* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-11-04 16:22 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2018-11-04 16:22 UTC (permalink / raw
To: gentoo-commits
commit: 4196ed330cd049bfd7781bc2f3e71b646e13a0bd
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 4 16:21:49 2018 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Sun Nov 4 16:21:49 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4196ed33
linux kernel 4.19.1
0000_README | 4 +
1000_linux_4.19.1.patch | 966 ++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 970 insertions(+)
diff --git a/0000_README b/0000_README
index 917d838..828fbcd 100644
--- a/0000_README
+++ b/0000_README
@@ -43,6 +43,10 @@ EXPERIMENTAL
Individual Patch Descriptions:
--------------------------------------------------------------------------
+Patch: 1000_linux-4.19.1.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.1
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1000_linux_4.19.1.patch b/1000_linux_4.19.1.patch
new file mode 100644
index 0000000..2274982
--- /dev/null
+++ b/1000_linux_4.19.1.patch
@@ -0,0 +1,966 @@
+diff --git a/Makefile b/Makefile
+index 69fa5c0310d8..abcd8ca4966f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 0
++SUBLEVEL = 1
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/sparc/include/asm/switch_to_64.h b/arch/sparc/include/asm/switch_to_64.h
+index 4ff29b1406a9..b1d4e2e3210f 100644
+--- a/arch/sparc/include/asm/switch_to_64.h
++++ b/arch/sparc/include/asm/switch_to_64.h
+@@ -67,6 +67,7 @@ do { save_and_clear_fpu(); \
+ } while(0)
+
+ void synchronize_user_stack(void);
+-void fault_in_user_windows(void);
++struct pt_regs;
++void fault_in_user_windows(struct pt_regs *);
+
+ #endif /* __SPARC64_SWITCH_TO_64_H */
+diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
+index 6c086086ca8f..59eaf6227af1 100644
+--- a/arch/sparc/kernel/process_64.c
++++ b/arch/sparc/kernel/process_64.c
+@@ -36,6 +36,7 @@
+ #include <linux/sysrq.h>
+ #include <linux/nmi.h>
+ #include <linux/context_tracking.h>
++#include <linux/signal.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/page.h>
+@@ -521,7 +522,12 @@ static void stack_unaligned(unsigned long sp)
+ force_sig_fault(SIGBUS, BUS_ADRALN, (void __user *) sp, 0, current);
+ }
+
+-void fault_in_user_windows(void)
++static const char uwfault32[] = KERN_INFO \
++ "%s[%d]: bad register window fault: SP %08lx (orig_sp %08lx) TPC %08lx O7 %08lx\n";
++static const char uwfault64[] = KERN_INFO \
++ "%s[%d]: bad register window fault: SP %016lx (orig_sp %016lx) TPC %08lx O7 %016lx\n";
++
++void fault_in_user_windows(struct pt_regs *regs)
+ {
+ struct thread_info *t = current_thread_info();
+ unsigned long window;
+@@ -534,9 +540,9 @@ void fault_in_user_windows(void)
+ do {
+ struct reg_window *rwin = &t->reg_window[window];
+ int winsize = sizeof(struct reg_window);
+- unsigned long sp;
++ unsigned long sp, orig_sp;
+
+- sp = t->rwbuf_stkptrs[window];
++ orig_sp = sp = t->rwbuf_stkptrs[window];
+
+ if (test_thread_64bit_stack(sp))
+ sp += STACK_BIAS;
+@@ -547,8 +553,16 @@ void fault_in_user_windows(void)
+ stack_unaligned(sp);
+
+ if (unlikely(copy_to_user((char __user *)sp,
+- rwin, winsize)))
++ rwin, winsize))) {
++ if (show_unhandled_signals)
++ printk_ratelimited(is_compat_task() ?
++ uwfault32 : uwfault64,
++ current->comm, current->pid,
++ sp, orig_sp,
++ regs->tpc,
++ regs->u_regs[UREG_I7]);
+ goto barf;
++ }
+ } while (window--);
+ }
+ set_thread_wsaved(0);
+@@ -556,8 +570,7 @@ void fault_in_user_windows(void)
+
+ barf:
+ set_thread_wsaved(window + 1);
+- user_exit();
+- do_exit(SIGILL);
++ force_sig(SIGSEGV, current);
+ }
+
+ asmlinkage long sparc_do_fork(unsigned long clone_flags,
+diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
+index 4073e2b87dd0..29aa34f11720 100644
+--- a/arch/sparc/kernel/rtrap_64.S
++++ b/arch/sparc/kernel/rtrap_64.S
+@@ -39,6 +39,7 @@ __handle_preemption:
+ wrpr %g0, RTRAP_PSTATE_IRQOFF, %pstate
+
+ __handle_user_windows:
++ add %sp, PTREGS_OFF, %o0
+ call fault_in_user_windows
+ 661: wrpr %g0, RTRAP_PSTATE, %pstate
+ /* If userspace is using ADI, it could potentially pass
+diff --git a/arch/sparc/kernel/signal32.c b/arch/sparc/kernel/signal32.c
+index 44d379db3f64..4c5b3fcbed94 100644
+--- a/arch/sparc/kernel/signal32.c
++++ b/arch/sparc/kernel/signal32.c
+@@ -371,7 +371,11 @@ static int setup_frame32(struct ksignal *ksig, struct pt_regs *regs,
+ get_sigframe(ksig, regs, sigframe_size);
+
+ if (invalid_frame_pointer(sf, sigframe_size)) {
+- do_exit(SIGILL);
++ if (show_unhandled_signals)
++ pr_info("%s[%d] bad frame in setup_frame32: %08lx TPC %08lx O7 %08lx\n",
++ current->comm, current->pid, (unsigned long)sf,
++ regs->tpc, regs->u_regs[UREG_I7]);
++ force_sigsegv(ksig->sig, current);
+ return -EINVAL;
+ }
+
+@@ -501,7 +505,11 @@ static int setup_rt_frame32(struct ksignal *ksig, struct pt_regs *regs,
+ get_sigframe(ksig, regs, sigframe_size);
+
+ if (invalid_frame_pointer(sf, sigframe_size)) {
+- do_exit(SIGILL);
++ if (show_unhandled_signals)
++ pr_info("%s[%d] bad frame in setup_rt_frame32: %08lx TPC %08lx O7 %08lx\n",
++ current->comm, current->pid, (unsigned long)sf,
++ regs->tpc, regs->u_regs[UREG_I7]);
++ force_sigsegv(ksig->sig, current);
+ return -EINVAL;
+ }
+
+diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
+index 48366e5eb5b2..e9de1803a22e 100644
+--- a/arch/sparc/kernel/signal_64.c
++++ b/arch/sparc/kernel/signal_64.c
+@@ -370,7 +370,11 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs)
+ get_sigframe(ksig, regs, sf_size);
+
+ if (invalid_frame_pointer (sf)) {
+- do_exit(SIGILL); /* won't return, actually */
++ if (show_unhandled_signals)
++ pr_info("%s[%d] bad frame in setup_rt_frame: %016lx TPC %016lx O7 %016lx\n",
++ current->comm, current->pid, (unsigned long)sf,
++ regs->tpc, regs->u_regs[UREG_I7]);
++ force_sigsegv(ksig->sig, current);
+ return -EINVAL;
+ }
+
+diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
+index bb68c805b891..ff9389a1c9f3 100644
+--- a/arch/sparc/kernel/systbls_64.S
++++ b/arch/sparc/kernel/systbls_64.S
+@@ -47,9 +47,9 @@ sys_call_table32:
+ .word sys_recvfrom, sys_setreuid16, sys_setregid16, sys_rename, compat_sys_truncate
+ /*130*/ .word compat_sys_ftruncate, sys_flock, compat_sys_lstat64, sys_sendto, sys_shutdown
+ .word sys_socketpair, sys_mkdir, sys_rmdir, compat_sys_utimes, compat_sys_stat64
+-/*140*/ .word sys_sendfile64, sys_nis_syscall, compat_sys_futex, sys_gettid, compat_sys_getrlimit
++/*140*/ .word sys_sendfile64, sys_getpeername, compat_sys_futex, sys_gettid, compat_sys_getrlimit
+ .word compat_sys_setrlimit, sys_pivot_root, sys_prctl, sys_pciconfig_read, sys_pciconfig_write
+-/*150*/ .word sys_nis_syscall, sys_inotify_init, sys_inotify_add_watch, sys_poll, sys_getdents64
++/*150*/ .word sys_getsockname, sys_inotify_init, sys_inotify_add_watch, sys_poll, sys_getdents64
+ .word compat_sys_fcntl64, sys_inotify_rm_watch, compat_sys_statfs, compat_sys_fstatfs, sys_oldumount
+ /*160*/ .word compat_sys_sched_setaffinity, compat_sys_sched_getaffinity, sys_getdomainname, sys_setdomainname, sys_nis_syscall
+ .word sys_quotactl, sys_set_tid_address, compat_sys_mount, compat_sys_ustat, sys_setxattr
+diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
+index f396048a0d68..39822f611c01 100644
+--- a/arch/sparc/mm/init_64.c
++++ b/arch/sparc/mm/init_64.c
+@@ -1383,6 +1383,7 @@ int __node_distance(int from, int to)
+ }
+ return numa_latency[from][to];
+ }
++EXPORT_SYMBOL(__node_distance);
+
+ static int __init find_best_numa_node_for_mlgroup(struct mdesc_mlgroup *grp)
+ {
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index b053179e0bc5..17eb09d222ff 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -1071,7 +1071,7 @@ __poll_t af_alg_poll(struct file *file, struct socket *sock,
+ struct af_alg_ctx *ctx = ask->private;
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ if (!ctx->more || ctx->used)
+diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
+index 9697977b80f0..6b9ad8673218 100644
+--- a/drivers/net/bonding/bond_netlink.c
++++ b/drivers/net/bonding/bond_netlink.c
+@@ -638,8 +638,7 @@ static int bond_fill_info(struct sk_buff *skb,
+ goto nla_put_failure;
+
+ if (nla_put(skb, IFLA_BOND_AD_ACTOR_SYSTEM,
+- sizeof(bond->params.ad_actor_system),
+- &bond->params.ad_actor_system))
++ ETH_ALEN, &bond->params.ad_actor_system))
+ goto nla_put_failure;
+ }
+ if (!bond_3ad_get_active_agg_info(bond, &info)) {
+diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
+index 58bcee8f0a58..ce041c90adb0 100644
+--- a/drivers/net/ethernet/emulex/benet/be.h
++++ b/drivers/net/ethernet/emulex/benet/be.h
+@@ -185,6 +185,7 @@ static inline void queue_tail_inc(struct be_queue_info *q)
+
+ struct be_eq_obj {
+ struct be_queue_info q;
++ char desc[32];
+
+ struct be_adapter *adapter;
+ struct napi_struct napi;
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index 534787291b44..bff74752cef1 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -3488,11 +3488,9 @@ static int be_msix_register(struct be_adapter *adapter)
+ int status, i, vec;
+
+ for_all_evt_queues(adapter, eqo, i) {
+- char irq_name[IFNAMSIZ+4];
+-
+- snprintf(irq_name, sizeof(irq_name), "%s-q%d", netdev->name, i);
++ sprintf(eqo->desc, "%s-q%d", netdev->name, i);
+ vec = be_msix_vec_get(adapter, eqo);
+- status = request_irq(vec, be_msix, 0, irq_name, eqo);
++ status = request_irq(vec, be_msix, 0, eqo->desc, eqo);
+ if (status)
+ goto err_msix;
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index 00172dee5339..a144146b769c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -696,43 +696,15 @@ static inline bool is_last_ethertype_ip(struct sk_buff *skb, int *network_depth)
+ return (ethertype == htons(ETH_P_IP) || ethertype == htons(ETH_P_IPV6));
+ }
+
+-static __be32 mlx5e_get_fcs(struct sk_buff *skb)
++static u32 mlx5e_get_fcs(const struct sk_buff *skb)
+ {
+- int last_frag_sz, bytes_in_prev, nr_frags;
+- u8 *fcs_p1, *fcs_p2;
+- skb_frag_t *last_frag;
+- __be32 fcs_bytes;
++ const void *fcs_bytes;
++ u32 _fcs_bytes;
+
+- if (!skb_is_nonlinear(skb))
+- return *(__be32 *)(skb->data + skb->len - ETH_FCS_LEN);
++ fcs_bytes = skb_header_pointer(skb, skb->len - ETH_FCS_LEN,
++ ETH_FCS_LEN, &_fcs_bytes);
+
+- nr_frags = skb_shinfo(skb)->nr_frags;
+- last_frag = &skb_shinfo(skb)->frags[nr_frags - 1];
+- last_frag_sz = skb_frag_size(last_frag);
+-
+- /* If all FCS data is in last frag */
+- if (last_frag_sz >= ETH_FCS_LEN)
+- return *(__be32 *)(skb_frag_address(last_frag) +
+- last_frag_sz - ETH_FCS_LEN);
+-
+- fcs_p2 = (u8 *)skb_frag_address(last_frag);
+- bytes_in_prev = ETH_FCS_LEN - last_frag_sz;
+-
+- /* Find where the other part of the FCS is - Linear or another frag */
+- if (nr_frags == 1) {
+- fcs_p1 = skb_tail_pointer(skb);
+- } else {
+- skb_frag_t *prev_frag = &skb_shinfo(skb)->frags[nr_frags - 2];
+-
+- fcs_p1 = skb_frag_address(prev_frag) +
+- skb_frag_size(prev_frag);
+- }
+- fcs_p1 -= bytes_in_prev;
+-
+- memcpy(&fcs_bytes, fcs_p1, bytes_in_prev);
+- memcpy(((u8 *)&fcs_bytes) + bytes_in_prev, fcs_p2, last_frag_sz);
+-
+- return fcs_bytes;
++ return __get_unaligned_cpu32(fcs_bytes);
+ }
+
+ static inline void mlx5e_handle_csum(struct net_device *netdev,
+@@ -765,8 +737,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ network_depth - ETH_HLEN,
+ skb->csum);
+ if (unlikely(netdev->features & NETIF_F_RXFCS))
+- skb->csum = csum_add(skb->csum,
+- (__force __wsum)mlx5e_get_fcs(skb));
++ skb->csum = csum_block_add(skb->csum,
++ (__force __wsum)mlx5e_get_fcs(skb),
++ skb->len - ETH_FCS_LEN);
+ stats->csum_complete++;
+ return;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index 937d0ace699a..30f751e69698 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -943,8 +943,8 @@ static int mlxsw_devlink_core_bus_device_reload(struct devlink *devlink,
+ mlxsw_core->bus,
+ mlxsw_core->bus_priv, true,
+ devlink);
+- if (err)
+- mlxsw_core->reload_fail = true;
++ mlxsw_core->reload_fail = !!err;
++
+ return err;
+ }
+
+@@ -1083,8 +1083,15 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
+ {
+ struct devlink *devlink = priv_to_devlink(mlxsw_core);
+
+- if (mlxsw_core->reload_fail)
+- goto reload_fail;
++ if (mlxsw_core->reload_fail) {
++ if (!reload)
++ /* Only the parts that were not de-initialized in the
++ * failed reload attempt need to be de-initialized.
++ */
++ goto reload_fail_deinit;
++ else
++ return;
++ }
+
+ if (mlxsw_core->driver->fini)
+ mlxsw_core->driver->fini(mlxsw_core);
+@@ -1098,9 +1105,12 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
+ if (!reload)
+ devlink_resources_unregister(devlink, NULL);
+ mlxsw_core->bus->fini(mlxsw_core->bus_priv);
+- if (reload)
+- return;
+-reload_fail:
++
++ return;
++
++reload_fail_deinit:
++ devlink_unregister(devlink);
++ devlink_resources_unregister(devlink, NULL);
+ devlink_free(devlink);
+ }
+ EXPORT_SYMBOL(mlxsw_core_bus_device_unregister);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index db715da7bab7..7715f1ed2bcb 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -2317,8 +2317,6 @@ static void mlxsw_sp_switchdev_event_work(struct work_struct *work)
+ break;
+ case SWITCHDEV_FDB_DEL_TO_DEVICE:
+ fdb_info = &switchdev_work->fdb_info;
+- if (!fdb_info->added_by_user)
+- break;
+ mlxsw_sp_port_fdb_set(mlxsw_sp_port, fdb_info, false);
+ break;
+ case SWITCHDEV_FDB_ADD_TO_BRIDGE: /* fall through */
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 2c350099b83c..4930e0375c1d 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -4175,10 +4175,15 @@ static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
+
+ static bool rtl_wol_pll_power_down(struct rtl8169_private *tp)
+ {
+- if (!netif_running(tp->dev) || !__rtl8169_get_wol(tp))
++ struct phy_device *phydev;
++
++ if (!__rtl8169_get_wol(tp))
+ return false;
+
+- phy_speed_down(tp->dev->phydev, false);
++ /* phydev may not be attached to netdevice */
++ phydev = mdiobus_get_phy(tp->mii_bus, 0);
++
++ phy_speed_down(phydev, false);
+ rtl_wol_suspend_quirk(tp);
+
+ return true;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+index b72ef171477e..bdd351597b55 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+@@ -243,7 +243,7 @@ static int stmmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg,
+ */
+ int stmmac_mdio_reset(struct mii_bus *bus)
+ {
+-#if defined(CONFIG_STMMAC_PLATFORM)
++#if IS_ENABLED(CONFIG_STMMAC_PLATFORM)
+ struct net_device *ndev = bus->priv;
+ struct stmmac_priv *priv = netdev_priv(ndev);
+ unsigned int mii_address = priv->hw->mii.addr;
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index b13c6b4b2c66..eb95daa3e5a5 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -30,6 +30,7 @@
+ #include <linux/sched/mm.h>
+ #include <linux/sched/signal.h>
+ #include <linux/interval_tree_generic.h>
++#include <linux/nospec.h>
+
+ #include "vhost.h"
+
+@@ -1397,6 +1398,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *arg
+ if (idx >= d->nvqs)
+ return -ENOBUFS;
+
++ idx = array_index_nospec(idx, d->nvqs);
+ vq = d->vqs[idx];
+
+ mutex_lock(&vq->mutex);
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 433f45fc2d68..c64a1cff9eb3 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -2057,14 +2057,20 @@ static inline bool skwq_has_sleeper(struct socket_wq *wq)
+ /**
+ * sock_poll_wait - place memory barrier behind the poll_wait call.
+ * @filp: file
++ * @sock: socket to wait on
+ * @p: poll_table
+ *
+ * See the comments in the wq_has_sleeper function.
++ *
++ * Do not derive sock from filp->private_data here. An SMC socket establishes
++ * an internal TCP socket that is used in the fallback case. All socket
++ * operations on the SMC socket are then forwarded to the TCP socket. In case of
++ * poll, the filp->private_data pointer references the SMC socket because the
++ * TCP socket has no file assigned.
+ */
+-static inline void sock_poll_wait(struct file *filp, poll_table *p)
++static inline void sock_poll_wait(struct file *filp, struct socket *sock,
++ poll_table *p)
+ {
+- struct socket *sock = filp->private_data;
+-
+ if (!poll_does_not_wait(p)) {
+ poll_wait(filp, &sock->wq->wait, p);
+ /* We need to be sure we are in sync with the
+diff --git a/net/atm/common.c b/net/atm/common.c
+index 9f8cb0d2e71e..a38c174fc766 100644
+--- a/net/atm/common.c
++++ b/net/atm/common.c
+@@ -653,7 +653,7 @@ __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
+ struct atm_vcc *vcc;
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ vcc = ATM_SD(sock);
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 20ed7adcf1cc..6dec8e9b3451 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1420,7 +1420,14 @@ static void br_multicast_query_received(struct net_bridge *br,
+ return;
+
+ br_multicast_update_query_timer(br, query, max_delay);
+- br_multicast_mark_router(br, port);
++
++ /* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules,
++ * the arrival port for IGMP Queries where the source address
++ * is 0.0.0.0 should not be added to router port list.
++ */
++ if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) ||
++ saddr->proto == htons(ETH_P_IPV6))
++ br_multicast_mark_router(br, port);
+ }
+
+ static void br_ip4_multicast_query(struct net_bridge *br,
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index d18965f3291f..416717c57cd1 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -941,7 +941,7 @@ static __poll_t caif_poll(struct file *file,
+ __poll_t mask;
+ struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ /* exceptional events? */
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index 9aac0d63d53e..57f3a6fcfc1e 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -808,8 +808,9 @@ int skb_copy_and_csum_datagram_msg(struct sk_buff *skb,
+ return -EINVAL;
+ }
+
+- if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE))
+- netdev_rx_csum_fault(skb->dev);
++ if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE) &&
++ !skb->csum_complete_sw)
++ netdev_rx_csum_fault(NULL);
+ }
+ return 0;
+ fault:
+@@ -837,7 +838,7 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
+ struct sock *sk = sock->sk;
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ /* exceptional events? */
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 93243479085f..e16ba3625400 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5431,6 +5431,7 @@ static void gro_flush_oldest(struct list_head *head)
+ * SKB to the chain.
+ */
+ list_del(&oldest->list);
++ oldest->next = NULL;
+ napi_gro_complete(oldest);
+ }
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 37c7936124e6..6e5d61a20a70 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -3530,6 +3530,11 @@ static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh,
+ return -EINVAL;
+ }
+
++ if (dev->type != ARPHRD_ETHER) {
++ NL_SET_ERR_MSG(extack, "FDB delete only supported for Ethernet devices");
++ return -EINVAL;
++ }
++
+ addr = nla_data(tb[NDA_LLADDR]);
+
+ err = fdb_vid_parse(tb[NDA_VLAN], &vid, extack);
+@@ -3634,6 +3639,11 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,
+ return -EINVAL;
+ }
+
++ if (dev->type != ARPHRD_ETHER) {
++ NL_SET_ERR_MSG(extack, "FDB add only supported for Ethernet devices");
++ return -EINVAL;
++ }
++
+ addr = nla_data(tb[NDA_LLADDR]);
+
+ err = fdb_vid_parse(tb[NDA_VLAN], &vid, extack);
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c
+index 875858c8b059..43733accf58e 100644
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -325,7 +325,7 @@ __poll_t dccp_poll(struct file *file, struct socket *sock,
+ __poll_t mask;
+ struct sock *sk = sock->sk;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ if (sk->sk_state == DCCP_LISTEN)
+ return inet_csk_listen_poll(sk);
+
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index e7227128df2c..cb8fa5d7afe1 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -720,10 +720,14 @@ struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user)
+ if (ip_is_fragment(&iph)) {
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (skb) {
+- if (!pskb_may_pull(skb, netoff + iph.ihl * 4))
+- return skb;
+- if (pskb_trim_rcsum(skb, netoff + len))
+- return skb;
++ if (!pskb_may_pull(skb, netoff + iph.ihl * 4)) {
++ kfree_skb(skb);
++ return NULL;
++ }
++ if (pskb_trim_rcsum(skb, netoff + len)) {
++ kfree_skb(skb);
++ return NULL;
++ }
+ memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+ if (ip_defrag(net, skb, user))
+ return NULL;
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 10c6246396cc..bbd07736fb0f 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -507,7 +507,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ const struct tcp_sock *tp = tcp_sk(sk);
+ int state;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+
+ state = inet_sk_state_load(sk);
+ if (state == TCP_LISTEN)
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index c32a4c16b7ff..f8183fdce5b2 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2120,8 +2120,24 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
+ /* Note, we are only interested in != 0 or == 0, thus the
+ * force to int.
+ */
+- return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
+- inet_compute_pseudo);
++ err = (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
++ inet_compute_pseudo);
++ if (err)
++ return err;
++
++ if (skb->ip_summed == CHECKSUM_COMPLETE && !skb->csum_valid) {
++ /* If SW calculated the value, we know it's bad */
++ if (skb->csum_complete_sw)
++ return 1;
++
++ /* HW says the value is bad. Let's validate that.
++ * skb->csum is no longer the full packet checksum,
++ * so don't treat it as such.
++ */
++ skb_checksum_complete_unset(skb);
++ }
++
++ return 0;
+ }
+
+ /* wrapper for udp_queue_rcv_skb tacking care of csum conversion and
+diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c
+index 547515e8450a..377717045f8f 100644
+--- a/net/ipv6/ip6_checksum.c
++++ b/net/ipv6/ip6_checksum.c
+@@ -88,8 +88,24 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
+ * Note, we are only interested in != 0 or == 0, thus the
+ * force to int.
+ */
+- return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
+- ip6_compute_pseudo);
++ err = (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
++ ip6_compute_pseudo);
++ if (err)
++ return err;
++
++ if (skb->ip_summed == CHECKSUM_COMPLETE && !skb->csum_valid) {
++ /* If SW calculated the value, we know it's bad */
++ if (skb->csum_complete_sw)
++ return 1;
++
++ /* HW says the value is bad. Let's validate that.
++ * skb->csum is no longer the full packet checksum,
++ * so don't treat is as such.
++ */
++ skb_checksum_complete_unset(skb);
++ }
++
++ return 0;
+ }
+ EXPORT_SYMBOL(udp6_csum_init);
+
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index 0ec273997d1d..673a4a932f2a 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -1732,10 +1732,9 @@ int ndisc_rcv(struct sk_buff *skb)
+ return 0;
+ }
+
+- memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
+-
+ switch (msg->icmph.icmp6_type) {
+ case NDISC_NEIGHBOUR_SOLICITATION:
++ memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
+ ndisc_recv_ns(skb);
+ break;
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index abcb5ae77319..1cf00d857fc1 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2799,6 +2799,8 @@ static int ip6_route_check_nh_onlink(struct net *net,
+ grt = ip6_nh_lookup_table(net, cfg, gw_addr, tbid, 0);
+ if (grt) {
+ if (!grt->dst.error &&
++ /* ignore match if it is the default route */
++ grt->from && !ipv6_addr_any(&grt->from->fib6_dst.addr) &&
+ (grt->rt6i_flags & flags || dev != grt->dst.dev)) {
+ NL_SET_ERR_MSG(extack,
+ "Nexthop has invalid gateway or device mismatch");
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index e2f16a0173a9..f024914da1b2 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -1505,7 +1505,7 @@ __poll_t iucv_sock_poll(struct file *file, struct socket *sock,
+ struct sock *sk = sock->sk;
+ __poll_t mask = 0;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+
+ if (sk->sk_state == IUCV_LISTEN)
+ return iucv_accept_poll(sk);
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index dd4adf8b1167..ae296273ce3d 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -556,7 +556,7 @@ static __poll_t llcp_sock_poll(struct file *file, struct socket *sock,
+
+ pr_debug("%p\n", sk);
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+
+ if (sk->sk_state == LLCP_LISTEN)
+ return llcp_accept_poll(sk);
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index a70097ecf33c..865ecef68196 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -3030,7 +3030,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ * is already present */
+ if (mac_proto != MAC_PROTO_NONE)
+ return -EINVAL;
+- mac_proto = MAC_PROTO_NONE;
++ mac_proto = MAC_PROTO_ETHERNET;
+ break;
+
+ case OVS_ACTION_ATTR_POP_ETH:
+@@ -3038,7 +3038,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ return -EINVAL;
+ if (vlan_tci & htons(VLAN_TAG_PRESENT))
+ return -EINVAL;
+- mac_proto = MAC_PROTO_ETHERNET;
++ mac_proto = MAC_PROTO_NONE;
+ break;
+
+ case OVS_ACTION_ATTR_PUSH_NSH:
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index ac44d8afffb1..3c39b8805d01 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -741,7 +741,7 @@ static __poll_t rxrpc_poll(struct file *file, struct socket *sock,
+ struct rxrpc_sock *rx = rxrpc_sk(sk);
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ /* the socket is readable if there are any messages waiting on the Rx
+diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
+index cbe4831f46f4..4a042abf844c 100644
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -413,7 +413,7 @@ static int gred_change(struct Qdisc *sch, struct nlattr *opt,
+ if (tb[TCA_GRED_PARMS] == NULL && tb[TCA_GRED_STAB] == NULL) {
+ if (tb[TCA_GRED_LIMIT] != NULL)
+ sch->limit = nla_get_u32(tb[TCA_GRED_LIMIT]);
+- return gred_change_table_def(sch, opt);
++ return gred_change_table_def(sch, tb[TCA_GRED_DPS]);
+ }
+
+ if (tb[TCA_GRED_PARMS] == NULL ||
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index c1c1bda334a4..c1693e28aed4 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -7101,14 +7101,15 @@ static int sctp_getsockopt_pr_assocstatus(struct sock *sk, int len,
+ }
+
+ policy = params.sprstat_policy;
+- if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)))
++ if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)) ||
++ ((policy & SCTP_PR_SCTP_ALL) && (policy & SCTP_PR_SCTP_MASK)))
+ goto out;
+
+ asoc = sctp_id2assoc(sk, params.sprstat_assoc_id);
+ if (!asoc)
+ goto out;
+
+- if (policy & SCTP_PR_SCTP_ALL) {
++ if (policy == SCTP_PR_SCTP_ALL) {
+ params.sprstat_abandoned_unsent = 0;
+ params.sprstat_abandoned_sent = 0;
+ for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) {
+@@ -7160,7 +7161,8 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
+ }
+
+ policy = params.sprstat_policy;
+- if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)))
++ if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)) ||
++ ((policy & SCTP_PR_SCTP_ALL) && (policy & SCTP_PR_SCTP_MASK)))
+ goto out;
+
+ asoc = sctp_id2assoc(sk, params.sprstat_assoc_id);
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 015231789ed2..80e2119f1c70 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1543,7 +1543,7 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
+ mask |= EPOLLERR;
+ } else {
+ if (sk->sk_state != SMC_CLOSED)
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ if (sk->sk_err)
+ mask |= EPOLLERR;
+ if ((sk->sk_shutdown == SHUTDOWN_MASK) ||
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index e871368500e3..18daebcef181 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -122,22 +122,17 @@ static void __smc_lgr_unregister_conn(struct smc_connection *conn)
+ sock_put(&smc->sk); /* sock_hold in smc_lgr_register_conn() */
+ }
+
+-/* Unregister connection and trigger lgr freeing if applicable
++/* Unregister connection from lgr
+ */
+ static void smc_lgr_unregister_conn(struct smc_connection *conn)
+ {
+ struct smc_link_group *lgr = conn->lgr;
+- int reduced = 0;
+
+ write_lock_bh(&lgr->conns_lock);
+ if (conn->alert_token_local) {
+- reduced = 1;
+ __smc_lgr_unregister_conn(conn);
+ }
+ write_unlock_bh(&lgr->conns_lock);
+- if (!reduced || lgr->conns_num)
+- return;
+- smc_lgr_schedule_free_work(lgr);
+ }
+
+ /* Send delete link, either as client to request the initiation
+@@ -291,7 +286,8 @@ out:
+ return rc;
+ }
+
+-static void smc_buf_unuse(struct smc_connection *conn)
++static void smc_buf_unuse(struct smc_connection *conn,
++ struct smc_link_group *lgr)
+ {
+ if (conn->sndbuf_desc)
+ conn->sndbuf_desc->used = 0;
+@@ -301,8 +297,6 @@ static void smc_buf_unuse(struct smc_connection *conn)
+ conn->rmb_desc->used = 0;
+ } else {
+ /* buf registration failed, reuse not possible */
+- struct smc_link_group *lgr = conn->lgr;
+-
+ write_lock_bh(&lgr->rmbs_lock);
+ list_del(&conn->rmb_desc->list);
+ write_unlock_bh(&lgr->rmbs_lock);
+@@ -315,16 +309,21 @@ static void smc_buf_unuse(struct smc_connection *conn)
+ /* remove a finished connection from its link group */
+ void smc_conn_free(struct smc_connection *conn)
+ {
+- if (!conn->lgr)
++ struct smc_link_group *lgr = conn->lgr;
++
++ if (!lgr)
+ return;
+- if (conn->lgr->is_smcd) {
++ if (lgr->is_smcd) {
+ smc_ism_unset_conn(conn);
+ tasklet_kill(&conn->rx_tsklet);
+ } else {
+ smc_cdc_tx_dismiss_slots(conn);
+ }
+- smc_lgr_unregister_conn(conn);
+- smc_buf_unuse(conn);
++ smc_lgr_unregister_conn(conn); /* unsets conn->lgr */
++ smc_buf_unuse(conn, lgr); /* allow buffer reuse */
++
++ if (!lgr->conns_num)
++ smc_lgr_schedule_free_work(lgr);
+ }
+
+ static void smc_link_clear(struct smc_link *lnk)
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 49810fdff4c5..0bf8ad486c5e 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -715,7 +715,7 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
+ struct tipc_sock *tsk = tipc_sk(sk);
+ __poll_t revents = 0;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+
+ if (sk->sk_shutdown & RCV_SHUTDOWN)
+ revents |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index d1edfa3cad61..c754f3a90a2e 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -2640,7 +2640,7 @@ static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wa
+ struct sock *sk = sock->sk;
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ /* exceptional events? */
+@@ -2677,7 +2677,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
+ unsigned int writable;
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ /* exceptional events? */
+diff --git a/tools/testing/selftests/net/fib-onlink-tests.sh b/tools/testing/selftests/net/fib-onlink-tests.sh
+index 3991ad1a368d..864f865eee55 100755
+--- a/tools/testing/selftests/net/fib-onlink-tests.sh
++++ b/tools/testing/selftests/net/fib-onlink-tests.sh
+@@ -167,8 +167,8 @@ setup()
+ # add vrf table
+ ip li add ${VRF} type vrf table ${VRF_TABLE}
+ ip li set ${VRF} up
+- ip ro add table ${VRF_TABLE} unreachable default
+- ip -6 ro add table ${VRF_TABLE} unreachable default
++ ip ro add table ${VRF_TABLE} unreachable default metric 8192
++ ip -6 ro add table ${VRF_TABLE} unreachable default metric 8192
+
+ # create test interfaces
+ ip li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]}
+@@ -185,20 +185,20 @@ setup()
+ for n in 1 3 5 7; do
+ ip li set ${NETIFS[p${n}]} up
+ ip addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
+- ip addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]}
++ ip addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad
+ done
+
+ # move peer interfaces to namespace and add addresses
+ for n in 2 4 6 8; do
+ ip li set ${NETIFS[p${n}]} netns ${PEER_NS} up
+ ip -netns ${PEER_NS} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
+- ip -netns ${PEER_NS} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]}
++ ip -netns ${PEER_NS} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad
+ done
+
+- set +e
++ ip -6 ro add default via ${V6ADDRS[p3]/::[0-9]/::64}
++ ip -6 ro add table ${VRF_TABLE} default via ${V6ADDRS[p7]/::[0-9]/::64}
+
+- # let DAD complete - assume default of 1 probe
+- sleep 1
++ set +e
+ }
+
+ cleanup()
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-11-13 20:44 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-11-13 20:44 UTC (permalink / raw
To: gentoo-commits
commit: 99c3f5dad08df87ebbe027d84f40a78a641f22c4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 13 20:44:05 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 13 20:44:05 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=99c3f5da
Linux patch 4.19.2
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1001_linux-4.19.2.patch | 15435 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 15439 insertions(+)
diff --git a/0000_README b/0000_README
index 828fbcd..6b0adb6 100644
--- a/0000_README
+++ b/0000_README
@@ -47,6 +47,10 @@ Patch: 1000_linux-4.19.1.patch
From: http://www.kernel.org
Desc: Linux 4.19.1
+Patch: 1001_linux-4.19.2.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.2
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1001_linux-4.19.2.patch b/1001_linux-4.19.2.patch
new file mode 100644
index 0000000..62ce83c
--- /dev/null
+++ b/1001_linux-4.19.2.patch
@@ -0,0 +1,15435 @@
+diff --git a/Documentation/filesystems/fscrypt.rst b/Documentation/filesystems/fscrypt.rst
+index 48b424de85bb..cfbc18f0d9c9 100644
+--- a/Documentation/filesystems/fscrypt.rst
++++ b/Documentation/filesystems/fscrypt.rst
+@@ -191,21 +191,11 @@ Currently, the following pairs of encryption modes are supported:
+
+ - AES-256-XTS for contents and AES-256-CTS-CBC for filenames
+ - AES-128-CBC for contents and AES-128-CTS-CBC for filenames
+-- Speck128/256-XTS for contents and Speck128/256-CTS-CBC for filenames
+
+ It is strongly recommended to use AES-256-XTS for contents encryption.
+ AES-128-CBC was added only for low-powered embedded devices with
+ crypto accelerators such as CAAM or CESA that do not support XTS.
+
+-Similarly, Speck128/256 support was only added for older or low-end
+-CPUs which cannot do AES fast enough -- especially ARM CPUs which have
+-NEON instructions but not the Cryptography Extensions -- and for which
+-it would not otherwise be feasible to use encryption at all. It is
+-not recommended to use Speck on CPUs that have AES instructions.
+-Speck support is only available if it has been enabled in the crypto
+-API via CONFIG_CRYPTO_SPECK. Also, on ARM platforms, to get
+-acceptable performance CONFIG_CRYPTO_SPECK_NEON must be enabled.
+-
+ New encryption modes can be added relatively easily, without changes
+ to individual filesystems. However, authenticated encryption (AE)
+ modes are not currently supported because of the difficulty of dealing
+diff --git a/Documentation/media/uapi/cec/cec-ioc-receive.rst b/Documentation/media/uapi/cec/cec-ioc-receive.rst
+index e964074cd15b..b25e48afaa08 100644
+--- a/Documentation/media/uapi/cec/cec-ioc-receive.rst
++++ b/Documentation/media/uapi/cec/cec-ioc-receive.rst
+@@ -16,10 +16,10 @@ CEC_RECEIVE, CEC_TRANSMIT - Receive or transmit a CEC message
+ Synopsis
+ ========
+
+-.. c:function:: int ioctl( int fd, CEC_RECEIVE, struct cec_msg *argp )
++.. c:function:: int ioctl( int fd, CEC_RECEIVE, struct cec_msg \*argp )
+ :name: CEC_RECEIVE
+
+-.. c:function:: int ioctl( int fd, CEC_TRANSMIT, struct cec_msg *argp )
++.. c:function:: int ioctl( int fd, CEC_TRANSMIT, struct cec_msg \*argp )
+ :name: CEC_TRANSMIT
+
+ Arguments
+@@ -272,6 +272,19 @@ View On' messages from initiator 0xf ('Unregistered') to destination 0 ('TV').
+ - The transmit failed after one or more retries. This status bit is
+ mutually exclusive with :ref:`CEC_TX_STATUS_OK <CEC-TX-STATUS-OK>`.
+ Other bits can still be set to explain which failures were seen.
++ * .. _`CEC-TX-STATUS-ABORTED`:
++
++ - ``CEC_TX_STATUS_ABORTED``
++ - 0x40
++ - The transmit was aborted due to an HDMI disconnect, or the adapter
++ was unconfigured, or a transmit was interrupted, or the driver
++ returned an error when attempting to start a transmit.
++ * .. _`CEC-TX-STATUS-TIMEOUT`:
++
++ - ``CEC_TX_STATUS_TIMEOUT``
++ - 0x80
++ - The transmit timed out. This should not normally happen and this
++ indicates a driver problem.
+
+
+ .. tabularcolumns:: |p{5.6cm}|p{0.9cm}|p{11.0cm}|
+@@ -300,6 +313,14 @@ View On' messages from initiator 0xf ('Unregistered') to destination 0 ('TV').
+ - The message was received successfully but the reply was
+ ``CEC_MSG_FEATURE_ABORT``. This status is only set if this message
+ was the reply to an earlier transmitted message.
++ * .. _`CEC-RX-STATUS-ABORTED`:
++
++ - ``CEC_RX_STATUS_ABORTED``
++ - 0x08
++ - The wait for a reply to an earlier transmitted message was aborted
++ because the HDMI cable was disconnected, the adapter was unconfigured
++ or the :ref:`CEC_TRANSMIT <CEC_RECEIVE>` that waited for a
++ reply was interrupted.
+
+
+
+diff --git a/Documentation/media/uapi/v4l/biblio.rst b/Documentation/media/uapi/v4l/biblio.rst
+index 1cedcfc04327..386d6cf83e9c 100644
+--- a/Documentation/media/uapi/v4l/biblio.rst
++++ b/Documentation/media/uapi/v4l/biblio.rst
+@@ -226,16 +226,6 @@ xvYCC
+
+ :author: International Electrotechnical Commission (http://www.iec.ch)
+
+-.. _adobergb:
+-
+-AdobeRGB
+-========
+-
+-
+-:title: Adobe© RGB (1998) Color Image Encoding Version 2005-05
+-
+-:author: Adobe Systems Incorporated (http://www.adobe.com)
+-
+ .. _oprgb:
+
+ opRGB
+diff --git a/Documentation/media/uapi/v4l/colorspaces-defs.rst b/Documentation/media/uapi/v4l/colorspaces-defs.rst
+index 410907fe9415..f24615544792 100644
+--- a/Documentation/media/uapi/v4l/colorspaces-defs.rst
++++ b/Documentation/media/uapi/v4l/colorspaces-defs.rst
+@@ -51,8 +51,8 @@ whole range, 0-255, dividing the angular value by 1.41. The enum
+ - See :ref:`col-rec709`.
+ * - ``V4L2_COLORSPACE_SRGB``
+ - See :ref:`col-srgb`.
+- * - ``V4L2_COLORSPACE_ADOBERGB``
+- - See :ref:`col-adobergb`.
++ * - ``V4L2_COLORSPACE_OPRGB``
++ - See :ref:`col-oprgb`.
+ * - ``V4L2_COLORSPACE_BT2020``
+ - See :ref:`col-bt2020`.
+ * - ``V4L2_COLORSPACE_DCI_P3``
+@@ -90,8 +90,8 @@ whole range, 0-255, dividing the angular value by 1.41. The enum
+ - Use the Rec. 709 transfer function.
+ * - ``V4L2_XFER_FUNC_SRGB``
+ - Use the sRGB transfer function.
+- * - ``V4L2_XFER_FUNC_ADOBERGB``
+- - Use the AdobeRGB transfer function.
++ * - ``V4L2_XFER_FUNC_OPRGB``
++ - Use the opRGB transfer function.
+ * - ``V4L2_XFER_FUNC_SMPTE240M``
+ - Use the SMPTE 240M transfer function.
+ * - ``V4L2_XFER_FUNC_NONE``
+diff --git a/Documentation/media/uapi/v4l/colorspaces-details.rst b/Documentation/media/uapi/v4l/colorspaces-details.rst
+index b5d551b9cc8f..09fabf4cd412 100644
+--- a/Documentation/media/uapi/v4l/colorspaces-details.rst
++++ b/Documentation/media/uapi/v4l/colorspaces-details.rst
+@@ -290,15 +290,14 @@ Y' is clamped to the range [0…1] and Cb and Cr are clamped to the range
+ 170M/BT.601. The Y'CbCr quantization is limited range.
+
+
+-.. _col-adobergb:
++.. _col-oprgb:
+
+-Colorspace Adobe RGB (V4L2_COLORSPACE_ADOBERGB)
++Colorspace opRGB (V4L2_COLORSPACE_OPRGB)
+ ===============================================
+
+-The :ref:`adobergb` standard defines the colorspace used by computer
+-graphics that use the AdobeRGB colorspace. This is also known as the
+-:ref:`oprgb` standard. The default transfer function is
+-``V4L2_XFER_FUNC_ADOBERGB``. The default Y'CbCr encoding is
++The :ref:`oprgb` standard defines the colorspace used by computer
++graphics that use the opRGB colorspace. The default transfer function is
++``V4L2_XFER_FUNC_OPRGB``. The default Y'CbCr encoding is
+ ``V4L2_YCBCR_ENC_601``. The default Y'CbCr quantization is limited
+ range.
+
+@@ -312,7 +311,7 @@ The chromaticities of the primary colors and the white reference are:
+
+ .. tabularcolumns:: |p{4.4cm}|p{4.4cm}|p{8.7cm}|
+
+-.. flat-table:: Adobe RGB Chromaticities
++.. flat-table:: opRGB Chromaticities
+ :header-rows: 1
+ :stub-columns: 0
+ :widths: 1 1 2
+diff --git a/Documentation/media/videodev2.h.rst.exceptions b/Documentation/media/videodev2.h.rst.exceptions
+index ca9f0edc579e..e420a39f1ebf 100644
+--- a/Documentation/media/videodev2.h.rst.exceptions
++++ b/Documentation/media/videodev2.h.rst.exceptions
+@@ -56,7 +56,8 @@ replace symbol V4L2_MEMORY_USERPTR :c:type:`v4l2_memory`
+ # Documented enum v4l2_colorspace
+ replace symbol V4L2_COLORSPACE_470_SYSTEM_BG :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_470_SYSTEM_M :c:type:`v4l2_colorspace`
+-replace symbol V4L2_COLORSPACE_ADOBERGB :c:type:`v4l2_colorspace`
++replace symbol V4L2_COLORSPACE_OPRGB :c:type:`v4l2_colorspace`
++replace define V4L2_COLORSPACE_ADOBERGB :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_BT2020 :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_DCI_P3 :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_DEFAULT :c:type:`v4l2_colorspace`
+@@ -69,7 +70,8 @@ replace symbol V4L2_COLORSPACE_SRGB :c:type:`v4l2_colorspace`
+
+ # Documented enum v4l2_xfer_func
+ replace symbol V4L2_XFER_FUNC_709 :c:type:`v4l2_xfer_func`
+-replace symbol V4L2_XFER_FUNC_ADOBERGB :c:type:`v4l2_xfer_func`
++replace symbol V4L2_XFER_FUNC_OPRGB :c:type:`v4l2_xfer_func`
++replace define V4L2_XFER_FUNC_ADOBERGB :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_DCI_P3 :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_DEFAULT :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_NONE :c:type:`v4l2_xfer_func`
+diff --git a/Makefile b/Makefile
+index abcd8ca4966f..c8fe567f18ab 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 1
++SUBLEVEL = 2
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index a0ddf497e8cd..2cb45ddd2ae3 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -354,7 +354,7 @@
+ ti,hwmods = "pcie1";
+ phys = <&pcie1_phy>;
+ phy-names = "pcie-phy0";
+- ti,syscon-unaligned-access = <&scm_conf1 0x14 2>;
++ ti,syscon-unaligned-access = <&scm_conf1 0x14 1>;
+ status = "disabled";
+ };
+ };
+diff --git a/arch/arm/boot/dts/exynos4210-origen.dts b/arch/arm/boot/dts/exynos4210-origen.dts
+index 2ab99f9f3d0a..dd9ec05eb0f7 100644
+--- a/arch/arm/boot/dts/exynos4210-origen.dts
++++ b/arch/arm/boot/dts/exynos4210-origen.dts
+@@ -151,6 +151,8 @@
+ reg = <0x66>;
+ interrupt-parent = <&gpx0>;
+ interrupts = <4 IRQ_TYPE_NONE>, <3 IRQ_TYPE_NONE>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&max8997_irq>;
+
+ max8997,pmic-buck1-dvs-voltage = <1350000>;
+ max8997,pmic-buck2-dvs-voltage = <1100000>;
+@@ -288,6 +290,13 @@
+ };
+ };
+
++&pinctrl_1 {
++ max8997_irq: max8997-irq {
++ samsung,pins = "gpx0-3", "gpx0-4";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
++};
++
+ &sdhci_0 {
+ bus-width = <4>;
+ pinctrl-0 = <&sd0_clk &sd0_cmd &sd0_bus4 &sd0_cd>;
+diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
+index da163a40af15..b85527faa6ea 100644
+--- a/arch/arm/boot/dts/exynos5250.dtsi
++++ b/arch/arm/boot/dts/exynos5250.dtsi
+@@ -54,62 +54,109 @@
+ device_type = "cpu";
+ compatible = "arm,cortex-a15";
+ reg = <0>;
+- clock-frequency = <1700000000>;
+ clocks = <&clock CLK_ARM_CLK>;
+ clock-names = "cpu";
+- clock-latency = <140000>;
+-
+- operating-points = <
+- 1700000 1300000
+- 1600000 1250000
+- 1500000 1225000
+- 1400000 1200000
+- 1300000 1150000
+- 1200000 1125000
+- 1100000 1100000
+- 1000000 1075000
+- 900000 1050000
+- 800000 1025000
+- 700000 1012500
+- 600000 1000000
+- 500000 975000
+- 400000 950000
+- 300000 937500
+- 200000 925000
+- >;
++ operating-points-v2 = <&cpu0_opp_table>;
+ #cooling-cells = <2>; /* min followed by max */
+ };
+ cpu@1 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a15";
+ reg = <1>;
+- clock-frequency = <1700000000>;
+ clocks = <&clock CLK_ARM_CLK>;
+ clock-names = "cpu";
+- clock-latency = <140000>;
+-
+- operating-points = <
+- 1700000 1300000
+- 1600000 1250000
+- 1500000 1225000
+- 1400000 1200000
+- 1300000 1150000
+- 1200000 1125000
+- 1100000 1100000
+- 1000000 1075000
+- 900000 1050000
+- 800000 1025000
+- 700000 1012500
+- 600000 1000000
+- 500000 975000
+- 400000 950000
+- 300000 937500
+- 200000 925000
+- >;
++ operating-points-v2 = <&cpu0_opp_table>;
+ #cooling-cells = <2>; /* min followed by max */
+ };
+ };
+
++ cpu0_opp_table: opp_table0 {
++ compatible = "operating-points-v2";
++ opp-shared;
++
++ opp-200000000 {
++ opp-hz = /bits/ 64 <200000000>;
++ opp-microvolt = <925000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-300000000 {
++ opp-hz = /bits/ 64 <300000000>;
++ opp-microvolt = <937500>;
++ clock-latency-ns = <140000>;
++ };
++ opp-400000000 {
++ opp-hz = /bits/ 64 <400000000>;
++ opp-microvolt = <950000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-500000000 {
++ opp-hz = /bits/ 64 <500000000>;
++ opp-microvolt = <975000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-600000000 {
++ opp-hz = /bits/ 64 <600000000>;
++ opp-microvolt = <1000000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-700000000 {
++ opp-hz = /bits/ 64 <700000000>;
++ opp-microvolt = <1012500>;
++ clock-latency-ns = <140000>;
++ };
++ opp-800000000 {
++ opp-hz = /bits/ 64 <800000000>;
++ opp-microvolt = <1025000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-900000000 {
++ opp-hz = /bits/ 64 <900000000>;
++ opp-microvolt = <1050000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1000000000 {
++ opp-hz = /bits/ 64 <1000000000>;
++ opp-microvolt = <1075000>;
++ clock-latency-ns = <140000>;
++ opp-suspend;
++ };
++ opp-1100000000 {
++ opp-hz = /bits/ 64 <1100000000>;
++ opp-microvolt = <1100000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1200000000 {
++ opp-hz = /bits/ 64 <1200000000>;
++ opp-microvolt = <1125000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1300000000 {
++ opp-hz = /bits/ 64 <1300000000>;
++ opp-microvolt = <1150000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1400000000 {
++ opp-hz = /bits/ 64 <1400000000>;
++ opp-microvolt = <1200000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1500000000 {
++ opp-hz = /bits/ 64 <1500000000>;
++ opp-microvolt = <1225000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1600000000 {
++ opp-hz = /bits/ 64 <1600000000>;
++ opp-microvolt = <1250000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1700000000 {
++ opp-hz = /bits/ 64 <1700000000>;
++ opp-microvolt = <1300000>;
++ clock-latency-ns = <140000>;
++ };
++ };
++
+ soc: soc {
+ sysram@2020000 {
+ compatible = "mmio-sram";
+diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
+index a4dcb68f4322..b4dd3846e8cc 100644
+--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
+@@ -613,7 +613,7 @@
+ status = "disabled";
+ };
+
+- sdr: sdr@ffc25000 {
++ sdr: sdr@ffcfb100 {
+ compatible = "altr,sdr-ctl", "syscon";
+ reg = <0xffcfb100 0x80>;
+ };
+diff --git a/arch/arm/crypto/Kconfig b/arch/arm/crypto/Kconfig
+index 925d1364727a..b8e69fe282b8 100644
+--- a/arch/arm/crypto/Kconfig
++++ b/arch/arm/crypto/Kconfig
+@@ -121,10 +121,4 @@ config CRYPTO_CHACHA20_NEON
+ select CRYPTO_BLKCIPHER
+ select CRYPTO_CHACHA20
+
+-config CRYPTO_SPECK_NEON
+- tristate "NEON accelerated Speck cipher algorithms"
+- depends on KERNEL_MODE_NEON
+- select CRYPTO_BLKCIPHER
+- select CRYPTO_SPECK
+-
+ endif
+diff --git a/arch/arm/crypto/Makefile b/arch/arm/crypto/Makefile
+index 8de542c48ade..bd5bceef0605 100644
+--- a/arch/arm/crypto/Makefile
++++ b/arch/arm/crypto/Makefile
+@@ -10,7 +10,6 @@ obj-$(CONFIG_CRYPTO_SHA1_ARM_NEON) += sha1-arm-neon.o
+ obj-$(CONFIG_CRYPTO_SHA256_ARM) += sha256-arm.o
+ obj-$(CONFIG_CRYPTO_SHA512_ARM) += sha512-arm.o
+ obj-$(CONFIG_CRYPTO_CHACHA20_NEON) += chacha20-neon.o
+-obj-$(CONFIG_CRYPTO_SPECK_NEON) += speck-neon.o
+
+ ce-obj-$(CONFIG_CRYPTO_AES_ARM_CE) += aes-arm-ce.o
+ ce-obj-$(CONFIG_CRYPTO_SHA1_ARM_CE) += sha1-arm-ce.o
+@@ -54,7 +53,6 @@ ghash-arm-ce-y := ghash-ce-core.o ghash-ce-glue.o
+ crct10dif-arm-ce-y := crct10dif-ce-core.o crct10dif-ce-glue.o
+ crc32-arm-ce-y:= crc32-ce-core.o crc32-ce-glue.o
+ chacha20-neon-y := chacha20-neon-core.o chacha20-neon-glue.o
+-speck-neon-y := speck-neon-core.o speck-neon-glue.o
+
+ ifdef REGENERATE_ARM_CRYPTO
+ quiet_cmd_perl = PERL $@
+diff --git a/arch/arm/crypto/speck-neon-core.S b/arch/arm/crypto/speck-neon-core.S
+deleted file mode 100644
+index 57caa742016e..000000000000
+--- a/arch/arm/crypto/speck-neon-core.S
++++ /dev/null
+@@ -1,434 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Author: Eric Biggers <ebiggers@google.com>
+- */
+-
+-#include <linux/linkage.h>
+-
+- .text
+- .fpu neon
+-
+- // arguments
+- ROUND_KEYS .req r0 // const {u64,u32} *round_keys
+- NROUNDS .req r1 // int nrounds
+- DST .req r2 // void *dst
+- SRC .req r3 // const void *src
+- NBYTES .req r4 // unsigned int nbytes
+- TWEAK .req r5 // void *tweak
+-
+- // registers which hold the data being encrypted/decrypted
+- X0 .req q0
+- X0_L .req d0
+- X0_H .req d1
+- Y0 .req q1
+- Y0_H .req d3
+- X1 .req q2
+- X1_L .req d4
+- X1_H .req d5
+- Y1 .req q3
+- Y1_H .req d7
+- X2 .req q4
+- X2_L .req d8
+- X2_H .req d9
+- Y2 .req q5
+- Y2_H .req d11
+- X3 .req q6
+- X3_L .req d12
+- X3_H .req d13
+- Y3 .req q7
+- Y3_H .req d15
+-
+- // the round key, duplicated in all lanes
+- ROUND_KEY .req q8
+- ROUND_KEY_L .req d16
+- ROUND_KEY_H .req d17
+-
+- // index vector for vtbl-based 8-bit rotates
+- ROTATE_TABLE .req d18
+-
+- // multiplication table for updating XTS tweaks
+- GF128MUL_TABLE .req d19
+- GF64MUL_TABLE .req d19
+-
+- // current XTS tweak value(s)
+- TWEAKV .req q10
+- TWEAKV_L .req d20
+- TWEAKV_H .req d21
+-
+- TMP0 .req q12
+- TMP0_L .req d24
+- TMP0_H .req d25
+- TMP1 .req q13
+- TMP2 .req q14
+- TMP3 .req q15
+-
+- .align 4
+-.Lror64_8_table:
+- .byte 1, 2, 3, 4, 5, 6, 7, 0
+-.Lror32_8_table:
+- .byte 1, 2, 3, 0, 5, 6, 7, 4
+-.Lrol64_8_table:
+- .byte 7, 0, 1, 2, 3, 4, 5, 6
+-.Lrol32_8_table:
+- .byte 3, 0, 1, 2, 7, 4, 5, 6
+-.Lgf128mul_table:
+- .byte 0, 0x87
+- .fill 14
+-.Lgf64mul_table:
+- .byte 0, 0x1b, (0x1b << 1), (0x1b << 1) ^ 0x1b
+- .fill 12
+-
+-/*
+- * _speck_round_128bytes() - Speck encryption round on 128 bytes at a time
+- *
+- * Do one Speck encryption round on the 128 bytes (8 blocks for Speck128, 16 for
+- * Speck64) stored in X0-X3 and Y0-Y3, using the round key stored in all lanes
+- * of ROUND_KEY. 'n' is the lane size: 64 for Speck128, or 32 for Speck64.
+- *
+- * The 8-bit rotates are implemented using vtbl instead of vshr + vsli because
+- * the vtbl approach is faster on some processors and the same speed on others.
+- */
+-.macro _speck_round_128bytes n
+-
+- // x = ror(x, 8)
+- vtbl.8 X0_L, {X0_L}, ROTATE_TABLE
+- vtbl.8 X0_H, {X0_H}, ROTATE_TABLE
+- vtbl.8 X1_L, {X1_L}, ROTATE_TABLE
+- vtbl.8 X1_H, {X1_H}, ROTATE_TABLE
+- vtbl.8 X2_L, {X2_L}, ROTATE_TABLE
+- vtbl.8 X2_H, {X2_H}, ROTATE_TABLE
+- vtbl.8 X3_L, {X3_L}, ROTATE_TABLE
+- vtbl.8 X3_H, {X3_H}, ROTATE_TABLE
+-
+- // x += y
+- vadd.u\n X0, Y0
+- vadd.u\n X1, Y1
+- vadd.u\n X2, Y2
+- vadd.u\n X3, Y3
+-
+- // x ^= k
+- veor X0, ROUND_KEY
+- veor X1, ROUND_KEY
+- veor X2, ROUND_KEY
+- veor X3, ROUND_KEY
+-
+- // y = rol(y, 3)
+- vshl.u\n TMP0, Y0, #3
+- vshl.u\n TMP1, Y1, #3
+- vshl.u\n TMP2, Y2, #3
+- vshl.u\n TMP3, Y3, #3
+- vsri.u\n TMP0, Y0, #(\n - 3)
+- vsri.u\n TMP1, Y1, #(\n - 3)
+- vsri.u\n TMP2, Y2, #(\n - 3)
+- vsri.u\n TMP3, Y3, #(\n - 3)
+-
+- // y ^= x
+- veor Y0, TMP0, X0
+- veor Y1, TMP1, X1
+- veor Y2, TMP2, X2
+- veor Y3, TMP3, X3
+-.endm
+-
+-/*
+- * _speck_unround_128bytes() - Speck decryption round on 128 bytes at a time
+- *
+- * This is the inverse of _speck_round_128bytes().
+- */
+-.macro _speck_unround_128bytes n
+-
+- // y ^= x
+- veor TMP0, Y0, X0
+- veor TMP1, Y1, X1
+- veor TMP2, Y2, X2
+- veor TMP3, Y3, X3
+-
+- // y = ror(y, 3)
+- vshr.u\n Y0, TMP0, #3
+- vshr.u\n Y1, TMP1, #3
+- vshr.u\n Y2, TMP2, #3
+- vshr.u\n Y3, TMP3, #3
+- vsli.u\n Y0, TMP0, #(\n - 3)
+- vsli.u\n Y1, TMP1, #(\n - 3)
+- vsli.u\n Y2, TMP2, #(\n - 3)
+- vsli.u\n Y3, TMP3, #(\n - 3)
+-
+- // x ^= k
+- veor X0, ROUND_KEY
+- veor X1, ROUND_KEY
+- veor X2, ROUND_KEY
+- veor X3, ROUND_KEY
+-
+- // x -= y
+- vsub.u\n X0, Y0
+- vsub.u\n X1, Y1
+- vsub.u\n X2, Y2
+- vsub.u\n X3, Y3
+-
+- // x = rol(x, 8);
+- vtbl.8 X0_L, {X0_L}, ROTATE_TABLE
+- vtbl.8 X0_H, {X0_H}, ROTATE_TABLE
+- vtbl.8 X1_L, {X1_L}, ROTATE_TABLE
+- vtbl.8 X1_H, {X1_H}, ROTATE_TABLE
+- vtbl.8 X2_L, {X2_L}, ROTATE_TABLE
+- vtbl.8 X2_H, {X2_H}, ROTATE_TABLE
+- vtbl.8 X3_L, {X3_L}, ROTATE_TABLE
+- vtbl.8 X3_H, {X3_H}, ROTATE_TABLE
+-.endm
+-
+-.macro _xts128_precrypt_one dst_reg, tweak_buf, tmp
+-
+- // Load the next source block
+- vld1.8 {\dst_reg}, [SRC]!
+-
+- // Save the current tweak in the tweak buffer
+- vst1.8 {TWEAKV}, [\tweak_buf:128]!
+-
+- // XOR the next source block with the current tweak
+- veor \dst_reg, TWEAKV
+-
+- /*
+- * Calculate the next tweak by multiplying the current one by x,
+- * modulo p(x) = x^128 + x^7 + x^2 + x + 1.
+- */
+- vshr.u64 \tmp, TWEAKV, #63
+- vshl.u64 TWEAKV, #1
+- veor TWEAKV_H, \tmp\()_L
+- vtbl.8 \tmp\()_H, {GF128MUL_TABLE}, \tmp\()_H
+- veor TWEAKV_L, \tmp\()_H
+-.endm
+-
+-.macro _xts64_precrypt_two dst_reg, tweak_buf, tmp
+-
+- // Load the next two source blocks
+- vld1.8 {\dst_reg}, [SRC]!
+-
+- // Save the current two tweaks in the tweak buffer
+- vst1.8 {TWEAKV}, [\tweak_buf:128]!
+-
+- // XOR the next two source blocks with the current two tweaks
+- veor \dst_reg, TWEAKV
+-
+- /*
+- * Calculate the next two tweaks by multiplying the current ones by x^2,
+- * modulo p(x) = x^64 + x^4 + x^3 + x + 1.
+- */
+- vshr.u64 \tmp, TWEAKV, #62
+- vshl.u64 TWEAKV, #2
+- vtbl.8 \tmp\()_L, {GF64MUL_TABLE}, \tmp\()_L
+- vtbl.8 \tmp\()_H, {GF64MUL_TABLE}, \tmp\()_H
+- veor TWEAKV, \tmp
+-.endm
+-
+-/*
+- * _speck_xts_crypt() - Speck-XTS encryption/decryption
+- *
+- * Encrypt or decrypt NBYTES bytes of data from the SRC buffer to the DST buffer
+- * using Speck-XTS, specifically the variant with a block size of '2n' and round
+- * count given by NROUNDS. The expanded round keys are given in ROUND_KEYS, and
+- * the current XTS tweak value is given in TWEAK. It's assumed that NBYTES is a
+- * nonzero multiple of 128.
+- */
+-.macro _speck_xts_crypt n, decrypting
+- push {r4-r7}
+- mov r7, sp
+-
+- /*
+- * The first four parameters were passed in registers r0-r3. Load the
+- * additional parameters, which were passed on the stack.
+- */
+- ldr NBYTES, [sp, #16]
+- ldr TWEAK, [sp, #20]
+-
+- /*
+- * If decrypting, modify the ROUND_KEYS parameter to point to the last
+- * round key rather than the first, since for decryption the round keys
+- * are used in reverse order.
+- */
+-.if \decrypting
+-.if \n == 64
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS, lsl #3
+- sub ROUND_KEYS, #8
+-.else
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS, lsl #2
+- sub ROUND_KEYS, #4
+-.endif
+-.endif
+-
+- // Load the index vector for vtbl-based 8-bit rotates
+-.if \decrypting
+- ldr r12, =.Lrol\n\()_8_table
+-.else
+- ldr r12, =.Lror\n\()_8_table
+-.endif
+- vld1.8 {ROTATE_TABLE}, [r12:64]
+-
+- // One-time XTS preparation
+-
+- /*
+- * Allocate stack space to store 128 bytes worth of tweaks. For
+- * performance, this space is aligned to a 16-byte boundary so that we
+- * can use the load/store instructions that declare 16-byte alignment.
+- * For Thumb2 compatibility, don't do the 'bic' directly on 'sp'.
+- */
+- sub r12, sp, #128
+- bic r12, #0xf
+- mov sp, r12
+-
+-.if \n == 64
+- // Load first tweak
+- vld1.8 {TWEAKV}, [TWEAK]
+-
+- // Load GF(2^128) multiplication table
+- ldr r12, =.Lgf128mul_table
+- vld1.8 {GF128MUL_TABLE}, [r12:64]
+-.else
+- // Load first tweak
+- vld1.8 {TWEAKV_L}, [TWEAK]
+-
+- // Load GF(2^64) multiplication table
+- ldr r12, =.Lgf64mul_table
+- vld1.8 {GF64MUL_TABLE}, [r12:64]
+-
+- // Calculate second tweak, packing it together with the first
+- vshr.u64 TMP0_L, TWEAKV_L, #63
+- vtbl.u8 TMP0_L, {GF64MUL_TABLE}, TMP0_L
+- vshl.u64 TWEAKV_H, TWEAKV_L, #1
+- veor TWEAKV_H, TMP0_L
+-.endif
+-
+-.Lnext_128bytes_\@:
+-
+- /*
+- * Load the source blocks into {X,Y}[0-3], XOR them with their XTS tweak
+- * values, and save the tweaks on the stack for later. Then
+- * de-interleave the 'x' and 'y' elements of each block, i.e. make it so
+- * that the X[0-3] registers contain only the second halves of blocks,
+- * and the Y[0-3] registers contain only the first halves of blocks.
+- * (Speck uses the order (y, x) rather than the more intuitive (x, y).)
+- */
+- mov r12, sp
+-.if \n == 64
+- _xts128_precrypt_one X0, r12, TMP0
+- _xts128_precrypt_one Y0, r12, TMP0
+- _xts128_precrypt_one X1, r12, TMP0
+- _xts128_precrypt_one Y1, r12, TMP0
+- _xts128_precrypt_one X2, r12, TMP0
+- _xts128_precrypt_one Y2, r12, TMP0
+- _xts128_precrypt_one X3, r12, TMP0
+- _xts128_precrypt_one Y3, r12, TMP0
+- vswp X0_L, Y0_H
+- vswp X1_L, Y1_H
+- vswp X2_L, Y2_H
+- vswp X3_L, Y3_H
+-.else
+- _xts64_precrypt_two X0, r12, TMP0
+- _xts64_precrypt_two Y0, r12, TMP0
+- _xts64_precrypt_two X1, r12, TMP0
+- _xts64_precrypt_two Y1, r12, TMP0
+- _xts64_precrypt_two X2, r12, TMP0
+- _xts64_precrypt_two Y2, r12, TMP0
+- _xts64_precrypt_two X3, r12, TMP0
+- _xts64_precrypt_two Y3, r12, TMP0
+- vuzp.32 Y0, X0
+- vuzp.32 Y1, X1
+- vuzp.32 Y2, X2
+- vuzp.32 Y3, X3
+-.endif
+-
+- // Do the cipher rounds
+-
+- mov r12, ROUND_KEYS
+- mov r6, NROUNDS
+-
+-.Lnext_round_\@:
+-.if \decrypting
+-.if \n == 64
+- vld1.64 ROUND_KEY_L, [r12]
+- sub r12, #8
+- vmov ROUND_KEY_H, ROUND_KEY_L
+-.else
+- vld1.32 {ROUND_KEY_L[],ROUND_KEY_H[]}, [r12]
+- sub r12, #4
+-.endif
+- _speck_unround_128bytes \n
+-.else
+-.if \n == 64
+- vld1.64 ROUND_KEY_L, [r12]!
+- vmov ROUND_KEY_H, ROUND_KEY_L
+-.else
+- vld1.32 {ROUND_KEY_L[],ROUND_KEY_H[]}, [r12]!
+-.endif
+- _speck_round_128bytes \n
+-.endif
+- subs r6, r6, #1
+- bne .Lnext_round_\@
+-
+- // Re-interleave the 'x' and 'y' elements of each block
+-.if \n == 64
+- vswp X0_L, Y0_H
+- vswp X1_L, Y1_H
+- vswp X2_L, Y2_H
+- vswp X3_L, Y3_H
+-.else
+- vzip.32 Y0, X0
+- vzip.32 Y1, X1
+- vzip.32 Y2, X2
+- vzip.32 Y3, X3
+-.endif
+-
+- // XOR the encrypted/decrypted blocks with the tweaks we saved earlier
+- mov r12, sp
+- vld1.8 {TMP0, TMP1}, [r12:128]!
+- vld1.8 {TMP2, TMP3}, [r12:128]!
+- veor X0, TMP0
+- veor Y0, TMP1
+- veor X1, TMP2
+- veor Y1, TMP3
+- vld1.8 {TMP0, TMP1}, [r12:128]!
+- vld1.8 {TMP2, TMP3}, [r12:128]!
+- veor X2, TMP0
+- veor Y2, TMP1
+- veor X3, TMP2
+- veor Y3, TMP3
+-
+- // Store the ciphertext in the destination buffer
+- vst1.8 {X0, Y0}, [DST]!
+- vst1.8 {X1, Y1}, [DST]!
+- vst1.8 {X2, Y2}, [DST]!
+- vst1.8 {X3, Y3}, [DST]!
+-
+- // Continue if there are more 128-byte chunks remaining, else return
+- subs NBYTES, #128
+- bne .Lnext_128bytes_\@
+-
+- // Store the next tweak
+-.if \n == 64
+- vst1.8 {TWEAKV}, [TWEAK]
+-.else
+- vst1.8 {TWEAKV_L}, [TWEAK]
+-.endif
+-
+- mov sp, r7
+- pop {r4-r7}
+- bx lr
+-.endm
+-
+-ENTRY(speck128_xts_encrypt_neon)
+- _speck_xts_crypt n=64, decrypting=0
+-ENDPROC(speck128_xts_encrypt_neon)
+-
+-ENTRY(speck128_xts_decrypt_neon)
+- _speck_xts_crypt n=64, decrypting=1
+-ENDPROC(speck128_xts_decrypt_neon)
+-
+-ENTRY(speck64_xts_encrypt_neon)
+- _speck_xts_crypt n=32, decrypting=0
+-ENDPROC(speck64_xts_encrypt_neon)
+-
+-ENTRY(speck64_xts_decrypt_neon)
+- _speck_xts_crypt n=32, decrypting=1
+-ENDPROC(speck64_xts_decrypt_neon)
+diff --git a/arch/arm/crypto/speck-neon-glue.c b/arch/arm/crypto/speck-neon-glue.c
+deleted file mode 100644
+index f012c3ea998f..000000000000
+--- a/arch/arm/crypto/speck-neon-glue.c
++++ /dev/null
+@@ -1,288 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Note: the NIST recommendation for XTS only specifies a 128-bit block size,
+- * but a 64-bit version (needed for Speck64) is fairly straightforward; the math
+- * is just done in GF(2^64) instead of GF(2^128), with the reducing polynomial
+- * x^64 + x^4 + x^3 + x + 1 from the original XEX paper (Rogaway, 2004:
+- * "Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes
+- * OCB and PMAC"), represented as 0x1B.
+- */
+-
+-#include <asm/hwcap.h>
+-#include <asm/neon.h>
+-#include <asm/simd.h>
+-#include <crypto/algapi.h>
+-#include <crypto/gf128mul.h>
+-#include <crypto/internal/skcipher.h>
+-#include <crypto/speck.h>
+-#include <crypto/xts.h>
+-#include <linux/kernel.h>
+-#include <linux/module.h>
+-
+-/* The assembly functions only handle multiples of 128 bytes */
+-#define SPECK_NEON_CHUNK_SIZE 128
+-
+-/* Speck128 */
+-
+-struct speck128_xts_tfm_ctx {
+- struct speck128_tfm_ctx main_key;
+- struct speck128_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck128_xts_encrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck128_xts_decrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck128_crypt_one_t)(const struct speck128_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck128_xts_crypt_many_t)(const u64 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck128_xts_crypt(struct skcipher_request *req,
+- speck128_crypt_one_t crypt_one,
+- speck128_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- le128 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck128_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- le128_xor((le128 *)dst, (const le128 *)src, &tweak);
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- le128_xor((le128 *)dst, (const le128 *)dst, &tweak);
+- gf128mul_x_ble(&tweak, &tweak);
+-
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck128_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_encrypt,
+- speck128_xts_encrypt_neon);
+-}
+-
+-static int speck128_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_decrypt,
+- speck128_xts_decrypt_neon);
+-}
+-
+-static int speck128_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck128_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck128_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-/* Speck64 */
+-
+-struct speck64_xts_tfm_ctx {
+- struct speck64_tfm_ctx main_key;
+- struct speck64_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck64_xts_encrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck64_xts_decrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck64_crypt_one_t)(const struct speck64_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck64_xts_crypt_many_t)(const u32 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck64_xts_crypt(struct skcipher_request *req, speck64_crypt_one_t crypt_one,
+- speck64_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- __le64 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck64_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- *(__le64 *)dst = *(__le64 *)src ^ tweak;
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- *(__le64 *)dst ^= tweak;
+- tweak = cpu_to_le64((le64_to_cpu(tweak) << 1) ^
+- ((tweak & cpu_to_le64(1ULL << 63)) ?
+- 0x1B : 0));
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck64_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_encrypt,
+- speck64_xts_encrypt_neon);
+-}
+-
+-static int speck64_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_decrypt,
+- speck64_xts_decrypt_neon);
+-}
+-
+-static int speck64_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck64_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck64_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-static struct skcipher_alg speck_algs[] = {
+- {
+- .base.cra_name = "xts(speck128)",
+- .base.cra_driver_name = "xts-speck128-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK128_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck128_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK128_128_KEY_SIZE,
+- .max_keysize = 2 * SPECK128_256_KEY_SIZE,
+- .ivsize = SPECK128_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck128_xts_setkey,
+- .encrypt = speck128_xts_encrypt,
+- .decrypt = speck128_xts_decrypt,
+- }, {
+- .base.cra_name = "xts(speck64)",
+- .base.cra_driver_name = "xts-speck64-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK64_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck64_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK64_96_KEY_SIZE,
+- .max_keysize = 2 * SPECK64_128_KEY_SIZE,
+- .ivsize = SPECK64_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck64_xts_setkey,
+- .encrypt = speck64_xts_encrypt,
+- .decrypt = speck64_xts_decrypt,
+- }
+-};
+-
+-static int __init speck_neon_module_init(void)
+-{
+- if (!(elf_hwcap & HWCAP_NEON))
+- return -ENODEV;
+- return crypto_register_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-static void __exit speck_neon_module_exit(void)
+-{
+- crypto_unregister_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-module_init(speck_neon_module_init);
+-module_exit(speck_neon_module_exit);
+-
+-MODULE_DESCRIPTION("Speck block cipher (NEON-accelerated)");
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
+-MODULE_ALIAS_CRYPTO("xts(speck128)");
+-MODULE_ALIAS_CRYPTO("xts-speck128-neon");
+-MODULE_ALIAS_CRYPTO("xts(speck64)");
+-MODULE_ALIAS_CRYPTO("xts-speck64-neon");
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+index d033da401c26..bc6c141d7372 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+@@ -335,7 +335,7 @@
+
+ sysmgr: sysmgr@ffd12000 {
+ compatible = "altr,sys-mgr", "syscon";
+- reg = <0xffd12000 0x1000>;
++ reg = <0xffd12000 0x228>;
+ };
+
+ /* Local timer */
+diff --git a/arch/arm64/crypto/Kconfig b/arch/arm64/crypto/Kconfig
+index e3fdb0fd6f70..d51944ff9f91 100644
+--- a/arch/arm64/crypto/Kconfig
++++ b/arch/arm64/crypto/Kconfig
+@@ -119,10 +119,4 @@ config CRYPTO_AES_ARM64_BS
+ select CRYPTO_AES_ARM64
+ select CRYPTO_SIMD
+
+-config CRYPTO_SPECK_NEON
+- tristate "NEON accelerated Speck cipher algorithms"
+- depends on KERNEL_MODE_NEON
+- select CRYPTO_BLKCIPHER
+- select CRYPTO_SPECK
+-
+ endif
+diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile
+index bcafd016618e..7bc4bda6d9c6 100644
+--- a/arch/arm64/crypto/Makefile
++++ b/arch/arm64/crypto/Makefile
+@@ -56,9 +56,6 @@ sha512-arm64-y := sha512-glue.o sha512-core.o
+ obj-$(CONFIG_CRYPTO_CHACHA20_NEON) += chacha20-neon.o
+ chacha20-neon-y := chacha20-neon-core.o chacha20-neon-glue.o
+
+-obj-$(CONFIG_CRYPTO_SPECK_NEON) += speck-neon.o
+-speck-neon-y := speck-neon-core.o speck-neon-glue.o
+-
+ obj-$(CONFIG_CRYPTO_AES_ARM64) += aes-arm64.o
+ aes-arm64-y := aes-cipher-core.o aes-cipher-glue.o
+
+diff --git a/arch/arm64/crypto/speck-neon-core.S b/arch/arm64/crypto/speck-neon-core.S
+deleted file mode 100644
+index b14463438b09..000000000000
+--- a/arch/arm64/crypto/speck-neon-core.S
++++ /dev/null
+@@ -1,352 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * ARM64 NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Author: Eric Biggers <ebiggers@google.com>
+- */
+-
+-#include <linux/linkage.h>
+-
+- .text
+-
+- // arguments
+- ROUND_KEYS .req x0 // const {u64,u32} *round_keys
+- NROUNDS .req w1 // int nrounds
+- NROUNDS_X .req x1
+- DST .req x2 // void *dst
+- SRC .req x3 // const void *src
+- NBYTES .req w4 // unsigned int nbytes
+- TWEAK .req x5 // void *tweak
+-
+- // registers which hold the data being encrypted/decrypted
+- // (underscores avoid a naming collision with ARM64 registers x0-x3)
+- X_0 .req v0
+- Y_0 .req v1
+- X_1 .req v2
+- Y_1 .req v3
+- X_2 .req v4
+- Y_2 .req v5
+- X_3 .req v6
+- Y_3 .req v7
+-
+- // the round key, duplicated in all lanes
+- ROUND_KEY .req v8
+-
+- // index vector for tbl-based 8-bit rotates
+- ROTATE_TABLE .req v9
+- ROTATE_TABLE_Q .req q9
+-
+- // temporary registers
+- TMP0 .req v10
+- TMP1 .req v11
+- TMP2 .req v12
+- TMP3 .req v13
+-
+- // multiplication table for updating XTS tweaks
+- GFMUL_TABLE .req v14
+- GFMUL_TABLE_Q .req q14
+-
+- // next XTS tweak value(s)
+- TWEAKV_NEXT .req v15
+-
+- // XTS tweaks for the blocks currently being encrypted/decrypted
+- TWEAKV0 .req v16
+- TWEAKV1 .req v17
+- TWEAKV2 .req v18
+- TWEAKV3 .req v19
+- TWEAKV4 .req v20
+- TWEAKV5 .req v21
+- TWEAKV6 .req v22
+- TWEAKV7 .req v23
+-
+- .align 4
+-.Lror64_8_table:
+- .octa 0x080f0e0d0c0b0a090007060504030201
+-.Lror32_8_table:
+- .octa 0x0c0f0e0d080b0a090407060500030201
+-.Lrol64_8_table:
+- .octa 0x0e0d0c0b0a09080f0605040302010007
+-.Lrol32_8_table:
+- .octa 0x0e0d0c0f0a09080b0605040702010003
+-.Lgf128mul_table:
+- .octa 0x00000000000000870000000000000001
+-.Lgf64mul_table:
+- .octa 0x0000000000000000000000002d361b00
+-
+-/*
+- * _speck_round_128bytes() - Speck encryption round on 128 bytes at a time
+- *
+- * Do one Speck encryption round on the 128 bytes (8 blocks for Speck128, 16 for
+- * Speck64) stored in X0-X3 and Y0-Y3, using the round key stored in all lanes
+- * of ROUND_KEY. 'n' is the lane size: 64 for Speck128, or 32 for Speck64.
+- * 'lanes' is the lane specifier: "2d" for Speck128 or "4s" for Speck64.
+- */
+-.macro _speck_round_128bytes n, lanes
+-
+- // x = ror(x, 8)
+- tbl X_0.16b, {X_0.16b}, ROTATE_TABLE.16b
+- tbl X_1.16b, {X_1.16b}, ROTATE_TABLE.16b
+- tbl X_2.16b, {X_2.16b}, ROTATE_TABLE.16b
+- tbl X_3.16b, {X_3.16b}, ROTATE_TABLE.16b
+-
+- // x += y
+- add X_0.\lanes, X_0.\lanes, Y_0.\lanes
+- add X_1.\lanes, X_1.\lanes, Y_1.\lanes
+- add X_2.\lanes, X_2.\lanes, Y_2.\lanes
+- add X_3.\lanes, X_3.\lanes, Y_3.\lanes
+-
+- // x ^= k
+- eor X_0.16b, X_0.16b, ROUND_KEY.16b
+- eor X_1.16b, X_1.16b, ROUND_KEY.16b
+- eor X_2.16b, X_2.16b, ROUND_KEY.16b
+- eor X_3.16b, X_3.16b, ROUND_KEY.16b
+-
+- // y = rol(y, 3)
+- shl TMP0.\lanes, Y_0.\lanes, #3
+- shl TMP1.\lanes, Y_1.\lanes, #3
+- shl TMP2.\lanes, Y_2.\lanes, #3
+- shl TMP3.\lanes, Y_3.\lanes, #3
+- sri TMP0.\lanes, Y_0.\lanes, #(\n - 3)
+- sri TMP1.\lanes, Y_1.\lanes, #(\n - 3)
+- sri TMP2.\lanes, Y_2.\lanes, #(\n - 3)
+- sri TMP3.\lanes, Y_3.\lanes, #(\n - 3)
+-
+- // y ^= x
+- eor Y_0.16b, TMP0.16b, X_0.16b
+- eor Y_1.16b, TMP1.16b, X_1.16b
+- eor Y_2.16b, TMP2.16b, X_2.16b
+- eor Y_3.16b, TMP3.16b, X_3.16b
+-.endm
+-
+-/*
+- * _speck_unround_128bytes() - Speck decryption round on 128 bytes at a time
+- *
+- * This is the inverse of _speck_round_128bytes().
+- */
+-.macro _speck_unround_128bytes n, lanes
+-
+- // y ^= x
+- eor TMP0.16b, Y_0.16b, X_0.16b
+- eor TMP1.16b, Y_1.16b, X_1.16b
+- eor TMP2.16b, Y_2.16b, X_2.16b
+- eor TMP3.16b, Y_3.16b, X_3.16b
+-
+- // y = ror(y, 3)
+- ushr Y_0.\lanes, TMP0.\lanes, #3
+- ushr Y_1.\lanes, TMP1.\lanes, #3
+- ushr Y_2.\lanes, TMP2.\lanes, #3
+- ushr Y_3.\lanes, TMP3.\lanes, #3
+- sli Y_0.\lanes, TMP0.\lanes, #(\n - 3)
+- sli Y_1.\lanes, TMP1.\lanes, #(\n - 3)
+- sli Y_2.\lanes, TMP2.\lanes, #(\n - 3)
+- sli Y_3.\lanes, TMP3.\lanes, #(\n - 3)
+-
+- // x ^= k
+- eor X_0.16b, X_0.16b, ROUND_KEY.16b
+- eor X_1.16b, X_1.16b, ROUND_KEY.16b
+- eor X_2.16b, X_2.16b, ROUND_KEY.16b
+- eor X_3.16b, X_3.16b, ROUND_KEY.16b
+-
+- // x -= y
+- sub X_0.\lanes, X_0.\lanes, Y_0.\lanes
+- sub X_1.\lanes, X_1.\lanes, Y_1.\lanes
+- sub X_2.\lanes, X_2.\lanes, Y_2.\lanes
+- sub X_3.\lanes, X_3.\lanes, Y_3.\lanes
+-
+- // x = rol(x, 8)
+- tbl X_0.16b, {X_0.16b}, ROTATE_TABLE.16b
+- tbl X_1.16b, {X_1.16b}, ROTATE_TABLE.16b
+- tbl X_2.16b, {X_2.16b}, ROTATE_TABLE.16b
+- tbl X_3.16b, {X_3.16b}, ROTATE_TABLE.16b
+-.endm
+-
+-.macro _next_xts_tweak next, cur, tmp, n
+-.if \n == 64
+- /*
+- * Calculate the next tweak by multiplying the current one by x,
+- * modulo p(x) = x^128 + x^7 + x^2 + x + 1.
+- */
+- sshr \tmp\().2d, \cur\().2d, #63
+- and \tmp\().16b, \tmp\().16b, GFMUL_TABLE.16b
+- shl \next\().2d, \cur\().2d, #1
+- ext \tmp\().16b, \tmp\().16b, \tmp\().16b, #8
+- eor \next\().16b, \next\().16b, \tmp\().16b
+-.else
+- /*
+- * Calculate the next two tweaks by multiplying the current ones by x^2,
+- * modulo p(x) = x^64 + x^4 + x^3 + x + 1.
+- */
+- ushr \tmp\().2d, \cur\().2d, #62
+- shl \next\().2d, \cur\().2d, #2
+- tbl \tmp\().16b, {GFMUL_TABLE.16b}, \tmp\().16b
+- eor \next\().16b, \next\().16b, \tmp\().16b
+-.endif
+-.endm
+-
+-/*
+- * _speck_xts_crypt() - Speck-XTS encryption/decryption
+- *
+- * Encrypt or decrypt NBYTES bytes of data from the SRC buffer to the DST buffer
+- * using Speck-XTS, specifically the variant with a block size of '2n' and round
+- * count given by NROUNDS. The expanded round keys are given in ROUND_KEYS, and
+- * the current XTS tweak value is given in TWEAK. It's assumed that NBYTES is a
+- * nonzero multiple of 128.
+- */
+-.macro _speck_xts_crypt n, lanes, decrypting
+-
+- /*
+- * If decrypting, modify the ROUND_KEYS parameter to point to the last
+- * round key rather than the first, since for decryption the round keys
+- * are used in reverse order.
+- */
+-.if \decrypting
+- mov NROUNDS, NROUNDS /* zero the high 32 bits */
+-.if \n == 64
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS_X, lsl #3
+- sub ROUND_KEYS, ROUND_KEYS, #8
+-.else
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS_X, lsl #2
+- sub ROUND_KEYS, ROUND_KEYS, #4
+-.endif
+-.endif
+-
+- // Load the index vector for tbl-based 8-bit rotates
+-.if \decrypting
+- ldr ROTATE_TABLE_Q, .Lrol\n\()_8_table
+-.else
+- ldr ROTATE_TABLE_Q, .Lror\n\()_8_table
+-.endif
+-
+- // One-time XTS preparation
+-.if \n == 64
+- // Load first tweak
+- ld1 {TWEAKV0.16b}, [TWEAK]
+-
+- // Load GF(2^128) multiplication table
+- ldr GFMUL_TABLE_Q, .Lgf128mul_table
+-.else
+- // Load first tweak
+- ld1 {TWEAKV0.8b}, [TWEAK]
+-
+- // Load GF(2^64) multiplication table
+- ldr GFMUL_TABLE_Q, .Lgf64mul_table
+-
+- // Calculate second tweak, packing it together with the first
+- ushr TMP0.2d, TWEAKV0.2d, #63
+- shl TMP1.2d, TWEAKV0.2d, #1
+- tbl TMP0.8b, {GFMUL_TABLE.16b}, TMP0.8b
+- eor TMP0.8b, TMP0.8b, TMP1.8b
+- mov TWEAKV0.d[1], TMP0.d[0]
+-.endif
+-
+-.Lnext_128bytes_\@:
+-
+- // Calculate XTS tweaks for next 128 bytes
+- _next_xts_tweak TWEAKV1, TWEAKV0, TMP0, \n
+- _next_xts_tweak TWEAKV2, TWEAKV1, TMP0, \n
+- _next_xts_tweak TWEAKV3, TWEAKV2, TMP0, \n
+- _next_xts_tweak TWEAKV4, TWEAKV3, TMP0, \n
+- _next_xts_tweak TWEAKV5, TWEAKV4, TMP0, \n
+- _next_xts_tweak TWEAKV6, TWEAKV5, TMP0, \n
+- _next_xts_tweak TWEAKV7, TWEAKV6, TMP0, \n
+- _next_xts_tweak TWEAKV_NEXT, TWEAKV7, TMP0, \n
+-
+- // Load the next source blocks into {X,Y}[0-3]
+- ld1 {X_0.16b-Y_1.16b}, [SRC], #64
+- ld1 {X_2.16b-Y_3.16b}, [SRC], #64
+-
+- // XOR the source blocks with their XTS tweaks
+- eor TMP0.16b, X_0.16b, TWEAKV0.16b
+- eor Y_0.16b, Y_0.16b, TWEAKV1.16b
+- eor TMP1.16b, X_1.16b, TWEAKV2.16b
+- eor Y_1.16b, Y_1.16b, TWEAKV3.16b
+- eor TMP2.16b, X_2.16b, TWEAKV4.16b
+- eor Y_2.16b, Y_2.16b, TWEAKV5.16b
+- eor TMP3.16b, X_3.16b, TWEAKV6.16b
+- eor Y_3.16b, Y_3.16b, TWEAKV7.16b
+-
+- /*
+- * De-interleave the 'x' and 'y' elements of each block, i.e. make it so
+- * that the X[0-3] registers contain only the second halves of blocks,
+- * and the Y[0-3] registers contain only the first halves of blocks.
+- * (Speck uses the order (y, x) rather than the more intuitive (x, y).)
+- */
+- uzp2 X_0.\lanes, TMP0.\lanes, Y_0.\lanes
+- uzp1 Y_0.\lanes, TMP0.\lanes, Y_0.\lanes
+- uzp2 X_1.\lanes, TMP1.\lanes, Y_1.\lanes
+- uzp1 Y_1.\lanes, TMP1.\lanes, Y_1.\lanes
+- uzp2 X_2.\lanes, TMP2.\lanes, Y_2.\lanes
+- uzp1 Y_2.\lanes, TMP2.\lanes, Y_2.\lanes
+- uzp2 X_3.\lanes, TMP3.\lanes, Y_3.\lanes
+- uzp1 Y_3.\lanes, TMP3.\lanes, Y_3.\lanes
+-
+- // Do the cipher rounds
+- mov x6, ROUND_KEYS
+- mov w7, NROUNDS
+-.Lnext_round_\@:
+-.if \decrypting
+- ld1r {ROUND_KEY.\lanes}, [x6]
+- sub x6, x6, #( \n / 8 )
+- _speck_unround_128bytes \n, \lanes
+-.else
+- ld1r {ROUND_KEY.\lanes}, [x6], #( \n / 8 )
+- _speck_round_128bytes \n, \lanes
+-.endif
+- subs w7, w7, #1
+- bne .Lnext_round_\@
+-
+- // Re-interleave the 'x' and 'y' elements of each block
+- zip1 TMP0.\lanes, Y_0.\lanes, X_0.\lanes
+- zip2 Y_0.\lanes, Y_0.\lanes, X_0.\lanes
+- zip1 TMP1.\lanes, Y_1.\lanes, X_1.\lanes
+- zip2 Y_1.\lanes, Y_1.\lanes, X_1.\lanes
+- zip1 TMP2.\lanes, Y_2.\lanes, X_2.\lanes
+- zip2 Y_2.\lanes, Y_2.\lanes, X_2.\lanes
+- zip1 TMP3.\lanes, Y_3.\lanes, X_3.\lanes
+- zip2 Y_3.\lanes, Y_3.\lanes, X_3.\lanes
+-
+- // XOR the encrypted/decrypted blocks with the tweaks calculated earlier
+- eor X_0.16b, TMP0.16b, TWEAKV0.16b
+- eor Y_0.16b, Y_0.16b, TWEAKV1.16b
+- eor X_1.16b, TMP1.16b, TWEAKV2.16b
+- eor Y_1.16b, Y_1.16b, TWEAKV3.16b
+- eor X_2.16b, TMP2.16b, TWEAKV4.16b
+- eor Y_2.16b, Y_2.16b, TWEAKV5.16b
+- eor X_3.16b, TMP3.16b, TWEAKV6.16b
+- eor Y_3.16b, Y_3.16b, TWEAKV7.16b
+- mov TWEAKV0.16b, TWEAKV_NEXT.16b
+-
+- // Store the ciphertext in the destination buffer
+- st1 {X_0.16b-Y_1.16b}, [DST], #64
+- st1 {X_2.16b-Y_3.16b}, [DST], #64
+-
+- // Continue if there are more 128-byte chunks remaining
+- subs NBYTES, NBYTES, #128
+- bne .Lnext_128bytes_\@
+-
+- // Store the next tweak and return
+-.if \n == 64
+- st1 {TWEAKV_NEXT.16b}, [TWEAK]
+-.else
+- st1 {TWEAKV_NEXT.8b}, [TWEAK]
+-.endif
+- ret
+-.endm
+-
+-ENTRY(speck128_xts_encrypt_neon)
+- _speck_xts_crypt n=64, lanes=2d, decrypting=0
+-ENDPROC(speck128_xts_encrypt_neon)
+-
+-ENTRY(speck128_xts_decrypt_neon)
+- _speck_xts_crypt n=64, lanes=2d, decrypting=1
+-ENDPROC(speck128_xts_decrypt_neon)
+-
+-ENTRY(speck64_xts_encrypt_neon)
+- _speck_xts_crypt n=32, lanes=4s, decrypting=0
+-ENDPROC(speck64_xts_encrypt_neon)
+-
+-ENTRY(speck64_xts_decrypt_neon)
+- _speck_xts_crypt n=32, lanes=4s, decrypting=1
+-ENDPROC(speck64_xts_decrypt_neon)
+diff --git a/arch/arm64/crypto/speck-neon-glue.c b/arch/arm64/crypto/speck-neon-glue.c
+deleted file mode 100644
+index 6e233aeb4ff4..000000000000
+--- a/arch/arm64/crypto/speck-neon-glue.c
++++ /dev/null
+@@ -1,282 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- * (64-bit version; based on the 32-bit version)
+- *
+- * Copyright (c) 2018 Google, Inc
+- */
+-
+-#include <asm/hwcap.h>
+-#include <asm/neon.h>
+-#include <asm/simd.h>
+-#include <crypto/algapi.h>
+-#include <crypto/gf128mul.h>
+-#include <crypto/internal/skcipher.h>
+-#include <crypto/speck.h>
+-#include <crypto/xts.h>
+-#include <linux/kernel.h>
+-#include <linux/module.h>
+-
+-/* The assembly functions only handle multiples of 128 bytes */
+-#define SPECK_NEON_CHUNK_SIZE 128
+-
+-/* Speck128 */
+-
+-struct speck128_xts_tfm_ctx {
+- struct speck128_tfm_ctx main_key;
+- struct speck128_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck128_xts_encrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck128_xts_decrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck128_crypt_one_t)(const struct speck128_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck128_xts_crypt_many_t)(const u64 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck128_xts_crypt(struct skcipher_request *req,
+- speck128_crypt_one_t crypt_one,
+- speck128_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- le128 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck128_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- le128_xor((le128 *)dst, (const le128 *)src, &tweak);
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- le128_xor((le128 *)dst, (const le128 *)dst, &tweak);
+- gf128mul_x_ble(&tweak, &tweak);
+-
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck128_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_encrypt,
+- speck128_xts_encrypt_neon);
+-}
+-
+-static int speck128_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_decrypt,
+- speck128_xts_decrypt_neon);
+-}
+-
+-static int speck128_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck128_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck128_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-/* Speck64 */
+-
+-struct speck64_xts_tfm_ctx {
+- struct speck64_tfm_ctx main_key;
+- struct speck64_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck64_xts_encrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck64_xts_decrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck64_crypt_one_t)(const struct speck64_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck64_xts_crypt_many_t)(const u32 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck64_xts_crypt(struct skcipher_request *req, speck64_crypt_one_t crypt_one,
+- speck64_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- __le64 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck64_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- *(__le64 *)dst = *(__le64 *)src ^ tweak;
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- *(__le64 *)dst ^= tweak;
+- tweak = cpu_to_le64((le64_to_cpu(tweak) << 1) ^
+- ((tweak & cpu_to_le64(1ULL << 63)) ?
+- 0x1B : 0));
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck64_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_encrypt,
+- speck64_xts_encrypt_neon);
+-}
+-
+-static int speck64_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_decrypt,
+- speck64_xts_decrypt_neon);
+-}
+-
+-static int speck64_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck64_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck64_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-static struct skcipher_alg speck_algs[] = {
+- {
+- .base.cra_name = "xts(speck128)",
+- .base.cra_driver_name = "xts-speck128-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK128_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck128_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK128_128_KEY_SIZE,
+- .max_keysize = 2 * SPECK128_256_KEY_SIZE,
+- .ivsize = SPECK128_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck128_xts_setkey,
+- .encrypt = speck128_xts_encrypt,
+- .decrypt = speck128_xts_decrypt,
+- }, {
+- .base.cra_name = "xts(speck64)",
+- .base.cra_driver_name = "xts-speck64-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK64_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck64_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK64_96_KEY_SIZE,
+- .max_keysize = 2 * SPECK64_128_KEY_SIZE,
+- .ivsize = SPECK64_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck64_xts_setkey,
+- .encrypt = speck64_xts_encrypt,
+- .decrypt = speck64_xts_decrypt,
+- }
+-};
+-
+-static int __init speck_neon_module_init(void)
+-{
+- if (!(elf_hwcap & HWCAP_ASIMD))
+- return -ENODEV;
+- return crypto_register_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-static void __exit speck_neon_module_exit(void)
+-{
+- crypto_unregister_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-module_init(speck_neon_module_init);
+-module_exit(speck_neon_module_exit);
+-
+-MODULE_DESCRIPTION("Speck block cipher (NEON-accelerated)");
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
+-MODULE_ALIAS_CRYPTO("xts(speck128)");
+-MODULE_ALIAS_CRYPTO("xts-speck128-neon");
+-MODULE_ALIAS_CRYPTO("xts(speck64)");
+-MODULE_ALIAS_CRYPTO("xts-speck64-neon");
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index e238b7932096..93f69d82225d 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -848,15 +848,29 @@ static bool has_no_fpsimd(const struct arm64_cpu_capabilities *entry, int __unus
+ }
+
+ static bool has_cache_idc(const struct arm64_cpu_capabilities *entry,
+- int __unused)
++ int scope)
+ {
+- return read_sanitised_ftr_reg(SYS_CTR_EL0) & BIT(CTR_IDC_SHIFT);
++ u64 ctr;
++
++ if (scope == SCOPE_SYSTEM)
++ ctr = arm64_ftr_reg_ctrel0.sys_val;
++ else
++ ctr = read_cpuid_cachetype();
++
++ return ctr & BIT(CTR_IDC_SHIFT);
+ }
+
+ static bool has_cache_dic(const struct arm64_cpu_capabilities *entry,
+- int __unused)
++ int scope)
+ {
+- return read_sanitised_ftr_reg(SYS_CTR_EL0) & BIT(CTR_DIC_SHIFT);
++ u64 ctr;
++
++ if (scope == SCOPE_SYSTEM)
++ ctr = arm64_ftr_reg_ctrel0.sys_val;
++ else
++ ctr = read_cpuid_cachetype();
++
++ return ctr & BIT(CTR_DIC_SHIFT);
+ }
+
+ #ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 09dbea221a27..8556876c9109 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -589,7 +589,7 @@ el1_undef:
+ inherit_daif pstate=x23, tmp=x2
+ mov x0, sp
+ bl do_undefinstr
+- ASM_BUG()
++ kernel_exit 1
+ el1_dbg:
+ /*
+ * Debug exception handling
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index 039e9ff379cc..b9da093e0341 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -310,10 +310,12 @@ static int call_undef_hook(struct pt_regs *regs)
+ int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
+ void __user *pc = (void __user *)instruction_pointer(regs);
+
+- if (!user_mode(regs))
+- return 1;
+-
+- if (compat_thumb_mode(regs)) {
++ if (!user_mode(regs)) {
++ __le32 instr_le;
++ if (probe_kernel_address((__force __le32 *)pc, instr_le))
++ goto exit;
++ instr = le32_to_cpu(instr_le);
++ } else if (compat_thumb_mode(regs)) {
+ /* 16-bit Thumb instruction */
+ __le16 instr_le;
+ if (get_user(instr_le, (__le16 __user *)pc))
+@@ -407,6 +409,7 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs)
+ return;
+
+ force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc);
++ BUG_ON(!user_mode(regs));
+ }
+
+ void cpu_enable_cache_maint_trap(const struct arm64_cpu_capabilities *__unused)
+diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile
+index 68755fd70dcf..5df2d611b77d 100644
+--- a/arch/arm64/lib/Makefile
++++ b/arch/arm64/lib/Makefile
+@@ -12,7 +12,7 @@ lib-y := clear_user.o delay.o copy_from_user.o \
+ # when supported by the CPU. Result and argument registers are handled
+ # correctly, based on the function prototype.
+ lib-$(CONFIG_ARM64_LSE_ATOMICS) += atomic_ll_sc.o
+-CFLAGS_atomic_ll_sc.o := -fcall-used-x0 -ffixed-x1 -ffixed-x2 \
++CFLAGS_atomic_ll_sc.o := -ffixed-x1 -ffixed-x2 \
+ -ffixed-x3 -ffixed-x4 -ffixed-x5 -ffixed-x6 \
+ -ffixed-x7 -fcall-saved-x8 -fcall-saved-x9 \
+ -fcall-saved-x10 -fcall-saved-x11 -fcall-saved-x12 \
+diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
+index 1d5483f6e457..93a3c3c0238c 100644
+--- a/arch/m68k/configs/amiga_defconfig
++++ b/arch/m68k/configs/amiga_defconfig
+@@ -657,7 +657,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
+index 52a0af127951..e3d0efd6397d 100644
+--- a/arch/m68k/configs/apollo_defconfig
++++ b/arch/m68k/configs/apollo_defconfig
+@@ -614,7 +614,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
+index b3103e51268a..75ac0c76e884 100644
+--- a/arch/m68k/configs/atari_defconfig
++++ b/arch/m68k/configs/atari_defconfig
+@@ -635,7 +635,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
+index fb7d651a4cab..c6e492700188 100644
+--- a/arch/m68k/configs/bvme6000_defconfig
++++ b/arch/m68k/configs/bvme6000_defconfig
+@@ -606,7 +606,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
+index 6b37f5537c39..b00d1c477432 100644
+--- a/arch/m68k/configs/hp300_defconfig
++++ b/arch/m68k/configs/hp300_defconfig
+@@ -616,7 +616,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
+index c717bf879449..85cac3770d89 100644
+--- a/arch/m68k/configs/mac_defconfig
++++ b/arch/m68k/configs/mac_defconfig
+@@ -638,7 +638,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
+index 226c994ce794..b3a5d1e99d27 100644
+--- a/arch/m68k/configs/multi_defconfig
++++ b/arch/m68k/configs/multi_defconfig
+@@ -720,7 +720,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
+index b383327fd77a..0ca22608453f 100644
+--- a/arch/m68k/configs/mvme147_defconfig
++++ b/arch/m68k/configs/mvme147_defconfig
+@@ -606,7 +606,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
+index 9783d3deb9e9..8e3d10d12d9c 100644
+--- a/arch/m68k/configs/mvme16x_defconfig
++++ b/arch/m68k/configs/mvme16x_defconfig
+@@ -606,7 +606,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
+index a35d10ee10cb..ff7e653ec7fa 100644
+--- a/arch/m68k/configs/q40_defconfig
++++ b/arch/m68k/configs/q40_defconfig
+@@ -629,7 +629,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
+index 573bf922d448..612cf46f6d0c 100644
+--- a/arch/m68k/configs/sun3_defconfig
++++ b/arch/m68k/configs/sun3_defconfig
+@@ -607,7 +607,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
+index efb27a7fcc55..a6a7bb6dc3fd 100644
+--- a/arch/m68k/configs/sun3x_defconfig
++++ b/arch/m68k/configs/sun3x_defconfig
+@@ -608,7 +608,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/mips/cavium-octeon/executive/cvmx-helper.c b/arch/mips/cavium-octeon/executive/cvmx-helper.c
+index 75108ec669eb..6c79e8a16a26 100644
+--- a/arch/mips/cavium-octeon/executive/cvmx-helper.c
++++ b/arch/mips/cavium-octeon/executive/cvmx-helper.c
+@@ -67,7 +67,7 @@ void (*cvmx_override_pko_queue_priority) (int pko_port,
+ void (*cvmx_override_ipd_port_setup) (int ipd_port);
+
+ /* Port count per interface */
+-static int interface_port_count[5];
++static int interface_port_count[9];
+
+ /**
+ * Return the number of interfaces the chip has. Each interface
+diff --git a/arch/mips/include/asm/processor.h b/arch/mips/include/asm/processor.h
+index 49d6046ca1d0..c373eb605040 100644
+--- a/arch/mips/include/asm/processor.h
++++ b/arch/mips/include/asm/processor.h
+@@ -81,7 +81,7 @@ extern unsigned int vced_count, vcei_count;
+
+ #endif
+
+-#define VDSO_RANDOMIZE_SIZE (TASK_IS_32BIT_ADDR ? SZ_1M : SZ_256M)
++#define VDSO_RANDOMIZE_SIZE (TASK_IS_32BIT_ADDR ? SZ_1M : SZ_64M)
+
+ extern unsigned long mips_stack_top(void);
+ #define STACK_TOP mips_stack_top()
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index 242c5ab65611..d2f92273fe37 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -186,7 +186,7 @@
+ bv,n 0(%r3)
+ nop
+ .word 0 /* checksum (will be patched) */
+- .word PA(os_hpmc) /* address of handler */
++ .word 0 /* address of handler */
+ .word 0 /* length of handler */
+ .endm
+
+diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S
+index 781c3b9a3e46..fde654115564 100644
+--- a/arch/parisc/kernel/hpmc.S
++++ b/arch/parisc/kernel/hpmc.S
+@@ -85,7 +85,7 @@ END(hpmc_pim_data)
+
+ .import intr_save, code
+ .align 16
+-ENTRY_CFI(os_hpmc)
++ENTRY(os_hpmc)
+ .os_hpmc:
+
+ /*
+@@ -302,7 +302,6 @@ os_hpmc_6:
+ b .
+ nop
+ .align 16 /* make function length multiple of 16 bytes */
+-ENDPROC_CFI(os_hpmc)
+ .os_hpmc_end:
+
+
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index 68f10f87073d..abeb5321a83f 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -802,7 +802,8 @@ void __init initialize_ivt(const void *iva)
+ * the Length/4 words starting at Address is zero.
+ */
+
+- /* Compute Checksum for HPMC handler */
++ /* Setup IVA and compute checksum for HPMC handler */
++ ivap[6] = (u32)__pa(os_hpmc);
+ length = os_hpmc_size;
+ ivap[7] = length;
+
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index 74842d28a7a1..aae9b0d71c1e 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -494,12 +494,8 @@ static void __init map_pages(unsigned long start_vaddr,
+ pte = pte_mkhuge(pte);
+ }
+
+- if (address >= end_paddr) {
+- if (force)
+- break;
+- else
+- pte_val(pte) = 0;
+- }
++ if (address >= end_paddr)
++ break;
+
+ set_pte(pg_table, pte);
+
+diff --git a/arch/powerpc/include/asm/mpic.h b/arch/powerpc/include/asm/mpic.h
+index fad8ddd697ac..0abf2e7fd222 100644
+--- a/arch/powerpc/include/asm/mpic.h
++++ b/arch/powerpc/include/asm/mpic.h
+@@ -393,7 +393,14 @@ extern struct bus_type mpic_subsys;
+ #define MPIC_REGSET_TSI108 MPIC_REGSET(1) /* Tsi108/109 PIC */
+
+ /* Get the version of primary MPIC */
++#ifdef CONFIG_MPIC
+ extern u32 fsl_mpic_primary_get_version(void);
++#else
++static inline u32 fsl_mpic_primary_get_version(void)
++{
++ return 0;
++}
++#endif
+
+ /* Allocate the controller structure and setup the linux irq descs
+ * for the range if interrupts passed in. No HW initialization is
+diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
+index 3497c8329c1d..3022d67f0c48 100644
+--- a/arch/powerpc/kernel/mce_power.c
++++ b/arch/powerpc/kernel/mce_power.c
+@@ -89,6 +89,13 @@ static void flush_and_reload_slb(void)
+
+ static void flush_erat(void)
+ {
++#ifdef CONFIG_PPC_BOOK3S_64
++ if (!early_cpu_has_feature(CPU_FTR_ARCH_300)) {
++ flush_and_reload_slb();
++ return;
++ }
++#endif
++ /* PPC_INVALIDATE_ERAT can only be used on ISA v3 and newer */
+ asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+ }
+
+diff --git a/arch/powerpc/kernel/module.c b/arch/powerpc/kernel/module.c
+index 77371c9ef3d8..2d861a36662e 100644
+--- a/arch/powerpc/kernel/module.c
++++ b/arch/powerpc/kernel/module.c
+@@ -74,6 +74,14 @@ int module_finalize(const Elf_Ehdr *hdr,
+ (void *)sect->sh_addr + sect->sh_size);
+ #endif /* CONFIG_PPC64 */
+
++#ifdef PPC64_ELF_ABI_v1
++ sect = find_section(hdr, sechdrs, ".opd");
++ if (sect != NULL) {
++ me->arch.start_opd = sect->sh_addr;
++ me->arch.end_opd = sect->sh_addr + sect->sh_size;
++ }
++#endif /* PPC64_ELF_ABI_v1 */
++
+ #ifdef CONFIG_PPC_BARRIER_NOSPEC
+ sect = find_section(hdr, sechdrs, "__spec_barrier_fixup");
+ if (sect != NULL)
+diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
+index b8d61e019d06..2c53de9f3b6a 100644
+--- a/arch/powerpc/kernel/module_64.c
++++ b/arch/powerpc/kernel/module_64.c
+@@ -360,11 +360,6 @@ int module_frob_arch_sections(Elf64_Ehdr *hdr,
+ else if (strcmp(secstrings+sechdrs[i].sh_name,"__versions")==0)
+ dedotify_versions((void *)hdr + sechdrs[i].sh_offset,
+ sechdrs[i].sh_size);
+- else if (!strcmp(secstrings + sechdrs[i].sh_name, ".opd")) {
+- me->arch.start_opd = sechdrs[i].sh_addr;
+- me->arch.end_opd = sechdrs[i].sh_addr +
+- sechdrs[i].sh_size;
+- }
+
+ /* We don't handle .init for the moment: rename to _init */
+ while ((p = strstr(secstrings + sechdrs[i].sh_name, ".init")))
+diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
+index 6a501b25dd85..faf00222b324 100644
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -243,13 +243,19 @@ static void cpu_ready_for_interrupts(void)
+ }
+
+ /*
+- * Fixup HFSCR:TM based on CPU features. The bit is set by our
+- * early asm init because at that point we haven't updated our
+- * CPU features from firmware and device-tree. Here we have,
+- * so let's do it.
++ * Set HFSCR:TM based on CPU features:
++ * In the special case of TM no suspend (P9N DD2.1), Linux is
++ * told TM is off via the dt-ftrs but told to (partially) use
++ * it via OPAL_REINIT_CPUS_TM_SUSPEND_DISABLED. So HFSCR[TM]
++ * will be off from dt-ftrs but we need to turn it on for the
++ * no suspend case.
+ */
+- if (cpu_has_feature(CPU_FTR_HVMODE) && !cpu_has_feature(CPU_FTR_TM_COMP))
+- mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) & ~HFSCR_TM);
++ if (cpu_has_feature(CPU_FTR_HVMODE)) {
++ if (cpu_has_feature(CPU_FTR_TM_COMP))
++ mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) | HFSCR_TM);
++ else
++ mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) & ~HFSCR_TM);
++ }
+
+ /* Set IR and DR in PACA MSR */
+ get_paca()->kernel_msr = MSR_KERNEL;
+diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
+index 729f02df8290..aaa28fd918fe 100644
+--- a/arch/powerpc/mm/hash_native_64.c
++++ b/arch/powerpc/mm/hash_native_64.c
+@@ -115,6 +115,8 @@ static void tlbiel_all_isa300(unsigned int num_sets, unsigned int is)
+ tlbiel_hash_set_isa300(0, is, 0, 2, 1);
+
+ asm volatile("ptesync": : :"memory");
++
++ asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+ void hash__tlbiel_all(unsigned int action)
+@@ -140,8 +142,6 @@ void hash__tlbiel_all(unsigned int action)
+ tlbiel_all_isa206(POWER7_TLB_SETS, is);
+ else
+ WARN(1, "%s called on pre-POWER7 CPU\n", __func__);
+-
+- asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+ static inline unsigned long ___tlbie(unsigned long vpn, int psize,
+diff --git a/arch/s390/defconfig b/arch/s390/defconfig
+index f40600eb1762..5134c71a4937 100644
+--- a/arch/s390/defconfig
++++ b/arch/s390/defconfig
+@@ -221,7 +221,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_DEFLATE=m
+diff --git a/arch/s390/kernel/sthyi.c b/arch/s390/kernel/sthyi.c
+index 0859cde36f75..888cc2f166db 100644
+--- a/arch/s390/kernel/sthyi.c
++++ b/arch/s390/kernel/sthyi.c
+@@ -183,17 +183,19 @@ static void fill_hdr(struct sthyi_sctns *sctns)
+ static void fill_stsi_mac(struct sthyi_sctns *sctns,
+ struct sysinfo_1_1_1 *sysinfo)
+ {
++ sclp_ocf_cpc_name_copy(sctns->mac.infmname);
++ if (*(u64 *)sctns->mac.infmname != 0)
++ sctns->mac.infmval1 |= MAC_NAME_VLD;
++
+ if (stsi(sysinfo, 1, 1, 1))
+ return;
+
+- sclp_ocf_cpc_name_copy(sctns->mac.infmname);
+-
+ memcpy(sctns->mac.infmtype, sysinfo->type, sizeof(sctns->mac.infmtype));
+ memcpy(sctns->mac.infmmanu, sysinfo->manufacturer, sizeof(sctns->mac.infmmanu));
+ memcpy(sctns->mac.infmpman, sysinfo->plant, sizeof(sctns->mac.infmpman));
+ memcpy(sctns->mac.infmseq, sysinfo->sequence, sizeof(sctns->mac.infmseq));
+
+- sctns->mac.infmval1 |= MAC_ID_VLD | MAC_NAME_VLD;
++ sctns->mac.infmval1 |= MAC_ID_VLD;
+ }
+
+ static void fill_stsi_par(struct sthyi_sctns *sctns,
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 1458b1700fc7..8b4c5e001157 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -738,6 +738,7 @@ efi_main(struct efi_config *c, struct boot_params *boot_params)
+ struct desc_struct *desc;
+ void *handle;
+ efi_system_table_t *_table;
++ unsigned long cmdline_paddr;
+
+ efi_early = c;
+
+@@ -755,6 +756,15 @@ efi_main(struct efi_config *c, struct boot_params *boot_params)
+ else
+ setup_boot_services32(efi_early);
+
++ /*
++ * make_boot_params() may have been called before efi_main(), in which
++ * case this is the second time we parse the cmdline. This is ok,
++ * parsing the cmdline multiple times does not have side-effects.
++ */
++ cmdline_paddr = ((u64)hdr->cmd_line_ptr |
++ ((u64)boot_params->ext_cmd_line_ptr << 32));
++ efi_parse_options((char *)cmdline_paddr);
++
+ /*
+ * If the boot loader gave us a value for secure_boot then we use that,
+ * otherwise we ask the BIOS.
+diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
+index d4e6cd4577e5..bf0e82400358 100644
+--- a/arch/x86/boot/tools/build.c
++++ b/arch/x86/boot/tools/build.c
+@@ -391,6 +391,13 @@ int main(int argc, char ** argv)
+ die("Unable to mmap '%s': %m", argv[2]);
+ /* Number of 16-byte paragraphs, including space for a 4-byte CRC */
+ sys_size = (sz + 15 + 4) / 16;
++#ifdef CONFIG_EFI_STUB
++ /*
++ * COFF requires minimum 32-byte alignment of sections, and
++ * adding a signature is problematic without that alignment.
++ */
++ sys_size = (sys_size + 1) & ~1;
++#endif
+
+ /* Patch the setup code with the appropriate size parameters */
+ buf[0x1f1] = setup_sectors-1;
+diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
+index acbe7e8336d8..e4b78f962874 100644
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -817,7 +817,7 @@ static int gcmaes_crypt_by_sg(bool enc, struct aead_request *req,
+ /* Linearize assoc, if not already linear */
+ if (req->src->length >= assoclen && req->src->length &&
+ (!PageHighMem(sg_page(req->src)) ||
+- req->src->offset + req->src->length < PAGE_SIZE)) {
++ req->src->offset + req->src->length <= PAGE_SIZE)) {
+ scatterwalk_start(&assoc_sg_walk, req->src);
+ assoc = scatterwalk_map(&assoc_sg_walk);
+ } else {
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 09b2e3e2cf1b..1c09a0d1771f 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -177,6 +177,7 @@ enum {
+
+ #define DR6_BD (1 << 13)
+ #define DR6_BS (1 << 14)
++#define DR6_BT (1 << 15)
+ #define DR6_RTM (1 << 16)
+ #define DR6_FIXED_1 0xfffe0ff0
+ #define DR6_INIT 0xffff0ff0
+diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
+index 58ce5288878e..0e2130d8d6b1 100644
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -469,6 +469,12 @@ static inline void __native_flush_tlb_one_user(unsigned long addr)
+ */
+ static inline void __flush_tlb_all(void)
+ {
++ /*
++ * This is to catch users with enabled preemption and the PGE feature
++ * and don't trigger the warning in __native_flush_tlb().
++ */
++ VM_WARN_ON_ONCE(preemptible());
++
+ if (boot_cpu_has(X86_FEATURE_PGE)) {
+ __flush_tlb_global();
+ } else {
+diff --git a/arch/x86/kernel/check.c b/arch/x86/kernel/check.c
+index 33399426793e..cc8258a5378b 100644
+--- a/arch/x86/kernel/check.c
++++ b/arch/x86/kernel/check.c
+@@ -31,6 +31,11 @@ static __init int set_corruption_check(char *arg)
+ ssize_t ret;
+ unsigned long val;
+
++ if (!arg) {
++ pr_err("memory_corruption_check config string not provided\n");
++ return -EINVAL;
++ }
++
+ ret = kstrtoul(arg, 10, &val);
+ if (ret)
+ return ret;
+@@ -45,6 +50,11 @@ static __init int set_corruption_check_period(char *arg)
+ ssize_t ret;
+ unsigned long val;
+
++ if (!arg) {
++ pr_err("memory_corruption_check_period config string not provided\n");
++ return -EINVAL;
++ }
++
+ ret = kstrtoul(arg, 10, &val);
+ if (ret)
+ return ret;
+@@ -59,6 +69,11 @@ static __init int set_corruption_check_size(char *arg)
+ char *end;
+ unsigned size;
+
++ if (!arg) {
++ pr_err("memory_corruption_check_size config string not provided\n");
++ return -EINVAL;
++ }
++
+ size = memparse(arg, &end);
+
+ if (*end == '\0')
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 40bdaea97fe7..53eb14a65610 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -35,12 +35,10 @@ static void __init spectre_v2_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
+
+-/*
+- * Our boot-time value of the SPEC_CTRL MSR. We read it once so that any
+- * writes to SPEC_CTRL contain whatever reserved bits have been set.
+- */
+-u64 __ro_after_init x86_spec_ctrl_base;
++/* The base value of the SPEC_CTRL MSR that always has to be preserved. */
++u64 x86_spec_ctrl_base;
+ EXPORT_SYMBOL_GPL(x86_spec_ctrl_base);
++static DEFINE_MUTEX(spec_ctrl_mutex);
+
+ /*
+ * The vendor and possibly platform specific bits which can be modified in
+@@ -325,6 +323,46 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ return cmd;
+ }
+
++static bool stibp_needed(void)
++{
++ if (spectre_v2_enabled == SPECTRE_V2_NONE)
++ return false;
++
++ if (!boot_cpu_has(X86_FEATURE_STIBP))
++ return false;
++
++ return true;
++}
++
++static void update_stibp_msr(void *info)
++{
++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++}
++
++void arch_smt_update(void)
++{
++ u64 mask;
++
++ if (!stibp_needed())
++ return;
++
++ mutex_lock(&spec_ctrl_mutex);
++ mask = x86_spec_ctrl_base;
++ if (cpu_smt_control == CPU_SMT_ENABLED)
++ mask |= SPEC_CTRL_STIBP;
++ else
++ mask &= ~SPEC_CTRL_STIBP;
++
++ if (mask != x86_spec_ctrl_base) {
++ pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n",
++ cpu_smt_control == CPU_SMT_ENABLED ?
++ "Enabling" : "Disabling");
++ x86_spec_ctrl_base = mask;
++ on_each_cpu(update_stibp_msr, NULL, 1);
++ }
++ mutex_unlock(&spec_ctrl_mutex);
++}
++
+ static void __init spectre_v2_select_mitigation(void)
+ {
+ enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
+@@ -424,6 +462,9 @@ specv2_set_mode:
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+ pr_info("Enabling Restricted Speculation for firmware calls\n");
+ }
++
++ /* Enable STIBP if appropriate */
++ arch_smt_update();
+ }
+
+ #undef pr_fmt
+@@ -814,6 +855,8 @@ static ssize_t l1tf_show_state(char *buf)
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+ char *buf, unsigned int bug)
+ {
++ int ret;
++
+ if (!boot_cpu_has_bug(bug))
+ return sprintf(buf, "Not affected\n");
+
+@@ -831,10 +874,12 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ return sprintf(buf, "Mitigation: __user pointer sanitization\n");
+
+ case X86_BUG_SPECTRE_V2:
+- return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
++ ret = sprintf(buf, "%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+ boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
++ (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
+ spectre_v2_module_string());
++ return ret;
+
+ case X86_BUG_SPEC_STORE_BYPASS:
+ return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index b140c68bc14b..643670fb8943 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -2805,6 +2805,13 @@ static int rdtgroup_show_options(struct seq_file *seq, struct kernfs_root *kf)
+ {
+ if (rdt_resources_all[RDT_RESOURCE_L3DATA].alloc_enabled)
+ seq_puts(seq, ",cdp");
++
++ if (rdt_resources_all[RDT_RESOURCE_L2DATA].alloc_enabled)
++ seq_puts(seq, ",cdpl2");
++
++ if (is_mba_sc(&rdt_resources_all[RDT_RESOURCE_MBA]))
++ seq_puts(seq, ",mba_MBps");
++
+ return 0;
+ }
+
+diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
+index eaf02f2e7300..40b16b270656 100644
+--- a/arch/x86/kernel/kprobes/opt.c
++++ b/arch/x86/kernel/kprobes/opt.c
+@@ -179,7 +179,7 @@ optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs)
+ opt_pre_handler(&op->kp, regs);
+ __this_cpu_write(current_kprobe, NULL);
+ }
+- preempt_enable_no_resched();
++ preempt_enable();
+ }
+ NOKPROBE_SYMBOL(optimized_callback);
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index e665aa7167cf..9f3def7baa6d 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3294,10 +3294,13 @@ static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned long *exit
+ }
+ } else {
+ if (vmcs12->exception_bitmap & (1u << nr)) {
+- if (nr == DB_VECTOR)
++ if (nr == DB_VECTOR) {
+ *exit_qual = vcpu->arch.dr6;
+- else
++ *exit_qual &= ~(DR6_FIXED_1 | DR6_BT);
++ *exit_qual ^= DR6_RTM;
++ } else {
+ *exit_qual = 0;
++ }
+ return 1;
+ }
+ }
+@@ -14010,13 +14013,6 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
+ if (!page_address_valid(vcpu, kvm_state->vmx.vmxon_pa))
+ return -EINVAL;
+
+- if (kvm_state->size < sizeof(kvm_state) + sizeof(*vmcs12))
+- return -EINVAL;
+-
+- if (kvm_state->vmx.vmcs_pa == kvm_state->vmx.vmxon_pa ||
+- !page_address_valid(vcpu, kvm_state->vmx.vmcs_pa))
+- return -EINVAL;
+-
+ if ((kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_GUEST_MODE) &&
+ (kvm_state->flags & KVM_STATE_NESTED_GUEST_MODE))
+ return -EINVAL;
+@@ -14046,6 +14042,14 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
+ if (ret)
+ return ret;
+
++ /* Empty 'VMXON' state is permitted */
++ if (kvm_state->size < sizeof(kvm_state) + sizeof(*vmcs12))
++ return 0;
++
++ if (kvm_state->vmx.vmcs_pa == kvm_state->vmx.vmxon_pa ||
++ !page_address_valid(vcpu, kvm_state->vmx.vmcs_pa))
++ return -EINVAL;
++
+ set_current_vmptr(vmx, kvm_state->vmx.vmcs_pa);
+
+ if (kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_VMXON) {
+diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
+index b54d52a2d00a..d71d72cf6c66 100644
+--- a/arch/x86/mm/numa_emulation.c
++++ b/arch/x86/mm/numa_emulation.c
+@@ -400,9 +400,17 @@ void __init numa_emulation(struct numa_meminfo *numa_meminfo, int numa_dist_cnt)
+ n = simple_strtoul(emu_cmdline, &emu_cmdline, 0);
+ ret = -1;
+ for_each_node_mask(i, physnode_mask) {
++ /*
++ * The reason we pass in blk[0] is due to
++ * numa_remove_memblk_from() called by
++ * emu_setup_memblk() will delete entry 0
++ * and then move everything else up in the pi.blk
++ * array. Therefore we should always be looking
++ * at blk[0].
++ */
+ ret = split_nodes_size_interleave_uniform(&ei, &pi,
+- pi.blk[i].start, pi.blk[i].end, 0,
+- n, &pi.blk[i], nid);
++ pi.blk[0].start, pi.blk[0].end, 0,
++ n, &pi.blk[0], nid);
+ if (ret < 0)
+ break;
+ if (ret < n) {
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index 51a5a69ecac9..e2d4b25c7aa4 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -2086,9 +2086,13 @@ void __kernel_map_pages(struct page *page, int numpages, int enable)
+
+ /*
+ * We should perform an IPI and flush all tlbs,
+- * but that can deadlock->flush only current cpu:
++ * but that can deadlock->flush only current cpu.
++ * Preemption needs to be disabled around __flush_tlb_all() due to
++ * CR3 reload in __native_flush_tlb().
+ */
++ preempt_disable();
+ __flush_tlb_all();
++ preempt_enable();
+
+ arch_flush_lazy_mmu_mode();
+ }
+diff --git a/arch/x86/platform/olpc/olpc-xo1-rtc.c b/arch/x86/platform/olpc/olpc-xo1-rtc.c
+index a2b4efddd61a..8e7ddd7e313a 100644
+--- a/arch/x86/platform/olpc/olpc-xo1-rtc.c
++++ b/arch/x86/platform/olpc/olpc-xo1-rtc.c
+@@ -16,6 +16,7 @@
+
+ #include <asm/msr.h>
+ #include <asm/olpc.h>
++#include <asm/x86_init.h>
+
+ static void rtc_wake_on(struct device *dev)
+ {
+@@ -75,6 +76,8 @@ static int __init xo1_rtc_init(void)
+ if (r)
+ return r;
+
++ x86_platform.legacy.rtc = 0;
++
+ device_init_wakeup(&xo1_rtc_device.dev, 1);
+ return 0;
+ }
+diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c
+index c85d1a88f476..f7f77023288a 100644
+--- a/arch/x86/xen/enlighten_pvh.c
++++ b/arch/x86/xen/enlighten_pvh.c
+@@ -75,7 +75,7 @@ static void __init init_pvh_bootparams(void)
+ * Version 2.12 supports Xen entry point but we will use default x86/PC
+ * environment (i.e. hardware_subarch 0).
+ */
+- pvh_bootparams.hdr.version = 0x212;
++ pvh_bootparams.hdr.version = (2 << 8) | 12;
+ pvh_bootparams.hdr.type_of_loader = (9 << 4) | 0; /* Xen loader */
+
+ x86_init.acpi.get_root_pointer = pvh_get_root_pointer;
+diff --git a/arch/x86/xen/platform-pci-unplug.c b/arch/x86/xen/platform-pci-unplug.c
+index 33a783c77d96..184b36922397 100644
+--- a/arch/x86/xen/platform-pci-unplug.c
++++ b/arch/x86/xen/platform-pci-unplug.c
+@@ -146,6 +146,10 @@ void xen_unplug_emulated_devices(void)
+ {
+ int r;
+
++ /* PVH guests don't have emulated devices. */
++ if (xen_pvh_domain())
++ return;
++
+ /* user explicitly requested no unplug */
+ if (xen_emul_unplug & XEN_UNPLUG_NEVER)
+ return;
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index 973f10e05211..717b4847b473 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -9,6 +9,7 @@
+ #include <linux/log2.h>
+ #include <linux/gfp.h>
+ #include <linux/slab.h>
++#include <linux/atomic.h>
+
+ #include <asm/paravirt.h>
+ #include <asm/qspinlock.h>
+@@ -21,6 +22,7 @@
+
+ static DEFINE_PER_CPU(int, lock_kicker_irq) = -1;
+ static DEFINE_PER_CPU(char *, irq_name);
++static DEFINE_PER_CPU(atomic_t, xen_qlock_wait_nest);
+ static bool xen_pvspin = true;
+
+ static void xen_qlock_kick(int cpu)
+@@ -40,33 +42,24 @@ static void xen_qlock_kick(int cpu)
+ static void xen_qlock_wait(u8 *byte, u8 val)
+ {
+ int irq = __this_cpu_read(lock_kicker_irq);
++ atomic_t *nest_cnt = this_cpu_ptr(&xen_qlock_wait_nest);
+
+ /* If kicker interrupts not initialized yet, just spin */
+- if (irq == -1)
++ if (irq == -1 || in_nmi())
+ return;
+
+- /* clear pending */
+- xen_clear_irq_pending(irq);
+- barrier();
+-
+- /*
+- * We check the byte value after clearing pending IRQ to make sure
+- * that we won't miss a wakeup event because of the clearing.
+- *
+- * The sync_clear_bit() call in xen_clear_irq_pending() is atomic.
+- * So it is effectively a memory barrier for x86.
+- */
+- if (READ_ONCE(*byte) != val)
+- return;
++ /* Detect reentry. */
++ atomic_inc(nest_cnt);
+
+- /*
+- * If an interrupt happens here, it will leave the wakeup irq
+- * pending, which will cause xen_poll_irq() to return
+- * immediately.
+- */
++ /* If irq pending already and no nested call clear it. */
++ if (atomic_read(nest_cnt) == 1 && xen_test_irq_pending(irq)) {
++ xen_clear_irq_pending(irq);
++ } else if (READ_ONCE(*byte) == val) {
++ /* Block until irq becomes pending (or a spurious wakeup) */
++ xen_poll_irq(irq);
++ }
+
+- /* Block until irq becomes pending (or perhaps a spurious wakeup) */
+- xen_poll_irq(irq);
++ atomic_dec(nest_cnt);
+ }
+
+ static irqreturn_t dummy_handler(int irq, void *dev_id)
+diff --git a/arch/x86/xen/xen-pvh.S b/arch/x86/xen/xen-pvh.S
+index ca2d3b2bf2af..58722a052f9c 100644
+--- a/arch/x86/xen/xen-pvh.S
++++ b/arch/x86/xen/xen-pvh.S
+@@ -181,7 +181,7 @@ canary:
+ .fill 48, 1, 0
+
+ early_stack:
+- .fill 256, 1, 0
++ .fill BOOT_STACK_SIZE, 1, 0
+ early_stack_end:
+
+ ELFNOTE(Xen, XEN_ELFNOTE_PHYS32_ENTRY,
+diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
+index ae52bff43ce4..ff7c2d470bb8 100644
+--- a/block/bfq-wf2q.c
++++ b/block/bfq-wf2q.c
+@@ -1181,10 +1181,17 @@ bool __bfq_deactivate_entity(struct bfq_entity *entity, bool ins_into_idle_tree)
+ st = bfq_entity_service_tree(entity);
+ is_in_service = entity == sd->in_service_entity;
+
+- if (is_in_service) {
+- bfq_calc_finish(entity, entity->service);
++ bfq_calc_finish(entity, entity->service);
++
++ if (is_in_service)
+ sd->in_service_entity = NULL;
+- }
++ else
++ /*
++ * Non in-service entity: nobody will take care of
++ * resetting its service counter on expiration. Do it
++ * now.
++ */
++ entity->service = 0;
+
+ if (entity->tree == &st->active)
+ bfq_active_extract(st, entity);
+diff --git a/block/blk-lib.c b/block/blk-lib.c
+index bbd44666f2b5..1f196cf0aa5d 100644
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -58,8 +58,7 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+
+ if (!req_sects)
+ goto fail;
+- if (req_sects > UINT_MAX >> 9)
+- req_sects = UINT_MAX >> 9;
++ req_sects = min(req_sects, bio_allowed_max_sectors(q));
+
+ end_sect = sector + req_sects;
+
+@@ -162,7 +161,7 @@ static int __blkdev_issue_write_same(struct block_device *bdev, sector_t sector,
+ return -EOPNOTSUPP;
+
+ /* Ensure that max_write_same_sectors doesn't overflow bi_size */
+- max_write_same_sectors = UINT_MAX >> 9;
++ max_write_same_sectors = bio_allowed_max_sectors(q);
+
+ while (nr_sects) {
+ bio = next_bio(bio, 1, gfp_mask);
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index aaec38cc37b8..2e042190a4f1 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -27,7 +27,8 @@ static struct bio *blk_bio_discard_split(struct request_queue *q,
+ /* Zero-sector (unknown) and one-sector granularities are the same. */
+ granularity = max(q->limits.discard_granularity >> 9, 1U);
+
+- max_discard_sectors = min(q->limits.max_discard_sectors, UINT_MAX >> 9);
++ max_discard_sectors = min(q->limits.max_discard_sectors,
++ bio_allowed_max_sectors(q));
+ max_discard_sectors -= max_discard_sectors % granularity;
+
+ if (unlikely(!max_discard_sectors)) {
+diff --git a/block/blk.h b/block/blk.h
+index 9db4e389582c..977d4b5d968d 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -328,6 +328,16 @@ static inline unsigned long blk_rq_deadline(struct request *rq)
+ return rq->__deadline & ~0x1UL;
+ }
+
++/*
++ * The max size one bio can handle is UINT_MAX becasue bvec_iter.bi_size
++ * is defined as 'unsigned int', meantime it has to aligned to with logical
++ * block size which is the minimum accepted unit by hardware.
++ */
++static inline unsigned int bio_allowed_max_sectors(struct request_queue *q)
++{
++ return round_down(UINT_MAX, queue_logical_block_size(q)) >> 9;
++}
++
+ /*
+ * Internal io_context interface
+ */
+diff --git a/block/bounce.c b/block/bounce.c
+index bc63b3a2d18c..418677dcec60 100644
+--- a/block/bounce.c
++++ b/block/bounce.c
+@@ -31,6 +31,24 @@
+ static struct bio_set bounce_bio_set, bounce_bio_split;
+ static mempool_t page_pool, isa_page_pool;
+
++static void init_bounce_bioset(void)
++{
++ static bool bounce_bs_setup;
++ int ret;
++
++ if (bounce_bs_setup)
++ return;
++
++ ret = bioset_init(&bounce_bio_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
++ BUG_ON(ret);
++ if (bioset_integrity_create(&bounce_bio_set, BIO_POOL_SIZE))
++ BUG_ON(1);
++
++ ret = bioset_init(&bounce_bio_split, BIO_POOL_SIZE, 0, 0);
++ BUG_ON(ret);
++ bounce_bs_setup = true;
++}
++
+ #if defined(CONFIG_HIGHMEM)
+ static __init int init_emergency_pool(void)
+ {
+@@ -44,14 +62,7 @@ static __init int init_emergency_pool(void)
+ BUG_ON(ret);
+ pr_info("pool size: %d pages\n", POOL_SIZE);
+
+- ret = bioset_init(&bounce_bio_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
+- BUG_ON(ret);
+- if (bioset_integrity_create(&bounce_bio_set, BIO_POOL_SIZE))
+- BUG_ON(1);
+-
+- ret = bioset_init(&bounce_bio_split, BIO_POOL_SIZE, 0, 0);
+- BUG_ON(ret);
+-
++ init_bounce_bioset();
+ return 0;
+ }
+
+@@ -86,6 +97,8 @@ static void *mempool_alloc_pages_isa(gfp_t gfp_mask, void *data)
+ return mempool_alloc_pages(gfp_mask | GFP_DMA, data);
+ }
+
++static DEFINE_MUTEX(isa_mutex);
++
+ /*
+ * gets called "every" time someone init's a queue with BLK_BOUNCE_ISA
+ * as the max address, so check if the pool has already been created.
+@@ -94,14 +107,20 @@ int init_emergency_isa_pool(void)
+ {
+ int ret;
+
+- if (mempool_initialized(&isa_page_pool))
++ mutex_lock(&isa_mutex);
++
++ if (mempool_initialized(&isa_page_pool)) {
++ mutex_unlock(&isa_mutex);
+ return 0;
++ }
+
+ ret = mempool_init(&isa_page_pool, ISA_POOL_SIZE, mempool_alloc_pages_isa,
+ mempool_free_pages, (void *) 0);
+ BUG_ON(ret);
+
+ pr_info("isa pool size: %d pages\n", ISA_POOL_SIZE);
++ init_bounce_bioset();
++ mutex_unlock(&isa_mutex);
+ return 0;
+ }
+
+diff --git a/crypto/Kconfig b/crypto/Kconfig
+index f3e40ac56d93..59e32623a7ce 100644
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -1590,20 +1590,6 @@ config CRYPTO_SM4
+
+ If unsure, say N.
+
+-config CRYPTO_SPECK
+- tristate "Speck cipher algorithm"
+- select CRYPTO_ALGAPI
+- help
+- Speck is a lightweight block cipher that is tuned for optimal
+- performance in software (rather than hardware).
+-
+- Speck may not be as secure as AES, and should only be used on systems
+- where AES is not fast enough.
+-
+- See also: <https://eprint.iacr.org/2013/404.pdf>
+-
+- If unsure, say N.
+-
+ config CRYPTO_TEA
+ tristate "TEA, XTEA and XETA cipher algorithms"
+ select CRYPTO_ALGAPI
+diff --git a/crypto/Makefile b/crypto/Makefile
+index 6d1d40eeb964..f6a234d08882 100644
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -115,7 +115,6 @@ obj-$(CONFIG_CRYPTO_TEA) += tea.o
+ obj-$(CONFIG_CRYPTO_KHAZAD) += khazad.o
+ obj-$(CONFIG_CRYPTO_ANUBIS) += anubis.o
+ obj-$(CONFIG_CRYPTO_SEED) += seed.o
+-obj-$(CONFIG_CRYPTO_SPECK) += speck.o
+ obj-$(CONFIG_CRYPTO_SALSA20) += salsa20_generic.o
+ obj-$(CONFIG_CRYPTO_CHACHA20) += chacha20_generic.o
+ obj-$(CONFIG_CRYPTO_POLY1305) += poly1305_generic.o
+diff --git a/crypto/aegis.h b/crypto/aegis.h
+index f1c6900ddb80..405e025fc906 100644
+--- a/crypto/aegis.h
++++ b/crypto/aegis.h
+@@ -21,7 +21,7 @@
+
+ union aegis_block {
+ __le64 words64[AEGIS_BLOCK_SIZE / sizeof(__le64)];
+- u32 words32[AEGIS_BLOCK_SIZE / sizeof(u32)];
++ __le32 words32[AEGIS_BLOCK_SIZE / sizeof(__le32)];
+ u8 bytes[AEGIS_BLOCK_SIZE];
+ };
+
+@@ -57,24 +57,22 @@ static void crypto_aegis_aesenc(union aegis_block *dst,
+ const union aegis_block *src,
+ const union aegis_block *key)
+ {
+- u32 *d = dst->words32;
+ const u8 *s = src->bytes;
+- const u32 *k = key->words32;
+ const u32 *t0 = crypto_ft_tab[0];
+ const u32 *t1 = crypto_ft_tab[1];
+ const u32 *t2 = crypto_ft_tab[2];
+ const u32 *t3 = crypto_ft_tab[3];
+ u32 d0, d1, d2, d3;
+
+- d0 = t0[s[ 0]] ^ t1[s[ 5]] ^ t2[s[10]] ^ t3[s[15]] ^ k[0];
+- d1 = t0[s[ 4]] ^ t1[s[ 9]] ^ t2[s[14]] ^ t3[s[ 3]] ^ k[1];
+- d2 = t0[s[ 8]] ^ t1[s[13]] ^ t2[s[ 2]] ^ t3[s[ 7]] ^ k[2];
+- d3 = t0[s[12]] ^ t1[s[ 1]] ^ t2[s[ 6]] ^ t3[s[11]] ^ k[3];
++ d0 = t0[s[ 0]] ^ t1[s[ 5]] ^ t2[s[10]] ^ t3[s[15]];
++ d1 = t0[s[ 4]] ^ t1[s[ 9]] ^ t2[s[14]] ^ t3[s[ 3]];
++ d2 = t0[s[ 8]] ^ t1[s[13]] ^ t2[s[ 2]] ^ t3[s[ 7]];
++ d3 = t0[s[12]] ^ t1[s[ 1]] ^ t2[s[ 6]] ^ t3[s[11]];
+
+- d[0] = d0;
+- d[1] = d1;
+- d[2] = d2;
+- d[3] = d3;
++ dst->words32[0] = cpu_to_le32(d0) ^ key->words32[0];
++ dst->words32[1] = cpu_to_le32(d1) ^ key->words32[1];
++ dst->words32[2] = cpu_to_le32(d2) ^ key->words32[2];
++ dst->words32[3] = cpu_to_le32(d3) ^ key->words32[3];
+ }
+
+ #endif /* _CRYPTO_AEGIS_H */
+diff --git a/crypto/lrw.c b/crypto/lrw.c
+index 393a782679c7..5504d1325a56 100644
+--- a/crypto/lrw.c
++++ b/crypto/lrw.c
+@@ -143,7 +143,12 @@ static inline int get_index128(be128 *block)
+ return x + ffz(val);
+ }
+
+- return x;
++ /*
++ * If we get here, then x == 128 and we are incrementing the counter
++ * from all ones to all zeros. This means we must return index 127, i.e.
++ * the one corresponding to key2*{ 1,...,1 }.
++ */
++ return 127;
+ }
+
+ static int post_crypt(struct skcipher_request *req)
+diff --git a/crypto/morus1280.c b/crypto/morus1280.c
+index d057cf5ac4a8..3889c188f266 100644
+--- a/crypto/morus1280.c
++++ b/crypto/morus1280.c
+@@ -385,14 +385,11 @@ static void crypto_morus1280_final(struct morus1280_state *state,
+ struct morus1280_block *tag_xor,
+ u64 assoclen, u64 cryptlen)
+ {
+- u64 assocbits = assoclen * 8;
+- u64 cryptbits = cryptlen * 8;
+-
+ struct morus1280_block tmp;
+ unsigned int i;
+
+- tmp.words[0] = cpu_to_le64(assocbits);
+- tmp.words[1] = cpu_to_le64(cryptbits);
++ tmp.words[0] = assoclen * 8;
++ tmp.words[1] = cryptlen * 8;
+ tmp.words[2] = 0;
+ tmp.words[3] = 0;
+
+diff --git a/crypto/morus640.c b/crypto/morus640.c
+index 1ca76e54281b..da06ec2f6a80 100644
+--- a/crypto/morus640.c
++++ b/crypto/morus640.c
+@@ -384,21 +384,13 @@ static void crypto_morus640_final(struct morus640_state *state,
+ struct morus640_block *tag_xor,
+ u64 assoclen, u64 cryptlen)
+ {
+- u64 assocbits = assoclen * 8;
+- u64 cryptbits = cryptlen * 8;
+-
+- u32 assocbits_lo = (u32)assocbits;
+- u32 assocbits_hi = (u32)(assocbits >> 32);
+- u32 cryptbits_lo = (u32)cryptbits;
+- u32 cryptbits_hi = (u32)(cryptbits >> 32);
+-
+ struct morus640_block tmp;
+ unsigned int i;
+
+- tmp.words[0] = cpu_to_le32(assocbits_lo);
+- tmp.words[1] = cpu_to_le32(assocbits_hi);
+- tmp.words[2] = cpu_to_le32(cryptbits_lo);
+- tmp.words[3] = cpu_to_le32(cryptbits_hi);
++ tmp.words[0] = lower_32_bits(assoclen * 8);
++ tmp.words[1] = upper_32_bits(assoclen * 8);
++ tmp.words[2] = lower_32_bits(cryptlen * 8);
++ tmp.words[3] = upper_32_bits(cryptlen * 8);
+
+ for (i = 0; i < MORUS_BLOCK_WORDS; i++)
+ state->s[4].words[i] ^= state->s[0].words[i];
+diff --git a/crypto/speck.c b/crypto/speck.c
+deleted file mode 100644
+index 58aa9f7f91f7..000000000000
+--- a/crypto/speck.c
++++ /dev/null
+@@ -1,307 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * Speck: a lightweight block cipher
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Speck has 10 variants, including 5 block sizes. For now we only implement
+- * the variants Speck128/128, Speck128/192, Speck128/256, Speck64/96, and
+- * Speck64/128. Speck${B}/${K} denotes the variant with a block size of B bits
+- * and a key size of K bits. The Speck128 variants are believed to be the most
+- * secure variants, and they use the same block size and key sizes as AES. The
+- * Speck64 variants are less secure, but on 32-bit processors are usually
+- * faster. The remaining variants (Speck32, Speck48, and Speck96) are even less
+- * secure and/or not as well suited for implementation on either 32-bit or
+- * 64-bit processors, so are omitted.
+- *
+- * Reference: "The Simon and Speck Families of Lightweight Block Ciphers"
+- * https://eprint.iacr.org/2013/404.pdf
+- *
+- * In a correspondence, the Speck designers have also clarified that the words
+- * should be interpreted in little-endian format, and the words should be
+- * ordered such that the first word of each block is 'y' rather than 'x', and
+- * the first key word (rather than the last) becomes the first round key.
+- */
+-
+-#include <asm/unaligned.h>
+-#include <crypto/speck.h>
+-#include <linux/bitops.h>
+-#include <linux/crypto.h>
+-#include <linux/init.h>
+-#include <linux/module.h>
+-
+-/* Speck128 */
+-
+-static __always_inline void speck128_round(u64 *x, u64 *y, u64 k)
+-{
+- *x = ror64(*x, 8);
+- *x += *y;
+- *x ^= k;
+- *y = rol64(*y, 3);
+- *y ^= *x;
+-}
+-
+-static __always_inline void speck128_unround(u64 *x, u64 *y, u64 k)
+-{
+- *y ^= *x;
+- *y = ror64(*y, 3);
+- *x ^= k;
+- *x -= *y;
+- *x = rol64(*x, 8);
+-}
+-
+-void crypto_speck128_encrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u64 y = get_unaligned_le64(in);
+- u64 x = get_unaligned_le64(in + 8);
+- int i;
+-
+- for (i = 0; i < ctx->nrounds; i++)
+- speck128_round(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le64(y, out);
+- put_unaligned_le64(x, out + 8);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck128_encrypt);
+-
+-static void speck128_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck128_encrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-void crypto_speck128_decrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u64 y = get_unaligned_le64(in);
+- u64 x = get_unaligned_le64(in + 8);
+- int i;
+-
+- for (i = ctx->nrounds - 1; i >= 0; i--)
+- speck128_unround(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le64(y, out);
+- put_unaligned_le64(x, out + 8);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck128_decrypt);
+-
+-static void speck128_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck128_decrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-int crypto_speck128_setkey(struct speck128_tfm_ctx *ctx, const u8 *key,
+- unsigned int keylen)
+-{
+- u64 l[3];
+- u64 k;
+- int i;
+-
+- switch (keylen) {
+- case SPECK128_128_KEY_SIZE:
+- k = get_unaligned_le64(key);
+- l[0] = get_unaligned_le64(key + 8);
+- ctx->nrounds = SPECK128_128_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck128_round(&l[0], &k, i);
+- }
+- break;
+- case SPECK128_192_KEY_SIZE:
+- k = get_unaligned_le64(key);
+- l[0] = get_unaligned_le64(key + 8);
+- l[1] = get_unaligned_le64(key + 16);
+- ctx->nrounds = SPECK128_192_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck128_round(&l[i % 2], &k, i);
+- }
+- break;
+- case SPECK128_256_KEY_SIZE:
+- k = get_unaligned_le64(key);
+- l[0] = get_unaligned_le64(key + 8);
+- l[1] = get_unaligned_le64(key + 16);
+- l[2] = get_unaligned_le64(key + 24);
+- ctx->nrounds = SPECK128_256_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck128_round(&l[i % 3], &k, i);
+- }
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck128_setkey);
+-
+-static int speck128_setkey(struct crypto_tfm *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- return crypto_speck128_setkey(crypto_tfm_ctx(tfm), key, keylen);
+-}
+-
+-/* Speck64 */
+-
+-static __always_inline void speck64_round(u32 *x, u32 *y, u32 k)
+-{
+- *x = ror32(*x, 8);
+- *x += *y;
+- *x ^= k;
+- *y = rol32(*y, 3);
+- *y ^= *x;
+-}
+-
+-static __always_inline void speck64_unround(u32 *x, u32 *y, u32 k)
+-{
+- *y ^= *x;
+- *y = ror32(*y, 3);
+- *x ^= k;
+- *x -= *y;
+- *x = rol32(*x, 8);
+-}
+-
+-void crypto_speck64_encrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u32 y = get_unaligned_le32(in);
+- u32 x = get_unaligned_le32(in + 4);
+- int i;
+-
+- for (i = 0; i < ctx->nrounds; i++)
+- speck64_round(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le32(y, out);
+- put_unaligned_le32(x, out + 4);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck64_encrypt);
+-
+-static void speck64_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck64_encrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-void crypto_speck64_decrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u32 y = get_unaligned_le32(in);
+- u32 x = get_unaligned_le32(in + 4);
+- int i;
+-
+- for (i = ctx->nrounds - 1; i >= 0; i--)
+- speck64_unround(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le32(y, out);
+- put_unaligned_le32(x, out + 4);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck64_decrypt);
+-
+-static void speck64_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck64_decrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-int crypto_speck64_setkey(struct speck64_tfm_ctx *ctx, const u8 *key,
+- unsigned int keylen)
+-{
+- u32 l[3];
+- u32 k;
+- int i;
+-
+- switch (keylen) {
+- case SPECK64_96_KEY_SIZE:
+- k = get_unaligned_le32(key);
+- l[0] = get_unaligned_le32(key + 4);
+- l[1] = get_unaligned_le32(key + 8);
+- ctx->nrounds = SPECK64_96_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck64_round(&l[i % 2], &k, i);
+- }
+- break;
+- case SPECK64_128_KEY_SIZE:
+- k = get_unaligned_le32(key);
+- l[0] = get_unaligned_le32(key + 4);
+- l[1] = get_unaligned_le32(key + 8);
+- l[2] = get_unaligned_le32(key + 12);
+- ctx->nrounds = SPECK64_128_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck64_round(&l[i % 3], &k, i);
+- }
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck64_setkey);
+-
+-static int speck64_setkey(struct crypto_tfm *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- return crypto_speck64_setkey(crypto_tfm_ctx(tfm), key, keylen);
+-}
+-
+-/* Algorithm definitions */
+-
+-static struct crypto_alg speck_algs[] = {
+- {
+- .cra_name = "speck128",
+- .cra_driver_name = "speck128-generic",
+- .cra_priority = 100,
+- .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
+- .cra_blocksize = SPECK128_BLOCK_SIZE,
+- .cra_ctxsize = sizeof(struct speck128_tfm_ctx),
+- .cra_module = THIS_MODULE,
+- .cra_u = {
+- .cipher = {
+- .cia_min_keysize = SPECK128_128_KEY_SIZE,
+- .cia_max_keysize = SPECK128_256_KEY_SIZE,
+- .cia_setkey = speck128_setkey,
+- .cia_encrypt = speck128_encrypt,
+- .cia_decrypt = speck128_decrypt
+- }
+- }
+- }, {
+- .cra_name = "speck64",
+- .cra_driver_name = "speck64-generic",
+- .cra_priority = 100,
+- .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
+- .cra_blocksize = SPECK64_BLOCK_SIZE,
+- .cra_ctxsize = sizeof(struct speck64_tfm_ctx),
+- .cra_module = THIS_MODULE,
+- .cra_u = {
+- .cipher = {
+- .cia_min_keysize = SPECK64_96_KEY_SIZE,
+- .cia_max_keysize = SPECK64_128_KEY_SIZE,
+- .cia_setkey = speck64_setkey,
+- .cia_encrypt = speck64_encrypt,
+- .cia_decrypt = speck64_decrypt
+- }
+- }
+- }
+-};
+-
+-static int __init speck_module_init(void)
+-{
+- return crypto_register_algs(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-static void __exit speck_module_exit(void)
+-{
+- crypto_unregister_algs(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-module_init(speck_module_init);
+-module_exit(speck_module_exit);
+-
+-MODULE_DESCRIPTION("Speck block cipher (generic)");
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
+-MODULE_ALIAS_CRYPTO("speck128");
+-MODULE_ALIAS_CRYPTO("speck128-generic");
+-MODULE_ALIAS_CRYPTO("speck64");
+-MODULE_ALIAS_CRYPTO("speck64-generic");
+diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
+index bdde95e8d369..6e0a054bb61d 100644
+--- a/crypto/tcrypt.c
++++ b/crypto/tcrypt.c
+@@ -1103,6 +1103,9 @@ static void test_ahash_speed_common(const char *algo, unsigned int secs,
+ break;
+ }
+
++ if (speed[i].klen)
++ crypto_ahash_setkey(tfm, tvmem[0], speed[i].klen);
++
+ pr_info("test%3u "
+ "(%5u byte blocks,%5u bytes per update,%4u updates): ",
+ i, speed[i].blen, speed[i].plen, speed[i].blen / speed[i].plen);
+diff --git a/crypto/testmgr.c b/crypto/testmgr.c
+index a1d42245082a..1c9bf38e59ea 100644
+--- a/crypto/testmgr.c
++++ b/crypto/testmgr.c
+@@ -3037,18 +3037,6 @@ static const struct alg_test_desc alg_test_descs[] = {
+ .suite = {
+ .cipher = __VECS(sm4_tv_template)
+ }
+- }, {
+- .alg = "ecb(speck128)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck128_tv_template)
+- }
+- }, {
+- .alg = "ecb(speck64)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck64_tv_template)
+- }
+ }, {
+ .alg = "ecb(tea)",
+ .test = alg_test_skcipher,
+@@ -3576,18 +3564,6 @@ static const struct alg_test_desc alg_test_descs[] = {
+ .suite = {
+ .cipher = __VECS(serpent_xts_tv_template)
+ }
+- }, {
+- .alg = "xts(speck128)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck128_xts_tv_template)
+- }
+- }, {
+- .alg = "xts(speck64)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck64_xts_tv_template)
+- }
+ }, {
+ .alg = "xts(twofish)",
+ .test = alg_test_skcipher,
+diff --git a/crypto/testmgr.h b/crypto/testmgr.h
+index 173111c70746..0b3d7cadbe93 100644
+--- a/crypto/testmgr.h
++++ b/crypto/testmgr.h
+@@ -10198,744 +10198,6 @@ static const struct cipher_testvec sm4_tv_template[] = {
+ }
+ };
+
+-/*
+- * Speck test vectors taken from the original paper:
+- * "The Simon and Speck Families of Lightweight Block Ciphers"
+- * https://eprint.iacr.org/2013/404.pdf
+- *
+- * Note that the paper does not make byte and word order clear. But it was
+- * confirmed with the authors that the intended orders are little endian byte
+- * order and (y, x) word order. Equivalently, the printed test vectors, when
+- * looking at only the bytes (ignoring the whitespace that divides them into
+- * words), are backwards: the left-most byte is actually the one with the
+- * highest memory address, while the right-most byte is actually the one with
+- * the lowest memory address.
+- */
+-
+-static const struct cipher_testvec speck128_tv_template[] = {
+- { /* Speck128/128 */
+- .key = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
+- .klen = 16,
+- .ptext = "\x20\x6d\x61\x64\x65\x20\x69\x74"
+- "\x20\x65\x71\x75\x69\x76\x61\x6c",
+- .ctext = "\x18\x0d\x57\x5c\xdf\xfe\x60\x78"
+- "\x65\x32\x78\x79\x51\x98\x5d\xa6",
+- .len = 16,
+- }, { /* Speck128/192 */
+- .key = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17",
+- .klen = 24,
+- .ptext = "\x65\x6e\x74\x20\x74\x6f\x20\x43"
+- "\x68\x69\x65\x66\x20\x48\x61\x72",
+- .ctext = "\x86\x18\x3c\xe0\x5d\x18\xbc\xf9"
+- "\x66\x55\x13\x13\x3a\xcf\xe4\x1b",
+- .len = 16,
+- }, { /* Speck128/256 */
+- .key = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
+- .klen = 32,
+- .ptext = "\x70\x6f\x6f\x6e\x65\x72\x2e\x20"
+- "\x49\x6e\x20\x74\x68\x6f\x73\x65",
+- .ctext = "\x43\x8f\x18\x9c\x8d\xb4\xee\x4e"
+- "\x3e\xf5\xc0\x05\x04\x01\x09\x41",
+- .len = 16,
+- },
+-};
+-
+-/*
+- * Speck128-XTS test vectors, taken from the AES-XTS test vectors with the
+- * ciphertext recomputed with Speck128 as the cipher
+- */
+-static const struct cipher_testvec speck128_xts_tv_template[] = {
+- {
+- .key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .klen = 32,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ctext = "\xbe\xa0\xe7\x03\xd7\xfe\xab\x62"
+- "\x3b\x99\x4a\x64\x74\x77\xac\xed"
+- "\xd8\xf4\xa6\xcf\xae\xb9\x07\x42"
+- "\x51\xd9\xb6\x1d\xe0\x5e\xbc\x54",
+- .len = 32,
+- }, {
+- .key = "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x22\x22\x22\x22\x22\x22\x22\x22"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 32,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\xfb\x53\x81\x75\x6f\x9f\x34\xad"
+- "\x7e\x01\xed\x7b\xcc\xda\x4e\x4a"
+- "\xd4\x84\xa4\x53\xd5\x88\x73\x1b"
+- "\xfd\xcb\xae\x0d\xf3\x04\xee\xe6",
+- .len = 32,
+- }, {
+- .key = "\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8"
+- "\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
+- "\x22\x22\x22\x22\x22\x22\x22\x22"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 32,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\x21\x52\x84\x15\xd1\xf7\x21\x55"
+- "\xd9\x75\x4a\xd3\xc5\xdb\x9f\x7d"
+- "\xda\x63\xb2\xf1\x82\xb0\x89\x59"
+- "\x86\xd4\xaa\xaa\xdd\xff\x4f\x92",
+- .len = 32,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x31\x41\x59\x26\x53\x58\x97\x93"
+- "\x23\x84\x62\x64\x33\x83\x27\x95",
+- .klen = 32,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\x57\xb5\xf8\x71\x6e\x6d\xdd\x82"
+- "\x53\xd0\xed\x2d\x30\xc1\x20\xef"
+- "\x70\x67\x5e\xff\x09\x70\xbb\xc1"
+- "\x3a\x7b\x48\x26\xd9\x0b\xf4\x48"
+- "\xbe\xce\xb1\xc7\xb2\x67\xc4\xa7"
+- "\x76\xf8\x36\x30\xb7\xb4\x9a\xd9"
+- "\xf5\x9d\xd0\x7b\xc1\x06\x96\x44"
+- "\x19\xc5\x58\x84\x63\xb9\x12\x68"
+- "\x68\xc7\xaa\x18\x98\xf2\x1f\x5c"
+- "\x39\xa6\xd8\x32\x2b\xc3\x51\xfd"
+- "\x74\x79\x2e\xb4\x44\xd7\x69\xc4"
+- "\xfc\x29\xe6\xed\x26\x1e\xa6\x9d"
+- "\x1c\xbe\x00\x0e\x7f\x3a\xca\xfb"
+- "\x6d\x13\x65\xa0\xf9\x31\x12\xe2"
+- "\x26\xd1\xec\x2b\x0a\x8b\x59\x99"
+- "\xa7\x49\xa0\x0e\x09\x33\x85\x50"
+- "\xc3\x23\xca\x7a\xdd\x13\x45\x5f"
+- "\xde\x4c\xa7\xcb\x00\x8a\x66\x6f"
+- "\xa2\xb6\xb1\x2e\xe1\xa0\x18\xf6"
+- "\xad\xf3\xbd\xeb\xc7\xef\x55\x4f"
+- "\x79\x91\x8d\x36\x13\x7b\xd0\x4a"
+- "\x6c\x39\xfb\x53\xb8\x6f\x02\x51"
+- "\xa5\x20\xac\x24\x1c\x73\x59\x73"
+- "\x58\x61\x3a\x87\x58\xb3\x20\x56"
+- "\x39\x06\x2b\x4d\xd3\x20\x2b\x89"
+- "\x3f\xa2\xf0\x96\xeb\x7f\xa4\xcd"
+- "\x11\xae\xbd\xcb\x3a\xb4\xd9\x91"
+- "\x09\x35\x71\x50\x65\xac\x92\xe3"
+- "\x7b\x32\xc0\x7a\xdd\xd4\xc3\x92"
+- "\x6f\xeb\x79\xde\x6f\xd3\x25\xc9"
+- "\xcd\x63\xf5\x1e\x7a\x3b\x26\x9d"
+- "\x77\x04\x80\xa9\xbf\x38\xb5\xbd"
+- "\xb8\x05\x07\xbd\xfd\xab\x7b\xf8"
+- "\x2a\x26\xcc\x49\x14\x6d\x55\x01"
+- "\x06\x94\xd8\xb2\x2d\x53\x83\x1b"
+- "\x8f\xd4\xdd\x57\x12\x7e\x18\xba"
+- "\x8e\xe2\x4d\x80\xef\x7e\x6b\x9d"
+- "\x24\xa9\x60\xa4\x97\x85\x86\x2a"
+- "\x01\x00\x09\xf1\xcb\x4a\x24\x1c"
+- "\xd8\xf6\xe6\x5b\xe7\x5d\xf2\xc4"
+- "\x97\x1c\x10\xc6\x4d\x66\x4f\x98"
+- "\x87\x30\xac\xd5\xea\x73\x49\x10"
+- "\x80\xea\xe5\x5f\x4d\x5f\x03\x33"
+- "\x66\x02\x35\x3d\x60\x06\x36\x4f"
+- "\x14\x1c\xd8\x07\x1f\x78\xd0\xf8"
+- "\x4f\x6c\x62\x7c\x15\xa5\x7c\x28"
+- "\x7c\xcc\xeb\x1f\xd1\x07\x90\x93"
+- "\x7e\xc2\xa8\x3a\x80\xc0\xf5\x30"
+- "\xcc\x75\xcf\x16\x26\xa9\x26\x3b"
+- "\xe7\x68\x2f\x15\x21\x5b\xe4\x00"
+- "\xbd\x48\x50\xcd\x75\x70\xc4\x62"
+- "\xbb\x41\xfb\x89\x4a\x88\x3b\x3b"
+- "\x51\x66\x02\x69\x04\x97\x36\xd4"
+- "\x75\xae\x0b\xa3\x42\xf8\xca\x79"
+- "\x8f\x93\xe9\xcc\x38\xbd\xd6\xd2"
+- "\xf9\x70\x4e\xc3\x6a\x8e\x25\xbd"
+- "\xea\x15\x5a\xa0\x85\x7e\x81\x0d"
+- "\x03\xe7\x05\x39\xf5\x05\x26\xee"
+- "\xec\xaa\x1f\x3d\xc9\x98\x76\x01"
+- "\x2c\xf4\xfc\xa3\x88\x77\x38\xc4"
+- "\x50\x65\x50\x6d\x04\x1f\xdf\x5a"
+- "\xaa\xf2\x01\xa9\xc1\x8d\xee\xca"
+- "\x47\x26\xef\x39\xb8\xb4\xf2\xd1"
+- "\xd6\xbb\x1b\x2a\xc1\x34\x14\xcf",
+- .len = 512,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x62\x49\x77\x57\x24\x70\x93\x69"
+- "\x99\x59\x57\x49\x66\x96\x76\x27"
+- "\x31\x41\x59\x26\x53\x58\x97\x93"
+- "\x23\x84\x62\x64\x33\x83\x27\x95"
+- "\x02\x88\x41\x97\x16\x93\x99\x37"
+- "\x51\x05\x82\x09\x74\x94\x45\x92",
+- .klen = 64,
+- .iv = "\xff\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\xc5\x85\x2a\x4b\x73\xe4\xf6\xf1"
+- "\x7e\xf9\xf6\xe9\xa3\x73\x36\xcb"
+- "\xaa\xb6\x22\xb0\x24\x6e\x3d\x73"
+- "\x92\x99\xde\xd3\x76\xed\xcd\x63"
+- "\x64\x3a\x22\x57\xc1\x43\x49\xd4"
+- "\x79\x36\x31\x19\x62\xae\x10\x7e"
+- "\x7d\xcf\x7a\xe2\x6b\xce\x27\xfa"
+- "\xdc\x3d\xd9\x83\xd3\x42\x4c\xe0"
+- "\x1b\xd6\x1d\x1a\x6f\xd2\x03\x00"
+- "\xfc\x81\x99\x8a\x14\x62\xf5\x7e"
+- "\x0d\xe7\x12\xe8\x17\x9d\x0b\xec"
+- "\xe2\xf7\xc9\xa7\x63\xd1\x79\xb6"
+- "\x62\x62\x37\xfe\x0a\x4c\x4a\x37"
+- "\x70\xc7\x5e\x96\x5f\xbc\x8e\x9e"
+- "\x85\x3c\x4f\x26\x64\x85\xbc\x68"
+- "\xb0\xe0\x86\x5e\x26\x41\xce\x11"
+- "\x50\xda\x97\x14\xe9\x9e\xc7\x6d"
+- "\x3b\xdc\x43\xde\x2b\x27\x69\x7d"
+- "\xfc\xb0\x28\xbd\x8f\xb1\xc6\x31"
+- "\x14\x4d\xf0\x74\x37\xfd\x07\x25"
+- "\x96\x55\xe5\xfc\x9e\x27\x2a\x74"
+- "\x1b\x83\x4d\x15\x83\xac\x57\xa0"
+- "\xac\xa5\xd0\x38\xef\x19\x56\x53"
+- "\x25\x4b\xfc\xce\x04\x23\xe5\x6b"
+- "\xf6\xc6\x6c\x32\x0b\xb3\x12\xc5"
+- "\xed\x22\x34\x1c\x5d\xed\x17\x06"
+- "\x36\xa3\xe6\x77\xb9\x97\x46\xb8"
+- "\xe9\x3f\x7e\xc7\xbc\x13\x5c\xdc"
+- "\x6e\x3f\x04\x5e\xd1\x59\xa5\x82"
+- "\x35\x91\x3d\x1b\xe4\x97\x9f\x92"
+- "\x1c\x5e\x5f\x6f\x41\xd4\x62\xa1"
+- "\x8d\x39\xfc\x42\xfb\x38\x80\xb9"
+- "\x0a\xe3\xcc\x6a\x93\xd9\x7a\xb1"
+- "\xe9\x69\xaf\x0a\x6b\x75\x38\xa7"
+- "\xa1\xbf\xf7\xda\x95\x93\x4b\x78"
+- "\x19\xf5\x94\xf9\xd2\x00\x33\x37"
+- "\xcf\xf5\x9e\x9c\xf3\xcc\xa6\xee"
+- "\x42\xb2\x9e\x2c\x5f\x48\x23\x26"
+- "\x15\x25\x17\x03\x3d\xfe\x2c\xfc"
+- "\xeb\xba\xda\xe0\x00\x05\xb6\xa6"
+- "\x07\xb3\xe8\x36\x5b\xec\x5b\xbf"
+- "\xd6\x5b\x00\x74\xc6\x97\xf1\x6a"
+- "\x49\xa1\xc3\xfa\x10\x52\xb9\x14"
+- "\xad\xb7\x73\xf8\x78\x12\xc8\x59"
+- "\x17\x80\x4c\x57\x39\xf1\x6d\x80"
+- "\x25\x77\x0f\x5e\x7d\xf0\xaf\x21"
+- "\xec\xce\xb7\xc8\x02\x8a\xed\x53"
+- "\x2c\x25\x68\x2e\x1f\x85\x5e\x67"
+- "\xd1\x07\x7a\x3a\x89\x08\xe0\x34"
+- "\xdc\xdb\x26\xb4\x6b\x77\xfc\x40"
+- "\x31\x15\x72\xa0\xf0\x73\xd9\x3b"
+- "\xd5\xdb\xfe\xfc\x8f\xa9\x44\xa2"
+- "\x09\x9f\xc6\x33\xe5\xe2\x88\xe8"
+- "\xf3\xf0\x1a\xf4\xce\x12\x0f\xd6"
+- "\xf7\x36\xe6\xa4\xf4\x7a\x10\x58"
+- "\xcc\x1f\x48\x49\x65\x47\x75\xe9"
+- "\x28\xe1\x65\x7b\xf2\xc4\xb5\x07"
+- "\xf2\xec\x76\xd8\x8f\x09\xf3\x16"
+- "\xa1\x51\x89\x3b\xeb\x96\x42\xac"
+- "\x65\xe0\x67\x63\x29\xdc\xb4\x7d"
+- "\xf2\x41\x51\x6a\xcb\xde\x3c\xfb"
+- "\x66\x8d\x13\xca\xe0\x59\x2a\x00"
+- "\xc9\x53\x4c\xe6\x9e\xe2\x73\xd5"
+- "\x67\x19\xb2\xbd\x9a\x63\xd7\x5c",
+- .len = 512,
+- .also_non_np = 1,
+- .np = 3,
+- .tap = { 512 - 20, 4, 16 },
+- }
+-};
+-
+-static const struct cipher_testvec speck64_tv_template[] = {
+- { /* Speck64/96 */
+- .key = "\x00\x01\x02\x03\x08\x09\x0a\x0b"
+- "\x10\x11\x12\x13",
+- .klen = 12,
+- .ptext = "\x65\x61\x6e\x73\x20\x46\x61\x74",
+- .ctext = "\x6c\x94\x75\x41\xec\x52\x79\x9f",
+- .len = 8,
+- }, { /* Speck64/128 */
+- .key = "\x00\x01\x02\x03\x08\x09\x0a\x0b"
+- "\x10\x11\x12\x13\x18\x19\x1a\x1b",
+- .klen = 16,
+- .ptext = "\x2d\x43\x75\x74\x74\x65\x72\x3b",
+- .ctext = "\x8b\x02\x4e\x45\x48\xa5\x6f\x8c",
+- .len = 8,
+- },
+-};
+-
+-/*
+- * Speck64-XTS test vectors, taken from the AES-XTS test vectors with the
+- * ciphertext recomputed with Speck64 as the cipher, and key lengths adjusted
+- */
+-static const struct cipher_testvec speck64_xts_tv_template[] = {
+- {
+- .key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .klen = 24,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ctext = "\x84\xaf\x54\x07\x19\xd4\x7c\xa6"
+- "\xe4\xfe\xdf\xc4\x1f\x34\xc3\xc2"
+- "\x80\xf5\x72\xe7\xcd\xf0\x99\x22"
+- "\x35\xa7\x2f\x06\xef\xdc\x51\xaa",
+- .len = 32,
+- }, {
+- .key = "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 24,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\x12\x56\x73\xcd\x15\x87\xa8\x59"
+- "\xcf\x84\xae\xd9\x1c\x66\xd6\x9f"
+- "\xb3\x12\x69\x7e\x36\xeb\x52\xff"
+- "\x62\xdd\xba\x90\xb3\xe1\xee\x99",
+- .len = 32,
+- }, {
+- .key = "\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8"
+- "\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 24,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\x15\x1b\xe4\x2c\xa2\x5a\x2d\x2c"
+- "\x27\x36\xc0\xbf\x5d\xea\x36\x37"
+- "\x2d\x1a\x88\xbc\x66\xb5\xd0\x0b"
+- "\xa1\xbc\x19\xb2\x0f\x3b\x75\x34",
+- .len = 32,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x31\x41\x59\x26\x53\x58\x97\x93",
+- .klen = 24,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\xaf\xa1\x81\xa6\x32\xbb\x15\x8e"
+- "\xf8\x95\x2e\xd3\xe6\xee\x7e\x09"
+- "\x0c\x1a\xf5\x02\x97\x8b\xe3\xb3"
+- "\x11\xc7\x39\x96\xd0\x95\xf4\x56"
+- "\xf4\xdd\x03\x38\x01\x44\x2c\xcf"
+- "\x88\xae\x8e\x3c\xcd\xe7\xaa\x66"
+- "\xfe\x3d\xc6\xfb\x01\x23\x51\x43"
+- "\xd5\xd2\x13\x86\x94\x34\xe9\x62"
+- "\xf9\x89\xe3\xd1\x7b\xbe\xf8\xef"
+- "\x76\x35\x04\x3f\xdb\x23\x9d\x0b"
+- "\x85\x42\xb9\x02\xd6\xcc\xdb\x96"
+- "\xa7\x6b\x27\xb6\xd4\x45\x8f\x7d"
+- "\xae\xd2\x04\xd5\xda\xc1\x7e\x24"
+- "\x8c\x73\xbe\x48\x7e\xcf\x65\x28"
+- "\x29\xe5\xbe\x54\x30\xcb\x46\x95"
+- "\x4f\x2e\x8a\x36\xc8\x27\xc5\xbe"
+- "\xd0\x1a\xaf\xab\x26\xcd\x9e\x69"
+- "\xa1\x09\x95\x71\x26\xe9\xc4\xdf"
+- "\xe6\x31\xc3\x46\xda\xaf\x0b\x41"
+- "\x1f\xab\xb1\x8e\xd6\xfc\x0b\xb3"
+- "\x82\xc0\x37\x27\xfc\x91\xa7\x05"
+- "\xfb\xc5\xdc\x2b\x74\x96\x48\x43"
+- "\x5d\x9c\x19\x0f\x60\x63\x3a\x1f"
+- "\x6f\xf0\x03\xbe\x4d\xfd\xc8\x4a"
+- "\xc6\xa4\x81\x6d\xc3\x12\x2a\x5c"
+- "\x07\xff\xf3\x72\x74\x48\xb5\x40"
+- "\x50\xb5\xdd\x90\x43\x31\x18\x15"
+- "\x7b\xf2\xa6\xdb\x83\xc8\x4b\x4a"
+- "\x29\x93\x90\x8b\xda\x07\xf0\x35"
+- "\x6d\x90\x88\x09\x4e\x83\xf5\x5b"
+- "\x94\x12\xbb\x33\x27\x1d\x3f\x23"
+- "\x51\xa8\x7c\x07\xa2\xae\x77\xa6"
+- "\x50\xfd\xcc\xc0\x4f\x80\x7a\x9f"
+- "\x66\xdd\xcd\x75\x24\x8b\x33\xf7"
+- "\x20\xdb\x83\x9b\x4f\x11\x63\x6e"
+- "\xcf\x37\xef\xc9\x11\x01\x5c\x45"
+- "\x32\x99\x7c\x3c\x9e\x42\x89\xe3"
+- "\x70\x6d\x15\x9f\xb1\xe6\xb6\x05"
+- "\xfe\x0c\xb9\x49\x2d\x90\x6d\xcc"
+- "\x5d\x3f\xc1\xfe\x89\x0a\x2e\x2d"
+- "\xa0\xa8\x89\x3b\x73\x39\xa5\x94"
+- "\x4c\xa4\xa6\xbb\xa7\x14\x46\x89"
+- "\x10\xff\xaf\xef\xca\xdd\x4f\x80"
+- "\xb3\xdf\x3b\xab\xd4\xe5\x5a\xc7"
+- "\x33\xca\x00\x8b\x8b\x3f\xea\xec"
+- "\x68\x8a\xc2\x6d\xfd\xd4\x67\x0f"
+- "\x22\x31\xe1\x0e\xfe\x5a\x04\xd5"
+- "\x64\xa3\xf1\x1a\x76\x28\xcc\x35"
+- "\x36\xa7\x0a\x74\xf7\x1c\x44\x9b"
+- "\xc7\x1b\x53\x17\x02\xea\xd1\xad"
+- "\x13\x51\x73\xc0\xa0\xb2\x05\x32"
+- "\xa8\xa2\x37\x2e\xe1\x7a\x3a\x19"
+- "\x26\xb4\x6c\x62\x5d\xb3\x1a\x1d"
+- "\x59\xda\xee\x1a\x22\x18\xda\x0d"
+- "\x88\x0f\x55\x8b\x72\x62\xfd\xc1"
+- "\x69\x13\xcd\x0d\x5f\xc1\x09\x52"
+- "\xee\xd6\xe3\x84\x4d\xee\xf6\x88"
+- "\xaf\x83\xdc\x76\xf4\xc0\x93\x3f"
+- "\x4a\x75\x2f\xb0\x0b\x3e\xc4\x54"
+- "\x7d\x69\x8d\x00\x62\x77\x0d\x14"
+- "\xbe\x7c\xa6\x7d\xc5\x24\x4f\xf3"
+- "\x50\xf7\x5f\xf4\xc2\xca\x41\x97"
+- "\x37\xbe\x75\x74\xcd\xf0\x75\x6e"
+- "\x25\x23\x94\xbd\xda\x8d\xb0\xd4",
+- .len = 512,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x62\x49\x77\x57\x24\x70\x93\x69"
+- "\x99\x59\x57\x49\x66\x96\x76\x27",
+- .klen = 32,
+- .iv = "\xff\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\x55\xed\x71\xd3\x02\x8e\x15\x3b"
+- "\xc6\x71\x29\x2d\x3e\x89\x9f\x59"
+- "\x68\x6a\xcc\x8a\x56\x97\xf3\x95"
+- "\x4e\x51\x08\xda\x2a\xf8\x6f\x3c"
+- "\x78\x16\xea\x80\xdb\x33\x75\x94"
+- "\xf9\x29\xc4\x2b\x76\x75\x97\xc7"
+- "\xf2\x98\x2c\xf9\xff\xc8\xd5\x2b"
+- "\x18\xf1\xaf\xcf\x7c\xc5\x0b\xee"
+- "\xad\x3c\x76\x7c\xe6\x27\xa2\x2a"
+- "\xe4\x66\xe1\xab\xa2\x39\xfc\x7c"
+- "\xf5\xec\x32\x74\xa3\xb8\x03\x88"
+- "\x52\xfc\x2e\x56\x3f\xa1\xf0\x9f"
+- "\x84\x5e\x46\xed\x20\x89\xb6\x44"
+- "\x8d\xd0\xed\x54\x47\x16\xbe\x95"
+- "\x8a\xb3\x6b\x72\xc4\x32\x52\x13"
+- "\x1b\xb0\x82\xbe\xac\xf9\x70\xa6"
+- "\x44\x18\xdd\x8c\x6e\xca\x6e\x45"
+- "\x8f\x1e\x10\x07\x57\x25\x98\x7b"
+- "\x17\x8c\x78\xdd\x80\xa7\xd9\xd8"
+- "\x63\xaf\xb9\x67\x57\xfd\xbc\xdb"
+- "\x44\xe9\xc5\x65\xd1\xc7\x3b\xff"
+- "\x20\xa0\x80\x1a\xc3\x9a\xad\x5e"
+- "\x5d\x3b\xd3\x07\xd9\xf5\xfd\x3d"
+- "\x4a\x8b\xa8\xd2\x6e\x7a\x51\x65"
+- "\x6c\x8e\x95\xe0\x45\xc9\x5f\x4a"
+- "\x09\x3c\x3d\x71\x7f\x0c\x84\x2a"
+- "\xc8\x48\x52\x1a\xc2\xd5\xd6\x78"
+- "\x92\x1e\xa0\x90\x2e\xea\xf0\xf3"
+- "\xdc\x0f\xb1\xaf\x0d\x9b\x06\x2e"
+- "\x35\x10\x30\x82\x0d\xe7\xc5\x9b"
+- "\xde\x44\x18\xbd\x9f\xd1\x45\xa9"
+- "\x7b\x7a\x4a\xad\x35\x65\x27\xca"
+- "\xb2\xc3\xd4\x9b\x71\x86\x70\xee"
+- "\xf1\x89\x3b\x85\x4b\x5b\xaa\xaf"
+- "\xfc\x42\xc8\x31\x59\xbe\x16\x60"
+- "\x4f\xf9\xfa\x12\xea\xd0\xa7\x14"
+- "\xf0\x7a\xf3\xd5\x8d\xbd\x81\xef"
+- "\x52\x7f\x29\x51\x94\x20\x67\x3c"
+- "\xd1\xaf\x77\x9f\x22\x5a\x4e\x63"
+- "\xe7\xff\x73\x25\xd1\xdd\x96\x8a"
+- "\x98\x52\x6d\xf3\xac\x3e\xf2\x18"
+- "\x6d\xf6\x0a\x29\xa6\x34\x3d\xed"
+- "\xe3\x27\x0d\x9d\x0a\x02\x44\x7e"
+- "\x5a\x7e\x67\x0f\x0a\x9e\xd6\xad"
+- "\x91\xe6\x4d\x81\x8c\x5c\x59\xaa"
+- "\xfb\xeb\x56\x53\xd2\x7d\x4c\x81"
+- "\x65\x53\x0f\x41\x11\xbd\x98\x99"
+- "\xf9\xc6\xfa\x51\x2e\xa3\xdd\x8d"
+- "\x84\x98\xf9\x34\xed\x33\x2a\x1f"
+- "\x82\xed\xc1\x73\x98\xd3\x02\xdc"
+- "\xe6\xc2\x33\x1d\xa2\xb4\xca\x76"
+- "\x63\x51\x34\x9d\x96\x12\xae\xce"
+- "\x83\xc9\x76\x5e\xa4\x1b\x53\x37"
+- "\x17\xd5\xc0\x80\x1d\x62\xf8\x3d"
+- "\x54\x27\x74\xbb\x10\x86\x57\x46"
+- "\x68\xe1\xed\x14\xe7\x9d\xfc\x84"
+- "\x47\xbc\xc2\xf8\x19\x4b\x99\xcf"
+- "\x7a\xe9\xc4\xb8\x8c\x82\x72\x4d"
+- "\x7b\x4f\x38\x55\x36\x71\x64\xc1"
+- "\xfc\x5c\x75\x52\x33\x02\x18\xf8"
+- "\x17\xe1\x2b\xc2\x43\x39\xbd\x76"
+- "\x9b\x63\x76\x32\x2f\x19\x72\x10"
+- "\x9f\x21\x0c\xf1\x66\x50\x7f\xa5"
+- "\x0d\x1f\x46\xe0\xba\xd3\x2f\x3c",
+- .len = 512,
+- .also_non_np = 1,
+- .np = 3,
+- .tap = { 512 - 20, 4, 16 },
+- }
+-};
+-
+ /* Cast6 test vectors from RFC 2612 */
+ static const struct cipher_testvec cast6_tv_template[] = {
+ {
+diff --git a/drivers/acpi/acpi_lpit.c b/drivers/acpi/acpi_lpit.c
+index cf4fc0161164..e43cb71b6972 100644
+--- a/drivers/acpi/acpi_lpit.c
++++ b/drivers/acpi/acpi_lpit.c
+@@ -117,11 +117,17 @@ static void lpit_update_residency(struct lpit_residency_info *info,
+ if (!info->iomem_addr)
+ return;
+
++ if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0))
++ return;
++
+ /* Silently fail, if cpuidle attribute group is not present */
+ sysfs_add_file_to_group(&cpu_subsys.dev_root->kobj,
+ &dev_attr_low_power_idle_system_residency_us.attr,
+ "cpuidle");
+ } else if (info->gaddr.space_id == ACPI_ADR_SPACE_FIXED_HARDWARE) {
++ if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0))
++ return;
++
+ /* Silently fail, if cpuidle attribute group is not present */
+ sysfs_add_file_to_group(&cpu_subsys.dev_root->kobj,
+ &dev_attr_low_power_idle_cpu_residency_us.attr,
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index bf64cfa30feb..969bf8d515c0 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -327,9 +327,11 @@ static const struct acpi_device_id acpi_lpss_device_ids[] = {
+ { "INT33FC", },
+
+ /* Braswell LPSS devices */
++ { "80862286", LPSS_ADDR(lpss_dma_desc) },
+ { "80862288", LPSS_ADDR(bsw_pwm_dev_desc) },
+ { "8086228A", LPSS_ADDR(bsw_uart_dev_desc) },
+ { "8086228E", LPSS_ADDR(bsw_spi_dev_desc) },
++ { "808622C0", LPSS_ADDR(lpss_dma_desc) },
+ { "808622C1", LPSS_ADDR(bsw_i2c_dev_desc) },
+
+ /* Broadwell LPSS devices */
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index 449d86d39965..fc447410ae4d 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -643,7 +643,7 @@ static acpi_status __init acpi_processor_ids_walk(acpi_handle handle,
+
+ status = acpi_get_type(handle, &acpi_type);
+ if (ACPI_FAILURE(status))
+- return false;
++ return status;
+
+ switch (acpi_type) {
+ case ACPI_TYPE_PROCESSOR:
+@@ -663,11 +663,12 @@ static acpi_status __init acpi_processor_ids_walk(acpi_handle handle,
+ }
+
+ processor_validated_ids_update(uid);
+- return true;
++ return AE_OK;
+
+ err:
++ /* Exit on error, but don't abort the namespace walk */
+ acpi_handle_info(handle, "Invalid processor object\n");
+- return false;
++ return AE_OK;
+
+ }
+
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index e9fb0bf3c8d2..78f9de260d5f 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -417,6 +417,10 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
++ status = acpi_ut_add_address_range(obj_desc->region.space_id,
++ obj_desc->region.address,
++ obj_desc->region.length, node);
++
+ /* Now the address and length are valid for this opregion */
+
+ obj_desc->region.flags |= AOPOBJ_DATA_VALID;
+diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
+index 34fc2f7476ed..b0789c483b0f 100644
+--- a/drivers/acpi/acpica/psloop.c
++++ b/drivers/acpi/acpica/psloop.c
+@@ -417,6 +417,7 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
+ union acpi_parse_object *op = NULL; /* current op */
+ struct acpi_parse_state *parser_state;
+ u8 *aml_op_start = NULL;
++ u8 opcode_length;
+
+ ACPI_FUNCTION_TRACE_PTR(ps_parse_loop, walk_state);
+
+@@ -540,8 +541,19 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
+ "Skip parsing opcode %s",
+ acpi_ps_get_opcode_name
+ (walk_state->opcode)));
++
++ /*
++ * Determine the opcode length before skipping the opcode.
++ * An opcode can be 1 byte or 2 bytes in length.
++ */
++ opcode_length = 1;
++ if ((walk_state->opcode & 0xFF00) ==
++ AML_EXTENDED_OPCODE) {
++ opcode_length = 2;
++ }
+ walk_state->parser_state.aml =
+- walk_state->aml + 1;
++ walk_state->aml + opcode_length;
++
+ walk_state->parser_state.aml =
+ acpi_ps_get_next_package_end
+ (&walk_state->parser_state);
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index b072cfc5f20e..19b641208d86 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2466,7 +2466,8 @@ static int ars_get_cap(struct acpi_nfit_desc *acpi_desc,
+ return cmd_rc;
+ }
+
+-static int ars_start(struct acpi_nfit_desc *acpi_desc, struct nfit_spa *nfit_spa)
++static int ars_start(struct acpi_nfit_desc *acpi_desc,
++ struct nfit_spa *nfit_spa, enum nfit_ars_state req_type)
+ {
+ int rc;
+ int cmd_rc;
+@@ -2477,7 +2478,7 @@ static int ars_start(struct acpi_nfit_desc *acpi_desc, struct nfit_spa *nfit_spa
+ memset(&ars_start, 0, sizeof(ars_start));
+ ars_start.address = spa->address;
+ ars_start.length = spa->length;
+- if (test_bit(ARS_SHORT, &nfit_spa->ars_state))
++ if (req_type == ARS_REQ_SHORT)
+ ars_start.flags = ND_ARS_RETURN_PREV_DATA;
+ if (nfit_spa_type(spa) == NFIT_SPA_PM)
+ ars_start.type = ND_ARS_PERSISTENT;
+@@ -2534,6 +2535,15 @@ static void ars_complete(struct acpi_nfit_desc *acpi_desc,
+ struct nd_region *nd_region = nfit_spa->nd_region;
+ struct device *dev;
+
++ lockdep_assert_held(&acpi_desc->init_mutex);
++ /*
++ * Only advance the ARS state for ARS runs initiated by the
++ * kernel, ignore ARS results from BIOS initiated runs for scrub
++ * completion tracking.
++ */
++ if (acpi_desc->scrub_spa != nfit_spa)
++ return;
++
+ if ((ars_status->address >= spa->address && ars_status->address
+ < spa->address + spa->length)
+ || (ars_status->address < spa->address)) {
+@@ -2553,28 +2563,13 @@ static void ars_complete(struct acpi_nfit_desc *acpi_desc,
+ } else
+ return;
+
+- if (test_bit(ARS_DONE, &nfit_spa->ars_state))
+- return;
+-
+- if (!test_and_clear_bit(ARS_REQ, &nfit_spa->ars_state))
+- return;
+-
++ acpi_desc->scrub_spa = NULL;
+ if (nd_region) {
+ dev = nd_region_dev(nd_region);
+ nvdimm_region_notify(nd_region, NVDIMM_REVALIDATE_POISON);
+ } else
+ dev = acpi_desc->dev;
+-
+- dev_dbg(dev, "ARS: range %d %s complete\n", spa->range_index,
+- test_bit(ARS_SHORT, &nfit_spa->ars_state)
+- ? "short" : "long");
+- clear_bit(ARS_SHORT, &nfit_spa->ars_state);
+- if (test_and_clear_bit(ARS_REQ_REDO, &nfit_spa->ars_state)) {
+- set_bit(ARS_SHORT, &nfit_spa->ars_state);
+- set_bit(ARS_REQ, &nfit_spa->ars_state);
+- dev_dbg(dev, "ARS: processing scrub request received while in progress\n");
+- } else
+- set_bit(ARS_DONE, &nfit_spa->ars_state);
++ dev_dbg(dev, "ARS: range %d complete\n", spa->range_index);
+ }
+
+ static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc)
+@@ -2855,46 +2850,55 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc)
+ return 0;
+ }
+
+-static int ars_register(struct acpi_nfit_desc *acpi_desc, struct nfit_spa *nfit_spa,
+- int *query_rc)
++static int ars_register(struct acpi_nfit_desc *acpi_desc,
++ struct nfit_spa *nfit_spa)
+ {
+- int rc = *query_rc;
++ int rc;
+
+- if (no_init_ars)
++ if (no_init_ars || test_bit(ARS_FAILED, &nfit_spa->ars_state))
+ return acpi_nfit_register_region(acpi_desc, nfit_spa);
+
+- set_bit(ARS_REQ, &nfit_spa->ars_state);
+- set_bit(ARS_SHORT, &nfit_spa->ars_state);
++ set_bit(ARS_REQ_SHORT, &nfit_spa->ars_state);
++ set_bit(ARS_REQ_LONG, &nfit_spa->ars_state);
+
+- switch (rc) {
++ switch (acpi_nfit_query_poison(acpi_desc)) {
+ case 0:
+ case -EAGAIN:
+- rc = ars_start(acpi_desc, nfit_spa);
+- if (rc == -EBUSY) {
+- *query_rc = rc;
++ rc = ars_start(acpi_desc, nfit_spa, ARS_REQ_SHORT);
++ /* shouldn't happen, try again later */
++ if (rc == -EBUSY)
+ break;
+- } else if (rc == 0) {
+- rc = acpi_nfit_query_poison(acpi_desc);
+- } else {
++ if (rc) {
+ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ break;
+ }
+- if (rc == -EAGAIN)
+- clear_bit(ARS_SHORT, &nfit_spa->ars_state);
+- else if (rc == 0)
+- ars_complete(acpi_desc, nfit_spa);
++ clear_bit(ARS_REQ_SHORT, &nfit_spa->ars_state);
++ rc = acpi_nfit_query_poison(acpi_desc);
++ if (rc)
++ break;
++ acpi_desc->scrub_spa = nfit_spa;
++ ars_complete(acpi_desc, nfit_spa);
++ /*
++ * If ars_complete() says we didn't complete the
++ * short scrub, we'll try again with a long
++ * request.
++ */
++ acpi_desc->scrub_spa = NULL;
+ break;
+ case -EBUSY:
++ case -ENOMEM:
+ case -ENOSPC:
++ /*
++ * BIOS was using ARS, wait for it to complete (or
++ * resources to become available) and then perform our
++ * own scrubs.
++ */
+ break;
+ default:
+ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ break;
+ }
+
+- if (test_and_clear_bit(ARS_DONE, &nfit_spa->ars_state))
+- set_bit(ARS_REQ, &nfit_spa->ars_state);
+-
+ return acpi_nfit_register_region(acpi_desc, nfit_spa);
+ }
+
+@@ -2916,6 +2920,8 @@ static unsigned int __acpi_nfit_scrub(struct acpi_nfit_desc *acpi_desc,
+ struct device *dev = acpi_desc->dev;
+ struct nfit_spa *nfit_spa;
+
++ lockdep_assert_held(&acpi_desc->init_mutex);
++
+ if (acpi_desc->cancel)
+ return 0;
+
+@@ -2939,21 +2945,49 @@ static unsigned int __acpi_nfit_scrub(struct acpi_nfit_desc *acpi_desc,
+
+ ars_complete_all(acpi_desc);
+ list_for_each_entry(nfit_spa, &acpi_desc->spas, list) {
++ enum nfit_ars_state req_type;
++ int rc;
++
+ if (test_bit(ARS_FAILED, &nfit_spa->ars_state))
+ continue;
+- if (test_bit(ARS_REQ, &nfit_spa->ars_state)) {
+- int rc = ars_start(acpi_desc, nfit_spa);
+-
+- clear_bit(ARS_DONE, &nfit_spa->ars_state);
+- dev = nd_region_dev(nfit_spa->nd_region);
+- dev_dbg(dev, "ARS: range %d ARS start (%d)\n",
+- nfit_spa->spa->range_index, rc);
+- if (rc == 0 || rc == -EBUSY)
+- return 1;
+- dev_err(dev, "ARS: range %d ARS failed (%d)\n",
+- nfit_spa->spa->range_index, rc);
+- set_bit(ARS_FAILED, &nfit_spa->ars_state);
++
++ /* prefer short ARS requests first */
++ if (test_bit(ARS_REQ_SHORT, &nfit_spa->ars_state))
++ req_type = ARS_REQ_SHORT;
++ else if (test_bit(ARS_REQ_LONG, &nfit_spa->ars_state))
++ req_type = ARS_REQ_LONG;
++ else
++ continue;
++ rc = ars_start(acpi_desc, nfit_spa, req_type);
++
++ dev = nd_region_dev(nfit_spa->nd_region);
++ dev_dbg(dev, "ARS: range %d ARS start %s (%d)\n",
++ nfit_spa->spa->range_index,
++ req_type == ARS_REQ_SHORT ? "short" : "long",
++ rc);
++ /*
++ * Hmm, we raced someone else starting ARS? Try again in
++ * a bit.
++ */
++ if (rc == -EBUSY)
++ return 1;
++ if (rc == 0) {
++ dev_WARN_ONCE(dev, acpi_desc->scrub_spa,
++ "scrub start while range %d active\n",
++ acpi_desc->scrub_spa->spa->range_index);
++ clear_bit(req_type, &nfit_spa->ars_state);
++ acpi_desc->scrub_spa = nfit_spa;
++ /*
++ * Consider this spa last for future scrub
++ * requests
++ */
++ list_move_tail(&nfit_spa->list, &acpi_desc->spas);
++ return 1;
+ }
++
++ dev_err(dev, "ARS: range %d ARS failed (%d)\n",
++ nfit_spa->spa->range_index, rc);
++ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ }
+ return 0;
+ }
+@@ -3009,6 +3043,7 @@ static void acpi_nfit_init_ars(struct acpi_nfit_desc *acpi_desc,
+ struct nd_cmd_ars_cap ars_cap;
+ int rc;
+
++ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ memset(&ars_cap, 0, sizeof(ars_cap));
+ rc = ars_get_cap(acpi_desc, &ars_cap, nfit_spa);
+ if (rc < 0)
+@@ -3025,16 +3060,14 @@ static void acpi_nfit_init_ars(struct acpi_nfit_desc *acpi_desc,
+ nfit_spa->clear_err_unit = ars_cap.clear_err_unit;
+ acpi_desc->max_ars = max(nfit_spa->max_ars, acpi_desc->max_ars);
+ clear_bit(ARS_FAILED, &nfit_spa->ars_state);
+- set_bit(ARS_REQ, &nfit_spa->ars_state);
+ }
+
+ static int acpi_nfit_register_regions(struct acpi_nfit_desc *acpi_desc)
+ {
+ struct nfit_spa *nfit_spa;
+- int rc, query_rc;
++ int rc;
+
+ list_for_each_entry(nfit_spa, &acpi_desc->spas, list) {
+- set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ switch (nfit_spa_type(nfit_spa->spa)) {
+ case NFIT_SPA_VOLATILE:
+ case NFIT_SPA_PM:
+@@ -3043,20 +3076,12 @@ static int acpi_nfit_register_regions(struct acpi_nfit_desc *acpi_desc)
+ }
+ }
+
+- /*
+- * Reap any results that might be pending before starting new
+- * short requests.
+- */
+- query_rc = acpi_nfit_query_poison(acpi_desc);
+- if (query_rc == 0)
+- ars_complete_all(acpi_desc);
+-
+ list_for_each_entry(nfit_spa, &acpi_desc->spas, list)
+ switch (nfit_spa_type(nfit_spa->spa)) {
+ case NFIT_SPA_VOLATILE:
+ case NFIT_SPA_PM:
+ /* register regions and kick off initial ARS run */
+- rc = ars_register(acpi_desc, nfit_spa, &query_rc);
++ rc = ars_register(acpi_desc, nfit_spa);
+ if (rc)
+ return rc;
+ break;
+@@ -3251,7 +3276,8 @@ static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
+ return 0;
+ }
+
+-int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc, unsigned long flags)
++int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc,
++ enum nfit_ars_state req_type)
+ {
+ struct device *dev = acpi_desc->dev;
+ int scheduled = 0, busy = 0;
+@@ -3271,14 +3297,10 @@ int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc, unsigned long flags)
+ if (test_bit(ARS_FAILED, &nfit_spa->ars_state))
+ continue;
+
+- if (test_and_set_bit(ARS_REQ, &nfit_spa->ars_state)) {
++ if (test_and_set_bit(req_type, &nfit_spa->ars_state))
+ busy++;
+- set_bit(ARS_REQ_REDO, &nfit_spa->ars_state);
+- } else {
+- if (test_bit(ARS_SHORT, &flags))
+- set_bit(ARS_SHORT, &nfit_spa->ars_state);
++ else
+ scheduled++;
+- }
+ }
+ if (scheduled) {
+ sched_ars(acpi_desc);
+@@ -3464,10 +3486,11 @@ static void acpi_nfit_update_notify(struct device *dev, acpi_handle handle)
+ static void acpi_nfit_uc_error_notify(struct device *dev, acpi_handle handle)
+ {
+ struct acpi_nfit_desc *acpi_desc = dev_get_drvdata(dev);
+- unsigned long flags = (acpi_desc->scrub_mode == HW_ERROR_SCRUB_ON) ?
+- 0 : 1 << ARS_SHORT;
+
+- acpi_nfit_ars_rescan(acpi_desc, flags);
++ if (acpi_desc->scrub_mode == HW_ERROR_SCRUB_ON)
++ acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG);
++ else
++ acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_SHORT);
+ }
+
+ void __acpi_nfit_notify(struct device *dev, acpi_handle handle, u32 event)
+diff --git a/drivers/acpi/nfit/nfit.h b/drivers/acpi/nfit/nfit.h
+index d1274ea2d251..02c10de50386 100644
+--- a/drivers/acpi/nfit/nfit.h
++++ b/drivers/acpi/nfit/nfit.h
+@@ -118,10 +118,8 @@ enum nfit_dimm_notifiers {
+ };
+
+ enum nfit_ars_state {
+- ARS_REQ,
+- ARS_REQ_REDO,
+- ARS_DONE,
+- ARS_SHORT,
++ ARS_REQ_SHORT,
++ ARS_REQ_LONG,
+ ARS_FAILED,
+ };
+
+@@ -198,6 +196,7 @@ struct acpi_nfit_desc {
+ struct device *dev;
+ u8 ars_start_flags;
+ struct nd_cmd_ars_status *ars_status;
++ struct nfit_spa *scrub_spa;
+ struct delayed_work dwork;
+ struct list_head list;
+ struct kernfs_node *scrub_count_state;
+@@ -252,7 +251,8 @@ struct nfit_blk {
+
+ extern struct list_head acpi_descs;
+ extern struct mutex acpi_desc_lock;
+-int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc, unsigned long flags);
++int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc,
++ enum nfit_ars_state req_type);
+
+ #ifdef CONFIG_X86_MCE
+ void nfit_mce_register(void);
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index 8df9abfa947b..ed73f6fb0779 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -617,15 +617,18 @@ void acpi_os_stall(u32 us)
+ }
+
+ /*
+- * Support ACPI 3.0 AML Timer operand
+- * Returns 64-bit free-running, monotonically increasing timer
+- * with 100ns granularity
++ * Support ACPI 3.0 AML Timer operand. Returns a 64-bit free-running,
++ * monotonically increasing timer with 100ns granularity. Do not use
++ * ktime_get() to implement this function because this function may get
++ * called after timekeeping has been suspended. Note: calling this function
++ * after timekeeping has been suspended may lead to unexpected results
++ * because when timekeeping is suspended the jiffies counter is not
++ * incremented. See also timekeeping_suspend().
+ */
+ u64 acpi_os_get_timer(void)
+ {
+- u64 time_ns = ktime_to_ns(ktime_get());
+- do_div(time_ns, 100);
+- return time_ns;
++ return (get_jiffies_64() - INITIAL_JIFFIES) *
++ (ACPI_100NSEC_PER_SEC / HZ);
+ }
+
+ acpi_status acpi_os_read_port(acpi_io_address port, u32 * value, u32 width)
+diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c
+index d1e26cb599bf..da031b1df6f5 100644
+--- a/drivers/acpi/pptt.c
++++ b/drivers/acpi/pptt.c
+@@ -338,9 +338,6 @@ static struct acpi_pptt_cache *acpi_find_cache_node(struct acpi_table_header *ta
+ return found;
+ }
+
+-/* total number of attributes checked by the properties code */
+-#define PPTT_CHECKED_ATTRIBUTES 4
+-
+ /**
+ * update_cache_properties() - Update cacheinfo for the given processor
+ * @this_leaf: Kernel cache info structure being updated
+@@ -357,25 +354,15 @@ static void update_cache_properties(struct cacheinfo *this_leaf,
+ struct acpi_pptt_cache *found_cache,
+ struct acpi_pptt_processor *cpu_node)
+ {
+- int valid_flags = 0;
+-
+ this_leaf->fw_token = cpu_node;
+- if (found_cache->flags & ACPI_PPTT_SIZE_PROPERTY_VALID) {
++ if (found_cache->flags & ACPI_PPTT_SIZE_PROPERTY_VALID)
+ this_leaf->size = found_cache->size;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_LINE_SIZE_VALID) {
++ if (found_cache->flags & ACPI_PPTT_LINE_SIZE_VALID)
+ this_leaf->coherency_line_size = found_cache->line_size;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_NUMBER_OF_SETS_VALID) {
++ if (found_cache->flags & ACPI_PPTT_NUMBER_OF_SETS_VALID)
+ this_leaf->number_of_sets = found_cache->number_of_sets;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_ASSOCIATIVITY_VALID) {
++ if (found_cache->flags & ACPI_PPTT_ASSOCIATIVITY_VALID)
+ this_leaf->ways_of_associativity = found_cache->associativity;
+- valid_flags++;
+- }
+ if (found_cache->flags & ACPI_PPTT_WRITE_POLICY_VALID) {
+ switch (found_cache->attributes & ACPI_PPTT_MASK_WRITE_POLICY) {
+ case ACPI_PPTT_CACHE_POLICY_WT:
+@@ -402,11 +389,17 @@ static void update_cache_properties(struct cacheinfo *this_leaf,
+ }
+ }
+ /*
+- * If the above flags are valid, and the cache type is NOCACHE
+- * update the cache type as well.
++ * If cache type is NOCACHE, then the cache hasn't been specified
++ * via other mechanisms. Update the type if a cache type has been
++ * provided.
++ *
++ * Note, we assume such caches are unified based on conventional system
++ * design and known examples. Significant work is required elsewhere to
++ * fully support data/instruction only type caches which are only
++ * specified in PPTT.
+ */
+ if (this_leaf->type == CACHE_TYPE_NOCACHE &&
+- valid_flags == PPTT_CHECKED_ATTRIBUTES)
++ found_cache->flags & ACPI_PPTT_CACHE_TYPE_VALID)
+ this_leaf->type = CACHE_TYPE_UNIFIED;
+ }
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index a9dd4ea7467d..6e594644cb1d 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4553,6 +4553,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ /* These specific Samsung models/firmware-revs do not handle LPM well */
+ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
+ { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM, },
++ { "SAMSUNG MZ7TD256HAFV-000L9", "DXT02L5Q", ATA_HORKAGE_NOLPM, },
+
+ /* devices that don't properly handle queued TRIM commands */
+ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
+index dfb2c2622e5a..822e3060d834 100644
+--- a/drivers/block/ataflop.c
++++ b/drivers/block/ataflop.c
+@@ -1935,6 +1935,11 @@ static int __init atari_floppy_init (void)
+ unit[i].disk = alloc_disk(1);
+ if (!unit[i].disk)
+ goto Enomem;
++
++ unit[i].disk->queue = blk_init_queue(do_fd_request,
++ &ataflop_lock);
++ if (!unit[i].disk->queue)
++ goto Enomem;
+ }
+
+ if (UseTrackbuffer < 0)
+@@ -1966,10 +1971,6 @@ static int __init atari_floppy_init (void)
+ sprintf(unit[i].disk->disk_name, "fd%d", i);
+ unit[i].disk->fops = &floppy_fops;
+ unit[i].disk->private_data = &unit[i];
+- unit[i].disk->queue = blk_init_queue(do_fd_request,
+- &ataflop_lock);
+- if (!unit[i].disk->queue)
+- goto Enomem;
+ set_capacity(unit[i].disk, MAX_DISK_SIZE * 2);
+ add_disk(unit[i].disk);
+ }
+@@ -1984,13 +1985,17 @@ static int __init atari_floppy_init (void)
+
+ return 0;
+ Enomem:
+- while (i--) {
+- struct request_queue *q = unit[i].disk->queue;
++ do {
++ struct gendisk *disk = unit[i].disk;
+
+- put_disk(unit[i].disk);
+- if (q)
+- blk_cleanup_queue(q);
+- }
++ if (disk) {
++ if (disk->queue) {
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++ }
++ put_disk(unit[i].disk);
++ }
++ } while (i--);
+
+ unregister_blkdev(FLOPPY_MAJOR, "fd");
+ return -ENOMEM;
+diff --git a/drivers/block/swim.c b/drivers/block/swim.c
+index 0e31884a9519..cbe909c51847 100644
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -887,8 +887,17 @@ static int swim_floppy_init(struct swim_priv *swd)
+
+ exit_put_disks:
+ unregister_blkdev(FLOPPY_MAJOR, "fd");
+- while (drive--)
+- put_disk(swd->unit[drive].disk);
++ do {
++ struct gendisk *disk = swd->unit[drive].disk;
++
++ if (disk) {
++ if (disk->queue) {
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++ }
++ put_disk(disk);
++ }
++ } while (drive--);
+ return err;
+ }
+
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 429d20131c7e..3e905da33bcb 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1919,6 +1919,7 @@ static int negotiate_mq(struct blkfront_info *info)
+ GFP_KERNEL);
+ if (!info->rinfo) {
+ xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
++ info->nr_rings = 0;
+ return -ENOMEM;
+ }
+
+@@ -2493,6 +2494,9 @@ static int blkfront_remove(struct xenbus_device *xbdev)
+
+ dev_dbg(&xbdev->dev, "%s removed", xbdev->nodename);
+
++ if (!info)
++ return 0;
++
+ blkif_free(info, 0);
+
+ mutex_lock(&info->mutex);
+diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
+index 99cde1f9467d..e3e4d929e74f 100644
+--- a/drivers/bluetooth/btbcm.c
++++ b/drivers/bluetooth/btbcm.c
+@@ -324,6 +324,7 @@ static const struct bcm_subver_table bcm_uart_subver_table[] = {
+ { 0x4103, "BCM4330B1" }, /* 002.001.003 */
+ { 0x410e, "BCM43341B0" }, /* 002.001.014 */
+ { 0x4406, "BCM4324B3" }, /* 002.004.006 */
++ { 0x6109, "BCM4335C0" }, /* 003.001.009 */
+ { 0x610c, "BCM4354" }, /* 003.001.012 */
+ { 0x2122, "BCM4343A0" }, /* 001.001.034 */
+ { 0x2209, "BCM43430A1" }, /* 001.002.009 */
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 2fee65886d50..f0d593c3fa72 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -167,7 +167,7 @@ struct qca_serdev {
+ };
+
+ static int qca_power_setup(struct hci_uart *hu, bool on);
+-static void qca_power_shutdown(struct hci_dev *hdev);
++static void qca_power_shutdown(struct hci_uart *hu);
+
+ static void __serial_clock_on(struct tty_struct *tty)
+ {
+@@ -609,7 +609,7 @@ static int qca_close(struct hci_uart *hu)
+ if (hu->serdev) {
+ qcadev = serdev_device_get_drvdata(hu->serdev);
+ if (qcadev->btsoc_type == QCA_WCN3990)
+- qca_power_shutdown(hu->hdev);
++ qca_power_shutdown(hu);
+ else
+ gpiod_set_value_cansleep(qcadev->bt_en, 0);
+
+@@ -1232,12 +1232,15 @@ static const struct qca_vreg_data qca_soc_data = {
+ .num_vregs = 4,
+ };
+
+-static void qca_power_shutdown(struct hci_dev *hdev)
++static void qca_power_shutdown(struct hci_uart *hu)
+ {
+- struct hci_uart *hu = hci_get_drvdata(hdev);
++ struct serdev_device *serdev = hu->serdev;
++ unsigned char cmd = QCA_WCN3990_POWEROFF_PULSE;
+
+ host_set_baudrate(hu, 2400);
+- qca_send_power_pulse(hdev, QCA_WCN3990_POWEROFF_PULSE);
++ hci_uart_set_flow_control(hu, true);
++ serdev_device_write_buf(serdev, &cmd, sizeof(cmd));
++ hci_uart_set_flow_control(hu, false);
+ qca_power_setup(hu, false);
+ }
+
+@@ -1413,7 +1416,7 @@ static void qca_serdev_remove(struct serdev_device *serdev)
+ struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
+
+ if (qcadev->btsoc_type == QCA_WCN3990)
+- qca_power_shutdown(qcadev->serdev_hu.hdev);
++ qca_power_shutdown(&qcadev->serdev_hu);
+ else
+ clk_disable_unprepare(qcadev->susclk);
+
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 29e67a80fb20..9b786726e426 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -606,8 +606,9 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+ ssif_info->waiting_alert = true;
+ ssif_info->rtc_us_timer = SSIF_MSG_USEC;
+- mod_timer(&ssif_info->retry_timer,
+- jiffies + SSIF_MSG_JIFFIES);
++ if (!ssif_info->stopping)
++ mod_timer(&ssif_info->retry_timer,
++ jiffies + SSIF_MSG_JIFFIES);
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ return;
+ }
+@@ -939,8 +940,9 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
+ ssif_info->waiting_alert = true;
+ ssif_info->retries_left = SSIF_RECV_RETRIES;
+ ssif_info->rtc_us_timer = SSIF_MSG_PART_USEC;
+- mod_timer(&ssif_info->retry_timer,
+- jiffies + SSIF_MSG_PART_JIFFIES);
++ if (!ssif_info->stopping)
++ mod_timer(&ssif_info->retry_timer,
++ jiffies + SSIF_MSG_PART_JIFFIES);
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ }
+ }
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 1a803b0cf980..7d958ff426e0 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -663,7 +663,8 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_space *space,
+ return len;
+
+ err = be32_to_cpu(header->return_code);
+- if (err != 0 && desc)
++ if (err != 0 && err != TPM_ERR_DISABLED && err != TPM_ERR_DEACTIVATED
++ && desc)
+ dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err,
+ desc);
+ if (err)
+@@ -1321,7 +1322,8 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max)
+ }
+
+ rlength = be32_to_cpu(tpm_cmd.header.out.length);
+- if (rlength < offsetof(struct tpm_getrandom_out, rng_data) +
++ if (rlength < TPM_HEADER_SIZE +
++ offsetof(struct tpm_getrandom_out, rng_data) +
+ recd) {
+ total = -EFAULT;
+ break;
+diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
+index c31b490bd41d..3acf4fd4e5a5 100644
+--- a/drivers/char/tpm/tpm2-cmd.c
++++ b/drivers/char/tpm/tpm2-cmd.c
+@@ -329,7 +329,9 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max)
+ &buf.data[TPM_HEADER_SIZE];
+ recd = min_t(u32, be16_to_cpu(out->size), num_bytes);
+ if (tpm_buf_length(&buf) <
+- offsetof(struct tpm2_get_random_out, buffer) + recd) {
++ TPM_HEADER_SIZE +
++ offsetof(struct tpm2_get_random_out, buffer) +
++ recd) {
+ err = -EFAULT;
+ goto out;
+ }
+diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c
+index 911475d36800..b150f87f38f5 100644
+--- a/drivers/char/tpm/xen-tpmfront.c
++++ b/drivers/char/tpm/xen-tpmfront.c
+@@ -264,7 +264,7 @@ static int setup_ring(struct xenbus_device *dev, struct tpm_private *priv)
+ return -ENOMEM;
+ }
+
+- rv = xenbus_grant_ring(dev, &priv->shr, 1, &gref);
++ rv = xenbus_grant_ring(dev, priv->shr, 1, &gref);
+ if (rv < 0)
+ return rv;
+
+diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
+index 0a9ebf00be46..e58bfcb1169e 100644
+--- a/drivers/cpufreq/cpufreq-dt.c
++++ b/drivers/cpufreq/cpufreq-dt.c
+@@ -32,6 +32,7 @@ struct private_data {
+ struct device *cpu_dev;
+ struct thermal_cooling_device *cdev;
+ const char *reg_name;
++ bool have_static_opps;
+ };
+
+ static struct freq_attr *cpufreq_dt_attr[] = {
+@@ -204,6 +205,15 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+ }
+ }
+
++ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++ if (!priv) {
++ ret = -ENOMEM;
++ goto out_put_regulator;
++ }
++
++ priv->reg_name = name;
++ priv->opp_table = opp_table;
++
+ /*
+ * Initialize OPP tables for all policy->cpus. They will be shared by
+ * all CPUs which have marked their CPUs shared with OPP bindings.
+@@ -214,7 +224,8 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+ *
+ * OPPs might be populated at runtime, don't check for error here
+ */
+- dev_pm_opp_of_cpumask_add_table(policy->cpus);
++ if (!dev_pm_opp_of_cpumask_add_table(policy->cpus))
++ priv->have_static_opps = true;
+
+ /*
+ * But we need OPP table to function so if it is not there let's
+@@ -240,19 +251,10 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+ __func__, ret);
+ }
+
+- priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+- if (!priv) {
+- ret = -ENOMEM;
+- goto out_free_opp;
+- }
+-
+- priv->reg_name = name;
+- priv->opp_table = opp_table;
+-
+ ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
+ if (ret) {
+ dev_err(cpu_dev, "failed to init cpufreq table: %d\n", ret);
+- goto out_free_priv;
++ goto out_free_opp;
+ }
+
+ priv->cpu_dev = cpu_dev;
+@@ -282,10 +284,11 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+
+ out_free_cpufreq_table:
+ dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
+-out_free_priv:
+- kfree(priv);
+ out_free_opp:
+- dev_pm_opp_of_cpumask_remove_table(policy->cpus);
++ if (priv->have_static_opps)
++ dev_pm_opp_of_cpumask_remove_table(policy->cpus);
++ kfree(priv);
++out_put_regulator:
+ if (name)
+ dev_pm_opp_put_regulators(opp_table);
+ out_put_clk:
+@@ -300,7 +303,8 @@ static int cpufreq_exit(struct cpufreq_policy *policy)
+
+ cpufreq_cooling_unregister(priv->cdev);
+ dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
+- dev_pm_opp_of_cpumask_remove_table(policy->related_cpus);
++ if (priv->have_static_opps)
++ dev_pm_opp_of_cpumask_remove_table(policy->related_cpus);
+ if (priv->reg_name)
+ dev_pm_opp_put_regulators(priv->opp_table);
+
+diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
+index f20f20a77d4d..4268f87e99fc 100644
+--- a/drivers/cpufreq/cpufreq_conservative.c
++++ b/drivers/cpufreq/cpufreq_conservative.c
+@@ -80,8 +80,10 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
+ * changed in the meantime, so fall back to current frequency in that
+ * case.
+ */
+- if (requested_freq > policy->max || requested_freq < policy->min)
++ if (requested_freq > policy->max || requested_freq < policy->min) {
+ requested_freq = policy->cur;
++ dbs_info->requested_freq = requested_freq;
++ }
+
+ freq_step = get_freq_step(cs_tuners, policy);
+
+@@ -92,7 +94,7 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
+ if (policy_dbs->idle_periods < UINT_MAX) {
+ unsigned int freq_steps = policy_dbs->idle_periods * freq_step;
+
+- if (requested_freq > freq_steps)
++ if (requested_freq > policy->min + freq_steps)
+ requested_freq -= freq_steps;
+ else
+ requested_freq = policy->min;
+diff --git a/drivers/crypto/caam/regs.h b/drivers/crypto/caam/regs.h
+index 4fb91ba39c36..ce3f9ad7120f 100644
+--- a/drivers/crypto/caam/regs.h
++++ b/drivers/crypto/caam/regs.h
+@@ -70,22 +70,22 @@
+ extern bool caam_little_end;
+ extern bool caam_imx;
+
+-#define caam_to_cpu(len) \
+-static inline u##len caam##len ## _to_cpu(u##len val) \
+-{ \
+- if (caam_little_end) \
+- return le##len ## _to_cpu(val); \
+- else \
+- return be##len ## _to_cpu(val); \
++#define caam_to_cpu(len) \
++static inline u##len caam##len ## _to_cpu(u##len val) \
++{ \
++ if (caam_little_end) \
++ return le##len ## _to_cpu((__force __le##len)val); \
++ else \
++ return be##len ## _to_cpu((__force __be##len)val); \
+ }
+
+-#define cpu_to_caam(len) \
+-static inline u##len cpu_to_caam##len(u##len val) \
+-{ \
+- if (caam_little_end) \
+- return cpu_to_le##len(val); \
+- else \
+- return cpu_to_be##len(val); \
++#define cpu_to_caam(len) \
++static inline u##len cpu_to_caam##len(u##len val) \
++{ \
++ if (caam_little_end) \
++ return (__force u##len)cpu_to_le##len(val); \
++ else \
++ return (__force u##len)cpu_to_be##len(val); \
+ }
+
+ caam_to_cpu(16)
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index 85820a2d69d4..987899610b46 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -761,6 +761,11 @@ static int jz4780_dma_probe(struct platform_device *pdev)
+ struct resource *res;
+ int i, ret;
+
++ if (!dev->of_node) {
++ dev_err(dev, "This driver must be probed from devicetree\n");
++ return -EINVAL;
++ }
++
+ jzdma = devm_kzalloc(dev, sizeof(*jzdma), GFP_KERNEL);
+ if (!jzdma)
+ return -ENOMEM;
+diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
+index 4fa4c06c9edb..21a5708985bc 100644
+--- a/drivers/dma/ioat/init.c
++++ b/drivers/dma/ioat/init.c
+@@ -1205,8 +1205,15 @@ static void ioat_shutdown(struct pci_dev *pdev)
+
+ spin_lock_bh(&ioat_chan->prep_lock);
+ set_bit(IOAT_CHAN_DOWN, &ioat_chan->state);
+- del_timer_sync(&ioat_chan->timer);
+ spin_unlock_bh(&ioat_chan->prep_lock);
++ /*
++ * Synchronization rule for del_timer_sync():
++ * - The caller must not hold locks which would prevent
++ * completion of the timer's handler.
++ * So prep_lock cannot be held before calling it.
++ */
++ del_timer_sync(&ioat_chan->timer);
++
+ /* this should quiesce then reset */
+ ioat_reset_hw(ioat_chan);
+ }
+diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
+index 4cf0d4d0cecf..25610286979f 100644
+--- a/drivers/dma/ppc4xx/adma.c
++++ b/drivers/dma/ppc4xx/adma.c
+@@ -4360,7 +4360,7 @@ static ssize_t enable_store(struct device_driver *dev, const char *buf,
+ }
+ static DRIVER_ATTR_RW(enable);
+
+-static ssize_t poly_store(struct device_driver *dev, char *buf)
++static ssize_t poly_show(struct device_driver *dev, char *buf)
+ {
+ ssize_t size = 0;
+ u32 reg;
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 18aeabb1d5ee..e2addb2bca29 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2200,6 +2200,15 @@ static struct amd64_family_type family_types[] = {
+ .dbam_to_cs = f17_base_addr_to_cs_size,
+ }
+ },
++ [F17_M10H_CPUS] = {
++ .ctl_name = "F17h_M10h",
++ .f0_id = PCI_DEVICE_ID_AMD_17H_M10H_DF_F0,
++ .f6_id = PCI_DEVICE_ID_AMD_17H_M10H_DF_F6,
++ .ops = {
++ .early_channel_count = f17_early_channel_count,
++ .dbam_to_cs = f17_base_addr_to_cs_size,
++ }
++ },
+ };
+
+ /*
+@@ -3188,6 +3197,11 @@ static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt)
+ break;
+
+ case 0x17:
++ if (pvt->model >= 0x10 && pvt->model <= 0x2f) {
++ fam_type = &family_types[F17_M10H_CPUS];
++ pvt->ops = &family_types[F17_M10H_CPUS].ops;
++ break;
++ }
+ fam_type = &family_types[F17_CPUS];
+ pvt->ops = &family_types[F17_CPUS].ops;
+ break;
+diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
+index 1d4b74e9a037..4242f8e39c18 100644
+--- a/drivers/edac/amd64_edac.h
++++ b/drivers/edac/amd64_edac.h
+@@ -115,6 +115,8 @@
+ #define PCI_DEVICE_ID_AMD_16H_M30H_NB_F2 0x1582
+ #define PCI_DEVICE_ID_AMD_17H_DF_F0 0x1460
+ #define PCI_DEVICE_ID_AMD_17H_DF_F6 0x1466
++#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F0 0x15e8
++#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F6 0x15ee
+
+ /*
+ * Function 1 - Address Map
+@@ -281,6 +283,7 @@ enum amd_families {
+ F16_CPUS,
+ F16_M30H_CPUS,
+ F17_CPUS,
++ F17_M10H_CPUS,
+ NUM_FAMILIES,
+ };
+
+diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
+index 8e120bf60624..f1d19504a028 100644
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -1711,6 +1711,7 @@ static void i7core_mce_output_error(struct mem_ctl_info *mci,
+ u32 errnum = find_first_bit(&error, 32);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv)
+ tp_event = HW_EVENT_ERR_FATAL;
+ else
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 07726fb00321..72cea3cb8622 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -2888,6 +2888,7 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
+ recoverable = GET_BITFIELD(m->status, 56, 56);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv) {
+ type = "FATAL";
+ tp_event = HW_EVENT_ERR_FATAL;
+diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
+index fae095162c01..4ba92f1dd0f7 100644
+--- a/drivers/edac/skx_edac.c
++++ b/drivers/edac/skx_edac.c
+@@ -668,7 +668,7 @@ sad_found:
+ break;
+ case 2:
+ lchan = (addr >> shift) % 2;
+- lchan = (lchan << 1) | ~lchan;
++ lchan = (lchan << 1) | !lchan;
+ break;
+ case 3:
+ lchan = ((addr >> shift) % 2) << 1;
+@@ -959,6 +959,7 @@ static void skx_mce_output_error(struct mem_ctl_info *mci,
+ recoverable = GET_BITFIELD(m->status, 56, 56);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv) {
+ type = "FATAL";
+ tp_event = HW_EVENT_ERR_FATAL;
+diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c
+index 19db5709ae28..898bb9abc41f 100644
+--- a/drivers/firmware/google/coreboot_table.c
++++ b/drivers/firmware/google/coreboot_table.c
+@@ -110,7 +110,8 @@ int coreboot_table_init(struct device *dev, void __iomem *ptr)
+
+ if (strncmp(header.signature, "LBIO", sizeof(header.signature))) {
+ pr_warn("coreboot_table: coreboot table missing or corrupt!\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto out;
+ }
+
+ ptr_entry = (void *)ptr_header + header.header_bytes;
+@@ -137,7 +138,8 @@ int coreboot_table_init(struct device *dev, void __iomem *ptr)
+
+ ptr_entry += entry.size;
+ }
+-
++out:
++ iounmap(ptr);
+ return ret;
+ }
+ EXPORT_SYMBOL(coreboot_table_init);
+@@ -146,7 +148,6 @@ int coreboot_table_exit(void)
+ {
+ if (ptr_header) {
+ bus_unregister(&coreboot_bus_type);
+- iounmap(ptr_header);
+ ptr_header = NULL;
+ }
+
+diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c
+index 16c7f9f49416..af936dcca659 100644
+--- a/drivers/gpio/gpio-brcmstb.c
++++ b/drivers/gpio/gpio-brcmstb.c
+@@ -664,6 +664,18 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
+ struct brcmstb_gpio_bank *bank;
+ struct gpio_chip *gc;
+
++ /*
++ * If bank_width is 0, then there is an empty bank in the
++ * register block. Special handling for this case.
++ */
++ if (bank_width == 0) {
++ dev_dbg(dev, "Width 0 found: Empty bank @ %d\n",
++ num_banks);
++ num_banks++;
++ gpio_base += MAX_GPIO_PER_BANK;
++ continue;
++ }
++
+ bank = devm_kzalloc(dev, sizeof(*bank), GFP_KERNEL);
+ if (!bank) {
+ err = -ENOMEM;
+@@ -740,9 +752,6 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
+ goto fail;
+ }
+
+- dev_info(dev, "Registered %d banks (GPIO(s): %d-%d)\n",
+- num_banks, priv->gpio_base, gpio_base - 1);
+-
+ if (priv->parent_wake_irq && need_wakeup_event)
+ pm_wakeup_event(dev, 0);
+
+diff --git a/drivers/gpio/gpio-mxs.c b/drivers/gpio/gpio-mxs.c
+index df30490da820..ea874fd033a5 100644
+--- a/drivers/gpio/gpio-mxs.c
++++ b/drivers/gpio/gpio-mxs.c
+@@ -18,8 +18,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ #include <linux/gpio/driver.h>
+-/* FIXME: for gpio_get_value(), replace this by direct register read */
+-#include <linux/gpio.h>
+ #include <linux/module.h>
+
+ #define MXS_SET 0x4
+@@ -86,7 +84,7 @@ static int mxs_gpio_set_irq_type(struct irq_data *d, unsigned int type)
+ port->both_edges &= ~pin_mask;
+ switch (type) {
+ case IRQ_TYPE_EDGE_BOTH:
+- val = gpio_get_value(port->gc.base + d->hwirq);
++ val = port->gc.get(&port->gc, d->hwirq);
+ if (val)
+ edge = GPIO_INT_FALL_EDGE;
+ else
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 2d45d1dd9554..643f5edd68fe 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1446,8 +1446,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ }
+
+ /* The CEC module handles HDMI hotplug detection */
+- cec_np = of_find_compatible_node(np->parent, NULL,
+- "mediatek,mt8173-cec");
++ cec_np = of_get_compatible_child(np->parent, "mediatek,mt8173-cec");
+ if (!cec_np) {
+ dev_err(dev, "Failed to find CEC node\n");
+ return -EINVAL;
+@@ -1457,8 +1456,10 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ if (!cec_pdev) {
+ dev_err(hdmi->dev, "Waiting for CEC device %pOF\n",
+ cec_np);
++ of_node_put(cec_np);
+ return -EPROBE_DEFER;
+ }
++ of_node_put(cec_np);
+ hdmi->cec_dev = &cec_pdev->dev;
+
+ /*
+diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
+index cf2a18571d48..a132c37d7334 100644
+--- a/drivers/gpu/vga/vga_switcheroo.c
++++ b/drivers/gpu/vga/vga_switcheroo.c
+@@ -380,6 +380,9 @@ int vga_switcheroo_register_audio_client(struct pci_dev *pdev,
+ mutex_unlock(&vgasr_mutex);
+ return -EINVAL;
+ }
++ /* notify if GPU has been already bound */
++ if (ops->gpu_bound)
++ ops->gpu_bound(pdev, id);
+ }
+ mutex_unlock(&vgasr_mutex);
+
+diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
+index 23872d08308c..a746017fac17 100644
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -512,14 +512,24 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
+ if (cmd == HIDIOCGCOLLECTIONINDEX) {
+ if (uref->usage_index >= field->maxusage)
+ goto inval;
++ uref->usage_index =
++ array_index_nospec(uref->usage_index,
++ field->maxusage);
+ } else if (uref->usage_index >= field->report_count)
+ goto inval;
+ }
+
+- if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
+- (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+- uref->usage_index + uref_multi->num_values > field->report_count))
+- goto inval;
++ if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
++ if (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
++ uref->usage_index + uref_multi->num_values >
++ field->report_count)
++ goto inval;
++
++ uref->usage_index =
++ array_index_nospec(uref->usage_index,
++ field->report_count -
++ uref_multi->num_values);
++ }
+
+ switch (cmd) {
+ case HIDIOCGUSAGE:
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index e0a06be5ef5c..5dd3a8245f0f 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -3335,6 +3335,7 @@ static void wacom_setup_intuos(struct wacom_wac *wacom_wac)
+
+ void wacom_setup_device_quirks(struct wacom *wacom)
+ {
++ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+ struct wacom_features *features = &wacom->wacom_wac.features;
+
+ /* The pen and pad share the same interface on most devices */
+@@ -3464,6 +3465,24 @@ void wacom_setup_device_quirks(struct wacom *wacom)
+
+ if (features->type == REMOTE)
+ features->device_type |= WACOM_DEVICETYPE_WL_MONITOR;
++
++ /* HID descriptor for DTK-2451 / DTH-2452 claims to report lots
++ * of things it shouldn't. Lets fix up the damage...
++ */
++ if (wacom->hdev->product == 0x382 || wacom->hdev->product == 0x37d) {
++ features->quirks &= ~WACOM_QUIRK_TOOLSERIAL;
++ __clear_bit(BTN_TOOL_BRUSH, wacom_wac->pen_input->keybit);
++ __clear_bit(BTN_TOOL_PENCIL, wacom_wac->pen_input->keybit);
++ __clear_bit(BTN_TOOL_AIRBRUSH, wacom_wac->pen_input->keybit);
++ __clear_bit(ABS_Z, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_DISTANCE, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_TILT_X, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_TILT_Y, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_WHEEL, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_MISC, wacom_wac->pen_input->absbit);
++ __clear_bit(MSC_SERIAL, wacom_wac->pen_input->mscbit);
++ __clear_bit(EV_MSC, wacom_wac->pen_input->evbit);
++ }
+ }
+
+ int wacom_setup_pen_input_capabilities(struct input_dev *input_dev,
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 0f0e091c117c..c4a1ebcfffb6 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -606,16 +606,18 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ bool perf_chn = vmbus_devs[dev_type].perf_device;
+ struct vmbus_channel *primary = channel->primary_channel;
+ int next_node;
+- struct cpumask available_mask;
++ cpumask_var_t available_mask;
+ struct cpumask *alloced_mask;
+
+ if ((vmbus_proto_version == VERSION_WS2008) ||
+- (vmbus_proto_version == VERSION_WIN7) || (!perf_chn)) {
++ (vmbus_proto_version == VERSION_WIN7) || (!perf_chn) ||
++ !alloc_cpumask_var(&available_mask, GFP_KERNEL)) {
+ /*
+ * Prior to win8, all channel interrupts are
+ * delivered on cpu 0.
+ * Also if the channel is not a performance critical
+ * channel, bind it to cpu 0.
++ * In case alloc_cpumask_var() fails, bind it to cpu 0.
+ */
+ channel->numa_node = 0;
+ channel->target_cpu = 0;
+@@ -653,7 +655,7 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ cpumask_clear(alloced_mask);
+ }
+
+- cpumask_xor(&available_mask, alloced_mask,
++ cpumask_xor(available_mask, alloced_mask,
+ cpumask_of_node(primary->numa_node));
+
+ cur_cpu = -1;
+@@ -671,10 +673,10 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ }
+
+ while (true) {
+- cur_cpu = cpumask_next(cur_cpu, &available_mask);
++ cur_cpu = cpumask_next(cur_cpu, available_mask);
+ if (cur_cpu >= nr_cpu_ids) {
+ cur_cpu = -1;
+- cpumask_copy(&available_mask,
++ cpumask_copy(available_mask,
+ cpumask_of_node(primary->numa_node));
+ continue;
+ }
+@@ -704,6 +706,8 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+
+ channel->target_cpu = cur_cpu;
+ channel->target_vp = hv_cpu_number_to_vp_number(cur_cpu);
++
++ free_cpumask_var(available_mask);
+ }
+
+ static void vmbus_wait_for_unload(void)
+diff --git a/drivers/hwmon/pmbus/pmbus.c b/drivers/hwmon/pmbus/pmbus.c
+index 7718e58dbda5..7688dab32f6e 100644
+--- a/drivers/hwmon/pmbus/pmbus.c
++++ b/drivers/hwmon/pmbus/pmbus.c
+@@ -118,6 +118,8 @@ static int pmbus_identify(struct i2c_client *client,
+ } else {
+ info->pages = 1;
+ }
++
++ pmbus_clear_faults(client);
+ }
+
+ if (pmbus_check_byte_register(client, 0, PMBUS_VOUT_MODE)) {
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index 82c3754e21e3..2e2b5851139c 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -2015,7 +2015,10 @@ static int pmbus_init_common(struct i2c_client *client, struct pmbus_data *data,
+ if (ret >= 0 && (ret & PB_CAPABILITY_ERROR_CHECK))
+ client->flags |= I2C_CLIENT_PEC;
+
+- pmbus_clear_faults(client);
++ if (data->info->pages)
++ pmbus_clear_faults(client);
++ else
++ pmbus_clear_fault_page(client, -1);
+
+ if (info->identify) {
+ ret = (*info->identify)(client, info);
+diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
+index 7838af58f92d..9d611dd268e1 100644
+--- a/drivers/hwmon/pwm-fan.c
++++ b/drivers/hwmon/pwm-fan.c
+@@ -290,9 +290,19 @@ static int pwm_fan_remove(struct platform_device *pdev)
+ static int pwm_fan_suspend(struct device *dev)
+ {
+ struct pwm_fan_ctx *ctx = dev_get_drvdata(dev);
++ struct pwm_args args;
++ int ret;
++
++ pwm_get_args(ctx->pwm, &args);
++
++ if (ctx->pwm_value) {
++ ret = pwm_config(ctx->pwm, 0, args.period);
++ if (ret < 0)
++ return ret;
+
+- if (ctx->pwm_value)
+ pwm_disable(ctx->pwm);
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
+index 306119eaf16a..0dad8626bcfb 100644
+--- a/drivers/hwtracing/coresight/coresight-etb10.c
++++ b/drivers/hwtracing/coresight/coresight-etb10.c
+@@ -147,6 +147,10 @@ static int etb_enable(struct coresight_device *csdev, u32 mode)
+ if (val == CS_MODE_PERF)
+ return -EBUSY;
+
++ /* Don't let perf disturb sysFS sessions */
++ if (val == CS_MODE_SYSFS && mode == CS_MODE_PERF)
++ return -EBUSY;
++
+ /* Nothing to do, the tracer is already enabled. */
+ if (val == CS_MODE_SYSFS)
+ goto out;
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index 44b516863c9d..75d2f73582a3 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -248,12 +248,14 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *idev = pf->indio_dev;
+ struct at91_adc_state *st = iio_priv(idev);
++ struct iio_chan_spec const *chan;
+ int i, j = 0;
+
+ for (i = 0; i < idev->masklength; i++) {
+ if (!test_bit(i, idev->active_scan_mask))
+ continue;
+- st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, i));
++ chan = idev->channels + i;
++ st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, chan->channel));
+ j++;
+ }
+
+@@ -279,6 +281,8 @@ static void handle_adc_eoc_trigger(int irq, struct iio_dev *idev)
+ iio_trigger_poll(idev->trig);
+ } else {
+ st->last_value = at91_adc_readl(st, AT91_ADC_CHAN(st, st->chnb));
++ /* Needed to ACK the DRDY interruption */
++ at91_adc_readl(st, AT91_ADC_LCDR);
+ st->done = true;
+ wake_up_interruptible(&st->wq_data_avail);
+ }
+diff --git a/drivers/iio/adc/fsl-imx25-gcq.c b/drivers/iio/adc/fsl-imx25-gcq.c
+index ea264fa9e567..929c617db364 100644
+--- a/drivers/iio/adc/fsl-imx25-gcq.c
++++ b/drivers/iio/adc/fsl-imx25-gcq.c
+@@ -209,12 +209,14 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ ret = of_property_read_u32(child, "reg", ®);
+ if (ret) {
+ dev_err(dev, "Failed to get reg property\n");
++ of_node_put(child);
+ return ret;
+ }
+
+ if (reg >= MX25_NUM_CFGS) {
+ dev_err(dev,
+ "reg value is greater than the number of available configuration registers\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+@@ -228,6 +230,7 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ if (IS_ERR(priv->vref[refp])) {
+ dev_err(dev, "Error, trying to use external voltage reference without a vref-%s regulator.",
+ mx25_gcq_refp_names[refp]);
++ of_node_put(child);
+ return PTR_ERR(priv->vref[refp]);
+ }
+ priv->channel_vref_mv[reg] =
+@@ -240,6 +243,7 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ break;
+ default:
+ dev_err(dev, "Invalid positive reference %d\n", refp);
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+@@ -254,10 +258,12 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+
+ if ((refp & MX25_ADCQ_CFG_REFP_MASK) != refp) {
+ dev_err(dev, "Invalid fsl,adc-refp property value\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+ if ((refn & MX25_ADCQ_CFG_REFN_MASK) != refn) {
+ dev_err(dev, "Invalid fsl,adc-refn property value\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/iio/dac/ad5064.c b/drivers/iio/dac/ad5064.c
+index bf4fc40ec84d..2f98cb2a3b96 100644
+--- a/drivers/iio/dac/ad5064.c
++++ b/drivers/iio/dac/ad5064.c
+@@ -808,6 +808,40 @@ static int ad5064_set_config(struct ad5064_state *st, unsigned int val)
+ return ad5064_write(st, cmd, 0, val, 0);
+ }
+
++static int ad5064_request_vref(struct ad5064_state *st, struct device *dev)
++{
++ unsigned int i;
++ int ret;
++
++ for (i = 0; i < ad5064_num_vref(st); ++i)
++ st->vref_reg[i].supply = ad5064_vref_name(st, i);
++
++ if (!st->chip_info->internal_vref)
++ return devm_regulator_bulk_get(dev, ad5064_num_vref(st),
++ st->vref_reg);
++
++ /*
++ * This assumes that when the regulator has an internal VREF
++ * there is only one external VREF connection, which is
++ * currently the case for all supported devices.
++ */
++ st->vref_reg[0].consumer = devm_regulator_get_optional(dev, "vref");
++ if (!IS_ERR(st->vref_reg[0].consumer))
++ return 0;
++
++ ret = PTR_ERR(st->vref_reg[0].consumer);
++ if (ret != -ENODEV)
++ return ret;
++
++ /* If no external regulator was supplied use the internal VREF */
++ st->use_internal_vref = true;
++ ret = ad5064_set_config(st, AD5064_CONFIG_INT_VREF_ENABLE);
++ if (ret)
++ dev_err(dev, "Failed to enable internal vref: %d\n", ret);
++
++ return ret;
++}
++
+ static int ad5064_probe(struct device *dev, enum ad5064_type type,
+ const char *name, ad5064_write_func write)
+ {
+@@ -828,22 +862,11 @@ static int ad5064_probe(struct device *dev, enum ad5064_type type,
+ st->dev = dev;
+ st->write = write;
+
+- for (i = 0; i < ad5064_num_vref(st); ++i)
+- st->vref_reg[i].supply = ad5064_vref_name(st, i);
++ ret = ad5064_request_vref(st, dev);
++ if (ret)
++ return ret;
+
+- ret = devm_regulator_bulk_get(dev, ad5064_num_vref(st),
+- st->vref_reg);
+- if (ret) {
+- if (!st->chip_info->internal_vref)
+- return ret;
+- st->use_internal_vref = true;
+- ret = ad5064_set_config(st, AD5064_CONFIG_INT_VREF_ENABLE);
+- if (ret) {
+- dev_err(dev, "Failed to enable internal vref: %d\n",
+- ret);
+- return ret;
+- }
+- } else {
++ if (!st->use_internal_vref) {
+ ret = regulator_bulk_enable(ad5064_num_vref(st), st->vref_reg);
+ if (ret)
+ return ret;
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 6e39c27dca8e..4c533275d1f2 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -3292,8 +3292,11 @@ static int cm_lap_handler(struct cm_work *work)
+ if (ret)
+ goto unlock;
+
+- cm_init_av_by_path(param->alternate_path, NULL, &cm_id_priv->alt_av,
+- cm_id_priv);
++ ret = cm_init_av_by_path(param->alternate_path, NULL,
++ &cm_id_priv->alt_av, cm_id_priv);
++ if (ret)
++ goto unlock;
++
+ cm_id_priv->id.lap_state = IB_CM_LAP_RCVD;
+ cm_id_priv->tid = lap_msg->hdr.tid;
+ ret = atomic_inc_and_test(&cm_id_priv->work_count);
+diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
+index 7fd14ead7b37..ace40bb98624 100644
+--- a/drivers/infiniband/core/sysfs.c
++++ b/drivers/infiniband/core/sysfs.c
+@@ -512,7 +512,7 @@ static ssize_t show_pma_counter(struct ib_port *p, struct port_attribute *attr,
+ ret = get_perf_mad(p->ibdev, p->port_num, tab_attr->attr_id, &data,
+ 40 + offset / 8, sizeof(data));
+ if (ret < 0)
+- return sprintf(buf, "N/A (no PMA)\n");
++ return ret;
+
+ switch (width) {
+ case 4:
+@@ -1057,10 +1057,12 @@ static int add_port(struct ib_device *device, int port_num,
+ goto err_put;
+ }
+
+- p->pma_table = get_counter_table(device, port_num);
+- ret = sysfs_create_group(&p->kobj, p->pma_table);
+- if (ret)
+- goto err_put_gid_attrs;
++ if (device->process_mad) {
++ p->pma_table = get_counter_table(device, port_num);
++ ret = sysfs_create_group(&p->kobj, p->pma_table);
++ if (ret)
++ goto err_put_gid_attrs;
++ }
+
+ p->gid_group.name = "gids";
+ p->gid_group.attrs = alloc_group_attrs(show_port_gid, attr.gid_tbl_len);
+@@ -1173,7 +1175,8 @@ err_free_gid:
+ p->gid_group.attrs = NULL;
+
+ err_remove_pma:
+- sysfs_remove_group(&p->kobj, p->pma_table);
++ if (p->pma_table)
++ sysfs_remove_group(&p->kobj, p->pma_table);
+
+ err_put_gid_attrs:
+ kobject_put(&p->gid_attr_group->kobj);
+@@ -1285,7 +1288,9 @@ static void free_port_list_attributes(struct ib_device *device)
+ kfree(port->hw_stats);
+ free_hsag(&port->kobj, port->hw_stats_ag);
+ }
+- sysfs_remove_group(p, port->pma_table);
++
++ if (port->pma_table)
++ sysfs_remove_group(p, port->pma_table);
+ sysfs_remove_group(p, &port->pkey_group);
+ sysfs_remove_group(p, &port->gid_group);
+ sysfs_remove_group(&port->gid_attr_group->kobj,
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index 6ad0d46ab879..249efa0a6aba 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -360,7 +360,8 @@ void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq)
+ }
+
+ /* Make sure the HW is stopped! */
+- bnxt_qplib_nq_stop_irq(nq, true);
++ if (nq->requested)
++ bnxt_qplib_nq_stop_irq(nq, true);
+
+ if (nq->bar_reg_iomem)
+ iounmap(nq->bar_reg_iomem);
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+index 2852d350ada1..6637df77d236 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+@@ -309,8 +309,17 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
+ rcfw->aeq_handler(rcfw, qp_event, qp);
+ break;
+ default:
+- /* Command Response */
+- spin_lock_irqsave(&cmdq->lock, flags);
++ /*
++ * Command Response
++ * cmdq->lock needs to be acquired to synchronie
++ * the command send and completion reaping. This function
++ * is always called with creq->lock held. Using
++ * the nested variant of spin_lock.
++ *
++ */
++
++ spin_lock_irqsave_nested(&cmdq->lock, flags,
++ SINGLE_DEPTH_NESTING);
+ cookie = le16_to_cpu(qp_event->cookie);
+ mcookie = qp_event->cookie;
+ blocked = cookie & RCFW_CMD_IS_BLOCKING;
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index e22314837645..7df4a4fe4af4 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -691,7 +691,6 @@ int mlx5_mr_cache_init(struct mlx5_ib_dev *dev)
+ init_completion(&ent->compl);
+ INIT_WORK(&ent->work, cache_work_func);
+ INIT_DELAYED_WORK(&ent->dwork, delayed_cache_work_func);
+- queue_work(cache->wq, &ent->work);
+
+ if (i > MR_CACHE_LAST_STD_ENTRY) {
+ mlx5_odp_init_mr_cache_entry(ent);
+@@ -711,6 +710,7 @@ int mlx5_mr_cache_init(struct mlx5_ib_dev *dev)
+ ent->limit = dev->mdev->profile->mr_cache[i].limit;
+ else
+ ent->limit = 0;
++ queue_work(cache->wq, &ent->work);
+ }
+
+ err = mlx5_mr_cache_debugfs_init(dev);
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 6cba2a02d11b..d53d954ac8af 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3243,7 +3243,9 @@ static bool modify_dci_qp_is_ok(enum ib_qp_state cur_state, enum ib_qp_state new
+ int req = IB_QP_STATE;
+ int opt = 0;
+
+- if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
++ if (new_state == IB_QPS_RESET) {
++ return is_valid_mask(attr_mask, req, opt);
++ } else if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
+ req |= IB_QP_PKEY_INDEX | IB_QP_PORT;
+ return is_valid_mask(attr_mask, req, opt);
+ } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_INIT) {
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index aa5833318372..fc6c880756da 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -682,6 +682,7 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ rxe_advance_resp_resource(qp);
+
+ res->type = RXE_READ_MASK;
++ res->replay = 0;
+
+ res->read.va = qp->resp.va;
+ res->read.va_org = qp->resp.va;
+@@ -752,7 +753,8 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ state = RESPST_DONE;
+ } else {
+ qp->resp.res = NULL;
+- qp->resp.opcode = -1;
++ if (!res->replay)
++ qp->resp.opcode = -1;
+ if (psn_compare(res->cur_psn, qp->resp.psn) >= 0)
+ qp->resp.psn = res->cur_psn;
+ state = RESPST_CLEANUP;
+@@ -814,6 +816,7 @@ static enum resp_states execute(struct rxe_qp *qp, struct rxe_pkt_info *pkt)
+
+ /* next expected psn, read handles this separately */
+ qp->resp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
++ qp->resp.ack_psn = qp->resp.psn;
+
+ qp->resp.opcode = pkt->opcode;
+ qp->resp.status = IB_WC_SUCCESS;
+@@ -1065,7 +1068,7 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
+ struct rxe_pkt_info *pkt)
+ {
+ enum resp_states rc;
+- u32 prev_psn = (qp->resp.psn - 1) & BTH_PSN_MASK;
++ u32 prev_psn = (qp->resp.ack_psn - 1) & BTH_PSN_MASK;
+
+ if (pkt->mask & RXE_SEND_MASK ||
+ pkt->mask & RXE_WRITE_MASK) {
+@@ -1108,6 +1111,7 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
+ res->state = (pkt->psn == res->first_psn) ?
+ rdatm_res_state_new :
+ rdatm_res_state_replay;
++ res->replay = 1;
+
+ /* Reset the resource, except length. */
+ res->read.va_org = iova;
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index af1470d29391..332a16dad2a7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -171,6 +171,7 @@ enum rdatm_res_state {
+
+ struct resp_res {
+ int type;
++ int replay;
+ u32 first_psn;
+ u32 last_psn;
+ u32 cur_psn;
+@@ -195,6 +196,7 @@ struct rxe_resp_info {
+ enum rxe_qp_state state;
+ u32 msn;
+ u32 psn;
++ u32 ack_psn;
+ int opcode;
+ int drop_msg;
+ int goto_error;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 3d5424f335cb..0428e01e8f69 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1438,11 +1438,15 @@ static void ipoib_cm_skb_reap(struct work_struct *work)
+ spin_unlock_irqrestore(&priv->lock, flags);
+ netif_tx_unlock_bh(dev);
+
+- if (skb->protocol == htons(ETH_P_IP))
++ if (skb->protocol == htons(ETH_P_IP)) {
++ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
++ }
+ #if IS_ENABLED(CONFIG_IPV6)
+- else if (skb->protocol == htons(ETH_P_IPV6))
++ else if (skb->protocol == htons(ETH_P_IPV6)) {
++ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
++ }
+ #endif
+ dev_kfree_skb_any(skb);
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index e3d28f9ad9c0..30f840f874b3 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1880,6 +1880,8 @@ static int ipoib_parent_init(struct net_device *ndev)
+ sizeof(union ib_gid));
+
+ SET_NETDEV_DEV(priv->dev, priv->ca->dev.parent);
++ priv->dev->dev_port = priv->port - 1;
++ /* Let's set this one too for backwards compatibility. */
+ priv->dev->dev_id = priv->port - 1;
+
+ return 0;
+diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
+index fd1b80ef9490..e7cbf4fcf61d 100644
+--- a/drivers/iommu/arm-smmu.c
++++ b/drivers/iommu/arm-smmu.c
+@@ -469,6 +469,9 @@ static void arm_smmu_tlb_inv_range_nosync(unsigned long iova, size_t size,
+ bool stage1 = cfg->cbar != CBAR_TYPE_S2_TRANS;
+ void __iomem *reg = ARM_SMMU_CB(smmu_domain->smmu, cfg->cbndx);
+
++ if (smmu_domain->smmu->features & ARM_SMMU_FEAT_COHERENT_WALK)
++ wmb();
++
+ if (stage1) {
+ reg += leaf ? ARM_SMMU_CB_S1_TLBIVAL : ARM_SMMU_CB_S1_TLBIVA;
+
+@@ -510,6 +513,9 @@ static void arm_smmu_tlb_inv_vmid_nosync(unsigned long iova, size_t size,
+ struct arm_smmu_domain *smmu_domain = cookie;
+ void __iomem *base = ARM_SMMU_GR0(smmu_domain->smmu);
+
++ if (smmu_domain->smmu->features & ARM_SMMU_FEAT_COHERENT_WALK)
++ wmb();
++
+ writel_relaxed(smmu_domain->cfg.vmid, base + ARM_SMMU_GR0_TLBIVMID);
+ }
+
+diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c
+index b1b47a40a278..faa7d61b9d6c 100644
+--- a/drivers/irqchip/qcom-pdc.c
++++ b/drivers/irqchip/qcom-pdc.c
+@@ -124,6 +124,7 @@ static int qcom_pdc_gic_set_type(struct irq_data *d, unsigned int type)
+ break;
+ case IRQ_TYPE_EDGE_BOTH:
+ pdc_type = PDC_EDGE_DUAL;
++ type = IRQ_TYPE_EDGE_RISING;
+ break;
+ case IRQ_TYPE_LEVEL_HIGH:
+ pdc_type = PDC_LEVEL_HIGH;
+diff --git a/drivers/lightnvm/pblk-core.c b/drivers/lightnvm/pblk-core.c
+index 00984b486fea..2940cdc87af1 100644
+--- a/drivers/lightnvm/pblk-core.c
++++ b/drivers/lightnvm/pblk-core.c
+@@ -1539,13 +1539,14 @@ struct pblk_line *pblk_line_replace_data(struct pblk *pblk)
+ struct pblk_line *cur, *new = NULL;
+ unsigned int left_seblks;
+
+- cur = l_mg->data_line;
+ new = l_mg->data_next;
+ if (!new)
+ goto out;
+- l_mg->data_line = new;
+
+ spin_lock(&l_mg->free_lock);
++ cur = l_mg->data_line;
++ l_mg->data_line = new;
++
+ pblk_line_setup_metadata(new, l_mg, &pblk->lm);
+ spin_unlock(&l_mg->free_lock);
+
+diff --git a/drivers/lightnvm/pblk-recovery.c b/drivers/lightnvm/pblk-recovery.c
+index e232e47e1353..df75d9caec45 100644
+--- a/drivers/lightnvm/pblk-recovery.c
++++ b/drivers/lightnvm/pblk-recovery.c
+@@ -956,12 +956,14 @@ next:
+ }
+ }
+
+- spin_lock(&l_mg->free_lock);
+ if (!open_lines) {
++ spin_lock(&l_mg->free_lock);
+ WARN_ON_ONCE(!test_and_clear_bit(meta_line,
+ &l_mg->meta_bitmap));
++ spin_unlock(&l_mg->free_lock);
+ pblk_line_replace_data(pblk);
+ } else {
++ spin_lock(&l_mg->free_lock);
+ /* Allocate next line for preparation */
+ l_mg->data_next = pblk_line_get(pblk);
+ if (l_mg->data_next) {
+@@ -969,8 +971,8 @@ next:
+ l_mg->data_next->type = PBLK_LINETYPE_DATA;
+ is_next = 1;
+ }
++ spin_unlock(&l_mg->free_lock);
+ }
+- spin_unlock(&l_mg->free_lock);
+
+ if (is_next)
+ pblk_line_erase(pblk, l_mg->data_next);
+diff --git a/drivers/lightnvm/pblk-sysfs.c b/drivers/lightnvm/pblk-sysfs.c
+index 9fc3dfa168b4..8d2ed510c04b 100644
+--- a/drivers/lightnvm/pblk-sysfs.c
++++ b/drivers/lightnvm/pblk-sysfs.c
+@@ -262,8 +262,14 @@ static ssize_t pblk_sysfs_lines(struct pblk *pblk, char *page)
+ sec_in_line = l_mg->data_line->sec_in_line;
+ meta_weight = bitmap_weight(&l_mg->meta_bitmap,
+ PBLK_DATA_LINES);
+- map_weight = bitmap_weight(l_mg->data_line->map_bitmap,
++
++ spin_lock(&l_mg->data_line->lock);
++ if (l_mg->data_line->map_bitmap)
++ map_weight = bitmap_weight(l_mg->data_line->map_bitmap,
+ lm->sec_per_line);
++ else
++ map_weight = 0;
++ spin_unlock(&l_mg->data_line->lock);
+ }
+ spin_unlock(&l_mg->free_lock);
+
+diff --git a/drivers/lightnvm/pblk-write.c b/drivers/lightnvm/pblk-write.c
+index ee774a86cf1e..879227d584e7 100644
+--- a/drivers/lightnvm/pblk-write.c
++++ b/drivers/lightnvm/pblk-write.c
+@@ -417,12 +417,11 @@ int pblk_submit_meta_io(struct pblk *pblk, struct pblk_line *meta_line)
+ rqd->ppa_list[i] = addr_to_gen_ppa(pblk, paddr, id);
+ }
+
++ spin_lock(&l_mg->close_lock);
+ emeta->mem += rq_len;
+- if (emeta->mem >= lm->emeta_len[0]) {
+- spin_lock(&l_mg->close_lock);
++ if (emeta->mem >= lm->emeta_len[0])
+ list_del(&meta_line->list);
+- spin_unlock(&l_mg->close_lock);
+- }
++ spin_unlock(&l_mg->close_lock);
+
+ pblk_down_page(pblk, rqd->ppa_list, rqd->nr_ppas);
+
+@@ -491,14 +490,15 @@ static struct pblk_line *pblk_should_submit_meta_io(struct pblk *pblk,
+ struct pblk_line *meta_line;
+
+ spin_lock(&l_mg->close_lock);
+-retry:
+ if (list_empty(&l_mg->emeta_list)) {
+ spin_unlock(&l_mg->close_lock);
+ return NULL;
+ }
+ meta_line = list_first_entry(&l_mg->emeta_list, struct pblk_line, list);
+- if (meta_line->emeta->mem >= lm->emeta_len[0])
+- goto retry;
++ if (meta_line->emeta->mem >= lm->emeta_len[0]) {
++ spin_unlock(&l_mg->close_lock);
++ return NULL;
++ }
+ spin_unlock(&l_mg->close_lock);
+
+ if (!pblk_valid_meta_ppa(pblk, meta_line, data_rqd))
+diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
+index 311e91b1a14f..256f18b67e8a 100644
+--- a/drivers/mailbox/pcc.c
++++ b/drivers/mailbox/pcc.c
+@@ -461,8 +461,11 @@ static int __init acpi_pcc_probe(void)
+ count = acpi_table_parse_entries_array(ACPI_SIG_PCCT,
+ sizeof(struct acpi_table_pcct), proc,
+ ACPI_PCCT_TYPE_RESERVED, MAX_PCC_SUBSPACES);
+- if (count == 0 || count > MAX_PCC_SUBSPACES) {
+- pr_warn("Invalid PCCT: %d PCC subspaces\n", count);
++ if (count <= 0 || count > MAX_PCC_SUBSPACES) {
++ if (count < 0)
++ pr_warn("Error parsing PCC subspaces from PCCT\n");
++ else
++ pr_warn("Invalid PCCT: %d PCC subspaces\n", count);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index e7d4817681f2..3f4211b5cd33 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -2434,7 +2434,7 @@ static int refill_keybuf_fn(struct btree_op *op, struct btree *b,
+ struct keybuf *buf = refill->buf;
+ int ret = MAP_CONTINUE;
+
+- if (bkey_cmp(k, refill->end) >= 0) {
++ if (bkey_cmp(k, refill->end) > 0) {
+ ret = MAP_DONE;
+ goto out;
+ }
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index 51be355a3309..22944aa7d8e5 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -850,7 +850,7 @@ static void cached_dev_read_done_bh(struct closure *cl)
+
+ bch_mark_cache_accounting(s->iop.c, s->d,
+ !s->cache_missed, s->iop.bypass);
+- trace_bcache_read(s->orig_bio, !s->cache_miss, s->iop.bypass);
++ trace_bcache_read(s->orig_bio, !s->cache_missed, s->iop.bypass);
+
+ if (s->iop.status)
+ continue_at_nobarrier(cl, cached_dev_read_error, bcache_wq);
+@@ -1218,6 +1218,9 @@ static int cached_dev_ioctl(struct bcache_device *d, fmode_t mode,
+ {
+ struct cached_dev *dc = container_of(d, struct cached_dev, disk);
+
++ if (dc->io_disable)
++ return -EIO;
++
+ return __blkdev_driver_ioctl(dc->bdev, mode, cmd, arg);
+ }
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 30ba9aeb5ee8..03bb5cee2b83 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -643,10 +643,6 @@ static int ioctl_dev(struct block_device *b, fmode_t mode,
+ unsigned int cmd, unsigned long arg)
+ {
+ struct bcache_device *d = b->bd_disk->private_data;
+- struct cached_dev *dc = container_of(d, struct cached_dev, disk);
+-
+- if (dc->io_disable)
+- return -EIO;
+
+ return d->ioctl(d, mode, cmd, arg);
+ }
+@@ -1152,11 +1148,12 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
+ }
+
+ if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) {
+- bch_sectors_dirty_init(&dc->disk);
+ atomic_set(&dc->has_dirty, 1);
+ bch_writeback_queue(dc);
+ }
+
++ bch_sectors_dirty_init(&dc->disk);
++
+ bch_cached_dev_run(dc);
+ bcache_device_link(&dc->disk, c, "bdev");
+ atomic_inc(&c->attached_dev_nr);
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index 150cf4f4cf74..26f035a0c5b9 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -285,6 +285,7 @@ STORE(__cached_dev)
+ 1, WRITEBACK_RATE_UPDATE_SECS_MAX);
+ d_strtoul(writeback_rate_i_term_inverse);
+ d_strtoul_nonzero(writeback_rate_p_term_inverse);
++ d_strtoul_nonzero(writeback_rate_minimum);
+
+ sysfs_strtoul_clamp(io_error_limit, dc->error_limit, 0, INT_MAX);
+
+@@ -412,6 +413,7 @@ static struct attribute *bch_cached_dev_files[] = {
+ &sysfs_writeback_rate_update_seconds,
+ &sysfs_writeback_rate_i_term_inverse,
+ &sysfs_writeback_rate_p_term_inverse,
++ &sysfs_writeback_rate_minimum,
+ &sysfs_writeback_rate_debug,
+ &sysfs_errors,
+ &sysfs_io_error_limit,
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index b810ea77e6b1..f666778ad237 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1720,8 +1720,7 @@ static void free_params(struct dm_ioctl *param, size_t param_size, int param_fla
+ }
+
+ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kernel,
+- int ioctl_flags,
+- struct dm_ioctl **param, int *param_flags)
++ int ioctl_flags, struct dm_ioctl **param, int *param_flags)
+ {
+ struct dm_ioctl *dmi;
+ int secure_data;
+@@ -1762,18 +1761,13 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
+
+ *param_flags |= DM_PARAMS_MALLOC;
+
+- if (copy_from_user(dmi, user, param_kernel->data_size))
+- goto bad;
++ /* Copy from param_kernel (which was already copied from user) */
++ memcpy(dmi, param_kernel, minimum_data_size);
+
+-data_copied:
+- /*
+- * Abort if something changed the ioctl data while it was being copied.
+- */
+- if (dmi->data_size != param_kernel->data_size) {
+- DMERR("rejecting ioctl: data size modified while processing parameters");
++ if (copy_from_user(&dmi->data, (char __user *)user + minimum_data_size,
++ param_kernel->data_size - minimum_data_size))
+ goto bad;
+- }
+-
++data_copied:
+ /* Wipe the user buffer so we do not return it to userspace */
+ if (secure_data && clear_user(user, param_kernel->data_size))
+ goto bad;
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index 969954915566..fa68336560c3 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -99,7 +99,7 @@ struct dmz_mblock {
+ struct rb_node node;
+ struct list_head link;
+ sector_t no;
+- atomic_t ref;
++ unsigned int ref;
+ unsigned long state;
+ struct page *page;
+ void *data;
+@@ -296,7 +296,7 @@ static struct dmz_mblock *dmz_alloc_mblock(struct dmz_metadata *zmd,
+
+ RB_CLEAR_NODE(&mblk->node);
+ INIT_LIST_HEAD(&mblk->link);
+- atomic_set(&mblk->ref, 0);
++ mblk->ref = 0;
+ mblk->state = 0;
+ mblk->no = mblk_no;
+ mblk->data = page_address(mblk->page);
+@@ -339,10 +339,11 @@ static void dmz_insert_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk)
+ }
+
+ /*
+- * Lookup a metadata block in the rbtree.
++ * Lookup a metadata block in the rbtree. If the block is found, increment
++ * its reference count.
+ */
+-static struct dmz_mblock *dmz_lookup_mblock(struct dmz_metadata *zmd,
+- sector_t mblk_no)
++static struct dmz_mblock *dmz_get_mblock_fast(struct dmz_metadata *zmd,
++ sector_t mblk_no)
+ {
+ struct rb_root *root = &zmd->mblk_rbtree;
+ struct rb_node *node = root->rb_node;
+@@ -350,8 +351,17 @@ static struct dmz_mblock *dmz_lookup_mblock(struct dmz_metadata *zmd,
+
+ while (node) {
+ mblk = container_of(node, struct dmz_mblock, node);
+- if (mblk->no == mblk_no)
++ if (mblk->no == mblk_no) {
++ /*
++ * If this is the first reference to the block,
++ * remove it from the LRU list.
++ */
++ mblk->ref++;
++ if (mblk->ref == 1 &&
++ !test_bit(DMZ_META_DIRTY, &mblk->state))
++ list_del_init(&mblk->link);
+ return mblk;
++ }
+ node = (mblk->no < mblk_no) ? node->rb_left : node->rb_right;
+ }
+
+@@ -382,32 +392,47 @@ static void dmz_mblock_bio_end_io(struct bio *bio)
+ }
+
+ /*
+- * Read a metadata block from disk.
++ * Read an uncached metadata block from disk and add it to the cache.
+ */
+-static struct dmz_mblock *dmz_fetch_mblock(struct dmz_metadata *zmd,
+- sector_t mblk_no)
++static struct dmz_mblock *dmz_get_mblock_slow(struct dmz_metadata *zmd,
++ sector_t mblk_no)
+ {
+- struct dmz_mblock *mblk;
++ struct dmz_mblock *mblk, *m;
+ sector_t block = zmd->sb[zmd->mblk_primary].block + mblk_no;
+ struct bio *bio;
+
+- /* Get block and insert it */
++ /* Get a new block and a BIO to read it */
+ mblk = dmz_alloc_mblock(zmd, mblk_no);
+ if (!mblk)
+ return NULL;
+
+- spin_lock(&zmd->mblk_lock);
+- atomic_inc(&mblk->ref);
+- set_bit(DMZ_META_READING, &mblk->state);
+- dmz_insert_mblock(zmd, mblk);
+- spin_unlock(&zmd->mblk_lock);
+-
+ bio = bio_alloc(GFP_NOIO, 1);
+ if (!bio) {
+ dmz_free_mblock(zmd, mblk);
+ return NULL;
+ }
+
++ spin_lock(&zmd->mblk_lock);
++
++ /*
++ * Make sure that another context did not start reading
++ * the block already.
++ */
++ m = dmz_get_mblock_fast(zmd, mblk_no);
++ if (m) {
++ spin_unlock(&zmd->mblk_lock);
++ dmz_free_mblock(zmd, mblk);
++ bio_put(bio);
++ return m;
++ }
++
++ mblk->ref++;
++ set_bit(DMZ_META_READING, &mblk->state);
++ dmz_insert_mblock(zmd, mblk);
++
++ spin_unlock(&zmd->mblk_lock);
++
++ /* Submit read BIO */
+ bio->bi_iter.bi_sector = dmz_blk2sect(block);
+ bio_set_dev(bio, zmd->dev->bdev);
+ bio->bi_private = mblk;
+@@ -484,7 +509,8 @@ static void dmz_release_mblock(struct dmz_metadata *zmd,
+
+ spin_lock(&zmd->mblk_lock);
+
+- if (atomic_dec_and_test(&mblk->ref)) {
++ mblk->ref--;
++ if (mblk->ref == 0) {
+ if (test_bit(DMZ_META_ERROR, &mblk->state)) {
+ rb_erase(&mblk->node, &zmd->mblk_rbtree);
+ dmz_free_mblock(zmd, mblk);
+@@ -508,18 +534,12 @@ static struct dmz_mblock *dmz_get_mblock(struct dmz_metadata *zmd,
+
+ /* Check rbtree */
+ spin_lock(&zmd->mblk_lock);
+- mblk = dmz_lookup_mblock(zmd, mblk_no);
+- if (mblk) {
+- /* Cache hit: remove block from LRU list */
+- if (atomic_inc_return(&mblk->ref) == 1 &&
+- !test_bit(DMZ_META_DIRTY, &mblk->state))
+- list_del_init(&mblk->link);
+- }
++ mblk = dmz_get_mblock_fast(zmd, mblk_no);
+ spin_unlock(&zmd->mblk_lock);
+
+ if (!mblk) {
+ /* Cache miss: read the block from disk */
+- mblk = dmz_fetch_mblock(zmd, mblk_no);
++ mblk = dmz_get_mblock_slow(zmd, mblk_no);
+ if (!mblk)
+ return ERR_PTR(-ENOMEM);
+ }
+@@ -753,7 +773,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
+
+ spin_lock(&zmd->mblk_lock);
+ clear_bit(DMZ_META_DIRTY, &mblk->state);
+- if (atomic_read(&mblk->ref) == 0)
++ if (mblk->ref == 0)
+ list_add_tail(&mblk->link, &zmd->mblk_lru_list);
+ spin_unlock(&zmd->mblk_lock);
+ }
+@@ -2308,7 +2328,7 @@ static void dmz_cleanup_metadata(struct dmz_metadata *zmd)
+ mblk = list_first_entry(&zmd->mblk_dirty_list,
+ struct dmz_mblock, link);
+ dmz_dev_warn(zmd->dev, "mblock %llu still in dirty list (ref %u)",
+- (u64)mblk->no, atomic_read(&mblk->ref));
++ (u64)mblk->no, mblk->ref);
+ list_del_init(&mblk->link);
+ rb_erase(&mblk->node, &zmd->mblk_rbtree);
+ dmz_free_mblock(zmd, mblk);
+@@ -2326,8 +2346,8 @@ static void dmz_cleanup_metadata(struct dmz_metadata *zmd)
+ root = &zmd->mblk_rbtree;
+ rbtree_postorder_for_each_entry_safe(mblk, next, root, node) {
+ dmz_dev_warn(zmd->dev, "mblock %llu ref %u still in rbtree",
+- (u64)mblk->no, atomic_read(&mblk->ref));
+- atomic_set(&mblk->ref, 0);
++ (u64)mblk->no, mblk->ref);
++ mblk->ref = 0;
+ dmz_free_mblock(zmd, mblk);
+ }
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 63ceabb4e020..8668793262d0 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -452,10 +452,11 @@ static void md_end_flush(struct bio *fbio)
+ rdev_dec_pending(rdev, mddev);
+
+ if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0)
++ if (bio->bi_iter.bi_size == 0) {
+ /* an empty barrier - all done */
+ bio_endio(bio);
+- else {
++ mempool_free(fi, mddev->flush_pool);
++ } else {
+ INIT_WORK(&fi->flush_work, submit_flushes);
+ queue_work(md_wq, &fi->flush_work);
+ }
+@@ -509,10 +510,11 @@ void md_flush_request(struct mddev *mddev, struct bio *bio)
+ rcu_read_unlock();
+
+ if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0)
++ if (bio->bi_iter.bi_size == 0) {
+ /* an empty barrier - all done */
+ bio_endio(bio);
+- else {
++ mempool_free(fi, mddev->flush_pool);
++ } else {
+ INIT_WORK(&fi->flush_work, submit_flushes);
+ queue_work(md_wq, &fi->flush_work);
+ }
+@@ -5904,14 +5906,6 @@ static void __md_stop(struct mddev *mddev)
+ mddev->to_remove = &md_redundancy_group;
+ module_put(pers->owner);
+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+-}
+-
+-void md_stop(struct mddev *mddev)
+-{
+- /* stop the array and free an attached data structures.
+- * This is called from dm-raid
+- */
+- __md_stop(mddev);
+ if (mddev->flush_bio_pool) {
+ mempool_destroy(mddev->flush_bio_pool);
+ mddev->flush_bio_pool = NULL;
+@@ -5920,6 +5914,14 @@ void md_stop(struct mddev *mddev)
+ mempool_destroy(mddev->flush_pool);
+ mddev->flush_pool = NULL;
+ }
++}
++
++void md_stop(struct mddev *mddev)
++{
++ /* stop the array and free an attached data structures.
++ * This is called from dm-raid
++ */
++ __md_stop(mddev);
+ bioset_exit(&mddev->bio_set);
+ bioset_exit(&mddev->sync_set);
+ }
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 4e990246225e..1d54109071cc 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1734,6 +1734,7 @@ static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ */
+ if (rdev->saved_raid_disk >= 0 &&
+ rdev->saved_raid_disk >= first &&
++ rdev->saved_raid_disk < conf->raid_disks &&
+ conf->mirrors[rdev->saved_raid_disk].rdev == NULL)
+ first = last = rdev->saved_raid_disk;
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index d6f7978b4449..811427e53126 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1808,6 +1808,7 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ first = last = rdev->raid_disk;
+
+ if (rdev->saved_raid_disk >= first &&
++ rdev->saved_raid_disk < conf->geo.raid_disks &&
+ conf->mirrors[rdev->saved_raid_disk].rdev == NULL)
+ mirror = rdev->saved_raid_disk;
+ else
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index 030b2602faf0..dd8bad74a1f0 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -341,7 +341,7 @@ static void cec_data_completed(struct cec_data *data)
+ *
+ * This function is called with adap->lock held.
+ */
+-static void cec_data_cancel(struct cec_data *data)
++static void cec_data_cancel(struct cec_data *data, u8 tx_status)
+ {
+ /*
+ * It's either the current transmit, or it is a pending
+@@ -356,13 +356,11 @@ static void cec_data_cancel(struct cec_data *data)
+ }
+
+ if (data->msg.tx_status & CEC_TX_STATUS_OK) {
+- /* Mark the canceled RX as a timeout */
+ data->msg.rx_ts = ktime_get_ns();
+- data->msg.rx_status = CEC_RX_STATUS_TIMEOUT;
++ data->msg.rx_status = CEC_RX_STATUS_ABORTED;
+ } else {
+- /* Mark the canceled TX as an error */
+ data->msg.tx_ts = ktime_get_ns();
+- data->msg.tx_status |= CEC_TX_STATUS_ERROR |
++ data->msg.tx_status |= tx_status |
+ CEC_TX_STATUS_MAX_RETRIES;
+ data->msg.tx_error_cnt++;
+ data->attempts = 0;
+@@ -390,15 +388,15 @@ static void cec_flush(struct cec_adapter *adap)
+ while (!list_empty(&adap->transmit_queue)) {
+ data = list_first_entry(&adap->transmit_queue,
+ struct cec_data, list);
+- cec_data_cancel(data);
++ cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
+ }
+ if (adap->transmitting)
+- cec_data_cancel(adap->transmitting);
++ cec_data_cancel(adap->transmitting, CEC_TX_STATUS_ABORTED);
+
+ /* Cancel the pending timeout work. */
+ list_for_each_entry_safe(data, n, &adap->wait_queue, list) {
+ if (cancel_delayed_work(&data->work))
+- cec_data_cancel(data);
++ cec_data_cancel(data, CEC_TX_STATUS_OK);
+ /*
+ * If cancel_delayed_work returned false, then
+ * the cec_wait_timeout function is running,
+@@ -474,12 +472,13 @@ int cec_thread_func(void *_adap)
+ * so much traffic on the bus that the adapter was
+ * unable to transmit for CEC_XFER_TIMEOUT_MS (2.1s).
+ */
+- dprintk(1, "%s: message %*ph timed out\n", __func__,
++ pr_warn("cec-%s: message %*ph timed out\n", adap->name,
+ adap->transmitting->msg.len,
+ adap->transmitting->msg.msg);
+ adap->tx_timeouts++;
+ /* Just give up on this. */
+- cec_data_cancel(adap->transmitting);
++ cec_data_cancel(adap->transmitting,
++ CEC_TX_STATUS_TIMEOUT);
+ goto unlock;
+ }
+
+@@ -514,9 +513,11 @@ int cec_thread_func(void *_adap)
+ if (data->attempts) {
+ /* should be >= 3 data bit periods for a retry */
+ signal_free_time = CEC_SIGNAL_FREE_TIME_RETRY;
+- } else if (data->new_initiator) {
++ } else if (adap->last_initiator !=
++ cec_msg_initiator(&data->msg)) {
+ /* should be >= 5 data bit periods for new initiator */
+ signal_free_time = CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
++ adap->last_initiator = cec_msg_initiator(&data->msg);
+ } else {
+ /*
+ * should be >= 7 data bit periods for sending another
+@@ -530,7 +531,7 @@ int cec_thread_func(void *_adap)
+ /* Tell the adapter to transmit, cancel on error */
+ if (adap->ops->adap_transmit(adap, data->attempts,
+ signal_free_time, &data->msg))
+- cec_data_cancel(data);
++ cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
+
+ unlock:
+ mutex_unlock(&adap->lock);
+@@ -701,9 +702,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ struct cec_fh *fh, bool block)
+ {
+ struct cec_data *data;
+- u8 last_initiator = 0xff;
+- unsigned int timeout;
+- int res = 0;
+
+ msg->rx_ts = 0;
+ msg->tx_ts = 0;
+@@ -813,23 +811,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ data->adap = adap;
+ data->blocking = block;
+
+- /*
+- * Determine if this message follows a message from the same
+- * initiator. Needed to determine the free signal time later on.
+- */
+- if (msg->len > 1) {
+- if (!(list_empty(&adap->transmit_queue))) {
+- const struct cec_data *last;
+-
+- last = list_last_entry(&adap->transmit_queue,
+- const struct cec_data, list);
+- last_initiator = cec_msg_initiator(&last->msg);
+- } else if (adap->transmitting) {
+- last_initiator =
+- cec_msg_initiator(&adap->transmitting->msg);
+- }
+- }
+- data->new_initiator = last_initiator != cec_msg_initiator(msg);
+ init_completion(&data->c);
+ INIT_DELAYED_WORK(&data->work, cec_wait_timeout);
+
+@@ -845,48 +826,23 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ if (!block)
+ return 0;
+
+- /*
+- * If we don't get a completion before this time something is really
+- * wrong and we time out.
+- */
+- timeout = CEC_XFER_TIMEOUT_MS;
+- /* Add the requested timeout if we have to wait for a reply as well */
+- if (msg->timeout)
+- timeout += msg->timeout;
+-
+ /*
+ * Release the lock and wait, retake the lock afterwards.
+ */
+ mutex_unlock(&adap->lock);
+- res = wait_for_completion_killable_timeout(&data->c,
+- msecs_to_jiffies(timeout));
++ wait_for_completion_killable(&data->c);
++ if (!data->completed)
++ cancel_delayed_work_sync(&data->work);
+ mutex_lock(&adap->lock);
+
+- if (data->completed) {
+- /* The transmit completed (possibly with an error) */
+- *msg = data->msg;
+- kfree(data);
+- return 0;
+- }
+- /*
+- * The wait for completion timed out or was interrupted, so mark this
+- * as non-blocking and disconnect from the filehandle since it is
+- * still 'in flight'. When it finally completes it will just drop the
+- * result silently.
+- */
+- data->blocking = false;
+- if (data->fh)
+- list_del(&data->xfer_list);
+- data->fh = NULL;
++ /* Cancel the transmit if it was interrupted */
++ if (!data->completed)
++ cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
+
+- if (res == 0) { /* timed out */
+- /* Check if the reply or the transmit failed */
+- if (msg->timeout && (msg->tx_status & CEC_TX_STATUS_OK))
+- msg->rx_status = CEC_RX_STATUS_TIMEOUT;
+- else
+- msg->tx_status = CEC_TX_STATUS_MAX_RETRIES;
+- }
+- return res > 0 ? 0 : res;
++ /* The transmit completed (possibly with an error) */
++ *msg = data->msg;
++ kfree(data);
++ return 0;
+ }
+
+ /* Helper function to be used by drivers and this framework. */
+@@ -1044,6 +1000,8 @@ void cec_received_msg_ts(struct cec_adapter *adap,
+ mutex_lock(&adap->lock);
+ dprintk(2, "%s: %*ph\n", __func__, msg->len, msg->msg);
+
++ adap->last_initiator = 0xff;
++
+ /* Check if this message was for us (directed or broadcast). */
+ if (!cec_msg_is_broadcast(msg))
+ valid_la = cec_has_log_addr(adap, msg_dest);
+@@ -1506,6 +1464,8 @@ void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
+ }
+
+ mutex_lock(&adap->devnode.lock);
++ adap->last_initiator = 0xff;
++
+ if ((adap->needs_hpd || list_empty(&adap->devnode.fhs)) &&
+ adap->ops->adap_enable(adap, true)) {
+ mutex_unlock(&adap->devnode.lock);
+diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
+index b6536bbad530..4961573850d5 100644
+--- a/drivers/media/cec/cec-api.c
++++ b/drivers/media/cec/cec-api.c
+@@ -101,6 +101,23 @@ static long cec_adap_g_phys_addr(struct cec_adapter *adap,
+ return 0;
+ }
+
++static int cec_validate_phys_addr(u16 phys_addr)
++{
++ int i;
++
++ if (phys_addr == CEC_PHYS_ADDR_INVALID)
++ return 0;
++ for (i = 0; i < 16; i += 4)
++ if (phys_addr & (0xf << i))
++ break;
++ if (i == 16)
++ return 0;
++ for (i += 4; i < 16; i += 4)
++ if ((phys_addr & (0xf << i)) == 0)
++ return -EINVAL;
++ return 0;
++}
++
+ static long cec_adap_s_phys_addr(struct cec_adapter *adap, struct cec_fh *fh,
+ bool block, __u16 __user *parg)
+ {
+@@ -112,7 +129,7 @@ static long cec_adap_s_phys_addr(struct cec_adapter *adap, struct cec_fh *fh,
+ if (copy_from_user(&phys_addr, parg, sizeof(phys_addr)))
+ return -EFAULT;
+
+- err = cec_phys_addr_validate(phys_addr, NULL, NULL);
++ err = cec_validate_phys_addr(phys_addr);
+ if (err)
+ return err;
+ mutex_lock(&adap->lock);
+diff --git a/drivers/media/cec/cec-edid.c b/drivers/media/cec/cec-edid.c
+index ec72ac1c0b91..f587e8eaefd8 100644
+--- a/drivers/media/cec/cec-edid.c
++++ b/drivers/media/cec/cec-edid.c
+@@ -10,66 +10,6 @@
+ #include <linux/types.h>
+ #include <media/cec.h>
+
+-/*
+- * This EDID is expected to be a CEA-861 compliant, which means that there are
+- * at least two blocks and one or more of the extensions blocks are CEA-861
+- * blocks.
+- *
+- * The returned location is guaranteed to be < size - 1.
+- */
+-static unsigned int cec_get_edid_spa_location(const u8 *edid, unsigned int size)
+-{
+- unsigned int blocks = size / 128;
+- unsigned int block;
+- u8 d;
+-
+- /* Sanity check: at least 2 blocks and a multiple of the block size */
+- if (blocks < 2 || size % 128)
+- return 0;
+-
+- /*
+- * If there are fewer extension blocks than the size, then update
+- * 'blocks'. It is allowed to have more extension blocks than the size,
+- * since some hardware can only read e.g. 256 bytes of the EDID, even
+- * though more blocks are present. The first CEA-861 extension block
+- * should normally be in block 1 anyway.
+- */
+- if (edid[0x7e] + 1 < blocks)
+- blocks = edid[0x7e] + 1;
+-
+- for (block = 1; block < blocks; block++) {
+- unsigned int offset = block * 128;
+-
+- /* Skip any non-CEA-861 extension blocks */
+- if (edid[offset] != 0x02 || edid[offset + 1] != 0x03)
+- continue;
+-
+- /* search Vendor Specific Data Block (tag 3) */
+- d = edid[offset + 2] & 0x7f;
+- /* Check if there are Data Blocks */
+- if (d <= 4)
+- continue;
+- if (d > 4) {
+- unsigned int i = offset + 4;
+- unsigned int end = offset + d;
+-
+- /* Note: 'end' is always < 'size' */
+- do {
+- u8 tag = edid[i] >> 5;
+- u8 len = edid[i] & 0x1f;
+-
+- if (tag == 3 && len >= 5 && i + len <= end &&
+- edid[i + 1] == 0x03 &&
+- edid[i + 2] == 0x0c &&
+- edid[i + 3] == 0x00)
+- return i + 4;
+- i += len + 1;
+- } while (i < end);
+- }
+- }
+- return 0;
+-}
+-
+ u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
+ unsigned int *offset)
+ {
+diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c
+index 3a3dc23c560c..a4341205c197 100644
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c
+@@ -602,14 +602,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][5] = { 3138, 657, 810 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][6] = { 731, 680, 3048 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][1] = { 3046, 3054, 886 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][2] = { 0, 3058, 3031 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][3] = { 360, 3079, 877 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][4] = { 3103, 587, 3027 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][5] = { 3116, 723, 861 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][6] = { 789, 744, 3025 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][1] = { 3046, 3054, 886 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][2] = { 0, 3058, 3031 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][3] = { 360, 3079, 877 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][4] = { 3103, 587, 3027 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][5] = { 3116, 723, 861 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][6] = { 789, 744, 3025 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2941, 2950, 546 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][2] = { 0, 2954, 2924 },
+@@ -658,14 +658,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][5] = { 3138, 657, 810 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][6] = { 731, 680, 3048 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][1] = { 3046, 3054, 886 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][2] = { 0, 3058, 3031 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][3] = { 360, 3079, 877 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][4] = { 3103, 587, 3027 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][5] = { 3116, 723, 861 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][6] = { 789, 744, 3025 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][1] = { 3046, 3054, 886 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][2] = { 0, 3058, 3031 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][3] = { 360, 3079, 877 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][4] = { 3103, 587, 3027 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][5] = { 3116, 723, 861 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][6] = { 789, 744, 3025 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2941, 2950, 546 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][2] = { 0, 2954, 2924 },
+@@ -714,14 +714,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][5] = { 3056, 800, 800 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3056 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 851 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][2] = { 851, 3033, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][3] = { 851, 3033, 851 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][4] = { 3033, 851, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][5] = { 3033, 851, 851 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][2] = { 851, 3033, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][3] = { 851, 3033, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][4] = { 3033, 851, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][5] = { 3033, 851, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 507 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][2] = { 507, 2926, 2926 },
+@@ -770,14 +770,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][5] = { 2599, 901, 909 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][6] = { 991, 0, 2966 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][1] = { 2989, 3120, 1180 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][2] = { 1913, 3011, 3009 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][3] = { 1836, 3099, 1105 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][4] = { 2627, 413, 2966 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][5] = { 2576, 943, 951 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][6] = { 1026, 0, 2942 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][1] = { 2989, 3120, 1180 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][2] = { 1913, 3011, 3009 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][3] = { 1836, 3099, 1105 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][4] = { 2627, 413, 2966 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][5] = { 2576, 943, 951 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][6] = { 1026, 0, 2942 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2879, 3022, 874 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][2] = { 1688, 2903, 2901 },
+@@ -826,14 +826,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][5] = { 3001, 800, 799 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3071 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 799 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 776 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][2] = { 1068, 3033, 3033 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][3] = { 1068, 3033, 776 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][4] = { 2977, 851, 3048 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][5] = { 2977, 851, 851 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3048 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 776 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][2] = { 1068, 3033, 3033 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][3] = { 1068, 3033, 776 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][4] = { 2977, 851, 3048 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][5] = { 2977, 851, 851 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3048 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 423 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][2] = { 749, 2926, 2926 },
+@@ -882,14 +882,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][5] = { 3056, 800, 800 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3056 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 851 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][2] = { 851, 3033, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][3] = { 851, 3033, 851 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][4] = { 3033, 851, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][5] = { 3033, 851, 851 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][2] = { 851, 3033, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][3] = { 851, 3033, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][4] = { 3033, 851, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][5] = { 3033, 851, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 507 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 507, 2926, 2926 },
+@@ -922,62 +922,62 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1812, 886, 886 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1812 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][1] = { 2939, 2939, 781 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][2] = { 1622, 2939, 2939 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][3] = { 1622, 2939, 781 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][4] = { 2502, 547, 2881 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][5] = { 2502, 547, 547 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][6] = { 547, 547, 2881 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][7] = { 547, 547, 547 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][0] = { 3056, 3056, 3056 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][1] = { 3056, 3056, 1031 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][2] = { 1838, 3056, 3056 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][3] = { 1838, 3056, 1031 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][4] = { 2657, 800, 3002 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][5] = { 2657, 800, 800 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3002 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 1063 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][2] = { 1828, 3033, 3033 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][3] = { 1828, 3033, 1063 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][4] = { 2633, 851, 2979 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][5] = { 2633, 851, 851 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 2979 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 744 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 1594, 2926, 2926 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][3] = { 1594, 2926, 744 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][4] = { 2484, 507, 2867 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][5] = { 2484, 507, 507 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][6] = { 507, 507, 2867 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][7] = { 507, 507, 507 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][0] = { 2125, 2125, 2125 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][1] = { 2125, 2125, 212 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][2] = { 698, 2125, 2125 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][3] = { 698, 2125, 212 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][4] = { 1557, 130, 2043 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][5] = { 1557, 130, 130 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][6] = { 130, 130, 2043 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][7] = { 130, 130, 130 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][0] = { 3175, 3175, 3175 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][1] = { 3175, 3175, 1308 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][2] = { 2069, 3175, 3175 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][3] = { 2069, 3175, 1308 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][4] = { 2816, 1084, 3127 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][5] = { 2816, 1084, 1084 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][6] = { 1084, 1084, 3127 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][7] = { 1084, 1084, 1084 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][0] = { 1812, 1812, 1812 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][1] = { 1812, 1812, 1022 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][2] = { 1402, 1812, 1812 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][3] = { 1402, 1812, 1022 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][4] = { 1692, 886, 1797 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1692, 886, 886 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1797 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][1] = { 2939, 2939, 781 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][2] = { 1622, 2939, 2939 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][3] = { 1622, 2939, 781 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][4] = { 2502, 547, 2881 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][5] = { 2502, 547, 547 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][6] = { 547, 547, 2881 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][7] = { 547, 547, 547 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][0] = { 3056, 3056, 3056 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][1] = { 3056, 3056, 1031 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][2] = { 1838, 3056, 3056 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][3] = { 1838, 3056, 1031 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][4] = { 2657, 800, 3002 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][5] = { 2657, 800, 800 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3002 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 1063 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][2] = { 1828, 3033, 3033 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][3] = { 1828, 3033, 1063 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][4] = { 2633, 851, 2979 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][5] = { 2633, 851, 851 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 2979 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 744 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 1594, 2926, 2926 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][3] = { 1594, 2926, 744 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][4] = { 2484, 507, 2867 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][5] = { 2484, 507, 507 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][6] = { 507, 507, 2867 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][7] = { 507, 507, 507 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][0] = { 2125, 2125, 2125 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][1] = { 2125, 2125, 212 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][2] = { 698, 2125, 2125 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][3] = { 698, 2125, 212 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][4] = { 1557, 130, 2043 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][5] = { 1557, 130, 130 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][6] = { 130, 130, 2043 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][7] = { 130, 130, 130 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][0] = { 3175, 3175, 3175 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][1] = { 3175, 3175, 1308 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][2] = { 2069, 3175, 3175 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][3] = { 2069, 3175, 1308 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][4] = { 2816, 1084, 3127 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][5] = { 2816, 1084, 1084 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][6] = { 1084, 1084, 3127 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][7] = { 1084, 1084, 1084 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][0] = { 1812, 1812, 1812 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][1] = { 1812, 1812, 1022 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][2] = { 1402, 1812, 1812 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][3] = { 1402, 1812, 1022 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][4] = { 1692, 886, 1797 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1692, 886, 886 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1797 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][1] = { 2877, 2923, 1058 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][2] = { 1837, 2840, 2916 },
+@@ -994,14 +994,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][5] = { 2517, 1159, 900 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][6] = { 1042, 870, 2917 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][1] = { 2976, 3018, 1315 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][2] = { 2024, 2942, 3011 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][3] = { 1930, 2926, 1256 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][4] = { 2563, 1227, 2916 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][5] = { 2494, 1183, 943 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][6] = { 1073, 916, 2894 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][1] = { 2976, 3018, 1315 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][2] = { 2024, 2942, 3011 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][3] = { 1930, 2926, 1256 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][4] = { 2563, 1227, 2916 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][5] = { 2494, 1183, 943 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][6] = { 1073, 916, 2894 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][1] = { 2864, 2910, 1024 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][2] = { 1811, 2826, 2903 },
+@@ -1050,14 +1050,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][5] = { 2880, 998, 902 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][6] = { 816, 823, 2940 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 799 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][1] = { 3029, 3028, 1255 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][2] = { 1406, 2988, 3011 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][3] = { 1398, 2983, 1190 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][4] = { 2860, 1050, 2939 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][5] = { 2857, 1033, 945 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][6] = { 866, 873, 2916 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][1] = { 3029, 3028, 1255 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][2] = { 1406, 2988, 3011 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][3] = { 1398, 2983, 1190 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][4] = { 2860, 1050, 2939 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][5] = { 2857, 1033, 945 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][6] = { 866, 873, 2916 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][1] = { 2923, 2921, 957 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][2] = { 1125, 2877, 2902 },
+@@ -1128,7 +1128,7 @@ static const double rec709_to_240m[3][3] = {
+ { 0.0016327, 0.0044133, 0.9939540 },
+ };
+
+-static const double rec709_to_adobergb[3][3] = {
++static const double rec709_to_oprgb[3][3] = {
+ { 0.7151627, 0.2848373, -0.0000000 },
+ { 0.0000000, 1.0000000, 0.0000000 },
+ { -0.0000000, 0.0411705, 0.9588295 },
+@@ -1195,7 +1195,7 @@ static double transfer_rec709_to_rgb(double v)
+ return (v < 0.081) ? v / 4.5 : pow((v + 0.099) / 1.099, 1.0 / 0.45);
+ }
+
+-static double transfer_rgb_to_adobergb(double v)
++static double transfer_rgb_to_oprgb(double v)
+ {
+ return pow(v, 1.0 / 2.19921875);
+ }
+@@ -1251,8 +1251,8 @@ static void csc(enum v4l2_colorspace colorspace, enum v4l2_xfer_func xfer_func,
+ case V4L2_COLORSPACE_470_SYSTEM_M:
+ mult_matrix(r, g, b, rec709_to_ntsc1953);
+ break;
+- case V4L2_COLORSPACE_ADOBERGB:
+- mult_matrix(r, g, b, rec709_to_adobergb);
++ case V4L2_COLORSPACE_OPRGB:
++ mult_matrix(r, g, b, rec709_to_oprgb);
+ break;
+ case V4L2_COLORSPACE_BT2020:
+ mult_matrix(r, g, b, rec709_to_bt2020);
+@@ -1284,10 +1284,10 @@ static void csc(enum v4l2_colorspace colorspace, enum v4l2_xfer_func xfer_func,
+ *g = transfer_rgb_to_srgb(*g);
+ *b = transfer_rgb_to_srgb(*b);
+ break;
+- case V4L2_XFER_FUNC_ADOBERGB:
+- *r = transfer_rgb_to_adobergb(*r);
+- *g = transfer_rgb_to_adobergb(*g);
+- *b = transfer_rgb_to_adobergb(*b);
++ case V4L2_XFER_FUNC_OPRGB:
++ *r = transfer_rgb_to_oprgb(*r);
++ *g = transfer_rgb_to_oprgb(*g);
++ *b = transfer_rgb_to_oprgb(*b);
+ break;
+ case V4L2_XFER_FUNC_DCI_P3:
+ *r = transfer_rgb_to_dcip3(*r);
+@@ -1321,7 +1321,7 @@ int main(int argc, char **argv)
+ V4L2_COLORSPACE_470_SYSTEM_BG,
+ 0,
+ V4L2_COLORSPACE_SRGB,
+- V4L2_COLORSPACE_ADOBERGB,
++ V4L2_COLORSPACE_OPRGB,
+ V4L2_COLORSPACE_BT2020,
+ 0,
+ V4L2_COLORSPACE_DCI_P3,
+@@ -1336,7 +1336,7 @@ int main(int argc, char **argv)
+ "V4L2_COLORSPACE_470_SYSTEM_BG",
+ "",
+ "V4L2_COLORSPACE_SRGB",
+- "V4L2_COLORSPACE_ADOBERGB",
++ "V4L2_COLORSPACE_OPRGB",
+ "V4L2_COLORSPACE_BT2020",
+ "",
+ "V4L2_COLORSPACE_DCI_P3",
+@@ -1345,7 +1345,7 @@ int main(int argc, char **argv)
+ "",
+ "V4L2_XFER_FUNC_709",
+ "V4L2_XFER_FUNC_SRGB",
+- "V4L2_XFER_FUNC_ADOBERGB",
++ "V4L2_XFER_FUNC_OPRGB",
+ "V4L2_XFER_FUNC_SMPTE240M",
+ "V4L2_XFER_FUNC_NONE",
+ "V4L2_XFER_FUNC_DCI_P3",
+diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+index abd4c788dffd..f40ab5704bf0 100644
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+@@ -1770,7 +1770,7 @@ typedef struct { u16 __; u8 _; } __packed x24;
+ pos[7] = (chr & (0x01 << 0) ? fg : bg); \
+ } \
+ \
+- pos += (tpg->hflip ? -8 : 8) / hdiv; \
++ pos += (tpg->hflip ? -8 : 8) / (int)hdiv; \
+ } \
+ } \
+ } while (0)
+diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
+index 55c2ea0720d9..f3899cc84e27 100644
+--- a/drivers/media/i2c/adv7511.c
++++ b/drivers/media/i2c/adv7511.c
+@@ -1355,10 +1355,10 @@ static int adv7511_set_fmt(struct v4l2_subdev *sd,
+ state->xfer_func = format->format.xfer_func;
+
+ switch (format->format.colorspace) {
+- case V4L2_COLORSPACE_ADOBERGB:
++ case V4L2_COLORSPACE_OPRGB:
+ c = HDMI_COLORIMETRY_EXTENDED;
+- ec = y ? HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601 :
+- HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB;
++ ec = y ? HDMI_EXTENDED_COLORIMETRY_OPYCC_601 :
++ HDMI_EXTENDED_COLORIMETRY_OPRGB;
+ break;
+ case V4L2_COLORSPACE_SMPTE170M:
+ c = y ? HDMI_COLORIMETRY_ITU_601 : HDMI_COLORIMETRY_NONE;
+diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
+index 668be2bca57a..c78698199ac5 100644
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -2284,8 +2284,10 @@ static int adv76xx_set_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid)
+ state->aspect_ratio.numerator = 16;
+ state->aspect_ratio.denominator = 9;
+
+- if (!state->edid.present)
++ if (!state->edid.present) {
+ state->edid.blocks = 0;
++ cec_phys_addr_invalidate(state->cec_adap);
++ }
+
+ v4l2_dbg(2, debug, sd, "%s: clear EDID pad %d, edid.present = 0x%x\n",
+ __func__, edid->pad, state->edid.present);
+@@ -2474,7 +2476,7 @@ static int adv76xx_log_status(struct v4l2_subdev *sd)
+ "YCbCr Bt.601 (16-235)", "YCbCr Bt.709 (16-235)",
+ "xvYCC Bt.601", "xvYCC Bt.709",
+ "YCbCr Bt.601 (0-255)", "YCbCr Bt.709 (0-255)",
+- "sYCC", "Adobe YCC 601", "AdobeRGB", "invalid", "invalid",
++ "sYCC", "opYCC 601", "opRGB", "invalid", "invalid",
+ "invalid", "invalid", "invalid"
+ };
+ static const char * const rgb_quantization_range_txt[] = {
+diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
+index 4f8fbdd00e35..71fe56565f75 100644
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -786,8 +786,10 @@ static int edid_write_hdmi_segment(struct v4l2_subdev *sd, u8 port)
+ /* Disable I2C access to internal EDID ram from HDMI DDC ports */
+ rep_write_and_or(sd, 0x77, 0xf3, 0x00);
+
+- if (!state->hdmi_edid.present)
++ if (!state->hdmi_edid.present) {
++ cec_phys_addr_invalidate(state->cec_adap);
+ return 0;
++ }
+
+ pa = cec_get_edid_phys_addr(edid, 256, &spa_loc);
+ err = cec_phys_addr_validate(pa, &pa, NULL);
+diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
+index 31bf577b0bd3..64d1402882c8 100644
+--- a/drivers/media/i2c/ov7670.c
++++ b/drivers/media/i2c/ov7670.c
+@@ -1808,17 +1808,24 @@ static int ov7670_probe(struct i2c_client *client,
+ info->pclk_hb_disable = true;
+ }
+
+- info->clk = devm_clk_get(&client->dev, "xclk");
+- if (IS_ERR(info->clk))
+- return PTR_ERR(info->clk);
+- ret = clk_prepare_enable(info->clk);
+- if (ret)
+- return ret;
++ info->clk = devm_clk_get(&client->dev, "xclk"); /* optional */
++ if (IS_ERR(info->clk)) {
++ ret = PTR_ERR(info->clk);
++ if (ret == -ENOENT)
++ info->clk = NULL;
++ else
++ return ret;
++ }
++ if (info->clk) {
++ ret = clk_prepare_enable(info->clk);
++ if (ret)
++ return ret;
+
+- info->clock_speed = clk_get_rate(info->clk) / 1000000;
+- if (info->clock_speed < 10 || info->clock_speed > 48) {
+- ret = -EINVAL;
+- goto clk_disable;
++ info->clock_speed = clk_get_rate(info->clk) / 1000000;
++ if (info->clock_speed < 10 || info->clock_speed > 48) {
++ ret = -EINVAL;
++ goto clk_disable;
++ }
+ }
+
+ ret = ov7670_init_gpio(client, info);
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index 44c41933415a..ff25ea9aca48 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1243,9 +1243,9 @@ static int tc358743_log_status(struct v4l2_subdev *sd)
+ u8 vi_status3 = i2c_rd8(sd, VI_STATUS3);
+ const int deep_color_mode[4] = { 8, 10, 12, 16 };
+ static const char * const input_color_space[] = {
+- "RGB", "YCbCr 601", "Adobe RGB", "YCbCr 709", "NA (4)",
++ "RGB", "YCbCr 601", "opRGB", "YCbCr 709", "NA (4)",
+ "xvYCC 601", "NA(6)", "xvYCC 709", "NA(8)", "sYCC601",
+- "NA(10)", "NA(11)", "NA(12)", "Adobe YCC 601"};
++ "NA(10)", "NA(11)", "NA(12)", "opYCC 601"};
+
+ v4l2_info(sd, "-----Chip status-----\n");
+ v4l2_info(sd, "Chip ID: 0x%02x\n",
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 76e6bed5a1da..805bd9c65940 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -1534,7 +1534,7 @@ static int tvp5150_probe(struct i2c_client *c,
+ 27000000, 1, 27000000);
+ v4l2_ctrl_new_std_menu_items(&core->hdl, &tvp5150_ctrl_ops,
+ V4L2_CID_TEST_PATTERN,
+- ARRAY_SIZE(tvp5150_test_patterns),
++ ARRAY_SIZE(tvp5150_test_patterns) - 1,
+ 0, 0, tvp5150_test_patterns);
+ sd->ctrl_handler = &core->hdl;
+ if (core->hdl.error) {
+diff --git a/drivers/media/platform/vivid/vivid-core.h b/drivers/media/platform/vivid/vivid-core.h
+index 477c80a4d44c..cd4c8230563c 100644
+--- a/drivers/media/platform/vivid/vivid-core.h
++++ b/drivers/media/platform/vivid/vivid-core.h
+@@ -111,7 +111,7 @@ enum vivid_colorspace {
+ VIVID_CS_170M,
+ VIVID_CS_709,
+ VIVID_CS_SRGB,
+- VIVID_CS_ADOBERGB,
++ VIVID_CS_OPRGB,
+ VIVID_CS_2020,
+ VIVID_CS_DCI_P3,
+ VIVID_CS_240M,
+diff --git a/drivers/media/platform/vivid/vivid-ctrls.c b/drivers/media/platform/vivid/vivid-ctrls.c
+index 5429193fbb91..999aa101b150 100644
+--- a/drivers/media/platform/vivid/vivid-ctrls.c
++++ b/drivers/media/platform/vivid/vivid-ctrls.c
+@@ -348,7 +348,7 @@ static int vivid_vid_cap_s_ctrl(struct v4l2_ctrl *ctrl)
+ V4L2_COLORSPACE_SMPTE170M,
+ V4L2_COLORSPACE_REC709,
+ V4L2_COLORSPACE_SRGB,
+- V4L2_COLORSPACE_ADOBERGB,
++ V4L2_COLORSPACE_OPRGB,
+ V4L2_COLORSPACE_BT2020,
+ V4L2_COLORSPACE_DCI_P3,
+ V4L2_COLORSPACE_SMPTE240M,
+@@ -729,7 +729,7 @@ static const char * const vivid_ctrl_colorspace_strings[] = {
+ "SMPTE 170M",
+ "Rec. 709",
+ "sRGB",
+- "AdobeRGB",
++ "opRGB",
+ "BT.2020",
+ "DCI-P3",
+ "SMPTE 240M",
+@@ -752,7 +752,7 @@ static const char * const vivid_ctrl_xfer_func_strings[] = {
+ "Default",
+ "Rec. 709",
+ "sRGB",
+- "AdobeRGB",
++ "opRGB",
+ "SMPTE 240M",
+ "None",
+ "DCI-P3",
+diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
+index 51fec66d8d45..50248e2176a0 100644
+--- a/drivers/media/platform/vivid/vivid-vid-out.c
++++ b/drivers/media/platform/vivid/vivid-vid-out.c
+@@ -413,7 +413,7 @@ int vivid_try_fmt_vid_out(struct file *file, void *priv,
+ mp->colorspace = V4L2_COLORSPACE_SMPTE170M;
+ } else if (mp->colorspace != V4L2_COLORSPACE_SMPTE170M &&
+ mp->colorspace != V4L2_COLORSPACE_REC709 &&
+- mp->colorspace != V4L2_COLORSPACE_ADOBERGB &&
++ mp->colorspace != V4L2_COLORSPACE_OPRGB &&
+ mp->colorspace != V4L2_COLORSPACE_BT2020 &&
+ mp->colorspace != V4L2_COLORSPACE_SRGB) {
+ mp->colorspace = V4L2_COLORSPACE_REC709;
+diff --git a/drivers/media/usb/dvb-usb-v2/dvbsky.c b/drivers/media/usb/dvb-usb-v2/dvbsky.c
+index 1aa88d94e57f..e28bd8836751 100644
+--- a/drivers/media/usb/dvb-usb-v2/dvbsky.c
++++ b/drivers/media/usb/dvb-usb-v2/dvbsky.c
+@@ -31,6 +31,7 @@ MODULE_PARM_DESC(disable_rc, "Disable inbuilt IR receiver.");
+ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+
+ struct dvbsky_state {
++ struct mutex stream_mutex;
+ u8 ibuf[DVBSKY_BUF_LEN];
+ u8 obuf[DVBSKY_BUF_LEN];
+ u8 last_lock;
+@@ -67,17 +68,18 @@ static int dvbsky_usb_generic_rw(struct dvb_usb_device *d,
+
+ static int dvbsky_stream_ctrl(struct dvb_usb_device *d, u8 onoff)
+ {
++ struct dvbsky_state *state = d_to_priv(d);
+ int ret;
+- static u8 obuf_pre[3] = { 0x37, 0, 0 };
+- static u8 obuf_post[3] = { 0x36, 3, 0 };
++ u8 obuf_pre[3] = { 0x37, 0, 0 };
++ u8 obuf_post[3] = { 0x36, 3, 0 };
+
+- mutex_lock(&d->usb_mutex);
+- ret = dvb_usbv2_generic_rw_locked(d, obuf_pre, 3, NULL, 0);
++ mutex_lock(&state->stream_mutex);
++ ret = dvbsky_usb_generic_rw(d, obuf_pre, 3, NULL, 0);
+ if (!ret && onoff) {
+ msleep(20);
+- ret = dvb_usbv2_generic_rw_locked(d, obuf_post, 3, NULL, 0);
++ ret = dvbsky_usb_generic_rw(d, obuf_post, 3, NULL, 0);
+ }
+- mutex_unlock(&d->usb_mutex);
++ mutex_unlock(&state->stream_mutex);
+ return ret;
+ }
+
+@@ -606,6 +608,8 @@ static int dvbsky_init(struct dvb_usb_device *d)
+ if (ret)
+ return ret;
+ */
++ mutex_init(&state->stream_mutex);
++
+ state->last_lock = 0;
+
+ return 0;
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index 71c829f31d3b..87b887b7604e 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -2141,13 +2141,13 @@ const struct em28xx_board em28xx_boards[] = {
+ .input = { {
+ .type = EM28XX_VMUX_COMPOSITE,
+ .vmux = TVP5150_COMPOSITE1,
+- .amux = EM28XX_AUDIO_SRC_LINE,
++ .amux = EM28XX_AMUX_LINE_IN,
+ .gpio = terratec_av350_unmute_gpio,
+
+ }, {
+ .type = EM28XX_VMUX_SVIDEO,
+ .vmux = TVP5150_SVIDEO,
+- .amux = EM28XX_AUDIO_SRC_LINE,
++ .amux = EM28XX_AMUX_LINE_IN,
+ .gpio = terratec_av350_unmute_gpio,
+ } },
+ },
+@@ -3039,6 +3039,9 @@ static int em28xx_hint_board(struct em28xx *dev)
+
+ static void em28xx_card_setup(struct em28xx *dev)
+ {
++ int i, j, idx;
++ bool duplicate_entry;
++
+ /*
+ * If the device can be a webcam, seek for a sensor.
+ * If sensor is not found, then it isn't a webcam.
+@@ -3195,6 +3198,32 @@ static void em28xx_card_setup(struct em28xx *dev)
+ /* Allow override tuner type by a module parameter */
+ if (tuner >= 0)
+ dev->tuner_type = tuner;
++
++ /*
++ * Dynamically generate a list of valid audio inputs for this
++ * specific board, mapping them via enum em28xx_amux.
++ */
++
++ idx = 0;
++ for (i = 0; i < MAX_EM28XX_INPUT; i++) {
++ if (!INPUT(i)->type)
++ continue;
++
++ /* Skip already mapped audio inputs */
++ duplicate_entry = false;
++ for (j = 0; j < idx; j++) {
++ if (INPUT(i)->amux == dev->amux_map[j]) {
++ duplicate_entry = true;
++ break;
++ }
++ }
++ if (duplicate_entry)
++ continue;
++
++ dev->amux_map[idx++] = INPUT(i)->amux;
++ }
++ for (; idx < MAX_EM28XX_INPUT; idx++)
++ dev->amux_map[idx] = EM28XX_AMUX_UNUSED;
+ }
+
+ void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
+diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
+index 68571bf36d28..3bf98ac897ec 100644
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1093,6 +1093,8 @@ int em28xx_start_analog_streaming(struct vb2_queue *vq, unsigned int count)
+
+ em28xx_videodbg("%s\n", __func__);
+
++ dev->v4l2->field_count = 0;
++
+ /*
+ * Make sure streaming is not already in progress for this type
+ * of filehandle (e.g. video, vbi)
+@@ -1471,9 +1473,9 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
+
+ fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+ if (!fmt) {
+- em28xx_videodbg("Fourcc format (%08x) invalid.\n",
+- f->fmt.pix.pixelformat);
+- return -EINVAL;
++ fmt = &format[0];
++ em28xx_videodbg("Fourcc format (%08x) invalid. Using default (%08x).\n",
++ f->fmt.pix.pixelformat, fmt->fourcc);
+ }
+
+ if (dev->board.is_em2800) {
+@@ -1666,6 +1668,7 @@ static int vidioc_enum_input(struct file *file, void *priv,
+ {
+ struct em28xx *dev = video_drvdata(file);
+ unsigned int n;
++ int j;
+
+ n = i->index;
+ if (n >= MAX_EM28XX_INPUT)
+@@ -1685,6 +1688,12 @@ static int vidioc_enum_input(struct file *file, void *priv,
+ if (dev->is_webcam)
+ i->capabilities = 0;
+
++ /* Dynamically generates an audioset bitmask */
++ i->audioset = 0;
++ for (j = 0; j < MAX_EM28XX_INPUT; j++)
++ if (dev->amux_map[j] != EM28XX_AMUX_UNUSED)
++ i->audioset |= 1 << j;
++
+ return 0;
+ }
+
+@@ -1710,11 +1719,24 @@ static int vidioc_s_input(struct file *file, void *priv, unsigned int i)
+ return 0;
+ }
+
+-static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
++static int em28xx_fill_audio_input(struct em28xx *dev,
++ const char *s,
++ struct v4l2_audio *a,
++ unsigned int index)
+ {
+- struct em28xx *dev = video_drvdata(file);
++ unsigned int idx = dev->amux_map[index];
++
++ /*
++ * With msp3400, almost all mappings use the default (amux = 0).
++ * The only one may use a different value is WinTV USB2, where it
++ * can also be SCART1 input.
++ * As it is very doubtful that we would see new boards with msp3400,
++ * let's just reuse the existing switch.
++ */
++ if (dev->has_msp34xx && idx != EM28XX_AMUX_UNUSED)
++ idx = EM28XX_AMUX_LINE_IN;
+
+- switch (a->index) {
++ switch (idx) {
+ case EM28XX_AMUX_VIDEO:
+ strcpy(a->name, "Television");
+ break;
+@@ -1739,32 +1761,79 @@ static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
+ case EM28XX_AMUX_PCM_OUT:
+ strcpy(a->name, "PCM");
+ break;
++ case EM28XX_AMUX_UNUSED:
+ default:
+ return -EINVAL;
+ }
+-
+- a->index = dev->ctl_ainput;
++ a->index = index;
+ a->capability = V4L2_AUDCAP_STEREO;
+
++ em28xx_videodbg("%s: audio input index %d is '%s'\n",
++ s, a->index, a->name);
++
+ return 0;
+ }
+
++static int vidioc_enumaudio(struct file *file, void *fh, struct v4l2_audio *a)
++{
++ struct em28xx *dev = video_drvdata(file);
++
++ if (a->index >= MAX_EM28XX_INPUT)
++ return -EINVAL;
++
++ return em28xx_fill_audio_input(dev, __func__, a, a->index);
++}
++
++static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
++{
++ struct em28xx *dev = video_drvdata(file);
++ int i;
++
++ for (i = 0; i < MAX_EM28XX_INPUT; i++)
++ if (dev->ctl_ainput == dev->amux_map[i])
++ return em28xx_fill_audio_input(dev, __func__, a, i);
++
++ /* Should never happen! */
++ return -EINVAL;
++}
++
+ static int vidioc_s_audio(struct file *file, void *priv,
+ const struct v4l2_audio *a)
+ {
+ struct em28xx *dev = video_drvdata(file);
++ int idx, i;
+
+ if (a->index >= MAX_EM28XX_INPUT)
+ return -EINVAL;
+- if (!INPUT(a->index)->type)
++
++ idx = dev->amux_map[a->index];
++
++ if (idx == EM28XX_AMUX_UNUSED)
+ return -EINVAL;
+
+- dev->ctl_ainput = INPUT(a->index)->amux;
+- dev->ctl_aoutput = INPUT(a->index)->aout;
++ dev->ctl_ainput = idx;
++
++ /*
++ * FIXME: This is wrong, as different inputs at em28xx_cards
++ * may have different audio outputs. So, the right thing
++ * to do is to implement VIDIOC_G_AUDOUT/VIDIOC_S_AUDOUT.
++ * With the current board definitions, this would work fine,
++ * as, currently, all boards fit.
++ */
++ for (i = 0; i < MAX_EM28XX_INPUT; i++)
++ if (idx == dev->amux_map[i])
++ break;
++ if (i == MAX_EM28XX_INPUT)
++ return -EINVAL;
++
++ dev->ctl_aoutput = INPUT(i)->aout;
+
+ if (!dev->ctl_aoutput)
+ dev->ctl_aoutput = EM28XX_AOUT_MASTER;
+
++ em28xx_videodbg("%s: set audio input to %d\n", __func__,
++ dev->ctl_ainput);
++
+ return 0;
+ }
+
+@@ -2302,6 +2371,7 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
+ .vidioc_try_fmt_vbi_cap = vidioc_g_fmt_vbi_cap,
+ .vidioc_s_fmt_vbi_cap = vidioc_g_fmt_vbi_cap,
+ .vidioc_enum_framesizes = vidioc_enum_framesizes,
++ .vidioc_enumaudio = vidioc_enumaudio,
+ .vidioc_g_audio = vidioc_g_audio,
+ .vidioc_s_audio = vidioc_s_audio,
+
+diff --git a/drivers/media/usb/em28xx/em28xx.h b/drivers/media/usb/em28xx/em28xx.h
+index 953caac025f2..a551072e62ed 100644
+--- a/drivers/media/usb/em28xx/em28xx.h
++++ b/drivers/media/usb/em28xx/em28xx.h
+@@ -335,6 +335,9 @@ enum em28xx_usb_audio_type {
+ /**
+ * em28xx_amux - describes the type of audio input used by em28xx
+ *
++ * @EM28XX_AMUX_UNUSED:
++ * Used only on em28xx dev->map field, in order to mark an entry
++ * as unused.
+ * @EM28XX_AMUX_VIDEO:
+ * On devices without AC97, this is the only value that it is currently
+ * allowed.
+@@ -369,7 +372,8 @@ enum em28xx_usb_audio_type {
+ * same time, via the alsa mux.
+ */
+ enum em28xx_amux {
+- EM28XX_AMUX_VIDEO,
++ EM28XX_AMUX_UNUSED = -1,
++ EM28XX_AMUX_VIDEO = 0,
+ EM28XX_AMUX_LINE_IN,
+
+ /* Some less-common mixer setups */
+@@ -692,6 +696,8 @@ struct em28xx {
+ unsigned int ctl_input; // selected input
+ unsigned int ctl_ainput;// selected audio input
+ unsigned int ctl_aoutput;// selected audio output
++ enum em28xx_amux amux_map[MAX_EM28XX_INPUT];
++
+ int mute;
+ int volume;
+
+diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
+index c81faea96fba..c7c600c1f63b 100644
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -837,9 +837,9 @@ v4l2_hdmi_rx_colorimetry(const struct hdmi_avi_infoframe *avi,
+ switch (avi->colorimetry) {
+ case HDMI_COLORIMETRY_EXTENDED:
+ switch (avi->extended_colorimetry) {
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB:
+- c.colorspace = V4L2_COLORSPACE_ADOBERGB;
+- c.xfer_func = V4L2_XFER_FUNC_ADOBERGB;
++ case HDMI_EXTENDED_COLORIMETRY_OPRGB:
++ c.colorspace = V4L2_COLORSPACE_OPRGB;
++ c.xfer_func = V4L2_XFER_FUNC_OPRGB;
+ break;
+ case HDMI_EXTENDED_COLORIMETRY_BT2020:
+ c.colorspace = V4L2_COLORSPACE_BT2020;
+@@ -908,10 +908,10 @@ v4l2_hdmi_rx_colorimetry(const struct hdmi_avi_infoframe *avi,
+ c.ycbcr_enc = V4L2_YCBCR_ENC_601;
+ c.xfer_func = V4L2_XFER_FUNC_SRGB;
+ break;
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601:
+- c.colorspace = V4L2_COLORSPACE_ADOBERGB;
++ case HDMI_EXTENDED_COLORIMETRY_OPYCC_601:
++ c.colorspace = V4L2_COLORSPACE_OPRGB;
+ c.ycbcr_enc = V4L2_YCBCR_ENC_601;
+- c.xfer_func = V4L2_XFER_FUNC_ADOBERGB;
++ c.xfer_func = V4L2_XFER_FUNC_OPRGB;
+ break;
+ case HDMI_EXTENDED_COLORIMETRY_BT2020:
+ c.colorspace = V4L2_COLORSPACE_BT2020;
+diff --git a/drivers/mfd/menelaus.c b/drivers/mfd/menelaus.c
+index 29b7164a823b..d28ebe7ecd21 100644
+--- a/drivers/mfd/menelaus.c
++++ b/drivers/mfd/menelaus.c
+@@ -1094,6 +1094,7 @@ static void menelaus_rtc_alarm_work(struct menelaus_chip *m)
+ static inline void menelaus_rtc_init(struct menelaus_chip *m)
+ {
+ int alarm = (m->client->irq > 0);
++ int err;
+
+ /* assume 32KDETEN pin is pulled high */
+ if (!(menelaus_read_reg(MENELAUS_OSC_CTRL) & 0x80)) {
+@@ -1101,6 +1102,12 @@ static inline void menelaus_rtc_init(struct menelaus_chip *m)
+ return;
+ }
+
++ m->rtc = devm_rtc_allocate_device(&m->client->dev);
++ if (IS_ERR(m->rtc))
++ return;
++
++ m->rtc->ops = &menelaus_rtc_ops;
++
+ /* support RTC alarm; it can issue wakeups */
+ if (alarm) {
+ if (menelaus_add_irq_work(MENELAUS_RTCALM_IRQ,
+@@ -1125,10 +1132,8 @@ static inline void menelaus_rtc_init(struct menelaus_chip *m)
+ menelaus_write_reg(MENELAUS_RTC_CTRL, m->rtc_control);
+ }
+
+- m->rtc = rtc_device_register(DRIVER_NAME,
+- &m->client->dev,
+- &menelaus_rtc_ops, THIS_MODULE);
+- if (IS_ERR(m->rtc)) {
++ err = rtc_register_device(m->rtc);
++ if (err) {
+ if (alarm) {
+ menelaus_remove_irq_work(MENELAUS_RTCALM_IRQ);
+ device_init_wakeup(&m->client->dev, 0);
+diff --git a/drivers/misc/genwqe/card_base.h b/drivers/misc/genwqe/card_base.h
+index 120738d6e58b..77ed3967c5b0 100644
+--- a/drivers/misc/genwqe/card_base.h
++++ b/drivers/misc/genwqe/card_base.h
+@@ -408,7 +408,7 @@ struct genwqe_file {
+ struct file *filp;
+
+ struct fasync_struct *async_queue;
+- struct task_struct *owner;
++ struct pid *opener;
+ struct list_head list; /* entry in list of open files */
+
+ spinlock_t map_lock; /* lock for dma_mappings */
+diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c
+index f453ab82f0d7..8c1b63a4337b 100644
+--- a/drivers/misc/genwqe/card_dev.c
++++ b/drivers/misc/genwqe/card_dev.c
+@@ -52,7 +52,7 @@ static void genwqe_add_file(struct genwqe_dev *cd, struct genwqe_file *cfile)
+ {
+ unsigned long flags;
+
+- cfile->owner = current;
++ cfile->opener = get_pid(task_tgid(current));
+ spin_lock_irqsave(&cd->file_lock, flags);
+ list_add(&cfile->list, &cd->file_list);
+ spin_unlock_irqrestore(&cd->file_lock, flags);
+@@ -65,6 +65,7 @@ static int genwqe_del_file(struct genwqe_dev *cd, struct genwqe_file *cfile)
+ spin_lock_irqsave(&cd->file_lock, flags);
+ list_del(&cfile->list);
+ spin_unlock_irqrestore(&cd->file_lock, flags);
++ put_pid(cfile->opener);
+
+ return 0;
+ }
+@@ -275,7 +276,7 @@ static int genwqe_kill_fasync(struct genwqe_dev *cd, int sig)
+ return files;
+ }
+
+-static int genwqe_force_sig(struct genwqe_dev *cd, int sig)
++static int genwqe_terminate(struct genwqe_dev *cd)
+ {
+ unsigned int files = 0;
+ unsigned long flags;
+@@ -283,7 +284,7 @@ static int genwqe_force_sig(struct genwqe_dev *cd, int sig)
+
+ spin_lock_irqsave(&cd->file_lock, flags);
+ list_for_each_entry(cfile, &cd->file_list, list) {
+- force_sig(sig, cfile->owner);
++ kill_pid(cfile->opener, SIGKILL, 1);
+ files++;
+ }
+ spin_unlock_irqrestore(&cd->file_lock, flags);
+@@ -1352,7 +1353,7 @@ static int genwqe_inform_and_stop_processes(struct genwqe_dev *cd)
+ dev_warn(&pci_dev->dev,
+ "[%s] send SIGKILL and wait ...\n", __func__);
+
+- rc = genwqe_force_sig(cd, SIGKILL); /* force terminate */
++ rc = genwqe_terminate(cd);
+ if (rc) {
+ /* Give kill_timout more seconds to end processes */
+ for (i = 0; (i < GENWQE_KILL_TIMEOUT) &&
+diff --git a/drivers/misc/ocxl/config.c b/drivers/misc/ocxl/config.c
+index 2e30de9c694a..57a6bb1fd3c9 100644
+--- a/drivers/misc/ocxl/config.c
++++ b/drivers/misc/ocxl/config.c
+@@ -280,7 +280,9 @@ int ocxl_config_check_afu_index(struct pci_dev *dev,
+ u32 val;
+ int rc, templ_major, templ_minor, len;
+
+- pci_write_config_word(dev, fn->dvsec_afu_info_pos, afu_idx);
++ pci_write_config_byte(dev,
++ fn->dvsec_afu_info_pos + OCXL_DVSEC_AFU_INFO_AFU_IDX,
++ afu_idx);
+ rc = read_afu_info(dev, fn, OCXL_DVSEC_TEMPL_VERSION, &val);
+ if (rc)
+ return rc;
+diff --git a/drivers/misc/vmw_vmci/vmci_driver.c b/drivers/misc/vmw_vmci/vmci_driver.c
+index d7eaf1eb11e7..003bfba40758 100644
+--- a/drivers/misc/vmw_vmci/vmci_driver.c
++++ b/drivers/misc/vmw_vmci/vmci_driver.c
+@@ -113,5 +113,5 @@ module_exit(vmci_drv_exit);
+
+ MODULE_AUTHOR("VMware, Inc.");
+ MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface.");
+-MODULE_VERSION("1.1.5.0-k");
++MODULE_VERSION("1.1.6.0-k");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c
+index 1ab6e8737a5f..da1ee2e1ba99 100644
+--- a/drivers/misc/vmw_vmci/vmci_resource.c
++++ b/drivers/misc/vmw_vmci/vmci_resource.c
+@@ -57,7 +57,8 @@ static struct vmci_resource *vmci_resource_lookup(struct vmci_handle handle,
+
+ if (r->type == type &&
+ rid == handle.resource &&
+- (cid == handle.context || cid == VMCI_INVALID_ID)) {
++ (cid == handle.context || cid == VMCI_INVALID_ID ||
++ handle.context == VMCI_INVALID_ID)) {
+ resource = r;
+ break;
+ }
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index 32321bd596d8..c61109f7b793 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -76,6 +76,7 @@ struct sdhci_acpi_slot {
+ size_t priv_size;
+ int (*probe_slot)(struct platform_device *, const char *, const char *);
+ int (*remove_slot)(struct platform_device *);
++ int (*free_slot)(struct platform_device *pdev);
+ int (*setup_host)(struct platform_device *pdev);
+ };
+
+@@ -756,6 +757,9 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
+ err_cleanup:
+ sdhci_cleanup_host(c->host);
+ err_free:
++ if (c->slot && c->slot->free_slot)
++ c->slot->free_slot(pdev);
++
+ sdhci_free_host(c->host);
+ return err;
+ }
+@@ -777,6 +781,10 @@ static int sdhci_acpi_remove(struct platform_device *pdev)
+
+ dead = (sdhci_readl(c->host, SDHCI_INT_STATUS) == ~0);
+ sdhci_remove_host(c->host, dead);
++
++ if (c->slot && c->slot->free_slot)
++ c->slot->free_slot(pdev);
++
+ sdhci_free_host(c->host);
+
+ return 0;
+diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c
+index 77e9bc4aaee9..cc3ffeffd7a2 100644
+--- a/drivers/mmc/host/sdhci-pci-o2micro.c
++++ b/drivers/mmc/host/sdhci-pci-o2micro.c
+@@ -490,6 +490,9 @@ int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip)
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+ break;
+ case PCI_DEVICE_ID_O2_SEABIRD0:
++ if (chip->pdev->revision == 0x01)
++ chip->quirks |= SDHCI_QUIRK_DELAY_AFTER_POWER;
++ /* fall through */
+ case PCI_DEVICE_ID_O2_SEABIRD1:
+ /* UnLock WP */
+ ret = pci_read_config_byte(chip->pdev,
+diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
+index 9d9723693217..2e3a8da3ce72 100644
+--- a/drivers/mtd/maps/gpio-addr-flash.c
++++ b/drivers/mtd/maps/gpio-addr-flash.c
+@@ -238,7 +238,7 @@ static int gpio_flash_probe(struct platform_device *pdev)
+ state->map.copy_to = gf_copy_to;
+ state->map.bankwidth = pdata->width;
+ state->map.size = state->win_size * (1 << state->gpio_count);
+- state->map.virt = ioremap_nocache(memory->start, state->map.size);
++ state->map.virt = ioremap_nocache(memory->start, state->win_size);
+ if (!state->map.virt)
+ return -ENOMEM;
+
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index a068b214ebaa..a594fb1e9a99 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -2063,6 +2063,10 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
+ nand_np = dev->of_node;
+ nfc_np = of_find_compatible_node(dev->of_node, NULL,
+ "atmel,sama5d3-nfc");
++ if (!nfc_np) {
++ dev_err(dev, "Could not find device node for sama5d3-nfc\n");
++ return -ENODEV;
++ }
+
+ nc->clk = of_clk_get(nfc_np, 0);
+ if (IS_ERR(nc->clk)) {
+diff --git a/drivers/mtd/nand/raw/denali.c b/drivers/mtd/nand/raw/denali.c
+index b864b93dd289..2242e999a76b 100644
+--- a/drivers/mtd/nand/raw/denali.c
++++ b/drivers/mtd/nand/raw/denali.c
+@@ -28,6 +28,7 @@
+ MODULE_LICENSE("GPL");
+
+ #define DENALI_NAND_NAME "denali-nand"
++#define DENALI_DEFAULT_OOB_SKIP_BYTES 8
+
+ /* for Indexed Addressing */
+ #define DENALI_INDEXED_CTRL 0x00
+@@ -1105,12 +1106,17 @@ static void denali_hw_init(struct denali_nand_info *denali)
+ denali->revision = swab16(ioread32(denali->reg + REVISION));
+
+ /*
+- * tell driver how many bit controller will skip before
+- * writing ECC code in OOB, this register may be already
+- * set by firmware. So we read this value out.
+- * if this value is 0, just let it be.
++ * Set how many bytes should be skipped before writing data in OOB.
++ * If a non-zero value has already been set (by firmware or something),
++ * just use it. Otherwise, set the driver default.
+ */
+ denali->oob_skip_bytes = ioread32(denali->reg + SPARE_AREA_SKIP_BYTES);
++ if (!denali->oob_skip_bytes) {
++ denali->oob_skip_bytes = DENALI_DEFAULT_OOB_SKIP_BYTES;
++ iowrite32(denali->oob_skip_bytes,
++ denali->reg + SPARE_AREA_SKIP_BYTES);
++ }
++
+ denali_detect_max_banks(denali);
+ iowrite32(0x0F, denali->reg + RB_PIN_ENABLED);
+ iowrite32(CHIP_EN_DONT_CARE__FLAG, denali->reg + CHIP_ENABLE_DONT_CARE);
+diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
+index bc2ef5209783..c7573ccdbacd 100644
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -686,7 +686,7 @@ static irqreturn_t marvell_nfc_isr(int irq, void *dev_id)
+
+ marvell_nfc_disable_int(nfc, st & NDCR_ALL_INT);
+
+- if (!(st & (NDSR_RDDREQ | NDSR_WRDREQ | NDSR_WRCMDREQ)))
++ if (st & (NDSR_RDY(0) | NDSR_RDY(1)))
+ complete(&nfc->complete);
+
+ return IRQ_HANDLED;
+diff --git a/drivers/mtd/spi-nor/fsl-quadspi.c b/drivers/mtd/spi-nor/fsl-quadspi.c
+index 7d9620c7ff6c..1ff3430f82c8 100644
+--- a/drivers/mtd/spi-nor/fsl-quadspi.c
++++ b/drivers/mtd/spi-nor/fsl-quadspi.c
+@@ -478,6 +478,7 @@ static int fsl_qspi_get_seqid(struct fsl_qspi *q, u8 cmd)
+ {
+ switch (cmd) {
+ case SPINOR_OP_READ_1_1_4:
++ case SPINOR_OP_READ_1_1_4_4B:
+ return SEQID_READ;
+ case SPINOR_OP_WREN:
+ return SEQID_WREN;
+@@ -543,6 +544,9 @@ fsl_qspi_runcmd(struct fsl_qspi *q, u8 cmd, unsigned int addr, int len)
+
+ /* trigger the LUT now */
+ seqid = fsl_qspi_get_seqid(q, cmd);
++ if (seqid < 0)
++ return seqid;
++
+ qspi_writel(q, (seqid << QUADSPI_IPCR_SEQID_SHIFT) | len,
+ base + QUADSPI_IPCR);
+
+@@ -671,7 +675,7 @@ static void fsl_qspi_set_map_addr(struct fsl_qspi *q)
+ * causes the controller to clear the buffer, and use the sequence pointed
+ * by the QUADSPI_BFGENCR[SEQID] to initiate a read from the flash.
+ */
+-static void fsl_qspi_init_ahb_read(struct fsl_qspi *q)
++static int fsl_qspi_init_ahb_read(struct fsl_qspi *q)
+ {
+ void __iomem *base = q->iobase;
+ int seqid;
+@@ -696,8 +700,13 @@ static void fsl_qspi_init_ahb_read(struct fsl_qspi *q)
+
+ /* Set the default lut sequence for AHB Read. */
+ seqid = fsl_qspi_get_seqid(q, q->nor[0].read_opcode);
++ if (seqid < 0)
++ return seqid;
++
+ qspi_writel(q, seqid << QUADSPI_BFGENCR_SEQID_SHIFT,
+ q->iobase + QUADSPI_BFGENCR);
++
++ return 0;
+ }
+
+ /* This function was used to prepare and enable QSPI clock */
+@@ -805,9 +814,7 @@ static int fsl_qspi_nor_setup_last(struct fsl_qspi *q)
+ fsl_qspi_init_lut(q);
+
+ /* Init for AHB read */
+- fsl_qspi_init_ahb_read(q);
+-
+- return 0;
++ return fsl_qspi_init_ahb_read(q);
+ }
+
+ static const struct of_device_id fsl_qspi_dt_ids[] = {
+diff --git a/drivers/mtd/spi-nor/intel-spi-pci.c b/drivers/mtd/spi-nor/intel-spi-pci.c
+index c0976f2e3dd1..872b40922608 100644
+--- a/drivers/mtd/spi-nor/intel-spi-pci.c
++++ b/drivers/mtd/spi-nor/intel-spi-pci.c
+@@ -65,6 +65,7 @@ static void intel_spi_pci_remove(struct pci_dev *pdev)
+ static const struct pci_device_id intel_spi_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x18e0), (unsigned long)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0x19e0), (unsigned long)&bxt_info },
++ { PCI_VDEVICE(INTEL, 0x34a4), (unsigned long)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0xa1a4), (unsigned long)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0xa224), (unsigned long)&bxt_info },
+ { },
+diff --git a/drivers/net/dsa/mv88e6xxx/phy.c b/drivers/net/dsa/mv88e6xxx/phy.c
+index 46af8052e535..152a65d46e0b 100644
+--- a/drivers/net/dsa/mv88e6xxx/phy.c
++++ b/drivers/net/dsa/mv88e6xxx/phy.c
+@@ -110,6 +110,9 @@ int mv88e6xxx_phy_page_write(struct mv88e6xxx_chip *chip, int phy,
+ err = mv88e6xxx_phy_page_get(chip, phy, page);
+ if (!err) {
+ err = mv88e6xxx_phy_write(chip, phy, MV88E6XXX_PHY_PAGE, page);
++ if (!err)
++ err = mv88e6xxx_phy_write(chip, phy, reg, val);
++
+ mv88e6xxx_phy_page_put(chip, phy);
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index 34af5f1569c8..de0e24d912fe 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -342,7 +342,7 @@ static struct device_node *bcmgenet_mii_of_find_mdio(struct bcmgenet_priv *priv)
+ if (!compat)
+ return NULL;
+
+- priv->mdio_dn = of_find_compatible_node(dn, NULL, compat);
++ priv->mdio_dn = of_get_compatible_child(dn, compat);
+ kfree(compat);
+ if (!priv->mdio_dn) {
+ dev_err(kdev, "unable to find MDIO bus node\n");
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 955c4ab18b03..b7b2f8254ce1 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1915,6 +1915,7 @@ static int is_valid_clean_head(struct hns3_enet_ring *ring, int h)
+ bool hns3_clean_tx_ring(struct hns3_enet_ring *ring, int budget)
+ {
+ struct net_device *netdev = ring->tqp->handle->kinfo.netdev;
++ struct hns3_nic_priv *priv = netdev_priv(netdev);
+ struct netdev_queue *dev_queue;
+ int bytes, pkts;
+ int head;
+@@ -1961,7 +1962,8 @@ bool hns3_clean_tx_ring(struct hns3_enet_ring *ring, int budget)
+ * sees the new next_to_clean.
+ */
+ smp_mb();
+- if (netif_tx_queue_stopped(dev_queue)) {
++ if (netif_tx_queue_stopped(dev_queue) &&
++ !test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) {
+ netif_tx_wake_queue(dev_queue);
+ ring->stats.restart_queue++;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+index f70ee6910ee2..9684ad015c42 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+@@ -309,7 +309,7 @@ static void hns3_self_test(struct net_device *ndev,
+ h->flags & HNAE3_SUPPORT_SERDES_LOOPBACK;
+
+ if (if_running)
+- dev_close(ndev);
++ ndev->netdev_ops->ndo_stop(ndev);
+
+ #if IS_ENABLED(CONFIG_VLAN_8021Q)
+ /* Disable the vlan filter for selftest does not support it */
+@@ -347,7 +347,7 @@ static void hns3_self_test(struct net_device *ndev,
+ #endif
+
+ if (if_running)
+- dev_open(ndev);
++ ndev->netdev_ops->ndo_open(ndev);
+ }
+
+ static int hns3_get_sset_count(struct net_device *netdev, int stringset)
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index f08ebb7caaaf..92f19384e258 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -73,6 +73,7 @@ static int hclge_ieee_getets(struct hnae3_handle *h, struct ieee_ets *ets)
+ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
+ u8 *tc, bool *changed)
+ {
++ bool has_ets_tc = false;
+ u32 total_ets_bw = 0;
+ u8 max_tc = 0;
+ u8 i;
+@@ -100,13 +101,14 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
+ *changed = true;
+
+ total_ets_bw += ets->tc_tx_bw[i];
+- break;
++ has_ets_tc = true;
++ break;
+ default:
+ return -EINVAL;
+ }
+ }
+
+- if (total_ets_bw != BW_PERCENT)
++ if (has_ets_tc && total_ets_bw != BW_PERCENT)
+ return -EINVAL;
+
+ *tc = max_tc + 1;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 8577dfc799ad..db763450e5e3 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -1657,11 +1657,13 @@ static int hclge_tx_buffer_calc(struct hclge_dev *hdev,
+ static int hclge_rx_buffer_calc(struct hclge_dev *hdev,
+ struct hclge_pkt_buf_alloc *buf_alloc)
+ {
+- u32 rx_all = hdev->pkt_buf_size;
++#define HCLGE_BUF_SIZE_UNIT 128
++ u32 rx_all = hdev->pkt_buf_size, aligned_mps;
+ int no_pfc_priv_num, pfc_priv_num;
+ struct hclge_priv_buf *priv;
+ int i;
+
++ aligned_mps = round_up(hdev->mps, HCLGE_BUF_SIZE_UNIT);
+ rx_all -= hclge_get_tx_buff_alloced(buf_alloc);
+
+ /* When DCB is not supported, rx private
+@@ -1680,13 +1682,13 @@ static int hclge_rx_buffer_calc(struct hclge_dev *hdev,
+ if (hdev->hw_tc_map & BIT(i)) {
+ priv->enable = 1;
+ if (hdev->tm_info.hw_pfc_map & BIT(i)) {
+- priv->wl.low = hdev->mps;
+- priv->wl.high = priv->wl.low + hdev->mps;
++ priv->wl.low = aligned_mps;
++ priv->wl.high = priv->wl.low + aligned_mps;
+ priv->buf_size = priv->wl.high +
+ HCLGE_DEFAULT_DV;
+ } else {
+ priv->wl.low = 0;
+- priv->wl.high = 2 * hdev->mps;
++ priv->wl.high = 2 * aligned_mps;
+ priv->buf_size = priv->wl.high;
+ }
+ } else {
+@@ -1718,11 +1720,11 @@ static int hclge_rx_buffer_calc(struct hclge_dev *hdev,
+
+ if (hdev->tm_info.hw_pfc_map & BIT(i)) {
+ priv->wl.low = 128;
+- priv->wl.high = priv->wl.low + hdev->mps;
++ priv->wl.high = priv->wl.low + aligned_mps;
+ priv->buf_size = priv->wl.high + HCLGE_DEFAULT_DV;
+ } else {
+ priv->wl.low = 0;
+- priv->wl.high = hdev->mps;
++ priv->wl.high = aligned_mps;
+ priv->buf_size = priv->wl.high;
+ }
+ }
+@@ -2360,6 +2362,9 @@ static int hclge_get_mac_phy_link(struct hclge_dev *hdev)
+ int mac_state;
+ int link_stat;
+
++ if (test_bit(HCLGE_STATE_DOWN, &hdev->state))
++ return 0;
++
+ mac_state = hclge_get_mac_link_status(hdev);
+
+ if (hdev->hw.mac.phydev) {
+@@ -3809,6 +3814,8 @@ static void hclge_ae_stop(struct hnae3_handle *handle)
+ struct hclge_dev *hdev = vport->back;
+ int i;
+
++ set_bit(HCLGE_STATE_DOWN, &hdev->state);
++
+ del_timer_sync(&hdev->service_timer);
+ cancel_work_sync(&hdev->service_task);
+ clear_bit(HCLGE_STATE_SERVICE_SCHED, &hdev->state);
+@@ -4686,9 +4693,17 @@ static int hclge_set_vf_vlan_common(struct hclge_dev *hdev, int vfid,
+ "Add vf vlan filter fail, ret =%d.\n",
+ req0->resp_code);
+ } else {
++#define HCLGE_VF_VLAN_DEL_NO_FOUND 1
+ if (!req0->resp_code)
+ return 0;
+
++ if (req0->resp_code == HCLGE_VF_VLAN_DEL_NO_FOUND) {
++ dev_warn(&hdev->pdev->dev,
++ "vlan %d filter is not in vf vlan table\n",
++ vlan);
++ return 0;
++ }
++
+ dev_err(&hdev->pdev->dev,
+ "Kill vf vlan filter fail, ret =%d.\n",
+ req0->resp_code);
+@@ -4732,6 +4747,9 @@ static int hclge_set_vlan_filter_hw(struct hclge_dev *hdev, __be16 proto,
+ u16 vport_idx, vport_num = 0;
+ int ret;
+
++ if (is_kill && !vlan_id)
++ return 0;
++
+ ret = hclge_set_vf_vlan_common(hdev, vport_id, is_kill, vlan_id,
+ 0, proto);
+ if (ret) {
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 9c0091f2addf..320043e87fc6 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -299,6 +299,9 @@ void hclgevf_update_link_status(struct hclgevf_dev *hdev, int link_state)
+
+ client = handle->client;
+
++ link_state =
++ test_bit(HCLGEVF_STATE_DOWN, &hdev->state) ? 0 : link_state;
++
+ if (link_state != hdev->hw.mac.link) {
+ client->ops->link_status_change(handle, !!link_state);
+ hdev->hw.mac.link = link_state;
+@@ -1448,6 +1451,8 @@ static void hclgevf_ae_stop(struct hnae3_handle *handle)
+ struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle);
+ int i, queue_id;
+
++ set_bit(HCLGEVF_STATE_DOWN, &hdev->state);
++
+ for (i = 0; i < hdev->num_tqps; i++) {
+ /* Ring disable */
+ queue_id = hclgevf_get_queue_id(handle->kinfo.tqp[i]);
+diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
+index 868f4a1d0f72..67591722c625 100644
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -39,9 +39,9 @@
+ extern const char ice_drv_ver[];
+ #define ICE_BAR0 0
+ #define ICE_DFLT_NUM_DESC 128
+-#define ICE_MIN_NUM_DESC 8
+-#define ICE_MAX_NUM_DESC 8160
+ #define ICE_REQ_DESC_MULTIPLE 32
++#define ICE_MIN_NUM_DESC ICE_REQ_DESC_MULTIPLE
++#define ICE_MAX_NUM_DESC 8160
+ #define ICE_DFLT_TRAFFIC_CLASS BIT(0)
+ #define ICE_INT_NAME_STR_LEN (IFNAMSIZ + 16)
+ #define ICE_ETHTOOL_FWVER_LEN 32
+diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c
+index 62be72fdc8f3..e783976c401d 100644
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
+@@ -518,22 +518,31 @@ shutdown_sq_out:
+
+ /**
+ * ice_aq_ver_check - Check the reported AQ API version.
+- * @fw_branch: The "branch" of FW, typically describes the device type
+- * @fw_major: The major version of the FW API
+- * @fw_minor: The minor version increment of the FW API
++ * @hw: pointer to the hardware structure
+ *
+ * Checks if the driver should load on a given AQ API version.
+ *
+ * Return: 'true' iff the driver should attempt to load. 'false' otherwise.
+ */
+-static bool ice_aq_ver_check(u8 fw_branch, u8 fw_major, u8 fw_minor)
++static bool ice_aq_ver_check(struct ice_hw *hw)
+ {
+- if (fw_branch != EXP_FW_API_VER_BRANCH)
+- return false;
+- if (fw_major != EXP_FW_API_VER_MAJOR)
+- return false;
+- if (fw_minor != EXP_FW_API_VER_MINOR)
++ if (hw->api_maj_ver > EXP_FW_API_VER_MAJOR) {
++ /* Major API version is newer than expected, don't load */
++ dev_warn(ice_hw_to_dev(hw),
++ "The driver for the device stopped because the NVM image is newer than expected. You must install the most recent version of the network driver.\n");
+ return false;
++ } else if (hw->api_maj_ver == EXP_FW_API_VER_MAJOR) {
++ if (hw->api_min_ver > (EXP_FW_API_VER_MINOR + 2))
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected a newer version of the NVM image than expected. Please install the most recent version of the network driver.\n");
++ else if ((hw->api_min_ver + 2) < EXP_FW_API_VER_MINOR)
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected an older version of the NVM image than expected. Please update the NVM image.\n");
++ } else {
++ /* Major API version is older than expected, log a warning */
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected an older version of the NVM image than expected. Please update the NVM image.\n");
++ }
+ return true;
+ }
+
+@@ -588,8 +597,7 @@ static enum ice_status ice_init_check_adminq(struct ice_hw *hw)
+ if (status)
+ goto init_ctrlq_free_rq;
+
+- if (!ice_aq_ver_check(hw->api_branch, hw->api_maj_ver,
+- hw->api_min_ver)) {
++ if (!ice_aq_ver_check(hw)) {
+ status = ICE_ERR_FW_API_VER;
+ goto init_ctrlq_free_rq;
+ }
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index c71a9b528d6d..9d6754f65a1a 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -478,9 +478,11 @@ ice_get_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
+ ring->tx_max_pending = ICE_MAX_NUM_DESC;
+ ring->rx_pending = vsi->rx_rings[0]->count;
+ ring->tx_pending = vsi->tx_rings[0]->count;
+- ring->rx_mini_pending = ICE_MIN_NUM_DESC;
++
++ /* Rx mini and jumbo rings are not supported */
+ ring->rx_mini_max_pending = 0;
+ ring->rx_jumbo_max_pending = 0;
++ ring->rx_mini_pending = 0;
+ ring->rx_jumbo_pending = 0;
+ }
+
+@@ -498,14 +500,23 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
+ ring->tx_pending < ICE_MIN_NUM_DESC ||
+ ring->rx_pending > ICE_MAX_NUM_DESC ||
+ ring->rx_pending < ICE_MIN_NUM_DESC) {
+- netdev_err(netdev, "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d]\n",
++ netdev_err(netdev, "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d] (increment %d)\n",
+ ring->tx_pending, ring->rx_pending,
+- ICE_MIN_NUM_DESC, ICE_MAX_NUM_DESC);
++ ICE_MIN_NUM_DESC, ICE_MAX_NUM_DESC,
++ ICE_REQ_DESC_MULTIPLE);
+ return -EINVAL;
+ }
+
+ new_tx_cnt = ALIGN(ring->tx_pending, ICE_REQ_DESC_MULTIPLE);
++ if (new_tx_cnt != ring->tx_pending)
++ netdev_info(netdev,
++ "Requested Tx descriptor count rounded up to %d\n",
++ new_tx_cnt);
+ new_rx_cnt = ALIGN(ring->rx_pending, ICE_REQ_DESC_MULTIPLE);
++ if (new_rx_cnt != ring->rx_pending)
++ netdev_info(netdev,
++ "Requested Rx descriptor count rounded up to %d\n",
++ new_rx_cnt);
+
+ /* if nothing to do return success */
+ if (new_tx_cnt == vsi->tx_rings[0]->count &&
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+index da4322e4daed..add124e0381d 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -676,6 +676,9 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs)
+ } else {
+ struct tx_sa tsa;
+
++ if (adapter->num_vfs)
++ return -EOPNOTSUPP;
++
+ /* find the first unused index */
+ ret = ixgbe_ipsec_find_empty_idx(ipsec, false);
+ if (ret < 0) {
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 5a228582423b..4093a9c52c18 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -3849,6 +3849,10 @@ static void ixgbevf_tx_csum(struct ixgbevf_ring *tx_ring,
+ skb_checksum_help(skb);
+ goto no_csum;
+ }
++
++ if (first->protocol == htons(ETH_P_IP))
++ type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4;
++
+ /* update TX checksum flag */
+ first->tx_flags |= IXGBE_TX_FLAGS_CSUM;
+ vlan_macip_lens = skb_checksum_start_offset(skb) -
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
+index db463e20a876..e9a4179e7e48 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
+@@ -96,6 +96,7 @@ nfp_devlink_port_split(struct devlink *devlink, unsigned int port_index,
+ {
+ struct nfp_pf *pf = devlink_priv(devlink);
+ struct nfp_eth_table_port eth_port;
++ unsigned int lanes;
+ int ret;
+
+ if (count < 2)
+@@ -114,8 +115,12 @@ nfp_devlink_port_split(struct devlink *devlink, unsigned int port_index,
+ goto out;
+ }
+
+- ret = nfp_devlink_set_lanes(pf, eth_port.index,
+- eth_port.port_lanes / count);
++ /* Special case the 100G CXP -> 2x40G split */
++ lanes = eth_port.port_lanes / count;
++ if (eth_port.lanes == 10 && count == 2)
++ lanes = 8 / count;
++
++ ret = nfp_devlink_set_lanes(pf, eth_port.index, lanes);
+ out:
+ mutex_unlock(&pf->lock);
+
+@@ -128,6 +133,7 @@ nfp_devlink_port_unsplit(struct devlink *devlink, unsigned int port_index,
+ {
+ struct nfp_pf *pf = devlink_priv(devlink);
+ struct nfp_eth_table_port eth_port;
++ unsigned int lanes;
+ int ret;
+
+ mutex_lock(&pf->lock);
+@@ -143,7 +149,12 @@ nfp_devlink_port_unsplit(struct devlink *devlink, unsigned int port_index,
+ goto out;
+ }
+
+- ret = nfp_devlink_set_lanes(pf, eth_port.index, eth_port.port_lanes);
++ /* Special case the 100G CXP -> 2x40G unsplit */
++ lanes = eth_port.port_lanes;
++ if (eth_port.port_lanes == 8)
++ lanes = 10;
++
++ ret = nfp_devlink_set_lanes(pf, eth_port.index, lanes);
+ out:
+ mutex_unlock(&pf->lock);
+
+diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
+index 4289ccb26e4e..d2caeb9edc04 100644
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -940,6 +940,9 @@ static void netsec_uninit_pkt_dring(struct netsec_priv *priv, int id)
+ dring->head = 0;
+ dring->tail = 0;
+ dring->pkt_cnt = 0;
++
++ if (id == NETSEC_RING_TX)
++ netdev_reset_queue(priv->ndev);
+ }
+
+ static void netsec_free_dring(struct netsec_priv *priv, int id)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index f9a61f90cfbc..0f660af01a4b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -714,8 +714,9 @@ static int get_ephy_nodes(struct stmmac_priv *priv)
+ return -ENODEV;
+ }
+
+- mdio_internal = of_find_compatible_node(mdio_mux, NULL,
++ mdio_internal = of_get_compatible_child(mdio_mux,
+ "allwinner,sun8i-h3-mdio-internal");
++ of_node_put(mdio_mux);
+ if (!mdio_internal) {
+ dev_err(priv->device, "Cannot get internal_mdio node\n");
+ return -ENODEV;
+@@ -729,13 +730,20 @@ static int get_ephy_nodes(struct stmmac_priv *priv)
+ gmac->rst_ephy = of_reset_control_get_exclusive(iphynode, NULL);
+ if (IS_ERR(gmac->rst_ephy)) {
+ ret = PTR_ERR(gmac->rst_ephy);
+- if (ret == -EPROBE_DEFER)
++ if (ret == -EPROBE_DEFER) {
++ of_node_put(iphynode);
++ of_node_put(mdio_internal);
+ return ret;
++ }
+ continue;
+ }
+ dev_info(priv->device, "Found internal PHY node\n");
++ of_node_put(iphynode);
++ of_node_put(mdio_internal);
+ return 0;
+ }
++
++ of_node_put(mdio_internal);
+ return -ENODEV;
+ }
+
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 3af6d8d15233..1c37a821895b 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -2022,14 +2022,15 @@ static void netvsc_vf_setup(struct work_struct *w)
+ rtnl_unlock();
+ }
+
+-/* Find netvsc by VMBus serial number.
+- * The PCI hyperv controller records the serial number as the slot.
++/* Find netvsc by VF serial number.
++ * The PCI hyperv controller records the serial number as the slot kobj name.
+ */
+ static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
+ {
+ struct device *parent = vf_netdev->dev.parent;
+ struct net_device_context *ndev_ctx;
+ struct pci_dev *pdev;
++ u32 serial;
+
+ if (!parent || !dev_is_pci(parent))
+ return NULL; /* not a PCI device */
+@@ -2040,16 +2041,22 @@ static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
+ return NULL;
+ }
+
++ if (kstrtou32(pci_slot_name(pdev->slot), 10, &serial)) {
++ netdev_notice(vf_netdev, "Invalid vf serial:%s\n",
++ pci_slot_name(pdev->slot));
++ return NULL;
++ }
++
+ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
+ if (!ndev_ctx->vf_alloc)
+ continue;
+
+- if (ndev_ctx->vf_serial == pdev->slot->number)
++ if (ndev_ctx->vf_serial == serial)
+ return hv_get_drvdata(ndev_ctx->device_ctx);
+ }
+
+ netdev_notice(vf_netdev,
+- "no netdev found for slot %u\n", pdev->slot->number);
++ "no netdev found for vf serial:%u\n", serial);
+ return NULL;
+ }
+
+diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
+index 30612497643c..d192936b76cf 100644
+--- a/drivers/net/loopback.c
++++ b/drivers/net/loopback.c
+@@ -75,6 +75,10 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
+ int len;
+
+ skb_tx_timestamp(skb);
++
++ /* do not fool net_timestamp_check() with various clock bases */
++ skb->tstamp = 0;
++
+ skb_orphan(skb);
+
+ /* Before queueing this packet to netif_rx(),
+diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c
+index 7ae1856d1f18..5a749dc25bec 100644
+--- a/drivers/net/net_failover.c
++++ b/drivers/net/net_failover.c
+@@ -603,6 +603,9 @@ static int net_failover_slave_unregister(struct net_device *slave_dev,
+ primary_dev = rtnl_dereference(nfo_info->primary_dev);
+ standby_dev = rtnl_dereference(nfo_info->standby_dev);
+
++ if (WARN_ON_ONCE(slave_dev != primary_dev && slave_dev != standby_dev))
++ return -ENODEV;
++
+ vlan_vids_del_by_dev(slave_dev, failover_dev);
+ dev_uc_unsync(slave_dev, failover_dev);
+ dev_mc_unsync(slave_dev, failover_dev);
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 7abca86c3aa9..70f3f90c2ed6 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -907,6 +907,9 @@ void phylink_start(struct phylink *pl)
+ phylink_an_mode_str(pl->link_an_mode),
+ phy_modes(pl->link_config.interface));
+
++ /* Always set the carrier off */
++ netif_carrier_off(pl->netdev);
++
+ /* Apply the link configuration to the MAC when starting. This allows
+ * a fixed-link to start with the correct parameters, and also
+ * ensures that we set the appropriate advertisement for Serdes links.
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 50e9cc19023a..c52207beef88 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -2264,6 +2264,8 @@ static void tun_setup(struct net_device *dev)
+ static int tun_validate(struct nlattr *tb[], struct nlattr *data[],
+ struct netlink_ext_ack *extack)
+ {
++ if (!data)
++ return 0;
+ return -EINVAL;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index fd612d2905b0..9f31b9a10850 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1869,6 +1869,12 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
+ if (ret)
+ dev_kfree_skb_any(skb);
+
++ if (ret == -EAGAIN) {
++ ath10k_warn(ar, "wmi command %d timeout, restarting hardware\n",
++ cmd_id);
++ queue_work(ar->workqueue, &ar->restart_work);
++ }
++
+ return ret;
+ }
+
+@@ -2336,7 +2342,12 @@ static int wmi_process_mgmt_tx_comp(struct ath10k *ar, u32 desc_id,
+ dma_unmap_single(ar->dev, pkt_addr->paddr,
+ msdu->len, DMA_FROM_DEVICE);
+ info = IEEE80211_SKB_CB(msdu);
+- info->flags |= status;
++
++ if (status)
++ info->flags &= ~IEEE80211_TX_STAT_ACK;
++ else
++ info->flags |= IEEE80211_TX_STAT_ACK;
++
+ ieee80211_tx_status_irqsafe(ar->hw, msdu);
+
+ ret = 0;
+diff --git a/drivers/net/wireless/ath/wil6210/txrx_edma.c b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+index bca61cb44c37..3e7fc2983cbb 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx_edma.c
++++ b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+@@ -279,9 +279,6 @@ static void wil_move_all_rx_buff_to_free_list(struct wil6210_priv *wil,
+ u16 buff_id;
+
+ *d = *_d;
+- pa = wil_rx_desc_get_addr_edma(&d->dma);
+- dmalen = le16_to_cpu(d->dma.length);
+- dma_unmap_single(dev, pa, dmalen, DMA_FROM_DEVICE);
+
+ /* Extract the SKB from the rx_buff management array */
+ buff_id = __le16_to_cpu(d->mac.buff_id);
+@@ -291,10 +288,15 @@ static void wil_move_all_rx_buff_to_free_list(struct wil6210_priv *wil,
+ }
+ skb = wil->rx_buff_mgmt.buff_arr[buff_id].skb;
+ wil->rx_buff_mgmt.buff_arr[buff_id].skb = NULL;
+- if (unlikely(!skb))
++ if (unlikely(!skb)) {
+ wil_err(wil, "No Rx skb at buff_id %d\n", buff_id);
+- else
++ } else {
++ pa = wil_rx_desc_get_addr_edma(&d->dma);
++ dmalen = le16_to_cpu(d->dma.length);
++ dma_unmap_single(dev, pa, dmalen, DMA_FROM_DEVICE);
++
+ kfree_skb(skb);
++ }
+
+ /* Move the buffer from the active to the free list */
+ list_move(&wil->rx_buff_mgmt.buff_arr[buff_id].list,
+@@ -906,6 +908,9 @@ again:
+ wil->rx_buff_mgmt.buff_arr[buff_id].skb = NULL;
+ if (!skb) {
+ wil_err(wil, "No Rx skb at buff_id %d\n", buff_id);
++ /* Move the buffer from the active list to the free list */
++ list_move(&wil->rx_buff_mgmt.buff_arr[buff_id].list,
++ &wil->rx_buff_mgmt.free);
+ goto again;
+ }
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+index d8b79cb72b58..e7584b842dce 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -77,6 +77,8 @@ static u16 d11ac_bw(enum brcmu_chan_bw bw)
+ return BRCMU_CHSPEC_D11AC_BW_40;
+ case BRCMU_CHAN_BW_80:
+ return BRCMU_CHSPEC_D11AC_BW_80;
++ case BRCMU_CHAN_BW_160:
++ return BRCMU_CHSPEC_D11AC_BW_160;
+ default:
+ WARN_ON(1);
+ }
+@@ -190,8 +192,38 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
+ break;
+ }
+ break;
+- case BRCMU_CHSPEC_D11AC_BW_8080:
+ case BRCMU_CHSPEC_D11AC_BW_160:
++ switch (ch->sb) {
++ case BRCMU_CHAN_SB_LLL:
++ ch->control_ch_num -= CH_70MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LLU:
++ ch->control_ch_num -= CH_50MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LUL:
++ ch->control_ch_num -= CH_30MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LUU:
++ ch->control_ch_num -= CH_10MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_ULL:
++ ch->control_ch_num += CH_10MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_ULU:
++ ch->control_ch_num += CH_30MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_UUL:
++ ch->control_ch_num += CH_50MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_UUU:
++ ch->control_ch_num += CH_70MHZ_APART;
++ break;
++ default:
++ WARN_ON_ONCE(1);
++ break;
++ }
++ break;
++ case BRCMU_CHSPEC_D11AC_BW_8080:
+ default:
+ WARN_ON_ONCE(1);
+ break;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+index 7b9a77981df1..75b2a0438cfa 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+@@ -29,6 +29,8 @@
+ #define CH_UPPER_SB 0x01
+ #define CH_LOWER_SB 0x02
+ #define CH_EWA_VALID 0x04
++#define CH_70MHZ_APART 14
++#define CH_50MHZ_APART 10
+ #define CH_30MHZ_APART 6
+ #define CH_20MHZ_APART 4
+ #define CH_10MHZ_APART 2
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 6bb1a99a197a..48a3611d6a31 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -704,8 +704,12 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
+ enabled = !!(wifi_pkg->package.elements[1].integer.value);
+ n_profiles = wifi_pkg->package.elements[2].integer.value;
+
+- /* in case of BIOS bug */
+- if (n_profiles <= 0) {
++ /*
++ * Check the validity of n_profiles. The EWRD profiles start
++ * from index 1, so the maximum value allowed here is
++ * ACPI_SAR_PROFILES_NUM - 1.
++ */
++ if (n_profiles <= 0 || n_profiles >= ACPI_SAR_PROFILE_NUM) {
+ ret = -EINVAL;
+ goto out_free;
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index b15b0d84bb7e..155cc2ac0120 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -1233,12 +1233,15 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
+ iwl_mvm_del_aux_sta(mvm);
+
+ /*
+- * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete()
+- * won't be called in this case).
++ * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the
++ * hw (as restart_complete() won't be called in this case) and mac80211
++ * won't execute the restart.
+ * But make sure to cleanup interfaces that have gone down before/during
+ * HW restart was requested.
+ */
+- if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
++ if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
++ test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
++ &mvm->status))
+ ieee80211_iterate_interfaces(mvm->hw, 0,
+ iwl_mvm_cleanup_iterator, mvm);
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+index 30cfd7d50bc9..f2830b5693d2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+@@ -1239,7 +1239,11 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ !(info->flags & IEEE80211_TX_STAT_AMPDU))
+ return;
+
+- rs_rate_from_ucode_rate(tx_resp_hwrate, info->band, &tx_resp_rate);
++ if (rs_rate_from_ucode_rate(tx_resp_hwrate, info->band,
++ &tx_resp_rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
+
+ #ifdef CONFIG_MAC80211_DEBUGFS
+ /* Disable last tx check if we are debugging with fixed rate but
+@@ -1290,7 +1294,10 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ */
+ table = &lq_sta->lq;
+ lq_hwrate = le32_to_cpu(table->rs_table[0]);
+- rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate);
++ if (rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
+
+ /* Here we actually compare this rate to the latest LQ command */
+ if (lq_color != LQ_FLAG_COLOR_GET(table->flags)) {
+@@ -1392,8 +1399,12 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ /* Collect data for each rate used during failed TX attempts */
+ for (i = 0; i <= retries; ++i) {
+ lq_hwrate = le32_to_cpu(table->rs_table[i]);
+- rs_rate_from_ucode_rate(lq_hwrate, info->band,
+- &lq_rate);
++ if (rs_rate_from_ucode_rate(lq_hwrate, info->band,
++ &lq_rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
++
+ /*
+ * Only collect stats if retried rate is in the same RS
+ * table as active/search.
+@@ -3262,7 +3273,10 @@ static void rs_build_rates_table_from_fixed(struct iwl_mvm *mvm,
+ for (i = 0; i < num_rates; i++)
+ lq_cmd->rs_table[i] = ucode_rate_le32;
+
+- rs_rate_from_ucode_rate(ucode_rate, band, &rate);
++ if (rs_rate_from_ucode_rate(ucode_rate, band, &rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
+
+ if (is_mimo(&rate))
+ lq_cmd->mimo_delim = num_rates - 1;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index ff193dca2020..2d21f0a1fa00 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -1405,6 +1405,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ while (!skb_queue_empty(&skbs)) {
+ struct sk_buff *skb = __skb_dequeue(&skbs);
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++ struct ieee80211_hdr *hdr = (void *)skb->data;
+ bool flushed = false;
+
+ skb_freed++;
+@@ -1449,11 +1450,11 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
+ info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
+- /* W/A FW bug: seq_ctl is wrong when the status isn't success */
+- if (status != TX_STATUS_SUCCESS) {
+- struct ieee80211_hdr *hdr = (void *)skb->data;
++ /* W/A FW bug: seq_ctl is wrong upon failure / BAR frame */
++ if (ieee80211_is_back_req(hdr->frame_control))
++ seq_ctl = 0;
++ else if (status != TX_STATUS_SUCCESS)
+ seq_ctl = le16_to_cpu(hdr->seq_ctrl);
+- }
+
+ if (unlikely(!seq_ctl)) {
+ struct ieee80211_hdr *hdr = (void *)skb->data;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index d017aa2a0a8b..d4a31e014c82 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1144,6 +1144,14 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
+ kfree(trans_pcie->rxq);
+ }
+
++static void iwl_pcie_rx_move_to_allocator(struct iwl_rxq *rxq,
++ struct iwl_rb_allocator *rba)
++{
++ spin_lock(&rba->lock);
++ list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
++ spin_unlock(&rba->lock);
++}
++
+ /*
+ * iwl_pcie_rx_reuse_rbd - Recycle used RBDs
+ *
+@@ -1175,9 +1183,7 @@ static void iwl_pcie_rx_reuse_rbd(struct iwl_trans *trans,
+ if ((rxq->used_count % RX_CLAIM_REQ_ALLOC) == RX_POST_REQ_ALLOC) {
+ /* Move the 2 RBDs to the allocator ownership.
+ Allocator has another 6 from pool for the request completion*/
+- spin_lock(&rba->lock);
+- list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
+- spin_unlock(&rba->lock);
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+
+ atomic_inc(&rba->req_pending);
+ queue_work(rba->alloc_wq, &rba->rx_alloc);
+@@ -1396,10 +1402,18 @@ restart:
+ IWL_DEBUG_RX(trans, "Q %d: HW = SW = %d\n", rxq->id, r);
+
+ while (i != r) {
++ struct iwl_rb_allocator *rba = &trans_pcie->rba;
+ struct iwl_rx_mem_buffer *rxb;
+-
+- if (unlikely(rxq->used_count == rxq->queue_size / 2))
++ /* number of RBDs still waiting for page allocation */
++ u32 rb_pending_alloc =
++ atomic_read(&trans_pcie->rba.req_pending) *
++ RX_CLAIM_REQ_ALLOC;
++
++ if (unlikely(rb_pending_alloc >= rxq->queue_size / 2 &&
++ !emergency)) {
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+ emergency = true;
++ }
+
+ rxb = iwl_pcie_get_rxb(trans, rxq, i);
+ if (!rxb)
+@@ -1421,17 +1435,13 @@ restart:
+ iwl_pcie_rx_allocator_get(trans, rxq);
+
+ if (rxq->used_count % RX_CLAIM_REQ_ALLOC == 0 && !emergency) {
+- struct iwl_rb_allocator *rba = &trans_pcie->rba;
+-
+ /* Add the remaining empty RBDs for allocator use */
+- spin_lock(&rba->lock);
+- list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
+- spin_unlock(&rba->lock);
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+ } else if (emergency) {
+ count++;
+ if (count == 8) {
+ count = 0;
+- if (rxq->used_count < rxq->queue_size / 3)
++ if (rb_pending_alloc < rxq->queue_size / 3)
+ emergency = false;
+
+ rxq->read = i;
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index c67a8e7be310..3dbfce972c56 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -456,8 +456,6 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
+ MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn,
+ cardp);
+
+- cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET;
+-
+ lbs_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n", cardp->rx_urb);
+ if ((ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC))) {
+ lbs_deb_usbd(&cardp->udev->dev, "Submit Rx URB failed: %d\n", ret);
+diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+index e92fc5001171..789337ea676a 100644
+--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+@@ -605,9 +605,10 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
+ {
+ unsigned long flags;
+
+- if (recvlength > LBS_CMD_BUFFER_SIZE) {
++ if (recvlength < MESSAGE_HEADER_LEN ||
++ recvlength > LBS_CMD_BUFFER_SIZE) {
+ lbtf_deb_usbd(&cardp->udev->dev,
+- "The receive buffer is too large\n");
++ "The receive buffer is invalid: %d\n", recvlength);
+ kfree_skb(skb);
+ return;
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
+index 23cf437d14f9..1a49d1be042d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
+@@ -128,8 +128,7 @@ __mt76x2_mac_set_beacon(struct mt76x2_dev *dev, u8 bcn_idx, struct sk_buff *skb)
+ if (skb) {
+ ret = mt76_write_beacon(dev, beacon_addr, skb);
+ if (!ret)
+- dev->beacon_data_mask |= BIT(bcn_idx) &
+- dev->beacon_mask;
++ dev->beacon_data_mask |= BIT(bcn_idx);
+ } else {
+ dev->beacon_data_mask &= ~BIT(bcn_idx);
+ for (i = 0; i < beacon_len; i += 4)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2_usb.c
+index 1428cfdee579..9594433234cc 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_usb.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_usb.c
+@@ -107,16 +107,24 @@ static int __maybe_unused mt76x2u_resume(struct usb_interface *intf)
+ mt76u_mcu_complete_urb,
+ &usb->mcu.cmpl);
+ if (err < 0)
+- return err;
++ goto err;
+
+ err = mt76u_submit_rx_buffers(&dev->mt76);
+ if (err < 0)
+- return err;
++ goto err;
+
+ tasklet_enable(&usb->rx_tasklet);
+ tasklet_enable(&usb->tx_tasklet);
+
+- return mt76x2u_init_hardware(dev);
++ err = mt76x2u_init_hardware(dev);
++ if (err < 0)
++ goto err;
++
++ return 0;
++
++err:
++ mt76x2u_cleanup(dev);
++ return err;
+ }
+
+ MODULE_DEVICE_TABLE(usb, mt76x2u_device_table);
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index c0a163e40402..f360690396dd 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -266,15 +266,17 @@ static void rsi_rx_done_handler(struct urb *urb)
+ if (urb->status)
+ goto out;
+
+- if (urb->actual_length <= 0) {
+- rsi_dbg(INFO_ZONE, "%s: Zero length packet\n", __func__);
++ if (urb->actual_length <= 0 ||
++ urb->actual_length > rx_cb->rx_skb->len) {
++ rsi_dbg(INFO_ZONE, "%s: Invalid packet length = %d\n",
++ __func__, urb->actual_length);
+ goto out;
+ }
+ if (skb_queue_len(&dev->rx_q) >= RSI_MAX_RX_PKTS) {
+ rsi_dbg(INFO_ZONE, "Max RX packets reached\n");
+ goto out;
+ }
+- skb_put(rx_cb->rx_skb, urb->actual_length);
++ skb_trim(rx_cb->rx_skb, urb->actual_length);
+ skb_queue_tail(&dev->rx_q, rx_cb->rx_skb);
+
+ rsi_set_event(&dev->rx_thread.event);
+@@ -308,6 +310,7 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num)
+ if (!skb)
+ return -ENOMEM;
+ skb_reserve(skb, MAX_DWORD_ALIGN_BYTES);
++ skb_put(skb, RSI_MAX_RX_USB_PKT_SIZE - MAX_DWORD_ALIGN_BYTES);
+ dword_align_bytes = (unsigned long)skb->data & 0x3f;
+ if (dword_align_bytes > 0)
+ skb_push(skb, dword_align_bytes);
+@@ -319,7 +322,7 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num)
+ usb_rcvbulkpipe(dev->usbdev,
+ dev->bulkin_endpoint_addr[ep_num - 1]),
+ urb->transfer_buffer,
+- RSI_MAX_RX_USB_PKT_SIZE,
++ skb->len,
+ rsi_rx_done_handler,
+ rx_cb);
+
+diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
+index 89b0d0fade9f..19e3c5a0b715 100644
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -957,6 +957,8 @@ static void wl1271_recovery_work(struct work_struct *work)
+ BUG_ON(wl->conf.recovery.bug_on_recovery &&
+ !test_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags));
+
++ clear_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags);
++
+ if (wl->conf.recovery.no_recovery) {
+ wl1271_info("No recovery (chosen on module load). Fw will remain stuck.");
+ goto out_unlock;
+@@ -6710,6 +6712,7 @@ static int __maybe_unused wlcore_runtime_resume(struct device *dev)
+ int ret;
+ unsigned long start_time = jiffies;
+ bool pending = false;
++ bool recovery = false;
+
+ /* Nothing to do if no ELP mode requested */
+ if (!test_bit(WL1271_FLAG_IN_ELP, &wl->flags))
+@@ -6726,7 +6729,7 @@ static int __maybe_unused wlcore_runtime_resume(struct device *dev)
+
+ ret = wlcore_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG, ELPCTRL_WAKE_UP);
+ if (ret < 0) {
+- wl12xx_queue_recovery_work(wl);
++ recovery = true;
+ goto err;
+ }
+
+@@ -6734,11 +6737,12 @@ static int __maybe_unused wlcore_runtime_resume(struct device *dev)
+ ret = wait_for_completion_timeout(&compl,
+ msecs_to_jiffies(WL1271_WAKEUP_TIMEOUT));
+ if (ret == 0) {
+- wl1271_error("ELP wakeup timeout!");
+- wl12xx_queue_recovery_work(wl);
++ wl1271_warning("ELP wakeup timeout!");
+
+ /* Return no error for runtime PM for recovery */
+- return 0;
++ ret = 0;
++ recovery = true;
++ goto err;
+ }
+ }
+
+@@ -6753,6 +6757,12 @@ err:
+ spin_lock_irqsave(&wl->wl_lock, flags);
+ wl->elp_compl = NULL;
+ spin_unlock_irqrestore(&wl->wl_lock, flags);
++
++ if (recovery) {
++ set_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags);
++ wl12xx_queue_recovery_work(wl);
++ }
++
+ return ret;
+ }
+
+diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c
+index 91162f8e0366..9a22056e8d9e 100644
+--- a/drivers/nfc/nfcmrvl/uart.c
++++ b/drivers/nfc/nfcmrvl/uart.c
+@@ -73,10 +73,9 @@ static int nfcmrvl_uart_parse_dt(struct device_node *node,
+ struct device_node *matched_node;
+ int ret;
+
+- matched_node = of_find_compatible_node(node, NULL, "marvell,nfc-uart");
++ matched_node = of_get_compatible_child(node, "marvell,nfc-uart");
+ if (!matched_node) {
+- matched_node = of_find_compatible_node(node, NULL,
+- "mrvl,nfc-uart");
++ matched_node = of_get_compatible_child(node, "mrvl,nfc-uart");
+ if (!matched_node)
+ return -ENODEV;
+ }
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 8aae6dcc839f..9148015ed803 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -488,6 +488,8 @@ static void nd_async_device_register(void *d, async_cookie_t cookie)
+ put_device(dev);
+ }
+ put_device(dev);
++ if (dev->parent)
++ put_device(dev->parent);
+ }
+
+ static void nd_async_device_unregister(void *d, async_cookie_t cookie)
+@@ -507,6 +509,8 @@ void __nd_device_register(struct device *dev)
+ if (!dev)
+ return;
+ dev->bus = &nvdimm_bus_type;
++ if (dev->parent)
++ get_device(dev->parent);
+ get_device(dev);
+ async_schedule_domain(nd_async_device_register, dev,
+ &nd_async_domain);
+diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
+index 6071e2942053..2082ae01b9c8 100644
+--- a/drivers/nvdimm/pmem.c
++++ b/drivers/nvdimm/pmem.c
+@@ -421,9 +421,11 @@ static int pmem_attach_disk(struct device *dev,
+ addr = devm_memremap_pages(dev, &pmem->pgmap);
+ pmem->pfn_flags |= PFN_MAP;
+ memcpy(&bb_res, &pmem->pgmap.res, sizeof(bb_res));
+- } else
++ } else {
+ addr = devm_memremap(dev, pmem->phys_addr,
+ pmem->size, ARCH_MEMREMAP_PMEM);
++ memcpy(&bb_res, &nsio->res, sizeof(bb_res));
++ }
+
+ /*
+ * At release time the queue must be frozen before
+diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
+index fa37afcd43ff..174a418cb171 100644
+--- a/drivers/nvdimm/region_devs.c
++++ b/drivers/nvdimm/region_devs.c
+@@ -560,10 +560,17 @@ static ssize_t region_badblocks_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ struct nd_region *nd_region = to_nd_region(dev);
++ ssize_t rc;
+
+- return badblocks_show(&nd_region->bb, buf, 0);
+-}
++ device_lock(dev);
++ if (dev->driver)
++ rc = badblocks_show(&nd_region->bb, buf, 0);
++ else
++ rc = -ENXIO;
++ device_unlock(dev);
+
++ return rc;
++}
+ static DEVICE_ATTR(badblocks, 0444, region_badblocks_show, NULL);
+
+ static ssize_t resource_show(struct device *dev,
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index 206d63cb1afc..bcd09d3a44da 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -552,8 +552,11 @@ blk_status_t nvmf_fail_nonready_command(struct nvme_ctrl *ctrl,
+ ctrl->state != NVME_CTRL_DEAD &&
+ !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH))
+ return BLK_STS_RESOURCE;
+- nvme_req(rq)->status = NVME_SC_ABORT_REQ;
+- return BLK_STS_IOERR;
++
++ nvme_req(rq)->status = NVME_SC_HOST_PATH_ERROR;
++ blk_mq_start_request(rq);
++ nvme_complete_rq(rq);
++ return BLK_STS_OK;
+ }
+ EXPORT_SYMBOL_GPL(nvmf_fail_nonready_command);
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 9fe3fff818b8..b71c9ad1bf45 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -77,6 +77,13 @@ void nvme_failover_req(struct request *req)
+ queue_work(nvme_wq, &ns->ctrl->ana_work);
+ }
+ break;
++ case NVME_SC_HOST_PATH_ERROR:
++ /*
++ * Temporary transport disruption in talking to the controller.
++ * Try to send on a new path.
++ */
++ nvme_mpath_clear_current_path(ns);
++ break;
+ default:
+ /*
+ * Reset the controller for any non-ANA error as we don't know
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index aa1657831b70..7c530c88b3fb 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -516,11 +516,17 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config)
+ goto err_device_del;
+ }
+
+- if (config->cells)
+- nvmem_add_cells(nvmem, config->cells, config->ncells);
++ if (config->cells) {
++ rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
++ if (rval)
++ goto err_teardown_compat;
++ }
+
+ return nvmem;
+
++err_teardown_compat:
++ if (config->compat)
++ device_remove_bin_file(nvmem->base_dev, &nvmem->eeprom);
+ err_device_del:
+ device_del(&nvmem->dev);
+ err_put_device:
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 74eaedd5b860..70f5fd08891b 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -67,6 +67,7 @@ bool of_node_name_eq(const struct device_node *np, const char *name)
+
+ return (strlen(name) == len) && (strncmp(node_name, name, len) == 0);
+ }
++EXPORT_SYMBOL(of_node_name_eq);
+
+ bool of_node_name_prefix(const struct device_node *np, const char *prefix)
+ {
+@@ -75,6 +76,7 @@ bool of_node_name_prefix(const struct device_node *np, const char *prefix)
+
+ return strncmp(kbasename(np->full_name), prefix, strlen(prefix)) == 0;
+ }
++EXPORT_SYMBOL(of_node_name_prefix);
+
+ int of_n_addr_cells(struct device_node *np)
+ {
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index 7af0ddec936b..20988c426650 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -425,6 +425,7 @@ static int _of_add_opp_table_v2(struct device *dev, struct device_node *opp_np)
+ dev_err(dev, "Not all nodes have performance state set (%d: %d)\n",
+ count, pstate_count);
+ ret = -ENOENT;
++ _dev_pm_opp_remove_table(opp_table, dev, false);
+ goto put_opp_table;
+ }
+
+diff --git a/drivers/pci/controller/dwc/pci-dra7xx.c b/drivers/pci/controller/dwc/pci-dra7xx.c
+index ce9224a36f62..a32d6dde7a57 100644
+--- a/drivers/pci/controller/dwc/pci-dra7xx.c
++++ b/drivers/pci/controller/dwc/pci-dra7xx.c
+@@ -542,7 +542,7 @@ static const struct of_device_id of_dra7xx_pcie_match[] = {
+ };
+
+ /*
+- * dra7xx_pcie_ep_unaligned_memaccess: workaround for AM572x/AM571x Errata i870
++ * dra7xx_pcie_unaligned_memaccess: workaround for AM572x/AM571x Errata i870
+ * @dra7xx: the dra7xx device where the workaround should be applied
+ *
+ * Access to the PCIe slave port that are not 32-bit aligned will result
+@@ -552,7 +552,7 @@ static const struct of_device_id of_dra7xx_pcie_match[] = {
+ *
+ * To avoid this issue set PCIE_SS1_AXI2OCP_LEGACY_MODE_ENABLE to 1.
+ */
+-static int dra7xx_pcie_ep_unaligned_memaccess(struct device *dev)
++static int dra7xx_pcie_unaligned_memaccess(struct device *dev)
+ {
+ int ret;
+ struct device_node *np = dev->of_node;
+@@ -704,6 +704,11 @@ static int __init dra7xx_pcie_probe(struct platform_device *pdev)
+
+ dra7xx_pcie_writel(dra7xx, PCIECTRL_TI_CONF_DEVICE_TYPE,
+ DEVICE_TYPE_RC);
++
++ ret = dra7xx_pcie_unaligned_memaccess(dev);
++ if (ret)
++ dev_err(dev, "WA for Errata i870 not applied\n");
++
+ ret = dra7xx_add_pcie_port(dra7xx, pdev);
+ if (ret < 0)
+ goto err_gpio;
+@@ -717,7 +722,7 @@ static int __init dra7xx_pcie_probe(struct platform_device *pdev)
+ dra7xx_pcie_writel(dra7xx, PCIECTRL_TI_CONF_DEVICE_TYPE,
+ DEVICE_TYPE_EP);
+
+- ret = dra7xx_pcie_ep_unaligned_memaccess(dev);
++ ret = dra7xx_pcie_unaligned_memaccess(dev);
+ if (ret)
+ goto err_gpio;
+
+diff --git a/drivers/pci/controller/pcie-cadence-ep.c b/drivers/pci/controller/pcie-cadence-ep.c
+index 9e87dd7f9ac3..6692654798d4 100644
+--- a/drivers/pci/controller/pcie-cadence-ep.c
++++ b/drivers/pci/controller/pcie-cadence-ep.c
+@@ -258,7 +258,6 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn,
+ u8 intx, bool is_asserted)
+ {
+ struct cdns_pcie *pcie = &ep->pcie;
+- u32 r = ep->max_regions - 1;
+ u32 offset;
+ u16 status;
+ u8 msg_code;
+@@ -268,8 +267,8 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn,
+ /* Set the outbound region if needed. */
+ if (unlikely(ep->irq_pci_addr != CDNS_PCIE_EP_IRQ_PCI_ADDR_LEGACY ||
+ ep->irq_pci_fn != fn)) {
+- /* Last region was reserved for IRQ writes. */
+- cdns_pcie_set_outbound_region_for_normal_msg(pcie, fn, r,
++ /* First region was reserved for IRQ writes. */
++ cdns_pcie_set_outbound_region_for_normal_msg(pcie, fn, 0,
+ ep->irq_phys_addr);
+ ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_LEGACY;
+ ep->irq_pci_fn = fn;
+@@ -347,8 +346,8 @@ static int cdns_pcie_ep_send_msi_irq(struct cdns_pcie_ep *ep, u8 fn,
+ /* Set the outbound region if needed. */
+ if (unlikely(ep->irq_pci_addr != (pci_addr & ~pci_addr_mask) ||
+ ep->irq_pci_fn != fn)) {
+- /* Last region was reserved for IRQ writes. */
+- cdns_pcie_set_outbound_region(pcie, fn, ep->max_regions - 1,
++ /* First region was reserved for IRQ writes. */
++ cdns_pcie_set_outbound_region(pcie, fn, 0,
+ false,
+ ep->irq_phys_addr,
+ pci_addr & ~pci_addr_mask,
+@@ -517,6 +516,8 @@ static int cdns_pcie_ep_probe(struct platform_device *pdev)
+ goto free_epc_mem;
+ }
+ ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_NONE;
++ /* Reserve region 0 for IRQs */
++ set_bit(0, &ep->ob_region_map);
+
+ return 0;
+
+diff --git a/drivers/pci/controller/pcie-cadence.c b/drivers/pci/controller/pcie-cadence.c
+index 975bcdd6b5c0..cd795f6fc1e2 100644
+--- a/drivers/pci/controller/pcie-cadence.c
++++ b/drivers/pci/controller/pcie-cadence.c
+@@ -190,14 +190,16 @@ int cdns_pcie_init_phy(struct device *dev, struct cdns_pcie *pcie)
+
+ for (i = 0; i < phy_count; i++) {
+ of_property_read_string_index(np, "phy-names", i, &name);
+- phy[i] = devm_phy_optional_get(dev, name);
+- if (IS_ERR(phy))
+- return PTR_ERR(phy);
+-
++ phy[i] = devm_phy_get(dev, name);
++ if (IS_ERR(phy[i])) {
++ ret = PTR_ERR(phy[i]);
++ goto err_phy;
++ }
+ link[i] = device_link_add(dev, &phy[i]->dev, DL_FLAG_STATELESS);
+ if (!link[i]) {
++ devm_phy_put(dev, phy[i]);
+ ret = -EINVAL;
+- goto err_link;
++ goto err_phy;
+ }
+ }
+
+@@ -207,13 +209,15 @@ int cdns_pcie_init_phy(struct device *dev, struct cdns_pcie *pcie)
+
+ ret = cdns_pcie_enable_phy(pcie);
+ if (ret)
+- goto err_link;
++ goto err_phy;
+
+ return 0;
+
+-err_link:
+- while (--i >= 0)
++err_phy:
++ while (--i >= 0) {
+ device_link_del(link[i]);
++ devm_phy_put(dev, phy[i]);
++ }
+
+ return ret;
+ }
+diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
+index 861dda69f366..c5ff6ca65eab 100644
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -337,6 +337,17 @@ static struct mtk_pcie_port *mtk_pcie_find_port(struct pci_bus *bus,
+ {
+ struct mtk_pcie *pcie = bus->sysdata;
+ struct mtk_pcie_port *port;
++ struct pci_dev *dev = NULL;
++
++ /*
++ * Walk the bus hierarchy to get the devfn value
++ * of the port in the root bus.
++ */
++ while (bus && bus->number) {
++ dev = bus->self;
++ bus = dev->bus;
++ devfn = dev->devfn;
++ }
+
+ list_for_each_entry(port, &pcie->ports, list)
+ if (port->slot == PCI_SLOT(devfn))
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index f2ef896464b3..af24ed50a245 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -958,7 +958,6 @@ static int __pci_enable_msix(struct pci_dev *dev, struct msix_entry *entries,
+ }
+ }
+ }
+- WARN_ON(!!dev->msix_enabled);
+
+ /* Check whether driver already requested for MSI irq */
+ if (dev->msi_enabled) {
+@@ -1028,8 +1027,6 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
+ if (!pci_msi_supported(dev, minvec))
+ return -EINVAL;
+
+- WARN_ON(!!dev->msi_enabled);
+-
+ /* Check whether driver already requested MSI-X irqs */
+ if (dev->msix_enabled) {
+ pci_info(dev, "can't enable MSI (MSI-X already enabled)\n");
+@@ -1039,6 +1036,9 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
+ if (maxvec < minvec)
+ return -ERANGE;
+
++ if (WARN_ON_ONCE(dev->msi_enabled))
++ return -EINVAL;
++
+ nvec = pci_msi_vec_count(dev);
+ if (nvec < 0)
+ return nvec;
+@@ -1087,6 +1087,9 @@ static int __pci_enable_msix_range(struct pci_dev *dev,
+ if (maxvec < minvec)
+ return -ERANGE;
+
++ if (WARN_ON_ONCE(dev->msix_enabled))
++ return -EINVAL;
++
+ for (;;) {
+ if (affd) {
+ nvec = irq_calc_affinity_vectors(minvec, nvec, affd);
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index c2ab57705043..f8436d1c4d45 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -762,19 +762,33 @@ static void pci_acpi_setup(struct device *dev)
+ return;
+
+ device_set_wakeup_capable(dev, true);
++ /*
++ * For bridges that can do D3 we enable wake automatically (as
++ * we do for the power management itself in that case). The
++ * reason is that the bridge may have additional methods such as
++ * _DSW that need to be called.
++ */
++ if (pci_dev->bridge_d3)
++ device_wakeup_enable(dev);
++
+ acpi_pci_wakeup(pci_dev, false);
+ }
+
+ static void pci_acpi_cleanup(struct device *dev)
+ {
+ struct acpi_device *adev = ACPI_COMPANION(dev);
++ struct pci_dev *pci_dev = to_pci_dev(dev);
+
+ if (!adev)
+ return;
+
+ pci_acpi_remove_pm_notifier(adev);
+- if (adev->wakeup.flags.valid)
++ if (adev->wakeup.flags.valid) {
++ if (pci_dev->bridge_d3)
++ device_wakeup_disable(dev);
++
+ device_set_wakeup_capable(dev, false);
++ }
+ }
+
+ static bool pci_acpi_bus_match(struct device *dev)
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 5326916715d2..f78860ce884b 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -991,7 +991,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
+ * All PCIe functions are in one slot, remove one function will remove
+ * the whole slot, so just wait until we are the last function left.
+ */
+- if (!list_is_last(&pdev->bus_list, &parent->subordinate->devices))
++ if (!list_empty(&parent->subordinate->devices))
+ goto out;
+
+ link = parent->link_state;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 6bc27b7fd452..c0673a717239 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3190,7 +3190,11 @@ static void disable_igfx_irq(struct pci_dev *dev)
+
+ pci_iounmap(dev, regs);
+ }
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0042, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0046, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x004a, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0106, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq);
+
+diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
+index 461e7fd2756f..e9c6b120cf45 100644
+--- a/drivers/pci/remove.c
++++ b/drivers/pci/remove.c
+@@ -25,9 +25,6 @@ static void pci_stop_dev(struct pci_dev *dev)
+
+ pci_dev_assign_added(dev, false);
+ }
+-
+- if (dev->bus->self)
+- pcie_aspm_exit_link_state(dev);
+ }
+
+ static void pci_destroy_dev(struct pci_dev *dev)
+@@ -41,6 +38,7 @@ static void pci_destroy_dev(struct pci_dev *dev)
+ list_del(&dev->bus_list);
+ up_write(&pci_bus_sem);
+
++ pcie_aspm_exit_link_state(dev);
+ pci_bridge_d3_update(dev);
+ pci_free_resources(dev);
+ put_device(&dev->dev);
+diff --git a/drivers/pcmcia/ricoh.h b/drivers/pcmcia/ricoh.h
+index 01098c841f87..8ac7b138c094 100644
+--- a/drivers/pcmcia/ricoh.h
++++ b/drivers/pcmcia/ricoh.h
+@@ -119,6 +119,10 @@
+ #define RL5C4XX_MISC_CONTROL 0x2F /* 8 bit */
+ #define RL5C4XX_ZV_ENABLE 0x08
+
++/* Misc Control 3 Register */
++#define RL5C4XX_MISC3 0x00A2 /* 16 bit */
++#define RL5C47X_MISC3_CB_CLKRUN_DIS BIT(1)
++
+ #ifdef __YENTA_H
+
+ #define rl_misc(socket) ((socket)->private[0])
+@@ -156,6 +160,35 @@ static void ricoh_set_zv(struct yenta_socket *socket)
+ }
+ }
+
++static void ricoh_set_clkrun(struct yenta_socket *socket, bool quiet)
++{
++ u16 misc3;
++
++ /*
++ * RL5C475II likely has this setting, too, however no datasheet
++ * is publicly available for this chip
++ */
++ if (socket->dev->device != PCI_DEVICE_ID_RICOH_RL5C476 &&
++ socket->dev->device != PCI_DEVICE_ID_RICOH_RL5C478)
++ return;
++
++ if (socket->dev->revision < 0x80)
++ return;
++
++ misc3 = config_readw(socket, RL5C4XX_MISC3);
++ if (misc3 & RL5C47X_MISC3_CB_CLKRUN_DIS) {
++ if (!quiet)
++ dev_dbg(&socket->dev->dev,
++ "CLKRUN feature already disabled\n");
++ } else if (disable_clkrun) {
++ if (!quiet)
++ dev_info(&socket->dev->dev,
++ "Disabling CLKRUN feature\n");
++ misc3 |= RL5C47X_MISC3_CB_CLKRUN_DIS;
++ config_writew(socket, RL5C4XX_MISC3, misc3);
++ }
++}
++
+ static void ricoh_save_state(struct yenta_socket *socket)
+ {
+ rl_misc(socket) = config_readw(socket, RL5C4XX_MISC);
+@@ -172,6 +205,7 @@ static void ricoh_restore_state(struct yenta_socket *socket)
+ config_writew(socket, RL5C4XX_16BIT_IO_0, rl_io(socket));
+ config_writew(socket, RL5C4XX_16BIT_MEM_0, rl_mem(socket));
+ config_writew(socket, RL5C4XX_CONFIG, rl_config(socket));
++ ricoh_set_clkrun(socket, true);
+ }
+
+
+@@ -197,6 +231,7 @@ static int ricoh_override(struct yenta_socket *socket)
+ config_writew(socket, RL5C4XX_CONFIG, config);
+
+ ricoh_set_zv(socket);
++ ricoh_set_clkrun(socket, false);
+
+ return 0;
+ }
+diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
+index ab3da2262f0f..ac6a3f46b1e6 100644
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -26,7 +26,8 @@
+
+ static bool disable_clkrun;
+ module_param(disable_clkrun, bool, 0444);
+-MODULE_PARM_DESC(disable_clkrun, "If PC card doesn't function properly, please try this option");
++MODULE_PARM_DESC(disable_clkrun,
++ "If PC card doesn't function properly, please try this option (TI and Ricoh bridges only)");
+
+ static bool isa_probe = 1;
+ module_param(isa_probe, bool, 0444);
+diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+index 6556dbeae65e..ac251c62bc66 100644
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+@@ -319,6 +319,8 @@ static int pmic_mpp_set_mux(struct pinctrl_dev *pctldev, unsigned function,
+ pad->function = function;
+
+ ret = pmic_mpp_write_mode_ctl(state, pad);
++ if (ret < 0)
++ return ret;
+
+ val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT;
+
+@@ -343,13 +345,12 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev,
+
+ switch (param) {
+ case PIN_CONFIG_BIAS_DISABLE:
+- arg = pad->pullup == PMIC_MPP_PULL_UP_OPEN;
++ if (pad->pullup != PMIC_MPP_PULL_UP_OPEN)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_UP:
+ switch (pad->pullup) {
+- case PMIC_MPP_PULL_UP_OPEN:
+- arg = 0;
+- break;
+ case PMIC_MPP_PULL_UP_0P6KOHM:
+ arg = 600;
+ break;
+@@ -364,13 +365,17 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev,
+ }
+ break;
+ case PIN_CONFIG_BIAS_HIGH_IMPEDANCE:
+- arg = !pad->is_enabled;
++ if (pad->is_enabled)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_POWER_SOURCE:
+ arg = pad->power_source;
+ break;
+ case PIN_CONFIG_INPUT_ENABLE:
+- arg = pad->input_enabled;
++ if (!pad->input_enabled)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_OUTPUT:
+ arg = pad->out_value;
+@@ -382,7 +387,9 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev,
+ arg = pad->amux_input;
+ break;
+ case PMIC_MPP_CONF_PAIRED:
+- arg = pad->paired;
++ if (!pad->paired)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_DRIVE_STRENGTH:
+ arg = pad->drive_strength;
+@@ -455,7 +462,7 @@ static int pmic_mpp_config_set(struct pinctrl_dev *pctldev, unsigned int pin,
+ pad->dtest = arg;
+ break;
+ case PIN_CONFIG_DRIVE_STRENGTH:
+- arg = pad->drive_strength;
++ pad->drive_strength = arg;
+ break;
+ case PMIC_MPP_CONF_AMUX_ROUTE:
+ if (arg >= PMIC_MPP_AMUX_ROUTE_ABUS4)
+@@ -502,6 +509,10 @@ static int pmic_mpp_config_set(struct pinctrl_dev *pctldev, unsigned int pin,
+ if (ret < 0)
+ return ret;
+
++ ret = pmic_mpp_write(state, pad, PMIC_MPP_REG_SINK_CTL, pad->drive_strength);
++ if (ret < 0)
++ return ret;
++
+ val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT;
+
+ return pmic_mpp_write(state, pad, PMIC_MPP_REG_EN_CTL, val);
+diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+index f53e32a9d8fc..0e153bae322e 100644
+--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+@@ -260,22 +260,32 @@ static int pm8xxx_pin_config_get(struct pinctrl_dev *pctldev,
+
+ switch (param) {
+ case PIN_CONFIG_BIAS_DISABLE:
+- arg = pin->bias == PM8XXX_GPIO_BIAS_NP;
++ if (pin->bias != PM8XXX_GPIO_BIAS_NP)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+- arg = pin->bias == PM8XXX_GPIO_BIAS_PD;
++ if (pin->bias != PM8XXX_GPIO_BIAS_PD)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_UP:
+- arg = pin->bias <= PM8XXX_GPIO_BIAS_PU_1P5_30;
++ if (pin->bias > PM8XXX_GPIO_BIAS_PU_1P5_30)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PM8XXX_QCOM_PULL_UP_STRENGTH:
+ arg = pin->pull_up_strength;
+ break;
+ case PIN_CONFIG_BIAS_HIGH_IMPEDANCE:
+- arg = pin->disable;
++ if (!pin->disable)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_INPUT_ENABLE:
+- arg = pin->mode == PM8XXX_GPIO_MODE_INPUT;
++ if (pin->mode != PM8XXX_GPIO_MODE_INPUT)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_OUTPUT:
+ if (pin->mode & PM8XXX_GPIO_MODE_OUTPUT)
+@@ -290,10 +300,14 @@ static int pm8xxx_pin_config_get(struct pinctrl_dev *pctldev,
+ arg = pin->output_strength;
+ break;
+ case PIN_CONFIG_DRIVE_PUSH_PULL:
+- arg = !pin->open_drain;
++ if (pin->open_drain)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_DRIVE_OPEN_DRAIN:
+- arg = pin->open_drain;
++ if (!pin->open_drain)
++ return -EINVAL;
++ arg = 1;
+ break;
+ default:
+ return -EINVAL;
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+index 4d9bf9b3e9f3..26ebedc1f6d3 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+@@ -1079,10 +1079,9 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+ * We suppose that we won't have any more functions than pins,
+ * we'll reallocate that later anyway
+ */
+- pctl->functions = devm_kcalloc(&pdev->dev,
+- pctl->ngroups,
+- sizeof(*pctl->functions),
+- GFP_KERNEL);
++ pctl->functions = kcalloc(pctl->ngroups,
++ sizeof(*pctl->functions),
++ GFP_KERNEL);
+ if (!pctl->functions)
+ return -ENOMEM;
+
+@@ -1133,8 +1132,10 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+
+ func_item = sunxi_pinctrl_find_function_by_name(pctl,
+ func->name);
+- if (!func_item)
++ if (!func_item) {
++ kfree(pctl->functions);
+ return -EINVAL;
++ }
+
+ if (!func_item->groups) {
+ func_item->groups =
+@@ -1142,8 +1143,10 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+ func_item->ngroups,
+ sizeof(*func_item->groups),
+ GFP_KERNEL);
+- if (!func_item->groups)
++ if (!func_item->groups) {
++ kfree(pctl->functions);
+ return -ENOMEM;
++ }
+ }
+
+ func_grp = func_item->groups;
+diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
+index bbcaee56db9d..b6a7d9f74cf3 100644
+--- a/drivers/power/supply/twl4030_charger.c
++++ b/drivers/power/supply/twl4030_charger.c
+@@ -996,12 +996,13 @@ static int twl4030_bci_probe(struct platform_device *pdev)
+ if (bci->dev->of_node) {
+ struct device_node *phynode;
+
+- phynode = of_find_compatible_node(bci->dev->of_node->parent,
+- NULL, "ti,twl4030-usb");
++ phynode = of_get_compatible_child(bci->dev->of_node->parent,
++ "ti,twl4030-usb");
+ if (phynode) {
+ bci->usb_nb.notifier_call = twl4030_bci_usb_ncb;
+ bci->transceiver = devm_usb_get_phy_by_node(
+ bci->dev, phynode, &bci->usb_nb);
++ of_node_put(phynode);
+ if (IS_ERR(bci->transceiver)) {
+ ret = PTR_ERR(bci->transceiver);
+ if (ret == -EPROBE_DEFER)
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 61a760ee4aac..e9ab90c19304 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -198,6 +198,9 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->fatal_irq = platform_get_irq_byname(pdev, "fatal");
++ if (q6v5->fatal_irq == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->fatal_irq,
+ NULL, q6v5_fatal_interrupt,
+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+@@ -208,6 +211,9 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->ready_irq = platform_get_irq_byname(pdev, "ready");
++ if (q6v5->ready_irq == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->ready_irq,
+ NULL, q6v5_ready_interrupt,
+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+@@ -218,6 +224,9 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->handover_irq = platform_get_irq_byname(pdev, "handover");
++ if (q6v5->handover_irq == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->handover_irq,
+ NULL, q6v5_handover_interrupt,
+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+@@ -229,6 +238,9 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ disable_irq(q6v5->handover_irq);
+
+ q6v5->stop_irq = platform_get_irq_byname(pdev, "stop-ack");
++ if (q6v5->stop_irq == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->stop_irq,
+ NULL, q6v5_stop_interrupt,
+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
+index 8da83a4ebadc..b2e5a6abf7d5 100644
+--- a/drivers/rpmsg/qcom_smd.c
++++ b/drivers/rpmsg/qcom_smd.c
+@@ -1122,8 +1122,10 @@ static struct qcom_smd_channel *qcom_smd_create_channel(struct qcom_smd_edge *ed
+
+ channel->edge = edge;
+ channel->name = kstrdup(name, GFP_KERNEL);
+- if (!channel->name)
+- return ERR_PTR(-ENOMEM);
++ if (!channel->name) {
++ ret = -ENOMEM;
++ goto free_channel;
++ }
+
+ spin_lock_init(&channel->tx_lock);
+ spin_lock_init(&channel->recv_lock);
+@@ -1173,6 +1175,7 @@ static struct qcom_smd_channel *qcom_smd_create_channel(struct qcom_smd_edge *ed
+
+ free_name_and_channel:
+ kfree(channel->name);
++free_channel:
+ kfree(channel);
+
+ return ERR_PTR(ret);
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index cd3a2411bc2f..df0c5776d49b 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -50,6 +50,7 @@
+ /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */
+ #include <linux/mc146818rtc.h>
+
++#ifdef CONFIG_ACPI
+ /*
+ * Use ACPI SCI to replace HPET interrupt for RTC Alarm event
+ *
+@@ -61,6 +62,18 @@
+ static bool use_acpi_alarm;
+ module_param(use_acpi_alarm, bool, 0444);
+
++static inline int cmos_use_acpi_alarm(void)
++{
++ return use_acpi_alarm;
++}
++#else /* !CONFIG_ACPI */
++
++static inline int cmos_use_acpi_alarm(void)
++{
++ return 0;
++}
++#endif
++
+ struct cmos_rtc {
+ struct rtc_device *rtc;
+ struct device *dev;
+@@ -167,9 +180,9 @@ static inline int hpet_unregister_irq_handler(irq_handler_t handler)
+ #endif
+
+ /* Don't use HPET for RTC Alarm event if ACPI Fixed event is used */
+-static int use_hpet_alarm(void)
++static inline int use_hpet_alarm(void)
+ {
+- return is_hpet_enabled() && !use_acpi_alarm;
++ return is_hpet_enabled() && !cmos_use_acpi_alarm();
+ }
+
+ /*----------------------------------------------------------------*/
+@@ -340,7 +353,7 @@ static void cmos_irq_enable(struct cmos_rtc *cmos, unsigned char mask)
+ if (use_hpet_alarm())
+ hpet_set_rtc_irq_bit(mask);
+
+- if ((mask & RTC_AIE) && use_acpi_alarm) {
++ if ((mask & RTC_AIE) && cmos_use_acpi_alarm()) {
+ if (cmos->wake_on)
+ cmos->wake_on(cmos->dev);
+ }
+@@ -358,7 +371,7 @@ static void cmos_irq_disable(struct cmos_rtc *cmos, unsigned char mask)
+ if (use_hpet_alarm())
+ hpet_mask_rtc_irq_bit(mask);
+
+- if ((mask & RTC_AIE) && use_acpi_alarm) {
++ if ((mask & RTC_AIE) && cmos_use_acpi_alarm()) {
+ if (cmos->wake_off)
+ cmos->wake_off(cmos->dev);
+ }
+@@ -980,7 +993,7 @@ static int cmos_suspend(struct device *dev)
+ }
+ spin_unlock_irq(&rtc_lock);
+
+- if ((tmp & RTC_AIE) && !use_acpi_alarm) {
++ if ((tmp & RTC_AIE) && !cmos_use_acpi_alarm()) {
+ cmos->enabled_wake = 1;
+ if (cmos->wake_on)
+ cmos->wake_on(dev);
+@@ -1031,7 +1044,7 @@ static void cmos_check_wkalrm(struct device *dev)
+ * ACPI RTC wake event is cleared after resume from STR,
+ * ACK the rtc irq here
+ */
+- if (t_now >= cmos->alarm_expires && use_acpi_alarm) {
++ if (t_now >= cmos->alarm_expires && cmos_use_acpi_alarm()) {
+ cmos_interrupt(0, (void *)cmos->rtc);
+ return;
+ }
+@@ -1053,7 +1066,7 @@ static int __maybe_unused cmos_resume(struct device *dev)
+ struct cmos_rtc *cmos = dev_get_drvdata(dev);
+ unsigned char tmp;
+
+- if (cmos->enabled_wake && !use_acpi_alarm) {
++ if (cmos->enabled_wake && !cmos_use_acpi_alarm()) {
+ if (cmos->wake_off)
+ cmos->wake_off(dev);
+ else
+@@ -1132,7 +1145,7 @@ static u32 rtc_handler(void *context)
+ * Or else, ACPI SCI is enabled during suspend/resume only,
+ * update rtc irq in that case.
+ */
+- if (use_acpi_alarm)
++ if (cmos_use_acpi_alarm())
+ cmos_interrupt(0, (void *)cmos->rtc);
+ else {
+ /* Fix me: can we use cmos_interrupt() here as well? */
+diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
+index 4b2b4627daeb..71396b62dc52 100644
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -1384,7 +1384,6 @@ static void ds1307_clks_register(struct ds1307 *ds1307)
+ static const struct regmap_config regmap_config = {
+ .reg_bits = 8,
+ .val_bits = 8,
+- .max_register = 0x9,
+ };
+
+ static int ds1307_probe(struct i2c_client *client,
+diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c
+index c3fc34b9964d..9e5d3f7d29ae 100644
+--- a/drivers/scsi/esp_scsi.c
++++ b/drivers/scsi/esp_scsi.c
+@@ -1338,6 +1338,7 @@ static int esp_data_bytes_sent(struct esp *esp, struct esp_cmd_entry *ent,
+
+ bytes_sent = esp->data_dma_len;
+ bytes_sent -= ecount;
++ bytes_sent -= esp->send_cmd_residual;
+
+ /*
+ * The am53c974 has a DMA 'pecularity'. The doc states:
+diff --git a/drivers/scsi/esp_scsi.h b/drivers/scsi/esp_scsi.h
+index 8163dca2071b..a77772777a30 100644
+--- a/drivers/scsi/esp_scsi.h
++++ b/drivers/scsi/esp_scsi.h
+@@ -540,6 +540,8 @@ struct esp {
+
+ void *dma;
+ int dmarev;
++
++ u32 send_cmd_residual;
+ };
+
+ /* A front-end driver for the ESP chip should do the following in
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 5c7858e735c9..200b5bca1f5f 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -4158,9 +4158,17 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
+ }
+ lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
+
+- spin_lock_irqsave(&phba->hbalock, flags);
+- lpfc_cmd->pCmd = NULL;
+- spin_unlock_irqrestore(&phba->hbalock, flags);
++ /* If pCmd was set to NULL from abort path, do not call scsi_done */
++ if (xchg(&lpfc_cmd->pCmd, NULL) == NULL) {
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_FCP,
++ "0711 FCP cmd already NULL, sid: 0x%06x, "
++ "did: 0x%06x, oxid: 0x%04x\n",
++ vport->fc_myDID,
++ (pnode) ? pnode->nlp_DID : 0,
++ phba->sli_rev == LPFC_SLI_REV4 ?
++ lpfc_cmd->cur_iocbq.sli4_xritag : 0xffff);
++ return;
++ }
+
+ /* The sdev is not guaranteed to be valid post scsi_done upcall. */
+ cmd->scsi_done(cmd);
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 9830bdb6e072..a95c823cd1a4 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -3797,6 +3797,7 @@ lpfc_sli_handle_slow_ring_event_s4(struct lpfc_hba *phba,
+ struct hbq_dmabuf *dmabuf;
+ struct lpfc_cq_event *cq_event;
+ unsigned long iflag;
++ int count = 0;
+
+ spin_lock_irqsave(&phba->hbalock, iflag);
+ phba->hba_flag &= ~HBA_SP_QUEUE_EVT;
+@@ -3818,16 +3819,22 @@ lpfc_sli_handle_slow_ring_event_s4(struct lpfc_hba *phba,
+ if (irspiocbq)
+ lpfc_sli_sp_handle_rspiocb(phba, pring,
+ irspiocbq);
++ count++;
+ break;
+ case CQE_CODE_RECEIVE:
+ case CQE_CODE_RECEIVE_V1:
+ dmabuf = container_of(cq_event, struct hbq_dmabuf,
+ cq_event);
+ lpfc_sli4_handle_received_buffer(phba, dmabuf);
++ count++;
+ break;
+ default:
+ break;
+ }
++
++ /* Limit the number of events to 64 to avoid soft lockups */
++ if (count == 64)
++ break;
+ }
+ }
+
+diff --git a/drivers/scsi/mac_esp.c b/drivers/scsi/mac_esp.c
+index eb551f3cc471..71879f2207e0 100644
+--- a/drivers/scsi/mac_esp.c
++++ b/drivers/scsi/mac_esp.c
+@@ -427,6 +427,8 @@ static void mac_esp_send_pio_cmd(struct esp *esp, u32 addr, u32 esp_count,
+ scsi_esp_cmd(esp, ESP_CMD_TI);
+ }
+ }
++
++ esp->send_cmd_residual = esp_count;
+ }
+
+ static int mac_esp_irq_pending(struct esp *esp)
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 9aa9590c5373..f6de7526ded5 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -7523,6 +7523,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
+ get_user(user_sense_off, &cioc->sense_off))
+ return -EFAULT;
+
++ if (local_sense_off != user_sense_off)
++ return -EINVAL;
++
+ if (local_sense_len) {
+ void __user **sense_ioc_ptr =
+ (void __user **)((u8 *)((unsigned long)&ioc->frame.raw) + local_sense_off);
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 2c6c2cd5a0d0..596a9b214df1 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -493,7 +493,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+ qla2xxx_wake_dpc(vha);
+ }
+- } else if (!abort_active) {
++ } else if (current == ha->dpc_thread) {
+ /* call abort directly since we are in the DPC thread */
+ ql_dbg(ql_dbg_mbx, vha, 0x101d,
+ "Timeout, calling abort_isp.\n");
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index c55f38ec391c..54074dd483a7 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1691,8 +1691,9 @@ static void __ufshcd_release(struct ufs_hba *hba)
+
+ hba->clk_gating.state = REQ_CLKS_OFF;
+ trace_ufshcd_clk_gating(dev_name(hba->dev), hba->clk_gating.state);
+- schedule_delayed_work(&hba->clk_gating.gate_work,
+- msecs_to_jiffies(hba->clk_gating.delay_ms));
++ queue_delayed_work(hba->clk_gating.clk_gating_workq,
++ &hba->clk_gating.gate_work,
++ msecs_to_jiffies(hba->clk_gating.delay_ms));
+ }
+
+ void ufshcd_release(struct ufs_hba *hba)
+diff --git a/drivers/soc/qcom/rmtfs_mem.c b/drivers/soc/qcom/rmtfs_mem.c
+index 8a3678c2e83c..97bb5989aa21 100644
+--- a/drivers/soc/qcom/rmtfs_mem.c
++++ b/drivers/soc/qcom/rmtfs_mem.c
+@@ -212,6 +212,11 @@ static int qcom_rmtfs_mem_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "failed to parse qcom,vmid\n");
+ goto remove_cdev;
+ } else if (!ret) {
++ if (!qcom_scm_is_available()) {
++ ret = -EPROBE_DEFER;
++ goto remove_cdev;
++ }
++
+ perms[0].vmid = QCOM_SCM_VMID_HLOS;
+ perms[0].perm = QCOM_SCM_PERM_RW;
+ perms[1].vmid = vmid;
+diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
+index 2d6f3fcf3211..ed71a4c9c8b2 100644
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -1288,7 +1288,7 @@ static void tegra_pmc_init_tsense_reset(struct tegra_pmc *pmc)
+ if (!pmc->soc->has_tsense_reset)
+ return;
+
+- np = of_find_node_by_name(pmc->dev->of_node, "i2c-thermtrip");
++ np = of_get_child_by_name(pmc->dev->of_node, "i2c-thermtrip");
+ if (!np) {
+ dev_warn(dev, "i2c-thermtrip node not found, %s.\n", disabled);
+ return;
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 8612525fa4e3..584bcb018a62 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -89,7 +89,7 @@
+ #define BSPI_BPP_MODE_SELECT_MASK BIT(8)
+ #define BSPI_BPP_ADDR_SELECT_MASK BIT(16)
+
+-#define BSPI_READ_LENGTH 512
++#define BSPI_READ_LENGTH 256
+
+ /* MSPI register offsets */
+ #define MSPI_SPCR0_LSB 0x000
+@@ -355,7 +355,7 @@ static int bcm_qspi_bspi_set_flex_mode(struct bcm_qspi *qspi,
+ int bpc = 0, bpp = 0;
+ u8 command = op->cmd.opcode;
+ int width = op->cmd.buswidth ? op->cmd.buswidth : SPI_NBITS_SINGLE;
+- int addrlen = op->addr.nbytes * 8;
++ int addrlen = op->addr.nbytes;
+ int flex_mode = 1;
+
+ dev_dbg(&qspi->pdev->dev, "set flex mode w %x addrlen %x hp %d\n",
+diff --git a/drivers/spi/spi-ep93xx.c b/drivers/spi/spi-ep93xx.c
+index f1526757aaf6..79fc3940245a 100644
+--- a/drivers/spi/spi-ep93xx.c
++++ b/drivers/spi/spi-ep93xx.c
+@@ -246,6 +246,19 @@ static int ep93xx_spi_read_write(struct spi_master *master)
+ return -EINPROGRESS;
+ }
+
++static enum dma_transfer_direction
++ep93xx_dma_data_to_trans_dir(enum dma_data_direction dir)
++{
++ switch (dir) {
++ case DMA_TO_DEVICE:
++ return DMA_MEM_TO_DEV;
++ case DMA_FROM_DEVICE:
++ return DMA_DEV_TO_MEM;
++ default:
++ return DMA_TRANS_NONE;
++ }
++}
++
+ /**
+ * ep93xx_spi_dma_prepare() - prepares a DMA transfer
+ * @master: SPI master
+@@ -257,7 +270,7 @@ static int ep93xx_spi_read_write(struct spi_master *master)
+ */
+ static struct dma_async_tx_descriptor *
+ ep93xx_spi_dma_prepare(struct spi_master *master,
+- enum dma_transfer_direction dir)
++ enum dma_data_direction dir)
+ {
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct spi_transfer *xfer = master->cur_msg->state;
+@@ -277,9 +290,9 @@ ep93xx_spi_dma_prepare(struct spi_master *master,
+ buswidth = DMA_SLAVE_BUSWIDTH_1_BYTE;
+
+ memset(&conf, 0, sizeof(conf));
+- conf.direction = dir;
++ conf.direction = ep93xx_dma_data_to_trans_dir(dir);
+
+- if (dir == DMA_DEV_TO_MEM) {
++ if (dir == DMA_FROM_DEVICE) {
+ chan = espi->dma_rx;
+ buf = xfer->rx_buf;
+ sgt = &espi->rx_sgt;
+@@ -343,7 +356,8 @@ ep93xx_spi_dma_prepare(struct spi_master *master,
+ if (!nents)
+ return ERR_PTR(-ENOMEM);
+
+- txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents, dir, DMA_CTRL_ACK);
++ txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents, conf.direction,
++ DMA_CTRL_ACK);
+ if (!txd) {
+ dma_unmap_sg(chan->device->dev, sgt->sgl, sgt->nents, dir);
+ return ERR_PTR(-ENOMEM);
+@@ -360,13 +374,13 @@ ep93xx_spi_dma_prepare(struct spi_master *master,
+ * unmapped.
+ */
+ static void ep93xx_spi_dma_finish(struct spi_master *master,
+- enum dma_transfer_direction dir)
++ enum dma_data_direction dir)
+ {
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct dma_chan *chan;
+ struct sg_table *sgt;
+
+- if (dir == DMA_DEV_TO_MEM) {
++ if (dir == DMA_FROM_DEVICE) {
+ chan = espi->dma_rx;
+ sgt = &espi->rx_sgt;
+ } else {
+@@ -381,8 +395,8 @@ static void ep93xx_spi_dma_callback(void *callback_param)
+ {
+ struct spi_master *master = callback_param;
+
+- ep93xx_spi_dma_finish(master, DMA_MEM_TO_DEV);
+- ep93xx_spi_dma_finish(master, DMA_DEV_TO_MEM);
++ ep93xx_spi_dma_finish(master, DMA_TO_DEVICE);
++ ep93xx_spi_dma_finish(master, DMA_FROM_DEVICE);
+
+ spi_finalize_current_transfer(master);
+ }
+@@ -392,15 +406,15 @@ static int ep93xx_spi_dma_transfer(struct spi_master *master)
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct dma_async_tx_descriptor *rxd, *txd;
+
+- rxd = ep93xx_spi_dma_prepare(master, DMA_DEV_TO_MEM);
++ rxd = ep93xx_spi_dma_prepare(master, DMA_FROM_DEVICE);
+ if (IS_ERR(rxd)) {
+ dev_err(&master->dev, "DMA RX failed: %ld\n", PTR_ERR(rxd));
+ return PTR_ERR(rxd);
+ }
+
+- txd = ep93xx_spi_dma_prepare(master, DMA_MEM_TO_DEV);
++ txd = ep93xx_spi_dma_prepare(master, DMA_TO_DEVICE);
+ if (IS_ERR(txd)) {
+- ep93xx_spi_dma_finish(master, DMA_DEV_TO_MEM);
++ ep93xx_spi_dma_finish(master, DMA_FROM_DEVICE);
+ dev_err(&master->dev, "DMA TX failed: %ld\n", PTR_ERR(txd));
+ return PTR_ERR(txd);
+ }
+diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
+index 421bfc7dda67..088772ebef9b 100644
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -295,9 +295,11 @@ static int spi_gpio_request(struct device *dev,
+ spi_gpio->miso = devm_gpiod_get_optional(dev, "miso", GPIOD_IN);
+ if (IS_ERR(spi_gpio->miso))
+ return PTR_ERR(spi_gpio->miso);
+- if (!spi_gpio->miso)
+- /* HW configuration without MISO pin */
+- *mflags |= SPI_MASTER_NO_RX;
++ /*
++ * No setting SPI_MASTER_NO_RX here - if there is only a MOSI
++ * pin connected the host can still do RX by changing the
++ * direction of the line.
++ */
+
+ spi_gpio->sck = devm_gpiod_get(dev, "sck", GPIOD_OUT_LOW);
+ if (IS_ERR(spi_gpio->sck))
+@@ -423,7 +425,7 @@ static int spi_gpio_probe(struct platform_device *pdev)
+ spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
+ spi_gpio->bitbang.set_line_direction = spi_gpio_set_direction;
+
+- if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
++ if ((master_flags & SPI_MASTER_NO_TX) == 0) {
+ spi_gpio->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_word_mode0;
+ spi_gpio->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_word_mode1;
+ spi_gpio->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_word_mode2;
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index e43842c7a31a..eb72dba71d83 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -346,10 +346,25 @@ EXPORT_SYMBOL_GPL(spi_mem_get_name);
+ int spi_mem_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op)
+ {
+ struct spi_controller *ctlr = mem->spi->controller;
++ size_t len;
++
++ len = sizeof(op->cmd.opcode) + op->addr.nbytes + op->dummy.nbytes;
+
+ if (ctlr->mem_ops && ctlr->mem_ops->adjust_op_size)
+ return ctlr->mem_ops->adjust_op_size(mem, op);
+
++ if (!ctlr->mem_ops || !ctlr->mem_ops->exec_op) {
++ if (len > spi_max_transfer_size(mem->spi))
++ return -EINVAL;
++
++ op->data.nbytes = min3((size_t)op->data.nbytes,
++ spi_max_transfer_size(mem->spi),
++ spi_max_message_size(mem->spi) -
++ len);
++ if (!op->data.nbytes)
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(spi_mem_adjust_op_size);
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 86c0156e6c88..fc3093d21b96 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2754,7 +2754,7 @@ static void target_release_cmd_kref(struct kref *kref)
+ if (se_sess) {
+ spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
+ list_del_init(&se_cmd->se_cmd_list);
+- if (list_empty(&se_sess->sess_cmd_list))
++ if (se_sess->sess_tearing_down && list_empty(&se_sess->sess_cmd_list))
+ wake_up(&se_sess->cmd_list_wq);
+ spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+ }
+@@ -2907,7 +2907,7 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
+
+ spin_lock_irq(&se_sess->sess_cmd_lock);
+ do {
+- ret = wait_event_interruptible_lock_irq_timeout(
++ ret = wait_event_lock_irq_timeout(
+ se_sess->cmd_list_wq,
+ list_empty(&se_sess->sess_cmd_list),
+ se_sess->sess_cmd_lock, 180 * HZ);
+diff --git a/drivers/tc/tc.c b/drivers/tc/tc.c
+index 3be9519654e5..cf3fad2cb871 100644
+--- a/drivers/tc/tc.c
++++ b/drivers/tc/tc.c
+@@ -2,7 +2,7 @@
+ * TURBOchannel bus services.
+ *
+ * Copyright (c) Harald Koerfgen, 1998
+- * Copyright (c) 2001, 2003, 2005, 2006 Maciej W. Rozycki
++ * Copyright (c) 2001, 2003, 2005, 2006, 2018 Maciej W. Rozycki
+ * Copyright (c) 2005 James Simmons
+ *
+ * This file is subject to the terms and conditions of the GNU
+@@ -10,6 +10,7 @@
+ * directory of this archive for more details.
+ */
+ #include <linux/compiler.h>
++#include <linux/dma-mapping.h>
+ #include <linux/errno.h>
+ #include <linux/init.h>
+ #include <linux/ioport.h>
+@@ -92,6 +93,11 @@ static void __init tc_bus_add_devices(struct tc_bus *tbus)
+ tdev->dev.bus = &tc_bus_type;
+ tdev->slot = slot;
+
++ /* TURBOchannel has 34-bit DMA addressing (16GiB space). */
++ tdev->dma_mask = DMA_BIT_MASK(34);
++ tdev->dev.dma_mask = &tdev->dma_mask;
++ tdev->dev.coherent_dma_mask = DMA_BIT_MASK(34);
++
+ for (i = 0; i < 8; i++) {
+ tdev->firmware[i] =
+ readb(module + offset + TC_FIRM_VER + 4 * i);
+diff --git a/drivers/thermal/da9062-thermal.c b/drivers/thermal/da9062-thermal.c
+index dd8dd947b7f0..01b0cb994457 100644
+--- a/drivers/thermal/da9062-thermal.c
++++ b/drivers/thermal/da9062-thermal.c
+@@ -106,7 +106,7 @@ static void da9062_thermal_poll_on(struct work_struct *work)
+ THERMAL_EVENT_UNSPECIFIED);
+
+ delay = msecs_to_jiffies(thermal->zone->passive_delay);
+- schedule_delayed_work(&thermal->work, delay);
++ queue_delayed_work(system_freezable_wq, &thermal->work, delay);
+ return;
+ }
+
+@@ -125,7 +125,7 @@ static irqreturn_t da9062_thermal_irq_handler(int irq, void *data)
+ struct da9062_thermal *thermal = data;
+
+ disable_irq_nosync(thermal->irq);
+- schedule_delayed_work(&thermal->work, 0);
++ queue_delayed_work(system_freezable_wq, &thermal->work, 0);
+
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
+index 78f932822d38..8df2ce94c28d 100644
+--- a/drivers/thermal/rcar_thermal.c
++++ b/drivers/thermal/rcar_thermal.c
+@@ -453,6 +453,7 @@ static int rcar_thermal_remove(struct platform_device *pdev)
+
+ rcar_thermal_for_each_priv(priv, common) {
+ rcar_thermal_irq_disable(priv);
++ cancel_delayed_work_sync(&priv->work);
+ if (priv->chip->use_of_thermal)
+ thermal_remove_hwmon_sysfs(priv->zone);
+ else
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index b4ba2b1dab76..f4d0ef695225 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -130,6 +130,11 @@ static void kgdboc_unregister_kbd(void)
+
+ static int kgdboc_option_setup(char *opt)
+ {
++ if (!opt) {
++ pr_err("kgdboc: config string not provided\n");
++ return -EINVAL;
++ }
++
+ if (strlen(opt) >= MAX_CONFIG_LEN) {
+ printk(KERN_ERR "kgdboc: config string too long\n");
+ return -ENOSPC;
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 5f1183b0b89d..476ec4b1b86c 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1551,7 +1551,7 @@ static void csi_K(struct vc_data *vc, int vpar)
+ scr_memsetw(start + offset, vc->vc_video_erase_char, 2 * count);
+ vc->vc_need_wrap = 0;
+ if (con_should_update(vc))
+- do_update_region(vc, (unsigned long) start, count);
++ do_update_region(vc, (unsigned long)(start + offset), count);
+ }
+
+ static void csi_X(struct vc_data *vc, int vpar) /* erase the following vpar positions */
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index 70a7981b94b3..9916edda5271 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -274,6 +274,8 @@ static struct class uio_class = {
+ .dev_groups = uio_groups,
+ };
+
++bool uio_class_registered;
++
+ /*
+ * device functions
+ */
+@@ -876,6 +878,9 @@ static int init_uio_class(void)
+ printk(KERN_ERR "class_register failed for uio\n");
+ goto err_class_register;
+ }
++
++ uio_class_registered = true;
++
+ return 0;
+
+ err_class_register:
+@@ -886,6 +891,7 @@ exit:
+
+ static void release_uio_class(void)
+ {
++ uio_class_registered = false;
+ class_unregister(&uio_class);
+ uio_major_cleanup();
+ }
+@@ -912,6 +918,9 @@ int __uio_register_device(struct module *owner,
+ struct uio_device *idev;
+ int ret = 0;
+
++ if (!uio_class_registered)
++ return -EPROBE_DEFER;
++
+ if (!parent || !info || !info->name || !info->version)
+ return -EINVAL;
+
+diff --git a/drivers/usb/chipidea/otg.h b/drivers/usb/chipidea/otg.h
+index 7e7428e48bfa..4f8b8179ec96 100644
+--- a/drivers/usb/chipidea/otg.h
++++ b/drivers/usb/chipidea/otg.h
+@@ -17,7 +17,8 @@ void ci_handle_vbus_change(struct ci_hdrc *ci);
+ static inline void ci_otg_queue_work(struct ci_hdrc *ci)
+ {
+ disable_irq_nosync(ci->irq);
+- queue_work(ci->wq, &ci->work);
++ if (queue_work(ci->wq, &ci->work) == false)
++ enable_irq(ci->irq);
+ }
+
+ #endif /* __DRIVERS_USB_CHIPIDEA_OTG_H */
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 2bd6e6bfc241..260010abf9d8 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -4393,6 +4393,7 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
+ struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd);
+ struct usb_bus *bus = hcd_to_bus(hcd);
+ unsigned long flags;
++ int ret;
+
+ dev_dbg(hsotg->dev, "DWC OTG HCD START\n");
+
+@@ -4408,6 +4409,13 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
+
+ dwc2_hcd_reinit(hsotg);
+
++ /* enable external vbus supply before resuming root hub */
++ spin_unlock_irqrestore(&hsotg->lock, flags);
++ ret = dwc2_vbus_supply_init(hsotg);
++ if (ret)
++ return ret;
++ spin_lock_irqsave(&hsotg->lock, flags);
++
+ /* Initialize and connect root hub if one is not already attached */
+ if (bus->root_hub) {
+ dev_dbg(hsotg->dev, "DWC OTG HCD Has Root Hub\n");
+@@ -4417,7 +4425,7 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
+
+ spin_unlock_irqrestore(&hsotg->lock, flags);
+
+- return dwc2_vbus_supply_init(hsotg);
++ return 0;
+ }
+
+ /*
+@@ -4482,7 +4490,9 @@ static int _dwc2_hcd_suspend(struct usb_hcd *hcd)
+ hprt0 |= HPRT0_SUSP;
+ hprt0 &= ~HPRT0_PWR;
+ dwc2_writel(hsotg, hprt0, HPRT0);
++ spin_unlock_irqrestore(&hsotg->lock, flags);
+ dwc2_vbus_supply_exit(hsotg);
++ spin_lock_irqsave(&hsotg->lock, flags);
+ }
+
+ /* Enter partial_power_down */
+diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
+index 17147b8c771e..8f267be1745d 100644
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -2017,6 +2017,8 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev,
+
+ udc->errata = match->data;
+ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9g45-pmc");
++ if (IS_ERR(udc->pmc))
++ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9rl-pmc");
+ if (IS_ERR(udc->pmc))
+ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9x5-pmc");
+ if (udc->errata && IS_ERR(udc->pmc))
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index e1656f361e08..67d8a501d994 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2437,6 +2437,9 @@ static ssize_t renesas_usb3_b_device_write(struct file *file,
+ else
+ usb3->forced_b_device = false;
+
++ if (usb3->workaround_for_vbus)
++ usb3_disconnect(usb3);
++
+ /* Let this driver call usb3_connect() anyway */
+ usb3_check_id(usb3);
+
+diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
+index e98673954020..ec6739ef3129 100644
+--- a/drivers/usb/host/ohci-at91.c
++++ b/drivers/usb/host/ohci-at91.c
+@@ -551,6 +551,8 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
+ pdata->overcurrent_pin[i] =
+ devm_gpiod_get_index_optional(&pdev->dev, "atmel,oc",
+ i, GPIOD_IN);
++ if (!pdata->overcurrent_pin[i])
++ continue;
+ if (IS_ERR(pdata->overcurrent_pin[i])) {
+ err = PTR_ERR(pdata->overcurrent_pin[i]);
+ dev_err(&pdev->dev, "unable to claim gpio \"overcurrent\": %d\n", err);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 7e2a531ba321..12eea73d9f20 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -900,6 +900,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ set_bit(wIndex, &bus_state->resuming_ports);
+ bus_state->resume_done[wIndex] = timeout;
+ mod_timer(&hcd->rh_timer, timeout);
++ usb_hcd_start_port_resume(&hcd->self, wIndex);
+ }
+ /* Has resume been signalled for USB_RESUME_TIME yet? */
+ } else if (time_after_eq(jiffies,
+@@ -940,6 +941,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ clear_bit(wIndex, &bus_state->rexit_ports);
+ }
+
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ bus_state->port_c_suspend |= 1 << wIndex;
+ bus_state->suspended_ports &= ~(1 << wIndex);
+ } else {
+@@ -962,6 +964,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
+ bus_state->resume_done[wIndex] = 0;
+ clear_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ }
+
+
+@@ -1337,6 +1340,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ goto error;
+
+ set_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_start_port_resume(&hcd->self, wIndex);
+ xhci_set_link_state(xhci, ports[wIndex],
+ XDEV_RESUME);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+@@ -1345,6 +1349,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ xhci_set_link_state(xhci, ports[wIndex],
+ XDEV_U0);
+ clear_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ }
+ bus_state->port_c_suspend |= 1 << wIndex;
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index f0a99aa0ac58..cd4659703647 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1602,6 +1602,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ mod_timer(&hcd->rh_timer,
+ bus_state->resume_done[hcd_portnum]);
++ usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
+ bogus_port_status = true;
+ }
+ }
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index 4f1f4215f3d6..c74cc9c309b1 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -1430,8 +1430,8 @@ static enum pdo_err tcpm_caps_err(struct tcpm_port *port, const u32 *pdo,
+ if (pdo_apdo_type(pdo[i]) != APDO_TYPE_PPS)
+ break;
+
+- if (pdo_pps_apdo_max_current(pdo[i]) <
+- pdo_pps_apdo_max_current(pdo[i - 1]))
++ if (pdo_pps_apdo_max_voltage(pdo[i]) <
++ pdo_pps_apdo_max_voltage(pdo[i - 1]))
+ return PDO_ERR_PPS_APDO_NOT_SORTED;
+ else if (pdo_pps_apdo_min_voltage(pdo[i]) ==
+ pdo_pps_apdo_min_voltage(pdo[i - 1]) &&
+@@ -4116,6 +4116,9 @@ static int tcpm_pps_set_op_curr(struct tcpm_port *port, u16 op_curr)
+ goto port_unlock;
+ }
+
++ /* Round down operating current to align with PPS valid steps */
++ op_curr = op_curr - (op_curr % RDO_PROG_CURR_MA_STEP);
++
+ reinit_completion(&port->pps_complete);
+ port->pps_data.op_curr = op_curr;
+ port->pps_status = 0;
+@@ -4169,6 +4172,9 @@ static int tcpm_pps_set_out_volt(struct tcpm_port *port, u16 out_volt)
+ goto port_unlock;
+ }
+
++ /* Round down output voltage to align with PPS valid steps */
++ out_volt = out_volt - (out_volt % RDO_PROG_VOLT_MV_STEP);
++
+ reinit_completion(&port->pps_complete);
+ port->pps_data.out_volt = out_volt;
+ port->pps_status = 0;
+diff --git a/drivers/usb/usbip/vudc_main.c b/drivers/usb/usbip/vudc_main.c
+index 3fc22037a82f..390733e6937e 100644
+--- a/drivers/usb/usbip/vudc_main.c
++++ b/drivers/usb/usbip/vudc_main.c
+@@ -73,6 +73,10 @@ static int __init init(void)
+ cleanup:
+ list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) {
+ list_del(&udc_dev->dev_entry);
++ /*
++ * Just do platform_device_del() here, put_vudc_device()
++ * calls the platform_device_put()
++ */
+ platform_device_del(udc_dev->pdev);
+ put_vudc_device(udc_dev);
+ }
+@@ -89,7 +93,11 @@ static void __exit cleanup(void)
+
+ list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) {
+ list_del(&udc_dev->dev_entry);
+- platform_device_unregister(udc_dev->pdev);
++ /*
++ * Just do platform_device_del() here, put_vudc_device()
++ * calls the platform_device_put()
++ */
++ platform_device_del(udc_dev->pdev);
+ put_vudc_device(udc_dev);
+ }
+ platform_driver_unregister(&vudc_driver);
+diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c
+index 38716eb50408..8a3e8f61b991 100644
+--- a/drivers/video/hdmi.c
++++ b/drivers/video/hdmi.c
+@@ -592,10 +592,10 @@ hdmi_extended_colorimetry_get_name(enum hdmi_extended_colorimetry ext_col)
+ return "xvYCC 709";
+ case HDMI_EXTENDED_COLORIMETRY_S_YCC_601:
+ return "sYCC 601";
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601:
+- return "Adobe YCC 601";
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB:
+- return "Adobe RGB";
++ case HDMI_EXTENDED_COLORIMETRY_OPYCC_601:
++ return "opYCC 601";
++ case HDMI_EXTENDED_COLORIMETRY_OPRGB:
++ return "opRGB";
+ case HDMI_EXTENDED_COLORIMETRY_BT2020_CONST_LUM:
+ return "BT.2020 Constant Luminance";
+ case HDMI_EXTENDED_COLORIMETRY_BT2020:
+diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
+index 83fc9aab34e8..3099052e1243 100644
+--- a/drivers/w1/masters/omap_hdq.c
++++ b/drivers/w1/masters/omap_hdq.c
+@@ -763,6 +763,8 @@ static int omap_hdq_remove(struct platform_device *pdev)
+ /* remove module dependency */
+ pm_runtime_disable(&pdev->dev);
+
++ w1_remove_master_device(&omap_w1_master);
++
+ return 0;
+ }
+
+diff --git a/drivers/xen/privcmd-buf.c b/drivers/xen/privcmd-buf.c
+index df1ed37c3269..de01a6d0059d 100644
+--- a/drivers/xen/privcmd-buf.c
++++ b/drivers/xen/privcmd-buf.c
+@@ -21,15 +21,9 @@
+
+ MODULE_LICENSE("GPL");
+
+-static unsigned int limit = 64;
+-module_param(limit, uint, 0644);
+-MODULE_PARM_DESC(limit, "Maximum number of pages that may be allocated by "
+- "the privcmd-buf device per open file");
+-
+ struct privcmd_buf_private {
+ struct mutex lock;
+ struct list_head list;
+- unsigned int allocated;
+ };
+
+ struct privcmd_buf_vma_private {
+@@ -60,13 +54,10 @@ static void privcmd_buf_vmapriv_free(struct privcmd_buf_vma_private *vma_priv)
+ {
+ unsigned int i;
+
+- vma_priv->file_priv->allocated -= vma_priv->n_pages;
+-
+ list_del(&vma_priv->list);
+
+ for (i = 0; i < vma_priv->n_pages; i++)
+- if (vma_priv->pages[i])
+- __free_page(vma_priv->pages[i]);
++ __free_page(vma_priv->pages[i]);
+
+ kfree(vma_priv);
+ }
+@@ -146,8 +137,7 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
+ unsigned int i;
+ int ret = 0;
+
+- if (!(vma->vm_flags & VM_SHARED) || count > limit ||
+- file_priv->allocated + count > limit)
++ if (!(vma->vm_flags & VM_SHARED))
+ return -EINVAL;
+
+ vma_priv = kzalloc(sizeof(*vma_priv) + count * sizeof(void *),
+@@ -155,19 +145,15 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
+ if (!vma_priv)
+ return -ENOMEM;
+
+- vma_priv->n_pages = count;
+- count = 0;
+- for (i = 0; i < vma_priv->n_pages; i++) {
++ for (i = 0; i < count; i++) {
+ vma_priv->pages[i] = alloc_page(GFP_KERNEL | __GFP_ZERO);
+ if (!vma_priv->pages[i])
+ break;
+- count++;
++ vma_priv->n_pages++;
+ }
+
+ mutex_lock(&file_priv->lock);
+
+- file_priv->allocated += count;
+-
+ vma_priv->file_priv = file_priv;
+ vma_priv->users = 1;
+
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index a6f9ba85dc4b..aa081f806728 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -303,6 +303,9 @@ xen_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
+ */
+ flags &= ~(__GFP_DMA | __GFP_HIGHMEM);
+
++ /* Convert the size to actually allocated. */
++ size = 1UL << (order + XEN_PAGE_SHIFT);
++
+ /* On ARM this function returns an ioremap'ped virtual address for
+ * which virt_to_phys doesn't return the corresponding physical
+ * address. In fact on ARM virt_to_phys only works for kernel direct
+@@ -351,6 +354,9 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
+ * physical address */
+ phys = xen_bus_to_phys(dev_addr);
+
++ /* Convert the size to actually allocated. */
++ size = 1UL << (order + XEN_PAGE_SHIFT);
++
+ if (((dev_addr + size - 1 <= dma_mask)) ||
+ range_straddles_page_boundary(phys, size))
+ xen_destroy_contiguous_region(phys, order);
+diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
+index 63c1494a8d73..2acbfe104e46 100644
+--- a/drivers/xen/xen-balloon.c
++++ b/drivers/xen/xen-balloon.c
+@@ -76,12 +76,15 @@ static void watch_target(struct xenbus_watch *watch,
+
+ if (!watch_fired) {
+ watch_fired = true;
+- err = xenbus_scanf(XBT_NIL, "memory", "static-max", "%llu",
+- &static_max);
+- if (err != 1)
+- static_max = new_target;
+- else
++
++ if ((xenbus_scanf(XBT_NIL, "memory", "static-max",
++ "%llu", &static_max) == 1) ||
++ (xenbus_scanf(XBT_NIL, "memory", "memory_static_max",
++ "%llu", &static_max) == 1))
+ static_max >>= PAGE_SHIFT - 10;
++ else
++ static_max = new_target;
++
+ target_diff = (xen_pv_domain() || xen_initial_domain()) ? 0
+ : static_max - balloon_stats.target_pages;
+ }
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index d436fb4c002e..089b46c4d97f 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1050,9 +1050,26 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ if ((root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) && parent)
+ parent_start = parent->start;
+
++ /*
++ * If we are COWing a node/leaf from the extent, chunk or device trees,
++ * make sure that we do not finish block group creation of pending block
++ * groups. We do this to avoid a deadlock.
++ * COWing can result in allocation of a new chunk, and flushing pending
++ * block groups (btrfs_create_pending_block_groups()) can be triggered
++ * when finishing allocation of a new chunk. Creation of a pending block
++ * group modifies the extent, chunk and device trees, therefore we could
++ * deadlock with ourselves since we are holding a lock on an extent
++ * buffer that btrfs_create_pending_block_groups() may try to COW later.
++ */
++ if (root == fs_info->extent_root ||
++ root == fs_info->chunk_root ||
++ root == fs_info->dev_root)
++ trans->can_flush_pending_bgs = false;
++
+ cow = btrfs_alloc_tree_block(trans, root, parent_start,
+ root->root_key.objectid, &disk_key, level,
+ search_start, empty_size);
++ trans->can_flush_pending_bgs = true;
+ if (IS_ERR(cow))
+ return PTR_ERR(cow);
+
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index dec01970d8c5..981434764bb9 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -440,6 +440,7 @@ int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
+ break;
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED:
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED:
++ ASSERT(0);
+ ret = BTRFS_IOCTL_DEV_REPLACE_RESULT_ALREADY_STARTED;
+ goto leave;
+ }
+@@ -482,6 +483,10 @@ int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
+ if (IS_ERR(trans)) {
+ ret = PTR_ERR(trans);
+ btrfs_dev_replace_write_lock(dev_replace);
++ dev_replace->replace_state =
++ BTRFS_IOCTL_DEV_REPLACE_STATE_NEVER_STARTED;
++ dev_replace->srcdev = NULL;
++ dev_replace->tgtdev = NULL;
+ goto leave;
+ }
+
+@@ -503,8 +508,6 @@ int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
+ return ret;
+
+ leave:
+- dev_replace->srcdev = NULL;
+- dev_replace->tgtdev = NULL;
+ btrfs_dev_replace_write_unlock(dev_replace);
+ btrfs_destroy_dev_replace_tgtdev(tgt_device);
+ return ret;
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 2d9074295d7f..51e41e53d4ae 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2366,6 +2366,9 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans,
+ insert_reserved);
+ else
+ BUG();
++ if (ret && insert_reserved)
++ btrfs_pin_extent(trans->fs_info, node->bytenr,
++ node->num_bytes, 1);
+ return ret;
+ }
+
+@@ -2911,7 +2914,6 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_ref_head *head;
+ int ret;
+ int run_all = count == (unsigned long)-1;
+- bool can_flush_pending_bgs = trans->can_flush_pending_bgs;
+
+ /* We'll clean this up in btrfs_cleanup_transaction */
+ if (trans->aborted)
+@@ -2928,7 +2930,6 @@ again:
+ #ifdef SCRAMBLE_DELAYED_REFS
+ delayed_refs->run_delayed_start = find_middle(&delayed_refs->root);
+ #endif
+- trans->can_flush_pending_bgs = false;
+ ret = __btrfs_run_delayed_refs(trans, count);
+ if (ret < 0) {
+ btrfs_abort_transaction(trans, ret);
+@@ -2959,7 +2960,6 @@ again:
+ goto again;
+ }
+ out:
+- trans->can_flush_pending_bgs = can_flush_pending_bgs;
+ return 0;
+ }
+
+@@ -4533,6 +4533,7 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans, u64 flags,
+ goto out;
+ } else {
+ ret = 1;
++ space_info->max_extent_size = 0;
+ }
+
+ space_info->force_alloc = CHUNK_ALLOC_NO_FORCE;
+@@ -4554,11 +4555,9 @@ out:
+ * the block groups that were made dirty during the lifetime of the
+ * transaction.
+ */
+- if (trans->can_flush_pending_bgs &&
+- trans->chunk_bytes_reserved >= (u64)SZ_2M) {
++ if (trans->chunk_bytes_reserved >= (u64)SZ_2M)
+ btrfs_create_pending_block_groups(trans);
+- btrfs_trans_release_chunk_metadata(trans);
+- }
++
+ return ret;
+ }
+
+@@ -6436,6 +6435,7 @@ static int btrfs_free_reserved_bytes(struct btrfs_block_group_cache *cache,
+ space_info->bytes_readonly += num_bytes;
+ cache->reserved -= num_bytes;
+ space_info->bytes_reserved -= num_bytes;
++ space_info->max_extent_size = 0;
+
+ if (delalloc)
+ cache->delalloc_bytes -= num_bytes;
+@@ -7233,6 +7233,7 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info,
+ struct btrfs_block_group_cache *block_group = NULL;
+ u64 search_start = 0;
+ u64 max_extent_size = 0;
++ u64 max_free_space = 0;
+ u64 empty_cluster = 0;
+ struct btrfs_space_info *space_info;
+ int loop = 0;
+@@ -7528,8 +7529,8 @@ unclustered_alloc:
+ spin_lock(&ctl->tree_lock);
+ if (ctl->free_space <
+ num_bytes + empty_cluster + empty_size) {
+- if (ctl->free_space > max_extent_size)
+- max_extent_size = ctl->free_space;
++ max_free_space = max(max_free_space,
++ ctl->free_space);
+ spin_unlock(&ctl->tree_lock);
+ goto loop;
+ }
+@@ -7696,6 +7697,8 @@ loop:
+ }
+ out:
+ if (ret == -ENOSPC) {
++ if (!max_extent_size)
++ max_extent_size = max_free_space;
+ spin_lock(&space_info->lock);
+ space_info->max_extent_size = max_extent_size;
+ spin_unlock(&space_info->lock);
+@@ -7977,21 +7980,14 @@ static int alloc_reserved_tree_block(struct btrfs_trans_handle *trans,
+ }
+
+ path = btrfs_alloc_path();
+- if (!path) {
+- btrfs_free_and_pin_reserved_extent(fs_info,
+- extent_key.objectid,
+- fs_info->nodesize);
++ if (!path)
+ return -ENOMEM;
+- }
+
+ path->leave_spinning = 1;
+ ret = btrfs_insert_empty_item(trans, fs_info->extent_root, path,
+ &extent_key, size);
+ if (ret) {
+ btrfs_free_path(path);
+- btrfs_free_and_pin_reserved_extent(fs_info,
+- extent_key.objectid,
+- fs_info->nodesize);
+ return ret;
+ }
+
+@@ -8119,6 +8115,19 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ if (IS_ERR(buf))
+ return buf;
+
++ /*
++ * Extra safety check in case the extent tree is corrupted and extent
++ * allocator chooses to use a tree block which is already used and
++ * locked.
++ */
++ if (buf->lock_owner == current->pid) {
++ btrfs_err_rl(fs_info,
++"tree block %llu owner %llu already locked by pid=%d, extent tree corruption detected",
++ buf->start, btrfs_header_owner(buf), current->pid);
++ free_extent_buffer(buf);
++ return ERR_PTR(-EUCLEAN);
++ }
++
+ btrfs_set_buffer_lockdep_class(root->root_key.objectid, buf, level);
+ btrfs_tree_lock(buf);
+ clean_tree_block(fs_info, buf);
+@@ -8763,15 +8772,14 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans,
+ if (eb == root->node) {
+ if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF)
+ parent = eb->start;
+- else
+- BUG_ON(root->root_key.objectid !=
+- btrfs_header_owner(eb));
++ else if (root->root_key.objectid != btrfs_header_owner(eb))
++ goto owner_mismatch;
+ } else {
+ if (wc->flags[level + 1] & BTRFS_BLOCK_FLAG_FULL_BACKREF)
+ parent = path->nodes[level + 1]->start;
+- else
+- BUG_ON(root->root_key.objectid !=
+- btrfs_header_owner(path->nodes[level + 1]));
++ else if (root->root_key.objectid !=
++ btrfs_header_owner(path->nodes[level + 1]))
++ goto owner_mismatch;
+ }
+
+ btrfs_free_tree_block(trans, root, eb, parent, wc->refs[level] == 1);
+@@ -8779,6 +8787,11 @@ out:
+ wc->refs[level] = 0;
+ wc->flags[level] = 0;
+ return 0;
++
++owner_mismatch:
++ btrfs_err_rl(fs_info, "unexpected tree owner, have %llu expect %llu",
++ btrfs_header_owner(eb), root->root_key.objectid);
++ return -EUCLEAN;
+ }
+
+ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
+@@ -8832,6 +8845,8 @@ static noinline int walk_up_tree(struct btrfs_trans_handle *trans,
+ ret = walk_up_proc(trans, root, path, wc);
+ if (ret > 0)
+ return 0;
++ if (ret < 0)
++ return ret;
+
+ if (path->locks[level]) {
+ btrfs_tree_unlock_rw(path->nodes[level],
+@@ -9613,6 +9628,7 @@ void btrfs_put_block_group_cache(struct btrfs_fs_info *info)
+
+ block_group = btrfs_lookup_first_block_group(info, last);
+ while (block_group) {
++ wait_block_group_cache_done(block_group);
+ spin_lock(&block_group->lock);
+ if (block_group->iref)
+ break;
+@@ -10074,15 +10090,19 @@ error:
+ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans)
+ {
+ struct btrfs_fs_info *fs_info = trans->fs_info;
+- struct btrfs_block_group_cache *block_group, *tmp;
++ struct btrfs_block_group_cache *block_group;
+ struct btrfs_root *extent_root = fs_info->extent_root;
+ struct btrfs_block_group_item item;
+ struct btrfs_key key;
+ int ret = 0;
+- bool can_flush_pending_bgs = trans->can_flush_pending_bgs;
+
+- trans->can_flush_pending_bgs = false;
+- list_for_each_entry_safe(block_group, tmp, &trans->new_bgs, bg_list) {
++ if (!trans->can_flush_pending_bgs)
++ return;
++
++ while (!list_empty(&trans->new_bgs)) {
++ block_group = list_first_entry(&trans->new_bgs,
++ struct btrfs_block_group_cache,
++ bg_list);
+ if (ret)
+ goto next;
+
+@@ -10103,7 +10123,7 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans)
+ next:
+ list_del_init(&block_group->bg_list);
+ }
+- trans->can_flush_pending_bgs = can_flush_pending_bgs;
++ btrfs_trans_release_chunk_metadata(trans);
+ }
+
+ int btrfs_make_block_group(struct btrfs_trans_handle *trans, u64 bytes_used,
+@@ -10753,14 +10773,16 @@ int btrfs_error_unpin_extent_range(struct btrfs_fs_info *fs_info,
+ * We don't want a transaction for this since the discard may take a
+ * substantial amount of time. We don't require that a transaction be
+ * running, but we do need to take a running transaction into account
+- * to ensure that we're not discarding chunks that were released in
+- * the current transaction.
++ * to ensure that we're not discarding chunks that were released or
++ * allocated in the current transaction.
+ *
+ * Holding the chunks lock will prevent other threads from allocating
+ * or releasing chunks, but it won't prevent a running transaction
+ * from committing and releasing the memory that the pending chunks
+ * list head uses. For that, we need to take a reference to the
+- * transaction.
++ * transaction and hold the commit root sem. We only need to hold
++ * it while performing the free space search since we have already
++ * held back allocations.
+ */
+ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ u64 minlen, u64 *trimmed)
+@@ -10770,6 +10792,10 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+
+ *trimmed = 0;
+
++ /* Discard not supported = nothing to do. */
++ if (!blk_queue_discard(bdev_get_queue(device->bdev)))
++ return 0;
++
+ /* Not writeable = nothing to do. */
+ if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state))
+ return 0;
+@@ -10787,9 +10813,13 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+
+ ret = mutex_lock_interruptible(&fs_info->chunk_mutex);
+ if (ret)
+- return ret;
++ break;
+
+- down_read(&fs_info->commit_root_sem);
++ ret = down_read_killable(&fs_info->commit_root_sem);
++ if (ret) {
++ mutex_unlock(&fs_info->chunk_mutex);
++ break;
++ }
+
+ spin_lock(&fs_info->trans_lock);
+ trans = fs_info->running_transaction;
+@@ -10797,13 +10827,17 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ refcount_inc(&trans->use_count);
+ spin_unlock(&fs_info->trans_lock);
+
++ if (!trans)
++ up_read(&fs_info->commit_root_sem);
++
+ ret = find_free_dev_extent_start(trans, device, minlen, start,
+ &start, &len);
+- if (trans)
++ if (trans) {
++ up_read(&fs_info->commit_root_sem);
+ btrfs_put_transaction(trans);
++ }
+
+ if (ret) {
+- up_read(&fs_info->commit_root_sem);
+ mutex_unlock(&fs_info->chunk_mutex);
+ if (ret == -ENOSPC)
+ ret = 0;
+@@ -10811,7 +10845,6 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ }
+
+ ret = btrfs_issue_discard(device->bdev, start, len, &bytes);
+- up_read(&fs_info->commit_root_sem);
+ mutex_unlock(&fs_info->chunk_mutex);
+
+ if (ret)
+@@ -10831,6 +10864,15 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ return ret;
+ }
+
++/*
++ * Trim the whole filesystem by:
++ * 1) trimming the free space in each block group
++ * 2) trimming the unallocated space on each device
++ *
++ * This will also continue trimming even if a block group or device encounters
++ * an error. The return value will be the last error, or 0 if nothing bad
++ * happens.
++ */
+ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ {
+ struct btrfs_block_group_cache *cache = NULL;
+@@ -10840,18 +10882,14 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ u64 start;
+ u64 end;
+ u64 trimmed = 0;
+- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
++ u64 bg_failed = 0;
++ u64 dev_failed = 0;
++ int bg_ret = 0;
++ int dev_ret = 0;
+ int ret = 0;
+
+- /*
+- * try to trim all FS space, our block group may start from non-zero.
+- */
+- if (range->len == total_bytes)
+- cache = btrfs_lookup_first_block_group(fs_info, range->start);
+- else
+- cache = btrfs_lookup_block_group(fs_info, range->start);
+-
+- while (cache) {
++ cache = btrfs_lookup_first_block_group(fs_info, range->start);
++ for (; cache; cache = next_block_group(fs_info, cache)) {
+ if (cache->key.objectid >= (range->start + range->len)) {
+ btrfs_put_block_group(cache);
+ break;
+@@ -10865,13 +10903,15 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ if (!block_group_cache_done(cache)) {
+ ret = cache_block_group(cache, 0);
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ ret = wait_block_group_cache_done(cache);
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ }
+ ret = btrfs_trim_block_group(cache,
+@@ -10882,28 +10922,40 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+
+ trimmed += group_trimmed;
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ }
+-
+- cache = next_block_group(fs_info, cache);
+ }
+
++ if (bg_failed)
++ btrfs_warn(fs_info,
++ "failed to trim %llu block group(s), last error %d",
++ bg_failed, bg_ret);
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+- devices = &fs_info->fs_devices->alloc_list;
+- list_for_each_entry(device, devices, dev_alloc_list) {
++ devices = &fs_info->fs_devices->devices;
++ list_for_each_entry(device, devices, dev_list) {
+ ret = btrfs_trim_free_extents(device, range->minlen,
+ &group_trimmed);
+- if (ret)
++ if (ret) {
++ dev_failed++;
++ dev_ret = ret;
+ break;
++ }
+
+ trimmed += group_trimmed;
+ }
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+
++ if (dev_failed)
++ btrfs_warn(fs_info,
++ "failed to trim %llu device(s), last error %d",
++ dev_failed, dev_ret);
+ range->len = trimmed;
+- return ret;
++ if (bg_ret)
++ return bg_ret;
++ return dev_ret;
+ }
+
+ /*
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 2be00e873e92..7d81cc415264 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -531,6 +531,14 @@ int btrfs_dirty_pages(struct inode *inode, struct page **pages,
+
+ end_of_last_block = start_pos + num_bytes - 1;
+
++ /*
++ * The pages may have already been dirty, clear out old accounting so
++ * we can set things up properly
++ */
++ clear_extent_bit(&BTRFS_I(inode)->io_tree, start_pos, end_of_last_block,
++ EXTENT_DIRTY | EXTENT_DELALLOC |
++ EXTENT_DO_ACCOUNTING | EXTENT_DEFRAG, 0, 0, cached);
++
+ if (!btrfs_is_free_space_inode(BTRFS_I(inode))) {
+ if (start_pos >= isize &&
+ !(BTRFS_I(inode)->flags & BTRFS_INODE_PREALLOC)) {
+@@ -1500,18 +1508,27 @@ lock_and_cleanup_extent_if_need(struct btrfs_inode *inode, struct page **pages,
+ }
+ if (ordered)
+ btrfs_put_ordered_extent(ordered);
+- clear_extent_bit(&inode->io_tree, start_pos, last_pos,
+- EXTENT_DIRTY | EXTENT_DELALLOC |
+- EXTENT_DO_ACCOUNTING | EXTENT_DEFRAG,
+- 0, 0, cached_state);
++
+ *lockstart = start_pos;
+ *lockend = last_pos;
+ ret = 1;
+ }
+
++ /*
++ * It's possible the pages are dirty right now, but we don't want
++ * to clean them yet because copy_from_user may catch a page fault
++ * and we might have to fall back to one page at a time. If that
++ * happens, we'll unlock these pages and we'd have a window where
++ * reclaim could sneak in and drop the once-dirty page on the floor
++ * without writing it.
++ *
++ * We have the pages locked and the extent range locked, so there's
++ * no way someone can start IO on any dirty pages in this range.
++ *
++ * We'll call btrfs_dirty_pages() later on, and that will flip around
++ * delalloc bits and dirty the pages as required.
++ */
+ for (i = 0; i < num_pages; i++) {
+- if (clear_page_dirty_for_io(pages[i]))
+- account_page_redirty(pages[i]);
+ set_page_extent_mapped(pages[i]);
+ WARN_ON(!PageLocked(pages[i]));
+ }
+@@ -2061,6 +2078,14 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ goto out;
+
+ inode_lock(inode);
++
++ /*
++ * We take the dio_sem here because the tree log stuff can race with
++ * lockless dio writes and get an extent map logged for an extent we
++ * never waited on. We need it this high up for lockdep reasons.
++ */
++ down_write(&BTRFS_I(inode)->dio_sem);
++
+ atomic_inc(&root->log_batch);
+
+ /*
+@@ -2069,6 +2094,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ */
+ ret = btrfs_wait_ordered_range(inode, start, len);
+ if (ret) {
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+ goto out;
+ }
+@@ -2092,6 +2118,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ * checked called fsync.
+ */
+ ret = filemap_check_wb_err(inode->i_mapping, file->f_wb_err);
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+ goto out;
+ }
+@@ -2110,6 +2137,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ trans = btrfs_start_transaction(root, 0);
+ if (IS_ERR(trans)) {
+ ret = PTR_ERR(trans);
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+ goto out;
+ }
+@@ -2131,6 +2159,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ * file again, but that will end up using the synchronization
+ * inside btrfs_sync_log to keep things safe.
+ */
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+
+ /*
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index 0adf38b00fa0..8ecf8c0e5fe6 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -10,6 +10,7 @@
+ #include <linux/math64.h>
+ #include <linux/ratelimit.h>
+ #include <linux/error-injection.h>
++#include <linux/sched/mm.h>
+ #include "ctree.h"
+ #include "free-space-cache.h"
+ #include "transaction.h"
+@@ -47,6 +48,7 @@ static struct inode *__lookup_free_space_inode(struct btrfs_root *root,
+ struct btrfs_free_space_header *header;
+ struct extent_buffer *leaf;
+ struct inode *inode = NULL;
++ unsigned nofs_flag;
+ int ret;
+
+ key.objectid = BTRFS_FREE_SPACE_OBJECTID;
+@@ -68,7 +70,13 @@ static struct inode *__lookup_free_space_inode(struct btrfs_root *root,
+ btrfs_disk_key_to_cpu(&location, &disk_key);
+ btrfs_release_path(path);
+
++ /*
++ * We are often under a trans handle at this point, so we need to make
++ * sure NOFS is set to keep us from deadlocking.
++ */
++ nofs_flag = memalloc_nofs_save();
+ inode = btrfs_iget(fs_info->sb, &location, root, NULL);
++ memalloc_nofs_restore(nofs_flag);
+ if (IS_ERR(inode))
+ return inode;
+
+@@ -1679,6 +1687,8 @@ static inline void __bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
+ bitmap_clear(info->bitmap, start, count);
+
+ info->bytes -= bytes;
++ if (info->max_extent_size > ctl->unit)
++ info->max_extent_size = 0;
+ }
+
+ static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
+@@ -1762,6 +1772,13 @@ static int search_bitmap(struct btrfs_free_space_ctl *ctl,
+ return -1;
+ }
+
++static inline u64 get_max_extent_size(struct btrfs_free_space *entry)
++{
++ if (entry->bitmap)
++ return entry->max_extent_size;
++ return entry->bytes;
++}
++
+ /* Cache the size of the max extent in bytes */
+ static struct btrfs_free_space *
+ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+@@ -1783,8 +1800,8 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+ for (node = &entry->offset_index; node; node = rb_next(node)) {
+ entry = rb_entry(node, struct btrfs_free_space, offset_index);
+ if (entry->bytes < *bytes) {
+- if (entry->bytes > *max_extent_size)
+- *max_extent_size = entry->bytes;
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+ continue;
+ }
+
+@@ -1802,8 +1819,8 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+ }
+
+ if (entry->bytes < *bytes + align_off) {
+- if (entry->bytes > *max_extent_size)
+- *max_extent_size = entry->bytes;
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+ continue;
+ }
+
+@@ -1815,8 +1832,10 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+ *offset = tmp;
+ *bytes = size;
+ return entry;
+- } else if (size > *max_extent_size) {
+- *max_extent_size = size;
++ } else {
++ *max_extent_size =
++ max(get_max_extent_size(entry),
++ *max_extent_size);
+ }
+ continue;
+ }
+@@ -2440,6 +2459,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
+ struct rb_node *n;
+ int count = 0;
+
++ spin_lock(&ctl->tree_lock);
+ for (n = rb_first(&ctl->free_space_offset); n; n = rb_next(n)) {
+ info = rb_entry(n, struct btrfs_free_space, offset_index);
+ if (info->bytes >= bytes && !block_group->ro)
+@@ -2448,6 +2468,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
+ info->offset, info->bytes,
+ (info->bitmap) ? "yes" : "no");
+ }
++ spin_unlock(&ctl->tree_lock);
+ btrfs_info(fs_info, "block group has cluster?: %s",
+ list_empty(&block_group->cluster_list) ? "no" : "yes");
+ btrfs_info(fs_info,
+@@ -2676,8 +2697,8 @@ static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
+
+ err = search_bitmap(ctl, entry, &search_start, &search_bytes, true);
+ if (err) {
+- if (search_bytes > *max_extent_size)
+- *max_extent_size = search_bytes;
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+ return 0;
+ }
+
+@@ -2714,8 +2735,9 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
+
+ entry = rb_entry(node, struct btrfs_free_space, offset_index);
+ while (1) {
+- if (entry->bytes < bytes && entry->bytes > *max_extent_size)
+- *max_extent_size = entry->bytes;
++ if (entry->bytes < bytes)
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+
+ if (entry->bytes < bytes ||
+ (!entry->bitmap && entry->offset < min_start)) {
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 3ea5339603cf..83268d8f48c4 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -503,6 +503,7 @@ again:
+ pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS);
+ if (!pages) {
+ /* just bail out to the uncompressed code */
++ nr_pages = 0;
+ goto cont;
+ }
+
+@@ -2944,6 +2945,7 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
+ bool truncated = false;
+ bool range_locked = false;
+ bool clear_new_delalloc_bytes = false;
++ bool clear_reserved_extent = true;
+
+ if (!test_bit(BTRFS_ORDERED_NOCOW, &ordered_extent->flags) &&
+ !test_bit(BTRFS_ORDERED_PREALLOC, &ordered_extent->flags) &&
+@@ -3047,10 +3049,12 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
+ logical_len, logical_len,
+ compress_type, 0, 0,
+ BTRFS_FILE_EXTENT_REG);
+- if (!ret)
++ if (!ret) {
++ clear_reserved_extent = false;
+ btrfs_release_delalloc_bytes(fs_info,
+ ordered_extent->start,
+ ordered_extent->disk_len);
++ }
+ }
+ unpin_extent_cache(&BTRFS_I(inode)->extent_tree,
+ ordered_extent->file_offset, ordered_extent->len,
+@@ -3111,8 +3115,13 @@ out:
+ * wrong we need to return the space for this ordered extent
+ * back to the allocator. We only free the extent in the
+ * truncated case if we didn't write out the extent at all.
++ *
++ * If we made it past insert_reserved_file_extent before we
++ * errored out then we don't need to do this as the accounting
++ * has already been done.
+ */
+ if ((ret || !logical_len) &&
++ clear_reserved_extent &&
+ !test_bit(BTRFS_ORDERED_NOCOW, &ordered_extent->flags) &&
+ !test_bit(BTRFS_ORDERED_PREALLOC, &ordered_extent->flags))
+ btrfs_free_reserved_extent(fs_info,
+@@ -5274,11 +5283,13 @@ static void evict_inode_truncate_pages(struct inode *inode)
+ struct extent_state *cached_state = NULL;
+ u64 start;
+ u64 end;
++ unsigned state_flags;
+
+ node = rb_first(&io_tree->state);
+ state = rb_entry(node, struct extent_state, rb_node);
+ start = state->start;
+ end = state->end;
++ state_flags = state->state;
+ spin_unlock(&io_tree->lock);
+
+ lock_extent_bits(io_tree, start, end, &cached_state);
+@@ -5291,7 +5302,7 @@ static void evict_inode_truncate_pages(struct inode *inode)
+ *
+ * Note, end is the bytenr of last byte, so we need + 1 here.
+ */
+- if (state->state & EXTENT_DELALLOC)
++ if (state_flags & EXTENT_DELALLOC)
+ btrfs_qgroup_free_data(inode, NULL, start, end - start + 1);
+
+ clear_extent_bit(io_tree, start, end,
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index d60b6caf09e8..bd4767f562cd 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -491,7 +491,6 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
+ struct fstrim_range range;
+ u64 minlen = ULLONG_MAX;
+ u64 num_devices = 0;
+- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
+ int ret;
+
+ if (!capable(CAP_SYS_ADMIN))
+@@ -515,11 +514,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
+ return -EOPNOTSUPP;
+ if (copy_from_user(&range, arg, sizeof(range)))
+ return -EFAULT;
+- if (range.start > total_bytes ||
+- range.len < fs_info->sb->s_blocksize)
++
++ /*
++ * NOTE: Don't truncate the range using super->total_bytes. Bytenr of
++ * block group is in the logical address space, which can be any
++ * sectorsize aligned bytenr in the range [0, U64_MAX].
++ */
++ if (range.len < fs_info->sb->s_blocksize)
+ return -EINVAL;
+
+- range.len = min(range.len, total_bytes - range.start);
+ range.minlen = max(range.minlen, minlen);
+ ret = btrfs_trim_fs(fs_info, &range);
+ if (ret < 0)
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index d4917c0cddf5..b070401406be 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2897,6 +2897,7 @@ qgroup_rescan_zero_tracking(struct btrfs_fs_info *fs_info)
+ qgroup->rfer_cmpr = 0;
+ qgroup->excl = 0;
+ qgroup->excl_cmpr = 0;
++ qgroup_dirty(fs_info, qgroup);
+ }
+ spin_unlock(&fs_info->qgroup_lock);
+ }
+@@ -3106,6 +3107,10 @@ static int __btrfs_qgroup_release_data(struct inode *inode,
+ int trace_op = QGROUP_RELEASE;
+ int ret;
+
++ if (!test_bit(BTRFS_FS_QUOTA_ENABLED,
++ &BTRFS_I(inode)->root->fs_info->flags))
++ return 0;
++
+ /* In release case, we shouldn't have @reserved */
+ WARN_ON(!free && reserved);
+ if (free && reserved)
+diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h
+index 54b8bb282c0e..4bbcc1e92a93 100644
+--- a/fs/btrfs/qgroup.h
++++ b/fs/btrfs/qgroup.h
+@@ -249,6 +249,8 @@ void btrfs_qgroup_free_refroot(struct btrfs_fs_info *fs_info,
+ static inline void btrfs_qgroup_free_delayed_ref(struct btrfs_fs_info *fs_info,
+ u64 ref_root, u64 num_bytes)
+ {
++ if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
++ return;
+ trace_btrfs_qgroup_free_delayed_ref(fs_info, ref_root, num_bytes);
+ btrfs_qgroup_free_refroot(fs_info, ref_root, num_bytes,
+ BTRFS_QGROUP_RSV_DATA);
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 8783a1776540..60bf8dfe7df4 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1281,7 +1281,7 @@ static void __del_reloc_root(struct btrfs_root *root)
+ struct mapping_node *node = NULL;
+ struct reloc_control *rc = fs_info->reloc_ctl;
+
+- if (rc) {
++ if (rc && root->node) {
+ spin_lock(&rc->reloc_root_tree.lock);
+ rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+ root->node->start);
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 3b84f5015029..bb8f6c020d22 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1929,6 +1929,9 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+ return ret;
+ }
+
++ btrfs_trans_release_metadata(trans);
++ trans->block_rsv = NULL;
++
+ /* make a pass through all the delayed refs we have so far
+ * any runnings procs may add more while we are here
+ */
+@@ -1938,9 +1941,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+ return ret;
+ }
+
+- btrfs_trans_release_metadata(trans);
+- trans->block_rsv = NULL;
+-
+ cur_trans = trans->transaction;
+
+ /*
+@@ -2280,15 +2280,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+
+ kmem_cache_free(btrfs_trans_handle_cachep, trans);
+
+- /*
+- * If fs has been frozen, we can not handle delayed iputs, otherwise
+- * it'll result in deadlock about SB_FREEZE_FS.
+- */
+- if (current != fs_info->transaction_kthread &&
+- current != fs_info->cleaner_kthread &&
+- !test_bit(BTRFS_FS_FROZEN, &fs_info->flags))
+- btrfs_run_delayed_iputs(fs_info);
+-
+ return ret;
+
+ scrub_continue:
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 3c2ae0e4f25a..d0bcfbfc0e3a 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -258,6 +258,13 @@ struct walk_control {
+ /* what stage of the replay code we're currently in */
+ int stage;
+
++ /*
++ * Ignore any items from the inode currently being processed. Needs
++ * to be set every time we find a BTRFS_INODE_ITEM_KEY and we are in
++ * the LOG_WALK_REPLAY_INODES stage.
++ */
++ bool ignore_cur_inode;
++
+ /* the root we are currently replaying */
+ struct btrfs_root *replay_dest;
+
+@@ -2487,6 +2494,20 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
+
+ inode_item = btrfs_item_ptr(eb, i,
+ struct btrfs_inode_item);
++ /*
++ * If we have a tmpfile (O_TMPFILE) that got fsync'ed
++ * and never got linked before the fsync, skip it, as
++ * replaying it is pointless since it would be deleted
++ * later. We skip logging tmpfiles, but it's always
++ * possible we are replaying a log created with a kernel
++ * that used to log tmpfiles.
++ */
++ if (btrfs_inode_nlink(eb, inode_item) == 0) {
++ wc->ignore_cur_inode = true;
++ continue;
++ } else {
++ wc->ignore_cur_inode = false;
++ }
+ ret = replay_xattr_deletes(wc->trans, root, log,
+ path, key.objectid);
+ if (ret)
+@@ -2524,16 +2545,8 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
+ root->fs_info->sectorsize);
+ ret = btrfs_drop_extents(wc->trans, root, inode,
+ from, (u64)-1, 1);
+- /*
+- * If the nlink count is zero here, the iput
+- * will free the inode. We bump it to make
+- * sure it doesn't get freed until the link
+- * count fixup is done.
+- */
+ if (!ret) {
+- if (inode->i_nlink == 0)
+- inc_nlink(inode);
+- /* Update link count and nbytes. */
++ /* Update the inode's nbytes. */
+ ret = btrfs_update_inode(wc->trans,
+ root, inode);
+ }
+@@ -2548,6 +2561,9 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
+ break;
+ }
+
++ if (wc->ignore_cur_inode)
++ continue;
++
+ if (key.type == BTRFS_DIR_INDEX_KEY &&
+ wc->stage == LOG_WALK_REPLAY_DIR_INDEX) {
+ ret = replay_one_dir_item(wc->trans, root, path,
+@@ -3196,9 +3212,12 @@ static void free_log_tree(struct btrfs_trans_handle *trans,
+ };
+
+ ret = walk_log_tree(trans, log, &wc);
+- /* I don't think this can happen but just in case */
+- if (ret)
+- btrfs_abort_transaction(trans, ret);
++ if (ret) {
++ if (trans)
++ btrfs_abort_transaction(trans, ret);
++ else
++ btrfs_handle_fs_error(log->fs_info, ret, NULL);
++ }
+
+ while (1) {
+ ret = find_first_extent_bit(&log->dirty_log_pages,
+@@ -4374,7 +4393,6 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
+
+ INIT_LIST_HEAD(&extents);
+
+- down_write(&inode->dio_sem);
+ write_lock(&tree->lock);
+ test_gen = root->fs_info->last_trans_committed;
+ logged_start = start;
+@@ -4440,7 +4458,6 @@ process:
+ }
+ WARN_ON(!list_empty(&extents));
+ write_unlock(&tree->lock);
+- up_write(&inode->dio_sem);
+
+ btrfs_release_path(path);
+ if (!ret)
+@@ -4636,7 +4653,8 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
+ ASSERT(len == i_size ||
+ (len == fs_info->sectorsize &&
+ btrfs_file_extent_compression(leaf, extent) !=
+- BTRFS_COMPRESS_NONE));
++ BTRFS_COMPRESS_NONE) ||
++ (len < i_size && i_size < fs_info->sectorsize));
+ return 0;
+ }
+
+@@ -5564,9 +5582,33 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans,
+
+ dir_inode = btrfs_iget(fs_info->sb, &inode_key,
+ root, NULL);
+- /* If parent inode was deleted, skip it. */
+- if (IS_ERR(dir_inode))
+- continue;
++ /*
++ * If the parent inode was deleted, return an error to
++ * fallback to a transaction commit. This is to prevent
++ * getting an inode that was moved from one parent A to
++ * a parent B, got its former parent A deleted and then
++ * it got fsync'ed, from existing at both parents after
++ * a log replay (and the old parent still existing).
++ * Example:
++ *
++ * mkdir /mnt/A
++ * mkdir /mnt/B
++ * touch /mnt/B/bar
++ * sync
++ * mv /mnt/B/bar /mnt/A/bar
++ * mv -T /mnt/A /mnt/B
++ * fsync /mnt/B/bar
++ * <power fail>
++ *
++ * If we ignore the old parent B which got deleted,
++ * after a log replay we would have file bar linked
++ * at both parents and the old parent B would still
++ * exist.
++ */
++ if (IS_ERR(dir_inode)) {
++ ret = PTR_ERR(dir_inode);
++ goto out;
++ }
+
+ if (ctx)
+ ctx->log_new_dentries = false;
+@@ -5640,7 +5682,13 @@ static int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
+ if (ret)
+ goto end_no_trans;
+
+- if (btrfs_inode_in_log(inode, trans->transid)) {
++ /*
++ * Skip already logged inodes or inodes corresponding to tmpfiles
++ * (since logging them is pointless, a link count of 0 means they
++ * will never be accessible).
++ */
++ if (btrfs_inode_in_log(inode, trans->transid) ||
++ inode->vfs_inode.i_nlink == 0) {
+ ret = BTRFS_NO_LOG_SYNC;
+ goto end_no_trans;
+ }
+diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
+index f1fbea947fef..06576797cf31 100644
+--- a/fs/cifs/cifs_debug.c
++++ b/fs/cifs/cifs_debug.c
+@@ -383,6 +383,9 @@ static ssize_t cifs_stats_proc_write(struct file *file,
+ atomic_set(&totBufAllocCount, 0);
+ atomic_set(&totSmBufAllocCount, 0);
+ #endif /* CONFIG_CIFS_STATS2 */
++ atomic_set(&tcpSesReconnectCount, 0);
++ atomic_set(&tconInfoReconnectCount, 0);
++
+ spin_lock(&GlobalMid_Lock);
+ GlobalMaxActiveXid = 0;
+ GlobalCurrentXid = 0;
+diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
+index b611fc2e8984..7f01c6e60791 100644
+--- a/fs/cifs/cifs_spnego.c
++++ b/fs/cifs/cifs_spnego.c
+@@ -147,8 +147,10 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo)
+ sprintf(dp, ";sec=krb5");
+ else if (server->sec_mskerberos)
+ sprintf(dp, ";sec=mskrb5");
+- else
+- goto out;
++ else {
++ cifs_dbg(VFS, "unknown or missing server auth type, use krb5\n");
++ sprintf(dp, ";sec=krb5");
++ }
+
+ dp = description + strlen(description);
+ sprintf(dp, ";uid=0x%x",
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 6e8765f44508..020f49c15b30 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -777,7 +777,15 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
+ } else if (rc == -EREMOTE) {
+ cifs_create_dfs_fattr(&fattr, sb);
+ rc = 0;
+- } else if (rc == -EACCES && backup_cred(cifs_sb)) {
++ } else if ((rc == -EACCES) && backup_cred(cifs_sb) &&
++ (strcmp(server->vals->version_string, SMB1_VERSION_STRING)
++ == 0)) {
++ /*
++ * For SMB2 and later the backup intent flag is already
++ * sent if needed on open and there is no path based
++ * FindFirst operation to use to retry with
++ */
++
+ srchinf = kzalloc(sizeof(struct cifs_search_info),
+ GFP_KERNEL);
+ if (srchinf == NULL) {
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index b48f43963da6..333729cf46cd 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -786,7 +786,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ int i, j, rc = 0;
+ int timeout, optype;
+ struct mid_q_entry *midQ[MAX_COMPOUND];
+- unsigned int credits = 1;
++ unsigned int credits = 0;
+ char *buf;
+
+ timeout = flags & CIFS_TIMEOUT_MASK;
+@@ -851,17 +851,20 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+
+ mutex_unlock(&ses->server->srv_mutex);
+
+- for (i = 0; i < num_rqst; i++) {
+- if (rc < 0)
+- goto out;
++ if (rc < 0)
++ goto out;
+
+- if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP))
+- smb311_update_preauth_hash(ses, rqst[i].rq_iov,
+- rqst[i].rq_nvec);
++ /*
++ * Compounding is never used during session establish.
++ */
++ if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP))
++ smb311_update_preauth_hash(ses, rqst[0].rq_iov,
++ rqst[0].rq_nvec);
+
+- if (timeout == CIFS_ASYNC_OP)
+- goto out;
++ if (timeout == CIFS_ASYNC_OP)
++ goto out;
+
++ for (i = 0; i < num_rqst; i++) {
+ rc = wait_for_response(ses->server, midQ[i]);
+ if (rc != 0) {
+ cifs_dbg(FYI, "Cancelling wait for mid %llu\n",
+@@ -877,10 +880,21 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ }
+ spin_unlock(&GlobalMid_Lock);
+ }
++ }
++
++ for (i = 0; i < num_rqst; i++)
++ if (midQ[i]->resp_buf)
++ credits += ses->server->ops->get_credits(midQ[i]);
++ if (!credits)
++ credits = 1;
++
++ for (i = 0; i < num_rqst; i++) {
++ if (rc < 0)
++ goto out;
+
+ rc = cifs_sync_mid_result(midQ[i], ses->server);
+ if (rc != 0) {
+- add_credits(ses->server, 1, optype);
++ add_credits(ses->server, credits, optype);
+ return rc;
+ }
+
+@@ -901,23 +915,26 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ else
+ resp_buf_type[i] = CIFS_SMALL_BUFFER;
+
+- if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) {
+- struct kvec iov = {
+- .iov_base = resp_iov[i].iov_base,
+- .iov_len = resp_iov[i].iov_len
+- };
+- smb311_update_preauth_hash(ses, &iov, 1);
+- }
+-
+- credits = ses->server->ops->get_credits(midQ[i]);
+-
+ rc = ses->server->ops->check_receive(midQ[i], ses->server,
+ flags & CIFS_LOG_ERROR);
+
+ /* mark it so buf will not be freed by cifs_delete_mid */
+ if ((flags & CIFS_NO_RESP) == 0)
+ midQ[i]->resp_buf = NULL;
++
+ }
++
++ /*
++ * Compounding is never used during session establish.
++ */
++ if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) {
++ struct kvec iov = {
++ .iov_base = resp_iov[0].iov_base,
++ .iov_len = resp_iov[0].iov_len
++ };
++ smb311_update_preauth_hash(ses, &iov, 1);
++ }
++
+ out:
+ /*
+ * This will dequeue all mids. After this it is important that the
+diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
+index f408994fc632..6e000392e4a4 100644
+--- a/fs/cramfs/inode.c
++++ b/fs/cramfs/inode.c
+@@ -202,7 +202,8 @@ static void *cramfs_blkdev_read(struct super_block *sb, unsigned int offset,
+ continue;
+ blk_offset = (blocknr - buffer_blocknr[i]) << PAGE_SHIFT;
+ blk_offset += offset;
+- if (blk_offset + len > BUFFER_SIZE)
++ if (blk_offset > BUFFER_SIZE ||
++ blk_offset + len > BUFFER_SIZE)
+ continue;
+ return read_buffers[i] + blk_offset;
+ }
+diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h
+index 39c20ef26db4..79debfc9cef9 100644
+--- a/fs/crypto/fscrypt_private.h
++++ b/fs/crypto/fscrypt_private.h
+@@ -83,10 +83,6 @@ static inline bool fscrypt_valid_enc_modes(u32 contents_mode,
+ filenames_mode == FS_ENCRYPTION_MODE_AES_256_CTS)
+ return true;
+
+- if (contents_mode == FS_ENCRYPTION_MODE_SPECK128_256_XTS &&
+- filenames_mode == FS_ENCRYPTION_MODE_SPECK128_256_CTS)
+- return true;
+-
+ return false;
+ }
+
+diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
+index e997ca51192f..7874c9bb2fc5 100644
+--- a/fs/crypto/keyinfo.c
++++ b/fs/crypto/keyinfo.c
+@@ -174,16 +174,6 @@ static struct fscrypt_mode {
+ .cipher_str = "cts(cbc(aes))",
+ .keysize = 16,
+ },
+- [FS_ENCRYPTION_MODE_SPECK128_256_XTS] = {
+- .friendly_name = "Speck128/256-XTS",
+- .cipher_str = "xts(speck128)",
+- .keysize = 64,
+- },
+- [FS_ENCRYPTION_MODE_SPECK128_256_CTS] = {
+- .friendly_name = "Speck128/256-CTS-CBC",
+- .cipher_str = "cts(cbc(speck128))",
+- .keysize = 32,
+- },
+ };
+
+ static struct fscrypt_mode *
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index caff935fbeb8..5cfb1e2f6a5b 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1401,7 +1401,8 @@ struct ext4_sb_info {
+ u32 s_min_batch_time;
+ struct block_device *journal_bdev;
+ #ifdef CONFIG_QUOTA
+- char *s_qf_names[EXT4_MAXQUOTAS]; /* Names of quota files with journalled quota */
++ /* Names of quota files with journalled quota */
++ char __rcu *s_qf_names[EXT4_MAXQUOTAS];
+ int s_jquota_fmt; /* Format of quota to use */
+ #endif
+ unsigned int s_want_extra_isize; /* New inodes should reserve # bytes */
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 7b4736022761..9c4bac18cc6c 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -863,7 +863,7 @@ int ext4_da_write_inline_data_begin(struct address_space *mapping,
+ handle_t *handle;
+ struct page *page;
+ struct ext4_iloc iloc;
+- int retries;
++ int retries = 0;
+
+ ret = ext4_get_inode_loc(inode, &iloc);
+ if (ret)
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index a7074115d6f6..0edee31913d1 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -67,7 +67,6 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2)
+ ei1 = EXT4_I(inode1);
+ ei2 = EXT4_I(inode2);
+
+- swap(inode1->i_flags, inode2->i_flags);
+ swap(inode1->i_version, inode2->i_version);
+ swap(inode1->i_blocks, inode2->i_blocks);
+ swap(inode1->i_bytes, inode2->i_bytes);
+@@ -85,6 +84,21 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2)
+ i_size_write(inode2, isize);
+ }
+
++static void reset_inode_seed(struct inode *inode)
++{
++ struct ext4_inode_info *ei = EXT4_I(inode);
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ __le32 inum = cpu_to_le32(inode->i_ino);
++ __le32 gen = cpu_to_le32(inode->i_generation);
++ __u32 csum;
++
++ if (!ext4_has_metadata_csum(inode->i_sb))
++ return;
++
++ csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&inum, sizeof(inum));
++ ei->i_csum_seed = ext4_chksum(sbi, csum, (__u8 *)&gen, sizeof(gen));
++}
++
+ /**
+ * Swap the information from the given @inode and the inode
+ * EXT4_BOOT_LOADER_INO. It will basically swap i_data and all other
+@@ -102,10 +116,13 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ struct inode *inode_bl;
+ struct ext4_inode_info *ei_bl;
+
+- if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode))
++ if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) ||
++ IS_SWAPFILE(inode) || IS_ENCRYPTED(inode) ||
++ ext4_has_inline_data(inode))
+ return -EINVAL;
+
+- if (!inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN))
++ if (IS_RDONLY(inode) || IS_APPEND(inode) || IS_IMMUTABLE(inode) ||
++ !inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+ inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO);
+@@ -120,13 +137,13 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ * that only 1 swap_inode_boot_loader is running. */
+ lock_two_nondirectories(inode, inode_bl);
+
+- truncate_inode_pages(&inode->i_data, 0);
+- truncate_inode_pages(&inode_bl->i_data, 0);
+-
+ /* Wait for all existing dio workers */
+ inode_dio_wait(inode);
+ inode_dio_wait(inode_bl);
+
++ truncate_inode_pages(&inode->i_data, 0);
++ truncate_inode_pages(&inode_bl->i_data, 0);
++
+ handle = ext4_journal_start(inode_bl, EXT4_HT_MOVE_EXTENTS, 2);
+ if (IS_ERR(handle)) {
+ err = -EINVAL;
+@@ -159,6 +176,8 @@ static long swap_inode_boot_loader(struct super_block *sb,
+
+ inode->i_generation = prandom_u32();
+ inode_bl->i_generation = prandom_u32();
++ reset_inode_seed(inode);
++ reset_inode_seed(inode_bl);
+
+ ext4_discard_preallocations(inode);
+
+@@ -169,6 +188,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ inode->i_ino, err);
+ /* Revert all changes: */
+ swap_inode_data(inode, inode_bl);
++ ext4_mark_inode_dirty(handle, inode);
+ } else {
+ err = ext4_mark_inode_dirty(handle, inode_bl);
+ if (err < 0) {
+@@ -178,6 +198,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ /* Revert all changes: */
+ swap_inode_data(inode, inode_bl);
+ ext4_mark_inode_dirty(handle, inode);
++ ext4_mark_inode_dirty(handle, inode_bl);
+ }
+ }
+ ext4_journal_stop(handle);
+@@ -339,19 +360,14 @@ static int ext4_ioctl_setproject(struct file *filp, __u32 projid)
+ if (projid_eq(kprojid, EXT4_I(inode)->i_projid))
+ return 0;
+
+- err = mnt_want_write_file(filp);
+- if (err)
+- return err;
+-
+ err = -EPERM;
+- inode_lock(inode);
+ /* Is it quota file? Do not allow user to mess with it */
+ if (ext4_is_quota_file(inode))
+- goto out_unlock;
++ return err;
+
+ err = ext4_get_inode_loc(inode, &iloc);
+ if (err)
+- goto out_unlock;
++ return err;
+
+ raw_inode = ext4_raw_inode(&iloc);
+ if (!EXT4_FITS_IN_INODE(raw_inode, ei, i_projid)) {
+@@ -359,20 +375,20 @@ static int ext4_ioctl_setproject(struct file *filp, __u32 projid)
+ EXT4_SB(sb)->s_want_extra_isize,
+ &iloc);
+ if (err)
+- goto out_unlock;
++ return err;
+ } else {
+ brelse(iloc.bh);
+ }
+
+- dquot_initialize(inode);
++ err = dquot_initialize(inode);
++ if (err)
++ return err;
+
+ handle = ext4_journal_start(inode, EXT4_HT_QUOTA,
+ EXT4_QUOTA_INIT_BLOCKS(sb) +
+ EXT4_QUOTA_DEL_BLOCKS(sb) + 3);
+- if (IS_ERR(handle)) {
+- err = PTR_ERR(handle);
+- goto out_unlock;
+- }
++ if (IS_ERR(handle))
++ return PTR_ERR(handle);
+
+ err = ext4_reserve_inode_write(handle, inode, &iloc);
+ if (err)
+@@ -400,9 +416,6 @@ out_dirty:
+ err = rc;
+ out_stop:
+ ext4_journal_stop(handle);
+-out_unlock:
+- inode_unlock(inode);
+- mnt_drop_write_file(filp);
+ return err;
+ }
+ #else
+@@ -626,6 +639,30 @@ group_add_out:
+ return err;
+ }
+
++static int ext4_ioctl_check_project(struct inode *inode, struct fsxattr *fa)
++{
++ /*
++ * Project Quota ID state is only allowed to change from within the init
++ * namespace. Enforce that restriction only if we are trying to change
++ * the quota ID state. Everything else is allowed in user namespaces.
++ */
++ if (current_user_ns() == &init_user_ns)
++ return 0;
++
++ if (__kprojid_val(EXT4_I(inode)->i_projid) != fa->fsx_projid)
++ return -EINVAL;
++
++ if (ext4_test_inode_flag(inode, EXT4_INODE_PROJINHERIT)) {
++ if (!(fa->fsx_xflags & FS_XFLAG_PROJINHERIT))
++ return -EINVAL;
++ } else {
++ if (fa->fsx_xflags & FS_XFLAG_PROJINHERIT)
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ {
+ struct inode *inode = file_inode(filp);
+@@ -1025,19 +1062,19 @@ resizefs_out:
+ return err;
+
+ inode_lock(inode);
++ err = ext4_ioctl_check_project(inode, &fa);
++ if (err)
++ goto out;
+ flags = (ei->i_flags & ~EXT4_FL_XFLAG_VISIBLE) |
+ (flags & EXT4_FL_XFLAG_VISIBLE);
+ err = ext4_ioctl_setflags(inode, flags);
+- inode_unlock(inode);
+- mnt_drop_write_file(filp);
+ if (err)
+- return err;
+-
++ goto out;
+ err = ext4_ioctl_setproject(filp, fa.fsx_projid);
+- if (err)
+- return err;
+-
+- return 0;
++out:
++ inode_unlock(inode);
++ mnt_drop_write_file(filp);
++ return err;
+ }
+ case EXT4_IOC_SHUTDOWN:
+ return ext4_shutdown(sb, arg);
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index a409ff70d67b..2f5be02fc6f6 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -516,9 +516,13 @@ mext_check_arguments(struct inode *orig_inode,
+ orig_inode->i_ino, donor_inode->i_ino);
+ return -EINVAL;
+ }
+- if (orig_eof < orig_start + *len - 1)
++ if (orig_eof <= orig_start)
++ *len = 0;
++ else if (orig_eof < orig_start + *len - 1)
+ *len = orig_eof - orig_start;
+- if (donor_eof < donor_start + *len - 1)
++ if (donor_eof <= donor_start)
++ *len = 0;
++ else if (donor_eof < donor_start + *len - 1)
+ *len = donor_eof - donor_start;
+ if (!*len) {
+ ext4_debug("ext4 move extent: len should not be 0 "
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 1145109968ef..d3d4643ab79b 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -914,6 +914,18 @@ static inline void ext4_quota_off_umount(struct super_block *sb)
+ for (type = 0; type < EXT4_MAXQUOTAS; type++)
+ ext4_quota_off(sb, type);
+ }
++
++/*
++ * This is a helper function which is used in the mount/remount
++ * codepaths (which holds s_umount) to fetch the quota file name.
++ */
++static inline char *get_qf_name(struct super_block *sb,
++ struct ext4_sb_info *sbi,
++ int type)
++{
++ return rcu_dereference_protected(sbi->s_qf_names[type],
++ lockdep_is_held(&sb->s_umount));
++}
+ #else
+ static inline void ext4_quota_off_umount(struct super_block *sb)
+ {
+@@ -965,7 +977,7 @@ static void ext4_put_super(struct super_block *sb)
+ percpu_free_rwsem(&sbi->s_journal_flag_rwsem);
+ #ifdef CONFIG_QUOTA
+ for (i = 0; i < EXT4_MAXQUOTAS; i++)
+- kfree(sbi->s_qf_names[i]);
++ kfree(get_qf_name(sb, sbi, i));
+ #endif
+
+ /* Debugging code just in case the in-memory inode orphan list
+@@ -1530,11 +1542,10 @@ static const char deprecated_msg[] =
+ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+- char *qname;
++ char *qname, *old_qname = get_qf_name(sb, sbi, qtype);
+ int ret = -1;
+
+- if (sb_any_quota_loaded(sb) &&
+- !sbi->s_qf_names[qtype]) {
++ if (sb_any_quota_loaded(sb) && !old_qname) {
+ ext4_msg(sb, KERN_ERR,
+ "Cannot change journaled "
+ "quota options when quota turned on");
+@@ -1551,8 +1562,8 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+ "Not enough memory for storing quotafile name");
+ return -1;
+ }
+- if (sbi->s_qf_names[qtype]) {
+- if (strcmp(sbi->s_qf_names[qtype], qname) == 0)
++ if (old_qname) {
++ if (strcmp(old_qname, qname) == 0)
+ ret = 1;
+ else
+ ext4_msg(sb, KERN_ERR,
+@@ -1565,7 +1576,7 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+ "quotafile must be on filesystem root");
+ goto errout;
+ }
+- sbi->s_qf_names[qtype] = qname;
++ rcu_assign_pointer(sbi->s_qf_names[qtype], qname);
+ set_opt(sb, QUOTA);
+ return 1;
+ errout:
+@@ -1577,15 +1588,16 @@ static int clear_qf_name(struct super_block *sb, int qtype)
+ {
+
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ char *old_qname = get_qf_name(sb, sbi, qtype);
+
+- if (sb_any_quota_loaded(sb) &&
+- sbi->s_qf_names[qtype]) {
++ if (sb_any_quota_loaded(sb) && old_qname) {
+ ext4_msg(sb, KERN_ERR, "Cannot change journaled quota options"
+ " when quota turned on");
+ return -1;
+ }
+- kfree(sbi->s_qf_names[qtype]);
+- sbi->s_qf_names[qtype] = NULL;
++ rcu_assign_pointer(sbi->s_qf_names[qtype], NULL);
++ synchronize_rcu();
++ kfree(old_qname);
+ return 1;
+ }
+ #endif
+@@ -1960,7 +1972,7 @@ static int parse_options(char *options, struct super_block *sb,
+ int is_remount)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+- char *p;
++ char *p, __maybe_unused *usr_qf_name, __maybe_unused *grp_qf_name;
+ substring_t args[MAX_OPT_ARGS];
+ int token;
+
+@@ -1991,11 +2003,13 @@ static int parse_options(char *options, struct super_block *sb,
+ "Cannot enable project quota enforcement.");
+ return 0;
+ }
+- if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
+- if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA])
++ usr_qf_name = get_qf_name(sb, sbi, USRQUOTA);
++ grp_qf_name = get_qf_name(sb, sbi, GRPQUOTA);
++ if (usr_qf_name || grp_qf_name) {
++ if (test_opt(sb, USRQUOTA) && usr_qf_name)
+ clear_opt(sb, USRQUOTA);
+
+- if (test_opt(sb, GRPQUOTA) && sbi->s_qf_names[GRPQUOTA])
++ if (test_opt(sb, GRPQUOTA) && grp_qf_name)
+ clear_opt(sb, GRPQUOTA);
+
+ if (test_opt(sb, GRPQUOTA) || test_opt(sb, USRQUOTA)) {
+@@ -2029,6 +2043,7 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
+ {
+ #if defined(CONFIG_QUOTA)
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ char *usr_qf_name, *grp_qf_name;
+
+ if (sbi->s_jquota_fmt) {
+ char *fmtname = "";
+@@ -2047,11 +2062,14 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
+ seq_printf(seq, ",jqfmt=%s", fmtname);
+ }
+
+- if (sbi->s_qf_names[USRQUOTA])
+- seq_show_option(seq, "usrjquota", sbi->s_qf_names[USRQUOTA]);
+-
+- if (sbi->s_qf_names[GRPQUOTA])
+- seq_show_option(seq, "grpjquota", sbi->s_qf_names[GRPQUOTA]);
++ rcu_read_lock();
++ usr_qf_name = rcu_dereference(sbi->s_qf_names[USRQUOTA]);
++ grp_qf_name = rcu_dereference(sbi->s_qf_names[GRPQUOTA]);
++ if (usr_qf_name)
++ seq_show_option(seq, "usrjquota", usr_qf_name);
++ if (grp_qf_name)
++ seq_show_option(seq, "grpjquota", grp_qf_name);
++ rcu_read_unlock();
+ #endif
+ }
+
+@@ -5103,6 +5121,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ int err = 0;
+ #ifdef CONFIG_QUOTA
+ int i, j;
++ char *to_free[EXT4_MAXQUOTAS];
+ #endif
+ char *orig_data = kstrdup(data, GFP_KERNEL);
+
+@@ -5122,8 +5141,9 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ old_opts.s_jquota_fmt = sbi->s_jquota_fmt;
+ for (i = 0; i < EXT4_MAXQUOTAS; i++)
+ if (sbi->s_qf_names[i]) {
+- old_opts.s_qf_names[i] = kstrdup(sbi->s_qf_names[i],
+- GFP_KERNEL);
++ char *qf_name = get_qf_name(sb, sbi, i);
++
++ old_opts.s_qf_names[i] = kstrdup(qf_name, GFP_KERNEL);
+ if (!old_opts.s_qf_names[i]) {
+ for (j = 0; j < i; j++)
+ kfree(old_opts.s_qf_names[j]);
+@@ -5352,9 +5372,12 @@ restore_opts:
+ #ifdef CONFIG_QUOTA
+ sbi->s_jquota_fmt = old_opts.s_jquota_fmt;
+ for (i = 0; i < EXT4_MAXQUOTAS; i++) {
+- kfree(sbi->s_qf_names[i]);
+- sbi->s_qf_names[i] = old_opts.s_qf_names[i];
++ to_free[i] = get_qf_name(sb, sbi, i);
++ rcu_assign_pointer(sbi->s_qf_names[i], old_opts.s_qf_names[i]);
+ }
++ synchronize_rcu();
++ for (i = 0; i < EXT4_MAXQUOTAS; i++)
++ kfree(to_free[i]);
+ #endif
+ kfree(orig_data);
+ return err;
+@@ -5545,7 +5568,7 @@ static int ext4_write_info(struct super_block *sb, int type)
+ */
+ static int ext4_quota_on_mount(struct super_block *sb, int type)
+ {
+- return dquot_quota_on_mount(sb, EXT4_SB(sb)->s_qf_names[type],
++ return dquot_quota_on_mount(sb, get_qf_name(sb, EXT4_SB(sb), type),
+ EXT4_SB(sb)->s_jquota_fmt, type);
+ }
+
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index e8b6b89bddb8..59d0472013f4 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -696,6 +696,8 @@ int f2fs_recover_orphan_inodes(struct f2fs_sb_info *sbi)
+ /* clear Orphan Flag */
+ clear_ckpt_flags(sbi, CP_ORPHAN_PRESENT_FLAG);
+ out:
++ set_sbi_flag(sbi, SBI_IS_RECOVERED);
++
+ #ifdef CONFIG_QUOTA
+ /* Turn quotas off */
+ if (quota_enabled)
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 382c1ef9a9e4..11f28342f641 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -80,7 +80,8 @@ static void __read_end_io(struct bio *bio)
+ /* PG_error was set if any post_read step failed */
+ if (bio->bi_status || PageError(page)) {
+ ClearPageUptodate(page);
+- SetPageError(page);
++ /* will re-read again later */
++ ClearPageError(page);
+ } else {
+ SetPageUptodate(page);
+ }
+@@ -456,12 +457,16 @@ int f2fs_submit_page_bio(struct f2fs_io_info *fio)
+ bio_put(bio);
+ return -EFAULT;
+ }
+- bio_set_op_attrs(bio, fio->op, fio->op_flags);
+
+- __submit_bio(fio->sbi, bio, fio->type);
++ if (fio->io_wbc && !is_read_io(fio->op))
++ wbc_account_io(fio->io_wbc, page, PAGE_SIZE);
++
++ bio_set_op_attrs(bio, fio->op, fio->op_flags);
+
+ if (!is_read_io(fio->op))
+ inc_page_count(fio->sbi, WB_DATA_TYPE(fio->page));
++
++ __submit_bio(fio->sbi, bio, fio->type);
+ return 0;
+ }
+
+@@ -586,6 +591,7 @@ static int f2fs_submit_page_read(struct inode *inode, struct page *page,
+ bio_put(bio);
+ return -EFAULT;
+ }
++ ClearPageError(page);
+ __submit_bio(F2FS_I_SB(inode), bio, DATA);
+ return 0;
+ }
+@@ -1561,6 +1567,7 @@ submit_and_realloc:
+ if (bio_add_page(bio, page, blocksize, 0) < blocksize)
+ goto submit_and_realloc;
+
++ ClearPageError(page);
+ last_block_in_bio = block_nr;
+ goto next_page;
+ set_error_page:
+@@ -2583,10 +2590,6 @@ static int f2fs_set_data_page_dirty(struct page *page)
+ if (!PageUptodate(page))
+ SetPageUptodate(page);
+
+- /* don't remain PG_checked flag which was set during GC */
+- if (is_cold_data(page))
+- clear_cold_data(page);
+-
+ if (f2fs_is_atomic_file(inode) && !f2fs_is_commit_atomic_write(inode)) {
+ if (!IS_ATOMIC_WRITTEN_PAGE(page)) {
+ f2fs_register_inmem_page(inode, page);
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index 231b77ef5a53..a70cd2580eae 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -308,14 +308,13 @@ static unsigned int __free_extent_tree(struct f2fs_sb_info *sbi,
+ return count - atomic_read(&et->node_cnt);
+ }
+
+-static void __drop_largest_extent(struct inode *inode,
++static void __drop_largest_extent(struct extent_tree *et,
+ pgoff_t fofs, unsigned int len)
+ {
+- struct extent_info *largest = &F2FS_I(inode)->extent_tree->largest;
+-
+- if (fofs < largest->fofs + largest->len && fofs + len > largest->fofs) {
+- largest->len = 0;
+- f2fs_mark_inode_dirty_sync(inode, true);
++ if (fofs < et->largest.fofs + et->largest.len &&
++ fofs + len > et->largest.fofs) {
++ et->largest.len = 0;
++ et->largest_updated = true;
+ }
+ }
+
+@@ -416,12 +415,11 @@ out:
+ return ret;
+ }
+
+-static struct extent_node *__try_merge_extent_node(struct inode *inode,
++static struct extent_node *__try_merge_extent_node(struct f2fs_sb_info *sbi,
+ struct extent_tree *et, struct extent_info *ei,
+ struct extent_node *prev_ex,
+ struct extent_node *next_ex)
+ {
+- struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct extent_node *en = NULL;
+
+ if (prev_ex && __is_back_mergeable(ei, &prev_ex->ei)) {
+@@ -443,7 +441,7 @@ static struct extent_node *__try_merge_extent_node(struct inode *inode,
+ if (!en)
+ return NULL;
+
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+
+ spin_lock(&sbi->extent_lock);
+ if (!list_empty(&en->list)) {
+@@ -454,12 +452,11 @@ static struct extent_node *__try_merge_extent_node(struct inode *inode,
+ return en;
+ }
+
+-static struct extent_node *__insert_extent_tree(struct inode *inode,
++static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi,
+ struct extent_tree *et, struct extent_info *ei,
+ struct rb_node **insert_p,
+ struct rb_node *insert_parent)
+ {
+- struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct rb_node **p;
+ struct rb_node *parent = NULL;
+ struct extent_node *en = NULL;
+@@ -476,7 +473,7 @@ do_insert:
+ if (!en)
+ return NULL;
+
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+
+ /* update in global extent list */
+ spin_lock(&sbi->extent_lock);
+@@ -497,6 +494,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ struct rb_node **insert_p = NULL, *insert_parent = NULL;
+ unsigned int end = fofs + len;
+ unsigned int pos = (unsigned int)fofs;
++ bool updated = false;
+
+ if (!et)
+ return;
+@@ -517,7 +515,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ * drop largest extent before lookup, in case it's already
+ * been shrunk from extent tree
+ */
+- __drop_largest_extent(inode, fofs, len);
++ __drop_largest_extent(et, fofs, len);
+
+ /* 1. lookup first extent node in range [fofs, fofs + len - 1] */
+ en = (struct extent_node *)f2fs_lookup_rb_tree_ret(&et->root,
+@@ -550,7 +548,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ set_extent_info(&ei, end,
+ end - dei.fofs + dei.blk,
+ org_end - end);
+- en1 = __insert_extent_tree(inode, et, &ei,
++ en1 = __insert_extent_tree(sbi, et, &ei,
+ NULL, NULL);
+ next_en = en1;
+ } else {
+@@ -570,7 +568,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ }
+
+ if (parts)
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+ else
+ __release_extent_node(sbi, et, en);
+
+@@ -590,15 +588,16 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ if (blkaddr) {
+
+ set_extent_info(&ei, fofs, blkaddr, len);
+- if (!__try_merge_extent_node(inode, et, &ei, prev_en, next_en))
+- __insert_extent_tree(inode, et, &ei,
++ if (!__try_merge_extent_node(sbi, et, &ei, prev_en, next_en))
++ __insert_extent_tree(sbi, et, &ei,
+ insert_p, insert_parent);
+
+ /* give up extent_cache, if split and small updates happen */
+ if (dei.len >= 1 &&
+ prev.len < F2FS_MIN_EXTENT_LEN &&
+ et->largest.len < F2FS_MIN_EXTENT_LEN) {
+- __drop_largest_extent(inode, 0, UINT_MAX);
++ et->largest.len = 0;
++ et->largest_updated = true;
+ set_inode_flag(inode, FI_NO_EXTENT);
+ }
+ }
+@@ -606,7 +605,15 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ if (is_inode_flag_set(inode, FI_NO_EXTENT))
+ __free_extent_tree(sbi, et);
+
++ if (et->largest_updated) {
++ et->largest_updated = false;
++ updated = true;
++ }
++
+ write_unlock(&et->lock);
++
++ if (updated)
++ f2fs_mark_inode_dirty_sync(inode, true);
+ }
+
+ unsigned int f2fs_shrink_extent_tree(struct f2fs_sb_info *sbi, int nr_shrink)
+@@ -705,6 +712,7 @@ void f2fs_drop_extent_tree(struct inode *inode)
+ {
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct extent_tree *et = F2FS_I(inode)->extent_tree;
++ bool updated = false;
+
+ if (!f2fs_may_extent_tree(inode))
+ return;
+@@ -713,8 +721,13 @@ void f2fs_drop_extent_tree(struct inode *inode)
+
+ write_lock(&et->lock);
+ __free_extent_tree(sbi, et);
+- __drop_largest_extent(inode, 0, UINT_MAX);
++ if (et->largest.len) {
++ et->largest.len = 0;
++ updated = true;
++ }
+ write_unlock(&et->lock);
++ if (updated)
++ f2fs_mark_inode_dirty_sync(inode, true);
+ }
+
+ void f2fs_destroy_extent_tree(struct inode *inode)
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index abf925664d9c..ecb735142276 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -572,6 +572,7 @@ struct extent_tree {
+ struct list_head list; /* to be used by sbi->zombie_list */
+ rwlock_t lock; /* protect extent info rb-tree */
+ atomic_t node_cnt; /* # of extent node in rb-tree*/
++ bool largest_updated; /* largest extent updated */
+ };
+
+ /*
+@@ -754,12 +755,12 @@ static inline bool __is_front_mergeable(struct extent_info *cur,
+ }
+
+ extern void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync);
+-static inline void __try_update_largest_extent(struct inode *inode,
+- struct extent_tree *et, struct extent_node *en)
++static inline void __try_update_largest_extent(struct extent_tree *et,
++ struct extent_node *en)
+ {
+ if (en->ei.len > et->largest.len) {
+ et->largest = en->ei;
+- f2fs_mark_inode_dirty_sync(inode, true);
++ et->largest_updated = true;
+ }
+ }
+
+@@ -1088,6 +1089,7 @@ enum {
+ SBI_NEED_SB_WRITE, /* need to recover superblock */
+ SBI_NEED_CP, /* need to checkpoint */
+ SBI_IS_SHUTDOWN, /* shutdown by ioctl */
++ SBI_IS_RECOVERED, /* recovered orphan/data */
+ };
+
+ enum {
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index 959df2249875..dd608b819a3c 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -368,6 +368,12 @@ static int do_read_inode(struct inode *inode)
+ if (f2fs_has_inline_data(inode) && !f2fs_exist_data(inode))
+ __recover_inline_status(inode, node_page);
+
++ /* try to recover cold bit for non-dir inode */
++ if (!S_ISDIR(inode->i_mode) && !is_cold_node(node_page)) {
++ set_cold_node(node_page, false);
++ set_page_dirty(node_page);
++ }
++
+ /* get rdev by using inline_info */
+ __get_inode_rdev(inode, ri);
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index dd2e45a661aa..42ea42acb487 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1542,8 +1542,10 @@ static int __write_node_page(struct page *page, bool atomic, bool *submitted,
+ }
+
+ if (__is_valid_data_blkaddr(ni.blk_addr) &&
+- !f2fs_is_valid_blkaddr(sbi, ni.blk_addr, DATA_GENERIC))
++ !f2fs_is_valid_blkaddr(sbi, ni.blk_addr, DATA_GENERIC)) {
++ up_read(&sbi->node_write);
+ goto redirty_out;
++ }
+
+ if (atomic && !test_opt(sbi, NOBARRIER))
+ fio.op_flags |= REQ_PREFLUSH | REQ_FUA;
+@@ -2537,7 +2539,7 @@ retry:
+ if (!PageUptodate(ipage))
+ SetPageUptodate(ipage);
+ fill_node_footer(ipage, ino, ino, 0, true);
+- set_cold_node(page, false);
++ set_cold_node(ipage, false);
+
+ src = F2FS_INODE(page);
+ dst = F2FS_INODE(ipage);
+@@ -2560,6 +2562,13 @@ retry:
+ F2FS_FITS_IN_INODE(src, le16_to_cpu(src->i_extra_isize),
+ i_projid))
+ dst->i_projid = src->i_projid;
++
++ if (f2fs_sb_has_inode_crtime(sbi->sb) &&
++ F2FS_FITS_IN_INODE(src, le16_to_cpu(src->i_extra_isize),
++ i_crtime_nsec)) {
++ dst->i_crtime = src->i_crtime;
++ dst->i_crtime_nsec = src->i_crtime_nsec;
++ }
+ }
+
+ new_ni = old_ni;
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 95511ed11a22..9a8579fb3a30 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -221,6 +221,7 @@ static void recover_inode(struct inode *inode, struct page *page)
+ inode->i_mtime.tv_nsec = le32_to_cpu(raw->i_mtime_nsec);
+
+ F2FS_I(inode)->i_advise = raw->i_advise;
++ F2FS_I(inode)->i_flags = le32_to_cpu(raw->i_flags);
+
+ recover_inline_flags(inode, raw);
+
+@@ -697,11 +698,15 @@ skip:
+ /* let's drop all the directory inodes for clean checkpoint */
+ destroy_fsync_dnodes(&dir_list);
+
+- if (!err && need_writecp) {
+- struct cp_control cpc = {
+- .reason = CP_RECOVERY,
+- };
+- err = f2fs_write_checkpoint(sbi, &cpc);
++ if (need_writecp) {
++ set_sbi_flag(sbi, SBI_IS_RECOVERED);
++
++ if (!err) {
++ struct cp_control cpc = {
++ .reason = CP_RECOVERY,
++ };
++ err = f2fs_write_checkpoint(sbi, &cpc);
++ }
+ }
+
+ kmem_cache_destroy(fsync_entry_slab);
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 896b885f504e..287c9fe9fff9 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1852,7 +1852,9 @@ static int f2fs_quota_off(struct super_block *sb, int type)
+ if (!inode || !igrab(inode))
+ return dquot_quota_off(sb, type);
+
+- f2fs_quota_sync(sb, type);
++ err = f2fs_quota_sync(sb, type);
++ if (err)
++ goto out_put;
+
+ err = dquot_quota_off(sb, type);
+ if (err || f2fs_sb_has_quota_ino(sb))
+@@ -1871,9 +1873,20 @@ out_put:
+ void f2fs_quota_off_umount(struct super_block *sb)
+ {
+ int type;
++ int err;
+
+- for (type = 0; type < MAXQUOTAS; type++)
+- f2fs_quota_off(sb, type);
++ for (type = 0; type < MAXQUOTAS; type++) {
++ err = f2fs_quota_off(sb, type);
++ if (err) {
++ int ret = dquot_quota_off(sb, type);
++
++ f2fs_msg(sb, KERN_ERR,
++ "Fail to turn off disk quota "
++ "(type: %d, err: %d, ret:%d), Please "
++ "run fsck to fix it.", type, err, ret);
++ set_sbi_flag(F2FS_SB(sb), SBI_NEED_FSCK);
++ }
++ }
+ }
+
+ static int f2fs_get_projid(struct inode *inode, kprojid_t *projid)
+@@ -3175,6 +3188,9 @@ static void kill_f2fs_super(struct super_block *sb)
+ };
+ f2fs_write_checkpoint(sbi, &cpc);
+ }
++
++ if (is_sbi_flag_set(sbi, SBI_IS_RECOVERED) && f2fs_readonly(sb))
++ sb->s_flags &= ~SB_RDONLY;
+ }
+ kill_block_super(sb);
+ }
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index c2469833b4fb..6b84ef6ccff3 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -1333,6 +1333,9 @@ static struct dentry *gfs2_mount_meta(struct file_system_type *fs_type,
+ struct path path;
+ int error;
+
++ if (!dev_name || !*dev_name)
++ return ERR_PTR(-EINVAL);
++
+ error = kern_path(dev_name, LOOKUP_FOLLOW, &path);
+ if (error) {
+ pr_warn("path_lookup on %s returned error %d\n",
+diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
+index c125d662777c..26f8d7e46462 100644
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -251,8 +251,8 @@ restart:
+ bh = jh2bh(jh);
+
+ if (buffer_locked(bh)) {
+- spin_unlock(&journal->j_list_lock);
+ get_bh(bh);
++ spin_unlock(&journal->j_list_lock);
+ wait_on_buffer(bh);
+ /* the journal_head may have gone by now */
+ BUFFER_TRACE(bh, "brelse");
+@@ -333,8 +333,8 @@ restart2:
+ jh = transaction->t_checkpoint_io_list;
+ bh = jh2bh(jh);
+ if (buffer_locked(bh)) {
+- spin_unlock(&journal->j_list_lock);
+ get_bh(bh);
++ spin_unlock(&journal->j_list_lock);
+ wait_on_buffer(bh);
+ /* the journal_head may have gone by now */
+ BUFFER_TRACE(bh, "brelse");
+diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
+index 87bdf0f4cba1..902a7dd10e5c 100644
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super_block *sb, void *data, int silent)
+ sb->s_fs_info = c;
+
+ ret = jffs2_parse_options(c, data);
+- if (ret) {
+- kfree(c);
++ if (ret)
+ return -EINVAL;
+- }
+
+ /* Initialize JFFS2 superblock locks, the further initialization will
+ * be done later */
+diff --git a/fs/lockd/host.c b/fs/lockd/host.c
+index d35cd6be0675..93fb7cf0b92b 100644
+--- a/fs/lockd/host.c
++++ b/fs/lockd/host.c
+@@ -341,7 +341,7 @@ struct nlm_host *nlmsvc_lookup_host(const struct svc_rqst *rqstp,
+ };
+ struct lockd_net *ln = net_generic(net, lockd_net_id);
+
+- dprintk("lockd: %s(host='%*s', vers=%u, proto=%s)\n", __func__,
++ dprintk("lockd: %s(host='%.*s', vers=%u, proto=%s)\n", __func__,
+ (int)hostname_len, hostname, rqstp->rq_vers,
+ (rqstp->rq_prot == IPPROTO_UDP ? "udp" : "tcp"));
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 146e30862234..8f53455c4765 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -950,10 +950,10 @@ EXPORT_SYMBOL_GPL(nfs4_set_ds_client);
+
+ /*
+ * Session has been established, and the client marked ready.
+- * Set the mount rsize and wsize with negotiated fore channel
+- * attributes which will be bound checked in nfs_server_set_fsinfo.
++ * Limit the mount rsize, wsize and dtsize using negotiated fore
++ * channel attributes.
+ */
+-static void nfs4_session_set_rwsize(struct nfs_server *server)
++static void nfs4_session_limit_rwsize(struct nfs_server *server)
+ {
+ #ifdef CONFIG_NFS_V4_1
+ struct nfs4_session *sess;
+@@ -966,9 +966,11 @@ static void nfs4_session_set_rwsize(struct nfs_server *server)
+ server_resp_sz = sess->fc_attrs.max_resp_sz - nfs41_maxread_overhead;
+ server_rqst_sz = sess->fc_attrs.max_rqst_sz - nfs41_maxwrite_overhead;
+
+- if (!server->rsize || server->rsize > server_resp_sz)
++ if (server->dtsize > server_resp_sz)
++ server->dtsize = server_resp_sz;
++ if (server->rsize > server_resp_sz)
+ server->rsize = server_resp_sz;
+- if (!server->wsize || server->wsize > server_rqst_sz)
++ if (server->wsize > server_rqst_sz)
+ server->wsize = server_rqst_sz;
+ #endif /* CONFIG_NFS_V4_1 */
+ }
+@@ -1015,12 +1017,12 @@ static int nfs4_server_common_setup(struct nfs_server *server,
+ (unsigned long long) server->fsid.minor);
+ nfs_display_fhandle(mntfh, "Pseudo-fs root FH");
+
+- nfs4_session_set_rwsize(server);
+-
+ error = nfs_probe_fsinfo(server, mntfh, fattr);
+ if (error < 0)
+ goto out;
+
++ nfs4_session_limit_rwsize(server);
++
+ if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
+ server->namelen = NFS4_MAXNAMLEN;
+
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index bb5476a6d264..3dbd15b47c27 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -1111,6 +1111,20 @@ static int nfs_pageio_add_request_mirror(struct nfs_pageio_descriptor *desc,
+ return ret;
+ }
+
++static void nfs_pageio_error_cleanup(struct nfs_pageio_descriptor *desc)
++{
++ u32 midx;
++ struct nfs_pgio_mirror *mirror;
++
++ if (!desc->pg_error)
++ return;
++
++ for (midx = 0; midx < desc->pg_mirror_count; midx++) {
++ mirror = &desc->pg_mirrors[midx];
++ desc->pg_completion_ops->error_cleanup(&mirror->pg_list);
++ }
++}
++
+ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
+ struct nfs_page *req)
+ {
+@@ -1161,25 +1175,11 @@ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
+ return 1;
+
+ out_failed:
+- /*
+- * We might have failed before sending any reqs over wire.
+- * Clean up rest of the reqs in mirror pg_list.
+- */
+- if (desc->pg_error) {
+- struct nfs_pgio_mirror *mirror;
+- void (*func)(struct list_head *);
+-
+- /* remember fatal errors */
+- if (nfs_error_is_fatal(desc->pg_error))
+- nfs_context_set_write_error(req->wb_context,
+- desc->pg_error);
+-
+- func = desc->pg_completion_ops->error_cleanup;
+- for (midx = 0; midx < desc->pg_mirror_count; midx++) {
+- mirror = &desc->pg_mirrors[midx];
+- func(&mirror->pg_list);
+- }
+- }
++ /* remember fatal errors */
++ if (nfs_error_is_fatal(desc->pg_error))
++ nfs_context_set_write_error(req->wb_context,
++ desc->pg_error);
++ nfs_pageio_error_cleanup(desc);
+ return 0;
+ }
+
+@@ -1251,6 +1251,8 @@ void nfs_pageio_complete(struct nfs_pageio_descriptor *desc)
+ for (midx = 0; midx < desc->pg_mirror_count; midx++)
+ nfs_pageio_complete_mirror(desc, midx);
+
++ if (desc->pg_error < 0)
++ nfs_pageio_error_cleanup(desc);
+ if (desc->pg_ops->pg_cleanup)
+ desc->pg_ops->pg_cleanup(desc);
+ nfs_pageio_cleanup_mirroring(desc);
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index b0ca0efd2875..9c6d1d57b598 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -4364,7 +4364,7 @@ nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
+
+ fl = nfs4_alloc_init_lease(dp, NFS4_OPEN_DELEGATE_READ);
+ if (!fl)
+- goto out_stid;
++ goto out_clnt_odstate;
+
+ status = vfs_setlease(fp->fi_deleg_file, fl->fl_type, &fl, NULL);
+ if (fl)
+@@ -4389,7 +4389,6 @@ out_unlock:
+ vfs_setlease(fp->fi_deleg_file, F_UNLCK, NULL, (void **)&dp);
+ out_clnt_odstate:
+ put_clnt_odstate(dp->dl_clnt_odstate);
+-out_stid:
+ nfs4_put_stid(&dp->dl_stid);
+ out_delegees:
+ put_deleg_file(fp);
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index ababdbfab537..f43ea1aad542 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -96,6 +96,9 @@ void fsnotify_unmount_inodes(struct super_block *sb)
+
+ if (iput_inode)
+ iput(iput_inode);
++ /* Wait for outstanding inode references from connectors */
++ wait_var_event(&sb->s_fsnotify_inode_refs,
++ !atomic_long_read(&sb->s_fsnotify_inode_refs));
+ }
+
+ /*
+diff --git a/fs/notify/mark.c b/fs/notify/mark.c
+index 59cdb27826de..09535f6423fc 100644
+--- a/fs/notify/mark.c
++++ b/fs/notify/mark.c
+@@ -179,17 +179,20 @@ static void fsnotify_connector_destroy_workfn(struct work_struct *work)
+ }
+ }
+
+-static struct inode *fsnotify_detach_connector_from_object(
+- struct fsnotify_mark_connector *conn)
++static void *fsnotify_detach_connector_from_object(
++ struct fsnotify_mark_connector *conn,
++ unsigned int *type)
+ {
+ struct inode *inode = NULL;
+
++ *type = conn->type;
+ if (conn->type == FSNOTIFY_OBJ_TYPE_DETACHED)
+ return NULL;
+
+ if (conn->type == FSNOTIFY_OBJ_TYPE_INODE) {
+ inode = fsnotify_conn_inode(conn);
+ inode->i_fsnotify_mask = 0;
++ atomic_long_inc(&inode->i_sb->s_fsnotify_inode_refs);
+ } else if (conn->type == FSNOTIFY_OBJ_TYPE_VFSMOUNT) {
+ fsnotify_conn_mount(conn)->mnt_fsnotify_mask = 0;
+ }
+@@ -211,10 +214,29 @@ static void fsnotify_final_mark_destroy(struct fsnotify_mark *mark)
+ fsnotify_put_group(group);
+ }
+
++/* Drop object reference originally held by a connector */
++static void fsnotify_drop_object(unsigned int type, void *objp)
++{
++ struct inode *inode;
++ struct super_block *sb;
++
++ if (!objp)
++ return;
++ /* Currently only inode references are passed to be dropped */
++ if (WARN_ON_ONCE(type != FSNOTIFY_OBJ_TYPE_INODE))
++ return;
++ inode = objp;
++ sb = inode->i_sb;
++ iput(inode);
++ if (atomic_long_dec_and_test(&sb->s_fsnotify_inode_refs))
++ wake_up_var(&sb->s_fsnotify_inode_refs);
++}
++
+ void fsnotify_put_mark(struct fsnotify_mark *mark)
+ {
+ struct fsnotify_mark_connector *conn;
+- struct inode *inode = NULL;
++ void *objp = NULL;
++ unsigned int type = FSNOTIFY_OBJ_TYPE_DETACHED;
+ bool free_conn = false;
+
+ /* Catch marks that were actually never attached to object */
+@@ -234,7 +256,7 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
+ conn = mark->connector;
+ hlist_del_init_rcu(&mark->obj_list);
+ if (hlist_empty(&conn->list)) {
+- inode = fsnotify_detach_connector_from_object(conn);
++ objp = fsnotify_detach_connector_from_object(conn, &type);
+ free_conn = true;
+ } else {
+ __fsnotify_recalc_mask(conn);
+@@ -242,7 +264,7 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
+ mark->connector = NULL;
+ spin_unlock(&conn->lock);
+
+- iput(inode);
++ fsnotify_drop_object(type, objp);
+
+ if (free_conn) {
+ spin_lock(&destroy_lock);
+@@ -709,7 +731,8 @@ void fsnotify_destroy_marks(fsnotify_connp_t *connp)
+ {
+ struct fsnotify_mark_connector *conn;
+ struct fsnotify_mark *mark, *old_mark = NULL;
+- struct inode *inode;
++ void *objp;
++ unsigned int type;
+
+ conn = fsnotify_grab_connector(connp);
+ if (!conn)
+@@ -735,11 +758,11 @@ void fsnotify_destroy_marks(fsnotify_connp_t *connp)
+ * mark references get dropped. It would lead to strange results such
+ * as delaying inode deletion or blocking unmount.
+ */
+- inode = fsnotify_detach_connector_from_object(conn);
++ objp = fsnotify_detach_connector_from_object(conn, &type);
+ spin_unlock(&conn->lock);
+ if (old_mark)
+ fsnotify_put_mark(old_mark);
+- iput(inode);
++ fsnotify_drop_object(type, objp);
+ }
+
+ /*
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index 5ea1d64cb0b4..a027473561c6 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -713,6 +713,8 @@ static void smap_gather_stats(struct vm_area_struct *vma,
+ smaps_walk.private = mss;
+
+ #ifdef CONFIG_SHMEM
++ /* In case of smaps_rollup, reset the value from previous vma */
++ mss->check_shmem_swap = false;
+ if (vma->vm_file && shmem_mapping(vma->vm_file->f_mapping)) {
+ /*
+ * For shared or readonly shmem mappings we know that all
+@@ -728,7 +730,7 @@ static void smap_gather_stats(struct vm_area_struct *vma,
+
+ if (!shmem_swapped || (vma->vm_flags & VM_SHARED) ||
+ !(vma->vm_flags & VM_WRITE)) {
+- mss->swap = shmem_swapped;
++ mss->swap += shmem_swapped;
+ } else {
+ mss->check_shmem_swap = true;
+ smaps_walk.pte_hole = smaps_pte_hole;
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index bfa0ec69f924..356d2b8568c1 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -1026,7 +1026,7 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
+ struct userfaultfd_ctx *fork_nctx = NULL;
+
+ /* always take the fd_wqh lock before the fault_pending_wqh lock */
+- spin_lock(&ctx->fd_wqh.lock);
++ spin_lock_irq(&ctx->fd_wqh.lock);
+ __add_wait_queue(&ctx->fd_wqh, &wait);
+ for (;;) {
+ set_current_state(TASK_INTERRUPTIBLE);
+@@ -1112,13 +1112,13 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
+ ret = -EAGAIN;
+ break;
+ }
+- spin_unlock(&ctx->fd_wqh.lock);
++ spin_unlock_irq(&ctx->fd_wqh.lock);
+ schedule();
+- spin_lock(&ctx->fd_wqh.lock);
++ spin_lock_irq(&ctx->fd_wqh.lock);
+ }
+ __remove_wait_queue(&ctx->fd_wqh, &wait);
+ __set_current_state(TASK_RUNNING);
+- spin_unlock(&ctx->fd_wqh.lock);
++ spin_unlock_irq(&ctx->fd_wqh.lock);
+
+ if (!ret && msg->event == UFFD_EVENT_FORK) {
+ ret = resolve_userfault_fork(ctx, fork_nctx, msg);
+diff --git a/include/crypto/speck.h b/include/crypto/speck.h
+deleted file mode 100644
+index 73cfc952d405..000000000000
+--- a/include/crypto/speck.h
++++ /dev/null
+@@ -1,62 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * Common values for the Speck algorithm
+- */
+-
+-#ifndef _CRYPTO_SPECK_H
+-#define _CRYPTO_SPECK_H
+-
+-#include <linux/types.h>
+-
+-/* Speck128 */
+-
+-#define SPECK128_BLOCK_SIZE 16
+-
+-#define SPECK128_128_KEY_SIZE 16
+-#define SPECK128_128_NROUNDS 32
+-
+-#define SPECK128_192_KEY_SIZE 24
+-#define SPECK128_192_NROUNDS 33
+-
+-#define SPECK128_256_KEY_SIZE 32
+-#define SPECK128_256_NROUNDS 34
+-
+-struct speck128_tfm_ctx {
+- u64 round_keys[SPECK128_256_NROUNDS];
+- int nrounds;
+-};
+-
+-void crypto_speck128_encrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-void crypto_speck128_decrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-int crypto_speck128_setkey(struct speck128_tfm_ctx *ctx, const u8 *key,
+- unsigned int keysize);
+-
+-/* Speck64 */
+-
+-#define SPECK64_BLOCK_SIZE 8
+-
+-#define SPECK64_96_KEY_SIZE 12
+-#define SPECK64_96_NROUNDS 26
+-
+-#define SPECK64_128_KEY_SIZE 16
+-#define SPECK64_128_NROUNDS 27
+-
+-struct speck64_tfm_ctx {
+- u32 round_keys[SPECK64_128_NROUNDS];
+- int nrounds;
+-};
+-
+-void crypto_speck64_encrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-void crypto_speck64_decrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-int crypto_speck64_setkey(struct speck64_tfm_ctx *ctx, const u8 *key,
+- unsigned int keysize);
+-
+-#endif /* _CRYPTO_SPECK_H */
+diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
+index 38b04f559ad3..1fd6fa822d2c 100644
+--- a/include/linux/bpf_verifier.h
++++ b/include/linux/bpf_verifier.h
+@@ -50,6 +50,9 @@ struct bpf_reg_state {
+ * PTR_TO_MAP_VALUE_OR_NULL
+ */
+ struct bpf_map *map_ptr;
++
++ /* Max size from any of the above. */
++ unsigned long raw;
+ };
+ /* Fixed part of pointer offset, pointer types only */
+ s32 off;
+diff --git a/include/linux/compat.h b/include/linux/compat.h
+index 1a3c4f37e908..de0c13bdcd2c 100644
+--- a/include/linux/compat.h
++++ b/include/linux/compat.h
+@@ -103,6 +103,9 @@ typedef struct compat_sigaltstack {
+ compat_size_t ss_size;
+ } compat_stack_t;
+ #endif
++#ifndef COMPAT_MINSIGSTKSZ
++#define COMPAT_MINSIGSTKSZ MINSIGSTKSZ
++#endif
+
+ #define compat_jiffies_to_clock_t(x) \
+ (((unsigned long)(x) * COMPAT_USER_HZ) / HZ)
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 897eae8faee1..7b6084854bfe 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -1428,6 +1428,9 @@ struct super_block {
+ /* Number of inodes with nlink == 0 but still referenced */
+ atomic_long_t s_remove_count;
+
++ /* Pending fsnotify inode refs */
++ atomic_long_t s_fsnotify_inode_refs;
++
+ /* Being remounted read-only */
+ int s_readonly_remount;
+
+diff --git a/include/linux/hdmi.h b/include/linux/hdmi.h
+index d271ff23984f..4f3febc0f971 100644
+--- a/include/linux/hdmi.h
++++ b/include/linux/hdmi.h
+@@ -101,8 +101,8 @@ enum hdmi_extended_colorimetry {
+ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601,
+ HDMI_EXTENDED_COLORIMETRY_XV_YCC_709,
+ HDMI_EXTENDED_COLORIMETRY_S_YCC_601,
+- HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601,
+- HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB,
++ HDMI_EXTENDED_COLORIMETRY_OPYCC_601,
++ HDMI_EXTENDED_COLORIMETRY_OPRGB,
+
+ /* The following EC values are only defined in CEA-861-F. */
+ HDMI_EXTENDED_COLORIMETRY_BT2020_CONST_LUM,
+diff --git a/include/linux/nvme.h b/include/linux/nvme.h
+index 68e91ef5494c..818dbe9331be 100644
+--- a/include/linux/nvme.h
++++ b/include/linux/nvme.h
+@@ -1241,6 +1241,7 @@ enum {
+ NVME_SC_ANA_PERSISTENT_LOSS = 0x301,
+ NVME_SC_ANA_INACCESSIBLE = 0x302,
+ NVME_SC_ANA_TRANSITION = 0x303,
++ NVME_SC_HOST_PATH_ERROR = 0x370,
+
+ NVME_SC_DNR = 0x4000,
+ };
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index 3d4cd5db30a9..e4d01469ed60 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -36,7 +36,7 @@ enum siginfo_layout {
+ SIL_SYS,
+ };
+
+-enum siginfo_layout siginfo_layout(int sig, int si_code);
++enum siginfo_layout siginfo_layout(unsigned sig, int si_code);
+
+ /*
+ * Define some primitives to manipulate sigset_t.
+diff --git a/include/linux/tc.h b/include/linux/tc.h
+index f92511e57cdb..a60639f37963 100644
+--- a/include/linux/tc.h
++++ b/include/linux/tc.h
+@@ -84,6 +84,7 @@ struct tc_dev {
+ device. */
+ struct device dev; /* Generic device interface. */
+ struct resource resource; /* Address space of this device. */
++ u64 dma_mask; /* DMA addressable range. */
+ char vendor[9];
+ char name[9];
+ char firmware[9];
+diff --git a/include/linux/wait.h b/include/linux/wait.h
+index d9f131ecf708..ed7c122cb31f 100644
+--- a/include/linux/wait.h
++++ b/include/linux/wait.h
+@@ -1052,10 +1052,9 @@ do { \
+ __ret; \
+ })
+
+-#define __wait_event_interruptible_lock_irq_timeout(wq_head, condition, \
+- lock, timeout) \
++#define __wait_event_lock_irq_timeout(wq_head, condition, lock, timeout, state) \
+ ___wait_event(wq_head, ___wait_cond_timeout(condition), \
+- TASK_INTERRUPTIBLE, 0, timeout, \
++ state, 0, timeout, \
+ spin_unlock_irq(&lock); \
+ __ret = schedule_timeout(__ret); \
+ spin_lock_irq(&lock));
+@@ -1089,8 +1088,19 @@ do { \
+ ({ \
+ long __ret = timeout; \
+ if (!___wait_cond_timeout(condition)) \
+- __ret = __wait_event_interruptible_lock_irq_timeout( \
+- wq_head, condition, lock, timeout); \
++ __ret = __wait_event_lock_irq_timeout( \
++ wq_head, condition, lock, timeout, \
++ TASK_INTERRUPTIBLE); \
++ __ret; \
++})
++
++#define wait_event_lock_irq_timeout(wq_head, condition, lock, timeout) \
++({ \
++ long __ret = timeout; \
++ if (!___wait_cond_timeout(condition)) \
++ __ret = __wait_event_lock_irq_timeout( \
++ wq_head, condition, lock, timeout, \
++ TASK_UNINTERRUPTIBLE); \
+ __ret; \
+ })
+
+diff --git a/include/media/cec.h b/include/media/cec.h
+index ff9847f7f99d..9b7394a74dca 100644
+--- a/include/media/cec.h
++++ b/include/media/cec.h
+@@ -63,7 +63,6 @@ struct cec_data {
+ struct delayed_work work;
+ struct completion c;
+ u8 attempts;
+- bool new_initiator;
+ bool blocking;
+ bool completed;
+ };
+@@ -174,6 +173,7 @@ struct cec_adapter {
+ bool is_configuring;
+ bool is_configured;
+ bool cec_pin_is_high;
++ u8 last_initiator;
+ u32 monitor_all_cnt;
+ u32 monitor_pin_cnt;
+ u32 follower_cnt;
+@@ -461,4 +461,74 @@ static inline void cec_phys_addr_invalidate(struct cec_adapter *adap)
+ cec_s_phys_addr(adap, CEC_PHYS_ADDR_INVALID, false);
+ }
+
++/**
++ * cec_get_edid_spa_location() - find location of the Source Physical Address
++ *
++ * @edid: the EDID
++ * @size: the size of the EDID
++ *
++ * This EDID is expected to be a CEA-861 compliant, which means that there are
++ * at least two blocks and one or more of the extensions blocks are CEA-861
++ * blocks.
++ *
++ * The returned location is guaranteed to be <= size-2.
++ *
++ * This is an inline function since it is used by both CEC and V4L2.
++ * Ideally this would go in a module shared by both, but it is overkill to do
++ * that for just a single function.
++ */
++static inline unsigned int cec_get_edid_spa_location(const u8 *edid,
++ unsigned int size)
++{
++ unsigned int blocks = size / 128;
++ unsigned int block;
++ u8 d;
++
++ /* Sanity check: at least 2 blocks and a multiple of the block size */
++ if (blocks < 2 || size % 128)
++ return 0;
++
++ /*
++ * If there are fewer extension blocks than the size, then update
++ * 'blocks'. It is allowed to have more extension blocks than the size,
++ * since some hardware can only read e.g. 256 bytes of the EDID, even
++ * though more blocks are present. The first CEA-861 extension block
++ * should normally be in block 1 anyway.
++ */
++ if (edid[0x7e] + 1 < blocks)
++ blocks = edid[0x7e] + 1;
++
++ for (block = 1; block < blocks; block++) {
++ unsigned int offset = block * 128;
++
++ /* Skip any non-CEA-861 extension blocks */
++ if (edid[offset] != 0x02 || edid[offset + 1] != 0x03)
++ continue;
++
++ /* search Vendor Specific Data Block (tag 3) */
++ d = edid[offset + 2] & 0x7f;
++ /* Check if there are Data Blocks */
++ if (d <= 4)
++ continue;
++ if (d > 4) {
++ unsigned int i = offset + 4;
++ unsigned int end = offset + d;
++
++ /* Note: 'end' is always < 'size' */
++ do {
++ u8 tag = edid[i] >> 5;
++ u8 len = edid[i] & 0x1f;
++
++ if (tag == 3 && len >= 5 && i + len <= end &&
++ edid[i + 1] == 0x03 &&
++ edid[i + 2] == 0x0c &&
++ edid[i + 3] == 0x00)
++ return i + 4;
++ i += len + 1;
++ } while (i < end);
++ }
++ }
++ return 0;
++}
++
+ #endif /* _MEDIA_CEC_H */
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index e950c2a68f06..ec299fcf55f7 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -1278,21 +1278,27 @@ struct ib_qp_attr {
+ };
+
+ enum ib_wr_opcode {
+- IB_WR_RDMA_WRITE,
+- IB_WR_RDMA_WRITE_WITH_IMM,
+- IB_WR_SEND,
+- IB_WR_SEND_WITH_IMM,
+- IB_WR_RDMA_READ,
+- IB_WR_ATOMIC_CMP_AND_SWP,
+- IB_WR_ATOMIC_FETCH_AND_ADD,
+- IB_WR_LSO,
+- IB_WR_SEND_WITH_INV,
+- IB_WR_RDMA_READ_WITH_INV,
+- IB_WR_LOCAL_INV,
+- IB_WR_REG_MR,
+- IB_WR_MASKED_ATOMIC_CMP_AND_SWP,
+- IB_WR_MASKED_ATOMIC_FETCH_AND_ADD,
++ /* These are shared with userspace */
++ IB_WR_RDMA_WRITE = IB_UVERBS_WR_RDMA_WRITE,
++ IB_WR_RDMA_WRITE_WITH_IMM = IB_UVERBS_WR_RDMA_WRITE_WITH_IMM,
++ IB_WR_SEND = IB_UVERBS_WR_SEND,
++ IB_WR_SEND_WITH_IMM = IB_UVERBS_WR_SEND_WITH_IMM,
++ IB_WR_RDMA_READ = IB_UVERBS_WR_RDMA_READ,
++ IB_WR_ATOMIC_CMP_AND_SWP = IB_UVERBS_WR_ATOMIC_CMP_AND_SWP,
++ IB_WR_ATOMIC_FETCH_AND_ADD = IB_UVERBS_WR_ATOMIC_FETCH_AND_ADD,
++ IB_WR_LSO = IB_UVERBS_WR_TSO,
++ IB_WR_SEND_WITH_INV = IB_UVERBS_WR_SEND_WITH_INV,
++ IB_WR_RDMA_READ_WITH_INV = IB_UVERBS_WR_RDMA_READ_WITH_INV,
++ IB_WR_LOCAL_INV = IB_UVERBS_WR_LOCAL_INV,
++ IB_WR_MASKED_ATOMIC_CMP_AND_SWP =
++ IB_UVERBS_WR_MASKED_ATOMIC_CMP_AND_SWP,
++ IB_WR_MASKED_ATOMIC_FETCH_AND_ADD =
++ IB_UVERBS_WR_MASKED_ATOMIC_FETCH_AND_ADD,
++
++ /* These are kernel only and can not be issued by userspace */
++ IB_WR_REG_MR = 0x20,
+ IB_WR_REG_SIG_MR,
++
+ /* reserve values for low level drivers' internal use.
+ * These values will not be used at all in the ib core layer.
+ */
+diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h
+index 097fcd812471..3094af68b6e7 100644
+--- a/include/uapi/linux/cec.h
++++ b/include/uapi/linux/cec.h
+@@ -152,10 +152,13 @@ static inline void cec_msg_set_reply_to(struct cec_msg *msg,
+ #define CEC_TX_STATUS_LOW_DRIVE (1 << 3)
+ #define CEC_TX_STATUS_ERROR (1 << 4)
+ #define CEC_TX_STATUS_MAX_RETRIES (1 << 5)
++#define CEC_TX_STATUS_ABORTED (1 << 6)
++#define CEC_TX_STATUS_TIMEOUT (1 << 7)
+
+ #define CEC_RX_STATUS_OK (1 << 0)
+ #define CEC_RX_STATUS_TIMEOUT (1 << 1)
+ #define CEC_RX_STATUS_FEATURE_ABORT (1 << 2)
++#define CEC_RX_STATUS_ABORTED (1 << 3)
+
+ static inline int cec_msg_status_is_ok(const struct cec_msg *msg)
+ {
+diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h
+index 73e01918f996..a441ea1bfe6d 100644
+--- a/include/uapi/linux/fs.h
++++ b/include/uapi/linux/fs.h
+@@ -279,8 +279,8 @@ struct fsxattr {
+ #define FS_ENCRYPTION_MODE_AES_256_CTS 4
+ #define FS_ENCRYPTION_MODE_AES_128_CBC 5
+ #define FS_ENCRYPTION_MODE_AES_128_CTS 6
+-#define FS_ENCRYPTION_MODE_SPECK128_256_XTS 7
+-#define FS_ENCRYPTION_MODE_SPECK128_256_CTS 8
++#define FS_ENCRYPTION_MODE_SPECK128_256_XTS 7 /* Removed, do not use. */
++#define FS_ENCRYPTION_MODE_SPECK128_256_CTS 8 /* Removed, do not use. */
+
+ struct fscrypt_policy {
+ __u8 version;
+diff --git a/include/uapi/linux/ndctl.h b/include/uapi/linux/ndctl.h
+index 7e27070b9440..2f2c43d633c5 100644
+--- a/include/uapi/linux/ndctl.h
++++ b/include/uapi/linux/ndctl.h
+@@ -128,37 +128,31 @@ enum {
+
+ static inline const char *nvdimm_bus_cmd_name(unsigned cmd)
+ {
+- static const char * const names[] = {
+- [ND_CMD_ARS_CAP] = "ars_cap",
+- [ND_CMD_ARS_START] = "ars_start",
+- [ND_CMD_ARS_STATUS] = "ars_status",
+- [ND_CMD_CLEAR_ERROR] = "clear_error",
+- [ND_CMD_CALL] = "cmd_call",
+- };
+-
+- if (cmd < ARRAY_SIZE(names) && names[cmd])
+- return names[cmd];
+- return "unknown";
++ switch (cmd) {
++ case ND_CMD_ARS_CAP: return "ars_cap";
++ case ND_CMD_ARS_START: return "ars_start";
++ case ND_CMD_ARS_STATUS: return "ars_status";
++ case ND_CMD_CLEAR_ERROR: return "clear_error";
++ case ND_CMD_CALL: return "cmd_call";
++ default: return "unknown";
++ }
+ }
+
+ static inline const char *nvdimm_cmd_name(unsigned cmd)
+ {
+- static const char * const names[] = {
+- [ND_CMD_SMART] = "smart",
+- [ND_CMD_SMART_THRESHOLD] = "smart_thresh",
+- [ND_CMD_DIMM_FLAGS] = "flags",
+- [ND_CMD_GET_CONFIG_SIZE] = "get_size",
+- [ND_CMD_GET_CONFIG_DATA] = "get_data",
+- [ND_CMD_SET_CONFIG_DATA] = "set_data",
+- [ND_CMD_VENDOR_EFFECT_LOG_SIZE] = "effect_size",
+- [ND_CMD_VENDOR_EFFECT_LOG] = "effect_log",
+- [ND_CMD_VENDOR] = "vendor",
+- [ND_CMD_CALL] = "cmd_call",
+- };
+-
+- if (cmd < ARRAY_SIZE(names) && names[cmd])
+- return names[cmd];
+- return "unknown";
++ switch (cmd) {
++ case ND_CMD_SMART: return "smart";
++ case ND_CMD_SMART_THRESHOLD: return "smart_thresh";
++ case ND_CMD_DIMM_FLAGS: return "flags";
++ case ND_CMD_GET_CONFIG_SIZE: return "get_size";
++ case ND_CMD_GET_CONFIG_DATA: return "get_data";
++ case ND_CMD_SET_CONFIG_DATA: return "set_data";
++ case ND_CMD_VENDOR_EFFECT_LOG_SIZE: return "effect_size";
++ case ND_CMD_VENDOR_EFFECT_LOG: return "effect_log";
++ case ND_CMD_VENDOR: return "vendor";
++ case ND_CMD_CALL: return "cmd_call";
++ default: return "unknown";
++ }
+ }
+
+ #define ND_IOCTL 'N'
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index 5d1a3685bea9..1aae2e4b8f10 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -225,8 +225,8 @@ enum v4l2_colorspace {
+ /* For RGB colorspaces such as produces by most webcams. */
+ V4L2_COLORSPACE_SRGB = 8,
+
+- /* AdobeRGB colorspace */
+- V4L2_COLORSPACE_ADOBERGB = 9,
++ /* opRGB colorspace */
++ V4L2_COLORSPACE_OPRGB = 9,
+
+ /* BT.2020 colorspace, used for UHDTV. */
+ V4L2_COLORSPACE_BT2020 = 10,
+@@ -258,7 +258,7 @@ enum v4l2_xfer_func {
+ *
+ * V4L2_COLORSPACE_SRGB, V4L2_COLORSPACE_JPEG: V4L2_XFER_FUNC_SRGB
+ *
+- * V4L2_COLORSPACE_ADOBERGB: V4L2_XFER_FUNC_ADOBERGB
++ * V4L2_COLORSPACE_OPRGB: V4L2_XFER_FUNC_OPRGB
+ *
+ * V4L2_COLORSPACE_SMPTE240M: V4L2_XFER_FUNC_SMPTE240M
+ *
+@@ -269,7 +269,7 @@ enum v4l2_xfer_func {
+ V4L2_XFER_FUNC_DEFAULT = 0,
+ V4L2_XFER_FUNC_709 = 1,
+ V4L2_XFER_FUNC_SRGB = 2,
+- V4L2_XFER_FUNC_ADOBERGB = 3,
++ V4L2_XFER_FUNC_OPRGB = 3,
+ V4L2_XFER_FUNC_SMPTE240M = 4,
+ V4L2_XFER_FUNC_NONE = 5,
+ V4L2_XFER_FUNC_DCI_P3 = 6,
+@@ -281,7 +281,7 @@ enum v4l2_xfer_func {
+ * This depends on the colorspace.
+ */
+ #define V4L2_MAP_XFER_FUNC_DEFAULT(colsp) \
+- ((colsp) == V4L2_COLORSPACE_ADOBERGB ? V4L2_XFER_FUNC_ADOBERGB : \
++ ((colsp) == V4L2_COLORSPACE_OPRGB ? V4L2_XFER_FUNC_OPRGB : \
+ ((colsp) == V4L2_COLORSPACE_SMPTE240M ? V4L2_XFER_FUNC_SMPTE240M : \
+ ((colsp) == V4L2_COLORSPACE_DCI_P3 ? V4L2_XFER_FUNC_DCI_P3 : \
+ ((colsp) == V4L2_COLORSPACE_RAW ? V4L2_XFER_FUNC_NONE : \
+@@ -295,7 +295,7 @@ enum v4l2_ycbcr_encoding {
+ *
+ * V4L2_COLORSPACE_SMPTE170M, V4L2_COLORSPACE_470_SYSTEM_M,
+ * V4L2_COLORSPACE_470_SYSTEM_BG, V4L2_COLORSPACE_SRGB,
+- * V4L2_COLORSPACE_ADOBERGB and V4L2_COLORSPACE_JPEG: V4L2_YCBCR_ENC_601
++ * V4L2_COLORSPACE_OPRGB and V4L2_COLORSPACE_JPEG: V4L2_YCBCR_ENC_601
+ *
+ * V4L2_COLORSPACE_REC709 and V4L2_COLORSPACE_DCI_P3: V4L2_YCBCR_ENC_709
+ *
+@@ -382,6 +382,17 @@ enum v4l2_quantization {
+ (((is_rgb_or_hsv) || (colsp) == V4L2_COLORSPACE_JPEG) ? \
+ V4L2_QUANTIZATION_FULL_RANGE : V4L2_QUANTIZATION_LIM_RANGE))
+
++/*
++ * Deprecated names for opRGB colorspace (IEC 61966-2-5)
++ *
++ * WARNING: Please don't use these deprecated defines in your code, as
++ * there is a chance we have to remove them in the future.
++ */
++#ifndef __KERNEL__
++#define V4L2_COLORSPACE_ADOBERGB V4L2_COLORSPACE_OPRGB
++#define V4L2_XFER_FUNC_ADOBERGB V4L2_XFER_FUNC_OPRGB
++#endif
++
+ enum v4l2_priority {
+ V4L2_PRIORITY_UNSET = 0, /* not initialized */
+ V4L2_PRIORITY_BACKGROUND = 1,
+diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
+index 25a16760de2a..1254b51a551a 100644
+--- a/include/uapi/rdma/ib_user_verbs.h
++++ b/include/uapi/rdma/ib_user_verbs.h
+@@ -763,10 +763,28 @@ struct ib_uverbs_sge {
+ __u32 lkey;
+ };
+
++enum ib_uverbs_wr_opcode {
++ IB_UVERBS_WR_RDMA_WRITE = 0,
++ IB_UVERBS_WR_RDMA_WRITE_WITH_IMM = 1,
++ IB_UVERBS_WR_SEND = 2,
++ IB_UVERBS_WR_SEND_WITH_IMM = 3,
++ IB_UVERBS_WR_RDMA_READ = 4,
++ IB_UVERBS_WR_ATOMIC_CMP_AND_SWP = 5,
++ IB_UVERBS_WR_ATOMIC_FETCH_AND_ADD = 6,
++ IB_UVERBS_WR_LOCAL_INV = 7,
++ IB_UVERBS_WR_BIND_MW = 8,
++ IB_UVERBS_WR_SEND_WITH_INV = 9,
++ IB_UVERBS_WR_TSO = 10,
++ IB_UVERBS_WR_RDMA_READ_WITH_INV = 11,
++ IB_UVERBS_WR_MASKED_ATOMIC_CMP_AND_SWP = 12,
++ IB_UVERBS_WR_MASKED_ATOMIC_FETCH_AND_ADD = 13,
++ /* Review enum ib_wr_opcode before modifying this */
++};
++
+ struct ib_uverbs_send_wr {
+ __aligned_u64 wr_id;
+ __u32 num_sge;
+- __u32 opcode;
++ __u32 opcode; /* see enum ib_uverbs_wr_opcode */
+ __u32 send_flags;
+ union {
+ __be32 imm_data;
+diff --git a/kernel/bounds.c b/kernel/bounds.c
+index c373e887c066..9795d75b09b2 100644
+--- a/kernel/bounds.c
++++ b/kernel/bounds.c
+@@ -13,7 +13,7 @@
+ #include <linux/log2.h>
+ #include <linux/spinlock_types.h>
+
+-void foo(void)
++int main(void)
+ {
+ /* The enum constants to put into include/generated/bounds.h */
+ DEFINE(NR_PAGEFLAGS, __NR_PAGEFLAGS);
+@@ -23,4 +23,6 @@ void foo(void)
+ #endif
+ DEFINE(SPINLOCK_SIZE, sizeof(spinlock_t));
+ /* End of constants */
++
++ return 0;
+ }
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 8339d81cba1d..675eb6d36e47 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -741,6 +741,17 @@ err_put:
+ return err;
+ }
+
++static void maybe_wait_bpf_programs(struct bpf_map *map)
++{
++ /* Wait for any running BPF programs to complete so that
++ * userspace, when we return to it, knows that all programs
++ * that could be running use the new map value.
++ */
++ if (map->map_type == BPF_MAP_TYPE_HASH_OF_MAPS ||
++ map->map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS)
++ synchronize_rcu();
++}
++
+ #define BPF_MAP_UPDATE_ELEM_LAST_FIELD flags
+
+ static int map_update_elem(union bpf_attr *attr)
+@@ -831,6 +842,7 @@ static int map_update_elem(union bpf_attr *attr)
+ }
+ __this_cpu_dec(bpf_prog_active);
+ preempt_enable();
++ maybe_wait_bpf_programs(map);
+ out:
+ free_value:
+ kfree(value);
+@@ -883,6 +895,7 @@ static int map_delete_elem(union bpf_attr *attr)
+ rcu_read_unlock();
+ __this_cpu_dec(bpf_prog_active);
+ preempt_enable();
++ maybe_wait_bpf_programs(map);
+ out:
+ kfree(key);
+ err_put:
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 465952a8e465..5780876ac81a 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -553,7 +553,9 @@ static void __mark_reg_not_init(struct bpf_reg_state *reg);
+ */
+ static void __mark_reg_known(struct bpf_reg_state *reg, u64 imm)
+ {
+- reg->id = 0;
++ /* Clear id, off, and union(map_ptr, range) */
++ memset(((u8 *)reg) + sizeof(reg->type), 0,
++ offsetof(struct bpf_reg_state, var_off) - sizeof(reg->type));
+ reg->var_off = tnum_const(imm);
+ reg->smin_value = (s64)imm;
+ reg->smax_value = (s64)imm;
+@@ -572,7 +574,6 @@ static void __mark_reg_known_zero(struct bpf_reg_state *reg)
+ static void __mark_reg_const_zero(struct bpf_reg_state *reg)
+ {
+ __mark_reg_known(reg, 0);
+- reg->off = 0;
+ reg->type = SCALAR_VALUE;
+ }
+
+@@ -683,9 +684,12 @@ static void __mark_reg_unbounded(struct bpf_reg_state *reg)
+ /* Mark a register as having a completely unknown (scalar) value. */
+ static void __mark_reg_unknown(struct bpf_reg_state *reg)
+ {
++ /*
++ * Clear type, id, off, and union(map_ptr, range) and
++ * padding between 'type' and union
++ */
++ memset(reg, 0, offsetof(struct bpf_reg_state, var_off));
+ reg->type = SCALAR_VALUE;
+- reg->id = 0;
+- reg->off = 0;
+ reg->var_off = tnum_unknown;
+ reg->frameno = 0;
+ __mark_reg_unbounded(reg);
+@@ -1727,9 +1731,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
+ else
+ mark_reg_known_zero(env, regs,
+ value_regno);
+- regs[value_regno].id = 0;
+- regs[value_regno].off = 0;
+- regs[value_regno].range = 0;
+ regs[value_regno].type = reg_type;
+ }
+
+@@ -2580,7 +2581,6 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
+ regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL;
+ /* There is no offset yet applied, variable or fixed */
+ mark_reg_known_zero(env, regs, BPF_REG_0);
+- regs[BPF_REG_0].off = 0;
+ /* remember map_ptr, so that check_map_access()
+ * can check 'value_size' boundary of memory access
+ * to map element returned from bpf_map_lookup_elem()
+@@ -2762,7 +2762,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ dst_reg->umax_value = umax_ptr;
+ dst_reg->var_off = ptr_reg->var_off;
+ dst_reg->off = ptr_reg->off + smin_val;
+- dst_reg->range = ptr_reg->range;
++ dst_reg->raw = ptr_reg->raw;
+ break;
+ }
+ /* A new variable offset is created. Note that off_reg->off
+@@ -2792,10 +2792,11 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ }
+ dst_reg->var_off = tnum_add(ptr_reg->var_off, off_reg->var_off);
+ dst_reg->off = ptr_reg->off;
++ dst_reg->raw = ptr_reg->raw;
+ if (reg_is_pkt_pointer(ptr_reg)) {
+ dst_reg->id = ++env->id_gen;
+ /* something was added to pkt_ptr, set range to zero */
+- dst_reg->range = 0;
++ dst_reg->raw = 0;
+ }
+ break;
+ case BPF_SUB:
+@@ -2824,7 +2825,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ dst_reg->var_off = ptr_reg->var_off;
+ dst_reg->id = ptr_reg->id;
+ dst_reg->off = ptr_reg->off - smin_val;
+- dst_reg->range = ptr_reg->range;
++ dst_reg->raw = ptr_reg->raw;
+ break;
+ }
+ /* A new variable offset is created. If the subtrahend is known
+@@ -2850,11 +2851,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ }
+ dst_reg->var_off = tnum_sub(ptr_reg->var_off, off_reg->var_off);
+ dst_reg->off = ptr_reg->off;
++ dst_reg->raw = ptr_reg->raw;
+ if (reg_is_pkt_pointer(ptr_reg)) {
+ dst_reg->id = ++env->id_gen;
+ /* something was added to pkt_ptr, set range to zero */
+ if (smin_val < 0)
+- dst_reg->range = 0;
++ dst_reg->raw = 0;
+ }
+ break;
+ case BPF_AND:
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 0097acec1c71..3adecda21444 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2026,6 +2026,12 @@ static void cpuhp_online_cpu_device(unsigned int cpu)
+ kobject_uevent(&dev->kobj, KOBJ_ONLINE);
+ }
+
++/*
++ * Architectures that need SMT-specific errata handling during SMT hotplug
++ * should override this.
++ */
++void __weak arch_smt_update(void) { };
++
+ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ {
+ int cpu, ret = 0;
+@@ -2052,8 +2058,10 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ */
+ cpuhp_offline_cpu_device(cpu);
+ }
+- if (!ret)
++ if (!ret) {
+ cpu_smt_control = ctrlval;
++ arch_smt_update();
++ }
+ cpu_maps_update_done();
+ return ret;
+ }
+@@ -2064,6 +2072,7 @@ static int cpuhp_smt_enable(void)
+
+ cpu_maps_update_begin();
+ cpu_smt_control = CPU_SMT_ENABLED;
++ arch_smt_update();
+ for_each_present_cpu(cpu) {
+ /* Skip online CPUs and CPUs on offline nodes */
+ if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
+diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c
+index 286d82329eb0..b2a87905846d 100644
+--- a/kernel/dma/contiguous.c
++++ b/kernel/dma/contiguous.c
+@@ -49,7 +49,11 @@ static phys_addr_t limit_cmdline;
+
+ static int __init early_cma(char *p)
+ {
+- pr_debug("%s(%s)\n", __func__, p);
++ if (!p) {
++ pr_err("Config string not provided\n");
++ return -EINVAL;
++ }
++
+ size_cmdline = memparse(p, &p);
+ if (*p != '@')
+ return 0;
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index fb86146037a7..9dbdccab3b6a 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -927,6 +927,9 @@ irq_forced_thread_fn(struct irq_desc *desc, struct irqaction *action)
+
+ local_bh_disable();
+ ret = action->thread_fn(action->irq, action->dev_id);
++ if (ret == IRQ_HANDLED)
++ atomic_inc(&desc->threads_handled);
++
+ irq_finalize_oneshot(desc, action);
+ local_bh_enable();
+ return ret;
+@@ -943,6 +946,9 @@ static irqreturn_t irq_thread_fn(struct irq_desc *desc,
+ irqreturn_t ret;
+
+ ret = action->thread_fn(action->irq, action->dev_id);
++ if (ret == IRQ_HANDLED)
++ atomic_inc(&desc->threads_handled);
++
+ irq_finalize_oneshot(desc, action);
+ return ret;
+ }
+@@ -1020,8 +1026,6 @@ static int irq_thread(void *data)
+ irq_thread_check_affinity(desc, action);
+
+ action_ret = handler_fn(desc, action);
+- if (action_ret == IRQ_HANDLED)
+- atomic_inc(&desc->threads_handled);
+ if (action_ret == IRQ_WAKE_THREAD)
+ irq_wake_secondary(desc, action);
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index ab257be4d924..4344381664cc 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -700,9 +700,10 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)
+ }
+
+ /* Cancel unoptimizing for reusing */
+-static void reuse_unused_kprobe(struct kprobe *ap)
++static int reuse_unused_kprobe(struct kprobe *ap)
+ {
+ struct optimized_kprobe *op;
++ int ret;
+
+ BUG_ON(!kprobe_unused(ap));
+ /*
+@@ -714,8 +715,12 @@ static void reuse_unused_kprobe(struct kprobe *ap)
+ /* Enable the probe again */
+ ap->flags &= ~KPROBE_FLAG_DISABLED;
+ /* Optimize it again (remove from op->list) */
+- BUG_ON(!kprobe_optready(ap));
++ ret = kprobe_optready(ap);
++ if (ret)
++ return ret;
++
+ optimize_kprobe(ap);
++ return 0;
+ }
+
+ /* Remove optimized instructions */
+@@ -940,11 +945,16 @@ static void __disarm_kprobe(struct kprobe *p, bool reopt)
+ #define kprobe_disarmed(p) kprobe_disabled(p)
+ #define wait_for_kprobe_optimizer() do {} while (0)
+
+-/* There should be no unused kprobes can be reused without optimization */
+-static void reuse_unused_kprobe(struct kprobe *ap)
++static int reuse_unused_kprobe(struct kprobe *ap)
+ {
++ /*
++ * If the optimized kprobe is NOT supported, the aggr kprobe is
++ * released at the same time that the last aggregated kprobe is
++ * unregistered.
++ * Thus there should be no chance to reuse unused kprobe.
++ */
+ printk(KERN_ERR "Error: There should be no unused kprobe here.\n");
+- BUG_ON(kprobe_unused(ap));
++ return -EINVAL;
+ }
+
+ static void free_aggr_kprobe(struct kprobe *p)
+@@ -1318,9 +1328,12 @@ static int register_aggr_kprobe(struct kprobe *orig_p, struct kprobe *p)
+ goto out;
+ }
+ init_aggr_kprobe(ap, orig_p);
+- } else if (kprobe_unused(ap))
++ } else if (kprobe_unused(ap)) {
+ /* This probe is going to die. Rescue it */
+- reuse_unused_kprobe(ap);
++ ret = reuse_unused_kprobe(ap);
++ if (ret)
++ goto out;
++ }
+
+ if (kprobe_gone(ap)) {
+ /*
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index dd13f865ad40..26b57e24476f 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -4122,7 +4122,7 @@ void lock_contended(struct lockdep_map *lock, unsigned long ip)
+ {
+ unsigned long flags;
+
+- if (unlikely(!lock_stat))
++ if (unlikely(!lock_stat || !debug_locks))
+ return;
+
+ if (unlikely(current->lockdep_recursion))
+@@ -4142,7 +4142,7 @@ void lock_acquired(struct lockdep_map *lock, unsigned long ip)
+ {
+ unsigned long flags;
+
+- if (unlikely(!lock_stat))
++ if (unlikely(!lock_stat || !debug_locks))
+ return;
+
+ if (unlikely(current->lockdep_recursion))
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 9bf5404397e0..06045abd1887 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -1048,7 +1048,12 @@ static void __init log_buf_len_update(unsigned size)
+ /* save requested log_buf_len since it's too early to process it */
+ static int __init log_buf_len_setup(char *str)
+ {
+- unsigned size = memparse(str, &str);
++ unsigned int size;
++
++ if (!str)
++ return -EINVAL;
++
++ size = memparse(str, &str);
+
+ log_buf_len_update(size);
+
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 5843c541fda9..edc28afc9fb4 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -1035,7 +1035,7 @@ static int __send_signal(int sig, struct siginfo *info, struct task_struct *t,
+
+ result = TRACE_SIGNAL_IGNORED;
+ if (!prepare_signal(sig, t,
+- from_ancestor_ns || (info == SEND_SIG_FORCED)))
++ from_ancestor_ns || (info == SEND_SIG_PRIV) || (info == SEND_SIG_FORCED)))
+ goto ret;
+
+ pending = (type != PIDTYPE_PID) ? &t->signal->shared_pending : &t->pending;
+@@ -2847,7 +2847,7 @@ COMPAT_SYSCALL_DEFINE2(rt_sigpending, compat_sigset_t __user *, uset,
+ }
+ #endif
+
+-enum siginfo_layout siginfo_layout(int sig, int si_code)
++enum siginfo_layout siginfo_layout(unsigned sig, int si_code)
+ {
+ enum siginfo_layout layout = SIL_KILL;
+ if ((si_code > SI_USER) && (si_code < SI_KERNEL)) {
+@@ -3460,7 +3460,8 @@ int do_sigaction(int sig, struct k_sigaction *act, struct k_sigaction *oact)
+ }
+
+ static int
+-do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp)
++do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp,
++ size_t min_ss_size)
+ {
+ struct task_struct *t = current;
+
+@@ -3490,7 +3491,7 @@ do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp)
+ ss_size = 0;
+ ss_sp = NULL;
+ } else {
+- if (unlikely(ss_size < MINSIGSTKSZ))
++ if (unlikely(ss_size < min_ss_size))
+ return -ENOMEM;
+ }
+
+@@ -3508,7 +3509,8 @@ SYSCALL_DEFINE2(sigaltstack,const stack_t __user *,uss, stack_t __user *,uoss)
+ if (uss && copy_from_user(&new, uss, sizeof(stack_t)))
+ return -EFAULT;
+ err = do_sigaltstack(uss ? &new : NULL, uoss ? &old : NULL,
+- current_user_stack_pointer());
++ current_user_stack_pointer(),
++ MINSIGSTKSZ);
+ if (!err && uoss && copy_to_user(uoss, &old, sizeof(stack_t)))
+ err = -EFAULT;
+ return err;
+@@ -3519,7 +3521,8 @@ int restore_altstack(const stack_t __user *uss)
+ stack_t new;
+ if (copy_from_user(&new, uss, sizeof(stack_t)))
+ return -EFAULT;
+- (void)do_sigaltstack(&new, NULL, current_user_stack_pointer());
++ (void)do_sigaltstack(&new, NULL, current_user_stack_pointer(),
++ MINSIGSTKSZ);
+ /* squash all but EFAULT for now */
+ return 0;
+ }
+@@ -3553,7 +3556,8 @@ static int do_compat_sigaltstack(const compat_stack_t __user *uss_ptr,
+ uss.ss_size = uss32.ss_size;
+ }
+ ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss,
+- compat_user_stack_pointer());
++ compat_user_stack_pointer(),
++ COMPAT_MINSIGSTKSZ);
+ if (ret >= 0 && uoss_ptr) {
+ compat_stack_t old;
+ memset(&old, 0, sizeof(old));
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index d239004aaf29..eb908ef2ecec 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -1063,8 +1063,10 @@ static int create_synth_event(int argc, char **argv)
+ event = NULL;
+ ret = -EEXIST;
+ goto out;
+- } else if (delete_event)
++ } else if (delete_event) {
++ ret = -ENOENT;
+ goto out;
++ }
+
+ if (argc < 2) {
+ ret = -EINVAL;
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index e5222b5fb4fe..923414a246e9 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -974,10 +974,6 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ if (!new_idmap_permitted(file, ns, cap_setid, &new_map))
+ goto out;
+
+- ret = sort_idmaps(&new_map);
+- if (ret < 0)
+- goto out;
+-
+ ret = -EPERM;
+ /* Map the lower ids from the parent user namespace to the
+ * kernel global id space.
+@@ -1004,6 +1000,14 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ e->lower_first = lower_first;
+ }
+
++ /*
++ * If we want to use binary search for lookup, this clones the extent
++ * array and sorts both copies.
++ */
++ ret = sort_idmaps(&new_map);
++ if (ret < 0)
++ goto out;
++
+ /* Install the map */
+ if (new_map.nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS) {
+ memcpy(map->extent, new_map.extent,
+diff --git a/lib/debug_locks.c b/lib/debug_locks.c
+index 96c4c633d95e..124fdf238b3d 100644
+--- a/lib/debug_locks.c
++++ b/lib/debug_locks.c
+@@ -37,7 +37,7 @@ EXPORT_SYMBOL_GPL(debug_locks_silent);
+ */
+ int debug_locks_off(void)
+ {
+- if (__debug_locks_off()) {
++ if (debug_locks && __debug_locks_off()) {
+ if (!debug_locks_silent) {
+ console_verbose();
+ return 1;
+diff --git a/mm/hmm.c b/mm/hmm.c
+index c968e49f7a0c..90193a7fabce 100644
+--- a/mm/hmm.c
++++ b/mm/hmm.c
+@@ -91,16 +91,6 @@ static struct hmm *hmm_register(struct mm_struct *mm)
+ spin_lock_init(&hmm->lock);
+ hmm->mm = mm;
+
+- /*
+- * We should only get here if hold the mmap_sem in write mode ie on
+- * registration of first mirror through hmm_mirror_register()
+- */
+- hmm->mmu_notifier.ops = &hmm_mmu_notifier_ops;
+- if (__mmu_notifier_register(&hmm->mmu_notifier, mm)) {
+- kfree(hmm);
+- return NULL;
+- }
+-
+ spin_lock(&mm->page_table_lock);
+ if (!mm->hmm)
+ mm->hmm = hmm;
+@@ -108,12 +98,27 @@ static struct hmm *hmm_register(struct mm_struct *mm)
+ cleanup = true;
+ spin_unlock(&mm->page_table_lock);
+
+- if (cleanup) {
+- mmu_notifier_unregister(&hmm->mmu_notifier, mm);
+- kfree(hmm);
+- }
++ if (cleanup)
++ goto error;
++
++ /*
++ * We should only get here if hold the mmap_sem in write mode ie on
++ * registration of first mirror through hmm_mirror_register()
++ */
++ hmm->mmu_notifier.ops = &hmm_mmu_notifier_ops;
++ if (__mmu_notifier_register(&hmm->mmu_notifier, mm))
++ goto error_mm;
+
+ return mm->hmm;
++
++error_mm:
++ spin_lock(&mm->page_table_lock);
++ if (mm->hmm == hmm)
++ mm->hmm = NULL;
++ spin_unlock(&mm->page_table_lock);
++error:
++ kfree(hmm);
++ return NULL;
+ }
+
+ void hmm_mm_destroy(struct mm_struct *mm)
+@@ -278,12 +283,13 @@ void hmm_mirror_unregister(struct hmm_mirror *mirror)
+ if (!should_unregister || mm == NULL)
+ return;
+
++ mmu_notifier_unregister_no_release(&hmm->mmu_notifier, mm);
++
+ spin_lock(&mm->page_table_lock);
+ if (mm->hmm == hmm)
+ mm->hmm = NULL;
+ spin_unlock(&mm->page_table_lock);
+
+- mmu_notifier_unregister_no_release(&hmm->mmu_notifier, mm);
+ kfree(hmm);
+ }
+ EXPORT_SYMBOL(hmm_mirror_unregister);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 5c390f5a5207..7b5c0ad9a6bd 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3690,6 +3690,12 @@ int huge_add_to_page_cache(struct page *page, struct address_space *mapping,
+ return err;
+ ClearPagePrivate(page);
+
++ /*
++ * set page dirty so that it will not be removed from cache/file
++ * by non-hugetlbfs specific code paths.
++ */
++ set_page_dirty(page);
++
+ spin_lock(&inode->i_lock);
+ inode->i_blocks += blocks_per_huge_page(h);
+ spin_unlock(&inode->i_lock);
+diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
+index ae3c2a35d61b..11df03e71288 100644
+--- a/mm/page_vma_mapped.c
++++ b/mm/page_vma_mapped.c
+@@ -21,7 +21,29 @@ static bool map_pte(struct page_vma_mapped_walk *pvmw)
+ if (!is_swap_pte(*pvmw->pte))
+ return false;
+ } else {
+- if (!pte_present(*pvmw->pte))
++ /*
++ * We get here when we are trying to unmap a private
++ * device page from the process address space. Such
++ * page is not CPU accessible and thus is mapped as
++ * a special swap entry, nonetheless it still does
++ * count as a valid regular mapping for the page (and
++ * is accounted as such in page maps count).
++ *
++ * So handle this special case as if it was a normal
++ * page mapping ie lock CPU page table and returns
++ * true.
++ *
++ * For more details on device private memory see HMM
++ * (include/linux/hmm.h or mm/hmm.c).
++ */
++ if (is_swap_pte(*pvmw->pte)) {
++ swp_entry_t entry;
++
++ /* Handle un-addressable ZONE_DEVICE memory */
++ entry = pte_to_swp_entry(*pvmw->pte);
++ if (!is_device_private_entry(entry))
++ return false;
++ } else if (!pte_present(*pvmw->pte))
+ return false;
+ }
+ }
+diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
+index 5e4f04004a49..7bf833598615 100644
+--- a/net/core/netclassid_cgroup.c
++++ b/net/core/netclassid_cgroup.c
+@@ -106,6 +106,7 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft,
+ iterate_fd(p->files, 0, update_classid_sock,
+ (void *)(unsigned long)cs->classid);
+ task_unlock(p);
++ cond_resched();
+ }
+ css_task_iter_end(&it);
+
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index 82178cc69c96..777fa3b7fb13 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -1512,7 +1512,7 @@ static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
+ *
+ * Description:
+ * Parse the packet's IP header looking for a CIPSO option. Returns a pointer
+- * to the start of the CIPSO option on success, NULL if one if not found.
++ * to the start of the CIPSO option on success, NULL if one is not found.
+ *
+ */
+ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+@@ -1522,10 +1522,8 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+ int optlen;
+ int taglen;
+
+- for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
++ for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 1; ) {
+ switch (optptr[0]) {
+- case IPOPT_CIPSO:
+- return optptr;
+ case IPOPT_END:
+ return NULL;
+ case IPOPT_NOOP:
+@@ -1534,6 +1532,11 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+ default:
+ taglen = optptr[1];
+ }
++ if (!taglen || taglen > optlen)
++ return NULL;
++ if (optptr[0] == IPOPT_CIPSO)
++ return optptr;
++
+ optlen -= taglen;
+ optptr += taglen;
+ }
+diff --git a/net/netfilter/xt_nat.c b/net/netfilter/xt_nat.c
+index 8af9707f8789..ac91170fc8c8 100644
+--- a/net/netfilter/xt_nat.c
++++ b/net/netfilter/xt_nat.c
+@@ -216,6 +216,8 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
+ {
+ .name = "DNAT",
+ .revision = 2,
++ .checkentry = xt_nat_checkentry,
++ .destroy = xt_nat_destroy,
+ .target = xt_dnat_target_v2,
+ .targetsize = sizeof(struct nf_nat_range2),
+ .table = "nat",
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 3dc0acf54245..be7cd140b2a3 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1309,7 +1309,6 @@ check_loop_fn(struct Qdisc *q, unsigned long cl, struct qdisc_walker *w)
+
+ const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = {
+ [TCA_KIND] = { .type = NLA_STRING },
+- [TCA_OPTIONS] = { .type = NLA_NESTED },
+ [TCA_RATE] = { .type = NLA_BINARY,
+ .len = sizeof(struct tc_estimator) },
+ [TCA_STAB] = { .type = NLA_NESTED },
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 5185efb9027b..83ccd0221c98 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -989,7 +989,7 @@ static void call_xpt_users(struct svc_xprt *xprt)
+ spin_lock(&xprt->xpt_lock);
+ while (!list_empty(&xprt->xpt_users)) {
+ u = list_first_entry(&xprt->xpt_users, struct svc_xpt_user, list);
+- list_del(&u->list);
++ list_del_init(&u->list);
+ u->callback(u);
+ }
+ spin_unlock(&xprt->xpt_lock);
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+index a68180090554..b9827665ff35 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+@@ -248,6 +248,7 @@ static void
+ xprt_rdma_bc_close(struct rpc_xprt *xprt)
+ {
+ dprintk("svcrdma: %s: xprt %p\n", __func__, xprt);
++ xprt->cwnd = RPC_CWNDSHIFT;
+ }
+
+ static void
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index 143ce2579ba9..98cbc7b060ba 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -468,6 +468,12 @@ xprt_rdma_close(struct rpc_xprt *xprt)
+ xprt->reestablish_timeout = 0;
+ xprt_disconnect_done(xprt);
+ rpcrdma_ep_disconnect(ep, ia);
++
++ /* Prepare @xprt for the next connection by reinitializing
++ * its credit grant to one (see RFC 8166, Section 3.3.3).
++ */
++ r_xprt->rx_buf.rb_credits = 1;
++ xprt->cwnd = RPC_CWNDSHIFT;
+ }
+
+ /**
+diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
+index 7e7e7e7c250a..d9e7728027c6 100644
+--- a/security/integrity/ima/ima_crypto.c
++++ b/security/integrity/ima/ima_crypto.c
+@@ -210,7 +210,7 @@ static int ima_calc_file_hash_atfm(struct file *file,
+ {
+ loff_t i_size, offset;
+ char *rbuf[2] = { NULL, };
+- int rc, read = 0, rbuf_len, active = 0, ahash_rc = 0;
++ int rc, rbuf_len, active = 0, ahash_rc = 0;
+ struct ahash_request *req;
+ struct scatterlist sg[1];
+ struct crypto_wait wait;
+@@ -257,11 +257,6 @@ static int ima_calc_file_hash_atfm(struct file *file,
+ &rbuf_size[1], 0);
+ }
+
+- if (!(file->f_mode & FMODE_READ)) {
+- file->f_mode |= FMODE_READ;
+- read = 1;
+- }
+-
+ for (offset = 0; offset < i_size; offset += rbuf_len) {
+ if (!rbuf[1] && offset) {
+ /* Not using two buffers, and it is not the first
+@@ -300,8 +295,6 @@ static int ima_calc_file_hash_atfm(struct file *file,
+ /* wait for the last update request to complete */
+ rc = ahash_wait(ahash_rc, &wait);
+ out3:
+- if (read)
+- file->f_mode &= ~FMODE_READ;
+ ima_free_pages(rbuf[0], rbuf_size[0]);
+ ima_free_pages(rbuf[1], rbuf_size[1]);
+ out2:
+@@ -336,7 +329,7 @@ static int ima_calc_file_hash_tfm(struct file *file,
+ {
+ loff_t i_size, offset = 0;
+ char *rbuf;
+- int rc, read = 0;
++ int rc;
+ SHASH_DESC_ON_STACK(shash, tfm);
+
+ shash->tfm = tfm;
+@@ -357,11 +350,6 @@ static int ima_calc_file_hash_tfm(struct file *file,
+ if (!rbuf)
+ return -ENOMEM;
+
+- if (!(file->f_mode & FMODE_READ)) {
+- file->f_mode |= FMODE_READ;
+- read = 1;
+- }
+-
+ while (offset < i_size) {
+ int rbuf_len;
+
+@@ -378,8 +366,6 @@ static int ima_calc_file_hash_tfm(struct file *file,
+ if (rc)
+ break;
+ }
+- if (read)
+- file->f_mode &= ~FMODE_READ;
+ kfree(rbuf);
+ out:
+ if (!rc)
+@@ -420,6 +406,8 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ {
+ loff_t i_size;
+ int rc;
++ struct file *f = file;
++ bool new_file_instance = false, modified_flags = false;
+
+ /*
+ * For consistency, fail file's opened with the O_DIRECT flag on
+@@ -431,15 +419,41 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ return -EINVAL;
+ }
+
+- i_size = i_size_read(file_inode(file));
++ /* Open a new file instance in O_RDONLY if we cannot read */
++ if (!(file->f_mode & FMODE_READ)) {
++ int flags = file->f_flags & ~(O_WRONLY | O_APPEND |
++ O_TRUNC | O_CREAT | O_NOCTTY | O_EXCL);
++ flags |= O_RDONLY;
++ f = dentry_open(&file->f_path, flags, file->f_cred);
++ if (IS_ERR(f)) {
++ /*
++ * Cannot open the file again, lets modify f_flags
++ * of original and continue
++ */
++ pr_info_ratelimited("Unable to reopen file for reading.\n");
++ f = file;
++ f->f_flags |= FMODE_READ;
++ modified_flags = true;
++ } else {
++ new_file_instance = true;
++ }
++ }
++
++ i_size = i_size_read(file_inode(f));
+
+ if (ima_ahash_minsize && i_size >= ima_ahash_minsize) {
+- rc = ima_calc_file_ahash(file, hash);
++ rc = ima_calc_file_ahash(f, hash);
+ if (!rc)
+- return 0;
++ goto out;
+ }
+
+- return ima_calc_file_shash(file, hash);
++ rc = ima_calc_file_shash(f, hash);
++out:
++ if (new_file_instance)
++ fput(f);
++ else if (modified_flags)
++ f->f_flags &= ~FMODE_READ;
++ return rc;
+ }
+
+ /*
+diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
+index ae9d5c766a3c..cfb8cc3b975e 100644
+--- a/security/integrity/ima/ima_fs.c
++++ b/security/integrity/ima/ima_fs.c
+@@ -42,14 +42,14 @@ static int __init default_canonical_fmt_setup(char *str)
+ __setup("ima_canonical_fmt", default_canonical_fmt_setup);
+
+ static int valid_policy = 1;
+-#define TMPBUFLEN 12
++
+ static ssize_t ima_show_htable_value(char __user *buf, size_t count,
+ loff_t *ppos, atomic_long_t *val)
+ {
+- char tmpbuf[TMPBUFLEN];
++ char tmpbuf[32]; /* greater than largest 'long' string value */
+ ssize_t len;
+
+- len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
++ len = scnprintf(tmpbuf, sizeof(tmpbuf), "%li\n", atomic_long_read(val));
+ return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
+ }
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index ad9a9b8e9979..18b98b5e1e3c 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1508,6 +1508,11 @@ static int selinux_genfs_get_sid(struct dentry *dentry,
+ }
+ rc = security_genfs_sid(&selinux_state, sb->s_type->name,
+ path, tclass, sid);
++ if (rc == -ENOENT) {
++ /* No match in policy, mark as unlabeled. */
++ *sid = SECINITSID_UNLABELED;
++ rc = 0;
++ }
+ }
+ free_page((unsigned long)buffer);
+ return rc;
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 340fc30ad85d..70d3066e69fe 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -421,6 +421,7 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
+ struct smk_audit_info ad, *saip = NULL;
+ struct task_smack *tsp;
+ struct smack_known *tracer_known;
++ const struct cred *tracercred;
+
+ if ((mode & PTRACE_MODE_NOAUDIT) == 0) {
+ smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK);
+@@ -429,7 +430,8 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
+ }
+
+ rcu_read_lock();
+- tsp = __task_cred(tracer)->security;
++ tracercred = __task_cred(tracer);
++ tsp = tracercred->security;
+ tracer_known = smk_of_task(tsp);
+
+ if ((mode & PTRACE_MODE_ATTACH) &&
+@@ -439,7 +441,7 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
+ rc = 0;
+ else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)
+ rc = -EACCES;
+- else if (capable(CAP_SYS_PTRACE))
++ else if (smack_privileged_cred(CAP_SYS_PTRACE, tracercred))
+ rc = 0;
+ else
+ rc = -EACCES;
+@@ -1841,6 +1843,7 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
+ {
+ struct smack_known *skp;
+ struct smack_known *tkp = smk_of_task(tsk->cred->security);
++ const struct cred *tcred;
+ struct file *file;
+ int rc;
+ struct smk_audit_info ad;
+@@ -1854,8 +1857,12 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
+ skp = file->f_security;
+ rc = smk_access(skp, tkp, MAY_DELIVER, NULL);
+ rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc);
+- if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
++
++ rcu_read_lock();
++ tcred = __task_cred(tsk);
++ if (rc != 0 && smack_privileged_cred(CAP_MAC_OVERRIDE, tcred))
+ rc = 0;
++ rcu_read_unlock();
+
+ smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+ smk_ad_setfield_u_tsk(&ad, tsk);
+diff --git a/sound/pci/ca0106/ca0106.h b/sound/pci/ca0106/ca0106.h
+index 04402c14cb23..9847b669cf3c 100644
+--- a/sound/pci/ca0106/ca0106.h
++++ b/sound/pci/ca0106/ca0106.h
+@@ -582,7 +582,7 @@
+ #define SPI_PL_BIT_R_R (2<<7) /* right channel = right */
+ #define SPI_PL_BIT_R_C (3<<7) /* right channel = (L+R)/2 */
+ #define SPI_IZD_REG 2
+-#define SPI_IZD_BIT (1<<4) /* infinite zero detect */
++#define SPI_IZD_BIT (0<<4) /* infinite zero detect */
+
+ #define SPI_FMT_REG 3
+ #define SPI_FMT_BIT_RJ (0<<0) /* right justified mode */
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index a68e75b00ea3..53c3cd28bc99 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -160,6 +160,7 @@ struct azx {
+ unsigned int msi:1;
+ unsigned int probing:1; /* codec probing phase */
+ unsigned int snoop:1;
++ unsigned int uc_buffer:1; /* non-cached pages for stream buffers */
+ unsigned int align_buffer_size:1;
+ unsigned int region_requested:1;
+ unsigned int disabled:1; /* disabled by vga_switcheroo */
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index aa4c672dbaf7..625cb6c7b7d6 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -412,7 +412,7 @@ static void __mark_pages_wc(struct azx *chip, struct snd_dma_buffer *dmab, bool
+ #ifdef CONFIG_SND_DMA_SGBUF
+ if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG) {
+ struct snd_sg_buf *sgbuf = dmab->private_data;
+- if (chip->driver_type == AZX_DRIVER_CMEDIA)
++ if (!chip->uc_buffer)
+ return; /* deal with only CORB/RIRB buffers */
+ if (on)
+ set_pages_array_wc(sgbuf->page_table, sgbuf->pages);
+@@ -1678,6 +1678,7 @@ static void azx_check_snoop_available(struct azx *chip)
+ dev_info(chip->card->dev, "Force to %s mode by module option\n",
+ snoop ? "snoop" : "non-snoop");
+ chip->snoop = snoop;
++ chip->uc_buffer = !snoop;
+ return;
+ }
+
+@@ -1698,8 +1699,12 @@ static void azx_check_snoop_available(struct azx *chip)
+ snoop = false;
+
+ chip->snoop = snoop;
+- if (!snoop)
++ if (!snoop) {
+ dev_info(chip->card->dev, "Force to non-snoop mode\n");
++ /* C-Media requires non-cached pages only for CORB/RIRB */
++ if (chip->driver_type != AZX_DRIVER_CMEDIA)
++ chip->uc_buffer = true;
++ }
+ }
+
+ static void azx_probe_work(struct work_struct *work)
+@@ -2138,7 +2143,7 @@ static void pcm_mmap_prepare(struct snd_pcm_substream *substream,
+ #ifdef CONFIG_X86
+ struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
+ struct azx *chip = apcm->chip;
+- if (!azx_snoop(chip) && chip->driver_type != AZX_DRIVER_CMEDIA)
++ if (chip->uc_buffer)
+ area->vm_page_prot = pgprot_writecombine(area->vm_page_prot);
+ #endif
+ }
+@@ -2257,8 +2262,12 @@ static struct snd_pci_quirk power_save_blacklist[] = {
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1581607 */
+ SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
++ SND_PCI_QUIRK(0x1028, 0x0497, "Dell Precision T3600", 0),
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+ /* Note the P55A-UD3 and Z87-D3HP share the subsys id for the HDA dev */
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte P55A-UD3 / Z87-D3HP", 0),
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
++ SND_PCI_QUIRK(0x8086, 0x2040, "Intel DZ77BH-55K", 0),
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=199607 */
+ SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index cfd4e4f97f8f..3c5f2a603754 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -943,6 +943,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD),
++ SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 3ac7ba9b342d..1070749c3cf4 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6841,6 +6841,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x1a, 0x02a11040},
+ {0x1b, 0x01014020},
+ {0x21, 0x0221101f}),
++ SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC294_FIXUP_LENOVO_MIC_LOCATION,
++ {0x14, 0x90170110},
++ {0x19, 0x02a11030},
++ {0x1a, 0x02a11040},
++ {0x1b, 0x01011020},
++ {0x21, 0x0221101f}),
+ SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC294_FIXUP_LENOVO_MIC_LOCATION,
+ {0x14, 0x90170110},
+ {0x19, 0x02a11020},
+@@ -7738,6 +7744,8 @@ enum {
+ ALC662_FIXUP_ASUS_Nx50,
+ ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE,
+ ALC668_FIXUP_ASUS_Nx51,
++ ALC668_FIXUP_MIC_COEF,
++ ALC668_FIXUP_ASUS_G751,
+ ALC891_FIXUP_HEADSET_MODE,
+ ALC891_FIXUP_DELL_MIC_NO_PRESENCE,
+ ALC662_FIXUP_ACER_VERITON,
+@@ -8007,6 +8015,23 @@ static const struct hda_fixup alc662_fixups[] = {
+ .chained = true,
+ .chain_id = ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE,
+ },
++ [ALC668_FIXUP_MIC_COEF] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0xc3 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x4000 },
++ {}
++ },
++ },
++ [ALC668_FIXUP_ASUS_G751] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x16, 0x0421101f }, /* HP */
++ {}
++ },
++ .chained = true,
++ .chain_id = ALC668_FIXUP_MIC_COEF
++ },
+ [ALC891_FIXUP_HEADSET_MODE] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_headset_mode,
+@@ -8080,6 +8105,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
+ SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
+ SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
++ SND_PCI_QUIRK(0x1043, 0x12ff, "ASUS G751", ALC668_FIXUP_ASUS_G751),
+ SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
+ SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
+ SND_PCI_QUIRK(0x1043, 0x177d, "ASUS N551", ALC668_FIXUP_ASUS_Nx51),
+diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c
+index 97f49b751e6e..568575b72f2f 100644
+--- a/sound/pci/hda/thinkpad_helper.c
++++ b/sound/pci/hda/thinkpad_helper.c
+@@ -58,8 +58,8 @@ static void hda_fixup_thinkpad_acpi(struct hda_codec *codec,
+ removefunc = false;
+ }
+ if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0 &&
+- snd_hda_gen_add_micmute_led(codec,
+- update_tpacpi_micmute) > 0)
++ !snd_hda_gen_add_micmute_led(codec,
++ update_tpacpi_micmute))
+ removefunc = false;
+ }
+
+diff --git a/sound/soc/amd/acp-pcm-dma.c b/sound/soc/amd/acp-pcm-dma.c
+index 77b265bd0505..3135e9eafd18 100644
+--- a/sound/soc/amd/acp-pcm-dma.c
++++ b/sound/soc/amd/acp-pcm-dma.c
+@@ -1036,16 +1036,22 @@ static snd_pcm_uframes_t acp_dma_pointer(struct snd_pcm_substream *substream)
+
+ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) {
+ period_bytes = frames_to_bytes(runtime, runtime->period_size);
+- dscr = acp_reg_read(rtd->acp_mmio, rtd->dma_curr_dscr);
+- if (dscr == rtd->dma_dscr_idx_1)
+- pos = period_bytes;
+- else
+- pos = 0;
+ bytescount = acp_get_byte_count(rtd);
+- if (bytescount > rtd->bytescount)
++ if (bytescount >= rtd->bytescount)
+ bytescount -= rtd->bytescount;
+- delay = do_div(bytescount, period_bytes);
+- runtime->delay = bytes_to_frames(runtime, delay);
++ if (bytescount < period_bytes) {
++ pos = 0;
++ } else {
++ dscr = acp_reg_read(rtd->acp_mmio, rtd->dma_curr_dscr);
++ if (dscr == rtd->dma_dscr_idx_1)
++ pos = period_bytes;
++ else
++ pos = 0;
++ }
++ if (bytescount > 0) {
++ delay = do_div(bytescount, period_bytes);
++ runtime->delay = bytes_to_frames(runtime, delay);
++ }
+ } else {
+ buffersize = frames_to_bytes(runtime, runtime->buffer_size);
+ bytescount = acp_get_byte_count(rtd);
+diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
+index d5035f2f2b2b..ce508b4cc85c 100644
+--- a/sound/soc/codecs/sta32x.c
++++ b/sound/soc/codecs/sta32x.c
+@@ -879,6 +879,9 @@ static int sta32x_probe(struct snd_soc_component *component)
+ struct sta32x_priv *sta32x = snd_soc_component_get_drvdata(component);
+ struct sta32x_platform_data *pdata = sta32x->pdata;
+ int i, ret = 0, thermal = 0;
++
++ sta32x->component = component;
++
+ ret = regulator_bulk_enable(ARRAY_SIZE(sta32x->supplies),
+ sta32x->supplies);
+ if (ret != 0) {
+diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
+index 2620d77729c5..f99c600f86e4 100644
+--- a/sound/soc/intel/skylake/skl-topology.c
++++ b/sound/soc/intel/skylake/skl-topology.c
+@@ -2461,6 +2461,7 @@ static int skl_tplg_get_token(struct device *dev,
+
+ case SKL_TKN_U8_CORE_ID:
+ mconfig->core_id = tkn_elem->value;
++ break;
+
+ case SKL_TKN_U8_MOD_TYPE:
+ mconfig->m_type = tkn_elem->value;
+diff --git a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+index 3013ac8f83d0..cab7b0aea6ea 100755
+--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
++++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+@@ -48,7 +48,7 @@ trace_libc_inet_pton_backtrace() {
+ *)
+ eventattr='max-stack=3'
+ echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
+- echo ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected
++ echo ".*(\+0x[[:xdigit:]]+|\[unknown\])[[:space:]]\(.*/bin/ping.*\)$" >> $expected
+ ;;
+ esac
+
+diff --git a/tools/perf/util/strbuf.c b/tools/perf/util/strbuf.c
+index 3d1cf5bf7f18..9005fbe0780e 100644
+--- a/tools/perf/util/strbuf.c
++++ b/tools/perf/util/strbuf.c
+@@ -98,19 +98,25 @@ static int strbuf_addv(struct strbuf *sb, const char *fmt, va_list ap)
+
+ va_copy(ap_saved, ap);
+ len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap);
+- if (len < 0)
++ if (len < 0) {
++ va_end(ap_saved);
+ return len;
++ }
+ if (len > strbuf_avail(sb)) {
+ ret = strbuf_grow(sb, len);
+- if (ret)
++ if (ret) {
++ va_end(ap_saved);
+ return ret;
++ }
+ len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap_saved);
+ va_end(ap_saved);
+ if (len > strbuf_avail(sb)) {
+ pr_debug("this should not happen, your vsnprintf is broken");
++ va_end(ap_saved);
+ return -EINVAL;
+ }
+ }
++ va_end(ap_saved);
+ return strbuf_setlen(sb, sb->len + len);
+ }
+
+diff --git a/tools/perf/util/trace-event-info.c b/tools/perf/util/trace-event-info.c
+index 7b0ca7cbb7de..8ad8e755127b 100644
+--- a/tools/perf/util/trace-event-info.c
++++ b/tools/perf/util/trace-event-info.c
+@@ -531,12 +531,14 @@ struct tracing_data *tracing_data_get(struct list_head *pattrs,
+ "/tmp/perf-XXXXXX");
+ if (!mkstemp(tdata->temp_file)) {
+ pr_debug("Can't make temp file");
++ free(tdata);
+ return NULL;
+ }
+
+ temp_fd = open(tdata->temp_file, O_RDWR);
+ if (temp_fd < 0) {
+ pr_debug("Can't read '%s'", tdata->temp_file);
++ free(tdata);
+ return NULL;
+ }
+
+diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
+index e76214f8d596..b15a9bf1837b 100644
+--- a/tools/perf/util/trace-event-parse.c
++++ b/tools/perf/util/trace-event-parse.c
+@@ -158,6 +158,7 @@ void parse_ftrace_printk(struct tep_handle *pevent,
+ printk = strdup(fmt+1);
+ line = strtok_r(NULL, "\n", &next);
+ tep_register_print_string(pevent, printk, addr);
++ free(printk);
+ }
+ }
+
+diff --git a/tools/perf/util/trace-event-read.c b/tools/perf/util/trace-event-read.c
+index 3dfc1db6b25b..5eb1b2469bba 100644
+--- a/tools/perf/util/trace-event-read.c
++++ b/tools/perf/util/trace-event-read.c
+@@ -349,9 +349,12 @@ static int read_event_files(struct tep_handle *pevent)
+ for (x=0; x < count; x++) {
+ size = read8(pevent);
+ ret = read_event_file(pevent, sys, size);
+- if (ret)
++ if (ret) {
++ free(sys);
+ return ret;
++ }
+ }
++ free(sys);
+ }
+ return 0;
+ }
+diff --git a/tools/power/cpupower/utils/cpufreq-info.c b/tools/power/cpupower/utils/cpufreq-info.c
+index df43cd45d810..ccd08dd00996 100644
+--- a/tools/power/cpupower/utils/cpufreq-info.c
++++ b/tools/power/cpupower/utils/cpufreq-info.c
+@@ -200,6 +200,8 @@ static int get_boost_mode(unsigned int cpu)
+ printf(_(" Boost States: %d\n"), b_states);
+ printf(_(" Total States: %d\n"), pstate_no);
+ for (i = 0; i < pstate_no; i++) {
++ if (!pstates[i])
++ continue;
+ if (i < b_states)
+ printf(_(" Pstate-Pb%d: %luMHz (boost state)"
+ "\n"), i, pstates[i]);
+diff --git a/tools/power/cpupower/utils/helpers/amd.c b/tools/power/cpupower/utils/helpers/amd.c
+index bb41cdd0df6b..9607ada5b29a 100644
+--- a/tools/power/cpupower/utils/helpers/amd.c
++++ b/tools/power/cpupower/utils/helpers/amd.c
+@@ -33,7 +33,7 @@ union msr_pstate {
+ unsigned vid:8;
+ unsigned iddval:8;
+ unsigned idddiv:2;
+- unsigned res1:30;
++ unsigned res1:31;
+ unsigned en:1;
+ } fam17h_bits;
+ unsigned long long val;
+@@ -119,6 +119,11 @@ int decode_pstates(unsigned int cpu, unsigned int cpu_family,
+ }
+ if (read_msr(cpu, MSR_AMD_PSTATE + i, &pstate.val))
+ return -1;
++ if ((cpu_family == 0x17) && (!pstate.fam17h_bits.en))
++ continue;
++ else if (!pstate.bits.en)
++ continue;
++
+ pstates[i] = get_cof(cpu_family, pstate);
+ }
+ *no = i;
+diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc
+index cef11377dcbd..c604438df13b 100644
+--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc
++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc
+@@ -35,18 +35,18 @@ fi
+
+ reset_trigger
+
+-echo "Test create synthetic event with an error"
+-echo 'wakeup_latency u64 lat pid_t pid char' > synthetic_events > /dev/null
++echo "Test remove synthetic event"
++echo '!wakeup_latency u64 lat pid_t pid char comm[16]' >> synthetic_events
+ if [ -d events/synthetic/wakeup_latency ]; then
+- fail "Created wakeup_latency synthetic event with an invalid format"
++ fail "Failed to delete wakeup_latency synthetic event"
+ fi
+
+ reset_trigger
+
+-echo "Test remove synthetic event"
+-echo '!wakeup_latency u64 lat pid_t pid char comm[16]' > synthetic_events
++echo "Test create synthetic event with an error"
++echo 'wakeup_latency u64 lat pid_t pid char' > synthetic_events > /dev/null
+ if [ -d events/synthetic/wakeup_latency ]; then
+- fail "Failed to delete wakeup_latency synthetic event"
++ fail "Created wakeup_latency synthetic event with an invalid format"
+ fi
+
+ do_reset
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c
+index 327fa943c7f3..dbdffa2e2c82 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c
+@@ -67,8 +67,8 @@ trans:
+ "3: ;"
+ : [res] "=r" (result), [texasr] "=r" (texasr)
+ : [gpr_1]"i"(GPR_1), [gpr_2]"i"(GPR_2), [gpr_4]"i"(GPR_4),
+- [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "r" (&a),
+- [flt_2] "r" (&b), [flt_4] "r" (&d)
++ [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "b" (&a),
++ [flt_4] "b" (&d)
+ : "memory", "r5", "r6", "r7",
+ "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15",
+ "r16", "r17", "r18", "r19", "r20", "r21", "r22", "r23",
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index c92053bc3f96..8fb31a7cc22c 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -1295,8 +1295,6 @@ static void cpu_init_hyp_mode(void *dummy)
+
+ __cpu_init_hyp_mode(pgd_ptr, hyp_stack_ptr, vector_ptr);
+ __cpu_init_stage2();
+-
+- kvm_arm_init_debug();
+ }
+
+ static void cpu_hyp_reset(void)
+@@ -1320,6 +1318,8 @@ static void cpu_hyp_reinit(void)
+ cpu_init_hyp_mode(NULL);
+ }
+
++ kvm_arm_init_debug();
++
+ if (vgic_present)
+ kvm_vgic_init_cpu_hardware();
+ }
+diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
+index ed162a6c57c5..2f405b0be25c 100644
+--- a/virt/kvm/arm/mmu.c
++++ b/virt/kvm/arm/mmu.c
+@@ -1230,8 +1230,14 @@ static bool transparent_hugepage_adjust(kvm_pfn_t *pfnp, phys_addr_t *ipap)
+ {
+ kvm_pfn_t pfn = *pfnp;
+ gfn_t gfn = *ipap >> PAGE_SHIFT;
++ struct page *page = pfn_to_page(pfn);
+
+- if (PageTransCompoundMap(pfn_to_page(pfn))) {
++ /*
++ * PageTransCompoungMap() returns true for THP and
++ * hugetlbfs. Make sure the adjustment is done only for THP
++ * pages.
++ */
++ if (!PageHuge(page) && PageTransCompoundMap(page)) {
+ unsigned long mask;
+ /*
+ * The address we faulted on is backed by a transparent huge
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-11-14 0:47 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-11-14 0:47 UTC (permalink / raw
To: gentoo-commits
commit: 421d5534f563efc013380ae2668e5d50aca27769
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 4 16:21:49 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Nov 14 00:46:44 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=421d5534
linux kernel 4.19.1
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1000_linux_4.19.1.patch | 966 ++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 970 insertions(+)
diff --git a/0000_README b/0000_README
index 917d838..828fbcd 100644
--- a/0000_README
+++ b/0000_README
@@ -43,6 +43,10 @@ EXPERIMENTAL
Individual Patch Descriptions:
--------------------------------------------------------------------------
+Patch: 1000_linux-4.19.1.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.1
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1000_linux_4.19.1.patch b/1000_linux_4.19.1.patch
new file mode 100644
index 0000000..2274982
--- /dev/null
+++ b/1000_linux_4.19.1.patch
@@ -0,0 +1,966 @@
+diff --git a/Makefile b/Makefile
+index 69fa5c0310d8..abcd8ca4966f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 0
++SUBLEVEL = 1
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/sparc/include/asm/switch_to_64.h b/arch/sparc/include/asm/switch_to_64.h
+index 4ff29b1406a9..b1d4e2e3210f 100644
+--- a/arch/sparc/include/asm/switch_to_64.h
++++ b/arch/sparc/include/asm/switch_to_64.h
+@@ -67,6 +67,7 @@ do { save_and_clear_fpu(); \
+ } while(0)
+
+ void synchronize_user_stack(void);
+-void fault_in_user_windows(void);
++struct pt_regs;
++void fault_in_user_windows(struct pt_regs *);
+
+ #endif /* __SPARC64_SWITCH_TO_64_H */
+diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
+index 6c086086ca8f..59eaf6227af1 100644
+--- a/arch/sparc/kernel/process_64.c
++++ b/arch/sparc/kernel/process_64.c
+@@ -36,6 +36,7 @@
+ #include <linux/sysrq.h>
+ #include <linux/nmi.h>
+ #include <linux/context_tracking.h>
++#include <linux/signal.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/page.h>
+@@ -521,7 +522,12 @@ static void stack_unaligned(unsigned long sp)
+ force_sig_fault(SIGBUS, BUS_ADRALN, (void __user *) sp, 0, current);
+ }
+
+-void fault_in_user_windows(void)
++static const char uwfault32[] = KERN_INFO \
++ "%s[%d]: bad register window fault: SP %08lx (orig_sp %08lx) TPC %08lx O7 %08lx\n";
++static const char uwfault64[] = KERN_INFO \
++ "%s[%d]: bad register window fault: SP %016lx (orig_sp %016lx) TPC %08lx O7 %016lx\n";
++
++void fault_in_user_windows(struct pt_regs *regs)
+ {
+ struct thread_info *t = current_thread_info();
+ unsigned long window;
+@@ -534,9 +540,9 @@ void fault_in_user_windows(void)
+ do {
+ struct reg_window *rwin = &t->reg_window[window];
+ int winsize = sizeof(struct reg_window);
+- unsigned long sp;
++ unsigned long sp, orig_sp;
+
+- sp = t->rwbuf_stkptrs[window];
++ orig_sp = sp = t->rwbuf_stkptrs[window];
+
+ if (test_thread_64bit_stack(sp))
+ sp += STACK_BIAS;
+@@ -547,8 +553,16 @@ void fault_in_user_windows(void)
+ stack_unaligned(sp);
+
+ if (unlikely(copy_to_user((char __user *)sp,
+- rwin, winsize)))
++ rwin, winsize))) {
++ if (show_unhandled_signals)
++ printk_ratelimited(is_compat_task() ?
++ uwfault32 : uwfault64,
++ current->comm, current->pid,
++ sp, orig_sp,
++ regs->tpc,
++ regs->u_regs[UREG_I7]);
+ goto barf;
++ }
+ } while (window--);
+ }
+ set_thread_wsaved(0);
+@@ -556,8 +570,7 @@ void fault_in_user_windows(void)
+
+ barf:
+ set_thread_wsaved(window + 1);
+- user_exit();
+- do_exit(SIGILL);
++ force_sig(SIGSEGV, current);
+ }
+
+ asmlinkage long sparc_do_fork(unsigned long clone_flags,
+diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
+index 4073e2b87dd0..29aa34f11720 100644
+--- a/arch/sparc/kernel/rtrap_64.S
++++ b/arch/sparc/kernel/rtrap_64.S
+@@ -39,6 +39,7 @@ __handle_preemption:
+ wrpr %g0, RTRAP_PSTATE_IRQOFF, %pstate
+
+ __handle_user_windows:
++ add %sp, PTREGS_OFF, %o0
+ call fault_in_user_windows
+ 661: wrpr %g0, RTRAP_PSTATE, %pstate
+ /* If userspace is using ADI, it could potentially pass
+diff --git a/arch/sparc/kernel/signal32.c b/arch/sparc/kernel/signal32.c
+index 44d379db3f64..4c5b3fcbed94 100644
+--- a/arch/sparc/kernel/signal32.c
++++ b/arch/sparc/kernel/signal32.c
+@@ -371,7 +371,11 @@ static int setup_frame32(struct ksignal *ksig, struct pt_regs *regs,
+ get_sigframe(ksig, regs, sigframe_size);
+
+ if (invalid_frame_pointer(sf, sigframe_size)) {
+- do_exit(SIGILL);
++ if (show_unhandled_signals)
++ pr_info("%s[%d] bad frame in setup_frame32: %08lx TPC %08lx O7 %08lx\n",
++ current->comm, current->pid, (unsigned long)sf,
++ regs->tpc, regs->u_regs[UREG_I7]);
++ force_sigsegv(ksig->sig, current);
+ return -EINVAL;
+ }
+
+@@ -501,7 +505,11 @@ static int setup_rt_frame32(struct ksignal *ksig, struct pt_regs *regs,
+ get_sigframe(ksig, regs, sigframe_size);
+
+ if (invalid_frame_pointer(sf, sigframe_size)) {
+- do_exit(SIGILL);
++ if (show_unhandled_signals)
++ pr_info("%s[%d] bad frame in setup_rt_frame32: %08lx TPC %08lx O7 %08lx\n",
++ current->comm, current->pid, (unsigned long)sf,
++ regs->tpc, regs->u_regs[UREG_I7]);
++ force_sigsegv(ksig->sig, current);
+ return -EINVAL;
+ }
+
+diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
+index 48366e5eb5b2..e9de1803a22e 100644
+--- a/arch/sparc/kernel/signal_64.c
++++ b/arch/sparc/kernel/signal_64.c
+@@ -370,7 +370,11 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs)
+ get_sigframe(ksig, regs, sf_size);
+
+ if (invalid_frame_pointer (sf)) {
+- do_exit(SIGILL); /* won't return, actually */
++ if (show_unhandled_signals)
++ pr_info("%s[%d] bad frame in setup_rt_frame: %016lx TPC %016lx O7 %016lx\n",
++ current->comm, current->pid, (unsigned long)sf,
++ regs->tpc, regs->u_regs[UREG_I7]);
++ force_sigsegv(ksig->sig, current);
+ return -EINVAL;
+ }
+
+diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
+index bb68c805b891..ff9389a1c9f3 100644
+--- a/arch/sparc/kernel/systbls_64.S
++++ b/arch/sparc/kernel/systbls_64.S
+@@ -47,9 +47,9 @@ sys_call_table32:
+ .word sys_recvfrom, sys_setreuid16, sys_setregid16, sys_rename, compat_sys_truncate
+ /*130*/ .word compat_sys_ftruncate, sys_flock, compat_sys_lstat64, sys_sendto, sys_shutdown
+ .word sys_socketpair, sys_mkdir, sys_rmdir, compat_sys_utimes, compat_sys_stat64
+-/*140*/ .word sys_sendfile64, sys_nis_syscall, compat_sys_futex, sys_gettid, compat_sys_getrlimit
++/*140*/ .word sys_sendfile64, sys_getpeername, compat_sys_futex, sys_gettid, compat_sys_getrlimit
+ .word compat_sys_setrlimit, sys_pivot_root, sys_prctl, sys_pciconfig_read, sys_pciconfig_write
+-/*150*/ .word sys_nis_syscall, sys_inotify_init, sys_inotify_add_watch, sys_poll, sys_getdents64
++/*150*/ .word sys_getsockname, sys_inotify_init, sys_inotify_add_watch, sys_poll, sys_getdents64
+ .word compat_sys_fcntl64, sys_inotify_rm_watch, compat_sys_statfs, compat_sys_fstatfs, sys_oldumount
+ /*160*/ .word compat_sys_sched_setaffinity, compat_sys_sched_getaffinity, sys_getdomainname, sys_setdomainname, sys_nis_syscall
+ .word sys_quotactl, sys_set_tid_address, compat_sys_mount, compat_sys_ustat, sys_setxattr
+diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
+index f396048a0d68..39822f611c01 100644
+--- a/arch/sparc/mm/init_64.c
++++ b/arch/sparc/mm/init_64.c
+@@ -1383,6 +1383,7 @@ int __node_distance(int from, int to)
+ }
+ return numa_latency[from][to];
+ }
++EXPORT_SYMBOL(__node_distance);
+
+ static int __init find_best_numa_node_for_mlgroup(struct mdesc_mlgroup *grp)
+ {
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index b053179e0bc5..17eb09d222ff 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -1071,7 +1071,7 @@ __poll_t af_alg_poll(struct file *file, struct socket *sock,
+ struct af_alg_ctx *ctx = ask->private;
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ if (!ctx->more || ctx->used)
+diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
+index 9697977b80f0..6b9ad8673218 100644
+--- a/drivers/net/bonding/bond_netlink.c
++++ b/drivers/net/bonding/bond_netlink.c
+@@ -638,8 +638,7 @@ static int bond_fill_info(struct sk_buff *skb,
+ goto nla_put_failure;
+
+ if (nla_put(skb, IFLA_BOND_AD_ACTOR_SYSTEM,
+- sizeof(bond->params.ad_actor_system),
+- &bond->params.ad_actor_system))
++ ETH_ALEN, &bond->params.ad_actor_system))
+ goto nla_put_failure;
+ }
+ if (!bond_3ad_get_active_agg_info(bond, &info)) {
+diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
+index 58bcee8f0a58..ce041c90adb0 100644
+--- a/drivers/net/ethernet/emulex/benet/be.h
++++ b/drivers/net/ethernet/emulex/benet/be.h
+@@ -185,6 +185,7 @@ static inline void queue_tail_inc(struct be_queue_info *q)
+
+ struct be_eq_obj {
+ struct be_queue_info q;
++ char desc[32];
+
+ struct be_adapter *adapter;
+ struct napi_struct napi;
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index 534787291b44..bff74752cef1 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -3488,11 +3488,9 @@ static int be_msix_register(struct be_adapter *adapter)
+ int status, i, vec;
+
+ for_all_evt_queues(adapter, eqo, i) {
+- char irq_name[IFNAMSIZ+4];
+-
+- snprintf(irq_name, sizeof(irq_name), "%s-q%d", netdev->name, i);
++ sprintf(eqo->desc, "%s-q%d", netdev->name, i);
+ vec = be_msix_vec_get(adapter, eqo);
+- status = request_irq(vec, be_msix, 0, irq_name, eqo);
++ status = request_irq(vec, be_msix, 0, eqo->desc, eqo);
+ if (status)
+ goto err_msix;
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index 00172dee5339..a144146b769c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -696,43 +696,15 @@ static inline bool is_last_ethertype_ip(struct sk_buff *skb, int *network_depth)
+ return (ethertype == htons(ETH_P_IP) || ethertype == htons(ETH_P_IPV6));
+ }
+
+-static __be32 mlx5e_get_fcs(struct sk_buff *skb)
++static u32 mlx5e_get_fcs(const struct sk_buff *skb)
+ {
+- int last_frag_sz, bytes_in_prev, nr_frags;
+- u8 *fcs_p1, *fcs_p2;
+- skb_frag_t *last_frag;
+- __be32 fcs_bytes;
++ const void *fcs_bytes;
++ u32 _fcs_bytes;
+
+- if (!skb_is_nonlinear(skb))
+- return *(__be32 *)(skb->data + skb->len - ETH_FCS_LEN);
++ fcs_bytes = skb_header_pointer(skb, skb->len - ETH_FCS_LEN,
++ ETH_FCS_LEN, &_fcs_bytes);
+
+- nr_frags = skb_shinfo(skb)->nr_frags;
+- last_frag = &skb_shinfo(skb)->frags[nr_frags - 1];
+- last_frag_sz = skb_frag_size(last_frag);
+-
+- /* If all FCS data is in last frag */
+- if (last_frag_sz >= ETH_FCS_LEN)
+- return *(__be32 *)(skb_frag_address(last_frag) +
+- last_frag_sz - ETH_FCS_LEN);
+-
+- fcs_p2 = (u8 *)skb_frag_address(last_frag);
+- bytes_in_prev = ETH_FCS_LEN - last_frag_sz;
+-
+- /* Find where the other part of the FCS is - Linear or another frag */
+- if (nr_frags == 1) {
+- fcs_p1 = skb_tail_pointer(skb);
+- } else {
+- skb_frag_t *prev_frag = &skb_shinfo(skb)->frags[nr_frags - 2];
+-
+- fcs_p1 = skb_frag_address(prev_frag) +
+- skb_frag_size(prev_frag);
+- }
+- fcs_p1 -= bytes_in_prev;
+-
+- memcpy(&fcs_bytes, fcs_p1, bytes_in_prev);
+- memcpy(((u8 *)&fcs_bytes) + bytes_in_prev, fcs_p2, last_frag_sz);
+-
+- return fcs_bytes;
++ return __get_unaligned_cpu32(fcs_bytes);
+ }
+
+ static inline void mlx5e_handle_csum(struct net_device *netdev,
+@@ -765,8 +737,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ network_depth - ETH_HLEN,
+ skb->csum);
+ if (unlikely(netdev->features & NETIF_F_RXFCS))
+- skb->csum = csum_add(skb->csum,
+- (__force __wsum)mlx5e_get_fcs(skb));
++ skb->csum = csum_block_add(skb->csum,
++ (__force __wsum)mlx5e_get_fcs(skb),
++ skb->len - ETH_FCS_LEN);
+ stats->csum_complete++;
+ return;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index 937d0ace699a..30f751e69698 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -943,8 +943,8 @@ static int mlxsw_devlink_core_bus_device_reload(struct devlink *devlink,
+ mlxsw_core->bus,
+ mlxsw_core->bus_priv, true,
+ devlink);
+- if (err)
+- mlxsw_core->reload_fail = true;
++ mlxsw_core->reload_fail = !!err;
++
+ return err;
+ }
+
+@@ -1083,8 +1083,15 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
+ {
+ struct devlink *devlink = priv_to_devlink(mlxsw_core);
+
+- if (mlxsw_core->reload_fail)
+- goto reload_fail;
++ if (mlxsw_core->reload_fail) {
++ if (!reload)
++ /* Only the parts that were not de-initialized in the
++ * failed reload attempt need to be de-initialized.
++ */
++ goto reload_fail_deinit;
++ else
++ return;
++ }
+
+ if (mlxsw_core->driver->fini)
+ mlxsw_core->driver->fini(mlxsw_core);
+@@ -1098,9 +1105,12 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
+ if (!reload)
+ devlink_resources_unregister(devlink, NULL);
+ mlxsw_core->bus->fini(mlxsw_core->bus_priv);
+- if (reload)
+- return;
+-reload_fail:
++
++ return;
++
++reload_fail_deinit:
++ devlink_unregister(devlink);
++ devlink_resources_unregister(devlink, NULL);
+ devlink_free(devlink);
+ }
+ EXPORT_SYMBOL(mlxsw_core_bus_device_unregister);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index db715da7bab7..7715f1ed2bcb 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -2317,8 +2317,6 @@ static void mlxsw_sp_switchdev_event_work(struct work_struct *work)
+ break;
+ case SWITCHDEV_FDB_DEL_TO_DEVICE:
+ fdb_info = &switchdev_work->fdb_info;
+- if (!fdb_info->added_by_user)
+- break;
+ mlxsw_sp_port_fdb_set(mlxsw_sp_port, fdb_info, false);
+ break;
+ case SWITCHDEV_FDB_ADD_TO_BRIDGE: /* fall through */
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 2c350099b83c..4930e0375c1d 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -4175,10 +4175,15 @@ static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
+
+ static bool rtl_wol_pll_power_down(struct rtl8169_private *tp)
+ {
+- if (!netif_running(tp->dev) || !__rtl8169_get_wol(tp))
++ struct phy_device *phydev;
++
++ if (!__rtl8169_get_wol(tp))
+ return false;
+
+- phy_speed_down(tp->dev->phydev, false);
++ /* phydev may not be attached to netdevice */
++ phydev = mdiobus_get_phy(tp->mii_bus, 0);
++
++ phy_speed_down(phydev, false);
+ rtl_wol_suspend_quirk(tp);
+
+ return true;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+index b72ef171477e..bdd351597b55 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+@@ -243,7 +243,7 @@ static int stmmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg,
+ */
+ int stmmac_mdio_reset(struct mii_bus *bus)
+ {
+-#if defined(CONFIG_STMMAC_PLATFORM)
++#if IS_ENABLED(CONFIG_STMMAC_PLATFORM)
+ struct net_device *ndev = bus->priv;
+ struct stmmac_priv *priv = netdev_priv(ndev);
+ unsigned int mii_address = priv->hw->mii.addr;
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index b13c6b4b2c66..eb95daa3e5a5 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -30,6 +30,7 @@
+ #include <linux/sched/mm.h>
+ #include <linux/sched/signal.h>
+ #include <linux/interval_tree_generic.h>
++#include <linux/nospec.h>
+
+ #include "vhost.h"
+
+@@ -1397,6 +1398,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *arg
+ if (idx >= d->nvqs)
+ return -ENOBUFS;
+
++ idx = array_index_nospec(idx, d->nvqs);
+ vq = d->vqs[idx];
+
+ mutex_lock(&vq->mutex);
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 433f45fc2d68..c64a1cff9eb3 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -2057,14 +2057,20 @@ static inline bool skwq_has_sleeper(struct socket_wq *wq)
+ /**
+ * sock_poll_wait - place memory barrier behind the poll_wait call.
+ * @filp: file
++ * @sock: socket to wait on
+ * @p: poll_table
+ *
+ * See the comments in the wq_has_sleeper function.
++ *
++ * Do not derive sock from filp->private_data here. An SMC socket establishes
++ * an internal TCP socket that is used in the fallback case. All socket
++ * operations on the SMC socket are then forwarded to the TCP socket. In case of
++ * poll, the filp->private_data pointer references the SMC socket because the
++ * TCP socket has no file assigned.
+ */
+-static inline void sock_poll_wait(struct file *filp, poll_table *p)
++static inline void sock_poll_wait(struct file *filp, struct socket *sock,
++ poll_table *p)
+ {
+- struct socket *sock = filp->private_data;
+-
+ if (!poll_does_not_wait(p)) {
+ poll_wait(filp, &sock->wq->wait, p);
+ /* We need to be sure we are in sync with the
+diff --git a/net/atm/common.c b/net/atm/common.c
+index 9f8cb0d2e71e..a38c174fc766 100644
+--- a/net/atm/common.c
++++ b/net/atm/common.c
+@@ -653,7 +653,7 @@ __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
+ struct atm_vcc *vcc;
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ vcc = ATM_SD(sock);
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 20ed7adcf1cc..6dec8e9b3451 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1420,7 +1420,14 @@ static void br_multicast_query_received(struct net_bridge *br,
+ return;
+
+ br_multicast_update_query_timer(br, query, max_delay);
+- br_multicast_mark_router(br, port);
++
++ /* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules,
++ * the arrival port for IGMP Queries where the source address
++ * is 0.0.0.0 should not be added to router port list.
++ */
++ if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) ||
++ saddr->proto == htons(ETH_P_IPV6))
++ br_multicast_mark_router(br, port);
+ }
+
+ static void br_ip4_multicast_query(struct net_bridge *br,
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index d18965f3291f..416717c57cd1 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -941,7 +941,7 @@ static __poll_t caif_poll(struct file *file,
+ __poll_t mask;
+ struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ /* exceptional events? */
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index 9aac0d63d53e..57f3a6fcfc1e 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -808,8 +808,9 @@ int skb_copy_and_csum_datagram_msg(struct sk_buff *skb,
+ return -EINVAL;
+ }
+
+- if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE))
+- netdev_rx_csum_fault(skb->dev);
++ if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE) &&
++ !skb->csum_complete_sw)
++ netdev_rx_csum_fault(NULL);
+ }
+ return 0;
+ fault:
+@@ -837,7 +838,7 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
+ struct sock *sk = sock->sk;
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ /* exceptional events? */
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 93243479085f..e16ba3625400 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5431,6 +5431,7 @@ static void gro_flush_oldest(struct list_head *head)
+ * SKB to the chain.
+ */
+ list_del(&oldest->list);
++ oldest->next = NULL;
+ napi_gro_complete(oldest);
+ }
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 37c7936124e6..6e5d61a20a70 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -3530,6 +3530,11 @@ static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh,
+ return -EINVAL;
+ }
+
++ if (dev->type != ARPHRD_ETHER) {
++ NL_SET_ERR_MSG(extack, "FDB delete only supported for Ethernet devices");
++ return -EINVAL;
++ }
++
+ addr = nla_data(tb[NDA_LLADDR]);
+
+ err = fdb_vid_parse(tb[NDA_VLAN], &vid, extack);
+@@ -3634,6 +3639,11 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,
+ return -EINVAL;
+ }
+
++ if (dev->type != ARPHRD_ETHER) {
++ NL_SET_ERR_MSG(extack, "FDB add only supported for Ethernet devices");
++ return -EINVAL;
++ }
++
+ addr = nla_data(tb[NDA_LLADDR]);
+
+ err = fdb_vid_parse(tb[NDA_VLAN], &vid, extack);
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c
+index 875858c8b059..43733accf58e 100644
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -325,7 +325,7 @@ __poll_t dccp_poll(struct file *file, struct socket *sock,
+ __poll_t mask;
+ struct sock *sk = sock->sk;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ if (sk->sk_state == DCCP_LISTEN)
+ return inet_csk_listen_poll(sk);
+
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index e7227128df2c..cb8fa5d7afe1 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -720,10 +720,14 @@ struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user)
+ if (ip_is_fragment(&iph)) {
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (skb) {
+- if (!pskb_may_pull(skb, netoff + iph.ihl * 4))
+- return skb;
+- if (pskb_trim_rcsum(skb, netoff + len))
+- return skb;
++ if (!pskb_may_pull(skb, netoff + iph.ihl * 4)) {
++ kfree_skb(skb);
++ return NULL;
++ }
++ if (pskb_trim_rcsum(skb, netoff + len)) {
++ kfree_skb(skb);
++ return NULL;
++ }
+ memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+ if (ip_defrag(net, skb, user))
+ return NULL;
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 10c6246396cc..bbd07736fb0f 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -507,7 +507,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ const struct tcp_sock *tp = tcp_sk(sk);
+ int state;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+
+ state = inet_sk_state_load(sk);
+ if (state == TCP_LISTEN)
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index c32a4c16b7ff..f8183fdce5b2 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2120,8 +2120,24 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
+ /* Note, we are only interested in != 0 or == 0, thus the
+ * force to int.
+ */
+- return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
+- inet_compute_pseudo);
++ err = (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
++ inet_compute_pseudo);
++ if (err)
++ return err;
++
++ if (skb->ip_summed == CHECKSUM_COMPLETE && !skb->csum_valid) {
++ /* If SW calculated the value, we know it's bad */
++ if (skb->csum_complete_sw)
++ return 1;
++
++ /* HW says the value is bad. Let's validate that.
++ * skb->csum is no longer the full packet checksum,
++ * so don't treat it as such.
++ */
++ skb_checksum_complete_unset(skb);
++ }
++
++ return 0;
+ }
+
+ /* wrapper for udp_queue_rcv_skb tacking care of csum conversion and
+diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c
+index 547515e8450a..377717045f8f 100644
+--- a/net/ipv6/ip6_checksum.c
++++ b/net/ipv6/ip6_checksum.c
+@@ -88,8 +88,24 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
+ * Note, we are only interested in != 0 or == 0, thus the
+ * force to int.
+ */
+- return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
+- ip6_compute_pseudo);
++ err = (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
++ ip6_compute_pseudo);
++ if (err)
++ return err;
++
++ if (skb->ip_summed == CHECKSUM_COMPLETE && !skb->csum_valid) {
++ /* If SW calculated the value, we know it's bad */
++ if (skb->csum_complete_sw)
++ return 1;
++
++ /* HW says the value is bad. Let's validate that.
++ * skb->csum is no longer the full packet checksum,
++ * so don't treat is as such.
++ */
++ skb_checksum_complete_unset(skb);
++ }
++
++ return 0;
+ }
+ EXPORT_SYMBOL(udp6_csum_init);
+
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index 0ec273997d1d..673a4a932f2a 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -1732,10 +1732,9 @@ int ndisc_rcv(struct sk_buff *skb)
+ return 0;
+ }
+
+- memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
+-
+ switch (msg->icmph.icmp6_type) {
+ case NDISC_NEIGHBOUR_SOLICITATION:
++ memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
+ ndisc_recv_ns(skb);
+ break;
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index abcb5ae77319..1cf00d857fc1 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2799,6 +2799,8 @@ static int ip6_route_check_nh_onlink(struct net *net,
+ grt = ip6_nh_lookup_table(net, cfg, gw_addr, tbid, 0);
+ if (grt) {
+ if (!grt->dst.error &&
++ /* ignore match if it is the default route */
++ grt->from && !ipv6_addr_any(&grt->from->fib6_dst.addr) &&
+ (grt->rt6i_flags & flags || dev != grt->dst.dev)) {
+ NL_SET_ERR_MSG(extack,
+ "Nexthop has invalid gateway or device mismatch");
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index e2f16a0173a9..f024914da1b2 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -1505,7 +1505,7 @@ __poll_t iucv_sock_poll(struct file *file, struct socket *sock,
+ struct sock *sk = sock->sk;
+ __poll_t mask = 0;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+
+ if (sk->sk_state == IUCV_LISTEN)
+ return iucv_accept_poll(sk);
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index dd4adf8b1167..ae296273ce3d 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -556,7 +556,7 @@ static __poll_t llcp_sock_poll(struct file *file, struct socket *sock,
+
+ pr_debug("%p\n", sk);
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+
+ if (sk->sk_state == LLCP_LISTEN)
+ return llcp_accept_poll(sk);
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index a70097ecf33c..865ecef68196 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -3030,7 +3030,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ * is already present */
+ if (mac_proto != MAC_PROTO_NONE)
+ return -EINVAL;
+- mac_proto = MAC_PROTO_NONE;
++ mac_proto = MAC_PROTO_ETHERNET;
+ break;
+
+ case OVS_ACTION_ATTR_POP_ETH:
+@@ -3038,7 +3038,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ return -EINVAL;
+ if (vlan_tci & htons(VLAN_TAG_PRESENT))
+ return -EINVAL;
+- mac_proto = MAC_PROTO_ETHERNET;
++ mac_proto = MAC_PROTO_NONE;
+ break;
+
+ case OVS_ACTION_ATTR_PUSH_NSH:
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index ac44d8afffb1..3c39b8805d01 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -741,7 +741,7 @@ static __poll_t rxrpc_poll(struct file *file, struct socket *sock,
+ struct rxrpc_sock *rx = rxrpc_sk(sk);
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ /* the socket is readable if there are any messages waiting on the Rx
+diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
+index cbe4831f46f4..4a042abf844c 100644
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -413,7 +413,7 @@ static int gred_change(struct Qdisc *sch, struct nlattr *opt,
+ if (tb[TCA_GRED_PARMS] == NULL && tb[TCA_GRED_STAB] == NULL) {
+ if (tb[TCA_GRED_LIMIT] != NULL)
+ sch->limit = nla_get_u32(tb[TCA_GRED_LIMIT]);
+- return gred_change_table_def(sch, opt);
++ return gred_change_table_def(sch, tb[TCA_GRED_DPS]);
+ }
+
+ if (tb[TCA_GRED_PARMS] == NULL ||
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index c1c1bda334a4..c1693e28aed4 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -7101,14 +7101,15 @@ static int sctp_getsockopt_pr_assocstatus(struct sock *sk, int len,
+ }
+
+ policy = params.sprstat_policy;
+- if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)))
++ if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)) ||
++ ((policy & SCTP_PR_SCTP_ALL) && (policy & SCTP_PR_SCTP_MASK)))
+ goto out;
+
+ asoc = sctp_id2assoc(sk, params.sprstat_assoc_id);
+ if (!asoc)
+ goto out;
+
+- if (policy & SCTP_PR_SCTP_ALL) {
++ if (policy == SCTP_PR_SCTP_ALL) {
+ params.sprstat_abandoned_unsent = 0;
+ params.sprstat_abandoned_sent = 0;
+ for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) {
+@@ -7160,7 +7161,8 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len,
+ }
+
+ policy = params.sprstat_policy;
+- if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)))
++ if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)) ||
++ ((policy & SCTP_PR_SCTP_ALL) && (policy & SCTP_PR_SCTP_MASK)))
+ goto out;
+
+ asoc = sctp_id2assoc(sk, params.sprstat_assoc_id);
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 015231789ed2..80e2119f1c70 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1543,7 +1543,7 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
+ mask |= EPOLLERR;
+ } else {
+ if (sk->sk_state != SMC_CLOSED)
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ if (sk->sk_err)
+ mask |= EPOLLERR;
+ if ((sk->sk_shutdown == SHUTDOWN_MASK) ||
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index e871368500e3..18daebcef181 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -122,22 +122,17 @@ static void __smc_lgr_unregister_conn(struct smc_connection *conn)
+ sock_put(&smc->sk); /* sock_hold in smc_lgr_register_conn() */
+ }
+
+-/* Unregister connection and trigger lgr freeing if applicable
++/* Unregister connection from lgr
+ */
+ static void smc_lgr_unregister_conn(struct smc_connection *conn)
+ {
+ struct smc_link_group *lgr = conn->lgr;
+- int reduced = 0;
+
+ write_lock_bh(&lgr->conns_lock);
+ if (conn->alert_token_local) {
+- reduced = 1;
+ __smc_lgr_unregister_conn(conn);
+ }
+ write_unlock_bh(&lgr->conns_lock);
+- if (!reduced || lgr->conns_num)
+- return;
+- smc_lgr_schedule_free_work(lgr);
+ }
+
+ /* Send delete link, either as client to request the initiation
+@@ -291,7 +286,8 @@ out:
+ return rc;
+ }
+
+-static void smc_buf_unuse(struct smc_connection *conn)
++static void smc_buf_unuse(struct smc_connection *conn,
++ struct smc_link_group *lgr)
+ {
+ if (conn->sndbuf_desc)
+ conn->sndbuf_desc->used = 0;
+@@ -301,8 +297,6 @@ static void smc_buf_unuse(struct smc_connection *conn)
+ conn->rmb_desc->used = 0;
+ } else {
+ /* buf registration failed, reuse not possible */
+- struct smc_link_group *lgr = conn->lgr;
+-
+ write_lock_bh(&lgr->rmbs_lock);
+ list_del(&conn->rmb_desc->list);
+ write_unlock_bh(&lgr->rmbs_lock);
+@@ -315,16 +309,21 @@ static void smc_buf_unuse(struct smc_connection *conn)
+ /* remove a finished connection from its link group */
+ void smc_conn_free(struct smc_connection *conn)
+ {
+- if (!conn->lgr)
++ struct smc_link_group *lgr = conn->lgr;
++
++ if (!lgr)
+ return;
+- if (conn->lgr->is_smcd) {
++ if (lgr->is_smcd) {
+ smc_ism_unset_conn(conn);
+ tasklet_kill(&conn->rx_tsklet);
+ } else {
+ smc_cdc_tx_dismiss_slots(conn);
+ }
+- smc_lgr_unregister_conn(conn);
+- smc_buf_unuse(conn);
++ smc_lgr_unregister_conn(conn); /* unsets conn->lgr */
++ smc_buf_unuse(conn, lgr); /* allow buffer reuse */
++
++ if (!lgr->conns_num)
++ smc_lgr_schedule_free_work(lgr);
+ }
+
+ static void smc_link_clear(struct smc_link *lnk)
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 49810fdff4c5..0bf8ad486c5e 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -715,7 +715,7 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
+ struct tipc_sock *tsk = tipc_sk(sk);
+ __poll_t revents = 0;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+
+ if (sk->sk_shutdown & RCV_SHUTDOWN)
+ revents |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index d1edfa3cad61..c754f3a90a2e 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -2640,7 +2640,7 @@ static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wa
+ struct sock *sk = sock->sk;
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ /* exceptional events? */
+@@ -2677,7 +2677,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
+ unsigned int writable;
+ __poll_t mask;
+
+- sock_poll_wait(file, wait);
++ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ /* exceptional events? */
+diff --git a/tools/testing/selftests/net/fib-onlink-tests.sh b/tools/testing/selftests/net/fib-onlink-tests.sh
+index 3991ad1a368d..864f865eee55 100755
+--- a/tools/testing/selftests/net/fib-onlink-tests.sh
++++ b/tools/testing/selftests/net/fib-onlink-tests.sh
+@@ -167,8 +167,8 @@ setup()
+ # add vrf table
+ ip li add ${VRF} type vrf table ${VRF_TABLE}
+ ip li set ${VRF} up
+- ip ro add table ${VRF_TABLE} unreachable default
+- ip -6 ro add table ${VRF_TABLE} unreachable default
++ ip ro add table ${VRF_TABLE} unreachable default metric 8192
++ ip -6 ro add table ${VRF_TABLE} unreachable default metric 8192
+
+ # create test interfaces
+ ip li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]}
+@@ -185,20 +185,20 @@ setup()
+ for n in 1 3 5 7; do
+ ip li set ${NETIFS[p${n}]} up
+ ip addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
+- ip addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]}
++ ip addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad
+ done
+
+ # move peer interfaces to namespace and add addresses
+ for n in 2 4 6 8; do
+ ip li set ${NETIFS[p${n}]} netns ${PEER_NS} up
+ ip -netns ${PEER_NS} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
+- ip -netns ${PEER_NS} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]}
++ ip -netns ${PEER_NS} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad
+ done
+
+- set +e
++ ip -6 ro add default via ${V6ADDRS[p3]/::[0-9]/::64}
++ ip -6 ro add table ${VRF_TABLE} default via ${V6ADDRS[p7]/::[0-9]/::64}
+
+- # let DAD complete - assume default of 1 probe
+- sleep 1
++ set +e
+ }
+
+ cleanup()
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-11-14 0:47 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-11-14 0:47 UTC (permalink / raw
To: gentoo-commits
commit: ee37b92eac40ec7823a3cf4ead399e376d7686f1
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 13 20:44:05 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Nov 14 00:47:16 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ee37b92e
Linux patch 4.19.2
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1001_linux-4.19.2.patch | 15435 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 15439 insertions(+)
diff --git a/0000_README b/0000_README
index 828fbcd..6b0adb6 100644
--- a/0000_README
+++ b/0000_README
@@ -47,6 +47,10 @@ Patch: 1000_linux-4.19.1.patch
From: http://www.kernel.org
Desc: Linux 4.19.1
+Patch: 1001_linux-4.19.2.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.2
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1001_linux-4.19.2.patch b/1001_linux-4.19.2.patch
new file mode 100644
index 0000000..62ce83c
--- /dev/null
+++ b/1001_linux-4.19.2.patch
@@ -0,0 +1,15435 @@
+diff --git a/Documentation/filesystems/fscrypt.rst b/Documentation/filesystems/fscrypt.rst
+index 48b424de85bb..cfbc18f0d9c9 100644
+--- a/Documentation/filesystems/fscrypt.rst
++++ b/Documentation/filesystems/fscrypt.rst
+@@ -191,21 +191,11 @@ Currently, the following pairs of encryption modes are supported:
+
+ - AES-256-XTS for contents and AES-256-CTS-CBC for filenames
+ - AES-128-CBC for contents and AES-128-CTS-CBC for filenames
+-- Speck128/256-XTS for contents and Speck128/256-CTS-CBC for filenames
+
+ It is strongly recommended to use AES-256-XTS for contents encryption.
+ AES-128-CBC was added only for low-powered embedded devices with
+ crypto accelerators such as CAAM or CESA that do not support XTS.
+
+-Similarly, Speck128/256 support was only added for older or low-end
+-CPUs which cannot do AES fast enough -- especially ARM CPUs which have
+-NEON instructions but not the Cryptography Extensions -- and for which
+-it would not otherwise be feasible to use encryption at all. It is
+-not recommended to use Speck on CPUs that have AES instructions.
+-Speck support is only available if it has been enabled in the crypto
+-API via CONFIG_CRYPTO_SPECK. Also, on ARM platforms, to get
+-acceptable performance CONFIG_CRYPTO_SPECK_NEON must be enabled.
+-
+ New encryption modes can be added relatively easily, without changes
+ to individual filesystems. However, authenticated encryption (AE)
+ modes are not currently supported because of the difficulty of dealing
+diff --git a/Documentation/media/uapi/cec/cec-ioc-receive.rst b/Documentation/media/uapi/cec/cec-ioc-receive.rst
+index e964074cd15b..b25e48afaa08 100644
+--- a/Documentation/media/uapi/cec/cec-ioc-receive.rst
++++ b/Documentation/media/uapi/cec/cec-ioc-receive.rst
+@@ -16,10 +16,10 @@ CEC_RECEIVE, CEC_TRANSMIT - Receive or transmit a CEC message
+ Synopsis
+ ========
+
+-.. c:function:: int ioctl( int fd, CEC_RECEIVE, struct cec_msg *argp )
++.. c:function:: int ioctl( int fd, CEC_RECEIVE, struct cec_msg \*argp )
+ :name: CEC_RECEIVE
+
+-.. c:function:: int ioctl( int fd, CEC_TRANSMIT, struct cec_msg *argp )
++.. c:function:: int ioctl( int fd, CEC_TRANSMIT, struct cec_msg \*argp )
+ :name: CEC_TRANSMIT
+
+ Arguments
+@@ -272,6 +272,19 @@ View On' messages from initiator 0xf ('Unregistered') to destination 0 ('TV').
+ - The transmit failed after one or more retries. This status bit is
+ mutually exclusive with :ref:`CEC_TX_STATUS_OK <CEC-TX-STATUS-OK>`.
+ Other bits can still be set to explain which failures were seen.
++ * .. _`CEC-TX-STATUS-ABORTED`:
++
++ - ``CEC_TX_STATUS_ABORTED``
++ - 0x40
++ - The transmit was aborted due to an HDMI disconnect, or the adapter
++ was unconfigured, or a transmit was interrupted, or the driver
++ returned an error when attempting to start a transmit.
++ * .. _`CEC-TX-STATUS-TIMEOUT`:
++
++ - ``CEC_TX_STATUS_TIMEOUT``
++ - 0x80
++ - The transmit timed out. This should not normally happen and this
++ indicates a driver problem.
+
+
+ .. tabularcolumns:: |p{5.6cm}|p{0.9cm}|p{11.0cm}|
+@@ -300,6 +313,14 @@ View On' messages from initiator 0xf ('Unregistered') to destination 0 ('TV').
+ - The message was received successfully but the reply was
+ ``CEC_MSG_FEATURE_ABORT``. This status is only set if this message
+ was the reply to an earlier transmitted message.
++ * .. _`CEC-RX-STATUS-ABORTED`:
++
++ - ``CEC_RX_STATUS_ABORTED``
++ - 0x08
++ - The wait for a reply to an earlier transmitted message was aborted
++ because the HDMI cable was disconnected, the adapter was unconfigured
++ or the :ref:`CEC_TRANSMIT <CEC_RECEIVE>` that waited for a
++ reply was interrupted.
+
+
+
+diff --git a/Documentation/media/uapi/v4l/biblio.rst b/Documentation/media/uapi/v4l/biblio.rst
+index 1cedcfc04327..386d6cf83e9c 100644
+--- a/Documentation/media/uapi/v4l/biblio.rst
++++ b/Documentation/media/uapi/v4l/biblio.rst
+@@ -226,16 +226,6 @@ xvYCC
+
+ :author: International Electrotechnical Commission (http://www.iec.ch)
+
+-.. _adobergb:
+-
+-AdobeRGB
+-========
+-
+-
+-:title: Adobe© RGB (1998) Color Image Encoding Version 2005-05
+-
+-:author: Adobe Systems Incorporated (http://www.adobe.com)
+-
+ .. _oprgb:
+
+ opRGB
+diff --git a/Documentation/media/uapi/v4l/colorspaces-defs.rst b/Documentation/media/uapi/v4l/colorspaces-defs.rst
+index 410907fe9415..f24615544792 100644
+--- a/Documentation/media/uapi/v4l/colorspaces-defs.rst
++++ b/Documentation/media/uapi/v4l/colorspaces-defs.rst
+@@ -51,8 +51,8 @@ whole range, 0-255, dividing the angular value by 1.41. The enum
+ - See :ref:`col-rec709`.
+ * - ``V4L2_COLORSPACE_SRGB``
+ - See :ref:`col-srgb`.
+- * - ``V4L2_COLORSPACE_ADOBERGB``
+- - See :ref:`col-adobergb`.
++ * - ``V4L2_COLORSPACE_OPRGB``
++ - See :ref:`col-oprgb`.
+ * - ``V4L2_COLORSPACE_BT2020``
+ - See :ref:`col-bt2020`.
+ * - ``V4L2_COLORSPACE_DCI_P3``
+@@ -90,8 +90,8 @@ whole range, 0-255, dividing the angular value by 1.41. The enum
+ - Use the Rec. 709 transfer function.
+ * - ``V4L2_XFER_FUNC_SRGB``
+ - Use the sRGB transfer function.
+- * - ``V4L2_XFER_FUNC_ADOBERGB``
+- - Use the AdobeRGB transfer function.
++ * - ``V4L2_XFER_FUNC_OPRGB``
++ - Use the opRGB transfer function.
+ * - ``V4L2_XFER_FUNC_SMPTE240M``
+ - Use the SMPTE 240M transfer function.
+ * - ``V4L2_XFER_FUNC_NONE``
+diff --git a/Documentation/media/uapi/v4l/colorspaces-details.rst b/Documentation/media/uapi/v4l/colorspaces-details.rst
+index b5d551b9cc8f..09fabf4cd412 100644
+--- a/Documentation/media/uapi/v4l/colorspaces-details.rst
++++ b/Documentation/media/uapi/v4l/colorspaces-details.rst
+@@ -290,15 +290,14 @@ Y' is clamped to the range [0…1] and Cb and Cr are clamped to the range
+ 170M/BT.601. The Y'CbCr quantization is limited range.
+
+
+-.. _col-adobergb:
++.. _col-oprgb:
+
+-Colorspace Adobe RGB (V4L2_COLORSPACE_ADOBERGB)
++Colorspace opRGB (V4L2_COLORSPACE_OPRGB)
+ ===============================================
+
+-The :ref:`adobergb` standard defines the colorspace used by computer
+-graphics that use the AdobeRGB colorspace. This is also known as the
+-:ref:`oprgb` standard. The default transfer function is
+-``V4L2_XFER_FUNC_ADOBERGB``. The default Y'CbCr encoding is
++The :ref:`oprgb` standard defines the colorspace used by computer
++graphics that use the opRGB colorspace. The default transfer function is
++``V4L2_XFER_FUNC_OPRGB``. The default Y'CbCr encoding is
+ ``V4L2_YCBCR_ENC_601``. The default Y'CbCr quantization is limited
+ range.
+
+@@ -312,7 +311,7 @@ The chromaticities of the primary colors and the white reference are:
+
+ .. tabularcolumns:: |p{4.4cm}|p{4.4cm}|p{8.7cm}|
+
+-.. flat-table:: Adobe RGB Chromaticities
++.. flat-table:: opRGB Chromaticities
+ :header-rows: 1
+ :stub-columns: 0
+ :widths: 1 1 2
+diff --git a/Documentation/media/videodev2.h.rst.exceptions b/Documentation/media/videodev2.h.rst.exceptions
+index ca9f0edc579e..e420a39f1ebf 100644
+--- a/Documentation/media/videodev2.h.rst.exceptions
++++ b/Documentation/media/videodev2.h.rst.exceptions
+@@ -56,7 +56,8 @@ replace symbol V4L2_MEMORY_USERPTR :c:type:`v4l2_memory`
+ # Documented enum v4l2_colorspace
+ replace symbol V4L2_COLORSPACE_470_SYSTEM_BG :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_470_SYSTEM_M :c:type:`v4l2_colorspace`
+-replace symbol V4L2_COLORSPACE_ADOBERGB :c:type:`v4l2_colorspace`
++replace symbol V4L2_COLORSPACE_OPRGB :c:type:`v4l2_colorspace`
++replace define V4L2_COLORSPACE_ADOBERGB :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_BT2020 :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_DCI_P3 :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_DEFAULT :c:type:`v4l2_colorspace`
+@@ -69,7 +70,8 @@ replace symbol V4L2_COLORSPACE_SRGB :c:type:`v4l2_colorspace`
+
+ # Documented enum v4l2_xfer_func
+ replace symbol V4L2_XFER_FUNC_709 :c:type:`v4l2_xfer_func`
+-replace symbol V4L2_XFER_FUNC_ADOBERGB :c:type:`v4l2_xfer_func`
++replace symbol V4L2_XFER_FUNC_OPRGB :c:type:`v4l2_xfer_func`
++replace define V4L2_XFER_FUNC_ADOBERGB :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_DCI_P3 :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_DEFAULT :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_NONE :c:type:`v4l2_xfer_func`
+diff --git a/Makefile b/Makefile
+index abcd8ca4966f..c8fe567f18ab 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 1
++SUBLEVEL = 2
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index a0ddf497e8cd..2cb45ddd2ae3 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -354,7 +354,7 @@
+ ti,hwmods = "pcie1";
+ phys = <&pcie1_phy>;
+ phy-names = "pcie-phy0";
+- ti,syscon-unaligned-access = <&scm_conf1 0x14 2>;
++ ti,syscon-unaligned-access = <&scm_conf1 0x14 1>;
+ status = "disabled";
+ };
+ };
+diff --git a/arch/arm/boot/dts/exynos4210-origen.dts b/arch/arm/boot/dts/exynos4210-origen.dts
+index 2ab99f9f3d0a..dd9ec05eb0f7 100644
+--- a/arch/arm/boot/dts/exynos4210-origen.dts
++++ b/arch/arm/boot/dts/exynos4210-origen.dts
+@@ -151,6 +151,8 @@
+ reg = <0x66>;
+ interrupt-parent = <&gpx0>;
+ interrupts = <4 IRQ_TYPE_NONE>, <3 IRQ_TYPE_NONE>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&max8997_irq>;
+
+ max8997,pmic-buck1-dvs-voltage = <1350000>;
+ max8997,pmic-buck2-dvs-voltage = <1100000>;
+@@ -288,6 +290,13 @@
+ };
+ };
+
++&pinctrl_1 {
++ max8997_irq: max8997-irq {
++ samsung,pins = "gpx0-3", "gpx0-4";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
++};
++
+ &sdhci_0 {
+ bus-width = <4>;
+ pinctrl-0 = <&sd0_clk &sd0_cmd &sd0_bus4 &sd0_cd>;
+diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
+index da163a40af15..b85527faa6ea 100644
+--- a/arch/arm/boot/dts/exynos5250.dtsi
++++ b/arch/arm/boot/dts/exynos5250.dtsi
+@@ -54,62 +54,109 @@
+ device_type = "cpu";
+ compatible = "arm,cortex-a15";
+ reg = <0>;
+- clock-frequency = <1700000000>;
+ clocks = <&clock CLK_ARM_CLK>;
+ clock-names = "cpu";
+- clock-latency = <140000>;
+-
+- operating-points = <
+- 1700000 1300000
+- 1600000 1250000
+- 1500000 1225000
+- 1400000 1200000
+- 1300000 1150000
+- 1200000 1125000
+- 1100000 1100000
+- 1000000 1075000
+- 900000 1050000
+- 800000 1025000
+- 700000 1012500
+- 600000 1000000
+- 500000 975000
+- 400000 950000
+- 300000 937500
+- 200000 925000
+- >;
++ operating-points-v2 = <&cpu0_opp_table>;
+ #cooling-cells = <2>; /* min followed by max */
+ };
+ cpu@1 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a15";
+ reg = <1>;
+- clock-frequency = <1700000000>;
+ clocks = <&clock CLK_ARM_CLK>;
+ clock-names = "cpu";
+- clock-latency = <140000>;
+-
+- operating-points = <
+- 1700000 1300000
+- 1600000 1250000
+- 1500000 1225000
+- 1400000 1200000
+- 1300000 1150000
+- 1200000 1125000
+- 1100000 1100000
+- 1000000 1075000
+- 900000 1050000
+- 800000 1025000
+- 700000 1012500
+- 600000 1000000
+- 500000 975000
+- 400000 950000
+- 300000 937500
+- 200000 925000
+- >;
++ operating-points-v2 = <&cpu0_opp_table>;
+ #cooling-cells = <2>; /* min followed by max */
+ };
+ };
+
++ cpu0_opp_table: opp_table0 {
++ compatible = "operating-points-v2";
++ opp-shared;
++
++ opp-200000000 {
++ opp-hz = /bits/ 64 <200000000>;
++ opp-microvolt = <925000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-300000000 {
++ opp-hz = /bits/ 64 <300000000>;
++ opp-microvolt = <937500>;
++ clock-latency-ns = <140000>;
++ };
++ opp-400000000 {
++ opp-hz = /bits/ 64 <400000000>;
++ opp-microvolt = <950000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-500000000 {
++ opp-hz = /bits/ 64 <500000000>;
++ opp-microvolt = <975000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-600000000 {
++ opp-hz = /bits/ 64 <600000000>;
++ opp-microvolt = <1000000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-700000000 {
++ opp-hz = /bits/ 64 <700000000>;
++ opp-microvolt = <1012500>;
++ clock-latency-ns = <140000>;
++ };
++ opp-800000000 {
++ opp-hz = /bits/ 64 <800000000>;
++ opp-microvolt = <1025000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-900000000 {
++ opp-hz = /bits/ 64 <900000000>;
++ opp-microvolt = <1050000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1000000000 {
++ opp-hz = /bits/ 64 <1000000000>;
++ opp-microvolt = <1075000>;
++ clock-latency-ns = <140000>;
++ opp-suspend;
++ };
++ opp-1100000000 {
++ opp-hz = /bits/ 64 <1100000000>;
++ opp-microvolt = <1100000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1200000000 {
++ opp-hz = /bits/ 64 <1200000000>;
++ opp-microvolt = <1125000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1300000000 {
++ opp-hz = /bits/ 64 <1300000000>;
++ opp-microvolt = <1150000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1400000000 {
++ opp-hz = /bits/ 64 <1400000000>;
++ opp-microvolt = <1200000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1500000000 {
++ opp-hz = /bits/ 64 <1500000000>;
++ opp-microvolt = <1225000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1600000000 {
++ opp-hz = /bits/ 64 <1600000000>;
++ opp-microvolt = <1250000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1700000000 {
++ opp-hz = /bits/ 64 <1700000000>;
++ opp-microvolt = <1300000>;
++ clock-latency-ns = <140000>;
++ };
++ };
++
+ soc: soc {
+ sysram@2020000 {
+ compatible = "mmio-sram";
+diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
+index a4dcb68f4322..b4dd3846e8cc 100644
+--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
+@@ -613,7 +613,7 @@
+ status = "disabled";
+ };
+
+- sdr: sdr@ffc25000 {
++ sdr: sdr@ffcfb100 {
+ compatible = "altr,sdr-ctl", "syscon";
+ reg = <0xffcfb100 0x80>;
+ };
+diff --git a/arch/arm/crypto/Kconfig b/arch/arm/crypto/Kconfig
+index 925d1364727a..b8e69fe282b8 100644
+--- a/arch/arm/crypto/Kconfig
++++ b/arch/arm/crypto/Kconfig
+@@ -121,10 +121,4 @@ config CRYPTO_CHACHA20_NEON
+ select CRYPTO_BLKCIPHER
+ select CRYPTO_CHACHA20
+
+-config CRYPTO_SPECK_NEON
+- tristate "NEON accelerated Speck cipher algorithms"
+- depends on KERNEL_MODE_NEON
+- select CRYPTO_BLKCIPHER
+- select CRYPTO_SPECK
+-
+ endif
+diff --git a/arch/arm/crypto/Makefile b/arch/arm/crypto/Makefile
+index 8de542c48ade..bd5bceef0605 100644
+--- a/arch/arm/crypto/Makefile
++++ b/arch/arm/crypto/Makefile
+@@ -10,7 +10,6 @@ obj-$(CONFIG_CRYPTO_SHA1_ARM_NEON) += sha1-arm-neon.o
+ obj-$(CONFIG_CRYPTO_SHA256_ARM) += sha256-arm.o
+ obj-$(CONFIG_CRYPTO_SHA512_ARM) += sha512-arm.o
+ obj-$(CONFIG_CRYPTO_CHACHA20_NEON) += chacha20-neon.o
+-obj-$(CONFIG_CRYPTO_SPECK_NEON) += speck-neon.o
+
+ ce-obj-$(CONFIG_CRYPTO_AES_ARM_CE) += aes-arm-ce.o
+ ce-obj-$(CONFIG_CRYPTO_SHA1_ARM_CE) += sha1-arm-ce.o
+@@ -54,7 +53,6 @@ ghash-arm-ce-y := ghash-ce-core.o ghash-ce-glue.o
+ crct10dif-arm-ce-y := crct10dif-ce-core.o crct10dif-ce-glue.o
+ crc32-arm-ce-y:= crc32-ce-core.o crc32-ce-glue.o
+ chacha20-neon-y := chacha20-neon-core.o chacha20-neon-glue.o
+-speck-neon-y := speck-neon-core.o speck-neon-glue.o
+
+ ifdef REGENERATE_ARM_CRYPTO
+ quiet_cmd_perl = PERL $@
+diff --git a/arch/arm/crypto/speck-neon-core.S b/arch/arm/crypto/speck-neon-core.S
+deleted file mode 100644
+index 57caa742016e..000000000000
+--- a/arch/arm/crypto/speck-neon-core.S
++++ /dev/null
+@@ -1,434 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Author: Eric Biggers <ebiggers@google.com>
+- */
+-
+-#include <linux/linkage.h>
+-
+- .text
+- .fpu neon
+-
+- // arguments
+- ROUND_KEYS .req r0 // const {u64,u32} *round_keys
+- NROUNDS .req r1 // int nrounds
+- DST .req r2 // void *dst
+- SRC .req r3 // const void *src
+- NBYTES .req r4 // unsigned int nbytes
+- TWEAK .req r5 // void *tweak
+-
+- // registers which hold the data being encrypted/decrypted
+- X0 .req q0
+- X0_L .req d0
+- X0_H .req d1
+- Y0 .req q1
+- Y0_H .req d3
+- X1 .req q2
+- X1_L .req d4
+- X1_H .req d5
+- Y1 .req q3
+- Y1_H .req d7
+- X2 .req q4
+- X2_L .req d8
+- X2_H .req d9
+- Y2 .req q5
+- Y2_H .req d11
+- X3 .req q6
+- X3_L .req d12
+- X3_H .req d13
+- Y3 .req q7
+- Y3_H .req d15
+-
+- // the round key, duplicated in all lanes
+- ROUND_KEY .req q8
+- ROUND_KEY_L .req d16
+- ROUND_KEY_H .req d17
+-
+- // index vector for vtbl-based 8-bit rotates
+- ROTATE_TABLE .req d18
+-
+- // multiplication table for updating XTS tweaks
+- GF128MUL_TABLE .req d19
+- GF64MUL_TABLE .req d19
+-
+- // current XTS tweak value(s)
+- TWEAKV .req q10
+- TWEAKV_L .req d20
+- TWEAKV_H .req d21
+-
+- TMP0 .req q12
+- TMP0_L .req d24
+- TMP0_H .req d25
+- TMP1 .req q13
+- TMP2 .req q14
+- TMP3 .req q15
+-
+- .align 4
+-.Lror64_8_table:
+- .byte 1, 2, 3, 4, 5, 6, 7, 0
+-.Lror32_8_table:
+- .byte 1, 2, 3, 0, 5, 6, 7, 4
+-.Lrol64_8_table:
+- .byte 7, 0, 1, 2, 3, 4, 5, 6
+-.Lrol32_8_table:
+- .byte 3, 0, 1, 2, 7, 4, 5, 6
+-.Lgf128mul_table:
+- .byte 0, 0x87
+- .fill 14
+-.Lgf64mul_table:
+- .byte 0, 0x1b, (0x1b << 1), (0x1b << 1) ^ 0x1b
+- .fill 12
+-
+-/*
+- * _speck_round_128bytes() - Speck encryption round on 128 bytes at a time
+- *
+- * Do one Speck encryption round on the 128 bytes (8 blocks for Speck128, 16 for
+- * Speck64) stored in X0-X3 and Y0-Y3, using the round key stored in all lanes
+- * of ROUND_KEY. 'n' is the lane size: 64 for Speck128, or 32 for Speck64.
+- *
+- * The 8-bit rotates are implemented using vtbl instead of vshr + vsli because
+- * the vtbl approach is faster on some processors and the same speed on others.
+- */
+-.macro _speck_round_128bytes n
+-
+- // x = ror(x, 8)
+- vtbl.8 X0_L, {X0_L}, ROTATE_TABLE
+- vtbl.8 X0_H, {X0_H}, ROTATE_TABLE
+- vtbl.8 X1_L, {X1_L}, ROTATE_TABLE
+- vtbl.8 X1_H, {X1_H}, ROTATE_TABLE
+- vtbl.8 X2_L, {X2_L}, ROTATE_TABLE
+- vtbl.8 X2_H, {X2_H}, ROTATE_TABLE
+- vtbl.8 X3_L, {X3_L}, ROTATE_TABLE
+- vtbl.8 X3_H, {X3_H}, ROTATE_TABLE
+-
+- // x += y
+- vadd.u\n X0, Y0
+- vadd.u\n X1, Y1
+- vadd.u\n X2, Y2
+- vadd.u\n X3, Y3
+-
+- // x ^= k
+- veor X0, ROUND_KEY
+- veor X1, ROUND_KEY
+- veor X2, ROUND_KEY
+- veor X3, ROUND_KEY
+-
+- // y = rol(y, 3)
+- vshl.u\n TMP0, Y0, #3
+- vshl.u\n TMP1, Y1, #3
+- vshl.u\n TMP2, Y2, #3
+- vshl.u\n TMP3, Y3, #3
+- vsri.u\n TMP0, Y0, #(\n - 3)
+- vsri.u\n TMP1, Y1, #(\n - 3)
+- vsri.u\n TMP2, Y2, #(\n - 3)
+- vsri.u\n TMP3, Y3, #(\n - 3)
+-
+- // y ^= x
+- veor Y0, TMP0, X0
+- veor Y1, TMP1, X1
+- veor Y2, TMP2, X2
+- veor Y3, TMP3, X3
+-.endm
+-
+-/*
+- * _speck_unround_128bytes() - Speck decryption round on 128 bytes at a time
+- *
+- * This is the inverse of _speck_round_128bytes().
+- */
+-.macro _speck_unround_128bytes n
+-
+- // y ^= x
+- veor TMP0, Y0, X0
+- veor TMP1, Y1, X1
+- veor TMP2, Y2, X2
+- veor TMP3, Y3, X3
+-
+- // y = ror(y, 3)
+- vshr.u\n Y0, TMP0, #3
+- vshr.u\n Y1, TMP1, #3
+- vshr.u\n Y2, TMP2, #3
+- vshr.u\n Y3, TMP3, #3
+- vsli.u\n Y0, TMP0, #(\n - 3)
+- vsli.u\n Y1, TMP1, #(\n - 3)
+- vsli.u\n Y2, TMP2, #(\n - 3)
+- vsli.u\n Y3, TMP3, #(\n - 3)
+-
+- // x ^= k
+- veor X0, ROUND_KEY
+- veor X1, ROUND_KEY
+- veor X2, ROUND_KEY
+- veor X3, ROUND_KEY
+-
+- // x -= y
+- vsub.u\n X0, Y0
+- vsub.u\n X1, Y1
+- vsub.u\n X2, Y2
+- vsub.u\n X3, Y3
+-
+- // x = rol(x, 8);
+- vtbl.8 X0_L, {X0_L}, ROTATE_TABLE
+- vtbl.8 X0_H, {X0_H}, ROTATE_TABLE
+- vtbl.8 X1_L, {X1_L}, ROTATE_TABLE
+- vtbl.8 X1_H, {X1_H}, ROTATE_TABLE
+- vtbl.8 X2_L, {X2_L}, ROTATE_TABLE
+- vtbl.8 X2_H, {X2_H}, ROTATE_TABLE
+- vtbl.8 X3_L, {X3_L}, ROTATE_TABLE
+- vtbl.8 X3_H, {X3_H}, ROTATE_TABLE
+-.endm
+-
+-.macro _xts128_precrypt_one dst_reg, tweak_buf, tmp
+-
+- // Load the next source block
+- vld1.8 {\dst_reg}, [SRC]!
+-
+- // Save the current tweak in the tweak buffer
+- vst1.8 {TWEAKV}, [\tweak_buf:128]!
+-
+- // XOR the next source block with the current tweak
+- veor \dst_reg, TWEAKV
+-
+- /*
+- * Calculate the next tweak by multiplying the current one by x,
+- * modulo p(x) = x^128 + x^7 + x^2 + x + 1.
+- */
+- vshr.u64 \tmp, TWEAKV, #63
+- vshl.u64 TWEAKV, #1
+- veor TWEAKV_H, \tmp\()_L
+- vtbl.8 \tmp\()_H, {GF128MUL_TABLE}, \tmp\()_H
+- veor TWEAKV_L, \tmp\()_H
+-.endm
+-
+-.macro _xts64_precrypt_two dst_reg, tweak_buf, tmp
+-
+- // Load the next two source blocks
+- vld1.8 {\dst_reg}, [SRC]!
+-
+- // Save the current two tweaks in the tweak buffer
+- vst1.8 {TWEAKV}, [\tweak_buf:128]!
+-
+- // XOR the next two source blocks with the current two tweaks
+- veor \dst_reg, TWEAKV
+-
+- /*
+- * Calculate the next two tweaks by multiplying the current ones by x^2,
+- * modulo p(x) = x^64 + x^4 + x^3 + x + 1.
+- */
+- vshr.u64 \tmp, TWEAKV, #62
+- vshl.u64 TWEAKV, #2
+- vtbl.8 \tmp\()_L, {GF64MUL_TABLE}, \tmp\()_L
+- vtbl.8 \tmp\()_H, {GF64MUL_TABLE}, \tmp\()_H
+- veor TWEAKV, \tmp
+-.endm
+-
+-/*
+- * _speck_xts_crypt() - Speck-XTS encryption/decryption
+- *
+- * Encrypt or decrypt NBYTES bytes of data from the SRC buffer to the DST buffer
+- * using Speck-XTS, specifically the variant with a block size of '2n' and round
+- * count given by NROUNDS. The expanded round keys are given in ROUND_KEYS, and
+- * the current XTS tweak value is given in TWEAK. It's assumed that NBYTES is a
+- * nonzero multiple of 128.
+- */
+-.macro _speck_xts_crypt n, decrypting
+- push {r4-r7}
+- mov r7, sp
+-
+- /*
+- * The first four parameters were passed in registers r0-r3. Load the
+- * additional parameters, which were passed on the stack.
+- */
+- ldr NBYTES, [sp, #16]
+- ldr TWEAK, [sp, #20]
+-
+- /*
+- * If decrypting, modify the ROUND_KEYS parameter to point to the last
+- * round key rather than the first, since for decryption the round keys
+- * are used in reverse order.
+- */
+-.if \decrypting
+-.if \n == 64
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS, lsl #3
+- sub ROUND_KEYS, #8
+-.else
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS, lsl #2
+- sub ROUND_KEYS, #4
+-.endif
+-.endif
+-
+- // Load the index vector for vtbl-based 8-bit rotates
+-.if \decrypting
+- ldr r12, =.Lrol\n\()_8_table
+-.else
+- ldr r12, =.Lror\n\()_8_table
+-.endif
+- vld1.8 {ROTATE_TABLE}, [r12:64]
+-
+- // One-time XTS preparation
+-
+- /*
+- * Allocate stack space to store 128 bytes worth of tweaks. For
+- * performance, this space is aligned to a 16-byte boundary so that we
+- * can use the load/store instructions that declare 16-byte alignment.
+- * For Thumb2 compatibility, don't do the 'bic' directly on 'sp'.
+- */
+- sub r12, sp, #128
+- bic r12, #0xf
+- mov sp, r12
+-
+-.if \n == 64
+- // Load first tweak
+- vld1.8 {TWEAKV}, [TWEAK]
+-
+- // Load GF(2^128) multiplication table
+- ldr r12, =.Lgf128mul_table
+- vld1.8 {GF128MUL_TABLE}, [r12:64]
+-.else
+- // Load first tweak
+- vld1.8 {TWEAKV_L}, [TWEAK]
+-
+- // Load GF(2^64) multiplication table
+- ldr r12, =.Lgf64mul_table
+- vld1.8 {GF64MUL_TABLE}, [r12:64]
+-
+- // Calculate second tweak, packing it together with the first
+- vshr.u64 TMP0_L, TWEAKV_L, #63
+- vtbl.u8 TMP0_L, {GF64MUL_TABLE}, TMP0_L
+- vshl.u64 TWEAKV_H, TWEAKV_L, #1
+- veor TWEAKV_H, TMP0_L
+-.endif
+-
+-.Lnext_128bytes_\@:
+-
+- /*
+- * Load the source blocks into {X,Y}[0-3], XOR them with their XTS tweak
+- * values, and save the tweaks on the stack for later. Then
+- * de-interleave the 'x' and 'y' elements of each block, i.e. make it so
+- * that the X[0-3] registers contain only the second halves of blocks,
+- * and the Y[0-3] registers contain only the first halves of blocks.
+- * (Speck uses the order (y, x) rather than the more intuitive (x, y).)
+- */
+- mov r12, sp
+-.if \n == 64
+- _xts128_precrypt_one X0, r12, TMP0
+- _xts128_precrypt_one Y0, r12, TMP0
+- _xts128_precrypt_one X1, r12, TMP0
+- _xts128_precrypt_one Y1, r12, TMP0
+- _xts128_precrypt_one X2, r12, TMP0
+- _xts128_precrypt_one Y2, r12, TMP0
+- _xts128_precrypt_one X3, r12, TMP0
+- _xts128_precrypt_one Y3, r12, TMP0
+- vswp X0_L, Y0_H
+- vswp X1_L, Y1_H
+- vswp X2_L, Y2_H
+- vswp X3_L, Y3_H
+-.else
+- _xts64_precrypt_two X0, r12, TMP0
+- _xts64_precrypt_two Y0, r12, TMP0
+- _xts64_precrypt_two X1, r12, TMP0
+- _xts64_precrypt_two Y1, r12, TMP0
+- _xts64_precrypt_two X2, r12, TMP0
+- _xts64_precrypt_two Y2, r12, TMP0
+- _xts64_precrypt_two X3, r12, TMP0
+- _xts64_precrypt_two Y3, r12, TMP0
+- vuzp.32 Y0, X0
+- vuzp.32 Y1, X1
+- vuzp.32 Y2, X2
+- vuzp.32 Y3, X3
+-.endif
+-
+- // Do the cipher rounds
+-
+- mov r12, ROUND_KEYS
+- mov r6, NROUNDS
+-
+-.Lnext_round_\@:
+-.if \decrypting
+-.if \n == 64
+- vld1.64 ROUND_KEY_L, [r12]
+- sub r12, #8
+- vmov ROUND_KEY_H, ROUND_KEY_L
+-.else
+- vld1.32 {ROUND_KEY_L[],ROUND_KEY_H[]}, [r12]
+- sub r12, #4
+-.endif
+- _speck_unround_128bytes \n
+-.else
+-.if \n == 64
+- vld1.64 ROUND_KEY_L, [r12]!
+- vmov ROUND_KEY_H, ROUND_KEY_L
+-.else
+- vld1.32 {ROUND_KEY_L[],ROUND_KEY_H[]}, [r12]!
+-.endif
+- _speck_round_128bytes \n
+-.endif
+- subs r6, r6, #1
+- bne .Lnext_round_\@
+-
+- // Re-interleave the 'x' and 'y' elements of each block
+-.if \n == 64
+- vswp X0_L, Y0_H
+- vswp X1_L, Y1_H
+- vswp X2_L, Y2_H
+- vswp X3_L, Y3_H
+-.else
+- vzip.32 Y0, X0
+- vzip.32 Y1, X1
+- vzip.32 Y2, X2
+- vzip.32 Y3, X3
+-.endif
+-
+- // XOR the encrypted/decrypted blocks with the tweaks we saved earlier
+- mov r12, sp
+- vld1.8 {TMP0, TMP1}, [r12:128]!
+- vld1.8 {TMP2, TMP3}, [r12:128]!
+- veor X0, TMP0
+- veor Y0, TMP1
+- veor X1, TMP2
+- veor Y1, TMP3
+- vld1.8 {TMP0, TMP1}, [r12:128]!
+- vld1.8 {TMP2, TMP3}, [r12:128]!
+- veor X2, TMP0
+- veor Y2, TMP1
+- veor X3, TMP2
+- veor Y3, TMP3
+-
+- // Store the ciphertext in the destination buffer
+- vst1.8 {X0, Y0}, [DST]!
+- vst1.8 {X1, Y1}, [DST]!
+- vst1.8 {X2, Y2}, [DST]!
+- vst1.8 {X3, Y3}, [DST]!
+-
+- // Continue if there are more 128-byte chunks remaining, else return
+- subs NBYTES, #128
+- bne .Lnext_128bytes_\@
+-
+- // Store the next tweak
+-.if \n == 64
+- vst1.8 {TWEAKV}, [TWEAK]
+-.else
+- vst1.8 {TWEAKV_L}, [TWEAK]
+-.endif
+-
+- mov sp, r7
+- pop {r4-r7}
+- bx lr
+-.endm
+-
+-ENTRY(speck128_xts_encrypt_neon)
+- _speck_xts_crypt n=64, decrypting=0
+-ENDPROC(speck128_xts_encrypt_neon)
+-
+-ENTRY(speck128_xts_decrypt_neon)
+- _speck_xts_crypt n=64, decrypting=1
+-ENDPROC(speck128_xts_decrypt_neon)
+-
+-ENTRY(speck64_xts_encrypt_neon)
+- _speck_xts_crypt n=32, decrypting=0
+-ENDPROC(speck64_xts_encrypt_neon)
+-
+-ENTRY(speck64_xts_decrypt_neon)
+- _speck_xts_crypt n=32, decrypting=1
+-ENDPROC(speck64_xts_decrypt_neon)
+diff --git a/arch/arm/crypto/speck-neon-glue.c b/arch/arm/crypto/speck-neon-glue.c
+deleted file mode 100644
+index f012c3ea998f..000000000000
+--- a/arch/arm/crypto/speck-neon-glue.c
++++ /dev/null
+@@ -1,288 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Note: the NIST recommendation for XTS only specifies a 128-bit block size,
+- * but a 64-bit version (needed for Speck64) is fairly straightforward; the math
+- * is just done in GF(2^64) instead of GF(2^128), with the reducing polynomial
+- * x^64 + x^4 + x^3 + x + 1 from the original XEX paper (Rogaway, 2004:
+- * "Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes
+- * OCB and PMAC"), represented as 0x1B.
+- */
+-
+-#include <asm/hwcap.h>
+-#include <asm/neon.h>
+-#include <asm/simd.h>
+-#include <crypto/algapi.h>
+-#include <crypto/gf128mul.h>
+-#include <crypto/internal/skcipher.h>
+-#include <crypto/speck.h>
+-#include <crypto/xts.h>
+-#include <linux/kernel.h>
+-#include <linux/module.h>
+-
+-/* The assembly functions only handle multiples of 128 bytes */
+-#define SPECK_NEON_CHUNK_SIZE 128
+-
+-/* Speck128 */
+-
+-struct speck128_xts_tfm_ctx {
+- struct speck128_tfm_ctx main_key;
+- struct speck128_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck128_xts_encrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck128_xts_decrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck128_crypt_one_t)(const struct speck128_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck128_xts_crypt_many_t)(const u64 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck128_xts_crypt(struct skcipher_request *req,
+- speck128_crypt_one_t crypt_one,
+- speck128_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- le128 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck128_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- le128_xor((le128 *)dst, (const le128 *)src, &tweak);
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- le128_xor((le128 *)dst, (const le128 *)dst, &tweak);
+- gf128mul_x_ble(&tweak, &tweak);
+-
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck128_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_encrypt,
+- speck128_xts_encrypt_neon);
+-}
+-
+-static int speck128_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_decrypt,
+- speck128_xts_decrypt_neon);
+-}
+-
+-static int speck128_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck128_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck128_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-/* Speck64 */
+-
+-struct speck64_xts_tfm_ctx {
+- struct speck64_tfm_ctx main_key;
+- struct speck64_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck64_xts_encrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck64_xts_decrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck64_crypt_one_t)(const struct speck64_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck64_xts_crypt_many_t)(const u32 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck64_xts_crypt(struct skcipher_request *req, speck64_crypt_one_t crypt_one,
+- speck64_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- __le64 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck64_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- *(__le64 *)dst = *(__le64 *)src ^ tweak;
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- *(__le64 *)dst ^= tweak;
+- tweak = cpu_to_le64((le64_to_cpu(tweak) << 1) ^
+- ((tweak & cpu_to_le64(1ULL << 63)) ?
+- 0x1B : 0));
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck64_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_encrypt,
+- speck64_xts_encrypt_neon);
+-}
+-
+-static int speck64_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_decrypt,
+- speck64_xts_decrypt_neon);
+-}
+-
+-static int speck64_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck64_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck64_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-static struct skcipher_alg speck_algs[] = {
+- {
+- .base.cra_name = "xts(speck128)",
+- .base.cra_driver_name = "xts-speck128-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK128_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck128_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK128_128_KEY_SIZE,
+- .max_keysize = 2 * SPECK128_256_KEY_SIZE,
+- .ivsize = SPECK128_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck128_xts_setkey,
+- .encrypt = speck128_xts_encrypt,
+- .decrypt = speck128_xts_decrypt,
+- }, {
+- .base.cra_name = "xts(speck64)",
+- .base.cra_driver_name = "xts-speck64-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK64_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck64_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK64_96_KEY_SIZE,
+- .max_keysize = 2 * SPECK64_128_KEY_SIZE,
+- .ivsize = SPECK64_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck64_xts_setkey,
+- .encrypt = speck64_xts_encrypt,
+- .decrypt = speck64_xts_decrypt,
+- }
+-};
+-
+-static int __init speck_neon_module_init(void)
+-{
+- if (!(elf_hwcap & HWCAP_NEON))
+- return -ENODEV;
+- return crypto_register_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-static void __exit speck_neon_module_exit(void)
+-{
+- crypto_unregister_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-module_init(speck_neon_module_init);
+-module_exit(speck_neon_module_exit);
+-
+-MODULE_DESCRIPTION("Speck block cipher (NEON-accelerated)");
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
+-MODULE_ALIAS_CRYPTO("xts(speck128)");
+-MODULE_ALIAS_CRYPTO("xts-speck128-neon");
+-MODULE_ALIAS_CRYPTO("xts(speck64)");
+-MODULE_ALIAS_CRYPTO("xts-speck64-neon");
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+index d033da401c26..bc6c141d7372 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+@@ -335,7 +335,7 @@
+
+ sysmgr: sysmgr@ffd12000 {
+ compatible = "altr,sys-mgr", "syscon";
+- reg = <0xffd12000 0x1000>;
++ reg = <0xffd12000 0x228>;
+ };
+
+ /* Local timer */
+diff --git a/arch/arm64/crypto/Kconfig b/arch/arm64/crypto/Kconfig
+index e3fdb0fd6f70..d51944ff9f91 100644
+--- a/arch/arm64/crypto/Kconfig
++++ b/arch/arm64/crypto/Kconfig
+@@ -119,10 +119,4 @@ config CRYPTO_AES_ARM64_BS
+ select CRYPTO_AES_ARM64
+ select CRYPTO_SIMD
+
+-config CRYPTO_SPECK_NEON
+- tristate "NEON accelerated Speck cipher algorithms"
+- depends on KERNEL_MODE_NEON
+- select CRYPTO_BLKCIPHER
+- select CRYPTO_SPECK
+-
+ endif
+diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile
+index bcafd016618e..7bc4bda6d9c6 100644
+--- a/arch/arm64/crypto/Makefile
++++ b/arch/arm64/crypto/Makefile
+@@ -56,9 +56,6 @@ sha512-arm64-y := sha512-glue.o sha512-core.o
+ obj-$(CONFIG_CRYPTO_CHACHA20_NEON) += chacha20-neon.o
+ chacha20-neon-y := chacha20-neon-core.o chacha20-neon-glue.o
+
+-obj-$(CONFIG_CRYPTO_SPECK_NEON) += speck-neon.o
+-speck-neon-y := speck-neon-core.o speck-neon-glue.o
+-
+ obj-$(CONFIG_CRYPTO_AES_ARM64) += aes-arm64.o
+ aes-arm64-y := aes-cipher-core.o aes-cipher-glue.o
+
+diff --git a/arch/arm64/crypto/speck-neon-core.S b/arch/arm64/crypto/speck-neon-core.S
+deleted file mode 100644
+index b14463438b09..000000000000
+--- a/arch/arm64/crypto/speck-neon-core.S
++++ /dev/null
+@@ -1,352 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * ARM64 NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Author: Eric Biggers <ebiggers@google.com>
+- */
+-
+-#include <linux/linkage.h>
+-
+- .text
+-
+- // arguments
+- ROUND_KEYS .req x0 // const {u64,u32} *round_keys
+- NROUNDS .req w1 // int nrounds
+- NROUNDS_X .req x1
+- DST .req x2 // void *dst
+- SRC .req x3 // const void *src
+- NBYTES .req w4 // unsigned int nbytes
+- TWEAK .req x5 // void *tweak
+-
+- // registers which hold the data being encrypted/decrypted
+- // (underscores avoid a naming collision with ARM64 registers x0-x3)
+- X_0 .req v0
+- Y_0 .req v1
+- X_1 .req v2
+- Y_1 .req v3
+- X_2 .req v4
+- Y_2 .req v5
+- X_3 .req v6
+- Y_3 .req v7
+-
+- // the round key, duplicated in all lanes
+- ROUND_KEY .req v8
+-
+- // index vector for tbl-based 8-bit rotates
+- ROTATE_TABLE .req v9
+- ROTATE_TABLE_Q .req q9
+-
+- // temporary registers
+- TMP0 .req v10
+- TMP1 .req v11
+- TMP2 .req v12
+- TMP3 .req v13
+-
+- // multiplication table for updating XTS tweaks
+- GFMUL_TABLE .req v14
+- GFMUL_TABLE_Q .req q14
+-
+- // next XTS tweak value(s)
+- TWEAKV_NEXT .req v15
+-
+- // XTS tweaks for the blocks currently being encrypted/decrypted
+- TWEAKV0 .req v16
+- TWEAKV1 .req v17
+- TWEAKV2 .req v18
+- TWEAKV3 .req v19
+- TWEAKV4 .req v20
+- TWEAKV5 .req v21
+- TWEAKV6 .req v22
+- TWEAKV7 .req v23
+-
+- .align 4
+-.Lror64_8_table:
+- .octa 0x080f0e0d0c0b0a090007060504030201
+-.Lror32_8_table:
+- .octa 0x0c0f0e0d080b0a090407060500030201
+-.Lrol64_8_table:
+- .octa 0x0e0d0c0b0a09080f0605040302010007
+-.Lrol32_8_table:
+- .octa 0x0e0d0c0f0a09080b0605040702010003
+-.Lgf128mul_table:
+- .octa 0x00000000000000870000000000000001
+-.Lgf64mul_table:
+- .octa 0x0000000000000000000000002d361b00
+-
+-/*
+- * _speck_round_128bytes() - Speck encryption round on 128 bytes at a time
+- *
+- * Do one Speck encryption round on the 128 bytes (8 blocks for Speck128, 16 for
+- * Speck64) stored in X0-X3 and Y0-Y3, using the round key stored in all lanes
+- * of ROUND_KEY. 'n' is the lane size: 64 for Speck128, or 32 for Speck64.
+- * 'lanes' is the lane specifier: "2d" for Speck128 or "4s" for Speck64.
+- */
+-.macro _speck_round_128bytes n, lanes
+-
+- // x = ror(x, 8)
+- tbl X_0.16b, {X_0.16b}, ROTATE_TABLE.16b
+- tbl X_1.16b, {X_1.16b}, ROTATE_TABLE.16b
+- tbl X_2.16b, {X_2.16b}, ROTATE_TABLE.16b
+- tbl X_3.16b, {X_3.16b}, ROTATE_TABLE.16b
+-
+- // x += y
+- add X_0.\lanes, X_0.\lanes, Y_0.\lanes
+- add X_1.\lanes, X_1.\lanes, Y_1.\lanes
+- add X_2.\lanes, X_2.\lanes, Y_2.\lanes
+- add X_3.\lanes, X_3.\lanes, Y_3.\lanes
+-
+- // x ^= k
+- eor X_0.16b, X_0.16b, ROUND_KEY.16b
+- eor X_1.16b, X_1.16b, ROUND_KEY.16b
+- eor X_2.16b, X_2.16b, ROUND_KEY.16b
+- eor X_3.16b, X_3.16b, ROUND_KEY.16b
+-
+- // y = rol(y, 3)
+- shl TMP0.\lanes, Y_0.\lanes, #3
+- shl TMP1.\lanes, Y_1.\lanes, #3
+- shl TMP2.\lanes, Y_2.\lanes, #3
+- shl TMP3.\lanes, Y_3.\lanes, #3
+- sri TMP0.\lanes, Y_0.\lanes, #(\n - 3)
+- sri TMP1.\lanes, Y_1.\lanes, #(\n - 3)
+- sri TMP2.\lanes, Y_2.\lanes, #(\n - 3)
+- sri TMP3.\lanes, Y_3.\lanes, #(\n - 3)
+-
+- // y ^= x
+- eor Y_0.16b, TMP0.16b, X_0.16b
+- eor Y_1.16b, TMP1.16b, X_1.16b
+- eor Y_2.16b, TMP2.16b, X_2.16b
+- eor Y_3.16b, TMP3.16b, X_3.16b
+-.endm
+-
+-/*
+- * _speck_unround_128bytes() - Speck decryption round on 128 bytes at a time
+- *
+- * This is the inverse of _speck_round_128bytes().
+- */
+-.macro _speck_unround_128bytes n, lanes
+-
+- // y ^= x
+- eor TMP0.16b, Y_0.16b, X_0.16b
+- eor TMP1.16b, Y_1.16b, X_1.16b
+- eor TMP2.16b, Y_2.16b, X_2.16b
+- eor TMP3.16b, Y_3.16b, X_3.16b
+-
+- // y = ror(y, 3)
+- ushr Y_0.\lanes, TMP0.\lanes, #3
+- ushr Y_1.\lanes, TMP1.\lanes, #3
+- ushr Y_2.\lanes, TMP2.\lanes, #3
+- ushr Y_3.\lanes, TMP3.\lanes, #3
+- sli Y_0.\lanes, TMP0.\lanes, #(\n - 3)
+- sli Y_1.\lanes, TMP1.\lanes, #(\n - 3)
+- sli Y_2.\lanes, TMP2.\lanes, #(\n - 3)
+- sli Y_3.\lanes, TMP3.\lanes, #(\n - 3)
+-
+- // x ^= k
+- eor X_0.16b, X_0.16b, ROUND_KEY.16b
+- eor X_1.16b, X_1.16b, ROUND_KEY.16b
+- eor X_2.16b, X_2.16b, ROUND_KEY.16b
+- eor X_3.16b, X_3.16b, ROUND_KEY.16b
+-
+- // x -= y
+- sub X_0.\lanes, X_0.\lanes, Y_0.\lanes
+- sub X_1.\lanes, X_1.\lanes, Y_1.\lanes
+- sub X_2.\lanes, X_2.\lanes, Y_2.\lanes
+- sub X_3.\lanes, X_3.\lanes, Y_3.\lanes
+-
+- // x = rol(x, 8)
+- tbl X_0.16b, {X_0.16b}, ROTATE_TABLE.16b
+- tbl X_1.16b, {X_1.16b}, ROTATE_TABLE.16b
+- tbl X_2.16b, {X_2.16b}, ROTATE_TABLE.16b
+- tbl X_3.16b, {X_3.16b}, ROTATE_TABLE.16b
+-.endm
+-
+-.macro _next_xts_tweak next, cur, tmp, n
+-.if \n == 64
+- /*
+- * Calculate the next tweak by multiplying the current one by x,
+- * modulo p(x) = x^128 + x^7 + x^2 + x + 1.
+- */
+- sshr \tmp\().2d, \cur\().2d, #63
+- and \tmp\().16b, \tmp\().16b, GFMUL_TABLE.16b
+- shl \next\().2d, \cur\().2d, #1
+- ext \tmp\().16b, \tmp\().16b, \tmp\().16b, #8
+- eor \next\().16b, \next\().16b, \tmp\().16b
+-.else
+- /*
+- * Calculate the next two tweaks by multiplying the current ones by x^2,
+- * modulo p(x) = x^64 + x^4 + x^3 + x + 1.
+- */
+- ushr \tmp\().2d, \cur\().2d, #62
+- shl \next\().2d, \cur\().2d, #2
+- tbl \tmp\().16b, {GFMUL_TABLE.16b}, \tmp\().16b
+- eor \next\().16b, \next\().16b, \tmp\().16b
+-.endif
+-.endm
+-
+-/*
+- * _speck_xts_crypt() - Speck-XTS encryption/decryption
+- *
+- * Encrypt or decrypt NBYTES bytes of data from the SRC buffer to the DST buffer
+- * using Speck-XTS, specifically the variant with a block size of '2n' and round
+- * count given by NROUNDS. The expanded round keys are given in ROUND_KEYS, and
+- * the current XTS tweak value is given in TWEAK. It's assumed that NBYTES is a
+- * nonzero multiple of 128.
+- */
+-.macro _speck_xts_crypt n, lanes, decrypting
+-
+- /*
+- * If decrypting, modify the ROUND_KEYS parameter to point to the last
+- * round key rather than the first, since for decryption the round keys
+- * are used in reverse order.
+- */
+-.if \decrypting
+- mov NROUNDS, NROUNDS /* zero the high 32 bits */
+-.if \n == 64
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS_X, lsl #3
+- sub ROUND_KEYS, ROUND_KEYS, #8
+-.else
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS_X, lsl #2
+- sub ROUND_KEYS, ROUND_KEYS, #4
+-.endif
+-.endif
+-
+- // Load the index vector for tbl-based 8-bit rotates
+-.if \decrypting
+- ldr ROTATE_TABLE_Q, .Lrol\n\()_8_table
+-.else
+- ldr ROTATE_TABLE_Q, .Lror\n\()_8_table
+-.endif
+-
+- // One-time XTS preparation
+-.if \n == 64
+- // Load first tweak
+- ld1 {TWEAKV0.16b}, [TWEAK]
+-
+- // Load GF(2^128) multiplication table
+- ldr GFMUL_TABLE_Q, .Lgf128mul_table
+-.else
+- // Load first tweak
+- ld1 {TWEAKV0.8b}, [TWEAK]
+-
+- // Load GF(2^64) multiplication table
+- ldr GFMUL_TABLE_Q, .Lgf64mul_table
+-
+- // Calculate second tweak, packing it together with the first
+- ushr TMP0.2d, TWEAKV0.2d, #63
+- shl TMP1.2d, TWEAKV0.2d, #1
+- tbl TMP0.8b, {GFMUL_TABLE.16b}, TMP0.8b
+- eor TMP0.8b, TMP0.8b, TMP1.8b
+- mov TWEAKV0.d[1], TMP0.d[0]
+-.endif
+-
+-.Lnext_128bytes_\@:
+-
+- // Calculate XTS tweaks for next 128 bytes
+- _next_xts_tweak TWEAKV1, TWEAKV0, TMP0, \n
+- _next_xts_tweak TWEAKV2, TWEAKV1, TMP0, \n
+- _next_xts_tweak TWEAKV3, TWEAKV2, TMP0, \n
+- _next_xts_tweak TWEAKV4, TWEAKV3, TMP0, \n
+- _next_xts_tweak TWEAKV5, TWEAKV4, TMP0, \n
+- _next_xts_tweak TWEAKV6, TWEAKV5, TMP0, \n
+- _next_xts_tweak TWEAKV7, TWEAKV6, TMP0, \n
+- _next_xts_tweak TWEAKV_NEXT, TWEAKV7, TMP0, \n
+-
+- // Load the next source blocks into {X,Y}[0-3]
+- ld1 {X_0.16b-Y_1.16b}, [SRC], #64
+- ld1 {X_2.16b-Y_3.16b}, [SRC], #64
+-
+- // XOR the source blocks with their XTS tweaks
+- eor TMP0.16b, X_0.16b, TWEAKV0.16b
+- eor Y_0.16b, Y_0.16b, TWEAKV1.16b
+- eor TMP1.16b, X_1.16b, TWEAKV2.16b
+- eor Y_1.16b, Y_1.16b, TWEAKV3.16b
+- eor TMP2.16b, X_2.16b, TWEAKV4.16b
+- eor Y_2.16b, Y_2.16b, TWEAKV5.16b
+- eor TMP3.16b, X_3.16b, TWEAKV6.16b
+- eor Y_3.16b, Y_3.16b, TWEAKV7.16b
+-
+- /*
+- * De-interleave the 'x' and 'y' elements of each block, i.e. make it so
+- * that the X[0-3] registers contain only the second halves of blocks,
+- * and the Y[0-3] registers contain only the first halves of blocks.
+- * (Speck uses the order (y, x) rather than the more intuitive (x, y).)
+- */
+- uzp2 X_0.\lanes, TMP0.\lanes, Y_0.\lanes
+- uzp1 Y_0.\lanes, TMP0.\lanes, Y_0.\lanes
+- uzp2 X_1.\lanes, TMP1.\lanes, Y_1.\lanes
+- uzp1 Y_1.\lanes, TMP1.\lanes, Y_1.\lanes
+- uzp2 X_2.\lanes, TMP2.\lanes, Y_2.\lanes
+- uzp1 Y_2.\lanes, TMP2.\lanes, Y_2.\lanes
+- uzp2 X_3.\lanes, TMP3.\lanes, Y_3.\lanes
+- uzp1 Y_3.\lanes, TMP3.\lanes, Y_3.\lanes
+-
+- // Do the cipher rounds
+- mov x6, ROUND_KEYS
+- mov w7, NROUNDS
+-.Lnext_round_\@:
+-.if \decrypting
+- ld1r {ROUND_KEY.\lanes}, [x6]
+- sub x6, x6, #( \n / 8 )
+- _speck_unround_128bytes \n, \lanes
+-.else
+- ld1r {ROUND_KEY.\lanes}, [x6], #( \n / 8 )
+- _speck_round_128bytes \n, \lanes
+-.endif
+- subs w7, w7, #1
+- bne .Lnext_round_\@
+-
+- // Re-interleave the 'x' and 'y' elements of each block
+- zip1 TMP0.\lanes, Y_0.\lanes, X_0.\lanes
+- zip2 Y_0.\lanes, Y_0.\lanes, X_0.\lanes
+- zip1 TMP1.\lanes, Y_1.\lanes, X_1.\lanes
+- zip2 Y_1.\lanes, Y_1.\lanes, X_1.\lanes
+- zip1 TMP2.\lanes, Y_2.\lanes, X_2.\lanes
+- zip2 Y_2.\lanes, Y_2.\lanes, X_2.\lanes
+- zip1 TMP3.\lanes, Y_3.\lanes, X_3.\lanes
+- zip2 Y_3.\lanes, Y_3.\lanes, X_3.\lanes
+-
+- // XOR the encrypted/decrypted blocks with the tweaks calculated earlier
+- eor X_0.16b, TMP0.16b, TWEAKV0.16b
+- eor Y_0.16b, Y_0.16b, TWEAKV1.16b
+- eor X_1.16b, TMP1.16b, TWEAKV2.16b
+- eor Y_1.16b, Y_1.16b, TWEAKV3.16b
+- eor X_2.16b, TMP2.16b, TWEAKV4.16b
+- eor Y_2.16b, Y_2.16b, TWEAKV5.16b
+- eor X_3.16b, TMP3.16b, TWEAKV6.16b
+- eor Y_3.16b, Y_3.16b, TWEAKV7.16b
+- mov TWEAKV0.16b, TWEAKV_NEXT.16b
+-
+- // Store the ciphertext in the destination buffer
+- st1 {X_0.16b-Y_1.16b}, [DST], #64
+- st1 {X_2.16b-Y_3.16b}, [DST], #64
+-
+- // Continue if there are more 128-byte chunks remaining
+- subs NBYTES, NBYTES, #128
+- bne .Lnext_128bytes_\@
+-
+- // Store the next tweak and return
+-.if \n == 64
+- st1 {TWEAKV_NEXT.16b}, [TWEAK]
+-.else
+- st1 {TWEAKV_NEXT.8b}, [TWEAK]
+-.endif
+- ret
+-.endm
+-
+-ENTRY(speck128_xts_encrypt_neon)
+- _speck_xts_crypt n=64, lanes=2d, decrypting=0
+-ENDPROC(speck128_xts_encrypt_neon)
+-
+-ENTRY(speck128_xts_decrypt_neon)
+- _speck_xts_crypt n=64, lanes=2d, decrypting=1
+-ENDPROC(speck128_xts_decrypt_neon)
+-
+-ENTRY(speck64_xts_encrypt_neon)
+- _speck_xts_crypt n=32, lanes=4s, decrypting=0
+-ENDPROC(speck64_xts_encrypt_neon)
+-
+-ENTRY(speck64_xts_decrypt_neon)
+- _speck_xts_crypt n=32, lanes=4s, decrypting=1
+-ENDPROC(speck64_xts_decrypt_neon)
+diff --git a/arch/arm64/crypto/speck-neon-glue.c b/arch/arm64/crypto/speck-neon-glue.c
+deleted file mode 100644
+index 6e233aeb4ff4..000000000000
+--- a/arch/arm64/crypto/speck-neon-glue.c
++++ /dev/null
+@@ -1,282 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- * (64-bit version; based on the 32-bit version)
+- *
+- * Copyright (c) 2018 Google, Inc
+- */
+-
+-#include <asm/hwcap.h>
+-#include <asm/neon.h>
+-#include <asm/simd.h>
+-#include <crypto/algapi.h>
+-#include <crypto/gf128mul.h>
+-#include <crypto/internal/skcipher.h>
+-#include <crypto/speck.h>
+-#include <crypto/xts.h>
+-#include <linux/kernel.h>
+-#include <linux/module.h>
+-
+-/* The assembly functions only handle multiples of 128 bytes */
+-#define SPECK_NEON_CHUNK_SIZE 128
+-
+-/* Speck128 */
+-
+-struct speck128_xts_tfm_ctx {
+- struct speck128_tfm_ctx main_key;
+- struct speck128_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck128_xts_encrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck128_xts_decrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck128_crypt_one_t)(const struct speck128_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck128_xts_crypt_many_t)(const u64 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck128_xts_crypt(struct skcipher_request *req,
+- speck128_crypt_one_t crypt_one,
+- speck128_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- le128 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck128_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- le128_xor((le128 *)dst, (const le128 *)src, &tweak);
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- le128_xor((le128 *)dst, (const le128 *)dst, &tweak);
+- gf128mul_x_ble(&tweak, &tweak);
+-
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck128_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_encrypt,
+- speck128_xts_encrypt_neon);
+-}
+-
+-static int speck128_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_decrypt,
+- speck128_xts_decrypt_neon);
+-}
+-
+-static int speck128_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck128_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck128_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-/* Speck64 */
+-
+-struct speck64_xts_tfm_ctx {
+- struct speck64_tfm_ctx main_key;
+- struct speck64_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck64_xts_encrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck64_xts_decrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck64_crypt_one_t)(const struct speck64_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck64_xts_crypt_many_t)(const u32 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck64_xts_crypt(struct skcipher_request *req, speck64_crypt_one_t crypt_one,
+- speck64_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- __le64 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck64_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- *(__le64 *)dst = *(__le64 *)src ^ tweak;
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- *(__le64 *)dst ^= tweak;
+- tweak = cpu_to_le64((le64_to_cpu(tweak) << 1) ^
+- ((tweak & cpu_to_le64(1ULL << 63)) ?
+- 0x1B : 0));
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck64_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_encrypt,
+- speck64_xts_encrypt_neon);
+-}
+-
+-static int speck64_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_decrypt,
+- speck64_xts_decrypt_neon);
+-}
+-
+-static int speck64_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck64_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck64_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-static struct skcipher_alg speck_algs[] = {
+- {
+- .base.cra_name = "xts(speck128)",
+- .base.cra_driver_name = "xts-speck128-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK128_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck128_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK128_128_KEY_SIZE,
+- .max_keysize = 2 * SPECK128_256_KEY_SIZE,
+- .ivsize = SPECK128_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck128_xts_setkey,
+- .encrypt = speck128_xts_encrypt,
+- .decrypt = speck128_xts_decrypt,
+- }, {
+- .base.cra_name = "xts(speck64)",
+- .base.cra_driver_name = "xts-speck64-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK64_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck64_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK64_96_KEY_SIZE,
+- .max_keysize = 2 * SPECK64_128_KEY_SIZE,
+- .ivsize = SPECK64_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck64_xts_setkey,
+- .encrypt = speck64_xts_encrypt,
+- .decrypt = speck64_xts_decrypt,
+- }
+-};
+-
+-static int __init speck_neon_module_init(void)
+-{
+- if (!(elf_hwcap & HWCAP_ASIMD))
+- return -ENODEV;
+- return crypto_register_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-static void __exit speck_neon_module_exit(void)
+-{
+- crypto_unregister_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-module_init(speck_neon_module_init);
+-module_exit(speck_neon_module_exit);
+-
+-MODULE_DESCRIPTION("Speck block cipher (NEON-accelerated)");
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
+-MODULE_ALIAS_CRYPTO("xts(speck128)");
+-MODULE_ALIAS_CRYPTO("xts-speck128-neon");
+-MODULE_ALIAS_CRYPTO("xts(speck64)");
+-MODULE_ALIAS_CRYPTO("xts-speck64-neon");
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index e238b7932096..93f69d82225d 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -848,15 +848,29 @@ static bool has_no_fpsimd(const struct arm64_cpu_capabilities *entry, int __unus
+ }
+
+ static bool has_cache_idc(const struct arm64_cpu_capabilities *entry,
+- int __unused)
++ int scope)
+ {
+- return read_sanitised_ftr_reg(SYS_CTR_EL0) & BIT(CTR_IDC_SHIFT);
++ u64 ctr;
++
++ if (scope == SCOPE_SYSTEM)
++ ctr = arm64_ftr_reg_ctrel0.sys_val;
++ else
++ ctr = read_cpuid_cachetype();
++
++ return ctr & BIT(CTR_IDC_SHIFT);
+ }
+
+ static bool has_cache_dic(const struct arm64_cpu_capabilities *entry,
+- int __unused)
++ int scope)
+ {
+- return read_sanitised_ftr_reg(SYS_CTR_EL0) & BIT(CTR_DIC_SHIFT);
++ u64 ctr;
++
++ if (scope == SCOPE_SYSTEM)
++ ctr = arm64_ftr_reg_ctrel0.sys_val;
++ else
++ ctr = read_cpuid_cachetype();
++
++ return ctr & BIT(CTR_DIC_SHIFT);
+ }
+
+ #ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 09dbea221a27..8556876c9109 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -589,7 +589,7 @@ el1_undef:
+ inherit_daif pstate=x23, tmp=x2
+ mov x0, sp
+ bl do_undefinstr
+- ASM_BUG()
++ kernel_exit 1
+ el1_dbg:
+ /*
+ * Debug exception handling
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index 039e9ff379cc..b9da093e0341 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -310,10 +310,12 @@ static int call_undef_hook(struct pt_regs *regs)
+ int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
+ void __user *pc = (void __user *)instruction_pointer(regs);
+
+- if (!user_mode(regs))
+- return 1;
+-
+- if (compat_thumb_mode(regs)) {
++ if (!user_mode(regs)) {
++ __le32 instr_le;
++ if (probe_kernel_address((__force __le32 *)pc, instr_le))
++ goto exit;
++ instr = le32_to_cpu(instr_le);
++ } else if (compat_thumb_mode(regs)) {
+ /* 16-bit Thumb instruction */
+ __le16 instr_le;
+ if (get_user(instr_le, (__le16 __user *)pc))
+@@ -407,6 +409,7 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs)
+ return;
+
+ force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc);
++ BUG_ON(!user_mode(regs));
+ }
+
+ void cpu_enable_cache_maint_trap(const struct arm64_cpu_capabilities *__unused)
+diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile
+index 68755fd70dcf..5df2d611b77d 100644
+--- a/arch/arm64/lib/Makefile
++++ b/arch/arm64/lib/Makefile
+@@ -12,7 +12,7 @@ lib-y := clear_user.o delay.o copy_from_user.o \
+ # when supported by the CPU. Result and argument registers are handled
+ # correctly, based on the function prototype.
+ lib-$(CONFIG_ARM64_LSE_ATOMICS) += atomic_ll_sc.o
+-CFLAGS_atomic_ll_sc.o := -fcall-used-x0 -ffixed-x1 -ffixed-x2 \
++CFLAGS_atomic_ll_sc.o := -ffixed-x1 -ffixed-x2 \
+ -ffixed-x3 -ffixed-x4 -ffixed-x5 -ffixed-x6 \
+ -ffixed-x7 -fcall-saved-x8 -fcall-saved-x9 \
+ -fcall-saved-x10 -fcall-saved-x11 -fcall-saved-x12 \
+diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
+index 1d5483f6e457..93a3c3c0238c 100644
+--- a/arch/m68k/configs/amiga_defconfig
++++ b/arch/m68k/configs/amiga_defconfig
+@@ -657,7 +657,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
+index 52a0af127951..e3d0efd6397d 100644
+--- a/arch/m68k/configs/apollo_defconfig
++++ b/arch/m68k/configs/apollo_defconfig
+@@ -614,7 +614,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
+index b3103e51268a..75ac0c76e884 100644
+--- a/arch/m68k/configs/atari_defconfig
++++ b/arch/m68k/configs/atari_defconfig
+@@ -635,7 +635,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
+index fb7d651a4cab..c6e492700188 100644
+--- a/arch/m68k/configs/bvme6000_defconfig
++++ b/arch/m68k/configs/bvme6000_defconfig
+@@ -606,7 +606,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
+index 6b37f5537c39..b00d1c477432 100644
+--- a/arch/m68k/configs/hp300_defconfig
++++ b/arch/m68k/configs/hp300_defconfig
+@@ -616,7 +616,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
+index c717bf879449..85cac3770d89 100644
+--- a/arch/m68k/configs/mac_defconfig
++++ b/arch/m68k/configs/mac_defconfig
+@@ -638,7 +638,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
+index 226c994ce794..b3a5d1e99d27 100644
+--- a/arch/m68k/configs/multi_defconfig
++++ b/arch/m68k/configs/multi_defconfig
+@@ -720,7 +720,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
+index b383327fd77a..0ca22608453f 100644
+--- a/arch/m68k/configs/mvme147_defconfig
++++ b/arch/m68k/configs/mvme147_defconfig
+@@ -606,7 +606,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
+index 9783d3deb9e9..8e3d10d12d9c 100644
+--- a/arch/m68k/configs/mvme16x_defconfig
++++ b/arch/m68k/configs/mvme16x_defconfig
+@@ -606,7 +606,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
+index a35d10ee10cb..ff7e653ec7fa 100644
+--- a/arch/m68k/configs/q40_defconfig
++++ b/arch/m68k/configs/q40_defconfig
+@@ -629,7 +629,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
+index 573bf922d448..612cf46f6d0c 100644
+--- a/arch/m68k/configs/sun3_defconfig
++++ b/arch/m68k/configs/sun3_defconfig
+@@ -607,7 +607,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
+index efb27a7fcc55..a6a7bb6dc3fd 100644
+--- a/arch/m68k/configs/sun3x_defconfig
++++ b/arch/m68k/configs/sun3x_defconfig
+@@ -608,7 +608,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/mips/cavium-octeon/executive/cvmx-helper.c b/arch/mips/cavium-octeon/executive/cvmx-helper.c
+index 75108ec669eb..6c79e8a16a26 100644
+--- a/arch/mips/cavium-octeon/executive/cvmx-helper.c
++++ b/arch/mips/cavium-octeon/executive/cvmx-helper.c
+@@ -67,7 +67,7 @@ void (*cvmx_override_pko_queue_priority) (int pko_port,
+ void (*cvmx_override_ipd_port_setup) (int ipd_port);
+
+ /* Port count per interface */
+-static int interface_port_count[5];
++static int interface_port_count[9];
+
+ /**
+ * Return the number of interfaces the chip has. Each interface
+diff --git a/arch/mips/include/asm/processor.h b/arch/mips/include/asm/processor.h
+index 49d6046ca1d0..c373eb605040 100644
+--- a/arch/mips/include/asm/processor.h
++++ b/arch/mips/include/asm/processor.h
+@@ -81,7 +81,7 @@ extern unsigned int vced_count, vcei_count;
+
+ #endif
+
+-#define VDSO_RANDOMIZE_SIZE (TASK_IS_32BIT_ADDR ? SZ_1M : SZ_256M)
++#define VDSO_RANDOMIZE_SIZE (TASK_IS_32BIT_ADDR ? SZ_1M : SZ_64M)
+
+ extern unsigned long mips_stack_top(void);
+ #define STACK_TOP mips_stack_top()
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index 242c5ab65611..d2f92273fe37 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -186,7 +186,7 @@
+ bv,n 0(%r3)
+ nop
+ .word 0 /* checksum (will be patched) */
+- .word PA(os_hpmc) /* address of handler */
++ .word 0 /* address of handler */
+ .word 0 /* length of handler */
+ .endm
+
+diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S
+index 781c3b9a3e46..fde654115564 100644
+--- a/arch/parisc/kernel/hpmc.S
++++ b/arch/parisc/kernel/hpmc.S
+@@ -85,7 +85,7 @@ END(hpmc_pim_data)
+
+ .import intr_save, code
+ .align 16
+-ENTRY_CFI(os_hpmc)
++ENTRY(os_hpmc)
+ .os_hpmc:
+
+ /*
+@@ -302,7 +302,6 @@ os_hpmc_6:
+ b .
+ nop
+ .align 16 /* make function length multiple of 16 bytes */
+-ENDPROC_CFI(os_hpmc)
+ .os_hpmc_end:
+
+
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index 68f10f87073d..abeb5321a83f 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -802,7 +802,8 @@ void __init initialize_ivt(const void *iva)
+ * the Length/4 words starting at Address is zero.
+ */
+
+- /* Compute Checksum for HPMC handler */
++ /* Setup IVA and compute checksum for HPMC handler */
++ ivap[6] = (u32)__pa(os_hpmc);
+ length = os_hpmc_size;
+ ivap[7] = length;
+
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index 74842d28a7a1..aae9b0d71c1e 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -494,12 +494,8 @@ static void __init map_pages(unsigned long start_vaddr,
+ pte = pte_mkhuge(pte);
+ }
+
+- if (address >= end_paddr) {
+- if (force)
+- break;
+- else
+- pte_val(pte) = 0;
+- }
++ if (address >= end_paddr)
++ break;
+
+ set_pte(pg_table, pte);
+
+diff --git a/arch/powerpc/include/asm/mpic.h b/arch/powerpc/include/asm/mpic.h
+index fad8ddd697ac..0abf2e7fd222 100644
+--- a/arch/powerpc/include/asm/mpic.h
++++ b/arch/powerpc/include/asm/mpic.h
+@@ -393,7 +393,14 @@ extern struct bus_type mpic_subsys;
+ #define MPIC_REGSET_TSI108 MPIC_REGSET(1) /* Tsi108/109 PIC */
+
+ /* Get the version of primary MPIC */
++#ifdef CONFIG_MPIC
+ extern u32 fsl_mpic_primary_get_version(void);
++#else
++static inline u32 fsl_mpic_primary_get_version(void)
++{
++ return 0;
++}
++#endif
+
+ /* Allocate the controller structure and setup the linux irq descs
+ * for the range if interrupts passed in. No HW initialization is
+diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
+index 3497c8329c1d..3022d67f0c48 100644
+--- a/arch/powerpc/kernel/mce_power.c
++++ b/arch/powerpc/kernel/mce_power.c
+@@ -89,6 +89,13 @@ static void flush_and_reload_slb(void)
+
+ static void flush_erat(void)
+ {
++#ifdef CONFIG_PPC_BOOK3S_64
++ if (!early_cpu_has_feature(CPU_FTR_ARCH_300)) {
++ flush_and_reload_slb();
++ return;
++ }
++#endif
++ /* PPC_INVALIDATE_ERAT can only be used on ISA v3 and newer */
+ asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+ }
+
+diff --git a/arch/powerpc/kernel/module.c b/arch/powerpc/kernel/module.c
+index 77371c9ef3d8..2d861a36662e 100644
+--- a/arch/powerpc/kernel/module.c
++++ b/arch/powerpc/kernel/module.c
+@@ -74,6 +74,14 @@ int module_finalize(const Elf_Ehdr *hdr,
+ (void *)sect->sh_addr + sect->sh_size);
+ #endif /* CONFIG_PPC64 */
+
++#ifdef PPC64_ELF_ABI_v1
++ sect = find_section(hdr, sechdrs, ".opd");
++ if (sect != NULL) {
++ me->arch.start_opd = sect->sh_addr;
++ me->arch.end_opd = sect->sh_addr + sect->sh_size;
++ }
++#endif /* PPC64_ELF_ABI_v1 */
++
+ #ifdef CONFIG_PPC_BARRIER_NOSPEC
+ sect = find_section(hdr, sechdrs, "__spec_barrier_fixup");
+ if (sect != NULL)
+diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
+index b8d61e019d06..2c53de9f3b6a 100644
+--- a/arch/powerpc/kernel/module_64.c
++++ b/arch/powerpc/kernel/module_64.c
+@@ -360,11 +360,6 @@ int module_frob_arch_sections(Elf64_Ehdr *hdr,
+ else if (strcmp(secstrings+sechdrs[i].sh_name,"__versions")==0)
+ dedotify_versions((void *)hdr + sechdrs[i].sh_offset,
+ sechdrs[i].sh_size);
+- else if (!strcmp(secstrings + sechdrs[i].sh_name, ".opd")) {
+- me->arch.start_opd = sechdrs[i].sh_addr;
+- me->arch.end_opd = sechdrs[i].sh_addr +
+- sechdrs[i].sh_size;
+- }
+
+ /* We don't handle .init for the moment: rename to _init */
+ while ((p = strstr(secstrings + sechdrs[i].sh_name, ".init")))
+diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
+index 6a501b25dd85..faf00222b324 100644
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -243,13 +243,19 @@ static void cpu_ready_for_interrupts(void)
+ }
+
+ /*
+- * Fixup HFSCR:TM based on CPU features. The bit is set by our
+- * early asm init because at that point we haven't updated our
+- * CPU features from firmware and device-tree. Here we have,
+- * so let's do it.
++ * Set HFSCR:TM based on CPU features:
++ * In the special case of TM no suspend (P9N DD2.1), Linux is
++ * told TM is off via the dt-ftrs but told to (partially) use
++ * it via OPAL_REINIT_CPUS_TM_SUSPEND_DISABLED. So HFSCR[TM]
++ * will be off from dt-ftrs but we need to turn it on for the
++ * no suspend case.
+ */
+- if (cpu_has_feature(CPU_FTR_HVMODE) && !cpu_has_feature(CPU_FTR_TM_COMP))
+- mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) & ~HFSCR_TM);
++ if (cpu_has_feature(CPU_FTR_HVMODE)) {
++ if (cpu_has_feature(CPU_FTR_TM_COMP))
++ mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) | HFSCR_TM);
++ else
++ mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) & ~HFSCR_TM);
++ }
+
+ /* Set IR and DR in PACA MSR */
+ get_paca()->kernel_msr = MSR_KERNEL;
+diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
+index 729f02df8290..aaa28fd918fe 100644
+--- a/arch/powerpc/mm/hash_native_64.c
++++ b/arch/powerpc/mm/hash_native_64.c
+@@ -115,6 +115,8 @@ static void tlbiel_all_isa300(unsigned int num_sets, unsigned int is)
+ tlbiel_hash_set_isa300(0, is, 0, 2, 1);
+
+ asm volatile("ptesync": : :"memory");
++
++ asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+ void hash__tlbiel_all(unsigned int action)
+@@ -140,8 +142,6 @@ void hash__tlbiel_all(unsigned int action)
+ tlbiel_all_isa206(POWER7_TLB_SETS, is);
+ else
+ WARN(1, "%s called on pre-POWER7 CPU\n", __func__);
+-
+- asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+ static inline unsigned long ___tlbie(unsigned long vpn, int psize,
+diff --git a/arch/s390/defconfig b/arch/s390/defconfig
+index f40600eb1762..5134c71a4937 100644
+--- a/arch/s390/defconfig
++++ b/arch/s390/defconfig
+@@ -221,7 +221,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_DEFLATE=m
+diff --git a/arch/s390/kernel/sthyi.c b/arch/s390/kernel/sthyi.c
+index 0859cde36f75..888cc2f166db 100644
+--- a/arch/s390/kernel/sthyi.c
++++ b/arch/s390/kernel/sthyi.c
+@@ -183,17 +183,19 @@ static void fill_hdr(struct sthyi_sctns *sctns)
+ static void fill_stsi_mac(struct sthyi_sctns *sctns,
+ struct sysinfo_1_1_1 *sysinfo)
+ {
++ sclp_ocf_cpc_name_copy(sctns->mac.infmname);
++ if (*(u64 *)sctns->mac.infmname != 0)
++ sctns->mac.infmval1 |= MAC_NAME_VLD;
++
+ if (stsi(sysinfo, 1, 1, 1))
+ return;
+
+- sclp_ocf_cpc_name_copy(sctns->mac.infmname);
+-
+ memcpy(sctns->mac.infmtype, sysinfo->type, sizeof(sctns->mac.infmtype));
+ memcpy(sctns->mac.infmmanu, sysinfo->manufacturer, sizeof(sctns->mac.infmmanu));
+ memcpy(sctns->mac.infmpman, sysinfo->plant, sizeof(sctns->mac.infmpman));
+ memcpy(sctns->mac.infmseq, sysinfo->sequence, sizeof(sctns->mac.infmseq));
+
+- sctns->mac.infmval1 |= MAC_ID_VLD | MAC_NAME_VLD;
++ sctns->mac.infmval1 |= MAC_ID_VLD;
+ }
+
+ static void fill_stsi_par(struct sthyi_sctns *sctns,
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 1458b1700fc7..8b4c5e001157 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -738,6 +738,7 @@ efi_main(struct efi_config *c, struct boot_params *boot_params)
+ struct desc_struct *desc;
+ void *handle;
+ efi_system_table_t *_table;
++ unsigned long cmdline_paddr;
+
+ efi_early = c;
+
+@@ -755,6 +756,15 @@ efi_main(struct efi_config *c, struct boot_params *boot_params)
+ else
+ setup_boot_services32(efi_early);
+
++ /*
++ * make_boot_params() may have been called before efi_main(), in which
++ * case this is the second time we parse the cmdline. This is ok,
++ * parsing the cmdline multiple times does not have side-effects.
++ */
++ cmdline_paddr = ((u64)hdr->cmd_line_ptr |
++ ((u64)boot_params->ext_cmd_line_ptr << 32));
++ efi_parse_options((char *)cmdline_paddr);
++
+ /*
+ * If the boot loader gave us a value for secure_boot then we use that,
+ * otherwise we ask the BIOS.
+diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
+index d4e6cd4577e5..bf0e82400358 100644
+--- a/arch/x86/boot/tools/build.c
++++ b/arch/x86/boot/tools/build.c
+@@ -391,6 +391,13 @@ int main(int argc, char ** argv)
+ die("Unable to mmap '%s': %m", argv[2]);
+ /* Number of 16-byte paragraphs, including space for a 4-byte CRC */
+ sys_size = (sz + 15 + 4) / 16;
++#ifdef CONFIG_EFI_STUB
++ /*
++ * COFF requires minimum 32-byte alignment of sections, and
++ * adding a signature is problematic without that alignment.
++ */
++ sys_size = (sys_size + 1) & ~1;
++#endif
+
+ /* Patch the setup code with the appropriate size parameters */
+ buf[0x1f1] = setup_sectors-1;
+diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
+index acbe7e8336d8..e4b78f962874 100644
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -817,7 +817,7 @@ static int gcmaes_crypt_by_sg(bool enc, struct aead_request *req,
+ /* Linearize assoc, if not already linear */
+ if (req->src->length >= assoclen && req->src->length &&
+ (!PageHighMem(sg_page(req->src)) ||
+- req->src->offset + req->src->length < PAGE_SIZE)) {
++ req->src->offset + req->src->length <= PAGE_SIZE)) {
+ scatterwalk_start(&assoc_sg_walk, req->src);
+ assoc = scatterwalk_map(&assoc_sg_walk);
+ } else {
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 09b2e3e2cf1b..1c09a0d1771f 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -177,6 +177,7 @@ enum {
+
+ #define DR6_BD (1 << 13)
+ #define DR6_BS (1 << 14)
++#define DR6_BT (1 << 15)
+ #define DR6_RTM (1 << 16)
+ #define DR6_FIXED_1 0xfffe0ff0
+ #define DR6_INIT 0xffff0ff0
+diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
+index 58ce5288878e..0e2130d8d6b1 100644
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -469,6 +469,12 @@ static inline void __native_flush_tlb_one_user(unsigned long addr)
+ */
+ static inline void __flush_tlb_all(void)
+ {
++ /*
++ * This is to catch users with enabled preemption and the PGE feature
++ * and don't trigger the warning in __native_flush_tlb().
++ */
++ VM_WARN_ON_ONCE(preemptible());
++
+ if (boot_cpu_has(X86_FEATURE_PGE)) {
+ __flush_tlb_global();
+ } else {
+diff --git a/arch/x86/kernel/check.c b/arch/x86/kernel/check.c
+index 33399426793e..cc8258a5378b 100644
+--- a/arch/x86/kernel/check.c
++++ b/arch/x86/kernel/check.c
+@@ -31,6 +31,11 @@ static __init int set_corruption_check(char *arg)
+ ssize_t ret;
+ unsigned long val;
+
++ if (!arg) {
++ pr_err("memory_corruption_check config string not provided\n");
++ return -EINVAL;
++ }
++
+ ret = kstrtoul(arg, 10, &val);
+ if (ret)
+ return ret;
+@@ -45,6 +50,11 @@ static __init int set_corruption_check_period(char *arg)
+ ssize_t ret;
+ unsigned long val;
+
++ if (!arg) {
++ pr_err("memory_corruption_check_period config string not provided\n");
++ return -EINVAL;
++ }
++
+ ret = kstrtoul(arg, 10, &val);
+ if (ret)
+ return ret;
+@@ -59,6 +69,11 @@ static __init int set_corruption_check_size(char *arg)
+ char *end;
+ unsigned size;
+
++ if (!arg) {
++ pr_err("memory_corruption_check_size config string not provided\n");
++ return -EINVAL;
++ }
++
+ size = memparse(arg, &end);
+
+ if (*end == '\0')
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 40bdaea97fe7..53eb14a65610 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -35,12 +35,10 @@ static void __init spectre_v2_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
+
+-/*
+- * Our boot-time value of the SPEC_CTRL MSR. We read it once so that any
+- * writes to SPEC_CTRL contain whatever reserved bits have been set.
+- */
+-u64 __ro_after_init x86_spec_ctrl_base;
++/* The base value of the SPEC_CTRL MSR that always has to be preserved. */
++u64 x86_spec_ctrl_base;
+ EXPORT_SYMBOL_GPL(x86_spec_ctrl_base);
++static DEFINE_MUTEX(spec_ctrl_mutex);
+
+ /*
+ * The vendor and possibly platform specific bits which can be modified in
+@@ -325,6 +323,46 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ return cmd;
+ }
+
++static bool stibp_needed(void)
++{
++ if (spectre_v2_enabled == SPECTRE_V2_NONE)
++ return false;
++
++ if (!boot_cpu_has(X86_FEATURE_STIBP))
++ return false;
++
++ return true;
++}
++
++static void update_stibp_msr(void *info)
++{
++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++}
++
++void arch_smt_update(void)
++{
++ u64 mask;
++
++ if (!stibp_needed())
++ return;
++
++ mutex_lock(&spec_ctrl_mutex);
++ mask = x86_spec_ctrl_base;
++ if (cpu_smt_control == CPU_SMT_ENABLED)
++ mask |= SPEC_CTRL_STIBP;
++ else
++ mask &= ~SPEC_CTRL_STIBP;
++
++ if (mask != x86_spec_ctrl_base) {
++ pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n",
++ cpu_smt_control == CPU_SMT_ENABLED ?
++ "Enabling" : "Disabling");
++ x86_spec_ctrl_base = mask;
++ on_each_cpu(update_stibp_msr, NULL, 1);
++ }
++ mutex_unlock(&spec_ctrl_mutex);
++}
++
+ static void __init spectre_v2_select_mitigation(void)
+ {
+ enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
+@@ -424,6 +462,9 @@ specv2_set_mode:
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+ pr_info("Enabling Restricted Speculation for firmware calls\n");
+ }
++
++ /* Enable STIBP if appropriate */
++ arch_smt_update();
+ }
+
+ #undef pr_fmt
+@@ -814,6 +855,8 @@ static ssize_t l1tf_show_state(char *buf)
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+ char *buf, unsigned int bug)
+ {
++ int ret;
++
+ if (!boot_cpu_has_bug(bug))
+ return sprintf(buf, "Not affected\n");
+
+@@ -831,10 +874,12 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ return sprintf(buf, "Mitigation: __user pointer sanitization\n");
+
+ case X86_BUG_SPECTRE_V2:
+- return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
++ ret = sprintf(buf, "%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+ boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
++ (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
+ spectre_v2_module_string());
++ return ret;
+
+ case X86_BUG_SPEC_STORE_BYPASS:
+ return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index b140c68bc14b..643670fb8943 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -2805,6 +2805,13 @@ static int rdtgroup_show_options(struct seq_file *seq, struct kernfs_root *kf)
+ {
+ if (rdt_resources_all[RDT_RESOURCE_L3DATA].alloc_enabled)
+ seq_puts(seq, ",cdp");
++
++ if (rdt_resources_all[RDT_RESOURCE_L2DATA].alloc_enabled)
++ seq_puts(seq, ",cdpl2");
++
++ if (is_mba_sc(&rdt_resources_all[RDT_RESOURCE_MBA]))
++ seq_puts(seq, ",mba_MBps");
++
+ return 0;
+ }
+
+diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
+index eaf02f2e7300..40b16b270656 100644
+--- a/arch/x86/kernel/kprobes/opt.c
++++ b/arch/x86/kernel/kprobes/opt.c
+@@ -179,7 +179,7 @@ optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs)
+ opt_pre_handler(&op->kp, regs);
+ __this_cpu_write(current_kprobe, NULL);
+ }
+- preempt_enable_no_resched();
++ preempt_enable();
+ }
+ NOKPROBE_SYMBOL(optimized_callback);
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index e665aa7167cf..9f3def7baa6d 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3294,10 +3294,13 @@ static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned long *exit
+ }
+ } else {
+ if (vmcs12->exception_bitmap & (1u << nr)) {
+- if (nr == DB_VECTOR)
++ if (nr == DB_VECTOR) {
+ *exit_qual = vcpu->arch.dr6;
+- else
++ *exit_qual &= ~(DR6_FIXED_1 | DR6_BT);
++ *exit_qual ^= DR6_RTM;
++ } else {
+ *exit_qual = 0;
++ }
+ return 1;
+ }
+ }
+@@ -14010,13 +14013,6 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
+ if (!page_address_valid(vcpu, kvm_state->vmx.vmxon_pa))
+ return -EINVAL;
+
+- if (kvm_state->size < sizeof(kvm_state) + sizeof(*vmcs12))
+- return -EINVAL;
+-
+- if (kvm_state->vmx.vmcs_pa == kvm_state->vmx.vmxon_pa ||
+- !page_address_valid(vcpu, kvm_state->vmx.vmcs_pa))
+- return -EINVAL;
+-
+ if ((kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_GUEST_MODE) &&
+ (kvm_state->flags & KVM_STATE_NESTED_GUEST_MODE))
+ return -EINVAL;
+@@ -14046,6 +14042,14 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
+ if (ret)
+ return ret;
+
++ /* Empty 'VMXON' state is permitted */
++ if (kvm_state->size < sizeof(kvm_state) + sizeof(*vmcs12))
++ return 0;
++
++ if (kvm_state->vmx.vmcs_pa == kvm_state->vmx.vmxon_pa ||
++ !page_address_valid(vcpu, kvm_state->vmx.vmcs_pa))
++ return -EINVAL;
++
+ set_current_vmptr(vmx, kvm_state->vmx.vmcs_pa);
+
+ if (kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_VMXON) {
+diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
+index b54d52a2d00a..d71d72cf6c66 100644
+--- a/arch/x86/mm/numa_emulation.c
++++ b/arch/x86/mm/numa_emulation.c
+@@ -400,9 +400,17 @@ void __init numa_emulation(struct numa_meminfo *numa_meminfo, int numa_dist_cnt)
+ n = simple_strtoul(emu_cmdline, &emu_cmdline, 0);
+ ret = -1;
+ for_each_node_mask(i, physnode_mask) {
++ /*
++ * The reason we pass in blk[0] is due to
++ * numa_remove_memblk_from() called by
++ * emu_setup_memblk() will delete entry 0
++ * and then move everything else up in the pi.blk
++ * array. Therefore we should always be looking
++ * at blk[0].
++ */
+ ret = split_nodes_size_interleave_uniform(&ei, &pi,
+- pi.blk[i].start, pi.blk[i].end, 0,
+- n, &pi.blk[i], nid);
++ pi.blk[0].start, pi.blk[0].end, 0,
++ n, &pi.blk[0], nid);
+ if (ret < 0)
+ break;
+ if (ret < n) {
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index 51a5a69ecac9..e2d4b25c7aa4 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -2086,9 +2086,13 @@ void __kernel_map_pages(struct page *page, int numpages, int enable)
+
+ /*
+ * We should perform an IPI and flush all tlbs,
+- * but that can deadlock->flush only current cpu:
++ * but that can deadlock->flush only current cpu.
++ * Preemption needs to be disabled around __flush_tlb_all() due to
++ * CR3 reload in __native_flush_tlb().
+ */
++ preempt_disable();
+ __flush_tlb_all();
++ preempt_enable();
+
+ arch_flush_lazy_mmu_mode();
+ }
+diff --git a/arch/x86/platform/olpc/olpc-xo1-rtc.c b/arch/x86/platform/olpc/olpc-xo1-rtc.c
+index a2b4efddd61a..8e7ddd7e313a 100644
+--- a/arch/x86/platform/olpc/olpc-xo1-rtc.c
++++ b/arch/x86/platform/olpc/olpc-xo1-rtc.c
+@@ -16,6 +16,7 @@
+
+ #include <asm/msr.h>
+ #include <asm/olpc.h>
++#include <asm/x86_init.h>
+
+ static void rtc_wake_on(struct device *dev)
+ {
+@@ -75,6 +76,8 @@ static int __init xo1_rtc_init(void)
+ if (r)
+ return r;
+
++ x86_platform.legacy.rtc = 0;
++
+ device_init_wakeup(&xo1_rtc_device.dev, 1);
+ return 0;
+ }
+diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c
+index c85d1a88f476..f7f77023288a 100644
+--- a/arch/x86/xen/enlighten_pvh.c
++++ b/arch/x86/xen/enlighten_pvh.c
+@@ -75,7 +75,7 @@ static void __init init_pvh_bootparams(void)
+ * Version 2.12 supports Xen entry point but we will use default x86/PC
+ * environment (i.e. hardware_subarch 0).
+ */
+- pvh_bootparams.hdr.version = 0x212;
++ pvh_bootparams.hdr.version = (2 << 8) | 12;
+ pvh_bootparams.hdr.type_of_loader = (9 << 4) | 0; /* Xen loader */
+
+ x86_init.acpi.get_root_pointer = pvh_get_root_pointer;
+diff --git a/arch/x86/xen/platform-pci-unplug.c b/arch/x86/xen/platform-pci-unplug.c
+index 33a783c77d96..184b36922397 100644
+--- a/arch/x86/xen/platform-pci-unplug.c
++++ b/arch/x86/xen/platform-pci-unplug.c
+@@ -146,6 +146,10 @@ void xen_unplug_emulated_devices(void)
+ {
+ int r;
+
++ /* PVH guests don't have emulated devices. */
++ if (xen_pvh_domain())
++ return;
++
+ /* user explicitly requested no unplug */
+ if (xen_emul_unplug & XEN_UNPLUG_NEVER)
+ return;
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index 973f10e05211..717b4847b473 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -9,6 +9,7 @@
+ #include <linux/log2.h>
+ #include <linux/gfp.h>
+ #include <linux/slab.h>
++#include <linux/atomic.h>
+
+ #include <asm/paravirt.h>
+ #include <asm/qspinlock.h>
+@@ -21,6 +22,7 @@
+
+ static DEFINE_PER_CPU(int, lock_kicker_irq) = -1;
+ static DEFINE_PER_CPU(char *, irq_name);
++static DEFINE_PER_CPU(atomic_t, xen_qlock_wait_nest);
+ static bool xen_pvspin = true;
+
+ static void xen_qlock_kick(int cpu)
+@@ -40,33 +42,24 @@ static void xen_qlock_kick(int cpu)
+ static void xen_qlock_wait(u8 *byte, u8 val)
+ {
+ int irq = __this_cpu_read(lock_kicker_irq);
++ atomic_t *nest_cnt = this_cpu_ptr(&xen_qlock_wait_nest);
+
+ /* If kicker interrupts not initialized yet, just spin */
+- if (irq == -1)
++ if (irq == -1 || in_nmi())
+ return;
+
+- /* clear pending */
+- xen_clear_irq_pending(irq);
+- barrier();
+-
+- /*
+- * We check the byte value after clearing pending IRQ to make sure
+- * that we won't miss a wakeup event because of the clearing.
+- *
+- * The sync_clear_bit() call in xen_clear_irq_pending() is atomic.
+- * So it is effectively a memory barrier for x86.
+- */
+- if (READ_ONCE(*byte) != val)
+- return;
++ /* Detect reentry. */
++ atomic_inc(nest_cnt);
+
+- /*
+- * If an interrupt happens here, it will leave the wakeup irq
+- * pending, which will cause xen_poll_irq() to return
+- * immediately.
+- */
++ /* If irq pending already and no nested call clear it. */
++ if (atomic_read(nest_cnt) == 1 && xen_test_irq_pending(irq)) {
++ xen_clear_irq_pending(irq);
++ } else if (READ_ONCE(*byte) == val) {
++ /* Block until irq becomes pending (or a spurious wakeup) */
++ xen_poll_irq(irq);
++ }
+
+- /* Block until irq becomes pending (or perhaps a spurious wakeup) */
+- xen_poll_irq(irq);
++ atomic_dec(nest_cnt);
+ }
+
+ static irqreturn_t dummy_handler(int irq, void *dev_id)
+diff --git a/arch/x86/xen/xen-pvh.S b/arch/x86/xen/xen-pvh.S
+index ca2d3b2bf2af..58722a052f9c 100644
+--- a/arch/x86/xen/xen-pvh.S
++++ b/arch/x86/xen/xen-pvh.S
+@@ -181,7 +181,7 @@ canary:
+ .fill 48, 1, 0
+
+ early_stack:
+- .fill 256, 1, 0
++ .fill BOOT_STACK_SIZE, 1, 0
+ early_stack_end:
+
+ ELFNOTE(Xen, XEN_ELFNOTE_PHYS32_ENTRY,
+diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
+index ae52bff43ce4..ff7c2d470bb8 100644
+--- a/block/bfq-wf2q.c
++++ b/block/bfq-wf2q.c
+@@ -1181,10 +1181,17 @@ bool __bfq_deactivate_entity(struct bfq_entity *entity, bool ins_into_idle_tree)
+ st = bfq_entity_service_tree(entity);
+ is_in_service = entity == sd->in_service_entity;
+
+- if (is_in_service) {
+- bfq_calc_finish(entity, entity->service);
++ bfq_calc_finish(entity, entity->service);
++
++ if (is_in_service)
+ sd->in_service_entity = NULL;
+- }
++ else
++ /*
++ * Non in-service entity: nobody will take care of
++ * resetting its service counter on expiration. Do it
++ * now.
++ */
++ entity->service = 0;
+
+ if (entity->tree == &st->active)
+ bfq_active_extract(st, entity);
+diff --git a/block/blk-lib.c b/block/blk-lib.c
+index bbd44666f2b5..1f196cf0aa5d 100644
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -58,8 +58,7 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+
+ if (!req_sects)
+ goto fail;
+- if (req_sects > UINT_MAX >> 9)
+- req_sects = UINT_MAX >> 9;
++ req_sects = min(req_sects, bio_allowed_max_sectors(q));
+
+ end_sect = sector + req_sects;
+
+@@ -162,7 +161,7 @@ static int __blkdev_issue_write_same(struct block_device *bdev, sector_t sector,
+ return -EOPNOTSUPP;
+
+ /* Ensure that max_write_same_sectors doesn't overflow bi_size */
+- max_write_same_sectors = UINT_MAX >> 9;
++ max_write_same_sectors = bio_allowed_max_sectors(q);
+
+ while (nr_sects) {
+ bio = next_bio(bio, 1, gfp_mask);
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index aaec38cc37b8..2e042190a4f1 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -27,7 +27,8 @@ static struct bio *blk_bio_discard_split(struct request_queue *q,
+ /* Zero-sector (unknown) and one-sector granularities are the same. */
+ granularity = max(q->limits.discard_granularity >> 9, 1U);
+
+- max_discard_sectors = min(q->limits.max_discard_sectors, UINT_MAX >> 9);
++ max_discard_sectors = min(q->limits.max_discard_sectors,
++ bio_allowed_max_sectors(q));
+ max_discard_sectors -= max_discard_sectors % granularity;
+
+ if (unlikely(!max_discard_sectors)) {
+diff --git a/block/blk.h b/block/blk.h
+index 9db4e389582c..977d4b5d968d 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -328,6 +328,16 @@ static inline unsigned long blk_rq_deadline(struct request *rq)
+ return rq->__deadline & ~0x1UL;
+ }
+
++/*
++ * The max size one bio can handle is UINT_MAX becasue bvec_iter.bi_size
++ * is defined as 'unsigned int', meantime it has to aligned to with logical
++ * block size which is the minimum accepted unit by hardware.
++ */
++static inline unsigned int bio_allowed_max_sectors(struct request_queue *q)
++{
++ return round_down(UINT_MAX, queue_logical_block_size(q)) >> 9;
++}
++
+ /*
+ * Internal io_context interface
+ */
+diff --git a/block/bounce.c b/block/bounce.c
+index bc63b3a2d18c..418677dcec60 100644
+--- a/block/bounce.c
++++ b/block/bounce.c
+@@ -31,6 +31,24 @@
+ static struct bio_set bounce_bio_set, bounce_bio_split;
+ static mempool_t page_pool, isa_page_pool;
+
++static void init_bounce_bioset(void)
++{
++ static bool bounce_bs_setup;
++ int ret;
++
++ if (bounce_bs_setup)
++ return;
++
++ ret = bioset_init(&bounce_bio_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
++ BUG_ON(ret);
++ if (bioset_integrity_create(&bounce_bio_set, BIO_POOL_SIZE))
++ BUG_ON(1);
++
++ ret = bioset_init(&bounce_bio_split, BIO_POOL_SIZE, 0, 0);
++ BUG_ON(ret);
++ bounce_bs_setup = true;
++}
++
+ #if defined(CONFIG_HIGHMEM)
+ static __init int init_emergency_pool(void)
+ {
+@@ -44,14 +62,7 @@ static __init int init_emergency_pool(void)
+ BUG_ON(ret);
+ pr_info("pool size: %d pages\n", POOL_SIZE);
+
+- ret = bioset_init(&bounce_bio_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
+- BUG_ON(ret);
+- if (bioset_integrity_create(&bounce_bio_set, BIO_POOL_SIZE))
+- BUG_ON(1);
+-
+- ret = bioset_init(&bounce_bio_split, BIO_POOL_SIZE, 0, 0);
+- BUG_ON(ret);
+-
++ init_bounce_bioset();
+ return 0;
+ }
+
+@@ -86,6 +97,8 @@ static void *mempool_alloc_pages_isa(gfp_t gfp_mask, void *data)
+ return mempool_alloc_pages(gfp_mask | GFP_DMA, data);
+ }
+
++static DEFINE_MUTEX(isa_mutex);
++
+ /*
+ * gets called "every" time someone init's a queue with BLK_BOUNCE_ISA
+ * as the max address, so check if the pool has already been created.
+@@ -94,14 +107,20 @@ int init_emergency_isa_pool(void)
+ {
+ int ret;
+
+- if (mempool_initialized(&isa_page_pool))
++ mutex_lock(&isa_mutex);
++
++ if (mempool_initialized(&isa_page_pool)) {
++ mutex_unlock(&isa_mutex);
+ return 0;
++ }
+
+ ret = mempool_init(&isa_page_pool, ISA_POOL_SIZE, mempool_alloc_pages_isa,
+ mempool_free_pages, (void *) 0);
+ BUG_ON(ret);
+
+ pr_info("isa pool size: %d pages\n", ISA_POOL_SIZE);
++ init_bounce_bioset();
++ mutex_unlock(&isa_mutex);
+ return 0;
+ }
+
+diff --git a/crypto/Kconfig b/crypto/Kconfig
+index f3e40ac56d93..59e32623a7ce 100644
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -1590,20 +1590,6 @@ config CRYPTO_SM4
+
+ If unsure, say N.
+
+-config CRYPTO_SPECK
+- tristate "Speck cipher algorithm"
+- select CRYPTO_ALGAPI
+- help
+- Speck is a lightweight block cipher that is tuned for optimal
+- performance in software (rather than hardware).
+-
+- Speck may not be as secure as AES, and should only be used on systems
+- where AES is not fast enough.
+-
+- See also: <https://eprint.iacr.org/2013/404.pdf>
+-
+- If unsure, say N.
+-
+ config CRYPTO_TEA
+ tristate "TEA, XTEA and XETA cipher algorithms"
+ select CRYPTO_ALGAPI
+diff --git a/crypto/Makefile b/crypto/Makefile
+index 6d1d40eeb964..f6a234d08882 100644
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -115,7 +115,6 @@ obj-$(CONFIG_CRYPTO_TEA) += tea.o
+ obj-$(CONFIG_CRYPTO_KHAZAD) += khazad.o
+ obj-$(CONFIG_CRYPTO_ANUBIS) += anubis.o
+ obj-$(CONFIG_CRYPTO_SEED) += seed.o
+-obj-$(CONFIG_CRYPTO_SPECK) += speck.o
+ obj-$(CONFIG_CRYPTO_SALSA20) += salsa20_generic.o
+ obj-$(CONFIG_CRYPTO_CHACHA20) += chacha20_generic.o
+ obj-$(CONFIG_CRYPTO_POLY1305) += poly1305_generic.o
+diff --git a/crypto/aegis.h b/crypto/aegis.h
+index f1c6900ddb80..405e025fc906 100644
+--- a/crypto/aegis.h
++++ b/crypto/aegis.h
+@@ -21,7 +21,7 @@
+
+ union aegis_block {
+ __le64 words64[AEGIS_BLOCK_SIZE / sizeof(__le64)];
+- u32 words32[AEGIS_BLOCK_SIZE / sizeof(u32)];
++ __le32 words32[AEGIS_BLOCK_SIZE / sizeof(__le32)];
+ u8 bytes[AEGIS_BLOCK_SIZE];
+ };
+
+@@ -57,24 +57,22 @@ static void crypto_aegis_aesenc(union aegis_block *dst,
+ const union aegis_block *src,
+ const union aegis_block *key)
+ {
+- u32 *d = dst->words32;
+ const u8 *s = src->bytes;
+- const u32 *k = key->words32;
+ const u32 *t0 = crypto_ft_tab[0];
+ const u32 *t1 = crypto_ft_tab[1];
+ const u32 *t2 = crypto_ft_tab[2];
+ const u32 *t3 = crypto_ft_tab[3];
+ u32 d0, d1, d2, d3;
+
+- d0 = t0[s[ 0]] ^ t1[s[ 5]] ^ t2[s[10]] ^ t3[s[15]] ^ k[0];
+- d1 = t0[s[ 4]] ^ t1[s[ 9]] ^ t2[s[14]] ^ t3[s[ 3]] ^ k[1];
+- d2 = t0[s[ 8]] ^ t1[s[13]] ^ t2[s[ 2]] ^ t3[s[ 7]] ^ k[2];
+- d3 = t0[s[12]] ^ t1[s[ 1]] ^ t2[s[ 6]] ^ t3[s[11]] ^ k[3];
++ d0 = t0[s[ 0]] ^ t1[s[ 5]] ^ t2[s[10]] ^ t3[s[15]];
++ d1 = t0[s[ 4]] ^ t1[s[ 9]] ^ t2[s[14]] ^ t3[s[ 3]];
++ d2 = t0[s[ 8]] ^ t1[s[13]] ^ t2[s[ 2]] ^ t3[s[ 7]];
++ d3 = t0[s[12]] ^ t1[s[ 1]] ^ t2[s[ 6]] ^ t3[s[11]];
+
+- d[0] = d0;
+- d[1] = d1;
+- d[2] = d2;
+- d[3] = d3;
++ dst->words32[0] = cpu_to_le32(d0) ^ key->words32[0];
++ dst->words32[1] = cpu_to_le32(d1) ^ key->words32[1];
++ dst->words32[2] = cpu_to_le32(d2) ^ key->words32[2];
++ dst->words32[3] = cpu_to_le32(d3) ^ key->words32[3];
+ }
+
+ #endif /* _CRYPTO_AEGIS_H */
+diff --git a/crypto/lrw.c b/crypto/lrw.c
+index 393a782679c7..5504d1325a56 100644
+--- a/crypto/lrw.c
++++ b/crypto/lrw.c
+@@ -143,7 +143,12 @@ static inline int get_index128(be128 *block)
+ return x + ffz(val);
+ }
+
+- return x;
++ /*
++ * If we get here, then x == 128 and we are incrementing the counter
++ * from all ones to all zeros. This means we must return index 127, i.e.
++ * the one corresponding to key2*{ 1,...,1 }.
++ */
++ return 127;
+ }
+
+ static int post_crypt(struct skcipher_request *req)
+diff --git a/crypto/morus1280.c b/crypto/morus1280.c
+index d057cf5ac4a8..3889c188f266 100644
+--- a/crypto/morus1280.c
++++ b/crypto/morus1280.c
+@@ -385,14 +385,11 @@ static void crypto_morus1280_final(struct morus1280_state *state,
+ struct morus1280_block *tag_xor,
+ u64 assoclen, u64 cryptlen)
+ {
+- u64 assocbits = assoclen * 8;
+- u64 cryptbits = cryptlen * 8;
+-
+ struct morus1280_block tmp;
+ unsigned int i;
+
+- tmp.words[0] = cpu_to_le64(assocbits);
+- tmp.words[1] = cpu_to_le64(cryptbits);
++ tmp.words[0] = assoclen * 8;
++ tmp.words[1] = cryptlen * 8;
+ tmp.words[2] = 0;
+ tmp.words[3] = 0;
+
+diff --git a/crypto/morus640.c b/crypto/morus640.c
+index 1ca76e54281b..da06ec2f6a80 100644
+--- a/crypto/morus640.c
++++ b/crypto/morus640.c
+@@ -384,21 +384,13 @@ static void crypto_morus640_final(struct morus640_state *state,
+ struct morus640_block *tag_xor,
+ u64 assoclen, u64 cryptlen)
+ {
+- u64 assocbits = assoclen * 8;
+- u64 cryptbits = cryptlen * 8;
+-
+- u32 assocbits_lo = (u32)assocbits;
+- u32 assocbits_hi = (u32)(assocbits >> 32);
+- u32 cryptbits_lo = (u32)cryptbits;
+- u32 cryptbits_hi = (u32)(cryptbits >> 32);
+-
+ struct morus640_block tmp;
+ unsigned int i;
+
+- tmp.words[0] = cpu_to_le32(assocbits_lo);
+- tmp.words[1] = cpu_to_le32(assocbits_hi);
+- tmp.words[2] = cpu_to_le32(cryptbits_lo);
+- tmp.words[3] = cpu_to_le32(cryptbits_hi);
++ tmp.words[0] = lower_32_bits(assoclen * 8);
++ tmp.words[1] = upper_32_bits(assoclen * 8);
++ tmp.words[2] = lower_32_bits(cryptlen * 8);
++ tmp.words[3] = upper_32_bits(cryptlen * 8);
+
+ for (i = 0; i < MORUS_BLOCK_WORDS; i++)
+ state->s[4].words[i] ^= state->s[0].words[i];
+diff --git a/crypto/speck.c b/crypto/speck.c
+deleted file mode 100644
+index 58aa9f7f91f7..000000000000
+--- a/crypto/speck.c
++++ /dev/null
+@@ -1,307 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * Speck: a lightweight block cipher
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Speck has 10 variants, including 5 block sizes. For now we only implement
+- * the variants Speck128/128, Speck128/192, Speck128/256, Speck64/96, and
+- * Speck64/128. Speck${B}/${K} denotes the variant with a block size of B bits
+- * and a key size of K bits. The Speck128 variants are believed to be the most
+- * secure variants, and they use the same block size and key sizes as AES. The
+- * Speck64 variants are less secure, but on 32-bit processors are usually
+- * faster. The remaining variants (Speck32, Speck48, and Speck96) are even less
+- * secure and/or not as well suited for implementation on either 32-bit or
+- * 64-bit processors, so are omitted.
+- *
+- * Reference: "The Simon and Speck Families of Lightweight Block Ciphers"
+- * https://eprint.iacr.org/2013/404.pdf
+- *
+- * In a correspondence, the Speck designers have also clarified that the words
+- * should be interpreted in little-endian format, and the words should be
+- * ordered such that the first word of each block is 'y' rather than 'x', and
+- * the first key word (rather than the last) becomes the first round key.
+- */
+-
+-#include <asm/unaligned.h>
+-#include <crypto/speck.h>
+-#include <linux/bitops.h>
+-#include <linux/crypto.h>
+-#include <linux/init.h>
+-#include <linux/module.h>
+-
+-/* Speck128 */
+-
+-static __always_inline void speck128_round(u64 *x, u64 *y, u64 k)
+-{
+- *x = ror64(*x, 8);
+- *x += *y;
+- *x ^= k;
+- *y = rol64(*y, 3);
+- *y ^= *x;
+-}
+-
+-static __always_inline void speck128_unround(u64 *x, u64 *y, u64 k)
+-{
+- *y ^= *x;
+- *y = ror64(*y, 3);
+- *x ^= k;
+- *x -= *y;
+- *x = rol64(*x, 8);
+-}
+-
+-void crypto_speck128_encrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u64 y = get_unaligned_le64(in);
+- u64 x = get_unaligned_le64(in + 8);
+- int i;
+-
+- for (i = 0; i < ctx->nrounds; i++)
+- speck128_round(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le64(y, out);
+- put_unaligned_le64(x, out + 8);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck128_encrypt);
+-
+-static void speck128_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck128_encrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-void crypto_speck128_decrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u64 y = get_unaligned_le64(in);
+- u64 x = get_unaligned_le64(in + 8);
+- int i;
+-
+- for (i = ctx->nrounds - 1; i >= 0; i--)
+- speck128_unround(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le64(y, out);
+- put_unaligned_le64(x, out + 8);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck128_decrypt);
+-
+-static void speck128_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck128_decrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-int crypto_speck128_setkey(struct speck128_tfm_ctx *ctx, const u8 *key,
+- unsigned int keylen)
+-{
+- u64 l[3];
+- u64 k;
+- int i;
+-
+- switch (keylen) {
+- case SPECK128_128_KEY_SIZE:
+- k = get_unaligned_le64(key);
+- l[0] = get_unaligned_le64(key + 8);
+- ctx->nrounds = SPECK128_128_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck128_round(&l[0], &k, i);
+- }
+- break;
+- case SPECK128_192_KEY_SIZE:
+- k = get_unaligned_le64(key);
+- l[0] = get_unaligned_le64(key + 8);
+- l[1] = get_unaligned_le64(key + 16);
+- ctx->nrounds = SPECK128_192_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck128_round(&l[i % 2], &k, i);
+- }
+- break;
+- case SPECK128_256_KEY_SIZE:
+- k = get_unaligned_le64(key);
+- l[0] = get_unaligned_le64(key + 8);
+- l[1] = get_unaligned_le64(key + 16);
+- l[2] = get_unaligned_le64(key + 24);
+- ctx->nrounds = SPECK128_256_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck128_round(&l[i % 3], &k, i);
+- }
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck128_setkey);
+-
+-static int speck128_setkey(struct crypto_tfm *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- return crypto_speck128_setkey(crypto_tfm_ctx(tfm), key, keylen);
+-}
+-
+-/* Speck64 */
+-
+-static __always_inline void speck64_round(u32 *x, u32 *y, u32 k)
+-{
+- *x = ror32(*x, 8);
+- *x += *y;
+- *x ^= k;
+- *y = rol32(*y, 3);
+- *y ^= *x;
+-}
+-
+-static __always_inline void speck64_unround(u32 *x, u32 *y, u32 k)
+-{
+- *y ^= *x;
+- *y = ror32(*y, 3);
+- *x ^= k;
+- *x -= *y;
+- *x = rol32(*x, 8);
+-}
+-
+-void crypto_speck64_encrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u32 y = get_unaligned_le32(in);
+- u32 x = get_unaligned_le32(in + 4);
+- int i;
+-
+- for (i = 0; i < ctx->nrounds; i++)
+- speck64_round(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le32(y, out);
+- put_unaligned_le32(x, out + 4);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck64_encrypt);
+-
+-static void speck64_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck64_encrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-void crypto_speck64_decrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u32 y = get_unaligned_le32(in);
+- u32 x = get_unaligned_le32(in + 4);
+- int i;
+-
+- for (i = ctx->nrounds - 1; i >= 0; i--)
+- speck64_unround(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le32(y, out);
+- put_unaligned_le32(x, out + 4);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck64_decrypt);
+-
+-static void speck64_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck64_decrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-int crypto_speck64_setkey(struct speck64_tfm_ctx *ctx, const u8 *key,
+- unsigned int keylen)
+-{
+- u32 l[3];
+- u32 k;
+- int i;
+-
+- switch (keylen) {
+- case SPECK64_96_KEY_SIZE:
+- k = get_unaligned_le32(key);
+- l[0] = get_unaligned_le32(key + 4);
+- l[1] = get_unaligned_le32(key + 8);
+- ctx->nrounds = SPECK64_96_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck64_round(&l[i % 2], &k, i);
+- }
+- break;
+- case SPECK64_128_KEY_SIZE:
+- k = get_unaligned_le32(key);
+- l[0] = get_unaligned_le32(key + 4);
+- l[1] = get_unaligned_le32(key + 8);
+- l[2] = get_unaligned_le32(key + 12);
+- ctx->nrounds = SPECK64_128_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck64_round(&l[i % 3], &k, i);
+- }
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck64_setkey);
+-
+-static int speck64_setkey(struct crypto_tfm *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- return crypto_speck64_setkey(crypto_tfm_ctx(tfm), key, keylen);
+-}
+-
+-/* Algorithm definitions */
+-
+-static struct crypto_alg speck_algs[] = {
+- {
+- .cra_name = "speck128",
+- .cra_driver_name = "speck128-generic",
+- .cra_priority = 100,
+- .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
+- .cra_blocksize = SPECK128_BLOCK_SIZE,
+- .cra_ctxsize = sizeof(struct speck128_tfm_ctx),
+- .cra_module = THIS_MODULE,
+- .cra_u = {
+- .cipher = {
+- .cia_min_keysize = SPECK128_128_KEY_SIZE,
+- .cia_max_keysize = SPECK128_256_KEY_SIZE,
+- .cia_setkey = speck128_setkey,
+- .cia_encrypt = speck128_encrypt,
+- .cia_decrypt = speck128_decrypt
+- }
+- }
+- }, {
+- .cra_name = "speck64",
+- .cra_driver_name = "speck64-generic",
+- .cra_priority = 100,
+- .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
+- .cra_blocksize = SPECK64_BLOCK_SIZE,
+- .cra_ctxsize = sizeof(struct speck64_tfm_ctx),
+- .cra_module = THIS_MODULE,
+- .cra_u = {
+- .cipher = {
+- .cia_min_keysize = SPECK64_96_KEY_SIZE,
+- .cia_max_keysize = SPECK64_128_KEY_SIZE,
+- .cia_setkey = speck64_setkey,
+- .cia_encrypt = speck64_encrypt,
+- .cia_decrypt = speck64_decrypt
+- }
+- }
+- }
+-};
+-
+-static int __init speck_module_init(void)
+-{
+- return crypto_register_algs(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-static void __exit speck_module_exit(void)
+-{
+- crypto_unregister_algs(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-module_init(speck_module_init);
+-module_exit(speck_module_exit);
+-
+-MODULE_DESCRIPTION("Speck block cipher (generic)");
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
+-MODULE_ALIAS_CRYPTO("speck128");
+-MODULE_ALIAS_CRYPTO("speck128-generic");
+-MODULE_ALIAS_CRYPTO("speck64");
+-MODULE_ALIAS_CRYPTO("speck64-generic");
+diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
+index bdde95e8d369..6e0a054bb61d 100644
+--- a/crypto/tcrypt.c
++++ b/crypto/tcrypt.c
+@@ -1103,6 +1103,9 @@ static void test_ahash_speed_common(const char *algo, unsigned int secs,
+ break;
+ }
+
++ if (speed[i].klen)
++ crypto_ahash_setkey(tfm, tvmem[0], speed[i].klen);
++
+ pr_info("test%3u "
+ "(%5u byte blocks,%5u bytes per update,%4u updates): ",
+ i, speed[i].blen, speed[i].plen, speed[i].blen / speed[i].plen);
+diff --git a/crypto/testmgr.c b/crypto/testmgr.c
+index a1d42245082a..1c9bf38e59ea 100644
+--- a/crypto/testmgr.c
++++ b/crypto/testmgr.c
+@@ -3037,18 +3037,6 @@ static const struct alg_test_desc alg_test_descs[] = {
+ .suite = {
+ .cipher = __VECS(sm4_tv_template)
+ }
+- }, {
+- .alg = "ecb(speck128)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck128_tv_template)
+- }
+- }, {
+- .alg = "ecb(speck64)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck64_tv_template)
+- }
+ }, {
+ .alg = "ecb(tea)",
+ .test = alg_test_skcipher,
+@@ -3576,18 +3564,6 @@ static const struct alg_test_desc alg_test_descs[] = {
+ .suite = {
+ .cipher = __VECS(serpent_xts_tv_template)
+ }
+- }, {
+- .alg = "xts(speck128)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck128_xts_tv_template)
+- }
+- }, {
+- .alg = "xts(speck64)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck64_xts_tv_template)
+- }
+ }, {
+ .alg = "xts(twofish)",
+ .test = alg_test_skcipher,
+diff --git a/crypto/testmgr.h b/crypto/testmgr.h
+index 173111c70746..0b3d7cadbe93 100644
+--- a/crypto/testmgr.h
++++ b/crypto/testmgr.h
+@@ -10198,744 +10198,6 @@ static const struct cipher_testvec sm4_tv_template[] = {
+ }
+ };
+
+-/*
+- * Speck test vectors taken from the original paper:
+- * "The Simon and Speck Families of Lightweight Block Ciphers"
+- * https://eprint.iacr.org/2013/404.pdf
+- *
+- * Note that the paper does not make byte and word order clear. But it was
+- * confirmed with the authors that the intended orders are little endian byte
+- * order and (y, x) word order. Equivalently, the printed test vectors, when
+- * looking at only the bytes (ignoring the whitespace that divides them into
+- * words), are backwards: the left-most byte is actually the one with the
+- * highest memory address, while the right-most byte is actually the one with
+- * the lowest memory address.
+- */
+-
+-static const struct cipher_testvec speck128_tv_template[] = {
+- { /* Speck128/128 */
+- .key = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
+- .klen = 16,
+- .ptext = "\x20\x6d\x61\x64\x65\x20\x69\x74"
+- "\x20\x65\x71\x75\x69\x76\x61\x6c",
+- .ctext = "\x18\x0d\x57\x5c\xdf\xfe\x60\x78"
+- "\x65\x32\x78\x79\x51\x98\x5d\xa6",
+- .len = 16,
+- }, { /* Speck128/192 */
+- .key = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17",
+- .klen = 24,
+- .ptext = "\x65\x6e\x74\x20\x74\x6f\x20\x43"
+- "\x68\x69\x65\x66\x20\x48\x61\x72",
+- .ctext = "\x86\x18\x3c\xe0\x5d\x18\xbc\xf9"
+- "\x66\x55\x13\x13\x3a\xcf\xe4\x1b",
+- .len = 16,
+- }, { /* Speck128/256 */
+- .key = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
+- .klen = 32,
+- .ptext = "\x70\x6f\x6f\x6e\x65\x72\x2e\x20"
+- "\x49\x6e\x20\x74\x68\x6f\x73\x65",
+- .ctext = "\x43\x8f\x18\x9c\x8d\xb4\xee\x4e"
+- "\x3e\xf5\xc0\x05\x04\x01\x09\x41",
+- .len = 16,
+- },
+-};
+-
+-/*
+- * Speck128-XTS test vectors, taken from the AES-XTS test vectors with the
+- * ciphertext recomputed with Speck128 as the cipher
+- */
+-static const struct cipher_testvec speck128_xts_tv_template[] = {
+- {
+- .key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .klen = 32,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ctext = "\xbe\xa0\xe7\x03\xd7\xfe\xab\x62"
+- "\x3b\x99\x4a\x64\x74\x77\xac\xed"
+- "\xd8\xf4\xa6\xcf\xae\xb9\x07\x42"
+- "\x51\xd9\xb6\x1d\xe0\x5e\xbc\x54",
+- .len = 32,
+- }, {
+- .key = "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x22\x22\x22\x22\x22\x22\x22\x22"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 32,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\xfb\x53\x81\x75\x6f\x9f\x34\xad"
+- "\x7e\x01\xed\x7b\xcc\xda\x4e\x4a"
+- "\xd4\x84\xa4\x53\xd5\x88\x73\x1b"
+- "\xfd\xcb\xae\x0d\xf3\x04\xee\xe6",
+- .len = 32,
+- }, {
+- .key = "\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8"
+- "\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
+- "\x22\x22\x22\x22\x22\x22\x22\x22"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 32,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\x21\x52\x84\x15\xd1\xf7\x21\x55"
+- "\xd9\x75\x4a\xd3\xc5\xdb\x9f\x7d"
+- "\xda\x63\xb2\xf1\x82\xb0\x89\x59"
+- "\x86\xd4\xaa\xaa\xdd\xff\x4f\x92",
+- .len = 32,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x31\x41\x59\x26\x53\x58\x97\x93"
+- "\x23\x84\x62\x64\x33\x83\x27\x95",
+- .klen = 32,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\x57\xb5\xf8\x71\x6e\x6d\xdd\x82"
+- "\x53\xd0\xed\x2d\x30\xc1\x20\xef"
+- "\x70\x67\x5e\xff\x09\x70\xbb\xc1"
+- "\x3a\x7b\x48\x26\xd9\x0b\xf4\x48"
+- "\xbe\xce\xb1\xc7\xb2\x67\xc4\xa7"
+- "\x76\xf8\x36\x30\xb7\xb4\x9a\xd9"
+- "\xf5\x9d\xd0\x7b\xc1\x06\x96\x44"
+- "\x19\xc5\x58\x84\x63\xb9\x12\x68"
+- "\x68\xc7\xaa\x18\x98\xf2\x1f\x5c"
+- "\x39\xa6\xd8\x32\x2b\xc3\x51\xfd"
+- "\x74\x79\x2e\xb4\x44\xd7\x69\xc4"
+- "\xfc\x29\xe6\xed\x26\x1e\xa6\x9d"
+- "\x1c\xbe\x00\x0e\x7f\x3a\xca\xfb"
+- "\x6d\x13\x65\xa0\xf9\x31\x12\xe2"
+- "\x26\xd1\xec\x2b\x0a\x8b\x59\x99"
+- "\xa7\x49\xa0\x0e\x09\x33\x85\x50"
+- "\xc3\x23\xca\x7a\xdd\x13\x45\x5f"
+- "\xde\x4c\xa7\xcb\x00\x8a\x66\x6f"
+- "\xa2\xb6\xb1\x2e\xe1\xa0\x18\xf6"
+- "\xad\xf3\xbd\xeb\xc7\xef\x55\x4f"
+- "\x79\x91\x8d\x36\x13\x7b\xd0\x4a"
+- "\x6c\x39\xfb\x53\xb8\x6f\x02\x51"
+- "\xa5\x20\xac\x24\x1c\x73\x59\x73"
+- "\x58\x61\x3a\x87\x58\xb3\x20\x56"
+- "\x39\x06\x2b\x4d\xd3\x20\x2b\x89"
+- "\x3f\xa2\xf0\x96\xeb\x7f\xa4\xcd"
+- "\x11\xae\xbd\xcb\x3a\xb4\xd9\x91"
+- "\x09\x35\x71\x50\x65\xac\x92\xe3"
+- "\x7b\x32\xc0\x7a\xdd\xd4\xc3\x92"
+- "\x6f\xeb\x79\xde\x6f\xd3\x25\xc9"
+- "\xcd\x63\xf5\x1e\x7a\x3b\x26\x9d"
+- "\x77\x04\x80\xa9\xbf\x38\xb5\xbd"
+- "\xb8\x05\x07\xbd\xfd\xab\x7b\xf8"
+- "\x2a\x26\xcc\x49\x14\x6d\x55\x01"
+- "\x06\x94\xd8\xb2\x2d\x53\x83\x1b"
+- "\x8f\xd4\xdd\x57\x12\x7e\x18\xba"
+- "\x8e\xe2\x4d\x80\xef\x7e\x6b\x9d"
+- "\x24\xa9\x60\xa4\x97\x85\x86\x2a"
+- "\x01\x00\x09\xf1\xcb\x4a\x24\x1c"
+- "\xd8\xf6\xe6\x5b\xe7\x5d\xf2\xc4"
+- "\x97\x1c\x10\xc6\x4d\x66\x4f\x98"
+- "\x87\x30\xac\xd5\xea\x73\x49\x10"
+- "\x80\xea\xe5\x5f\x4d\x5f\x03\x33"
+- "\x66\x02\x35\x3d\x60\x06\x36\x4f"
+- "\x14\x1c\xd8\x07\x1f\x78\xd0\xf8"
+- "\x4f\x6c\x62\x7c\x15\xa5\x7c\x28"
+- "\x7c\xcc\xeb\x1f\xd1\x07\x90\x93"
+- "\x7e\xc2\xa8\x3a\x80\xc0\xf5\x30"
+- "\xcc\x75\xcf\x16\x26\xa9\x26\x3b"
+- "\xe7\x68\x2f\x15\x21\x5b\xe4\x00"
+- "\xbd\x48\x50\xcd\x75\x70\xc4\x62"
+- "\xbb\x41\xfb\x89\x4a\x88\x3b\x3b"
+- "\x51\x66\x02\x69\x04\x97\x36\xd4"
+- "\x75\xae\x0b\xa3\x42\xf8\xca\x79"
+- "\x8f\x93\xe9\xcc\x38\xbd\xd6\xd2"
+- "\xf9\x70\x4e\xc3\x6a\x8e\x25\xbd"
+- "\xea\x15\x5a\xa0\x85\x7e\x81\x0d"
+- "\x03\xe7\x05\x39\xf5\x05\x26\xee"
+- "\xec\xaa\x1f\x3d\xc9\x98\x76\x01"
+- "\x2c\xf4\xfc\xa3\x88\x77\x38\xc4"
+- "\x50\x65\x50\x6d\x04\x1f\xdf\x5a"
+- "\xaa\xf2\x01\xa9\xc1\x8d\xee\xca"
+- "\x47\x26\xef\x39\xb8\xb4\xf2\xd1"
+- "\xd6\xbb\x1b\x2a\xc1\x34\x14\xcf",
+- .len = 512,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x62\x49\x77\x57\x24\x70\x93\x69"
+- "\x99\x59\x57\x49\x66\x96\x76\x27"
+- "\x31\x41\x59\x26\x53\x58\x97\x93"
+- "\x23\x84\x62\x64\x33\x83\x27\x95"
+- "\x02\x88\x41\x97\x16\x93\x99\x37"
+- "\x51\x05\x82\x09\x74\x94\x45\x92",
+- .klen = 64,
+- .iv = "\xff\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\xc5\x85\x2a\x4b\x73\xe4\xf6\xf1"
+- "\x7e\xf9\xf6\xe9\xa3\x73\x36\xcb"
+- "\xaa\xb6\x22\xb0\x24\x6e\x3d\x73"
+- "\x92\x99\xde\xd3\x76\xed\xcd\x63"
+- "\x64\x3a\x22\x57\xc1\x43\x49\xd4"
+- "\x79\x36\x31\x19\x62\xae\x10\x7e"
+- "\x7d\xcf\x7a\xe2\x6b\xce\x27\xfa"
+- "\xdc\x3d\xd9\x83\xd3\x42\x4c\xe0"
+- "\x1b\xd6\x1d\x1a\x6f\xd2\x03\x00"
+- "\xfc\x81\x99\x8a\x14\x62\xf5\x7e"
+- "\x0d\xe7\x12\xe8\x17\x9d\x0b\xec"
+- "\xe2\xf7\xc9\xa7\x63\xd1\x79\xb6"
+- "\x62\x62\x37\xfe\x0a\x4c\x4a\x37"
+- "\x70\xc7\x5e\x96\x5f\xbc\x8e\x9e"
+- "\x85\x3c\x4f\x26\x64\x85\xbc\x68"
+- "\xb0\xe0\x86\x5e\x26\x41\xce\x11"
+- "\x50\xda\x97\x14\xe9\x9e\xc7\x6d"
+- "\x3b\xdc\x43\xde\x2b\x27\x69\x7d"
+- "\xfc\xb0\x28\xbd\x8f\xb1\xc6\x31"
+- "\x14\x4d\xf0\x74\x37\xfd\x07\x25"
+- "\x96\x55\xe5\xfc\x9e\x27\x2a\x74"
+- "\x1b\x83\x4d\x15\x83\xac\x57\xa0"
+- "\xac\xa5\xd0\x38\xef\x19\x56\x53"
+- "\x25\x4b\xfc\xce\x04\x23\xe5\x6b"
+- "\xf6\xc6\x6c\x32\x0b\xb3\x12\xc5"
+- "\xed\x22\x34\x1c\x5d\xed\x17\x06"
+- "\x36\xa3\xe6\x77\xb9\x97\x46\xb8"
+- "\xe9\x3f\x7e\xc7\xbc\x13\x5c\xdc"
+- "\x6e\x3f\x04\x5e\xd1\x59\xa5\x82"
+- "\x35\x91\x3d\x1b\xe4\x97\x9f\x92"
+- "\x1c\x5e\x5f\x6f\x41\xd4\x62\xa1"
+- "\x8d\x39\xfc\x42\xfb\x38\x80\xb9"
+- "\x0a\xe3\xcc\x6a\x93\xd9\x7a\xb1"
+- "\xe9\x69\xaf\x0a\x6b\x75\x38\xa7"
+- "\xa1\xbf\xf7\xda\x95\x93\x4b\x78"
+- "\x19\xf5\x94\xf9\xd2\x00\x33\x37"
+- "\xcf\xf5\x9e\x9c\xf3\xcc\xa6\xee"
+- "\x42\xb2\x9e\x2c\x5f\x48\x23\x26"
+- "\x15\x25\x17\x03\x3d\xfe\x2c\xfc"
+- "\xeb\xba\xda\xe0\x00\x05\xb6\xa6"
+- "\x07\xb3\xe8\x36\x5b\xec\x5b\xbf"
+- "\xd6\x5b\x00\x74\xc6\x97\xf1\x6a"
+- "\x49\xa1\xc3\xfa\x10\x52\xb9\x14"
+- "\xad\xb7\x73\xf8\x78\x12\xc8\x59"
+- "\x17\x80\x4c\x57\x39\xf1\x6d\x80"
+- "\x25\x77\x0f\x5e\x7d\xf0\xaf\x21"
+- "\xec\xce\xb7\xc8\x02\x8a\xed\x53"
+- "\x2c\x25\x68\x2e\x1f\x85\x5e\x67"
+- "\xd1\x07\x7a\x3a\x89\x08\xe0\x34"
+- "\xdc\xdb\x26\xb4\x6b\x77\xfc\x40"
+- "\x31\x15\x72\xa0\xf0\x73\xd9\x3b"
+- "\xd5\xdb\xfe\xfc\x8f\xa9\x44\xa2"
+- "\x09\x9f\xc6\x33\xe5\xe2\x88\xe8"
+- "\xf3\xf0\x1a\xf4\xce\x12\x0f\xd6"
+- "\xf7\x36\xe6\xa4\xf4\x7a\x10\x58"
+- "\xcc\x1f\x48\x49\x65\x47\x75\xe9"
+- "\x28\xe1\x65\x7b\xf2\xc4\xb5\x07"
+- "\xf2\xec\x76\xd8\x8f\x09\xf3\x16"
+- "\xa1\x51\x89\x3b\xeb\x96\x42\xac"
+- "\x65\xe0\x67\x63\x29\xdc\xb4\x7d"
+- "\xf2\x41\x51\x6a\xcb\xde\x3c\xfb"
+- "\x66\x8d\x13\xca\xe0\x59\x2a\x00"
+- "\xc9\x53\x4c\xe6\x9e\xe2\x73\xd5"
+- "\x67\x19\xb2\xbd\x9a\x63\xd7\x5c",
+- .len = 512,
+- .also_non_np = 1,
+- .np = 3,
+- .tap = { 512 - 20, 4, 16 },
+- }
+-};
+-
+-static const struct cipher_testvec speck64_tv_template[] = {
+- { /* Speck64/96 */
+- .key = "\x00\x01\x02\x03\x08\x09\x0a\x0b"
+- "\x10\x11\x12\x13",
+- .klen = 12,
+- .ptext = "\x65\x61\x6e\x73\x20\x46\x61\x74",
+- .ctext = "\x6c\x94\x75\x41\xec\x52\x79\x9f",
+- .len = 8,
+- }, { /* Speck64/128 */
+- .key = "\x00\x01\x02\x03\x08\x09\x0a\x0b"
+- "\x10\x11\x12\x13\x18\x19\x1a\x1b",
+- .klen = 16,
+- .ptext = "\x2d\x43\x75\x74\x74\x65\x72\x3b",
+- .ctext = "\x8b\x02\x4e\x45\x48\xa5\x6f\x8c",
+- .len = 8,
+- },
+-};
+-
+-/*
+- * Speck64-XTS test vectors, taken from the AES-XTS test vectors with the
+- * ciphertext recomputed with Speck64 as the cipher, and key lengths adjusted
+- */
+-static const struct cipher_testvec speck64_xts_tv_template[] = {
+- {
+- .key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .klen = 24,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ctext = "\x84\xaf\x54\x07\x19\xd4\x7c\xa6"
+- "\xe4\xfe\xdf\xc4\x1f\x34\xc3\xc2"
+- "\x80\xf5\x72\xe7\xcd\xf0\x99\x22"
+- "\x35\xa7\x2f\x06\xef\xdc\x51\xaa",
+- .len = 32,
+- }, {
+- .key = "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 24,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\x12\x56\x73\xcd\x15\x87\xa8\x59"
+- "\xcf\x84\xae\xd9\x1c\x66\xd6\x9f"
+- "\xb3\x12\x69\x7e\x36\xeb\x52\xff"
+- "\x62\xdd\xba\x90\xb3\xe1\xee\x99",
+- .len = 32,
+- }, {
+- .key = "\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8"
+- "\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 24,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\x15\x1b\xe4\x2c\xa2\x5a\x2d\x2c"
+- "\x27\x36\xc0\xbf\x5d\xea\x36\x37"
+- "\x2d\x1a\x88\xbc\x66\xb5\xd0\x0b"
+- "\xa1\xbc\x19\xb2\x0f\x3b\x75\x34",
+- .len = 32,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x31\x41\x59\x26\x53\x58\x97\x93",
+- .klen = 24,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\xaf\xa1\x81\xa6\x32\xbb\x15\x8e"
+- "\xf8\x95\x2e\xd3\xe6\xee\x7e\x09"
+- "\x0c\x1a\xf5\x02\x97\x8b\xe3\xb3"
+- "\x11\xc7\x39\x96\xd0\x95\xf4\x56"
+- "\xf4\xdd\x03\x38\x01\x44\x2c\xcf"
+- "\x88\xae\x8e\x3c\xcd\xe7\xaa\x66"
+- "\xfe\x3d\xc6\xfb\x01\x23\x51\x43"
+- "\xd5\xd2\x13\x86\x94\x34\xe9\x62"
+- "\xf9\x89\xe3\xd1\x7b\xbe\xf8\xef"
+- "\x76\x35\x04\x3f\xdb\x23\x9d\x0b"
+- "\x85\x42\xb9\x02\xd6\xcc\xdb\x96"
+- "\xa7\x6b\x27\xb6\xd4\x45\x8f\x7d"
+- "\xae\xd2\x04\xd5\xda\xc1\x7e\x24"
+- "\x8c\x73\xbe\x48\x7e\xcf\x65\x28"
+- "\x29\xe5\xbe\x54\x30\xcb\x46\x95"
+- "\x4f\x2e\x8a\x36\xc8\x27\xc5\xbe"
+- "\xd0\x1a\xaf\xab\x26\xcd\x9e\x69"
+- "\xa1\x09\x95\x71\x26\xe9\xc4\xdf"
+- "\xe6\x31\xc3\x46\xda\xaf\x0b\x41"
+- "\x1f\xab\xb1\x8e\xd6\xfc\x0b\xb3"
+- "\x82\xc0\x37\x27\xfc\x91\xa7\x05"
+- "\xfb\xc5\xdc\x2b\x74\x96\x48\x43"
+- "\x5d\x9c\x19\x0f\x60\x63\x3a\x1f"
+- "\x6f\xf0\x03\xbe\x4d\xfd\xc8\x4a"
+- "\xc6\xa4\x81\x6d\xc3\x12\x2a\x5c"
+- "\x07\xff\xf3\x72\x74\x48\xb5\x40"
+- "\x50\xb5\xdd\x90\x43\x31\x18\x15"
+- "\x7b\xf2\xa6\xdb\x83\xc8\x4b\x4a"
+- "\x29\x93\x90\x8b\xda\x07\xf0\x35"
+- "\x6d\x90\x88\x09\x4e\x83\xf5\x5b"
+- "\x94\x12\xbb\x33\x27\x1d\x3f\x23"
+- "\x51\xa8\x7c\x07\xa2\xae\x77\xa6"
+- "\x50\xfd\xcc\xc0\x4f\x80\x7a\x9f"
+- "\x66\xdd\xcd\x75\x24\x8b\x33\xf7"
+- "\x20\xdb\x83\x9b\x4f\x11\x63\x6e"
+- "\xcf\x37\xef\xc9\x11\x01\x5c\x45"
+- "\x32\x99\x7c\x3c\x9e\x42\x89\xe3"
+- "\x70\x6d\x15\x9f\xb1\xe6\xb6\x05"
+- "\xfe\x0c\xb9\x49\x2d\x90\x6d\xcc"
+- "\x5d\x3f\xc1\xfe\x89\x0a\x2e\x2d"
+- "\xa0\xa8\x89\x3b\x73\x39\xa5\x94"
+- "\x4c\xa4\xa6\xbb\xa7\x14\x46\x89"
+- "\x10\xff\xaf\xef\xca\xdd\x4f\x80"
+- "\xb3\xdf\x3b\xab\xd4\xe5\x5a\xc7"
+- "\x33\xca\x00\x8b\x8b\x3f\xea\xec"
+- "\x68\x8a\xc2\x6d\xfd\xd4\x67\x0f"
+- "\x22\x31\xe1\x0e\xfe\x5a\x04\xd5"
+- "\x64\xa3\xf1\x1a\x76\x28\xcc\x35"
+- "\x36\xa7\x0a\x74\xf7\x1c\x44\x9b"
+- "\xc7\x1b\x53\x17\x02\xea\xd1\xad"
+- "\x13\x51\x73\xc0\xa0\xb2\x05\x32"
+- "\xa8\xa2\x37\x2e\xe1\x7a\x3a\x19"
+- "\x26\xb4\x6c\x62\x5d\xb3\x1a\x1d"
+- "\x59\xda\xee\x1a\x22\x18\xda\x0d"
+- "\x88\x0f\x55\x8b\x72\x62\xfd\xc1"
+- "\x69\x13\xcd\x0d\x5f\xc1\x09\x52"
+- "\xee\xd6\xe3\x84\x4d\xee\xf6\x88"
+- "\xaf\x83\xdc\x76\xf4\xc0\x93\x3f"
+- "\x4a\x75\x2f\xb0\x0b\x3e\xc4\x54"
+- "\x7d\x69\x8d\x00\x62\x77\x0d\x14"
+- "\xbe\x7c\xa6\x7d\xc5\x24\x4f\xf3"
+- "\x50\xf7\x5f\xf4\xc2\xca\x41\x97"
+- "\x37\xbe\x75\x74\xcd\xf0\x75\x6e"
+- "\x25\x23\x94\xbd\xda\x8d\xb0\xd4",
+- .len = 512,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x62\x49\x77\x57\x24\x70\x93\x69"
+- "\x99\x59\x57\x49\x66\x96\x76\x27",
+- .klen = 32,
+- .iv = "\xff\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\x55\xed\x71\xd3\x02\x8e\x15\x3b"
+- "\xc6\x71\x29\x2d\x3e\x89\x9f\x59"
+- "\x68\x6a\xcc\x8a\x56\x97\xf3\x95"
+- "\x4e\x51\x08\xda\x2a\xf8\x6f\x3c"
+- "\x78\x16\xea\x80\xdb\x33\x75\x94"
+- "\xf9\x29\xc4\x2b\x76\x75\x97\xc7"
+- "\xf2\x98\x2c\xf9\xff\xc8\xd5\x2b"
+- "\x18\xf1\xaf\xcf\x7c\xc5\x0b\xee"
+- "\xad\x3c\x76\x7c\xe6\x27\xa2\x2a"
+- "\xe4\x66\xe1\xab\xa2\x39\xfc\x7c"
+- "\xf5\xec\x32\x74\xa3\xb8\x03\x88"
+- "\x52\xfc\x2e\x56\x3f\xa1\xf0\x9f"
+- "\x84\x5e\x46\xed\x20\x89\xb6\x44"
+- "\x8d\xd0\xed\x54\x47\x16\xbe\x95"
+- "\x8a\xb3\x6b\x72\xc4\x32\x52\x13"
+- "\x1b\xb0\x82\xbe\xac\xf9\x70\xa6"
+- "\x44\x18\xdd\x8c\x6e\xca\x6e\x45"
+- "\x8f\x1e\x10\x07\x57\x25\x98\x7b"
+- "\x17\x8c\x78\xdd\x80\xa7\xd9\xd8"
+- "\x63\xaf\xb9\x67\x57\xfd\xbc\xdb"
+- "\x44\xe9\xc5\x65\xd1\xc7\x3b\xff"
+- "\x20\xa0\x80\x1a\xc3\x9a\xad\x5e"
+- "\x5d\x3b\xd3\x07\xd9\xf5\xfd\x3d"
+- "\x4a\x8b\xa8\xd2\x6e\x7a\x51\x65"
+- "\x6c\x8e\x95\xe0\x45\xc9\x5f\x4a"
+- "\x09\x3c\x3d\x71\x7f\x0c\x84\x2a"
+- "\xc8\x48\x52\x1a\xc2\xd5\xd6\x78"
+- "\x92\x1e\xa0\x90\x2e\xea\xf0\xf3"
+- "\xdc\x0f\xb1\xaf\x0d\x9b\x06\x2e"
+- "\x35\x10\x30\x82\x0d\xe7\xc5\x9b"
+- "\xde\x44\x18\xbd\x9f\xd1\x45\xa9"
+- "\x7b\x7a\x4a\xad\x35\x65\x27\xca"
+- "\xb2\xc3\xd4\x9b\x71\x86\x70\xee"
+- "\xf1\x89\x3b\x85\x4b\x5b\xaa\xaf"
+- "\xfc\x42\xc8\x31\x59\xbe\x16\x60"
+- "\x4f\xf9\xfa\x12\xea\xd0\xa7\x14"
+- "\xf0\x7a\xf3\xd5\x8d\xbd\x81\xef"
+- "\x52\x7f\x29\x51\x94\x20\x67\x3c"
+- "\xd1\xaf\x77\x9f\x22\x5a\x4e\x63"
+- "\xe7\xff\x73\x25\xd1\xdd\x96\x8a"
+- "\x98\x52\x6d\xf3\xac\x3e\xf2\x18"
+- "\x6d\xf6\x0a\x29\xa6\x34\x3d\xed"
+- "\xe3\x27\x0d\x9d\x0a\x02\x44\x7e"
+- "\x5a\x7e\x67\x0f\x0a\x9e\xd6\xad"
+- "\x91\xe6\x4d\x81\x8c\x5c\x59\xaa"
+- "\xfb\xeb\x56\x53\xd2\x7d\x4c\x81"
+- "\x65\x53\x0f\x41\x11\xbd\x98\x99"
+- "\xf9\xc6\xfa\x51\x2e\xa3\xdd\x8d"
+- "\x84\x98\xf9\x34\xed\x33\x2a\x1f"
+- "\x82\xed\xc1\x73\x98\xd3\x02\xdc"
+- "\xe6\xc2\x33\x1d\xa2\xb4\xca\x76"
+- "\x63\x51\x34\x9d\x96\x12\xae\xce"
+- "\x83\xc9\x76\x5e\xa4\x1b\x53\x37"
+- "\x17\xd5\xc0\x80\x1d\x62\xf8\x3d"
+- "\x54\x27\x74\xbb\x10\x86\x57\x46"
+- "\x68\xe1\xed\x14\xe7\x9d\xfc\x84"
+- "\x47\xbc\xc2\xf8\x19\x4b\x99\xcf"
+- "\x7a\xe9\xc4\xb8\x8c\x82\x72\x4d"
+- "\x7b\x4f\x38\x55\x36\x71\x64\xc1"
+- "\xfc\x5c\x75\x52\x33\x02\x18\xf8"
+- "\x17\xe1\x2b\xc2\x43\x39\xbd\x76"
+- "\x9b\x63\x76\x32\x2f\x19\x72\x10"
+- "\x9f\x21\x0c\xf1\x66\x50\x7f\xa5"
+- "\x0d\x1f\x46\xe0\xba\xd3\x2f\x3c",
+- .len = 512,
+- .also_non_np = 1,
+- .np = 3,
+- .tap = { 512 - 20, 4, 16 },
+- }
+-};
+-
+ /* Cast6 test vectors from RFC 2612 */
+ static const struct cipher_testvec cast6_tv_template[] = {
+ {
+diff --git a/drivers/acpi/acpi_lpit.c b/drivers/acpi/acpi_lpit.c
+index cf4fc0161164..e43cb71b6972 100644
+--- a/drivers/acpi/acpi_lpit.c
++++ b/drivers/acpi/acpi_lpit.c
+@@ -117,11 +117,17 @@ static void lpit_update_residency(struct lpit_residency_info *info,
+ if (!info->iomem_addr)
+ return;
+
++ if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0))
++ return;
++
+ /* Silently fail, if cpuidle attribute group is not present */
+ sysfs_add_file_to_group(&cpu_subsys.dev_root->kobj,
+ &dev_attr_low_power_idle_system_residency_us.attr,
+ "cpuidle");
+ } else if (info->gaddr.space_id == ACPI_ADR_SPACE_FIXED_HARDWARE) {
++ if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0))
++ return;
++
+ /* Silently fail, if cpuidle attribute group is not present */
+ sysfs_add_file_to_group(&cpu_subsys.dev_root->kobj,
+ &dev_attr_low_power_idle_cpu_residency_us.attr,
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index bf64cfa30feb..969bf8d515c0 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -327,9 +327,11 @@ static const struct acpi_device_id acpi_lpss_device_ids[] = {
+ { "INT33FC", },
+
+ /* Braswell LPSS devices */
++ { "80862286", LPSS_ADDR(lpss_dma_desc) },
+ { "80862288", LPSS_ADDR(bsw_pwm_dev_desc) },
+ { "8086228A", LPSS_ADDR(bsw_uart_dev_desc) },
+ { "8086228E", LPSS_ADDR(bsw_spi_dev_desc) },
++ { "808622C0", LPSS_ADDR(lpss_dma_desc) },
+ { "808622C1", LPSS_ADDR(bsw_i2c_dev_desc) },
+
+ /* Broadwell LPSS devices */
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index 449d86d39965..fc447410ae4d 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -643,7 +643,7 @@ static acpi_status __init acpi_processor_ids_walk(acpi_handle handle,
+
+ status = acpi_get_type(handle, &acpi_type);
+ if (ACPI_FAILURE(status))
+- return false;
++ return status;
+
+ switch (acpi_type) {
+ case ACPI_TYPE_PROCESSOR:
+@@ -663,11 +663,12 @@ static acpi_status __init acpi_processor_ids_walk(acpi_handle handle,
+ }
+
+ processor_validated_ids_update(uid);
+- return true;
++ return AE_OK;
+
+ err:
++ /* Exit on error, but don't abort the namespace walk */
+ acpi_handle_info(handle, "Invalid processor object\n");
+- return false;
++ return AE_OK;
+
+ }
+
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index e9fb0bf3c8d2..78f9de260d5f 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -417,6 +417,10 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
++ status = acpi_ut_add_address_range(obj_desc->region.space_id,
++ obj_desc->region.address,
++ obj_desc->region.length, node);
++
+ /* Now the address and length are valid for this opregion */
+
+ obj_desc->region.flags |= AOPOBJ_DATA_VALID;
+diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
+index 34fc2f7476ed..b0789c483b0f 100644
+--- a/drivers/acpi/acpica/psloop.c
++++ b/drivers/acpi/acpica/psloop.c
+@@ -417,6 +417,7 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
+ union acpi_parse_object *op = NULL; /* current op */
+ struct acpi_parse_state *parser_state;
+ u8 *aml_op_start = NULL;
++ u8 opcode_length;
+
+ ACPI_FUNCTION_TRACE_PTR(ps_parse_loop, walk_state);
+
+@@ -540,8 +541,19 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
+ "Skip parsing opcode %s",
+ acpi_ps_get_opcode_name
+ (walk_state->opcode)));
++
++ /*
++ * Determine the opcode length before skipping the opcode.
++ * An opcode can be 1 byte or 2 bytes in length.
++ */
++ opcode_length = 1;
++ if ((walk_state->opcode & 0xFF00) ==
++ AML_EXTENDED_OPCODE) {
++ opcode_length = 2;
++ }
+ walk_state->parser_state.aml =
+- walk_state->aml + 1;
++ walk_state->aml + opcode_length;
++
+ walk_state->parser_state.aml =
+ acpi_ps_get_next_package_end
+ (&walk_state->parser_state);
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index b072cfc5f20e..19b641208d86 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2466,7 +2466,8 @@ static int ars_get_cap(struct acpi_nfit_desc *acpi_desc,
+ return cmd_rc;
+ }
+
+-static int ars_start(struct acpi_nfit_desc *acpi_desc, struct nfit_spa *nfit_spa)
++static int ars_start(struct acpi_nfit_desc *acpi_desc,
++ struct nfit_spa *nfit_spa, enum nfit_ars_state req_type)
+ {
+ int rc;
+ int cmd_rc;
+@@ -2477,7 +2478,7 @@ static int ars_start(struct acpi_nfit_desc *acpi_desc, struct nfit_spa *nfit_spa
+ memset(&ars_start, 0, sizeof(ars_start));
+ ars_start.address = spa->address;
+ ars_start.length = spa->length;
+- if (test_bit(ARS_SHORT, &nfit_spa->ars_state))
++ if (req_type == ARS_REQ_SHORT)
+ ars_start.flags = ND_ARS_RETURN_PREV_DATA;
+ if (nfit_spa_type(spa) == NFIT_SPA_PM)
+ ars_start.type = ND_ARS_PERSISTENT;
+@@ -2534,6 +2535,15 @@ static void ars_complete(struct acpi_nfit_desc *acpi_desc,
+ struct nd_region *nd_region = nfit_spa->nd_region;
+ struct device *dev;
+
++ lockdep_assert_held(&acpi_desc->init_mutex);
++ /*
++ * Only advance the ARS state for ARS runs initiated by the
++ * kernel, ignore ARS results from BIOS initiated runs for scrub
++ * completion tracking.
++ */
++ if (acpi_desc->scrub_spa != nfit_spa)
++ return;
++
+ if ((ars_status->address >= spa->address && ars_status->address
+ < spa->address + spa->length)
+ || (ars_status->address < spa->address)) {
+@@ -2553,28 +2563,13 @@ static void ars_complete(struct acpi_nfit_desc *acpi_desc,
+ } else
+ return;
+
+- if (test_bit(ARS_DONE, &nfit_spa->ars_state))
+- return;
+-
+- if (!test_and_clear_bit(ARS_REQ, &nfit_spa->ars_state))
+- return;
+-
++ acpi_desc->scrub_spa = NULL;
+ if (nd_region) {
+ dev = nd_region_dev(nd_region);
+ nvdimm_region_notify(nd_region, NVDIMM_REVALIDATE_POISON);
+ } else
+ dev = acpi_desc->dev;
+-
+- dev_dbg(dev, "ARS: range %d %s complete\n", spa->range_index,
+- test_bit(ARS_SHORT, &nfit_spa->ars_state)
+- ? "short" : "long");
+- clear_bit(ARS_SHORT, &nfit_spa->ars_state);
+- if (test_and_clear_bit(ARS_REQ_REDO, &nfit_spa->ars_state)) {
+- set_bit(ARS_SHORT, &nfit_spa->ars_state);
+- set_bit(ARS_REQ, &nfit_spa->ars_state);
+- dev_dbg(dev, "ARS: processing scrub request received while in progress\n");
+- } else
+- set_bit(ARS_DONE, &nfit_spa->ars_state);
++ dev_dbg(dev, "ARS: range %d complete\n", spa->range_index);
+ }
+
+ static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc)
+@@ -2855,46 +2850,55 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc)
+ return 0;
+ }
+
+-static int ars_register(struct acpi_nfit_desc *acpi_desc, struct nfit_spa *nfit_spa,
+- int *query_rc)
++static int ars_register(struct acpi_nfit_desc *acpi_desc,
++ struct nfit_spa *nfit_spa)
+ {
+- int rc = *query_rc;
++ int rc;
+
+- if (no_init_ars)
++ if (no_init_ars || test_bit(ARS_FAILED, &nfit_spa->ars_state))
+ return acpi_nfit_register_region(acpi_desc, nfit_spa);
+
+- set_bit(ARS_REQ, &nfit_spa->ars_state);
+- set_bit(ARS_SHORT, &nfit_spa->ars_state);
++ set_bit(ARS_REQ_SHORT, &nfit_spa->ars_state);
++ set_bit(ARS_REQ_LONG, &nfit_spa->ars_state);
+
+- switch (rc) {
++ switch (acpi_nfit_query_poison(acpi_desc)) {
+ case 0:
+ case -EAGAIN:
+- rc = ars_start(acpi_desc, nfit_spa);
+- if (rc == -EBUSY) {
+- *query_rc = rc;
++ rc = ars_start(acpi_desc, nfit_spa, ARS_REQ_SHORT);
++ /* shouldn't happen, try again later */
++ if (rc == -EBUSY)
+ break;
+- } else if (rc == 0) {
+- rc = acpi_nfit_query_poison(acpi_desc);
+- } else {
++ if (rc) {
+ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ break;
+ }
+- if (rc == -EAGAIN)
+- clear_bit(ARS_SHORT, &nfit_spa->ars_state);
+- else if (rc == 0)
+- ars_complete(acpi_desc, nfit_spa);
++ clear_bit(ARS_REQ_SHORT, &nfit_spa->ars_state);
++ rc = acpi_nfit_query_poison(acpi_desc);
++ if (rc)
++ break;
++ acpi_desc->scrub_spa = nfit_spa;
++ ars_complete(acpi_desc, nfit_spa);
++ /*
++ * If ars_complete() says we didn't complete the
++ * short scrub, we'll try again with a long
++ * request.
++ */
++ acpi_desc->scrub_spa = NULL;
+ break;
+ case -EBUSY:
++ case -ENOMEM:
+ case -ENOSPC:
++ /*
++ * BIOS was using ARS, wait for it to complete (or
++ * resources to become available) and then perform our
++ * own scrubs.
++ */
+ break;
+ default:
+ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ break;
+ }
+
+- if (test_and_clear_bit(ARS_DONE, &nfit_spa->ars_state))
+- set_bit(ARS_REQ, &nfit_spa->ars_state);
+-
+ return acpi_nfit_register_region(acpi_desc, nfit_spa);
+ }
+
+@@ -2916,6 +2920,8 @@ static unsigned int __acpi_nfit_scrub(struct acpi_nfit_desc *acpi_desc,
+ struct device *dev = acpi_desc->dev;
+ struct nfit_spa *nfit_spa;
+
++ lockdep_assert_held(&acpi_desc->init_mutex);
++
+ if (acpi_desc->cancel)
+ return 0;
+
+@@ -2939,21 +2945,49 @@ static unsigned int __acpi_nfit_scrub(struct acpi_nfit_desc *acpi_desc,
+
+ ars_complete_all(acpi_desc);
+ list_for_each_entry(nfit_spa, &acpi_desc->spas, list) {
++ enum nfit_ars_state req_type;
++ int rc;
++
+ if (test_bit(ARS_FAILED, &nfit_spa->ars_state))
+ continue;
+- if (test_bit(ARS_REQ, &nfit_spa->ars_state)) {
+- int rc = ars_start(acpi_desc, nfit_spa);
+-
+- clear_bit(ARS_DONE, &nfit_spa->ars_state);
+- dev = nd_region_dev(nfit_spa->nd_region);
+- dev_dbg(dev, "ARS: range %d ARS start (%d)\n",
+- nfit_spa->spa->range_index, rc);
+- if (rc == 0 || rc == -EBUSY)
+- return 1;
+- dev_err(dev, "ARS: range %d ARS failed (%d)\n",
+- nfit_spa->spa->range_index, rc);
+- set_bit(ARS_FAILED, &nfit_spa->ars_state);
++
++ /* prefer short ARS requests first */
++ if (test_bit(ARS_REQ_SHORT, &nfit_spa->ars_state))
++ req_type = ARS_REQ_SHORT;
++ else if (test_bit(ARS_REQ_LONG, &nfit_spa->ars_state))
++ req_type = ARS_REQ_LONG;
++ else
++ continue;
++ rc = ars_start(acpi_desc, nfit_spa, req_type);
++
++ dev = nd_region_dev(nfit_spa->nd_region);
++ dev_dbg(dev, "ARS: range %d ARS start %s (%d)\n",
++ nfit_spa->spa->range_index,
++ req_type == ARS_REQ_SHORT ? "short" : "long",
++ rc);
++ /*
++ * Hmm, we raced someone else starting ARS? Try again in
++ * a bit.
++ */
++ if (rc == -EBUSY)
++ return 1;
++ if (rc == 0) {
++ dev_WARN_ONCE(dev, acpi_desc->scrub_spa,
++ "scrub start while range %d active\n",
++ acpi_desc->scrub_spa->spa->range_index);
++ clear_bit(req_type, &nfit_spa->ars_state);
++ acpi_desc->scrub_spa = nfit_spa;
++ /*
++ * Consider this spa last for future scrub
++ * requests
++ */
++ list_move_tail(&nfit_spa->list, &acpi_desc->spas);
++ return 1;
+ }
++
++ dev_err(dev, "ARS: range %d ARS failed (%d)\n",
++ nfit_spa->spa->range_index, rc);
++ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ }
+ return 0;
+ }
+@@ -3009,6 +3043,7 @@ static void acpi_nfit_init_ars(struct acpi_nfit_desc *acpi_desc,
+ struct nd_cmd_ars_cap ars_cap;
+ int rc;
+
++ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ memset(&ars_cap, 0, sizeof(ars_cap));
+ rc = ars_get_cap(acpi_desc, &ars_cap, nfit_spa);
+ if (rc < 0)
+@@ -3025,16 +3060,14 @@ static void acpi_nfit_init_ars(struct acpi_nfit_desc *acpi_desc,
+ nfit_spa->clear_err_unit = ars_cap.clear_err_unit;
+ acpi_desc->max_ars = max(nfit_spa->max_ars, acpi_desc->max_ars);
+ clear_bit(ARS_FAILED, &nfit_spa->ars_state);
+- set_bit(ARS_REQ, &nfit_spa->ars_state);
+ }
+
+ static int acpi_nfit_register_regions(struct acpi_nfit_desc *acpi_desc)
+ {
+ struct nfit_spa *nfit_spa;
+- int rc, query_rc;
++ int rc;
+
+ list_for_each_entry(nfit_spa, &acpi_desc->spas, list) {
+- set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ switch (nfit_spa_type(nfit_spa->spa)) {
+ case NFIT_SPA_VOLATILE:
+ case NFIT_SPA_PM:
+@@ -3043,20 +3076,12 @@ static int acpi_nfit_register_regions(struct acpi_nfit_desc *acpi_desc)
+ }
+ }
+
+- /*
+- * Reap any results that might be pending before starting new
+- * short requests.
+- */
+- query_rc = acpi_nfit_query_poison(acpi_desc);
+- if (query_rc == 0)
+- ars_complete_all(acpi_desc);
+-
+ list_for_each_entry(nfit_spa, &acpi_desc->spas, list)
+ switch (nfit_spa_type(nfit_spa->spa)) {
+ case NFIT_SPA_VOLATILE:
+ case NFIT_SPA_PM:
+ /* register regions and kick off initial ARS run */
+- rc = ars_register(acpi_desc, nfit_spa, &query_rc);
++ rc = ars_register(acpi_desc, nfit_spa);
+ if (rc)
+ return rc;
+ break;
+@@ -3251,7 +3276,8 @@ static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
+ return 0;
+ }
+
+-int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc, unsigned long flags)
++int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc,
++ enum nfit_ars_state req_type)
+ {
+ struct device *dev = acpi_desc->dev;
+ int scheduled = 0, busy = 0;
+@@ -3271,14 +3297,10 @@ int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc, unsigned long flags)
+ if (test_bit(ARS_FAILED, &nfit_spa->ars_state))
+ continue;
+
+- if (test_and_set_bit(ARS_REQ, &nfit_spa->ars_state)) {
++ if (test_and_set_bit(req_type, &nfit_spa->ars_state))
+ busy++;
+- set_bit(ARS_REQ_REDO, &nfit_spa->ars_state);
+- } else {
+- if (test_bit(ARS_SHORT, &flags))
+- set_bit(ARS_SHORT, &nfit_spa->ars_state);
++ else
+ scheduled++;
+- }
+ }
+ if (scheduled) {
+ sched_ars(acpi_desc);
+@@ -3464,10 +3486,11 @@ static void acpi_nfit_update_notify(struct device *dev, acpi_handle handle)
+ static void acpi_nfit_uc_error_notify(struct device *dev, acpi_handle handle)
+ {
+ struct acpi_nfit_desc *acpi_desc = dev_get_drvdata(dev);
+- unsigned long flags = (acpi_desc->scrub_mode == HW_ERROR_SCRUB_ON) ?
+- 0 : 1 << ARS_SHORT;
+
+- acpi_nfit_ars_rescan(acpi_desc, flags);
++ if (acpi_desc->scrub_mode == HW_ERROR_SCRUB_ON)
++ acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG);
++ else
++ acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_SHORT);
+ }
+
+ void __acpi_nfit_notify(struct device *dev, acpi_handle handle, u32 event)
+diff --git a/drivers/acpi/nfit/nfit.h b/drivers/acpi/nfit/nfit.h
+index d1274ea2d251..02c10de50386 100644
+--- a/drivers/acpi/nfit/nfit.h
++++ b/drivers/acpi/nfit/nfit.h
+@@ -118,10 +118,8 @@ enum nfit_dimm_notifiers {
+ };
+
+ enum nfit_ars_state {
+- ARS_REQ,
+- ARS_REQ_REDO,
+- ARS_DONE,
+- ARS_SHORT,
++ ARS_REQ_SHORT,
++ ARS_REQ_LONG,
+ ARS_FAILED,
+ };
+
+@@ -198,6 +196,7 @@ struct acpi_nfit_desc {
+ struct device *dev;
+ u8 ars_start_flags;
+ struct nd_cmd_ars_status *ars_status;
++ struct nfit_spa *scrub_spa;
+ struct delayed_work dwork;
+ struct list_head list;
+ struct kernfs_node *scrub_count_state;
+@@ -252,7 +251,8 @@ struct nfit_blk {
+
+ extern struct list_head acpi_descs;
+ extern struct mutex acpi_desc_lock;
+-int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc, unsigned long flags);
++int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc,
++ enum nfit_ars_state req_type);
+
+ #ifdef CONFIG_X86_MCE
+ void nfit_mce_register(void);
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index 8df9abfa947b..ed73f6fb0779 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -617,15 +617,18 @@ void acpi_os_stall(u32 us)
+ }
+
+ /*
+- * Support ACPI 3.0 AML Timer operand
+- * Returns 64-bit free-running, monotonically increasing timer
+- * with 100ns granularity
++ * Support ACPI 3.0 AML Timer operand. Returns a 64-bit free-running,
++ * monotonically increasing timer with 100ns granularity. Do not use
++ * ktime_get() to implement this function because this function may get
++ * called after timekeeping has been suspended. Note: calling this function
++ * after timekeeping has been suspended may lead to unexpected results
++ * because when timekeeping is suspended the jiffies counter is not
++ * incremented. See also timekeeping_suspend().
+ */
+ u64 acpi_os_get_timer(void)
+ {
+- u64 time_ns = ktime_to_ns(ktime_get());
+- do_div(time_ns, 100);
+- return time_ns;
++ return (get_jiffies_64() - INITIAL_JIFFIES) *
++ (ACPI_100NSEC_PER_SEC / HZ);
+ }
+
+ acpi_status acpi_os_read_port(acpi_io_address port, u32 * value, u32 width)
+diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c
+index d1e26cb599bf..da031b1df6f5 100644
+--- a/drivers/acpi/pptt.c
++++ b/drivers/acpi/pptt.c
+@@ -338,9 +338,6 @@ static struct acpi_pptt_cache *acpi_find_cache_node(struct acpi_table_header *ta
+ return found;
+ }
+
+-/* total number of attributes checked by the properties code */
+-#define PPTT_CHECKED_ATTRIBUTES 4
+-
+ /**
+ * update_cache_properties() - Update cacheinfo for the given processor
+ * @this_leaf: Kernel cache info structure being updated
+@@ -357,25 +354,15 @@ static void update_cache_properties(struct cacheinfo *this_leaf,
+ struct acpi_pptt_cache *found_cache,
+ struct acpi_pptt_processor *cpu_node)
+ {
+- int valid_flags = 0;
+-
+ this_leaf->fw_token = cpu_node;
+- if (found_cache->flags & ACPI_PPTT_SIZE_PROPERTY_VALID) {
++ if (found_cache->flags & ACPI_PPTT_SIZE_PROPERTY_VALID)
+ this_leaf->size = found_cache->size;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_LINE_SIZE_VALID) {
++ if (found_cache->flags & ACPI_PPTT_LINE_SIZE_VALID)
+ this_leaf->coherency_line_size = found_cache->line_size;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_NUMBER_OF_SETS_VALID) {
++ if (found_cache->flags & ACPI_PPTT_NUMBER_OF_SETS_VALID)
+ this_leaf->number_of_sets = found_cache->number_of_sets;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_ASSOCIATIVITY_VALID) {
++ if (found_cache->flags & ACPI_PPTT_ASSOCIATIVITY_VALID)
+ this_leaf->ways_of_associativity = found_cache->associativity;
+- valid_flags++;
+- }
+ if (found_cache->flags & ACPI_PPTT_WRITE_POLICY_VALID) {
+ switch (found_cache->attributes & ACPI_PPTT_MASK_WRITE_POLICY) {
+ case ACPI_PPTT_CACHE_POLICY_WT:
+@@ -402,11 +389,17 @@ static void update_cache_properties(struct cacheinfo *this_leaf,
+ }
+ }
+ /*
+- * If the above flags are valid, and the cache type is NOCACHE
+- * update the cache type as well.
++ * If cache type is NOCACHE, then the cache hasn't been specified
++ * via other mechanisms. Update the type if a cache type has been
++ * provided.
++ *
++ * Note, we assume such caches are unified based on conventional system
++ * design and known examples. Significant work is required elsewhere to
++ * fully support data/instruction only type caches which are only
++ * specified in PPTT.
+ */
+ if (this_leaf->type == CACHE_TYPE_NOCACHE &&
+- valid_flags == PPTT_CHECKED_ATTRIBUTES)
++ found_cache->flags & ACPI_PPTT_CACHE_TYPE_VALID)
+ this_leaf->type = CACHE_TYPE_UNIFIED;
+ }
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index a9dd4ea7467d..6e594644cb1d 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4553,6 +4553,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ /* These specific Samsung models/firmware-revs do not handle LPM well */
+ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
+ { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM, },
++ { "SAMSUNG MZ7TD256HAFV-000L9", "DXT02L5Q", ATA_HORKAGE_NOLPM, },
+
+ /* devices that don't properly handle queued TRIM commands */
+ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
+index dfb2c2622e5a..822e3060d834 100644
+--- a/drivers/block/ataflop.c
++++ b/drivers/block/ataflop.c
+@@ -1935,6 +1935,11 @@ static int __init atari_floppy_init (void)
+ unit[i].disk = alloc_disk(1);
+ if (!unit[i].disk)
+ goto Enomem;
++
++ unit[i].disk->queue = blk_init_queue(do_fd_request,
++ &ataflop_lock);
++ if (!unit[i].disk->queue)
++ goto Enomem;
+ }
+
+ if (UseTrackbuffer < 0)
+@@ -1966,10 +1971,6 @@ static int __init atari_floppy_init (void)
+ sprintf(unit[i].disk->disk_name, "fd%d", i);
+ unit[i].disk->fops = &floppy_fops;
+ unit[i].disk->private_data = &unit[i];
+- unit[i].disk->queue = blk_init_queue(do_fd_request,
+- &ataflop_lock);
+- if (!unit[i].disk->queue)
+- goto Enomem;
+ set_capacity(unit[i].disk, MAX_DISK_SIZE * 2);
+ add_disk(unit[i].disk);
+ }
+@@ -1984,13 +1985,17 @@ static int __init atari_floppy_init (void)
+
+ return 0;
+ Enomem:
+- while (i--) {
+- struct request_queue *q = unit[i].disk->queue;
++ do {
++ struct gendisk *disk = unit[i].disk;
+
+- put_disk(unit[i].disk);
+- if (q)
+- blk_cleanup_queue(q);
+- }
++ if (disk) {
++ if (disk->queue) {
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++ }
++ put_disk(unit[i].disk);
++ }
++ } while (i--);
+
+ unregister_blkdev(FLOPPY_MAJOR, "fd");
+ return -ENOMEM;
+diff --git a/drivers/block/swim.c b/drivers/block/swim.c
+index 0e31884a9519..cbe909c51847 100644
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -887,8 +887,17 @@ static int swim_floppy_init(struct swim_priv *swd)
+
+ exit_put_disks:
+ unregister_blkdev(FLOPPY_MAJOR, "fd");
+- while (drive--)
+- put_disk(swd->unit[drive].disk);
++ do {
++ struct gendisk *disk = swd->unit[drive].disk;
++
++ if (disk) {
++ if (disk->queue) {
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++ }
++ put_disk(disk);
++ }
++ } while (drive--);
+ return err;
+ }
+
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 429d20131c7e..3e905da33bcb 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1919,6 +1919,7 @@ static int negotiate_mq(struct blkfront_info *info)
+ GFP_KERNEL);
+ if (!info->rinfo) {
+ xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
++ info->nr_rings = 0;
+ return -ENOMEM;
+ }
+
+@@ -2493,6 +2494,9 @@ static int blkfront_remove(struct xenbus_device *xbdev)
+
+ dev_dbg(&xbdev->dev, "%s removed", xbdev->nodename);
+
++ if (!info)
++ return 0;
++
+ blkif_free(info, 0);
+
+ mutex_lock(&info->mutex);
+diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
+index 99cde1f9467d..e3e4d929e74f 100644
+--- a/drivers/bluetooth/btbcm.c
++++ b/drivers/bluetooth/btbcm.c
+@@ -324,6 +324,7 @@ static const struct bcm_subver_table bcm_uart_subver_table[] = {
+ { 0x4103, "BCM4330B1" }, /* 002.001.003 */
+ { 0x410e, "BCM43341B0" }, /* 002.001.014 */
+ { 0x4406, "BCM4324B3" }, /* 002.004.006 */
++ { 0x6109, "BCM4335C0" }, /* 003.001.009 */
+ { 0x610c, "BCM4354" }, /* 003.001.012 */
+ { 0x2122, "BCM4343A0" }, /* 001.001.034 */
+ { 0x2209, "BCM43430A1" }, /* 001.002.009 */
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 2fee65886d50..f0d593c3fa72 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -167,7 +167,7 @@ struct qca_serdev {
+ };
+
+ static int qca_power_setup(struct hci_uart *hu, bool on);
+-static void qca_power_shutdown(struct hci_dev *hdev);
++static void qca_power_shutdown(struct hci_uart *hu);
+
+ static void __serial_clock_on(struct tty_struct *tty)
+ {
+@@ -609,7 +609,7 @@ static int qca_close(struct hci_uart *hu)
+ if (hu->serdev) {
+ qcadev = serdev_device_get_drvdata(hu->serdev);
+ if (qcadev->btsoc_type == QCA_WCN3990)
+- qca_power_shutdown(hu->hdev);
++ qca_power_shutdown(hu);
+ else
+ gpiod_set_value_cansleep(qcadev->bt_en, 0);
+
+@@ -1232,12 +1232,15 @@ static const struct qca_vreg_data qca_soc_data = {
+ .num_vregs = 4,
+ };
+
+-static void qca_power_shutdown(struct hci_dev *hdev)
++static void qca_power_shutdown(struct hci_uart *hu)
+ {
+- struct hci_uart *hu = hci_get_drvdata(hdev);
++ struct serdev_device *serdev = hu->serdev;
++ unsigned char cmd = QCA_WCN3990_POWEROFF_PULSE;
+
+ host_set_baudrate(hu, 2400);
+- qca_send_power_pulse(hdev, QCA_WCN3990_POWEROFF_PULSE);
++ hci_uart_set_flow_control(hu, true);
++ serdev_device_write_buf(serdev, &cmd, sizeof(cmd));
++ hci_uart_set_flow_control(hu, false);
+ qca_power_setup(hu, false);
+ }
+
+@@ -1413,7 +1416,7 @@ static void qca_serdev_remove(struct serdev_device *serdev)
+ struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
+
+ if (qcadev->btsoc_type == QCA_WCN3990)
+- qca_power_shutdown(qcadev->serdev_hu.hdev);
++ qca_power_shutdown(&qcadev->serdev_hu);
+ else
+ clk_disable_unprepare(qcadev->susclk);
+
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 29e67a80fb20..9b786726e426 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -606,8 +606,9 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+ ssif_info->waiting_alert = true;
+ ssif_info->rtc_us_timer = SSIF_MSG_USEC;
+- mod_timer(&ssif_info->retry_timer,
+- jiffies + SSIF_MSG_JIFFIES);
++ if (!ssif_info->stopping)
++ mod_timer(&ssif_info->retry_timer,
++ jiffies + SSIF_MSG_JIFFIES);
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ return;
+ }
+@@ -939,8 +940,9 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
+ ssif_info->waiting_alert = true;
+ ssif_info->retries_left = SSIF_RECV_RETRIES;
+ ssif_info->rtc_us_timer = SSIF_MSG_PART_USEC;
+- mod_timer(&ssif_info->retry_timer,
+- jiffies + SSIF_MSG_PART_JIFFIES);
++ if (!ssif_info->stopping)
++ mod_timer(&ssif_info->retry_timer,
++ jiffies + SSIF_MSG_PART_JIFFIES);
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ }
+ }
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 1a803b0cf980..7d958ff426e0 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -663,7 +663,8 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_space *space,
+ return len;
+
+ err = be32_to_cpu(header->return_code);
+- if (err != 0 && desc)
++ if (err != 0 && err != TPM_ERR_DISABLED && err != TPM_ERR_DEACTIVATED
++ && desc)
+ dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err,
+ desc);
+ if (err)
+@@ -1321,7 +1322,8 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max)
+ }
+
+ rlength = be32_to_cpu(tpm_cmd.header.out.length);
+- if (rlength < offsetof(struct tpm_getrandom_out, rng_data) +
++ if (rlength < TPM_HEADER_SIZE +
++ offsetof(struct tpm_getrandom_out, rng_data) +
+ recd) {
+ total = -EFAULT;
+ break;
+diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
+index c31b490bd41d..3acf4fd4e5a5 100644
+--- a/drivers/char/tpm/tpm2-cmd.c
++++ b/drivers/char/tpm/tpm2-cmd.c
+@@ -329,7 +329,9 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max)
+ &buf.data[TPM_HEADER_SIZE];
+ recd = min_t(u32, be16_to_cpu(out->size), num_bytes);
+ if (tpm_buf_length(&buf) <
+- offsetof(struct tpm2_get_random_out, buffer) + recd) {
++ TPM_HEADER_SIZE +
++ offsetof(struct tpm2_get_random_out, buffer) +
++ recd) {
+ err = -EFAULT;
+ goto out;
+ }
+diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c
+index 911475d36800..b150f87f38f5 100644
+--- a/drivers/char/tpm/xen-tpmfront.c
++++ b/drivers/char/tpm/xen-tpmfront.c
+@@ -264,7 +264,7 @@ static int setup_ring(struct xenbus_device *dev, struct tpm_private *priv)
+ return -ENOMEM;
+ }
+
+- rv = xenbus_grant_ring(dev, &priv->shr, 1, &gref);
++ rv = xenbus_grant_ring(dev, priv->shr, 1, &gref);
+ if (rv < 0)
+ return rv;
+
+diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
+index 0a9ebf00be46..e58bfcb1169e 100644
+--- a/drivers/cpufreq/cpufreq-dt.c
++++ b/drivers/cpufreq/cpufreq-dt.c
+@@ -32,6 +32,7 @@ struct private_data {
+ struct device *cpu_dev;
+ struct thermal_cooling_device *cdev;
+ const char *reg_name;
++ bool have_static_opps;
+ };
+
+ static struct freq_attr *cpufreq_dt_attr[] = {
+@@ -204,6 +205,15 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+ }
+ }
+
++ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++ if (!priv) {
++ ret = -ENOMEM;
++ goto out_put_regulator;
++ }
++
++ priv->reg_name = name;
++ priv->opp_table = opp_table;
++
+ /*
+ * Initialize OPP tables for all policy->cpus. They will be shared by
+ * all CPUs which have marked their CPUs shared with OPP bindings.
+@@ -214,7 +224,8 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+ *
+ * OPPs might be populated at runtime, don't check for error here
+ */
+- dev_pm_opp_of_cpumask_add_table(policy->cpus);
++ if (!dev_pm_opp_of_cpumask_add_table(policy->cpus))
++ priv->have_static_opps = true;
+
+ /*
+ * But we need OPP table to function so if it is not there let's
+@@ -240,19 +251,10 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+ __func__, ret);
+ }
+
+- priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+- if (!priv) {
+- ret = -ENOMEM;
+- goto out_free_opp;
+- }
+-
+- priv->reg_name = name;
+- priv->opp_table = opp_table;
+-
+ ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
+ if (ret) {
+ dev_err(cpu_dev, "failed to init cpufreq table: %d\n", ret);
+- goto out_free_priv;
++ goto out_free_opp;
+ }
+
+ priv->cpu_dev = cpu_dev;
+@@ -282,10 +284,11 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+
+ out_free_cpufreq_table:
+ dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
+-out_free_priv:
+- kfree(priv);
+ out_free_opp:
+- dev_pm_opp_of_cpumask_remove_table(policy->cpus);
++ if (priv->have_static_opps)
++ dev_pm_opp_of_cpumask_remove_table(policy->cpus);
++ kfree(priv);
++out_put_regulator:
+ if (name)
+ dev_pm_opp_put_regulators(opp_table);
+ out_put_clk:
+@@ -300,7 +303,8 @@ static int cpufreq_exit(struct cpufreq_policy *policy)
+
+ cpufreq_cooling_unregister(priv->cdev);
+ dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
+- dev_pm_opp_of_cpumask_remove_table(policy->related_cpus);
++ if (priv->have_static_opps)
++ dev_pm_opp_of_cpumask_remove_table(policy->related_cpus);
+ if (priv->reg_name)
+ dev_pm_opp_put_regulators(priv->opp_table);
+
+diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
+index f20f20a77d4d..4268f87e99fc 100644
+--- a/drivers/cpufreq/cpufreq_conservative.c
++++ b/drivers/cpufreq/cpufreq_conservative.c
+@@ -80,8 +80,10 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
+ * changed in the meantime, so fall back to current frequency in that
+ * case.
+ */
+- if (requested_freq > policy->max || requested_freq < policy->min)
++ if (requested_freq > policy->max || requested_freq < policy->min) {
+ requested_freq = policy->cur;
++ dbs_info->requested_freq = requested_freq;
++ }
+
+ freq_step = get_freq_step(cs_tuners, policy);
+
+@@ -92,7 +94,7 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
+ if (policy_dbs->idle_periods < UINT_MAX) {
+ unsigned int freq_steps = policy_dbs->idle_periods * freq_step;
+
+- if (requested_freq > freq_steps)
++ if (requested_freq > policy->min + freq_steps)
+ requested_freq -= freq_steps;
+ else
+ requested_freq = policy->min;
+diff --git a/drivers/crypto/caam/regs.h b/drivers/crypto/caam/regs.h
+index 4fb91ba39c36..ce3f9ad7120f 100644
+--- a/drivers/crypto/caam/regs.h
++++ b/drivers/crypto/caam/regs.h
+@@ -70,22 +70,22 @@
+ extern bool caam_little_end;
+ extern bool caam_imx;
+
+-#define caam_to_cpu(len) \
+-static inline u##len caam##len ## _to_cpu(u##len val) \
+-{ \
+- if (caam_little_end) \
+- return le##len ## _to_cpu(val); \
+- else \
+- return be##len ## _to_cpu(val); \
++#define caam_to_cpu(len) \
++static inline u##len caam##len ## _to_cpu(u##len val) \
++{ \
++ if (caam_little_end) \
++ return le##len ## _to_cpu((__force __le##len)val); \
++ else \
++ return be##len ## _to_cpu((__force __be##len)val); \
+ }
+
+-#define cpu_to_caam(len) \
+-static inline u##len cpu_to_caam##len(u##len val) \
+-{ \
+- if (caam_little_end) \
+- return cpu_to_le##len(val); \
+- else \
+- return cpu_to_be##len(val); \
++#define cpu_to_caam(len) \
++static inline u##len cpu_to_caam##len(u##len val) \
++{ \
++ if (caam_little_end) \
++ return (__force u##len)cpu_to_le##len(val); \
++ else \
++ return (__force u##len)cpu_to_be##len(val); \
+ }
+
+ caam_to_cpu(16)
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index 85820a2d69d4..987899610b46 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -761,6 +761,11 @@ static int jz4780_dma_probe(struct platform_device *pdev)
+ struct resource *res;
+ int i, ret;
+
++ if (!dev->of_node) {
++ dev_err(dev, "This driver must be probed from devicetree\n");
++ return -EINVAL;
++ }
++
+ jzdma = devm_kzalloc(dev, sizeof(*jzdma), GFP_KERNEL);
+ if (!jzdma)
+ return -ENOMEM;
+diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
+index 4fa4c06c9edb..21a5708985bc 100644
+--- a/drivers/dma/ioat/init.c
++++ b/drivers/dma/ioat/init.c
+@@ -1205,8 +1205,15 @@ static void ioat_shutdown(struct pci_dev *pdev)
+
+ spin_lock_bh(&ioat_chan->prep_lock);
+ set_bit(IOAT_CHAN_DOWN, &ioat_chan->state);
+- del_timer_sync(&ioat_chan->timer);
+ spin_unlock_bh(&ioat_chan->prep_lock);
++ /*
++ * Synchronization rule for del_timer_sync():
++ * - The caller must not hold locks which would prevent
++ * completion of the timer's handler.
++ * So prep_lock cannot be held before calling it.
++ */
++ del_timer_sync(&ioat_chan->timer);
++
+ /* this should quiesce then reset */
+ ioat_reset_hw(ioat_chan);
+ }
+diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
+index 4cf0d4d0cecf..25610286979f 100644
+--- a/drivers/dma/ppc4xx/adma.c
++++ b/drivers/dma/ppc4xx/adma.c
+@@ -4360,7 +4360,7 @@ static ssize_t enable_store(struct device_driver *dev, const char *buf,
+ }
+ static DRIVER_ATTR_RW(enable);
+
+-static ssize_t poly_store(struct device_driver *dev, char *buf)
++static ssize_t poly_show(struct device_driver *dev, char *buf)
+ {
+ ssize_t size = 0;
+ u32 reg;
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 18aeabb1d5ee..e2addb2bca29 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2200,6 +2200,15 @@ static struct amd64_family_type family_types[] = {
+ .dbam_to_cs = f17_base_addr_to_cs_size,
+ }
+ },
++ [F17_M10H_CPUS] = {
++ .ctl_name = "F17h_M10h",
++ .f0_id = PCI_DEVICE_ID_AMD_17H_M10H_DF_F0,
++ .f6_id = PCI_DEVICE_ID_AMD_17H_M10H_DF_F6,
++ .ops = {
++ .early_channel_count = f17_early_channel_count,
++ .dbam_to_cs = f17_base_addr_to_cs_size,
++ }
++ },
+ };
+
+ /*
+@@ -3188,6 +3197,11 @@ static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt)
+ break;
+
+ case 0x17:
++ if (pvt->model >= 0x10 && pvt->model <= 0x2f) {
++ fam_type = &family_types[F17_M10H_CPUS];
++ pvt->ops = &family_types[F17_M10H_CPUS].ops;
++ break;
++ }
+ fam_type = &family_types[F17_CPUS];
+ pvt->ops = &family_types[F17_CPUS].ops;
+ break;
+diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
+index 1d4b74e9a037..4242f8e39c18 100644
+--- a/drivers/edac/amd64_edac.h
++++ b/drivers/edac/amd64_edac.h
+@@ -115,6 +115,8 @@
+ #define PCI_DEVICE_ID_AMD_16H_M30H_NB_F2 0x1582
+ #define PCI_DEVICE_ID_AMD_17H_DF_F0 0x1460
+ #define PCI_DEVICE_ID_AMD_17H_DF_F6 0x1466
++#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F0 0x15e8
++#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F6 0x15ee
+
+ /*
+ * Function 1 - Address Map
+@@ -281,6 +283,7 @@ enum amd_families {
+ F16_CPUS,
+ F16_M30H_CPUS,
+ F17_CPUS,
++ F17_M10H_CPUS,
+ NUM_FAMILIES,
+ };
+
+diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
+index 8e120bf60624..f1d19504a028 100644
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -1711,6 +1711,7 @@ static void i7core_mce_output_error(struct mem_ctl_info *mci,
+ u32 errnum = find_first_bit(&error, 32);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv)
+ tp_event = HW_EVENT_ERR_FATAL;
+ else
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 07726fb00321..72cea3cb8622 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -2888,6 +2888,7 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
+ recoverable = GET_BITFIELD(m->status, 56, 56);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv) {
+ type = "FATAL";
+ tp_event = HW_EVENT_ERR_FATAL;
+diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
+index fae095162c01..4ba92f1dd0f7 100644
+--- a/drivers/edac/skx_edac.c
++++ b/drivers/edac/skx_edac.c
+@@ -668,7 +668,7 @@ sad_found:
+ break;
+ case 2:
+ lchan = (addr >> shift) % 2;
+- lchan = (lchan << 1) | ~lchan;
++ lchan = (lchan << 1) | !lchan;
+ break;
+ case 3:
+ lchan = ((addr >> shift) % 2) << 1;
+@@ -959,6 +959,7 @@ static void skx_mce_output_error(struct mem_ctl_info *mci,
+ recoverable = GET_BITFIELD(m->status, 56, 56);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv) {
+ type = "FATAL";
+ tp_event = HW_EVENT_ERR_FATAL;
+diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c
+index 19db5709ae28..898bb9abc41f 100644
+--- a/drivers/firmware/google/coreboot_table.c
++++ b/drivers/firmware/google/coreboot_table.c
+@@ -110,7 +110,8 @@ int coreboot_table_init(struct device *dev, void __iomem *ptr)
+
+ if (strncmp(header.signature, "LBIO", sizeof(header.signature))) {
+ pr_warn("coreboot_table: coreboot table missing or corrupt!\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto out;
+ }
+
+ ptr_entry = (void *)ptr_header + header.header_bytes;
+@@ -137,7 +138,8 @@ int coreboot_table_init(struct device *dev, void __iomem *ptr)
+
+ ptr_entry += entry.size;
+ }
+-
++out:
++ iounmap(ptr);
+ return ret;
+ }
+ EXPORT_SYMBOL(coreboot_table_init);
+@@ -146,7 +148,6 @@ int coreboot_table_exit(void)
+ {
+ if (ptr_header) {
+ bus_unregister(&coreboot_bus_type);
+- iounmap(ptr_header);
+ ptr_header = NULL;
+ }
+
+diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c
+index 16c7f9f49416..af936dcca659 100644
+--- a/drivers/gpio/gpio-brcmstb.c
++++ b/drivers/gpio/gpio-brcmstb.c
+@@ -664,6 +664,18 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
+ struct brcmstb_gpio_bank *bank;
+ struct gpio_chip *gc;
+
++ /*
++ * If bank_width is 0, then there is an empty bank in the
++ * register block. Special handling for this case.
++ */
++ if (bank_width == 0) {
++ dev_dbg(dev, "Width 0 found: Empty bank @ %d\n",
++ num_banks);
++ num_banks++;
++ gpio_base += MAX_GPIO_PER_BANK;
++ continue;
++ }
++
+ bank = devm_kzalloc(dev, sizeof(*bank), GFP_KERNEL);
+ if (!bank) {
+ err = -ENOMEM;
+@@ -740,9 +752,6 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
+ goto fail;
+ }
+
+- dev_info(dev, "Registered %d banks (GPIO(s): %d-%d)\n",
+- num_banks, priv->gpio_base, gpio_base - 1);
+-
+ if (priv->parent_wake_irq && need_wakeup_event)
+ pm_wakeup_event(dev, 0);
+
+diff --git a/drivers/gpio/gpio-mxs.c b/drivers/gpio/gpio-mxs.c
+index df30490da820..ea874fd033a5 100644
+--- a/drivers/gpio/gpio-mxs.c
++++ b/drivers/gpio/gpio-mxs.c
+@@ -18,8 +18,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ #include <linux/gpio/driver.h>
+-/* FIXME: for gpio_get_value(), replace this by direct register read */
+-#include <linux/gpio.h>
+ #include <linux/module.h>
+
+ #define MXS_SET 0x4
+@@ -86,7 +84,7 @@ static int mxs_gpio_set_irq_type(struct irq_data *d, unsigned int type)
+ port->both_edges &= ~pin_mask;
+ switch (type) {
+ case IRQ_TYPE_EDGE_BOTH:
+- val = gpio_get_value(port->gc.base + d->hwirq);
++ val = port->gc.get(&port->gc, d->hwirq);
+ if (val)
+ edge = GPIO_INT_FALL_EDGE;
+ else
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 2d45d1dd9554..643f5edd68fe 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1446,8 +1446,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ }
+
+ /* The CEC module handles HDMI hotplug detection */
+- cec_np = of_find_compatible_node(np->parent, NULL,
+- "mediatek,mt8173-cec");
++ cec_np = of_get_compatible_child(np->parent, "mediatek,mt8173-cec");
+ if (!cec_np) {
+ dev_err(dev, "Failed to find CEC node\n");
+ return -EINVAL;
+@@ -1457,8 +1456,10 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ if (!cec_pdev) {
+ dev_err(hdmi->dev, "Waiting for CEC device %pOF\n",
+ cec_np);
++ of_node_put(cec_np);
+ return -EPROBE_DEFER;
+ }
++ of_node_put(cec_np);
+ hdmi->cec_dev = &cec_pdev->dev;
+
+ /*
+diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
+index cf2a18571d48..a132c37d7334 100644
+--- a/drivers/gpu/vga/vga_switcheroo.c
++++ b/drivers/gpu/vga/vga_switcheroo.c
+@@ -380,6 +380,9 @@ int vga_switcheroo_register_audio_client(struct pci_dev *pdev,
+ mutex_unlock(&vgasr_mutex);
+ return -EINVAL;
+ }
++ /* notify if GPU has been already bound */
++ if (ops->gpu_bound)
++ ops->gpu_bound(pdev, id);
+ }
+ mutex_unlock(&vgasr_mutex);
+
+diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
+index 23872d08308c..a746017fac17 100644
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -512,14 +512,24 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
+ if (cmd == HIDIOCGCOLLECTIONINDEX) {
+ if (uref->usage_index >= field->maxusage)
+ goto inval;
++ uref->usage_index =
++ array_index_nospec(uref->usage_index,
++ field->maxusage);
+ } else if (uref->usage_index >= field->report_count)
+ goto inval;
+ }
+
+- if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
+- (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+- uref->usage_index + uref_multi->num_values > field->report_count))
+- goto inval;
++ if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
++ if (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
++ uref->usage_index + uref_multi->num_values >
++ field->report_count)
++ goto inval;
++
++ uref->usage_index =
++ array_index_nospec(uref->usage_index,
++ field->report_count -
++ uref_multi->num_values);
++ }
+
+ switch (cmd) {
+ case HIDIOCGUSAGE:
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index e0a06be5ef5c..5dd3a8245f0f 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -3335,6 +3335,7 @@ static void wacom_setup_intuos(struct wacom_wac *wacom_wac)
+
+ void wacom_setup_device_quirks(struct wacom *wacom)
+ {
++ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+ struct wacom_features *features = &wacom->wacom_wac.features;
+
+ /* The pen and pad share the same interface on most devices */
+@@ -3464,6 +3465,24 @@ void wacom_setup_device_quirks(struct wacom *wacom)
+
+ if (features->type == REMOTE)
+ features->device_type |= WACOM_DEVICETYPE_WL_MONITOR;
++
++ /* HID descriptor for DTK-2451 / DTH-2452 claims to report lots
++ * of things it shouldn't. Lets fix up the damage...
++ */
++ if (wacom->hdev->product == 0x382 || wacom->hdev->product == 0x37d) {
++ features->quirks &= ~WACOM_QUIRK_TOOLSERIAL;
++ __clear_bit(BTN_TOOL_BRUSH, wacom_wac->pen_input->keybit);
++ __clear_bit(BTN_TOOL_PENCIL, wacom_wac->pen_input->keybit);
++ __clear_bit(BTN_TOOL_AIRBRUSH, wacom_wac->pen_input->keybit);
++ __clear_bit(ABS_Z, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_DISTANCE, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_TILT_X, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_TILT_Y, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_WHEEL, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_MISC, wacom_wac->pen_input->absbit);
++ __clear_bit(MSC_SERIAL, wacom_wac->pen_input->mscbit);
++ __clear_bit(EV_MSC, wacom_wac->pen_input->evbit);
++ }
+ }
+
+ int wacom_setup_pen_input_capabilities(struct input_dev *input_dev,
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 0f0e091c117c..c4a1ebcfffb6 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -606,16 +606,18 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ bool perf_chn = vmbus_devs[dev_type].perf_device;
+ struct vmbus_channel *primary = channel->primary_channel;
+ int next_node;
+- struct cpumask available_mask;
++ cpumask_var_t available_mask;
+ struct cpumask *alloced_mask;
+
+ if ((vmbus_proto_version == VERSION_WS2008) ||
+- (vmbus_proto_version == VERSION_WIN7) || (!perf_chn)) {
++ (vmbus_proto_version == VERSION_WIN7) || (!perf_chn) ||
++ !alloc_cpumask_var(&available_mask, GFP_KERNEL)) {
+ /*
+ * Prior to win8, all channel interrupts are
+ * delivered on cpu 0.
+ * Also if the channel is not a performance critical
+ * channel, bind it to cpu 0.
++ * In case alloc_cpumask_var() fails, bind it to cpu 0.
+ */
+ channel->numa_node = 0;
+ channel->target_cpu = 0;
+@@ -653,7 +655,7 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ cpumask_clear(alloced_mask);
+ }
+
+- cpumask_xor(&available_mask, alloced_mask,
++ cpumask_xor(available_mask, alloced_mask,
+ cpumask_of_node(primary->numa_node));
+
+ cur_cpu = -1;
+@@ -671,10 +673,10 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ }
+
+ while (true) {
+- cur_cpu = cpumask_next(cur_cpu, &available_mask);
++ cur_cpu = cpumask_next(cur_cpu, available_mask);
+ if (cur_cpu >= nr_cpu_ids) {
+ cur_cpu = -1;
+- cpumask_copy(&available_mask,
++ cpumask_copy(available_mask,
+ cpumask_of_node(primary->numa_node));
+ continue;
+ }
+@@ -704,6 +706,8 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+
+ channel->target_cpu = cur_cpu;
+ channel->target_vp = hv_cpu_number_to_vp_number(cur_cpu);
++
++ free_cpumask_var(available_mask);
+ }
+
+ static void vmbus_wait_for_unload(void)
+diff --git a/drivers/hwmon/pmbus/pmbus.c b/drivers/hwmon/pmbus/pmbus.c
+index 7718e58dbda5..7688dab32f6e 100644
+--- a/drivers/hwmon/pmbus/pmbus.c
++++ b/drivers/hwmon/pmbus/pmbus.c
+@@ -118,6 +118,8 @@ static int pmbus_identify(struct i2c_client *client,
+ } else {
+ info->pages = 1;
+ }
++
++ pmbus_clear_faults(client);
+ }
+
+ if (pmbus_check_byte_register(client, 0, PMBUS_VOUT_MODE)) {
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index 82c3754e21e3..2e2b5851139c 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -2015,7 +2015,10 @@ static int pmbus_init_common(struct i2c_client *client, struct pmbus_data *data,
+ if (ret >= 0 && (ret & PB_CAPABILITY_ERROR_CHECK))
+ client->flags |= I2C_CLIENT_PEC;
+
+- pmbus_clear_faults(client);
++ if (data->info->pages)
++ pmbus_clear_faults(client);
++ else
++ pmbus_clear_fault_page(client, -1);
+
+ if (info->identify) {
+ ret = (*info->identify)(client, info);
+diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
+index 7838af58f92d..9d611dd268e1 100644
+--- a/drivers/hwmon/pwm-fan.c
++++ b/drivers/hwmon/pwm-fan.c
+@@ -290,9 +290,19 @@ static int pwm_fan_remove(struct platform_device *pdev)
+ static int pwm_fan_suspend(struct device *dev)
+ {
+ struct pwm_fan_ctx *ctx = dev_get_drvdata(dev);
++ struct pwm_args args;
++ int ret;
++
++ pwm_get_args(ctx->pwm, &args);
++
++ if (ctx->pwm_value) {
++ ret = pwm_config(ctx->pwm, 0, args.period);
++ if (ret < 0)
++ return ret;
+
+- if (ctx->pwm_value)
+ pwm_disable(ctx->pwm);
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
+index 306119eaf16a..0dad8626bcfb 100644
+--- a/drivers/hwtracing/coresight/coresight-etb10.c
++++ b/drivers/hwtracing/coresight/coresight-etb10.c
+@@ -147,6 +147,10 @@ static int etb_enable(struct coresight_device *csdev, u32 mode)
+ if (val == CS_MODE_PERF)
+ return -EBUSY;
+
++ /* Don't let perf disturb sysFS sessions */
++ if (val == CS_MODE_SYSFS && mode == CS_MODE_PERF)
++ return -EBUSY;
++
+ /* Nothing to do, the tracer is already enabled. */
+ if (val == CS_MODE_SYSFS)
+ goto out;
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index 44b516863c9d..75d2f73582a3 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -248,12 +248,14 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *idev = pf->indio_dev;
+ struct at91_adc_state *st = iio_priv(idev);
++ struct iio_chan_spec const *chan;
+ int i, j = 0;
+
+ for (i = 0; i < idev->masklength; i++) {
+ if (!test_bit(i, idev->active_scan_mask))
+ continue;
+- st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, i));
++ chan = idev->channels + i;
++ st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, chan->channel));
+ j++;
+ }
+
+@@ -279,6 +281,8 @@ static void handle_adc_eoc_trigger(int irq, struct iio_dev *idev)
+ iio_trigger_poll(idev->trig);
+ } else {
+ st->last_value = at91_adc_readl(st, AT91_ADC_CHAN(st, st->chnb));
++ /* Needed to ACK the DRDY interruption */
++ at91_adc_readl(st, AT91_ADC_LCDR);
+ st->done = true;
+ wake_up_interruptible(&st->wq_data_avail);
+ }
+diff --git a/drivers/iio/adc/fsl-imx25-gcq.c b/drivers/iio/adc/fsl-imx25-gcq.c
+index ea264fa9e567..929c617db364 100644
+--- a/drivers/iio/adc/fsl-imx25-gcq.c
++++ b/drivers/iio/adc/fsl-imx25-gcq.c
+@@ -209,12 +209,14 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ ret = of_property_read_u32(child, "reg", ®);
+ if (ret) {
+ dev_err(dev, "Failed to get reg property\n");
++ of_node_put(child);
+ return ret;
+ }
+
+ if (reg >= MX25_NUM_CFGS) {
+ dev_err(dev,
+ "reg value is greater than the number of available configuration registers\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+@@ -228,6 +230,7 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ if (IS_ERR(priv->vref[refp])) {
+ dev_err(dev, "Error, trying to use external voltage reference without a vref-%s regulator.",
+ mx25_gcq_refp_names[refp]);
++ of_node_put(child);
+ return PTR_ERR(priv->vref[refp]);
+ }
+ priv->channel_vref_mv[reg] =
+@@ -240,6 +243,7 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ break;
+ default:
+ dev_err(dev, "Invalid positive reference %d\n", refp);
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+@@ -254,10 +258,12 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+
+ if ((refp & MX25_ADCQ_CFG_REFP_MASK) != refp) {
+ dev_err(dev, "Invalid fsl,adc-refp property value\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+ if ((refn & MX25_ADCQ_CFG_REFN_MASK) != refn) {
+ dev_err(dev, "Invalid fsl,adc-refn property value\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/iio/dac/ad5064.c b/drivers/iio/dac/ad5064.c
+index bf4fc40ec84d..2f98cb2a3b96 100644
+--- a/drivers/iio/dac/ad5064.c
++++ b/drivers/iio/dac/ad5064.c
+@@ -808,6 +808,40 @@ static int ad5064_set_config(struct ad5064_state *st, unsigned int val)
+ return ad5064_write(st, cmd, 0, val, 0);
+ }
+
++static int ad5064_request_vref(struct ad5064_state *st, struct device *dev)
++{
++ unsigned int i;
++ int ret;
++
++ for (i = 0; i < ad5064_num_vref(st); ++i)
++ st->vref_reg[i].supply = ad5064_vref_name(st, i);
++
++ if (!st->chip_info->internal_vref)
++ return devm_regulator_bulk_get(dev, ad5064_num_vref(st),
++ st->vref_reg);
++
++ /*
++ * This assumes that when the regulator has an internal VREF
++ * there is only one external VREF connection, which is
++ * currently the case for all supported devices.
++ */
++ st->vref_reg[0].consumer = devm_regulator_get_optional(dev, "vref");
++ if (!IS_ERR(st->vref_reg[0].consumer))
++ return 0;
++
++ ret = PTR_ERR(st->vref_reg[0].consumer);
++ if (ret != -ENODEV)
++ return ret;
++
++ /* If no external regulator was supplied use the internal VREF */
++ st->use_internal_vref = true;
++ ret = ad5064_set_config(st, AD5064_CONFIG_INT_VREF_ENABLE);
++ if (ret)
++ dev_err(dev, "Failed to enable internal vref: %d\n", ret);
++
++ return ret;
++}
++
+ static int ad5064_probe(struct device *dev, enum ad5064_type type,
+ const char *name, ad5064_write_func write)
+ {
+@@ -828,22 +862,11 @@ static int ad5064_probe(struct device *dev, enum ad5064_type type,
+ st->dev = dev;
+ st->write = write;
+
+- for (i = 0; i < ad5064_num_vref(st); ++i)
+- st->vref_reg[i].supply = ad5064_vref_name(st, i);
++ ret = ad5064_request_vref(st, dev);
++ if (ret)
++ return ret;
+
+- ret = devm_regulator_bulk_get(dev, ad5064_num_vref(st),
+- st->vref_reg);
+- if (ret) {
+- if (!st->chip_info->internal_vref)
+- return ret;
+- st->use_internal_vref = true;
+- ret = ad5064_set_config(st, AD5064_CONFIG_INT_VREF_ENABLE);
+- if (ret) {
+- dev_err(dev, "Failed to enable internal vref: %d\n",
+- ret);
+- return ret;
+- }
+- } else {
++ if (!st->use_internal_vref) {
+ ret = regulator_bulk_enable(ad5064_num_vref(st), st->vref_reg);
+ if (ret)
+ return ret;
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 6e39c27dca8e..4c533275d1f2 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -3292,8 +3292,11 @@ static int cm_lap_handler(struct cm_work *work)
+ if (ret)
+ goto unlock;
+
+- cm_init_av_by_path(param->alternate_path, NULL, &cm_id_priv->alt_av,
+- cm_id_priv);
++ ret = cm_init_av_by_path(param->alternate_path, NULL,
++ &cm_id_priv->alt_av, cm_id_priv);
++ if (ret)
++ goto unlock;
++
+ cm_id_priv->id.lap_state = IB_CM_LAP_RCVD;
+ cm_id_priv->tid = lap_msg->hdr.tid;
+ ret = atomic_inc_and_test(&cm_id_priv->work_count);
+diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
+index 7fd14ead7b37..ace40bb98624 100644
+--- a/drivers/infiniband/core/sysfs.c
++++ b/drivers/infiniband/core/sysfs.c
+@@ -512,7 +512,7 @@ static ssize_t show_pma_counter(struct ib_port *p, struct port_attribute *attr,
+ ret = get_perf_mad(p->ibdev, p->port_num, tab_attr->attr_id, &data,
+ 40 + offset / 8, sizeof(data));
+ if (ret < 0)
+- return sprintf(buf, "N/A (no PMA)\n");
++ return ret;
+
+ switch (width) {
+ case 4:
+@@ -1057,10 +1057,12 @@ static int add_port(struct ib_device *device, int port_num,
+ goto err_put;
+ }
+
+- p->pma_table = get_counter_table(device, port_num);
+- ret = sysfs_create_group(&p->kobj, p->pma_table);
+- if (ret)
+- goto err_put_gid_attrs;
++ if (device->process_mad) {
++ p->pma_table = get_counter_table(device, port_num);
++ ret = sysfs_create_group(&p->kobj, p->pma_table);
++ if (ret)
++ goto err_put_gid_attrs;
++ }
+
+ p->gid_group.name = "gids";
+ p->gid_group.attrs = alloc_group_attrs(show_port_gid, attr.gid_tbl_len);
+@@ -1173,7 +1175,8 @@ err_free_gid:
+ p->gid_group.attrs = NULL;
+
+ err_remove_pma:
+- sysfs_remove_group(&p->kobj, p->pma_table);
++ if (p->pma_table)
++ sysfs_remove_group(&p->kobj, p->pma_table);
+
+ err_put_gid_attrs:
+ kobject_put(&p->gid_attr_group->kobj);
+@@ -1285,7 +1288,9 @@ static void free_port_list_attributes(struct ib_device *device)
+ kfree(port->hw_stats);
+ free_hsag(&port->kobj, port->hw_stats_ag);
+ }
+- sysfs_remove_group(p, port->pma_table);
++
++ if (port->pma_table)
++ sysfs_remove_group(p, port->pma_table);
+ sysfs_remove_group(p, &port->pkey_group);
+ sysfs_remove_group(p, &port->gid_group);
+ sysfs_remove_group(&port->gid_attr_group->kobj,
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index 6ad0d46ab879..249efa0a6aba 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -360,7 +360,8 @@ void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq)
+ }
+
+ /* Make sure the HW is stopped! */
+- bnxt_qplib_nq_stop_irq(nq, true);
++ if (nq->requested)
++ bnxt_qplib_nq_stop_irq(nq, true);
+
+ if (nq->bar_reg_iomem)
+ iounmap(nq->bar_reg_iomem);
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+index 2852d350ada1..6637df77d236 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+@@ -309,8 +309,17 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
+ rcfw->aeq_handler(rcfw, qp_event, qp);
+ break;
+ default:
+- /* Command Response */
+- spin_lock_irqsave(&cmdq->lock, flags);
++ /*
++ * Command Response
++ * cmdq->lock needs to be acquired to synchronie
++ * the command send and completion reaping. This function
++ * is always called with creq->lock held. Using
++ * the nested variant of spin_lock.
++ *
++ */
++
++ spin_lock_irqsave_nested(&cmdq->lock, flags,
++ SINGLE_DEPTH_NESTING);
+ cookie = le16_to_cpu(qp_event->cookie);
+ mcookie = qp_event->cookie;
+ blocked = cookie & RCFW_CMD_IS_BLOCKING;
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index e22314837645..7df4a4fe4af4 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -691,7 +691,6 @@ int mlx5_mr_cache_init(struct mlx5_ib_dev *dev)
+ init_completion(&ent->compl);
+ INIT_WORK(&ent->work, cache_work_func);
+ INIT_DELAYED_WORK(&ent->dwork, delayed_cache_work_func);
+- queue_work(cache->wq, &ent->work);
+
+ if (i > MR_CACHE_LAST_STD_ENTRY) {
+ mlx5_odp_init_mr_cache_entry(ent);
+@@ -711,6 +710,7 @@ int mlx5_mr_cache_init(struct mlx5_ib_dev *dev)
+ ent->limit = dev->mdev->profile->mr_cache[i].limit;
+ else
+ ent->limit = 0;
++ queue_work(cache->wq, &ent->work);
+ }
+
+ err = mlx5_mr_cache_debugfs_init(dev);
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 6cba2a02d11b..d53d954ac8af 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3243,7 +3243,9 @@ static bool modify_dci_qp_is_ok(enum ib_qp_state cur_state, enum ib_qp_state new
+ int req = IB_QP_STATE;
+ int opt = 0;
+
+- if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
++ if (new_state == IB_QPS_RESET) {
++ return is_valid_mask(attr_mask, req, opt);
++ } else if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
+ req |= IB_QP_PKEY_INDEX | IB_QP_PORT;
+ return is_valid_mask(attr_mask, req, opt);
+ } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_INIT) {
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index aa5833318372..fc6c880756da 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -682,6 +682,7 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ rxe_advance_resp_resource(qp);
+
+ res->type = RXE_READ_MASK;
++ res->replay = 0;
+
+ res->read.va = qp->resp.va;
+ res->read.va_org = qp->resp.va;
+@@ -752,7 +753,8 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ state = RESPST_DONE;
+ } else {
+ qp->resp.res = NULL;
+- qp->resp.opcode = -1;
++ if (!res->replay)
++ qp->resp.opcode = -1;
+ if (psn_compare(res->cur_psn, qp->resp.psn) >= 0)
+ qp->resp.psn = res->cur_psn;
+ state = RESPST_CLEANUP;
+@@ -814,6 +816,7 @@ static enum resp_states execute(struct rxe_qp *qp, struct rxe_pkt_info *pkt)
+
+ /* next expected psn, read handles this separately */
+ qp->resp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
++ qp->resp.ack_psn = qp->resp.psn;
+
+ qp->resp.opcode = pkt->opcode;
+ qp->resp.status = IB_WC_SUCCESS;
+@@ -1065,7 +1068,7 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
+ struct rxe_pkt_info *pkt)
+ {
+ enum resp_states rc;
+- u32 prev_psn = (qp->resp.psn - 1) & BTH_PSN_MASK;
++ u32 prev_psn = (qp->resp.ack_psn - 1) & BTH_PSN_MASK;
+
+ if (pkt->mask & RXE_SEND_MASK ||
+ pkt->mask & RXE_WRITE_MASK) {
+@@ -1108,6 +1111,7 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
+ res->state = (pkt->psn == res->first_psn) ?
+ rdatm_res_state_new :
+ rdatm_res_state_replay;
++ res->replay = 1;
+
+ /* Reset the resource, except length. */
+ res->read.va_org = iova;
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index af1470d29391..332a16dad2a7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -171,6 +171,7 @@ enum rdatm_res_state {
+
+ struct resp_res {
+ int type;
++ int replay;
+ u32 first_psn;
+ u32 last_psn;
+ u32 cur_psn;
+@@ -195,6 +196,7 @@ struct rxe_resp_info {
+ enum rxe_qp_state state;
+ u32 msn;
+ u32 psn;
++ u32 ack_psn;
+ int opcode;
+ int drop_msg;
+ int goto_error;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 3d5424f335cb..0428e01e8f69 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1438,11 +1438,15 @@ static void ipoib_cm_skb_reap(struct work_struct *work)
+ spin_unlock_irqrestore(&priv->lock, flags);
+ netif_tx_unlock_bh(dev);
+
+- if (skb->protocol == htons(ETH_P_IP))
++ if (skb->protocol == htons(ETH_P_IP)) {
++ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
++ }
+ #if IS_ENABLED(CONFIG_IPV6)
+- else if (skb->protocol == htons(ETH_P_IPV6))
++ else if (skb->protocol == htons(ETH_P_IPV6)) {
++ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
++ }
+ #endif
+ dev_kfree_skb_any(skb);
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index e3d28f9ad9c0..30f840f874b3 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1880,6 +1880,8 @@ static int ipoib_parent_init(struct net_device *ndev)
+ sizeof(union ib_gid));
+
+ SET_NETDEV_DEV(priv->dev, priv->ca->dev.parent);
++ priv->dev->dev_port = priv->port - 1;
++ /* Let's set this one too for backwards compatibility. */
+ priv->dev->dev_id = priv->port - 1;
+
+ return 0;
+diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
+index fd1b80ef9490..e7cbf4fcf61d 100644
+--- a/drivers/iommu/arm-smmu.c
++++ b/drivers/iommu/arm-smmu.c
+@@ -469,6 +469,9 @@ static void arm_smmu_tlb_inv_range_nosync(unsigned long iova, size_t size,
+ bool stage1 = cfg->cbar != CBAR_TYPE_S2_TRANS;
+ void __iomem *reg = ARM_SMMU_CB(smmu_domain->smmu, cfg->cbndx);
+
++ if (smmu_domain->smmu->features & ARM_SMMU_FEAT_COHERENT_WALK)
++ wmb();
++
+ if (stage1) {
+ reg += leaf ? ARM_SMMU_CB_S1_TLBIVAL : ARM_SMMU_CB_S1_TLBIVA;
+
+@@ -510,6 +513,9 @@ static void arm_smmu_tlb_inv_vmid_nosync(unsigned long iova, size_t size,
+ struct arm_smmu_domain *smmu_domain = cookie;
+ void __iomem *base = ARM_SMMU_GR0(smmu_domain->smmu);
+
++ if (smmu_domain->smmu->features & ARM_SMMU_FEAT_COHERENT_WALK)
++ wmb();
++
+ writel_relaxed(smmu_domain->cfg.vmid, base + ARM_SMMU_GR0_TLBIVMID);
+ }
+
+diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c
+index b1b47a40a278..faa7d61b9d6c 100644
+--- a/drivers/irqchip/qcom-pdc.c
++++ b/drivers/irqchip/qcom-pdc.c
+@@ -124,6 +124,7 @@ static int qcom_pdc_gic_set_type(struct irq_data *d, unsigned int type)
+ break;
+ case IRQ_TYPE_EDGE_BOTH:
+ pdc_type = PDC_EDGE_DUAL;
++ type = IRQ_TYPE_EDGE_RISING;
+ break;
+ case IRQ_TYPE_LEVEL_HIGH:
+ pdc_type = PDC_LEVEL_HIGH;
+diff --git a/drivers/lightnvm/pblk-core.c b/drivers/lightnvm/pblk-core.c
+index 00984b486fea..2940cdc87af1 100644
+--- a/drivers/lightnvm/pblk-core.c
++++ b/drivers/lightnvm/pblk-core.c
+@@ -1539,13 +1539,14 @@ struct pblk_line *pblk_line_replace_data(struct pblk *pblk)
+ struct pblk_line *cur, *new = NULL;
+ unsigned int left_seblks;
+
+- cur = l_mg->data_line;
+ new = l_mg->data_next;
+ if (!new)
+ goto out;
+- l_mg->data_line = new;
+
+ spin_lock(&l_mg->free_lock);
++ cur = l_mg->data_line;
++ l_mg->data_line = new;
++
+ pblk_line_setup_metadata(new, l_mg, &pblk->lm);
+ spin_unlock(&l_mg->free_lock);
+
+diff --git a/drivers/lightnvm/pblk-recovery.c b/drivers/lightnvm/pblk-recovery.c
+index e232e47e1353..df75d9caec45 100644
+--- a/drivers/lightnvm/pblk-recovery.c
++++ b/drivers/lightnvm/pblk-recovery.c
+@@ -956,12 +956,14 @@ next:
+ }
+ }
+
+- spin_lock(&l_mg->free_lock);
+ if (!open_lines) {
++ spin_lock(&l_mg->free_lock);
+ WARN_ON_ONCE(!test_and_clear_bit(meta_line,
+ &l_mg->meta_bitmap));
++ spin_unlock(&l_mg->free_lock);
+ pblk_line_replace_data(pblk);
+ } else {
++ spin_lock(&l_mg->free_lock);
+ /* Allocate next line for preparation */
+ l_mg->data_next = pblk_line_get(pblk);
+ if (l_mg->data_next) {
+@@ -969,8 +971,8 @@ next:
+ l_mg->data_next->type = PBLK_LINETYPE_DATA;
+ is_next = 1;
+ }
++ spin_unlock(&l_mg->free_lock);
+ }
+- spin_unlock(&l_mg->free_lock);
+
+ if (is_next)
+ pblk_line_erase(pblk, l_mg->data_next);
+diff --git a/drivers/lightnvm/pblk-sysfs.c b/drivers/lightnvm/pblk-sysfs.c
+index 9fc3dfa168b4..8d2ed510c04b 100644
+--- a/drivers/lightnvm/pblk-sysfs.c
++++ b/drivers/lightnvm/pblk-sysfs.c
+@@ -262,8 +262,14 @@ static ssize_t pblk_sysfs_lines(struct pblk *pblk, char *page)
+ sec_in_line = l_mg->data_line->sec_in_line;
+ meta_weight = bitmap_weight(&l_mg->meta_bitmap,
+ PBLK_DATA_LINES);
+- map_weight = bitmap_weight(l_mg->data_line->map_bitmap,
++
++ spin_lock(&l_mg->data_line->lock);
++ if (l_mg->data_line->map_bitmap)
++ map_weight = bitmap_weight(l_mg->data_line->map_bitmap,
+ lm->sec_per_line);
++ else
++ map_weight = 0;
++ spin_unlock(&l_mg->data_line->lock);
+ }
+ spin_unlock(&l_mg->free_lock);
+
+diff --git a/drivers/lightnvm/pblk-write.c b/drivers/lightnvm/pblk-write.c
+index ee774a86cf1e..879227d584e7 100644
+--- a/drivers/lightnvm/pblk-write.c
++++ b/drivers/lightnvm/pblk-write.c
+@@ -417,12 +417,11 @@ int pblk_submit_meta_io(struct pblk *pblk, struct pblk_line *meta_line)
+ rqd->ppa_list[i] = addr_to_gen_ppa(pblk, paddr, id);
+ }
+
++ spin_lock(&l_mg->close_lock);
+ emeta->mem += rq_len;
+- if (emeta->mem >= lm->emeta_len[0]) {
+- spin_lock(&l_mg->close_lock);
++ if (emeta->mem >= lm->emeta_len[0])
+ list_del(&meta_line->list);
+- spin_unlock(&l_mg->close_lock);
+- }
++ spin_unlock(&l_mg->close_lock);
+
+ pblk_down_page(pblk, rqd->ppa_list, rqd->nr_ppas);
+
+@@ -491,14 +490,15 @@ static struct pblk_line *pblk_should_submit_meta_io(struct pblk *pblk,
+ struct pblk_line *meta_line;
+
+ spin_lock(&l_mg->close_lock);
+-retry:
+ if (list_empty(&l_mg->emeta_list)) {
+ spin_unlock(&l_mg->close_lock);
+ return NULL;
+ }
+ meta_line = list_first_entry(&l_mg->emeta_list, struct pblk_line, list);
+- if (meta_line->emeta->mem >= lm->emeta_len[0])
+- goto retry;
++ if (meta_line->emeta->mem >= lm->emeta_len[0]) {
++ spin_unlock(&l_mg->close_lock);
++ return NULL;
++ }
+ spin_unlock(&l_mg->close_lock);
+
+ if (!pblk_valid_meta_ppa(pblk, meta_line, data_rqd))
+diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
+index 311e91b1a14f..256f18b67e8a 100644
+--- a/drivers/mailbox/pcc.c
++++ b/drivers/mailbox/pcc.c
+@@ -461,8 +461,11 @@ static int __init acpi_pcc_probe(void)
+ count = acpi_table_parse_entries_array(ACPI_SIG_PCCT,
+ sizeof(struct acpi_table_pcct), proc,
+ ACPI_PCCT_TYPE_RESERVED, MAX_PCC_SUBSPACES);
+- if (count == 0 || count > MAX_PCC_SUBSPACES) {
+- pr_warn("Invalid PCCT: %d PCC subspaces\n", count);
++ if (count <= 0 || count > MAX_PCC_SUBSPACES) {
++ if (count < 0)
++ pr_warn("Error parsing PCC subspaces from PCCT\n");
++ else
++ pr_warn("Invalid PCCT: %d PCC subspaces\n", count);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index e7d4817681f2..3f4211b5cd33 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -2434,7 +2434,7 @@ static int refill_keybuf_fn(struct btree_op *op, struct btree *b,
+ struct keybuf *buf = refill->buf;
+ int ret = MAP_CONTINUE;
+
+- if (bkey_cmp(k, refill->end) >= 0) {
++ if (bkey_cmp(k, refill->end) > 0) {
+ ret = MAP_DONE;
+ goto out;
+ }
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index 51be355a3309..22944aa7d8e5 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -850,7 +850,7 @@ static void cached_dev_read_done_bh(struct closure *cl)
+
+ bch_mark_cache_accounting(s->iop.c, s->d,
+ !s->cache_missed, s->iop.bypass);
+- trace_bcache_read(s->orig_bio, !s->cache_miss, s->iop.bypass);
++ trace_bcache_read(s->orig_bio, !s->cache_missed, s->iop.bypass);
+
+ if (s->iop.status)
+ continue_at_nobarrier(cl, cached_dev_read_error, bcache_wq);
+@@ -1218,6 +1218,9 @@ static int cached_dev_ioctl(struct bcache_device *d, fmode_t mode,
+ {
+ struct cached_dev *dc = container_of(d, struct cached_dev, disk);
+
++ if (dc->io_disable)
++ return -EIO;
++
+ return __blkdev_driver_ioctl(dc->bdev, mode, cmd, arg);
+ }
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 30ba9aeb5ee8..03bb5cee2b83 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -643,10 +643,6 @@ static int ioctl_dev(struct block_device *b, fmode_t mode,
+ unsigned int cmd, unsigned long arg)
+ {
+ struct bcache_device *d = b->bd_disk->private_data;
+- struct cached_dev *dc = container_of(d, struct cached_dev, disk);
+-
+- if (dc->io_disable)
+- return -EIO;
+
+ return d->ioctl(d, mode, cmd, arg);
+ }
+@@ -1152,11 +1148,12 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
+ }
+
+ if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) {
+- bch_sectors_dirty_init(&dc->disk);
+ atomic_set(&dc->has_dirty, 1);
+ bch_writeback_queue(dc);
+ }
+
++ bch_sectors_dirty_init(&dc->disk);
++
+ bch_cached_dev_run(dc);
+ bcache_device_link(&dc->disk, c, "bdev");
+ atomic_inc(&c->attached_dev_nr);
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index 150cf4f4cf74..26f035a0c5b9 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -285,6 +285,7 @@ STORE(__cached_dev)
+ 1, WRITEBACK_RATE_UPDATE_SECS_MAX);
+ d_strtoul(writeback_rate_i_term_inverse);
+ d_strtoul_nonzero(writeback_rate_p_term_inverse);
++ d_strtoul_nonzero(writeback_rate_minimum);
+
+ sysfs_strtoul_clamp(io_error_limit, dc->error_limit, 0, INT_MAX);
+
+@@ -412,6 +413,7 @@ static struct attribute *bch_cached_dev_files[] = {
+ &sysfs_writeback_rate_update_seconds,
+ &sysfs_writeback_rate_i_term_inverse,
+ &sysfs_writeback_rate_p_term_inverse,
++ &sysfs_writeback_rate_minimum,
+ &sysfs_writeback_rate_debug,
+ &sysfs_errors,
+ &sysfs_io_error_limit,
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index b810ea77e6b1..f666778ad237 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1720,8 +1720,7 @@ static void free_params(struct dm_ioctl *param, size_t param_size, int param_fla
+ }
+
+ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kernel,
+- int ioctl_flags,
+- struct dm_ioctl **param, int *param_flags)
++ int ioctl_flags, struct dm_ioctl **param, int *param_flags)
+ {
+ struct dm_ioctl *dmi;
+ int secure_data;
+@@ -1762,18 +1761,13 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
+
+ *param_flags |= DM_PARAMS_MALLOC;
+
+- if (copy_from_user(dmi, user, param_kernel->data_size))
+- goto bad;
++ /* Copy from param_kernel (which was already copied from user) */
++ memcpy(dmi, param_kernel, minimum_data_size);
+
+-data_copied:
+- /*
+- * Abort if something changed the ioctl data while it was being copied.
+- */
+- if (dmi->data_size != param_kernel->data_size) {
+- DMERR("rejecting ioctl: data size modified while processing parameters");
++ if (copy_from_user(&dmi->data, (char __user *)user + minimum_data_size,
++ param_kernel->data_size - minimum_data_size))
+ goto bad;
+- }
+-
++data_copied:
+ /* Wipe the user buffer so we do not return it to userspace */
+ if (secure_data && clear_user(user, param_kernel->data_size))
+ goto bad;
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index 969954915566..fa68336560c3 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -99,7 +99,7 @@ struct dmz_mblock {
+ struct rb_node node;
+ struct list_head link;
+ sector_t no;
+- atomic_t ref;
++ unsigned int ref;
+ unsigned long state;
+ struct page *page;
+ void *data;
+@@ -296,7 +296,7 @@ static struct dmz_mblock *dmz_alloc_mblock(struct dmz_metadata *zmd,
+
+ RB_CLEAR_NODE(&mblk->node);
+ INIT_LIST_HEAD(&mblk->link);
+- atomic_set(&mblk->ref, 0);
++ mblk->ref = 0;
+ mblk->state = 0;
+ mblk->no = mblk_no;
+ mblk->data = page_address(mblk->page);
+@@ -339,10 +339,11 @@ static void dmz_insert_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk)
+ }
+
+ /*
+- * Lookup a metadata block in the rbtree.
++ * Lookup a metadata block in the rbtree. If the block is found, increment
++ * its reference count.
+ */
+-static struct dmz_mblock *dmz_lookup_mblock(struct dmz_metadata *zmd,
+- sector_t mblk_no)
++static struct dmz_mblock *dmz_get_mblock_fast(struct dmz_metadata *zmd,
++ sector_t mblk_no)
+ {
+ struct rb_root *root = &zmd->mblk_rbtree;
+ struct rb_node *node = root->rb_node;
+@@ -350,8 +351,17 @@ static struct dmz_mblock *dmz_lookup_mblock(struct dmz_metadata *zmd,
+
+ while (node) {
+ mblk = container_of(node, struct dmz_mblock, node);
+- if (mblk->no == mblk_no)
++ if (mblk->no == mblk_no) {
++ /*
++ * If this is the first reference to the block,
++ * remove it from the LRU list.
++ */
++ mblk->ref++;
++ if (mblk->ref == 1 &&
++ !test_bit(DMZ_META_DIRTY, &mblk->state))
++ list_del_init(&mblk->link);
+ return mblk;
++ }
+ node = (mblk->no < mblk_no) ? node->rb_left : node->rb_right;
+ }
+
+@@ -382,32 +392,47 @@ static void dmz_mblock_bio_end_io(struct bio *bio)
+ }
+
+ /*
+- * Read a metadata block from disk.
++ * Read an uncached metadata block from disk and add it to the cache.
+ */
+-static struct dmz_mblock *dmz_fetch_mblock(struct dmz_metadata *zmd,
+- sector_t mblk_no)
++static struct dmz_mblock *dmz_get_mblock_slow(struct dmz_metadata *zmd,
++ sector_t mblk_no)
+ {
+- struct dmz_mblock *mblk;
++ struct dmz_mblock *mblk, *m;
+ sector_t block = zmd->sb[zmd->mblk_primary].block + mblk_no;
+ struct bio *bio;
+
+- /* Get block and insert it */
++ /* Get a new block and a BIO to read it */
+ mblk = dmz_alloc_mblock(zmd, mblk_no);
+ if (!mblk)
+ return NULL;
+
+- spin_lock(&zmd->mblk_lock);
+- atomic_inc(&mblk->ref);
+- set_bit(DMZ_META_READING, &mblk->state);
+- dmz_insert_mblock(zmd, mblk);
+- spin_unlock(&zmd->mblk_lock);
+-
+ bio = bio_alloc(GFP_NOIO, 1);
+ if (!bio) {
+ dmz_free_mblock(zmd, mblk);
+ return NULL;
+ }
+
++ spin_lock(&zmd->mblk_lock);
++
++ /*
++ * Make sure that another context did not start reading
++ * the block already.
++ */
++ m = dmz_get_mblock_fast(zmd, mblk_no);
++ if (m) {
++ spin_unlock(&zmd->mblk_lock);
++ dmz_free_mblock(zmd, mblk);
++ bio_put(bio);
++ return m;
++ }
++
++ mblk->ref++;
++ set_bit(DMZ_META_READING, &mblk->state);
++ dmz_insert_mblock(zmd, mblk);
++
++ spin_unlock(&zmd->mblk_lock);
++
++ /* Submit read BIO */
+ bio->bi_iter.bi_sector = dmz_blk2sect(block);
+ bio_set_dev(bio, zmd->dev->bdev);
+ bio->bi_private = mblk;
+@@ -484,7 +509,8 @@ static void dmz_release_mblock(struct dmz_metadata *zmd,
+
+ spin_lock(&zmd->mblk_lock);
+
+- if (atomic_dec_and_test(&mblk->ref)) {
++ mblk->ref--;
++ if (mblk->ref == 0) {
+ if (test_bit(DMZ_META_ERROR, &mblk->state)) {
+ rb_erase(&mblk->node, &zmd->mblk_rbtree);
+ dmz_free_mblock(zmd, mblk);
+@@ -508,18 +534,12 @@ static struct dmz_mblock *dmz_get_mblock(struct dmz_metadata *zmd,
+
+ /* Check rbtree */
+ spin_lock(&zmd->mblk_lock);
+- mblk = dmz_lookup_mblock(zmd, mblk_no);
+- if (mblk) {
+- /* Cache hit: remove block from LRU list */
+- if (atomic_inc_return(&mblk->ref) == 1 &&
+- !test_bit(DMZ_META_DIRTY, &mblk->state))
+- list_del_init(&mblk->link);
+- }
++ mblk = dmz_get_mblock_fast(zmd, mblk_no);
+ spin_unlock(&zmd->mblk_lock);
+
+ if (!mblk) {
+ /* Cache miss: read the block from disk */
+- mblk = dmz_fetch_mblock(zmd, mblk_no);
++ mblk = dmz_get_mblock_slow(zmd, mblk_no);
+ if (!mblk)
+ return ERR_PTR(-ENOMEM);
+ }
+@@ -753,7 +773,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
+
+ spin_lock(&zmd->mblk_lock);
+ clear_bit(DMZ_META_DIRTY, &mblk->state);
+- if (atomic_read(&mblk->ref) == 0)
++ if (mblk->ref == 0)
+ list_add_tail(&mblk->link, &zmd->mblk_lru_list);
+ spin_unlock(&zmd->mblk_lock);
+ }
+@@ -2308,7 +2328,7 @@ static void dmz_cleanup_metadata(struct dmz_metadata *zmd)
+ mblk = list_first_entry(&zmd->mblk_dirty_list,
+ struct dmz_mblock, link);
+ dmz_dev_warn(zmd->dev, "mblock %llu still in dirty list (ref %u)",
+- (u64)mblk->no, atomic_read(&mblk->ref));
++ (u64)mblk->no, mblk->ref);
+ list_del_init(&mblk->link);
+ rb_erase(&mblk->node, &zmd->mblk_rbtree);
+ dmz_free_mblock(zmd, mblk);
+@@ -2326,8 +2346,8 @@ static void dmz_cleanup_metadata(struct dmz_metadata *zmd)
+ root = &zmd->mblk_rbtree;
+ rbtree_postorder_for_each_entry_safe(mblk, next, root, node) {
+ dmz_dev_warn(zmd->dev, "mblock %llu ref %u still in rbtree",
+- (u64)mblk->no, atomic_read(&mblk->ref));
+- atomic_set(&mblk->ref, 0);
++ (u64)mblk->no, mblk->ref);
++ mblk->ref = 0;
+ dmz_free_mblock(zmd, mblk);
+ }
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 63ceabb4e020..8668793262d0 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -452,10 +452,11 @@ static void md_end_flush(struct bio *fbio)
+ rdev_dec_pending(rdev, mddev);
+
+ if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0)
++ if (bio->bi_iter.bi_size == 0) {
+ /* an empty barrier - all done */
+ bio_endio(bio);
+- else {
++ mempool_free(fi, mddev->flush_pool);
++ } else {
+ INIT_WORK(&fi->flush_work, submit_flushes);
+ queue_work(md_wq, &fi->flush_work);
+ }
+@@ -509,10 +510,11 @@ void md_flush_request(struct mddev *mddev, struct bio *bio)
+ rcu_read_unlock();
+
+ if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0)
++ if (bio->bi_iter.bi_size == 0) {
+ /* an empty barrier - all done */
+ bio_endio(bio);
+- else {
++ mempool_free(fi, mddev->flush_pool);
++ } else {
+ INIT_WORK(&fi->flush_work, submit_flushes);
+ queue_work(md_wq, &fi->flush_work);
+ }
+@@ -5904,14 +5906,6 @@ static void __md_stop(struct mddev *mddev)
+ mddev->to_remove = &md_redundancy_group;
+ module_put(pers->owner);
+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+-}
+-
+-void md_stop(struct mddev *mddev)
+-{
+- /* stop the array and free an attached data structures.
+- * This is called from dm-raid
+- */
+- __md_stop(mddev);
+ if (mddev->flush_bio_pool) {
+ mempool_destroy(mddev->flush_bio_pool);
+ mddev->flush_bio_pool = NULL;
+@@ -5920,6 +5914,14 @@ void md_stop(struct mddev *mddev)
+ mempool_destroy(mddev->flush_pool);
+ mddev->flush_pool = NULL;
+ }
++}
++
++void md_stop(struct mddev *mddev)
++{
++ /* stop the array and free an attached data structures.
++ * This is called from dm-raid
++ */
++ __md_stop(mddev);
+ bioset_exit(&mddev->bio_set);
+ bioset_exit(&mddev->sync_set);
+ }
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 4e990246225e..1d54109071cc 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1734,6 +1734,7 @@ static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ */
+ if (rdev->saved_raid_disk >= 0 &&
+ rdev->saved_raid_disk >= first &&
++ rdev->saved_raid_disk < conf->raid_disks &&
+ conf->mirrors[rdev->saved_raid_disk].rdev == NULL)
+ first = last = rdev->saved_raid_disk;
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index d6f7978b4449..811427e53126 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1808,6 +1808,7 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ first = last = rdev->raid_disk;
+
+ if (rdev->saved_raid_disk >= first &&
++ rdev->saved_raid_disk < conf->geo.raid_disks &&
+ conf->mirrors[rdev->saved_raid_disk].rdev == NULL)
+ mirror = rdev->saved_raid_disk;
+ else
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index 030b2602faf0..dd8bad74a1f0 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -341,7 +341,7 @@ static void cec_data_completed(struct cec_data *data)
+ *
+ * This function is called with adap->lock held.
+ */
+-static void cec_data_cancel(struct cec_data *data)
++static void cec_data_cancel(struct cec_data *data, u8 tx_status)
+ {
+ /*
+ * It's either the current transmit, or it is a pending
+@@ -356,13 +356,11 @@ static void cec_data_cancel(struct cec_data *data)
+ }
+
+ if (data->msg.tx_status & CEC_TX_STATUS_OK) {
+- /* Mark the canceled RX as a timeout */
+ data->msg.rx_ts = ktime_get_ns();
+- data->msg.rx_status = CEC_RX_STATUS_TIMEOUT;
++ data->msg.rx_status = CEC_RX_STATUS_ABORTED;
+ } else {
+- /* Mark the canceled TX as an error */
+ data->msg.tx_ts = ktime_get_ns();
+- data->msg.tx_status |= CEC_TX_STATUS_ERROR |
++ data->msg.tx_status |= tx_status |
+ CEC_TX_STATUS_MAX_RETRIES;
+ data->msg.tx_error_cnt++;
+ data->attempts = 0;
+@@ -390,15 +388,15 @@ static void cec_flush(struct cec_adapter *adap)
+ while (!list_empty(&adap->transmit_queue)) {
+ data = list_first_entry(&adap->transmit_queue,
+ struct cec_data, list);
+- cec_data_cancel(data);
++ cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
+ }
+ if (adap->transmitting)
+- cec_data_cancel(adap->transmitting);
++ cec_data_cancel(adap->transmitting, CEC_TX_STATUS_ABORTED);
+
+ /* Cancel the pending timeout work. */
+ list_for_each_entry_safe(data, n, &adap->wait_queue, list) {
+ if (cancel_delayed_work(&data->work))
+- cec_data_cancel(data);
++ cec_data_cancel(data, CEC_TX_STATUS_OK);
+ /*
+ * If cancel_delayed_work returned false, then
+ * the cec_wait_timeout function is running,
+@@ -474,12 +472,13 @@ int cec_thread_func(void *_adap)
+ * so much traffic on the bus that the adapter was
+ * unable to transmit for CEC_XFER_TIMEOUT_MS (2.1s).
+ */
+- dprintk(1, "%s: message %*ph timed out\n", __func__,
++ pr_warn("cec-%s: message %*ph timed out\n", adap->name,
+ adap->transmitting->msg.len,
+ adap->transmitting->msg.msg);
+ adap->tx_timeouts++;
+ /* Just give up on this. */
+- cec_data_cancel(adap->transmitting);
++ cec_data_cancel(adap->transmitting,
++ CEC_TX_STATUS_TIMEOUT);
+ goto unlock;
+ }
+
+@@ -514,9 +513,11 @@ int cec_thread_func(void *_adap)
+ if (data->attempts) {
+ /* should be >= 3 data bit periods for a retry */
+ signal_free_time = CEC_SIGNAL_FREE_TIME_RETRY;
+- } else if (data->new_initiator) {
++ } else if (adap->last_initiator !=
++ cec_msg_initiator(&data->msg)) {
+ /* should be >= 5 data bit periods for new initiator */
+ signal_free_time = CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
++ adap->last_initiator = cec_msg_initiator(&data->msg);
+ } else {
+ /*
+ * should be >= 7 data bit periods for sending another
+@@ -530,7 +531,7 @@ int cec_thread_func(void *_adap)
+ /* Tell the adapter to transmit, cancel on error */
+ if (adap->ops->adap_transmit(adap, data->attempts,
+ signal_free_time, &data->msg))
+- cec_data_cancel(data);
++ cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
+
+ unlock:
+ mutex_unlock(&adap->lock);
+@@ -701,9 +702,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ struct cec_fh *fh, bool block)
+ {
+ struct cec_data *data;
+- u8 last_initiator = 0xff;
+- unsigned int timeout;
+- int res = 0;
+
+ msg->rx_ts = 0;
+ msg->tx_ts = 0;
+@@ -813,23 +811,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ data->adap = adap;
+ data->blocking = block;
+
+- /*
+- * Determine if this message follows a message from the same
+- * initiator. Needed to determine the free signal time later on.
+- */
+- if (msg->len > 1) {
+- if (!(list_empty(&adap->transmit_queue))) {
+- const struct cec_data *last;
+-
+- last = list_last_entry(&adap->transmit_queue,
+- const struct cec_data, list);
+- last_initiator = cec_msg_initiator(&last->msg);
+- } else if (adap->transmitting) {
+- last_initiator =
+- cec_msg_initiator(&adap->transmitting->msg);
+- }
+- }
+- data->new_initiator = last_initiator != cec_msg_initiator(msg);
+ init_completion(&data->c);
+ INIT_DELAYED_WORK(&data->work, cec_wait_timeout);
+
+@@ -845,48 +826,23 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ if (!block)
+ return 0;
+
+- /*
+- * If we don't get a completion before this time something is really
+- * wrong and we time out.
+- */
+- timeout = CEC_XFER_TIMEOUT_MS;
+- /* Add the requested timeout if we have to wait for a reply as well */
+- if (msg->timeout)
+- timeout += msg->timeout;
+-
+ /*
+ * Release the lock and wait, retake the lock afterwards.
+ */
+ mutex_unlock(&adap->lock);
+- res = wait_for_completion_killable_timeout(&data->c,
+- msecs_to_jiffies(timeout));
++ wait_for_completion_killable(&data->c);
++ if (!data->completed)
++ cancel_delayed_work_sync(&data->work);
+ mutex_lock(&adap->lock);
+
+- if (data->completed) {
+- /* The transmit completed (possibly with an error) */
+- *msg = data->msg;
+- kfree(data);
+- return 0;
+- }
+- /*
+- * The wait for completion timed out or was interrupted, so mark this
+- * as non-blocking and disconnect from the filehandle since it is
+- * still 'in flight'. When it finally completes it will just drop the
+- * result silently.
+- */
+- data->blocking = false;
+- if (data->fh)
+- list_del(&data->xfer_list);
+- data->fh = NULL;
++ /* Cancel the transmit if it was interrupted */
++ if (!data->completed)
++ cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
+
+- if (res == 0) { /* timed out */
+- /* Check if the reply or the transmit failed */
+- if (msg->timeout && (msg->tx_status & CEC_TX_STATUS_OK))
+- msg->rx_status = CEC_RX_STATUS_TIMEOUT;
+- else
+- msg->tx_status = CEC_TX_STATUS_MAX_RETRIES;
+- }
+- return res > 0 ? 0 : res;
++ /* The transmit completed (possibly with an error) */
++ *msg = data->msg;
++ kfree(data);
++ return 0;
+ }
+
+ /* Helper function to be used by drivers and this framework. */
+@@ -1044,6 +1000,8 @@ void cec_received_msg_ts(struct cec_adapter *adap,
+ mutex_lock(&adap->lock);
+ dprintk(2, "%s: %*ph\n", __func__, msg->len, msg->msg);
+
++ adap->last_initiator = 0xff;
++
+ /* Check if this message was for us (directed or broadcast). */
+ if (!cec_msg_is_broadcast(msg))
+ valid_la = cec_has_log_addr(adap, msg_dest);
+@@ -1506,6 +1464,8 @@ void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
+ }
+
+ mutex_lock(&adap->devnode.lock);
++ adap->last_initiator = 0xff;
++
+ if ((adap->needs_hpd || list_empty(&adap->devnode.fhs)) &&
+ adap->ops->adap_enable(adap, true)) {
+ mutex_unlock(&adap->devnode.lock);
+diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
+index b6536bbad530..4961573850d5 100644
+--- a/drivers/media/cec/cec-api.c
++++ b/drivers/media/cec/cec-api.c
+@@ -101,6 +101,23 @@ static long cec_adap_g_phys_addr(struct cec_adapter *adap,
+ return 0;
+ }
+
++static int cec_validate_phys_addr(u16 phys_addr)
++{
++ int i;
++
++ if (phys_addr == CEC_PHYS_ADDR_INVALID)
++ return 0;
++ for (i = 0; i < 16; i += 4)
++ if (phys_addr & (0xf << i))
++ break;
++ if (i == 16)
++ return 0;
++ for (i += 4; i < 16; i += 4)
++ if ((phys_addr & (0xf << i)) == 0)
++ return -EINVAL;
++ return 0;
++}
++
+ static long cec_adap_s_phys_addr(struct cec_adapter *adap, struct cec_fh *fh,
+ bool block, __u16 __user *parg)
+ {
+@@ -112,7 +129,7 @@ static long cec_adap_s_phys_addr(struct cec_adapter *adap, struct cec_fh *fh,
+ if (copy_from_user(&phys_addr, parg, sizeof(phys_addr)))
+ return -EFAULT;
+
+- err = cec_phys_addr_validate(phys_addr, NULL, NULL);
++ err = cec_validate_phys_addr(phys_addr);
+ if (err)
+ return err;
+ mutex_lock(&adap->lock);
+diff --git a/drivers/media/cec/cec-edid.c b/drivers/media/cec/cec-edid.c
+index ec72ac1c0b91..f587e8eaefd8 100644
+--- a/drivers/media/cec/cec-edid.c
++++ b/drivers/media/cec/cec-edid.c
+@@ -10,66 +10,6 @@
+ #include <linux/types.h>
+ #include <media/cec.h>
+
+-/*
+- * This EDID is expected to be a CEA-861 compliant, which means that there are
+- * at least two blocks and one or more of the extensions blocks are CEA-861
+- * blocks.
+- *
+- * The returned location is guaranteed to be < size - 1.
+- */
+-static unsigned int cec_get_edid_spa_location(const u8 *edid, unsigned int size)
+-{
+- unsigned int blocks = size / 128;
+- unsigned int block;
+- u8 d;
+-
+- /* Sanity check: at least 2 blocks and a multiple of the block size */
+- if (blocks < 2 || size % 128)
+- return 0;
+-
+- /*
+- * If there are fewer extension blocks than the size, then update
+- * 'blocks'. It is allowed to have more extension blocks than the size,
+- * since some hardware can only read e.g. 256 bytes of the EDID, even
+- * though more blocks are present. The first CEA-861 extension block
+- * should normally be in block 1 anyway.
+- */
+- if (edid[0x7e] + 1 < blocks)
+- blocks = edid[0x7e] + 1;
+-
+- for (block = 1; block < blocks; block++) {
+- unsigned int offset = block * 128;
+-
+- /* Skip any non-CEA-861 extension blocks */
+- if (edid[offset] != 0x02 || edid[offset + 1] != 0x03)
+- continue;
+-
+- /* search Vendor Specific Data Block (tag 3) */
+- d = edid[offset + 2] & 0x7f;
+- /* Check if there are Data Blocks */
+- if (d <= 4)
+- continue;
+- if (d > 4) {
+- unsigned int i = offset + 4;
+- unsigned int end = offset + d;
+-
+- /* Note: 'end' is always < 'size' */
+- do {
+- u8 tag = edid[i] >> 5;
+- u8 len = edid[i] & 0x1f;
+-
+- if (tag == 3 && len >= 5 && i + len <= end &&
+- edid[i + 1] == 0x03 &&
+- edid[i + 2] == 0x0c &&
+- edid[i + 3] == 0x00)
+- return i + 4;
+- i += len + 1;
+- } while (i < end);
+- }
+- }
+- return 0;
+-}
+-
+ u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
+ unsigned int *offset)
+ {
+diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c
+index 3a3dc23c560c..a4341205c197 100644
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c
+@@ -602,14 +602,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][5] = { 3138, 657, 810 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][6] = { 731, 680, 3048 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][1] = { 3046, 3054, 886 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][2] = { 0, 3058, 3031 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][3] = { 360, 3079, 877 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][4] = { 3103, 587, 3027 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][5] = { 3116, 723, 861 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][6] = { 789, 744, 3025 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][1] = { 3046, 3054, 886 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][2] = { 0, 3058, 3031 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][3] = { 360, 3079, 877 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][4] = { 3103, 587, 3027 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][5] = { 3116, 723, 861 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][6] = { 789, 744, 3025 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2941, 2950, 546 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][2] = { 0, 2954, 2924 },
+@@ -658,14 +658,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][5] = { 3138, 657, 810 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][6] = { 731, 680, 3048 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][1] = { 3046, 3054, 886 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][2] = { 0, 3058, 3031 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][3] = { 360, 3079, 877 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][4] = { 3103, 587, 3027 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][5] = { 3116, 723, 861 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][6] = { 789, 744, 3025 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][1] = { 3046, 3054, 886 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][2] = { 0, 3058, 3031 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][3] = { 360, 3079, 877 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][4] = { 3103, 587, 3027 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][5] = { 3116, 723, 861 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][6] = { 789, 744, 3025 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2941, 2950, 546 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][2] = { 0, 2954, 2924 },
+@@ -714,14 +714,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][5] = { 3056, 800, 800 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3056 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 851 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][2] = { 851, 3033, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][3] = { 851, 3033, 851 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][4] = { 3033, 851, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][5] = { 3033, 851, 851 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][2] = { 851, 3033, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][3] = { 851, 3033, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][4] = { 3033, 851, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][5] = { 3033, 851, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 507 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][2] = { 507, 2926, 2926 },
+@@ -770,14 +770,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][5] = { 2599, 901, 909 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][6] = { 991, 0, 2966 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][1] = { 2989, 3120, 1180 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][2] = { 1913, 3011, 3009 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][3] = { 1836, 3099, 1105 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][4] = { 2627, 413, 2966 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][5] = { 2576, 943, 951 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][6] = { 1026, 0, 2942 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][1] = { 2989, 3120, 1180 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][2] = { 1913, 3011, 3009 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][3] = { 1836, 3099, 1105 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][4] = { 2627, 413, 2966 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][5] = { 2576, 943, 951 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][6] = { 1026, 0, 2942 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2879, 3022, 874 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][2] = { 1688, 2903, 2901 },
+@@ -826,14 +826,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][5] = { 3001, 800, 799 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3071 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 799 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 776 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][2] = { 1068, 3033, 3033 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][3] = { 1068, 3033, 776 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][4] = { 2977, 851, 3048 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][5] = { 2977, 851, 851 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3048 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 776 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][2] = { 1068, 3033, 3033 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][3] = { 1068, 3033, 776 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][4] = { 2977, 851, 3048 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][5] = { 2977, 851, 851 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3048 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 423 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][2] = { 749, 2926, 2926 },
+@@ -882,14 +882,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][5] = { 3056, 800, 800 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3056 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 851 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][2] = { 851, 3033, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][3] = { 851, 3033, 851 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][4] = { 3033, 851, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][5] = { 3033, 851, 851 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][2] = { 851, 3033, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][3] = { 851, 3033, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][4] = { 3033, 851, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][5] = { 3033, 851, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 507 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 507, 2926, 2926 },
+@@ -922,62 +922,62 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1812, 886, 886 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1812 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][1] = { 2939, 2939, 781 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][2] = { 1622, 2939, 2939 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][3] = { 1622, 2939, 781 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][4] = { 2502, 547, 2881 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][5] = { 2502, 547, 547 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][6] = { 547, 547, 2881 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][7] = { 547, 547, 547 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][0] = { 3056, 3056, 3056 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][1] = { 3056, 3056, 1031 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][2] = { 1838, 3056, 3056 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][3] = { 1838, 3056, 1031 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][4] = { 2657, 800, 3002 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][5] = { 2657, 800, 800 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3002 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 1063 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][2] = { 1828, 3033, 3033 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][3] = { 1828, 3033, 1063 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][4] = { 2633, 851, 2979 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][5] = { 2633, 851, 851 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 2979 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 744 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 1594, 2926, 2926 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][3] = { 1594, 2926, 744 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][4] = { 2484, 507, 2867 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][5] = { 2484, 507, 507 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][6] = { 507, 507, 2867 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][7] = { 507, 507, 507 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][0] = { 2125, 2125, 2125 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][1] = { 2125, 2125, 212 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][2] = { 698, 2125, 2125 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][3] = { 698, 2125, 212 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][4] = { 1557, 130, 2043 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][5] = { 1557, 130, 130 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][6] = { 130, 130, 2043 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][7] = { 130, 130, 130 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][0] = { 3175, 3175, 3175 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][1] = { 3175, 3175, 1308 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][2] = { 2069, 3175, 3175 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][3] = { 2069, 3175, 1308 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][4] = { 2816, 1084, 3127 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][5] = { 2816, 1084, 1084 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][6] = { 1084, 1084, 3127 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][7] = { 1084, 1084, 1084 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][0] = { 1812, 1812, 1812 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][1] = { 1812, 1812, 1022 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][2] = { 1402, 1812, 1812 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][3] = { 1402, 1812, 1022 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][4] = { 1692, 886, 1797 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1692, 886, 886 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1797 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][1] = { 2939, 2939, 781 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][2] = { 1622, 2939, 2939 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][3] = { 1622, 2939, 781 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][4] = { 2502, 547, 2881 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][5] = { 2502, 547, 547 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][6] = { 547, 547, 2881 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][7] = { 547, 547, 547 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][0] = { 3056, 3056, 3056 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][1] = { 3056, 3056, 1031 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][2] = { 1838, 3056, 3056 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][3] = { 1838, 3056, 1031 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][4] = { 2657, 800, 3002 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][5] = { 2657, 800, 800 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3002 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 1063 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][2] = { 1828, 3033, 3033 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][3] = { 1828, 3033, 1063 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][4] = { 2633, 851, 2979 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][5] = { 2633, 851, 851 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 2979 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 744 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 1594, 2926, 2926 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][3] = { 1594, 2926, 744 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][4] = { 2484, 507, 2867 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][5] = { 2484, 507, 507 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][6] = { 507, 507, 2867 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][7] = { 507, 507, 507 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][0] = { 2125, 2125, 2125 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][1] = { 2125, 2125, 212 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][2] = { 698, 2125, 2125 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][3] = { 698, 2125, 212 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][4] = { 1557, 130, 2043 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][5] = { 1557, 130, 130 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][6] = { 130, 130, 2043 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][7] = { 130, 130, 130 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][0] = { 3175, 3175, 3175 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][1] = { 3175, 3175, 1308 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][2] = { 2069, 3175, 3175 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][3] = { 2069, 3175, 1308 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][4] = { 2816, 1084, 3127 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][5] = { 2816, 1084, 1084 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][6] = { 1084, 1084, 3127 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][7] = { 1084, 1084, 1084 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][0] = { 1812, 1812, 1812 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][1] = { 1812, 1812, 1022 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][2] = { 1402, 1812, 1812 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][3] = { 1402, 1812, 1022 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][4] = { 1692, 886, 1797 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1692, 886, 886 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1797 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][1] = { 2877, 2923, 1058 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][2] = { 1837, 2840, 2916 },
+@@ -994,14 +994,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][5] = { 2517, 1159, 900 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][6] = { 1042, 870, 2917 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][1] = { 2976, 3018, 1315 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][2] = { 2024, 2942, 3011 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][3] = { 1930, 2926, 1256 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][4] = { 2563, 1227, 2916 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][5] = { 2494, 1183, 943 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][6] = { 1073, 916, 2894 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][1] = { 2976, 3018, 1315 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][2] = { 2024, 2942, 3011 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][3] = { 1930, 2926, 1256 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][4] = { 2563, 1227, 2916 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][5] = { 2494, 1183, 943 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][6] = { 1073, 916, 2894 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][1] = { 2864, 2910, 1024 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][2] = { 1811, 2826, 2903 },
+@@ -1050,14 +1050,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][5] = { 2880, 998, 902 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][6] = { 816, 823, 2940 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 799 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][1] = { 3029, 3028, 1255 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][2] = { 1406, 2988, 3011 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][3] = { 1398, 2983, 1190 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][4] = { 2860, 1050, 2939 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][5] = { 2857, 1033, 945 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][6] = { 866, 873, 2916 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][1] = { 3029, 3028, 1255 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][2] = { 1406, 2988, 3011 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][3] = { 1398, 2983, 1190 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][4] = { 2860, 1050, 2939 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][5] = { 2857, 1033, 945 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][6] = { 866, 873, 2916 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][1] = { 2923, 2921, 957 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][2] = { 1125, 2877, 2902 },
+@@ -1128,7 +1128,7 @@ static const double rec709_to_240m[3][3] = {
+ { 0.0016327, 0.0044133, 0.9939540 },
+ };
+
+-static const double rec709_to_adobergb[3][3] = {
++static const double rec709_to_oprgb[3][3] = {
+ { 0.7151627, 0.2848373, -0.0000000 },
+ { 0.0000000, 1.0000000, 0.0000000 },
+ { -0.0000000, 0.0411705, 0.9588295 },
+@@ -1195,7 +1195,7 @@ static double transfer_rec709_to_rgb(double v)
+ return (v < 0.081) ? v / 4.5 : pow((v + 0.099) / 1.099, 1.0 / 0.45);
+ }
+
+-static double transfer_rgb_to_adobergb(double v)
++static double transfer_rgb_to_oprgb(double v)
+ {
+ return pow(v, 1.0 / 2.19921875);
+ }
+@@ -1251,8 +1251,8 @@ static void csc(enum v4l2_colorspace colorspace, enum v4l2_xfer_func xfer_func,
+ case V4L2_COLORSPACE_470_SYSTEM_M:
+ mult_matrix(r, g, b, rec709_to_ntsc1953);
+ break;
+- case V4L2_COLORSPACE_ADOBERGB:
+- mult_matrix(r, g, b, rec709_to_adobergb);
++ case V4L2_COLORSPACE_OPRGB:
++ mult_matrix(r, g, b, rec709_to_oprgb);
+ break;
+ case V4L2_COLORSPACE_BT2020:
+ mult_matrix(r, g, b, rec709_to_bt2020);
+@@ -1284,10 +1284,10 @@ static void csc(enum v4l2_colorspace colorspace, enum v4l2_xfer_func xfer_func,
+ *g = transfer_rgb_to_srgb(*g);
+ *b = transfer_rgb_to_srgb(*b);
+ break;
+- case V4L2_XFER_FUNC_ADOBERGB:
+- *r = transfer_rgb_to_adobergb(*r);
+- *g = transfer_rgb_to_adobergb(*g);
+- *b = transfer_rgb_to_adobergb(*b);
++ case V4L2_XFER_FUNC_OPRGB:
++ *r = transfer_rgb_to_oprgb(*r);
++ *g = transfer_rgb_to_oprgb(*g);
++ *b = transfer_rgb_to_oprgb(*b);
+ break;
+ case V4L2_XFER_FUNC_DCI_P3:
+ *r = transfer_rgb_to_dcip3(*r);
+@@ -1321,7 +1321,7 @@ int main(int argc, char **argv)
+ V4L2_COLORSPACE_470_SYSTEM_BG,
+ 0,
+ V4L2_COLORSPACE_SRGB,
+- V4L2_COLORSPACE_ADOBERGB,
++ V4L2_COLORSPACE_OPRGB,
+ V4L2_COLORSPACE_BT2020,
+ 0,
+ V4L2_COLORSPACE_DCI_P3,
+@@ -1336,7 +1336,7 @@ int main(int argc, char **argv)
+ "V4L2_COLORSPACE_470_SYSTEM_BG",
+ "",
+ "V4L2_COLORSPACE_SRGB",
+- "V4L2_COLORSPACE_ADOBERGB",
++ "V4L2_COLORSPACE_OPRGB",
+ "V4L2_COLORSPACE_BT2020",
+ "",
+ "V4L2_COLORSPACE_DCI_P3",
+@@ -1345,7 +1345,7 @@ int main(int argc, char **argv)
+ "",
+ "V4L2_XFER_FUNC_709",
+ "V4L2_XFER_FUNC_SRGB",
+- "V4L2_XFER_FUNC_ADOBERGB",
++ "V4L2_XFER_FUNC_OPRGB",
+ "V4L2_XFER_FUNC_SMPTE240M",
+ "V4L2_XFER_FUNC_NONE",
+ "V4L2_XFER_FUNC_DCI_P3",
+diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+index abd4c788dffd..f40ab5704bf0 100644
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+@@ -1770,7 +1770,7 @@ typedef struct { u16 __; u8 _; } __packed x24;
+ pos[7] = (chr & (0x01 << 0) ? fg : bg); \
+ } \
+ \
+- pos += (tpg->hflip ? -8 : 8) / hdiv; \
++ pos += (tpg->hflip ? -8 : 8) / (int)hdiv; \
+ } \
+ } \
+ } while (0)
+diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
+index 55c2ea0720d9..f3899cc84e27 100644
+--- a/drivers/media/i2c/adv7511.c
++++ b/drivers/media/i2c/adv7511.c
+@@ -1355,10 +1355,10 @@ static int adv7511_set_fmt(struct v4l2_subdev *sd,
+ state->xfer_func = format->format.xfer_func;
+
+ switch (format->format.colorspace) {
+- case V4L2_COLORSPACE_ADOBERGB:
++ case V4L2_COLORSPACE_OPRGB:
+ c = HDMI_COLORIMETRY_EXTENDED;
+- ec = y ? HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601 :
+- HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB;
++ ec = y ? HDMI_EXTENDED_COLORIMETRY_OPYCC_601 :
++ HDMI_EXTENDED_COLORIMETRY_OPRGB;
+ break;
+ case V4L2_COLORSPACE_SMPTE170M:
+ c = y ? HDMI_COLORIMETRY_ITU_601 : HDMI_COLORIMETRY_NONE;
+diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
+index 668be2bca57a..c78698199ac5 100644
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -2284,8 +2284,10 @@ static int adv76xx_set_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid)
+ state->aspect_ratio.numerator = 16;
+ state->aspect_ratio.denominator = 9;
+
+- if (!state->edid.present)
++ if (!state->edid.present) {
+ state->edid.blocks = 0;
++ cec_phys_addr_invalidate(state->cec_adap);
++ }
+
+ v4l2_dbg(2, debug, sd, "%s: clear EDID pad %d, edid.present = 0x%x\n",
+ __func__, edid->pad, state->edid.present);
+@@ -2474,7 +2476,7 @@ static int adv76xx_log_status(struct v4l2_subdev *sd)
+ "YCbCr Bt.601 (16-235)", "YCbCr Bt.709 (16-235)",
+ "xvYCC Bt.601", "xvYCC Bt.709",
+ "YCbCr Bt.601 (0-255)", "YCbCr Bt.709 (0-255)",
+- "sYCC", "Adobe YCC 601", "AdobeRGB", "invalid", "invalid",
++ "sYCC", "opYCC 601", "opRGB", "invalid", "invalid",
+ "invalid", "invalid", "invalid"
+ };
+ static const char * const rgb_quantization_range_txt[] = {
+diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
+index 4f8fbdd00e35..71fe56565f75 100644
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -786,8 +786,10 @@ static int edid_write_hdmi_segment(struct v4l2_subdev *sd, u8 port)
+ /* Disable I2C access to internal EDID ram from HDMI DDC ports */
+ rep_write_and_or(sd, 0x77, 0xf3, 0x00);
+
+- if (!state->hdmi_edid.present)
++ if (!state->hdmi_edid.present) {
++ cec_phys_addr_invalidate(state->cec_adap);
+ return 0;
++ }
+
+ pa = cec_get_edid_phys_addr(edid, 256, &spa_loc);
+ err = cec_phys_addr_validate(pa, &pa, NULL);
+diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
+index 31bf577b0bd3..64d1402882c8 100644
+--- a/drivers/media/i2c/ov7670.c
++++ b/drivers/media/i2c/ov7670.c
+@@ -1808,17 +1808,24 @@ static int ov7670_probe(struct i2c_client *client,
+ info->pclk_hb_disable = true;
+ }
+
+- info->clk = devm_clk_get(&client->dev, "xclk");
+- if (IS_ERR(info->clk))
+- return PTR_ERR(info->clk);
+- ret = clk_prepare_enable(info->clk);
+- if (ret)
+- return ret;
++ info->clk = devm_clk_get(&client->dev, "xclk"); /* optional */
++ if (IS_ERR(info->clk)) {
++ ret = PTR_ERR(info->clk);
++ if (ret == -ENOENT)
++ info->clk = NULL;
++ else
++ return ret;
++ }
++ if (info->clk) {
++ ret = clk_prepare_enable(info->clk);
++ if (ret)
++ return ret;
+
+- info->clock_speed = clk_get_rate(info->clk) / 1000000;
+- if (info->clock_speed < 10 || info->clock_speed > 48) {
+- ret = -EINVAL;
+- goto clk_disable;
++ info->clock_speed = clk_get_rate(info->clk) / 1000000;
++ if (info->clock_speed < 10 || info->clock_speed > 48) {
++ ret = -EINVAL;
++ goto clk_disable;
++ }
+ }
+
+ ret = ov7670_init_gpio(client, info);
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index 44c41933415a..ff25ea9aca48 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1243,9 +1243,9 @@ static int tc358743_log_status(struct v4l2_subdev *sd)
+ u8 vi_status3 = i2c_rd8(sd, VI_STATUS3);
+ const int deep_color_mode[4] = { 8, 10, 12, 16 };
+ static const char * const input_color_space[] = {
+- "RGB", "YCbCr 601", "Adobe RGB", "YCbCr 709", "NA (4)",
++ "RGB", "YCbCr 601", "opRGB", "YCbCr 709", "NA (4)",
+ "xvYCC 601", "NA(6)", "xvYCC 709", "NA(8)", "sYCC601",
+- "NA(10)", "NA(11)", "NA(12)", "Adobe YCC 601"};
++ "NA(10)", "NA(11)", "NA(12)", "opYCC 601"};
+
+ v4l2_info(sd, "-----Chip status-----\n");
+ v4l2_info(sd, "Chip ID: 0x%02x\n",
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 76e6bed5a1da..805bd9c65940 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -1534,7 +1534,7 @@ static int tvp5150_probe(struct i2c_client *c,
+ 27000000, 1, 27000000);
+ v4l2_ctrl_new_std_menu_items(&core->hdl, &tvp5150_ctrl_ops,
+ V4L2_CID_TEST_PATTERN,
+- ARRAY_SIZE(tvp5150_test_patterns),
++ ARRAY_SIZE(tvp5150_test_patterns) - 1,
+ 0, 0, tvp5150_test_patterns);
+ sd->ctrl_handler = &core->hdl;
+ if (core->hdl.error) {
+diff --git a/drivers/media/platform/vivid/vivid-core.h b/drivers/media/platform/vivid/vivid-core.h
+index 477c80a4d44c..cd4c8230563c 100644
+--- a/drivers/media/platform/vivid/vivid-core.h
++++ b/drivers/media/platform/vivid/vivid-core.h
+@@ -111,7 +111,7 @@ enum vivid_colorspace {
+ VIVID_CS_170M,
+ VIVID_CS_709,
+ VIVID_CS_SRGB,
+- VIVID_CS_ADOBERGB,
++ VIVID_CS_OPRGB,
+ VIVID_CS_2020,
+ VIVID_CS_DCI_P3,
+ VIVID_CS_240M,
+diff --git a/drivers/media/platform/vivid/vivid-ctrls.c b/drivers/media/platform/vivid/vivid-ctrls.c
+index 5429193fbb91..999aa101b150 100644
+--- a/drivers/media/platform/vivid/vivid-ctrls.c
++++ b/drivers/media/platform/vivid/vivid-ctrls.c
+@@ -348,7 +348,7 @@ static int vivid_vid_cap_s_ctrl(struct v4l2_ctrl *ctrl)
+ V4L2_COLORSPACE_SMPTE170M,
+ V4L2_COLORSPACE_REC709,
+ V4L2_COLORSPACE_SRGB,
+- V4L2_COLORSPACE_ADOBERGB,
++ V4L2_COLORSPACE_OPRGB,
+ V4L2_COLORSPACE_BT2020,
+ V4L2_COLORSPACE_DCI_P3,
+ V4L2_COLORSPACE_SMPTE240M,
+@@ -729,7 +729,7 @@ static const char * const vivid_ctrl_colorspace_strings[] = {
+ "SMPTE 170M",
+ "Rec. 709",
+ "sRGB",
+- "AdobeRGB",
++ "opRGB",
+ "BT.2020",
+ "DCI-P3",
+ "SMPTE 240M",
+@@ -752,7 +752,7 @@ static const char * const vivid_ctrl_xfer_func_strings[] = {
+ "Default",
+ "Rec. 709",
+ "sRGB",
+- "AdobeRGB",
++ "opRGB",
+ "SMPTE 240M",
+ "None",
+ "DCI-P3",
+diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
+index 51fec66d8d45..50248e2176a0 100644
+--- a/drivers/media/platform/vivid/vivid-vid-out.c
++++ b/drivers/media/platform/vivid/vivid-vid-out.c
+@@ -413,7 +413,7 @@ int vivid_try_fmt_vid_out(struct file *file, void *priv,
+ mp->colorspace = V4L2_COLORSPACE_SMPTE170M;
+ } else if (mp->colorspace != V4L2_COLORSPACE_SMPTE170M &&
+ mp->colorspace != V4L2_COLORSPACE_REC709 &&
+- mp->colorspace != V4L2_COLORSPACE_ADOBERGB &&
++ mp->colorspace != V4L2_COLORSPACE_OPRGB &&
+ mp->colorspace != V4L2_COLORSPACE_BT2020 &&
+ mp->colorspace != V4L2_COLORSPACE_SRGB) {
+ mp->colorspace = V4L2_COLORSPACE_REC709;
+diff --git a/drivers/media/usb/dvb-usb-v2/dvbsky.c b/drivers/media/usb/dvb-usb-v2/dvbsky.c
+index 1aa88d94e57f..e28bd8836751 100644
+--- a/drivers/media/usb/dvb-usb-v2/dvbsky.c
++++ b/drivers/media/usb/dvb-usb-v2/dvbsky.c
+@@ -31,6 +31,7 @@ MODULE_PARM_DESC(disable_rc, "Disable inbuilt IR receiver.");
+ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+
+ struct dvbsky_state {
++ struct mutex stream_mutex;
+ u8 ibuf[DVBSKY_BUF_LEN];
+ u8 obuf[DVBSKY_BUF_LEN];
+ u8 last_lock;
+@@ -67,17 +68,18 @@ static int dvbsky_usb_generic_rw(struct dvb_usb_device *d,
+
+ static int dvbsky_stream_ctrl(struct dvb_usb_device *d, u8 onoff)
+ {
++ struct dvbsky_state *state = d_to_priv(d);
+ int ret;
+- static u8 obuf_pre[3] = { 0x37, 0, 0 };
+- static u8 obuf_post[3] = { 0x36, 3, 0 };
++ u8 obuf_pre[3] = { 0x37, 0, 0 };
++ u8 obuf_post[3] = { 0x36, 3, 0 };
+
+- mutex_lock(&d->usb_mutex);
+- ret = dvb_usbv2_generic_rw_locked(d, obuf_pre, 3, NULL, 0);
++ mutex_lock(&state->stream_mutex);
++ ret = dvbsky_usb_generic_rw(d, obuf_pre, 3, NULL, 0);
+ if (!ret && onoff) {
+ msleep(20);
+- ret = dvb_usbv2_generic_rw_locked(d, obuf_post, 3, NULL, 0);
++ ret = dvbsky_usb_generic_rw(d, obuf_post, 3, NULL, 0);
+ }
+- mutex_unlock(&d->usb_mutex);
++ mutex_unlock(&state->stream_mutex);
+ return ret;
+ }
+
+@@ -606,6 +608,8 @@ static int dvbsky_init(struct dvb_usb_device *d)
+ if (ret)
+ return ret;
+ */
++ mutex_init(&state->stream_mutex);
++
+ state->last_lock = 0;
+
+ return 0;
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index 71c829f31d3b..87b887b7604e 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -2141,13 +2141,13 @@ const struct em28xx_board em28xx_boards[] = {
+ .input = { {
+ .type = EM28XX_VMUX_COMPOSITE,
+ .vmux = TVP5150_COMPOSITE1,
+- .amux = EM28XX_AUDIO_SRC_LINE,
++ .amux = EM28XX_AMUX_LINE_IN,
+ .gpio = terratec_av350_unmute_gpio,
+
+ }, {
+ .type = EM28XX_VMUX_SVIDEO,
+ .vmux = TVP5150_SVIDEO,
+- .amux = EM28XX_AUDIO_SRC_LINE,
++ .amux = EM28XX_AMUX_LINE_IN,
+ .gpio = terratec_av350_unmute_gpio,
+ } },
+ },
+@@ -3039,6 +3039,9 @@ static int em28xx_hint_board(struct em28xx *dev)
+
+ static void em28xx_card_setup(struct em28xx *dev)
+ {
++ int i, j, idx;
++ bool duplicate_entry;
++
+ /*
+ * If the device can be a webcam, seek for a sensor.
+ * If sensor is not found, then it isn't a webcam.
+@@ -3195,6 +3198,32 @@ static void em28xx_card_setup(struct em28xx *dev)
+ /* Allow override tuner type by a module parameter */
+ if (tuner >= 0)
+ dev->tuner_type = tuner;
++
++ /*
++ * Dynamically generate a list of valid audio inputs for this
++ * specific board, mapping them via enum em28xx_amux.
++ */
++
++ idx = 0;
++ for (i = 0; i < MAX_EM28XX_INPUT; i++) {
++ if (!INPUT(i)->type)
++ continue;
++
++ /* Skip already mapped audio inputs */
++ duplicate_entry = false;
++ for (j = 0; j < idx; j++) {
++ if (INPUT(i)->amux == dev->amux_map[j]) {
++ duplicate_entry = true;
++ break;
++ }
++ }
++ if (duplicate_entry)
++ continue;
++
++ dev->amux_map[idx++] = INPUT(i)->amux;
++ }
++ for (; idx < MAX_EM28XX_INPUT; idx++)
++ dev->amux_map[idx] = EM28XX_AMUX_UNUSED;
+ }
+
+ void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
+diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
+index 68571bf36d28..3bf98ac897ec 100644
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1093,6 +1093,8 @@ int em28xx_start_analog_streaming(struct vb2_queue *vq, unsigned int count)
+
+ em28xx_videodbg("%s\n", __func__);
+
++ dev->v4l2->field_count = 0;
++
+ /*
+ * Make sure streaming is not already in progress for this type
+ * of filehandle (e.g. video, vbi)
+@@ -1471,9 +1473,9 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
+
+ fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+ if (!fmt) {
+- em28xx_videodbg("Fourcc format (%08x) invalid.\n",
+- f->fmt.pix.pixelformat);
+- return -EINVAL;
++ fmt = &format[0];
++ em28xx_videodbg("Fourcc format (%08x) invalid. Using default (%08x).\n",
++ f->fmt.pix.pixelformat, fmt->fourcc);
+ }
+
+ if (dev->board.is_em2800) {
+@@ -1666,6 +1668,7 @@ static int vidioc_enum_input(struct file *file, void *priv,
+ {
+ struct em28xx *dev = video_drvdata(file);
+ unsigned int n;
++ int j;
+
+ n = i->index;
+ if (n >= MAX_EM28XX_INPUT)
+@@ -1685,6 +1688,12 @@ static int vidioc_enum_input(struct file *file, void *priv,
+ if (dev->is_webcam)
+ i->capabilities = 0;
+
++ /* Dynamically generates an audioset bitmask */
++ i->audioset = 0;
++ for (j = 0; j < MAX_EM28XX_INPUT; j++)
++ if (dev->amux_map[j] != EM28XX_AMUX_UNUSED)
++ i->audioset |= 1 << j;
++
+ return 0;
+ }
+
+@@ -1710,11 +1719,24 @@ static int vidioc_s_input(struct file *file, void *priv, unsigned int i)
+ return 0;
+ }
+
+-static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
++static int em28xx_fill_audio_input(struct em28xx *dev,
++ const char *s,
++ struct v4l2_audio *a,
++ unsigned int index)
+ {
+- struct em28xx *dev = video_drvdata(file);
++ unsigned int idx = dev->amux_map[index];
++
++ /*
++ * With msp3400, almost all mappings use the default (amux = 0).
++ * The only one may use a different value is WinTV USB2, where it
++ * can also be SCART1 input.
++ * As it is very doubtful that we would see new boards with msp3400,
++ * let's just reuse the existing switch.
++ */
++ if (dev->has_msp34xx && idx != EM28XX_AMUX_UNUSED)
++ idx = EM28XX_AMUX_LINE_IN;
+
+- switch (a->index) {
++ switch (idx) {
+ case EM28XX_AMUX_VIDEO:
+ strcpy(a->name, "Television");
+ break;
+@@ -1739,32 +1761,79 @@ static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
+ case EM28XX_AMUX_PCM_OUT:
+ strcpy(a->name, "PCM");
+ break;
++ case EM28XX_AMUX_UNUSED:
+ default:
+ return -EINVAL;
+ }
+-
+- a->index = dev->ctl_ainput;
++ a->index = index;
+ a->capability = V4L2_AUDCAP_STEREO;
+
++ em28xx_videodbg("%s: audio input index %d is '%s'\n",
++ s, a->index, a->name);
++
+ return 0;
+ }
+
++static int vidioc_enumaudio(struct file *file, void *fh, struct v4l2_audio *a)
++{
++ struct em28xx *dev = video_drvdata(file);
++
++ if (a->index >= MAX_EM28XX_INPUT)
++ return -EINVAL;
++
++ return em28xx_fill_audio_input(dev, __func__, a, a->index);
++}
++
++static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
++{
++ struct em28xx *dev = video_drvdata(file);
++ int i;
++
++ for (i = 0; i < MAX_EM28XX_INPUT; i++)
++ if (dev->ctl_ainput == dev->amux_map[i])
++ return em28xx_fill_audio_input(dev, __func__, a, i);
++
++ /* Should never happen! */
++ return -EINVAL;
++}
++
+ static int vidioc_s_audio(struct file *file, void *priv,
+ const struct v4l2_audio *a)
+ {
+ struct em28xx *dev = video_drvdata(file);
++ int idx, i;
+
+ if (a->index >= MAX_EM28XX_INPUT)
+ return -EINVAL;
+- if (!INPUT(a->index)->type)
++
++ idx = dev->amux_map[a->index];
++
++ if (idx == EM28XX_AMUX_UNUSED)
+ return -EINVAL;
+
+- dev->ctl_ainput = INPUT(a->index)->amux;
+- dev->ctl_aoutput = INPUT(a->index)->aout;
++ dev->ctl_ainput = idx;
++
++ /*
++ * FIXME: This is wrong, as different inputs at em28xx_cards
++ * may have different audio outputs. So, the right thing
++ * to do is to implement VIDIOC_G_AUDOUT/VIDIOC_S_AUDOUT.
++ * With the current board definitions, this would work fine,
++ * as, currently, all boards fit.
++ */
++ for (i = 0; i < MAX_EM28XX_INPUT; i++)
++ if (idx == dev->amux_map[i])
++ break;
++ if (i == MAX_EM28XX_INPUT)
++ return -EINVAL;
++
++ dev->ctl_aoutput = INPUT(i)->aout;
+
+ if (!dev->ctl_aoutput)
+ dev->ctl_aoutput = EM28XX_AOUT_MASTER;
+
++ em28xx_videodbg("%s: set audio input to %d\n", __func__,
++ dev->ctl_ainput);
++
+ return 0;
+ }
+
+@@ -2302,6 +2371,7 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
+ .vidioc_try_fmt_vbi_cap = vidioc_g_fmt_vbi_cap,
+ .vidioc_s_fmt_vbi_cap = vidioc_g_fmt_vbi_cap,
+ .vidioc_enum_framesizes = vidioc_enum_framesizes,
++ .vidioc_enumaudio = vidioc_enumaudio,
+ .vidioc_g_audio = vidioc_g_audio,
+ .vidioc_s_audio = vidioc_s_audio,
+
+diff --git a/drivers/media/usb/em28xx/em28xx.h b/drivers/media/usb/em28xx/em28xx.h
+index 953caac025f2..a551072e62ed 100644
+--- a/drivers/media/usb/em28xx/em28xx.h
++++ b/drivers/media/usb/em28xx/em28xx.h
+@@ -335,6 +335,9 @@ enum em28xx_usb_audio_type {
+ /**
+ * em28xx_amux - describes the type of audio input used by em28xx
+ *
++ * @EM28XX_AMUX_UNUSED:
++ * Used only on em28xx dev->map field, in order to mark an entry
++ * as unused.
+ * @EM28XX_AMUX_VIDEO:
+ * On devices without AC97, this is the only value that it is currently
+ * allowed.
+@@ -369,7 +372,8 @@ enum em28xx_usb_audio_type {
+ * same time, via the alsa mux.
+ */
+ enum em28xx_amux {
+- EM28XX_AMUX_VIDEO,
++ EM28XX_AMUX_UNUSED = -1,
++ EM28XX_AMUX_VIDEO = 0,
+ EM28XX_AMUX_LINE_IN,
+
+ /* Some less-common mixer setups */
+@@ -692,6 +696,8 @@ struct em28xx {
+ unsigned int ctl_input; // selected input
+ unsigned int ctl_ainput;// selected audio input
+ unsigned int ctl_aoutput;// selected audio output
++ enum em28xx_amux amux_map[MAX_EM28XX_INPUT];
++
+ int mute;
+ int volume;
+
+diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
+index c81faea96fba..c7c600c1f63b 100644
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -837,9 +837,9 @@ v4l2_hdmi_rx_colorimetry(const struct hdmi_avi_infoframe *avi,
+ switch (avi->colorimetry) {
+ case HDMI_COLORIMETRY_EXTENDED:
+ switch (avi->extended_colorimetry) {
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB:
+- c.colorspace = V4L2_COLORSPACE_ADOBERGB;
+- c.xfer_func = V4L2_XFER_FUNC_ADOBERGB;
++ case HDMI_EXTENDED_COLORIMETRY_OPRGB:
++ c.colorspace = V4L2_COLORSPACE_OPRGB;
++ c.xfer_func = V4L2_XFER_FUNC_OPRGB;
+ break;
+ case HDMI_EXTENDED_COLORIMETRY_BT2020:
+ c.colorspace = V4L2_COLORSPACE_BT2020;
+@@ -908,10 +908,10 @@ v4l2_hdmi_rx_colorimetry(const struct hdmi_avi_infoframe *avi,
+ c.ycbcr_enc = V4L2_YCBCR_ENC_601;
+ c.xfer_func = V4L2_XFER_FUNC_SRGB;
+ break;
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601:
+- c.colorspace = V4L2_COLORSPACE_ADOBERGB;
++ case HDMI_EXTENDED_COLORIMETRY_OPYCC_601:
++ c.colorspace = V4L2_COLORSPACE_OPRGB;
+ c.ycbcr_enc = V4L2_YCBCR_ENC_601;
+- c.xfer_func = V4L2_XFER_FUNC_ADOBERGB;
++ c.xfer_func = V4L2_XFER_FUNC_OPRGB;
+ break;
+ case HDMI_EXTENDED_COLORIMETRY_BT2020:
+ c.colorspace = V4L2_COLORSPACE_BT2020;
+diff --git a/drivers/mfd/menelaus.c b/drivers/mfd/menelaus.c
+index 29b7164a823b..d28ebe7ecd21 100644
+--- a/drivers/mfd/menelaus.c
++++ b/drivers/mfd/menelaus.c
+@@ -1094,6 +1094,7 @@ static void menelaus_rtc_alarm_work(struct menelaus_chip *m)
+ static inline void menelaus_rtc_init(struct menelaus_chip *m)
+ {
+ int alarm = (m->client->irq > 0);
++ int err;
+
+ /* assume 32KDETEN pin is pulled high */
+ if (!(menelaus_read_reg(MENELAUS_OSC_CTRL) & 0x80)) {
+@@ -1101,6 +1102,12 @@ static inline void menelaus_rtc_init(struct menelaus_chip *m)
+ return;
+ }
+
++ m->rtc = devm_rtc_allocate_device(&m->client->dev);
++ if (IS_ERR(m->rtc))
++ return;
++
++ m->rtc->ops = &menelaus_rtc_ops;
++
+ /* support RTC alarm; it can issue wakeups */
+ if (alarm) {
+ if (menelaus_add_irq_work(MENELAUS_RTCALM_IRQ,
+@@ -1125,10 +1132,8 @@ static inline void menelaus_rtc_init(struct menelaus_chip *m)
+ menelaus_write_reg(MENELAUS_RTC_CTRL, m->rtc_control);
+ }
+
+- m->rtc = rtc_device_register(DRIVER_NAME,
+- &m->client->dev,
+- &menelaus_rtc_ops, THIS_MODULE);
+- if (IS_ERR(m->rtc)) {
++ err = rtc_register_device(m->rtc);
++ if (err) {
+ if (alarm) {
+ menelaus_remove_irq_work(MENELAUS_RTCALM_IRQ);
+ device_init_wakeup(&m->client->dev, 0);
+diff --git a/drivers/misc/genwqe/card_base.h b/drivers/misc/genwqe/card_base.h
+index 120738d6e58b..77ed3967c5b0 100644
+--- a/drivers/misc/genwqe/card_base.h
++++ b/drivers/misc/genwqe/card_base.h
+@@ -408,7 +408,7 @@ struct genwqe_file {
+ struct file *filp;
+
+ struct fasync_struct *async_queue;
+- struct task_struct *owner;
++ struct pid *opener;
+ struct list_head list; /* entry in list of open files */
+
+ spinlock_t map_lock; /* lock for dma_mappings */
+diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c
+index f453ab82f0d7..8c1b63a4337b 100644
+--- a/drivers/misc/genwqe/card_dev.c
++++ b/drivers/misc/genwqe/card_dev.c
+@@ -52,7 +52,7 @@ static void genwqe_add_file(struct genwqe_dev *cd, struct genwqe_file *cfile)
+ {
+ unsigned long flags;
+
+- cfile->owner = current;
++ cfile->opener = get_pid(task_tgid(current));
+ spin_lock_irqsave(&cd->file_lock, flags);
+ list_add(&cfile->list, &cd->file_list);
+ spin_unlock_irqrestore(&cd->file_lock, flags);
+@@ -65,6 +65,7 @@ static int genwqe_del_file(struct genwqe_dev *cd, struct genwqe_file *cfile)
+ spin_lock_irqsave(&cd->file_lock, flags);
+ list_del(&cfile->list);
+ spin_unlock_irqrestore(&cd->file_lock, flags);
++ put_pid(cfile->opener);
+
+ return 0;
+ }
+@@ -275,7 +276,7 @@ static int genwqe_kill_fasync(struct genwqe_dev *cd, int sig)
+ return files;
+ }
+
+-static int genwqe_force_sig(struct genwqe_dev *cd, int sig)
++static int genwqe_terminate(struct genwqe_dev *cd)
+ {
+ unsigned int files = 0;
+ unsigned long flags;
+@@ -283,7 +284,7 @@ static int genwqe_force_sig(struct genwqe_dev *cd, int sig)
+
+ spin_lock_irqsave(&cd->file_lock, flags);
+ list_for_each_entry(cfile, &cd->file_list, list) {
+- force_sig(sig, cfile->owner);
++ kill_pid(cfile->opener, SIGKILL, 1);
+ files++;
+ }
+ spin_unlock_irqrestore(&cd->file_lock, flags);
+@@ -1352,7 +1353,7 @@ static int genwqe_inform_and_stop_processes(struct genwqe_dev *cd)
+ dev_warn(&pci_dev->dev,
+ "[%s] send SIGKILL and wait ...\n", __func__);
+
+- rc = genwqe_force_sig(cd, SIGKILL); /* force terminate */
++ rc = genwqe_terminate(cd);
+ if (rc) {
+ /* Give kill_timout more seconds to end processes */
+ for (i = 0; (i < GENWQE_KILL_TIMEOUT) &&
+diff --git a/drivers/misc/ocxl/config.c b/drivers/misc/ocxl/config.c
+index 2e30de9c694a..57a6bb1fd3c9 100644
+--- a/drivers/misc/ocxl/config.c
++++ b/drivers/misc/ocxl/config.c
+@@ -280,7 +280,9 @@ int ocxl_config_check_afu_index(struct pci_dev *dev,
+ u32 val;
+ int rc, templ_major, templ_minor, len;
+
+- pci_write_config_word(dev, fn->dvsec_afu_info_pos, afu_idx);
++ pci_write_config_byte(dev,
++ fn->dvsec_afu_info_pos + OCXL_DVSEC_AFU_INFO_AFU_IDX,
++ afu_idx);
+ rc = read_afu_info(dev, fn, OCXL_DVSEC_TEMPL_VERSION, &val);
+ if (rc)
+ return rc;
+diff --git a/drivers/misc/vmw_vmci/vmci_driver.c b/drivers/misc/vmw_vmci/vmci_driver.c
+index d7eaf1eb11e7..003bfba40758 100644
+--- a/drivers/misc/vmw_vmci/vmci_driver.c
++++ b/drivers/misc/vmw_vmci/vmci_driver.c
+@@ -113,5 +113,5 @@ module_exit(vmci_drv_exit);
+
+ MODULE_AUTHOR("VMware, Inc.");
+ MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface.");
+-MODULE_VERSION("1.1.5.0-k");
++MODULE_VERSION("1.1.6.0-k");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c
+index 1ab6e8737a5f..da1ee2e1ba99 100644
+--- a/drivers/misc/vmw_vmci/vmci_resource.c
++++ b/drivers/misc/vmw_vmci/vmci_resource.c
+@@ -57,7 +57,8 @@ static struct vmci_resource *vmci_resource_lookup(struct vmci_handle handle,
+
+ if (r->type == type &&
+ rid == handle.resource &&
+- (cid == handle.context || cid == VMCI_INVALID_ID)) {
++ (cid == handle.context || cid == VMCI_INVALID_ID ||
++ handle.context == VMCI_INVALID_ID)) {
+ resource = r;
+ break;
+ }
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index 32321bd596d8..c61109f7b793 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -76,6 +76,7 @@ struct sdhci_acpi_slot {
+ size_t priv_size;
+ int (*probe_slot)(struct platform_device *, const char *, const char *);
+ int (*remove_slot)(struct platform_device *);
++ int (*free_slot)(struct platform_device *pdev);
+ int (*setup_host)(struct platform_device *pdev);
+ };
+
+@@ -756,6 +757,9 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
+ err_cleanup:
+ sdhci_cleanup_host(c->host);
+ err_free:
++ if (c->slot && c->slot->free_slot)
++ c->slot->free_slot(pdev);
++
+ sdhci_free_host(c->host);
+ return err;
+ }
+@@ -777,6 +781,10 @@ static int sdhci_acpi_remove(struct platform_device *pdev)
+
+ dead = (sdhci_readl(c->host, SDHCI_INT_STATUS) == ~0);
+ sdhci_remove_host(c->host, dead);
++
++ if (c->slot && c->slot->free_slot)
++ c->slot->free_slot(pdev);
++
+ sdhci_free_host(c->host);
+
+ return 0;
+diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c
+index 77e9bc4aaee9..cc3ffeffd7a2 100644
+--- a/drivers/mmc/host/sdhci-pci-o2micro.c
++++ b/drivers/mmc/host/sdhci-pci-o2micro.c
+@@ -490,6 +490,9 @@ int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip)
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+ break;
+ case PCI_DEVICE_ID_O2_SEABIRD0:
++ if (chip->pdev->revision == 0x01)
++ chip->quirks |= SDHCI_QUIRK_DELAY_AFTER_POWER;
++ /* fall through */
+ case PCI_DEVICE_ID_O2_SEABIRD1:
+ /* UnLock WP */
+ ret = pci_read_config_byte(chip->pdev,
+diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
+index 9d9723693217..2e3a8da3ce72 100644
+--- a/drivers/mtd/maps/gpio-addr-flash.c
++++ b/drivers/mtd/maps/gpio-addr-flash.c
+@@ -238,7 +238,7 @@ static int gpio_flash_probe(struct platform_device *pdev)
+ state->map.copy_to = gf_copy_to;
+ state->map.bankwidth = pdata->width;
+ state->map.size = state->win_size * (1 << state->gpio_count);
+- state->map.virt = ioremap_nocache(memory->start, state->map.size);
++ state->map.virt = ioremap_nocache(memory->start, state->win_size);
+ if (!state->map.virt)
+ return -ENOMEM;
+
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index a068b214ebaa..a594fb1e9a99 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -2063,6 +2063,10 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
+ nand_np = dev->of_node;
+ nfc_np = of_find_compatible_node(dev->of_node, NULL,
+ "atmel,sama5d3-nfc");
++ if (!nfc_np) {
++ dev_err(dev, "Could not find device node for sama5d3-nfc\n");
++ return -ENODEV;
++ }
+
+ nc->clk = of_clk_get(nfc_np, 0);
+ if (IS_ERR(nc->clk)) {
+diff --git a/drivers/mtd/nand/raw/denali.c b/drivers/mtd/nand/raw/denali.c
+index b864b93dd289..2242e999a76b 100644
+--- a/drivers/mtd/nand/raw/denali.c
++++ b/drivers/mtd/nand/raw/denali.c
+@@ -28,6 +28,7 @@
+ MODULE_LICENSE("GPL");
+
+ #define DENALI_NAND_NAME "denali-nand"
++#define DENALI_DEFAULT_OOB_SKIP_BYTES 8
+
+ /* for Indexed Addressing */
+ #define DENALI_INDEXED_CTRL 0x00
+@@ -1105,12 +1106,17 @@ static void denali_hw_init(struct denali_nand_info *denali)
+ denali->revision = swab16(ioread32(denali->reg + REVISION));
+
+ /*
+- * tell driver how many bit controller will skip before
+- * writing ECC code in OOB, this register may be already
+- * set by firmware. So we read this value out.
+- * if this value is 0, just let it be.
++ * Set how many bytes should be skipped before writing data in OOB.
++ * If a non-zero value has already been set (by firmware or something),
++ * just use it. Otherwise, set the driver default.
+ */
+ denali->oob_skip_bytes = ioread32(denali->reg + SPARE_AREA_SKIP_BYTES);
++ if (!denali->oob_skip_bytes) {
++ denali->oob_skip_bytes = DENALI_DEFAULT_OOB_SKIP_BYTES;
++ iowrite32(denali->oob_skip_bytes,
++ denali->reg + SPARE_AREA_SKIP_BYTES);
++ }
++
+ denali_detect_max_banks(denali);
+ iowrite32(0x0F, denali->reg + RB_PIN_ENABLED);
+ iowrite32(CHIP_EN_DONT_CARE__FLAG, denali->reg + CHIP_ENABLE_DONT_CARE);
+diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
+index bc2ef5209783..c7573ccdbacd 100644
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -686,7 +686,7 @@ static irqreturn_t marvell_nfc_isr(int irq, void *dev_id)
+
+ marvell_nfc_disable_int(nfc, st & NDCR_ALL_INT);
+
+- if (!(st & (NDSR_RDDREQ | NDSR_WRDREQ | NDSR_WRCMDREQ)))
++ if (st & (NDSR_RDY(0) | NDSR_RDY(1)))
+ complete(&nfc->complete);
+
+ return IRQ_HANDLED;
+diff --git a/drivers/mtd/spi-nor/fsl-quadspi.c b/drivers/mtd/spi-nor/fsl-quadspi.c
+index 7d9620c7ff6c..1ff3430f82c8 100644
+--- a/drivers/mtd/spi-nor/fsl-quadspi.c
++++ b/drivers/mtd/spi-nor/fsl-quadspi.c
+@@ -478,6 +478,7 @@ static int fsl_qspi_get_seqid(struct fsl_qspi *q, u8 cmd)
+ {
+ switch (cmd) {
+ case SPINOR_OP_READ_1_1_4:
++ case SPINOR_OP_READ_1_1_4_4B:
+ return SEQID_READ;
+ case SPINOR_OP_WREN:
+ return SEQID_WREN;
+@@ -543,6 +544,9 @@ fsl_qspi_runcmd(struct fsl_qspi *q, u8 cmd, unsigned int addr, int len)
+
+ /* trigger the LUT now */
+ seqid = fsl_qspi_get_seqid(q, cmd);
++ if (seqid < 0)
++ return seqid;
++
+ qspi_writel(q, (seqid << QUADSPI_IPCR_SEQID_SHIFT) | len,
+ base + QUADSPI_IPCR);
+
+@@ -671,7 +675,7 @@ static void fsl_qspi_set_map_addr(struct fsl_qspi *q)
+ * causes the controller to clear the buffer, and use the sequence pointed
+ * by the QUADSPI_BFGENCR[SEQID] to initiate a read from the flash.
+ */
+-static void fsl_qspi_init_ahb_read(struct fsl_qspi *q)
++static int fsl_qspi_init_ahb_read(struct fsl_qspi *q)
+ {
+ void __iomem *base = q->iobase;
+ int seqid;
+@@ -696,8 +700,13 @@ static void fsl_qspi_init_ahb_read(struct fsl_qspi *q)
+
+ /* Set the default lut sequence for AHB Read. */
+ seqid = fsl_qspi_get_seqid(q, q->nor[0].read_opcode);
++ if (seqid < 0)
++ return seqid;
++
+ qspi_writel(q, seqid << QUADSPI_BFGENCR_SEQID_SHIFT,
+ q->iobase + QUADSPI_BFGENCR);
++
++ return 0;
+ }
+
+ /* This function was used to prepare and enable QSPI clock */
+@@ -805,9 +814,7 @@ static int fsl_qspi_nor_setup_last(struct fsl_qspi *q)
+ fsl_qspi_init_lut(q);
+
+ /* Init for AHB read */
+- fsl_qspi_init_ahb_read(q);
+-
+- return 0;
++ return fsl_qspi_init_ahb_read(q);
+ }
+
+ static const struct of_device_id fsl_qspi_dt_ids[] = {
+diff --git a/drivers/mtd/spi-nor/intel-spi-pci.c b/drivers/mtd/spi-nor/intel-spi-pci.c
+index c0976f2e3dd1..872b40922608 100644
+--- a/drivers/mtd/spi-nor/intel-spi-pci.c
++++ b/drivers/mtd/spi-nor/intel-spi-pci.c
+@@ -65,6 +65,7 @@ static void intel_spi_pci_remove(struct pci_dev *pdev)
+ static const struct pci_device_id intel_spi_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x18e0), (unsigned long)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0x19e0), (unsigned long)&bxt_info },
++ { PCI_VDEVICE(INTEL, 0x34a4), (unsigned long)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0xa1a4), (unsigned long)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0xa224), (unsigned long)&bxt_info },
+ { },
+diff --git a/drivers/net/dsa/mv88e6xxx/phy.c b/drivers/net/dsa/mv88e6xxx/phy.c
+index 46af8052e535..152a65d46e0b 100644
+--- a/drivers/net/dsa/mv88e6xxx/phy.c
++++ b/drivers/net/dsa/mv88e6xxx/phy.c
+@@ -110,6 +110,9 @@ int mv88e6xxx_phy_page_write(struct mv88e6xxx_chip *chip, int phy,
+ err = mv88e6xxx_phy_page_get(chip, phy, page);
+ if (!err) {
+ err = mv88e6xxx_phy_write(chip, phy, MV88E6XXX_PHY_PAGE, page);
++ if (!err)
++ err = mv88e6xxx_phy_write(chip, phy, reg, val);
++
+ mv88e6xxx_phy_page_put(chip, phy);
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index 34af5f1569c8..de0e24d912fe 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -342,7 +342,7 @@ static struct device_node *bcmgenet_mii_of_find_mdio(struct bcmgenet_priv *priv)
+ if (!compat)
+ return NULL;
+
+- priv->mdio_dn = of_find_compatible_node(dn, NULL, compat);
++ priv->mdio_dn = of_get_compatible_child(dn, compat);
+ kfree(compat);
+ if (!priv->mdio_dn) {
+ dev_err(kdev, "unable to find MDIO bus node\n");
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 955c4ab18b03..b7b2f8254ce1 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1915,6 +1915,7 @@ static int is_valid_clean_head(struct hns3_enet_ring *ring, int h)
+ bool hns3_clean_tx_ring(struct hns3_enet_ring *ring, int budget)
+ {
+ struct net_device *netdev = ring->tqp->handle->kinfo.netdev;
++ struct hns3_nic_priv *priv = netdev_priv(netdev);
+ struct netdev_queue *dev_queue;
+ int bytes, pkts;
+ int head;
+@@ -1961,7 +1962,8 @@ bool hns3_clean_tx_ring(struct hns3_enet_ring *ring, int budget)
+ * sees the new next_to_clean.
+ */
+ smp_mb();
+- if (netif_tx_queue_stopped(dev_queue)) {
++ if (netif_tx_queue_stopped(dev_queue) &&
++ !test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) {
+ netif_tx_wake_queue(dev_queue);
+ ring->stats.restart_queue++;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+index f70ee6910ee2..9684ad015c42 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+@@ -309,7 +309,7 @@ static void hns3_self_test(struct net_device *ndev,
+ h->flags & HNAE3_SUPPORT_SERDES_LOOPBACK;
+
+ if (if_running)
+- dev_close(ndev);
++ ndev->netdev_ops->ndo_stop(ndev);
+
+ #if IS_ENABLED(CONFIG_VLAN_8021Q)
+ /* Disable the vlan filter for selftest does not support it */
+@@ -347,7 +347,7 @@ static void hns3_self_test(struct net_device *ndev,
+ #endif
+
+ if (if_running)
+- dev_open(ndev);
++ ndev->netdev_ops->ndo_open(ndev);
+ }
+
+ static int hns3_get_sset_count(struct net_device *netdev, int stringset)
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index f08ebb7caaaf..92f19384e258 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -73,6 +73,7 @@ static int hclge_ieee_getets(struct hnae3_handle *h, struct ieee_ets *ets)
+ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
+ u8 *tc, bool *changed)
+ {
++ bool has_ets_tc = false;
+ u32 total_ets_bw = 0;
+ u8 max_tc = 0;
+ u8 i;
+@@ -100,13 +101,14 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
+ *changed = true;
+
+ total_ets_bw += ets->tc_tx_bw[i];
+- break;
++ has_ets_tc = true;
++ break;
+ default:
+ return -EINVAL;
+ }
+ }
+
+- if (total_ets_bw != BW_PERCENT)
++ if (has_ets_tc && total_ets_bw != BW_PERCENT)
+ return -EINVAL;
+
+ *tc = max_tc + 1;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 8577dfc799ad..db763450e5e3 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -1657,11 +1657,13 @@ static int hclge_tx_buffer_calc(struct hclge_dev *hdev,
+ static int hclge_rx_buffer_calc(struct hclge_dev *hdev,
+ struct hclge_pkt_buf_alloc *buf_alloc)
+ {
+- u32 rx_all = hdev->pkt_buf_size;
++#define HCLGE_BUF_SIZE_UNIT 128
++ u32 rx_all = hdev->pkt_buf_size, aligned_mps;
+ int no_pfc_priv_num, pfc_priv_num;
+ struct hclge_priv_buf *priv;
+ int i;
+
++ aligned_mps = round_up(hdev->mps, HCLGE_BUF_SIZE_UNIT);
+ rx_all -= hclge_get_tx_buff_alloced(buf_alloc);
+
+ /* When DCB is not supported, rx private
+@@ -1680,13 +1682,13 @@ static int hclge_rx_buffer_calc(struct hclge_dev *hdev,
+ if (hdev->hw_tc_map & BIT(i)) {
+ priv->enable = 1;
+ if (hdev->tm_info.hw_pfc_map & BIT(i)) {
+- priv->wl.low = hdev->mps;
+- priv->wl.high = priv->wl.low + hdev->mps;
++ priv->wl.low = aligned_mps;
++ priv->wl.high = priv->wl.low + aligned_mps;
+ priv->buf_size = priv->wl.high +
+ HCLGE_DEFAULT_DV;
+ } else {
+ priv->wl.low = 0;
+- priv->wl.high = 2 * hdev->mps;
++ priv->wl.high = 2 * aligned_mps;
+ priv->buf_size = priv->wl.high;
+ }
+ } else {
+@@ -1718,11 +1720,11 @@ static int hclge_rx_buffer_calc(struct hclge_dev *hdev,
+
+ if (hdev->tm_info.hw_pfc_map & BIT(i)) {
+ priv->wl.low = 128;
+- priv->wl.high = priv->wl.low + hdev->mps;
++ priv->wl.high = priv->wl.low + aligned_mps;
+ priv->buf_size = priv->wl.high + HCLGE_DEFAULT_DV;
+ } else {
+ priv->wl.low = 0;
+- priv->wl.high = hdev->mps;
++ priv->wl.high = aligned_mps;
+ priv->buf_size = priv->wl.high;
+ }
+ }
+@@ -2360,6 +2362,9 @@ static int hclge_get_mac_phy_link(struct hclge_dev *hdev)
+ int mac_state;
+ int link_stat;
+
++ if (test_bit(HCLGE_STATE_DOWN, &hdev->state))
++ return 0;
++
+ mac_state = hclge_get_mac_link_status(hdev);
+
+ if (hdev->hw.mac.phydev) {
+@@ -3809,6 +3814,8 @@ static void hclge_ae_stop(struct hnae3_handle *handle)
+ struct hclge_dev *hdev = vport->back;
+ int i;
+
++ set_bit(HCLGE_STATE_DOWN, &hdev->state);
++
+ del_timer_sync(&hdev->service_timer);
+ cancel_work_sync(&hdev->service_task);
+ clear_bit(HCLGE_STATE_SERVICE_SCHED, &hdev->state);
+@@ -4686,9 +4693,17 @@ static int hclge_set_vf_vlan_common(struct hclge_dev *hdev, int vfid,
+ "Add vf vlan filter fail, ret =%d.\n",
+ req0->resp_code);
+ } else {
++#define HCLGE_VF_VLAN_DEL_NO_FOUND 1
+ if (!req0->resp_code)
+ return 0;
+
++ if (req0->resp_code == HCLGE_VF_VLAN_DEL_NO_FOUND) {
++ dev_warn(&hdev->pdev->dev,
++ "vlan %d filter is not in vf vlan table\n",
++ vlan);
++ return 0;
++ }
++
+ dev_err(&hdev->pdev->dev,
+ "Kill vf vlan filter fail, ret =%d.\n",
+ req0->resp_code);
+@@ -4732,6 +4747,9 @@ static int hclge_set_vlan_filter_hw(struct hclge_dev *hdev, __be16 proto,
+ u16 vport_idx, vport_num = 0;
+ int ret;
+
++ if (is_kill && !vlan_id)
++ return 0;
++
+ ret = hclge_set_vf_vlan_common(hdev, vport_id, is_kill, vlan_id,
+ 0, proto);
+ if (ret) {
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 9c0091f2addf..320043e87fc6 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -299,6 +299,9 @@ void hclgevf_update_link_status(struct hclgevf_dev *hdev, int link_state)
+
+ client = handle->client;
+
++ link_state =
++ test_bit(HCLGEVF_STATE_DOWN, &hdev->state) ? 0 : link_state;
++
+ if (link_state != hdev->hw.mac.link) {
+ client->ops->link_status_change(handle, !!link_state);
+ hdev->hw.mac.link = link_state;
+@@ -1448,6 +1451,8 @@ static void hclgevf_ae_stop(struct hnae3_handle *handle)
+ struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle);
+ int i, queue_id;
+
++ set_bit(HCLGEVF_STATE_DOWN, &hdev->state);
++
+ for (i = 0; i < hdev->num_tqps; i++) {
+ /* Ring disable */
+ queue_id = hclgevf_get_queue_id(handle->kinfo.tqp[i]);
+diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
+index 868f4a1d0f72..67591722c625 100644
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -39,9 +39,9 @@
+ extern const char ice_drv_ver[];
+ #define ICE_BAR0 0
+ #define ICE_DFLT_NUM_DESC 128
+-#define ICE_MIN_NUM_DESC 8
+-#define ICE_MAX_NUM_DESC 8160
+ #define ICE_REQ_DESC_MULTIPLE 32
++#define ICE_MIN_NUM_DESC ICE_REQ_DESC_MULTIPLE
++#define ICE_MAX_NUM_DESC 8160
+ #define ICE_DFLT_TRAFFIC_CLASS BIT(0)
+ #define ICE_INT_NAME_STR_LEN (IFNAMSIZ + 16)
+ #define ICE_ETHTOOL_FWVER_LEN 32
+diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c
+index 62be72fdc8f3..e783976c401d 100644
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
+@@ -518,22 +518,31 @@ shutdown_sq_out:
+
+ /**
+ * ice_aq_ver_check - Check the reported AQ API version.
+- * @fw_branch: The "branch" of FW, typically describes the device type
+- * @fw_major: The major version of the FW API
+- * @fw_minor: The minor version increment of the FW API
++ * @hw: pointer to the hardware structure
+ *
+ * Checks if the driver should load on a given AQ API version.
+ *
+ * Return: 'true' iff the driver should attempt to load. 'false' otherwise.
+ */
+-static bool ice_aq_ver_check(u8 fw_branch, u8 fw_major, u8 fw_minor)
++static bool ice_aq_ver_check(struct ice_hw *hw)
+ {
+- if (fw_branch != EXP_FW_API_VER_BRANCH)
+- return false;
+- if (fw_major != EXP_FW_API_VER_MAJOR)
+- return false;
+- if (fw_minor != EXP_FW_API_VER_MINOR)
++ if (hw->api_maj_ver > EXP_FW_API_VER_MAJOR) {
++ /* Major API version is newer than expected, don't load */
++ dev_warn(ice_hw_to_dev(hw),
++ "The driver for the device stopped because the NVM image is newer than expected. You must install the most recent version of the network driver.\n");
+ return false;
++ } else if (hw->api_maj_ver == EXP_FW_API_VER_MAJOR) {
++ if (hw->api_min_ver > (EXP_FW_API_VER_MINOR + 2))
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected a newer version of the NVM image than expected. Please install the most recent version of the network driver.\n");
++ else if ((hw->api_min_ver + 2) < EXP_FW_API_VER_MINOR)
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected an older version of the NVM image than expected. Please update the NVM image.\n");
++ } else {
++ /* Major API version is older than expected, log a warning */
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected an older version of the NVM image than expected. Please update the NVM image.\n");
++ }
+ return true;
+ }
+
+@@ -588,8 +597,7 @@ static enum ice_status ice_init_check_adminq(struct ice_hw *hw)
+ if (status)
+ goto init_ctrlq_free_rq;
+
+- if (!ice_aq_ver_check(hw->api_branch, hw->api_maj_ver,
+- hw->api_min_ver)) {
++ if (!ice_aq_ver_check(hw)) {
+ status = ICE_ERR_FW_API_VER;
+ goto init_ctrlq_free_rq;
+ }
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index c71a9b528d6d..9d6754f65a1a 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -478,9 +478,11 @@ ice_get_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
+ ring->tx_max_pending = ICE_MAX_NUM_DESC;
+ ring->rx_pending = vsi->rx_rings[0]->count;
+ ring->tx_pending = vsi->tx_rings[0]->count;
+- ring->rx_mini_pending = ICE_MIN_NUM_DESC;
++
++ /* Rx mini and jumbo rings are not supported */
+ ring->rx_mini_max_pending = 0;
+ ring->rx_jumbo_max_pending = 0;
++ ring->rx_mini_pending = 0;
+ ring->rx_jumbo_pending = 0;
+ }
+
+@@ -498,14 +500,23 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
+ ring->tx_pending < ICE_MIN_NUM_DESC ||
+ ring->rx_pending > ICE_MAX_NUM_DESC ||
+ ring->rx_pending < ICE_MIN_NUM_DESC) {
+- netdev_err(netdev, "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d]\n",
++ netdev_err(netdev, "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d] (increment %d)\n",
+ ring->tx_pending, ring->rx_pending,
+- ICE_MIN_NUM_DESC, ICE_MAX_NUM_DESC);
++ ICE_MIN_NUM_DESC, ICE_MAX_NUM_DESC,
++ ICE_REQ_DESC_MULTIPLE);
+ return -EINVAL;
+ }
+
+ new_tx_cnt = ALIGN(ring->tx_pending, ICE_REQ_DESC_MULTIPLE);
++ if (new_tx_cnt != ring->tx_pending)
++ netdev_info(netdev,
++ "Requested Tx descriptor count rounded up to %d\n",
++ new_tx_cnt);
+ new_rx_cnt = ALIGN(ring->rx_pending, ICE_REQ_DESC_MULTIPLE);
++ if (new_rx_cnt != ring->rx_pending)
++ netdev_info(netdev,
++ "Requested Rx descriptor count rounded up to %d\n",
++ new_rx_cnt);
+
+ /* if nothing to do return success */
+ if (new_tx_cnt == vsi->tx_rings[0]->count &&
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+index da4322e4daed..add124e0381d 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -676,6 +676,9 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs)
+ } else {
+ struct tx_sa tsa;
+
++ if (adapter->num_vfs)
++ return -EOPNOTSUPP;
++
+ /* find the first unused index */
+ ret = ixgbe_ipsec_find_empty_idx(ipsec, false);
+ if (ret < 0) {
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 5a228582423b..4093a9c52c18 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -3849,6 +3849,10 @@ static void ixgbevf_tx_csum(struct ixgbevf_ring *tx_ring,
+ skb_checksum_help(skb);
+ goto no_csum;
+ }
++
++ if (first->protocol == htons(ETH_P_IP))
++ type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4;
++
+ /* update TX checksum flag */
+ first->tx_flags |= IXGBE_TX_FLAGS_CSUM;
+ vlan_macip_lens = skb_checksum_start_offset(skb) -
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
+index db463e20a876..e9a4179e7e48 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
+@@ -96,6 +96,7 @@ nfp_devlink_port_split(struct devlink *devlink, unsigned int port_index,
+ {
+ struct nfp_pf *pf = devlink_priv(devlink);
+ struct nfp_eth_table_port eth_port;
++ unsigned int lanes;
+ int ret;
+
+ if (count < 2)
+@@ -114,8 +115,12 @@ nfp_devlink_port_split(struct devlink *devlink, unsigned int port_index,
+ goto out;
+ }
+
+- ret = nfp_devlink_set_lanes(pf, eth_port.index,
+- eth_port.port_lanes / count);
++ /* Special case the 100G CXP -> 2x40G split */
++ lanes = eth_port.port_lanes / count;
++ if (eth_port.lanes == 10 && count == 2)
++ lanes = 8 / count;
++
++ ret = nfp_devlink_set_lanes(pf, eth_port.index, lanes);
+ out:
+ mutex_unlock(&pf->lock);
+
+@@ -128,6 +133,7 @@ nfp_devlink_port_unsplit(struct devlink *devlink, unsigned int port_index,
+ {
+ struct nfp_pf *pf = devlink_priv(devlink);
+ struct nfp_eth_table_port eth_port;
++ unsigned int lanes;
+ int ret;
+
+ mutex_lock(&pf->lock);
+@@ -143,7 +149,12 @@ nfp_devlink_port_unsplit(struct devlink *devlink, unsigned int port_index,
+ goto out;
+ }
+
+- ret = nfp_devlink_set_lanes(pf, eth_port.index, eth_port.port_lanes);
++ /* Special case the 100G CXP -> 2x40G unsplit */
++ lanes = eth_port.port_lanes;
++ if (eth_port.port_lanes == 8)
++ lanes = 10;
++
++ ret = nfp_devlink_set_lanes(pf, eth_port.index, lanes);
+ out:
+ mutex_unlock(&pf->lock);
+
+diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
+index 4289ccb26e4e..d2caeb9edc04 100644
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -940,6 +940,9 @@ static void netsec_uninit_pkt_dring(struct netsec_priv *priv, int id)
+ dring->head = 0;
+ dring->tail = 0;
+ dring->pkt_cnt = 0;
++
++ if (id == NETSEC_RING_TX)
++ netdev_reset_queue(priv->ndev);
+ }
+
+ static void netsec_free_dring(struct netsec_priv *priv, int id)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index f9a61f90cfbc..0f660af01a4b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -714,8 +714,9 @@ static int get_ephy_nodes(struct stmmac_priv *priv)
+ return -ENODEV;
+ }
+
+- mdio_internal = of_find_compatible_node(mdio_mux, NULL,
++ mdio_internal = of_get_compatible_child(mdio_mux,
+ "allwinner,sun8i-h3-mdio-internal");
++ of_node_put(mdio_mux);
+ if (!mdio_internal) {
+ dev_err(priv->device, "Cannot get internal_mdio node\n");
+ return -ENODEV;
+@@ -729,13 +730,20 @@ static int get_ephy_nodes(struct stmmac_priv *priv)
+ gmac->rst_ephy = of_reset_control_get_exclusive(iphynode, NULL);
+ if (IS_ERR(gmac->rst_ephy)) {
+ ret = PTR_ERR(gmac->rst_ephy);
+- if (ret == -EPROBE_DEFER)
++ if (ret == -EPROBE_DEFER) {
++ of_node_put(iphynode);
++ of_node_put(mdio_internal);
+ return ret;
++ }
+ continue;
+ }
+ dev_info(priv->device, "Found internal PHY node\n");
++ of_node_put(iphynode);
++ of_node_put(mdio_internal);
+ return 0;
+ }
++
++ of_node_put(mdio_internal);
+ return -ENODEV;
+ }
+
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 3af6d8d15233..1c37a821895b 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -2022,14 +2022,15 @@ static void netvsc_vf_setup(struct work_struct *w)
+ rtnl_unlock();
+ }
+
+-/* Find netvsc by VMBus serial number.
+- * The PCI hyperv controller records the serial number as the slot.
++/* Find netvsc by VF serial number.
++ * The PCI hyperv controller records the serial number as the slot kobj name.
+ */
+ static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
+ {
+ struct device *parent = vf_netdev->dev.parent;
+ struct net_device_context *ndev_ctx;
+ struct pci_dev *pdev;
++ u32 serial;
+
+ if (!parent || !dev_is_pci(parent))
+ return NULL; /* not a PCI device */
+@@ -2040,16 +2041,22 @@ static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
+ return NULL;
+ }
+
++ if (kstrtou32(pci_slot_name(pdev->slot), 10, &serial)) {
++ netdev_notice(vf_netdev, "Invalid vf serial:%s\n",
++ pci_slot_name(pdev->slot));
++ return NULL;
++ }
++
+ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
+ if (!ndev_ctx->vf_alloc)
+ continue;
+
+- if (ndev_ctx->vf_serial == pdev->slot->number)
++ if (ndev_ctx->vf_serial == serial)
+ return hv_get_drvdata(ndev_ctx->device_ctx);
+ }
+
+ netdev_notice(vf_netdev,
+- "no netdev found for slot %u\n", pdev->slot->number);
++ "no netdev found for vf serial:%u\n", serial);
+ return NULL;
+ }
+
+diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
+index 30612497643c..d192936b76cf 100644
+--- a/drivers/net/loopback.c
++++ b/drivers/net/loopback.c
+@@ -75,6 +75,10 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
+ int len;
+
+ skb_tx_timestamp(skb);
++
++ /* do not fool net_timestamp_check() with various clock bases */
++ skb->tstamp = 0;
++
+ skb_orphan(skb);
+
+ /* Before queueing this packet to netif_rx(),
+diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c
+index 7ae1856d1f18..5a749dc25bec 100644
+--- a/drivers/net/net_failover.c
++++ b/drivers/net/net_failover.c
+@@ -603,6 +603,9 @@ static int net_failover_slave_unregister(struct net_device *slave_dev,
+ primary_dev = rtnl_dereference(nfo_info->primary_dev);
+ standby_dev = rtnl_dereference(nfo_info->standby_dev);
+
++ if (WARN_ON_ONCE(slave_dev != primary_dev && slave_dev != standby_dev))
++ return -ENODEV;
++
+ vlan_vids_del_by_dev(slave_dev, failover_dev);
+ dev_uc_unsync(slave_dev, failover_dev);
+ dev_mc_unsync(slave_dev, failover_dev);
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 7abca86c3aa9..70f3f90c2ed6 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -907,6 +907,9 @@ void phylink_start(struct phylink *pl)
+ phylink_an_mode_str(pl->link_an_mode),
+ phy_modes(pl->link_config.interface));
+
++ /* Always set the carrier off */
++ netif_carrier_off(pl->netdev);
++
+ /* Apply the link configuration to the MAC when starting. This allows
+ * a fixed-link to start with the correct parameters, and also
+ * ensures that we set the appropriate advertisement for Serdes links.
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 50e9cc19023a..c52207beef88 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -2264,6 +2264,8 @@ static void tun_setup(struct net_device *dev)
+ static int tun_validate(struct nlattr *tb[], struct nlattr *data[],
+ struct netlink_ext_ack *extack)
+ {
++ if (!data)
++ return 0;
+ return -EINVAL;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index fd612d2905b0..9f31b9a10850 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1869,6 +1869,12 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
+ if (ret)
+ dev_kfree_skb_any(skb);
+
++ if (ret == -EAGAIN) {
++ ath10k_warn(ar, "wmi command %d timeout, restarting hardware\n",
++ cmd_id);
++ queue_work(ar->workqueue, &ar->restart_work);
++ }
++
+ return ret;
+ }
+
+@@ -2336,7 +2342,12 @@ static int wmi_process_mgmt_tx_comp(struct ath10k *ar, u32 desc_id,
+ dma_unmap_single(ar->dev, pkt_addr->paddr,
+ msdu->len, DMA_FROM_DEVICE);
+ info = IEEE80211_SKB_CB(msdu);
+- info->flags |= status;
++
++ if (status)
++ info->flags &= ~IEEE80211_TX_STAT_ACK;
++ else
++ info->flags |= IEEE80211_TX_STAT_ACK;
++
+ ieee80211_tx_status_irqsafe(ar->hw, msdu);
+
+ ret = 0;
+diff --git a/drivers/net/wireless/ath/wil6210/txrx_edma.c b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+index bca61cb44c37..3e7fc2983cbb 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx_edma.c
++++ b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+@@ -279,9 +279,6 @@ static void wil_move_all_rx_buff_to_free_list(struct wil6210_priv *wil,
+ u16 buff_id;
+
+ *d = *_d;
+- pa = wil_rx_desc_get_addr_edma(&d->dma);
+- dmalen = le16_to_cpu(d->dma.length);
+- dma_unmap_single(dev, pa, dmalen, DMA_FROM_DEVICE);
+
+ /* Extract the SKB from the rx_buff management array */
+ buff_id = __le16_to_cpu(d->mac.buff_id);
+@@ -291,10 +288,15 @@ static void wil_move_all_rx_buff_to_free_list(struct wil6210_priv *wil,
+ }
+ skb = wil->rx_buff_mgmt.buff_arr[buff_id].skb;
+ wil->rx_buff_mgmt.buff_arr[buff_id].skb = NULL;
+- if (unlikely(!skb))
++ if (unlikely(!skb)) {
+ wil_err(wil, "No Rx skb at buff_id %d\n", buff_id);
+- else
++ } else {
++ pa = wil_rx_desc_get_addr_edma(&d->dma);
++ dmalen = le16_to_cpu(d->dma.length);
++ dma_unmap_single(dev, pa, dmalen, DMA_FROM_DEVICE);
++
+ kfree_skb(skb);
++ }
+
+ /* Move the buffer from the active to the free list */
+ list_move(&wil->rx_buff_mgmt.buff_arr[buff_id].list,
+@@ -906,6 +908,9 @@ again:
+ wil->rx_buff_mgmt.buff_arr[buff_id].skb = NULL;
+ if (!skb) {
+ wil_err(wil, "No Rx skb at buff_id %d\n", buff_id);
++ /* Move the buffer from the active list to the free list */
++ list_move(&wil->rx_buff_mgmt.buff_arr[buff_id].list,
++ &wil->rx_buff_mgmt.free);
+ goto again;
+ }
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+index d8b79cb72b58..e7584b842dce 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -77,6 +77,8 @@ static u16 d11ac_bw(enum brcmu_chan_bw bw)
+ return BRCMU_CHSPEC_D11AC_BW_40;
+ case BRCMU_CHAN_BW_80:
+ return BRCMU_CHSPEC_D11AC_BW_80;
++ case BRCMU_CHAN_BW_160:
++ return BRCMU_CHSPEC_D11AC_BW_160;
+ default:
+ WARN_ON(1);
+ }
+@@ -190,8 +192,38 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
+ break;
+ }
+ break;
+- case BRCMU_CHSPEC_D11AC_BW_8080:
+ case BRCMU_CHSPEC_D11AC_BW_160:
++ switch (ch->sb) {
++ case BRCMU_CHAN_SB_LLL:
++ ch->control_ch_num -= CH_70MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LLU:
++ ch->control_ch_num -= CH_50MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LUL:
++ ch->control_ch_num -= CH_30MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LUU:
++ ch->control_ch_num -= CH_10MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_ULL:
++ ch->control_ch_num += CH_10MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_ULU:
++ ch->control_ch_num += CH_30MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_UUL:
++ ch->control_ch_num += CH_50MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_UUU:
++ ch->control_ch_num += CH_70MHZ_APART;
++ break;
++ default:
++ WARN_ON_ONCE(1);
++ break;
++ }
++ break;
++ case BRCMU_CHSPEC_D11AC_BW_8080:
+ default:
+ WARN_ON_ONCE(1);
+ break;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+index 7b9a77981df1..75b2a0438cfa 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+@@ -29,6 +29,8 @@
+ #define CH_UPPER_SB 0x01
+ #define CH_LOWER_SB 0x02
+ #define CH_EWA_VALID 0x04
++#define CH_70MHZ_APART 14
++#define CH_50MHZ_APART 10
+ #define CH_30MHZ_APART 6
+ #define CH_20MHZ_APART 4
+ #define CH_10MHZ_APART 2
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 6bb1a99a197a..48a3611d6a31 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -704,8 +704,12 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
+ enabled = !!(wifi_pkg->package.elements[1].integer.value);
+ n_profiles = wifi_pkg->package.elements[2].integer.value;
+
+- /* in case of BIOS bug */
+- if (n_profiles <= 0) {
++ /*
++ * Check the validity of n_profiles. The EWRD profiles start
++ * from index 1, so the maximum value allowed here is
++ * ACPI_SAR_PROFILES_NUM - 1.
++ */
++ if (n_profiles <= 0 || n_profiles >= ACPI_SAR_PROFILE_NUM) {
+ ret = -EINVAL;
+ goto out_free;
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index b15b0d84bb7e..155cc2ac0120 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -1233,12 +1233,15 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
+ iwl_mvm_del_aux_sta(mvm);
+
+ /*
+- * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete()
+- * won't be called in this case).
++ * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the
++ * hw (as restart_complete() won't be called in this case) and mac80211
++ * won't execute the restart.
+ * But make sure to cleanup interfaces that have gone down before/during
+ * HW restart was requested.
+ */
+- if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
++ if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
++ test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
++ &mvm->status))
+ ieee80211_iterate_interfaces(mvm->hw, 0,
+ iwl_mvm_cleanup_iterator, mvm);
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+index 30cfd7d50bc9..f2830b5693d2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+@@ -1239,7 +1239,11 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ !(info->flags & IEEE80211_TX_STAT_AMPDU))
+ return;
+
+- rs_rate_from_ucode_rate(tx_resp_hwrate, info->band, &tx_resp_rate);
++ if (rs_rate_from_ucode_rate(tx_resp_hwrate, info->band,
++ &tx_resp_rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
+
+ #ifdef CONFIG_MAC80211_DEBUGFS
+ /* Disable last tx check if we are debugging with fixed rate but
+@@ -1290,7 +1294,10 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ */
+ table = &lq_sta->lq;
+ lq_hwrate = le32_to_cpu(table->rs_table[0]);
+- rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate);
++ if (rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
+
+ /* Here we actually compare this rate to the latest LQ command */
+ if (lq_color != LQ_FLAG_COLOR_GET(table->flags)) {
+@@ -1392,8 +1399,12 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ /* Collect data for each rate used during failed TX attempts */
+ for (i = 0; i <= retries; ++i) {
+ lq_hwrate = le32_to_cpu(table->rs_table[i]);
+- rs_rate_from_ucode_rate(lq_hwrate, info->band,
+- &lq_rate);
++ if (rs_rate_from_ucode_rate(lq_hwrate, info->band,
++ &lq_rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
++
+ /*
+ * Only collect stats if retried rate is in the same RS
+ * table as active/search.
+@@ -3262,7 +3273,10 @@ static void rs_build_rates_table_from_fixed(struct iwl_mvm *mvm,
+ for (i = 0; i < num_rates; i++)
+ lq_cmd->rs_table[i] = ucode_rate_le32;
+
+- rs_rate_from_ucode_rate(ucode_rate, band, &rate);
++ if (rs_rate_from_ucode_rate(ucode_rate, band, &rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
+
+ if (is_mimo(&rate))
+ lq_cmd->mimo_delim = num_rates - 1;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index ff193dca2020..2d21f0a1fa00 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -1405,6 +1405,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ while (!skb_queue_empty(&skbs)) {
+ struct sk_buff *skb = __skb_dequeue(&skbs);
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++ struct ieee80211_hdr *hdr = (void *)skb->data;
+ bool flushed = false;
+
+ skb_freed++;
+@@ -1449,11 +1450,11 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
+ info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
+- /* W/A FW bug: seq_ctl is wrong when the status isn't success */
+- if (status != TX_STATUS_SUCCESS) {
+- struct ieee80211_hdr *hdr = (void *)skb->data;
++ /* W/A FW bug: seq_ctl is wrong upon failure / BAR frame */
++ if (ieee80211_is_back_req(hdr->frame_control))
++ seq_ctl = 0;
++ else if (status != TX_STATUS_SUCCESS)
+ seq_ctl = le16_to_cpu(hdr->seq_ctrl);
+- }
+
+ if (unlikely(!seq_ctl)) {
+ struct ieee80211_hdr *hdr = (void *)skb->data;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index d017aa2a0a8b..d4a31e014c82 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1144,6 +1144,14 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
+ kfree(trans_pcie->rxq);
+ }
+
++static void iwl_pcie_rx_move_to_allocator(struct iwl_rxq *rxq,
++ struct iwl_rb_allocator *rba)
++{
++ spin_lock(&rba->lock);
++ list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
++ spin_unlock(&rba->lock);
++}
++
+ /*
+ * iwl_pcie_rx_reuse_rbd - Recycle used RBDs
+ *
+@@ -1175,9 +1183,7 @@ static void iwl_pcie_rx_reuse_rbd(struct iwl_trans *trans,
+ if ((rxq->used_count % RX_CLAIM_REQ_ALLOC) == RX_POST_REQ_ALLOC) {
+ /* Move the 2 RBDs to the allocator ownership.
+ Allocator has another 6 from pool for the request completion*/
+- spin_lock(&rba->lock);
+- list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
+- spin_unlock(&rba->lock);
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+
+ atomic_inc(&rba->req_pending);
+ queue_work(rba->alloc_wq, &rba->rx_alloc);
+@@ -1396,10 +1402,18 @@ restart:
+ IWL_DEBUG_RX(trans, "Q %d: HW = SW = %d\n", rxq->id, r);
+
+ while (i != r) {
++ struct iwl_rb_allocator *rba = &trans_pcie->rba;
+ struct iwl_rx_mem_buffer *rxb;
+-
+- if (unlikely(rxq->used_count == rxq->queue_size / 2))
++ /* number of RBDs still waiting for page allocation */
++ u32 rb_pending_alloc =
++ atomic_read(&trans_pcie->rba.req_pending) *
++ RX_CLAIM_REQ_ALLOC;
++
++ if (unlikely(rb_pending_alloc >= rxq->queue_size / 2 &&
++ !emergency)) {
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+ emergency = true;
++ }
+
+ rxb = iwl_pcie_get_rxb(trans, rxq, i);
+ if (!rxb)
+@@ -1421,17 +1435,13 @@ restart:
+ iwl_pcie_rx_allocator_get(trans, rxq);
+
+ if (rxq->used_count % RX_CLAIM_REQ_ALLOC == 0 && !emergency) {
+- struct iwl_rb_allocator *rba = &trans_pcie->rba;
+-
+ /* Add the remaining empty RBDs for allocator use */
+- spin_lock(&rba->lock);
+- list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
+- spin_unlock(&rba->lock);
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+ } else if (emergency) {
+ count++;
+ if (count == 8) {
+ count = 0;
+- if (rxq->used_count < rxq->queue_size / 3)
++ if (rb_pending_alloc < rxq->queue_size / 3)
+ emergency = false;
+
+ rxq->read = i;
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index c67a8e7be310..3dbfce972c56 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -456,8 +456,6 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
+ MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn,
+ cardp);
+
+- cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET;
+-
+ lbs_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n", cardp->rx_urb);
+ if ((ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC))) {
+ lbs_deb_usbd(&cardp->udev->dev, "Submit Rx URB failed: %d\n", ret);
+diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+index e92fc5001171..789337ea676a 100644
+--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+@@ -605,9 +605,10 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
+ {
+ unsigned long flags;
+
+- if (recvlength > LBS_CMD_BUFFER_SIZE) {
++ if (recvlength < MESSAGE_HEADER_LEN ||
++ recvlength > LBS_CMD_BUFFER_SIZE) {
+ lbtf_deb_usbd(&cardp->udev->dev,
+- "The receive buffer is too large\n");
++ "The receive buffer is invalid: %d\n", recvlength);
+ kfree_skb(skb);
+ return;
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
+index 23cf437d14f9..1a49d1be042d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
+@@ -128,8 +128,7 @@ __mt76x2_mac_set_beacon(struct mt76x2_dev *dev, u8 bcn_idx, struct sk_buff *skb)
+ if (skb) {
+ ret = mt76_write_beacon(dev, beacon_addr, skb);
+ if (!ret)
+- dev->beacon_data_mask |= BIT(bcn_idx) &
+- dev->beacon_mask;
++ dev->beacon_data_mask |= BIT(bcn_idx);
+ } else {
+ dev->beacon_data_mask &= ~BIT(bcn_idx);
+ for (i = 0; i < beacon_len; i += 4)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2_usb.c
+index 1428cfdee579..9594433234cc 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_usb.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_usb.c
+@@ -107,16 +107,24 @@ static int __maybe_unused mt76x2u_resume(struct usb_interface *intf)
+ mt76u_mcu_complete_urb,
+ &usb->mcu.cmpl);
+ if (err < 0)
+- return err;
++ goto err;
+
+ err = mt76u_submit_rx_buffers(&dev->mt76);
+ if (err < 0)
+- return err;
++ goto err;
+
+ tasklet_enable(&usb->rx_tasklet);
+ tasklet_enable(&usb->tx_tasklet);
+
+- return mt76x2u_init_hardware(dev);
++ err = mt76x2u_init_hardware(dev);
++ if (err < 0)
++ goto err;
++
++ return 0;
++
++err:
++ mt76x2u_cleanup(dev);
++ return err;
+ }
+
+ MODULE_DEVICE_TABLE(usb, mt76x2u_device_table);
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index c0a163e40402..f360690396dd 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -266,15 +266,17 @@ static void rsi_rx_done_handler(struct urb *urb)
+ if (urb->status)
+ goto out;
+
+- if (urb->actual_length <= 0) {
+- rsi_dbg(INFO_ZONE, "%s: Zero length packet\n", __func__);
++ if (urb->actual_length <= 0 ||
++ urb->actual_length > rx_cb->rx_skb->len) {
++ rsi_dbg(INFO_ZONE, "%s: Invalid packet length = %d\n",
++ __func__, urb->actual_length);
+ goto out;
+ }
+ if (skb_queue_len(&dev->rx_q) >= RSI_MAX_RX_PKTS) {
+ rsi_dbg(INFO_ZONE, "Max RX packets reached\n");
+ goto out;
+ }
+- skb_put(rx_cb->rx_skb, urb->actual_length);
++ skb_trim(rx_cb->rx_skb, urb->actual_length);
+ skb_queue_tail(&dev->rx_q, rx_cb->rx_skb);
+
+ rsi_set_event(&dev->rx_thread.event);
+@@ -308,6 +310,7 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num)
+ if (!skb)
+ return -ENOMEM;
+ skb_reserve(skb, MAX_DWORD_ALIGN_BYTES);
++ skb_put(skb, RSI_MAX_RX_USB_PKT_SIZE - MAX_DWORD_ALIGN_BYTES);
+ dword_align_bytes = (unsigned long)skb->data & 0x3f;
+ if (dword_align_bytes > 0)
+ skb_push(skb, dword_align_bytes);
+@@ -319,7 +322,7 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num)
+ usb_rcvbulkpipe(dev->usbdev,
+ dev->bulkin_endpoint_addr[ep_num - 1]),
+ urb->transfer_buffer,
+- RSI_MAX_RX_USB_PKT_SIZE,
++ skb->len,
+ rsi_rx_done_handler,
+ rx_cb);
+
+diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
+index 89b0d0fade9f..19e3c5a0b715 100644
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -957,6 +957,8 @@ static void wl1271_recovery_work(struct work_struct *work)
+ BUG_ON(wl->conf.recovery.bug_on_recovery &&
+ !test_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags));
+
++ clear_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags);
++
+ if (wl->conf.recovery.no_recovery) {
+ wl1271_info("No recovery (chosen on module load). Fw will remain stuck.");
+ goto out_unlock;
+@@ -6710,6 +6712,7 @@ static int __maybe_unused wlcore_runtime_resume(struct device *dev)
+ int ret;
+ unsigned long start_time = jiffies;
+ bool pending = false;
++ bool recovery = false;
+
+ /* Nothing to do if no ELP mode requested */
+ if (!test_bit(WL1271_FLAG_IN_ELP, &wl->flags))
+@@ -6726,7 +6729,7 @@ static int __maybe_unused wlcore_runtime_resume(struct device *dev)
+
+ ret = wlcore_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG, ELPCTRL_WAKE_UP);
+ if (ret < 0) {
+- wl12xx_queue_recovery_work(wl);
++ recovery = true;
+ goto err;
+ }
+
+@@ -6734,11 +6737,12 @@ static int __maybe_unused wlcore_runtime_resume(struct device *dev)
+ ret = wait_for_completion_timeout(&compl,
+ msecs_to_jiffies(WL1271_WAKEUP_TIMEOUT));
+ if (ret == 0) {
+- wl1271_error("ELP wakeup timeout!");
+- wl12xx_queue_recovery_work(wl);
++ wl1271_warning("ELP wakeup timeout!");
+
+ /* Return no error for runtime PM for recovery */
+- return 0;
++ ret = 0;
++ recovery = true;
++ goto err;
+ }
+ }
+
+@@ -6753,6 +6757,12 @@ err:
+ spin_lock_irqsave(&wl->wl_lock, flags);
+ wl->elp_compl = NULL;
+ spin_unlock_irqrestore(&wl->wl_lock, flags);
++
++ if (recovery) {
++ set_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags);
++ wl12xx_queue_recovery_work(wl);
++ }
++
+ return ret;
+ }
+
+diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c
+index 91162f8e0366..9a22056e8d9e 100644
+--- a/drivers/nfc/nfcmrvl/uart.c
++++ b/drivers/nfc/nfcmrvl/uart.c
+@@ -73,10 +73,9 @@ static int nfcmrvl_uart_parse_dt(struct device_node *node,
+ struct device_node *matched_node;
+ int ret;
+
+- matched_node = of_find_compatible_node(node, NULL, "marvell,nfc-uart");
++ matched_node = of_get_compatible_child(node, "marvell,nfc-uart");
+ if (!matched_node) {
+- matched_node = of_find_compatible_node(node, NULL,
+- "mrvl,nfc-uart");
++ matched_node = of_get_compatible_child(node, "mrvl,nfc-uart");
+ if (!matched_node)
+ return -ENODEV;
+ }
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 8aae6dcc839f..9148015ed803 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -488,6 +488,8 @@ static void nd_async_device_register(void *d, async_cookie_t cookie)
+ put_device(dev);
+ }
+ put_device(dev);
++ if (dev->parent)
++ put_device(dev->parent);
+ }
+
+ static void nd_async_device_unregister(void *d, async_cookie_t cookie)
+@@ -507,6 +509,8 @@ void __nd_device_register(struct device *dev)
+ if (!dev)
+ return;
+ dev->bus = &nvdimm_bus_type;
++ if (dev->parent)
++ get_device(dev->parent);
+ get_device(dev);
+ async_schedule_domain(nd_async_device_register, dev,
+ &nd_async_domain);
+diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
+index 6071e2942053..2082ae01b9c8 100644
+--- a/drivers/nvdimm/pmem.c
++++ b/drivers/nvdimm/pmem.c
+@@ -421,9 +421,11 @@ static int pmem_attach_disk(struct device *dev,
+ addr = devm_memremap_pages(dev, &pmem->pgmap);
+ pmem->pfn_flags |= PFN_MAP;
+ memcpy(&bb_res, &pmem->pgmap.res, sizeof(bb_res));
+- } else
++ } else {
+ addr = devm_memremap(dev, pmem->phys_addr,
+ pmem->size, ARCH_MEMREMAP_PMEM);
++ memcpy(&bb_res, &nsio->res, sizeof(bb_res));
++ }
+
+ /*
+ * At release time the queue must be frozen before
+diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
+index fa37afcd43ff..174a418cb171 100644
+--- a/drivers/nvdimm/region_devs.c
++++ b/drivers/nvdimm/region_devs.c
+@@ -560,10 +560,17 @@ static ssize_t region_badblocks_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ struct nd_region *nd_region = to_nd_region(dev);
++ ssize_t rc;
+
+- return badblocks_show(&nd_region->bb, buf, 0);
+-}
++ device_lock(dev);
++ if (dev->driver)
++ rc = badblocks_show(&nd_region->bb, buf, 0);
++ else
++ rc = -ENXIO;
++ device_unlock(dev);
+
++ return rc;
++}
+ static DEVICE_ATTR(badblocks, 0444, region_badblocks_show, NULL);
+
+ static ssize_t resource_show(struct device *dev,
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index 206d63cb1afc..bcd09d3a44da 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -552,8 +552,11 @@ blk_status_t nvmf_fail_nonready_command(struct nvme_ctrl *ctrl,
+ ctrl->state != NVME_CTRL_DEAD &&
+ !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH))
+ return BLK_STS_RESOURCE;
+- nvme_req(rq)->status = NVME_SC_ABORT_REQ;
+- return BLK_STS_IOERR;
++
++ nvme_req(rq)->status = NVME_SC_HOST_PATH_ERROR;
++ blk_mq_start_request(rq);
++ nvme_complete_rq(rq);
++ return BLK_STS_OK;
+ }
+ EXPORT_SYMBOL_GPL(nvmf_fail_nonready_command);
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 9fe3fff818b8..b71c9ad1bf45 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -77,6 +77,13 @@ void nvme_failover_req(struct request *req)
+ queue_work(nvme_wq, &ns->ctrl->ana_work);
+ }
+ break;
++ case NVME_SC_HOST_PATH_ERROR:
++ /*
++ * Temporary transport disruption in talking to the controller.
++ * Try to send on a new path.
++ */
++ nvme_mpath_clear_current_path(ns);
++ break;
+ default:
+ /*
+ * Reset the controller for any non-ANA error as we don't know
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index aa1657831b70..7c530c88b3fb 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -516,11 +516,17 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config)
+ goto err_device_del;
+ }
+
+- if (config->cells)
+- nvmem_add_cells(nvmem, config->cells, config->ncells);
++ if (config->cells) {
++ rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
++ if (rval)
++ goto err_teardown_compat;
++ }
+
+ return nvmem;
+
++err_teardown_compat:
++ if (config->compat)
++ device_remove_bin_file(nvmem->base_dev, &nvmem->eeprom);
+ err_device_del:
+ device_del(&nvmem->dev);
+ err_put_device:
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 74eaedd5b860..70f5fd08891b 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -67,6 +67,7 @@ bool of_node_name_eq(const struct device_node *np, const char *name)
+
+ return (strlen(name) == len) && (strncmp(node_name, name, len) == 0);
+ }
++EXPORT_SYMBOL(of_node_name_eq);
+
+ bool of_node_name_prefix(const struct device_node *np, const char *prefix)
+ {
+@@ -75,6 +76,7 @@ bool of_node_name_prefix(const struct device_node *np, const char *prefix)
+
+ return strncmp(kbasename(np->full_name), prefix, strlen(prefix)) == 0;
+ }
++EXPORT_SYMBOL(of_node_name_prefix);
+
+ int of_n_addr_cells(struct device_node *np)
+ {
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index 7af0ddec936b..20988c426650 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -425,6 +425,7 @@ static int _of_add_opp_table_v2(struct device *dev, struct device_node *opp_np)
+ dev_err(dev, "Not all nodes have performance state set (%d: %d)\n",
+ count, pstate_count);
+ ret = -ENOENT;
++ _dev_pm_opp_remove_table(opp_table, dev, false);
+ goto put_opp_table;
+ }
+
+diff --git a/drivers/pci/controller/dwc/pci-dra7xx.c b/drivers/pci/controller/dwc/pci-dra7xx.c
+index ce9224a36f62..a32d6dde7a57 100644
+--- a/drivers/pci/controller/dwc/pci-dra7xx.c
++++ b/drivers/pci/controller/dwc/pci-dra7xx.c
+@@ -542,7 +542,7 @@ static const struct of_device_id of_dra7xx_pcie_match[] = {
+ };
+
+ /*
+- * dra7xx_pcie_ep_unaligned_memaccess: workaround for AM572x/AM571x Errata i870
++ * dra7xx_pcie_unaligned_memaccess: workaround for AM572x/AM571x Errata i870
+ * @dra7xx: the dra7xx device where the workaround should be applied
+ *
+ * Access to the PCIe slave port that are not 32-bit aligned will result
+@@ -552,7 +552,7 @@ static const struct of_device_id of_dra7xx_pcie_match[] = {
+ *
+ * To avoid this issue set PCIE_SS1_AXI2OCP_LEGACY_MODE_ENABLE to 1.
+ */
+-static int dra7xx_pcie_ep_unaligned_memaccess(struct device *dev)
++static int dra7xx_pcie_unaligned_memaccess(struct device *dev)
+ {
+ int ret;
+ struct device_node *np = dev->of_node;
+@@ -704,6 +704,11 @@ static int __init dra7xx_pcie_probe(struct platform_device *pdev)
+
+ dra7xx_pcie_writel(dra7xx, PCIECTRL_TI_CONF_DEVICE_TYPE,
+ DEVICE_TYPE_RC);
++
++ ret = dra7xx_pcie_unaligned_memaccess(dev);
++ if (ret)
++ dev_err(dev, "WA for Errata i870 not applied\n");
++
+ ret = dra7xx_add_pcie_port(dra7xx, pdev);
+ if (ret < 0)
+ goto err_gpio;
+@@ -717,7 +722,7 @@ static int __init dra7xx_pcie_probe(struct platform_device *pdev)
+ dra7xx_pcie_writel(dra7xx, PCIECTRL_TI_CONF_DEVICE_TYPE,
+ DEVICE_TYPE_EP);
+
+- ret = dra7xx_pcie_ep_unaligned_memaccess(dev);
++ ret = dra7xx_pcie_unaligned_memaccess(dev);
+ if (ret)
+ goto err_gpio;
+
+diff --git a/drivers/pci/controller/pcie-cadence-ep.c b/drivers/pci/controller/pcie-cadence-ep.c
+index 9e87dd7f9ac3..6692654798d4 100644
+--- a/drivers/pci/controller/pcie-cadence-ep.c
++++ b/drivers/pci/controller/pcie-cadence-ep.c
+@@ -258,7 +258,6 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn,
+ u8 intx, bool is_asserted)
+ {
+ struct cdns_pcie *pcie = &ep->pcie;
+- u32 r = ep->max_regions - 1;
+ u32 offset;
+ u16 status;
+ u8 msg_code;
+@@ -268,8 +267,8 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn,
+ /* Set the outbound region if needed. */
+ if (unlikely(ep->irq_pci_addr != CDNS_PCIE_EP_IRQ_PCI_ADDR_LEGACY ||
+ ep->irq_pci_fn != fn)) {
+- /* Last region was reserved for IRQ writes. */
+- cdns_pcie_set_outbound_region_for_normal_msg(pcie, fn, r,
++ /* First region was reserved for IRQ writes. */
++ cdns_pcie_set_outbound_region_for_normal_msg(pcie, fn, 0,
+ ep->irq_phys_addr);
+ ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_LEGACY;
+ ep->irq_pci_fn = fn;
+@@ -347,8 +346,8 @@ static int cdns_pcie_ep_send_msi_irq(struct cdns_pcie_ep *ep, u8 fn,
+ /* Set the outbound region if needed. */
+ if (unlikely(ep->irq_pci_addr != (pci_addr & ~pci_addr_mask) ||
+ ep->irq_pci_fn != fn)) {
+- /* Last region was reserved for IRQ writes. */
+- cdns_pcie_set_outbound_region(pcie, fn, ep->max_regions - 1,
++ /* First region was reserved for IRQ writes. */
++ cdns_pcie_set_outbound_region(pcie, fn, 0,
+ false,
+ ep->irq_phys_addr,
+ pci_addr & ~pci_addr_mask,
+@@ -517,6 +516,8 @@ static int cdns_pcie_ep_probe(struct platform_device *pdev)
+ goto free_epc_mem;
+ }
+ ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_NONE;
++ /* Reserve region 0 for IRQs */
++ set_bit(0, &ep->ob_region_map);
+
+ return 0;
+
+diff --git a/drivers/pci/controller/pcie-cadence.c b/drivers/pci/controller/pcie-cadence.c
+index 975bcdd6b5c0..cd795f6fc1e2 100644
+--- a/drivers/pci/controller/pcie-cadence.c
++++ b/drivers/pci/controller/pcie-cadence.c
+@@ -190,14 +190,16 @@ int cdns_pcie_init_phy(struct device *dev, struct cdns_pcie *pcie)
+
+ for (i = 0; i < phy_count; i++) {
+ of_property_read_string_index(np, "phy-names", i, &name);
+- phy[i] = devm_phy_optional_get(dev, name);
+- if (IS_ERR(phy))
+- return PTR_ERR(phy);
+-
++ phy[i] = devm_phy_get(dev, name);
++ if (IS_ERR(phy[i])) {
++ ret = PTR_ERR(phy[i]);
++ goto err_phy;
++ }
+ link[i] = device_link_add(dev, &phy[i]->dev, DL_FLAG_STATELESS);
+ if (!link[i]) {
++ devm_phy_put(dev, phy[i]);
+ ret = -EINVAL;
+- goto err_link;
++ goto err_phy;
+ }
+ }
+
+@@ -207,13 +209,15 @@ int cdns_pcie_init_phy(struct device *dev, struct cdns_pcie *pcie)
+
+ ret = cdns_pcie_enable_phy(pcie);
+ if (ret)
+- goto err_link;
++ goto err_phy;
+
+ return 0;
+
+-err_link:
+- while (--i >= 0)
++err_phy:
++ while (--i >= 0) {
+ device_link_del(link[i]);
++ devm_phy_put(dev, phy[i]);
++ }
+
+ return ret;
+ }
+diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
+index 861dda69f366..c5ff6ca65eab 100644
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -337,6 +337,17 @@ static struct mtk_pcie_port *mtk_pcie_find_port(struct pci_bus *bus,
+ {
+ struct mtk_pcie *pcie = bus->sysdata;
+ struct mtk_pcie_port *port;
++ struct pci_dev *dev = NULL;
++
++ /*
++ * Walk the bus hierarchy to get the devfn value
++ * of the port in the root bus.
++ */
++ while (bus && bus->number) {
++ dev = bus->self;
++ bus = dev->bus;
++ devfn = dev->devfn;
++ }
+
+ list_for_each_entry(port, &pcie->ports, list)
+ if (port->slot == PCI_SLOT(devfn))
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index f2ef896464b3..af24ed50a245 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -958,7 +958,6 @@ static int __pci_enable_msix(struct pci_dev *dev, struct msix_entry *entries,
+ }
+ }
+ }
+- WARN_ON(!!dev->msix_enabled);
+
+ /* Check whether driver already requested for MSI irq */
+ if (dev->msi_enabled) {
+@@ -1028,8 +1027,6 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
+ if (!pci_msi_supported(dev, minvec))
+ return -EINVAL;
+
+- WARN_ON(!!dev->msi_enabled);
+-
+ /* Check whether driver already requested MSI-X irqs */
+ if (dev->msix_enabled) {
+ pci_info(dev, "can't enable MSI (MSI-X already enabled)\n");
+@@ -1039,6 +1036,9 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
+ if (maxvec < minvec)
+ return -ERANGE;
+
++ if (WARN_ON_ONCE(dev->msi_enabled))
++ return -EINVAL;
++
+ nvec = pci_msi_vec_count(dev);
+ if (nvec < 0)
+ return nvec;
+@@ -1087,6 +1087,9 @@ static int __pci_enable_msix_range(struct pci_dev *dev,
+ if (maxvec < minvec)
+ return -ERANGE;
+
++ if (WARN_ON_ONCE(dev->msix_enabled))
++ return -EINVAL;
++
+ for (;;) {
+ if (affd) {
+ nvec = irq_calc_affinity_vectors(minvec, nvec, affd);
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index c2ab57705043..f8436d1c4d45 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -762,19 +762,33 @@ static void pci_acpi_setup(struct device *dev)
+ return;
+
+ device_set_wakeup_capable(dev, true);
++ /*
++ * For bridges that can do D3 we enable wake automatically (as
++ * we do for the power management itself in that case). The
++ * reason is that the bridge may have additional methods such as
++ * _DSW that need to be called.
++ */
++ if (pci_dev->bridge_d3)
++ device_wakeup_enable(dev);
++
+ acpi_pci_wakeup(pci_dev, false);
+ }
+
+ static void pci_acpi_cleanup(struct device *dev)
+ {
+ struct acpi_device *adev = ACPI_COMPANION(dev);
++ struct pci_dev *pci_dev = to_pci_dev(dev);
+
+ if (!adev)
+ return;
+
+ pci_acpi_remove_pm_notifier(adev);
+- if (adev->wakeup.flags.valid)
++ if (adev->wakeup.flags.valid) {
++ if (pci_dev->bridge_d3)
++ device_wakeup_disable(dev);
++
+ device_set_wakeup_capable(dev, false);
++ }
+ }
+
+ static bool pci_acpi_bus_match(struct device *dev)
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 5326916715d2..f78860ce884b 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -991,7 +991,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
+ * All PCIe functions are in one slot, remove one function will remove
+ * the whole slot, so just wait until we are the last function left.
+ */
+- if (!list_is_last(&pdev->bus_list, &parent->subordinate->devices))
++ if (!list_empty(&parent->subordinate->devices))
+ goto out;
+
+ link = parent->link_state;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 6bc27b7fd452..c0673a717239 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3190,7 +3190,11 @@ static void disable_igfx_irq(struct pci_dev *dev)
+
+ pci_iounmap(dev, regs);
+ }
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0042, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0046, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x004a, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0106, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq);
+
+diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
+index 461e7fd2756f..e9c6b120cf45 100644
+--- a/drivers/pci/remove.c
++++ b/drivers/pci/remove.c
+@@ -25,9 +25,6 @@ static void pci_stop_dev(struct pci_dev *dev)
+
+ pci_dev_assign_added(dev, false);
+ }
+-
+- if (dev->bus->self)
+- pcie_aspm_exit_link_state(dev);
+ }
+
+ static void pci_destroy_dev(struct pci_dev *dev)
+@@ -41,6 +38,7 @@ static void pci_destroy_dev(struct pci_dev *dev)
+ list_del(&dev->bus_list);
+ up_write(&pci_bus_sem);
+
++ pcie_aspm_exit_link_state(dev);
+ pci_bridge_d3_update(dev);
+ pci_free_resources(dev);
+ put_device(&dev->dev);
+diff --git a/drivers/pcmcia/ricoh.h b/drivers/pcmcia/ricoh.h
+index 01098c841f87..8ac7b138c094 100644
+--- a/drivers/pcmcia/ricoh.h
++++ b/drivers/pcmcia/ricoh.h
+@@ -119,6 +119,10 @@
+ #define RL5C4XX_MISC_CONTROL 0x2F /* 8 bit */
+ #define RL5C4XX_ZV_ENABLE 0x08
+
++/* Misc Control 3 Register */
++#define RL5C4XX_MISC3 0x00A2 /* 16 bit */
++#define RL5C47X_MISC3_CB_CLKRUN_DIS BIT(1)
++
+ #ifdef __YENTA_H
+
+ #define rl_misc(socket) ((socket)->private[0])
+@@ -156,6 +160,35 @@ static void ricoh_set_zv(struct yenta_socket *socket)
+ }
+ }
+
++static void ricoh_set_clkrun(struct yenta_socket *socket, bool quiet)
++{
++ u16 misc3;
++
++ /*
++ * RL5C475II likely has this setting, too, however no datasheet
++ * is publicly available for this chip
++ */
++ if (socket->dev->device != PCI_DEVICE_ID_RICOH_RL5C476 &&
++ socket->dev->device != PCI_DEVICE_ID_RICOH_RL5C478)
++ return;
++
++ if (socket->dev->revision < 0x80)
++ return;
++
++ misc3 = config_readw(socket, RL5C4XX_MISC3);
++ if (misc3 & RL5C47X_MISC3_CB_CLKRUN_DIS) {
++ if (!quiet)
++ dev_dbg(&socket->dev->dev,
++ "CLKRUN feature already disabled\n");
++ } else if (disable_clkrun) {
++ if (!quiet)
++ dev_info(&socket->dev->dev,
++ "Disabling CLKRUN feature\n");
++ misc3 |= RL5C47X_MISC3_CB_CLKRUN_DIS;
++ config_writew(socket, RL5C4XX_MISC3, misc3);
++ }
++}
++
+ static void ricoh_save_state(struct yenta_socket *socket)
+ {
+ rl_misc(socket) = config_readw(socket, RL5C4XX_MISC);
+@@ -172,6 +205,7 @@ static void ricoh_restore_state(struct yenta_socket *socket)
+ config_writew(socket, RL5C4XX_16BIT_IO_0, rl_io(socket));
+ config_writew(socket, RL5C4XX_16BIT_MEM_0, rl_mem(socket));
+ config_writew(socket, RL5C4XX_CONFIG, rl_config(socket));
++ ricoh_set_clkrun(socket, true);
+ }
+
+
+@@ -197,6 +231,7 @@ static int ricoh_override(struct yenta_socket *socket)
+ config_writew(socket, RL5C4XX_CONFIG, config);
+
+ ricoh_set_zv(socket);
++ ricoh_set_clkrun(socket, false);
+
+ return 0;
+ }
+diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
+index ab3da2262f0f..ac6a3f46b1e6 100644
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -26,7 +26,8 @@
+
+ static bool disable_clkrun;
+ module_param(disable_clkrun, bool, 0444);
+-MODULE_PARM_DESC(disable_clkrun, "If PC card doesn't function properly, please try this option");
++MODULE_PARM_DESC(disable_clkrun,
++ "If PC card doesn't function properly, please try this option (TI and Ricoh bridges only)");
+
+ static bool isa_probe = 1;
+ module_param(isa_probe, bool, 0444);
+diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+index 6556dbeae65e..ac251c62bc66 100644
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+@@ -319,6 +319,8 @@ static int pmic_mpp_set_mux(struct pinctrl_dev *pctldev, unsigned function,
+ pad->function = function;
+
+ ret = pmic_mpp_write_mode_ctl(state, pad);
++ if (ret < 0)
++ return ret;
+
+ val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT;
+
+@@ -343,13 +345,12 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev,
+
+ switch (param) {
+ case PIN_CONFIG_BIAS_DISABLE:
+- arg = pad->pullup == PMIC_MPP_PULL_UP_OPEN;
++ if (pad->pullup != PMIC_MPP_PULL_UP_OPEN)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_UP:
+ switch (pad->pullup) {
+- case PMIC_MPP_PULL_UP_OPEN:
+- arg = 0;
+- break;
+ case PMIC_MPP_PULL_UP_0P6KOHM:
+ arg = 600;
+ break;
+@@ -364,13 +365,17 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev,
+ }
+ break;
+ case PIN_CONFIG_BIAS_HIGH_IMPEDANCE:
+- arg = !pad->is_enabled;
++ if (pad->is_enabled)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_POWER_SOURCE:
+ arg = pad->power_source;
+ break;
+ case PIN_CONFIG_INPUT_ENABLE:
+- arg = pad->input_enabled;
++ if (!pad->input_enabled)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_OUTPUT:
+ arg = pad->out_value;
+@@ -382,7 +387,9 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev,
+ arg = pad->amux_input;
+ break;
+ case PMIC_MPP_CONF_PAIRED:
+- arg = pad->paired;
++ if (!pad->paired)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_DRIVE_STRENGTH:
+ arg = pad->drive_strength;
+@@ -455,7 +462,7 @@ static int pmic_mpp_config_set(struct pinctrl_dev *pctldev, unsigned int pin,
+ pad->dtest = arg;
+ break;
+ case PIN_CONFIG_DRIVE_STRENGTH:
+- arg = pad->drive_strength;
++ pad->drive_strength = arg;
+ break;
+ case PMIC_MPP_CONF_AMUX_ROUTE:
+ if (arg >= PMIC_MPP_AMUX_ROUTE_ABUS4)
+@@ -502,6 +509,10 @@ static int pmic_mpp_config_set(struct pinctrl_dev *pctldev, unsigned int pin,
+ if (ret < 0)
+ return ret;
+
++ ret = pmic_mpp_write(state, pad, PMIC_MPP_REG_SINK_CTL, pad->drive_strength);
++ if (ret < 0)
++ return ret;
++
+ val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT;
+
+ return pmic_mpp_write(state, pad, PMIC_MPP_REG_EN_CTL, val);
+diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+index f53e32a9d8fc..0e153bae322e 100644
+--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+@@ -260,22 +260,32 @@ static int pm8xxx_pin_config_get(struct pinctrl_dev *pctldev,
+
+ switch (param) {
+ case PIN_CONFIG_BIAS_DISABLE:
+- arg = pin->bias == PM8XXX_GPIO_BIAS_NP;
++ if (pin->bias != PM8XXX_GPIO_BIAS_NP)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+- arg = pin->bias == PM8XXX_GPIO_BIAS_PD;
++ if (pin->bias != PM8XXX_GPIO_BIAS_PD)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_UP:
+- arg = pin->bias <= PM8XXX_GPIO_BIAS_PU_1P5_30;
++ if (pin->bias > PM8XXX_GPIO_BIAS_PU_1P5_30)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PM8XXX_QCOM_PULL_UP_STRENGTH:
+ arg = pin->pull_up_strength;
+ break;
+ case PIN_CONFIG_BIAS_HIGH_IMPEDANCE:
+- arg = pin->disable;
++ if (!pin->disable)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_INPUT_ENABLE:
+- arg = pin->mode == PM8XXX_GPIO_MODE_INPUT;
++ if (pin->mode != PM8XXX_GPIO_MODE_INPUT)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_OUTPUT:
+ if (pin->mode & PM8XXX_GPIO_MODE_OUTPUT)
+@@ -290,10 +300,14 @@ static int pm8xxx_pin_config_get(struct pinctrl_dev *pctldev,
+ arg = pin->output_strength;
+ break;
+ case PIN_CONFIG_DRIVE_PUSH_PULL:
+- arg = !pin->open_drain;
++ if (pin->open_drain)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_DRIVE_OPEN_DRAIN:
+- arg = pin->open_drain;
++ if (!pin->open_drain)
++ return -EINVAL;
++ arg = 1;
+ break;
+ default:
+ return -EINVAL;
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+index 4d9bf9b3e9f3..26ebedc1f6d3 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+@@ -1079,10 +1079,9 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+ * We suppose that we won't have any more functions than pins,
+ * we'll reallocate that later anyway
+ */
+- pctl->functions = devm_kcalloc(&pdev->dev,
+- pctl->ngroups,
+- sizeof(*pctl->functions),
+- GFP_KERNEL);
++ pctl->functions = kcalloc(pctl->ngroups,
++ sizeof(*pctl->functions),
++ GFP_KERNEL);
+ if (!pctl->functions)
+ return -ENOMEM;
+
+@@ -1133,8 +1132,10 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+
+ func_item = sunxi_pinctrl_find_function_by_name(pctl,
+ func->name);
+- if (!func_item)
++ if (!func_item) {
++ kfree(pctl->functions);
+ return -EINVAL;
++ }
+
+ if (!func_item->groups) {
+ func_item->groups =
+@@ -1142,8 +1143,10 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+ func_item->ngroups,
+ sizeof(*func_item->groups),
+ GFP_KERNEL);
+- if (!func_item->groups)
++ if (!func_item->groups) {
++ kfree(pctl->functions);
+ return -ENOMEM;
++ }
+ }
+
+ func_grp = func_item->groups;
+diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
+index bbcaee56db9d..b6a7d9f74cf3 100644
+--- a/drivers/power/supply/twl4030_charger.c
++++ b/drivers/power/supply/twl4030_charger.c
+@@ -996,12 +996,13 @@ static int twl4030_bci_probe(struct platform_device *pdev)
+ if (bci->dev->of_node) {
+ struct device_node *phynode;
+
+- phynode = of_find_compatible_node(bci->dev->of_node->parent,
+- NULL, "ti,twl4030-usb");
++ phynode = of_get_compatible_child(bci->dev->of_node->parent,
++ "ti,twl4030-usb");
+ if (phynode) {
+ bci->usb_nb.notifier_call = twl4030_bci_usb_ncb;
+ bci->transceiver = devm_usb_get_phy_by_node(
+ bci->dev, phynode, &bci->usb_nb);
++ of_node_put(phynode);
+ if (IS_ERR(bci->transceiver)) {
+ ret = PTR_ERR(bci->transceiver);
+ if (ret == -EPROBE_DEFER)
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 61a760ee4aac..e9ab90c19304 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -198,6 +198,9 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->fatal_irq = platform_get_irq_byname(pdev, "fatal");
++ if (q6v5->fatal_irq == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->fatal_irq,
+ NULL, q6v5_fatal_interrupt,
+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+@@ -208,6 +211,9 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->ready_irq = platform_get_irq_byname(pdev, "ready");
++ if (q6v5->ready_irq == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->ready_irq,
+ NULL, q6v5_ready_interrupt,
+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+@@ -218,6 +224,9 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->handover_irq = platform_get_irq_byname(pdev, "handover");
++ if (q6v5->handover_irq == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->handover_irq,
+ NULL, q6v5_handover_interrupt,
+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+@@ -229,6 +238,9 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ disable_irq(q6v5->handover_irq);
+
+ q6v5->stop_irq = platform_get_irq_byname(pdev, "stop-ack");
++ if (q6v5->stop_irq == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->stop_irq,
+ NULL, q6v5_stop_interrupt,
+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
+index 8da83a4ebadc..b2e5a6abf7d5 100644
+--- a/drivers/rpmsg/qcom_smd.c
++++ b/drivers/rpmsg/qcom_smd.c
+@@ -1122,8 +1122,10 @@ static struct qcom_smd_channel *qcom_smd_create_channel(struct qcom_smd_edge *ed
+
+ channel->edge = edge;
+ channel->name = kstrdup(name, GFP_KERNEL);
+- if (!channel->name)
+- return ERR_PTR(-ENOMEM);
++ if (!channel->name) {
++ ret = -ENOMEM;
++ goto free_channel;
++ }
+
+ spin_lock_init(&channel->tx_lock);
+ spin_lock_init(&channel->recv_lock);
+@@ -1173,6 +1175,7 @@ static struct qcom_smd_channel *qcom_smd_create_channel(struct qcom_smd_edge *ed
+
+ free_name_and_channel:
+ kfree(channel->name);
++free_channel:
+ kfree(channel);
+
+ return ERR_PTR(ret);
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index cd3a2411bc2f..df0c5776d49b 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -50,6 +50,7 @@
+ /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */
+ #include <linux/mc146818rtc.h>
+
++#ifdef CONFIG_ACPI
+ /*
+ * Use ACPI SCI to replace HPET interrupt for RTC Alarm event
+ *
+@@ -61,6 +62,18 @@
+ static bool use_acpi_alarm;
+ module_param(use_acpi_alarm, bool, 0444);
+
++static inline int cmos_use_acpi_alarm(void)
++{
++ return use_acpi_alarm;
++}
++#else /* !CONFIG_ACPI */
++
++static inline int cmos_use_acpi_alarm(void)
++{
++ return 0;
++}
++#endif
++
+ struct cmos_rtc {
+ struct rtc_device *rtc;
+ struct device *dev;
+@@ -167,9 +180,9 @@ static inline int hpet_unregister_irq_handler(irq_handler_t handler)
+ #endif
+
+ /* Don't use HPET for RTC Alarm event if ACPI Fixed event is used */
+-static int use_hpet_alarm(void)
++static inline int use_hpet_alarm(void)
+ {
+- return is_hpet_enabled() && !use_acpi_alarm;
++ return is_hpet_enabled() && !cmos_use_acpi_alarm();
+ }
+
+ /*----------------------------------------------------------------*/
+@@ -340,7 +353,7 @@ static void cmos_irq_enable(struct cmos_rtc *cmos, unsigned char mask)
+ if (use_hpet_alarm())
+ hpet_set_rtc_irq_bit(mask);
+
+- if ((mask & RTC_AIE) && use_acpi_alarm) {
++ if ((mask & RTC_AIE) && cmos_use_acpi_alarm()) {
+ if (cmos->wake_on)
+ cmos->wake_on(cmos->dev);
+ }
+@@ -358,7 +371,7 @@ static void cmos_irq_disable(struct cmos_rtc *cmos, unsigned char mask)
+ if (use_hpet_alarm())
+ hpet_mask_rtc_irq_bit(mask);
+
+- if ((mask & RTC_AIE) && use_acpi_alarm) {
++ if ((mask & RTC_AIE) && cmos_use_acpi_alarm()) {
+ if (cmos->wake_off)
+ cmos->wake_off(cmos->dev);
+ }
+@@ -980,7 +993,7 @@ static int cmos_suspend(struct device *dev)
+ }
+ spin_unlock_irq(&rtc_lock);
+
+- if ((tmp & RTC_AIE) && !use_acpi_alarm) {
++ if ((tmp & RTC_AIE) && !cmos_use_acpi_alarm()) {
+ cmos->enabled_wake = 1;
+ if (cmos->wake_on)
+ cmos->wake_on(dev);
+@@ -1031,7 +1044,7 @@ static void cmos_check_wkalrm(struct device *dev)
+ * ACPI RTC wake event is cleared after resume from STR,
+ * ACK the rtc irq here
+ */
+- if (t_now >= cmos->alarm_expires && use_acpi_alarm) {
++ if (t_now >= cmos->alarm_expires && cmos_use_acpi_alarm()) {
+ cmos_interrupt(0, (void *)cmos->rtc);
+ return;
+ }
+@@ -1053,7 +1066,7 @@ static int __maybe_unused cmos_resume(struct device *dev)
+ struct cmos_rtc *cmos = dev_get_drvdata(dev);
+ unsigned char tmp;
+
+- if (cmos->enabled_wake && !use_acpi_alarm) {
++ if (cmos->enabled_wake && !cmos_use_acpi_alarm()) {
+ if (cmos->wake_off)
+ cmos->wake_off(dev);
+ else
+@@ -1132,7 +1145,7 @@ static u32 rtc_handler(void *context)
+ * Or else, ACPI SCI is enabled during suspend/resume only,
+ * update rtc irq in that case.
+ */
+- if (use_acpi_alarm)
++ if (cmos_use_acpi_alarm())
+ cmos_interrupt(0, (void *)cmos->rtc);
+ else {
+ /* Fix me: can we use cmos_interrupt() here as well? */
+diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
+index 4b2b4627daeb..71396b62dc52 100644
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -1384,7 +1384,6 @@ static void ds1307_clks_register(struct ds1307 *ds1307)
+ static const struct regmap_config regmap_config = {
+ .reg_bits = 8,
+ .val_bits = 8,
+- .max_register = 0x9,
+ };
+
+ static int ds1307_probe(struct i2c_client *client,
+diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c
+index c3fc34b9964d..9e5d3f7d29ae 100644
+--- a/drivers/scsi/esp_scsi.c
++++ b/drivers/scsi/esp_scsi.c
+@@ -1338,6 +1338,7 @@ static int esp_data_bytes_sent(struct esp *esp, struct esp_cmd_entry *ent,
+
+ bytes_sent = esp->data_dma_len;
+ bytes_sent -= ecount;
++ bytes_sent -= esp->send_cmd_residual;
+
+ /*
+ * The am53c974 has a DMA 'pecularity'. The doc states:
+diff --git a/drivers/scsi/esp_scsi.h b/drivers/scsi/esp_scsi.h
+index 8163dca2071b..a77772777a30 100644
+--- a/drivers/scsi/esp_scsi.h
++++ b/drivers/scsi/esp_scsi.h
+@@ -540,6 +540,8 @@ struct esp {
+
+ void *dma;
+ int dmarev;
++
++ u32 send_cmd_residual;
+ };
+
+ /* A front-end driver for the ESP chip should do the following in
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 5c7858e735c9..200b5bca1f5f 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -4158,9 +4158,17 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
+ }
+ lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
+
+- spin_lock_irqsave(&phba->hbalock, flags);
+- lpfc_cmd->pCmd = NULL;
+- spin_unlock_irqrestore(&phba->hbalock, flags);
++ /* If pCmd was set to NULL from abort path, do not call scsi_done */
++ if (xchg(&lpfc_cmd->pCmd, NULL) == NULL) {
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_FCP,
++ "0711 FCP cmd already NULL, sid: 0x%06x, "
++ "did: 0x%06x, oxid: 0x%04x\n",
++ vport->fc_myDID,
++ (pnode) ? pnode->nlp_DID : 0,
++ phba->sli_rev == LPFC_SLI_REV4 ?
++ lpfc_cmd->cur_iocbq.sli4_xritag : 0xffff);
++ return;
++ }
+
+ /* The sdev is not guaranteed to be valid post scsi_done upcall. */
+ cmd->scsi_done(cmd);
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 9830bdb6e072..a95c823cd1a4 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -3797,6 +3797,7 @@ lpfc_sli_handle_slow_ring_event_s4(struct lpfc_hba *phba,
+ struct hbq_dmabuf *dmabuf;
+ struct lpfc_cq_event *cq_event;
+ unsigned long iflag;
++ int count = 0;
+
+ spin_lock_irqsave(&phba->hbalock, iflag);
+ phba->hba_flag &= ~HBA_SP_QUEUE_EVT;
+@@ -3818,16 +3819,22 @@ lpfc_sli_handle_slow_ring_event_s4(struct lpfc_hba *phba,
+ if (irspiocbq)
+ lpfc_sli_sp_handle_rspiocb(phba, pring,
+ irspiocbq);
++ count++;
+ break;
+ case CQE_CODE_RECEIVE:
+ case CQE_CODE_RECEIVE_V1:
+ dmabuf = container_of(cq_event, struct hbq_dmabuf,
+ cq_event);
+ lpfc_sli4_handle_received_buffer(phba, dmabuf);
++ count++;
+ break;
+ default:
+ break;
+ }
++
++ /* Limit the number of events to 64 to avoid soft lockups */
++ if (count == 64)
++ break;
+ }
+ }
+
+diff --git a/drivers/scsi/mac_esp.c b/drivers/scsi/mac_esp.c
+index eb551f3cc471..71879f2207e0 100644
+--- a/drivers/scsi/mac_esp.c
++++ b/drivers/scsi/mac_esp.c
+@@ -427,6 +427,8 @@ static void mac_esp_send_pio_cmd(struct esp *esp, u32 addr, u32 esp_count,
+ scsi_esp_cmd(esp, ESP_CMD_TI);
+ }
+ }
++
++ esp->send_cmd_residual = esp_count;
+ }
+
+ static int mac_esp_irq_pending(struct esp *esp)
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 9aa9590c5373..f6de7526ded5 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -7523,6 +7523,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
+ get_user(user_sense_off, &cioc->sense_off))
+ return -EFAULT;
+
++ if (local_sense_off != user_sense_off)
++ return -EINVAL;
++
+ if (local_sense_len) {
+ void __user **sense_ioc_ptr =
+ (void __user **)((u8 *)((unsigned long)&ioc->frame.raw) + local_sense_off);
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 2c6c2cd5a0d0..596a9b214df1 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -493,7 +493,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+ qla2xxx_wake_dpc(vha);
+ }
+- } else if (!abort_active) {
++ } else if (current == ha->dpc_thread) {
+ /* call abort directly since we are in the DPC thread */
+ ql_dbg(ql_dbg_mbx, vha, 0x101d,
+ "Timeout, calling abort_isp.\n");
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index c55f38ec391c..54074dd483a7 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1691,8 +1691,9 @@ static void __ufshcd_release(struct ufs_hba *hba)
+
+ hba->clk_gating.state = REQ_CLKS_OFF;
+ trace_ufshcd_clk_gating(dev_name(hba->dev), hba->clk_gating.state);
+- schedule_delayed_work(&hba->clk_gating.gate_work,
+- msecs_to_jiffies(hba->clk_gating.delay_ms));
++ queue_delayed_work(hba->clk_gating.clk_gating_workq,
++ &hba->clk_gating.gate_work,
++ msecs_to_jiffies(hba->clk_gating.delay_ms));
+ }
+
+ void ufshcd_release(struct ufs_hba *hba)
+diff --git a/drivers/soc/qcom/rmtfs_mem.c b/drivers/soc/qcom/rmtfs_mem.c
+index 8a3678c2e83c..97bb5989aa21 100644
+--- a/drivers/soc/qcom/rmtfs_mem.c
++++ b/drivers/soc/qcom/rmtfs_mem.c
+@@ -212,6 +212,11 @@ static int qcom_rmtfs_mem_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "failed to parse qcom,vmid\n");
+ goto remove_cdev;
+ } else if (!ret) {
++ if (!qcom_scm_is_available()) {
++ ret = -EPROBE_DEFER;
++ goto remove_cdev;
++ }
++
+ perms[0].vmid = QCOM_SCM_VMID_HLOS;
+ perms[0].perm = QCOM_SCM_PERM_RW;
+ perms[1].vmid = vmid;
+diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
+index 2d6f3fcf3211..ed71a4c9c8b2 100644
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -1288,7 +1288,7 @@ static void tegra_pmc_init_tsense_reset(struct tegra_pmc *pmc)
+ if (!pmc->soc->has_tsense_reset)
+ return;
+
+- np = of_find_node_by_name(pmc->dev->of_node, "i2c-thermtrip");
++ np = of_get_child_by_name(pmc->dev->of_node, "i2c-thermtrip");
+ if (!np) {
+ dev_warn(dev, "i2c-thermtrip node not found, %s.\n", disabled);
+ return;
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 8612525fa4e3..584bcb018a62 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -89,7 +89,7 @@
+ #define BSPI_BPP_MODE_SELECT_MASK BIT(8)
+ #define BSPI_BPP_ADDR_SELECT_MASK BIT(16)
+
+-#define BSPI_READ_LENGTH 512
++#define BSPI_READ_LENGTH 256
+
+ /* MSPI register offsets */
+ #define MSPI_SPCR0_LSB 0x000
+@@ -355,7 +355,7 @@ static int bcm_qspi_bspi_set_flex_mode(struct bcm_qspi *qspi,
+ int bpc = 0, bpp = 0;
+ u8 command = op->cmd.opcode;
+ int width = op->cmd.buswidth ? op->cmd.buswidth : SPI_NBITS_SINGLE;
+- int addrlen = op->addr.nbytes * 8;
++ int addrlen = op->addr.nbytes;
+ int flex_mode = 1;
+
+ dev_dbg(&qspi->pdev->dev, "set flex mode w %x addrlen %x hp %d\n",
+diff --git a/drivers/spi/spi-ep93xx.c b/drivers/spi/spi-ep93xx.c
+index f1526757aaf6..79fc3940245a 100644
+--- a/drivers/spi/spi-ep93xx.c
++++ b/drivers/spi/spi-ep93xx.c
+@@ -246,6 +246,19 @@ static int ep93xx_spi_read_write(struct spi_master *master)
+ return -EINPROGRESS;
+ }
+
++static enum dma_transfer_direction
++ep93xx_dma_data_to_trans_dir(enum dma_data_direction dir)
++{
++ switch (dir) {
++ case DMA_TO_DEVICE:
++ return DMA_MEM_TO_DEV;
++ case DMA_FROM_DEVICE:
++ return DMA_DEV_TO_MEM;
++ default:
++ return DMA_TRANS_NONE;
++ }
++}
++
+ /**
+ * ep93xx_spi_dma_prepare() - prepares a DMA transfer
+ * @master: SPI master
+@@ -257,7 +270,7 @@ static int ep93xx_spi_read_write(struct spi_master *master)
+ */
+ static struct dma_async_tx_descriptor *
+ ep93xx_spi_dma_prepare(struct spi_master *master,
+- enum dma_transfer_direction dir)
++ enum dma_data_direction dir)
+ {
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct spi_transfer *xfer = master->cur_msg->state;
+@@ -277,9 +290,9 @@ ep93xx_spi_dma_prepare(struct spi_master *master,
+ buswidth = DMA_SLAVE_BUSWIDTH_1_BYTE;
+
+ memset(&conf, 0, sizeof(conf));
+- conf.direction = dir;
++ conf.direction = ep93xx_dma_data_to_trans_dir(dir);
+
+- if (dir == DMA_DEV_TO_MEM) {
++ if (dir == DMA_FROM_DEVICE) {
+ chan = espi->dma_rx;
+ buf = xfer->rx_buf;
+ sgt = &espi->rx_sgt;
+@@ -343,7 +356,8 @@ ep93xx_spi_dma_prepare(struct spi_master *master,
+ if (!nents)
+ return ERR_PTR(-ENOMEM);
+
+- txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents, dir, DMA_CTRL_ACK);
++ txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents, conf.direction,
++ DMA_CTRL_ACK);
+ if (!txd) {
+ dma_unmap_sg(chan->device->dev, sgt->sgl, sgt->nents, dir);
+ return ERR_PTR(-ENOMEM);
+@@ -360,13 +374,13 @@ ep93xx_spi_dma_prepare(struct spi_master *master,
+ * unmapped.
+ */
+ static void ep93xx_spi_dma_finish(struct spi_master *master,
+- enum dma_transfer_direction dir)
++ enum dma_data_direction dir)
+ {
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct dma_chan *chan;
+ struct sg_table *sgt;
+
+- if (dir == DMA_DEV_TO_MEM) {
++ if (dir == DMA_FROM_DEVICE) {
+ chan = espi->dma_rx;
+ sgt = &espi->rx_sgt;
+ } else {
+@@ -381,8 +395,8 @@ static void ep93xx_spi_dma_callback(void *callback_param)
+ {
+ struct spi_master *master = callback_param;
+
+- ep93xx_spi_dma_finish(master, DMA_MEM_TO_DEV);
+- ep93xx_spi_dma_finish(master, DMA_DEV_TO_MEM);
++ ep93xx_spi_dma_finish(master, DMA_TO_DEVICE);
++ ep93xx_spi_dma_finish(master, DMA_FROM_DEVICE);
+
+ spi_finalize_current_transfer(master);
+ }
+@@ -392,15 +406,15 @@ static int ep93xx_spi_dma_transfer(struct spi_master *master)
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct dma_async_tx_descriptor *rxd, *txd;
+
+- rxd = ep93xx_spi_dma_prepare(master, DMA_DEV_TO_MEM);
++ rxd = ep93xx_spi_dma_prepare(master, DMA_FROM_DEVICE);
+ if (IS_ERR(rxd)) {
+ dev_err(&master->dev, "DMA RX failed: %ld\n", PTR_ERR(rxd));
+ return PTR_ERR(rxd);
+ }
+
+- txd = ep93xx_spi_dma_prepare(master, DMA_MEM_TO_DEV);
++ txd = ep93xx_spi_dma_prepare(master, DMA_TO_DEVICE);
+ if (IS_ERR(txd)) {
+- ep93xx_spi_dma_finish(master, DMA_DEV_TO_MEM);
++ ep93xx_spi_dma_finish(master, DMA_FROM_DEVICE);
+ dev_err(&master->dev, "DMA TX failed: %ld\n", PTR_ERR(txd));
+ return PTR_ERR(txd);
+ }
+diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
+index 421bfc7dda67..088772ebef9b 100644
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -295,9 +295,11 @@ static int spi_gpio_request(struct device *dev,
+ spi_gpio->miso = devm_gpiod_get_optional(dev, "miso", GPIOD_IN);
+ if (IS_ERR(spi_gpio->miso))
+ return PTR_ERR(spi_gpio->miso);
+- if (!spi_gpio->miso)
+- /* HW configuration without MISO pin */
+- *mflags |= SPI_MASTER_NO_RX;
++ /*
++ * No setting SPI_MASTER_NO_RX here - if there is only a MOSI
++ * pin connected the host can still do RX by changing the
++ * direction of the line.
++ */
+
+ spi_gpio->sck = devm_gpiod_get(dev, "sck", GPIOD_OUT_LOW);
+ if (IS_ERR(spi_gpio->sck))
+@@ -423,7 +425,7 @@ static int spi_gpio_probe(struct platform_device *pdev)
+ spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
+ spi_gpio->bitbang.set_line_direction = spi_gpio_set_direction;
+
+- if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
++ if ((master_flags & SPI_MASTER_NO_TX) == 0) {
+ spi_gpio->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_word_mode0;
+ spi_gpio->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_word_mode1;
+ spi_gpio->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_word_mode2;
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index e43842c7a31a..eb72dba71d83 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -346,10 +346,25 @@ EXPORT_SYMBOL_GPL(spi_mem_get_name);
+ int spi_mem_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op)
+ {
+ struct spi_controller *ctlr = mem->spi->controller;
++ size_t len;
++
++ len = sizeof(op->cmd.opcode) + op->addr.nbytes + op->dummy.nbytes;
+
+ if (ctlr->mem_ops && ctlr->mem_ops->adjust_op_size)
+ return ctlr->mem_ops->adjust_op_size(mem, op);
+
++ if (!ctlr->mem_ops || !ctlr->mem_ops->exec_op) {
++ if (len > spi_max_transfer_size(mem->spi))
++ return -EINVAL;
++
++ op->data.nbytes = min3((size_t)op->data.nbytes,
++ spi_max_transfer_size(mem->spi),
++ spi_max_message_size(mem->spi) -
++ len);
++ if (!op->data.nbytes)
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(spi_mem_adjust_op_size);
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 86c0156e6c88..fc3093d21b96 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2754,7 +2754,7 @@ static void target_release_cmd_kref(struct kref *kref)
+ if (se_sess) {
+ spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
+ list_del_init(&se_cmd->se_cmd_list);
+- if (list_empty(&se_sess->sess_cmd_list))
++ if (se_sess->sess_tearing_down && list_empty(&se_sess->sess_cmd_list))
+ wake_up(&se_sess->cmd_list_wq);
+ spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+ }
+@@ -2907,7 +2907,7 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
+
+ spin_lock_irq(&se_sess->sess_cmd_lock);
+ do {
+- ret = wait_event_interruptible_lock_irq_timeout(
++ ret = wait_event_lock_irq_timeout(
+ se_sess->cmd_list_wq,
+ list_empty(&se_sess->sess_cmd_list),
+ se_sess->sess_cmd_lock, 180 * HZ);
+diff --git a/drivers/tc/tc.c b/drivers/tc/tc.c
+index 3be9519654e5..cf3fad2cb871 100644
+--- a/drivers/tc/tc.c
++++ b/drivers/tc/tc.c
+@@ -2,7 +2,7 @@
+ * TURBOchannel bus services.
+ *
+ * Copyright (c) Harald Koerfgen, 1998
+- * Copyright (c) 2001, 2003, 2005, 2006 Maciej W. Rozycki
++ * Copyright (c) 2001, 2003, 2005, 2006, 2018 Maciej W. Rozycki
+ * Copyright (c) 2005 James Simmons
+ *
+ * This file is subject to the terms and conditions of the GNU
+@@ -10,6 +10,7 @@
+ * directory of this archive for more details.
+ */
+ #include <linux/compiler.h>
++#include <linux/dma-mapping.h>
+ #include <linux/errno.h>
+ #include <linux/init.h>
+ #include <linux/ioport.h>
+@@ -92,6 +93,11 @@ static void __init tc_bus_add_devices(struct tc_bus *tbus)
+ tdev->dev.bus = &tc_bus_type;
+ tdev->slot = slot;
+
++ /* TURBOchannel has 34-bit DMA addressing (16GiB space). */
++ tdev->dma_mask = DMA_BIT_MASK(34);
++ tdev->dev.dma_mask = &tdev->dma_mask;
++ tdev->dev.coherent_dma_mask = DMA_BIT_MASK(34);
++
+ for (i = 0; i < 8; i++) {
+ tdev->firmware[i] =
+ readb(module + offset + TC_FIRM_VER + 4 * i);
+diff --git a/drivers/thermal/da9062-thermal.c b/drivers/thermal/da9062-thermal.c
+index dd8dd947b7f0..01b0cb994457 100644
+--- a/drivers/thermal/da9062-thermal.c
++++ b/drivers/thermal/da9062-thermal.c
+@@ -106,7 +106,7 @@ static void da9062_thermal_poll_on(struct work_struct *work)
+ THERMAL_EVENT_UNSPECIFIED);
+
+ delay = msecs_to_jiffies(thermal->zone->passive_delay);
+- schedule_delayed_work(&thermal->work, delay);
++ queue_delayed_work(system_freezable_wq, &thermal->work, delay);
+ return;
+ }
+
+@@ -125,7 +125,7 @@ static irqreturn_t da9062_thermal_irq_handler(int irq, void *data)
+ struct da9062_thermal *thermal = data;
+
+ disable_irq_nosync(thermal->irq);
+- schedule_delayed_work(&thermal->work, 0);
++ queue_delayed_work(system_freezable_wq, &thermal->work, 0);
+
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
+index 78f932822d38..8df2ce94c28d 100644
+--- a/drivers/thermal/rcar_thermal.c
++++ b/drivers/thermal/rcar_thermal.c
+@@ -453,6 +453,7 @@ static int rcar_thermal_remove(struct platform_device *pdev)
+
+ rcar_thermal_for_each_priv(priv, common) {
+ rcar_thermal_irq_disable(priv);
++ cancel_delayed_work_sync(&priv->work);
+ if (priv->chip->use_of_thermal)
+ thermal_remove_hwmon_sysfs(priv->zone);
+ else
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index b4ba2b1dab76..f4d0ef695225 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -130,6 +130,11 @@ static void kgdboc_unregister_kbd(void)
+
+ static int kgdboc_option_setup(char *opt)
+ {
++ if (!opt) {
++ pr_err("kgdboc: config string not provided\n");
++ return -EINVAL;
++ }
++
+ if (strlen(opt) >= MAX_CONFIG_LEN) {
+ printk(KERN_ERR "kgdboc: config string too long\n");
+ return -ENOSPC;
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 5f1183b0b89d..476ec4b1b86c 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1551,7 +1551,7 @@ static void csi_K(struct vc_data *vc, int vpar)
+ scr_memsetw(start + offset, vc->vc_video_erase_char, 2 * count);
+ vc->vc_need_wrap = 0;
+ if (con_should_update(vc))
+- do_update_region(vc, (unsigned long) start, count);
++ do_update_region(vc, (unsigned long)(start + offset), count);
+ }
+
+ static void csi_X(struct vc_data *vc, int vpar) /* erase the following vpar positions */
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index 70a7981b94b3..9916edda5271 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -274,6 +274,8 @@ static struct class uio_class = {
+ .dev_groups = uio_groups,
+ };
+
++bool uio_class_registered;
++
+ /*
+ * device functions
+ */
+@@ -876,6 +878,9 @@ static int init_uio_class(void)
+ printk(KERN_ERR "class_register failed for uio\n");
+ goto err_class_register;
+ }
++
++ uio_class_registered = true;
++
+ return 0;
+
+ err_class_register:
+@@ -886,6 +891,7 @@ exit:
+
+ static void release_uio_class(void)
+ {
++ uio_class_registered = false;
+ class_unregister(&uio_class);
+ uio_major_cleanup();
+ }
+@@ -912,6 +918,9 @@ int __uio_register_device(struct module *owner,
+ struct uio_device *idev;
+ int ret = 0;
+
++ if (!uio_class_registered)
++ return -EPROBE_DEFER;
++
+ if (!parent || !info || !info->name || !info->version)
+ return -EINVAL;
+
+diff --git a/drivers/usb/chipidea/otg.h b/drivers/usb/chipidea/otg.h
+index 7e7428e48bfa..4f8b8179ec96 100644
+--- a/drivers/usb/chipidea/otg.h
++++ b/drivers/usb/chipidea/otg.h
+@@ -17,7 +17,8 @@ void ci_handle_vbus_change(struct ci_hdrc *ci);
+ static inline void ci_otg_queue_work(struct ci_hdrc *ci)
+ {
+ disable_irq_nosync(ci->irq);
+- queue_work(ci->wq, &ci->work);
++ if (queue_work(ci->wq, &ci->work) == false)
++ enable_irq(ci->irq);
+ }
+
+ #endif /* __DRIVERS_USB_CHIPIDEA_OTG_H */
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 2bd6e6bfc241..260010abf9d8 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -4393,6 +4393,7 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
+ struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd);
+ struct usb_bus *bus = hcd_to_bus(hcd);
+ unsigned long flags;
++ int ret;
+
+ dev_dbg(hsotg->dev, "DWC OTG HCD START\n");
+
+@@ -4408,6 +4409,13 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
+
+ dwc2_hcd_reinit(hsotg);
+
++ /* enable external vbus supply before resuming root hub */
++ spin_unlock_irqrestore(&hsotg->lock, flags);
++ ret = dwc2_vbus_supply_init(hsotg);
++ if (ret)
++ return ret;
++ spin_lock_irqsave(&hsotg->lock, flags);
++
+ /* Initialize and connect root hub if one is not already attached */
+ if (bus->root_hub) {
+ dev_dbg(hsotg->dev, "DWC OTG HCD Has Root Hub\n");
+@@ -4417,7 +4425,7 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
+
+ spin_unlock_irqrestore(&hsotg->lock, flags);
+
+- return dwc2_vbus_supply_init(hsotg);
++ return 0;
+ }
+
+ /*
+@@ -4482,7 +4490,9 @@ static int _dwc2_hcd_suspend(struct usb_hcd *hcd)
+ hprt0 |= HPRT0_SUSP;
+ hprt0 &= ~HPRT0_PWR;
+ dwc2_writel(hsotg, hprt0, HPRT0);
++ spin_unlock_irqrestore(&hsotg->lock, flags);
+ dwc2_vbus_supply_exit(hsotg);
++ spin_lock_irqsave(&hsotg->lock, flags);
+ }
+
+ /* Enter partial_power_down */
+diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
+index 17147b8c771e..8f267be1745d 100644
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -2017,6 +2017,8 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev,
+
+ udc->errata = match->data;
+ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9g45-pmc");
++ if (IS_ERR(udc->pmc))
++ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9rl-pmc");
+ if (IS_ERR(udc->pmc))
+ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9x5-pmc");
+ if (udc->errata && IS_ERR(udc->pmc))
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index e1656f361e08..67d8a501d994 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2437,6 +2437,9 @@ static ssize_t renesas_usb3_b_device_write(struct file *file,
+ else
+ usb3->forced_b_device = false;
+
++ if (usb3->workaround_for_vbus)
++ usb3_disconnect(usb3);
++
+ /* Let this driver call usb3_connect() anyway */
+ usb3_check_id(usb3);
+
+diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
+index e98673954020..ec6739ef3129 100644
+--- a/drivers/usb/host/ohci-at91.c
++++ b/drivers/usb/host/ohci-at91.c
+@@ -551,6 +551,8 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
+ pdata->overcurrent_pin[i] =
+ devm_gpiod_get_index_optional(&pdev->dev, "atmel,oc",
+ i, GPIOD_IN);
++ if (!pdata->overcurrent_pin[i])
++ continue;
+ if (IS_ERR(pdata->overcurrent_pin[i])) {
+ err = PTR_ERR(pdata->overcurrent_pin[i]);
+ dev_err(&pdev->dev, "unable to claim gpio \"overcurrent\": %d\n", err);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 7e2a531ba321..12eea73d9f20 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -900,6 +900,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ set_bit(wIndex, &bus_state->resuming_ports);
+ bus_state->resume_done[wIndex] = timeout;
+ mod_timer(&hcd->rh_timer, timeout);
++ usb_hcd_start_port_resume(&hcd->self, wIndex);
+ }
+ /* Has resume been signalled for USB_RESUME_TIME yet? */
+ } else if (time_after_eq(jiffies,
+@@ -940,6 +941,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ clear_bit(wIndex, &bus_state->rexit_ports);
+ }
+
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ bus_state->port_c_suspend |= 1 << wIndex;
+ bus_state->suspended_ports &= ~(1 << wIndex);
+ } else {
+@@ -962,6 +964,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
+ bus_state->resume_done[wIndex] = 0;
+ clear_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ }
+
+
+@@ -1337,6 +1340,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ goto error;
+
+ set_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_start_port_resume(&hcd->self, wIndex);
+ xhci_set_link_state(xhci, ports[wIndex],
+ XDEV_RESUME);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+@@ -1345,6 +1349,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ xhci_set_link_state(xhci, ports[wIndex],
+ XDEV_U0);
+ clear_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ }
+ bus_state->port_c_suspend |= 1 << wIndex;
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index f0a99aa0ac58..cd4659703647 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1602,6 +1602,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ mod_timer(&hcd->rh_timer,
+ bus_state->resume_done[hcd_portnum]);
++ usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
+ bogus_port_status = true;
+ }
+ }
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index 4f1f4215f3d6..c74cc9c309b1 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -1430,8 +1430,8 @@ static enum pdo_err tcpm_caps_err(struct tcpm_port *port, const u32 *pdo,
+ if (pdo_apdo_type(pdo[i]) != APDO_TYPE_PPS)
+ break;
+
+- if (pdo_pps_apdo_max_current(pdo[i]) <
+- pdo_pps_apdo_max_current(pdo[i - 1]))
++ if (pdo_pps_apdo_max_voltage(pdo[i]) <
++ pdo_pps_apdo_max_voltage(pdo[i - 1]))
+ return PDO_ERR_PPS_APDO_NOT_SORTED;
+ else if (pdo_pps_apdo_min_voltage(pdo[i]) ==
+ pdo_pps_apdo_min_voltage(pdo[i - 1]) &&
+@@ -4116,6 +4116,9 @@ static int tcpm_pps_set_op_curr(struct tcpm_port *port, u16 op_curr)
+ goto port_unlock;
+ }
+
++ /* Round down operating current to align with PPS valid steps */
++ op_curr = op_curr - (op_curr % RDO_PROG_CURR_MA_STEP);
++
+ reinit_completion(&port->pps_complete);
+ port->pps_data.op_curr = op_curr;
+ port->pps_status = 0;
+@@ -4169,6 +4172,9 @@ static int tcpm_pps_set_out_volt(struct tcpm_port *port, u16 out_volt)
+ goto port_unlock;
+ }
+
++ /* Round down output voltage to align with PPS valid steps */
++ out_volt = out_volt - (out_volt % RDO_PROG_VOLT_MV_STEP);
++
+ reinit_completion(&port->pps_complete);
+ port->pps_data.out_volt = out_volt;
+ port->pps_status = 0;
+diff --git a/drivers/usb/usbip/vudc_main.c b/drivers/usb/usbip/vudc_main.c
+index 3fc22037a82f..390733e6937e 100644
+--- a/drivers/usb/usbip/vudc_main.c
++++ b/drivers/usb/usbip/vudc_main.c
+@@ -73,6 +73,10 @@ static int __init init(void)
+ cleanup:
+ list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) {
+ list_del(&udc_dev->dev_entry);
++ /*
++ * Just do platform_device_del() here, put_vudc_device()
++ * calls the platform_device_put()
++ */
+ platform_device_del(udc_dev->pdev);
+ put_vudc_device(udc_dev);
+ }
+@@ -89,7 +93,11 @@ static void __exit cleanup(void)
+
+ list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) {
+ list_del(&udc_dev->dev_entry);
+- platform_device_unregister(udc_dev->pdev);
++ /*
++ * Just do platform_device_del() here, put_vudc_device()
++ * calls the platform_device_put()
++ */
++ platform_device_del(udc_dev->pdev);
+ put_vudc_device(udc_dev);
+ }
+ platform_driver_unregister(&vudc_driver);
+diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c
+index 38716eb50408..8a3e8f61b991 100644
+--- a/drivers/video/hdmi.c
++++ b/drivers/video/hdmi.c
+@@ -592,10 +592,10 @@ hdmi_extended_colorimetry_get_name(enum hdmi_extended_colorimetry ext_col)
+ return "xvYCC 709";
+ case HDMI_EXTENDED_COLORIMETRY_S_YCC_601:
+ return "sYCC 601";
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601:
+- return "Adobe YCC 601";
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB:
+- return "Adobe RGB";
++ case HDMI_EXTENDED_COLORIMETRY_OPYCC_601:
++ return "opYCC 601";
++ case HDMI_EXTENDED_COLORIMETRY_OPRGB:
++ return "opRGB";
+ case HDMI_EXTENDED_COLORIMETRY_BT2020_CONST_LUM:
+ return "BT.2020 Constant Luminance";
+ case HDMI_EXTENDED_COLORIMETRY_BT2020:
+diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
+index 83fc9aab34e8..3099052e1243 100644
+--- a/drivers/w1/masters/omap_hdq.c
++++ b/drivers/w1/masters/omap_hdq.c
+@@ -763,6 +763,8 @@ static int omap_hdq_remove(struct platform_device *pdev)
+ /* remove module dependency */
+ pm_runtime_disable(&pdev->dev);
+
++ w1_remove_master_device(&omap_w1_master);
++
+ return 0;
+ }
+
+diff --git a/drivers/xen/privcmd-buf.c b/drivers/xen/privcmd-buf.c
+index df1ed37c3269..de01a6d0059d 100644
+--- a/drivers/xen/privcmd-buf.c
++++ b/drivers/xen/privcmd-buf.c
+@@ -21,15 +21,9 @@
+
+ MODULE_LICENSE("GPL");
+
+-static unsigned int limit = 64;
+-module_param(limit, uint, 0644);
+-MODULE_PARM_DESC(limit, "Maximum number of pages that may be allocated by "
+- "the privcmd-buf device per open file");
+-
+ struct privcmd_buf_private {
+ struct mutex lock;
+ struct list_head list;
+- unsigned int allocated;
+ };
+
+ struct privcmd_buf_vma_private {
+@@ -60,13 +54,10 @@ static void privcmd_buf_vmapriv_free(struct privcmd_buf_vma_private *vma_priv)
+ {
+ unsigned int i;
+
+- vma_priv->file_priv->allocated -= vma_priv->n_pages;
+-
+ list_del(&vma_priv->list);
+
+ for (i = 0; i < vma_priv->n_pages; i++)
+- if (vma_priv->pages[i])
+- __free_page(vma_priv->pages[i]);
++ __free_page(vma_priv->pages[i]);
+
+ kfree(vma_priv);
+ }
+@@ -146,8 +137,7 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
+ unsigned int i;
+ int ret = 0;
+
+- if (!(vma->vm_flags & VM_SHARED) || count > limit ||
+- file_priv->allocated + count > limit)
++ if (!(vma->vm_flags & VM_SHARED))
+ return -EINVAL;
+
+ vma_priv = kzalloc(sizeof(*vma_priv) + count * sizeof(void *),
+@@ -155,19 +145,15 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
+ if (!vma_priv)
+ return -ENOMEM;
+
+- vma_priv->n_pages = count;
+- count = 0;
+- for (i = 0; i < vma_priv->n_pages; i++) {
++ for (i = 0; i < count; i++) {
+ vma_priv->pages[i] = alloc_page(GFP_KERNEL | __GFP_ZERO);
+ if (!vma_priv->pages[i])
+ break;
+- count++;
++ vma_priv->n_pages++;
+ }
+
+ mutex_lock(&file_priv->lock);
+
+- file_priv->allocated += count;
+-
+ vma_priv->file_priv = file_priv;
+ vma_priv->users = 1;
+
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index a6f9ba85dc4b..aa081f806728 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -303,6 +303,9 @@ xen_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
+ */
+ flags &= ~(__GFP_DMA | __GFP_HIGHMEM);
+
++ /* Convert the size to actually allocated. */
++ size = 1UL << (order + XEN_PAGE_SHIFT);
++
+ /* On ARM this function returns an ioremap'ped virtual address for
+ * which virt_to_phys doesn't return the corresponding physical
+ * address. In fact on ARM virt_to_phys only works for kernel direct
+@@ -351,6 +354,9 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
+ * physical address */
+ phys = xen_bus_to_phys(dev_addr);
+
++ /* Convert the size to actually allocated. */
++ size = 1UL << (order + XEN_PAGE_SHIFT);
++
+ if (((dev_addr + size - 1 <= dma_mask)) ||
+ range_straddles_page_boundary(phys, size))
+ xen_destroy_contiguous_region(phys, order);
+diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
+index 63c1494a8d73..2acbfe104e46 100644
+--- a/drivers/xen/xen-balloon.c
++++ b/drivers/xen/xen-balloon.c
+@@ -76,12 +76,15 @@ static void watch_target(struct xenbus_watch *watch,
+
+ if (!watch_fired) {
+ watch_fired = true;
+- err = xenbus_scanf(XBT_NIL, "memory", "static-max", "%llu",
+- &static_max);
+- if (err != 1)
+- static_max = new_target;
+- else
++
++ if ((xenbus_scanf(XBT_NIL, "memory", "static-max",
++ "%llu", &static_max) == 1) ||
++ (xenbus_scanf(XBT_NIL, "memory", "memory_static_max",
++ "%llu", &static_max) == 1))
+ static_max >>= PAGE_SHIFT - 10;
++ else
++ static_max = new_target;
++
+ target_diff = (xen_pv_domain() || xen_initial_domain()) ? 0
+ : static_max - balloon_stats.target_pages;
+ }
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index d436fb4c002e..089b46c4d97f 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1050,9 +1050,26 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ if ((root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) && parent)
+ parent_start = parent->start;
+
++ /*
++ * If we are COWing a node/leaf from the extent, chunk or device trees,
++ * make sure that we do not finish block group creation of pending block
++ * groups. We do this to avoid a deadlock.
++ * COWing can result in allocation of a new chunk, and flushing pending
++ * block groups (btrfs_create_pending_block_groups()) can be triggered
++ * when finishing allocation of a new chunk. Creation of a pending block
++ * group modifies the extent, chunk and device trees, therefore we could
++ * deadlock with ourselves since we are holding a lock on an extent
++ * buffer that btrfs_create_pending_block_groups() may try to COW later.
++ */
++ if (root == fs_info->extent_root ||
++ root == fs_info->chunk_root ||
++ root == fs_info->dev_root)
++ trans->can_flush_pending_bgs = false;
++
+ cow = btrfs_alloc_tree_block(trans, root, parent_start,
+ root->root_key.objectid, &disk_key, level,
+ search_start, empty_size);
++ trans->can_flush_pending_bgs = true;
+ if (IS_ERR(cow))
+ return PTR_ERR(cow);
+
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index dec01970d8c5..981434764bb9 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -440,6 +440,7 @@ int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
+ break;
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED:
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED:
++ ASSERT(0);
+ ret = BTRFS_IOCTL_DEV_REPLACE_RESULT_ALREADY_STARTED;
+ goto leave;
+ }
+@@ -482,6 +483,10 @@ int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
+ if (IS_ERR(trans)) {
+ ret = PTR_ERR(trans);
+ btrfs_dev_replace_write_lock(dev_replace);
++ dev_replace->replace_state =
++ BTRFS_IOCTL_DEV_REPLACE_STATE_NEVER_STARTED;
++ dev_replace->srcdev = NULL;
++ dev_replace->tgtdev = NULL;
+ goto leave;
+ }
+
+@@ -503,8 +508,6 @@ int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
+ return ret;
+
+ leave:
+- dev_replace->srcdev = NULL;
+- dev_replace->tgtdev = NULL;
+ btrfs_dev_replace_write_unlock(dev_replace);
+ btrfs_destroy_dev_replace_tgtdev(tgt_device);
+ return ret;
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 2d9074295d7f..51e41e53d4ae 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2366,6 +2366,9 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans,
+ insert_reserved);
+ else
+ BUG();
++ if (ret && insert_reserved)
++ btrfs_pin_extent(trans->fs_info, node->bytenr,
++ node->num_bytes, 1);
+ return ret;
+ }
+
+@@ -2911,7 +2914,6 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_ref_head *head;
+ int ret;
+ int run_all = count == (unsigned long)-1;
+- bool can_flush_pending_bgs = trans->can_flush_pending_bgs;
+
+ /* We'll clean this up in btrfs_cleanup_transaction */
+ if (trans->aborted)
+@@ -2928,7 +2930,6 @@ again:
+ #ifdef SCRAMBLE_DELAYED_REFS
+ delayed_refs->run_delayed_start = find_middle(&delayed_refs->root);
+ #endif
+- trans->can_flush_pending_bgs = false;
+ ret = __btrfs_run_delayed_refs(trans, count);
+ if (ret < 0) {
+ btrfs_abort_transaction(trans, ret);
+@@ -2959,7 +2960,6 @@ again:
+ goto again;
+ }
+ out:
+- trans->can_flush_pending_bgs = can_flush_pending_bgs;
+ return 0;
+ }
+
+@@ -4533,6 +4533,7 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans, u64 flags,
+ goto out;
+ } else {
+ ret = 1;
++ space_info->max_extent_size = 0;
+ }
+
+ space_info->force_alloc = CHUNK_ALLOC_NO_FORCE;
+@@ -4554,11 +4555,9 @@ out:
+ * the block groups that were made dirty during the lifetime of the
+ * transaction.
+ */
+- if (trans->can_flush_pending_bgs &&
+- trans->chunk_bytes_reserved >= (u64)SZ_2M) {
++ if (trans->chunk_bytes_reserved >= (u64)SZ_2M)
+ btrfs_create_pending_block_groups(trans);
+- btrfs_trans_release_chunk_metadata(trans);
+- }
++
+ return ret;
+ }
+
+@@ -6436,6 +6435,7 @@ static int btrfs_free_reserved_bytes(struct btrfs_block_group_cache *cache,
+ space_info->bytes_readonly += num_bytes;
+ cache->reserved -= num_bytes;
+ space_info->bytes_reserved -= num_bytes;
++ space_info->max_extent_size = 0;
+
+ if (delalloc)
+ cache->delalloc_bytes -= num_bytes;
+@@ -7233,6 +7233,7 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info,
+ struct btrfs_block_group_cache *block_group = NULL;
+ u64 search_start = 0;
+ u64 max_extent_size = 0;
++ u64 max_free_space = 0;
+ u64 empty_cluster = 0;
+ struct btrfs_space_info *space_info;
+ int loop = 0;
+@@ -7528,8 +7529,8 @@ unclustered_alloc:
+ spin_lock(&ctl->tree_lock);
+ if (ctl->free_space <
+ num_bytes + empty_cluster + empty_size) {
+- if (ctl->free_space > max_extent_size)
+- max_extent_size = ctl->free_space;
++ max_free_space = max(max_free_space,
++ ctl->free_space);
+ spin_unlock(&ctl->tree_lock);
+ goto loop;
+ }
+@@ -7696,6 +7697,8 @@ loop:
+ }
+ out:
+ if (ret == -ENOSPC) {
++ if (!max_extent_size)
++ max_extent_size = max_free_space;
+ spin_lock(&space_info->lock);
+ space_info->max_extent_size = max_extent_size;
+ spin_unlock(&space_info->lock);
+@@ -7977,21 +7980,14 @@ static int alloc_reserved_tree_block(struct btrfs_trans_handle *trans,
+ }
+
+ path = btrfs_alloc_path();
+- if (!path) {
+- btrfs_free_and_pin_reserved_extent(fs_info,
+- extent_key.objectid,
+- fs_info->nodesize);
++ if (!path)
+ return -ENOMEM;
+- }
+
+ path->leave_spinning = 1;
+ ret = btrfs_insert_empty_item(trans, fs_info->extent_root, path,
+ &extent_key, size);
+ if (ret) {
+ btrfs_free_path(path);
+- btrfs_free_and_pin_reserved_extent(fs_info,
+- extent_key.objectid,
+- fs_info->nodesize);
+ return ret;
+ }
+
+@@ -8119,6 +8115,19 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ if (IS_ERR(buf))
+ return buf;
+
++ /*
++ * Extra safety check in case the extent tree is corrupted and extent
++ * allocator chooses to use a tree block which is already used and
++ * locked.
++ */
++ if (buf->lock_owner == current->pid) {
++ btrfs_err_rl(fs_info,
++"tree block %llu owner %llu already locked by pid=%d, extent tree corruption detected",
++ buf->start, btrfs_header_owner(buf), current->pid);
++ free_extent_buffer(buf);
++ return ERR_PTR(-EUCLEAN);
++ }
++
+ btrfs_set_buffer_lockdep_class(root->root_key.objectid, buf, level);
+ btrfs_tree_lock(buf);
+ clean_tree_block(fs_info, buf);
+@@ -8763,15 +8772,14 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans,
+ if (eb == root->node) {
+ if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF)
+ parent = eb->start;
+- else
+- BUG_ON(root->root_key.objectid !=
+- btrfs_header_owner(eb));
++ else if (root->root_key.objectid != btrfs_header_owner(eb))
++ goto owner_mismatch;
+ } else {
+ if (wc->flags[level + 1] & BTRFS_BLOCK_FLAG_FULL_BACKREF)
+ parent = path->nodes[level + 1]->start;
+- else
+- BUG_ON(root->root_key.objectid !=
+- btrfs_header_owner(path->nodes[level + 1]));
++ else if (root->root_key.objectid !=
++ btrfs_header_owner(path->nodes[level + 1]))
++ goto owner_mismatch;
+ }
+
+ btrfs_free_tree_block(trans, root, eb, parent, wc->refs[level] == 1);
+@@ -8779,6 +8787,11 @@ out:
+ wc->refs[level] = 0;
+ wc->flags[level] = 0;
+ return 0;
++
++owner_mismatch:
++ btrfs_err_rl(fs_info, "unexpected tree owner, have %llu expect %llu",
++ btrfs_header_owner(eb), root->root_key.objectid);
++ return -EUCLEAN;
+ }
+
+ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
+@@ -8832,6 +8845,8 @@ static noinline int walk_up_tree(struct btrfs_trans_handle *trans,
+ ret = walk_up_proc(trans, root, path, wc);
+ if (ret > 0)
+ return 0;
++ if (ret < 0)
++ return ret;
+
+ if (path->locks[level]) {
+ btrfs_tree_unlock_rw(path->nodes[level],
+@@ -9613,6 +9628,7 @@ void btrfs_put_block_group_cache(struct btrfs_fs_info *info)
+
+ block_group = btrfs_lookup_first_block_group(info, last);
+ while (block_group) {
++ wait_block_group_cache_done(block_group);
+ spin_lock(&block_group->lock);
+ if (block_group->iref)
+ break;
+@@ -10074,15 +10090,19 @@ error:
+ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans)
+ {
+ struct btrfs_fs_info *fs_info = trans->fs_info;
+- struct btrfs_block_group_cache *block_group, *tmp;
++ struct btrfs_block_group_cache *block_group;
+ struct btrfs_root *extent_root = fs_info->extent_root;
+ struct btrfs_block_group_item item;
+ struct btrfs_key key;
+ int ret = 0;
+- bool can_flush_pending_bgs = trans->can_flush_pending_bgs;
+
+- trans->can_flush_pending_bgs = false;
+- list_for_each_entry_safe(block_group, tmp, &trans->new_bgs, bg_list) {
++ if (!trans->can_flush_pending_bgs)
++ return;
++
++ while (!list_empty(&trans->new_bgs)) {
++ block_group = list_first_entry(&trans->new_bgs,
++ struct btrfs_block_group_cache,
++ bg_list);
+ if (ret)
+ goto next;
+
+@@ -10103,7 +10123,7 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans)
+ next:
+ list_del_init(&block_group->bg_list);
+ }
+- trans->can_flush_pending_bgs = can_flush_pending_bgs;
++ btrfs_trans_release_chunk_metadata(trans);
+ }
+
+ int btrfs_make_block_group(struct btrfs_trans_handle *trans, u64 bytes_used,
+@@ -10753,14 +10773,16 @@ int btrfs_error_unpin_extent_range(struct btrfs_fs_info *fs_info,
+ * We don't want a transaction for this since the discard may take a
+ * substantial amount of time. We don't require that a transaction be
+ * running, but we do need to take a running transaction into account
+- * to ensure that we're not discarding chunks that were released in
+- * the current transaction.
++ * to ensure that we're not discarding chunks that were released or
++ * allocated in the current transaction.
+ *
+ * Holding the chunks lock will prevent other threads from allocating
+ * or releasing chunks, but it won't prevent a running transaction
+ * from committing and releasing the memory that the pending chunks
+ * list head uses. For that, we need to take a reference to the
+- * transaction.
++ * transaction and hold the commit root sem. We only need to hold
++ * it while performing the free space search since we have already
++ * held back allocations.
+ */
+ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ u64 minlen, u64 *trimmed)
+@@ -10770,6 +10792,10 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+
+ *trimmed = 0;
+
++ /* Discard not supported = nothing to do. */
++ if (!blk_queue_discard(bdev_get_queue(device->bdev)))
++ return 0;
++
+ /* Not writeable = nothing to do. */
+ if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state))
+ return 0;
+@@ -10787,9 +10813,13 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+
+ ret = mutex_lock_interruptible(&fs_info->chunk_mutex);
+ if (ret)
+- return ret;
++ break;
+
+- down_read(&fs_info->commit_root_sem);
++ ret = down_read_killable(&fs_info->commit_root_sem);
++ if (ret) {
++ mutex_unlock(&fs_info->chunk_mutex);
++ break;
++ }
+
+ spin_lock(&fs_info->trans_lock);
+ trans = fs_info->running_transaction;
+@@ -10797,13 +10827,17 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ refcount_inc(&trans->use_count);
+ spin_unlock(&fs_info->trans_lock);
+
++ if (!trans)
++ up_read(&fs_info->commit_root_sem);
++
+ ret = find_free_dev_extent_start(trans, device, minlen, start,
+ &start, &len);
+- if (trans)
++ if (trans) {
++ up_read(&fs_info->commit_root_sem);
+ btrfs_put_transaction(trans);
++ }
+
+ if (ret) {
+- up_read(&fs_info->commit_root_sem);
+ mutex_unlock(&fs_info->chunk_mutex);
+ if (ret == -ENOSPC)
+ ret = 0;
+@@ -10811,7 +10845,6 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ }
+
+ ret = btrfs_issue_discard(device->bdev, start, len, &bytes);
+- up_read(&fs_info->commit_root_sem);
+ mutex_unlock(&fs_info->chunk_mutex);
+
+ if (ret)
+@@ -10831,6 +10864,15 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ return ret;
+ }
+
++/*
++ * Trim the whole filesystem by:
++ * 1) trimming the free space in each block group
++ * 2) trimming the unallocated space on each device
++ *
++ * This will also continue trimming even if a block group or device encounters
++ * an error. The return value will be the last error, or 0 if nothing bad
++ * happens.
++ */
+ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ {
+ struct btrfs_block_group_cache *cache = NULL;
+@@ -10840,18 +10882,14 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ u64 start;
+ u64 end;
+ u64 trimmed = 0;
+- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
++ u64 bg_failed = 0;
++ u64 dev_failed = 0;
++ int bg_ret = 0;
++ int dev_ret = 0;
+ int ret = 0;
+
+- /*
+- * try to trim all FS space, our block group may start from non-zero.
+- */
+- if (range->len == total_bytes)
+- cache = btrfs_lookup_first_block_group(fs_info, range->start);
+- else
+- cache = btrfs_lookup_block_group(fs_info, range->start);
+-
+- while (cache) {
++ cache = btrfs_lookup_first_block_group(fs_info, range->start);
++ for (; cache; cache = next_block_group(fs_info, cache)) {
+ if (cache->key.objectid >= (range->start + range->len)) {
+ btrfs_put_block_group(cache);
+ break;
+@@ -10865,13 +10903,15 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ if (!block_group_cache_done(cache)) {
+ ret = cache_block_group(cache, 0);
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ ret = wait_block_group_cache_done(cache);
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ }
+ ret = btrfs_trim_block_group(cache,
+@@ -10882,28 +10922,40 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+
+ trimmed += group_trimmed;
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ }
+-
+- cache = next_block_group(fs_info, cache);
+ }
+
++ if (bg_failed)
++ btrfs_warn(fs_info,
++ "failed to trim %llu block group(s), last error %d",
++ bg_failed, bg_ret);
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+- devices = &fs_info->fs_devices->alloc_list;
+- list_for_each_entry(device, devices, dev_alloc_list) {
++ devices = &fs_info->fs_devices->devices;
++ list_for_each_entry(device, devices, dev_list) {
+ ret = btrfs_trim_free_extents(device, range->minlen,
+ &group_trimmed);
+- if (ret)
++ if (ret) {
++ dev_failed++;
++ dev_ret = ret;
+ break;
++ }
+
+ trimmed += group_trimmed;
+ }
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+
++ if (dev_failed)
++ btrfs_warn(fs_info,
++ "failed to trim %llu device(s), last error %d",
++ dev_failed, dev_ret);
+ range->len = trimmed;
+- return ret;
++ if (bg_ret)
++ return bg_ret;
++ return dev_ret;
+ }
+
+ /*
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 2be00e873e92..7d81cc415264 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -531,6 +531,14 @@ int btrfs_dirty_pages(struct inode *inode, struct page **pages,
+
+ end_of_last_block = start_pos + num_bytes - 1;
+
++ /*
++ * The pages may have already been dirty, clear out old accounting so
++ * we can set things up properly
++ */
++ clear_extent_bit(&BTRFS_I(inode)->io_tree, start_pos, end_of_last_block,
++ EXTENT_DIRTY | EXTENT_DELALLOC |
++ EXTENT_DO_ACCOUNTING | EXTENT_DEFRAG, 0, 0, cached);
++
+ if (!btrfs_is_free_space_inode(BTRFS_I(inode))) {
+ if (start_pos >= isize &&
+ !(BTRFS_I(inode)->flags & BTRFS_INODE_PREALLOC)) {
+@@ -1500,18 +1508,27 @@ lock_and_cleanup_extent_if_need(struct btrfs_inode *inode, struct page **pages,
+ }
+ if (ordered)
+ btrfs_put_ordered_extent(ordered);
+- clear_extent_bit(&inode->io_tree, start_pos, last_pos,
+- EXTENT_DIRTY | EXTENT_DELALLOC |
+- EXTENT_DO_ACCOUNTING | EXTENT_DEFRAG,
+- 0, 0, cached_state);
++
+ *lockstart = start_pos;
+ *lockend = last_pos;
+ ret = 1;
+ }
+
++ /*
++ * It's possible the pages are dirty right now, but we don't want
++ * to clean them yet because copy_from_user may catch a page fault
++ * and we might have to fall back to one page at a time. If that
++ * happens, we'll unlock these pages and we'd have a window where
++ * reclaim could sneak in and drop the once-dirty page on the floor
++ * without writing it.
++ *
++ * We have the pages locked and the extent range locked, so there's
++ * no way someone can start IO on any dirty pages in this range.
++ *
++ * We'll call btrfs_dirty_pages() later on, and that will flip around
++ * delalloc bits and dirty the pages as required.
++ */
+ for (i = 0; i < num_pages; i++) {
+- if (clear_page_dirty_for_io(pages[i]))
+- account_page_redirty(pages[i]);
+ set_page_extent_mapped(pages[i]);
+ WARN_ON(!PageLocked(pages[i]));
+ }
+@@ -2061,6 +2078,14 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ goto out;
+
+ inode_lock(inode);
++
++ /*
++ * We take the dio_sem here because the tree log stuff can race with
++ * lockless dio writes and get an extent map logged for an extent we
++ * never waited on. We need it this high up for lockdep reasons.
++ */
++ down_write(&BTRFS_I(inode)->dio_sem);
++
+ atomic_inc(&root->log_batch);
+
+ /*
+@@ -2069,6 +2094,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ */
+ ret = btrfs_wait_ordered_range(inode, start, len);
+ if (ret) {
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+ goto out;
+ }
+@@ -2092,6 +2118,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ * checked called fsync.
+ */
+ ret = filemap_check_wb_err(inode->i_mapping, file->f_wb_err);
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+ goto out;
+ }
+@@ -2110,6 +2137,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ trans = btrfs_start_transaction(root, 0);
+ if (IS_ERR(trans)) {
+ ret = PTR_ERR(trans);
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+ goto out;
+ }
+@@ -2131,6 +2159,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ * file again, but that will end up using the synchronization
+ * inside btrfs_sync_log to keep things safe.
+ */
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+
+ /*
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index 0adf38b00fa0..8ecf8c0e5fe6 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -10,6 +10,7 @@
+ #include <linux/math64.h>
+ #include <linux/ratelimit.h>
+ #include <linux/error-injection.h>
++#include <linux/sched/mm.h>
+ #include "ctree.h"
+ #include "free-space-cache.h"
+ #include "transaction.h"
+@@ -47,6 +48,7 @@ static struct inode *__lookup_free_space_inode(struct btrfs_root *root,
+ struct btrfs_free_space_header *header;
+ struct extent_buffer *leaf;
+ struct inode *inode = NULL;
++ unsigned nofs_flag;
+ int ret;
+
+ key.objectid = BTRFS_FREE_SPACE_OBJECTID;
+@@ -68,7 +70,13 @@ static struct inode *__lookup_free_space_inode(struct btrfs_root *root,
+ btrfs_disk_key_to_cpu(&location, &disk_key);
+ btrfs_release_path(path);
+
++ /*
++ * We are often under a trans handle at this point, so we need to make
++ * sure NOFS is set to keep us from deadlocking.
++ */
++ nofs_flag = memalloc_nofs_save();
+ inode = btrfs_iget(fs_info->sb, &location, root, NULL);
++ memalloc_nofs_restore(nofs_flag);
+ if (IS_ERR(inode))
+ return inode;
+
+@@ -1679,6 +1687,8 @@ static inline void __bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
+ bitmap_clear(info->bitmap, start, count);
+
+ info->bytes -= bytes;
++ if (info->max_extent_size > ctl->unit)
++ info->max_extent_size = 0;
+ }
+
+ static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
+@@ -1762,6 +1772,13 @@ static int search_bitmap(struct btrfs_free_space_ctl *ctl,
+ return -1;
+ }
+
++static inline u64 get_max_extent_size(struct btrfs_free_space *entry)
++{
++ if (entry->bitmap)
++ return entry->max_extent_size;
++ return entry->bytes;
++}
++
+ /* Cache the size of the max extent in bytes */
+ static struct btrfs_free_space *
+ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+@@ -1783,8 +1800,8 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+ for (node = &entry->offset_index; node; node = rb_next(node)) {
+ entry = rb_entry(node, struct btrfs_free_space, offset_index);
+ if (entry->bytes < *bytes) {
+- if (entry->bytes > *max_extent_size)
+- *max_extent_size = entry->bytes;
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+ continue;
+ }
+
+@@ -1802,8 +1819,8 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+ }
+
+ if (entry->bytes < *bytes + align_off) {
+- if (entry->bytes > *max_extent_size)
+- *max_extent_size = entry->bytes;
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+ continue;
+ }
+
+@@ -1815,8 +1832,10 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+ *offset = tmp;
+ *bytes = size;
+ return entry;
+- } else if (size > *max_extent_size) {
+- *max_extent_size = size;
++ } else {
++ *max_extent_size =
++ max(get_max_extent_size(entry),
++ *max_extent_size);
+ }
+ continue;
+ }
+@@ -2440,6 +2459,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
+ struct rb_node *n;
+ int count = 0;
+
++ spin_lock(&ctl->tree_lock);
+ for (n = rb_first(&ctl->free_space_offset); n; n = rb_next(n)) {
+ info = rb_entry(n, struct btrfs_free_space, offset_index);
+ if (info->bytes >= bytes && !block_group->ro)
+@@ -2448,6 +2468,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
+ info->offset, info->bytes,
+ (info->bitmap) ? "yes" : "no");
+ }
++ spin_unlock(&ctl->tree_lock);
+ btrfs_info(fs_info, "block group has cluster?: %s",
+ list_empty(&block_group->cluster_list) ? "no" : "yes");
+ btrfs_info(fs_info,
+@@ -2676,8 +2697,8 @@ static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
+
+ err = search_bitmap(ctl, entry, &search_start, &search_bytes, true);
+ if (err) {
+- if (search_bytes > *max_extent_size)
+- *max_extent_size = search_bytes;
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+ return 0;
+ }
+
+@@ -2714,8 +2735,9 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
+
+ entry = rb_entry(node, struct btrfs_free_space, offset_index);
+ while (1) {
+- if (entry->bytes < bytes && entry->bytes > *max_extent_size)
+- *max_extent_size = entry->bytes;
++ if (entry->bytes < bytes)
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+
+ if (entry->bytes < bytes ||
+ (!entry->bitmap && entry->offset < min_start)) {
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 3ea5339603cf..83268d8f48c4 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -503,6 +503,7 @@ again:
+ pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS);
+ if (!pages) {
+ /* just bail out to the uncompressed code */
++ nr_pages = 0;
+ goto cont;
+ }
+
+@@ -2944,6 +2945,7 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
+ bool truncated = false;
+ bool range_locked = false;
+ bool clear_new_delalloc_bytes = false;
++ bool clear_reserved_extent = true;
+
+ if (!test_bit(BTRFS_ORDERED_NOCOW, &ordered_extent->flags) &&
+ !test_bit(BTRFS_ORDERED_PREALLOC, &ordered_extent->flags) &&
+@@ -3047,10 +3049,12 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
+ logical_len, logical_len,
+ compress_type, 0, 0,
+ BTRFS_FILE_EXTENT_REG);
+- if (!ret)
++ if (!ret) {
++ clear_reserved_extent = false;
+ btrfs_release_delalloc_bytes(fs_info,
+ ordered_extent->start,
+ ordered_extent->disk_len);
++ }
+ }
+ unpin_extent_cache(&BTRFS_I(inode)->extent_tree,
+ ordered_extent->file_offset, ordered_extent->len,
+@@ -3111,8 +3115,13 @@ out:
+ * wrong we need to return the space for this ordered extent
+ * back to the allocator. We only free the extent in the
+ * truncated case if we didn't write out the extent at all.
++ *
++ * If we made it past insert_reserved_file_extent before we
++ * errored out then we don't need to do this as the accounting
++ * has already been done.
+ */
+ if ((ret || !logical_len) &&
++ clear_reserved_extent &&
+ !test_bit(BTRFS_ORDERED_NOCOW, &ordered_extent->flags) &&
+ !test_bit(BTRFS_ORDERED_PREALLOC, &ordered_extent->flags))
+ btrfs_free_reserved_extent(fs_info,
+@@ -5274,11 +5283,13 @@ static void evict_inode_truncate_pages(struct inode *inode)
+ struct extent_state *cached_state = NULL;
+ u64 start;
+ u64 end;
++ unsigned state_flags;
+
+ node = rb_first(&io_tree->state);
+ state = rb_entry(node, struct extent_state, rb_node);
+ start = state->start;
+ end = state->end;
++ state_flags = state->state;
+ spin_unlock(&io_tree->lock);
+
+ lock_extent_bits(io_tree, start, end, &cached_state);
+@@ -5291,7 +5302,7 @@ static void evict_inode_truncate_pages(struct inode *inode)
+ *
+ * Note, end is the bytenr of last byte, so we need + 1 here.
+ */
+- if (state->state & EXTENT_DELALLOC)
++ if (state_flags & EXTENT_DELALLOC)
+ btrfs_qgroup_free_data(inode, NULL, start, end - start + 1);
+
+ clear_extent_bit(io_tree, start, end,
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index d60b6caf09e8..bd4767f562cd 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -491,7 +491,6 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
+ struct fstrim_range range;
+ u64 minlen = ULLONG_MAX;
+ u64 num_devices = 0;
+- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
+ int ret;
+
+ if (!capable(CAP_SYS_ADMIN))
+@@ -515,11 +514,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
+ return -EOPNOTSUPP;
+ if (copy_from_user(&range, arg, sizeof(range)))
+ return -EFAULT;
+- if (range.start > total_bytes ||
+- range.len < fs_info->sb->s_blocksize)
++
++ /*
++ * NOTE: Don't truncate the range using super->total_bytes. Bytenr of
++ * block group is in the logical address space, which can be any
++ * sectorsize aligned bytenr in the range [0, U64_MAX].
++ */
++ if (range.len < fs_info->sb->s_blocksize)
+ return -EINVAL;
+
+- range.len = min(range.len, total_bytes - range.start);
+ range.minlen = max(range.minlen, minlen);
+ ret = btrfs_trim_fs(fs_info, &range);
+ if (ret < 0)
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index d4917c0cddf5..b070401406be 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2897,6 +2897,7 @@ qgroup_rescan_zero_tracking(struct btrfs_fs_info *fs_info)
+ qgroup->rfer_cmpr = 0;
+ qgroup->excl = 0;
+ qgroup->excl_cmpr = 0;
++ qgroup_dirty(fs_info, qgroup);
+ }
+ spin_unlock(&fs_info->qgroup_lock);
+ }
+@@ -3106,6 +3107,10 @@ static int __btrfs_qgroup_release_data(struct inode *inode,
+ int trace_op = QGROUP_RELEASE;
+ int ret;
+
++ if (!test_bit(BTRFS_FS_QUOTA_ENABLED,
++ &BTRFS_I(inode)->root->fs_info->flags))
++ return 0;
++
+ /* In release case, we shouldn't have @reserved */
+ WARN_ON(!free && reserved);
+ if (free && reserved)
+diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h
+index 54b8bb282c0e..4bbcc1e92a93 100644
+--- a/fs/btrfs/qgroup.h
++++ b/fs/btrfs/qgroup.h
+@@ -249,6 +249,8 @@ void btrfs_qgroup_free_refroot(struct btrfs_fs_info *fs_info,
+ static inline void btrfs_qgroup_free_delayed_ref(struct btrfs_fs_info *fs_info,
+ u64 ref_root, u64 num_bytes)
+ {
++ if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
++ return;
+ trace_btrfs_qgroup_free_delayed_ref(fs_info, ref_root, num_bytes);
+ btrfs_qgroup_free_refroot(fs_info, ref_root, num_bytes,
+ BTRFS_QGROUP_RSV_DATA);
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 8783a1776540..60bf8dfe7df4 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1281,7 +1281,7 @@ static void __del_reloc_root(struct btrfs_root *root)
+ struct mapping_node *node = NULL;
+ struct reloc_control *rc = fs_info->reloc_ctl;
+
+- if (rc) {
++ if (rc && root->node) {
+ spin_lock(&rc->reloc_root_tree.lock);
+ rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+ root->node->start);
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 3b84f5015029..bb8f6c020d22 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1929,6 +1929,9 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+ return ret;
+ }
+
++ btrfs_trans_release_metadata(trans);
++ trans->block_rsv = NULL;
++
+ /* make a pass through all the delayed refs we have so far
+ * any runnings procs may add more while we are here
+ */
+@@ -1938,9 +1941,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+ return ret;
+ }
+
+- btrfs_trans_release_metadata(trans);
+- trans->block_rsv = NULL;
+-
+ cur_trans = trans->transaction;
+
+ /*
+@@ -2280,15 +2280,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+
+ kmem_cache_free(btrfs_trans_handle_cachep, trans);
+
+- /*
+- * If fs has been frozen, we can not handle delayed iputs, otherwise
+- * it'll result in deadlock about SB_FREEZE_FS.
+- */
+- if (current != fs_info->transaction_kthread &&
+- current != fs_info->cleaner_kthread &&
+- !test_bit(BTRFS_FS_FROZEN, &fs_info->flags))
+- btrfs_run_delayed_iputs(fs_info);
+-
+ return ret;
+
+ scrub_continue:
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 3c2ae0e4f25a..d0bcfbfc0e3a 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -258,6 +258,13 @@ struct walk_control {
+ /* what stage of the replay code we're currently in */
+ int stage;
+
++ /*
++ * Ignore any items from the inode currently being processed. Needs
++ * to be set every time we find a BTRFS_INODE_ITEM_KEY and we are in
++ * the LOG_WALK_REPLAY_INODES stage.
++ */
++ bool ignore_cur_inode;
++
+ /* the root we are currently replaying */
+ struct btrfs_root *replay_dest;
+
+@@ -2487,6 +2494,20 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
+
+ inode_item = btrfs_item_ptr(eb, i,
+ struct btrfs_inode_item);
++ /*
++ * If we have a tmpfile (O_TMPFILE) that got fsync'ed
++ * and never got linked before the fsync, skip it, as
++ * replaying it is pointless since it would be deleted
++ * later. We skip logging tmpfiles, but it's always
++ * possible we are replaying a log created with a kernel
++ * that used to log tmpfiles.
++ */
++ if (btrfs_inode_nlink(eb, inode_item) == 0) {
++ wc->ignore_cur_inode = true;
++ continue;
++ } else {
++ wc->ignore_cur_inode = false;
++ }
+ ret = replay_xattr_deletes(wc->trans, root, log,
+ path, key.objectid);
+ if (ret)
+@@ -2524,16 +2545,8 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
+ root->fs_info->sectorsize);
+ ret = btrfs_drop_extents(wc->trans, root, inode,
+ from, (u64)-1, 1);
+- /*
+- * If the nlink count is zero here, the iput
+- * will free the inode. We bump it to make
+- * sure it doesn't get freed until the link
+- * count fixup is done.
+- */
+ if (!ret) {
+- if (inode->i_nlink == 0)
+- inc_nlink(inode);
+- /* Update link count and nbytes. */
++ /* Update the inode's nbytes. */
+ ret = btrfs_update_inode(wc->trans,
+ root, inode);
+ }
+@@ -2548,6 +2561,9 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
+ break;
+ }
+
++ if (wc->ignore_cur_inode)
++ continue;
++
+ if (key.type == BTRFS_DIR_INDEX_KEY &&
+ wc->stage == LOG_WALK_REPLAY_DIR_INDEX) {
+ ret = replay_one_dir_item(wc->trans, root, path,
+@@ -3196,9 +3212,12 @@ static void free_log_tree(struct btrfs_trans_handle *trans,
+ };
+
+ ret = walk_log_tree(trans, log, &wc);
+- /* I don't think this can happen but just in case */
+- if (ret)
+- btrfs_abort_transaction(trans, ret);
++ if (ret) {
++ if (trans)
++ btrfs_abort_transaction(trans, ret);
++ else
++ btrfs_handle_fs_error(log->fs_info, ret, NULL);
++ }
+
+ while (1) {
+ ret = find_first_extent_bit(&log->dirty_log_pages,
+@@ -4374,7 +4393,6 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
+
+ INIT_LIST_HEAD(&extents);
+
+- down_write(&inode->dio_sem);
+ write_lock(&tree->lock);
+ test_gen = root->fs_info->last_trans_committed;
+ logged_start = start;
+@@ -4440,7 +4458,6 @@ process:
+ }
+ WARN_ON(!list_empty(&extents));
+ write_unlock(&tree->lock);
+- up_write(&inode->dio_sem);
+
+ btrfs_release_path(path);
+ if (!ret)
+@@ -4636,7 +4653,8 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
+ ASSERT(len == i_size ||
+ (len == fs_info->sectorsize &&
+ btrfs_file_extent_compression(leaf, extent) !=
+- BTRFS_COMPRESS_NONE));
++ BTRFS_COMPRESS_NONE) ||
++ (len < i_size && i_size < fs_info->sectorsize));
+ return 0;
+ }
+
+@@ -5564,9 +5582,33 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans,
+
+ dir_inode = btrfs_iget(fs_info->sb, &inode_key,
+ root, NULL);
+- /* If parent inode was deleted, skip it. */
+- if (IS_ERR(dir_inode))
+- continue;
++ /*
++ * If the parent inode was deleted, return an error to
++ * fallback to a transaction commit. This is to prevent
++ * getting an inode that was moved from one parent A to
++ * a parent B, got its former parent A deleted and then
++ * it got fsync'ed, from existing at both parents after
++ * a log replay (and the old parent still existing).
++ * Example:
++ *
++ * mkdir /mnt/A
++ * mkdir /mnt/B
++ * touch /mnt/B/bar
++ * sync
++ * mv /mnt/B/bar /mnt/A/bar
++ * mv -T /mnt/A /mnt/B
++ * fsync /mnt/B/bar
++ * <power fail>
++ *
++ * If we ignore the old parent B which got deleted,
++ * after a log replay we would have file bar linked
++ * at both parents and the old parent B would still
++ * exist.
++ */
++ if (IS_ERR(dir_inode)) {
++ ret = PTR_ERR(dir_inode);
++ goto out;
++ }
+
+ if (ctx)
+ ctx->log_new_dentries = false;
+@@ -5640,7 +5682,13 @@ static int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
+ if (ret)
+ goto end_no_trans;
+
+- if (btrfs_inode_in_log(inode, trans->transid)) {
++ /*
++ * Skip already logged inodes or inodes corresponding to tmpfiles
++ * (since logging them is pointless, a link count of 0 means they
++ * will never be accessible).
++ */
++ if (btrfs_inode_in_log(inode, trans->transid) ||
++ inode->vfs_inode.i_nlink == 0) {
+ ret = BTRFS_NO_LOG_SYNC;
+ goto end_no_trans;
+ }
+diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
+index f1fbea947fef..06576797cf31 100644
+--- a/fs/cifs/cifs_debug.c
++++ b/fs/cifs/cifs_debug.c
+@@ -383,6 +383,9 @@ static ssize_t cifs_stats_proc_write(struct file *file,
+ atomic_set(&totBufAllocCount, 0);
+ atomic_set(&totSmBufAllocCount, 0);
+ #endif /* CONFIG_CIFS_STATS2 */
++ atomic_set(&tcpSesReconnectCount, 0);
++ atomic_set(&tconInfoReconnectCount, 0);
++
+ spin_lock(&GlobalMid_Lock);
+ GlobalMaxActiveXid = 0;
+ GlobalCurrentXid = 0;
+diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
+index b611fc2e8984..7f01c6e60791 100644
+--- a/fs/cifs/cifs_spnego.c
++++ b/fs/cifs/cifs_spnego.c
+@@ -147,8 +147,10 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo)
+ sprintf(dp, ";sec=krb5");
+ else if (server->sec_mskerberos)
+ sprintf(dp, ";sec=mskrb5");
+- else
+- goto out;
++ else {
++ cifs_dbg(VFS, "unknown or missing server auth type, use krb5\n");
++ sprintf(dp, ";sec=krb5");
++ }
+
+ dp = description + strlen(description);
+ sprintf(dp, ";uid=0x%x",
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 6e8765f44508..020f49c15b30 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -777,7 +777,15 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
+ } else if (rc == -EREMOTE) {
+ cifs_create_dfs_fattr(&fattr, sb);
+ rc = 0;
+- } else if (rc == -EACCES && backup_cred(cifs_sb)) {
++ } else if ((rc == -EACCES) && backup_cred(cifs_sb) &&
++ (strcmp(server->vals->version_string, SMB1_VERSION_STRING)
++ == 0)) {
++ /*
++ * For SMB2 and later the backup intent flag is already
++ * sent if needed on open and there is no path based
++ * FindFirst operation to use to retry with
++ */
++
+ srchinf = kzalloc(sizeof(struct cifs_search_info),
+ GFP_KERNEL);
+ if (srchinf == NULL) {
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index b48f43963da6..333729cf46cd 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -786,7 +786,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ int i, j, rc = 0;
+ int timeout, optype;
+ struct mid_q_entry *midQ[MAX_COMPOUND];
+- unsigned int credits = 1;
++ unsigned int credits = 0;
+ char *buf;
+
+ timeout = flags & CIFS_TIMEOUT_MASK;
+@@ -851,17 +851,20 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+
+ mutex_unlock(&ses->server->srv_mutex);
+
+- for (i = 0; i < num_rqst; i++) {
+- if (rc < 0)
+- goto out;
++ if (rc < 0)
++ goto out;
+
+- if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP))
+- smb311_update_preauth_hash(ses, rqst[i].rq_iov,
+- rqst[i].rq_nvec);
++ /*
++ * Compounding is never used during session establish.
++ */
++ if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP))
++ smb311_update_preauth_hash(ses, rqst[0].rq_iov,
++ rqst[0].rq_nvec);
+
+- if (timeout == CIFS_ASYNC_OP)
+- goto out;
++ if (timeout == CIFS_ASYNC_OP)
++ goto out;
+
++ for (i = 0; i < num_rqst; i++) {
+ rc = wait_for_response(ses->server, midQ[i]);
+ if (rc != 0) {
+ cifs_dbg(FYI, "Cancelling wait for mid %llu\n",
+@@ -877,10 +880,21 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ }
+ spin_unlock(&GlobalMid_Lock);
+ }
++ }
++
++ for (i = 0; i < num_rqst; i++)
++ if (midQ[i]->resp_buf)
++ credits += ses->server->ops->get_credits(midQ[i]);
++ if (!credits)
++ credits = 1;
++
++ for (i = 0; i < num_rqst; i++) {
++ if (rc < 0)
++ goto out;
+
+ rc = cifs_sync_mid_result(midQ[i], ses->server);
+ if (rc != 0) {
+- add_credits(ses->server, 1, optype);
++ add_credits(ses->server, credits, optype);
+ return rc;
+ }
+
+@@ -901,23 +915,26 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ else
+ resp_buf_type[i] = CIFS_SMALL_BUFFER;
+
+- if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) {
+- struct kvec iov = {
+- .iov_base = resp_iov[i].iov_base,
+- .iov_len = resp_iov[i].iov_len
+- };
+- smb311_update_preauth_hash(ses, &iov, 1);
+- }
+-
+- credits = ses->server->ops->get_credits(midQ[i]);
+-
+ rc = ses->server->ops->check_receive(midQ[i], ses->server,
+ flags & CIFS_LOG_ERROR);
+
+ /* mark it so buf will not be freed by cifs_delete_mid */
+ if ((flags & CIFS_NO_RESP) == 0)
+ midQ[i]->resp_buf = NULL;
++
+ }
++
++ /*
++ * Compounding is never used during session establish.
++ */
++ if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) {
++ struct kvec iov = {
++ .iov_base = resp_iov[0].iov_base,
++ .iov_len = resp_iov[0].iov_len
++ };
++ smb311_update_preauth_hash(ses, &iov, 1);
++ }
++
+ out:
+ /*
+ * This will dequeue all mids. After this it is important that the
+diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
+index f408994fc632..6e000392e4a4 100644
+--- a/fs/cramfs/inode.c
++++ b/fs/cramfs/inode.c
+@@ -202,7 +202,8 @@ static void *cramfs_blkdev_read(struct super_block *sb, unsigned int offset,
+ continue;
+ blk_offset = (blocknr - buffer_blocknr[i]) << PAGE_SHIFT;
+ blk_offset += offset;
+- if (blk_offset + len > BUFFER_SIZE)
++ if (blk_offset > BUFFER_SIZE ||
++ blk_offset + len > BUFFER_SIZE)
+ continue;
+ return read_buffers[i] + blk_offset;
+ }
+diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h
+index 39c20ef26db4..79debfc9cef9 100644
+--- a/fs/crypto/fscrypt_private.h
++++ b/fs/crypto/fscrypt_private.h
+@@ -83,10 +83,6 @@ static inline bool fscrypt_valid_enc_modes(u32 contents_mode,
+ filenames_mode == FS_ENCRYPTION_MODE_AES_256_CTS)
+ return true;
+
+- if (contents_mode == FS_ENCRYPTION_MODE_SPECK128_256_XTS &&
+- filenames_mode == FS_ENCRYPTION_MODE_SPECK128_256_CTS)
+- return true;
+-
+ return false;
+ }
+
+diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
+index e997ca51192f..7874c9bb2fc5 100644
+--- a/fs/crypto/keyinfo.c
++++ b/fs/crypto/keyinfo.c
+@@ -174,16 +174,6 @@ static struct fscrypt_mode {
+ .cipher_str = "cts(cbc(aes))",
+ .keysize = 16,
+ },
+- [FS_ENCRYPTION_MODE_SPECK128_256_XTS] = {
+- .friendly_name = "Speck128/256-XTS",
+- .cipher_str = "xts(speck128)",
+- .keysize = 64,
+- },
+- [FS_ENCRYPTION_MODE_SPECK128_256_CTS] = {
+- .friendly_name = "Speck128/256-CTS-CBC",
+- .cipher_str = "cts(cbc(speck128))",
+- .keysize = 32,
+- },
+ };
+
+ static struct fscrypt_mode *
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index caff935fbeb8..5cfb1e2f6a5b 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1401,7 +1401,8 @@ struct ext4_sb_info {
+ u32 s_min_batch_time;
+ struct block_device *journal_bdev;
+ #ifdef CONFIG_QUOTA
+- char *s_qf_names[EXT4_MAXQUOTAS]; /* Names of quota files with journalled quota */
++ /* Names of quota files with journalled quota */
++ char __rcu *s_qf_names[EXT4_MAXQUOTAS];
+ int s_jquota_fmt; /* Format of quota to use */
+ #endif
+ unsigned int s_want_extra_isize; /* New inodes should reserve # bytes */
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 7b4736022761..9c4bac18cc6c 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -863,7 +863,7 @@ int ext4_da_write_inline_data_begin(struct address_space *mapping,
+ handle_t *handle;
+ struct page *page;
+ struct ext4_iloc iloc;
+- int retries;
++ int retries = 0;
+
+ ret = ext4_get_inode_loc(inode, &iloc);
+ if (ret)
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index a7074115d6f6..0edee31913d1 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -67,7 +67,6 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2)
+ ei1 = EXT4_I(inode1);
+ ei2 = EXT4_I(inode2);
+
+- swap(inode1->i_flags, inode2->i_flags);
+ swap(inode1->i_version, inode2->i_version);
+ swap(inode1->i_blocks, inode2->i_blocks);
+ swap(inode1->i_bytes, inode2->i_bytes);
+@@ -85,6 +84,21 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2)
+ i_size_write(inode2, isize);
+ }
+
++static void reset_inode_seed(struct inode *inode)
++{
++ struct ext4_inode_info *ei = EXT4_I(inode);
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ __le32 inum = cpu_to_le32(inode->i_ino);
++ __le32 gen = cpu_to_le32(inode->i_generation);
++ __u32 csum;
++
++ if (!ext4_has_metadata_csum(inode->i_sb))
++ return;
++
++ csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&inum, sizeof(inum));
++ ei->i_csum_seed = ext4_chksum(sbi, csum, (__u8 *)&gen, sizeof(gen));
++}
++
+ /**
+ * Swap the information from the given @inode and the inode
+ * EXT4_BOOT_LOADER_INO. It will basically swap i_data and all other
+@@ -102,10 +116,13 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ struct inode *inode_bl;
+ struct ext4_inode_info *ei_bl;
+
+- if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode))
++ if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) ||
++ IS_SWAPFILE(inode) || IS_ENCRYPTED(inode) ||
++ ext4_has_inline_data(inode))
+ return -EINVAL;
+
+- if (!inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN))
++ if (IS_RDONLY(inode) || IS_APPEND(inode) || IS_IMMUTABLE(inode) ||
++ !inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+ inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO);
+@@ -120,13 +137,13 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ * that only 1 swap_inode_boot_loader is running. */
+ lock_two_nondirectories(inode, inode_bl);
+
+- truncate_inode_pages(&inode->i_data, 0);
+- truncate_inode_pages(&inode_bl->i_data, 0);
+-
+ /* Wait for all existing dio workers */
+ inode_dio_wait(inode);
+ inode_dio_wait(inode_bl);
+
++ truncate_inode_pages(&inode->i_data, 0);
++ truncate_inode_pages(&inode_bl->i_data, 0);
++
+ handle = ext4_journal_start(inode_bl, EXT4_HT_MOVE_EXTENTS, 2);
+ if (IS_ERR(handle)) {
+ err = -EINVAL;
+@@ -159,6 +176,8 @@ static long swap_inode_boot_loader(struct super_block *sb,
+
+ inode->i_generation = prandom_u32();
+ inode_bl->i_generation = prandom_u32();
++ reset_inode_seed(inode);
++ reset_inode_seed(inode_bl);
+
+ ext4_discard_preallocations(inode);
+
+@@ -169,6 +188,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ inode->i_ino, err);
+ /* Revert all changes: */
+ swap_inode_data(inode, inode_bl);
++ ext4_mark_inode_dirty(handle, inode);
+ } else {
+ err = ext4_mark_inode_dirty(handle, inode_bl);
+ if (err < 0) {
+@@ -178,6 +198,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ /* Revert all changes: */
+ swap_inode_data(inode, inode_bl);
+ ext4_mark_inode_dirty(handle, inode);
++ ext4_mark_inode_dirty(handle, inode_bl);
+ }
+ }
+ ext4_journal_stop(handle);
+@@ -339,19 +360,14 @@ static int ext4_ioctl_setproject(struct file *filp, __u32 projid)
+ if (projid_eq(kprojid, EXT4_I(inode)->i_projid))
+ return 0;
+
+- err = mnt_want_write_file(filp);
+- if (err)
+- return err;
+-
+ err = -EPERM;
+- inode_lock(inode);
+ /* Is it quota file? Do not allow user to mess with it */
+ if (ext4_is_quota_file(inode))
+- goto out_unlock;
++ return err;
+
+ err = ext4_get_inode_loc(inode, &iloc);
+ if (err)
+- goto out_unlock;
++ return err;
+
+ raw_inode = ext4_raw_inode(&iloc);
+ if (!EXT4_FITS_IN_INODE(raw_inode, ei, i_projid)) {
+@@ -359,20 +375,20 @@ static int ext4_ioctl_setproject(struct file *filp, __u32 projid)
+ EXT4_SB(sb)->s_want_extra_isize,
+ &iloc);
+ if (err)
+- goto out_unlock;
++ return err;
+ } else {
+ brelse(iloc.bh);
+ }
+
+- dquot_initialize(inode);
++ err = dquot_initialize(inode);
++ if (err)
++ return err;
+
+ handle = ext4_journal_start(inode, EXT4_HT_QUOTA,
+ EXT4_QUOTA_INIT_BLOCKS(sb) +
+ EXT4_QUOTA_DEL_BLOCKS(sb) + 3);
+- if (IS_ERR(handle)) {
+- err = PTR_ERR(handle);
+- goto out_unlock;
+- }
++ if (IS_ERR(handle))
++ return PTR_ERR(handle);
+
+ err = ext4_reserve_inode_write(handle, inode, &iloc);
+ if (err)
+@@ -400,9 +416,6 @@ out_dirty:
+ err = rc;
+ out_stop:
+ ext4_journal_stop(handle);
+-out_unlock:
+- inode_unlock(inode);
+- mnt_drop_write_file(filp);
+ return err;
+ }
+ #else
+@@ -626,6 +639,30 @@ group_add_out:
+ return err;
+ }
+
++static int ext4_ioctl_check_project(struct inode *inode, struct fsxattr *fa)
++{
++ /*
++ * Project Quota ID state is only allowed to change from within the init
++ * namespace. Enforce that restriction only if we are trying to change
++ * the quota ID state. Everything else is allowed in user namespaces.
++ */
++ if (current_user_ns() == &init_user_ns)
++ return 0;
++
++ if (__kprojid_val(EXT4_I(inode)->i_projid) != fa->fsx_projid)
++ return -EINVAL;
++
++ if (ext4_test_inode_flag(inode, EXT4_INODE_PROJINHERIT)) {
++ if (!(fa->fsx_xflags & FS_XFLAG_PROJINHERIT))
++ return -EINVAL;
++ } else {
++ if (fa->fsx_xflags & FS_XFLAG_PROJINHERIT)
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ {
+ struct inode *inode = file_inode(filp);
+@@ -1025,19 +1062,19 @@ resizefs_out:
+ return err;
+
+ inode_lock(inode);
++ err = ext4_ioctl_check_project(inode, &fa);
++ if (err)
++ goto out;
+ flags = (ei->i_flags & ~EXT4_FL_XFLAG_VISIBLE) |
+ (flags & EXT4_FL_XFLAG_VISIBLE);
+ err = ext4_ioctl_setflags(inode, flags);
+- inode_unlock(inode);
+- mnt_drop_write_file(filp);
+ if (err)
+- return err;
+-
++ goto out;
+ err = ext4_ioctl_setproject(filp, fa.fsx_projid);
+- if (err)
+- return err;
+-
+- return 0;
++out:
++ inode_unlock(inode);
++ mnt_drop_write_file(filp);
++ return err;
+ }
+ case EXT4_IOC_SHUTDOWN:
+ return ext4_shutdown(sb, arg);
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index a409ff70d67b..2f5be02fc6f6 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -516,9 +516,13 @@ mext_check_arguments(struct inode *orig_inode,
+ orig_inode->i_ino, donor_inode->i_ino);
+ return -EINVAL;
+ }
+- if (orig_eof < orig_start + *len - 1)
++ if (orig_eof <= orig_start)
++ *len = 0;
++ else if (orig_eof < orig_start + *len - 1)
+ *len = orig_eof - orig_start;
+- if (donor_eof < donor_start + *len - 1)
++ if (donor_eof <= donor_start)
++ *len = 0;
++ else if (donor_eof < donor_start + *len - 1)
+ *len = donor_eof - donor_start;
+ if (!*len) {
+ ext4_debug("ext4 move extent: len should not be 0 "
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 1145109968ef..d3d4643ab79b 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -914,6 +914,18 @@ static inline void ext4_quota_off_umount(struct super_block *sb)
+ for (type = 0; type < EXT4_MAXQUOTAS; type++)
+ ext4_quota_off(sb, type);
+ }
++
++/*
++ * This is a helper function which is used in the mount/remount
++ * codepaths (which holds s_umount) to fetch the quota file name.
++ */
++static inline char *get_qf_name(struct super_block *sb,
++ struct ext4_sb_info *sbi,
++ int type)
++{
++ return rcu_dereference_protected(sbi->s_qf_names[type],
++ lockdep_is_held(&sb->s_umount));
++}
+ #else
+ static inline void ext4_quota_off_umount(struct super_block *sb)
+ {
+@@ -965,7 +977,7 @@ static void ext4_put_super(struct super_block *sb)
+ percpu_free_rwsem(&sbi->s_journal_flag_rwsem);
+ #ifdef CONFIG_QUOTA
+ for (i = 0; i < EXT4_MAXQUOTAS; i++)
+- kfree(sbi->s_qf_names[i]);
++ kfree(get_qf_name(sb, sbi, i));
+ #endif
+
+ /* Debugging code just in case the in-memory inode orphan list
+@@ -1530,11 +1542,10 @@ static const char deprecated_msg[] =
+ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+- char *qname;
++ char *qname, *old_qname = get_qf_name(sb, sbi, qtype);
+ int ret = -1;
+
+- if (sb_any_quota_loaded(sb) &&
+- !sbi->s_qf_names[qtype]) {
++ if (sb_any_quota_loaded(sb) && !old_qname) {
+ ext4_msg(sb, KERN_ERR,
+ "Cannot change journaled "
+ "quota options when quota turned on");
+@@ -1551,8 +1562,8 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+ "Not enough memory for storing quotafile name");
+ return -1;
+ }
+- if (sbi->s_qf_names[qtype]) {
+- if (strcmp(sbi->s_qf_names[qtype], qname) == 0)
++ if (old_qname) {
++ if (strcmp(old_qname, qname) == 0)
+ ret = 1;
+ else
+ ext4_msg(sb, KERN_ERR,
+@@ -1565,7 +1576,7 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+ "quotafile must be on filesystem root");
+ goto errout;
+ }
+- sbi->s_qf_names[qtype] = qname;
++ rcu_assign_pointer(sbi->s_qf_names[qtype], qname);
+ set_opt(sb, QUOTA);
+ return 1;
+ errout:
+@@ -1577,15 +1588,16 @@ static int clear_qf_name(struct super_block *sb, int qtype)
+ {
+
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ char *old_qname = get_qf_name(sb, sbi, qtype);
+
+- if (sb_any_quota_loaded(sb) &&
+- sbi->s_qf_names[qtype]) {
++ if (sb_any_quota_loaded(sb) && old_qname) {
+ ext4_msg(sb, KERN_ERR, "Cannot change journaled quota options"
+ " when quota turned on");
+ return -1;
+ }
+- kfree(sbi->s_qf_names[qtype]);
+- sbi->s_qf_names[qtype] = NULL;
++ rcu_assign_pointer(sbi->s_qf_names[qtype], NULL);
++ synchronize_rcu();
++ kfree(old_qname);
+ return 1;
+ }
+ #endif
+@@ -1960,7 +1972,7 @@ static int parse_options(char *options, struct super_block *sb,
+ int is_remount)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+- char *p;
++ char *p, __maybe_unused *usr_qf_name, __maybe_unused *grp_qf_name;
+ substring_t args[MAX_OPT_ARGS];
+ int token;
+
+@@ -1991,11 +2003,13 @@ static int parse_options(char *options, struct super_block *sb,
+ "Cannot enable project quota enforcement.");
+ return 0;
+ }
+- if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
+- if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA])
++ usr_qf_name = get_qf_name(sb, sbi, USRQUOTA);
++ grp_qf_name = get_qf_name(sb, sbi, GRPQUOTA);
++ if (usr_qf_name || grp_qf_name) {
++ if (test_opt(sb, USRQUOTA) && usr_qf_name)
+ clear_opt(sb, USRQUOTA);
+
+- if (test_opt(sb, GRPQUOTA) && sbi->s_qf_names[GRPQUOTA])
++ if (test_opt(sb, GRPQUOTA) && grp_qf_name)
+ clear_opt(sb, GRPQUOTA);
+
+ if (test_opt(sb, GRPQUOTA) || test_opt(sb, USRQUOTA)) {
+@@ -2029,6 +2043,7 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
+ {
+ #if defined(CONFIG_QUOTA)
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ char *usr_qf_name, *grp_qf_name;
+
+ if (sbi->s_jquota_fmt) {
+ char *fmtname = "";
+@@ -2047,11 +2062,14 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
+ seq_printf(seq, ",jqfmt=%s", fmtname);
+ }
+
+- if (sbi->s_qf_names[USRQUOTA])
+- seq_show_option(seq, "usrjquota", sbi->s_qf_names[USRQUOTA]);
+-
+- if (sbi->s_qf_names[GRPQUOTA])
+- seq_show_option(seq, "grpjquota", sbi->s_qf_names[GRPQUOTA]);
++ rcu_read_lock();
++ usr_qf_name = rcu_dereference(sbi->s_qf_names[USRQUOTA]);
++ grp_qf_name = rcu_dereference(sbi->s_qf_names[GRPQUOTA]);
++ if (usr_qf_name)
++ seq_show_option(seq, "usrjquota", usr_qf_name);
++ if (grp_qf_name)
++ seq_show_option(seq, "grpjquota", grp_qf_name);
++ rcu_read_unlock();
+ #endif
+ }
+
+@@ -5103,6 +5121,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ int err = 0;
+ #ifdef CONFIG_QUOTA
+ int i, j;
++ char *to_free[EXT4_MAXQUOTAS];
+ #endif
+ char *orig_data = kstrdup(data, GFP_KERNEL);
+
+@@ -5122,8 +5141,9 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ old_opts.s_jquota_fmt = sbi->s_jquota_fmt;
+ for (i = 0; i < EXT4_MAXQUOTAS; i++)
+ if (sbi->s_qf_names[i]) {
+- old_opts.s_qf_names[i] = kstrdup(sbi->s_qf_names[i],
+- GFP_KERNEL);
++ char *qf_name = get_qf_name(sb, sbi, i);
++
++ old_opts.s_qf_names[i] = kstrdup(qf_name, GFP_KERNEL);
+ if (!old_opts.s_qf_names[i]) {
+ for (j = 0; j < i; j++)
+ kfree(old_opts.s_qf_names[j]);
+@@ -5352,9 +5372,12 @@ restore_opts:
+ #ifdef CONFIG_QUOTA
+ sbi->s_jquota_fmt = old_opts.s_jquota_fmt;
+ for (i = 0; i < EXT4_MAXQUOTAS; i++) {
+- kfree(sbi->s_qf_names[i]);
+- sbi->s_qf_names[i] = old_opts.s_qf_names[i];
++ to_free[i] = get_qf_name(sb, sbi, i);
++ rcu_assign_pointer(sbi->s_qf_names[i], old_opts.s_qf_names[i]);
+ }
++ synchronize_rcu();
++ for (i = 0; i < EXT4_MAXQUOTAS; i++)
++ kfree(to_free[i]);
+ #endif
+ kfree(orig_data);
+ return err;
+@@ -5545,7 +5568,7 @@ static int ext4_write_info(struct super_block *sb, int type)
+ */
+ static int ext4_quota_on_mount(struct super_block *sb, int type)
+ {
+- return dquot_quota_on_mount(sb, EXT4_SB(sb)->s_qf_names[type],
++ return dquot_quota_on_mount(sb, get_qf_name(sb, EXT4_SB(sb), type),
+ EXT4_SB(sb)->s_jquota_fmt, type);
+ }
+
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index e8b6b89bddb8..59d0472013f4 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -696,6 +696,8 @@ int f2fs_recover_orphan_inodes(struct f2fs_sb_info *sbi)
+ /* clear Orphan Flag */
+ clear_ckpt_flags(sbi, CP_ORPHAN_PRESENT_FLAG);
+ out:
++ set_sbi_flag(sbi, SBI_IS_RECOVERED);
++
+ #ifdef CONFIG_QUOTA
+ /* Turn quotas off */
+ if (quota_enabled)
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 382c1ef9a9e4..11f28342f641 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -80,7 +80,8 @@ static void __read_end_io(struct bio *bio)
+ /* PG_error was set if any post_read step failed */
+ if (bio->bi_status || PageError(page)) {
+ ClearPageUptodate(page);
+- SetPageError(page);
++ /* will re-read again later */
++ ClearPageError(page);
+ } else {
+ SetPageUptodate(page);
+ }
+@@ -456,12 +457,16 @@ int f2fs_submit_page_bio(struct f2fs_io_info *fio)
+ bio_put(bio);
+ return -EFAULT;
+ }
+- bio_set_op_attrs(bio, fio->op, fio->op_flags);
+
+- __submit_bio(fio->sbi, bio, fio->type);
++ if (fio->io_wbc && !is_read_io(fio->op))
++ wbc_account_io(fio->io_wbc, page, PAGE_SIZE);
++
++ bio_set_op_attrs(bio, fio->op, fio->op_flags);
+
+ if (!is_read_io(fio->op))
+ inc_page_count(fio->sbi, WB_DATA_TYPE(fio->page));
++
++ __submit_bio(fio->sbi, bio, fio->type);
+ return 0;
+ }
+
+@@ -586,6 +591,7 @@ static int f2fs_submit_page_read(struct inode *inode, struct page *page,
+ bio_put(bio);
+ return -EFAULT;
+ }
++ ClearPageError(page);
+ __submit_bio(F2FS_I_SB(inode), bio, DATA);
+ return 0;
+ }
+@@ -1561,6 +1567,7 @@ submit_and_realloc:
+ if (bio_add_page(bio, page, blocksize, 0) < blocksize)
+ goto submit_and_realloc;
+
++ ClearPageError(page);
+ last_block_in_bio = block_nr;
+ goto next_page;
+ set_error_page:
+@@ -2583,10 +2590,6 @@ static int f2fs_set_data_page_dirty(struct page *page)
+ if (!PageUptodate(page))
+ SetPageUptodate(page);
+
+- /* don't remain PG_checked flag which was set during GC */
+- if (is_cold_data(page))
+- clear_cold_data(page);
+-
+ if (f2fs_is_atomic_file(inode) && !f2fs_is_commit_atomic_write(inode)) {
+ if (!IS_ATOMIC_WRITTEN_PAGE(page)) {
+ f2fs_register_inmem_page(inode, page);
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index 231b77ef5a53..a70cd2580eae 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -308,14 +308,13 @@ static unsigned int __free_extent_tree(struct f2fs_sb_info *sbi,
+ return count - atomic_read(&et->node_cnt);
+ }
+
+-static void __drop_largest_extent(struct inode *inode,
++static void __drop_largest_extent(struct extent_tree *et,
+ pgoff_t fofs, unsigned int len)
+ {
+- struct extent_info *largest = &F2FS_I(inode)->extent_tree->largest;
+-
+- if (fofs < largest->fofs + largest->len && fofs + len > largest->fofs) {
+- largest->len = 0;
+- f2fs_mark_inode_dirty_sync(inode, true);
++ if (fofs < et->largest.fofs + et->largest.len &&
++ fofs + len > et->largest.fofs) {
++ et->largest.len = 0;
++ et->largest_updated = true;
+ }
+ }
+
+@@ -416,12 +415,11 @@ out:
+ return ret;
+ }
+
+-static struct extent_node *__try_merge_extent_node(struct inode *inode,
++static struct extent_node *__try_merge_extent_node(struct f2fs_sb_info *sbi,
+ struct extent_tree *et, struct extent_info *ei,
+ struct extent_node *prev_ex,
+ struct extent_node *next_ex)
+ {
+- struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct extent_node *en = NULL;
+
+ if (prev_ex && __is_back_mergeable(ei, &prev_ex->ei)) {
+@@ -443,7 +441,7 @@ static struct extent_node *__try_merge_extent_node(struct inode *inode,
+ if (!en)
+ return NULL;
+
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+
+ spin_lock(&sbi->extent_lock);
+ if (!list_empty(&en->list)) {
+@@ -454,12 +452,11 @@ static struct extent_node *__try_merge_extent_node(struct inode *inode,
+ return en;
+ }
+
+-static struct extent_node *__insert_extent_tree(struct inode *inode,
++static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi,
+ struct extent_tree *et, struct extent_info *ei,
+ struct rb_node **insert_p,
+ struct rb_node *insert_parent)
+ {
+- struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct rb_node **p;
+ struct rb_node *parent = NULL;
+ struct extent_node *en = NULL;
+@@ -476,7 +473,7 @@ do_insert:
+ if (!en)
+ return NULL;
+
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+
+ /* update in global extent list */
+ spin_lock(&sbi->extent_lock);
+@@ -497,6 +494,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ struct rb_node **insert_p = NULL, *insert_parent = NULL;
+ unsigned int end = fofs + len;
+ unsigned int pos = (unsigned int)fofs;
++ bool updated = false;
+
+ if (!et)
+ return;
+@@ -517,7 +515,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ * drop largest extent before lookup, in case it's already
+ * been shrunk from extent tree
+ */
+- __drop_largest_extent(inode, fofs, len);
++ __drop_largest_extent(et, fofs, len);
+
+ /* 1. lookup first extent node in range [fofs, fofs + len - 1] */
+ en = (struct extent_node *)f2fs_lookup_rb_tree_ret(&et->root,
+@@ -550,7 +548,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ set_extent_info(&ei, end,
+ end - dei.fofs + dei.blk,
+ org_end - end);
+- en1 = __insert_extent_tree(inode, et, &ei,
++ en1 = __insert_extent_tree(sbi, et, &ei,
+ NULL, NULL);
+ next_en = en1;
+ } else {
+@@ -570,7 +568,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ }
+
+ if (parts)
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+ else
+ __release_extent_node(sbi, et, en);
+
+@@ -590,15 +588,16 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ if (blkaddr) {
+
+ set_extent_info(&ei, fofs, blkaddr, len);
+- if (!__try_merge_extent_node(inode, et, &ei, prev_en, next_en))
+- __insert_extent_tree(inode, et, &ei,
++ if (!__try_merge_extent_node(sbi, et, &ei, prev_en, next_en))
++ __insert_extent_tree(sbi, et, &ei,
+ insert_p, insert_parent);
+
+ /* give up extent_cache, if split and small updates happen */
+ if (dei.len >= 1 &&
+ prev.len < F2FS_MIN_EXTENT_LEN &&
+ et->largest.len < F2FS_MIN_EXTENT_LEN) {
+- __drop_largest_extent(inode, 0, UINT_MAX);
++ et->largest.len = 0;
++ et->largest_updated = true;
+ set_inode_flag(inode, FI_NO_EXTENT);
+ }
+ }
+@@ -606,7 +605,15 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ if (is_inode_flag_set(inode, FI_NO_EXTENT))
+ __free_extent_tree(sbi, et);
+
++ if (et->largest_updated) {
++ et->largest_updated = false;
++ updated = true;
++ }
++
+ write_unlock(&et->lock);
++
++ if (updated)
++ f2fs_mark_inode_dirty_sync(inode, true);
+ }
+
+ unsigned int f2fs_shrink_extent_tree(struct f2fs_sb_info *sbi, int nr_shrink)
+@@ -705,6 +712,7 @@ void f2fs_drop_extent_tree(struct inode *inode)
+ {
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct extent_tree *et = F2FS_I(inode)->extent_tree;
++ bool updated = false;
+
+ if (!f2fs_may_extent_tree(inode))
+ return;
+@@ -713,8 +721,13 @@ void f2fs_drop_extent_tree(struct inode *inode)
+
+ write_lock(&et->lock);
+ __free_extent_tree(sbi, et);
+- __drop_largest_extent(inode, 0, UINT_MAX);
++ if (et->largest.len) {
++ et->largest.len = 0;
++ updated = true;
++ }
+ write_unlock(&et->lock);
++ if (updated)
++ f2fs_mark_inode_dirty_sync(inode, true);
+ }
+
+ void f2fs_destroy_extent_tree(struct inode *inode)
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index abf925664d9c..ecb735142276 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -572,6 +572,7 @@ struct extent_tree {
+ struct list_head list; /* to be used by sbi->zombie_list */
+ rwlock_t lock; /* protect extent info rb-tree */
+ atomic_t node_cnt; /* # of extent node in rb-tree*/
++ bool largest_updated; /* largest extent updated */
+ };
+
+ /*
+@@ -754,12 +755,12 @@ static inline bool __is_front_mergeable(struct extent_info *cur,
+ }
+
+ extern void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync);
+-static inline void __try_update_largest_extent(struct inode *inode,
+- struct extent_tree *et, struct extent_node *en)
++static inline void __try_update_largest_extent(struct extent_tree *et,
++ struct extent_node *en)
+ {
+ if (en->ei.len > et->largest.len) {
+ et->largest = en->ei;
+- f2fs_mark_inode_dirty_sync(inode, true);
++ et->largest_updated = true;
+ }
+ }
+
+@@ -1088,6 +1089,7 @@ enum {
+ SBI_NEED_SB_WRITE, /* need to recover superblock */
+ SBI_NEED_CP, /* need to checkpoint */
+ SBI_IS_SHUTDOWN, /* shutdown by ioctl */
++ SBI_IS_RECOVERED, /* recovered orphan/data */
+ };
+
+ enum {
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index 959df2249875..dd608b819a3c 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -368,6 +368,12 @@ static int do_read_inode(struct inode *inode)
+ if (f2fs_has_inline_data(inode) && !f2fs_exist_data(inode))
+ __recover_inline_status(inode, node_page);
+
++ /* try to recover cold bit for non-dir inode */
++ if (!S_ISDIR(inode->i_mode) && !is_cold_node(node_page)) {
++ set_cold_node(node_page, false);
++ set_page_dirty(node_page);
++ }
++
+ /* get rdev by using inline_info */
+ __get_inode_rdev(inode, ri);
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index dd2e45a661aa..42ea42acb487 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1542,8 +1542,10 @@ static int __write_node_page(struct page *page, bool atomic, bool *submitted,
+ }
+
+ if (__is_valid_data_blkaddr(ni.blk_addr) &&
+- !f2fs_is_valid_blkaddr(sbi, ni.blk_addr, DATA_GENERIC))
++ !f2fs_is_valid_blkaddr(sbi, ni.blk_addr, DATA_GENERIC)) {
++ up_read(&sbi->node_write);
+ goto redirty_out;
++ }
+
+ if (atomic && !test_opt(sbi, NOBARRIER))
+ fio.op_flags |= REQ_PREFLUSH | REQ_FUA;
+@@ -2537,7 +2539,7 @@ retry:
+ if (!PageUptodate(ipage))
+ SetPageUptodate(ipage);
+ fill_node_footer(ipage, ino, ino, 0, true);
+- set_cold_node(page, false);
++ set_cold_node(ipage, false);
+
+ src = F2FS_INODE(page);
+ dst = F2FS_INODE(ipage);
+@@ -2560,6 +2562,13 @@ retry:
+ F2FS_FITS_IN_INODE(src, le16_to_cpu(src->i_extra_isize),
+ i_projid))
+ dst->i_projid = src->i_projid;
++
++ if (f2fs_sb_has_inode_crtime(sbi->sb) &&
++ F2FS_FITS_IN_INODE(src, le16_to_cpu(src->i_extra_isize),
++ i_crtime_nsec)) {
++ dst->i_crtime = src->i_crtime;
++ dst->i_crtime_nsec = src->i_crtime_nsec;
++ }
+ }
+
+ new_ni = old_ni;
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 95511ed11a22..9a8579fb3a30 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -221,6 +221,7 @@ static void recover_inode(struct inode *inode, struct page *page)
+ inode->i_mtime.tv_nsec = le32_to_cpu(raw->i_mtime_nsec);
+
+ F2FS_I(inode)->i_advise = raw->i_advise;
++ F2FS_I(inode)->i_flags = le32_to_cpu(raw->i_flags);
+
+ recover_inline_flags(inode, raw);
+
+@@ -697,11 +698,15 @@ skip:
+ /* let's drop all the directory inodes for clean checkpoint */
+ destroy_fsync_dnodes(&dir_list);
+
+- if (!err && need_writecp) {
+- struct cp_control cpc = {
+- .reason = CP_RECOVERY,
+- };
+- err = f2fs_write_checkpoint(sbi, &cpc);
++ if (need_writecp) {
++ set_sbi_flag(sbi, SBI_IS_RECOVERED);
++
++ if (!err) {
++ struct cp_control cpc = {
++ .reason = CP_RECOVERY,
++ };
++ err = f2fs_write_checkpoint(sbi, &cpc);
++ }
+ }
+
+ kmem_cache_destroy(fsync_entry_slab);
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 896b885f504e..287c9fe9fff9 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1852,7 +1852,9 @@ static int f2fs_quota_off(struct super_block *sb, int type)
+ if (!inode || !igrab(inode))
+ return dquot_quota_off(sb, type);
+
+- f2fs_quota_sync(sb, type);
++ err = f2fs_quota_sync(sb, type);
++ if (err)
++ goto out_put;
+
+ err = dquot_quota_off(sb, type);
+ if (err || f2fs_sb_has_quota_ino(sb))
+@@ -1871,9 +1873,20 @@ out_put:
+ void f2fs_quota_off_umount(struct super_block *sb)
+ {
+ int type;
++ int err;
+
+- for (type = 0; type < MAXQUOTAS; type++)
+- f2fs_quota_off(sb, type);
++ for (type = 0; type < MAXQUOTAS; type++) {
++ err = f2fs_quota_off(sb, type);
++ if (err) {
++ int ret = dquot_quota_off(sb, type);
++
++ f2fs_msg(sb, KERN_ERR,
++ "Fail to turn off disk quota "
++ "(type: %d, err: %d, ret:%d), Please "
++ "run fsck to fix it.", type, err, ret);
++ set_sbi_flag(F2FS_SB(sb), SBI_NEED_FSCK);
++ }
++ }
+ }
+
+ static int f2fs_get_projid(struct inode *inode, kprojid_t *projid)
+@@ -3175,6 +3188,9 @@ static void kill_f2fs_super(struct super_block *sb)
+ };
+ f2fs_write_checkpoint(sbi, &cpc);
+ }
++
++ if (is_sbi_flag_set(sbi, SBI_IS_RECOVERED) && f2fs_readonly(sb))
++ sb->s_flags &= ~SB_RDONLY;
+ }
+ kill_block_super(sb);
+ }
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index c2469833b4fb..6b84ef6ccff3 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -1333,6 +1333,9 @@ static struct dentry *gfs2_mount_meta(struct file_system_type *fs_type,
+ struct path path;
+ int error;
+
++ if (!dev_name || !*dev_name)
++ return ERR_PTR(-EINVAL);
++
+ error = kern_path(dev_name, LOOKUP_FOLLOW, &path);
+ if (error) {
+ pr_warn("path_lookup on %s returned error %d\n",
+diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
+index c125d662777c..26f8d7e46462 100644
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -251,8 +251,8 @@ restart:
+ bh = jh2bh(jh);
+
+ if (buffer_locked(bh)) {
+- spin_unlock(&journal->j_list_lock);
+ get_bh(bh);
++ spin_unlock(&journal->j_list_lock);
+ wait_on_buffer(bh);
+ /* the journal_head may have gone by now */
+ BUFFER_TRACE(bh, "brelse");
+@@ -333,8 +333,8 @@ restart2:
+ jh = transaction->t_checkpoint_io_list;
+ bh = jh2bh(jh);
+ if (buffer_locked(bh)) {
+- spin_unlock(&journal->j_list_lock);
+ get_bh(bh);
++ spin_unlock(&journal->j_list_lock);
+ wait_on_buffer(bh);
+ /* the journal_head may have gone by now */
+ BUFFER_TRACE(bh, "brelse");
+diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
+index 87bdf0f4cba1..902a7dd10e5c 100644
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super_block *sb, void *data, int silent)
+ sb->s_fs_info = c;
+
+ ret = jffs2_parse_options(c, data);
+- if (ret) {
+- kfree(c);
++ if (ret)
+ return -EINVAL;
+- }
+
+ /* Initialize JFFS2 superblock locks, the further initialization will
+ * be done later */
+diff --git a/fs/lockd/host.c b/fs/lockd/host.c
+index d35cd6be0675..93fb7cf0b92b 100644
+--- a/fs/lockd/host.c
++++ b/fs/lockd/host.c
+@@ -341,7 +341,7 @@ struct nlm_host *nlmsvc_lookup_host(const struct svc_rqst *rqstp,
+ };
+ struct lockd_net *ln = net_generic(net, lockd_net_id);
+
+- dprintk("lockd: %s(host='%*s', vers=%u, proto=%s)\n", __func__,
++ dprintk("lockd: %s(host='%.*s', vers=%u, proto=%s)\n", __func__,
+ (int)hostname_len, hostname, rqstp->rq_vers,
+ (rqstp->rq_prot == IPPROTO_UDP ? "udp" : "tcp"));
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 146e30862234..8f53455c4765 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -950,10 +950,10 @@ EXPORT_SYMBOL_GPL(nfs4_set_ds_client);
+
+ /*
+ * Session has been established, and the client marked ready.
+- * Set the mount rsize and wsize with negotiated fore channel
+- * attributes which will be bound checked in nfs_server_set_fsinfo.
++ * Limit the mount rsize, wsize and dtsize using negotiated fore
++ * channel attributes.
+ */
+-static void nfs4_session_set_rwsize(struct nfs_server *server)
++static void nfs4_session_limit_rwsize(struct nfs_server *server)
+ {
+ #ifdef CONFIG_NFS_V4_1
+ struct nfs4_session *sess;
+@@ -966,9 +966,11 @@ static void nfs4_session_set_rwsize(struct nfs_server *server)
+ server_resp_sz = sess->fc_attrs.max_resp_sz - nfs41_maxread_overhead;
+ server_rqst_sz = sess->fc_attrs.max_rqst_sz - nfs41_maxwrite_overhead;
+
+- if (!server->rsize || server->rsize > server_resp_sz)
++ if (server->dtsize > server_resp_sz)
++ server->dtsize = server_resp_sz;
++ if (server->rsize > server_resp_sz)
+ server->rsize = server_resp_sz;
+- if (!server->wsize || server->wsize > server_rqst_sz)
++ if (server->wsize > server_rqst_sz)
+ server->wsize = server_rqst_sz;
+ #endif /* CONFIG_NFS_V4_1 */
+ }
+@@ -1015,12 +1017,12 @@ static int nfs4_server_common_setup(struct nfs_server *server,
+ (unsigned long long) server->fsid.minor);
+ nfs_display_fhandle(mntfh, "Pseudo-fs root FH");
+
+- nfs4_session_set_rwsize(server);
+-
+ error = nfs_probe_fsinfo(server, mntfh, fattr);
+ if (error < 0)
+ goto out;
+
++ nfs4_session_limit_rwsize(server);
++
+ if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
+ server->namelen = NFS4_MAXNAMLEN;
+
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index bb5476a6d264..3dbd15b47c27 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -1111,6 +1111,20 @@ static int nfs_pageio_add_request_mirror(struct nfs_pageio_descriptor *desc,
+ return ret;
+ }
+
++static void nfs_pageio_error_cleanup(struct nfs_pageio_descriptor *desc)
++{
++ u32 midx;
++ struct nfs_pgio_mirror *mirror;
++
++ if (!desc->pg_error)
++ return;
++
++ for (midx = 0; midx < desc->pg_mirror_count; midx++) {
++ mirror = &desc->pg_mirrors[midx];
++ desc->pg_completion_ops->error_cleanup(&mirror->pg_list);
++ }
++}
++
+ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
+ struct nfs_page *req)
+ {
+@@ -1161,25 +1175,11 @@ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
+ return 1;
+
+ out_failed:
+- /*
+- * We might have failed before sending any reqs over wire.
+- * Clean up rest of the reqs in mirror pg_list.
+- */
+- if (desc->pg_error) {
+- struct nfs_pgio_mirror *mirror;
+- void (*func)(struct list_head *);
+-
+- /* remember fatal errors */
+- if (nfs_error_is_fatal(desc->pg_error))
+- nfs_context_set_write_error(req->wb_context,
+- desc->pg_error);
+-
+- func = desc->pg_completion_ops->error_cleanup;
+- for (midx = 0; midx < desc->pg_mirror_count; midx++) {
+- mirror = &desc->pg_mirrors[midx];
+- func(&mirror->pg_list);
+- }
+- }
++ /* remember fatal errors */
++ if (nfs_error_is_fatal(desc->pg_error))
++ nfs_context_set_write_error(req->wb_context,
++ desc->pg_error);
++ nfs_pageio_error_cleanup(desc);
+ return 0;
+ }
+
+@@ -1251,6 +1251,8 @@ void nfs_pageio_complete(struct nfs_pageio_descriptor *desc)
+ for (midx = 0; midx < desc->pg_mirror_count; midx++)
+ nfs_pageio_complete_mirror(desc, midx);
+
++ if (desc->pg_error < 0)
++ nfs_pageio_error_cleanup(desc);
+ if (desc->pg_ops->pg_cleanup)
+ desc->pg_ops->pg_cleanup(desc);
+ nfs_pageio_cleanup_mirroring(desc);
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index b0ca0efd2875..9c6d1d57b598 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -4364,7 +4364,7 @@ nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
+
+ fl = nfs4_alloc_init_lease(dp, NFS4_OPEN_DELEGATE_READ);
+ if (!fl)
+- goto out_stid;
++ goto out_clnt_odstate;
+
+ status = vfs_setlease(fp->fi_deleg_file, fl->fl_type, &fl, NULL);
+ if (fl)
+@@ -4389,7 +4389,6 @@ out_unlock:
+ vfs_setlease(fp->fi_deleg_file, F_UNLCK, NULL, (void **)&dp);
+ out_clnt_odstate:
+ put_clnt_odstate(dp->dl_clnt_odstate);
+-out_stid:
+ nfs4_put_stid(&dp->dl_stid);
+ out_delegees:
+ put_deleg_file(fp);
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index ababdbfab537..f43ea1aad542 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -96,6 +96,9 @@ void fsnotify_unmount_inodes(struct super_block *sb)
+
+ if (iput_inode)
+ iput(iput_inode);
++ /* Wait for outstanding inode references from connectors */
++ wait_var_event(&sb->s_fsnotify_inode_refs,
++ !atomic_long_read(&sb->s_fsnotify_inode_refs));
+ }
+
+ /*
+diff --git a/fs/notify/mark.c b/fs/notify/mark.c
+index 59cdb27826de..09535f6423fc 100644
+--- a/fs/notify/mark.c
++++ b/fs/notify/mark.c
+@@ -179,17 +179,20 @@ static void fsnotify_connector_destroy_workfn(struct work_struct *work)
+ }
+ }
+
+-static struct inode *fsnotify_detach_connector_from_object(
+- struct fsnotify_mark_connector *conn)
++static void *fsnotify_detach_connector_from_object(
++ struct fsnotify_mark_connector *conn,
++ unsigned int *type)
+ {
+ struct inode *inode = NULL;
+
++ *type = conn->type;
+ if (conn->type == FSNOTIFY_OBJ_TYPE_DETACHED)
+ return NULL;
+
+ if (conn->type == FSNOTIFY_OBJ_TYPE_INODE) {
+ inode = fsnotify_conn_inode(conn);
+ inode->i_fsnotify_mask = 0;
++ atomic_long_inc(&inode->i_sb->s_fsnotify_inode_refs);
+ } else if (conn->type == FSNOTIFY_OBJ_TYPE_VFSMOUNT) {
+ fsnotify_conn_mount(conn)->mnt_fsnotify_mask = 0;
+ }
+@@ -211,10 +214,29 @@ static void fsnotify_final_mark_destroy(struct fsnotify_mark *mark)
+ fsnotify_put_group(group);
+ }
+
++/* Drop object reference originally held by a connector */
++static void fsnotify_drop_object(unsigned int type, void *objp)
++{
++ struct inode *inode;
++ struct super_block *sb;
++
++ if (!objp)
++ return;
++ /* Currently only inode references are passed to be dropped */
++ if (WARN_ON_ONCE(type != FSNOTIFY_OBJ_TYPE_INODE))
++ return;
++ inode = objp;
++ sb = inode->i_sb;
++ iput(inode);
++ if (atomic_long_dec_and_test(&sb->s_fsnotify_inode_refs))
++ wake_up_var(&sb->s_fsnotify_inode_refs);
++}
++
+ void fsnotify_put_mark(struct fsnotify_mark *mark)
+ {
+ struct fsnotify_mark_connector *conn;
+- struct inode *inode = NULL;
++ void *objp = NULL;
++ unsigned int type = FSNOTIFY_OBJ_TYPE_DETACHED;
+ bool free_conn = false;
+
+ /* Catch marks that were actually never attached to object */
+@@ -234,7 +256,7 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
+ conn = mark->connector;
+ hlist_del_init_rcu(&mark->obj_list);
+ if (hlist_empty(&conn->list)) {
+- inode = fsnotify_detach_connector_from_object(conn);
++ objp = fsnotify_detach_connector_from_object(conn, &type);
+ free_conn = true;
+ } else {
+ __fsnotify_recalc_mask(conn);
+@@ -242,7 +264,7 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
+ mark->connector = NULL;
+ spin_unlock(&conn->lock);
+
+- iput(inode);
++ fsnotify_drop_object(type, objp);
+
+ if (free_conn) {
+ spin_lock(&destroy_lock);
+@@ -709,7 +731,8 @@ void fsnotify_destroy_marks(fsnotify_connp_t *connp)
+ {
+ struct fsnotify_mark_connector *conn;
+ struct fsnotify_mark *mark, *old_mark = NULL;
+- struct inode *inode;
++ void *objp;
++ unsigned int type;
+
+ conn = fsnotify_grab_connector(connp);
+ if (!conn)
+@@ -735,11 +758,11 @@ void fsnotify_destroy_marks(fsnotify_connp_t *connp)
+ * mark references get dropped. It would lead to strange results such
+ * as delaying inode deletion or blocking unmount.
+ */
+- inode = fsnotify_detach_connector_from_object(conn);
++ objp = fsnotify_detach_connector_from_object(conn, &type);
+ spin_unlock(&conn->lock);
+ if (old_mark)
+ fsnotify_put_mark(old_mark);
+- iput(inode);
++ fsnotify_drop_object(type, objp);
+ }
+
+ /*
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index 5ea1d64cb0b4..a027473561c6 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -713,6 +713,8 @@ static void smap_gather_stats(struct vm_area_struct *vma,
+ smaps_walk.private = mss;
+
+ #ifdef CONFIG_SHMEM
++ /* In case of smaps_rollup, reset the value from previous vma */
++ mss->check_shmem_swap = false;
+ if (vma->vm_file && shmem_mapping(vma->vm_file->f_mapping)) {
+ /*
+ * For shared or readonly shmem mappings we know that all
+@@ -728,7 +730,7 @@ static void smap_gather_stats(struct vm_area_struct *vma,
+
+ if (!shmem_swapped || (vma->vm_flags & VM_SHARED) ||
+ !(vma->vm_flags & VM_WRITE)) {
+- mss->swap = shmem_swapped;
++ mss->swap += shmem_swapped;
+ } else {
+ mss->check_shmem_swap = true;
+ smaps_walk.pte_hole = smaps_pte_hole;
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index bfa0ec69f924..356d2b8568c1 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -1026,7 +1026,7 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
+ struct userfaultfd_ctx *fork_nctx = NULL;
+
+ /* always take the fd_wqh lock before the fault_pending_wqh lock */
+- spin_lock(&ctx->fd_wqh.lock);
++ spin_lock_irq(&ctx->fd_wqh.lock);
+ __add_wait_queue(&ctx->fd_wqh, &wait);
+ for (;;) {
+ set_current_state(TASK_INTERRUPTIBLE);
+@@ -1112,13 +1112,13 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
+ ret = -EAGAIN;
+ break;
+ }
+- spin_unlock(&ctx->fd_wqh.lock);
++ spin_unlock_irq(&ctx->fd_wqh.lock);
+ schedule();
+- spin_lock(&ctx->fd_wqh.lock);
++ spin_lock_irq(&ctx->fd_wqh.lock);
+ }
+ __remove_wait_queue(&ctx->fd_wqh, &wait);
+ __set_current_state(TASK_RUNNING);
+- spin_unlock(&ctx->fd_wqh.lock);
++ spin_unlock_irq(&ctx->fd_wqh.lock);
+
+ if (!ret && msg->event == UFFD_EVENT_FORK) {
+ ret = resolve_userfault_fork(ctx, fork_nctx, msg);
+diff --git a/include/crypto/speck.h b/include/crypto/speck.h
+deleted file mode 100644
+index 73cfc952d405..000000000000
+--- a/include/crypto/speck.h
++++ /dev/null
+@@ -1,62 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * Common values for the Speck algorithm
+- */
+-
+-#ifndef _CRYPTO_SPECK_H
+-#define _CRYPTO_SPECK_H
+-
+-#include <linux/types.h>
+-
+-/* Speck128 */
+-
+-#define SPECK128_BLOCK_SIZE 16
+-
+-#define SPECK128_128_KEY_SIZE 16
+-#define SPECK128_128_NROUNDS 32
+-
+-#define SPECK128_192_KEY_SIZE 24
+-#define SPECK128_192_NROUNDS 33
+-
+-#define SPECK128_256_KEY_SIZE 32
+-#define SPECK128_256_NROUNDS 34
+-
+-struct speck128_tfm_ctx {
+- u64 round_keys[SPECK128_256_NROUNDS];
+- int nrounds;
+-};
+-
+-void crypto_speck128_encrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-void crypto_speck128_decrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-int crypto_speck128_setkey(struct speck128_tfm_ctx *ctx, const u8 *key,
+- unsigned int keysize);
+-
+-/* Speck64 */
+-
+-#define SPECK64_BLOCK_SIZE 8
+-
+-#define SPECK64_96_KEY_SIZE 12
+-#define SPECK64_96_NROUNDS 26
+-
+-#define SPECK64_128_KEY_SIZE 16
+-#define SPECK64_128_NROUNDS 27
+-
+-struct speck64_tfm_ctx {
+- u32 round_keys[SPECK64_128_NROUNDS];
+- int nrounds;
+-};
+-
+-void crypto_speck64_encrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-void crypto_speck64_decrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-int crypto_speck64_setkey(struct speck64_tfm_ctx *ctx, const u8 *key,
+- unsigned int keysize);
+-
+-#endif /* _CRYPTO_SPECK_H */
+diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
+index 38b04f559ad3..1fd6fa822d2c 100644
+--- a/include/linux/bpf_verifier.h
++++ b/include/linux/bpf_verifier.h
+@@ -50,6 +50,9 @@ struct bpf_reg_state {
+ * PTR_TO_MAP_VALUE_OR_NULL
+ */
+ struct bpf_map *map_ptr;
++
++ /* Max size from any of the above. */
++ unsigned long raw;
+ };
+ /* Fixed part of pointer offset, pointer types only */
+ s32 off;
+diff --git a/include/linux/compat.h b/include/linux/compat.h
+index 1a3c4f37e908..de0c13bdcd2c 100644
+--- a/include/linux/compat.h
++++ b/include/linux/compat.h
+@@ -103,6 +103,9 @@ typedef struct compat_sigaltstack {
+ compat_size_t ss_size;
+ } compat_stack_t;
+ #endif
++#ifndef COMPAT_MINSIGSTKSZ
++#define COMPAT_MINSIGSTKSZ MINSIGSTKSZ
++#endif
+
+ #define compat_jiffies_to_clock_t(x) \
+ (((unsigned long)(x) * COMPAT_USER_HZ) / HZ)
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 897eae8faee1..7b6084854bfe 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -1428,6 +1428,9 @@ struct super_block {
+ /* Number of inodes with nlink == 0 but still referenced */
+ atomic_long_t s_remove_count;
+
++ /* Pending fsnotify inode refs */
++ atomic_long_t s_fsnotify_inode_refs;
++
+ /* Being remounted read-only */
+ int s_readonly_remount;
+
+diff --git a/include/linux/hdmi.h b/include/linux/hdmi.h
+index d271ff23984f..4f3febc0f971 100644
+--- a/include/linux/hdmi.h
++++ b/include/linux/hdmi.h
+@@ -101,8 +101,8 @@ enum hdmi_extended_colorimetry {
+ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601,
+ HDMI_EXTENDED_COLORIMETRY_XV_YCC_709,
+ HDMI_EXTENDED_COLORIMETRY_S_YCC_601,
+- HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601,
+- HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB,
++ HDMI_EXTENDED_COLORIMETRY_OPYCC_601,
++ HDMI_EXTENDED_COLORIMETRY_OPRGB,
+
+ /* The following EC values are only defined in CEA-861-F. */
+ HDMI_EXTENDED_COLORIMETRY_BT2020_CONST_LUM,
+diff --git a/include/linux/nvme.h b/include/linux/nvme.h
+index 68e91ef5494c..818dbe9331be 100644
+--- a/include/linux/nvme.h
++++ b/include/linux/nvme.h
+@@ -1241,6 +1241,7 @@ enum {
+ NVME_SC_ANA_PERSISTENT_LOSS = 0x301,
+ NVME_SC_ANA_INACCESSIBLE = 0x302,
+ NVME_SC_ANA_TRANSITION = 0x303,
++ NVME_SC_HOST_PATH_ERROR = 0x370,
+
+ NVME_SC_DNR = 0x4000,
+ };
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index 3d4cd5db30a9..e4d01469ed60 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -36,7 +36,7 @@ enum siginfo_layout {
+ SIL_SYS,
+ };
+
+-enum siginfo_layout siginfo_layout(int sig, int si_code);
++enum siginfo_layout siginfo_layout(unsigned sig, int si_code);
+
+ /*
+ * Define some primitives to manipulate sigset_t.
+diff --git a/include/linux/tc.h b/include/linux/tc.h
+index f92511e57cdb..a60639f37963 100644
+--- a/include/linux/tc.h
++++ b/include/linux/tc.h
+@@ -84,6 +84,7 @@ struct tc_dev {
+ device. */
+ struct device dev; /* Generic device interface. */
+ struct resource resource; /* Address space of this device. */
++ u64 dma_mask; /* DMA addressable range. */
+ char vendor[9];
+ char name[9];
+ char firmware[9];
+diff --git a/include/linux/wait.h b/include/linux/wait.h
+index d9f131ecf708..ed7c122cb31f 100644
+--- a/include/linux/wait.h
++++ b/include/linux/wait.h
+@@ -1052,10 +1052,9 @@ do { \
+ __ret; \
+ })
+
+-#define __wait_event_interruptible_lock_irq_timeout(wq_head, condition, \
+- lock, timeout) \
++#define __wait_event_lock_irq_timeout(wq_head, condition, lock, timeout, state) \
+ ___wait_event(wq_head, ___wait_cond_timeout(condition), \
+- TASK_INTERRUPTIBLE, 0, timeout, \
++ state, 0, timeout, \
+ spin_unlock_irq(&lock); \
+ __ret = schedule_timeout(__ret); \
+ spin_lock_irq(&lock));
+@@ -1089,8 +1088,19 @@ do { \
+ ({ \
+ long __ret = timeout; \
+ if (!___wait_cond_timeout(condition)) \
+- __ret = __wait_event_interruptible_lock_irq_timeout( \
+- wq_head, condition, lock, timeout); \
++ __ret = __wait_event_lock_irq_timeout( \
++ wq_head, condition, lock, timeout, \
++ TASK_INTERRUPTIBLE); \
++ __ret; \
++})
++
++#define wait_event_lock_irq_timeout(wq_head, condition, lock, timeout) \
++({ \
++ long __ret = timeout; \
++ if (!___wait_cond_timeout(condition)) \
++ __ret = __wait_event_lock_irq_timeout( \
++ wq_head, condition, lock, timeout, \
++ TASK_UNINTERRUPTIBLE); \
+ __ret; \
+ })
+
+diff --git a/include/media/cec.h b/include/media/cec.h
+index ff9847f7f99d..9b7394a74dca 100644
+--- a/include/media/cec.h
++++ b/include/media/cec.h
+@@ -63,7 +63,6 @@ struct cec_data {
+ struct delayed_work work;
+ struct completion c;
+ u8 attempts;
+- bool new_initiator;
+ bool blocking;
+ bool completed;
+ };
+@@ -174,6 +173,7 @@ struct cec_adapter {
+ bool is_configuring;
+ bool is_configured;
+ bool cec_pin_is_high;
++ u8 last_initiator;
+ u32 monitor_all_cnt;
+ u32 monitor_pin_cnt;
+ u32 follower_cnt;
+@@ -461,4 +461,74 @@ static inline void cec_phys_addr_invalidate(struct cec_adapter *adap)
+ cec_s_phys_addr(adap, CEC_PHYS_ADDR_INVALID, false);
+ }
+
++/**
++ * cec_get_edid_spa_location() - find location of the Source Physical Address
++ *
++ * @edid: the EDID
++ * @size: the size of the EDID
++ *
++ * This EDID is expected to be a CEA-861 compliant, which means that there are
++ * at least two blocks and one or more of the extensions blocks are CEA-861
++ * blocks.
++ *
++ * The returned location is guaranteed to be <= size-2.
++ *
++ * This is an inline function since it is used by both CEC and V4L2.
++ * Ideally this would go in a module shared by both, but it is overkill to do
++ * that for just a single function.
++ */
++static inline unsigned int cec_get_edid_spa_location(const u8 *edid,
++ unsigned int size)
++{
++ unsigned int blocks = size / 128;
++ unsigned int block;
++ u8 d;
++
++ /* Sanity check: at least 2 blocks and a multiple of the block size */
++ if (blocks < 2 || size % 128)
++ return 0;
++
++ /*
++ * If there are fewer extension blocks than the size, then update
++ * 'blocks'. It is allowed to have more extension blocks than the size,
++ * since some hardware can only read e.g. 256 bytes of the EDID, even
++ * though more blocks are present. The first CEA-861 extension block
++ * should normally be in block 1 anyway.
++ */
++ if (edid[0x7e] + 1 < blocks)
++ blocks = edid[0x7e] + 1;
++
++ for (block = 1; block < blocks; block++) {
++ unsigned int offset = block * 128;
++
++ /* Skip any non-CEA-861 extension blocks */
++ if (edid[offset] != 0x02 || edid[offset + 1] != 0x03)
++ continue;
++
++ /* search Vendor Specific Data Block (tag 3) */
++ d = edid[offset + 2] & 0x7f;
++ /* Check if there are Data Blocks */
++ if (d <= 4)
++ continue;
++ if (d > 4) {
++ unsigned int i = offset + 4;
++ unsigned int end = offset + d;
++
++ /* Note: 'end' is always < 'size' */
++ do {
++ u8 tag = edid[i] >> 5;
++ u8 len = edid[i] & 0x1f;
++
++ if (tag == 3 && len >= 5 && i + len <= end &&
++ edid[i + 1] == 0x03 &&
++ edid[i + 2] == 0x0c &&
++ edid[i + 3] == 0x00)
++ return i + 4;
++ i += len + 1;
++ } while (i < end);
++ }
++ }
++ return 0;
++}
++
+ #endif /* _MEDIA_CEC_H */
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index e950c2a68f06..ec299fcf55f7 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -1278,21 +1278,27 @@ struct ib_qp_attr {
+ };
+
+ enum ib_wr_opcode {
+- IB_WR_RDMA_WRITE,
+- IB_WR_RDMA_WRITE_WITH_IMM,
+- IB_WR_SEND,
+- IB_WR_SEND_WITH_IMM,
+- IB_WR_RDMA_READ,
+- IB_WR_ATOMIC_CMP_AND_SWP,
+- IB_WR_ATOMIC_FETCH_AND_ADD,
+- IB_WR_LSO,
+- IB_WR_SEND_WITH_INV,
+- IB_WR_RDMA_READ_WITH_INV,
+- IB_WR_LOCAL_INV,
+- IB_WR_REG_MR,
+- IB_WR_MASKED_ATOMIC_CMP_AND_SWP,
+- IB_WR_MASKED_ATOMIC_FETCH_AND_ADD,
++ /* These are shared with userspace */
++ IB_WR_RDMA_WRITE = IB_UVERBS_WR_RDMA_WRITE,
++ IB_WR_RDMA_WRITE_WITH_IMM = IB_UVERBS_WR_RDMA_WRITE_WITH_IMM,
++ IB_WR_SEND = IB_UVERBS_WR_SEND,
++ IB_WR_SEND_WITH_IMM = IB_UVERBS_WR_SEND_WITH_IMM,
++ IB_WR_RDMA_READ = IB_UVERBS_WR_RDMA_READ,
++ IB_WR_ATOMIC_CMP_AND_SWP = IB_UVERBS_WR_ATOMIC_CMP_AND_SWP,
++ IB_WR_ATOMIC_FETCH_AND_ADD = IB_UVERBS_WR_ATOMIC_FETCH_AND_ADD,
++ IB_WR_LSO = IB_UVERBS_WR_TSO,
++ IB_WR_SEND_WITH_INV = IB_UVERBS_WR_SEND_WITH_INV,
++ IB_WR_RDMA_READ_WITH_INV = IB_UVERBS_WR_RDMA_READ_WITH_INV,
++ IB_WR_LOCAL_INV = IB_UVERBS_WR_LOCAL_INV,
++ IB_WR_MASKED_ATOMIC_CMP_AND_SWP =
++ IB_UVERBS_WR_MASKED_ATOMIC_CMP_AND_SWP,
++ IB_WR_MASKED_ATOMIC_FETCH_AND_ADD =
++ IB_UVERBS_WR_MASKED_ATOMIC_FETCH_AND_ADD,
++
++ /* These are kernel only and can not be issued by userspace */
++ IB_WR_REG_MR = 0x20,
+ IB_WR_REG_SIG_MR,
++
+ /* reserve values for low level drivers' internal use.
+ * These values will not be used at all in the ib core layer.
+ */
+diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h
+index 097fcd812471..3094af68b6e7 100644
+--- a/include/uapi/linux/cec.h
++++ b/include/uapi/linux/cec.h
+@@ -152,10 +152,13 @@ static inline void cec_msg_set_reply_to(struct cec_msg *msg,
+ #define CEC_TX_STATUS_LOW_DRIVE (1 << 3)
+ #define CEC_TX_STATUS_ERROR (1 << 4)
+ #define CEC_TX_STATUS_MAX_RETRIES (1 << 5)
++#define CEC_TX_STATUS_ABORTED (1 << 6)
++#define CEC_TX_STATUS_TIMEOUT (1 << 7)
+
+ #define CEC_RX_STATUS_OK (1 << 0)
+ #define CEC_RX_STATUS_TIMEOUT (1 << 1)
+ #define CEC_RX_STATUS_FEATURE_ABORT (1 << 2)
++#define CEC_RX_STATUS_ABORTED (1 << 3)
+
+ static inline int cec_msg_status_is_ok(const struct cec_msg *msg)
+ {
+diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h
+index 73e01918f996..a441ea1bfe6d 100644
+--- a/include/uapi/linux/fs.h
++++ b/include/uapi/linux/fs.h
+@@ -279,8 +279,8 @@ struct fsxattr {
+ #define FS_ENCRYPTION_MODE_AES_256_CTS 4
+ #define FS_ENCRYPTION_MODE_AES_128_CBC 5
+ #define FS_ENCRYPTION_MODE_AES_128_CTS 6
+-#define FS_ENCRYPTION_MODE_SPECK128_256_XTS 7
+-#define FS_ENCRYPTION_MODE_SPECK128_256_CTS 8
++#define FS_ENCRYPTION_MODE_SPECK128_256_XTS 7 /* Removed, do not use. */
++#define FS_ENCRYPTION_MODE_SPECK128_256_CTS 8 /* Removed, do not use. */
+
+ struct fscrypt_policy {
+ __u8 version;
+diff --git a/include/uapi/linux/ndctl.h b/include/uapi/linux/ndctl.h
+index 7e27070b9440..2f2c43d633c5 100644
+--- a/include/uapi/linux/ndctl.h
++++ b/include/uapi/linux/ndctl.h
+@@ -128,37 +128,31 @@ enum {
+
+ static inline const char *nvdimm_bus_cmd_name(unsigned cmd)
+ {
+- static const char * const names[] = {
+- [ND_CMD_ARS_CAP] = "ars_cap",
+- [ND_CMD_ARS_START] = "ars_start",
+- [ND_CMD_ARS_STATUS] = "ars_status",
+- [ND_CMD_CLEAR_ERROR] = "clear_error",
+- [ND_CMD_CALL] = "cmd_call",
+- };
+-
+- if (cmd < ARRAY_SIZE(names) && names[cmd])
+- return names[cmd];
+- return "unknown";
++ switch (cmd) {
++ case ND_CMD_ARS_CAP: return "ars_cap";
++ case ND_CMD_ARS_START: return "ars_start";
++ case ND_CMD_ARS_STATUS: return "ars_status";
++ case ND_CMD_CLEAR_ERROR: return "clear_error";
++ case ND_CMD_CALL: return "cmd_call";
++ default: return "unknown";
++ }
+ }
+
+ static inline const char *nvdimm_cmd_name(unsigned cmd)
+ {
+- static const char * const names[] = {
+- [ND_CMD_SMART] = "smart",
+- [ND_CMD_SMART_THRESHOLD] = "smart_thresh",
+- [ND_CMD_DIMM_FLAGS] = "flags",
+- [ND_CMD_GET_CONFIG_SIZE] = "get_size",
+- [ND_CMD_GET_CONFIG_DATA] = "get_data",
+- [ND_CMD_SET_CONFIG_DATA] = "set_data",
+- [ND_CMD_VENDOR_EFFECT_LOG_SIZE] = "effect_size",
+- [ND_CMD_VENDOR_EFFECT_LOG] = "effect_log",
+- [ND_CMD_VENDOR] = "vendor",
+- [ND_CMD_CALL] = "cmd_call",
+- };
+-
+- if (cmd < ARRAY_SIZE(names) && names[cmd])
+- return names[cmd];
+- return "unknown";
++ switch (cmd) {
++ case ND_CMD_SMART: return "smart";
++ case ND_CMD_SMART_THRESHOLD: return "smart_thresh";
++ case ND_CMD_DIMM_FLAGS: return "flags";
++ case ND_CMD_GET_CONFIG_SIZE: return "get_size";
++ case ND_CMD_GET_CONFIG_DATA: return "get_data";
++ case ND_CMD_SET_CONFIG_DATA: return "set_data";
++ case ND_CMD_VENDOR_EFFECT_LOG_SIZE: return "effect_size";
++ case ND_CMD_VENDOR_EFFECT_LOG: return "effect_log";
++ case ND_CMD_VENDOR: return "vendor";
++ case ND_CMD_CALL: return "cmd_call";
++ default: return "unknown";
++ }
+ }
+
+ #define ND_IOCTL 'N'
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index 5d1a3685bea9..1aae2e4b8f10 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -225,8 +225,8 @@ enum v4l2_colorspace {
+ /* For RGB colorspaces such as produces by most webcams. */
+ V4L2_COLORSPACE_SRGB = 8,
+
+- /* AdobeRGB colorspace */
+- V4L2_COLORSPACE_ADOBERGB = 9,
++ /* opRGB colorspace */
++ V4L2_COLORSPACE_OPRGB = 9,
+
+ /* BT.2020 colorspace, used for UHDTV. */
+ V4L2_COLORSPACE_BT2020 = 10,
+@@ -258,7 +258,7 @@ enum v4l2_xfer_func {
+ *
+ * V4L2_COLORSPACE_SRGB, V4L2_COLORSPACE_JPEG: V4L2_XFER_FUNC_SRGB
+ *
+- * V4L2_COLORSPACE_ADOBERGB: V4L2_XFER_FUNC_ADOBERGB
++ * V4L2_COLORSPACE_OPRGB: V4L2_XFER_FUNC_OPRGB
+ *
+ * V4L2_COLORSPACE_SMPTE240M: V4L2_XFER_FUNC_SMPTE240M
+ *
+@@ -269,7 +269,7 @@ enum v4l2_xfer_func {
+ V4L2_XFER_FUNC_DEFAULT = 0,
+ V4L2_XFER_FUNC_709 = 1,
+ V4L2_XFER_FUNC_SRGB = 2,
+- V4L2_XFER_FUNC_ADOBERGB = 3,
++ V4L2_XFER_FUNC_OPRGB = 3,
+ V4L2_XFER_FUNC_SMPTE240M = 4,
+ V4L2_XFER_FUNC_NONE = 5,
+ V4L2_XFER_FUNC_DCI_P3 = 6,
+@@ -281,7 +281,7 @@ enum v4l2_xfer_func {
+ * This depends on the colorspace.
+ */
+ #define V4L2_MAP_XFER_FUNC_DEFAULT(colsp) \
+- ((colsp) == V4L2_COLORSPACE_ADOBERGB ? V4L2_XFER_FUNC_ADOBERGB : \
++ ((colsp) == V4L2_COLORSPACE_OPRGB ? V4L2_XFER_FUNC_OPRGB : \
+ ((colsp) == V4L2_COLORSPACE_SMPTE240M ? V4L2_XFER_FUNC_SMPTE240M : \
+ ((colsp) == V4L2_COLORSPACE_DCI_P3 ? V4L2_XFER_FUNC_DCI_P3 : \
+ ((colsp) == V4L2_COLORSPACE_RAW ? V4L2_XFER_FUNC_NONE : \
+@@ -295,7 +295,7 @@ enum v4l2_ycbcr_encoding {
+ *
+ * V4L2_COLORSPACE_SMPTE170M, V4L2_COLORSPACE_470_SYSTEM_M,
+ * V4L2_COLORSPACE_470_SYSTEM_BG, V4L2_COLORSPACE_SRGB,
+- * V4L2_COLORSPACE_ADOBERGB and V4L2_COLORSPACE_JPEG: V4L2_YCBCR_ENC_601
++ * V4L2_COLORSPACE_OPRGB and V4L2_COLORSPACE_JPEG: V4L2_YCBCR_ENC_601
+ *
+ * V4L2_COLORSPACE_REC709 and V4L2_COLORSPACE_DCI_P3: V4L2_YCBCR_ENC_709
+ *
+@@ -382,6 +382,17 @@ enum v4l2_quantization {
+ (((is_rgb_or_hsv) || (colsp) == V4L2_COLORSPACE_JPEG) ? \
+ V4L2_QUANTIZATION_FULL_RANGE : V4L2_QUANTIZATION_LIM_RANGE))
+
++/*
++ * Deprecated names for opRGB colorspace (IEC 61966-2-5)
++ *
++ * WARNING: Please don't use these deprecated defines in your code, as
++ * there is a chance we have to remove them in the future.
++ */
++#ifndef __KERNEL__
++#define V4L2_COLORSPACE_ADOBERGB V4L2_COLORSPACE_OPRGB
++#define V4L2_XFER_FUNC_ADOBERGB V4L2_XFER_FUNC_OPRGB
++#endif
++
+ enum v4l2_priority {
+ V4L2_PRIORITY_UNSET = 0, /* not initialized */
+ V4L2_PRIORITY_BACKGROUND = 1,
+diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
+index 25a16760de2a..1254b51a551a 100644
+--- a/include/uapi/rdma/ib_user_verbs.h
++++ b/include/uapi/rdma/ib_user_verbs.h
+@@ -763,10 +763,28 @@ struct ib_uverbs_sge {
+ __u32 lkey;
+ };
+
++enum ib_uverbs_wr_opcode {
++ IB_UVERBS_WR_RDMA_WRITE = 0,
++ IB_UVERBS_WR_RDMA_WRITE_WITH_IMM = 1,
++ IB_UVERBS_WR_SEND = 2,
++ IB_UVERBS_WR_SEND_WITH_IMM = 3,
++ IB_UVERBS_WR_RDMA_READ = 4,
++ IB_UVERBS_WR_ATOMIC_CMP_AND_SWP = 5,
++ IB_UVERBS_WR_ATOMIC_FETCH_AND_ADD = 6,
++ IB_UVERBS_WR_LOCAL_INV = 7,
++ IB_UVERBS_WR_BIND_MW = 8,
++ IB_UVERBS_WR_SEND_WITH_INV = 9,
++ IB_UVERBS_WR_TSO = 10,
++ IB_UVERBS_WR_RDMA_READ_WITH_INV = 11,
++ IB_UVERBS_WR_MASKED_ATOMIC_CMP_AND_SWP = 12,
++ IB_UVERBS_WR_MASKED_ATOMIC_FETCH_AND_ADD = 13,
++ /* Review enum ib_wr_opcode before modifying this */
++};
++
+ struct ib_uverbs_send_wr {
+ __aligned_u64 wr_id;
+ __u32 num_sge;
+- __u32 opcode;
++ __u32 opcode; /* see enum ib_uverbs_wr_opcode */
+ __u32 send_flags;
+ union {
+ __be32 imm_data;
+diff --git a/kernel/bounds.c b/kernel/bounds.c
+index c373e887c066..9795d75b09b2 100644
+--- a/kernel/bounds.c
++++ b/kernel/bounds.c
+@@ -13,7 +13,7 @@
+ #include <linux/log2.h>
+ #include <linux/spinlock_types.h>
+
+-void foo(void)
++int main(void)
+ {
+ /* The enum constants to put into include/generated/bounds.h */
+ DEFINE(NR_PAGEFLAGS, __NR_PAGEFLAGS);
+@@ -23,4 +23,6 @@ void foo(void)
+ #endif
+ DEFINE(SPINLOCK_SIZE, sizeof(spinlock_t));
+ /* End of constants */
++
++ return 0;
+ }
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 8339d81cba1d..675eb6d36e47 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -741,6 +741,17 @@ err_put:
+ return err;
+ }
+
++static void maybe_wait_bpf_programs(struct bpf_map *map)
++{
++ /* Wait for any running BPF programs to complete so that
++ * userspace, when we return to it, knows that all programs
++ * that could be running use the new map value.
++ */
++ if (map->map_type == BPF_MAP_TYPE_HASH_OF_MAPS ||
++ map->map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS)
++ synchronize_rcu();
++}
++
+ #define BPF_MAP_UPDATE_ELEM_LAST_FIELD flags
+
+ static int map_update_elem(union bpf_attr *attr)
+@@ -831,6 +842,7 @@ static int map_update_elem(union bpf_attr *attr)
+ }
+ __this_cpu_dec(bpf_prog_active);
+ preempt_enable();
++ maybe_wait_bpf_programs(map);
+ out:
+ free_value:
+ kfree(value);
+@@ -883,6 +895,7 @@ static int map_delete_elem(union bpf_attr *attr)
+ rcu_read_unlock();
+ __this_cpu_dec(bpf_prog_active);
+ preempt_enable();
++ maybe_wait_bpf_programs(map);
+ out:
+ kfree(key);
+ err_put:
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 465952a8e465..5780876ac81a 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -553,7 +553,9 @@ static void __mark_reg_not_init(struct bpf_reg_state *reg);
+ */
+ static void __mark_reg_known(struct bpf_reg_state *reg, u64 imm)
+ {
+- reg->id = 0;
++ /* Clear id, off, and union(map_ptr, range) */
++ memset(((u8 *)reg) + sizeof(reg->type), 0,
++ offsetof(struct bpf_reg_state, var_off) - sizeof(reg->type));
+ reg->var_off = tnum_const(imm);
+ reg->smin_value = (s64)imm;
+ reg->smax_value = (s64)imm;
+@@ -572,7 +574,6 @@ static void __mark_reg_known_zero(struct bpf_reg_state *reg)
+ static void __mark_reg_const_zero(struct bpf_reg_state *reg)
+ {
+ __mark_reg_known(reg, 0);
+- reg->off = 0;
+ reg->type = SCALAR_VALUE;
+ }
+
+@@ -683,9 +684,12 @@ static void __mark_reg_unbounded(struct bpf_reg_state *reg)
+ /* Mark a register as having a completely unknown (scalar) value. */
+ static void __mark_reg_unknown(struct bpf_reg_state *reg)
+ {
++ /*
++ * Clear type, id, off, and union(map_ptr, range) and
++ * padding between 'type' and union
++ */
++ memset(reg, 0, offsetof(struct bpf_reg_state, var_off));
+ reg->type = SCALAR_VALUE;
+- reg->id = 0;
+- reg->off = 0;
+ reg->var_off = tnum_unknown;
+ reg->frameno = 0;
+ __mark_reg_unbounded(reg);
+@@ -1727,9 +1731,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
+ else
+ mark_reg_known_zero(env, regs,
+ value_regno);
+- regs[value_regno].id = 0;
+- regs[value_regno].off = 0;
+- regs[value_regno].range = 0;
+ regs[value_regno].type = reg_type;
+ }
+
+@@ -2580,7 +2581,6 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
+ regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL;
+ /* There is no offset yet applied, variable or fixed */
+ mark_reg_known_zero(env, regs, BPF_REG_0);
+- regs[BPF_REG_0].off = 0;
+ /* remember map_ptr, so that check_map_access()
+ * can check 'value_size' boundary of memory access
+ * to map element returned from bpf_map_lookup_elem()
+@@ -2762,7 +2762,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ dst_reg->umax_value = umax_ptr;
+ dst_reg->var_off = ptr_reg->var_off;
+ dst_reg->off = ptr_reg->off + smin_val;
+- dst_reg->range = ptr_reg->range;
++ dst_reg->raw = ptr_reg->raw;
+ break;
+ }
+ /* A new variable offset is created. Note that off_reg->off
+@@ -2792,10 +2792,11 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ }
+ dst_reg->var_off = tnum_add(ptr_reg->var_off, off_reg->var_off);
+ dst_reg->off = ptr_reg->off;
++ dst_reg->raw = ptr_reg->raw;
+ if (reg_is_pkt_pointer(ptr_reg)) {
+ dst_reg->id = ++env->id_gen;
+ /* something was added to pkt_ptr, set range to zero */
+- dst_reg->range = 0;
++ dst_reg->raw = 0;
+ }
+ break;
+ case BPF_SUB:
+@@ -2824,7 +2825,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ dst_reg->var_off = ptr_reg->var_off;
+ dst_reg->id = ptr_reg->id;
+ dst_reg->off = ptr_reg->off - smin_val;
+- dst_reg->range = ptr_reg->range;
++ dst_reg->raw = ptr_reg->raw;
+ break;
+ }
+ /* A new variable offset is created. If the subtrahend is known
+@@ -2850,11 +2851,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ }
+ dst_reg->var_off = tnum_sub(ptr_reg->var_off, off_reg->var_off);
+ dst_reg->off = ptr_reg->off;
++ dst_reg->raw = ptr_reg->raw;
+ if (reg_is_pkt_pointer(ptr_reg)) {
+ dst_reg->id = ++env->id_gen;
+ /* something was added to pkt_ptr, set range to zero */
+ if (smin_val < 0)
+- dst_reg->range = 0;
++ dst_reg->raw = 0;
+ }
+ break;
+ case BPF_AND:
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 0097acec1c71..3adecda21444 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2026,6 +2026,12 @@ static void cpuhp_online_cpu_device(unsigned int cpu)
+ kobject_uevent(&dev->kobj, KOBJ_ONLINE);
+ }
+
++/*
++ * Architectures that need SMT-specific errata handling during SMT hotplug
++ * should override this.
++ */
++void __weak arch_smt_update(void) { };
++
+ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ {
+ int cpu, ret = 0;
+@@ -2052,8 +2058,10 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ */
+ cpuhp_offline_cpu_device(cpu);
+ }
+- if (!ret)
++ if (!ret) {
+ cpu_smt_control = ctrlval;
++ arch_smt_update();
++ }
+ cpu_maps_update_done();
+ return ret;
+ }
+@@ -2064,6 +2072,7 @@ static int cpuhp_smt_enable(void)
+
+ cpu_maps_update_begin();
+ cpu_smt_control = CPU_SMT_ENABLED;
++ arch_smt_update();
+ for_each_present_cpu(cpu) {
+ /* Skip online CPUs and CPUs on offline nodes */
+ if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
+diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c
+index 286d82329eb0..b2a87905846d 100644
+--- a/kernel/dma/contiguous.c
++++ b/kernel/dma/contiguous.c
+@@ -49,7 +49,11 @@ static phys_addr_t limit_cmdline;
+
+ static int __init early_cma(char *p)
+ {
+- pr_debug("%s(%s)\n", __func__, p);
++ if (!p) {
++ pr_err("Config string not provided\n");
++ return -EINVAL;
++ }
++
+ size_cmdline = memparse(p, &p);
+ if (*p != '@')
+ return 0;
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index fb86146037a7..9dbdccab3b6a 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -927,6 +927,9 @@ irq_forced_thread_fn(struct irq_desc *desc, struct irqaction *action)
+
+ local_bh_disable();
+ ret = action->thread_fn(action->irq, action->dev_id);
++ if (ret == IRQ_HANDLED)
++ atomic_inc(&desc->threads_handled);
++
+ irq_finalize_oneshot(desc, action);
+ local_bh_enable();
+ return ret;
+@@ -943,6 +946,9 @@ static irqreturn_t irq_thread_fn(struct irq_desc *desc,
+ irqreturn_t ret;
+
+ ret = action->thread_fn(action->irq, action->dev_id);
++ if (ret == IRQ_HANDLED)
++ atomic_inc(&desc->threads_handled);
++
+ irq_finalize_oneshot(desc, action);
+ return ret;
+ }
+@@ -1020,8 +1026,6 @@ static int irq_thread(void *data)
+ irq_thread_check_affinity(desc, action);
+
+ action_ret = handler_fn(desc, action);
+- if (action_ret == IRQ_HANDLED)
+- atomic_inc(&desc->threads_handled);
+ if (action_ret == IRQ_WAKE_THREAD)
+ irq_wake_secondary(desc, action);
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index ab257be4d924..4344381664cc 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -700,9 +700,10 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)
+ }
+
+ /* Cancel unoptimizing for reusing */
+-static void reuse_unused_kprobe(struct kprobe *ap)
++static int reuse_unused_kprobe(struct kprobe *ap)
+ {
+ struct optimized_kprobe *op;
++ int ret;
+
+ BUG_ON(!kprobe_unused(ap));
+ /*
+@@ -714,8 +715,12 @@ static void reuse_unused_kprobe(struct kprobe *ap)
+ /* Enable the probe again */
+ ap->flags &= ~KPROBE_FLAG_DISABLED;
+ /* Optimize it again (remove from op->list) */
+- BUG_ON(!kprobe_optready(ap));
++ ret = kprobe_optready(ap);
++ if (ret)
++ return ret;
++
+ optimize_kprobe(ap);
++ return 0;
+ }
+
+ /* Remove optimized instructions */
+@@ -940,11 +945,16 @@ static void __disarm_kprobe(struct kprobe *p, bool reopt)
+ #define kprobe_disarmed(p) kprobe_disabled(p)
+ #define wait_for_kprobe_optimizer() do {} while (0)
+
+-/* There should be no unused kprobes can be reused without optimization */
+-static void reuse_unused_kprobe(struct kprobe *ap)
++static int reuse_unused_kprobe(struct kprobe *ap)
+ {
++ /*
++ * If the optimized kprobe is NOT supported, the aggr kprobe is
++ * released at the same time that the last aggregated kprobe is
++ * unregistered.
++ * Thus there should be no chance to reuse unused kprobe.
++ */
+ printk(KERN_ERR "Error: There should be no unused kprobe here.\n");
+- BUG_ON(kprobe_unused(ap));
++ return -EINVAL;
+ }
+
+ static void free_aggr_kprobe(struct kprobe *p)
+@@ -1318,9 +1328,12 @@ static int register_aggr_kprobe(struct kprobe *orig_p, struct kprobe *p)
+ goto out;
+ }
+ init_aggr_kprobe(ap, orig_p);
+- } else if (kprobe_unused(ap))
++ } else if (kprobe_unused(ap)) {
+ /* This probe is going to die. Rescue it */
+- reuse_unused_kprobe(ap);
++ ret = reuse_unused_kprobe(ap);
++ if (ret)
++ goto out;
++ }
+
+ if (kprobe_gone(ap)) {
+ /*
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index dd13f865ad40..26b57e24476f 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -4122,7 +4122,7 @@ void lock_contended(struct lockdep_map *lock, unsigned long ip)
+ {
+ unsigned long flags;
+
+- if (unlikely(!lock_stat))
++ if (unlikely(!lock_stat || !debug_locks))
+ return;
+
+ if (unlikely(current->lockdep_recursion))
+@@ -4142,7 +4142,7 @@ void lock_acquired(struct lockdep_map *lock, unsigned long ip)
+ {
+ unsigned long flags;
+
+- if (unlikely(!lock_stat))
++ if (unlikely(!lock_stat || !debug_locks))
+ return;
+
+ if (unlikely(current->lockdep_recursion))
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 9bf5404397e0..06045abd1887 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -1048,7 +1048,12 @@ static void __init log_buf_len_update(unsigned size)
+ /* save requested log_buf_len since it's too early to process it */
+ static int __init log_buf_len_setup(char *str)
+ {
+- unsigned size = memparse(str, &str);
++ unsigned int size;
++
++ if (!str)
++ return -EINVAL;
++
++ size = memparse(str, &str);
+
+ log_buf_len_update(size);
+
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 5843c541fda9..edc28afc9fb4 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -1035,7 +1035,7 @@ static int __send_signal(int sig, struct siginfo *info, struct task_struct *t,
+
+ result = TRACE_SIGNAL_IGNORED;
+ if (!prepare_signal(sig, t,
+- from_ancestor_ns || (info == SEND_SIG_FORCED)))
++ from_ancestor_ns || (info == SEND_SIG_PRIV) || (info == SEND_SIG_FORCED)))
+ goto ret;
+
+ pending = (type != PIDTYPE_PID) ? &t->signal->shared_pending : &t->pending;
+@@ -2847,7 +2847,7 @@ COMPAT_SYSCALL_DEFINE2(rt_sigpending, compat_sigset_t __user *, uset,
+ }
+ #endif
+
+-enum siginfo_layout siginfo_layout(int sig, int si_code)
++enum siginfo_layout siginfo_layout(unsigned sig, int si_code)
+ {
+ enum siginfo_layout layout = SIL_KILL;
+ if ((si_code > SI_USER) && (si_code < SI_KERNEL)) {
+@@ -3460,7 +3460,8 @@ int do_sigaction(int sig, struct k_sigaction *act, struct k_sigaction *oact)
+ }
+
+ static int
+-do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp)
++do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp,
++ size_t min_ss_size)
+ {
+ struct task_struct *t = current;
+
+@@ -3490,7 +3491,7 @@ do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp)
+ ss_size = 0;
+ ss_sp = NULL;
+ } else {
+- if (unlikely(ss_size < MINSIGSTKSZ))
++ if (unlikely(ss_size < min_ss_size))
+ return -ENOMEM;
+ }
+
+@@ -3508,7 +3509,8 @@ SYSCALL_DEFINE2(sigaltstack,const stack_t __user *,uss, stack_t __user *,uoss)
+ if (uss && copy_from_user(&new, uss, sizeof(stack_t)))
+ return -EFAULT;
+ err = do_sigaltstack(uss ? &new : NULL, uoss ? &old : NULL,
+- current_user_stack_pointer());
++ current_user_stack_pointer(),
++ MINSIGSTKSZ);
+ if (!err && uoss && copy_to_user(uoss, &old, sizeof(stack_t)))
+ err = -EFAULT;
+ return err;
+@@ -3519,7 +3521,8 @@ int restore_altstack(const stack_t __user *uss)
+ stack_t new;
+ if (copy_from_user(&new, uss, sizeof(stack_t)))
+ return -EFAULT;
+- (void)do_sigaltstack(&new, NULL, current_user_stack_pointer());
++ (void)do_sigaltstack(&new, NULL, current_user_stack_pointer(),
++ MINSIGSTKSZ);
+ /* squash all but EFAULT for now */
+ return 0;
+ }
+@@ -3553,7 +3556,8 @@ static int do_compat_sigaltstack(const compat_stack_t __user *uss_ptr,
+ uss.ss_size = uss32.ss_size;
+ }
+ ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss,
+- compat_user_stack_pointer());
++ compat_user_stack_pointer(),
++ COMPAT_MINSIGSTKSZ);
+ if (ret >= 0 && uoss_ptr) {
+ compat_stack_t old;
+ memset(&old, 0, sizeof(old));
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index d239004aaf29..eb908ef2ecec 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -1063,8 +1063,10 @@ static int create_synth_event(int argc, char **argv)
+ event = NULL;
+ ret = -EEXIST;
+ goto out;
+- } else if (delete_event)
++ } else if (delete_event) {
++ ret = -ENOENT;
+ goto out;
++ }
+
+ if (argc < 2) {
+ ret = -EINVAL;
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index e5222b5fb4fe..923414a246e9 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -974,10 +974,6 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ if (!new_idmap_permitted(file, ns, cap_setid, &new_map))
+ goto out;
+
+- ret = sort_idmaps(&new_map);
+- if (ret < 0)
+- goto out;
+-
+ ret = -EPERM;
+ /* Map the lower ids from the parent user namespace to the
+ * kernel global id space.
+@@ -1004,6 +1000,14 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ e->lower_first = lower_first;
+ }
+
++ /*
++ * If we want to use binary search for lookup, this clones the extent
++ * array and sorts both copies.
++ */
++ ret = sort_idmaps(&new_map);
++ if (ret < 0)
++ goto out;
++
+ /* Install the map */
+ if (new_map.nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS) {
+ memcpy(map->extent, new_map.extent,
+diff --git a/lib/debug_locks.c b/lib/debug_locks.c
+index 96c4c633d95e..124fdf238b3d 100644
+--- a/lib/debug_locks.c
++++ b/lib/debug_locks.c
+@@ -37,7 +37,7 @@ EXPORT_SYMBOL_GPL(debug_locks_silent);
+ */
+ int debug_locks_off(void)
+ {
+- if (__debug_locks_off()) {
++ if (debug_locks && __debug_locks_off()) {
+ if (!debug_locks_silent) {
+ console_verbose();
+ return 1;
+diff --git a/mm/hmm.c b/mm/hmm.c
+index c968e49f7a0c..90193a7fabce 100644
+--- a/mm/hmm.c
++++ b/mm/hmm.c
+@@ -91,16 +91,6 @@ static struct hmm *hmm_register(struct mm_struct *mm)
+ spin_lock_init(&hmm->lock);
+ hmm->mm = mm;
+
+- /*
+- * We should only get here if hold the mmap_sem in write mode ie on
+- * registration of first mirror through hmm_mirror_register()
+- */
+- hmm->mmu_notifier.ops = &hmm_mmu_notifier_ops;
+- if (__mmu_notifier_register(&hmm->mmu_notifier, mm)) {
+- kfree(hmm);
+- return NULL;
+- }
+-
+ spin_lock(&mm->page_table_lock);
+ if (!mm->hmm)
+ mm->hmm = hmm;
+@@ -108,12 +98,27 @@ static struct hmm *hmm_register(struct mm_struct *mm)
+ cleanup = true;
+ spin_unlock(&mm->page_table_lock);
+
+- if (cleanup) {
+- mmu_notifier_unregister(&hmm->mmu_notifier, mm);
+- kfree(hmm);
+- }
++ if (cleanup)
++ goto error;
++
++ /*
++ * We should only get here if hold the mmap_sem in write mode ie on
++ * registration of first mirror through hmm_mirror_register()
++ */
++ hmm->mmu_notifier.ops = &hmm_mmu_notifier_ops;
++ if (__mmu_notifier_register(&hmm->mmu_notifier, mm))
++ goto error_mm;
+
+ return mm->hmm;
++
++error_mm:
++ spin_lock(&mm->page_table_lock);
++ if (mm->hmm == hmm)
++ mm->hmm = NULL;
++ spin_unlock(&mm->page_table_lock);
++error:
++ kfree(hmm);
++ return NULL;
+ }
+
+ void hmm_mm_destroy(struct mm_struct *mm)
+@@ -278,12 +283,13 @@ void hmm_mirror_unregister(struct hmm_mirror *mirror)
+ if (!should_unregister || mm == NULL)
+ return;
+
++ mmu_notifier_unregister_no_release(&hmm->mmu_notifier, mm);
++
+ spin_lock(&mm->page_table_lock);
+ if (mm->hmm == hmm)
+ mm->hmm = NULL;
+ spin_unlock(&mm->page_table_lock);
+
+- mmu_notifier_unregister_no_release(&hmm->mmu_notifier, mm);
+ kfree(hmm);
+ }
+ EXPORT_SYMBOL(hmm_mirror_unregister);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 5c390f5a5207..7b5c0ad9a6bd 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3690,6 +3690,12 @@ int huge_add_to_page_cache(struct page *page, struct address_space *mapping,
+ return err;
+ ClearPagePrivate(page);
+
++ /*
++ * set page dirty so that it will not be removed from cache/file
++ * by non-hugetlbfs specific code paths.
++ */
++ set_page_dirty(page);
++
+ spin_lock(&inode->i_lock);
+ inode->i_blocks += blocks_per_huge_page(h);
+ spin_unlock(&inode->i_lock);
+diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
+index ae3c2a35d61b..11df03e71288 100644
+--- a/mm/page_vma_mapped.c
++++ b/mm/page_vma_mapped.c
+@@ -21,7 +21,29 @@ static bool map_pte(struct page_vma_mapped_walk *pvmw)
+ if (!is_swap_pte(*pvmw->pte))
+ return false;
+ } else {
+- if (!pte_present(*pvmw->pte))
++ /*
++ * We get here when we are trying to unmap a private
++ * device page from the process address space. Such
++ * page is not CPU accessible and thus is mapped as
++ * a special swap entry, nonetheless it still does
++ * count as a valid regular mapping for the page (and
++ * is accounted as such in page maps count).
++ *
++ * So handle this special case as if it was a normal
++ * page mapping ie lock CPU page table and returns
++ * true.
++ *
++ * For more details on device private memory see HMM
++ * (include/linux/hmm.h or mm/hmm.c).
++ */
++ if (is_swap_pte(*pvmw->pte)) {
++ swp_entry_t entry;
++
++ /* Handle un-addressable ZONE_DEVICE memory */
++ entry = pte_to_swp_entry(*pvmw->pte);
++ if (!is_device_private_entry(entry))
++ return false;
++ } else if (!pte_present(*pvmw->pte))
+ return false;
+ }
+ }
+diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
+index 5e4f04004a49..7bf833598615 100644
+--- a/net/core/netclassid_cgroup.c
++++ b/net/core/netclassid_cgroup.c
+@@ -106,6 +106,7 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft,
+ iterate_fd(p->files, 0, update_classid_sock,
+ (void *)(unsigned long)cs->classid);
+ task_unlock(p);
++ cond_resched();
+ }
+ css_task_iter_end(&it);
+
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index 82178cc69c96..777fa3b7fb13 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -1512,7 +1512,7 @@ static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
+ *
+ * Description:
+ * Parse the packet's IP header looking for a CIPSO option. Returns a pointer
+- * to the start of the CIPSO option on success, NULL if one if not found.
++ * to the start of the CIPSO option on success, NULL if one is not found.
+ *
+ */
+ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+@@ -1522,10 +1522,8 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+ int optlen;
+ int taglen;
+
+- for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
++ for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 1; ) {
+ switch (optptr[0]) {
+- case IPOPT_CIPSO:
+- return optptr;
+ case IPOPT_END:
+ return NULL;
+ case IPOPT_NOOP:
+@@ -1534,6 +1532,11 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+ default:
+ taglen = optptr[1];
+ }
++ if (!taglen || taglen > optlen)
++ return NULL;
++ if (optptr[0] == IPOPT_CIPSO)
++ return optptr;
++
+ optlen -= taglen;
+ optptr += taglen;
+ }
+diff --git a/net/netfilter/xt_nat.c b/net/netfilter/xt_nat.c
+index 8af9707f8789..ac91170fc8c8 100644
+--- a/net/netfilter/xt_nat.c
++++ b/net/netfilter/xt_nat.c
+@@ -216,6 +216,8 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
+ {
+ .name = "DNAT",
+ .revision = 2,
++ .checkentry = xt_nat_checkentry,
++ .destroy = xt_nat_destroy,
+ .target = xt_dnat_target_v2,
+ .targetsize = sizeof(struct nf_nat_range2),
+ .table = "nat",
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 3dc0acf54245..be7cd140b2a3 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1309,7 +1309,6 @@ check_loop_fn(struct Qdisc *q, unsigned long cl, struct qdisc_walker *w)
+
+ const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = {
+ [TCA_KIND] = { .type = NLA_STRING },
+- [TCA_OPTIONS] = { .type = NLA_NESTED },
+ [TCA_RATE] = { .type = NLA_BINARY,
+ .len = sizeof(struct tc_estimator) },
+ [TCA_STAB] = { .type = NLA_NESTED },
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 5185efb9027b..83ccd0221c98 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -989,7 +989,7 @@ static void call_xpt_users(struct svc_xprt *xprt)
+ spin_lock(&xprt->xpt_lock);
+ while (!list_empty(&xprt->xpt_users)) {
+ u = list_first_entry(&xprt->xpt_users, struct svc_xpt_user, list);
+- list_del(&u->list);
++ list_del_init(&u->list);
+ u->callback(u);
+ }
+ spin_unlock(&xprt->xpt_lock);
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+index a68180090554..b9827665ff35 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+@@ -248,6 +248,7 @@ static void
+ xprt_rdma_bc_close(struct rpc_xprt *xprt)
+ {
+ dprintk("svcrdma: %s: xprt %p\n", __func__, xprt);
++ xprt->cwnd = RPC_CWNDSHIFT;
+ }
+
+ static void
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index 143ce2579ba9..98cbc7b060ba 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -468,6 +468,12 @@ xprt_rdma_close(struct rpc_xprt *xprt)
+ xprt->reestablish_timeout = 0;
+ xprt_disconnect_done(xprt);
+ rpcrdma_ep_disconnect(ep, ia);
++
++ /* Prepare @xprt for the next connection by reinitializing
++ * its credit grant to one (see RFC 8166, Section 3.3.3).
++ */
++ r_xprt->rx_buf.rb_credits = 1;
++ xprt->cwnd = RPC_CWNDSHIFT;
+ }
+
+ /**
+diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
+index 7e7e7e7c250a..d9e7728027c6 100644
+--- a/security/integrity/ima/ima_crypto.c
++++ b/security/integrity/ima/ima_crypto.c
+@@ -210,7 +210,7 @@ static int ima_calc_file_hash_atfm(struct file *file,
+ {
+ loff_t i_size, offset;
+ char *rbuf[2] = { NULL, };
+- int rc, read = 0, rbuf_len, active = 0, ahash_rc = 0;
++ int rc, rbuf_len, active = 0, ahash_rc = 0;
+ struct ahash_request *req;
+ struct scatterlist sg[1];
+ struct crypto_wait wait;
+@@ -257,11 +257,6 @@ static int ima_calc_file_hash_atfm(struct file *file,
+ &rbuf_size[1], 0);
+ }
+
+- if (!(file->f_mode & FMODE_READ)) {
+- file->f_mode |= FMODE_READ;
+- read = 1;
+- }
+-
+ for (offset = 0; offset < i_size; offset += rbuf_len) {
+ if (!rbuf[1] && offset) {
+ /* Not using two buffers, and it is not the first
+@@ -300,8 +295,6 @@ static int ima_calc_file_hash_atfm(struct file *file,
+ /* wait for the last update request to complete */
+ rc = ahash_wait(ahash_rc, &wait);
+ out3:
+- if (read)
+- file->f_mode &= ~FMODE_READ;
+ ima_free_pages(rbuf[0], rbuf_size[0]);
+ ima_free_pages(rbuf[1], rbuf_size[1]);
+ out2:
+@@ -336,7 +329,7 @@ static int ima_calc_file_hash_tfm(struct file *file,
+ {
+ loff_t i_size, offset = 0;
+ char *rbuf;
+- int rc, read = 0;
++ int rc;
+ SHASH_DESC_ON_STACK(shash, tfm);
+
+ shash->tfm = tfm;
+@@ -357,11 +350,6 @@ static int ima_calc_file_hash_tfm(struct file *file,
+ if (!rbuf)
+ return -ENOMEM;
+
+- if (!(file->f_mode & FMODE_READ)) {
+- file->f_mode |= FMODE_READ;
+- read = 1;
+- }
+-
+ while (offset < i_size) {
+ int rbuf_len;
+
+@@ -378,8 +366,6 @@ static int ima_calc_file_hash_tfm(struct file *file,
+ if (rc)
+ break;
+ }
+- if (read)
+- file->f_mode &= ~FMODE_READ;
+ kfree(rbuf);
+ out:
+ if (!rc)
+@@ -420,6 +406,8 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ {
+ loff_t i_size;
+ int rc;
++ struct file *f = file;
++ bool new_file_instance = false, modified_flags = false;
+
+ /*
+ * For consistency, fail file's opened with the O_DIRECT flag on
+@@ -431,15 +419,41 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ return -EINVAL;
+ }
+
+- i_size = i_size_read(file_inode(file));
++ /* Open a new file instance in O_RDONLY if we cannot read */
++ if (!(file->f_mode & FMODE_READ)) {
++ int flags = file->f_flags & ~(O_WRONLY | O_APPEND |
++ O_TRUNC | O_CREAT | O_NOCTTY | O_EXCL);
++ flags |= O_RDONLY;
++ f = dentry_open(&file->f_path, flags, file->f_cred);
++ if (IS_ERR(f)) {
++ /*
++ * Cannot open the file again, lets modify f_flags
++ * of original and continue
++ */
++ pr_info_ratelimited("Unable to reopen file for reading.\n");
++ f = file;
++ f->f_flags |= FMODE_READ;
++ modified_flags = true;
++ } else {
++ new_file_instance = true;
++ }
++ }
++
++ i_size = i_size_read(file_inode(f));
+
+ if (ima_ahash_minsize && i_size >= ima_ahash_minsize) {
+- rc = ima_calc_file_ahash(file, hash);
++ rc = ima_calc_file_ahash(f, hash);
+ if (!rc)
+- return 0;
++ goto out;
+ }
+
+- return ima_calc_file_shash(file, hash);
++ rc = ima_calc_file_shash(f, hash);
++out:
++ if (new_file_instance)
++ fput(f);
++ else if (modified_flags)
++ f->f_flags &= ~FMODE_READ;
++ return rc;
+ }
+
+ /*
+diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
+index ae9d5c766a3c..cfb8cc3b975e 100644
+--- a/security/integrity/ima/ima_fs.c
++++ b/security/integrity/ima/ima_fs.c
+@@ -42,14 +42,14 @@ static int __init default_canonical_fmt_setup(char *str)
+ __setup("ima_canonical_fmt", default_canonical_fmt_setup);
+
+ static int valid_policy = 1;
+-#define TMPBUFLEN 12
++
+ static ssize_t ima_show_htable_value(char __user *buf, size_t count,
+ loff_t *ppos, atomic_long_t *val)
+ {
+- char tmpbuf[TMPBUFLEN];
++ char tmpbuf[32]; /* greater than largest 'long' string value */
+ ssize_t len;
+
+- len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
++ len = scnprintf(tmpbuf, sizeof(tmpbuf), "%li\n", atomic_long_read(val));
+ return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
+ }
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index ad9a9b8e9979..18b98b5e1e3c 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1508,6 +1508,11 @@ static int selinux_genfs_get_sid(struct dentry *dentry,
+ }
+ rc = security_genfs_sid(&selinux_state, sb->s_type->name,
+ path, tclass, sid);
++ if (rc == -ENOENT) {
++ /* No match in policy, mark as unlabeled. */
++ *sid = SECINITSID_UNLABELED;
++ rc = 0;
++ }
+ }
+ free_page((unsigned long)buffer);
+ return rc;
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 340fc30ad85d..70d3066e69fe 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -421,6 +421,7 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
+ struct smk_audit_info ad, *saip = NULL;
+ struct task_smack *tsp;
+ struct smack_known *tracer_known;
++ const struct cred *tracercred;
+
+ if ((mode & PTRACE_MODE_NOAUDIT) == 0) {
+ smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK);
+@@ -429,7 +430,8 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
+ }
+
+ rcu_read_lock();
+- tsp = __task_cred(tracer)->security;
++ tracercred = __task_cred(tracer);
++ tsp = tracercred->security;
+ tracer_known = smk_of_task(tsp);
+
+ if ((mode & PTRACE_MODE_ATTACH) &&
+@@ -439,7 +441,7 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
+ rc = 0;
+ else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)
+ rc = -EACCES;
+- else if (capable(CAP_SYS_PTRACE))
++ else if (smack_privileged_cred(CAP_SYS_PTRACE, tracercred))
+ rc = 0;
+ else
+ rc = -EACCES;
+@@ -1841,6 +1843,7 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
+ {
+ struct smack_known *skp;
+ struct smack_known *tkp = smk_of_task(tsk->cred->security);
++ const struct cred *tcred;
+ struct file *file;
+ int rc;
+ struct smk_audit_info ad;
+@@ -1854,8 +1857,12 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
+ skp = file->f_security;
+ rc = smk_access(skp, tkp, MAY_DELIVER, NULL);
+ rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc);
+- if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
++
++ rcu_read_lock();
++ tcred = __task_cred(tsk);
++ if (rc != 0 && smack_privileged_cred(CAP_MAC_OVERRIDE, tcred))
+ rc = 0;
++ rcu_read_unlock();
+
+ smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+ smk_ad_setfield_u_tsk(&ad, tsk);
+diff --git a/sound/pci/ca0106/ca0106.h b/sound/pci/ca0106/ca0106.h
+index 04402c14cb23..9847b669cf3c 100644
+--- a/sound/pci/ca0106/ca0106.h
++++ b/sound/pci/ca0106/ca0106.h
+@@ -582,7 +582,7 @@
+ #define SPI_PL_BIT_R_R (2<<7) /* right channel = right */
+ #define SPI_PL_BIT_R_C (3<<7) /* right channel = (L+R)/2 */
+ #define SPI_IZD_REG 2
+-#define SPI_IZD_BIT (1<<4) /* infinite zero detect */
++#define SPI_IZD_BIT (0<<4) /* infinite zero detect */
+
+ #define SPI_FMT_REG 3
+ #define SPI_FMT_BIT_RJ (0<<0) /* right justified mode */
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index a68e75b00ea3..53c3cd28bc99 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -160,6 +160,7 @@ struct azx {
+ unsigned int msi:1;
+ unsigned int probing:1; /* codec probing phase */
+ unsigned int snoop:1;
++ unsigned int uc_buffer:1; /* non-cached pages for stream buffers */
+ unsigned int align_buffer_size:1;
+ unsigned int region_requested:1;
+ unsigned int disabled:1; /* disabled by vga_switcheroo */
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index aa4c672dbaf7..625cb6c7b7d6 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -412,7 +412,7 @@ static void __mark_pages_wc(struct azx *chip, struct snd_dma_buffer *dmab, bool
+ #ifdef CONFIG_SND_DMA_SGBUF
+ if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG) {
+ struct snd_sg_buf *sgbuf = dmab->private_data;
+- if (chip->driver_type == AZX_DRIVER_CMEDIA)
++ if (!chip->uc_buffer)
+ return; /* deal with only CORB/RIRB buffers */
+ if (on)
+ set_pages_array_wc(sgbuf->page_table, sgbuf->pages);
+@@ -1678,6 +1678,7 @@ static void azx_check_snoop_available(struct azx *chip)
+ dev_info(chip->card->dev, "Force to %s mode by module option\n",
+ snoop ? "snoop" : "non-snoop");
+ chip->snoop = snoop;
++ chip->uc_buffer = !snoop;
+ return;
+ }
+
+@@ -1698,8 +1699,12 @@ static void azx_check_snoop_available(struct azx *chip)
+ snoop = false;
+
+ chip->snoop = snoop;
+- if (!snoop)
++ if (!snoop) {
+ dev_info(chip->card->dev, "Force to non-snoop mode\n");
++ /* C-Media requires non-cached pages only for CORB/RIRB */
++ if (chip->driver_type != AZX_DRIVER_CMEDIA)
++ chip->uc_buffer = true;
++ }
+ }
+
+ static void azx_probe_work(struct work_struct *work)
+@@ -2138,7 +2143,7 @@ static void pcm_mmap_prepare(struct snd_pcm_substream *substream,
+ #ifdef CONFIG_X86
+ struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
+ struct azx *chip = apcm->chip;
+- if (!azx_snoop(chip) && chip->driver_type != AZX_DRIVER_CMEDIA)
++ if (chip->uc_buffer)
+ area->vm_page_prot = pgprot_writecombine(area->vm_page_prot);
+ #endif
+ }
+@@ -2257,8 +2262,12 @@ static struct snd_pci_quirk power_save_blacklist[] = {
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1581607 */
+ SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
++ SND_PCI_QUIRK(0x1028, 0x0497, "Dell Precision T3600", 0),
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+ /* Note the P55A-UD3 and Z87-D3HP share the subsys id for the HDA dev */
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte P55A-UD3 / Z87-D3HP", 0),
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
++ SND_PCI_QUIRK(0x8086, 0x2040, "Intel DZ77BH-55K", 0),
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=199607 */
+ SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index cfd4e4f97f8f..3c5f2a603754 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -943,6 +943,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD),
++ SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 3ac7ba9b342d..1070749c3cf4 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6841,6 +6841,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x1a, 0x02a11040},
+ {0x1b, 0x01014020},
+ {0x21, 0x0221101f}),
++ SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC294_FIXUP_LENOVO_MIC_LOCATION,
++ {0x14, 0x90170110},
++ {0x19, 0x02a11030},
++ {0x1a, 0x02a11040},
++ {0x1b, 0x01011020},
++ {0x21, 0x0221101f}),
+ SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC294_FIXUP_LENOVO_MIC_LOCATION,
+ {0x14, 0x90170110},
+ {0x19, 0x02a11020},
+@@ -7738,6 +7744,8 @@ enum {
+ ALC662_FIXUP_ASUS_Nx50,
+ ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE,
+ ALC668_FIXUP_ASUS_Nx51,
++ ALC668_FIXUP_MIC_COEF,
++ ALC668_FIXUP_ASUS_G751,
+ ALC891_FIXUP_HEADSET_MODE,
+ ALC891_FIXUP_DELL_MIC_NO_PRESENCE,
+ ALC662_FIXUP_ACER_VERITON,
+@@ -8007,6 +8015,23 @@ static const struct hda_fixup alc662_fixups[] = {
+ .chained = true,
+ .chain_id = ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE,
+ },
++ [ALC668_FIXUP_MIC_COEF] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0xc3 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x4000 },
++ {}
++ },
++ },
++ [ALC668_FIXUP_ASUS_G751] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x16, 0x0421101f }, /* HP */
++ {}
++ },
++ .chained = true,
++ .chain_id = ALC668_FIXUP_MIC_COEF
++ },
+ [ALC891_FIXUP_HEADSET_MODE] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_headset_mode,
+@@ -8080,6 +8105,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
+ SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
+ SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
++ SND_PCI_QUIRK(0x1043, 0x12ff, "ASUS G751", ALC668_FIXUP_ASUS_G751),
+ SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
+ SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
+ SND_PCI_QUIRK(0x1043, 0x177d, "ASUS N551", ALC668_FIXUP_ASUS_Nx51),
+diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c
+index 97f49b751e6e..568575b72f2f 100644
+--- a/sound/pci/hda/thinkpad_helper.c
++++ b/sound/pci/hda/thinkpad_helper.c
+@@ -58,8 +58,8 @@ static void hda_fixup_thinkpad_acpi(struct hda_codec *codec,
+ removefunc = false;
+ }
+ if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0 &&
+- snd_hda_gen_add_micmute_led(codec,
+- update_tpacpi_micmute) > 0)
++ !snd_hda_gen_add_micmute_led(codec,
++ update_tpacpi_micmute))
+ removefunc = false;
+ }
+
+diff --git a/sound/soc/amd/acp-pcm-dma.c b/sound/soc/amd/acp-pcm-dma.c
+index 77b265bd0505..3135e9eafd18 100644
+--- a/sound/soc/amd/acp-pcm-dma.c
++++ b/sound/soc/amd/acp-pcm-dma.c
+@@ -1036,16 +1036,22 @@ static snd_pcm_uframes_t acp_dma_pointer(struct snd_pcm_substream *substream)
+
+ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) {
+ period_bytes = frames_to_bytes(runtime, runtime->period_size);
+- dscr = acp_reg_read(rtd->acp_mmio, rtd->dma_curr_dscr);
+- if (dscr == rtd->dma_dscr_idx_1)
+- pos = period_bytes;
+- else
+- pos = 0;
+ bytescount = acp_get_byte_count(rtd);
+- if (bytescount > rtd->bytescount)
++ if (bytescount >= rtd->bytescount)
+ bytescount -= rtd->bytescount;
+- delay = do_div(bytescount, period_bytes);
+- runtime->delay = bytes_to_frames(runtime, delay);
++ if (bytescount < period_bytes) {
++ pos = 0;
++ } else {
++ dscr = acp_reg_read(rtd->acp_mmio, rtd->dma_curr_dscr);
++ if (dscr == rtd->dma_dscr_idx_1)
++ pos = period_bytes;
++ else
++ pos = 0;
++ }
++ if (bytescount > 0) {
++ delay = do_div(bytescount, period_bytes);
++ runtime->delay = bytes_to_frames(runtime, delay);
++ }
+ } else {
+ buffersize = frames_to_bytes(runtime, runtime->buffer_size);
+ bytescount = acp_get_byte_count(rtd);
+diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
+index d5035f2f2b2b..ce508b4cc85c 100644
+--- a/sound/soc/codecs/sta32x.c
++++ b/sound/soc/codecs/sta32x.c
+@@ -879,6 +879,9 @@ static int sta32x_probe(struct snd_soc_component *component)
+ struct sta32x_priv *sta32x = snd_soc_component_get_drvdata(component);
+ struct sta32x_platform_data *pdata = sta32x->pdata;
+ int i, ret = 0, thermal = 0;
++
++ sta32x->component = component;
++
+ ret = regulator_bulk_enable(ARRAY_SIZE(sta32x->supplies),
+ sta32x->supplies);
+ if (ret != 0) {
+diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
+index 2620d77729c5..f99c600f86e4 100644
+--- a/sound/soc/intel/skylake/skl-topology.c
++++ b/sound/soc/intel/skylake/skl-topology.c
+@@ -2461,6 +2461,7 @@ static int skl_tplg_get_token(struct device *dev,
+
+ case SKL_TKN_U8_CORE_ID:
+ mconfig->core_id = tkn_elem->value;
++ break;
+
+ case SKL_TKN_U8_MOD_TYPE:
+ mconfig->m_type = tkn_elem->value;
+diff --git a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+index 3013ac8f83d0..cab7b0aea6ea 100755
+--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
++++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+@@ -48,7 +48,7 @@ trace_libc_inet_pton_backtrace() {
+ *)
+ eventattr='max-stack=3'
+ echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
+- echo ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected
++ echo ".*(\+0x[[:xdigit:]]+|\[unknown\])[[:space:]]\(.*/bin/ping.*\)$" >> $expected
+ ;;
+ esac
+
+diff --git a/tools/perf/util/strbuf.c b/tools/perf/util/strbuf.c
+index 3d1cf5bf7f18..9005fbe0780e 100644
+--- a/tools/perf/util/strbuf.c
++++ b/tools/perf/util/strbuf.c
+@@ -98,19 +98,25 @@ static int strbuf_addv(struct strbuf *sb, const char *fmt, va_list ap)
+
+ va_copy(ap_saved, ap);
+ len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap);
+- if (len < 0)
++ if (len < 0) {
++ va_end(ap_saved);
+ return len;
++ }
+ if (len > strbuf_avail(sb)) {
+ ret = strbuf_grow(sb, len);
+- if (ret)
++ if (ret) {
++ va_end(ap_saved);
+ return ret;
++ }
+ len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap_saved);
+ va_end(ap_saved);
+ if (len > strbuf_avail(sb)) {
+ pr_debug("this should not happen, your vsnprintf is broken");
++ va_end(ap_saved);
+ return -EINVAL;
+ }
+ }
++ va_end(ap_saved);
+ return strbuf_setlen(sb, sb->len + len);
+ }
+
+diff --git a/tools/perf/util/trace-event-info.c b/tools/perf/util/trace-event-info.c
+index 7b0ca7cbb7de..8ad8e755127b 100644
+--- a/tools/perf/util/trace-event-info.c
++++ b/tools/perf/util/trace-event-info.c
+@@ -531,12 +531,14 @@ struct tracing_data *tracing_data_get(struct list_head *pattrs,
+ "/tmp/perf-XXXXXX");
+ if (!mkstemp(tdata->temp_file)) {
+ pr_debug("Can't make temp file");
++ free(tdata);
+ return NULL;
+ }
+
+ temp_fd = open(tdata->temp_file, O_RDWR);
+ if (temp_fd < 0) {
+ pr_debug("Can't read '%s'", tdata->temp_file);
++ free(tdata);
+ return NULL;
+ }
+
+diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
+index e76214f8d596..b15a9bf1837b 100644
+--- a/tools/perf/util/trace-event-parse.c
++++ b/tools/perf/util/trace-event-parse.c
+@@ -158,6 +158,7 @@ void parse_ftrace_printk(struct tep_handle *pevent,
+ printk = strdup(fmt+1);
+ line = strtok_r(NULL, "\n", &next);
+ tep_register_print_string(pevent, printk, addr);
++ free(printk);
+ }
+ }
+
+diff --git a/tools/perf/util/trace-event-read.c b/tools/perf/util/trace-event-read.c
+index 3dfc1db6b25b..5eb1b2469bba 100644
+--- a/tools/perf/util/trace-event-read.c
++++ b/tools/perf/util/trace-event-read.c
+@@ -349,9 +349,12 @@ static int read_event_files(struct tep_handle *pevent)
+ for (x=0; x < count; x++) {
+ size = read8(pevent);
+ ret = read_event_file(pevent, sys, size);
+- if (ret)
++ if (ret) {
++ free(sys);
+ return ret;
++ }
+ }
++ free(sys);
+ }
+ return 0;
+ }
+diff --git a/tools/power/cpupower/utils/cpufreq-info.c b/tools/power/cpupower/utils/cpufreq-info.c
+index df43cd45d810..ccd08dd00996 100644
+--- a/tools/power/cpupower/utils/cpufreq-info.c
++++ b/tools/power/cpupower/utils/cpufreq-info.c
+@@ -200,6 +200,8 @@ static int get_boost_mode(unsigned int cpu)
+ printf(_(" Boost States: %d\n"), b_states);
+ printf(_(" Total States: %d\n"), pstate_no);
+ for (i = 0; i < pstate_no; i++) {
++ if (!pstates[i])
++ continue;
+ if (i < b_states)
+ printf(_(" Pstate-Pb%d: %luMHz (boost state)"
+ "\n"), i, pstates[i]);
+diff --git a/tools/power/cpupower/utils/helpers/amd.c b/tools/power/cpupower/utils/helpers/amd.c
+index bb41cdd0df6b..9607ada5b29a 100644
+--- a/tools/power/cpupower/utils/helpers/amd.c
++++ b/tools/power/cpupower/utils/helpers/amd.c
+@@ -33,7 +33,7 @@ union msr_pstate {
+ unsigned vid:8;
+ unsigned iddval:8;
+ unsigned idddiv:2;
+- unsigned res1:30;
++ unsigned res1:31;
+ unsigned en:1;
+ } fam17h_bits;
+ unsigned long long val;
+@@ -119,6 +119,11 @@ int decode_pstates(unsigned int cpu, unsigned int cpu_family,
+ }
+ if (read_msr(cpu, MSR_AMD_PSTATE + i, &pstate.val))
+ return -1;
++ if ((cpu_family == 0x17) && (!pstate.fam17h_bits.en))
++ continue;
++ else if (!pstate.bits.en)
++ continue;
++
+ pstates[i] = get_cof(cpu_family, pstate);
+ }
+ *no = i;
+diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc
+index cef11377dcbd..c604438df13b 100644
+--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc
++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc
+@@ -35,18 +35,18 @@ fi
+
+ reset_trigger
+
+-echo "Test create synthetic event with an error"
+-echo 'wakeup_latency u64 lat pid_t pid char' > synthetic_events > /dev/null
++echo "Test remove synthetic event"
++echo '!wakeup_latency u64 lat pid_t pid char comm[16]' >> synthetic_events
+ if [ -d events/synthetic/wakeup_latency ]; then
+- fail "Created wakeup_latency synthetic event with an invalid format"
++ fail "Failed to delete wakeup_latency synthetic event"
+ fi
+
+ reset_trigger
+
+-echo "Test remove synthetic event"
+-echo '!wakeup_latency u64 lat pid_t pid char comm[16]' > synthetic_events
++echo "Test create synthetic event with an error"
++echo 'wakeup_latency u64 lat pid_t pid char' > synthetic_events > /dev/null
+ if [ -d events/synthetic/wakeup_latency ]; then
+- fail "Failed to delete wakeup_latency synthetic event"
++ fail "Created wakeup_latency synthetic event with an invalid format"
+ fi
+
+ do_reset
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c
+index 327fa943c7f3..dbdffa2e2c82 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c
+@@ -67,8 +67,8 @@ trans:
+ "3: ;"
+ : [res] "=r" (result), [texasr] "=r" (texasr)
+ : [gpr_1]"i"(GPR_1), [gpr_2]"i"(GPR_2), [gpr_4]"i"(GPR_4),
+- [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "r" (&a),
+- [flt_2] "r" (&b), [flt_4] "r" (&d)
++ [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "b" (&a),
++ [flt_4] "b" (&d)
+ : "memory", "r5", "r6", "r7",
+ "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15",
+ "r16", "r17", "r18", "r19", "r20", "r21", "r22", "r23",
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index c92053bc3f96..8fb31a7cc22c 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -1295,8 +1295,6 @@ static void cpu_init_hyp_mode(void *dummy)
+
+ __cpu_init_hyp_mode(pgd_ptr, hyp_stack_ptr, vector_ptr);
+ __cpu_init_stage2();
+-
+- kvm_arm_init_debug();
+ }
+
+ static void cpu_hyp_reset(void)
+@@ -1320,6 +1318,8 @@ static void cpu_hyp_reinit(void)
+ cpu_init_hyp_mode(NULL);
+ }
+
++ kvm_arm_init_debug();
++
+ if (vgic_present)
+ kvm_vgic_init_cpu_hardware();
+ }
+diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
+index ed162a6c57c5..2f405b0be25c 100644
+--- a/virt/kvm/arm/mmu.c
++++ b/virt/kvm/arm/mmu.c
+@@ -1230,8 +1230,14 @@ static bool transparent_hugepage_adjust(kvm_pfn_t *pfnp, phys_addr_t *ipap)
+ {
+ kvm_pfn_t pfn = *pfnp;
+ gfn_t gfn = *ipap >> PAGE_SHIFT;
++ struct page *page = pfn_to_page(pfn);
+
+- if (PageTransCompoundMap(pfn_to_page(pfn))) {
++ /*
++ * PageTransCompoungMap() returns true for THP and
++ * hugetlbfs. Make sure the adjustment is done only for THP
++ * pages.
++ */
++ if (!PageHuge(page) && PageTransCompoundMap(page)) {
+ unsigned long mask;
+ /*
+ * The address we faulted on is backed by a transparent huge
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-11-21 12:30 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-11-21 12:30 UTC (permalink / raw
To: gentoo-commits
commit: 4874450496010d25ec717a0c3b7922413a43de2a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 21 12:29:59 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Nov 21 12:29:59 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=48744504
proj/linux-patches: Linux patch 4.19.3
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1002_linux-4.19.3.patch | 6344 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6348 insertions(+)
diff --git a/0000_README b/0000_README
index 6b0adb6..6ce85c3 100644
--- a/0000_README
+++ b/0000_README
@@ -51,6 +51,10 @@ Patch: 1001_linux-4.19.2.patch
From: http://www.kernel.org
Desc: Linux 4.19.2
+Patch: 1002_linux-4.19.3.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.3
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1002_linux-4.19.3.patch b/1002_linux-4.19.3.patch
new file mode 100644
index 0000000..3650f86
--- /dev/null
+++ b/1002_linux-4.19.3.patch
@@ -0,0 +1,6344 @@
+diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
+index 51c136c821bf..eef7d9d259e8 100644
+--- a/Documentation/filesystems/overlayfs.txt
++++ b/Documentation/filesystems/overlayfs.txt
+@@ -286,6 +286,12 @@ pointed by REDIRECT. This should not be possible on local system as setting
+ "trusted." xattrs will require CAP_SYS_ADMIN. But it should be possible
+ for untrusted layers like from a pen drive.
+
++Note: redirect_dir={off|nofollow|follow(*)} conflicts with metacopy=on, and
++results in an error.
++
++(*) redirect_dir=follow only conflicts with metacopy=on if upperdir=... is
++given.
++
+ Sharing and copying layers
+ --------------------------
+
+diff --git a/Makefile b/Makefile
+index c8fe567f18ab..e4064fa16f11 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/include/asm/termios.h b/arch/alpha/include/asm/termios.h
+index 6a8c53dec57e..b7c77bb1bfd2 100644
+--- a/arch/alpha/include/asm/termios.h
++++ b/arch/alpha/include/asm/termios.h
+@@ -73,9 +73,15 @@
+ })
+
+ #define user_termios_to_kernel_termios(k, u) \
+- copy_from_user(k, u, sizeof(struct termios))
++ copy_from_user(k, u, sizeof(struct termios2))
+
+ #define kernel_termios_to_user_termios(u, k) \
++ copy_to_user(u, k, sizeof(struct termios2))
++
++#define user_termios_to_kernel_termios_1(k, u) \
++ copy_from_user(k, u, sizeof(struct termios))
++
++#define kernel_termios_to_user_termios_1(u, k) \
+ copy_to_user(u, k, sizeof(struct termios))
+
+ #endif /* _ALPHA_TERMIOS_H */
+diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h
+index 3729d92d3fa8..dc8c20ac7191 100644
+--- a/arch/alpha/include/uapi/asm/ioctls.h
++++ b/arch/alpha/include/uapi/asm/ioctls.h
+@@ -32,6 +32,11 @@
+ #define TCXONC _IO('t', 30)
+ #define TCFLSH _IO('t', 31)
+
++#define TCGETS2 _IOR('T', 42, struct termios2)
++#define TCSETS2 _IOW('T', 43, struct termios2)
++#define TCSETSW2 _IOW('T', 44, struct termios2)
++#define TCSETSF2 _IOW('T', 45, struct termios2)
++
+ #define TIOCSWINSZ _IOW('t', 103, struct winsize)
+ #define TIOCGWINSZ _IOR('t', 104, struct winsize)
+ #define TIOCSTART _IO('t', 110) /* start output, like ^Q */
+diff --git a/arch/alpha/include/uapi/asm/termbits.h b/arch/alpha/include/uapi/asm/termbits.h
+index de6c8360fbe3..4575ba34a0ea 100644
+--- a/arch/alpha/include/uapi/asm/termbits.h
++++ b/arch/alpha/include/uapi/asm/termbits.h
+@@ -26,6 +26,19 @@ struct termios {
+ speed_t c_ospeed; /* output speed */
+ };
+
++/* Alpha has identical termios and termios2 */
++
++struct termios2 {
++ tcflag_t c_iflag; /* input mode flags */
++ tcflag_t c_oflag; /* output mode flags */
++ tcflag_t c_cflag; /* control mode flags */
++ tcflag_t c_lflag; /* local mode flags */
++ cc_t c_cc[NCCS]; /* control characters */
++ cc_t c_line; /* line discipline (== c_cc[19]) */
++ speed_t c_ispeed; /* input speed */
++ speed_t c_ospeed; /* output speed */
++};
++
+ /* Alpha has matching termios and ktermios */
+
+ struct ktermios {
+@@ -152,6 +165,7 @@ struct ktermios {
+ #define B3000000 00034
+ #define B3500000 00035
+ #define B4000000 00036
++#define BOTHER 00037
+
+ #define CSIZE 00001400
+ #define CS5 00000000
+@@ -169,6 +183,9 @@ struct ktermios {
+ #define CMSPAR 010000000000 /* mark or space (stick) parity */
+ #define CRTSCTS 020000000000 /* flow control */
+
++#define CIBAUD 07600000
++#define IBSHIFT 16
++
+ /* c_lflag bits */
+ #define ISIG 0x00000080
+ #define ICANON 0x00000100
+diff --git a/arch/arm/boot/dts/imx6ull-pinfunc.h b/arch/arm/boot/dts/imx6ull-pinfunc.h
+index fdc46bb09cc1..3c12a6fb0b61 100644
+--- a/arch/arm/boot/dts/imx6ull-pinfunc.h
++++ b/arch/arm/boot/dts/imx6ull-pinfunc.h
+@@ -14,14 +14,23 @@
+ * The pin function ID is a tuple of
+ * <mux_reg conf_reg input_reg mux_mode input_val>
+ */
++/* signals common for i.MX6UL and i.MX6ULL */
++#undef MX6UL_PAD_UART5_TX_DATA__UART5_DTE_RX
++#define MX6UL_PAD_UART5_TX_DATA__UART5_DTE_RX 0x00BC 0x0348 0x0644 0x0 0x6
++#undef MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX
++#define MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX 0x00C0 0x034C 0x0644 0x0 0x7
++#undef MX6UL_PAD_ENET1_RX_EN__UART5_DCE_RTS
++#define MX6UL_PAD_ENET1_RX_EN__UART5_DCE_RTS 0x00CC 0x0358 0x0640 0x1 0x5
++#undef MX6UL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS
++#define MX6UL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS 0x00D0 0x035C 0x0640 0x1 0x6
++#undef MX6UL_PAD_CSI_DATA02__UART5_DCE_RTS
++#define MX6UL_PAD_CSI_DATA02__UART5_DCE_RTS 0x01EC 0x0478 0x0640 0x8 0x7
++
++/* signals for i.MX6ULL only */
+ #define MX6ULL_PAD_UART1_TX_DATA__UART5_DTE_RX 0x0084 0x0310 0x0644 0x9 0x4
+ #define MX6ULL_PAD_UART1_RX_DATA__UART5_DCE_RX 0x0088 0x0314 0x0644 0x9 0x5
+ #define MX6ULL_PAD_UART1_CTS_B__UART5_DCE_RTS 0x008C 0x0318 0x0640 0x9 0x3
+ #define MX6ULL_PAD_UART1_RTS_B__UART5_DTE_RTS 0x0090 0x031C 0x0640 0x9 0x4
+-#define MX6ULL_PAD_UART5_TX_DATA__UART5_DTE_RX 0x00BC 0x0348 0x0644 0x0 0x6
+-#define MX6ULL_PAD_UART5_RX_DATA__UART5_DCE_RX 0x00C0 0x034C 0x0644 0x0 0x7
+-#define MX6ULL_PAD_ENET1_RX_EN__UART5_DCE_RTS 0x00CC 0x0358 0x0640 0x1 0x5
+-#define MX6ULL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS 0x00D0 0x035C 0x0640 0x1 0x6
+ #define MX6ULL_PAD_ENET2_RX_DATA0__EPDC_SDDO08 0x00E4 0x0370 0x0000 0x9 0x0
+ #define MX6ULL_PAD_ENET2_RX_DATA1__EPDC_SDDO09 0x00E8 0x0374 0x0000 0x9 0x0
+ #define MX6ULL_PAD_ENET2_RX_EN__EPDC_SDDO10 0x00EC 0x0378 0x0000 0x9 0x0
+@@ -55,7 +64,6 @@
+ #define MX6ULL_PAD_CSI_DATA00__ESAI_TX_HF_CLK 0x01E4 0x0470 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA01__ESAI_RX_HF_CLK 0x01E8 0x0474 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA02__ESAI_RX_FS 0x01EC 0x0478 0x0000 0x9 0x0
+-#define MX6ULL_PAD_CSI_DATA02__UART5_DCE_RTS 0x01EC 0x0478 0x0640 0x8 0x7
+ #define MX6ULL_PAD_CSI_DATA03__ESAI_RX_CLK 0x01F0 0x047C 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA04__ESAI_TX_FS 0x01F4 0x0480 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA05__ESAI_TX_CLK 0x01F8 0x0484 0x0000 0x9 0x0
+diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
+index 7eca43ff69bb..f4c2e993bba3 100644
+--- a/arch/arm/configs/imx_v6_v7_defconfig
++++ b/arch/arm/configs/imx_v6_v7_defconfig
+@@ -409,6 +409,7 @@ CONFIG_ZISOFS=y
+ CONFIG_UDF_FS=m
+ CONFIG_MSDOS_FS=m
+ CONFIG_VFAT_FS=y
++CONFIG_TMPFS_POSIX_ACL=y
+ CONFIG_JFFS2_FS=y
+ CONFIG_UBIFS_FS=y
+ CONFIG_NFS_FS=y
+diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
+index 6fe52819e014..339eb17c9808 100644
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -112,7 +112,7 @@ ENTRY(cpu_v7_hvc_switch_mm)
+ hvc #0
+ ldmfd sp!, {r0 - r3}
+ b cpu_v7_switch_mm
+-ENDPROC(cpu_v7_smc_switch_mm)
++ENDPROC(cpu_v7_hvc_switch_mm)
+ #endif
+ ENTRY(cpu_v7_iciallu_switch_mm)
+ mov r3, #0
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+index bc6c141d7372..5089aa64088f 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+@@ -137,6 +137,9 @@
+ reset-names = "stmmaceth", "stmmaceth-ocp";
+ clocks = <&clkmgr STRATIX10_EMAC0_CLK>;
+ clock-names = "stmmaceth";
++ tx-fifo-depth = <16384>;
++ rx-fifo-depth = <16384>;
++ snps,multicast-filter-bins = <256>;
+ status = "disabled";
+ };
+
+@@ -150,6 +153,9 @@
+ reset-names = "stmmaceth", "stmmaceth-ocp";
+ clocks = <&clkmgr STRATIX10_EMAC1_CLK>;
+ clock-names = "stmmaceth";
++ tx-fifo-depth = <16384>;
++ rx-fifo-depth = <16384>;
++ snps,multicast-filter-bins = <256>;
+ status = "disabled";
+ };
+
+@@ -163,6 +169,9 @@
+ reset-names = "stmmaceth", "stmmaceth-ocp";
+ clocks = <&clkmgr STRATIX10_EMAC2_CLK>;
+ clock-names = "stmmaceth";
++ tx-fifo-depth = <16384>;
++ rx-fifo-depth = <16384>;
++ snps,multicast-filter-bins = <256>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+index 6edc4fa9fd42..7c661753bfaf 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+@@ -76,7 +76,7 @@
+ phy-mode = "rgmii";
+ phy-handle = <&phy0>;
+
+- max-frame-size = <3800>;
++ max-frame-size = <9000>;
+
+ mdio0 {
+ #address-cells = <1>;
+diff --git a/arch/mips/include/asm/mach-loongson64/irq.h b/arch/mips/include/asm/mach-loongson64/irq.h
+index 3644b68c0ccc..be9f727a9328 100644
+--- a/arch/mips/include/asm/mach-loongson64/irq.h
++++ b/arch/mips/include/asm/mach-loongson64/irq.h
+@@ -10,7 +10,7 @@
+ #define MIPS_CPU_IRQ_BASE 56
+
+ #define LOONGSON_UART_IRQ (MIPS_CPU_IRQ_BASE + 2) /* UART */
+-#define LOONGSON_HT1_IRQ (MIPS_CPU_IRQ_BASE + 3) /* HT1 */
++#define LOONGSON_BRIDGE_IRQ (MIPS_CPU_IRQ_BASE + 3) /* CASCADE */
+ #define LOONGSON_TIMER_IRQ (MIPS_CPU_IRQ_BASE + 7) /* CPU Timer */
+
+ #define LOONGSON_HT1_CFG_BASE loongson_sysconf.ht_control_base
+diff --git a/arch/mips/kernel/crash.c b/arch/mips/kernel/crash.c
+index d455363d51c3..4c07a43a3242 100644
+--- a/arch/mips/kernel/crash.c
++++ b/arch/mips/kernel/crash.c
+@@ -36,6 +36,9 @@ static void crash_shutdown_secondary(void *passed_regs)
+ if (!cpu_online(cpu))
+ return;
+
++ /* We won't be sent IPIs any more. */
++ set_cpu_online(cpu, false);
++
+ local_irq_disable();
+ if (!cpumask_test_cpu(cpu, &cpus_in_crash))
+ crash_save_cpu(regs, cpu);
+diff --git a/arch/mips/kernel/machine_kexec.c b/arch/mips/kernel/machine_kexec.c
+index 8b574bcd39ba..4b3726e4fe3a 100644
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -118,6 +118,9 @@ machine_kexec(struct kimage *image)
+ *ptr = (unsigned long) phys_to_virt(*ptr);
+ }
+
++ /* Mark offline BEFORE disabling local irq. */
++ set_cpu_online(smp_processor_id(), false);
++
+ /*
+ * we do not want to be bothered.
+ */
+diff --git a/arch/mips/loongson64/loongson-3/irq.c b/arch/mips/loongson64/loongson-3/irq.c
+index cbeb20f9fc95..5605061f5f98 100644
+--- a/arch/mips/loongson64/loongson-3/irq.c
++++ b/arch/mips/loongson64/loongson-3/irq.c
+@@ -96,51 +96,8 @@ void mach_irq_dispatch(unsigned int pending)
+ }
+ }
+
+-static struct irqaction cascade_irqaction = {
+- .handler = no_action,
+- .flags = IRQF_NO_SUSPEND,
+- .name = "cascade",
+-};
+-
+-static inline void mask_loongson_irq(struct irq_data *d)
+-{
+- clear_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE));
+- irq_disable_hazard();
+-
+- /* Workaround: UART IRQ may deliver to any core */
+- if (d->irq == LOONGSON_UART_IRQ) {
+- int cpu = smp_processor_id();
+- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node;
+- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node;
+- u64 intenclr_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_INTENCLR);
+- u64 introuter_lpc_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_LPC);
+-
+- *(volatile u32 *)intenclr_addr = 1 << 10;
+- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id);
+- }
+-}
+-
+-static inline void unmask_loongson_irq(struct irq_data *d)
+-{
+- /* Workaround: UART IRQ may deliver to any core */
+- if (d->irq == LOONGSON_UART_IRQ) {
+- int cpu = smp_processor_id();
+- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node;
+- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node;
+- u64 intenset_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_INTENSET);
+- u64 introuter_lpc_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_LPC);
+-
+- *(volatile u32 *)intenset_addr = 1 << 10;
+- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id);
+- }
+-
+- set_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE));
+- irq_enable_hazard();
+-}
++static inline void mask_loongson_irq(struct irq_data *d) { }
++static inline void unmask_loongson_irq(struct irq_data *d) { }
+
+ /* For MIPS IRQs which shared by all cores */
+ static struct irq_chip loongson_irq_chip = {
+@@ -183,12 +140,11 @@ void __init mach_init_irq(void)
+ chip->irq_set_affinity = plat_set_irq_affinity;
+
+ irq_set_chip_and_handler(LOONGSON_UART_IRQ,
+- &loongson_irq_chip, handle_level_irq);
+-
+- /* setup HT1 irq */
+- setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction);
++ &loongson_irq_chip, handle_percpu_irq);
++ irq_set_chip_and_handler(LOONGSON_BRIDGE_IRQ,
++ &loongson_irq_chip, handle_percpu_irq);
+
+- set_c0_status(STATUSF_IP2 | STATUSF_IP6);
++ set_c0_status(STATUSF_IP2 | STATUSF_IP3 | STATUSF_IP6);
+ }
+
+ #ifdef CONFIG_HOTPLUG_CPU
+diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c
+index f1e92bf743c2..3c3b1e6abb53 100644
+--- a/arch/mips/pci/pci-legacy.c
++++ b/arch/mips/pci/pci-legacy.c
+@@ -127,8 +127,12 @@ static void pcibios_scanbus(struct pci_controller *hose)
+ if (pci_has_flag(PCI_PROBE_ONLY)) {
+ pci_bus_claim_resources(bus);
+ } else {
++ struct pci_bus *child;
++
+ pci_bus_size_bridges(bus);
+ pci_bus_assign_resources(bus);
++ list_for_each_entry(child, &bus->children, node)
++ pcie_bus_configure_settings(child);
+ }
+ pci_bus_add_devices(bus);
+ }
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 11a1acba164a..d2824b0cc142 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -238,7 +238,11 @@ cpu-as-$(CONFIG_4xx) += -Wa,-m405
+ cpu-as-$(CONFIG_ALTIVEC) += $(call as-option,-Wa$(comma)-maltivec)
+ cpu-as-$(CONFIG_E200) += -Wa,-me200
+ cpu-as-$(CONFIG_E500) += -Wa,-me500
+-cpu-as-$(CONFIG_PPC_BOOK3S_64) += -Wa,-mpower4
++
++# When using '-many -mpower4' gas will first try and find a matching power4
++# mnemonic and failing that it will allow any valid mnemonic that GAS knows
++# about. GCC will pass -many to GAS when assembling, clang does not.
++cpu-as-$(CONFIG_PPC_BOOK3S_64) += -Wa,-mpower4 -Wa,-many
+ cpu-as-$(CONFIG_PPC_E500MC) += $(call as-option,-Wa$(comma)-me500mc)
+
+ KBUILD_AFLAGS += $(cpu-as-y)
+diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
+index dcf2f15e6797..32dfe6d083f3 100644
+--- a/arch/powerpc/boot/crt0.S
++++ b/arch/powerpc/boot/crt0.S
+@@ -47,8 +47,10 @@ p_end: .long _end
+ p_pstack: .long _platform_stack_top
+ #endif
+
+- .weak _zimage_start
+ .globl _zimage_start
++ /* Clang appears to require the .weak directive to be after the symbol
++ * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */
++ .weak _zimage_start
+ _zimage_start:
+ .globl _zimage_start_lib
+ _zimage_start_lib:
+diff --git a/arch/powerpc/include/asm/mmu-8xx.h b/arch/powerpc/include/asm/mmu-8xx.h
+index 4f547752ae79..193f53116c7a 100644
+--- a/arch/powerpc/include/asm/mmu-8xx.h
++++ b/arch/powerpc/include/asm/mmu-8xx.h
+@@ -34,20 +34,12 @@
+ * respectively NA for All or X for Supervisor and no access for User.
+ * Then we use the APG to say whether accesses are according to Page rules or
+ * "all Supervisor" rules (Access to all)
+- * We also use the 2nd APG bit for _PAGE_ACCESSED when having SWAP:
+- * When that bit is not set access is done iaw "all user"
+- * which means no access iaw page rules.
+- * Therefore, we define 4 APG groups. lsb is _PMD_USER, 2nd is _PAGE_ACCESSED
+- * 0x => No access => 11 (all accesses performed as user iaw page definition)
+- * 10 => No user => 01 (all accesses performed according to page definition)
+- * 11 => User => 00 (all accesses performed as supervisor iaw page definition)
++ * Therefore, we define 2 APG groups. lsb is _PMD_USER
++ * 0 => No user => 01 (all accesses performed according to page definition)
++ * 1 => User => 00 (all accesses performed as supervisor iaw page definition)
+ * We define all 16 groups so that all other bits of APG can take any value
+ */
+-#ifdef CONFIG_SWAP
+-#define MI_APG_INIT 0xf4f4f4f4
+-#else
+ #define MI_APG_INIT 0x44444444
+-#endif
+
+ /* The effective page number register. When read, contains the information
+ * about the last instruction TLB miss. When MI_RPN is written, bits in
+@@ -115,20 +107,12 @@
+ * Supervisor and no access for user and NA for ALL.
+ * Then we use the APG to say whether accesses are according to Page rules or
+ * "all Supervisor" rules (Access to all)
+- * We also use the 2nd APG bit for _PAGE_ACCESSED when having SWAP:
+- * When that bit is not set access is done iaw "all user"
+- * which means no access iaw page rules.
+- * Therefore, we define 4 APG groups. lsb is _PMD_USER, 2nd is _PAGE_ACCESSED
+- * 0x => No access => 11 (all accesses performed as user iaw page definition)
+- * 10 => No user => 01 (all accesses performed according to page definition)
+- * 11 => User => 00 (all accesses performed as supervisor iaw page definition)
++ * Therefore, we define 2 APG groups. lsb is _PMD_USER
++ * 0 => No user => 01 (all accesses performed according to page definition)
++ * 1 => User => 00 (all accesses performed as supervisor iaw page definition)
+ * We define all 16 groups so that all other bits of APG can take any value
+ */
+-#ifdef CONFIG_SWAP
+-#define MD_APG_INIT 0xf4f4f4f4
+-#else
+ #define MD_APG_INIT 0x44444444
+-#endif
+
+ /* The effective page number register. When read, contains the information
+ * about the last instruction TLB miss. When MD_RPN is written, bits in
+@@ -180,12 +164,6 @@
+ */
+ #define SPRN_M_TW 799
+
+-/* APGs */
+-#define M_APG0 0x00000000
+-#define M_APG1 0x00000020
+-#define M_APG2 0x00000040
+-#define M_APG3 0x00000060
+-
+ #ifdef CONFIG_PPC_MM_SLICES
+ #include <asm/nohash/32/slice.h>
+ #define SLICE_ARRAY_SIZE (1 << (32 - SLICE_LOW_SHIFT - 1))
+diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
+index 6ebba3e48b01..c72767a5327a 100644
+--- a/arch/powerpc/kernel/eeh.c
++++ b/arch/powerpc/kernel/eeh.c
+@@ -169,6 +169,11 @@ static size_t eeh_dump_dev_log(struct eeh_dev *edev, char *buf, size_t len)
+ int n = 0, l = 0;
+ char buffer[128];
+
++ if (!pdn) {
++ pr_warn("EEH: Note: No error log for absent device.\n");
++ return 0;
++ }
++
+ n += scnprintf(buf+n, len-n, "%04x:%02x:%02x.%01x\n",
+ pdn->phb->global_number, pdn->busno,
+ PCI_SLOT(pdn->devfn), PCI_FUNC(pdn->devfn));
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index 6582f824d620..81d4574d1f37 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -353,13 +353,14 @@ _ENTRY(ITLBMiss_cmp)
+ #if defined(ITLB_MISS_KERNEL) || defined(CONFIG_HUGETLB_PAGE)
+ mtcr r12
+ #endif
+-
+-#ifdef CONFIG_SWAP
+- rlwinm r11, r10, 31, _PAGE_ACCESSED >> 1
+-#endif
+ /* Load the MI_TWC with the attributes for this "segment." */
+ mtspr SPRN_MI_TWC, r11 /* Set segment attributes */
+
++#ifdef CONFIG_SWAP
++ rlwinm r11, r10, 32-5, _PAGE_PRESENT
++ and r11, r11, r10
++ rlwimi r10, r11, 0, _PAGE_PRESENT
++#endif
+ li r11, RPN_PATTERN | 0x200
+ /* The Linux PTE won't go exactly into the MMU TLB.
+ * Software indicator bits 20 and 23 must be clear.
+@@ -470,14 +471,22 @@ _ENTRY(DTLBMiss_jmp)
+ * above.
+ */
+ rlwimi r11, r10, 0, _PAGE_GUARDED
+-#ifdef CONFIG_SWAP
+- /* _PAGE_ACCESSED has to be set. We use second APG bit for that, 0
+- * on that bit will represent a Non Access group
+- */
+- rlwinm r11, r10, 31, _PAGE_ACCESSED >> 1
+-#endif
+ mtspr SPRN_MD_TWC, r11
+
++ /* Both _PAGE_ACCESSED and _PAGE_PRESENT has to be set.
++ * We also need to know if the insn is a load/store, so:
++ * Clear _PAGE_PRESENT and load that which will
++ * trap into DTLB Error with store bit set accordinly.
++ */
++ /* PRESENT=0x1, ACCESSED=0x20
++ * r11 = ((r10 & PRESENT) & ((r10 & ACCESSED) >> 5));
++ * r10 = (r10 & ~PRESENT) | r11;
++ */
++#ifdef CONFIG_SWAP
++ rlwinm r11, r10, 32-5, _PAGE_PRESENT
++ and r11, r11, r10
++ rlwimi r10, r11, 0, _PAGE_PRESENT
++#endif
+ /* The Linux PTE won't go exactly into the MMU TLB.
+ * Software indicator bits 24, 25, 26, and 27 must be
+ * set. All other Linux PTE bits control the behavior
+@@ -637,8 +646,8 @@ InstructionBreakpoint:
+ */
+ DTLBMissIMMR:
+ mtcr r12
+- /* Set 512k byte guarded page and mark it valid and accessed */
+- li r10, MD_PS512K | MD_GUARDED | MD_SVALID | M_APG2
++ /* Set 512k byte guarded page and mark it valid */
++ li r10, MD_PS512K | MD_GUARDED | MD_SVALID
+ mtspr SPRN_MD_TWC, r10
+ mfspr r10, SPRN_IMMR /* Get current IMMR */
+ rlwinm r10, r10, 0, 0xfff80000 /* Get 512 kbytes boundary */
+@@ -656,8 +665,8 @@ _ENTRY(dtlb_miss_exit_2)
+
+ DTLBMissLinear:
+ mtcr r12
+- /* Set 8M byte page and mark it valid and accessed */
+- li r11, MD_PS8MEG | MD_SVALID | M_APG2
++ /* Set 8M byte page and mark it valid */
++ li r11, MD_PS8MEG | MD_SVALID
+ mtspr SPRN_MD_TWC, r11
+ rlwinm r10, r10, 0, 0x0f800000 /* 8xx supports max 256Mb RAM */
+ ori r10, r10, 0xf0 | MD_SPS16K | _PAGE_PRIVILEGED | _PAGE_DIRTY | \
+@@ -675,8 +684,8 @@ _ENTRY(dtlb_miss_exit_3)
+ #ifndef CONFIG_PIN_TLB_TEXT
+ ITLBMissLinear:
+ mtcr r12
+- /* Set 8M byte page and mark it valid,accessed */
+- li r11, MI_PS8MEG | MI_SVALID | M_APG2
++ /* Set 8M byte page and mark it valid */
++ li r11, MI_PS8MEG | MI_SVALID
+ mtspr SPRN_MI_TWC, r11
+ rlwinm r10, r10, 0, 0x0f800000 /* 8xx supports max 256Mb RAM */
+ ori r10, r10, 0xf0 | MI_SPS16K | _PAGE_PRIVILEGED | _PAGE_DIRTY | \
+@@ -960,7 +969,7 @@ initial_mmu:
+ ori r8, r8, MI_EVALID /* Mark it valid */
+ mtspr SPRN_MI_EPN, r8
+ li r8, MI_PS8MEG /* Set 8M byte page */
+- ori r8, r8, MI_SVALID | M_APG2 /* Make it valid, APG 2 */
++ ori r8, r8, MI_SVALID /* Make it valid */
+ mtspr SPRN_MI_TWC, r8
+ li r8, MI_BOOTINIT /* Create RPN for address 0 */
+ mtspr SPRN_MI_RPN, r8 /* Store TLB entry */
+@@ -987,7 +996,7 @@ initial_mmu:
+ ori r8, r8, MD_EVALID /* Mark it valid */
+ mtspr SPRN_MD_EPN, r8
+ li r8, MD_PS512K | MD_GUARDED /* Set 512k byte page */
+- ori r8, r8, MD_SVALID | M_APG2 /* Make it valid and accessed */
++ ori r8, r8, MD_SVALID /* Make it valid */
+ mtspr SPRN_MD_TWC, r8
+ mr r8, r9 /* Create paddr for TLB */
+ ori r8, r8, MI_BOOTINIT|0x2 /* Inhibit cache -- Cort */
+diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
+index 2c53de9f3b6a..8661eea78503 100644
+--- a/arch/powerpc/kernel/module_64.c
++++ b/arch/powerpc/kernel/module_64.c
+@@ -680,7 +680,14 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
+
+ case R_PPC64_REL32:
+ /* 32 bits relative (used by relative exception tables) */
+- *(u32 *)location = value - (unsigned long)location;
++ /* Convert value to relative */
++ value -= (unsigned long)location;
++ if (value + 0x80000000 > 0xffffffff) {
++ pr_err("%s: REL32 %li out of range!\n",
++ me->name, (long int)value);
++ return -ENOEXEC;
++ }
++ *(u32 *)location = value;
+ break;
+
+ case R_PPC64_TOCSAVE:
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index c85adb858271..8689a02b7df8 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -767,12 +767,17 @@ void machine_check_exception(struct pt_regs *regs)
+ if (check_io_access(regs))
+ goto bail;
+
+- die("Machine check", regs, SIGBUS);
+-
+ /* Must die if the interrupt is not recoverable */
+ if (!(regs->msr & MSR_RI))
+ nmi_panic(regs, "Unrecoverable Machine check");
+
++ if (!nested)
++ nmi_exit();
++
++ die("Machine check", regs, SIGBUS);
++
++ return;
++
+ bail:
+ if (!nested)
+ nmi_exit();
+diff --git a/arch/powerpc/mm/8xx_mmu.c b/arch/powerpc/mm/8xx_mmu.c
+index cf77d755246d..5d53684c2ebd 100644
+--- a/arch/powerpc/mm/8xx_mmu.c
++++ b/arch/powerpc/mm/8xx_mmu.c
+@@ -79,7 +79,7 @@ void __init MMU_init_hw(void)
+ for (; i < 32 && mem >= LARGE_PAGE_SIZE_8M; i++) {
+ mtspr(SPRN_MD_CTR, ctr | (i << 8));
+ mtspr(SPRN_MD_EPN, (unsigned long)__va(addr) | MD_EVALID);
+- mtspr(SPRN_MD_TWC, MD_PS8MEG | MD_SVALID | M_APG2);
++ mtspr(SPRN_MD_TWC, MD_PS8MEG | MD_SVALID);
+ mtspr(SPRN_MD_RPN, addr | flags | _PAGE_PRESENT);
+ addr += LARGE_PAGE_SIZE_8M;
+ mem -= LARGE_PAGE_SIZE_8M;
+diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c
+index 876e2a3c79f2..bdf33b989f98 100644
+--- a/arch/powerpc/mm/dump_linuxpagetables.c
++++ b/arch/powerpc/mm/dump_linuxpagetables.c
+@@ -418,12 +418,13 @@ static void walk_pagetables(struct pg_state *st)
+ unsigned int i;
+ unsigned long addr;
+
++ addr = st->start_address;
++
+ /*
+ * Traverse the linux pagetable structure and dump pages that are in
+ * the hash pagetable.
+ */
+- for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
+- addr = KERN_VIRT_START + i * PGDIR_SIZE;
++ for (i = 0; i < PTRS_PER_PGD; i++, pgd++, addr += PGDIR_SIZE) {
+ if (!pgd_none(*pgd) && !pgd_huge(*pgd))
+ /* pgd exists */
+ walk_pud(st, pgd, addr);
+@@ -472,9 +473,14 @@ static int ptdump_show(struct seq_file *m, void *v)
+ {
+ struct pg_state st = {
+ .seq = m,
+- .start_address = KERN_VIRT_START,
+ .marker = address_markers,
+ };
++
++ if (radix_enabled())
++ st.start_address = PAGE_OFFSET;
++ else
++ st.start_address = KERN_VIRT_START;
++
+ /* Traverse kernel page tables */
+ walk_pagetables(&st);
+ note_page(&st, 0, 0, 0);
+diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
+index e87f9ef9115b..7296a42eb62e 100644
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -19,6 +19,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/swap.h>
+ #include <linux/swapops.h>
++#include <linux/kmemleak.h>
+ #include <asm/pgtable.h>
+ #include <asm/pgalloc.h>
+ #include <asm/tlb.h>
+@@ -112,6 +113,8 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t *hpdp,
+ for (i = i - 1 ; i >= 0; i--, hpdp--)
+ *hpdp = __hugepd(0);
+ kmem_cache_free(cachep, new);
++ } else {
++ kmemleak_ignore(new);
+ }
+ spin_unlock(ptl);
+ return 0;
+diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
+index 205fe557ca10..4f213ba33491 100644
+--- a/arch/powerpc/mm/slice.c
++++ b/arch/powerpc/mm/slice.c
+@@ -61,6 +61,13 @@ static void slice_print_mask(const char *label, const struct slice_mask *mask) {
+
+ #endif
+
++static inline bool slice_addr_is_low(unsigned long addr)
++{
++ u64 tmp = (u64)addr;
++
++ return tmp < SLICE_LOW_TOP;
++}
++
+ static void slice_range_to_mask(unsigned long start, unsigned long len,
+ struct slice_mask *ret)
+ {
+@@ -70,7 +77,7 @@ static void slice_range_to_mask(unsigned long start, unsigned long len,
+ if (SLICE_NUM_HIGH)
+ bitmap_zero(ret->high_slices, SLICE_NUM_HIGH);
+
+- if (start < SLICE_LOW_TOP) {
++ if (slice_addr_is_low(start)) {
+ unsigned long mend = min(end,
+ (unsigned long)(SLICE_LOW_TOP - 1));
+
+@@ -78,7 +85,7 @@ static void slice_range_to_mask(unsigned long start, unsigned long len,
+ - (1u << GET_LOW_SLICE_INDEX(start));
+ }
+
+- if ((start + len) > SLICE_LOW_TOP) {
++ if (SLICE_NUM_HIGH && !slice_addr_is_low(end)) {
+ unsigned long start_index = GET_HIGH_SLICE_INDEX(start);
+ unsigned long align_end = ALIGN(end, (1UL << SLICE_HIGH_SHIFT));
+ unsigned long count = GET_HIGH_SLICE_INDEX(align_end) - start_index;
+@@ -133,7 +140,7 @@ static void slice_mask_for_free(struct mm_struct *mm, struct slice_mask *ret,
+ if (!slice_low_has_vma(mm, i))
+ ret->low_slices |= 1u << i;
+
+- if (high_limit <= SLICE_LOW_TOP)
++ if (slice_addr_is_low(high_limit - 1))
+ return;
+
+ for (i = 0; i < GET_HIGH_SLICE_INDEX(high_limit); i++)
+@@ -182,7 +189,7 @@ static bool slice_check_range_fits(struct mm_struct *mm,
+ unsigned long end = start + len - 1;
+ u64 low_slices = 0;
+
+- if (start < SLICE_LOW_TOP) {
++ if (slice_addr_is_low(start)) {
+ unsigned long mend = min(end,
+ (unsigned long)(SLICE_LOW_TOP - 1));
+
+@@ -192,7 +199,7 @@ static bool slice_check_range_fits(struct mm_struct *mm,
+ if ((low_slices & available->low_slices) != low_slices)
+ return false;
+
+- if (SLICE_NUM_HIGH && ((start + len) > SLICE_LOW_TOP)) {
++ if (SLICE_NUM_HIGH && !slice_addr_is_low(end)) {
+ unsigned long start_index = GET_HIGH_SLICE_INDEX(start);
+ unsigned long align_end = ALIGN(end, (1UL << SLICE_HIGH_SHIFT));
+ unsigned long count = GET_HIGH_SLICE_INDEX(align_end) - start_index;
+@@ -303,7 +310,7 @@ static bool slice_scan_available(unsigned long addr,
+ int end, unsigned long *boundary_addr)
+ {
+ unsigned long slice;
+- if (addr < SLICE_LOW_TOP) {
++ if (slice_addr_is_low(addr)) {
+ slice = GET_LOW_SLICE_INDEX(addr);
+ *boundary_addr = (slice + end) << SLICE_LOW_SHIFT;
+ return !!(available->low_slices & (1u << slice));
+@@ -706,7 +713,7 @@ unsigned int get_slice_psize(struct mm_struct *mm, unsigned long addr)
+
+ VM_BUG_ON(radix_enabled());
+
+- if (addr < SLICE_LOW_TOP) {
++ if (slice_addr_is_low(addr)) {
+ psizes = mm->context.low_slices_psize;
+ index = GET_LOW_SLICE_INDEX(addr);
+ } else {
+diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c
+index 15fe5f0c8665..ae5d568e267f 100644
+--- a/arch/powerpc/mm/tlb_nohash.c
++++ b/arch/powerpc/mm/tlb_nohash.c
+@@ -503,6 +503,9 @@ static void setup_page_sizes(void)
+ for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) {
+ struct mmu_psize_def *def = &mmu_psize_defs[psize];
+
++ if (!def->shift)
++ continue;
++
+ if (tlb1ps & (1U << (def->shift - 10))) {
+ def->flags |= MMU_PAGE_SIZE_DIRECT;
+
+diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c
+index 51dc398ae3f7..a29fdf8a2e56 100644
+--- a/arch/powerpc/platforms/powernv/memtrace.c
++++ b/arch/powerpc/platforms/powernv/memtrace.c
+@@ -90,17 +90,15 @@ static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages)
+ walk_memory_range(start_pfn, end_pfn, (void *)MEM_OFFLINE,
+ change_memblock_state);
+
+- lock_device_hotplug();
+- remove_memory(nid, start_pfn << PAGE_SHIFT, nr_pages << PAGE_SHIFT);
+- unlock_device_hotplug();
+
+ return true;
+ }
+
+ static u64 memtrace_alloc_node(u32 nid, u64 size)
+ {
+- u64 start_pfn, end_pfn, nr_pages;
++ u64 start_pfn, end_pfn, nr_pages, pfn;
+ u64 base_pfn;
++ u64 bytes = memory_block_size_bytes();
+
+ if (!node_spanned_pages(nid))
+ return 0;
+@@ -113,8 +111,21 @@ static u64 memtrace_alloc_node(u32 nid, u64 size)
+ end_pfn = round_down(end_pfn - nr_pages, nr_pages);
+
+ for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) {
+- if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true)
++ if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) {
++ /*
++ * Remove memory in memory block size chunks so that
++ * iomem resources are always split to the same size and
++ * we never try to remove memory that spans two iomem
++ * resources.
++ */
++ lock_device_hotplug();
++ end_pfn = base_pfn + nr_pages;
++ for (pfn = base_pfn; pfn < end_pfn; pfn += bytes>> PAGE_SHIFT) {
++ remove_memory(nid, pfn << PAGE_SHIFT, bytes);
++ }
++ unlock_device_hotplug();
+ return base_pfn << PAGE_SHIFT;
++ }
+ }
+
+ return 0;
+diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
+index 3a17107594c8..eb786f90f2d3 100644
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -216,6 +216,8 @@ static inline int umc_normaddr_to_sysaddr(u64 norm_addr, u16 nid, u8 umc, u64 *s
+
+ int mce_available(struct cpuinfo_x86 *c);
+ bool mce_is_memory_error(struct mce *m);
++bool mce_is_correctable(struct mce *m);
++int mce_usable_address(struct mce *m);
+
+ DECLARE_PER_CPU(unsigned, mce_exception_count);
+ DECLARE_PER_CPU(unsigned, mce_poll_count);
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 953b3ce92dcc..cdbedeb3f3db 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -485,7 +485,7 @@ static void mce_report_event(struct pt_regs *regs)
+ * be somewhat complicated (e.g. segment offset would require an instruction
+ * parser). So only support physical addresses up to page granuality for now.
+ */
+-static int mce_usable_address(struct mce *m)
++int mce_usable_address(struct mce *m)
+ {
+ if (!(m->status & MCI_STATUS_ADDRV))
+ return 0;
+@@ -505,6 +505,7 @@ static int mce_usable_address(struct mce *m)
+
+ return 1;
+ }
++EXPORT_SYMBOL_GPL(mce_usable_address);
+
+ bool mce_is_memory_error(struct mce *m)
+ {
+@@ -534,7 +535,7 @@ bool mce_is_memory_error(struct mce *m)
+ }
+ EXPORT_SYMBOL_GPL(mce_is_memory_error);
+
+-static bool mce_is_correctable(struct mce *m)
++bool mce_is_correctable(struct mce *m)
+ {
+ if (m->cpuvendor == X86_VENDOR_AMD && m->status & MCI_STATUS_DEFERRED)
+ return false;
+@@ -544,6 +545,7 @@ static bool mce_is_correctable(struct mce *m)
+
+ return true;
+ }
++EXPORT_SYMBOL_GPL(mce_is_correctable);
+
+ static bool cec_add_mce(struct mce *m)
+ {
+diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
+index ad12733f6058..852e74e48890 100644
+--- a/arch/x86/kernel/cpu/mshyperv.c
++++ b/arch/x86/kernel/cpu/mshyperv.c
+@@ -20,6 +20,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/irq.h>
+ #include <linux/kexec.h>
++#include <linux/i8253.h>
+ #include <asm/processor.h>
+ #include <asm/hypervisor.h>
+ #include <asm/hyperv-tlfs.h>
+@@ -285,6 +286,16 @@ static void __init ms_hyperv_init_platform(void)
+ if (efi_enabled(EFI_BOOT))
+ x86_platform.get_nmi_reason = hv_get_nmi_reason;
+
++ /*
++ * Hyper-V VMs have a PIT emulation quirk such that zeroing the
++ * counter register during PIT shutdown restarts the PIT. So it
++ * continues to interrupt @18.2 HZ. Setting i8253_clear_counter
++ * to false tells pit_shutdown() not to zero the counter so that
++ * the PIT really is shutdown. Generation 2 VMs don't have a PIT,
++ * and setting this value has no effect.
++ */
++ i8253_clear_counter_on_shutdown = false;
++
+ #if IS_ENABLED(CONFIG_HYPERV)
+ /*
+ * Setup the hook to get control post apic initialization.
+diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
+index 8e005329648b..d805202c63cd 100644
+--- a/arch/x86/kernel/cpu/vmware.c
++++ b/arch/x86/kernel/cpu/vmware.c
+@@ -77,7 +77,7 @@ static __init int setup_vmw_sched_clock(char *s)
+ }
+ early_param("no-vmw-sched-clock", setup_vmw_sched_clock);
+
+-static unsigned long long vmware_sched_clock(void)
++static unsigned long long notrace vmware_sched_clock(void)
+ {
+ unsigned long long ns;
+
+diff --git a/arch/x86/um/shared/sysdep/ptrace_32.h b/arch/x86/um/shared/sysdep/ptrace_32.h
+index b94a108de1dc..ae00d22bce02 100644
+--- a/arch/x86/um/shared/sysdep/ptrace_32.h
++++ b/arch/x86/um/shared/sysdep/ptrace_32.h
+@@ -10,20 +10,10 @@
+
+ static inline void update_debugregs(int seq) {}
+
+-/* syscall emulation path in ptrace */
+-
+-#ifndef PTRACE_SYSEMU
+-#define PTRACE_SYSEMU 31
+-#endif
+-
+ void set_using_sysemu(int value);
+ int get_using_sysemu(void);
+ extern int sysemu_supported;
+
+-#ifndef PTRACE_SYSEMU_SINGLESTEP
+-#define PTRACE_SYSEMU_SINGLESTEP 32
+-#endif
+-
+ #define UPT_SYSCALL_ARG1(r) UPT_BX(r)
+ #define UPT_SYSCALL_ARG2(r) UPT_CX(r)
+ #define UPT_SYSCALL_ARG3(r) UPT_DX(r)
+diff --git a/arch/xtensa/boot/Makefile b/arch/xtensa/boot/Makefile
+index dc9e0ba7122c..294846117fc2 100644
+--- a/arch/xtensa/boot/Makefile
++++ b/arch/xtensa/boot/Makefile
+@@ -33,7 +33,7 @@ uImage: $(obj)/uImage
+ boot-elf boot-redboot: $(addprefix $(obj)/,$(subdir-y))
+ $(Q)$(MAKE) $(build)=$(obj)/$@ $(MAKECMDGOALS)
+
+-OBJCOPYFLAGS = --strip-all -R .comment -R .note.gnu.build-id -O binary
++OBJCOPYFLAGS = --strip-all -R .comment -R .notes -O binary
+
+ vmlinux.bin: vmlinux FORCE
+ $(call if_changed,objcopy)
+diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h
+index e4ccb88b7996..677bc76c1d70 100644
+--- a/arch/xtensa/include/asm/processor.h
++++ b/arch/xtensa/include/asm/processor.h
+@@ -23,7 +23,11 @@
+ # error Linux requires the Xtensa Windowed Registers Option.
+ #endif
+
+-#define ARCH_SLAB_MINALIGN XCHAL_DATA_WIDTH
++/* Xtensa ABI requires stack alignment to be at least 16 */
++
++#define STACK_ALIGN (XCHAL_DATA_WIDTH > 16 ? XCHAL_DATA_WIDTH : 16)
++
++#define ARCH_SLAB_MINALIGN STACK_ALIGN
+
+ /*
+ * User space process size: 1 GB.
+diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
+index 2f76118ecf62..9053a5622d2c 100644
+--- a/arch/xtensa/kernel/head.S
++++ b/arch/xtensa/kernel/head.S
+@@ -88,9 +88,12 @@ _SetupMMU:
+ initialize_mmu
+ #if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY
+ rsr a2, excsave1
+- movi a3, 0x08000000
++ movi a3, XCHAL_KSEG_PADDR
++ bltu a2, a3, 1f
++ sub a2, a2, a3
++ movi a3, XCHAL_KSEG_SIZE
+ bgeu a2, a3, 1f
+- movi a3, 0xd0000000
++ movi a3, XCHAL_KSEG_CACHED_VADDR
+ add a2, a2, a3
+ wsr a2, excsave1
+ 1:
+diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S
+index a1c3edb8ad56..fa926995d2a3 100644
+--- a/arch/xtensa/kernel/vmlinux.lds.S
++++ b/arch/xtensa/kernel/vmlinux.lds.S
+@@ -131,6 +131,7 @@ SECTIONS
+ .fixup : { *(.fixup) }
+
+ EXCEPTION_TABLE(16)
++ NOTES
+ /* Data section */
+
+ _sdata = .;
+diff --git a/block/blk-core.c b/block/blk-core.c
+index cff0a60ee200..eb8b52241453 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -793,9 +793,8 @@ void blk_cleanup_queue(struct request_queue *q)
+ * dispatch may still be in-progress since we dispatch requests
+ * from more than one contexts.
+ *
+- * No need to quiesce queue if it isn't initialized yet since
+- * blk_freeze_queue() should be enough for cases of passthrough
+- * request.
++ * We rely on driver to deal with the race in case that queue
++ * initialization isn't done.
+ */
+ if (q->mq_ops && blk_queue_init_done(q))
+ blk_mq_quiesce_queue(q);
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index 0e89b5457cab..ceeb2eaf28cf 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -83,7 +83,7 @@ static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_cipher rcipher;
+
+- strlcpy(rcipher.type, "cipher", sizeof(rcipher.type));
++ strncpy(rcipher.type, "cipher", sizeof(rcipher.type));
+
+ rcipher.blocksize = alg->cra_blocksize;
+ rcipher.min_keysize = alg->cra_cipher.cia_min_keysize;
+@@ -102,7 +102,7 @@ static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_comp rcomp;
+
+- strlcpy(rcomp.type, "compression", sizeof(rcomp.type));
++ strncpy(rcomp.type, "compression", sizeof(rcomp.type));
+ if (nla_put(skb, CRYPTOCFGA_REPORT_COMPRESS,
+ sizeof(struct crypto_report_comp), &rcomp))
+ goto nla_put_failure;
+@@ -116,7 +116,7 @@ static int crypto_report_acomp(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_acomp racomp;
+
+- strlcpy(racomp.type, "acomp", sizeof(racomp.type));
++ strncpy(racomp.type, "acomp", sizeof(racomp.type));
+
+ if (nla_put(skb, CRYPTOCFGA_REPORT_ACOMP,
+ sizeof(struct crypto_report_acomp), &racomp))
+@@ -131,7 +131,7 @@ static int crypto_report_akcipher(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_akcipher rakcipher;
+
+- strlcpy(rakcipher.type, "akcipher", sizeof(rakcipher.type));
++ strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type));
+
+ if (nla_put(skb, CRYPTOCFGA_REPORT_AKCIPHER,
+ sizeof(struct crypto_report_akcipher), &rakcipher))
+@@ -146,7 +146,7 @@ static int crypto_report_kpp(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_kpp rkpp;
+
+- strlcpy(rkpp.type, "kpp", sizeof(rkpp.type));
++ strncpy(rkpp.type, "kpp", sizeof(rkpp.type));
+
+ if (nla_put(skb, CRYPTOCFGA_REPORT_KPP,
+ sizeof(struct crypto_report_kpp), &rkpp))
+@@ -160,10 +160,10 @@ nla_put_failure:
+ static int crypto_report_one(struct crypto_alg *alg,
+ struct crypto_user_alg *ualg, struct sk_buff *skb)
+ {
+- strlcpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
+- strlcpy(ualg->cru_driver_name, alg->cra_driver_name,
++ strncpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
++ strncpy(ualg->cru_driver_name, alg->cra_driver_name,
+ sizeof(ualg->cru_driver_name));
+- strlcpy(ualg->cru_module_name, module_name(alg->cra_module),
++ strncpy(ualg->cru_module_name, module_name(alg->cra_module),
+ sizeof(ualg->cru_module_name));
+
+ ualg->cru_type = 0;
+@@ -176,7 +176,7 @@ static int crypto_report_one(struct crypto_alg *alg,
+ if (alg->cra_flags & CRYPTO_ALG_LARVAL) {
+ struct crypto_report_larval rl;
+
+- strlcpy(rl.type, "larval", sizeof(rl.type));
++ strncpy(rl.type, "larval", sizeof(rl.type));
+ if (nla_put(skb, CRYPTOCFGA_REPORT_LARVAL,
+ sizeof(struct crypto_report_larval), &rl))
+ goto nla_put_failure;
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index 78f9de260d5f..e9fb0bf3c8d2 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -417,10 +417,6 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
+- status = acpi_ut_add_address_range(obj_desc->region.space_id,
+- obj_desc->region.address,
+- obj_desc->region.length, node);
+-
+ /* Now the address and length are valid for this opregion */
+
+ obj_desc->region.flags |= AOPOBJ_DATA_VALID;
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 19b641208d86..c5d15752dfb3 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2845,9 +2845,9 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc)
+ return rc;
+
+ if (ars_status_process_records(acpi_desc))
+- return -ENOMEM;
++ dev_err(acpi_desc->dev, "Failed to process ARS records\n");
+
+- return 0;
++ return rc;
+ }
+
+ static int ars_register(struct acpi_nfit_desc *acpi_desc,
+diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
+index e9626bf6ca29..d6c1b10f6c25 100644
+--- a/drivers/acpi/nfit/mce.c
++++ b/drivers/acpi/nfit/mce.c
+@@ -25,8 +25,12 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
+ struct acpi_nfit_desc *acpi_desc;
+ struct nfit_spa *nfit_spa;
+
+- /* We only care about memory errors */
+- if (!mce_is_memory_error(mce))
++ /* We only care about uncorrectable memory errors */
++ if (!mce_is_memory_error(mce) || mce_is_correctable(mce))
++ return NOTIFY_DONE;
++
++ /* Verify the address reported in the MCE is valid. */
++ if (!mce_usable_address(mce))
+ return NOTIFY_DONE;
+
+ /*
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 6e594644cb1d..a7f5202a4815 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4553,7 +4553,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ /* These specific Samsung models/firmware-revs do not handle LPM well */
+ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
+ { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM, },
+- { "SAMSUNG MZ7TD256HAFV-000L9", "DXT02L5Q", ATA_HORKAGE_NOLPM, },
++ { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM, },
+
+ /* devices that don't properly handle queued TRIM commands */
+ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index a1d6b5597c17..66921427d109 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -1636,6 +1636,11 @@ static const struct attribute_group zram_disk_attr_group = {
+ .attrs = zram_disk_attrs,
+ };
+
++static const struct attribute_group *zram_disk_attr_groups[] = {
++ &zram_disk_attr_group,
++ NULL,
++};
++
+ /*
+ * Allocate and initialize new zram device. the function returns
+ * '>= 0' device_id upon success, and negative value otherwise.
+@@ -1716,24 +1721,15 @@ static int zram_add(void)
+
+ zram->disk->queue->backing_dev_info->capabilities |=
+ (BDI_CAP_STABLE_WRITES | BDI_CAP_SYNCHRONOUS_IO);
++ disk_to_dev(zram->disk)->groups = zram_disk_attr_groups;
+ add_disk(zram->disk);
+
+- ret = sysfs_create_group(&disk_to_dev(zram->disk)->kobj,
+- &zram_disk_attr_group);
+- if (ret < 0) {
+- pr_err("Error creating sysfs group for device %d\n",
+- device_id);
+- goto out_free_disk;
+- }
+ strlcpy(zram->compressor, default_compressor, sizeof(zram->compressor));
+
+ zram_debugfs_register(zram);
+ pr_info("Added device: %s\n", zram->disk->disk_name);
+ return device_id;
+
+-out_free_disk:
+- del_gendisk(zram->disk);
+- put_disk(zram->disk);
+ out_free_queue:
+ blk_cleanup_queue(queue);
+ out_free_idr:
+@@ -1762,16 +1758,6 @@ static int zram_remove(struct zram *zram)
+ mutex_unlock(&bdev->bd_mutex);
+
+ zram_debugfs_unregister(zram);
+- /*
+- * Remove sysfs first, so no one will perform a disksize
+- * store while we destroy the devices. This also helps during
+- * hot_remove -- zram_reset_device() is the last holder of
+- * ->init_lock, no later/concurrent disksize_store() or any
+- * other sysfs handlers are possible.
+- */
+- sysfs_remove_group(&disk_to_dev(zram->disk)->kobj,
+- &zram_disk_attr_group);
+-
+ /* Make sure all the pending I/O are finished */
+ fsync_bdev(bdev);
+ zram_reset_device(zram);
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index a5d5a96479bf..10802d1fc554 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2445,7 +2445,7 @@ static int cdrom_ioctl_select_disc(struct cdrom_device_info *cdi,
+ return -ENOSYS;
+
+ if (arg != CDSL_CURRENT && arg != CDSL_NONE) {
+- if ((int)arg >= cdi->capacity)
++ if (arg >= cdi->capacity)
+ return -EINVAL;
+ }
+
+diff --git a/drivers/clk/at91/clk-pll.c b/drivers/clk/at91/clk-pll.c
+index 72b6091eb7b9..dc7fbc796cb6 100644
+--- a/drivers/clk/at91/clk-pll.c
++++ b/drivers/clk/at91/clk-pll.c
+@@ -133,6 +133,9 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hw,
+ {
+ struct clk_pll *pll = to_clk_pll(hw);
+
++ if (!pll->div || !pll->mul)
++ return 0;
++
+ return (parent_rate / pll->div) * (pll->mul + 1);
+ }
+
+diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
+index d44e0eea31ec..0934d3724495 100644
+--- a/drivers/clk/clk-s2mps11.c
++++ b/drivers/clk/clk-s2mps11.c
+@@ -245,6 +245,36 @@ static const struct platform_device_id s2mps11_clk_id[] = {
+ };
+ MODULE_DEVICE_TABLE(platform, s2mps11_clk_id);
+
++#ifdef CONFIG_OF
++/*
++ * Device is instantiated through parent MFD device and device matching is done
++ * through platform_device_id.
++ *
++ * However if device's DT node contains proper clock compatible and driver is
++ * built as a module, then the *module* matching will be done trough DT aliases.
++ * This requires of_device_id table. In the same time this will not change the
++ * actual *device* matching so do not add .of_match_table.
++ */
++static const struct of_device_id s2mps11_dt_match[] = {
++ {
++ .compatible = "samsung,s2mps11-clk",
++ .data = (void *)S2MPS11X,
++ }, {
++ .compatible = "samsung,s2mps13-clk",
++ .data = (void *)S2MPS13X,
++ }, {
++ .compatible = "samsung,s2mps14-clk",
++ .data = (void *)S2MPS14X,
++ }, {
++ .compatible = "samsung,s5m8767-clk",
++ .data = (void *)S5M8767X,
++ }, {
++ /* Sentinel */
++ },
++};
++MODULE_DEVICE_TABLE(of, s2mps11_dt_match);
++#endif
++
+ static struct platform_driver s2mps11_clk_driver = {
+ .driver = {
+ .name = "s2mps11-clk",
+diff --git a/drivers/clk/hisilicon/reset.c b/drivers/clk/hisilicon/reset.c
+index 2a5015c736ce..43e82fa64422 100644
+--- a/drivers/clk/hisilicon/reset.c
++++ b/drivers/clk/hisilicon/reset.c
+@@ -109,9 +109,8 @@ struct hisi_reset_controller *hisi_reset_init(struct platform_device *pdev)
+ return NULL;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- rstc->membase = devm_ioremap(&pdev->dev,
+- res->start, resource_size(res));
+- if (!rstc->membase)
++ rstc->membase = devm_ioremap_resource(&pdev->dev, res);
++ if (IS_ERR(rstc->membase))
+ return NULL;
+
+ spin_lock_init(&rstc->lock);
+diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
+index 00ce62ad6416..8cf74fc423e6 100644
+--- a/drivers/clk/meson/axg.c
++++ b/drivers/clk/meson/axg.c
+@@ -319,6 +319,7 @@ static struct clk_regmap axg_fclk_div2 = {
+ .ops = &clk_regmap_gate_ops,
+ .parent_names = (const char *[]){ "fclk_div2_div" },
+ .num_parents = 1,
++ .flags = CLK_IS_CRITICAL,
+ },
+ };
+
+@@ -343,6 +344,18 @@ static struct clk_regmap axg_fclk_div3 = {
+ .ops = &clk_regmap_gate_ops,
+ .parent_names = (const char *[]){ "fclk_div3_div" },
+ .num_parents = 1,
++ /*
++ * FIXME:
++ * This clock, as fdiv2, is used by the SCPI FW and is required
++ * by the platform to operate correctly.
++ * Until the following condition are met, we need this clock to
++ * be marked as critical:
++ * a) The SCPI generic driver claims and enable all the clocks
++ * it needs
++ * b) CCF has a clock hand-off mechanism to make the sure the
++ * clock stays on until the proper driver comes along
++ */
++ .flags = CLK_IS_CRITICAL,
+ },
+ };
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 86d3ae58e84c..6435d86118f1 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -522,6 +522,18 @@ static struct clk_regmap gxbb_fclk_div3 = {
+ .ops = &clk_regmap_gate_ops,
+ .parent_names = (const char *[]){ "fclk_div3_div" },
+ .num_parents = 1,
++ /*
++ * FIXME:
++ * This clock, as fdiv2, is used by the SCPI FW and is required
++ * by the platform to operate correctly.
++ * Until the following condition are met, we need this clock to
++ * be marked as critical:
++ * a) The SCPI generic driver claims and enable all the clocks
++ * it needs
++ * b) CCF has a clock hand-off mechanism to make the sure the
++ * clock stays on until the proper driver comes along
++ */
++ .flags = CLK_IS_CRITICAL,
+ },
+ };
+
+diff --git a/drivers/clk/rockchip/clk-ddr.c b/drivers/clk/rockchip/clk-ddr.c
+index e8075359366b..ebce5260068b 100644
+--- a/drivers/clk/rockchip/clk-ddr.c
++++ b/drivers/clk/rockchip/clk-ddr.c
+@@ -80,16 +80,12 @@ static long rockchip_ddrclk_sip_round_rate(struct clk_hw *hw,
+ static u8 rockchip_ddrclk_get_parent(struct clk_hw *hw)
+ {
+ struct rockchip_ddrclk *ddrclk = to_rockchip_ddrclk_hw(hw);
+- int num_parents = clk_hw_get_num_parents(hw);
+ u32 val;
+
+ val = clk_readl(ddrclk->reg_base +
+ ddrclk->mux_offset) >> ddrclk->mux_shift;
+ val &= GENMASK(ddrclk->mux_width - 1, 0);
+
+- if (val >= num_parents)
+- return -EINVAL;
+-
+ return val;
+ }
+
+diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c
+index 252366a5231f..2c5426607790 100644
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -813,22 +813,22 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+ MMC(SCLK_SDMMC_DRV, "sdmmc_drv", "clk_sdmmc",
+ RK3328_SDMMC_CON0, 1),
+ MMC(SCLK_SDMMC_SAMPLE, "sdmmc_sample", "clk_sdmmc",
+- RK3328_SDMMC_CON1, 1),
++ RK3328_SDMMC_CON1, 0),
+
+ MMC(SCLK_SDIO_DRV, "sdio_drv", "clk_sdio",
+ RK3328_SDIO_CON0, 1),
+ MMC(SCLK_SDIO_SAMPLE, "sdio_sample", "clk_sdio",
+- RK3328_SDIO_CON1, 1),
++ RK3328_SDIO_CON1, 0),
+
+ MMC(SCLK_EMMC_DRV, "emmc_drv", "clk_emmc",
+ RK3328_EMMC_CON0, 1),
+ MMC(SCLK_EMMC_SAMPLE, "emmc_sample", "clk_emmc",
+- RK3328_EMMC_CON1, 1),
++ RK3328_EMMC_CON1, 0),
+
+ MMC(SCLK_SDMMC_EXT_DRV, "sdmmc_ext_drv", "clk_sdmmc_ext",
+ RK3328_SDMMC_EXT_CON0, 1),
+ MMC(SCLK_SDMMC_EXT_SAMPLE, "sdmmc_ext_sample", "clk_sdmmc_ext",
+- RK3328_SDMMC_EXT_CON1, 1),
++ RK3328_SDMMC_EXT_CON1, 0),
+ };
+
+ static const char *const rk3328_critical_clocks[] __initconst = {
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+index bdbfe78fe133..0f7a0ffd3f70 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+@@ -224,7 +224,7 @@ static SUNXI_CCU_MP_WITH_MUX(psi_ahb1_ahb2_clk, "psi-ahb1-ahb2",
+ psi_ahb1_ahb2_parents,
+ 0x510,
+ 0, 5, /* M */
+- 16, 2, /* P */
++ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+@@ -233,19 +233,19 @@ static const char * const ahb3_apb1_apb2_parents[] = { "osc24M", "osc32k",
+ "pll-periph0" };
+ static SUNXI_CCU_MP_WITH_MUX(ahb3_clk, "ahb3", ahb3_apb1_apb2_parents, 0x51c,
+ 0, 5, /* M */
+- 16, 2, /* P */
++ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+ static SUNXI_CCU_MP_WITH_MUX(apb1_clk, "apb1", ahb3_apb1_apb2_parents, 0x520,
+ 0, 5, /* M */
+- 16, 2, /* P */
++ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+ static SUNXI_CCU_MP_WITH_MUX(apb2_clk, "apb2", ahb3_apb1_apb2_parents, 0x524,
+ 0, 5, /* M */
+- 16, 2, /* P */
++ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+diff --git a/drivers/clocksource/i8253.c b/drivers/clocksource/i8253.c
+index 9c38895542f4..d4350bb10b83 100644
+--- a/drivers/clocksource/i8253.c
++++ b/drivers/clocksource/i8253.c
+@@ -20,6 +20,13 @@
+ DEFINE_RAW_SPINLOCK(i8253_lock);
+ EXPORT_SYMBOL(i8253_lock);
+
++/*
++ * Handle PIT quirk in pit_shutdown() where zeroing the counter register
++ * restarts the PIT, negating the shutdown. On platforms with the quirk,
++ * platform specific code can set this to false.
++ */
++bool i8253_clear_counter_on_shutdown __ro_after_init = true;
++
+ #ifdef CONFIG_CLKSRC_I8253
+ /*
+ * Since the PIT overflows every tick, its not very useful
+@@ -109,8 +116,11 @@ static int pit_shutdown(struct clock_event_device *evt)
+ raw_spin_lock(&i8253_lock);
+
+ outb_p(0x30, PIT_MODE);
+- outb_p(0, PIT_CH0);
+- outb_p(0, PIT_CH0);
++
++ if (i8253_clear_counter_on_shutdown) {
++ outb_p(0, PIT_CH0);
++ outb_p(0, PIT_CH0);
++ }
+
+ raw_spin_unlock(&i8253_lock);
+ return 0;
+diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c
+index 073557f433eb..df564d783216 100644
+--- a/drivers/cpuidle/cpuidle-arm.c
++++ b/drivers/cpuidle/cpuidle-arm.c
+@@ -103,13 +103,6 @@ static int __init arm_idle_init_cpu(int cpu)
+ goto out_kfree_drv;
+ }
+
+- ret = cpuidle_register_driver(drv);
+- if (ret) {
+- if (ret != -EBUSY)
+- pr_err("Failed to register cpuidle driver\n");
+- goto out_kfree_drv;
+- }
+-
+ /*
+ * Call arch CPU operations in order to initialize
+ * idle states suspend back-end specific data
+@@ -117,15 +110,20 @@ static int __init arm_idle_init_cpu(int cpu)
+ ret = arm_cpuidle_init(cpu);
+
+ /*
+- * Skip the cpuidle device initialization if the reported
++ * Allow the initialization to continue for other CPUs, if the reported
+ * failure is a HW misconfiguration/breakage (-ENXIO).
+ */
+- if (ret == -ENXIO)
+- return 0;
+-
+ if (ret) {
+ pr_err("CPU %d failed to init idle CPU ops\n", cpu);
+- goto out_unregister_drv;
++ ret = ret == -ENXIO ? 0 : ret;
++ goto out_kfree_drv;
++ }
++
++ ret = cpuidle_register_driver(drv);
++ if (ret) {
++ if (ret != -EBUSY)
++ pr_err("Failed to register cpuidle driver\n");
++ goto out_kfree_drv;
+ }
+
+ dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c
+index f7d6d690116e..cdc4f9a171d9 100644
+--- a/drivers/crypto/hisilicon/sec/sec_algs.c
++++ b/drivers/crypto/hisilicon/sec/sec_algs.c
+@@ -732,6 +732,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ int *splits_in_nents;
+ int *splits_out_nents = NULL;
+ struct sec_request_el *el, *temp;
++ bool split = skreq->src != skreq->dst;
+
+ mutex_init(&sec_req->lock);
+ sec_req->req_base = &skreq->base;
+@@ -750,7 +751,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ if (ret)
+ goto err_free_split_sizes;
+
+- if (skreq->src != skreq->dst) {
++ if (split) {
+ sec_req->len_out = sg_nents(skreq->dst);
+ ret = sec_map_and_split_sg(skreq->dst, split_sizes, steps,
+ &splits_out, &splits_out_nents,
+@@ -785,8 +786,9 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ split_sizes[i],
+ skreq->src != skreq->dst,
+ splits_in[i], splits_in_nents[i],
+- splits_out[i],
+- splits_out_nents[i], info);
++ split ? splits_out[i] : NULL,
++ split ? splits_out_nents[i] : 0,
++ info);
+ if (IS_ERR(el)) {
+ ret = PTR_ERR(el);
+ goto err_free_elements;
+@@ -806,13 +808,6 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ * more refined but this is unlikely to happen so no need.
+ */
+
+- /* Cleanup - all elements in pointer arrays have been coppied */
+- kfree(splits_in_nents);
+- kfree(splits_in);
+- kfree(splits_out_nents);
+- kfree(splits_out);
+- kfree(split_sizes);
+-
+ /* Grab a big lock for a long time to avoid concurrency issues */
+ mutex_lock(&queue->queuelock);
+
+@@ -827,13 +822,13 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ (!queue->havesoftqueue ||
+ kfifo_avail(&queue->softqueue) > steps)) ||
+ !list_empty(&ctx->backlog)) {
++ ret = -EBUSY;
+ if ((skreq->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) {
+ list_add_tail(&sec_req->backlog_head, &ctx->backlog);
+ mutex_unlock(&queue->queuelock);
+- return -EBUSY;
++ goto out;
+ }
+
+- ret = -EBUSY;
+ mutex_unlock(&queue->queuelock);
+ goto err_free_elements;
+ }
+@@ -842,7 +837,15 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ if (ret)
+ goto err_free_elements;
+
+- return -EINPROGRESS;
++ ret = -EINPROGRESS;
++out:
++ /* Cleanup - all elements in pointer arrays have been copied */
++ kfree(splits_in_nents);
++ kfree(splits_in);
++ kfree(splits_out_nents);
++ kfree(splits_out);
++ kfree(split_sizes);
++ return ret;
+
+ err_free_elements:
+ list_for_each_entry_safe(el, temp, &sec_req->elements, head) {
+@@ -854,7 +857,7 @@ err_free_elements:
+ crypto_skcipher_ivsize(atfm),
+ DMA_BIDIRECTIONAL);
+ err_unmap_out_sg:
+- if (skreq->src != skreq->dst)
++ if (split)
+ sec_unmap_sg_on_err(skreq->dst, steps, splits_out,
+ splits_out_nents, sec_req->len_out,
+ info->dev);
+diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
+index 8830fa601e45..0c0d2312f4a8 100644
+--- a/drivers/firmware/efi/libstub/fdt.c
++++ b/drivers/firmware/efi/libstub/fdt.c
+@@ -158,6 +158,10 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt,
+ return efi_status;
+ }
+ }
++
++ /* shrink the FDT back to its minimum size */
++ fdt_pack(fdt);
++
+ return EFI_SUCCESS;
+
+ fdt_set_fail:
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+index 353993218f21..f008804f0b97 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+@@ -358,7 +358,9 @@ out:
+ *
+ * Checks the acpi event and if it matches an atif event,
+ * handles it.
+- * Returns NOTIFY code
++ *
++ * Returns:
++ * NOTIFY_BAD or NOTIFY_DONE, depending on the event.
+ */
+ static int amdgpu_atif_handler(struct amdgpu_device *adev,
+ struct acpi_bus_event *event)
+@@ -372,11 +374,16 @@ static int amdgpu_atif_handler(struct amdgpu_device *adev,
+ if (strcmp(event->device_class, ACPI_VIDEO_CLASS) != 0)
+ return NOTIFY_DONE;
+
++ /* Is this actually our event? */
+ if (!atif ||
+ !atif->notification_cfg.enabled ||
+- event->type != atif->notification_cfg.command_code)
+- /* Not our event */
+- return NOTIFY_DONE;
++ event->type != atif->notification_cfg.command_code) {
++ /* These events will generate keypresses otherwise */
++ if (event->type == ACPI_VIDEO_NOTIFY_PROBE)
++ return NOTIFY_BAD;
++ else
++ return NOTIFY_DONE;
++ }
+
+ if (atif->functions.sbios_requests) {
+ struct atif_sbios_requests req;
+@@ -385,7 +392,7 @@ static int amdgpu_atif_handler(struct amdgpu_device *adev,
+ count = amdgpu_atif_get_sbios_requests(atif, &req);
+
+ if (count <= 0)
+- return NOTIFY_DONE;
++ return NOTIFY_BAD;
+
+ DRM_DEBUG_DRIVER("ATIF: %d pending SBIOS requests\n", count);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+index d472a2c8399f..b80243d3972e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+@@ -67,7 +67,8 @@ int amdgpu_bo_list_create(struct amdgpu_device *adev, struct drm_file *filp,
+ unsigned i;
+ int r;
+
+- if (num_entries > SIZE_MAX / sizeof(struct amdgpu_bo_list_entry))
++ if (num_entries > (SIZE_MAX - sizeof(struct amdgpu_bo_list))
++ / sizeof(struct amdgpu_bo_list_entry))
+ return -EINVAL;
+
+ size = sizeof(struct amdgpu_bo_list);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
+index 3a072a7a39f0..df9b173c3d0b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
+@@ -574,7 +574,7 @@ void amdgpu_vmid_mgr_init(struct amdgpu_device *adev)
+ /* skip over VMID 0, since it is the system VM */
+ for (j = 1; j < id_mgr->num_ids; ++j) {
+ amdgpu_vmid_reset(adev, i, j);
+- amdgpu_sync_create(&id_mgr->ids[i].active);
++ amdgpu_sync_create(&id_mgr->ids[j].active);
+ list_add_tail(&id_mgr->ids[j].list, &id_mgr->ids_lru);
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+index 391e2f7c03aa..f823d4baf044 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+@@ -66,6 +66,7 @@ int amdgpu_job_alloc(struct amdgpu_device *adev, unsigned num_ibs,
+ amdgpu_sync_create(&(*job)->sync);
+ amdgpu_sync_create(&(*job)->sched_sync);
+ (*job)->vram_lost_counter = atomic_read(&adev->vram_lost_counter);
++ (*job)->vm_pd_addr = AMDGPU_BO_INVALID_OFFSET;
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
+index f55f72a37ca8..c29d519fa381 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
+@@ -277,6 +277,7 @@ amdgpu_ucode_get_load_type(struct amdgpu_device *adev, int load_type)
+ case CHIP_PITCAIRN:
+ case CHIP_VERDE:
+ case CHIP_OLAND:
++ case CHIP_HAINAN:
+ return AMDGPU_FW_LOAD_DIRECT;
+ #endif
+ #ifdef CONFIG_DRM_AMDGPU_CIK
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index b17771dd5ce7..6a84526e20e0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -714,7 +714,8 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_
+ }
+
+ gds_switch_needed &= !!ring->funcs->emit_gds_switch;
+- vm_flush_needed &= !!ring->funcs->emit_vm_flush;
++ vm_flush_needed &= !!ring->funcs->emit_vm_flush &&
++ job->vm_pd_addr != AMDGPU_BO_INVALID_OFFSET;
+ pasid_mapping_needed &= adev->gmc.gmc_funcs->emit_pasid_mapping &&
+ ring->funcs->emit_wreg;
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 6ae050dc3220..9045e6fa0780 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -1120,9 +1120,6 @@ static enum surface_update_type get_plane_info_update_type(const struct dc_surfa
+ */
+ update_flags->bits.bpp_change = 1;
+
+- if (u->gamma && dce_use_lut(u->plane_info->format))
+- update_flags->bits.gamma_change = 1;
+-
+ if (memcmp(&u->plane_info->tiling_info, &u->surface->tiling_info,
+ sizeof(union dc_tiling_info)) != 0) {
+ update_flags->bits.swizzle_change = 1;
+@@ -1139,7 +1136,6 @@ static enum surface_update_type get_plane_info_update_type(const struct dc_surfa
+ if (update_flags->bits.rotation_change
+ || update_flags->bits.stereo_format_change
+ || update_flags->bits.pixel_format_change
+- || update_flags->bits.gamma_change
+ || update_flags->bits.bpp_change
+ || update_flags->bits.bandwidth_change
+ || update_flags->bits.output_tf_change)
+@@ -1229,13 +1225,26 @@ static enum surface_update_type det_surface_update(const struct dc *dc,
+ if (u->coeff_reduction_factor)
+ update_flags->bits.coeff_reduction_change = 1;
+
++ if (u->gamma) {
++ enum surface_pixel_format format = SURFACE_PIXEL_FORMAT_GRPH_BEGIN;
++
++ if (u->plane_info)
++ format = u->plane_info->format;
++ else if (u->surface)
++ format = u->surface->format;
++
++ if (dce_use_lut(format))
++ update_flags->bits.gamma_change = 1;
++ }
++
+ if (update_flags->bits.in_transfer_func_change) {
+ type = UPDATE_TYPE_MED;
+ elevate_update_type(&overall_type, type);
+ }
+
+ if (update_flags->bits.input_csc_change
+- || update_flags->bits.coeff_reduction_change) {
++ || update_flags->bits.coeff_reduction_change
++ || update_flags->bits.gamma_change) {
+ type = UPDATE_TYPE_FULL;
+ elevate_update_type(&overall_type, type);
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clocks.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clocks.c
+index fb1f373d08a1..e798241fae37 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clocks.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clocks.c
+@@ -466,6 +466,9 @@ static void dce12_update_clocks(struct dccg *dccg,
+ {
+ struct dm_pp_clock_for_voltage_req clock_voltage_req = {0};
+
++ /* TODO: Investigate why this is needed to fix display corruption. */
++ new_clocks->dispclk_khz = new_clocks->dispclk_khz * 115 / 100;
++
+ if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, dccg->clks.dispclk_khz)) {
+ clock_voltage_req.clk_type = DM_PP_CLOCK_TYPE_DISPLAY_CLK;
+ clock_voltage_req.clocks_in_khz = new_clocks->dispclk_khz;
+diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+index bf29733958c3..962900932bee 100644
+--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
++++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+@@ -1069,10 +1069,14 @@ static void build_evenly_distributed_points(
+ struct dividers dividers)
+ {
+ struct gamma_pixel *p = points;
+- struct gamma_pixel *p_last = p + numberof_points - 1;
++ struct gamma_pixel *p_last;
+
+ uint32_t i = 0;
+
++ // This function should not gets called with 0 as a parameter
++ ASSERT(numberof_points > 0);
++ p_last = p + numberof_points - 1;
++
+ do {
+ struct fixed31_32 value = dc_fixpt_from_fraction(i,
+ numberof_points - 1);
+@@ -1083,7 +1087,7 @@ static void build_evenly_distributed_points(
+
+ ++p;
+ ++i;
+- } while (i != numberof_points);
++ } while (i < numberof_points);
+
+ p->r = dc_fixpt_div(p_last->r, dividers.divider1);
+ p->g = dc_fixpt_div(p_last->g, dividers.divider1);
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+index 0adfc5392cd3..c9a15baf2c10 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+@@ -1222,14 +1222,17 @@ static int smu8_dpm_force_dpm_level(struct pp_hwmgr *hwmgr,
+
+ static int smu8_dpm_powerdown_uvd(struct pp_hwmgr *hwmgr)
+ {
+- if (PP_CAP(PHM_PlatformCaps_UVDPowerGating))
++ if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) {
++ smu8_nbdpm_pstate_enable_disable(hwmgr, true, true);
+ return smum_send_msg_to_smc(hwmgr, PPSMC_MSG_UVDPowerOFF);
++ }
+ return 0;
+ }
+
+ static int smu8_dpm_powerup_uvd(struct pp_hwmgr *hwmgr)
+ {
+ if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) {
++ smu8_nbdpm_pstate_enable_disable(hwmgr, false, true);
+ return smum_send_msg_to_smc_with_parameter(
+ hwmgr,
+ PPSMC_MSG_UVDPowerON,
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+index fbe3ef4ee45c..924788772b07 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+@@ -2268,11 +2268,13 @@ static uint32_t ci_get_offsetof(uint32_t type, uint32_t member)
+ case DRAM_LOG_BUFF_SIZE:
+ return offsetof(SMU7_SoftRegisters, DRAM_LOG_BUFF_SIZE);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU7_Discrete_DpmTable, LowSclkInterruptT);
+ }
++ break;
+ }
+ pr_debug("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c
+index 18048f8e2f13..40df5c2706cc 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c
+@@ -2330,6 +2330,7 @@ static uint32_t fiji_get_offsetof(uint32_t type, uint32_t member)
+ case DRAM_LOG_BUFF_SIZE:
+ return offsetof(SMU73_SoftRegisters, DRAM_LOG_BUFF_SIZE);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2339,6 +2340,7 @@ static uint32_t fiji_get_offsetof(uint32_t type, uint32_t member)
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU73_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c
+index 9299b93aa09a..302ca7745723 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c
+@@ -2236,11 +2236,13 @@ static uint32_t iceland_get_offsetof(uint32_t type, uint32_t member)
+ case DRAM_LOG_BUFF_SIZE:
+ return offsetof(SMU71_SoftRegisters, DRAM_LOG_BUFF_SIZE);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU71_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c
+index 7dabc6c456e1..697c8d92bd53 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c
+@@ -2618,6 +2618,7 @@ static uint32_t tonga_get_offsetof(uint32_t type, uint32_t member)
+ case DRAM_LOG_BUFF_SIZE:
+ return offsetof(SMU72_SoftRegisters, DRAM_LOG_BUFF_SIZE);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2627,6 +2628,7 @@ static uint32_t tonga_get_offsetof(uint32_t type, uint32_t member)
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU72_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
+index 57420d7caa4e..59113fdd1c1c 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
+@@ -2184,6 +2184,7 @@ static uint32_t vegam_get_offsetof(uint32_t type, uint32_t member)
+ case DRAM_LOG_BUFF_SIZE:
+ return offsetof(SMU75_SoftRegisters, DRAM_LOG_BUFF_SIZE);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2193,6 +2194,7 @@ static uint32_t vegam_get_offsetof(uint32_t type, uint32_t member)
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU75_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 7780567aa669..d708472d93c4 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1274,6 +1274,9 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
+ mutex_lock(&mgr->lock);
+ mstb = mgr->mst_primary;
+
++ if (!mstb)
++ goto out;
++
+ for (i = 0; i < lct - 1; i++) {
+ int shift = (i % 2) ? 0 : 4;
+ int port_num = (rad[i / 2] >> shift) & 0xf;
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index fe9c6c731e87..ee4a5e1221f1 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -30,6 +30,12 @@ struct drm_dmi_panel_orientation_data {
+ int orientation;
+ };
+
++static const struct drm_dmi_panel_orientation_data acer_s1003 = {
++ .width = 800,
++ .height = 1280,
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data asus_t100ha = {
+ .width = 800,
+ .height = 1280,
+@@ -67,7 +73,13 @@ static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = {
+ };
+
+ static const struct dmi_system_id orientation_data[] = {
+- { /* Asus T100HA */
++ { /* Acer One 10 (S1003) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"),
++ },
++ .driver_data = (void *)&acer_s1003,
++ }, { /* Asus T100HA */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"),
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_sched.c b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
+index 69e9b431bf1f..e5a9fae31ab7 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
+@@ -93,7 +93,7 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job)
+ * If the GPU managed to complete this jobs fence, the timout is
+ * spurious. Bail out.
+ */
+- if (fence_completed(gpu, submit->out_fence->seqno))
++ if (dma_fence_is_signaled(submit->out_fence))
+ return;
+
+ /*
+diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+index b92595c477ef..8bd29075ae4e 100644
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+@@ -122,6 +122,7 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
+ hi_fbdev->fb = hibmc_framebuffer_init(priv->dev, &mode_cmd, gobj);
+ if (IS_ERR(hi_fbdev->fb)) {
+ ret = PTR_ERR(hi_fbdev->fb);
++ hi_fbdev->fb = NULL;
+ DRM_ERROR("failed to initialize framebuffer: %d\n", ret);
+ goto out_release_fbi;
+ }
+diff --git a/drivers/gpu/drm/i915/gvt/gtt.h b/drivers/gpu/drm/i915/gvt/gtt.h
+index 7a9b36176efb..bfb6f652b09f 100644
+--- a/drivers/gpu/drm/i915/gvt/gtt.h
++++ b/drivers/gpu/drm/i915/gvt/gtt.h
+@@ -35,7 +35,6 @@
+ #define _GVT_GTT_H_
+
+ #define I915_GTT_PAGE_SHIFT 12
+-#define I915_GTT_PAGE_MASK (~(I915_GTT_PAGE_SIZE - 1))
+
+ struct intel_vgpu_mm;
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index fcc73a6ab503..47cc932e23a7 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1122,11 +1122,7 @@ i915_gem_shmem_pread(struct drm_i915_gem_object *obj,
+ offset = offset_in_page(args->offset);
+ for (idx = args->offset >> PAGE_SHIFT; remain; idx++) {
+ struct page *page = i915_gem_object_get_page(obj, idx);
+- int length;
+-
+- length = remain;
+- if (offset + length > PAGE_SIZE)
+- length = PAGE_SIZE - offset;
++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset);
+
+ ret = shmem_pread(page, offset, length, user_data,
+ page_to_phys(page) & obj_do_bit17_swizzling,
+@@ -1570,11 +1566,7 @@ i915_gem_shmem_pwrite(struct drm_i915_gem_object *obj,
+ offset = offset_in_page(args->offset);
+ for (idx = args->offset >> PAGE_SHIFT; remain; idx++) {
+ struct page *page = i915_gem_object_get_page(obj, idx);
+- int length;
+-
+- length = remain;
+- if (offset + length > PAGE_SIZE)
+- length = PAGE_SIZE - offset;
++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset);
+
+ ret = shmem_pwrite(page, offset, length, user_data,
+ page_to_phys(page) & obj_do_bit17_swizzling,
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index 3f0c612d42e7..679bbae52945 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -458,7 +458,7 @@ eb_validate_vma(struct i915_execbuffer *eb,
+ * any non-page-aligned or non-canonical addresses.
+ */
+ if (unlikely(entry->flags & EXEC_OBJECT_PINNED &&
+- entry->offset != gen8_canonical_addr(entry->offset & PAGE_MASK)))
++ entry->offset != gen8_canonical_addr(entry->offset & I915_GTT_PAGE_MASK)))
+ return -EINVAL;
+
+ /* pad_to_size was once a reserved field, so sanitize it */
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
+index f00c7fbef79e..294a143b85f5 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -1768,7 +1768,7 @@ static void gen6_dump_ppgtt(struct i915_hw_ppgtt *base, struct seq_file *m)
+ if (i == 4)
+ continue;
+
+- seq_printf(m, "\t\t(%03d, %04d) %08lx: ",
++ seq_printf(m, "\t\t(%03d, %04d) %08llx: ",
+ pde, pte,
+ (pde * GEN6_PTES + pte) * PAGE_SIZE);
+ for (i = 0; i < 4; i++) {
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.h b/drivers/gpu/drm/i915/i915_gem_gtt.h
+index 2a116a91420b..680e0dc5db4b 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.h
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.h
+@@ -42,13 +42,15 @@
+ #include "i915_selftest.h"
+ #include "i915_timeline.h"
+
+-#define I915_GTT_PAGE_SIZE_4K BIT(12)
+-#define I915_GTT_PAGE_SIZE_64K BIT(16)
+-#define I915_GTT_PAGE_SIZE_2M BIT(21)
++#define I915_GTT_PAGE_SIZE_4K BIT_ULL(12)
++#define I915_GTT_PAGE_SIZE_64K BIT_ULL(16)
++#define I915_GTT_PAGE_SIZE_2M BIT_ULL(21)
+
+ #define I915_GTT_PAGE_SIZE I915_GTT_PAGE_SIZE_4K
+ #define I915_GTT_MAX_PAGE_SIZE I915_GTT_PAGE_SIZE_2M
+
++#define I915_GTT_PAGE_MASK -I915_GTT_PAGE_SIZE
++
+ #define I915_GTT_MIN_ALIGNMENT I915_GTT_PAGE_SIZE
+
+ #define I915_FENCE_REG_NONE -1
+@@ -662,20 +664,20 @@ int i915_gem_gtt_insert(struct i915_address_space *vm,
+ u64 start, u64 end, unsigned int flags);
+
+ /* Flags used by pin/bind&friends. */
+-#define PIN_NONBLOCK BIT(0)
+-#define PIN_MAPPABLE BIT(1)
+-#define PIN_ZONE_4G BIT(2)
+-#define PIN_NONFAULT BIT(3)
+-#define PIN_NOEVICT BIT(4)
+-
+-#define PIN_MBZ BIT(5) /* I915_VMA_PIN_OVERFLOW */
+-#define PIN_GLOBAL BIT(6) /* I915_VMA_GLOBAL_BIND */
+-#define PIN_USER BIT(7) /* I915_VMA_LOCAL_BIND */
+-#define PIN_UPDATE BIT(8)
+-
+-#define PIN_HIGH BIT(9)
+-#define PIN_OFFSET_BIAS BIT(10)
+-#define PIN_OFFSET_FIXED BIT(11)
++#define PIN_NONBLOCK BIT_ULL(0)
++#define PIN_MAPPABLE BIT_ULL(1)
++#define PIN_ZONE_4G BIT_ULL(2)
++#define PIN_NONFAULT BIT_ULL(3)
++#define PIN_NOEVICT BIT_ULL(4)
++
++#define PIN_MBZ BIT_ULL(5) /* I915_VMA_PIN_OVERFLOW */
++#define PIN_GLOBAL BIT_ULL(6) /* I915_VMA_GLOBAL_BIND */
++#define PIN_USER BIT_ULL(7) /* I915_VMA_LOCAL_BIND */
++#define PIN_UPDATE BIT_ULL(8)
++
++#define PIN_HIGH BIT_ULL(9)
++#define PIN_OFFSET_BIAS BIT_ULL(10)
++#define PIN_OFFSET_FIXED BIT_ULL(11)
+ #define PIN_OFFSET_MASK (-I915_GTT_PAGE_SIZE)
+
+ #endif
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 9e63cd47b60f..5b544cb38148 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -2097,8 +2097,12 @@ enum i915_power_well_id {
+
+ /* ICL PHY DFLEX registers */
+ #define PORT_TX_DFLEXDPMLE1 _MMIO(0x1638C0)
+-#define DFLEXDPMLE1_DPMLETC_MASK(n) (0xf << (4 * (n)))
+-#define DFLEXDPMLE1_DPMLETC(n, x) ((x) << (4 * (n)))
++#define DFLEXDPMLE1_DPMLETC_MASK(tc_port) (0xf << (4 * (tc_port)))
++#define DFLEXDPMLE1_DPMLETC_ML0(tc_port) (1 << (4 * (tc_port)))
++#define DFLEXDPMLE1_DPMLETC_ML1_0(tc_port) (3 << (4 * (tc_port)))
++#define DFLEXDPMLE1_DPMLETC_ML3(tc_port) (8 << (4 * (tc_port)))
++#define DFLEXDPMLE1_DPMLETC_ML3_2(tc_port) (12 << (4 * (tc_port)))
++#define DFLEXDPMLE1_DPMLETC_ML3_0(tc_port) (15 << (4 * (tc_port)))
+
+ /* BXT PHY Ref registers */
+ #define _PORT_REF_DW3_A 0x16218C
+diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
+index 769f3f586661..ee3ca2de983b 100644
+--- a/drivers/gpu/drm/i915/intel_audio.c
++++ b/drivers/gpu/drm/i915/intel_audio.c
+@@ -144,6 +144,9 @@ static const struct {
+ /* HDMI N/CTS table */
+ #define TMDS_297M 297000
+ #define TMDS_296M 296703
++#define TMDS_594M 594000
++#define TMDS_593M 593407
++
+ static const struct {
+ int sample_rate;
+ int clock;
+@@ -164,6 +167,20 @@ static const struct {
+ { 176400, TMDS_297M, 18816, 247500 },
+ { 192000, TMDS_296M, 23296, 281250 },
+ { 192000, TMDS_297M, 20480, 247500 },
++ { 44100, TMDS_593M, 8918, 937500 },
++ { 44100, TMDS_594M, 9408, 990000 },
++ { 48000, TMDS_593M, 5824, 562500 },
++ { 48000, TMDS_594M, 6144, 594000 },
++ { 32000, TMDS_593M, 5824, 843750 },
++ { 32000, TMDS_594M, 3072, 445500 },
++ { 88200, TMDS_593M, 17836, 937500 },
++ { 88200, TMDS_594M, 18816, 990000 },
++ { 96000, TMDS_593M, 11648, 562500 },
++ { 96000, TMDS_594M, 12288, 594000 },
++ { 176400, TMDS_593M, 35672, 937500 },
++ { 176400, TMDS_594M, 37632, 990000 },
++ { 192000, TMDS_593M, 23296, 562500 },
++ { 192000, TMDS_594M, 24576, 594000 },
+ };
+
+ /* get AUD_CONFIG_PIXEL_CLOCK_HDMI_* value for mode */
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index d2951096bca0..3bd44d042a1d 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2754,20 +2754,33 @@ intel_set_plane_visible(struct intel_crtc_state *crtc_state,
+
+ plane_state->base.visible = visible;
+
+- /* FIXME pre-g4x don't work like this */
+- if (visible) {
++ if (visible)
+ crtc_state->base.plane_mask |= drm_plane_mask(&plane->base);
+- crtc_state->active_planes |= BIT(plane->id);
+- } else {
++ else
+ crtc_state->base.plane_mask &= ~drm_plane_mask(&plane->base);
+- crtc_state->active_planes &= ~BIT(plane->id);
+- }
+
+ DRM_DEBUG_KMS("%s active planes 0x%x\n",
+ crtc_state->base.crtc->name,
+ crtc_state->active_planes);
+ }
+
++static void fixup_active_planes(struct intel_crtc_state *crtc_state)
++{
++ struct drm_i915_private *dev_priv = to_i915(crtc_state->base.crtc->dev);
++ struct drm_plane *plane;
++
++ /*
++ * Active_planes aliases if multiple "primary" or cursor planes
++ * have been used on the same (or wrong) pipe. plane_mask uses
++ * unique ids, hence we can use that to reconstruct active_planes.
++ */
++ crtc_state->active_planes = 0;
++
++ drm_for_each_plane_mask(plane, &dev_priv->drm,
++ crtc_state->base.plane_mask)
++ crtc_state->active_planes |= BIT(to_intel_plane(plane)->id);
++}
++
+ static void intel_plane_disable_noatomic(struct intel_crtc *crtc,
+ struct intel_plane *plane)
+ {
+@@ -2777,6 +2790,7 @@ static void intel_plane_disable_noatomic(struct intel_crtc *crtc,
+ to_intel_plane_state(plane->base.state);
+
+ intel_set_plane_visible(crtc_state, plane_state, false);
++ fixup_active_planes(crtc_state);
+
+ if (plane->id == PLANE_PRIMARY)
+ intel_pre_disable_primary_noatomic(&crtc->base);
+@@ -2795,7 +2809,6 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
+ struct drm_i915_gem_object *obj;
+ struct drm_plane *primary = intel_crtc->base.primary;
+ struct drm_plane_state *plane_state = primary->state;
+- struct drm_crtc_state *crtc_state = intel_crtc->base.state;
+ struct intel_plane *intel_plane = to_intel_plane(primary);
+ struct intel_plane_state *intel_state =
+ to_intel_plane_state(plane_state);
+@@ -2885,10 +2898,6 @@ valid_fb:
+ plane_state->fb = fb;
+ plane_state->crtc = &intel_crtc->base;
+
+- intel_set_plane_visible(to_intel_crtc_state(crtc_state),
+- to_intel_plane_state(plane_state),
+- true);
+-
+ atomic_or(to_intel_plane(primary)->frontbuffer_bit,
+ &obj->frontbuffer_bits);
+ }
+@@ -12630,17 +12639,12 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
+ intel_check_cpu_fifo_underruns(dev_priv);
+ intel_check_pch_fifo_underruns(dev_priv);
+
+- if (!new_crtc_state->active) {
+- /*
+- * Make sure we don't call initial_watermarks
+- * for ILK-style watermark updates.
+- *
+- * No clue what this is supposed to achieve.
+- */
+- if (INTEL_GEN(dev_priv) >= 9)
+- dev_priv->display.initial_watermarks(intel_state,
+- to_intel_crtc_state(new_crtc_state));
+- }
++ /* FIXME unify this for all platforms */
++ if (!new_crtc_state->active &&
++ !HAS_GMCH_DISPLAY(dev_priv) &&
++ dev_priv->display.initial_watermarks)
++ dev_priv->display.initial_watermarks(intel_state,
++ to_intel_crtc_state(new_crtc_state));
+ }
+ }
+
+@@ -14573,7 +14577,7 @@ static int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
+ fb->height < SKL_MIN_YUV_420_SRC_H ||
+ (fb->width % 4) != 0 || (fb->height % 4) != 0)) {
+ DRM_DEBUG_KMS("src dimensions not correct for NV12\n");
+- return -EINVAL;
++ goto err;
+ }
+
+ for (i = 0; i < fb->format->num_planes; i++) {
+@@ -15365,17 +15369,6 @@ void i830_disable_pipe(struct drm_i915_private *dev_priv, enum pipe pipe)
+ POSTING_READ(DPLL(pipe));
+ }
+
+-static bool intel_plane_mapping_ok(struct intel_crtc *crtc,
+- struct intel_plane *plane)
+-{
+- enum pipe pipe;
+-
+- if (!plane->get_hw_state(plane, &pipe))
+- return true;
+-
+- return pipe == crtc->pipe;
+-}
+-
+ static void
+ intel_sanitize_plane_mapping(struct drm_i915_private *dev_priv)
+ {
+@@ -15387,13 +15380,20 @@ intel_sanitize_plane_mapping(struct drm_i915_private *dev_priv)
+ for_each_intel_crtc(&dev_priv->drm, crtc) {
+ struct intel_plane *plane =
+ to_intel_plane(crtc->base.primary);
++ struct intel_crtc *plane_crtc;
++ enum pipe pipe;
+
+- if (intel_plane_mapping_ok(crtc, plane))
++ if (!plane->get_hw_state(plane, &pipe))
++ continue;
++
++ if (pipe == crtc->pipe)
+ continue;
+
+ DRM_DEBUG_KMS("%s attached to the wrong pipe, disabling plane\n",
+ plane->base.name);
+- intel_plane_disable_noatomic(crtc, plane);
++
++ plane_crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
++ intel_plane_disable_noatomic(plane_crtc, plane);
+ }
+ }
+
+@@ -15441,13 +15441,9 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc,
+ I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK);
+ }
+
+- /* restore vblank interrupts to correct state */
+- drm_crtc_vblank_reset(&crtc->base);
+ if (crtc->active) {
+ struct intel_plane *plane;
+
+- drm_crtc_vblank_on(&crtc->base);
+-
+ /* Disable everything but the primary plane */
+ for_each_intel_plane_on_crtc(dev, crtc, plane) {
+ const struct intel_plane_state *plane_state =
+@@ -15565,23 +15561,32 @@ void i915_redisable_vga(struct drm_i915_private *dev_priv)
+ }
+
+ /* FIXME read out full plane state for all planes */
+-static void readout_plane_state(struct intel_crtc *crtc)
++static void readout_plane_state(struct drm_i915_private *dev_priv)
+ {
+- struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+- struct intel_crtc_state *crtc_state =
+- to_intel_crtc_state(crtc->base.state);
+ struct intel_plane *plane;
++ struct intel_crtc *crtc;
+
+- for_each_intel_plane_on_crtc(&dev_priv->drm, crtc, plane) {
++ for_each_intel_plane(&dev_priv->drm, plane) {
+ struct intel_plane_state *plane_state =
+ to_intel_plane_state(plane->base.state);
+- enum pipe pipe;
++ struct intel_crtc_state *crtc_state;
++ enum pipe pipe = PIPE_A;
+ bool visible;
+
+ visible = plane->get_hw_state(plane, &pipe);
+
++ crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
++ crtc_state = to_intel_crtc_state(crtc->base.state);
++
+ intel_set_plane_visible(crtc_state, plane_state, visible);
+ }
++
++ for_each_intel_crtc(&dev_priv->drm, crtc) {
++ struct intel_crtc_state *crtc_state =
++ to_intel_crtc_state(crtc->base.state);
++
++ fixup_active_planes(crtc_state);
++ }
+ }
+
+ static void intel_modeset_readout_hw_state(struct drm_device *dev)
+@@ -15613,13 +15618,13 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev)
+ if (crtc_state->base.active)
+ dev_priv->active_crtcs |= 1 << crtc->pipe;
+
+- readout_plane_state(crtc);
+-
+ DRM_DEBUG_KMS("[CRTC:%d:%s] hw state readout: %s\n",
+ crtc->base.base.id, crtc->base.name,
+ enableddisabled(crtc_state->base.active));
+ }
+
++ readout_plane_state(dev_priv);
++
+ for (i = 0; i < dev_priv->num_shared_dpll; i++) {
+ struct intel_shared_dpll *pll = &dev_priv->shared_dplls[i];
+
+@@ -15789,7 +15794,6 @@ intel_modeset_setup_hw_state(struct drm_device *dev,
+ struct drm_modeset_acquire_ctx *ctx)
+ {
+ struct drm_i915_private *dev_priv = to_i915(dev);
+- enum pipe pipe;
+ struct intel_crtc *crtc;
+ struct intel_encoder *encoder;
+ int i;
+@@ -15800,15 +15804,23 @@ intel_modeset_setup_hw_state(struct drm_device *dev,
+ /* HW state is read out, now we need to sanitize this mess. */
+ get_encoder_power_domains(dev_priv);
+
+- intel_sanitize_plane_mapping(dev_priv);
++ /*
++ * intel_sanitize_plane_mapping() may need to do vblank
++ * waits, so we need vblank interrupts restored beforehand.
++ */
++ for_each_intel_crtc(&dev_priv->drm, crtc) {
++ drm_crtc_vblank_reset(&crtc->base);
+
+- for_each_intel_encoder(dev, encoder) {
+- intel_sanitize_encoder(encoder);
++ if (crtc->active)
++ drm_crtc_vblank_on(&crtc->base);
+ }
+
+- for_each_pipe(dev_priv, pipe) {
+- crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
++ intel_sanitize_plane_mapping(dev_priv);
+
++ for_each_intel_encoder(dev, encoder)
++ intel_sanitize_encoder(encoder);
++
++ for_each_intel_crtc(&dev_priv->drm, crtc) {
+ intel_sanitize_crtc(crtc, ctx);
+ intel_dump_pipe_config(crtc, crtc->config,
+ "[setup_hw_state]");
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 1193202766a2..f92079e19de8 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -401,6 +401,22 @@ static bool intel_dp_link_params_valid(struct intel_dp *intel_dp, int link_rate,
+ return true;
+ }
+
++static bool intel_dp_can_link_train_fallback_for_edp(struct intel_dp *intel_dp,
++ int link_rate,
++ uint8_t lane_count)
++{
++ const struct drm_display_mode *fixed_mode =
++ intel_dp->attached_connector->panel.fixed_mode;
++ int mode_rate, max_rate;
++
++ mode_rate = intel_dp_link_required(fixed_mode->clock, 18);
++ max_rate = intel_dp_max_data_rate(link_rate, lane_count);
++ if (mode_rate > max_rate)
++ return false;
++
++ return true;
++}
++
+ int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp,
+ int link_rate, uint8_t lane_count)
+ {
+@@ -410,9 +426,23 @@ int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp,
+ intel_dp->num_common_rates,
+ link_rate);
+ if (index > 0) {
++ if (intel_dp_is_edp(intel_dp) &&
++ !intel_dp_can_link_train_fallback_for_edp(intel_dp,
++ intel_dp->common_rates[index - 1],
++ lane_count)) {
++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n");
++ return 0;
++ }
+ intel_dp->max_link_rate = intel_dp->common_rates[index - 1];
+ intel_dp->max_link_lane_count = lane_count;
+ } else if (lane_count > 1) {
++ if (intel_dp_is_edp(intel_dp) &&
++ !intel_dp_can_link_train_fallback_for_edp(intel_dp,
++ intel_dp_max_common_rate(intel_dp),
++ lane_count >> 1)) {
++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n");
++ return 0;
++ }
+ intel_dp->max_link_rate = intel_dp_max_common_rate(intel_dp);
+ intel_dp->max_link_lane_count = lane_count >> 1;
+ } else {
+@@ -4709,19 +4739,13 @@ intel_dp_long_pulse(struct intel_connector *connector,
+ */
+ status = connector_status_disconnected;
+ goto out;
+- } else {
+- /*
+- * If display is now connected check links status,
+- * there has been known issues of link loss triggering
+- * long pulse.
+- *
+- * Some sinks (eg. ASUS PB287Q) seem to perform some
+- * weird HPD ping pong during modesets. So we can apparently
+- * end up with HPD going low during a modeset, and then
+- * going back up soon after. And once that happens we must
+- * retrain the link to get a picture. That's in case no
+- * userspace component reacted to intermittent HPD dip.
+- */
++ }
++
++ /*
++ * Some external monitors do not signal loss of link synchronization
++ * with an IRQ_HPD, so force a link status check.
++ */
++ if (!intel_dp_is_edp(intel_dp)) {
+ struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base;
+
+ intel_dp_retrain_link(encoder, ctx);
+diff --git a/drivers/gpu/drm/i915/intel_dp_link_training.c b/drivers/gpu/drm/i915/intel_dp_link_training.c
+index 4da6e33c7fa1..329309a085cb 100644
+--- a/drivers/gpu/drm/i915/intel_dp_link_training.c
++++ b/drivers/gpu/drm/i915/intel_dp_link_training.c
+@@ -352,22 +352,14 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
+ return;
+
+ failure_handling:
+- /* Dont fallback and prune modes if its eDP */
+- if (!intel_dp_is_edp(intel_dp)) {
+- DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
+- intel_connector->base.base.id,
+- intel_connector->base.name,
+- intel_dp->link_rate, intel_dp->lane_count);
+- if (!intel_dp_get_link_train_fallback_values(intel_dp,
+- intel_dp->link_rate,
+- intel_dp->lane_count))
+- /* Schedule a Hotplug Uevent to userspace to start modeset */
+- schedule_work(&intel_connector->modeset_retry_work);
+- } else {
+- DRM_ERROR("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
+- intel_connector->base.base.id,
+- intel_connector->base.name,
+- intel_dp->link_rate, intel_dp->lane_count);
+- }
++ DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
++ intel_connector->base.base.id,
++ intel_connector->base.name,
++ intel_dp->link_rate, intel_dp->lane_count);
++ if (!intel_dp_get_link_train_fallback_values(intel_dp,
++ intel_dp->link_rate,
++ intel_dp->lane_count))
++ /* Schedule a Hotplug Uevent to userspace to start modeset */
++ schedule_work(&intel_connector->modeset_retry_work);
+ return;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
+index 4ecd65375603..1fec0c71b4d9 100644
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -38,11 +38,11 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
+ struct intel_dp_mst_encoder *intel_mst = enc_to_mst(&encoder->base);
+ struct intel_digital_port *intel_dig_port = intel_mst->primary;
+ struct intel_dp *intel_dp = &intel_dig_port->dp;
+- struct intel_connector *connector =
+- to_intel_connector(conn_state->connector);
++ struct drm_connector *connector = conn_state->connector;
++ void *port = to_intel_connector(connector)->port;
+ struct drm_atomic_state *state = pipe_config->base.state;
+ int bpp;
+- int lane_count, slots;
++ int lane_count, slots = 0;
+ const struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode;
+ int mst_pbn;
+ bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc,
+@@ -70,17 +70,23 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
+
+ pipe_config->port_clock = intel_dp_max_link_rate(intel_dp);
+
+- if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, connector->port))
++ if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, port))
+ pipe_config->has_audio = true;
+
+ mst_pbn = drm_dp_calc_pbn_mode(adjusted_mode->crtc_clock, bpp);
+ pipe_config->pbn = mst_pbn;
+
+- slots = drm_dp_atomic_find_vcpi_slots(state, &intel_dp->mst_mgr,
+- connector->port, mst_pbn);
+- if (slots < 0) {
+- DRM_DEBUG_KMS("failed finding vcpi slots:%d\n", slots);
+- return false;
++ /* Zombie connectors can't have VCPI slots */
++ if (READ_ONCE(connector->registered)) {
++ slots = drm_dp_atomic_find_vcpi_slots(state,
++ &intel_dp->mst_mgr,
++ port,
++ mst_pbn);
++ if (slots < 0) {
++ DRM_DEBUG_KMS("failed finding vcpi slots:%d\n",
++ slots);
++ return false;
++ }
+ }
+
+ intel_link_compute_m_n(bpp, lane_count,
+@@ -311,9 +317,8 @@ static int intel_dp_mst_get_ddc_modes(struct drm_connector *connector)
+ struct edid *edid;
+ int ret;
+
+- if (!intel_dp) {
++ if (!READ_ONCE(connector->registered))
+ return intel_connector_update_modes(connector, NULL);
+- }
+
+ edid = drm_dp_mst_get_edid(connector, &intel_dp->mst_mgr, intel_connector->port);
+ ret = intel_connector_update_modes(connector, edid);
+@@ -328,9 +333,10 @@ intel_dp_mst_detect(struct drm_connector *connector, bool force)
+ struct intel_connector *intel_connector = to_intel_connector(connector);
+ struct intel_dp *intel_dp = intel_connector->mst_port;
+
+- if (!intel_dp)
++ if (!READ_ONCE(connector->registered))
+ return connector_status_disconnected;
+- return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr, intel_connector->port);
++ return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr,
++ intel_connector->port);
+ }
+
+ static void
+@@ -370,7 +376,7 @@ intel_dp_mst_mode_valid(struct drm_connector *connector,
+ int bpp = 24; /* MST uses fixed bpp */
+ int max_rate, mode_rate, max_lanes, max_link_clock;
+
+- if (!intel_dp)
++ if (!READ_ONCE(connector->registered))
+ return MODE_ERROR;
+
+ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+@@ -402,7 +408,7 @@ static struct drm_encoder *intel_mst_atomic_best_encoder(struct drm_connector *c
+ struct intel_dp *intel_dp = intel_connector->mst_port;
+ struct intel_crtc *crtc = to_intel_crtc(state->crtc);
+
+- if (!intel_dp)
++ if (!READ_ONCE(connector->registered))
+ return NULL;
+ return &intel_dp->mst_encoders[crtc->pipe]->base.base;
+ }
+@@ -452,6 +458,10 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
+ if (!intel_connector)
+ return NULL;
+
++ intel_connector->get_hw_state = intel_dp_mst_get_hw_state;
++ intel_connector->mst_port = intel_dp;
++ intel_connector->port = port;
++
+ connector = &intel_connector->base;
+ ret = drm_connector_init(dev, connector, &intel_dp_mst_connector_funcs,
+ DRM_MODE_CONNECTOR_DisplayPort);
+@@ -462,10 +472,6 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
+
+ drm_connector_helper_add(connector, &intel_dp_mst_connector_helper_funcs);
+
+- intel_connector->get_hw_state = intel_dp_mst_get_hw_state;
+- intel_connector->mst_port = intel_dp;
+- intel_connector->port = port;
+-
+ for_each_pipe(dev_priv, pipe) {
+ struct drm_encoder *enc =
+ &intel_dp->mst_encoders[pipe]->base.base;
+@@ -503,7 +509,6 @@ static void intel_dp_register_mst_connector(struct drm_connector *connector)
+ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ struct drm_connector *connector)
+ {
+- struct intel_connector *intel_connector = to_intel_connector(connector);
+ struct drm_i915_private *dev_priv = to_i915(connector->dev);
+
+ DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", connector->base.id, connector->name);
+@@ -512,10 +517,6 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ if (dev_priv->fbdev)
+ drm_fb_helper_remove_one_connector(&dev_priv->fbdev->helper,
+ connector);
+- /* prevent race with the check in ->detect */
+- drm_modeset_lock(&connector->dev->mode_config.connection_mutex, NULL);
+- intel_connector->mst_port = NULL;
+- drm_modeset_unlock(&connector->dev->mode_config.connection_mutex);
+
+ drm_connector_put(connector);
+ }
+diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c
+index 648a13c6043c..9a8018130237 100644
+--- a/drivers/gpu/drm/i915/intel_hotplug.c
++++ b/drivers/gpu/drm/i915/intel_hotplug.c
+@@ -228,7 +228,9 @@ static void intel_hpd_irq_storm_reenable_work(struct work_struct *work)
+ drm_for_each_connector_iter(connector, &conn_iter) {
+ struct intel_connector *intel_connector = to_intel_connector(connector);
+
+- if (intel_connector->encoder->hpd_pin == pin) {
++ /* Don't check MST ports, they don't have pins */
++ if (!intel_connector->mst_port &&
++ intel_connector->encoder->hpd_pin == pin) {
+ if (connector->polled != intel_connector->polled)
+ DRM_DEBUG_DRIVER("Reenabling HPD on connector %s\n",
+ connector->name);
+@@ -395,37 +397,54 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv,
+ struct intel_encoder *encoder;
+ bool storm_detected = false;
+ bool queue_dig = false, queue_hp = false;
++ u32 long_hpd_pulse_mask = 0;
++ u32 short_hpd_pulse_mask = 0;
++ enum hpd_pin pin;
+
+ if (!pin_mask)
+ return;
+
+ spin_lock(&dev_priv->irq_lock);
++
++ /*
++ * Determine whether ->hpd_pulse() exists for each pin, and
++ * whether we have a short or a long pulse. This is needed
++ * as each pin may have up to two encoders (HDMI and DP) and
++ * only the one of them (DP) will have ->hpd_pulse().
++ */
+ for_each_intel_encoder(&dev_priv->drm, encoder) {
+- enum hpd_pin pin = encoder->hpd_pin;
+ bool has_hpd_pulse = intel_encoder_has_hpd_pulse(encoder);
++ enum port port = encoder->port;
++ bool long_hpd;
+
++ pin = encoder->hpd_pin;
+ if (!(BIT(pin) & pin_mask))
+ continue;
+
+- if (has_hpd_pulse) {
+- bool long_hpd = long_mask & BIT(pin);
+- enum port port = encoder->port;
++ if (!has_hpd_pulse)
++ continue;
+
+- DRM_DEBUG_DRIVER("digital hpd port %c - %s\n", port_name(port),
+- long_hpd ? "long" : "short");
+- /*
+- * For long HPD pulses we want to have the digital queue happen,
+- * but we still want HPD storm detection to function.
+- */
+- queue_dig = true;
+- if (long_hpd) {
+- dev_priv->hotplug.long_port_mask |= (1 << port);
+- } else {
+- /* for short HPD just trigger the digital queue */
+- dev_priv->hotplug.short_port_mask |= (1 << port);
+- continue;
+- }
++ long_hpd = long_mask & BIT(pin);
++
++ DRM_DEBUG_DRIVER("digital hpd port %c - %s\n", port_name(port),
++ long_hpd ? "long" : "short");
++ queue_dig = true;
++
++ if (long_hpd) {
++ long_hpd_pulse_mask |= BIT(pin);
++ dev_priv->hotplug.long_port_mask |= BIT(port);
++ } else {
++ short_hpd_pulse_mask |= BIT(pin);
++ dev_priv->hotplug.short_port_mask |= BIT(port);
+ }
++ }
++
++ /* Now process each pin just once */
++ for_each_hpd_pin(pin) {
++ bool long_hpd;
++
++ if (!(BIT(pin) & pin_mask))
++ continue;
+
+ if (dev_priv->hotplug.stats[pin].state == HPD_DISABLED) {
+ /*
+@@ -442,11 +461,22 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv,
+ if (dev_priv->hotplug.stats[pin].state != HPD_ENABLED)
+ continue;
+
+- if (!has_hpd_pulse) {
++ /*
++ * Delegate to ->hpd_pulse() if one of the encoders for this
++ * pin has it, otherwise let the hotplug_work deal with this
++ * pin directly.
++ */
++ if (((short_hpd_pulse_mask | long_hpd_pulse_mask) & BIT(pin))) {
++ long_hpd = long_hpd_pulse_mask & BIT(pin);
++ } else {
+ dev_priv->hotplug.event_bits |= BIT(pin);
++ long_hpd = true;
+ queue_hp = true;
+ }
+
++ if (!long_hpd)
++ continue;
++
+ if (intel_hpd_irq_storm_detect(dev_priv, pin)) {
+ dev_priv->hotplug.event_bits &= ~BIT(pin);
+ storm_detected = true;
+diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
+index cdf19553ffac..5d5336fbe7b0 100644
+--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
++++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
+@@ -297,8 +297,10 @@ void intel_lpe_audio_teardown(struct drm_i915_private *dev_priv)
+ lpe_audio_platdev_destroy(dev_priv);
+
+ irq_free_desc(dev_priv->lpe_audio.irq);
+-}
+
++ dev_priv->lpe_audio.irq = -1;
++ dev_priv->lpe_audio.platdev = NULL;
++}
+
+ /**
+ * intel_lpe_audio_notify() - notify lpe audio event
+diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
+index 174479232e94..75ea87ebf9b0 100644
+--- a/drivers/gpu/drm/i915/intel_lrc.c
++++ b/drivers/gpu/drm/i915/intel_lrc.c
+@@ -424,7 +424,8 @@ static u64 execlists_update_context(struct i915_request *rq)
+
+ reg_state[CTX_RING_TAIL+1] = intel_ring_set_tail(rq->ring, rq->tail);
+
+- /* True 32b PPGTT with dynamic page allocation: update PDP
++ /*
++ * True 32b PPGTT with dynamic page allocation: update PDP
+ * registers and point the unallocated PDPs to scratch page.
+ * PML4 is allocated during ppgtt init, so this is not needed
+ * in 48-bit mode.
+@@ -432,6 +433,17 @@ static u64 execlists_update_context(struct i915_request *rq)
+ if (ppgtt && !i915_vm_is_48bit(&ppgtt->vm))
+ execlists_update_context_pdps(ppgtt, reg_state);
+
++ /*
++ * Make sure the context image is complete before we submit it to HW.
++ *
++ * Ostensibly, writes (including the WCB) should be flushed prior to
++ * an uncached write such as our mmio register access, the empirical
++ * evidence (esp. on Braswell) suggests that the WC write into memory
++ * may not be visible to the HW prior to the completion of the UC
++ * register write and that we may begin execution from the context
++ * before its image is complete leading to invalid PD chasing.
++ */
++ wmb();
+ return ce->lrc_desc;
+ }
+
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 6a8f27d0a742..3b8218dd9bb1 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -91,6 +91,7 @@ static int
+ gen4_render_ring_flush(struct i915_request *rq, u32 mode)
+ {
+ u32 cmd, *cs;
++ int i;
+
+ /*
+ * read/write caches:
+@@ -127,12 +128,45 @@ gen4_render_ring_flush(struct i915_request *rq, u32 mode)
+ cmd |= MI_INVALIDATE_ISP;
+ }
+
+- cs = intel_ring_begin(rq, 2);
++ i = 2;
++ if (mode & EMIT_INVALIDATE)
++ i += 20;
++
++ cs = intel_ring_begin(rq, i);
+ if (IS_ERR(cs))
+ return PTR_ERR(cs);
+
+ *cs++ = cmd;
+- *cs++ = MI_NOOP;
++
++ /*
++ * A random delay to let the CS invalidate take effect? Without this
++ * delay, the GPU relocation path fails as the CS does not see
++ * the updated contents. Just as important, if we apply the flushes
++ * to the EMIT_FLUSH branch (i.e. immediately after the relocation
++ * write and before the invalidate on the next batch), the relocations
++ * still fail. This implies that is a delay following invalidation
++ * that is required to reset the caches as opposed to a delay to
++ * ensure the memory is written.
++ */
++ if (mode & EMIT_INVALIDATE) {
++ *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
++ *cs++ = i915_ggtt_offset(rq->engine->scratch) |
++ PIPE_CONTROL_GLOBAL_GTT;
++ *cs++ = 0;
++ *cs++ = 0;
++
++ for (i = 0; i < 12; i++)
++ *cs++ = MI_FLUSH;
++
++ *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
++ *cs++ = i915_ggtt_offset(rq->engine->scratch) |
++ PIPE_CONTROL_GLOBAL_GTT;
++ *cs++ = 0;
++ *cs++ = 0;
++ }
++
++ *cs++ = cmd;
++
+ intel_ring_advance(rq, cs);
+
+ return 0;
+diff --git a/drivers/gpu/drm/i915/selftests/huge_pages.c b/drivers/gpu/drm/i915/selftests/huge_pages.c
+index 7efb326badcd..704572c2e6a2 100644
+--- a/drivers/gpu/drm/i915/selftests/huge_pages.c
++++ b/drivers/gpu/drm/i915/selftests/huge_pages.c
+@@ -549,7 +549,7 @@ static int igt_mock_ppgtt_misaligned_dma(void *arg)
+ err = igt_check_page_sizes(vma);
+
+ if (vma->page_sizes.gtt != I915_GTT_PAGE_SIZE_4K) {
+- pr_err("page_sizes.gtt=%u, expected %lu\n",
++ pr_err("page_sizes.gtt=%u, expected %llu\n",
+ vma->page_sizes.gtt, I915_GTT_PAGE_SIZE_4K);
+ err = -EINVAL;
+ }
+diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
+index 8e2e269db97e..127d81513671 100644
+--- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
+@@ -1337,7 +1337,7 @@ static int igt_gtt_reserve(void *arg)
+ GEM_BUG_ON(!drm_mm_node_allocated(&vma->node));
+ if (vma->node.start != total ||
+ vma->node.size != 2*I915_GTT_PAGE_SIZE) {
+- pr_err("i915_gem_gtt_reserve (pass 1) placement failed, found (%llx + %llx), expected (%llx + %lx)\n",
++ pr_err("i915_gem_gtt_reserve (pass 1) placement failed, found (%llx + %llx), expected (%llx + %llx)\n",
+ vma->node.start, vma->node.size,
+ total, 2*I915_GTT_PAGE_SIZE);
+ err = -EINVAL;
+@@ -1386,7 +1386,7 @@ static int igt_gtt_reserve(void *arg)
+ GEM_BUG_ON(!drm_mm_node_allocated(&vma->node));
+ if (vma->node.start != total ||
+ vma->node.size != 2*I915_GTT_PAGE_SIZE) {
+- pr_err("i915_gem_gtt_reserve (pass 2) placement failed, found (%llx + %llx), expected (%llx + %lx)\n",
++ pr_err("i915_gem_gtt_reserve (pass 2) placement failed, found (%llx + %llx), expected (%llx + %llx)\n",
+ vma->node.start, vma->node.size,
+ total, 2*I915_GTT_PAGE_SIZE);
+ err = -EINVAL;
+@@ -1430,7 +1430,7 @@ static int igt_gtt_reserve(void *arg)
+ GEM_BUG_ON(!drm_mm_node_allocated(&vma->node));
+ if (vma->node.start != offset ||
+ vma->node.size != 2*I915_GTT_PAGE_SIZE) {
+- pr_err("i915_gem_gtt_reserve (pass 3) placement failed, found (%llx + %llx), expected (%llx + %lx)\n",
++ pr_err("i915_gem_gtt_reserve (pass 3) placement failed, found (%llx + %llx), expected (%llx + %llx)\n",
+ vma->node.start, vma->node.size,
+ offset, 2*I915_GTT_PAGE_SIZE);
+ err = -EINVAL;
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index da1363a0c54d..93d70f4a2154 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -633,8 +633,7 @@ static int adreno_get_legacy_pwrlevels(struct device *dev)
+ struct device_node *child, *node;
+ int ret;
+
+- node = of_find_compatible_node(dev->of_node, NULL,
+- "qcom,gpu-pwrlevels");
++ node = of_get_compatible_child(dev->of_node, "qcom,gpu-pwrlevels");
+ if (!node) {
+ dev_err(dev, "Could not find the GPU powerlevels\n");
+ return -ENXIO;
+@@ -655,6 +654,8 @@ static int adreno_get_legacy_pwrlevels(struct device *dev)
+ dev_pm_opp_add(dev, val, 0);
+ }
+
++ of_node_put(node);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index 80cbf75bc2ff..cd02eae884cc 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -1535,8 +1535,7 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
+ cnt++;
+
+ dst = drm_plane_state_dest(pstate);
+- if (!drm_rect_intersect(&clip, &dst) ||
+- !drm_rect_equals(&clip, &dst)) {
++ if (!drm_rect_intersect(&clip, &dst)) {
+ DPU_ERROR("invalid vertical/horizontal destination\n");
+ DPU_ERROR("display: " DRM_RECT_FMT " plane: "
+ DRM_RECT_FMT "\n", DRM_RECT_ARG(&crtc_rect),
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+index 7dd6bd2d6d37..74cc204b07e8 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+@@ -450,7 +450,7 @@ static void _dpu_kms_initialize_dsi(struct drm_device *dev,
+ int i, rc;
+
+ /*TODO: Support two independent DSI connectors */
+- encoder = dpu_encoder_init(dev, DRM_MODE_CONNECTOR_DSI);
++ encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_DSI);
+ if (IS_ERR_OR_NULL(encoder)) {
+ DPU_ERROR("encoder init failed for dsi display\n");
+ return;
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+index b640e39ebaca..4ac2b0c669b7 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+@@ -1254,7 +1254,7 @@ static int dpu_plane_sspp_atomic_update(struct drm_plane *plane,
+ const struct dpu_format *fmt;
+ struct drm_crtc *crtc;
+ struct drm_framebuffer *fb;
+- struct drm_rect src, dst;
++ int ret, min_scale;
+
+ if (!plane) {
+ DPU_ERROR("invalid plane\n");
+@@ -1293,21 +1293,29 @@ static int dpu_plane_sspp_atomic_update(struct drm_plane *plane,
+ pdpu->is_rt_pipe = (dpu_crtc_get_client_type(crtc) != NRT_CLIENT);
+ _dpu_plane_set_qos_ctrl(plane, false, DPU_PLANE_QOS_PANIC_CTRL);
+
+- src.x1 = state->src_x >> 16;
+- src.y1 = state->src_y >> 16;
+- src.x2 = src.x1 + (state->src_w >> 16);
+- src.y2 = src.y1 + (state->src_h >> 16);
++ min_scale = FRAC_16_16(1, pdpu->pipe_sblk->maxdwnscale);
++ ret = drm_atomic_helper_check_plane_state(state, crtc->state, min_scale,
++ pdpu->pipe_sblk->maxupscale << 16,
++ true, false);
++ if (ret) {
++ DPU_ERROR_PLANE(pdpu, "Check plane state failed (%d)\n", ret);
++ return ret;
++ }
+
+- dst = drm_plane_state_dest(state);
++ DPU_DEBUG_PLANE(pdpu, "FB[%u] " DRM_RECT_FP_FMT "->crtc%u " DRM_RECT_FMT
++ ", %4.4s ubwc %d\n", fb->base.id, DRM_RECT_FP_ARG(&state->src),
++ crtc->base.id, DRM_RECT_ARG(&state->dst),
++ (char *)&fmt->base.pixel_format, DPU_FORMAT_IS_UBWC(fmt));
+
+- DPU_DEBUG_PLANE(pdpu, "FB[%u] " DRM_RECT_FMT "->crtc%u " DRM_RECT_FMT
+- ", %4.4s ubwc %d\n", fb->base.id, DRM_RECT_ARG(&src),
+- crtc->base.id, DRM_RECT_ARG(&dst),
+- (char *)&fmt->base.pixel_format,
+- DPU_FORMAT_IS_UBWC(fmt));
++ pdpu->pipe_cfg.src_rect = state->src;
++
++ /* state->src is 16.16, src_rect is not */
++ pdpu->pipe_cfg.src_rect.x1 >>= 16;
++ pdpu->pipe_cfg.src_rect.x2 >>= 16;
++ pdpu->pipe_cfg.src_rect.y1 >>= 16;
++ pdpu->pipe_cfg.src_rect.y2 >>= 16;
+
+- pdpu->pipe_cfg.src_rect = src;
+- pdpu->pipe_cfg.dst_rect = dst;
++ pdpu->pipe_cfg.dst_rect = state->dst;
+
+ _dpu_plane_setup_scaler(pdpu, pstate, fmt, false);
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+index 7d306c5acd09..273cbbe27c2e 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+@@ -259,7 +259,6 @@ static void mdp5_plane_cleanup_fb(struct drm_plane *plane,
+ msm_framebuffer_cleanup(fb, kms->aspace);
+ }
+
+-#define FRAC_16_16(mult, div) (((mult) << 16) / (div))
+ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state,
+ struct drm_plane_state *state)
+ {
+diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
+index 8e510d5c758a..9d11f321f5a9 100644
+--- a/drivers/gpu/drm/msm/msm_drv.h
++++ b/drivers/gpu/drm/msm/msm_drv.h
+@@ -62,6 +62,8 @@ struct msm_gem_vma;
+ #define MAX_BRIDGES 8
+ #define MAX_CONNECTORS 8
+
++#define FRAC_16_16(mult, div) (((mult) << 16) / (div))
++
+ struct msm_file_private {
+ rwlock_t queuelock;
+ struct list_head submitqueues;
+diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
+index 5e808cfec345..46e6b82f7b66 100644
+--- a/drivers/gpu/drm/msm/msm_gpu.c
++++ b/drivers/gpu/drm/msm/msm_gpu.c
+@@ -367,8 +367,8 @@ static void msm_gpu_crashstate_capture(struct msm_gpu *gpu,
+ msm_gpu_devcoredump_read, msm_gpu_devcoredump_free);
+ }
+ #else
+-static void msm_gpu_crashstate_capture(struct msm_gpu *gpu, char *comm,
+- char *cmd)
++static void msm_gpu_crashstate_capture(struct msm_gpu *gpu,
++ struct msm_gem_submit *submit, char *comm, char *cmd)
+ {
+ }
+ #endif
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index 041e7daf8a33..faf7009c0a3c 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -843,22 +843,16 @@ nv50_mstc_atomic_best_encoder(struct drm_connector *connector,
+ {
+ struct nv50_head *head = nv50_head(connector_state->crtc);
+ struct nv50_mstc *mstc = nv50_mstc(connector);
+- if (mstc->port) {
+- struct nv50_mstm *mstm = mstc->mstm;
+- return &mstm->msto[head->base.index]->encoder;
+- }
+- return NULL;
++
++ return &mstc->mstm->msto[head->base.index]->encoder;
+ }
+
+ static struct drm_encoder *
+ nv50_mstc_best_encoder(struct drm_connector *connector)
+ {
+ struct nv50_mstc *mstc = nv50_mstc(connector);
+- if (mstc->port) {
+- struct nv50_mstm *mstm = mstc->mstm;
+- return &mstm->msto[0]->encoder;
+- }
+- return NULL;
++
++ return &mstc->mstm->msto[0]->encoder;
+ }
+
+ static enum drm_mode_status
+diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
+index 408b955e5c39..6dd72bc32897 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
+@@ -116,7 +116,7 @@ nv40_backlight_init(struct drm_connector *connector)
+ &nv40_bl_ops, &props);
+
+ if (IS_ERR(bd)) {
+- if (bl_connector.id > 0)
++ if (bl_connector.id >= 0)
+ ida_simple_remove(&bl_ida, bl_connector.id);
+ return PTR_ERR(bd);
+ }
+@@ -249,7 +249,7 @@ nv50_backlight_init(struct drm_connector *connector)
+ nv_encoder, ops, &props);
+
+ if (IS_ERR(bd)) {
+- if (bl_connector.id > 0)
++ if (bl_connector.id >= 0)
+ ida_simple_remove(&bl_ida, bl_connector.id);
+ return PTR_ERR(bd);
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c
+index d02e183717dc..5c14d6ac855d 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/acr_r352.c
+@@ -801,6 +801,7 @@ acr_r352_load(struct nvkm_acr *_acr, struct nvkm_falcon *falcon,
+ bl = acr->hsbl_unload_blob;
+ } else {
+ nvkm_error(_acr->subdev, "invalid secure boot blob!\n");
++ kfree(bl_desc);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+index f92fe205550b..e884183c018a 100644
+--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+@@ -285,6 +285,17 @@ static int dmm_txn_commit(struct dmm_txn *txn, bool wait)
+ }
+
+ txn->last_pat->next_pa = 0;
++ /* ensure that the written descriptors are visible to DMM */
++ wmb();
++
++ /*
++ * NOTE: the wmb() above should be enough, but there seems to be a bug
++ * in OMAP's memory barrier implementation, which in some rare cases may
++ * cause the writes not to be observable after wmb().
++ */
++
++ /* read back to ensure the data is in RAM */
++ readl(&txn->last_pat->next_pa);
+
+ /* write to PAT_DESCR to clear out any pending transaction */
+ dmm_write(dmm, 0x0, reg[PAT_DESCR][engine->id]);
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+index f0bc7cc0e913..fb46df56f0c4 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+@@ -516,12 +516,22 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu)
+
+ dev->mode_config.min_width = 0;
+ dev->mode_config.min_height = 0;
+- dev->mode_config.max_width = 4095;
+- dev->mode_config.max_height = 2047;
+ dev->mode_config.normalize_zpos = true;
+ dev->mode_config.funcs = &rcar_du_mode_config_funcs;
+ dev->mode_config.helper_private = &rcar_du_mode_config_helper;
+
++ if (rcdu->info->gen < 3) {
++ dev->mode_config.max_width = 4095;
++ dev->mode_config.max_height = 2047;
++ } else {
++ /*
++ * The Gen3 DU uses the VSP1 for memory access, and is limited
++ * to frame sizes of 8190x8190.
++ */
++ dev->mode_config.max_width = 8190;
++ dev->mode_config.max_height = 8190;
++ }
++
+ rcdu->num_crtcs = hweight8(rcdu->info->channels_mask);
+
+ ret = rcar_du_properties_init(rcdu);
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+index f814d37b1db2..05368fa4f956 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+@@ -442,6 +442,11 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static void rockchip_drm_platform_shutdown(struct platform_device *pdev)
++{
++ rockchip_drm_platform_remove(pdev);
++}
++
+ static const struct of_device_id rockchip_drm_dt_ids[] = {
+ { .compatible = "rockchip,display-subsystem", },
+ { /* sentinel */ },
+@@ -451,6 +456,7 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids);
+ static struct platform_driver rockchip_drm_platform_driver = {
+ .probe = rockchip_drm_platform_probe,
+ .remove = rockchip_drm_platform_remove,
++ .shutdown = rockchip_drm_platform_shutdown,
+ .driver = {
+ .name = "rockchip-drm",
+ .of_match_table = rockchip_drm_dt_ids,
+diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
+index 33d51281272b..fcdbac4a56e3 100644
+--- a/drivers/hwmon/hwmon.c
++++ b/drivers/hwmon/hwmon.c
+@@ -635,8 +635,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
+ if (info[i]->config[j] & HWMON_T_INPUT) {
+ err = hwmon_thermal_add_sensor(dev,
+ hwdev, j);
+- if (err)
+- goto free_device;
++ if (err) {
++ device_unregister(hdev);
++ goto ida_remove;
++ }
+ }
+ }
+ }
+@@ -644,8 +646,6 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
+
+ return hdev;
+
+-free_device:
+- device_unregister(hdev);
+ free_hwmon:
+ kfree(hwdev);
+ ida_remove:
+diff --git a/drivers/input/touchscreen/wm97xx-core.c b/drivers/input/touchscreen/wm97xx-core.c
+index 2566b4d8b342..73856c2a8ac0 100644
+--- a/drivers/input/touchscreen/wm97xx-core.c
++++ b/drivers/input/touchscreen/wm97xx-core.c
+@@ -929,7 +929,8 @@ static int __init wm97xx_init(void)
+
+ static void __exit wm97xx_exit(void)
+ {
+- driver_unregister(&wm97xx_driver);
++ if (IS_BUILTIN(CONFIG_AC97_BUS))
++ driver_unregister(&wm97xx_driver);
+ platform_driver_unregister(&wm97xx_mfd_driver);
+ }
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 071f4bc240ca..7b662bd1c7a0 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -223,8 +223,10 @@ struct ov5640_dev {
+ int power_count;
+
+ struct v4l2_mbus_framefmt fmt;
++ bool pending_fmt_change;
+
+ const struct ov5640_mode_info *current_mode;
++ const struct ov5640_mode_info *last_mode;
+ enum ov5640_frame_rate current_fr;
+ struct v4l2_fract frame_interval;
+
+@@ -255,7 +257,7 @@ static inline struct v4l2_subdev *ctrl_to_sd(struct v4l2_ctrl *ctrl)
+ * should be identified and removed to speed register load time
+ * over i2c.
+ */
+-
++/* YUV422 UYVY VGA@30fps */
+ static const struct reg_value ov5640_init_setting_30fps_VGA[] = {
+ {0x3103, 0x11, 0, 0}, {0x3008, 0x82, 0, 5}, {0x3008, 0x42, 0, 0},
+ {0x3103, 0x03, 0, 0}, {0x3017, 0x00, 0, 0}, {0x3018, 0x00, 0, 0},
+@@ -1613,10 +1615,10 @@ static int ov5640_set_mode_direct(struct ov5640_dev *sensor,
+ return __v4l2_ctrl_s_ctrl(sensor->ctrls.auto_exp, exposure);
+ }
+
+-static int ov5640_set_mode(struct ov5640_dev *sensor,
+- const struct ov5640_mode_info *orig_mode)
++static int ov5640_set_mode(struct ov5640_dev *sensor)
+ {
+ const struct ov5640_mode_info *mode = sensor->current_mode;
++ const struct ov5640_mode_info *orig_mode = sensor->last_mode;
+ enum ov5640_downsize_mode dn_mode, orig_dn_mode;
+ s32 exposure;
+ int ret;
+@@ -1673,6 +1675,7 @@ static int ov5640_set_mode(struct ov5640_dev *sensor,
+ return ret;
+
+ sensor->pending_mode_change = false;
++ sensor->last_mode = mode;
+
+ return 0;
+ }
+@@ -1689,6 +1692,7 @@ static int ov5640_restore_mode(struct ov5640_dev *sensor)
+ ret = ov5640_load_regs(sensor, &ov5640_mode_init_data);
+ if (ret < 0)
+ return ret;
++ sensor->last_mode = &ov5640_mode_init_data;
+
+ ret = ov5640_mod_reg(sensor, OV5640_REG_SYS_ROOT_DIVIDER, 0x3f,
+ (ilog2(OV5640_SCLK2X_ROOT_DIVIDER_DEFAULT) << 2) |
+@@ -1697,7 +1701,7 @@ static int ov5640_restore_mode(struct ov5640_dev *sensor)
+ return ret;
+
+ /* now restore the last capture mode */
+- ret = ov5640_set_mode(sensor, &ov5640_mode_init_data);
++ ret = ov5640_set_mode(sensor);
+ if (ret < 0)
+ return ret;
+
+@@ -1968,9 +1972,12 @@ static int ov5640_set_fmt(struct v4l2_subdev *sd,
+
+ if (new_mode != sensor->current_mode) {
+ sensor->current_mode = new_mode;
+- sensor->fmt = *mbus_fmt;
+ sensor->pending_mode_change = true;
+ }
++ if (mbus_fmt->code != sensor->fmt.code) {
++ sensor->fmt = *mbus_fmt;
++ sensor->pending_fmt_change = true;
++ }
+ out:
+ mutex_unlock(&sensor->lock);
+ return ret;
+@@ -2541,13 +2548,16 @@ static int ov5640_s_stream(struct v4l2_subdev *sd, int enable)
+
+ if (sensor->streaming == !enable) {
+ if (enable && sensor->pending_mode_change) {
+- ret = ov5640_set_mode(sensor, sensor->current_mode);
++ ret = ov5640_set_mode(sensor);
+ if (ret)
+ goto out;
++ }
+
++ if (enable && sensor->pending_fmt_change) {
+ ret = ov5640_set_framefmt(sensor, &sensor->fmt);
+ if (ret)
+ goto out;
++ sensor->pending_fmt_change = false;
+ }
+
+ if (sensor->ep.bus_type == V4L2_MBUS_CSI2)
+@@ -2642,9 +2652,14 @@ static int ov5640_probe(struct i2c_client *client,
+ return -ENOMEM;
+
+ sensor->i2c_client = client;
++
++ /*
++ * default init sequence initialize sensor to
++ * YUV422 UYVY VGA@30fps
++ */
+ fmt = &sensor->fmt;
+- fmt->code = ov5640_formats[0].code;
+- fmt->colorspace = ov5640_formats[0].colorspace;
++ fmt->code = MEDIA_BUS_FMT_UYVY8_2X8;
++ fmt->colorspace = V4L2_COLORSPACE_SRGB;
+ fmt->ycbcr_enc = V4L2_MAP_YCBCR_ENC_DEFAULT(fmt->colorspace);
+ fmt->quantization = V4L2_QUANTIZATION_FULL_RANGE;
+ fmt->xfer_func = V4L2_MAP_XFER_FUNC_DEFAULT(fmt->colorspace);
+@@ -2656,7 +2671,7 @@ static int ov5640_probe(struct i2c_client *client,
+ sensor->current_fr = OV5640_30_FPS;
+ sensor->current_mode =
+ &ov5640_mode_data[OV5640_30_FPS][OV5640_MODE_VGA_640_480];
+- sensor->pending_mode_change = true;
++ sensor->last_mode = sensor->current_mode;
+
+ sensor->ae_target = 52;
+
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 805bd9c65940..8b450fc53202 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -901,9 +901,6 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd,
+
+ /* tvp5150 has some special limits */
+ rect.left = clamp(rect.left, 0, TVP5150_MAX_CROP_LEFT);
+- rect.width = clamp_t(unsigned int, rect.width,
+- TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left,
+- TVP5150_H_MAX - rect.left);
+ rect.top = clamp(rect.top, 0, TVP5150_MAX_CROP_TOP);
+
+ /* Calculate height based on current standard */
+@@ -917,9 +914,16 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd,
+ else
+ hmax = TVP5150_V_MAX_OTHERS;
+
+- rect.height = clamp_t(unsigned int, rect.height,
++ /*
++ * alignments:
++ * - width = 2 due to UYVY colorspace
++ * - height, image = no special alignment
++ */
++ v4l_bound_align_image(&rect.width,
++ TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left,
++ TVP5150_H_MAX - rect.left, 1, &rect.height,
+ hmax - TVP5150_MAX_CROP_TOP - rect.top,
+- hmax - rect.top);
++ hmax - rect.top, 0, 0);
+
+ tvp5150_write(sd, TVP5150_VERT_BLANKING_START, rect.top);
+ tvp5150_write(sd, TVP5150_VERT_BLANKING_STOP,
+diff --git a/drivers/media/pci/cx23885/altera-ci.c b/drivers/media/pci/cx23885/altera-ci.c
+index 62bc8049b320..198c05e83f5c 100644
+--- a/drivers/media/pci/cx23885/altera-ci.c
++++ b/drivers/media/pci/cx23885/altera-ci.c
+@@ -665,6 +665,10 @@ static int altera_hw_filt_init(struct altera_ci_config *config, int hw_filt_nr)
+ }
+
+ temp_int = append_internal(inter);
++ if (!temp_int) {
++ ret = -ENOMEM;
++ goto err;
++ }
+ inter->filts_used = 1;
+ inter->dev = config->dev;
+ inter->fpga_rw = config->fpga_rw;
+@@ -699,6 +703,7 @@ err:
+ __func__, ret);
+
+ kfree(pid_filt);
++ kfree(inter);
+
+ return ret;
+ }
+@@ -733,6 +738,10 @@ int altera_ci_init(struct altera_ci_config *config, int ci_nr)
+ }
+
+ temp_int = append_internal(inter);
++ if (!temp_int) {
++ ret = -ENOMEM;
++ goto err;
++ }
+ inter->cis_used = 1;
+ inter->dev = config->dev;
+ inter->fpga_rw = config->fpga_rw;
+@@ -801,6 +810,7 @@ err:
+ ci_dbg_print("%s: Cannot initialize CI: Error %d.\n", __func__, ret);
+
+ kfree(state);
++ kfree(inter);
+
+ return ret;
+ }
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index 726b3b93a486..bf7b8417c27f 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -1804,7 +1804,8 @@ static int coda_s_ctrl(struct v4l2_ctrl *ctrl)
+ break;
+ case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
+ /* TODO: switch between baseline and constrained baseline */
+- ctx->params.h264_profile_idc = 66;
++ if (ctx->inst_type == CODA_INST_ENCODER)
++ ctx->params.h264_profile_idc = 66;
+ break;
+ case V4L2_CID_MPEG_VIDEO_H264_LEVEL:
+ /* nothing to do, this is set by the encoder */
+diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
+index e514d57a0419..aa983422aa97 100644
+--- a/drivers/mtd/devices/Kconfig
++++ b/drivers/mtd/devices/Kconfig
+@@ -207,7 +207,7 @@ comment "Disk-On-Chip Device Drivers"
+ config MTD_DOCG3
+ tristate "M-Systems Disk-On-Chip G3"
+ select BCH
+- select BCH_CONST_PARAMS
++ select BCH_CONST_PARAMS if !MTD_NAND_BCH
+ select BITREVERSE
+ help
+ This provides an MTD device driver for the M-Systems DiskOnChip
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index 8e714fbfa521..6e9cbd1a0b6d 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -996,7 +996,7 @@ static int cqspi_direct_read_execute(struct spi_nor *nor, u_char *buf,
+ err_unmap:
+ dma_unmap_single(nor->dev, dma_dst, len, DMA_DEV_TO_MEM);
+
+- return 0;
++ return ret;
+ }
+
+ static ssize_t cqspi_read(struct spi_nor *nor, loff_t from,
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index ee28ec9e0aba..3c597569cfae 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3111,13 +3111,13 @@ static int bond_slave_netdev_event(unsigned long event,
+ case NETDEV_CHANGE:
+ /* For 802.3ad mode only:
+ * Getting invalid Speed/Duplex values here will put slave
+- * in weird state. So mark it as link-down for the time
++ * in weird state. So mark it as link-fail for the time
+ * being and let link-monitoring (miimon) set it right when
+ * correct speeds/duplex are available.
+ */
+ if (bond_update_speed_duplex(slave) &&
+ BOND_MODE(bond) == BOND_MODE_8023AD)
+- slave->link = BOND_LINK_DOWN;
++ slave->link = BOND_LINK_FAIL;
+
+ if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ bond_3ad_adapter_speed_duplex_changed(slave);
+diff --git a/drivers/of/of_numa.c b/drivers/of/of_numa.c
+index 27d9b4bba535..2411ed3c7303 100644
+--- a/drivers/of/of_numa.c
++++ b/drivers/of/of_numa.c
+@@ -115,9 +115,14 @@ static int __init of_numa_parse_distance_map_v1(struct device_node *map)
+ distance = of_read_number(matrix, 1);
+ matrix++;
+
++ if ((nodea == nodeb && distance != LOCAL_DISTANCE) ||
++ (nodea != nodeb && distance <= LOCAL_DISTANCE)) {
++ pr_err("Invalid distance[node%d -> node%d] = %d\n",
++ nodea, nodeb, distance);
++ return -EINVAL;
++ }
++
+ numa_set_distance(nodea, nodeb, distance);
+- pr_debug("distance[node%d -> node%d] = %d\n",
+- nodea, nodeb, distance);
+
+ /* Set default distance of node B->A same as A->B */
+ if (nodeb > nodea)
+diff --git a/drivers/rtc/hctosys.c b/drivers/rtc/hctosys.c
+index e79f2a181ad2..b9ec4a16db1f 100644
+--- a/drivers/rtc/hctosys.c
++++ b/drivers/rtc/hctosys.c
+@@ -50,8 +50,10 @@ static int __init rtc_hctosys(void)
+ tv64.tv_sec = rtc_tm_to_time64(&tm);
+
+ #if BITS_PER_LONG == 32
+- if (tv64.tv_sec > INT_MAX)
++ if (tv64.tv_sec > INT_MAX) {
++ err = -ERANGE;
+ goto err_read;
++ }
+ #endif
+
+ err = do_settimeofday64(&tv64);
+diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
+index c11a89be292c..4a9fd8d944d6 100644
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -2487,7 +2487,7 @@ qla24xx_bsg_request(struct bsg_job *bsg_job)
+ vha = shost_priv(host);
+ }
+
+- if (qla2x00_reset_active(vha)) {
++ if (qla2x00_chip_is_down(vha)) {
+ ql_dbg(ql_dbg_user, vha, 0x709f,
+ "BSG: ISP abort active/needed -- cmd=%d.\n",
+ bsg_request->msgcode);
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index a0038d879b9d..de3f2a097451 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3261,6 +3261,9 @@ static void qla24xx_async_gpsc_sp_done(void *s, int res)
+ "Async done-%s res %x, WWPN %8phC \n",
+ sp->name, res, fcport->port_name);
+
++ if (res == QLA_FUNCTION_TIMEOUT)
++ return;
++
+ if (res == (DID_ERROR << 16)) {
+ /* entry status error */
+ goto done;
+@@ -4444,9 +4447,9 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
+ sp->u.iocb_cmd.timeout = qla2x00_async_iocb_timeout;
+ qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
+
+- rspsz = sizeof(struct ct_sns_gpnft_rsp) +
+- ((vha->hw->max_fibre_devices - 1) *
+- sizeof(struct ct_sns_gpn_ft_data));
++ rspsz = sp->u.iocb_cmd.u.ctarg.rsp_size;
++ memset(sp->u.iocb_cmd.u.ctarg.rsp, 0, sp->u.iocb_cmd.u.ctarg.rsp_size);
++ memset(sp->u.iocb_cmd.u.ctarg.req, 0, sp->u.iocb_cmd.u.ctarg.req_size);
+
+ ct_sns = (struct ct_sns_pkt *)sp->u.iocb_cmd.u.ctarg.req;
+ /* CT_IU preamble */
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index b934977c5c26..5352c9bbcaf7 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -52,12 +52,14 @@ qla2x00_sp_timeout(struct timer_list *t)
+ struct srb_iocb *iocb;
+ struct req_que *req;
+ unsigned long flags;
++ struct qla_hw_data *ha = sp->vha->hw;
+
+- spin_lock_irqsave(sp->qpair->qp_lock_ptr, flags);
++ WARN_ON(irqs_disabled());
++ spin_lock_irqsave(&ha->hardware_lock, flags);
+ req = sp->qpair->req;
+ req->outstanding_cmds[sp->handle] = NULL;
+ iocb = &sp->u.iocb_cmd;
+- spin_unlock_irqrestore(sp->qpair->qp_lock_ptr, flags);
++ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ iocb->timeout(sp);
+ }
+
+@@ -972,6 +974,15 @@ void qla24xx_async_gpdb_sp_done(void *s, int res)
+
+ fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+
++ if (res == QLA_FUNCTION_TIMEOUT)
++ return;
++
++ if (res == QLA_FUNCTION_TIMEOUT) {
++ dma_pool_free(sp->vha->hw->s_dma_pool, sp->u.iocb_cmd.u.mbx.in,
++ sp->u.iocb_cmd.u.mbx.in_dma);
++ return;
++ }
++
+ memset(&ea, 0, sizeof(ea));
+ ea.event = FCME_GPDB_DONE;
+ ea.fcport = fcport;
+@@ -1788,6 +1799,8 @@ qla24xx_async_abort_cmd(srb_t *cmd_sp, bool wait)
+ wait_for_completion(&abt_iocb->u.abt.comp);
+ rval = abt_iocb->u.abt.comp_status == CS_COMPLETE ?
+ QLA_SUCCESS : QLA_FUNCTION_FAILED;
++ } else {
++ goto done;
+ }
+
+ done_free_sp:
+@@ -1952,25 +1965,15 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea)
+ cid.b.rsvd_1 = 0;
+
+ ql_dbg(ql_dbg_disc, vha, 0x20ec,
+- "%s %d %8phC LoopID 0x%x in use post gnl\n",
++ "%s %d %8phC lid %#x in use with pid %06x post gnl\n",
+ __func__, __LINE__, ea->fcport->port_name,
+- ea->fcport->loop_id);
++ ea->fcport->loop_id, cid.b24);
+
+- if (IS_SW_RESV_ADDR(cid)) {
+- set_bit(ea->fcport->loop_id, vha->hw->loop_id_map);
+- ea->fcport->loop_id = FC_NO_LOOP_ID;
+- } else {
+- qla2x00_clear_loop_id(ea->fcport);
+- }
++ set_bit(ea->fcport->loop_id, vha->hw->loop_id_map);
++ ea->fcport->loop_id = FC_NO_LOOP_ID;
+ qla24xx_post_gnl_work(vha, ea->fcport);
+ break;
+ case MBS_PORT_ID_USED:
+- ql_dbg(ql_dbg_disc, vha, 0x20ed,
+- "%s %d %8phC NPortId %02x%02x%02x inuse post gidpn\n",
+- __func__, __LINE__, ea->fcport->port_name,
+- ea->fcport->d_id.b.domain, ea->fcport->d_id.b.area,
+- ea->fcport->d_id.b.al_pa);
+-
+ lid = ea->iop[1] & 0xffff;
+ qlt_find_sess_invalidate_other(vha,
+ wwn_to_u64(ea->fcport->port_name),
+@@ -4711,6 +4714,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags)
+ fcport->loop_id = FC_NO_LOOP_ID;
+ qla2x00_set_fcport_state(fcport, FCS_UNCONFIGURED);
+ fcport->supported_classes = FC_COS_UNSPECIFIED;
++ fcport->fp_speed = PORT_SPEED_UNKNOWN;
+
+ fcport->ct_desc.ct_sns = dma_alloc_coherent(&vha->hw->pdev->dev,
+ sizeof(struct ct_sns_pkt), &fcport->ct_desc.ct_sns_dma,
+@@ -6682,7 +6686,7 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)
+ * The next call disables the board
+ * completely.
+ */
+- ha->isp_ops->reset_adapter(vha);
++ qla2x00_abort_isp_cleanup(vha);
+ vha->flags.online = 0;
+ clear_bit(ISP_ABORT_RETRY,
+ &vha->dpc_flags);
+@@ -7142,7 +7146,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vha)
+ }
+ icb->firmware_options_2 &= cpu_to_le32(
+ ~(BIT_3 | BIT_2 | BIT_1 | BIT_0));
+- vha->flags.process_response_queue = 0;
+ if (ha->zio_mode != QLA_ZIO_DISABLED) {
+ ha->zio_mode = QLA_ZIO_MODE_6;
+
+@@ -7153,7 +7156,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vha)
+ icb->firmware_options_2 |= cpu_to_le32(
+ (uint32_t)ha->zio_mode);
+ icb->interrupt_delay_timer = cpu_to_le16(ha->zio_timer);
+- vha->flags.process_response_queue = 1;
+ }
+
+ if (rval) {
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index 42ac8e097419..119927220299 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -1526,12 +1526,6 @@ qla24xx_start_scsi(srb_t *sp)
+
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr);
+-
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ return QLA_SUCCESS;
+@@ -1725,12 +1719,6 @@ qla24xx_dif_start_scsi(srb_t *sp)
+
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr);
+-
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+@@ -1880,11 +1868,6 @@ qla2xxx_start_scsi_mq(srb_t *sp)
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+-
+ spin_unlock_irqrestore(&qpair->qp_lock, flags);
+ return QLA_SUCCESS;
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 596a9b214df1..84f57f075455 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -3762,10 +3762,7 @@ qla2x00_set_idma_speed(scsi_qla_host_t *vha, uint16_t loop_id,
+ mcp->mb[0] = MBC_PORT_PARAMS;
+ mcp->mb[1] = loop_id;
+ mcp->mb[2] = BIT_0;
+- if (IS_CNA_CAPABLE(vha->hw))
+- mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0);
+- else
+- mcp->mb[3] = port_speed & (BIT_2|BIT_1|BIT_0);
++ mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0);
+ mcp->mb[9] = vha->vp_idx;
+ mcp->out_mb = MBX_9|MBX_3|MBX_2|MBX_1|MBX_0;
+ mcp->in_mb = MBX_3|MBX_1|MBX_0;
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 20d9dc39f0fb..e6545cb9a2c1 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -607,7 +607,7 @@ void qla_nvme_abort(struct qla_hw_data *ha, struct srb *sp, int res)
+ {
+ int rval;
+
+- if (!test_bit(ABORT_ISP_ACTIVE, &sp->vha->dpc_flags)) {
++ if (ha->flags.fw_started) {
+ rval = ha->isp_ops->abort_command(sp);
+ if (!rval && !qla_nvme_wait_on_command(sp))
+ ql_log(ql_log_warn, NULL, 0x2112,
+@@ -660,9 +660,6 @@ void qla_nvme_delete(struct scsi_qla_host *vha)
+ __func__, fcport);
+
+ nvme_fc_set_remoteport_devloss(fcport->nvme_remote_port, 0);
+- init_completion(&fcport->nvme_del_done);
+- nvme_fc_unregister_remoteport(fcport->nvme_remote_port);
+- wait_for_completion(&fcport->nvme_del_done);
+ }
+
+ if (vha->nvme_local_port) {
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 42b8f0d3e580..ae9fd2d01004 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -4808,10 +4808,10 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
+ fcport->d_id = e->u.new_sess.id;
+ fcport->flags |= FCF_FABRIC_DEVICE;
+ fcport->fw_login_state = DSC_LS_PLOGI_PEND;
+- if (e->u.new_sess.fc4_type == FS_FC4TYPE_FCP)
++ if (e->u.new_sess.fc4_type & FS_FC4TYPE_FCP)
+ fcport->fc4_type = FC4_TYPE_FCP_SCSI;
+
+- if (e->u.new_sess.fc4_type == FS_FC4TYPE_NVME) {
++ if (e->u.new_sess.fc4_type & FS_FC4TYPE_NVME) {
+ fcport->fc4_type = FC4_TYPE_OTHER;
+ fcport->fc4f_nvme = FC4_TYPE_NVME;
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 8c811b251d42..d2888b30a8a3 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1261,7 +1261,8 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
+ qla24xx_chk_fcp_state(sess);
+
+ ql_dbg(ql_dbg_tgt, sess->vha, 0xe001,
+- "Scheduling sess %p for deletion\n", sess);
++ "Scheduling sess %p for deletion %8phC\n",
++ sess, sess->port_name);
+
+ INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn);
+ WARN_ON(!queue_work(sess->vha->hw->wq, &sess->del_work));
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index e03d12a5f986..64e2d859f633 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -718,10 +718,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd)
+ cmd->sg_cnt = 0;
+ cmd->offset = 0;
+ cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
+- if (cmd->trc_flags & TRC_XMIT_STATUS) {
+- pr_crit("Multiple calls for status = %p.\n", cmd);
+- dump_stack();
+- }
+ cmd->trc_flags |= TRC_XMIT_STATUS;
+
+ if (se_cmd->data_direction == DMA_FROM_DEVICE) {
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index eb97d2dd3651..b5f638286037 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -697,6 +697,12 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
+ */
+ scsi_mq_uninit_cmd(cmd);
+
++ /*
++ * queue is still alive, so grab the ref for preventing it
++ * from being cleaned up during running queue.
++ */
++ percpu_ref_get(&q->q_usage_counter);
++
+ __blk_mq_end_request(req, error);
+
+ if (scsi_target(sdev)->single_lun ||
+@@ -704,6 +710,8 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
+ kblockd_schedule_work(&sdev->requeue_work);
+ else
+ blk_mq_run_hw_queues(q, true);
++
++ percpu_ref_put(&q->q_usage_counter);
+ } else {
+ unsigned long flags;
+
+diff --git a/drivers/soc/ti/knav_qmss.h b/drivers/soc/ti/knav_qmss.h
+index 3efc47e82973..bd040c29c4bf 100644
+--- a/drivers/soc/ti/knav_qmss.h
++++ b/drivers/soc/ti/knav_qmss.h
+@@ -329,8 +329,8 @@ struct knav_range_ops {
+ };
+
+ struct knav_irq_info {
+- int irq;
+- u32 cpu_map;
++ int irq;
++ struct cpumask *cpu_mask;
+ };
+
+ struct knav_range_info {
+diff --git a/drivers/soc/ti/knav_qmss_acc.c b/drivers/soc/ti/knav_qmss_acc.c
+index 316e82e46f6c..2f7fb2dcc1d6 100644
+--- a/drivers/soc/ti/knav_qmss_acc.c
++++ b/drivers/soc/ti/knav_qmss_acc.c
+@@ -205,18 +205,18 @@ static int knav_range_setup_acc_irq(struct knav_range_info *range,
+ {
+ struct knav_device *kdev = range->kdev;
+ struct knav_acc_channel *acc;
+- unsigned long cpu_map;
++ struct cpumask *cpu_mask;
+ int ret = 0, irq;
+ u32 old, new;
+
+ if (range->flags & RANGE_MULTI_QUEUE) {
+ acc = range->acc;
+ irq = range->irqs[0].irq;
+- cpu_map = range->irqs[0].cpu_map;
++ cpu_mask = range->irqs[0].cpu_mask;
+ } else {
+ acc = range->acc + queue;
+ irq = range->irqs[queue].irq;
+- cpu_map = range->irqs[queue].cpu_map;
++ cpu_mask = range->irqs[queue].cpu_mask;
+ }
+
+ old = acc->open_mask;
+@@ -239,8 +239,8 @@ static int knav_range_setup_acc_irq(struct knav_range_info *range,
+ acc->name, acc->name);
+ ret = request_irq(irq, knav_acc_int_handler, 0, acc->name,
+ range);
+- if (!ret && cpu_map) {
+- ret = irq_set_affinity_hint(irq, to_cpumask(&cpu_map));
++ if (!ret && cpu_mask) {
++ ret = irq_set_affinity_hint(irq, cpu_mask);
+ if (ret) {
+ dev_warn(range->kdev->dev,
+ "Failed to set IRQ affinity\n");
+diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
+index 6755f2af5619..ef36acc0e708 100644
+--- a/drivers/soc/ti/knav_qmss_queue.c
++++ b/drivers/soc/ti/knav_qmss_queue.c
+@@ -118,19 +118,17 @@ static int knav_queue_setup_irq(struct knav_range_info *range,
+ struct knav_queue_inst *inst)
+ {
+ unsigned queue = inst->id - range->queue_base;
+- unsigned long cpu_map;
+ int ret = 0, irq;
+
+ if (range->flags & RANGE_HAS_IRQ) {
+ irq = range->irqs[queue].irq;
+- cpu_map = range->irqs[queue].cpu_map;
+ ret = request_irq(irq, knav_queue_int_handler, 0,
+ inst->irq_name, inst);
+ if (ret)
+ return ret;
+ disable_irq(irq);
+- if (cpu_map) {
+- ret = irq_set_affinity_hint(irq, to_cpumask(&cpu_map));
++ if (range->irqs[queue].cpu_mask) {
++ ret = irq_set_affinity_hint(irq, range->irqs[queue].cpu_mask);
+ if (ret) {
+ dev_warn(range->kdev->dev,
+ "Failed to set IRQ affinity\n");
+@@ -1262,9 +1260,19 @@ static int knav_setup_queue_range(struct knav_device *kdev,
+
+ range->num_irqs++;
+
+- if (IS_ENABLED(CONFIG_SMP) && oirq.args_count == 3)
+- range->irqs[i].cpu_map =
+- (oirq.args[2] & 0x0000ff00) >> 8;
++ if (IS_ENABLED(CONFIG_SMP) && oirq.args_count == 3) {
++ unsigned long mask;
++ int bit;
++
++ range->irqs[i].cpu_mask = devm_kzalloc(dev,
++ cpumask_size(), GFP_KERNEL);
++ if (!range->irqs[i].cpu_mask)
++ return -ENOMEM;
++
++ mask = (oirq.args[2] & 0x0000ff00) >> 8;
++ for_each_set_bit(bit, &mask, BITS_PER_LONG)
++ cpumask_set_cpu(bit, range->irqs[i].cpu_mask);
++ }
+ }
+
+ range->num_irqs = min(range->num_irqs, range->num_queues);
+diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c
+index 8721f0a41d15..14da8cc2246a 100644
+--- a/drivers/staging/erofs/unzip_vle.c
++++ b/drivers/staging/erofs/unzip_vle.c
+@@ -1490,6 +1490,7 @@ static erofs_off_t vle_get_logical_extent_head(
+ unsigned long long ofs;
+ const unsigned int clusterbits = EROFS_SB(inode->i_sb)->clusterbits;
+ const unsigned int clustersize = 1 << clusterbits;
++ unsigned int delta0;
+
+ if (page->index != blkaddr) {
+ kunmap_atomic(*kaddr_iter);
+@@ -1504,12 +1505,13 @@ static erofs_off_t vle_get_logical_extent_head(
+ di = *kaddr_iter + vle_extent_blkoff(inode, lcn);
+ switch (vle_cluster_type(di)) {
+ case Z_EROFS_VLE_CLUSTER_TYPE_NONHEAD:
+- BUG_ON(!di->di_u.delta[0]);
+- BUG_ON(lcn < di->di_u.delta[0]);
++ delta0 = le16_to_cpu(di->di_u.delta[0]);
++ DBG_BUGON(!delta0);
++ DBG_BUGON(lcn < delta0);
+
+ ofs = vle_get_logical_extent_head(inode,
+ page_iter, kaddr_iter,
+- lcn - di->di_u.delta[0], pcn, flags);
++ lcn - delta0, pcn, flags);
+ break;
+ case Z_EROFS_VLE_CLUSTER_TYPE_PLAIN:
+ *flags ^= EROFS_MAP_ZIPPED;
+diff --git a/drivers/staging/iio/adc/ad7606.c b/drivers/staging/iio/adc/ad7606.c
+index 25b9fcd5e3a4..ce3351832fb1 100644
+--- a/drivers/staging/iio/adc/ad7606.c
++++ b/drivers/staging/iio/adc/ad7606.c
+@@ -26,9 +26,12 @@
+
+ #include "ad7606.h"
+
+-/* Scales are computed as 2.5/2**16 and 5/2**16 respectively */
++/*
++ * Scales are computed as 5000/32768 and 10000/32768 respectively,
++ * so that when applied to the raw values they provide mV values
++ */
+ static const unsigned int scale_avail[2][2] = {
+- {0, 38147}, {0, 76294}
++ {0, 152588}, {0, 305176}
+ };
+
+ static int ad7606_reset(struct ad7606_state *st)
+diff --git a/drivers/staging/most/video/video.c b/drivers/staging/most/video/video.c
+index cf342eb58e10..ad7e28ab9a4f 100644
+--- a/drivers/staging/most/video/video.c
++++ b/drivers/staging/most/video/video.c
+@@ -530,7 +530,7 @@ static int comp_disconnect_channel(struct most_interface *iface,
+ return 0;
+ }
+
+-static struct core_component comp_info = {
++static struct core_component comp = {
+ .name = "video",
+ .probe_channel = comp_probe_channel,
+ .disconnect_channel = comp_disconnect_channel,
+@@ -565,7 +565,7 @@ static void __exit comp_exit(void)
+ }
+ spin_unlock_irq(&list_lock);
+
+- most_deregister_component(&comp_info);
++ most_deregister_component(&comp);
+ BUG_ON(!list_empty(&video_devices));
+ }
+
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index 6ab982309e6a..441778100887 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -1102,8 +1102,9 @@ void thermal_cooling_device_unregister(struct thermal_cooling_device *cdev)
+ mutex_unlock(&thermal_list_lock);
+
+ ida_simple_remove(&thermal_cdev_ida, cdev->id);
+- device_unregister(&cdev->device);
++ device_del(&cdev->device);
+ thermal_cooling_device_destroy_sysfs(cdev);
++ put_device(&cdev->device);
+ }
+ EXPORT_SYMBOL_GPL(thermal_cooling_device_unregister);
+
+diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c
+index af8beefe9b5c..877fd7f8a8ed 100644
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -58,7 +58,7 @@ static int of_platform_serial_setup(struct platform_device *ofdev,
+ struct resource resource;
+ struct device_node *np = ofdev->dev.of_node;
+ u32 clk, spd, prop;
+- int ret;
++ int ret, irq;
+
+ memset(port, 0, sizeof *port);
+
+@@ -143,21 +143,27 @@ static int of_platform_serial_setup(struct platform_device *ofdev,
+ if (ret >= 0)
+ port->line = ret;
+
+- port->irq = irq_of_parse_and_map(np, 0);
+- if (!port->irq) {
+- ret = -EPROBE_DEFER;
+- goto err_unprepare;
++ irq = of_irq_get(np, 0);
++ if (irq < 0) {
++ if (irq == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto err_unprepare;
++ }
++ /* IRQ support not mandatory */
++ irq = 0;
+ }
+
++ port->irq = irq;
++
+ info->rst = devm_reset_control_get_optional_shared(&ofdev->dev, NULL);
+ if (IS_ERR(info->rst)) {
+ ret = PTR_ERR(info->rst);
+- goto err_dispose;
++ goto err_unprepare;
+ }
+
+ ret = reset_control_deassert(info->rst);
+ if (ret)
+- goto err_dispose;
++ goto err_unprepare;
+
+ port->type = type;
+ port->uartclk = clk;
+@@ -184,8 +190,6 @@ static int of_platform_serial_setup(struct platform_device *ofdev,
+ port->handle_irq = fsl8250_handle_irq;
+
+ return 0;
+-err_dispose:
+- irq_dispose_mapping(port->irq);
+ err_unprepare:
+ clk_disable_unprepare(info->clk);
+ err_pmruntime:
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index 243c96025053..47b41159a8bc 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -657,7 +657,7 @@ static void sc16is7xx_handle_tx(struct uart_port *port)
+ uart_write_wakeup(port);
+ }
+
+-static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
++static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
+ {
+ struct uart_port *port = &s->p[portno].port;
+
+@@ -666,7 +666,7 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
+
+ iir = sc16is7xx_port_read(port, SC16IS7XX_IIR_REG);
+ if (iir & SC16IS7XX_IIR_NO_INT_BIT)
+- break;
++ return false;
+
+ iir &= SC16IS7XX_IIR_ID_MASK;
+
+@@ -688,16 +688,23 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
+ port->line, iir);
+ break;
+ }
+- } while (1);
++ } while (0);
++ return true;
+ }
+
+ static void sc16is7xx_ist(struct kthread_work *ws)
+ {
+ struct sc16is7xx_port *s = to_sc16is7xx_port(ws, irq_work);
+- int i;
+
+- for (i = 0; i < s->devtype->nr_uart; ++i)
+- sc16is7xx_port_irq(s, i);
++ while (1) {
++ bool keep_polling = false;
++ int i;
++
++ for (i = 0; i < s->devtype->nr_uart; ++i)
++ keep_polling |= sc16is7xx_port_irq(s, i);
++ if (!keep_polling)
++ break;
++ }
+ }
+
+ static irqreturn_t sc16is7xx_irq(int irq, void *dev_id)
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index ab3f6e91853d..3649b83ef863 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -3102,6 +3102,7 @@ static struct uart_driver sci_uart_driver = {
+ static int sci_remove(struct platform_device *dev)
+ {
+ struct sci_port *port = platform_get_drvdata(dev);
++ unsigned int type = port->port.type; /* uart_remove_... clears it */
+
+ sci_ports_in_use &= ~BIT(port->port.line);
+ uart_remove_one_port(&sci_uart_driver, &port->port);
+@@ -3112,8 +3113,7 @@ static int sci_remove(struct platform_device *dev)
+ sysfs_remove_file(&dev->dev.kobj,
+ &dev_attr_rx_fifo_trigger.attr);
+ }
+- if (port->port.type == PORT_SCIFA || port->port.type == PORT_SCIFB ||
+- port->port.type == PORT_HSCIF) {
++ if (type == PORT_SCIFA || type == PORT_SCIFB || type == PORT_HSCIF) {
+ sysfs_remove_file(&dev->dev.kobj,
+ &dev_attr_rx_fifo_timeout.attr);
+ }
+diff --git a/drivers/tty/tty_baudrate.c b/drivers/tty/tty_baudrate.c
+index 7576ceace571..f438eaa68246 100644
+--- a/drivers/tty/tty_baudrate.c
++++ b/drivers/tty/tty_baudrate.c
+@@ -77,7 +77,7 @@ speed_t tty_termios_baud_rate(struct ktermios *termios)
+ else
+ cbaud += 15;
+ }
+- return baud_table[cbaud];
++ return cbaud >= n_baud_table ? 0 : baud_table[cbaud];
+ }
+ EXPORT_SYMBOL(tty_termios_baud_rate);
+
+@@ -113,7 +113,7 @@ speed_t tty_termios_input_baud_rate(struct ktermios *termios)
+ else
+ cbaud += 15;
+ }
+- return baud_table[cbaud];
++ return cbaud >= n_baud_table ? 0 : baud_table[cbaud];
+ #else /* IBSHIFT */
+ return tty_termios_baud_rate(termios);
+ #endif /* IBSHIFT */
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 5e5da9acaf0a..252eef2c32f9 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -408,7 +408,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
+ mutex_lock(&tty_mutex);
+ /* Search through the tty devices to look for a match */
+ list_for_each_entry(p, &tty_drivers, tty_drivers) {
+- if (strncmp(name, p->name, len) != 0)
++ if (!len || strncmp(name, p->name, len) != 0)
+ continue;
+ stp = str;
+ if (*stp == ',')
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index c24bb690680b..e7e3ae13516d 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -964,7 +964,8 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ prot_bytes = vhost32_to_cpu(vq, v_req_pi.pi_bytesin);
+ }
+ /*
+- * Set prot_iter to data_iter, and advance past any
++ * Set prot_iter to data_iter and truncate it to
++ * prot_bytes, and advance data_iter past any
+ * preceeding prot_bytes that may be present.
+ *
+ * Also fix up the exp_data_len to reflect only the
+@@ -973,6 +974,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ if (prot_bytes) {
+ exp_data_len -= prot_bytes;
+ prot_iter = data_iter;
++ iov_iter_truncate(&prot_iter, prot_bytes);
+ iov_iter_advance(&data_iter, prot_bytes);
+ }
+ tag = vhost64_to_cpu(vq, v_req_pi.tag);
+diff --git a/drivers/video/fbdev/aty/mach64_accel.c b/drivers/video/fbdev/aty/mach64_accel.c
+index 2541a0e0de76..3ad46255f990 100644
+--- a/drivers/video/fbdev/aty/mach64_accel.c
++++ b/drivers/video/fbdev/aty/mach64_accel.c
+@@ -127,7 +127,7 @@ void aty_init_engine(struct atyfb_par *par, struct fb_info *info)
+
+ /* set host attributes */
+ wait_for_fifo(13, par);
+- aty_st_le32(HOST_CNTL, 0, par);
++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par);
+
+ /* set pattern attributes */
+ aty_st_le32(PAT_REG0, 0, par);
+@@ -233,7 +233,8 @@ void atyfb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
+ rotation = rotation24bpp(dx, direction);
+ }
+
+- wait_for_fifo(4, par);
++ wait_for_fifo(5, par);
++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par);
+ aty_st_le32(DP_SRC, FRGD_SRC_BLIT, par);
+ aty_st_le32(SRC_Y_X, (sx << 16) | sy, par);
+ aty_st_le32(SRC_HEIGHT1_WIDTH1, (width << 16) | area->height, par);
+@@ -269,7 +270,8 @@ void atyfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
+ rotation = rotation24bpp(dx, DST_X_LEFT_TO_RIGHT);
+ }
+
+- wait_for_fifo(3, par);
++ wait_for_fifo(4, par);
++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par);
+ aty_st_le32(DP_FRGD_CLR, color, par);
+ aty_st_le32(DP_SRC,
+ BKGD_SRC_BKGD_CLR | FRGD_SRC_FRGD_CLR | MONO_SRC_ONE,
+@@ -284,7 +286,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ {
+ struct atyfb_par *par = (struct atyfb_par *) info->par;
+ u32 src_bytes, dx = image->dx, dy = image->dy, width = image->width;
+- u32 pix_width_save, pix_width, host_cntl, rotation = 0, src, mix;
++ u32 pix_width, rotation = 0, src, mix;
+
+ if (par->asleep)
+ return;
+@@ -296,8 +298,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ return;
+ }
+
+- pix_width = pix_width_save = aty_ld_le32(DP_PIX_WIDTH, par);
+- host_cntl = aty_ld_le32(HOST_CNTL, par) | HOST_BYTE_ALIGN;
++ pix_width = par->crtc.dp_pix_width;
+
+ switch (image->depth) {
+ case 1:
+@@ -345,7 +346,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ * since Rage 3D IIc we have DP_HOST_TRIPLE_EN bit
+ * this hwaccelerated triple has an issue with not aligned data
+ */
+- if (M64_HAS(HW_TRIPLE) && image->width % 8 == 0)
++ if (image->depth == 1 && M64_HAS(HW_TRIPLE) && image->width % 8 == 0)
+ pix_width |= DP_HOST_TRIPLE_EN;
+ }
+
+@@ -370,19 +371,18 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ mix = FRGD_MIX_D_XOR_S | BKGD_MIX_D;
+ }
+
+- wait_for_fifo(6, par);
+- aty_st_le32(DP_WRITE_MASK, 0xFFFFFFFF, par);
++ wait_for_fifo(5, par);
+ aty_st_le32(DP_PIX_WIDTH, pix_width, par);
+ aty_st_le32(DP_MIX, mix, par);
+ aty_st_le32(DP_SRC, src, par);
+- aty_st_le32(HOST_CNTL, host_cntl, par);
++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par);
+ aty_st_le32(DST_CNTL, DST_Y_TOP_TO_BOTTOM | DST_X_LEFT_TO_RIGHT | rotation, par);
+
+ draw_rect(dx, dy, width, image->height, par);
+ src_bytes = (((image->width * image->depth) + 7) / 8) * image->height;
+
+ /* manual triple each pixel */
+- if (info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) {
++ if (image->depth == 1 && info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) {
+ int inbit, outbit, mult24, byte_id_in_dword, width;
+ u8 *pbitmapin = (u8*)image->data, *pbitmapout;
+ u32 hostdword;
+@@ -415,7 +415,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ }
+ }
+ wait_for_fifo(1, par);
+- aty_st_le32(HOST_DATA0, hostdword, par);
++ aty_st_le32(HOST_DATA0, le32_to_cpu(hostdword), par);
+ }
+ } else {
+ u32 *pbitmap, dwords = (src_bytes + 3) / 4;
+@@ -424,8 +424,4 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ aty_st_le32(HOST_DATA0, get_unaligned_le32(pbitmap), par);
+ }
+ }
+-
+- /* restore pix_width */
+- wait_for_fifo(1, par);
+- aty_st_le32(DP_PIX_WIDTH, pix_width_save, par);
+ }
+diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
+index 5f2e48d41d72..ab3d5f5dbb00 100644
+--- a/fs/9p/vfs_file.c
++++ b/fs/9p/vfs_file.c
+@@ -204,6 +204,14 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl)
+ break;
+ if (schedule_timeout_interruptible(P9_LOCK_TIMEOUT) != 0)
+ break;
++ /*
++ * p9_client_lock_dotl overwrites flock.client_id with the
++ * server message, free and reuse the client name
++ */
++ if (flock.client_id != fid->clnt->name) {
++ kfree(flock.client_id);
++ flock.client_id = fid->clnt->name;
++ }
+ }
+
+ /* map 9p status to VFS status */
+@@ -235,6 +243,8 @@ out_unlock:
+ locks_lock_file_wait(filp, fl);
+ fl->fl_type = fl_type;
+ }
++ if (flock.client_id != fid->clnt->name)
++ kfree(flock.client_id);
+ out:
+ return res;
+ }
+@@ -269,7 +279,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
+
+ res = p9_client_getlock_dotl(fid, &glock);
+ if (res < 0)
+- return res;
++ goto out;
+ /* map 9p lock type to os lock type */
+ switch (glock.type) {
+ case P9_LOCK_TYPE_RDLCK:
+@@ -290,7 +300,9 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
+ fl->fl_end = glock.start + glock.length - 1;
+ fl->fl_pid = -glock.proc_id;
+ }
+- kfree(glock.client_id);
++out:
++ if (glock.client_id != fid->clnt->name)
++ kfree(glock.client_id);
+ return res;
+ }
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 05dc3c17cb62..dc52ce5e495f 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4359,13 +4359,23 @@ static int btrfs_destroy_pinned_extent(struct btrfs_fs_info *fs_info,
+ unpin = pinned_extents;
+ again:
+ while (1) {
++ /*
++ * The btrfs_finish_extent_commit() may get the same range as
++ * ours between find_first_extent_bit and clear_extent_dirty.
++ * Hence, hold the unused_bg_unpin_mutex to avoid double unpin
++ * the same extent range.
++ */
++ mutex_lock(&fs_info->unused_bg_unpin_mutex);
+ ret = find_first_extent_bit(unpin, 0, &start, &end,
+ EXTENT_DIRTY, NULL);
+- if (ret)
++ if (ret) {
++ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ break;
++ }
+
+ clear_extent_dirty(unpin, start, end);
+ btrfs_error_unpin_extent_range(fs_info, start, end);
++ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ cond_resched();
+ }
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 83268d8f48c4..7158b5b77c9d 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1532,12 +1532,11 @@ out_check:
+ }
+ btrfs_release_path(path);
+
+- if (cur_offset <= end && cow_start == (u64)-1) {
++ if (cur_offset <= end && cow_start == (u64)-1)
+ cow_start = cur_offset;
+- cur_offset = end;
+- }
+
+ if (cow_start != (u64)-1) {
++ cur_offset = end;
+ ret = cow_file_range(inode, locked_page, cow_start, end, end,
+ page_started, nr_written, 1, NULL);
+ if (ret)
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index bd4767f562cd..c9152155fcbf 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3489,6 +3489,8 @@ static int btrfs_extent_same_range(struct inode *src, u64 loff, u64 olen,
+ const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize;
+
+ len = round_down(i_size_read(src), sz) - loff;
++ if (len == 0)
++ return 0;
+ olen = len;
+ }
+ }
+@@ -4278,9 +4280,17 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src,
+ goto out_unlock;
+ if (len == 0)
+ olen = len = src->i_size - off;
+- /* if we extend to eof, continue to block boundary */
+- if (off + len == src->i_size)
++ /*
++ * If we extend to eof, continue to block boundary if and only if the
++ * destination end offset matches the destination file's size, otherwise
++ * we would be corrupting data by placing the eof block into the middle
++ * of a file.
++ */
++ if (off + len == src->i_size) {
++ if (!IS_ALIGNED(len, bs) && destoff + len < inode->i_size)
++ goto out_unlock;
+ len = ALIGN(src->i_size, bs) - off;
++ }
+
+ if (len == 0) {
+ ret = 0;
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index db835635372f..d385778b628c 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -440,7 +440,7 @@ static int check_block_group_item(struct btrfs_fs_info *fs_info,
+ type != (BTRFS_BLOCK_GROUP_METADATA |
+ BTRFS_BLOCK_GROUP_DATA)) {
+ block_group_err(fs_info, leaf, slot,
+-"invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llu or 0x%llx",
++"invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llx or 0x%llx",
+ type, hweight64(type),
+ BTRFS_BLOCK_GROUP_DATA, BTRFS_BLOCK_GROUP_METADATA,
+ BTRFS_BLOCK_GROUP_SYSTEM,
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index d0bcfbfc0e3a..16ecb76fa53c 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -4399,6 +4399,23 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
+ logged_end = end;
+
+ list_for_each_entry_safe(em, n, &tree->modified_extents, list) {
++ /*
++ * Skip extents outside our logging range. It's important to do
++ * it for correctness because if we don't ignore them, we may
++ * log them before their ordered extent completes, and therefore
++ * we could log them without logging their respective checksums
++ * (the checksum items are added to the csum tree at the very
++ * end of btrfs_finish_ordered_io()). Also leave such extents
++ * outside of our range in the list, since we may have another
++ * ranged fsync in the near future that needs them. If an extent
++ * outside our range corresponds to a hole, log it to avoid
++ * leaving gaps between extents (fsck will complain when we are
++ * not using the NO_HOLES feature).
++ */
++ if ((em->start > end || em->start + em->len <= start) &&
++ em->block_start != EXTENT_MAP_HOLE)
++ continue;
++
+ list_del_init(&em->list);
+ /*
+ * Just an arbitrary number, this can be really CPU intensive
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index ebc7bdaed2d0..4055ab4d5c52 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1132,8 +1132,12 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in)
+ if (IS_ERR(realdn)) {
+ pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n",
+ PTR_ERR(realdn), dn, in, ceph_vinop(in));
+- dput(dn);
+- dn = realdn; /* note realdn contains the error */
++ dn = realdn;
++ /*
++ * Caller should release 'dn' in the case of error.
++ * If 'req->r_dentry' is passed to this function,
++ * caller should leave 'req->r_dentry' untouched.
++ */
+ goto out;
+ } else if (realdn) {
+ dout("dn %p (%d) spliced with %p (%d) "
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index d767e993591d..244531d3065a 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5804,9 +5804,10 @@ int ext4_mark_iloc_dirty(handle_t *handle,
+ {
+ int err = 0;
+
+- if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
++ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) {
++ put_bh(iloc->bh);
+ return -EIO;
+-
++ }
+ if (IS_I_VERSION(inode))
+ inode_inc_iversion(inode);
+
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 377d516c475f..ffa25753e929 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -126,6 +126,7 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode,
+ if (!is_dx_block && type == INDEX) {
+ ext4_error_inode(inode, func, line, block,
+ "directory leaf block found instead of index block");
++ brelse(bh);
+ return ERR_PTR(-EFSCORRUPTED);
+ }
+ if (!ext4_has_metadata_csum(inode->i_sb) ||
+@@ -2811,7 +2812,9 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
+ list_del_init(&EXT4_I(inode)->i_orphan);
+ mutex_unlock(&sbi->s_orphan_lock);
+ }
+- }
++ } else
++ brelse(iloc.bh);
++
+ jbd_debug(4, "superblock will point to %lu\n", inode->i_ino);
+ jbd_debug(4, "orphan inode %lu will point to %d\n",
+ inode->i_ino, NEXT_ORPHAN(inode));
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index ebbc663d0798..a5efee34415f 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -459,16 +459,18 @@ static int set_flexbg_block_bitmap(struct super_block *sb, handle_t *handle,
+
+ BUFFER_TRACE(bh, "get_write_access");
+ err = ext4_journal_get_write_access(handle, bh);
+- if (err)
++ if (err) {
++ brelse(bh);
+ return err;
++ }
+ ext4_debug("mark block bitmap %#04llx (+%llu/%u)\n",
+ first_cluster, first_cluster - start, count2);
+ ext4_set_bits(bh->b_data, first_cluster - start, count2);
+
+ err = ext4_handle_dirty_metadata(handle, NULL, bh);
++ brelse(bh);
+ if (unlikely(err))
+ return err;
+- brelse(bh);
+ }
+
+ return 0;
+@@ -605,7 +607,6 @@ handle_bb:
+ bh = bclean(handle, sb, block);
+ if (IS_ERR(bh)) {
+ err = PTR_ERR(bh);
+- bh = NULL;
+ goto out;
+ }
+ overhead = ext4_group_overhead_blocks(sb, group);
+@@ -618,9 +619,9 @@ handle_bb:
+ ext4_mark_bitmap_end(EXT4_B2C(sbi, group_data[i].blocks_count),
+ sb->s_blocksize * 8, bh->b_data);
+ err = ext4_handle_dirty_metadata(handle, NULL, bh);
++ brelse(bh);
+ if (err)
+ goto out;
+- brelse(bh);
+
+ handle_ib:
+ if (bg_flags[i] & EXT4_BG_INODE_UNINIT)
+@@ -635,18 +636,16 @@ handle_ib:
+ bh = bclean(handle, sb, block);
+ if (IS_ERR(bh)) {
+ err = PTR_ERR(bh);
+- bh = NULL;
+ goto out;
+ }
+
+ ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb),
+ sb->s_blocksize * 8, bh->b_data);
+ err = ext4_handle_dirty_metadata(handle, NULL, bh);
++ brelse(bh);
+ if (err)
+ goto out;
+- brelse(bh);
+ }
+- bh = NULL;
+
+ /* Mark group tables in block bitmap */
+ for (j = 0; j < GROUP_TABLE_COUNT; j++) {
+@@ -685,7 +684,6 @@ handle_ib:
+ }
+
+ out:
+- brelse(bh);
+ err2 = ext4_journal_stop(handle);
+ if (err2 && !err)
+ err = err2;
+@@ -873,6 +871,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ err = ext4_handle_dirty_metadata(handle, NULL, gdb_bh);
+ if (unlikely(err)) {
+ ext4_std_error(sb, err);
++ iloc.bh = NULL;
+ goto exit_inode;
+ }
+ brelse(dind);
+@@ -924,6 +923,7 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
+ sizeof(struct buffer_head *),
+ GFP_NOFS);
+ if (!n_group_desc) {
++ brelse(gdb_bh);
+ err = -ENOMEM;
+ ext4_warning(sb, "not enough memory for %lu groups",
+ gdb_num + 1);
+@@ -939,8 +939,6 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
+ kvfree(o_group_desc);
+ BUFFER_TRACE(gdb_bh, "get_write_access");
+ err = ext4_journal_get_write_access(handle, gdb_bh);
+- if (unlikely(err))
+- brelse(gdb_bh);
+ return err;
+ }
+
+@@ -1124,8 +1122,10 @@ static void update_backups(struct super_block *sb, sector_t blk_off, char *data,
+ backup_block, backup_block -
+ ext4_group_first_block_no(sb, group));
+ BUFFER_TRACE(bh, "get_write_access");
+- if ((err = ext4_journal_get_write_access(handle, bh)))
++ if ((err = ext4_journal_get_write_access(handle, bh))) {
++ brelse(bh);
+ break;
++ }
+ lock_buffer(bh);
+ memcpy(bh->b_data, data, size);
+ if (rest)
+@@ -2023,7 +2023,7 @@ retry:
+
+ err = ext4_alloc_flex_bg_array(sb, n_group + 1);
+ if (err)
+- return err;
++ goto out;
+
+ err = ext4_mb_alloc_groupinfo(sb, n_group + 1);
+ if (err)
+@@ -2059,6 +2059,10 @@ retry:
+ n_blocks_count_retry = 0;
+ free_flex_gd(flex_gd);
+ flex_gd = NULL;
++ if (resize_inode) {
++ iput(resize_inode);
++ resize_inode = NULL;
++ }
+ goto retry;
+ }
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index d3d4643ab79b..8a149df1c6a1 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4074,6 +4074,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ sbi->s_groups_count = blocks_count;
+ sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count,
+ (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
++ if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) !=
++ le32_to_cpu(es->s_inodes_count)) {
++ ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu",
++ le32_to_cpu(es->s_inodes_count),
++ ((u64)sbi->s_groups_count * sbi->s_inodes_per_group));
++ ret = -EINVAL;
++ goto failed_mount;
++ }
+ db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
+ EXT4_DESC_PER_BLOCK(sb);
+ if (ext4_has_feature_meta_bg(sb)) {
+@@ -4093,14 +4101,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ ret = -ENOMEM;
+ goto failed_mount;
+ }
+- if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) !=
+- le32_to_cpu(es->s_inodes_count)) {
+- ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu",
+- le32_to_cpu(es->s_inodes_count),
+- ((u64)sbi->s_groups_count * sbi->s_inodes_per_group));
+- ret = -EINVAL;
+- goto failed_mount;
+- }
+
+ bgl_lock_init(sbi->s_blockgroup_lock);
+
+@@ -4509,6 +4509,7 @@ failed_mount6:
+ percpu_counter_destroy(&sbi->s_freeinodes_counter);
+ percpu_counter_destroy(&sbi->s_dirs_counter);
+ percpu_counter_destroy(&sbi->s_dirtyclusters_counter);
++ percpu_free_rwsem(&sbi->s_journal_flag_rwsem);
+ failed_mount5:
+ ext4_ext_release(sb);
+ ext4_release_system_zone(sb);
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index f36fc5d5b257..4380c8630539 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1388,6 +1388,12 @@ retry:
+ bh = ext4_getblk(handle, ea_inode, block, 0);
+ if (IS_ERR(bh))
+ return PTR_ERR(bh);
++ if (!bh) {
++ WARN_ON_ONCE(1);
++ EXT4_ERROR_INODE(ea_inode,
++ "ext4_getblk() return bh = NULL");
++ return -EFSCORRUPTED;
++ }
+ ret = ext4_journal_get_write_access(handle, bh);
+ if (ret)
+ goto out;
+@@ -2276,8 +2282,10 @@ static struct buffer_head *ext4_xattr_get_block(struct inode *inode)
+ if (!bh)
+ return ERR_PTR(-EIO);
+ error = ext4_xattr_check_block(inode, bh);
+- if (error)
++ if (error) {
++ brelse(bh);
+ return ERR_PTR(error);
++ }
+ return bh;
+ }
+
+@@ -2397,6 +2405,8 @@ retry_inode:
+ error = ext4_xattr_block_set(handle, inode, &i, &bs);
+ } else if (error == -ENOSPC) {
+ if (EXT4_I(inode)->i_file_acl && !bs.s.base) {
++ brelse(bs.bh);
++ bs.bh = NULL;
+ error = ext4_xattr_block_find(inode, &i, &bs);
+ if (error)
+ goto cleanup;
+@@ -2617,6 +2627,8 @@ out:
+ kfree(buffer);
+ if (is)
+ brelse(is->iloc.bh);
++ if (bs)
++ brelse(bs->bh);
+ kfree(is);
+ kfree(bs);
+
+@@ -2696,7 +2708,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
+ struct ext4_inode *raw_inode, handle_t *handle)
+ {
+ struct ext4_xattr_ibody_header *header;
+- struct buffer_head *bh;
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ static unsigned int mnt_count;
+ size_t min_offs;
+@@ -2737,13 +2748,17 @@ retry:
+ * EA block can hold new_extra_isize bytes.
+ */
+ if (EXT4_I(inode)->i_file_acl) {
++ struct buffer_head *bh;
++
+ bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
+ error = -EIO;
+ if (!bh)
+ goto cleanup;
+ error = ext4_xattr_check_block(inode, bh);
+- if (error)
++ if (error) {
++ brelse(bh);
+ goto cleanup;
++ }
+ base = BHDR(bh);
+ end = bh->b_data + bh->b_size;
+ min_offs = end - base;
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 11ea2c4a38ab..bf0da0382c9e 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -129,9 +129,13 @@ static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
+
+ static void fuse_drop_waiting(struct fuse_conn *fc)
+ {
+- if (fc->connected) {
+- atomic_dec(&fc->num_waiting);
+- } else if (atomic_dec_and_test(&fc->num_waiting)) {
++ /*
++ * lockess check of fc->connected is okay, because atomic_dec_and_test()
++ * provides a memory barrier mached with the one in fuse_wait_aborted()
++ * to ensure no wake-up is missed.
++ */
++ if (atomic_dec_and_test(&fc->num_waiting) &&
++ !READ_ONCE(fc->connected)) {
+ /* wake up aborters */
+ wake_up_all(&fc->blocked_waitq);
+ }
+@@ -391,12 +395,19 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
+ if (test_bit(FR_BACKGROUND, &req->flags)) {
+ spin_lock(&fc->lock);
+ clear_bit(FR_BACKGROUND, &req->flags);
+- if (fc->num_background == fc->max_background)
++ if (fc->num_background == fc->max_background) {
+ fc->blocked = 0;
+-
+- /* Wake up next waiter, if any */
+- if (!fc->blocked && waitqueue_active(&fc->blocked_waitq))
+ wake_up(&fc->blocked_waitq);
++ } else if (!fc->blocked) {
++ /*
++ * Wake up next waiter, if any. It's okay to use
++ * waitqueue_active(), as we've already synced up
++ * fc->blocked with waiters with the wake_up() call
++ * above.
++ */
++ if (waitqueue_active(&fc->blocked_waitq))
++ wake_up(&fc->blocked_waitq);
++ }
+
+ if (fc->num_background == fc->congestion_threshold && fc->sb) {
+ clear_bdi_congested(fc->sb->s_bdi, BLK_RW_SYNC);
+@@ -1311,12 +1322,14 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
+ goto out_end;
+ }
+ list_move_tail(&req->list, &fpq->processing);
+- spin_unlock(&fpq->lock);
++ __fuse_get_request(req);
+ set_bit(FR_SENT, &req->flags);
++ spin_unlock(&fpq->lock);
+ /* matches barrier in request_wait_answer() */
+ smp_mb__after_atomic();
+ if (test_bit(FR_INTERRUPTED, &req->flags))
+ queue_interrupt(fiq, req);
++ fuse_put_request(fc, req);
+
+ return reqsize;
+
+@@ -1715,8 +1728,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
+ req->in.args[1].size = total_len;
+
+ err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
+- if (err)
++ if (err) {
+ fuse_retrieve_end(fc, req);
++ fuse_put_request(fc, req);
++ }
+
+ return err;
+ }
+@@ -1875,16 +1890,20 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
+
+ /* Is it an interrupt reply? */
+ if (req->intr_unique == oh.unique) {
++ __fuse_get_request(req);
+ spin_unlock(&fpq->lock);
+
+ err = -EINVAL;
+- if (nbytes != sizeof(struct fuse_out_header))
++ if (nbytes != sizeof(struct fuse_out_header)) {
++ fuse_put_request(fc, req);
+ goto err_finish;
++ }
+
+ if (oh.error == -ENOSYS)
+ fc->no_interrupt = 1;
+ else if (oh.error == -EAGAIN)
+ queue_interrupt(&fc->iq, req);
++ fuse_put_request(fc, req);
+
+ fuse_copy_finish(cs);
+ return nbytes;
+@@ -2152,6 +2171,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn);
+
+ void fuse_wait_aborted(struct fuse_conn *fc)
+ {
++ /* matches implicit memory barrier in fuse_drop_waiting() */
++ smp_mb();
+ wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0);
+ }
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 32d0b883e74f..a0ffed34b85d 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -2913,10 +2913,12 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
+ }
+
+ if (io->async) {
++ bool blocking = io->blocking;
++
+ fuse_aio_complete(io, ret < 0 ? ret : 0, -1);
+
+ /* we have a non-extending, async request, so return */
+- if (!io->blocking)
++ if (!blocking)
+ return -EIOCBQUEUED;
+
+ wait_for_completion(&wait);
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 84544a4f012d..8748539c04ed 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -1908,10 +1908,16 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)
+ if (ret < 0)
+ goto out;
+
+- /* issue read-ahead on metadata */
+- if (mp.mp_aheight > 1) {
+- for (; ret > 1; ret--) {
+- metapointer_range(&mp, mp.mp_aheight - ret,
++ /* On the first pass, issue read-ahead on metadata. */
++ if (mp.mp_aheight > 1 && strip_h == ip->i_height - 1) {
++ unsigned int height = mp.mp_aheight - 1;
++
++ /* No read-ahead for data blocks. */
++ if (mp.mp_aheight - 1 == strip_h)
++ height--;
++
++ for (; height >= mp.mp_aheight - ret; height--) {
++ metapointer_range(&mp, height,
+ start_list, start_aligned,
+ end_list, end_aligned,
+ &start, &end);
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 1ad3256b9cbc..449d0cb45a84 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -725,6 +725,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
+
+ if (gl) {
+ glock_clear_object(gl, rgd);
++ gfs2_rgrp_brelse(rgd);
+ gfs2_glock_put(gl);
+ }
+
+@@ -1141,7 +1142,7 @@ static u32 count_unlinked(struct gfs2_rgrpd *rgd)
+ * @rgd: the struct gfs2_rgrpd describing the RG to read in
+ *
+ * Read in all of a Resource Group's header and bitmap blocks.
+- * Caller must eventually call gfs2_rgrp_relse() to free the bitmaps.
++ * Caller must eventually call gfs2_rgrp_brelse() to free the bitmaps.
+ *
+ * Returns: errno
+ */
+diff --git a/fs/inode.c b/fs/inode.c
+index 42f6d25f32a5..65ae154df760 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -730,8 +730,11 @@ static enum lru_status inode_lru_isolate(struct list_head *item,
+ return LRU_REMOVED;
+ }
+
+- /* recently referenced inodes get one more pass */
+- if (inode->i_state & I_REFERENCED) {
++ /*
++ * Recently referenced inodes and inodes with many attached pages
++ * get one more pass.
++ */
++ if (inode->i_state & I_REFERENCED || inode->i_data.nrpages > 1) {
+ inode->i_state &= ~I_REFERENCED;
+ spin_unlock(&inode->i_lock);
+ return LRU_ROTATE;
+diff --git a/fs/ioctl.c b/fs/ioctl.c
+index 2005529af560..0400297c8d72 100644
+--- a/fs/ioctl.c
++++ b/fs/ioctl.c
+@@ -669,6 +669,9 @@ int do_vfs_ioctl(struct file *filp, unsigned int fd, unsigned int cmd,
+ return ioctl_fiemap(filp, arg);
+
+ case FIGETBSZ:
++ /* anon_bdev filesystems may not have a block size */
++ if (!inode->i_sb->s_blocksize)
++ return -EINVAL;
+ return put_user(inode->i_sb->s_blocksize, argp);
+
+ case FICLONE:
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 99186556f8d3..1fce41ba3535 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -695,9 +695,6 @@ static struct mountpoint *lookup_mountpoint(struct dentry *dentry)
+
+ hlist_for_each_entry(mp, chain, m_hash) {
+ if (mp->m_dentry == dentry) {
+- /* might be worth a WARN_ON() */
+- if (d_unlinked(dentry))
+- return ERR_PTR(-ENOENT);
+ mp->m_count++;
+ return mp;
+ }
+@@ -711,6 +708,9 @@ static struct mountpoint *get_mountpoint(struct dentry *dentry)
+ int ret;
+
+ if (d_mountpoint(dentry)) {
++ /* might be worth a WARN_ON() */
++ if (d_unlinked(dentry))
++ return ERR_PTR(-ENOENT);
+ mountpoint:
+ read_seqlock_excl(&mount_lock);
+ mp = lookup_mountpoint(dentry);
+@@ -1540,8 +1540,13 @@ static int do_umount(struct mount *mnt, int flags)
+
+ namespace_lock();
+ lock_mount_hash();
+- event++;
+
++ /* Recheck MNT_LOCKED with the locks held */
++ retval = -EINVAL;
++ if (mnt->mnt.mnt_flags & MNT_LOCKED)
++ goto out;
++
++ event++;
+ if (flags & MNT_DETACH) {
+ if (!list_empty(&mnt->mnt_list))
+ umount_tree(mnt, UMOUNT_PROPAGATE);
+@@ -1555,6 +1560,7 @@ static int do_umount(struct mount *mnt, int flags)
+ retval = 0;
+ }
+ }
++out:
+ unlock_mount_hash();
+ namespace_unlock();
+ return retval;
+@@ -1645,7 +1651,7 @@ int ksys_umount(char __user *name, int flags)
+ goto dput_and_out;
+ if (!check_mnt(mnt))
+ goto dput_and_out;
+- if (mnt->mnt.mnt_flags & MNT_LOCKED)
++ if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */
+ goto dput_and_out;
+ retval = -EPERM;
+ if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
+@@ -1728,8 +1734,14 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
+ for (s = r; s; s = next_mnt(s, r)) {
+ if (!(flag & CL_COPY_UNBINDABLE) &&
+ IS_MNT_UNBINDABLE(s)) {
+- s = skip_mnt_tree(s);
+- continue;
++ if (s->mnt.mnt_flags & MNT_LOCKED) {
++ /* Both unbindable and locked. */
++ q = ERR_PTR(-EPERM);
++ goto out;
++ } else {
++ s = skip_mnt_tree(s);
++ continue;
++ }
+ }
+ if (!(flag & CL_COPY_MNT_NS_FILE) &&
+ is_mnt_ns_file(s->mnt.mnt_root)) {
+@@ -1782,7 +1794,7 @@ void drop_collected_mounts(struct vfsmount *mnt)
+ {
+ namespace_lock();
+ lock_mount_hash();
+- umount_tree(real_mount(mnt), UMOUNT_SYNC);
++ umount_tree(real_mount(mnt), 0);
+ unlock_mount_hash();
+ namespace_unlock();
+ }
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 40a08cd483f0..18920152da14 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2583,11 +2583,12 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ nfs4_clear_state_manager_bit(clp);
+ /* Did we race with an attempt to give us more work? */
+ if (clp->cl_state == 0)
+- break;
++ return;
+ if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
+- break;
++ return;
+ } while (refcount_read(&clp->cl_count) > 1);
+- return;
++ goto out_drain;
++
+ out_error:
+ if (strlen(section))
+ section_sep = ": ";
+@@ -2595,6 +2596,7 @@ out_error:
+ " with error %d\n", section_sep, section,
+ clp->cl_hostname, -status);
+ ssleep(1);
++out_drain:
+ nfs4_end_drain_session(clp);
+ nfs4_clear_state_manager_bit(clp);
+ }
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index b7bc6e1a85ac..9d6b4f0f1a25 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1037,6 +1037,9 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ {
+ __be32 status;
+
++ if (!cstate->save_fh.fh_dentry)
++ return nfserr_nofilehandle;
++
+ status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->save_fh,
+ src_stateid, RD_STATE, src, NULL);
+ if (status) {
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
+index 302cd7caa4a7..7578bd507c70 100644
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -2412,8 +2412,16 @@ static int ocfs2_dio_end_io(struct kiocb *iocb,
+ /* this io's submitter should not have unlocked this before we could */
+ BUG_ON(!ocfs2_iocb_is_rw_locked(iocb));
+
+- if (bytes > 0 && private)
+- ret = ocfs2_dio_end_io_write(inode, private, offset, bytes);
++ if (bytes <= 0)
++ mlog_ratelimited(ML_ERROR, "Direct IO failed, bytes = %lld",
++ (long long)bytes);
++ if (private) {
++ if (bytes > 0)
++ ret = ocfs2_dio_end_io_write(inode, private, offset,
++ bytes);
++ else
++ ocfs2_dio_free_write_ctx(inode, private);
++ }
+
+ ocfs2_iocb_clear_rw_locked(iocb);
+
+diff --git a/fs/ocfs2/cluster/masklog.h b/fs/ocfs2/cluster/masklog.h
+index 308ea0eb35fd..a396096a5099 100644
+--- a/fs/ocfs2/cluster/masklog.h
++++ b/fs/ocfs2/cluster/masklog.h
+@@ -178,6 +178,15 @@ do { \
+ ##__VA_ARGS__); \
+ } while (0)
+
++#define mlog_ratelimited(mask, fmt, ...) \
++do { \
++ static DEFINE_RATELIMIT_STATE(_rs, \
++ DEFAULT_RATELIMIT_INTERVAL, \
++ DEFAULT_RATELIMIT_BURST); \
++ if (__ratelimit(&_rs)) \
++ mlog(mask, fmt, ##__VA_ARGS__); \
++} while (0)
++
+ #define mlog_errno(st) ({ \
+ int _st = (st); \
+ if (_st != -ERESTARTSYS && _st != -EINTR && \
+diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
+index b048d4fa3959..c121abbdfc7d 100644
+--- a/fs/ocfs2/dir.c
++++ b/fs/ocfs2/dir.c
+@@ -1897,8 +1897,7 @@ static int ocfs2_dir_foreach_blk_el(struct inode *inode,
+ /* On error, skip the f_pos to the
+ next block. */
+ ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1;
+- brelse(bh);
+- continue;
++ break;
+ }
+ if (le64_to_cpu(de->inode)) {
+ unsigned char d_type = DT_UNKNOWN;
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 276914ae3c60..3bbde0a9f48f 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -463,6 +463,10 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
+ if (IS_ERR(upper))
+ goto out_unlock;
+
++ err = -ESTALE;
++ if (d_is_negative(upper) || !IS_WHITEOUT(d_inode(upper)))
++ goto out_dput;
++
+ newdentry = ovl_create_temp(workdir, cattr);
+ err = PTR_ERR(newdentry);
+ if (IS_ERR(newdentry))
+@@ -663,6 +667,10 @@ static int ovl_link(struct dentry *old, struct inode *newdir,
+ if (err)
+ goto out_drop_write;
+
++ err = ovl_copy_up(new->d_parent);
++ if (err)
++ goto out_drop_write;
++
+ if (ovl_is_metacopy_dentry(old)) {
+ err = ovl_set_redirect(old, false);
+ if (err)
+diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
+index 9c0ca6a7becf..efd372312ef1 100644
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -422,8 +422,10 @@ int ovl_verify_set_fh(struct dentry *dentry, const char *name,
+
+ fh = ovl_encode_real_fh(real, is_upper);
+ err = PTR_ERR(fh);
+- if (IS_ERR(fh))
++ if (IS_ERR(fh)) {
++ fh = NULL;
+ goto fail;
++ }
+
+ err = ovl_verify_fh(dentry, name, fh);
+ if (set && err == -ENODATA)
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 30adc9d408a0..0fb0a59a5e5c 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -472,6 +472,7 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
+ {
+ char *p;
+ int err;
++ bool metacopy_opt = false, redirect_opt = false;
+
+ config->redirect_mode = kstrdup(ovl_redirect_mode_def(), GFP_KERNEL);
+ if (!config->redirect_mode)
+@@ -516,6 +517,7 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
+ config->redirect_mode = match_strdup(&args[0]);
+ if (!config->redirect_mode)
+ return -ENOMEM;
++ redirect_opt = true;
+ break;
+
+ case OPT_INDEX_ON:
+@@ -548,6 +550,7 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
+
+ case OPT_METACOPY_ON:
+ config->metacopy = true;
++ metacopy_opt = true;
+ break;
+
+ case OPT_METACOPY_OFF:
+@@ -572,13 +575,32 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
+ if (err)
+ return err;
+
+- /* metacopy feature with upper requires redirect_dir=on */
+- if (config->upperdir && config->metacopy && !config->redirect_dir) {
+- pr_warn("overlayfs: metadata only copy up requires \"redirect_dir=on\", falling back to metacopy=off.\n");
+- config->metacopy = false;
+- } else if (config->metacopy && !config->redirect_follow) {
+- pr_warn("overlayfs: metadata only copy up requires \"redirect_dir=follow\" on non-upper mount, falling back to metacopy=off.\n");
+- config->metacopy = false;
++ /*
++ * This is to make the logic below simpler. It doesn't make any other
++ * difference, since config->redirect_dir is only used for upper.
++ */
++ if (!config->upperdir && config->redirect_follow)
++ config->redirect_dir = true;
++
++ /* Resolve metacopy -> redirect_dir dependency */
++ if (config->metacopy && !config->redirect_dir) {
++ if (metacopy_opt && redirect_opt) {
++ pr_err("overlayfs: conflicting options: metacopy=on,redirect_dir=%s\n",
++ config->redirect_mode);
++ return -EINVAL;
++ }
++ if (redirect_opt) {
++ /*
++ * There was an explicit redirect_dir=... that resulted
++ * in this conflict.
++ */
++ pr_info("overlayfs: disabling metacopy due to redirect_dir=%s\n",
++ config->redirect_mode);
++ config->metacopy = false;
++ } else {
++ /* Automatically enable redirect otherwise. */
++ config->redirect_follow = config->redirect_dir = true;
++ }
+ }
+
+ return 0;
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 6f515651a2c2..b997e3116e37 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -613,14 +613,11 @@ static int udf_remount_fs(struct super_block *sb, int *flags, char *options)
+ struct udf_options uopt;
+ struct udf_sb_info *sbi = UDF_SB(sb);
+ int error = 0;
+- struct logicalVolIntegrityDescImpUse *lvidiu = udf_sb_lvidiu(sb);
++
++ if (!(*flags & SB_RDONLY) && UDF_QUERY_FLAG(sb, UDF_FLAG_RW_INCOMPAT))
++ return -EACCES;
+
+ sync_filesystem(sb);
+- if (lvidiu) {
+- int write_rev = le16_to_cpu(lvidiu->minUDFWriteRev);
+- if (write_rev > UDF_MAX_WRITE_VERSION && !(*flags & SB_RDONLY))
+- return -EACCES;
+- }
+
+ uopt.flags = sbi->s_flags;
+ uopt.uid = sbi->s_uid;
+@@ -1257,6 +1254,7 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block)
+ ret = -EACCES;
+ goto out_bh;
+ }
++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT);
+ ret = udf_load_vat(sb, i, type1_idx);
+ if (ret < 0)
+ goto out_bh;
+@@ -2155,10 +2153,12 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
+ UDF_MAX_READ_VERSION);
+ ret = -EINVAL;
+ goto error_out;
+- } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION &&
+- !sb_rdonly(sb)) {
+- ret = -EACCES;
+- goto error_out;
++ } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION) {
++ if (!sb_rdonly(sb)) {
++ ret = -EACCES;
++ goto error_out;
++ }
++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT);
+ }
+
+ sbi->s_udfrev = minUDFWriteRev;
+@@ -2176,10 +2176,12 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
+ }
+
+ if (sbi->s_partmaps[sbi->s_partition].s_partition_flags &
+- UDF_PART_FLAG_READ_ONLY &&
+- !sb_rdonly(sb)) {
+- ret = -EACCES;
+- goto error_out;
++ UDF_PART_FLAG_READ_ONLY) {
++ if (!sb_rdonly(sb)) {
++ ret = -EACCES;
++ goto error_out;
++ }
++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT);
+ }
+
+ if (udf_find_fileset(sb, &fileset, &rootdir)) {
+diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
+index 9424d7cab790..d12e507e9eb2 100644
+--- a/fs/udf/udf_sb.h
++++ b/fs/udf/udf_sb.h
+@@ -30,6 +30,8 @@
+ #define UDF_FLAG_LASTBLOCK_SET 16
+ #define UDF_FLAG_BLOCKSIZE_SET 17
+ #define UDF_FLAG_INCONSISTENT 18
++#define UDF_FLAG_RW_INCOMPAT 19 /* Set when we find RW incompatible
++ * feature */
+
+ #define UDF_PART_FLAG_UNALLOC_BITMAP 0x0001
+ #define UDF_PART_FLAG_UNALLOC_TABLE 0x0002
+diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h
+index 49c93b9308d7..68bb09c29ce8 100644
+--- a/include/linux/ceph/libceph.h
++++ b/include/linux/ceph/libceph.h
+@@ -81,7 +81,13 @@ struct ceph_options {
+
+ #define CEPH_MSG_MAX_FRONT_LEN (16*1024*1024)
+ #define CEPH_MSG_MAX_MIDDLE_LEN (16*1024*1024)
+-#define CEPH_MSG_MAX_DATA_LEN (16*1024*1024)
++
++/*
++ * Handle the largest possible rbd object in one message.
++ * There is no limit on the size of cephfs objects, but it has to obey
++ * rsize and wsize mount options anyway.
++ */
++#define CEPH_MSG_MAX_DATA_LEN (32*1024*1024)
+
+ #define CEPH_AUTH_NAME_DEFAULT "guest"
+
+diff --git a/include/linux/i8253.h b/include/linux/i8253.h
+index e6bb36a97519..8336b2f6f834 100644
+--- a/include/linux/i8253.h
++++ b/include/linux/i8253.h
+@@ -21,6 +21,7 @@
+ #define PIT_LATCH ((PIT_TICK_RATE + HZ/2) / HZ)
+
+ extern raw_spinlock_t i8253_lock;
++extern bool i8253_clear_counter_on_shutdown;
+ extern struct clock_event_device i8253_clockevent;
+ extern void clockevent_i8253_init(bool oneshot);
+
+diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
+index abe975c87b90..78b86dea2f29 100644
+--- a/include/linux/mtd/nand.h
++++ b/include/linux/mtd/nand.h
+@@ -324,9 +324,8 @@ static inline unsigned int nanddev_ntargets(const struct nand_device *nand)
+ */
+ static inline unsigned int nanddev_neraseblocks(const struct nand_device *nand)
+ {
+- return (u64)nand->memorg.luns_per_target *
+- nand->memorg.eraseblocks_per_lun *
+- nand->memorg.pages_per_eraseblock;
++ return nand->memorg.ntargets * nand->memorg.luns_per_target *
++ nand->memorg.eraseblocks_per_lun;
+ }
+
+ /**
+diff --git a/include/linux/nmi.h b/include/linux/nmi.h
+index 08f9247e9827..9003e29cde46 100644
+--- a/include/linux/nmi.h
++++ b/include/linux/nmi.h
+@@ -119,6 +119,8 @@ static inline int hardlockup_detector_perf_init(void) { return 0; }
+ void watchdog_nmi_stop(void);
+ void watchdog_nmi_start(void);
+ int watchdog_nmi_probe(void);
++int watchdog_nmi_enable(unsigned int cpu);
++void watchdog_nmi_disable(unsigned int cpu);
+
+ /**
+ * touch_nmi_watchdog - restart NMI watchdog timeout.
+diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h
+index 01674b56e14f..71a87c36e2b6 100644
+--- a/include/uapi/linux/kfd_ioctl.h
++++ b/include/uapi/linux/kfd_ioctl.h
+@@ -247,10 +247,10 @@ struct kfd_hsa_memory_exception_data {
+
+ /* hw exception data */
+ struct kfd_hsa_hw_exception_data {
+- uint32_t reset_type;
+- uint32_t reset_cause;
+- uint32_t memory_lost;
+- uint32_t gpu_id;
++ __u32 reset_type;
++ __u32 reset_cause;
++ __u32 memory_lost;
++ __u32 gpu_id;
+ };
+
+ /* Event data */
+diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h
+index fd18c974a619..f6e798d42069 100644
+--- a/include/xen/xen-ops.h
++++ b/include/xen/xen-ops.h
+@@ -41,7 +41,7 @@ int xen_setup_shutdown_event(void);
+
+ extern unsigned long *xen_contiguous_bitmap;
+
+-#ifdef CONFIG_XEN_PV
++#if defined(CONFIG_XEN_PV) || defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+ int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order,
+ unsigned int address_bits,
+ dma_addr_t *dma_handle);
+diff --git a/kernel/debug/kdb/kdb_bt.c b/kernel/debug/kdb/kdb_bt.c
+index 6ad4a9fcbd6f..7921ae4fca8d 100644
+--- a/kernel/debug/kdb/kdb_bt.c
++++ b/kernel/debug/kdb/kdb_bt.c
+@@ -179,14 +179,14 @@ kdb_bt(int argc, const char **argv)
+ kdb_printf("no process for cpu %ld\n", cpu);
+ return 0;
+ }
+- sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu));
++ sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu));
+ kdb_parse(buf);
+ return 0;
+ }
+ kdb_printf("btc: cpu status: ");
+ kdb_parse("cpu\n");
+ for_each_online_cpu(cpu) {
+- sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu));
++ sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu));
+ kdb_parse(buf);
+ touch_nmi_watchdog();
+ }
+diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
+index 2ddfce8f1e8f..f338d23b112b 100644
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -1192,7 +1192,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
+ if (reason == KDB_REASON_DEBUG) {
+ /* special case below */
+ } else {
+- kdb_printf("\nEntering kdb (current=0x%p, pid %d) ",
++ kdb_printf("\nEntering kdb (current=0x%px, pid %d) ",
+ kdb_current, kdb_current ? kdb_current->pid : 0);
+ #if defined(CONFIG_SMP)
+ kdb_printf("on processor %d ", raw_smp_processor_id());
+@@ -1208,7 +1208,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
+ */
+ switch (db_result) {
+ case KDB_DB_BPT:
+- kdb_printf("\nEntering kdb (0x%p, pid %d) ",
++ kdb_printf("\nEntering kdb (0x%px, pid %d) ",
+ kdb_current, kdb_current->pid);
+ #if defined(CONFIG_SMP)
+ kdb_printf("on processor %d ", raw_smp_processor_id());
+@@ -2048,7 +2048,7 @@ static int kdb_lsmod(int argc, const char **argv)
+ if (mod->state == MODULE_STATE_UNFORMED)
+ continue;
+
+- kdb_printf("%-20s%8u 0x%p ", mod->name,
++ kdb_printf("%-20s%8u 0x%px ", mod->name,
+ mod->core_layout.size, (void *)mod);
+ #ifdef CONFIG_MODULE_UNLOAD
+ kdb_printf("%4d ", module_refcount(mod));
+@@ -2059,7 +2059,7 @@ static int kdb_lsmod(int argc, const char **argv)
+ kdb_printf(" (Loading)");
+ else
+ kdb_printf(" (Live)");
+- kdb_printf(" 0x%p", mod->core_layout.base);
++ kdb_printf(" 0x%px", mod->core_layout.base);
+
+ #ifdef CONFIG_MODULE_UNLOAD
+ {
+@@ -2341,7 +2341,7 @@ void kdb_ps1(const struct task_struct *p)
+ return;
+
+ cpu = kdb_process_cpu(p);
+- kdb_printf("0x%p %8d %8d %d %4d %c 0x%p %c%s\n",
++ kdb_printf("0x%px %8d %8d %d %4d %c 0x%px %c%s\n",
+ (void *)p, p->pid, p->parent->pid,
+ kdb_task_has_cpu(p), kdb_process_cpu(p),
+ kdb_task_state_char(p),
+@@ -2354,7 +2354,7 @@ void kdb_ps1(const struct task_struct *p)
+ } else {
+ if (KDB_TSK(cpu) != p)
+ kdb_printf(" Error: does not match running "
+- "process table (0x%p)\n", KDB_TSK(cpu));
++ "process table (0x%px)\n", KDB_TSK(cpu));
+ }
+ }
+ }
+@@ -2692,7 +2692,7 @@ int kdb_register_flags(char *cmd,
+ for_each_kdbcmd(kp, i) {
+ if (kp->cmd_name && (strcmp(kp->cmd_name, cmd) == 0)) {
+ kdb_printf("Duplicate kdb command registered: "
+- "%s, func %p help %s\n", cmd, func, help);
++ "%s, func %px help %s\n", cmd, func, help);
+ return 1;
+ }
+ }
+diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
+index 990b3cc526c8..987eb73284d2 100644
+--- a/kernel/debug/kdb/kdb_support.c
++++ b/kernel/debug/kdb/kdb_support.c
+@@ -40,7 +40,7 @@
+ int kdbgetsymval(const char *symname, kdb_symtab_t *symtab)
+ {
+ if (KDB_DEBUG(AR))
+- kdb_printf("kdbgetsymval: symname=%s, symtab=%p\n", symname,
++ kdb_printf("kdbgetsymval: symname=%s, symtab=%px\n", symname,
+ symtab);
+ memset(symtab, 0, sizeof(*symtab));
+ symtab->sym_start = kallsyms_lookup_name(symname);
+@@ -88,7 +88,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
+ char *knt1 = NULL;
+
+ if (KDB_DEBUG(AR))
+- kdb_printf("kdbnearsym: addr=0x%lx, symtab=%p\n", addr, symtab);
++ kdb_printf("kdbnearsym: addr=0x%lx, symtab=%px\n", addr, symtab);
+ memset(symtab, 0, sizeof(*symtab));
+
+ if (addr < 4096)
+@@ -149,7 +149,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
+ symtab->mod_name = "kernel";
+ if (KDB_DEBUG(AR))
+ kdb_printf("kdbnearsym: returns %d symtab->sym_start=0x%lx, "
+- "symtab->mod_name=%p, symtab->sym_name=%p (%s)\n", ret,
++ "symtab->mod_name=%px, symtab->sym_name=%px (%s)\n", ret,
+ symtab->sym_start, symtab->mod_name, symtab->sym_name,
+ symtab->sym_name);
+
+@@ -887,13 +887,13 @@ void debug_kusage(void)
+ __func__, dah_first);
+ if (dah_first) {
+ h_used = (struct debug_alloc_header *)debug_alloc_pool;
+- kdb_printf("%s: h_used %p size %d\n", __func__, h_used,
++ kdb_printf("%s: h_used %px size %d\n", __func__, h_used,
+ h_used->size);
+ }
+ do {
+ h_used = (struct debug_alloc_header *)
+ ((char *)h_free + dah_overhead + h_free->size);
+- kdb_printf("%s: h_used %p size %d caller %p\n",
++ kdb_printf("%s: h_used %px size %d caller %px\n",
+ __func__, h_used, h_used->size, h_used->caller);
+ h_free = (struct debug_alloc_header *)
+ (debug_alloc_pool + h_free->next);
+@@ -902,7 +902,7 @@ void debug_kusage(void)
+ ((char *)h_free + dah_overhead + h_free->size);
+ if ((char *)h_used - debug_alloc_pool !=
+ sizeof(debug_alloc_pool_aligned))
+- kdb_printf("%s: h_used %p size %d caller %p\n",
++ kdb_printf("%s: h_used %px size %d caller %px\n",
+ __func__, h_used, h_used->size, h_used->caller);
+ out:
+ spin_unlock(&dap_lock);
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index c30032367aab..f9a0cd094b81 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -61,9 +61,23 @@ static nokprobe_inline bool trace_kprobe_within_module(struct trace_kprobe *tk,
+ return strncmp(mod->name, name, len) == 0 && name[len] == ':';
+ }
+
+-static nokprobe_inline bool trace_kprobe_is_on_module(struct trace_kprobe *tk)
++static nokprobe_inline bool trace_kprobe_module_exist(struct trace_kprobe *tk)
+ {
+- return !!strchr(trace_kprobe_symbol(tk), ':');
++ char *p;
++ bool ret;
++
++ if (!tk->symbol)
++ return false;
++ p = strchr(tk->symbol, ':');
++ if (!p)
++ return true;
++ *p = '\0';
++ mutex_lock(&module_mutex);
++ ret = !!find_module(tk->symbol);
++ mutex_unlock(&module_mutex);
++ *p = ':';
++
++ return ret;
+ }
+
+ static nokprobe_inline unsigned long trace_kprobe_nhit(struct trace_kprobe *tk)
+@@ -554,19 +568,13 @@ static int __register_trace_kprobe(struct trace_kprobe *tk)
+ else
+ ret = register_kprobe(&tk->rp.kp);
+
+- if (ret == 0)
++ if (ret == 0) {
+ tk->tp.flags |= TP_FLAG_REGISTERED;
+- else {
+- if (ret == -ENOENT && trace_kprobe_is_on_module(tk)) {
+- pr_warn("This probe might be able to register after target module is loaded. Continue.\n");
+- ret = 0;
+- } else if (ret == -EILSEQ) {
+- pr_warn("Probing address(0x%p) is not an instruction boundary.\n",
+- tk->rp.kp.addr);
+- ret = -EINVAL;
+- }
++ } else if (ret == -EILSEQ) {
++ pr_warn("Probing address(0x%p) is not an instruction boundary.\n",
++ tk->rp.kp.addr);
++ ret = -EINVAL;
+ }
+-
+ return ret;
+ }
+
+@@ -629,6 +637,11 @@ static int register_trace_kprobe(struct trace_kprobe *tk)
+
+ /* Register k*probe */
+ ret = __register_trace_kprobe(tk);
++ if (ret == -ENOENT && !trace_kprobe_module_exist(tk)) {
++ pr_warn("This probe might be able to register after target module is loaded. Continue.\n");
++ ret = 0;
++ }
++
+ if (ret < 0)
+ unregister_kprobe_event(tk);
+ else
+diff --git a/lib/ubsan.c b/lib/ubsan.c
+index 59fee96c29a0..e4162f59a81c 100644
+--- a/lib/ubsan.c
++++ b/lib/ubsan.c
+@@ -427,8 +427,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
+ EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds);
+
+
+-void __noreturn
+-__ubsan_handle_builtin_unreachable(struct unreachable_data *data)
++void __ubsan_handle_builtin_unreachable(struct unreachable_data *data)
+ {
+ unsigned long flags;
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 7b5c0ad9a6bd..1931a3d9b282 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3233,7 +3233,7 @@ static int is_hugetlb_entry_hwpoisoned(pte_t pte)
+ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
+ struct vm_area_struct *vma)
+ {
+- pte_t *src_pte, *dst_pte, entry;
++ pte_t *src_pte, *dst_pte, entry, dst_entry;
+ struct page *ptepage;
+ unsigned long addr;
+ int cow;
+@@ -3261,15 +3261,30 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
+ break;
+ }
+
+- /* If the pagetables are shared don't copy or take references */
+- if (dst_pte == src_pte)
++ /*
++ * If the pagetables are shared don't copy or take references.
++ * dst_pte == src_pte is the common case of src/dest sharing.
++ *
++ * However, src could have 'unshared' and dst shares with
++ * another vma. If dst_pte !none, this implies sharing.
++ * Check here before taking page table lock, and once again
++ * after taking the lock below.
++ */
++ dst_entry = huge_ptep_get(dst_pte);
++ if ((dst_pte == src_pte) || !huge_pte_none(dst_entry))
+ continue;
+
+ dst_ptl = huge_pte_lock(h, dst, dst_pte);
+ src_ptl = huge_pte_lockptr(h, src, src_pte);
+ spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
+ entry = huge_ptep_get(src_pte);
+- if (huge_pte_none(entry)) { /* skip none entry */
++ dst_entry = huge_ptep_get(dst_pte);
++ if (huge_pte_none(entry) || !huge_pte_none(dst_entry)) {
++ /*
++ * Skip if src entry none. Also, skip in the
++ * unlikely case dst entry !none as this implies
++ * sharing with another vma.
++ */
+ ;
+ } else if (unlikely(is_hugetlb_entry_migration(entry) ||
+ is_hugetlb_entry_hwpoisoned(entry))) {
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 38d94b703e9d..f3f919728f5c 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -587,6 +587,7 @@ int __remove_pages(struct zone *zone, unsigned long phys_start_pfn,
+ for (i = 0; i < sections_to_remove; i++) {
+ unsigned long pfn = phys_start_pfn + i*PAGES_PER_SECTION;
+
++ cond_resched();
+ ret = __remove_section(zone, __pfn_to_section(pfn), map_offset,
+ altmap);
+ map_offset = 0;
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index da858f794eb6..149b6f4cf023 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2046,8 +2046,36 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
+ nmask = policy_nodemask(gfp, pol);
+ if (!nmask || node_isset(hpage_node, *nmask)) {
+ mpol_cond_put(pol);
+- page = __alloc_pages_node(hpage_node,
+- gfp | __GFP_THISNODE, order);
++ /*
++ * We cannot invoke reclaim if __GFP_THISNODE
++ * is set. Invoking reclaim with
++ * __GFP_THISNODE set, would cause THP
++ * allocations to trigger heavy swapping
++ * despite there may be tons of free memory
++ * (including potentially plenty of THP
++ * already available in the buddy) on all the
++ * other NUMA nodes.
++ *
++ * At most we could invoke compaction when
++ * __GFP_THISNODE is set (but we would need to
++ * refrain from invoking reclaim even if
++ * compaction returned COMPACT_SKIPPED because
++ * there wasn't not enough memory to succeed
++ * compaction). For now just avoid
++ * __GFP_THISNODE instead of limiting the
++ * allocation path to a strict and single
++ * compaction invocation.
++ *
++ * Supposedly if direct reclaim was enabled by
++ * the caller, the app prefers THP regardless
++ * of the node it comes from so this would be
++ * more desiderable behavior than only
++ * providing THP originated from the local
++ * node in such case.
++ */
++ if (!(gfp & __GFP_DIRECT_RECLAIM))
++ gfp |= __GFP_THISNODE;
++ page = __alloc_pages_node(hpage_node, gfp, order);
+ goto out;
+ }
+ }
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index d954b71c4f9c..8810a6d7d67f 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2820,7 +2820,7 @@ static struct swap_info_struct *alloc_swap_info(void)
+ unsigned int type;
+ int i;
+
+- p = kzalloc(sizeof(*p), GFP_KERNEL);
++ p = kvzalloc(sizeof(*p), GFP_KERNEL);
+ if (!p)
+ return ERR_PTR(-ENOMEM);
+
+@@ -2831,7 +2831,7 @@ static struct swap_info_struct *alloc_swap_info(void)
+ }
+ if (type >= MAX_SWAPFILES) {
+ spin_unlock(&swap_lock);
+- kfree(p);
++ kvfree(p);
+ return ERR_PTR(-EPERM);
+ }
+ if (type >= nr_swapfiles) {
+@@ -2845,7 +2845,7 @@ static struct swap_info_struct *alloc_swap_info(void)
+ smp_wmb();
+ nr_swapfiles++;
+ } else {
+- kfree(p);
++ kvfree(p);
+ p = swap_info[type];
+ /*
+ * Do not memset this entry: a racing procfs swap_next()
+diff --git a/net/9p/protocol.c b/net/9p/protocol.c
+index 4a1e1dd30b52..ee32bbf12675 100644
+--- a/net/9p/protocol.c
++++ b/net/9p/protocol.c
+@@ -46,10 +46,15 @@ p9pdu_writef(struct p9_fcall *pdu, int proto_version, const char *fmt, ...);
+ void p9stat_free(struct p9_wstat *stbuf)
+ {
+ kfree(stbuf->name);
++ stbuf->name = NULL;
+ kfree(stbuf->uid);
++ stbuf->uid = NULL;
+ kfree(stbuf->gid);
++ stbuf->gid = NULL;
+ kfree(stbuf->muid);
++ stbuf->muid = NULL;
+ kfree(stbuf->extension);
++ stbuf->extension = NULL;
+ }
+ EXPORT_SYMBOL(p9stat_free);
+
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index a676d5f76bdc..277d02a8cac8 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1073,19 +1073,22 @@ static unsigned int early_drop_list(struct net *net,
+ return drops;
+ }
+
+-static noinline int early_drop(struct net *net, unsigned int _hash)
++static noinline int early_drop(struct net *net, unsigned int hash)
+ {
+- unsigned int i;
++ unsigned int i, bucket;
+
+ for (i = 0; i < NF_CT_EVICTION_RANGE; i++) {
+ struct hlist_nulls_head *ct_hash;
+- unsigned int hash, hsize, drops;
++ unsigned int hsize, drops;
+
+ rcu_read_lock();
+ nf_conntrack_get_ht(&ct_hash, &hsize);
+- hash = reciprocal_scale(_hash++, hsize);
++ if (!i)
++ bucket = reciprocal_scale(hash, hsize);
++ else
++ bucket = (bucket + 1) % hsize;
+
+- drops = early_drop_list(net, &ct_hash[hash]);
++ drops = early_drop_list(net, &ct_hash[bucket]);
+ rcu_read_unlock();
+
+ if (drops) {
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 30afbd236656..b53cc0960b5d 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -639,11 +639,10 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
+ WARN_ON_ONCE(xdr->iov);
+ return;
+ }
+- if (fraglen) {
++ if (fraglen)
+ xdr->end = head->iov_base + head->iov_len;
+- xdr->page_ptr--;
+- }
+ /* (otherwise assume xdr->end is already set) */
++ xdr->page_ptr--;
+ head->iov_len = len;
+ buf->len = len;
+ xdr->p = head->iov_base + head->iov_len;
+diff --git a/scripts/spdxcheck.py b/scripts/spdxcheck.py
+index 839e190bbd7a..5056fb3b897d 100755
+--- a/scripts/spdxcheck.py
++++ b/scripts/spdxcheck.py
+@@ -168,7 +168,6 @@ class id_parser(object):
+ self.curline = 0
+ try:
+ for line in fd:
+- line = line.decode(locale.getpreferredencoding(False), errors='ignore')
+ self.curline += 1
+ if self.curline > maxlines:
+ break
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 18b98b5e1e3c..fe251c6f09f1 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -5318,6 +5318,9 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname,
+ addr_buf = address;
+
+ while (walk_size < addrlen) {
++ if (walk_size + sizeof(sa_family_t) > addrlen)
++ return -EINVAL;
++
+ addr = addr_buf;
+ switch (addr->sa_family) {
+ case AF_UNSPEC:
+diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
+index 2ae640257fdb..ca577658e890 100644
+--- a/tools/perf/util/cs-etm.c
++++ b/tools/perf/util/cs-etm.c
+@@ -244,6 +244,27 @@ static void cs_etm__free(struct perf_session *session)
+ zfree(&aux);
+ }
+
++static u8 cs_etm__cpu_mode(struct cs_etm_queue *etmq, u64 address)
++{
++ struct machine *machine;
++
++ machine = etmq->etm->machine;
++
++ if (address >= etmq->etm->kernel_start) {
++ if (machine__is_host(machine))
++ return PERF_RECORD_MISC_KERNEL;
++ else
++ return PERF_RECORD_MISC_GUEST_KERNEL;
++ } else {
++ if (machine__is_host(machine))
++ return PERF_RECORD_MISC_USER;
++ else if (perf_guest)
++ return PERF_RECORD_MISC_GUEST_USER;
++ else
++ return PERF_RECORD_MISC_HYPERVISOR;
++ }
++}
++
+ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u64 address,
+ size_t size, u8 *buffer)
+ {
+@@ -258,10 +279,7 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u64 address,
+ return -1;
+
+ machine = etmq->etm->machine;
+- if (address >= etmq->etm->kernel_start)
+- cpumode = PERF_RECORD_MISC_KERNEL;
+- else
+- cpumode = PERF_RECORD_MISC_USER;
++ cpumode = cs_etm__cpu_mode(etmq, address);
+
+ thread = etmq->thread;
+ if (!thread) {
+@@ -653,7 +671,7 @@ static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq,
+ struct perf_sample sample = {.ip = 0,};
+
+ event->sample.header.type = PERF_RECORD_SAMPLE;
+- event->sample.header.misc = PERF_RECORD_MISC_USER;
++ event->sample.header.misc = cs_etm__cpu_mode(etmq, addr);
+ event->sample.header.size = sizeof(struct perf_event_header);
+
+ sample.ip = addr;
+@@ -665,7 +683,7 @@ static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq,
+ sample.cpu = etmq->packet->cpu;
+ sample.flags = 0;
+ sample.insn_len = 1;
+- sample.cpumode = event->header.misc;
++ sample.cpumode = event->sample.header.misc;
+
+ if (etm->synth_opts.last_branch) {
+ cs_etm__copy_last_branch_rb(etmq);
+@@ -706,12 +724,15 @@ static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq)
+ u64 nr;
+ struct branch_entry entries;
+ } dummy_bs;
++ u64 ip;
++
++ ip = cs_etm__last_executed_instr(etmq->prev_packet);
+
+ event->sample.header.type = PERF_RECORD_SAMPLE;
+- event->sample.header.misc = PERF_RECORD_MISC_USER;
++ event->sample.header.misc = cs_etm__cpu_mode(etmq, ip);
+ event->sample.header.size = sizeof(struct perf_event_header);
+
+- sample.ip = cs_etm__last_executed_instr(etmq->prev_packet);
++ sample.ip = ip;
+ sample.pid = etmq->pid;
+ sample.tid = etmq->tid;
+ sample.addr = cs_etm__first_executed_instr(etmq->packet);
+@@ -720,7 +741,7 @@ static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq)
+ sample.period = 1;
+ sample.cpu = etmq->packet->cpu;
+ sample.flags = 0;
+- sample.cpumode = PERF_RECORD_MISC_USER;
++ sample.cpumode = event->sample.header.misc;
+
+ /*
+ * perf report cannot handle events without a branch stack
+diff --git a/tools/perf/util/intel-bts.c b/tools/perf/util/intel-bts.c
+index 7f0c83b6332b..7127bc917fc5 100644
+--- a/tools/perf/util/intel-bts.c
++++ b/tools/perf/util/intel-bts.c
+@@ -269,6 +269,13 @@ static int intel_bts_do_fix_overlap(struct auxtrace_queue *queue,
+ return 0;
+ }
+
++static inline u8 intel_bts_cpumode(struct intel_bts *bts, uint64_t ip)
++{
++ return machine__kernel_ip(bts->machine, ip) ?
++ PERF_RECORD_MISC_KERNEL :
++ PERF_RECORD_MISC_USER;
++}
++
+ static int intel_bts_synth_branch_sample(struct intel_bts_queue *btsq,
+ struct branch *branch)
+ {
+@@ -281,12 +288,8 @@ static int intel_bts_synth_branch_sample(struct intel_bts_queue *btsq,
+ bts->num_events++ <= bts->synth_opts.initial_skip)
+ return 0;
+
+- event.sample.header.type = PERF_RECORD_SAMPLE;
+- event.sample.header.misc = PERF_RECORD_MISC_USER;
+- event.sample.header.size = sizeof(struct perf_event_header);
+-
+- sample.cpumode = PERF_RECORD_MISC_USER;
+ sample.ip = le64_to_cpu(branch->from);
++ sample.cpumode = intel_bts_cpumode(bts, sample.ip);
+ sample.pid = btsq->pid;
+ sample.tid = btsq->tid;
+ sample.addr = le64_to_cpu(branch->to);
+@@ -298,6 +301,10 @@ static int intel_bts_synth_branch_sample(struct intel_bts_queue *btsq,
+ sample.insn_len = btsq->intel_pt_insn.length;
+ memcpy(sample.insn, btsq->intel_pt_insn.buf, INTEL_PT_INSN_BUF_SZ);
+
++ event.sample.header.type = PERF_RECORD_SAMPLE;
++ event.sample.header.misc = sample.cpumode;
++ event.sample.header.size = sizeof(struct perf_event_header);
++
+ if (bts->synth_opts.inject) {
+ event.sample.header.size = bts->branches_event_size;
+ ret = perf_event__synthesize_sample(&event,
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index aec68908d604..4f48bc11a29c 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -407,6 +407,13 @@ intel_pt_cache_lookup(struct dso *dso, struct machine *machine, u64 offset)
+ return auxtrace_cache__lookup(dso->auxtrace_cache, offset);
+ }
+
++static inline u8 intel_pt_cpumode(struct intel_pt *pt, uint64_t ip)
++{
++ return ip >= pt->kernel_start ?
++ PERF_RECORD_MISC_KERNEL :
++ PERF_RECORD_MISC_USER;
++}
++
+ static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn,
+ uint64_t *insn_cnt_ptr, uint64_t *ip,
+ uint64_t to_ip, uint64_t max_insn_cnt,
+@@ -429,10 +436,7 @@ static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn,
+ if (to_ip && *ip == to_ip)
+ goto out_no_cache;
+
+- if (*ip >= ptq->pt->kernel_start)
+- cpumode = PERF_RECORD_MISC_KERNEL;
+- else
+- cpumode = PERF_RECORD_MISC_USER;
++ cpumode = intel_pt_cpumode(ptq->pt, *ip);
+
+ thread = ptq->thread;
+ if (!thread) {
+@@ -759,7 +763,8 @@ static struct intel_pt_queue *intel_pt_alloc_queue(struct intel_pt *pt,
+ if (pt->synth_opts.callchain) {
+ size_t sz = sizeof(struct ip_callchain);
+
+- sz += pt->synth_opts.callchain_sz * sizeof(u64);
++ /* Add 1 to callchain_sz for callchain context */
++ sz += (pt->synth_opts.callchain_sz + 1) * sizeof(u64);
+ ptq->chain = zalloc(sz);
+ if (!ptq->chain)
+ goto out_free;
+@@ -1053,15 +1058,11 @@ static void intel_pt_prep_b_sample(struct intel_pt *pt,
+ union perf_event *event,
+ struct perf_sample *sample)
+ {
+- event->sample.header.type = PERF_RECORD_SAMPLE;
+- event->sample.header.misc = PERF_RECORD_MISC_USER;
+- event->sample.header.size = sizeof(struct perf_event_header);
+-
+ if (!pt->timeless_decoding)
+ sample->time = tsc_to_perf_time(ptq->timestamp, &pt->tc);
+
+- sample->cpumode = PERF_RECORD_MISC_USER;
+ sample->ip = ptq->state->from_ip;
++ sample->cpumode = intel_pt_cpumode(pt, sample->ip);
+ sample->pid = ptq->pid;
+ sample->tid = ptq->tid;
+ sample->addr = ptq->state->to_ip;
+@@ -1070,6 +1071,10 @@ static void intel_pt_prep_b_sample(struct intel_pt *pt,
+ sample->flags = ptq->flags;
+ sample->insn_len = ptq->insn_len;
+ memcpy(sample->insn, ptq->insn, INTEL_PT_INSN_BUF_SZ);
++
++ event->sample.header.type = PERF_RECORD_SAMPLE;
++ event->sample.header.misc = sample->cpumode;
++ event->sample.header.size = sizeof(struct perf_event_header);
+ }
+
+ static int intel_pt_inject_event(union perf_event *event,
+@@ -1155,7 +1160,8 @@ static void intel_pt_prep_sample(struct intel_pt *pt,
+
+ if (pt->synth_opts.callchain) {
+ thread_stack__sample(ptq->thread, ptq->chain,
+- pt->synth_opts.callchain_sz, sample->ip);
++ pt->synth_opts.callchain_sz + 1,
++ sample->ip, pt->kernel_start);
+ sample->callchain = ptq->chain;
+ }
+
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index 111ae858cbcb..8ee8ab39d8ac 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -2140,6 +2140,27 @@ static int resolve_lbr_callchain_sample(struct thread *thread,
+ return 0;
+ }
+
++static int find_prev_cpumode(struct ip_callchain *chain, struct thread *thread,
++ struct callchain_cursor *cursor,
++ struct symbol **parent,
++ struct addr_location *root_al,
++ u8 *cpumode, int ent)
++{
++ int err = 0;
++
++ while (--ent >= 0) {
++ u64 ip = chain->ips[ent];
++
++ if (ip >= PERF_CONTEXT_MAX) {
++ err = add_callchain_ip(thread, cursor, parent,
++ root_al, cpumode, ip,
++ false, NULL, NULL, 0);
++ break;
++ }
++ }
++ return err;
++}
++
+ static int thread__resolve_callchain_sample(struct thread *thread,
+ struct callchain_cursor *cursor,
+ struct perf_evsel *evsel,
+@@ -2246,6 +2267,12 @@ static int thread__resolve_callchain_sample(struct thread *thread,
+ }
+
+ check_calls:
++ if (callchain_param.order != ORDER_CALLEE) {
++ err = find_prev_cpumode(chain, thread, cursor, parent, root_al,
++ &cpumode, chain->nr - first_call);
++ if (err)
++ return (err < 0) ? err : 0;
++ }
+ for (i = first_call, nr_entries = 0;
+ i < chain_nr && nr_entries < max_stack; i++) {
+ u64 ip;
+@@ -2260,9 +2287,15 @@ check_calls:
+ continue;
+ #endif
+ ip = chain->ips[j];
+-
+ if (ip < PERF_CONTEXT_MAX)
+ ++nr_entries;
++ else if (callchain_param.order != ORDER_CALLEE) {
++ err = find_prev_cpumode(chain, thread, cursor, parent,
++ root_al, &cpumode, j);
++ if (err)
++ return (err < 0) ? err : 0;
++ continue;
++ }
+
+ err = add_callchain_ip(thread, cursor, parent,
+ root_al, &cpumode, ip,
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index 7799788f662f..7e49baad304d 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -773,7 +773,7 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
+
+ if (!is_arm_pmu_core(name)) {
+ pname = pe->pmu ? pe->pmu : "cpu";
+- if (strncmp(pname, name, strlen(pname)))
++ if (strcmp(pname, name))
+ continue;
+ }
+
+diff --git a/tools/perf/util/thread-stack.c b/tools/perf/util/thread-stack.c
+index dd17d6a38d3a..a5669d05e91f 100644
+--- a/tools/perf/util/thread-stack.c
++++ b/tools/perf/util/thread-stack.c
+@@ -285,20 +285,46 @@ void thread_stack__free(struct thread *thread)
+ }
+ }
+
++static inline u64 callchain_context(u64 ip, u64 kernel_start)
++{
++ return ip < kernel_start ? PERF_CONTEXT_USER : PERF_CONTEXT_KERNEL;
++}
++
+ void thread_stack__sample(struct thread *thread, struct ip_callchain *chain,
+- size_t sz, u64 ip)
++ size_t sz, u64 ip, u64 kernel_start)
+ {
+- size_t i;
++ u64 context = callchain_context(ip, kernel_start);
++ u64 last_context;
++ size_t i, j;
+
+- if (!thread || !thread->ts)
+- chain->nr = 1;
+- else
+- chain->nr = min(sz, thread->ts->cnt + 1);
++ if (sz < 2) {
++ chain->nr = 0;
++ return;
++ }
+
+- chain->ips[0] = ip;
++ chain->ips[0] = context;
++ chain->ips[1] = ip;
++
++ if (!thread || !thread->ts) {
++ chain->nr = 2;
++ return;
++ }
++
++ last_context = context;
++
++ for (i = 2, j = 1; i < sz && j <= thread->ts->cnt; i++, j++) {
++ ip = thread->ts->stack[thread->ts->cnt - j].ret_addr;
++ context = callchain_context(ip, kernel_start);
++ if (context != last_context) {
++ if (i >= sz - 1)
++ break;
++ chain->ips[i++] = context;
++ last_context = context;
++ }
++ chain->ips[i] = ip;
++ }
+
+- for (i = 1; i < chain->nr; i++)
+- chain->ips[i] = thread->ts->stack[thread->ts->cnt - i].ret_addr;
++ chain->nr = i;
+ }
+
+ struct call_return_processor *
+diff --git a/tools/perf/util/thread-stack.h b/tools/perf/util/thread-stack.h
+index b7e41c4ebfdd..f97c00a8c251 100644
+--- a/tools/perf/util/thread-stack.h
++++ b/tools/perf/util/thread-stack.h
+@@ -84,7 +84,7 @@ int thread_stack__event(struct thread *thread, u32 flags, u64 from_ip,
+ u64 to_ip, u16 insn_len, u64 trace_nr);
+ void thread_stack__set_trace_nr(struct thread *thread, u64 trace_nr);
+ void thread_stack__sample(struct thread *thread, struct ip_callchain *chain,
+- size_t sz, u64 ip);
++ size_t sz, u64 ip, u64 kernel_start);
+ int thread_stack__flush(struct thread *thread);
+ void thread_stack__free(struct thread *thread);
+ size_t thread_stack__depth(struct thread *thread);
+diff --git a/tools/testing/selftests/powerpc/tm/tm-tmspr.c b/tools/testing/selftests/powerpc/tm/tm-tmspr.c
+index 2bda81c7bf23..df1d7d4b1c89 100644
+--- a/tools/testing/selftests/powerpc/tm/tm-tmspr.c
++++ b/tools/testing/selftests/powerpc/tm/tm-tmspr.c
+@@ -98,7 +98,7 @@ void texasr(void *in)
+
+ int test_tmspr()
+ {
+- pthread_t thread;
++ pthread_t *thread;
+ int thread_num;
+ unsigned long i;
+
+@@ -107,21 +107,28 @@ int test_tmspr()
+ /* To cause some context switching */
+ thread_num = 10 * sysconf(_SC_NPROCESSORS_ONLN);
+
++ thread = malloc(thread_num * sizeof(pthread_t));
++ if (thread == NULL)
++ return EXIT_FAILURE;
++
+ /* Test TFIAR and TFHAR */
+- for (i = 0 ; i < thread_num ; i += 2){
+- if (pthread_create(&thread, NULL, (void*)tfiar_tfhar, (void *)i))
++ for (i = 0; i < thread_num; i += 2) {
++ if (pthread_create(&thread[i], NULL, (void *)tfiar_tfhar,
++ (void *)i))
+ return EXIT_FAILURE;
+ }
+- if (pthread_join(thread, NULL) != 0)
+- return EXIT_FAILURE;
+-
+ /* Test TEXASR */
+- for (i = 0 ; i < thread_num ; i++){
+- if (pthread_create(&thread, NULL, (void*)texasr, (void *)i))
++ for (i = 1; i < thread_num; i += 2) {
++ if (pthread_create(&thread[i], NULL, (void *)texasr, (void *)i))
+ return EXIT_FAILURE;
+ }
+- if (pthread_join(thread, NULL) != 0)
+- return EXIT_FAILURE;
++
++ for (i = 0; i < thread_num; i++) {
++ if (pthread_join(thread[i], NULL) != 0)
++ return EXIT_FAILURE;
++ }
++
++ free(thread);
+
+ if (passed)
+ return 0;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-11-23 12:42 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-11-23 12:42 UTC (permalink / raw
To: gentoo-commits
commit: dbdea736f818d9e94ece21b82d2ec584871eb772
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Nov 23 12:42:23 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Nov 23 12:42:23 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dbdea736
proj/linux-patches: Linux patch 4.19.4
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1003_linux-4.19.4.patch | 1733 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1737 insertions(+)
diff --git a/0000_README b/0000_README
index 6ce85c3..f74e5e3 100644
--- a/0000_README
+++ b/0000_README
@@ -55,6 +55,10 @@ Patch: 1002_linux-4.19.3.patch
From: http://www.kernel.org
Desc: Linux 4.19.3
+Patch: 1003_linux-4.19.4.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.4
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1003_linux-4.19.4.patch b/1003_linux-4.19.4.patch
new file mode 100644
index 0000000..6ff628e
--- /dev/null
+++ b/1003_linux-4.19.4.patch
@@ -0,0 +1,1733 @@
+diff --git a/Makefile b/Makefile
+index e4064fa16f11..1f3c7adeea63 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 53eb14a65610..40bdaea97fe7 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -35,10 +35,12 @@ static void __init spectre_v2_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
+
+-/* The base value of the SPEC_CTRL MSR that always has to be preserved. */
+-u64 x86_spec_ctrl_base;
++/*
++ * Our boot-time value of the SPEC_CTRL MSR. We read it once so that any
++ * writes to SPEC_CTRL contain whatever reserved bits have been set.
++ */
++u64 __ro_after_init x86_spec_ctrl_base;
+ EXPORT_SYMBOL_GPL(x86_spec_ctrl_base);
+-static DEFINE_MUTEX(spec_ctrl_mutex);
+
+ /*
+ * The vendor and possibly platform specific bits which can be modified in
+@@ -323,46 +325,6 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ return cmd;
+ }
+
+-static bool stibp_needed(void)
+-{
+- if (spectre_v2_enabled == SPECTRE_V2_NONE)
+- return false;
+-
+- if (!boot_cpu_has(X86_FEATURE_STIBP))
+- return false;
+-
+- return true;
+-}
+-
+-static void update_stibp_msr(void *info)
+-{
+- wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+-}
+-
+-void arch_smt_update(void)
+-{
+- u64 mask;
+-
+- if (!stibp_needed())
+- return;
+-
+- mutex_lock(&spec_ctrl_mutex);
+- mask = x86_spec_ctrl_base;
+- if (cpu_smt_control == CPU_SMT_ENABLED)
+- mask |= SPEC_CTRL_STIBP;
+- else
+- mask &= ~SPEC_CTRL_STIBP;
+-
+- if (mask != x86_spec_ctrl_base) {
+- pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n",
+- cpu_smt_control == CPU_SMT_ENABLED ?
+- "Enabling" : "Disabling");
+- x86_spec_ctrl_base = mask;
+- on_each_cpu(update_stibp_msr, NULL, 1);
+- }
+- mutex_unlock(&spec_ctrl_mutex);
+-}
+-
+ static void __init spectre_v2_select_mitigation(void)
+ {
+ enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
+@@ -462,9 +424,6 @@ specv2_set_mode:
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+ pr_info("Enabling Restricted Speculation for firmware calls\n");
+ }
+-
+- /* Enable STIBP if appropriate */
+- arch_smt_update();
+ }
+
+ #undef pr_fmt
+@@ -855,8 +814,6 @@ static ssize_t l1tf_show_state(char *buf)
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+ char *buf, unsigned int bug)
+ {
+- int ret;
+-
+ if (!boot_cpu_has_bug(bug))
+ return sprintf(buf, "Not affected\n");
+
+@@ -874,12 +831,10 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ return sprintf(buf, "Mitigation: __user pointer sanitization\n");
+
+ case X86_BUG_SPECTRE_V2:
+- ret = sprintf(buf, "%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
++ return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+ boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
+- (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
+ spectre_v2_module_string());
+- return ret;
+
+ case X86_BUG_SPEC_STORE_BYPASS:
+ return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
+diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
+index 54e0ca6ed730..86b6464b4525 100644
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -1117,11 +1117,6 @@ static int ksz_switch_init(struct ksz_device *dev)
+ {
+ int i;
+
+- mutex_init(&dev->reg_mutex);
+- mutex_init(&dev->stats_mutex);
+- mutex_init(&dev->alu_mutex);
+- mutex_init(&dev->vlan_mutex);
+-
+ dev->ds->ops = &ksz_switch_ops;
+
+ for (i = 0; i < ARRAY_SIZE(ksz_switch_chips); i++) {
+@@ -1206,6 +1201,11 @@ int ksz_switch_register(struct ksz_device *dev)
+ if (dev->pdata)
+ dev->chip_id = dev->pdata->chip_id;
+
++ mutex_init(&dev->reg_mutex);
++ mutex_init(&dev->stats_mutex);
++ mutex_init(&dev->alu_mutex);
++ mutex_init(&dev->vlan_mutex);
++
+ if (ksz_switch_detect(dev))
+ return -EINVAL;
+
+diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c
+index d721ccf7d8be..38e399e0f30e 100644
+--- a/drivers/net/dsa/mv88e6xxx/global1.c
++++ b/drivers/net/dsa/mv88e6xxx/global1.c
+@@ -567,6 +567,8 @@ int mv88e6xxx_g1_stats_clear(struct mv88e6xxx_chip *chip)
+ if (err)
+ return err;
+
++ /* Keep the histogram mode bits */
++ val &= MV88E6XXX_G1_STATS_OP_HIST_RX_TX;
+ val |= MV88E6XXX_G1_STATS_OP_BUSY | MV88E6XXX_G1_STATS_OP_FLUSH_ALL;
+
+ err = mv88e6xxx_g1_write(chip, MV88E6XXX_G1_STATS_OP, val);
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index c57238fce863..7b6859e4924e 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -1897,9 +1897,6 @@ static void bcm_sysport_netif_start(struct net_device *dev)
+ intrl2_1_mask_clear(priv, 0xffffffff);
+ else
+ intrl2_0_mask_clear(priv, INTRL2_0_TDMA_MBDONE_MASK);
+-
+- /* Last call before we start the real business */
+- netif_tx_start_all_queues(dev);
+ }
+
+ static void rbuf_init(struct bcm_sysport_priv *priv)
+@@ -2045,6 +2042,8 @@ static int bcm_sysport_open(struct net_device *dev)
+
+ bcm_sysport_netif_start(dev);
+
++ netif_tx_start_all_queues(dev);
++
+ return 0;
+
+ out_clear_rx_int:
+@@ -2068,7 +2067,7 @@ static void bcm_sysport_netif_stop(struct net_device *dev)
+ struct bcm_sysport_priv *priv = netdev_priv(dev);
+
+ /* stop all software from updating hardware */
+- netif_tx_stop_all_queues(dev);
++ netif_tx_disable(dev);
+ napi_disable(&priv->napi);
+ cancel_work_sync(&priv->dim.dim.work);
+ phy_stop(dev->phydev);
+@@ -2654,12 +2653,12 @@ static int __maybe_unused bcm_sysport_suspend(struct device *d)
+ if (!netif_running(dev))
+ return 0;
+
++ netif_device_detach(dev);
++
+ bcm_sysport_netif_stop(dev);
+
+ phy_suspend(dev->phydev);
+
+- netif_device_detach(dev);
+-
+ /* Disable UniMAC RX */
+ umac_enable_set(priv, CMD_RX_EN, 0);
+
+@@ -2743,8 +2742,6 @@ static int __maybe_unused bcm_sysport_resume(struct device *d)
+ goto out_free_rx_ring;
+ }
+
+- netif_device_attach(dev);
+-
+ /* RX pipe enable */
+ topctrl_writel(priv, 0, RX_FLUSH_CNTL);
+
+@@ -2789,6 +2786,8 @@ static int __maybe_unused bcm_sysport_resume(struct device *d)
+
+ bcm_sysport_netif_start(dev);
+
++ netif_device_attach(dev);
++
+ return 0;
+
+ out_free_rx_ring:
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 20c1681bb1af..2d6f090bf644 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2855,7 +2855,6 @@ static void bcmgenet_netif_start(struct net_device *dev)
+
+ umac_enable_set(priv, CMD_TX_EN | CMD_RX_EN, true);
+
+- netif_tx_start_all_queues(dev);
+ bcmgenet_enable_tx_napi(priv);
+
+ /* Monitor link interrupts now */
+@@ -2937,6 +2936,8 @@ static int bcmgenet_open(struct net_device *dev)
+
+ bcmgenet_netif_start(dev);
+
++ netif_tx_start_all_queues(dev);
++
+ return 0;
+
+ err_irq1:
+@@ -2958,7 +2959,7 @@ static void bcmgenet_netif_stop(struct net_device *dev)
+ struct bcmgenet_priv *priv = netdev_priv(dev);
+
+ bcmgenet_disable_tx_napi(priv);
+- netif_tx_stop_all_queues(dev);
++ netif_tx_disable(dev);
+
+ /* Disable MAC receive */
+ umac_enable_set(priv, CMD_RX_EN, false);
+@@ -3620,13 +3621,13 @@ static int bcmgenet_suspend(struct device *d)
+ if (!netif_running(dev))
+ return 0;
+
++ netif_device_detach(dev);
++
+ bcmgenet_netif_stop(dev);
+
+ if (!device_may_wakeup(d))
+ phy_suspend(dev->phydev);
+
+- netif_device_detach(dev);
+-
+ /* Prepare the device for Wake-on-LAN and switch to the slow clock */
+ if (device_may_wakeup(d) && priv->wolopts) {
+ ret = bcmgenet_power_down(priv, GENET_POWER_WOL_MAGIC);
+@@ -3700,8 +3701,6 @@ static int bcmgenet_resume(struct device *d)
+ /* Always enable ring 16 - descriptor ring */
+ bcmgenet_enable_dma(priv, dma_ctrl);
+
+- netif_device_attach(dev);
+-
+ if (!device_may_wakeup(d))
+ phy_resume(dev->phydev);
+
+@@ -3710,6 +3709,8 @@ static int bcmgenet_resume(struct device *d)
+
+ bcmgenet_netif_start(dev);
+
++ netif_device_attach(dev);
++
+ return 0;
+
+ out_clk_disable:
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index e6f28c7942ab..a12962702611 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -12426,6 +12426,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
+ {
+ struct tg3 *tp = netdev_priv(dev);
+ int i, irq_sync = 0, err = 0;
++ bool reset_phy = false;
+
+ if ((ering->rx_pending > tp->rx_std_ring_mask) ||
+ (ering->rx_jumbo_pending > tp->rx_jmb_ring_mask) ||
+@@ -12457,7 +12458,13 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
+
+ if (netif_running(dev)) {
+ tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+- err = tg3_restart_hw(tp, false);
++ /* Reset PHY to avoid PHY lock up */
++ if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
++ tg3_asic_rev(tp) == ASIC_REV_5719 ||
++ tg3_asic_rev(tp) == ASIC_REV_5720)
++ reset_phy = true;
++
++ err = tg3_restart_hw(tp, reset_phy);
+ if (!err)
+ tg3_netif_start(tp);
+ }
+@@ -12491,6 +12498,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
+ {
+ struct tg3 *tp = netdev_priv(dev);
+ int err = 0;
++ bool reset_phy = false;
+
+ if (tp->link_config.autoneg == AUTONEG_ENABLE)
+ tg3_warn_mgmt_link_flap(tp);
+@@ -12581,7 +12589,13 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
+
+ if (netif_running(dev)) {
+ tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+- err = tg3_restart_hw(tp, false);
++ /* Reset PHY to avoid PHY lock up */
++ if (tg3_asic_rev(tp) == ASIC_REV_5717 ||
++ tg3_asic_rev(tp) == ASIC_REV_5719 ||
++ tg3_asic_rev(tp) == ASIC_REV_5720)
++ reset_phy = true;
++
++ err = tg3_restart_hw(tp, reset_phy);
+ if (!err)
+ tg3_netif_start(tp);
+ }
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 699ef942b615..7661064c815b 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1545,7 +1545,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ tx_crq.v1.sge_len = cpu_to_be32(skb->len);
+ tx_crq.v1.ioba = cpu_to_be64(data_dma_addr);
+
+- if (adapter->vlan_header_insertion) {
++ if (adapter->vlan_header_insertion && skb_vlan_tag_present(skb)) {
+ tx_crq.v1.flags2 |= IBMVNIC_TX_VLAN_INSERT;
+ tx_crq.v1.vlan_id = cpu_to_be16(skb->vlan_tci);
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+index 0f189f873859..16ceeb1b2c9d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -566,6 +566,7 @@ struct mlx5e_rq {
+
+ unsigned long state;
+ int ix;
++ unsigned int hw_mtu;
+
+ struct net_dim dim; /* Dynamic Interrupt Moderation */
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
+index 24e3b564964f..12e1682f940b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port.c
+@@ -88,10 +88,8 @@ int mlx5e_port_linkspeed(struct mlx5_core_dev *mdev, u32 *speed)
+
+ eth_proto_oper = MLX5_GET(ptys_reg, out, eth_proto_oper);
+ *speed = mlx5e_port_ptys2speed(eth_proto_oper);
+- if (!(*speed)) {
+- mlx5_core_warn(mdev, "cannot get port speed\n");
++ if (!(*speed))
+ err = -EINVAL;
+- }
+
+ return err;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+index c047da8752da..eac245a93f91 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+@@ -130,8 +130,10 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
+ int err;
+
+ err = mlx5e_port_linkspeed(priv->mdev, &speed);
+- if (err)
++ if (err) {
++ mlx5_core_warn(priv->mdev, "cannot get port speed\n");
+ return 0;
++ }
+
+ xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100;
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index f291d1bf1558..faa84b45e20a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -492,6 +492,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
+ rq->channel = c;
+ rq->ix = c->ix;
+ rq->mdev = mdev;
++ rq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu);
+ rq->stats = &c->priv->channel_stats[c->ix].rq;
+
+ rq->xdp_prog = params->xdp_prog ? bpf_prog_inc(params->xdp_prog) : NULL;
+@@ -1610,13 +1611,15 @@ static int mlx5e_alloc_cq_common(struct mlx5_core_dev *mdev,
+ int err;
+ u32 i;
+
++ err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn);
++ if (err)
++ return err;
++
+ err = mlx5_cqwq_create(mdev, ¶m->wq, param->cqc, &cq->wq,
+ &cq->wq_ctrl);
+ if (err)
+ return err;
+
+- mlx5_vector2eqn(mdev, param->eq_ix, &eqn_not_used, &irqn);
+-
+ mcq->cqe_sz = 64;
+ mcq->set_ci_db = cq->wq_ctrl.db.db;
+ mcq->arm_db = cq->wq_ctrl.db.db + 1;
+@@ -1674,6 +1677,10 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)
+ int eqn;
+ int err;
+
++ err = mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used);
++ if (err)
++ return err;
++
+ inlen = MLX5_ST_SZ_BYTES(create_cq_in) +
+ sizeof(u64) * cq->wq_ctrl.buf.npages;
+ in = kvzalloc(inlen, GFP_KERNEL);
+@@ -1687,8 +1694,6 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param)
+ mlx5_fill_page_frag_array(&cq->wq_ctrl.buf,
+ (__be64 *)MLX5_ADDR_OF(create_cq_in, in, pas));
+
+- mlx5_vector2eqn(mdev, param->eq_ix, &eqn, &irqn_not_used);
+-
+ MLX5_SET(cqc, cqc, cq_period_mode, param->cq_period_mode);
+ MLX5_SET(cqc, cqc, c_eqn, eqn);
+ MLX5_SET(cqc, cqc, uar_page, mdev->priv.uar->index);
+@@ -1908,6 +1913,10 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
+ int err;
+ int eqn;
+
++ err = mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq);
++ if (err)
++ return err;
++
+ c = kvzalloc_node(sizeof(*c), GFP_KERNEL, cpu_to_node(cpu));
+ if (!c)
+ return -ENOMEM;
+@@ -1924,7 +1933,6 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
+ c->xdp = !!params->xdp_prog;
+ c->stats = &priv->channel_stats[ix].ch;
+
+- mlx5_vector2eqn(priv->mdev, ix, &eqn, &irq);
+ c->irq_desc = irq_to_desc(irq);
+
+ netif_napi_add(netdev, &c->napi, mlx5e_napi_poll, 64);
+@@ -3566,6 +3574,7 @@ static int set_feature_cvlan_filter(struct net_device *netdev, bool enable)
+ return 0;
+ }
+
++#ifdef CONFIG_MLX5_ESWITCH
+ static int set_feature_tc_num_filters(struct net_device *netdev, bool enable)
+ {
+ struct mlx5e_priv *priv = netdev_priv(netdev);
+@@ -3578,6 +3587,7 @@ static int set_feature_tc_num_filters(struct net_device *netdev, bool enable)
+
+ return 0;
+ }
++#endif
+
+ static int set_feature_rx_all(struct net_device *netdev, bool enable)
+ {
+@@ -3676,7 +3686,9 @@ static int mlx5e_set_features(struct net_device *netdev,
+ err |= MLX5E_HANDLE_FEATURE(NETIF_F_LRO, set_feature_lro);
+ err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_FILTER,
+ set_feature_cvlan_filter);
++#ifdef CONFIG_MLX5_ESWITCH
+ err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_TC, set_feature_tc_num_filters);
++#endif
+ err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXALL, set_feature_rx_all);
+ err |= MLX5E_HANDLE_FEATURE(NETIF_F_RXFCS, set_feature_rx_fcs);
+ err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_RX, set_feature_rx_vlan);
+@@ -3747,10 +3759,11 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
+ }
+
+ if (params->rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ) {
++ bool is_linear = mlx5e_rx_mpwqe_is_linear_skb(priv->mdev, &new_channels.params);
+ u8 ppw_old = mlx5e_mpwqe_log_pkts_per_wqe(params);
+ u8 ppw_new = mlx5e_mpwqe_log_pkts_per_wqe(&new_channels.params);
+
+- reset = reset && (ppw_old != ppw_new);
++ reset = reset && (is_linear || (ppw_old != ppw_new));
+ }
+
+ if (!reset) {
+@@ -4685,7 +4698,9 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
+ FT_CAP(modify_root) &&
+ FT_CAP(identified_miss_table_mode) &&
+ FT_CAP(flow_table_modify)) {
++#ifdef CONFIG_MLX5_ESWITCH
+ netdev->hw_features |= NETIF_F_HW_TC;
++#endif
+ #ifdef CONFIG_MLX5_EN_ARFS
+ netdev->hw_features |= NETIF_F_NTUPLE;
+ #endif
+@@ -4958,11 +4973,21 @@ int mlx5e_attach_netdev(struct mlx5e_priv *priv)
+ {
+ struct mlx5_core_dev *mdev = priv->mdev;
+ const struct mlx5e_profile *profile;
++ int max_nch;
+ int err;
+
+ profile = priv->profile;
+ clear_bit(MLX5E_STATE_DESTROYING, &priv->state);
+
++ /* max number of channels may have changed */
++ max_nch = mlx5e_get_max_num_channels(priv->mdev);
++ if (priv->channels.params.num_channels > max_nch) {
++ mlx5_core_warn(priv->mdev, "MLX5E: Reducing number of channels to %d\n", max_nch);
++ priv->channels.params.num_channels = max_nch;
++ mlx5e_build_default_indir_rqt(priv->channels.params.indirection_rqt,
++ MLX5E_INDIR_RQT_SIZE, max_nch);
++ }
++
+ err = profile->init_tx(priv);
+ if (err)
+ goto out;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index a144146b769c..d543a5cff049 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -1064,6 +1064,12 @@ mlx5e_skb_from_cqe_mpwrq_linear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wi,
+ u32 frag_size;
+ bool consumed;
+
++ /* Check packet size. Note LRO doesn't use linear SKB */
++ if (unlikely(cqe_bcnt > rq->hw_mtu)) {
++ rq->stats->oversize_pkts_sw_drop++;
++ return NULL;
++ }
++
+ va = page_address(di->page) + head_offset;
+ data = va + rx_headroom;
+ frag_size = MLX5_SKB_FRAG_SZ(rx_headroom + cqe_bcnt32);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+index 35ded91203f5..4382ef85488c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+@@ -98,18 +98,17 @@ static int mlx5e_test_link_speed(struct mlx5e_priv *priv)
+ return 1;
+ }
+
+-#ifdef CONFIG_INET
+-/* loopback test */
+-#define MLX5E_TEST_PKT_SIZE (MLX5E_RX_MAX_HEAD - NET_IP_ALIGN)
+-static const char mlx5e_test_text[ETH_GSTRING_LEN] = "MLX5E SELF TEST";
+-#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL
+-
+ struct mlx5ehdr {
+ __be32 version;
+ __be64 magic;
+- char text[ETH_GSTRING_LEN];
+ };
+
++#ifdef CONFIG_INET
++/* loopback test */
++#define MLX5E_TEST_PKT_SIZE (sizeof(struct ethhdr) + sizeof(struct iphdr) +\
++ sizeof(struct udphdr) + sizeof(struct mlx5ehdr))
++#define MLX5E_TEST_MAGIC 0x5AEED15C001ULL
++
+ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
+ {
+ struct sk_buff *skb = NULL;
+@@ -117,10 +116,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
+ struct ethhdr *ethh;
+ struct udphdr *udph;
+ struct iphdr *iph;
+- int datalen, iplen;
+-
+- datalen = MLX5E_TEST_PKT_SIZE -
+- (sizeof(*ethh) + sizeof(*iph) + sizeof(*udph));
++ int iplen;
+
+ skb = netdev_alloc_skb(priv->netdev, MLX5E_TEST_PKT_SIZE);
+ if (!skb) {
+@@ -149,7 +145,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
+ /* Fill UDP header */
+ udph->source = htons(9);
+ udph->dest = htons(9); /* Discard Protocol */
+- udph->len = htons(datalen + sizeof(struct udphdr));
++ udph->len = htons(sizeof(struct mlx5ehdr) + sizeof(struct udphdr));
+ udph->check = 0;
+
+ /* Fill IP header */
+@@ -157,7 +153,8 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
+ iph->ttl = 32;
+ iph->version = 4;
+ iph->protocol = IPPROTO_UDP;
+- iplen = sizeof(struct iphdr) + sizeof(struct udphdr) + datalen;
++ iplen = sizeof(struct iphdr) + sizeof(struct udphdr) +
++ sizeof(struct mlx5ehdr);
+ iph->tot_len = htons(iplen);
+ iph->frag_off = 0;
+ iph->saddr = 0;
+@@ -170,9 +167,6 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
+ mlxh = skb_put(skb, sizeof(*mlxh));
+ mlxh->version = 0;
+ mlxh->magic = cpu_to_be64(MLX5E_TEST_MAGIC);
+- strlcpy(mlxh->text, mlx5e_test_text, sizeof(mlxh->text));
+- datalen -= sizeof(*mlxh);
+- skb_put_zero(skb, datalen);
+
+ skb->csum = 0;
+ skb->ip_summed = CHECKSUM_PARTIAL;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index 6839481f7697..d57d51c4e658 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -82,6 +82,7 @@ static const struct counter_desc sw_stats_desc[] = {
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_wqe_err) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_cqes) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler_strides) },
++ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_oversize_pkts_sw_drop) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_buff_alloc_err) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_blks) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_pkts) },
+@@ -158,6 +159,7 @@ void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
+ s->rx_wqe_err += rq_stats->wqe_err;
+ s->rx_mpwqe_filler_cqes += rq_stats->mpwqe_filler_cqes;
+ s->rx_mpwqe_filler_strides += rq_stats->mpwqe_filler_strides;
++ s->rx_oversize_pkts_sw_drop += rq_stats->oversize_pkts_sw_drop;
+ s->rx_buff_alloc_err += rq_stats->buff_alloc_err;
+ s->rx_cqe_compress_blks += rq_stats->cqe_compress_blks;
+ s->rx_cqe_compress_pkts += rq_stats->cqe_compress_pkts;
+@@ -1148,6 +1150,7 @@ static const struct counter_desc rq_stats_desc[] = {
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, wqe_err) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_cqes) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_strides) },
++ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, oversize_pkts_sw_drop) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, buff_alloc_err) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_blks) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_pkts) },
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+index a4c035aedd46..c1064af9d54c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+@@ -95,6 +95,7 @@ struct mlx5e_sw_stats {
+ u64 rx_wqe_err;
+ u64 rx_mpwqe_filler_cqes;
+ u64 rx_mpwqe_filler_strides;
++ u64 rx_oversize_pkts_sw_drop;
+ u64 rx_buff_alloc_err;
+ u64 rx_cqe_compress_blks;
+ u64 rx_cqe_compress_pkts;
+@@ -190,6 +191,7 @@ struct mlx5e_rq_stats {
+ u64 wqe_err;
+ u64 mpwqe_filler_cqes;
+ u64 mpwqe_filler_strides;
++ u64 oversize_pkts_sw_drop;
+ u64 buff_alloc_err;
+ u64 cqe_compress_blks;
+ u64 cqe_compress_pkts;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index 85796727093e..3092c59c0dc7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -1310,31 +1310,21 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
+ inner_headers);
+ }
+
+- if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+- struct flow_dissector_key_eth_addrs *key =
++ if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
++ struct flow_dissector_key_basic *key =
+ skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_ETH_ADDRS,
++ FLOW_DISSECTOR_KEY_BASIC,
+ f->key);
+- struct flow_dissector_key_eth_addrs *mask =
++ struct flow_dissector_key_basic *mask =
+ skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_ETH_ADDRS,
++ FLOW_DISSECTOR_KEY_BASIC,
+ f->mask);
++ MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype,
++ ntohs(mask->n_proto));
++ MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype,
++ ntohs(key->n_proto));
+
+- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
+- dmac_47_16),
+- mask->dst);
+- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
+- dmac_47_16),
+- key->dst);
+-
+- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
+- smac_47_16),
+- mask->src);
+- ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
+- smac_47_16),
+- key->src);
+-
+- if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst))
++ if (mask->n_proto)
+ *match_level = MLX5_MATCH_L2;
+ }
+
+@@ -1368,9 +1358,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
+
+ *match_level = MLX5_MATCH_L2;
+ }
+- } else {
++ } else if (*match_level != MLX5_MATCH_NONE) {
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, svlan_tag, 1);
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, cvlan_tag, 1);
++ *match_level = MLX5_MATCH_L2;
+ }
+
+ if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CVLAN)) {
+@@ -1408,21 +1399,31 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
+ }
+ }
+
+- if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
+- struct flow_dissector_key_basic *key =
++ if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
++ struct flow_dissector_key_eth_addrs *key =
+ skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_BASIC,
++ FLOW_DISSECTOR_KEY_ETH_ADDRS,
+ f->key);
+- struct flow_dissector_key_basic *mask =
++ struct flow_dissector_key_eth_addrs *mask =
+ skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_BASIC,
++ FLOW_DISSECTOR_KEY_ETH_ADDRS,
+ f->mask);
+- MLX5_SET(fte_match_set_lyr_2_4, headers_c, ethertype,
+- ntohs(mask->n_proto));
+- MLX5_SET(fte_match_set_lyr_2_4, headers_v, ethertype,
+- ntohs(key->n_proto));
+
+- if (mask->n_proto)
++ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
++ dmac_47_16),
++ mask->dst);
++ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
++ dmac_47_16),
++ key->dst);
++
++ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
++ smac_47_16),
++ mask->src);
++ ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
++ smac_47_16),
++ key->src);
++
++ if (!is_zero_ether_addr(mask->src) || !is_zero_ether_addr(mask->dst))
+ *match_level = MLX5_MATCH_L2;
+ }
+
+@@ -1449,10 +1450,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
+
+ /* the HW doesn't need L3 inline to match on frag=no */
+ if (!(key->flags & FLOW_DIS_IS_FRAGMENT))
+- *match_level = MLX5_INLINE_MODE_L2;
++ *match_level = MLX5_MATCH_L2;
+ /* *** L2 attributes parsing up to here *** */
+ else
+- *match_level = MLX5_INLINE_MODE_IP;
++ *match_level = MLX5_MATCH_L3;
+ }
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+index b8ee9101c506..b5a8769a5bfd 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+@@ -83,8 +83,14 @@ struct mlx5_fpga_ipsec_rule {
+ };
+
+ static const struct rhashtable_params rhash_sa = {
+- .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa),
+- .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa),
++ /* Keep out "cmd" field from the key as it's
++ * value is not constant during the lifetime
++ * of the key object.
++ */
++ .key_len = FIELD_SIZEOF(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) -
++ FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd),
++ .key_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hw_sa) +
++ FIELD_SIZEOF(struct mlx5_ifc_fpga_ipsec_sa_v1, cmd),
+ .head_offset = offsetof(struct mlx5_fpga_ipsec_sa_ctx, hash),
+ .automatic_shrinking = true,
+ .min_size = 1,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+index e3797a44e074..5b7fe8264144 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+@@ -502,9 +502,9 @@ static int mlx5i_close(struct net_device *netdev)
+
+ netif_carrier_off(epriv->netdev);
+ mlx5_fs_remove_rx_underlay_qpn(mdev, ipriv->qp.qpn);
+- mlx5i_uninit_underlay_qp(epriv);
+ mlx5e_deactivate_priv_channels(epriv);
+ mlx5e_close_channels(&epriv->channels);
++ mlx5i_uninit_underlay_qp(epriv);
+ unlock:
+ mutex_unlock(&epriv->state_lock);
+ return 0;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index 30bb2c533cec..ada644d90029 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -3519,7 +3519,6 @@ static int mlxsw_sp_cpu_policers_set(struct mlxsw_core *mlxsw_core)
+ burst_size = 7;
+ break;
+ case MLXSW_REG_HTGT_TRAP_GROUP_SP_IP2ME:
+- is_bytes = true;
+ rate = 4 * 1024;
+ burst_size = 4;
+ break;
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+index 0afc3d335d56..d11c16aeb19a 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+@@ -234,7 +234,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
+ struct net_device *real_dev,
+ struct rmnet_endpoint *ep)
+ {
+- struct rmnet_priv *priv;
++ struct rmnet_priv *priv = netdev_priv(rmnet_dev);
+ int rc;
+
+ if (ep->egress_dev)
+@@ -247,6 +247,8 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
+ rmnet_dev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+ rmnet_dev->hw_features |= NETIF_F_SG;
+
++ priv->real_dev = real_dev;
++
+ rc = register_netdevice(rmnet_dev);
+ if (!rc) {
+ ep->egress_dev = rmnet_dev;
+@@ -255,9 +257,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
+
+ rmnet_dev->rtnl_link_ops = &rmnet_link_ops;
+
+- priv = netdev_priv(rmnet_dev);
+ priv->mux_id = id;
+- priv->real_dev = real_dev;
+
+ netdev_dbg(rmnet_dev, "rmnet dev created\n");
+ }
+diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
+index 33265747bf39..0fbcedcdf6e2 100644
+--- a/drivers/net/phy/mdio-gpio.c
++++ b/drivers/net/phy/mdio-gpio.c
+@@ -63,7 +63,7 @@ static void mdio_dir(struct mdiobb_ctrl *ctrl, int dir)
+ * assume the pin serves as pull-up. If direction is
+ * output, the default value is high.
+ */
+- gpiod_set_value(bitbang->mdo, 1);
++ gpiod_set_value_cansleep(bitbang->mdo, 1);
+ return;
+ }
+
+@@ -78,7 +78,7 @@ static int mdio_get(struct mdiobb_ctrl *ctrl)
+ struct mdio_gpio_info *bitbang =
+ container_of(ctrl, struct mdio_gpio_info, ctrl);
+
+- return gpiod_get_value(bitbang->mdio);
++ return gpiod_get_value_cansleep(bitbang->mdio);
+ }
+
+ static void mdio_set(struct mdiobb_ctrl *ctrl, int what)
+@@ -87,9 +87,9 @@ static void mdio_set(struct mdiobb_ctrl *ctrl, int what)
+ container_of(ctrl, struct mdio_gpio_info, ctrl);
+
+ if (bitbang->mdo)
+- gpiod_set_value(bitbang->mdo, what);
++ gpiod_set_value_cansleep(bitbang->mdo, what);
+ else
+- gpiod_set_value(bitbang->mdio, what);
++ gpiod_set_value_cansleep(bitbang->mdio, what);
+ }
+
+ static void mdc_set(struct mdiobb_ctrl *ctrl, int what)
+@@ -97,7 +97,7 @@ static void mdc_set(struct mdiobb_ctrl *ctrl, int what)
+ struct mdio_gpio_info *bitbang =
+ container_of(ctrl, struct mdio_gpio_info, ctrl);
+
+- gpiod_set_value(bitbang->mdc, what);
++ gpiod_set_value_cansleep(bitbang->mdc, what);
+ }
+
+ static const struct mdiobb_ops mdio_gpio_ops = {
+diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
+index 7fc8508b5231..271e8adc39f1 100644
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -220,7 +220,7 @@ static struct phy_driver realtek_drvs[] = {
+ .flags = PHY_HAS_INTERRUPT,
+ }, {
+ .phy_id = 0x001cc816,
+- .name = "RTL8201F 10/100Mbps Ethernet",
++ .name = "RTL8201F Fast Ethernet",
+ .phy_id_mask = 0x001fffff,
+ .features = PHY_BASIC_FEATURES,
+ .flags = PHY_HAS_INTERRUPT,
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index c52207beef88..573620771154 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1527,6 +1527,7 @@ static void tun_rx_batched(struct tun_struct *tun, struct tun_file *tfile,
+
+ if (!rx_batched || (!more && skb_queue_empty(queue))) {
+ local_bh_disable();
++ skb_record_rx_queue(skb, tfile->queue_index);
+ netif_receive_skb(skb);
+ local_bh_enable();
+ return;
+@@ -1546,8 +1547,11 @@ static void tun_rx_batched(struct tun_struct *tun, struct tun_file *tfile,
+ struct sk_buff *nskb;
+
+ local_bh_disable();
+- while ((nskb = __skb_dequeue(&process_queue)))
++ while ((nskb = __skb_dequeue(&process_queue))) {
++ skb_record_rx_queue(nskb, tfile->queue_index);
+ netif_receive_skb(nskb);
++ }
++ skb_record_rx_queue(skb, tfile->queue_index);
+ netif_receive_skb(skb);
+ local_bh_enable();
+ }
+diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
+index 262e7a3c23cb..f2d01cb6f958 100644
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -1321,6 +1321,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ dev->net->ethtool_ops = &smsc95xx_ethtool_ops;
+ dev->net->flags |= IFF_MULTICAST;
+ dev->net->hard_header_len += SMSC95XX_TX_OVERHEAD_CSUM;
++ dev->net->min_mtu = ETH_MIN_MTU;
++ dev->net->max_mtu = ETH_DATA_LEN;
+ dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+
+ pdata->dev = dev;
+@@ -1598,6 +1600,8 @@ static int smsc95xx_suspend(struct usb_interface *intf, pm_message_t message)
+ return ret;
+ }
+
++ cancel_delayed_work_sync(&pdata->carrier_check);
++
+ if (pdata->suspend_flags) {
+ netdev_warn(dev->net, "error during last resume\n");
+ pdata->suspend_flags = 0;
+@@ -1840,6 +1844,11 @@ done:
+ */
+ if (ret && PMSG_IS_AUTO(message))
+ usbnet_resume(intf);
++
++ if (ret)
++ schedule_delayed_work(&pdata->carrier_check,
++ CARRIER_CHECK_DELAY);
++
+ return ret;
+ }
+
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 8c2caa370e0f..ab9242e51d9e 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -608,4 +608,16 @@ static inline __u32 sctp_dst_mtu(const struct dst_entry *dst)
+ SCTP_DEFAULT_MINSEGMENT));
+ }
+
++static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
++{
++ __u32 pmtu = sctp_dst_mtu(t->dst);
++
++ if (t->pathmtu == pmtu)
++ return true;
++
++ t->pathmtu = pmtu;
++
++ return false;
++}
++
+ #endif /* __net_sctp_h__ */
+diff --git a/include/uapi/linux/sctp.h b/include/uapi/linux/sctp.h
+index 34dd3d497f2c..c81feb373d3e 100644
+--- a/include/uapi/linux/sctp.h
++++ b/include/uapi/linux/sctp.h
+@@ -568,6 +568,8 @@ struct sctp_assoc_reset_event {
+
+ #define SCTP_ASSOC_CHANGE_DENIED 0x0004
+ #define SCTP_ASSOC_CHANGE_FAILED 0x0008
++#define SCTP_STREAM_CHANGE_DENIED SCTP_ASSOC_CHANGE_DENIED
++#define SCTP_STREAM_CHANGE_FAILED SCTP_ASSOC_CHANGE_FAILED
+ struct sctp_stream_change_event {
+ __u16 strchange_type;
+ __u16 strchange_flags;
+@@ -1151,6 +1153,7 @@ struct sctp_add_streams {
+ /* SCTP Stream schedulers */
+ enum sctp_sched_type {
+ SCTP_SS_FCFS,
++ SCTP_SS_DEFAULT = SCTP_SS_FCFS,
+ SCTP_SS_PRIO,
+ SCTP_SS_RR,
+ SCTP_SS_MAX = SCTP_SS_RR
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 3adecda21444..0097acec1c71 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2026,12 +2026,6 @@ static void cpuhp_online_cpu_device(unsigned int cpu)
+ kobject_uevent(&dev->kobj, KOBJ_ONLINE);
+ }
+
+-/*
+- * Architectures that need SMT-specific errata handling during SMT hotplug
+- * should override this.
+- */
+-void __weak arch_smt_update(void) { };
+-
+ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ {
+ int cpu, ret = 0;
+@@ -2058,10 +2052,8 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ */
+ cpuhp_offline_cpu_device(cpu);
+ }
+- if (!ret) {
++ if (!ret)
+ cpu_smt_control = ctrlval;
+- arch_smt_update();
+- }
+ cpu_maps_update_done();
+ return ret;
+ }
+@@ -2072,7 +2064,6 @@ static int cpuhp_smt_enable(void)
+
+ cpu_maps_update_begin();
+ cpu_smt_control = CPU_SMT_ENABLED;
+- arch_smt_update();
+ for_each_present_cpu(cpu) {
+ /* Skip online CPUs and CPUs on offline nodes */
+ if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
+diff --git a/net/core/dev.c b/net/core/dev.c
+index e16ba3625400..097c02101450 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5630,6 +5630,10 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
+ skb->vlan_tci = 0;
+ skb->dev = napi->dev;
+ skb->skb_iif = 0;
++
++ /* eth_type_trans() assumes pkt_type is PACKET_HOST */
++ skb->pkt_type = PACKET_HOST;
++
+ skb->encapsulation = 0;
+ skb_shinfo(skb)->gso_type = 0;
+ skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index ce9eeeb7c024..415b95f76b66 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -1026,8 +1026,8 @@ ip_proto_again:
+ break;
+ }
+
+- if (dissector_uses_key(flow_dissector,
+- FLOW_DISSECTOR_KEY_PORTS)) {
++ if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS) &&
++ !(key_control->flags & FLOW_DIS_IS_FRAGMENT)) {
+ key_ports = skb_flow_dissector_target(flow_dissector,
+ FLOW_DISSECTOR_KEY_PORTS,
+ target_container);
+diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
+index bcb11f3a27c0..760a9e52e02b 100644
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -178,21 +178,22 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
+ }
+
+ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
+- void *arg)
++ void *arg,
++ struct inet_frag_queue **prev)
+ {
+ struct inet_frags *f = nf->f;
+ struct inet_frag_queue *q;
+- int err;
+
+ q = inet_frag_alloc(nf, f, arg);
+- if (!q)
++ if (!q) {
++ *prev = ERR_PTR(-ENOMEM);
+ return NULL;
+-
++ }
+ mod_timer(&q->timer, jiffies + nf->timeout);
+
+- err = rhashtable_insert_fast(&nf->rhashtable, &q->node,
+- f->rhash_params);
+- if (err < 0) {
++ *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key,
++ &q->node, f->rhash_params);
++ if (*prev) {
+ q->flags |= INET_FRAG_COMPLETE;
+ inet_frag_kill(q);
+ inet_frag_destroy(q);
+@@ -204,22 +205,22 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
+ /* TODO : call from rcu_read_lock() and no longer use refcount_inc_not_zero() */
+ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key)
+ {
+- struct inet_frag_queue *fq;
++ struct inet_frag_queue *fq = NULL, *prev;
+
+ if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
+ return NULL;
+
+ rcu_read_lock();
+
+- fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
+- if (fq) {
++ prev = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
++ if (!prev)
++ fq = inet_frag_create(nf, key, &prev);
++ if (prev && !IS_ERR(prev)) {
++ fq = prev;
+ if (!refcount_inc_not_zero(&fq->refcnt))
+ fq = NULL;
+- rcu_read_unlock();
+- return fq;
+ }
+ rcu_read_unlock();
+-
+- return inet_frag_create(nf, key);
++ return fq;
+ }
+ EXPORT_SYMBOL(inet_frag_find);
+diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
+index dde671e97829..c248e0dccbe1 100644
+--- a/net/ipv4/ip_tunnel_core.c
++++ b/net/ipv4/ip_tunnel_core.c
+@@ -80,7 +80,7 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
+
+ iph->version = 4;
+ iph->ihl = sizeof(struct iphdr) >> 2;
+- iph->frag_off = df;
++ iph->frag_off = ip_mtu_locked(&rt->dst) ? 0 : df;
+ iph->protocol = proto;
+ iph->tos = tos;
+ iph->daddr = dst;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 47e08c1b5bc3..72898cbef43d 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4371,6 +4371,7 @@ static bool tcp_try_coalesce(struct sock *sk,
+ if (TCP_SKB_CB(from)->has_rxtstamp) {
+ TCP_SKB_CB(to)->has_rxtstamp = true;
+ to->tstamp = from->tstamp;
++ skb_hwtstamps(to)->hwtstamp = skb_hwtstamps(from)->hwtstamp;
+ }
+
+ return true;
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 1cf00d857fc1..a33681dc4796 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2263,8 +2263,7 @@ static void ip6_link_failure(struct sk_buff *skb)
+ if (rt) {
+ rcu_read_lock();
+ if (rt->rt6i_flags & RTF_CACHE) {
+- if (dst_hold_safe(&rt->dst))
+- rt6_remove_exception_rt(rt);
++ rt6_remove_exception_rt(rt);
+ } else {
+ struct fib6_info *from;
+ struct fib6_node *fn;
+@@ -2392,10 +2391,13 @@ EXPORT_SYMBOL_GPL(ip6_update_pmtu);
+
+ void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
+ {
++ int oif = sk->sk_bound_dev_if;
+ struct dst_entry *dst;
+
+- ip6_update_pmtu(skb, sock_net(sk), mtu,
+- sk->sk_bound_dev_if, sk->sk_mark, sk->sk_uid);
++ if (!oif && skb->dev)
++ oif = l3mdev_master_ifindex(skb->dev);
++
++ ip6_update_pmtu(skb, sock_net(sk), mtu, oif, sk->sk_mark, sk->sk_uid);
+
+ dst = __sk_dst_get(sk);
+ if (!dst || !dst->obsolete ||
+@@ -3266,8 +3268,8 @@ static int ip6_del_cached_rt(struct rt6_info *rt, struct fib6_config *cfg)
+ if (cfg->fc_flags & RTF_GATEWAY &&
+ !ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
+ goto out;
+- if (dst_hold_safe(&rt->dst))
+- rc = rt6_remove_exception_rt(rt);
++
++ rc = rt6_remove_exception_rt(rt);
+ out:
+ return rc;
+ }
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 82cdf9020b53..26f1d435696a 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1490,12 +1490,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
+ goto err_sock;
+ }
+
+- sk = sock->sk;
+-
+- sock_hold(sk);
+- tunnel->sock = sk;
+ tunnel->l2tp_net = net;
+-
+ pn = l2tp_pernet(net);
+
+ spin_lock_bh(&pn->l2tp_tunnel_list_lock);
+@@ -1510,6 +1505,10 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
+ list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
+ spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+
++ sk = sock->sk;
++ sock_hold(sk);
++ tunnel->sock = sk;
++
+ if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
+ struct udp_tunnel_sock_cfg udp_cfg = {
+ .sk_user_data = tunnel,
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index a6e6cae82c30..03e0fc8c183f 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -611,6 +611,7 @@ struct rxrpc_call {
+ * not hard-ACK'd packet follows this.
+ */
+ rxrpc_seq_t tx_top; /* Highest Tx slot allocated. */
++ u16 tx_backoff; /* Delay to insert due to Tx failure */
+
+ /* TCP-style slow-start congestion control [RFC5681]. Since the SMSS
+ * is fixed, we keep these numbers in terms of segments (ie. DATA
+diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
+index 8e7434e92097..468efc3660c0 100644
+--- a/net/rxrpc/call_event.c
++++ b/net/rxrpc/call_event.c
+@@ -123,6 +123,7 @@ static void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
+ else
+ ack_at = expiry;
+
++ ack_at += READ_ONCE(call->tx_backoff);
+ ack_at += now;
+ if (time_before(ack_at, call->ack_at)) {
+ WRITE_ONCE(call->ack_at, ack_at);
+@@ -311,6 +312,7 @@ void rxrpc_process_call(struct work_struct *work)
+ container_of(work, struct rxrpc_call, processor);
+ rxrpc_serial_t *send_ack;
+ unsigned long now, next, t;
++ unsigned int iterations = 0;
+
+ rxrpc_see_call(call);
+
+@@ -319,6 +321,11 @@ void rxrpc_process_call(struct work_struct *work)
+ call->debug_id, rxrpc_call_states[call->state], call->events);
+
+ recheck_state:
++ /* Limit the number of times we do this before returning to the manager */
++ iterations++;
++ if (iterations > 5)
++ goto requeue;
++
+ if (test_and_clear_bit(RXRPC_CALL_EV_ABORT, &call->events)) {
+ rxrpc_send_abort_packet(call);
+ goto recheck_state;
+@@ -447,13 +454,16 @@ recheck_state:
+ rxrpc_reduce_call_timer(call, next, now, rxrpc_timer_restart);
+
+ /* other events may have been raised since we started checking */
+- if (call->events && call->state < RXRPC_CALL_COMPLETE) {
+- __rxrpc_queue_call(call);
+- goto out;
+- }
++ if (call->events && call->state < RXRPC_CALL_COMPLETE)
++ goto requeue;
+
+ out_put:
+ rxrpc_put_call(call, rxrpc_call_put);
+ out:
+ _leave("");
++ return;
++
++requeue:
++ __rxrpc_queue_call(call);
++ goto out;
+ }
+diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
+index a141ee3ab812..345dc1c5fe72 100644
+--- a/net/rxrpc/output.c
++++ b/net/rxrpc/output.c
+@@ -34,6 +34,21 @@ struct rxrpc_abort_buffer {
+
+ static const char rxrpc_keepalive_string[] = "";
+
++/*
++ * Increase Tx backoff on transmission failure and clear it on success.
++ */
++static void rxrpc_tx_backoff(struct rxrpc_call *call, int ret)
++{
++ if (ret < 0) {
++ u16 tx_backoff = READ_ONCE(call->tx_backoff);
++
++ if (tx_backoff < HZ)
++ WRITE_ONCE(call->tx_backoff, tx_backoff + 1);
++ } else {
++ WRITE_ONCE(call->tx_backoff, 0);
++ }
++}
++
+ /*
+ * Arrange for a keepalive ping a certain time after we last transmitted. This
+ * lets the far side know we're still interested in this call and helps keep
+@@ -210,6 +225,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
+ else
+ trace_rxrpc_tx_packet(call->debug_id, &pkt->whdr,
+ rxrpc_tx_point_call_ack);
++ rxrpc_tx_backoff(call, ret);
+
+ if (call->state < RXRPC_CALL_COMPLETE) {
+ if (ret < 0) {
+@@ -218,7 +234,7 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
+ rxrpc_propose_ACK(call, pkt->ack.reason,
+ ntohs(pkt->ack.maxSkew),
+ ntohl(pkt->ack.serial),
+- true, true,
++ false, true,
+ rxrpc_propose_ack_retry_tx);
+ } else {
+ spin_lock_bh(&call->lock);
+@@ -300,7 +316,7 @@ int rxrpc_send_abort_packet(struct rxrpc_call *call)
+ else
+ trace_rxrpc_tx_packet(call->debug_id, &pkt.whdr,
+ rxrpc_tx_point_call_abort);
+-
++ rxrpc_tx_backoff(call, ret);
+
+ rxrpc_put_connection(conn);
+ return ret;
+@@ -411,6 +427,7 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb,
+ else
+ trace_rxrpc_tx_packet(call->debug_id, &whdr,
+ rxrpc_tx_point_call_data_nofrag);
++ rxrpc_tx_backoff(call, ret);
+ if (ret == -EMSGSIZE)
+ goto send_fragmentable;
+
+@@ -445,9 +462,18 @@ done:
+ rxrpc_reduce_call_timer(call, expect_rx_by, nowj,
+ rxrpc_timer_set_for_normal);
+ }
+- }
+
+- rxrpc_set_keepalive(call);
++ rxrpc_set_keepalive(call);
++ } else {
++ /* Cancel the call if the initial transmission fails,
++ * particularly if that's due to network routing issues that
++ * aren't going away anytime soon. The layer above can arrange
++ * the retransmission.
++ */
++ if (!test_and_set_bit(RXRPC_CALL_BEGAN_RX_TIMER, &call->flags))
++ rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR,
++ RX_USER_ABORT, ret);
++ }
+
+ _leave(" = %d [%u]", ret, call->peer->maxdata);
+ return ret;
+@@ -506,6 +532,7 @@ send_fragmentable:
+ else
+ trace_rxrpc_tx_packet(call->debug_id, &whdr,
+ rxrpc_tx_point_call_data_frag);
++ rxrpc_tx_backoff(call, ret);
+
+ up_write(&conn->params.local->defrag_sem);
+ goto done;
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index ad99a99f11f6..ca535a8585bc 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -201,7 +201,8 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
+ goto out_release;
+ }
+ } else {
+- return err;
++ ret = err;
++ goto out_free;
+ }
+
+ p = to_pedit(*a);
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index 6fd9bdd93796..7fade7107f95 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -709,11 +709,23 @@ static int fl_set_enc_opt(struct nlattr **tb, struct fl_flow_key *key,
+ struct netlink_ext_ack *extack)
+ {
+ const struct nlattr *nla_enc_key, *nla_opt_key, *nla_opt_msk = NULL;
+- int option_len, key_depth, msk_depth = 0;
++ int err, option_len, key_depth, msk_depth = 0;
++
++ err = nla_validate_nested(tb[TCA_FLOWER_KEY_ENC_OPTS],
++ TCA_FLOWER_KEY_ENC_OPTS_MAX,
++ enc_opts_policy, extack);
++ if (err)
++ return err;
+
+ nla_enc_key = nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS]);
+
+ if (tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]) {
++ err = nla_validate_nested(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK],
++ TCA_FLOWER_KEY_ENC_OPTS_MAX,
++ enc_opts_policy, extack);
++ if (err)
++ return err;
++
+ nla_opt_msk = nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]);
+ msk_depth = nla_len(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]);
+ }
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index 67939ad99c01..08601223b0bf 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -118,6 +118,9 @@ void sctp_packet_config(struct sctp_packet *packet, __u32 vtag,
+ sctp_transport_route(tp, NULL, sp);
+ if (asoc->param_flags & SPP_PMTUD_ENABLE)
+ sctp_assoc_sync_pmtu(asoc);
++ } else if (!sctp_transport_pmtu_check(tp)) {
++ if (asoc->param_flags & SPP_PMTUD_ENABLE)
++ sctp_assoc_sync_pmtu(asoc);
+ }
+
+ if (asoc->pmtu_pending) {
+diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
+index 42191ed9902b..7bb8e5603298 100644
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -212,7 +212,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
+ INIT_LIST_HEAD(&q->retransmit);
+ INIT_LIST_HEAD(&q->sacked);
+ INIT_LIST_HEAD(&q->abandoned);
+- sctp_sched_set_sched(asoc, SCTP_SS_FCFS);
++ sctp_sched_set_sched(asoc, SCTP_SS_DEFAULT);
+ }
+
+ /* Free the outqueue structure and any related pending chunks.
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index c1693e28aed4..876393cf5ed6 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -3958,32 +3958,16 @@ static int sctp_setsockopt_pr_supported(struct sock *sk,
+ unsigned int optlen)
+ {
+ struct sctp_assoc_value params;
+- struct sctp_association *asoc;
+- int retval = -EINVAL;
+
+ if (optlen != sizeof(params))
+- goto out;
+-
+- if (copy_from_user(¶ms, optval, optlen)) {
+- retval = -EFAULT;
+- goto out;
+- }
+-
+- asoc = sctp_id2assoc(sk, params.assoc_id);
+- if (asoc) {
+- asoc->prsctp_enable = !!params.assoc_value;
+- } else if (!params.assoc_id) {
+- struct sctp_sock *sp = sctp_sk(sk);
++ return -EINVAL;
+
+- sp->ep->prsctp_enable = !!params.assoc_value;
+- } else {
+- goto out;
+- }
++ if (copy_from_user(¶ms, optval, optlen))
++ return -EFAULT;
+
+- retval = 0;
++ sctp_sk(sk)->ep->prsctp_enable = !!params.assoc_value;
+
+-out:
+- return retval;
++ return 0;
+ }
+
+ static int sctp_setsockopt_default_prinfo(struct sock *sk,
+diff --git a/net/sctp/stream.c b/net/sctp/stream.c
+index ffb940d3b57c..3892e7630f3a 100644
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -535,7 +535,6 @@ int sctp_send_add_streams(struct sctp_association *asoc,
+ goto out;
+ }
+
+- stream->incnt = incnt;
+ stream->outcnt = outcnt;
+
+ asoc->strreset_outstanding = !!out + !!in;
+diff --git a/net/tipc/discover.c b/net/tipc/discover.c
+index 2830709957bd..c138d68e8a69 100644
+--- a/net/tipc/discover.c
++++ b/net/tipc/discover.c
+@@ -166,7 +166,8 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
+
+ /* Apply trial address if we just left trial period */
+ if (!trial && !self) {
+- tipc_net_finalize(net, tn->trial_addr);
++ tipc_sched_net_finalize(net, tn->trial_addr);
++ msg_set_prevnode(buf_msg(d->skb), tn->trial_addr);
+ msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
+ }
+
+@@ -300,14 +301,12 @@ static void tipc_disc_timeout(struct timer_list *t)
+ goto exit;
+ }
+
+- /* Trial period over ? */
+- if (!time_before(jiffies, tn->addr_trial_end)) {
+- /* Did we just leave it ? */
+- if (!tipc_own_addr(net))
+- tipc_net_finalize(net, tn->trial_addr);
+-
+- msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
+- msg_set_prevnode(buf_msg(d->skb), tipc_own_addr(net));
++ /* Did we just leave trial period ? */
++ if (!time_before(jiffies, tn->addr_trial_end) && !tipc_own_addr(net)) {
++ mod_timer(&d->timer, jiffies + TIPC_DISC_INIT);
++ spin_unlock_bh(&d->lock);
++ tipc_sched_net_finalize(net, tn->trial_addr);
++ return;
+ }
+
+ /* Adjust timeout interval according to discovery phase */
+@@ -319,6 +318,8 @@ static void tipc_disc_timeout(struct timer_list *t)
+ d->timer_intv = TIPC_DISC_SLOW;
+ else if (!d->num_nodes && d->timer_intv > TIPC_DISC_FAST)
+ d->timer_intv = TIPC_DISC_FAST;
++ msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
++ msg_set_prevnode(buf_msg(d->skb), tn->trial_addr);
+ }
+
+ mod_timer(&d->timer, jiffies + d->timer_intv);
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 201c3b5bc96b..836727e363c4 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1594,14 +1594,17 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
+ if (in_range(peers_prio, l->priority + 1, TIPC_MAX_LINK_PRI))
+ l->priority = peers_prio;
+
+- /* ACTIVATE_MSG serves as PEER_RESET if link is already down */
+- if (msg_peer_stopping(hdr))
++ /* If peer is going down we want full re-establish cycle */
++ if (msg_peer_stopping(hdr)) {
+ rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
+- else if ((mtyp == RESET_MSG) || !link_is_up(l))
++ break;
++ }
++ /* ACTIVATE_MSG serves as PEER_RESET if link is already down */
++ if (mtyp == RESET_MSG || !link_is_up(l))
+ rc = tipc_link_fsm_evt(l, LINK_PEER_RESET_EVT);
+
+ /* ACTIVATE_MSG takes up link if it was already locally reset */
+- if ((mtyp == ACTIVATE_MSG) && (l->state == LINK_ESTABLISHING))
++ if (mtyp == ACTIVATE_MSG && l->state == LINK_ESTABLISHING)
+ rc = TIPC_LINK_UP_EVT;
+
+ l->peer_session = msg_session(hdr);
+diff --git a/net/tipc/net.c b/net/tipc/net.c
+index 62199cf5a56c..f076edb74338 100644
+--- a/net/tipc/net.c
++++ b/net/tipc/net.c
+@@ -104,6 +104,14 @@
+ * - A local spin_lock protecting the queue of subscriber events.
+ */
+
++struct tipc_net_work {
++ struct work_struct work;
++ struct net *net;
++ u32 addr;
++};
++
++static void tipc_net_finalize(struct net *net, u32 addr);
++
+ int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
+ {
+ if (tipc_own_id(net)) {
+@@ -119,17 +127,38 @@ int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
+ return 0;
+ }
+
+-void tipc_net_finalize(struct net *net, u32 addr)
++static void tipc_net_finalize(struct net *net, u32 addr)
+ {
+ struct tipc_net *tn = tipc_net(net);
+
+- if (!cmpxchg(&tn->node_addr, 0, addr)) {
+- tipc_set_node_addr(net, addr);
+- tipc_named_reinit(net);
+- tipc_sk_reinit(net);
+- tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
+- TIPC_CLUSTER_SCOPE, 0, addr);
+- }
++ if (cmpxchg(&tn->node_addr, 0, addr))
++ return;
++ tipc_set_node_addr(net, addr);
++ tipc_named_reinit(net);
++ tipc_sk_reinit(net);
++ tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
++ TIPC_CLUSTER_SCOPE, 0, addr);
++}
++
++static void tipc_net_finalize_work(struct work_struct *work)
++{
++ struct tipc_net_work *fwork;
++
++ fwork = container_of(work, struct tipc_net_work, work);
++ tipc_net_finalize(fwork->net, fwork->addr);
++ kfree(fwork);
++}
++
++void tipc_sched_net_finalize(struct net *net, u32 addr)
++{
++ struct tipc_net_work *fwork = kzalloc(sizeof(*fwork), GFP_ATOMIC);
++
++ if (!fwork)
++ return;
++ INIT_WORK(&fwork->work, tipc_net_finalize_work);
++ fwork->net = net;
++ fwork->addr = addr;
++ schedule_work(&fwork->work);
+ }
+
+ void tipc_net_stop(struct net *net)
+diff --git a/net/tipc/net.h b/net/tipc/net.h
+index 09ad02b50bb1..b7f2e364eb99 100644
+--- a/net/tipc/net.h
++++ b/net/tipc/net.h
+@@ -42,7 +42,7 @@
+ extern const struct nla_policy tipc_nl_net_policy[];
+
+ int tipc_net_init(struct net *net, u8 *node_id, u32 addr);
+-void tipc_net_finalize(struct net *net, u32 addr);
++void tipc_sched_net_finalize(struct net *net, u32 addr);
+ void tipc_net_stop(struct net *net);
+ int tipc_nl_net_dump(struct sk_buff *skb, struct netlink_callback *cb);
+ int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 0bf8ad486c5e..366ce0bf2658 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -1548,16 +1548,17 @@ static void tipc_sk_set_orig_addr(struct msghdr *m, struct sk_buff *skb)
+ /**
+ * tipc_sk_anc_data_recv - optionally capture ancillary data for received message
+ * @m: descriptor for message info
+- * @msg: received message header
++ * @skb: received message buffer
+ * @tsk: TIPC port associated with message
+ *
+ * Note: Ancillary data is not captured if not requested by receiver.
+ *
+ * Returns 0 if successful, otherwise errno
+ */
+-static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
++static int tipc_sk_anc_data_recv(struct msghdr *m, struct sk_buff *skb,
+ struct tipc_sock *tsk)
+ {
++ struct tipc_msg *msg;
+ u32 anc_data[3];
+ u32 err;
+ u32 dest_type;
+@@ -1566,6 +1567,7 @@ static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
+
+ if (likely(m->msg_controllen == 0))
+ return 0;
++ msg = buf_msg(skb);
+
+ /* Optionally capture errored message object(s) */
+ err = msg ? msg_errcode(msg) : 0;
+@@ -1576,6 +1578,9 @@ static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg,
+ if (res)
+ return res;
+ if (anc_data[1]) {
++ if (skb_linearize(skb))
++ return -ENOMEM;
++ msg = buf_msg(skb);
+ res = put_cmsg(m, SOL_TIPC, TIPC_RETDATA, anc_data[1],
+ msg_data(msg));
+ if (res)
+@@ -1737,9 +1742,10 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
+
+ /* Collect msg meta data, including error code and rejected data */
+ tipc_sk_set_orig_addr(m, skb);
+- rc = tipc_sk_anc_data_recv(m, hdr, tsk);
++ rc = tipc_sk_anc_data_recv(m, skb, tsk);
+ if (unlikely(rc))
+ goto exit;
++ hdr = buf_msg(skb);
+
+ /* Capture data if non-error msg, otherwise just set return value */
+ if (likely(!err)) {
+@@ -1849,9 +1855,10 @@ static int tipc_recvstream(struct socket *sock, struct msghdr *m,
+ /* Collect msg meta data, incl. error code and rejected data */
+ if (!copied) {
+ tipc_sk_set_orig_addr(m, skb);
+- rc = tipc_sk_anc_data_recv(m, hdr, tsk);
++ rc = tipc_sk_anc_data_recv(m, skb, tsk);
+ if (rc)
+ break;
++ hdr = buf_msg(skb);
+ }
+
+ /* Copy data if msg ok, otherwise return error/partial data */
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-11-27 16:16 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-11-27 16:16 UTC (permalink / raw
To: gentoo-commits
commit: 82476154d4461d52b9ba7f9b16db179d440f4c05
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 27 16:15:57 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 27 16:15:57 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=82476154
proj/linux-patches: Linux patch 4.19.5
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1004_linux-4.19.5.patch | 4298 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4302 insertions(+)
diff --git a/0000_README b/0000_README
index f74e5e3..c0b6ddf 100644
--- a/0000_README
+++ b/0000_README
@@ -59,6 +59,10 @@ Patch: 1003_linux-4.19.4.patch
From: http://www.kernel.org
Desc: Linux 4.19.4
+Patch: 1004_linux-4.19.5.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.5
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1004_linux-4.19.5.patch b/1004_linux-4.19.5.patch
new file mode 100644
index 0000000..008e859
--- /dev/null
+++ b/1004_linux-4.19.5.patch
@@ -0,0 +1,4298 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 92eb1f42240d..fa4eec22816d 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1063,7 +1063,7 @@
+ earlyprintk=serial[,0x...[,baudrate]]
+ earlyprintk=ttySn[,baudrate]
+ earlyprintk=dbgp[debugController#]
+- earlyprintk=pciserial,bus:device.function[,baudrate]
++ earlyprintk=pciserial[,force],bus:device.function[,baudrate]
+ earlyprintk=xdbc[xhciController#]
+
+ earlyprintk is useful when the kernel crashes before
+@@ -1095,6 +1095,10 @@
+
+ The sclp output can only be used on s390.
+
++ The optional "force" to "pciserial" enables use of a
++ PCI device even when its classcode is not of the
++ UART class.
++
+ edac_report= [HW,EDAC] Control how to report EDAC event
+ Format: {"on" | "off" | "force"}
+ on: enable EDAC to report H/W event. May be overridden
+@@ -4683,6 +4687,8 @@
+ prevent spurious wakeup);
+ n = USB_QUIRK_DELAY_CTRL_MSG (Device needs a
+ pause after every control message);
++ o = USB_QUIRK_HUB_SLOW_RESET (Hub needs extra
++ delay after resetting its port);
+ Example: quirks=0781:5580:bk,0a5c:5834:gij
+
+ usbhid.mousepoll=
+diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt
+index 5432a96d31ff..05ef53d83a41 100644
+--- a/Documentation/x86/x86_64/mm.txt
++++ b/Documentation/x86/x86_64/mm.txt
+@@ -4,8 +4,9 @@ Virtual memory map with 4 level page tables:
+ 0000000000000000 - 00007fffffffffff (=47 bits) user space, different per mm
+ hole caused by [47:63] sign extension
+ ffff800000000000 - ffff87ffffffffff (=43 bits) guard hole, reserved for hypervisor
+-ffff880000000000 - ffffc7ffffffffff (=64 TB) direct mapping of all phys. memory
+-ffffc80000000000 - ffffc8ffffffffff (=40 bits) hole
++ffff880000000000 - ffff887fffffffff (=39 bits) LDT remap for PTI
++ffff888000000000 - ffffc87fffffffff (=64 TB) direct mapping of all phys. memory
++ffffc88000000000 - ffffc8ffffffffff (=39 bits) hole
+ ffffc90000000000 - ffffe8ffffffffff (=45 bits) vmalloc/ioremap space
+ ffffe90000000000 - ffffe9ffffffffff (=40 bits) hole
+ ffffea0000000000 - ffffeaffffffffff (=40 bits) virtual memory map (1TB)
+@@ -30,8 +31,9 @@ Virtual memory map with 5 level page tables:
+ 0000000000000000 - 00ffffffffffffff (=56 bits) user space, different per mm
+ hole caused by [56:63] sign extension
+ ff00000000000000 - ff0fffffffffffff (=52 bits) guard hole, reserved for hypervisor
+-ff10000000000000 - ff8fffffffffffff (=55 bits) direct mapping of all phys. memory
+-ff90000000000000 - ff9fffffffffffff (=52 bits) LDT remap for PTI
++ff10000000000000 - ff10ffffffffffff (=48 bits) LDT remap for PTI
++ff11000000000000 - ff90ffffffffffff (=55 bits) direct mapping of all phys. memory
++ff91000000000000 - ff9fffffffffffff (=3840 TB) hole
+ ffa0000000000000 - ffd1ffffffffffff (=54 bits) vmalloc/ioremap space (12800 TB)
+ ffd2000000000000 - ffd3ffffffffffff (=49 bits) hole
+ ffd4000000000000 - ffd5ffffffffffff (=49 bits) virtual memory map (512TB)
+diff --git a/Makefile b/Makefile
+index 1f3c7adeea63..a07830185bdf 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/imx53-ppd.dts b/arch/arm/boot/dts/imx53-ppd.dts
+index cdb90bee7b4a..f202396e3f2a 100644
+--- a/arch/arm/boot/dts/imx53-ppd.dts
++++ b/arch/arm/boot/dts/imx53-ppd.dts
+@@ -55,7 +55,7 @@
+ };
+
+ chosen {
+- stdout-path = "&uart1:115200n8";
++ stdout-path = "serial0:115200n8";
+ };
+
+ memory@70000000 {
+diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi
+index 000e6136a9d6..3e6ffaf5f104 100644
+--- a/arch/arm/boot/dts/imx6sll.dtsi
++++ b/arch/arm/boot/dts/imx6sll.dtsi
+@@ -709,7 +709,7 @@
+ i2c1: i2c@21a0000 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+- compatible = "fs,imx6sll-i2c", "fsl,imx21-i2c";
++ compatible = "fsl,imx6sll-i2c", "fsl,imx21-i2c";
+ reg = <0x021a0000 0x4000>;
+ interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX6SLL_CLK_I2C1>;
+diff --git a/arch/arm/boot/dts/vf610m4-colibri.dts b/arch/arm/boot/dts/vf610m4-colibri.dts
+index 41ec66a96990..ca6249558760 100644
+--- a/arch/arm/boot/dts/vf610m4-colibri.dts
++++ b/arch/arm/boot/dts/vf610m4-colibri.dts
+@@ -50,8 +50,8 @@
+ compatible = "fsl,vf610m4";
+
+ chosen {
+- bootargs = "console=ttyLP2,115200 clk_ignore_unused init=/linuxrc rw";
+- stdout-path = "&uart2";
++ bootargs = "clk_ignore_unused init=/linuxrc rw";
++ stdout-path = "serial2:115200";
+ };
+
+ memory@8c000000 {
+diff --git a/arch/arm64/boot/dts/renesas/r8a7795.dtsi b/arch/arm64/boot/dts/renesas/r8a7795.dtsi
+index fb9d08ad7659..c87eed77de2c 100644
+--- a/arch/arm64/boot/dts/renesas/r8a7795.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a7795.dtsi
+@@ -662,7 +662,7 @@
+ clock-names = "fck", "brg_int", "scif_clk";
+ dmas = <&dmac1 0x35>, <&dmac1 0x34>,
+ <&dmac2 0x35>, <&dmac2 0x34>;
+- dma-names = "tx", "rx";
++ dma-names = "tx", "rx", "tx", "rx";
+ power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
+ resets = <&cpg 518>;
+ status = "disabled";
+diff --git a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
+index 9f25c407dfd7..e830b6162375 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts
+@@ -15,7 +15,7 @@
+
+ aliases {
+ serial0 = &scif0;
+- ethernet0 = &avb;
++ ethernet0 = &gether;
+ };
+
+ chosen {
+@@ -47,23 +47,6 @@
+ };
+ };
+
+-&avb {
+- pinctrl-0 = <&avb_pins>;
+- pinctrl-names = "default";
+-
+- phy-mode = "rgmii-id";
+- phy-handle = <&phy0>;
+- renesas,no-ether-link;
+- status = "okay";
+-
+- phy0: ethernet-phy@0 {
+- rxc-skew-ps = <1500>;
+- reg = <0>;
+- interrupt-parent = <&gpio1>;
+- interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
+- };
+-};
+-
+ &canfd {
+ pinctrl-0 = <&canfd0_pins>;
+ pinctrl-names = "default";
+@@ -82,6 +65,23 @@
+ clock-frequency = <32768>;
+ };
+
++&gether {
++ pinctrl-0 = <&gether_pins>;
++ pinctrl-names = "default";
++
++ phy-mode = "rgmii-id";
++ phy-handle = <&phy0>;
++ renesas,no-ether-link;
++ status = "okay";
++
++ phy0: ethernet-phy@0 {
++ rxc-skew-ps = <1500>;
++ reg = <0>;
++ interrupt-parent = <&gpio4>;
++ interrupts = <23 IRQ_TYPE_LEVEL_LOW>;
++ };
++};
++
+ &i2c0 {
+ pinctrl-0 = <&i2c0_pins>;
+ pinctrl-names = "default";
+@@ -118,16 +118,17 @@
+ };
+
+ &pfc {
+- avb_pins: avb {
+- groups = "avb_mdio", "avb_rgmii";
+- function = "avb";
+- };
+-
+ canfd0_pins: canfd0 {
+ groups = "canfd0_data_a";
+ function = "canfd0";
+ };
+
++ gether_pins: gether {
++ groups = "gether_mdio_a", "gether_rgmii",
++ "gether_txcrefclk", "gether_txcrefclk_mega";
++ function = "gether";
++ };
++
+ i2c0_pins: i2c0 {
+ groups = "i2c0";
+ function = "i2c0";
+diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
+index 9234013e759e..21a81b59a0cc 100644
+--- a/arch/arm64/include/asm/percpu.h
++++ b/arch/arm64/include/asm/percpu.h
+@@ -96,6 +96,7 @@ static inline unsigned long __percpu_##op(void *ptr, \
+ : [val] "Ir" (val)); \
+ break; \
+ default: \
++ ret = 0; \
+ BUILD_BUG(); \
+ } \
+ \
+@@ -125,6 +126,7 @@ static inline unsigned long __percpu_read(void *ptr, int size)
+ ret = READ_ONCE(*(u64 *)ptr);
+ break;
+ default:
++ ret = 0;
+ BUILD_BUG();
+ }
+
+@@ -194,6 +196,7 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
+ : [val] "r" (val));
+ break;
+ default:
++ ret = 0;
+ BUILD_BUG();
+ }
+
+diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
+index e78c3ef04d95..b5a367d4bba6 100644
+--- a/arch/arm64/kernel/probes/kprobes.c
++++ b/arch/arm64/kernel/probes/kprobes.c
+@@ -23,7 +23,9 @@
+ #include <linux/slab.h>
+ #include <linux/stop_machine.h>
+ #include <linux/sched/debug.h>
++#include <linux/set_memory.h>
+ #include <linux/stringify.h>
++#include <linux/vmalloc.h>
+ #include <asm/traps.h>
+ #include <asm/ptrace.h>
+ #include <asm/cacheflush.h>
+@@ -42,10 +44,21 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
+ static void __kprobes
+ post_kprobe_handler(struct kprobe_ctlblk *, struct pt_regs *);
+
++static int __kprobes patch_text(kprobe_opcode_t *addr, u32 opcode)
++{
++ void *addrs[1];
++ u32 insns[1];
++
++ addrs[0] = addr;
++ insns[0] = opcode;
++
++ return aarch64_insn_patch_text(addrs, insns, 1);
++}
++
+ static void __kprobes arch_prepare_ss_slot(struct kprobe *p)
+ {
+ /* prepare insn slot */
+- p->ainsn.api.insn[0] = cpu_to_le32(p->opcode);
++ patch_text(p->ainsn.api.insn, p->opcode);
+
+ flush_icache_range((uintptr_t) (p->ainsn.api.insn),
+ (uintptr_t) (p->ainsn.api.insn) +
+@@ -118,15 +131,15 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+ return 0;
+ }
+
+-static int __kprobes patch_text(kprobe_opcode_t *addr, u32 opcode)
++void *alloc_insn_page(void)
+ {
+- void *addrs[1];
+- u32 insns[1];
++ void *page;
+
+- addrs[0] = (void *)addr;
+- insns[0] = (u32)opcode;
++ page = vmalloc_exec(PAGE_SIZE);
++ if (page)
++ set_memory_ro((unsigned long)page, 1);
+
+- return aarch64_insn_patch_text(addrs, insns, 1);
++ return page;
+ }
+
+ /* arm kprobe: install breakpoint in text */
+diff --git a/arch/mips/configs/cavium_octeon_defconfig b/arch/mips/configs/cavium_octeon_defconfig
+index 490b12af103c..c52d0efacd14 100644
+--- a/arch/mips/configs/cavium_octeon_defconfig
++++ b/arch/mips/configs/cavium_octeon_defconfig
+@@ -140,6 +140,7 @@ CONFIG_RTC_CLASS=y
+ CONFIG_RTC_DRV_DS1307=y
+ CONFIG_STAGING=y
+ CONFIG_OCTEON_ETHERNET=y
++CONFIG_OCTEON_USB=y
+ # CONFIG_IOMMU_SUPPORT is not set
+ CONFIG_RAS=y
+ CONFIG_EXT4_FS=y
+diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
+index 473cfc84e412..8c3e3e3c8be1 100644
+--- a/arch/riscv/include/asm/uaccess.h
++++ b/arch/riscv/include/asm/uaccess.h
+@@ -400,13 +400,13 @@ extern unsigned long __must_check __asm_copy_from_user(void *to,
+ static inline unsigned long
+ raw_copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+- return __asm_copy_to_user(to, from, n);
++ return __asm_copy_from_user(to, from, n);
+ }
+
+ static inline unsigned long
+ raw_copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+- return __asm_copy_from_user(to, from, n);
++ return __asm_copy_to_user(to, from, n);
+ }
+
+ extern long strncpy_from_user(char *dest, const char __user *src, long count);
+diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile
+index 04609478d18b..b375c6c5ae7b 100644
+--- a/arch/s390/boot/compressed/Makefile
++++ b/arch/s390/boot/compressed/Makefile
+@@ -20,7 +20,7 @@ KBUILD_CFLAGS := $(KBUILD_CFLAGS_DECOMPRESSOR)
+ OBJECTS := $(addprefix $(obj)/,$(obj-y))
+
+ LDFLAGS_vmlinux := --oformat $(LD_BFD) -e startup -T
+-$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS)
++$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS) FORCE
+ $(call if_changed,ld)
+
+ # extract required uncompressed vmlinux symbols and adjust them to reflect offsets inside vmlinux.bin
+@@ -51,17 +51,17 @@ suffix-$(CONFIG_KERNEL_LZMA) := .lzma
+ suffix-$(CONFIG_KERNEL_LZO) := .lzo
+ suffix-$(CONFIG_KERNEL_XZ) := .xz
+
+-$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,gzip)
+-$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,bzip2)
+-$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,lz4)
+-$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,lzma)
+-$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,lzo)
+-$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y)
++$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y) FORCE
+ $(call if_changed,xzkern)
+
+ LDFLAGS_piggy.o := -r --format binary --oformat $(LD_BFD) -T
+diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
+index 0717ee76885d..f1ab9420ccfb 100644
+--- a/arch/s390/include/asm/mmu_context.h
++++ b/arch/s390/include/asm/mmu_context.h
+@@ -45,8 +45,6 @@ static inline int init_new_context(struct task_struct *tsk,
+ mm->context.asce_limit = STACK_TOP_MAX;
+ mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
+ _ASCE_USER_BITS | _ASCE_TYPE_REGION3;
+- /* pgd_alloc() did not account this pud */
+- mm_inc_nr_puds(mm);
+ break;
+ case -PAGE_SIZE:
+ /* forked 5-level task, set new asce with new_mm->pgd */
+@@ -62,9 +60,6 @@ static inline int init_new_context(struct task_struct *tsk,
+ /* forked 2-level compat task, set new asce with new mm->pgd */
+ mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
+ _ASCE_USER_BITS | _ASCE_TYPE_SEGMENT;
+- /* pgd_alloc() did not account this pmd */
+- mm_inc_nr_pmds(mm);
+- mm_inc_nr_puds(mm);
+ }
+ crst_table_init((unsigned long *) mm->pgd, pgd_entry_type(mm));
+ return 0;
+diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h
+index f0f9bcf94c03..5ee733720a57 100644
+--- a/arch/s390/include/asm/pgalloc.h
++++ b/arch/s390/include/asm/pgalloc.h
+@@ -36,11 +36,11 @@ static inline void crst_table_init(unsigned long *crst, unsigned long entry)
+
+ static inline unsigned long pgd_entry_type(struct mm_struct *mm)
+ {
+- if (mm->context.asce_limit <= _REGION3_SIZE)
++ if (mm_pmd_folded(mm))
+ return _SEGMENT_ENTRY_EMPTY;
+- if (mm->context.asce_limit <= _REGION2_SIZE)
++ if (mm_pud_folded(mm))
+ return _REGION3_ENTRY_EMPTY;
+- if (mm->context.asce_limit <= _REGION1_SIZE)
++ if (mm_p4d_folded(mm))
+ return _REGION2_ENTRY_EMPTY;
+ return _REGION1_ENTRY_EMPTY;
+ }
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index 0e7cb0dc9c33..de05466ce50c 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -485,6 +485,24 @@ static inline int is_module_addr(void *addr)
+ _REGION_ENTRY_PROTECT | \
+ _REGION_ENTRY_NOEXEC)
+
++static inline bool mm_p4d_folded(struct mm_struct *mm)
++{
++ return mm->context.asce_limit <= _REGION1_SIZE;
++}
++#define mm_p4d_folded(mm) mm_p4d_folded(mm)
++
++static inline bool mm_pud_folded(struct mm_struct *mm)
++{
++ return mm->context.asce_limit <= _REGION2_SIZE;
++}
++#define mm_pud_folded(mm) mm_pud_folded(mm)
++
++static inline bool mm_pmd_folded(struct mm_struct *mm)
++{
++ return mm->context.asce_limit <= _REGION3_SIZE;
++}
++#define mm_pmd_folded(mm) mm_pmd_folded(mm)
++
+ static inline int mm_has_pgste(struct mm_struct *mm)
+ {
+ #ifdef CONFIG_PGSTE
+diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
+index 457b7ba0fbb6..b31c779cf581 100644
+--- a/arch/s390/include/asm/tlb.h
++++ b/arch/s390/include/asm/tlb.h
+@@ -136,7 +136,7 @@ static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
+ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+ unsigned long address)
+ {
+- if (tlb->mm->context.asce_limit <= _REGION3_SIZE)
++ if (mm_pmd_folded(tlb->mm))
+ return;
+ pgtable_pmd_page_dtor(virt_to_page(pmd));
+ tlb_remove_table(tlb, pmd);
+@@ -152,7 +152,7 @@ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
+ static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d,
+ unsigned long address)
+ {
+- if (tlb->mm->context.asce_limit <= _REGION1_SIZE)
++ if (mm_p4d_folded(tlb->mm))
+ return;
+ tlb_remove_table(tlb, p4d);
+ }
+@@ -167,7 +167,7 @@ static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d,
+ static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
+ unsigned long address)
+ {
+- if (tlb->mm->context.asce_limit <= _REGION2_SIZE)
++ if (mm_pud_folded(tlb->mm))
+ return;
+ tlb_remove_table(tlb, pud);
+ }
+diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
+index cc085e2d2ce9..74091fd3101e 100644
+--- a/arch/s390/kernel/perf_cpum_cf.c
++++ b/arch/s390/kernel/perf_cpum_cf.c
+@@ -373,7 +373,7 @@ static int __hw_perf_event_init(struct perf_event *event)
+ return -ENOENT;
+
+ if (ev > PERF_CPUM_CF_MAX_CTR)
+- return -EINVAL;
++ return -ENOENT;
+
+ /* Obtain the counter set to which the specified counter belongs */
+ set = get_counter_set(ev);
+diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile
+index c5c856f320bc..04dd3e2c3bd9 100644
+--- a/arch/s390/kernel/vdso32/Makefile
++++ b/arch/s390/kernel/vdso32/Makefile
+@@ -36,7 +36,7 @@ UBSAN_SANITIZE := n
+ $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so
+
+ # link rule for the .so file, .lds has to be first
+-$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32)
++$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) FORCE
+ $(call if_changed,vdso32ld)
+
+ # strip rule for the .so file
+@@ -45,12 +45,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
+ $(call if_changed,objcopy)
+
+ # assembly rules for the .S files
+-$(obj-vdso32): %.o: %.S
++$(obj-vdso32): %.o: %.S FORCE
+ $(call if_changed_dep,vdso32as)
+
+ # actual build commands
+ quiet_cmd_vdso32ld = VDSO32L $@
+- cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
++ cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@
+ quiet_cmd_vdso32as = VDSO32A $@
+ cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $<
+
+diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
+index 15b1ceafc4c1..ddebc26cd949 100644
+--- a/arch/s390/kernel/vdso64/Makefile
++++ b/arch/s390/kernel/vdso64/Makefile
+@@ -36,7 +36,7 @@ UBSAN_SANITIZE := n
+ $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so
+
+ # link rule for the .so file, .lds has to be first
+-$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64)
++$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) FORCE
+ $(call if_changed,vdso64ld)
+
+ # strip rule for the .so file
+@@ -45,12 +45,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
+ $(call if_changed,objcopy)
+
+ # assembly rules for the .S files
+-$(obj-vdso64): %.o: %.S
++$(obj-vdso64): %.o: %.S FORCE
+ $(call if_changed_dep,vdso64as)
+
+ # actual build commands
+ quiet_cmd_vdso64ld = VDSO64L $@
+- cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
++ cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@
+ quiet_cmd_vdso64as = VDSO64A $@
+ cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $<
+
+diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
+index 76d89ee8b428..814f26520aa2 100644
+--- a/arch/s390/mm/pgalloc.c
++++ b/arch/s390/mm/pgalloc.c
+@@ -101,6 +101,7 @@ int crst_table_upgrade(struct mm_struct *mm, unsigned long end)
+ mm->context.asce_limit = _REGION1_SIZE;
+ mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
+ _ASCE_USER_BITS | _ASCE_TYPE_REGION2;
++ mm_inc_nr_puds(mm);
+ } else {
+ crst_table_init(table, _REGION1_ENTRY_EMPTY);
+ pgd_populate(mm, (pgd_t *) table, (p4d_t *) pgd);
+diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c
+index 5bd374491f94..6c151b42e65d 100644
+--- a/arch/s390/numa/numa.c
++++ b/arch/s390/numa/numa.c
+@@ -54,6 +54,7 @@ int __node_distance(int a, int b)
+ {
+ return mode->distance ? mode->distance(a, b) : 0;
+ }
++EXPORT_SYMBOL(__node_distance);
+
+ int numa_debug_enabled;
+
+diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
+index c94c3bd70ccd..df4a985716eb 100644
+--- a/arch/um/os-Linux/skas/process.c
++++ b/arch/um/os-Linux/skas/process.c
+@@ -610,6 +610,11 @@ int start_idle_thread(void *stack, jmp_buf *switch_buf)
+ fatal_sigsegv();
+ }
+ longjmp(*switch_buf, 1);
++
++ /* unreachable */
++ printk(UM_KERN_ERR "impossible long jump!");
++ fatal_sigsegv();
++ return 0;
+ }
+
+ void initial_thread_cb_skas(void (*proc)(void *), void *arg)
+diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
+index 6afac386a434..b99d497e342d 100644
+--- a/arch/x86/include/asm/page_64_types.h
++++ b/arch/x86/include/asm/page_64_types.h
+@@ -33,12 +33,14 @@
+
+ /*
+ * Set __PAGE_OFFSET to the most negative possible address +
+- * PGDIR_SIZE*16 (pgd slot 272). The gap is to allow a space for a
+- * hypervisor to fit. Choosing 16 slots here is arbitrary, but it's
+- * what Xen requires.
++ * PGDIR_SIZE*17 (pgd slot 273).
++ *
++ * The gap is to allow a space for LDT remap for PTI (1 pgd slot) and space for
++ * a hypervisor (16 slots). Choosing 16 slots for a hypervisor is arbitrary,
++ * but it's what Xen requires.
+ */
+-#define __PAGE_OFFSET_BASE_L5 _AC(0xff10000000000000, UL)
+-#define __PAGE_OFFSET_BASE_L4 _AC(0xffff880000000000, UL)
++#define __PAGE_OFFSET_BASE_L5 _AC(0xff11000000000000, UL)
++#define __PAGE_OFFSET_BASE_L4 _AC(0xffff888000000000, UL)
+
+ #ifdef CONFIG_DYNAMIC_MEMORY_LAYOUT
+ #define __PAGE_OFFSET page_offset_base
+diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
+index 04edd2d58211..84bd9bdc1987 100644
+--- a/arch/x86/include/asm/pgtable_64_types.h
++++ b/arch/x86/include/asm/pgtable_64_types.h
+@@ -111,9 +111,7 @@ extern unsigned int ptrs_per_p4d;
+ */
+ #define MAXMEM (1UL << MAX_PHYSMEM_BITS)
+
+-#define LDT_PGD_ENTRY_L4 -3UL
+-#define LDT_PGD_ENTRY_L5 -112UL
+-#define LDT_PGD_ENTRY (pgtable_l5_enabled() ? LDT_PGD_ENTRY_L5 : LDT_PGD_ENTRY_L4)
++#define LDT_PGD_ENTRY -240UL
+ #define LDT_BASE_ADDR (LDT_PGD_ENTRY << PGDIR_SHIFT)
+ #define LDT_END_ADDR (LDT_BASE_ADDR + PGDIR_SIZE)
+
+diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
+index 5e801c8c8ce7..374a52fa5296 100644
+--- a/arch/x86/kernel/early_printk.c
++++ b/arch/x86/kernel/early_printk.c
+@@ -213,8 +213,9 @@ static unsigned int mem32_serial_in(unsigned long addr, int offset)
+ * early_pci_serial_init()
+ *
+ * This function is invoked when the early_printk param starts with "pciserial"
+- * The rest of the param should be ",B:D.F,baud" where B, D & F describe the
+- * location of a PCI device that must be a UART device.
++ * The rest of the param should be "[force],B:D.F,baud", where B, D & F describe
++ * the location of a PCI device that must be a UART device. "force" is optional
++ * and overrides the use of an UART device with a wrong PCI class code.
+ */
+ static __init void early_pci_serial_init(char *s)
+ {
+@@ -224,17 +225,23 @@ static __init void early_pci_serial_init(char *s)
+ u32 classcode, bar0;
+ u16 cmdreg;
+ char *e;
++ int force = 0;
+
+-
+- /*
+- * First, part the param to get the BDF values
+- */
+ if (*s == ',')
+ ++s;
+
+ if (*s == 0)
+ return;
+
++ /* Force the use of an UART device with wrong class code */
++ if (!strncmp(s, "force,", 6)) {
++ force = 1;
++ s += 6;
++ }
++
++ /*
++ * Part the param to get the BDF values
++ */
+ bus = (u8)simple_strtoul(s, &e, 16);
+ s = e;
+ if (*s != ':')
+@@ -253,7 +260,7 @@ static __init void early_pci_serial_init(char *s)
+ s++;
+
+ /*
+- * Second, find the device from the BDF
++ * Find the device from the BDF
+ */
+ cmdreg = read_pci_config(bus, slot, func, PCI_COMMAND);
+ classcode = read_pci_config(bus, slot, func, PCI_CLASS_REVISION);
+@@ -264,8 +271,10 @@ static __init void early_pci_serial_init(char *s)
+ */
+ if (((classcode >> 16 != PCI_CLASS_COMMUNICATION_MODEM) &&
+ (classcode >> 16 != PCI_CLASS_COMMUNICATION_SERIAL)) ||
+- (((classcode >> 8) & 0xff) != 0x02)) /* 16550 I/F at BAR0 */
+- return;
++ (((classcode >> 8) & 0xff) != 0x02)) /* 16550 I/F at BAR0 */ {
++ if (!force)
++ return;
++ }
+
+ /*
+ * Determine if it is IO or memory mapped
+@@ -289,7 +298,7 @@ static __init void early_pci_serial_init(char *s)
+ }
+
+ /*
+- * Lastly, initialize the hardware
++ * Initialize the hardware
+ */
+ if (*s) {
+ if (strcmp(s, "nocfg") == 0)
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index 733e6ace0fa4..65590eee6289 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -199,14 +199,6 @@ static void sanity_check_ldt_mapping(struct mm_struct *mm)
+ /*
+ * If PTI is enabled, this maps the LDT into the kernelmode and
+ * usermode tables for the given mm.
+- *
+- * There is no corresponding unmap function. Even if the LDT is freed, we
+- * leave the PTEs around until the slot is reused or the mm is destroyed.
+- * This is harmless: the LDT is always in ordinary memory, and no one will
+- * access the freed slot.
+- *
+- * If we wanted to unmap freed LDTs, we'd also need to do a flush to make
+- * it useful, and the flush would slow down modify_ldt().
+ */
+ static int
+ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+@@ -214,8 +206,7 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+ unsigned long va;
+ bool is_vmalloc;
+ spinlock_t *ptl;
+- pgd_t *pgd;
+- int i;
++ int i, nr_pages;
+
+ if (!static_cpu_has(X86_FEATURE_PTI))
+ return 0;
+@@ -229,16 +220,11 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+ /* Check if the current mappings are sane */
+ sanity_check_ldt_mapping(mm);
+
+- /*
+- * Did we already have the top level entry allocated? We can't
+- * use pgd_none() for this because it doens't do anything on
+- * 4-level page table kernels.
+- */
+- pgd = pgd_offset(mm, LDT_BASE_ADDR);
+-
+ is_vmalloc = is_vmalloc_addr(ldt->entries);
+
+- for (i = 0; i * PAGE_SIZE < ldt->nr_entries * LDT_ENTRY_SIZE; i++) {
++ nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
++
++ for (i = 0; i < nr_pages; i++) {
+ unsigned long offset = i << PAGE_SHIFT;
+ const void *src = (char *)ldt->entries + offset;
+ unsigned long pfn;
+@@ -272,13 +258,39 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+ /* Propagate LDT mapping to the user page-table */
+ map_ldt_struct_to_user(mm);
+
+- va = (unsigned long)ldt_slot_va(slot);
+- flush_tlb_mm_range(mm, va, va + LDT_SLOT_STRIDE, 0);
+-
+ ldt->slot = slot;
+ return 0;
+ }
+
++static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
++{
++ unsigned long va;
++ int i, nr_pages;
++
++ if (!ldt)
++ return;
++
++ /* LDT map/unmap is only required for PTI */
++ if (!static_cpu_has(X86_FEATURE_PTI))
++ return;
++
++ nr_pages = DIV_ROUND_UP(ldt->nr_entries * LDT_ENTRY_SIZE, PAGE_SIZE);
++
++ for (i = 0; i < nr_pages; i++) {
++ unsigned long offset = i << PAGE_SHIFT;
++ spinlock_t *ptl;
++ pte_t *ptep;
++
++ va = (unsigned long)ldt_slot_va(ldt->slot) + offset;
++ ptep = get_locked_pte(mm, va, &ptl);
++ pte_clear(mm, va, ptep);
++ pte_unmap_unlock(ptep, ptl);
++ }
++
++ va = (unsigned long)ldt_slot_va(ldt->slot);
++ flush_tlb_mm_range(mm, va, va + nr_pages * PAGE_SIZE, 0);
++}
++
+ #else /* !CONFIG_PAGE_TABLE_ISOLATION */
+
+ static int
+@@ -286,6 +298,10 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+ {
+ return 0;
+ }
++
++static void unmap_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt)
++{
++}
+ #endif /* CONFIG_PAGE_TABLE_ISOLATION */
+
+ static void free_ldt_pgtables(struct mm_struct *mm)
+@@ -524,6 +540,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ }
+
+ install_ldt(mm, new_ldt);
++ unmap_ldt_struct(mm, old_ldt);
+ free_ldt_struct(old_ldt);
+ error = 0;
+
+diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
+index dd461c0167ef..2c84c6ad8b50 100644
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -1897,7 +1897,7 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
+ init_top_pgt[0] = __pgd(0);
+
+ /* Pre-constructed entries are in pfn, so convert to mfn */
+- /* L4[272] -> level3_ident_pgt */
++ /* L4[273] -> level3_ident_pgt */
+ /* L4[511] -> level3_kernel_pgt */
+ convert_pfn_mfn(init_top_pgt);
+
+@@ -1917,8 +1917,8 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
+ addr[0] = (unsigned long)pgd;
+ addr[1] = (unsigned long)l3;
+ addr[2] = (unsigned long)l2;
+- /* Graft it onto L4[272][0]. Note that we creating an aliasing problem:
+- * Both L4[272][0] and L4[511][510] have entries that point to the same
++ /* Graft it onto L4[273][0]. Note that we creating an aliasing problem:
++ * Both L4[273][0] and L4[511][510] have entries that point to the same
+ * L2 (PMD) tables. Meaning that if you modify it in __va space
+ * it will be also modified in the __ka space! (But if you just
+ * modify the PMD table to point to other PTE's or none, then you
+diff --git a/block/bio.c b/block/bio.c
+index 0093bed81c0e..41173710430c 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -1261,6 +1261,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
+ if (ret)
+ goto cleanup;
+ } else {
++ zero_fill_bio(bio);
+ iov_iter_advance(iter, bio->bi_iter.bi_size);
+ }
+
+diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
+index eaa60c94205a..1f32caa87686 100644
+--- a/drivers/acpi/acpi_platform.c
++++ b/drivers/acpi/acpi_platform.c
+@@ -30,6 +30,7 @@ static const struct acpi_device_id forbidden_id_list[] = {
+ {"PNP0200", 0}, /* AT DMA Controller */
+ {"ACPI0009", 0}, /* IOxAPIC */
+ {"ACPI000A", 0}, /* IOAPIC */
++ {"SMB0001", 0}, /* ACPI SMBUS virtual device */
+ {"", 0},
+ };
+
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index df8103dd40ac..c18586fccb6f 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -396,15 +396,14 @@ static struct brd_device *brd_alloc(int i)
+ disk->first_minor = i * max_part;
+ disk->fops = &brd_fops;
+ disk->private_data = brd;
+- disk->queue = brd->brd_queue;
+ disk->flags = GENHD_FL_EXT_DEVT;
+ sprintf(disk->disk_name, "ram%d", i);
+ set_capacity(disk, rd_size * 2);
+- disk->queue->backing_dev_info->capabilities |= BDI_CAP_SYNCHRONOUS_IO;
++ brd->brd_queue->backing_dev_info->capabilities |= BDI_CAP_SYNCHRONOUS_IO;
+
+ /* Tell the block layer that this is not a rotational device */
+- blk_queue_flag_set(QUEUE_FLAG_NONROT, disk->queue);
+- blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, disk->queue);
++ blk_queue_flag_set(QUEUE_FLAG_NONROT, brd->brd_queue);
++ blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, brd->brd_queue);
+
+ return brd;
+
+@@ -436,6 +435,7 @@ static struct brd_device *brd_init_one(int i, bool *new)
+
+ brd = brd_alloc(i);
+ if (brd) {
++ brd->brd_disk->queue = brd->brd_queue;
+ add_disk(brd->brd_disk);
+ list_add_tail(&brd->brd_list, &brd_devices);
+ }
+@@ -503,8 +503,14 @@ static int __init brd_init(void)
+
+ /* point of no return */
+
+- list_for_each_entry(brd, &brd_devices, brd_list)
++ list_for_each_entry(brd, &brd_devices, brd_list) {
++ /*
++ * associate with queue just before adding disk for
++ * avoiding to mess up failure path
++ */
++ brd->brd_disk->queue = brd->brd_queue;
+ add_disk(brd->brd_disk);
++ }
+
+ blk_register_region(MKDEV(RAMDISK_MAJOR, 0), 1UL << MINORBITS,
+ THIS_MODULE, brd_probe, NULL, NULL);
+diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c
+index 20724abd38bd..7df6b5b1e7ee 100644
+--- a/drivers/clk/clk-fixed-factor.c
++++ b/drivers/clk/clk-fixed-factor.c
+@@ -210,6 +210,7 @@ static int of_fixed_factor_clk_remove(struct platform_device *pdev)
+ {
+ struct clk *clk = platform_get_drvdata(pdev);
+
++ of_clk_del_provider(pdev->dev.of_node);
+ clk_unregister_fixed_factor(clk);
+
+ return 0;
+diff --git a/drivers/clk/clk-fixed-rate.c b/drivers/clk/clk-fixed-rate.c
+index b5c46b3f8764..6d6475c32ee5 100644
+--- a/drivers/clk/clk-fixed-rate.c
++++ b/drivers/clk/clk-fixed-rate.c
+@@ -200,6 +200,7 @@ static int of_fixed_clk_remove(struct platform_device *pdev)
+ {
+ struct clk *clk = platform_get_drvdata(pdev);
+
++ of_clk_del_provider(pdev->dev.of_node);
+ clk_unregister_fixed_rate(clk);
+
+ return 0;
+diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
+index 8cf74fc423e6..02229d051d77 100644
+--- a/drivers/clk/meson/axg.c
++++ b/drivers/clk/meson/axg.c
+@@ -96,7 +96,6 @@ static struct clk_regmap axg_sys_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+@@ -713,12 +712,14 @@ static struct clk_regmap axg_pcie_mux = {
+ .offset = HHI_PCIE_PLL_CNTL6,
+ .mask = 0x1,
+ .shift = 2,
++ /* skip the parent mpll3, reserved for debug */
++ .table = (u32[]){ 1 },
+ },
+ .hw.init = &(struct clk_init_data){
+ .name = "pcie_mux",
+ .ops = &clk_regmap_mux_ops,
+- .parent_names = (const char *[]){ "mpll3", "pcie_pll" },
+- .num_parents = 2,
++ .parent_names = (const char *[]){ "pcie_pll" },
++ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 6435d86118f1..6628ffa31383 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -213,7 +213,6 @@ static struct clk_regmap gxbb_fixed_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+@@ -276,6 +275,10 @@ static struct clk_regmap gxbb_hdmi_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "hdmi_pll_pre_mult" },
+ .num_parents = 1,
++ /*
++ * Display directly handle hdmi pll registers ATM, we need
++ * NOCACHE to keep our view of the clock as accurate as possible
++ */
+ .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+@@ -334,6 +337,10 @@ static struct clk_regmap gxl_hdmi_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
++ /*
++ * Display directly handle hdmi pll registers ATM, we need
++ * NOCACHE to keep our view of the clock as accurate as possible
++ */
+ .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+@@ -371,7 +378,6 @@ static struct clk_regmap gxbb_sys_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+@@ -418,7 +424,6 @@ static struct clk_regmap gxbb_gp0_pll = {
+ .ops = &meson_clk_pll_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+@@ -472,7 +477,6 @@ static struct clk_regmap gxl_gp0_pll = {
+ .ops = &meson_clk_pll_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
+index 7447d96a265f..74697e145dde 100644
+--- a/drivers/clk/meson/meson8b.c
++++ b/drivers/clk/meson/meson8b.c
+@@ -132,7 +132,6 @@ static struct clk_regmap meson8b_fixed_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+@@ -169,7 +168,6 @@ static struct clk_regmap meson8b_vid_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+@@ -207,7 +205,6 @@ static struct clk_regmap meson8b_sys_pll = {
+ .ops = &meson_clk_pll_ro_ops,
+ .parent_names = (const char *[]){ "xtal" },
+ .num_parents = 1,
+- .flags = CLK_GET_RATE_NOCACHE,
+ },
+ };
+
+diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c
+index a0b6ecdc63dd..6d2b56891559 100644
+--- a/drivers/clk/renesas/r9a06g032-clocks.c
++++ b/drivers/clk/renesas/r9a06g032-clocks.c
+@@ -539,7 +539,8 @@ r9a06g032_div_round_rate(struct clk_hw *hw,
+ * several uarts attached to this divider, and changing this impacts
+ * everyone.
+ */
+- if (clk->index == R9A06G032_DIV_UART) {
++ if (clk->index == R9A06G032_DIV_UART ||
++ clk->index == R9A06G032_DIV_P2_PG) {
+ pr_devel("%s div uart hack!\n", __func__);
+ return clk_get_rate(hw->clk);
+ }
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index 95e1bf69449b..d4f77c4eb277 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -281,6 +281,7 @@ static const struct samsung_clk_reg_dump exynos5420_set_clksrc[] = {
+ { .offset = GATE_BUS_TOP, .value = 0xffffffff, },
+ { .offset = GATE_BUS_DISP1, .value = 0xffffffff, },
+ { .offset = GATE_IP_PERIC, .value = 0xffffffff, },
++ { .offset = GATE_IP_PERIS, .value = 0xffffffff, },
+ };
+
+ static int exynos5420_clk_suspend(void)
+diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c
+index 7d22e1af2247..27e0979b3158 100644
+--- a/drivers/clk/ti/clk.c
++++ b/drivers/clk/ti/clk.c
+@@ -129,7 +129,7 @@ int ti_clk_setup_ll_ops(struct ti_clk_ll_ops *ops)
+ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
+ {
+ struct ti_dt_clk *c;
+- struct device_node *node;
++ struct device_node *node, *parent;
+ struct clk *clk;
+ struct of_phandle_args clkspec;
+ char buf[64];
+@@ -164,8 +164,12 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
+ continue;
+
+ node = of_find_node_by_name(NULL, buf);
+- if (num_args)
+- node = of_find_node_by_name(node, "clk");
++ if (num_args) {
++ parent = node;
++ node = of_get_child_by_name(parent, "clk");
++ of_node_put(parent);
++ }
++
+ clkspec.np = node;
+ clkspec.args_count = num_args;
+ for (i = 0; i < num_args; i++) {
+@@ -173,11 +177,12 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
+ if (ret) {
+ pr_warn("Bad tag in %s at %d: %s\n",
+ c->node_name, i, tags[i]);
++ of_node_put(node);
+ return;
+ }
+ }
+ clk = of_clk_get_from_provider(&clkspec);
+-
++ of_node_put(node);
+ if (!IS_ERR(clk)) {
+ c->lk.clk = clk;
+ clkdev_add(&c->lk);
+diff --git a/drivers/gnss/serial.c b/drivers/gnss/serial.c
+index b01ba4438501..31e891f00175 100644
+--- a/drivers/gnss/serial.c
++++ b/drivers/gnss/serial.c
+@@ -13,6 +13,7 @@
+ #include <linux/of.h>
+ #include <linux/pm.h>
+ #include <linux/pm_runtime.h>
++#include <linux/sched.h>
+ #include <linux/serdev.h>
+ #include <linux/slab.h>
+
+@@ -63,7 +64,7 @@ static int gnss_serial_write_raw(struct gnss_device *gdev,
+ int ret;
+
+ /* write is only buffered synchronously */
+- ret = serdev_device_write(serdev, buf, count, 0);
++ ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
+ if (ret < 0)
+ return ret;
+
+diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c
+index 79cb98950013..71d014edd167 100644
+--- a/drivers/gnss/sirf.c
++++ b/drivers/gnss/sirf.c
+@@ -16,6 +16,7 @@
+ #include <linux/pm.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/regulator/consumer.h>
++#include <linux/sched.h>
+ #include <linux/serdev.h>
+ #include <linux/slab.h>
+ #include <linux/wait.h>
+@@ -83,7 +84,7 @@ static int sirf_write_raw(struct gnss_device *gdev, const unsigned char *buf,
+ int ret;
+
+ /* write is only buffered synchronously */
+- ret = serdev_device_write(serdev, buf, count, 0);
++ ret = serdev_device_write(serdev, buf, count, MAX_SCHEDULE_TIMEOUT);
+ if (ret < 0)
+ return ret;
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 6903fe6c894b..ef5c6af4d964 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3167,7 +3167,7 @@ void dm_drm_plane_destroy_state(struct drm_plane *plane,
+ static const struct drm_plane_funcs dm_plane_funcs = {
+ .update_plane = drm_atomic_helper_update_plane,
+ .disable_plane = drm_atomic_helper_disable_plane,
+- .destroy = drm_plane_cleanup,
++ .destroy = drm_primary_helper_destroy,
+ .reset = dm_drm_plane_reset,
+ .atomic_duplicate_state = dm_drm_plane_duplicate_state,
+ .atomic_destroy_state = dm_drm_plane_destroy_state,
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+index a29dc35954c9..aba2c5c1d2f8 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -173,8 +173,6 @@ struct amdgpu_dm_connector {
+ struct mutex hpd_lock;
+
+ bool fake_enable;
+-
+- bool mst_connected;
+ };
+
+ #define to_amdgpu_dm_connector(x) container_of(x, struct amdgpu_dm_connector, base)
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 9a300732ba37..4cc45a1d21db 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -317,12 +317,7 @@ dm_dp_create_fake_mst_encoder(struct amdgpu_dm_connector *connector)
+ struct amdgpu_device *adev = dev->dev_private;
+ struct amdgpu_encoder *amdgpu_encoder;
+ struct drm_encoder *encoder;
+- const struct drm_connector_helper_funcs *connector_funcs =
+- connector->base.helper_private;
+- struct drm_encoder *enc_master =
+- connector_funcs->best_encoder(&connector->base);
+
+- DRM_DEBUG_KMS("enc master is %p\n", enc_master);
+ amdgpu_encoder = kzalloc(sizeof(*amdgpu_encoder), GFP_KERNEL);
+ if (!amdgpu_encoder)
+ return NULL;
+@@ -352,25 +347,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ struct amdgpu_device *adev = dev->dev_private;
+ struct amdgpu_dm_connector *aconnector;
+ struct drm_connector *connector;
+- struct drm_connector_list_iter conn_iter;
+-
+- drm_connector_list_iter_begin(dev, &conn_iter);
+- drm_for_each_connector_iter(connector, &conn_iter) {
+- aconnector = to_amdgpu_dm_connector(connector);
+- if (aconnector->mst_port == master
+- && !aconnector->port) {
+- DRM_INFO("DM_MST: reusing connector: %p [id: %d] [master: %p]\n",
+- aconnector, connector->base.id, aconnector->mst_port);
+-
+- aconnector->port = port;
+- drm_connector_set_path_property(connector, pathprop);
+-
+- drm_connector_list_iter_end(&conn_iter);
+- aconnector->mst_connected = true;
+- return &aconnector->base;
+- }
+- }
+- drm_connector_list_iter_end(&conn_iter);
+
+ aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL);
+ if (!aconnector)
+@@ -419,8 +395,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ */
+ amdgpu_dm_connector_funcs_reset(connector);
+
+- aconnector->mst_connected = true;
+-
+ DRM_INFO("DM_MST: added connector: %p [id: %d] [master: %p]\n",
+ aconnector, connector->base.id, aconnector->mst_port);
+
+@@ -432,6 +406,9 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ struct drm_connector *connector)
+ {
++ struct amdgpu_dm_connector *master = container_of(mgr, struct amdgpu_dm_connector, mst_mgr);
++ struct drm_device *dev = master->base.dev;
++ struct amdgpu_device *adev = dev->dev_private;
+ struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+
+ DRM_INFO("DM_MST: Disabling connector: %p [id: %d] [master: %p]\n",
+@@ -445,7 +422,10 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ aconnector->dc_sink = NULL;
+ }
+
+- aconnector->mst_connected = false;
++ drm_connector_unregister(connector);
++ if (adev->mode_info.rfbdev)
++ drm_fb_helper_remove_one_connector(&adev->mode_info.rfbdev->helper, connector);
++ drm_connector_put(connector);
+ }
+
+ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
+@@ -456,18 +436,10 @@ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
+ drm_kms_helper_hotplug_event(dev);
+ }
+
+-static void dm_dp_mst_link_status_reset(struct drm_connector *connector)
+-{
+- mutex_lock(&connector->dev->mode_config.mutex);
+- drm_connector_set_link_status_property(connector, DRM_MODE_LINK_STATUS_BAD);
+- mutex_unlock(&connector->dev->mode_config.mutex);
+-}
+-
+ static void dm_dp_mst_register_connector(struct drm_connector *connector)
+ {
+ struct drm_device *dev = connector->dev;
+ struct amdgpu_device *adev = dev->dev_private;
+- struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+
+ if (adev->mode_info.rfbdev)
+ drm_fb_helper_add_one_connector(&adev->mode_info.rfbdev->helper, connector);
+@@ -475,9 +447,6 @@ static void dm_dp_mst_register_connector(struct drm_connector *connector)
+ DRM_ERROR("adev->mode_info.rfbdev is NULL\n");
+
+ drm_connector_register(connector);
+-
+- if (aconnector->mst_connected)
+- dm_dp_mst_link_status_reset(connector);
+ }
+
+ static const struct drm_dp_mst_topology_cbs dm_mst_cbs = {
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index ff0bfc65a8c1..b506e3622b08 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -122,6 +122,9 @@ static const struct edid_quirk {
+ /* SDC panel of Lenovo B50-80 reports 8 bpc, but is a 6 bpc panel */
+ { "SDC", 0x3652, EDID_QUIRK_FORCE_6BPC },
+
++ /* BOE model 0x0771 reports 8 bpc, but is a 6 bpc panel */
++ { "BOE", 0x0771, EDID_QUIRK_FORCE_6BPC },
++
+ /* Belinea 10 15 55 */
+ { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
+ { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },
+diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+index 94529aa82339..aef487dd8731 100644
+--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+@@ -164,13 +164,6 @@ static u32 decon_get_frame_count(struct decon_context *ctx, bool end)
+ return frm;
+ }
+
+-static u32 decon_get_vblank_counter(struct exynos_drm_crtc *crtc)
+-{
+- struct decon_context *ctx = crtc->ctx;
+-
+- return decon_get_frame_count(ctx, false);
+-}
+-
+ static void decon_setup_trigger(struct decon_context *ctx)
+ {
+ if (!ctx->crtc->i80_mode && !(ctx->out_type & I80_HW_TRG))
+@@ -536,7 +529,6 @@ static const struct exynos_drm_crtc_ops decon_crtc_ops = {
+ .disable = decon_disable,
+ .enable_vblank = decon_enable_vblank,
+ .disable_vblank = decon_disable_vblank,
+- .get_vblank_counter = decon_get_vblank_counter,
+ .atomic_begin = decon_atomic_begin,
+ .update_plane = decon_update_plane,
+ .disable_plane = decon_disable_plane,
+@@ -554,7 +546,6 @@ static int decon_bind(struct device *dev, struct device *master, void *data)
+ int ret;
+
+ ctx->drm_dev = drm_dev;
+- drm_dev->max_vblank_count = 0xffffffff;
+
+ for (win = ctx->first_win; win < WINDOWS_NR; win++) {
+ ctx->configs[win].pixel_formats = decon_formats;
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+index eea90251808f..2696289ecc78 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+@@ -162,16 +162,6 @@ static void exynos_drm_crtc_disable_vblank(struct drm_crtc *crtc)
+ exynos_crtc->ops->disable_vblank(exynos_crtc);
+ }
+
+-static u32 exynos_drm_crtc_get_vblank_counter(struct drm_crtc *crtc)
+-{
+- struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
+-
+- if (exynos_crtc->ops->get_vblank_counter)
+- return exynos_crtc->ops->get_vblank_counter(exynos_crtc);
+-
+- return 0;
+-}
+-
+ static const struct drm_crtc_funcs exynos_crtc_funcs = {
+ .set_config = drm_atomic_helper_set_config,
+ .page_flip = drm_atomic_helper_page_flip,
+@@ -181,7 +171,6 @@ static const struct drm_crtc_funcs exynos_crtc_funcs = {
+ .atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
+ .enable_vblank = exynos_drm_crtc_enable_vblank,
+ .disable_vblank = exynos_drm_crtc_disable_vblank,
+- .get_vblank_counter = exynos_drm_crtc_get_vblank_counter,
+ };
+
+ struct exynos_drm_crtc *exynos_drm_crtc_create(struct drm_device *drm_dev,
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
+index c737c4bd2c19..630f1edc5de2 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
++++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
+@@ -133,7 +133,6 @@ struct exynos_drm_crtc_ops {
+ void (*disable)(struct exynos_drm_crtc *crtc);
+ int (*enable_vblank)(struct exynos_drm_crtc *crtc);
+ void (*disable_vblank)(struct exynos_drm_crtc *crtc);
+- u32 (*get_vblank_counter)(struct exynos_drm_crtc *crtc);
+ enum drm_mode_status (*mode_valid)(struct exynos_drm_crtc *crtc,
+ const struct drm_display_mode *mode);
+ bool (*mode_fixup)(struct exynos_drm_crtc *crtc,
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 4aca5344863d..d6c25bea4382 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -2248,7 +2248,7 @@ static inline struct scatterlist *__sg_next(struct scatterlist *sg)
+ #define for_each_sgt_dma(__dmap, __iter, __sgt) \
+ for ((__iter) = __sgt_iter((__sgt)->sgl, true); \
+ ((__dmap) = (__iter).dma + (__iter).curr); \
+- (((__iter).curr += PAGE_SIZE) >= (__iter).max) ? \
++ (((__iter).curr += I915_GTT_PAGE_SIZE) >= (__iter).max) ? \
+ (__iter) = __sgt_iter(__sg_next((__iter).sgp), true), 0 : 0)
+
+ /**
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
+index 294a143b85f5..5f57f4e1fbc8 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -1058,7 +1058,7 @@ gen8_ppgtt_insert_pte_entries(struct i915_hw_ppgtt *ppgtt,
+ do {
+ vaddr[idx->pte] = pte_encode | iter->dma;
+
+- iter->dma += PAGE_SIZE;
++ iter->dma += I915_GTT_PAGE_SIZE;
+ if (iter->dma >= iter->max) {
+ iter->sg = __sg_next(iter->sg);
+ if (!iter->sg) {
+@@ -1770,7 +1770,7 @@ static void gen6_dump_ppgtt(struct i915_hw_ppgtt *base, struct seq_file *m)
+
+ seq_printf(m, "\t\t(%03d, %04d) %08llx: ",
+ pde, pte,
+- (pde * GEN6_PTES + pte) * PAGE_SIZE);
++ (pde * GEN6_PTES + pte) * I915_GTT_PAGE_SIZE);
+ for (i = 0; i < 4; i++) {
+ if (vaddr[pte + i] != scratch_pte)
+ seq_printf(m, " %08x", vaddr[pte + i]);
+@@ -1910,7 +1910,7 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm,
+ do {
+ vaddr[act_pte] = pte_encode | GEN6_PTE_ADDR_ENCODE(iter.dma);
+
+- iter.dma += PAGE_SIZE;
++ iter.dma += I915_GTT_PAGE_SIZE;
+ if (iter.dma == iter.max) {
+ iter.sg = __sg_next(iter.sg);
+ if (!iter.sg)
+@@ -2048,7 +2048,7 @@ static int pd_vma_bind(struct i915_vma *vma,
+ {
+ struct i915_ggtt *ggtt = i915_vm_to_ggtt(vma->vm);
+ struct gen6_hw_ppgtt *ppgtt = vma->private;
+- u32 ggtt_offset = i915_ggtt_offset(vma) / PAGE_SIZE;
++ u32 ggtt_offset = i915_ggtt_offset(vma) / I915_GTT_PAGE_SIZE;
+ struct i915_page_table *pt;
+ unsigned int pde;
+
+@@ -2174,7 +2174,7 @@ static struct i915_hw_ppgtt *gen6_ppgtt_create(struct drm_i915_private *i915)
+ ppgtt->base.vm.i915 = i915;
+ ppgtt->base.vm.dma = &i915->drm.pdev->dev;
+
+- ppgtt->base.vm.total = I915_PDES * GEN6_PTES * PAGE_SIZE;
++ ppgtt->base.vm.total = I915_PDES * GEN6_PTES * I915_GTT_PAGE_SIZE;
+
+ i915_address_space_init(&ppgtt->base.vm, i915);
+
+@@ -3031,7 +3031,7 @@ static unsigned int gen8_get_total_gtt_size(u16 bdw_gmch_ctl)
+ bdw_gmch_ctl = 1 << bdw_gmch_ctl;
+
+ #ifdef CONFIG_X86_32
+- /* Limit 32b platforms to a 2GB GGTT: 4 << 20 / pte size * PAGE_SIZE */
++ /* Limit 32b platforms to a 2GB GGTT: 4 << 20 / pte size * I915_GTT_PAGE_SIZE */
+ if (bdw_gmch_ctl > 4)
+ bdw_gmch_ctl = 4;
+ #endif
+@@ -3729,9 +3729,9 @@ rotate_pages(const dma_addr_t *in, unsigned int offset,
+ * the entries so the sg list can be happily traversed.
+ * The only thing we need are DMA addresses.
+ */
+- sg_set_page(sg, NULL, PAGE_SIZE, 0);
++ sg_set_page(sg, NULL, I915_GTT_PAGE_SIZE, 0);
+ sg_dma_address(sg) = in[offset + src_idx];
+- sg_dma_len(sg) = PAGE_SIZE;
++ sg_dma_len(sg) = I915_GTT_PAGE_SIZE;
+ sg = sg_next(sg);
+ src_idx -= stride;
+ }
+@@ -3744,7 +3744,7 @@ static noinline struct sg_table *
+ intel_rotate_pages(struct intel_rotation_info *rot_info,
+ struct drm_i915_gem_object *obj)
+ {
+- const unsigned long n_pages = obj->base.size / PAGE_SIZE;
++ const unsigned long n_pages = obj->base.size / I915_GTT_PAGE_SIZE;
+ unsigned int size = intel_rotation_info_size(rot_info);
+ struct sgt_iter sgt_iter;
+ dma_addr_t dma_addr;
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index aec253b44156..3cd7229b6e54 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -660,6 +660,20 @@ exit:
+ return ret;
+ }
+
++static int alps_sp_open(struct input_dev *dev)
++{
++ struct hid_device *hid = input_get_drvdata(dev);
++
++ return hid_hw_open(hid);
++}
++
++static void alps_sp_close(struct input_dev *dev)
++{
++ struct hid_device *hid = input_get_drvdata(dev);
++
++ hid_hw_close(hid);
++}
++
+ static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ {
+ struct alps_dev *data = hid_get_drvdata(hdev);
+@@ -733,6 +747,10 @@ static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ input2->id.version = input->id.version;
+ input2->dev.parent = input->dev.parent;
+
++ input_set_drvdata(input2, hdev);
++ input2->open = alps_sp_open;
++ input2->close = alps_sp_close;
++
+ __set_bit(EV_KEY, input2->evbit);
+ data->sp_btn_cnt = (data->sp_btn_info & 0x0F);
+ for (i = 0; i < data->sp_btn_cnt; i++)
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index bc49909aba8e..501c05cbec7e 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -799,6 +799,7 @@
+ #define USB_DEVICE_ID_MS_TOUCH_COVER_2 0x07a7
+ #define USB_DEVICE_ID_MS_TYPE_COVER_2 0x07a9
+ #define USB_DEVICE_ID_MS_POWER_COVER 0x07da
++#define USB_DEVICE_ID_MS_PIXART_MOUSE 0x00cb
+
+ #define USB_VENDOR_ID_MOJO 0x8282
+ #define USB_DEVICE_ID_RETRO_ADAPTER 0x3201
+@@ -921,6 +922,9 @@
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003 0x3003
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008
+
++#define I2C_VENDOR_ID_RAYDIUM 0x2386
++#define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33
++
+ #define USB_VENDOR_ID_RAZER 0x1532
+ #define USB_DEVICE_ID_RAZER_BLADE_14 0x011D
+
+@@ -1195,6 +1199,8 @@
+ #define USB_DEVICE_ID_PRIMAX_MOUSE_4D22 0x4d22
+ #define USB_DEVICE_ID_PRIMAX_KEYBOARD 0x4e05
+ #define USB_DEVICE_ID_PRIMAX_REZEL 0x4e72
++#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F 0x4d0f
++#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22 0x4e22
+
+
+ #define USB_VENDOR_ID_RISO_KAGAKU 0x1294 /* Riso Kagaku Corp. */
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 249d49b6b16c..0a0605a7e481 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -106,7 +106,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MCS, USB_DEVICE_ID_MCS_GAMEPADBLOCK), HID_QUIRK_MULTI_INPUT },
+- { HID_USB_DEVICE(USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS), HID_QUIRK_NOGET },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PIXART_MOUSE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2), HID_QUIRK_NO_INIT_REPORTS },
+@@ -129,6 +129,8 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_MOUSE_4D22), HID_QUIRK_ALWAYS_POLL },
++ { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F), HID_QUIRK_ALWAYS_POLL },
++ { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003), HID_QUIRK_NOGET },
+diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
+index 4e3592e7a3f7..88daa388e1f6 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -48,6 +48,7 @@
+ #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV BIT(0)
+ #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(1)
+ #define I2C_HID_QUIRK_NO_RUNTIME_PM BIT(2)
++#define I2C_HID_QUIRK_DELAY_AFTER_SLEEP BIT(3)
+
+ /* flags */
+ #define I2C_HID_STARTED 0
+@@ -157,6 +158,8 @@ struct i2c_hid {
+
+ bool irq_wake_enabled;
+ struct mutex reset_lock;
++
++ unsigned long sleep_delay;
+ };
+
+ static const struct i2c_hid_quirks {
+@@ -171,6 +174,8 @@ static const struct i2c_hid_quirks {
+ { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
+ I2C_HID_QUIRK_NO_IRQ_AFTER_RESET |
+ I2C_HID_QUIRK_NO_RUNTIME_PM },
++ { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33,
++ I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
+ { 0, 0 }
+ };
+
+@@ -386,6 +391,7 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
+ {
+ struct i2c_hid *ihid = i2c_get_clientdata(client);
+ int ret;
++ unsigned long now, delay;
+
+ i2c_hid_dbg(ihid, "%s\n", __func__);
+
+@@ -403,9 +409,22 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
+ goto set_pwr_exit;
+ }
+
++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
++ power_state == I2C_HID_PWR_ON) {
++ now = jiffies;
++ if (time_after(ihid->sleep_delay, now)) {
++ delay = jiffies_to_usecs(ihid->sleep_delay - now);
++ usleep_range(delay, delay + 1);
++ }
++ }
++
+ ret = __i2c_hid_command(client, &hid_set_power_cmd, power_state,
+ 0, NULL, 0, NULL, 0);
+
++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
++ power_state == I2C_HID_PWR_SLEEP)
++ ihid->sleep_delay = jiffies + msecs_to_jiffies(20);
++
+ if (ret)
+ dev_err(&client->dev, "failed to change power setting.\n");
+
+diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
+index 3c5507313606..051639c09f72 100644
+--- a/drivers/hid/uhid.c
++++ b/drivers/hid/uhid.c
+@@ -12,6 +12,7 @@
+
+ #include <linux/atomic.h>
+ #include <linux/compat.h>
++#include <linux/cred.h>
+ #include <linux/device.h>
+ #include <linux/fs.h>
+ #include <linux/hid.h>
+@@ -722,6 +723,17 @@ static ssize_t uhid_char_write(struct file *file, const char __user *buffer,
+
+ switch (uhid->input_buf.type) {
+ case UHID_CREATE:
++ /*
++ * 'struct uhid_create_req' contains a __user pointer which is
++ * copied from, so it's unsafe to allow this with elevated
++ * privileges (e.g. from a setuid binary) or via kernel_write().
++ */
++ if (file->f_cred != current_cred() || uaccess_kernel()) {
++ pr_err_once("UHID_CREATE from different security context by process %d (%s), this is not allowed.\n",
++ task_tgid_vnr(current), current->comm);
++ ret = -EACCES;
++ goto unlock;
++ }
+ ret = uhid_dev_create(uhid, &uhid->input_buf);
+ break;
+ case UHID_CREATE2:
+diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
+index 83472808c816..64d05edff130 100644
+--- a/drivers/hwmon/ibmpowernv.c
++++ b/drivers/hwmon/ibmpowernv.c
+@@ -181,7 +181,7 @@ static ssize_t show_label(struct device *dev, struct device_attribute *devattr,
+ return sprintf(buf, "%s\n", sdata->label);
+ }
+
+-static int __init get_logical_cpu(int hwcpu)
++static int get_logical_cpu(int hwcpu)
+ {
+ int cpu;
+
+@@ -192,9 +192,8 @@ static int __init get_logical_cpu(int hwcpu)
+ return -ENOENT;
+ }
+
+-static void __init make_sensor_label(struct device_node *np,
+- struct sensor_data *sdata,
+- const char *label)
++static void make_sensor_label(struct device_node *np,
++ struct sensor_data *sdata, const char *label)
+ {
+ u32 id;
+ size_t n;
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index 451d4ae50e66..ac4b09642f63 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -751,7 +751,7 @@ config I2C_OCORES
+
+ config I2C_OMAP
+ tristate "OMAP I2C adapter"
+- depends on ARCH_OMAP
++ depends on ARCH_OMAP || ARCH_K3
+ default y if MACH_OMAP_H3 || MACH_OMAP_OSK
+ help
+ If you say yes to this option, support will be included for the
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index 9f2eb02481d3..d7329177b0ea 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -590,18 +590,19 @@ static int geni_i2c_probe(struct platform_device *pdev)
+
+ dev_dbg(&pdev->dev, "i2c fifo/se-dma mode. fifo depth:%d\n", tx_depth);
+
+- ret = i2c_add_adapter(&gi2c->adap);
+- if (ret) {
+- dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret);
+- return ret;
+- }
+-
+ gi2c->suspended = 1;
+ pm_runtime_set_suspended(gi2c->se.dev);
+ pm_runtime_set_autosuspend_delay(gi2c->se.dev, I2C_AUTO_SUSPEND_DELAY);
+ pm_runtime_use_autosuspend(gi2c->se.dev);
+ pm_runtime_enable(gi2c->se.dev);
+
++ ret = i2c_add_adapter(&gi2c->adap);
++ if (ret) {
++ dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret);
++ pm_runtime_disable(gi2c->se.dev);
++ return ret;
++ }
++
+ return 0;
+ }
+
+@@ -609,8 +610,8 @@ static int geni_i2c_remove(struct platform_device *pdev)
+ {
+ struct geni_i2c_dev *gi2c = platform_get_drvdata(pdev);
+
+- pm_runtime_disable(gi2c->se.dev);
+ i2c_del_adapter(&gi2c->adap);
++ pm_runtime_disable(gi2c->se.dev);
+ return 0;
+ }
+
+diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
+index a3ef1f50a4b3..481e3c65cf97 100644
+--- a/drivers/media/v4l2-core/v4l2-event.c
++++ b/drivers/media/v4l2-core/v4l2-event.c
+@@ -193,6 +193,22 @@ int v4l2_event_pending(struct v4l2_fh *fh)
+ }
+ EXPORT_SYMBOL_GPL(v4l2_event_pending);
+
++static void __v4l2_event_unsubscribe(struct v4l2_subscribed_event *sev)
++{
++ struct v4l2_fh *fh = sev->fh;
++ unsigned int i;
++
++ lockdep_assert_held(&fh->subscribe_lock);
++ assert_spin_locked(&fh->vdev->fh_lock);
++
++ /* Remove any pending events for this subscription */
++ for (i = 0; i < sev->in_use; i++) {
++ list_del(&sev->events[sev_pos(sev, i)].list);
++ fh->navailable--;
++ }
++ list_del(&sev->list);
++}
++
+ int v4l2_event_subscribe(struct v4l2_fh *fh,
+ const struct v4l2_event_subscription *sub, unsigned elems,
+ const struct v4l2_subscribed_event_ops *ops)
+@@ -224,27 +240,23 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
+
+ spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+ found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
++ if (!found_ev)
++ list_add(&sev->list, &fh->subscribed);
+ spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
+
+ if (found_ev) {
+ /* Already listening */
+ kvfree(sev);
+- goto out_unlock;
+- }
+-
+- if (sev->ops && sev->ops->add) {
++ } else if (sev->ops && sev->ops->add) {
+ ret = sev->ops->add(sev, elems);
+ if (ret) {
++ spin_lock_irqsave(&fh->vdev->fh_lock, flags);
++ __v4l2_event_unsubscribe(sev);
++ spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
+ kvfree(sev);
+- goto out_unlock;
+ }
+ }
+
+- spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+- list_add(&sev->list, &fh->subscribed);
+- spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
+-
+-out_unlock:
+ mutex_unlock(&fh->subscribe_lock);
+
+ return ret;
+@@ -279,7 +291,6 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
+ {
+ struct v4l2_subscribed_event *sev;
+ unsigned long flags;
+- int i;
+
+ if (sub->type == V4L2_EVENT_ALL) {
+ v4l2_event_unsubscribe_all(fh);
+@@ -291,14 +302,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
+ spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+
+ sev = v4l2_event_subscribed(fh, sub->type, sub->id);
+- if (sev != NULL) {
+- /* Remove any pending events for this subscription */
+- for (i = 0; i < sev->in_use; i++) {
+- list_del(&sev->events[sev_pos(sev, i)].list);
+- fh->navailable--;
+- }
+- list_del(&sev->list);
+- }
++ if (sev != NULL)
++ __v4l2_event_unsubscribe(sev);
+
+ spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
+
+diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
+index b2a0340f277e..d8e3cc2dc747 100644
+--- a/drivers/misc/atmel-ssc.c
++++ b/drivers/misc/atmel-ssc.c
+@@ -132,7 +132,7 @@ static const struct of_device_id atmel_ssc_dt_ids[] = {
+ MODULE_DEVICE_TABLE(of, atmel_ssc_dt_ids);
+ #endif
+
+-static inline const struct atmel_ssc_platform_data * __init
++static inline const struct atmel_ssc_platform_data *
+ atmel_ssc_get_driver_data(struct platform_device *pdev)
+ {
+ if (pdev->dev.of_node) {
+diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c
+index 313da3150262..1540a7785e14 100644
+--- a/drivers/misc/sgi-gru/grukdump.c
++++ b/drivers/misc/sgi-gru/grukdump.c
+@@ -27,6 +27,9 @@
+ #include <linux/delay.h>
+ #include <linux/bitops.h>
+ #include <asm/uv/uv_hub.h>
++
++#include <linux/nospec.h>
++
+ #include "gru.h"
+ #include "grutables.h"
+ #include "gruhandles.h"
+@@ -196,6 +199,7 @@ int gru_dump_chiplet_request(unsigned long arg)
+ /* Currently, only dump by gid is implemented */
+ if (req.gid >= gru_max_gids)
+ return -EINVAL;
++ req.gid = array_index_nospec(req.gid, gru_max_gids);
+
+ gru = GID_TO_GRU(req.gid);
+ ubuf = req.buf;
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index a594fb1e9a99..32e95af486a2 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -2061,8 +2061,7 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
+ int ret;
+
+ nand_np = dev->of_node;
+- nfc_np = of_find_compatible_node(dev->of_node, NULL,
+- "atmel,sama5d3-nfc");
++ nfc_np = of_get_compatible_child(dev->of_node, "atmel,sama5d3-nfc");
+ if (!nfc_np) {
+ dev_err(dev, "Could not find device node for sama5d3-nfc\n");
+ return -ENODEV;
+@@ -2476,15 +2475,19 @@ static int atmel_nand_controller_probe(struct platform_device *pdev)
+ }
+
+ if (caps->legacy_of_bindings) {
++ struct device_node *nfc_node;
+ u32 ale_offs = 21;
+
+ /*
+ * If we are parsing legacy DT props and the DT contains a
+ * valid NFC node, forward the request to the sama5 logic.
+ */
+- if (of_find_compatible_node(pdev->dev.of_node, NULL,
+- "atmel,sama5d3-nfc"))
++ nfc_node = of_get_compatible_child(pdev->dev.of_node,
++ "atmel,sama5d3-nfc");
++ if (nfc_node) {
+ caps = &atmel_sama5_nand_caps;
++ of_node_put(nfc_node);
++ }
+
+ /*
+ * Even if the compatible says we are dealing with an
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+index b939a4c10b84..c89c7d4900d7 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+@@ -528,7 +528,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ context = &priv->tx_contexts[i];
+
+ context->echo_index = i;
+- can_put_echo_skb(skb, netdev, context->echo_index);
+ ++priv->active_tx_contexts;
+ if (priv->active_tx_contexts >= (int)dev->max_tx_urbs)
+ netif_stop_queue(netdev);
+@@ -553,7 +552,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ dev_kfree_skb(skb);
+ spin_lock_irqsave(&priv->tx_contexts_lock, flags);
+
+- can_free_echo_skb(netdev, context->echo_index);
+ context->echo_index = dev->max_tx_urbs;
+ --priv->active_tx_contexts;
+ netif_wake_queue(netdev);
+@@ -564,6 +562,8 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+
+ context->priv = priv;
+
++ can_put_echo_skb(skb, netdev, context->echo_index);
++
+ usb_fill_bulk_urb(urb, dev->udev,
+ usb_sndbulkpipe(dev->udev,
+ dev->bulk_out->bEndpointAddress),
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index c084bae5ec0a..5fc0be564274 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -1019,6 +1019,11 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv,
+ new_state : CAN_STATE_ERROR_ACTIVE;
+
+ can_change_state(netdev, cf, tx_state, rx_state);
++
++ if (priv->can.restart_ms &&
++ old_state >= CAN_STATE_BUS_OFF &&
++ new_state < CAN_STATE_BUS_OFF)
++ cf->can_id |= CAN_ERR_RESTARTED;
+ }
+
+ if (new_state == CAN_STATE_BUS_OFF) {
+@@ -1028,11 +1033,6 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv,
+
+ can_bus_off(netdev);
+ }
+-
+- if (priv->can.restart_ms &&
+- old_state >= CAN_STATE_BUS_OFF &&
+- new_state < CAN_STATE_BUS_OFF)
+- cf->can_id |= CAN_ERR_RESTARTED;
+ }
+
+ if (!skb) {
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index 26dc6782b475..4f34808f1e06 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -590,7 +590,7 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
+ }
+ }
+
+- if (i > 0 && i < AQ_HW_MULTICAST_ADDRESS_MAX) {
++ if (i > 0 && i <= AQ_HW_MULTICAST_ADDRESS_MAX) {
+ packet_filter |= IFF_MULTICAST;
+ self->mc_list.count = i;
+ self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index d1e1a0ba8615..7134d0d4cdf7 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -172,6 +172,27 @@ bool aq_ring_tx_clean(struct aq_ring_s *self)
+ return !!budget;
+ }
+
++static void aq_rx_checksum(struct aq_ring_s *self,
++ struct aq_ring_buff_s *buff,
++ struct sk_buff *skb)
++{
++ if (!(self->aq_nic->ndev->features & NETIF_F_RXCSUM))
++ return;
++
++ if (unlikely(buff->is_cso_err)) {
++ ++self->stats.rx.errors;
++ skb->ip_summed = CHECKSUM_NONE;
++ return;
++ }
++ if (buff->is_ip_cso) {
++ __skb_incr_checksum_unnecessary(skb);
++ if (buff->is_udp_cso || buff->is_tcp_cso)
++ __skb_incr_checksum_unnecessary(skb);
++ } else {
++ skb->ip_summed = CHECKSUM_NONE;
++ }
++}
++
+ #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
+ int aq_ring_rx_clean(struct aq_ring_s *self,
+ struct napi_struct *napi,
+@@ -267,18 +288,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ }
+
+ skb->protocol = eth_type_trans(skb, ndev);
+- if (unlikely(buff->is_cso_err)) {
+- ++self->stats.rx.errors;
+- skb->ip_summed = CHECKSUM_NONE;
+- } else {
+- if (buff->is_ip_cso) {
+- __skb_incr_checksum_unnecessary(skb);
+- if (buff->is_udp_cso || buff->is_tcp_cso)
+- __skb_incr_checksum_unnecessary(skb);
+- } else {
+- skb->ip_summed = CHECKSUM_NONE;
+- }
+- }
++
++ aq_rx_checksum(self, buff, skb);
+
+ skb_set_hash(skb, buff->rss_hash,
+ buff->is_hash_l4 ? PKT_HASH_TYPE_L4 :
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 1d44a386e7d3..88705dee5b95 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -655,9 +655,9 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
+ struct hw_atl_rxd_wb_s *rxd_wb = (struct hw_atl_rxd_wb_s *)
+ &ring->dx_ring[ring->hw_head * HW_ATL_B0_RXD_SIZE];
+
+- unsigned int is_err = 1U;
+ unsigned int is_rx_check_sum_enabled = 0U;
+ unsigned int pkt_type = 0U;
++ u8 rx_stat = 0U;
+
+ if (!(rxd_wb->status & 0x1U)) { /* RxD is not done */
+ break;
+@@ -665,35 +665,35 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
+
+ buff = &ring->buff_ring[ring->hw_head];
+
+- is_err = (0x0000003CU & rxd_wb->status);
++ rx_stat = (0x0000003CU & rxd_wb->status) >> 2;
+
+ is_rx_check_sum_enabled = (rxd_wb->type) & (0x3U << 19);
+- is_err &= ~0x20U; /* exclude validity bit */
+
+ pkt_type = 0xFFU & (rxd_wb->type >> 4);
+
+- if (is_rx_check_sum_enabled) {
+- if (0x0U == (pkt_type & 0x3U))
+- buff->is_ip_cso = (is_err & 0x08U) ? 0U : 1U;
++ if (is_rx_check_sum_enabled & BIT(0) &&
++ (0x0U == (pkt_type & 0x3U)))
++ buff->is_ip_cso = (rx_stat & BIT(1)) ? 0U : 1U;
+
++ if (is_rx_check_sum_enabled & BIT(1)) {
+ if (0x4U == (pkt_type & 0x1CU))
+- buff->is_udp_cso = buff->is_cso_err ? 0U : 1U;
++ buff->is_udp_cso = (rx_stat & BIT(2)) ? 0U :
++ !!(rx_stat & BIT(3));
+ else if (0x0U == (pkt_type & 0x1CU))
+- buff->is_tcp_cso = buff->is_cso_err ? 0U : 1U;
+-
+- /* Checksum offload workaround for small packets */
+- if (rxd_wb->pkt_len <= 60) {
+- buff->is_ip_cso = 0U;
+- buff->is_cso_err = 0U;
+- }
++ buff->is_tcp_cso = (rx_stat & BIT(2)) ? 0U :
++ !!(rx_stat & BIT(3));
++ }
++ buff->is_cso_err = !!(rx_stat & 0x6);
++ /* Checksum offload workaround for small packets */
++ if (unlikely(rxd_wb->pkt_len <= 60)) {
++ buff->is_ip_cso = 0U;
++ buff->is_cso_err = 0U;
+ }
+-
+- is_err &= ~0x18U;
+
+ dma_unmap_page(ndev, buff->pa, buff->len, DMA_FROM_DEVICE);
+
+- if (is_err || rxd_wb->type & 0x1000U) {
+- /* status error or DMA error */
++ if ((rx_stat & BIT(0)) || rxd_wb->type & 0x1000U) {
++ /* MAC error or DMA error */
+ buff->is_error = 1U;
+ } else {
+ if (self->aq_nic_cfg->is_rss) {
+@@ -915,6 +915,12 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self)
+ static int hw_atl_b0_hw_stop(struct aq_hw_s *self)
+ {
+ hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK);
++
++ /* Invalidate Descriptor Cache to prevent writing to the cached
++ * descriptors and to the data pointer of those descriptors
++ */
++ hw_atl_rdm_rx_dma_desc_cache_init_set(self, 1);
++
+ return aq_hw_err_from_flags(self);
+ }
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+index 10ba035dadb1..10ec5dc88e24 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+@@ -619,6 +619,14 @@ void hw_atl_rpb_rx_flow_ctl_mode_set(struct aq_hw_s *aq_hw, u32 rx_flow_ctl_mode
+ HW_ATL_RPB_RX_FC_MODE_SHIFT, rx_flow_ctl_mode);
+ }
+
++void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init)
++{
++ aq_hw_write_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR,
++ HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK,
++ HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT,
++ init);
++}
++
+ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw,
+ u32 rx_pkt_buff_size_per_tc, u32 buffer)
+ {
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+index dfb426f2dc2c..b3bf64b48b93 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+@@ -325,6 +325,9 @@ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw,
+ u32 rx_pkt_buff_size_per_tc,
+ u32 buffer);
+
++/* set rdm rx dma descriptor cache init */
++void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init);
++
+ /* set rx xoff enable (per tc) */
+ void hw_atl_rpb_rx_xoff_en_per_tc_set(struct aq_hw_s *aq_hw, u32 rx_xoff_en_per_tc,
+ u32 buffer);
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+index e0cf70120f1d..e2ecdb1c5a5c 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+@@ -293,6 +293,24 @@
+ /* default value of bitfield desc{d}_reset */
+ #define HW_ATL_RDM_DESCDRESET_DEFAULT 0x0
+
++/* rdm_desc_init_i bitfield definitions
++ * preprocessor definitions for the bitfield rdm_desc_init_i.
++ * port="pif_rdm_desc_init_i"
++ */
++
++/* register address for bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR 0x00005a00
++/* bitmask for bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK 0xffffffff
++/* inverted bitmask for bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSKN 0x00000000
++/* lower bit position of bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT 0
++/* width of bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_WIDTH 32
++/* default value of bitfield rdm_desc_init_i */
++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_DEFAULT 0x0
++
+ /* rx int_desc_wrb_en bitfield definitions
+ * preprocessor definitions for the bitfield "int_desc_wrb_en".
+ * port="pif_rdm_int_desc_wrb_en_i"
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+index ac13cb2b168e..68026a5ad7e7 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+@@ -304,6 +304,10 @@ int hclge_cmd_queue_init(struct hclge_dev *hdev)
+ {
+ int ret;
+
++ /* Setup the lock for command queue */
++ spin_lock_init(&hdev->hw.cmq.csq.lock);
++ spin_lock_init(&hdev->hw.cmq.crq.lock);
++
+ /* Setup the queue entries for use cmd queue */
+ hdev->hw.cmq.csq.desc_num = HCLGE_NIC_CMQ_DESC_NUM;
+ hdev->hw.cmq.crq.desc_num = HCLGE_NIC_CMQ_DESC_NUM;
+@@ -337,18 +341,20 @@ int hclge_cmd_init(struct hclge_dev *hdev)
+ u32 version;
+ int ret;
+
++ spin_lock_bh(&hdev->hw.cmq.csq.lock);
++ spin_lock_bh(&hdev->hw.cmq.crq.lock);
++
+ hdev->hw.cmq.csq.next_to_clean = 0;
+ hdev->hw.cmq.csq.next_to_use = 0;
+ hdev->hw.cmq.crq.next_to_clean = 0;
+ hdev->hw.cmq.crq.next_to_use = 0;
+
+- /* Setup the lock for command queue */
+- spin_lock_init(&hdev->hw.cmq.csq.lock);
+- spin_lock_init(&hdev->hw.cmq.crq.lock);
+-
+ hclge_cmd_init_regs(&hdev->hw);
+ clear_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state);
+
++ spin_unlock_bh(&hdev->hw.cmq.crq.lock);
++ spin_unlock_bh(&hdev->hw.cmq.csq.lock);
++
+ ret = hclge_cmd_query_firmware_version(&hdev->hw, &version);
+ if (ret) {
+ dev_err(&hdev->pdev->dev,
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index db763450e5e3..340baf6a470c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2804,14 +2804,17 @@ static void hclge_reset(struct hclge_dev *hdev)
+ handle = &hdev->vport[0].nic;
+ rtnl_lock();
+ hclge_notify_client(hdev, HNAE3_DOWN_CLIENT);
++ rtnl_unlock();
+
+ if (!hclge_reset_wait(hdev)) {
++ rtnl_lock();
+ hclge_notify_client(hdev, HNAE3_UNINIT_CLIENT);
+ hclge_reset_ae_dev(hdev->ae_dev);
+ hclge_notify_client(hdev, HNAE3_INIT_CLIENT);
+
+ hclge_clear_reset_cause(hdev);
+ } else {
++ rtnl_lock();
+ /* schedule again to check pending resets later */
+ set_bit(hdev->reset_type, &hdev->reset_pending);
+ hclge_reset_task_schedule(hdev);
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+index f34851c91eb3..e08e82020402 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+@@ -458,6 +458,12 @@ void hclge_mbx_handler(struct hclge_dev *hdev)
+
+ /* handle all the mailbox requests in the queue */
+ while (!hclge_cmd_crq_empty(&hdev->hw)) {
++ if (test_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state)) {
++ dev_warn(&hdev->pdev->dev,
++ "command queue needs re-initializing\n");
++ return;
++ }
++
+ desc = &crq->desc[crq->next_to_use];
+ req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data;
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 5db70a1451c5..48235dc2dd56 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -1167,14 +1167,14 @@ static int hclge_pfc_setup_hw(struct hclge_dev *hdev)
+ */
+ static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc)
+ {
+- struct hclge_vport *vport = hdev->vport;
+- u32 i, k, qs_bitmap;
+- int ret;
++ int i;
+
+ for (i = 0; i < HCLGE_BP_GRP_NUM; i++) {
+- qs_bitmap = 0;
++ u32 qs_bitmap = 0;
++ int k, ret;
+
+ for (k = 0; k < hdev->num_alloc_vport; k++) {
++ struct hclge_vport *vport = &hdev->vport[k];
+ u16 qs_id = vport->qs_offset + tc;
+ u8 grp, sub_grp;
+
+@@ -1184,8 +1184,6 @@ static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc)
+ HCLGE_BP_SUB_GRP_ID_S);
+ if (i == grp)
+ qs_bitmap |= (1 << sub_grp);
+-
+- vport++;
+ }
+
+ ret = hclge_tm_qs_bp_cfg(hdev, tc, i, qs_bitmap);
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 320043e87fc6..5570fb5dc2eb 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1065,6 +1065,8 @@ static int hclgevf_reset(struct hclgevf_dev *hdev)
+ /* bring down the nic to stop any ongoing TX/RX */
+ hclgevf_notify_client(hdev, HNAE3_DOWN_CLIENT);
+
++ rtnl_unlock();
++
+ /* check if VF could successfully fetch the hardware reset completion
+ * status from the hardware
+ */
+@@ -1076,12 +1078,15 @@ static int hclgevf_reset(struct hclgevf_dev *hdev)
+ ret);
+
+ dev_warn(&hdev->pdev->dev, "VF reset failed, disabling VF!\n");
++ rtnl_lock();
+ hclgevf_notify_client(hdev, HNAE3_UNINIT_CLIENT);
+
+ rtnl_unlock();
+ return ret;
+ }
+
++ rtnl_lock();
++
+ /* now, re-initialize the nic client and ae device*/
+ ret = hclgevf_reset_stack(hdev);
+ if (ret)
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index ac685ad4d877..6eccfa82ca94 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -11926,6 +11926,8 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
+ NETIF_F_GSO_GRE |
+ NETIF_F_GSO_GRE_CSUM |
+ NETIF_F_GSO_PARTIAL |
++ NETIF_F_GSO_IPXIP4 |
++ NETIF_F_GSO_IPXIP6 |
+ NETIF_F_GSO_UDP_TUNNEL |
+ NETIF_F_GSO_UDP_TUNNEL_CSUM |
+ NETIF_F_SCTP_CRC |
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index 9d6754f65a1a..4c5c87b158f5 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -797,10 +797,15 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause)
+ }
+
+ if (!test_bit(__ICE_DOWN, pf->state)) {
+- /* Give it a little more time to try to come back */
++ /* Give it a little more time to try to come back. If still
++ * down, restart autoneg link or reinitialize the interface.
++ */
+ msleep(75);
+ if (!test_bit(__ICE_DOWN, pf->state))
+ return ice_nway_reset(netdev);
++
++ ice_down(vsi);
++ ice_up(vsi);
+ }
+
+ return err;
+diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
+index 6481e3d86374..0c95c8f83432 100644
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
+@@ -1519,7 +1519,7 @@ int ice_tso(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
+
+ /* update gso_segs and bytecount */
+ first->gso_segs = skb_shinfo(skb)->gso_segs;
+- first->bytecount = (first->gso_segs - 1) * off->header_len;
++ first->bytecount += (first->gso_segs - 1) * off->header_len;
+
+ cd_tso_len = skb->len - off->header_len;
+ cd_mss = skb_shinfo(skb)->gso_size;
+diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h
+index 97c366e0ca59..ba11b5898833 100644
+--- a/drivers/net/ethernet/intel/ice/ice_type.h
++++ b/drivers/net/ethernet/intel/ice/ice_type.h
+@@ -83,12 +83,12 @@ struct ice_link_status {
+ u64 phy_type_low;
+ u16 max_frame_size;
+ u16 link_speed;
++ u16 req_speeds;
+ u8 lse_ena; /* Link Status Event notification */
+ u8 link_info;
+ u8 an_info;
+ u8 ext_info;
+ u8 pacing;
+- u8 req_speeds;
+ /* Refer to #define from module_type[ICE_MODULE_TYPE_TOTAL_BYTE] of
+ * ice_aqc_get_phy_caps structure
+ */
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+index 3c6f01c41b78..eea63a99f29c 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+@@ -721,8 +721,10 @@ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
+ ixgbe_set_vmvir(adapter, vfinfo->pf_vlan,
+ adapter->default_up, vf);
+
+- if (vfinfo->spoofchk_enabled)
++ if (vfinfo->spoofchk_enabled) {
+ hw->mac.ops.set_vlan_anti_spoofing(hw, true, vf);
++ hw->mac.ops.set_mac_anti_spoofing(hw, true, vf);
++ }
+ }
+
+ /* reset multicast table array for vf */
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
+index cc1b373c0ace..46dc93d3b9b5 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
+@@ -147,7 +147,8 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
+ "Cannot satisfy CQ amount. CQs requested %d, CQs available %d. Aborting function start\n",
+ fcoe_pf_params->num_cqs,
+ p_hwfn->hw_info.feat_num[QED_FCOE_CQ]);
+- return -EINVAL;
++ rc = -EINVAL;
++ goto err;
+ }
+
+ p_data->mtu = cpu_to_le16(fcoe_pf_params->mtu);
+@@ -156,14 +157,14 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
+
+ rc = qed_cxt_acquire_cid(p_hwfn, PROTOCOLID_FCOE, &dummy_cid);
+ if (rc)
+- return rc;
++ goto err;
+
+ cxt_info.iid = dummy_cid;
+ rc = qed_cxt_get_cid_info(p_hwfn, &cxt_info);
+ if (rc) {
+ DP_NOTICE(p_hwfn, "Cannot find context info for dummy cid=%d\n",
+ dummy_cid);
+- return rc;
++ goto err;
+ }
+ p_cxt = cxt_info.p_cxt;
+ SET_FIELD(p_cxt->tstorm_ag_context.flags3,
+@@ -240,6 +241,10 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
+ rc = qed_spq_post(p_hwfn, p_ent, NULL);
+
+ return rc;
++
++err:
++ qed_sp_destroy_request(p_hwfn, p_ent);
++ return rc;
+ }
+
+ static int
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
+index 1135387bd99d..4f8a685d1a55 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
+@@ -200,6 +200,7 @@ qed_sp_iscsi_func_start(struct qed_hwfn *p_hwfn,
+ "Cannot satisfy CQ amount. Queues requested %d, CQs available %d. Aborting function start\n",
+ p_params->num_queues,
+ p_hwfn->hw_info.feat_num[QED_ISCSI_CQ]);
++ qed_sp_destroy_request(p_hwfn, p_ent);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+index 82a1bd1f8a8c..67c02ea93906 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -740,8 +740,7 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
+
+ rc = qed_sp_vport_update_rss(p_hwfn, p_ramrod, p_rss_params);
+ if (rc) {
+- /* Return spq entry which is taken in qed_sp_init_request()*/
+- qed_spq_return_entry(p_hwfn, p_ent);
++ qed_sp_destroy_request(p_hwfn, p_ent);
+ return rc;
+ }
+
+@@ -1355,6 +1354,7 @@ qed_filter_ucast_common(struct qed_hwfn *p_hwfn,
+ DP_NOTICE(p_hwfn,
+ "%d is not supported yet\n",
+ p_filter_cmd->opcode);
++ qed_sp_destroy_request(p_hwfn, *pp_ent);
+ return -EINVAL;
+ }
+
+@@ -2056,13 +2056,13 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn,
+ } else {
+ rc = qed_fw_vport(p_hwfn, p_params->vport_id, &abs_vport_id);
+ if (rc)
+- return rc;
++ goto err;
+
+ if (p_params->qid != QED_RFS_NTUPLE_QID_RSS) {
+ rc = qed_fw_l2_queue(p_hwfn, p_params->qid,
+ &abs_rx_q_id);
+ if (rc)
+- return rc;
++ goto err;
+
+ p_ramrod->rx_qid_valid = 1;
+ p_ramrod->rx_qid = cpu_to_le16(abs_rx_q_id);
+@@ -2083,6 +2083,10 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn,
+ (u64)p_params->addr, p_params->length);
+
+ return qed_spq_post(p_hwfn, p_ent, NULL);
++
++err:
++ qed_sp_destroy_request(p_hwfn, p_ent);
++ return rc;
+ }
+
+ int qed_get_rxq_coalesce(struct qed_hwfn *p_hwfn,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index c71391b9c757..62113438c880 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -1514,6 +1514,7 @@ qed_rdma_register_tid(void *rdma_cxt,
+ default:
+ rc = -EINVAL;
+ DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "rc = %d\n", rc);
++ qed_sp_destroy_request(p_hwfn, p_ent);
+ return rc;
+ }
+ SET_FIELD(p_ramrod->flags1,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
+index f9167d1354bb..e49fada85410 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
+@@ -745,6 +745,7 @@ static int qed_roce_sp_destroy_qp_responder(struct qed_hwfn *p_hwfn,
+ DP_NOTICE(p_hwfn,
+ "qed destroy responder failed: cannot allocate memory (ramrod). rc = %d\n",
+ rc);
++ qed_sp_destroy_request(p_hwfn, p_ent);
+ return rc;
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+index e95431f6acd4..3157c0d99441 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+@@ -167,6 +167,9 @@ struct qed_spq_entry {
+ enum spq_mode comp_mode;
+ struct qed_spq_comp_cb comp_cb;
+ struct qed_spq_comp_done comp_done; /* SPQ_MODE_EBLOCK */
++
++ /* Posted entry for unlimited list entry in EBLOCK mode */
++ struct qed_spq_entry *post_ent;
+ };
+
+ struct qed_eq {
+@@ -396,6 +399,17 @@ struct qed_sp_init_data {
+ struct qed_spq_comp_cb *p_comp_data;
+ };
+
++/**
++ * @brief Returns a SPQ entry to the pool / frees the entry if allocated.
++ * Should be called on in error flows after initializing the SPQ entry
++ * and before posting it.
++ *
++ * @param p_hwfn
++ * @param p_ent
++ */
++void qed_sp_destroy_request(struct qed_hwfn *p_hwfn,
++ struct qed_spq_entry *p_ent);
++
+ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ struct qed_spq_entry **pp_ent,
+ u8 cmd,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+index 77b6248ad3b9..888274fa208b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+@@ -47,6 +47,19 @@
+ #include "qed_sp.h"
+ #include "qed_sriov.h"
+
++void qed_sp_destroy_request(struct qed_hwfn *p_hwfn,
++ struct qed_spq_entry *p_ent)
++{
++ /* qed_spq_get_entry() can either get an entry from the free_pool,
++ * or, if no entries are left, allocate a new entry and add it to
++ * the unlimited_pending list.
++ */
++ if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending)
++ kfree(p_ent);
++ else
++ qed_spq_return_entry(p_hwfn, p_ent);
++}
++
+ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ struct qed_spq_entry **pp_ent,
+ u8 cmd, u8 protocol, struct qed_sp_init_data *p_data)
+@@ -80,7 +93,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+
+ case QED_SPQ_MODE_BLOCK:
+ if (!p_data->p_comp_data)
+- return -EINVAL;
++ goto err;
+
+ p_ent->comp_cb.cookie = p_data->p_comp_data->cookie;
+ break;
+@@ -95,7 +108,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ default:
+ DP_NOTICE(p_hwfn, "Unknown SPQE completion mode %d\n",
+ p_ent->comp_mode);
+- return -EINVAL;
++ goto err;
+ }
+
+ DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
+@@ -109,6 +122,11 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
+ memset(&p_ent->ramrod, 0, sizeof(p_ent->ramrod));
+
+ return 0;
++
++err:
++ qed_sp_destroy_request(p_hwfn, p_ent);
++
++ return -EINVAL;
+ }
+
+ static enum tunnel_clss qed_tunn_clss_to_fw_clss(u8 type)
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+index 1673fc90027f..7106ad17afe2 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+@@ -142,6 +142,7 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn,
+
+ DP_INFO(p_hwfn, "Ramrod is stuck, requesting MCP drain\n");
+ rc = qed_mcp_drain(p_hwfn, p_ptt);
++ qed_ptt_release(p_hwfn, p_ptt);
+ if (rc) {
+ DP_NOTICE(p_hwfn, "MCP drain failed\n");
+ goto err;
+@@ -150,18 +151,15 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn,
+ /* Retry after drain */
+ rc = __qed_spq_block(p_hwfn, p_ent, p_fw_ret, true);
+ if (!rc)
+- goto out;
++ return 0;
+
+ comp_done = (struct qed_spq_comp_done *)p_ent->comp_cb.cookie;
+- if (comp_done->done == 1)
++ if (comp_done->done == 1) {
+ if (p_fw_ret)
+ *p_fw_ret = comp_done->fw_return_code;
+-out:
+- qed_ptt_release(p_hwfn, p_ptt);
+- return 0;
+-
++ return 0;
++ }
+ err:
+- qed_ptt_release(p_hwfn, p_ptt);
+ DP_NOTICE(p_hwfn,
+ "Ramrod is stuck [CID %08x cmd %02x protocol %02x echo %04x]\n",
+ le32_to_cpu(p_ent->elem.hdr.cid),
+@@ -685,6 +683,8 @@ static int qed_spq_add_entry(struct qed_hwfn *p_hwfn,
+ /* EBLOCK responsible to free the allocated p_ent */
+ if (p_ent->comp_mode != QED_SPQ_MODE_EBLOCK)
+ kfree(p_ent);
++ else
++ p_ent->post_ent = p_en2;
+
+ p_ent = p_en2;
+ }
+@@ -768,6 +768,25 @@ static int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
+ SPQ_HIGH_PRI_RESERVE_DEFAULT);
+ }
+
++/* Avoid overriding of SPQ entries when getting out-of-order completions, by
++ * marking the completions in a bitmap and increasing the chain consumer only
++ * for the first successive completed entries.
++ */
++static void qed_spq_comp_bmap_update(struct qed_hwfn *p_hwfn, __le16 echo)
++{
++ u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE;
++ struct qed_spq *p_spq = p_hwfn->p_spq;
++
++ __set_bit(pos, p_spq->p_comp_bitmap);
++ while (test_bit(p_spq->comp_bitmap_idx,
++ p_spq->p_comp_bitmap)) {
++ __clear_bit(p_spq->comp_bitmap_idx,
++ p_spq->p_comp_bitmap);
++ p_spq->comp_bitmap_idx++;
++ qed_chain_return_produced(&p_spq->chain);
++ }
++}
++
+ int qed_spq_post(struct qed_hwfn *p_hwfn,
+ struct qed_spq_entry *p_ent, u8 *fw_return_code)
+ {
+@@ -825,11 +844,12 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
+ p_ent->queue == &p_spq->unlimited_pending);
+
+ if (p_ent->queue == &p_spq->unlimited_pending) {
+- /* This is an allocated p_ent which does not need to
+- * return to pool.
+- */
++ struct qed_spq_entry *p_post_ent = p_ent->post_ent;
++
+ kfree(p_ent);
+- return rc;
++
++ /* Return the entry which was actually posted */
++ p_ent = p_post_ent;
+ }
+
+ if (rc)
+@@ -843,7 +863,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
+ spq_post_fail2:
+ spin_lock_bh(&p_spq->lock);
+ list_del(&p_ent->list);
+- qed_chain_return_produced(&p_spq->chain);
++ qed_spq_comp_bmap_update(p_hwfn, p_ent->elem.hdr.echo);
+
+ spq_post_fail:
+ /* return to the free pool */
+@@ -875,25 +895,8 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
+ spin_lock_bh(&p_spq->lock);
+ list_for_each_entry_safe(p_ent, tmp, &p_spq->completion_pending, list) {
+ if (p_ent->elem.hdr.echo == echo) {
+- u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE;
+-
+ list_del(&p_ent->list);
+-
+- /* Avoid overriding of SPQ entries when getting
+- * out-of-order completions, by marking the completions
+- * in a bitmap and increasing the chain consumer only
+- * for the first successive completed entries.
+- */
+- __set_bit(pos, p_spq->p_comp_bitmap);
+-
+- while (test_bit(p_spq->comp_bitmap_idx,
+- p_spq->p_comp_bitmap)) {
+- __clear_bit(p_spq->comp_bitmap_idx,
+- p_spq->p_comp_bitmap);
+- p_spq->comp_bitmap_idx++;
+- qed_chain_return_produced(&p_spq->chain);
+- }
+-
++ qed_spq_comp_bmap_update(p_hwfn, echo);
+ p_spq->comp_count++;
+ found = p_ent;
+ break;
+@@ -932,11 +935,9 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
+ QED_MSG_SPQ,
+ "Got a completion without a callback function\n");
+
+- if ((found->comp_mode != QED_SPQ_MODE_EBLOCK) ||
+- (found->queue == &p_spq->unlimited_pending))
++ if (found->comp_mode != QED_SPQ_MODE_EBLOCK)
+ /* EBLOCK is responsible for returning its own entry into the
+- * free list, unless it originally added the entry into the
+- * unlimited pending list.
++ * free list.
+ */
+ qed_spq_return_entry(p_hwfn, found);
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+index 9b08a9d9e151..ca6290fa0f30 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+@@ -101,6 +101,7 @@ static int qed_sp_vf_start(struct qed_hwfn *p_hwfn, struct qed_vf_info *p_vf)
+ default:
+ DP_NOTICE(p_hwfn, "Unknown VF personality %d\n",
+ p_hwfn->hw_info.personality);
++ qed_sp_destroy_request(p_hwfn, p_ent);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
+index b1b305f8f414..272b9ca66314 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -365,7 +365,8 @@ struct dma_features {
+
+ /* GMAC TX FIFO is 8K, Rx FIFO is 16K */
+ #define BUF_SIZE_16KiB 16384
+-#define BUF_SIZE_8KiB 8192
++/* RX Buffer size must be < 8191 and multiple of 4/8/16 bytes */
++#define BUF_SIZE_8KiB 8188
+ #define BUF_SIZE_4KiB 4096
+ #define BUF_SIZE_2KiB 2048
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+index ca9d7e48034c..40d6356a7e73 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
++++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+@@ -31,7 +31,7 @@
+ /* Enhanced descriptors */
+ static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end)
+ {
+- p->des1 |= cpu_to_le32(((BUF_SIZE_8KiB - 1)
++ p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
+ << ERDES1_BUFFER2_SIZE_SHIFT)
+ & ERDES1_BUFFER2_SIZE_MASK);
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+index 77914c89d749..5ef91a790f9d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+@@ -262,7 +262,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
+ int mode, int end)
+ {
+ p->des0 |= cpu_to_le32(RDES0_OWN);
+- p->des1 |= cpu_to_le32((BUF_SIZE_8KiB - 1) & ERDES1_BUFFER1_SIZE_MASK);
++ p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK);
+
+ if (mode == STMMAC_CHAIN_MODE)
+ ehn_desc_rx_set_on_chain(p);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+index a7ffc73fffe8..bc83ced94e1b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
++++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+@@ -140,7 +140,7 @@ static void clean_desc3(void *priv_ptr, struct dma_desc *p)
+ static int set_16kib_bfsize(int mtu)
+ {
+ int ret = 0;
+- if (unlikely(mtu >= BUF_SIZE_8KiB))
++ if (unlikely(mtu > BUF_SIZE_8KiB))
+ ret = BUF_SIZE_16KiB;
+ return ret;
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+index 5da7bfbe907f..14e8c575f6c3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+@@ -757,10 +757,10 @@ __mt76x0_phy_set_channel(struct mt76x0_dev *dev,
+ /* Vendor driver don't do it */
+ /* mt76x0_phy_set_tx_power(dev, channel, rf_bw_band); */
+
++ mt76x0_vco_cal(dev, channel);
+ if (scan)
+- mt76x0_vco_cal(dev, channel);
++ mt76x0_mcu_calibrate(dev, MCU_CAL_RXDCOC, 1);
+
+- mt76x0_mcu_calibrate(dev, MCU_CAL_RXDCOC, 1);
+ mt76x0_phy_set_chan_pwr(dev, channel);
+
+ dev->mt76.chandef = *chandef;
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 6bb9908bf46f..0ba301f7e8b4 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1519,8 +1519,10 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
+ if (ns->ndev)
+ nvme_nvm_update_nvm_info(ns);
+ #ifdef CONFIG_NVME_MULTIPATH
+- if (ns->head->disk)
++ if (ns->head->disk) {
+ nvme_update_disk_info(ns->head->disk, ns, id);
++ blk_queue_stack_limits(ns->head->disk->queue, ns->queue);
++ }
+ #endif
+ }
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index b71c9ad1bf45..c27af277e14e 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -257,6 +257,7 @@ int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl, struct nvme_ns_head *head)
+ blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
+ /* set to a default value for 512 until disk is validated */
+ blk_queue_logical_block_size(q, 512);
++ blk_set_stacking_limits(&q->limits);
+
+ /* we need to propagate up the VMC settings */
+ if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index 5957cd4fa262..40b9051a7fce 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -149,9 +149,11 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
+ * set by the driver.
+ */
+ mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1);
+- dev->bus_dma_mask = mask;
+ dev->coherent_dma_mask &= mask;
+ *dev->dma_mask &= mask;
++ /* ...but only set bus mask if we found valid dma-ranges earlier */
++ if (!ret)
++ dev->bus_dma_mask = mask;
+
+ coherent = of_dma_is_coherent(np);
+ dev_dbg(dev, "device is%sdma coherent\n",
+diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
+index ea22591ee66f..53dfe67807e3 100644
+--- a/drivers/platform/x86/acerhdf.c
++++ b/drivers/platform/x86/acerhdf.c
+@@ -233,6 +233,7 @@ static const struct bios_settings bios_tbl[] = {
+ {"Gateway", "LT31", "v1.3201", 0x55, 0x58, {0x9e, 0x00}, 0},
+ {"Gateway", "LT31", "v1.3302", 0x55, 0x58, {0x9e, 0x00}, 0},
+ {"Gateway", "LT31", "v1.3303t", 0x55, 0x58, {0x9e, 0x00}, 0},
++ {"Gateway", "LT31", "v1.3307", 0x55, 0x58, {0x9e, 0x00}, 0},
+ /* Packard Bell */
+ {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00}, 0},
+ {"Packard Bell", "DOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00}, 0},
+diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c
+index ffd0474b0531..1423fa8710fd 100644
+--- a/drivers/platform/x86/intel_telemetry_debugfs.c
++++ b/drivers/platform/x86/intel_telemetry_debugfs.c
+@@ -951,12 +951,16 @@ static int __init telemetry_debugfs_init(void)
+ debugfs_conf = (struct telemetry_debugfs_conf *)id->driver_data;
+
+ err = telemetry_pltconfig_valid();
+- if (err < 0)
++ if (err < 0) {
++ pr_info("Invalid pltconfig, ensure IPC1 device is enabled in BIOS\n");
+ return -ENODEV;
++ }
+
+ err = telemetry_debugfs_check_evts();
+- if (err < 0)
++ if (err < 0) {
++ pr_info("telemetry_debugfs_check_evts failed\n");
+ return -EINVAL;
++ }
+
+ register_pm_notifier(&pm_notifier);
+
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index 34e0d476c5c6..970654fcc48d 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -826,6 +826,11 @@ struct qeth_trap_id {
+ /*some helper functions*/
+ #define QETH_CARD_IFNAME(card) (((card)->dev)? (card)->dev->name : "")
+
++static inline bool qeth_netdev_is_registered(struct net_device *dev)
++{
++ return dev->netdev_ops != NULL;
++}
++
+ static inline void qeth_scrub_qdio_buffer(struct qdio_buffer *buf,
+ unsigned int elements)
+ {
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index b5e38531733f..76b2fba5fba2 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -854,7 +854,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
+
+ if (cgdev->state == CCWGROUP_ONLINE)
+ qeth_l2_set_offline(cgdev);
+- unregister_netdev(card->dev);
++ if (qeth_netdev_is_registered(card->dev))
++ unregister_netdev(card->dev);
+ }
+
+ static const struct ethtool_ops qeth_l2_ethtool_ops = {
+@@ -894,7 +895,7 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
+ {
+ int rc;
+
+- if (card->dev->netdev_ops)
++ if (qeth_netdev_is_registered(card->dev))
+ return 0;
+
+ card->dev->priv_flags |= IFF_UNICAST_FLT;
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index ada258c01a08..b7f6a8384543 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -279,9 +279,6 @@ static void qeth_l3_clear_ip_htable(struct qeth_card *card, int recover)
+
+ QETH_CARD_TEXT(card, 4, "clearip");
+
+- if (recover && card->options.sniffer)
+- return;
+-
+ spin_lock_bh(&card->ip_lock);
+
+ hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) {
+@@ -664,6 +661,8 @@ static int qeth_l3_register_addr_entry(struct qeth_card *card,
+ int rc = 0;
+ int cnt = 3;
+
++ if (card->options.sniffer)
++ return 0;
+
+ if (addr->proto == QETH_PROT_IPV4) {
+ QETH_CARD_TEXT(card, 2, "setaddr4");
+@@ -698,6 +697,9 @@ static int qeth_l3_deregister_addr_entry(struct qeth_card *card,
+ {
+ int rc = 0;
+
++ if (card->options.sniffer)
++ return 0;
++
+ if (addr->proto == QETH_PROT_IPV4) {
+ QETH_CARD_TEXT(card, 2, "deladdr4");
+ QETH_CARD_HEX(card, 3, &addr->u.a4.addr, sizeof(int));
+@@ -2512,7 +2514,7 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
+ {
+ int rc;
+
+- if (card->dev->netdev_ops)
++ if (qeth_netdev_is_registered(card->dev))
+ return 0;
+
+ if (card->info.type == QETH_CARD_TYPE_OSD ||
+@@ -2609,7 +2611,8 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
+ if (cgdev->state == CCWGROUP_ONLINE)
+ qeth_l3_set_offline(cgdev);
+
+- unregister_netdev(card->dev);
++ if (qeth_netdev_is_registered(card->dev))
++ unregister_netdev(card->dev);
+ qeth_l3_clear_ip_htable(card, 0);
+ qeth_l3_clear_ipato_list(card);
+ }
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 3649b83ef863..effba6ce0caa 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1614,10 +1614,10 @@ static void sci_request_dma(struct uart_port *port)
+ hrtimer_init(&s->rx_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ s->rx_timer.function = rx_timer_fn;
+
++ s->chan_rx_saved = s->chan_rx = chan;
++
+ if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
+ sci_submit_rx(s);
+-
+- s->chan_rx_saved = s->chan_rx = chan;
+ }
+ }
+
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index 9916edda5271..2762148c169d 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -959,6 +959,8 @@ int __uio_register_device(struct module *owner,
+ if (ret)
+ goto err_uio_dev_add_attributes;
+
++ info->uio_dev = idev;
++
+ if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
+ /*
+ * Note that we deliberately don't use devm_request_irq
+@@ -970,11 +972,12 @@ int __uio_register_device(struct module *owner,
+ */
+ ret = request_irq(info->irq, uio_interrupt,
+ info->irq_flags, info->name, idev);
+- if (ret)
++ if (ret) {
++ info->uio_dev = NULL;
+ goto err_request_irq;
++ }
+ }
+
+- info->uio_dev = idev;
+ return 0;
+
+ err_request_irq:
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 9ede35cecb12..40c64c7ab5e4 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1711,6 +1711,9 @@ static const struct usb_device_id acm_ids[] = {
+ { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ },
++ { USB_DEVICE(0x0572, 0x1349), /* Hiro (Conexant) USB MODEM H50228 */
++ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
++ },
+ { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */
+ .driver_info = QUIRK_CONTROL_LINE_STATE, },
+ { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 462ce49f683a..6e0823790bee 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2791,6 +2791,7 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ int i, status;
+ u16 portchange, portstatus;
+ struct usb_port *port_dev = hub->ports[port1 - 1];
++ int reset_recovery_time;
+
+ if (!hub_is_superspeed(hub->hdev)) {
+ if (warm) {
+@@ -2882,11 +2883,18 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+
+ done:
+ if (status == 0) {
+- /* TRSTRCY = 10 ms; plus some extra */
+ if (port_dev->quirks & USB_PORT_QUIRK_FAST_ENUM)
+ usleep_range(10000, 12000);
+- else
+- msleep(10 + 40);
++ else {
++ /* TRSTRCY = 10 ms; plus some extra */
++ reset_recovery_time = 10 + 40;
++
++ /* Hub needs extra delay after resetting its port. */
++ if (hub->hdev->quirks & USB_QUIRK_HUB_SLOW_RESET)
++ reset_recovery_time += 100;
++
++ msleep(reset_recovery_time);
++ }
+
+ if (udev) {
+ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 178d6c6063c0..f9ff03e6af93 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -128,6 +128,9 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
+ case 'n':
+ flags |= USB_QUIRK_DELAY_CTRL_MSG;
+ break;
++ case 'o':
++ flags |= USB_QUIRK_HUB_SLOW_RESET;
++ break;
+ /* Ignore unrecognized flag characters */
+ }
+ }
+@@ -380,6 +383,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
++ /* Terminus Technology Inc. Hub */
++ { USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET },
++
+ /* Corsair K70 RGB */
+ { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
+
+@@ -391,6 +397,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
+ USB_QUIRK_DELAY_CTRL_MSG },
+
++ /* Corsair K70 LUX RGB */
++ { USB_DEVICE(0x1b1c, 0x1b33), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ /* Corsair K70 LUX */
+ { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
+
+@@ -411,6 +420,11 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x2040, 0x7200), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
++ /* Raydium Touchscreen */
++ { USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM },
++
++ { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* DJI CineSSD */
+ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
+
+diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
+index d746c26a8055..6a0c60badfa0 100644
+--- a/drivers/usb/misc/appledisplay.c
++++ b/drivers/usb/misc/appledisplay.c
+@@ -50,6 +50,7 @@ static const struct usb_device_id appledisplay_table[] = {
+ { APPLEDISPLAY_DEVICE(0x9219) },
+ { APPLEDISPLAY_DEVICE(0x921c) },
+ { APPLEDISPLAY_DEVICE(0x921d) },
++ { APPLEDISPLAY_DEVICE(0x9222) },
+ { APPLEDISPLAY_DEVICE(0x9236) },
+
+ /* Terminating entry */
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index 84575baceebc..97341fa75458 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -914,7 +914,7 @@ int gnttab_dma_free_pages(struct gnttab_dma_alloc_args *args)
+
+ ret = xenmem_reservation_increase(args->nr_pages, args->frames);
+ if (ret != args->nr_pages) {
+- pr_debug("Failed to decrease reservation for DMA buffer\n");
++ pr_debug("Failed to increase reservation for DMA buffer\n");
+ ret = -EFAULT;
+ } else {
+ ret = 0;
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index 77a83790a31f..2543f24d23f8 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -500,7 +500,6 @@ static void afs_deliver_to_call(struct afs_call *call)
+ case -EINPROGRESS:
+ case -EAGAIN:
+ goto out;
+- case -EIO:
+ case -ECONNABORTED:
+ ASSERTCMP(state, ==, AFS_CALL_COMPLETE);
+ goto done;
+@@ -509,6 +508,10 @@ static void afs_deliver_to_call(struct afs_call *call)
+ rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
+ abort_code, ret, "KIV");
+ goto local_abort;
++ case -EIO:
++ pr_err("kAFS: Call %u in bad state %u\n",
++ call->debug_id, state);
++ /* Fall through */
+ case -ENODATA:
+ case -EBADMSG:
+ case -EMSGSIZE:
+diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c
+index 32d4f13784ba..03f4d24db8fe 100644
+--- a/fs/ceph/quota.c
++++ b/fs/ceph/quota.c
+@@ -237,7 +237,8 @@ static bool check_quota_exceeded(struct inode *inode, enum quota_check_op op,
+ ceph_put_snap_realm(mdsc, realm);
+ realm = next;
+ }
+- ceph_put_snap_realm(mdsc, realm);
++ if (realm)
++ ceph_put_snap_realm(mdsc, realm);
+ up_read(&mdsc->snap_rwsem);
+
+ return exceeded;
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 7065426b3280..fb32f3d6925e 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -981,8 +981,8 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off,
+ struct inode *src_inode = file_inode(src_file);
+ struct inode *target_inode = file_inode(dst_file);
+ struct cifsFileInfo *smb_file_src = src_file->private_data;
+- struct cifsFileInfo *smb_file_target = dst_file->private_data;
+- struct cifs_tcon *target_tcon = tlink_tcon(smb_file_target->tlink);
++ struct cifsFileInfo *smb_file_target;
++ struct cifs_tcon *target_tcon;
+ unsigned int xid;
+ int rc;
+
+@@ -996,6 +996,9 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off,
+ goto out;
+ }
+
++ smb_file_target = dst_file->private_data;
++ target_tcon = tlink_tcon(smb_file_target->tlink);
++
+ /*
+ * Note: cifs case is easier than btrfs since server responsible for
+ * checks for proper open modes and file type and if it wants
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 89985a0a6819..812da3e56a22 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -686,6 +686,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ int rc = 0;
+ unsigned int ea_name_len = ea_name ? strlen(ea_name) : 0;
+ char *name, *value;
++ size_t buf_size = dst_size;
+ size_t name_len, value_len, user_name_len;
+
+ while (src_size > 0) {
+@@ -721,9 +722,10 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ /* 'user.' plus a terminating null */
+ user_name_len = 5 + 1 + name_len;
+
+- rc += user_name_len;
+-
+- if (dst_size >= user_name_len) {
++ if (buf_size == 0) {
++ /* skip copy - calc size only */
++ rc += user_name_len;
++ } else if (dst_size >= user_name_len) {
+ dst_size -= user_name_len;
+ memcpy(dst, "user.", 5);
+ dst += 5;
+@@ -731,8 +733,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ dst += name_len;
+ *dst = 0;
+ ++dst;
+- } else if (dst_size == 0) {
+- /* skip copy - calc size only */
++ rc += user_name_len;
+ } else {
+ /* stop before overrun buffer */
+ rc = -ERANGE;
+diff --git a/fs/exofs/super.c b/fs/exofs/super.c
+index 41cf2fbee50d..7d61e3fa378c 100644
+--- a/fs/exofs/super.c
++++ b/fs/exofs/super.c
+@@ -101,6 +101,7 @@ static int parse_options(char *options, struct exofs_mountopt *opts)
+ token = match_token(p, tokens, args);
+ switch (token) {
+ case Opt_name:
++ kfree(opts->dev_name);
+ opts->dev_name = match_strdup(&args[0]);
+ if (unlikely(!opts->dev_name)) {
+ EXOFS_ERR("Error allocating dev_name");
+@@ -866,8 +867,10 @@ static struct dentry *exofs_mount(struct file_system_type *type,
+ int ret;
+
+ ret = parse_options(data, &opts);
+- if (ret)
++ if (ret) {
++ kfree(opts.dev_name);
+ return ERR_PTR(ret);
++ }
+
+ if (!opts.dev_name)
+ opts.dev_name = dev_name;
+diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
+index 9a8772465a90..da25c49203cc 100644
+--- a/fs/hfs/brec.c
++++ b/fs/hfs/brec.c
+@@ -425,6 +425,10 @@ skip:
+ if (new_node) {
+ __be32 cnid;
+
++ if (!new_node->parent) {
++ hfs_btree_inc_height(tree);
++ new_node->parent = tree->root;
++ }
+ fd->bnode = hfs_bnode_find(tree, new_node->parent);
+ /* create index key and entry */
+ hfs_bnode_read_key(new_node, fd->search_key, 14);
+diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
+index ed8eacb34452..aa17a392b414 100644
+--- a/fs/hfsplus/brec.c
++++ b/fs/hfsplus/brec.c
+@@ -429,6 +429,10 @@ skip:
+ if (new_node) {
+ __be32 cnid;
+
++ if (!new_node->parent) {
++ hfs_btree_inc_height(tree);
++ new_node->parent = tree->root;
++ }
+ fd->bnode = hfs_bnode_find(tree, new_node->parent);
+ /* create index key and entry */
+ hfs_bnode_read_key(new_node, fd->search_key, 14);
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index 48cdfc81fe10..32d8986c26fb 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -185,6 +185,7 @@ struct reiserfs_dentry_buf {
+ struct dir_context ctx;
+ struct dentry *xadir;
+ int count;
++ int err;
+ struct dentry *dentries[8];
+ };
+
+@@ -207,6 +208,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen,
+
+ dentry = lookup_one_len(name, dbuf->xadir, namelen);
+ if (IS_ERR(dentry)) {
++ dbuf->err = PTR_ERR(dentry);
+ return PTR_ERR(dentry);
+ } else if (d_really_is_negative(dentry)) {
+ /* A directory entry exists, but no file? */
+@@ -215,6 +217,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen,
+ "not found for file %pd.\n",
+ dentry, dbuf->xadir);
+ dput(dentry);
++ dbuf->err = -EIO;
+ return -EIO;
+ }
+
+@@ -262,6 +265,10 @@ static int reiserfs_for_each_xattr(struct inode *inode,
+ err = reiserfs_readdir_inode(d_inode(dir), &buf.ctx);
+ if (err)
+ break;
++ if (buf.err) {
++ err = buf.err;
++ break;
++ }
+ if (!buf.count)
+ break;
+ for (i = 0; !err && i < buf.count && buf.dentries[i]; i++) {
+diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
+index 78b86dea2f29..7f53ece2c039 100644
+--- a/include/linux/mtd/nand.h
++++ b/include/linux/mtd/nand.h
+@@ -568,7 +568,7 @@ static inline void nanddev_pos_next_eraseblock(struct nand_device *nand,
+ }
+
+ /**
+- * nanddev_pos_next_eraseblock() - Move a position to the next page
++ * nanddev_pos_next_page() - Move a position to the next page
+ * @nand: NAND device
+ * @pos: the position to update
+ *
+diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
+index 34fc80f3eb90..1d100efe74ec 100644
+--- a/include/linux/netfilter/ipset/ip_set.h
++++ b/include/linux/netfilter/ipset/ip_set.h
+@@ -314,7 +314,7 @@ enum {
+ extern ip_set_id_t ip_set_get_byname(struct net *net,
+ const char *name, struct ip_set **set);
+ extern void ip_set_put_byindex(struct net *net, ip_set_id_t index);
+-extern const char *ip_set_name_byindex(struct net *net, ip_set_id_t index);
++extern void ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name);
+ extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index);
+ extern void ip_set_nfnl_put(struct net *net, ip_set_id_t index);
+
+diff --git a/include/linux/netfilter/ipset/ip_set_comment.h b/include/linux/netfilter/ipset/ip_set_comment.h
+index 8e2bab1e8e90..70877f8de7e9 100644
+--- a/include/linux/netfilter/ipset/ip_set_comment.h
++++ b/include/linux/netfilter/ipset/ip_set_comment.h
+@@ -43,11 +43,11 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,
+ rcu_assign_pointer(comment->c, c);
+ }
+
+-/* Used only when dumping a set, protected by rcu_read_lock_bh() */
++/* Used only when dumping a set, protected by rcu_read_lock() */
+ static inline int
+ ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment)
+ {
+- struct ip_set_comment_rcu *c = rcu_dereference_bh(comment->c);
++ struct ip_set_comment_rcu *c = rcu_dereference(comment->c);
+
+ if (!c)
+ return 0;
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index b7a99ce56bc9..a1be64c9940f 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -66,4 +66,7 @@
+ /* Device needs a pause after every control message. */
+ #define USB_QUIRK_DELAY_CTRL_MSG BIT(13)
+
++/* Hub needs extra delay after resetting its port. */
++#define USB_QUIRK_HUB_SLOW_RESET BIT(14)
++
+ #endif /* __LINUX_USB_QUIRKS_H */
+diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
+index e23290ffdc77..325ec6ef0a76 100644
+--- a/include/uapi/linux/netfilter/nf_tables.h
++++ b/include/uapi/linux/netfilter/nf_tables.h
+@@ -1581,8 +1581,8 @@ enum nft_ng_attributes {
+ NFTA_NG_MODULUS,
+ NFTA_NG_TYPE,
+ NFTA_NG_OFFSET,
+- NFTA_NG_SET_NAME,
+- NFTA_NG_SET_ID,
++ NFTA_NG_SET_NAME, /* deprecated */
++ NFTA_NG_SET_ID, /* deprecated */
+ __NFTA_NG_MAX
+ };
+ #define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
+diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
+index 156ccd089df1..1610fdbab98d 100644
+--- a/include/uapi/linux/netfilter_bridge.h
++++ b/include/uapi/linux/netfilter_bridge.h
+@@ -11,6 +11,10 @@
+ #include <linux/if_vlan.h>
+ #include <linux/if_pppox.h>
+
++#ifndef __KERNEL__
++#include <limits.h> /* for INT_MIN, INT_MAX */
++#endif
++
+ /* Bridge Hooks */
+ /* After promisc drops, checksum checks. */
+ #define NF_BR_PRE_ROUTING 0
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 675eb6d36e47..382c09dddf93 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1974,6 +1974,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
+ info.jited_prog_len = 0;
+ info.xlated_prog_len = 0;
+ info.nr_jited_ksyms = 0;
++ info.nr_jited_func_lens = 0;
+ goto done;
+ }
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index ad97f3ba5ec5..35551110d277 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5854,11 +5854,14 @@ void __init sched_init_smp(void)
+ /*
+ * There's no userspace yet to cause hotplug operations; hence all the
+ * CPU masks are stable and all blatant races in the below code cannot
+- * happen.
++ * happen. The hotplug lock is nevertheless taken to satisfy lockdep,
++ * but there won't be any contention on it.
+ */
++ cpus_read_lock();
+ mutex_lock(&sched_domains_mutex);
+ sched_init_domains(cpu_active_mask);
+ mutex_unlock(&sched_domains_mutex);
++ cpus_read_unlock();
+
+ /* Move init over to a non-isolated CPU */
+ if (set_cpus_allowed_ptr(current, housekeeping_cpumask(HK_FLAG_DOMAIN)) < 0)
+diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile
+index 5d73f5cb4d8a..79777645cac9 100644
+--- a/lib/raid6/test/Makefile
++++ b/lib/raid6/test/Makefile
+@@ -27,7 +27,7 @@ ifeq ($(ARCH),arm)
+ CFLAGS += -I../../../arch/arm/include -mfpu=neon
+ HAS_NEON = yes
+ endif
+-ifeq ($(ARCH),arm64)
++ifeq ($(ARCH),aarch64)
+ CFLAGS += -I../../../arch/arm64/include
+ HAS_NEON = yes
+ endif
+@@ -41,7 +41,7 @@ ifeq ($(IS_X86),yes)
+ gcc -c -x assembler - >&/dev/null && \
+ rm ./-.o && echo -DCONFIG_AS_AVX512=1)
+ else ifeq ($(HAS_NEON),yes)
+- OBJS += neon.o neon1.o neon2.o neon4.o neon8.o
++ OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o
+ CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1
+ else
+ HAS_ALTIVEC := $(shell printf '\#include <altivec.h>\nvector int a;\n' |\
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 0a187196aeed..9a1c27c61de8 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -593,9 +593,15 @@ static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
+ struct bio_vec bvec;
+ int ret;
+
+- /* sendpage cannot properly handle pages with page_count == 0,
+- * we need to fallback to sendmsg if that's the case */
+- if (page_count(page) >= 1)
++ /*
++ * sendpage cannot properly handle pages with page_count == 0,
++ * we need to fall back to sendmsg if that's the case.
++ *
++ * Same goes for slab pages: skb_can_coalesce() allows
++ * coalescing neighboring slab objects into a single frag which
++ * triggers one of hardened usercopy checks.
++ */
++ if (page_count(page) >= 1 && !PageSlab(page))
+ return __ceph_tcp_sendpage(sock, page, offset, size, more);
+
+ bvec.bv_page = page;
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index 8f68a518d9db..f76bd4d15704 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
+ */
+ ret = -EINPROGRESS;
+ if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
+- fq->q.meat == fq->q.len &&
+- nf_ct_frag6_reasm(fq, skb, dev))
+- ret = 0;
+- else
++ fq->q.meat == fq->q.len) {
++ unsigned long orefdst = skb->_skb_refdst;
++
++ skb->_skb_refdst = 0UL;
++ if (nf_ct_frag6_reasm(fq, skb, dev))
++ ret = 0;
++ skb->_skb_refdst = orefdst;
++ } else {
+ skb_dst_drop(skb);
++ }
+
+ out_unlock:
+ spin_unlock_bh(&fq->q.lock);
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index bc4bd247bb7d..1577f2f76060 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -55,11 +55,15 @@ MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
+ MODULE_DESCRIPTION("core IP set support");
+ MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
+
+-/* When the nfnl mutex is held: */
++/* When the nfnl mutex or ip_set_ref_lock is held: */
+ #define ip_set_dereference(p) \
+- rcu_dereference_protected(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET))
++ rcu_dereference_protected(p, \
++ lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \
++ lockdep_is_held(&ip_set_ref_lock))
+ #define ip_set(inst, id) \
+ ip_set_dereference((inst)->ip_set_list)[id]
++#define ip_set_ref_netlink(inst,id) \
++ rcu_dereference_raw((inst)->ip_set_list)[id]
+
+ /* The set types are implemented in modules and registered set types
+ * can be found in ip_set_type_list. Adding/deleting types is
+@@ -693,21 +697,20 @@ ip_set_put_byindex(struct net *net, ip_set_id_t index)
+ EXPORT_SYMBOL_GPL(ip_set_put_byindex);
+
+ /* Get the name of a set behind a set index.
+- * We assume the set is referenced, so it does exist and
+- * can't be destroyed. The set cannot be renamed due to
+- * the referencing either.
+- *
++ * Set itself is protected by RCU, but its name isn't: to protect against
++ * renaming, grab ip_set_ref_lock as reader (see ip_set_rename()) and copy the
++ * name.
+ */
+-const char *
+-ip_set_name_byindex(struct net *net, ip_set_id_t index)
++void
++ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name)
+ {
+- const struct ip_set *set = ip_set_rcu_get(net, index);
++ struct ip_set *set = ip_set_rcu_get(net, index);
+
+ BUG_ON(!set);
+- BUG_ON(set->ref == 0);
+
+- /* Referenced, so it's safe */
+- return set->name;
++ read_lock_bh(&ip_set_ref_lock);
++ strncpy(name, set->name, IPSET_MAXNAMELEN);
++ read_unlock_bh(&ip_set_ref_lock);
+ }
+ EXPORT_SYMBOL_GPL(ip_set_name_byindex);
+
+@@ -961,7 +964,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
+ /* Wraparound */
+ goto cleanup;
+
+- list = kcalloc(i, sizeof(struct ip_set *), GFP_KERNEL);
++ list = kvcalloc(i, sizeof(struct ip_set *), GFP_KERNEL);
+ if (!list)
+ goto cleanup;
+ /* nfnl mutex is held, both lists are valid */
+@@ -973,7 +976,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
+ /* Use new list */
+ index = inst->ip_set_max;
+ inst->ip_set_max = i;
+- kfree(tmp);
++ kvfree(tmp);
+ ret = 0;
+ } else if (ret) {
+ goto cleanup;
+@@ -1153,7 +1156,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
+ if (!set)
+ return -ENOENT;
+
+- read_lock_bh(&ip_set_ref_lock);
++ write_lock_bh(&ip_set_ref_lock);
+ if (set->ref != 0) {
+ ret = -IPSET_ERR_REFERENCED;
+ goto out;
+@@ -1170,7 +1173,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
+ strncpy(set->name, name2, IPSET_MAXNAMELEN);
+
+ out:
+- read_unlock_bh(&ip_set_ref_lock);
++ write_unlock_bh(&ip_set_ref_lock);
+ return ret;
+ }
+
+@@ -1252,7 +1255,7 @@ ip_set_dump_done(struct netlink_callback *cb)
+ struct ip_set_net *inst =
+ (struct ip_set_net *)cb->args[IPSET_CB_NET];
+ ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
+- struct ip_set *set = ip_set(inst, index);
++ struct ip_set *set = ip_set_ref_netlink(inst, index);
+
+ if (set->variant->uref)
+ set->variant->uref(set, cb, false);
+@@ -1441,7 +1444,7 @@ next_set:
+ release_refcount:
+ /* If there was an error or set is done, release set */
+ if (ret || !cb->args[IPSET_CB_ARG0]) {
+- set = ip_set(inst, index);
++ set = ip_set_ref_netlink(inst, index);
+ if (set->variant->uref)
+ set->variant->uref(set, cb, false);
+ pr_debug("release set %s\n", set->name);
+@@ -2059,7 +2062,7 @@ ip_set_net_init(struct net *net)
+ if (inst->ip_set_max >= IPSET_INVALID_ID)
+ inst->ip_set_max = IPSET_INVALID_ID - 1;
+
+- list = kcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL);
++ list = kvcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL);
+ if (!list)
+ return -ENOMEM;
+ inst->is_deleted = false;
+@@ -2087,7 +2090,7 @@ ip_set_net_exit(struct net *net)
+ }
+ }
+ nfnl_unlock(NFNL_SUBSYS_IPSET);
+- kfree(rcu_dereference_protected(inst->ip_set_list, 1));
++ kvfree(rcu_dereference_protected(inst->ip_set_list, 1));
+ }
+
+ static struct pernet_operations ip_set_net_ops = {
+diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
+index d391485a6acd..613e18e720a4 100644
+--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
++++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
+@@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
+
+ if (tb[IPSET_ATTR_CIDR]) {
+ e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+- if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
++ if (e.cidr[0] > HOST_MASK)
+ return -IPSET_ERR_INVALID_CIDR;
+ }
+
+ if (tb[IPSET_ATTR_CIDR2]) {
+ e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
+- if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
++ if (e.cidr[1] > HOST_MASK)
+ return -IPSET_ERR_INVALID_CIDR;
+ }
+
+@@ -493,13 +493,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
+
+ if (tb[IPSET_ATTR_CIDR]) {
+ e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]);
+- if (!e.cidr[0] || e.cidr[0] > HOST_MASK)
++ if (e.cidr[0] > HOST_MASK)
+ return -IPSET_ERR_INVALID_CIDR;
+ }
+
+ if (tb[IPSET_ATTR_CIDR2]) {
+ e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]);
+- if (!e.cidr[1] || e.cidr[1] > HOST_MASK)
++ if (e.cidr[1] > HOST_MASK)
+ return -IPSET_ERR_INVALID_CIDR;
+ }
+
+diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
+index 072a658fde04..4eef55da0878 100644
+--- a/net/netfilter/ipset/ip_set_list_set.c
++++ b/net/netfilter/ipset/ip_set_list_set.c
+@@ -148,9 +148,7 @@ __list_set_del_rcu(struct rcu_head * rcu)
+ {
+ struct set_elem *e = container_of(rcu, struct set_elem, rcu);
+ struct ip_set *set = e->set;
+- struct list_set *map = set->data;
+
+- ip_set_put_byindex(map->net, e->id);
+ ip_set_ext_destroy(set, e);
+ kfree(e);
+ }
+@@ -158,15 +156,21 @@ __list_set_del_rcu(struct rcu_head * rcu)
+ static inline void
+ list_set_del(struct ip_set *set, struct set_elem *e)
+ {
++ struct list_set *map = set->data;
++
+ set->elements--;
+ list_del_rcu(&e->list);
++ ip_set_put_byindex(map->net, e->id);
+ call_rcu(&e->rcu, __list_set_del_rcu);
+ }
+
+ static inline void
+-list_set_replace(struct set_elem *e, struct set_elem *old)
++list_set_replace(struct ip_set *set, struct set_elem *e, struct set_elem *old)
+ {
++ struct list_set *map = set->data;
++
+ list_replace_rcu(&old->list, &e->list);
++ ip_set_put_byindex(map->net, old->id);
+ call_rcu(&old->rcu, __list_set_del_rcu);
+ }
+
+@@ -298,7 +302,7 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ INIT_LIST_HEAD(&e->list);
+ list_set_init_extensions(set, ext, e);
+ if (n)
+- list_set_replace(e, n);
++ list_set_replace(set, e, n);
+ else if (next)
+ list_add_tail_rcu(&e->list, &next->list);
+ else if (prev)
+@@ -486,6 +490,7 @@ list_set_list(const struct ip_set *set,
+ const struct list_set *map = set->data;
+ struct nlattr *atd, *nested;
+ u32 i = 0, first = cb->args[IPSET_CB_ARG0];
++ char name[IPSET_MAXNAMELEN];
+ struct set_elem *e;
+ int ret = 0;
+
+@@ -504,8 +509,8 @@ list_set_list(const struct ip_set *set,
+ nested = ipset_nest_start(skb, IPSET_ATTR_DATA);
+ if (!nested)
+ goto nla_put_failure;
+- if (nla_put_string(skb, IPSET_ATTR_NAME,
+- ip_set_name_byindex(map->net, e->id)))
++ ip_set_name_byindex(map->net, e->id, name);
++ if (nla_put_string(skb, IPSET_ATTR_NAME, name))
+ goto nla_put_failure;
+ if (ip_set_put_extensions(skb, set, e, true))
+ goto nla_put_failure;
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 32535eea51b2..ad2fe6a7e47d 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -54,9 +54,11 @@ static bool nft_xt_put(struct nft_xt *xt)
+ return false;
+ }
+
+-static int nft_compat_chain_validate_dependency(const char *tablename,
+- const struct nft_chain *chain)
++static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
++ const char *tablename)
+ {
++ enum nft_chain_types type = NFT_CHAIN_T_DEFAULT;
++ const struct nft_chain *chain = ctx->chain;
+ const struct nft_base_chain *basechain;
+
+ if (!tablename ||
+@@ -64,9 +66,12 @@ static int nft_compat_chain_validate_dependency(const char *tablename,
+ return 0;
+
+ basechain = nft_base_chain(chain);
+- if (strcmp(tablename, "nat") == 0 &&
+- basechain->type->type != NFT_CHAIN_T_NAT)
+- return -EINVAL;
++ if (strcmp(tablename, "nat") == 0) {
++ if (ctx->family != NFPROTO_BRIDGE)
++ type = NFT_CHAIN_T_NAT;
++ if (basechain->type->type != type)
++ return -EINVAL;
++ }
+
+ return 0;
+ }
+@@ -323,8 +328,7 @@ static int nft_target_validate(const struct nft_ctx *ctx,
+ if (target->hooks && !(hook_mask & target->hooks))
+ return -EINVAL;
+
+- ret = nft_compat_chain_validate_dependency(target->table,
+- ctx->chain);
++ ret = nft_compat_chain_validate_dependency(ctx, target->table);
+ if (ret < 0)
+ return ret;
+ }
+@@ -570,8 +574,7 @@ static int nft_match_validate(const struct nft_ctx *ctx,
+ if (match->hooks && !(hook_mask & match->hooks))
+ return -EINVAL;
+
+- ret = nft_compat_chain_validate_dependency(match->table,
+- ctx->chain);
++ ret = nft_compat_chain_validate_dependency(ctx, match->table);
+ if (ret < 0)
+ return ret;
+ }
+diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
+index 649d1700ec5b..3cc1b3dc3c3c 100644
+--- a/net/netfilter/nft_numgen.c
++++ b/net/netfilter/nft_numgen.c
+@@ -24,7 +24,6 @@ struct nft_ng_inc {
+ u32 modulus;
+ atomic_t counter;
+ u32 offset;
+- struct nft_set *map;
+ };
+
+ static u32 nft_ng_inc_gen(struct nft_ng_inc *priv)
+@@ -48,34 +47,11 @@ static void nft_ng_inc_eval(const struct nft_expr *expr,
+ regs->data[priv->dreg] = nft_ng_inc_gen(priv);
+ }
+
+-static void nft_ng_inc_map_eval(const struct nft_expr *expr,
+- struct nft_regs *regs,
+- const struct nft_pktinfo *pkt)
+-{
+- struct nft_ng_inc *priv = nft_expr_priv(expr);
+- const struct nft_set *map = priv->map;
+- const struct nft_set_ext *ext;
+- u32 result;
+- bool found;
+-
+- result = nft_ng_inc_gen(priv);
+- found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
+-
+- if (!found)
+- return;
+-
+- nft_data_copy(®s->data[priv->dreg],
+- nft_set_ext_data(ext), map->dlen);
+-}
+-
+ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
+ [NFTA_NG_DREG] = { .type = NLA_U32 },
+ [NFTA_NG_MODULUS] = { .type = NLA_U32 },
+ [NFTA_NG_TYPE] = { .type = NLA_U32 },
+ [NFTA_NG_OFFSET] = { .type = NLA_U32 },
+- [NFTA_NG_SET_NAME] = { .type = NLA_STRING,
+- .len = NFT_SET_MAXNAMELEN - 1 },
+- [NFTA_NG_SET_ID] = { .type = NLA_U32 },
+ };
+
+ static int nft_ng_inc_init(const struct nft_ctx *ctx,
+@@ -101,22 +77,6 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
+ NFT_DATA_VALUE, sizeof(u32));
+ }
+
+-static int nft_ng_inc_map_init(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nlattr * const tb[])
+-{
+- struct nft_ng_inc *priv = nft_expr_priv(expr);
+- u8 genmask = nft_genmask_next(ctx->net);
+-
+- nft_ng_inc_init(ctx, expr, tb);
+-
+- priv->map = nft_set_lookup_global(ctx->net, ctx->table,
+- tb[NFTA_NG_SET_NAME],
+- tb[NFTA_NG_SET_ID], genmask);
+-
+- return PTR_ERR_OR_ZERO(priv->map);
+-}
+-
+ static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg,
+ u32 modulus, enum nft_ng_types type, u32 offset)
+ {
+@@ -143,27 +103,10 @@ static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ priv->offset);
+ }
+
+-static int nft_ng_inc_map_dump(struct sk_buff *skb,
+- const struct nft_expr *expr)
+-{
+- const struct nft_ng_inc *priv = nft_expr_priv(expr);
+-
+- if (nft_ng_dump(skb, priv->dreg, priv->modulus,
+- NFT_NG_INCREMENTAL, priv->offset) ||
+- nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name))
+- goto nla_put_failure;
+-
+- return 0;
+-
+-nla_put_failure:
+- return -1;
+-}
+-
+ struct nft_ng_random {
+ enum nft_registers dreg:8;
+ u32 modulus;
+ u32 offset;
+- struct nft_set *map;
+ };
+
+ static u32 nft_ng_random_gen(struct nft_ng_random *priv)
+@@ -183,25 +126,6 @@ static void nft_ng_random_eval(const struct nft_expr *expr,
+ regs->data[priv->dreg] = nft_ng_random_gen(priv);
+ }
+
+-static void nft_ng_random_map_eval(const struct nft_expr *expr,
+- struct nft_regs *regs,
+- const struct nft_pktinfo *pkt)
+-{
+- struct nft_ng_random *priv = nft_expr_priv(expr);
+- const struct nft_set *map = priv->map;
+- const struct nft_set_ext *ext;
+- u32 result;
+- bool found;
+-
+- result = nft_ng_random_gen(priv);
+- found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
+- if (!found)
+- return;
+-
+- nft_data_copy(®s->data[priv->dreg],
+- nft_set_ext_data(ext), map->dlen);
+-}
+-
+ static int nft_ng_random_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nlattr * const tb[])
+@@ -226,21 +150,6 @@ static int nft_ng_random_init(const struct nft_ctx *ctx,
+ NFT_DATA_VALUE, sizeof(u32));
+ }
+
+-static int nft_ng_random_map_init(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nlattr * const tb[])
+-{
+- struct nft_ng_random *priv = nft_expr_priv(expr);
+- u8 genmask = nft_genmask_next(ctx->net);
+-
+- nft_ng_random_init(ctx, expr, tb);
+- priv->map = nft_set_lookup_global(ctx->net, ctx->table,
+- tb[NFTA_NG_SET_NAME],
+- tb[NFTA_NG_SET_ID], genmask);
+-
+- return PTR_ERR_OR_ZERO(priv->map);
+-}
+-
+ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ {
+ const struct nft_ng_random *priv = nft_expr_priv(expr);
+@@ -249,22 +158,6 @@ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ priv->offset);
+ }
+
+-static int nft_ng_random_map_dump(struct sk_buff *skb,
+- const struct nft_expr *expr)
+-{
+- const struct nft_ng_random *priv = nft_expr_priv(expr);
+-
+- if (nft_ng_dump(skb, priv->dreg, priv->modulus,
+- NFT_NG_RANDOM, priv->offset) ||
+- nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name))
+- goto nla_put_failure;
+-
+- return 0;
+-
+-nla_put_failure:
+- return -1;
+-}
+-
+ static struct nft_expr_type nft_ng_type;
+ static const struct nft_expr_ops nft_ng_inc_ops = {
+ .type = &nft_ng_type,
+@@ -274,14 +167,6 @@ static const struct nft_expr_ops nft_ng_inc_ops = {
+ .dump = nft_ng_inc_dump,
+ };
+
+-static const struct nft_expr_ops nft_ng_inc_map_ops = {
+- .type = &nft_ng_type,
+- .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_inc)),
+- .eval = nft_ng_inc_map_eval,
+- .init = nft_ng_inc_map_init,
+- .dump = nft_ng_inc_map_dump,
+-};
+-
+ static const struct nft_expr_ops nft_ng_random_ops = {
+ .type = &nft_ng_type,
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)),
+@@ -290,14 +175,6 @@ static const struct nft_expr_ops nft_ng_random_ops = {
+ .dump = nft_ng_random_dump,
+ };
+
+-static const struct nft_expr_ops nft_ng_random_map_ops = {
+- .type = &nft_ng_type,
+- .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)),
+- .eval = nft_ng_random_map_eval,
+- .init = nft_ng_random_map_init,
+- .dump = nft_ng_random_map_dump,
+-};
+-
+ static const struct nft_expr_ops *
+ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
+ {
+@@ -312,12 +189,8 @@ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
+
+ switch (type) {
+ case NFT_NG_INCREMENTAL:
+- if (tb[NFTA_NG_SET_NAME])
+- return &nft_ng_inc_map_ops;
+ return &nft_ng_inc_ops;
+ case NFT_NG_RANDOM:
+- if (tb[NFTA_NG_SET_NAME])
+- return &nft_ng_random_map_ops;
+ return &nft_ng_random_ops;
+ }
+
+diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
+index 5ee859193783..25453a16385e 100644
+--- a/net/netfilter/xt_IDLETIMER.c
++++ b/net/netfilter/xt_IDLETIMER.c
+@@ -116,6 +116,22 @@ static void idletimer_tg_expired(struct timer_list *t)
+ schedule_work(&timer->work);
+ }
+
++static int idletimer_check_sysfs_name(const char *name, unsigned int size)
++{
++ int ret;
++
++ ret = xt_check_proc_name(name, size);
++ if (ret < 0)
++ return ret;
++
++ if (!strcmp(name, "power") ||
++ !strcmp(name, "subsystem") ||
++ !strcmp(name, "uevent"))
++ return -EINVAL;
++
++ return 0;
++}
++
+ static int idletimer_tg_create(struct idletimer_tg_info *info)
+ {
+ int ret;
+@@ -126,6 +142,10 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
+ goto out;
+ }
+
++ ret = idletimer_check_sysfs_name(info->label, sizeof(info->label));
++ if (ret < 0)
++ goto out_free_timer;
++
+ sysfs_attr_init(&info->timer->attr.attr);
+ info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL);
+ if (!info->timer->attr.attr.name) {
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index b53cc0960b5d..ac16f509c95c 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -512,7 +512,7 @@ EXPORT_SYMBOL_GPL(xdr_commit_encode);
+ static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr,
+ size_t nbytes)
+ {
+- static __be32 *p;
++ __be32 *p;
+ int space_left;
+ int frag1bytes, frag2bytes;
+
+diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
+index 663a7f343b42..edcad61fe3cd 100755
+--- a/scripts/package/mkdebian
++++ b/scripts/package/mkdebian
+@@ -88,6 +88,7 @@ set_debarch() {
+ version=$KERNELRELEASE
+ if [ -n "$KDEB_PKGVERSION" ]; then
+ packageversion=$KDEB_PKGVERSION
++ revision=${packageversion##*-}
+ else
+ revision=$(cat .version 2>/dev/null||echo 1)
+ packageversion=$version-$revision
+@@ -205,10 +206,12 @@ cat <<EOF > debian/rules
+ #!$(command -v $MAKE) -f
+
+ build:
+- \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC=
++ \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \
++ KBUILD_BUILD_VERSION=${revision} KBUILD_SRC=
+
+ binary-arch:
+- \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC= intdeb-pkg
++ \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \
++ KBUILD_BUILD_VERSION=${revision} KBUILD_SRC= intdeb-pkg
+
+ clean:
+ rm -rf debian/*tmp debian/files
+diff --git a/scripts/setlocalversion b/scripts/setlocalversion
+index 79f7dd57d571..71f39410691b 100755
+--- a/scripts/setlocalversion
++++ b/scripts/setlocalversion
+@@ -74,7 +74,7 @@ scm_version()
+ fi
+
+ # Check for uncommitted changes
+- if git status -uno --porcelain | grep -qv '^.. scripts/package'; then
++ if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then
+ printf '%s' -dirty
+ fi
+
+diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
+index 974affe50531..76491e7f4177 100644
+--- a/security/apparmor/lib.c
++++ b/security/apparmor/lib.c
+@@ -90,10 +90,12 @@ const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name,
+ const char *end = fqname + n;
+ const char *name = skipn_spaces(fqname, n);
+
+- if (!name)
+- return NULL;
+ *ns_name = NULL;
+ *ns_len = 0;
++
++ if (!name)
++ return NULL;
++
+ if (name[0] == ':') {
+ char *split = strnchr(&name[1], end - &name[1], ':');
+ *ns_name = skipn_spaces(&name[1], end - &name[1]);
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 0166a3d7cd55..dffd60cebc31 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -7395,7 +7395,7 @@ static void ca0132_free(struct hda_codec *codec)
+
+ snd_hda_power_down(codec);
+ if (spec->mem_base)
+- iounmap(spec->mem_base);
++ pci_iounmap(codec->bus->pci, spec->mem_base);
+ kfree(spec->spec_init_verbs);
+ kfree(codec->spec);
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1070749c3cf4..e58537e13ad3 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6481,6 +6481,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
+ SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360),
+ SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+diff --git a/tools/perf/jvmti/jvmti_agent.c b/tools/perf/jvmti/jvmti_agent.c
+index ac1bcdc17dae..f7eb63cbbc65 100644
+--- a/tools/perf/jvmti/jvmti_agent.c
++++ b/tools/perf/jvmti/jvmti_agent.c
+@@ -125,7 +125,7 @@ perf_get_timestamp(void)
+ }
+
+ static int
+-debug_cache_init(void)
++create_jit_cache_dir(void)
+ {
+ char str[32];
+ char *base, *p;
+@@ -144,8 +144,13 @@ debug_cache_init(void)
+
+ strftime(str, sizeof(str), JIT_LANG"-jit-%Y%m%d", &tm);
+
+- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/", base);
+-
++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/", base);
++ if (ret >= PATH_MAX) {
++ warnx("jvmti: cannot generate jit cache dir because %s/.debug/"
++ " is too long, please check the cwd, JITDUMPDIR, and"
++ " HOME variables", base);
++ return -1;
++ }
+ ret = mkdir(jit_path, 0755);
+ if (ret == -1) {
+ if (errno != EEXIST) {
+@@ -154,20 +159,32 @@ debug_cache_init(void)
+ }
+ }
+
+- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit", base);
++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit", base);
++ if (ret >= PATH_MAX) {
++ warnx("jvmti: cannot generate jit cache dir because"
++ " %s/.debug/jit is too long, please check the cwd,"
++ " JITDUMPDIR, and HOME variables", base);
++ return -1;
++ }
+ ret = mkdir(jit_path, 0755);
+ if (ret == -1) {
+ if (errno != EEXIST) {
+- warn("cannot create jit cache dir %s", jit_path);
++ warn("jvmti: cannot create jit cache dir %s", jit_path);
+ return -1;
+ }
+ }
+
+- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit/%s.XXXXXXXX", base, str);
+-
++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit/%s.XXXXXXXX", base, str);
++ if (ret >= PATH_MAX) {
++ warnx("jvmti: cannot generate jit cache dir because"
++ " %s/.debug/jit/%s.XXXXXXXX is too long, please check"
++ " the cwd, JITDUMPDIR, and HOME variables",
++ base, str);
++ return -1;
++ }
+ p = mkdtemp(jit_path);
+ if (p != jit_path) {
+- warn("cannot create jit cache dir %s", jit_path);
++ warn("jvmti: cannot create jit cache dir %s", jit_path);
+ return -1;
+ }
+
+@@ -228,7 +245,7 @@ void *jvmti_open(void)
+ {
+ char dump_path[PATH_MAX];
+ struct jitheader header;
+- int fd;
++ int fd, ret;
+ FILE *fp;
+
+ init_arch_timestamp();
+@@ -245,12 +262,22 @@ void *jvmti_open(void)
+
+ memset(&header, 0, sizeof(header));
+
+- debug_cache_init();
++ /*
++ * jitdump file dir
++ */
++ if (create_jit_cache_dir() < 0)
++ return NULL;
+
+ /*
+ * jitdump file name
+ */
+- scnprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
++ ret = snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid());
++ if (ret >= PATH_MAX) {
++ warnx("jvmti: cannot generate jitdump file full path because"
++ " %s/jit-%i.dump is too long, please check the cwd,"
++ " JITDUMPDIR, and HOME variables", jit_path, getpid());
++ return NULL;
++ }
+
+ fd = open(dump_path, O_CREAT|O_TRUNC|O_RDWR, 0666);
+ if (fd == -1)
+diff --git a/tools/perf/tests/attr/test-record-group-sampling b/tools/perf/tests/attr/test-record-group-sampling
+index 8a33ca4f9e1f..f0729c454f16 100644
+--- a/tools/perf/tests/attr/test-record-group-sampling
++++ b/tools/perf/tests/attr/test-record-group-sampling
+@@ -37,4 +37,3 @@ sample_freq=0
+ sample_period=0
+ freq=0
+ write_backward=0
+-sample_id_all=0
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index e596ae358c4d..03a72310315f 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -952,7 +952,6 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
+ attr->sample_freq = 0;
+ attr->sample_period = 0;
+ attr->write_backward = 0;
+- attr->sample_id_all = 0;
+ }
+
+ if (opts->no_samples)
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 29770ea61768..6e70cc00c161 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -324,7 +324,17 @@ int dso__synthesize_plt_symbols(struct dso *dso, struct symsrc *ss)
+ plt_entry_size = 16;
+ break;
+
+- default: /* FIXME: s390/alpha/mips/parisc/poperpc/sh/sparc/xtensa need to be checked */
++ case EM_SPARC:
++ plt_header_size = 48;
++ plt_entry_size = 12;
++ break;
++
++ case EM_SPARCV9:
++ plt_header_size = 128;
++ plt_entry_size = 32;
++ break;
++
++ default: /* FIXME: s390/alpha/mips/parisc/poperpc/sh/xtensa need to be checked */
+ plt_header_size = shdr_plt.sh_entsize;
+ plt_entry_size = shdr_plt.sh_entsize;
+ break;
+diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
+index 6f318b15950e..5eff9bfc5758 100644
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -45,13 +45,13 @@ static int __report_module(struct addr_location *al, u64 ip,
+ Dwarf_Addr s;
+
+ dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL);
+- if (s != al->map->start)
++ if (s != al->map->start - al->map->pgoff)
+ mod = 0;
+ }
+
+ if (!mod)
+ mod = dwfl_report_elf(ui->dwfl, dso->short_name,
+- (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start,
++ (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start - al->map->pgoff,
+ false);
+
+ return mod && dwfl_addrmodule(ui->dwfl, ip) == mod ? 0 : -1;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-12-01 15:08 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-12-01 15:08 UTC (permalink / raw
To: gentoo-commits
commit: 3c846c91f5b30fcc7c4adbb519f42d972fd9cfd4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 1 15:07:51 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Dec 1 15:07:51 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3c846c91
proj/linux-patches: Linux patch 4.19.6
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1005_linux-4.19.6.patch | 4624 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4628 insertions(+)
diff --git a/0000_README b/0000_README
index c0b6ddf..c4c0a77 100644
--- a/0000_README
+++ b/0000_README
@@ -63,6 +63,10 @@ Patch: 1004_linux-4.19.5.patch
From: http://www.kernel.org
Desc: Linux 4.19.5
+Patch: 1005_linux-4.19.6.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.6
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1005_linux-4.19.6.patch b/1005_linux-4.19.6.patch
new file mode 100644
index 0000000..91b0881
--- /dev/null
+++ b/1005_linux-4.19.6.patch
@@ -0,0 +1,4624 @@
+diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst
+index 30491d91e93d..30187d49dc2c 100644
+--- a/Documentation/admin-guide/security-bugs.rst
++++ b/Documentation/admin-guide/security-bugs.rst
+@@ -26,23 +26,35 @@ information is helpful. Any exploit code is very helpful and will not
+ be released without consent from the reporter unless it has already been
+ made public.
+
+-Disclosure
+-----------
+-
+-The goal of the Linux kernel security team is to work with the bug
+-submitter to understand and fix the bug. We prefer to publish the fix as
+-soon as possible, but try to avoid public discussion of the bug itself
+-and leave that to others.
+-
+-Publishing the fix may be delayed when the bug or the fix is not yet
+-fully understood, the solution is not well-tested or for vendor
+-coordination. However, we expect these delays to be short, measurable in
+-days, not weeks or months. A release date is negotiated by the security
+-team working with the bug submitter as well as vendors. However, the
+-kernel security team holds the final say when setting a timeframe. The
+-timeframe varies from immediate (esp. if it's already publicly known bug)
+-to a few weeks. As a basic default policy, we expect report date to
+-release date to be on the order of 7 days.
++Disclosure and embargoed information
++------------------------------------
++
++The security list is not a disclosure channel. For that, see Coordination
++below.
++
++Once a robust fix has been developed, the release process starts. Fixes
++for publicly known bugs are released immediately.
++
++Although our preference is to release fixes for publicly undisclosed bugs
++as soon as they become available, this may be postponed at the request of
++the reporter or an affected party for up to 7 calendar days from the start
++of the release process, with an exceptional extension to 14 calendar days
++if it is agreed that the criticality of the bug requires more time. The
++only valid reason for deferring the publication of a fix is to accommodate
++the logistics of QA and large scale rollouts which require release
++coordination.
++
++Whilst embargoed information may be shared with trusted individuals in
++order to develop a fix, such information will not be published alongside
++the fix or on any other disclosure channel without the permission of the
++reporter. This includes but is not limited to the original bug report
++and followup discussions (if any), exploits, CVE information or the
++identity of the reporter.
++
++In other words our only interest is in getting bugs fixed. All other
++information submitted to the security list and any followup discussions
++of the report are treated confidentially even after the embargo has been
++lifted, in perpetuity.
+
+ Coordination
+ ------------
+@@ -68,7 +80,7 @@ may delay the bug handling. If a reporter wishes to have a CVE identifier
+ assigned ahead of public disclosure, they will need to contact the private
+ linux-distros list, described above. When such a CVE identifier is known
+ before a patch is provided, it is desirable to mention it in the commit
+-message, though.
++message if the reporter agrees.
+
+ Non-disclosure agreements
+ -------------------------
+diff --git a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
+index 903a78da65be..3a9926f99937 100644
+--- a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
++++ b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
+@@ -17,7 +17,7 @@ Example:
+ reg = <1>;
+ clocks = <&clk32m>;
+ interrupt-parent = <&gpio4>;
+- interrupts = <13 IRQ_TYPE_EDGE_RISING>;
++ interrupts = <13 IRQ_TYPE_LEVEL_HIGH>;
+ vdd-supply = <®5v0>;
+ xceiver-supply = <®5v0>;
+ };
+diff --git a/MAINTAINERS b/MAINTAINERS
+index b2f710eee67a..9e9b19ecf6f7 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -13769,6 +13769,7 @@ F: drivers/i2c/busses/i2c-stm32*
+
+ STABLE BRANCH
+ M: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
++M: Sasha Levin <sashal@kernel.org>
+ L: stable@vger.kernel.org
+ S: Supported
+ F: Documentation/process/stable-kernel-rules.rst
+diff --git a/Makefile b/Makefile
+index a07830185bdf..20cbb8e84650 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h
+index e0331e754568..b855f56489ac 100644
+--- a/arch/powerpc/include/asm/io.h
++++ b/arch/powerpc/include/asm/io.h
+@@ -285,19 +285,13 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
+ * their hooks, a bitfield is reserved for use by the platform near the
+ * top of MMIO addresses (not PIO, those have to cope the hard way).
+ *
+- * This bit field is 12 bits and is at the top of the IO virtual
+- * addresses PCI_IO_INDIRECT_TOKEN_MASK.
++ * The highest address in the kernel virtual space are:
+ *
+- * The kernel virtual space is thus:
++ * d0003fffffffffff # with Hash MMU
++ * c00fffffffffffff # with Radix MMU
+ *
+- * 0xD000000000000000 : vmalloc
+- * 0xD000080000000000 : PCI PHB IO space
+- * 0xD000080080000000 : ioremap
+- * 0xD0000fffffffffff : end of ioremap region
+- *
+- * Since the top 4 bits are reserved as the region ID, we use thus
+- * the next 12 bits and keep 4 bits available for the future if the
+- * virtual address space is ever to be extended.
++ * The top 4 bits are reserved as the region ID on hash, leaving us 8 bits
++ * that can be used for the field.
+ *
+ * The direct IO mapping operations will then mask off those bits
+ * before doing the actual access, though that only happen when
+@@ -309,8 +303,8 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
+ */
+
+ #ifdef CONFIG_PPC_INDIRECT_MMIO
+-#define PCI_IO_IND_TOKEN_MASK 0x0fff000000000000ul
+-#define PCI_IO_IND_TOKEN_SHIFT 48
++#define PCI_IO_IND_TOKEN_SHIFT 52
++#define PCI_IO_IND_TOKEN_MASK (0xfful << PCI_IO_IND_TOKEN_SHIFT)
+ #define PCI_FIX_ADDR(addr) \
+ ((PCI_IO_ADDR)(((unsigned long)(addr)) & ~PCI_IO_IND_TOKEN_MASK))
+ #define PCI_GET_ADDR_TOKEN(addr) \
+diff --git a/arch/powerpc/kvm/trace.h b/arch/powerpc/kvm/trace.h
+index 491b0f715d6b..ea1d7c808319 100644
+--- a/arch/powerpc/kvm/trace.h
++++ b/arch/powerpc/kvm/trace.h
+@@ -6,8 +6,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace
+
+ /*
+ * Tracepoint for guest mode entry.
+@@ -120,4 +118,10 @@ TRACE_EVENT(kvm_check_requests,
+ #endif /* _TRACE_KVM_H */
+
+ /* This part must be outside protection */
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace
++
+ #include <trace/define_trace.h>
+diff --git a/arch/powerpc/kvm/trace_booke.h b/arch/powerpc/kvm/trace_booke.h
+index ac640e81fdc5..3837842986aa 100644
+--- a/arch/powerpc/kvm/trace_booke.h
++++ b/arch/powerpc/kvm/trace_booke.h
+@@ -6,8 +6,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm_booke
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace_booke
+
+ #define kvm_trace_symbol_exit \
+ {0, "CRITICAL"}, \
+@@ -218,4 +216,11 @@ TRACE_EVENT(kvm_booke_queue_irqprio,
+ #endif
+
+ /* This part must be outside protection */
++
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace_booke
++
+ #include <trace/define_trace.h>
+diff --git a/arch/powerpc/kvm/trace_hv.h b/arch/powerpc/kvm/trace_hv.h
+index bcfe8a987f6a..8a1e3b0047f1 100644
+--- a/arch/powerpc/kvm/trace_hv.h
++++ b/arch/powerpc/kvm/trace_hv.h
+@@ -9,8 +9,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm_hv
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace_hv
+
+ #define kvm_trace_symbol_hcall \
+ {H_REMOVE, "H_REMOVE"}, \
+@@ -497,4 +495,11 @@ TRACE_EVENT(kvmppc_run_vcpu_exit,
+ #endif /* _TRACE_KVM_HV_H */
+
+ /* This part must be outside protection */
++
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace_hv
++
+ #include <trace/define_trace.h>
+diff --git a/arch/powerpc/kvm/trace_pr.h b/arch/powerpc/kvm/trace_pr.h
+index 2f9a8829552b..46a46d328fbf 100644
+--- a/arch/powerpc/kvm/trace_pr.h
++++ b/arch/powerpc/kvm/trace_pr.h
+@@ -8,8 +8,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm_pr
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace_pr
+
+ TRACE_EVENT(kvm_book3s_reenter,
+ TP_PROTO(int r, struct kvm_vcpu *vcpu),
+@@ -257,4 +255,11 @@ TRACE_EVENT(kvm_exit,
+ #endif /* _TRACE_KVM_H */
+
+ /* This part must be outside protection */
++
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace_pr
++
+ #include <trace/define_trace.h>
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 055b211b7126..5500e4edabc6 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -1179,7 +1179,7 @@ static long vphn_get_associativity(unsigned long cpu,
+
+ switch (rc) {
+ case H_FUNCTION:
+- printk(KERN_INFO
++ printk_once(KERN_INFO
+ "VPHN is not supported. Disabling polling...\n");
+ stop_topology_update();
+ break;
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index 61ec42405ec9..110be14e6122 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -82,4 +82,8 @@ core-y += arch/riscv/kernel/ arch/riscv/mm/
+
+ libs-y += arch/riscv/lib/
+
++PHONY += vdso_install
++vdso_install:
++ $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@
++
+ all: vmlinux
+diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
+index 3303ed2cd419..7dd308129b40 100644
+--- a/arch/riscv/kernel/module.c
++++ b/arch/riscv/kernel/module.c
+@@ -21,7 +21,7 @@ static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v)
+ {
+ if (v != (u32)v) {
+ pr_err("%s: value %016llx out of range for 32-bit field\n",
+- me->name, v);
++ me->name, (long long)v);
+ return -EINVAL;
+ }
+ *location = v;
+@@ -102,7 +102,7 @@ static int apply_r_riscv_pcrel_hi20_rela(struct module *me, u32 *location,
+ if (offset != (s32)offset) {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+@@ -144,7 +144,7 @@ static int apply_r_riscv_hi20_rela(struct module *me, u32 *location,
+ if (IS_ENABLED(CMODEL_MEDLOW)) {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+@@ -188,7 +188,7 @@ static int apply_r_riscv_got_hi20_rela(struct module *me, u32 *location,
+ } else {
+ pr_err(
+ "%s: can not generate the GOT entry for symbol = %016llx from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+@@ -212,7 +212,7 @@ static int apply_r_riscv_call_plt_rela(struct module *me, u32 *location,
+ } else {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+ }
+@@ -234,7 +234,7 @@ static int apply_r_riscv_call_rela(struct module *me, u32 *location,
+ if (offset != fill_v) {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
+index 8527c3e1038b..bfa25814fe5f 100644
+--- a/arch/x86/events/intel/uncore_snb.c
++++ b/arch/x86/events/intel/uncore_snb.c
+@@ -15,6 +15,25 @@
+ #define PCI_DEVICE_ID_INTEL_SKL_HQ_IMC 0x1910
+ #define PCI_DEVICE_ID_INTEL_SKL_SD_IMC 0x190f
+ #define PCI_DEVICE_ID_INTEL_SKL_SQ_IMC 0x191f
++#define PCI_DEVICE_ID_INTEL_KBL_Y_IMC 0x590c
++#define PCI_DEVICE_ID_INTEL_KBL_U_IMC 0x5904
++#define PCI_DEVICE_ID_INTEL_KBL_UQ_IMC 0x5914
++#define PCI_DEVICE_ID_INTEL_KBL_SD_IMC 0x590f
++#define PCI_DEVICE_ID_INTEL_KBL_SQ_IMC 0x591f
++#define PCI_DEVICE_ID_INTEL_CFL_2U_IMC 0x3ecc
++#define PCI_DEVICE_ID_INTEL_CFL_4U_IMC 0x3ed0
++#define PCI_DEVICE_ID_INTEL_CFL_4H_IMC 0x3e10
++#define PCI_DEVICE_ID_INTEL_CFL_6H_IMC 0x3ec4
++#define PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC 0x3e0f
++#define PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC 0x3e1f
++#define PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC 0x3ec2
++#define PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC 0x3e30
++#define PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC 0x3e18
++#define PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC 0x3ec6
++#define PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC 0x3e31
++#define PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC 0x3e33
++#define PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC 0x3eca
++#define PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC 0x3e32
+
+ /* SNB event control */
+ #define SNB_UNC_CTL_EV_SEL_MASK 0x000000ff
+@@ -569,7 +588,82 @@ static const struct pci_device_id skl_uncore_pci_ids[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SQ_IMC),
+ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+ },
+-
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_Y_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_U_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_UQ_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SD_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SQ_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2U_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4U_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4H_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6H_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
+ { /* end: all zeroes */ },
+ };
+
+@@ -618,6 +712,25 @@ static const struct imc_uncore_pci_dev desktop_imc_pci_ids[] = {
+ IMC_DEV(SKL_HQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core H Quad Core */
+ IMC_DEV(SKL_SD_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Dual Core */
+ IMC_DEV(SKL_SQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Quad Core */
++ IMC_DEV(KBL_Y_IMC, &skl_uncore_pci_driver), /* 7th Gen Core Y */
++ IMC_DEV(KBL_U_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U */
++ IMC_DEV(KBL_UQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U Quad Core */
++ IMC_DEV(KBL_SD_IMC, &skl_uncore_pci_driver), /* 7th Gen Core S Dual Core */
++ IMC_DEV(KBL_SQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core S Quad Core */
++ IMC_DEV(CFL_2U_IMC, &skl_uncore_pci_driver), /* 8th Gen Core U 2 Cores */
++ IMC_DEV(CFL_4U_IMC, &skl_uncore_pci_driver), /* 8th Gen Core U 4 Cores */
++ IMC_DEV(CFL_4H_IMC, &skl_uncore_pci_driver), /* 8th Gen Core H 4 Cores */
++ IMC_DEV(CFL_6H_IMC, &skl_uncore_pci_driver), /* 8th Gen Core H 6 Cores */
++ IMC_DEV(CFL_2S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 2 Cores Desktop */
++ IMC_DEV(CFL_4S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Desktop */
++ IMC_DEV(CFL_6S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Desktop */
++ IMC_DEV(CFL_8S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Desktop */
++ IMC_DEV(CFL_4S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Work Station */
++ IMC_DEV(CFL_6S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Work Station */
++ IMC_DEV(CFL_8S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Work Station */
++ IMC_DEV(CFL_4S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Server */
++ IMC_DEV(CFL_6S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Server */
++ IMC_DEV(CFL_8S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Server */
+ { /* end marker */ }
+ };
+
+diff --git a/block/bio.c b/block/bio.c
+index 41173710430c..c4ef8aa46452 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -605,6 +605,7 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src)
+ if (bio_flagged(bio_src, BIO_THROTTLED))
+ bio_set_flag(bio, BIO_THROTTLED);
+ bio->bi_opf = bio_src->bi_opf;
++ bio->bi_ioprio = bio_src->bi_ioprio;
+ bio->bi_write_hint = bio_src->bi_write_hint;
+ bio->bi_iter = bio_src->bi_iter;
+ bio->bi_io_vec = bio_src->bi_io_vec;
+diff --git a/block/bounce.c b/block/bounce.c
+index 418677dcec60..abb50e7e5fab 100644
+--- a/block/bounce.c
++++ b/block/bounce.c
+@@ -248,6 +248,7 @@ static struct bio *bounce_clone_bio(struct bio *bio_src, gfp_t gfp_mask,
+ return NULL;
+ bio->bi_disk = bio_src->bi_disk;
+ bio->bi_opf = bio_src->bi_opf;
++ bio->bi_ioprio = bio_src->bi_ioprio;
+ bio->bi_write_hint = bio_src->bi_write_hint;
+ bio->bi_iter.bi_sector = bio_src->bi_iter.bi_sector;
+ bio->bi_iter.bi_size = bio_src->bi_iter.bi_size;
+diff --git a/crypto/simd.c b/crypto/simd.c
+index ea7240be3001..78e8d037ae2b 100644
+--- a/crypto/simd.c
++++ b/crypto/simd.c
+@@ -124,8 +124,9 @@ static int simd_skcipher_init(struct crypto_skcipher *tfm)
+
+ ctx->cryptd_tfm = cryptd_tfm;
+
+- reqsize = sizeof(struct skcipher_request);
+- reqsize += crypto_skcipher_reqsize(&cryptd_tfm->base);
++ reqsize = crypto_skcipher_reqsize(cryptd_skcipher_child(cryptd_tfm));
++ reqsize = max(reqsize, crypto_skcipher_reqsize(&cryptd_tfm->base));
++ reqsize += sizeof(struct skcipher_request);
+
+ crypto_skcipher_set_reqsize(tfm, reqsize);
+
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index e9fb0bf3c8d2..78f9de260d5f 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -417,6 +417,10 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
++ status = acpi_ut_add_address_range(obj_desc->region.space_id,
++ obj_desc->region.address,
++ obj_desc->region.length, node);
++
+ /* Now the address and length are valid for this opregion */
+
+ obj_desc->region.flags |= AOPOBJ_DATA_VALID;
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index f2b6f4da1034..fdabd0b74492 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -4151,10 +4151,11 @@ static int __floppy_read_block_0(struct block_device *bdev, int drive)
+ bio.bi_end_io = floppy_rb0_cb;
+ bio_set_op_attrs(&bio, REQ_OP_READ, 0);
+
++ init_completion(&cbdata.complete);
++
+ submit_bio(&bio);
+ process_fd_request();
+
+- init_completion(&cbdata.complete);
+ wait_for_completion(&cbdata.complete);
+
+ __free_page(page);
+diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
+index b2ff423ad7f8..f4880a4f865b 100644
+--- a/drivers/cpufreq/imx6q-cpufreq.c
++++ b/drivers/cpufreq/imx6q-cpufreq.c
+@@ -159,8 +159,13 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)
+ /* Ensure the arm clock divider is what we expect */
+ ret = clk_set_rate(clks[ARM].clk, new_freq * 1000);
+ if (ret) {
++ int ret1;
++
+ dev_err(cpu_dev, "failed to set clock rate: %d\n", ret);
+- regulator_set_voltage_tol(arm_reg, volt_old, 0);
++ ret1 = regulator_set_voltage_tol(arm_reg, volt_old, 0);
++ if (ret1)
++ dev_warn(cpu_dev,
++ "failed to restore vddarm voltage: %d\n", ret1);
+ return ret;
+ }
+
+diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
+index 388a929baf95..1a6a77df8a5e 100644
+--- a/drivers/firmware/efi/arm-init.c
++++ b/drivers/firmware/efi/arm-init.c
+@@ -265,6 +265,10 @@ void __init efi_init(void)
+ (params.mmap & ~PAGE_MASK)));
+
+ init_screen_info();
++
++ /* ARM does not permit early mappings to persist across paging_init() */
++ if (IS_ENABLED(CONFIG_ARM))
++ efi_memmap_unmap();
+ }
+
+ static int __init register_gop_device(void)
+diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
+index 922cfb813109..a00934d263c5 100644
+--- a/drivers/firmware/efi/arm-runtime.c
++++ b/drivers/firmware/efi/arm-runtime.c
+@@ -110,7 +110,7 @@ static int __init arm_enable_runtime_services(void)
+ {
+ u64 mapsize;
+
+- if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) {
++ if (!efi_enabled(EFI_BOOT)) {
+ pr_info("EFI services will not be available.\n");
+ return 0;
+ }
+diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
+index 14c40a7750d1..c51627660dbb 100644
+--- a/drivers/firmware/efi/libstub/Makefile
++++ b/drivers/firmware/efi/libstub/Makefile
+@@ -16,7 +16,8 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -O2 \
+ cflags-$(CONFIG_ARM64) := $(subst -pg,,$(KBUILD_CFLAGS)) -fpie \
+ $(DISABLE_STACKLEAK_PLUGIN)
+ cflags-$(CONFIG_ARM) := $(subst -pg,,$(KBUILD_CFLAGS)) \
+- -fno-builtin -fpic -mno-single-pic-base
++ -fno-builtin -fpic \
++ $(call cc-option,-mno-single-pic-base)
+
+ cflags-$(CONFIG_EFI_ARMSTUB) += -I$(srctree)/scripts/dtc/libfdt
+
+diff --git a/drivers/firmware/efi/memmap.c b/drivers/firmware/efi/memmap.c
+index 5fc70520e04c..1907db2b38d8 100644
+--- a/drivers/firmware/efi/memmap.c
++++ b/drivers/firmware/efi/memmap.c
+@@ -118,6 +118,9 @@ int __init efi_memmap_init_early(struct efi_memory_map_data *data)
+
+ void __init efi_memmap_unmap(void)
+ {
++ if (!efi_enabled(EFI_MEMMAP))
++ return;
++
+ if (!efi.memmap.late) {
+ unsigned long size;
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 25187403e3ac..a8e01d99919c 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1285,7 +1285,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
+ gdev->descs = kcalloc(chip->ngpio, sizeof(gdev->descs[0]), GFP_KERNEL);
+ if (!gdev->descs) {
+ status = -ENOMEM;
+- goto err_free_gdev;
++ goto err_free_ida;
+ }
+
+ if (chip->ngpio == 0) {
+@@ -1413,8 +1413,9 @@ err_free_label:
+ kfree_const(gdev->label);
+ err_free_descs:
+ kfree(gdev->descs);
+-err_free_gdev:
++err_free_ida:
+ ida_simple_remove(&gpio_ida, gdev->id);
++err_free_gdev:
+ /* failures here can mean systems won't boot... */
+ pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__,
+ gdev->base, gdev->base + gdev->ngpio - 1,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+index 0c791e35acf0..79bd8bd97fae 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+@@ -496,8 +496,11 @@ void amdgpu_amdkfd_set_compute_idle(struct kgd_dev *kgd, bool idle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)kgd;
+
+- amdgpu_dpm_switch_power_profile(adev,
+- PP_SMC_POWER_PROFILE_COMPUTE, !idle);
++ if (adev->powerplay.pp_funcs &&
++ adev->powerplay.pp_funcs->switch_power_profile)
++ amdgpu_dpm_switch_power_profile(adev,
++ PP_SMC_POWER_PROFILE_COMPUTE,
++ !idle);
+ }
+
+ bool amdgpu_amdkfd_is_kfd_vmid(struct amdgpu_device *adev, u32 vmid)
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+index ad151fefa41f..db406a35808f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+@@ -45,6 +45,7 @@ MODULE_FIRMWARE("amdgpu/tahiti_mc.bin");
+ MODULE_FIRMWARE("amdgpu/pitcairn_mc.bin");
+ MODULE_FIRMWARE("amdgpu/verde_mc.bin");
+ MODULE_FIRMWARE("amdgpu/oland_mc.bin");
++MODULE_FIRMWARE("amdgpu/hainan_mc.bin");
+ MODULE_FIRMWARE("amdgpu/si58_mc.bin");
+
+ #define MC_SEQ_MISC0__MT__MASK 0xf0000000
+diff --git a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
+index 5ae5ed2e62d6..21bc12e02311 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
+@@ -129,7 +129,7 @@ static int vega10_ih_irq_init(struct amdgpu_device *adev)
+ else
+ wptr_off = adev->wb.gpu_addr + (adev->irq.ih.wptr_offs * 4);
+ WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_LO, lower_32_bits(wptr_off));
+- WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFF);
++ WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFFFF);
+
+ /* set rptr, wptr to 0 */
+ WREG32_SOC15(OSSSYS, 0, mmIH_RB_RPTR, 0);
+diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c
+index 69dab82a3771..bf589c53b908 100644
+--- a/drivers/gpu/drm/ast/ast_drv.c
++++ b/drivers/gpu/drm/ast/ast_drv.c
+@@ -60,8 +60,29 @@ static const struct pci_device_id pciidlist[] = {
+
+ MODULE_DEVICE_TABLE(pci, pciidlist);
+
++static void ast_kick_out_firmware_fb(struct pci_dev *pdev)
++{
++ struct apertures_struct *ap;
++ bool primary = false;
++
++ ap = alloc_apertures(1);
++ if (!ap)
++ return;
++
++ ap->ranges[0].base = pci_resource_start(pdev, 0);
++ ap->ranges[0].size = pci_resource_len(pdev, 0);
++
++#ifdef CONFIG_X86
++ primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
++#endif
++ drm_fb_helper_remove_conflicting_framebuffers(ap, "astdrmfb", primary);
++ kfree(ap);
++}
++
+ static int ast_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
++ ast_kick_out_firmware_fb(pdev);
++
+ return drm_get_pci_dev(pdev, ent, &driver);
+ }
+
+diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
+index 5e77d456d9bb..7c6ac3cadb6b 100644
+--- a/drivers/gpu/drm/ast/ast_mode.c
++++ b/drivers/gpu/drm/ast/ast_mode.c
+@@ -568,6 +568,7 @@ static int ast_crtc_do_set_base(struct drm_crtc *crtc,
+ }
+ ast_bo_unreserve(bo);
+
++ ast_set_offset_reg(crtc);
+ ast_set_start_address_crt1(crtc, (u32)gpu_addr);
+
+ return 0;
+@@ -1254,7 +1255,7 @@ static int ast_cursor_move(struct drm_crtc *crtc,
+ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xc7, ((y >> 8) & 0x07));
+
+ /* dummy write to fire HWC */
+- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xCB, 0xFF, 0x00);
++ ast_show_cursor(crtc);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 9628dd617826..9214c8b02484 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -200,6 +200,9 @@ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper)
+ mutex_lock(&fb_helper->lock);
+ drm_connector_list_iter_begin(dev, &conn_iter);
+ drm_for_each_connector_iter(connector, &conn_iter) {
++ if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK)
++ continue;
++
+ ret = __drm_fb_helper_add_one_connector(fb_helper, connector);
+ if (ret)
+ goto fail;
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 43ae9de12ba3..c3a64d6a18df 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2492,6 +2492,9 @@ static uint32_t ilk_compute_pri_wm(const struct intel_crtc_state *cstate,
+ uint32_t method1, method2;
+ int cpp;
+
++ if (mem_value == 0)
++ return U32_MAX;
++
+ if (!intel_wm_plane_visible(cstate, pstate))
+ return 0;
+
+@@ -2521,6 +2524,9 @@ static uint32_t ilk_compute_spr_wm(const struct intel_crtc_state *cstate,
+ uint32_t method1, method2;
+ int cpp;
+
++ if (mem_value == 0)
++ return U32_MAX;
++
+ if (!intel_wm_plane_visible(cstate, pstate))
+ return 0;
+
+@@ -2544,6 +2550,9 @@ static uint32_t ilk_compute_cur_wm(const struct intel_crtc_state *cstate,
+ {
+ int cpp;
+
++ if (mem_value == 0)
++ return U32_MAX;
++
+ if (!intel_wm_plane_visible(cstate, pstate))
+ return 0;
+
+@@ -2998,6 +3007,34 @@ static void snb_wm_latency_quirk(struct drm_i915_private *dev_priv)
+ intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
+ }
+
++static void snb_wm_lp3_irq_quirk(struct drm_i915_private *dev_priv)
++{
++ /*
++ * On some SNB machines (Thinkpad X220 Tablet at least)
++ * LP3 usage can cause vblank interrupts to be lost.
++ * The DEIIR bit will go high but it looks like the CPU
++ * never gets interrupted.
++ *
++ * It's not clear whether other interrupt source could
++ * be affected or if this is somehow limited to vblank
++ * interrupts only. To play it safe we disable LP3
++ * watermarks entirely.
++ */
++ if (dev_priv->wm.pri_latency[3] == 0 &&
++ dev_priv->wm.spr_latency[3] == 0 &&
++ dev_priv->wm.cur_latency[3] == 0)
++ return;
++
++ dev_priv->wm.pri_latency[3] = 0;
++ dev_priv->wm.spr_latency[3] = 0;
++ dev_priv->wm.cur_latency[3] = 0;
++
++ DRM_DEBUG_KMS("LP3 watermarks disabled due to potential for lost interrupts\n");
++ intel_print_wm_latency(dev_priv, "Primary", dev_priv->wm.pri_latency);
++ intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
++ intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
++}
++
+ static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
+ {
+ intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency);
+@@ -3014,8 +3051,10 @@ static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
+ intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
+ intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
+
+- if (IS_GEN6(dev_priv))
++ if (IS_GEN6(dev_priv)) {
+ snb_wm_latency_quirk(dev_priv);
++ snb_wm_lp3_irq_quirk(dev_priv);
++ }
+ }
+
+ static void skl_setup_wm_latency(struct drm_i915_private *dev_priv)
+diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
+index ca5aa7fba769..f4d8a730e821 100644
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -216,6 +216,12 @@ static int vc4_atomic_commit(struct drm_device *dev,
+ return 0;
+ }
+
++ /* We know for sure we don't want an async update here. Set
++ * state->legacy_cursor_update to false to prevent
++ * drm_atomic_helper_setup_commit() from auto-completing
++ * commit->flip_done.
++ */
++ state->legacy_cursor_update = false;
+ ret = drm_atomic_helper_setup_commit(state, nonblock);
+ if (ret)
+ return ret;
+diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
+index 0422ec2b13d2..dc4128bfe2ca 100644
+--- a/drivers/hid/hid-steam.c
++++ b/drivers/hid/hid-steam.c
+@@ -23,8 +23,9 @@
+ * In order to avoid breaking them this driver creates a layered hidraw device,
+ * so it can detect when the client is running and then:
+ * - it will not send any command to the controller.
+- * - this input device will be disabled, to avoid double input of the same
++ * - this input device will be removed, to avoid double input of the same
+ * user action.
++ * When the client is closed, this input device will be created again.
+ *
+ * For additional functions, such as changing the right-pad margin or switching
+ * the led, you can use the user-space tool at:
+@@ -113,7 +114,7 @@ struct steam_device {
+ spinlock_t lock;
+ struct hid_device *hdev, *client_hdev;
+ struct mutex mutex;
+- bool client_opened, input_opened;
++ bool client_opened;
+ struct input_dev __rcu *input;
+ unsigned long quirks;
+ struct work_struct work_connect;
+@@ -279,18 +280,6 @@ static void steam_set_lizard_mode(struct steam_device *steam, bool enable)
+ }
+ }
+
+-static void steam_update_lizard_mode(struct steam_device *steam)
+-{
+- mutex_lock(&steam->mutex);
+- if (!steam->client_opened) {
+- if (steam->input_opened)
+- steam_set_lizard_mode(steam, false);
+- else
+- steam_set_lizard_mode(steam, lizard_mode);
+- }
+- mutex_unlock(&steam->mutex);
+-}
+-
+ static int steam_input_open(struct input_dev *dev)
+ {
+ struct steam_device *steam = input_get_drvdata(dev);
+@@ -301,7 +290,6 @@ static int steam_input_open(struct input_dev *dev)
+ return ret;
+
+ mutex_lock(&steam->mutex);
+- steam->input_opened = true;
+ if (!steam->client_opened && lizard_mode)
+ steam_set_lizard_mode(steam, false);
+ mutex_unlock(&steam->mutex);
+@@ -313,7 +301,6 @@ static void steam_input_close(struct input_dev *dev)
+ struct steam_device *steam = input_get_drvdata(dev);
+
+ mutex_lock(&steam->mutex);
+- steam->input_opened = false;
+ if (!steam->client_opened && lizard_mode)
+ steam_set_lizard_mode(steam, true);
+ mutex_unlock(&steam->mutex);
+@@ -400,7 +387,7 @@ static int steam_battery_register(struct steam_device *steam)
+ return 0;
+ }
+
+-static int steam_register(struct steam_device *steam)
++static int steam_input_register(struct steam_device *steam)
+ {
+ struct hid_device *hdev = steam->hdev;
+ struct input_dev *input;
+@@ -414,17 +401,6 @@ static int steam_register(struct steam_device *steam)
+ return 0;
+ }
+
+- /*
+- * Unlikely, but getting the serial could fail, and it is not so
+- * important, so make up a serial number and go on.
+- */
+- if (steam_get_serial(steam) < 0)
+- strlcpy(steam->serial_no, "XXXXXXXXXX",
+- sizeof(steam->serial_no));
+-
+- hid_info(hdev, "Steam Controller '%s' connected",
+- steam->serial_no);
+-
+ input = input_allocate_device();
+ if (!input)
+ return -ENOMEM;
+@@ -492,11 +468,6 @@ static int steam_register(struct steam_device *steam)
+ goto input_register_fail;
+
+ rcu_assign_pointer(steam->input, input);
+-
+- /* ignore battery errors, we can live without it */
+- if (steam->quirks & STEAM_QUIRK_WIRELESS)
+- steam_battery_register(steam);
+-
+ return 0;
+
+ input_register_fail:
+@@ -504,27 +475,88 @@ input_register_fail:
+ return ret;
+ }
+
+-static void steam_unregister(struct steam_device *steam)
++static void steam_input_unregister(struct steam_device *steam)
+ {
+ struct input_dev *input;
++ rcu_read_lock();
++ input = rcu_dereference(steam->input);
++ rcu_read_unlock();
++ if (!input)
++ return;
++ RCU_INIT_POINTER(steam->input, NULL);
++ synchronize_rcu();
++ input_unregister_device(input);
++}
++
++static void steam_battery_unregister(struct steam_device *steam)
++{
+ struct power_supply *battery;
+
+ rcu_read_lock();
+- input = rcu_dereference(steam->input);
+ battery = rcu_dereference(steam->battery);
+ rcu_read_unlock();
+
+- if (battery) {
+- RCU_INIT_POINTER(steam->battery, NULL);
+- synchronize_rcu();
+- power_supply_unregister(battery);
++ if (!battery)
++ return;
++ RCU_INIT_POINTER(steam->battery, NULL);
++ synchronize_rcu();
++ power_supply_unregister(battery);
++}
++
++static int steam_register(struct steam_device *steam)
++{
++ int ret;
++
++ /*
++ * This function can be called several times in a row with the
++ * wireless adaptor, without steam_unregister() between them, because
++ * another client send a get_connection_status command, for example.
++ * The battery and serial number are set just once per device.
++ */
++ if (!steam->serial_no[0]) {
++ /*
++ * Unlikely, but getting the serial could fail, and it is not so
++ * important, so make up a serial number and go on.
++ */
++ if (steam_get_serial(steam) < 0)
++ strlcpy(steam->serial_no, "XXXXXXXXXX",
++ sizeof(steam->serial_no));
++
++ hid_info(steam->hdev, "Steam Controller '%s' connected",
++ steam->serial_no);
++
++ /* ignore battery errors, we can live without it */
++ if (steam->quirks & STEAM_QUIRK_WIRELESS)
++ steam_battery_register(steam);
++
++ mutex_lock(&steam_devices_lock);
++ list_add(&steam->list, &steam_devices);
++ mutex_unlock(&steam_devices_lock);
+ }
+- if (input) {
+- RCU_INIT_POINTER(steam->input, NULL);
+- synchronize_rcu();
++
++ mutex_lock(&steam->mutex);
++ if (!steam->client_opened) {
++ steam_set_lizard_mode(steam, lizard_mode);
++ ret = steam_input_register(steam);
++ } else {
++ ret = 0;
++ }
++ mutex_unlock(&steam->mutex);
++
++ return ret;
++}
++
++static void steam_unregister(struct steam_device *steam)
++{
++ steam_battery_unregister(steam);
++ steam_input_unregister(steam);
++ if (steam->serial_no[0]) {
+ hid_info(steam->hdev, "Steam Controller '%s' disconnected",
+ steam->serial_no);
+- input_unregister_device(input);
++ mutex_lock(&steam_devices_lock);
++ list_del(&steam->list);
++ mutex_unlock(&steam_devices_lock);
++ steam->serial_no[0] = 0;
+ }
+ }
+
+@@ -600,6 +632,9 @@ static int steam_client_ll_open(struct hid_device *hdev)
+ mutex_lock(&steam->mutex);
+ steam->client_opened = true;
+ mutex_unlock(&steam->mutex);
++
++ steam_input_unregister(steam);
++
+ return ret;
+ }
+
+@@ -609,13 +644,13 @@ static void steam_client_ll_close(struct hid_device *hdev)
+
+ mutex_lock(&steam->mutex);
+ steam->client_opened = false;
+- if (steam->input_opened)
+- steam_set_lizard_mode(steam, false);
+- else
+- steam_set_lizard_mode(steam, lizard_mode);
+ mutex_unlock(&steam->mutex);
+
+ hid_hw_close(steam->hdev);
++ if (steam->connected) {
++ steam_set_lizard_mode(steam, lizard_mode);
++ steam_input_register(steam);
++ }
+ }
+
+ static int steam_client_ll_raw_request(struct hid_device *hdev,
+@@ -744,11 +779,6 @@ static int steam_probe(struct hid_device *hdev,
+ }
+ }
+
+- mutex_lock(&steam_devices_lock);
+- steam_update_lizard_mode(steam);
+- list_add(&steam->list, &steam_devices);
+- mutex_unlock(&steam_devices_lock);
+-
+ return 0;
+
+ hid_hw_open_fail:
+@@ -774,10 +804,6 @@ static void steam_remove(struct hid_device *hdev)
+ return;
+ }
+
+- mutex_lock(&steam_devices_lock);
+- list_del(&steam->list);
+- mutex_unlock(&steam_devices_lock);
+-
+ hid_destroy_device(steam->client_hdev);
+ steam->client_opened = false;
+ cancel_work_sync(&steam->work_connect);
+@@ -792,12 +818,14 @@ static void steam_remove(struct hid_device *hdev)
+ static void steam_do_connect_event(struct steam_device *steam, bool connected)
+ {
+ unsigned long flags;
++ bool changed;
+
+ spin_lock_irqsave(&steam->lock, flags);
++ changed = steam->connected != connected;
+ steam->connected = connected;
+ spin_unlock_irqrestore(&steam->lock, flags);
+
+- if (schedule_work(&steam->work_connect) == 0)
++ if (changed && schedule_work(&steam->work_connect) == 0)
+ dbg_hid("%s: connected=%d event already queued\n",
+ __func__, connected);
+ }
+@@ -1019,13 +1047,8 @@ static int steam_raw_event(struct hid_device *hdev,
+ return 0;
+ rcu_read_lock();
+ input = rcu_dereference(steam->input);
+- if (likely(input)) {
++ if (likely(input))
+ steam_do_input_event(steam, input, data);
+- } else {
+- dbg_hid("%s: input data without connect event\n",
+- __func__);
+- steam_do_connect_event(steam, true);
+- }
+ rcu_read_unlock();
+ break;
+ case STEAM_EV_CONNECT:
+@@ -1074,7 +1097,10 @@ static int steam_param_set_lizard_mode(const char *val,
+
+ mutex_lock(&steam_devices_lock);
+ list_for_each_entry(steam, &steam_devices, list) {
+- steam_update_lizard_mode(steam);
++ mutex_lock(&steam->mutex);
++ if (!steam->client_opened)
++ steam_set_lizard_mode(steam, lizard_mode);
++ mutex_unlock(&steam->mutex);
+ }
+ mutex_unlock(&steam_devices_lock);
+ return 0;
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index 5c88706121c1..39134dd305f5 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -328,7 +328,6 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ u8 opcode, sc, vl;
+ u16 pkey;
+ u32 slid;
+- int req_queued = 0;
+ u16 dlid;
+ u32 selector;
+
+@@ -392,7 +391,6 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ req->data_len = 0;
+ req->pq = pq;
+ req->cq = cq;
+- req->status = -1;
+ req->ahg_idx = -1;
+ req->iov_idx = 0;
+ req->sent = 0;
+@@ -400,12 +398,14 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ req->seqcomp = 0;
+ req->seqsubmitted = 0;
+ req->tids = NULL;
+- req->done = 0;
+ req->has_error = 0;
+ INIT_LIST_HEAD(&req->txps);
+
+ memcpy(&req->info, &info, sizeof(info));
+
++ /* The request is initialized, count it */
++ atomic_inc(&pq->n_reqs);
++
+ if (req_opcode(info.ctrl) == EXPECTED) {
+ /* expected must have a TID info and at least one data vector */
+ if (req->data_iovs < 2) {
+@@ -500,7 +500,6 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ ret = pin_vector_pages(req, &req->iovs[i]);
+ if (ret) {
+ req->data_iovs = i;
+- req->status = ret;
+ goto free_req;
+ }
+ req->data_len += req->iovs[i].iov.iov_len;
+@@ -561,14 +560,10 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ req->ahg_idx = sdma_ahg_alloc(req->sde);
+
+ set_comp_state(pq, cq, info.comp_idx, QUEUED, 0);
+- atomic_inc(&pq->n_reqs);
+- req_queued = 1;
+ /* Send the first N packets in the request to buy us some time */
+ ret = user_sdma_send_pkts(req, pcount);
+- if (unlikely(ret < 0 && ret != -EBUSY)) {
+- req->status = ret;
++ if (unlikely(ret < 0 && ret != -EBUSY))
+ goto free_req;
+- }
+
+ /*
+ * It is possible that the SDMA engine would have processed all the
+@@ -588,14 +583,8 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ while (req->seqsubmitted != req->info.npkts) {
+ ret = user_sdma_send_pkts(req, pcount);
+ if (ret < 0) {
+- if (ret != -EBUSY) {
+- req->status = ret;
+- WRITE_ONCE(req->has_error, 1);
+- if (READ_ONCE(req->seqcomp) ==
+- req->seqsubmitted - 1)
+- goto free_req;
+- return ret;
+- }
++ if (ret != -EBUSY)
++ goto free_req;
+ wait_event_interruptible_timeout(
+ pq->busy.wait_dma,
+ (pq->state == SDMA_PKT_Q_ACTIVE),
+@@ -606,10 +595,19 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ *count += idx;
+ return 0;
+ free_req:
+- user_sdma_free_request(req, true);
+- if (req_queued)
++ /*
++ * If the submitted seqsubmitted == npkts, the completion routine
++ * controls the final state. If sequbmitted < npkts, wait for any
++ * outstanding packets to finish before cleaning up.
++ */
++ if (req->seqsubmitted < req->info.npkts) {
++ if (req->seqsubmitted)
++ wait_event(pq->busy.wait_dma,
++ (req->seqcomp == req->seqsubmitted - 1));
++ user_sdma_free_request(req, true);
+ pq_update(pq);
+- set_comp_state(pq, cq, info.comp_idx, ERROR, req->status);
++ set_comp_state(pq, cq, info.comp_idx, ERROR, ret);
++ }
+ return ret;
+ }
+
+@@ -917,7 +915,6 @@ dosend:
+ ret = sdma_send_txlist(req->sde, &pq->busy, &req->txps, &count);
+ req->seqsubmitted += count;
+ if (req->seqsubmitted == req->info.npkts) {
+- WRITE_ONCE(req->done, 1);
+ /*
+ * The txreq has already been submitted to the HW queue
+ * so we can free the AHG entry now. Corruption will not
+@@ -1365,11 +1362,15 @@ static int set_txreq_header_ahg(struct user_sdma_request *req,
+ return idx;
+ }
+
+-/*
+- * SDMA tx request completion callback. Called when the SDMA progress
+- * state machine gets notification that the SDMA descriptors for this
+- * tx request have been processed by the DMA engine. Called in
+- * interrupt context.
++/**
++ * user_sdma_txreq_cb() - SDMA tx request completion callback.
++ * @txreq: valid sdma tx request
++ * @status: success/failure of request
++ *
++ * Called when the SDMA progress state machine gets notification that
++ * the SDMA descriptors for this tx request have been processed by the
++ * DMA engine. Called in interrupt context.
++ * Only do work on completed sequences.
+ */
+ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status)
+ {
+@@ -1378,7 +1379,7 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status)
+ struct user_sdma_request *req;
+ struct hfi1_user_sdma_pkt_q *pq;
+ struct hfi1_user_sdma_comp_q *cq;
+- u16 idx;
++ enum hfi1_sdma_comp_state state = COMPLETE;
+
+ if (!tx->req)
+ return;
+@@ -1391,31 +1392,19 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status)
+ SDMA_DBG(req, "SDMA completion with error %d",
+ status);
+ WRITE_ONCE(req->has_error, 1);
++ state = ERROR;
+ }
+
+ req->seqcomp = tx->seqnum;
+ kmem_cache_free(pq->txreq_cache, tx);
+- tx = NULL;
+-
+- idx = req->info.comp_idx;
+- if (req->status == -1 && status == SDMA_TXREQ_S_OK) {
+- if (req->seqcomp == req->info.npkts - 1) {
+- req->status = 0;
+- user_sdma_free_request(req, false);
+- pq_update(pq);
+- set_comp_state(pq, cq, idx, COMPLETE, 0);
+- }
+- } else {
+- if (status != SDMA_TXREQ_S_OK)
+- req->status = status;
+- if (req->seqcomp == (READ_ONCE(req->seqsubmitted) - 1) &&
+- (READ_ONCE(req->done) ||
+- READ_ONCE(req->has_error))) {
+- user_sdma_free_request(req, false);
+- pq_update(pq);
+- set_comp_state(pq, cq, idx, ERROR, req->status);
+- }
+- }
++
++ /* sequence isn't complete? We are done */
++ if (req->seqcomp != req->info.npkts - 1)
++ return;
++
++ user_sdma_free_request(req, false);
++ set_comp_state(pq, cq, req->info.comp_idx, state, status);
++ pq_update(pq);
+ }
+
+ static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq)
+@@ -1448,6 +1437,8 @@ static void user_sdma_free_request(struct user_sdma_request *req, bool unpin)
+ if (!node)
+ continue;
+
++ req->iovs[i].node = NULL;
++
+ if (unpin)
+ hfi1_mmu_rb_remove(req->pq->handler,
+ &node->rb);
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h
+index d2bc77f75253..0ae06456c868 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.h
++++ b/drivers/infiniband/hw/hfi1/user_sdma.h
+@@ -205,8 +205,6 @@ struct user_sdma_request {
+ /* Writeable fields shared with interrupt */
+ u64 seqcomp ____cacheline_aligned_in_smp;
+ u64 seqsubmitted;
+- /* status of the last txreq completed */
+- int status;
+
+ /* Send side fields */
+ struct list_head txps ____cacheline_aligned_in_smp;
+@@ -228,7 +226,6 @@ struct user_sdma_request {
+ u16 tididx;
+ /* progress index moving along the iovs array */
+ u8 iov_idx;
+- u8 done;
+ u8 has_error;
+
+ struct user_sdma_iovec iovs[MAX_VECTORS_PER_REQ];
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 55d33500d55e..5e85f3cca867 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -99,9 +99,7 @@ static int synaptics_mode_cmd(struct psmouse *psmouse, u8 mode)
+ int synaptics_detect(struct psmouse *psmouse, bool set_properties)
+ {
+ struct ps2dev *ps2dev = &psmouse->ps2dev;
+- u8 param[4];
+-
+- param[0] = 0;
++ u8 param[4] = { 0 };
+
+ ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES);
+ ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES);
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 7b662bd1c7a0..30b15e91d8be 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -288,10 +288,10 @@ static const struct reg_value ov5640_init_setting_30fps_VGA[] = {
+ {0x3a0d, 0x04, 0, 0}, {0x3a14, 0x03, 0, 0}, {0x3a15, 0xd8, 0, 0},
+ {0x4001, 0x02, 0, 0}, {0x4004, 0x02, 0, 0}, {0x3000, 0x00, 0, 0},
+ {0x3002, 0x1c, 0, 0}, {0x3004, 0xff, 0, 0}, {0x3006, 0xc3, 0, 0},
+- {0x300e, 0x45, 0, 0}, {0x302e, 0x08, 0, 0}, {0x4300, 0x3f, 0, 0},
++ {0x302e, 0x08, 0, 0}, {0x4300, 0x3f, 0, 0},
+ {0x501f, 0x00, 0, 0}, {0x4713, 0x03, 0, 0}, {0x4407, 0x04, 0, 0},
+ {0x440e, 0x00, 0, 0}, {0x460b, 0x35, 0, 0}, {0x460c, 0x22, 0, 0},
+- {0x4837, 0x0a, 0, 0}, {0x4800, 0x04, 0, 0}, {0x3824, 0x02, 0, 0},
++ {0x4837, 0x0a, 0, 0}, {0x3824, 0x02, 0, 0},
+ {0x5000, 0xa7, 0, 0}, {0x5001, 0xa3, 0, 0}, {0x5180, 0xff, 0, 0},
+ {0x5181, 0xf2, 0, 0}, {0x5182, 0x00, 0, 0}, {0x5183, 0x14, 0, 0},
+ {0x5184, 0x25, 0, 0}, {0x5185, 0x24, 0, 0}, {0x5186, 0x09, 0, 0},
+@@ -910,6 +910,26 @@ static int ov5640_mod_reg(struct ov5640_dev *sensor, u16 reg,
+ }
+
+ /* download ov5640 settings to sensor through i2c */
++static int ov5640_set_timings(struct ov5640_dev *sensor,
++ const struct ov5640_mode_info *mode)
++{
++ int ret;
++
++ ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPHO, mode->hact);
++ if (ret < 0)
++ return ret;
++
++ ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPVO, mode->vact);
++ if (ret < 0)
++ return ret;
++
++ ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_HTS, mode->htot);
++ if (ret < 0)
++ return ret;
++
++ return ov5640_write_reg16(sensor, OV5640_REG_TIMING_VTS, mode->vtot);
++}
++
+ static int ov5640_load_regs(struct ov5640_dev *sensor,
+ const struct ov5640_mode_info *mode)
+ {
+@@ -937,7 +957,13 @@ static int ov5640_load_regs(struct ov5640_dev *sensor,
+ usleep_range(1000 * delay_ms, 1000 * delay_ms + 100);
+ }
+
+- return ret;
++ return ov5640_set_timings(sensor, mode);
++}
++
++static int ov5640_set_autoexposure(struct ov5640_dev *sensor, bool on)
++{
++ return ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL,
++ BIT(0), on ? 0 : BIT(0));
+ }
+
+ /* read exposure, in number of line periods */
+@@ -996,6 +1022,18 @@ static int ov5640_get_gain(struct ov5640_dev *sensor)
+ return gain & 0x3ff;
+ }
+
++static int ov5640_set_gain(struct ov5640_dev *sensor, int gain)
++{
++ return ov5640_write_reg16(sensor, OV5640_REG_AEC_PK_REAL_GAIN,
++ (u16)gain & 0x3ff);
++}
++
++static int ov5640_set_autogain(struct ov5640_dev *sensor, bool on)
++{
++ return ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL,
++ BIT(1), on ? 0 : BIT(1));
++}
++
+ static int ov5640_set_stream_dvp(struct ov5640_dev *sensor, bool on)
+ {
+ int ret;
+@@ -1104,12 +1142,25 @@ static int ov5640_set_stream_mipi(struct ov5640_dev *sensor, bool on)
+ {
+ int ret;
+
+- ret = ov5640_mod_reg(sensor, OV5640_REG_MIPI_CTRL00, BIT(5),
+- on ? 0 : BIT(5));
+- if (ret)
+- return ret;
+- ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT00,
+- on ? 0x00 : 0x70);
++ /*
++ * Enable/disable the MIPI interface
++ *
++ * 0x300e = on ? 0x45 : 0x40
++ *
++ * FIXME: the sensor manual (version 2.03) reports
++ * [7:5] = 000 : 1 data lane mode
++ * [7:5] = 001 : 2 data lanes mode
++ * But this settings do not work, while the following ones
++ * have been validated for 2 data lanes mode.
++ *
++ * [7:5] = 010 : 2 data lanes mode
++ * [4] = 0 : Power up MIPI HS Tx
++ * [3] = 0 : Power up MIPI LS Rx
++ * [2] = 1/0 : MIPI interface enable/disable
++ * [1:0] = 01/00: FIXME: 'debug'
++ */
++ ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00,
++ on ? 0x45 : 0x40);
+ if (ret)
+ return ret;
+
+@@ -1333,7 +1384,7 @@ static int ov5640_set_ae_target(struct ov5640_dev *sensor, int target)
+ return ov5640_write_reg(sensor, OV5640_REG_AEC_CTRL1F, fast_low);
+ }
+
+-static int ov5640_binning_on(struct ov5640_dev *sensor)
++static int ov5640_get_binning(struct ov5640_dev *sensor)
+ {
+ u8 temp;
+ int ret;
+@@ -1341,8 +1392,8 @@ static int ov5640_binning_on(struct ov5640_dev *sensor)
+ ret = ov5640_read_reg(sensor, OV5640_REG_TIMING_TC_REG21, &temp);
+ if (ret)
+ return ret;
+- temp &= 0xfe;
+- return temp ? 1 : 0;
++
++ return temp & BIT(0);
+ }
+
+ static int ov5640_set_binning(struct ov5640_dev *sensor, bool enable)
+@@ -1387,30 +1438,6 @@ static int ov5640_set_virtual_channel(struct ov5640_dev *sensor)
+ return ov5640_write_reg(sensor, OV5640_REG_DEBUG_MODE, temp);
+ }
+
+-static int ov5640_set_timings(struct ov5640_dev *sensor,
+- const struct ov5640_mode_info *mode)
+-{
+- int ret;
+-
+- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPHO, mode->hact);
+- if (ret < 0)
+- return ret;
+-
+- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPVO, mode->vact);
+- if (ret < 0)
+- return ret;
+-
+- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_HTS, mode->htot);
+- if (ret < 0)
+- return ret;
+-
+- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_VTS, mode->vtot);
+- if (ret < 0)
+- return ret;
+-
+- return 0;
+-}
+-
+ static const struct ov5640_mode_info *
+ ov5640_find_mode(struct ov5640_dev *sensor, enum ov5640_frame_rate fr,
+ int width, int height, bool nearest)
+@@ -1452,7 +1479,7 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor,
+ if (ret < 0)
+ return ret;
+ prev_shutter = ret;
+- ret = ov5640_binning_on(sensor);
++ ret = ov5640_get_binning(sensor);
+ if (ret < 0)
+ return ret;
+ if (ret && mode->id != OV5640_MODE_720P_1280_720 &&
+@@ -1573,7 +1600,7 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor,
+ }
+
+ /* set capture gain */
+- ret = __v4l2_ctrl_s_ctrl(sensor->ctrls.gain, cap_gain16);
++ ret = ov5640_set_gain(sensor, cap_gain16);
+ if (ret)
+ return ret;
+
+@@ -1586,7 +1613,7 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor,
+ }
+
+ /* set exposure */
+- return __v4l2_ctrl_s_ctrl(sensor->ctrls.exposure, cap_shutter);
++ return ov5640_set_exposure(sensor, cap_shutter);
+ }
+
+ /*
+@@ -1594,25 +1621,13 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor,
+ * change mode directly
+ */
+ static int ov5640_set_mode_direct(struct ov5640_dev *sensor,
+- const struct ov5640_mode_info *mode,
+- s32 exposure)
++ const struct ov5640_mode_info *mode)
+ {
+- int ret;
+-
+ if (!mode->reg_data)
+ return -EINVAL;
+
+ /* Write capture setting */
+- ret = ov5640_load_regs(sensor, mode);
+- if (ret < 0)
+- return ret;
+-
+- /* turn auto gain/exposure back on for direct mode */
+- ret = __v4l2_ctrl_s_ctrl(sensor->ctrls.auto_gain, 1);
+- if (ret)
+- return ret;
+-
+- return __v4l2_ctrl_s_ctrl(sensor->ctrls.auto_exp, exposure);
++ return ov5640_load_regs(sensor, mode);
+ }
+
+ static int ov5640_set_mode(struct ov5640_dev *sensor)
+@@ -1620,27 +1635,31 @@ static int ov5640_set_mode(struct ov5640_dev *sensor)
+ const struct ov5640_mode_info *mode = sensor->current_mode;
+ const struct ov5640_mode_info *orig_mode = sensor->last_mode;
+ enum ov5640_downsize_mode dn_mode, orig_dn_mode;
+- s32 exposure;
++ bool auto_gain = sensor->ctrls.auto_gain->val == 1;
++ bool auto_exp = sensor->ctrls.auto_exp->val == V4L2_EXPOSURE_AUTO;
+ int ret;
+
+ dn_mode = mode->dn_mode;
+ orig_dn_mode = orig_mode->dn_mode;
+
+ /* auto gain and exposure must be turned off when changing modes */
+- ret = __v4l2_ctrl_s_ctrl(sensor->ctrls.auto_gain, 0);
+- if (ret)
+- return ret;
++ if (auto_gain) {
++ ret = ov5640_set_autogain(sensor, false);
++ if (ret)
++ return ret;
++ }
+
+- exposure = sensor->ctrls.auto_exp->val;
+- ret = ov5640_set_exposure(sensor, V4L2_EXPOSURE_MANUAL);
+- if (ret)
+- return ret;
++ if (auto_exp) {
++ ret = ov5640_set_autoexposure(sensor, false);
++ if (ret)
++ goto restore_auto_gain;
++ }
+
+ if ((dn_mode == SUBSAMPLING && orig_dn_mode == SCALING) ||
+ (dn_mode == SCALING && orig_dn_mode == SUBSAMPLING)) {
+ /*
+ * change between subsampling and scaling
+- * go through exposure calucation
++ * go through exposure calculation
+ */
+ ret = ov5640_set_mode_exposure_calc(sensor, mode);
+ } else {
+@@ -1648,15 +1667,16 @@ static int ov5640_set_mode(struct ov5640_dev *sensor)
+ * change inside subsampling or scaling
+ * download firmware directly
+ */
+- ret = ov5640_set_mode_direct(sensor, mode, exposure);
++ ret = ov5640_set_mode_direct(sensor, mode);
+ }
+-
+ if (ret < 0)
+- return ret;
++ goto restore_auto_exp_gain;
+
+- ret = ov5640_set_timings(sensor, mode);
+- if (ret < 0)
+- return ret;
++ /* restore auto gain and exposure */
++ if (auto_gain)
++ ov5640_set_autogain(sensor, true);
++ if (auto_exp)
++ ov5640_set_autoexposure(sensor, true);
+
+ ret = ov5640_set_binning(sensor, dn_mode != SCALING);
+ if (ret < 0)
+@@ -1678,6 +1698,15 @@ static int ov5640_set_mode(struct ov5640_dev *sensor)
+ sensor->last_mode = mode;
+
+ return 0;
++
++restore_auto_exp_gain:
++ if (auto_exp)
++ ov5640_set_autoexposure(sensor, true);
++restore_auto_gain:
++ if (auto_gain)
++ ov5640_set_autogain(sensor, true);
++
++ return ret;
+ }
+
+ static int ov5640_set_framefmt(struct ov5640_dev *sensor,
+@@ -1790,23 +1819,69 @@ static int ov5640_set_power(struct ov5640_dev *sensor, bool on)
+ if (ret)
+ goto power_off;
+
++ /* We're done here for DVP bus, while CSI-2 needs setup. */
++ if (sensor->ep.bus_type != V4L2_MBUS_CSI2)
++ return 0;
++
++ /*
++ * Power up MIPI HS Tx and LS Rx; 2 data lanes mode
++ *
++ * 0x300e = 0x40
++ * [7:5] = 010 : 2 data lanes mode (see FIXME note in
++ * "ov5640_set_stream_mipi()")
++ * [4] = 0 : Power up MIPI HS Tx
++ * [3] = 0 : Power up MIPI LS Rx
++ * [2] = 0 : MIPI interface disabled
++ */
++ ret = ov5640_write_reg(sensor,
++ OV5640_REG_IO_MIPI_CTRL00, 0x40);
++ if (ret)
++ goto power_off;
++
++ /*
++ * Gate clock and set LP11 in 'no packets mode' (idle)
++ *
++ * 0x4800 = 0x24
++ * [5] = 1 : Gate clock when 'no packets'
++ * [2] = 1 : MIPI bus in LP11 when 'no packets'
++ */
++ ret = ov5640_write_reg(sensor,
++ OV5640_REG_MIPI_CTRL00, 0x24);
++ if (ret)
++ goto power_off;
++
++ /*
++ * Set data lanes and clock in LP11 when 'sleeping'
++ *
++ * 0x3019 = 0x70
++ * [6] = 1 : MIPI data lane 2 in LP11 when 'sleeping'
++ * [5] = 1 : MIPI data lane 1 in LP11 when 'sleeping'
++ * [4] = 1 : MIPI clock lane in LP11 when 'sleeping'
++ */
++ ret = ov5640_write_reg(sensor,
++ OV5640_REG_PAD_OUTPUT00, 0x70);
++ if (ret)
++ goto power_off;
++
++ /* Give lanes some time to coax into LP11 state. */
++ usleep_range(500, 1000);
++
++ } else {
+ if (sensor->ep.bus_type == V4L2_MBUS_CSI2) {
+- /*
+- * start streaming briefly followed by stream off in
+- * order to coax the clock lane into LP-11 state.
+- */
+- ret = ov5640_set_stream_mipi(sensor, true);
+- if (ret)
+- goto power_off;
+- usleep_range(1000, 2000);
+- ret = ov5640_set_stream_mipi(sensor, false);
+- if (ret)
+- goto power_off;
++ /* Reset MIPI bus settings to their default values. */
++ ov5640_write_reg(sensor,
++ OV5640_REG_IO_MIPI_CTRL00, 0x58);
++ ov5640_write_reg(sensor,
++ OV5640_REG_MIPI_CTRL00, 0x04);
++ ov5640_write_reg(sensor,
++ OV5640_REG_PAD_OUTPUT00, 0x00);
+ }
+
+- return 0;
++ ov5640_set_power_off(sensor);
+ }
+
++ return 0;
++
+ power_off:
+ ov5640_set_power_off(sensor);
+ return ret;
+@@ -2144,20 +2219,20 @@ static int ov5640_set_ctrl_white_balance(struct ov5640_dev *sensor, int awb)
+ return ret;
+ }
+
+-static int ov5640_set_ctrl_exposure(struct ov5640_dev *sensor, int exp)
++static int ov5640_set_ctrl_exposure(struct ov5640_dev *sensor,
++ enum v4l2_exposure_auto_type auto_exposure)
+ {
+ struct ov5640_ctrls *ctrls = &sensor->ctrls;
+- bool auto_exposure = (exp == V4L2_EXPOSURE_AUTO);
++ bool auto_exp = (auto_exposure == V4L2_EXPOSURE_AUTO);
+ int ret = 0;
+
+ if (ctrls->auto_exp->is_new) {
+- ret = ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL,
+- BIT(0), auto_exposure ? 0 : BIT(0));
++ ret = ov5640_set_autoexposure(sensor, auto_exp);
+ if (ret)
+ return ret;
+ }
+
+- if (!auto_exposure && ctrls->exposure->is_new) {
++ if (!auto_exp && ctrls->exposure->is_new) {
+ u16 max_exp;
+
+ ret = ov5640_read_reg16(sensor, OV5640_REG_AEC_PK_VTS,
+@@ -2177,25 +2252,19 @@ static int ov5640_set_ctrl_exposure(struct ov5640_dev *sensor, int exp)
+ return ret;
+ }
+
+-static int ov5640_set_ctrl_gain(struct ov5640_dev *sensor, int auto_gain)
++static int ov5640_set_ctrl_gain(struct ov5640_dev *sensor, bool auto_gain)
+ {
+ struct ov5640_ctrls *ctrls = &sensor->ctrls;
+ int ret = 0;
+
+ if (ctrls->auto_gain->is_new) {
+- ret = ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL,
+- BIT(1),
+- ctrls->auto_gain->val ? 0 : BIT(1));
++ ret = ov5640_set_autogain(sensor, auto_gain);
+ if (ret)
+ return ret;
+ }
+
+- if (!auto_gain && ctrls->gain->is_new) {
+- u16 gain = (u16)ctrls->gain->val;
+-
+- ret = ov5640_write_reg16(sensor, OV5640_REG_AEC_PK_REAL_GAIN,
+- gain & 0x3ff);
+- }
++ if (!auto_gain && ctrls->gain->is_new)
++ ret = ov5640_set_gain(sensor, ctrls->gain->val);
+
+ return ret;
+ }
+@@ -2268,16 +2337,12 @@ static int ov5640_g_volatile_ctrl(struct v4l2_ctrl *ctrl)
+
+ switch (ctrl->id) {
+ case V4L2_CID_AUTOGAIN:
+- if (!ctrl->val)
+- return 0;
+ val = ov5640_get_gain(sensor);
+ if (val < 0)
+ return val;
+ sensor->ctrls.gain->val = val;
+ break;
+ case V4L2_CID_EXPOSURE_AUTO:
+- if (ctrl->val == V4L2_EXPOSURE_MANUAL)
+- return 0;
+ val = ov5640_get_exposure(sensor);
+ if (val < 0)
+ return val;
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index 7bfd366d970d..c4115bae5db1 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -12,6 +12,7 @@
+ * - JMicron (hardware and technical support)
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/string.h>
+ #include <linux/delay.h>
+ #include <linux/highmem.h>
+@@ -462,6 +463,9 @@ struct intel_host {
+ u32 dsm_fns;
+ int drv_strength;
+ bool d3_retune;
++ bool rpm_retune_ok;
++ u32 glk_rx_ctrl1;
++ u32 glk_tun_val;
+ };
+
+ static const guid_t intel_dsm_guid =
+@@ -791,6 +795,77 @@ cleanup:
+ return ret;
+ }
+
++#ifdef CONFIG_PM
++#define GLK_RX_CTRL1 0x834
++#define GLK_TUN_VAL 0x840
++#define GLK_PATH_PLL GENMASK(13, 8)
++#define GLK_DLY GENMASK(6, 0)
++/* Workaround firmware failing to restore the tuning value */
++static void glk_rpm_retune_wa(struct sdhci_pci_chip *chip, bool susp)
++{
++ struct sdhci_pci_slot *slot = chip->slots[0];
++ struct intel_host *intel_host = sdhci_pci_priv(slot);
++ struct sdhci_host *host = slot->host;
++ u32 glk_rx_ctrl1;
++ u32 glk_tun_val;
++ u32 dly;
++
++ if (intel_host->rpm_retune_ok || !mmc_can_retune(host->mmc))
++ return;
++
++ glk_rx_ctrl1 = sdhci_readl(host, GLK_RX_CTRL1);
++ glk_tun_val = sdhci_readl(host, GLK_TUN_VAL);
++
++ if (susp) {
++ intel_host->glk_rx_ctrl1 = glk_rx_ctrl1;
++ intel_host->glk_tun_val = glk_tun_val;
++ return;
++ }
++
++ if (!intel_host->glk_tun_val)
++ return;
++
++ if (glk_rx_ctrl1 != intel_host->glk_rx_ctrl1) {
++ intel_host->rpm_retune_ok = true;
++ return;
++ }
++
++ dly = FIELD_PREP(GLK_DLY, FIELD_GET(GLK_PATH_PLL, glk_rx_ctrl1) +
++ (intel_host->glk_tun_val << 1));
++ if (dly == FIELD_GET(GLK_DLY, glk_rx_ctrl1))
++ return;
++
++ glk_rx_ctrl1 = (glk_rx_ctrl1 & ~GLK_DLY) | dly;
++ sdhci_writel(host, glk_rx_ctrl1, GLK_RX_CTRL1);
++
++ intel_host->rpm_retune_ok = true;
++ chip->rpm_retune = true;
++ mmc_retune_needed(host->mmc);
++ pr_info("%s: Requiring re-tune after rpm resume", mmc_hostname(host->mmc));
++}
++
++static void glk_rpm_retune_chk(struct sdhci_pci_chip *chip, bool susp)
++{
++ if (chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC &&
++ !chip->rpm_retune)
++ glk_rpm_retune_wa(chip, susp);
++}
++
++static int glk_runtime_suspend(struct sdhci_pci_chip *chip)
++{
++ glk_rpm_retune_chk(chip, true);
++
++ return sdhci_cqhci_runtime_suspend(chip);
++}
++
++static int glk_runtime_resume(struct sdhci_pci_chip *chip)
++{
++ glk_rpm_retune_chk(chip, false);
++
++ return sdhci_cqhci_runtime_resume(chip);
++}
++#endif
++
+ #ifdef CONFIG_ACPI
+ static int ni_set_max_freq(struct sdhci_pci_slot *slot)
+ {
+@@ -879,8 +954,8 @@ static const struct sdhci_pci_fixes sdhci_intel_glk_emmc = {
+ .resume = sdhci_cqhci_resume,
+ #endif
+ #ifdef CONFIG_PM
+- .runtime_suspend = sdhci_cqhci_runtime_suspend,
+- .runtime_resume = sdhci_cqhci_runtime_resume,
++ .runtime_suspend = glk_runtime_suspend,
++ .runtime_resume = glk_runtime_resume,
+ #endif
+ .quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC,
+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
+@@ -1762,8 +1837,13 @@ static struct sdhci_pci_slot *sdhci_pci_probe_slot(
+ device_init_wakeup(&pdev->dev, true);
+
+ if (slot->cd_idx >= 0) {
+- ret = mmc_gpiod_request_cd(host->mmc, NULL, slot->cd_idx,
++ ret = mmc_gpiod_request_cd(host->mmc, "cd", slot->cd_idx,
+ slot->cd_override_level, 0, NULL);
++ if (ret && ret != -EPROBE_DEFER)
++ ret = mmc_gpiod_request_cd(host->mmc, NULL,
++ slot->cd_idx,
++ slot->cd_override_level,
++ 0, NULL);
+ if (ret == -EPROBE_DEFER)
+ goto remove;
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 49163570a63a..3b3f88ffab53 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -477,6 +477,34 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
+ }
+ EXPORT_SYMBOL_GPL(can_put_echo_skb);
+
++struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
++{
++ struct can_priv *priv = netdev_priv(dev);
++ struct sk_buff *skb = priv->echo_skb[idx];
++ struct canfd_frame *cf;
++
++ if (idx >= priv->echo_skb_max) {
++ netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
++ __func__, idx, priv->echo_skb_max);
++ return NULL;
++ }
++
++ if (!skb) {
++ netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
++ __func__, idx);
++ return NULL;
++ }
++
++ /* Using "struct canfd_frame::len" for the frame
++ * length is supported on both CAN and CANFD frames.
++ */
++ cf = (struct canfd_frame *)skb->data;
++ *len_ptr = cf->len;
++ priv->echo_skb[idx] = NULL;
++
++ return skb;
++}
++
+ /*
+ * Get the skb from the stack and loop it back locally
+ *
+@@ -486,22 +514,16 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
+ */
+ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
+ {
+- struct can_priv *priv = netdev_priv(dev);
+-
+- BUG_ON(idx >= priv->echo_skb_max);
+-
+- if (priv->echo_skb[idx]) {
+- struct sk_buff *skb = priv->echo_skb[idx];
+- struct can_frame *cf = (struct can_frame *)skb->data;
+- u8 dlc = cf->can_dlc;
++ struct sk_buff *skb;
++ u8 len;
+
+- netif_rx(priv->echo_skb[idx]);
+- priv->echo_skb[idx] = NULL;
++ skb = __can_get_echo_skb(dev, idx, &len);
++ if (!skb)
++ return 0;
+
+- return dlc;
+- }
++ netif_rx(skb);
+
+- return 0;
++ return len;
+ }
+ EXPORT_SYMBOL_GPL(can_get_echo_skb);
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 8e972ef08637..75ce11395ee8 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -135,13 +135,12 @@
+
+ /* FLEXCAN interrupt flag register (IFLAG) bits */
+ /* Errata ERR005829 step7: Reserve first valid MB */
+-#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO 8
+-#define FLEXCAN_TX_MB_OFF_FIFO 9
++#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO 8
+ #define FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP 0
+-#define FLEXCAN_TX_MB_OFF_TIMESTAMP 1
+-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST (FLEXCAN_TX_MB_OFF_TIMESTAMP + 1)
+-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST 63
+-#define FLEXCAN_IFLAG_MB(x) BIT(x)
++#define FLEXCAN_TX_MB 63
++#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST (FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP + 1)
++#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST (FLEXCAN_TX_MB - 1)
++#define FLEXCAN_IFLAG_MB(x) BIT(x & 0x1f)
+ #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW BIT(7)
+ #define FLEXCAN_IFLAG_RX_FIFO_WARN BIT(6)
+ #define FLEXCAN_IFLAG_RX_FIFO_AVAILABLE BIT(5)
+@@ -259,9 +258,7 @@ struct flexcan_priv {
+ struct can_rx_offload offload;
+
+ struct flexcan_regs __iomem *regs;
+- struct flexcan_mb __iomem *tx_mb;
+ struct flexcan_mb __iomem *tx_mb_reserved;
+- u8 tx_mb_idx;
+ u32 reg_ctrl_default;
+ u32 reg_imask1_default;
+ u32 reg_imask2_default;
+@@ -515,6 +512,7 @@ static int flexcan_get_berr_counter(const struct net_device *dev,
+ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ const struct flexcan_priv *priv = netdev_priv(dev);
++ struct flexcan_regs __iomem *regs = priv->regs;
+ struct can_frame *cf = (struct can_frame *)skb->data;
+ u32 can_id;
+ u32 data;
+@@ -537,17 +535,17 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de
+
+ if (cf->can_dlc > 0) {
+ data = be32_to_cpup((__be32 *)&cf->data[0]);
+- priv->write(data, &priv->tx_mb->data[0]);
++ priv->write(data, ®s->mb[FLEXCAN_TX_MB].data[0]);
+ }
+ if (cf->can_dlc > 4) {
+ data = be32_to_cpup((__be32 *)&cf->data[4]);
+- priv->write(data, &priv->tx_mb->data[1]);
++ priv->write(data, ®s->mb[FLEXCAN_TX_MB].data[1]);
+ }
+
+ can_put_echo_skb(skb, dev, 0);
+
+- priv->write(can_id, &priv->tx_mb->can_id);
+- priv->write(ctrl, &priv->tx_mb->can_ctrl);
++ priv->write(can_id, ®s->mb[FLEXCAN_TX_MB].can_id);
++ priv->write(ctrl, ®s->mb[FLEXCAN_TX_MB].can_ctrl);
+
+ /* Errata ERR005829 step8:
+ * Write twice INACTIVE(0x8) code to first MB.
+@@ -563,9 +561,13 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de
+ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ {
+ struct flexcan_priv *priv = netdev_priv(dev);
++ struct flexcan_regs __iomem *regs = priv->regs;
+ struct sk_buff *skb;
+ struct can_frame *cf;
+ bool rx_errors = false, tx_errors = false;
++ u32 timestamp;
++
++ timestamp = priv->read(®s->timer) << 16;
+
+ skb = alloc_can_err_skb(dev, &cf);
+ if (unlikely(!skb))
+@@ -612,17 +614,21 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ if (tx_errors)
+ dev->stats.tx_errors++;
+
+- can_rx_offload_irq_queue_err_skb(&priv->offload, skb);
++ can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+ }
+
+ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ {
+ struct flexcan_priv *priv = netdev_priv(dev);
++ struct flexcan_regs __iomem *regs = priv->regs;
+ struct sk_buff *skb;
+ struct can_frame *cf;
+ enum can_state new_state, rx_state, tx_state;
+ int flt;
+ struct can_berr_counter bec;
++ u32 timestamp;
++
++ timestamp = priv->read(®s->timer) << 16;
+
+ flt = reg_esr & FLEXCAN_ESR_FLT_CONF_MASK;
+ if (likely(flt == FLEXCAN_ESR_FLT_CONF_ACTIVE)) {
+@@ -652,7 +658,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ if (unlikely(new_state == CAN_STATE_BUS_OFF))
+ can_bus_off(dev);
+
+- can_rx_offload_irq_queue_err_skb(&priv->offload, skb);
++ can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+ }
+
+ static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload)
+@@ -720,9 +726,14 @@ static unsigned int flexcan_mailbox_read(struct can_rx_offload *offload,
+ priv->write(BIT(n - 32), ®s->iflag2);
+ } else {
+ priv->write(FLEXCAN_IFLAG_RX_FIFO_AVAILABLE, ®s->iflag1);
+- priv->read(®s->timer);
+ }
+
++ /* Read the Free Running Timer. It is optional but recommended
++ * to unlock Mailbox as soon as possible and make it available
++ * for reception.
++ */
++ priv->read(®s->timer);
++
+ return 1;
+ }
+
+@@ -732,9 +743,9 @@ static inline u64 flexcan_read_reg_iflag_rx(struct flexcan_priv *priv)
+ struct flexcan_regs __iomem *regs = priv->regs;
+ u32 iflag1, iflag2;
+
+- iflag2 = priv->read(®s->iflag2) & priv->reg_imask2_default;
+- iflag1 = priv->read(®s->iflag1) & priv->reg_imask1_default &
+- ~FLEXCAN_IFLAG_MB(priv->tx_mb_idx);
++ iflag2 = priv->read(®s->iflag2) & priv->reg_imask2_default &
++ ~FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB);
++ iflag1 = priv->read(®s->iflag1) & priv->reg_imask1_default;
+
+ return (u64)iflag2 << 32 | iflag1;
+ }
+@@ -746,11 +757,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
+ struct flexcan_priv *priv = netdev_priv(dev);
+ struct flexcan_regs __iomem *regs = priv->regs;
+ irqreturn_t handled = IRQ_NONE;
+- u32 reg_iflag1, reg_esr;
++ u32 reg_iflag2, reg_esr;
+ enum can_state last_state = priv->can.state;
+
+- reg_iflag1 = priv->read(®s->iflag1);
+-
+ /* reception interrupt */
+ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
+ u64 reg_iflag;
+@@ -764,6 +773,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
+ break;
+ }
+ } else {
++ u32 reg_iflag1;
++
++ reg_iflag1 = priv->read(®s->iflag1);
+ if (reg_iflag1 & FLEXCAN_IFLAG_RX_FIFO_AVAILABLE) {
+ handled = IRQ_HANDLED;
+ can_rx_offload_irq_offload_fifo(&priv->offload);
+@@ -779,17 +791,22 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
+ }
+ }
+
++ reg_iflag2 = priv->read(®s->iflag2);
++
+ /* transmission complete interrupt */
+- if (reg_iflag1 & FLEXCAN_IFLAG_MB(priv->tx_mb_idx)) {
++ if (reg_iflag2 & FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB)) {
++ u32 reg_ctrl = priv->read(®s->mb[FLEXCAN_TX_MB].can_ctrl);
++
+ handled = IRQ_HANDLED;
+- stats->tx_bytes += can_get_echo_skb(dev, 0);
++ stats->tx_bytes += can_rx_offload_get_echo_skb(&priv->offload,
++ 0, reg_ctrl << 16);
+ stats->tx_packets++;
+ can_led_event(dev, CAN_LED_EVENT_TX);
+
+ /* after sending a RTR frame MB is in RX mode */
+ priv->write(FLEXCAN_MB_CODE_TX_INACTIVE,
+- &priv->tx_mb->can_ctrl);
+- priv->write(FLEXCAN_IFLAG_MB(priv->tx_mb_idx), ®s->iflag1);
++ ®s->mb[FLEXCAN_TX_MB].can_ctrl);
++ priv->write(FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB), ®s->iflag2);
+ netif_wake_queue(dev);
+ }
+
+@@ -931,15 +948,13 @@ static int flexcan_chip_start(struct net_device *dev)
+ reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
+ reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT | FLEXCAN_MCR_SUPV |
+ FLEXCAN_MCR_WRN_EN | FLEXCAN_MCR_SRX_DIS | FLEXCAN_MCR_IRMQ |
+- FLEXCAN_MCR_IDAM_C;
++ FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_MAXMB(FLEXCAN_TX_MB);
+
+- if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP)
+ reg_mcr &= ~FLEXCAN_MCR_FEN;
+- reg_mcr |= FLEXCAN_MCR_MAXMB(priv->offload.mb_last);
+- } else {
+- reg_mcr |= FLEXCAN_MCR_FEN |
+- FLEXCAN_MCR_MAXMB(priv->tx_mb_idx);
+- }
++ else
++ reg_mcr |= FLEXCAN_MCR_FEN;
++
+ netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr);
+ priv->write(reg_mcr, ®s->mcr);
+
+@@ -982,16 +997,17 @@ static int flexcan_chip_start(struct net_device *dev)
+ priv->write(reg_ctrl2, ®s->ctrl2);
+ }
+
+- /* clear and invalidate all mailboxes first */
+- for (i = priv->tx_mb_idx; i < ARRAY_SIZE(regs->mb); i++) {
+- priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
+- ®s->mb[i].can_ctrl);
+- }
+-
+ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
+- for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++)
++ for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++) {
+ priv->write(FLEXCAN_MB_CODE_RX_EMPTY,
+ ®s->mb[i].can_ctrl);
++ }
++ } else {
++ /* clear and invalidate unused mailboxes first */
++ for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= ARRAY_SIZE(regs->mb); i++) {
++ priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
++ ®s->mb[i].can_ctrl);
++ }
+ }
+
+ /* Errata ERR005829: mark first TX mailbox as INACTIVE */
+@@ -1000,7 +1016,7 @@ static int flexcan_chip_start(struct net_device *dev)
+
+ /* mark TX mailbox as INACTIVE */
+ priv->write(FLEXCAN_MB_CODE_TX_INACTIVE,
+- &priv->tx_mb->can_ctrl);
++ ®s->mb[FLEXCAN_TX_MB].can_ctrl);
+
+ /* acceptance mask/acceptance code (accept everything) */
+ priv->write(0x0, ®s->rxgmask);
+@@ -1355,17 +1371,13 @@ static int flexcan_probe(struct platform_device *pdev)
+ priv->devtype_data = devtype_data;
+ priv->reg_xceiver = reg_xceiver;
+
+- if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
+- priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_TIMESTAMP;
++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP)
+ priv->tx_mb_reserved = ®s->mb[FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP];
+- } else {
+- priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_FIFO;
++ else
+ priv->tx_mb_reserved = ®s->mb[FLEXCAN_TX_MB_RESERVED_OFF_FIFO];
+- }
+- priv->tx_mb = ®s->mb[priv->tx_mb_idx];
+
+- priv->reg_imask1_default = FLEXCAN_IFLAG_MB(priv->tx_mb_idx);
+- priv->reg_imask2_default = 0;
++ priv->reg_imask1_default = 0;
++ priv->reg_imask2_default = FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB);
+
+ priv->offload.mailbox_read = flexcan_mailbox_read;
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index d94dae216820..727691dd08fb 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -209,7 +209,54 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
+ }
+ EXPORT_SYMBOL_GPL(can_rx_offload_irq_offload_fifo);
+
+-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb)
++int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
++ struct sk_buff *skb, u32 timestamp)
++{
++ struct can_rx_offload_cb *cb;
++ unsigned long flags;
++
++ if (skb_queue_len(&offload->skb_queue) >
++ offload->skb_queue_len_max)
++ return -ENOMEM;
++
++ cb = can_rx_offload_get_cb(skb);
++ cb->timestamp = timestamp;
++
++ spin_lock_irqsave(&offload->skb_queue.lock, flags);
++ __skb_queue_add_sort(&offload->skb_queue, skb, can_rx_offload_compare);
++ spin_unlock_irqrestore(&offload->skb_queue.lock, flags);
++
++ can_rx_offload_schedule(offload);
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(can_rx_offload_queue_sorted);
++
++unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload,
++ unsigned int idx, u32 timestamp)
++{
++ struct net_device *dev = offload->dev;
++ struct net_device_stats *stats = &dev->stats;
++ struct sk_buff *skb;
++ u8 len;
++ int err;
++
++ skb = __can_get_echo_skb(dev, idx, &len);
++ if (!skb)
++ return 0;
++
++ err = can_rx_offload_queue_sorted(offload, skb, timestamp);
++ if (err) {
++ stats->rx_errors++;
++ stats->tx_fifo_errors++;
++ }
++
++ return len;
++}
++EXPORT_SYMBOL_GPL(can_rx_offload_get_echo_skb);
++
++int can_rx_offload_queue_tail(struct can_rx_offload *offload,
++ struct sk_buff *skb)
+ {
+ if (skb_queue_len(&offload->skb_queue) >
+ offload->skb_queue_len_max)
+@@ -220,7 +267,7 @@ int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_b
+
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(can_rx_offload_irq_queue_err_skb);
++EXPORT_SYMBOL_GPL(can_rx_offload_queue_tail);
+
+ static int can_rx_offload_init_queue(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight)
+ {
+diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
+index 53e320c92a8b..ddaf46239e39 100644
+--- a/drivers/net/can/spi/hi311x.c
++++ b/drivers/net/can/spi/hi311x.c
+@@ -760,7 +760,7 @@ static int hi3110_open(struct net_device *net)
+ {
+ struct hi3110_priv *priv = netdev_priv(net);
+ struct spi_device *spi = priv->spi;
+- unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_RISING;
++ unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_HIGH;
+ int ret;
+
+ ret = open_candev(net);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index 5444e6213d45..64a794be7fcb 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5997,7 +5997,8 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
+ * for subsequent chanspecs.
+ */
+ channel->flags = IEEE80211_CHAN_NO_HT40 |
+- IEEE80211_CHAN_NO_80MHZ;
++ IEEE80211_CHAN_NO_80MHZ |
++ IEEE80211_CHAN_NO_160MHZ;
+ ch.bw = BRCMU_CHAN_BW_20;
+ cfg->d11inf.encchspec(&ch);
+ chaninfo = ch.chspec;
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+index cb5f32c1d705..0b3b1223cff7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+@@ -6,6 +6,7 @@
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2017 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -29,6 +30,7 @@
+ * BSD LICENSE
+ *
+ * Copyright(c) 2017 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -84,7 +86,7 @@
+ #define ACPI_WRDS_WIFI_DATA_SIZE (ACPI_SAR_TABLE_SIZE + 2)
+ #define ACPI_EWRD_WIFI_DATA_SIZE ((ACPI_SAR_PROFILE_NUM - 1) * \
+ ACPI_SAR_TABLE_SIZE + 3)
+-#define ACPI_WGDS_WIFI_DATA_SIZE 18
++#define ACPI_WGDS_WIFI_DATA_SIZE 19
+ #define ACPI_WRDD_WIFI_DATA_SIZE 2
+ #define ACPI_SPLC_WIFI_DATA_SIZE 2
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 48a3611d6a31..4d49a1a3f504 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -880,7 +880,7 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
+ IWL_DEBUG_RADIO(mvm, "Sending GEO_TX_POWER_LIMIT\n");
+
+ BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES * ACPI_WGDS_NUM_BANDS *
+- ACPI_WGDS_TABLE_SIZE != ACPI_WGDS_WIFI_DATA_SIZE);
++ ACPI_WGDS_TABLE_SIZE + 1 != ACPI_WGDS_WIFI_DATA_SIZE);
+
+ BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES > IWL_NUM_GEO_PROFILES);
+
+@@ -915,6 +915,11 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
+ return -ENOENT;
+ }
+
++static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
++{
++ return -ENOENT;
++}
++
+ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
+ {
+ return 0;
+@@ -941,8 +946,11 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
+ IWL_DEBUG_RADIO(mvm,
+ "WRDS SAR BIOS table invalid or unavailable. (%d)\n",
+ ret);
+- /* if not available, don't fail and don't bother with EWRD */
+- return 0;
++ /*
++ * If not available, don't fail and don't bother with EWRD.
++ * Return 1 to tell that we can't use WGDS either.
++ */
++ return 1;
+ }
+
+ ret = iwl_mvm_sar_get_ewrd_table(mvm);
+@@ -955,9 +963,13 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
+ /* choose profile 1 (WRDS) as default for both chains */
+ ret = iwl_mvm_sar_select_profile(mvm, 1, 1);
+
+- /* if we don't have profile 0 from BIOS, just skip it */
++ /*
++ * If we don't have profile 0 from BIOS, just skip it. This
++ * means that SAR Geo will not be enabled either, even if we
++ * have other valid profiles.
++ */
+ if (ret == -ENOENT)
+- return 0;
++ return 1;
+
+ return ret;
+ }
+@@ -1155,11 +1167,19 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
+ iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
+
+ ret = iwl_mvm_sar_init(mvm);
+- if (ret)
+- goto error;
++ if (ret == 0) {
++ ret = iwl_mvm_sar_geo_init(mvm);
++ } else if (ret > 0 && !iwl_mvm_sar_get_wgds_table(mvm)) {
++ /*
++ * If basic SAR is not available, we check for WGDS,
++ * which should *not* be available either. If it is
++ * available, issue an error, because we can't use SAR
++ * Geo without basic SAR.
++ */
++ IWL_ERR(mvm, "BIOS contains WGDS but no WRDS\n");
++ }
+
+- ret = iwl_mvm_sar_geo_init(mvm);
+- if (ret)
++ if (ret < 0)
+ goto error;
+
+ iwl_mvm_leds_sync(mvm);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 155cc2ac0120..afed549f5645 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -306,8 +306,12 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
+ goto out;
+ }
+
+- if (changed)
+- *changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE);
++ if (changed) {
++ u32 status = le32_to_cpu(resp->status);
++
++ *changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
++ status == MCC_RESP_ILLEGAL);
++ }
+
+ regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
+ __le32_to_cpu(resp->n_channels),
+@@ -4416,10 +4420,6 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
+ }
+
+- if (!fw_has_capa(&mvm->fw->ucode_capa,
+- IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+- return;
+-
+ /* if beacon filtering isn't on mac80211 does it anyway */
+ if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
+ return;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+index cf48517944ec..f2579c94ffdb 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+@@ -545,9 +545,8 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2,
+ }
+
+ IWL_DEBUG_LAR(mvm,
+- "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') change: %d n_chans: %d\n",
+- status, mcc, mcc >> 8, mcc & 0xff,
+- !!(status == MCC_RESP_NEW_CHAN_PROFILE), n_channels);
++ "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') n_chans: %d\n",
++ status, mcc, mcc >> 8, mcc & 0xff, n_channels);
+
+ exit:
+ iwl_free_resp(&cmd);
+diff --git a/drivers/opp/ti-opp-supply.c b/drivers/opp/ti-opp-supply.c
+index 9e5a9a3112c9..3f4fb4dbbe33 100644
+--- a/drivers/opp/ti-opp-supply.c
++++ b/drivers/opp/ti-opp-supply.c
+@@ -288,7 +288,10 @@ static int ti_opp_supply_set_opp(struct dev_pm_set_opp_data *data)
+ int ret;
+
+ vdd_uv = _get_optimal_vdd_voltage(dev, &opp_data,
+- new_supply_vbb->u_volt);
++ new_supply_vdd->u_volt);
++
++ if (new_supply_vdd->u_volt_min < vdd_uv)
++ new_supply_vdd->u_volt_min = vdd_uv;
+
+ /* Scaling up? Scale voltage before frequency */
+ if (freq > old_freq) {
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+index 4ceb06f8a33c..4edeb4cae72a 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+@@ -830,7 +830,7 @@ static struct meson_bank meson_gxbb_periphs_banks[] = {
+
+ static struct meson_bank meson_gxbb_aobus_banks[] = {
+ /* name first last irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIOAO_13, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIOAO_13, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson_gxbb_periphs_pinctrl_data = {
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 7dae1d7bf6b0..158f618f1695 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -807,7 +807,7 @@ static struct meson_bank meson_gxl_periphs_banks[] = {
+
+ static struct meson_bank meson_gxl_aobus_banks[] = {
+ /* name first last irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIOAO_9, 0, 9, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIOAO_9, 0, 9, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson_gxl_periphs_pinctrl_data = {
+diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
+index 29a458da78db..4f3ab18636a3 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson.c
++++ b/drivers/pinctrl/meson/pinctrl-meson.c
+@@ -192,7 +192,7 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,
+ dev_dbg(pc->dev, "pin %u: disable bias\n", pin);
+
+ meson_calc_reg_and_bit(bank, pin, REG_PULL, ®, &bit);
+- ret = regmap_update_bits(pc->reg_pull, reg,
++ ret = regmap_update_bits(pc->reg_pullen, reg,
+ BIT(bit), 0);
+ if (ret)
+ return ret;
+diff --git a/drivers/pinctrl/meson/pinctrl-meson8.c b/drivers/pinctrl/meson/pinctrl-meson8.c
+index c6d79315218f..86466173114d 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson8.c
++++ b/drivers/pinctrl/meson/pinctrl-meson8.c
+@@ -1053,7 +1053,7 @@ static struct meson_bank meson8_cbus_banks[] = {
+
+ static struct meson_bank meson8_aobus_banks[] = {
+ /* name first last irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson8_cbus_pinctrl_data = {
+diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
+index bb2a30964fc6..647ad15d5c3c 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
+@@ -906,7 +906,7 @@ static struct meson_bank meson8b_cbus_banks[] = {
+
+ static struct meson_bank meson8b_aobus_banks[] = {
+ /* name first lastc irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson8b_cbus_pinctrl_data = {
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index df0c5776d49b..a5a19ff10535 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -257,6 +257,7 @@ static int cmos_read_alarm(struct device *dev, struct rtc_wkalrm *t)
+ struct cmos_rtc *cmos = dev_get_drvdata(dev);
+ unsigned char rtc_control;
+
++ /* This not only a rtc_op, but also called directly */
+ if (!is_valid_irq(cmos->irq))
+ return -EIO;
+
+@@ -452,6 +453,7 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t)
+ unsigned char mon, mday, hrs, min, sec, rtc_control;
+ int ret;
+
++ /* This not only a rtc_op, but also called directly */
+ if (!is_valid_irq(cmos->irq))
+ return -EIO;
+
+@@ -516,9 +518,6 @@ static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled)
+ struct cmos_rtc *cmos = dev_get_drvdata(dev);
+ unsigned long flags;
+
+- if (!is_valid_irq(cmos->irq))
+- return -EINVAL;
+-
+ spin_lock_irqsave(&rtc_lock, flags);
+
+ if (enabled)
+@@ -579,6 +578,12 @@ static const struct rtc_class_ops cmos_rtc_ops = {
+ .alarm_irq_enable = cmos_alarm_irq_enable,
+ };
+
++static const struct rtc_class_ops cmos_rtc_ops_no_alarm = {
++ .read_time = cmos_read_time,
++ .set_time = cmos_set_time,
++ .proc = cmos_procfs,
++};
++
+ /*----------------------------------------------------------------*/
+
+ /*
+@@ -855,9 +860,12 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
+ dev_dbg(dev, "IRQ %d is already in use\n", rtc_irq);
+ goto cleanup1;
+ }
++
++ cmos_rtc.rtc->ops = &cmos_rtc_ops;
++ } else {
++ cmos_rtc.rtc->ops = &cmos_rtc_ops_no_alarm;
+ }
+
+- cmos_rtc.rtc->ops = &cmos_rtc_ops;
+ cmos_rtc.rtc->nvram_old_abi = true;
+ retval = rtc_register_device(cmos_rtc.rtc);
+ if (retval)
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 9f99a0966550..7cb786d76e3c 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -303,6 +303,9 @@ static int pcf2127_i2c_gather_write(void *context,
+ memcpy(buf + 1, val, val_size);
+
+ ret = i2c_master_send(client, buf, val_size + 1);
++
++ kfree(buf);
++
+ if (ret != val_size + 1)
+ return ret < 0 ? ret : -EIO;
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+index 8f60f0e04599..410eccf0bc5e 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+@@ -904,11 +904,9 @@ static void start_delivery_v1_hw(struct hisi_sas_dq *dq)
+ {
+ struct hisi_hba *hisi_hba = dq->hisi_hba;
+ struct hisi_sas_slot *s, *s1, *s2 = NULL;
+- struct list_head *dq_list;
+ int dlvry_queue = dq->id;
+ int wp;
+
+- dq_list = &dq->list;
+ list_for_each_entry_safe(s, s1, &dq->list, delivery) {
+ if (!s->ready)
+ break;
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+index 9c5c5a601332..1c4ea58da1ae 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+@@ -1666,11 +1666,9 @@ static void start_delivery_v2_hw(struct hisi_sas_dq *dq)
+ {
+ struct hisi_hba *hisi_hba = dq->hisi_hba;
+ struct hisi_sas_slot *s, *s1, *s2 = NULL;
+- struct list_head *dq_list;
+ int dlvry_queue = dq->id;
+ int wp;
+
+- dq_list = &dq->list;
+ list_for_each_entry_safe(s, s1, &dq->list, delivery) {
+ if (!s->ready)
+ break;
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 08b503e274b8..687ff61bba9f 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -883,11 +883,9 @@ static void start_delivery_v3_hw(struct hisi_sas_dq *dq)
+ {
+ struct hisi_hba *hisi_hba = dq->hisi_hba;
+ struct hisi_sas_slot *s, *s1, *s2 = NULL;
+- struct list_head *dq_list;
+ int dlvry_queue = dq->id;
+ int wp;
+
+- dq_list = &dq->list;
+ list_for_each_entry_safe(s, s1, &dq->list, delivery) {
+ if (!s->ready)
+ break;
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index aec5b10a8c85..ca6c3982548d 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -700,6 +700,8 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
+ rport = lpfc_ndlp_get_nrport(ndlp);
+ if (rport)
+ nrport = rport->remoteport;
++ else
++ nrport = NULL;
+ spin_unlock(&phba->hbalock);
+ if (!nrport)
+ continue;
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 431742201709..3ad460219fd6 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -152,17 +152,28 @@ static inline unsigned char *echo_buf_addr(struct n_tty_data *ldata, size_t i)
+ return &ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
+ }
+
++/* If we are not echoing the data, perhaps this is a secret so erase it */
++static void zero_buffer(struct tty_struct *tty, u8 *buffer, int size)
++{
++ bool icanon = !!L_ICANON(tty);
++ bool no_echo = !L_ECHO(tty);
++
++ if (icanon && no_echo)
++ memset(buffer, 0x00, size);
++}
++
+ static int tty_copy_to_user(struct tty_struct *tty, void __user *to,
+ size_t tail, size_t n)
+ {
+ struct n_tty_data *ldata = tty->disc_data;
+ size_t size = N_TTY_BUF_SIZE - tail;
+- const void *from = read_buf_addr(ldata, tail);
++ void *from = read_buf_addr(ldata, tail);
+ int uncopied;
+
+ if (n > size) {
+ tty_audit_add_data(tty, from, size);
+ uncopied = copy_to_user(to, from, size);
++ zero_buffer(tty, from, size - uncopied);
+ if (uncopied)
+ return uncopied;
+ to += size;
+@@ -171,7 +182,9 @@ static int tty_copy_to_user(struct tty_struct *tty, void __user *to,
+ }
+
+ tty_audit_add_data(tty, from, n);
+- return copy_to_user(to, from, n);
++ uncopied = copy_to_user(to, from, n);
++ zero_buffer(tty, from, n - uncopied);
++ return uncopied;
+ }
+
+ /**
+@@ -1960,11 +1973,12 @@ static int copy_from_read_buf(struct tty_struct *tty,
+ n = min(head - ldata->read_tail, N_TTY_BUF_SIZE - tail);
+ n = min(*nr, n);
+ if (n) {
+- const unsigned char *from = read_buf_addr(ldata, tail);
++ unsigned char *from = read_buf_addr(ldata, tail);
+ retval = copy_to_user(*b, from, n);
+ n -= retval;
+ is_eof = n == 1 && *from == EOF_CHAR(tty);
+ tty_audit_add_data(tty, from, n);
++ zero_buffer(tty, from, n);
+ smp_store_release(&ldata->read_tail, ldata->read_tail + n);
+ /* Turn single EOF into zero-length read */
+ if (L_EXTPROC(tty) && ldata->icanon && is_eof &&
+diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
+index c996b6859c5e..ae3ce330200e 100644
+--- a/drivers/tty/tty_buffer.c
++++ b/drivers/tty/tty_buffer.c
+@@ -468,11 +468,15 @@ receive_buf(struct tty_port *port, struct tty_buffer *head, int count)
+ {
+ unsigned char *p = char_buf_ptr(head, head->read);
+ char *f = NULL;
++ int n;
+
+ if (~head->flags & TTYB_NORMAL)
+ f = flag_buf_ptr(head, head->read);
+
+- return port->client_ops->receive_buf(port, p, f, count);
++ n = port->client_ops->receive_buf(port, p, f, count);
++ if (n > 0)
++ memset(p, 0, n);
++ return n;
+ }
+
+ /**
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 6e0823790bee..f79979ae482a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2847,7 +2847,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ USB_PORT_FEAT_C_BH_PORT_RESET);
+ usb_clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_PORT_LINK_STATE);
+- usb_clear_port_feature(hub->hdev, port1,
++
++ if (udev)
++ usb_clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_CONNECTION);
+
+ /*
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 88c80fcc39f5..fec97465ccac 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1499,6 +1499,7 @@ static int dwc3_probe(struct platform_device *pdev)
+
+ err5:
+ dwc3_event_buffers_cleanup(dwc);
++ dwc3_ulpi_exit(dwc);
+
+ err4:
+ dwc3_free_scratch_buffers(dwc);
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 1286076a8890..842795856bf4 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -283,8 +283,10 @@ err:
+ static void dwc3_pci_remove(struct pci_dev *pci)
+ {
+ struct dwc3_pci *dwc = pci_get_drvdata(pci);
++ struct pci_dev *pdev = dwc->pci;
+
+- gpiod_remove_lookup_table(&platform_bytcr_gpios);
++ if (pdev->device == PCI_DEVICE_ID_INTEL_BYT)
++ gpiod_remove_lookup_table(&platform_bytcr_gpios);
+ #ifdef CONFIG_PM
+ cancel_work_sync(&dwc->wakeup_work);
+ #endif
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 2b53194081ba..2de1a3971a26 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1072,7 +1072,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ /* Now prepare one extra TRB to align transfer size */
+ trb = &dep->trb_pool[dep->trb_enqueue];
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr,
+- maxp - rem, false, 0,
++ maxp - rem, false, 1,
+ req->request.stream_id,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
+@@ -1116,7 +1116,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
+ /* Now prepare one extra TRB to align transfer size */
+ trb = &dep->trb_pool[dep->trb_enqueue];
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp - rem,
+- false, 0, req->request.stream_id,
++ false, 1, req->request.stream_id,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
+ } else if (req->request.zero && req->request.length &&
+@@ -1132,7 +1132,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
+ /* Now prepare one extra TRB to handle ZLP */
+ trb = &dep->trb_pool[dep->trb_enqueue];
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
+- false, 0, req->request.stream_id,
++ false, 1, req->request.stream_id,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
+ } else {
+@@ -2250,7 +2250,7 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
+ * with one TRB pending in the ring. We need to manually clear HWO bit
+ * from that TRB.
+ */
+- if ((req->zero || req->unaligned) && (trb->ctrl & DWC3_TRB_CTRL_HWO)) {
++ if ((req->zero || req->unaligned) && !(trb->ctrl & DWC3_TRB_CTRL_CHN)) {
+ trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+ return 1;
+ }
+diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c
+index 27f00160332e..3c4abb5a1c3f 100644
+--- a/drivers/usb/host/xhci-histb.c
++++ b/drivers/usb/host/xhci-histb.c
+@@ -325,14 +325,16 @@ static int xhci_histb_remove(struct platform_device *dev)
+ struct xhci_hcd_histb *histb = platform_get_drvdata(dev);
+ struct usb_hcd *hcd = histb->hcd;
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
+ xhci->xhc_state |= XHCI_STATE_REMOVING;
+
+- usb_remove_hcd(xhci->shared_hcd);
++ usb_remove_hcd(shared_hcd);
++ xhci->shared_hcd = NULL;
+ device_wakeup_disable(&dev->dev);
+
+ usb_remove_hcd(hcd);
+- usb_put_hcd(xhci->shared_hcd);
++ usb_put_hcd(shared_hcd);
+
+ xhci_histb_host_disable(histb);
+ usb_put_hcd(hcd);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 12eea73d9f20..94aca1b5ac8a 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -876,7 +876,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ status |= USB_PORT_STAT_SUSPEND;
+ }
+ if ((raw_port_status & PORT_PLS_MASK) == XDEV_RESUME &&
+- !DEV_SUPERSPEED_ANY(raw_port_status)) {
++ !DEV_SUPERSPEED_ANY(raw_port_status) && hcd->speed < HCD_USB3) {
+ if ((raw_port_status & PORT_RESET) ||
+ !(raw_port_status & PORT_PE))
+ return 0xffffffff;
+@@ -921,7 +921,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ time_left = wait_for_completion_timeout(
+ &bus_state->rexit_done[wIndex],
+ msecs_to_jiffies(
+- XHCI_MAX_REXIT_TIMEOUT));
++ XHCI_MAX_REXIT_TIMEOUT_MS));
+ spin_lock_irqsave(&xhci->lock, flags);
+
+ if (time_left) {
+@@ -935,7 +935,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ } else {
+ int port_status = readl(port->addr);
+ xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n",
+- XHCI_MAX_REXIT_TIMEOUT,
++ XHCI_MAX_REXIT_TIMEOUT_MS,
+ port_status);
+ status |= USB_PORT_STAT_SUSPEND;
+ clear_bit(wIndex, &bus_state->rexit_ports);
+@@ -1474,15 +1474,18 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ unsigned long flags;
+ struct xhci_hub *rhub;
+ struct xhci_port **ports;
++ u32 portsc_buf[USB_MAXCHILDREN];
++ bool wake_enabled;
+
+ rhub = xhci_get_rhub(hcd);
+ ports = rhub->ports;
+ max_ports = rhub->num_ports;
+ bus_state = &xhci->bus_state[hcd_index(hcd)];
++ wake_enabled = hcd->self.root_hub->do_remote_wakeup;
+
+ spin_lock_irqsave(&xhci->lock, flags);
+
+- if (hcd->self.root_hub->do_remote_wakeup) {
++ if (wake_enabled) {
+ if (bus_state->resuming_ports || /* USB2 */
+ bus_state->port_remote_wakeup) { /* USB3 */
+ spin_unlock_irqrestore(&xhci->lock, flags);
+@@ -1490,26 +1493,36 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ return -EBUSY;
+ }
+ }
+-
+- port_index = max_ports;
++ /*
++ * Prepare ports for suspend, but don't write anything before all ports
++ * are checked and we know bus suspend can proceed
++ */
+ bus_state->bus_suspended = 0;
++ port_index = max_ports;
+ while (port_index--) {
+- /* suspend the port if the port is not suspended */
+ u32 t1, t2;
+- int slot_id;
+
+ t1 = readl(ports[port_index]->addr);
+ t2 = xhci_port_state_to_neutral(t1);
++ portsc_buf[port_index] = 0;
+
+- if ((t1 & PORT_PE) && !(t1 & PORT_PLS_MASK)) {
+- xhci_dbg(xhci, "port %d not suspended\n", port_index);
+- slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+- port_index + 1);
+- if (slot_id) {
++ /* Bail out if a USB3 port has a new device in link training */
++ if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) {
++ bus_state->bus_suspended = 0;
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
++ return -EBUSY;
++ }
++
++ /* suspend ports in U0, or bail out for new connect changes */
++ if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) {
++ if ((t1 & PORT_CSC) && wake_enabled) {
++ bus_state->bus_suspended = 0;
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- xhci_stop_device(xhci, slot_id, 1);
+- spin_lock_irqsave(&xhci->lock, flags);
++ xhci_dbg(xhci, "Bus suspend bailout, port connect change\n");
++ return -EBUSY;
+ }
++ xhci_dbg(xhci, "port %d not suspended\n", port_index);
+ t2 &= ~PORT_PLS_MASK;
+ t2 |= PORT_LINK_STROBE | XDEV_U3;
+ set_bit(port_index, &bus_state->bus_suspended);
+@@ -1518,7 +1531,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ * including the USB 3.0 roothub, but only if CONFIG_PM
+ * is enabled, so also enable remote wake here.
+ */
+- if (hcd->self.root_hub->do_remote_wakeup) {
++ if (wake_enabled) {
+ if (t1 & PORT_CONNECT) {
+ t2 |= PORT_WKOC_E | PORT_WKDISC_E;
+ t2 &= ~PORT_WKCONN_E;
+@@ -1538,7 +1551,26 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+
+ t1 = xhci_port_state_to_neutral(t1);
+ if (t1 != t2)
+- writel(t2, ports[port_index]->addr);
++ portsc_buf[port_index] = t2;
++ }
++
++ /* write port settings, stopping and suspending ports if needed */
++ port_index = max_ports;
++ while (port_index--) {
++ if (!portsc_buf[port_index])
++ continue;
++ if (test_bit(port_index, &bus_state->bus_suspended)) {
++ int slot_id;
++
++ slot_id = xhci_find_slot_id_by_port(hcd, xhci,
++ port_index + 1);
++ if (slot_id) {
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ xhci_stop_device(xhci, slot_id, 1);
++ spin_lock_irqsave(&xhci->lock, flags);
++ }
++ }
++ writel(portsc_buf[port_index], ports[port_index]->addr);
+ }
+ hcd->state = HC_STATE_SUSPENDED;
+ bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
+diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
+index 71d0d33c3286..60987c787e44 100644
+--- a/drivers/usb/host/xhci-mtk.c
++++ b/drivers/usb/host/xhci-mtk.c
+@@ -590,12 +590,14 @@ static int xhci_mtk_remove(struct platform_device *dev)
+ struct xhci_hcd_mtk *mtk = platform_get_drvdata(dev);
+ struct usb_hcd *hcd = mtk->hcd;
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
+- usb_remove_hcd(xhci->shared_hcd);
++ usb_remove_hcd(shared_hcd);
++ xhci->shared_hcd = NULL;
+ device_init_wakeup(&dev->dev, false);
+
+ usb_remove_hcd(hcd);
+- usb_put_hcd(xhci->shared_hcd);
++ usb_put_hcd(shared_hcd);
+ usb_put_hcd(hcd);
+ xhci_mtk_sch_exit(mtk);
+ xhci_mtk_clks_disable(mtk);
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 51dd8e00c4f8..beeda27b3789 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -231,6 +231,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
+ xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
+
++ if ((pdev->vendor == PCI_VENDOR_ID_BROADCOM ||
++ pdev->vendor == PCI_VENDOR_ID_CAVIUM) &&
++ pdev->device == 0x9026)
++ xhci->quirks |= XHCI_RESET_PLL_ON_DISCONNECT;
++
+ if (xhci->quirks & XHCI_RESET_ON_RESUME)
+ xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
+ "QUIRK: Resetting on resume");
+@@ -356,6 +361,7 @@ static void xhci_pci_remove(struct pci_dev *dev)
+ if (xhci->shared_hcd) {
+ usb_remove_hcd(xhci->shared_hcd);
+ usb_put_hcd(xhci->shared_hcd);
++ xhci->shared_hcd = NULL;
+ }
+
+ /* Workaround for spurious wakeups at shutdown with HSW */
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 94e939249b2b..e5da8ce62914 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -359,14 +359,16 @@ static int xhci_plat_remove(struct platform_device *dev)
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct clk *clk = xhci->clk;
+ struct clk *reg_clk = xhci->reg_clk;
++ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
+ xhci->xhc_state |= XHCI_STATE_REMOVING;
+
+- usb_remove_hcd(xhci->shared_hcd);
++ usb_remove_hcd(shared_hcd);
++ xhci->shared_hcd = NULL;
+ usb_phy_shutdown(hcd->usb_phy);
+
+ usb_remove_hcd(hcd);
+- usb_put_hcd(xhci->shared_hcd);
++ usb_put_hcd(shared_hcd);
+
+ clk_disable_unprepare(clk);
+ clk_disable_unprepare(reg_clk);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index cd4659703647..9ae17a666bdb 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1517,6 +1517,35 @@ static void handle_device_notification(struct xhci_hcd *xhci,
+ usb_wakeup_notification(udev->parent, udev->portnum);
+ }
+
++/*
++ * Quirk hanlder for errata seen on Cavium ThunderX2 processor XHCI
++ * Controller.
++ * As per ThunderX2errata-129 USB 2 device may come up as USB 1
++ * If a connection to a USB 1 device is followed by another connection
++ * to a USB 2 device.
++ *
++ * Reset the PHY after the USB device is disconnected if device speed
++ * is less than HCD_USB3.
++ * Retry the reset sequence max of 4 times checking the PLL lock status.
++ *
++ */
++static void xhci_cavium_reset_phy_quirk(struct xhci_hcd *xhci)
++{
++ struct usb_hcd *hcd = xhci_to_hcd(xhci);
++ u32 pll_lock_check;
++ u32 retry_count = 4;
++
++ do {
++ /* Assert PHY reset */
++ writel(0x6F, hcd->regs + 0x1048);
++ udelay(10);
++ /* De-assert the PHY reset */
++ writel(0x7F, hcd->regs + 0x1048);
++ udelay(200);
++ pll_lock_check = readl(hcd->regs + 0x1070);
++ } while (!(pll_lock_check & 0x1) && --retry_count);
++}
++
+ static void handle_port_status(struct xhci_hcd *xhci,
+ union xhci_trb *event)
+ {
+@@ -1552,6 +1581,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ goto cleanup;
+ }
+
++ /* We might get interrupts after shared_hcd is removed */
++ if (port->rhub == &xhci->usb3_rhub && xhci->shared_hcd == NULL) {
++ xhci_dbg(xhci, "ignore port event for removed USB3 hcd\n");
++ bogus_port_status = true;
++ goto cleanup;
++ }
++
+ hcd = port->rhub->hcd;
+ bus_state = &xhci->bus_state[hcd_index(hcd)];
+ hcd_portnum = port->hcd_portnum;
+@@ -1635,7 +1671,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ * RExit to a disconnect state). If so, let the the driver know it's
+ * out of the RExit state.
+ */
+- if (!DEV_SUPERSPEED_ANY(portsc) &&
++ if (!DEV_SUPERSPEED_ANY(portsc) && hcd->speed < HCD_USB3 &&
+ test_and_clear_bit(hcd_portnum,
+ &bus_state->rexit_ports)) {
+ complete(&bus_state->rexit_done[hcd_portnum]);
+@@ -1643,8 +1679,12 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ goto cleanup;
+ }
+
+- if (hcd->speed < HCD_USB3)
++ if (hcd->speed < HCD_USB3) {
+ xhci_test_and_clear_bit(xhci, port, PORT_PLC);
++ if ((xhci->quirks & XHCI_RESET_PLL_ON_DISCONNECT) &&
++ (portsc & PORT_CSC) && !(portsc & PORT_CONNECT))
++ xhci_cavium_reset_phy_quirk(xhci);
++ }
+
+ cleanup:
+ /* Update event ring dequeue pointer before dropping the lock */
+@@ -2247,6 +2287,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ goto cleanup;
+ case COMP_RING_UNDERRUN:
+ case COMP_RING_OVERRUN:
++ case COMP_STOPPED_LENGTH_INVALID:
+ goto cleanup;
+ default:
+ xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
+diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
+index 4b463e5202a4..b1cce989bd12 100644
+--- a/drivers/usb/host/xhci-tegra.c
++++ b/drivers/usb/host/xhci-tegra.c
+@@ -1240,6 +1240,7 @@ static int tegra_xusb_remove(struct platform_device *pdev)
+
+ usb_remove_hcd(xhci->shared_hcd);
+ usb_put_hcd(xhci->shared_hcd);
++ xhci->shared_hcd = NULL;
+ usb_remove_hcd(tegra->hcd);
+ usb_put_hcd(tegra->hcd);
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 0420eefa647a..c928dbbff881 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -719,8 +719,6 @@ static void xhci_stop(struct usb_hcd *hcd)
+
+ /* Only halt host and free memory after both hcds are removed */
+ if (!usb_hcd_is_primary_hcd(hcd)) {
+- /* usb core will free this hcd shortly, unset pointer */
+- xhci->shared_hcd = NULL;
+ mutex_unlock(&xhci->mutex);
+ return;
+ }
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 6230a578324c..e936e4c8af98 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1678,7 +1678,7 @@ struct xhci_bus_state {
+ * It can take up to 20 ms to transition from RExit to U0 on the
+ * Intel Lynx Point LP xHCI host.
+ */
+-#define XHCI_MAX_REXIT_TIMEOUT (20 * 1000)
++#define XHCI_MAX_REXIT_TIMEOUT_MS 20
+
+ static inline unsigned int hcd_index(struct usb_hcd *hcd)
+ {
+@@ -1846,6 +1846,7 @@ struct xhci_hcd {
+ #define XHCI_SUSPEND_DELAY BIT_ULL(30)
+ #define XHCI_INTEL_USB_ROLE_SW BIT_ULL(31)
+ #define XHCI_ZERO_64B_REGS BIT_ULL(32)
++#define XHCI_RESET_PLL_ON_DISCONNECT BIT_ULL(34)
+
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
+index b0405d6aac85..48db9a9f13f9 100644
+--- a/fs/9p/vfs_dir.c
++++ b/fs/9p/vfs_dir.c
+@@ -76,15 +76,6 @@ static inline int dt_type(struct p9_wstat *mistat)
+ return rettype;
+ }
+
+-static void p9stat_init(struct p9_wstat *stbuf)
+-{
+- stbuf->name = NULL;
+- stbuf->uid = NULL;
+- stbuf->gid = NULL;
+- stbuf->muid = NULL;
+- stbuf->extension = NULL;
+-}
+-
+ /**
+ * v9fs_alloc_rdir_buf - Allocate buffer used for read and readdir
+ * @filp: opened file structure
+@@ -145,12 +136,10 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
+ rdir->tail = n;
+ }
+ while (rdir->head < rdir->tail) {
+- p9stat_init(&st);
+ err = p9stat_read(fid->clnt, rdir->buf + rdir->head,
+ rdir->tail - rdir->head, &st);
+ if (err) {
+ p9_debug(P9_DEBUG_VFS, "returned %d\n", err);
+- p9stat_free(&st);
+ return -EIO;
+ }
+ reclen = st.size+2;
+diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
+index 9a69392f1fb3..d81c148682e7 100644
+--- a/fs/bfs/inode.c
++++ b/fs/bfs/inode.c
+@@ -350,7 +350,8 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
+
+ s->s_magic = BFS_MAGIC;
+
+- if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end)) {
++ if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end) ||
++ le32_to_cpu(bfs_sb->s_start) < BFS_BSIZE) {
+ printf("Superblock is corrupted\n");
+ goto out1;
+ }
+@@ -359,9 +360,11 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
+ sizeof(struct bfs_inode)
+ + BFS_ROOT_INO - 1;
+ imap_len = (info->si_lasti / 8) + 1;
+- info->si_imap = kzalloc(imap_len, GFP_KERNEL);
+- if (!info->si_imap)
++ info->si_imap = kzalloc(imap_len, GFP_KERNEL | __GFP_NOWARN);
++ if (!info->si_imap) {
++ printf("Cannot allocate %u bytes\n", imap_len);
+ goto out1;
++ }
+ for (i = 0; i < BFS_ROOT_INO; i++)
+ set_bit(i, info->si_imap);
+
+diff --git a/fs/dax.c b/fs/dax.c
+index 0fb270f0a0ef..b0cd1364c68f 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -217,6 +217,9 @@ static inline void *unlock_slot(struct address_space *mapping, void **slot)
+ return (void *)entry;
+ }
+
++static void put_unlocked_mapping_entry(struct address_space *mapping,
++ pgoff_t index, void *entry);
++
+ /*
+ * Lookup entry in radix tree, wait for it to become unlocked if it is
+ * exceptional entry and return it. The caller must call
+@@ -256,8 +259,10 @@ static void *__get_unlocked_mapping_entry(struct address_space *mapping,
+ revalidate = wait_fn();
+ finish_wait(wq, &ewait.wait);
+ xa_lock_irq(&mapping->i_pages);
+- if (revalidate)
++ if (revalidate) {
++ put_unlocked_mapping_entry(mapping, index, entry);
+ return ERR_PTR(-EAGAIN);
++ }
+ }
+ }
+
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 8748539c04ed..7f8bb0868c0f 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -826,7 +826,7 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length,
+ ret = gfs2_meta_inode_buffer(ip, &dibh);
+ if (ret)
+ goto unlock;
+- iomap->private = dibh;
++ mp->mp_bh[0] = dibh;
+
+ if (gfs2_is_stuffed(ip)) {
+ if (flags & IOMAP_WRITE) {
+@@ -863,9 +863,6 @@ unstuff:
+ len = lblock_stop - lblock + 1;
+ iomap->length = len << inode->i_blkbits;
+
+- get_bh(dibh);
+- mp->mp_bh[0] = dibh;
+-
+ height = ip->i_height;
+ while ((lblock + 1) * sdp->sd_sb.sb_bsize > sdp->sd_heightsize[height])
+ height++;
+@@ -898,8 +895,6 @@ out:
+ iomap->bdev = inode->i_sb->s_bdev;
+ unlock:
+ up_read(&ip->i_rw_mutex);
+- if (ret && dibh)
+- brelse(dibh);
+ return ret;
+
+ do_alloc:
+@@ -980,9 +975,9 @@ static void gfs2_iomap_journaled_page_done(struct inode *inode, loff_t pos,
+
+ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
+ loff_t length, unsigned flags,
+- struct iomap *iomap)
++ struct iomap *iomap,
++ struct metapath *mp)
+ {
+- struct metapath mp = { .mp_aheight = 1, };
+ struct gfs2_inode *ip = GFS2_I(inode);
+ struct gfs2_sbd *sdp = GFS2_SB(inode);
+ unsigned int data_blocks = 0, ind_blocks = 0, rblocks;
+@@ -996,9 +991,9 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
+ unstuff = gfs2_is_stuffed(ip) &&
+ pos + length > gfs2_max_stuffed_size(ip);
+
+- ret = gfs2_iomap_get(inode, pos, length, flags, iomap, &mp);
++ ret = gfs2_iomap_get(inode, pos, length, flags, iomap, mp);
+ if (ret)
+- goto out_release;
++ goto out_unlock;
+
+ alloc_required = unstuff || iomap->type == IOMAP_HOLE;
+
+@@ -1013,7 +1008,7 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
+
+ ret = gfs2_quota_lock_check(ip, &ap);
+ if (ret)
+- goto out_release;
++ goto out_unlock;
+
+ ret = gfs2_inplace_reserve(ip, &ap);
+ if (ret)
+@@ -1038,17 +1033,15 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
+ ret = gfs2_unstuff_dinode(ip, NULL);
+ if (ret)
+ goto out_trans_end;
+- release_metapath(&mp);
+- brelse(iomap->private);
+- iomap->private = NULL;
++ release_metapath(mp);
+ ret = gfs2_iomap_get(inode, iomap->offset, iomap->length,
+- flags, iomap, &mp);
++ flags, iomap, mp);
+ if (ret)
+ goto out_trans_end;
+ }
+
+ if (iomap->type == IOMAP_HOLE) {
+- ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
++ ret = gfs2_iomap_alloc(inode, iomap, flags, mp);
+ if (ret) {
+ gfs2_trans_end(sdp);
+ gfs2_inplace_release(ip);
+@@ -1056,7 +1049,6 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
+ goto out_qunlock;
+ }
+ }
+- release_metapath(&mp);
+ if (!gfs2_is_stuffed(ip) && gfs2_is_jdata(ip))
+ iomap->page_done = gfs2_iomap_journaled_page_done;
+ return 0;
+@@ -1069,10 +1061,7 @@ out_trans_fail:
+ out_qunlock:
+ if (alloc_required)
+ gfs2_quota_unlock(ip);
+-out_release:
+- if (iomap->private)
+- brelse(iomap->private);
+- release_metapath(&mp);
++out_unlock:
+ gfs2_write_unlock(inode);
+ return ret;
+ }
+@@ -1088,10 +1077,10 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
+
+ trace_gfs2_iomap_start(ip, pos, length, flags);
+ if ((flags & IOMAP_WRITE) && !(flags & IOMAP_DIRECT)) {
+- ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap);
++ ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap, &mp);
+ } else {
+ ret = gfs2_iomap_get(inode, pos, length, flags, iomap, &mp);
+- release_metapath(&mp);
++
+ /*
+ * Silently fall back to buffered I/O for stuffed files or if
+ * we've hot a hole (see gfs2_file_direct_write).
+@@ -1100,6 +1089,11 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
+ iomap->type != IOMAP_MAPPED)
+ ret = -ENOTBLK;
+ }
++ if (!ret) {
++ get_bh(mp.mp_bh[0]);
++ iomap->private = mp.mp_bh[0];
++ }
++ release_metapath(&mp);
+ trace_gfs2_iomap_end(ip, iomap, ret);
+ return ret;
+ }
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index 6b84ef6ccff3..b041cb8ae383 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -72,13 +72,13 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb)
+ if (!sdp)
+ return NULL;
+
+- sb->s_fs_info = sdp;
+ sdp->sd_vfs = sb;
+ sdp->sd_lkstats = alloc_percpu(struct gfs2_pcpu_lkstats);
+ if (!sdp->sd_lkstats) {
+ kfree(sdp);
+ return NULL;
+ }
++ sb->s_fs_info = sdp;
+
+ set_bit(SDF_NOJOURNALID, &sdp->sd_flags);
+ gfs2_tune_init(&sdp->sd_tune);
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index fa515d5ea5ba..7b861bbc0b43 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -66,7 +66,7 @@ __be32 nfs4_callback_getattr(void *argp, void *resp,
+ out_iput:
+ rcu_read_unlock();
+ trace_nfs4_cb_getattr(cps->clp, &args->fh, inode, -ntohl(res->status));
+- iput(inode);
++ nfs_iput_and_deactive(inode);
+ out:
+ dprintk("%s: exit with status = %d\n", __func__, ntohl(res->status));
+ return res->status;
+@@ -108,7 +108,7 @@ __be32 nfs4_callback_recall(void *argp, void *resp,
+ }
+ trace_nfs4_cb_recall(cps->clp, &args->fh, inode,
+ &args->stateid, -ntohl(res));
+- iput(inode);
++ nfs_iput_and_deactive(inode);
+ out:
+ dprintk("%s: exit with status = %d\n", __func__, ntohl(res));
+ return res;
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index f033f3a69a3b..75fe92eaa681 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -849,16 +849,23 @@ nfs_delegation_find_inode_server(struct nfs_server *server,
+ const struct nfs_fh *fhandle)
+ {
+ struct nfs_delegation *delegation;
+- struct inode *res = NULL;
++ struct inode *freeme, *res = NULL;
+
+ list_for_each_entry_rcu(delegation, &server->delegations, super_list) {
+ spin_lock(&delegation->lock);
+ if (delegation->inode != NULL &&
+ nfs_compare_fh(fhandle, &NFS_I(delegation->inode)->fh) == 0) {
+- res = igrab(delegation->inode);
++ freeme = igrab(delegation->inode);
++ if (freeme && nfs_sb_active(freeme->i_sb))
++ res = freeme;
+ spin_unlock(&delegation->lock);
+ if (res != NULL)
+ return res;
++ if (freeme) {
++ rcu_read_unlock();
++ iput(freeme);
++ rcu_read_lock();
++ }
+ return ERR_PTR(-EAGAIN);
+ }
+ spin_unlock(&delegation->lock);
+diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
+index 94b52157bf8d..29dee9630eec 100644
+--- a/fs/notify/fanotify/fanotify.c
++++ b/fs/notify/fanotify/fanotify.c
+@@ -115,12 +115,12 @@ static bool fanotify_should_send_event(struct fsnotify_iter_info *iter_info,
+ continue;
+ mark = iter_info->marks[type];
+ /*
+- * if the event is for a child and this inode doesn't care about
+- * events on the child, don't send it!
++ * If the event is for a child and this mark doesn't care about
++ * events on a child, don't send it!
+ */
+- if (type == FSNOTIFY_OBJ_TYPE_INODE &&
+- (event_mask & FS_EVENT_ON_CHILD) &&
+- !(mark->mask & FS_EVENT_ON_CHILD))
++ if (event_mask & FS_EVENT_ON_CHILD &&
++ (type != FSNOTIFY_OBJ_TYPE_INODE ||
++ !(mark->mask & FS_EVENT_ON_CHILD)))
+ continue;
+
+ marks_mask |= mark->mask;
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index f43ea1aad542..170a733454f7 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -161,9 +161,9 @@ int __fsnotify_parent(const struct path *path, struct dentry *dentry, __u32 mask
+ parent = dget_parent(dentry);
+ p_inode = parent->d_inode;
+
+- if (unlikely(!fsnotify_inode_watches_children(p_inode)))
++ if (unlikely(!fsnotify_inode_watches_children(p_inode))) {
+ __fsnotify_update_child_dentry_flags(p_inode);
+- else if (p_inode->i_fsnotify_mask & mask) {
++ } else if (p_inode->i_fsnotify_mask & mask & ALL_FSNOTIFY_EVENTS) {
+ struct name_snapshot name;
+
+ /* we are notifying a parent so come up with the new mask which
+@@ -193,7 +193,7 @@ static int send_to_group(struct inode *to_tell,
+ struct fsnotify_iter_info *iter_info)
+ {
+ struct fsnotify_group *group = NULL;
+- __u32 test_mask = (mask & ~FS_EVENT_ON_CHILD);
++ __u32 test_mask = (mask & ALL_FSNOTIFY_EVENTS);
+ __u32 marks_mask = 0;
+ __u32 marks_ignored_mask = 0;
+ struct fsnotify_mark *mark;
+@@ -324,14 +324,17 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
+ struct fsnotify_iter_info iter_info = {};
+ struct mount *mnt;
+ int ret = 0;
+- /* global tests shouldn't care about events on child only the specific event */
+- __u32 test_mask = (mask & ~FS_EVENT_ON_CHILD);
++ __u32 test_mask = (mask & ALL_FSNOTIFY_EVENTS);
+
+ if (data_is == FSNOTIFY_EVENT_PATH)
+ mnt = real_mount(((const struct path *)data)->mnt);
+ else
+ mnt = NULL;
+
++ /* An event "on child" is not intended for a mount mark */
++ if (mask & FS_EVENT_ON_CHILD)
++ mnt = NULL;
++
+ /*
+ * Optimization: srcu_read_lock() has a memory barrier which can
+ * be expensive. It protects walking the *_fsnotify_marks lists.
+@@ -389,7 +392,7 @@ static __init int fsnotify_init(void)
+ {
+ int ret;
+
+- BUG_ON(hweight32(ALL_FSNOTIFY_EVENTS) != 23);
++ BUG_ON(hweight32(ALL_FSNOTIFY_BITS) != 23);
+
+ ret = init_srcu_struct(&fsnotify_mark_srcu);
+ if (ret)
+diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
+index a83e1f632eb7..f01623aef2f7 100644
+--- a/include/linux/can/dev.h
++++ b/include/linux/can/dev.h
+@@ -169,6 +169,7 @@ void can_change_state(struct net_device *dev, struct can_frame *cf,
+
+ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
+ unsigned int idx);
++struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr);
+ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx);
+ void can_free_echo_skb(struct net_device *dev, unsigned int idx);
+
+diff --git a/include/linux/can/rx-offload.h b/include/linux/can/rx-offload.h
+index cb31683bbe15..8268811a697e 100644
+--- a/include/linux/can/rx-offload.h
++++ b/include/linux/can/rx-offload.h
+@@ -41,7 +41,12 @@ int can_rx_offload_add_timestamp(struct net_device *dev, struct can_rx_offload *
+ int can_rx_offload_add_fifo(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight);
+ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 reg);
+ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload);
+-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb);
++int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
++ struct sk_buff *skb, u32 timestamp);
++unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload,
++ unsigned int idx, u32 timestamp);
++int can_rx_offload_queue_tail(struct can_rx_offload *offload,
++ struct sk_buff *skb);
+ void can_rx_offload_reset(struct can_rx_offload *offload);
+ void can_rx_offload_del(struct can_rx_offload *offload);
+ void can_rx_offload_enable(struct can_rx_offload *offload);
+diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
+index b8f4182f42f1..4599d1c95f8c 100644
+--- a/include/linux/fsnotify_backend.h
++++ b/include/linux/fsnotify_backend.h
+@@ -68,15 +68,20 @@
+
+ #define ALL_FSNOTIFY_PERM_EVENTS (FS_OPEN_PERM | FS_ACCESS_PERM)
+
++/* Events that can be reported to backends */
+ #define ALL_FSNOTIFY_EVENTS (FS_ACCESS | FS_MODIFY | FS_ATTRIB | \
+ FS_CLOSE_WRITE | FS_CLOSE_NOWRITE | FS_OPEN | \
+ FS_MOVED_FROM | FS_MOVED_TO | FS_CREATE | \
+ FS_DELETE | FS_DELETE_SELF | FS_MOVE_SELF | \
+ FS_UNMOUNT | FS_Q_OVERFLOW | FS_IN_IGNORED | \
+- FS_OPEN_PERM | FS_ACCESS_PERM | FS_EXCL_UNLINK | \
+- FS_ISDIR | FS_IN_ONESHOT | FS_DN_RENAME | \
++ FS_OPEN_PERM | FS_ACCESS_PERM | FS_DN_RENAME)
++
++/* Extra flags that may be reported with event or control handling of events */
++#define ALL_FSNOTIFY_FLAGS (FS_EXCL_UNLINK | FS_ISDIR | FS_IN_ONESHOT | \
+ FS_DN_MULTISHOT | FS_EVENT_ON_CHILD)
+
++#define ALL_FSNOTIFY_BITS (ALL_FSNOTIFY_EVENTS | ALL_FSNOTIFY_FLAGS)
++
+ struct fsnotify_group;
+ struct fsnotify_event;
+ struct fsnotify_mark;
+diff --git a/include/linux/pfn_t.h b/include/linux/pfn_t.h
+index 21713dc14ce2..673546ba7342 100644
+--- a/include/linux/pfn_t.h
++++ b/include/linux/pfn_t.h
+@@ -10,7 +10,7 @@
+ * PFN_DEV - pfn is not covered by system memmap by default
+ * PFN_MAP - pfn has a dynamic page mapping established by a device driver
+ */
+-#define PFN_FLAGS_MASK (((u64) ~PAGE_MASK) << (BITS_PER_LONG_LONG - PAGE_SHIFT))
++#define PFN_FLAGS_MASK (((u64) (~PAGE_MASK)) << (BITS_PER_LONG_LONG - PAGE_SHIFT))
+ #define PFN_SG_CHAIN (1ULL << (BITS_PER_LONG_LONG - 1))
+ #define PFN_SG_LAST (1ULL << (BITS_PER_LONG_LONG - 2))
+ #define PFN_DEV (1ULL << (BITS_PER_LONG_LONG - 3))
+diff --git a/include/net/sock.h b/include/net/sock.h
+index c64a1cff9eb3..f18dbd6da906 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1491,6 +1491,7 @@ static inline void lock_sock(struct sock *sk)
+ lock_sock_nested(sk, 0);
+ }
+
++void __release_sock(struct sock *sk);
+ void release_sock(struct sock *sk);
+
+ /* BH context may only use the following locking interface. */
+diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
+index ed5d34925ad0..6a4b41484afe 100644
+--- a/kernel/debug/kdb/kdb_io.c
++++ b/kernel/debug/kdb/kdb_io.c
+@@ -216,7 +216,7 @@ static char *kdb_read(char *buffer, size_t bufsize)
+ int count;
+ int i;
+ int diag, dtab_count;
+- int key;
++ int key, buf_size, ret;
+
+
+ diag = kdbgetintenv("DTABCOUNT", &dtab_count);
+@@ -336,9 +336,8 @@ poll_again:
+ else
+ p_tmp = tmpbuffer;
+ len = strlen(p_tmp);
+- count = kallsyms_symbol_complete(p_tmp,
+- sizeof(tmpbuffer) -
+- (p_tmp - tmpbuffer));
++ buf_size = sizeof(tmpbuffer) - (p_tmp - tmpbuffer);
++ count = kallsyms_symbol_complete(p_tmp, buf_size);
+ if (tab == 2 && count > 0) {
+ kdb_printf("\n%d symbols are found.", count);
+ if (count > dtab_count) {
+@@ -350,9 +349,13 @@ poll_again:
+ }
+ kdb_printf("\n");
+ for (i = 0; i < count; i++) {
+- if (WARN_ON(!kallsyms_symbol_next(p_tmp, i)))
++ ret = kallsyms_symbol_next(p_tmp, i, buf_size);
++ if (WARN_ON(!ret))
+ break;
+- kdb_printf("%s ", p_tmp);
++ if (ret != -E2BIG)
++ kdb_printf("%s ", p_tmp);
++ else
++ kdb_printf("%s... ", p_tmp);
+ *(p_tmp + len) = '\0';
+ }
+ if (i >= dtab_count)
+diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
+index 1e5a502ba4a7..2118d8258b7c 100644
+--- a/kernel/debug/kdb/kdb_private.h
++++ b/kernel/debug/kdb/kdb_private.h
+@@ -83,7 +83,7 @@ typedef struct __ksymtab {
+ unsigned long sym_start;
+ unsigned long sym_end;
+ } kdb_symtab_t;
+-extern int kallsyms_symbol_next(char *prefix_name, int flag);
++extern int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size);
+ extern int kallsyms_symbol_complete(char *prefix_name, int max_len);
+
+ /* Exported Symbols for kernel loadable modules to use. */
+diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
+index 987eb73284d2..b14b0925c184 100644
+--- a/kernel/debug/kdb/kdb_support.c
++++ b/kernel/debug/kdb/kdb_support.c
+@@ -221,11 +221,13 @@ int kallsyms_symbol_complete(char *prefix_name, int max_len)
+ * Parameters:
+ * prefix_name prefix of a symbol name to lookup
+ * flag 0 means search from the head, 1 means continue search.
++ * buf_size maximum length that can be written to prefix_name
++ * buffer
+ * Returns:
+ * 1 if a symbol matches the given prefix.
+ * 0 if no string found
+ */
+-int kallsyms_symbol_next(char *prefix_name, int flag)
++int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size)
+ {
+ int prefix_len = strlen(prefix_name);
+ static loff_t pos;
+@@ -235,10 +237,8 @@ int kallsyms_symbol_next(char *prefix_name, int flag)
+ pos = 0;
+
+ while ((name = kdb_walk_kallsyms(&pos))) {
+- if (strncmp(name, prefix_name, prefix_len) == 0) {
+- strncpy(prefix_name, name, strlen(name)+1);
+- return 1;
+- }
++ if (!strncmp(name, prefix_name, prefix_len))
++ return strscpy(prefix_name, name, buf_size);
+ }
+ return 0;
+ }
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 0b760c1369f7..15301ed19da6 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -2662,6 +2662,15 @@ void rcu_check_callbacks(int user)
+ rcu_bh_qs();
+ }
+ rcu_preempt_check_callbacks();
++ /* The load-acquire pairs with the store-release setting to true. */
++ if (smp_load_acquire(this_cpu_ptr(&rcu_dynticks.rcu_urgent_qs))) {
++ /* Idle and userspace execution already are quiescent states. */
++ if (!rcu_is_cpu_rrupt_from_idle() && !user) {
++ set_tsk_need_resched(current);
++ set_preempt_need_resched();
++ }
++ __this_cpu_write(rcu_dynticks.rcu_urgent_qs, false);
++ }
+ if (rcu_pending())
+ invoke_rcu_core();
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 908c9cdae2f0..1162552dc3cc 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -5672,11 +5672,11 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p,
+ return target;
+ }
+
+-static unsigned long cpu_util_wake(int cpu, struct task_struct *p);
++static unsigned long cpu_util_without(int cpu, struct task_struct *p);
+
+-static unsigned long capacity_spare_wake(int cpu, struct task_struct *p)
++static unsigned long capacity_spare_without(int cpu, struct task_struct *p)
+ {
+- return max_t(long, capacity_of(cpu) - cpu_util_wake(cpu, p), 0);
++ return max_t(long, capacity_of(cpu) - cpu_util_without(cpu, p), 0);
+ }
+
+ /*
+@@ -5736,7 +5736,7 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p,
+
+ avg_load += cfs_rq_load_avg(&cpu_rq(i)->cfs);
+
+- spare_cap = capacity_spare_wake(i, p);
++ spare_cap = capacity_spare_without(i, p);
+
+ if (spare_cap > max_spare_cap)
+ max_spare_cap = spare_cap;
+@@ -5887,8 +5887,8 @@ static inline int find_idlest_cpu(struct sched_domain *sd, struct task_struct *p
+ return prev_cpu;
+
+ /*
+- * We need task's util for capacity_spare_wake, sync it up to prev_cpu's
+- * last_update_time.
++ * We need task's util for capacity_spare_without, sync it up to
++ * prev_cpu's last_update_time.
+ */
+ if (!(sd_flag & SD_BALANCE_FORK))
+ sync_entity_load_avg(&p->se);
+@@ -6214,10 +6214,19 @@ static inline unsigned long cpu_util(int cpu)
+ }
+
+ /*
+- * cpu_util_wake: Compute CPU utilization with any contributions from
+- * the waking task p removed.
++ * cpu_util_without: compute cpu utilization without any contributions from *p
++ * @cpu: the CPU which utilization is requested
++ * @p: the task which utilization should be discounted
++ *
++ * The utilization of a CPU is defined by the utilization of tasks currently
++ * enqueued on that CPU as well as tasks which are currently sleeping after an
++ * execution on that CPU.
++ *
++ * This method returns the utilization of the specified CPU by discounting the
++ * utilization of the specified task, whenever the task is currently
++ * contributing to the CPU utilization.
+ */
+-static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
++static unsigned long cpu_util_without(int cpu, struct task_struct *p)
+ {
+ struct cfs_rq *cfs_rq;
+ unsigned int util;
+@@ -6229,7 +6238,7 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
+ cfs_rq = &cpu_rq(cpu)->cfs;
+ util = READ_ONCE(cfs_rq->avg.util_avg);
+
+- /* Discount task's blocked util from CPU's util */
++ /* Discount task's util from CPU's util */
+ util -= min_t(unsigned int, util, task_util(p));
+
+ /*
+@@ -6238,14 +6247,14 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
+ * a) if *p is the only task sleeping on this CPU, then:
+ * cpu_util (== task_util) > util_est (== 0)
+ * and thus we return:
+- * cpu_util_wake = (cpu_util - task_util) = 0
++ * cpu_util_without = (cpu_util - task_util) = 0
+ *
+ * b) if other tasks are SLEEPING on this CPU, which is now exiting
+ * IDLE, then:
+ * cpu_util >= task_util
+ * cpu_util > util_est (== 0)
+ * and thus we discount *p's blocked utilization to return:
+- * cpu_util_wake = (cpu_util - task_util) >= 0
++ * cpu_util_without = (cpu_util - task_util) >= 0
+ *
+ * c) if other tasks are RUNNABLE on that CPU and
+ * util_est > cpu_util
+@@ -6258,8 +6267,33 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
+ * covered by the following code when estimated utilization is
+ * enabled.
+ */
+- if (sched_feat(UTIL_EST))
+- util = max(util, READ_ONCE(cfs_rq->avg.util_est.enqueued));
++ if (sched_feat(UTIL_EST)) {
++ unsigned int estimated =
++ READ_ONCE(cfs_rq->avg.util_est.enqueued);
++
++ /*
++ * Despite the following checks we still have a small window
++ * for a possible race, when an execl's select_task_rq_fair()
++ * races with LB's detach_task():
++ *
++ * detach_task()
++ * p->on_rq = TASK_ON_RQ_MIGRATING;
++ * ---------------------------------- A
++ * deactivate_task() \
++ * dequeue_task() + RaceTime
++ * util_est_dequeue() /
++ * ---------------------------------- B
++ *
++ * The additional check on "current == p" it's required to
++ * properly fix the execl regression and it helps in further
++ * reducing the chances for the above race.
++ */
++ if (unlikely(task_on_rq_queued(p) || current == p)) {
++ estimated -= min_t(unsigned int, estimated,
++ (_task_util_est(p) | UTIL_AVG_UNCHANGED));
++ }
++ util = max(util, estimated);
++ }
+
+ /*
+ * Utilization (estimated) can exceed the CPU capacity, thus let's
+diff --git a/mm/memory.c b/mm/memory.c
+index c467102a5cbc..5c5df53dbdf9 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3745,10 +3745,36 @@ static vm_fault_t do_fault(struct vm_fault *vmf)
+ struct vm_area_struct *vma = vmf->vma;
+ vm_fault_t ret;
+
+- /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
+- if (!vma->vm_ops->fault)
+- ret = VM_FAULT_SIGBUS;
+- else if (!(vmf->flags & FAULT_FLAG_WRITE))
++ /*
++ * The VMA was not fully populated on mmap() or missing VM_DONTEXPAND
++ */
++ if (!vma->vm_ops->fault) {
++ /*
++ * If we find a migration pmd entry or a none pmd entry, which
++ * should never happen, return SIGBUS
++ */
++ if (unlikely(!pmd_present(*vmf->pmd)))
++ ret = VM_FAULT_SIGBUS;
++ else {
++ vmf->pte = pte_offset_map_lock(vmf->vma->vm_mm,
++ vmf->pmd,
++ vmf->address,
++ &vmf->ptl);
++ /*
++ * Make sure this is not a temporary clearing of pte
++ * by holding ptl and checking again. A R/M/W update
++ * of pte involves: take ptl, clearing the pte so that
++ * we don't have concurrent modification by hardware
++ * followed by an update.
++ */
++ if (unlikely(pte_none(*vmf->pte)))
++ ret = VM_FAULT_SIGBUS;
++ else
++ ret = VM_FAULT_NOPAGE;
++
++ pte_unmap_unlock(vmf->pte, vmf->ptl);
++ }
++ } else if (!(vmf->flags & FAULT_FLAG_WRITE))
+ ret = do_read_fault(vmf);
+ else if (!(vma->vm_flags & VM_SHARED))
+ ret = do_cow_fault(vmf);
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index e2ef1c17942f..b721631d78ab 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4055,17 +4055,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
+ unsigned int cpuset_mems_cookie;
+ int reserve_flags;
+
+- /*
+- * In the slowpath, we sanity check order to avoid ever trying to
+- * reclaim >= MAX_ORDER areas which will never succeed. Callers may
+- * be using allocators in order of preference for an area that is
+- * too large.
+- */
+- if (order >= MAX_ORDER) {
+- WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN));
+- return NULL;
+- }
+-
+ /*
+ * We also sanity check to catch abuse of atomic reserves being used by
+ * callers that are not in atomic context.
+@@ -4359,6 +4348,15 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, int preferred_nid,
+ gfp_t alloc_mask; /* The gfp_t that was actually used for allocation */
+ struct alloc_context ac = { };
+
++ /*
++ * There are several places where we assume that the order value is sane
++ * so bail out early if the request is out of bound.
++ */
++ if (unlikely(order >= MAX_ORDER)) {
++ WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN));
++ return NULL;
++ }
++
+ gfp_mask &= gfp_allowed_mask;
+ alloc_mask = gfp_mask;
+ if (!prepare_alloc_pages(gfp_mask, order, preferred_nid, nodemask, &ac, &alloc_mask, &alloc_flags))
+@@ -7690,6 +7688,14 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count,
+ if (PageReserved(page))
+ goto unmovable;
+
++ /*
++ * If the zone is movable and we have ruled out all reserved
++ * pages then it should be reasonably safe to assume the rest
++ * is movable.
++ */
++ if (zone_idx(zone) == ZONE_MOVABLE)
++ continue;
++
+ /*
+ * Hugepages are not in LRU lists, but they're movable.
+ * We need not scan over tail pages bacause we don't
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 446942677cd4..38d228a30fdc 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2610,9 +2610,7 @@ static loff_t shmem_file_llseek(struct file *file, loff_t offset, int whence)
+ inode_lock(inode);
+ /* We're holding i_mutex so we can access i_size directly */
+
+- if (offset < 0)
+- offset = -EINVAL;
+- else if (offset >= inode->i_size)
++ if (offset < 0 || offset >= inode->i_size)
+ offset = -ENXIO;
+ else {
+ start = offset >> PAGE_SHIFT;
+diff --git a/mm/slab.c b/mm/slab.c
+index aa76a70e087e..d73c7a4820a4 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -3675,6 +3675,8 @@ __do_kmalloc_node(size_t size, gfp_t flags, int node, unsigned long caller)
+ struct kmem_cache *cachep;
+ void *ret;
+
++ if (unlikely(size > KMALLOC_MAX_CACHE_SIZE))
++ return NULL;
+ cachep = kmalloc_slab(size, flags);
+ if (unlikely(ZERO_OR_NULL_PTR(cachep)))
+ return cachep;
+@@ -3710,6 +3712,8 @@ static __always_inline void *__do_kmalloc(size_t size, gfp_t flags,
+ struct kmem_cache *cachep;
+ void *ret;
+
++ if (unlikely(size > KMALLOC_MAX_CACHE_SIZE))
++ return NULL;
+ cachep = kmalloc_slab(size, flags);
+ if (unlikely(ZERO_OR_NULL_PTR(cachep)))
+ return cachep;
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index fea3376f9816..3a7ac4f15194 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -1027,18 +1027,18 @@ struct kmem_cache *kmalloc_slab(size_t size, gfp_t flags)
+ {
+ unsigned int index;
+
+- if (unlikely(size > KMALLOC_MAX_SIZE)) {
+- WARN_ON_ONCE(!(flags & __GFP_NOWARN));
+- return NULL;
+- }
+-
+ if (size <= 192) {
+ if (!size)
+ return ZERO_SIZE_PTR;
+
+ index = size_index[size_index_elem(size)];
+- } else
++ } else {
++ if (unlikely(size > KMALLOC_MAX_CACHE_SIZE)) {
++ WARN_ON(1);
++ return NULL;
++ }
+ index = fls(size - 1);
++ }
+
+ #ifdef CONFIG_ZONE_DMA
+ if (unlikely((flags & GFP_DMA)))
+diff --git a/mm/z3fold.c b/mm/z3fold.c
+index 4b366d181f35..aee9b0b8d907 100644
+--- a/mm/z3fold.c
++++ b/mm/z3fold.c
+@@ -99,6 +99,7 @@ struct z3fold_header {
+ #define NCHUNKS ((PAGE_SIZE - ZHDR_SIZE_ALIGNED) >> CHUNK_SHIFT)
+
+ #define BUDDY_MASK (0x3)
++#define BUDDY_SHIFT 2
+
+ /**
+ * struct z3fold_pool - stores metadata for each z3fold pool
+@@ -145,7 +146,7 @@ enum z3fold_page_flags {
+ MIDDLE_CHUNK_MAPPED,
+ NEEDS_COMPACTING,
+ PAGE_STALE,
+- UNDER_RECLAIM
++ PAGE_CLAIMED, /* by either reclaim or free */
+ };
+
+ /*****************
+@@ -174,7 +175,7 @@ static struct z3fold_header *init_z3fold_page(struct page *page,
+ clear_bit(MIDDLE_CHUNK_MAPPED, &page->private);
+ clear_bit(NEEDS_COMPACTING, &page->private);
+ clear_bit(PAGE_STALE, &page->private);
+- clear_bit(UNDER_RECLAIM, &page->private);
++ clear_bit(PAGE_CLAIMED, &page->private);
+
+ spin_lock_init(&zhdr->page_lock);
+ kref_init(&zhdr->refcount);
+@@ -223,8 +224,11 @@ static unsigned long encode_handle(struct z3fold_header *zhdr, enum buddy bud)
+ unsigned long handle;
+
+ handle = (unsigned long)zhdr;
+- if (bud != HEADLESS)
+- handle += (bud + zhdr->first_num) & BUDDY_MASK;
++ if (bud != HEADLESS) {
++ handle |= (bud + zhdr->first_num) & BUDDY_MASK;
++ if (bud == LAST)
++ handle |= (zhdr->last_chunks << BUDDY_SHIFT);
++ }
+ return handle;
+ }
+
+@@ -234,6 +238,12 @@ static struct z3fold_header *handle_to_z3fold_header(unsigned long handle)
+ return (struct z3fold_header *)(handle & PAGE_MASK);
+ }
+
++/* only for LAST bud, returns zero otherwise */
++static unsigned short handle_to_chunks(unsigned long handle)
++{
++ return (handle & ~PAGE_MASK) >> BUDDY_SHIFT;
++}
++
+ /*
+ * (handle & BUDDY_MASK) < zhdr->first_num is possible in encode_handle
+ * but that doesn't matter. because the masking will result in the
+@@ -720,37 +730,39 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
+ page = virt_to_page(zhdr);
+
+ if (test_bit(PAGE_HEADLESS, &page->private)) {
+- /* HEADLESS page stored */
+- bud = HEADLESS;
+- } else {
+- z3fold_page_lock(zhdr);
+- bud = handle_to_buddy(handle);
+-
+- switch (bud) {
+- case FIRST:
+- zhdr->first_chunks = 0;
+- break;
+- case MIDDLE:
+- zhdr->middle_chunks = 0;
+- zhdr->start_middle = 0;
+- break;
+- case LAST:
+- zhdr->last_chunks = 0;
+- break;
+- default:
+- pr_err("%s: unknown bud %d\n", __func__, bud);
+- WARN_ON(1);
+- z3fold_page_unlock(zhdr);
+- return;
++ /* if a headless page is under reclaim, just leave.
++ * NB: we use test_and_set_bit for a reason: if the bit
++ * has not been set before, we release this page
++ * immediately so we don't care about its value any more.
++ */
++ if (!test_and_set_bit(PAGE_CLAIMED, &page->private)) {
++ spin_lock(&pool->lock);
++ list_del(&page->lru);
++ spin_unlock(&pool->lock);
++ free_z3fold_page(page);
++ atomic64_dec(&pool->pages_nr);
+ }
++ return;
+ }
+
+- if (bud == HEADLESS) {
+- spin_lock(&pool->lock);
+- list_del(&page->lru);
+- spin_unlock(&pool->lock);
+- free_z3fold_page(page);
+- atomic64_dec(&pool->pages_nr);
++ /* Non-headless case */
++ z3fold_page_lock(zhdr);
++ bud = handle_to_buddy(handle);
++
++ switch (bud) {
++ case FIRST:
++ zhdr->first_chunks = 0;
++ break;
++ case MIDDLE:
++ zhdr->middle_chunks = 0;
++ break;
++ case LAST:
++ zhdr->last_chunks = 0;
++ break;
++ default:
++ pr_err("%s: unknown bud %d\n", __func__, bud);
++ WARN_ON(1);
++ z3fold_page_unlock(zhdr);
+ return;
+ }
+
+@@ -758,7 +770,7 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
+ atomic64_dec(&pool->pages_nr);
+ return;
+ }
+- if (test_bit(UNDER_RECLAIM, &page->private)) {
++ if (test_bit(PAGE_CLAIMED, &page->private)) {
+ z3fold_page_unlock(zhdr);
+ return;
+ }
+@@ -836,20 +848,30 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries)
+ }
+ list_for_each_prev(pos, &pool->lru) {
+ page = list_entry(pos, struct page, lru);
++
++ /* this bit could have been set by free, in which case
++ * we pass over to the next page in the pool.
++ */
++ if (test_and_set_bit(PAGE_CLAIMED, &page->private))
++ continue;
++
++ zhdr = page_address(page);
+ if (test_bit(PAGE_HEADLESS, &page->private))
+- /* candidate found */
+ break;
+
+- zhdr = page_address(page);
+- if (!z3fold_page_trylock(zhdr))
++ if (!z3fold_page_trylock(zhdr)) {
++ zhdr = NULL;
+ continue; /* can't evict at this point */
++ }
+ kref_get(&zhdr->refcount);
+ list_del_init(&zhdr->buddy);
+ zhdr->cpu = -1;
+- set_bit(UNDER_RECLAIM, &page->private);
+ break;
+ }
+
++ if (!zhdr)
++ break;
++
+ list_del_init(&page->lru);
+ spin_unlock(&pool->lock);
+
+@@ -898,6 +920,7 @@ next:
+ if (test_bit(PAGE_HEADLESS, &page->private)) {
+ if (ret == 0) {
+ free_z3fold_page(page);
++ atomic64_dec(&pool->pages_nr);
+ return 0;
+ }
+ spin_lock(&pool->lock);
+@@ -905,7 +928,7 @@ next:
+ spin_unlock(&pool->lock);
+ } else {
+ z3fold_page_lock(zhdr);
+- clear_bit(UNDER_RECLAIM, &page->private);
++ clear_bit(PAGE_CLAIMED, &page->private);
+ if (kref_put(&zhdr->refcount,
+ release_z3fold_page_locked)) {
+ atomic64_dec(&pool->pages_nr);
+@@ -964,7 +987,7 @@ static void *z3fold_map(struct z3fold_pool *pool, unsigned long handle)
+ set_bit(MIDDLE_CHUNK_MAPPED, &page->private);
+ break;
+ case LAST:
+- addr += PAGE_SIZE - (zhdr->last_chunks << CHUNK_SHIFT);
++ addr += PAGE_SIZE - (handle_to_chunks(handle) << CHUNK_SHIFT);
+ break;
+ default:
+ pr_err("unknown buddy id %d\n", buddy);
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 1051eee82581..3aab7664933f 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -745,18 +745,19 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ } else
+ ifindex = ro->ifindex;
+
+- if (ro->fd_frames) {
++ dev = dev_get_by_index(sock_net(sk), ifindex);
++ if (!dev)
++ return -ENXIO;
++
++ err = -EINVAL;
++ if (ro->fd_frames && dev->mtu == CANFD_MTU) {
+ if (unlikely(size != CANFD_MTU && size != CAN_MTU))
+- return -EINVAL;
++ goto put_dev;
+ } else {
+ if (unlikely(size != CAN_MTU))
+- return -EINVAL;
++ goto put_dev;
+ }
+
+- dev = dev_get_by_index(sock_net(sk), ifindex);
+- if (!dev)
+- return -ENXIO;
+-
+ skb = sock_alloc_send_skb(sk, size + sizeof(struct can_skb_priv),
+ msg->msg_flags & MSG_DONTWAIT, &err);
+ if (!skb)
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 3730eb855095..748765e35423 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2317,7 +2317,7 @@ static void __lock_sock(struct sock *sk)
+ finish_wait(&sk->sk_lock.wq, &wait);
+ }
+
+-static void __release_sock(struct sock *sk)
++void __release_sock(struct sock *sk)
+ __releases(&sk->sk_lock.slock)
+ __acquires(&sk->sk_lock.slock)
+ {
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index bbd07736fb0f..a32a0f4cc138 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2403,16 +2403,10 @@ adjudge_to_death:
+ sock_hold(sk);
+ sock_orphan(sk);
+
+- /* It is the last release_sock in its life. It will remove backlog. */
+- release_sock(sk);
+-
+-
+- /* Now socket is owned by kernel and we acquire BH lock
+- * to finish close. No need to check for user refs.
+- */
+ local_bh_disable();
+ bh_lock_sock(sk);
+- WARN_ON(sock_owned_by_user(sk));
++ /* remove backlog if any, without releasing ownership. */
++ __release_sock(sk);
+
+ percpu_counter_inc(sk->sk_prot->orphan_count);
+
+@@ -2481,6 +2475,7 @@ adjudge_to_death:
+ out:
+ bh_unlock_sock(sk);
+ local_bh_enable();
++ release_sock(sk);
+ sock_put(sk);
+ }
+ EXPORT_SYMBOL(tcp_close);
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index 1beeea9549fa..b99e73a7e7e0 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -730,7 +730,6 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ struct sk_buff *skb = NULL;
+ struct sock *sk = sock->sk;
+ struct llc_sock *llc = llc_sk(sk);
+- unsigned long cpu_flags;
+ size_t copied = 0;
+ u32 peek_seq = 0;
+ u32 *seq, skb_len;
+@@ -855,9 +854,8 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ goto copy_uaddr;
+
+ if (!(flags & MSG_PEEK)) {
+- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
+- sk_eat_skb(sk, skb);
+- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
++ skb_unlink(skb, &sk->sk_receive_queue);
++ kfree_skb(skb);
+ *seq = 0;
+ }
+
+@@ -878,9 +876,8 @@ copy_uaddr:
+ llc_cmsg_rcv(msg, skb);
+
+ if (!(flags & MSG_PEEK)) {
+- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
+- sk_eat_skb(sk, skb);
+- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
++ skb_unlink(skb, &sk->sk_receive_queue);
++ kfree_skb(skb);
+ *seq = 0;
+ }
+
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index a827a1f562bf..6a28b96e779e 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -499,8 +499,9 @@ void sctp_assoc_set_primary(struct sctp_association *asoc,
+ void sctp_assoc_rm_peer(struct sctp_association *asoc,
+ struct sctp_transport *peer)
+ {
+- struct list_head *pos;
+- struct sctp_transport *transport;
++ struct sctp_transport *transport;
++ struct list_head *pos;
++ struct sctp_chunk *ch;
+
+ pr_debug("%s: association:%p addr:%pISpc\n",
+ __func__, asoc, &peer->ipaddr.sa);
+@@ -564,7 +565,6 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
+ */
+ if (!list_empty(&peer->transmitted)) {
+ struct sctp_transport *active = asoc->peer.active_path;
+- struct sctp_chunk *ch;
+
+ /* Reset the transport of each chunk on this list */
+ list_for_each_entry(ch, &peer->transmitted,
+@@ -586,6 +586,10 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
+ sctp_transport_hold(active);
+ }
+
++ list_for_each_entry(ch, &asoc->outqueue.out_chunk_list, list)
++ if (ch->transport == peer)
++ ch->transport = NULL;
++
+ asoc->peer.transport_count--;
+
+ sctp_transport_free(peer);
+diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
+index f1df9837f1ac..1ac08dcbf85d 100644
+--- a/net/sunrpc/auth_generic.c
++++ b/net/sunrpc/auth_generic.c
+@@ -281,13 +281,7 @@ static bool generic_key_to_expire(struct rpc_cred *cred)
+ {
+ struct auth_cred *acred = &container_of(cred, struct generic_cred,
+ gc_base)->acred;
+- bool ret;
+-
+- get_rpccred(cred);
+- ret = test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
+- put_rpccred(cred);
+-
+- return ret;
++ return test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
+ }
+
+ static const struct rpc_credops generic_credops = {
+diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
+index e9394e7adc84..f4eadd3f7350 100644
+--- a/security/selinux/ss/policydb.c
++++ b/security/selinux/ss/policydb.c
+@@ -1101,7 +1101,7 @@ static int str_read(char **strp, gfp_t flags, void *fp, u32 len)
+ if ((len == 0) || (len == (u32)-1))
+ return -EINVAL;
+
+- str = kmalloc(len + 1, flags);
++ str = kmalloc(len + 1, flags | __GFP_NOWARN);
+ if (!str)
+ return -ENOMEM;
+
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index f8d4a419f3af..467039b342b5 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -1062,8 +1062,8 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
+ runtime->oss.channels = params_channels(params);
+ runtime->oss.rate = params_rate(params);
+
+- vfree(runtime->oss.buffer);
+- runtime->oss.buffer = vmalloc(runtime->oss.period_bytes);
++ kvfree(runtime->oss.buffer);
++ runtime->oss.buffer = kvzalloc(runtime->oss.period_bytes, GFP_KERNEL);
+ if (!runtime->oss.buffer) {
+ err = -ENOMEM;
+ goto failure;
+@@ -2328,7 +2328,7 @@ static void snd_pcm_oss_release_substream(struct snd_pcm_substream *substream)
+ {
+ struct snd_pcm_runtime *runtime;
+ runtime = substream->runtime;
+- vfree(runtime->oss.buffer);
++ kvfree(runtime->oss.buffer);
+ runtime->oss.buffer = NULL;
+ #ifdef CONFIG_SND_PCM_OSS_PLUGINS
+ snd_pcm_oss_plugin_clear(substream);
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index 0391cb1a4f19..71571d992159 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -66,8 +66,8 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t
+ return -ENXIO;
+ size /= 8;
+ if (plugin->buf_frames < frames) {
+- vfree(plugin->buf);
+- plugin->buf = vmalloc(size);
++ kvfree(plugin->buf);
++ plugin->buf = kvzalloc(size, GFP_KERNEL);
+ plugin->buf_frames = frames;
+ }
+ if (!plugin->buf) {
+@@ -191,7 +191,7 @@ int snd_pcm_plugin_free(struct snd_pcm_plugin *plugin)
+ if (plugin->private_free)
+ plugin->private_free(plugin);
+ kfree(plugin->buf_channels);
+- vfree(plugin->buf);
++ kvfree(plugin->buf);
+ kfree(plugin);
+ return 0;
+ }
+diff --git a/tools/power/cpupower/bench/Makefile b/tools/power/cpupower/bench/Makefile
+index d79ab161cc75..f68b4bc55273 100644
+--- a/tools/power/cpupower/bench/Makefile
++++ b/tools/power/cpupower/bench/Makefile
+@@ -9,7 +9,7 @@ endif
+ ifeq ($(strip $(STATIC)),true)
+ LIBS = -L../ -L$(OUTPUT) -lm
+ OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o \
+- $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/sysfs.o
++ $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/cpupower.o
+ else
+ LIBS = -L../ -L$(OUTPUT) -lm -lcpupower
+ OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o
+diff --git a/tools/power/cpupower/lib/cpufreq.c b/tools/power/cpupower/lib/cpufreq.c
+index 1b993fe1ce23..0c0f3e3f0d80 100644
+--- a/tools/power/cpupower/lib/cpufreq.c
++++ b/tools/power/cpupower/lib/cpufreq.c
+@@ -28,7 +28,7 @@ static unsigned int sysfs_cpufreq_read_file(unsigned int cpu, const char *fname,
+
+ snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/cpufreq/%s",
+ cpu, fname);
+- return sysfs_read_file(path, buf, buflen);
++ return cpupower_read_sysfs(path, buf, buflen);
+ }
+
+ /* helper function to write a new value to a /sys file */
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 9bd4c7655fdb..852d25462388 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -319,7 +319,7 @@ static unsigned int sysfs_cpuidle_read_file(const char *fname, char *buf,
+
+ snprintf(path, sizeof(path), PATH_TO_CPU "cpuidle/%s", fname);
+
+- return sysfs_read_file(path, buf, buflen);
++ return cpupower_read_sysfs(path, buf, buflen);
+ }
+
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index 9c395ec924de..9711d628b0f4 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -15,7 +15,7 @@
+ #include "cpupower.h"
+ #include "cpupower_intern.h"
+
+-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen)
++unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen)
+ {
+ int fd;
+ ssize_t numread;
+@@ -95,7 +95,7 @@ static int sysfs_topology_read_file(unsigned int cpu, const char *fname, int *re
+
+ snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/topology/%s",
+ cpu, fname);
+- if (sysfs_read_file(path, linebuf, MAX_LINE_LEN) == 0)
++ if (cpupower_read_sysfs(path, linebuf, MAX_LINE_LEN) == 0)
+ return -1;
+ *result = strtol(linebuf, &endp, 0);
+ if (endp == linebuf || errno == ERANGE)
+diff --git a/tools/power/cpupower/lib/cpupower_intern.h b/tools/power/cpupower/lib/cpupower_intern.h
+index 92affdfbe417..4887c76d23f8 100644
+--- a/tools/power/cpupower/lib/cpupower_intern.h
++++ b/tools/power/cpupower/lib/cpupower_intern.h
+@@ -3,4 +3,4 @@
+ #define MAX_LINE_LEN 4096
+ #define SYSFS_PATH_MAX 255
+
+-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen);
++unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen);
+diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
+index cffc2c5a778d..ec50d2a95076 100644
+--- a/tools/testing/nvdimm/test/nfit.c
++++ b/tools/testing/nvdimm/test/nfit.c
+@@ -139,8 +139,8 @@ static u32 handle[] = {
+ [6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1),
+ };
+
+-static unsigned long dimm_fail_cmd_flags[NUM_DCR];
+-static int dimm_fail_cmd_code[NUM_DCR];
++static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)];
++static int dimm_fail_cmd_code[ARRAY_SIZE(handle)];
+
+ static const struct nd_intel_smart smart_def = {
+ .flags = ND_INTEL_SMART_HEALTH_VALID
+@@ -203,7 +203,7 @@ struct nfit_test {
+ unsigned long deadline;
+ spinlock_t lock;
+ } ars_state;
+- struct device *dimm_dev[NUM_DCR];
++ struct device *dimm_dev[ARRAY_SIZE(handle)];
+ struct nd_intel_smart *smart;
+ struct nd_intel_smart_threshold *smart_threshold;
+ struct badrange badrange;
+@@ -2678,7 +2678,7 @@ static int nfit_test_probe(struct platform_device *pdev)
+ u32 nfit_handle = __to_nfit_memdev(nfit_mem)->device_handle;
+ int i;
+
+- for (i = 0; i < NUM_DCR; i++)
++ for (i = 0; i < ARRAY_SIZE(handle); i++)
+ if (nfit_handle == handle[i])
+ dev_set_drvdata(nfit_test->dimm_dev[i],
+ nfit_mem);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-12-05 20:16 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-12-05 20:16 UTC (permalink / raw
To: gentoo-commits
commit: 5a7c485603ea79c3f41cc5db9f8206335fc9b819
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 5 20:15:52 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 5 20:15:52 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5a7c4856
proj/linux-patches: Linuxpatch 4.19.7
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1006_linux-4.19.7.patch | 5500 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5504 insertions(+)
diff --git a/0000_README b/0000_README
index c4c0a77..e91fad4 100644
--- a/0000_README
+++ b/0000_README
@@ -67,6 +67,10 @@ Patch: 1005_linux-4.19.6.patch
From: http://www.kernel.org
Desc: Linux 4.19.6
+Patch: 1006_linux-4.19.7.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.7
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1006_linux-4.19.7.patch b/1006_linux-4.19.7.patch
new file mode 100644
index 0000000..0840b0c
--- /dev/null
+++ b/1006_linux-4.19.7.patch
@@ -0,0 +1,5500 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index fa4eec22816d..0c404cda531a 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -4169,9 +4169,13 @@
+
+ spectre_v2= [X86] Control mitigation of Spectre variant 2
+ (indirect branch speculation) vulnerability.
++ The default operation protects the kernel from
++ user space attacks.
+
+- on - unconditionally enable
+- off - unconditionally disable
++ on - unconditionally enable, implies
++ spectre_v2_user=on
++ off - unconditionally disable, implies
++ spectre_v2_user=off
+ auto - kernel detects whether your CPU model is
+ vulnerable
+
+@@ -4181,6 +4185,12 @@
+ CONFIG_RETPOLINE configuration option, and the
+ compiler with which the kernel was built.
+
++ Selecting 'on' will also enable the mitigation
++ against user space to user space task attacks.
++
++ Selecting 'off' will disable both the kernel and
++ the user space protections.
++
+ Specific mitigations can also be selected manually:
+
+ retpoline - replace indirect branches
+@@ -4190,6 +4200,48 @@
+ Not specifying this option is equivalent to
+ spectre_v2=auto.
+
++ spectre_v2_user=
++ [X86] Control mitigation of Spectre variant 2
++ (indirect branch speculation) vulnerability between
++ user space tasks
++
++ on - Unconditionally enable mitigations. Is
++ enforced by spectre_v2=on
++
++ off - Unconditionally disable mitigations. Is
++ enforced by spectre_v2=off
++
++ prctl - Indirect branch speculation is enabled,
++ but mitigation can be enabled via prctl
++ per thread. The mitigation control state
++ is inherited on fork.
++
++ prctl,ibpb
++ - Like "prctl" above, but only STIBP is
++ controlled per thread. IBPB is issued
++ always when switching between different user
++ space processes.
++
++ seccomp
++ - Same as "prctl" above, but all seccomp
++ threads will enable the mitigation unless
++ they explicitly opt out.
++
++ seccomp,ibpb
++ - Like "seccomp" above, but only STIBP is
++ controlled per thread. IBPB is issued
++ always when switching between different
++ user space processes.
++
++ auto - Kernel selects the mitigation depending on
++ the available CPU features and vulnerability.
++
++ Default mitigation:
++ If CONFIG_SECCOMP=y then "seccomp", otherwise "prctl"
++
++ Not specifying this option is equivalent to
++ spectre_v2_user=auto.
++
+ spec_store_bypass_disable=
+ [HW] Control Speculative Store Bypass (SSB) Disable mitigation
+ (Speculative Store Bypass vulnerability)
+diff --git a/Documentation/userspace-api/spec_ctrl.rst b/Documentation/userspace-api/spec_ctrl.rst
+index 32f3d55c54b7..c4dbe6f7cdae 100644
+--- a/Documentation/userspace-api/spec_ctrl.rst
++++ b/Documentation/userspace-api/spec_ctrl.rst
+@@ -92,3 +92,12 @@ Speculation misfeature controls
+ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_ENABLE, 0, 0);
+ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
+ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_FORCE_DISABLE, 0, 0);
++
++- PR_SPEC_INDIR_BRANCH: Indirect Branch Speculation in User Processes
++ (Mitigate Spectre V2 style attacks against user processes)
++
++ Invocations:
++ * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0);
++ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0);
++ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0);
++ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0);
+diff --git a/Makefile b/Makefile
+index 20cbb8e84650..d2b4efcfb388 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 6
++SUBLEVEL = 7
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/rk3288-veyron.dtsi b/arch/arm/boot/dts/rk3288-veyron.dtsi
+index 2075120cfc4d..d8bf939a3aff 100644
+--- a/arch/arm/boot/dts/rk3288-veyron.dtsi
++++ b/arch/arm/boot/dts/rk3288-veyron.dtsi
+@@ -10,7 +10,11 @@
+ #include "rk3288.dtsi"
+
+ / {
+- memory@0 {
++ /*
++ * The default coreboot on veyron devices ignores memory@0 nodes
++ * and would instead create another memory node.
++ */
++ memory {
+ device_type = "memory";
+ reg = <0x0 0x0 0x0 0x80000000>;
+ };
+diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c
+index 5617932a83df..ee673c09aa6c 100644
+--- a/arch/arm/kernel/ftrace.c
++++ b/arch/arm/kernel/ftrace.c
+@@ -227,9 +227,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+ unsigned long frame_pointer)
+ {
+ unsigned long return_hooker = (unsigned long) &return_to_handler;
+- struct ftrace_graph_ent trace;
+ unsigned long old;
+- int err;
+
+ if (unlikely(atomic_read(¤t->tracing_graph_pause)))
+ return;
+@@ -237,21 +235,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+ old = *parent;
+ *parent = return_hooker;
+
+- trace.func = self_addr;
+- trace.depth = current->curr_ret_stack + 1;
+-
+- /* Only trace if the calling function expects to */
+- if (!ftrace_graph_entry(&trace)) {
++ if (function_graph_enter(old, self_addr, frame_pointer, NULL))
+ *parent = old;
+- return;
+- }
+-
+- err = ftrace_push_return_trace(old, self_addr, &trace.depth,
+- frame_pointer, NULL);
+- if (err == -EBUSY) {
+- *parent = old;
+- return;
+- }
+ }
+
+ #ifdef CONFIG_DYNAMIC_FTRACE
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
+index e0d64f862322..8ce4a79d9360 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
+@@ -153,7 +153,7 @@
+ };
+
+ &pcie0 {
+- ep-gpios = <&gpio4 RK_PC6 GPIO_ACTIVE_LOW>;
++ ep-gpios = <&gpio4 RK_PC6 GPIO_ACTIVE_HIGH>;
+ num-lanes = <4>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pcie_clkreqn_cpm>;
+diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
+index 50986e388d2b..57e962290df3 100644
+--- a/arch/arm64/kernel/ftrace.c
++++ b/arch/arm64/kernel/ftrace.c
+@@ -216,8 +216,6 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+ {
+ unsigned long return_hooker = (unsigned long)&return_to_handler;
+ unsigned long old;
+- struct ftrace_graph_ent trace;
+- int err;
+
+ if (unlikely(atomic_read(¤t->tracing_graph_pause)))
+ return;
+@@ -229,18 +227,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+ */
+ old = *parent;
+
+- trace.func = self_addr;
+- trace.depth = current->curr_ret_stack + 1;
+-
+- /* Only trace if the calling function expects to */
+- if (!ftrace_graph_entry(&trace))
+- return;
+-
+- err = ftrace_push_return_trace(old, self_addr, &trace.depth,
+- frame_pointer, NULL);
+- if (err == -EBUSY)
+- return;
+- else
++ if (!function_graph_enter(old, self_addr, frame_pointer, NULL))
+ *parent = return_hooker;
+ }
+
+diff --git a/arch/microblaze/kernel/ftrace.c b/arch/microblaze/kernel/ftrace.c
+index d57563c58a26..224eea40e1ee 100644
+--- a/arch/microblaze/kernel/ftrace.c
++++ b/arch/microblaze/kernel/ftrace.c
+@@ -22,8 +22,7 @@
+ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
+ {
+ unsigned long old;
+- int faulted, err;
+- struct ftrace_graph_ent trace;
++ int faulted;
+ unsigned long return_hooker = (unsigned long)
+ &return_to_handler;
+
+@@ -63,18 +62,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
+ return;
+ }
+
+- err = ftrace_push_return_trace(old, self_addr, &trace.depth, 0, NULL);
+- if (err == -EBUSY) {
++ if (function_graph_enter(old, self_addr, 0, NULL))
+ *parent = old;
+- return;
+- }
+-
+- trace.func = self_addr;
+- /* Only trace if the calling function expects to */
+- if (!ftrace_graph_entry(&trace)) {
+- current->curr_ret_stack--;
+- *parent = old;
+- }
+ }
+ #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+
+diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
+index 7f3dfdbc3657..b122cbb4aad1 100644
+--- a/arch/mips/kernel/ftrace.c
++++ b/arch/mips/kernel/ftrace.c
+@@ -322,7 +322,6 @@ void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
+ unsigned long fp)
+ {
+ unsigned long old_parent_ra;
+- struct ftrace_graph_ent trace;
+ unsigned long return_hooker = (unsigned long)
+ &return_to_handler;
+ int faulted, insns;
+@@ -369,12 +368,6 @@ void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
+ if (unlikely(faulted))
+ goto out;
+
+- if (ftrace_push_return_trace(old_parent_ra, self_ra, &trace.depth, fp,
+- NULL) == -EBUSY) {
+- *parent_ra_addr = old_parent_ra;
+- return;
+- }
+-
+ /*
+ * Get the recorded ip of the current mcount calling site in the
+ * __mcount_loc section, which will be used to filter the function
+@@ -382,13 +375,10 @@ void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
+ */
+
+ insns = core_kernel_text(self_ra) ? 2 : MCOUNT_OFFSET_INSNS + 1;
+- trace.func = self_ra - (MCOUNT_INSN_SIZE * insns);
++ self_ra -= (MCOUNT_INSN_SIZE * insns);
+
+- /* Only trace if the calling function expects to */
+- if (!ftrace_graph_entry(&trace)) {
+- current->curr_ret_stack--;
++ if (function_graph_enter(old_parent_ra, self_ra, fp, NULL))
+ *parent_ra_addr = old_parent_ra;
+- }
+ return;
+ out:
+ ftrace_graph_stop();
+diff --git a/arch/nds32/kernel/ftrace.c b/arch/nds32/kernel/ftrace.c
+index a0a9679ad5de..8a41372551ff 100644
+--- a/arch/nds32/kernel/ftrace.c
++++ b/arch/nds32/kernel/ftrace.c
+@@ -211,29 +211,15 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+ unsigned long frame_pointer)
+ {
+ unsigned long return_hooker = (unsigned long)&return_to_handler;
+- struct ftrace_graph_ent trace;
+ unsigned long old;
+- int err;
+
+ if (unlikely(atomic_read(¤t->tracing_graph_pause)))
+ return;
+
+ old = *parent;
+
+- trace.func = self_addr;
+- trace.depth = current->curr_ret_stack + 1;
+-
+- /* Only trace if the calling function expects to */
+- if (!ftrace_graph_entry(&trace))
+- return;
+-
+- err = ftrace_push_return_trace(old, self_addr, &trace.depth,
+- frame_pointer, NULL);
+-
+- if (err == -EBUSY)
+- return;
+-
+- *parent = return_hooker;
++ if (!function_graph_enter(old, self_addr, frame_pointer, NULL))
++ *parent = return_hooker;
+ }
+
+ noinline void ftrace_graph_caller(void)
+diff --git a/arch/parisc/kernel/ftrace.c b/arch/parisc/kernel/ftrace.c
+index 6fa8535d3cce..e46a4157a894 100644
+--- a/arch/parisc/kernel/ftrace.c
++++ b/arch/parisc/kernel/ftrace.c
+@@ -30,7 +30,6 @@ static void __hot prepare_ftrace_return(unsigned long *parent,
+ unsigned long self_addr)
+ {
+ unsigned long old;
+- struct ftrace_graph_ent trace;
+ extern int parisc_return_to_handler;
+
+ if (unlikely(ftrace_graph_is_dead()))
+@@ -41,19 +40,9 @@ static void __hot prepare_ftrace_return(unsigned long *parent,
+
+ old = *parent;
+
+- trace.func = self_addr;
+- trace.depth = current->curr_ret_stack + 1;
+-
+- /* Only trace if the calling function expects to */
+- if (!ftrace_graph_entry(&trace))
+- return;
+-
+- if (ftrace_push_return_trace(old, self_addr, &trace.depth,
+- 0, NULL) == -EBUSY)
+- return;
+-
+- /* activate parisc_return_to_handler() as return point */
+- *parent = (unsigned long) &parisc_return_to_handler;
++ if (!function_graph_enter(old, self_addr, 0, NULL))
++ /* activate parisc_return_to_handler() as return point */
++ *parent = (unsigned long) &parisc_return_to_handler;
+ }
+ #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+
+diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c
+index 4bfbb54dee51..19ef4f5866b6 100644
+--- a/arch/powerpc/kernel/trace/ftrace.c
++++ b/arch/powerpc/kernel/trace/ftrace.c
+@@ -697,7 +697,6 @@ int ftrace_disable_ftrace_graph_caller(void)
+ */
+ unsigned long prepare_ftrace_return(unsigned long parent, unsigned long ip)
+ {
+- struct ftrace_graph_ent trace;
+ unsigned long return_hooker;
+
+ if (unlikely(ftrace_graph_is_dead()))
+@@ -708,18 +707,8 @@ unsigned long prepare_ftrace_return(unsigned long parent, unsigned long ip)
+
+ return_hooker = ppc_function_entry(return_to_handler);
+
+- trace.func = ip;
+- trace.depth = current->curr_ret_stack + 1;
+-
+- /* Only trace if the calling function expects to */
+- if (!ftrace_graph_entry(&trace))
+- goto out;
+-
+- if (ftrace_push_return_trace(parent, ip, &trace.depth, 0,
+- NULL) == -EBUSY)
+- goto out;
+-
+- parent = return_hooker;
++ if (!function_graph_enter(parent, ip, 0, NULL))
++ parent = return_hooker;
+ out:
+ return parent;
+ }
+diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c
+index 1157b6b52d25..c433f6d3dd64 100644
+--- a/arch/riscv/kernel/ftrace.c
++++ b/arch/riscv/kernel/ftrace.c
+@@ -132,7 +132,6 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+ {
+ unsigned long return_hooker = (unsigned long)&return_to_handler;
+ unsigned long old;
+- struct ftrace_graph_ent trace;
+ int err;
+
+ if (unlikely(atomic_read(¤t->tracing_graph_pause)))
+@@ -144,17 +143,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+ */
+ old = *parent;
+
+- trace.func = self_addr;
+- trace.depth = current->curr_ret_stack + 1;
+-
+- if (!ftrace_graph_entry(&trace))
+- return;
+-
+- err = ftrace_push_return_trace(old, self_addr, &trace.depth,
+- frame_pointer, parent);
+- if (err == -EBUSY)
+- return;
+- *parent = return_hooker;
++ if (function_graph_enter(old, self_addr, frame_pointer, parent))
++ *parent = return_hooker;
+ }
+
+ #ifdef CONFIG_DYNAMIC_FTRACE
+diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
+index 84be7f02d0c2..39b13d71a8fe 100644
+--- a/arch/s390/kernel/ftrace.c
++++ b/arch/s390/kernel/ftrace.c
+@@ -203,22 +203,13 @@ device_initcall(ftrace_plt_init);
+ */
+ unsigned long prepare_ftrace_return(unsigned long parent, unsigned long ip)
+ {
+- struct ftrace_graph_ent trace;
+-
+ if (unlikely(ftrace_graph_is_dead()))
+ goto out;
+ if (unlikely(atomic_read(¤t->tracing_graph_pause)))
+ goto out;
+ ip -= MCOUNT_INSN_SIZE;
+- trace.func = ip;
+- trace.depth = current->curr_ret_stack + 1;
+- /* Only trace if the calling function expects to. */
+- if (!ftrace_graph_entry(&trace))
+- goto out;
+- if (ftrace_push_return_trace(parent, ip, &trace.depth, 0,
+- NULL) == -EBUSY)
+- goto out;
+- parent = (unsigned long) return_to_handler;
++ if (!function_graph_enter(parent, ip, 0, NULL))
++ parent = (unsigned long) return_to_handler;
+ out:
+ return parent;
+ }
+diff --git a/arch/sh/kernel/ftrace.c b/arch/sh/kernel/ftrace.c
+index 96dd9f7da250..1b04270e5460 100644
+--- a/arch/sh/kernel/ftrace.c
++++ b/arch/sh/kernel/ftrace.c
+@@ -321,8 +321,7 @@ int ftrace_disable_ftrace_graph_caller(void)
+ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
+ {
+ unsigned long old;
+- int faulted, err;
+- struct ftrace_graph_ent trace;
++ int faulted;
+ unsigned long return_hooker = (unsigned long)&return_to_handler;
+
+ if (unlikely(ftrace_graph_is_dead()))
+@@ -365,18 +364,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
+ return;
+ }
+
+- err = ftrace_push_return_trace(old, self_addr, &trace.depth, 0, NULL);
+- if (err == -EBUSY) {
++ if (function_graph_enter(old, self_addr, 0, NULL))
+ __raw_writel(old, parent);
+- return;
+- }
+-
+- trace.func = self_addr;
+-
+- /* Only trace if the calling function expects to */
+- if (!ftrace_graph_entry(&trace)) {
+- current->curr_ret_stack--;
+- __raw_writel(old, parent);
+- }
+ }
+ #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+diff --git a/arch/sparc/kernel/ftrace.c b/arch/sparc/kernel/ftrace.c
+index 915dda4ae412..684b84ce397f 100644
+--- a/arch/sparc/kernel/ftrace.c
++++ b/arch/sparc/kernel/ftrace.c
+@@ -126,20 +126,11 @@ unsigned long prepare_ftrace_return(unsigned long parent,
+ unsigned long frame_pointer)
+ {
+ unsigned long return_hooker = (unsigned long) &return_to_handler;
+- struct ftrace_graph_ent trace;
+
+ if (unlikely(atomic_read(¤t->tracing_graph_pause)))
+ return parent + 8UL;
+
+- trace.func = self_addr;
+- trace.depth = current->curr_ret_stack + 1;
+-
+- /* Only trace if the calling function expects to */
+- if (!ftrace_graph_entry(&trace))
+- return parent + 8UL;
+-
+- if (ftrace_push_return_trace(parent, self_addr, &trace.depth,
+- frame_pointer, NULL) == -EBUSY)
++ if (function_graph_enter(parent, self_addr, frame_pointer, NULL))
+ return parent + 8UL;
+
+ return return_hooker;
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 1a0be022f91d..44c6a82b7ce5 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -441,10 +441,6 @@ config RETPOLINE
+ branches. Requires a compiler with -mindirect-branch=thunk-extern
+ support for full protection. The kernel may run slower.
+
+- Without compiler support, at least indirect branches in assembler
+- code are eliminated. Since this includes the syscall entry path,
+- it is not entirely pointless.
+-
+ config INTEL_RDT
+ bool "Intel Resource Director Technology support"
+ default n
+@@ -1005,13 +1001,7 @@ config NR_CPUS
+ to the kernel image.
+
+ config SCHED_SMT
+- bool "SMT (Hyperthreading) scheduler support"
+- depends on SMP
+- ---help---
+- SMT scheduler support improves the CPU scheduler's decision making
+- when dealing with Intel Pentium 4 chips with HyperThreading at a
+- cost of slightly increased overhead in some places. If unsure say
+- N here.
++ def_bool y if SMP
+
+ config SCHED_MC
+ def_bool y
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 8f6e7eb8ae9f..9298f0f3817a 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -223,9 +223,10 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
+
+ # Avoid indirect branches in kernel to deal with Spectre
+ ifdef CONFIG_RETPOLINE
+-ifneq ($(RETPOLINE_CFLAGS),)
+- KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
++ifeq ($(RETPOLINE_CFLAGS),)
++ $(error You are building kernel with non-retpoline compiler, please update your compiler.)
+ endif
++ KBUILD_CFLAGS += $(RETPOLINE_CFLAGS)
+ endif
+
+ archscripts: scripts_basic
+diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
+index dfb2f7c0d019..c8d08da5b308 100644
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -438,26 +438,6 @@ int x86_setup_perfctr(struct perf_event *event)
+ if (config == -1LL)
+ return -EINVAL;
+
+- /*
+- * Branch tracing:
+- */
+- if (attr->config == PERF_COUNT_HW_BRANCH_INSTRUCTIONS &&
+- !attr->freq && hwc->sample_period == 1) {
+- /* BTS is not supported by this architecture. */
+- if (!x86_pmu.bts_active)
+- return -EOPNOTSUPP;
+-
+- /* BTS is currently only allowed for user-mode. */
+- if (!attr->exclude_kernel)
+- return -EOPNOTSUPP;
+-
+- /* disallow bts if conflicting events are present */
+- if (x86_add_exclusive(x86_lbr_exclusive_lbr))
+- return -EBUSY;
+-
+- event->destroy = hw_perf_lbr_event_destroy;
+- }
+-
+ hwc->config |= config;
+
+ return 0;
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 035c37481f57..155fa4b53c56 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -2358,16 +2358,7 @@ done:
+ static struct event_constraint *
+ intel_bts_constraints(struct perf_event *event)
+ {
+- struct hw_perf_event *hwc = &event->hw;
+- unsigned int hw_event, bts_event;
+-
+- if (event->attr.freq)
+- return NULL;
+-
+- hw_event = hwc->config & INTEL_ARCH_EVENT_MASK;
+- bts_event = x86_pmu.event_map(PERF_COUNT_HW_BRANCH_INSTRUCTIONS);
+-
+- if (unlikely(hw_event == bts_event && hwc->sample_period == 1))
++ if (unlikely(intel_pmu_has_bts(event)))
+ return &bts_constraint;
+
+ return NULL;
+@@ -2986,10 +2977,51 @@ static unsigned long intel_pmu_large_pebs_flags(struct perf_event *event)
+ return flags;
+ }
+
++static int intel_pmu_bts_config(struct perf_event *event)
++{
++ struct perf_event_attr *attr = &event->attr;
++
++ if (unlikely(intel_pmu_has_bts(event))) {
++ /* BTS is not supported by this architecture. */
++ if (!x86_pmu.bts_active)
++ return -EOPNOTSUPP;
++
++ /* BTS is currently only allowed for user-mode. */
++ if (!attr->exclude_kernel)
++ return -EOPNOTSUPP;
++
++ /* BTS is not allowed for precise events. */
++ if (attr->precise_ip)
++ return -EOPNOTSUPP;
++
++ /* disallow bts if conflicting events are present */
++ if (x86_add_exclusive(x86_lbr_exclusive_lbr))
++ return -EBUSY;
++
++ event->destroy = hw_perf_lbr_event_destroy;
++ }
++
++ return 0;
++}
++
++static int core_pmu_hw_config(struct perf_event *event)
++{
++ int ret = x86_pmu_hw_config(event);
++
++ if (ret)
++ return ret;
++
++ return intel_pmu_bts_config(event);
++}
++
+ static int intel_pmu_hw_config(struct perf_event *event)
+ {
+ int ret = x86_pmu_hw_config(event);
+
++ if (ret)
++ return ret;
++
++ ret = intel_pmu_bts_config(event);
+ if (ret)
+ return ret;
+
+@@ -3015,7 +3047,7 @@ static int intel_pmu_hw_config(struct perf_event *event)
+ /*
+ * BTS is set up earlier in this path, so don't account twice
+ */
+- if (!intel_pmu_has_bts(event)) {
++ if (!unlikely(intel_pmu_has_bts(event))) {
+ /* disallow lbr if conflicting events are present */
+ if (x86_add_exclusive(x86_lbr_exclusive_lbr))
+ return -EBUSY;
+@@ -3478,7 +3510,7 @@ static __initconst const struct x86_pmu core_pmu = {
+ .enable_all = core_pmu_enable_all,
+ .enable = core_pmu_enable_event,
+ .disable = x86_pmu_disable_event,
+- .hw_config = x86_pmu_hw_config,
++ .hw_config = core_pmu_hw_config,
+ .schedule_events = x86_schedule_events,
+ .eventsel = MSR_ARCH_PERFMON_EVENTSEL0,
+ .perfctr = MSR_ARCH_PERFMON_PERFCTR0,
+diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
+index 156286335351..c5ad9cc61f4b 100644
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -857,11 +857,16 @@ static inline int amd_pmu_init(void)
+
+ static inline bool intel_pmu_has_bts(struct perf_event *event)
+ {
+- if (event->attr.config == PERF_COUNT_HW_BRANCH_INSTRUCTIONS &&
+- !event->attr.freq && event->hw.sample_period == 1)
+- return true;
++ struct hw_perf_event *hwc = &event->hw;
++ unsigned int hw_event, bts_event;
++
++ if (event->attr.freq)
++ return false;
++
++ hw_event = hwc->config & INTEL_ARCH_EVENT_MASK;
++ bts_event = x86_pmu.event_map(PERF_COUNT_HW_BRANCH_INSTRUCTIONS);
+
+- return false;
++ return hw_event == bts_event && hwc->sample_period == 1;
+ }
+
+ int intel_pmu_save_and_restart(struct perf_event *event);
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 1c09a0d1771f..022845ee0c88 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1046,7 +1046,8 @@ struct kvm_x86_ops {
+ bool (*has_wbinvd_exit)(void);
+
+ u64 (*read_l1_tsc_offset)(struct kvm_vcpu *vcpu);
+- void (*write_tsc_offset)(struct kvm_vcpu *vcpu, u64 offset);
++ /* Returns actual tsc_offset set in active VMCS */
++ u64 (*write_l1_tsc_offset)(struct kvm_vcpu *vcpu, u64 offset);
+
+ void (*get_exit_info)(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2);
+
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 4731f0cf97c5..b3486c8b570a 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -41,9 +41,10 @@
+
+ #define MSR_IA32_SPEC_CTRL 0x00000048 /* Speculation Control */
+ #define SPEC_CTRL_IBRS (1 << 0) /* Indirect Branch Restricted Speculation */
+-#define SPEC_CTRL_STIBP (1 << 1) /* Single Thread Indirect Branch Predictors */
++#define SPEC_CTRL_STIBP_SHIFT 1 /* Single Thread Indirect Branch Predictor (STIBP) bit */
++#define SPEC_CTRL_STIBP (1 << SPEC_CTRL_STIBP_SHIFT) /* STIBP mask */
+ #define SPEC_CTRL_SSBD_SHIFT 2 /* Speculative Store Bypass Disable bit */
+-#define SPEC_CTRL_SSBD (1 << SPEC_CTRL_SSBD_SHIFT) /* Speculative Store Bypass Disable */
++#define SPEC_CTRL_SSBD (1 << SPEC_CTRL_SSBD_SHIFT) /* Speculative Store Bypass Disable */
+
+ #define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */
+ #define PRED_CMD_IBPB (1 << 0) /* Indirect Branch Prediction Barrier */
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index fd2a8c1b88bc..032b6009baab 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -3,6 +3,8 @@
+ #ifndef _ASM_X86_NOSPEC_BRANCH_H_
+ #define _ASM_X86_NOSPEC_BRANCH_H_
+
++#include <linux/static_key.h>
++
+ #include <asm/alternative.h>
+ #include <asm/alternative-asm.h>
+ #include <asm/cpufeatures.h>
+@@ -162,29 +164,35 @@
+ _ASM_PTR " 999b\n\t" \
+ ".popsection\n\t"
+
+-#if defined(CONFIG_X86_64) && defined(RETPOLINE)
++#ifdef CONFIG_RETPOLINE
++#ifdef CONFIG_X86_64
+
+ /*
+- * Since the inline asm uses the %V modifier which is only in newer GCC,
+- * the 64-bit one is dependent on RETPOLINE not CONFIG_RETPOLINE.
++ * Inline asm uses the %V modifier which is only in newer GCC
++ * which is ensured when CONFIG_RETPOLINE is defined.
+ */
+ # define CALL_NOSPEC \
+ ANNOTATE_NOSPEC_ALTERNATIVE \
+- ALTERNATIVE( \
++ ALTERNATIVE_2( \
+ ANNOTATE_RETPOLINE_SAFE \
+ "call *%[thunk_target]\n", \
+ "call __x86_indirect_thunk_%V[thunk_target]\n", \
+- X86_FEATURE_RETPOLINE)
++ X86_FEATURE_RETPOLINE, \
++ "lfence;\n" \
++ ANNOTATE_RETPOLINE_SAFE \
++ "call *%[thunk_target]\n", \
++ X86_FEATURE_RETPOLINE_AMD)
+ # define THUNK_TARGET(addr) [thunk_target] "r" (addr)
+
+-#elif defined(CONFIG_X86_32) && defined(CONFIG_RETPOLINE)
++#else /* CONFIG_X86_32 */
+ /*
+ * For i386 we use the original ret-equivalent retpoline, because
+ * otherwise we'll run out of registers. We don't care about CET
+ * here, anyway.
+ */
+ # define CALL_NOSPEC \
+- ALTERNATIVE( \
++ ANNOTATE_NOSPEC_ALTERNATIVE \
++ ALTERNATIVE_2( \
+ ANNOTATE_RETPOLINE_SAFE \
+ "call *%[thunk_target]\n", \
+ " jmp 904f;\n" \
+@@ -199,9 +207,14 @@
+ " ret;\n" \
+ " .align 16\n" \
+ "904: call 901b;\n", \
+- X86_FEATURE_RETPOLINE)
++ X86_FEATURE_RETPOLINE, \
++ "lfence;\n" \
++ ANNOTATE_RETPOLINE_SAFE \
++ "call *%[thunk_target]\n", \
++ X86_FEATURE_RETPOLINE_AMD)
+
+ # define THUNK_TARGET(addr) [thunk_target] "rm" (addr)
++#endif
+ #else /* No retpoline for C / inline asm */
+ # define CALL_NOSPEC "call *%[thunk_target]\n"
+ # define THUNK_TARGET(addr) [thunk_target] "rm" (addr)
+@@ -210,13 +223,19 @@
+ /* The Spectre V2 mitigation variants */
+ enum spectre_v2_mitigation {
+ SPECTRE_V2_NONE,
+- SPECTRE_V2_RETPOLINE_MINIMAL,
+- SPECTRE_V2_RETPOLINE_MINIMAL_AMD,
+ SPECTRE_V2_RETPOLINE_GENERIC,
+ SPECTRE_V2_RETPOLINE_AMD,
+ SPECTRE_V2_IBRS_ENHANCED,
+ };
+
++/* The indirect branch speculation control variants */
++enum spectre_v2_user_mitigation {
++ SPECTRE_V2_USER_NONE,
++ SPECTRE_V2_USER_STRICT,
++ SPECTRE_V2_USER_PRCTL,
++ SPECTRE_V2_USER_SECCOMP,
++};
++
+ /* The Speculative Store Bypass disable variants */
+ enum ssb_mitigation {
+ SPEC_STORE_BYPASS_NONE,
+@@ -294,6 +313,10 @@ do { \
+ preempt_enable(); \
+ } while (0)
+
++DECLARE_STATIC_KEY_FALSE(switch_to_cond_stibp);
++DECLARE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
++DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
++
+ #endif /* __ASSEMBLY__ */
+
+ /*
+diff --git a/arch/x86/include/asm/spec-ctrl.h b/arch/x86/include/asm/spec-ctrl.h
+index ae7c2c5cd7f0..5393babc0598 100644
+--- a/arch/x86/include/asm/spec-ctrl.h
++++ b/arch/x86/include/asm/spec-ctrl.h
+@@ -53,12 +53,24 @@ static inline u64 ssbd_tif_to_spec_ctrl(u64 tifn)
+ return (tifn & _TIF_SSBD) >> (TIF_SSBD - SPEC_CTRL_SSBD_SHIFT);
+ }
+
++static inline u64 stibp_tif_to_spec_ctrl(u64 tifn)
++{
++ BUILD_BUG_ON(TIF_SPEC_IB < SPEC_CTRL_STIBP_SHIFT);
++ return (tifn & _TIF_SPEC_IB) >> (TIF_SPEC_IB - SPEC_CTRL_STIBP_SHIFT);
++}
++
+ static inline unsigned long ssbd_spec_ctrl_to_tif(u64 spec_ctrl)
+ {
+ BUILD_BUG_ON(TIF_SSBD < SPEC_CTRL_SSBD_SHIFT);
+ return (spec_ctrl & SPEC_CTRL_SSBD) << (TIF_SSBD - SPEC_CTRL_SSBD_SHIFT);
+ }
+
++static inline unsigned long stibp_spec_ctrl_to_tif(u64 spec_ctrl)
++{
++ BUILD_BUG_ON(TIF_SPEC_IB < SPEC_CTRL_STIBP_SHIFT);
++ return (spec_ctrl & SPEC_CTRL_STIBP) << (TIF_SPEC_IB - SPEC_CTRL_STIBP_SHIFT);
++}
++
+ static inline u64 ssbd_tif_to_amd_ls_cfg(u64 tifn)
+ {
+ return (tifn & _TIF_SSBD) ? x86_amd_ls_cfg_ssbd_mask : 0ULL;
+@@ -70,11 +82,7 @@ extern void speculative_store_bypass_ht_init(void);
+ static inline void speculative_store_bypass_ht_init(void) { }
+ #endif
+
+-extern void speculative_store_bypass_update(unsigned long tif);
+-
+-static inline void speculative_store_bypass_update_current(void)
+-{
+- speculative_store_bypass_update(current_thread_info()->flags);
+-}
++extern void speculation_ctrl_update(unsigned long tif);
++extern void speculation_ctrl_update_current(void);
+
+ #endif
+diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
+index 36bd243843d6..7cf1a270d891 100644
+--- a/arch/x86/include/asm/switch_to.h
++++ b/arch/x86/include/asm/switch_to.h
+@@ -11,9 +11,6 @@ struct task_struct *__switch_to_asm(struct task_struct *prev,
+
+ __visible struct task_struct *__switch_to(struct task_struct *prev,
+ struct task_struct *next);
+-struct tss_struct;
+-void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
+- struct tss_struct *tss);
+
+ /* This runs runs on the previous thread's stack. */
+ static inline void prepare_switch_to(struct task_struct *next)
+diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
+index 2ff2a30a264f..82b73b75d67c 100644
+--- a/arch/x86/include/asm/thread_info.h
++++ b/arch/x86/include/asm/thread_info.h
+@@ -79,10 +79,12 @@ struct thread_info {
+ #define TIF_SIGPENDING 2 /* signal pending */
+ #define TIF_NEED_RESCHED 3 /* rescheduling necessary */
+ #define TIF_SINGLESTEP 4 /* reenable singlestep on user return*/
+-#define TIF_SSBD 5 /* Reduced data speculation */
++#define TIF_SSBD 5 /* Speculative store bypass disable */
+ #define TIF_SYSCALL_EMU 6 /* syscall emulation active */
+ #define TIF_SYSCALL_AUDIT 7 /* syscall auditing active */
+ #define TIF_SECCOMP 8 /* secure computing */
++#define TIF_SPEC_IB 9 /* Indirect branch speculation mitigation */
++#define TIF_SPEC_FORCE_UPDATE 10 /* Force speculation MSR update in context switch */
+ #define TIF_USER_RETURN_NOTIFY 11 /* notify kernel of userspace return */
+ #define TIF_UPROBE 12 /* breakpointed or singlestepping */
+ #define TIF_PATCH_PENDING 13 /* pending live patching update */
+@@ -110,6 +112,8 @@ struct thread_info {
+ #define _TIF_SYSCALL_EMU (1 << TIF_SYSCALL_EMU)
+ #define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT)
+ #define _TIF_SECCOMP (1 << TIF_SECCOMP)
++#define _TIF_SPEC_IB (1 << TIF_SPEC_IB)
++#define _TIF_SPEC_FORCE_UPDATE (1 << TIF_SPEC_FORCE_UPDATE)
+ #define _TIF_USER_RETURN_NOTIFY (1 << TIF_USER_RETURN_NOTIFY)
+ #define _TIF_UPROBE (1 << TIF_UPROBE)
+ #define _TIF_PATCH_PENDING (1 << TIF_PATCH_PENDING)
+@@ -145,8 +149,18 @@ struct thread_info {
+ _TIF_FSCHECK)
+
+ /* flags to check in __switch_to() */
+-#define _TIF_WORK_CTXSW \
+- (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP|_TIF_SSBD)
++#define _TIF_WORK_CTXSW_BASE \
++ (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP| \
++ _TIF_SSBD | _TIF_SPEC_FORCE_UPDATE)
++
++/*
++ * Avoid calls to __switch_to_xtra() on UP as STIBP is not evaluated.
++ */
++#ifdef CONFIG_SMP
++# define _TIF_WORK_CTXSW (_TIF_WORK_CTXSW_BASE | _TIF_SPEC_IB)
++#else
++# define _TIF_WORK_CTXSW (_TIF_WORK_CTXSW_BASE)
++#endif
+
+ #define _TIF_WORK_CTXSW_PREV (_TIF_WORK_CTXSW|_TIF_USER_RETURN_NOTIFY)
+ #define _TIF_WORK_CTXSW_NEXT (_TIF_WORK_CTXSW)
+diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
+index 0e2130d8d6b1..79ec7add5f98 100644
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -185,10 +185,14 @@ struct tlb_state {
+
+ #define LOADED_MM_SWITCHING ((struct mm_struct *)1)
+
++ /* Last user mm for optimizing IBPB */
++ union {
++ struct mm_struct *last_user_mm;
++ unsigned long last_user_mm_ibpb;
++ };
++
+ u16 loaded_mm_asid;
+ u16 next_asid;
+- /* last user mm's ctx id */
+- u64 last_ctx_id;
+
+ /*
+ * We can be in one of several states:
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 40bdaea97fe7..78928f56cf72 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -14,6 +14,7 @@
+ #include <linux/module.h>
+ #include <linux/nospec.h>
+ #include <linux/prctl.h>
++#include <linux/sched/smt.h>
+
+ #include <asm/spec-ctrl.h>
+ #include <asm/cmdline.h>
+@@ -35,12 +36,10 @@ static void __init spectre_v2_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
+
+-/*
+- * Our boot-time value of the SPEC_CTRL MSR. We read it once so that any
+- * writes to SPEC_CTRL contain whatever reserved bits have been set.
+- */
+-u64 __ro_after_init x86_spec_ctrl_base;
++/* The base value of the SPEC_CTRL MSR that always has to be preserved. */
++u64 x86_spec_ctrl_base;
+ EXPORT_SYMBOL_GPL(x86_spec_ctrl_base);
++static DEFINE_MUTEX(spec_ctrl_mutex);
+
+ /*
+ * The vendor and possibly platform specific bits which can be modified in
+@@ -55,6 +54,13 @@ static u64 __ro_after_init x86_spec_ctrl_mask = SPEC_CTRL_IBRS;
+ u64 __ro_after_init x86_amd_ls_cfg_base;
+ u64 __ro_after_init x86_amd_ls_cfg_ssbd_mask;
+
++/* Control conditional STIPB in switch_to() */
++DEFINE_STATIC_KEY_FALSE(switch_to_cond_stibp);
++/* Control conditional IBPB in switch_mm() */
++DEFINE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
++/* Control unconditional IBPB in switch_mm() */
++DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
++
+ void __init check_bugs(void)
+ {
+ identify_boot_cpu();
+@@ -125,31 +131,6 @@ void __init check_bugs(void)
+ #endif
+ }
+
+-/* The kernel command line selection */
+-enum spectre_v2_mitigation_cmd {
+- SPECTRE_V2_CMD_NONE,
+- SPECTRE_V2_CMD_AUTO,
+- SPECTRE_V2_CMD_FORCE,
+- SPECTRE_V2_CMD_RETPOLINE,
+- SPECTRE_V2_CMD_RETPOLINE_GENERIC,
+- SPECTRE_V2_CMD_RETPOLINE_AMD,
+-};
+-
+-static const char *spectre_v2_strings[] = {
+- [SPECTRE_V2_NONE] = "Vulnerable",
+- [SPECTRE_V2_RETPOLINE_MINIMAL] = "Vulnerable: Minimal generic ASM retpoline",
+- [SPECTRE_V2_RETPOLINE_MINIMAL_AMD] = "Vulnerable: Minimal AMD ASM retpoline",
+- [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline",
+- [SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline",
+- [SPECTRE_V2_IBRS_ENHANCED] = "Mitigation: Enhanced IBRS",
+-};
+-
+-#undef pr_fmt
+-#define pr_fmt(fmt) "Spectre V2 : " fmt
+-
+-static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+- SPECTRE_V2_NONE;
+-
+ void
+ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
+ {
+@@ -171,6 +152,10 @@ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
+ static_cpu_has(X86_FEATURE_AMD_SSBD))
+ hostval |= ssbd_tif_to_spec_ctrl(ti->flags);
+
++ /* Conditional STIBP enabled? */
++ if (static_branch_unlikely(&switch_to_cond_stibp))
++ hostval |= stibp_tif_to_spec_ctrl(ti->flags);
++
+ if (hostval != guestval) {
+ msrval = setguest ? guestval : hostval;
+ wrmsrl(MSR_IA32_SPEC_CTRL, msrval);
+@@ -204,7 +189,7 @@ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
+ tif = setguest ? ssbd_spec_ctrl_to_tif(guestval) :
+ ssbd_spec_ctrl_to_tif(hostval);
+
+- speculative_store_bypass_update(tif);
++ speculation_ctrl_update(tif);
+ }
+ }
+ EXPORT_SYMBOL_GPL(x86_virt_spec_ctrl);
+@@ -219,6 +204,15 @@ static void x86_amd_ssb_disable(void)
+ wrmsrl(MSR_AMD64_LS_CFG, msrval);
+ }
+
++#undef pr_fmt
++#define pr_fmt(fmt) "Spectre V2 : " fmt
++
++static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
++ SPECTRE_V2_NONE;
++
++static enum spectre_v2_user_mitigation spectre_v2_user __ro_after_init =
++ SPECTRE_V2_USER_NONE;
++
+ #ifdef RETPOLINE
+ static bool spectre_v2_bad_module;
+
+@@ -240,67 +234,217 @@ static inline const char *spectre_v2_module_string(void)
+ static inline const char *spectre_v2_module_string(void) { return ""; }
+ #endif
+
+-static void __init spec2_print_if_insecure(const char *reason)
++static inline bool match_option(const char *arg, int arglen, const char *opt)
+ {
+- if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+- pr_info("%s selected on command line.\n", reason);
++ int len = strlen(opt);
++
++ return len == arglen && !strncmp(arg, opt, len);
+ }
+
+-static void __init spec2_print_if_secure(const char *reason)
++/* The kernel command line selection for spectre v2 */
++enum spectre_v2_mitigation_cmd {
++ SPECTRE_V2_CMD_NONE,
++ SPECTRE_V2_CMD_AUTO,
++ SPECTRE_V2_CMD_FORCE,
++ SPECTRE_V2_CMD_RETPOLINE,
++ SPECTRE_V2_CMD_RETPOLINE_GENERIC,
++ SPECTRE_V2_CMD_RETPOLINE_AMD,
++};
++
++enum spectre_v2_user_cmd {
++ SPECTRE_V2_USER_CMD_NONE,
++ SPECTRE_V2_USER_CMD_AUTO,
++ SPECTRE_V2_USER_CMD_FORCE,
++ SPECTRE_V2_USER_CMD_PRCTL,
++ SPECTRE_V2_USER_CMD_PRCTL_IBPB,
++ SPECTRE_V2_USER_CMD_SECCOMP,
++ SPECTRE_V2_USER_CMD_SECCOMP_IBPB,
++};
++
++static const char * const spectre_v2_user_strings[] = {
++ [SPECTRE_V2_USER_NONE] = "User space: Vulnerable",
++ [SPECTRE_V2_USER_STRICT] = "User space: Mitigation: STIBP protection",
++ [SPECTRE_V2_USER_PRCTL] = "User space: Mitigation: STIBP via prctl",
++ [SPECTRE_V2_USER_SECCOMP] = "User space: Mitigation: STIBP via seccomp and prctl",
++};
++
++static const struct {
++ const char *option;
++ enum spectre_v2_user_cmd cmd;
++ bool secure;
++} v2_user_options[] __initdata = {
++ { "auto", SPECTRE_V2_USER_CMD_AUTO, false },
++ { "off", SPECTRE_V2_USER_CMD_NONE, false },
++ { "on", SPECTRE_V2_USER_CMD_FORCE, true },
++ { "prctl", SPECTRE_V2_USER_CMD_PRCTL, false },
++ { "prctl,ibpb", SPECTRE_V2_USER_CMD_PRCTL_IBPB, false },
++ { "seccomp", SPECTRE_V2_USER_CMD_SECCOMP, false },
++ { "seccomp,ibpb", SPECTRE_V2_USER_CMD_SECCOMP_IBPB, false },
++};
++
++static void __init spec_v2_user_print_cond(const char *reason, bool secure)
+ {
+- if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+- pr_info("%s selected on command line.\n", reason);
++ if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2) != secure)
++ pr_info("spectre_v2_user=%s forced on command line.\n", reason);
+ }
+
+-static inline bool retp_compiler(void)
++static enum spectre_v2_user_cmd __init
++spectre_v2_parse_user_cmdline(enum spectre_v2_mitigation_cmd v2_cmd)
+ {
+- return __is_defined(RETPOLINE);
++ char arg[20];
++ int ret, i;
++
++ switch (v2_cmd) {
++ case SPECTRE_V2_CMD_NONE:
++ return SPECTRE_V2_USER_CMD_NONE;
++ case SPECTRE_V2_CMD_FORCE:
++ return SPECTRE_V2_USER_CMD_FORCE;
++ default:
++ break;
++ }
++
++ ret = cmdline_find_option(boot_command_line, "spectre_v2_user",
++ arg, sizeof(arg));
++ if (ret < 0)
++ return SPECTRE_V2_USER_CMD_AUTO;
++
++ for (i = 0; i < ARRAY_SIZE(v2_user_options); i++) {
++ if (match_option(arg, ret, v2_user_options[i].option)) {
++ spec_v2_user_print_cond(v2_user_options[i].option,
++ v2_user_options[i].secure);
++ return v2_user_options[i].cmd;
++ }
++ }
++
++ pr_err("Unknown user space protection option (%s). Switching to AUTO select\n", arg);
++ return SPECTRE_V2_USER_CMD_AUTO;
+ }
+
+-static inline bool match_option(const char *arg, int arglen, const char *opt)
++static void __init
++spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ {
+- int len = strlen(opt);
++ enum spectre_v2_user_mitigation mode = SPECTRE_V2_USER_NONE;
++ bool smt_possible = IS_ENABLED(CONFIG_SMP);
++ enum spectre_v2_user_cmd cmd;
+
+- return len == arglen && !strncmp(arg, opt, len);
++ if (!boot_cpu_has(X86_FEATURE_IBPB) && !boot_cpu_has(X86_FEATURE_STIBP))
++ return;
++
++ if (cpu_smt_control == CPU_SMT_FORCE_DISABLED ||
++ cpu_smt_control == CPU_SMT_NOT_SUPPORTED)
++ smt_possible = false;
++
++ cmd = spectre_v2_parse_user_cmdline(v2_cmd);
++ switch (cmd) {
++ case SPECTRE_V2_USER_CMD_NONE:
++ goto set_mode;
++ case SPECTRE_V2_USER_CMD_FORCE:
++ mode = SPECTRE_V2_USER_STRICT;
++ break;
++ case SPECTRE_V2_USER_CMD_PRCTL:
++ case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
++ mode = SPECTRE_V2_USER_PRCTL;
++ break;
++ case SPECTRE_V2_USER_CMD_AUTO:
++ case SPECTRE_V2_USER_CMD_SECCOMP:
++ case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
++ if (IS_ENABLED(CONFIG_SECCOMP))
++ mode = SPECTRE_V2_USER_SECCOMP;
++ else
++ mode = SPECTRE_V2_USER_PRCTL;
++ break;
++ }
++
++ /* Initialize Indirect Branch Prediction Barrier */
++ if (boot_cpu_has(X86_FEATURE_IBPB)) {
++ setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
++
++ switch (cmd) {
++ case SPECTRE_V2_USER_CMD_FORCE:
++ case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
++ case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
++ static_branch_enable(&switch_mm_always_ibpb);
++ break;
++ case SPECTRE_V2_USER_CMD_PRCTL:
++ case SPECTRE_V2_USER_CMD_AUTO:
++ case SPECTRE_V2_USER_CMD_SECCOMP:
++ static_branch_enable(&switch_mm_cond_ibpb);
++ break;
++ default:
++ break;
++ }
++
++ pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
++ static_key_enabled(&switch_mm_always_ibpb) ?
++ "always-on" : "conditional");
++ }
++
++ /* If enhanced IBRS is enabled no STIPB required */
++ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
++ return;
++
++ /*
++ * If SMT is not possible or STIBP is not available clear the STIPB
++ * mode.
++ */
++ if (!smt_possible || !boot_cpu_has(X86_FEATURE_STIBP))
++ mode = SPECTRE_V2_USER_NONE;
++set_mode:
++ spectre_v2_user = mode;
++ /* Only print the STIBP mode when SMT possible */
++ if (smt_possible)
++ pr_info("%s\n", spectre_v2_user_strings[mode]);
+ }
+
++static const char * const spectre_v2_strings[] = {
++ [SPECTRE_V2_NONE] = "Vulnerable",
++ [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline",
++ [SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline",
++ [SPECTRE_V2_IBRS_ENHANCED] = "Mitigation: Enhanced IBRS",
++};
++
+ static const struct {
+ const char *option;
+ enum spectre_v2_mitigation_cmd cmd;
+ bool secure;
+-} mitigation_options[] = {
+- { "off", SPECTRE_V2_CMD_NONE, false },
+- { "on", SPECTRE_V2_CMD_FORCE, true },
+- { "retpoline", SPECTRE_V2_CMD_RETPOLINE, false },
+- { "retpoline,amd", SPECTRE_V2_CMD_RETPOLINE_AMD, false },
+- { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
+- { "auto", SPECTRE_V2_CMD_AUTO, false },
++} mitigation_options[] __initdata = {
++ { "off", SPECTRE_V2_CMD_NONE, false },
++ { "on", SPECTRE_V2_CMD_FORCE, true },
++ { "retpoline", SPECTRE_V2_CMD_RETPOLINE, false },
++ { "retpoline,amd", SPECTRE_V2_CMD_RETPOLINE_AMD, false },
++ { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
++ { "auto", SPECTRE_V2_CMD_AUTO, false },
+ };
+
++static void __init spec_v2_print_cond(const char *reason, bool secure)
++{
++ if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2) != secure)
++ pr_info("%s selected on command line.\n", reason);
++}
++
+ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ {
++ enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO;
+ char arg[20];
+ int ret, i;
+- enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO;
+
+ if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
+ return SPECTRE_V2_CMD_NONE;
+- else {
+- ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
+- if (ret < 0)
+- return SPECTRE_V2_CMD_AUTO;
+
+- for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) {
+- if (!match_option(arg, ret, mitigation_options[i].option))
+- continue;
+- cmd = mitigation_options[i].cmd;
+- break;
+- }
++ ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
++ if (ret < 0)
++ return SPECTRE_V2_CMD_AUTO;
+
+- if (i >= ARRAY_SIZE(mitigation_options)) {
+- pr_err("unknown option (%s). Switching to AUTO select\n", arg);
+- return SPECTRE_V2_CMD_AUTO;
+- }
++ for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) {
++ if (!match_option(arg, ret, mitigation_options[i].option))
++ continue;
++ cmd = mitigation_options[i].cmd;
++ break;
++ }
++
++ if (i >= ARRAY_SIZE(mitigation_options)) {
++ pr_err("unknown option (%s). Switching to AUTO select\n", arg);
++ return SPECTRE_V2_CMD_AUTO;
+ }
+
+ if ((cmd == SPECTRE_V2_CMD_RETPOLINE ||
+@@ -317,11 +461,8 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ return SPECTRE_V2_CMD_AUTO;
+ }
+
+- if (mitigation_options[i].secure)
+- spec2_print_if_secure(mitigation_options[i].option);
+- else
+- spec2_print_if_insecure(mitigation_options[i].option);
+-
++ spec_v2_print_cond(mitigation_options[i].option,
++ mitigation_options[i].secure);
+ return cmd;
+ }
+
+@@ -377,14 +518,12 @@ retpoline_auto:
+ pr_err("Spectre mitigation: LFENCE not serializing, switching to generic retpoline\n");
+ goto retpoline_generic;
+ }
+- mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
+- SPECTRE_V2_RETPOLINE_MINIMAL_AMD;
++ mode = SPECTRE_V2_RETPOLINE_AMD;
+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD);
+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
+ } else {
+ retpoline_generic:
+- mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_GENERIC :
+- SPECTRE_V2_RETPOLINE_MINIMAL;
++ mode = SPECTRE_V2_RETPOLINE_GENERIC;
+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
+ }
+
+@@ -403,12 +542,6 @@ specv2_set_mode:
+ setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
+ pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n");
+
+- /* Initialize Indirect Branch Prediction Barrier if supported */
+- if (boot_cpu_has(X86_FEATURE_IBPB)) {
+- setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+- pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
+- }
+-
+ /*
+ * Retpoline means the kernel is safe because it has no indirect
+ * branches. Enhanced IBRS protects firmware too, so, enable restricted
+@@ -424,6 +557,66 @@ specv2_set_mode:
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+ pr_info("Enabling Restricted Speculation for firmware calls\n");
+ }
++
++ /* Set up IBPB and STIBP depending on the general spectre V2 command */
++ spectre_v2_user_select_mitigation(cmd);
++
++ /* Enable STIBP if appropriate */
++ arch_smt_update();
++}
++
++static void update_stibp_msr(void * __unused)
++{
++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++}
++
++/* Update x86_spec_ctrl_base in case SMT state changed. */
++static void update_stibp_strict(void)
++{
++ u64 mask = x86_spec_ctrl_base & ~SPEC_CTRL_STIBP;
++
++ if (sched_smt_active())
++ mask |= SPEC_CTRL_STIBP;
++
++ if (mask == x86_spec_ctrl_base)
++ return;
++
++ pr_info("Update user space SMT mitigation: STIBP %s\n",
++ mask & SPEC_CTRL_STIBP ? "always-on" : "off");
++ x86_spec_ctrl_base = mask;
++ on_each_cpu(update_stibp_msr, NULL, 1);
++}
++
++/* Update the static key controlling the evaluation of TIF_SPEC_IB */
++static void update_indir_branch_cond(void)
++{
++ if (sched_smt_active())
++ static_branch_enable(&switch_to_cond_stibp);
++ else
++ static_branch_disable(&switch_to_cond_stibp);
++}
++
++void arch_smt_update(void)
++{
++ /* Enhanced IBRS implies STIBP. No update required. */
++ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
++ return;
++
++ mutex_lock(&spec_ctrl_mutex);
++
++ switch (spectre_v2_user) {
++ case SPECTRE_V2_USER_NONE:
++ break;
++ case SPECTRE_V2_USER_STRICT:
++ update_stibp_strict();
++ break;
++ case SPECTRE_V2_USER_PRCTL:
++ case SPECTRE_V2_USER_SECCOMP:
++ update_indir_branch_cond();
++ break;
++ }
++
++ mutex_unlock(&spec_ctrl_mutex);
+ }
+
+ #undef pr_fmt
+@@ -440,7 +633,7 @@ enum ssb_mitigation_cmd {
+ SPEC_STORE_BYPASS_CMD_SECCOMP,
+ };
+
+-static const char *ssb_strings[] = {
++static const char * const ssb_strings[] = {
+ [SPEC_STORE_BYPASS_NONE] = "Vulnerable",
+ [SPEC_STORE_BYPASS_DISABLE] = "Mitigation: Speculative Store Bypass disabled",
+ [SPEC_STORE_BYPASS_PRCTL] = "Mitigation: Speculative Store Bypass disabled via prctl",
+@@ -450,7 +643,7 @@ static const char *ssb_strings[] = {
+ static const struct {
+ const char *option;
+ enum ssb_mitigation_cmd cmd;
+-} ssb_mitigation_options[] = {
++} ssb_mitigation_options[] __initdata = {
+ { "auto", SPEC_STORE_BYPASS_CMD_AUTO }, /* Platform decides */
+ { "on", SPEC_STORE_BYPASS_CMD_ON }, /* Disable Speculative Store Bypass */
+ { "off", SPEC_STORE_BYPASS_CMD_NONE }, /* Don't touch Speculative Store Bypass */
+@@ -561,10 +754,25 @@ static void ssb_select_mitigation(void)
+ #undef pr_fmt
+ #define pr_fmt(fmt) "Speculation prctl: " fmt
+
+-static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
++static void task_update_spec_tif(struct task_struct *tsk)
+ {
+- bool update;
++ /* Force the update of the real TIF bits */
++ set_tsk_thread_flag(tsk, TIF_SPEC_FORCE_UPDATE);
+
++ /*
++ * Immediately update the speculation control MSRs for the current
++ * task, but for a non-current task delay setting the CPU
++ * mitigation until it is scheduled next.
++ *
++ * This can only happen for SECCOMP mitigation. For PRCTL it's
++ * always the current task.
++ */
++ if (tsk == current)
++ speculation_ctrl_update_current();
++}
++
++static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
++{
+ if (ssb_mode != SPEC_STORE_BYPASS_PRCTL &&
+ ssb_mode != SPEC_STORE_BYPASS_SECCOMP)
+ return -ENXIO;
+@@ -575,28 +783,56 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
+ if (task_spec_ssb_force_disable(task))
+ return -EPERM;
+ task_clear_spec_ssb_disable(task);
+- update = test_and_clear_tsk_thread_flag(task, TIF_SSBD);
++ task_update_spec_tif(task);
+ break;
+ case PR_SPEC_DISABLE:
+ task_set_spec_ssb_disable(task);
+- update = !test_and_set_tsk_thread_flag(task, TIF_SSBD);
++ task_update_spec_tif(task);
+ break;
+ case PR_SPEC_FORCE_DISABLE:
+ task_set_spec_ssb_disable(task);
+ task_set_spec_ssb_force_disable(task);
+- update = !test_and_set_tsk_thread_flag(task, TIF_SSBD);
++ task_update_spec_tif(task);
+ break;
+ default:
+ return -ERANGE;
+ }
++ return 0;
++}
+
+- /*
+- * If being set on non-current task, delay setting the CPU
+- * mitigation until it is next scheduled.
+- */
+- if (task == current && update)
+- speculative_store_bypass_update_current();
+-
++static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
++{
++ switch (ctrl) {
++ case PR_SPEC_ENABLE:
++ if (spectre_v2_user == SPECTRE_V2_USER_NONE)
++ return 0;
++ /*
++ * Indirect branch speculation is always disabled in strict
++ * mode.
++ */
++ if (spectre_v2_user == SPECTRE_V2_USER_STRICT)
++ return -EPERM;
++ task_clear_spec_ib_disable(task);
++ task_update_spec_tif(task);
++ break;
++ case PR_SPEC_DISABLE:
++ case PR_SPEC_FORCE_DISABLE:
++ /*
++ * Indirect branch speculation is always allowed when
++ * mitigation is force disabled.
++ */
++ if (spectre_v2_user == SPECTRE_V2_USER_NONE)
++ return -EPERM;
++ if (spectre_v2_user == SPECTRE_V2_USER_STRICT)
++ return 0;
++ task_set_spec_ib_disable(task);
++ if (ctrl == PR_SPEC_FORCE_DISABLE)
++ task_set_spec_ib_force_disable(task);
++ task_update_spec_tif(task);
++ break;
++ default:
++ return -ERANGE;
++ }
+ return 0;
+ }
+
+@@ -606,6 +842,8 @@ int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which,
+ switch (which) {
+ case PR_SPEC_STORE_BYPASS:
+ return ssb_prctl_set(task, ctrl);
++ case PR_SPEC_INDIRECT_BRANCH:
++ return ib_prctl_set(task, ctrl);
+ default:
+ return -ENODEV;
+ }
+@@ -616,6 +854,8 @@ void arch_seccomp_spec_mitigate(struct task_struct *task)
+ {
+ if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP)
+ ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE);
++ if (spectre_v2_user == SPECTRE_V2_USER_SECCOMP)
++ ib_prctl_set(task, PR_SPEC_FORCE_DISABLE);
+ }
+ #endif
+
+@@ -638,11 +878,35 @@ static int ssb_prctl_get(struct task_struct *task)
+ }
+ }
+
++static int ib_prctl_get(struct task_struct *task)
++{
++ if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
++ return PR_SPEC_NOT_AFFECTED;
++
++ switch (spectre_v2_user) {
++ case SPECTRE_V2_USER_NONE:
++ return PR_SPEC_ENABLE;
++ case SPECTRE_V2_USER_PRCTL:
++ case SPECTRE_V2_USER_SECCOMP:
++ if (task_spec_ib_force_disable(task))
++ return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
++ if (task_spec_ib_disable(task))
++ return PR_SPEC_PRCTL | PR_SPEC_DISABLE;
++ return PR_SPEC_PRCTL | PR_SPEC_ENABLE;
++ case SPECTRE_V2_USER_STRICT:
++ return PR_SPEC_DISABLE;
++ default:
++ return PR_SPEC_NOT_AFFECTED;
++ }
++}
++
+ int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which)
+ {
+ switch (which) {
+ case PR_SPEC_STORE_BYPASS:
+ return ssb_prctl_get(task);
++ case PR_SPEC_INDIRECT_BRANCH:
++ return ib_prctl_get(task);
+ default:
+ return -ENODEV;
+ }
+@@ -780,7 +1044,7 @@ early_param("l1tf", l1tf_cmdline);
+ #define L1TF_DEFAULT_MSG "Mitigation: PTE Inversion"
+
+ #if IS_ENABLED(CONFIG_KVM_INTEL)
+-static const char *l1tf_vmx_states[] = {
++static const char * const l1tf_vmx_states[] = {
+ [VMENTER_L1D_FLUSH_AUTO] = "auto",
+ [VMENTER_L1D_FLUSH_NEVER] = "vulnerable",
+ [VMENTER_L1D_FLUSH_COND] = "conditional cache flushes",
+@@ -796,13 +1060,14 @@ static ssize_t l1tf_show_state(char *buf)
+
+ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_EPT_DISABLED ||
+ (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER &&
+- cpu_smt_control == CPU_SMT_ENABLED))
++ sched_smt_active())) {
+ return sprintf(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG,
+ l1tf_vmx_states[l1tf_vmx_mitigation]);
++ }
+
+ return sprintf(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG,
+ l1tf_vmx_states[l1tf_vmx_mitigation],
+- cpu_smt_control == CPU_SMT_ENABLED ? "vulnerable" : "disabled");
++ sched_smt_active() ? "vulnerable" : "disabled");
+ }
+ #else
+ static ssize_t l1tf_show_state(char *buf)
+@@ -811,6 +1076,36 @@ static ssize_t l1tf_show_state(char *buf)
+ }
+ #endif
+
++static char *stibp_state(void)
++{
++ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
++ return "";
++
++ switch (spectre_v2_user) {
++ case SPECTRE_V2_USER_NONE:
++ return ", STIBP: disabled";
++ case SPECTRE_V2_USER_STRICT:
++ return ", STIBP: forced";
++ case SPECTRE_V2_USER_PRCTL:
++ case SPECTRE_V2_USER_SECCOMP:
++ if (static_key_enabled(&switch_to_cond_stibp))
++ return ", STIBP: conditional";
++ }
++ return "";
++}
++
++static char *ibpb_state(void)
++{
++ if (boot_cpu_has(X86_FEATURE_IBPB)) {
++ if (static_key_enabled(&switch_mm_always_ibpb))
++ return ", IBPB: always-on";
++ if (static_key_enabled(&switch_mm_cond_ibpb))
++ return ", IBPB: conditional";
++ return ", IBPB: disabled";
++ }
++ return "";
++}
++
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+ char *buf, unsigned int bug)
+ {
+@@ -831,9 +1126,11 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ return sprintf(buf, "Mitigation: __user pointer sanitization\n");
+
+ case X86_BUG_SPECTRE_V2:
+- return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+- boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
++ return sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
++ ibpb_state(),
+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
++ stibp_state(),
++ boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
+ spectre_v2_module_string());
+
+ case X86_BUG_SPEC_STORE_BYPASS:
+diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+index dd33c357548f..e12454e21b8a 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -56,7 +56,7 @@
+ /* Threshold LVT offset is at MSR0xC0000410[15:12] */
+ #define SMCA_THR_LVT_OFF 0xF000
+
+-static bool thresholding_en;
++static bool thresholding_irq_en;
+
+ static const char * const th_names[] = {
+ "load_store",
+@@ -534,9 +534,8 @@ prepare_threshold_block(unsigned int bank, unsigned int block, u32 addr,
+
+ set_offset:
+ offset = setup_APIC_mce_threshold(offset, new);
+-
+- if ((offset == new) && (mce_threshold_vector != amd_threshold_interrupt))
+- mce_threshold_vector = amd_threshold_interrupt;
++ if (offset == new)
++ thresholding_irq_en = true;
+
+ done:
+ mce_threshold_block_init(&b, offset);
+@@ -1357,9 +1356,6 @@ int mce_threshold_remove_device(unsigned int cpu)
+ {
+ unsigned int bank;
+
+- if (!thresholding_en)
+- return 0;
+-
+ for (bank = 0; bank < mca_cfg.banks; ++bank) {
+ if (!(per_cpu(bank_map, cpu) & (1 << bank)))
+ continue;
+@@ -1377,9 +1373,6 @@ int mce_threshold_create_device(unsigned int cpu)
+ struct threshold_bank **bp;
+ int err = 0;
+
+- if (!thresholding_en)
+- return 0;
+-
+ bp = per_cpu(threshold_banks, cpu);
+ if (bp)
+ return 0;
+@@ -1408,9 +1401,6 @@ static __init int threshold_init_device(void)
+ {
+ unsigned lcpu = 0;
+
+- if (mce_threshold_vector == amd_threshold_interrupt)
+- thresholding_en = true;
+-
+ /* to hit CPUs online before the notifier is up */
+ for_each_online_cpu(lcpu) {
+ int err = mce_threshold_create_device(lcpu);
+@@ -1419,6 +1409,9 @@ static __init int threshold_init_device(void)
+ return err;
+ }
+
++ if (thresholding_irq_en)
++ mce_threshold_vector = amd_threshold_interrupt;
++
+ return 0;
+ }
+ /*
+diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
+index 61a949d84dfa..d99a8ee9e185 100644
+--- a/arch/x86/kernel/fpu/signal.c
++++ b/arch/x86/kernel/fpu/signal.c
+@@ -344,10 +344,10 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
+ sanitize_restored_xstate(tsk, &env, xfeatures, fx_only);
+ }
+
++ local_bh_disable();
+ fpu->initialized = 1;
+- preempt_disable();
+ fpu__restore(fpu);
+- preempt_enable();
++ local_bh_enable();
+
+ return err;
+ } else {
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index 01ebcb6f263e..7ee8067cbf45 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -994,7 +994,6 @@ void prepare_ftrace_return(unsigned long self_addr, unsigned long *parent,
+ {
+ unsigned long old;
+ int faulted;
+- struct ftrace_graph_ent trace;
+ unsigned long return_hooker = (unsigned long)
+ &return_to_handler;
+
+@@ -1046,19 +1045,7 @@ void prepare_ftrace_return(unsigned long self_addr, unsigned long *parent,
+ return;
+ }
+
+- trace.func = self_addr;
+- trace.depth = current->curr_ret_stack + 1;
+-
+- /* Only trace if the calling function expects to */
+- if (!ftrace_graph_entry(&trace)) {
++ if (function_graph_enter(old, self_addr, frame_pointer, parent))
+ *parent = old;
+- return;
+- }
+-
+- if (ftrace_push_return_trace(old, self_addr, &trace.depth,
+- frame_pointer, parent) == -EBUSY) {
+- *parent = old;
+- return;
+- }
+ }
+ #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index c93fcfdf1673..7d31192296a8 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -40,6 +40,8 @@
+ #include <asm/prctl.h>
+ #include <asm/spec-ctrl.h>
+
++#include "process.h"
++
+ /*
+ * per-CPU TSS segments. Threads are completely 'soft' on Linux,
+ * no more per-task TSS's. The TSS size is kept cacheline-aligned
+@@ -252,11 +254,12 @@ void arch_setup_new_exec(void)
+ enable_cpuid();
+ }
+
+-static inline void switch_to_bitmap(struct tss_struct *tss,
+- struct thread_struct *prev,
++static inline void switch_to_bitmap(struct thread_struct *prev,
+ struct thread_struct *next,
+ unsigned long tifp, unsigned long tifn)
+ {
++ struct tss_struct *tss = this_cpu_ptr(&cpu_tss_rw);
++
+ if (tifn & _TIF_IO_BITMAP) {
+ /*
+ * Copy the relevant range of the IO bitmap.
+@@ -395,32 +398,85 @@ static __always_inline void amd_set_ssb_virt_state(unsigned long tifn)
+ wrmsrl(MSR_AMD64_VIRT_SPEC_CTRL, ssbd_tif_to_spec_ctrl(tifn));
+ }
+
+-static __always_inline void intel_set_ssb_state(unsigned long tifn)
++/*
++ * Update the MSRs managing speculation control, during context switch.
++ *
++ * tifp: Previous task's thread flags
++ * tifn: Next task's thread flags
++ */
++static __always_inline void __speculation_ctrl_update(unsigned long tifp,
++ unsigned long tifn)
+ {
+- u64 msr = x86_spec_ctrl_base | ssbd_tif_to_spec_ctrl(tifn);
++ unsigned long tif_diff = tifp ^ tifn;
++ u64 msr = x86_spec_ctrl_base;
++ bool updmsr = false;
++
++ /*
++ * If TIF_SSBD is different, select the proper mitigation
++ * method. Note that if SSBD mitigation is disabled or permanentely
++ * enabled this branch can't be taken because nothing can set
++ * TIF_SSBD.
++ */
++ if (tif_diff & _TIF_SSBD) {
++ if (static_cpu_has(X86_FEATURE_VIRT_SSBD)) {
++ amd_set_ssb_virt_state(tifn);
++ } else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD)) {
++ amd_set_core_ssb_state(tifn);
++ } else if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
++ static_cpu_has(X86_FEATURE_AMD_SSBD)) {
++ msr |= ssbd_tif_to_spec_ctrl(tifn);
++ updmsr = true;
++ }
++ }
++
++ /*
++ * Only evaluate TIF_SPEC_IB if conditional STIBP is enabled,
++ * otherwise avoid the MSR write.
++ */
++ if (IS_ENABLED(CONFIG_SMP) &&
++ static_branch_unlikely(&switch_to_cond_stibp)) {
++ updmsr |= !!(tif_diff & _TIF_SPEC_IB);
++ msr |= stibp_tif_to_spec_ctrl(tifn);
++ }
+
+- wrmsrl(MSR_IA32_SPEC_CTRL, msr);
++ if (updmsr)
++ wrmsrl(MSR_IA32_SPEC_CTRL, msr);
+ }
+
+-static __always_inline void __speculative_store_bypass_update(unsigned long tifn)
++static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk)
+ {
+- if (static_cpu_has(X86_FEATURE_VIRT_SSBD))
+- amd_set_ssb_virt_state(tifn);
+- else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD))
+- amd_set_core_ssb_state(tifn);
+- else
+- intel_set_ssb_state(tifn);
++ if (test_and_clear_tsk_thread_flag(tsk, TIF_SPEC_FORCE_UPDATE)) {
++ if (task_spec_ssb_disable(tsk))
++ set_tsk_thread_flag(tsk, TIF_SSBD);
++ else
++ clear_tsk_thread_flag(tsk, TIF_SSBD);
++
++ if (task_spec_ib_disable(tsk))
++ set_tsk_thread_flag(tsk, TIF_SPEC_IB);
++ else
++ clear_tsk_thread_flag(tsk, TIF_SPEC_IB);
++ }
++ /* Return the updated threadinfo flags*/
++ return task_thread_info(tsk)->flags;
+ }
+
+-void speculative_store_bypass_update(unsigned long tif)
++void speculation_ctrl_update(unsigned long tif)
+ {
++ /* Forced update. Make sure all relevant TIF flags are different */
+ preempt_disable();
+- __speculative_store_bypass_update(tif);
++ __speculation_ctrl_update(~tif, tif);
+ preempt_enable();
+ }
+
+-void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
+- struct tss_struct *tss)
++/* Called from seccomp/prctl update */
++void speculation_ctrl_update_current(void)
++{
++ preempt_disable();
++ speculation_ctrl_update(speculation_ctrl_update_tif(current));
++ preempt_enable();
++}
++
++void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p)
+ {
+ struct thread_struct *prev, *next;
+ unsigned long tifp, tifn;
+@@ -430,7 +486,7 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
+
+ tifn = READ_ONCE(task_thread_info(next_p)->flags);
+ tifp = READ_ONCE(task_thread_info(prev_p)->flags);
+- switch_to_bitmap(tss, prev, next, tifp, tifn);
++ switch_to_bitmap(prev, next, tifp, tifn);
+
+ propagate_user_return_notify(prev_p, next_p);
+
+@@ -451,8 +507,15 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
+ if ((tifp ^ tifn) & _TIF_NOCPUID)
+ set_cpuid_faulting(!!(tifn & _TIF_NOCPUID));
+
+- if ((tifp ^ tifn) & _TIF_SSBD)
+- __speculative_store_bypass_update(tifn);
++ if (likely(!((tifp | tifn) & _TIF_SPEC_FORCE_UPDATE))) {
++ __speculation_ctrl_update(tifp, tifn);
++ } else {
++ speculation_ctrl_update_tif(prev_p);
++ tifn = speculation_ctrl_update_tif(next_p);
++
++ /* Enforce MSR update to ensure consistent state */
++ __speculation_ctrl_update(~tifn, tifn);
++ }
+ }
+
+ /*
+diff --git a/arch/x86/kernel/process.h b/arch/x86/kernel/process.h
+new file mode 100644
+index 000000000000..898e97cf6629
+--- /dev/null
++++ b/arch/x86/kernel/process.h
+@@ -0,0 +1,39 @@
++// SPDX-License-Identifier: GPL-2.0
++//
++// Code shared between 32 and 64 bit
++
++#include <asm/spec-ctrl.h>
++
++void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p);
++
++/*
++ * This needs to be inline to optimize for the common case where no extra
++ * work needs to be done.
++ */
++static inline void switch_to_extra(struct task_struct *prev,
++ struct task_struct *next)
++{
++ unsigned long next_tif = task_thread_info(next)->flags;
++ unsigned long prev_tif = task_thread_info(prev)->flags;
++
++ if (IS_ENABLED(CONFIG_SMP)) {
++ /*
++ * Avoid __switch_to_xtra() invocation when conditional
++ * STIPB is disabled and the only different bit is
++ * TIF_SPEC_IB. For CONFIG_SMP=n TIF_SPEC_IB is not
++ * in the TIF_WORK_CTXSW masks.
++ */
++ if (!static_branch_likely(&switch_to_cond_stibp)) {
++ prev_tif &= ~_TIF_SPEC_IB;
++ next_tif &= ~_TIF_SPEC_IB;
++ }
++ }
++
++ /*
++ * __switch_to_xtra() handles debug registers, i/o bitmaps,
++ * speculation mitigations etc.
++ */
++ if (unlikely(next_tif & _TIF_WORK_CTXSW_NEXT ||
++ prev_tif & _TIF_WORK_CTXSW_PREV))
++ __switch_to_xtra(prev, next);
++}
+diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
+index 5046a3c9dec2..d3e593eb189f 100644
+--- a/arch/x86/kernel/process_32.c
++++ b/arch/x86/kernel/process_32.c
+@@ -59,6 +59,8 @@
+ #include <asm/intel_rdt_sched.h>
+ #include <asm/proto.h>
+
++#include "process.h"
++
+ void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
+ {
+ unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L;
+@@ -232,7 +234,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+ struct fpu *prev_fpu = &prev->fpu;
+ struct fpu *next_fpu = &next->fpu;
+ int cpu = smp_processor_id();
+- struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
+
+ /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
+
+@@ -264,12 +265,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+ if (get_kernel_rpl() && unlikely(prev->iopl != next->iopl))
+ set_iopl_mask(next->iopl);
+
+- /*
+- * Now maybe handle debug registers and/or IO bitmaps
+- */
+- if (unlikely(task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV ||
+- task_thread_info(next_p)->flags & _TIF_WORK_CTXSW_NEXT))
+- __switch_to_xtra(prev_p, next_p, tss);
++ switch_to_extra(prev_p, next_p);
+
+ /*
+ * Leave lazy mode, flushing any hypercalls made here.
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index ea5ea850348d..a0854f283efd 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -59,6 +59,8 @@
+ #include <asm/unistd_32_ia32.h>
+ #endif
+
++#include "process.h"
++
+ __visible DEFINE_PER_CPU(unsigned long, rsp_scratch);
+
+ /* Prints also some state that isn't saved in the pt_regs */
+@@ -422,7 +424,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+ struct fpu *prev_fpu = &prev->fpu;
+ struct fpu *next_fpu = &next->fpu;
+ int cpu = smp_processor_id();
+- struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
+
+ WARN_ON_ONCE(IS_ENABLED(CONFIG_DEBUG_ENTRY) &&
+ this_cpu_read(irq_count) != -1);
+@@ -489,12 +490,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+ /* Reload sp0. */
+ update_task_stack(next_p);
+
+- /*
+- * Now maybe reload the debug registers and handle I/O bitmaps
+- */
+- if (unlikely(task_thread_info(next_p)->flags & _TIF_WORK_CTXSW_NEXT ||
+- task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
+- __switch_to_xtra(prev_p, next_p, tss);
++ switch_to_extra(prev_p, next_p);
+
+ #ifdef CONFIG_XEN_PV
+ /*
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index fbb0e6df121b..2216d21e955d 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -571,6 +571,11 @@ int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
+ rcu_read_lock();
+ map = rcu_dereference(kvm->arch.apic_map);
+
++ if (unlikely(!map)) {
++ count = -EOPNOTSUPP;
++ goto out;
++ }
++
+ if (min > map->max_apic_id)
+ goto out;
+ /* Bits above cluster_size are masked in the caller. */
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 51b953ad9d4e..1b82bc7c3cca 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -5013,9 +5013,9 @@ static bool need_remote_flush(u64 old, u64 new)
+ }
+
+ static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,
+- const u8 *new, int *bytes)
++ int *bytes)
+ {
+- u64 gentry;
++ u64 gentry = 0;
+ int r;
+
+ /*
+@@ -5027,22 +5027,12 @@ static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,
+ /* Handle a 32-bit guest writing two halves of a 64-bit gpte */
+ *gpa &= ~(gpa_t)7;
+ *bytes = 8;
+- r = kvm_vcpu_read_guest(vcpu, *gpa, &gentry, 8);
+- if (r)
+- gentry = 0;
+- new = (const u8 *)&gentry;
+ }
+
+- switch (*bytes) {
+- case 4:
+- gentry = *(const u32 *)new;
+- break;
+- case 8:
+- gentry = *(const u64 *)new;
+- break;
+- default:
+- gentry = 0;
+- break;
++ if (*bytes == 4 || *bytes == 8) {
++ r = kvm_vcpu_read_guest_atomic(vcpu, *gpa, &gentry, *bytes);
++ if (r)
++ gentry = 0;
+ }
+
+ return gentry;
+@@ -5146,8 +5136,6 @@ static void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+
+ pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
+
+- gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, new, &bytes);
+-
+ /*
+ * No need to care whether allocation memory is successful
+ * or not since pte prefetch is skiped if it does not have
+@@ -5156,6 +5144,9 @@ static void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+ mmu_topup_memory_caches(vcpu);
+
+ spin_lock(&vcpu->kvm->mmu_lock);
++
++ gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, &bytes);
++
+ ++vcpu->kvm->stat.mmu_pte_write;
+ kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 61ccfb13899e..4397fa0c448f 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1444,7 +1444,7 @@ static u64 svm_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
+ return vcpu->arch.tsc_offset;
+ }
+
+-static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
++static u64 svm_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+ {
+ struct vcpu_svm *svm = to_svm(vcpu);
+ u64 g_tsc_offset = 0;
+@@ -1462,6 +1462,7 @@ static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+ svm->vmcb->control.tsc_offset = offset + g_tsc_offset;
+
+ mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
++ return svm->vmcb->control.tsc_offset;
+ }
+
+ static void avic_init_vmcb(struct vcpu_svm *svm)
+@@ -2187,21 +2188,31 @@ out:
+ return ERR_PTR(err);
+ }
+
++static void svm_clear_current_vmcb(struct vmcb *vmcb)
++{
++ int i;
++
++ for_each_online_cpu(i)
++ cmpxchg(&per_cpu(svm_data, i)->current_vmcb, vmcb, NULL);
++}
++
+ static void svm_free_vcpu(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_svm *svm = to_svm(vcpu);
+
++ /*
++ * The vmcb page can be recycled, causing a false negative in
++ * svm_vcpu_load(). So, ensure that no logical CPU has this
++ * vmcb page recorded as its current vmcb.
++ */
++ svm_clear_current_vmcb(svm->vmcb);
++
+ __free_page(pfn_to_page(__sme_clr(svm->vmcb_pa) >> PAGE_SHIFT));
+ __free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);
+ __free_page(virt_to_page(svm->nested.hsave));
+ __free_pages(virt_to_page(svm->nested.msrpm), MSRPM_ALLOC_ORDER);
+ kvm_vcpu_uninit(vcpu);
+ kmem_cache_free(kvm_vcpu_cache, svm);
+- /*
+- * The vmcb page can be recycled, causing a false negative in
+- * svm_vcpu_load(). So do a full IBPB now.
+- */
+- indirect_branch_prediction_barrier();
+ }
+
+ static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+@@ -7145,7 +7156,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
+ .has_wbinvd_exit = svm_has_wbinvd_exit,
+
+ .read_l1_tsc_offset = svm_read_l1_tsc_offset,
+- .write_tsc_offset = svm_write_tsc_offset,
++ .write_l1_tsc_offset = svm_write_l1_tsc_offset,
+
+ .set_tdp_cr3 = set_tdp_cr3,
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 9f3def7baa6d..e55f7a90d4b2 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -170,6 +170,7 @@ module_param_named(preemption_timer, enable_preemption_timer, bool, S_IRUGO);
+ * refer SDM volume 3b section 21.6.13 & 22.1.3.
+ */
+ static unsigned int ple_gap = KVM_DEFAULT_PLE_GAP;
++module_param(ple_gap, uint, 0444);
+
+ static unsigned int ple_window = KVM_VMX_DEFAULT_PLE_WINDOW;
+ module_param(ple_window, uint, 0444);
+@@ -3433,11 +3434,9 @@ static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
+ return vcpu->arch.tsc_offset;
+ }
+
+-/*
+- * writes 'offset' into guest's timestamp counter offset register
+- */
+-static void vmx_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
++static u64 vmx_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+ {
++ u64 active_offset = offset;
+ if (is_guest_mode(vcpu)) {
+ /*
+ * We're here if L1 chose not to trap WRMSR to TSC. According
+@@ -3445,17 +3444,16 @@ static void vmx_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+ * set for L2 remains unchanged, and still needs to be added
+ * to the newly set TSC to get L2's TSC.
+ */
+- struct vmcs12 *vmcs12;
+- /* recalculate vmcs02.TSC_OFFSET: */
+- vmcs12 = get_vmcs12(vcpu);
+- vmcs_write64(TSC_OFFSET, offset +
+- (nested_cpu_has(vmcs12, CPU_BASED_USE_TSC_OFFSETING) ?
+- vmcs12->tsc_offset : 0));
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ if (nested_cpu_has(vmcs12, CPU_BASED_USE_TSC_OFFSETING))
++ active_offset += vmcs12->tsc_offset;
+ } else {
+ trace_kvm_write_tsc_offset(vcpu->vcpu_id,
+ vmcs_read64(TSC_OFFSET), offset);
+- vmcs_write64(TSC_OFFSET, offset);
+ }
++
++ vmcs_write64(TSC_OFFSET, active_offset);
++ return active_offset;
+ }
+
+ /*
+@@ -14203,7 +14201,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
+ .has_wbinvd_exit = cpu_has_vmx_wbinvd_exit,
+
+ .read_l1_tsc_offset = vmx_read_l1_tsc_offset,
+- .write_tsc_offset = vmx_write_tsc_offset,
++ .write_l1_tsc_offset = vmx_write_l1_tsc_offset,
+
+ .set_tdp_cr3 = vmx_set_cr3,
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index ca717737347e..68b53f05a420 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1582,8 +1582,7 @@ EXPORT_SYMBOL_GPL(kvm_read_l1_tsc);
+
+ static void kvm_vcpu_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+ {
+- kvm_x86_ops->write_tsc_offset(vcpu, offset);
+- vcpu->arch.tsc_offset = offset;
++ vcpu->arch.tsc_offset = kvm_x86_ops->write_l1_tsc_offset(vcpu, offset);
+ }
+
+ static inline bool kvm_check_tsc_unstable(void)
+@@ -1711,7 +1710,8 @@ EXPORT_SYMBOL_GPL(kvm_write_tsc);
+ static inline void adjust_tsc_offset_guest(struct kvm_vcpu *vcpu,
+ s64 adjustment)
+ {
+- kvm_vcpu_write_tsc_offset(vcpu, vcpu->arch.tsc_offset + adjustment);
++ u64 tsc_offset = kvm_x86_ops->read_l1_tsc_offset(vcpu);
++ kvm_vcpu_write_tsc_offset(vcpu, tsc_offset + adjustment);
+ }
+
+ static inline void adjust_tsc_offset_host(struct kvm_vcpu *vcpu, s64 adjustment)
+@@ -6788,6 +6788,7 @@ static int kvm_pv_clock_pairing(struct kvm_vcpu *vcpu, gpa_t paddr,
+ clock_pairing.nsec = ts.tv_nsec;
+ clock_pairing.tsc = kvm_read_l1_tsc(vcpu, cycle);
+ clock_pairing.flags = 0;
++ memset(&clock_pairing.pad, 0, sizeof(clock_pairing.pad));
+
+ ret = 0;
+ if (kvm_write_guest(vcpu->kvm, paddr, &clock_pairing,
+@@ -7313,7 +7314,8 @@ static void vcpu_scan_ioapic(struct kvm_vcpu *vcpu)
+ else {
+ if (vcpu->arch.apicv_active)
+ kvm_x86_ops->sync_pir_to_irr(vcpu);
+- kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
++ if (ioapic_in_kernel(vcpu->kvm))
++ kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
+ }
+
+ if (is_guest_mode(vcpu))
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index e96b99eb800c..a6d1b0241aea 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -29,6 +29,12 @@
+ * Implement flush IPI by CALL_FUNCTION_VECTOR, Alex Shi
+ */
+
++/*
++ * Use bit 0 to mangle the TIF_SPEC_IB state into the mm pointer which is
++ * stored in cpu_tlb_state.last_user_mm_ibpb.
++ */
++#define LAST_USER_MM_IBPB 0x1UL
++
+ /*
+ * We get here when we do something requiring a TLB invalidation
+ * but could not go invalidate all of the contexts. We do the
+@@ -180,6 +186,89 @@ static void sync_current_stack_to_mm(struct mm_struct *mm)
+ }
+ }
+
++static inline unsigned long mm_mangle_tif_spec_ib(struct task_struct *next)
++{
++ unsigned long next_tif = task_thread_info(next)->flags;
++ unsigned long ibpb = (next_tif >> TIF_SPEC_IB) & LAST_USER_MM_IBPB;
++
++ return (unsigned long)next->mm | ibpb;
++}
++
++static void cond_ibpb(struct task_struct *next)
++{
++ if (!next || !next->mm)
++ return;
++
++ /*
++ * Both, the conditional and the always IBPB mode use the mm
++ * pointer to avoid the IBPB when switching between tasks of the
++ * same process. Using the mm pointer instead of mm->context.ctx_id
++ * opens a hypothetical hole vs. mm_struct reuse, which is more or
++ * less impossible to control by an attacker. Aside of that it
++ * would only affect the first schedule so the theoretically
++ * exposed data is not really interesting.
++ */
++ if (static_branch_likely(&switch_mm_cond_ibpb)) {
++ unsigned long prev_mm, next_mm;
++
++ /*
++ * This is a bit more complex than the always mode because
++ * it has to handle two cases:
++ *
++ * 1) Switch from a user space task (potential attacker)
++ * which has TIF_SPEC_IB set to a user space task
++ * (potential victim) which has TIF_SPEC_IB not set.
++ *
++ * 2) Switch from a user space task (potential attacker)
++ * which has TIF_SPEC_IB not set to a user space task
++ * (potential victim) which has TIF_SPEC_IB set.
++ *
++ * This could be done by unconditionally issuing IBPB when
++ * a task which has TIF_SPEC_IB set is either scheduled in
++ * or out. Though that results in two flushes when:
++ *
++ * - the same user space task is scheduled out and later
++ * scheduled in again and only a kernel thread ran in
++ * between.
++ *
++ * - a user space task belonging to the same process is
++ * scheduled in after a kernel thread ran in between
++ *
++ * - a user space task belonging to the same process is
++ * scheduled in immediately.
++ *
++ * Optimize this with reasonably small overhead for the
++ * above cases. Mangle the TIF_SPEC_IB bit into the mm
++ * pointer of the incoming task which is stored in
++ * cpu_tlbstate.last_user_mm_ibpb for comparison.
++ */
++ next_mm = mm_mangle_tif_spec_ib(next);
++ prev_mm = this_cpu_read(cpu_tlbstate.last_user_mm_ibpb);
++
++ /*
++ * Issue IBPB only if the mm's are different and one or
++ * both have the IBPB bit set.
++ */
++ if (next_mm != prev_mm &&
++ (next_mm | prev_mm) & LAST_USER_MM_IBPB)
++ indirect_branch_prediction_barrier();
++
++ this_cpu_write(cpu_tlbstate.last_user_mm_ibpb, next_mm);
++ }
++
++ if (static_branch_unlikely(&switch_mm_always_ibpb)) {
++ /*
++ * Only flush when switching to a user space task with a
++ * different context than the user space task which ran
++ * last on this CPU.
++ */
++ if (this_cpu_read(cpu_tlbstate.last_user_mm) != next->mm) {
++ indirect_branch_prediction_barrier();
++ this_cpu_write(cpu_tlbstate.last_user_mm, next->mm);
++ }
++ }
++}
++
+ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+ struct task_struct *tsk)
+ {
+@@ -254,27 +343,13 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+ } else {
+ u16 new_asid;
+ bool need_flush;
+- u64 last_ctx_id = this_cpu_read(cpu_tlbstate.last_ctx_id);
+
+ /*
+ * Avoid user/user BTB poisoning by flushing the branch
+ * predictor when switching between processes. This stops
+ * one process from doing Spectre-v2 attacks on another.
+- *
+- * As an optimization, flush indirect branches only when
+- * switching into processes that disable dumping. This
+- * protects high value processes like gpg, without having
+- * too high performance overhead. IBPB is *expensive*!
+- *
+- * This will not flush branches when switching into kernel
+- * threads. It will also not flush if we switch to idle
+- * thread and back to the same process. It will flush if we
+- * switch to a different non-dumpable process.
+ */
+- if (tsk && tsk->mm &&
+- tsk->mm->context.ctx_id != last_ctx_id &&
+- get_dumpable(tsk->mm) != SUID_DUMP_USER)
+- indirect_branch_prediction_barrier();
++ cond_ibpb(tsk);
+
+ if (IS_ENABLED(CONFIG_VMAP_STACK)) {
+ /*
+@@ -331,14 +406,6 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+ trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, 0);
+ }
+
+- /*
+- * Record last user mm's context id, so we can avoid
+- * flushing branch buffer with IBPB if we switch back
+- * to the same user.
+- */
+- if (next != &init_mm)
+- this_cpu_write(cpu_tlbstate.last_ctx_id, next->context.ctx_id);
+-
+ /* Make sure we write CR3 before loaded_mm. */
+ barrier();
+
+@@ -419,7 +486,7 @@ void initialize_tlbstate_and_flush(void)
+ write_cr3(build_cr3(mm->pgd, 0));
+
+ /* Reinitialize tlbstate. */
+- this_cpu_write(cpu_tlbstate.last_ctx_id, mm->context.ctx_id);
++ this_cpu_write(cpu_tlbstate.last_user_mm_ibpb, LAST_USER_MM_IBPB);
+ this_cpu_write(cpu_tlbstate.loaded_mm_asid, 0);
+ this_cpu_write(cpu_tlbstate.next_asid, 1);
+ this_cpu_write(cpu_tlbstate.ctxs[0].ctx_id, mm->context.ctx_id);
+diff --git a/arch/xtensa/kernel/asm-offsets.c b/arch/xtensa/kernel/asm-offsets.c
+index 67904f55f188..120dd746a147 100644
+--- a/arch/xtensa/kernel/asm-offsets.c
++++ b/arch/xtensa/kernel/asm-offsets.c
+@@ -94,14 +94,14 @@ int main(void)
+ DEFINE(THREAD_SP, offsetof (struct task_struct, thread.sp));
+ DEFINE(THREAD_CPENABLE, offsetof (struct thread_info, cpenable));
+ #if XTENSA_HAVE_COPROCESSORS
+- DEFINE(THREAD_XTREGS_CP0, offsetof (struct thread_info, xtregs_cp));
+- DEFINE(THREAD_XTREGS_CP1, offsetof (struct thread_info, xtregs_cp));
+- DEFINE(THREAD_XTREGS_CP2, offsetof (struct thread_info, xtregs_cp));
+- DEFINE(THREAD_XTREGS_CP3, offsetof (struct thread_info, xtregs_cp));
+- DEFINE(THREAD_XTREGS_CP4, offsetof (struct thread_info, xtregs_cp));
+- DEFINE(THREAD_XTREGS_CP5, offsetof (struct thread_info, xtregs_cp));
+- DEFINE(THREAD_XTREGS_CP6, offsetof (struct thread_info, xtregs_cp));
+- DEFINE(THREAD_XTREGS_CP7, offsetof (struct thread_info, xtregs_cp));
++ DEFINE(THREAD_XTREGS_CP0, offsetof(struct thread_info, xtregs_cp.cp0));
++ DEFINE(THREAD_XTREGS_CP1, offsetof(struct thread_info, xtregs_cp.cp1));
++ DEFINE(THREAD_XTREGS_CP2, offsetof(struct thread_info, xtregs_cp.cp2));
++ DEFINE(THREAD_XTREGS_CP3, offsetof(struct thread_info, xtregs_cp.cp3));
++ DEFINE(THREAD_XTREGS_CP4, offsetof(struct thread_info, xtregs_cp.cp4));
++ DEFINE(THREAD_XTREGS_CP5, offsetof(struct thread_info, xtregs_cp.cp5));
++ DEFINE(THREAD_XTREGS_CP6, offsetof(struct thread_info, xtregs_cp.cp6));
++ DEFINE(THREAD_XTREGS_CP7, offsetof(struct thread_info, xtregs_cp.cp7));
+ #endif
+ DEFINE(THREAD_XTREGS_USER, offsetof (struct thread_info, xtregs_user));
+ DEFINE(XTREGS_USER_SIZE, sizeof(xtregs_user_t));
+diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
+index 483dcfb6e681..4bb68133a72a 100644
+--- a/arch/xtensa/kernel/process.c
++++ b/arch/xtensa/kernel/process.c
+@@ -94,18 +94,21 @@ void coprocessor_release_all(struct thread_info *ti)
+
+ void coprocessor_flush_all(struct thread_info *ti)
+ {
+- unsigned long cpenable;
++ unsigned long cpenable, old_cpenable;
+ int i;
+
+ preempt_disable();
+
++ RSR_CPENABLE(old_cpenable);
+ cpenable = ti->cpenable;
++ WSR_CPENABLE(cpenable);
+
+ for (i = 0; i < XCHAL_CP_MAX; i++) {
+ if ((cpenable & 1) != 0 && coprocessor_owner[i] == ti)
+ coprocessor_flush(ti, i);
+ cpenable >>= 1;
+ }
++ WSR_CPENABLE(old_cpenable);
+
+ preempt_enable();
+ }
+diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
+index c0845cb1cbb9..d9541be0605a 100644
+--- a/arch/xtensa/kernel/ptrace.c
++++ b/arch/xtensa/kernel/ptrace.c
+@@ -127,12 +127,37 @@ static int ptrace_setregs(struct task_struct *child, void __user *uregs)
+ }
+
+
++#if XTENSA_HAVE_COPROCESSORS
++#define CP_OFFSETS(cp) \
++ { \
++ .elf_xtregs_offset = offsetof(elf_xtregs_t, cp), \
++ .ti_offset = offsetof(struct thread_info, xtregs_cp.cp), \
++ .sz = sizeof(xtregs_ ## cp ## _t), \
++ }
++
++static const struct {
++ size_t elf_xtregs_offset;
++ size_t ti_offset;
++ size_t sz;
++} cp_offsets[] = {
++ CP_OFFSETS(cp0),
++ CP_OFFSETS(cp1),
++ CP_OFFSETS(cp2),
++ CP_OFFSETS(cp3),
++ CP_OFFSETS(cp4),
++ CP_OFFSETS(cp5),
++ CP_OFFSETS(cp6),
++ CP_OFFSETS(cp7),
++};
++#endif
++
+ static int ptrace_getxregs(struct task_struct *child, void __user *uregs)
+ {
+ struct pt_regs *regs = task_pt_regs(child);
+ struct thread_info *ti = task_thread_info(child);
+ elf_xtregs_t __user *xtregs = uregs;
+ int ret = 0;
++ int i __maybe_unused;
+
+ if (!access_ok(VERIFY_WRITE, uregs, sizeof(elf_xtregs_t)))
+ return -EIO;
+@@ -140,8 +165,13 @@ static int ptrace_getxregs(struct task_struct *child, void __user *uregs)
+ #if XTENSA_HAVE_COPROCESSORS
+ /* Flush all coprocessor registers to memory. */
+ coprocessor_flush_all(ti);
+- ret |= __copy_to_user(&xtregs->cp0, &ti->xtregs_cp,
+- sizeof(xtregs_coprocessor_t));
++
++ for (i = 0; i < ARRAY_SIZE(cp_offsets); ++i)
++ ret |= __copy_to_user((char __user *)xtregs +
++ cp_offsets[i].elf_xtregs_offset,
++ (const char *)ti +
++ cp_offsets[i].ti_offset,
++ cp_offsets[i].sz);
+ #endif
+ ret |= __copy_to_user(&xtregs->opt, ®s->xtregs_opt,
+ sizeof(xtregs->opt));
+@@ -157,6 +187,7 @@ static int ptrace_setxregs(struct task_struct *child, void __user *uregs)
+ struct pt_regs *regs = task_pt_regs(child);
+ elf_xtregs_t *xtregs = uregs;
+ int ret = 0;
++ int i __maybe_unused;
+
+ if (!access_ok(VERIFY_READ, uregs, sizeof(elf_xtregs_t)))
+ return -EFAULT;
+@@ -166,8 +197,11 @@ static int ptrace_setxregs(struct task_struct *child, void __user *uregs)
+ coprocessor_flush_all(ti);
+ coprocessor_release_all(ti);
+
+- ret |= __copy_from_user(&ti->xtregs_cp, &xtregs->cp0,
+- sizeof(xtregs_coprocessor_t));
++ for (i = 0; i < ARRAY_SIZE(cp_offsets); ++i)
++ ret |= __copy_from_user((char *)ti + cp_offsets[i].ti_offset,
++ (const char __user *)xtregs +
++ cp_offsets[i].elf_xtregs_offset,
++ cp_offsets[i].sz);
+ #endif
+ ret |= __copy_from_user(®s->xtregs_opt, &xtregs->opt,
+ sizeof(xtregs->opt));
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index d58763b6b009..ce0e4d317d24 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -2971,7 +2971,6 @@ static void binder_transaction(struct binder_proc *proc,
+ t->buffer = NULL;
+ goto err_binder_alloc_buf_failed;
+ }
+- t->buffer->allow_user_free = 0;
+ t->buffer->debug_id = t->debug_id;
+ t->buffer->transaction = t;
+ t->buffer->target_node = target_node;
+@@ -3465,14 +3464,18 @@ static int binder_thread_write(struct binder_proc *proc,
+
+ buffer = binder_alloc_prepare_to_free(&proc->alloc,
+ data_ptr);
+- if (buffer == NULL) {
+- binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n",
+- proc->pid, thread->pid, (u64)data_ptr);
+- break;
+- }
+- if (!buffer->allow_user_free) {
+- binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n",
+- proc->pid, thread->pid, (u64)data_ptr);
++ if (IS_ERR_OR_NULL(buffer)) {
++ if (PTR_ERR(buffer) == -EPERM) {
++ binder_user_error(
++ "%d:%d BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n",
++ proc->pid, thread->pid,
++ (u64)data_ptr);
++ } else {
++ binder_user_error(
++ "%d:%d BC_FREE_BUFFER u%016llx no match\n",
++ proc->pid, thread->pid,
++ (u64)data_ptr);
++ }
+ break;
+ }
+ binder_debug(BINDER_DEBUG_FREE_BUFFER,
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 64fd96eada31..030c98f35cca 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -151,16 +151,12 @@ static struct binder_buffer *binder_alloc_prepare_to_free_locked(
+ else {
+ /*
+ * Guard against user threads attempting to
+- * free the buffer twice
++ * free the buffer when in use by kernel or
++ * after it's already been freed.
+ */
+- if (buffer->free_in_progress) {
+- binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
+- "%d:%d FREE_BUFFER u%016llx user freed buffer twice\n",
+- alloc->pid, current->pid,
+- (u64)user_ptr);
+- return NULL;
+- }
+- buffer->free_in_progress = 1;
++ if (!buffer->allow_user_free)
++ return ERR_PTR(-EPERM);
++ buffer->allow_user_free = 0;
+ return buffer;
+ }
+ }
+@@ -500,7 +496,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
+
+ rb_erase(best_fit, &alloc->free_buffers);
+ buffer->free = 0;
+- buffer->free_in_progress = 0;
++ buffer->allow_user_free = 0;
+ binder_insert_allocated_buffer_locked(alloc, buffer);
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+ "%d: binder_alloc_buf size %zd got %pK\n",
+diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
+index 9ef64e563856..fb3238c74c8a 100644
+--- a/drivers/android/binder_alloc.h
++++ b/drivers/android/binder_alloc.h
+@@ -50,8 +50,7 @@ struct binder_buffer {
+ unsigned free:1;
+ unsigned allow_user_free:1;
+ unsigned async_transaction:1;
+- unsigned free_in_progress:1;
+- unsigned debug_id:28;
++ unsigned debug_id:29;
+
+ struct binder_transaction *transaction;
+
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index 75f38d19fcbe..dbc51154f122 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1641,6 +1641,12 @@ static void atc_free_chan_resources(struct dma_chan *chan)
+ atchan->descs_allocated = 0;
+ atchan->status = 0;
+
++ /*
++ * Free atslave allocated in at_dma_xlate()
++ */
++ kfree(chan->private);
++ chan->private = NULL;
++
+ dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
+ }
+
+@@ -1675,7 +1681,7 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,
+ dma_cap_zero(mask);
+ dma_cap_set(DMA_SLAVE, mask);
+
+- atslave = devm_kzalloc(&dmac_pdev->dev, sizeof(*atslave), GFP_KERNEL);
++ atslave = kzalloc(sizeof(*atslave), GFP_KERNEL);
+ if (!atslave)
+ return NULL;
+
+@@ -2000,6 +2006,8 @@ static int at_dma_remove(struct platform_device *pdev)
+ struct resource *io;
+
+ at_dma_off(atdma);
++ if (pdev->dev.of_node)
++ of_dma_controller_free(pdev->dev.of_node);
+ dma_async_device_unregister(&atdma->dma_common);
+
+ dma_pool_destroy(atdma->memset_pool);
+diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
+index e8a114157f87..bb012bc032e0 100644
+--- a/drivers/hid/hid-sensor-custom.c
++++ b/drivers/hid/hid-sensor-custom.c
+@@ -358,7 +358,7 @@ static ssize_t show_value(struct device *dev, struct device_attribute *attr,
+ sensor_inst->hsdev,
+ sensor_inst->hsdev->usage,
+ usage, report_id,
+- SENSOR_HUB_SYNC);
++ SENSOR_HUB_SYNC, false);
+ } else if (!strncmp(name, "units", strlen("units")))
+ value = sensor_inst->fields[field_index].attribute.units;
+ else if (!strncmp(name, "unit-expo", strlen("unit-expo")))
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index 2b63487057c2..4256fdc5cd6d 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -299,7 +299,8 @@ EXPORT_SYMBOL_GPL(sensor_hub_get_feature);
+ int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
+ u32 usage_id,
+ u32 attr_usage_id, u32 report_id,
+- enum sensor_hub_read_flags flag)
++ enum sensor_hub_read_flags flag,
++ bool is_signed)
+ {
+ struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
+ unsigned long flags;
+@@ -331,10 +332,16 @@ int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
+ &hsdev->pending.ready, HZ*5);
+ switch (hsdev->pending.raw_size) {
+ case 1:
+- ret_val = *(u8 *)hsdev->pending.raw_data;
++ if (is_signed)
++ ret_val = *(s8 *)hsdev->pending.raw_data;
++ else
++ ret_val = *(u8 *)hsdev->pending.raw_data;
+ break;
+ case 2:
+- ret_val = *(u16 *)hsdev->pending.raw_data;
++ if (is_signed)
++ ret_val = *(s16 *)hsdev->pending.raw_data;
++ else
++ ret_val = *(u16 *)hsdev->pending.raw_data;
+ break;
+ case 4:
+ ret_val = *(u32 *)hsdev->pending.raw_data;
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 741857d80da1..2f164bd74687 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -482,6 +482,14 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
+ }
+ wait_for_completion(&msginfo->waitevent);
+
++ if (msginfo->response.gpadl_created.creation_status != 0) {
++ pr_err("Failed to establish GPADL: err = 0x%x\n",
++ msginfo->response.gpadl_created.creation_status);
++
++ ret = -EDQUOT;
++ goto cleanup;
++ }
++
+ if (channel->rescind) {
+ ret = -ENODEV;
+ goto cleanup;
+diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
+index 41d97faf5013..38ff374a3ca4 100644
+--- a/drivers/iio/accel/hid-sensor-accel-3d.c
++++ b/drivers/iio/accel/hid-sensor-accel-3d.c
+@@ -149,6 +149,7 @@ static int accel_3d_read_raw(struct iio_dev *indio_dev,
+ int report_id = -1;
+ u32 address;
+ int ret_type;
++ s32 min;
+ struct hid_sensor_hub_device *hsdev =
+ accel_state->common_attributes.hsdev;
+
+@@ -158,12 +159,14 @@ static int accel_3d_read_raw(struct iio_dev *indio_dev,
+ case IIO_CHAN_INFO_RAW:
+ hid_sensor_power_state(&accel_state->common_attributes, true);
+ report_id = accel_state->accel[chan->scan_index].report_id;
++ min = accel_state->accel[chan->scan_index].logical_minimum;
+ address = accel_3d_addresses[chan->scan_index];
+ if (report_id >= 0)
+ *val = sensor_hub_input_attr_get_raw_value(
+ accel_state->common_attributes.hsdev,
+ hsdev->usage, address, report_id,
+- SENSOR_HUB_SYNC);
++ SENSOR_HUB_SYNC,
++ min < 0);
+ else {
+ *val = 0;
+ hid_sensor_power_state(&accel_state->common_attributes,
+diff --git a/drivers/iio/gyro/hid-sensor-gyro-3d.c b/drivers/iio/gyro/hid-sensor-gyro-3d.c
+index 36941e69f959..88e857c4baf4 100644
+--- a/drivers/iio/gyro/hid-sensor-gyro-3d.c
++++ b/drivers/iio/gyro/hid-sensor-gyro-3d.c
+@@ -111,6 +111,7 @@ static int gyro_3d_read_raw(struct iio_dev *indio_dev,
+ int report_id = -1;
+ u32 address;
+ int ret_type;
++ s32 min;
+
+ *val = 0;
+ *val2 = 0;
+@@ -118,13 +119,15 @@ static int gyro_3d_read_raw(struct iio_dev *indio_dev,
+ case IIO_CHAN_INFO_RAW:
+ hid_sensor_power_state(&gyro_state->common_attributes, true);
+ report_id = gyro_state->gyro[chan->scan_index].report_id;
++ min = gyro_state->gyro[chan->scan_index].logical_minimum;
+ address = gyro_3d_addresses[chan->scan_index];
+ if (report_id >= 0)
+ *val = sensor_hub_input_attr_get_raw_value(
+ gyro_state->common_attributes.hsdev,
+ HID_USAGE_SENSOR_GYRO_3D, address,
+ report_id,
+- SENSOR_HUB_SYNC);
++ SENSOR_HUB_SYNC,
++ min < 0);
+ else {
+ *val = 0;
+ hid_sensor_power_state(&gyro_state->common_attributes,
+diff --git a/drivers/iio/humidity/hid-sensor-humidity.c b/drivers/iio/humidity/hid-sensor-humidity.c
+index beab6d6fd6e1..4bc95f31c730 100644
+--- a/drivers/iio/humidity/hid-sensor-humidity.c
++++ b/drivers/iio/humidity/hid-sensor-humidity.c
+@@ -75,7 +75,8 @@ static int humidity_read_raw(struct iio_dev *indio_dev,
+ HID_USAGE_SENSOR_HUMIDITY,
+ HID_USAGE_SENSOR_ATMOSPHERIC_HUMIDITY,
+ humid_st->humidity_attr.report_id,
+- SENSOR_HUB_SYNC);
++ SENSOR_HUB_SYNC,
++ humid_st->humidity_attr.logical_minimum < 0);
+ hid_sensor_power_state(&humid_st->common_attributes, false);
+
+ return IIO_VAL_INT;
+diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
+index 406caaee9a3c..94f33250ba5a 100644
+--- a/drivers/iio/light/hid-sensor-als.c
++++ b/drivers/iio/light/hid-sensor-als.c
+@@ -93,6 +93,7 @@ static int als_read_raw(struct iio_dev *indio_dev,
+ int report_id = -1;
+ u32 address;
+ int ret_type;
++ s32 min;
+
+ *val = 0;
+ *val2 = 0;
+@@ -102,8 +103,8 @@ static int als_read_raw(struct iio_dev *indio_dev,
+ case CHANNEL_SCAN_INDEX_INTENSITY:
+ case CHANNEL_SCAN_INDEX_ILLUM:
+ report_id = als_state->als_illum.report_id;
+- address =
+- HID_USAGE_SENSOR_LIGHT_ILLUM;
++ min = als_state->als_illum.logical_minimum;
++ address = HID_USAGE_SENSOR_LIGHT_ILLUM;
+ break;
+ default:
+ report_id = -1;
+@@ -116,7 +117,8 @@ static int als_read_raw(struct iio_dev *indio_dev,
+ als_state->common_attributes.hsdev,
+ HID_USAGE_SENSOR_ALS, address,
+ report_id,
+- SENSOR_HUB_SYNC);
++ SENSOR_HUB_SYNC,
++ min < 0);
+ hid_sensor_power_state(&als_state->common_attributes,
+ false);
+ } else {
+diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c
+index 45107f7537b5..cf5a0c242609 100644
+--- a/drivers/iio/light/hid-sensor-prox.c
++++ b/drivers/iio/light/hid-sensor-prox.c
+@@ -73,6 +73,7 @@ static int prox_read_raw(struct iio_dev *indio_dev,
+ int report_id = -1;
+ u32 address;
+ int ret_type;
++ s32 min;
+
+ *val = 0;
+ *val2 = 0;
+@@ -81,8 +82,8 @@ static int prox_read_raw(struct iio_dev *indio_dev,
+ switch (chan->scan_index) {
+ case CHANNEL_SCAN_INDEX_PRESENCE:
+ report_id = prox_state->prox_attr.report_id;
+- address =
+- HID_USAGE_SENSOR_HUMAN_PRESENCE;
++ min = prox_state->prox_attr.logical_minimum;
++ address = HID_USAGE_SENSOR_HUMAN_PRESENCE;
+ break;
+ default:
+ report_id = -1;
+@@ -95,7 +96,8 @@ static int prox_read_raw(struct iio_dev *indio_dev,
+ prox_state->common_attributes.hsdev,
+ HID_USAGE_SENSOR_PROX, address,
+ report_id,
+- SENSOR_HUB_SYNC);
++ SENSOR_HUB_SYNC,
++ min < 0);
+ hid_sensor_power_state(&prox_state->common_attributes,
+ false);
+ } else {
+diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+index d55c4885211a..f3c0d41e5a8c 100644
+--- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
++++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
+@@ -163,21 +163,23 @@ static int magn_3d_read_raw(struct iio_dev *indio_dev,
+ int report_id = -1;
+ u32 address;
+ int ret_type;
++ s32 min;
+
+ *val = 0;
+ *val2 = 0;
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+ hid_sensor_power_state(&magn_state->magn_flux_attributes, true);
+- report_id =
+- magn_state->magn[chan->address].report_id;
++ report_id = magn_state->magn[chan->address].report_id;
++ min = magn_state->magn[chan->address].logical_minimum;
+ address = magn_3d_addresses[chan->address];
+ if (report_id >= 0)
+ *val = sensor_hub_input_attr_get_raw_value(
+ magn_state->magn_flux_attributes.hsdev,
+ HID_USAGE_SENSOR_COMPASS_3D, address,
+ report_id,
+- SENSOR_HUB_SYNC);
++ SENSOR_HUB_SYNC,
++ min < 0);
+ else {
+ *val = 0;
+ hid_sensor_power_state(
+diff --git a/drivers/iio/magnetometer/st_magn_buffer.c b/drivers/iio/magnetometer/st_magn_buffer.c
+index 0a9e8fadfa9d..37ab30566464 100644
+--- a/drivers/iio/magnetometer/st_magn_buffer.c
++++ b/drivers/iio/magnetometer/st_magn_buffer.c
+@@ -30,11 +30,6 @@ int st_magn_trig_set_state(struct iio_trigger *trig, bool state)
+ return st_sensors_set_dataready_irq(indio_dev, state);
+ }
+
+-static int st_magn_buffer_preenable(struct iio_dev *indio_dev)
+-{
+- return st_sensors_set_enable(indio_dev, true);
+-}
+-
+ static int st_magn_buffer_postenable(struct iio_dev *indio_dev)
+ {
+ int err;
+@@ -50,7 +45,7 @@ static int st_magn_buffer_postenable(struct iio_dev *indio_dev)
+ if (err < 0)
+ goto st_magn_buffer_postenable_error;
+
+- return err;
++ return st_sensors_set_enable(indio_dev, true);
+
+ st_magn_buffer_postenable_error:
+ kfree(mdata->buffer_data);
+@@ -63,11 +58,11 @@ static int st_magn_buffer_predisable(struct iio_dev *indio_dev)
+ int err;
+ struct st_sensor_data *mdata = iio_priv(indio_dev);
+
+- err = iio_triggered_buffer_predisable(indio_dev);
++ err = st_sensors_set_enable(indio_dev, false);
+ if (err < 0)
+ goto st_magn_buffer_predisable_error;
+
+- err = st_sensors_set_enable(indio_dev, false);
++ err = iio_triggered_buffer_predisable(indio_dev);
+
+ st_magn_buffer_predisable_error:
+ kfree(mdata->buffer_data);
+@@ -75,7 +70,6 @@ st_magn_buffer_predisable_error:
+ }
+
+ static const struct iio_buffer_setup_ops st_magn_buffer_setup_ops = {
+- .preenable = &st_magn_buffer_preenable,
+ .postenable = &st_magn_buffer_postenable,
+ .predisable = &st_magn_buffer_predisable,
+ };
+diff --git a/drivers/iio/orientation/hid-sensor-incl-3d.c b/drivers/iio/orientation/hid-sensor-incl-3d.c
+index 1e5451d1ff88..bdc5e4554ee4 100644
+--- a/drivers/iio/orientation/hid-sensor-incl-3d.c
++++ b/drivers/iio/orientation/hid-sensor-incl-3d.c
+@@ -111,21 +111,23 @@ static int incl_3d_read_raw(struct iio_dev *indio_dev,
+ int report_id = -1;
+ u32 address;
+ int ret_type;
++ s32 min;
+
+ *val = 0;
+ *val2 = 0;
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+ hid_sensor_power_state(&incl_state->common_attributes, true);
+- report_id =
+- incl_state->incl[chan->scan_index].report_id;
++ report_id = incl_state->incl[chan->scan_index].report_id;
++ min = incl_state->incl[chan->scan_index].logical_minimum;
+ address = incl_3d_addresses[chan->scan_index];
+ if (report_id >= 0)
+ *val = sensor_hub_input_attr_get_raw_value(
+ incl_state->common_attributes.hsdev,
+ HID_USAGE_SENSOR_INCLINOMETER_3D, address,
+ report_id,
+- SENSOR_HUB_SYNC);
++ SENSOR_HUB_SYNC,
++ min < 0);
+ else {
+ hid_sensor_power_state(&incl_state->common_attributes,
+ false);
+diff --git a/drivers/iio/pressure/hid-sensor-press.c b/drivers/iio/pressure/hid-sensor-press.c
+index 4c437918f1d2..d7b1c00ceb4d 100644
+--- a/drivers/iio/pressure/hid-sensor-press.c
++++ b/drivers/iio/pressure/hid-sensor-press.c
+@@ -77,6 +77,7 @@ static int press_read_raw(struct iio_dev *indio_dev,
+ int report_id = -1;
+ u32 address;
+ int ret_type;
++ s32 min;
+
+ *val = 0;
+ *val2 = 0;
+@@ -85,8 +86,8 @@ static int press_read_raw(struct iio_dev *indio_dev,
+ switch (chan->scan_index) {
+ case CHANNEL_SCAN_INDEX_PRESSURE:
+ report_id = press_state->press_attr.report_id;
+- address =
+- HID_USAGE_SENSOR_ATMOSPHERIC_PRESSURE;
++ min = press_state->press_attr.logical_minimum;
++ address = HID_USAGE_SENSOR_ATMOSPHERIC_PRESSURE;
+ break;
+ default:
+ report_id = -1;
+@@ -99,7 +100,8 @@ static int press_read_raw(struct iio_dev *indio_dev,
+ press_state->common_attributes.hsdev,
+ HID_USAGE_SENSOR_PRESSURE, address,
+ report_id,
+- SENSOR_HUB_SYNC);
++ SENSOR_HUB_SYNC,
++ min < 0);
+ hid_sensor_power_state(&press_state->common_attributes,
+ false);
+ } else {
+diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
+index beaf6fd3e337..b592fc4f007e 100644
+--- a/drivers/iio/temperature/hid-sensor-temperature.c
++++ b/drivers/iio/temperature/hid-sensor-temperature.c
+@@ -76,7 +76,8 @@ static int temperature_read_raw(struct iio_dev *indio_dev,
+ HID_USAGE_SENSOR_TEMPERATURE,
+ HID_USAGE_SENSOR_DATA_ENVIRONMENTAL_TEMPERATURE,
+ temp_st->temperature_attr.report_id,
+- SENSOR_HUB_SYNC);
++ SENSOR_HUB_SYNC,
++ temp_st->temperature_attr.logical_minimum < 0);
+ hid_sensor_power_state(
+ &temp_st->common_attributes,
+ false);
+diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c
+index c824329f7012..0e4193cb08cf 100644
+--- a/drivers/misc/mic/scif/scif_rma.c
++++ b/drivers/misc/mic/scif/scif_rma.c
+@@ -416,7 +416,7 @@ static int scif_create_remote_lookup(struct scif_dev *remote_dev,
+ if (err)
+ goto error_window;
+ err = scif_map_page(&window->num_pages_lookup.lookup[j],
+- vmalloc_dma_phys ?
++ vmalloc_num_pages ?
+ vmalloc_to_page(&window->num_pages[i]) :
+ virt_to_page(&window->num_pages[i]),
+ remote_dev);
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+index 768f584f8392..88f8a8fa93cd 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -1784,6 +1784,7 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
+ bool if_up = netif_running(nic->netdev);
+ struct bpf_prog *old_prog;
+ bool bpf_attached = false;
++ int ret = 0;
+
+ /* For now just support only the usual MTU sized frames */
+ if (prog && (dev->mtu > 1500)) {
+@@ -1817,8 +1818,12 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
+ if (nic->xdp_prog) {
+ /* Attach BPF program */
+ nic->xdp_prog = bpf_prog_add(nic->xdp_prog, nic->rx_queues - 1);
+- if (!IS_ERR(nic->xdp_prog))
++ if (!IS_ERR(nic->xdp_prog)) {
+ bpf_attached = true;
++ } else {
++ ret = PTR_ERR(nic->xdp_prog);
++ nic->xdp_prog = NULL;
++ }
+ }
+
+ /* Calculate Tx queues needed for XDP and network stack */
+@@ -1830,7 +1835,7 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
+ netif_trans_update(nic->netdev);
+ }
+
+- return 0;
++ return ret;
+ }
+
+ static int nicvf_xdp(struct net_device *netdev, struct netdev_bpf *xdp)
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+index 187a249ff2d1..fcaf18fa3904 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+@@ -585,10 +585,12 @@ static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
+ if (!sq->dmem.base)
+ return;
+
+- if (sq->tso_hdrs)
++ if (sq->tso_hdrs) {
+ dma_free_coherent(&nic->pdev->dev,
+ sq->dmem.q_len * TSO_HEADER_SIZE,
+ sq->tso_hdrs, sq->tso_hdrs_phys);
++ sq->tso_hdrs = NULL;
++ }
+
+ /* Free pending skbs in the queue */
+ smp_rmb();
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index 1c9ad3630c77..dfd1ad0b1cb9 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -661,7 +661,7 @@ static void gmac_clean_txq(struct net_device *netdev, struct gmac_txq *txq,
+
+ u64_stats_update_begin(&port->tx_stats_syncp);
+ port->tx_frag_stats[nfrags]++;
+- u64_stats_update_end(&port->ir_stats_syncp);
++ u64_stats_update_end(&port->tx_stats_syncp);
+ }
+ }
+
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index 001b5f714c1b..aaedf1072460 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -1675,7 +1675,7 @@ static int lan743x_tx_napi_poll(struct napi_struct *napi, int weight)
+ netif_wake_queue(adapter->netdev);
+ }
+
+- if (!napi_complete_done(napi, weight))
++ if (!napi_complete(napi))
+ goto done;
+
+ /* enable isr */
+@@ -1684,7 +1684,7 @@ static int lan743x_tx_napi_poll(struct napi_struct *napi, int weight)
+ lan743x_csr_read(adapter, INT_STS);
+
+ done:
+- return weight;
++ return 0;
+ }
+
+ static void lan743x_tx_ring_cleanup(struct lan743x_tx *tx)
+@@ -1873,9 +1873,9 @@ static int lan743x_tx_open(struct lan743x_tx *tx)
+ tx->vector_flags = lan743x_intr_get_vector_flags(adapter,
+ INT_BIT_DMA_TX_
+ (tx->channel_number));
+- netif_napi_add(adapter->netdev,
+- &tx->napi, lan743x_tx_napi_poll,
+- tx->ring_size - 1);
++ netif_tx_napi_add(adapter->netdev,
++ &tx->napi, lan743x_tx_napi_poll,
++ tx->ring_size - 1);
+ napi_enable(&tx->napi);
+
+ data = 0;
+@@ -3020,6 +3020,7 @@ static const struct dev_pm_ops lan743x_pm_ops = {
+
+ static const struct pci_device_id lan743x_pcidev_tbl[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_SMSC, PCI_DEVICE_ID_SMSC_LAN7430) },
++ { PCI_DEVICE(PCI_VENDOR_ID_SMSC, PCI_DEVICE_ID_SMSC_LAN7431) },
+ { 0, }
+ };
+
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.h b/drivers/net/ethernet/microchip/lan743x_main.h
+index 0e82b6368798..2d6eea18973e 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.h
++++ b/drivers/net/ethernet/microchip/lan743x_main.h
+@@ -548,6 +548,7 @@ struct lan743x_adapter;
+ /* SMSC acquired EFAR late 1990's, MCHP acquired SMSC 2012 */
+ #define PCI_VENDOR_ID_SMSC PCI_VENDOR_ID_EFAR
+ #define PCI_DEVICE_ID_SMSC_LAN7430 (0x7430)
++#define PCI_DEVICE_ID_SMSC_LAN7431 (0x7431)
+
+ #define PCI_CONFIG_LENGTH (0x1000)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 19ab8a7d1e48..733e35b7c4bb 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1930,6 +1930,14 @@ int phy_driver_register(struct phy_driver *new_driver, struct module *owner)
+ new_driver->mdiodrv.driver.remove = phy_remove;
+ new_driver->mdiodrv.driver.owner = owner;
+
++ /* The following works around an issue where the PHY driver doesn't bind
++ * to the device, resulting in the genphy driver being used instead of
++ * the dedicated driver. The root cause of the issue isn't known yet
++ * and seems to be in the base driver core. Once this is fixed we may
++ * remove this workaround.
++ */
++ new_driver->mdiodrv.driver.probe_type = PROBE_FORCE_SYNCHRONOUS;
++
+ retval = driver_register(&new_driver->mdiodrv.driver);
+ if (retval) {
+ pr_err("%s: Error %d in registering driver\n",
+diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
+index e9f101c9bae2..bfbb39f93554 100644
+--- a/drivers/net/rionet.c
++++ b/drivers/net/rionet.c
+@@ -216,9 +216,9 @@ static int rionet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ * it just report sending a packet to the target
+ * (without actual packet transfer).
+ */
+- dev_kfree_skb_any(skb);
+ ndev->stats.tx_packets++;
+ ndev->stats.tx_bytes += skb->len;
++ dev_kfree_skb_any(skb);
+ }
+ }
+
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index 7275761a1177..3d8a70d3ea9b 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -140,7 +140,6 @@ struct ipheth_device {
+ struct usb_device *udev;
+ struct usb_interface *intf;
+ struct net_device *net;
+- struct sk_buff *tx_skb;
+ struct urb *tx_urb;
+ struct urb *rx_urb;
+ unsigned char *tx_buf;
+@@ -230,6 +229,7 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
+ case -ENOENT:
+ case -ECONNRESET:
+ case -ESHUTDOWN:
++ case -EPROTO:
+ return;
+ case 0:
+ break;
+@@ -281,7 +281,6 @@ static void ipheth_sndbulk_callback(struct urb *urb)
+ dev_err(&dev->intf->dev, "%s: urb status: %d\n",
+ __func__, status);
+
+- dev_kfree_skb_irq(dev->tx_skb);
+ if (status == 0)
+ netif_wake_queue(dev->net);
+ else
+@@ -423,7 +422,7 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+ if (skb->len > IPHETH_BUF_SIZE) {
+ WARN(1, "%s: skb too large: %d bytes\n", __func__, skb->len);
+ dev->net->stats.tx_dropped++;
+- dev_kfree_skb_irq(skb);
++ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+ }
+
+@@ -443,12 +442,11 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+ dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n",
+ __func__, retval);
+ dev->net->stats.tx_errors++;
+- dev_kfree_skb_irq(skb);
++ dev_kfree_skb_any(skb);
+ } else {
+- dev->tx_skb = skb;
+-
+ dev->net->stats.tx_packets++;
+ dev->net->stats.tx_bytes += skb->len;
++ dev_consume_skb_any(skb);
+ netif_stop_queue(net);
+ }
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index ddfa3f24204c..c2ca6cd3fbe0 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -70,7 +70,8 @@ static const unsigned long guest_offloads[] = {
+ VIRTIO_NET_F_GUEST_TSO4,
+ VIRTIO_NET_F_GUEST_TSO6,
+ VIRTIO_NET_F_GUEST_ECN,
+- VIRTIO_NET_F_GUEST_UFO
++ VIRTIO_NET_F_GUEST_UFO,
++ VIRTIO_NET_F_GUEST_CSUM
+ };
+
+ struct virtnet_stat_desc {
+@@ -2285,9 +2286,6 @@ static int virtnet_clear_guest_offloads(struct virtnet_info *vi)
+ if (!vi->guest_offloads)
+ return 0;
+
+- if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))
+- offloads = 1ULL << VIRTIO_NET_F_GUEST_CSUM;
+-
+ return virtnet_set_guest_offloads(vi, offloads);
+ }
+
+@@ -2297,8 +2295,6 @@ static int virtnet_restore_guest_offloads(struct virtnet_info *vi)
+
+ if (!vi->guest_offloads)
+ return 0;
+- if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))
+- offloads |= 1ULL << VIRTIO_NET_F_GUEST_CSUM;
+
+ return virtnet_set_guest_offloads(vi, offloads);
+ }
+@@ -2316,8 +2312,9 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
+ && (virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO4) ||
+ virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_TSO6) ||
+ virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) ||
+- virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO))) {
+- NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO, disable LRO first");
++ virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO) ||
++ virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))) {
++ NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO/CSUM, disable LRO/CSUM first");
+ return -EOPNOTSUPP;
+ }
+
+diff --git a/drivers/pci/controller/dwc/pci-layerscape.c b/drivers/pci/controller/dwc/pci-layerscape.c
+index 3724d3ef7008..7aa9a82b7ebd 100644
+--- a/drivers/pci/controller/dwc/pci-layerscape.c
++++ b/drivers/pci/controller/dwc/pci-layerscape.c
+@@ -88,7 +88,7 @@ static void ls_pcie_disable_outbound_atus(struct ls_pcie *pcie)
+ int i;
+
+ for (i = 0; i < PCIE_IATU_NUM; i++)
+- dw_pcie_disable_atu(pcie->pci, DW_PCIE_REGION_OUTBOUND, i);
++ dw_pcie_disable_atu(pcie->pci, i, DW_PCIE_REGION_OUTBOUND);
+ }
+
+ static int ls1021_pcie_link_up(struct dw_pcie *pci)
+diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
+index 1e7b02221eac..de8635af4cde 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
++++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
+@@ -440,7 +440,6 @@ int dw_pcie_ep_raise_msix_irq(struct dw_pcie_ep *ep, u8 func_no,
+ tbl_offset = dw_pcie_readl_dbi(pci, reg);
+ bir = (tbl_offset & PCI_MSIX_TABLE_BIR);
+ tbl_offset &= PCI_MSIX_TABLE_OFFSET;
+- tbl_offset >>= 3;
+
+ reg = PCI_BASE_ADDRESS_0 + (4 * bir);
+ bar_addr_upper = 0;
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 51b6c81671c1..afc4680c584f 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5473,9 +5473,13 @@ enum pci_bus_speed pcie_get_speed_cap(struct pci_dev *dev)
+ u32 lnkcap2, lnkcap;
+
+ /*
+- * PCIe r4.0 sec 7.5.3.18 recommends using the Supported Link
+- * Speeds Vector in Link Capabilities 2 when supported, falling
+- * back to Max Link Speed in Link Capabilities otherwise.
++ * Link Capabilities 2 was added in PCIe r3.0, sec 7.8.18. The
++ * implementation note there recommends using the Supported Link
++ * Speeds Vector in Link Capabilities 2 when supported.
++ *
++ * Without Link Capabilities 2, i.e., prior to PCIe r3.0, software
++ * should use the Supported Link Speeds field in Link Capabilities,
++ * where only 2.5 GT/s and 5.0 GT/s speeds were defined.
+ */
+ pcie_capability_read_dword(dev, PCI_EXP_LNKCAP2, &lnkcap2);
+ if (lnkcap2) { /* PCIe r3.0-compliant */
+@@ -5491,16 +5495,10 @@ enum pci_bus_speed pcie_get_speed_cap(struct pci_dev *dev)
+ }
+
+ pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &lnkcap);
+- if (lnkcap) {
+- if (lnkcap & PCI_EXP_LNKCAP_SLS_16_0GB)
+- return PCIE_SPEED_16_0GT;
+- else if (lnkcap & PCI_EXP_LNKCAP_SLS_8_0GB)
+- return PCIE_SPEED_8_0GT;
+- else if (lnkcap & PCI_EXP_LNKCAP_SLS_5_0GB)
+- return PCIE_SPEED_5_0GT;
+- else if (lnkcap & PCI_EXP_LNKCAP_SLS_2_5GB)
+- return PCIE_SPEED_2_5GT;
+- }
++ if ((lnkcap & PCI_EXP_LNKCAP_SLS) == PCI_EXP_LNKCAP_SLS_5_0GB)
++ return PCIE_SPEED_5_0GT;
++ else if ((lnkcap & PCI_EXP_LNKCAP_SLS) == PCI_EXP_LNKCAP_SLS_2_5GB)
++ return PCIE_SPEED_2_5GT;
+
+ return PCI_SPEED_UNKNOWN;
+ }
+diff --git a/drivers/rtc/rtc-hid-sensor-time.c b/drivers/rtc/rtc-hid-sensor-time.c
+index 2751dba850c6..3e1abb455472 100644
+--- a/drivers/rtc/rtc-hid-sensor-time.c
++++ b/drivers/rtc/rtc-hid-sensor-time.c
+@@ -213,7 +213,7 @@ static int hid_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ /* get a report with all values through requesting one value */
+ sensor_hub_input_attr_get_raw_value(time_state->common_attributes.hsdev,
+ HID_USAGE_SENSOR_TIME, hid_time_addresses[0],
+- time_state->info[0].report_id, SENSOR_HUB_SYNC);
++ time_state->info[0].report_id, SENSOR_HUB_SYNC, false);
+ /* wait for all values (event) */
+ ret = wait_for_completion_killable_timeout(
+ &time_state->comp_last_time, HZ*6);
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index ffce6f39828a..b03515d43745 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -4524,8 +4524,8 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
+ {
+ struct qeth_ipa_cmd *cmd;
+ struct qeth_arp_query_info *qinfo;
+- struct qeth_snmp_cmd *snmp;
+ unsigned char *data;
++ void *snmp_data;
+ __u16 data_len;
+
+ QETH_CARD_TEXT(card, 3, "snpcmdcb");
+@@ -4533,7 +4533,6 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
+ cmd = (struct qeth_ipa_cmd *) sdata;
+ data = (unsigned char *)((char *)cmd - reply->offset);
+ qinfo = (struct qeth_arp_query_info *) reply->param;
+- snmp = &cmd->data.setadapterparms.data.snmp;
+
+ if (cmd->hdr.return_code) {
+ QETH_CARD_TEXT_(card, 4, "scer1%x", cmd->hdr.return_code);
+@@ -4546,10 +4545,15 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
+ return 0;
+ }
+ data_len = *((__u16 *)QETH_IPA_PDU_LEN_PDU1(data));
+- if (cmd->data.setadapterparms.hdr.seq_no == 1)
+- data_len -= (__u16)((char *)&snmp->data - (char *)cmd);
+- else
+- data_len -= (__u16)((char *)&snmp->request - (char *)cmd);
++ if (cmd->data.setadapterparms.hdr.seq_no == 1) {
++ snmp_data = &cmd->data.setadapterparms.data.snmp;
++ data_len -= offsetof(struct qeth_ipa_cmd,
++ data.setadapterparms.data.snmp);
++ } else {
++ snmp_data = &cmd->data.setadapterparms.data.snmp.request;
++ data_len -= offsetof(struct qeth_ipa_cmd,
++ data.setadapterparms.data.snmp.request);
++ }
+
+ /* check if there is enough room in userspace */
+ if ((qinfo->udata_len - qinfo->udata_offset) < data_len) {
+@@ -4562,16 +4566,9 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
+ QETH_CARD_TEXT_(card, 4, "sseqn%i",
+ cmd->data.setadapterparms.hdr.seq_no);
+ /*copy entries to user buffer*/
+- if (cmd->data.setadapterparms.hdr.seq_no == 1) {
+- memcpy(qinfo->udata + qinfo->udata_offset,
+- (char *)snmp,
+- data_len + offsetof(struct qeth_snmp_cmd, data));
+- qinfo->udata_offset += offsetof(struct qeth_snmp_cmd, data);
+- } else {
+- memcpy(qinfo->udata + qinfo->udata_offset,
+- (char *)&snmp->request, data_len);
+- }
++ memcpy(qinfo->udata + qinfo->udata_offset, snmp_data, data_len);
+ qinfo->udata_offset += data_len;
++
+ /* check if all replies received ... */
+ QETH_CARD_TEXT_(card, 4, "srtot%i",
+ cmd->data.setadapterparms.hdr.used_total);
+diff --git a/drivers/staging/most/core.c b/drivers/staging/most/core.c
+index f4c464625a67..52ad62722996 100644
+--- a/drivers/staging/most/core.c
++++ b/drivers/staging/most/core.c
+@@ -351,7 +351,7 @@ static ssize_t set_datatype_show(struct device *dev,
+
+ for (i = 0; i < ARRAY_SIZE(ch_data_type); i++) {
+ if (c->cfg.data_type & ch_data_type[i].most_ch_data_type)
+- return snprintf(buf, PAGE_SIZE, ch_data_type[i].name);
++ return snprintf(buf, PAGE_SIZE, "%s", ch_data_type[i].name);
+ }
+ return snprintf(buf, PAGE_SIZE, "unconfigured\n");
+ }
+diff --git a/drivers/staging/mt7621-dma/mtk-hsdma.c b/drivers/staging/mt7621-dma/mtk-hsdma.c
+index df6ebf41bdea..5831f816c17b 100644
+--- a/drivers/staging/mt7621-dma/mtk-hsdma.c
++++ b/drivers/staging/mt7621-dma/mtk-hsdma.c
+@@ -335,6 +335,8 @@ static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma,
+ /* tx desc */
+ src = sg->src_addr;
+ for (i = 0; i < chan->desc->num_sgs; i++) {
++ tx_desc = &chan->tx_ring[chan->tx_idx];
++
+ if (len > HSDMA_MAX_PLEN)
+ tlen = HSDMA_MAX_PLEN;
+ else
+@@ -344,7 +346,6 @@ static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma,
+ tx_desc->addr1 = src;
+ tx_desc->flags |= HSDMA_DESC_PLEN1(tlen);
+ } else {
+- tx_desc = &chan->tx_ring[chan->tx_idx];
+ tx_desc->addr0 = src;
+ tx_desc->flags = HSDMA_DESC_PLEN0(tlen);
+
+diff --git a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
+index b8566ed898f1..aa98fbb17013 100644
+--- a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
++++ b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
+@@ -82,7 +82,7 @@ static int rt2880_pinctrl_dt_node_to_map(struct pinctrl_dev *pctrldev,
+ struct property *prop;
+ const char *function_name, *group_name;
+ int ret;
+- int ngroups;
++ int ngroups = 0;
+ unsigned int reserved_maps = 0;
+
+ for_each_node_with_property(np_config, "group")
+diff --git a/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c b/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c
+index 85077947b9b8..85aba8a503cd 100644
+--- a/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c
++++ b/drivers/staging/rtl8723bs/hal/rtl8723bs_recv.c
+@@ -109,12 +109,12 @@ static void update_recvframe_phyinfo(union recv_frame *precvframe,
+ rx_bssid = get_hdr_bssid(wlanhdr);
+ pkt_info.bssid_match = ((!IsFrameTypeCtrl(wlanhdr)) &&
+ !pattrib->icv_err && !pattrib->crc_err &&
+- !ether_addr_equal(rx_bssid, my_bssid));
++ ether_addr_equal(rx_bssid, my_bssid));
+
+ rx_ra = get_ra(wlanhdr);
+ my_hwaddr = myid(&padapter->eeprompriv);
+ pkt_info.to_self = pkt_info.bssid_match &&
+- !ether_addr_equal(rx_ra, my_hwaddr);
++ ether_addr_equal(rx_ra, my_hwaddr);
+
+
+ pkt_info.is_beacon = pkt_info.bssid_match &&
+diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+index af2234798fa8..db553f2e4c0b 100644
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+@@ -1277,7 +1277,7 @@ static int cfg80211_rtw_get_station(struct wiphy *wiphy,
+
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
+ sinfo->tx_packets = psta->sta_stats.tx_pkts;
+-
++ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
+ }
+
+ /* for Ad-Hoc/AP mode */
+diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+index bc05c69383b8..fe431302a030 100644
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -1787,6 +1787,7 @@ vchiq_compat_ioctl_await_completion(struct file *file,
+ struct vchiq_await_completion32 args32;
+ struct vchiq_completion_data32 completion32;
+ unsigned int *msgbufcount32;
++ unsigned int msgbufcount_native;
+ compat_uptr_t msgbuf32;
+ void *msgbuf;
+ void **msgbufptr;
+@@ -1898,7 +1899,11 @@ vchiq_compat_ioctl_await_completion(struct file *file,
+ sizeof(completion32)))
+ return -EFAULT;
+
+- args32.msgbufcount--;
++ if (get_user(msgbufcount_native, &args->msgbufcount))
++ return -EFAULT;
++
++ if (!msgbufcount_native)
++ args32.msgbufcount--;
+
+ msgbufcount32 =
+ &((struct vchiq_await_completion32 __user *)arg)->msgbufcount;
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index f9ff03e6af93..0690fcff0ea2 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -209,6 +209,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Microsoft LifeCam-VX700 v2.0 */
+ { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
++ { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
+ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 2de1a3971a26..558949b826d0 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1461,9 +1461,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
+ unsigned transfer_in_flight;
+ unsigned started;
+
+- if (dep->flags & DWC3_EP_STALL)
+- return 0;
+-
+ if (dep->number > 1)
+ trb = dwc3_ep_prev_trb(dep, dep->trb_enqueue);
+ else
+@@ -1485,8 +1482,6 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
+ else
+ dep->flags |= DWC3_EP_STALL;
+ } else {
+- if (!(dep->flags & DWC3_EP_STALL))
+- return 0;
+
+ ret = dwc3_send_clear_stall_ep_cmd(dep);
+ if (ret)
+diff --git a/drivers/usb/storage/unusual_realtek.h b/drivers/usb/storage/unusual_realtek.h
+index d17cd95b55bb..6b2140f966ef 100644
+--- a/drivers/usb/storage/unusual_realtek.h
++++ b/drivers/usb/storage/unusual_realtek.h
+@@ -27,4 +27,14 @@ UNUSUAL_DEV(0x0bda, 0x0159, 0x0000, 0x9999,
+ "USB Card Reader",
+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+
++UNUSUAL_DEV(0x0bda, 0x0177, 0x0000, 0x9999,
++ "Realtek",
++ "USB Card Reader",
++ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
++
++UNUSUAL_DEV(0x0bda, 0x0184, 0x0000, 0x9999,
++ "Realtek",
++ "USB Card Reader",
++ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
++
+ #endif /* defined(CONFIG_USB_STORAGE_REALTEK) || ... */
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index dc52ce5e495f..834a3f5ef642 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -477,9 +477,9 @@ static int btree_read_extent_buffer_pages(struct btrfs_fs_info *fs_info,
+ int mirror_num = 0;
+ int failed_mirror = 0;
+
+- clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags);
+ io_tree = &BTRFS_I(fs_info->btree_inode)->io_tree;
+ while (1) {
++ clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags);
+ ret = read_extent_buffer_pages(io_tree, eb, WAIT_COMPLETE,
+ mirror_num);
+ if (!ret) {
+@@ -493,15 +493,6 @@ static int btree_read_extent_buffer_pages(struct btrfs_fs_info *fs_info,
+ break;
+ }
+
+- /*
+- * This buffer's crc is fine, but its contents are corrupted, so
+- * there is no reason to read the other copies, they won't be
+- * any less wrong.
+- */
+- if (test_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags) ||
+- ret == -EUCLEAN)
+- break;
+-
+ num_copies = btrfs_num_copies(fs_info,
+ eb->start, eb->len);
+ if (num_copies == 1)
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 7d81cc415264..ca4902c66dc4 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -2088,6 +2088,30 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+
+ atomic_inc(&root->log_batch);
+
++ /*
++ * Before we acquired the inode's lock, someone may have dirtied more
++ * pages in the target range. We need to make sure that writeback for
++ * any such pages does not start while we are logging the inode, because
++ * if it does, any of the following might happen when we are not doing a
++ * full inode sync:
++ *
++ * 1) We log an extent after its writeback finishes but before its
++ * checksums are added to the csum tree, leading to -EIO errors
++ * when attempting to read the extent after a log replay.
++ *
++ * 2) We can end up logging an extent before its writeback finishes.
++ * Therefore after the log replay we will have a file extent item
++ * pointing to an unwritten extent (and no data checksums as well).
++ *
++ * So trigger writeback for any eventual new dirty pages and then we
++ * wait for all ordered extents to complete below.
++ */
++ ret = start_ordered_ops(inode, start, end);
++ if (ret) {
++ inode_unlock(inode);
++ goto out;
++ }
++
+ /*
+ * We have to do this here to avoid the priority inversion of waiting on
+ * IO of a lower priority task while holding a transaciton open.
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index b070401406be..ff434663d65b 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2244,7 +2244,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
+ int i;
+ u64 *i_qgroups;
+ struct btrfs_fs_info *fs_info = trans->fs_info;
+- struct btrfs_root *quota_root = fs_info->quota_root;
++ struct btrfs_root *quota_root;
+ struct btrfs_qgroup *srcgroup;
+ struct btrfs_qgroup *dstgroup;
+ u32 level_size = 0;
+@@ -2254,6 +2254,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
+ if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
+ goto out;
+
++ quota_root = fs_info->quota_root;
+ if (!quota_root) {
+ ret = -EINVAL;
+ goto out;
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 60bf8dfe7df4..0526b6c473c7 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -3963,6 +3963,7 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
+ restart:
+ if (update_backref_cache(trans, &rc->backref_cache)) {
+ btrfs_end_transaction(trans);
++ trans = NULL;
+ continue;
+ }
+
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 6601c9aa5e35..8ad145820ea8 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -2235,6 +2235,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
+ vol = memdup_user((void __user *)arg, sizeof(*vol));
+ if (IS_ERR(vol))
+ return PTR_ERR(vol);
++ vol->name[BTRFS_PATH_NAME_MAX] = '\0';
+
+ switch (cmd) {
+ case BTRFS_IOC_SCAN_DEV:
+diff --git a/fs/direct-io.c b/fs/direct-io.c
+index 093fb54cd316..199146036093 100644
+--- a/fs/direct-io.c
++++ b/fs/direct-io.c
+@@ -325,8 +325,8 @@ static ssize_t dio_complete(struct dio *dio, ssize_t ret, unsigned int flags)
+ */
+ dio->iocb->ki_pos += transferred;
+
+- if (dio->op == REQ_OP_WRITE)
+- ret = generic_write_sync(dio->iocb, transferred);
++ if (ret > 0 && dio->op == REQ_OP_WRITE)
++ ret = generic_write_sync(dio->iocb, ret);
+ dio->iocb->ki_complete(dio->iocb, ret, 0);
+ }
+
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index 73bd58fa13de..0c38e31ec938 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -895,6 +895,7 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
+ if (sb->s_magic != EXT2_SUPER_MAGIC)
+ goto cantfind_ext2;
+
++ opts.s_mount_opt = 0;
+ /* Set defaults before we parse the mount options */
+ def_mount_opts = le32_to_cpu(es->s_default_mount_opts);
+ if (def_mount_opts & EXT2_DEFM_DEBUG)
+diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
+index 62d9a659a8ff..dd8f10db82e9 100644
+--- a/fs/ext2/xattr.c
++++ b/fs/ext2/xattr.c
+@@ -612,9 +612,9 @@ skip_replace:
+ }
+
+ cleanup:
+- brelse(bh);
+ if (!(bh && header == HDR(bh)))
+ kfree(header);
++ brelse(bh);
+ up_write(&EXT2_I(inode)->xattr_sem);
+
+ return error;
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index b997e3116e37..c495db7165ae 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -831,16 +831,20 @@ static int udf_load_pvoldesc(struct super_block *sb, sector_t block)
+
+
+ ret = udf_dstrCS0toChar(sb, outstr, 31, pvoldesc->volIdent, 32);
+- if (ret < 0)
+- goto out_bh;
+-
+- strncpy(UDF_SB(sb)->s_volume_ident, outstr, ret);
++ if (ret < 0) {
++ strcpy(UDF_SB(sb)->s_volume_ident, "InvalidName");
++ pr_warn("incorrect volume identification, setting to "
++ "'InvalidName'\n");
++ } else {
++ strncpy(UDF_SB(sb)->s_volume_ident, outstr, ret);
++ }
+ udf_debug("volIdent[] = '%s'\n", UDF_SB(sb)->s_volume_ident);
+
+ ret = udf_dstrCS0toChar(sb, outstr, 127, pvoldesc->volSetIdent, 128);
+- if (ret < 0)
++ if (ret < 0) {
++ ret = 0;
+ goto out_bh;
+-
++ }
+ outstr[ret] = 0;
+ udf_debug("volSetIdent[] = '%s'\n", outstr);
+
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index 45234791fec2..5fcfa96463eb 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -351,6 +351,11 @@ try_again:
+ return u_len;
+ }
+
++/*
++ * Convert CS0 dstring to output charset. Warning: This function may truncate
++ * input string if it is too long as it is used for informational strings only
++ * and it is better to truncate the string than to refuse mounting a media.
++ */
+ int udf_dstrCS0toChar(struct super_block *sb, uint8_t *utf_o, int o_len,
+ const uint8_t *ocu_i, int i_len)
+ {
+@@ -359,9 +364,12 @@ int udf_dstrCS0toChar(struct super_block *sb, uint8_t *utf_o, int o_len,
+ if (i_len > 0) {
+ s_len = ocu_i[i_len - 1];
+ if (s_len >= i_len) {
+- pr_err("incorrect dstring lengths (%d/%d)\n",
+- s_len, i_len);
+- return -EINVAL;
++ pr_warn("incorrect dstring lengths (%d/%d),"
++ " truncating\n", s_len, i_len);
++ s_len = i_len - 1;
++ /* 2-byte encoding? Need to round properly... */
++ if (ocu_i[0] == 16)
++ s_len -= (s_len - 1) & 2;
+ }
+ }
+
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index 356d2b8568c1..cd58939dc977 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -1361,6 +1361,19 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
+ ret = -EINVAL;
+ if (!vma_can_userfault(cur))
+ goto out_unlock;
++
++ /*
++ * UFFDIO_COPY will fill file holes even without
++ * PROT_WRITE. This check enforces that if this is a
++ * MAP_SHARED, the process has write permission to the backing
++ * file. If VM_MAYWRITE is set it also enforces that on a
++ * MAP_SHARED vma: there is no F_WRITE_SEAL and no further
++ * F_WRITE_SEAL can be taken until the vma is destroyed.
++ */
++ ret = -EPERM;
++ if (unlikely(!(cur->vm_flags & VM_MAYWRITE)))
++ goto out_unlock;
++
+ /*
+ * If this vma contains ending address, and huge pages
+ * check alignment.
+@@ -1406,6 +1419,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
+ BUG_ON(!vma_can_userfault(vma));
+ BUG_ON(vma->vm_userfaultfd_ctx.ctx &&
+ vma->vm_userfaultfd_ctx.ctx != ctx);
++ WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
+
+ /*
+ * Nothing to do: this vma is already registered into this
+@@ -1552,6 +1566,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
+ cond_resched();
+
+ BUG_ON(!vma_can_userfault(vma));
++ WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
+
+ /*
+ * Nothing to do: this vma is already registered into this
+diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
+index a397907e8d72..dd16e8218db3 100644
+--- a/include/linux/ftrace.h
++++ b/include/linux/ftrace.h
+@@ -777,8 +777,8 @@ struct ftrace_ret_stack {
+ extern void return_to_handler(void);
+
+ extern int
+-ftrace_push_return_trace(unsigned long ret, unsigned long func, int *depth,
+- unsigned long frame_pointer, unsigned long *retp);
++function_graph_enter(unsigned long ret, unsigned long func,
++ unsigned long frame_pointer, unsigned long *retp);
+
+ unsigned long ftrace_graph_ret_addr(struct task_struct *task, int *idx,
+ unsigned long ret, unsigned long *retp);
+diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
+index 331dc377c275..dc12f5c4b076 100644
+--- a/include/linux/hid-sensor-hub.h
++++ b/include/linux/hid-sensor-hub.h
+@@ -177,6 +177,7 @@ int sensor_hub_input_get_attribute_info(struct hid_sensor_hub_device *hsdev,
+ * @attr_usage_id: Attribute usage id as per spec
+ * @report_id: Report id to look for
+ * @flag: Synchronous or asynchronous read
++* @is_signed: If true then fields < 32 bits will be sign-extended
+ *
+ * Issues a synchronous or asynchronous read request for an input attribute.
+ * Returns data upto 32 bits.
+@@ -190,7 +191,8 @@ enum sensor_hub_read_flags {
+ int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
+ u32 usage_id,
+ u32 attr_usage_id, u32 report_id,
+- enum sensor_hub_read_flags flag
++ enum sensor_hub_read_flags flag,
++ bool is_signed
+ );
+
+ /**
+diff --git a/include/linux/net_dim.h b/include/linux/net_dim.h
+index c79e859408e6..fd458389f7d1 100644
+--- a/include/linux/net_dim.h
++++ b/include/linux/net_dim.h
+@@ -406,6 +406,8 @@ static inline void net_dim(struct net_dim *dim,
+ }
+ /* fall through */
+ case NET_DIM_START_MEASURE:
++ net_dim_sample(end_sample.event_ctr, end_sample.pkt_ctr, end_sample.byte_ctr,
++ &dim->start_sample);
+ dim->state = NET_DIM_MEASURE_IN_PROGRESS;
+ break;
+ case NET_DIM_APPLY_NEW_PROFILE:
+diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
+index 4f36431c380b..561feb560619 100644
+--- a/include/linux/ptrace.h
++++ b/include/linux/ptrace.h
+@@ -62,8 +62,8 @@ extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
+ #define PTRACE_MODE_READ 0x01
+ #define PTRACE_MODE_ATTACH 0x02
+ #define PTRACE_MODE_NOAUDIT 0x04
+-#define PTRACE_MODE_FSCREDS 0x08
+-#define PTRACE_MODE_REALCREDS 0x10
++#define PTRACE_MODE_FSCREDS 0x08
++#define PTRACE_MODE_REALCREDS 0x10
+
+ /* shorthands for READ/ATTACH and FSCREDS/REALCREDS combinations */
+ #define PTRACE_MODE_READ_FSCREDS (PTRACE_MODE_READ | PTRACE_MODE_FSCREDS)
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 977cb57d7bc9..4abb5bd74b04 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1108,6 +1108,7 @@ struct task_struct {
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ /* Index of current stored address in ret_stack: */
+ int curr_ret_stack;
++ int curr_ret_depth;
+
+ /* Stack of return addresses for return function tracing: */
+ struct ftrace_ret_stack *ret_stack;
+@@ -1439,6 +1440,8 @@ static inline bool is_percpu_thread(void)
+ #define PFA_SPREAD_SLAB 2 /* Spread some slab caches over cpuset */
+ #define PFA_SPEC_SSB_DISABLE 3 /* Speculative Store Bypass disabled */
+ #define PFA_SPEC_SSB_FORCE_DISABLE 4 /* Speculative Store Bypass force disabled*/
++#define PFA_SPEC_IB_DISABLE 5 /* Indirect branch speculation restricted */
++#define PFA_SPEC_IB_FORCE_DISABLE 6 /* Indirect branch speculation permanently restricted */
+
+ #define TASK_PFA_TEST(name, func) \
+ static inline bool task_##func(struct task_struct *p) \
+@@ -1470,6 +1473,13 @@ TASK_PFA_CLEAR(SPEC_SSB_DISABLE, spec_ssb_disable)
+ TASK_PFA_TEST(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable)
+ TASK_PFA_SET(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable)
+
++TASK_PFA_TEST(SPEC_IB_DISABLE, spec_ib_disable)
++TASK_PFA_SET(SPEC_IB_DISABLE, spec_ib_disable)
++TASK_PFA_CLEAR(SPEC_IB_DISABLE, spec_ib_disable)
++
++TASK_PFA_TEST(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
++TASK_PFA_SET(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
++
+ static inline void
+ current_restore_flags(unsigned long orig_flags, unsigned long flags)
+ {
+diff --git a/include/linux/sched/smt.h b/include/linux/sched/smt.h
+new file mode 100644
+index 000000000000..59d3736c454c
+--- /dev/null
++++ b/include/linux/sched/smt.h
+@@ -0,0 +1,20 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _LINUX_SCHED_SMT_H
++#define _LINUX_SCHED_SMT_H
++
++#include <linux/static_key.h>
++
++#ifdef CONFIG_SCHED_SMT
++extern struct static_key_false sched_smt_present;
++
++static __always_inline bool sched_smt_active(void)
++{
++ return static_branch_likely(&sched_smt_present);
++}
++#else
++static inline bool sched_smt_active(void) { return false; }
++#endif
++
++void arch_smt_update(void);
++
++#endif
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 17a13e4785fc..e6ef9cc05e60 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1311,6 +1311,22 @@ static inline void skb_zcopy_set(struct sk_buff *skb, struct ubuf_info *uarg)
+ }
+ }
+
++static inline void skb_zcopy_set_nouarg(struct sk_buff *skb, void *val)
++{
++ skb_shinfo(skb)->destructor_arg = (void *)((uintptr_t) val | 0x1UL);
++ skb_shinfo(skb)->tx_flags |= SKBTX_ZEROCOPY_FRAG;
++}
++
++static inline bool skb_zcopy_is_nouarg(struct sk_buff *skb)
++{
++ return (uintptr_t) skb_shinfo(skb)->destructor_arg & 0x1UL;
++}
++
++static inline void *skb_zcopy_get_nouarg(struct sk_buff *skb)
++{
++ return (void *)((uintptr_t) skb_shinfo(skb)->destructor_arg & ~0x1UL);
++}
++
+ /* Release a reference on a zerocopy structure */
+ static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
+ {
+@@ -1320,7 +1336,7 @@ static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
+ if (uarg->callback == sock_zerocopy_callback) {
+ uarg->zerocopy = uarg->zerocopy && zerocopy;
+ sock_zerocopy_put(uarg);
+- } else {
++ } else if (!skb_zcopy_is_nouarg(skb)) {
+ uarg->callback(uarg, zerocopy);
+ }
+
+diff --git a/include/linux/tcp.h b/include/linux/tcp.h
+index 263e37271afd..d2c8f280e48f 100644
+--- a/include/linux/tcp.h
++++ b/include/linux/tcp.h
+@@ -196,6 +196,7 @@ struct tcp_sock {
+ u32 rcv_tstamp; /* timestamp of last received ACK (for keepalives) */
+ u32 lsndtime; /* timestamp of last sent data packet (for restart window) */
+ u32 last_oow_ack_time; /* timestamp of last out-of-window ACK */
++ u32 compressed_ack_rcv_nxt;
+
+ u32 tsoffset; /* timestamp offset */
+
+diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
+index c0d7ea0bf5b6..b17201edfa09 100644
+--- a/include/uapi/linux/prctl.h
++++ b/include/uapi/linux/prctl.h
+@@ -212,6 +212,7 @@ struct prctl_mm_map {
+ #define PR_SET_SPECULATION_CTRL 53
+ /* Speculation control variants */
+ # define PR_SPEC_STORE_BYPASS 0
++# define PR_SPEC_INDIRECT_BRANCH 1
+ /* Return and control values for PR_SET/GET_SPECULATION_CTRL */
+ # define PR_SPEC_NOT_AFFECTED 0
+ # define PR_SPEC_PRCTL (1UL << 0)
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 0097acec1c71..1699ff68c412 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -10,6 +10,7 @@
+ #include <linux/sched/signal.h>
+ #include <linux/sched/hotplug.h>
+ #include <linux/sched/task.h>
++#include <linux/sched/smt.h>
+ #include <linux/unistd.h>
+ #include <linux/cpu.h>
+ #include <linux/oom.h>
+@@ -346,6 +347,12 @@ void cpu_hotplug_enable(void)
+ EXPORT_SYMBOL_GPL(cpu_hotplug_enable);
+ #endif /* CONFIG_HOTPLUG_CPU */
+
++/*
++ * Architectures that need SMT-specific errata handling during SMT hotplug
++ * should override this.
++ */
++void __weak arch_smt_update(void) { }
++
+ #ifdef CONFIG_HOTPLUG_SMT
+ enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
+ EXPORT_SYMBOL_GPL(cpu_smt_control);
+@@ -982,6 +989,7 @@ out:
+ * concurrent CPU hotplug via cpu_add_remove_lock.
+ */
+ lockup_detector_cleanup();
++ arch_smt_update();
+ return ret;
+ }
+
+@@ -1110,6 +1118,7 @@ static int _cpu_up(unsigned int cpu, int tasks_frozen, enum cpuhp_state target)
+ ret = cpuhp_up_callbacks(cpu, st, target);
+ out:
+ cpus_write_unlock();
++ arch_smt_update();
+ return ret;
+ }
+
+@@ -2052,8 +2061,10 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ */
+ cpuhp_offline_cpu_device(cpu);
+ }
+- if (!ret)
++ if (!ret) {
+ cpu_smt_control = ctrlval;
++ arch_smt_update();
++ }
+ cpu_maps_update_done();
+ return ret;
+ }
+@@ -2064,6 +2075,7 @@ static int cpuhp_smt_enable(void)
+
+ cpu_maps_update_begin();
+ cpu_smt_control = CPU_SMT_ENABLED;
++ arch_smt_update();
+ for_each_present_cpu(cpu) {
+ /* Skip online CPUs and CPUs on offline nodes */
+ if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 35551110d277..2beda4b726e2 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5741,15 +5741,10 @@ int sched_cpu_activate(unsigned int cpu)
+
+ #ifdef CONFIG_SCHED_SMT
+ /*
+- * The sched_smt_present static key needs to be evaluated on every
+- * hotplug event because at boot time SMT might be disabled when
+- * the number of booted CPUs is limited.
+- *
+- * If then later a sibling gets hotplugged, then the key would stay
+- * off and SMT scheduling would never be functional.
++ * When going up, increment the number of cores with SMT present.
+ */
+- if (cpumask_weight(cpu_smt_mask(cpu)) > 1)
+- static_branch_enable_cpuslocked(&sched_smt_present);
++ if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
++ static_branch_inc_cpuslocked(&sched_smt_present);
+ #endif
+ set_cpu_active(cpu, true);
+
+@@ -5793,6 +5788,14 @@ int sched_cpu_deactivate(unsigned int cpu)
+ */
+ synchronize_rcu_mult(call_rcu, call_rcu_sched);
+
++#ifdef CONFIG_SCHED_SMT
++ /*
++ * When going down, decrement the number of cores with SMT present.
++ */
++ if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
++ static_branch_dec_cpuslocked(&sched_smt_present);
++#endif
++
+ if (!sched_smp_initialized)
+ return 0;
+
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 9683f458aec7..6c25bbe87bd3 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -23,6 +23,7 @@
+ #include <linux/sched/prio.h>
+ #include <linux/sched/rt.h>
+ #include <linux/sched/signal.h>
++#include <linux/sched/smt.h>
+ #include <linux/sched/stat.h>
+ #include <linux/sched/sysctl.h>
+ #include <linux/sched/task.h>
+@@ -930,9 +931,6 @@ static inline int cpu_of(struct rq *rq)
+
+
+ #ifdef CONFIG_SCHED_SMT
+-
+-extern struct static_key_false sched_smt_present;
+-
+ extern void __update_idle_core(struct rq *rq);
+
+ static inline void update_idle_core(struct rq *rq)
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index f536f601bd46..77734451cb05 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -817,7 +817,7 @@ function_profile_call(unsigned long ip, unsigned long parent_ip,
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ static int profile_graph_entry(struct ftrace_graph_ent *trace)
+ {
+- int index = trace->depth;
++ int index = current->curr_ret_stack;
+
+ function_profile_call(trace->func, 0, NULL, NULL);
+
+@@ -852,7 +852,7 @@ static void profile_graph_return(struct ftrace_graph_ret *trace)
+ if (!fgraph_graph_time) {
+ int index;
+
+- index = trace->depth;
++ index = current->curr_ret_stack;
+
+ /* Append this call time to the parent time to subtract */
+ if (index)
+@@ -6814,6 +6814,7 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
+ atomic_set(&t->tracing_graph_pause, 0);
+ atomic_set(&t->trace_overrun, 0);
+ t->curr_ret_stack = -1;
++ t->curr_ret_depth = -1;
+ /* Make sure the tasks see the -1 first: */
+ smp_wmb();
+ t->ret_stack = ret_stack_list[start++];
+@@ -7038,6 +7039,7 @@ graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
+ void ftrace_graph_init_idle_task(struct task_struct *t, int cpu)
+ {
+ t->curr_ret_stack = -1;
++ t->curr_ret_depth = -1;
+ /*
+ * The idle task has no parent, it either has its own
+ * stack or no stack at all.
+@@ -7068,6 +7070,7 @@ void ftrace_graph_init_task(struct task_struct *t)
+ /* Make sure we do not use the parent ret_stack */
+ t->ret_stack = NULL;
+ t->curr_ret_stack = -1;
++ t->curr_ret_depth = -1;
+
+ if (ftrace_graph_active) {
+ struct ftrace_ret_stack *ret_stack;
+diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
+index 169b3c44ee97..2561460d7baf 100644
+--- a/kernel/trace/trace_functions_graph.c
++++ b/kernel/trace/trace_functions_graph.c
+@@ -118,8 +118,8 @@ print_graph_duration(struct trace_array *tr, unsigned long long duration,
+ struct trace_seq *s, u32 flags);
+
+ /* Add a function return address to the trace stack on thread info.*/
+-int
+-ftrace_push_return_trace(unsigned long ret, unsigned long func, int *depth,
++static int
++ftrace_push_return_trace(unsigned long ret, unsigned long func,
+ unsigned long frame_pointer, unsigned long *retp)
+ {
+ unsigned long long calltime;
+@@ -177,9 +177,31 @@ ftrace_push_return_trace(unsigned long ret, unsigned long func, int *depth,
+ #ifdef HAVE_FUNCTION_GRAPH_RET_ADDR_PTR
+ current->ret_stack[index].retp = retp;
+ #endif
+- *depth = current->curr_ret_stack;
++ return 0;
++}
++
++int function_graph_enter(unsigned long ret, unsigned long func,
++ unsigned long frame_pointer, unsigned long *retp)
++{
++ struct ftrace_graph_ent trace;
++
++ trace.func = func;
++ trace.depth = ++current->curr_ret_depth;
++
++ if (ftrace_push_return_trace(ret, func,
++ frame_pointer, retp))
++ goto out;
++
++ /* Only trace if the calling function expects to */
++ if (!ftrace_graph_entry(&trace))
++ goto out_ret;
+
+ return 0;
++ out_ret:
++ current->curr_ret_stack--;
++ out:
++ current->curr_ret_depth--;
++ return -EBUSY;
+ }
+
+ /* Retrieve a function return address to the trace stack on thread info.*/
+@@ -241,7 +263,13 @@ ftrace_pop_return_trace(struct ftrace_graph_ret *trace, unsigned long *ret,
+ trace->func = current->ret_stack[index].func;
+ trace->calltime = current->ret_stack[index].calltime;
+ trace->overrun = atomic_read(¤t->trace_overrun);
+- trace->depth = index;
++ trace->depth = current->curr_ret_depth--;
++ /*
++ * We still want to trace interrupts coming in if
++ * max_depth is set to 1. Make sure the decrement is
++ * seen before ftrace_graph_return.
++ */
++ barrier();
+ }
+
+ /*
+@@ -255,6 +283,12 @@ unsigned long ftrace_return_to_handler(unsigned long frame_pointer)
+
+ ftrace_pop_return_trace(&trace, &ret, frame_pointer);
+ trace.rettime = trace_clock_local();
++ ftrace_graph_return(&trace);
++ /*
++ * The ftrace_graph_return() may still access the current
++ * ret_stack structure, we need to make sure the update of
++ * curr_ret_stack is after that.
++ */
+ barrier();
+ current->curr_ret_stack--;
+ /*
+@@ -267,13 +301,6 @@ unsigned long ftrace_return_to_handler(unsigned long frame_pointer)
+ return ret;
+ }
+
+- /*
+- * The trace should run after decrementing the ret counter
+- * in case an interrupt were to come in. We don't want to
+- * lose the interrupt if max_depth is set.
+- */
+- ftrace_graph_return(&trace);
+-
+ if (unlikely(!ret)) {
+ ftrace_graph_stop();
+ WARN_ON(1);
+diff --git a/lib/test_kmod.c b/lib/test_kmod.c
+index e3ddd836491f..d82d022111e0 100644
+--- a/lib/test_kmod.c
++++ b/lib/test_kmod.c
+@@ -1214,7 +1214,6 @@ void unregister_test_dev_kmod(struct kmod_test_device *test_dev)
+
+ dev_info(test_dev->dev, "removing interface\n");
+ misc_deregister(&test_dev->misc_dev);
+- kfree(&test_dev->misc_dev.name);
+
+ mutex_unlock(&test_dev->config_mutex);
+ mutex_unlock(&test_dev->trigger_mutex);
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index deed97fba979..15310f14c25e 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2322,7 +2322,7 @@ void vma_adjust_trans_huge(struct vm_area_struct *vma,
+ }
+ }
+
+-static void freeze_page(struct page *page)
++static void unmap_page(struct page *page)
+ {
+ enum ttu_flags ttu_flags = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS |
+ TTU_RMAP_LOCKED | TTU_SPLIT_HUGE_PMD;
+@@ -2337,7 +2337,7 @@ static void freeze_page(struct page *page)
+ VM_BUG_ON_PAGE(!unmap_success, page);
+ }
+
+-static void unfreeze_page(struct page *page)
++static void remap_page(struct page *page)
+ {
+ int i;
+ if (PageTransHuge(page)) {
+@@ -2373,6 +2373,12 @@ static void __split_huge_page_tail(struct page *head, int tail,
+ (1L << PG_unevictable) |
+ (1L << PG_dirty)));
+
++ /* ->mapping in first tail page is compound_mapcount */
++ VM_BUG_ON_PAGE(tail > 2 && page_tail->mapping != TAIL_MAPPING,
++ page_tail);
++ page_tail->mapping = head->mapping;
++ page_tail->index = head->index + tail;
++
+ /* Page flags must be visible before we make the page non-compound. */
+ smp_wmb();
+
+@@ -2393,12 +2399,6 @@ static void __split_huge_page_tail(struct page *head, int tail,
+ if (page_is_idle(head))
+ set_page_idle(page_tail);
+
+- /* ->mapping in first tail page is compound_mapcount */
+- VM_BUG_ON_PAGE(tail > 2 && page_tail->mapping != TAIL_MAPPING,
+- page_tail);
+- page_tail->mapping = head->mapping;
+-
+- page_tail->index = head->index + tail;
+ page_cpupid_xchg_last(page_tail, page_cpupid_last(head));
+
+ /*
+@@ -2410,12 +2410,11 @@ static void __split_huge_page_tail(struct page *head, int tail,
+ }
+
+ static void __split_huge_page(struct page *page, struct list_head *list,
+- unsigned long flags)
++ pgoff_t end, unsigned long flags)
+ {
+ struct page *head = compound_head(page);
+ struct zone *zone = page_zone(head);
+ struct lruvec *lruvec;
+- pgoff_t end = -1;
+ int i;
+
+ lruvec = mem_cgroup_page_lruvec(head, zone->zone_pgdat);
+@@ -2423,9 +2422,6 @@ static void __split_huge_page(struct page *page, struct list_head *list,
+ /* complete memcg works before add pages to LRU */
+ mem_cgroup_split_huge_fixup(head);
+
+- if (!PageAnon(page))
+- end = DIV_ROUND_UP(i_size_read(head->mapping->host), PAGE_SIZE);
+-
+ for (i = HPAGE_PMD_NR - 1; i >= 1; i--) {
+ __split_huge_page_tail(head, i, lruvec, list);
+ /* Some pages can be beyond i_size: drop them from page cache */
+@@ -2454,7 +2450,7 @@ static void __split_huge_page(struct page *page, struct list_head *list,
+
+ spin_unlock_irqrestore(zone_lru_lock(page_zone(head)), flags);
+
+- unfreeze_page(head);
++ remap_page(head);
+
+ for (i = 0; i < HPAGE_PMD_NR; i++) {
+ struct page *subpage = head + i;
+@@ -2597,6 +2593,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+ int count, mapcount, extra_pins, ret;
+ bool mlocked;
+ unsigned long flags;
++ pgoff_t end;
+
+ VM_BUG_ON_PAGE(is_huge_zero_page(page), page);
+ VM_BUG_ON_PAGE(!PageLocked(page), page);
+@@ -2619,6 +2616,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+ ret = -EBUSY;
+ goto out;
+ }
++ end = -1;
+ mapping = NULL;
+ anon_vma_lock_write(anon_vma);
+ } else {
+@@ -2632,10 +2630,19 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+
+ anon_vma = NULL;
+ i_mmap_lock_read(mapping);
++
++ /*
++ *__split_huge_page() may need to trim off pages beyond EOF:
++ * but on 32-bit, i_size_read() takes an irq-unsafe seqlock,
++ * which cannot be nested inside the page tree lock. So note
++ * end now: i_size itself may be changed at any moment, but
++ * head page lock is good enough to serialize the trimming.
++ */
++ end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE);
+ }
+
+ /*
+- * Racy check if we can split the page, before freeze_page() will
++ * Racy check if we can split the page, before unmap_page() will
+ * split PMDs
+ */
+ if (!can_split_huge_page(head, &extra_pins)) {
+@@ -2644,7 +2651,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+ }
+
+ mlocked = PageMlocked(page);
+- freeze_page(head);
++ unmap_page(head);
+ VM_BUG_ON_PAGE(compound_mapcount(head), head);
+
+ /* Make sure the page is not on per-CPU pagevec as it takes pin */
+@@ -2681,7 +2688,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+ if (mapping)
+ __dec_node_page_state(page, NR_SHMEM_THPS);
+ spin_unlock(&pgdata->split_queue_lock);
+- __split_huge_page(page, list, flags);
++ __split_huge_page(page, list, end, flags);
+ if (PageSwapCache(head)) {
+ swp_entry_t entry = { .val = page_private(head) };
+
+@@ -2701,7 +2708,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+ fail: if (mapping)
+ xa_unlock(&mapping->i_pages);
+ spin_unlock_irqrestore(zone_lru_lock(page_zone(head)), flags);
+- unfreeze_page(head);
++ remap_page(head);
+ ret = -EBUSY;
+ }
+
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index a31d740e6cd1..fde5820be24d 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1287,7 +1287,7 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
+ * collapse_shmem - collapse small tmpfs/shmem pages into huge one.
+ *
+ * Basic scheme is simple, details are more complex:
+- * - allocate and freeze a new huge page;
++ * - allocate and lock a new huge page;
+ * - scan over radix tree replacing old pages the new one
+ * + swap in pages if necessary;
+ * + fill in gaps;
+@@ -1295,11 +1295,11 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
+ * - if replacing succeed:
+ * + copy data over;
+ * + free old pages;
+- * + unfreeze huge page;
++ * + unlock huge page;
+ * - if replacing failed;
+ * + put all pages back and unfreeze them;
+ * + restore gaps in the radix-tree;
+- * + free huge page;
++ * + unlock and free huge page;
+ */
+ static void collapse_shmem(struct mm_struct *mm,
+ struct address_space *mapping, pgoff_t start,
+@@ -1330,18 +1330,15 @@ static void collapse_shmem(struct mm_struct *mm,
+ goto out;
+ }
+
++ __SetPageLocked(new_page);
++ __SetPageSwapBacked(new_page);
+ new_page->index = start;
+ new_page->mapping = mapping;
+- __SetPageSwapBacked(new_page);
+- __SetPageLocked(new_page);
+- BUG_ON(!page_ref_freeze(new_page, 1));
+-
+
+ /*
+- * At this point the new_page is 'frozen' (page_count() is zero), locked
+- * and not up-to-date. It's safe to insert it into radix tree, because
+- * nobody would be able to map it or use it in other way until we
+- * unfreeze it.
++ * At this point the new_page is locked and not up-to-date.
++ * It's safe to insert it into the page cache, because nobody would
++ * be able to map it or use it in another way until we unlock it.
+ */
+
+ index = start;
+@@ -1349,19 +1346,29 @@ static void collapse_shmem(struct mm_struct *mm,
+ radix_tree_for_each_slot(slot, &mapping->i_pages, &iter, start) {
+ int n = min(iter.index, end) - index;
+
++ /*
++ * Stop if extent has been hole-punched, and is now completely
++ * empty (the more obvious i_size_read() check would take an
++ * irq-unsafe seqlock on 32-bit).
++ */
++ if (n >= HPAGE_PMD_NR) {
++ result = SCAN_TRUNCATED;
++ goto tree_locked;
++ }
++
+ /*
+ * Handle holes in the radix tree: charge it from shmem and
+ * insert relevant subpage of new_page into the radix-tree.
+ */
+ if (n && !shmem_charge(mapping->host, n)) {
+ result = SCAN_FAIL;
+- break;
++ goto tree_locked;
+ }
+- nr_none += n;
+ for (; index < min(iter.index, end); index++) {
+ radix_tree_insert(&mapping->i_pages, index,
+ new_page + (index % HPAGE_PMD_NR));
+ }
++ nr_none += n;
+
+ /* We are done. */
+ if (index >= end)
+@@ -1377,12 +1384,12 @@ static void collapse_shmem(struct mm_struct *mm,
+ result = SCAN_FAIL;
+ goto tree_unlocked;
+ }
+- xa_lock_irq(&mapping->i_pages);
+ } else if (trylock_page(page)) {
+ get_page(page);
++ xa_unlock_irq(&mapping->i_pages);
+ } else {
+ result = SCAN_PAGE_LOCK;
+- break;
++ goto tree_locked;
+ }
+
+ /*
+@@ -1391,17 +1398,24 @@ static void collapse_shmem(struct mm_struct *mm,
+ */
+ VM_BUG_ON_PAGE(!PageLocked(page), page);
+ VM_BUG_ON_PAGE(!PageUptodate(page), page);
+- VM_BUG_ON_PAGE(PageTransCompound(page), page);
++
++ /*
++ * If file was truncated then extended, or hole-punched, before
++ * we locked the first page, then a THP might be there already.
++ */
++ if (PageTransCompound(page)) {
++ result = SCAN_PAGE_COMPOUND;
++ goto out_unlock;
++ }
+
+ if (page_mapping(page) != mapping) {
+ result = SCAN_TRUNCATED;
+ goto out_unlock;
+ }
+- xa_unlock_irq(&mapping->i_pages);
+
+ if (isolate_lru_page(page)) {
+ result = SCAN_DEL_PAGE_LRU;
+- goto out_isolate_failed;
++ goto out_unlock;
+ }
+
+ if (page_mapped(page))
+@@ -1422,7 +1436,9 @@ static void collapse_shmem(struct mm_struct *mm,
+ */
+ if (!page_ref_freeze(page, 3)) {
+ result = SCAN_PAGE_COUNT;
+- goto out_lru;
++ xa_unlock_irq(&mapping->i_pages);
++ putback_lru_page(page);
++ goto out_unlock;
+ }
+
+ /*
+@@ -1438,17 +1454,10 @@ static void collapse_shmem(struct mm_struct *mm,
+ slot = radix_tree_iter_resume(slot, &iter);
+ index++;
+ continue;
+-out_lru:
+- xa_unlock_irq(&mapping->i_pages);
+- putback_lru_page(page);
+-out_isolate_failed:
+- unlock_page(page);
+- put_page(page);
+- goto tree_unlocked;
+ out_unlock:
+ unlock_page(page);
+ put_page(page);
+- break;
++ goto tree_unlocked;
+ }
+
+ /*
+@@ -1456,14 +1465,18 @@ out_unlock:
+ * This code only triggers if there's nothing in radix tree
+ * beyond 'end'.
+ */
+- if (result == SCAN_SUCCEED && index < end) {
++ if (index < end) {
+ int n = end - index;
+
++ /* Stop if extent has been truncated, and is now empty */
++ if (n >= HPAGE_PMD_NR) {
++ result = SCAN_TRUNCATED;
++ goto tree_locked;
++ }
+ if (!shmem_charge(mapping->host, n)) {
+ result = SCAN_FAIL;
+ goto tree_locked;
+ }
+-
+ for (; index < end; index++) {
+ radix_tree_insert(&mapping->i_pages, index,
+ new_page + (index % HPAGE_PMD_NR));
+@@ -1471,59 +1484,64 @@ out_unlock:
+ nr_none += n;
+ }
+
++ __inc_node_page_state(new_page, NR_SHMEM_THPS);
++ if (nr_none) {
++ struct zone *zone = page_zone(new_page);
++
++ __mod_node_page_state(zone->zone_pgdat, NR_FILE_PAGES, nr_none);
++ __mod_node_page_state(zone->zone_pgdat, NR_SHMEM, nr_none);
++ }
++
+ tree_locked:
+ xa_unlock_irq(&mapping->i_pages);
+ tree_unlocked:
+
+ if (result == SCAN_SUCCEED) {
+- unsigned long flags;
+- struct zone *zone = page_zone(new_page);
+-
+ /*
+ * Replacing old pages with new one has succeed, now we need to
+ * copy the content and free old pages.
+ */
++ index = start;
+ list_for_each_entry_safe(page, tmp, &pagelist, lru) {
++ while (index < page->index) {
++ clear_highpage(new_page + (index % HPAGE_PMD_NR));
++ index++;
++ }
+ copy_highpage(new_page + (page->index % HPAGE_PMD_NR),
+ page);
+ list_del(&page->lru);
+- unlock_page(page);
+- page_ref_unfreeze(page, 1);
+ page->mapping = NULL;
++ page_ref_unfreeze(page, 1);
+ ClearPageActive(page);
+ ClearPageUnevictable(page);
++ unlock_page(page);
+ put_page(page);
++ index++;
+ }
+-
+- local_irq_save(flags);
+- __inc_node_page_state(new_page, NR_SHMEM_THPS);
+- if (nr_none) {
+- __mod_node_page_state(zone->zone_pgdat, NR_FILE_PAGES, nr_none);
+- __mod_node_page_state(zone->zone_pgdat, NR_SHMEM, nr_none);
++ while (index < end) {
++ clear_highpage(new_page + (index % HPAGE_PMD_NR));
++ index++;
+ }
+- local_irq_restore(flags);
+
+- /*
+- * Remove pte page tables, so we can re-faulti
+- * the page as huge.
+- */
+- retract_page_tables(mapping, start);
+-
+- /* Everything is ready, let's unfreeze the new_page */
+- set_page_dirty(new_page);
+ SetPageUptodate(new_page);
+- page_ref_unfreeze(new_page, HPAGE_PMD_NR);
++ page_ref_add(new_page, HPAGE_PMD_NR - 1);
++ set_page_dirty(new_page);
+ mem_cgroup_commit_charge(new_page, memcg, false, true);
+ lru_cache_add_anon(new_page);
+- unlock_page(new_page);
+
++ /*
++ * Remove pte page tables, so we can re-fault the page as huge.
++ */
++ retract_page_tables(mapping, start);
+ *hpage = NULL;
+
+ khugepaged_pages_collapsed++;
+ } else {
+ /* Something went wrong: rollback changes to the radix-tree */
+- shmem_uncharge(mapping->host, nr_none);
+ xa_lock_irq(&mapping->i_pages);
++ mapping->nrpages -= nr_none;
++ shmem_uncharge(mapping->host, nr_none);
++
+ radix_tree_for_each_slot(slot, &mapping->i_pages, &iter, start) {
+ if (iter.index >= end)
+ break;
+@@ -1546,19 +1564,18 @@ tree_unlocked:
+ radix_tree_replace_slot(&mapping->i_pages, slot, page);
+ slot = radix_tree_iter_resume(slot, &iter);
+ xa_unlock_irq(&mapping->i_pages);
+- putback_lru_page(page);
+ unlock_page(page);
++ putback_lru_page(page);
+ xa_lock_irq(&mapping->i_pages);
+ }
+ VM_BUG_ON(nr_none);
+ xa_unlock_irq(&mapping->i_pages);
+
+- /* Unfreeze new_page, caller would take care about freeing it */
+- page_ref_unfreeze(new_page, 1);
+ mem_cgroup_cancel_charge(new_page, memcg, true);
+- unlock_page(new_page);
+ new_page->mapping = NULL;
+ }
++
++ unlock_page(new_page);
+ out:
+ VM_BUG_ON(!list_empty(&pagelist));
+ /* TODO: tracepoints */
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 1e79fac3186b..85b7f9423352 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -1627,16 +1627,9 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
+ address + PAGE_SIZE);
+ } else {
+ /*
+- * We should not need to notify here as we reach this
+- * case only from freeze_page() itself only call from
+- * split_huge_page_to_list() so everything below must
+- * be true:
+- * - page is not anonymous
+- * - page is locked
+- *
+- * So as it is a locked file back page thus it can not
+- * be remove from the page cache and replace by a new
+- * page before mmu_notifier_invalidate_range_end so no
++ * This is a locked file-backed page, thus it cannot
++ * be removed from the page cache and replaced by a new
++ * page before mmu_notifier_invalidate_range_end, so no
+ * concurrent thread might update its page table to
+ * point at new page while a device still is using this
+ * page.
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 38d228a30fdc..0b02b539072e 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -297,12 +297,14 @@ bool shmem_charge(struct inode *inode, long pages)
+ if (!shmem_inode_acct_block(inode, pages))
+ return false;
+
++ /* nrpages adjustment first, then shmem_recalc_inode() when balanced */
++ inode->i_mapping->nrpages += pages;
++
+ spin_lock_irqsave(&info->lock, flags);
+ info->alloced += pages;
+ inode->i_blocks += pages * BLOCKS_PER_PAGE;
+ shmem_recalc_inode(inode);
+ spin_unlock_irqrestore(&info->lock, flags);
+- inode->i_mapping->nrpages += pages;
+
+ return true;
+ }
+@@ -312,6 +314,8 @@ void shmem_uncharge(struct inode *inode, long pages)
+ struct shmem_inode_info *info = SHMEM_I(inode);
+ unsigned long flags;
+
++ /* nrpages adjustment done by __delete_from_page_cache() or caller */
++
+ spin_lock_irqsave(&info->lock, flags);
+ info->alloced -= pages;
+ inode->i_blocks -= pages * BLOCKS_PER_PAGE;
+@@ -1547,11 +1551,13 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
+ {
+ struct page *oldpage, *newpage;
+ struct address_space *swap_mapping;
++ swp_entry_t entry;
+ pgoff_t swap_index;
+ int error;
+
+ oldpage = *pagep;
+- swap_index = page_private(oldpage);
++ entry.val = page_private(oldpage);
++ swap_index = swp_offset(entry);
+ swap_mapping = page_mapping(oldpage);
+
+ /*
+@@ -1570,7 +1576,7 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
+ __SetPageLocked(newpage);
+ __SetPageSwapBacked(newpage);
+ SetPageUptodate(newpage);
+- set_page_private(newpage, swap_index);
++ set_page_private(newpage, entry.val);
+ SetPageSwapCache(newpage);
+
+ /*
+diff --git a/mm/truncate.c b/mm/truncate.c
+index 1d2fb2dca96f..71b65aab8077 100644
+--- a/mm/truncate.c
++++ b/mm/truncate.c
+@@ -520,9 +520,13 @@ void truncate_inode_pages_final(struct address_space *mapping)
+ */
+ xa_lock_irq(&mapping->i_pages);
+ xa_unlock_irq(&mapping->i_pages);
+-
+- truncate_inode_pages(mapping, 0);
+ }
++
++ /*
++ * Cleancache needs notification even if there are no pages or shadow
++ * entries.
++ */
++ truncate_inode_pages(mapping, 0);
+ }
+ EXPORT_SYMBOL(truncate_inode_pages_final);
+
+diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
+index 5029f241908f..f0af11b1cdf3 100644
+--- a/mm/userfaultfd.c
++++ b/mm/userfaultfd.c
+@@ -205,8 +205,9 @@ retry:
+ if (!dst_vma || !is_vm_hugetlb_page(dst_vma))
+ goto out_unlock;
+ /*
+- * Only allow __mcopy_atomic_hugetlb on userfaultfd
+- * registered ranges.
++ * Check the vma is registered in uffd, this is
++ * required to enforce the VM_MAYWRITE check done at
++ * uffd registration time.
+ */
+ if (!dst_vma->vm_userfaultfd_ctx.ctx)
+ goto out_unlock;
+@@ -449,13 +450,9 @@ retry:
+ if (!dst_vma)
+ goto out_unlock;
+ /*
+- * Be strict and only allow __mcopy_atomic on userfaultfd
+- * registered ranges to prevent userland errors going
+- * unnoticed. As far as the VM consistency is concerned, it
+- * would be perfectly safe to remove this check, but there's
+- * no useful usage for __mcopy_atomic ouside of userfaultfd
+- * registered ranges. This is after all why these are ioctls
+- * belonging to the userfaultfd and not syscalls.
++ * Check the vma is registered in uffd, this is required to
++ * enforce the VM_MAYWRITE check done at uffd registration
++ * time.
+ */
+ if (!dst_vma->vm_userfaultfd_ctx.ctx)
+ goto out_unlock;
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 097c02101450..22af88c47756 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5945,11 +5945,14 @@ bool napi_complete_done(struct napi_struct *n, int work_done)
+ if (work_done)
+ timeout = n->dev->gro_flush_timeout;
+
++ /* When the NAPI instance uses a timeout and keeps postponing
++ * it, we need to bound somehow the time packets are kept in
++ * the GRO layer
++ */
++ napi_gro_flush(n, !!timeout);
+ if (timeout)
+ hrtimer_start(&n->timer, ns_to_ktime(timeout),
+ HRTIMER_MODE_REL_PINNED);
+- else
+- napi_gro_flush(n, false);
+ }
+ if (unlikely(!list_empty(&n->poll_list))) {
+ /* If n->poll_list is not empty, we need to mask irqs */
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index f817f336595d..abbbd7fd17fe 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4912,6 +4912,11 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
+ nf_reset(skb);
+ nf_reset_trace(skb);
+
++#ifdef CONFIG_NET_SWITCHDEV
++ skb->offload_fwd_mark = 0;
++ skb->offload_mr_fwd_mark = 0;
++#endif
++
+ if (!xnet)
+ return;
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 72898cbef43d..664fa7d8f7d9 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4276,7 +4276,7 @@ static void tcp_sack_new_ofo_skb(struct sock *sk, u32 seq, u32 end_seq)
+ * If the sack array is full, forget about the last one.
+ */
+ if (this_sack >= TCP_NUM_SACKS) {
+- if (tp->compressed_ack)
++ if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
+ tcp_send_ack(sk);
+ this_sack--;
+ tp->rx_opt.num_sacks--;
+@@ -5196,7 +5196,17 @@ send_now:
+ if (!tcp_is_sack(tp) ||
+ tp->compressed_ack >= sock_net(sk)->ipv4.sysctl_tcp_comp_sack_nr)
+ goto send_now;
+- tp->compressed_ack++;
++
++ if (tp->compressed_ack_rcv_nxt != tp->rcv_nxt) {
++ tp->compressed_ack_rcv_nxt = tp->rcv_nxt;
++ if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
++ NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED,
++ tp->compressed_ack - TCP_FASTRETRANS_THRESH);
++ tp->compressed_ack = 0;
++ }
++
++ if (++tp->compressed_ack <= TCP_FASTRETRANS_THRESH)
++ goto send_now;
+
+ if (hrtimer_is_queued(&tp->compressed_ack_timer))
+ return;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 597dbd749f05..68f65ddf9e3c 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -165,10 +165,10 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts,
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+
+- if (unlikely(tp->compressed_ack)) {
++ if (unlikely(tp->compressed_ack > TCP_FASTRETRANS_THRESH)) {
+ NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED,
+- tp->compressed_ack);
+- tp->compressed_ack = 0;
++ tp->compressed_ack - TCP_FASTRETRANS_THRESH);
++ tp->compressed_ack = TCP_FASTRETRANS_THRESH;
+ if (hrtimer_try_to_cancel(&tp->compressed_ack_timer) == 1)
+ __sock_put(sk);
+ }
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 7fdf222a0bdf..57eae8d70ba1 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -740,7 +740,7 @@ static enum hrtimer_restart tcp_compressed_ack_kick(struct hrtimer *timer)
+
+ bh_lock_sock(sk);
+ if (!sock_owned_by_user(sk)) {
+- if (tp->compressed_ack)
++ if (tp->compressed_ack > TCP_FASTRETRANS_THRESH)
+ tcp_send_ack(sk);
+ } else {
+ if (!test_and_set_bit(TCP_DELACK_TIMER_DEFERRED,
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index d6e94dc7e290..6477b131e809 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2394,7 +2394,7 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
+ void *ph;
+ __u32 ts;
+
+- ph = skb_shinfo(skb)->destructor_arg;
++ ph = skb_zcopy_get_nouarg(skb);
+ packet_dec_pending(&po->tx_ring);
+
+ ts = __packet_set_timestamp(po, ph, skb);
+@@ -2461,7 +2461,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
+ skb->mark = po->sk.sk_mark;
+ skb->tstamp = sockc->transmit_time;
+ sock_tx_timestamp(&po->sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags);
+- skb_shinfo(skb)->destructor_arg = ph.raw;
++ skb_zcopy_set_nouarg(skb, ph.raw);
+
+ skb_reserve(skb, hlen);
+ skb_reset_network_header(skb);
+diff --git a/net/tipc/node.c b/net/tipc/node.c
+index 2afc4f8c37a7..488019766433 100644
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -584,12 +584,15 @@ static void tipc_node_clear_links(struct tipc_node *node)
+ /* tipc_node_cleanup - delete nodes that does not
+ * have active links for NODE_CLEANUP_AFTER time
+ */
+-static int tipc_node_cleanup(struct tipc_node *peer)
++static bool tipc_node_cleanup(struct tipc_node *peer)
+ {
+ struct tipc_net *tn = tipc_net(peer->net);
+ bool deleted = false;
+
+- spin_lock_bh(&tn->node_list_lock);
++ /* If lock held by tipc_node_stop() the node will be deleted anyway */
++ if (!spin_trylock_bh(&tn->node_list_lock))
++ return false;
++
+ tipc_node_write_lock(peer);
+
+ if (!node_is_up(peer) && time_after(jiffies, peer->delete_at)) {
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index 54da4b070db3..64fac0ad32d6 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -248,10 +248,8 @@ ifdef CONFIG_GCOV_KERNEL
+ objtool_args += --no-unreachable
+ endif
+ ifdef CONFIG_RETPOLINE
+-ifneq ($(RETPOLINE_CFLAGS),)
+ objtool_args += --retpoline
+ endif
+-endif
+
+
+ ifdef CONFIG_MODVERSIONS
+diff --git a/sound/core/control.c b/sound/core/control.c
+index 9aa15bfc7936..649d3217590e 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -348,6 +348,40 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
+ return 0;
+ }
+
++/* add a new kcontrol object; call with card->controls_rwsem locked */
++static int __snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
++{
++ struct snd_ctl_elem_id id;
++ unsigned int idx;
++ unsigned int count;
++
++ id = kcontrol->id;
++ if (id.index > UINT_MAX - kcontrol->count)
++ return -EINVAL;
++
++ if (snd_ctl_find_id(card, &id)) {
++ dev_err(card->dev,
++ "control %i:%i:%i:%s:%i is already present\n",
++ id.iface, id.device, id.subdevice, id.name, id.index);
++ return -EBUSY;
++ }
++
++ if (snd_ctl_find_hole(card, kcontrol->count) < 0)
++ return -ENOMEM;
++
++ list_add_tail(&kcontrol->list, &card->controls);
++ card->controls_count += kcontrol->count;
++ kcontrol->id.numid = card->last_numid + 1;
++ card->last_numid += kcontrol->count;
++
++ id = kcontrol->id;
++ count = kcontrol->count;
++ for (idx = 0; idx < count; idx++, id.index++, id.numid++)
++ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
++
++ return 0;
++}
++
+ /**
+ * snd_ctl_add - add the control instance to the card
+ * @card: the card instance
+@@ -364,45 +398,18 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
+ */
+ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
+ {
+- struct snd_ctl_elem_id id;
+- unsigned int idx;
+- unsigned int count;
+ int err = -EINVAL;
+
+ if (! kcontrol)
+ return err;
+ if (snd_BUG_ON(!card || !kcontrol->info))
+ goto error;
+- id = kcontrol->id;
+- if (id.index > UINT_MAX - kcontrol->count)
+- goto error;
+
+ down_write(&card->controls_rwsem);
+- if (snd_ctl_find_id(card, &id)) {
+- up_write(&card->controls_rwsem);
+- dev_err(card->dev, "control %i:%i:%i:%s:%i is already present\n",
+- id.iface,
+- id.device,
+- id.subdevice,
+- id.name,
+- id.index);
+- err = -EBUSY;
+- goto error;
+- }
+- if (snd_ctl_find_hole(card, kcontrol->count) < 0) {
+- up_write(&card->controls_rwsem);
+- err = -ENOMEM;
+- goto error;
+- }
+- list_add_tail(&kcontrol->list, &card->controls);
+- card->controls_count += kcontrol->count;
+- kcontrol->id.numid = card->last_numid + 1;
+- card->last_numid += kcontrol->count;
+- id = kcontrol->id;
+- count = kcontrol->count;
++ err = __snd_ctl_add(card, kcontrol);
+ up_write(&card->controls_rwsem);
+- for (idx = 0; idx < count; idx++, id.index++, id.numid++)
+- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
++ if (err < 0)
++ goto error;
+ return 0;
+
+ error:
+@@ -1361,9 +1368,12 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+ kctl->tlv.c = snd_ctl_elem_user_tlv;
+
+ /* This function manage to free the instance on failure. */
+- err = snd_ctl_add(card, kctl);
+- if (err < 0)
+- return err;
++ down_write(&card->controls_rwsem);
++ err = __snd_ctl_add(card, kctl);
++ if (err < 0) {
++ snd_ctl_free_one(kctl);
++ goto unlock;
++ }
+ offset = snd_ctl_get_ioff(kctl, &info->id);
+ snd_ctl_build_ioff(&info->id, kctl, offset);
+ /*
+@@ -1374,10 +1384,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+ * which locks the element.
+ */
+
+- down_write(&card->controls_rwsem);
+ card->user_ctl_count++;
+- up_write(&card->controls_rwsem);
+
++ unlock:
++ up_write(&card->controls_rwsem);
+ return 0;
+ }
+
+diff --git a/sound/isa/wss/wss_lib.c b/sound/isa/wss/wss_lib.c
+index 32453f81b95a..3a5008837576 100644
+--- a/sound/isa/wss/wss_lib.c
++++ b/sound/isa/wss/wss_lib.c
+@@ -1531,7 +1531,6 @@ static int snd_wss_playback_open(struct snd_pcm_substream *substream)
+ if (err < 0) {
+ if (chip->release_dma)
+ chip->release_dma(chip, chip->dma_private_data, chip->dma1);
+- snd_free_pages(runtime->dma_area, runtime->dma_bytes);
+ return err;
+ }
+ chip->playback_substream = substream;
+@@ -1572,7 +1571,6 @@ static int snd_wss_capture_open(struct snd_pcm_substream *substream)
+ if (err < 0) {
+ if (chip->release_dma)
+ chip->release_dma(chip, chip->dma_private_data, chip->dma2);
+- snd_free_pages(runtime->dma_area, runtime->dma_bytes);
+ return err;
+ }
+ chip->capture_substream = substream;
+diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
+index f4459d1a9d67..27b468f057dd 100644
+--- a/sound/pci/ac97/ac97_codec.c
++++ b/sound/pci/ac97/ac97_codec.c
+@@ -824,7 +824,7 @@ static int snd_ac97_put_spsa(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_
+ {
+ struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol);
+ int reg = kcontrol->private_value & 0xff;
+- int shift = (kcontrol->private_value >> 8) & 0xff;
++ int shift = (kcontrol->private_value >> 8) & 0x0f;
+ int mask = (kcontrol->private_value >> 16) & 0xff;
+ // int invert = (kcontrol->private_value >> 24) & 0xff;
+ unsigned short value, old, new;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 625cb6c7b7d6..5810be2c6c34 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2256,6 +2256,8 @@ static struct snd_pci_quirk power_save_blacklist[] = {
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+ SND_PCI_QUIRK(0x1849, 0xc892, "Asrock B85M-ITX", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
++ SND_PCI_QUIRK(0x1849, 0x0397, "Asrock N68C-S UCC", 0),
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+ SND_PCI_QUIRK(0x1849, 0x7662, "Asrock H81M-HDS", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+ SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index e58537e13ad3..cf5d26642bcd 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -388,6 +388,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0285:
+ case 0x10ec0298:
+ case 0x10ec0289:
++ case 0x10ec0300:
+ alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+ break;
+ case 0x10ec0275:
+@@ -2830,6 +2831,7 @@ enum {
+ ALC269_TYPE_ALC215,
+ ALC269_TYPE_ALC225,
+ ALC269_TYPE_ALC294,
++ ALC269_TYPE_ALC300,
+ ALC269_TYPE_ALC700,
+ };
+
+@@ -2864,6 +2866,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
+ case ALC269_TYPE_ALC215:
+ case ALC269_TYPE_ALC225:
+ case ALC269_TYPE_ALC294:
++ case ALC269_TYPE_ALC300:
+ case ALC269_TYPE_ALC700:
+ ssids = alc269_ssids;
+ break;
+@@ -5358,6 +5361,16 @@ static void alc274_fixup_bind_dacs(struct hda_codec *codec,
+ spec->gen.preferred_dacs = preferred_pairs;
+ }
+
++/* The DAC of NID 0x3 will introduce click/pop noise on headphones, so invalidate it */
++static void alc285_fixup_invalidate_dacs(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action != HDA_FIXUP_ACT_PRE_PROBE)
++ return;
++
++ snd_hda_override_wcaps(codec, 0x03, 0);
++}
++
+ /* for hda_fixup_thinkpad_acpi() */
+ #include "thinkpad_helper.c"
+
+@@ -5495,6 +5508,8 @@ enum {
+ ALC255_FIXUP_DELL_HEADSET_MIC,
+ ALC295_FIXUP_HP_X360,
+ ALC221_FIXUP_HP_HEADSET_MIC,
++ ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
++ ALC295_FIXUP_HP_AUTO_MUTE,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5659,6 +5674,8 @@ static const struct hda_fixup alc269_fixups[] = {
+ [ALC269_FIXUP_HP_MUTE_LED_MIC3] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc269_fixup_hp_mute_led_mic3,
++ .chained = true,
++ .chain_id = ALC295_FIXUP_HP_AUTO_MUTE
+ },
+ [ALC269_FIXUP_HP_GPIO_LED] = {
+ .type = HDA_FIXUP_FUNC,
+@@ -6362,6 +6379,14 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MIC
+ },
++ [ALC285_FIXUP_LENOVO_HEADPHONE_NOISE] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc285_fixup_invalidate_dacs,
++ },
++ [ALC295_FIXUP_HP_AUTO_MUTE] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_auto_mute_via_amp,
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6532,6 +6557,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
+ SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+@@ -7034,6 +7060,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60130},
+ {0x19, 0x03a11020},
+ {0x21, 0x0321101f}),
++ SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
++ {0x12, 0x90a60130},
++ {0x14, 0x90170110},
++ {0x19, 0x04a11040},
++ {0x21, 0x04211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0288, 0x1028, "Dell", ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x12, 0x90a60120},
+ {0x14, 0x90170110},
+@@ -7295,6 +7326,10 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->gen.mixer_nid = 0; /* ALC2x4 does not have any loopback mixer path */
+ alc_update_coef_idx(codec, 0x6b, 0x0018, (1<<4) | (1<<3)); /* UAJ MIC Vref control by verb */
+ break;
++ case 0x10ec0300:
++ spec->codec_variant = ALC269_TYPE_ALC300;
++ spec->gen.mixer_nid = 0; /* no loopback on ALC300 */
++ break;
+ case 0x10ec0700:
+ case 0x10ec0701:
+ case 0x10ec0703:
+@@ -8404,6 +8439,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ HDA_CODEC_ENTRY(0x10ec0295, "ALC295", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0298, "ALC298", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0299, "ALC299", patch_alc269),
++ HDA_CODEC_ENTRY(0x10ec0300, "ALC300", patch_alc269),
+ HDA_CODEC_REV_ENTRY(0x10ec0861, 0x100340, "ALC660", patch_alc861),
+ HDA_CODEC_ENTRY(0x10ec0660, "ALC660-VD", patch_alc861vd),
+ HDA_CODEC_ENTRY(0x10ec0861, "ALC861", patch_alc861),
+diff --git a/sound/soc/codecs/pcm186x.h b/sound/soc/codecs/pcm186x.h
+index 2c6ba55bf394..bb3f0c42a1cd 100644
+--- a/sound/soc/codecs/pcm186x.h
++++ b/sound/soc/codecs/pcm186x.h
+@@ -139,7 +139,7 @@ enum pcm186x_type {
+ #define PCM186X_MAX_REGISTER PCM186X_CURR_TRIM_CTRL
+
+ /* PCM186X_PAGE */
+-#define PCM186X_RESET 0xff
++#define PCM186X_RESET 0xfe
+
+ /* PCM186X_ADCX_INPUT_SEL_X */
+ #define PCM186X_ADC_INPUT_SEL_POL BIT(7)
+diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+index db6976f4ddaa..9d9f6e41d81c 100644
+--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
++++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+@@ -19,6 +19,7 @@
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+
++#include <linux/dmi.h>
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+@@ -35,6 +36,8 @@
+ #define CHT_PLAT_CLK_3_HZ 19200000
+ #define CHT_CODEC_DAI "HiFi"
+
++#define QUIRK_PMC_PLT_CLK_0 0x01
++
+ struct cht_mc_private {
+ struct clk *mclk;
+ struct snd_soc_jack jack;
+@@ -385,11 +388,29 @@ static struct snd_soc_card snd_soc_card_cht = {
+ .num_controls = ARRAY_SIZE(cht_mc_controls),
+ };
+
++static const struct dmi_system_id cht_max98090_quirk_table[] = {
++ {
++ /* Swanky model Chromebook (Toshiba Chromebook 2) */
++ .matches = {
++ DMI_MATCH(DMI_PRODUCT_NAME, "Swanky"),
++ },
++ .driver_data = (void *)QUIRK_PMC_PLT_CLK_0,
++ },
++ {}
++};
++
+ static int snd_cht_mc_probe(struct platform_device *pdev)
+ {
++ const struct dmi_system_id *dmi_id;
+ struct device *dev = &pdev->dev;
+ int ret_val = 0;
+ struct cht_mc_private *drv;
++ const char *mclk_name;
++ int quirks = 0;
++
++ dmi_id = dmi_first_match(cht_max98090_quirk_table);
++ if (dmi_id)
++ quirks = (unsigned long)dmi_id->driver_data;
+
+ drv = devm_kzalloc(&pdev->dev, sizeof(*drv), GFP_KERNEL);
+ if (!drv)
+@@ -411,11 +432,16 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
+ snd_soc_card_cht.dev = &pdev->dev;
+ snd_soc_card_set_drvdata(&snd_soc_card_cht, drv);
+
+- drv->mclk = devm_clk_get(&pdev->dev, "pmc_plt_clk_3");
++ if (quirks & QUIRK_PMC_PLT_CLK_0)
++ mclk_name = "pmc_plt_clk_0";
++ else
++ mclk_name = "pmc_plt_clk_3";
++
++ drv->mclk = devm_clk_get(&pdev->dev, mclk_name);
+ if (IS_ERR(drv->mclk)) {
+ dev_err(&pdev->dev,
+- "Failed to get MCLK from pmc_plt_clk_3: %ld\n",
+- PTR_ERR(drv->mclk));
++ "Failed to get MCLK from %s: %ld\n",
++ mclk_name, PTR_ERR(drv->mclk));
+ return PTR_ERR(drv->mclk);
+ }
+
+diff --git a/sound/sparc/cs4231.c b/sound/sparc/cs4231.c
+index e73c962590eb..079063d8038d 100644
+--- a/sound/sparc/cs4231.c
++++ b/sound/sparc/cs4231.c
+@@ -1146,10 +1146,8 @@ static int snd_cs4231_playback_open(struct snd_pcm_substream *substream)
+ runtime->hw = snd_cs4231_playback;
+
+ err = snd_cs4231_open(chip, CS4231_MODE_PLAY);
+- if (err < 0) {
+- snd_free_pages(runtime->dma_area, runtime->dma_bytes);
++ if (err < 0)
+ return err;
+- }
+ chip->playback_substream = substream;
+ chip->p_periods_sent = 0;
+ snd_pcm_set_sync(substream);
+@@ -1167,10 +1165,8 @@ static int snd_cs4231_capture_open(struct snd_pcm_substream *substream)
+ runtime->hw = snd_cs4231_capture;
+
+ err = snd_cs4231_open(chip, CS4231_MODE_RECORD);
+- if (err < 0) {
+- snd_free_pages(runtime->dma_area, runtime->dma_bytes);
++ if (err < 0)
+ return err;
+- }
+ chip->capture_substream = substream;
+ chip->c_periods_sent = 0;
+ snd_pcm_set_sync(substream);
+diff --git a/tools/include/uapi/linux/prctl.h b/tools/include/uapi/linux/prctl.h
+index c0d7ea0bf5b6..b17201edfa09 100644
+--- a/tools/include/uapi/linux/prctl.h
++++ b/tools/include/uapi/linux/prctl.h
+@@ -212,6 +212,7 @@ struct prctl_mm_map {
+ #define PR_SET_SPECULATION_CTRL 53
+ /* Speculation control variants */
+ # define PR_SPEC_STORE_BYPASS 0
++# define PR_SPEC_INDIRECT_BRANCH 1
+ /* Return and control values for PR_SET/GET_SPECULATION_CTRL */
+ # define PR_SPEC_NOT_AFFECTED 0
+ # define PR_SPEC_PRCTL (1UL << 0)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-12-08 13:17 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-12-08 13:17 UTC (permalink / raw
To: gentoo-commits
commit: 6066aba76c5f1240fdb5cd93b959030a4f26c147
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 8 13:17:09 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Dec 8 13:17:09 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6066aba7
proj/linux-patches: Linux patch 4.19.8
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1007_linux-4.19.8.patch | 1441 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1445 insertions(+)
diff --git a/0000_README b/0000_README
index 6c79837..79aa888 100644
--- a/0000_README
+++ b/0000_README
@@ -75,6 +75,10 @@ Patch: 1007_linux-4.19.8.patch
From: http://www.kernel.org
Desc: Linux 4.19.8
+Patch: 1008_linux-4.19.9.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.9
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1007_linux-4.19.8.patch b/1007_linux-4.19.8.patch
new file mode 100644
index 0000000..dbc8053
--- /dev/null
+++ b/1007_linux-4.19.8.patch
@@ -0,0 +1,1441 @@
+diff --git a/Makefile b/Makefile
+index d2b4efcfb388..34bc4c752c49 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 7
++SUBLEVEL = 8
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
+index a045f3086047..a90c4f126050 100644
+--- a/arch/arc/Kconfig
++++ b/arch/arc/Kconfig
+@@ -111,7 +111,7 @@ endmenu
+
+ choice
+ prompt "ARC Instruction Set"
+- default ISA_ARCOMPACT
++ default ISA_ARCV2
+
+ config ISA_ARCOMPACT
+ bool "ARCompact ISA"
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index 644815c0516e..16e6cc22e25c 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -6,7 +6,7 @@
+ # published by the Free Software Foundation.
+ #
+
+-KBUILD_DEFCONFIG := nsim_700_defconfig
++KBUILD_DEFCONFIG := nsim_hs_defconfig
+
+ cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
+ cflags-$(CONFIG_ISA_ARCOMPACT) += -mA7
+diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
+index 41bc08be6a3b..020d4493edfd 100644
+--- a/arch/arc/configs/axs101_defconfig
++++ b/arch/arc/configs/axs101_defconfig
+@@ -14,6 +14,7 @@ CONFIG_PERF_EVENTS=y
+ # CONFIG_VM_EVENT_COUNTERS is not set
+ # CONFIG_SLUB_DEBUG is not set
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_MODULES=y
+ CONFIG_MODULE_FORCE_LOAD=y
+ CONFIG_MODULE_UNLOAD=y
+@@ -95,6 +96,7 @@ CONFIG_VFAT_FS=y
+ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
+index 1e1c4a8011b5..666314fffc60 100644
+--- a/arch/arc/configs/axs103_defconfig
++++ b/arch/arc/configs/axs103_defconfig
+@@ -94,6 +94,7 @@ CONFIG_VFAT_FS=y
+ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
+index 6b0c0cfd5c30..429832b8560b 100644
+--- a/arch/arc/configs/axs103_smp_defconfig
++++ b/arch/arc/configs/axs103_smp_defconfig
+@@ -97,6 +97,7 @@ CONFIG_VFAT_FS=y
+ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
+index 1dec2b4bc5e6..2a1d2cbfee1a 100644
+--- a/arch/arc/configs/hsdk_defconfig
++++ b/arch/arc/configs/hsdk_defconfig
+@@ -65,6 +65,7 @@ CONFIG_EXT3_FS=y
+ CONFIG_VFAT_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/nps_defconfig b/arch/arc/configs/nps_defconfig
+index 31ba224bbfb4..6e84060e7c90 100644
+--- a/arch/arc/configs/nps_defconfig
++++ b/arch/arc/configs/nps_defconfig
+@@ -15,6 +15,7 @@ CONFIG_SYSCTL_SYSCALL=y
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_KPROBES=y
+ CONFIG_MODULES=y
+ CONFIG_MODULE_FORCE_LOAD=y
+@@ -73,6 +74,7 @@ CONFIG_PROC_KCORE=y
+ CONFIG_TMPFS=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_ROOT_NFS=y
+ CONFIG_DEBUG_INFO=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
+index 8e0b8b134cd9..219c2a65294b 100644
+--- a/arch/arc/configs/nsim_700_defconfig
++++ b/arch/arc/configs/nsim_700_defconfig
+@@ -15,6 +15,7 @@ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_SLUB_DEBUG is not set
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_KPROBES=y
+ CONFIG_MODULES=y
+ # CONFIG_LBDAF is not set
+diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
+index f14eeff7d308..35dfc6491a09 100644
+--- a/arch/arc/configs/nsimosci_defconfig
++++ b/arch/arc/configs/nsimosci_defconfig
+@@ -15,6 +15,7 @@ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_SLUB_DEBUG is not set
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_KPROBES=y
+ CONFIG_MODULES=y
+ # CONFIG_LBDAF is not set
+@@ -66,5 +67,6 @@ CONFIG_EXT2_FS_XATTR=y
+ CONFIG_TMPFS=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+ # CONFIG_ENABLE_MUST_CHECK is not set
+diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
+index 025298a48305..1638e5bc9672 100644
+--- a/arch/arc/configs/nsimosci_hs_defconfig
++++ b/arch/arc/configs/nsimosci_hs_defconfig
+@@ -65,5 +65,6 @@ CONFIG_EXT2_FS_XATTR=y
+ CONFIG_TMPFS=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+ # CONFIG_ENABLE_MUST_CHECK is not set
+diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
+index df7b77b13b82..11cfbdb0f441 100644
+--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
++++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
+@@ -76,6 +76,7 @@ CONFIG_EXT2_FS_XATTR=y
+ CONFIG_TMPFS=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+ # CONFIG_ENABLE_MUST_CHECK is not set
+ CONFIG_FTRACE=y
+diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig
+index a7f65313f84a..e71ade3cf9c8 100644
+--- a/arch/arc/configs/tb10x_defconfig
++++ b/arch/arc/configs/tb10x_defconfig
+@@ -19,6 +19,7 @@ CONFIG_KALLSYMS_ALL=y
+ # CONFIG_AIO is not set
+ CONFIG_EMBEDDED=y
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_SLAB=y
+ CONFIG_MODULES=y
+ CONFIG_MODULE_FORCE_LOAD=y
+diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
+index db47c3541f15..1e59a2e9c602 100644
+--- a/arch/arc/configs/vdk_hs38_defconfig
++++ b/arch/arc/configs/vdk_hs38_defconfig
+@@ -85,6 +85,7 @@ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_JFFS2_FS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
+index a8ac5e917d9a..b5c3f6c54b03 100644
+--- a/arch/arc/configs/vdk_hs38_smp_defconfig
++++ b/arch/arc/configs/vdk_hs38_smp_defconfig
+@@ -90,6 +90,7 @@ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_JFFS2_FS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arm64/include/asm/ftrace.h b/arch/arm64/include/asm/ftrace.h
+index caa955f10e19..fac54fb050d0 100644
+--- a/arch/arm64/include/asm/ftrace.h
++++ b/arch/arm64/include/asm/ftrace.h
+@@ -56,6 +56,19 @@ static inline bool arch_trace_is_compat_syscall(struct pt_regs *regs)
+ {
+ return is_compat_task();
+ }
++
++#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
++
++static inline bool arch_syscall_match_sym_name(const char *sym,
++ const char *name)
++{
++ /*
++ * Since all syscall functions have __arm64_ prefix, we must skip it.
++ * However, as we described above, we decided to ignore compat
++ * syscalls, so we don't care about __arm64_compat_ prefix here.
++ */
++ return !strcmp(sym + 8, name);
++}
+ #endif /* ifndef __ASSEMBLY__ */
+
+ #endif /* __ASM_FTRACE_H */
+diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
+index 0170602a1e4e..6cf8ffb5367e 100644
+--- a/arch/mips/include/asm/syscall.h
++++ b/arch/mips/include/asm/syscall.h
+@@ -73,7 +73,7 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
+ #ifdef CONFIG_64BIT
+ case 4: case 5: case 6: case 7:
+ #ifdef CONFIG_MIPS32_O32
+- if (test_thread_flag(TIF_32BIT_REGS))
++ if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
+ return get_user(*arg, (int *)usp + n);
+ else
+ #endif
+diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
+index 41b71c4352c2..c1ce6f43642b 100644
+--- a/arch/mips/ralink/mt7620.c
++++ b/arch/mips/ralink/mt7620.c
+@@ -84,7 +84,7 @@ static struct rt2880_pmx_func pcie_rst_grp[] = {
+ };
+ static struct rt2880_pmx_func nd_sd_grp[] = {
+ FUNC("nand", MT7620_GPIO_MODE_NAND, 45, 15),
+- FUNC("sd", MT7620_GPIO_MODE_SD, 45, 15)
++ FUNC("sd", MT7620_GPIO_MODE_SD, 47, 13)
+ };
+
+ static struct rt2880_pmx_group mt7620a_pinmux_data[] = {
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 4397fa0c448f..f1d3fe5a0c65 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1663,20 +1663,23 @@ static u64 *avic_get_physical_id_entry(struct kvm_vcpu *vcpu,
+ static int avic_init_access_page(struct kvm_vcpu *vcpu)
+ {
+ struct kvm *kvm = vcpu->kvm;
+- int ret;
++ int ret = 0;
+
++ mutex_lock(&kvm->slots_lock);
+ if (kvm->arch.apic_access_page_done)
+- return 0;
++ goto out;
+
+- ret = x86_set_memory_region(kvm,
+- APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
+- APIC_DEFAULT_PHYS_BASE,
+- PAGE_SIZE);
++ ret = __x86_set_memory_region(kvm,
++ APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
++ APIC_DEFAULT_PHYS_BASE,
++ PAGE_SIZE);
+ if (ret)
+- return ret;
++ goto out;
+
+ kvm->arch.apic_access_page_done = true;
+- return 0;
++out:
++ mutex_unlock(&kvm->slots_lock);
++ return ret;
+ }
+
+ static int avic_init_backing_page(struct kvm_vcpu *vcpu)
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index e3c39ea8e17b..23a53b67cf0d 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1747,7 +1747,7 @@ insert:
+ if (bypass_insert)
+ return BLK_STS_RESOURCE;
+
+- blk_mq_sched_insert_request(rq, false, run_queue, false);
++ blk_mq_request_bypass_insert(rq, run_queue);
+ return BLK_STS_OK;
+ }
+
+@@ -1763,7 +1763,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
+
+ ret = __blk_mq_try_issue_directly(hctx, rq, cookie, false);
+ if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE)
+- blk_mq_sched_insert_request(rq, false, true, false);
++ blk_mq_request_bypass_insert(rq, true);
+ else if (ret != BLK_STS_OK)
+ blk_mq_end_request(rq, ret);
+
+@@ -1798,7 +1798,8 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
+ if (ret != BLK_STS_OK) {
+ if (ret == BLK_STS_RESOURCE ||
+ ret == BLK_STS_DEV_RESOURCE) {
+- list_add(&rq->queuelist, list);
++ blk_mq_request_bypass_insert(rq,
++ list_empty(list));
+ break;
+ }
+ blk_mq_end_request(rq, ret);
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 4cc45a1d21db..59445c83f023 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -374,6 +374,8 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ master->connector_id);
+
+ aconnector->mst_encoder = dm_dp_create_fake_mst_encoder(master);
++ drm_connector_attach_encoder(&aconnector->base,
++ &aconnector->mst_encoder->base);
+
+ /*
+ * TODO: understand why this one is needed
+diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
+index dac355812adc..373700c05a00 100644
+--- a/drivers/gpu/drm/ast/ast_main.c
++++ b/drivers/gpu/drm/ast/ast_main.c
+@@ -583,7 +583,8 @@ void ast_driver_unload(struct drm_device *dev)
+ drm_mode_config_cleanup(dev);
+
+ ast_mm_fini(ast);
+- pci_iounmap(dev->pdev, ast->ioregs);
++ if (ast->ioregs != ast->regs + AST_IO_MM_OFFSET)
++ pci_iounmap(dev->pdev, ast->ioregs);
+ pci_iounmap(dev->pdev, ast->regs);
+ kfree(ast);
+ }
+diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
+index d9c0f7573905..1669c42c40ed 100644
+--- a/drivers/gpu/drm/drm_auth.c
++++ b/drivers/gpu/drm/drm_auth.c
+@@ -142,6 +142,7 @@ static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
+
+ lockdep_assert_held_once(&dev->master_mutex);
+
++ WARN_ON(fpriv->is_master);
+ old_master = fpriv->master;
+ fpriv->master = drm_master_create(dev);
+ if (!fpriv->master) {
+@@ -170,6 +171,7 @@ out_err:
+ /* drop references and restore old master on failure */
+ drm_master_put(&fpriv->master);
+ fpriv->master = old_master;
++ fpriv->is_master = 0;
+
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/meson/meson_crtc.c b/drivers/gpu/drm/meson/meson_crtc.c
+index 05520202c967..191b314f9e9e 100644
+--- a/drivers/gpu/drm/meson/meson_crtc.c
++++ b/drivers/gpu/drm/meson/meson_crtc.c
+@@ -45,6 +45,7 @@ struct meson_crtc {
+ struct drm_crtc base;
+ struct drm_pending_vblank_event *event;
+ struct meson_drm *priv;
++ bool enabled;
+ };
+ #define to_meson_crtc(x) container_of(x, struct meson_crtc, base)
+
+@@ -80,8 +81,7 @@ static const struct drm_crtc_funcs meson_crtc_funcs = {
+
+ };
+
+-static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
+- struct drm_crtc_state *old_state)
++static void meson_crtc_enable(struct drm_crtc *crtc)
+ {
+ struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
+ struct drm_crtc_state *crtc_state = crtc->state;
+@@ -101,6 +101,22 @@ static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
+ writel_bits_relaxed(VPP_POSTBLEND_ENABLE, VPP_POSTBLEND_ENABLE,
+ priv->io_base + _REG(VPP_MISC));
+
++ drm_crtc_vblank_on(crtc);
++
++ meson_crtc->enabled = true;
++}
++
++static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
++ struct drm_crtc_state *old_state)
++{
++ struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
++ struct meson_drm *priv = meson_crtc->priv;
++
++ DRM_DEBUG_DRIVER("\n");
++
++ if (!meson_crtc->enabled)
++ meson_crtc_enable(crtc);
++
+ priv->viu.osd1_enabled = true;
+ }
+
+@@ -110,6 +126,8 @@ static void meson_crtc_atomic_disable(struct drm_crtc *crtc,
+ struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
+ struct meson_drm *priv = meson_crtc->priv;
+
++ drm_crtc_vblank_off(crtc);
++
+ priv->viu.osd1_enabled = false;
+ priv->viu.osd1_commit = false;
+
+@@ -124,6 +142,8 @@ static void meson_crtc_atomic_disable(struct drm_crtc *crtc,
+
+ crtc->state->event = NULL;
+ }
++
++ meson_crtc->enabled = false;
+ }
+
+ static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
+@@ -132,6 +152,9 @@ static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
+ struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
+ unsigned long flags;
+
++ if (crtc->state->enable && !meson_crtc->enabled)
++ meson_crtc_enable(crtc);
++
+ if (crtc->state->event) {
+ WARN_ON(drm_crtc_vblank_get(crtc) != 0);
+
+diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+index df7247cd93f9..2cb2ad26d716 100644
+--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
++++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+@@ -706,6 +706,7 @@ static const struct regmap_config meson_dw_hdmi_regmap_config = {
+ .reg_read = meson_dw_hdmi_reg_read,
+ .reg_write = meson_dw_hdmi_reg_write,
+ .max_register = 0x10000,
++ .fast_io = true,
+ };
+
+ static bool meson_hdmi_connector_is_available(struct device *dev)
+diff --git a/drivers/gpu/drm/meson/meson_venc.c b/drivers/gpu/drm/meson/meson_venc.c
+index 514245e69b38..14aac661f38b 100644
+--- a/drivers/gpu/drm/meson/meson_venc.c
++++ b/drivers/gpu/drm/meson/meson_venc.c
+@@ -71,6 +71,7 @@
+ */
+
+ /* HHI Registers */
++#define HHI_GCLK_MPEG2 0x148 /* 0x52 offset in data sheet */
+ #define HHI_VDAC_CNTL0 0x2F4 /* 0xbd offset in data sheet */
+ #define HHI_VDAC_CNTL1 0x2F8 /* 0xbe offset in data sheet */
+ #define HHI_HDMI_PHY_CNTL0 0x3a0 /* 0xe8 offset in data sheet */
+@@ -1529,10 +1530,12 @@ unsigned int meson_venci_get_field(struct meson_drm *priv)
+ void meson_venc_enable_vsync(struct meson_drm *priv)
+ {
+ writel_relaxed(2, priv->io_base + _REG(VENC_INTCTRL));
++ regmap_update_bits(priv->hhi, HHI_GCLK_MPEG2, BIT(25), BIT(25));
+ }
+
+ void meson_venc_disable_vsync(struct meson_drm *priv)
+ {
++ regmap_update_bits(priv->hhi, HHI_GCLK_MPEG2, BIT(25), 0);
+ writel_relaxed(0, priv->io_base + _REG(VENC_INTCTRL));
+ }
+
+diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c
+index 6bcfa527c180..26a0857878bf 100644
+--- a/drivers/gpu/drm/meson/meson_viu.c
++++ b/drivers/gpu/drm/meson/meson_viu.c
+@@ -184,18 +184,18 @@ void meson_viu_set_osd_lut(struct meson_drm *priv, enum viu_lut_sel_e lut_sel,
+ if (lut_sel == VIU_LUT_OSD_OETF) {
+ writel(0, priv->io_base + _REG(addr_port));
+
+- for (i = 0; i < 20; i++)
++ for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
+ writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16),
+ priv->io_base + _REG(data_port));
+
+ writel(r_map[OSD_OETF_LUT_SIZE - 1] | (g_map[0] << 16),
+ priv->io_base + _REG(data_port));
+
+- for (i = 0; i < 20; i++)
++ for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
+ writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16),
+ priv->io_base + _REG(data_port));
+
+- for (i = 0; i < 20; i++)
++ for (i = 0; i < (OSD_OETF_LUT_SIZE / 2); i++)
+ writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16),
+ priv->io_base + _REG(data_port));
+
+@@ -211,18 +211,18 @@ void meson_viu_set_osd_lut(struct meson_drm *priv, enum viu_lut_sel_e lut_sel,
+ } else if (lut_sel == VIU_LUT_OSD_EOTF) {
+ writel(0, priv->io_base + _REG(addr_port));
+
+- for (i = 0; i < 20; i++)
++ for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
+ writel(r_map[i * 2] | (r_map[i * 2 + 1] << 16),
+ priv->io_base + _REG(data_port));
+
+ writel(r_map[OSD_EOTF_LUT_SIZE - 1] | (g_map[0] << 16),
+ priv->io_base + _REG(data_port));
+
+- for (i = 0; i < 20; i++)
++ for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
+ writel(g_map[i * 2 + 1] | (g_map[i * 2 + 2] << 16),
+ priv->io_base + _REG(data_port));
+
+- for (i = 0; i < 20; i++)
++ for (i = 0; i < (OSD_EOTF_LUT_SIZE / 2); i++)
+ writel(b_map[i * 2] | (b_map[i * 2 + 1] << 16),
+ priv->io_base + _REG(data_port));
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index c414f3809e5c..50be240df331 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1094,31 +1094,26 @@ enum mlx5_ib_width {
+ MLX5_IB_WIDTH_12X = 1 << 4
+ };
+
+-static int translate_active_width(struct ib_device *ibdev, u8 active_width,
++static void translate_active_width(struct ib_device *ibdev, u8 active_width,
+ u8 *ib_width)
+ {
+ struct mlx5_ib_dev *dev = to_mdev(ibdev);
+- int err = 0;
+
+- if (active_width & MLX5_IB_WIDTH_1X) {
++ if (active_width & MLX5_IB_WIDTH_1X)
+ *ib_width = IB_WIDTH_1X;
+- } else if (active_width & MLX5_IB_WIDTH_2X) {
+- mlx5_ib_dbg(dev, "active_width %d is not supported by IB spec\n",
+- (int)active_width);
+- err = -EINVAL;
+- } else if (active_width & MLX5_IB_WIDTH_4X) {
++ else if (active_width & MLX5_IB_WIDTH_4X)
+ *ib_width = IB_WIDTH_4X;
+- } else if (active_width & MLX5_IB_WIDTH_8X) {
++ else if (active_width & MLX5_IB_WIDTH_8X)
+ *ib_width = IB_WIDTH_8X;
+- } else if (active_width & MLX5_IB_WIDTH_12X) {
++ else if (active_width & MLX5_IB_WIDTH_12X)
+ *ib_width = IB_WIDTH_12X;
+- } else {
+- mlx5_ib_dbg(dev, "Invalid active_width %d\n",
++ else {
++ mlx5_ib_dbg(dev, "Invalid active_width %d, setting width to default value: 4x\n",
+ (int)active_width);
+- err = -EINVAL;
++ *ib_width = IB_WIDTH_4X;
+ }
+
+- return err;
++ return;
+ }
+
+ static int mlx5_mtu_to_ib_mtu(int mtu)
+@@ -1225,10 +1220,8 @@ static int mlx5_query_hca_port(struct ib_device *ibdev, u8 port,
+ if (err)
+ goto out;
+
+- err = translate_active_width(ibdev, ib_link_width_oper,
+- &props->active_width);
+- if (err)
+- goto out;
++ translate_active_width(ibdev, ib_link_width_oper, &props->active_width);
++
+ err = mlx5_query_port_ib_proto_oper(mdev, &props->active_speed, port);
+ if (err)
+ goto out;
+diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
+index b686a4aaffe8..bee8c0b1d6a5 100644
+--- a/drivers/infiniband/ulp/iser/iser_verbs.c
++++ b/drivers/infiniband/ulp/iser/iser_verbs.c
+@@ -1123,7 +1123,9 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
+ IB_MR_CHECK_SIG_STATUS, &mr_status);
+ if (ret) {
+ pr_err("ib_check_mr_status failed, ret %d\n", ret);
+- goto err;
++ /* Not a lot we can do, return ambiguous guard error */
++ *sector = 0;
++ return 0x1;
+ }
+
+ if (mr_status.fail_status & IB_MR_CHECK_SIG_STATUS) {
+@@ -1151,9 +1153,6 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
+ }
+
+ return 0;
+-err:
+- /* Not alot we can do here, return ambiguous guard error */
+- return 0x1;
+ }
+
+ void iser_err_comp(struct ib_wc *wc, const char *type)
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index d4b9db487b16..cfc8b94527b9 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -480,18 +480,18 @@ static const u8 xboxone_hori_init[] = {
+ };
+
+ /*
+- * This packet is required for some of the PDP pads to start
++ * This packet is required for most (all?) of the PDP pads to start
+ * sending input reports. These pads include: (0x0e6f:0x02ab),
+- * (0x0e6f:0x02a4).
++ * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
+ */
+ static const u8 xboxone_pdp_init1[] = {
+ 0x0a, 0x20, 0x00, 0x03, 0x00, 0x01, 0x14
+ };
+
+ /*
+- * This packet is required for some of the PDP pads to start
++ * This packet is required for most (all?) of the PDP pads to start
+ * sending input reports. These pads include: (0x0e6f:0x02ab),
+- * (0x0e6f:0x02a4).
++ * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
+ */
+ static const u8 xboxone_pdp_init2[] = {
+ 0x06, 0x20, 0x00, 0x02, 0x01, 0x00
+@@ -527,12 +527,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
+ XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
+ XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
+ XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
+- XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init1),
+- XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init2),
+- XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init1),
+- XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init2),
+- XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init1),
+- XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init2),
++ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1),
++ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2),
+ XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
+ XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init),
+ XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
+diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
+index 81be6f781f0b..d56001181598 100644
+--- a/drivers/input/keyboard/cros_ec_keyb.c
++++ b/drivers/input/keyboard/cros_ec_keyb.c
+@@ -493,7 +493,8 @@ static int cros_ec_keyb_register_bs(struct cros_ec_keyb *ckdev)
+ for (i = 0; i < ARRAY_SIZE(cros_ec_keyb_bs); i++) {
+ const struct cros_ec_bs_map *map = &cros_ec_keyb_bs[i];
+
+- if (buttons & BIT(map->bit))
++ if ((map->ev_type == EV_KEY && (buttons & BIT(map->bit))) ||
++ (map->ev_type == EV_SW && (switches & BIT(map->bit))))
+ input_set_capability(idev, map->ev_type, map->code);
+ }
+
+diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
+index f51ae09596ef..403452ef00e6 100644
+--- a/drivers/input/keyboard/matrix_keypad.c
++++ b/drivers/input/keyboard/matrix_keypad.c
+@@ -407,7 +407,7 @@ matrix_keypad_parse_dt(struct device *dev)
+ struct matrix_keypad_platform_data *pdata;
+ struct device_node *np = dev->of_node;
+ unsigned int *gpios;
+- int i, nrow, ncol;
++ int ret, i, nrow, ncol;
+
+ if (!np) {
+ dev_err(dev, "device lacks DT data\n");
+@@ -452,12 +452,19 @@ matrix_keypad_parse_dt(struct device *dev)
+ return ERR_PTR(-ENOMEM);
+ }
+
+- for (i = 0; i < pdata->num_row_gpios; i++)
+- gpios[i] = of_get_named_gpio(np, "row-gpios", i);
++ for (i = 0; i < nrow; i++) {
++ ret = of_get_named_gpio(np, "row-gpios", i);
++ if (ret < 0)
++ return ERR_PTR(ret);
++ gpios[i] = ret;
++ }
+
+- for (i = 0; i < pdata->num_col_gpios; i++)
+- gpios[pdata->num_row_gpios + i] =
+- of_get_named_gpio(np, "col-gpios", i);
++ for (i = 0; i < ncol; i++) {
++ ret = of_get_named_gpio(np, "col-gpios", i);
++ if (ret < 0)
++ return ERR_PTR(ret);
++ gpios[nrow + i] = ret;
++ }
+
+ pdata->row_gpios = gpios;
+ pdata->col_gpios = &gpios[pdata->num_row_gpios];
+@@ -484,10 +491,8 @@ static int matrix_keypad_probe(struct platform_device *pdev)
+ pdata = dev_get_platdata(&pdev->dev);
+ if (!pdata) {
+ pdata = matrix_keypad_parse_dt(&pdev->dev);
+- if (IS_ERR(pdata)) {
+- dev_err(&pdev->dev, "no platform data defined\n");
++ if (IS_ERR(pdata))
+ return PTR_ERR(pdata);
+- }
+ } else if (!pdata->keymap_data) {
+ dev_err(&pdev->dev, "no keymap data defined\n");
+ return -EINVAL;
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index b0f9d19b3410..a94b6494e71a 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1348,6 +1348,9 @@ static const struct acpi_device_id elan_acpi_id[] = {
+ { "ELAN0618", 0 },
+ { "ELAN061C", 0 },
+ { "ELAN061D", 0 },
++ { "ELAN061E", 0 },
++ { "ELAN0620", 0 },
++ { "ELAN0621", 0 },
+ { "ELAN0622", 0 },
+ { "ELAN1000", 0 },
+ { }
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 5e85f3cca867..c42813d50591 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -170,6 +170,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0048", /* X1 Carbon 3 */
+ "LEN0046", /* X250 */
+ "LEN004a", /* W541 */
++ "LEN005b", /* P50 */
+ "LEN0071", /* T480 */
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN0073", /* X1 Carbon G5 (Elantech) */
+diff --git a/drivers/mtd/nand/bbt.c b/drivers/mtd/nand/bbt.c
+index 56cde38b92c0..044adf913854 100644
+--- a/drivers/mtd/nand/bbt.c
++++ b/drivers/mtd/nand/bbt.c
+@@ -27,7 +27,8 @@ int nanddev_bbt_init(struct nand_device *nand)
+ unsigned int nwords = DIV_ROUND_UP(nblocks * bits_per_block,
+ BITS_PER_LONG);
+
+- nand->bbt.cache = kzalloc(nwords, GFP_KERNEL);
++ nand->bbt.cache = kcalloc(nwords, sizeof(*nand->bbt.cache),
++ GFP_KERNEL);
+ if (!nand->bbt.cache)
+ return -ENOMEM;
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 6eccfa82ca94..3c342700bf5f 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -1409,7 +1409,7 @@ void __i40e_del_filter(struct i40e_vsi *vsi, struct i40e_mac_filter *f)
+ }
+
+ vsi->flags |= I40E_VSI_FLAG_FILTER_CHANGED;
+- set_bit(__I40E_MACVLAN_SYNC_PENDING, vsi->state);
++ set_bit(__I40E_MACVLAN_SYNC_PENDING, vsi->back->state);
+ }
+
+ /**
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index f3cae733ae2d..9acb5b44ce4c 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -167,7 +167,11 @@ lpfc_config_port_prep(struct lpfc_hba *phba)
+ sizeof(phba->wwpn));
+ }
+
+- phba->sli3_options = 0x0;
++ /*
++ * Clear all option bits except LPFC_SLI3_BG_ENABLED,
++ * which was already set in lpfc_get_cfgparam()
++ */
++ phba->sli3_options &= (uint32_t)LPFC_SLI3_BG_ENABLED;
+
+ /* Setup and issue mailbox READ REV command */
+ lpfc_read_rev(phba, pmb);
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index a95c823cd1a4..be2bac9355cd 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -4969,7 +4969,6 @@ lpfc_sli_config_port(struct lpfc_hba *phba, int sli_mode)
+ phba->sli3_options &= ~(LPFC_SLI3_NPIV_ENABLED |
+ LPFC_SLI3_HBQ_ENABLED |
+ LPFC_SLI3_CRP_ENABLED |
+- LPFC_SLI3_BG_ENABLED |
+ LPFC_SLI3_DSS_ENABLED);
+ if (rc != MBX_SUCCESS) {
+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index f4d0ef695225..8a111ab33b50 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -128,24 +128,6 @@ static void kgdboc_unregister_kbd(void)
+ #define kgdboc_restore_input()
+ #endif /* ! CONFIG_KDB_KEYBOARD */
+
+-static int kgdboc_option_setup(char *opt)
+-{
+- if (!opt) {
+- pr_err("kgdboc: config string not provided\n");
+- return -EINVAL;
+- }
+-
+- if (strlen(opt) >= MAX_CONFIG_LEN) {
+- printk(KERN_ERR "kgdboc: config string too long\n");
+- return -ENOSPC;
+- }
+- strcpy(config, opt);
+-
+- return 0;
+-}
+-
+-__setup("kgdboc=", kgdboc_option_setup);
+-
+ static void cleanup_kgdboc(void)
+ {
+ if (kgdb_unregister_nmi_console())
+@@ -159,15 +141,13 @@ static int configure_kgdboc(void)
+ {
+ struct tty_driver *p;
+ int tty_line = 0;
+- int err;
++ int err = -ENODEV;
+ char *cptr = config;
+ struct console *cons;
+
+- err = kgdboc_option_setup(config);
+- if (err || !strlen(config) || isspace(config[0]))
++ if (!strlen(config) || isspace(config[0]))
+ goto noconfig;
+
+- err = -ENODEV;
+ kgdboc_io_ops.is_console = 0;
+ kgdb_tty_driver = NULL;
+
+@@ -316,6 +296,25 @@ static struct kgdb_io kgdboc_io_ops = {
+ };
+
+ #ifdef CONFIG_KGDB_SERIAL_CONSOLE
++static int kgdboc_option_setup(char *opt)
++{
++ if (!opt) {
++ pr_err("config string not provided\n");
++ return -EINVAL;
++ }
++
++ if (strlen(opt) >= MAX_CONFIG_LEN) {
++ pr_err("config string too long\n");
++ return -ENOSPC;
++ }
++ strcpy(config, opt);
++
++ return 0;
++}
++
++__setup("kgdboc=", kgdboc_option_setup);
++
++
+ /* This is only available if kgdboc is a built in for early debugging */
+ static int __init kgdboc_early_init(char *opt)
+ {
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index d385778b628c..3ec712cba58e 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -389,13 +389,11 @@ static int check_block_group_item(struct btrfs_fs_info *fs_info,
+
+ /*
+ * Here we don't really care about alignment since extent allocator can
+- * handle it. We care more about the size, as if one block group is
+- * larger than maximum size, it's must be some obvious corruption.
++ * handle it. We care more about the size.
+ */
+- if (key->offset > BTRFS_MAX_DATA_CHUNK_SIZE || key->offset == 0) {
++ if (key->offset == 0) {
+ block_group_err(fs_info, leaf, slot,
+- "invalid block group size, have %llu expect (0, %llu]",
+- key->offset, BTRFS_MAX_DATA_CHUNK_SIZE);
++ "invalid block group size 0");
+ return -EUCLEAN;
+ }
+
+diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
+index 538ba1a58f5b..e9de8ad0bad7 100644
+--- a/include/linux/tracepoint.h
++++ b/include/linux/tracepoint.h
+@@ -166,7 +166,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
+ struct tracepoint_func *it_func_ptr; \
+ void *it_func; \
+ void *__data; \
+- int __maybe_unused idx = 0; \
++ int __maybe_unused __idx = 0; \
+ \
+ if (!(cond)) \
+ return; \
+@@ -182,7 +182,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
+ * doesn't work from the idle path. \
+ */ \
+ if (rcuidle) { \
+- idx = srcu_read_lock_notrace(&tracepoint_srcu); \
++ __idx = srcu_read_lock_notrace(&tracepoint_srcu);\
+ rcu_irq_enter_irqson(); \
+ } \
+ \
+@@ -198,7 +198,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
+ \
+ if (rcuidle) { \
+ rcu_irq_exit_irqson(); \
+- srcu_read_unlock_notrace(&tracepoint_srcu, idx);\
++ srcu_read_unlock_notrace(&tracepoint_srcu, __idx);\
+ } \
+ \
+ preempt_enable_notrace(); \
+diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
+index 0be866c91f62..5e1a7578c9ed 100644
+--- a/include/trace/events/sched.h
++++ b/include/trace/events/sched.h
+@@ -107,6 +107,8 @@ DEFINE_EVENT(sched_wakeup_template, sched_wakeup_new,
+ #ifdef CREATE_TRACE_POINTS
+ static inline long __trace_sched_switch_state(bool preempt, struct task_struct *p)
+ {
++ unsigned int state;
++
+ #ifdef CONFIG_SCHED_DEBUG
+ BUG_ON(p != current);
+ #endif /* CONFIG_SCHED_DEBUG */
+@@ -118,7 +120,15 @@ static inline long __trace_sched_switch_state(bool preempt, struct task_struct *
+ if (preempt)
+ return TASK_REPORT_MAX;
+
+- return 1 << task_state_index(p);
++ /*
++ * task_state_index() uses fls() and returns a value from 0-8 range.
++ * Decrement it by 1 (except TASK_RUNNING state i.e 0) before using
++ * it for left shift operation to get the correct task->state
++ * mapping.
++ */
++ state = task_state_index(p);
++
++ return state ? (1 << (state - 1)) : state;
+ }
+ #endif /* CREATE_TRACE_POINTS */
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 3207a4d26849..578d4ac54484 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -616,7 +616,7 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
+ BUG_ON((uprobe->offset & ~PAGE_MASK) +
+ UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
+
+- smp_wmb(); /* pairs with rmb() in find_active_uprobe() */
++ smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */
+ set_bit(UPROBE_COPY_INSN, &uprobe->flags);
+
+ out:
+@@ -1914,10 +1914,18 @@ static void handle_swbp(struct pt_regs *regs)
+ * After we hit the bp, _unregister + _register can install the
+ * new and not-yet-analyzed uprobe at the same address, restart.
+ */
+- smp_rmb(); /* pairs with wmb() in install_breakpoint() */
+ if (unlikely(!test_bit(UPROBE_COPY_INSN, &uprobe->flags)))
+ goto out;
+
++ /*
++ * Pairs with the smp_wmb() in prepare_uprobe().
++ *
++ * Guarantees that if we see the UPROBE_COPY_INSN bit set, then
++ * we must also see the stores to &uprobe->arch performed by the
++ * prepare_uprobe() call.
++ */
++ smp_rmb();
++
+ /* Tracing handlers use ->utask to communicate with fetch methods */
+ if (!get_utask())
+ goto out;
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 3b8c0e24ab30..447bd96ee658 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -512,12 +512,44 @@ enum {
+ * can only be modified by current, we can reuse trace_recursion.
+ */
+ TRACE_IRQ_BIT,
++
++ /* Set if the function is in the set_graph_function file */
++ TRACE_GRAPH_BIT,
++
++ /*
++ * In the very unlikely case that an interrupt came in
++ * at a start of graph tracing, and we want to trace
++ * the function in that interrupt, the depth can be greater
++ * than zero, because of the preempted start of a previous
++ * trace. In an even more unlikely case, depth could be 2
++ * if a softirq interrupted the start of graph tracing,
++ * followed by an interrupt preempting a start of graph
++ * tracing in the softirq, and depth can even be 3
++ * if an NMI came in at the start of an interrupt function
++ * that preempted a softirq start of a function that
++ * preempted normal context!!!! Luckily, it can't be
++ * greater than 3, so the next two bits are a mask
++ * of what the depth is when we set TRACE_GRAPH_BIT
++ */
++
++ TRACE_GRAPH_DEPTH_START_BIT,
++ TRACE_GRAPH_DEPTH_END_BIT,
+ };
+
+ #define trace_recursion_set(bit) do { (current)->trace_recursion |= (1<<(bit)); } while (0)
+ #define trace_recursion_clear(bit) do { (current)->trace_recursion &= ~(1<<(bit)); } while (0)
+ #define trace_recursion_test(bit) ((current)->trace_recursion & (1<<(bit)))
+
++#define trace_recursion_depth() \
++ (((current)->trace_recursion >> TRACE_GRAPH_DEPTH_START_BIT) & 3)
++#define trace_recursion_set_depth(depth) \
++ do { \
++ current->trace_recursion &= \
++ ~(3 << TRACE_GRAPH_DEPTH_START_BIT); \
++ current->trace_recursion |= \
++ ((depth) & 3) << TRACE_GRAPH_DEPTH_START_BIT; \
++ } while (0)
++
+ #define TRACE_CONTEXT_BITS 4
+
+ #define TRACE_FTRACE_START TRACE_FTRACE_BIT
+@@ -843,8 +875,9 @@ extern void __trace_graph_return(struct trace_array *tr,
+ extern struct ftrace_hash *ftrace_graph_hash;
+ extern struct ftrace_hash *ftrace_graph_notrace_hash;
+
+-static inline int ftrace_graph_addr(unsigned long addr)
++static inline int ftrace_graph_addr(struct ftrace_graph_ent *trace)
+ {
++ unsigned long addr = trace->func;
+ int ret = 0;
+
+ preempt_disable_notrace();
+@@ -855,6 +888,14 @@ static inline int ftrace_graph_addr(unsigned long addr)
+ }
+
+ if (ftrace_lookup_ip(ftrace_graph_hash, addr)) {
++
++ /*
++ * This needs to be cleared on the return functions
++ * when the depth is zero.
++ */
++ trace_recursion_set(TRACE_GRAPH_BIT);
++ trace_recursion_set_depth(trace->depth);
++
+ /*
+ * If no irqs are to be traced, but a set_graph_function
+ * is set, and called by an interrupt handler, we still
+@@ -872,6 +913,13 @@ out:
+ return ret;
+ }
+
++static inline void ftrace_graph_addr_finish(struct ftrace_graph_ret *trace)
++{
++ if (trace_recursion_test(TRACE_GRAPH_BIT) &&
++ trace->depth == trace_recursion_depth())
++ trace_recursion_clear(TRACE_GRAPH_BIT);
++}
++
+ static inline int ftrace_graph_notrace_addr(unsigned long addr)
+ {
+ int ret = 0;
+@@ -885,7 +933,7 @@ static inline int ftrace_graph_notrace_addr(unsigned long addr)
+ return ret;
+ }
+ #else
+-static inline int ftrace_graph_addr(unsigned long addr)
++static inline int ftrace_graph_addr(struct ftrace_graph_ent *trace)
+ {
+ return 1;
+ }
+@@ -894,6 +942,8 @@ static inline int ftrace_graph_notrace_addr(unsigned long addr)
+ {
+ return 0;
+ }
++static inline void ftrace_graph_addr_finish(struct ftrace_graph_ret *trace)
++{ }
+ #endif /* CONFIG_DYNAMIC_FTRACE */
+
+ extern unsigned int fgraph_max_depth;
+@@ -901,7 +951,8 @@ extern unsigned int fgraph_max_depth;
+ static inline bool ftrace_graph_ignore_func(struct ftrace_graph_ent *trace)
+ {
+ /* trace it when it is-nested-in or is a function enabled. */
+- return !(trace->depth || ftrace_graph_addr(trace->func)) ||
++ return !(trace_recursion_test(TRACE_GRAPH_BIT) ||
++ ftrace_graph_addr(trace)) ||
+ (trace->depth < 0) ||
+ (fgraph_max_depth && trace->depth >= fgraph_max_depth);
+ }
+diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
+index 2561460d7baf..086af4f5c3e8 100644
+--- a/kernel/trace/trace_functions_graph.c
++++ b/kernel/trace/trace_functions_graph.c
+@@ -509,6 +509,8 @@ void trace_graph_return(struct ftrace_graph_ret *trace)
+ int cpu;
+ int pc;
+
++ ftrace_graph_addr_finish(trace);
++
+ local_irq_save(flags);
+ cpu = raw_smp_processor_id();
+ data = per_cpu_ptr(tr->trace_buffer.data, cpu);
+@@ -532,6 +534,8 @@ void set_graph_array(struct trace_array *tr)
+
+ static void trace_graph_thresh_return(struct ftrace_graph_ret *trace)
+ {
++ ftrace_graph_addr_finish(trace);
++
+ if (tracing_thresh &&
+ (trace->rettime - trace->calltime < tracing_thresh))
+ return;
+diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
+index b7357f9f82a3..98ea6d28df15 100644
+--- a/kernel/trace/trace_irqsoff.c
++++ b/kernel/trace/trace_irqsoff.c
+@@ -208,6 +208,8 @@ static void irqsoff_graph_return(struct ftrace_graph_ret *trace)
+ unsigned long flags;
+ int pc;
+
++ ftrace_graph_addr_finish(trace);
++
+ if (!func_prolog_dec(tr, &data, &flags))
+ return;
+
+diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
+index a86b303e6c67..7d04b9890755 100644
+--- a/kernel/trace/trace_sched_wakeup.c
++++ b/kernel/trace/trace_sched_wakeup.c
+@@ -270,6 +270,8 @@ static void wakeup_graph_return(struct ftrace_graph_ret *trace)
+ unsigned long flags;
+ int pc;
+
++ ftrace_graph_addr_finish(trace);
++
+ if (!func_prolog_preempt_disable(tr, &data, &pc))
+ return;
+
+diff --git a/lib/test_hexdump.c b/lib/test_hexdump.c
+index 626f580b4ff7..5144899d3c6b 100644
+--- a/lib/test_hexdump.c
++++ b/lib/test_hexdump.c
+@@ -99,7 +99,7 @@ static void __init test_hexdump_prepare_test(size_t len, int rowsize,
+ const char *q = *result++;
+ size_t amount = strlen(q);
+
+- strncpy(p, q, amount);
++ memcpy(p, q, amount);
+ p += amount;
+
+ *p++ = ' ';
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 1931a3d9b282..309fb8c969af 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4080,7 +4080,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
+
+ /* fallback to copy_from_user outside mmap_sem */
+ if (unlikely(ret)) {
+- ret = -EFAULT;
++ ret = -ENOENT;
+ *pagep = page;
+ /* don't free the page */
+ goto out;
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 0b02b539072e..b6cf0e8e685b 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2264,6 +2264,7 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
+ struct page *page;
+ pte_t _dst_pte, *dst_pte;
+ int ret;
++ pgoff_t offset, max_off;
+
+ ret = -ENOMEM;
+ if (!shmem_inode_acct_block(inode, 1))
+@@ -2286,7 +2287,7 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
+ *pagep = page;
+ shmem_inode_unacct_blocks(inode, 1);
+ /* don't free the page */
+- return -EFAULT;
++ return -ENOENT;
+ }
+ } else { /* mfill_zeropage_atomic */
+ clear_highpage(page);
+@@ -2301,6 +2302,12 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
+ __SetPageSwapBacked(page);
+ __SetPageUptodate(page);
+
++ ret = -EFAULT;
++ offset = linear_page_index(dst_vma, dst_addr);
++ max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
++ if (unlikely(offset >= max_off))
++ goto out_release;
++
+ ret = mem_cgroup_try_charge_delay(page, dst_mm, gfp, &memcg, false);
+ if (ret)
+ goto out_release;
+@@ -2318,9 +2325,25 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
+ _dst_pte = mk_pte(page, dst_vma->vm_page_prot);
+ if (dst_vma->vm_flags & VM_WRITE)
+ _dst_pte = pte_mkwrite(pte_mkdirty(_dst_pte));
++ else {
++ /*
++ * We don't set the pte dirty if the vma has no
++ * VM_WRITE permission, so mark the page dirty or it
++ * could be freed from under us. We could do it
++ * unconditionally before unlock_page(), but doing it
++ * only if VM_WRITE is not set is faster.
++ */
++ set_page_dirty(page);
++ }
+
+- ret = -EEXIST;
+ dst_pte = pte_offset_map_lock(dst_mm, dst_pmd, dst_addr, &ptl);
++
++ ret = -EFAULT;
++ max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
++ if (unlikely(offset >= max_off))
++ goto out_release_uncharge_unlock;
++
++ ret = -EEXIST;
+ if (!pte_none(*dst_pte))
+ goto out_release_uncharge_unlock;
+
+@@ -2338,13 +2361,15 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
+
+ /* No need to invalidate - it was non-present before */
+ update_mmu_cache(dst_vma, dst_addr, dst_pte);
+- unlock_page(page);
+ pte_unmap_unlock(dst_pte, ptl);
++ unlock_page(page);
+ ret = 0;
+ out:
+ return ret;
+ out_release_uncharge_unlock:
+ pte_unmap_unlock(dst_pte, ptl);
++ ClearPageDirty(page);
++ delete_from_page_cache(page);
+ out_release_uncharge:
+ mem_cgroup_cancel_charge(page, memcg, false);
+ out_release:
+diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
+index f0af11b1cdf3..458acda96f20 100644
+--- a/mm/userfaultfd.c
++++ b/mm/userfaultfd.c
+@@ -33,6 +33,8 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,
+ void *page_kaddr;
+ int ret;
+ struct page *page;
++ pgoff_t offset, max_off;
++ struct inode *inode;
+
+ if (!*pagep) {
+ ret = -ENOMEM;
+@@ -48,7 +50,7 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,
+
+ /* fallback to copy_from_user outside mmap_sem */
+ if (unlikely(ret)) {
+- ret = -EFAULT;
++ ret = -ENOENT;
+ *pagep = page;
+ /* don't free the page */
+ goto out;
+@@ -73,8 +75,17 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,
+ if (dst_vma->vm_flags & VM_WRITE)
+ _dst_pte = pte_mkwrite(pte_mkdirty(_dst_pte));
+
+- ret = -EEXIST;
+ dst_pte = pte_offset_map_lock(dst_mm, dst_pmd, dst_addr, &ptl);
++ if (dst_vma->vm_file) {
++ /* the shmem MAP_PRIVATE case requires checking the i_size */
++ inode = dst_vma->vm_file->f_inode;
++ offset = linear_page_index(dst_vma, dst_addr);
++ max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
++ ret = -EFAULT;
++ if (unlikely(offset >= max_off))
++ goto out_release_uncharge_unlock;
++ }
++ ret = -EEXIST;
+ if (!pte_none(*dst_pte))
+ goto out_release_uncharge_unlock;
+
+@@ -108,11 +119,22 @@ static int mfill_zeropage_pte(struct mm_struct *dst_mm,
+ pte_t _dst_pte, *dst_pte;
+ spinlock_t *ptl;
+ int ret;
++ pgoff_t offset, max_off;
++ struct inode *inode;
+
+ _dst_pte = pte_mkspecial(pfn_pte(my_zero_pfn(dst_addr),
+ dst_vma->vm_page_prot));
+- ret = -EEXIST;
+ dst_pte = pte_offset_map_lock(dst_mm, dst_pmd, dst_addr, &ptl);
++ if (dst_vma->vm_file) {
++ /* the shmem MAP_PRIVATE case requires checking the i_size */
++ inode = dst_vma->vm_file->f_inode;
++ offset = linear_page_index(dst_vma, dst_addr);
++ max_off = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
++ ret = -EFAULT;
++ if (unlikely(offset >= max_off))
++ goto out_unlock;
++ }
++ ret = -EEXIST;
+ if (!pte_none(*dst_pte))
+ goto out_unlock;
+ set_pte_at(dst_mm, dst_addr, dst_pte, _dst_pte);
+@@ -275,7 +297,7 @@ retry:
+
+ cond_resched();
+
+- if (unlikely(err == -EFAULT)) {
++ if (unlikely(err == -ENOENT)) {
+ up_read(&dst_mm->mmap_sem);
+ BUG_ON(!page);
+
+@@ -381,7 +403,17 @@ static __always_inline ssize_t mfill_atomic_pte(struct mm_struct *dst_mm,
+ {
+ ssize_t err;
+
+- if (vma_is_anonymous(dst_vma)) {
++ /*
++ * The normal page fault path for a shmem will invoke the
++ * fault, fill the hole in the file and COW it right away. The
++ * result generates plain anonymous memory. So when we are
++ * asked to fill an hole in a MAP_PRIVATE shmem mapping, we'll
++ * generate anonymous memory directly without actually filling
++ * the hole. For the MAP_PRIVATE case the robustness check
++ * only happens in the pagetable (to verify it's still none)
++ * and not in the radix tree.
++ */
++ if (!(dst_vma->vm_flags & VM_SHARED)) {
+ if (!zeropage)
+ err = mcopy_atomic_pte(dst_mm, dst_pmd, dst_vma,
+ dst_addr, src_addr, page);
+@@ -486,7 +518,8 @@ retry:
+ * dst_vma.
+ */
+ err = -ENOMEM;
+- if (vma_is_anonymous(dst_vma) && unlikely(anon_vma_prepare(dst_vma)))
++ if (!(dst_vma->vm_flags & VM_SHARED) &&
++ unlikely(anon_vma_prepare(dst_vma)))
+ goto out_unlock;
+
+ while (src_addr < src_start + len) {
+@@ -527,7 +560,7 @@ retry:
+ src_addr, &page, zeropage);
+ cond_resched();
+
+- if (unlikely(err == -EFAULT)) {
++ if (unlikely(err == -ENOENT)) {
+ void *page_kaddr;
+
+ up_read(&dst_mm->mmap_sem);
+diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
+index 2627b5d812e9..b84c0059214f 100644
+--- a/net/tipc/topsrv.c
++++ b/net/tipc/topsrv.c
+@@ -657,7 +657,7 @@ int tipc_topsrv_start(struct net *net)
+ srv->max_rcvbuf_size = sizeof(struct tipc_subscr);
+ INIT_WORK(&srv->awork, tipc_topsrv_accept);
+
+- strncpy(srv->name, name, strlen(name) + 1);
++ strscpy(srv->name, name, sizeof(srv->name));
+ tn->topsrv = srv;
+ atomic_set(&tn->subscription_count, 0);
+
+diff --git a/scripts/unifdef.c b/scripts/unifdef.c
+index 7493c0ee51cc..db00e3e30a59 100644
+--- a/scripts/unifdef.c
++++ b/scripts/unifdef.c
+@@ -395,7 +395,7 @@ usage(void)
+ * When we have processed a group that starts off with a known-false
+ * #if/#elif sequence (which has therefore been deleted) followed by a
+ * #elif that we don't understand and therefore must keep, we edit the
+- * latter into a #if to keep the nesting correct. We use strncpy() to
++ * latter into a #if to keep the nesting correct. We use memcpy() to
+ * overwrite the 4 byte token "elif" with "if " without a '\0' byte.
+ *
+ * When we find a true #elif in a group, the following block will
+@@ -450,7 +450,7 @@ static void Idrop (void) { Fdrop(); ignoreon(); }
+ static void Itrue (void) { Ftrue(); ignoreon(); }
+ static void Ifalse(void) { Ffalse(); ignoreon(); }
+ /* modify this line */
+-static void Mpass (void) { strncpy(keyword, "if ", 4); Pelif(); }
++static void Mpass (void) { memcpy(keyword, "if ", 4); Pelif(); }
+ static void Mtrue (void) { keywordedit("else"); state(IS_TRUE_MIDDLE); }
+ static void Melif (void) { keywordedit("endif"); state(IS_FALSE_TRAILER); }
+ static void Melse (void) { keywordedit("endif"); state(IS_FALSE_ELSE); }
+diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
+index 74b951f55608..9cec81209617 100644
+--- a/security/selinux/nlmsgtab.c
++++ b/security/selinux/nlmsgtab.c
+@@ -80,6 +80,9 @@ static const struct nlmsg_perm nlmsg_route_perms[] =
+ { RTM_NEWSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
+ { RTM_GETSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
+ { RTM_NEWCACHEREPORT, NETLINK_ROUTE_SOCKET__NLMSG_READ },
++ { RTM_NEWCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
++ { RTM_DELCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
++ { RTM_GETCHAIN, NETLINK_ROUTE_SOCKET__NLMSG_READ },
+ };
+
+ static const struct nlmsg_perm nlmsg_tcpdiag_perms[] =
+@@ -158,7 +161,11 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
+
+ switch (sclass) {
+ case SECCLASS_NETLINK_ROUTE_SOCKET:
+- /* RTM_MAX always point to RTM_SETxxxx, ie RTM_NEWxxx + 3 */
++ /* RTM_MAX always points to RTM_SETxxxx, ie RTM_NEWxxx + 3.
++ * If the BUILD_BUG_ON() below fails you must update the
++ * structures at the top of this file with the new mappings
++ * before updating the BUILD_BUG_ON() macro!
++ */
+ BUILD_BUG_ON(RTM_MAX != (RTM_NEWCHAIN + 3));
+ err = nlmsg_perm(nlmsg_type, perm, nlmsg_route_perms,
+ sizeof(nlmsg_route_perms));
+@@ -170,6 +177,10 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
+ break;
+
+ case SECCLASS_NETLINK_XFRM_SOCKET:
++ /* If the BUILD_BUG_ON() below fails you must update the
++ * structures at the top of this file with the new mappings
++ * before updating the BUILD_BUG_ON() macro!
++ */
+ BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_MAPPING);
+ err = nlmsg_perm(nlmsg_type, perm, nlmsg_xfrm_perms,
+ sizeof(nlmsg_xfrm_perms));
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-12-08 13:17 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-12-08 13:17 UTC (permalink / raw
To: gentoo-commits
commit: a6e925b71b07eaaccec90812b77638527d94a868
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Dec 6 20:43:04 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Dec 6 20:43:04 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a6e925b7
proj/linux-patches: Update readme for 4.19.8
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/0000_README b/0000_README
index e91fad4..6c79837 100644
--- a/0000_README
+++ b/0000_README
@@ -71,6 +71,10 @@ Patch: 1006_linux-4.19.7.patch
From: http://www.kernel.org
Desc: Linux 4.19.7
+Patch: 1007_linux-4.19.8.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.8
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-12-13 11:40 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-12-13 11:40 UTC (permalink / raw
To: gentoo-commits
commit: 59ef1e9801722a3585eac6c0eb62f2087ca1d235
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Dec 13 11:39:55 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Dec 13 11:39:55 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=59ef1e98
proj/linux-patches: Linux patch 4.19.9
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
1008_linux-4.19.9.patch | 4670 +++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 4670 insertions(+)
diff --git a/1008_linux-4.19.9.patch b/1008_linux-4.19.9.patch
new file mode 100644
index 0000000..dae36a8
--- /dev/null
+++ b/1008_linux-4.19.9.patch
@@ -0,0 +1,4670 @@
+diff --git a/Makefile b/Makefile
+index 34bc4c752c49..8717f34464d5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 8
++SUBLEVEL = 9
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c
+index b2aa9b32bff2..2c118a6ab358 100644
+--- a/arch/arm/probes/kprobes/opt-arm.c
++++ b/arch/arm/probes/kprobes/opt-arm.c
+@@ -247,7 +247,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *or
+ }
+
+ /* Copy arch-dep-instance from template. */
+- memcpy(code, &optprobe_template_entry,
++ memcpy(code, (unsigned char *)optprobe_template_entry,
+ TMPL_END_IDX * sizeof(kprobe_opcode_t));
+
+ /* Adjust buffer according to instruction. */
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-ficus.dts b/arch/arm64/boot/dts/rockchip/rk3399-ficus.dts
+index 8978d924eb83..85cf0b6bdda9 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-ficus.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-ficus.dts
+@@ -75,18 +75,6 @@
+ regulator-always-on;
+ vin-supply = <&vcc_sys>;
+ };
+-
+- vdd_log: vdd-log {
+- compatible = "pwm-regulator";
+- pwms = <&pwm2 0 25000 0>;
+- regulator-name = "vdd_log";
+- regulator-min-microvolt = <800000>;
+- regulator-max-microvolt = <1400000>;
+- regulator-always-on;
+- regulator-boot-on;
+- vin-supply = <&vcc_sys>;
+- };
+-
+ };
+
+ &cpu_l0 {
+diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
+index 6b2686d54411..29cdc99688f3 100644
+--- a/arch/arm64/kernel/hibernate.c
++++ b/arch/arm64/kernel/hibernate.c
+@@ -214,7 +214,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
+ }
+
+ memcpy((void *)dst, src_start, length);
+- flush_icache_range(dst, dst + length);
++ __flush_icache_range(dst, dst + length);
+
+ pgdp = pgd_offset_raw(allocator(mask), dst_addr);
+ if (pgd_none(READ_ONCE(*pgdp))) {
+diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
+index 5ce030266e7d..253d7ca71472 100644
+--- a/arch/parisc/Makefile
++++ b/arch/parisc/Makefile
+@@ -71,6 +71,13 @@ ifdef CONFIG_MLONGCALLS
+ KBUILD_CFLAGS_KERNEL += -mlong-calls
+ endif
+
++# Without this, "ld -r" results in .text sections that are too big (> 0x40000)
++# for branches to reach stubs. And multiple .text sections trigger a warning
++# when creating the sysfs module information section.
++ifndef CONFIG_64BIT
++KBUILD_CFLAGS_MODULE += -ffunction-sections
++endif
++
+ # select which processor to optimise for
+ cflags-$(CONFIG_PA7000) += -march=1.1 -mschedule=7100
+ cflags-$(CONFIG_PA7200) += -march=1.1 -mschedule=7200
+diff --git a/arch/riscv/include/asm/module.h b/arch/riscv/include/asm/module.h
+index 349df33808c4..cd2af4b013e3 100644
+--- a/arch/riscv/include/asm/module.h
++++ b/arch/riscv/include/asm/module.h
+@@ -8,6 +8,7 @@
+
+ #define MODULE_ARCH_VERMAGIC "riscv"
+
++struct module;
+ u64 module_emit_got_entry(struct module *mod, u64 val);
+ u64 module_emit_plt_entry(struct module *mod, u64 val);
+
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 8b4c5e001157..544ac4fafd11 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -1,3 +1,4 @@
++
+ /* -----------------------------------------------------------------------
+ *
+ * Copyright 2011 Intel Corporation; author Matt Fleming
+@@ -634,37 +635,54 @@ static efi_status_t alloc_e820ext(u32 nr_desc, struct setup_data **e820ext,
+ return status;
+ }
+
++static efi_status_t allocate_e820(struct boot_params *params,
++ struct setup_data **e820ext,
++ u32 *e820ext_size)
++{
++ unsigned long map_size, desc_size, buff_size;
++ struct efi_boot_memmap boot_map;
++ efi_memory_desc_t *map;
++ efi_status_t status;
++ __u32 nr_desc;
++
++ boot_map.map = ↦
++ boot_map.map_size = &map_size;
++ boot_map.desc_size = &desc_size;
++ boot_map.desc_ver = NULL;
++ boot_map.key_ptr = NULL;
++ boot_map.buff_size = &buff_size;
++
++ status = efi_get_memory_map(sys_table, &boot_map);
++ if (status != EFI_SUCCESS)
++ return status;
++
++ nr_desc = buff_size / desc_size;
++
++ if (nr_desc > ARRAY_SIZE(params->e820_table)) {
++ u32 nr_e820ext = nr_desc - ARRAY_SIZE(params->e820_table);
++
++ status = alloc_e820ext(nr_e820ext, e820ext, e820ext_size);
++ if (status != EFI_SUCCESS)
++ return status;
++ }
++
++ return EFI_SUCCESS;
++}
++
+ struct exit_boot_struct {
+ struct boot_params *boot_params;
+ struct efi_info *efi;
+- struct setup_data *e820ext;
+- __u32 e820ext_size;
+ };
+
+ static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
+ struct efi_boot_memmap *map,
+ void *priv)
+ {
+- static bool first = true;
+ const char *signature;
+ __u32 nr_desc;
+ efi_status_t status;
+ struct exit_boot_struct *p = priv;
+
+- if (first) {
+- nr_desc = *map->buff_size / *map->desc_size;
+- if (nr_desc > ARRAY_SIZE(p->boot_params->e820_table)) {
+- u32 nr_e820ext = nr_desc -
+- ARRAY_SIZE(p->boot_params->e820_table);
+-
+- status = alloc_e820ext(nr_e820ext, &p->e820ext,
+- &p->e820ext_size);
+- if (status != EFI_SUCCESS)
+- return status;
+- }
+- first = false;
+- }
+-
+ signature = efi_is_64bit() ? EFI64_LOADER_SIGNATURE
+ : EFI32_LOADER_SIGNATURE;
+ memcpy(&p->efi->efi_loader_signature, signature, sizeof(__u32));
+@@ -687,8 +705,8 @@ static efi_status_t exit_boot(struct boot_params *boot_params, void *handle)
+ {
+ unsigned long map_sz, key, desc_size, buff_size;
+ efi_memory_desc_t *mem_map;
+- struct setup_data *e820ext;
+- __u32 e820ext_size;
++ struct setup_data *e820ext = NULL;
++ __u32 e820ext_size = 0;
+ efi_status_t status;
+ __u32 desc_version;
+ struct efi_boot_memmap map;
+@@ -702,8 +720,10 @@ static efi_status_t exit_boot(struct boot_params *boot_params, void *handle)
+ map.buff_size = &buff_size;
+ priv.boot_params = boot_params;
+ priv.efi = &boot_params->efi_info;
+- priv.e820ext = NULL;
+- priv.e820ext_size = 0;
++
++ status = allocate_e820(boot_params, &e820ext, &e820ext_size);
++ if (status != EFI_SUCCESS)
++ return status;
+
+ /* Might as well exit boot services now */
+ status = efi_exit_boot_services(sys_table, handle, &map, &priv,
+@@ -711,9 +731,6 @@ static efi_status_t exit_boot(struct boot_params *boot_params, void *handle)
+ if (status != EFI_SUCCESS)
+ return status;
+
+- e820ext = priv.e820ext;
+- e820ext_size = priv.e820ext_size;
+-
+ /* Historic? */
+ boot_params->alt_mem_k = 32 * 1024;
+
+diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
+index c88c23c658c1..d1f25c831447 100644
+--- a/arch/x86/kernel/e820.c
++++ b/arch/x86/kernel/e820.c
+@@ -1248,7 +1248,6 @@ void __init e820__memblock_setup(void)
+ {
+ int i;
+ u64 end;
+- u64 addr = 0;
+
+ /*
+ * The bootstrap memblock region count maximum is 128 entries
+@@ -1265,21 +1264,13 @@ void __init e820__memblock_setup(void)
+ struct e820_entry *entry = &e820_table->entries[i];
+
+ end = entry->addr + entry->size;
+- if (addr < entry->addr)
+- memblock_reserve(addr, entry->addr - addr);
+- addr = end;
+ if (end != (resource_size_t)end)
+ continue;
+
+- /*
+- * all !E820_TYPE_RAM ranges (including gap ranges) are put
+- * into memblock.reserved to make sure that struct pages in
+- * such regions are not left uninitialized after bootup.
+- */
+ if (entry->type != E820_TYPE_RAM && entry->type != E820_TYPE_RESERVED_KERN)
+- memblock_reserve(entry->addr, entry->size);
+- else
+- memblock_add(entry->addr, entry->size);
++ continue;
++
++ memblock_add(entry->addr, entry->size);
+ }
+
+ /* Throw away partial pages: */
+diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
+index 40b16b270656..6adf6e6c2933 100644
+--- a/arch/x86/kernel/kprobes/opt.c
++++ b/arch/x86/kernel/kprobes/opt.c
+@@ -189,7 +189,7 @@ static int copy_optimized_instructions(u8 *dest, u8 *src, u8 *real)
+ int len = 0, ret;
+
+ while (len < RELATIVEJUMP_SIZE) {
+- ret = __copy_instruction(dest + len, src + len, real, &insn);
++ ret = __copy_instruction(dest + len, src + len, real + len, &insn);
+ if (!ret || !can_boost(&insn, src + len))
+ return -EINVAL;
+ len += ret;
+diff --git a/crypto/cbc.c b/crypto/cbc.c
+index b761b1f9c6ca..dd5f332fd566 100644
+--- a/crypto/cbc.c
++++ b/crypto/cbc.c
+@@ -140,9 +140,8 @@ static int crypto_cbc_create(struct crypto_template *tmpl, struct rtattr **tb)
+ spawn = skcipher_instance_ctx(inst);
+ err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
+ CRYPTO_ALG_TYPE_MASK);
+- crypto_mod_put(alg);
+ if (err)
+- goto err_free_inst;
++ goto err_put_alg;
+
+ err = crypto_inst_setname(skcipher_crypto_instance(inst), "cbc", alg);
+ if (err)
+@@ -174,12 +173,15 @@ static int crypto_cbc_create(struct crypto_template *tmpl, struct rtattr **tb)
+ err = skcipher_register_instance(tmpl, inst);
+ if (err)
+ goto err_drop_spawn;
++ crypto_mod_put(alg);
+
+ out:
+ return err;
+
+ err_drop_spawn:
+ crypto_drop_spawn(spawn);
++err_put_alg:
++ crypto_mod_put(alg);
+ err_free_inst:
+ kfree(inst);
+ goto out;
+diff --git a/crypto/cfb.c b/crypto/cfb.c
+index a0d68c09e1b9..20987d0e09d8 100644
+--- a/crypto/cfb.c
++++ b/crypto/cfb.c
+@@ -286,9 +286,8 @@ static int crypto_cfb_create(struct crypto_template *tmpl, struct rtattr **tb)
+ spawn = skcipher_instance_ctx(inst);
+ err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
+ CRYPTO_ALG_TYPE_MASK);
+- crypto_mod_put(alg);
+ if (err)
+- goto err_free_inst;
++ goto err_put_alg;
+
+ err = crypto_inst_setname(skcipher_crypto_instance(inst), "cfb", alg);
+ if (err)
+@@ -317,12 +316,15 @@ static int crypto_cfb_create(struct crypto_template *tmpl, struct rtattr **tb)
+ err = skcipher_register_instance(tmpl, inst);
+ if (err)
+ goto err_drop_spawn;
++ crypto_mod_put(alg);
+
+ out:
+ return err;
+
+ err_drop_spawn:
+ crypto_drop_spawn(spawn);
++err_put_alg:
++ crypto_mod_put(alg);
+ err_free_inst:
+ kfree(inst);
+ goto out;
+diff --git a/crypto/pcbc.c b/crypto/pcbc.c
+index ef802f6e9642..8aa10144407c 100644
+--- a/crypto/pcbc.c
++++ b/crypto/pcbc.c
+@@ -244,9 +244,8 @@ static int crypto_pcbc_create(struct crypto_template *tmpl, struct rtattr **tb)
+ spawn = skcipher_instance_ctx(inst);
+ err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
+ CRYPTO_ALG_TYPE_MASK);
+- crypto_mod_put(alg);
+ if (err)
+- goto err_free_inst;
++ goto err_put_alg;
+
+ err = crypto_inst_setname(skcipher_crypto_instance(inst), "pcbc", alg);
+ if (err)
+@@ -275,12 +274,15 @@ static int crypto_pcbc_create(struct crypto_template *tmpl, struct rtattr **tb)
+ err = skcipher_register_instance(tmpl, inst);
+ if (err)
+ goto err_drop_spawn;
++ crypto_mod_put(alg);
+
+ out:
+ return err;
+
+ err_drop_spawn:
+ crypto_drop_spawn(spawn);
++err_put_alg:
++ crypto_mod_put(alg);
+ err_free_inst:
+ kfree(inst);
+ goto out;
+diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
+index 3f0e2a14895a..22b53bf26817 100644
+--- a/drivers/cpufreq/ti-cpufreq.c
++++ b/drivers/cpufreq/ti-cpufreq.c
+@@ -201,19 +201,28 @@ static const struct of_device_id ti_cpufreq_of_match[] = {
+ {},
+ };
+
++static const struct of_device_id *ti_cpufreq_match_node(void)
++{
++ struct device_node *np;
++ const struct of_device_id *match;
++
++ np = of_find_node_by_path("/");
++ match = of_match_node(ti_cpufreq_of_match, np);
++ of_node_put(np);
++
++ return match;
++}
++
+ static int ti_cpufreq_probe(struct platform_device *pdev)
+ {
+ u32 version[VERSION_COUNT];
+- struct device_node *np;
+ const struct of_device_id *match;
+ struct opp_table *ti_opp_table;
+ struct ti_cpufreq_data *opp_data;
+ const char * const reg_names[] = {"vdd", "vbb"};
+ int ret;
+
+- np = of_find_node_by_path("/");
+- match = of_match_node(ti_cpufreq_of_match, np);
+- of_node_put(np);
++ match = dev_get_platdata(&pdev->dev);
+ if (!match)
+ return -ENODEV;
+
+@@ -290,7 +299,14 @@ fail_put_node:
+
+ static int ti_cpufreq_init(void)
+ {
+- platform_device_register_simple("ti-cpufreq", -1, NULL, 0);
++ const struct of_device_id *match;
++
++ /* Check to ensure we are on a compatible platform */
++ match = ti_cpufreq_match_node();
++ if (match)
++ platform_device_register_data(NULL, "ti-cpufreq", -1, match,
++ sizeof(*match));
++
+ return 0;
+ }
+ module_init(ti_cpufreq_init);
+diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
+index f43e6dafe446..0f389e008ce6 100644
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -1064,12 +1064,12 @@ static void dwc_issue_pending(struct dma_chan *chan)
+ /*
+ * Program FIFO size of channels.
+ *
+- * By default full FIFO (1024 bytes) is assigned to channel 0. Here we
++ * By default full FIFO (512 bytes) is assigned to channel 0. Here we
+ * slice FIFO on equal parts between channels.
+ */
+ static void idma32_fifo_partition(struct dw_dma *dw)
+ {
+- u64 value = IDMA32C_FP_PSIZE_CH0(128) | IDMA32C_FP_PSIZE_CH1(128) |
++ u64 value = IDMA32C_FP_PSIZE_CH0(64) | IDMA32C_FP_PSIZE_CH1(64) |
+ IDMA32C_FP_UPDATE;
+ u64 fifo_partition = 0;
+
+@@ -1082,7 +1082,7 @@ static void idma32_fifo_partition(struct dw_dma *dw)
+ /* Fill FIFO_PARTITION high bits (Channels 2..3, 6..7) */
+ fifo_partition |= value << 32;
+
+- /* Program FIFO Partition registers - 128 bytes for each channel */
++ /* Program FIFO Partition registers - 64 bytes per channel */
+ idma32_writeq(dw, FIFO_PARTITION1, fifo_partition);
+ idma32_writeq(dw, FIFO_PARTITION0, fifo_partition);
+ }
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index b4ec2d20e661..cb1b44d78a1f 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -24,7 +24,6 @@
+ #include <linux/spinlock.h>
+ #include <linux/device.h>
+ #include <linux/dma-mapping.h>
+-#include <linux/dmapool.h>
+ #include <linux/firmware.h>
+ #include <linux/slab.h>
+ #include <linux/platform_device.h>
+@@ -33,6 +32,7 @@
+ #include <linux/of_address.h>
+ #include <linux/of_device.h>
+ #include <linux/of_dma.h>
++#include <linux/workqueue.h>
+
+ #include <asm/irq.h>
+ #include <linux/platform_data/dma-imx-sdma.h>
+@@ -376,7 +376,7 @@ struct sdma_channel {
+ u32 shp_addr, per_addr;
+ enum dma_status status;
+ struct imx_dma_data data;
+- struct dma_pool *bd_pool;
++ struct work_struct terminate_worker;
+ };
+
+ #define IMX_DMA_SG_LOOP BIT(0)
+@@ -1027,31 +1027,49 @@ static int sdma_disable_channel(struct dma_chan *chan)
+
+ return 0;
+ }
+-
+-static int sdma_disable_channel_with_delay(struct dma_chan *chan)
++static void sdma_channel_terminate_work(struct work_struct *work)
+ {
+- struct sdma_channel *sdmac = to_sdma_chan(chan);
++ struct sdma_channel *sdmac = container_of(work, struct sdma_channel,
++ terminate_worker);
+ unsigned long flags;
+ LIST_HEAD(head);
+
+- sdma_disable_channel(chan);
+- spin_lock_irqsave(&sdmac->vc.lock, flags);
+- vchan_get_all_descriptors(&sdmac->vc, &head);
+- sdmac->desc = NULL;
+- spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+- vchan_dma_desc_free_list(&sdmac->vc, &head);
+-
+ /*
+ * According to NXP R&D team a delay of one BD SDMA cost time
+ * (maximum is 1ms) should be added after disable of the channel
+ * bit, to ensure SDMA core has really been stopped after SDMA
+ * clients call .device_terminate_all.
+ */
+- mdelay(1);
++ usleep_range(1000, 2000);
++
++ spin_lock_irqsave(&sdmac->vc.lock, flags);
++ vchan_get_all_descriptors(&sdmac->vc, &head);
++ sdmac->desc = NULL;
++ spin_unlock_irqrestore(&sdmac->vc.lock, flags);
++ vchan_dma_desc_free_list(&sdmac->vc, &head);
++}
++
++static int sdma_disable_channel_async(struct dma_chan *chan)
++{
++ struct sdma_channel *sdmac = to_sdma_chan(chan);
++
++ sdma_disable_channel(chan);
++
++ if (sdmac->desc)
++ schedule_work(&sdmac->terminate_worker);
+
+ return 0;
+ }
+
++static void sdma_channel_synchronize(struct dma_chan *chan)
++{
++ struct sdma_channel *sdmac = to_sdma_chan(chan);
++
++ vchan_synchronize(&sdmac->vc);
++
++ flush_work(&sdmac->terminate_worker);
++}
++
+ static void sdma_set_watermarklevel_for_p2p(struct sdma_channel *sdmac)
+ {
+ struct sdma_engine *sdma = sdmac->sdma;
+@@ -1192,10 +1210,11 @@ out:
+
+ static int sdma_alloc_bd(struct sdma_desc *desc)
+ {
++ u32 bd_size = desc->num_bd * sizeof(struct sdma_buffer_descriptor);
+ int ret = 0;
+
+- desc->bd = dma_pool_alloc(desc->sdmac->bd_pool, GFP_NOWAIT,
+- &desc->bd_phys);
++ desc->bd = dma_zalloc_coherent(NULL, bd_size, &desc->bd_phys,
++ GFP_NOWAIT);
+ if (!desc->bd) {
+ ret = -ENOMEM;
+ goto out;
+@@ -1206,7 +1225,9 @@ out:
+
+ static void sdma_free_bd(struct sdma_desc *desc)
+ {
+- dma_pool_free(desc->sdmac->bd_pool, desc->bd, desc->bd_phys);
++ u32 bd_size = desc->num_bd * sizeof(struct sdma_buffer_descriptor);
++
++ dma_free_coherent(NULL, bd_size, desc->bd, desc->bd_phys);
+ }
+
+ static void sdma_desc_free(struct virt_dma_desc *vd)
+@@ -1272,10 +1293,6 @@ static int sdma_alloc_chan_resources(struct dma_chan *chan)
+ if (ret)
+ goto disable_clk_ahb;
+
+- sdmac->bd_pool = dma_pool_create("bd_pool", chan->device->dev,
+- sizeof(struct sdma_buffer_descriptor),
+- 32, 0);
+-
+ return 0;
+
+ disable_clk_ahb:
+@@ -1290,7 +1307,9 @@ static void sdma_free_chan_resources(struct dma_chan *chan)
+ struct sdma_channel *sdmac = to_sdma_chan(chan);
+ struct sdma_engine *sdma = sdmac->sdma;
+
+- sdma_disable_channel_with_delay(chan);
++ sdma_disable_channel_async(chan);
++
++ sdma_channel_synchronize(chan);
+
+ if (sdmac->event_id0)
+ sdma_event_disable(sdmac, sdmac->event_id0);
+@@ -1304,9 +1323,6 @@ static void sdma_free_chan_resources(struct dma_chan *chan)
+
+ clk_disable(sdma->clk_ipg);
+ clk_disable(sdma->clk_ahb);
+-
+- dma_pool_destroy(sdmac->bd_pool);
+- sdmac->bd_pool = NULL;
+ }
+
+ static struct sdma_desc *sdma_transfer_init(struct sdma_channel *sdmac,
+@@ -1999,6 +2015,8 @@ static int sdma_probe(struct platform_device *pdev)
+
+ sdmac->channel = i;
+ sdmac->vc.desc_free = sdma_desc_free;
++ INIT_WORK(&sdmac->terminate_worker,
++ sdma_channel_terminate_work);
+ /*
+ * Add the channel to the DMAC list. Do not add channel 0 though
+ * because we need it internally in the SDMA driver. This also means
+@@ -2050,7 +2068,8 @@ static int sdma_probe(struct platform_device *pdev)
+ sdma->dma_device.device_prep_slave_sg = sdma_prep_slave_sg;
+ sdma->dma_device.device_prep_dma_cyclic = sdma_prep_dma_cyclic;
+ sdma->dma_device.device_config = sdma_config;
+- sdma->dma_device.device_terminate_all = sdma_disable_channel_with_delay;
++ sdma->dma_device.device_terminate_all = sdma_disable_channel_async;
++ sdma->dma_device.device_synchronize = sdma_channel_synchronize;
+ sdma->dma_device.src_addr_widths = SDMA_DMA_BUSWIDTHS;
+ sdma->dma_device.dst_addr_widths = SDMA_DMA_BUSWIDTHS;
+ sdma->dma_device.directions = SDMA_DMA_DIRECTIONS;
+diff --git a/drivers/dma/ti/cppi41.c b/drivers/dma/ti/cppi41.c
+index 1497da367710..e507ec36c0d3 100644
+--- a/drivers/dma/ti/cppi41.c
++++ b/drivers/dma/ti/cppi41.c
+@@ -723,8 +723,22 @@ static int cppi41_stop_chan(struct dma_chan *chan)
+
+ desc_phys = lower_32_bits(c->desc_phys);
+ desc_num = (desc_phys - cdd->descs_phys) / sizeof(struct cppi41_desc);
+- if (!cdd->chan_busy[desc_num])
++ if (!cdd->chan_busy[desc_num]) {
++ struct cppi41_channel *cc, *_ct;
++
++ /*
++ * channels might still be in the pendling list if
++ * cppi41_dma_issue_pending() is called after
++ * cppi41_runtime_suspend() is called
++ */
++ list_for_each_entry_safe(cc, _ct, &cdd->pending, node) {
++ if (cc != c)
++ continue;
++ list_del(&cc->node);
++ break;
++ }
+ return 0;
++ }
+
+ ret = cppi41_tear_down_chan(c);
+ if (ret)
+diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c
+index 71d014edd167..2c22836d3ffd 100644
+--- a/drivers/gnss/sirf.c
++++ b/drivers/gnss/sirf.c
+@@ -168,7 +168,7 @@ static int sirf_set_active(struct sirf_data *data, bool active)
+ else
+ timeout = SIRF_HIBERNATE_TIMEOUT;
+
+- while (retries-- > 0) {
++ do {
+ sirf_pulse_on_off(data);
+ ret = sirf_wait_for_power_state(data, active, timeout);
+ if (ret < 0) {
+@@ -179,9 +179,9 @@ static int sirf_set_active(struct sirf_data *data, bool active)
+ }
+
+ break;
+- }
++ } while (retries--);
+
+- if (retries == 0)
++ if (retries < 0)
+ return -ETIMEDOUT;
+
+ return 0;
+diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
+index d66b7a768ecd..945bd13e5e79 100644
+--- a/drivers/gpio/gpio-mockup.c
++++ b/drivers/gpio/gpio-mockup.c
+@@ -32,8 +32,8 @@
+ #define gpio_mockup_err(...) pr_err(GPIO_MOCKUP_NAME ": " __VA_ARGS__)
+
+ enum {
+- GPIO_MOCKUP_DIR_OUT = 0,
+- GPIO_MOCKUP_DIR_IN = 1,
++ GPIO_MOCKUP_DIR_IN = 0,
++ GPIO_MOCKUP_DIR_OUT = 1,
+ };
+
+ /*
+@@ -135,7 +135,7 @@ static int gpio_mockup_get_direction(struct gpio_chip *gc, unsigned int offset)
+ {
+ struct gpio_mockup_chip *chip = gpiochip_get_data(gc);
+
+- return chip->lines[offset].dir;
++ return !chip->lines[offset].dir;
+ }
+
+ static int gpio_mockup_to_irq(struct gpio_chip *gc, unsigned int offset)
+diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
+index c18712dabf93..9f3f166f1760 100644
+--- a/drivers/gpio/gpio-pxa.c
++++ b/drivers/gpio/gpio-pxa.c
+@@ -268,8 +268,8 @@ static int pxa_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
+
+ if (pxa_gpio_has_pinctrl()) {
+ ret = pinctrl_gpio_direction_input(chip->base + offset);
+- if (!ret)
+- return 0;
++ if (ret)
++ return ret;
+ }
+
+ spin_lock_irqsave(&gpio_lock, flags);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+index 6748cd7fc129..686a26de50f9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+@@ -626,6 +626,13 @@ int amdgpu_display_modeset_create_props(struct amdgpu_device *adev)
+ "dither",
+ amdgpu_dither_enum_list, sz);
+
++ if (amdgpu_device_has_dc_support(adev)) {
++ adev->mode_info.max_bpc_property =
++ drm_property_create_range(adev->ddev, 0, "max bpc", 8, 16);
++ if (!adev->mode_info.max_bpc_property)
++ return -ENOMEM;
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+index b9e9e8b02fb7..d1b4d9b6aae0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+@@ -339,6 +339,8 @@ struct amdgpu_mode_info {
+ struct drm_property *audio_property;
+ /* FMT dithering */
+ struct drm_property *dither_property;
++ /* maximum number of bits per channel for monitor color */
++ struct drm_property *max_bpc_property;
+ /* hardcoded DFP edid from BIOS */
+ struct edid *bios_hardcoded_edid;
+ int bios_hardcoded_edid_size;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+index 9333109b210d..1a744f964b30 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+@@ -55,6 +55,9 @@ MODULE_FIRMWARE("amdgpu/tonga_mc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris11_mc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris10_mc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris12_mc.bin");
++MODULE_FIRMWARE("amdgpu/polaris11_k_mc.bin");
++MODULE_FIRMWARE("amdgpu/polaris10_k_mc.bin");
++MODULE_FIRMWARE("amdgpu/polaris12_k_mc.bin");
+
+ static const u32 golden_settings_tonga_a11[] =
+ {
+@@ -223,13 +226,39 @@ static int gmc_v8_0_init_microcode(struct amdgpu_device *adev)
+ chip_name = "tonga";
+ break;
+ case CHIP_POLARIS11:
+- chip_name = "polaris11";
++ if (((adev->pdev->device == 0x67ef) &&
++ ((adev->pdev->revision == 0xe0) ||
++ (adev->pdev->revision == 0xe5))) ||
++ ((adev->pdev->device == 0x67ff) &&
++ ((adev->pdev->revision == 0xcf) ||
++ (adev->pdev->revision == 0xef) ||
++ (adev->pdev->revision == 0xff))))
++ chip_name = "polaris11_k";
++ else if ((adev->pdev->device == 0x67ef) &&
++ (adev->pdev->revision == 0xe2))
++ chip_name = "polaris11_k";
++ else
++ chip_name = "polaris11";
+ break;
+ case CHIP_POLARIS10:
+- chip_name = "polaris10";
++ if ((adev->pdev->device == 0x67df) &&
++ ((adev->pdev->revision == 0xe1) ||
++ (adev->pdev->revision == 0xf7)))
++ chip_name = "polaris10_k";
++ else
++ chip_name = "polaris10";
+ break;
+ case CHIP_POLARIS12:
+- chip_name = "polaris12";
++ if (((adev->pdev->device == 0x6987) &&
++ ((adev->pdev->revision == 0xc0) ||
++ (adev->pdev->revision == 0xc3))) ||
++ ((adev->pdev->device == 0x6981) &&
++ ((adev->pdev->revision == 0x00) ||
++ (adev->pdev->revision == 0x01) ||
++ (adev->pdev->revision == 0x10))))
++ chip_name = "polaris12_k";
++ else
++ chip_name = "polaris12";
+ break;
+ case CHIP_FIJI:
+ case CHIP_CARRIZO:
+@@ -336,7 +365,7 @@ static int gmc_v8_0_polaris_mc_load_microcode(struct amdgpu_device *adev)
+ const struct mc_firmware_header_v1_0 *hdr;
+ const __le32 *fw_data = NULL;
+ const __le32 *io_mc_regs = NULL;
+- u32 data, vbios_version;
++ u32 data;
+ int i, ucode_size, regs_size;
+
+ /* Skip MC ucode loading on SR-IOV capable boards.
+@@ -347,13 +376,6 @@ static int gmc_v8_0_polaris_mc_load_microcode(struct amdgpu_device *adev)
+ if (amdgpu_sriov_bios(adev))
+ return 0;
+
+- WREG32(mmMC_SEQ_IO_DEBUG_INDEX, 0x9F);
+- data = RREG32(mmMC_SEQ_IO_DEBUG_DATA);
+- vbios_version = data & 0xf;
+-
+- if (vbios_version == 0)
+- return 0;
+-
+ if (!adev->gmc.fw)
+ return -EINVAL;
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index ef5c6af4d964..299def84e69c 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -2213,8 +2213,15 @@ static void update_stream_scaling_settings(const struct drm_display_mode *mode,
+ static enum dc_color_depth
+ convert_color_depth_from_display_info(const struct drm_connector *connector)
+ {
++ struct dm_connector_state *dm_conn_state =
++ to_dm_connector_state(connector->state);
+ uint32_t bpc = connector->display_info.bpc;
+
++ /* TODO: Remove this when there's support for max_bpc in drm */
++ if (dm_conn_state && bpc > dm_conn_state->max_bpc)
++ /* Round down to nearest even number. */
++ bpc = dm_conn_state->max_bpc - (dm_conn_state->max_bpc & 1);
++
+ switch (bpc) {
+ case 0:
+ /* Temporary Work around, DRM don't parse color depth for
+@@ -2796,6 +2803,9 @@ int amdgpu_dm_connector_atomic_set_property(struct drm_connector *connector,
+ } else if (property == adev->mode_info.underscan_property) {
+ dm_new_state->underscan_enable = val;
+ ret = 0;
++ } else if (property == adev->mode_info.max_bpc_property) {
++ dm_new_state->max_bpc = val;
++ ret = 0;
+ }
+
+ return ret;
+@@ -2838,6 +2848,9 @@ int amdgpu_dm_connector_atomic_get_property(struct drm_connector *connector,
+ } else if (property == adev->mode_info.underscan_property) {
+ *val = dm_state->underscan_enable;
+ ret = 0;
++ } else if (property == adev->mode_info.max_bpc_property) {
++ *val = dm_state->max_bpc;
++ ret = 0;
+ }
+ return ret;
+ }
+@@ -3658,6 +3671,9 @@ void amdgpu_dm_connector_init_helper(struct amdgpu_display_manager *dm,
+ drm_object_attach_property(&aconnector->base.base,
+ adev->mode_info.underscan_vborder_property,
+ 0);
++ drm_object_attach_property(&aconnector->base.base,
++ adev->mode_info.max_bpc_property,
++ 0);
+
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+index aba2c5c1d2f8..74aedcffc4bb 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -213,6 +213,7 @@ struct dm_connector_state {
+ enum amdgpu_rmx_type scaling;
+ uint8_t underscan_vborder;
+ uint8_t underscan_hborder;
++ uint8_t max_bpc;
+ bool underscan_enable;
+ struct mod_freesync_user_enable user_enable;
+ bool freesync_capable;
+diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h
+index 40179c5fc6b8..8750f3f02b3f 100644
+--- a/drivers/gpu/drm/drm_internal.h
++++ b/drivers/gpu/drm/drm_internal.h
+@@ -99,6 +99,8 @@ struct device *drm_sysfs_minor_alloc(struct drm_minor *minor);
+ int drm_sysfs_connector_add(struct drm_connector *connector);
+ void drm_sysfs_connector_remove(struct drm_connector *connector);
+
++void drm_sysfs_lease_event(struct drm_device *dev);
++
+ /* drm_gem.c */
+ int drm_gem_init(struct drm_device *dev);
+ void drm_gem_destroy(struct drm_device *dev);
+diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
+index b82da96ded5c..fe6bfaf8b53f 100644
+--- a/drivers/gpu/drm/drm_lease.c
++++ b/drivers/gpu/drm/drm_lease.c
+@@ -296,7 +296,7 @@ void drm_lease_destroy(struct drm_master *master)
+
+ if (master->lessor) {
+ /* Tell the master to check the lessee list */
+- drm_sysfs_hotplug_event(dev);
++ drm_sysfs_lease_event(dev);
+ drm_master_put(&master->lessor);
+ }
+
+diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
+index b3c1daad1169..ecb7b33002bb 100644
+--- a/drivers/gpu/drm/drm_sysfs.c
++++ b/drivers/gpu/drm/drm_sysfs.c
+@@ -301,6 +301,16 @@ void drm_sysfs_connector_remove(struct drm_connector *connector)
+ connector->kdev = NULL;
+ }
+
++void drm_sysfs_lease_event(struct drm_device *dev)
++{
++ char *event_string = "LEASE=1";
++ char *envp[] = { event_string, NULL };
++
++ DRM_DEBUG("generating lease event\n");
++
++ kobject_uevent_env(&dev->primary->kdev->kobj, KOBJ_CHANGE, envp);
++}
++
+ /**
+ * drm_sysfs_hotplug_event - generate a DRM uevent
+ * @dev: DRM device
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index c3a64d6a18df..425df814de75 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2951,8 +2951,8 @@ static void intel_print_wm_latency(struct drm_i915_private *dev_priv,
+ unsigned int latency = wm[level];
+
+ if (latency == 0) {
+- DRM_ERROR("%s WM%d latency not provided\n",
+- name, level);
++ DRM_DEBUG_KMS("%s WM%d latency not provided\n",
++ name, level);
+ continue;
+ }
+
+diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
+index 7bd83e0afa97..c3ae7507d1c7 100644
+--- a/drivers/gpu/drm/msm/msm_gem_submit.c
++++ b/drivers/gpu/drm/msm/msm_gem_submit.c
+@@ -410,7 +410,6 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
+ struct msm_file_private *ctx = file->driver_priv;
+ struct msm_gem_submit *submit;
+ struct msm_gpu *gpu = priv->gpu;
+- struct dma_fence *in_fence = NULL;
+ struct sync_file *sync_file = NULL;
+ struct msm_gpu_submitqueue *queue;
+ struct msm_ringbuffer *ring;
+@@ -443,6 +442,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
+ ring = gpu->rb[queue->prio];
+
+ if (args->flags & MSM_SUBMIT_FENCE_FD_IN) {
++ struct dma_fence *in_fence;
++
+ in_fence = sync_file_get_fence(args->fence_fd);
+
+ if (!in_fence)
+@@ -452,11 +453,13 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
+ * Wait if the fence is from a foreign context, or if the fence
+ * array contains any fence from a foreign context.
+ */
+- if (!dma_fence_match_context(in_fence, ring->fctx->context)) {
++ ret = 0;
++ if (!dma_fence_match_context(in_fence, ring->fctx->context))
+ ret = dma_fence_wait(in_fence, true);
+- if (ret)
+- return ret;
+- }
++
++ dma_fence_put(in_fence);
++ if (ret)
++ return ret;
+ }
+
+ ret = mutex_lock_interruptible(&dev->struct_mutex);
+@@ -582,8 +585,6 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
+ }
+
+ out:
+- if (in_fence)
+- dma_fence_put(in_fence);
+ submit_cleanup(submit);
+ if (ret)
+ msm_gem_submit_free(submit);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 501c05cbec7e..46182d4dd1ce 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -271,6 +271,9 @@
+
+ #define USB_VENDOR_ID_CIDC 0x1677
+
++#define I2C_VENDOR_ID_CIRQUE 0x0488
++#define I2C_PRODUCT_ID_CIRQUE_121F 0x121F
++
+ #define USB_VENDOR_ID_CJTOUCH 0x24b8
+ #define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0020 0x0020
+ #define USB_DEVICE_ID_CJTOUCH_MULTI_TOUCH_0040 0x0040
+@@ -931,6 +934,10 @@
+ #define USB_VENDOR_ID_REALTEK 0x0bda
+ #define USB_DEVICE_ID_REALTEK_READER 0x0152
+
++#define USB_VENDOR_ID_RETROUSB 0xf000
++#define USB_DEVICE_ID_RETROUSB_SNES_RETROPAD 0x0003
++#define USB_DEVICE_ID_RETROUSB_SNES_RETROPORT 0x00f1
++
+ #define USB_VENDOR_ID_ROCCAT 0x1e7d
+ #define USB_DEVICE_ID_ROCCAT_ARVO 0x30d4
+ #define USB_DEVICE_ID_ROCCAT_ISKU 0x319c
+@@ -1038,6 +1045,7 @@
+ #define USB_VENDOR_ID_SYMBOL 0x05e0
+ #define USB_DEVICE_ID_SYMBOL_SCANNER_1 0x0800
+ #define USB_DEVICE_ID_SYMBOL_SCANNER_2 0x1300
++#define USB_DEVICE_ID_SYMBOL_SCANNER_3 0x1200
+
+ #define USB_VENDOR_ID_SYNAPTICS 0x06cb
+ #define USB_DEVICE_ID_SYNAPTICS_TP 0x0001
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index a481eaf39e88..a3916e58dbf5 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -325,6 +325,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM,
+ USB_DEVICE_ID_ELECOM_BM084),
+ HID_BATTERY_QUIRK_IGNORE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SYMBOL,
++ USB_DEVICE_ID_SYMBOL_SCANNER_3),
++ HID_BATTERY_QUIRK_IGNORE },
+ {}
+ };
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index da954f3f4da7..2faf5421fdd0 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1822,6 +1822,12 @@ static const struct hid_device_id mt_devices[] = {
+ MT_USB_DEVICE(USB_VENDOR_ID_CHUNGHWAT,
+ USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH) },
+
++ /* Cirque devices */
++ { .driver_data = MT_CLS_WIN_8_DUAL,
++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
++ I2C_VENDOR_ID_CIRQUE,
++ I2C_PRODUCT_ID_CIRQUE_121F) },
++
+ /* CJTouch panels */
+ { .driver_data = MT_CLS_NSMU,
+ MT_USB_DEVICE(USB_VENDOR_ID_CJTOUCH,
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 0a0605a7e481..77316f022c5a 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -136,6 +136,8 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_REALTEK, USB_DEVICE_ID_REALTEK_READER), HID_QUIRK_NO_INIT_REPORTS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPAD), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
+diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
+index 051639c09f72..840634e0f1e3 100644
+--- a/drivers/hid/uhid.c
++++ b/drivers/hid/uhid.c
+@@ -497,12 +497,13 @@ static int uhid_dev_create2(struct uhid_device *uhid,
+ goto err_free;
+ }
+
+- len = min(sizeof(hid->name), sizeof(ev->u.create2.name));
+- strlcpy(hid->name, ev->u.create2.name, len);
+- len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys));
+- strlcpy(hid->phys, ev->u.create2.phys, len);
+- len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq));
+- strlcpy(hid->uniq, ev->u.create2.uniq, len);
++ /* @hid is zero-initialized, strncpy() is correct, strlcpy() not */
++ len = min(sizeof(hid->name), sizeof(ev->u.create2.name)) - 1;
++ strncpy(hid->name, ev->u.create2.name, len);
++ len = min(sizeof(hid->phys), sizeof(ev->u.create2.phys)) - 1;
++ strncpy(hid->phys, ev->u.create2.phys, len);
++ len = min(sizeof(hid->uniq), sizeof(ev->u.create2.uniq)) - 1;
++ strncpy(hid->uniq, ev->u.create2.uniq, len);
+
+ hid->ll_driver = &uhid_hid_driver;
+ hid->bus = ev->u.create2.bus;
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index c4a1ebcfffb6..16eb9b3f1cb1 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -447,61 +447,16 @@ void vmbus_free_channels(void)
+ }
+ }
+
+-/*
+- * vmbus_process_offer - Process the offer by creating a channel/device
+- * associated with this offer
+- */
+-static void vmbus_process_offer(struct vmbus_channel *newchannel)
++/* Note: the function can run concurrently for primary/sub channels. */
++static void vmbus_add_channel_work(struct work_struct *work)
+ {
+- struct vmbus_channel *channel;
+- bool fnew = true;
++ struct vmbus_channel *newchannel =
++ container_of(work, struct vmbus_channel, add_channel_work);
++ struct vmbus_channel *primary_channel = newchannel->primary_channel;
+ unsigned long flags;
+ u16 dev_type;
+ int ret;
+
+- /* Make sure this is a new offer */
+- mutex_lock(&vmbus_connection.channel_mutex);
+-
+- /*
+- * Now that we have acquired the channel_mutex,
+- * we can release the potentially racing rescind thread.
+- */
+- atomic_dec(&vmbus_connection.offer_in_progress);
+-
+- list_for_each_entry(channel, &vmbus_connection.chn_list, listentry) {
+- if (!uuid_le_cmp(channel->offermsg.offer.if_type,
+- newchannel->offermsg.offer.if_type) &&
+- !uuid_le_cmp(channel->offermsg.offer.if_instance,
+- newchannel->offermsg.offer.if_instance)) {
+- fnew = false;
+- break;
+- }
+- }
+-
+- if (fnew)
+- list_add_tail(&newchannel->listentry,
+- &vmbus_connection.chn_list);
+-
+- mutex_unlock(&vmbus_connection.channel_mutex);
+-
+- if (!fnew) {
+- /*
+- * Check to see if this is a sub-channel.
+- */
+- if (newchannel->offermsg.offer.sub_channel_index != 0) {
+- /*
+- * Process the sub-channel.
+- */
+- newchannel->primary_channel = channel;
+- spin_lock_irqsave(&channel->lock, flags);
+- list_add_tail(&newchannel->sc_list, &channel->sc_list);
+- channel->num_sc++;
+- spin_unlock_irqrestore(&channel->lock, flags);
+- } else {
+- goto err_free_chan;
+- }
+- }
+-
+ dev_type = hv_get_dev_type(newchannel);
+
+ init_vp_index(newchannel, dev_type);
+@@ -519,27 +474,26 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
+ /*
+ * This state is used to indicate a successful open
+ * so that when we do close the channel normally, we
+- * can cleanup properly
++ * can cleanup properly.
+ */
+ newchannel->state = CHANNEL_OPEN_STATE;
+
+- if (!fnew) {
+- struct hv_device *dev
+- = newchannel->primary_channel->device_obj;
++ if (primary_channel != NULL) {
++ /* newchannel is a sub-channel. */
++ struct hv_device *dev = primary_channel->device_obj;
+
+ if (vmbus_add_channel_kobj(dev, newchannel))
+- goto err_free_chan;
++ goto err_deq_chan;
++
++ if (primary_channel->sc_creation_callback != NULL)
++ primary_channel->sc_creation_callback(newchannel);
+
+- if (channel->sc_creation_callback != NULL)
+- channel->sc_creation_callback(newchannel);
+ newchannel->probe_done = true;
+ return;
+ }
+
+ /*
+- * Start the process of binding this offer to the driver
+- * We need to set the DeviceObject field before calling
+- * vmbus_child_dev_add()
++ * Start the process of binding the primary channel to the driver
+ */
+ newchannel->device_obj = vmbus_device_create(
+ &newchannel->offermsg.offer.if_type,
+@@ -568,13 +522,28 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
+
+ err_deq_chan:
+ mutex_lock(&vmbus_connection.channel_mutex);
+- list_del(&newchannel->listentry);
++
++ /*
++ * We need to set the flag, otherwise
++ * vmbus_onoffer_rescind() can be blocked.
++ */
++ newchannel->probe_done = true;
++
++ if (primary_channel == NULL) {
++ list_del(&newchannel->listentry);
++ } else {
++ spin_lock_irqsave(&primary_channel->lock, flags);
++ list_del(&newchannel->sc_list);
++ spin_unlock_irqrestore(&primary_channel->lock, flags);
++ }
++
+ mutex_unlock(&vmbus_connection.channel_mutex);
+
+ if (newchannel->target_cpu != get_cpu()) {
+ put_cpu();
+ smp_call_function_single(newchannel->target_cpu,
+- percpu_channel_deq, newchannel, true);
++ percpu_channel_deq,
++ newchannel, true);
+ } else {
+ percpu_channel_deq(newchannel);
+ put_cpu();
+@@ -582,14 +551,104 @@ err_deq_chan:
+
+ vmbus_release_relid(newchannel->offermsg.child_relid);
+
+-err_free_chan:
+ free_channel(newchannel);
+ }
+
++/*
++ * vmbus_process_offer - Process the offer by creating a channel/device
++ * associated with this offer
++ */
++static void vmbus_process_offer(struct vmbus_channel *newchannel)
++{
++ struct vmbus_channel *channel;
++ struct workqueue_struct *wq;
++ unsigned long flags;
++ bool fnew = true;
++
++ mutex_lock(&vmbus_connection.channel_mutex);
++
++ /*
++ * Now that we have acquired the channel_mutex,
++ * we can release the potentially racing rescind thread.
++ */
++ atomic_dec(&vmbus_connection.offer_in_progress);
++
++ list_for_each_entry(channel, &vmbus_connection.chn_list, listentry) {
++ if (!uuid_le_cmp(channel->offermsg.offer.if_type,
++ newchannel->offermsg.offer.if_type) &&
++ !uuid_le_cmp(channel->offermsg.offer.if_instance,
++ newchannel->offermsg.offer.if_instance)) {
++ fnew = false;
++ break;
++ }
++ }
++
++ if (fnew)
++ list_add_tail(&newchannel->listentry,
++ &vmbus_connection.chn_list);
++ else {
++ /*
++ * Check to see if this is a valid sub-channel.
++ */
++ if (newchannel->offermsg.offer.sub_channel_index == 0) {
++ mutex_unlock(&vmbus_connection.channel_mutex);
++ /*
++ * Don't call free_channel(), because newchannel->kobj
++ * is not initialized yet.
++ */
++ kfree(newchannel);
++ WARN_ON_ONCE(1);
++ return;
++ }
++ /*
++ * Process the sub-channel.
++ */
++ newchannel->primary_channel = channel;
++ spin_lock_irqsave(&channel->lock, flags);
++ list_add_tail(&newchannel->sc_list, &channel->sc_list);
++ spin_unlock_irqrestore(&channel->lock, flags);
++ }
++
++ mutex_unlock(&vmbus_connection.channel_mutex);
++
++ /*
++ * vmbus_process_offer() mustn't call channel->sc_creation_callback()
++ * directly for sub-channels, because sc_creation_callback() ->
++ * vmbus_open() may never get the host's response to the
++ * OPEN_CHANNEL message (the host may rescind a channel at any time,
++ * e.g. in the case of hot removing a NIC), and vmbus_onoffer_rescind()
++ * may not wake up the vmbus_open() as it's blocked due to a non-zero
++ * vmbus_connection.offer_in_progress, and finally we have a deadlock.
++ *
++ * The above is also true for primary channels, if the related device
++ * drivers use sync probing mode by default.
++ *
++ * And, usually the handling of primary channels and sub-channels can
++ * depend on each other, so we should offload them to different
++ * workqueues to avoid possible deadlock, e.g. in sync-probing mode,
++ * NIC1's netvsc_subchan_work() can race with NIC2's netvsc_probe() ->
++ * rtnl_lock(), and causes deadlock: the former gets the rtnl_lock
++ * and waits for all the sub-channels to appear, but the latter
++ * can't get the rtnl_lock and this blocks the handling of
++ * sub-channels.
++ */
++ INIT_WORK(&newchannel->add_channel_work, vmbus_add_channel_work);
++ wq = fnew ? vmbus_connection.handle_primary_chan_wq :
++ vmbus_connection.handle_sub_chan_wq;
++ queue_work(wq, &newchannel->add_channel_work);
++}
++
+ /*
+ * We use this state to statically distribute the channel interrupt load.
+ */
+ static int next_numa_node_id;
++/*
++ * init_vp_index() accesses global variables like next_numa_node_id, and
++ * it can run concurrently for primary channels and sub-channels: see
++ * vmbus_process_offer(), so we need the lock to protect the global
++ * variables.
++ */
++static DEFINE_SPINLOCK(bind_channel_to_cpu_lock);
+
+ /*
+ * Starting with Win8, we can statically distribute the incoming
+@@ -625,6 +684,8 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ return;
+ }
+
++ spin_lock(&bind_channel_to_cpu_lock);
++
+ /*
+ * Based on the channel affinity policy, we will assign the NUMA
+ * nodes.
+@@ -707,6 +768,8 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ channel->target_cpu = cur_cpu;
+ channel->target_vp = hv_cpu_number_to_vp_number(cur_cpu);
+
++ spin_unlock(&bind_channel_to_cpu_lock);
++
+ free_cpumask_var(available_mask);
+ }
+
+diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
+index f4d08c8ac7f8..4fe117b761ce 100644
+--- a/drivers/hv/connection.c
++++ b/drivers/hv/connection.c
+@@ -190,6 +190,20 @@ int vmbus_connect(void)
+ goto cleanup;
+ }
+
++ vmbus_connection.handle_primary_chan_wq =
++ create_workqueue("hv_pri_chan");
++ if (!vmbus_connection.handle_primary_chan_wq) {
++ ret = -ENOMEM;
++ goto cleanup;
++ }
++
++ vmbus_connection.handle_sub_chan_wq =
++ create_workqueue("hv_sub_chan");
++ if (!vmbus_connection.handle_sub_chan_wq) {
++ ret = -ENOMEM;
++ goto cleanup;
++ }
++
+ INIT_LIST_HEAD(&vmbus_connection.chn_msg_list);
+ spin_lock_init(&vmbus_connection.channelmsg_lock);
+
+@@ -280,10 +294,14 @@ void vmbus_disconnect(void)
+ */
+ vmbus_initiate_unload(false);
+
+- if (vmbus_connection.work_queue) {
+- drain_workqueue(vmbus_connection.work_queue);
++ if (vmbus_connection.handle_sub_chan_wq)
++ destroy_workqueue(vmbus_connection.handle_sub_chan_wq);
++
++ if (vmbus_connection.handle_primary_chan_wq)
++ destroy_workqueue(vmbus_connection.handle_primary_chan_wq);
++
++ if (vmbus_connection.work_queue)
+ destroy_workqueue(vmbus_connection.work_queue);
+- }
+
+ if (vmbus_connection.int_page) {
+ free_pages((unsigned long)vmbus_connection.int_page, 0);
+diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
+index 72eaba3d50fc..87d3d7da78f8 100644
+--- a/drivers/hv/hyperv_vmbus.h
++++ b/drivers/hv/hyperv_vmbus.h
+@@ -335,7 +335,14 @@ struct vmbus_connection {
+ struct list_head chn_list;
+ struct mutex channel_mutex;
+
++ /*
++ * An offer message is handled first on the work_queue, and then
++ * is further handled on handle_primary_chan_wq or
++ * handle_sub_chan_wq.
++ */
+ struct workqueue_struct *work_queue;
++ struct workqueue_struct *handle_primary_chan_wq;
++ struct workqueue_struct *handle_sub_chan_wq;
+ };
+
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 84b3e4445d46..e062ab9687c7 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -797,7 +797,8 @@ static int iommu_init_ga_log(struct amd_iommu *iommu)
+ entry = iommu_virt_to_phys(iommu->ga_log) | GA_LOG_SIZE_512;
+ memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_BASE_OFFSET,
+ &entry, sizeof(entry));
+- entry = (iommu_virt_to_phys(iommu->ga_log) & 0xFFFFFFFFFFFFFULL) & ~7ULL;
++ entry = (iommu_virt_to_phys(iommu->ga_log_tail) &
++ (BIT_ULL(52)-1)) & ~7ULL;
+ memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_TAIL_OFFSET,
+ &entry, sizeof(entry));
+ writel(0x00, iommu->mmio_base + MMIO_GA_HEAD_OFFSET);
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index bedc801b06a0..a76c47f20587 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3100,7 +3100,7 @@ static int copy_context_table(struct intel_iommu *iommu,
+ }
+
+ if (old_ce)
+- iounmap(old_ce);
++ memunmap(old_ce);
+
+ ret = 0;
+ if (devfn < 0x80)
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index 4a03e5090952..188f4eaed6e5 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -596,7 +596,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
+ pr_err("%s: Page request without PASID: %08llx %08llx\n",
+ iommu->name, ((unsigned long long *)req)[0],
+ ((unsigned long long *)req)[1]);
+- goto bad_req;
++ goto no_pasid;
+ }
+
+ if (!svm || svm->pasid != req->pasid) {
+diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
+index 22b94f8a9a04..d8598e44e381 100644
+--- a/drivers/iommu/ipmmu-vmsa.c
++++ b/drivers/iommu/ipmmu-vmsa.c
+@@ -501,6 +501,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain)
+
+ static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain)
+ {
++ if (!domain->mmu)
++ return;
++
+ /*
+ * Disable the context. Flush the TLB as required when modifying the
+ * context registers.
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index dd8bad74a1f0..a537e518384b 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -1167,6 +1167,8 @@ static int cec_config_log_addr(struct cec_adapter *adap,
+ {
+ struct cec_log_addrs *las = &adap->log_addrs;
+ struct cec_msg msg = { };
++ const unsigned int max_retries = 2;
++ unsigned int i;
+ int err;
+
+ if (cec_has_log_addr(adap, log_addr))
+@@ -1175,19 +1177,44 @@ static int cec_config_log_addr(struct cec_adapter *adap,
+ /* Send poll message */
+ msg.len = 1;
+ msg.msg[0] = (log_addr << 4) | log_addr;
+- err = cec_transmit_msg_fh(adap, &msg, NULL, true);
+
+- /*
+- * While trying to poll the physical address was reset
+- * and the adapter was unconfigured, so bail out.
+- */
+- if (!adap->is_configuring)
+- return -EINTR;
++ for (i = 0; i < max_retries; i++) {
++ err = cec_transmit_msg_fh(adap, &msg, NULL, true);
+
+- if (err)
+- return err;
++ /*
++ * While trying to poll the physical address was reset
++ * and the adapter was unconfigured, so bail out.
++ */
++ if (!adap->is_configuring)
++ return -EINTR;
++
++ if (err)
++ return err;
+
+- if (msg.tx_status & CEC_TX_STATUS_OK)
++ /*
++ * The message was aborted due to a disconnect or
++ * unconfigure, just bail out.
++ */
++ if (msg.tx_status & CEC_TX_STATUS_ABORTED)
++ return -EINTR;
++ if (msg.tx_status & CEC_TX_STATUS_OK)
++ return 0;
++ if (msg.tx_status & CEC_TX_STATUS_NACK)
++ break;
++ /*
++ * Retry up to max_retries times if the message was neither
++ * OKed or NACKed. This can happen due to e.g. a Lost
++ * Arbitration condition.
++ */
++ }
++
++ /*
++ * If we are unable to get an OK or a NACK after max_retries attempts
++ * (and note that each attempt already consists of four polls), then
++ * then we assume that something is really weird and that it is not a
++ * good idea to try and claim this logical address.
++ */
++ if (i == max_retries)
+ return 0;
+
+ /*
+diff --git a/drivers/media/dvb-frontends/dvb-pll.c b/drivers/media/dvb-frontends/dvb-pll.c
+index 6d4b2eec67b4..29836c1a40e9 100644
+--- a/drivers/media/dvb-frontends/dvb-pll.c
++++ b/drivers/media/dvb-frontends/dvb-pll.c
+@@ -80,8 +80,8 @@ struct dvb_pll_desc {
+
+ static const struct dvb_pll_desc dvb_pll_thomson_dtt7579 = {
+ .name = "Thomson dtt7579",
+- .min = 177000000,
+- .max = 858000000,
++ .min = 177 * MHz,
++ .max = 858 * MHz,
+ .iffreq= 36166667,
+ .sleepdata = (u8[]){ 2, 0xb4, 0x03 },
+ .count = 4,
+@@ -102,8 +102,8 @@ static void thomson_dtt759x_bw(struct dvb_frontend *fe, u8 *buf)
+
+ static const struct dvb_pll_desc dvb_pll_thomson_dtt759x = {
+ .name = "Thomson dtt759x",
+- .min = 177000000,
+- .max = 896000000,
++ .min = 177 * MHz,
++ .max = 896 * MHz,
+ .set = thomson_dtt759x_bw,
+ .iffreq= 36166667,
+ .sleepdata = (u8[]){ 2, 0x84, 0x03 },
+@@ -126,8 +126,8 @@ static void thomson_dtt7520x_bw(struct dvb_frontend *fe, u8 *buf)
+
+ static const struct dvb_pll_desc dvb_pll_thomson_dtt7520x = {
+ .name = "Thomson dtt7520x",
+- .min = 185000000,
+- .max = 900000000,
++ .min = 185 * MHz,
++ .max = 900 * MHz,
+ .set = thomson_dtt7520x_bw,
+ .iffreq = 36166667,
+ .count = 7,
+@@ -144,8 +144,8 @@ static const struct dvb_pll_desc dvb_pll_thomson_dtt7520x = {
+
+ static const struct dvb_pll_desc dvb_pll_lg_z201 = {
+ .name = "LG z201",
+- .min = 174000000,
+- .max = 862000000,
++ .min = 174 * MHz,
++ .max = 862 * MHz,
+ .iffreq= 36166667,
+ .sleepdata = (u8[]){ 2, 0xbc, 0x03 },
+ .count = 5,
+@@ -160,8 +160,8 @@ static const struct dvb_pll_desc dvb_pll_lg_z201 = {
+
+ static const struct dvb_pll_desc dvb_pll_unknown_1 = {
+ .name = "unknown 1", /* used by dntv live dvb-t */
+- .min = 174000000,
+- .max = 862000000,
++ .min = 174 * MHz,
++ .max = 862 * MHz,
+ .iffreq= 36166667,
+ .count = 9,
+ .entries = {
+@@ -182,8 +182,8 @@ static const struct dvb_pll_desc dvb_pll_unknown_1 = {
+ */
+ static const struct dvb_pll_desc dvb_pll_tua6010xs = {
+ .name = "Infineon TUA6010XS",
+- .min = 44250000,
+- .max = 858000000,
++ .min = 44250 * kHz,
++ .max = 858 * MHz,
+ .iffreq= 36125000,
+ .count = 3,
+ .entries = {
+@@ -196,8 +196,8 @@ static const struct dvb_pll_desc dvb_pll_tua6010xs = {
+ /* Panasonic env57h1xd5 (some Philips PLL ?) */
+ static const struct dvb_pll_desc dvb_pll_env57h1xd5 = {
+ .name = "Panasonic ENV57H1XD5",
+- .min = 44250000,
+- .max = 858000000,
++ .min = 44250 * kHz,
++ .max = 858 * MHz,
+ .iffreq= 36125000,
+ .count = 4,
+ .entries = {
+@@ -220,8 +220,8 @@ static void tda665x_bw(struct dvb_frontend *fe, u8 *buf)
+
+ static const struct dvb_pll_desc dvb_pll_tda665x = {
+ .name = "Philips TDA6650/TDA6651",
+- .min = 44250000,
+- .max = 858000000,
++ .min = 44250 * kHz,
++ .max = 858 * MHz,
+ .set = tda665x_bw,
+ .iffreq= 36166667,
+ .initdata = (u8[]){ 4, 0x0b, 0xf5, 0x85, 0xab },
+@@ -254,8 +254,8 @@ static void tua6034_bw(struct dvb_frontend *fe, u8 *buf)
+
+ static const struct dvb_pll_desc dvb_pll_tua6034 = {
+ .name = "Infineon TUA6034",
+- .min = 44250000,
+- .max = 858000000,
++ .min = 44250 * kHz,
++ .max = 858 * MHz,
+ .iffreq= 36166667,
+ .count = 3,
+ .set = tua6034_bw,
+@@ -278,8 +278,8 @@ static void tded4_bw(struct dvb_frontend *fe, u8 *buf)
+
+ static const struct dvb_pll_desc dvb_pll_tded4 = {
+ .name = "ALPS TDED4",
+- .min = 47000000,
+- .max = 863000000,
++ .min = 47 * MHz,
++ .max = 863 * MHz,
+ .iffreq= 36166667,
+ .set = tded4_bw,
+ .count = 4,
+@@ -296,8 +296,8 @@ static const struct dvb_pll_desc dvb_pll_tded4 = {
+ */
+ static const struct dvb_pll_desc dvb_pll_tdhu2 = {
+ .name = "ALPS TDHU2",
+- .min = 54000000,
+- .max = 864000000,
++ .min = 54 * MHz,
++ .max = 864 * MHz,
+ .iffreq= 44000000,
+ .count = 4,
+ .entries = {
+@@ -313,8 +313,8 @@ static const struct dvb_pll_desc dvb_pll_tdhu2 = {
+ */
+ static const struct dvb_pll_desc dvb_pll_samsung_tbmv = {
+ .name = "Samsung TBMV30111IN / TBMV30712IN1",
+- .min = 54000000,
+- .max = 860000000,
++ .min = 54 * MHz,
++ .max = 860 * MHz,
+ .iffreq= 44000000,
+ .count = 6,
+ .entries = {
+@@ -332,8 +332,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tbmv = {
+ */
+ static const struct dvb_pll_desc dvb_pll_philips_sd1878_tda8261 = {
+ .name = "Philips SD1878",
+- .min = 950000,
+- .max = 2150000,
++ .min = 950 * MHz,
++ .max = 2150 * MHz,
+ .iffreq= 249, /* zero-IF, offset 249 is to round up */
+ .count = 4,
+ .entries = {
+@@ -398,8 +398,8 @@ static void opera1_bw(struct dvb_frontend *fe, u8 *buf)
+
+ static const struct dvb_pll_desc dvb_pll_opera1 = {
+ .name = "Opera Tuner",
+- .min = 900000,
+- .max = 2250000,
++ .min = 900 * MHz,
++ .max = 2250 * MHz,
+ .initdata = (u8[]){ 4, 0x08, 0xe5, 0xe1, 0x00 },
+ .initdata2 = (u8[]){ 4, 0x08, 0xe5, 0xe5, 0x00 },
+ .iffreq= 0,
+@@ -445,8 +445,8 @@ static void samsung_dtos403ih102a_set(struct dvb_frontend *fe, u8 *buf)
+ /* unknown pll used in Samsung DTOS403IH102A DVB-C tuner */
+ static const struct dvb_pll_desc dvb_pll_samsung_dtos403ih102a = {
+ .name = "Samsung DTOS403IH102A",
+- .min = 44250000,
+- .max = 858000000,
++ .min = 44250 * kHz,
++ .max = 858 * MHz,
+ .iffreq = 36125000,
+ .count = 8,
+ .set = samsung_dtos403ih102a_set,
+@@ -465,8 +465,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_dtos403ih102a = {
+ /* Samsung TDTC9251DH0 DVB-T NIM, as used on AirStar 2 */
+ static const struct dvb_pll_desc dvb_pll_samsung_tdtc9251dh0 = {
+ .name = "Samsung TDTC9251DH0",
+- .min = 48000000,
+- .max = 863000000,
++ .min = 48 * MHz,
++ .max = 863 * MHz,
+ .iffreq = 36166667,
+ .count = 3,
+ .entries = {
+@@ -479,8 +479,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tdtc9251dh0 = {
+ /* Samsung TBDU18132 DVB-S NIM with TSA5059 PLL, used in SkyStar2 DVB-S 2.3 */
+ static const struct dvb_pll_desc dvb_pll_samsung_tbdu18132 = {
+ .name = "Samsung TBDU18132",
+- .min = 950000,
+- .max = 2150000, /* guesses */
++ .min = 950 * MHz,
++ .max = 2150 * MHz, /* guesses */
+ .iffreq = 0,
+ .count = 2,
+ .entries = {
+@@ -500,8 +500,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tbdu18132 = {
+ /* Samsung TBMU24112 DVB-S NIM with SL1935 zero-IF tuner */
+ static const struct dvb_pll_desc dvb_pll_samsung_tbmu24112 = {
+ .name = "Samsung TBMU24112",
+- .min = 950000,
+- .max = 2150000, /* guesses */
++ .min = 950 * MHz,
++ .max = 2150 * MHz, /* guesses */
+ .iffreq = 0,
+ .count = 2,
+ .entries = {
+@@ -521,8 +521,8 @@ static const struct dvb_pll_desc dvb_pll_samsung_tbmu24112 = {
+ * 822 - 862 1 * 0 0 1 0 0 0 0x88 */
+ static const struct dvb_pll_desc dvb_pll_alps_tdee4 = {
+ .name = "ALPS TDEE4",
+- .min = 47000000,
+- .max = 862000000,
++ .min = 47 * MHz,
++ .max = 862 * MHz,
+ .iffreq = 36125000,
+ .count = 4,
+ .entries = {
+@@ -537,8 +537,8 @@ static const struct dvb_pll_desc dvb_pll_alps_tdee4 = {
+ /* CP cur. 50uA, AGC takeover: 103dBuV, PORT3 on */
+ static const struct dvb_pll_desc dvb_pll_tua6034_friio = {
+ .name = "Infineon TUA6034 ISDB-T (Friio)",
+- .min = 90000000,
+- .max = 770000000,
++ .min = 90 * MHz,
++ .max = 770 * MHz,
+ .iffreq = 57000000,
+ .initdata = (u8[]){ 4, 0x9a, 0x50, 0xb2, 0x08 },
+ .sleepdata = (u8[]){ 4, 0x9a, 0x70, 0xb3, 0x0b },
+@@ -553,8 +553,8 @@ static const struct dvb_pll_desc dvb_pll_tua6034_friio = {
+ /* Philips TDA6651 ISDB-T, used in Earthsoft PT1 */
+ static const struct dvb_pll_desc dvb_pll_tda665x_earth_pt1 = {
+ .name = "Philips TDA6651 ISDB-T (EarthSoft PT1)",
+- .min = 90000000,
+- .max = 770000000,
++ .min = 90 * MHz,
++ .max = 770 * MHz,
+ .iffreq = 57000000,
+ .initdata = (u8[]){ 5, 0x0e, 0x7f, 0xc1, 0x80, 0x80 },
+ .count = 10,
+@@ -610,9 +610,6 @@ static int dvb_pll_configure(struct dvb_frontend *fe, u8 *buf,
+ u32 div;
+ int i;
+
+- if (frequency && (frequency < desc->min || frequency > desc->max))
+- return -EINVAL;
+-
+ for (i = 0; i < desc->count; i++) {
+ if (frequency > desc->entries[i].limit)
+ continue;
+@@ -799,7 +796,6 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
+ struct dvb_pll_priv *priv = NULL;
+ int ret;
+ const struct dvb_pll_desc *desc;
+- struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+
+ b1 = kmalloc(1, GFP_KERNEL);
+ if (!b1)
+@@ -845,18 +841,12 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
+
+ strncpy(fe->ops.tuner_ops.info.name, desc->name,
+ sizeof(fe->ops.tuner_ops.info.name));
+- switch (c->delivery_system) {
+- case SYS_DVBS:
+- case SYS_DVBS2:
+- case SYS_TURBO:
+- case SYS_ISDBS:
+- fe->ops.tuner_ops.info.frequency_min_hz = desc->min * kHz;
+- fe->ops.tuner_ops.info.frequency_max_hz = desc->max * kHz;
+- break;
+- default:
+- fe->ops.tuner_ops.info.frequency_min_hz = desc->min;
+- fe->ops.tuner_ops.info.frequency_max_hz = desc->max;
+- }
++
++ fe->ops.tuner_ops.info.frequency_min_hz = desc->min;
++ fe->ops.tuner_ops.info.frequency_max_hz = desc->max;
++
++ dprintk("%s tuner, frequency range: %u...%u\n",
++ desc->name, desc->min, desc->max);
+
+ if (!desc->initdata)
+ fe->ops.tuner_ops.init = NULL;
+diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+index 29027159eced..ca1a4d8e972e 100644
+--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+@@ -1846,12 +1846,12 @@ static void cio2_pci_remove(struct pci_dev *pci_dev)
+ struct cio2_device *cio2 = pci_get_drvdata(pci_dev);
+ unsigned int i;
+
++ media_device_unregister(&cio2->media_dev);
+ cio2_notifier_exit(cio2);
+- cio2_fbpt_exit_dummy(cio2);
+ for (i = 0; i < CIO2_QUEUES; i++)
+ cio2_queue_exit(cio2, &cio2->queue[i]);
++ cio2_fbpt_exit_dummy(cio2);
+ v4l2_device_unregister(&cio2->v4l2_dev);
+- media_device_unregister(&cio2->media_dev);
+ media_device_cleanup(&cio2->media_dev);
+ mutex_destroy(&cio2->lock);
+ }
+diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
+index 842e2235047d..432bc7fbedc9 100644
+--- a/drivers/media/platform/omap3isp/isp.c
++++ b/drivers/media/platform/omap3isp/isp.c
+@@ -1587,6 +1587,8 @@ static void isp_pm_complete(struct device *dev)
+
+ static void isp_unregister_entities(struct isp_device *isp)
+ {
++ media_device_unregister(&isp->media_dev);
++
+ omap3isp_csi2_unregister_entities(&isp->isp_csi2a);
+ omap3isp_ccp2_unregister_entities(&isp->isp_ccp2);
+ omap3isp_ccdc_unregister_entities(&isp->isp_ccdc);
+@@ -1597,7 +1599,6 @@ static void isp_unregister_entities(struct isp_device *isp)
+ omap3isp_stat_unregister_entities(&isp->isp_hist);
+
+ v4l2_device_unregister(&isp->v4l2_dev);
+- media_device_unregister(&isp->media_dev);
+ media_device_cleanup(&isp->media_dev);
+ }
+
+diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
+index 408cd55d3580..7a33a52eacca 100644
+--- a/drivers/media/platform/vicodec/vicodec-core.c
++++ b/drivers/media/platform/vicodec/vicodec-core.c
+@@ -42,7 +42,7 @@ MODULE_PARM_DESC(debug, " activates debug info");
+ #define MAX_WIDTH 4096U
+ #define MIN_WIDTH 640U
+ #define MAX_HEIGHT 2160U
+-#define MIN_HEIGHT 480U
++#define MIN_HEIGHT 360U
+
+ #define dprintk(dev, fmt, arg...) \
+ v4l2_dbg(1, debug, &dev->v4l2_dev, "%s: " fmt, __func__, ## arg)
+@@ -438,7 +438,8 @@ restart:
+ for (; p < p_out + sz; p++) {
+ u32 copy;
+
+- p = memchr(p, magic[ctx->comp_magic_cnt], sz);
++ p = memchr(p, magic[ctx->comp_magic_cnt],
++ p_out + sz - p);
+ if (!p) {
+ ctx->comp_magic_cnt = 0;
+ break;
+diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
+index 57aa521e16b1..405a6a76d820 100644
+--- a/drivers/media/usb/gspca/gspca.c
++++ b/drivers/media/usb/gspca/gspca.c
+@@ -426,10 +426,10 @@ void gspca_frame_add(struct gspca_dev *gspca_dev,
+
+ /* append the packet to the frame buffer */
+ if (len > 0) {
+- if (gspca_dev->image_len + len > gspca_dev->pixfmt.sizeimage) {
++ if (gspca_dev->image_len + len > PAGE_ALIGN(gspca_dev->pixfmt.sizeimage)) {
+ gspca_err(gspca_dev, "frame overflow %d > %d\n",
+ gspca_dev->image_len + len,
+- gspca_dev->pixfmt.sizeimage);
++ PAGE_ALIGN(gspca_dev->pixfmt.sizeimage));
+ packet_type = DISCARD_PACKET;
+ } else {
+ /* !! image is NULL only when last pkt is LAST or DISCARD
+@@ -1297,18 +1297,19 @@ static int gspca_queue_setup(struct vb2_queue *vq,
+ unsigned int sizes[], struct device *alloc_devs[])
+ {
+ struct gspca_dev *gspca_dev = vb2_get_drv_priv(vq);
++ unsigned int size = PAGE_ALIGN(gspca_dev->pixfmt.sizeimage);
+
+ if (*nplanes)
+- return sizes[0] < gspca_dev->pixfmt.sizeimage ? -EINVAL : 0;
++ return sizes[0] < size ? -EINVAL : 0;
+ *nplanes = 1;
+- sizes[0] = gspca_dev->pixfmt.sizeimage;
++ sizes[0] = size;
+ return 0;
+ }
+
+ static int gspca_buffer_prepare(struct vb2_buffer *vb)
+ {
+ struct gspca_dev *gspca_dev = vb2_get_drv_priv(vb->vb2_queue);
+- unsigned long size = gspca_dev->pixfmt.sizeimage;
++ unsigned long size = PAGE_ALIGN(gspca_dev->pixfmt.sizeimage);
+
+ if (vb2_plane_size(vb, 0) < size) {
+ gspca_err(gspca_dev, "buffer too small (%lu < %lu)\n",
+diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c
+index 999dac752bcc..6b22d54a540d 100644
+--- a/drivers/mfd/cros_ec_dev.c
++++ b/drivers/mfd/cros_ec_dev.c
+@@ -263,6 +263,11 @@ static const struct file_operations fops = {
+ #endif
+ };
+
++static void cros_ec_class_release(struct device *dev)
++{
++ kfree(to_cros_ec_dev(dev));
++}
++
+ static void cros_ec_sensors_register(struct cros_ec_dev *ec)
+ {
+ /*
+@@ -395,7 +400,7 @@ static int ec_device_probe(struct platform_device *pdev)
+ int retval = -ENOMEM;
+ struct device *dev = &pdev->dev;
+ struct cros_ec_platform *ec_platform = dev_get_platdata(dev);
+- struct cros_ec_dev *ec = devm_kzalloc(dev, sizeof(*ec), GFP_KERNEL);
++ struct cros_ec_dev *ec = kzalloc(sizeof(*ec), GFP_KERNEL);
+
+ if (!ec)
+ return retval;
+@@ -417,6 +422,7 @@ static int ec_device_probe(struct platform_device *pdev)
+ ec->class_dev.devt = MKDEV(ec_major, pdev->id);
+ ec->class_dev.class = &cros_class;
+ ec->class_dev.parent = dev;
++ ec->class_dev.release = cros_ec_class_release;
+
+ retval = dev_set_name(&ec->class_dev, "%s", ec_platform->ec_name);
+ if (retval) {
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index d1d470bb32e4..8815f3e2b718 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -151,15 +151,15 @@
+ #define NAND_VERSION_MINOR_SHIFT 16
+
+ /* NAND OP_CMDs */
+-#define PAGE_READ 0x2
+-#define PAGE_READ_WITH_ECC 0x3
+-#define PAGE_READ_WITH_ECC_SPARE 0x4
+-#define PROGRAM_PAGE 0x6
+-#define PAGE_PROGRAM_WITH_ECC 0x7
+-#define PROGRAM_PAGE_SPARE 0x9
+-#define BLOCK_ERASE 0xa
+-#define FETCH_ID 0xb
+-#define RESET_DEVICE 0xd
++#define OP_PAGE_READ 0x2
++#define OP_PAGE_READ_WITH_ECC 0x3
++#define OP_PAGE_READ_WITH_ECC_SPARE 0x4
++#define OP_PROGRAM_PAGE 0x6
++#define OP_PAGE_PROGRAM_WITH_ECC 0x7
++#define OP_PROGRAM_PAGE_SPARE 0x9
++#define OP_BLOCK_ERASE 0xa
++#define OP_FETCH_ID 0xb
++#define OP_RESET_DEVICE 0xd
+
+ /* Default Value for NAND_DEV_CMD_VLD */
+ #define NAND_DEV_CMD_VLD_VAL (READ_START_VLD | WRITE_START_VLD | \
+@@ -692,11 +692,11 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read)
+
+ if (read) {
+ if (host->use_ecc)
+- cmd = PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
++ cmd = OP_PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
+ else
+- cmd = PAGE_READ | PAGE_ACC | LAST_PAGE;
++ cmd = OP_PAGE_READ | PAGE_ACC | LAST_PAGE;
+ } else {
+- cmd = PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
++ cmd = OP_PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
+ }
+
+ if (host->use_ecc) {
+@@ -1170,7 +1170,7 @@ static int nandc_param(struct qcom_nand_host *host)
+ * in use. we configure the controller to perform a raw read of 512
+ * bytes to read onfi params
+ */
+- nandc_set_reg(nandc, NAND_FLASH_CMD, PAGE_READ | PAGE_ACC | LAST_PAGE);
++ nandc_set_reg(nandc, NAND_FLASH_CMD, OP_PAGE_READ | PAGE_ACC | LAST_PAGE);
+ nandc_set_reg(nandc, NAND_ADDR0, 0);
+ nandc_set_reg(nandc, NAND_ADDR1, 0);
+ nandc_set_reg(nandc, NAND_DEV0_CFG0, 0 << CW_PER_PAGE
+@@ -1224,7 +1224,7 @@ static int erase_block(struct qcom_nand_host *host, int page_addr)
+ struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
+
+ nandc_set_reg(nandc, NAND_FLASH_CMD,
+- BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
++ OP_BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
+ nandc_set_reg(nandc, NAND_ADDR0, page_addr);
+ nandc_set_reg(nandc, NAND_ADDR1, 0);
+ nandc_set_reg(nandc, NAND_DEV0_CFG0,
+@@ -1255,7 +1255,7 @@ static int read_id(struct qcom_nand_host *host, int column)
+ if (column == -1)
+ return 0;
+
+- nandc_set_reg(nandc, NAND_FLASH_CMD, FETCH_ID);
++ nandc_set_reg(nandc, NAND_FLASH_CMD, OP_FETCH_ID);
+ nandc_set_reg(nandc, NAND_ADDR0, column);
+ nandc_set_reg(nandc, NAND_ADDR1, 0);
+ nandc_set_reg(nandc, NAND_FLASH_CHIP_SELECT,
+@@ -1276,7 +1276,7 @@ static int reset(struct qcom_nand_host *host)
+ struct nand_chip *chip = &host->chip;
+ struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
+
+- nandc_set_reg(nandc, NAND_FLASH_CMD, RESET_DEVICE);
++ nandc_set_reg(nandc, NAND_FLASH_CMD, OP_RESET_DEVICE);
+ nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
+
+ write_reg_dma(nandc, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL);
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index 6e9cbd1a0b6d..0806c7a81c0f 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -644,9 +644,23 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr,
+ ndelay(cqspi->wr_delay);
+
+ while (remaining > 0) {
++ size_t write_words, mod_bytes;
++
+ write_bytes = remaining > page_size ? page_size : remaining;
+- iowrite32_rep(cqspi->ahb_base, txbuf,
+- DIV_ROUND_UP(write_bytes, 4));
++ write_words = write_bytes / 4;
++ mod_bytes = write_bytes % 4;
++ /* Write 4 bytes at a time then single bytes. */
++ if (write_words) {
++ iowrite32_rep(cqspi->ahb_base, txbuf, write_words);
++ txbuf += (write_words * 4);
++ }
++ if (mod_bytes) {
++ unsigned int temp = 0xFFFFFFFF;
++
++ memcpy(&temp, txbuf, mod_bytes);
++ iowrite32(temp, cqspi->ahb_base);
++ txbuf += mod_bytes;
++ }
+
+ if (!wait_for_completion_timeout(&cqspi->transfer_complete,
+ msecs_to_jiffies(CQSPI_TIMEOUT_MS))) {
+@@ -655,7 +669,6 @@ static int cqspi_indirect_write_execute(struct spi_nor *nor, loff_t to_addr,
+ goto failwr;
+ }
+
+- txbuf += write_bytes;
+ remaining -= write_bytes;
+
+ if (remaining > 0)
+diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
+index 11662f479e76..771a46083739 100644
+--- a/drivers/net/can/rcar/rcar_can.c
++++ b/drivers/net/can/rcar/rcar_can.c
+@@ -24,6 +24,9 @@
+
+ #define RCAR_CAN_DRV_NAME "rcar_can"
+
++#define RCAR_SUPPORTED_CLOCKS (BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \
++ BIT(CLKR_CLKEXT))
++
+ /* Mailbox configuration:
+ * mailbox 60 - 63 - Rx FIFO mailboxes
+ * mailbox 56 - 59 - Tx FIFO mailboxes
+@@ -789,7 +792,7 @@ static int rcar_can_probe(struct platform_device *pdev)
+ goto fail_clk;
+ }
+
+- if (clock_select >= ARRAY_SIZE(clock_names)) {
++ if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) {
+ err = -EINVAL;
+ dev_err(&pdev->dev, "invalid CAN clock selected\n");
+ goto fail_clk;
+diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c
+index 0678a38b1af4..c9fd83e8d947 100644
+--- a/drivers/net/can/usb/ucan.c
++++ b/drivers/net/can/usb/ucan.c
+@@ -1575,11 +1575,8 @@ err_firmware_needs_update:
+ /* disconnect the device */
+ static void ucan_disconnect(struct usb_interface *intf)
+ {
+- struct usb_device *udev;
+ struct ucan_priv *up = usb_get_intfdata(intf);
+
+- udev = interface_to_usbdev(intf);
+-
+ usb_set_intfdata(intf, NULL);
+
+ if (up) {
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index d906293ce07d..4b73131a0f20 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2627,8 +2627,8 @@ err_device_destroy:
+ ena_com_abort_admin_commands(ena_dev);
+ ena_com_wait_for_abort_completion(ena_dev);
+ ena_com_admin_destroy(ena_dev);
+- ena_com_mmio_reg_read_request_destroy(ena_dev);
+ ena_com_dev_reset(ena_dev, ENA_REGS_RESET_DRIVER_INVALID_STATE);
++ ena_com_mmio_reg_read_request_destroy(ena_dev);
+ err:
+ clear_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
+ clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
+diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
+index cdd7a611479b..19f89d9b1781 100644
+--- a/drivers/net/ethernet/amd/sunlance.c
++++ b/drivers/net/ethernet/amd/sunlance.c
+@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op,
+
+ prop = of_get_property(nd, "tpe-link-test?", NULL);
+ if (!prop)
+- goto no_link_test;
++ goto node_put;
+
+ if (strcmp(prop, "true")) {
+ printk(KERN_NOTICE "SunLance: warning: overriding option "
+@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op,
+ "to ecd@skynet.be\n");
+ auxio_set_lte(AUXIO_LTE_ON);
+ }
++node_put:
++ of_node_put(nd);
+ no_link_test:
+ lp->auto_select = 1;
+ lp->tpe = 0;
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+index be1506169076..0de487a8f0eb 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -2191,6 +2191,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
+ #define PMF_DMAE_C(bp) (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
+ E1HVN_MAX)
+
++/* Following is the DMAE channel number allocation for the clients.
++ * MFW: OCBB/OCSD implementations use DMAE channels 14/15 respectively.
++ * Driver: 0-3 and 8-11 (for PF dmae operations)
++ * 4 and 12 (for stats requests)
++ */
++#define BNX2X_FW_DMAE_C 13 /* Channel for FW DMAE operations */
++
+ /* PCIE link and speed */
+ #define PCICFG_LINK_WIDTH 0x1f00000
+ #define PCICFG_LINK_WIDTH_SHIFT 20
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+index 3f4d2c8da21a..a9eaaf3e73a4 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+@@ -6149,6 +6149,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp,
+ rdata->sd_vlan_tag = cpu_to_le16(start_params->sd_vlan_tag);
+ rdata->path_id = BP_PATH(bp);
+ rdata->network_cos_mode = start_params->network_cos_mode;
++ rdata->dmae_cmd_id = BNX2X_FW_DMAE_C;
+
+ rdata->vxlan_dst_port = cpu_to_le16(start_params->vxlan_dst_port);
+ rdata->geneve_dst_port = cpu_to_le16(start_params->geneve_dst_port);
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index e52d7af3ab3e..da9b87689996 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -2862,8 +2862,8 @@ bnxt_fill_coredump_record(struct bnxt *bp, struct bnxt_coredump_record *record,
+ record->asic_state = 0;
+ strlcpy(record->system_name, utsname()->nodename,
+ sizeof(record->system_name));
+- record->year = cpu_to_le16(tm.tm_year);
+- record->month = cpu_to_le16(tm.tm_mon);
++ record->year = cpu_to_le16(tm.tm_year + 1900);
++ record->month = cpu_to_le16(tm.tm_mon + 1);
+ record->day = cpu_to_le16(tm.tm_mday);
+ record->hour = cpu_to_le16(tm.tm_hour);
+ record->minute = cpu_to_le16(tm.tm_min);
+diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
+index a1197d3adbe0..9015bd911bee 100644
+--- a/drivers/net/ethernet/faraday/ftmac100.c
++++ b/drivers/net/ethernet/faraday/ftmac100.c
+@@ -872,11 +872,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id)
+ struct net_device *netdev = dev_id;
+ struct ftmac100 *priv = netdev_priv(netdev);
+
+- if (likely(netif_running(netdev))) {
+- /* Disable interrupts for polling */
+- ftmac100_disable_all_int(priv);
++ /* Disable interrupts for polling */
++ ftmac100_disable_all_int(priv);
++ if (likely(netif_running(netdev)))
+ napi_schedule(&priv->napi);
+- }
+
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 7661064c815b..5ab21a1b5444 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -485,8 +485,8 @@ static void release_rx_pools(struct ibmvnic_adapter *adapter)
+
+ for (j = 0; j < rx_pool->size; j++) {
+ if (rx_pool->rx_buff[j].skb) {
+- dev_kfree_skb_any(rx_pool->rx_buff[i].skb);
+- rx_pool->rx_buff[i].skb = NULL;
++ dev_kfree_skb_any(rx_pool->rx_buff[j].skb);
++ rx_pool->rx_buff[j].skb = NULL;
+ }
+ }
+
+@@ -1103,20 +1103,15 @@ static int ibmvnic_open(struct net_device *netdev)
+ return 0;
+ }
+
+- mutex_lock(&adapter->reset_lock);
+-
+ if (adapter->state != VNIC_CLOSED) {
+ rc = ibmvnic_login(netdev);
+- if (rc) {
+- mutex_unlock(&adapter->reset_lock);
++ if (rc)
+ return rc;
+- }
+
+ rc = init_resources(adapter);
+ if (rc) {
+ netdev_err(netdev, "failed to initialize resources\n");
+ release_resources(adapter);
+- mutex_unlock(&adapter->reset_lock);
+ return rc;
+ }
+ }
+@@ -1124,8 +1119,6 @@ static int ibmvnic_open(struct net_device *netdev)
+ rc = __ibmvnic_open(netdev);
+ netif_carrier_on(netdev);
+
+- mutex_unlock(&adapter->reset_lock);
+-
+ return rc;
+ }
+
+@@ -1269,10 +1262,8 @@ static int ibmvnic_close(struct net_device *netdev)
+ return 0;
+ }
+
+- mutex_lock(&adapter->reset_lock);
+ rc = __ibmvnic_close(netdev);
+ ibmvnic_cleanup(netdev);
+- mutex_unlock(&adapter->reset_lock);
+
+ return rc;
+ }
+@@ -1746,6 +1737,7 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ struct ibmvnic_rwi *rwi, u32 reset_state)
+ {
+ u64 old_num_rx_queues, old_num_tx_queues;
++ u64 old_num_rx_slots, old_num_tx_slots;
+ struct net_device *netdev = adapter->netdev;
+ int i, rc;
+
+@@ -1757,6 +1749,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+
+ old_num_rx_queues = adapter->req_rx_queues;
+ old_num_tx_queues = adapter->req_tx_queues;
++ old_num_rx_slots = adapter->req_rx_add_entries_per_subcrq;
++ old_num_tx_slots = adapter->req_tx_entries_per_subcrq;
+
+ ibmvnic_cleanup(netdev);
+
+@@ -1819,21 +1813,20 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ if (rc)
+ return rc;
+ } else if (adapter->req_rx_queues != old_num_rx_queues ||
+- adapter->req_tx_queues != old_num_tx_queues) {
+- adapter->map_id = 1;
++ adapter->req_tx_queues != old_num_tx_queues ||
++ adapter->req_rx_add_entries_per_subcrq !=
++ old_num_rx_slots ||
++ adapter->req_tx_entries_per_subcrq !=
++ old_num_tx_slots) {
+ release_rx_pools(adapter);
+ release_tx_pools(adapter);
+- rc = init_rx_pools(netdev);
+- if (rc)
+- return rc;
+- rc = init_tx_pools(netdev);
+- if (rc)
+- return rc;
+-
+ release_napi(adapter);
+- rc = init_napi(adapter);
++ release_vpd_data(adapter);
++
++ rc = init_resources(adapter);
+ if (rc)
+ return rc;
++
+ } else {
+ rc = reset_tx_pools(adapter);
+ if (rc)
+@@ -1917,17 +1910,8 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
+ adapter->state = VNIC_PROBED;
+ return 0;
+ }
+- /* netif_set_real_num_xx_queues needs to take rtnl lock here
+- * unless wait_for_reset is set, in which case the rtnl lock
+- * has already been taken before initializing the reset
+- */
+- if (!adapter->wait_for_reset) {
+- rtnl_lock();
+- rc = init_resources(adapter);
+- rtnl_unlock();
+- } else {
+- rc = init_resources(adapter);
+- }
++
++ rc = init_resources(adapter);
+ if (rc)
+ return rc;
+
+@@ -1986,13 +1970,21 @@ static void __ibmvnic_reset(struct work_struct *work)
+ struct ibmvnic_rwi *rwi;
+ struct ibmvnic_adapter *adapter;
+ struct net_device *netdev;
++ bool we_lock_rtnl = false;
+ u32 reset_state;
+ int rc = 0;
+
+ adapter = container_of(work, struct ibmvnic_adapter, ibmvnic_reset);
+ netdev = adapter->netdev;
+
+- mutex_lock(&adapter->reset_lock);
++ /* netif_set_real_num_xx_queues needs to take rtnl lock here
++ * unless wait_for_reset is set, in which case the rtnl lock
++ * has already been taken before initializing the reset
++ */
++ if (!adapter->wait_for_reset) {
++ rtnl_lock();
++ we_lock_rtnl = true;
++ }
+ reset_state = adapter->state;
+
+ rwi = get_next_rwi(adapter);
+@@ -2020,12 +2012,11 @@ static void __ibmvnic_reset(struct work_struct *work)
+ if (rc) {
+ netdev_dbg(adapter->netdev, "Reset failed\n");
+ free_all_rwi(adapter);
+- mutex_unlock(&adapter->reset_lock);
+- return;
+ }
+
+ adapter->resetting = false;
+- mutex_unlock(&adapter->reset_lock);
++ if (we_lock_rtnl)
++ rtnl_unlock();
+ }
+
+ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+@@ -4709,7 +4700,6 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
+
+ INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
+ INIT_LIST_HEAD(&adapter->rwi_list);
+- mutex_init(&adapter->reset_lock);
+ mutex_init(&adapter->rwi_lock);
+ adapter->resetting = false;
+
+@@ -4781,8 +4771,8 @@ static int ibmvnic_remove(struct vio_dev *dev)
+ struct ibmvnic_adapter *adapter = netdev_priv(netdev);
+
+ adapter->state = VNIC_REMOVING;
+- unregister_netdev(netdev);
+- mutex_lock(&adapter->reset_lock);
++ rtnl_lock();
++ unregister_netdevice(netdev);
+
+ release_resources(adapter);
+ release_sub_crqs(adapter, 1);
+@@ -4793,7 +4783,7 @@ static int ibmvnic_remove(struct vio_dev *dev)
+
+ adapter->state = VNIC_REMOVED;
+
+- mutex_unlock(&adapter->reset_lock);
++ rtnl_unlock();
+ device_remove_file(&dev->dev, &dev_attr_failover);
+ free_netdev(netdev);
+ dev_set_drvdata(&dev->dev, NULL);
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index f06eec145ca6..735f481b1870 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -1068,7 +1068,7 @@ struct ibmvnic_adapter {
+ struct tasklet_struct tasklet;
+ enum vnic_state state;
+ enum ibmvnic_reset_reason reset_reason;
+- struct mutex reset_lock, rwi_lock;
++ struct mutex rwi_lock;
+ struct list_head rwi_list;
+ struct work_struct ibmvnic_reset;
+ bool resetting;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
+index 4bdf25059542..21788d4f9881 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
++++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
+@@ -337,7 +337,7 @@ void mlx4_zone_allocator_destroy(struct mlx4_zone_allocator *zone_alloc)
+ static u32 __mlx4_alloc_from_zone(struct mlx4_zone_entry *zone, int count,
+ int align, u32 skip_mask, u32 *puid)
+ {
+- u32 uid;
++ u32 uid = 0;
+ u32 res;
+ struct mlx4_zone_allocator *zone_alloc = zone->allocator;
+ struct mlx4_zone_entry *curr_node;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+index ebcd2778eeb3..23f1b5b512c2 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+@@ -540,8 +540,8 @@ struct slave_list {
+ struct resource_allocator {
+ spinlock_t alloc_lock; /* protect quotas */
+ union {
+- int res_reserved;
+- int res_port_rsvd[MLX4_MAX_PORTS];
++ unsigned int res_reserved;
++ unsigned int res_port_rsvd[MLX4_MAX_PORTS];
+ };
+ union {
+ int res_free;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
+index 2e84f10f59ba..1a11bc0e1612 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
+@@ -363,6 +363,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr,
+ container_of((void *)mpt_entry, struct mlx4_cmd_mailbox,
+ buf);
+
++ (*mpt_entry)->lkey = 0;
+ err = mlx4_SW2HW_MPT(dev, mailbox, key);
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+index f5459de6d60a..5900a506bf8d 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+@@ -191,7 +191,7 @@ qed_dcbx_dp_protocol(struct qed_hwfn *p_hwfn, struct qed_dcbx_results *p_data)
+ static void
+ qed_dcbx_set_params(struct qed_dcbx_results *p_data,
+ struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+- bool enable, u8 prio, u8 tc,
++ bool app_tlv, bool enable, u8 prio, u8 tc,
+ enum dcbx_protocol_type type,
+ enum qed_pci_personality personality)
+ {
+@@ -210,7 +210,7 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data,
+ p_data->arr[type].dont_add_vlan0 = true;
+
+ /* QM reconf data */
+- if (p_hwfn->hw_info.personality == personality)
++ if (app_tlv && p_hwfn->hw_info.personality == personality)
+ qed_hw_info_set_offload_tc(&p_hwfn->hw_info, tc);
+
+ /* Configure dcbx vlan priority in doorbell block for roce EDPM */
+@@ -225,7 +225,7 @@ qed_dcbx_set_params(struct qed_dcbx_results *p_data,
+ static void
+ qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
+ struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+- bool enable, u8 prio, u8 tc,
++ bool app_tlv, bool enable, u8 prio, u8 tc,
+ enum dcbx_protocol_type type)
+ {
+ enum qed_pci_personality personality;
+@@ -240,7 +240,7 @@ qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
+
+ personality = qed_dcbx_app_update[i].personality;
+
+- qed_dcbx_set_params(p_data, p_hwfn, p_ptt, enable,
++ qed_dcbx_set_params(p_data, p_hwfn, p_ptt, app_tlv, enable,
+ prio, tc, type, personality);
+ }
+ }
+@@ -318,8 +318,8 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+ enable = true;
+ }
+
+- qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
+- priority, tc, type);
++ qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, true,
++ enable, priority, tc, type);
+ }
+ }
+
+@@ -340,7 +340,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+ continue;
+
+ enable = (type == DCBX_PROTOCOL_ETH) ? false : !!dcbx_version;
+- qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, enable,
++ qed_dcbx_update_app_info(p_data, p_hwfn, p_ptt, false, enable,
+ priority, tc, type);
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+index 97f073fd3725..2f69ee9221c6 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -179,6 +179,10 @@ void qed_resc_free(struct qed_dev *cdev)
+ qed_iscsi_free(p_hwfn);
+ qed_ooo_free(p_hwfn);
+ }
++
++ if (QED_IS_RDMA_PERSONALITY(p_hwfn))
++ qed_rdma_info_free(p_hwfn);
++
+ qed_iov_free(p_hwfn);
+ qed_l2_free(p_hwfn);
+ qed_dmae_info_free(p_hwfn);
+@@ -474,8 +478,16 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
+ struct qed_qm_info *qm_info = &p_hwfn->qm_info;
+
+ /* Can't have multiple flags set here */
+- if (bitmap_weight((unsigned long *)&pq_flags, sizeof(pq_flags)) > 1)
++ if (bitmap_weight((unsigned long *)&pq_flags,
++ sizeof(pq_flags) * BITS_PER_BYTE) > 1) {
++ DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags);
++ goto err;
++ }
++
++ if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) {
++ DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags);
+ goto err;
++ }
+
+ switch (pq_flags) {
+ case PQ_FLAGS_RLS:
+@@ -499,8 +511,7 @@ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
+ }
+
+ err:
+- DP_ERR(p_hwfn, "BAD pq flags %d\n", pq_flags);
+- return NULL;
++ return &qm_info->start_pq;
+ }
+
+ /* save pq index in qm info */
+@@ -524,20 +535,32 @@ u16 qed_get_cm_pq_idx_mcos(struct qed_hwfn *p_hwfn, u8 tc)
+ {
+ u8 max_tc = qed_init_qm_get_num_tcs(p_hwfn);
+
++ if (max_tc == 0) {
++ DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n",
++ PQ_FLAGS_MCOS);
++ return p_hwfn->qm_info.start_pq;
++ }
++
+ if (tc > max_tc)
+ DP_ERR(p_hwfn, "tc %d must be smaller than %d\n", tc, max_tc);
+
+- return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + tc;
++ return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_MCOS) + (tc % max_tc);
+ }
+
+ u16 qed_get_cm_pq_idx_vf(struct qed_hwfn *p_hwfn, u16 vf)
+ {
+ u16 max_vf = qed_init_qm_get_num_vfs(p_hwfn);
+
++ if (max_vf == 0) {
++ DP_ERR(p_hwfn, "pq with flag 0x%lx do not exist\n",
++ PQ_FLAGS_VFS);
++ return p_hwfn->qm_info.start_pq;
++ }
++
+ if (vf > max_vf)
+ DP_ERR(p_hwfn, "vf %d must be smaller than %d\n", vf, max_vf);
+
+- return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + vf;
++ return qed_get_cm_pq_idx(p_hwfn, PQ_FLAGS_VFS) + (vf % max_vf);
+ }
+
+ u16 qed_get_cm_pq_idx_ofld_mtc(struct qed_hwfn *p_hwfn, u8 tc)
+@@ -1074,6 +1097,12 @@ int qed_resc_alloc(struct qed_dev *cdev)
+ goto alloc_err;
+ }
+
++ if (QED_IS_RDMA_PERSONALITY(p_hwfn)) {
++ rc = qed_rdma_info_alloc(p_hwfn);
++ if (rc)
++ goto alloc_err;
++ }
++
+ /* DMA info initialization */
+ rc = qed_dmae_info_alloc(p_hwfn);
+ if (rc)
+@@ -2091,11 +2120,8 @@ int qed_hw_start_fastpath(struct qed_hwfn *p_hwfn)
+ if (!p_ptt)
+ return -EAGAIN;
+
+- /* If roce info is allocated it means roce is initialized and should
+- * be enabled in searcher.
+- */
+ if (p_hwfn->p_rdma_info &&
+- p_hwfn->b_rdma_enabled_in_prs)
++ p_hwfn->p_rdma_info->active && p_hwfn->b_rdma_enabled_in_prs)
+ qed_wr(p_hwfn, p_ptt, p_hwfn->rdma_prs_search_reg, 0x1);
+
+ /* Re-open incoming traffic */
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
+index 0f0aba793352..b22f464ea3fa 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
+@@ -992,6 +992,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn)
+ */
+ do {
+ index = p_sb_attn->sb_index;
++ /* finish reading index before the loop condition */
++ dma_rmb();
+ attn_bits = le32_to_cpu(p_sb_attn->atten_bits);
+ attn_acks = le32_to_cpu(p_sb_attn->atten_ack);
+ } while (index != p_sb_attn->sb_index);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
+index 2094d86a7a08..cf3b0e3dc350 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -1634,9 +1634,9 @@ static int qed_drain(struct qed_dev *cdev)
+ return -EBUSY;
+ }
+ rc = qed_mcp_drain(hwfn, ptt);
++ qed_ptt_release(hwfn, ptt);
+ if (rc)
+ return rc;
+- qed_ptt_release(hwfn, ptt);
+ }
+
+ return 0;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index 62113438c880..7873d6dfd91f 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -140,22 +140,34 @@ static u32 qed_rdma_get_sb_id(void *p_hwfn, u32 rel_sb_id)
+ return FEAT_NUM((struct qed_hwfn *)p_hwfn, QED_PF_L2_QUE) + rel_sb_id;
+ }
+
+-static int qed_rdma_alloc(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt,
+- struct qed_rdma_start_in_params *params)
++int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn)
+ {
+ struct qed_rdma_info *p_rdma_info;
+- u32 num_cons, num_tasks;
+- int rc = -ENOMEM;
+
+- DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocating RDMA\n");
+-
+- /* Allocate a struct with current pf rdma info */
+ p_rdma_info = kzalloc(sizeof(*p_rdma_info), GFP_KERNEL);
+ if (!p_rdma_info)
+- return rc;
++ return -ENOMEM;
++
++ spin_lock_init(&p_rdma_info->lock);
+
+ p_hwfn->p_rdma_info = p_rdma_info;
++ return 0;
++}
++
++void qed_rdma_info_free(struct qed_hwfn *p_hwfn)
++{
++ kfree(p_hwfn->p_rdma_info);
++ p_hwfn->p_rdma_info = NULL;
++}
++
++static int qed_rdma_alloc(struct qed_hwfn *p_hwfn)
++{
++ struct qed_rdma_info *p_rdma_info = p_hwfn->p_rdma_info;
++ u32 num_cons, num_tasks;
++ int rc = -ENOMEM;
++
++ DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Allocating RDMA\n");
++
+ if (QED_IS_IWARP_PERSONALITY(p_hwfn))
+ p_rdma_info->proto = PROTOCOLID_IWARP;
+ else
+@@ -183,7 +195,7 @@ static int qed_rdma_alloc(struct qed_hwfn *p_hwfn,
+ /* Allocate a struct with device params and fill it */
+ p_rdma_info->dev = kzalloc(sizeof(*p_rdma_info->dev), GFP_KERNEL);
+ if (!p_rdma_info->dev)
+- goto free_rdma_info;
++ return rc;
+
+ /* Allocate a struct with port params and fill it */
+ p_rdma_info->port = kzalloc(sizeof(*p_rdma_info->port), GFP_KERNEL);
+@@ -298,8 +310,6 @@ free_rdma_port:
+ kfree(p_rdma_info->port);
+ free_rdma_dev:
+ kfree(p_rdma_info->dev);
+-free_rdma_info:
+- kfree(p_rdma_info);
+
+ return rc;
+ }
+@@ -370,8 +380,6 @@ static void qed_rdma_resc_free(struct qed_hwfn *p_hwfn)
+
+ kfree(p_rdma_info->port);
+ kfree(p_rdma_info->dev);
+-
+- kfree(p_rdma_info);
+ }
+
+ static void qed_rdma_free_tid(void *rdma_cxt, u32 itid)
+@@ -679,8 +687,6 @@ static int qed_rdma_setup(struct qed_hwfn *p_hwfn,
+
+ DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "RDMA setup\n");
+
+- spin_lock_init(&p_hwfn->p_rdma_info->lock);
+-
+ qed_rdma_init_devinfo(p_hwfn, params);
+ qed_rdma_init_port(p_hwfn);
+ qed_rdma_init_events(p_hwfn, params);
+@@ -727,7 +733,7 @@ static int qed_rdma_stop(void *rdma_cxt)
+ /* Disable RoCE search */
+ qed_wr(p_hwfn, p_ptt, p_hwfn->rdma_prs_search_reg, 0);
+ p_hwfn->b_rdma_enabled_in_prs = false;
+-
++ p_hwfn->p_rdma_info->active = 0;
+ qed_wr(p_hwfn, p_ptt, PRS_REG_ROCE_DEST_QP_MAX_PF, 0);
+
+ ll2_ethertype_en = qed_rd(p_hwfn, p_ptt, PRS_REG_LIGHT_L2_ETHERTYPE_EN);
+@@ -1236,7 +1242,8 @@ qed_rdma_create_qp(void *rdma_cxt,
+ u8 max_stats_queues;
+ int rc;
+
+- if (!rdma_cxt || !in_params || !out_params || !p_hwfn->p_rdma_info) {
++ if (!rdma_cxt || !in_params || !out_params ||
++ !p_hwfn->p_rdma_info->active) {
+ DP_ERR(p_hwfn->cdev,
+ "qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n",
+ rdma_cxt, in_params, out_params);
+@@ -1802,8 +1809,8 @@ bool qed_rdma_allocated_qps(struct qed_hwfn *p_hwfn)
+ {
+ bool result;
+
+- /* if rdma info has not been allocated, naturally there are no qps */
+- if (!p_hwfn->p_rdma_info)
++ /* if rdma wasn't activated yet, naturally there are no qps */
++ if (!p_hwfn->p_rdma_info->active)
+ return false;
+
+ spin_lock_bh(&p_hwfn->p_rdma_info->lock);
+@@ -1849,7 +1856,7 @@ static int qed_rdma_start(void *rdma_cxt,
+ if (!p_ptt)
+ goto err;
+
+- rc = qed_rdma_alloc(p_hwfn, p_ptt, params);
++ rc = qed_rdma_alloc(p_hwfn);
+ if (rc)
+ goto err1;
+
+@@ -1858,6 +1865,7 @@ static int qed_rdma_start(void *rdma_cxt,
+ goto err2;
+
+ qed_ptt_release(p_hwfn, p_ptt);
++ p_hwfn->p_rdma_info->active = 1;
+
+ return rc;
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.h b/drivers/net/ethernet/qlogic/qed/qed_rdma.h
+index 6f722ee8ee94..3689fe3e5935 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.h
+@@ -102,6 +102,7 @@ struct qed_rdma_info {
+ u16 max_queue_zones;
+ enum protocol_type proto;
+ struct qed_iwarp_info iwarp;
++ u8 active:1;
+ };
+
+ struct qed_rdma_qp {
+@@ -176,10 +177,14 @@ struct qed_rdma_qp {
+ #if IS_ENABLED(CONFIG_QED_RDMA)
+ void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
+ void qed_rdma_dpm_conf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
++int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn);
++void qed_rdma_info_free(struct qed_hwfn *p_hwfn);
+ #else
+ static inline void qed_rdma_dpm_conf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) {}
+ static inline void qed_rdma_dpm_bar(struct qed_hwfn *p_hwfn,
+ struct qed_ptt *p_ptt) {}
++static inline int qed_rdma_info_alloc(struct qed_hwfn *p_hwfn) {return -EINVAL;}
++static inline void qed_rdma_info_free(struct qed_hwfn *p_hwfn) {}
+ #endif
+
+ int
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index d887016e54b6..4b6572f0188a 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -985,8 +985,6 @@ static void team_port_disable(struct team *team,
+ team->en_port_count--;
+ team_queue_override_port_del(team, port);
+ team_adjust_ops(team);
+- team_notify_peers(team);
+- team_mcast_rejoin(team);
+ team_lower_state_changed(port);
+ }
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+index e7584b842dce..eb5db94f5745 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
+ }
+ break;
+ case BRCMU_CHSPEC_D11AC_BW_160:
++ ch->bw = BRCMU_CHAN_BW_160;
++ ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
++ BRCMU_CHSPEC_D11AC_SB_SHIFT);
+ switch (ch->sb) {
+ case BRCMU_CHAN_SB_LLL:
+ ch->control_ch_num -= CH_70MHZ_APART;
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 07442ada6dd0..62ab42e94c9d 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -2889,6 +2889,10 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
+
+ wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
+
++ tasklet_hrtimer_init(&data->beacon_timer,
++ mac80211_hwsim_beacon,
++ CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
++
+ err = ieee80211_register_hw(hw);
+ if (err < 0) {
+ pr_debug("mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
+@@ -2913,10 +2917,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
+ data->debugfs,
+ data, &hwsim_simulate_radar);
+
+- tasklet_hrtimer_init(&data->beacon_timer,
+- mac80211_hwsim_beacon,
+- CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+-
+ spin_lock_bh(&hwsim_radio_lock);
+ err = rhashtable_insert_fast(&hwsim_radios_rht, &data->rht,
+ hwsim_rht_params);
+diff --git a/drivers/net/wireless/mediatek/mt76/Kconfig b/drivers/net/wireless/mediatek/mt76/Kconfig
+index b6c5f17dca30..27826217ff76 100644
+--- a/drivers/net/wireless/mediatek/mt76/Kconfig
++++ b/drivers/net/wireless/mediatek/mt76/Kconfig
+@@ -1,6 +1,12 @@
+ config MT76_CORE
+ tristate
+
++config MT76_LEDS
++ bool
++ depends on MT76_CORE
++ depends on LEDS_CLASS=y || MT76_CORE=LEDS_CLASS
++ default y
++
+ config MT76_USB
+ tristate
+ depends on MT76_CORE
+diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
+index 029d54bce9e8..ade4a2029a24 100644
+--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
++++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
+@@ -342,9 +342,11 @@ int mt76_register_device(struct mt76_dev *dev, bool vht,
+ mt76_check_sband(dev, NL80211_BAND_2GHZ);
+ mt76_check_sband(dev, NL80211_BAND_5GHZ);
+
+- ret = mt76_led_init(dev);
+- if (ret)
+- return ret;
++ if (IS_ENABLED(CONFIG_MT76_LEDS)) {
++ ret = mt76_led_init(dev);
++ if (ret)
++ return ret;
++ }
+
+ return ieee80211_register_hw(hw);
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_init.c b/drivers/net/wireless/mediatek/mt76/mt76x2_init.c
+index b814391f79ac..03b103c45d69 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_init.c
+@@ -581,8 +581,10 @@ int mt76x2_register_device(struct mt76x2_dev *dev)
+ mt76x2_dfs_init_detector(dev);
+
+ /* init led callbacks */
+- dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness;
+- dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink;
++ if (IS_ENABLED(CONFIG_MT76_LEDS)) {
++ dev->mt76.led_cdev.brightness_set = mt76x2_led_set_brightness;
++ dev->mt76.led_cdev.blink_set = mt76x2_led_set_blink;
++ }
+
+ ret = mt76_register_device(&dev->mt76, true, mt76x2_rates,
+ ARRAY_SIZE(mt76x2_rates));
+diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h
+index ac68072fb8cd..5ff254dc9b14 100644
+--- a/drivers/nvdimm/nd-core.h
++++ b/drivers/nvdimm/nd-core.h
+@@ -112,6 +112,8 @@ resource_size_t nd_pmem_available_dpa(struct nd_region *nd_region,
+ struct nd_mapping *nd_mapping, resource_size_t *overlap);
+ resource_size_t nd_blk_available_dpa(struct nd_region *nd_region);
+ resource_size_t nd_region_available_dpa(struct nd_region *nd_region);
++int nd_region_conflict(struct nd_region *nd_region, resource_size_t start,
++ resource_size_t size);
+ resource_size_t nvdimm_allocated_dpa(struct nvdimm_drvdata *ndd,
+ struct nd_label_id *label_id);
+ int alias_dpa_busy(struct device *dev, void *data);
+diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
+index 3f7ad5bc443e..7fe84bfe0878 100644
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -590,14 +590,47 @@ static u64 phys_pmem_align_down(struct nd_pfn *nd_pfn, u64 phys)
+ ALIGN_DOWN(phys, nd_pfn->align));
+ }
+
++/*
++ * Check if pmem collides with 'System RAM', or other regions when
++ * section aligned. Trim it accordingly.
++ */
++static void trim_pfn_device(struct nd_pfn *nd_pfn, u32 *start_pad, u32 *end_trunc)
++{
++ struct nd_namespace_common *ndns = nd_pfn->ndns;
++ struct nd_namespace_io *nsio = to_nd_namespace_io(&ndns->dev);
++ struct nd_region *nd_region = to_nd_region(nd_pfn->dev.parent);
++ const resource_size_t start = nsio->res.start;
++ const resource_size_t end = start + resource_size(&nsio->res);
++ resource_size_t adjust, size;
++
++ *start_pad = 0;
++ *end_trunc = 0;
++
++ adjust = start - PHYS_SECTION_ALIGN_DOWN(start);
++ size = resource_size(&nsio->res) + adjust;
++ if (region_intersects(start - adjust, size, IORESOURCE_SYSTEM_RAM,
++ IORES_DESC_NONE) == REGION_MIXED
++ || nd_region_conflict(nd_region, start - adjust, size))
++ *start_pad = PHYS_SECTION_ALIGN_UP(start) - start;
++
++ /* Now check that end of the range does not collide. */
++ adjust = PHYS_SECTION_ALIGN_UP(end) - end;
++ size = resource_size(&nsio->res) + adjust;
++ if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM,
++ IORES_DESC_NONE) == REGION_MIXED
++ || !IS_ALIGNED(end, nd_pfn->align)
++ || nd_region_conflict(nd_region, start, size + adjust))
++ *end_trunc = end - phys_pmem_align_down(nd_pfn, end);
++}
++
+ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+ {
+ u32 dax_label_reserve = is_nd_dax(&nd_pfn->dev) ? SZ_128K : 0;
+ struct nd_namespace_common *ndns = nd_pfn->ndns;
+- u32 start_pad = 0, end_trunc = 0;
++ struct nd_namespace_io *nsio = to_nd_namespace_io(&ndns->dev);
+ resource_size_t start, size;
+- struct nd_namespace_io *nsio;
+ struct nd_region *nd_region;
++ u32 start_pad, end_trunc;
+ struct nd_pfn_sb *pfn_sb;
+ unsigned long npfns;
+ phys_addr_t offset;
+@@ -629,30 +662,7 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+
+ memset(pfn_sb, 0, sizeof(*pfn_sb));
+
+- /*
+- * Check if pmem collides with 'System RAM' when section aligned and
+- * trim it accordingly
+- */
+- nsio = to_nd_namespace_io(&ndns->dev);
+- start = PHYS_SECTION_ALIGN_DOWN(nsio->res.start);
+- size = resource_size(&nsio->res);
+- if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM,
+- IORES_DESC_NONE) == REGION_MIXED) {
+- start = nsio->res.start;
+- start_pad = PHYS_SECTION_ALIGN_UP(start) - start;
+- }
+-
+- start = nsio->res.start;
+- size = PHYS_SECTION_ALIGN_UP(start + size) - start;
+- if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM,
+- IORES_DESC_NONE) == REGION_MIXED
+- || !IS_ALIGNED(start + resource_size(&nsio->res),
+- nd_pfn->align)) {
+- size = resource_size(&nsio->res);
+- end_trunc = start + size - phys_pmem_align_down(nd_pfn,
+- start + size);
+- }
+-
++ trim_pfn_device(nd_pfn, &start_pad, &end_trunc);
+ if (start_pad + end_trunc)
+ dev_info(&nd_pfn->dev, "%s alignment collision, truncate %d bytes\n",
+ dev_name(&ndns->dev), start_pad + end_trunc);
+@@ -663,7 +673,7 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+ * implementation will limit the pfns advertised through
+ * ->direct_access() to those that are included in the memmap.
+ */
+- start += start_pad;
++ start = nsio->res.start + start_pad;
+ size = resource_size(&nsio->res);
+ npfns = PFN_SECTION_ALIGN_UP((size - start_pad - end_trunc - SZ_8K)
+ / PAGE_SIZE);
+diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
+index 174a418cb171..e7377f1028ef 100644
+--- a/drivers/nvdimm/region_devs.c
++++ b/drivers/nvdimm/region_devs.c
+@@ -1184,6 +1184,47 @@ int nvdimm_has_cache(struct nd_region *nd_region)
+ }
+ EXPORT_SYMBOL_GPL(nvdimm_has_cache);
+
++struct conflict_context {
++ struct nd_region *nd_region;
++ resource_size_t start, size;
++};
++
++static int region_conflict(struct device *dev, void *data)
++{
++ struct nd_region *nd_region;
++ struct conflict_context *ctx = data;
++ resource_size_t res_end, region_end, region_start;
++
++ if (!is_memory(dev))
++ return 0;
++
++ nd_region = to_nd_region(dev);
++ if (nd_region == ctx->nd_region)
++ return 0;
++
++ res_end = ctx->start + ctx->size;
++ region_start = nd_region->ndr_start;
++ region_end = region_start + nd_region->ndr_size;
++ if (ctx->start >= region_start && ctx->start < region_end)
++ return -EBUSY;
++ if (res_end > region_start && res_end <= region_end)
++ return -EBUSY;
++ return 0;
++}
++
++int nd_region_conflict(struct nd_region *nd_region, resource_size_t start,
++ resource_size_t size)
++{
++ struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(&nd_region->dev);
++ struct conflict_context ctx = {
++ .nd_region = nd_region,
++ .start = start,
++ .size = size,
++ };
++
++ return device_for_each_child(&nvdimm_bus->dev, &ctx, region_conflict);
++}
++
+ void __exit nd_region_devs_exit(void)
+ {
+ ida_destroy(®ion_ida);
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 611e70cae754..9375fa705d82 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -144,6 +144,7 @@ struct nvme_fc_ctrl {
+
+ bool ioq_live;
+ bool assoc_active;
++ atomic_t err_work_active;
+ u64 association_id;
+
+ struct list_head ctrl_list; /* rport->ctrl_list */
+@@ -152,6 +153,7 @@ struct nvme_fc_ctrl {
+ struct blk_mq_tag_set tag_set;
+
+ struct delayed_work connect_work;
++ struct work_struct err_work;
+
+ struct kref ref;
+ u32 flags;
+@@ -1523,6 +1525,10 @@ nvme_fc_abort_aen_ops(struct nvme_fc_ctrl *ctrl)
+ struct nvme_fc_fcp_op *aen_op = ctrl->aen_ops;
+ int i;
+
++ /* ensure we've initialized the ops once */
++ if (!(aen_op->flags & FCOP_FLAGS_AEN))
++ return;
++
+ for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++)
+ __nvme_fc_abort_op(ctrl, aen_op);
+ }
+@@ -2036,7 +2042,25 @@ nvme_fc_nvme_ctrl_freed(struct nvme_ctrl *nctrl)
+ static void
+ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
+ {
+- /* only proceed if in LIVE state - e.g. on first error */
++ int active;
++
++ /*
++ * if an error (io timeout, etc) while (re)connecting,
++ * it's an error on creating the new association.
++ * Start the error recovery thread if it hasn't already
++ * been started. It is expected there could be multiple
++ * ios hitting this path before things are cleaned up.
++ */
++ if (ctrl->ctrl.state == NVME_CTRL_CONNECTING) {
++ active = atomic_xchg(&ctrl->err_work_active, 1);
++ if (!active && !schedule_work(&ctrl->err_work)) {
++ atomic_set(&ctrl->err_work_active, 0);
++ WARN_ON(1);
++ }
++ return;
++ }
++
++ /* Otherwise, only proceed if in LIVE state - e.g. on first error */
+ if (ctrl->ctrl.state != NVME_CTRL_LIVE)
+ return;
+
+@@ -2802,6 +2826,7 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl)
+ {
+ struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
+
++ cancel_work_sync(&ctrl->err_work);
+ cancel_delayed_work_sync(&ctrl->connect_work);
+ /*
+ * kill the association on the link side. this will block
+@@ -2854,23 +2879,30 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
+ }
+
+ static void
+-nvme_fc_reset_ctrl_work(struct work_struct *work)
++__nvme_fc_terminate_io(struct nvme_fc_ctrl *ctrl)
+ {
+- struct nvme_fc_ctrl *ctrl =
+- container_of(work, struct nvme_fc_ctrl, ctrl.reset_work);
+- int ret;
+-
+- nvme_stop_ctrl(&ctrl->ctrl);
++ nvme_stop_keep_alive(&ctrl->ctrl);
+
+ /* will block will waiting for io to terminate */
+ nvme_fc_delete_association(ctrl);
+
+- if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
++ if (ctrl->ctrl.state != NVME_CTRL_CONNECTING &&
++ !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
+ dev_err(ctrl->ctrl.device,
+ "NVME-FC{%d}: error_recovery: Couldn't change state "
+ "to CONNECTING\n", ctrl->cnum);
+- return;
+- }
++}
++
++static void
++nvme_fc_reset_ctrl_work(struct work_struct *work)
++{
++ struct nvme_fc_ctrl *ctrl =
++ container_of(work, struct nvme_fc_ctrl, ctrl.reset_work);
++ int ret;
++
++ __nvme_fc_terminate_io(ctrl);
++
++ nvme_stop_ctrl(&ctrl->ctrl);
+
+ if (ctrl->rport->remoteport.port_state == FC_OBJSTATE_ONLINE)
+ ret = nvme_fc_create_association(ctrl);
+@@ -2885,6 +2917,24 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
+ ctrl->cnum);
+ }
+
++static void
++nvme_fc_connect_err_work(struct work_struct *work)
++{
++ struct nvme_fc_ctrl *ctrl =
++ container_of(work, struct nvme_fc_ctrl, err_work);
++
++ __nvme_fc_terminate_io(ctrl);
++
++ atomic_set(&ctrl->err_work_active, 0);
++
++ /*
++ * Rescheduling the connection after recovering
++ * from the io error is left to the reconnect work
++ * item, which is what should have stalled waiting on
++ * the io that had the error that scheduled this work.
++ */
++}
++
+ static const struct nvme_ctrl_ops nvme_fc_ctrl_ops = {
+ .name = "fc",
+ .module = THIS_MODULE,
+@@ -2995,6 +3045,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
+ ctrl->cnum = idx;
+ ctrl->ioq_live = false;
+ ctrl->assoc_active = false;
++ atomic_set(&ctrl->err_work_active, 0);
+ init_waitqueue_head(&ctrl->ioabort_wait);
+
+ get_device(ctrl->dev);
+@@ -3002,6 +3053,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
+
+ INIT_WORK(&ctrl->ctrl.reset_work, nvme_fc_reset_ctrl_work);
+ INIT_DELAYED_WORK(&ctrl->connect_work, nvme_fc_connect_ctrl_work);
++ INIT_WORK(&ctrl->err_work, nvme_fc_connect_err_work);
+ spin_lock_init(&ctrl->lock);
+
+ /* io queue count */
+@@ -3092,6 +3144,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
+ fail_ctrl:
+ nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING);
+ cancel_work_sync(&ctrl->ctrl.reset_work);
++ cancel_work_sync(&ctrl->err_work);
+ cancel_delayed_work_sync(&ctrl->connect_work);
+
+ ctrl->ctrl.opts = NULL;
+diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
+index c0631895154e..8684bcec8ff4 100644
+--- a/drivers/s390/net/ism_drv.c
++++ b/drivers/s390/net/ism_drv.c
+@@ -415,9 +415,9 @@ static irqreturn_t ism_handle_irq(int irq, void *data)
+ break;
+
+ clear_bit_inv(bit, bv);
++ ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET] = 0;
+ barrier();
+ smcd_handle_irq(ism->smcd, bit + ISM_DMB_BIT_OFFSET);
+- ism->sba->dmbe_mask[bit + ISM_DMB_BIT_OFFSET] = 0;
+ }
+
+ if (ism->sba->e) {
+diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
+index 8f5c1d7f751a..b67dc4974f23 100644
+--- a/drivers/s390/virtio/virtio_ccw.c
++++ b/drivers/s390/virtio/virtio_ccw.c
+@@ -56,6 +56,7 @@ struct virtio_ccw_device {
+ unsigned int revision; /* Transport revision */
+ wait_queue_head_t wait_q;
+ spinlock_t lock;
++ struct mutex io_lock; /* Serializes I/O requests */
+ struct list_head virtqueues;
+ unsigned long indicators;
+ unsigned long indicators2;
+@@ -296,6 +297,7 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev,
+ unsigned long flags;
+ int flag = intparm & VIRTIO_CCW_INTPARM_MASK;
+
++ mutex_lock(&vcdev->io_lock);
+ do {
+ spin_lock_irqsave(get_ccwdev_lock(vcdev->cdev), flags);
+ ret = ccw_device_start(vcdev->cdev, ccw, intparm, 0, 0);
+@@ -308,7 +310,9 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev,
+ cpu_relax();
+ } while (ret == -EBUSY);
+ wait_event(vcdev->wait_q, doing_io(vcdev, flag) == 0);
+- return ret ? ret : vcdev->err;
++ ret = ret ? ret : vcdev->err;
++ mutex_unlock(&vcdev->io_lock);
++ return ret;
+ }
+
+ static void virtio_ccw_drop_indicator(struct virtio_ccw_device *vcdev,
+@@ -828,6 +832,7 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
+ int ret;
+ struct ccw1 *ccw;
+ void *config_area;
++ unsigned long flags;
+
+ ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+ if (!ccw)
+@@ -846,11 +851,13 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
+ if (ret)
+ goto out_free;
+
++ spin_lock_irqsave(&vcdev->lock, flags);
+ memcpy(vcdev->config, config_area, offset + len);
+- if (buf)
+- memcpy(buf, &vcdev->config[offset], len);
+ if (vcdev->config_ready < offset + len)
+ vcdev->config_ready = offset + len;
++ spin_unlock_irqrestore(&vcdev->lock, flags);
++ if (buf)
++ memcpy(buf, config_area + offset, len);
+
+ out_free:
+ kfree(config_area);
+@@ -864,6 +871,7 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
+ struct virtio_ccw_device *vcdev = to_vc_device(vdev);
+ struct ccw1 *ccw;
+ void *config_area;
++ unsigned long flags;
+
+ ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+ if (!ccw)
+@@ -876,9 +884,11 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
+ /* Make sure we don't overwrite fields. */
+ if (vcdev->config_ready < offset)
+ virtio_ccw_get_config(vdev, 0, NULL, offset);
++ spin_lock_irqsave(&vcdev->lock, flags);
+ memcpy(&vcdev->config[offset], buf, len);
+ /* Write the config area to the host. */
+ memcpy(config_area, vcdev->config, sizeof(vcdev->config));
++ spin_unlock_irqrestore(&vcdev->lock, flags);
+ ccw->cmd_code = CCW_CMD_WRITE_CONF;
+ ccw->flags = 0;
+ ccw->count = offset + len;
+@@ -1247,6 +1257,7 @@ static int virtio_ccw_online(struct ccw_device *cdev)
+ init_waitqueue_head(&vcdev->wait_q);
+ INIT_LIST_HEAD(&vcdev->virtqueues);
+ spin_lock_init(&vcdev->lock);
++ mutex_init(&vcdev->io_lock);
+
+ spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+ dev_set_drvdata(&cdev->dev, vcdev);
+diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c
+index 46df707e6f2c..452e19f8fb47 100644
+--- a/drivers/scsi/ufs/ufs-hisi.c
++++ b/drivers/scsi/ufs/ufs-hisi.c
+@@ -20,6 +20,7 @@
+ #include "unipro.h"
+ #include "ufs-hisi.h"
+ #include "ufshci.h"
++#include "ufs_quirks.h"
+
+ static int ufs_hisi_check_hibern8(struct ufs_hba *hba)
+ {
+@@ -390,6 +391,14 @@ static void ufs_hisi_set_dev_cap(struct ufs_hisi_dev_params *hisi_param)
+
+ static void ufs_hisi_pwr_change_pre_change(struct ufs_hba *hba)
+ {
++ if (hba->dev_quirks & UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME) {
++ pr_info("ufs flash device must set VS_DebugSaveConfigTime 0x10\n");
++ /* VS_DebugSaveConfigTime */
++ ufshcd_dme_set(hba, UIC_ARG_MIB(0xD0A0), 0x10);
++ /* sync length */
++ ufshcd_dme_set(hba, UIC_ARG_MIB(0x1556), 0x48);
++ }
++
+ /* update */
+ ufshcd_dme_set(hba, UIC_ARG_MIB(0x15A8), 0x1);
+ /* PA_TxSkip */
+diff --git a/drivers/scsi/ufs/ufs_quirks.h b/drivers/scsi/ufs/ufs_quirks.h
+index 71f73d1d1ad1..5d2dfdb41a6f 100644
+--- a/drivers/scsi/ufs/ufs_quirks.h
++++ b/drivers/scsi/ufs/ufs_quirks.h
+@@ -131,4 +131,10 @@ struct ufs_dev_fix {
+ */
+ #define UFS_DEVICE_QUIRK_HOST_PA_SAVECONFIGTIME (1 << 8)
+
++/*
++ * Some UFS devices require VS_DebugSaveConfigTime is 0x10,
++ * enabling this quirk ensure this.
++ */
++#define UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME (1 << 9)
++
+ #endif /* UFS_QUIRKS_H_ */
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 54074dd483a7..0b81d9d03357 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -230,6 +230,8 @@ static struct ufs_dev_fix ufs_fixups[] = {
+ UFS_FIX(UFS_VENDOR_SKHYNIX, UFS_ANY_MODEL, UFS_DEVICE_NO_VCCQ),
+ UFS_FIX(UFS_VENDOR_SKHYNIX, UFS_ANY_MODEL,
+ UFS_DEVICE_QUIRK_HOST_PA_SAVECONFIGTIME),
++ UFS_FIX(UFS_VENDOR_SKHYNIX, "hB8aL1" /*H28U62301AMR*/,
++ UFS_DEVICE_QUIRK_HOST_VS_DEBUGSAVECONFIGTIME),
+
+ END_FIX
+ };
+diff --git a/drivers/staging/rtl8712/mlme_linux.c b/drivers/staging/rtl8712/mlme_linux.c
+index baaa52f04560..52095086574f 100644
+--- a/drivers/staging/rtl8712/mlme_linux.c
++++ b/drivers/staging/rtl8712/mlme_linux.c
+@@ -158,7 +158,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie)
+ p = buff;
+ p += sprintf(p, "ASSOCINFO(ReqIEs=");
+ len = sec_ie[1] + 2;
+- len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX - 1;
++ len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX;
+ for (i = 0; i < len; i++)
+ p += sprintf(p, "%02x", sec_ie[i]);
+ p += sprintf(p, ")");
+diff --git a/drivers/staging/rtl8712/rtl871x_mlme.c b/drivers/staging/rtl8712/rtl871x_mlme.c
+index ac547ddd72d1..d7e88d2a8b1b 100644
+--- a/drivers/staging/rtl8712/rtl871x_mlme.c
++++ b/drivers/staging/rtl8712/rtl871x_mlme.c
+@@ -1358,7 +1358,7 @@ sint r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie,
+ u8 *out_ie, uint in_len)
+ {
+ u8 authmode = 0, match;
+- u8 sec_ie[255], uncst_oui[4], bkup_ie[255];
++ u8 sec_ie[IW_CUSTOM_MAX], uncst_oui[4], bkup_ie[255];
+ u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
+ uint ielength, cnt, remove_cnt;
+ int iEntry;
+diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+index 0952d15f6d40..ca6f1fa3466a 100644
+--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
++++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+@@ -1566,7 +1566,7 @@ unsigned int OnAssocReq(struct adapter *padapter, union recv_frame *precv_frame)
+ if (pstat->aid > 0) {
+ DBG_871X(" old AID %d\n", pstat->aid);
+ } else {
+- for (pstat->aid = 1; pstat->aid < NUM_STA; pstat->aid++)
++ for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
+ if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
+ break;
+
+diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
+index dd5e1cede2b5..c3f933d10295 100644
+--- a/drivers/tty/serial/8250/8250_mtk.c
++++ b/drivers/tty/serial/8250/8250_mtk.c
+@@ -213,17 +213,17 @@ static int mtk8250_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, data);
+
+- pm_runtime_enable(&pdev->dev);
+- if (!pm_runtime_enabled(&pdev->dev)) {
+- err = mtk8250_runtime_resume(&pdev->dev);
+- if (err)
+- return err;
+- }
++ err = mtk8250_runtime_resume(&pdev->dev);
++ if (err)
++ return err;
+
+ data->line = serial8250_register_8250_port(&uart);
+ if (data->line < 0)
+ return data->line;
+
++ pm_runtime_set_active(&pdev->dev);
++ pm_runtime_enable(&pdev->dev);
++
+ return 0;
+ }
+
+@@ -234,13 +234,11 @@ static int mtk8250_remove(struct platform_device *pdev)
+ pm_runtime_get_sync(&pdev->dev);
+
+ serial8250_unregister_port(data->line);
++ mtk8250_runtime_suspend(&pdev->dev);
+
+ pm_runtime_disable(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
+
+- if (!pm_runtime_status_suspended(&pdev->dev))
+- mtk8250_runtime_suspend(&pdev->dev);
+-
+ return 0;
+ }
+
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index 8a111ab33b50..93d3a0ec5e11 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -230,7 +230,7 @@ static void kgdboc_put_char(u8 chr)
+ static int param_set_kgdboc_var(const char *kmessage,
+ const struct kernel_param *kp)
+ {
+- int len = strlen(kmessage);
++ size_t len = strlen(kmessage);
+
+ if (len >= MAX_CONFIG_LEN) {
+ printk(KERN_ERR "kgdboc: config string too long\n");
+@@ -252,7 +252,7 @@ static int param_set_kgdboc_var(const char *kmessage,
+
+ strcpy(config, kmessage);
+ /* Chop out \n char as a result of echo */
+- if (config[len - 1] == '\n')
++ if (len && config[len - 1] == '\n')
+ config[len - 1] = '\0';
+
+ if (configured == 1)
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 252eef2c32f9..d6f42b528277 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1372,7 +1372,13 @@ err_release_lock:
+ return ERR_PTR(retval);
+ }
+
+-static void tty_free_termios(struct tty_struct *tty)
++/**
++ * tty_save_termios() - save tty termios data in driver table
++ * @tty: tty whose termios data to save
++ *
++ * Locking: Caller guarantees serialisation with tty_init_termios().
++ */
++void tty_save_termios(struct tty_struct *tty)
+ {
+ struct ktermios *tp;
+ int idx = tty->index;
+@@ -1391,6 +1397,7 @@ static void tty_free_termios(struct tty_struct *tty)
+ }
+ *tp = tty->termios;
+ }
++EXPORT_SYMBOL_GPL(tty_save_termios);
+
+ /**
+ * tty_flush_works - flush all works of a tty/pty pair
+@@ -1490,7 +1497,7 @@ static void release_tty(struct tty_struct *tty, int idx)
+ WARN_ON(!mutex_is_locked(&tty_mutex));
+ if (tty->ops->shutdown)
+ tty->ops->shutdown(tty);
+- tty_free_termios(tty);
++ tty_save_termios(tty);
+ tty_driver_remove_tty(tty->driver, tty);
+ tty->port->itty = NULL;
+ if (tty->link)
+diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
+index 25d736880013..c699d41a2a48 100644
+--- a/drivers/tty/tty_port.c
++++ b/drivers/tty/tty_port.c
+@@ -640,7 +640,8 @@ void tty_port_close(struct tty_port *port, struct tty_struct *tty,
+ if (tty_port_close_start(port, tty, filp) == 0)
+ return;
+ tty_port_shutdown(port, tty);
+- set_bit(TTY_IO_ERROR, &tty->flags);
++ if (!port->console)
++ set_bit(TTY_IO_ERROR, &tty->flags);
+ tty_port_close_end(port, tty);
+ tty_port_tty_set(port, NULL);
+ }
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index f79979ae482a..cc62707c0251 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2250,7 +2250,7 @@ static int usb_enumerate_device_otg(struct usb_device *udev)
+ /* descriptor may appear anywhere in config */
+ err = __usb_get_extra_descriptor(udev->rawdescriptors[0],
+ le16_to_cpu(udev->config[0].desc.wTotalLength),
+- USB_DT_OTG, (void **) &desc);
++ USB_DT_OTG, (void **) &desc, sizeof(*desc));
+ if (err || !(desc->bmAttributes & USB_OTG_HNP))
+ return 0;
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 0690fcff0ea2..514c5214ddb2 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -333,6 +333,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Midiman M-Audio Keystation 88es */
+ { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* SanDisk Ultra Fit and Ultra Flair */
++ { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM },
++ { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
+diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
+index 79d8bd7a612e..4ebfbd737905 100644
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -832,14 +832,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number);
+ */
+
+ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+- unsigned char type, void **ptr)
++ unsigned char type, void **ptr, size_t minsize)
+ {
+ struct usb_descriptor_header *header;
+
+ while (size >= sizeof(struct usb_descriptor_header)) {
+ header = (struct usb_descriptor_header *)buffer;
+
+- if (header->bLength < 2) {
++ if (header->bLength < 2 || header->bLength > size) {
+ printk(KERN_ERR
+ "%s: bogus descriptor, type %d length %d\n",
+ usbcore_name,
+@@ -848,7 +848,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+ return -1;
+ }
+
+- if (header->bDescriptorType == type) {
++ if (header->bDescriptorType == type && header->bLength >= minsize) {
+ *ptr = header;
+ return 0;
+ }
+diff --git a/drivers/usb/dwc2/pci.c b/drivers/usb/dwc2/pci.c
+index d257c541e51b..7afc10872f1f 100644
+--- a/drivers/usb/dwc2/pci.c
++++ b/drivers/usb/dwc2/pci.c
+@@ -120,6 +120,7 @@ static int dwc2_pci_probe(struct pci_dev *pci,
+ dwc2 = platform_device_alloc("dwc2", PLATFORM_DEVID_AUTO);
+ if (!dwc2) {
+ dev_err(dev, "couldn't allocate dwc2 device\n");
++ ret = -ENOMEM;
+ goto err;
+ }
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 3ada83d81bda..31e8bf3578c8 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -215,7 +215,6 @@ struct ffs_io_data {
+
+ struct mm_struct *mm;
+ struct work_struct work;
+- struct work_struct cancellation_work;
+
+ struct usb_ep *ep;
+ struct usb_request *req;
+@@ -1073,31 +1072,22 @@ ffs_epfile_open(struct inode *inode, struct file *file)
+ return 0;
+ }
+
+-static void ffs_aio_cancel_worker(struct work_struct *work)
+-{
+- struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
+- cancellation_work);
+-
+- ENTER();
+-
+- usb_ep_dequeue(io_data->ep, io_data->req);
+-}
+-
+ static int ffs_aio_cancel(struct kiocb *kiocb)
+ {
+ struct ffs_io_data *io_data = kiocb->private;
+- struct ffs_data *ffs = io_data->ffs;
++ struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
+ int value;
+
+ ENTER();
+
+- if (likely(io_data && io_data->ep && io_data->req)) {
+- INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker);
+- queue_work(ffs->io_completion_wq, &io_data->cancellation_work);
+- value = -EINPROGRESS;
+- } else {
++ spin_lock_irq(&epfile->ffs->eps_lock);
++
++ if (likely(io_data && io_data->ep && io_data->req))
++ value = usb_ep_dequeue(io_data->ep, io_data->req);
++ else
+ value = -EINVAL;
+- }
++
++ spin_unlock_irq(&epfile->ffs->eps_lock);
+
+ return value;
+ }
+diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
+index 684d6f074c3a..09a8ebd95588 100644
+--- a/drivers/usb/host/hwa-hc.c
++++ b/drivers/usb/host/hwa-hc.c
+@@ -640,7 +640,7 @@ static int hwahc_security_create(struct hwahc *hwahc)
+ top = itr + itr_size;
+ result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index],
+ le16_to_cpu(usb_dev->actconfig->desc.wTotalLength),
+- USB_DT_SECURITY, (void **) &secd);
++ USB_DT_SECURITY, (void **) &secd, sizeof(*secd));
+ if (result == -1) {
+ dev_warn(dev, "BUG? WUSB host has no security descriptors\n");
+ return 0;
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index beeda27b3789..09bf6b4b741b 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -132,6 +132,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ pdev->device == 0x43bb))
+ xhci->quirks |= XHCI_SUSPEND_DELAY;
+
++ if (pdev->vendor == PCI_VENDOR_ID_AMD &&
++ (pdev->device == 0x15e0 || pdev->device == 0x15e1))
++ xhci->quirks |= XHCI_SNPS_BROKEN_SUSPEND;
++
+ if (pdev->vendor == PCI_VENDOR_ID_AMD)
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index c928dbbff881..dae3be1b9c8f 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -968,6 +968,7 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
+ unsigned int delay = XHCI_MAX_HALT_USEC;
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ u32 command;
++ u32 res;
+
+ if (!hcd->state)
+ return 0;
+@@ -1021,11 +1022,28 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
+ command = readl(&xhci->op_regs->command);
+ command |= CMD_CSS;
+ writel(command, &xhci->op_regs->command);
++ xhci->broken_suspend = 0;
+ if (xhci_handshake(&xhci->op_regs->status,
+ STS_SAVE, 0, 10 * 1000)) {
+- xhci_warn(xhci, "WARN: xHC save state timeout\n");
+- spin_unlock_irq(&xhci->lock);
+- return -ETIMEDOUT;
++ /*
++ * AMD SNPS xHC 3.0 occasionally does not clear the
++ * SSS bit of USBSTS and when driver tries to poll
++ * to see if the xHC clears BIT(8) which never happens
++ * and driver assumes that controller is not responding
++ * and times out. To workaround this, its good to check
++ * if SRE and HCE bits are not set (as per xhci
++ * Section 5.4.2) and bypass the timeout.
++ */
++ res = readl(&xhci->op_regs->status);
++ if ((xhci->quirks & XHCI_SNPS_BROKEN_SUSPEND) &&
++ (((res & STS_SRE) == 0) &&
++ ((res & STS_HCE) == 0))) {
++ xhci->broken_suspend = 1;
++ } else {
++ xhci_warn(xhci, "WARN: xHC save state timeout\n");
++ spin_unlock_irq(&xhci->lock);
++ return -ETIMEDOUT;
++ }
+ }
+ spin_unlock_irq(&xhci->lock);
+
+@@ -1078,7 +1096,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
+
+ spin_lock_irq(&xhci->lock);
+- if (xhci->quirks & XHCI_RESET_ON_RESUME)
++ if ((xhci->quirks & XHCI_RESET_ON_RESUME) || xhci->broken_suspend)
+ hibernated = true;
+
+ if (!hibernated) {
+@@ -4496,6 +4514,14 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci,
+ {
+ unsigned long long timeout_ns;
+
++ /* Prevent U1 if service interval is shorter than U1 exit latency */
++ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
++ if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) {
++ dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n");
++ return USB3_LPM_DISABLED;
++ }
++ }
++
+ if (xhci->quirks & XHCI_INTEL_HOST)
+ timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
+ else
+@@ -4552,6 +4578,14 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci,
+ {
+ unsigned long long timeout_ns;
+
++ /* Prevent U2 if service interval is shorter than U2 exit latency */
++ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
++ if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) {
++ dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n");
++ return USB3_LPM_DISABLED;
++ }
++ }
++
+ if (xhci->quirks & XHCI_INTEL_HOST)
+ timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
+ else
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index e936e4c8af98..c3ed7d1c9f65 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1847,6 +1847,7 @@ struct xhci_hcd {
+ #define XHCI_INTEL_USB_ROLE_SW BIT_ULL(31)
+ #define XHCI_ZERO_64B_REGS BIT_ULL(32)
+ #define XHCI_RESET_PLL_ON_DISCONNECT BIT_ULL(34)
++#define XHCI_SNPS_BROKEN_SUSPEND BIT_ULL(35)
+
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+@@ -1876,6 +1877,8 @@ struct xhci_hcd {
+ void *dbc;
+ /* platform-specific data -- must come last */
+ unsigned long priv[0] __aligned(sizeof(s64));
++ /* Broken Suspend flag for SNPS Suspend resume issue */
++ u8 broken_suspend;
+ };
+
+ /* Platform specific overrides to generic XHCI hc_driver ops */
+diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
+index 6a0c60badfa0..1c6da8d6cccf 100644
+--- a/drivers/usb/misc/appledisplay.c
++++ b/drivers/usb/misc/appledisplay.c
+@@ -51,6 +51,7 @@ static const struct usb_device_id appledisplay_table[] = {
+ { APPLEDISPLAY_DEVICE(0x921c) },
+ { APPLEDISPLAY_DEVICE(0x921d) },
+ { APPLEDISPLAY_DEVICE(0x9222) },
++ { APPLEDISPLAY_DEVICE(0x9226) },
+ { APPLEDISPLAY_DEVICE(0x9236) },
+
+ /* Terminating entry */
+diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
+index 17940589c647..7d289302ff6c 100644
+--- a/drivers/usb/serial/console.c
++++ b/drivers/usb/serial/console.c
+@@ -101,7 +101,6 @@ static int usb_console_setup(struct console *co, char *options)
+ cflag |= PARENB;
+ break;
+ }
+- co->cflag = cflag;
+
+ /*
+ * no need to check the index here: if the index is wrong, console
+@@ -164,6 +163,7 @@ static int usb_console_setup(struct console *co, char *options)
+ serial->type->set_termios(tty, port, &dummy);
+
+ tty_port_tty_set(&port->port, NULL);
++ tty_save_termios(tty);
+ tty_kref_put(tty);
+ }
+ tty_port_set_initialized(&port->port, 1);
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 34bc3ab40c6d..51879ed18652 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -15,6 +15,7 @@
+ #include <net/sock.h>
+ #include <linux/virtio_vsock.h>
+ #include <linux/vhost.h>
++#include <linux/hashtable.h>
+
+ #include <net/af_vsock.h>
+ #include "vhost.h"
+@@ -27,14 +28,14 @@ enum {
+
+ /* Used to track all the vhost_vsock instances on the system. */
+ static DEFINE_SPINLOCK(vhost_vsock_lock);
+-static LIST_HEAD(vhost_vsock_list);
++static DEFINE_READ_MOSTLY_HASHTABLE(vhost_vsock_hash, 8);
+
+ struct vhost_vsock {
+ struct vhost_dev dev;
+ struct vhost_virtqueue vqs[2];
+
+- /* Link to global vhost_vsock_list, protected by vhost_vsock_lock */
+- struct list_head list;
++ /* Link to global vhost_vsock_hash, writes use vhost_vsock_lock */
++ struct hlist_node hash;
+
+ struct vhost_work send_pkt_work;
+ spinlock_t send_pkt_list_lock;
+@@ -50,11 +51,14 @@ static u32 vhost_transport_get_local_cid(void)
+ return VHOST_VSOCK_DEFAULT_HOST_CID;
+ }
+
+-static struct vhost_vsock *__vhost_vsock_get(u32 guest_cid)
++/* Callers that dereference the return value must hold vhost_vsock_lock or the
++ * RCU read lock.
++ */
++static struct vhost_vsock *vhost_vsock_get(u32 guest_cid)
+ {
+ struct vhost_vsock *vsock;
+
+- list_for_each_entry(vsock, &vhost_vsock_list, list) {
++ hash_for_each_possible_rcu(vhost_vsock_hash, vsock, hash, guest_cid) {
+ u32 other_cid = vsock->guest_cid;
+
+ /* Skip instances that have no CID yet */
+@@ -69,17 +73,6 @@ static struct vhost_vsock *__vhost_vsock_get(u32 guest_cid)
+ return NULL;
+ }
+
+-static struct vhost_vsock *vhost_vsock_get(u32 guest_cid)
+-{
+- struct vhost_vsock *vsock;
+-
+- spin_lock_bh(&vhost_vsock_lock);
+- vsock = __vhost_vsock_get(guest_cid);
+- spin_unlock_bh(&vhost_vsock_lock);
+-
+- return vsock;
+-}
+-
+ static void
+ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
+ struct vhost_virtqueue *vq)
+@@ -210,9 +203,12 @@ vhost_transport_send_pkt(struct virtio_vsock_pkt *pkt)
+ struct vhost_vsock *vsock;
+ int len = pkt->len;
+
++ rcu_read_lock();
++
+ /* Find the vhost_vsock according to guest context id */
+ vsock = vhost_vsock_get(le64_to_cpu(pkt->hdr.dst_cid));
+ if (!vsock) {
++ rcu_read_unlock();
+ virtio_transport_free_pkt(pkt);
+ return -ENODEV;
+ }
+@@ -225,6 +221,8 @@ vhost_transport_send_pkt(struct virtio_vsock_pkt *pkt)
+ spin_unlock_bh(&vsock->send_pkt_list_lock);
+
+ vhost_work_queue(&vsock->dev, &vsock->send_pkt_work);
++
++ rcu_read_unlock();
+ return len;
+ }
+
+@@ -234,12 +232,15 @@ vhost_transport_cancel_pkt(struct vsock_sock *vsk)
+ struct vhost_vsock *vsock;
+ struct virtio_vsock_pkt *pkt, *n;
+ int cnt = 0;
++ int ret = -ENODEV;
+ LIST_HEAD(freeme);
+
++ rcu_read_lock();
++
+ /* Find the vhost_vsock according to guest context id */
+ vsock = vhost_vsock_get(vsk->remote_addr.svm_cid);
+ if (!vsock)
+- return -ENODEV;
++ goto out;
+
+ spin_lock_bh(&vsock->send_pkt_list_lock);
+ list_for_each_entry_safe(pkt, n, &vsock->send_pkt_list, list) {
+@@ -265,7 +266,10 @@ vhost_transport_cancel_pkt(struct vsock_sock *vsk)
+ vhost_poll_queue(&tx_vq->poll);
+ }
+
+- return 0;
++ ret = 0;
++out:
++ rcu_read_unlock();
++ return ret;
+ }
+
+ static struct virtio_vsock_pkt *
+@@ -533,10 +537,6 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
+ spin_lock_init(&vsock->send_pkt_list_lock);
+ INIT_LIST_HEAD(&vsock->send_pkt_list);
+ vhost_work_init(&vsock->send_pkt_work, vhost_transport_send_pkt_work);
+-
+- spin_lock_bh(&vhost_vsock_lock);
+- list_add_tail(&vsock->list, &vhost_vsock_list);
+- spin_unlock_bh(&vhost_vsock_lock);
+ return 0;
+
+ out:
+@@ -577,9 +577,13 @@ static int vhost_vsock_dev_release(struct inode *inode, struct file *file)
+ struct vhost_vsock *vsock = file->private_data;
+
+ spin_lock_bh(&vhost_vsock_lock);
+- list_del(&vsock->list);
++ if (vsock->guest_cid)
++ hash_del_rcu(&vsock->hash);
+ spin_unlock_bh(&vhost_vsock_lock);
+
++ /* Wait for other CPUs to finish using vsock */
++ synchronize_rcu();
++
+ /* Iterating over all connections for all CIDs to find orphans is
+ * inefficient. Room for improvement here. */
+ vsock_for_each_connected_socket(vhost_vsock_reset_orphans);
+@@ -620,12 +624,17 @@ static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid)
+
+ /* Refuse if CID is already in use */
+ spin_lock_bh(&vhost_vsock_lock);
+- other = __vhost_vsock_get(guest_cid);
++ other = vhost_vsock_get(guest_cid);
+ if (other && other != vsock) {
+ spin_unlock_bh(&vhost_vsock_lock);
+ return -EADDRINUSE;
+ }
++
++ if (vsock->guest_cid)
++ hash_del_rcu(&vsock->hash);
++
+ vsock->guest_cid = guest_cid;
++ hash_add_rcu(vhost_vsock_hash, &vsock->hash, guest_cid);
+ spin_unlock_bh(&vhost_vsock_lock);
+
+ return 0;
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index 3713d22b95a7..907e85d65bb4 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -174,7 +174,7 @@ cifs_bp_rename_retry:
+
+ cifs_dbg(FYI, "using cifs_sb prepath <%s>\n", cifs_sb->prepath);
+ memcpy(full_path+dfsplen+1, cifs_sb->prepath, pplen-1);
+- full_path[dfsplen] = '\\';
++ full_path[dfsplen] = dirsep;
+ for (i = 0; i < pplen-1; i++)
+ if (full_path[dfsplen+1+i] == '/')
+ full_path[dfsplen+1+i] = CIFS_DIR_SEP(cifs_sb);
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index 7b861bbc0b43..315967354954 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -686,20 +686,24 @@ __be32 nfs4_callback_offload(void *data, void *dummy,
+ {
+ struct cb_offloadargs *args = data;
+ struct nfs_server *server;
+- struct nfs4_copy_state *copy;
++ struct nfs4_copy_state *copy, *tmp_copy;
+ bool found = false;
+
++ copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
++ if (!copy)
++ return htonl(NFS4ERR_SERVERFAULT);
++
+ spin_lock(&cps->clp->cl_lock);
+ rcu_read_lock();
+ list_for_each_entry_rcu(server, &cps->clp->cl_superblocks,
+ client_link) {
+- list_for_each_entry(copy, &server->ss_copies, copies) {
++ list_for_each_entry(tmp_copy, &server->ss_copies, copies) {
+ if (memcmp(args->coa_stateid.other,
+- copy->stateid.other,
++ tmp_copy->stateid.other,
+ sizeof(args->coa_stateid.other)))
+ continue;
+- nfs4_copy_cb_args(copy, args);
+- complete(©->completion);
++ nfs4_copy_cb_args(tmp_copy, args);
++ complete(&tmp_copy->completion);
+ found = true;
+ goto out;
+ }
+@@ -707,15 +711,11 @@ __be32 nfs4_callback_offload(void *data, void *dummy,
+ out:
+ rcu_read_unlock();
+ if (!found) {
+- copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
+- if (!copy) {
+- spin_unlock(&cps->clp->cl_lock);
+- return htonl(NFS4ERR_SERVERFAULT);
+- }
+ memcpy(©->stateid, &args->coa_stateid, NFS4_STATEID_SIZE);
+ nfs4_copy_cb_args(copy, args);
+ list_add_tail(©->copies, &cps->clp->pending_cb_stateids);
+- }
++ } else
++ kfree(copy);
+ spin_unlock(&cps->clp->cl_lock);
+
+ return 0;
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index cae43333ef16..86ac2c5b93fe 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -1361,12 +1361,7 @@ static void ff_layout_read_prepare_v4(struct rpc_task *task, void *data)
+ task))
+ return;
+
+- if (ff_layout_read_prepare_common(task, hdr))
+- return;
+-
+- if (nfs4_set_rw_stateid(&hdr->args.stateid, hdr->args.context,
+- hdr->args.lock_context, FMODE_READ) == -EIO)
+- rpc_exit(task, -EIO); /* lost lock, terminate I/O */
++ ff_layout_read_prepare_common(task, hdr);
+ }
+
+ static void ff_layout_read_call_done(struct rpc_task *task, void *data)
+@@ -1542,12 +1537,7 @@ static void ff_layout_write_prepare_v4(struct rpc_task *task, void *data)
+ task))
+ return;
+
+- if (ff_layout_write_prepare_common(task, hdr))
+- return;
+-
+- if (nfs4_set_rw_stateid(&hdr->args.stateid, hdr->args.context,
+- hdr->args.lock_context, FMODE_WRITE) == -EIO)
+- rpc_exit(task, -EIO); /* lost lock, terminate I/O */
++ ff_layout_write_prepare_common(task, hdr);
+ }
+
+ static void ff_layout_write_call_done(struct rpc_task *task, void *data)
+@@ -1742,6 +1732,10 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr)
+ fh = nfs4_ff_layout_select_ds_fh(lseg, idx);
+ if (fh)
+ hdr->args.fh = fh;
++
++ if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
++ goto out_failed;
++
+ /*
+ * Note that if we ever decide to split across DSes,
+ * then we may need to handle dense-like offsets.
+@@ -1804,6 +1798,9 @@ ff_layout_write_pagelist(struct nfs_pgio_header *hdr, int sync)
+ if (fh)
+ hdr->args.fh = fh;
+
++ if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
++ goto out_failed;
++
+ /*
+ * Note that if we ever decide to split across DSes,
+ * then we may need to handle dense-like offsets.
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
+index 411798346e48..de50a342d5a5 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.h
++++ b/fs/nfs/flexfilelayout/flexfilelayout.h
+@@ -215,6 +215,10 @@ unsigned int ff_layout_fetch_ds_ioerr(struct pnfs_layout_hdr *lo,
+ unsigned int maxnum);
+ struct nfs_fh *
+ nfs4_ff_layout_select_ds_fh(struct pnfs_layout_segment *lseg, u32 mirror_idx);
++int
++nfs4_ff_layout_select_ds_stateid(struct pnfs_layout_segment *lseg,
++ u32 mirror_idx,
++ nfs4_stateid *stateid);
+
+ struct nfs4_pnfs_ds *
+ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
+diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+index 59aa04976331..a8df2f496898 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+@@ -370,6 +370,25 @@ out:
+ return fh;
+ }
+
++int
++nfs4_ff_layout_select_ds_stateid(struct pnfs_layout_segment *lseg,
++ u32 mirror_idx,
++ nfs4_stateid *stateid)
++{
++ struct nfs4_ff_layout_mirror *mirror = FF_LAYOUT_COMP(lseg, mirror_idx);
++
++ if (!ff_layout_mirror_valid(lseg, mirror, false)) {
++ pr_err_ratelimited("NFS: %s: No data server for mirror offset index %d\n",
++ __func__, mirror_idx);
++ goto out;
++ }
++
++ nfs4_stateid_copy(stateid, &mirror->stateid);
++ return 1;
++out:
++ return 0;
++}
++
+ /**
+ * nfs4_ff_layout_prepare_ds - prepare a DS connection for an RPC call
+ * @lseg: the layout segment we're operating on
+diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
+index ac5b784a1de0..fed06fd9998d 100644
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -137,31 +137,32 @@ static int handle_async_copy(struct nfs42_copy_res *res,
+ struct file *dst,
+ nfs4_stateid *src_stateid)
+ {
+- struct nfs4_copy_state *copy;
++ struct nfs4_copy_state *copy, *tmp_copy;
+ int status = NFS4_OK;
+ bool found_pending = false;
+ struct nfs_open_context *ctx = nfs_file_open_context(dst);
+
++ copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
++ if (!copy)
++ return -ENOMEM;
++
+ spin_lock(&server->nfs_client->cl_lock);
+- list_for_each_entry(copy, &server->nfs_client->pending_cb_stateids,
++ list_for_each_entry(tmp_copy, &server->nfs_client->pending_cb_stateids,
+ copies) {
+- if (memcmp(&res->write_res.stateid, ©->stateid,
++ if (memcmp(&res->write_res.stateid, &tmp_copy->stateid,
+ NFS4_STATEID_SIZE))
+ continue;
+ found_pending = true;
+- list_del(©->copies);
++ list_del(&tmp_copy->copies);
+ break;
+ }
+ if (found_pending) {
+ spin_unlock(&server->nfs_client->cl_lock);
++ kfree(copy);
++ copy = tmp_copy;
+ goto out;
+ }
+
+- copy = kzalloc(sizeof(struct nfs4_copy_state), GFP_NOFS);
+- if (!copy) {
+- spin_unlock(&server->nfs_client->cl_lock);
+- return -ENOMEM;
+- }
+ memcpy(©->stateid, &res->write_res.stateid, NFS4_STATEID_SIZE);
+ init_completion(©->completion);
+ copy->parent_state = ctx->state;
+diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
+index 3a6904173214..63287d911c08 100644
+--- a/fs/nfs/nfs4_fs.h
++++ b/fs/nfs/nfs4_fs.h
+@@ -41,6 +41,8 @@ enum nfs4_client_state {
+ NFS4CLNT_MOVED,
+ NFS4CLNT_LEASE_MOVED,
+ NFS4CLNT_DELEGATION_EXPIRED,
++ NFS4CLNT_RUN_MANAGER,
++ NFS4CLNT_DELEGRETURN_RUNNING,
+ };
+
+ #define NFS4_RENEW_TIMEOUT 0x01
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 18920152da14..d2f645d34eb1 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1210,6 +1210,7 @@ void nfs4_schedule_state_manager(struct nfs_client *clp)
+ struct task_struct *task;
+ char buf[INET6_ADDRSTRLEN + sizeof("-manager") + 1];
+
++ set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
+ if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
+ return;
+ __module_get(THIS_MODULE);
+@@ -2485,6 +2486,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+
+ /* Ensure exclusive access to NFSv4 state */
+ do {
++ clear_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
+ if (test_bit(NFS4CLNT_PURGE_STATE, &clp->cl_state)) {
+ section = "purge state";
+ status = nfs4_purge_lease(clp);
+@@ -2575,14 +2577,18 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ }
+
+ nfs4_end_drain_session(clp);
+- if (test_and_clear_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state)) {
+- nfs_client_return_marked_delegations(clp);
+- continue;
++ nfs4_clear_state_manager_bit(clp);
++
++ if (!test_and_set_bit(NFS4CLNT_DELEGRETURN_RUNNING, &clp->cl_state)) {
++ if (test_and_clear_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state)) {
++ nfs_client_return_marked_delegations(clp);
++ set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
++ }
++ clear_bit(NFS4CLNT_DELEGRETURN_RUNNING, &clp->cl_state);
+ }
+
+- nfs4_clear_state_manager_bit(clp);
+ /* Did we race with an attempt to give us more work? */
+- if (clp->cl_state == 0)
++ if (!test_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state))
+ return;
+ if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
+ return;
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index efda23cf32c7..5185a16b19ba 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -904,6 +904,13 @@ struct vmbus_channel {
+
+ bool probe_done;
+
++ /*
++ * We must offload the handling of the primary/sub channels
++ * from the single-threaded vmbus_connection.work_queue to
++ * two different workqueue, otherwise we can block
++ * vmbus_connection.work_queue and hang: see vmbus_process_offer().
++ */
++ struct work_struct add_channel_work;
+ };
+
+ static inline bool is_hvsock_channel(const struct vmbus_channel *c)
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index c56e3978b00f..808fbfe86f85 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -556,6 +556,7 @@ extern struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx);
+ extern void tty_release_struct(struct tty_struct *tty, int idx);
+ extern int tty_release(struct inode *inode, struct file *filp);
+ extern void tty_init_termios(struct tty_struct *tty);
++extern void tty_save_termios(struct tty_struct *tty);
+ extern int tty_standard_install(struct tty_driver *driver,
+ struct tty_struct *tty);
+
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 4cdd515a4385..5e49e82c4368 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -407,11 +407,11 @@ struct usb_host_bos {
+ };
+
+ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+- unsigned char type, void **ptr);
++ unsigned char type, void **ptr, size_t min);
+ #define usb_get_extra_descriptor(ifpoint, type, ptr) \
+ __usb_get_extra_descriptor((ifpoint)->extra, \
+ (ifpoint)->extralen, \
+- type, (void **)ptr)
++ type, (void **)ptr, sizeof(**(ptr)))
+
+ /* ----------------------------------------------------------------------- */
+
+diff --git a/include/sound/pcm_params.h b/include/sound/pcm_params.h
+index 2dd37cada7c0..888a833d3b00 100644
+--- a/include/sound/pcm_params.h
++++ b/include/sound/pcm_params.h
+@@ -254,11 +254,13 @@ static inline int snd_interval_empty(const struct snd_interval *i)
+ static inline int snd_interval_single(const struct snd_interval *i)
+ {
+ return (i->min == i->max ||
+- (i->min + 1 == i->max && i->openmax));
++ (i->min + 1 == i->max && (i->openmin || i->openmax)));
+ }
+
+ static inline int snd_interval_value(const struct snd_interval *i)
+ {
++ if (i->openmin && !i->openmax)
++ return i->max;
+ return i->min;
+ }
+
+diff --git a/lib/test_firmware.c b/lib/test_firmware.c
+index b984806d7d7b..7cab9a9869ac 100644
+--- a/lib/test_firmware.c
++++ b/lib/test_firmware.c
+@@ -837,6 +837,7 @@ static ssize_t read_firmware_show(struct device *dev,
+ if (req->fw->size > PAGE_SIZE) {
+ pr_err("Testing interface must use PAGE_SIZE firmware for now\n");
+ rc = -EINVAL;
++ goto out;
+ }
+ memcpy(buf, req->fw->data, req->fw->size);
+
+diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
+index 9f481cfdf77d..e8090f099eb8 100644
+--- a/net/batman-adv/bat_v_elp.c
++++ b/net/batman-adv/bat_v_elp.c
+@@ -352,19 +352,21 @@ out:
+ */
+ int batadv_v_elp_iface_enable(struct batadv_hard_iface *hard_iface)
+ {
++ static const size_t tvlv_padding = sizeof(__be32);
+ struct batadv_elp_packet *elp_packet;
+ unsigned char *elp_buff;
+ u32 random_seqno;
+ size_t size;
+ int res = -ENOMEM;
+
+- size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN;
++ size = ETH_HLEN + NET_IP_ALIGN + BATADV_ELP_HLEN + tvlv_padding;
+ hard_iface->bat_v.elp_skb = dev_alloc_skb(size);
+ if (!hard_iface->bat_v.elp_skb)
+ goto out;
+
+ skb_reserve(hard_iface->bat_v.elp_skb, ETH_HLEN + NET_IP_ALIGN);
+- elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN);
++ elp_buff = skb_put_zero(hard_iface->bat_v.elp_skb,
++ BATADV_ELP_HLEN + tvlv_padding);
+ elp_packet = (struct batadv_elp_packet *)elp_buff;
+
+ elp_packet->packet_type = BATADV_ELP;
+diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
+index 0fddc17106bd..5b71a289d04f 100644
+--- a/net/batman-adv/fragmentation.c
++++ b/net/batman-adv/fragmentation.c
+@@ -275,7 +275,7 @@ batadv_frag_merge_packets(struct hlist_head *chain)
+ kfree(entry);
+
+ packet = (struct batadv_frag_packet *)skb_out->data;
+- size = ntohs(packet->total_size);
++ size = ntohs(packet->total_size) + hdr_size;
+
+ /* Make room for the rest of the fragments. */
+ if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 5836ddeac9e3..5f3c81e705c7 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1015,6 +1015,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+ if (local->open_count == 0)
+ ieee80211_clear_tx_pending(local);
+
++ sdata->vif.bss_conf.beacon_int = 0;
++
+ /*
+ * If the interface goes down while suspended, presumably because
+ * the device was unplugged and that happens before our resume,
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 96611d5dfadb..5e2b4a41acf1 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1372,6 +1372,7 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
+ return RX_CONTINUE;
+
+ if (ieee80211_is_ctl(hdr->frame_control) ||
++ ieee80211_is_nullfunc(hdr->frame_control) ||
+ ieee80211_is_qos_nullfunc(hdr->frame_control) ||
+ is_multicast_ether_addr(hdr->addr1))
+ return RX_CONTINUE;
+@@ -3029,7 +3030,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
+ cfg80211_sta_opmode_change_notify(sdata->dev,
+ rx->sta->addr,
+ &sta_opmode,
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ goto handled;
+ }
+ case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
+@@ -3066,7 +3067,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
+ cfg80211_sta_opmode_change_notify(sdata->dev,
+ rx->sta->addr,
+ &sta_opmode,
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ goto handled;
+ }
+ default:
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index 91d7c0cd1882..7fa10d06cc51 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -964,6 +964,8 @@ void ieee80211_tx_status_ext(struct ieee80211_hw *hw,
+ /* Track when last TDLS packet was ACKed */
+ if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
+ sta->status_stats.last_tdls_pkt_time = jiffies;
++ } else if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
++ return;
+ } else {
+ ieee80211_lost_packet(sta, info);
+ }
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 25ba24bef8f5..995a491f73a9 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -439,8 +439,8 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
+ if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL))
+ info->hw_queue = tx->sdata->vif.cab_queue;
+
+- /* no stations in PS mode */
+- if (!atomic_read(&ps->num_sta_ps))
++ /* no stations in PS mode and no buffered packets */
++ if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf))
+ return TX_CONTINUE;
+
+ info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index 21c0aa0a0d1d..8cb7d812ccb8 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -1768,6 +1768,7 @@ priv_release_snd_buf(struct rpc_rqst *rqstp)
+ for (i=0; i < rqstp->rq_enc_pages_num; i++)
+ __free_page(rqstp->rq_enc_pages[i]);
+ kfree(rqstp->rq_enc_pages);
++ rqstp->rq_release_snd_buf = NULL;
+ }
+
+ static int
+@@ -1776,6 +1777,9 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
+ struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
+ int first, last, i;
+
++ if (rqstp->rq_release_snd_buf)
++ rqstp->rq_release_snd_buf(rqstp);
++
+ if (snd_buf->page_len == 0) {
+ rqstp->rq_enc_pages_num = 0;
+ return 0;
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 959ed3acd240..aad1c8e858e5 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1418,6 +1418,8 @@ size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
+ ies[pos + ext],
+ ext == 2))
+ pos = skip_ie(ies, ielen, pos);
++ else
++ break;
+ }
+ } else {
+ pos = skip_ie(ies, ielen, pos);
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 66c90f486af9..818dff1de545 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -36,6 +36,7 @@
+ #include <sound/timer.h>
+ #include <sound/minors.h>
+ #include <linux/uio.h>
++#include <linux/delay.h>
+
+ #include "pcm_local.h"
+
+@@ -91,12 +92,12 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem);
+ * and this may lead to a deadlock when the code path takes read sem
+ * twice (e.g. one in snd_pcm_action_nonatomic() and another in
+ * snd_pcm_stream_lock()). As a (suboptimal) workaround, let writer to
+- * spin until it gets the lock.
++ * sleep until all the readers are completed without blocking by writer.
+ */
+-static inline void down_write_nonblock(struct rw_semaphore *lock)
++static inline void down_write_nonfifo(struct rw_semaphore *lock)
+ {
+ while (!down_write_trylock(lock))
+- cond_resched();
++ msleep(1);
+ }
+
+ #define PCM_LOCK_DEFAULT 0
+@@ -1967,7 +1968,7 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd)
+ res = -ENOMEM;
+ goto _nolock;
+ }
+- down_write_nonblock(&snd_pcm_link_rwsem);
++ down_write_nonfifo(&snd_pcm_link_rwsem);
+ write_lock_irq(&snd_pcm_link_rwlock);
+ if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+ substream->runtime->status->state != substream1->runtime->status->state ||
+@@ -2014,7 +2015,7 @@ static int snd_pcm_unlink(struct snd_pcm_substream *substream)
+ struct snd_pcm_substream *s;
+ int res = 0;
+
+- down_write_nonblock(&snd_pcm_link_rwsem);
++ down_write_nonfifo(&snd_pcm_link_rwsem);
+ write_lock_irq(&snd_pcm_link_rwlock);
+ if (!snd_pcm_stream_linked(substream)) {
+ res = -EALREADY;
+@@ -2369,7 +2370,8 @@ int snd_pcm_hw_constraints_complete(struct snd_pcm_substream *substream)
+
+ static void pcm_release_private(struct snd_pcm_substream *substream)
+ {
+- snd_pcm_unlink(substream);
++ if (snd_pcm_stream_linked(substream))
++ snd_pcm_unlink(substream);
+ }
+
+ void snd_pcm_release_substream(struct snd_pcm_substream *substream)
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 5810be2c6c34..1ddeebc373b3 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2585,6 +2585,10 @@ static const struct pci_device_id azx_ids[] = {
+ /* AMD Hudson */
+ { PCI_DEVICE(0x1022, 0x780d),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
++ /* AMD Stoney */
++ { PCI_DEVICE(0x1022, 0x157a),
++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
++ AZX_DCAPS_PM_RUNTIME },
+ /* AMD Raven */
+ { PCI_DEVICE(0x1022, 0x15e3),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index cf5d26642bcd..22ca1f0a858f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4988,9 +4988,18 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
+ { 0x19, 0x21a11010 }, /* dock mic */
+ { }
+ };
++ /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise
++ * the speaker output becomes too low by some reason on Thinkpads with
++ * ALC298 codec
++ */
++ static hda_nid_t preferred_pairs[] = {
++ 0x14, 0x03, 0x17, 0x02, 0x21, 0x02,
++ 0
++ };
+ struct alc_spec *spec = codec->spec;
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ spec->gen.preferred_dacs = preferred_pairs;
+ spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+ snd_hda_apply_pincfgs(codec, pincfgs);
+ } else if (action == HDA_FIXUP_ACT_INIT) {
+@@ -5510,6 +5519,7 @@ enum {
+ ALC221_FIXUP_HP_HEADSET_MIC,
+ ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+ ALC295_FIXUP_HP_AUTO_MUTE,
++ ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6387,6 +6397,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_auto_mute_via_amp,
+ },
++ [ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MIC
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6401,7 +6420,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
+ SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
+ SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
++ SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
++ SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
+ SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
+@@ -7065,6 +7088,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x14, 0x90170110},
+ {0x19, 0x04a11040},
+ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0286, 0x1025, "Acer", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE,
++ {0x12, 0x90a60130},
++ {0x17, 0x90170110},
++ {0x21, 0x02211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0288, 0x1028, "Dell", ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x12, 0x90a60120},
+ {0x14, 0x90170110},
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 2bfe4e80a6b9..a105947eaf55 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -682,9 +682,12 @@ static int usb_audio_probe(struct usb_interface *intf,
+
+ __error:
+ if (chip) {
++ /* chip->active is inside the chip->card object,
++ * decrement before memory is possibly returned.
++ */
++ atomic_dec(&chip->active);
+ if (!chip->num_interfaces)
+ snd_card_free(chip->card);
+- atomic_dec(&chip->active);
+ }
+ mutex_unlock(®ister_mutex);
+ return err;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 8a945ece9869..6623cafc94f2 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1373,6 +1373,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+
++ case USB_ID(0x152a, 0x85de): /* SMSL D1 DAC */
+ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
+ case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
+ case USB_ID(0x16b0, 0x06b2): /* NuPrime DAC-10 */
+diff --git a/tools/testing/selftests/tc-testing/tdc.py b/tools/testing/selftests/tc-testing/tdc.py
+index 87a04a8a5945..7607ba3e3cbe 100755
+--- a/tools/testing/selftests/tc-testing/tdc.py
++++ b/tools/testing/selftests/tc-testing/tdc.py
+@@ -134,9 +134,9 @@ def exec_cmd(args, pm, stage, command):
+ (rawout, serr) = proc.communicate()
+
+ if proc.returncode != 0 and len(serr) > 0:
+- foutput = serr.decode("utf-8")
++ foutput = serr.decode("utf-8", errors="ignore")
+ else:
+- foutput = rawout.decode("utf-8")
++ foutput = rawout.decode("utf-8", errors="ignore")
+
+ proc.stdout.close()
+ proc.stderr.close()
+@@ -169,6 +169,8 @@ def prepare_env(args, pm, stage, prefix, cmdlist, output = None):
+ file=sys.stderr)
+ print("\n{} *** Error message: \"{}\"".format(prefix, foutput),
+ file=sys.stderr)
++ print("returncode {}; expected {}".format(proc.returncode,
++ exit_codes))
+ print("\n{} *** Aborting test run.".format(prefix), file=sys.stderr)
+ print("\n\n{} *** stdout ***".format(proc.stdout), file=sys.stderr)
+ print("\n\n{} *** stderr ***".format(proc.stderr), file=sys.stderr)
+@@ -195,12 +197,18 @@ def run_one_test(pm, args, index, tidx):
+ print('-----> execute stage')
+ pm.call_pre_execute()
+ (p, procout) = exec_cmd(args, pm, 'execute', tidx["cmdUnderTest"])
+- exit_code = p.returncode
++ if p:
++ exit_code = p.returncode
++ else:
++ exit_code = None
++
+ pm.call_post_execute()
+
+- if (exit_code != int(tidx["expExitCode"])):
++ if (exit_code is None or exit_code != int(tidx["expExitCode"])):
+ result = False
+- print("exit:", exit_code, int(tidx["expExitCode"]))
++ print("exit: {!r}".format(exit_code))
++ print("exit: {}".format(int(tidx["expExitCode"])))
++ #print("exit: {!r} {}".format(exit_code, int(tidx["expExitCode"])))
+ print(procout)
+ else:
+ if args.verbose > 0:
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-12-17 11:42 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-12-17 11:42 UTC (permalink / raw
To: gentoo-commits
commit: a75a898806989c930a7fe627f3fa7f24611c2354
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 17 11:41:44 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Dec 17 11:41:44 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a75a8988
proj/linux-patches: Linux patch 4.19.10
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1009_linux-4.19.10.patch | 5005 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5009 insertions(+)
diff --git a/0000_README b/0000_README
index 79aa888..59408e2 100644
--- a/0000_README
+++ b/0000_README
@@ -79,6 +79,10 @@ Patch: 1008_linux-4.19.9.patch
From: http://www.kernel.org
Desc: Linux 4.19.9
+Patch: 1009_linux-4.19.10.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.10
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1009_linux-4.19.10.patch b/1009_linux-4.19.10.patch
new file mode 100644
index 0000000..3b73072
--- /dev/null
+++ b/1009_linux-4.19.10.patch
@@ -0,0 +1,5005 @@
+diff --git a/Makefile b/Makefile
+index 8717f34464d5..36d9de42def3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am3517-evm.dts b/arch/arm/boot/dts/am3517-evm.dts
+index 1d158cfda15f..c45aef806870 100644
+--- a/arch/arm/boot/dts/am3517-evm.dts
++++ b/arch/arm/boot/dts/am3517-evm.dts
+@@ -227,7 +227,7 @@
+ vmmc-supply = <&vmmc_fixed>;
+ bus-width = <4>;
+ wp-gpios = <&gpio4 30 GPIO_ACTIVE_HIGH>; /* gpio_126 */
+- cd-gpios = <&gpio4 31 GPIO_ACTIVE_HIGH>; /* gpio_127 */
++ cd-gpios = <&gpio4 31 GPIO_ACTIVE_LOW>; /* gpio_127 */
+ };
+
+ &mmc3 {
+diff --git a/arch/arm/boot/dts/am3517-som.dtsi b/arch/arm/boot/dts/am3517-som.dtsi
+index dae6e458e59f..b1c988eed87c 100644
+--- a/arch/arm/boot/dts/am3517-som.dtsi
++++ b/arch/arm/boot/dts/am3517-som.dtsi
+@@ -163,7 +163,7 @@
+ compatible = "ti,wl1271";
+ reg = <2>;
+ interrupt-parent = <&gpio6>;
+- interrupts = <10 IRQ_TYPE_LEVEL_HIGH>; /* gpio_170 */
++ interrupts = <10 IRQ_TYPE_EDGE_RISING>; /* gpio_170 */
+ ref-clock-frequency = <26000000>;
+ tcxo-clock-frequency = <26000000>;
+ };
+diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+index ac343330d0c8..98b682a8080c 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+@@ -129,7 +129,7 @@
+ };
+
+ &mmc3 {
+- interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>;
++ interrupts-extended = <&intc 94 &omap3_pmx_core 0x136>;
+ pinctrl-0 = <&mmc3_pins &wl127x_gpio>;
+ pinctrl-names = "default";
+ vmmc-supply = <&wl12xx_vmmc>;
+diff --git a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
+index 9d5d53fbe9c0..c39cf2ca54da 100644
+--- a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
++++ b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
+@@ -35,7 +35,7 @@
+ * jumpering combinations for the long run.
+ */
+ &mmc3 {
+- interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>;
++ interrupts-extended = <&intc 94 &omap3_pmx_core 0x136>;
+ pinctrl-0 = <&mmc3_pins &mmc3_core2_pins>;
+ pinctrl-names = "default";
+ vmmc-supply = <&wl12xx_vmmc>;
+diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
+index 61f68e5c48e9..b405992eb601 100644
+--- a/arch/arm/boot/dts/sama5d2.dtsi
++++ b/arch/arm/boot/dts/sama5d2.dtsi
+@@ -308,7 +308,7 @@
+ 0x1 0x0 0x60000000 0x10000000
+ 0x2 0x0 0x70000000 0x10000000
+ 0x3 0x0 0x80000000 0x10000000>;
+- clocks = <&mck>;
++ clocks = <&h32ck>;
+ status = "disabled";
+
+ nand_controller: nand-controller {
+diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c
+index dd28d2614d7f..d10d8831f527 100644
+--- a/arch/arm/mach-omap1/board-ams-delta.c
++++ b/arch/arm/mach-omap1/board-ams-delta.c
+@@ -726,6 +726,9 @@ static void modem_pm(struct uart_port *port, unsigned int state, unsigned old)
+ struct modem_private_data *priv = port->private_data;
+ int ret;
+
++ if (!priv)
++ return;
++
+ if (IS_ERR(priv->regulator))
+ return;
+
+diff --git a/arch/arm/mach-omap2/prm44xx.c b/arch/arm/mach-omap2/prm44xx.c
+index 7b95729e8359..38a1be6c3694 100644
+--- a/arch/arm/mach-omap2/prm44xx.c
++++ b/arch/arm/mach-omap2/prm44xx.c
+@@ -351,7 +351,7 @@ static void omap44xx_prm_reconfigure_io_chain(void)
+ * to occur, WAKEUPENABLE bits must be set in the pad mux registers, and
+ * omap44xx_prm_reconfigure_io_chain() must be called. No return value.
+ */
+-static void __init omap44xx_prm_enable_io_wakeup(void)
++static void omap44xx_prm_enable_io_wakeup(void)
+ {
+ s32 inst = omap4_prmst_get_prm_dev_inst();
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
+index 6d651f314193..6921f8dc5ebb 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
+@@ -31,6 +31,10 @@
+ status = "okay";
+ };
+
++&tlmm {
++ gpio-reserved-ranges = <0 4>, <81 4>;
++};
++
+ &uart9 {
+ status = "okay";
+ };
+diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
+index 74091fd3101e..d5523adeddbf 100644
+--- a/arch/s390/kernel/perf_cpum_cf.c
++++ b/arch/s390/kernel/perf_cpum_cf.c
+@@ -346,6 +346,8 @@ static int __hw_perf_event_init(struct perf_event *event)
+ break;
+
+ case PERF_TYPE_HARDWARE:
++ if (is_sampling_event(event)) /* No sampling support */
++ return -ENOENT;
+ ev = attr->config;
+ /* Count user space (problem-state) only */
+ if (!attr->exclude_user && attr->exclude_kernel) {
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 2216d21e955d..3692de84c420 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -55,7 +55,7 @@
+ #define PRIo64 "o"
+
+ /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
+-#define apic_debug(fmt, arg...)
++#define apic_debug(fmt, arg...) do {} while (0)
+
+ /* 14 is the version for Xeon and Pentium 8.4.8*/
+ #define APIC_VERSION (0x14UL | ((KVM_APIC_LVT_NUM - 1) << 16))
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index e55f7a90d4b2..c97a9d60d305 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -962,6 +962,7 @@ struct vcpu_vmx {
+ struct shared_msr_entry *guest_msrs;
+ int nmsrs;
+ int save_nmsrs;
++ bool guest_msrs_dirty;
+ unsigned long host_idt_base;
+ #ifdef CONFIG_X86_64
+ u64 msr_host_kernel_gs_base;
+@@ -1284,7 +1285,7 @@ static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked);
+ static bool nested_vmx_is_page_fault_vmexit(struct vmcs12 *vmcs12,
+ u16 error_code);
+ static void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu);
+-static void __always_inline vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
++static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
+ u32 msr, int type);
+
+ static DEFINE_PER_CPU(struct vmcs *, vmxarea);
+@@ -2874,6 +2875,20 @@ static void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
+
+ vmx->req_immediate_exit = false;
+
++ /*
++ * Note that guest MSRs to be saved/restored can also be changed
++ * when guest state is loaded. This happens when guest transitions
++ * to/from long-mode by setting MSR_EFER.LMA.
++ */
++ if (!vmx->loaded_cpu_state || vmx->guest_msrs_dirty) {
++ vmx->guest_msrs_dirty = false;
++ for (i = 0; i < vmx->save_nmsrs; ++i)
++ kvm_set_shared_msr(vmx->guest_msrs[i].index,
++ vmx->guest_msrs[i].data,
++ vmx->guest_msrs[i].mask);
++
++ }
++
+ if (vmx->loaded_cpu_state)
+ return;
+
+@@ -2934,11 +2949,6 @@ static void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
+ vmcs_writel(HOST_GS_BASE, gs_base);
+ host_state->gs_base = gs_base;
+ }
+-
+- for (i = 0; i < vmx->save_nmsrs; ++i)
+- kvm_set_shared_msr(vmx->guest_msrs[i].index,
+- vmx->guest_msrs[i].data,
+- vmx->guest_msrs[i].mask);
+ }
+
+ static void vmx_prepare_switch_to_host(struct vcpu_vmx *vmx)
+@@ -3418,6 +3428,7 @@ static void setup_msrs(struct vcpu_vmx *vmx)
+ move_msr_up(vmx, index, save_nmsrs++);
+
+ vmx->save_nmsrs = save_nmsrs;
++ vmx->guest_msrs_dirty = true;
+
+ if (cpu_has_vmx_msr_bitmap())
+ vmx_update_msr_bitmap(&vmx->vcpu);
+@@ -5924,7 +5935,7 @@ static void free_vpid(int vpid)
+ spin_unlock(&vmx_vpid_lock);
+ }
+
+-static void __always_inline vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
++static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
+ u32 msr, int type)
+ {
+ int f = sizeof(unsigned long);
+@@ -5962,7 +5973,7 @@ static void __always_inline vmx_disable_intercept_for_msr(unsigned long *msr_bit
+ }
+ }
+
+-static void __always_inline vmx_enable_intercept_for_msr(unsigned long *msr_bitmap,
++static __always_inline void vmx_enable_intercept_for_msr(unsigned long *msr_bitmap,
+ u32 msr, int type)
+ {
+ int f = sizeof(unsigned long);
+@@ -6000,7 +6011,7 @@ static void __always_inline vmx_enable_intercept_for_msr(unsigned long *msr_bitm
+ }
+ }
+
+-static void __always_inline vmx_set_intercept_for_msr(unsigned long *msr_bitmap,
++static __always_inline void vmx_set_intercept_for_msr(unsigned long *msr_bitmap,
+ u32 msr, int type, bool value)
+ {
+ if (value)
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 2eeddd814653..c6c7c9b7b5c1 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -7,7 +7,6 @@
+
+ #include <xen/features.h>
+ #include <xen/page.h>
+-#include <xen/interface/memory.h>
+
+ #include <asm/xen/hypercall.h>
+ #include <asm/xen/hypervisor.h>
+@@ -343,80 +342,3 @@ void xen_arch_unregister_cpu(int num)
+ }
+ EXPORT_SYMBOL(xen_arch_unregister_cpu);
+ #endif
+-
+-#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+-void __init arch_xen_balloon_init(struct resource *hostmem_resource)
+-{
+- struct xen_memory_map memmap;
+- int rc;
+- unsigned int i, last_guest_ram;
+- phys_addr_t max_addr = PFN_PHYS(max_pfn);
+- struct e820_table *xen_e820_table;
+- const struct e820_entry *entry;
+- struct resource *res;
+-
+- if (!xen_initial_domain())
+- return;
+-
+- xen_e820_table = kmalloc(sizeof(*xen_e820_table), GFP_KERNEL);
+- if (!xen_e820_table)
+- return;
+-
+- memmap.nr_entries = ARRAY_SIZE(xen_e820_table->entries);
+- set_xen_guest_handle(memmap.buffer, xen_e820_table->entries);
+- rc = HYPERVISOR_memory_op(XENMEM_machine_memory_map, &memmap);
+- if (rc) {
+- pr_warn("%s: Can't read host e820 (%d)\n", __func__, rc);
+- goto out;
+- }
+-
+- last_guest_ram = 0;
+- for (i = 0; i < memmap.nr_entries; i++) {
+- if (xen_e820_table->entries[i].addr >= max_addr)
+- break;
+- if (xen_e820_table->entries[i].type == E820_TYPE_RAM)
+- last_guest_ram = i;
+- }
+-
+- entry = &xen_e820_table->entries[last_guest_ram];
+- if (max_addr >= entry->addr + entry->size)
+- goto out; /* No unallocated host RAM. */
+-
+- hostmem_resource->start = max_addr;
+- hostmem_resource->end = entry->addr + entry->size;
+-
+- /*
+- * Mark non-RAM regions between the end of dom0 RAM and end of host RAM
+- * as unavailable. The rest of that region can be used for hotplug-based
+- * ballooning.
+- */
+- for (; i < memmap.nr_entries; i++) {
+- entry = &xen_e820_table->entries[i];
+-
+- if (entry->type == E820_TYPE_RAM)
+- continue;
+-
+- if (entry->addr >= hostmem_resource->end)
+- break;
+-
+- res = kzalloc(sizeof(*res), GFP_KERNEL);
+- if (!res)
+- goto out;
+-
+- res->name = "Unavailable host RAM";
+- res->start = entry->addr;
+- res->end = (entry->addr + entry->size < hostmem_resource->end) ?
+- entry->addr + entry->size : hostmem_resource->end;
+- rc = insert_resource(hostmem_resource, res);
+- if (rc) {
+- pr_warn("%s: Can't insert [%llx - %llx) (%d)\n",
+- __func__, res->start, res->end, rc);
+- kfree(res);
+- goto out;
+- }
+- }
+-
+- out:
+- kfree(xen_e820_table);
+-}
+-#endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index 1163e33121fb..075ed47993bb 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -808,6 +808,7 @@ char * __init xen_memory_setup(void)
+ addr = xen_e820_table.entries[0].addr;
+ size = xen_e820_table.entries[0].size;
+ while (i < xen_e820_table.nr_entries) {
++ bool discard = false;
+
+ chunk_size = size;
+ type = xen_e820_table.entries[i].type;
+@@ -823,10 +824,11 @@ char * __init xen_memory_setup(void)
+ xen_add_extra_mem(pfn_s, n_pfns);
+ xen_max_p2m_pfn = pfn_s + n_pfns;
+ } else
+- type = E820_TYPE_UNUSABLE;
++ discard = true;
+ }
+
+- xen_align_and_add_e820_region(addr, chunk_size, type);
++ if (!discard)
++ xen_align_and_add_e820_region(addr, chunk_size, type);
+
+ addr += chunk_size;
+ size -= chunk_size;
+diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
+index 08f26db2da7e..e938576e58cb 100644
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -700,7 +700,7 @@ static void iort_set_device_domain(struct device *dev,
+ */
+ static struct irq_domain *iort_get_platform_device_domain(struct device *dev)
+ {
+- struct acpi_iort_node *node, *msi_parent;
++ struct acpi_iort_node *node, *msi_parent = NULL;
+ struct fwnode_handle *iort_fwnode;
+ struct acpi_iort_its_group *its;
+ int i;
+diff --git a/drivers/fsi/Kconfig b/drivers/fsi/Kconfig
+index af3a20dd5aa4..99c99a5d57fe 100644
+--- a/drivers/fsi/Kconfig
++++ b/drivers/fsi/Kconfig
+@@ -46,6 +46,7 @@ config FSI_MASTER_AST_CF
+ tristate "FSI master based on Aspeed ColdFire coprocessor"
+ depends on GPIOLIB
+ depends on GPIO_ASPEED
++ select GENERIC_ALLOCATOR
+ ---help---
+ This option enables a FSI master using the AST2400 and AST2500 GPIO
+ lines driven by the internal ColdFire coprocessor. This requires
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index ef00d14f8645..325e2213cac5 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -2243,12 +2243,13 @@ static void gfx_v9_0_rlc_start(struct amdgpu_device *adev)
+ #endif
+
+ WREG32_FIELD15(GC, 0, RLC_CNTL, RLC_ENABLE_F32, 1);
++ udelay(50);
+
+ /* carrizo do enable cp interrupt after cp inited */
+- if (!(adev->flags & AMD_IS_APU))
++ if (!(adev->flags & AMD_IS_APU)) {
+ gfx_v9_0_enable_gui_idle_interrupt(adev, true);
+-
+- udelay(50);
++ udelay(50);
++ }
+
+ #ifdef AMDGPU_RLC_DEBUG_RETRY
+ /* RLC_GPM_GENERAL_6 : RLC Ucode version */
+diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
+index 7c6ac3cadb6b..8bb355d5d43d 100644
+--- a/drivers/gpu/drm/ast/ast_mode.c
++++ b/drivers/gpu/drm/ast/ast_mode.c
+@@ -973,9 +973,21 @@ static int get_clock(void *i2c_priv)
+ {
+ struct ast_i2c_chan *i2c = i2c_priv;
+ struct ast_private *ast = i2c->dev->dev_private;
+- uint32_t val;
++ uint32_t val, val2, count, pass;
++
++ count = 0;
++ pass = 0;
++ val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01;
++ do {
++ val2 = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01;
++ if (val == val2) {
++ pass++;
++ } else {
++ pass = 0;
++ val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4) & 0x01;
++ }
++ } while ((pass < 5) && (count++ < 0x10000));
+
+- val = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x10) >> 4;
+ return val & 1 ? 1 : 0;
+ }
+
+@@ -983,9 +995,21 @@ static int get_data(void *i2c_priv)
+ {
+ struct ast_i2c_chan *i2c = i2c_priv;
+ struct ast_private *ast = i2c->dev->dev_private;
+- uint32_t val;
++ uint32_t val, val2, count, pass;
++
++ count = 0;
++ pass = 0;
++ val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01;
++ do {
++ val2 = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01;
++ if (val == val2) {
++ pass++;
++ } else {
++ pass = 0;
++ val = (ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5) & 0x01;
++ }
++ } while ((pass < 5) && (count++ < 0x10000));
+
+- val = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x20) >> 5;
+ return val & 1 ? 1 : 0;
+ }
+
+@@ -998,7 +1022,7 @@ static void set_clock(void *i2c_priv, int clock)
+
+ for (i = 0; i < 0x10000; i++) {
+ ujcrb7 = ((clock & 0x01) ? 0 : 1);
+- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xfe, ujcrb7);
++ ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xf4, ujcrb7);
+ jtemp = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x01);
+ if (ujcrb7 == jtemp)
+ break;
+@@ -1014,7 +1038,7 @@ static void set_data(void *i2c_priv, int data)
+
+ for (i = 0; i < 0x10000; i++) {
+ ujcrb7 = ((data & 0x01) ? 0 : 1) << 2;
+- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xfb, ujcrb7);
++ ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0xf1, ujcrb7);
+ jtemp = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb7, 0x04);
+ if (ujcrb7 == jtemp)
+ break;
+diff --git a/drivers/gpu/drm/meson/meson_venc.c b/drivers/gpu/drm/meson/meson_venc.c
+index 14aac661f38b..7a3a6ed9f27b 100644
+--- a/drivers/gpu/drm/meson/meson_venc.c
++++ b/drivers/gpu/drm/meson/meson_venc.c
+@@ -715,6 +715,7 @@ struct meson_hdmi_venc_vic_mode {
+ { 5, &meson_hdmi_encp_mode_1080i60 },
+ { 20, &meson_hdmi_encp_mode_1080i50 },
+ { 32, &meson_hdmi_encp_mode_1080p24 },
++ { 33, &meson_hdmi_encp_mode_1080p50 },
+ { 34, &meson_hdmi_encp_mode_1080p30 },
+ { 31, &meson_hdmi_encp_mode_1080p50 },
+ { 16, &meson_hdmi_encp_mode_1080p60 },
+diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
+index 71d3445ba869..07ee19573b3f 100644
+--- a/drivers/hwmon/ina2xx.c
++++ b/drivers/hwmon/ina2xx.c
+@@ -274,7 +274,7 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg,
+ break;
+ case INA2XX_CURRENT:
+ /* signed register, result in mA */
+- val = regval * data->current_lsb_uA;
++ val = (s16)regval * data->current_lsb_uA;
+ val = DIV_ROUND_CLOSEST(val, 1000);
+ break;
+ case INA2XX_CALIBRATION:
+@@ -491,7 +491,7 @@ static int ina2xx_probe(struct i2c_client *client,
+ }
+
+ data->groups[group++] = &ina2xx_group;
+- if (id->driver_data == ina226)
++ if (chip == ina226)
+ data->groups[group++] = &ina226_group;
+
+ hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
+@@ -500,7 +500,7 @@ static int ina2xx_probe(struct i2c_client *client,
+ return PTR_ERR(hwmon_dev);
+
+ dev_info(dev, "power monitor %s (Rshunt = %li uOhm)\n",
+- id->name, data->rshunt);
++ client->name, data->rshunt);
+
+ return 0;
+ }
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index de46577c7d5a..d8fa4bea4bc8 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -51,7 +51,7 @@
+ */
+ #define MLXREG_FAN_GET_RPM(rval, d, s) (DIV_ROUND_CLOSEST(15000000 * 100, \
+ ((rval) + (s)) * (d)))
+-#define MLXREG_FAN_GET_FAULT(val, mask) (!!((val) ^ (mask)))
++#define MLXREG_FAN_GET_FAULT(val, mask) (!((val) ^ (mask)))
+ #define MLXREG_FAN_PWM_DUTY2STATE(duty) (DIV_ROUND_CLOSEST((duty) * \
+ MLXREG_FAN_MAX_STATE, \
+ MLXREG_FAN_MAX_DUTY))
+diff --git a/drivers/hwmon/raspberrypi-hwmon.c b/drivers/hwmon/raspberrypi-hwmon.c
+index be5ba4690895..0d0457245e7d 100644
+--- a/drivers/hwmon/raspberrypi-hwmon.c
++++ b/drivers/hwmon/raspberrypi-hwmon.c
+@@ -115,7 +115,6 @@ static int rpi_hwmon_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct rpi_hwmon_data *data;
+- int ret;
+
+ data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
+ if (!data)
+@@ -124,11 +123,6 @@ static int rpi_hwmon_probe(struct platform_device *pdev)
+ /* Parent driver assure that firmware is correct */
+ data->fw = dev_get_drvdata(dev->parent);
+
+- /* Init throttled */
+- ret = rpi_firmware_property(data->fw, RPI_FIRMWARE_GET_THROTTLED,
+- &data->last_throttled,
+- sizeof(data->last_throttled));
+-
+ data->hwmon_dev = devm_hwmon_device_register_with_info(dev, "rpi_volt",
+ data,
+ &rpi_chip_info,
+diff --git a/drivers/hwmon/w83795.c b/drivers/hwmon/w83795.c
+index 49276bbdac3d..1bb80f992aa8 100644
+--- a/drivers/hwmon/w83795.c
++++ b/drivers/hwmon/w83795.c
+@@ -1691,7 +1691,7 @@ store_sf_setup(struct device *dev, struct device_attribute *attr,
+ * somewhere else in the code
+ */
+ #define SENSOR_ATTR_TEMP(index) { \
+- SENSOR_ATTR_2(temp##index##_type, S_IRUGO | (index < 4 ? S_IWUSR : 0), \
++ SENSOR_ATTR_2(temp##index##_type, S_IRUGO | (index < 5 ? S_IWUSR : 0), \
+ show_temp_mode, store_temp_mode, NOT_USED, index - 1), \
+ SENSOR_ATTR_2(temp##index##_input, S_IRUGO, show_temp, \
+ NULL, TEMP_READ, index - 1), \
+diff --git a/drivers/infiniband/core/roce_gid_mgmt.c b/drivers/infiniband/core/roce_gid_mgmt.c
+index ee366199b169..25d43c8f1c2a 100644
+--- a/drivers/infiniband/core/roce_gid_mgmt.c
++++ b/drivers/infiniband/core/roce_gid_mgmt.c
+@@ -767,8 +767,10 @@ static int netdevice_event(struct notifier_block *this, unsigned long event,
+
+ case NETDEV_CHANGEADDR:
+ cmds[0] = netdev_del_cmd;
+- cmds[1] = add_default_gid_cmd;
+- cmds[2] = add_cmd;
++ if (ndev->reg_state == NETREG_REGISTERED) {
++ cmds[1] = add_default_gid_cmd;
++ cmds[2] = add_cmd;
++ }
+ break;
+
+ case NETDEV_CHANGEUPPER:
+diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
+index 85cd1a3593d6..22bd9784fa2e 100644
+--- a/drivers/infiniband/hw/bnxt_re/main.c
++++ b/drivers/infiniband/hw/bnxt_re/main.c
+@@ -1252,6 +1252,7 @@ static int bnxt_re_ib_reg(struct bnxt_re_dev *rdev)
+ /* Registered a new RoCE device instance to netdev */
+ rc = bnxt_re_register_netdev(rdev);
+ if (rc) {
++ rtnl_unlock();
+ pr_err("Failed to register with netedev: %#x\n", rc);
+ return -EINVAL;
+ }
+@@ -1461,6 +1462,7 @@ static void bnxt_re_task(struct work_struct *work)
+ "Failed to register with IB: %#x", rc);
+ bnxt_re_remove_one(rdev);
+ bnxt_re_dev_unreg(rdev);
++ goto exit;
+ }
+ break;
+ case NETDEV_UP:
+@@ -1484,6 +1486,7 @@ static void bnxt_re_task(struct work_struct *work)
+ }
+ smp_mb__before_atomic();
+ atomic_dec(&rdev->sched_count);
++exit:
+ kfree(re_work);
+ }
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index e1668bcc2d13..902d12d6d88b 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -12485,7 +12485,8 @@ static int init_cntrs(struct hfi1_devdata *dd)
+ }
+
+ /* allocate space for the counter values */
+- dd->cntrs = kcalloc(dd->ndevcntrs, sizeof(u64), GFP_KERNEL);
++ dd->cntrs = kcalloc(dd->ndevcntrs + num_driver_cntrs, sizeof(u64),
++ GFP_KERNEL);
+ if (!dd->cntrs)
+ goto bail;
+
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index d9470317983f..cfd252386356 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -154,6 +154,8 @@ struct hfi1_ib_stats {
+ extern struct hfi1_ib_stats hfi1_stats;
+ extern const struct pci_error_handlers hfi1_pci_err_handler;
+
++extern int num_driver_cntrs;
++
+ /*
+ * First-cut criterion for "device is active" is
+ * two thousand dwords combined Tx, Rx traffic per
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index a7c586a5589d..3dfb4cf2f8c9 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -1701,7 +1701,7 @@ static const char * const driver_cntr_names[] = {
+ static DEFINE_MUTEX(cntr_names_lock); /* protects the *_cntr_names bufers */
+ static const char **dev_cntr_names;
+ static const char **port_cntr_names;
+-static int num_driver_cntrs = ARRAY_SIZE(driver_cntr_names);
++int num_driver_cntrs = ARRAY_SIZE(driver_cntr_names);
+ static int num_dev_cntrs;
+ static int num_port_cntrs;
+ static int cntr_names_initialized;
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 0218c0f8c2a7..a442b29e7611 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -1661,10 +1661,9 @@ static int hns_roce_v2_set_mac(struct hns_roce_dev *hr_dev, u8 phy_port,
+ return hns_roce_cmq_send(hr_dev, &desc, 1);
+ }
+
+-static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
+- unsigned long mtpt_idx)
++static int set_mtpt_pbl(struct hns_roce_v2_mpt_entry *mpt_entry,
++ struct hns_roce_mr *mr)
+ {
+- struct hns_roce_v2_mpt_entry *mpt_entry;
+ struct scatterlist *sg;
+ u64 page_addr;
+ u64 *pages;
+@@ -1672,6 +1671,53 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
+ int len;
+ int entry;
+
++ mpt_entry->pbl_size = cpu_to_le32(mr->pbl_size);
++ mpt_entry->pbl_ba_l = cpu_to_le32(lower_32_bits(mr->pbl_ba >> 3));
++ roce_set_field(mpt_entry->byte_48_mode_ba,
++ V2_MPT_BYTE_48_PBL_BA_H_M, V2_MPT_BYTE_48_PBL_BA_H_S,
++ upper_32_bits(mr->pbl_ba >> 3));
++
++ pages = (u64 *)__get_free_page(GFP_KERNEL);
++ if (!pages)
++ return -ENOMEM;
++
++ i = 0;
++ for_each_sg(mr->umem->sg_head.sgl, sg, mr->umem->nmap, entry) {
++ len = sg_dma_len(sg) >> PAGE_SHIFT;
++ for (j = 0; j < len; ++j) {
++ page_addr = sg_dma_address(sg) +
++ (j << mr->umem->page_shift);
++ pages[i] = page_addr >> 6;
++ /* Record the first 2 entry directly to MTPT table */
++ if (i >= HNS_ROCE_V2_MAX_INNER_MTPT_NUM - 1)
++ goto found;
++ i++;
++ }
++ }
++found:
++ mpt_entry->pa0_l = cpu_to_le32(lower_32_bits(pages[0]));
++ roce_set_field(mpt_entry->byte_56_pa0_h, V2_MPT_BYTE_56_PA0_H_M,
++ V2_MPT_BYTE_56_PA0_H_S, upper_32_bits(pages[0]));
++
++ mpt_entry->pa1_l = cpu_to_le32(lower_32_bits(pages[1]));
++ roce_set_field(mpt_entry->byte_64_buf_pa1, V2_MPT_BYTE_64_PA1_H_M,
++ V2_MPT_BYTE_64_PA1_H_S, upper_32_bits(pages[1]));
++ roce_set_field(mpt_entry->byte_64_buf_pa1,
++ V2_MPT_BYTE_64_PBL_BUF_PG_SZ_M,
++ V2_MPT_BYTE_64_PBL_BUF_PG_SZ_S,
++ mr->pbl_buf_pg_sz + PG_SHIFT_OFFSET);
++
++ free_page((unsigned long)pages);
++
++ return 0;
++}
++
++static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
++ unsigned long mtpt_idx)
++{
++ struct hns_roce_v2_mpt_entry *mpt_entry;
++ int ret;
++
+ mpt_entry = mb_buf;
+ memset(mpt_entry, 0, sizeof(*mpt_entry));
+
+@@ -1686,7 +1732,6 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
+ mr->pbl_ba_pg_sz + PG_SHIFT_OFFSET);
+ roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_PD_M,
+ V2_MPT_BYTE_4_PD_S, mr->pd);
+- mpt_entry->byte_4_pd_hop_st = cpu_to_le32(mpt_entry->byte_4_pd_hop_st);
+
+ roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_RA_EN_S, 0);
+ roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_R_INV_EN_S, 1);
+@@ -1700,13 +1745,11 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
+ (mr->access & IB_ACCESS_REMOTE_WRITE ? 1 : 0));
+ roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_LW_EN_S,
+ (mr->access & IB_ACCESS_LOCAL_WRITE ? 1 : 0));
+- mpt_entry->byte_8_mw_cnt_en = cpu_to_le32(mpt_entry->byte_8_mw_cnt_en);
+
+ roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_PA_S,
+ mr->type == MR_TYPE_MR ? 0 : 1);
+ roce_set_bit(mpt_entry->byte_12_mw_pa, V2_MPT_BYTE_12_INNER_PA_VLD_S,
+ 1);
+- mpt_entry->byte_12_mw_pa = cpu_to_le32(mpt_entry->byte_12_mw_pa);
+
+ mpt_entry->len_l = cpu_to_le32(lower_32_bits(mr->size));
+ mpt_entry->len_h = cpu_to_le32(upper_32_bits(mr->size));
+@@ -1717,53 +1760,9 @@ static int hns_roce_v2_write_mtpt(void *mb_buf, struct hns_roce_mr *mr,
+ if (mr->type == MR_TYPE_DMA)
+ return 0;
+
+- mpt_entry->pbl_size = cpu_to_le32(mr->pbl_size);
+-
+- mpt_entry->pbl_ba_l = cpu_to_le32(lower_32_bits(mr->pbl_ba >> 3));
+- roce_set_field(mpt_entry->byte_48_mode_ba, V2_MPT_BYTE_48_PBL_BA_H_M,
+- V2_MPT_BYTE_48_PBL_BA_H_S,
+- upper_32_bits(mr->pbl_ba >> 3));
+- mpt_entry->byte_48_mode_ba = cpu_to_le32(mpt_entry->byte_48_mode_ba);
+-
+- pages = (u64 *)__get_free_page(GFP_KERNEL);
+- if (!pages)
+- return -ENOMEM;
+-
+- i = 0;
+- for_each_sg(mr->umem->sg_head.sgl, sg, mr->umem->nmap, entry) {
+- len = sg_dma_len(sg) >> PAGE_SHIFT;
+- for (j = 0; j < len; ++j) {
+- page_addr = sg_dma_address(sg) +
+- (j << mr->umem->page_shift);
+- pages[i] = page_addr >> 6;
+-
+- /* Record the first 2 entry directly to MTPT table */
+- if (i >= HNS_ROCE_V2_MAX_INNER_MTPT_NUM - 1)
+- goto found;
+- i++;
+- }
+- }
++ ret = set_mtpt_pbl(mpt_entry, mr);
+
+-found:
+- mpt_entry->pa0_l = cpu_to_le32(lower_32_bits(pages[0]));
+- roce_set_field(mpt_entry->byte_56_pa0_h, V2_MPT_BYTE_56_PA0_H_M,
+- V2_MPT_BYTE_56_PA0_H_S,
+- upper_32_bits(pages[0]));
+- mpt_entry->byte_56_pa0_h = cpu_to_le32(mpt_entry->byte_56_pa0_h);
+-
+- mpt_entry->pa1_l = cpu_to_le32(lower_32_bits(pages[1]));
+- roce_set_field(mpt_entry->byte_64_buf_pa1, V2_MPT_BYTE_64_PA1_H_M,
+- V2_MPT_BYTE_64_PA1_H_S, upper_32_bits(pages[1]));
+-
+- free_page((unsigned long)pages);
+-
+- roce_set_field(mpt_entry->byte_64_buf_pa1,
+- V2_MPT_BYTE_64_PBL_BUF_PG_SZ_M,
+- V2_MPT_BYTE_64_PBL_BUF_PG_SZ_S,
+- mr->pbl_buf_pg_sz + PG_SHIFT_OFFSET);
+- mpt_entry->byte_64_buf_pa1 = cpu_to_le32(mpt_entry->byte_64_buf_pa1);
+-
+- return 0;
++ return ret;
+ }
+
+ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
+@@ -1772,6 +1771,7 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
+ u64 size, void *mb_buf)
+ {
+ struct hns_roce_v2_mpt_entry *mpt_entry = mb_buf;
++ int ret = 0;
+
+ if (flags & IB_MR_REREG_PD) {
+ roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_PD_M,
+@@ -1784,14 +1784,14 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
+ V2_MPT_BYTE_8_BIND_EN_S,
+ (mr_access_flags & IB_ACCESS_MW_BIND ? 1 : 0));
+ roce_set_bit(mpt_entry->byte_8_mw_cnt_en,
+- V2_MPT_BYTE_8_ATOMIC_EN_S,
+- (mr_access_flags & IB_ACCESS_REMOTE_ATOMIC ? 1 : 0));
++ V2_MPT_BYTE_8_ATOMIC_EN_S,
++ mr_access_flags & IB_ACCESS_REMOTE_ATOMIC ? 1 : 0);
+ roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_RR_EN_S,
+- (mr_access_flags & IB_ACCESS_REMOTE_READ ? 1 : 0));
++ mr_access_flags & IB_ACCESS_REMOTE_READ ? 1 : 0);
+ roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_RW_EN_S,
+- (mr_access_flags & IB_ACCESS_REMOTE_WRITE ? 1 : 0));
++ mr_access_flags & IB_ACCESS_REMOTE_WRITE ? 1 : 0);
+ roce_set_bit(mpt_entry->byte_8_mw_cnt_en, V2_MPT_BYTE_8_LW_EN_S,
+- (mr_access_flags & IB_ACCESS_LOCAL_WRITE ? 1 : 0));
++ mr_access_flags & IB_ACCESS_LOCAL_WRITE ? 1 : 0);
+ }
+
+ if (flags & IB_MR_REREG_TRANS) {
+@@ -1800,21 +1800,13 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
+ mpt_entry->len_l = cpu_to_le32(lower_32_bits(size));
+ mpt_entry->len_h = cpu_to_le32(upper_32_bits(size));
+
+- mpt_entry->pbl_size = cpu_to_le32(mr->pbl_size);
+- mpt_entry->pbl_ba_l =
+- cpu_to_le32(lower_32_bits(mr->pbl_ba >> 3));
+- roce_set_field(mpt_entry->byte_48_mode_ba,
+- V2_MPT_BYTE_48_PBL_BA_H_M,
+- V2_MPT_BYTE_48_PBL_BA_H_S,
+- upper_32_bits(mr->pbl_ba >> 3));
+- mpt_entry->byte_48_mode_ba =
+- cpu_to_le32(mpt_entry->byte_48_mode_ba);
+-
+ mr->iova = iova;
+ mr->size = size;
++
++ ret = set_mtpt_pbl(mpt_entry, mr);
+ }
+
+- return 0;
++ return ret;
+ }
+
+ static void *get_cqe_v2(struct hns_roce_cq *hr_cq, int n)
+diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
+index d216e0d2921d..9e1cac8cb260 100644
+--- a/drivers/infiniband/hw/mlx5/odp.c
++++ b/drivers/infiniband/hw/mlx5/odp.c
+@@ -724,6 +724,7 @@ next_mr:
+ head = frame;
+
+ bcnt -= frame->bcnt;
++ offset = 0;
+ }
+ break;
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index d53d954ac8af..183fe5c8ceb7 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -4413,17 +4413,18 @@ static int _mlx5_ib_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ goto out;
+ }
+
+- if (wr->opcode == IB_WR_LOCAL_INV ||
+- wr->opcode == IB_WR_REG_MR) {
++ if (wr->opcode == IB_WR_REG_MR) {
+ fence = dev->umr_fence;
+ next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
+- } else if (wr->send_flags & IB_SEND_FENCE) {
+- if (qp->next_fence)
+- fence = MLX5_FENCE_MODE_SMALL_AND_FENCE;
+- else
+- fence = MLX5_FENCE_MODE_FENCE;
+- } else {
+- fence = qp->next_fence;
++ } else {
++ if (wr->send_flags & IB_SEND_FENCE) {
++ if (qp->next_fence)
++ fence = MLX5_FENCE_MODE_SMALL_AND_FENCE;
++ else
++ fence = MLX5_FENCE_MODE_FENCE;
++ } else {
++ fence = qp->next_fence;
++ }
+ }
+
+ switch (ibqp->qp_type) {
+diff --git a/drivers/infiniband/sw/rdmavt/ah.c b/drivers/infiniband/sw/rdmavt/ah.c
+index 89ec0f64abfc..084bb4baebb5 100644
+--- a/drivers/infiniband/sw/rdmavt/ah.c
++++ b/drivers/infiniband/sw/rdmavt/ah.c
+@@ -91,13 +91,15 @@ EXPORT_SYMBOL(rvt_check_ah);
+ * rvt_create_ah - create an address handle
+ * @pd: the protection domain
+ * @ah_attr: the attributes of the AH
++ * @udata: pointer to user's input output buffer information.
+ *
+ * This may be called from interrupt context.
+ *
+ * Return: newly allocated ah
+ */
+ struct ib_ah *rvt_create_ah(struct ib_pd *pd,
+- struct rdma_ah_attr *ah_attr)
++ struct rdma_ah_attr *ah_attr,
++ struct ib_udata *udata)
+ {
+ struct rvt_ah *ah;
+ struct rvt_dev_info *dev = ib_to_rvt(pd->device);
+diff --git a/drivers/infiniband/sw/rdmavt/ah.h b/drivers/infiniband/sw/rdmavt/ah.h
+index 16105af99189..25271b48a683 100644
+--- a/drivers/infiniband/sw/rdmavt/ah.h
++++ b/drivers/infiniband/sw/rdmavt/ah.h
+@@ -51,7 +51,8 @@
+ #include <rdma/rdma_vt.h>
+
+ struct ib_ah *rvt_create_ah(struct ib_pd *pd,
+- struct rdma_ah_attr *ah_attr);
++ struct rdma_ah_attr *ah_attr,
++ struct ib_udata *udata);
+ int rvt_destroy_ah(struct ib_ah *ibah);
+ int rvt_modify_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr);
+ int rvt_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr);
+diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
+index 55af04fa03a7..6c8dcb65ff03 100644
+--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
+@@ -1441,6 +1441,9 @@ static void nic_remove(struct pci_dev *pdev)
+ {
+ struct nicpf *nic = pci_get_drvdata(pdev);
+
++ if (!nic)
++ return;
++
+ if (nic->flags & NIC_SRIOV_ENABLED)
+ pci_disable_sriov(pdev);
+
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index 14374a856d30..6127697ede12 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -914,10 +914,8 @@ static int hip04_mac_probe(struct platform_device *pdev)
+ }
+
+ ret = register_netdev(ndev);
+- if (ret) {
+- free_netdev(ndev);
++ if (ret)
+ goto alloc_fail;
+- }
+
+ return 0;
+
+diff --git a/drivers/net/ethernet/ibm/emac/emac.h b/drivers/net/ethernet/ibm/emac/emac.h
+index e2f80cca9bed..0d2de6f67676 100644
+--- a/drivers/net/ethernet/ibm/emac/emac.h
++++ b/drivers/net/ethernet/ibm/emac/emac.h
+@@ -231,7 +231,7 @@ struct emac_regs {
+ #define EMAC_STACR_PHYE 0x00004000
+ #define EMAC_STACR_STAC_MASK 0x00003000
+ #define EMAC_STACR_STAC_READ 0x00001000
+-#define EMAC_STACR_STAC_WRITE 0x00000800
++#define EMAC_STACR_STAC_WRITE 0x00002000
+ #define EMAC_STACR_OPBC_MASK 0x00000C00
+ #define EMAC_STACR_OPBC_50 0x00000000
+ #define EMAC_STACR_OPBC_66 0x00000400
+diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.c b/drivers/net/ethernet/intel/igb/e1000_i210.c
+index c54ebedca6da..c393cb2c0f16 100644
+--- a/drivers/net/ethernet/intel/igb/e1000_i210.c
++++ b/drivers/net/ethernet/intel/igb/e1000_i210.c
+@@ -842,6 +842,7 @@ s32 igb_pll_workaround_i210(struct e1000_hw *hw)
+ nvm_word = E1000_INVM_DEFAULT_AL;
+ tmp_nvm = nvm_word | E1000_INVM_PLL_WO_VAL;
+ igb_write_phy_reg_82580(hw, I347AT4_PAGE_SELECT, E1000_PHY_PLL_FREQ_PAGE);
++ phy_word = E1000_PHY_PLL_UNCONF;
+ for (i = 0; i < E1000_MAX_PLL_TRIES; i++) {
+ /* check current state directly from internal PHY */
+ igb_read_phy_reg_82580(hw, E1000_PHY_PLL_FREQ_REG, &phy_word);
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+index a8148c7126e5..9772016222c3 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+@@ -2248,7 +2248,9 @@ static s32 ixgbe_get_link_capabilities_X550em(struct ixgbe_hw *hw,
+ *autoneg = false;
+
+ if (hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core0 ||
+- hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core1) {
++ hw->phy.sfp_type == ixgbe_sfp_type_1g_sx_core1 ||
++ hw->phy.sfp_type == ixgbe_sfp_type_1g_lx_core0 ||
++ hw->phy.sfp_type == ixgbe_sfp_type_1g_lx_core1) {
+ *speed = IXGBE_LINK_SPEED_1GB_FULL;
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+index f11b45001cad..d290f0787dfb 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -1084,8 +1084,8 @@ static int mlx4_en_set_pauseparam(struct net_device *dev,
+
+ tx_pause = !!(pause->tx_pause);
+ rx_pause = !!(pause->rx_pause);
+- rx_ppp = priv->prof->rx_ppp && !(tx_pause || rx_pause);
+- tx_ppp = priv->prof->tx_ppp && !(tx_pause || rx_pause);
++ rx_ppp = (tx_pause || rx_pause) ? 0 : priv->prof->rx_ppp;
++ tx_ppp = (tx_pause || rx_pause) ? 0 : priv->prof->tx_ppp;
+
+ err = mlx4_SET_PORT_general(mdev->dev, priv->port,
+ priv->rx_skb_size + ETH_FCS_LEN,
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index fe49384eba48..0d7fd3f043cf 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -3494,8 +3494,8 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ dev->gso_partial_features = NETIF_F_GSO_UDP_TUNNEL_CSUM;
+ }
+
+- /* MTU range: 46 - hw-specific max */
+- dev->min_mtu = MLX4_EN_MIN_MTU;
++ /* MTU range: 68 - hw-specific max */
++ dev->min_mtu = ETH_MIN_MTU;
+ dev->max_mtu = priv->max_mtu;
+
+ mdev->pndev[port] = dev;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index c3228b89df46..240f9c9ca943 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -161,7 +161,6 @@
+ #define MLX4_SELFTEST_LB_MIN_MTU (MLX4_LOOPBACK_TEST_PAYLOAD + NET_IP_ALIGN + \
+ ETH_HLEN + PREAMBLE_LEN)
+
+-#define MLX4_EN_MIN_MTU 46
+ /* VLAN_HLEN is added twice,to support skb vlan tagged with multiple
+ * headers. (For example: ETH_P_8021Q and ETH_P_8021AD).
+ */
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index 81045dfa1cd8..44f6e4873aad 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -571,6 +571,7 @@ static irqreturn_t cp_interrupt (int irq, void *dev_instance)
+ struct cp_private *cp;
+ int handled = 0;
+ u16 status;
++ u16 mask;
+
+ if (unlikely(dev == NULL))
+ return IRQ_NONE;
+@@ -578,6 +579,10 @@ static irqreturn_t cp_interrupt (int irq, void *dev_instance)
+
+ spin_lock(&cp->lock);
+
++ mask = cpr16(IntrMask);
++ if (!mask)
++ goto out_unlock;
++
+ status = cpr16(IntrStatus);
+ if (!status || (status == 0xFFFF))
+ goto out_unlock;
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 733e35b7c4bb..20d1be2b070b 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1738,20 +1738,17 @@ EXPORT_SYMBOL(genphy_loopback);
+
+ static int __set_phy_supported(struct phy_device *phydev, u32 max_speed)
+ {
+- phydev->supported &= ~(PHY_1000BT_FEATURES | PHY_100BT_FEATURES |
+- PHY_10BT_FEATURES);
+-
+ switch (max_speed) {
+- default:
+- return -ENOTSUPP;
+- case SPEED_1000:
+- phydev->supported |= PHY_1000BT_FEATURES;
++ case SPEED_10:
++ phydev->supported &= ~PHY_100BT_FEATURES;
+ /* fall through */
+ case SPEED_100:
+- phydev->supported |= PHY_100BT_FEATURES;
+- /* fall through */
+- case SPEED_10:
+- phydev->supported |= PHY_10BT_FEATURES;
++ phydev->supported &= ~PHY_1000BT_FEATURES;
++ break;
++ case SPEED_1000:
++ break;
++ default:
++ return -ENOTSUPP;
+ }
+
+ return 0;
+diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
+index 83060fb349f4..ad9db652874d 100644
+--- a/drivers/net/phy/sfp-bus.c
++++ b/drivers/net/phy/sfp-bus.c
+@@ -162,7 +162,7 @@ void sfp_parse_support(struct sfp_bus *bus, const struct sfp_eeprom_id *id,
+ /* 1000Base-PX or 1000Base-BX10 */
+ if ((id->base.e_base_px || id->base.e_base_bx10) &&
+ br_min <= 1300 && br_max >= 1200)
+- phylink_set(support, 1000baseX_Full);
++ phylink_set(modes, 1000baseX_Full);
+
+ /* For active or passive cables, select the link modes
+ * based on the bit rates and the cable compliance bytes.
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 573620771154..8c1abcba4cbd 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -2268,9 +2268,9 @@ static void tun_setup(struct net_device *dev)
+ static int tun_validate(struct nlattr *tb[], struct nlattr *data[],
+ struct netlink_ext_ack *extack)
+ {
+- if (!data)
+- return 0;
+- return -EINVAL;
++ NL_SET_ERR_MSG(extack,
++ "tun/tap creation via rtnetlink is not supported.");
++ return -EOPNOTSUPP;
+ }
+
+ static size_t tun_get_size(const struct net_device *dev)
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index c2ca6cd3fbe0..ad14fbfa1864 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -365,7 +365,8 @@ static unsigned int mergeable_ctx_to_truesize(void *mrg_ctx)
+ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
+ struct receive_queue *rq,
+ struct page *page, unsigned int offset,
+- unsigned int len, unsigned int truesize)
++ unsigned int len, unsigned int truesize,
++ bool hdr_valid)
+ {
+ struct sk_buff *skb;
+ struct virtio_net_hdr_mrg_rxbuf *hdr;
+@@ -387,7 +388,8 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
+ else
+ hdr_padded_len = sizeof(struct padded_vnet_hdr);
+
+- memcpy(hdr, p, hdr_len);
++ if (hdr_valid)
++ memcpy(hdr, p, hdr_len);
+
+ len -= hdr_len;
+ offset += hdr_padded_len;
+@@ -739,7 +741,8 @@ static struct sk_buff *receive_big(struct net_device *dev,
+ struct virtnet_rq_stats *stats)
+ {
+ struct page *page = buf;
+- struct sk_buff *skb = page_to_skb(vi, rq, page, 0, len, PAGE_SIZE);
++ struct sk_buff *skb = page_to_skb(vi, rq, page, 0, len,
++ PAGE_SIZE, true);
+
+ stats->bytes += len - vi->hdr_len;
+ if (unlikely(!skb))
+@@ -842,7 +845,8 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
+ rcu_read_unlock();
+ put_page(page);
+ head_skb = page_to_skb(vi, rq, xdp_page,
+- offset, len, PAGE_SIZE);
++ offset, len,
++ PAGE_SIZE, false);
+ return head_skb;
+ }
+ break;
+@@ -898,7 +902,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
+ goto err_skb;
+ }
+
+- head_skb = page_to_skb(vi, rq, page, offset, len, truesize);
++ head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog);
+ curr_skb = head_skb;
+
+ if (unlikely(!curr_skb))
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 0ba301f7e8b4..b7b2659e02fa 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3308,6 +3308,9 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
+ struct nvme_ns *ns, *next;
+ LIST_HEAD(ns_list);
+
++ /* prevent racing with ns scanning */
++ flush_work(&ctrl->scan_work);
++
+ /*
+ * The dead states indicates the controller was not gracefully
+ * disconnected. In that case, we won't be able to flush any data while
+@@ -3463,7 +3466,6 @@ void nvme_stop_ctrl(struct nvme_ctrl *ctrl)
+ nvme_mpath_stop(ctrl);
+ nvme_stop_keep_alive(ctrl);
+ flush_work(&ctrl->async_event_work);
+- flush_work(&ctrl->scan_work);
+ cancel_work_sync(&ctrl->fw_act_work);
+ if (ctrl->ops->stop_ctrl)
+ ctrl->ops->stop_ctrl(ctrl);
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index bb4a2003c097..60220de2db52 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -537,6 +537,9 @@ static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
+ static inline int nvme_mpath_init(struct nvme_ctrl *ctrl,
+ struct nvme_id_ctrl *id)
+ {
++ if (ctrl->subsys->cmic & (1 << 3))
++ dev_warn(ctrl->device,
++"Please enable CONFIG_NVME_MULTIPATH for full support of multi-port devices.\n");
+ return 0;
+ }
+ static inline void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index dc042017c293..b6a28de682e8 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -184,6 +184,7 @@ static int nvme_rdma_alloc_qe(struct ib_device *ibdev, struct nvme_rdma_qe *qe,
+ qe->dma = ib_dma_map_single(ibdev, qe->data, capsule_size, dir);
+ if (ib_dma_mapping_error(ibdev, qe->dma)) {
+ kfree(qe->data);
++ qe->data = NULL;
+ return -ENOMEM;
+ }
+
+@@ -816,6 +817,7 @@ out_free_tagset:
+ out_free_async_qe:
+ nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
+ sizeof(struct nvme_command), DMA_TO_DEVICE);
++ ctrl->async_event_sqe.data = NULL;
+ out_free_queue:
+ nvme_rdma_free_queue(&ctrl->queues[0]);
+ return error;
+diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
+index 4a9a673b4777..975050a69494 100644
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -80,8 +80,6 @@ struct imx6_pcie {
+ #define PCIE_PL_PFLR_FORCE_LINK (1 << 15)
+ #define PCIE_PHY_DEBUG_R0 (PL_OFFSET + 0x28)
+ #define PCIE_PHY_DEBUG_R1 (PL_OFFSET + 0x2c)
+-#define PCIE_PHY_DEBUG_R1_XMLH_LINK_IN_TRAINING (1 << 29)
+-#define PCIE_PHY_DEBUG_R1_XMLH_LINK_UP (1 << 4)
+
+ #define PCIE_PHY_CTRL (PL_OFFSET + 0x114)
+ #define PCIE_PHY_CTRL_DATA_LOC 0
+@@ -641,12 +639,6 @@ static int imx6_pcie_host_init(struct pcie_port *pp)
+ return 0;
+ }
+
+-static int imx6_pcie_link_up(struct dw_pcie *pci)
+-{
+- return dw_pcie_readl_dbi(pci, PCIE_PHY_DEBUG_R1) &
+- PCIE_PHY_DEBUG_R1_XMLH_LINK_UP;
+-}
+-
+ static const struct dw_pcie_host_ops imx6_pcie_host_ops = {
+ .host_init = imx6_pcie_host_init,
+ };
+@@ -679,7 +671,7 @@ static int imx6_add_pcie_port(struct imx6_pcie *imx6_pcie,
+ }
+
+ static const struct dw_pcie_ops dw_pcie_ops = {
+- .link_up = imx6_pcie_link_up,
++ /* No special ops needed, but pcie-designware still expects this struct */
+ };
+
+ static int imx6_pcie_probe(struct platform_device *pdev)
+diff --git a/drivers/phy/qualcomm/phy-qcom-qusb2.c b/drivers/phy/qualcomm/phy-qcom-qusb2.c
+index e70e425f26f5..69c92843eb3b 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qusb2.c
++++ b/drivers/phy/qualcomm/phy-qcom-qusb2.c
+@@ -231,6 +231,7 @@ static const struct qusb2_phy_cfg sdm845_phy_cfg = {
+ .mask_core_ready = CORE_READY_STATUS,
+ .has_pll_override = true,
+ .autoresume_en = BIT(0),
++ .update_tune1_with_efuse = true,
+ };
+
+ static const char * const qusb2_phy_vreg_names[] = {
+@@ -402,10 +403,10 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
+
+ /*
+ * Read efuse register having TUNE2/1 parameter's high nibble.
+- * If efuse register shows value as 0x0, or if we fail to find
+- * a valid efuse register settings, then use default value
+- * as 0xB for high nibble that we have already set while
+- * configuring phy.
++ * If efuse register shows value as 0x0 (indicating value is not
++ * fused), or if we fail to find a valid efuse register setting,
++ * then use default value for high nibble that we have already
++ * set while configuring the phy.
+ */
+ val = nvmem_cell_read(qphy->cell, NULL);
+ if (IS_ERR(val) || !val[0]) {
+@@ -415,12 +416,13 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
+
+ /* Fused TUNE1/2 value is the higher nibble only */
+ if (cfg->update_tune1_with_efuse)
+- qusb2_setbits(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE1],
+- val[0] << 0x4);
++ qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE1],
++ val[0] << HSTX_TRIM_SHIFT,
++ HSTX_TRIM_MASK);
+ else
+- qusb2_setbits(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE2],
+- val[0] << 0x4);
+-
++ qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE2],
++ val[0] << HSTX_TRIM_SHIFT,
++ HSTX_TRIM_MASK);
+ }
+
+ static int qusb2_phy_set_mode(struct phy *phy, enum phy_mode mode)
+diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
+index fd77e46eb3b2..70a006ba4d05 100644
+--- a/drivers/s390/cio/vfio_ccw_cp.c
++++ b/drivers/s390/cio/vfio_ccw_cp.c
+@@ -387,8 +387,10 @@ static int ccwchain_calc_length(u64 iova, struct channel_program *cp)
+ * orb specified one of the unsupported formats, we defer
+ * checking for IDAWs in unsupported formats to here.
+ */
+- if ((!cp->orb.cmd.c64 || cp->orb.cmd.i2k) && ccw_is_idal(ccw))
++ if ((!cp->orb.cmd.c64 || cp->orb.cmd.i2k) && ccw_is_idal(ccw)) {
++ kfree(p);
+ return -EOPNOTSUPP;
++ }
+
+ if ((!ccw_is_chain(ccw)) && (!ccw_is_tic(ccw)))
+ break;
+@@ -528,7 +530,7 @@ static int ccwchain_fetch_direct(struct ccwchain *chain,
+
+ ret = pfn_array_alloc_pin(pat->pat_pa, cp->mdev, ccw->cda, ccw->count);
+ if (ret < 0)
+- goto out_init;
++ goto out_unpin;
+
+ /* Translate this direct ccw to a idal ccw. */
+ idaws = kcalloc(ret, sizeof(*idaws), GFP_DMA | GFP_KERNEL);
+diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
+index 508c61c669e7..e2be7da74343 100644
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -1455,13 +1455,26 @@ static int omap2_mcspi_remove(struct platform_device *pdev)
+ /* work with hotplug and coldplug */
+ MODULE_ALIAS("platform:omap2_mcspi");
+
+-#ifdef CONFIG_SUSPEND
+-static int omap2_mcspi_suspend_noirq(struct device *dev)
++static int __maybe_unused omap2_mcspi_suspend(struct device *dev)
+ {
+- return pinctrl_pm_select_sleep_state(dev);
++ struct spi_master *master = dev_get_drvdata(dev);
++ struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
++ int error;
++
++ error = pinctrl_pm_select_sleep_state(dev);
++ if (error)
++ dev_warn(mcspi->dev, "%s: failed to set pins: %i\n",
++ __func__, error);
++
++ error = spi_master_suspend(master);
++ if (error)
++ dev_warn(mcspi->dev, "%s: master suspend failed: %i\n",
++ __func__, error);
++
++ return pm_runtime_force_suspend(dev);
+ }
+
+-static int omap2_mcspi_resume_noirq(struct device *dev)
++static int __maybe_unused omap2_mcspi_resume(struct device *dev)
+ {
+ struct spi_master *master = dev_get_drvdata(dev);
+ struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
+@@ -1472,17 +1485,17 @@ static int omap2_mcspi_resume_noirq(struct device *dev)
+ dev_warn(mcspi->dev, "%s: failed to set pins: %i\n",
+ __func__, error);
+
+- return 0;
+-}
++ error = spi_master_resume(master);
++ if (error)
++ dev_warn(mcspi->dev, "%s: master resume failed: %i\n",
++ __func__, error);
+
+-#else
+-#define omap2_mcspi_suspend_noirq NULL
+-#define omap2_mcspi_resume_noirq NULL
+-#endif
++ return pm_runtime_force_resume(dev);
++}
+
+ static const struct dev_pm_ops omap2_mcspi_pm_ops = {
+- .suspend_noirq = omap2_mcspi_suspend_noirq,
+- .resume_noirq = omap2_mcspi_resume_noirq,
++ SET_SYSTEM_SLEEP_PM_OPS(omap2_mcspi_suspend,
++ omap2_mcspi_resume)
+ .runtime_resume = omap_mcspi_runtime_resume,
+ };
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+index c38298d960ff..4f120e72c7d2 100644
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+@@ -2289,7 +2289,7 @@ static int rtw_wx_read32(struct net_device *dev,
+ exit:
+ kfree(ptmp);
+
+- return 0;
++ return ret;
+ }
+
+ static int rtw_wx_write32(struct net_device *dev,
+diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
+index 7442bc4c6433..dd9ae6f5d19c 100644
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -864,6 +864,30 @@ static ssize_t key_store(struct device *dev, struct device_attribute *attr,
+ }
+ static DEVICE_ATTR(key, 0600, key_show, key_store);
+
++static void nvm_authenticate_start(struct tb_switch *sw)
++{
++ struct pci_dev *root_port;
++
++ /*
++ * During host router NVM upgrade we should not allow root port to
++ * go into D3cold because some root ports cannot trigger PME
++ * itself. To be on the safe side keep the root port in D0 during
++ * the whole upgrade process.
++ */
++ root_port = pci_find_pcie_root_port(sw->tb->nhi->pdev);
++ if (root_port)
++ pm_runtime_get_noresume(&root_port->dev);
++}
++
++static void nvm_authenticate_complete(struct tb_switch *sw)
++{
++ struct pci_dev *root_port;
++
++ root_port = pci_find_pcie_root_port(sw->tb->nhi->pdev);
++ if (root_port)
++ pm_runtime_put(&root_port->dev);
++}
++
+ static ssize_t nvm_authenticate_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+@@ -913,10 +937,18 @@ static ssize_t nvm_authenticate_store(struct device *dev,
+
+ sw->nvm->authenticating = true;
+
+- if (!tb_route(sw))
++ if (!tb_route(sw)) {
++ /*
++ * Keep root port from suspending as long as the
++ * NVM upgrade process is running.
++ */
++ nvm_authenticate_start(sw);
+ ret = nvm_authenticate_host(sw);
+- else
++ if (ret)
++ nvm_authenticate_complete(sw);
++ } else {
+ ret = nvm_authenticate_device(sw);
++ }
+ pm_runtime_mark_last_busy(&sw->dev);
+ pm_runtime_put_autosuspend(&sw->dev);
+ }
+@@ -1336,6 +1368,10 @@ static int tb_switch_add_dma_port(struct tb_switch *sw)
+ if (ret <= 0)
+ return ret;
+
++ /* Now we can allow root port to suspend again */
++ if (!tb_route(sw))
++ nvm_authenticate_complete(sw);
++
+ if (status) {
+ tb_sw_info(sw, "switch flash authentication failed\n");
+ tb_switch_set_uuid(sw);
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 1000d864929c..0f026d445e31 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -401,12 +401,12 @@ done:
+ static void rx_fill(struct eth_dev *dev, gfp_t gfp_flags)
+ {
+ struct usb_request *req;
+- struct usb_request *tmp;
+ unsigned long flags;
+
+ /* fill unused rxq slots with some skb */
+ spin_lock_irqsave(&dev->req_lock, flags);
+- list_for_each_entry_safe(req, tmp, &dev->rx_reqs, list) {
++ while (!list_empty(&dev->rx_reqs)) {
++ req = list_first_entry(&dev->rx_reqs, struct usb_request, list);
+ list_del_init(&req->list);
+ spin_unlock_irqrestore(&dev->req_lock, flags);
+
+@@ -1125,7 +1125,6 @@ void gether_disconnect(struct gether *link)
+ {
+ struct eth_dev *dev = link->ioport;
+ struct usb_request *req;
+- struct usb_request *tmp;
+
+ WARN_ON(!dev);
+ if (!dev)
+@@ -1142,7 +1141,8 @@ void gether_disconnect(struct gether *link)
+ */
+ usb_ep_disable(link->in_ep);
+ spin_lock(&dev->req_lock);
+- list_for_each_entry_safe(req, tmp, &dev->tx_reqs, list) {
++ while (!list_empty(&dev->tx_reqs)) {
++ req = list_first_entry(&dev->tx_reqs, struct usb_request, list);
+ list_del(&req->list);
+
+ spin_unlock(&dev->req_lock);
+@@ -1154,7 +1154,8 @@ void gether_disconnect(struct gether *link)
+
+ usb_ep_disable(link->out_ep);
+ spin_lock(&dev->req_lock);
+- list_for_each_entry_safe(req, tmp, &dev->rx_reqs, list) {
++ while (!list_empty(&dev->rx_reqs)) {
++ req = list_first_entry(&dev->rx_reqs, struct usb_request, list);
+ list_del(&req->list);
+
+ spin_unlock(&dev->req_lock);
+diff --git a/drivers/usb/gadget/udc/omap_udc.c b/drivers/usb/gadget/udc/omap_udc.c
+index 3a16431da321..fcf13ef33b31 100644
+--- a/drivers/usb/gadget/udc/omap_udc.c
++++ b/drivers/usb/gadget/udc/omap_udc.c
+@@ -2033,6 +2033,7 @@ static inline int machine_without_vbus_sense(void)
+ {
+ return machine_is_omap_innovator()
+ || machine_is_omap_osk()
++ || machine_is_omap_palmte()
+ || machine_is_sx1()
+ /* No known omap7xx boards with vbus sense */
+ || cpu_is_omap7xx();
+@@ -2041,7 +2042,7 @@ static inline int machine_without_vbus_sense(void)
+ static int omap_udc_start(struct usb_gadget *g,
+ struct usb_gadget_driver *driver)
+ {
+- int status = -ENODEV;
++ int status;
+ struct omap_ep *ep;
+ unsigned long flags;
+
+@@ -2079,6 +2080,7 @@ static int omap_udc_start(struct usb_gadget *g,
+ goto done;
+ }
+ } else {
++ status = 0;
+ if (can_pullup(udc))
+ pullup_enable(udc);
+ else
+@@ -2593,9 +2595,22 @@ omap_ep_setup(char *name, u8 addr, u8 type,
+
+ static void omap_udc_release(struct device *dev)
+ {
+- complete(udc->done);
++ pullup_disable(udc);
++ if (!IS_ERR_OR_NULL(udc->transceiver)) {
++ usb_put_phy(udc->transceiver);
++ udc->transceiver = NULL;
++ }
++ omap_writew(0, UDC_SYSCON1);
++ remove_proc_file();
++ if (udc->dc_clk) {
++ if (udc->clk_requested)
++ omap_udc_enable_clock(0);
++ clk_put(udc->hhc_clk);
++ clk_put(udc->dc_clk);
++ }
++ if (udc->done)
++ complete(udc->done);
+ kfree(udc);
+- udc = NULL;
+ }
+
+ static int
+@@ -2627,6 +2642,7 @@ omap_udc_setup(struct platform_device *odev, struct usb_phy *xceiv)
+ udc->gadget.speed = USB_SPEED_UNKNOWN;
+ udc->gadget.max_speed = USB_SPEED_FULL;
+ udc->gadget.name = driver_name;
++ udc->gadget.quirk_ep_out_aligned_size = 1;
+ udc->transceiver = xceiv;
+
+ /* ep0 is special; put it right after the SETUP buffer */
+@@ -2867,8 +2883,8 @@ bad_on_1710:
+ udc->clr_halt = UDC_RESET_EP;
+
+ /* USB general purpose IRQ: ep0, state changes, dma, etc */
+- status = request_irq(pdev->resource[1].start, omap_udc_irq,
+- 0, driver_name, udc);
++ status = devm_request_irq(&pdev->dev, pdev->resource[1].start,
++ omap_udc_irq, 0, driver_name, udc);
+ if (status != 0) {
+ ERR("can't get irq %d, err %d\n",
+ (int) pdev->resource[1].start, status);
+@@ -2876,20 +2892,20 @@ bad_on_1710:
+ }
+
+ /* USB "non-iso" IRQ (PIO for all but ep0) */
+- status = request_irq(pdev->resource[2].start, omap_udc_pio_irq,
+- 0, "omap_udc pio", udc);
++ status = devm_request_irq(&pdev->dev, pdev->resource[2].start,
++ omap_udc_pio_irq, 0, "omap_udc pio", udc);
+ if (status != 0) {
+ ERR("can't get irq %d, err %d\n",
+ (int) pdev->resource[2].start, status);
+- goto cleanup2;
++ goto cleanup1;
+ }
+ #ifdef USE_ISO
+- status = request_irq(pdev->resource[3].start, omap_udc_iso_irq,
+- 0, "omap_udc iso", udc);
++ status = devm_request_irq(&pdev->dev, pdev->resource[3].start,
++ omap_udc_iso_irq, 0, "omap_udc iso", udc);
+ if (status != 0) {
+ ERR("can't get irq %d, err %d\n",
+ (int) pdev->resource[3].start, status);
+- goto cleanup3;
++ goto cleanup1;
+ }
+ #endif
+ if (cpu_is_omap16xx() || cpu_is_omap7xx()) {
+@@ -2900,23 +2916,8 @@ bad_on_1710:
+ }
+
+ create_proc_file();
+- status = usb_add_gadget_udc_release(&pdev->dev, &udc->gadget,
+- omap_udc_release);
+- if (status)
+- goto cleanup4;
+-
+- return 0;
+-
+-cleanup4:
+- remove_proc_file();
+-
+-#ifdef USE_ISO
+-cleanup3:
+- free_irq(pdev->resource[2].start, udc);
+-#endif
+-
+-cleanup2:
+- free_irq(pdev->resource[1].start, udc);
++ return usb_add_gadget_udc_release(&pdev->dev, &udc->gadget,
++ omap_udc_release);
+
+ cleanup1:
+ kfree(udc);
+@@ -2943,42 +2944,15 @@ static int omap_udc_remove(struct platform_device *pdev)
+ {
+ DECLARE_COMPLETION_ONSTACK(done);
+
+- if (!udc)
+- return -ENODEV;
+-
+- usb_del_gadget_udc(&udc->gadget);
+- if (udc->driver)
+- return -EBUSY;
+-
+ udc->done = &done;
+
+- pullup_disable(udc);
+- if (!IS_ERR_OR_NULL(udc->transceiver)) {
+- usb_put_phy(udc->transceiver);
+- udc->transceiver = NULL;
+- }
+- omap_writew(0, UDC_SYSCON1);
+-
+- remove_proc_file();
+-
+-#ifdef USE_ISO
+- free_irq(pdev->resource[3].start, udc);
+-#endif
+- free_irq(pdev->resource[2].start, udc);
+- free_irq(pdev->resource[1].start, udc);
++ usb_del_gadget_udc(&udc->gadget);
+
+- if (udc->dc_clk) {
+- if (udc->clk_requested)
+- omap_udc_enable_clock(0);
+- clk_put(udc->hhc_clk);
+- clk_put(udc->dc_clk);
+- }
++ wait_for_completion(&done);
+
+ release_mem_region(pdev->resource[0].start,
+ pdev->resource[0].end - pdev->resource[0].start + 1);
+
+- wait_for_completion(&done);
+-
+ return 0;
+ }
+
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index e12bb256036f..7ab6caef599c 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -251,25 +251,10 @@ static void release_memory_resource(struct resource *resource)
+ kfree(resource);
+ }
+
+-/*
+- * Host memory not allocated to dom0. We can use this range for hotplug-based
+- * ballooning.
+- *
+- * It's a type-less resource. Setting IORESOURCE_MEM will make resource
+- * management algorithms (arch_remove_reservations()) look into guest e820,
+- * which we don't want.
+- */
+-static struct resource hostmem_resource = {
+- .name = "Host RAM",
+-};
+-
+-void __attribute__((weak)) __init arch_xen_balloon_init(struct resource *res)
+-{}
+-
+ static struct resource *additional_memory_resource(phys_addr_t size)
+ {
+- struct resource *res, *res_hostmem;
+- int ret = -ENOMEM;
++ struct resource *res;
++ int ret;
+
+ res = kzalloc(sizeof(*res), GFP_KERNEL);
+ if (!res)
+@@ -278,42 +263,13 @@ static struct resource *additional_memory_resource(phys_addr_t size)
+ res->name = "System RAM";
+ res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
+
+- res_hostmem = kzalloc(sizeof(*res), GFP_KERNEL);
+- if (res_hostmem) {
+- /* Try to grab a range from hostmem */
+- res_hostmem->name = "Host memory";
+- ret = allocate_resource(&hostmem_resource, res_hostmem,
+- size, 0, -1,
+- PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
+- }
+-
+- if (!ret) {
+- /*
+- * Insert this resource into iomem. Because hostmem_resource
+- * tracks portion of guest e820 marked as UNUSABLE noone else
+- * should try to use it.
+- */
+- res->start = res_hostmem->start;
+- res->end = res_hostmem->end;
+- ret = insert_resource(&iomem_resource, res);
+- if (ret < 0) {
+- pr_err("Can't insert iomem_resource [%llx - %llx]\n",
+- res->start, res->end);
+- release_memory_resource(res_hostmem);
+- res_hostmem = NULL;
+- res->start = res->end = 0;
+- }
+- }
+-
+- if (ret) {
+- ret = allocate_resource(&iomem_resource, res,
+- size, 0, -1,
+- PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
+- if (ret < 0) {
+- pr_err("Cannot allocate new System RAM resource\n");
+- kfree(res);
+- return NULL;
+- }
++ ret = allocate_resource(&iomem_resource, res,
++ size, 0, -1,
++ PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
++ if (ret < 0) {
++ pr_err("Cannot allocate new System RAM resource\n");
++ kfree(res);
++ return NULL;
+ }
+
+ #ifdef CONFIG_SPARSEMEM
+@@ -325,7 +281,6 @@ static struct resource *additional_memory_resource(phys_addr_t size)
+ pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n",
+ pfn, limit);
+ release_memory_resource(res);
+- release_memory_resource(res_hostmem);
+ return NULL;
+ }
+ }
+@@ -747,8 +702,6 @@ static int __init balloon_init(void)
+ set_online_page_callback(&xen_online_page);
+ register_memory_notifier(&xen_memory_nb);
+ register_sysctl_table(xen_root);
+-
+- arch_xen_balloon_init(&hostmem_resource);
+ #endif
+
+ #ifdef CONFIG_XEN_PV
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 2f11ca72a281..77224d8f3e6f 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -385,8 +385,8 @@ static int create_active(struct sock_mapping *map, int *evtchn)
+ out_error:
+ if (*evtchn >= 0)
+ xenbus_free_evtchn(pvcalls_front_dev, *evtchn);
+- kfree(map->active.data.in);
+- kfree(map->active.ring);
++ free_pages((unsigned long)map->active.data.in, PVCALLS_RING_ORDER);
++ free_page((unsigned long)map->active.ring);
+ return ret;
+ }
+
+diff --git a/drivers/xen/xlate_mmu.c b/drivers/xen/xlate_mmu.c
+index 23f1387b3ef7..e7df65d32c91 100644
+--- a/drivers/xen/xlate_mmu.c
++++ b/drivers/xen/xlate_mmu.c
+@@ -36,6 +36,7 @@
+ #include <asm/xen/hypervisor.h>
+
+ #include <xen/xen.h>
++#include <xen/xen-ops.h>
+ #include <xen/page.h>
+ #include <xen/interface/xen.h>
+ #include <xen/interface/memory.h>
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 479b7fdda124..071075d775a9 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -379,7 +379,7 @@ void afs_zap_data(struct afs_vnode *vnode)
+ int afs_validate(struct afs_vnode *vnode, struct key *key)
+ {
+ time64_t now = ktime_get_real_seconds();
+- bool valid = false;
++ bool valid;
+ int ret;
+
+ _enter("{v={%x:%u} fl=%lx},%x",
+@@ -399,15 +399,21 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
+ vnode->cb_v_break = vnode->volume->cb_v_break;
+ valid = false;
+ } else if (vnode->status.type == AFS_FTYPE_DIR &&
+- test_bit(AFS_VNODE_DIR_VALID, &vnode->flags) &&
+- vnode->cb_expires_at - 10 > now) {
+- valid = true;
+- } else if (!test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags) &&
+- vnode->cb_expires_at - 10 > now) {
++ (!test_bit(AFS_VNODE_DIR_VALID, &vnode->flags) ||
++ vnode->cb_expires_at - 10 <= now)) {
++ valid = false;
++ } else if (test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags) ||
++ vnode->cb_expires_at - 10 <= now) {
++ valid = false;
++ } else {
+ valid = true;
+ }
+ } else if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
+ valid = true;
++ } else {
++ vnode->cb_s_break = vnode->cb_interest->server->cb_s_break;
++ vnode->cb_v_break = vnode->volume->cb_v_break;
++ valid = false;
+ }
+
+ read_sequnlock_excl(&vnode->cb_lock);
+diff --git a/fs/aio.c b/fs/aio.c
+index b9350f3360c6..04c4d6218978 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -1436,6 +1436,7 @@ static int aio_prep_rw(struct kiocb *req, struct iocb *iocb)
+ ret = ioprio_check_cap(iocb->aio_reqprio);
+ if (ret) {
+ pr_debug("aio ioprio check cap error: %d\n", ret);
++ fput(req->ki_filp);
+ return ret;
+ }
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index ba8950bfd9c7..84cb6e5ef36c 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -3344,7 +3344,8 @@ static void free_pending_move(struct send_ctx *sctx, struct pending_dir_move *m)
+ kfree(m);
+ }
+
+-static void tail_append_pending_moves(struct pending_dir_move *moves,
++static void tail_append_pending_moves(struct send_ctx *sctx,
++ struct pending_dir_move *moves,
+ struct list_head *stack)
+ {
+ if (list_empty(&moves->list)) {
+@@ -3355,6 +3356,10 @@ static void tail_append_pending_moves(struct pending_dir_move *moves,
+ list_add_tail(&moves->list, stack);
+ list_splice_tail(&list, stack);
+ }
++ if (!RB_EMPTY_NODE(&moves->node)) {
++ rb_erase(&moves->node, &sctx->pending_dir_moves);
++ RB_CLEAR_NODE(&moves->node);
++ }
+ }
+
+ static int apply_children_dir_moves(struct send_ctx *sctx)
+@@ -3369,7 +3374,7 @@ static int apply_children_dir_moves(struct send_ctx *sctx)
+ return 0;
+
+ INIT_LIST_HEAD(&stack);
+- tail_append_pending_moves(pm, &stack);
++ tail_append_pending_moves(sctx, pm, &stack);
+
+ while (!list_empty(&stack)) {
+ pm = list_first_entry(&stack, struct pending_dir_move, list);
+@@ -3380,7 +3385,7 @@ static int apply_children_dir_moves(struct send_ctx *sctx)
+ goto out;
+ pm = get_pending_dir_moves(sctx, parent_ino);
+ if (pm)
+- tail_append_pending_moves(pm, &stack);
++ tail_append_pending_moves(sctx, pm, &stack);
+ }
+ return 0;
+
+diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
+index 95983c744164..5ab411d4bc59 100644
+--- a/fs/cachefiles/namei.c
++++ b/fs/cachefiles/namei.c
+@@ -244,11 +244,13 @@ wait_for_old_object:
+
+ ASSERT(!test_bit(CACHEFILES_OBJECT_ACTIVE, &xobject->flags));
+
+- cache->cache.ops->put_object(&xobject->fscache, cachefiles_obj_put_wait_retry);
++ cache->cache.ops->put_object(&xobject->fscache,
++ (enum fscache_obj_ref_trace)cachefiles_obj_put_wait_retry);
+ goto try_again;
+
+ requeue:
+- cache->cache.ops->put_object(&xobject->fscache, cachefiles_obj_put_wait_timeo);
++ cache->cache.ops->put_object(&xobject->fscache,
++ (enum fscache_obj_ref_trace)cachefiles_obj_put_wait_timeo);
+ _leave(" = -ETIMEDOUT");
+ return -ETIMEDOUT;
+ }
+diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
+index 40f7595aad10..8a577409d030 100644
+--- a/fs/cachefiles/rdwr.c
++++ b/fs/cachefiles/rdwr.c
+@@ -535,7 +535,10 @@ static int cachefiles_read_backing_file(struct cachefiles_object *object,
+ netpage->index, cachefiles_gfp);
+ if (ret < 0) {
+ if (ret == -EEXIST) {
++ put_page(backpage);
++ backpage = NULL;
+ put_page(netpage);
++ netpage = NULL;
+ fscache_retrieval_complete(op, 1);
+ continue;
+ }
+@@ -608,7 +611,10 @@ static int cachefiles_read_backing_file(struct cachefiles_object *object,
+ netpage->index, cachefiles_gfp);
+ if (ret < 0) {
+ if (ret == -EEXIST) {
++ put_page(backpage);
++ backpage = NULL;
+ put_page(netpage);
++ netpage = NULL;
+ fscache_retrieval_complete(op, 1);
+ continue;
+ }
+@@ -962,11 +968,8 @@ void cachefiles_uncache_page(struct fscache_object *_object, struct page *page)
+ __releases(&object->fscache.cookie->lock)
+ {
+ struct cachefiles_object *object;
+- struct cachefiles_cache *cache;
+
+ object = container_of(_object, struct cachefiles_object, fscache);
+- cache = container_of(object->fscache.cache,
+- struct cachefiles_cache, cache);
+
+ _enter("%p,{%lu}", object, page->index);
+
+diff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c
+index 0a29a00aed2e..511e6c68156a 100644
+--- a/fs/cachefiles/xattr.c
++++ b/fs/cachefiles/xattr.c
+@@ -135,7 +135,8 @@ int cachefiles_update_object_xattr(struct cachefiles_object *object,
+ struct dentry *dentry = object->dentry;
+ int ret;
+
+- ASSERT(dentry);
++ if (!dentry)
++ return -ESTALE;
+
+ _enter("%p,#%d", object, auxdata->len);
+
+diff --git a/fs/dax.c b/fs/dax.c
+index b0cd1364c68f..3a2682a6c832 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -423,7 +423,7 @@ bool dax_lock_mapping_entry(struct page *page)
+ for (;;) {
+ mapping = READ_ONCE(page->mapping);
+
+- if (!dax_mapping(mapping))
++ if (!mapping || !dax_mapping(mapping))
+ break;
+
+ /*
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index 645158dc33f1..63707abcbeb3 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -77,7 +77,7 @@ static bool dentry_connected(struct dentry *dentry)
+ struct dentry *parent = dget_parent(dentry);
+
+ dput(dentry);
+- if (IS_ROOT(dentry)) {
++ if (dentry == parent) {
+ dput(parent);
+ return false;
+ }
+diff --git a/fs/fscache/object.c b/fs/fscache/object.c
+index 9edc920f651f..6d9cb1719de5 100644
+--- a/fs/fscache/object.c
++++ b/fs/fscache/object.c
+@@ -730,6 +730,9 @@ static const struct fscache_state *fscache_drop_object(struct fscache_object *ob
+
+ if (awaken)
+ wake_up_bit(&cookie->flags, FSCACHE_COOKIE_INVALIDATING);
++ if (test_and_clear_bit(FSCACHE_COOKIE_LOOKING_UP, &cookie->flags))
++ wake_up_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP);
++
+
+ /* Prevent a race with our last child, which has to signal EV_CLEARED
+ * before dropping our spinlock.
+diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
+index 374b5688e29e..9bdff5e40626 100644
+--- a/fs/hfs/btree.c
++++ b/fs/hfs/btree.c
+@@ -329,13 +329,14 @@ void hfs_bmap_free(struct hfs_bnode *node)
+
+ nidx -= len * 8;
+ i = node->next;
+- hfs_bnode_put(node);
+ if (!i) {
+ /* panic */;
+ pr_crit("unable to free bnode %u. bmap not found!\n",
+ node->this);
++ hfs_bnode_put(node);
+ return;
+ }
++ hfs_bnode_put(node);
+ node = hfs_bnode_find(tree, i);
+ if (IS_ERR(node))
+ return;
+diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
+index de14b2b6881b..3de3bc4918b5 100644
+--- a/fs/hfsplus/btree.c
++++ b/fs/hfsplus/btree.c
+@@ -454,14 +454,15 @@ void hfs_bmap_free(struct hfs_bnode *node)
+
+ nidx -= len * 8;
+ i = node->next;
+- hfs_bnode_put(node);
+ if (!i) {
+ /* panic */;
+ pr_crit("unable to free bnode %u. "
+ "bmap not found!\n",
+ node->this);
++ hfs_bnode_put(node);
+ return;
+ }
++ hfs_bnode_put(node);
+ node = hfs_bnode_find(tree, i);
+ if (IS_ERR(node))
+ return;
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index 86ac2c5b93fe..e0fe9a0f1bf1 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -1733,7 +1733,8 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr)
+ if (fh)
+ hdr->args.fh = fh;
+
+- if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
++ if (vers == 4 &&
++ !nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
+ goto out_failed;
+
+ /*
+@@ -1798,7 +1799,8 @@ ff_layout_write_pagelist(struct nfs_pgio_header *hdr, int sync)
+ if (fh)
+ hdr->args.fh = fh;
+
+- if (!nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
++ if (vers == 4 &&
++ !nfs4_ff_layout_select_ds_stateid(lseg, idx, &hdr->args.stateid))
+ goto out_failed;
+
+ /*
+diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c
+index 9f88188060db..4bf8d5854b27 100644
+--- a/fs/ocfs2/export.c
++++ b/fs/ocfs2/export.c
+@@ -125,10 +125,10 @@ check_err:
+
+ check_gen:
+ if (handle->ih_generation != inode->i_generation) {
+- iput(inode);
+ trace_ocfs2_get_dentry_generation((unsigned long long)blkno,
+ handle->ih_generation,
+ inode->i_generation);
++ iput(inode);
+ result = ERR_PTR(-ESTALE);
+ goto bail;
+ }
+diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
+index 7eb3b0a6347e..f55f82ca3425 100644
+--- a/fs/ocfs2/move_extents.c
++++ b/fs/ocfs2/move_extents.c
+@@ -156,18 +156,14 @@ out:
+ }
+
+ /*
+- * lock allocators, and reserving appropriate number of bits for
+- * meta blocks and data clusters.
+- *
+- * in some cases, we don't need to reserve clusters, just let data_ac
+- * be NULL.
++ * lock allocator, and reserve appropriate number of bits for
++ * meta blocks.
+ */
+-static int ocfs2_lock_allocators_move_extents(struct inode *inode,
++static int ocfs2_lock_meta_allocator_move_extents(struct inode *inode,
+ struct ocfs2_extent_tree *et,
+ u32 clusters_to_move,
+ u32 extents_to_split,
+ struct ocfs2_alloc_context **meta_ac,
+- struct ocfs2_alloc_context **data_ac,
+ int extra_blocks,
+ int *credits)
+ {
+@@ -192,13 +188,6 @@ static int ocfs2_lock_allocators_move_extents(struct inode *inode,
+ goto out;
+ }
+
+- if (data_ac) {
+- ret = ocfs2_reserve_clusters(osb, clusters_to_move, data_ac);
+- if (ret) {
+- mlog_errno(ret);
+- goto out;
+- }
+- }
+
+ *credits += ocfs2_calc_extend_credits(osb->sb, et->et_root_el);
+
+@@ -257,10 +246,10 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
+ }
+ }
+
+- ret = ocfs2_lock_allocators_move_extents(inode, &context->et, *len, 1,
+- &context->meta_ac,
+- &context->data_ac,
+- extra_blocks, &credits);
++ ret = ocfs2_lock_meta_allocator_move_extents(inode, &context->et,
++ *len, 1,
++ &context->meta_ac,
++ extra_blocks, &credits);
+ if (ret) {
+ mlog_errno(ret);
+ goto out;
+@@ -283,6 +272,21 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
+ }
+ }
+
++ /*
++ * Make sure ocfs2_reserve_cluster is called after
++ * __ocfs2_flush_truncate_log, otherwise, dead lock may happen.
++ *
++ * If ocfs2_reserve_cluster is called
++ * before __ocfs2_flush_truncate_log, dead lock on global bitmap
++ * may happen.
++ *
++ */
++ ret = ocfs2_reserve_clusters(osb, *len, &context->data_ac);
++ if (ret) {
++ mlog_errno(ret);
++ goto out_unlock_mutex;
++ }
++
+ handle = ocfs2_start_trans(osb, credits);
+ if (IS_ERR(handle)) {
+ ret = PTR_ERR(handle);
+@@ -600,9 +604,10 @@ static int ocfs2_move_extent(struct ocfs2_move_extents_context *context,
+ }
+ }
+
+- ret = ocfs2_lock_allocators_move_extents(inode, &context->et, len, 1,
+- &context->meta_ac,
+- NULL, extra_blocks, &credits);
++ ret = ocfs2_lock_meta_allocator_move_extents(inode, &context->et,
++ len, 1,
++ &context->meta_ac,
++ extra_blocks, &credits);
+ if (ret) {
+ mlog_errno(ret);
+ goto out;
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index f4fd2e72add4..03cd59375abe 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -806,17 +806,14 @@ static int ramoops_probe(struct platform_device *pdev)
+
+ cxt->pstore.data = cxt;
+ /*
+- * Console can handle any buffer size, so prefer LOG_LINE_MAX. If we
+- * have to handle dumps, we must have at least record_size buffer. And
+- * for ftrace, bufsize is irrelevant (if bufsize is 0, buf will be
+- * ZERO_SIZE_PTR).
++ * Since bufsize is only used for dmesg crash dumps, it
++ * must match the size of the dprz record (after PRZ header
++ * and ECC bytes have been accounted for).
+ */
+- if (cxt->console_size)
+- cxt->pstore.bufsize = 1024; /* LOG_LINE_MAX */
+- cxt->pstore.bufsize = max(cxt->record_size, cxt->pstore.bufsize);
+- cxt->pstore.buf = kmalloc(cxt->pstore.bufsize, GFP_KERNEL);
++ cxt->pstore.bufsize = cxt->dprzs[0]->buffer_size;
++ cxt->pstore.buf = kzalloc(cxt->pstore.bufsize, GFP_KERNEL);
+ if (!cxt->pstore.buf) {
+- pr_err("cannot allocate pstore buffer\n");
++ pr_err("cannot allocate pstore crash dump buffer\n");
+ err = -ENOMEM;
+ goto fail_clear;
+ }
+diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c
+index 499a20a5a010..273736f41be3 100644
+--- a/fs/sysv/inode.c
++++ b/fs/sysv/inode.c
+@@ -275,7 +275,7 @@ static int __sysv_write_inode(struct inode *inode, int wait)
+ }
+ }
+ brelse(bh);
+- return 0;
++ return err;
+ }
+
+ int sysv_write_inode(struct inode *inode, struct writeback_control *wbc)
+diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
+index 34cf0fdd7dc7..610815e3f1aa 100644
+--- a/include/linux/fscache-cache.h
++++ b/include/linux/fscache-cache.h
+@@ -196,8 +196,7 @@ static inline void fscache_enqueue_retrieval(struct fscache_retrieval *op)
+ static inline void fscache_retrieval_complete(struct fscache_retrieval *op,
+ int n_pages)
+ {
+- atomic_sub(n_pages, &op->n_pages);
+- if (atomic_read(&op->n_pages) <= 0)
++ if (atomic_sub_return_relaxed(n_pages, &op->n_pages) <= 0)
+ fscache_op_complete(&op->op, false);
+ }
+
+diff --git a/include/linux/pstore.h b/include/linux/pstore.h
+index a15bc4d48752..30fcec375a3a 100644
+--- a/include/linux/pstore.h
++++ b/include/linux/pstore.h
+@@ -90,7 +90,10 @@ struct pstore_record {
+ *
+ * @buf_lock: spinlock to serialize access to @buf
+ * @buf: preallocated crash dump buffer
+- * @bufsize: size of @buf available for crash dump writes
++ * @bufsize: size of @buf available for crash dump bytes (must match
++ * smallest number of bytes available for writing to a
++ * backend entry, since compressed bytes don't take kindly
++ * to being truncated)
+ *
+ * @read_mutex: serializes @open, @read, @close, and @erase callbacks
+ * @flags: bitfield of frontends the backend can accept writes for
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index e6ef9cc05e60..60a2e7646985 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1355,6 +1355,17 @@ static inline void skb_zcopy_abort(struct sk_buff *skb)
+ }
+ }
+
++static inline void skb_mark_not_on_list(struct sk_buff *skb)
++{
++ skb->next = NULL;
++}
++
++static inline void skb_list_del_init(struct sk_buff *skb)
++{
++ __list_del_entry(&skb->list);
++ skb_mark_not_on_list(skb);
++}
++
+ /**
+ * skb_queue_empty - check if a queue is empty
+ * @list: queue head
+diff --git a/include/net/neighbour.h b/include/net/neighbour.h
+index 6c1eecd56a4d..beeeed126872 100644
+--- a/include/net/neighbour.h
++++ b/include/net/neighbour.h
+@@ -453,6 +453,7 @@ static inline int neigh_hh_bridge(struct hh_cache *hh, struct sk_buff *skb)
+
+ static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb)
+ {
++ unsigned int hh_alen = 0;
+ unsigned int seq;
+ unsigned int hh_len;
+
+@@ -460,16 +461,33 @@ static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb
+ seq = read_seqbegin(&hh->hh_lock);
+ hh_len = hh->hh_len;
+ if (likely(hh_len <= HH_DATA_MOD)) {
+- /* this is inlined by gcc */
+- memcpy(skb->data - HH_DATA_MOD, hh->hh_data, HH_DATA_MOD);
++ hh_alen = HH_DATA_MOD;
++
++ /* skb_push() would proceed silently if we have room for
++ * the unaligned size but not for the aligned size:
++ * check headroom explicitly.
++ */
++ if (likely(skb_headroom(skb) >= HH_DATA_MOD)) {
++ /* this is inlined by gcc */
++ memcpy(skb->data - HH_DATA_MOD, hh->hh_data,
++ HH_DATA_MOD);
++ }
+ } else {
+- unsigned int hh_alen = HH_DATA_ALIGN(hh_len);
++ hh_alen = HH_DATA_ALIGN(hh_len);
+
+- memcpy(skb->data - hh_alen, hh->hh_data, hh_alen);
++ if (likely(skb_headroom(skb) >= hh_alen)) {
++ memcpy(skb->data - hh_alen, hh->hh_data,
++ hh_alen);
++ }
+ }
+ } while (read_seqretry(&hh->hh_lock, seq));
+
+- skb_push(skb, hh_len);
++ if (WARN_ON_ONCE(skb_headroom(skb) < hh_alen)) {
++ kfree_skb(skb);
++ return NET_XMIT_DROP;
++ }
++
++ __skb_push(skb, hh_len);
+ return dev_queue_xmit(skb);
+ }
+
+diff --git a/include/net/netfilter/ipv4/nf_nat_masquerade.h b/include/net/netfilter/ipv4/nf_nat_masquerade.h
+index cd24be4c4a99..13d55206bb9f 100644
+--- a/include/net/netfilter/ipv4/nf_nat_masquerade.h
++++ b/include/net/netfilter/ipv4/nf_nat_masquerade.h
+@@ -9,7 +9,7 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
+ const struct nf_nat_range2 *range,
+ const struct net_device *out);
+
+-void nf_nat_masquerade_ipv4_register_notifier(void);
++int nf_nat_masquerade_ipv4_register_notifier(void);
+ void nf_nat_masquerade_ipv4_unregister_notifier(void);
+
+ #endif /*_NF_NAT_MASQUERADE_IPV4_H_ */
+diff --git a/include/net/netfilter/ipv6/nf_nat_masquerade.h b/include/net/netfilter/ipv6/nf_nat_masquerade.h
+index 0c3b5ebf0bb8..2917bf95c437 100644
+--- a/include/net/netfilter/ipv6/nf_nat_masquerade.h
++++ b/include/net/netfilter/ipv6/nf_nat_masquerade.h
+@@ -5,7 +5,7 @@
+ unsigned int
+ nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
+ const struct net_device *out);
+-void nf_nat_masquerade_ipv6_register_notifier(void);
++int nf_nat_masquerade_ipv6_register_notifier(void);
+ void nf_nat_masquerade_ipv6_unregister_notifier(void);
+
+ #endif /* _NF_NAT_MASQUERADE_IPV6_H_ */
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index a11f93790476..feada358d872 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -2075,6 +2075,8 @@ struct sctp_association {
+
+ __u64 abandoned_unsent[SCTP_PR_INDEX(MAX) + 1];
+ __u64 abandoned_sent[SCTP_PR_INDEX(MAX) + 1];
++
++ struct rcu_head rcu;
+ };
+
+
+diff --git a/include/xen/balloon.h b/include/xen/balloon.h
+index 61f410fd74e4..4914b93a23f2 100644
+--- a/include/xen/balloon.h
++++ b/include/xen/balloon.h
+@@ -44,8 +44,3 @@ static inline void xen_balloon_init(void)
+ {
+ }
+ #endif
+-
+-#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+-struct resource;
+-void arch_xen_balloon_init(struct resource *hostmem_resource);
+-#endif
+diff --git a/init/initramfs.c b/init/initramfs.c
+index 640557788026..f6f4a1e4cd54 100644
+--- a/init/initramfs.c
++++ b/init/initramfs.c
+@@ -291,16 +291,6 @@ static int __init do_reset(void)
+ return 1;
+ }
+
+-static int __init maybe_link(void)
+-{
+- if (nlink >= 2) {
+- char *old = find_link(major, minor, ino, mode, collected);
+- if (old)
+- return (ksys_link(old, collected) < 0) ? -1 : 1;
+- }
+- return 0;
+-}
+-
+ static void __init clean_path(char *path, umode_t fmode)
+ {
+ struct kstat st;
+@@ -313,6 +303,18 @@ static void __init clean_path(char *path, umode_t fmode)
+ }
+ }
+
++static int __init maybe_link(void)
++{
++ if (nlink >= 2) {
++ char *old = find_link(major, minor, ino, mode, collected);
++ if (old) {
++ clean_path(collected, 0);
++ return (ksys_link(old, collected) < 0) ? -1 : 1;
++ }
++ }
++ return 0;
++}
++
+ static __initdata int wfd;
+
+ static int __init do_name(void)
+diff --git a/kernel/bpf/local_storage.c b/kernel/bpf/local_storage.c
+index 830d7f095748..fc1605aee5ea 100644
+--- a/kernel/bpf/local_storage.c
++++ b/kernel/bpf/local_storage.c
+@@ -138,7 +138,8 @@ static int cgroup_storage_update_elem(struct bpf_map *map, void *_key,
+ return -ENOENT;
+
+ new = kmalloc_node(sizeof(struct bpf_storage_buffer) +
+- map->value_size, __GFP_ZERO | GFP_USER,
++ map->value_size,
++ __GFP_ZERO | GFP_ATOMIC | __GFP_NOWARN,
+ map->numa_node);
+ if (!new)
+ return -ENOMEM;
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 5780876ac81a..56acfbb80104 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -5283,7 +5283,7 @@ static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len
+ return;
+ /* NOTE: fake 'exit' subprog should be updated as well. */
+ for (i = 0; i <= env->subprog_cnt; i++) {
+- if (env->subprog_info[i].start < off)
++ if (env->subprog_info[i].start <= off)
+ continue;
+ env->subprog_info[i].start += len - 1;
+ }
+diff --git a/kernel/kcov.c b/kernel/kcov.c
+index 3ebd09efe72a..97959d7b77e2 100644
+--- a/kernel/kcov.c
++++ b/kernel/kcov.c
+@@ -56,7 +56,7 @@ struct kcov {
+ struct task_struct *t;
+ };
+
+-static bool check_kcov_mode(enum kcov_mode needed_mode, struct task_struct *t)
++static notrace bool check_kcov_mode(enum kcov_mode needed_mode, struct task_struct *t)
+ {
+ unsigned int mode;
+
+@@ -78,7 +78,7 @@ static bool check_kcov_mode(enum kcov_mode needed_mode, struct task_struct *t)
+ return mode == needed_mode;
+ }
+
+-static unsigned long canonicalize_ip(unsigned long ip)
++static notrace unsigned long canonicalize_ip(unsigned long ip)
+ {
+ #ifdef CONFIG_RANDOMIZE_BASE
+ ip -= kaslr_offset();
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 08fcfe440c63..9864a35c8bb5 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -196,11 +196,13 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
+ i++;
+ } else if (fmt[i] == 'p' || fmt[i] == 's') {
+ mod[fmt_cnt]++;
+- i++;
+- if (!isspace(fmt[i]) && !ispunct(fmt[i]) && fmt[i] != 0)
++ /* disallow any further format extensions */
++ if (fmt[i + 1] != 0 &&
++ !isspace(fmt[i + 1]) &&
++ !ispunct(fmt[i + 1]))
+ return -EINVAL;
+ fmt_cnt++;
+- if (fmt[i - 1] == 's') {
++ if (fmt[i] == 's') {
+ if (str_seen)
+ /* allow only one '%s' per fmt string */
+ return -EINVAL;
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 70935ed91125..14afeeb7d6ef 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -135,7 +135,6 @@ static void fill_pool(void)
+ if (!new)
+ return;
+
+- kmemleak_ignore(new);
+ raw_spin_lock_irqsave(&pool_lock, flags);
+ hlist_add_head(&new->node, &obj_pool);
+ debug_objects_allocated++;
+@@ -1128,7 +1127,6 @@ static int __init debug_objects_replace_static_objects(void)
+ obj = kmem_cache_zalloc(obj_cache, GFP_KERNEL);
+ if (!obj)
+ goto free;
+- kmemleak_ignore(obj);
+ hlist_add_head(&obj->node, &objects);
+ }
+
+@@ -1184,7 +1182,8 @@ void __init debug_objects_mem_init(void)
+
+ obj_cache = kmem_cache_create("debug_objects_cache",
+ sizeof (struct debug_obj), 0,
+- SLAB_DEBUG_OBJECTS, NULL);
++ SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE,
++ NULL);
+
+ if (!obj_cache || debug_objects_replace_static_objects()) {
+ debug_objects_enabled = 0;
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index b721631d78ab..6a62b2421cdf 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5733,8 +5733,10 @@ void __meminit init_currently_empty_zone(struct zone *zone,
+ unsigned long size)
+ {
+ struct pglist_data *pgdat = zone->zone_pgdat;
++ int zone_idx = zone_idx(zone) + 1;
+
+- pgdat->nr_zones = zone_idx(zone) + 1;
++ if (zone_idx > pgdat->nr_zones)
++ pgdat->nr_zones = zone_idx;
+
+ zone->zone_start_pfn = zone_start_pfn;
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 22af88c47756..1f1aae27d41f 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2161,6 +2161,20 @@ static bool remove_xps_queue_cpu(struct net_device *dev,
+ return active;
+ }
+
++static void reset_xps_maps(struct net_device *dev,
++ struct xps_dev_maps *dev_maps,
++ bool is_rxqs_map)
++{
++ if (is_rxqs_map) {
++ static_key_slow_dec_cpuslocked(&xps_rxqs_needed);
++ RCU_INIT_POINTER(dev->xps_rxqs_map, NULL);
++ } else {
++ RCU_INIT_POINTER(dev->xps_cpus_map, NULL);
++ }
++ static_key_slow_dec_cpuslocked(&xps_needed);
++ kfree_rcu(dev_maps, rcu);
++}
++
+ static void clean_xps_maps(struct net_device *dev, const unsigned long *mask,
+ struct xps_dev_maps *dev_maps, unsigned int nr_ids,
+ u16 offset, u16 count, bool is_rxqs_map)
+@@ -2172,18 +2186,15 @@ static void clean_xps_maps(struct net_device *dev, const unsigned long *mask,
+ j < nr_ids;)
+ active |= remove_xps_queue_cpu(dev, dev_maps, j, offset,
+ count);
+- if (!active) {
+- if (is_rxqs_map) {
+- RCU_INIT_POINTER(dev->xps_rxqs_map, NULL);
+- } else {
+- RCU_INIT_POINTER(dev->xps_cpus_map, NULL);
++ if (!active)
++ reset_xps_maps(dev, dev_maps, is_rxqs_map);
+
+- for (i = offset + (count - 1); count--; i--)
+- netdev_queue_numa_node_write(
+- netdev_get_tx_queue(dev, i),
+- NUMA_NO_NODE);
++ if (!is_rxqs_map) {
++ for (i = offset + (count - 1); count--; i--) {
++ netdev_queue_numa_node_write(
++ netdev_get_tx_queue(dev, i),
++ NUMA_NO_NODE);
+ }
+- kfree_rcu(dev_maps, rcu);
+ }
+ }
+
+@@ -2220,10 +2231,6 @@ static void netif_reset_xps_queues(struct net_device *dev, u16 offset,
+ false);
+
+ out_no_maps:
+- if (static_key_enabled(&xps_rxqs_needed))
+- static_key_slow_dec_cpuslocked(&xps_rxqs_needed);
+-
+- static_key_slow_dec_cpuslocked(&xps_needed);
+ mutex_unlock(&xps_map_mutex);
+ cpus_read_unlock();
+ }
+@@ -2341,9 +2348,12 @@ int __netif_set_xps_queue(struct net_device *dev, const unsigned long *mask,
+ if (!new_dev_maps)
+ goto out_no_new_maps;
+
+- static_key_slow_inc_cpuslocked(&xps_needed);
+- if (is_rxqs_map)
+- static_key_slow_inc_cpuslocked(&xps_rxqs_needed);
++ if (!dev_maps) {
++ /* Increment static keys at most once per type */
++ static_key_slow_inc_cpuslocked(&xps_needed);
++ if (is_rxqs_map)
++ static_key_slow_inc_cpuslocked(&xps_rxqs_needed);
++ }
+
+ for (j = -1; j = netif_attrmask_next(j, possible_mask, nr_ids),
+ j < nr_ids;) {
+@@ -2441,13 +2451,8 @@ out_no_new_maps:
+ }
+
+ /* free map if not active */
+- if (!active) {
+- if (is_rxqs_map)
+- RCU_INIT_POINTER(dev->xps_rxqs_map, NULL);
+- else
+- RCU_INIT_POINTER(dev->xps_cpus_map, NULL);
+- kfree_rcu(dev_maps, rcu);
+- }
++ if (!active)
++ reset_xps_maps(dev, dev_maps, is_rxqs_map);
+
+ out_no_maps:
+ mutex_unlock(&xps_map_mutex);
+@@ -4981,7 +4986,7 @@ static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemallo
+ struct net_device *orig_dev = skb->dev;
+ struct packet_type *pt_prev = NULL;
+
+- list_del(&skb->list);
++ skb_list_del_init(skb);
+ __netif_receive_skb_core(skb, pfmemalloc, &pt_prev);
+ if (!pt_prev)
+ continue;
+@@ -5137,7 +5142,7 @@ static void netif_receive_skb_list_internal(struct list_head *head)
+ INIT_LIST_HEAD(&sublist);
+ list_for_each_entry_safe(skb, next, head, list) {
+ net_timestamp_check(netdev_tstamp_prequeue, skb);
+- list_del(&skb->list);
++ skb_list_del_init(skb);
+ if (!skb_defer_rx_timestamp(skb))
+ list_add_tail(&skb->list, &sublist);
+ }
+@@ -5148,7 +5153,7 @@ static void netif_receive_skb_list_internal(struct list_head *head)
+ rcu_read_lock();
+ list_for_each_entry_safe(skb, next, head, list) {
+ xdp_prog = rcu_dereference(skb->dev->xdp_prog);
+- list_del(&skb->list);
++ skb_list_del_init(skb);
+ if (do_xdp_generic(xdp_prog, skb) == XDP_PASS)
+ list_add_tail(&skb->list, &sublist);
+ }
+@@ -5167,7 +5172,7 @@ static void netif_receive_skb_list_internal(struct list_head *head)
+
+ if (cpu >= 0) {
+ /* Will be handled, remove from list */
+- list_del(&skb->list);
++ skb_list_del_init(skb);
+ enqueue_to_backlog(skb, cpu, &rflow->last_qtail);
+ }
+ }
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 6e5d61a20a70..ebde98b565e9 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -3730,6 +3730,9 @@ int ndo_dflt_fdb_dump(struct sk_buff *skb,
+ {
+ int err;
+
++ if (dev->type != ARPHRD_ETHER)
++ return -EINVAL;
++
+ netif_addr_lock_bh(dev);
+ err = nlmsg_populate_fdb(skb, cb, dev, idx, &dev->uc);
+ if (err)
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index cb8fa5d7afe1..f686d7761acb 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -513,6 +513,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
+ struct rb_node *rbn;
+ int len;
+ int ihlen;
++ int delta;
+ int err;
+ u8 ecn;
+
+@@ -554,10 +555,16 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
+ if (len > 65535)
+ goto out_oversize;
+
++ delta = - head->truesize;
++
+ /* Head of list must not be cloned. */
+ if (skb_unclone(head, GFP_ATOMIC))
+ goto out_nomem;
+
++ delta += head->truesize;
++ if (delta)
++ add_frag_mem_limit(qp->q.net, delta);
++
+ /* If the first fragment is fragmented itself, we split
+ * it to two chunks: the first with data and paged part
+ * and the second, holding only fragments. */
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
+index 3196cf58f418..27c863f6dd83 100644
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -551,7 +551,7 @@ static void ip_list_rcv_finish(struct net *net, struct sock *sk,
+ list_for_each_entry_safe(skb, next, head, list) {
+ struct dst_entry *dst;
+
+- list_del(&skb->list);
++ skb_list_del_init(skb);
+ /* if ingress device is enslaved to an L3 master device pass the
+ * skb to its handler for processing
+ */
+@@ -598,7 +598,7 @@ void ip_list_rcv(struct list_head *head, struct packet_type *pt,
+ struct net_device *dev = skb->dev;
+ struct net *net = dev_net(dev);
+
+- list_del(&skb->list);
++ skb_list_del_init(skb);
+ skb = ip_rcv_core(skb, net);
+ if (skb == NULL)
+ continue;
+diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
+index ce1512b02cb2..fd3f9e8a74da 100644
+--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
++++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
+@@ -81,9 +81,12 @@ static int __init masquerade_tg_init(void)
+ int ret;
+
+ ret = xt_register_target(&masquerade_tg_reg);
++ if (ret)
++ return ret;
+
+- if (ret == 0)
+- nf_nat_masquerade_ipv4_register_notifier();
++ ret = nf_nat_masquerade_ipv4_register_notifier();
++ if (ret)
++ xt_unregister_target(&masquerade_tg_reg);
+
+ return ret;
+ }
+diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+index ad3aeff152ed..4c7fcd32f8e6 100644
+--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
++++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+@@ -131,28 +131,50 @@ static struct notifier_block masq_inet_notifier = {
+ .notifier_call = masq_inet_event,
+ };
+
+-static atomic_t masquerade_notifier_refcount = ATOMIC_INIT(0);
++static int masq_refcnt;
++static DEFINE_MUTEX(masq_mutex);
+
+-void nf_nat_masquerade_ipv4_register_notifier(void)
++int nf_nat_masquerade_ipv4_register_notifier(void)
+ {
++ int ret = 0;
++
++ mutex_lock(&masq_mutex);
+ /* check if the notifier was already set */
+- if (atomic_inc_return(&masquerade_notifier_refcount) > 1)
+- return;
++ if (++masq_refcnt > 1)
++ goto out_unlock;
+
+ /* Register for device down reports */
+- register_netdevice_notifier(&masq_dev_notifier);
++ ret = register_netdevice_notifier(&masq_dev_notifier);
++ if (ret)
++ goto err_dec;
+ /* Register IP address change reports */
+- register_inetaddr_notifier(&masq_inet_notifier);
++ ret = register_inetaddr_notifier(&masq_inet_notifier);
++ if (ret)
++ goto err_unregister;
++
++ mutex_unlock(&masq_mutex);
++ return ret;
++
++err_unregister:
++ unregister_netdevice_notifier(&masq_dev_notifier);
++err_dec:
++ masq_refcnt--;
++out_unlock:
++ mutex_unlock(&masq_mutex);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_register_notifier);
+
+ void nf_nat_masquerade_ipv4_unregister_notifier(void)
+ {
++ mutex_lock(&masq_mutex);
+ /* check if the notifier still has clients */
+- if (atomic_dec_return(&masquerade_notifier_refcount) > 0)
+- return;
++ if (--masq_refcnt > 0)
++ goto out_unlock;
+
+ unregister_netdevice_notifier(&masq_dev_notifier);
+ unregister_inetaddr_notifier(&masq_inet_notifier);
++out_unlock:
++ mutex_unlock(&masq_mutex);
+ }
+ EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_unregister_notifier);
+diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
+index f1193e1e928a..6847de1d1db8 100644
+--- a/net/ipv4/netfilter/nft_masq_ipv4.c
++++ b/net/ipv4/netfilter/nft_masq_ipv4.c
+@@ -69,7 +69,9 @@ static int __init nft_masq_ipv4_module_init(void)
+ if (ret < 0)
+ return ret;
+
+- nf_nat_masquerade_ipv4_register_notifier();
++ ret = nf_nat_masquerade_ipv4_register_notifier();
++ if (ret)
++ nft_unregister_expr(&nft_masq_ipv4_type);
+
+ return ret;
+ }
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 68f65ddf9e3c..bd134e3a0473 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1902,7 +1902,9 @@ static int tso_fragment(struct sock *sk, enum tcp_queue tcp_queue,
+ * This algorithm is from John Heffner.
+ */
+ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+- bool *is_cwnd_limited, u32 max_segs)
++ bool *is_cwnd_limited,
++ bool *is_rwnd_limited,
++ u32 max_segs)
+ {
+ const struct inet_connection_sock *icsk = inet_csk(sk);
+ u32 age, send_win, cong_win, limit, in_flight;
+@@ -1910,9 +1912,6 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ struct sk_buff *head;
+ int win_divisor;
+
+- if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+- goto send_now;
+-
+ if (icsk->icsk_ca_state >= TCP_CA_Recovery)
+ goto send_now;
+
+@@ -1971,10 +1970,27 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb,
+ if (age < (tp->srtt_us >> 4))
+ goto send_now;
+
+- /* Ok, it looks like it is advisable to defer. */
++ /* Ok, it looks like it is advisable to defer.
++ * Three cases are tracked :
++ * 1) We are cwnd-limited
++ * 2) We are rwnd-limited
++ * 3) We are application limited.
++ */
++ if (cong_win < send_win) {
++ if (cong_win <= skb->len) {
++ *is_cwnd_limited = true;
++ return true;
++ }
++ } else {
++ if (send_win <= skb->len) {
++ *is_rwnd_limited = true;
++ return true;
++ }
++ }
+
+- if (cong_win < send_win && cong_win <= skb->len)
+- *is_cwnd_limited = true;
++ /* If this packet won't get more data, do not wait. */
++ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
++ goto send_now;
+
+ return true;
+
+@@ -2338,7 +2354,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
+ } else {
+ if (!push_one &&
+ tcp_tso_should_defer(sk, skb, &is_cwnd_limited,
+- max_segs))
++ &is_rwnd_limited, max_segs))
+ break;
+ }
+
+@@ -2476,15 +2492,18 @@ void tcp_send_loss_probe(struct sock *sk)
+ goto rearm_timer;
+ }
+ skb = skb_rb_last(&sk->tcp_rtx_queue);
++ if (unlikely(!skb)) {
++ WARN_ONCE(tp->packets_out,
++ "invalid inflight: %u state %u cwnd %u mss %d\n",
++ tp->packets_out, sk->sk_state, tp->snd_cwnd, mss);
++ inet_csk(sk)->icsk_pending = 0;
++ return;
++ }
+
+ /* At most one outstanding TLP retransmission. */
+ if (tp->tlp_high_seq)
+ goto rearm_timer;
+
+- /* Retransmit last segment. */
+- if (WARN_ON(!skb))
+- goto rearm_timer;
+-
+ if (skb_still_in_host_queue(sk, skb))
+ goto rearm_timer;
+
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index 6242682be876..6b74523fc1c4 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -95,7 +95,7 @@ static void ip6_list_rcv_finish(struct net *net, struct sock *sk,
+ list_for_each_entry_safe(skb, next, head, list) {
+ struct dst_entry *dst;
+
+- list_del(&skb->list);
++ skb_list_del_init(skb);
+ /* if ingress device is enslaved to an L3 master device pass the
+ * skb to its handler for processing
+ */
+@@ -295,7 +295,7 @@ void ipv6_list_rcv(struct list_head *head, struct packet_type *pt,
+ struct net_device *dev = skb->dev;
+ struct net *net = dev_net(dev);
+
+- list_del(&skb->list);
++ skb_list_del_init(skb);
+ skb = ip6_rcv_core(skb, dev, net);
+ if (skb == NULL)
+ continue;
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index f9f8f554d141..2694def1e72c 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -195,37 +195,37 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
+ const struct ipv6_pinfo *np = inet6_sk(sk);
+ struct in6_addr *first_hop = &fl6->daddr;
+ struct dst_entry *dst = skb_dst(skb);
++ unsigned int head_room;
+ struct ipv6hdr *hdr;
+ u8 proto = fl6->flowi6_proto;
+ int seg_len = skb->len;
+ int hlimit = -1;
+ u32 mtu;
+
+- if (opt) {
+- unsigned int head_room;
++ head_room = sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
++ if (opt)
++ head_room += opt->opt_nflen + opt->opt_flen;
+
+- /* First: exthdrs may take lots of space (~8K for now)
+- MAX_HEADER is not enough.
+- */
+- head_room = opt->opt_nflen + opt->opt_flen;
+- seg_len += head_room;
+- head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
+-
+- if (skb_headroom(skb) < head_room) {
+- struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
+- if (!skb2) {
+- IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+- IPSTATS_MIB_OUTDISCARDS);
+- kfree_skb(skb);
+- return -ENOBUFS;
+- }
+- if (skb->sk)
+- skb_set_owner_w(skb2, skb->sk);
+- consume_skb(skb);
+- skb = skb2;
++ if (unlikely(skb_headroom(skb) < head_room)) {
++ struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
++ if (!skb2) {
++ IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
++ IPSTATS_MIB_OUTDISCARDS);
++ kfree_skb(skb);
++ return -ENOBUFS;
+ }
++ if (skb->sk)
++ skb_set_owner_w(skb2, skb->sk);
++ consume_skb(skb);
++ skb = skb2;
++ }
++
++ if (opt) {
++ seg_len += opt->opt_nflen + opt->opt_flen;
++
+ if (opt->opt_flen)
+ ipv6_push_frag_opts(skb, opt, &proto);
++
+ if (opt->opt_nflen)
+ ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop,
+ &fl6->saddr);
+diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
+index 5ae8e1c51079..8b075f0bc351 100644
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -24,7 +24,8 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
+ unsigned int hh_len;
+ struct dst_entry *dst;
+ struct flowi6 fl6 = {
+- .flowi6_oif = sk ? sk->sk_bound_dev_if : 0,
++ .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
++ rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
+ .flowi6_mark = skb->mark,
+ .flowi6_uid = sock_net_uid(net, sk),
+ .daddr = iph->daddr,
+diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c
+index 491f808e356a..29c7f1915a96 100644
+--- a/net/ipv6/netfilter/ip6t_MASQUERADE.c
++++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c
+@@ -58,8 +58,12 @@ static int __init masquerade_tg6_init(void)
+ int err;
+
+ err = xt_register_target(&masquerade_tg6_reg);
+- if (err == 0)
+- nf_nat_masquerade_ipv6_register_notifier();
++ if (err)
++ return err;
++
++ err = nf_nat_masquerade_ipv6_register_notifier();
++ if (err)
++ xt_unregister_target(&masquerade_tg6_reg);
+
+ return err;
+ }
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index f76bd4d15704..043ed8eb0ab9 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -341,7 +341,7 @@ static bool
+ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_device *dev)
+ {
+ struct sk_buff *fp, *head = fq->q.fragments;
+- int payload_len;
++ int payload_len, delta;
+ u8 ecn;
+
+ inet_frag_kill(&fq->q);
+@@ -363,10 +363,16 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_devic
+ return false;
+ }
+
++ delta = - head->truesize;
++
+ /* Head of list must not be cloned. */
+ if (skb_unclone(head, GFP_ATOMIC))
+ return false;
+
++ delta += head->truesize;
++ if (delta)
++ add_frag_mem_limit(fq->q.net, delta);
++
+ /* If the first fragment is fragmented itself, we split
+ * it to two chunks: the first with data and paged part
+ * and the second, holding only fragments. */
+diff --git a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+index e6eb7cf9b54f..37b1d413c825 100644
+--- a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
++++ b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+@@ -120,8 +120,8 @@ static void iterate_cleanup_work(struct work_struct *work)
+ * of ipv6 addresses being deleted), we also need to add an upper
+ * limit to the number of queued work items.
+ */
+-static int masq_inet_event(struct notifier_block *this,
+- unsigned long event, void *ptr)
++static int masq_inet6_event(struct notifier_block *this,
++ unsigned long event, void *ptr)
+ {
+ struct inet6_ifaddr *ifa = ptr;
+ const struct net_device *dev;
+@@ -158,30 +158,53 @@ static int masq_inet_event(struct notifier_block *this,
+ return NOTIFY_DONE;
+ }
+
+-static struct notifier_block masq_inet_notifier = {
+- .notifier_call = masq_inet_event,
++static struct notifier_block masq_inet6_notifier = {
++ .notifier_call = masq_inet6_event,
+ };
+
+-static atomic_t masquerade_notifier_refcount = ATOMIC_INIT(0);
++static int masq_refcnt;
++static DEFINE_MUTEX(masq_mutex);
+
+-void nf_nat_masquerade_ipv6_register_notifier(void)
++int nf_nat_masquerade_ipv6_register_notifier(void)
+ {
++ int ret = 0;
++
++ mutex_lock(&masq_mutex);
+ /* check if the notifier is already set */
+- if (atomic_inc_return(&masquerade_notifier_refcount) > 1)
+- return;
++ if (++masq_refcnt > 1)
++ goto out_unlock;
++
++ ret = register_netdevice_notifier(&masq_dev_notifier);
++ if (ret)
++ goto err_dec;
++
++ ret = register_inet6addr_notifier(&masq_inet6_notifier);
++ if (ret)
++ goto err_unregister;
+
+- register_netdevice_notifier(&masq_dev_notifier);
+- register_inet6addr_notifier(&masq_inet_notifier);
++ mutex_unlock(&masq_mutex);
++ return ret;
++
++err_unregister:
++ unregister_netdevice_notifier(&masq_dev_notifier);
++err_dec:
++ masq_refcnt--;
++out_unlock:
++ mutex_unlock(&masq_mutex);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6_register_notifier);
+
+ void nf_nat_masquerade_ipv6_unregister_notifier(void)
+ {
++ mutex_lock(&masq_mutex);
+ /* check if the notifier still has clients */
+- if (atomic_dec_return(&masquerade_notifier_refcount) > 0)
+- return;
++ if (--masq_refcnt > 0)
++ goto out_unlock;
+
+- unregister_inet6addr_notifier(&masq_inet_notifier);
++ unregister_inet6addr_notifier(&masq_inet6_notifier);
+ unregister_netdevice_notifier(&masq_dev_notifier);
++out_unlock:
++ mutex_unlock(&masq_mutex);
+ }
+ EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6_unregister_notifier);
+diff --git a/net/ipv6/netfilter/nft_masq_ipv6.c b/net/ipv6/netfilter/nft_masq_ipv6.c
+index dd0122f3cffe..e06c82e9dfcd 100644
+--- a/net/ipv6/netfilter/nft_masq_ipv6.c
++++ b/net/ipv6/netfilter/nft_masq_ipv6.c
+@@ -70,7 +70,9 @@ static int __init nft_masq_ipv6_module_init(void)
+ if (ret < 0)
+ return ret;
+
+- nf_nat_masquerade_ipv6_register_notifier();
++ ret = nf_nat_masquerade_ipv6_register_notifier();
++ if (ret)
++ nft_unregister_expr(&nft_masq_ipv6_type);
+
+ return ret;
+ }
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index 5c5b4f79296e..d3fd2d7e5aa4 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -281,7 +281,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
+ {
+ struct net *net = container_of(fq->q.net, struct net, ipv6.frags);
+ struct sk_buff *fp, *head = fq->q.fragments;
+- int payload_len;
++ int payload_len, delta;
+ unsigned int nhoff;
+ int sum_truesize;
+ u8 ecn;
+@@ -322,10 +322,16 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
+ if (payload_len > IPV6_MAXPLEN)
+ goto out_oversize;
+
++ delta = - head->truesize;
++
+ /* Head of list must not be cloned. */
+ if (skb_unclone(head, GFP_ATOMIC))
+ goto out_oom;
+
++ delta += head->truesize;
++ if (delta)
++ add_frag_mem_limit(fq->q.net, delta);
++
+ /* If the first fragment is fragmented itself, we split
+ * it to two chunks: the first with data and paged part
+ * and the second, holding only fragments. */
+diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
+index a8854dd3e9c5..8181ee7e1e27 100644
+--- a/net/ipv6/seg6_iptunnel.c
++++ b/net/ipv6/seg6_iptunnel.c
+@@ -347,6 +347,7 @@ static int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+ struct ipv6hdr *hdr = ipv6_hdr(skb);
+ struct flowi6 fl6;
+
++ memset(&fl6, 0, sizeof(fl6));
+ fl6.daddr = hdr->daddr;
+ fl6.saddr = hdr->saddr;
+ fl6.flowlabel = ip6_flowinfo(hdr);
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 62eefea48973..518364f4abcc 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -3980,6 +3980,9 @@ static void __net_exit ip_vs_control_net_cleanup_sysctl(struct netns_ipvs *ipvs)
+
+ static struct notifier_block ip_vs_dst_notifier = {
+ .notifier_call = ip_vs_dst_event,
++#ifdef CONFIG_IP_VS_IPV6
++ .priority = ADDRCONF_NOTIFY_PRIORITY + 5,
++#endif
+ };
+
+ int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs)
+diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
+index 02ca7df793f5..b6d0f6deea86 100644
+--- a/net/netfilter/nf_conncount.c
++++ b/net/netfilter/nf_conncount.c
+@@ -49,6 +49,7 @@ struct nf_conncount_tuple {
+ struct nf_conntrack_zone zone;
+ int cpu;
+ u32 jiffies32;
++ bool dead;
+ struct rcu_head rcu_head;
+ };
+
+@@ -106,15 +107,16 @@ nf_conncount_add(struct nf_conncount_list *list,
+ conn->zone = *zone;
+ conn->cpu = raw_smp_processor_id();
+ conn->jiffies32 = (u32)jiffies;
+- spin_lock(&list->list_lock);
++ conn->dead = false;
++ spin_lock_bh(&list->list_lock);
+ if (list->dead == true) {
+ kmem_cache_free(conncount_conn_cachep, conn);
+- spin_unlock(&list->list_lock);
++ spin_unlock_bh(&list->list_lock);
+ return NF_CONNCOUNT_SKIP;
+ }
+ list_add_tail(&conn->node, &list->head);
+ list->count++;
+- spin_unlock(&list->list_lock);
++ spin_unlock_bh(&list->list_lock);
+ return NF_CONNCOUNT_ADDED;
+ }
+ EXPORT_SYMBOL_GPL(nf_conncount_add);
+@@ -132,19 +134,22 @@ static bool conn_free(struct nf_conncount_list *list,
+ {
+ bool free_entry = false;
+
+- spin_lock(&list->list_lock);
++ spin_lock_bh(&list->list_lock);
+
+- if (list->count == 0) {
+- spin_unlock(&list->list_lock);
+- return free_entry;
++ if (conn->dead) {
++ spin_unlock_bh(&list->list_lock);
++ return free_entry;
+ }
+
+ list->count--;
++ conn->dead = true;
+ list_del_rcu(&conn->node);
+- if (list->count == 0)
++ if (list->count == 0) {
++ list->dead = true;
+ free_entry = true;
++ }
+
+- spin_unlock(&list->list_lock);
++ spin_unlock_bh(&list->list_lock);
+ call_rcu(&conn->rcu_head, __conn_free);
+ return free_entry;
+ }
+@@ -245,7 +250,7 @@ void nf_conncount_list_init(struct nf_conncount_list *list)
+ {
+ spin_lock_init(&list->list_lock);
+ INIT_LIST_HEAD(&list->head);
+- list->count = 1;
++ list->count = 0;
+ list->dead = false;
+ }
+ EXPORT_SYMBOL_GPL(nf_conncount_list_init);
+@@ -259,6 +264,7 @@ bool nf_conncount_gc_list(struct net *net,
+ struct nf_conn *found_ct;
+ unsigned int collected = 0;
+ bool free_entry = false;
++ bool ret = false;
+
+ list_for_each_entry_safe(conn, conn_n, &list->head, node) {
+ found = find_or_evict(net, list, conn, &free_entry);
+@@ -288,7 +294,15 @@ bool nf_conncount_gc_list(struct net *net,
+ if (collected > CONNCOUNT_GC_MAX_NODES)
+ return false;
+ }
+- return false;
++
++ spin_lock_bh(&list->list_lock);
++ if (!list->count) {
++ list->dead = true;
++ ret = true;
++ }
++ spin_unlock_bh(&list->list_lock);
++
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(nf_conncount_gc_list);
+
+@@ -309,11 +323,8 @@ static void tree_nodes_free(struct rb_root *root,
+ while (gc_count) {
+ rbconn = gc_nodes[--gc_count];
+ spin_lock(&rbconn->list.list_lock);
+- if (rbconn->list.count == 0 && rbconn->list.dead == false) {
+- rbconn->list.dead = true;
+- rb_erase(&rbconn->node, root);
+- call_rcu(&rbconn->rcu_head, __tree_nodes_free);
+- }
++ rb_erase(&rbconn->node, root);
++ call_rcu(&rbconn->rcu_head, __tree_nodes_free);
+ spin_unlock(&rbconn->list.list_lock);
+ }
+ }
+@@ -414,6 +425,7 @@ insert_tree(struct net *net,
+ nf_conncount_list_init(&rbconn->list);
+ list_add(&conn->node, &rbconn->list.head);
+ count = 1;
++ rbconn->list.count = count;
+
+ rb_link_node(&rbconn->node, parent, rbnode);
+ rb_insert_color(&rbconn->node, root);
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 2cfb173cd0b2..fe0558b15fd3 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2432,7 +2432,7 @@ err:
+ static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
+ struct nft_rule *rule)
+ {
+- struct nft_expr *expr;
++ struct nft_expr *expr, *next;
+
+ lockdep_assert_held(&ctx->net->nft.commit_mutex);
+ /*
+@@ -2441,8 +2441,9 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
+ */
+ expr = nft_expr_first(rule);
+ while (expr != nft_expr_last(rule) && expr->ops) {
++ next = nft_expr_next(expr);
+ nf_tables_expr_destroy(ctx, expr);
+- expr = nft_expr_next(expr);
++ expr = next;
+ }
+ kfree(rule);
+ }
+@@ -2645,21 +2646,14 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
+ }
+
+ if (nlh->nlmsg_flags & NLM_F_REPLACE) {
+- if (!nft_is_active_next(net, old_rule)) {
+- err = -ENOENT;
+- goto err2;
+- }
+- trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
+- old_rule);
++ trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
+ if (trans == NULL) {
+ err = -ENOMEM;
+ goto err2;
+ }
+- nft_deactivate_next(net, old_rule);
+- chain->use--;
+-
+- if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
+- err = -ENOMEM;
++ err = nft_delrule(&ctx, old_rule);
++ if (err < 0) {
++ nft_trans_destroy(trans);
+ goto err2;
+ }
+
+@@ -6277,7 +6271,7 @@ static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
+ call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
+ }
+
+-static void nf_tables_commit_chain_active(struct net *net, struct nft_chain *chain)
++static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
+ {
+ struct nft_rule **g0, **g1;
+ bool next_genbit;
+@@ -6363,11 +6357,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+
+ /* step 2. Make rules_gen_X visible to packet path */
+ list_for_each_entry(table, &net->nft.tables, list) {
+- list_for_each_entry(chain, &table->chains, list) {
+- if (!nft_is_active_next(net, chain))
+- continue;
+- nf_tables_commit_chain_active(net, chain);
+- }
++ list_for_each_entry(chain, &table->chains, list)
++ nf_tables_commit_chain(net, chain);
+ }
+
+ /*
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index ad2fe6a7e47d..29d6fc73caf9 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -501,6 +501,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ void *info)
+ {
+ struct xt_match *match = expr->ops->data;
++ struct module *me = match->me;
+ struct xt_mtdtor_param par;
+
+ par.net = ctx->net;
+@@ -511,7 +512,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ par.match->destroy(&par);
+
+ if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
+- module_put(match->me);
++ module_put(me);
+ }
+
+ static void
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index d6bab8c3cbb0..5fd4c57c79cc 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -214,7 +214,9 @@ static int __init nft_flow_offload_module_init(void)
+ {
+ int err;
+
+- register_netdevice_notifier(&flow_offload_netdev_notifier);
++ err = register_netdevice_notifier(&flow_offload_netdev_notifier);
++ if (err)
++ goto err;
+
+ err = nft_register_expr(&nft_flow_offload_type);
+ if (err < 0)
+@@ -224,6 +226,7 @@ static int __init nft_flow_offload_module_init(void)
+
+ register_expr:
+ unregister_netdevice_notifier(&flow_offload_netdev_notifier);
++err:
+ return err;
+ }
+
+diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
+index dec843cadf46..9e05c86ba5c4 100644
+--- a/net/netfilter/xt_RATEEST.c
++++ b/net/netfilter/xt_RATEEST.c
+@@ -201,18 +201,8 @@ static __net_init int xt_rateest_net_init(struct net *net)
+ return 0;
+ }
+
+-static void __net_exit xt_rateest_net_exit(struct net *net)
+-{
+- struct xt_rateest_net *xn = net_generic(net, xt_rateest_id);
+- int i;
+-
+- for (i = 0; i < ARRAY_SIZE(xn->hash); i++)
+- WARN_ON_ONCE(!hlist_empty(&xn->hash[i]));
+-}
+-
+ static struct pernet_operations xt_rateest_net_ops = {
+ .init = xt_rateest_net_init,
+- .exit = xt_rateest_net_exit,
+ .id = &xt_rateest_id,
+ .size = sizeof(struct xt_rateest_net),
+ };
+diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
+index 3e7d259e5d8d..1ad4017f9b73 100644
+--- a/net/netfilter/xt_hashlimit.c
++++ b/net/netfilter/xt_hashlimit.c
+@@ -295,9 +295,10 @@ static int htable_create(struct net *net, struct hashlimit_cfg3 *cfg,
+
+ /* copy match config into hashtable config */
+ ret = cfg_copy(&hinfo->cfg, (void *)cfg, 3);
+-
+- if (ret)
++ if (ret) {
++ vfree(hinfo);
+ return ret;
++ }
+
+ hinfo->cfg.size = size;
+ if (hinfo->cfg.max == 0)
+@@ -814,7 +815,6 @@ hashlimit_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
+ int ret;
+
+ ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
+-
+ if (ret)
+ return ret;
+
+@@ -830,7 +830,6 @@ hashlimit_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
+ int ret;
+
+ ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
+-
+ if (ret)
+ return ret;
+
+@@ -921,7 +920,6 @@ static int hashlimit_mt_check_v1(const struct xt_mtchk_param *par)
+ return ret;
+
+ ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
+-
+ if (ret)
+ return ret;
+
+@@ -940,7 +938,6 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
+ return ret;
+
+ ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
+-
+ if (ret)
+ return ret;
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index ad18a2052416..74c0f656f28c 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -441,6 +441,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ int count = 1;
+ int rc = NET_XMIT_SUCCESS;
+
++ /* Do not fool qdisc_drop_all() */
++ skb->prev = NULL;
++
+ /* Random duplication */
+ if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor))
+ ++count;
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index 6a28b96e779e..914750b819b2 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -118,9 +118,6 @@ static struct sctp_association *sctp_association_init(
+ asoc->flowlabel = sp->flowlabel;
+ asoc->dscp = sp->dscp;
+
+- /* Initialize default path MTU. */
+- asoc->pathmtu = sp->pathmtu;
+-
+ /* Set association default SACK delay */
+ asoc->sackdelay = msecs_to_jiffies(sp->sackdelay);
+ asoc->sackfreq = sp->sackfreq;
+@@ -252,6 +249,10 @@ static struct sctp_association *sctp_association_init(
+ 0, gfp))
+ goto fail_init;
+
++ /* Initialize default path MTU. */
++ asoc->pathmtu = sp->pathmtu;
++ sctp_assoc_update_frag_point(asoc);
++
+ /* Assume that peer would support both address types unless we are
+ * told otherwise.
+ */
+@@ -434,7 +435,7 @@ static void sctp_association_destroy(struct sctp_association *asoc)
+
+ WARN_ON(atomic_read(&asoc->rmem_alloc));
+
+- kfree(asoc);
++ kfree_rcu(asoc, rcu);
+ SCTP_DBG_OBJCNT_DEC(assoc);
+ }
+
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index 4a4fd1971255..f4ac6c592e13 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -2462,6 +2462,9 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
+ asoc->c.sinit_max_instreams, gfp))
+ goto clean_up;
+
++ /* Update frag_point when stream_interleave may get changed. */
++ sctp_assoc_update_frag_point(asoc);
++
+ if (!asoc->temp && sctp_assoc_set_id(asoc, gfp))
+ goto clean_up;
+
+diff --git a/sound/firewire/fireface/ff-protocol-ff400.c b/sound/firewire/fireface/ff-protocol-ff400.c
+index 64c3cb0fb926..654a50319198 100644
+--- a/sound/firewire/fireface/ff-protocol-ff400.c
++++ b/sound/firewire/fireface/ff-protocol-ff400.c
+@@ -30,7 +30,7 @@ static int ff400_get_clock(struct snd_ff *ff, unsigned int *rate,
+ int err;
+
+ err = snd_fw_transaction(ff->unit, TCODE_READ_QUADLET_REQUEST,
+- FF400_SYNC_STATUS, ®, sizeof(reg), 0);
++ FF400_CLOCK_CONFIG, ®, sizeof(reg), 0);
+ if (err < 0)
+ return err;
+ data = le32_to_cpu(reg);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 22ca1f0a858f..8a3d0694d2e5 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5520,6 +5520,9 @@ enum {
+ ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+ ALC295_FIXUP_HP_AUTO_MUTE,
+ ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE,
++ ALC294_FIXUP_ASUS_MIC,
++ ALC294_FIXUP_ASUS_HEADSET_MIC,
++ ALC294_FIXUP_ASUS_SPK,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6392,6 +6395,8 @@ static const struct hda_fixup alc269_fixups[] = {
+ [ALC285_FIXUP_LENOVO_HEADPHONE_NOISE] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_invalidate_dacs,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_THINKPAD_ACPI
+ },
+ [ALC295_FIXUP_HP_AUTO_MUTE] = {
+ .type = HDA_FIXUP_FUNC,
+@@ -6406,6 +6411,36 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MIC
+ },
++ [ALC294_FIXUP_ASUS_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x13, 0x90a60160 }, /* use as internal mic */
++ { 0x19, 0x04a11120 }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
++ },
++ [ALC294_FIXUP_ASUS_HEADSET_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x01a1113c }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
++ },
++ [ALC294_FIXUP_ASUS_SPK] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* Set EAPD high */
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x40 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x8800 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6548,6 +6583,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
++ SND_PCI_QUIRK(0x1043, 0x14a1, "ASUS UX533FD", ALC294_FIXUP_ASUS_SPK),
+ SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+@@ -7155,6 +7191,14 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC292_STANDARD_PINS,
+ {0x13, 0x90a60140}),
++ SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_MIC,
++ {0x14, 0x90170110},
++ {0x1b, 0x90a70130},
++ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_SPK,
++ {0x12, 0x90a60130},
++ {0x17, 0x90170110},
++ {0x21, 0x04211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC295_STANDARD_PINS,
+ {0x17, 0x21014020},
+@@ -7227,6 +7271,37 @@ static void alc269_fill_coef(struct hda_codec *codec)
+ alc_update_coef_idx(codec, 0x4, 0, 1<<11);
+ }
+
++static void alc294_hp_init(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ int i, val;
++
++ if (!hp_pin)
++ return;
++
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
++
++ msleep(100);
++
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++
++ alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
++ alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
++
++ /* Wait for depop procedure finish */
++ val = alc_read_coefex_idx(codec, 0x58, 0x01);
++ for (i = 0; i < 20 && val & 0x0080; i++) {
++ msleep(50);
++ val = alc_read_coefex_idx(codec, 0x58, 0x01);
++ }
++ /* Set HP depop to auto mode */
++ alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
++ msleep(50);
++}
++
+ /*
+ */
+ static int patch_alc269(struct hda_codec *codec)
+@@ -7352,6 +7427,7 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->codec_variant = ALC269_TYPE_ALC294;
+ spec->gen.mixer_nid = 0; /* ALC2x4 does not have any loopback mixer path */
+ alc_update_coef_idx(codec, 0x6b, 0x0018, (1<<4) | (1<<3)); /* UAJ MIC Vref control by verb */
++ alc294_hp_init(codec);
+ break;
+ case 0x10ec0300:
+ spec->codec_variant = ALC269_TYPE_ALC300;
+@@ -7363,6 +7439,7 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->codec_variant = ALC269_TYPE_ALC700;
+ spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
+ alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
++ alc294_hp_init(codec);
+ break;
+
+ }
+diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
+index 7b8533abf637..b61d518f4fef 100644
+--- a/sound/soc/codecs/hdac_hdmi.c
++++ b/sound/soc/codecs/hdac_hdmi.c
+@@ -2184,11 +2184,6 @@ static int hdac_hdmi_runtime_suspend(struct device *dev)
+ */
+ snd_hdac_codec_read(hdev, hdev->afg, 0, AC_VERB_SET_POWER_STATE,
+ AC_PWRST_D3);
+- err = snd_hdac_display_power(bus, false);
+- if (err < 0) {
+- dev_err(dev, "Cannot turn on display power on i915\n");
+- return err;
+- }
+
+ hlink = snd_hdac_ext_bus_get_link(bus, dev_name(dev));
+ if (!hlink) {
+@@ -2198,7 +2193,11 @@ static int hdac_hdmi_runtime_suspend(struct device *dev)
+
+ snd_hdac_ext_bus_link_put(bus, hlink);
+
+- return 0;
++ err = snd_hdac_display_power(bus, false);
++ if (err < 0)
++ dev_err(dev, "Cannot turn off display power on i915\n");
++
++ return err;
+ }
+
+ static int hdac_hdmi_runtime_resume(struct device *dev)
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index f61656070225..4d3ec295679d 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -765,38 +765,41 @@ static unsigned int wm_adsp_region_to_reg(struct wm_adsp_region const *mem,
+
+ static void wm_adsp2_show_fw_status(struct wm_adsp *dsp)
+ {
+- u16 scratch[4];
++ unsigned int scratch[4];
++ unsigned int addr = dsp->base + ADSP2_SCRATCH0;
++ unsigned int i;
+ int ret;
+
+- ret = regmap_raw_read(dsp->regmap, dsp->base + ADSP2_SCRATCH0,
+- scratch, sizeof(scratch));
+- if (ret) {
+- adsp_err(dsp, "Failed to read SCRATCH regs: %d\n", ret);
+- return;
++ for (i = 0; i < ARRAY_SIZE(scratch); ++i) {
++ ret = regmap_read(dsp->regmap, addr + i, &scratch[i]);
++ if (ret) {
++ adsp_err(dsp, "Failed to read SCRATCH%u: %d\n", i, ret);
++ return;
++ }
+ }
+
+ adsp_dbg(dsp, "FW SCRATCH 0:0x%x 1:0x%x 2:0x%x 3:0x%x\n",
+- be16_to_cpu(scratch[0]),
+- be16_to_cpu(scratch[1]),
+- be16_to_cpu(scratch[2]),
+- be16_to_cpu(scratch[3]));
++ scratch[0], scratch[1], scratch[2], scratch[3]);
+ }
+
+ static void wm_adsp2v2_show_fw_status(struct wm_adsp *dsp)
+ {
+- u32 scratch[2];
++ unsigned int scratch[2];
+ int ret;
+
+- ret = regmap_raw_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH0_1,
+- scratch, sizeof(scratch));
+-
++ ret = regmap_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH0_1,
++ &scratch[0]);
+ if (ret) {
+- adsp_err(dsp, "Failed to read SCRATCH regs: %d\n", ret);
++ adsp_err(dsp, "Failed to read SCRATCH0_1: %d\n", ret);
+ return;
+ }
+
+- scratch[0] = be32_to_cpu(scratch[0]);
+- scratch[1] = be32_to_cpu(scratch[1]);
++ ret = regmap_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH2_3,
++ &scratch[1]);
++ if (ret) {
++ adsp_err(dsp, "Failed to read SCRATCH2_3: %d\n", ret);
++ return;
++ }
+
+ adsp_dbg(dsp, "FW SCRATCH 0:0x%x 1:0x%x 2:0x%x 3:0x%x\n",
+ scratch[0] & 0xFFFF,
+diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
+index 1d17be0f78a0..50f16a0f6535 100644
+--- a/sound/soc/intel/skylake/skl.c
++++ b/sound/soc/intel/skylake/skl.c
+@@ -752,6 +752,12 @@ static void skl_probe_work(struct work_struct *work)
+ }
+ }
+
++ /*
++ * we are done probing so decrement link counts
++ */
++ list_for_each_entry(hlink, &bus->hlink_list, list)
++ snd_hdac_ext_bus_link_put(bus, hlink);
++
+ if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
+ err = snd_hdac_display_power(bus, false);
+ if (err < 0) {
+@@ -761,12 +767,6 @@ static void skl_probe_work(struct work_struct *work)
+ }
+ }
+
+- /*
+- * we are done probing so decrement link counts
+- */
+- list_for_each_entry(hlink, &bus->hlink_list, list)
+- snd_hdac_ext_bus_link_put(bus, hlink);
+-
+ /* configure PM */
+ pm_runtime_put_noidle(bus->dev);
+ pm_runtime_allow(bus->dev);
+diff --git a/sound/soc/omap/omap-abe-twl6040.c b/sound/soc/omap/omap-abe-twl6040.c
+index d5ae9eb8c756..fed45b41f9d3 100644
+--- a/sound/soc/omap/omap-abe-twl6040.c
++++ b/sound/soc/omap/omap-abe-twl6040.c
+@@ -36,6 +36,8 @@
+ #include "../codecs/twl6040.h"
+
+ struct abe_twl6040 {
++ struct snd_soc_card card;
++ struct snd_soc_dai_link dai_links[2];
+ int jack_detection; /* board can detect jack events */
+ int mclk_freq; /* MCLK frequency speed for twl6040 */
+ };
+@@ -208,40 +210,10 @@ static int omap_abe_dmic_init(struct snd_soc_pcm_runtime *rtd)
+ ARRAY_SIZE(dmic_audio_map));
+ }
+
+-/* Digital audio interface glue - connects codec <--> CPU */
+-static struct snd_soc_dai_link abe_twl6040_dai_links[] = {
+- {
+- .name = "TWL6040",
+- .stream_name = "TWL6040",
+- .codec_dai_name = "twl6040-legacy",
+- .codec_name = "twl6040-codec",
+- .init = omap_abe_twl6040_init,
+- .ops = &omap_abe_ops,
+- },
+- {
+- .name = "DMIC",
+- .stream_name = "DMIC Capture",
+- .codec_dai_name = "dmic-hifi",
+- .codec_name = "dmic-codec",
+- .init = omap_abe_dmic_init,
+- .ops = &omap_abe_dmic_ops,
+- },
+-};
+-
+-/* Audio machine driver */
+-static struct snd_soc_card omap_abe_card = {
+- .owner = THIS_MODULE,
+-
+- .dapm_widgets = twl6040_dapm_widgets,
+- .num_dapm_widgets = ARRAY_SIZE(twl6040_dapm_widgets),
+- .dapm_routes = audio_map,
+- .num_dapm_routes = ARRAY_SIZE(audio_map),
+-};
+-
+ static int omap_abe_probe(struct platform_device *pdev)
+ {
+ struct device_node *node = pdev->dev.of_node;
+- struct snd_soc_card *card = &omap_abe_card;
++ struct snd_soc_card *card;
+ struct device_node *dai_node;
+ struct abe_twl6040 *priv;
+ int num_links = 0;
+@@ -252,12 +224,18 @@ static int omap_abe_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
+- card->dev = &pdev->dev;
+-
+ priv = devm_kzalloc(&pdev->dev, sizeof(struct abe_twl6040), GFP_KERNEL);
+ if (priv == NULL)
+ return -ENOMEM;
+
++ card = &priv->card;
++ card->dev = &pdev->dev;
++ card->owner = THIS_MODULE;
++ card->dapm_widgets = twl6040_dapm_widgets;
++ card->num_dapm_widgets = ARRAY_SIZE(twl6040_dapm_widgets);
++ card->dapm_routes = audio_map;
++ card->num_dapm_routes = ARRAY_SIZE(audio_map);
++
+ if (snd_soc_of_parse_card_name(card, "ti,model")) {
+ dev_err(&pdev->dev, "Card name is not provided\n");
+ return -ENODEV;
+@@ -274,14 +252,27 @@ static int omap_abe_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "McPDM node is not provided\n");
+ return -EINVAL;
+ }
+- abe_twl6040_dai_links[0].cpu_of_node = dai_node;
+- abe_twl6040_dai_links[0].platform_of_node = dai_node;
++
++ priv->dai_links[0].name = "DMIC";
++ priv->dai_links[0].stream_name = "TWL6040";
++ priv->dai_links[0].cpu_of_node = dai_node;
++ priv->dai_links[0].platform_of_node = dai_node;
++ priv->dai_links[0].codec_dai_name = "twl6040-legacy";
++ priv->dai_links[0].codec_name = "twl6040-codec";
++ priv->dai_links[0].init = omap_abe_twl6040_init;
++ priv->dai_links[0].ops = &omap_abe_ops;
+
+ dai_node = of_parse_phandle(node, "ti,dmic", 0);
+ if (dai_node) {
+ num_links = 2;
+- abe_twl6040_dai_links[1].cpu_of_node = dai_node;
+- abe_twl6040_dai_links[1].platform_of_node = dai_node;
++ priv->dai_links[1].name = "TWL6040";
++ priv->dai_links[1].stream_name = "DMIC Capture";
++ priv->dai_links[1].cpu_of_node = dai_node;
++ priv->dai_links[1].platform_of_node = dai_node;
++ priv->dai_links[1].codec_dai_name = "dmic-hifi";
++ priv->dai_links[1].codec_name = "dmic-codec";
++ priv->dai_links[1].init = omap_abe_dmic_init;
++ priv->dai_links[1].ops = &omap_abe_dmic_ops;
+ } else {
+ num_links = 1;
+ }
+@@ -300,7 +291,7 @@ static int omap_abe_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
+- card->dai_link = abe_twl6040_dai_links;
++ card->dai_link = priv->dai_links;
+ card->num_links = num_links;
+
+ snd_soc_card_set_drvdata(card, priv);
+diff --git a/sound/soc/omap/omap-dmic.c b/sound/soc/omap/omap-dmic.c
+index fe966272bd0c..cba9645b6487 100644
+--- a/sound/soc/omap/omap-dmic.c
++++ b/sound/soc/omap/omap-dmic.c
+@@ -48,6 +48,8 @@ struct omap_dmic {
+ struct device *dev;
+ void __iomem *io_base;
+ struct clk *fclk;
++ struct pm_qos_request pm_qos_req;
++ int latency;
+ int fclk_freq;
+ int out_freq;
+ int clk_div;
+@@ -124,6 +126,8 @@ static void omap_dmic_dai_shutdown(struct snd_pcm_substream *substream,
+
+ mutex_lock(&dmic->mutex);
+
++ pm_qos_remove_request(&dmic->pm_qos_req);
++
+ if (!dai->active)
+ dmic->active = 0;
+
+@@ -228,6 +232,8 @@ static int omap_dmic_dai_hw_params(struct snd_pcm_substream *substream,
+ /* packet size is threshold * channels */
+ dma_data = snd_soc_dai_get_dma_data(dai, substream);
+ dma_data->maxburst = dmic->threshold * channels;
++ dmic->latency = (OMAP_DMIC_THRES_MAX - dmic->threshold) * USEC_PER_SEC /
++ params_rate(params);
+
+ return 0;
+ }
+@@ -238,6 +244,9 @@ static int omap_dmic_dai_prepare(struct snd_pcm_substream *substream,
+ struct omap_dmic *dmic = snd_soc_dai_get_drvdata(dai);
+ u32 ctrl;
+
++ if (pm_qos_request_active(&dmic->pm_qos_req))
++ pm_qos_update_request(&dmic->pm_qos_req, dmic->latency);
++
+ /* Configure uplink threshold */
+ omap_dmic_write(dmic, OMAP_DMIC_FIFO_CTRL_REG, dmic->threshold);
+
+diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
+index d0ebb6b9bfac..2d6decbfc99e 100644
+--- a/sound/soc/omap/omap-mcbsp.c
++++ b/sound/soc/omap/omap-mcbsp.c
+@@ -308,9 +308,9 @@ static int omap_mcbsp_dai_hw_params(struct snd_pcm_substream *substream,
+ pkt_size = channels;
+ }
+
+- latency = ((((buffer_size - pkt_size) / channels) * 1000)
+- / (params->rate_num / params->rate_den));
+-
++ latency = (buffer_size - pkt_size) / channels;
++ latency = latency * USEC_PER_SEC /
++ (params->rate_num / params->rate_den);
+ mcbsp->latency[substream->stream] = latency;
+
+ omap_mcbsp_set_threshold(substream, pkt_size);
+diff --git a/sound/soc/omap/omap-mcpdm.c b/sound/soc/omap/omap-mcpdm.c
+index 4c1be36c2207..7d5bdc5a2890 100644
+--- a/sound/soc/omap/omap-mcpdm.c
++++ b/sound/soc/omap/omap-mcpdm.c
+@@ -54,6 +54,8 @@ struct omap_mcpdm {
+ unsigned long phys_base;
+ void __iomem *io_base;
+ int irq;
++ struct pm_qos_request pm_qos_req;
++ int latency[2];
+
+ struct mutex mutex;
+
+@@ -277,6 +279,9 @@ static void omap_mcpdm_dai_shutdown(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *dai)
+ {
+ struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
++ int tx = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK);
++ int stream1 = tx ? SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE;
++ int stream2 = tx ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
+
+ mutex_lock(&mcpdm->mutex);
+
+@@ -289,6 +294,14 @@ static void omap_mcpdm_dai_shutdown(struct snd_pcm_substream *substream,
+ }
+ }
+
++ if (mcpdm->latency[stream2])
++ pm_qos_update_request(&mcpdm->pm_qos_req,
++ mcpdm->latency[stream2]);
++ else if (mcpdm->latency[stream1])
++ pm_qos_remove_request(&mcpdm->pm_qos_req);
++
++ mcpdm->latency[stream1] = 0;
++
+ mutex_unlock(&mcpdm->mutex);
+ }
+
+@@ -300,7 +313,7 @@ static int omap_mcpdm_dai_hw_params(struct snd_pcm_substream *substream,
+ int stream = substream->stream;
+ struct snd_dmaengine_dai_dma_data *dma_data;
+ u32 threshold;
+- int channels;
++ int channels, latency;
+ int link_mask = 0;
+
+ channels = params_channels(params);
+@@ -344,14 +357,25 @@ static int omap_mcpdm_dai_hw_params(struct snd_pcm_substream *substream,
+
+ dma_data->maxburst =
+ (MCPDM_DN_THRES_MAX - threshold) * channels;
++ latency = threshold;
+ } else {
+ /* If playback is not running assume a stereo stream to come */
+ if (!mcpdm->config[!stream].link_mask)
+ mcpdm->config[!stream].link_mask = (0x3 << 3);
+
+ dma_data->maxburst = threshold * channels;
++ latency = (MCPDM_DN_THRES_MAX - threshold);
+ }
+
++ /*
++ * The DMA must act to a DMA request within latency time (usec) to avoid
++ * under/overflow
++ */
++ mcpdm->latency[stream] = latency * USEC_PER_SEC / params_rate(params);
++
++ if (!mcpdm->latency[stream])
++ mcpdm->latency[stream] = 10;
++
+ /* Check if we need to restart McPDM with this stream */
+ if (mcpdm->config[stream].link_mask &&
+ mcpdm->config[stream].link_mask != link_mask)
+@@ -366,6 +390,20 @@ static int omap_mcpdm_prepare(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *dai)
+ {
+ struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
++ struct pm_qos_request *pm_qos_req = &mcpdm->pm_qos_req;
++ int tx = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK);
++ int stream1 = tx ? SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE;
++ int stream2 = tx ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
++ int latency = mcpdm->latency[stream2];
++
++ /* Prevent omap hardware from hitting off between FIFO fills */
++ if (!latency || mcpdm->latency[stream1] < latency)
++ latency = mcpdm->latency[stream1];
++
++ if (pm_qos_request_active(pm_qos_req))
++ pm_qos_update_request(pm_qos_req, latency);
++ else if (latency)
++ pm_qos_add_request(pm_qos_req, PM_QOS_CPU_DMA_LATENCY, latency);
+
+ if (!omap_mcpdm_active(mcpdm)) {
+ omap_mcpdm_start(mcpdm);
+@@ -427,6 +465,9 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai)
+ free_irq(mcpdm->irq, (void *)mcpdm);
+ pm_runtime_disable(mcpdm->dev);
+
++ if (pm_qos_request_active(&mcpdm->pm_qos_req))
++ pm_qos_remove_request(&mcpdm->pm_qos_req);
++
+ return 0;
+ }
+
+diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c
+index eb1b9da05dd4..4715527054e5 100644
+--- a/sound/soc/qcom/common.c
++++ b/sound/soc/qcom/common.c
+@@ -13,6 +13,7 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
+ struct device_node *cpu = NULL;
+ struct device *dev = card->dev;
+ struct snd_soc_dai_link *link;
++ struct of_phandle_args args;
+ int ret, num_links;
+
+ ret = snd_soc_of_parse_card_name(card, "model");
+@@ -47,12 +48,14 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
+ goto err;
+ }
+
+- link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
+- if (!link->cpu_of_node) {
++ ret = of_parse_phandle_with_args(cpu, "sound-dai",
++ "#sound-dai-cells", 0, &args);
++ if (ret) {
+ dev_err(card->dev, "error getting cpu phandle\n");
+- ret = -EINVAL;
+ goto err;
+ }
++ link->cpu_of_node = args.np;
++ link->id = args.args[0];
+
+ ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
+ if (ret) {
+diff --git a/sound/soc/qcom/qdsp6/q6afe-dai.c b/sound/soc/qcom/qdsp6/q6afe-dai.c
+index 60ff4a2d3577..8f6c8fc073a9 100644
+--- a/sound/soc/qcom/qdsp6/q6afe-dai.c
++++ b/sound/soc/qcom/qdsp6/q6afe-dai.c
+@@ -1112,204 +1112,204 @@ static int q6afe_of_xlate_dai_name(struct snd_soc_component *component,
+ }
+
+ static const struct snd_soc_dapm_widget q6afe_dai_widgets[] = {
+- SND_SOC_DAPM_AIF_OUT("HDMI_RX", "HDMI Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_RX", "Slimbus Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_RX", "Slimbus1 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_RX", "Slimbus2 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_RX", "Slimbus3 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_RX", "Slimbus4 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_RX", "Slimbus5 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_RX", "Slimbus6 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SLIMBUS_0_TX", "Slimbus Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SLIMBUS_1_TX", "Slimbus1 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SLIMBUS_2_TX", "Slimbus2 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SLIMBUS_3_TX", "Slimbus3 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SLIMBUS_4_TX", "Slimbus4 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SLIMBUS_5_TX", "Slimbus5 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SLIMBUS_6_TX", "Slimbus6 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUAT_MI2S_RX", "Quaternary MI2S Playback",
++ SND_SOC_DAPM_AIF_IN("HDMI_RX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_IN("SLIMBUS_0_RX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_IN("SLIMBUS_1_RX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_IN("SLIMBUS_2_RX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_IN("SLIMBUS_3_RX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_IN("SLIMBUS_4_RX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_IN("SLIMBUS_5_RX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_IN("SLIMBUS_6_RX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_TX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_TX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_TX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_TX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_TX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_TX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_TX", NULL, 0, 0, 0, 0),
++ SND_SOC_DAPM_AIF_IN("QUAT_MI2S_RX", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUAT_MI2S_TX", "Quaternary MI2S Capture",
++ SND_SOC_DAPM_AIF_OUT("QUAT_MI2S_TX", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("TERT_MI2S_RX", "Tertiary MI2S Playback",
++ SND_SOC_DAPM_AIF_IN("TERT_MI2S_RX", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("TERT_MI2S_TX", "Tertiary MI2S Capture",
++ SND_SOC_DAPM_AIF_OUT("TERT_MI2S_TX", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SEC_MI2S_RX", "Secondary MI2S Playback",
++ SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SEC_MI2S_TX", "Secondary MI2S Capture",
++ SND_SOC_DAPM_AIF_OUT("SEC_MI2S_TX", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SEC_MI2S_RX_SD1",
++ SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX_SD1",
+ "Secondary MI2S Playback SD1",
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("PRI_MI2S_RX", "Primary MI2S Playback",
++ SND_SOC_DAPM_AIF_IN("PRI_MI2S_RX", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("PRI_MI2S_TX", "Primary MI2S Capture",
++ SND_SOC_DAPM_AIF_OUT("PRI_MI2S_TX", NULL,
+ 0, 0, 0, 0),
+
+- SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_0", "Primary TDM0 Playback",
++ SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_0", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_1", "Primary TDM1 Playback",
++ SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_1", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_2", "Primary TDM2 Playback",
++ SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_2", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_3", "Primary TDM3 Playback",
++ SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_3", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_4", "Primary TDM4 Playback",
++ SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_4", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_5", "Primary TDM5 Playback",
++ SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_5", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_6", "Primary TDM6 Playback",
++ SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_6", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_RX_7", "Primary TDM7 Playback",
++ SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_7", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_0", "Primary TDM0 Capture",
++ SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_0", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_1", "Primary TDM1 Capture",
++ SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_1", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_2", "Primary TDM2 Capture",
++ SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_2", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_3", "Primary TDM3 Capture",
++ SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_3", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_4", "Primary TDM4 Capture",
++ SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_4", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_5", "Primary TDM5 Capture",
++ SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_5", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_6", "Primary TDM6 Capture",
++ SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_6", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_TX_7", "Primary TDM7 Capture",
++ SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_7", NULL,
+ 0, 0, 0, 0),
+
+- SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_0", "Secondary TDM0 Playback",
++ SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_0", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_1", "Secondary TDM1 Playback",
++ SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_1", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_2", "Secondary TDM2 Playback",
++ SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_2", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_3", "Secondary TDM3 Playback",
++ SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_3", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_4", "Secondary TDM4 Playback",
++ SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_4", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_5", "Secondary TDM5 Playback",
++ SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_5", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_6", "Secondary TDM6 Playback",
++ SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_6", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("SEC_TDM_RX_7", "Secondary TDM7 Playback",
++ SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_7", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_0", "Secondary TDM0 Capture",
++ SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_0", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_1", "Secondary TDM1 Capture",
++ SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_1", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_2", "Secondary TDM2 Capture",
++ SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_2", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_3", "Secondary TDM3 Capture",
++ SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_3", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_4", "Secondary TDM4 Capture",
++ SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_4", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_5", "Secondary TDM5 Capture",
++ SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_5", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_6", "Secondary TDM6 Capture",
++ SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_6", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("SEC_TDM_TX_7", "Secondary TDM7 Capture",
++ SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_7", NULL,
+ 0, 0, 0, 0),
+
+- SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_0", "Tertiary TDM0 Playback",
++ SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_0", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_1", "Tertiary TDM1 Playback",
++ SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_1", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_2", "Tertiary TDM2 Playback",
++ SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_2", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_3", "Tertiary TDM3 Playback",
++ SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_3", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_4", "Tertiary TDM4 Playback",
++ SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_4", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_5", "Tertiary TDM5 Playback",
++ SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_5", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_6", "Tertiary TDM6 Playback",
++ SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_6", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("TERT_TDM_RX_7", "Tertiary TDM7 Playback",
++ SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_7", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_0", "Tertiary TDM0 Capture",
++ SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_0", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_1", "Tertiary TDM1 Capture",
++ SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_1", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_2", "Tertiary TDM2 Capture",
++ SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_2", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_3", "Tertiary TDM3 Capture",
++ SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_3", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_4", "Tertiary TDM4 Capture",
++ SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_4", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_5", "Tertiary TDM5 Capture",
++ SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_5", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_6", "Tertiary TDM6 Capture",
++ SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_6", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("TERT_TDM_TX_7", "Tertiary TDM7 Capture",
++ SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_7", NULL,
+ 0, 0, 0, 0),
+
+- SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_0", "Quaternary TDM0 Playback",
++ SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_0", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_1", "Quaternary TDM1 Playback",
++ SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_1", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_2", "Quaternary TDM2 Playback",
++ SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_2", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_3", "Quaternary TDM3 Playback",
++ SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_3", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_4", "Quaternary TDM4 Playback",
++ SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_4", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_5", "Quaternary TDM5 Playback",
++ SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_5", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_6", "Quaternary TDM6 Playback",
++ SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_6", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUAT_TDM_RX_7", "Quaternary TDM7 Playback",
++ SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_7", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_0", "Quaternary TDM0 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_0", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_1", "Quaternary TDM1 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_1", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_2", "Quaternary TDM2 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_2", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_3", "Quaternary TDM3 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_3", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_4", "Quaternary TDM4 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_4", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_5", "Quaternary TDM5 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_5", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_6", "Quaternary TDM6 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_6", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUAT_TDM_TX_7", "Quaternary TDM7 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_7", NULL,
+ 0, 0, 0, 0),
+
+- SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_0", "Quinary TDM0 Playback",
++ SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_0", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_1", "Quinary TDM1 Playback",
++ SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_1", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_2", "Quinary TDM2 Playback",
++ SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_2", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_3", "Quinary TDM3 Playback",
++ SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_3", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_4", "Quinary TDM4 Playback",
++ SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_4", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_5", "Quinary TDM5 Playback",
++ SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_5", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_6", "Quinary TDM6 Playback",
++ SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_6", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("QUIN_TDM_RX_7", "Quinary TDM7 Playback",
++ SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_7", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_0", "Quinary TDM0 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_0", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_1", "Quinary TDM1 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_1", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_2", "Quinary TDM2 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_2", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_3", "Quinary TDM3 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_3", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_4", "Quinary TDM4 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_4", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_5", "Quinary TDM5 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_5", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_6", "Quinary TDM6 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_6", NULL,
+ 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("QUIN_TDM_TX_7", "Quinary TDM7 Capture",
++ SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_7", NULL,
+ 0, 0, 0, 0),
+ };
+
+diff --git a/sound/soc/qcom/qdsp6/q6afe.c b/sound/soc/qcom/qdsp6/q6afe.c
+index 000775b4bba8..829b5e987b2a 100644
+--- a/sound/soc/qcom/qdsp6/q6afe.c
++++ b/sound/soc/qcom/qdsp6/q6afe.c
+@@ -49,14 +49,14 @@
+ #define AFE_PORT_I2S_SD1 0x2
+ #define AFE_PORT_I2S_SD2 0x3
+ #define AFE_PORT_I2S_SD3 0x4
+-#define AFE_PORT_I2S_SD0_MASK BIT(0x1)
+-#define AFE_PORT_I2S_SD1_MASK BIT(0x2)
+-#define AFE_PORT_I2S_SD2_MASK BIT(0x3)
+-#define AFE_PORT_I2S_SD3_MASK BIT(0x4)
+-#define AFE_PORT_I2S_SD0_1_MASK GENMASK(2, 1)
+-#define AFE_PORT_I2S_SD2_3_MASK GENMASK(4, 3)
+-#define AFE_PORT_I2S_SD0_1_2_MASK GENMASK(3, 1)
+-#define AFE_PORT_I2S_SD0_1_2_3_MASK GENMASK(4, 1)
++#define AFE_PORT_I2S_SD0_MASK BIT(0x0)
++#define AFE_PORT_I2S_SD1_MASK BIT(0x1)
++#define AFE_PORT_I2S_SD2_MASK BIT(0x2)
++#define AFE_PORT_I2S_SD3_MASK BIT(0x3)
++#define AFE_PORT_I2S_SD0_1_MASK GENMASK(1, 0)
++#define AFE_PORT_I2S_SD2_3_MASK GENMASK(3, 2)
++#define AFE_PORT_I2S_SD0_1_2_MASK GENMASK(2, 0)
++#define AFE_PORT_I2S_SD0_1_2_3_MASK GENMASK(3, 0)
+ #define AFE_PORT_I2S_QUAD01 0x5
+ #define AFE_PORT_I2S_QUAD23 0x6
+ #define AFE_PORT_I2S_6CHS 0x7
+diff --git a/sound/soc/rockchip/rockchip_pcm.c b/sound/soc/rockchip/rockchip_pcm.c
+index f77538319221..7029e0b85f9e 100644
+--- a/sound/soc/rockchip/rockchip_pcm.c
++++ b/sound/soc/rockchip/rockchip_pcm.c
+@@ -32,6 +32,7 @@ static const struct snd_pcm_hardware snd_rockchip_hardware = {
+
+ static const struct snd_dmaengine_pcm_config rk_dmaengine_pcm_config = {
+ .pcm_hardware = &snd_rockchip_hardware,
++ .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
+ .prealloc_buffer_size = 32 * 1024,
+ };
+
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index 3f880ec66459..a566dae3ec8a 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -283,7 +283,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
+ if (rsnd_ssi_is_multi_slave(mod, io))
+ return 0;
+
+- if (ssi->rate) {
++ if (ssi->usrcnt > 1) {
+ if (ssi->rate != rate) {
+ dev_err(dev, "SSI parent/child should use same rate\n");
+ return -EINVAL;
+diff --git a/sound/soc/soc-acpi.c b/sound/soc/soc-acpi.c
+index b8e72b52db30..4fb29f0e561e 100644
+--- a/sound/soc/soc-acpi.c
++++ b/sound/soc/soc-acpi.c
+@@ -10,11 +10,17 @@ struct snd_soc_acpi_mach *
+ snd_soc_acpi_find_machine(struct snd_soc_acpi_mach *machines)
+ {
+ struct snd_soc_acpi_mach *mach;
++ struct snd_soc_acpi_mach *mach_alt;
+
+ for (mach = machines; mach->id[0]; mach++) {
+ if (acpi_dev_present(mach->id, NULL, -1)) {
+- if (mach->machine_quirk)
+- mach = mach->machine_quirk(mach);
++ if (mach->machine_quirk) {
++ mach_alt = mach->machine_quirk(mach);
++ if (!mach_alt)
++ continue; /* not full match, ignore */
++ mach = mach_alt;
++ }
++
+ return mach;
+ }
+ }
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 473eefe8658e..62aa320c2070 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -2126,6 +2126,7 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
+ }
+
+ card->instantiated = 1;
++ dapm_mark_endpoints_dirty(card);
+ snd_soc_dapm_sync(&card->dapm);
+ mutex_unlock(&card->mutex);
+ mutex_unlock(&client_mutex);
+diff --git a/sound/soc/sunxi/sun8i-codec.c b/sound/soc/sunxi/sun8i-codec.c
+index fb37dd927e33..bf615fa16dc8 100644
+--- a/sound/soc/sunxi/sun8i-codec.c
++++ b/sound/soc/sunxi/sun8i-codec.c
+@@ -589,16 +589,10 @@ err_pm_disable:
+
+ static int sun8i_codec_remove(struct platform_device *pdev)
+ {
+- struct snd_soc_card *card = platform_get_drvdata(pdev);
+- struct sun8i_codec *scodec = snd_soc_card_get_drvdata(card);
+-
+ pm_runtime_disable(&pdev->dev);
+ if (!pm_runtime_status_suspended(&pdev->dev))
+ sun8i_codec_runtime_suspend(&pdev->dev);
+
+- clk_disable_unprepare(scodec->clk_module);
+- clk_disable_unprepare(scodec->clk_bus);
+-
+ return 0;
+ }
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 08aa78007020..1c73b9ed44a6 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3387,5 +3387,15 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ .ifnum = QUIRK_NO_INTERFACE
+ }
+ },
++/* Dell WD19 Dock */
++{
++ USB_DEVICE(0x0bda, 0x402e),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .vendor_name = "Dell",
++ .product_name = "WD19 Dock",
++ .profile_name = "Dell-WD15-Dock",
++ .ifnum = QUIRK_NO_INTERFACE
++ }
++},
+
+ #undef USB_DEVICE_VENDOR_SPEC
+diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
+index b3a0709ea7ed..fcaf00621102 100644
+--- a/tools/bpf/bpftool/common.c
++++ b/tools/bpf/bpftool/common.c
+@@ -304,7 +304,7 @@ char *get_fdinfo(int fd, const char *key)
+ return NULL;
+ }
+
+- while ((n = getline(&line, &line_n, fdi))) {
++ while ((n = getline(&line, &line_n, fdi)) > 0) {
+ char *value;
+ int len;
+
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index dce960d22106..0de024a6cc2b 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -749,6 +749,7 @@ static int do_load(int argc, char **argv)
+ }
+ NEXT_ARG();
+ } else if (is_prefix(*argv, "map")) {
++ void *new_map_replace;
+ char *endptr, *name;
+ int fd;
+
+@@ -782,12 +783,15 @@ static int do_load(int argc, char **argv)
+ if (fd < 0)
+ goto err_free_reuse_maps;
+
+- map_replace = reallocarray(map_replace, old_map_fds + 1,
+- sizeof(*map_replace));
+- if (!map_replace) {
++ new_map_replace = reallocarray(map_replace,
++ old_map_fds + 1,
++ sizeof(*map_replace));
++ if (!new_map_replace) {
+ p_err("mem alloc failed");
+ goto err_free_reuse_maps;
+ }
++ map_replace = new_map_replace;
++
+ map_replace[old_map_fds].idx = idx;
+ map_replace[old_map_fds].name = name;
+ map_replace[old_map_fds].fd = fd;
+diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
+index 7ec85d567598..b75d004f6482 100644
+--- a/tools/objtool/elf.c
++++ b/tools/objtool/elf.c
+@@ -31,6 +31,8 @@
+ #include "elf.h"
+ #include "warn.h"
+
++#define MAX_NAME_LEN 128
++
+ struct section *find_section_by_name(struct elf *elf, const char *name)
+ {
+ struct section *sec;
+@@ -298,6 +300,8 @@ static int read_symbols(struct elf *elf)
+ /* Create parent/child links for any cold subfunctions */
+ list_for_each_entry(sec, &elf->sections, list) {
+ list_for_each_entry(sym, &sec->symbol_list, list) {
++ char pname[MAX_NAME_LEN + 1];
++ size_t pnamelen;
+ if (sym->type != STT_FUNC)
+ continue;
+ sym->pfunc = sym->cfunc = sym;
+@@ -305,14 +309,21 @@ static int read_symbols(struct elf *elf)
+ if (!coldstr)
+ continue;
+
+- coldstr[0] = '\0';
+- pfunc = find_symbol_by_name(elf, sym->name);
+- coldstr[0] = '.';
++ pnamelen = coldstr - sym->name;
++ if (pnamelen > MAX_NAME_LEN) {
++ WARN("%s(): parent function name exceeds maximum length of %d characters",
++ sym->name, MAX_NAME_LEN);
++ return -1;
++ }
++
++ strncpy(pname, sym->name, pnamelen);
++ pname[pnamelen] = '\0';
++ pfunc = find_symbol_by_name(elf, pname);
+
+ if (!pfunc) {
+ WARN("%s(): can't find parent function",
+ sym->name);
+- goto err;
++ return -1;
+ }
+
+ sym->pfunc = pfunc;
+diff --git a/tools/perf/tests/attr/base-record b/tools/perf/tests/attr/base-record
+index 37940665f736..efd0157b9d22 100644
+--- a/tools/perf/tests/attr/base-record
++++ b/tools/perf/tests/attr/base-record
+@@ -9,7 +9,7 @@ size=112
+ config=0
+ sample_period=*
+ sample_type=263
+-read_format=0
++read_format=0|4
+ disabled=1
+ inherit=1
+ pinned=0
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 03a72310315f..e7dbdcc8d465 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -1088,7 +1088,7 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
+ attr->exclude_user = 1;
+ }
+
+- if (evsel->own_cpus)
++ if (evsel->own_cpus || evsel->unit)
+ evsel->attr.read_format |= PERF_FORMAT_ID;
+
+ /*
+diff --git a/tools/perf/util/namespaces.c b/tools/perf/util/namespaces.c
+index cf8bd123cf73..aed170bd4384 100644
+--- a/tools/perf/util/namespaces.c
++++ b/tools/perf/util/namespaces.c
+@@ -18,6 +18,7 @@
+ #include <stdio.h>
+ #include <string.h>
+ #include <unistd.h>
++#include <asm/bug.h>
+
+ struct namespaces *namespaces__new(struct namespaces_event *event)
+ {
+@@ -186,6 +187,7 @@ void nsinfo__mountns_enter(struct nsinfo *nsi,
+ char curpath[PATH_MAX];
+ int oldns = -1;
+ int newns = -1;
++ char *oldcwd = NULL;
+
+ if (nc == NULL)
+ return;
+@@ -199,9 +201,13 @@ void nsinfo__mountns_enter(struct nsinfo *nsi,
+ if (snprintf(curpath, PATH_MAX, "/proc/self/ns/mnt") >= PATH_MAX)
+ return;
+
++ oldcwd = get_current_dir_name();
++ if (!oldcwd)
++ return;
++
+ oldns = open(curpath, O_RDONLY);
+ if (oldns < 0)
+- return;
++ goto errout;
+
+ newns = open(nsi->mntns_path, O_RDONLY);
+ if (newns < 0)
+@@ -210,11 +216,13 @@ void nsinfo__mountns_enter(struct nsinfo *nsi,
+ if (setns(newns, CLONE_NEWNS) < 0)
+ goto errout;
+
++ nc->oldcwd = oldcwd;
+ nc->oldns = oldns;
+ nc->newns = newns;
+ return;
+
+ errout:
++ free(oldcwd);
+ if (oldns > -1)
+ close(oldns);
+ if (newns > -1)
+@@ -223,11 +231,16 @@ errout:
+
+ void nsinfo__mountns_exit(struct nscookie *nc)
+ {
+- if (nc == NULL || nc->oldns == -1 || nc->newns == -1)
++ if (nc == NULL || nc->oldns == -1 || nc->newns == -1 || !nc->oldcwd)
+ return;
+
+ setns(nc->oldns, CLONE_NEWNS);
+
++ if (nc->oldcwd) {
++ WARN_ON_ONCE(chdir(nc->oldcwd));
++ zfree(&nc->oldcwd);
++ }
++
+ if (nc->oldns > -1) {
+ close(nc->oldns);
+ nc->oldns = -1;
+diff --git a/tools/perf/util/namespaces.h b/tools/perf/util/namespaces.h
+index cae1a9a39722..d5f46c09ea31 100644
+--- a/tools/perf/util/namespaces.h
++++ b/tools/perf/util/namespaces.h
+@@ -38,6 +38,7 @@ struct nsinfo {
+ struct nscookie {
+ int oldns;
+ int newns;
++ char *oldcwd;
+ };
+
+ int nsinfo__init(struct nsinfo *nsi);
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index f1fe492c8e17..f0017c831e57 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -24,6 +24,7 @@ TARGETS += memory-hotplug
+ TARGETS += mount
+ TARGETS += mqueue
+ TARGETS += net
++TARGETS += netfilter
+ TARGETS += nsfs
+ TARGETS += powerpc
+ TARGETS += proc
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index 67c412d19c09..2bde9ee04db7 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -12511,6 +12511,25 @@ static struct bpf_test tests[] = {
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .result = ACCEPT,
+ },
++ {
++ "calls: ctx read at start of subprog",
++ .insns = {
++ BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
++ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
++ BPF_JMP_REG(BPF_JSGT, BPF_REG_0, BPF_REG_0, 0),
++ BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
++ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
++ BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
++ BPF_EXIT_INSN(),
++ BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0),
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_EXIT_INSN(),
++ },
++ .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
++ .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
++ .result_unpriv = REJECT,
++ .result = ACCEPT,
++ },
+ };
+
+ static int probe_filter_length(const struct bpf_insn *fp)
+diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
+new file mode 100644
+index 000000000000..47ed6cef93fb
+--- /dev/null
++++ b/tools/testing/selftests/netfilter/Makefile
+@@ -0,0 +1,6 @@
++# SPDX-License-Identifier: GPL-2.0
++# Makefile for netfilter selftests
++
++TEST_PROGS := nft_trans_stress.sh
++
++include ../lib.mk
+diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config
+new file mode 100644
+index 000000000000..1017313e41a8
+--- /dev/null
++++ b/tools/testing/selftests/netfilter/config
+@@ -0,0 +1,2 @@
++CONFIG_NET_NS=y
++NF_TABLES_INET=y
+diff --git a/tools/testing/selftests/netfilter/nft_trans_stress.sh b/tools/testing/selftests/netfilter/nft_trans_stress.sh
+new file mode 100755
+index 000000000000..f1affd12c4b1
+--- /dev/null
++++ b/tools/testing/selftests/netfilter/nft_trans_stress.sh
+@@ -0,0 +1,78 @@
++#!/bin/bash
++#
++# This test is for stress-testing the nf_tables config plane path vs.
++# packet path processing: Make sure we never release rules that are
++# still visible to other cpus.
++#
++# set -e
++
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++
++testns=testns1
++tables="foo bar baz quux"
++
++nft --version > /dev/null 2>&1
++if [ $? -ne 0 ];then
++ echo "SKIP: Could not run test without nft tool"
++ exit $ksft_skip
++fi
++
++ip -Version > /dev/null 2>&1
++if [ $? -ne 0 ];then
++ echo "SKIP: Could not run test without ip tool"
++ exit $ksft_skip
++fi
++
++tmp=$(mktemp)
++
++for table in $tables; do
++ echo add table inet "$table" >> "$tmp"
++ echo flush table inet "$table" >> "$tmp"
++
++ echo "add chain inet $table INPUT { type filter hook input priority 0; }" >> "$tmp"
++ echo "add chain inet $table OUTPUT { type filter hook output priority 0; }" >> "$tmp"
++ for c in $(seq 1 400); do
++ chain=$(printf "chain%03u" "$c")
++ echo "add chain inet $table $chain" >> "$tmp"
++ done
++
++ for c in $(seq 1 400); do
++ chain=$(printf "chain%03u" "$c")
++ for BASE in INPUT OUTPUT; do
++ echo "add rule inet $table $BASE counter jump $chain" >> "$tmp"
++ done
++ echo "add rule inet $table $chain counter return" >> "$tmp"
++ done
++done
++
++ip netns add "$testns"
++ip -netns "$testns" link set lo up
++
++lscpu | grep ^CPU\(s\): | ( read cpu cpunum ;
++cpunum=$((cpunum-1))
++for i in $(seq 0 $cpunum);do
++ mask=$(printf 0x%x $((1<<$i)))
++ ip netns exec "$testns" taskset $mask ping -4 127.0.0.1 -fq > /dev/null &
++ ip netns exec "$testns" taskset $mask ping -6 ::1 -fq > /dev/null &
++done)
++
++sleep 1
++
++for i in $(seq 1 10) ; do ip netns exec "$testns" nft -f "$tmp" & done
++
++for table in $tables;do
++ randsleep=$((RANDOM%10))
++ sleep $randsleep
++ ip netns exec "$testns" nft delete table inet $table 2>/dev/null
++done
++
++randsleep=$((RANDOM%10))
++sleep $randsleep
++
++pkill -9 ping
++
++wait
++
++rm -f "$tmp"
++ip netns del "$testns"
+diff --git a/tools/testing/selftests/proc/proc-self-map-files-002.c b/tools/testing/selftests/proc/proc-self-map-files-002.c
+index 6f1f4a6e1ecb..85744425b08d 100644
+--- a/tools/testing/selftests/proc/proc-self-map-files-002.c
++++ b/tools/testing/selftests/proc/proc-self-map-files-002.c
+@@ -13,7 +13,7 @@
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+-/* Test readlink /proc/self/map_files/... with address 0. */
++/* Test readlink /proc/self/map_files/... with minimum address. */
+ #include <errno.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+@@ -47,6 +47,11 @@ static void fail(const char *fmt, unsigned long a, unsigned long b)
+ int main(void)
+ {
+ const unsigned int PAGE_SIZE = sysconf(_SC_PAGESIZE);
++#ifdef __arm__
++ unsigned long va = 2 * PAGE_SIZE;
++#else
++ unsigned long va = 0;
++#endif
+ void *p;
+ int fd;
+ unsigned long a, b;
+@@ -55,7 +60,7 @@ int main(void)
+ if (fd == -1)
+ return 1;
+
+- p = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE|MAP_FIXED, fd, 0);
++ p = mmap((void *)va, PAGE_SIZE, PROT_NONE, MAP_PRIVATE|MAP_FILE|MAP_FIXED, fd, 0);
+ if (p == MAP_FAILED) {
+ if (errno == EPERM)
+ return 2;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-12-19 19:09 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-12-19 19:09 UTC (permalink / raw
To: gentoo-commits
commit: ddb74622bdf265fef8705b51a9ada6be46b68fac
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 19 19:09:09 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 19 19:09:09 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ddb74622
proj/linux-patches: Linux patch 4.19.11
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1010_linux-4.19.11.patch | 1600 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1604 insertions(+)
diff --git a/0000_README b/0000_README
index 59408e2..72bf8ce 100644
--- a/0000_README
+++ b/0000_README
@@ -83,6 +83,10 @@ Patch: 1009_linux-4.19.10.patch
From: http://www.kernel.org
Desc: Linux 4.19.10
+Patch: 1010_linux-4.19.11.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.11
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1010_linux-4.19.11.patch b/1010_linux-4.19.11.patch
new file mode 100644
index 0000000..3742acb
--- /dev/null
+++ b/1010_linux-4.19.11.patch
@@ -0,0 +1,1600 @@
+diff --git a/Makefile b/Makefile
+index 36d9de42def3..676155d4dc3e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 10
++SUBLEVEL = 11
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
+index 4adb85e66be3..93762244be7f 100644
+--- a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
++++ b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
+@@ -31,7 +31,7 @@
+
+ wifi_pwrseq: wifi-pwrseq {
+ compatible = "mmc-pwrseq-simple";
+- reset-gpios = <&expgpio 1 GPIO_ACTIVE_HIGH>;
++ reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
+index c318bcbc6ba7..89e6fd547c75 100644
+--- a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
++++ b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
+@@ -26,7 +26,7 @@
+
+ wifi_pwrseq: wifi-pwrseq {
+ compatible = "mmc-pwrseq-simple";
+- reset-gpios = <&expgpio 1 GPIO_ACTIVE_HIGH>;
++ reset-gpios = <&expgpio 1 GPIO_ACTIVE_LOW>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/qcom-apq8064-arrow-sd-600eval.dts b/arch/arm/boot/dts/qcom-apq8064-arrow-sd-600eval.dts
+index 76b56eafaab9..f714a20649d7 100644
+--- a/arch/arm/boot/dts/qcom-apq8064-arrow-sd-600eval.dts
++++ b/arch/arm/boot/dts/qcom-apq8064-arrow-sd-600eval.dts
+@@ -387,6 +387,11 @@
+ hpd-gpio = <&tlmm_pinmux 72 GPIO_ACTIVE_HIGH>;
+
+ ports {
++ port@0 {
++ endpoint {
++ remote-endpoint = <&mdp_dtv_out>;
++ };
++ };
+ port@1 {
+ endpoint {
+ remote-endpoint = <&hdmi_con>;
+diff --git a/arch/arm/mach-mmp/cputype.h b/arch/arm/mach-mmp/cputype.h
+index 446edaeb78a7..a96abcf521b4 100644
+--- a/arch/arm/mach-mmp/cputype.h
++++ b/arch/arm/mach-mmp/cputype.h
+@@ -44,10 +44,12 @@ static inline int cpu_is_pxa910(void)
+ #define cpu_is_pxa910() (0)
+ #endif
+
+-#ifdef CONFIG_CPU_MMP2
++#if defined(CONFIG_CPU_MMP2) || defined(CONFIG_MACH_MMP2_DT)
+ static inline int cpu_is_mmp2(void)
+ {
+- return (((read_cpuid_id() >> 8) & 0xff) == 0x58);
++ return (((read_cpuid_id() >> 8) & 0xff) == 0x58) &&
++ (((mmp_chip_id & 0xfff) == 0x410) ||
++ ((mmp_chip_id & 0xfff) == 0x610));
+ }
+ #else
+ #define cpu_is_mmp2() (0)
+diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
+index 072c51fb07d7..c389f2bef938 100644
+--- a/arch/arm64/mm/dma-mapping.c
++++ b/arch/arm64/mm/dma-mapping.c
+@@ -587,9 +587,9 @@ static void *__iommu_alloc_attrs(struct device *dev, size_t size,
+ prot,
+ __builtin_return_address(0));
+ if (addr) {
+- memset(addr, 0, size);
+ if (!coherent)
+ __dma_flush_area(page_to_virt(page), iosize);
++ memset(addr, 0, size);
+ } else {
+ iommu_dma_unmap_page(dev, *handle, iosize, 0, attrs);
+ dma_release_from_contiguous(dev, page,
+diff --git a/arch/powerpc/kernel/legacy_serial.c b/arch/powerpc/kernel/legacy_serial.c
+index 33b34a58fc62..5b9dce17f0c9 100644
+--- a/arch/powerpc/kernel/legacy_serial.c
++++ b/arch/powerpc/kernel/legacy_serial.c
+@@ -372,6 +372,8 @@ void __init find_legacy_serial_ports(void)
+
+ /* Now find out if one of these is out firmware console */
+ path = of_get_property(of_chosen, "linux,stdout-path", NULL);
++ if (path == NULL)
++ path = of_get_property(of_chosen, "stdout-path", NULL);
+ if (path != NULL) {
+ stdout = of_find_node_by_path(path);
+ if (stdout)
+@@ -595,8 +597,10 @@ static int __init check_legacy_serial_console(void)
+ /* We are getting a weird phandle from OF ... */
+ /* ... So use the full path instead */
+ name = of_get_property(of_chosen, "linux,stdout-path", NULL);
++ if (name == NULL)
++ name = of_get_property(of_chosen, "stdout-path", NULL);
+ if (name == NULL) {
+- DBG(" no linux,stdout-path !\n");
++ DBG(" no stdout-path !\n");
+ return -ENODEV;
+ }
+ prom_stdout = of_find_node_by_path(name);
+diff --git a/arch/powerpc/kernel/msi.c b/arch/powerpc/kernel/msi.c
+index dab616a33b8d..f2197654be07 100644
+--- a/arch/powerpc/kernel/msi.c
++++ b/arch/powerpc/kernel/msi.c
+@@ -34,5 +34,10 @@ void arch_teardown_msi_irqs(struct pci_dev *dev)
+ {
+ struct pci_controller *phb = pci_bus_to_host(dev->bus);
+
+- phb->controller_ops.teardown_msi_irqs(dev);
++ /*
++ * We can be called even when arch_setup_msi_irqs() returns -ENOSYS,
++ * so check the pointer again.
++ */
++ if (phb->controller_ops.teardown_msi_irqs)
++ phb->controller_ops.teardown_msi_irqs(dev);
+ }
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 9298f0f3817a..b84f61bc5e7a 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -223,9 +223,6 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
+
+ # Avoid indirect branches in kernel to deal with Spectre
+ ifdef CONFIG_RETPOLINE
+-ifeq ($(RETPOLINE_CFLAGS),)
+- $(error You are building kernel with non-retpoline compiler, please update your compiler.)
+-endif
+ KBUILD_CFLAGS += $(RETPOLINE_CFLAGS)
+ endif
+
+@@ -303,6 +300,13 @@ ifndef CC_HAVE_ASM_GOTO
+ @echo Compiler lacks asm-goto support.
+ @exit 1
+ endif
++ifdef CONFIG_RETPOLINE
++ifeq ($(RETPOLINE_CFLAGS),)
++ @echo "You are building kernel with non-retpoline compiler." >&2
++ @echo "Please update your compiler." >&2
++ @false
++endif
++endif
+
+ archclean:
+ $(Q)rm -rf $(objtree)/arch/i386
+diff --git a/block/bio.c b/block/bio.c
+index c4ef8aa46452..55a5386fd431 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -1262,7 +1262,8 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
+ if (ret)
+ goto cleanup;
+ } else {
+- zero_fill_bio(bio);
++ if (bmd->is_our_pages)
++ zero_fill_bio(bio);
+ iov_iter_advance(iter, bio->bi_iter.bi_size);
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+index 8816c697b205..387f1cf1dc20 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+@@ -330,7 +330,9 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
+ case CHIP_TOPAZ:
+ if (((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0x81)) ||
+ ((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0x83)) ||
+- ((adev->pdev->device == 0x6907) && (adev->pdev->revision == 0x87))) {
++ ((adev->pdev->device == 0x6907) && (adev->pdev->revision == 0x87)) ||
++ ((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0xD1)) ||
++ ((adev->pdev->device == 0x6900) && (adev->pdev->revision == 0xD3))) {
+ info->is_kicker = true;
+ strcpy(fw_name, "amdgpu/topaz_k_smc.bin");
+ } else
+@@ -351,7 +353,6 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
+ if (type == CGS_UCODE_ID_SMU) {
+ if (((adev->pdev->device == 0x67ef) &&
+ ((adev->pdev->revision == 0xe0) ||
+- (adev->pdev->revision == 0xe2) ||
+ (adev->pdev->revision == 0xe5))) ||
+ ((adev->pdev->device == 0x67ff) &&
+ ((adev->pdev->revision == 0xcf) ||
+@@ -359,8 +360,13 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
+ (adev->pdev->revision == 0xff)))) {
+ info->is_kicker = true;
+ strcpy(fw_name, "amdgpu/polaris11_k_smc.bin");
+- } else
++ } else if ((adev->pdev->device == 0x67ef) &&
++ (adev->pdev->revision == 0xe2)) {
++ info->is_kicker = true;
++ strcpy(fw_name, "amdgpu/polaris11_k2_smc.bin");
++ } else {
+ strcpy(fw_name, "amdgpu/polaris11_smc.bin");
++ }
+ } else if (type == CGS_UCODE_ID_SMU_SK) {
+ strcpy(fw_name, "amdgpu/polaris11_smc_sk.bin");
+ }
+@@ -375,17 +381,35 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
+ (adev->pdev->revision == 0xe7) ||
+ (adev->pdev->revision == 0xef))) ||
+ ((adev->pdev->device == 0x6fdf) &&
+- (adev->pdev->revision == 0xef))) {
++ ((adev->pdev->revision == 0xef) ||
++ (adev->pdev->revision == 0xff)))) {
+ info->is_kicker = true;
+ strcpy(fw_name, "amdgpu/polaris10_k_smc.bin");
+- } else
++ } else if ((adev->pdev->device == 0x67df) &&
++ ((adev->pdev->revision == 0xe1) ||
++ (adev->pdev->revision == 0xf7))) {
++ info->is_kicker = true;
++ strcpy(fw_name, "amdgpu/polaris10_k2_smc.bin");
++ } else {
+ strcpy(fw_name, "amdgpu/polaris10_smc.bin");
++ }
+ } else if (type == CGS_UCODE_ID_SMU_SK) {
+ strcpy(fw_name, "amdgpu/polaris10_smc_sk.bin");
+ }
+ break;
+ case CHIP_POLARIS12:
+- strcpy(fw_name, "amdgpu/polaris12_smc.bin");
++ if (((adev->pdev->device == 0x6987) &&
++ ((adev->pdev->revision == 0xc0) ||
++ (adev->pdev->revision == 0xc3))) ||
++ ((adev->pdev->device == 0x6981) &&
++ ((adev->pdev->revision == 0x00) ||
++ (adev->pdev->revision == 0x01) ||
++ (adev->pdev->revision == 0x10)))) {
++ info->is_kicker = true;
++ strcpy(fw_name, "amdgpu/polaris12_k_smc.bin");
++ } else {
++ strcpy(fw_name, "amdgpu/polaris12_smc.bin");
++ }
+ break;
+ case CHIP_VEGAM:
+ strcpy(fw_name, "amdgpu/vegam_smc.bin");
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 0f41d8647376..8e26e1ca14c6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -761,7 +761,13 @@ static const struct pci_device_id pciidlist[] = {
+ {0x1002, 0x6864, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+ {0x1002, 0x6867, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+ {0x1002, 0x6868, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
++ {0x1002, 0x6869, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
++ {0x1002, 0x686a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
++ {0x1002, 0x686b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+ {0x1002, 0x686c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
++ {0x1002, 0x686d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
++ {0x1002, 0x686e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
++ {0x1002, 0x686f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+ {0x1002, 0x687f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+ /* Vega 12 */
+ {0x1002, 0x69A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA12},
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 29ac74f40dce..1427675d0e5a 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -326,7 +326,13 @@ static const struct kfd_deviceid supported_devices[] = {
+ { 0x6864, &vega10_device_info }, /* Vega10 */
+ { 0x6867, &vega10_device_info }, /* Vega10 */
+ { 0x6868, &vega10_device_info }, /* Vega10 */
++ { 0x6869, &vega10_device_info }, /* Vega10 */
++ { 0x686A, &vega10_device_info }, /* Vega10 */
++ { 0x686B, &vega10_device_info }, /* Vega10 */
+ { 0x686C, &vega10_vf_device_info }, /* Vega10 vf*/
++ { 0x686D, &vega10_device_info }, /* Vega10 */
++ { 0x686E, &vega10_device_info }, /* Vega10 */
++ { 0x686F, &vega10_device_info }, /* Vega10 */
+ { 0x687F, &vega10_device_info }, /* Vega10 */
+ };
+
+diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu7_ppsmc.h b/drivers/gpu/drm/amd/powerplay/inc/smu7_ppsmc.h
+index 62f36ba2435b..c1a99dfe4913 100644
+--- a/drivers/gpu/drm/amd/powerplay/inc/smu7_ppsmc.h
++++ b/drivers/gpu/drm/amd/powerplay/inc/smu7_ppsmc.h
+@@ -386,6 +386,8 @@ typedef uint16_t PPSMC_Result;
+ #define PPSMC_MSG_AgmResetPsm ((uint16_t) 0x403)
+ #define PPSMC_MSG_ReadVftCell ((uint16_t) 0x404)
+
++#define PPSMC_MSG_ApplyAvfsCksOffVoltage ((uint16_t) 0x415)
++
+ #define PPSMC_MSG_GFX_CU_PG_ENABLE ((uint16_t) 0x280)
+ #define PPSMC_MSG_GFX_CU_PG_DISABLE ((uint16_t) 0x281)
+ #define PPSMC_MSG_GetCurrPkgPwr ((uint16_t) 0x282)
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
+index 1276f168ff68..5b67f575cd34 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
+@@ -1984,6 +1984,12 @@ int polaris10_thermal_avfs_enable(struct pp_hwmgr *hwmgr)
+
+ smum_send_msg_to_smc(hwmgr, PPSMC_MSG_EnableAvfs);
+
++ /* Apply avfs cks-off voltages to avoid the overshoot
++ * when switching to the highest sclk frequency
++ */
++ if (data->apply_avfs_cks_off_voltage)
++ smum_send_msg_to_smc(hwmgr, PPSMC_MSG_ApplyAvfsCksOffVoltage);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
+index 99d5e4f98f49..a6edd5df33b0 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
+@@ -37,10 +37,13 @@ MODULE_FIRMWARE("amdgpu/fiji_smc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris10_smc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris10_smc_sk.bin");
+ MODULE_FIRMWARE("amdgpu/polaris10_k_smc.bin");
++MODULE_FIRMWARE("amdgpu/polaris10_k2_smc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris11_smc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris11_smc_sk.bin");
+ MODULE_FIRMWARE("amdgpu/polaris11_k_smc.bin");
++MODULE_FIRMWARE("amdgpu/polaris11_k2_smc.bin");
+ MODULE_FIRMWARE("amdgpu/polaris12_smc.bin");
++MODULE_FIRMWARE("amdgpu/polaris12_k_smc.bin");
+ MODULE_FIRMWARE("amdgpu/vegam_smc.bin");
+ MODULE_FIRMWARE("amdgpu/vega10_smc.bin");
+ MODULE_FIRMWARE("amdgpu/vega10_acg_smc.bin");
+diff --git a/drivers/gpu/drm/i915/gvt/fb_decoder.c b/drivers/gpu/drm/i915/gvt/fb_decoder.c
+index 481896fb712a..85e6736f0a32 100644
+--- a/drivers/gpu/drm/i915/gvt/fb_decoder.c
++++ b/drivers/gpu/drm/i915/gvt/fb_decoder.c
+@@ -235,7 +235,7 @@ int intel_vgpu_decode_primary_plane(struct intel_vgpu *vgpu,
+ plane->bpp = skl_pixel_formats[fmt].bpp;
+ plane->drm_format = skl_pixel_formats[fmt].drm_format;
+ } else {
+- plane->tiled = !!(val & DISPPLANE_TILED);
++ plane->tiled = val & DISPPLANE_TILED;
+ fmt = bdw_format_to_drm(val & DISPPLANE_PIXFORMAT_MASK);
+ plane->bpp = bdw_pixel_formats[fmt].bpp;
+ plane->drm_format = bdw_pixel_formats[fmt].drm_format;
+diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
+index 75ea87ebf9b0..6937ef0b4bfc 100644
+--- a/drivers/gpu/drm/i915/intel_lrc.c
++++ b/drivers/gpu/drm/i915/intel_lrc.c
+@@ -442,8 +442,13 @@ static u64 execlists_update_context(struct i915_request *rq)
+ * may not be visible to the HW prior to the completion of the UC
+ * register write and that we may begin execution from the context
+ * before its image is complete leading to invalid PD chasing.
++ *
++ * Furthermore, Braswell, at least, wants a full mb to be sure that
++ * the writes are coherent in memory (visible to the GPU) prior to
++ * execution, and not just visible to other CPUs (as is the result of
++ * wmb).
+ */
+- wmb();
++ mb();
+ return ce->lrc_desc;
+ }
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_dbg.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_dbg.c
+index ae2aee7ed9e1..e741d26185df 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_dbg.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_dbg.c
+@@ -1962,7 +1962,7 @@ static void _dpu_dbg_dump_dpu_dbg_bus(struct dpu_dbg_dpu_debug_bus *bus)
+ u32 *dump_addr = NULL;
+ u32 status = 0;
+ struct dpu_debug_bus_entry *head;
+- phys_addr_t phys = 0;
++ dma_addr_t dma = 0;
+ int list_size;
+ int i;
+ u32 offset;
+@@ -2000,7 +2000,7 @@ static void _dpu_dbg_dump_dpu_dbg_bus(struct dpu_dbg_dpu_debug_bus *bus)
+ if (in_mem) {
+ if (!(*dump_mem))
+ *dump_mem = dma_alloc_coherent(dpu_dbg_base.dev,
+- list_size, &phys, GFP_KERNEL);
++ list_size, &dma, GFP_KERNEL);
+
+ if (*dump_mem) {
+ dump_addr = *dump_mem;
+@@ -2101,7 +2101,7 @@ static void _dpu_dbg_dump_vbif_dbg_bus(struct dpu_dbg_vbif_debug_bus *bus)
+ u32 value, d0, d1;
+ unsigned long reg, reg1, reg2;
+ struct vbif_debug_bus_entry *head;
+- phys_addr_t phys = 0;
++ dma_addr_t dma = 0;
+ int i, list_size = 0;
+ void __iomem *mem_base = NULL;
+ struct vbif_debug_bus_entry *dbg_bus;
+@@ -2151,7 +2151,7 @@ static void _dpu_dbg_dump_vbif_dbg_bus(struct dpu_dbg_vbif_debug_bus *bus)
+ if (in_mem) {
+ if (!(*dump_mem))
+ *dump_mem = dma_alloc_coherent(dpu_dbg_base.dev,
+- list_size, &phys, GFP_KERNEL);
++ list_size, &dma, GFP_KERNEL);
+
+ if (*dump_mem) {
+ dump_addr = *dump_mem;
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index faf7009c0a3c..2abcd7bf104f 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -197,6 +197,22 @@ nv50_dmac_create(struct nvif_device *device, struct nvif_object *disp,
+ /******************************************************************************
+ * EVO channel helpers
+ *****************************************************************************/
++static void
++evo_flush(struct nv50_dmac *dmac)
++{
++ /* Push buffer fetches are not coherent with BAR1, we need to ensure
++ * writes have been flushed right through to VRAM before writing PUT.
++ */
++ if (dmac->push.type & NVIF_MEM_VRAM) {
++ struct nvif_device *device = dmac->base.device;
++ nvif_wr32(&device->object, 0x070000, 0x00000001);
++ nvif_msec(device, 2000,
++ if (!(nvif_rd32(&device->object, 0x070000) & 0x00000002))
++ break;
++ );
++ }
++}
++
+ u32 *
+ evo_wait(struct nv50_dmac *evoc, int nr)
+ {
+@@ -207,6 +223,7 @@ evo_wait(struct nv50_dmac *evoc, int nr)
+ mutex_lock(&dmac->lock);
+ if (put + nr >= (PAGE_SIZE / 4) - 8) {
+ dmac->ptr[put] = 0x20000000;
++ evo_flush(dmac);
+
+ nvif_wr32(&dmac->base.user, 0x0000, 0x00000000);
+ if (nvif_msec(device, 2000,
+@@ -229,17 +246,7 @@ evo_kick(u32 *push, struct nv50_dmac *evoc)
+ {
+ struct nv50_dmac *dmac = evoc;
+
+- /* Push buffer fetches are not coherent with BAR1, we need to ensure
+- * writes have been flushed right through to VRAM before writing PUT.
+- */
+- if (dmac->push.type & NVIF_MEM_VRAM) {
+- struct nvif_device *device = dmac->base.device;
+- nvif_wr32(&device->object, 0x070000, 0x00000001);
+- nvif_msec(device, 2000,
+- if (!(nvif_rd32(&device->object, 0x070000) & 0x00000002))
+- break;
+- );
+- }
++ evo_flush(dmac);
+
+ nvif_wr32(&dmac->base.user, 0x0000, (push - dmac->ptr) << 2);
+ mutex_unlock(&dmac->lock);
+@@ -1226,6 +1233,7 @@ nv50_mstm_del(struct nv50_mstm **pmstm)
+ {
+ struct nv50_mstm *mstm = *pmstm;
+ if (mstm) {
++ drm_dp_mst_topology_mgr_destroy(&mstm->mgr);
+ kfree(*pmstm);
+ *pmstm = NULL;
+ }
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+index 05368fa4f956..f814d37b1db2 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+@@ -442,11 +442,6 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev)
+ return 0;
+ }
+
+-static void rockchip_drm_platform_shutdown(struct platform_device *pdev)
+-{
+- rockchip_drm_platform_remove(pdev);
+-}
+-
+ static const struct of_device_id rockchip_drm_dt_ids[] = {
+ { .compatible = "rockchip,display-subsystem", },
+ { /* sentinel */ },
+@@ -456,7 +451,6 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids);
+ static struct platform_driver rockchip_drm_platform_driver = {
+ .probe = rockchip_drm_platform_probe,
+ .remove = rockchip_drm_platform_remove,
+- .shutdown = rockchip_drm_platform_shutdown,
+ .driver = {
+ .name = "rockchip-drm",
+ .of_match_table = rockchip_drm_dt_ids,
+diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c
+index a4f956c6d567..a19fbff16861 100644
+--- a/drivers/i2c/busses/i2c-aspeed.c
++++ b/drivers/i2c/busses/i2c-aspeed.c
+@@ -555,7 +555,7 @@ static irqreturn_t aspeed_i2c_bus_irq(int irq, void *dev_id)
+ spin_lock(&bus->lock);
+
+ #if IS_ENABLED(CONFIG_I2C_SLAVE)
+- if (aspeed_i2c_slave_irq(bus)) {
++ if (IS_ENABLED(CONFIG_I2C_SLAVE) && aspeed_i2c_slave_irq(bus)) {
+ dev_dbg(bus->dev, "irq handled by slave.\n");
+ ret = true;
+ goto out;
+@@ -564,7 +564,9 @@ static irqreturn_t aspeed_i2c_bus_irq(int irq, void *dev_id)
+
+ ret = aspeed_i2c_master_irq(bus);
+
++#if IS_ENABLED(CONFIG_I2C_SLAVE)
+ out:
++#endif
+ spin_unlock(&bus->lock);
+ return ret ? IRQ_HANDLED : IRQ_NONE;
+ }
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index 5936de71883f..6fc93834da44 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -930,6 +930,10 @@ static int blocks_are_clean_separate_dirty(struct dm_cache_metadata *cmd,
+ bool dirty_flag;
+ *result = true;
+
++ if (from_cblock(cmd->cache_blocks) == 0)
++ /* Nothing to do */
++ return 0;
++
+ r = dm_bitset_cursor_begin(&cmd->dirty_info, cmd->dirty_root,
+ from_cblock(cmd->cache_blocks), &cmd->dirty_cursor);
+ if (r) {
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index aaf1ad481ee8..1f225a1e08dd 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -195,7 +195,7 @@ static void throttle_unlock(struct throttle *t)
+ struct dm_thin_new_mapping;
+
+ /*
+- * The pool runs in 4 modes. Ordered in degraded order for comparisons.
++ * The pool runs in various modes. Ordered in degraded order for comparisons.
+ */
+ enum pool_mode {
+ PM_WRITE, /* metadata may be changed */
+@@ -282,9 +282,38 @@ struct pool {
+ mempool_t mapping_pool;
+ };
+
+-static enum pool_mode get_pool_mode(struct pool *pool);
+ static void metadata_operation_failed(struct pool *pool, const char *op, int r);
+
++static enum pool_mode get_pool_mode(struct pool *pool)
++{
++ return pool->pf.mode;
++}
++
++static void notify_of_pool_mode_change(struct pool *pool)
++{
++ const char *descs[] = {
++ "write",
++ "out-of-data-space",
++ "read-only",
++ "read-only",
++ "fail"
++ };
++ const char *extra_desc = NULL;
++ enum pool_mode mode = get_pool_mode(pool);
++
++ if (mode == PM_OUT_OF_DATA_SPACE) {
++ if (!pool->pf.error_if_no_space)
++ extra_desc = " (queue IO)";
++ else
++ extra_desc = " (error IO)";
++ }
++
++ dm_table_event(pool->ti->table);
++ DMINFO("%s: switching pool to %s%s mode",
++ dm_device_name(pool->pool_md),
++ descs[(int)mode], extra_desc ? : "");
++}
++
+ /*
+ * Target context for a pool.
+ */
+@@ -2351,8 +2380,6 @@ static void do_waker(struct work_struct *ws)
+ queue_delayed_work(pool->wq, &pool->waker, COMMIT_PERIOD);
+ }
+
+-static void notify_of_pool_mode_change_to_oods(struct pool *pool);
+-
+ /*
+ * We're holding onto IO to allow userland time to react. After the
+ * timeout either the pool will have been resized (and thus back in
+@@ -2365,7 +2392,7 @@ static void do_no_space_timeout(struct work_struct *ws)
+
+ if (get_pool_mode(pool) == PM_OUT_OF_DATA_SPACE && !pool->pf.error_if_no_space) {
+ pool->pf.error_if_no_space = true;
+- notify_of_pool_mode_change_to_oods(pool);
++ notify_of_pool_mode_change(pool);
+ error_retry_list_with_code(pool, BLK_STS_NOSPC);
+ }
+ }
+@@ -2433,26 +2460,6 @@ static void noflush_work(struct thin_c *tc, void (*fn)(struct work_struct *))
+
+ /*----------------------------------------------------------------*/
+
+-static enum pool_mode get_pool_mode(struct pool *pool)
+-{
+- return pool->pf.mode;
+-}
+-
+-static void notify_of_pool_mode_change(struct pool *pool, const char *new_mode)
+-{
+- dm_table_event(pool->ti->table);
+- DMINFO("%s: switching pool to %s mode",
+- dm_device_name(pool->pool_md), new_mode);
+-}
+-
+-static void notify_of_pool_mode_change_to_oods(struct pool *pool)
+-{
+- if (!pool->pf.error_if_no_space)
+- notify_of_pool_mode_change(pool, "out-of-data-space (queue IO)");
+- else
+- notify_of_pool_mode_change(pool, "out-of-data-space (error IO)");
+-}
+-
+ static bool passdown_enabled(struct pool_c *pt)
+ {
+ return pt->adjusted_pf.discard_passdown;
+@@ -2501,8 +2508,6 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
+
+ switch (new_mode) {
+ case PM_FAIL:
+- if (old_mode != new_mode)
+- notify_of_pool_mode_change(pool, "failure");
+ dm_pool_metadata_read_only(pool->pmd);
+ pool->process_bio = process_bio_fail;
+ pool->process_discard = process_bio_fail;
+@@ -2516,8 +2521,6 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
+
+ case PM_OUT_OF_METADATA_SPACE:
+ case PM_READ_ONLY:
+- if (!is_read_only_pool_mode(old_mode))
+- notify_of_pool_mode_change(pool, "read-only");
+ dm_pool_metadata_read_only(pool->pmd);
+ pool->process_bio = process_bio_read_only;
+ pool->process_discard = process_bio_success;
+@@ -2538,8 +2541,6 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
+ * alarming rate. Adjust your low water mark if you're
+ * frequently seeing this mode.
+ */
+- if (old_mode != new_mode)
+- notify_of_pool_mode_change_to_oods(pool);
+ pool->out_of_data_space = true;
+ pool->process_bio = process_bio_read_only;
+ pool->process_discard = process_discard_bio;
+@@ -2552,8 +2553,6 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
+ break;
+
+ case PM_WRITE:
+- if (old_mode != new_mode)
+- notify_of_pool_mode_change(pool, "write");
+ if (old_mode == PM_OUT_OF_DATA_SPACE)
+ cancel_delayed_work_sync(&pool->no_space_timeout);
+ pool->out_of_data_space = false;
+@@ -2573,6 +2572,9 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
+ * doesn't cause an unexpected mode transition on resume.
+ */
+ pt->adjusted_pf.mode = new_mode;
++
++ if (old_mode != new_mode)
++ notify_of_pool_mode_change(pool);
+ }
+
+ static void abort_transaction(struct pool *pool)
+diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
+index a44183ff4be0..85fb2baa8a7f 100644
+--- a/drivers/md/dm-zoned-target.c
++++ b/drivers/md/dm-zoned-target.c
+@@ -20,7 +20,6 @@ struct dmz_bioctx {
+ struct dm_zone *zone;
+ struct bio *bio;
+ atomic_t ref;
+- blk_status_t status;
+ };
+
+ /*
+@@ -78,65 +77,66 @@ static inline void dmz_bio_endio(struct bio *bio, blk_status_t status)
+ {
+ struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
+
+- if (bioctx->status == BLK_STS_OK && status != BLK_STS_OK)
+- bioctx->status = status;
+- bio_endio(bio);
++ if (status != BLK_STS_OK && bio->bi_status == BLK_STS_OK)
++ bio->bi_status = status;
++
++ if (atomic_dec_and_test(&bioctx->ref)) {
++ struct dm_zone *zone = bioctx->zone;
++
++ if (zone) {
++ if (bio->bi_status != BLK_STS_OK &&
++ bio_op(bio) == REQ_OP_WRITE &&
++ dmz_is_seq(zone))
++ set_bit(DMZ_SEQ_WRITE_ERR, &zone->flags);
++ dmz_deactivate_zone(zone);
++ }
++ bio_endio(bio);
++ }
+ }
+
+ /*
+- * Partial clone read BIO completion callback. This terminates the
++ * Completion callback for an internally cloned target BIO. This terminates the
+ * target BIO when there are no more references to its context.
+ */
+-static void dmz_read_bio_end_io(struct bio *bio)
++static void dmz_clone_endio(struct bio *clone)
+ {
+- struct dmz_bioctx *bioctx = bio->bi_private;
+- blk_status_t status = bio->bi_status;
++ struct dmz_bioctx *bioctx = clone->bi_private;
++ blk_status_t status = clone->bi_status;
+
+- bio_put(bio);
++ bio_put(clone);
+ dmz_bio_endio(bioctx->bio, status);
+ }
+
+ /*
+- * Issue a BIO to a zone. The BIO may only partially process the
++ * Issue a clone of a target BIO. The clone may only partially process the
+ * original target BIO.
+ */
+-static int dmz_submit_read_bio(struct dmz_target *dmz, struct dm_zone *zone,
+- struct bio *bio, sector_t chunk_block,
+- unsigned int nr_blocks)
++static int dmz_submit_bio(struct dmz_target *dmz, struct dm_zone *zone,
++ struct bio *bio, sector_t chunk_block,
++ unsigned int nr_blocks)
+ {
+ struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
+- sector_t sector;
+ struct bio *clone;
+
+- /* BIO remap sector */
+- sector = dmz_start_sect(dmz->metadata, zone) + dmz_blk2sect(chunk_block);
+-
+- /* If the read is not partial, there is no need to clone the BIO */
+- if (nr_blocks == dmz_bio_blocks(bio)) {
+- /* Setup and submit the BIO */
+- bio->bi_iter.bi_sector = sector;
+- atomic_inc(&bioctx->ref);
+- generic_make_request(bio);
+- return 0;
+- }
+-
+- /* Partial BIO: we need to clone the BIO */
+ clone = bio_clone_fast(bio, GFP_NOIO, &dmz->bio_set);
+ if (!clone)
+ return -ENOMEM;
+
+- /* Setup the clone */
+- clone->bi_iter.bi_sector = sector;
++ bio_set_dev(clone, dmz->dev->bdev);
++ clone->bi_iter.bi_sector =
++ dmz_start_sect(dmz->metadata, zone) + dmz_blk2sect(chunk_block);
+ clone->bi_iter.bi_size = dmz_blk2sect(nr_blocks) << SECTOR_SHIFT;
+- clone->bi_end_io = dmz_read_bio_end_io;
++ clone->bi_end_io = dmz_clone_endio;
+ clone->bi_private = bioctx;
+
+ bio_advance(bio, clone->bi_iter.bi_size);
+
+- /* Submit the clone */
+ atomic_inc(&bioctx->ref);
+ generic_make_request(clone);
+
++ if (bio_op(bio) == REQ_OP_WRITE && dmz_is_seq(zone))
++ zone->wp_block += nr_blocks;
++
+ return 0;
+ }
+
+@@ -214,7 +214,7 @@ static int dmz_handle_read(struct dmz_target *dmz, struct dm_zone *zone,
+ if (nr_blocks) {
+ /* Valid blocks found: read them */
+ nr_blocks = min_t(unsigned int, nr_blocks, end_block - chunk_block);
+- ret = dmz_submit_read_bio(dmz, rzone, bio, chunk_block, nr_blocks);
++ ret = dmz_submit_bio(dmz, rzone, bio, chunk_block, nr_blocks);
+ if (ret)
+ return ret;
+ chunk_block += nr_blocks;
+@@ -228,25 +228,6 @@ static int dmz_handle_read(struct dmz_target *dmz, struct dm_zone *zone,
+ return 0;
+ }
+
+-/*
+- * Issue a write BIO to a zone.
+- */
+-static void dmz_submit_write_bio(struct dmz_target *dmz, struct dm_zone *zone,
+- struct bio *bio, sector_t chunk_block,
+- unsigned int nr_blocks)
+-{
+- struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
+-
+- /* Setup and submit the BIO */
+- bio_set_dev(bio, dmz->dev->bdev);
+- bio->bi_iter.bi_sector = dmz_start_sect(dmz->metadata, zone) + dmz_blk2sect(chunk_block);
+- atomic_inc(&bioctx->ref);
+- generic_make_request(bio);
+-
+- if (dmz_is_seq(zone))
+- zone->wp_block += nr_blocks;
+-}
+-
+ /*
+ * Write blocks directly in a data zone, at the write pointer.
+ * If a buffer zone is assigned, invalidate the blocks written
+@@ -265,7 +246,9 @@ static int dmz_handle_direct_write(struct dmz_target *dmz,
+ return -EROFS;
+
+ /* Submit write */
+- dmz_submit_write_bio(dmz, zone, bio, chunk_block, nr_blocks);
++ ret = dmz_submit_bio(dmz, zone, bio, chunk_block, nr_blocks);
++ if (ret)
++ return ret;
+
+ /*
+ * Validate the blocks in the data zone and invalidate
+@@ -301,7 +284,9 @@ static int dmz_handle_buffered_write(struct dmz_target *dmz,
+ return -EROFS;
+
+ /* Submit write */
+- dmz_submit_write_bio(dmz, bzone, bio, chunk_block, nr_blocks);
++ ret = dmz_submit_bio(dmz, bzone, bio, chunk_block, nr_blocks);
++ if (ret)
++ return ret;
+
+ /*
+ * Validate the blocks in the buffer zone
+@@ -600,7 +585,6 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
+ bioctx->zone = NULL;
+ bioctx->bio = bio;
+ atomic_set(&bioctx->ref, 1);
+- bioctx->status = BLK_STS_OK;
+
+ /* Set the BIO pending in the flush list */
+ if (!nr_sectors && bio_op(bio) == REQ_OP_WRITE) {
+@@ -623,35 +607,6 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
+ return DM_MAPIO_SUBMITTED;
+ }
+
+-/*
+- * Completed target BIO processing.
+- */
+-static int dmz_end_io(struct dm_target *ti, struct bio *bio, blk_status_t *error)
+-{
+- struct dmz_bioctx *bioctx = dm_per_bio_data(bio, sizeof(struct dmz_bioctx));
+-
+- if (bioctx->status == BLK_STS_OK && *error)
+- bioctx->status = *error;
+-
+- if (!atomic_dec_and_test(&bioctx->ref))
+- return DM_ENDIO_INCOMPLETE;
+-
+- /* Done */
+- bio->bi_status = bioctx->status;
+-
+- if (bioctx->zone) {
+- struct dm_zone *zone = bioctx->zone;
+-
+- if (*error && bio_op(bio) == REQ_OP_WRITE) {
+- if (dmz_is_seq(zone))
+- set_bit(DMZ_SEQ_WRITE_ERR, &zone->flags);
+- }
+- dmz_deactivate_zone(zone);
+- }
+-
+- return DM_ENDIO_DONE;
+-}
+-
+ /*
+ * Get zoned device information.
+ */
+@@ -947,7 +902,6 @@ static struct target_type dmz_type = {
+ .ctr = dmz_ctr,
+ .dtr = dmz_dtr,
+ .map = dmz_map,
+- .end_io = dmz_end_io,
+ .io_hints = dmz_io_hints,
+ .prepare_ioctl = dmz_prepare_ioctl,
+ .postsuspend = dmz_suspend,
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 45abb54037fc..07d2949a8746 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1592,6 +1592,8 @@ static blk_qc_t __split_and_process_bio(struct mapped_device *md,
+ return ret;
+ }
+
++ blk_queue_split(md->queue, &bio);
++
+ init_clone_info(&ci, md, map, bio);
+
+ if (bio->bi_opf & REQ_PREFLUSH) {
+diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
+index 5653e8eebe2b..16c7b20cbf61 100644
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -1755,10 +1755,8 @@ int vb2_core_streamon(struct vb2_queue *q, unsigned int type)
+ if (ret)
+ return ret;
+ ret = vb2_start_streaming(q);
+- if (ret) {
+- __vb2_queue_cancel(q);
++ if (ret)
+ return ret;
+- }
+ }
+
+ q->streaming = 1;
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index e201ccb3fda4..f6755b86eba2 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -472,7 +472,7 @@ out:
+ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ struct mmc_blk_ioc_data *idata)
+ {
+- struct mmc_command cmd = {};
++ struct mmc_command cmd = {}, sbc = {};
+ struct mmc_data data = {};
+ struct mmc_request mrq = {};
+ struct scatterlist sg;
+@@ -550,10 +550,15 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ }
+
+ if (idata->rpmb) {
+- err = mmc_set_blockcount(card, data.blocks,
+- idata->ic.write_flag & (1 << 31));
+- if (err)
+- return err;
++ sbc.opcode = MMC_SET_BLOCK_COUNT;
++ /*
++ * We don't do any blockcount validation because the max size
++ * may be increased by a future standard. We just copy the
++ * 'Reliable Write' bit here.
++ */
++ sbc.arg = data.blocks | (idata->ic.write_flag & BIT(31));
++ sbc.flags = MMC_RSP_R1 | MMC_CMD_AC;
++ mrq.sbc = &sbc;
+ }
+
+ if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_SANITIZE_START) &&
+diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
+index adf32682f27a..c60a7625b1fa 100644
+--- a/drivers/mmc/host/omap.c
++++ b/drivers/mmc/host/omap.c
+@@ -104,6 +104,7 @@ struct mmc_omap_slot {
+ unsigned int vdd;
+ u16 saved_con;
+ u16 bus_mode;
++ u16 power_mode;
+ unsigned int fclk_freq;
+
+ struct tasklet_struct cover_tasklet;
+@@ -1157,7 +1158,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ struct mmc_omap_slot *slot = mmc_priv(mmc);
+ struct mmc_omap_host *host = slot->host;
+ int i, dsor;
+- int clk_enabled;
++ int clk_enabled, init_stream;
+
+ mmc_omap_select_slot(slot, 0);
+
+@@ -1167,6 +1168,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ slot->vdd = ios->vdd;
+
+ clk_enabled = 0;
++ init_stream = 0;
+ switch (ios->power_mode) {
+ case MMC_POWER_OFF:
+ mmc_omap_set_power(slot, 0, ios->vdd);
+@@ -1174,13 +1176,17 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ case MMC_POWER_UP:
+ /* Cannot touch dsor yet, just power up MMC */
+ mmc_omap_set_power(slot, 1, ios->vdd);
++ slot->power_mode = ios->power_mode;
+ goto exit;
+ case MMC_POWER_ON:
+ mmc_omap_fclk_enable(host, 1);
+ clk_enabled = 1;
+ dsor |= 1 << 11;
++ if (slot->power_mode != MMC_POWER_ON)
++ init_stream = 1;
+ break;
+ }
++ slot->power_mode = ios->power_mode;
+
+ if (slot->bus_mode != ios->bus_mode) {
+ if (slot->pdata->set_bus_mode != NULL)
+@@ -1196,7 +1202,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ for (i = 0; i < 2; i++)
+ OMAP_MMC_WRITE(host, CON, dsor);
+ slot->saved_con = dsor;
+- if (ios->power_mode == MMC_POWER_ON) {
++ if (init_stream) {
+ /* worst case at 400kHz, 80 cycles makes 200 microsecs */
+ int usecs = 250;
+
+@@ -1234,6 +1240,7 @@ static int mmc_omap_new_slot(struct mmc_omap_host *host, int id)
+ slot->host = host;
+ slot->mmc = mmc;
+ slot->id = id;
++ slot->power_mode = MMC_POWER_UNDEFINED;
+ slot->pdata = &host->pdata->slots[id];
+
+ host->slots[id] = slot;
+diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
+index 88347ce78f23..d264391616f9 100644
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -288,9 +288,9 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ struct device *dev = omap_host->dev;
+ struct mmc_ios *ios = &mmc->ios;
+ u32 start_window = 0, max_window = 0;
++ bool dcrc_was_enabled = false;
+ u8 cur_match, prev_match = 0;
+ u32 length = 0, max_len = 0;
+- u32 ier = host->ier;
+ u32 phase_delay = 0;
+ int ret = 0;
+ u32 reg;
+@@ -317,9 +317,10 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ * during the tuning procedure. So disable it during the
+ * tuning procedure.
+ */
+- ier &= ~SDHCI_INT_DATA_CRC;
+- sdhci_writel(host, ier, SDHCI_INT_ENABLE);
+- sdhci_writel(host, ier, SDHCI_SIGNAL_ENABLE);
++ if (host->ier & SDHCI_INT_DATA_CRC) {
++ host->ier &= ~SDHCI_INT_DATA_CRC;
++ dcrc_was_enabled = true;
++ }
+
+ while (phase_delay <= MAX_PHASE_DELAY) {
+ sdhci_omap_set_dll(omap_host, phase_delay);
+@@ -366,6 +367,9 @@ tuning_error:
+
+ ret:
+ sdhci_reset(host, SDHCI_RESET_CMD | SDHCI_RESET_DATA);
++ /* Reenable forbidden interrupt */
++ if (dcrc_was_enabled)
++ host->ier |= SDHCI_INT_DATA_CRC;
+ sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
+ sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
+ return ret;
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 1b3fbd9bd5c5..654051e00117 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -193,8 +193,12 @@ void sdhci_reset(struct sdhci_host *host, u8 mask)
+ timeout = ktime_add_ms(ktime_get(), 100);
+
+ /* hw clears the bit when it's done */
+- while (sdhci_readb(host, SDHCI_SOFTWARE_RESET) & mask) {
+- if (ktime_after(ktime_get(), timeout)) {
++ while (1) {
++ bool timedout = ktime_after(ktime_get(), timeout);
++
++ if (!(sdhci_readb(host, SDHCI_SOFTWARE_RESET) & mask))
++ break;
++ if (timedout) {
+ pr_err("%s: Reset 0x%x never completed.\n",
+ mmc_hostname(host->mmc), (int)mask);
+ sdhci_dumpregs(host);
+@@ -1495,9 +1499,13 @@ void sdhci_enable_clk(struct sdhci_host *host, u16 clk)
+
+ /* Wait max 20 ms */
+ timeout = ktime_add_ms(ktime_get(), 20);
+- while (!((clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL))
+- & SDHCI_CLOCK_INT_STABLE)) {
+- if (ktime_after(ktime_get(), timeout)) {
++ while (1) {
++ bool timedout = ktime_after(ktime_get(), timeout);
++
++ clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
++ if (clk & SDHCI_CLOCK_INT_STABLE)
++ break;
++ if (timedout) {
+ pr_err("%s: Internal clock never stabilised.\n",
+ mmc_hostname(host->mmc));
+ sdhci_dumpregs(host);
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+index 6624499eae72..4ada80317a3b 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+@@ -568,7 +568,7 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = {
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(H, 11),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 2, 1)), /* PH_EINT11 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 2, 11)), /* PH_EINT11 */
+ };
+
+ static const struct sunxi_pinctrl_desc sun8i_a83t_pinctrl_data = {
+diff --git a/drivers/scsi/raid_class.c b/drivers/scsi/raid_class.c
+index ea88906d2cc5..5c3d6e1e0145 100644
+--- a/drivers/scsi/raid_class.c
++++ b/drivers/scsi/raid_class.c
+@@ -63,8 +63,7 @@ static int raid_match(struct attribute_container *cont, struct device *dev)
+ * emulated RAID devices, so start with SCSI */
+ struct raid_internal *i = ac_to_raid_internal(cont);
+
+-#if defined(CONFIG_SCSI) || defined(CONFIG_SCSI_MODULE)
+- if (scsi_is_sdev_device(dev)) {
++ if (IS_ENABLED(CONFIG_SCSI) && scsi_is_sdev_device(dev)) {
+ struct scsi_device *sdev = to_scsi_device(dev);
+
+ if (i->f->cookie != sdev->host->hostt)
+@@ -72,7 +71,6 @@ static int raid_match(struct attribute_container *cont, struct device *dev)
+
+ return i->f->is_raid(dev);
+ }
+-#endif
+ /* FIXME: look at other subsystems too */
+ return 0;
+ }
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 8be4d6786c61..14a9d18306cb 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1467,7 +1467,7 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
+ return 0;
+ }
+
+-static int qcom_slim_ngd_runtime_idle(struct device *dev)
++static int __maybe_unused qcom_slim_ngd_runtime_idle(struct device *dev)
+ {
+ struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
+
+@@ -1477,8 +1477,7 @@ static int qcom_slim_ngd_runtime_idle(struct device *dev)
+ return -EAGAIN;
+ }
+
+-#ifdef CONFIG_PM
+-static int qcom_slim_ngd_runtime_suspend(struct device *dev)
++static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev)
+ {
+ struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
+ int ret = 0;
+@@ -1491,7 +1490,6 @@ static int qcom_slim_ngd_runtime_suspend(struct device *dev)
+
+ return ret;
+ }
+-#endif
+
+ static const struct dev_pm_ops qcom_slim_ngd_dev_pm_ops = {
+ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+diff --git a/drivers/staging/olpc_dcon/Kconfig b/drivers/staging/olpc_dcon/Kconfig
+index c91a56f77bcb..192cc8d0853f 100644
+--- a/drivers/staging/olpc_dcon/Kconfig
++++ b/drivers/staging/olpc_dcon/Kconfig
+@@ -2,6 +2,7 @@ config FB_OLPC_DCON
+ tristate "One Laptop Per Child Display CONtroller support"
+ depends on OLPC && FB
+ depends on I2C
++ depends on BACKLIGHT_LCD_SUPPORT
+ depends on (GPIO_CS5535 || GPIO_CS5535=n)
+ select BACKLIGHT_CLASS_DEVICE
+ help
+diff --git a/fs/aio.c b/fs/aio.c
+index 04c4d6218978..44551d96eaa4 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -45,6 +45,7 @@
+
+ #include <asm/kmap_types.h>
+ #include <linux/uaccess.h>
++#include <linux/nospec.h>
+
+ #include "internal.h"
+
+@@ -1038,6 +1039,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
+ if (!table || id >= table->nr)
+ goto out;
+
++ id = array_index_nospec(id, table->nr);
+ ctx = rcu_dereference(table->table[id]);
+ if (ctx && ctx->user_id == ctx_id) {
+ if (percpu_ref_tryget_live(&ctx->users))
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 0979609d6eba..82a13221775e 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1439,7 +1439,7 @@ static int fuse_dir_open(struct inode *inode, struct file *file)
+
+ static int fuse_dir_release(struct inode *inode, struct file *file)
+ {
+- fuse_release_common(file, FUSE_RELEASEDIR);
++ fuse_release_common(file, true);
+
+ return 0;
+ }
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index a0ffed34b85d..fbd6978479cb 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -87,12 +87,12 @@ static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
+ iput(req->misc.release.inode);
+ }
+
+-static void fuse_file_put(struct fuse_file *ff, bool sync)
++static void fuse_file_put(struct fuse_file *ff, bool sync, bool isdir)
+ {
+ if (refcount_dec_and_test(&ff->count)) {
+ struct fuse_req *req = ff->reserved_req;
+
+- if (ff->fc->no_open) {
++ if (ff->fc->no_open && !isdir) {
+ /*
+ * Drop the release request when client does not
+ * implement 'open'
+@@ -245,10 +245,11 @@ static void fuse_prepare_release(struct fuse_file *ff, int flags, int opcode)
+ req->in.args[0].value = inarg;
+ }
+
+-void fuse_release_common(struct file *file, int opcode)
++void fuse_release_common(struct file *file, bool isdir)
+ {
+ struct fuse_file *ff = file->private_data;
+ struct fuse_req *req = ff->reserved_req;
++ int opcode = isdir ? FUSE_RELEASEDIR : FUSE_RELEASE;
+
+ fuse_prepare_release(ff, file->f_flags, opcode);
+
+@@ -270,7 +271,7 @@ void fuse_release_common(struct file *file, int opcode)
+ * synchronous RELEASE is allowed (and desirable) in this case
+ * because the server can be trusted not to screw up.
+ */
+- fuse_file_put(ff, ff->fc->destroy_req != NULL);
++ fuse_file_put(ff, ff->fc->destroy_req != NULL, isdir);
+ }
+
+ static int fuse_open(struct inode *inode, struct file *file)
+@@ -286,7 +287,7 @@ static int fuse_release(struct inode *inode, struct file *file)
+ if (fc->writeback_cache)
+ write_inode_now(inode, 1);
+
+- fuse_release_common(file, FUSE_RELEASE);
++ fuse_release_common(file, false);
+
+ /* return value is ignored by VFS */
+ return 0;
+@@ -300,7 +301,7 @@ void fuse_sync_release(struct fuse_file *ff, int flags)
+ * iput(NULL) is a no-op and since the refcount is 1 and everything's
+ * synchronous, we are fine with not doing igrab() here"
+ */
+- fuse_file_put(ff, true);
++ fuse_file_put(ff, true, false);
+ }
+ EXPORT_SYMBOL_GPL(fuse_sync_release);
+
+@@ -805,7 +806,7 @@ static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req)
+ put_page(page);
+ }
+ if (req->ff)
+- fuse_file_put(req->ff, false);
++ fuse_file_put(req->ff, false, false);
+ }
+
+ static void fuse_send_readpages(struct fuse_req *req, struct file *file)
+@@ -1459,7 +1460,7 @@ static void fuse_writepage_free(struct fuse_conn *fc, struct fuse_req *req)
+ __free_page(req->pages[i]);
+
+ if (req->ff)
+- fuse_file_put(req->ff, false);
++ fuse_file_put(req->ff, false, false);
+ }
+
+ static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req)
+@@ -1616,7 +1617,7 @@ int fuse_write_inode(struct inode *inode, struct writeback_control *wbc)
+ ff = __fuse_write_file_get(fc, fi);
+ err = fuse_flush_times(inode, ff);
+ if (ff)
+- fuse_file_put(ff, 0);
++ fuse_file_put(ff, false, false);
+
+ return err;
+ }
+@@ -1930,7 +1931,7 @@ static int fuse_writepages(struct address_space *mapping,
+ err = 0;
+ }
+ if (data.ff)
+- fuse_file_put(data.ff, false);
++ fuse_file_put(data.ff, false, false);
+
+ kfree(data.orig_pages);
+ out:
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index f78e9614bb5f..cec8b8e74969 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -749,7 +749,7 @@ void fuse_sync_release(struct fuse_file *ff, int flags);
+ /**
+ * Send RELEASE or RELEASEDIR request
+ */
+-void fuse_release_common(struct file *file, int opcode);
++void fuse_release_common(struct file *file, bool isdir);
+
+ /**
+ * Send FSYNC or FSYNCDIR request
+diff --git a/fs/iomap.c b/fs/iomap.c
+index ec15cf2ec696..37da7a61a6c5 100644
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -117,6 +117,12 @@ iomap_page_create(struct inode *inode, struct page *page)
+ atomic_set(&iop->read_count, 0);
+ atomic_set(&iop->write_count, 0);
+ bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
++
++ /*
++ * migrate_page_move_mapping() assumes that pages with private data have
++ * their count elevated by 1.
++ */
++ get_page(page);
+ set_page_private(page, (unsigned long)iop);
+ SetPagePrivate(page);
+ return iop;
+@@ -133,6 +139,7 @@ iomap_page_release(struct page *page)
+ WARN_ON_ONCE(atomic_read(&iop->write_count));
+ ClearPagePrivate(page);
+ set_page_private(page, 0);
++ put_page(page);
+ kfree(iop);
+ }
+
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 3bbde0a9f48f..b2aadd3e1fec 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -652,6 +652,18 @@ static int ovl_symlink(struct inode *dir, struct dentry *dentry,
+ return ovl_create_object(dentry, S_IFLNK, 0, link);
+ }
+
++static int ovl_set_link_redirect(struct dentry *dentry)
++{
++ const struct cred *old_cred;
++ int err;
++
++ old_cred = ovl_override_creds(dentry->d_sb);
++ err = ovl_set_redirect(dentry, false);
++ revert_creds(old_cred);
++
++ return err;
++}
++
+ static int ovl_link(struct dentry *old, struct inode *newdir,
+ struct dentry *new)
+ {
+@@ -672,7 +684,7 @@ static int ovl_link(struct dentry *old, struct inode *newdir,
+ goto out_drop_write;
+
+ if (ovl_is_metacopy_dentry(old)) {
+- err = ovl_set_redirect(old, false);
++ err = ovl_set_link_redirect(old);
+ if (err)
+ goto out_drop_write;
+ }
+diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c
+index 8fa37cd7818a..54e5d17d7f3e 100644
+--- a/fs/overlayfs/export.c
++++ b/fs/overlayfs/export.c
+@@ -754,9 +754,8 @@ static struct dentry *ovl_lower_fh_to_d(struct super_block *sb,
+ goto out;
+ }
+
+- /* Otherwise, get a connected non-upper dir or disconnected non-dir */
+- if (d_is_dir(origin.dentry) &&
+- (origin.dentry->d_flags & DCACHE_DISCONNECTED)) {
++ /* Find origin.dentry again with ovl_acceptable() layer check */
++ if (d_is_dir(origin.dentry)) {
+ dput(origin.dentry);
+ origin.dentry = NULL;
+ err = ovl_check_origin_fh(ofs, fh, true, NULL, &stack);
+@@ -769,6 +768,7 @@ static struct dentry *ovl_lower_fh_to_d(struct super_block *sb,
+ goto out_err;
+ }
+
++ /* Get a connected non-upper dir or disconnected non-dir */
+ dentry = ovl_get_dentry(sb, NULL, &origin, index);
+
+ out:
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index cd58939dc977..7a85e609fc27 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -1566,7 +1566,6 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
+ cond_resched();
+
+ BUG_ON(!vma_can_userfault(vma));
+- WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
+
+ /*
+ * Nothing to do: this vma is already registered into this
+@@ -1575,6 +1574,8 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
+ if (!vma->vm_userfaultfd_ctx.ctx)
+ goto skip;
+
++ WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
++
+ if (vma->vm_start > start)
+ start = vma->vm_start;
+ vma_end = min(end, vma->vm_end);
+diff --git a/init/Kconfig b/init/Kconfig
+index 1e234e2f1cba..317d5ccb5191 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -415,6 +415,11 @@ config IRQ_TIME_ACCOUNTING
+
+ If in doubt, say N here.
+
++config HAVE_SCHED_AVG_IRQ
++ def_bool y
++ depends on IRQ_TIME_ACCOUNTING || PARAVIRT_TIME_ACCOUNTING
++ depends on SMP
++
+ config BSD_PROCESS_ACCT
+ bool "BSD Process Accounting"
+ depends on MULTIUSER
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 2beda4b726e2..13ddfa46d741 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -135,9 +135,8 @@ static void update_rq_clock_task(struct rq *rq, s64 delta)
+ * In theory, the compile should just see 0 here, and optimize out the call
+ * to sched_rt_avg_update. But I don't trust it...
+ */
+-#if defined(CONFIG_IRQ_TIME_ACCOUNTING) || defined(CONFIG_PARAVIRT_TIME_ACCOUNTING)
+- s64 steal = 0, irq_delta = 0;
+-#endif
++ s64 __maybe_unused steal = 0, irq_delta = 0;
++
+ #ifdef CONFIG_IRQ_TIME_ACCOUNTING
+ irq_delta = irq_time_read(cpu_of(rq)) - rq->prev_irq_time;
+
+@@ -177,7 +176,7 @@ static void update_rq_clock_task(struct rq *rq, s64 delta)
+
+ rq->clock_task += delta;
+
+-#ifdef HAVE_SCHED_AVG_IRQ
++#ifdef CONFIG_HAVE_SCHED_AVG_IRQ
+ if ((irq_delta + steal) && sched_feat(NONTASK_CAPACITY))
+ update_irq_load_avg(rq, irq_delta + steal);
+ #endif
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 1162552dc3cc..eabbf6b10b44 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7361,7 +7361,7 @@ static inline bool others_have_blocked(struct rq *rq)
+ if (READ_ONCE(rq->avg_dl.util_avg))
+ return true;
+
+-#if defined(CONFIG_IRQ_TIME_ACCOUNTING) || defined(CONFIG_PARAVIRT_TIME_ACCOUNTING)
++#ifdef CONFIG_HAVE_SCHED_AVG_IRQ
+ if (READ_ONCE(rq->avg_irq.util_avg))
+ return true;
+ #endif
+diff --git a/kernel/sched/pelt.c b/kernel/sched/pelt.c
+index 35475c0c5419..48a126486435 100644
+--- a/kernel/sched/pelt.c
++++ b/kernel/sched/pelt.c
+@@ -358,7 +358,7 @@ int update_dl_rq_load_avg(u64 now, struct rq *rq, int running)
+ return 0;
+ }
+
+-#if defined(CONFIG_IRQ_TIME_ACCOUNTING) || defined(CONFIG_PARAVIRT_TIME_ACCOUNTING)
++#ifdef CONFIG_HAVE_SCHED_AVG_IRQ
+ /*
+ * irq:
+ *
+diff --git a/kernel/sched/pelt.h b/kernel/sched/pelt.h
+index d2894db28955..7e56b489ff32 100644
+--- a/kernel/sched/pelt.h
++++ b/kernel/sched/pelt.h
+@@ -6,7 +6,7 @@ int __update_load_avg_cfs_rq(u64 now, int cpu, struct cfs_rq *cfs_rq);
+ int update_rt_rq_load_avg(u64 now, struct rq *rq, int running);
+ int update_dl_rq_load_avg(u64 now, struct rq *rq, int running);
+
+-#if defined(CONFIG_IRQ_TIME_ACCOUNTING) || defined(CONFIG_PARAVIRT_TIME_ACCOUNTING)
++#ifdef CONFIG_HAVE_SCHED_AVG_IRQ
+ int update_irq_load_avg(struct rq *rq, u64 running);
+ #else
+ static inline int
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 6c25bbe87bd3..b63172288f7b 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -859,8 +859,7 @@ struct rq {
+
+ struct sched_avg avg_rt;
+ struct sched_avg avg_dl;
+-#if defined(CONFIG_IRQ_TIME_ACCOUNTING) || defined(CONFIG_PARAVIRT_TIME_ACCOUNTING)
+-#define HAVE_SCHED_AVG_IRQ
++#ifdef CONFIG_HAVE_SCHED_AVG_IRQ
+ struct sched_avg avg_irq;
+ #endif
+ u64 idle_stamp;
+@@ -2215,7 +2214,7 @@ static inline unsigned long cpu_util_rt(struct rq *rq)
+ }
+ #endif
+
+-#ifdef HAVE_SCHED_AVG_IRQ
++#ifdef CONFIG_HAVE_SCHED_AVG_IRQ
+ static inline unsigned long cpu_util_irq(struct rq *rq)
+ {
+ return rq->avg_irq.util_avg;
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 77734451cb05..e23eb9fc77aa 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -5460,6 +5460,7 @@ void ftrace_destroy_filter_files(struct ftrace_ops *ops)
+ if (ops->flags & FTRACE_OPS_FL_ENABLED)
+ ftrace_shutdown(ops, 0);
+ ops->flags |= FTRACE_OPS_FL_DELETED;
++ ftrace_free_filter(ops);
+ mutex_unlock(&ftrace_lock);
+ }
+
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 84a65173b1e9..5574e862de8d 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -570,11 +570,13 @@ predicate_parse(const char *str, int nr_parens, int nr_preds,
+ }
+ }
+
++ kfree(op_stack);
++ kfree(inverts);
+ return prog;
+ out_free:
+ kfree(op_stack);
+- kfree(prog_stack);
+ kfree(inverts);
++ kfree(prog_stack);
+ return ERR_PTR(ret);
+ }
+
+@@ -1718,6 +1720,7 @@ static int create_filter(struct trace_event_call *call,
+ err = process_preds(call, filter_string, *filterp, pe);
+ if (err && set_str)
+ append_filter_err(pe, *filterp);
++ create_filter_finish(pe);
+
+ return err;
+ }
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index 2152d1e530cb..cd12ecb66eb9 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -732,8 +732,10 @@ int set_trigger_filter(char *filter_str,
+
+ /* The filter is for the 'trigger' event, not the triggered event */
+ ret = create_event_filter(file->event_call, filter_str, false, &filter);
+- if (ret)
+- goto out;
++ /*
++ * If create_event_filter() fails, filter still needs to be freed.
++ * Which the calling code will do with data->filter.
++ */
+ assign:
+ tmp = rcu_access_pointer(data->filter);
+
+diff --git a/scripts/spdxcheck.py b/scripts/spdxcheck.py
+index 5056fb3b897d..e559c6294c39 100755
+--- a/scripts/spdxcheck.py
++++ b/scripts/spdxcheck.py
+@@ -168,6 +168,7 @@ class id_parser(object):
+ self.curline = 0
+ try:
+ for line in fd:
++ line = line.decode(locale.getpreferredencoding(False), errors='ignore')
+ self.curline += 1
+ if self.curline > maxlines:
+ break
+@@ -249,12 +250,13 @@ if __name__ == '__main__':
+
+ try:
+ if len(args.path) and args.path[0] == '-':
+- parser.parse_lines(sys.stdin, args.maxlines, '-')
++ stdin = os.fdopen(sys.stdin.fileno(), 'rb')
++ parser.parse_lines(stdin, args.maxlines, '-')
+ else:
+ if args.path:
+ for p in args.path:
+ if os.path.isfile(p):
+- parser.parse_lines(open(p), args.maxlines, p)
++ parser.parse_lines(open(p, 'rb'), args.maxlines, p)
+ elif os.path.isdir(p):
+ scan_git_subtree(repo.head.reference.commit.tree, p)
+ else:
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-12-21 14:58 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-12-21 14:58 UTC (permalink / raw
To: gentoo-commits
commit: 224d691d2e62f06a1f76f01742102a16c366837b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 21 14:58:01 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Dec 21 14:58:01 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=224d691d
proj/linux-patches: Linux patch 4.19.12
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1011_linux-4.19.12.patch | 2424 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2428 insertions(+)
diff --git a/0000_README b/0000_README
index 72bf8ce..979d903 100644
--- a/0000_README
+++ b/0000_README
@@ -87,6 +87,10 @@ Patch: 1010_linux-4.19.11.patch
From: http://www.kernel.org
Desc: Linux 4.19.11
+Patch: 1011_linux-4.19.12.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.12
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1011_linux-4.19.12.patch b/1011_linux-4.19.12.patch
new file mode 100644
index 0000000..92dbcb5
--- /dev/null
+++ b/1011_linux-4.19.12.patch
@@ -0,0 +1,2424 @@
+diff --git a/Makefile b/Makefile
+index 676155d4dc3e..9770f29a690a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 11
++SUBLEVEL = 12
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h
+index c22b181e8206..2f39d9b3886e 100644
+--- a/arch/arc/include/asm/io.h
++++ b/arch/arc/include/asm/io.h
+@@ -12,6 +12,7 @@
+ #include <linux/types.h>
+ #include <asm/byteorder.h>
+ #include <asm/page.h>
++#include <asm/unaligned.h>
+
+ #ifdef CONFIG_ISA_ARCV2
+ #include <asm/barrier.h>
+@@ -94,6 +95,42 @@ static inline u32 __raw_readl(const volatile void __iomem *addr)
+ return w;
+ }
+
++/*
++ * {read,write}s{b,w,l}() repeatedly access the same IO address in
++ * native endianness in 8-, 16-, 32-bit chunks {into,from} memory,
++ * @count times
++ */
++#define __raw_readsx(t,f) \
++static inline void __raw_reads##f(const volatile void __iomem *addr, \
++ void *ptr, unsigned int count) \
++{ \
++ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \
++ u##t *buf = ptr; \
++ \
++ if (!count) \
++ return; \
++ \
++ /* Some ARC CPU's don't support unaligned accesses */ \
++ if (is_aligned) { \
++ do { \
++ u##t x = __raw_read##f(addr); \
++ *buf++ = x; \
++ } while (--count); \
++ } else { \
++ do { \
++ u##t x = __raw_read##f(addr); \
++ put_unaligned(x, buf++); \
++ } while (--count); \
++ } \
++}
++
++#define __raw_readsb __raw_readsb
++__raw_readsx(8, b)
++#define __raw_readsw __raw_readsw
++__raw_readsx(16, w)
++#define __raw_readsl __raw_readsl
++__raw_readsx(32, l)
++
+ #define __raw_writeb __raw_writeb
+ static inline void __raw_writeb(u8 b, volatile void __iomem *addr)
+ {
+@@ -126,6 +163,35 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
+
+ }
+
++#define __raw_writesx(t,f) \
++static inline void __raw_writes##f(volatile void __iomem *addr, \
++ const void *ptr, unsigned int count) \
++{ \
++ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \
++ const u##t *buf = ptr; \
++ \
++ if (!count) \
++ return; \
++ \
++ /* Some ARC CPU's don't support unaligned accesses */ \
++ if (is_aligned) { \
++ do { \
++ __raw_write##f(*buf++, addr); \
++ } while (--count); \
++ } else { \
++ do { \
++ __raw_write##f(get_unaligned(buf++), addr); \
++ } while (--count); \
++ } \
++}
++
++#define __raw_writesb __raw_writesb
++__raw_writesx(8, b)
++#define __raw_writesw __raw_writesw
++__raw_writesx(16, w)
++#define __raw_writesl __raw_writesl
++__raw_writesx(32, l)
++
+ /*
+ * MMIO can also get buffered/optimized in micro-arch, so barriers needed
+ * Based on ARM model for the typical use case
+@@ -141,10 +207,16 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr)
+ #define readb(c) ({ u8 __v = readb_relaxed(c); __iormb(); __v; })
+ #define readw(c) ({ u16 __v = readw_relaxed(c); __iormb(); __v; })
+ #define readl(c) ({ u32 __v = readl_relaxed(c); __iormb(); __v; })
++#define readsb(p,d,l) ({ __raw_readsb(p,d,l); __iormb(); })
++#define readsw(p,d,l) ({ __raw_readsw(p,d,l); __iormb(); })
++#define readsl(p,d,l) ({ __raw_readsl(p,d,l); __iormb(); })
+
+ #define writeb(v,c) ({ __iowmb(); writeb_relaxed(v,c); })
+ #define writew(v,c) ({ __iowmb(); writew_relaxed(v,c); })
+ #define writel(v,c) ({ __iowmb(); writel_relaxed(v,c); })
++#define writesb(p,d,l) ({ __iowmb(); __raw_writesb(p,d,l); })
++#define writesw(p,d,l) ({ __iowmb(); __raw_writesw(p,d,l); })
++#define writesl(p,d,l) ({ __iowmb(); __raw_writesl(p,d,l); })
+
+ /*
+ * Relaxed API for drivers which can handle barrier ordering themselves
+diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
+index 215df435bfb9..2149b47a0c5a 100644
+--- a/arch/arm/mm/cache-v7.S
++++ b/arch/arm/mm/cache-v7.S
+@@ -360,14 +360,16 @@ v7_dma_inv_range:
+ ALT_UP(W(nop))
+ #endif
+ mcrne p15, 0, r0, c7, c14, 1 @ clean & invalidate D / U line
++ addne r0, r0, r2
+
+ tst r1, r3
+ bic r1, r1, r3
+ mcrne p15, 0, r1, c7, c14, 1 @ clean & invalidate D / U line
+-1:
+- mcr p15, 0, r0, c7, c6, 1 @ invalidate D / U line
+- add r0, r0, r2
+ cmp r0, r1
++1:
++ mcrlo p15, 0, r0, c7, c6, 1 @ invalidate D / U line
++ addlo r0, r0, r2
++ cmplo r0, r1
+ blo 1b
+ dsb st
+ ret lr
+diff --git a/arch/arm/mm/cache-v7m.S b/arch/arm/mm/cache-v7m.S
+index 788486e830d3..32aa2a2aa260 100644
+--- a/arch/arm/mm/cache-v7m.S
++++ b/arch/arm/mm/cache-v7m.S
+@@ -73,9 +73,11 @@
+ /*
+ * dcimvac: Invalidate data cache line by MVA to PoC
+ */
+-.macro dcimvac, rt, tmp
+- v7m_cacheop \rt, \tmp, V7M_SCB_DCIMVAC
++.irp c,,eq,ne,cs,cc,mi,pl,vs,vc,hi,ls,ge,lt,gt,le,hs,lo
++.macro dcimvac\c, rt, tmp
++ v7m_cacheop \rt, \tmp, V7M_SCB_DCIMVAC, \c
+ .endm
++.endr
+
+ /*
+ * dccmvau: Clean data cache line by MVA to PoU
+@@ -369,14 +371,16 @@ v7m_dma_inv_range:
+ tst r0, r3
+ bic r0, r0, r3
+ dccimvacne r0, r3
++ addne r0, r0, r2
+ subne r3, r2, #1 @ restore r3, corrupted by v7m's dccimvac
+ tst r1, r3
+ bic r1, r1, r3
+ dccimvacne r1, r3
+-1:
+- dcimvac r0, r3
+- add r0, r0, r2
+ cmp r0, r1
++1:
++ dcimvaclo r0, r3
++ addlo r0, r0, r2
++ cmplo r0, r1
+ blo 1b
+ dsb st
+ ret lr
+diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
+index 66566472c153..1cb9c0f9b5d6 100644
+--- a/arch/arm/mm/dma-mapping.c
++++ b/arch/arm/mm/dma-mapping.c
+@@ -830,7 +830,7 @@ static int __arm_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+ void *cpu_addr, dma_addr_t dma_addr, size_t size,
+ unsigned long attrs)
+ {
+- int ret;
++ int ret = -ENXIO;
+ unsigned long nr_vma_pages = vma_pages(vma);
+ unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+ unsigned long pfn = dma_to_pfn(dev, dma_addr);
+diff --git a/arch/x86/include/asm/qspinlock.h b/arch/x86/include/asm/qspinlock.h
+index 3e70bed8a978..055c60a05756 100644
+--- a/arch/x86/include/asm/qspinlock.h
++++ b/arch/x86/include/asm/qspinlock.h
+@@ -6,9 +6,30 @@
+ #include <asm/cpufeature.h>
+ #include <asm-generic/qspinlock_types.h>
+ #include <asm/paravirt.h>
++#include <asm/rmwcc.h>
+
+ #define _Q_PENDING_LOOPS (1 << 9)
+
++#define queued_fetch_set_pending_acquire queued_fetch_set_pending_acquire
++
++static __always_inline bool __queued_RMW_btsl(struct qspinlock *lock)
++{
++ GEN_BINARY_RMWcc(LOCK_PREFIX "btsl", lock->val.counter,
++ "I", _Q_PENDING_OFFSET, "%0", c);
++}
++
++static __always_inline u32 queued_fetch_set_pending_acquire(struct qspinlock *lock)
++{
++ u32 val = 0;
++
++ if (__queued_RMW_btsl(lock))
++ val |= _Q_PENDING_VAL;
++
++ val |= atomic_read(&lock->val) & ~_Q_PENDING_MASK;
++
++ return val;
++}
++
+ #ifdef CONFIG_PARAVIRT_SPINLOCKS
+ extern void native_queued_spin_lock_slowpath(struct qspinlock *lock, u32 val);
+ extern void __pv_init_lock_hash(void);
+diff --git a/arch/x86/platform/efi/early_printk.c b/arch/x86/platform/efi/early_printk.c
+index 5fdacb322ceb..c3e6be110b7d 100644
+--- a/arch/x86/platform/efi/early_printk.c
++++ b/arch/x86/platform/efi/early_printk.c
+@@ -179,7 +179,7 @@ early_efi_write(struct console *con, const char *str, unsigned int num)
+ num--;
+ }
+
+- if (efi_x >= si->lfb_width) {
++ if (efi_x + font->width > si->lfb_width) {
+ efi_x = 0;
+ efi_y += font->height;
+ }
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index c5d15752dfb3..75b331f8a16a 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -1303,7 +1303,7 @@ static ssize_t scrub_store(struct device *dev,
+ if (nd_desc) {
+ struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
+
+- rc = acpi_nfit_ars_rescan(acpi_desc, 0);
++ rc = acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG);
+ }
+ device_unlock(dev);
+ if (rc)
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index a7f5202a4815..b8c3f9e6af89 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4602,6 +4602,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "SSD*INTEL*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Samsung*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "SAMSUNG*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "SAMSUNG*MZ7KM*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "ST[1248][0248]0[FH]*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, },
+
+ /*
+diff --git a/drivers/clk/mmp/clk.c b/drivers/clk/mmp/clk.c
+index ad8d483a35cd..ca7d37e2c7be 100644
+--- a/drivers/clk/mmp/clk.c
++++ b/drivers/clk/mmp/clk.c
+@@ -183,7 +183,7 @@ void mmp_clk_add(struct mmp_clk_unit *unit, unsigned int id,
+ pr_err("CLK %d has invalid pointer %p\n", id, clk);
+ return;
+ }
+- if (id > unit->nr_clks) {
++ if (id >= unit->nr_clks) {
+ pr_err("CLK %d is invalid\n", id);
+ return;
+ }
+diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
+index 75bf7b8f282f..0153c76d4a20 100644
+--- a/drivers/clk/mvebu/cp110-system-controller.c
++++ b/drivers/clk/mvebu/cp110-system-controller.c
+@@ -202,11 +202,11 @@ static struct clk_hw *cp110_of_clk_get(struct of_phandle_args *clkspec,
+ unsigned int idx = clkspec->args[1];
+
+ if (type == CP110_CLK_TYPE_CORE) {
+- if (idx > CP110_MAX_CORE_CLOCKS)
++ if (idx >= CP110_MAX_CORE_CLOCKS)
+ return ERR_PTR(-EINVAL);
+ return clk_data->hws[idx];
+ } else if (type == CP110_CLK_TYPE_GATABLE) {
+- if (idx > CP110_MAX_GATABLE_CLOCKS)
++ if (idx >= CP110_MAX_GATABLE_CLOCKS)
+ return ERR_PTR(-EINVAL);
+ return clk_data->hws[CP110_MAX_CORE_CLOCKS + idx];
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index bd98cc5fb97b..fd825d30edf1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -292,9 +292,6 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ if (!info->return_size || !info->return_pointer)
+ return -EINVAL;
+
+- /* Ensure IB tests are run on ring */
+- flush_delayed_work(&adev->late_init_work);
+-
+ switch (info->query) {
+ case AMDGPU_INFO_ACCEL_WORKING:
+ ui32 = adev->accel_working;
+@@ -861,6 +858,9 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
+ struct amdgpu_fpriv *fpriv;
+ int r, pasid;
+
++ /* Ensure IB tests are run on ring */
++ flush_delayed_work(&adev->late_init_work);
++
+ file_priv->driver_priv = NULL;
+
+ r = pm_runtime_get_sync(dev->dev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+index 072371ef5975..4f8f3bb21832 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+@@ -43,6 +43,7 @@ static void vcn_v1_0_set_enc_ring_funcs(struct amdgpu_device *adev);
+ static void vcn_v1_0_set_jpeg_ring_funcs(struct amdgpu_device *adev);
+ static void vcn_v1_0_set_irq_funcs(struct amdgpu_device *adev);
+ static void vcn_v1_0_jpeg_ring_set_patch_ring(struct amdgpu_ring *ring, uint32_t ptr);
++static int vcn_v1_0_set_powergating_state(void *handle, enum amd_powergating_state state);
+
+ /**
+ * vcn_v1_0_early_init - set function pointers
+@@ -216,7 +217,7 @@ static int vcn_v1_0_hw_fini(void *handle)
+ struct amdgpu_ring *ring = &adev->vcn.ring_dec;
+
+ if (RREG32_SOC15(VCN, 0, mmUVD_STATUS))
+- vcn_v1_0_stop(adev);
++ vcn_v1_0_set_powergating_state(adev, AMD_PG_STATE_GATE);
+
+ ring->ready = false;
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index b2f308766a9e..0941f3c689bc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -2530,6 +2530,8 @@ static void pplib_apply_display_requirements(
+ dc,
+ context->bw.dce.sclk_khz);
+
++ pp_display_cfg->min_dcfclock_khz = pp_display_cfg->min_engine_clock_khz;
++
+ pp_display_cfg->min_engine_clock_deep_sleep_khz
+ = context->bw.dce.sclk_deep_sleep_khz;
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
+index 8994aa5c8cf8..64596029b696 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
+@@ -365,6 +365,9 @@ int hwmgr_handle_task(struct pp_hwmgr *hwmgr, enum amd_pp_task task_id,
+
+ switch (task_id) {
+ case AMD_PP_TASK_DISPLAY_CONFIG_CHANGE:
++ ret = phm_pre_display_configuration_changed(hwmgr);
++ if (ret)
++ return ret;
+ ret = phm_set_cpu_power_state(hwmgr);
+ if (ret)
+ return ret;
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
+index 91ffb7bc4ee7..56437866d120 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c
+@@ -265,8 +265,6 @@ int psm_adjust_power_state_dynamic(struct pp_hwmgr *hwmgr, bool skip,
+ if (skip)
+ return 0;
+
+- phm_pre_display_configuration_changed(hwmgr);
+-
+ phm_display_configuration_changed(hwmgr);
+
+ if (hwmgr->ps)
+diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c
+index 0cd827e11fa2..de26df0c6044 100644
+--- a/drivers/gpu/drm/ast/ast_fb.c
++++ b/drivers/gpu/drm/ast/ast_fb.c
+@@ -263,6 +263,7 @@ static void ast_fbdev_destroy(struct drm_device *dev,
+ {
+ struct ast_framebuffer *afb = &afbdev->afb;
+
++ drm_crtc_force_disable_all(dev);
+ drm_fb_helper_unregister_fbi(&afbdev->helper);
+
+ if (afb->obj) {
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index cd02eae884cc..4752f08f0884 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -2122,7 +2122,6 @@ struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane)
+ NULL);
+
+ drm_crtc_helper_add(crtc, &dpu_crtc_helper_funcs);
+- plane->crtc = crtc;
+
+ /* save user friendly CRTC name for later */
+ snprintf(dpu_crtc->name, DPU_CRTC_NAME_SIZE, "crtc%u", crtc->base.id);
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index 1b4de3486ef9..ec3fd67378c1 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -503,8 +503,6 @@ static void dpu_encoder_destroy(struct drm_encoder *drm_enc)
+
+ drm_encoder_cleanup(drm_enc);
+ mutex_destroy(&dpu_enc->enc_lock);
+-
+- kfree(dpu_enc);
+ }
+
+ void dpu_encoder_helper_split_config(
+diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+index 4c03f0b7343e..41bec570c518 100644
+--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+@@ -39,6 +39,8 @@
+ #define DSI_PIXEL_PLL_CLK 1
+ #define NUM_PROVIDED_CLKS 2
+
++#define VCO_REF_CLK_RATE 19200000
++
+ struct dsi_pll_regs {
+ u32 pll_prop_gain_rate;
+ u32 pll_lockdet_rate;
+@@ -316,7 +318,7 @@ static int dsi_pll_10nm_vco_set_rate(struct clk_hw *hw, unsigned long rate,
+ parent_rate);
+
+ pll_10nm->vco_current_rate = rate;
+- pll_10nm->vco_ref_clk_rate = parent_rate;
++ pll_10nm->vco_ref_clk_rate = VCO_REF_CLK_RATE;
+
+ dsi_pll_setup_config(pll_10nm);
+
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
+index c79659ca5706..33e083f71a17 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
+@@ -332,6 +332,12 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi,
+ goto fail;
+ }
+
++ ret = msm_hdmi_hpd_enable(hdmi->connector);
++ if (ret < 0) {
++ DRM_DEV_ERROR(&hdmi->pdev->dev, "failed to enable HPD: %d\n", ret);
++ goto fail;
++ }
++
+ encoder->bridge = hdmi->bridge;
+
+ priv->bridges[priv->num_bridges++] = hdmi->bridge;
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.h b/drivers/gpu/drm/msm/hdmi/hdmi.h
+index accc9a61611d..5c5df6ab2a57 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.h
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.h
+@@ -245,6 +245,7 @@ void msm_hdmi_bridge_destroy(struct drm_bridge *bridge);
+
+ void msm_hdmi_connector_irq(struct drm_connector *connector);
+ struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi);
++int msm_hdmi_hpd_enable(struct drm_connector *connector);
+
+ /*
+ * i2c adapter for ddc:
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
+index e9c9a0af508e..30e908dfded7 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
+@@ -167,8 +167,9 @@ static void enable_hpd_clocks(struct hdmi *hdmi, bool enable)
+ }
+ }
+
+-static int hpd_enable(struct hdmi_connector *hdmi_connector)
++int msm_hdmi_hpd_enable(struct drm_connector *connector)
+ {
++ struct hdmi_connector *hdmi_connector = to_hdmi_connector(connector);
+ struct hdmi *hdmi = hdmi_connector->hdmi;
+ const struct hdmi_platform_config *config = hdmi->config;
+ struct device *dev = &hdmi->pdev->dev;
+@@ -450,7 +451,6 @@ struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi)
+ {
+ struct drm_connector *connector = NULL;
+ struct hdmi_connector *hdmi_connector;
+- int ret;
+
+ hdmi_connector = kzalloc(sizeof(*hdmi_connector), GFP_KERNEL);
+ if (!hdmi_connector)
+@@ -471,12 +471,6 @@ struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi)
+ connector->interlace_allowed = 0;
+ connector->doublescan_allowed = 0;
+
+- ret = hpd_enable(hdmi_connector);
+- if (ret) {
+- dev_err(&hdmi->pdev->dev, "failed to enable HPD: %d\n", ret);
+- return ERR_PTR(ret);
+- }
+-
+ drm_connector_attach_encoder(connector, hdmi->encoder);
+
+ return connector;
+diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
+index c1f1779c980f..2b7bb6e166d3 100644
+--- a/drivers/gpu/drm/msm/msm_atomic.c
++++ b/drivers/gpu/drm/msm/msm_atomic.c
+@@ -32,7 +32,12 @@ static void msm_atomic_wait_for_commit_done(struct drm_device *dev,
+ if (!new_crtc_state->active)
+ continue;
+
++ if (drm_crtc_vblank_get(crtc))
++ continue;
++
+ kms->funcs->wait_for_crtc_commit_done(kms, crtc);
++
++ drm_crtc_vblank_put(crtc);
+ }
+ }
+
+diff --git a/drivers/gpu/drm/msm/msm_debugfs.c b/drivers/gpu/drm/msm/msm_debugfs.c
+index f0da0d3c8a80..d756436c1fcd 100644
+--- a/drivers/gpu/drm/msm/msm_debugfs.c
++++ b/drivers/gpu/drm/msm/msm_debugfs.c
+@@ -84,7 +84,7 @@ static int msm_gpu_open(struct inode *inode, struct file *file)
+
+ ret = mutex_lock_interruptible(&dev->struct_mutex);
+ if (ret)
+- return ret;
++ goto free_priv;
+
+ pm_runtime_get_sync(&gpu->pdev->dev);
+ show_priv->state = gpu->funcs->gpu_state_get(gpu);
+@@ -94,13 +94,20 @@ static int msm_gpu_open(struct inode *inode, struct file *file)
+
+ if (IS_ERR(show_priv->state)) {
+ ret = PTR_ERR(show_priv->state);
+- kfree(show_priv);
+- return ret;
++ goto free_priv;
+ }
+
+ show_priv->dev = dev;
+
+- return single_open(file, msm_gpu_show, show_priv);
++ ret = single_open(file, msm_gpu_show, show_priv);
++ if (ret)
++ goto free_priv;
++
++ return 0;
++
++free_priv:
++ kfree(show_priv);
++ return ret;
+ }
+
+ static const struct file_operations msm_gpu_fops = {
+diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
+index 46e6b82f7b66..52a2146dc1f2 100644
+--- a/drivers/gpu/drm/msm/msm_gpu.c
++++ b/drivers/gpu/drm/msm/msm_gpu.c
+@@ -425,10 +425,9 @@ static void recover_worker(struct work_struct *work)
+ if (submit) {
+ struct task_struct *task;
+
+- rcu_read_lock();
+- task = pid_task(submit->pid, PIDTYPE_PID);
++ task = get_pid_task(submit->pid, PIDTYPE_PID);
+ if (task) {
+- comm = kstrdup(task->comm, GFP_ATOMIC);
++ comm = kstrdup(task->comm, GFP_KERNEL);
+
+ /*
+ * So slightly annoying, in other paths like
+@@ -441,10 +440,10 @@ static void recover_worker(struct work_struct *work)
+ * about the submit going away.
+ */
+ mutex_unlock(&dev->struct_mutex);
+- cmd = kstrdup_quotable_cmdline(task, GFP_ATOMIC);
++ cmd = kstrdup_quotable_cmdline(task, GFP_KERNEL);
++ put_task_struct(task);
+ mutex_lock(&dev->struct_mutex);
+ }
+- rcu_read_unlock();
+
+ if (comm && cmd) {
+ dev_err(dev->dev, "%s: offending task: %s (%s)\n",
+diff --git a/drivers/gpu/drm/msm/msm_iommu.c b/drivers/gpu/drm/msm/msm_iommu.c
+index b23d33622f37..2a90aa4caec0 100644
+--- a/drivers/gpu/drm/msm/msm_iommu.c
++++ b/drivers/gpu/drm/msm/msm_iommu.c
+@@ -66,7 +66,7 @@ static int msm_iommu_map(struct msm_mmu *mmu, uint64_t iova,
+ // pm_runtime_get_sync(mmu->dev);
+ ret = iommu_map_sg(iommu->domain, iova, sgt->sgl, sgt->nents, prot);
+ // pm_runtime_put_sync(mmu->dev);
+- WARN_ON(ret < 0);
++ WARN_ON(!ret);
+
+ return (ret == len) ? 0 : -EINVAL;
+ }
+diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
+index 3aa8a8576abe..f7a0edea4705 100644
+--- a/drivers/gpu/drm/msm/msm_rd.c
++++ b/drivers/gpu/drm/msm/msm_rd.c
+@@ -316,10 +316,11 @@ static void snapshot_buf(struct msm_rd_state *rd,
+ uint64_t iova, uint32_t size)
+ {
+ struct msm_gem_object *obj = submit->bos[idx].obj;
++ unsigned offset = 0;
+ const char *buf;
+
+ if (iova) {
+- buf += iova - submit->bos[idx].iova;
++ offset = iova - submit->bos[idx].iova;
+ } else {
+ iova = submit->bos[idx].iova;
+ size = obj->base.size;
+@@ -340,6 +341,8 @@ static void snapshot_buf(struct msm_rd_state *rd,
+ if (IS_ERR(buf))
+ return;
+
++ buf += offset;
++
+ rd_write_section(rd, RD_BUFFER_CONTENTS, buf, size);
+
+ msm_gem_put_vaddr(&obj->base);
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
+index 046a6dda690a..40904e84f883 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
+@@ -492,8 +492,10 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
+ if (!fbo)
+ return -ENOMEM;
+
+- ttm_bo_get(bo);
+ fbo->base = *bo;
++ fbo->base.mem.placement |= TTM_PL_FLAG_NO_EVICT;
++
++ ttm_bo_get(bo);
+ fbo->bo = bo;
+
+ /**
+diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c
+index b372854cf38d..704049e62d58 100644
+--- a/drivers/hid/hid-hyperv.c
++++ b/drivers/hid/hid-hyperv.c
+@@ -309,7 +309,7 @@ static void mousevsc_on_receive(struct hv_device *device,
+ hid_input_report(input_dev->hid_device, HID_INPUT_REPORT,
+ input_dev->input_buf, len, 1);
+
+- pm_wakeup_event(&input_dev->device->device, 0);
++ pm_wakeup_hard_event(&input_dev->device->device);
+
+ break;
+ default:
+diff --git a/drivers/i2c/busses/i2c-axxia.c b/drivers/i2c/busses/i2c-axxia.c
+index 8e60048a33f8..51d34959709b 100644
+--- a/drivers/i2c/busses/i2c-axxia.c
++++ b/drivers/i2c/busses/i2c-axxia.c
+@@ -74,8 +74,7 @@
+ MST_STATUS_ND)
+ #define MST_STATUS_ERR (MST_STATUS_NAK | \
+ MST_STATUS_AL | \
+- MST_STATUS_IP | \
+- MST_STATUS_TSS)
++ MST_STATUS_IP)
+ #define MST_TX_BYTES_XFRD 0x50
+ #define MST_RX_BYTES_XFRD 0x54
+ #define SCL_HIGH_PERIOD 0x80
+@@ -241,7 +240,7 @@ static int axxia_i2c_empty_rx_fifo(struct axxia_i2c_dev *idev)
+ */
+ if (c <= 0 || c > I2C_SMBUS_BLOCK_MAX) {
+ idev->msg_err = -EPROTO;
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ complete(&idev->msg_complete);
+ break;
+ }
+@@ -299,14 +298,19 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev)
+
+ if (status & MST_STATUS_SCC) {
+ /* Stop completed */
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ complete(&idev->msg_complete);
+ } else if (status & MST_STATUS_SNS) {
+ /* Transfer done */
+- i2c_int_disable(idev, ~0);
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
+ if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len)
+ axxia_i2c_empty_rx_fifo(idev);
+ complete(&idev->msg_complete);
++ } else if (status & MST_STATUS_TSS) {
++ /* Transfer timeout */
++ idev->msg_err = -ETIMEDOUT;
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
++ complete(&idev->msg_complete);
+ } else if (unlikely(status & MST_STATUS_ERR)) {
+ /* Transfer error */
+ i2c_int_disable(idev, ~0);
+@@ -339,10 +343,10 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ u32 rx_xfer, tx_xfer;
+ u32 addr_1, addr_2;
+ unsigned long time_left;
++ unsigned int wt_value;
+
+ idev->msg = msg;
+ idev->msg_xfrd = 0;
+- idev->msg_err = 0;
+ reinit_completion(&idev->msg_complete);
+
+ if (i2c_m_ten(msg)) {
+@@ -383,9 +387,18 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ else if (axxia_i2c_fill_tx_fifo(idev) != 0)
+ int_mask |= MST_STATUS_TFL;
+
++ wt_value = WT_VALUE(readl(idev->base + WAIT_TIMER_CONTROL));
++ /* Disable wait timer temporarly */
++ writel(wt_value, idev->base + WAIT_TIMER_CONTROL);
++ /* Check if timeout error happened */
++ if (idev->msg_err)
++ goto out;
++
+ /* Start manual mode */
+ writel(CMD_MANUAL, idev->base + MST_COMMAND);
+
++ writel(WT_EN | wt_value, idev->base + WAIT_TIMER_CONTROL);
++
+ i2c_int_enable(idev, int_mask);
+
+ time_left = wait_for_completion_timeout(&idev->msg_complete,
+@@ -396,13 +409,15 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+ if (readl(idev->base + MST_COMMAND) & CMD_BUSY)
+ dev_warn(idev->dev, "busy after xfer\n");
+
+- if (time_left == 0)
++ if (time_left == 0) {
+ idev->msg_err = -ETIMEDOUT;
+-
+- if (idev->msg_err == -ETIMEDOUT)
+ i2c_recover_bus(&idev->adapter);
++ axxia_i2c_init(idev);
++ }
+
+- if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO)
++out:
++ if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO &&
++ idev->msg_err != -ETIMEDOUT)
+ axxia_i2c_init(idev);
+
+ return idev->msg_err;
+@@ -410,7 +425,7 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg)
+
+ static int axxia_i2c_stop(struct axxia_i2c_dev *idev)
+ {
+- u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC;
++ u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC | MST_STATUS_TSS;
+ unsigned long time_left;
+
+ reinit_completion(&idev->msg_complete);
+@@ -437,6 +452,9 @@ axxia_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
+ int i;
+ int ret = 0;
+
++ idev->msg_err = 0;
++ i2c_int_enable(idev, MST_STATUS_TSS);
++
+ for (i = 0; ret == 0 && i < num; ++i)
+ ret = axxia_i2c_xfer_msg(idev, &msgs[i]);
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 4aa7dde876f3..254e6219e538 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -779,6 +779,11 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
+
+ pm_runtime_get_sync(dev);
+
++ /* Check bus state before init otherwise bus busy info will be lost */
++ ret = rcar_i2c_bus_barrier(priv);
++ if (ret < 0)
++ goto out;
++
+ /* Gen3 needs a reset before allowing RXDMA once */
+ if (priv->devtype == I2C_RCAR_GEN3) {
+ priv->flags |= ID_P_NO_RXDMA;
+@@ -791,10 +796,6 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
+
+ rcar_i2c_init(priv);
+
+- ret = rcar_i2c_bus_barrier(priv);
+- if (ret < 0)
+- goto out;
+-
+ for (i = 0; i < num; i++)
+ rcar_i2c_request_dma(priv, msgs + i);
+
+diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c
+index 7e9a2bbf5ddc..ff3f4553648f 100644
+--- a/drivers/i2c/busses/i2c-scmi.c
++++ b/drivers/i2c/busses/i2c-scmi.c
+@@ -367,6 +367,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ {
+ struct acpi_smbus_cmi *smbus_cmi;
+ const struct acpi_device_id *id;
++ int ret;
+
+ smbus_cmi = kzalloc(sizeof(struct acpi_smbus_cmi), GFP_KERNEL);
+ if (!smbus_cmi)
+@@ -388,8 +389,10 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ acpi_walk_namespace(ACPI_TYPE_METHOD, smbus_cmi->handle, 1,
+ acpi_smbus_cmi_query_methods, NULL, smbus_cmi, NULL);
+
+- if (smbus_cmi->cap_info == 0)
++ if (smbus_cmi->cap_info == 0) {
++ ret = -ENODEV;
+ goto err;
++ }
+
+ snprintf(smbus_cmi->adapter.name, sizeof(smbus_cmi->adapter.name),
+ "SMBus CMI adapter %s",
+@@ -400,7 +403,8 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ smbus_cmi->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
+ smbus_cmi->adapter.dev.parent = &device->dev;
+
+- if (i2c_add_adapter(&smbus_cmi->adapter)) {
++ ret = i2c_add_adapter(&smbus_cmi->adapter);
++ if (ret) {
+ dev_err(&device->dev, "Couldn't register adapter!\n");
+ goto err;
+ }
+@@ -410,7 +414,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
+ err:
+ kfree(smbus_cmi);
+ device->driver_data = NULL;
+- return -EIO;
++ return ret;
+ }
+
+ static int acpi_smbus_cmi_remove(struct acpi_device *device)
+diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
+index a403e8579b65..bc26ec822e26 100644
+--- a/drivers/i2c/busses/i2c-uniphier-f.c
++++ b/drivers/i2c/busses/i2c-uniphier-f.c
+@@ -470,9 +470,26 @@ static void uniphier_fi2c_hw_init(struct uniphier_fi2c_priv *priv)
+
+ uniphier_fi2c_reset(priv);
+
++ /*
++ * Standard-mode: tLOW + tHIGH = 10 us
++ * Fast-mode: tLOW + tHIGH = 2.5 us
++ */
+ writel(cyc, priv->membase + UNIPHIER_FI2C_CYC);
+- writel(cyc / 2, priv->membase + UNIPHIER_FI2C_LCTL);
++ /*
++ * Standard-mode: tLOW = 4.7 us, tHIGH = 4.0 us, tBUF = 4.7 us
++ * Fast-mode: tLOW = 1.3 us, tHIGH = 0.6 us, tBUF = 1.3 us
++ * "tLow/tHIGH = 5/4" meets both.
++ */
++ writel(cyc * 5 / 9, priv->membase + UNIPHIER_FI2C_LCTL);
++ /*
++ * Standard-mode: tHD;STA = 4.0 us, tSU;STA = 4.7 us, tSU;STO = 4.0 us
++ * Fast-mode: tHD;STA = 0.6 us, tSU;STA = 0.6 us, tSU;STO = 0.6 us
++ */
+ writel(cyc / 2, priv->membase + UNIPHIER_FI2C_SSUT);
++ /*
++ * Standard-mode: tSU;DAT = 250 ns
++ * Fast-mode: tSU;DAT = 100 ns
++ */
+ writel(cyc / 16, priv->membase + UNIPHIER_FI2C_DSUT);
+
+ uniphier_fi2c_prepare_operation(priv);
+diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c
+index 454f914ae66d..c488e558aef7 100644
+--- a/drivers/i2c/busses/i2c-uniphier.c
++++ b/drivers/i2c/busses/i2c-uniphier.c
+@@ -320,7 +320,13 @@ static void uniphier_i2c_hw_init(struct uniphier_i2c_priv *priv)
+
+ uniphier_i2c_reset(priv, true);
+
+- writel((cyc / 2 << 16) | cyc, priv->membase + UNIPHIER_I2C_CLK);
++ /*
++ * Bit30-16: clock cycles of tLOW.
++ * Standard-mode: tLOW = 4.7 us, tHIGH = 4.0 us
++ * Fast-mode: tLOW = 1.3 us, tHIGH = 0.6 us
++ * "tLow/tHIGH = 5/4" meets both.
++ */
++ writel((cyc * 5 / 9 << 16) | cyc, priv->membase + UNIPHIER_I2C_CLK);
+
+ uniphier_i2c_reset(priv, false);
+ }
+diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c
+index c5b902b86b44..203ed4adc04a 100644
+--- a/drivers/ide/pmac.c
++++ b/drivers/ide/pmac.c
+@@ -920,6 +920,7 @@ static u8 pmac_ide_cable_detect(ide_hwif_t *hwif)
+ struct device_node *root = of_find_node_by_path("/");
+ const char *model = of_get_property(root, "model", NULL);
+
++ of_node_put(root);
+ /* Get cable type from device-tree. */
+ if (cable && !strncmp(cable, "80-", 3)) {
+ /* Some drives fail to detect 80c cable in PowerBook */
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index 39134dd305f5..51831bfbf90f 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -187,7 +187,6 @@ int hfi1_user_sdma_alloc_queues(struct hfi1_ctxtdata *uctxt,
+ pq->ctxt = uctxt->ctxt;
+ pq->subctxt = fd->subctxt;
+ pq->n_max_reqs = hfi1_sdma_comp_ring_size;
+- pq->state = SDMA_PKT_Q_INACTIVE;
+ atomic_set(&pq->n_reqs, 0);
+ init_waitqueue_head(&pq->wait);
+ atomic_set(&pq->n_locked, 0);
+@@ -276,7 +275,7 @@ int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd,
+ /* Wait until all requests have been freed. */
+ wait_event_interruptible(
+ pq->wait,
+- (READ_ONCE(pq->state) == SDMA_PKT_Q_INACTIVE));
++ !atomic_read(&pq->n_reqs));
+ kfree(pq->reqs);
+ kfree(pq->req_in_use);
+ kmem_cache_destroy(pq->txreq_cache);
+@@ -312,6 +311,13 @@ static u8 dlid_to_selector(u16 dlid)
+ return mapping[hash];
+ }
+
++/**
++ * hfi1_user_sdma_process_request() - Process and start a user sdma request
++ * @fd: valid file descriptor
++ * @iovec: array of io vectors to process
++ * @dim: overall iovec array size
++ * @count: number of io vector array entries processed
++ */
+ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ struct iovec *iovec, unsigned long dim,
+ unsigned long *count)
+@@ -560,20 +566,12 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ req->ahg_idx = sdma_ahg_alloc(req->sde);
+
+ set_comp_state(pq, cq, info.comp_idx, QUEUED, 0);
++ pq->state = SDMA_PKT_Q_ACTIVE;
+ /* Send the first N packets in the request to buy us some time */
+ ret = user_sdma_send_pkts(req, pcount);
+ if (unlikely(ret < 0 && ret != -EBUSY))
+ goto free_req;
+
+- /*
+- * It is possible that the SDMA engine would have processed all the
+- * submitted packets by the time we get here. Therefore, only set
+- * packet queue state to ACTIVE if there are still uncompleted
+- * requests.
+- */
+- if (atomic_read(&pq->n_reqs))
+- xchg(&pq->state, SDMA_PKT_Q_ACTIVE);
+-
+ /*
+ * This is a somewhat blocking send implementation.
+ * The driver will block the caller until all packets of the
+@@ -1409,10 +1407,8 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status)
+
+ static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq)
+ {
+- if (atomic_dec_and_test(&pq->n_reqs)) {
+- xchg(&pq->state, SDMA_PKT_Q_INACTIVE);
++ if (atomic_dec_and_test(&pq->n_reqs))
+ wake_up(&pq->wait);
+- }
+ }
+
+ static void user_sdma_free_request(struct user_sdma_request *req, bool unpin)
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h
+index 0ae06456c868..91c343f91776 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.h
++++ b/drivers/infiniband/hw/hfi1/user_sdma.h
+@@ -105,9 +105,10 @@ static inline int ahg_header_set(u32 *arr, int idx, size_t array_size,
+ #define TXREQ_FLAGS_REQ_ACK BIT(0) /* Set the ACK bit in the header */
+ #define TXREQ_FLAGS_REQ_DISABLE_SH BIT(1) /* Disable header suppression */
+
+-#define SDMA_PKT_Q_INACTIVE BIT(0)
+-#define SDMA_PKT_Q_ACTIVE BIT(1)
+-#define SDMA_PKT_Q_DEFERRED BIT(2)
++enum pkt_q_sdma_state {
++ SDMA_PKT_Q_ACTIVE,
++ SDMA_PKT_Q_DEFERRED,
++};
+
+ /*
+ * Maximum retry attempts to submit a TX request
+@@ -133,7 +134,7 @@ struct hfi1_user_sdma_pkt_q {
+ struct user_sdma_request *reqs;
+ unsigned long *req_in_use;
+ struct iowait busy;
+- unsigned state;
++ enum pkt_q_sdma_state state;
+ wait_queue_head_t wait;
+ unsigned long unpinned;
+ struct mmu_rb_handler *handler;
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index 46406345742b..a7dc286f406c 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -60,8 +60,18 @@
+
+ /* OMAP4 values */
+ #define OMAP4_VAL_IRQDISABLE 0x0
+-#define OMAP4_VAL_DEBOUNCINGTIME 0x7
+-#define OMAP4_VAL_PVT 0x7
++
++/*
++ * Errata i689: If a key is released for a time shorter than debounce time,
++ * the keyboard will idle and never detect the key release. The workaround
++ * is to use at least a 12ms debounce time. See omap5432 TRM chapter
++ * "26.4.6.2 Keyboard Controller Timer" for more information.
++ */
++#define OMAP4_KEYPAD_PTV_DIV_128 0x6
++#define OMAP4_KEYPAD_DEBOUNCINGTIME_MS(dbms, ptv) \
++ ((((dbms) * 1000) / ((1 << ((ptv) + 1)) * (1000000 / 32768))) - 1)
++#define OMAP4_VAL_DEBOUNCINGTIME_16MS \
++ OMAP4_KEYPAD_DEBOUNCINGTIME_MS(16, OMAP4_KEYPAD_PTV_DIV_128)
+
+ enum {
+ KBD_REVISION_OMAP4 = 0,
+@@ -181,9 +191,9 @@ static int omap4_keypad_open(struct input_dev *input)
+
+ kbd_writel(keypad_data, OMAP4_KBD_CTRL,
+ OMAP4_DEF_CTRL_NOSOFTMODE |
+- (OMAP4_VAL_PVT << OMAP4_DEF_CTRL_PTV_SHIFT));
++ (OMAP4_KEYPAD_PTV_DIV_128 << OMAP4_DEF_CTRL_PTV_SHIFT));
+ kbd_writel(keypad_data, OMAP4_KBD_DEBOUNCINGTIME,
+- OMAP4_VAL_DEBOUNCINGTIME);
++ OMAP4_VAL_DEBOUNCINGTIME_16MS);
+ /* clear pending interrupts */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index c42813d50591..2bd5bb11c8ba 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -178,6 +178,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN200f", /* T450s */
++ "SYN3221", /* HP 15-ay000 */
+ NULL
+ };
+
+diff --git a/drivers/input/serio/hyperv-keyboard.c b/drivers/input/serio/hyperv-keyboard.c
+index 47a0e81a2989..a8b9be3e28db 100644
+--- a/drivers/input/serio/hyperv-keyboard.c
++++ b/drivers/input/serio/hyperv-keyboard.c
+@@ -177,7 +177,7 @@ static void hv_kbd_on_receive(struct hv_device *hv_dev,
+ * state because the Enter-UP can trigger a wakeup at once.
+ */
+ if (!(info & IS_BREAK))
+- pm_wakeup_event(&hv_dev->device, 0);
++ pm_wakeup_hard_event(&hv_dev->device);
+
+ break;
+
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index f43fb2f958a5..93dfcef8afc4 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -2086,6 +2086,9 @@ void bond_3ad_unbind_slave(struct slave *slave)
+ aggregator->aggregator_identifier);
+
+ /* Tell the partner that this port is not suitable for aggregation */
++ port->actor_oper_port_state &= ~AD_STATE_SYNCHRONIZATION;
++ port->actor_oper_port_state &= ~AD_STATE_COLLECTING;
++ port->actor_oper_port_state &= ~AD_STATE_DISTRIBUTING;
+ port->actor_oper_port_state &= ~AD_STATE_AGGREGATION;
+ __update_lacpdu_from_port(port);
+ ad_lacpdu_send(port);
+diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c
+index 65f10fec25b3..0b3e51f248c2 100644
+--- a/drivers/net/dsa/mv88e6060.c
++++ b/drivers/net/dsa/mv88e6060.c
+@@ -116,8 +116,7 @@ static int mv88e6060_switch_reset(struct dsa_switch *ds)
+ /* Reset the switch. */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+ GLOBAL_ATU_CONTROL_SWRESET |
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ /* Wait up to one second for reset to complete. */
+ timeout = jiffies + 1 * HZ;
+@@ -142,13 +141,10 @@ static int mv88e6060_setup_global(struct dsa_switch *ds)
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_CONTROL, GLOBAL_CONTROL_MAX_FRAME_1536);
+
+- /* Enable automatic address learning, set the address
+- * database size to 1024 entries, and set the default aging
+- * time to 5 minutes.
++ /* Disable automatic address learning.
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 88705dee5b95..56363ff5c891 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -667,7 +667,7 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
+
+ rx_stat = (0x0000003CU & rxd_wb->status) >> 2;
+
+- is_rx_check_sum_enabled = (rxd_wb->type) & (0x3U << 19);
++ is_rx_check_sum_enabled = (rxd_wb->type >> 19) & 0x3U;
+
+ pkt_type = 0xFFU & (rxd_wb->type >> 4);
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+index ddd7431579f4..c99b59fe4c8f 100644
+--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
++++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+@@ -367,13 +367,15 @@ lio_vf_rep_packet_sent_callback(struct octeon_device *oct,
+ struct octeon_soft_command *sc = (struct octeon_soft_command *)buf;
+ struct sk_buff *skb = sc->ctxptr;
+ struct net_device *ndev = skb->dev;
++ u32 iq_no;
+
+ dma_unmap_single(&oct->pci_dev->dev, sc->dmadptr,
+ sc->datasize, DMA_TO_DEVICE);
+ dev_kfree_skb_any(skb);
++ iq_no = sc->iq_no;
+ octeon_free_soft_command(oct, sc);
+
+- if (octnet_iq_is_full(oct, sc->iq_no))
++ if (octnet_iq_is_full(oct, iq_no))
+ return;
+
+ if (netif_queue_stopped(ndev))
+diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
+index c415ac67cb7b..e80fedb27cee 100644
+--- a/drivers/net/ethernet/freescale/fman/fman.c
++++ b/drivers/net/ethernet/freescale/fman/fman.c
+@@ -2786,7 +2786,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
+ if (!muram_node) {
+ dev_err(&of_dev->dev, "%s: could not find MURAM node\n",
+ __func__);
+- goto fman_node_put;
++ goto fman_free;
+ }
+
+ err = of_address_to_resource(muram_node, 0,
+@@ -2795,11 +2795,10 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
+ of_node_put(muram_node);
+ dev_err(&of_dev->dev, "%s: of_address_to_resource() = %d\n",
+ __func__, err);
+- goto fman_node_put;
++ goto fman_free;
+ }
+
+ of_node_put(muram_node);
+- of_node_put(fm_node);
+
+ err = devm_request_irq(&of_dev->dev, irq, fman_irq, IRQF_SHARED,
+ "fman", fman);
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index a74002b43b51..6320e080b831 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -4262,8 +4262,27 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+ unsigned long *supported,
+ struct phylink_link_state *state)
+ {
++ struct mvpp2_port *port = netdev_priv(dev);
+ __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+
++ /* Invalid combinations */
++ switch (state->interface) {
++ case PHY_INTERFACE_MODE_10GKR:
++ case PHY_INTERFACE_MODE_XAUI:
++ if (port->gop_id != 0)
++ goto empty_set;
++ break;
++ case PHY_INTERFACE_MODE_RGMII:
++ case PHY_INTERFACE_MODE_RGMII_ID:
++ case PHY_INTERFACE_MODE_RGMII_RXID:
++ case PHY_INTERFACE_MODE_RGMII_TXID:
++ if (port->gop_id == 0)
++ goto empty_set;
++ break;
++ default:
++ break;
++ }
++
+ phylink_set(mask, Autoneg);
+ phylink_set_port_modes(mask);
+ phylink_set(mask, Pause);
+@@ -4271,6 +4290,8 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+
+ switch (state->interface) {
+ case PHY_INTERFACE_MODE_10GKR:
++ case PHY_INTERFACE_MODE_XAUI:
++ case PHY_INTERFACE_MODE_NA:
+ phylink_set(mask, 10000baseCR_Full);
+ phylink_set(mask, 10000baseSR_Full);
+ phylink_set(mask, 10000baseLR_Full);
+@@ -4278,7 +4299,11 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+ phylink_set(mask, 10000baseER_Full);
+ phylink_set(mask, 10000baseKR_Full);
+ /* Fall-through */
+- default:
++ case PHY_INTERFACE_MODE_RGMII:
++ case PHY_INTERFACE_MODE_RGMII_ID:
++ case PHY_INTERFACE_MODE_RGMII_RXID:
++ case PHY_INTERFACE_MODE_RGMII_TXID:
++ case PHY_INTERFACE_MODE_SGMII:
+ phylink_set(mask, 10baseT_Half);
+ phylink_set(mask, 10baseT_Full);
+ phylink_set(mask, 100baseT_Half);
+@@ -4290,11 +4315,18 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+ phylink_set(mask, 1000baseT_Full);
+ phylink_set(mask, 1000baseX_Full);
+ phylink_set(mask, 2500baseX_Full);
++ break;
++ default:
++ goto empty_set;
+ }
+
+ bitmap_and(supported, supported, mask, __ETHTOOL_LINK_MODE_MASK_NBITS);
+ bitmap_and(state->advertising, state->advertising, mask,
+ __ETHTOOL_LINK_MODE_MASK_NBITS);
++ return;
++
++empty_set:
++ bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS);
+ }
+
+ static void mvpp22_xlg_link_state(struct mvpp2_port *port,
+diff --git a/drivers/net/ethernet/mellanox/mlx4/Kconfig b/drivers/net/ethernet/mellanox/mlx4/Kconfig
+index 36054e6fb9d3..f200b8c420d5 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/Kconfig
++++ b/drivers/net/ethernet/mellanox/mlx4/Kconfig
+@@ -5,7 +5,7 @@
+ config MLX4_EN
+ tristate "Mellanox Technologies 1/10/40Gbit Ethernet support"
+ depends on MAY_USE_DEVLINK
+- depends on PCI
++ depends on PCI && NETDEVICES && ETHERNET && INET
+ select MLX4_CORE
+ imply PTP_1588_CLOCK
+ ---help---
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index 7715f1ed2bcb..4eb64cb0d9a1 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -286,7 +286,13 @@ static bool
+ mlxsw_sp_bridge_port_should_destroy(const struct mlxsw_sp_bridge_port *
+ bridge_port)
+ {
+- struct mlxsw_sp *mlxsw_sp = mlxsw_sp_lower_get(bridge_port->dev);
++ struct net_device *dev = bridge_port->dev;
++ struct mlxsw_sp *mlxsw_sp;
++
++ if (is_vlan_dev(dev))
++ mlxsw_sp = mlxsw_sp_lower_get(vlan_dev_real_dev(dev));
++ else
++ mlxsw_sp = mlxsw_sp_lower_get(dev);
+
+ /* In case ports were pulled from out of a bridged LAG, then
+ * it's possible the reference count isn't zero, yet the bridge
+@@ -2020,7 +2026,7 @@ mlxsw_sp_bridge_8021d_port_leave(struct mlxsw_sp_bridge_device *bridge_device,
+
+ vid = is_vlan_dev(dev) ? vlan_dev_vlan_id(dev) : 1;
+ mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_vid(mlxsw_sp_port, vid);
+- if (WARN_ON(!mlxsw_sp_port_vlan))
++ if (!mlxsw_sp_port_vlan)
+ return;
+
+ mlxsw_sp_port_vlan_bridge_leave(mlxsw_sp_port_vlan);
+diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
+index f7ecceeb1e28..f27d67a4d304 100644
+--- a/drivers/net/ethernet/socionext/sni_ave.c
++++ b/drivers/net/ethernet/socionext/sni_ave.c
+@@ -194,6 +194,7 @@
+
+ /* Parameter for ethernet frame */
+ #define AVE_MAX_ETHFRAME 1518
++#define AVE_FRAME_HEADROOM 2
+
+ /* Parameter for interrupt */
+ #define AVE_INTM_COUNT 20
+@@ -585,12 +586,13 @@ static int ave_rxdesc_prepare(struct net_device *ndev, int entry)
+
+ skb = priv->rx.desc[entry].skbs;
+ if (!skb) {
+- skb = netdev_alloc_skb_ip_align(ndev,
+- AVE_MAX_ETHFRAME);
++ skb = netdev_alloc_skb(ndev, AVE_MAX_ETHFRAME);
+ if (!skb) {
+ netdev_err(ndev, "can't allocate skb for Rx\n");
+ return -ENOMEM;
+ }
++ skb->data += AVE_FRAME_HEADROOM;
++ skb->tail += AVE_FRAME_HEADROOM;
+ }
+
+ /* set disable to cmdsts */
+@@ -603,12 +605,12 @@ static int ave_rxdesc_prepare(struct net_device *ndev, int entry)
+ * - Rx buffer begins with 2 byte headroom, and data will be put from
+ * (buffer + 2).
+ * To satisfy this, specify the address to put back the buffer
+- * pointer advanced by NET_IP_ALIGN by netdev_alloc_skb_ip_align(),
+- * and expand the map size by NET_IP_ALIGN.
++ * pointer advanced by AVE_FRAME_HEADROOM, and expand the map size
++ * by AVE_FRAME_HEADROOM.
+ */
+ ret = ave_dma_map(ndev, &priv->rx.desc[entry],
+- skb->data - NET_IP_ALIGN,
+- AVE_MAX_ETHFRAME + NET_IP_ALIGN,
++ skb->data - AVE_FRAME_HEADROOM,
++ AVE_MAX_ETHFRAME + AVE_FRAME_HEADROOM,
+ DMA_FROM_DEVICE, &paddr);
+ if (ret) {
+ netdev_err(ndev, "can't map skb for Rx\n");
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 75896d6ba6e2..99ea5c4ce29c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -2547,12 +2547,6 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp)
+ netdev_warn(priv->dev, "PTP init failed\n");
+ }
+
+-#ifdef CONFIG_DEBUG_FS
+- ret = stmmac_init_fs(dev);
+- if (ret < 0)
+- netdev_warn(priv->dev, "%s: failed debugFS registration\n",
+- __func__);
+-#endif
+ priv->tx_lpi_timer = STMMAC_DEFAULT_TWT_LS;
+
+ if (priv->use_riwt) {
+@@ -2753,10 +2747,6 @@ static int stmmac_release(struct net_device *dev)
+
+ netif_carrier_off(dev);
+
+-#ifdef CONFIG_DEBUG_FS
+- stmmac_exit_fs(dev);
+-#endif
+-
+ stmmac_release_ptp(priv);
+
+ return 0;
+@@ -3896,6 +3886,9 @@ static int stmmac_sysfs_ring_read(struct seq_file *seq, void *v)
+ u32 tx_count = priv->plat->tx_queues_to_use;
+ u32 queue;
+
++ if ((dev->flags & IFF_UP) == 0)
++ return 0;
++
+ for (queue = 0; queue < rx_count; queue++) {
+ struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+
+@@ -4394,6 +4387,13 @@ int stmmac_dvr_probe(struct device *device,
+ goto error_netdev_register;
+ }
+
++#ifdef CONFIG_DEBUG_FS
++ ret = stmmac_init_fs(ndev);
++ if (ret < 0)
++ netdev_warn(priv->dev, "%s: failed debugFS registration\n",
++ __func__);
++#endif
++
+ return ret;
+
+ error_netdev_register:
+@@ -4429,6 +4429,9 @@ int stmmac_dvr_remove(struct device *dev)
+
+ netdev_info(priv->dev, "%s: removing driver", __func__);
+
++#ifdef CONFIG_DEBUG_FS
++ stmmac_exit_fs(ndev);
++#endif
+ stmmac_stop_all_dma(priv);
+
+ stmmac_mac_set(priv, priv->ioaddr, false);
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index cfda146f3b3b..6372cdc4a510 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -608,7 +608,7 @@ static int macvlan_open(struct net_device *dev)
+ goto hash_add;
+ }
+
+- err = -EBUSY;
++ err = -EADDRINUSE;
+ if (macvlan_addr_busy(vlan->port, dev->dev_addr))
+ goto out;
+
+@@ -706,7 +706,7 @@ static int macvlan_sync_address(struct net_device *dev, unsigned char *addr)
+ } else {
+ /* Rehash and update the device filters */
+ if (macvlan_addr_busy(vlan->port, addr))
+- return -EBUSY;
++ return -EADDRINUSE;
+
+ if (!macvlan_passthru(port)) {
+ err = dev_uc_add(lowerdev, addr);
+@@ -747,6 +747,9 @@ static int macvlan_set_mac_address(struct net_device *dev, void *p)
+ return dev_set_mac_address(vlan->lowerdev, addr);
+ }
+
++ if (macvlan_addr_busy(vlan->port, addr->sa_data))
++ return -EADDRINUSE;
++
+ return macvlan_sync_address(dev, addr->sa_data);
+ }
+
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 62ab42e94c9d..4ca6592f5b3a 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3712,16 +3712,16 @@ static int __init init_mac80211_hwsim(void)
+ if (err)
+ goto out_unregister_pernet;
+
++ err = hwsim_init_netlink();
++ if (err)
++ goto out_unregister_driver;
++
+ hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
+ if (IS_ERR(hwsim_class)) {
+ err = PTR_ERR(hwsim_class);
+- goto out_unregister_driver;
++ goto out_exit_netlink;
+ }
+
+- err = hwsim_init_netlink();
+- if (err < 0)
+- goto out_unregister_driver;
+-
+ for (i = 0; i < radios; i++) {
+ struct hwsim_new_radio_params param = { 0 };
+
+@@ -3827,6 +3827,8 @@ out_free_mon:
+ free_netdev(hwsim_mon);
+ out_free_radios:
+ mac80211_hwsim_free();
++out_exit_netlink:
++ hwsim_exit_netlink();
+ out_unregister_driver:
+ platform_driver_unregister(&mac80211_hwsim_driver);
+ out_unregister_pernet:
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index b7b2659e02fa..e5bddae16ed4 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -831,6 +831,8 @@ static int nvme_submit_user_cmd(struct request_queue *q,
+ static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status)
+ {
+ struct nvme_ctrl *ctrl = rq->end_io_data;
++ unsigned long flags;
++ bool startka = false;
+
+ blk_mq_free_request(rq);
+
+@@ -841,7 +843,13 @@ static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status)
+ return;
+ }
+
+- schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
++ spin_lock_irqsave(&ctrl->lock, flags);
++ if (ctrl->state == NVME_CTRL_LIVE ||
++ ctrl->state == NVME_CTRL_CONNECTING)
++ startka = true;
++ spin_unlock_irqrestore(&ctrl->lock, flags);
++ if (startka)
++ schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
+ }
+
+ static int nvme_keep_alive(struct nvme_ctrl *ctrl)
+diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
+index bfc4da660bb4..e57f3902beb3 100644
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -529,6 +529,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
+ {
+ struct nvmet_rdma_rsp *rsp =
+ container_of(wc->wr_cqe, struct nvmet_rdma_rsp, send_cqe);
++ struct nvmet_rdma_queue *queue = cq->cq_context;
+
+ nvmet_rdma_release_rsp(rsp);
+
+@@ -536,7 +537,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
+ wc->status != IB_WC_WR_FLUSH_ERR)) {
+ pr_err("SEND for CQE 0x%p failed with status %s (%d).\n",
+ wc->wr_cqe, ib_wc_status_msg(wc->status), wc->status);
+- nvmet_rdma_error_comp(rsp->queue);
++ nvmet_rdma_error_comp(queue);
+ }
+ }
+
+diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c
+index 5c8ed7350a04..a36e4cf1841d 100644
+--- a/drivers/sbus/char/display7seg.c
++++ b/drivers/sbus/char/display7seg.c
+@@ -220,6 +220,7 @@ static int d7s_probe(struct platform_device *op)
+ dev_set_drvdata(&op->dev, p);
+ d7s_device = p;
+ err = 0;
++ of_node_put(opts);
+
+ out:
+ return err;
+diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
+index 56e962a01493..b8481927bfe4 100644
+--- a/drivers/sbus/char/envctrl.c
++++ b/drivers/sbus/char/envctrl.c
+@@ -910,8 +910,10 @@ static void envctrl_init_i2c_child(struct device_node *dp,
+ for (len = 0; len < PCF8584_MAX_CHANNELS; ++len) {
+ pchild->mon_type[len] = ENVCTRL_NOMON;
+ }
++ of_node_put(root_node);
+ return;
+ }
++ of_node_put(root_node);
+ }
+
+ /* Get the monitor channels. */
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 93c66ebad907..f78d2e5c1471 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -2416,8 +2416,8 @@ int iscsi_eh_session_reset(struct scsi_cmnd *sc)
+ failed:
+ ISCSI_DBG_EH(session,
+ "failing session reset: Could not log back into "
+- "%s, %s [age %d]\n", session->targetname,
+- conn->persistent_address, session->age);
++ "%s [age %d]\n", session->targetname,
++ session->age);
+ spin_unlock_bh(&session->frwd_lock);
+ mutex_unlock(&session->eh_mutex);
+ return FAILED;
+diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
+index 0cd947f78b5b..890b8aaf95e1 100644
+--- a/drivers/scsi/vmw_pvscsi.c
++++ b/drivers/scsi/vmw_pvscsi.c
+@@ -1202,8 +1202,6 @@ static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter)
+
+ static void pvscsi_release_resources(struct pvscsi_adapter *adapter)
+ {
+- pvscsi_shutdown_intr(adapter);
+-
+ if (adapter->workqueue)
+ destroy_workqueue(adapter->workqueue);
+
+@@ -1535,6 +1533,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ out_reset_adapter:
+ ll_adapter_reset(adapter);
+ out_release_resources:
++ pvscsi_shutdown_intr(adapter);
+ pvscsi_release_resources(adapter);
+ scsi_host_put(host);
+ out_disable_device:
+@@ -1543,6 +1542,7 @@ out_disable_device:
+ return error;
+
+ out_release_resources_and_disable:
++ pvscsi_shutdown_intr(adapter);
+ pvscsi_release_resources(adapter);
+ goto out_disable_device;
+ }
+diff --git a/drivers/thermal/armada_thermal.c b/drivers/thermal/armada_thermal.c
+index 2c2f6d93034e..e16b3cb1808c 100644
+--- a/drivers/thermal/armada_thermal.c
++++ b/drivers/thermal/armada_thermal.c
+@@ -357,7 +357,7 @@ static int armada_get_temp_legacy(struct thermal_zone_device *thermal,
+ int ret;
+
+ /* Valid check */
+- if (armada_is_valid(priv)) {
++ if (!armada_is_valid(priv)) {
+ dev_err(priv->dev,
+ "Temperature sensor reading not valid\n");
+ return -EIO;
+diff --git a/drivers/tty/serial/suncore.c b/drivers/tty/serial/suncore.c
+index 70a4ea4eaa6e..990376576970 100644
+--- a/drivers/tty/serial/suncore.c
++++ b/drivers/tty/serial/suncore.c
+@@ -112,6 +112,7 @@ void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
+ mode = of_get_property(dp, mode_prop, NULL);
+ if (!mode)
+ mode = "9600,8,n,1,-";
++ of_node_put(dp);
+ }
+
+ cflag = CREAD | HUPCL | CLOCAL;
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 51879ed18652..98ed5be132c6 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -563,13 +563,21 @@ static void vhost_vsock_reset_orphans(struct sock *sk)
+ * executing.
+ */
+
+- if (!vhost_vsock_get(vsk->remote_addr.svm_cid)) {
+- sock_set_flag(sk, SOCK_DONE);
+- vsk->peer_shutdown = SHUTDOWN_MASK;
+- sk->sk_state = SS_UNCONNECTED;
+- sk->sk_err = ECONNRESET;
+- sk->sk_error_report(sk);
+- }
++ /* If the peer is still valid, no need to reset connection */
++ if (vhost_vsock_get(vsk->remote_addr.svm_cid))
++ return;
++
++ /* If the close timeout is pending, let it expire. This avoids races
++ * with the timeout callback.
++ */
++ if (vsk->close_work_scheduled)
++ return;
++
++ sock_set_flag(sk, SOCK_DONE);
++ vsk->peer_shutdown = SHUTDOWN_MASK;
++ sk->sk_state = SS_UNCONNECTED;
++ sk->sk_err = ECONNRESET;
++ sk->sk_error_report(sk);
+ }
+
+ static int vhost_vsock_dev_release(struct inode *inode, struct file *file)
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 834a3f5ef642..d4a7f7ca4145 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1656,9 +1656,8 @@ static int cleaner_kthread(void *arg)
+ struct btrfs_root *root = arg;
+ struct btrfs_fs_info *fs_info = root->fs_info;
+ int again;
+- struct btrfs_trans_handle *trans;
+
+- do {
++ while (1) {
+ again = 0;
+
+ /* Make the cleaner go to sleep early. */
+@@ -1707,42 +1706,16 @@ static int cleaner_kthread(void *arg)
+ */
+ btrfs_delete_unused_bgs(fs_info);
+ sleep:
++ if (kthread_should_park())
++ kthread_parkme();
++ if (kthread_should_stop())
++ return 0;
+ if (!again) {
+ set_current_state(TASK_INTERRUPTIBLE);
+- if (!kthread_should_stop())
+- schedule();
++ schedule();
+ __set_current_state(TASK_RUNNING);
+ }
+- } while (!kthread_should_stop());
+-
+- /*
+- * Transaction kthread is stopped before us and wakes us up.
+- * However we might have started a new transaction and COWed some
+- * tree blocks when deleting unused block groups for example. So
+- * make sure we commit the transaction we started to have a clean
+- * shutdown when evicting the btree inode - if it has dirty pages
+- * when we do the final iput() on it, eviction will trigger a
+- * writeback for it which will fail with null pointer dereferences
+- * since work queues and other resources were already released and
+- * destroyed by the time the iput/eviction/writeback is made.
+- */
+- trans = btrfs_attach_transaction(root);
+- if (IS_ERR(trans)) {
+- if (PTR_ERR(trans) != -ENOENT)
+- btrfs_err(fs_info,
+- "cleaner transaction attach returned %ld",
+- PTR_ERR(trans));
+- } else {
+- int ret;
+-
+- ret = btrfs_commit_transaction(trans);
+- if (ret)
+- btrfs_err(fs_info,
+- "cleaner open transaction commit returned %d",
+- ret);
+ }
+-
+- return 0;
+ }
+
+ static int transaction_kthread(void *arg)
+@@ -3923,6 +3896,13 @@ void close_ctree(struct btrfs_fs_info *fs_info)
+ int ret;
+
+ set_bit(BTRFS_FS_CLOSING_START, &fs_info->flags);
++ /*
++ * We don't want the cleaner to start new transactions, add more delayed
++ * iputs, etc. while we're closing. We can't use kthread_stop() yet
++ * because that frees the task_struct, and the transaction kthread might
++ * still try to wake up the cleaner.
++ */
++ kthread_park(fs_info->cleaner_kthread);
+
+ /* wait for the qgroup rescan worker to stop */
+ btrfs_qgroup_wait_for_completion(fs_info, false);
+@@ -3950,9 +3930,8 @@ void close_ctree(struct btrfs_fs_info *fs_info)
+
+ if (!sb_rdonly(fs_info->sb)) {
+ /*
+- * If the cleaner thread is stopped and there are
+- * block groups queued for removal, the deletion will be
+- * skipped when we quit the cleaner thread.
++ * The cleaner kthread is stopped, so do one final pass over
++ * unused block groups.
+ */
+ btrfs_delete_unused_bgs(fs_info);
+
+diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
+index abcd78e332fe..85dadb93c992 100644
+--- a/fs/cifs/Kconfig
++++ b/fs/cifs/Kconfig
+@@ -133,7 +133,7 @@ config CIFS_XATTR
+
+ config CIFS_POSIX
+ bool "CIFS POSIX Extensions"
+- depends on CIFS_XATTR
++ depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR
+ help
+ Enabling this option will cause the cifs client to attempt to
+ negotiate a newer dialect with servers, such as Samba 3.0.5
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index aa12c3063bae..33824a0a57bf 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -98,8 +98,11 @@ struct nfs_direct_req {
+ struct pnfs_ds_commit_info ds_cinfo; /* Storage for cinfo */
+ struct work_struct work;
+ int flags;
++ /* for write */
+ #define NFS_ODIRECT_DO_COMMIT (1) /* an unstable reply was received */
+ #define NFS_ODIRECT_RESCHED_WRITES (2) /* write verification failed */
++ /* for read */
++#define NFS_ODIRECT_SHOULD_DIRTY (3) /* dirty user-space page after read */
+ struct nfs_writeverf verf; /* unstable write verifier */
+ };
+
+@@ -412,7 +415,8 @@ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
+ struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+ struct page *page = req->wb_page;
+
+- if (!PageCompound(page) && bytes < hdr->good_bytes)
++ if (!PageCompound(page) && bytes < hdr->good_bytes &&
++ (dreq->flags == NFS_ODIRECT_SHOULD_DIRTY))
+ set_page_dirty(page);
+ bytes += req->wb_bytes;
+ nfs_list_remove_request(req);
+@@ -587,6 +591,9 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter)
+ if (!is_sync_kiocb(iocb))
+ dreq->iocb = iocb;
+
++ if (iter_is_iovec(iter))
++ dreq->flags = NFS_ODIRECT_SHOULD_DIRTY;
++
+ nfs_start_io_direct(inode);
+
+ NFS_I(inode)->read_io += count;
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 56acfbb80104..2954e4b3abd5 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -4792,6 +4792,9 @@ static int do_check(struct bpf_verifier_env *env)
+ goto process_bpf_exit;
+ }
+
++ if (signal_pending(current))
++ return -EAGAIN;
++
+ if (need_resched())
+ cond_resched();
+
+diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c
+index bfaeb05123ff..edd75e0c7d96 100644
+--- a/kernel/locking/qspinlock.c
++++ b/kernel/locking/qspinlock.c
+@@ -231,6 +231,20 @@ static __always_inline u32 xchg_tail(struct qspinlock *lock, u32 tail)
+ }
+ #endif /* _Q_PENDING_BITS == 8 */
+
++/**
++ * queued_fetch_set_pending_acquire - fetch the whole lock value and set pending
++ * @lock : Pointer to queued spinlock structure
++ * Return: The previous lock value
++ *
++ * *,*,* -> *,1,*
++ */
++#ifndef queued_fetch_set_pending_acquire
++static __always_inline u32 queued_fetch_set_pending_acquire(struct qspinlock *lock)
++{
++ return atomic_fetch_or_acquire(_Q_PENDING_VAL, &lock->val);
++}
++#endif
++
+ /**
+ * set_locked - Set the lock bit and own the lock
+ * @lock: Pointer to queued spinlock structure
+@@ -329,40 +343,39 @@ void queued_spin_lock_slowpath(struct qspinlock *lock, u32 val)
+ * 0,0,0 -> 0,0,1 ; trylock
+ * 0,0,1 -> 0,1,1 ; pending
+ */
+- val = atomic_fetch_or_acquire(_Q_PENDING_VAL, &lock->val);
+- if (!(val & ~_Q_LOCKED_MASK)) {
+- /*
+- * We're pending, wait for the owner to go away.
+- *
+- * *,1,1 -> *,1,0
+- *
+- * this wait loop must be a load-acquire such that we match the
+- * store-release that clears the locked bit and create lock
+- * sequentiality; this is because not all
+- * clear_pending_set_locked() implementations imply full
+- * barriers.
+- */
+- if (val & _Q_LOCKED_MASK) {
+- atomic_cond_read_acquire(&lock->val,
+- !(VAL & _Q_LOCKED_MASK));
+- }
++ val = queued_fetch_set_pending_acquire(lock);
+
+- /*
+- * take ownership and clear the pending bit.
+- *
+- * *,1,0 -> *,0,1
+- */
+- clear_pending_set_locked(lock);
+- qstat_inc(qstat_lock_pending, true);
+- return;
++ /*
++ * If we observe any contention; undo and queue.
++ */
++ if (unlikely(val & ~_Q_LOCKED_MASK)) {
++ if (!(val & _Q_PENDING_MASK))
++ clear_pending(lock);
++ goto queue;
+ }
+
+ /*
+- * If pending was clear but there are waiters in the queue, then
+- * we need to undo our setting of pending before we queue ourselves.
++ * We're pending, wait for the owner to go away.
++ *
++ * 0,1,1 -> 0,1,0
++ *
++ * this wait loop must be a load-acquire such that we match the
++ * store-release that clears the locked bit and create lock
++ * sequentiality; this is because not all
++ * clear_pending_set_locked() implementations imply full
++ * barriers.
++ */
++ if (val & _Q_LOCKED_MASK)
++ atomic_cond_read_acquire(&lock->val, !(VAL & _Q_LOCKED_MASK));
++
++ /*
++ * take ownership and clear the pending bit.
++ *
++ * 0,1,0 -> 0,0,1
+ */
+- if (!(val & _Q_PENDING_MASK))
+- clear_pending(lock);
++ clear_pending_set_locked(lock);
++ qstat_inc(qstat_lock_pending, true);
++ return;
+
+ /*
+ * End of pending bit optimistic spinning and beginning of MCS
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index a8db2e3f8904..d066aae3cb6d 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -781,8 +781,15 @@ void xprt_connect(struct rpc_task *task)
+ return;
+ if (xprt_test_and_set_connecting(xprt))
+ return;
+- xprt->stat.connect_start = jiffies;
+- xprt->ops->connect(xprt, task);
++ /* Race breaker */
++ if (!xprt_connected(xprt)) {
++ xprt->stat.connect_start = jiffies;
++ xprt->ops->connect(xprt, task);
++ } else {
++ xprt_clear_connecting(xprt);
++ task->tk_status = 0;
++ rpc_wake_up_queued_task(&xprt->pending, task);
++ }
+ }
+ xprt_release_write(xprt, task);
+ }
+diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
+index ec50d2a95076..fa763dbfdad7 100644
+--- a/tools/testing/nvdimm/test/nfit.c
++++ b/tools/testing/nvdimm/test/nfit.c
+@@ -15,6 +15,7 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/workqueue.h>
+ #include <linux/libnvdimm.h>
++#include <linux/genalloc.h>
+ #include <linux/vmalloc.h>
+ #include <linux/device.h>
+ #include <linux/module.h>
+@@ -213,6 +214,8 @@ struct nfit_test {
+
+ static struct workqueue_struct *nfit_wq;
+
++static struct gen_pool *nfit_pool;
++
+ static struct nfit_test *to_nfit_test(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+@@ -1130,6 +1133,9 @@ static void release_nfit_res(void *data)
+ list_del(&nfit_res->list);
+ spin_unlock(&nfit_test_lock);
+
++ if (resource_size(&nfit_res->res) >= DIMM_SIZE)
++ gen_pool_free(nfit_pool, nfit_res->res.start,
++ resource_size(&nfit_res->res));
+ vfree(nfit_res->buf);
+ kfree(nfit_res);
+ }
+@@ -1142,7 +1148,7 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma,
+ GFP_KERNEL);
+ int rc;
+
+- if (!buf || !nfit_res)
++ if (!buf || !nfit_res || !*dma)
+ goto err;
+ rc = devm_add_action(dev, release_nfit_res, nfit_res);
+ if (rc)
+@@ -1162,6 +1168,8 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma,
+
+ return nfit_res->buf;
+ err:
++ if (*dma && size >= DIMM_SIZE)
++ gen_pool_free(nfit_pool, *dma, size);
+ if (buf)
+ vfree(buf);
+ kfree(nfit_res);
+@@ -1170,9 +1178,16 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma,
+
+ static void *test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma)
+ {
++ struct genpool_data_align data = {
++ .align = SZ_128M,
++ };
+ void *buf = vmalloc(size);
+
+- *dma = (unsigned long) buf;
++ if (size >= DIMM_SIZE)
++ *dma = gen_pool_alloc_algo(nfit_pool, size,
++ gen_pool_first_fit_align, &data);
++ else
++ *dma = (unsigned long) buf;
+ return __test_alloc(t, size, dma, buf);
+ }
+
+@@ -2837,6 +2852,17 @@ static __init int nfit_test_init(void)
+ goto err_register;
+ }
+
++ nfit_pool = gen_pool_create(ilog2(SZ_4M), NUMA_NO_NODE);
++ if (!nfit_pool) {
++ rc = -ENOMEM;
++ goto err_register;
++ }
++
++ if (gen_pool_add(nfit_pool, SZ_4G, SZ_4G, NUMA_NO_NODE)) {
++ rc = -ENOMEM;
++ goto err_register;
++ }
++
+ for (i = 0; i < NUM_NFITS; i++) {
+ struct nfit_test *nfit_test;
+ struct platform_device *pdev;
+@@ -2892,6 +2918,9 @@ static __init int nfit_test_init(void)
+ return 0;
+
+ err_register:
++ if (nfit_pool)
++ gen_pool_destroy(nfit_pool);
++
+ destroy_workqueue(nfit_wq);
+ for (i = 0; i < NUM_NFITS; i++)
+ if (instances[i])
+@@ -2915,6 +2944,8 @@ static __exit void nfit_test_exit(void)
+ platform_driver_unregister(&nfit_test_driver);
+ nfit_test_teardown();
+
++ gen_pool_destroy(nfit_pool);
++
+ for (i = 0; i < NUM_NFITS; i++)
+ put_device(&instances[i]->pdev.dev);
+ class_destroy(nfit_test_dimm);
+diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
+index 6b5cfeb7a9cc..29116366a9fc 100644
+--- a/tools/testing/selftests/bpf/test_btf.c
++++ b/tools/testing/selftests/bpf/test_btf.c
+@@ -431,11 +431,11 @@ static struct btf_raw_test raw_tests[] = {
+ /* const void* */ /* [3] */
+ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2),
+ /* typedef const void * const_void_ptr */
+- BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 3),
+- /* struct A { */ /* [4] */
++ BTF_TYPEDEF_ENC(NAME_TBD, 3), /* [4] */
++ /* struct A { */ /* [5] */
+ BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), sizeof(void *)),
+ /* const_void_ptr m; */
+- BTF_MEMBER_ENC(NAME_TBD, 3, 0),
++ BTF_MEMBER_ENC(NAME_TBD, 4, 0),
+ /* } */
+ BTF_END_RAW,
+ },
+@@ -493,10 +493,10 @@ static struct btf_raw_test raw_tests[] = {
+ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 0),
+ /* const void* */ /* [3] */
+ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2),
+- /* typedef const void * const_void_ptr */ /* [4] */
+- BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 3),
+- /* const_void_ptr[4] */ /* [5] */
+- BTF_TYPE_ARRAY_ENC(3, 1, 4),
++ /* typedef const void * const_void_ptr */
++ BTF_TYPEDEF_ENC(NAME_TBD, 3), /* [4] */
++ /* const_void_ptr[4] */
++ BTF_TYPE_ARRAY_ENC(4, 1, 4), /* [5] */
+ BTF_END_RAW,
+ },
+ .str_sec = "\0const_void_ptr",
+@@ -1291,6 +1291,367 @@ static struct btf_raw_test raw_tests[] = {
+ .err_str = "type != 0",
+ },
+
++{
++ .descr = "typedef (invalid name, name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPEDEF_ENC(0, 1), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__int",
++ .str_sec_size = sizeof("\0__int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "typedef_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "typedef (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPEDEF_ENC(NAME_TBD, 1), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__!int",
++ .str_sec_size = sizeof("\0__!int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "typedef_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "ptr type (invalid name, name_off <> 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 1), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__int",
++ .str_sec_size = sizeof("\0__int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "ptr_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "volatile type (invalid name, name_off <> 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_VOLATILE, 0, 0), 1), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__int",
++ .str_sec_size = sizeof("\0__int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "volatile_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "const type (invalid name, name_off <> 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 1), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__int",
++ .str_sec_size = sizeof("\0__int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "const_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "restrict type (invalid name, name_off <> 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 1), /* [2] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_RESTRICT, 0, 0), 2), /* [3] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__int",
++ .str_sec_size = sizeof("\0__int"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "restrict_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "fwd type (invalid name, name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_FWD, 0, 0), 0), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__skb",
++ .str_sec_size = sizeof("\0__skb"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "fwd_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "fwd type (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_FWD, 0, 0), 0), /* [2] */
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__!skb",
++ .str_sec_size = sizeof("\0__!skb"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "fwd_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "array type (invalid name, name_off <> 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_ARRAY, 0, 0), 0), /* [2] */
++ BTF_ARRAY_ENC(1, 1, 4),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0__skb",
++ .str_sec_size = sizeof("\0__skb"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "array_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "struct type (name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0,
++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */
++ BTF_MEMBER_ENC(NAME_TBD, 1, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A",
++ .str_sec_size = sizeof("\0A"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "struct_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++},
++
++{
++ .descr = "struct type (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */
++ BTF_MEMBER_ENC(NAME_TBD, 1, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A!\0B",
++ .str_sec_size = sizeof("\0A!\0B"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "struct_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "struct member (name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0,
++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */
++ BTF_MEMBER_ENC(NAME_TBD, 1, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A",
++ .str_sec_size = sizeof("\0A"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "struct_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++},
++
++{
++ .descr = "struct member (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */
++ BTF_MEMBER_ENC(NAME_TBD, 1, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A\0B*",
++ .str_sec_size = sizeof("\0A\0B*"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "struct_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "enum type (name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0,
++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
++ sizeof(int)), /* [2] */
++ BTF_ENUM_ENC(NAME_TBD, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A\0B",
++ .str_sec_size = sizeof("\0A\0B"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "enum_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++},
++
++{
++ .descr = "enum type (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(NAME_TBD,
++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
++ sizeof(int)), /* [2] */
++ BTF_ENUM_ENC(NAME_TBD, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A!\0B",
++ .str_sec_size = sizeof("\0A!\0B"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "enum_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "enum member (invalid name, name_off = 0)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0,
++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
++ sizeof(int)), /* [2] */
++ BTF_ENUM_ENC(0, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "",
++ .str_sec_size = sizeof(""),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "enum_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
++
++{
++ .descr = "enum member (invalid name, invalid identifier)",
++ .raw_types = {
++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
++ BTF_TYPE_ENC(0,
++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1),
++ sizeof(int)), /* [2] */
++ BTF_ENUM_ENC(NAME_TBD, 0),
++ BTF_END_RAW,
++ },
++ .str_sec = "\0A!",
++ .str_sec_size = sizeof("\0A!"),
++ .map_type = BPF_MAP_TYPE_ARRAY,
++ .map_name = "enum_type_check_btf",
++ .key_size = sizeof(int),
++ .value_size = sizeof(int),
++ .key_type_id = 1,
++ .value_type_id = 1,
++ .max_entries = 4,
++ .btf_load_err = true,
++ .err_str = "Invalid name",
++},
+ {
+ .descr = "arraymap invalid btf key (a bit field)",
+ .raw_types = {
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index 2bde9ee04db7..e436b67f2426 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -12765,7 +12765,7 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
+
+ reject_from_alignment = fd_prog < 0 &&
+ (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
+- strstr(bpf_vlog, "Unknown alignment.");
++ strstr(bpf_vlog, "misaligned");
+ #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ if (reject_from_alignment) {
+ printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-12-29 1:08 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-12-29 1:08 UTC (permalink / raw
To: gentoo-commits
commit: fbcff2ddd1c47ddbac3304e23eaa152cf61f414e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 29 01:07:38 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Dec 29 01:07:38 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=fbcff2dd
proj/linux-patches: Select PID_NS to support FEATURES=pid-sandbox
For portage: >=sys-apps/portage-2.3.53
See bug #673896
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
4567_distro-Gentoo-Kconfig.patch | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index ec31768..d6e791a 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -6,9 +6,9 @@
source "lib/Kconfig.debug"
+
+source "distro/Kconfig"
---- /dev/null 2017-03-02 01:55:04.096566155 -0500
-+++ b/distro/Kconfig 2017-03-02 11:12:05.049448255 -0500
-@@ -0,0 +1,145 @@
+--- /dev/null 2018-12-28 10:40:34.089999934 -0500
++++ b/distro/Kconfig 2018-12-28 18:54:40.467970759 -0500
+@@ -0,0 +1,147 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -63,6 +63,7 @@
+ select NAMESPACES
+ select IPC_NS
+ select NET_NS
++ select PID_NS
+ select SYSVIPC
+
+ help
@@ -72,6 +73,7 @@
+ CGROUPS (required for FEATURES=cgroup)
+ IPC_NS (required for FEATURES=ipc-sandbox)
+ NET_NS (required for FEATURES=network-sandbox)
++ PID_NS (required for FEATURES=pid-sandbox)
+ SYSVIPC (required by IPC_NS)
+
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2018-12-29 18:55 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2018-12-29 18:55 UTC (permalink / raw
To: gentoo-commits
commit: 723771096426fbaf0e4063f516fa18d26177087d
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 29 18:55:02 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Dec 29 18:55:02 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=72377109
proj/linux-patches: Linux patch 4.19.13
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1012_linux-4.19.13.patch | 2153 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2157 insertions(+)
diff --git a/0000_README b/0000_README
index 979d903..e349c5a 100644
--- a/0000_README
+++ b/0000_README
@@ -91,6 +91,10 @@ Patch: 1011_linux-4.19.12.patch
From: http://www.kernel.org
Desc: Linux 4.19.12
+Patch: 1012_linux-4.19.13.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.13
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1012_linux-4.19.13.patch b/1012_linux-4.19.13.patch
new file mode 100644
index 0000000..4e9190e
--- /dev/null
+++ b/1012_linux-4.19.13.patch
@@ -0,0 +1,2153 @@
+diff --git a/Makefile b/Makefile
+index 9770f29a690a..892ff14cbc9d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 12
++SUBLEVEL = 13
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
+index 92fd2c8a9af0..12659ce5c1f3 100644
+--- a/arch/arm/include/asm/pgtable-2level.h
++++ b/arch/arm/include/asm/pgtable-2level.h
+@@ -10,7 +10,7 @@
+ #ifndef _ASM_PGTABLE_2LEVEL_H
+ #define _ASM_PGTABLE_2LEVEL_H
+
+-#define __PAGETABLE_PMD_FOLDED
++#define __PAGETABLE_PMD_FOLDED 1
+
+ /*
+ * Hardware-wise, we have a two level page table structure, where the first
+diff --git a/arch/m68k/include/asm/pgtable_mm.h b/arch/m68k/include/asm/pgtable_mm.h
+index 6181e4134483..fe3ddd73a0cc 100644
+--- a/arch/m68k/include/asm/pgtable_mm.h
++++ b/arch/m68k/include/asm/pgtable_mm.h
+@@ -55,12 +55,12 @@
+ */
+ #ifdef CONFIG_SUN3
+ #define PTRS_PER_PTE 16
+-#define __PAGETABLE_PMD_FOLDED
++#define __PAGETABLE_PMD_FOLDED 1
+ #define PTRS_PER_PMD 1
+ #define PTRS_PER_PGD 2048
+ #elif defined(CONFIG_COLDFIRE)
+ #define PTRS_PER_PTE 512
+-#define __PAGETABLE_PMD_FOLDED
++#define __PAGETABLE_PMD_FOLDED 1
+ #define PTRS_PER_PMD 1
+ #define PTRS_PER_PGD 1024
+ #else
+diff --git a/arch/microblaze/include/asm/pgtable.h b/arch/microblaze/include/asm/pgtable.h
+index 7b650ab14fa0..2ca598534cc7 100644
+--- a/arch/microblaze/include/asm/pgtable.h
++++ b/arch/microblaze/include/asm/pgtable.h
+@@ -63,7 +63,7 @@ extern int mem_init_done;
+
+ #include <asm-generic/4level-fixup.h>
+
+-#define __PAGETABLE_PMD_FOLDED
++#define __PAGETABLE_PMD_FOLDED 1
+
+ #ifdef __KERNEL__
+ #ifndef __ASSEMBLY__
+diff --git a/arch/nds32/include/asm/pgtable.h b/arch/nds32/include/asm/pgtable.h
+index d3e19a55cf53..9f52db930c00 100644
+--- a/arch/nds32/include/asm/pgtable.h
++++ b/arch/nds32/include/asm/pgtable.h
+@@ -4,7 +4,7 @@
+ #ifndef _ASMNDS32_PGTABLE_H
+ #define _ASMNDS32_PGTABLE_H
+
+-#define __PAGETABLE_PMD_FOLDED
++#define __PAGETABLE_PMD_FOLDED 1
+ #include <asm-generic/4level-fixup.h>
+ #include <asm-generic/sizes.h>
+
+diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
+index fa6b7c78f18a..ff0860b2b21a 100644
+--- a/arch/parisc/include/asm/pgtable.h
++++ b/arch/parisc/include/asm/pgtable.h
+@@ -117,7 +117,7 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+ #if CONFIG_PGTABLE_LEVELS == 3
+ #define BITS_PER_PMD (PAGE_SHIFT + PMD_ORDER - BITS_PER_PMD_ENTRY)
+ #else
+-#define __PAGETABLE_PMD_FOLDED
++#define __PAGETABLE_PMD_FOLDED 1
+ #define BITS_PER_PMD 0
+ #endif
+ #define PTRS_PER_PMD (1UL << BITS_PER_PMD)
+diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
+index 141d415a8c80..c3d7ccd25381 100644
+--- a/arch/x86/entry/vdso/Makefile
++++ b/arch/x86/entry/vdso/Makefile
+@@ -171,7 +171,8 @@ quiet_cmd_vdso = VDSO $@
+ sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
+
+ VDSO_LDFLAGS = -shared $(call ld-option, --hash-style=both) \
+- $(call ld-option, --build-id) -Bsymbolic
++ $(call ld-option, --build-id) $(call ld-option, --eh-frame-hdr) \
++ -Bsymbolic
+ GCOV_PROFILE := n
+
+ #
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index b3486c8b570a..1f9de7635bcb 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -389,6 +389,7 @@
+ #define MSR_F15H_NB_PERF_CTR 0xc0010241
+ #define MSR_F15H_PTSC 0xc0010280
+ #define MSR_F15H_IC_CFG 0xc0011021
++#define MSR_F15H_EX_CFG 0xc001102c
+
+ /* Fam 10h MSRs */
+ #define MSR_FAM10H_MMIO_CONF_BASE 0xc0010058
+diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+index 0f53049719cd..627e5c809b33 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
++++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+@@ -23,6 +23,7 @@
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
++#include <linux/cpu.h>
+ #include <linux/kernfs.h>
+ #include <linux/seq_file.h>
+ #include <linux/slab.h>
+@@ -310,9 +311,11 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
+ return -EINVAL;
+ buf[nbytes - 1] = '\0';
+
++ cpus_read_lock();
+ rdtgrp = rdtgroup_kn_lock_live(of->kn);
+ if (!rdtgrp) {
+ rdtgroup_kn_unlock(of->kn);
++ cpus_read_unlock();
+ return -ENOENT;
+ }
+ rdt_last_cmd_clear();
+@@ -367,6 +370,7 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
+
+ out:
+ rdtgroup_kn_unlock(of->kn);
++ cpus_read_unlock();
+ return ret ?: nbytes;
+ }
+
+diff --git a/arch/x86/kernel/cpu/mtrr/if.c b/arch/x86/kernel/cpu/mtrr/if.c
+index 40eee6cc4124..254683b503a9 100644
+--- a/arch/x86/kernel/cpu/mtrr/if.c
++++ b/arch/x86/kernel/cpu/mtrr/if.c
+@@ -165,6 +165,8 @@ mtrr_ioctl(struct file *file, unsigned int cmd, unsigned long __arg)
+ struct mtrr_gentry gentry;
+ void __user *arg = (void __user *) __arg;
+
++ memset(&gentry, 0, sizeof(gentry));
++
+ switch (cmd) {
+ case MTRRIOC_ADD_ENTRY:
+ case MTRRIOC_SET_ENTRY:
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index c97a9d60d305..33ffb6d17e73 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -11471,6 +11471,8 @@ static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
+ kunmap(vmx->nested.pi_desc_page);
+ kvm_release_page_dirty(vmx->nested.pi_desc_page);
+ vmx->nested.pi_desc_page = NULL;
++ vmx->nested.pi_desc = NULL;
++ vmcs_write64(POSTED_INTR_DESC_ADDR, -1ull);
+ }
+ page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->posted_intr_desc_addr);
+ if (is_error_page(page))
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 68b53f05a420..956eecd227f8 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2343,6 +2343,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ case MSR_AMD64_PATCH_LOADER:
+ case MSR_AMD64_BU_CFG2:
+ case MSR_AMD64_DC_CFG:
++ case MSR_F15H_EX_CFG:
+ break;
+
+ case MSR_IA32_UCODE_REV:
+@@ -2638,6 +2639,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ case MSR_AMD64_BU_CFG2:
+ case MSR_IA32_PERF_CTL:
+ case MSR_AMD64_DC_CFG:
++ case MSR_F15H_EX_CFG:
+ msr_info->data = 0;
+ break;
+ case MSR_F15H_PERF_CTL0 ... MSR_F15H_PERF_CTR5:
+@@ -7304,7 +7306,7 @@ void kvm_make_scan_ioapic_request(struct kvm *kvm)
+
+ static void vcpu_scan_ioapic(struct kvm_vcpu *vcpu)
+ {
+- if (!kvm_apic_hw_enabled(vcpu->arch.apic))
++ if (!kvm_apic_present(vcpu))
+ return;
+
+ bitmap_zero(vcpu->arch.ioapic_handled_vectors, 256);
+diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
+index 3d0c83ef6aab..a3c9ea29d7cc 100644
+--- a/arch/x86/mm/pat.c
++++ b/arch/x86/mm/pat.c
+@@ -519,8 +519,13 @@ static u64 sanitize_phys(u64 address)
+ * for a "decoy" virtual address (bit 63 clear) passed to
+ * set_memory_X(). __pa() on a "decoy" address results in a
+ * physical address with bit 63 set.
++ *
++ * Decoy addresses are not present for 32-bit builds, see
++ * set_mce_nospec().
+ */
+- return address & __PHYSICAL_MASK;
++ if (IS_ENABLED(CONFIG_X86_64))
++ return address & __PHYSICAL_MASK;
++ return address;
+ }
+
+ /*
+@@ -546,7 +551,11 @@ int reserve_memtype(u64 start, u64 end, enum page_cache_mode req_type,
+
+ start = sanitize_phys(start);
+ end = sanitize_phys(end);
+- BUG_ON(start >= end); /* end is exclusive */
++ if (start >= end) {
++ WARN(1, "%s failed: [mem %#010Lx-%#010Lx], req %s\n", __func__,
++ start, end - 1, cattr_name(req_type));
++ return -EINVAL;
++ }
+
+ if (!pat_enabled()) {
+ /* This is identical to page table setting without PAT */
+diff --git a/drivers/gpio/gpio-max7301.c b/drivers/gpio/gpio-max7301.c
+index 05813fbf3daf..647dfbbc4e1c 100644
+--- a/drivers/gpio/gpio-max7301.c
++++ b/drivers/gpio/gpio-max7301.c
+@@ -25,7 +25,7 @@ static int max7301_spi_write(struct device *dev, unsigned int reg,
+ struct spi_device *spi = to_spi_device(dev);
+ u16 word = ((reg & 0x7F) << 8) | (val & 0xFF);
+
+- return spi_write(spi, (const u8 *)&word, sizeof(word));
++ return spi_write_then_read(spi, &word, sizeof(word), NULL, 0);
+ }
+
+ /* A read from the MAX7301 means two transfers; here, one message each */
+@@ -37,14 +37,8 @@ static int max7301_spi_read(struct device *dev, unsigned int reg)
+ struct spi_device *spi = to_spi_device(dev);
+
+ word = 0x8000 | (reg << 8);
+- ret = spi_write(spi, (const u8 *)&word, sizeof(word));
+- if (ret)
+- return ret;
+- /*
+- * This relies on the fact, that a transfer with NULL tx_buf shifts out
+- * zero bytes (=NOOP for MAX7301)
+- */
+- ret = spi_read(spi, (u8 *)&word, sizeof(word));
++ ret = spi_write_then_read(spi, &word, sizeof(word), &word,
++ sizeof(word));
+ if (ret)
+ return ret;
+ return word & 0xff;
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 8b9d7e42c600..c5e009f61021 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -23,11 +23,28 @@
+
+ #include "gpiolib.h"
+
++/**
++ * struct acpi_gpio_event - ACPI GPIO event handler data
++ *
++ * @node: list-entry of the events list of the struct acpi_gpio_chip
++ * @handle: handle of ACPI method to execute when the IRQ triggers
++ * @handler: irq_handler to pass to request_irq when requesting the IRQ
++ * @pin: GPIO pin number on the gpio_chip
++ * @irq: Linux IRQ number for the event, for request_ / free_irq
++ * @irqflags: flags to pass to request_irq when requesting the IRQ
++ * @irq_is_wake: If the ACPI flags indicate the IRQ is a wakeup source
++ * @is_requested: True if request_irq has been done
++ * @desc: gpio_desc for the GPIO pin for this event
++ */
+ struct acpi_gpio_event {
+ struct list_head node;
+ acpi_handle handle;
++ irq_handler_t handler;
+ unsigned int pin;
+ unsigned int irq;
++ unsigned long irqflags;
++ bool irq_is_wake;
++ bool irq_requested;
+ struct gpio_desc *desc;
+ };
+
+@@ -53,10 +70,10 @@ struct acpi_gpio_chip {
+
+ /*
+ * For gpiochips which call acpi_gpiochip_request_interrupts() before late_init
+- * (so builtin drivers) we register the ACPI GpioInt event handlers from a
++ * (so builtin drivers) we register the ACPI GpioInt IRQ handlers from a
+ * late_initcall_sync handler, so that other builtin drivers can register their
+ * OpRegions before the event handlers can run. This list contains gpiochips
+- * for which the acpi_gpiochip_request_interrupts() has been deferred.
++ * for which the acpi_gpiochip_request_irqs() call has been deferred.
+ */
+ static DEFINE_MUTEX(acpi_gpio_deferred_req_irqs_lock);
+ static LIST_HEAD(acpi_gpio_deferred_req_irqs_list);
+@@ -137,8 +154,42 @@ bool acpi_gpio_get_irq_resource(struct acpi_resource *ares,
+ }
+ EXPORT_SYMBOL_GPL(acpi_gpio_get_irq_resource);
+
+-static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
+- void *context)
++static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio,
++ struct acpi_gpio_event *event)
++{
++ int ret, value;
++
++ ret = request_threaded_irq(event->irq, NULL, event->handler,
++ event->irqflags, "ACPI:Event", event);
++ if (ret) {
++ dev_err(acpi_gpio->chip->parent,
++ "Failed to setup interrupt handler for %d\n",
++ event->irq);
++ return;
++ }
++
++ if (event->irq_is_wake)
++ enable_irq_wake(event->irq);
++
++ event->irq_requested = true;
++
++ /* Make sure we trigger the initial state of edge-triggered IRQs */
++ value = gpiod_get_raw_value_cansleep(event->desc);
++ if (((event->irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
++ ((event->irqflags & IRQF_TRIGGER_FALLING) && value == 0))
++ event->handler(event->irq, event);
++}
++
++static void acpi_gpiochip_request_irqs(struct acpi_gpio_chip *acpi_gpio)
++{
++ struct acpi_gpio_event *event;
++
++ list_for_each_entry(event, &acpi_gpio->events, node)
++ acpi_gpiochip_request_irq(acpi_gpio, event);
++}
++
++static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares,
++ void *context)
+ {
+ struct acpi_gpio_chip *acpi_gpio = context;
+ struct gpio_chip *chip = acpi_gpio->chip;
+@@ -147,8 +198,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
+ struct acpi_gpio_event *event;
+ irq_handler_t handler = NULL;
+ struct gpio_desc *desc;
+- unsigned long irqflags;
+- int ret, pin, irq, value;
++ int ret, pin, irq;
+
+ if (!acpi_gpio_get_irq_resource(ares, &agpio))
+ return AE_OK;
+@@ -179,8 +229,6 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
+
+ gpiod_direction_input(desc);
+
+- value = gpiod_get_value_cansleep(desc);
+-
+ ret = gpiochip_lock_as_irq(chip, pin);
+ if (ret) {
+ dev_err(chip->parent, "Failed to lock GPIO as interrupt\n");
+@@ -193,64 +241,42 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
+ goto fail_unlock_irq;
+ }
+
+- irqflags = IRQF_ONESHOT;
++ event = kzalloc(sizeof(*event), GFP_KERNEL);
++ if (!event)
++ goto fail_unlock_irq;
++
++ event->irqflags = IRQF_ONESHOT;
+ if (agpio->triggering == ACPI_LEVEL_SENSITIVE) {
+ if (agpio->polarity == ACPI_ACTIVE_HIGH)
+- irqflags |= IRQF_TRIGGER_HIGH;
++ event->irqflags |= IRQF_TRIGGER_HIGH;
+ else
+- irqflags |= IRQF_TRIGGER_LOW;
++ event->irqflags |= IRQF_TRIGGER_LOW;
+ } else {
+ switch (agpio->polarity) {
+ case ACPI_ACTIVE_HIGH:
+- irqflags |= IRQF_TRIGGER_RISING;
++ event->irqflags |= IRQF_TRIGGER_RISING;
+ break;
+ case ACPI_ACTIVE_LOW:
+- irqflags |= IRQF_TRIGGER_FALLING;
++ event->irqflags |= IRQF_TRIGGER_FALLING;
+ break;
+ default:
+- irqflags |= IRQF_TRIGGER_RISING |
+- IRQF_TRIGGER_FALLING;
++ event->irqflags |= IRQF_TRIGGER_RISING |
++ IRQF_TRIGGER_FALLING;
+ break;
+ }
+ }
+
+- event = kzalloc(sizeof(*event), GFP_KERNEL);
+- if (!event)
+- goto fail_unlock_irq;
+-
+ event->handle = evt_handle;
++ event->handler = handler;
+ event->irq = irq;
++ event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE;
+ event->pin = pin;
+ event->desc = desc;
+
+- ret = request_threaded_irq(event->irq, NULL, handler, irqflags,
+- "ACPI:Event", event);
+- if (ret) {
+- dev_err(chip->parent,
+- "Failed to setup interrupt handler for %d\n",
+- event->irq);
+- goto fail_free_event;
+- }
+-
+- if (agpio->wake_capable == ACPI_WAKE_CAPABLE)
+- enable_irq_wake(irq);
+-
+ list_add_tail(&event->node, &acpi_gpio->events);
+
+- /*
+- * Make sure we trigger the initial state of the IRQ when using RISING
+- * or FALLING. Note we run the handlers on late_init, the AML code
+- * may refer to OperationRegions from other (builtin) drivers which
+- * may be probed after us.
+- */
+- if (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
+- ((irqflags & IRQF_TRIGGER_FALLING) && value == 0))
+- handler(event->irq, event);
+-
+ return AE_OK;
+
+-fail_free_event:
+- kfree(event);
+ fail_unlock_irq:
+ gpiochip_unlock_as_irq(chip, pin);
+ fail_free_desc:
+@@ -287,6 +313,9 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
+ if (ACPI_FAILURE(status))
+ return;
+
++ acpi_walk_resources(handle, "_AEI",
++ acpi_gpiochip_alloc_event, acpi_gpio);
++
+ mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+ defer = !acpi_gpio_deferred_req_irqs_done;
+ if (defer)
+@@ -297,8 +326,7 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
+ if (defer)
+ return;
+
+- acpi_walk_resources(handle, "_AEI",
+- acpi_gpiochip_request_interrupt, acpi_gpio);
++ acpi_gpiochip_request_irqs(acpi_gpio);
+ }
+ EXPORT_SYMBOL_GPL(acpi_gpiochip_request_interrupts);
+
+@@ -335,10 +363,13 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
+ list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
+ struct gpio_desc *desc;
+
+- if (irqd_is_wakeup_set(irq_get_irq_data(event->irq)))
+- disable_irq_wake(event->irq);
++ if (event->irq_requested) {
++ if (event->irq_is_wake)
++ disable_irq_wake(event->irq);
++
++ free_irq(event->irq, event);
++ }
+
+- free_irq(event->irq, event);
+ desc = event->desc;
+ if (WARN_ON(IS_ERR(desc)))
+ continue;
+@@ -1204,23 +1235,16 @@ bool acpi_can_fallback_to_crs(struct acpi_device *adev, const char *con_id)
+ return con_id == NULL;
+ }
+
+-/* Run deferred acpi_gpiochip_request_interrupts() */
+-static int acpi_gpio_handle_deferred_request_interrupts(void)
++/* Run deferred acpi_gpiochip_request_irqs() */
++static int acpi_gpio_handle_deferred_request_irqs(void)
+ {
+ struct acpi_gpio_chip *acpi_gpio, *tmp;
+
+ mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
+ list_for_each_entry_safe(acpi_gpio, tmp,
+ &acpi_gpio_deferred_req_irqs_list,
+- deferred_req_irqs_list_entry) {
+- acpi_handle handle;
+-
+- handle = ACPI_HANDLE(acpi_gpio->chip->parent);
+- acpi_walk_resources(handle, "_AEI",
+- acpi_gpiochip_request_interrupt, acpi_gpio);
+-
+- list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
+- }
++ deferred_req_irqs_list_entry)
++ acpi_gpiochip_request_irqs(acpi_gpio);
+
+ acpi_gpio_deferred_req_irqs_done = true;
+ mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
+@@ -1228,4 +1252,4 @@ static int acpi_gpio_handle_deferred_request_interrupts(void)
+ return 0;
+ }
+ /* We must use _sync so that this runs after the first deferred_probe run */
+-late_initcall_sync(acpi_gpio_handle_deferred_request_interrupts);
++late_initcall_sync(acpi_gpio_handle_deferred_request_irqs);
+diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
+index ea10e9a26aad..ba129b64b61f 100644
+--- a/drivers/gpu/drm/drm_ioctl.c
++++ b/drivers/gpu/drm/drm_ioctl.c
+@@ -37,6 +37,7 @@
+
+ #include <linux/pci.h>
+ #include <linux/export.h>
++#include <linux/nospec.h>
+
+ /**
+ * DOC: getunique and setversion story
+@@ -794,13 +795,17 @@ long drm_ioctl(struct file *filp,
+
+ if (is_driver_ioctl) {
+ /* driver ioctl */
+- if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls)
++ unsigned int index = nr - DRM_COMMAND_BASE;
++
++ if (index >= dev->driver->num_ioctls)
+ goto err_i1;
+- ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
++ index = array_index_nospec(index, dev->driver->num_ioctls);
++ ioctl = &dev->driver->ioctls[index];
+ } else {
+ /* core ioctl */
+ if (nr >= DRM_CORE_IOCTL_COUNT)
+ goto err_i1;
++ nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
+ ioctl = &drm_ioctls[nr];
+ }
+
+@@ -882,6 +887,7 @@ bool drm_ioctl_flags(unsigned int nr, unsigned int *flags)
+
+ if (nr >= DRM_CORE_IOCTL_COUNT)
+ return false;
++ nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
+
+ *flags = drm_ioctls[nr].flags;
+ return true;
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index c71cc857b649..2c6d5c7a4445 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -316,6 +316,8 @@ static ssize_t out_intr_mask_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ return sprintf(buf, "%d\n", outbound.current_interrupt_mask);
+ }
+@@ -329,6 +331,8 @@ static ssize_t out_read_index_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ return sprintf(buf, "%d\n", outbound.current_read_index);
+ }
+@@ -343,6 +347,8 @@ static ssize_t out_write_index_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ return sprintf(buf, "%d\n", outbound.current_write_index);
+ }
+@@ -357,6 +363,8 @@ static ssize_t out_read_bytes_avail_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ return sprintf(buf, "%d\n", outbound.bytes_avail_toread);
+ }
+@@ -371,6 +379,8 @@ static ssize_t out_write_bytes_avail_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
+ return sprintf(buf, "%d\n", outbound.bytes_avail_towrite);
+ }
+@@ -384,6 +394,8 @@ static ssize_t in_intr_mask_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ return sprintf(buf, "%d\n", inbound.current_interrupt_mask);
+ }
+@@ -397,6 +409,8 @@ static ssize_t in_read_index_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ return sprintf(buf, "%d\n", inbound.current_read_index);
+ }
+@@ -410,6 +424,8 @@ static ssize_t in_write_index_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ return sprintf(buf, "%d\n", inbound.current_write_index);
+ }
+@@ -424,6 +440,8 @@ static ssize_t in_read_bytes_avail_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ return sprintf(buf, "%d\n", inbound.bytes_avail_toread);
+ }
+@@ -438,6 +456,8 @@ static ssize_t in_write_bytes_avail_show(struct device *dev,
+
+ if (!hv_dev->channel)
+ return -ENODEV;
++ if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
++ return -EINVAL;
+ hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
+ return sprintf(buf, "%d\n", inbound.bytes_avail_towrite);
+ }
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 2d95e8d93cc7..9fe075c137dc 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1767,6 +1767,18 @@ static int elantech_smbus = IS_ENABLED(CONFIG_MOUSE_ELAN_I2C_SMBUS) ?
+ module_param_named(elantech_smbus, elantech_smbus, int, 0644);
+ MODULE_PARM_DESC(elantech_smbus, "Use a secondary bus for the Elantech device.");
+
++static const char * const i2c_blacklist_pnp_ids[] = {
++ /*
++ * These are known to not be working properly as bits are missing
++ * in elan_i2c.
++ */
++ "LEN2131", /* ThinkPad P52 w/ NFC */
++ "LEN2132", /* ThinkPad P52 */
++ "LEN2133", /* ThinkPad P72 w/ NFC */
++ "LEN2134", /* ThinkPad P72 */
++ NULL
++};
++
+ static int elantech_create_smbus(struct psmouse *psmouse,
+ struct elantech_device_info *info,
+ bool leave_breadcrumbs)
+@@ -1802,10 +1814,12 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
+
+ if (elantech_smbus == ELANTECH_SMBUS_NOT_SET) {
+ /*
+- * New ICs are enabled by default.
++ * New ICs are enabled by default, unless mentioned in
++ * i2c_blacklist_pnp_ids.
+ * Old ICs are up to the user to decide.
+ */
+- if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
++ if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) ||
++ psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids))
+ return -ENXIO;
+ }
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 30b15e91d8be..8e7a2a59cd32 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -2020,6 +2020,7 @@ static int ov5640_set_fmt(struct v4l2_subdev *sd,
+ struct ov5640_dev *sensor = to_ov5640_dev(sd);
+ const struct ov5640_mode_info *new_mode;
+ struct v4l2_mbus_framefmt *mbus_fmt = &format->format;
++ struct v4l2_mbus_framefmt *fmt;
+ int ret;
+
+ if (format->pad != 0)
+@@ -2037,22 +2038,20 @@ static int ov5640_set_fmt(struct v4l2_subdev *sd,
+ if (ret)
+ goto out;
+
+- if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
+- struct v4l2_mbus_framefmt *fmt =
+- v4l2_subdev_get_try_format(sd, cfg, 0);
++ if (format->which == V4L2_SUBDEV_FORMAT_TRY)
++ fmt = v4l2_subdev_get_try_format(sd, cfg, 0);
++ else
++ fmt = &sensor->fmt;
+
+- *fmt = *mbus_fmt;
+- goto out;
+- }
++ *fmt = *mbus_fmt;
+
+ if (new_mode != sensor->current_mode) {
+ sensor->current_mode = new_mode;
+ sensor->pending_mode_change = true;
+ }
+- if (mbus_fmt->code != sensor->fmt.code) {
+- sensor->fmt = *mbus_fmt;
++ if (mbus_fmt->code != sensor->fmt.code)
+ sensor->pending_fmt_change = true;
+- }
++
+ out:
+ mutex_unlock(&sensor->lock);
+ return ret;
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index bc1bd2c25613..55997cf84b39 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -30,6 +30,7 @@
+ #include "pwrseq.h"
+
+ #define DEFAULT_CMD6_TIMEOUT_MS 500
++#define MIN_CACHE_EN_TIMEOUT_MS 1600
+
+ static const unsigned int tran_exp[] = {
+ 10000, 100000, 1000000, 10000000,
+@@ -526,8 +527,7 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd)
+ card->cid.year += 16;
+
+ /* check whether the eMMC card supports BKOPS */
+- if (!mmc_card_broken_hpi(card) &&
+- ext_csd[EXT_CSD_BKOPS_SUPPORT] & 0x1) {
++ if (ext_csd[EXT_CSD_BKOPS_SUPPORT] & 0x1) {
+ card->ext_csd.bkops = 1;
+ card->ext_csd.man_bkops_en =
+ (ext_csd[EXT_CSD_BKOPS_EN] &
+@@ -1782,20 +1782,26 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
+ if (err) {
+ pr_warn("%s: Enabling HPI failed\n",
+ mmc_hostname(card->host));
++ card->ext_csd.hpi_en = 0;
+ err = 0;
+- } else
++ } else {
+ card->ext_csd.hpi_en = 1;
++ }
+ }
+
+ /*
+- * If cache size is higher than 0, this indicates
+- * the existence of cache and it can be turned on.
++ * If cache size is higher than 0, this indicates the existence of cache
++ * and it can be turned on. Note that some eMMCs from Micron has been
++ * reported to need ~800 ms timeout, while enabling the cache after
++ * sudden power failure tests. Let's extend the timeout to a minimum of
++ * DEFAULT_CACHE_EN_TIMEOUT_MS and do it for all cards.
+ */
+- if (!mmc_card_broken_hpi(card) &&
+- card->ext_csd.cache_size > 0) {
++ if (card->ext_csd.cache_size > 0) {
++ unsigned int timeout_ms = MIN_CACHE_EN_TIMEOUT_MS;
++
++ timeout_ms = max(card->ext_csd.generic_cmd6_time, timeout_ms);
+ err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+- EXT_CSD_CACHE_CTRL, 1,
+- card->ext_csd.generic_cmd6_time);
++ EXT_CSD_CACHE_CTRL, 1, timeout_ms);
+ if (err && err != -EBADMSG)
+ goto free_card;
+
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 68760d4a5d3d..b23c57e07f36 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -2066,7 +2066,6 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ mmc->max_blk_size = 512; /* Block Length at max can be 1024 */
+ mmc->max_blk_count = 0xFFFF; /* No. of Blocks is 16 bits */
+ mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count;
+- mmc->max_seg_size = mmc->max_req_size;
+
+ mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
+ MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE | MMC_CAP_CMD23;
+@@ -2096,6 +2095,17 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ goto err_irq;
+ }
+
++ /*
++ * Limit the maximum segment size to the lower of the request size
++ * and the DMA engine device segment size limits. In reality, with
++ * 32-bit transfers, the DMA engine can do longer segments than this
++ * but there is no way to represent that in the DMA model - if we
++ * increase this figure here, we get warnings from the DMA API debug.
++ */
++ mmc->max_seg_size = min3(mmc->max_req_size,
++ dma_get_max_seg_size(host->rx_chan->device->dev),
++ dma_get_max_seg_size(host->tx_chan->device->dev));
++
+ /* Request IRQ for MMC operations */
+ ret = devm_request_irq(&pdev->dev, host->irq, omap_hsmmc_irq, 0,
+ mmc_hostname(mmc), host);
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index 184c24baca15..d6916f787fce 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -2807,6 +2807,12 @@ static int hso_get_config_data(struct usb_interface *interface)
+ return -EIO;
+ }
+
++ /* check if we have a valid interface */
++ if (if_num > 16) {
++ kfree(config_data);
++ return -EINVAL;
++ }
++
+ switch (config_data[if_num]) {
+ case 0x0:
+ result = 0;
+@@ -2877,10 +2883,18 @@ static int hso_probe(struct usb_interface *interface,
+
+ /* Get the interface/port specification from either driver_info or from
+ * the device itself */
+- if (id->driver_info)
++ if (id->driver_info) {
++ /* if_num is controlled by the device, driver_info is a 0 terminated
++ * array. Make sure, the access is in bounds! */
++ for (i = 0; i <= if_num; ++i)
++ if (((u32 *)(id->driver_info))[i] == 0)
++ goto exit;
+ port_spec = ((u32 *)(id->driver_info))[if_num];
+- else
++ } else {
+ port_spec = hso_get_config_data(interface);
++ if (port_spec < 0)
++ goto exit;
++ }
+
+ /* Check if we need to switch to alt interfaces prior to port
+ * configuration */
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 4d49a1a3f504..16c6c7f921a8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -868,6 +868,15 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
+ int ret, i, j;
+ u16 cmd_wide_id = WIDE_ID(PHY_OPS_GROUP, GEO_TX_POWER_LIMIT);
+
++ /*
++ * This command is not supported on earlier firmware versions.
++ * Unfortunately, we don't have a TLV API flag to rely on, so
++ * rely on the major version which is in the first byte of
++ * ucode_ver.
++ */
++ if (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) < 41)
++ return 0;
++
+ ret = iwl_mvm_sar_get_wgds_table(mvm);
+ if (ret < 0) {
+ IWL_DEBUG_RADIO(mvm,
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index b150da4c6721..5d65500a8aa7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -518,6 +518,56 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x24FD, 0x9074, iwl8265_2ac_cfg)},
+
+ /* 9000 Series */
++ {IWL_PCI_DEVICE(0x02F0, 0x0030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x0034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x0038, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x003C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x0060, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x0064, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x00A0, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x00A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x0230, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x0234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x0238, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x023C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x0260, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x0264, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x02A0, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x02A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x2030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x2034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x4030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x4034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x40A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x4234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x02F0, 0x42A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x0030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x0034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x0038, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x003C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x0060, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x0064, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x00A0, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x00A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x0230, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x0234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x0238, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x023C, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x0260, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x0264, iwl9461_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x02A0, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x02A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x2030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x2034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x4030, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x4034, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x40A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x4234, iwl9560_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x06F0, 0x42A4, iwl9462_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x0018, iwl9260_2ac_cfg)},
+diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c
+index e2addd8b878b..5d75c971004b 100644
+--- a/drivers/net/wireless/marvell/mwifiex/11n.c
++++ b/drivers/net/wireless/marvell/mwifiex/11n.c
+@@ -696,11 +696,10 @@ void mwifiex_11n_delba(struct mwifiex_private *priv, int tid)
+ "Send delba to tid=%d, %pM\n",
+ tid, rx_reor_tbl_ptr->ta);
+ mwifiex_send_delba(priv, tid, rx_reor_tbl_ptr->ta, 0);
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
+- flags);
+- return;
++ goto exit;
+ }
+ }
++exit:
+ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ }
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+index 8e63d14c1e1c..5380fba652cc 100644
+--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
++++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+@@ -103,8 +103,6 @@ static int mwifiex_11n_dispatch_pkt(struct mwifiex_private *priv, void *payload)
+ * There could be holes in the buffer, which are skipped by the function.
+ * Since the buffer is linear, the function uses rotation to simulate
+ * circular buffer.
+- *
+- * The caller must hold rx_reorder_tbl_lock spinlock.
+ */
+ static void
+ mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv,
+@@ -113,21 +111,25 @@ mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv,
+ {
+ int pkt_to_send, i;
+ void *rx_tmp_ptr;
++ unsigned long flags;
+
+ pkt_to_send = (start_win > tbl->start_win) ?
+ min((start_win - tbl->start_win), tbl->win_size) :
+ tbl->win_size;
+
+ for (i = 0; i < pkt_to_send; ++i) {
++ spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ rx_tmp_ptr = NULL;
+ if (tbl->rx_reorder_ptr[i]) {
+ rx_tmp_ptr = tbl->rx_reorder_ptr[i];
+ tbl->rx_reorder_ptr[i] = NULL;
+ }
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ if (rx_tmp_ptr)
+ mwifiex_11n_dispatch_pkt(priv, rx_tmp_ptr);
+ }
+
++ spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ /*
+ * We don't have a circular buffer, hence use rotation to simulate
+ * circular buffer
+@@ -138,6 +140,7 @@ mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv,
+ }
+
+ tbl->start_win = start_win;
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ }
+
+ /*
+@@ -147,8 +150,6 @@ mwifiex_11n_dispatch_pkt_until_start_win(struct mwifiex_private *priv,
+ * The start window is adjusted automatically when a hole is located.
+ * Since the buffer is linear, the function uses rotation to simulate
+ * circular buffer.
+- *
+- * The caller must hold rx_reorder_tbl_lock spinlock.
+ */
+ static void
+ mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv,
+@@ -156,15 +157,22 @@ mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv,
+ {
+ int i, j, xchg;
+ void *rx_tmp_ptr;
++ unsigned long flags;
+
+ for (i = 0; i < tbl->win_size; ++i) {
+- if (!tbl->rx_reorder_ptr[i])
++ spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
++ if (!tbl->rx_reorder_ptr[i]) {
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
++ flags);
+ break;
++ }
+ rx_tmp_ptr = tbl->rx_reorder_ptr[i];
+ tbl->rx_reorder_ptr[i] = NULL;
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ mwifiex_11n_dispatch_pkt(priv, rx_tmp_ptr);
+ }
+
++ spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ /*
+ * We don't have a circular buffer, hence use rotation to simulate
+ * circular buffer
+@@ -177,6 +185,7 @@ mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv,
+ }
+ }
+ tbl->start_win = (tbl->start_win + i) & (MAX_TID_VALUE - 1);
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ }
+
+ /*
+@@ -184,8 +193,6 @@ mwifiex_11n_scan_and_dispatch(struct mwifiex_private *priv,
+ *
+ * The function stops the associated timer and dispatches all the
+ * pending packets in the Rx reorder table before deletion.
+- *
+- * The caller must hold rx_reorder_tbl_lock spinlock.
+ */
+ static void
+ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
+@@ -211,7 +218,11 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
+
+ del_timer_sync(&tbl->timer_context.timer);
+ tbl->timer_context.timer_is_set = false;
++
++ spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ list_del(&tbl->list);
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
++
+ kfree(tbl->rx_reorder_ptr);
+ kfree(tbl);
+
+@@ -224,17 +235,22 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
+ /*
+ * This function returns the pointer to an entry in Rx reordering
+ * table which matches the given TA/TID pair.
+- *
+- * The caller must hold rx_reorder_tbl_lock spinlock.
+ */
+ struct mwifiex_rx_reorder_tbl *
+ mwifiex_11n_get_rx_reorder_tbl(struct mwifiex_private *priv, int tid, u8 *ta)
+ {
+ struct mwifiex_rx_reorder_tbl *tbl;
++ unsigned long flags;
+
+- list_for_each_entry(tbl, &priv->rx_reorder_tbl_ptr, list)
+- if (!memcmp(tbl->ta, ta, ETH_ALEN) && tbl->tid == tid)
++ spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
++ list_for_each_entry(tbl, &priv->rx_reorder_tbl_ptr, list) {
++ if (!memcmp(tbl->ta, ta, ETH_ALEN) && tbl->tid == tid) {
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
++ flags);
+ return tbl;
++ }
++ }
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+
+ return NULL;
+ }
+@@ -251,9 +267,14 @@ void mwifiex_11n_del_rx_reorder_tbl_by_ta(struct mwifiex_private *priv, u8 *ta)
+ return;
+
+ spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+- list_for_each_entry_safe(tbl, tmp, &priv->rx_reorder_tbl_ptr, list)
+- if (!memcmp(tbl->ta, ta, ETH_ALEN))
++ list_for_each_entry_safe(tbl, tmp, &priv->rx_reorder_tbl_ptr, list) {
++ if (!memcmp(tbl->ta, ta, ETH_ALEN)) {
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
++ flags);
+ mwifiex_del_rx_reorder_entry(priv, tbl);
++ spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
++ }
++ }
+ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+
+ return;
+@@ -262,18 +283,24 @@ void mwifiex_11n_del_rx_reorder_tbl_by_ta(struct mwifiex_private *priv, u8 *ta)
+ /*
+ * This function finds the last sequence number used in the packets
+ * buffered in Rx reordering table.
+- *
+- * The caller must hold rx_reorder_tbl_lock spinlock.
+ */
+ static int
+ mwifiex_11n_find_last_seq_num(struct reorder_tmr_cnxt *ctx)
+ {
+ struct mwifiex_rx_reorder_tbl *rx_reorder_tbl_ptr = ctx->ptr;
++ struct mwifiex_private *priv = ctx->priv;
++ unsigned long flags;
+ int i;
+
+- for (i = rx_reorder_tbl_ptr->win_size - 1; i >= 0; --i)
+- if (rx_reorder_tbl_ptr->rx_reorder_ptr[i])
++ spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
++ for (i = rx_reorder_tbl_ptr->win_size - 1; i >= 0; --i) {
++ if (rx_reorder_tbl_ptr->rx_reorder_ptr[i]) {
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
++ flags);
+ return i;
++ }
++ }
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+
+ return -1;
+ }
+@@ -291,22 +318,17 @@ mwifiex_flush_data(struct timer_list *t)
+ struct reorder_tmr_cnxt *ctx =
+ from_timer(ctx, t, timer);
+ int start_win, seq_num;
+- unsigned long flags;
+
+ ctx->timer_is_set = false;
+- spin_lock_irqsave(&ctx->priv->rx_reorder_tbl_lock, flags);
+ seq_num = mwifiex_11n_find_last_seq_num(ctx);
+
+- if (seq_num < 0) {
+- spin_unlock_irqrestore(&ctx->priv->rx_reorder_tbl_lock, flags);
++ if (seq_num < 0)
+ return;
+- }
+
+ mwifiex_dbg(ctx->priv->adapter, INFO, "info: flush data %d\n", seq_num);
+ start_win = (ctx->ptr->start_win + seq_num + 1) & (MAX_TID_VALUE - 1);
+ mwifiex_11n_dispatch_pkt_until_start_win(ctx->priv, ctx->ptr,
+ start_win);
+- spin_unlock_irqrestore(&ctx->priv->rx_reorder_tbl_lock, flags);
+ }
+
+ /*
+@@ -333,14 +355,11 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
+ * If we get a TID, ta pair which is already present dispatch all the
+ * the packets and move the window size until the ssn
+ */
+- spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta);
+ if (tbl) {
+ mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, seq_num);
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ return;
+ }
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ /* if !tbl then create one */
+ new_node = kzalloc(sizeof(struct mwifiex_rx_reorder_tbl), GFP_KERNEL);
+ if (!new_node)
+@@ -551,20 +570,16 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
+ int prev_start_win, start_win, end_win, win_size;
+ u16 pkt_index;
+ bool init_window_shift = false;
+- unsigned long flags;
+ int ret = 0;
+
+- spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta);
+ if (!tbl) {
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ if (pkt_type != PKT_TYPE_BAR)
+ mwifiex_11n_dispatch_pkt(priv, payload);
+ return ret;
+ }
+
+ if ((pkt_type == PKT_TYPE_AMSDU) && !tbl->amsdu) {
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ mwifiex_11n_dispatch_pkt(priv, payload);
+ return ret;
+ }
+@@ -651,8 +666,6 @@ done:
+ if (!tbl->timer_context.timer_is_set ||
+ prev_start_win != tbl->start_win)
+ mwifiex_11n_rxreorder_timer_restart(tbl);
+-
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ return ret;
+ }
+
+@@ -681,18 +694,14 @@ mwifiex_del_ba_tbl(struct mwifiex_private *priv, int tid, u8 *peer_mac,
+ peer_mac, tid, initiator);
+
+ if (cleanup_rx_reorder_tbl) {
+- spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid,
+ peer_mac);
+ if (!tbl) {
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
+- flags);
+ mwifiex_dbg(priv->adapter, EVENT,
+ "event: TID, TA not found in table\n");
+ return;
+ }
+ mwifiex_del_rx_reorder_entry(priv, tbl);
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ } else {
+ ptx_tbl = mwifiex_get_ba_tbl(priv, tid, peer_mac);
+ if (!ptx_tbl) {
+@@ -726,7 +735,6 @@ int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv,
+ int tid, win_size;
+ struct mwifiex_rx_reorder_tbl *tbl;
+ uint16_t block_ack_param_set;
+- unsigned long flags;
+
+ block_ack_param_set = le16_to_cpu(add_ba_rsp->block_ack_param_set);
+
+@@ -740,20 +748,17 @@ int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv,
+ mwifiex_dbg(priv->adapter, ERROR, "ADDBA RSP: failed %pM tid=%d)\n",
+ add_ba_rsp->peer_mac_addr, tid);
+
+- spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid,
+ add_ba_rsp->peer_mac_addr);
+ if (tbl)
+ mwifiex_del_rx_reorder_entry(priv, tbl);
+
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ return 0;
+ }
+
+ win_size = (block_ack_param_set & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK)
+ >> BLOCKACKPARAM_WINSIZE_POS;
+
+- spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid,
+ add_ba_rsp->peer_mac_addr);
+ if (tbl) {
+@@ -764,7 +769,6 @@ int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv,
+ else
+ tbl->amsdu = false;
+ }
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+
+ mwifiex_dbg(priv->adapter, CMD,
+ "cmd: ADDBA RSP: %pM tid=%d ssn=%d win_size=%d\n",
+@@ -804,8 +808,11 @@ void mwifiex_11n_cleanup_reorder_tbl(struct mwifiex_private *priv)
+
+ spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ list_for_each_entry_safe(del_tbl_ptr, tmp_node,
+- &priv->rx_reorder_tbl_ptr, list)
++ &priv->rx_reorder_tbl_ptr, list) {
++ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ mwifiex_del_rx_reorder_entry(priv, del_tbl_ptr);
++ spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
++ }
+ INIT_LIST_HEAD(&priv->rx_reorder_tbl_ptr);
+ spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+
+@@ -929,7 +936,6 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
+ int tlv_buf_left = len;
+ int ret;
+ u8 *tmp;
+- unsigned long flags;
+
+ mwifiex_dbg_dump(priv->adapter, EVT_D, "RXBA_SYNC event:",
+ event_buf, len);
+@@ -949,18 +955,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
+ tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num,
+ tlv_bitmap_len);
+
+- spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ rx_reor_tbl_ptr =
+ mwifiex_11n_get_rx_reorder_tbl(priv, tlv_rxba->tid,
+ tlv_rxba->mac);
+ if (!rx_reor_tbl_ptr) {
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock,
+- flags);
+ mwifiex_dbg(priv->adapter, ERROR,
+ "Can not find rx_reorder_tbl!");
+ return;
+ }
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+
+ for (i = 0; i < tlv_bitmap_len; i++) {
+ for (j = 0 ; j < 8; j++) {
+diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+index a83c5afc256a..5ce85d5727e4 100644
+--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+@@ -421,15 +421,12 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv,
+ spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
+ }
+
+- spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
+ if (!priv->ap_11n_enabled ||
+ (!mwifiex_11n_get_rx_reorder_tbl(priv, uap_rx_pd->priority, ta) &&
+ (le16_to_cpu(uap_rx_pd->rx_pkt_type) != PKT_TYPE_AMSDU))) {
+ ret = mwifiex_handle_uap_rx_forward(priv, skb);
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ return ret;
+ }
+- spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+
+ /* Reorder and send to kernel */
+ pkt_type = (u8)le16_to_cpu(uap_rx_pd->rx_pkt_type);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index f4122c8fdd97..ef9b502ce576 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -2289,6 +2289,7 @@ void rtl_c2hcmd_enqueue(struct ieee80211_hw *hw, struct sk_buff *skb)
+
+ if (rtl_c2h_fast_cmd(hw, skb)) {
+ rtl_c2h_content_parsing(hw, skb);
++ kfree_skb(skb);
+ return;
+ }
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 4a57ffecc7e6..5c9acb634ff7 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -132,6 +132,7 @@ static DEFINE_MUTEX(sd_ref_mutex);
+
+ static struct kmem_cache *sd_cdb_cache;
+ static mempool_t *sd_cdb_pool;
++static mempool_t *sd_page_pool;
+
+ static const char *sd_cache_types[] = {
+ "write through", "none", "write back",
+@@ -758,9 +759,10 @@ static int sd_setup_unmap_cmnd(struct scsi_cmnd *cmd)
+ unsigned int data_len = 24;
+ char *buf;
+
+- rq->special_vec.bv_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
++ rq->special_vec.bv_page = mempool_alloc(sd_page_pool, GFP_ATOMIC);
+ if (!rq->special_vec.bv_page)
+ return BLKPREP_DEFER;
++ clear_highpage(rq->special_vec.bv_page);
+ rq->special_vec.bv_offset = 0;
+ rq->special_vec.bv_len = data_len;
+ rq->rq_flags |= RQF_SPECIAL_PAYLOAD;
+@@ -791,9 +793,10 @@ static int sd_setup_write_same16_cmnd(struct scsi_cmnd *cmd, bool unmap)
+ u32 nr_sectors = blk_rq_sectors(rq) >> (ilog2(sdp->sector_size) - 9);
+ u32 data_len = sdp->sector_size;
+
+- rq->special_vec.bv_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
++ rq->special_vec.bv_page = mempool_alloc(sd_page_pool, GFP_ATOMIC);
+ if (!rq->special_vec.bv_page)
+ return BLKPREP_DEFER;
++ clear_highpage(rq->special_vec.bv_page);
+ rq->special_vec.bv_offset = 0;
+ rq->special_vec.bv_len = data_len;
+ rq->rq_flags |= RQF_SPECIAL_PAYLOAD;
+@@ -821,9 +824,10 @@ static int sd_setup_write_same10_cmnd(struct scsi_cmnd *cmd, bool unmap)
+ u32 nr_sectors = blk_rq_sectors(rq) >> (ilog2(sdp->sector_size) - 9);
+ u32 data_len = sdp->sector_size;
+
+- rq->special_vec.bv_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
++ rq->special_vec.bv_page = mempool_alloc(sd_page_pool, GFP_ATOMIC);
+ if (!rq->special_vec.bv_page)
+ return BLKPREP_DEFER;
++ clear_highpage(rq->special_vec.bv_page);
+ rq->special_vec.bv_offset = 0;
+ rq->special_vec.bv_len = data_len;
+ rq->rq_flags |= RQF_SPECIAL_PAYLOAD;
+@@ -1287,7 +1291,7 @@ static void sd_uninit_command(struct scsi_cmnd *SCpnt)
+ u8 *cmnd;
+
+ if (rq->rq_flags & RQF_SPECIAL_PAYLOAD)
+- __free_page(rq->special_vec.bv_page);
++ mempool_free(rq->special_vec.bv_page, sd_page_pool);
+
+ if (SCpnt->cmnd != scsi_req(rq)->cmd) {
+ cmnd = SCpnt->cmnd;
+@@ -3635,6 +3639,13 @@ static int __init init_sd(void)
+ goto err_out_cache;
+ }
+
++ sd_page_pool = mempool_create_page_pool(SD_MEMPOOL_SIZE, 0);
++ if (!sd_page_pool) {
++ printk(KERN_ERR "sd: can't init discard page pool\n");
++ err = -ENOMEM;
++ goto err_out_ppool;
++ }
++
+ err = scsi_register_driver(&sd_template.gendrv);
+ if (err)
+ goto err_out_driver;
+@@ -3642,6 +3653,9 @@ static int __init init_sd(void)
+ return 0;
+
+ err_out_driver:
++ mempool_destroy(sd_page_pool);
++
++err_out_ppool:
+ mempool_destroy(sd_cdb_pool);
+
+ err_out_cache:
+@@ -3668,6 +3682,7 @@ static void __exit exit_sd(void)
+
+ scsi_unregister_driver(&sd_template.gendrv);
+ mempool_destroy(sd_cdb_pool);
++ mempool_destroy(sd_page_pool);
+ kmem_cache_destroy(sd_cdb_cache);
+
+ class_unregister(&sd_disk_class);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 94aca1b5ac8a..01b5818a4be5 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1507,7 +1507,8 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ portsc_buf[port_index] = 0;
+
+ /* Bail out if a USB3 port has a new device in link training */
+- if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) {
++ if ((hcd->speed >= HCD_USB3) &&
++ (t1 & PORT_PLS_MASK) == XDEV_POLLING) {
+ bus_state->bus_suspended = 0;
+ spin_unlock_irqrestore(&xhci->lock, flags);
+ xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index c3ed7d1c9f65..e88060ea1e33 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1860,6 +1860,8 @@ struct xhci_hcd {
+ unsigned sw_lpm_support:1;
+ /* support xHCI 1.0 spec USB2 hardware LPM */
+ unsigned hw_lpm_support:1;
++ /* Broken Suspend flag for SNPS Suspend resume issue */
++ unsigned broken_suspend:1;
+ /* cached usb2 extened protocol capabilites */
+ u32 *ext_caps;
+ unsigned int num_ext_caps;
+@@ -1877,8 +1879,6 @@ struct xhci_hcd {
+ void *dbc;
+ /* platform-specific data -- must come last */
+ unsigned long priv[0] __aligned(sizeof(s64));
+- /* Broken Suspend flag for SNPS Suspend resume issue */
+- u8 broken_suspend;
+ };
+
+ /* Platform specific overrides to generic XHCI hc_driver ops */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index e72ad9f81c73..17787dc349f8 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1164,6 +1164,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x1900), /* Telit LN940 (QMI) */
++ .driver_info = NCTRL(0) | RSVD(1) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
++ .driver_info = NCTRL(0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) },
+@@ -1328,6 +1332,7 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0602, 0xff) }, /* GosunCn ZTE WeLink ME3630 (MBIM mode) */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
+@@ -1531,6 +1536,7 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(2) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */
+ .driver_info = RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
+@@ -1758,6 +1764,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
+ .driver_info = RSVD(5) | RSVD(6) },
++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
+@@ -1940,7 +1947,14 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x10) }, /* HP lt4132 (Huawei ME906s-158) */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x12) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
++ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */
++ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/fs/iomap.c b/fs/iomap.c
+index 37da7a61a6c5..ec15cf2ec696 100644
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -117,12 +117,6 @@ iomap_page_create(struct inode *inode, struct page *page)
+ atomic_set(&iop->read_count, 0);
+ atomic_set(&iop->write_count, 0);
+ bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
+-
+- /*
+- * migrate_page_move_mapping() assumes that pages with private data have
+- * their count elevated by 1.
+- */
+- get_page(page);
+ set_page_private(page, (unsigned long)iop);
+ SetPagePrivate(page);
+ return iop;
+@@ -139,7 +133,6 @@ iomap_page_release(struct page *page)
+ WARN_ON_ONCE(atomic_read(&iop->write_count));
+ ClearPagePrivate(page);
+ set_page_private(page, 0);
+- put_page(page);
+ kfree(iop);
+ }
+
+diff --git a/fs/namei.c b/fs/namei.c
+index 0cab6494978c..914178cdbe94 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -3701,8 +3701,7 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
+ if (error)
+ return error;
+
+- if ((S_ISCHR(mode) || S_ISBLK(mode)) &&
+- !ns_capable(dentry->d_sb->s_user_ns, CAP_MKNOD))
++ if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
+ return -EPERM;
+
+ if (!dir->i_op->mknod)
+diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
+index 89921a0d2ebb..4d598a399bbf 100644
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -464,7 +464,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
+
+ inode = new_inode(sb);
+ if (!inode)
+- goto out;
++ return ERR_PTR(-ENOMEM);
+
+ inode->i_ino = get_next_ino();
+
+@@ -474,8 +474,7 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
+ if (unlikely(head->unregistering)) {
+ spin_unlock(&sysctl_lock);
+ iput(inode);
+- inode = NULL;
+- goto out;
++ return ERR_PTR(-ENOENT);
+ }
+ ei->sysctl = head;
+ ei->sysctl_entry = table;
+@@ -500,7 +499,6 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
+ if (root->set_ownership)
+ root->set_ownership(head, table, &inode->i_uid, &inode->i_gid);
+
+-out:
+ return inode;
+ }
+
+@@ -549,10 +547,11 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
+ goto out;
+ }
+
+- err = ERR_PTR(-ENOMEM);
+ inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
+- if (!inode)
++ if (IS_ERR(inode)) {
++ err = ERR_CAST(inode);
+ goto out;
++ }
+
+ d_set_d_op(dentry, &proc_sys_dentry_operations);
+ err = d_splice_alias(inode, dentry);
+@@ -685,7 +684,7 @@ static bool proc_sys_fill_cache(struct file *file,
+ if (d_in_lookup(child)) {
+ struct dentry *res;
+ inode = proc_sys_make_inode(dir->d_sb, head, table);
+- if (!inode) {
++ if (IS_ERR(inode)) {
+ d_lookup_done(child);
+ dput(child);
+ return false;
+diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
+index 4844538eb926..c6f9b2225387 100644
+--- a/fs/ubifs/replay.c
++++ b/fs/ubifs/replay.c
+@@ -209,6 +209,38 @@ static int trun_remove_range(struct ubifs_info *c, struct replay_entry *r)
+ return ubifs_tnc_remove_range(c, &min_key, &max_key);
+ }
+
++/**
++ * inode_still_linked - check whether inode in question will be re-linked.
++ * @c: UBIFS file-system description object
++ * @rino: replay entry to test
++ *
++ * O_TMPFILE files can be re-linked, this means link count goes from 0 to 1.
++ * This case needs special care, otherwise all references to the inode will
++ * be removed upon the first replay entry of an inode with link count 0
++ * is found.
++ */
++static bool inode_still_linked(struct ubifs_info *c, struct replay_entry *rino)
++{
++ struct replay_entry *r;
++
++ ubifs_assert(c, rino->deletion);
++ ubifs_assert(c, key_type(c, &rino->key) == UBIFS_INO_KEY);
++
++ /*
++ * Find the most recent entry for the inode behind @rino and check
++ * whether it is a deletion.
++ */
++ list_for_each_entry_reverse(r, &c->replay_list, list) {
++ ubifs_assert(c, r->sqnum >= rino->sqnum);
++ if (key_inum(c, &r->key) == key_inum(c, &rino->key))
++ return r->deletion == 0;
++
++ }
++
++ ubifs_assert(c, 0);
++ return false;
++}
++
+ /**
+ * apply_replay_entry - apply a replay entry to the TNC.
+ * @c: UBIFS file-system description object
+@@ -236,6 +268,11 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
+ {
+ ino_t inum = key_inum(c, &r->key);
+
++ if (inode_still_linked(c, r)) {
++ err = 0;
++ break;
++ }
++
+ err = ubifs_tnc_remove_ino(c, inum);
+ break;
+ }
+diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
+index 89f3b03b1445..e3667c9a33a5 100644
+--- a/include/asm-generic/4level-fixup.h
++++ b/include/asm-generic/4level-fixup.h
+@@ -3,7 +3,7 @@
+ #define _4LEVEL_FIXUP_H
+
+ #define __ARCH_HAS_4LEVEL_HACK
+-#define __PAGETABLE_PUD_FOLDED
++#define __PAGETABLE_PUD_FOLDED 1
+
+ #define PUD_SHIFT PGDIR_SHIFT
+ #define PUD_SIZE PGDIR_SIZE
+diff --git a/include/asm-generic/5level-fixup.h b/include/asm-generic/5level-fixup.h
+index 9c2e0708eb82..73474bb52344 100644
+--- a/include/asm-generic/5level-fixup.h
++++ b/include/asm-generic/5level-fixup.h
+@@ -3,7 +3,7 @@
+ #define _5LEVEL_FIXUP_H
+
+ #define __ARCH_HAS_5LEVEL_HACK
+-#define __PAGETABLE_P4D_FOLDED
++#define __PAGETABLE_P4D_FOLDED 1
+
+ #define P4D_SHIFT PGDIR_SHIFT
+ #define P4D_SIZE PGDIR_SIZE
+diff --git a/include/asm-generic/pgtable-nop4d-hack.h b/include/asm-generic/pgtable-nop4d-hack.h
+index 0c34215263b8..1d6dd38c0e5e 100644
+--- a/include/asm-generic/pgtable-nop4d-hack.h
++++ b/include/asm-generic/pgtable-nop4d-hack.h
+@@ -5,7 +5,7 @@
+ #ifndef __ASSEMBLY__
+ #include <asm-generic/5level-fixup.h>
+
+-#define __PAGETABLE_PUD_FOLDED
++#define __PAGETABLE_PUD_FOLDED 1
+
+ /*
+ * Having the pud type consist of a pgd gets the size right, and allows
+diff --git a/include/asm-generic/pgtable-nop4d.h b/include/asm-generic/pgtable-nop4d.h
+index 1a29b2a0282b..04cb913797bc 100644
+--- a/include/asm-generic/pgtable-nop4d.h
++++ b/include/asm-generic/pgtable-nop4d.h
+@@ -4,7 +4,7 @@
+
+ #ifndef __ASSEMBLY__
+
+-#define __PAGETABLE_P4D_FOLDED
++#define __PAGETABLE_P4D_FOLDED 1
+
+ typedef struct { pgd_t pgd; } p4d_t;
+
+diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
+index f35f6e8149e4..b85b8271a73d 100644
+--- a/include/asm-generic/pgtable-nopmd.h
++++ b/include/asm-generic/pgtable-nopmd.h
+@@ -8,7 +8,7 @@
+
+ struct mm_struct;
+
+-#define __PAGETABLE_PMD_FOLDED
++#define __PAGETABLE_PMD_FOLDED 1
+
+ /*
+ * Having the pmd type consist of a pud gets the size right, and allows
+diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
+index e950b9c50f34..9bef475db6fe 100644
+--- a/include/asm-generic/pgtable-nopud.h
++++ b/include/asm-generic/pgtable-nopud.h
+@@ -9,7 +9,7 @@
+ #else
+ #include <asm-generic/pgtable-nop4d.h>
+
+-#define __PAGETABLE_PUD_FOLDED
++#define __PAGETABLE_PUD_FOLDED 1
+
+ /*
+ * Having the pud type consist of a p4d gets the size right, and allows
+diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
+index 88ebc6102c7c..15fd0277ffa6 100644
+--- a/include/asm-generic/pgtable.h
++++ b/include/asm-generic/pgtable.h
+@@ -1127,4 +1127,20 @@ static inline bool arch_has_pfn_modify_check(void)
+ #endif
+ #endif
+
++/*
++ * On some architectures it depends on the mm if the p4d/pud or pmd
++ * layer of the page table hierarchy is folded or not.
++ */
++#ifndef mm_p4d_folded
++#define mm_p4d_folded(mm) __is_defined(__PAGETABLE_P4D_FOLDED)
++#endif
++
++#ifndef mm_pud_folded
++#define mm_pud_folded(mm) __is_defined(__PAGETABLE_PUD_FOLDED)
++#endif
++
++#ifndef mm_pmd_folded
++#define mm_pmd_folded(mm) __is_defined(__PAGETABLE_PMD_FOLDED)
++#endif
++
+ #endif /* _ASM_GENERIC_PGTABLE_H */
+diff --git a/include/linux/math64.h b/include/linux/math64.h
+index 837f2f2d1d34..bb2c84afb80c 100644
+--- a/include/linux/math64.h
++++ b/include/linux/math64.h
+@@ -281,4 +281,7 @@ static inline u64 mul_u64_u32_div(u64 a, u32 mul, u32 divisor)
+ }
+ #endif /* mul_u64_u32_div */
+
++#define DIV64_U64_ROUND_UP(ll, d) \
++ ({ u64 _tmp = (d); div64_u64((ll) + _tmp - 1, _tmp); })
++
+ #endif /* _LINUX_MATH64_H */
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 0416a7204be3..e899460f1bc5 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1724,11 +1724,15 @@ int __pud_alloc(struct mm_struct *mm, p4d_t *p4d, unsigned long address);
+
+ static inline void mm_inc_nr_puds(struct mm_struct *mm)
+ {
++ if (mm_pud_folded(mm))
++ return;
+ atomic_long_add(PTRS_PER_PUD * sizeof(pud_t), &mm->pgtables_bytes);
+ }
+
+ static inline void mm_dec_nr_puds(struct mm_struct *mm)
+ {
++ if (mm_pud_folded(mm))
++ return;
+ atomic_long_sub(PTRS_PER_PUD * sizeof(pud_t), &mm->pgtables_bytes);
+ }
+ #endif
+@@ -1748,11 +1752,15 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address);
+
+ static inline void mm_inc_nr_pmds(struct mm_struct *mm)
+ {
++ if (mm_pmd_folded(mm))
++ return;
+ atomic_long_add(PTRS_PER_PMD * sizeof(pmd_t), &mm->pgtables_bytes);
+ }
+
+ static inline void mm_dec_nr_pmds(struct mm_struct *mm)
+ {
++ if (mm_pmd_folded(mm))
++ return;
+ atomic_long_sub(PTRS_PER_PMD * sizeof(pmd_t), &mm->pgtables_bytes);
+ }
+ #endif
+diff --git a/include/linux/t10-pi.h b/include/linux/t10-pi.h
+index b9626aa7e90c..3e2a80cc7b56 100644
+--- a/include/linux/t10-pi.h
++++ b/include/linux/t10-pi.h
+@@ -39,12 +39,13 @@ struct t10_pi_tuple {
+
+ static inline u32 t10_pi_ref_tag(struct request *rq)
+ {
++ unsigned int shift = ilog2(queue_logical_block_size(rq->q));
++
+ #ifdef CONFIG_BLK_DEV_INTEGRITY
+- return blk_rq_pos(rq) >>
+- (rq->q->integrity.interval_exp - 9) & 0xffffffff;
+-#else
+- return -1U;
++ if (rq->q->integrity.interval_exp)
++ shift = rq->q->integrity.interval_exp;
+ #endif
++ return blk_rq_pos(rq) >> (shift - SECTOR_SHIFT) & 0xffffffff;
+ }
+
+ extern const struct blk_integrity_profile t10_pi_type1_crc;
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index 0eb390c205af..da588def3c61 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1552,6 +1552,7 @@ int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
+ int (*func)(struct xfrm_state *, int, void*), void *);
+ void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
+ struct xfrm_state *xfrm_state_alloc(struct net *net);
++void xfrm_state_free(struct xfrm_state *x);
+ struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
+ const xfrm_address_t *saddr,
+ const struct flowi *fl,
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 11fc3bb456d6..f89abca89513 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1148,11 +1148,65 @@ out_error:
+ return ret;
+ }
+
++static int handle_exit_race(u32 __user *uaddr, u32 uval,
++ struct task_struct *tsk)
++{
++ u32 uval2;
++
++ /*
++ * If PF_EXITPIDONE is not yet set, then try again.
++ */
++ if (tsk && !(tsk->flags & PF_EXITPIDONE))
++ return -EAGAIN;
++
++ /*
++ * Reread the user space value to handle the following situation:
++ *
++ * CPU0 CPU1
++ *
++ * sys_exit() sys_futex()
++ * do_exit() futex_lock_pi()
++ * futex_lock_pi_atomic()
++ * exit_signals(tsk) No waiters:
++ * tsk->flags |= PF_EXITING; *uaddr == 0x00000PID
++ * mm_release(tsk) Set waiter bit
++ * exit_robust_list(tsk) { *uaddr = 0x80000PID;
++ * Set owner died attach_to_pi_owner() {
++ * *uaddr = 0xC0000000; tsk = get_task(PID);
++ * } if (!tsk->flags & PF_EXITING) {
++ * ... attach();
++ * tsk->flags |= PF_EXITPIDONE; } else {
++ * if (!(tsk->flags & PF_EXITPIDONE))
++ * return -EAGAIN;
++ * return -ESRCH; <--- FAIL
++ * }
++ *
++ * Returning ESRCH unconditionally is wrong here because the
++ * user space value has been changed by the exiting task.
++ *
++ * The same logic applies to the case where the exiting task is
++ * already gone.
++ */
++ if (get_futex_value_locked(&uval2, uaddr))
++ return -EFAULT;
++
++ /* If the user space value has changed, try again. */
++ if (uval2 != uval)
++ return -EAGAIN;
++
++ /*
++ * The exiting task did not have a robust list, the robust list was
++ * corrupted or the user space value in *uaddr is simply bogus.
++ * Give up and tell user space.
++ */
++ return -ESRCH;
++}
++
+ /*
+ * Lookup the task for the TID provided from user space and attach to
+ * it after doing proper sanity checks.
+ */
+-static int attach_to_pi_owner(u32 uval, union futex_key *key,
++static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key,
+ struct futex_pi_state **ps)
+ {
+ pid_t pid = uval & FUTEX_TID_MASK;
+@@ -1162,12 +1216,15 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
+ /*
+ * We are the first waiter - try to look up the real owner and attach
+ * the new pi_state to it, but bail out when TID = 0 [1]
++ *
++ * The !pid check is paranoid. None of the call sites should end up
++ * with pid == 0, but better safe than sorry. Let the caller retry
+ */
+ if (!pid)
+- return -ESRCH;
++ return -EAGAIN;
+ p = find_get_task_by_vpid(pid);
+ if (!p)
+- return -ESRCH;
++ return handle_exit_race(uaddr, uval, NULL);
+
+ if (unlikely(p->flags & PF_KTHREAD)) {
+ put_task_struct(p);
+@@ -1187,7 +1244,7 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
+ * set, we know that the task has finished the
+ * cleanup:
+ */
+- int ret = (p->flags & PF_EXITPIDONE) ? -ESRCH : -EAGAIN;
++ int ret = handle_exit_race(uaddr, uval, p);
+
+ raw_spin_unlock_irq(&p->pi_lock);
+ put_task_struct(p);
+@@ -1244,7 +1301,7 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval,
+ * We are the first waiter - try to look up the owner based on
+ * @uval and attach to it.
+ */
+- return attach_to_pi_owner(uval, key, ps);
++ return attach_to_pi_owner(uaddr, uval, key, ps);
+ }
+
+ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
+@@ -1352,7 +1409,7 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
+ * attach to the owner. If that fails, no harm done, we only
+ * set the FUTEX_WAITERS bit in the user space variable.
+ */
+- return attach_to_pi_owner(uval, key, ps);
++ return attach_to_pi_owner(uaddr, newval, key, ps);
+ }
+
+ /**
+diff --git a/kernel/panic.c b/kernel/panic.c
+index 8b2e002d52eb..6a6df23acd1a 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -14,6 +14,7 @@
+ #include <linux/kmsg_dump.h>
+ #include <linux/kallsyms.h>
+ #include <linux/notifier.h>
++#include <linux/vt_kern.h>
+ #include <linux/module.h>
+ #include <linux/random.h>
+ #include <linux/ftrace.h>
+@@ -233,7 +234,10 @@ void panic(const char *fmt, ...)
+ if (_crash_kexec_post_notifiers)
+ __crash_kexec(NULL);
+
+- bust_spinlocks(0);
++#ifdef CONFIG_VT
++ unblank_screen();
++#endif
++ console_unblank();
+
+ /*
+ * We may have ended up stopping the CPU holding the lock (in
+diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
+index 4b9127e95430..5a01c4fdbfef 100644
+--- a/kernel/time/posix-timers.c
++++ b/kernel/time/posix-timers.c
+@@ -289,9 +289,6 @@ static void common_hrtimer_rearm(struct k_itimer *timr)
+ {
+ struct hrtimer *timer = &timr->it.real.timer;
+
+- if (!timr->it_interval)
+- return;
+-
+ timr->it_overrun += hrtimer_forward(timer, timer->base->get_time(),
+ timr->it_interval);
+ hrtimer_restart(timer);
+@@ -317,7 +314,7 @@ void posixtimer_rearm(struct siginfo *info)
+ if (!timr)
+ return;
+
+- if (timr->it_requeue_pending == info->si_sys_private) {
++ if (timr->it_interval && timr->it_requeue_pending == info->si_sys_private) {
+ timr->kclock->timer_rearm(timr);
+
+ timr->it_active = 1;
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 15310f14c25e..d2cd70cfaa90 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2127,23 +2127,25 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
+ */
+ old_pmd = pmdp_invalidate(vma, haddr, pmd);
+
+-#ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
+ pmd_migration = is_pmd_migration_entry(old_pmd);
+- if (pmd_migration) {
++ if (unlikely(pmd_migration)) {
+ swp_entry_t entry;
+
+ entry = pmd_to_swp_entry(old_pmd);
+ page = pfn_to_page(swp_offset(entry));
+- } else
+-#endif
++ write = is_write_migration_entry(entry);
++ young = false;
++ soft_dirty = pmd_swp_soft_dirty(old_pmd);
++ } else {
+ page = pmd_page(old_pmd);
++ if (pmd_dirty(old_pmd))
++ SetPageDirty(page);
++ write = pmd_write(old_pmd);
++ young = pmd_young(old_pmd);
++ soft_dirty = pmd_soft_dirty(old_pmd);
++ }
+ VM_BUG_ON_PAGE(!page_count(page), page);
+ page_ref_add(page, HPAGE_PMD_NR - 1);
+- if (pmd_dirty(old_pmd))
+- SetPageDirty(page);
+- write = pmd_write(old_pmd);
+- young = pmd_young(old_pmd);
+- soft_dirty = pmd_soft_dirty(old_pmd);
+
+ /*
+ * Withdraw the table only after we mark the pmd entry invalid.
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 6a62b2421cdf..93e73ccb4dec 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5538,6 +5538,18 @@ not_early:
+ cond_resched();
+ }
+ }
++#ifdef CONFIG_SPARSEMEM
++ /*
++ * If the zone does not span the rest of the section then
++ * we should at least initialize those pages. Otherwise we
++ * could blow up on a poisoned page in some paths which depend
++ * on full sections being initialized (e.g. memory hotplug).
++ */
++ while (end_pfn % PAGES_PER_SECTION) {
++ __init_single_page(pfn_to_page(end_pfn), end_pfn, zone, nid);
++ end_pfn++;
++ }
++#endif
+ }
+
+ static void __meminit zone_init_free_lists(struct zone *zone)
+@@ -7704,11 +7716,14 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count,
+ * handle each tail page individually in migration.
+ */
+ if (PageHuge(page)) {
++ struct page *head = compound_head(page);
++ unsigned int skip_pages;
+
+- if (!hugepage_migration_supported(page_hstate(page)))
++ if (!hugepage_migration_supported(page_hstate(head)))
+ goto unmovable;
+
+- iter = round_up(iter + 1, 1<<compound_order(page)) - 1;
++ skip_pages = (1 << compound_order(head)) - (page - head);
++ iter += skip_pages - 1;
+ continue;
+ }
+
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index c5ef7240cbcb..961401c46334 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2456,9 +2456,11 @@ out:
+ /*
+ * Scan types proportional to swappiness and
+ * their relative recent reclaim efficiency.
++ * Make sure we don't miss the last page
++ * because of a round-off error.
+ */
+- scan = div64_u64(scan * fraction[file],
+- denominator);
++ scan = DIV64_U64_ROUND_UP(scan * fraction[file],
++ denominator);
+ break;
+ case SCAN_FILE:
+ case SCAN_ANON:
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index b669262682c9..7a34990a68b1 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -426,6 +426,12 @@ static void xfrm_put_mode(struct xfrm_mode *mode)
+ module_put(mode->owner);
+ }
+
++void xfrm_state_free(struct xfrm_state *x)
++{
++ kmem_cache_free(xfrm_state_cache, x);
++}
++EXPORT_SYMBOL(xfrm_state_free);
++
+ static void xfrm_state_gc_destroy(struct xfrm_state *x)
+ {
+ tasklet_hrtimer_cancel(&x->mtimer);
+@@ -452,7 +458,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
+ }
+ xfrm_dev_state_free(x);
+ security_xfrm_state_free(x);
+- kmem_cache_free(xfrm_state_cache, x);
++ xfrm_state_free(x);
+ }
+
+ static void xfrm_state_gc_task(struct work_struct *work)
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index df7ca2dabc48..566919838d5e 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -2288,13 +2288,13 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
+
+ }
+
+- kfree(x);
++ xfrm_state_free(x);
+ kfree(xp);
+
+ return 0;
+
+ free_state:
+- kfree(x);
++ xfrm_state_free(x);
+ nomem:
+ return err;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-01-09 17:54 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-01-09 17:54 UTC (permalink / raw
To: gentoo-commits
commit: 601a9d4068a17a6bd9bf827bd6ac57c185beabfc
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 9 17:54:28 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jan 9 17:54:28 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=601a9d40
proj/linux-patches: Linux patch 4.19.14
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1013_linux-4.19.14.patch | 6925 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6929 insertions(+)
diff --git a/0000_README b/0000_README
index e349c5a..5bb2bcd 100644
--- a/0000_README
+++ b/0000_README
@@ -95,6 +95,10 @@ Patch: 1012_linux-4.19.13.patch
From: http://www.kernel.org
Desc: Linux 4.19.13
+Patch: 1013_linux-4.19.14.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.14
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1013_linux-4.19.14.patch b/1013_linux-4.19.14.patch
new file mode 100644
index 0000000..b005c31
--- /dev/null
+++ b/1013_linux-4.19.14.patch
@@ -0,0 +1,6925 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 0c404cda531a..f5acf35c712f 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2073,6 +2073,9 @@
+ off
+ Disables hypervisor mitigations and doesn't
+ emit any warnings.
++ It also drops the swap size and available
++ RAM limit restriction on both hypervisor and
++ bare metal.
+
+ Default is 'flush'.
+
+diff --git a/Documentation/admin-guide/l1tf.rst b/Documentation/admin-guide/l1tf.rst
+index bae52b845de0..9f5924f81f89 100644
+--- a/Documentation/admin-guide/l1tf.rst
++++ b/Documentation/admin-guide/l1tf.rst
+@@ -405,6 +405,9 @@ time with the option "l1tf=". The valid arguments for this option are:
+
+ off Disables hypervisor mitigations and doesn't emit any
+ warnings.
++ It also drops the swap size and available RAM limit restrictions
++ on both hypervisor and bare metal.
++
+ ============ =============================================================
+
+ The default is 'flush'. For details about L1D flushing see :ref:`l1d_flush`.
+@@ -576,7 +579,8 @@ Default mitigations
+ The kernel default mitigations for vulnerable processors are:
+
+ - PTE inversion to protect against malicious user space. This is done
+- unconditionally and cannot be controlled.
++ unconditionally and cannot be controlled. The swap storage is limited
++ to ~16TB.
+
+ - L1D conditional flushing on VMENTER when EPT is enabled for
+ a guest.
+diff --git a/Makefile b/Makefile
+index 892ff14cbc9d..3324dd0e11a3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 13
++SUBLEVEL = 14
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
+index a90c4f126050..ac69f307dcfe 100644
+--- a/arch/arc/Kconfig
++++ b/arch/arc/Kconfig
+@@ -26,6 +26,7 @@ config ARC
+ select GENERIC_IRQ_SHOW
+ select GENERIC_PCI_IOMAP
+ select GENERIC_PENDING_IRQ if SMP
++ select GENERIC_SCHED_CLOCK
+ select GENERIC_SMP_IDLE_THREAD
+ select HAVE_ARCH_KGDB
+ select HAVE_ARCH_TRACEHOOK
+diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-audio.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-audio.dtsi
+index 03611d50c5a9..e84544b220b9 100644
+--- a/arch/arm/boot/dts/exynos5422-odroidxu3-audio.dtsi
++++ b/arch/arm/boot/dts/exynos5422-odroidxu3-audio.dtsi
+@@ -26,8 +26,7 @@
+ "Speakers", "SPKL",
+ "Speakers", "SPKR";
+
+- assigned-clocks = <&i2s0 CLK_I2S_RCLK_SRC>,
+- <&clock CLK_MOUT_EPLL>,
++ assigned-clocks = <&clock CLK_MOUT_EPLL>,
+ <&clock CLK_MOUT_MAU_EPLL>,
+ <&clock CLK_MOUT_USER_MAU_EPLL>,
+ <&clock_audss EXYNOS_MOUT_AUDSS>,
+@@ -36,15 +35,13 @@
+ <&clock_audss EXYNOS_DOUT_AUD_BUS>,
+ <&clock_audss EXYNOS_DOUT_I2S>;
+
+- assigned-clock-parents = <&clock_audss EXYNOS_SCLK_I2S>,
+- <&clock CLK_FOUT_EPLL>,
++ assigned-clock-parents = <&clock CLK_FOUT_EPLL>,
+ <&clock CLK_MOUT_EPLL>,
+ <&clock CLK_MOUT_MAU_EPLL>,
+ <&clock CLK_MAU_EPLL>,
+ <&clock_audss EXYNOS_MOUT_AUDSS>;
+
+ assigned-clock-rates = <0>,
+- <0>,
+ <0>,
+ <0>,
+ <0>,
+@@ -84,4 +81,6 @@
+
+ &i2s0 {
+ status = "okay";
++ assigned-clocks = <&i2s0 CLK_I2S_RCLK_SRC>;
++ assigned-clock-parents = <&clock_audss EXYNOS_SCLK_I2S>;
+ };
+diff --git a/arch/arm/boot/dts/exynos5422-odroidxu4.dts b/arch/arm/boot/dts/exynos5422-odroidxu4.dts
+index 4a30cc849b00..122174ea9e0a 100644
+--- a/arch/arm/boot/dts/exynos5422-odroidxu4.dts
++++ b/arch/arm/boot/dts/exynos5422-odroidxu4.dts
+@@ -33,8 +33,7 @@
+ compatible = "samsung,odroid-xu3-audio";
+ model = "Odroid-XU4";
+
+- assigned-clocks = <&i2s0 CLK_I2S_RCLK_SRC>,
+- <&clock CLK_MOUT_EPLL>,
++ assigned-clocks = <&clock CLK_MOUT_EPLL>,
+ <&clock CLK_MOUT_MAU_EPLL>,
+ <&clock CLK_MOUT_USER_MAU_EPLL>,
+ <&clock_audss EXYNOS_MOUT_AUDSS>,
+@@ -43,15 +42,13 @@
+ <&clock_audss EXYNOS_DOUT_AUD_BUS>,
+ <&clock_audss EXYNOS_DOUT_I2S>;
+
+- assigned-clock-parents = <&clock_audss EXYNOS_SCLK_I2S>,
+- <&clock CLK_FOUT_EPLL>,
++ assigned-clock-parents = <&clock CLK_FOUT_EPLL>,
+ <&clock CLK_MOUT_EPLL>,
+ <&clock CLK_MOUT_MAU_EPLL>,
+ <&clock CLK_MAU_EPLL>,
+ <&clock_audss EXYNOS_MOUT_AUDSS>;
+
+ assigned-clock-rates = <0>,
+- <0>,
+ <0>,
+ <0>,
+ <0>,
+@@ -79,6 +76,8 @@
+
+ &i2s0 {
+ status = "okay";
++ assigned-clocks = <&i2s0 CLK_I2S_RCLK_SRC>;
++ assigned-clock-parents = <&clock_audss EXYNOS_SCLK_I2S>;
+ };
+
+ &pwm {
+diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
+index aa45df752a16..95e3fa7ded8b 100644
+--- a/arch/arm64/include/asm/kvm_arm.h
++++ b/arch/arm64/include/asm/kvm_arm.h
+@@ -104,7 +104,7 @@
+ TCR_EL2_ORGN0_MASK | TCR_EL2_IRGN0_MASK | TCR_EL2_T0SZ_MASK)
+
+ /* VTCR_EL2 Registers bits */
+-#define VTCR_EL2_RES1 (1 << 31)
++#define VTCR_EL2_RES1 (1U << 31)
+ #define VTCR_EL2_HD (1 << 22)
+ #define VTCR_EL2_HA (1 << 21)
+ #define VTCR_EL2_PS_MASK TCR_EL2_PS_MASK
+diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
+index e0d0f5b856e7..d52051879ffe 100644
+--- a/arch/arm64/include/asm/unistd.h
++++ b/arch/arm64/include/asm/unistd.h
+@@ -40,8 +40,9 @@
+ * The following SVCs are ARM private.
+ */
+ #define __ARM_NR_COMPAT_BASE 0x0f0000
+-#define __ARM_NR_compat_cacheflush (__ARM_NR_COMPAT_BASE+2)
+-#define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE+5)
++#define __ARM_NR_compat_cacheflush (__ARM_NR_COMPAT_BASE + 2)
++#define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE + 5)
++#define __ARM_NR_COMPAT_END (__ARM_NR_COMPAT_BASE + 0x800)
+
+ #define __NR_compat_syscalls 399
+ #endif
+diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
+index a6109825eeb9..7be666062c7c 100644
+--- a/arch/arm64/kernel/sys_compat.c
++++ b/arch/arm64/kernel/sys_compat.c
+@@ -102,12 +102,12 @@ long compat_arm_syscall(struct pt_regs *regs)
+
+ default:
+ /*
+- * Calls 9f00xx..9f07ff are defined to return -ENOSYS
++ * Calls 0xf0xxx..0xf07ff are defined to return -ENOSYS
+ * if not implemented, rather than raising SIGILL. This
+ * way the calling program can gracefully determine whether
+ * a feature is supported.
+ */
+- if ((no & 0xffff) <= 0x7ff)
++ if (no < __ARM_NR_COMPAT_END)
+ return -ENOSYS;
+ break;
+ }
+diff --git a/arch/arm64/kvm/hyp/tlb.c b/arch/arm64/kvm/hyp/tlb.c
+index 131c7772703c..c041eab3dce0 100644
+--- a/arch/arm64/kvm/hyp/tlb.c
++++ b/arch/arm64/kvm/hyp/tlb.c
+@@ -15,14 +15,19 @@
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
++#include <linux/irqflags.h>
++
+ #include <asm/kvm_hyp.h>
+ #include <asm/kvm_mmu.h>
+ #include <asm/tlbflush.h>
+
+-static void __hyp_text __tlb_switch_to_guest_vhe(struct kvm *kvm)
++static void __hyp_text __tlb_switch_to_guest_vhe(struct kvm *kvm,
++ unsigned long *flags)
+ {
+ u64 val;
+
++ local_irq_save(*flags);
++
+ /*
+ * With VHE enabled, we have HCR_EL2.{E2H,TGE} = {1,1}, and
+ * most TLB operations target EL2/EL0. In order to affect the
+@@ -37,7 +42,8 @@ static void __hyp_text __tlb_switch_to_guest_vhe(struct kvm *kvm)
+ isb();
+ }
+
+-static void __hyp_text __tlb_switch_to_guest_nvhe(struct kvm *kvm)
++static void __hyp_text __tlb_switch_to_guest_nvhe(struct kvm *kvm,
++ unsigned long *flags)
+ {
+ write_sysreg(kvm->arch.vttbr, vttbr_el2);
+ isb();
+@@ -48,7 +54,8 @@ static hyp_alternate_select(__tlb_switch_to_guest,
+ __tlb_switch_to_guest_vhe,
+ ARM64_HAS_VIRT_HOST_EXTN);
+
+-static void __hyp_text __tlb_switch_to_host_vhe(struct kvm *kvm)
++static void __hyp_text __tlb_switch_to_host_vhe(struct kvm *kvm,
++ unsigned long flags)
+ {
+ /*
+ * We're done with the TLB operation, let's restore the host's
+@@ -56,9 +63,12 @@ static void __hyp_text __tlb_switch_to_host_vhe(struct kvm *kvm)
+ */
+ write_sysreg(0, vttbr_el2);
+ write_sysreg(HCR_HOST_VHE_FLAGS, hcr_el2);
++ isb();
++ local_irq_restore(flags);
+ }
+
+-static void __hyp_text __tlb_switch_to_host_nvhe(struct kvm *kvm)
++static void __hyp_text __tlb_switch_to_host_nvhe(struct kvm *kvm,
++ unsigned long flags)
+ {
+ write_sysreg(0, vttbr_el2);
+ }
+@@ -70,11 +80,13 @@ static hyp_alternate_select(__tlb_switch_to_host,
+
+ void __hyp_text __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
+ {
++ unsigned long flags;
++
+ dsb(ishst);
+
+ /* Switch to requested VMID */
+ kvm = kern_hyp_va(kvm);
+- __tlb_switch_to_guest()(kvm);
++ __tlb_switch_to_guest()(kvm, &flags);
+
+ /*
+ * We could do so much better if we had the VA as well.
+@@ -117,36 +129,39 @@ void __hyp_text __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
+ if (!has_vhe() && icache_is_vpipt())
+ __flush_icache_all();
+
+- __tlb_switch_to_host()(kvm);
++ __tlb_switch_to_host()(kvm, flags);
+ }
+
+ void __hyp_text __kvm_tlb_flush_vmid(struct kvm *kvm)
+ {
++ unsigned long flags;
++
+ dsb(ishst);
+
+ /* Switch to requested VMID */
+ kvm = kern_hyp_va(kvm);
+- __tlb_switch_to_guest()(kvm);
++ __tlb_switch_to_guest()(kvm, &flags);
+
+ __tlbi(vmalls12e1is);
+ dsb(ish);
+ isb();
+
+- __tlb_switch_to_host()(kvm);
++ __tlb_switch_to_host()(kvm, flags);
+ }
+
+ void __hyp_text __kvm_tlb_flush_local_vmid(struct kvm_vcpu *vcpu)
+ {
+ struct kvm *kvm = kern_hyp_va(kern_hyp_va(vcpu)->kvm);
++ unsigned long flags;
+
+ /* Switch to requested VMID */
+- __tlb_switch_to_guest()(kvm);
++ __tlb_switch_to_guest()(kvm, &flags);
+
+ __tlbi(vmalle1);
+ dsb(nsh);
+ isb();
+
+- __tlb_switch_to_host()(kvm);
++ __tlb_switch_to_host()(kvm, flags);
+ }
+
+ void __hyp_text __kvm_flush_vm_context(void)
+diff --git a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
+index 37fe58c19a90..542c3ede9722 100644
+--- a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
++++ b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
+@@ -13,6 +13,7 @@
+ #include <stdint.h>
+ #include <stdio.h>
+ #include <stdlib.h>
++#include "../../../../include/linux/sizes.h"
+
+ int main(int argc, char *argv[])
+ {
+@@ -45,11 +46,11 @@ int main(int argc, char *argv[])
+ vmlinuz_load_addr = vmlinux_load_addr + vmlinux_size;
+
+ /*
+- * Align with 16 bytes: "greater than that used for any standard data
+- * types by a MIPS compiler." -- See MIPS Run Linux (Second Edition).
++ * Align with 64KB: KEXEC needs load sections to be aligned to PAGE_SIZE,
++ * which may be as large as 64KB depending on the kernel configuration.
+ */
+
+- vmlinuz_load_addr += (16 - vmlinux_size % 16);
++ vmlinuz_load_addr += (SZ_64K - vmlinux_size % SZ_64K);
+
+ printf("0x%llx\n", vmlinuz_load_addr);
+
+diff --git a/arch/mips/cavium-octeon/executive/cvmx-helper.c b/arch/mips/cavium-octeon/executive/cvmx-helper.c
+index 6c79e8a16a26..3ddbb98dff84 100644
+--- a/arch/mips/cavium-octeon/executive/cvmx-helper.c
++++ b/arch/mips/cavium-octeon/executive/cvmx-helper.c
+@@ -286,7 +286,8 @@ static cvmx_helper_interface_mode_t __cvmx_get_mode_cn7xxx(int interface)
+ case 3:
+ return CVMX_HELPER_INTERFACE_MODE_LOOP;
+ case 4:
+- return CVMX_HELPER_INTERFACE_MODE_RGMII;
++ /* TODO: Implement support for AGL (RGMII). */
++ return CVMX_HELPER_INTERFACE_MODE_DISABLED;
+ default:
+ return CVMX_HELPER_INTERFACE_MODE_DISABLED;
+ }
+diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
+index d4ea7a5b60cf..9e805317847d 100644
+--- a/arch/mips/include/asm/atomic.h
++++ b/arch/mips/include/asm/atomic.h
+@@ -306,7 +306,7 @@ static __inline__ long atomic64_fetch_##op##_relaxed(long i, atomic64_t * v) \
+ { \
+ long result; \
+ \
+- if (kernel_uses_llsc && R10000_LLSC_WAR) { \
++ if (kernel_uses_llsc) { \
+ long temp; \
+ \
+ __asm__ __volatile__( \
+diff --git a/arch/mips/include/asm/cpu-info.h b/arch/mips/include/asm/cpu-info.h
+index a41059d47d31..ed7ffe4e63a3 100644
+--- a/arch/mips/include/asm/cpu-info.h
++++ b/arch/mips/include/asm/cpu-info.h
+@@ -50,7 +50,7 @@ struct guest_info {
+ #define MIPS_CACHE_PINDEX 0x00000020 /* Physically indexed cache */
+
+ struct cpuinfo_mips {
+- unsigned long asid_cache;
++ u64 asid_cache;
+ #ifdef CONFIG_MIPS_ASID_BITS_VARIABLE
+ unsigned long asid_mask;
+ #endif
+diff --git a/arch/mips/include/asm/mach-loongson64/mmzone.h b/arch/mips/include/asm/mach-loongson64/mmzone.h
+index c9f7e231e66b..59c8b11c090e 100644
+--- a/arch/mips/include/asm/mach-loongson64/mmzone.h
++++ b/arch/mips/include/asm/mach-loongson64/mmzone.h
+@@ -21,6 +21,7 @@
+ #define NODE3_ADDRSPACE_OFFSET 0x300000000000UL
+
+ #define pa_to_nid(addr) (((addr) & 0xf00000000000) >> NODE_ADDRSPACE_SHIFT)
++#define nid_to_addrbase(nid) ((nid) << NODE_ADDRSPACE_SHIFT)
+
+ #define LEVELS_PER_SLICE 128
+
+diff --git a/arch/mips/include/asm/mmu.h b/arch/mips/include/asm/mmu.h
+index 0740be7d5d4a..24d6b42345fb 100644
+--- a/arch/mips/include/asm/mmu.h
++++ b/arch/mips/include/asm/mmu.h
+@@ -7,7 +7,7 @@
+ #include <linux/wait.h>
+
+ typedef struct {
+- unsigned long asid[NR_CPUS];
++ u64 asid[NR_CPUS];
+ void *vdso;
+ atomic_t fp_mode_switching;
+
+diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
+index 94414561de0e..a589585be21b 100644
+--- a/arch/mips/include/asm/mmu_context.h
++++ b/arch/mips/include/asm/mmu_context.h
+@@ -76,14 +76,14 @@ extern unsigned long pgd_current[];
+ * All unused by hardware upper bits will be considered
+ * as a software asid extension.
+ */
+-static unsigned long asid_version_mask(unsigned int cpu)
++static inline u64 asid_version_mask(unsigned int cpu)
+ {
+ unsigned long asid_mask = cpu_asid_mask(&cpu_data[cpu]);
+
+- return ~(asid_mask | (asid_mask - 1));
++ return ~(u64)(asid_mask | (asid_mask - 1));
+ }
+
+-static unsigned long asid_first_version(unsigned int cpu)
++static inline u64 asid_first_version(unsigned int cpu)
+ {
+ return ~asid_version_mask(cpu) + 1;
+ }
+@@ -102,14 +102,12 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
+ static inline void
+ get_new_mmu_context(struct mm_struct *mm, unsigned long cpu)
+ {
+- unsigned long asid = asid_cache(cpu);
++ u64 asid = asid_cache(cpu);
+
+ if (!((asid += cpu_asid_inc()) & cpu_asid_mask(&cpu_data[cpu]))) {
+ if (cpu_has_vtag_icache)
+ flush_icache_all();
+ local_flush_tlb_all(); /* start new asid cycle */
+- if (!asid) /* fix version if needed */
+- asid = asid_first_version(cpu);
+ }
+
+ cpu_context(cpu, mm) = asid_cache(cpu) = asid;
+diff --git a/arch/mips/include/asm/mmzone.h b/arch/mips/include/asm/mmzone.h
+index f085fba41da5..b826b8473e95 100644
+--- a/arch/mips/include/asm/mmzone.h
++++ b/arch/mips/include/asm/mmzone.h
+@@ -7,7 +7,18 @@
+ #define _ASM_MMZONE_H_
+
+ #include <asm/page.h>
+-#include <mmzone.h>
++
++#ifdef CONFIG_NEED_MULTIPLE_NODES
++# include <mmzone.h>
++#endif
++
++#ifndef pa_to_nid
++#define pa_to_nid(addr) 0
++#endif
++
++#ifndef nid_to_addrbase
++#define nid_to_addrbase(nid) 0
++#endif
+
+ #ifdef CONFIG_DISCONTIGMEM
+
+diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h
+index 0036ea0c7173..93a9dce31f25 100644
+--- a/arch/mips/include/asm/pgtable-64.h
++++ b/arch/mips/include/asm/pgtable-64.h
+@@ -265,6 +265,11 @@ static inline int pmd_bad(pmd_t pmd)
+
+ static inline int pmd_present(pmd_t pmd)
+ {
++#ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
++ if (unlikely(pmd_val(pmd) & _PAGE_HUGE))
++ return pmd_val(pmd) & _PAGE_PRESENT;
++#endif
++
+ return pmd_val(pmd) != (unsigned long) invalid_pte_table;
+ }
+
+diff --git a/arch/mips/include/asm/r4kcache.h b/arch/mips/include/asm/r4kcache.h
+index 7f12d7e27c94..e5190126080e 100644
+--- a/arch/mips/include/asm/r4kcache.h
++++ b/arch/mips/include/asm/r4kcache.h
+@@ -20,6 +20,7 @@
+ #include <asm/cpu-features.h>
+ #include <asm/cpu-type.h>
+ #include <asm/mipsmtregs.h>
++#include <asm/mmzone.h>
+ #include <linux/uaccess.h> /* for uaccess_kernel() */
+
+ extern void (*r4k_blast_dcache)(void);
+@@ -747,4 +748,25 @@ __BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, , )
+ __BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, , )
+ __BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD, , )
+
++/* Currently, this is very specific to Loongson-3 */
++#define __BUILD_BLAST_CACHE_NODE(pfx, desc, indexop, hitop, lsize) \
++static inline void blast_##pfx##cache##lsize##_node(long node) \
++{ \
++ unsigned long start = CAC_BASE | nid_to_addrbase(node); \
++ unsigned long end = start + current_cpu_data.desc.waysize; \
++ unsigned long ws_inc = 1UL << current_cpu_data.desc.waybit; \
++ unsigned long ws_end = current_cpu_data.desc.ways << \
++ current_cpu_data.desc.waybit; \
++ unsigned long ws, addr; \
++ \
++ for (ws = 0; ws < ws_end; ws += ws_inc) \
++ for (addr = start; addr < end; addr += lsize * 32) \
++ cache##lsize##_unroll32(addr|ws, indexop); \
++}
++
++__BUILD_BLAST_CACHE_NODE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16)
++__BUILD_BLAST_CACHE_NODE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32)
++__BUILD_BLAST_CACHE_NODE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64)
++__BUILD_BLAST_CACHE_NODE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128)
++
+ #endif /* _ASM_R4KCACHE_H */
+diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c
+index 48a9c6b90e07..9df3ebdc7b0f 100644
+--- a/arch/mips/kernel/vdso.c
++++ b/arch/mips/kernel/vdso.c
+@@ -126,8 +126,8 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+
+ /* Map delay slot emulation page */
+ base = mmap_region(NULL, STACK_TOP, PAGE_SIZE,
+- VM_READ|VM_WRITE|VM_EXEC|
+- VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
++ VM_READ | VM_EXEC |
++ VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
+ 0, NULL);
+ if (IS_ERR_VALUE(base)) {
+ ret = base;
+diff --git a/arch/mips/math-emu/dsemul.c b/arch/mips/math-emu/dsemul.c
+index 5450f4d1c920..e2d46cb93ca9 100644
+--- a/arch/mips/math-emu/dsemul.c
++++ b/arch/mips/math-emu/dsemul.c
+@@ -214,8 +214,9 @@ int mips_dsemul(struct pt_regs *regs, mips_instruction ir,
+ {
+ int isa16 = get_isa16_mode(regs->cp0_epc);
+ mips_instruction break_math;
+- struct emuframe __user *fr;
+- int err, fr_idx;
++ unsigned long fr_uaddr;
++ struct emuframe fr;
++ int fr_idx, ret;
+
+ /* NOP is easy */
+ if (ir == 0)
+@@ -250,27 +251,31 @@ int mips_dsemul(struct pt_regs *regs, mips_instruction ir,
+ fr_idx = alloc_emuframe();
+ if (fr_idx == BD_EMUFRAME_NONE)
+ return SIGBUS;
+- fr = &dsemul_page()[fr_idx];
+
+ /* Retrieve the appropriately encoded break instruction */
+ break_math = BREAK_MATH(isa16);
+
+ /* Write the instructions to the frame */
+ if (isa16) {
+- err = __put_user(ir >> 16,
+- (u16 __user *)(&fr->emul));
+- err |= __put_user(ir & 0xffff,
+- (u16 __user *)((long)(&fr->emul) + 2));
+- err |= __put_user(break_math >> 16,
+- (u16 __user *)(&fr->badinst));
+- err |= __put_user(break_math & 0xffff,
+- (u16 __user *)((long)(&fr->badinst) + 2));
++ union mips_instruction _emul = {
++ .halfword = { ir >> 16, ir }
++ };
++ union mips_instruction _badinst = {
++ .halfword = { break_math >> 16, break_math }
++ };
++
++ fr.emul = _emul.word;
++ fr.badinst = _badinst.word;
+ } else {
+- err = __put_user(ir, &fr->emul);
+- err |= __put_user(break_math, &fr->badinst);
++ fr.emul = ir;
++ fr.badinst = break_math;
+ }
+
+- if (unlikely(err)) {
++ /* Write the frame to user memory */
++ fr_uaddr = (unsigned long)&dsemul_page()[fr_idx];
++ ret = access_process_vm(current, fr_uaddr, &fr, sizeof(fr),
++ FOLL_FORCE | FOLL_WRITE);
++ if (unlikely(ret != sizeof(fr))) {
+ MIPS_FPU_EMU_INC_STATS(errors);
+ free_emuframe(fr_idx, current->mm);
+ return SIGBUS;
+@@ -282,10 +287,7 @@ int mips_dsemul(struct pt_regs *regs, mips_instruction ir,
+ atomic_set(¤t->thread.bd_emu_frame, fr_idx);
+
+ /* Change user register context to execute the frame */
+- regs->cp0_epc = (unsigned long)&fr->emul | isa16;
+-
+- /* Ensure the icache observes our newly written frame */
+- flush_cache_sigtramp((unsigned long)&fr->emul);
++ regs->cp0_epc = fr_uaddr | isa16;
+
+ return 0;
+ }
+diff --git a/arch/mips/mm/c-r3k.c b/arch/mips/mm/c-r3k.c
+index 3466fcdae0ca..01848cdf2074 100644
+--- a/arch/mips/mm/c-r3k.c
++++ b/arch/mips/mm/c-r3k.c
+@@ -245,7 +245,7 @@ static void r3k_flush_cache_page(struct vm_area_struct *vma,
+ pmd_t *pmdp;
+ pte_t *ptep;
+
+- pr_debug("cpage[%08lx,%08lx]\n",
++ pr_debug("cpage[%08llx,%08lx]\n",
+ cpu_context(smp_processor_id(), mm), addr);
+
+ /* No ASID => no such page in the cache. */
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index a9ef057c79fe..05a539d3a597 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -459,11 +459,28 @@ static void r4k_blast_scache_setup(void)
+ r4k_blast_scache = blast_scache128;
+ }
+
++static void (*r4k_blast_scache_node)(long node);
++
++static void r4k_blast_scache_node_setup(void)
++{
++ unsigned long sc_lsize = cpu_scache_line_size();
++
++ if (current_cpu_type() != CPU_LOONGSON3)
++ r4k_blast_scache_node = (void *)cache_noop;
++ else if (sc_lsize == 16)
++ r4k_blast_scache_node = blast_scache16_node;
++ else if (sc_lsize == 32)
++ r4k_blast_scache_node = blast_scache32_node;
++ else if (sc_lsize == 64)
++ r4k_blast_scache_node = blast_scache64_node;
++ else if (sc_lsize == 128)
++ r4k_blast_scache_node = blast_scache128_node;
++}
++
+ static inline void local_r4k___flush_cache_all(void * args)
+ {
+ switch (current_cpu_type()) {
+ case CPU_LOONGSON2:
+- case CPU_LOONGSON3:
+ case CPU_R4000SC:
+ case CPU_R4000MC:
+ case CPU_R4400SC:
+@@ -480,6 +497,11 @@ static inline void local_r4k___flush_cache_all(void * args)
+ r4k_blast_scache();
+ break;
+
++ case CPU_LOONGSON3:
++ /* Use get_ebase_cpunum() for both NUMA=y/n */
++ r4k_blast_scache_node(get_ebase_cpunum() >> 2);
++ break;
++
+ case CPU_BMIPS5000:
+ r4k_blast_scache();
+ __sync();
+@@ -840,10 +862,14 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
+
+ preempt_disable();
+ if (cpu_has_inclusive_pcaches) {
+- if (size >= scache_size)
+- r4k_blast_scache();
+- else
++ if (size >= scache_size) {
++ if (current_cpu_type() != CPU_LOONGSON3)
++ r4k_blast_scache();
++ else
++ r4k_blast_scache_node(pa_to_nid(addr));
++ } else {
+ blast_scache_range(addr, addr + size);
++ }
+ preempt_enable();
+ __sync();
+ return;
+@@ -877,9 +903,12 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
+
+ preempt_disable();
+ if (cpu_has_inclusive_pcaches) {
+- if (size >= scache_size)
+- r4k_blast_scache();
+- else {
++ if (size >= scache_size) {
++ if (current_cpu_type() != CPU_LOONGSON3)
++ r4k_blast_scache();
++ else
++ r4k_blast_scache_node(pa_to_nid(addr));
++ } else {
+ /*
+ * There is no clearly documented alignment requirement
+ * for the cache instruction on MIPS processors and
+@@ -1918,6 +1947,7 @@ void r4k_cache_init(void)
+ r4k_blast_scache_page_setup();
+ r4k_blast_scache_page_indexed_setup();
+ r4k_blast_scache_setup();
++ r4k_blast_scache_node_setup();
+ #ifdef CONFIG_EVA
+ r4k_blast_dcache_user_page_setup();
+ r4k_blast_icache_user_page_setup();
+diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
+index f6f469fc4073..1b395b85132b 100644
+--- a/arch/powerpc/kernel/security.c
++++ b/arch/powerpc/kernel/security.c
+@@ -22,7 +22,7 @@ enum count_cache_flush_type {
+ COUNT_CACHE_FLUSH_SW = 0x2,
+ COUNT_CACHE_FLUSH_HW = 0x4,
+ };
+-static enum count_cache_flush_type count_cache_flush_type;
++static enum count_cache_flush_type count_cache_flush_type = COUNT_CACHE_FLUSH_NONE;
+
+ bool barrier_nospec_enabled;
+ static bool no_nospec;
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index e6474a45cef5..6327fd79b0fb 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -1140,11 +1140,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ {
+ struct rt_sigframe __user *rt_sf;
+ struct pt_regs *regs = current_pt_regs();
++ int tm_restore = 0;
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ struct ucontext __user *uc_transact;
+ unsigned long msr_hi;
+ unsigned long tmp;
+- int tm_restore = 0;
+ #endif
+ /* Always make any pending restarted system calls return -EINTR */
+ current->restart_block.fn = do_no_restart_syscall;
+@@ -1192,11 +1192,19 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ goto bad;
+ }
+ }
+- if (!tm_restore)
+- /* Fall through, for non-TM restore */
++ if (!tm_restore) {
++ /*
++ * Unset regs->msr because ucontext MSR TS is not
++ * set, and recheckpoint was not called. This avoid
++ * hitting a TM Bad thing at RFID
++ */
++ regs->msr &= ~MSR_TS_MASK;
++ }
++ /* Fall through, for non-TM restore */
+ #endif
+- if (do_setcontext(&rt_sf->uc, regs, 1))
+- goto bad;
++ if (!tm_restore)
++ if (do_setcontext(&rt_sf->uc, regs, 1))
++ goto bad;
+
+ /*
+ * It's not clear whether or why it is desirable to save the
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
+index 83d51bf586c7..daa28cb72272 100644
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -740,11 +740,23 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ &uc_transact->uc_mcontext))
+ goto badframe;
+ }
+- else
+- /* Fall through, for non-TM restore */
+ #endif
+- if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
+- goto badframe;
++ /* Fall through, for non-TM restore */
++ if (!MSR_TM_ACTIVE(msr)) {
++ /*
++ * Unset MSR[TS] on the thread regs since MSR from user
++ * context does not have MSR active, and recheckpoint was
++ * not called since restore_tm_sigcontexts() was not called
++ * also.
++ *
++ * If not unsetting it, the code can RFID to userspace with
++ * MSR[TS] set, but without CPU in the proper state,
++ * causing a TM bad thing.
++ */
++ current->thread.regs->msr &= ~MSR_TS_MASK;
++ if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
++ goto badframe;
++ }
+
+ if (restore_altstack(&uc->uc_stack))
+ goto badframe;
+diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
+index 19b2d2a9b43d..eeb7450db18c 100644
+--- a/arch/s390/pci/pci_clp.c
++++ b/arch/s390/pci/pci_clp.c
+@@ -436,7 +436,7 @@ int clp_get_state(u32 fid, enum zpci_state *state)
+ struct clp_state_data sd = {fid, ZPCI_FN_STATE_RESERVED};
+ int rc;
+
+- rrb = clp_alloc_block(GFP_KERNEL);
++ rrb = clp_alloc_block(GFP_ATOMIC);
+ if (!rrb)
+ return -ENOMEM;
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 022845ee0c88..728dc661ebb6 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1441,7 +1441,7 @@ asmlinkage void kvm_spurious_fault(void);
+ "cmpb $0, kvm_rebooting \n\t" \
+ "jne 668b \n\t" \
+ __ASM_SIZE(push) " $666b \n\t" \
+- "call kvm_spurious_fault \n\t" \
++ "jmp kvm_spurious_fault \n\t" \
+ ".popsection \n\t" \
+ _ASM_EXTABLE(666b, 667b)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 78928f56cf72..abb92c341693 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -1000,7 +1000,8 @@ static void __init l1tf_select_mitigation(void)
+ #endif
+
+ half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT;
+- if (e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
++ if (l1tf_mitigation != L1TF_MITIGATION_OFF &&
++ e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) {
+ pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n");
+ pr_info("You may make it effective by booting the kernel with mem=%llu parameter.\n",
+ half_pa);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 33ffb6d17e73..841740045554 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -8011,13 +8011,16 @@ static __init int hardware_setup(void)
+
+ kvm_mce_cap_supported |= MCG_LMCE_P;
+
+- return alloc_kvm_area();
++ r = alloc_kvm_area();
++ if (r)
++ goto out;
++ return 0;
+
+ out:
+ for (i = 0; i < VMX_BITMAP_NR; i++)
+ free_page((unsigned long)vmx_bitmap[i]);
+
+- return r;
++ return r;
+ }
+
+ static __exit void hardware_unsetup(void)
+diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
+index faca978ebf9d..d883869437b5 100644
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -932,7 +932,7 @@ unsigned long max_swapfile_size(void)
+
+ pages = generic_max_swapfile_size();
+
+- if (boot_cpu_has_bug(X86_BUG_L1TF)) {
++ if (boot_cpu_has_bug(X86_BUG_L1TF) && l1tf_mitigation != L1TF_MITIGATION_OFF) {
+ /* Limit the swap file size to MAX_PA/2 for L1TF workaround */
+ unsigned long long l1tf_limit = l1tf_pfn_limit();
+ /*
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index dd519f372169..a3e9c6ee3cf2 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -585,7 +585,6 @@ phys_pud_init(pud_t *pud_page, unsigned long paddr, unsigned long paddr_end,
+ paddr_end,
+ page_size_mask,
+ prot);
+- __flush_tlb_all();
+ continue;
+ }
+ /*
+@@ -628,7 +627,6 @@ phys_pud_init(pud_t *pud_page, unsigned long paddr, unsigned long paddr_end,
+ pud_populate(&init_mm, pud, pmd);
+ spin_unlock(&init_mm.page_table_lock);
+ }
+- __flush_tlb_all();
+
+ update_page_count(PG_LEVEL_1G, pages);
+
+@@ -669,7 +667,6 @@ phys_p4d_init(p4d_t *p4d_page, unsigned long paddr, unsigned long paddr_end,
+ paddr_last = phys_pud_init(pud, paddr,
+ paddr_end,
+ page_size_mask);
+- __flush_tlb_all();
+ continue;
+ }
+
+@@ -681,7 +678,6 @@ phys_p4d_init(p4d_t *p4d_page, unsigned long paddr, unsigned long paddr_end,
+ p4d_populate(&init_mm, p4d, pud);
+ spin_unlock(&init_mm.page_table_lock);
+ }
+- __flush_tlb_all();
+
+ return paddr_last;
+ }
+@@ -734,8 +730,6 @@ kernel_physical_mapping_init(unsigned long paddr_start,
+ if (pgd_changed)
+ sync_global_pgds(vaddr_start, vaddr_end - 1);
+
+- __flush_tlb_all();
+-
+ return paddr_last;
+ }
+
+diff --git a/crypto/cfb.c b/crypto/cfb.c
+index 20987d0e09d8..e81e45673498 100644
+--- a/crypto/cfb.c
++++ b/crypto/cfb.c
+@@ -144,7 +144,7 @@ static int crypto_cfb_decrypt_segment(struct skcipher_walk *walk,
+
+ do {
+ crypto_cfb_encrypt_one(tfm, iv, dst);
+- crypto_xor(dst, iv, bsize);
++ crypto_xor(dst, src, bsize);
+ iv = src;
+
+ src += bsize;
+diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
+index 6e0a054bb61d..d332988eb8de 100644
+--- a/crypto/tcrypt.c
++++ b/crypto/tcrypt.c
+@@ -1736,6 +1736,7 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
+ ret += tcrypt_test("xts(aes)");
+ ret += tcrypt_test("ctr(aes)");
+ ret += tcrypt_test("rfc3686(ctr(aes))");
++ ret += tcrypt_test("cfb(aes)");
+ break;
+
+ case 11:
+@@ -2062,6 +2063,10 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
+ speed_template_16_24_32);
+ test_cipher_speed("ctr(aes)", DECRYPT, sec, NULL, 0,
+ speed_template_16_24_32);
++ test_cipher_speed("cfb(aes)", ENCRYPT, sec, NULL, 0,
++ speed_template_16_24_32);
++ test_cipher_speed("cfb(aes)", DECRYPT, sec, NULL, 0,
++ speed_template_16_24_32);
+ break;
+
+ case 201:
+diff --git a/crypto/testmgr.c b/crypto/testmgr.c
+index 1c9bf38e59ea..54d882ffe438 100644
+--- a/crypto/testmgr.c
++++ b/crypto/testmgr.c
+@@ -2684,6 +2684,13 @@ static const struct alg_test_desc alg_test_descs[] = {
+ .dec = __VECS(aes_ccm_dec_tv_template)
+ }
+ }
++ }, {
++ .alg = "cfb(aes)",
++ .test = alg_test_skcipher,
++ .fips_allowed = 1,
++ .suite = {
++ .cipher = __VECS(aes_cfb_tv_template)
++ },
+ }, {
+ .alg = "chacha20",
+ .test = alg_test_skcipher,
+diff --git a/crypto/testmgr.h b/crypto/testmgr.h
+index 0b3d7cadbe93..11e6f17fe724 100644
+--- a/crypto/testmgr.h
++++ b/crypto/testmgr.h
+@@ -11343,6 +11343,82 @@ static const struct cipher_testvec aes_cbc_tv_template[] = {
+ },
+ };
+
++static const struct cipher_testvec aes_cfb_tv_template[] = {
++ { /* From NIST SP800-38A */
++ .key = "\x2b\x7e\x15\x16\x28\xae\xd2\xa6"
++ "\xab\xf7\x15\x88\x09\xcf\x4f\x3c",
++ .klen = 16,
++ .iv = "\x00\x01\x02\x03\x04\x05\x06\x07"
++ "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
++ .ptext = "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96"
++ "\xe9\x3d\x7e\x11\x73\x93\x17\x2a"
++ "\xae\x2d\x8a\x57\x1e\x03\xac\x9c"
++ "\x9e\xb7\x6f\xac\x45\xaf\x8e\x51"
++ "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11"
++ "\xe5\xfb\xc1\x19\x1a\x0a\x52\xef"
++ "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17"
++ "\xad\x2b\x41\x7b\xe6\x6c\x37\x10",
++ .ctext = "\x3b\x3f\xd9\x2e\xb7\x2d\xad\x20"
++ "\x33\x34\x49\xf8\xe8\x3c\xfb\x4a"
++ "\xc8\xa6\x45\x37\xa0\xb3\xa9\x3f"
++ "\xcd\xe3\xcd\xad\x9f\x1c\xe5\x8b"
++ "\x26\x75\x1f\x67\xa3\xcb\xb1\x40"
++ "\xb1\x80\x8c\xf1\x87\xa4\xf4\xdf"
++ "\xc0\x4b\x05\x35\x7c\x5d\x1c\x0e"
++ "\xea\xc4\xc6\x6f\x9f\xf7\xf2\xe6",
++ .len = 64,
++ }, {
++ .key = "\x8e\x73\xb0\xf7\xda\x0e\x64\x52"
++ "\xc8\x10\xf3\x2b\x80\x90\x79\xe5"
++ "\x62\xf8\xea\xd2\x52\x2c\x6b\x7b",
++ .klen = 24,
++ .iv = "\x00\x01\x02\x03\x04\x05\x06\x07"
++ "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
++ .ptext = "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96"
++ "\xe9\x3d\x7e\x11\x73\x93\x17\x2a"
++ "\xae\x2d\x8a\x57\x1e\x03\xac\x9c"
++ "\x9e\xb7\x6f\xac\x45\xaf\x8e\x51"
++ "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11"
++ "\xe5\xfb\xc1\x19\x1a\x0a\x52\xef"
++ "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17"
++ "\xad\x2b\x41\x7b\xe6\x6c\x37\x10",
++ .ctext = "\xcd\xc8\x0d\x6f\xdd\xf1\x8c\xab"
++ "\x34\xc2\x59\x09\xc9\x9a\x41\x74"
++ "\x67\xce\x7f\x7f\x81\x17\x36\x21"
++ "\x96\x1a\x2b\x70\x17\x1d\x3d\x7a"
++ "\x2e\x1e\x8a\x1d\xd5\x9b\x88\xb1"
++ "\xc8\xe6\x0f\xed\x1e\xfa\xc4\xc9"
++ "\xc0\x5f\x9f\x9c\xa9\x83\x4f\xa0"
++ "\x42\xae\x8f\xba\x58\x4b\x09\xff",
++ .len = 64,
++ }, {
++ .key = "\x60\x3d\xeb\x10\x15\xca\x71\xbe"
++ "\x2b\x73\xae\xf0\x85\x7d\x77\x81"
++ "\x1f\x35\x2c\x07\x3b\x61\x08\xd7"
++ "\x2d\x98\x10\xa3\x09\x14\xdf\xf4",
++ .klen = 32,
++ .iv = "\x00\x01\x02\x03\x04\x05\x06\x07"
++ "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
++ .ptext = "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96"
++ "\xe9\x3d\x7e\x11\x73\x93\x17\x2a"
++ "\xae\x2d\x8a\x57\x1e\x03\xac\x9c"
++ "\x9e\xb7\x6f\xac\x45\xaf\x8e\x51"
++ "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11"
++ "\xe5\xfb\xc1\x19\x1a\x0a\x52\xef"
++ "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17"
++ "\xad\x2b\x41\x7b\xe6\x6c\x37\x10",
++ .ctext = "\xdc\x7e\x84\xbf\xda\x79\x16\x4b"
++ "\x7e\xcd\x84\x86\x98\x5d\x38\x60"
++ "\x39\xff\xed\x14\x3b\x28\xb1\xc8"
++ "\x32\x11\x3c\x63\x31\xe5\x40\x7b"
++ "\xdf\x10\x13\x24\x15\xe5\x4b\x92"
++ "\xa1\x3e\xd0\xa8\x26\x7a\xe2\xf9"
++ "\x75\xa3\x85\x74\x1a\xb9\xce\xf8"
++ "\x20\x31\x62\x3d\x55\xb1\xe4\x71",
++ .len = 64,
++ },
++};
++
+ static const struct aead_testvec hmac_md5_ecb_cipher_null_enc_tv_template[] = {
+ { /* Input data from RFC 2410 Case 1 */
+ #ifdef __LITTLE_ENDIAN
+diff --git a/drivers/base/platform-msi.c b/drivers/base/platform-msi.c
+index 60d6cc618f1c..6d54905c6263 100644
+--- a/drivers/base/platform-msi.c
++++ b/drivers/base/platform-msi.c
+@@ -366,14 +366,16 @@ void platform_msi_domain_free(struct irq_domain *domain, unsigned int virq,
+ unsigned int nvec)
+ {
+ struct platform_msi_priv_data *data = domain->host_data;
+- struct msi_desc *desc;
+- for_each_msi_entry(desc, data->dev) {
++ struct msi_desc *desc, *tmp;
++ for_each_msi_entry_safe(desc, tmp, data->dev) {
+ if (WARN_ON(!desc->irq || desc->nvec_used != 1))
+ return;
+ if (!(desc->irq >= virq && desc->irq < (virq + nvec)))
+ continue;
+
+ irq_domain_free_irqs_common(domain, desc->irq, 1);
++ list_del(&desc->list);
++ free_msi_entry(desc);
+ }
+ }
+
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 7d958ff426e0..1010cb79dcc6 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -477,13 +477,15 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip,
+
+ if (need_locality) {
+ rc = tpm_request_locality(chip, flags);
+- if (rc < 0)
+- goto out_no_locality;
++ if (rc < 0) {
++ need_locality = false;
++ goto out_locality;
++ }
+ }
+
+ rc = tpm_cmd_ready(chip, flags);
+ if (rc)
+- goto out;
++ goto out_locality;
+
+ rc = tpm2_prepare_space(chip, space, ordinal, buf);
+ if (rc)
+@@ -547,14 +549,13 @@ out_recv:
+ dev_err(&chip->dev, "tpm2_commit_space: error %d\n", rc);
+
+ out:
+- rc = tpm_go_idle(chip, flags);
+- if (rc)
+- goto out;
++ /* may fail but do not override previous error value in rc */
++ tpm_go_idle(chip, flags);
+
++out_locality:
+ if (need_locality)
+ tpm_relinquish_locality(chip, flags);
+
+-out_no_locality:
+ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, false);
+
+diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c
+index caa86b19c76d..f74f451baf6a 100644
+--- a/drivers/char/tpm/tpm_i2c_nuvoton.c
++++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
+@@ -369,6 +369,7 @@ static int i2c_nuvoton_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ struct device *dev = chip->dev.parent;
+ struct i2c_client *client = to_i2c_client(dev);
+ u32 ordinal;
++ unsigned long duration;
+ size_t count = 0;
+ int burst_count, bytes2write, retries, rc = -EIO;
+
+@@ -455,10 +456,12 @@ static int i2c_nuvoton_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ return rc;
+ }
+ ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
+- rc = i2c_nuvoton_wait_for_data_avail(chip,
+- tpm_calc_ordinal_duration(chip,
+- ordinal),
+- &priv->read_queue);
++ if (chip->flags & TPM_CHIP_FLAG_TPM2)
++ duration = tpm2_calc_ordinal_duration(chip, ordinal);
++ else
++ duration = tpm_calc_ordinal_duration(chip, ordinal);
++
++ rc = i2c_nuvoton_wait_for_data_avail(chip, duration, &priv->read_queue);
+ if (rc) {
+ dev_err(dev, "%s() timeout command duration\n", __func__);
+ i2c_nuvoton_ready(chip);
+diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
+index 67e73fd71f09..69fb3afc970f 100644
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -382,7 +382,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
+ COMPOSITE_NOMUX(0, "spdif_pre", "i2s_src", 0,
+ RK2928_CLKSEL_CON(5), 0, 7, DFLAGS,
+ RK2928_CLKGATE_CON(0), 13, GFLAGS),
+- COMPOSITE_FRACMUX(0, "spdif_frac", "spdif_pll", CLK_SET_RATE_PARENT,
++ COMPOSITE_FRACMUX(0, "spdif_frac", "spdif_pre", CLK_SET_RATE_PARENT,
+ RK2928_CLKSEL_CON(9), 0,
+ RK2928_CLKGATE_CON(0), 14, GFLAGS,
+ &common_spdif_fracmux),
+diff --git a/drivers/clk/sunxi-ng/ccu_nm.c b/drivers/clk/sunxi-ng/ccu_nm.c
+index 4e2073307f34..9e3944f868ff 100644
+--- a/drivers/clk/sunxi-ng/ccu_nm.c
++++ b/drivers/clk/sunxi-ng/ccu_nm.c
+@@ -19,6 +19,17 @@ struct _ccu_nm {
+ unsigned long m, min_m, max_m;
+ };
+
++static unsigned long ccu_nm_calc_rate(unsigned long parent,
++ unsigned long n, unsigned long m)
++{
++ u64 rate = parent;
++
++ rate *= n;
++ do_div(rate, m);
++
++ return rate;
++}
++
+ static void ccu_nm_find_best(unsigned long parent, unsigned long rate,
+ struct _ccu_nm *nm)
+ {
+@@ -28,7 +39,8 @@ static void ccu_nm_find_best(unsigned long parent, unsigned long rate,
+
+ for (_n = nm->min_n; _n <= nm->max_n; _n++) {
+ for (_m = nm->min_m; _m <= nm->max_m; _m++) {
+- unsigned long tmp_rate = parent * _n / _m;
++ unsigned long tmp_rate = ccu_nm_calc_rate(parent,
++ _n, _m);
+
+ if (tmp_rate > rate)
+ continue;
+@@ -100,7 +112,7 @@ static unsigned long ccu_nm_recalc_rate(struct clk_hw *hw,
+ if (ccu_sdm_helper_is_enabled(&nm->common, &nm->sdm))
+ rate = ccu_sdm_helper_read_rate(&nm->common, &nm->sdm, m, n);
+ else
+- rate = parent_rate * n / m;
++ rate = ccu_nm_calc_rate(parent_rate, n, m);
+
+ if (nm->common.features & CCU_FEATURE_FIXED_POSTDIV)
+ rate /= nm->fixed_post_div;
+@@ -142,7 +154,7 @@ static long ccu_nm_round_rate(struct clk_hw *hw, unsigned long rate,
+ _nm.max_m = nm->m.max ?: 1 << nm->m.width;
+
+ ccu_nm_find_best(*parent_rate, rate, &_nm);
+- rate = *parent_rate * _nm.n / _nm.m;
++ rate = ccu_nm_calc_rate(*parent_rate, _nm.n, _nm.m);
+
+ if (nm->common.features & CCU_FEATURE_FIXED_POSTDIV)
+ rate /= nm->fixed_post_div;
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index a11f4ba98b05..316d48d7be72 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -290,6 +290,7 @@ config CLKSRC_MPS2
+
+ config ARC_TIMERS
+ bool "Support for 32-bit TIMERn counters in ARC Cores" if COMPILE_TEST
++ depends on GENERIC_SCHED_CLOCK
+ select TIMER_OF
+ help
+ These are legacy 32-bit TIMER0 and TIMER1 counters found on all ARC cores
+diff --git a/drivers/clocksource/arc_timer.c b/drivers/clocksource/arc_timer.c
+index 20da9b1d7f7d..b28970ca4a7a 100644
+--- a/drivers/clocksource/arc_timer.c
++++ b/drivers/clocksource/arc_timer.c
+@@ -23,6 +23,7 @@
+ #include <linux/cpu.h>
+ #include <linux/of.h>
+ #include <linux/of_irq.h>
++#include <linux/sched_clock.h>
+
+ #include <soc/arc/timers.h>
+ #include <soc/arc/mcip.h>
+@@ -88,6 +89,11 @@ static u64 arc_read_gfrc(struct clocksource *cs)
+ return (((u64)h) << 32) | l;
+ }
+
++static notrace u64 arc_gfrc_clock_read(void)
++{
++ return arc_read_gfrc(NULL);
++}
++
+ static struct clocksource arc_counter_gfrc = {
+ .name = "ARConnect GFRC",
+ .rating = 400,
+@@ -111,6 +117,8 @@ static int __init arc_cs_setup_gfrc(struct device_node *node)
+ if (ret)
+ return ret;
+
++ sched_clock_register(arc_gfrc_clock_read, 64, arc_timer_freq);
++
+ return clocksource_register_hz(&arc_counter_gfrc, arc_timer_freq);
+ }
+ TIMER_OF_DECLARE(arc_gfrc, "snps,archs-timer-gfrc", arc_cs_setup_gfrc);
+@@ -139,6 +147,11 @@ static u64 arc_read_rtc(struct clocksource *cs)
+ return (((u64)h) << 32) | l;
+ }
+
++static notrace u64 arc_rtc_clock_read(void)
++{
++ return arc_read_rtc(NULL);
++}
++
+ static struct clocksource arc_counter_rtc = {
+ .name = "ARCv2 RTC",
+ .rating = 350,
+@@ -170,6 +183,8 @@ static int __init arc_cs_setup_rtc(struct device_node *node)
+
+ write_aux_reg(AUX_RTC_CTRL, 1);
+
++ sched_clock_register(arc_rtc_clock_read, 64, arc_timer_freq);
++
+ return clocksource_register_hz(&arc_counter_rtc, arc_timer_freq);
+ }
+ TIMER_OF_DECLARE(arc_rtc, "snps,archs-timer-rtc", arc_cs_setup_rtc);
+@@ -185,6 +200,11 @@ static u64 arc_read_timer1(struct clocksource *cs)
+ return (u64) read_aux_reg(ARC_REG_TIMER1_CNT);
+ }
+
++static notrace u64 arc_timer1_clock_read(void)
++{
++ return arc_read_timer1(NULL);
++}
++
+ static struct clocksource arc_counter_timer1 = {
+ .name = "ARC Timer1",
+ .rating = 300,
+@@ -209,6 +229,8 @@ static int __init arc_cs_setup_timer1(struct device_node *node)
+ write_aux_reg(ARC_REG_TIMER1_CNT, 0);
+ write_aux_reg(ARC_REG_TIMER1_CTRL, TIMER_CTRL_NH);
+
++ sched_clock_register(arc_timer1_clock_read, 32, arc_timer_freq);
++
+ return clocksource_register_hz(&arc_counter_timer1, arc_timer_freq);
+ }
+
+diff --git a/drivers/crypto/cavium/nitrox/nitrox_algs.c b/drivers/crypto/cavium/nitrox/nitrox_algs.c
+index 2ae6124e5da6..5d54ebc20cb3 100644
+--- a/drivers/crypto/cavium/nitrox/nitrox_algs.c
++++ b/drivers/crypto/cavium/nitrox/nitrox_algs.c
+@@ -73,7 +73,7 @@ static int flexi_aes_keylen(int keylen)
+ static int nitrox_skcipher_init(struct crypto_skcipher *tfm)
+ {
+ struct nitrox_crypto_ctx *nctx = crypto_skcipher_ctx(tfm);
+- void *fctx;
++ struct crypto_ctx_hdr *chdr;
+
+ /* get the first device */
+ nctx->ndev = nitrox_get_first_device();
+@@ -81,12 +81,14 @@ static int nitrox_skcipher_init(struct crypto_skcipher *tfm)
+ return -ENODEV;
+
+ /* allocate nitrox crypto context */
+- fctx = crypto_alloc_context(nctx->ndev);
+- if (!fctx) {
++ chdr = crypto_alloc_context(nctx->ndev);
++ if (!chdr) {
+ nitrox_put_device(nctx->ndev);
+ return -ENOMEM;
+ }
+- nctx->u.ctx_handle = (uintptr_t)fctx;
++ nctx->chdr = chdr;
++ nctx->u.ctx_handle = (uintptr_t)((u8 *)chdr->vaddr +
++ sizeof(struct ctx_hdr));
+ crypto_skcipher_set_reqsize(tfm, crypto_skcipher_reqsize(tfm) +
+ sizeof(struct nitrox_kcrypt_request));
+ return 0;
+@@ -102,7 +104,7 @@ static void nitrox_skcipher_exit(struct crypto_skcipher *tfm)
+
+ memset(&fctx->crypto, 0, sizeof(struct crypto_keys));
+ memset(&fctx->auth, 0, sizeof(struct auth_keys));
+- crypto_free_context((void *)fctx);
++ crypto_free_context((void *)nctx->chdr);
+ }
+ nitrox_put_device(nctx->ndev);
+
+diff --git a/drivers/crypto/cavium/nitrox/nitrox_lib.c b/drivers/crypto/cavium/nitrox/nitrox_lib.c
+index 4d31df07777f..28baf1a19d0a 100644
+--- a/drivers/crypto/cavium/nitrox/nitrox_lib.c
++++ b/drivers/crypto/cavium/nitrox/nitrox_lib.c
+@@ -146,12 +146,19 @@ static void destroy_crypto_dma_pool(struct nitrox_device *ndev)
+ void *crypto_alloc_context(struct nitrox_device *ndev)
+ {
+ struct ctx_hdr *ctx;
++ struct crypto_ctx_hdr *chdr;
+ void *vaddr;
+ dma_addr_t dma;
+
++ chdr = kmalloc(sizeof(*chdr), GFP_KERNEL);
++ if (!chdr)
++ return NULL;
++
+ vaddr = dma_pool_alloc(ndev->ctx_pool, (GFP_KERNEL | __GFP_ZERO), &dma);
+- if (!vaddr)
++ if (!vaddr) {
++ kfree(chdr);
+ return NULL;
++ }
+
+ /* fill meta data */
+ ctx = vaddr;
+@@ -159,7 +166,11 @@ void *crypto_alloc_context(struct nitrox_device *ndev)
+ ctx->dma = dma;
+ ctx->ctx_dma = dma + sizeof(struct ctx_hdr);
+
+- return ((u8 *)vaddr + sizeof(struct ctx_hdr));
++ chdr->pool = ndev->ctx_pool;
++ chdr->dma = dma;
++ chdr->vaddr = vaddr;
++
++ return chdr;
+ }
+
+ /**
+@@ -168,13 +179,14 @@ void *crypto_alloc_context(struct nitrox_device *ndev)
+ */
+ void crypto_free_context(void *ctx)
+ {
+- struct ctx_hdr *ctxp;
++ struct crypto_ctx_hdr *ctxp;
+
+ if (!ctx)
+ return;
+
+- ctxp = (struct ctx_hdr *)((u8 *)ctx - sizeof(struct ctx_hdr));
+- dma_pool_free(ctxp->pool, ctxp, ctxp->dma);
++ ctxp = ctx;
++ dma_pool_free(ctxp->pool, ctxp->vaddr, ctxp->dma);
++ kfree(ctxp);
+ }
+
+ /**
+diff --git a/drivers/crypto/cavium/nitrox/nitrox_req.h b/drivers/crypto/cavium/nitrox/nitrox_req.h
+index d091b6f5f5dd..19f0a20e3bb3 100644
+--- a/drivers/crypto/cavium/nitrox/nitrox_req.h
++++ b/drivers/crypto/cavium/nitrox/nitrox_req.h
+@@ -181,12 +181,19 @@ struct flexi_crypto_context {
+ struct auth_keys auth;
+ };
+
++struct crypto_ctx_hdr {
++ struct dma_pool *pool;
++ dma_addr_t dma;
++ void *vaddr;
++};
++
+ struct nitrox_crypto_ctx {
+ struct nitrox_device *ndev;
+ union {
+ u64 ctx_handle;
+ struct flexi_crypto_context *fctx;
+ } u;
++ struct crypto_ctx_hdr *chdr;
+ };
+
+ struct nitrox_kcrypt_request {
+diff --git a/drivers/crypto/chelsio/chcr_ipsec.c b/drivers/crypto/chelsio/chcr_ipsec.c
+index 461b97e2f1fd..1ff8738631a3 100644
+--- a/drivers/crypto/chelsio/chcr_ipsec.c
++++ b/drivers/crypto/chelsio/chcr_ipsec.c
+@@ -303,7 +303,10 @@ static bool chcr_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
+
+ static inline int is_eth_imm(const struct sk_buff *skb, unsigned int kctx_len)
+ {
+- int hdrlen = sizeof(struct chcr_ipsec_req) + kctx_len;
++ int hdrlen;
++
++ hdrlen = sizeof(struct fw_ulptx_wr) +
++ sizeof(struct chcr_ipsec_req) + kctx_len;
+
+ hdrlen += sizeof(struct cpl_tx_pkt);
+ if (skb->len <= MAX_IMM_TX_PKT_LEN - hdrlen)
+diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
+index f455f095a146..1b014d92855b 100644
+--- a/drivers/gpu/drm/udl/udl_main.c
++++ b/drivers/gpu/drm/udl/udl_main.c
+@@ -350,15 +350,10 @@ int udl_driver_load(struct drm_device *dev, unsigned long flags)
+ if (ret)
+ goto err;
+
+- ret = drm_vblank_init(dev, 1);
+- if (ret)
+- goto err_fb;
+-
+ drm_kms_helper_poll_init(dev);
+
+ return 0;
+-err_fb:
+- udl_fbdev_cleanup(dev);
++
+ err:
+ if (udl->urbs.count)
+ udl_free_urb_list(dev);
+diff --git a/drivers/gpu/drm/v3d/v3d_debugfs.c b/drivers/gpu/drm/v3d/v3d_debugfs.c
+index 4db62c545748..26470c77eb6e 100644
+--- a/drivers/gpu/drm/v3d/v3d_debugfs.c
++++ b/drivers/gpu/drm/v3d/v3d_debugfs.c
+@@ -71,10 +71,13 @@ static int v3d_v3d_debugfs_regs(struct seq_file *m, void *unused)
+ V3D_READ(v3d_hub_reg_defs[i].reg));
+ }
+
+- for (i = 0; i < ARRAY_SIZE(v3d_gca_reg_defs); i++) {
+- seq_printf(m, "%s (0x%04x): 0x%08x\n",
+- v3d_gca_reg_defs[i].name, v3d_gca_reg_defs[i].reg,
+- V3D_GCA_READ(v3d_gca_reg_defs[i].reg));
++ if (v3d->ver < 41) {
++ for (i = 0; i < ARRAY_SIZE(v3d_gca_reg_defs); i++) {
++ seq_printf(m, "%s (0x%04x): 0x%08x\n",
++ v3d_gca_reg_defs[i].name,
++ v3d_gca_reg_defs[i].reg,
++ V3D_GCA_READ(v3d_gca_reg_defs[i].reg));
++ }
+ }
+
+ for (core = 0; core < v3d->cores; core++) {
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index 3dfb4cf2f8c9..48692adbe811 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -1141,6 +1141,8 @@ int hfi1_verbs_send_pio(struct rvt_qp *qp, struct hfi1_pkt_state *ps,
+
+ if (slen > len)
+ slen = len;
++ if (slen > ss->sge.sge_length)
++ slen = ss->sge.sge_length;
+ rvt_update_sge(ss, slen, false);
+ seg_pio_copy_mid(pbuf, addr, slen);
+ len -= slen;
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index a94b6494e71a..f322a1768fbb 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1336,6 +1336,7 @@ MODULE_DEVICE_TABLE(i2c, elan_id);
+ static const struct acpi_device_id elan_acpi_id[] = {
+ { "ELAN0000", 0 },
+ { "ELAN0100", 0 },
++ { "ELAN0501", 0 },
+ { "ELAN0600", 0 },
+ { "ELAN0602", 0 },
+ { "ELAN0605", 0 },
+diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
+index 3232af5dcf89..a7ace07e179e 100644
+--- a/drivers/input/touchscreen/atmel_mxt_ts.c
++++ b/drivers/input/touchscreen/atmel_mxt_ts.c
+@@ -1586,10 +1586,10 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *fw)
+ /* T7 config may have changed */
+ mxt_init_t7_power_cfg(data);
+
+-release_raw:
+- kfree(cfg.raw);
+ release_mem:
+ kfree(cfg.mem);
++release_raw:
++ kfree(cfg.raw);
+ return ret;
+ }
+
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index 5059d09f3202..3e02aace38b1 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -837,7 +837,13 @@ static int arm_smmu_cmdq_build_cmd(u64 *cmd, struct arm_smmu_cmdq_ent *ent)
+ cmd[0] |= FIELD_PREP(CMDQ_SYNC_0_CS, CMDQ_SYNC_0_CS_SEV);
+ cmd[0] |= FIELD_PREP(CMDQ_SYNC_0_MSH, ARM_SMMU_SH_ISH);
+ cmd[0] |= FIELD_PREP(CMDQ_SYNC_0_MSIATTR, ARM_SMMU_MEMATTR_OIWB);
+- cmd[0] |= FIELD_PREP(CMDQ_SYNC_0_MSIDATA, ent->sync.msidata);
++ /*
++ * Commands are written little-endian, but we want the SMMU to
++ * receive MSIData, and thus write it back to memory, in CPU
++ * byte order, so big-endian needs an extra byteswap here.
++ */
++ cmd[0] |= FIELD_PREP(CMDQ_SYNC_0_MSIDATA,
++ cpu_to_le32(ent->sync.msidata));
+ cmd[1] |= ent->sync.msiaddr & CMDQ_SYNC_1_MSIADDR_MASK;
+ break;
+ default:
+diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
+index 0ff517d3c98f..a4ceb61c5b60 100644
+--- a/drivers/isdn/capi/kcapi.c
++++ b/drivers/isdn/capi/kcapi.c
+@@ -852,7 +852,7 @@ u16 capi20_get_manufacturer(u32 contr, u8 *buf)
+ u16 ret;
+
+ if (contr == 0) {
+- strlcpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN);
++ strncpy(buf, capi_manufakturer, CAPI_MANUFACTURER_LEN);
+ return CAPI_NOERROR;
+ }
+
+@@ -860,7 +860,7 @@ u16 capi20_get_manufacturer(u32 contr, u8 *buf)
+
+ ctr = get_capi_ctr_by_nr(contr);
+ if (ctr && ctr->state == CAPI_CTR_RUNNING) {
+- strlcpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN);
++ strncpy(buf, ctr->manu, CAPI_MANUFACTURER_LEN);
+ ret = CAPI_NOERROR;
+ } else
+ ret = CAPI_REGNOTINSTALLED;
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index a537e518384b..a7ea27d2aa8e 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -442,7 +442,7 @@ int cec_thread_func(void *_adap)
+ (adap->needs_hpd &&
+ (!adap->is_configured && !adap->is_configuring)) ||
+ kthread_should_stop() ||
+- (!adap->transmitting &&
++ (!adap->transmit_in_progress &&
+ !list_empty(&adap->transmit_queue)),
+ msecs_to_jiffies(CEC_XFER_TIMEOUT_MS));
+ timeout = err == 0;
+@@ -450,7 +450,7 @@ int cec_thread_func(void *_adap)
+ /* Otherwise we just wait for something to happen. */
+ wait_event_interruptible(adap->kthread_waitq,
+ kthread_should_stop() ||
+- (!adap->transmitting &&
++ (!adap->transmit_in_progress &&
+ !list_empty(&adap->transmit_queue)));
+ }
+
+@@ -475,6 +475,7 @@ int cec_thread_func(void *_adap)
+ pr_warn("cec-%s: message %*ph timed out\n", adap->name,
+ adap->transmitting->msg.len,
+ adap->transmitting->msg.msg);
++ adap->transmit_in_progress = false;
+ adap->tx_timeouts++;
+ /* Just give up on this. */
+ cec_data_cancel(adap->transmitting,
+@@ -486,7 +487,7 @@ int cec_thread_func(void *_adap)
+ * If we are still transmitting, or there is nothing new to
+ * transmit, then just continue waiting.
+ */
+- if (adap->transmitting || list_empty(&adap->transmit_queue))
++ if (adap->transmit_in_progress || list_empty(&adap->transmit_queue))
+ goto unlock;
+
+ /* Get a new message to transmit */
+@@ -532,6 +533,8 @@ int cec_thread_func(void *_adap)
+ if (adap->ops->adap_transmit(adap, data->attempts,
+ signal_free_time, &data->msg))
+ cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
++ else
++ adap->transmit_in_progress = true;
+
+ unlock:
+ mutex_unlock(&adap->lock);
+@@ -562,14 +565,17 @@ void cec_transmit_done_ts(struct cec_adapter *adap, u8 status,
+ data = adap->transmitting;
+ if (!data) {
+ /*
+- * This can happen if a transmit was issued and the cable is
++ * This might happen if a transmit was issued and the cable is
+ * unplugged while the transmit is ongoing. Ignore this
+ * transmit in that case.
+ */
+- dprintk(1, "%s was called without an ongoing transmit!\n",
+- __func__);
+- goto unlock;
++ if (!adap->transmit_in_progress)
++ dprintk(1, "%s was called without an ongoing transmit!\n",
++ __func__);
++ adap->transmit_in_progress = false;
++ goto wake_thread;
+ }
++ adap->transmit_in_progress = false;
+
+ msg = &data->msg;
+
+@@ -635,7 +641,6 @@ wake_thread:
+ * for transmitting or to retry the current message.
+ */
+ wake_up_interruptible(&adap->kthread_waitq);
+-unlock:
+ mutex_unlock(&adap->lock);
+ }
+ EXPORT_SYMBOL_GPL(cec_transmit_done_ts);
+@@ -1483,8 +1488,11 @@ void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
+ if (adap->monitor_all_cnt)
+ WARN_ON(call_op(adap, adap_monitor_all_enable, false));
+ mutex_lock(&adap->devnode.lock);
+- if (adap->needs_hpd || list_empty(&adap->devnode.fhs))
++ if (adap->needs_hpd || list_empty(&adap->devnode.fhs)) {
+ WARN_ON(adap->ops->adap_enable(adap, false));
++ adap->transmit_in_progress = false;
++ wake_up_interruptible(&adap->kthread_waitq);
++ }
+ mutex_unlock(&adap->devnode.lock);
+ if (phys_addr == CEC_PHYS_ADDR_INVALID)
+ return;
+@@ -1492,6 +1500,7 @@ void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
+
+ mutex_lock(&adap->devnode.lock);
+ adap->last_initiator = 0xff;
++ adap->transmit_in_progress = false;
+
+ if ((adap->needs_hpd || list_empty(&adap->devnode.fhs)) &&
+ adap->ops->adap_enable(adap, true)) {
+diff --git a/drivers/media/cec/cec-pin.c b/drivers/media/cec/cec-pin.c
+index 6e311424f0dc..0496d93b2b8f 100644
+--- a/drivers/media/cec/cec-pin.c
++++ b/drivers/media/cec/cec-pin.c
+@@ -601,8 +601,9 @@ static void cec_pin_tx_states(struct cec_pin *pin, ktime_t ts)
+ break;
+ /* Was the message ACKed? */
+ ack = cec_msg_is_broadcast(&pin->tx_msg) ? v : !v;
+- if (!ack && !pin->tx_ignore_nack_until_eom &&
+- pin->tx_bit / 10 < pin->tx_msg.len && !pin->tx_post_eom) {
++ if (!ack && (!pin->tx_ignore_nack_until_eom ||
++ pin->tx_bit / 10 == pin->tx_msg.len - 1) &&
++ !pin->tx_post_eom) {
+ /*
+ * Note: the CEC spec is ambiguous regarding
+ * what action to take when a NACK appears
+diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+index f40ab5704bf0..2036b94269af 100644
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+@@ -1738,7 +1738,7 @@ typedef struct { u16 __; u8 _; } __packed x24;
+ unsigned s; \
+ \
+ for (s = 0; s < len; s++) { \
+- u8 chr = font8x16[text[s] * 16 + line]; \
++ u8 chr = font8x16[(u8)text[s] * 16 + line]; \
+ \
+ if (hdiv == 2 && tpg->hflip) { \
+ pos[3] = (chr & (0x01 << 6) ? fg : bg); \
+diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
+index 16c7b20cbf61..1faa64abc74f 100644
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -800,6 +800,9 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
+ memset(q->alloc_devs, 0, sizeof(q->alloc_devs));
+ q->memory = memory;
+ q->waiting_for_buffers = !q->is_output;
++ } else if (q->memory != memory) {
++ dprintk(1, "memory model mismatch\n");
++ return -EINVAL;
+ }
+
+ num_buffers = min(*count, VB2_MAX_FRAME - q->num_buffers);
+diff --git a/drivers/media/i2c/imx274.c b/drivers/media/i2c/imx274.c
+index f8c70f1a34fe..8cc3bdb7f608 100644
+--- a/drivers/media/i2c/imx274.c
++++ b/drivers/media/i2c/imx274.c
+@@ -636,16 +636,19 @@ static int imx274_write_table(struct stimx274 *priv, const struct reg_8 table[])
+
+ static inline int imx274_read_reg(struct stimx274 *priv, u16 addr, u8 *val)
+ {
++ unsigned int uint_val;
+ int err;
+
+- err = regmap_read(priv->regmap, addr, (unsigned int *)val);
++ err = regmap_read(priv->regmap, addr, &uint_val);
+ if (err)
+ dev_err(&priv->client->dev,
+ "%s : i2c read failed, addr = %x\n", __func__, addr);
+ else
+ dev_dbg(&priv->client->dev,
+ "%s : addr 0x%x, val=0x%x\n", __func__,
+- addr, *val);
++ addr, uint_val);
++
++ *val = uint_val;
+ return err;
+ }
+
+diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
+index 1599159f2574..baa7c83ee6e0 100644
+--- a/drivers/media/platform/vivid/vivid-vid-cap.c
++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
+@@ -438,6 +438,8 @@ void vivid_update_format_cap(struct vivid_dev *dev, bool keep_controls)
+ tpg_s_rgb_range(&dev->tpg, v4l2_ctrl_g_ctrl(dev->rgb_range_cap));
+ break;
+ }
++ vfree(dev->bitmap_cap);
++ dev->bitmap_cap = NULL;
+ vivid_update_quality(dev);
+ tpg_reset_source(&dev->tpg, dev->src_rect.width, dev->src_rect.height, dev->field_cap);
+ dev->crop_cap = dev->src_rect;
+diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
+index ca68e1d2b2f9..8b2c16dd58bd 100644
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -707,7 +707,8 @@ void rc_repeat(struct rc_dev *dev)
+ (dev->last_toggle ? LIRC_SCANCODE_FLAG_TOGGLE : 0)
+ };
+
+- ir_lirc_scancode_event(dev, &sc);
++ if (dev->allowed_protocols != RC_PROTO_BIT_CEC)
++ ir_lirc_scancode_event(dev, &sc);
+
+ spin_lock_irqsave(&dev->keylock, flags);
+
+@@ -747,7 +748,8 @@ static void ir_do_keydown(struct rc_dev *dev, enum rc_proto protocol,
+ .keycode = keycode
+ };
+
+- ir_lirc_scancode_event(dev, &sc);
++ if (dev->allowed_protocols != RC_PROTO_BIT_CEC)
++ ir_lirc_scancode_event(dev, &sc);
+
+ if (new_event && dev->keypressed)
+ ir_do_keyup(dev, false);
+diff --git a/drivers/media/usb/dvb-usb-v2/usb_urb.c b/drivers/media/usb/dvb-usb-v2/usb_urb.c
+index 024c751eb165..2ad2ddeaff51 100644
+--- a/drivers/media/usb/dvb-usb-v2/usb_urb.c
++++ b/drivers/media/usb/dvb-usb-v2/usb_urb.c
+@@ -155,7 +155,6 @@ static int usb_urb_alloc_bulk_urbs(struct usb_data_stream *stream)
+ stream->props.u.bulk.buffersize,
+ usb_urb_complete, stream);
+
+- stream->urb_list[i]->transfer_flags = URB_FREE_BUFFER;
+ stream->urbs_initialized++;
+ }
+ return 0;
+@@ -186,7 +185,7 @@ static int usb_urb_alloc_isoc_urbs(struct usb_data_stream *stream)
+ urb->complete = usb_urb_complete;
+ urb->pipe = usb_rcvisocpipe(stream->udev,
+ stream->props.endpoint);
+- urb->transfer_flags = URB_ISO_ASAP | URB_FREE_BUFFER;
++ urb->transfer_flags = URB_ISO_ASAP;
+ urb->interval = stream->props.u.isoc.interval;
+ urb->number_of_packets = stream->props.u.isoc.framesperurb;
+ urb->transfer_buffer_length = stream->props.u.isoc.framesize *
+@@ -210,7 +209,7 @@ static int usb_free_stream_buffers(struct usb_data_stream *stream)
+ if (stream->state & USB_STATE_URB_BUF) {
+ while (stream->buf_num) {
+ stream->buf_num--;
+- stream->buf_list[stream->buf_num] = NULL;
++ kfree(stream->buf_list[stream->buf_num]);
+ }
+ }
+
+diff --git a/drivers/misc/ocxl/config.c b/drivers/misc/ocxl/config.c
+index 57a6bb1fd3c9..8f2c5d8bd2ee 100644
+--- a/drivers/misc/ocxl/config.c
++++ b/drivers/misc/ocxl/config.c
+@@ -318,7 +318,7 @@ static int read_afu_name(struct pci_dev *dev, struct ocxl_fn_config *fn,
+ if (rc)
+ return rc;
+ ptr = (u32 *) &afu->name[i];
+- *ptr = val;
++ *ptr = le32_to_cpu((__force __le32) val);
+ }
+ afu->name[OCXL_AFU_NAME_SZ - 1] = '\0'; /* play safe */
+ return 0;
+diff --git a/drivers/misc/ocxl/link.c b/drivers/misc/ocxl/link.c
+index 31695a078485..646d16450066 100644
+--- a/drivers/misc/ocxl/link.c
++++ b/drivers/misc/ocxl/link.c
+@@ -566,7 +566,7 @@ int ocxl_link_update_pe(void *link_handle, int pasid, __u16 tid)
+
+ mutex_lock(&spa->spa_lock);
+
+- pe->tid = tid;
++ pe->tid = cpu_to_be32(tid);
+
+ /*
+ * The barrier makes sure the PE is updated
+diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
+index c7573ccdbacd..9c90695a885f 100644
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -444,9 +444,14 @@ static void marvell_nfc_enable_int(struct marvell_nfc *nfc, u32 int_mask)
+ writel_relaxed(reg & ~int_mask, nfc->regs + NDCR);
+ }
+
+-static void marvell_nfc_clear_int(struct marvell_nfc *nfc, u32 int_mask)
++static u32 marvell_nfc_clear_int(struct marvell_nfc *nfc, u32 int_mask)
+ {
++ u32 reg;
++
++ reg = readl_relaxed(nfc->regs + NDSR);
+ writel_relaxed(int_mask, nfc->regs + NDSR);
++
++ return reg & int_mask;
+ }
+
+ static void marvell_nfc_force_byte_access(struct nand_chip *chip,
+@@ -613,6 +618,7 @@ static int marvell_nfc_wait_cmdd(struct nand_chip *chip)
+ static int marvell_nfc_wait_op(struct nand_chip *chip, unsigned int timeout_ms)
+ {
+ struct marvell_nfc *nfc = to_marvell_nfc(chip->controller);
++ u32 pending;
+ int ret;
+
+ /* Timeout is expressed in ms */
+@@ -625,8 +631,13 @@ static int marvell_nfc_wait_op(struct nand_chip *chip, unsigned int timeout_ms)
+ ret = wait_for_completion_timeout(&nfc->complete,
+ msecs_to_jiffies(timeout_ms));
+ marvell_nfc_disable_int(nfc, NDCR_RDYM);
+- marvell_nfc_clear_int(nfc, NDSR_RDY(0) | NDSR_RDY(1));
+- if (!ret) {
++ pending = marvell_nfc_clear_int(nfc, NDSR_RDY(0) | NDSR_RDY(1));
++
++ /*
++ * In case the interrupt was not served in the required time frame,
++ * check if the ISR was not served or if something went actually wrong.
++ */
++ if (ret && !pending) {
+ dev_err(nfc->dev, "Timeout waiting for RB signal\n");
+ return -ETIMEDOUT;
+ }
+diff --git a/drivers/mtd/nand/raw/omap2.c b/drivers/mtd/nand/raw/omap2.c
+index 4546ac0bed4a..b1683d7a7e04 100644
+--- a/drivers/mtd/nand/raw/omap2.c
++++ b/drivers/mtd/nand/raw/omap2.c
+@@ -1938,7 +1938,7 @@ static int omap_nand_attach_chip(struct nand_chip *chip)
+ case NAND_OMAP_PREFETCH_DMA:
+ dma_cap_zero(mask);
+ dma_cap_set(DMA_SLAVE, mask);
+- info->dma = dma_request_chan(dev, "rxtx");
++ info->dma = dma_request_chan(dev->parent, "rxtx");
+
+ if (IS_ERR(info->dma)) {
+ dev_err(dev, "DMA engine request failed\n");
+diff --git a/drivers/mtd/spi-nor/Kconfig b/drivers/mtd/spi-nor/Kconfig
+index 6cc9c929ff57..37775fc09e09 100644
+--- a/drivers/mtd/spi-nor/Kconfig
++++ b/drivers/mtd/spi-nor/Kconfig
+@@ -41,7 +41,7 @@ config SPI_ASPEED_SMC
+
+ config SPI_ATMEL_QUADSPI
+ tristate "Atmel Quad SPI Controller"
+- depends on ARCH_AT91 || (ARM && COMPILE_TEST)
++ depends on ARCH_AT91 || (ARM && COMPILE_TEST && !ARCH_EBSA110)
+ depends on OF && HAS_IOMEM
+ help
+ This enables support for the Quad SPI controller in master mode.
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 58b9744c4058..240fd36b5074 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -61,7 +61,8 @@
+ #define MACB_TX_ERR_FLAGS (MACB_BIT(ISR_TUND) \
+ | MACB_BIT(ISR_RLE) \
+ | MACB_BIT(TXERR))
+-#define MACB_TX_INT_FLAGS (MACB_TX_ERR_FLAGS | MACB_BIT(TCOMP))
++#define MACB_TX_INT_FLAGS (MACB_TX_ERR_FLAGS | MACB_BIT(TCOMP) \
++ | MACB_BIT(TXUBR))
+
+ /* Max length of transmit frame must be a multiple of 8 bytes */
+ #define MACB_TX_LEN_ALIGN 8
+@@ -1313,6 +1314,21 @@ static void macb_hresp_error_task(unsigned long data)
+ netif_tx_start_all_queues(dev);
+ }
+
++static void macb_tx_restart(struct macb_queue *queue)
++{
++ unsigned int head = queue->tx_head;
++ unsigned int tail = queue->tx_tail;
++ struct macb *bp = queue->bp;
++
++ if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
++ queue_writel(queue, ISR, MACB_BIT(TXUBR));
++
++ if (head == tail)
++ return;
++
++ macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART));
++}
++
+ static irqreturn_t macb_interrupt(int irq, void *dev_id)
+ {
+ struct macb_queue *queue = dev_id;
+@@ -1370,6 +1386,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
+ if (status & MACB_BIT(TCOMP))
+ macb_tx_interrupt(queue);
+
++ if (status & MACB_BIT(TXUBR))
++ macb_tx_restart(queue);
++
+ /* Link change detection isn't possible with RMII, so we'll
+ * add that if/when we get our hands on a full-blown MII PHY.
+ */
+diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
+index 525d8b89187b..91f48c078073 100644
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -1172,11 +1172,15 @@ out:
+
+ map_failed_frags:
+ last = i+1;
+- for (i = 0; i < last; i++)
++ for (i = 1; i < last; i++)
+ dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address,
+ descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK,
+ DMA_TO_DEVICE);
+
++ dma_unmap_single(&adapter->vdev->dev,
++ descs[0].fields.address,
++ descs[0].fields.flags_len & IBMVETH_BUF_LEN_MASK,
++ DMA_TO_DEVICE);
+ map_failed:
+ if (!firmware_has_feature(FW_FEATURE_CMO))
+ netdev_err(netdev, "tx: unable to map xmit buffer\n");
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index b4ed7d394d07..a78a39244b79 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -406,7 +406,6 @@ struct mvneta_port {
+ struct mvneta_pcpu_stats __percpu *stats;
+
+ int pkt_size;
+- unsigned int frag_size;
+ void __iomem *base;
+ struct mvneta_rx_queue *rxqs;
+ struct mvneta_tx_queue *txqs;
+@@ -2905,7 +2904,9 @@ static void mvneta_rxq_hw_init(struct mvneta_port *pp,
+ if (!pp->bm_priv) {
+ /* Set Offset */
+ mvneta_rxq_offset_set(pp, rxq, 0);
+- mvneta_rxq_buf_size_set(pp, rxq, pp->frag_size);
++ mvneta_rxq_buf_size_set(pp, rxq, PAGE_SIZE < SZ_64K ?
++ PAGE_SIZE :
++ MVNETA_RX_BUF_SIZE(pp->pkt_size));
+ mvneta_rxq_bm_disable(pp, rxq);
+ mvneta_rxq_fill(pp, rxq, rxq->size);
+ } else {
+@@ -3749,7 +3750,6 @@ static int mvneta_open(struct net_device *dev)
+ int ret;
+
+ pp->pkt_size = MVNETA_RX_PKT_SIZE(pp->dev->mtu);
+- pp->frag_size = PAGE_SIZE;
+
+ ret = mvneta_setup_rxqs(pp);
+ if (ret)
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 6320e080b831..f8e4808a8317 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -4292,12 +4292,15 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+ case PHY_INTERFACE_MODE_10GKR:
+ case PHY_INTERFACE_MODE_XAUI:
+ case PHY_INTERFACE_MODE_NA:
+- phylink_set(mask, 10000baseCR_Full);
+- phylink_set(mask, 10000baseSR_Full);
+- phylink_set(mask, 10000baseLR_Full);
+- phylink_set(mask, 10000baseLRM_Full);
+- phylink_set(mask, 10000baseER_Full);
+- phylink_set(mask, 10000baseKR_Full);
++ if (port->gop_id == 0) {
++ phylink_set(mask, 10000baseT_Full);
++ phylink_set(mask, 10000baseCR_Full);
++ phylink_set(mask, 10000baseSR_Full);
++ phylink_set(mask, 10000baseLR_Full);
++ phylink_set(mask, 10000baseLRM_Full);
++ phylink_set(mask, 10000baseER_Full);
++ phylink_set(mask, 10000baseKR_Full);
++ }
+ /* Fall-through */
+ case PHY_INTERFACE_MODE_RGMII:
+ case PHY_INTERFACE_MODE_RGMII_ID:
+@@ -4308,7 +4311,6 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+ phylink_set(mask, 10baseT_Full);
+ phylink_set(mask, 100baseT_Half);
+ phylink_set(mask, 100baseT_Full);
+- phylink_set(mask, 10000baseT_Full);
+ /* Fall-through */
+ case PHY_INTERFACE_MODE_1000BASEX:
+ case PHY_INTERFACE_MODE_2500BASEX:
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 98dd3e0ada72..5e5423076b03 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1101,11 +1101,6 @@ int mlx5e_ethtool_get_ts_info(struct mlx5e_priv *priv,
+ struct ethtool_ts_info *info)
+ {
+ struct mlx5_core_dev *mdev = priv->mdev;
+- int ret;
+-
+- ret = ethtool_op_get_ts_info(priv->netdev, info);
+- if (ret)
+- return ret;
+
+ info->phc_index = mlx5_clock_get_ptp_index(mdev);
+
+@@ -1113,9 +1108,9 @@ int mlx5e_ethtool_get_ts_info(struct mlx5e_priv *priv,
+ info->phc_index == -1)
+ return 0;
+
+- info->so_timestamping |= SOF_TIMESTAMPING_TX_HARDWARE |
+- SOF_TIMESTAMPING_RX_HARDWARE |
+- SOF_TIMESTAMPING_RAW_HARDWARE;
++ info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE |
++ SOF_TIMESTAMPING_RX_HARDWARE |
++ SOF_TIMESTAMPING_RAW_HARDWARE;
+
+ info->tx_types = BIT(HWTSTAMP_TX_OFF) |
+ BIT(HWTSTAMP_TX_ON);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index faa84b45e20a..7365899c3ac9 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -128,6 +128,8 @@ static bool mlx5e_rx_is_linear_skb(struct mlx5_core_dev *mdev,
+ return !params->lro_en && frag_sz <= PAGE_SIZE;
+ }
+
++#define MLX5_MAX_MPWQE_LOG_WQE_STRIDE_SZ ((BIT(__mlx5_bit_sz(wq, log_wqe_stride_size)) - 1) + \
++ MLX5_MPWQE_LOG_STRIDE_SZ_BASE)
+ static bool mlx5e_rx_mpwqe_is_linear_skb(struct mlx5_core_dev *mdev,
+ struct mlx5e_params *params)
+ {
+@@ -138,6 +140,9 @@ static bool mlx5e_rx_mpwqe_is_linear_skb(struct mlx5_core_dev *mdev,
+ if (!mlx5e_rx_is_linear_skb(mdev, params))
+ return false;
+
++ if (order_base_2(frag_sz) > MLX5_MAX_MPWQE_LOG_WQE_STRIDE_SZ)
++ return false;
++
+ if (MLX5_CAP_GEN(mdev, ext_stride_num_range))
+ return true;
+
+@@ -1383,6 +1388,7 @@ static void mlx5e_close_txqsq(struct mlx5e_txqsq *sq)
+ struct mlx5_core_dev *mdev = c->mdev;
+ struct mlx5_rate_limit rl = {0};
+
++ cancel_work_sync(&sq->dim.work);
+ mlx5e_destroy_sq(mdev, sq->sqn);
+ if (sq->rate_limit) {
+ rl.rate = sq->rate_limit;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index d543a5cff049..8262f093fec4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -1150,7 +1150,7 @@ mpwrq_cqe_out:
+ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
+ {
+ struct mlx5e_rq *rq = container_of(cq, struct mlx5e_rq, cq);
+- struct mlx5e_xdpsq *xdpsq;
++ struct mlx5e_xdpsq *xdpsq = &rq->xdpsq;
+ struct mlx5_cqe64 *cqe;
+ int work_done = 0;
+
+@@ -1161,10 +1161,11 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
+ work_done += mlx5e_decompress_cqes_cont(rq, cq, 0, budget);
+
+ cqe = mlx5_cqwq_get_cqe(&cq->wq);
+- if (!cqe)
++ if (!cqe) {
++ if (unlikely(work_done))
++ goto out;
+ return 0;
+-
+- xdpsq = &rq->xdpsq;
++ }
+
+ do {
+ if (mlx5_get_cqe_format(cqe) == MLX5_COMPRESSED) {
+@@ -1179,6 +1180,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
+ rq->handle_rx_cqe(rq, cqe);
+ } while ((++work_done < budget) && (cqe = mlx5_cqwq_get_cqe(&cq->wq)));
+
++out:
+ if (xdpsq->doorbell) {
+ mlx5e_xmit_xdp_doorbell(xdpsq);
+ xdpsq->doorbell = false;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index d57d51c4e658..7047cc293545 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -73,7 +73,6 @@ static const struct counter_desc sw_stats_desc[] = {
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_recover) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_cqes) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_wake) },
+- { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_udp_seg_rem) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_cqe_err) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_xdp_xmit) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_xdp_full) },
+@@ -194,7 +193,6 @@ void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
+ s->tx_nop += sq_stats->nop;
+ s->tx_queue_stopped += sq_stats->stopped;
+ s->tx_queue_wake += sq_stats->wake;
+- s->tx_udp_seg_rem += sq_stats->udp_seg_rem;
+ s->tx_queue_dropped += sq_stats->dropped;
+ s->tx_cqe_err += sq_stats->cqe_err;
+ s->tx_recover += sq_stats->recover;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+index c1064af9d54c..0ad7a165443a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+@@ -86,7 +86,6 @@ struct mlx5e_sw_stats {
+ u64 tx_recover;
+ u64 tx_cqes;
+ u64 tx_queue_wake;
+- u64 tx_udp_seg_rem;
+ u64 tx_cqe_err;
+ u64 tx_xdp_xmit;
+ u64 tx_xdp_full;
+@@ -217,7 +216,6 @@ struct mlx5e_sq_stats {
+ u64 csum_partial_inner;
+ u64 added_vlan_packets;
+ u64 nop;
+- u64 udp_seg_rem;
+ #ifdef CONFIG_MLX5_EN_TLS
+ u64 tls_ooo;
+ u64 tls_resync_bytes;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 37d114c668b7..d181645fd968 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -432,7 +432,7 @@ static void del_sw_hw_rule(struct fs_node *node)
+
+ if ((fte->action.action & MLX5_FLOW_CONTEXT_ACTION_FWD_DEST) &&
+ --fte->dests_size) {
+- modify_mask = BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_DESTINATION_LIST),
++ modify_mask = BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_DESTINATION_LIST);
+ update_fte = true;
+ }
+ out:
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index 30f751e69698..f7154f358f27 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -81,6 +81,7 @@ struct mlxsw_core {
+ struct mlxsw_core_port *ports;
+ unsigned int max_ports;
+ bool reload_fail;
++ bool fw_flash_in_progress;
+ unsigned long driver_priv[0];
+ /* driver_priv has to be always the last item */
+ };
+@@ -428,12 +429,16 @@ struct mlxsw_reg_trans {
+ struct rcu_head rcu;
+ };
+
+-#define MLXSW_EMAD_TIMEOUT_MS 200
++#define MLXSW_EMAD_TIMEOUT_DURING_FW_FLASH_MS 3000
++#define MLXSW_EMAD_TIMEOUT_MS 200
+
+ static void mlxsw_emad_trans_timeout_schedule(struct mlxsw_reg_trans *trans)
+ {
+ unsigned long timeout = msecs_to_jiffies(MLXSW_EMAD_TIMEOUT_MS);
+
++ if (trans->core->fw_flash_in_progress)
++ timeout = msecs_to_jiffies(MLXSW_EMAD_TIMEOUT_DURING_FW_FLASH_MS);
++
+ queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw, timeout);
+ }
+
+@@ -1854,6 +1859,18 @@ int mlxsw_core_kvd_sizes_get(struct mlxsw_core *mlxsw_core,
+ }
+ EXPORT_SYMBOL(mlxsw_core_kvd_sizes_get);
+
++void mlxsw_core_fw_flash_start(struct mlxsw_core *mlxsw_core)
++{
++ mlxsw_core->fw_flash_in_progress = true;
++}
++EXPORT_SYMBOL(mlxsw_core_fw_flash_start);
++
++void mlxsw_core_fw_flash_end(struct mlxsw_core *mlxsw_core)
++{
++ mlxsw_core->fw_flash_in_progress = false;
++}
++EXPORT_SYMBOL(mlxsw_core_fw_flash_end);
++
+ static int __init mlxsw_core_module_init(void)
+ {
+ int err;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.h b/drivers/net/ethernet/mellanox/mlxsw/core.h
+index c35be477856f..c4e4971764e5 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.h
+@@ -292,6 +292,9 @@ int mlxsw_core_kvd_sizes_get(struct mlxsw_core *mlxsw_core,
+ u64 *p_single_size, u64 *p_double_size,
+ u64 *p_linear_size);
+
++void mlxsw_core_fw_flash_start(struct mlxsw_core *mlxsw_core);
++void mlxsw_core_fw_flash_end(struct mlxsw_core *mlxsw_core);
++
+ bool mlxsw_core_res_valid(struct mlxsw_core *mlxsw_core,
+ enum mlxsw_res_id res_id);
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index ada644d90029..3d1159f8a53f 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -308,8 +308,13 @@ static int mlxsw_sp_firmware_flash(struct mlxsw_sp *mlxsw_sp,
+ },
+ .mlxsw_sp = mlxsw_sp
+ };
++ int err;
++
++ mlxsw_core_fw_flash_start(mlxsw_sp->core);
++ err = mlxfw_firmware_flash(&mlxsw_sp_mlxfw_dev.mlxfw_dev, firmware);
++ mlxsw_core_fw_flash_end(mlxsw_sp->core);
+
+- return mlxfw_firmware_flash(&mlxsw_sp_mlxfw_dev.mlxfw_dev, firmware);
++ return err;
+ }
+
+ static int mlxsw_sp_fw_rev_validate(struct mlxsw_sp *mlxsw_sp)
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index ed4e298cd823..0bdd3c400c92 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -733,7 +733,7 @@ static int ocelot_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
+ }
+
+ return ocelot_mact_learn(ocelot, port->chip_port, addr, vid,
+- ENTRYTYPE_NORMAL);
++ ENTRYTYPE_LOCKED);
+ }
+
+ static int ocelot_fdb_del(struct ndmsg *ndm, struct nlattr *tb[],
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
+index bd19624f10cf..90148dbb261b 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
+@@ -375,13 +375,29 @@ nfp_flower_calculate_key_layers(struct nfp_app *app,
+ !(tcp_flags & (TCPHDR_FIN | TCPHDR_SYN | TCPHDR_RST)))
+ return -EOPNOTSUPP;
+
+- /* We need to store TCP flags in the IPv4 key space, thus
+- * we need to ensure we include a IPv4 key layer if we have
+- * not done so already.
++ /* We need to store TCP flags in the either the IPv4 or IPv6 key
++ * space, thus we need to ensure we include a IPv4/IPv6 key
++ * layer if we have not done so already.
+ */
+- if (!(key_layer & NFP_FLOWER_LAYER_IPV4)) {
+- key_layer |= NFP_FLOWER_LAYER_IPV4;
+- key_size += sizeof(struct nfp_flower_ipv4);
++ if (!key_basic)
++ return -EOPNOTSUPP;
++
++ if (!(key_layer & NFP_FLOWER_LAYER_IPV4) &&
++ !(key_layer & NFP_FLOWER_LAYER_IPV6)) {
++ switch (key_basic->n_proto) {
++ case cpu_to_be16(ETH_P_IP):
++ key_layer |= NFP_FLOWER_LAYER_IPV4;
++ key_size += sizeof(struct nfp_flower_ipv4);
++ break;
++
++ case cpu_to_be16(ETH_P_IPV6):
++ key_layer |= NFP_FLOWER_LAYER_IPV6;
++ key_size += sizeof(struct nfp_flower_ipv6);
++ break;
++
++ default:
++ return -EOPNOTSUPP;
++ }
+ }
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_hsi.h b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+index a71382687ef2..bed8f48e029a 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+@@ -12669,8 +12669,9 @@ enum MFW_DRV_MSG_TYPE {
+ MFW_DRV_MSG_BW_UPDATE10,
+ MFW_DRV_MSG_TRANSCEIVER_STATE_CHANGE,
+ MFW_DRV_MSG_BW_UPDATE11,
+- MFW_DRV_MSG_OEM_CFG_UPDATE,
++ MFW_DRV_MSG_RESERVED,
+ MFW_DRV_MSG_GET_TLV_REQ,
++ MFW_DRV_MSG_OEM_CFG_UPDATE,
+ MFW_DRV_MSG_MAX
+ };
+
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 4930e0375c1d..9fc8a2bc0ff1 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -1528,6 +1528,8 @@ static void __rtl8169_set_wol(struct rtl8169_private *tp, u32 wolopts)
+ }
+
+ RTL_W8(tp, Cfg9346, Cfg9346_Lock);
++
++ device_set_wakeup_enable(tp_to_dev(tp), wolopts);
+ }
+
+ static int rtl8169_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+@@ -1549,8 +1551,6 @@ static int rtl8169_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+
+ rtl_unlock_work(tp);
+
+- device_set_wakeup_enable(d, tp->saved_wolopts);
+-
+ pm_runtime_put_noidle(d);
+
+ return 0;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 99ea5c4ce29c..2103b865726a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4247,6 +4247,7 @@ int stmmac_dvr_probe(struct device *device,
+ priv->wq = create_singlethread_workqueue("stmmac_wq");
+ if (!priv->wq) {
+ dev_err(priv->device, "failed to create workqueue\n");
++ ret = -ENOMEM;
+ goto error_wq;
+ }
+
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index d79a69dd2146..54e63ec04907 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -524,10 +524,7 @@ static void resync_tnc(struct timer_list *t)
+
+
+ /* Start resync timer again -- the TNC might be still absent */
+-
+- del_timer(&sp->resync_t);
+- sp->resync_t.expires = jiffies + SIXP_RESYNC_TIMEOUT;
+- add_timer(&sp->resync_t);
++ mod_timer(&sp->resync_t, jiffies + SIXP_RESYNC_TIMEOUT);
+ }
+
+ static inline int tnc_init(struct sixpack *sp)
+@@ -538,9 +535,7 @@ static inline int tnc_init(struct sixpack *sp)
+
+ sp->tty->ops->write(sp->tty, &inbyte, 1);
+
+- del_timer(&sp->resync_t);
+- sp->resync_t.expires = jiffies + SIXP_RESYNC_TIMEOUT;
+- add_timer(&sp->resync_t);
++ mod_timer(&sp->resync_t, jiffies + SIXP_RESYNC_TIMEOUT);
+
+ return 0;
+ }
+@@ -918,11 +913,8 @@ static void decode_prio_command(struct sixpack *sp, unsigned char cmd)
+ /* if the state byte has been received, the TNC is present,
+ so the resync timer can be reset. */
+
+- if (sp->tnc_state == TNC_IN_SYNC) {
+- del_timer(&sp->resync_t);
+- sp->resync_t.expires = jiffies + SIXP_INIT_RESYNC_TIMEOUT;
+- add_timer(&sp->resync_t);
+- }
++ if (sp->tnc_state == TNC_IN_SYNC)
++ mod_timer(&sp->resync_t, jiffies + SIXP_INIT_RESYNC_TIMEOUT);
+
+ sp->status1 = cmd & SIXP_PRIO_DATA_MASK;
+ }
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 20d1be2b070b..2c32c795f5dd 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -164,11 +164,8 @@ static int mdio_bus_phy_restore(struct device *dev)
+ if (ret < 0)
+ return ret;
+
+- /* The PHY needs to renegotiate. */
+- phydev->link = 0;
+- phydev->state = PHY_UP;
+-
+- phy_start_machine(phydev);
++ if (phydev->attached_dev && phydev->adjust_link)
++ phy_start_machine(phydev);
+
+ return 0;
+ }
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 72a55b6b4211..f5bac5075386 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1117,6 +1117,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1435, 0xd181, 4)}, /* Wistron NeWeb D18Q1 */
+ {QMI_FIXED_INTF(0x1435, 0xd181, 5)}, /* Wistron NeWeb D18Q1 */
+ {QMI_FIXED_INTF(0x1435, 0xd191, 4)}, /* Wistron NeWeb D19Q1 */
++ {QMI_QUIRK_SET_DTR(0x1508, 0x1001, 4)}, /* Fibocom NL668 series */
+ {QMI_FIXED_INTF(0x16d8, 0x6003, 0)}, /* CMOTech 6003 */
+ {QMI_FIXED_INTF(0x16d8, 0x6007, 0)}, /* CMOTech CHE-628S */
+ {QMI_FIXED_INTF(0x16d8, 0x6008, 0)}, /* CMOTech CMU-301 */
+@@ -1229,6 +1230,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */
+ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)}, /* Telit LN940 series */
+ {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)}, /* Telewell TW-3G HSPA+ */
+ {QMI_FIXED_INTF(0x1c9e, 0x9803, 4)}, /* Telewell TW-3G HSPA+ */
+ {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)}, /* XS Stick W100-2 from 4G Systems */
+@@ -1263,6 +1265,7 @@ static const struct usb_device_id products[] = {
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
+ {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */
++ {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */
+
+ /* 4. Gobi 1000 devices */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
+diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
+index 74c06a5f586f..4f25c2d8fff0 100644
+--- a/drivers/net/wan/x25_asy.c
++++ b/drivers/net/wan/x25_asy.c
+@@ -486,8 +486,10 @@ static int x25_asy_open(struct net_device *dev)
+
+ /* Cleanup */
+ kfree(sl->xbuff);
++ sl->xbuff = NULL;
+ noxbuff:
+ kfree(sl->rbuff);
++ sl->rbuff = NULL;
+ norbuff:
+ return -ENOMEM;
+ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index 64a794be7fcb..6f3faaf1b1cb 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5188,10 +5188,17 @@ static struct cfg80211_ops brcmf_cfg80211_ops = {
+ .del_pmk = brcmf_cfg80211_del_pmk,
+ };
+
+-struct cfg80211_ops *brcmf_cfg80211_get_ops(void)
++struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
+ {
+- return kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
++ struct cfg80211_ops *ops;
++
++ ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
+ GFP_KERNEL);
++
++ if (ops && settings->roamoff)
++ ops->update_connect_params = NULL;
++
++ return ops;
+ }
+
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+index a4aec0004e4f..9a6287f084a9 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+@@ -404,7 +404,7 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
+ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
+ s32 brcmf_cfg80211_up(struct net_device *ndev);
+ s32 brcmf_cfg80211_down(struct net_device *ndev);
+-struct cfg80211_ops *brcmf_cfg80211_get_ops(void);
++struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings);
+ enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
+
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+index b1f702faff4f..860a4372cb56 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1130,7 +1130,7 @@ int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
+
+ brcmf_dbg(TRACE, "Enter\n");
+
+- ops = brcmf_cfg80211_get_ops();
++ ops = brcmf_cfg80211_get_ops(settings);
+ if (!ops)
+ return -ENOMEM;
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+index 9095b830ae4d..9927079a9ace 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -641,8 +641,9 @@ brcmf_fw_alloc_request(u32 chip, u32 chiprev,
+ struct brcmf_fw_request *fwreq;
+ char chipname[12];
+ const char *mp_path;
++ size_t mp_path_len;
+ u32 i, j;
+- char end;
++ char end = '\0';
+ size_t reqsz;
+
+ for (i = 0; i < table_size; i++) {
+@@ -667,7 +668,10 @@ brcmf_fw_alloc_request(u32 chip, u32 chiprev,
+ mapping_table[i].fw_base, chipname);
+
+ mp_path = brcmf_mp_global.firmware_path;
+- end = mp_path[strlen(mp_path) - 1];
++ mp_path_len = strnlen(mp_path, BRCMF_FW_ALTPATH_LEN);
++ if (mp_path_len)
++ end = mp_path[mp_path_len - 1];
++
+ fwreq->n_items = n_fwnames;
+
+ for (j = 0; j < n_fwnames; j++) {
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index f17f602e6171..5b97cc946d70 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -905,7 +905,7 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
+ if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) {
+ unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
+
+- BUG_ON(pull_to <= skb_headlen(skb));
++ BUG_ON(pull_to < skb_headlen(skb));
+ __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
+ }
+ if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+diff --git a/drivers/rtc/rtc-m41t80.c b/drivers/rtc/rtc-m41t80.c
+index ad03e2f12f5d..5808a1e4c2e9 100644
+--- a/drivers/rtc/rtc-m41t80.c
++++ b/drivers/rtc/rtc-m41t80.c
+@@ -393,7 +393,7 @@ static int m41t80_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ alrm->time.tm_min = bcd2bin(alarmvals[3] & 0x7f);
+ alrm->time.tm_hour = bcd2bin(alarmvals[2] & 0x3f);
+ alrm->time.tm_mday = bcd2bin(alarmvals[1] & 0x3f);
+- alrm->time.tm_mon = bcd2bin(alarmvals[0] & 0x3f);
++ alrm->time.tm_mon = bcd2bin(alarmvals[0] & 0x3f) - 1;
+
+ alrm->enabled = !!(alarmvals[0] & M41T80_ALMON_AFE);
+ alrm->pending = (flags & M41T80_FLAGS_AF) && alrm->enabled;
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index f35cc10772f6..25abf2d1732a 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -88,7 +88,7 @@ struct bcm2835_spi {
+ u8 *rx_buf;
+ int tx_len;
+ int rx_len;
+- bool dma_pending;
++ unsigned int dma_pending;
+ };
+
+ static inline u32 bcm2835_rd(struct bcm2835_spi *bs, unsigned reg)
+@@ -155,8 +155,7 @@ static irqreturn_t bcm2835_spi_interrupt(int irq, void *dev_id)
+ /* Write as many bytes as possible to FIFO */
+ bcm2835_wr_fifo(bs);
+
+- /* based on flags decide if we can finish the transfer */
+- if (bcm2835_rd(bs, BCM2835_SPI_CS) & BCM2835_SPI_CS_DONE) {
++ if (!bs->rx_len) {
+ /* Transfer complete - reset SPI HW */
+ bcm2835_spi_reset_hw(master);
+ /* wake up the framework */
+@@ -233,10 +232,9 @@ static void bcm2835_spi_dma_done(void *data)
+ * is called the tx-dma must have finished - can't get to this
+ * situation otherwise...
+ */
+- dmaengine_terminate_all(master->dma_tx);
+-
+- /* mark as no longer pending */
+- bs->dma_pending = 0;
++ if (cmpxchg(&bs->dma_pending, true, false)) {
++ dmaengine_terminate_all(master->dma_tx);
++ }
+
+ /* and mark as completed */;
+ complete(&master->xfer_completion);
+@@ -342,6 +340,7 @@ static int bcm2835_spi_transfer_one_dma(struct spi_master *master,
+ if (ret) {
+ /* need to reset on errors */
+ dmaengine_terminate_all(master->dma_tx);
++ bs->dma_pending = false;
+ bcm2835_spi_reset_hw(master);
+ return ret;
+ }
+@@ -617,10 +616,9 @@ static void bcm2835_spi_handle_err(struct spi_master *master,
+ struct bcm2835_spi *bs = spi_master_get_devdata(master);
+
+ /* if an error occurred and we have an active dma, then terminate */
+- if (bs->dma_pending) {
++ if (cmpxchg(&bs->dma_pending, true, false)) {
+ dmaengine_terminate_all(master->dma_tx);
+ dmaengine_terminate_all(master->dma_rx);
+- bs->dma_pending = 0;
+ }
+ /* and reset */
+ bcm2835_spi_reset_hw(master);
+diff --git a/drivers/staging/wilc1000/wilc_sdio.c b/drivers/staging/wilc1000/wilc_sdio.c
+index b2080d8b801f..e52c3bdeaf04 100644
+--- a/drivers/staging/wilc1000/wilc_sdio.c
++++ b/drivers/staging/wilc1000/wilc_sdio.c
+@@ -831,6 +831,7 @@ static int sdio_read_int(struct wilc *wilc, u32 *int_status)
+ if (!g_sdio.irq_gpio) {
+ int i;
+
++ cmd.read_write = 0;
+ cmd.function = 1;
+ cmd.address = 0x04;
+ cmd.data = 0;
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index a48f19b1b88f..6ed74735b58c 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -125,7 +125,7 @@ MODULE_PARM_DESC(rx_timeout, "Rx timeout, 1-255");
+ #define CDNS_UART_IXR_RXTRIG 0x00000001 /* RX FIFO trigger interrupt */
+ #define CDNS_UART_IXR_RXFULL 0x00000004 /* RX FIFO full interrupt. */
+ #define CDNS_UART_IXR_RXEMPTY 0x00000002 /* RX FIFO empty interrupt. */
+-#define CDNS_UART_IXR_MASK 0x00001FFF /* Valid bit mask */
++#define CDNS_UART_IXR_RXMASK 0x000021e7 /* Valid RX bit mask */
+
+ /*
+ * Do not enable parity error interrupt for the following
+@@ -362,7 +362,7 @@ static irqreturn_t cdns_uart_isr(int irq, void *dev_id)
+ cdns_uart_handle_tx(dev_id);
+ isrstatus &= ~CDNS_UART_IXR_TXEMPTY;
+ }
+- if (isrstatus & CDNS_UART_IXR_MASK)
++ if (isrstatus & CDNS_UART_IXR_RXMASK)
+ cdns_uart_handle_rx(dev_id, isrstatus);
+
+ spin_unlock(&port->lock);
+diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
+index 987fc5ba6321..70e6c956c23c 100644
+--- a/drivers/usb/Kconfig
++++ b/drivers/usb/Kconfig
+@@ -205,8 +205,4 @@ config USB_ULPI_BUS
+ To compile this driver as a module, choose M here: the module will
+ be called ulpi.
+
+-config USB_ROLE_SWITCH
+- tristate
+- select USB_COMMON
+-
+ endif # USB_SUPPORT
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 40c64c7ab5e4..2886b7b477c7 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -581,6 +581,13 @@ static int acm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
+ if (retval)
+ goto error_init_termios;
+
++ /*
++ * Suppress initial echoing for some devices which might send data
++ * immediately after acm driver has been installed.
++ */
++ if (acm->quirks & DISABLE_ECHO)
++ tty->termios.c_lflag &= ~ECHO;
++
+ tty->driver_data = acm;
+
+ return 0;
+@@ -1672,6 +1679,9 @@ static const struct usb_device_id acm_ids[] = {
+ { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */
+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ },
++ { USB_DEVICE(0x0e8d, 0x2000), /* MediaTek Inc Preloader */
++ .driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */
++ },
+ { USB_DEVICE(0x0e8d, 0x3329), /* MediaTek Inc GPS */
+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ },
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index ca06b20d7af9..515aad0847ee 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -140,3 +140,4 @@ struct acm {
+ #define QUIRK_CONTROL_LINE_STATE BIT(6)
+ #define CLEAR_HALT_CONDITIONS BIT(7)
+ #define SEND_ZERO_PACKET BIT(8)
++#define DISABLE_ECHO BIT(9)
+diff --git a/drivers/usb/common/Makefile b/drivers/usb/common/Makefile
+index fb4d5ef4165c..0a7c45e85481 100644
+--- a/drivers/usb/common/Makefile
++++ b/drivers/usb/common/Makefile
+@@ -9,4 +9,3 @@ usb-common-$(CONFIG_USB_LED_TRIG) += led.o
+
+ obj-$(CONFIG_USB_OTG_FSM) += usb-otg-fsm.o
+ obj-$(CONFIG_USB_ULPI_BUS) += ulpi.o
+-obj-$(CONFIG_USB_ROLE_SWITCH) += roles.o
+diff --git a/drivers/usb/common/roles.c b/drivers/usb/common/roles.c
+deleted file mode 100644
+index 99116af07f1d..000000000000
+--- a/drivers/usb/common/roles.c
++++ /dev/null
+@@ -1,314 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * USB Role Switch Support
+- *
+- * Copyright (C) 2018 Intel Corporation
+- * Author: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+- * Hans de Goede <hdegoede@redhat.com>
+- */
+-
+-#include <linux/usb/role.h>
+-#include <linux/device.h>
+-#include <linux/module.h>
+-#include <linux/mutex.h>
+-#include <linux/slab.h>
+-
+-static struct class *role_class;
+-
+-struct usb_role_switch {
+- struct device dev;
+- struct mutex lock; /* device lock*/
+- enum usb_role role;
+-
+- /* From descriptor */
+- struct device *usb2_port;
+- struct device *usb3_port;
+- struct device *udc;
+- usb_role_switch_set_t set;
+- usb_role_switch_get_t get;
+- bool allow_userspace_control;
+-};
+-
+-#define to_role_switch(d) container_of(d, struct usb_role_switch, dev)
+-
+-/**
+- * usb_role_switch_set_role - Set USB role for a switch
+- * @sw: USB role switch
+- * @role: USB role to be switched to
+- *
+- * Set USB role @role for @sw.
+- */
+-int usb_role_switch_set_role(struct usb_role_switch *sw, enum usb_role role)
+-{
+- int ret;
+-
+- if (IS_ERR_OR_NULL(sw))
+- return 0;
+-
+- mutex_lock(&sw->lock);
+-
+- ret = sw->set(sw->dev.parent, role);
+- if (!ret)
+- sw->role = role;
+-
+- mutex_unlock(&sw->lock);
+-
+- return ret;
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_set_role);
+-
+-/**
+- * usb_role_switch_get_role - Get the USB role for a switch
+- * @sw: USB role switch
+- *
+- * Depending on the role-switch-driver this function returns either a cached
+- * value of the last set role, or reads back the actual value from the hardware.
+- */
+-enum usb_role usb_role_switch_get_role(struct usb_role_switch *sw)
+-{
+- enum usb_role role;
+-
+- if (IS_ERR_OR_NULL(sw))
+- return USB_ROLE_NONE;
+-
+- mutex_lock(&sw->lock);
+-
+- if (sw->get)
+- role = sw->get(sw->dev.parent);
+- else
+- role = sw->role;
+-
+- mutex_unlock(&sw->lock);
+-
+- return role;
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_get_role);
+-
+-static int __switch_match(struct device *dev, const void *name)
+-{
+- return !strcmp((const char *)name, dev_name(dev));
+-}
+-
+-static void *usb_role_switch_match(struct device_connection *con, int ep,
+- void *data)
+-{
+- struct device *dev;
+-
+- dev = class_find_device(role_class, NULL, con->endpoint[ep],
+- __switch_match);
+-
+- return dev ? to_role_switch(dev) : ERR_PTR(-EPROBE_DEFER);
+-}
+-
+-/**
+- * usb_role_switch_get - Find USB role switch linked with the caller
+- * @dev: The caller device
+- *
+- * Finds and returns role switch linked with @dev. The reference count for the
+- * found switch is incremented.
+- */
+-struct usb_role_switch *usb_role_switch_get(struct device *dev)
+-{
+- struct usb_role_switch *sw;
+-
+- sw = device_connection_find_match(dev, "usb-role-switch", NULL,
+- usb_role_switch_match);
+-
+- if (!IS_ERR_OR_NULL(sw))
+- WARN_ON(!try_module_get(sw->dev.parent->driver->owner));
+-
+- return sw;
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_get);
+-
+-/**
+- * usb_role_switch_put - Release handle to a switch
+- * @sw: USB Role Switch
+- *
+- * Decrement reference count for @sw.
+- */
+-void usb_role_switch_put(struct usb_role_switch *sw)
+-{
+- if (!IS_ERR_OR_NULL(sw)) {
+- put_device(&sw->dev);
+- module_put(sw->dev.parent->driver->owner);
+- }
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_put);
+-
+-static umode_t
+-usb_role_switch_is_visible(struct kobject *kobj, struct attribute *attr, int n)
+-{
+- struct device *dev = container_of(kobj, typeof(*dev), kobj);
+- struct usb_role_switch *sw = to_role_switch(dev);
+-
+- if (sw->allow_userspace_control)
+- return attr->mode;
+-
+- return 0;
+-}
+-
+-static const char * const usb_roles[] = {
+- [USB_ROLE_NONE] = "none",
+- [USB_ROLE_HOST] = "host",
+- [USB_ROLE_DEVICE] = "device",
+-};
+-
+-static ssize_t
+-role_show(struct device *dev, struct device_attribute *attr, char *buf)
+-{
+- struct usb_role_switch *sw = to_role_switch(dev);
+- enum usb_role role = usb_role_switch_get_role(sw);
+-
+- return sprintf(buf, "%s\n", usb_roles[role]);
+-}
+-
+-static ssize_t role_store(struct device *dev, struct device_attribute *attr,
+- const char *buf, size_t size)
+-{
+- struct usb_role_switch *sw = to_role_switch(dev);
+- int ret;
+-
+- ret = sysfs_match_string(usb_roles, buf);
+- if (ret < 0) {
+- bool res;
+-
+- /* Extra check if the user wants to disable the switch */
+- ret = kstrtobool(buf, &res);
+- if (ret || res)
+- return -EINVAL;
+- }
+-
+- ret = usb_role_switch_set_role(sw, ret);
+- if (ret)
+- return ret;
+-
+- return size;
+-}
+-static DEVICE_ATTR_RW(role);
+-
+-static struct attribute *usb_role_switch_attrs[] = {
+- &dev_attr_role.attr,
+- NULL,
+-};
+-
+-static const struct attribute_group usb_role_switch_group = {
+- .is_visible = usb_role_switch_is_visible,
+- .attrs = usb_role_switch_attrs,
+-};
+-
+-static const struct attribute_group *usb_role_switch_groups[] = {
+- &usb_role_switch_group,
+- NULL,
+-};
+-
+-static int
+-usb_role_switch_uevent(struct device *dev, struct kobj_uevent_env *env)
+-{
+- int ret;
+-
+- ret = add_uevent_var(env, "USB_ROLE_SWITCH=%s", dev_name(dev));
+- if (ret)
+- dev_err(dev, "failed to add uevent USB_ROLE_SWITCH\n");
+-
+- return ret;
+-}
+-
+-static void usb_role_switch_release(struct device *dev)
+-{
+- struct usb_role_switch *sw = to_role_switch(dev);
+-
+- kfree(sw);
+-}
+-
+-static const struct device_type usb_role_dev_type = {
+- .name = "usb_role_switch",
+- .groups = usb_role_switch_groups,
+- .uevent = usb_role_switch_uevent,
+- .release = usb_role_switch_release,
+-};
+-
+-/**
+- * usb_role_switch_register - Register USB Role Switch
+- * @parent: Parent device for the switch
+- * @desc: Description of the switch
+- *
+- * USB Role Switch is a device capable or choosing the role for USB connector.
+- * On platforms where the USB controller is dual-role capable, the controller
+- * driver will need to register the switch. On platforms where the USB host and
+- * USB device controllers behind the connector are separate, there will be a
+- * mux, and the driver for that mux will need to register the switch.
+- *
+- * Returns handle to a new role switch or ERR_PTR. The content of @desc is
+- * copied.
+- */
+-struct usb_role_switch *
+-usb_role_switch_register(struct device *parent,
+- const struct usb_role_switch_desc *desc)
+-{
+- struct usb_role_switch *sw;
+- int ret;
+-
+- if (!desc || !desc->set)
+- return ERR_PTR(-EINVAL);
+-
+- sw = kzalloc(sizeof(*sw), GFP_KERNEL);
+- if (!sw)
+- return ERR_PTR(-ENOMEM);
+-
+- mutex_init(&sw->lock);
+-
+- sw->allow_userspace_control = desc->allow_userspace_control;
+- sw->usb2_port = desc->usb2_port;
+- sw->usb3_port = desc->usb3_port;
+- sw->udc = desc->udc;
+- sw->set = desc->set;
+- sw->get = desc->get;
+-
+- sw->dev.parent = parent;
+- sw->dev.class = role_class;
+- sw->dev.type = &usb_role_dev_type;
+- dev_set_name(&sw->dev, "%s-role-switch", dev_name(parent));
+-
+- ret = device_register(&sw->dev);
+- if (ret) {
+- put_device(&sw->dev);
+- return ERR_PTR(ret);
+- }
+-
+- /* TODO: Symlinks for the host port and the device controller. */
+-
+- return sw;
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_register);
+-
+-/**
+- * usb_role_switch_unregister - Unregsiter USB Role Switch
+- * @sw: USB Role Switch
+- *
+- * Unregister switch that was registered with usb_role_switch_register().
+- */
+-void usb_role_switch_unregister(struct usb_role_switch *sw)
+-{
+- if (!IS_ERR_OR_NULL(sw))
+- device_unregister(&sw->dev);
+-}
+-EXPORT_SYMBOL_GPL(usb_role_switch_unregister);
+-
+-static int __init usb_roles_init(void)
+-{
+- role_class = class_create(THIS_MODULE, "usb_role");
+- return PTR_ERR_OR_ZERO(role_class);
+-}
+-subsys_initcall(usb_roles_init);
+-
+-static void __exit usb_roles_exit(void)
+-{
+- class_destroy(role_class);
+-}
+-module_exit(usb_roles_exit);
+-
+-MODULE_AUTHOR("Heikki Krogerus <heikki.krogerus@linux.intel.com>");
+-MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
+-MODULE_LICENSE("GPL v2");
+-MODULE_DESCRIPTION("USB Role Class");
+diff --git a/drivers/usb/dwc2/hcd.h b/drivers/usb/dwc2/hcd.h
+index 3f9bccc95add..c089ffa1f0a8 100644
+--- a/drivers/usb/dwc2/hcd.h
++++ b/drivers/usb/dwc2/hcd.h
+@@ -366,7 +366,7 @@ struct dwc2_qh {
+ u32 desc_list_sz;
+ u32 *n_bytes;
+ struct timer_list unreserve_timer;
+- struct timer_list wait_timer;
++ struct hrtimer wait_timer;
+ struct dwc2_tt *dwc_tt;
+ int ttport;
+ unsigned tt_buffer_dirty:1;
+diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c
+index 40839591d2ec..ea3aa640c15c 100644
+--- a/drivers/usb/dwc2/hcd_queue.c
++++ b/drivers/usb/dwc2/hcd_queue.c
+@@ -59,7 +59,7 @@
+ #define DWC2_UNRESERVE_DELAY (msecs_to_jiffies(5))
+
+ /* If we get a NAK, wait this long before retrying */
+-#define DWC2_RETRY_WAIT_DELAY (msecs_to_jiffies(1))
++#define DWC2_RETRY_WAIT_DELAY 1*1E6L
+
+ /**
+ * dwc2_periodic_channel_available() - Checks that a channel is available for a
+@@ -1464,10 +1464,12 @@ static void dwc2_deschedule_periodic(struct dwc2_hsotg *hsotg,
+ * qh back to the "inactive" list, then queues transactions.
+ *
+ * @t: Pointer to wait_timer in a qh.
++ *
++ * Return: HRTIMER_NORESTART to not automatically restart this timer.
+ */
+-static void dwc2_wait_timer_fn(struct timer_list *t)
++static enum hrtimer_restart dwc2_wait_timer_fn(struct hrtimer *t)
+ {
+- struct dwc2_qh *qh = from_timer(qh, t, wait_timer);
++ struct dwc2_qh *qh = container_of(t, struct dwc2_qh, wait_timer);
+ struct dwc2_hsotg *hsotg = qh->hsotg;
+ unsigned long flags;
+
+@@ -1491,6 +1493,7 @@ static void dwc2_wait_timer_fn(struct timer_list *t)
+ }
+
+ spin_unlock_irqrestore(&hsotg->lock, flags);
++ return HRTIMER_NORESTART;
+ }
+
+ /**
+@@ -1521,7 +1524,8 @@ static void dwc2_qh_init(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh,
+ /* Initialize QH */
+ qh->hsotg = hsotg;
+ timer_setup(&qh->unreserve_timer, dwc2_unreserve_timer_fn, 0);
+- timer_setup(&qh->wait_timer, dwc2_wait_timer_fn, 0);
++ hrtimer_init(&qh->wait_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++ qh->wait_timer.function = &dwc2_wait_timer_fn;
+ qh->ep_type = ep_type;
+ qh->ep_is_in = ep_is_in;
+
+@@ -1690,7 +1694,7 @@ void dwc2_hcd_qh_free(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
+ * won't do anything anyway, but we want it to finish before we free
+ * memory.
+ */
+- del_timer_sync(&qh->wait_timer);
++ hrtimer_cancel(&qh->wait_timer);
+
+ dwc2_host_put_tt_info(hsotg, qh->dwc_tt);
+
+@@ -1716,6 +1720,7 @@ int dwc2_hcd_qh_add(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
+ {
+ int status;
+ u32 intr_mask;
++ ktime_t delay;
+
+ if (dbg_qh(qh))
+ dev_vdbg(hsotg->dev, "%s()\n", __func__);
+@@ -1734,8 +1739,8 @@ int dwc2_hcd_qh_add(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
+ list_add_tail(&qh->qh_list_entry,
+ &hsotg->non_periodic_sched_waiting);
+ qh->wait_timer_cancel = false;
+- mod_timer(&qh->wait_timer,
+- jiffies + DWC2_RETRY_WAIT_DELAY + 1);
++ delay = ktime_set(0, DWC2_RETRY_WAIT_DELAY);
++ hrtimer_start(&qh->wait_timer, delay, HRTIMER_MODE_REL);
+ } else {
+ list_add_tail(&qh->qh_list_entry,
+ &hsotg->non_periodic_sched_inactive);
+diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
+index bf7052e037d6..ef2c199e6059 100644
+--- a/drivers/usb/dwc2/params.c
++++ b/drivers/usb/dwc2/params.c
+@@ -110,6 +110,7 @@ static void dwc2_set_amlogic_params(struct dwc2_hsotg *hsotg)
+ p->phy_type = DWC2_PHY_TYPE_PARAM_UTMI;
+ p->ahbcfg = GAHBCFG_HBSTLEN_INCR8 <<
+ GAHBCFG_HBSTLEN_SHIFT;
++ p->power_down = DWC2_POWER_DOWN_PARAM_NONE;
+ }
+
+ static void dwc2_set_amcc_params(struct dwc2_hsotg *hsotg)
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 842795856bf4..fdc6e4e403e8 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -170,20 +170,20 @@ static int dwc3_pci_quirks(struct dwc3_pci *dwc)
+ * put the gpio descriptors again here because the phy driver
+ * might want to grab them, too.
+ */
+- gpio = devm_gpiod_get_optional(&pdev->dev, "cs",
+- GPIOD_OUT_LOW);
++ gpio = gpiod_get_optional(&pdev->dev, "cs", GPIOD_OUT_LOW);
+ if (IS_ERR(gpio))
+ return PTR_ERR(gpio);
+
+ gpiod_set_value_cansleep(gpio, 1);
++ gpiod_put(gpio);
+
+- gpio = devm_gpiod_get_optional(&pdev->dev, "reset",
+- GPIOD_OUT_LOW);
++ gpio = gpiod_get_optional(&pdev->dev, "reset", GPIOD_OUT_LOW);
+ if (IS_ERR(gpio))
+ return PTR_ERR(gpio);
+
+ if (gpio) {
+ gpiod_set_value_cansleep(gpio, 1);
++ gpiod_put(gpio);
+ usleep_range(10000, 11000);
+ }
+ }
+diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
+index 984892dd72f5..42668aeca57c 100644
+--- a/drivers/usb/host/r8a66597-hcd.c
++++ b/drivers/usb/host/r8a66597-hcd.c
+@@ -1979,6 +1979,8 @@ static int r8a66597_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
+
+ static void r8a66597_endpoint_disable(struct usb_hcd *hcd,
+ struct usb_host_endpoint *hep)
++__acquires(r8a66597->lock)
++__releases(r8a66597->lock)
+ {
+ struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
+ struct r8a66597_pipe *pipe = (struct r8a66597_pipe *)hep->hcpriv;
+@@ -1991,13 +1993,14 @@ static void r8a66597_endpoint_disable(struct usb_hcd *hcd,
+ return;
+ pipenum = pipe->info.pipenum;
+
++ spin_lock_irqsave(&r8a66597->lock, flags);
+ if (pipenum == 0) {
+ kfree(hep->hcpriv);
+ hep->hcpriv = NULL;
++ spin_unlock_irqrestore(&r8a66597->lock, flags);
+ return;
+ }
+
+- spin_lock_irqsave(&r8a66597->lock, flags);
+ pipe_stop(r8a66597, pipe);
+ pipe_irq_disable(r8a66597, pipenum);
+ disable_irq_empty(r8a66597, pipenum);
+diff --git a/drivers/usb/roles/Kconfig b/drivers/usb/roles/Kconfig
+index f5a5e6f79f1b..e4194ac94510 100644
+--- a/drivers/usb/roles/Kconfig
++++ b/drivers/usb/roles/Kconfig
+@@ -1,3 +1,16 @@
++config USB_ROLE_SWITCH
++ tristate "USB Role Switch Support"
++ help
++ USB Role Switch is a device that can select the USB role - host or
++ device - for a USB port (connector). In most cases dual-role capable
++ USB controller will also represent the switch, but on some platforms
++ multiplexer/demultiplexer switch is used to route the data lines on
++ the USB connector between separate USB host and device controllers.
++
++ Say Y here if your USB connectors support both device and host roles.
++ To compile the driver as module, choose M here: the module will be
++ called roles.ko.
++
+ if USB_ROLE_SWITCH
+
+ config USB_ROLES_INTEL_XHCI
+diff --git a/drivers/usb/roles/Makefile b/drivers/usb/roles/Makefile
+index e44b179ba275..c02873206fc1 100644
+--- a/drivers/usb/roles/Makefile
++++ b/drivers/usb/roles/Makefile
+@@ -1 +1,3 @@
+-obj-$(CONFIG_USB_ROLES_INTEL_XHCI) += intel-xhci-usb-role-switch.o
++obj-$(CONFIG_USB_ROLE_SWITCH) += roles.o
++roles-y := class.o
++obj-$(CONFIG_USB_ROLES_INTEL_XHCI) += intel-xhci-usb-role-switch.o
+diff --git a/drivers/usb/roles/class.c b/drivers/usb/roles/class.c
+new file mode 100644
+index 000000000000..99116af07f1d
+--- /dev/null
++++ b/drivers/usb/roles/class.c
+@@ -0,0 +1,314 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * USB Role Switch Support
++ *
++ * Copyright (C) 2018 Intel Corporation
++ * Author: Heikki Krogerus <heikki.krogerus@linux.intel.com>
++ * Hans de Goede <hdegoede@redhat.com>
++ */
++
++#include <linux/usb/role.h>
++#include <linux/device.h>
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/slab.h>
++
++static struct class *role_class;
++
++struct usb_role_switch {
++ struct device dev;
++ struct mutex lock; /* device lock*/
++ enum usb_role role;
++
++ /* From descriptor */
++ struct device *usb2_port;
++ struct device *usb3_port;
++ struct device *udc;
++ usb_role_switch_set_t set;
++ usb_role_switch_get_t get;
++ bool allow_userspace_control;
++};
++
++#define to_role_switch(d) container_of(d, struct usb_role_switch, dev)
++
++/**
++ * usb_role_switch_set_role - Set USB role for a switch
++ * @sw: USB role switch
++ * @role: USB role to be switched to
++ *
++ * Set USB role @role for @sw.
++ */
++int usb_role_switch_set_role(struct usb_role_switch *sw, enum usb_role role)
++{
++ int ret;
++
++ if (IS_ERR_OR_NULL(sw))
++ return 0;
++
++ mutex_lock(&sw->lock);
++
++ ret = sw->set(sw->dev.parent, role);
++ if (!ret)
++ sw->role = role;
++
++ mutex_unlock(&sw->lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_set_role);
++
++/**
++ * usb_role_switch_get_role - Get the USB role for a switch
++ * @sw: USB role switch
++ *
++ * Depending on the role-switch-driver this function returns either a cached
++ * value of the last set role, or reads back the actual value from the hardware.
++ */
++enum usb_role usb_role_switch_get_role(struct usb_role_switch *sw)
++{
++ enum usb_role role;
++
++ if (IS_ERR_OR_NULL(sw))
++ return USB_ROLE_NONE;
++
++ mutex_lock(&sw->lock);
++
++ if (sw->get)
++ role = sw->get(sw->dev.parent);
++ else
++ role = sw->role;
++
++ mutex_unlock(&sw->lock);
++
++ return role;
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_get_role);
++
++static int __switch_match(struct device *dev, const void *name)
++{
++ return !strcmp((const char *)name, dev_name(dev));
++}
++
++static void *usb_role_switch_match(struct device_connection *con, int ep,
++ void *data)
++{
++ struct device *dev;
++
++ dev = class_find_device(role_class, NULL, con->endpoint[ep],
++ __switch_match);
++
++ return dev ? to_role_switch(dev) : ERR_PTR(-EPROBE_DEFER);
++}
++
++/**
++ * usb_role_switch_get - Find USB role switch linked with the caller
++ * @dev: The caller device
++ *
++ * Finds and returns role switch linked with @dev. The reference count for the
++ * found switch is incremented.
++ */
++struct usb_role_switch *usb_role_switch_get(struct device *dev)
++{
++ struct usb_role_switch *sw;
++
++ sw = device_connection_find_match(dev, "usb-role-switch", NULL,
++ usb_role_switch_match);
++
++ if (!IS_ERR_OR_NULL(sw))
++ WARN_ON(!try_module_get(sw->dev.parent->driver->owner));
++
++ return sw;
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_get);
++
++/**
++ * usb_role_switch_put - Release handle to a switch
++ * @sw: USB Role Switch
++ *
++ * Decrement reference count for @sw.
++ */
++void usb_role_switch_put(struct usb_role_switch *sw)
++{
++ if (!IS_ERR_OR_NULL(sw)) {
++ put_device(&sw->dev);
++ module_put(sw->dev.parent->driver->owner);
++ }
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_put);
++
++static umode_t
++usb_role_switch_is_visible(struct kobject *kobj, struct attribute *attr, int n)
++{
++ struct device *dev = container_of(kobj, typeof(*dev), kobj);
++ struct usb_role_switch *sw = to_role_switch(dev);
++
++ if (sw->allow_userspace_control)
++ return attr->mode;
++
++ return 0;
++}
++
++static const char * const usb_roles[] = {
++ [USB_ROLE_NONE] = "none",
++ [USB_ROLE_HOST] = "host",
++ [USB_ROLE_DEVICE] = "device",
++};
++
++static ssize_t
++role_show(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ struct usb_role_switch *sw = to_role_switch(dev);
++ enum usb_role role = usb_role_switch_get_role(sw);
++
++ return sprintf(buf, "%s\n", usb_roles[role]);
++}
++
++static ssize_t role_store(struct device *dev, struct device_attribute *attr,
++ const char *buf, size_t size)
++{
++ struct usb_role_switch *sw = to_role_switch(dev);
++ int ret;
++
++ ret = sysfs_match_string(usb_roles, buf);
++ if (ret < 0) {
++ bool res;
++
++ /* Extra check if the user wants to disable the switch */
++ ret = kstrtobool(buf, &res);
++ if (ret || res)
++ return -EINVAL;
++ }
++
++ ret = usb_role_switch_set_role(sw, ret);
++ if (ret)
++ return ret;
++
++ return size;
++}
++static DEVICE_ATTR_RW(role);
++
++static struct attribute *usb_role_switch_attrs[] = {
++ &dev_attr_role.attr,
++ NULL,
++};
++
++static const struct attribute_group usb_role_switch_group = {
++ .is_visible = usb_role_switch_is_visible,
++ .attrs = usb_role_switch_attrs,
++};
++
++static const struct attribute_group *usb_role_switch_groups[] = {
++ &usb_role_switch_group,
++ NULL,
++};
++
++static int
++usb_role_switch_uevent(struct device *dev, struct kobj_uevent_env *env)
++{
++ int ret;
++
++ ret = add_uevent_var(env, "USB_ROLE_SWITCH=%s", dev_name(dev));
++ if (ret)
++ dev_err(dev, "failed to add uevent USB_ROLE_SWITCH\n");
++
++ return ret;
++}
++
++static void usb_role_switch_release(struct device *dev)
++{
++ struct usb_role_switch *sw = to_role_switch(dev);
++
++ kfree(sw);
++}
++
++static const struct device_type usb_role_dev_type = {
++ .name = "usb_role_switch",
++ .groups = usb_role_switch_groups,
++ .uevent = usb_role_switch_uevent,
++ .release = usb_role_switch_release,
++};
++
++/**
++ * usb_role_switch_register - Register USB Role Switch
++ * @parent: Parent device for the switch
++ * @desc: Description of the switch
++ *
++ * USB Role Switch is a device capable or choosing the role for USB connector.
++ * On platforms where the USB controller is dual-role capable, the controller
++ * driver will need to register the switch. On platforms where the USB host and
++ * USB device controllers behind the connector are separate, there will be a
++ * mux, and the driver for that mux will need to register the switch.
++ *
++ * Returns handle to a new role switch or ERR_PTR. The content of @desc is
++ * copied.
++ */
++struct usb_role_switch *
++usb_role_switch_register(struct device *parent,
++ const struct usb_role_switch_desc *desc)
++{
++ struct usb_role_switch *sw;
++ int ret;
++
++ if (!desc || !desc->set)
++ return ERR_PTR(-EINVAL);
++
++ sw = kzalloc(sizeof(*sw), GFP_KERNEL);
++ if (!sw)
++ return ERR_PTR(-ENOMEM);
++
++ mutex_init(&sw->lock);
++
++ sw->allow_userspace_control = desc->allow_userspace_control;
++ sw->usb2_port = desc->usb2_port;
++ sw->usb3_port = desc->usb3_port;
++ sw->udc = desc->udc;
++ sw->set = desc->set;
++ sw->get = desc->get;
++
++ sw->dev.parent = parent;
++ sw->dev.class = role_class;
++ sw->dev.type = &usb_role_dev_type;
++ dev_set_name(&sw->dev, "%s-role-switch", dev_name(parent));
++
++ ret = device_register(&sw->dev);
++ if (ret) {
++ put_device(&sw->dev);
++ return ERR_PTR(ret);
++ }
++
++ /* TODO: Symlinks for the host port and the device controller. */
++
++ return sw;
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_register);
++
++/**
++ * usb_role_switch_unregister - Unregsiter USB Role Switch
++ * @sw: USB Role Switch
++ *
++ * Unregister switch that was registered with usb_role_switch_register().
++ */
++void usb_role_switch_unregister(struct usb_role_switch *sw)
++{
++ if (!IS_ERR_OR_NULL(sw))
++ device_unregister(&sw->dev);
++}
++EXPORT_SYMBOL_GPL(usb_role_switch_unregister);
++
++static int __init usb_roles_init(void)
++{
++ role_class = class_create(THIS_MODULE, "usb_role");
++ return PTR_ERR_OR_ZERO(role_class);
++}
++subsys_initcall(usb_roles_init);
++
++static void __exit usb_roles_exit(void)
++{
++ class_destroy(role_class);
++}
++module_exit(usb_roles_exit);
++
++MODULE_AUTHOR("Heikki Krogerus <heikki.krogerus@linux.intel.com>");
++MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("USB Role Class");
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 17787dc349f8..fb544340888b 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1955,6 +1955,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
+ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */
+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
++ { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */
++ .driver_info = RSVD(4) | RSVD(5) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */
++ .driver_info = RSVD(6) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index e41f725ac7aa..d5b38f096698 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -91,9 +91,14 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
+ { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) },
+ { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
+ { USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
+ { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 26965cc23c17..4e2554d55362 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -119,10 +119,15 @@
+
+ /* Hewlett-Packard POS Pole Displays */
+ #define HP_VENDOR_ID 0x03f0
++#define HP_LM920_PRODUCT_ID 0x026b
++#define HP_TD620_PRODUCT_ID 0x0956
+ #define HP_LD960_PRODUCT_ID 0x0b39
+ #define HP_LCM220_PRODUCT_ID 0x3139
+ #define HP_LCM960_PRODUCT_ID 0x3239
+ #define HP_LD220_PRODUCT_ID 0x3524
++#define HP_LD220TA_PRODUCT_ID 0x4349
++#define HP_LD960TA_PRODUCT_ID 0x4439
++#define HP_LM940_PRODUCT_ID 0x5039
+
+ /* Cressi Edy (diving computer) PC interface */
+ #define CRESSI_VENDOR_ID 0x04b8
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index eb95daa3e5a5..55e5aa662ad5 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -2233,6 +2233,8 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
+ return -EFAULT;
+ }
+ if (unlikely(vq->log_used)) {
++ /* Make sure used idx is seen before log. */
++ smp_wmb();
+ /* Log used index update. */
+ log_write(vq->log_base,
+ vq->log_addr + offsetof(struct vring_used, idx),
+diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
+index 1343ac57b438..7177d1d33584 100644
+--- a/fs/btrfs/btrfs_inode.h
++++ b/fs/btrfs/btrfs_inode.h
+@@ -146,6 +146,12 @@ struct btrfs_inode {
+ */
+ u64 last_unlink_trans;
+
++ /*
++ * Track the transaction id of the last transaction used to create a
++ * hard link for the inode. This is used by the log tree (fsync).
++ */
++ u64 last_link_trans;
++
+ /*
+ * Number of bytes outstanding that are going to need csums. This is
+ * used in ENOSPC accounting.
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 089b46c4d97f..fa18520529f3 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -2624,14 +2624,27 @@ static struct extent_buffer *btrfs_search_slot_get_root(struct btrfs_root *root,
+ root_lock = BTRFS_READ_LOCK;
+
+ if (p->search_commit_root) {
+- /* The commit roots are read only so we always do read locks */
+- if (p->need_commit_sem)
++ /*
++ * The commit roots are read only so we always do read locks,
++ * and we always must hold the commit_root_sem when doing
++ * searches on them, the only exception is send where we don't
++ * want to block transaction commits for a long time, so
++ * we need to clone the commit root in order to avoid races
++ * with transaction commits that create a snapshot of one of
++ * the roots used by a send operation.
++ */
++ if (p->need_commit_sem) {
+ down_read(&fs_info->commit_root_sem);
+- b = root->commit_root;
+- extent_buffer_get(b);
+- level = btrfs_header_level(b);
+- if (p->need_commit_sem)
++ b = btrfs_clone_extent_buffer(root->commit_root);
+ up_read(&fs_info->commit_root_sem);
++ if (!b)
++ return ERR_PTR(-ENOMEM);
++
++ } else {
++ b = root->commit_root;
++ extent_buffer_get(b);
++ }
++ level = btrfs_header_level(b);
+ /*
+ * Ensure that all callers have set skip_locking when
+ * p->search_commit_root = 1.
+@@ -2757,6 +2770,10 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ again:
+ prev_cmp = -1;
+ b = btrfs_search_slot_get_root(root, p, write_lock_level);
++ if (IS_ERR(b)) {
++ ret = PTR_ERR(b);
++ goto done;
++ }
+
+ while (b) {
+ level = btrfs_header_level(b);
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index 981434764bb9..b2b283e48439 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -887,6 +887,8 @@ int btrfs_resume_dev_replace_async(struct btrfs_fs_info *fs_info)
+ "cannot continue dev_replace, tgtdev is missing");
+ btrfs_info(fs_info,
+ "you may cancel the operation after 'mount -o degraded'");
++ dev_replace->replace_state =
++ BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED;
+ btrfs_dev_replace_write_unlock(dev_replace);
+ return 0;
+ }
+@@ -898,6 +900,10 @@ int btrfs_resume_dev_replace_async(struct btrfs_fs_info *fs_info)
+ * dev-replace to start anyway.
+ */
+ if (test_and_set_bit(BTRFS_FS_EXCL_OP, &fs_info->flags)) {
++ btrfs_dev_replace_write_lock(dev_replace);
++ dev_replace->replace_state =
++ BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED;
++ btrfs_dev_replace_write_unlock(dev_replace);
+ btrfs_info(fs_info,
+ "cannot resume dev-replace, other exclusive operation running");
+ return 0;
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 51e41e53d4ae..a16760b410b1 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -8911,6 +8911,10 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
+ goto out_free;
+ }
+
++ err = btrfs_run_delayed_items(trans);
++ if (err)
++ goto out_end_trans;
++
+ if (block_rsv)
+ trans->block_rsv = block_rsv;
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 7158b5b77c9d..14c85e61134d 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1373,7 +1373,8 @@ next_slot:
+ * Do the same check as in btrfs_cross_ref_exist but
+ * without the unnecessary search.
+ */
+- if (btrfs_file_extent_generation(leaf, fi) <=
++ if (!nolock &&
++ btrfs_file_extent_generation(leaf, fi) <=
+ btrfs_root_last_snapshot(&root->root_item))
+ goto out_check;
+ if (extent_type == BTRFS_FILE_EXTENT_REG && !force)
+@@ -3688,6 +3689,21 @@ cache_index:
+ * inode is not a directory, logging its parent unnecessarily.
+ */
+ BTRFS_I(inode)->last_unlink_trans = BTRFS_I(inode)->last_trans;
++ /*
++ * Similar reasoning for last_link_trans, needs to be set otherwise
++ * for a case like the following:
++ *
++ * mkdir A
++ * touch foo
++ * ln foo A/bar
++ * echo 2 > /proc/sys/vm/drop_caches
++ * fsync foo
++ * <power failure>
++ *
++ * Would result in link bar and directory A not existing after the power
++ * failure.
++ */
++ BTRFS_I(inode)->last_link_trans = BTRFS_I(inode)->last_trans;
+
+ path->slots[0]++;
+ if (inode->i_nlink != 1 ||
+@@ -6646,6 +6662,7 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
+ if (err)
+ goto fail;
+ }
++ BTRFS_I(inode)->last_link_trans = trans->transid;
+ d_instantiate(dentry, inode);
+ ret = btrfs_log_new_name(trans, BTRFS_I(inode), NULL, parent,
+ true, NULL);
+@@ -9174,6 +9191,7 @@ struct inode *btrfs_alloc_inode(struct super_block *sb)
+ ei->index_cnt = (u64)-1;
+ ei->dir_index = 0;
+ ei->last_unlink_trans = 0;
++ ei->last_link_trans = 0;
+ ei->last_log_commit = 0;
+
+ spin_lock_init(&ei->lock);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 16ecb76fa53c..0805f8c5e72d 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -5781,6 +5781,22 @@ static int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
+ goto end_trans;
+ }
+
++ /*
++ * If a new hard link was added to the inode in the current transaction
++ * and its link count is now greater than 1, we need to fallback to a
++ * transaction commit, otherwise we can end up not logging all its new
++ * parents for all the hard links. Here just from the dentry used to
++ * fsync, we can not visit the ancestor inodes for all the other hard
++ * links to figure out if any is new, so we fallback to a transaction
++ * commit (instead of adding a lot of complexity of scanning a btree,
++ * since this scenario is not a common use case).
++ */
++ if (inode->vfs_inode.i_nlink > 1 &&
++ inode->last_link_trans > last_committed) {
++ ret = -EMLINK;
++ goto end_trans;
++ }
++
+ while (1) {
+ if (!parent || d_really_is_negative(parent) || sb != parent->d_sb)
+ break;
+diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c
+index 20a2d304c603..c3ae8c1d6089 100644
+--- a/fs/cifs/smb2maperror.c
++++ b/fs/cifs/smb2maperror.c
+@@ -379,8 +379,8 @@ static const struct status_to_posix_error smb2_error_map_table[] = {
+ {STATUS_NONEXISTENT_EA_ENTRY, -EIO, "STATUS_NONEXISTENT_EA_ENTRY"},
+ {STATUS_NO_EAS_ON_FILE, -ENODATA, "STATUS_NO_EAS_ON_FILE"},
+ {STATUS_EA_CORRUPT_ERROR, -EIO, "STATUS_EA_CORRUPT_ERROR"},
+- {STATUS_FILE_LOCK_CONFLICT, -EIO, "STATUS_FILE_LOCK_CONFLICT"},
+- {STATUS_LOCK_NOT_GRANTED, -EIO, "STATUS_LOCK_NOT_GRANTED"},
++ {STATUS_FILE_LOCK_CONFLICT, -EACCES, "STATUS_FILE_LOCK_CONFLICT"},
++ {STATUS_LOCK_NOT_GRANTED, -EACCES, "STATUS_LOCK_NOT_GRANTED"},
+ {STATUS_DELETE_PENDING, -ENOENT, "STATUS_DELETE_PENDING"},
+ {STATUS_CTL_FILE_NOT_SUPPORTED, -ENOSYS,
+ "STATUS_CTL_FILE_NOT_SUPPORTED"},
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 812da3e56a22..f44bb4a304e9 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -3184,8 +3184,10 @@ smb3_receive_transform(struct TCP_Server_Info *server,
+ }
+
+ /* TODO: add support for compounds containing READ. */
+- if (pdu_length > CIFSMaxBufSize + MAX_HEADER_SIZE(server))
++ if (pdu_length > CIFSMaxBufSize + MAX_HEADER_SIZE(server)) {
++ *num_mids = 1;
+ return receive_encrypted_read(server, &mids[0]);
++ }
+
+ return receive_encrypted_standard(server, mids, bufs, num_mids);
+ }
+diff --git a/fs/dax.c b/fs/dax.c
+index 3a2682a6c832..09fa70683c41 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -229,8 +229,8 @@ static void put_unlocked_mapping_entry(struct address_space *mapping,
+ *
+ * Must be called with the i_pages lock held.
+ */
+-static void *__get_unlocked_mapping_entry(struct address_space *mapping,
+- pgoff_t index, void ***slotp, bool (*wait_fn)(void))
++static void *get_unlocked_mapping_entry(struct address_space *mapping,
++ pgoff_t index, void ***slotp)
+ {
+ void *entry, **slot;
+ struct wait_exceptional_entry_queue ewait;
+@@ -240,8 +240,6 @@ static void *__get_unlocked_mapping_entry(struct address_space *mapping,
+ ewait.wait.func = wake_exceptional_entry_func;
+
+ for (;;) {
+- bool revalidate;
+-
+ entry = __radix_tree_lookup(&mapping->i_pages, index, NULL,
+ &slot);
+ if (!entry ||
+@@ -256,30 +254,37 @@ static void *__get_unlocked_mapping_entry(struct address_space *mapping,
+ prepare_to_wait_exclusive(wq, &ewait.wait,
+ TASK_UNINTERRUPTIBLE);
+ xa_unlock_irq(&mapping->i_pages);
+- revalidate = wait_fn();
++ schedule();
+ finish_wait(wq, &ewait.wait);
+ xa_lock_irq(&mapping->i_pages);
+- if (revalidate) {
+- put_unlocked_mapping_entry(mapping, index, entry);
+- return ERR_PTR(-EAGAIN);
+- }
+ }
+ }
+
+-static bool entry_wait(void)
++/*
++ * The only thing keeping the address space around is the i_pages lock
++ * (it's cycled in clear_inode() after removing the entries from i_pages)
++ * After we call xas_unlock_irq(), we cannot touch xas->xa.
++ */
++static void wait_entry_unlocked(struct address_space *mapping, pgoff_t index,
++ void ***slotp, void *entry)
+ {
+- schedule();
++ struct wait_exceptional_entry_queue ewait;
++ wait_queue_head_t *wq;
++
++ init_wait(&ewait.wait);
++ ewait.wait.func = wake_exceptional_entry_func;
++
++ wq = dax_entry_waitqueue(mapping, index, entry, &ewait.key);
+ /*
+- * Never return an ERR_PTR() from
+- * __get_unlocked_mapping_entry(), just keep looping.
++ * Unlike get_unlocked_entry() there is no guarantee that this
++ * path ever successfully retrieves an unlocked entry before an
++ * inode dies. Perform a non-exclusive wait in case this path
++ * never successfully performs its own wake up.
+ */
+- return false;
+-}
+-
+-static void *get_unlocked_mapping_entry(struct address_space *mapping,
+- pgoff_t index, void ***slotp)
+-{
+- return __get_unlocked_mapping_entry(mapping, index, slotp, entry_wait);
++ prepare_to_wait(wq, &ewait.wait, TASK_UNINTERRUPTIBLE);
++ xa_unlock_irq(&mapping->i_pages);
++ schedule();
++ finish_wait(wq, &ewait.wait);
+ }
+
+ static void unlock_mapping_entry(struct address_space *mapping, pgoff_t index)
+@@ -398,19 +403,6 @@ static struct page *dax_busy_page(void *entry)
+ return NULL;
+ }
+
+-static bool entry_wait_revalidate(void)
+-{
+- rcu_read_unlock();
+- schedule();
+- rcu_read_lock();
+-
+- /*
+- * Tell __get_unlocked_mapping_entry() to take a break, we need
+- * to revalidate page->mapping after dropping locks
+- */
+- return true;
+-}
+-
+ bool dax_lock_mapping_entry(struct page *page)
+ {
+ pgoff_t index;
+@@ -446,14 +438,15 @@ bool dax_lock_mapping_entry(struct page *page)
+ }
+ index = page->index;
+
+- entry = __get_unlocked_mapping_entry(mapping, index, &slot,
+- entry_wait_revalidate);
++ entry = __radix_tree_lookup(&mapping->i_pages, index,
++ NULL, &slot);
+ if (!entry) {
+ xa_unlock_irq(&mapping->i_pages);
+ break;
+- } else if (IS_ERR(entry)) {
+- xa_unlock_irq(&mapping->i_pages);
+- WARN_ON_ONCE(PTR_ERR(entry) != -EAGAIN);
++ } else if (slot_locked(mapping, slot)) {
++ rcu_read_unlock();
++ wait_entry_unlocked(mapping, index, &slot, entry);
++ rcu_read_lock();
+ continue;
+ }
+ lock_slot(mapping, slot);
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 5cfb1e2f6a5b..032cf9b92665 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -2459,8 +2459,19 @@ int do_journal_get_write_access(handle_t *handle,
+ #define FALL_BACK_TO_NONDELALLOC 1
+ #define CONVERT_INLINE_DATA 2
+
+-extern struct inode *ext4_iget(struct super_block *, unsigned long);
+-extern struct inode *ext4_iget_normal(struct super_block *, unsigned long);
++typedef enum {
++ EXT4_IGET_NORMAL = 0,
++ EXT4_IGET_SPECIAL = 0x0001, /* OK to iget a system inode */
++ EXT4_IGET_HANDLE = 0x0002 /* Inode # is from a handle */
++} ext4_iget_flags;
++
++extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
++ ext4_iget_flags flags, const char *function,
++ unsigned int line);
++
++#define ext4_iget(sb, ino, flags) \
++ __ext4_iget((sb), (ino), (flags), __func__, __LINE__)
++
+ extern int ext4_write_inode(struct inode *, struct writeback_control *);
+ extern int ext4_setattr(struct dentry *, struct iattr *);
+ extern int ext4_getattr(const struct path *, struct kstat *, u32, unsigned int);
+@@ -2542,6 +2553,8 @@ extern int ext4_group_extend(struct super_block *sb,
+ extern int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count);
+
+ /* super.c */
++extern struct buffer_head *ext4_sb_bread(struct super_block *sb,
++ sector_t block, int op_flags);
+ extern int ext4_seq_options_show(struct seq_file *seq, void *offset);
+ extern int ext4_calculate_overhead(struct super_block *sb);
+ extern void ext4_superblock_csum_set(struct super_block *sb);
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 2addcb8730e1..091a18a51c99 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -1225,7 +1225,7 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
+ if (!ext4_test_bit(bit, bitmap_bh->b_data))
+ goto bad_orphan;
+
+- inode = ext4_iget(sb, ino);
++ inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL);
+ if (IS_ERR(inode)) {
+ err = PTR_ERR(inode);
+ ext4_error(sb, "couldn't read orphan inode %lu (err %d)",
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 9c4bac18cc6c..27373d88b5f0 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -705,8 +705,11 @@ int ext4_try_to_write_inline_data(struct address_space *mapping,
+
+ if (!PageUptodate(page)) {
+ ret = ext4_read_inline_page(inode, page);
+- if (ret < 0)
++ if (ret < 0) {
++ unlock_page(page);
++ put_page(page);
+ goto out_up_read;
++ }
+ }
+
+ ret = 1;
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 244531d3065a..36abbdafb26e 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4786,7 +4786,9 @@ static inline u64 ext4_inode_peek_iversion(const struct inode *inode)
+ return inode_peek_iversion(inode);
+ }
+
+-struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
++struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
++ ext4_iget_flags flags, const char *function,
++ unsigned int line)
+ {
+ struct ext4_iloc iloc;
+ struct ext4_inode *raw_inode;
+@@ -4800,6 +4802,18 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
+ gid_t i_gid;
+ projid_t i_projid;
+
++ if (((flags & EXT4_IGET_NORMAL) &&
++ (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) ||
++ (ino < EXT4_ROOT_INO) ||
++ (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) {
++ if (flags & EXT4_IGET_HANDLE)
++ return ERR_PTR(-ESTALE);
++ __ext4_error(sb, function, line,
++ "inode #%lu: comm %s: iget: illegal inode #",
++ ino, current->comm);
++ return ERR_PTR(-EFSCORRUPTED);
++ }
++
+ inode = iget_locked(sb, ino);
+ if (!inode)
+ return ERR_PTR(-ENOMEM);
+@@ -4815,18 +4829,26 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
+ raw_inode = ext4_raw_inode(&iloc);
+
+ if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) {
+- EXT4_ERROR_INODE(inode, "root inode unallocated");
++ ext4_error_inode(inode, function, line, 0,
++ "iget: root inode unallocated");
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+ }
+
++ if ((flags & EXT4_IGET_HANDLE) &&
++ (raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) {
++ ret = -ESTALE;
++ goto bad_inode;
++ }
++
+ if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
+ ei->i_extra_isize = le16_to_cpu(raw_inode->i_extra_isize);
+ if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize >
+ EXT4_INODE_SIZE(inode->i_sb) ||
+ (ei->i_extra_isize & 3)) {
+- EXT4_ERROR_INODE(inode,
+- "bad extra_isize %u (inode size %u)",
++ ext4_error_inode(inode, function, line, 0,
++ "iget: bad extra_isize %u "
++ "(inode size %u)",
+ ei->i_extra_isize,
+ EXT4_INODE_SIZE(inode->i_sb));
+ ret = -EFSCORRUPTED;
+@@ -4848,7 +4870,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
+ }
+
+ if (!ext4_inode_csum_verify(inode, raw_inode, ei)) {
+- EXT4_ERROR_INODE(inode, "checksum invalid");
++ ext4_error_inode(inode, function, line, 0,
++ "iget: checksum invalid");
+ ret = -EFSBADCRC;
+ goto bad_inode;
+ }
+@@ -4905,7 +4928,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
+ ((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32;
+ inode->i_size = ext4_isize(sb, raw_inode);
+ if ((size = i_size_read(inode)) < 0) {
+- EXT4_ERROR_INODE(inode, "bad i_size value: %lld", size);
++ ext4_error_inode(inode, function, line, 0,
++ "iget: bad i_size value: %lld", size);
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+ }
+@@ -4981,7 +5005,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
+ ret = 0;
+ if (ei->i_file_acl &&
+ !ext4_data_block_valid(EXT4_SB(sb), ei->i_file_acl, 1)) {
+- EXT4_ERROR_INODE(inode, "bad extended attribute block %llu",
++ ext4_error_inode(inode, function, line, 0,
++ "iget: bad extended attribute block %llu",
+ ei->i_file_acl);
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+@@ -5009,8 +5034,9 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
+ } else if (S_ISLNK(inode->i_mode)) {
+ /* VFS does not allow setting these so must be corruption */
+ if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) {
+- EXT4_ERROR_INODE(inode,
+- "immutable or append flags not allowed on symlinks");
++ ext4_error_inode(inode, function, line, 0,
++ "iget: immutable or append flags "
++ "not allowed on symlinks");
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+ }
+@@ -5040,7 +5066,8 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
+ make_bad_inode(inode);
+ } else {
+ ret = -EFSCORRUPTED;
+- EXT4_ERROR_INODE(inode, "bogus i_mode (%o)", inode->i_mode);
++ ext4_error_inode(inode, function, line, 0,
++ "iget: bogus i_mode (%o)", inode->i_mode);
+ goto bad_inode;
+ }
+ brelse(iloc.bh);
+@@ -5054,13 +5081,6 @@ bad_inode:
+ return ERR_PTR(ret);
+ }
+
+-struct inode *ext4_iget_normal(struct super_block *sb, unsigned long ino)
+-{
+- if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)
+- return ERR_PTR(-EFSCORRUPTED);
+- return ext4_iget(sb, ino);
+-}
+-
+ static int ext4_inode_blocks_set(handle_t *handle,
+ struct ext4_inode *raw_inode,
+ struct ext4_inode_info *ei)
+@@ -5349,9 +5369,13 @@ int ext4_write_inode(struct inode *inode, struct writeback_control *wbc)
+ {
+ int err;
+
+- if (WARN_ON_ONCE(current->flags & PF_MEMALLOC))
++ if (WARN_ON_ONCE(current->flags & PF_MEMALLOC) ||
++ sb_rdonly(inode->i_sb))
+ return 0;
+
++ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
++ return -EIO;
++
+ if (EXT4_SB(inode->i_sb)->s_journal) {
+ if (ext4_journal_current_handle()) {
+ jbd_debug(1, "called recursively, non-PF_MEMALLOC!\n");
+@@ -5367,7 +5391,8 @@ int ext4_write_inode(struct inode *inode, struct writeback_control *wbc)
+ if (wbc->sync_mode != WB_SYNC_ALL || wbc->for_sync)
+ return 0;
+
+- err = ext4_force_commit(inode->i_sb);
++ err = jbd2_complete_transaction(EXT4_SB(inode->i_sb)->s_journal,
++ EXT4_I(inode)->i_sync_tid);
+ } else {
+ struct ext4_iloc iloc;
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 0edee31913d1..d37dafa1d133 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -125,7 +125,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ !inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+- inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO);
++ inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO, EXT4_IGET_SPECIAL);
+ if (IS_ERR(inode_bl))
+ return PTR_ERR(inode_bl);
+ ei_bl = EXT4_I(inode_bl);
+diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
+index 61a9d1927817..a98bfca9c463 100644
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -116,9 +116,9 @@ static int update_ind_extent_range(handle_t *handle, struct inode *inode,
+ int i, retval = 0;
+ unsigned long max_entries = inode->i_sb->s_blocksize >> 2;
+
+- bh = sb_bread(inode->i_sb, pblock);
+- if (!bh)
+- return -EIO;
++ bh = ext4_sb_bread(inode->i_sb, pblock, 0);
++ if (IS_ERR(bh))
++ return PTR_ERR(bh);
+
+ i_data = (__le32 *)bh->b_data;
+ for (i = 0; i < max_entries; i++) {
+@@ -145,9 +145,9 @@ static int update_dind_extent_range(handle_t *handle, struct inode *inode,
+ int i, retval = 0;
+ unsigned long max_entries = inode->i_sb->s_blocksize >> 2;
+
+- bh = sb_bread(inode->i_sb, pblock);
+- if (!bh)
+- return -EIO;
++ bh = ext4_sb_bread(inode->i_sb, pblock, 0);
++ if (IS_ERR(bh))
++ return PTR_ERR(bh);
+
+ i_data = (__le32 *)bh->b_data;
+ for (i = 0; i < max_entries; i++) {
+@@ -175,9 +175,9 @@ static int update_tind_extent_range(handle_t *handle, struct inode *inode,
+ int i, retval = 0;
+ unsigned long max_entries = inode->i_sb->s_blocksize >> 2;
+
+- bh = sb_bread(inode->i_sb, pblock);
+- if (!bh)
+- return -EIO;
++ bh = ext4_sb_bread(inode->i_sb, pblock, 0);
++ if (IS_ERR(bh))
++ return PTR_ERR(bh);
+
+ i_data = (__le32 *)bh->b_data;
+ for (i = 0; i < max_entries; i++) {
+@@ -224,9 +224,9 @@ static int free_dind_blocks(handle_t *handle,
+ struct buffer_head *bh;
+ unsigned long max_entries = inode->i_sb->s_blocksize >> 2;
+
+- bh = sb_bread(inode->i_sb, le32_to_cpu(i_data));
+- if (!bh)
+- return -EIO;
++ bh = ext4_sb_bread(inode->i_sb, le32_to_cpu(i_data), 0);
++ if (IS_ERR(bh))
++ return PTR_ERR(bh);
+
+ tmp_idata = (__le32 *)bh->b_data;
+ for (i = 0; i < max_entries; i++) {
+@@ -254,9 +254,9 @@ static int free_tind_blocks(handle_t *handle,
+ struct buffer_head *bh;
+ unsigned long max_entries = inode->i_sb->s_blocksize >> 2;
+
+- bh = sb_bread(inode->i_sb, le32_to_cpu(i_data));
+- if (!bh)
+- return -EIO;
++ bh = ext4_sb_bread(inode->i_sb, le32_to_cpu(i_data), 0);
++ if (IS_ERR(bh))
++ return PTR_ERR(bh);
+
+ tmp_idata = (__le32 *)bh->b_data;
+ for (i = 0; i < max_entries; i++) {
+@@ -382,9 +382,9 @@ static int free_ext_idx(handle_t *handle, struct inode *inode,
+ struct ext4_extent_header *eh;
+
+ block = ext4_idx_pblock(ix);
+- bh = sb_bread(inode->i_sb, block);
+- if (!bh)
+- return -EIO;
++ bh = ext4_sb_bread(inode->i_sb, block, 0);
++ if (IS_ERR(bh))
++ return PTR_ERR(bh);
+
+ eh = (struct ext4_extent_header *)bh->b_data;
+ if (eh->eh_depth != 0) {
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index ffa25753e929..4f8de2b9e87e 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1571,7 +1571,7 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi
+ dentry);
+ return ERR_PTR(-EFSCORRUPTED);
+ }
+- inode = ext4_iget_normal(dir->i_sb, ino);
++ inode = ext4_iget(dir->i_sb, ino, EXT4_IGET_NORMAL);
+ if (inode == ERR_PTR(-ESTALE)) {
+ EXT4_ERROR_INODE(dir,
+ "deleted inode referenced: %u",
+@@ -1613,7 +1613,7 @@ struct dentry *ext4_get_parent(struct dentry *child)
+ return ERR_PTR(-EFSCORRUPTED);
+ }
+
+- return d_obtain_alias(ext4_iget_normal(child->d_sb, ino));
++ return d_obtain_alias(ext4_iget(child->d_sb, ino, EXT4_IGET_NORMAL));
+ }
+
+ /*
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index a5efee34415f..48421de803b7 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -127,10 +127,12 @@ static int verify_group_input(struct super_block *sb,
+ else if (free_blocks_count < 0)
+ ext4_warning(sb, "Bad blocks count %u",
+ input->blocks_count);
+- else if (!(bh = sb_bread(sb, end - 1)))
++ else if (IS_ERR(bh = ext4_sb_bread(sb, end - 1, 0))) {
++ err = PTR_ERR(bh);
++ bh = NULL;
+ ext4_warning(sb, "Cannot read last block (%llu)",
+ end - 1);
+- else if (outside(input->block_bitmap, start, end))
++ } else if (outside(input->block_bitmap, start, end))
+ ext4_warning(sb, "Block bitmap not in group (block %llu)",
+ (unsigned long long)input->block_bitmap);
+ else if (outside(input->inode_bitmap, start, end))
+@@ -781,11 +783,11 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+ unsigned long gdb_num = group / EXT4_DESC_PER_BLOCK(sb);
+ ext4_fsblk_t gdblock = EXT4_SB(sb)->s_sbh->b_blocknr + 1 + gdb_num;
+- struct buffer_head **o_group_desc, **n_group_desc;
+- struct buffer_head *dind;
+- struct buffer_head *gdb_bh;
++ struct buffer_head **o_group_desc, **n_group_desc = NULL;
++ struct buffer_head *dind = NULL;
++ struct buffer_head *gdb_bh = NULL;
+ int gdbackups;
+- struct ext4_iloc iloc;
++ struct ext4_iloc iloc = { .bh = NULL };
+ __le32 *data;
+ int err;
+
+@@ -794,21 +796,22 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ "EXT4-fs: ext4_add_new_gdb: adding group block %lu\n",
+ gdb_num);
+
+- gdb_bh = sb_bread(sb, gdblock);
+- if (!gdb_bh)
+- return -EIO;
++ gdb_bh = ext4_sb_bread(sb, gdblock, 0);
++ if (IS_ERR(gdb_bh))
++ return PTR_ERR(gdb_bh);
+
+ gdbackups = verify_reserved_gdb(sb, group, gdb_bh);
+ if (gdbackups < 0) {
+ err = gdbackups;
+- goto exit_bh;
++ goto errout;
+ }
+
+ data = EXT4_I(inode)->i_data + EXT4_DIND_BLOCK;
+- dind = sb_bread(sb, le32_to_cpu(*data));
+- if (!dind) {
+- err = -EIO;
+- goto exit_bh;
++ dind = ext4_sb_bread(sb, le32_to_cpu(*data), 0);
++ if (IS_ERR(dind)) {
++ err = PTR_ERR(dind);
++ dind = NULL;
++ goto errout;
+ }
+
+ data = (__le32 *)dind->b_data;
+@@ -816,18 +819,18 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ ext4_warning(sb, "new group %u GDT block %llu not reserved",
+ group, gdblock);
+ err = -EINVAL;
+- goto exit_dind;
++ goto errout;
+ }
+
+ BUFFER_TRACE(EXT4_SB(sb)->s_sbh, "get_write_access");
+ err = ext4_journal_get_write_access(handle, EXT4_SB(sb)->s_sbh);
+ if (unlikely(err))
+- goto exit_dind;
++ goto errout;
+
+ BUFFER_TRACE(gdb_bh, "get_write_access");
+ err = ext4_journal_get_write_access(handle, gdb_bh);
+ if (unlikely(err))
+- goto exit_dind;
++ goto errout;
+
+ BUFFER_TRACE(dind, "get_write_access");
+ err = ext4_journal_get_write_access(handle, dind);
+@@ -837,7 +840,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ /* ext4_reserve_inode_write() gets a reference on the iloc */
+ err = ext4_reserve_inode_write(handle, inode, &iloc);
+ if (unlikely(err))
+- goto exit_dind;
++ goto errout;
+
+ n_group_desc = ext4_kvmalloc((gdb_num + 1) *
+ sizeof(struct buffer_head *),
+@@ -846,7 +849,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ err = -ENOMEM;
+ ext4_warning(sb, "not enough memory for %lu groups",
+ gdb_num + 1);
+- goto exit_inode;
++ goto errout;
+ }
+
+ /*
+@@ -862,7 +865,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ err = ext4_handle_dirty_metadata(handle, NULL, dind);
+ if (unlikely(err)) {
+ ext4_std_error(sb, err);
+- goto exit_inode;
++ goto errout;
+ }
+ inode->i_blocks -= (gdbackups + 1) * sb->s_blocksize >>
+ (9 - EXT4_SB(sb)->s_cluster_bits);
+@@ -871,8 +874,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ err = ext4_handle_dirty_metadata(handle, NULL, gdb_bh);
+ if (unlikely(err)) {
+ ext4_std_error(sb, err);
+- iloc.bh = NULL;
+- goto exit_inode;
++ goto errout;
+ }
+ brelse(dind);
+
+@@ -888,15 +890,11 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ err = ext4_handle_dirty_super(handle, sb);
+ if (err)
+ ext4_std_error(sb, err);
+-
+ return err;
+-
+-exit_inode:
++errout:
+ kvfree(n_group_desc);
+ brelse(iloc.bh);
+-exit_dind:
+ brelse(dind);
+-exit_bh:
+ brelse(gdb_bh);
+
+ ext4_debug("leaving with error %d\n", err);
+@@ -916,9 +914,9 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
+
+ gdblock = ext4_meta_bg_first_block_no(sb, group) +
+ ext4_bg_has_super(sb, group);
+- gdb_bh = sb_bread(sb, gdblock);
+- if (!gdb_bh)
+- return -EIO;
++ gdb_bh = ext4_sb_bread(sb, gdblock, 0);
++ if (IS_ERR(gdb_bh))
++ return PTR_ERR(gdb_bh);
+ n_group_desc = ext4_kvmalloc((gdb_num + 1) *
+ sizeof(struct buffer_head *),
+ GFP_NOFS);
+@@ -975,9 +973,10 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
+ return -ENOMEM;
+
+ data = EXT4_I(inode)->i_data + EXT4_DIND_BLOCK;
+- dind = sb_bread(sb, le32_to_cpu(*data));
+- if (!dind) {
+- err = -EIO;
++ dind = ext4_sb_bread(sb, le32_to_cpu(*data), 0);
++ if (IS_ERR(dind)) {
++ err = PTR_ERR(dind);
++ dind = NULL;
+ goto exit_free;
+ }
+
+@@ -996,9 +995,10 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
+ err = -EINVAL;
+ goto exit_bh;
+ }
+- primary[res] = sb_bread(sb, blk);
+- if (!primary[res]) {
+- err = -EIO;
++ primary[res] = ext4_sb_bread(sb, blk, 0);
++ if (IS_ERR(primary[res])) {
++ err = PTR_ERR(primary[res]);
++ primary[res] = NULL;
+ goto exit_bh;
+ }
+ gdbackups = verify_reserved_gdb(sb, group, primary[res]);
+@@ -1631,13 +1631,13 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
+ }
+
+ if (reserved_gdb || gdb_off == 0) {
+- if (ext4_has_feature_resize_inode(sb) ||
++ if (!ext4_has_feature_resize_inode(sb) ||
+ !le16_to_cpu(es->s_reserved_gdt_blocks)) {
+ ext4_warning(sb,
+ "No reserved GDT blocks, can't resize");
+ return -EPERM;
+ }
+- inode = ext4_iget(sb, EXT4_RESIZE_INO);
++ inode = ext4_iget(sb, EXT4_RESIZE_INO, EXT4_IGET_SPECIAL);
+ if (IS_ERR(inode)) {
+ ext4_warning(sb, "Error opening resize inode");
+ return PTR_ERR(inode);
+@@ -1965,7 +1965,8 @@ retry:
+ }
+
+ if (!resize_inode)
+- resize_inode = ext4_iget(sb, EXT4_RESIZE_INO);
++ resize_inode = ext4_iget(sb, EXT4_RESIZE_INO,
++ EXT4_IGET_SPECIAL);
+ if (IS_ERR(resize_inode)) {
+ ext4_warning(sb, "Error opening resize inode");
+ return PTR_ERR(resize_inode);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 8a149df1c6a1..ee0f30852835 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -140,6 +140,29 @@ MODULE_ALIAS_FS("ext3");
+ MODULE_ALIAS("ext3");
+ #define IS_EXT3_SB(sb) ((sb)->s_bdev->bd_holder == &ext3_fs_type)
+
++/*
++ * This works like sb_bread() except it uses ERR_PTR for error
++ * returns. Currently with sb_bread it's impossible to distinguish
++ * between ENOMEM and EIO situations (since both result in a NULL
++ * return.
++ */
++struct buffer_head *
++ext4_sb_bread(struct super_block *sb, sector_t block, int op_flags)
++{
++ struct buffer_head *bh = sb_getblk(sb, block);
++
++ if (bh == NULL)
++ return ERR_PTR(-ENOMEM);
++ if (buffer_uptodate(bh))
++ return bh;
++ ll_rw_block(REQ_OP_READ, REQ_META | op_flags, 1, &bh);
++ wait_on_buffer(bh);
++ if (buffer_uptodate(bh))
++ return bh;
++ put_bh(bh);
++ return ERR_PTR(-EIO);
++}
++
+ static int ext4_verify_csum_type(struct super_block *sb,
+ struct ext4_super_block *es)
+ {
+@@ -1150,20 +1173,11 @@ static struct inode *ext4_nfs_get_inode(struct super_block *sb,
+ {
+ struct inode *inode;
+
+- if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)
+- return ERR_PTR(-ESTALE);
+- if (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))
+- return ERR_PTR(-ESTALE);
+-
+- /* iget isn't really right if the inode is currently unallocated!!
+- *
+- * ext4_read_inode will return a bad_inode if the inode had been
+- * deleted, so we should be safe.
+- *
++ /*
+ * Currently we don't know the generation for parent directory, so
+ * a generation of 0 means "accept any"
+ */
+- inode = ext4_iget_normal(sb, ino);
++ inode = ext4_iget(sb, ino, EXT4_IGET_HANDLE);
+ if (IS_ERR(inode))
+ return ERR_CAST(inode);
+ if (generation && inode->i_generation != generation) {
+@@ -1188,6 +1202,16 @@ static struct dentry *ext4_fh_to_parent(struct super_block *sb, struct fid *fid,
+ ext4_nfs_get_inode);
+ }
+
++static int ext4_nfs_commit_metadata(struct inode *inode)
++{
++ struct writeback_control wbc = {
++ .sync_mode = WB_SYNC_ALL
++ };
++
++ trace_ext4_nfs_commit_metadata(inode);
++ return ext4_write_inode(inode, &wbc);
++}
++
+ /*
+ * Try to release metadata pages (indirect blocks, directories) which are
+ * mapped via the block device. Since these pages could have journal heads
+@@ -1392,6 +1416,7 @@ static const struct export_operations ext4_export_ops = {
+ .fh_to_dentry = ext4_fh_to_dentry,
+ .fh_to_parent = ext4_fh_to_parent,
+ .get_parent = ext4_get_parent,
++ .commit_metadata = ext4_nfs_commit_metadata,
+ };
+
+ enum {
+@@ -4327,7 +4352,7 @@ no_journal:
+ * so we can safely mount the rest of the filesystem now.
+ */
+
+- root = ext4_iget(sb, EXT4_ROOT_INO);
++ root = ext4_iget(sb, EXT4_ROOT_INO, EXT4_IGET_SPECIAL);
+ if (IS_ERR(root)) {
+ ext4_msg(sb, KERN_ERR, "get root inode failed");
+ ret = PTR_ERR(root);
+@@ -4597,7 +4622,7 @@ static struct inode *ext4_get_journal_inode(struct super_block *sb,
+ * happen if we iget() an unused inode, as the subsequent iput()
+ * will try to delete it.
+ */
+- journal_inode = ext4_iget(sb, journal_inum);
++ journal_inode = ext4_iget(sb, journal_inum, EXT4_IGET_SPECIAL);
+ if (IS_ERR(journal_inode)) {
+ ext4_msg(sb, KERN_ERR, "no journal found");
+ return NULL;
+@@ -5679,7 +5704,7 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
+ if (!qf_inums[type])
+ return -EPERM;
+
+- qf_inode = ext4_iget(sb, qf_inums[type]);
++ qf_inode = ext4_iget(sb, qf_inums[type], EXT4_IGET_SPECIAL);
+ if (IS_ERR(qf_inode)) {
+ ext4_error(sb, "Bad quota inode # %lu", qf_inums[type]);
+ return PTR_ERR(qf_inode);
+@@ -5689,9 +5714,9 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
+ qf_inode->i_flags |= S_NOQUOTA;
+ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA);
+ err = dquot_enable(qf_inode, type, format_id, flags);
+- iput(qf_inode);
+ if (err)
+ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL);
++ iput(qf_inode);
+
+ return err;
+ }
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 4380c8630539..c0ba5206cd9d 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -384,7 +384,7 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,
+ struct inode *inode;
+ int err;
+
+- inode = ext4_iget(parent->i_sb, ea_ino);
++ inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_NORMAL);
+ if (IS_ERR(inode)) {
+ err = PTR_ERR(inode);
+ ext4_error(parent->i_sb,
+@@ -522,14 +522,13 @@ ext4_xattr_block_get(struct inode *inode, int name_index, const char *name,
+ ea_idebug(inode, "name=%d.%s, buffer=%p, buffer_size=%ld",
+ name_index, name, buffer, (long)buffer_size);
+
+- error = -ENODATA;
+ if (!EXT4_I(inode)->i_file_acl)
+- goto cleanup;
++ return -ENODATA;
+ ea_idebug(inode, "reading block %llu",
+ (unsigned long long)EXT4_I(inode)->i_file_acl);
+- bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
+- if (!bh)
+- goto cleanup;
++ bh = ext4_sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl, REQ_PRIO);
++ if (IS_ERR(bh))
++ return PTR_ERR(bh);
+ ea_bdebug(bh, "b_count=%d, refcount=%d",
+ atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount));
+ error = ext4_xattr_check_block(inode, bh);
+@@ -696,26 +695,23 @@ ext4_xattr_block_list(struct dentry *dentry, char *buffer, size_t buffer_size)
+ ea_idebug(inode, "buffer=%p, buffer_size=%ld",
+ buffer, (long)buffer_size);
+
+- error = 0;
+ if (!EXT4_I(inode)->i_file_acl)
+- goto cleanup;
++ return 0;
+ ea_idebug(inode, "reading block %llu",
+ (unsigned long long)EXT4_I(inode)->i_file_acl);
+- bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
+- error = -EIO;
+- if (!bh)
+- goto cleanup;
++ bh = ext4_sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl, REQ_PRIO);
++ if (IS_ERR(bh))
++ return PTR_ERR(bh);
+ ea_bdebug(bh, "b_count=%d, refcount=%d",
+ atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount));
+ error = ext4_xattr_check_block(inode, bh);
+ if (error)
+ goto cleanup;
+ ext4_xattr_block_cache_insert(EA_BLOCK_CACHE(inode), bh);
+- error = ext4_xattr_list_entries(dentry, BFIRST(bh), buffer, buffer_size);
+-
++ error = ext4_xattr_list_entries(dentry, BFIRST(bh), buffer,
++ buffer_size);
+ cleanup:
+ brelse(bh);
+-
+ return error;
+ }
+
+@@ -830,9 +826,9 @@ int ext4_get_inode_usage(struct inode *inode, qsize_t *usage)
+ }
+
+ if (EXT4_I(inode)->i_file_acl) {
+- bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
+- if (!bh) {
+- ret = -EIO;
++ bh = ext4_sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl, REQ_PRIO);
++ if (IS_ERR(bh)) {
++ ret = PTR_ERR(bh);
+ goto out;
+ }
+
+@@ -1490,7 +1486,8 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
+ }
+
+ while (ce) {
+- ea_inode = ext4_iget(inode->i_sb, ce->e_value);
++ ea_inode = ext4_iget(inode->i_sb, ce->e_value,
++ EXT4_IGET_NORMAL);
+ if (!IS_ERR(ea_inode) &&
+ !is_bad_inode(ea_inode) &&
+ (EXT4_I(ea_inode)->i_flags & EXT4_EA_INODE_FL) &&
+@@ -1825,16 +1822,15 @@ ext4_xattr_block_find(struct inode *inode, struct ext4_xattr_info *i,
+
+ if (EXT4_I(inode)->i_file_acl) {
+ /* The inode already has an extended attribute block. */
+- bs->bh = sb_bread(sb, EXT4_I(inode)->i_file_acl);
+- error = -EIO;
+- if (!bs->bh)
+- goto cleanup;
++ bs->bh = ext4_sb_bread(sb, EXT4_I(inode)->i_file_acl, REQ_PRIO);
++ if (IS_ERR(bs->bh))
++ return PTR_ERR(bs->bh);
+ ea_bdebug(bs->bh, "b_count=%d, refcount=%d",
+ atomic_read(&(bs->bh->b_count)),
+ le32_to_cpu(BHDR(bs->bh)->h_refcount));
+ error = ext4_xattr_check_block(inode, bs->bh);
+ if (error)
+- goto cleanup;
++ return error;
+ /* Find the named attribute. */
+ bs->s.base = BHDR(bs->bh);
+ bs->s.first = BFIRST(bs->bh);
+@@ -1843,13 +1839,10 @@ ext4_xattr_block_find(struct inode *inode, struct ext4_xattr_info *i,
+ error = xattr_find_entry(inode, &bs->s.here, bs->s.end,
+ i->name_index, i->name, 1);
+ if (error && error != -ENODATA)
+- goto cleanup;
++ return error;
+ bs->s.not_found = error;
+ }
+- error = 0;
+-
+-cleanup:
+- return error;
++ return 0;
+ }
+
+ static int
+@@ -2278,9 +2271,9 @@ static struct buffer_head *ext4_xattr_get_block(struct inode *inode)
+
+ if (!EXT4_I(inode)->i_file_acl)
+ return NULL;
+- bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
+- if (!bh)
+- return ERR_PTR(-EIO);
++ bh = ext4_sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl, REQ_PRIO);
++ if (IS_ERR(bh))
++ return bh;
+ error = ext4_xattr_check_block(inode, bh);
+ if (error) {
+ brelse(bh);
+@@ -2733,7 +2726,7 @@ retry:
+ base = IFIRST(header);
+ end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
+ min_offs = end - base;
+- total_ino = sizeof(struct ext4_xattr_ibody_header);
++ total_ino = sizeof(struct ext4_xattr_ibody_header) + sizeof(u32);
+
+ error = xattr_check_inode(inode, header, end);
+ if (error)
+@@ -2750,10 +2743,11 @@ retry:
+ if (EXT4_I(inode)->i_file_acl) {
+ struct buffer_head *bh;
+
+- bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
+- error = -EIO;
+- if (!bh)
++ bh = ext4_sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl, REQ_PRIO);
++ if (IS_ERR(bh)) {
++ error = PTR_ERR(bh);
+ goto cleanup;
++ }
+ error = ext4_xattr_check_block(inode, bh);
+ if (error) {
+ brelse(bh);
+@@ -2907,11 +2901,12 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
+ }
+
+ if (EXT4_I(inode)->i_file_acl) {
+- bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
+- if (!bh) {
+- EXT4_ERROR_INODE(inode, "block %llu read error",
+- EXT4_I(inode)->i_file_acl);
+- error = -EIO;
++ bh = ext4_sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl, REQ_PRIO);
++ if (IS_ERR(bh)) {
++ error = PTR_ERR(bh);
++ if (error == -EIO)
++ EXT4_ERROR_INODE(inode, "block %llu read error",
++ EXT4_I(inode)->i_file_acl);
+ goto cleanup;
+ }
+ error = ext4_xattr_check_block(inode, bh);
+@@ -3064,8 +3059,10 @@ ext4_xattr_block_cache_find(struct inode *inode,
+ while (ce) {
+ struct buffer_head *bh;
+
+- bh = sb_bread(inode->i_sb, ce->e_value);
+- if (!bh) {
++ bh = ext4_sb_bread(inode->i_sb, ce->e_value, REQ_PRIO);
++ if (IS_ERR(bh)) {
++ if (PTR_ERR(bh) == -ENOMEM)
++ return NULL;
+ EXT4_ERROR_INODE(inode, "block %lu read error",
+ (unsigned long)ce->e_value);
+ } else if (ext4_xattr_cmp(header, BHDR(bh)) == 0) {
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 42ea42acb487..19a0d83aae65 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -827,6 +827,7 @@ static int truncate_node(struct dnode_of_data *dn)
+ struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
+ struct node_info ni;
+ int err;
++ pgoff_t index;
+
+ err = f2fs_get_node_info(sbi, dn->nid, &ni);
+ if (err)
+@@ -846,10 +847,11 @@ static int truncate_node(struct dnode_of_data *dn)
+ clear_node_page_dirty(dn->node_page);
+ set_sbi_flag(sbi, SBI_IS_DIRTY);
+
++ index = dn->node_page->index;
+ f2fs_put_page(dn->node_page, 1);
+
+ invalidate_mapping_pages(NODE_MAPPING(sbi),
+- dn->node_page->index, dn->node_page->index);
++ index, index);
+
+ dn->node_page = NULL;
+ trace_f2fs_truncate_node(dn->inode, dn->nid, ni.blk_addr);
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 287c9fe9fff9..338138b34993 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -2267,10 +2267,10 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ return 1;
+ }
+
+- if (segment_count > (le32_to_cpu(raw_super->block_count) >> 9)) {
++ if (segment_count > (le64_to_cpu(raw_super->block_count) >> 9)) {
+ f2fs_msg(sb, KERN_INFO,
+- "Wrong segment_count / block_count (%u > %u)",
+- segment_count, le32_to_cpu(raw_super->block_count));
++ "Wrong segment_count / block_count (%u > %llu)",
++ segment_count, le64_to_cpu(raw_super->block_count));
+ return 1;
+ }
+
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 77a010e625f5..087e53a2d96c 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -291,7 +291,7 @@ static int read_xattr_block(struct inode *inode, void *txattr_addr)
+ static int lookup_all_xattrs(struct inode *inode, struct page *ipage,
+ unsigned int index, unsigned int len,
+ const char *name, struct f2fs_xattr_entry **xe,
+- void **base_addr)
++ void **base_addr, int *base_size)
+ {
+ void *cur_addr, *txattr_addr, *last_addr = NULL;
+ nid_t xnid = F2FS_I(inode)->i_xattr_nid;
+@@ -302,8 +302,8 @@ static int lookup_all_xattrs(struct inode *inode, struct page *ipage,
+ if (!size && !inline_size)
+ return -ENODATA;
+
+- txattr_addr = f2fs_kzalloc(F2FS_I_SB(inode),
+- inline_size + size + XATTR_PADDING_SIZE, GFP_NOFS);
++ *base_size = inline_size + size + XATTR_PADDING_SIZE;
++ txattr_addr = f2fs_kzalloc(F2FS_I_SB(inode), *base_size, GFP_NOFS);
+ if (!txattr_addr)
+ return -ENOMEM;
+
+@@ -315,8 +315,10 @@ static int lookup_all_xattrs(struct inode *inode, struct page *ipage,
+
+ *xe = __find_inline_xattr(inode, txattr_addr, &last_addr,
+ index, len, name);
+- if (*xe)
++ if (*xe) {
++ *base_size = inline_size;
+ goto check;
++ }
+ }
+
+ /* read from xattr node block */
+@@ -477,6 +479,7 @@ int f2fs_getxattr(struct inode *inode, int index, const char *name,
+ int error = 0;
+ unsigned int size, len;
+ void *base_addr = NULL;
++ int base_size;
+
+ if (name == NULL)
+ return -EINVAL;
+@@ -487,7 +490,7 @@ int f2fs_getxattr(struct inode *inode, int index, const char *name,
+
+ down_read(&F2FS_I(inode)->i_xattr_sem);
+ error = lookup_all_xattrs(inode, ipage, index, len, name,
+- &entry, &base_addr);
++ &entry, &base_addr, &base_size);
+ up_read(&F2FS_I(inode)->i_xattr_sem);
+ if (error)
+ return error;
+@@ -501,6 +504,11 @@ int f2fs_getxattr(struct inode *inode, int index, const char *name,
+
+ if (buffer) {
+ char *pval = entry->e_name + entry->e_name_len;
++
++ if (base_size - (pval - (char *)base_addr) < size) {
++ error = -ERANGE;
++ goto out;
++ }
+ memcpy(buffer, pval, size);
+ }
+ error = size;
+diff --git a/include/linux/msi.h b/include/linux/msi.h
+index 5839d8062dfc..be8ec813dbfb 100644
+--- a/include/linux/msi.h
++++ b/include/linux/msi.h
+@@ -116,6 +116,8 @@ struct msi_desc {
+ list_first_entry(dev_to_msi_list((dev)), struct msi_desc, list)
+ #define for_each_msi_entry(desc, dev) \
+ list_for_each_entry((desc), dev_to_msi_list((dev)), list)
++#define for_each_msi_entry_safe(desc, tmp, dev) \
++ list_for_each_entry_safe((desc), (tmp), dev_to_msi_list((dev)), list)
+
+ #ifdef CONFIG_PCI_MSI
+ #define first_pci_msi_entry(pdev) first_msi_entry(&(pdev)->dev)
+diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
+index 6894976b54e3..186cd8e970c7 100644
+--- a/include/linux/ptr_ring.h
++++ b/include/linux/ptr_ring.h
+@@ -573,6 +573,8 @@ static inline void **__ptr_ring_swap_queue(struct ptr_ring *r, void **queue,
+ else if (destroy)
+ destroy(ptr);
+
++ if (producer >= size)
++ producer = 0;
+ __ptr_ring_set_size(r, size);
+ r->producer = producer;
+ r->consumer_head = 0;
+diff --git a/include/media/cec.h b/include/media/cec.h
+index 9b7394a74dca..dc4b412e8fa1 100644
+--- a/include/media/cec.h
++++ b/include/media/cec.h
+@@ -155,6 +155,7 @@ struct cec_adapter {
+ unsigned int transmit_queue_sz;
+ struct list_head wait_queue;
+ struct cec_data *transmitting;
++ bool transmit_in_progress;
+
+ struct task_struct *kthread_config;
+ struct completion config_completion;
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index b0d022ff6ea1..e11423530d64 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -326,6 +326,26 @@ int ip_tunnel_encap_del_ops(const struct ip_tunnel_encap_ops *op,
+ int ip_tunnel_encap_setup(struct ip_tunnel *t,
+ struct ip_tunnel_encap *ipencap);
+
++static inline bool pskb_inet_may_pull(struct sk_buff *skb)
++{
++ int nhlen;
++
++ switch (skb->protocol) {
++#if IS_ENABLED(CONFIG_IPV6)
++ case htons(ETH_P_IPV6):
++ nhlen = sizeof(struct ipv6hdr);
++ break;
++#endif
++ case htons(ETH_P_IP):
++ nhlen = sizeof(struct iphdr);
++ break;
++ default:
++ nhlen = 0;
++ }
++
++ return pskb_network_may_pull(skb, nhlen);
++}
++
+ static inline int ip_encap_hlen(struct ip_tunnel_encap *e)
+ {
+ const struct ip_tunnel_encap_ops *ops;
+diff --git a/include/net/sock.h b/include/net/sock.h
+index f18dbd6da906..6cb5a545df7d 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -298,6 +298,7 @@ struct sock_common {
+ * @sk_filter: socket filtering instructions
+ * @sk_timer: sock cleanup timer
+ * @sk_stamp: time stamp of last packet received
++ * @sk_stamp_seq: lock for accessing sk_stamp on 32 bit architectures only
+ * @sk_tsflags: SO_TIMESTAMPING socket options
+ * @sk_tskey: counter to disambiguate concurrent tstamp requests
+ * @sk_zckey: counter to order MSG_ZEROCOPY notifications
+@@ -474,6 +475,9 @@ struct sock {
+ const struct cred *sk_peer_cred;
+ long sk_rcvtimeo;
+ ktime_t sk_stamp;
++#if BITS_PER_LONG==32
++ seqlock_t sk_stamp_seq;
++#endif
+ u16 sk_tsflags;
+ u8 sk_shutdown;
+ u32 sk_tskey;
+@@ -2290,6 +2294,34 @@ static inline void sk_drops_add(struct sock *sk, const struct sk_buff *skb)
+ atomic_add(segs, &sk->sk_drops);
+ }
+
++static inline ktime_t sock_read_timestamp(struct sock *sk)
++{
++#if BITS_PER_LONG==32
++ unsigned int seq;
++ ktime_t kt;
++
++ do {
++ seq = read_seqbegin(&sk->sk_stamp_seq);
++ kt = sk->sk_stamp;
++ } while (read_seqretry(&sk->sk_stamp_seq, seq));
++
++ return kt;
++#else
++ return sk->sk_stamp;
++#endif
++}
++
++static inline void sock_write_timestamp(struct sock *sk, ktime_t kt)
++{
++#if BITS_PER_LONG==32
++ write_seqlock(&sk->sk_stamp_seq);
++ sk->sk_stamp = kt;
++ write_sequnlock(&sk->sk_stamp_seq);
++#else
++ sk->sk_stamp = kt;
++#endif
++}
++
+ void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
+ struct sk_buff *skb);
+ void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
+@@ -2314,7 +2346,7 @@ sock_recv_timestamp(struct msghdr *msg, struct sock *sk, struct sk_buff *skb)
+ (sk->sk_tsflags & SOF_TIMESTAMPING_RAW_HARDWARE)))
+ __sock_recv_timestamp(msg, sk, skb);
+ else
+- sk->sk_stamp = kt;
++ sock_write_timestamp(sk, kt);
+
+ if (sock_flag(sk, SOCK_WIFI_STATUS) && skb->wifi_acked_valid)
+ __sock_recv_wifi_status(msg, sk, skb);
+@@ -2335,9 +2367,9 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+ if (sk->sk_flags & FLAGS_TS_OR_DROPS || sk->sk_tsflags & TSFLAGS_ANY)
+ __sock_recv_ts_and_drops(msg, sk, skb);
+ else if (unlikely(sock_flag(sk, SOCK_TIMESTAMP)))
+- sk->sk_stamp = skb->tstamp;
++ sock_write_timestamp(sk, skb->tstamp);
+ else if (unlikely(sk->sk_stamp == SK_DEFAULT_STAMP))
+- sk->sk_stamp = 0;
++ sock_write_timestamp(sk, 0);
+ }
+
+ void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags);
+diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h
+index 0e31eb136c57..0dfb174f707e 100644
+--- a/include/trace/events/ext4.h
++++ b/include/trace/events/ext4.h
+@@ -225,6 +225,26 @@ TRACE_EVENT(ext4_drop_inode,
+ (unsigned long) __entry->ino, __entry->drop)
+ );
+
++TRACE_EVENT(ext4_nfs_commit_metadata,
++ TP_PROTO(struct inode *inode),
++
++ TP_ARGS(inode),
++
++ TP_STRUCT__entry(
++ __field( dev_t, dev )
++ __field( ino_t, ino )
++ ),
++
++ TP_fast_assign(
++ __entry->dev = inode->i_sb->s_dev;
++ __entry->ino = inode->i_ino;
++ ),
++
++ TP_printk("dev %d,%d ino %lu",
++ MAJOR(__entry->dev), MINOR(__entry->dev),
++ (unsigned long) __entry->ino)
++);
++
+ TRACE_EVENT(ext4_mark_inode_dirty,
+ TP_PROTO(struct inode *inode, unsigned long IP),
+
+diff --git a/include/uapi/linux/net_tstamp.h b/include/uapi/linux/net_tstamp.h
+index 97ff3c17ec4d..e5b39721c6e4 100644
+--- a/include/uapi/linux/net_tstamp.h
++++ b/include/uapi/linux/net_tstamp.h
+@@ -155,8 +155,8 @@ enum txtime_flags {
+ };
+
+ struct sock_txtime {
+- clockid_t clockid; /* reference clockid */
+- __u32 flags; /* as defined by enum txtime_flags */
++ __kernel_clockid_t clockid;/* reference clockid */
++ __u32 flags; /* as defined by enum txtime_flags */
+ };
+
+ #endif /* _NET_TIMESTAMPING_H */
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 4a3dae2a8283..1aa517908561 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -4186,20 +4186,25 @@ static void css_task_iter_advance(struct css_task_iter *it)
+
+ lockdep_assert_held(&css_set_lock);
+ repeat:
+- /*
+- * Advance iterator to find next entry. cset->tasks is consumed
+- * first and then ->mg_tasks. After ->mg_tasks, we move onto the
+- * next cset.
+- */
+- next = it->task_pos->next;
++ if (it->task_pos) {
++ /*
++ * Advance iterator to find next entry. cset->tasks is
++ * consumed first and then ->mg_tasks. After ->mg_tasks,
++ * we move onto the next cset.
++ */
++ next = it->task_pos->next;
+
+- if (next == it->tasks_head)
+- next = it->mg_tasks_head->next;
++ if (next == it->tasks_head)
++ next = it->mg_tasks_head->next;
+
+- if (next == it->mg_tasks_head)
++ if (next == it->mg_tasks_head)
++ css_task_iter_advance_css_set(it);
++ else
++ it->task_pos = next;
++ } else {
++ /* called from start, proceed to the first cset */
+ css_task_iter_advance_css_set(it);
+- else
+- it->task_pos = next;
++ }
+
+ /* if PROCS, skip over tasks which aren't group leaders */
+ if ((it->flags & CSS_TASK_ITER_PROCS) && it->task_pos &&
+@@ -4239,7 +4244,7 @@ void css_task_iter_start(struct cgroup_subsys_state *css, unsigned int flags,
+
+ it->cset_head = it->cset_pos;
+
+- css_task_iter_advance_css_set(it);
++ css_task_iter_advance(it);
+
+ spin_unlock_irq(&css_set_lock);
+ }
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index c603d33d5410..5d01edf8d819 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -653,15 +653,22 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
+ break;
+ }
+
+- dev = dev_get_by_name(&init_net, devname);
++ rtnl_lock();
++ dev = __dev_get_by_name(&init_net, devname);
+ if (!dev) {
++ rtnl_unlock();
+ res = -ENODEV;
+ break;
+ }
+
+ ax25->ax25_dev = ax25_dev_ax25dev(dev);
++ if (!ax25->ax25_dev) {
++ rtnl_unlock();
++ res = -ENODEV;
++ break;
++ }
+ ax25_fillin_cb(ax25, ax25->ax25_dev);
+- dev_put(dev);
++ rtnl_unlock();
+ break;
+
+ default:
+diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
+index 9a3a301e1e2f..d92195cd7834 100644
+--- a/net/ax25/ax25_dev.c
++++ b/net/ax25/ax25_dev.c
+@@ -116,6 +116,7 @@ void ax25_dev_device_down(struct net_device *dev)
+ if ((s = ax25_dev_list) == ax25_dev) {
+ ax25_dev_list = s->next;
+ spin_unlock_bh(&ax25_dev_lock);
++ dev->ax25_ptr = NULL;
+ dev_put(dev);
+ kfree(ax25_dev);
+ return;
+@@ -125,6 +126,7 @@ void ax25_dev_device_down(struct net_device *dev)
+ if (s->next == ax25_dev) {
+ s->next = ax25_dev->next;
+ spin_unlock_bh(&ax25_dev_lock);
++ dev->ax25_ptr = NULL;
+ dev_put(dev);
+ kfree(ax25_dev);
+ return;
+diff --git a/net/compat.c b/net/compat.c
+index 3b2105f6549d..3c4b0283b29a 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -467,12 +467,14 @@ int compat_sock_get_timestamp(struct sock *sk, struct timeval __user *userstamp)
+ ctv = (struct compat_timeval __user *) userstamp;
+ err = -ENOENT;
+ sock_enable_timestamp(sk, SOCK_TIMESTAMP);
+- tv = ktime_to_timeval(sk->sk_stamp);
++ tv = ktime_to_timeval(sock_read_timestamp(sk));
++
+ if (tv.tv_sec == -1)
+ return err;
+ if (tv.tv_sec == 0) {
+- sk->sk_stamp = ktime_get_real();
+- tv = ktime_to_timeval(sk->sk_stamp);
++ ktime_t kt = ktime_get_real();
++ sock_write_timestamp(sk, kt);
++ tv = ktime_to_timeval(kt);
+ }
+ err = 0;
+ if (put_user(tv.tv_sec, &ctv->tv_sec) ||
+@@ -494,12 +496,13 @@ int compat_sock_get_timestampns(struct sock *sk, struct timespec __user *usersta
+ ctv = (struct compat_timespec __user *) userstamp;
+ err = -ENOENT;
+ sock_enable_timestamp(sk, SOCK_TIMESTAMP);
+- ts = ktime_to_timespec(sk->sk_stamp);
++ ts = ktime_to_timespec(sock_read_timestamp(sk));
+ if (ts.tv_sec == -1)
+ return err;
+ if (ts.tv_sec == 0) {
+- sk->sk_stamp = ktime_get_real();
+- ts = ktime_to_timespec(sk->sk_stamp);
++ ktime_t kt = ktime_get_real();
++ sock_write_timestamp(sk, kt);
++ ts = ktime_to_timespec(kt);
+ }
+ err = 0;
+ if (put_user(ts.tv_sec, &ctv->tv_sec) ||
+diff --git a/net/core/gro_cells.c b/net/core/gro_cells.c
+index 4b54e5f107c6..acf45ddbe924 100644
+--- a/net/core/gro_cells.c
++++ b/net/core/gro_cells.c
+@@ -84,6 +84,7 @@ void gro_cells_destroy(struct gro_cells *gcells)
+ for_each_possible_cpu(i) {
+ struct gro_cell *cell = per_cpu_ptr(gcells->cells, i);
+
++ napi_disable(&cell->napi);
+ netif_napi_del(&cell->napi);
+ __skb_queue_purge(&cell->napi_skbs);
+ }
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 748765e35423..5a8a3b76832f 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2803,6 +2803,9 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+ sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
+
+ sk->sk_stamp = SK_DEFAULT_STAMP;
++#if BITS_PER_LONG==32
++ seqlock_init(&sk->sk_stamp_seq);
++#endif
+ atomic_set(&sk->sk_zckey, 0);
+
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+@@ -2902,12 +2905,13 @@ int sock_get_timestamp(struct sock *sk, struct timeval __user *userstamp)
+ struct timeval tv;
+
+ sock_enable_timestamp(sk, SOCK_TIMESTAMP);
+- tv = ktime_to_timeval(sk->sk_stamp);
++ tv = ktime_to_timeval(sock_read_timestamp(sk));
+ if (tv.tv_sec == -1)
+ return -ENOENT;
+ if (tv.tv_sec == 0) {
+- sk->sk_stamp = ktime_get_real();
+- tv = ktime_to_timeval(sk->sk_stamp);
++ ktime_t kt = ktime_get_real();
++ sock_write_timestamp(sk, kt);
++ tv = ktime_to_timeval(kt);
+ }
+ return copy_to_user(userstamp, &tv, sizeof(tv)) ? -EFAULT : 0;
+ }
+@@ -2918,11 +2922,12 @@ int sock_get_timestampns(struct sock *sk, struct timespec __user *userstamp)
+ struct timespec ts;
+
+ sock_enable_timestamp(sk, SOCK_TIMESTAMP);
+- ts = ktime_to_timespec(sk->sk_stamp);
++ ts = ktime_to_timespec(sock_read_timestamp(sk));
+ if (ts.tv_sec == -1)
+ return -ENOENT;
+ if (ts.tv_sec == 0) {
+- sk->sk_stamp = ktime_get_real();
++ ktime_t kt = ktime_get_real();
++ sock_write_timestamp(sk, kt);
+ ts = ktime_to_timespec(sk->sk_stamp);
+ }
+ return copy_to_user(userstamp, &ts, sizeof(ts)) ? -EFAULT : 0;
+diff --git a/net/ieee802154/6lowpan/tx.c b/net/ieee802154/6lowpan/tx.c
+index ca53efa17be1..8bec827081cd 100644
+--- a/net/ieee802154/6lowpan/tx.c
++++ b/net/ieee802154/6lowpan/tx.c
+@@ -48,6 +48,9 @@ int lowpan_header_create(struct sk_buff *skb, struct net_device *ldev,
+ const struct ipv6hdr *hdr = ipv6_hdr(skb);
+ struct neighbour *n;
+
++ if (!daddr)
++ return -EINVAL;
++
+ /* TODO:
+ * if this package isn't ipv6 one, where should it be routed?
+ */
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 4e5bc4b2f14e..1a4e9ff02762 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -998,7 +998,9 @@ next_chunk:
+ if (!inet_diag_bc_sk(bc, sk))
+ goto next_normal;
+
+- sock_hold(sk);
++ if (!refcount_inc_not_zero(&sk->sk_refcnt))
++ goto next_normal;
++
+ num_arr[accum] = num;
+ sk_arr[accum] = sk;
+ if (++accum == SKARR_SZ)
+diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
+index 32662e9e5d21..d5984d31ab93 100644
+--- a/net/ipv4/ip_forward.c
++++ b/net/ipv4/ip_forward.c
+@@ -72,6 +72,7 @@ static int ip_forward_finish(struct net *net, struct sock *sk, struct sk_buff *s
+ if (unlikely(opt->optlen))
+ ip_forward_options(skb);
+
++ skb->tstamp = 0;
+ return dst_output(net, sk, skb);
+ }
+
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index f686d7761acb..f8bbd693c19c 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -347,10 +347,10 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ struct net *net = container_of(qp->q.net, struct net, ipv4.frags);
+ struct rb_node **rbn, *parent;
+ struct sk_buff *skb1, *prev_tail;
++ int ihl, end, skb1_run_end;
+ struct net_device *dev;
+ unsigned int fragsize;
+ int flags, offset;
+- int ihl, end;
+ int err = -ENOENT;
+ u8 ecn;
+
+@@ -420,7 +420,9 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ * overlapping fragment, the entire datagram (and any constituent
+ * fragments) MUST be silently discarded.
+ *
+- * We do the same here for IPv4 (and increment an snmp counter).
++ * We do the same here for IPv4 (and increment an snmp counter) but
++ * we do not want to drop the whole queue in response to a duplicate
++ * fragment.
+ */
+
+ /* Find out where to put this fragment. */
+@@ -444,13 +446,17 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ do {
+ parent = *rbn;
+ skb1 = rb_to_skb(parent);
++ skb1_run_end = skb1->ip_defrag_offset +
++ FRAG_CB(skb1)->frag_run_len;
+ if (end <= skb1->ip_defrag_offset)
+ rbn = &parent->rb_left;
+- else if (offset >= skb1->ip_defrag_offset +
+- FRAG_CB(skb1)->frag_run_len)
++ else if (offset >= skb1_run_end)
+ rbn = &parent->rb_right;
+- else /* Found an overlap with skb1. */
+- goto discard_qp;
++ else if (offset >= skb1->ip_defrag_offset &&
++ end <= skb1_run_end)
++ goto err; /* No new data, potential duplicate */
++ else
++ goto discard_qp; /* Found an overlap */
+ } while (*rbn);
+ /* Here we have parent properly set, and rbn pointing to
+ * one of its NULL left/right children. Insert skb.
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 8cce0e9ea08c..5ef5df3a06f1 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -677,6 +677,9 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+ const struct iphdr *tnl_params;
+
++ if (!pskb_inet_may_pull(skb))
++ goto free_skb;
++
+ if (tunnel->collect_md) {
+ gre_fb_xmit(skb, dev, skb->protocol);
+ return NETDEV_TX_OK;
+@@ -720,6 +723,9 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+ bool truncate = false;
+
++ if (!pskb_inet_may_pull(skb))
++ goto free_skb;
++
+ if (tunnel->collect_md) {
+ erspan_fb_xmit(skb, dev, skb->protocol);
+ return NETDEV_TX_OK;
+@@ -763,6 +769,9 @@ static netdev_tx_t gre_tap_xmit(struct sk_buff *skb,
+ {
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+
++ if (!pskb_inet_may_pull(skb))
++ goto free_skb;
++
+ if (tunnel->collect_md) {
+ gre_fb_xmit(skb, dev, htons(ETH_P_TEB));
+ return NETDEV_TX_OK;
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 284a22154b4e..c4f5602308ed 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -627,7 +627,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ const struct iphdr *tnl_params, u8 protocol)
+ {
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+- unsigned int inner_nhdr_len = 0;
+ const struct iphdr *inner_iph;
+ struct flowi4 fl4;
+ u8 tos, ttl;
+@@ -637,14 +636,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ __be32 dst;
+ bool connected;
+
+- /* ensure we can access the inner net header, for several users below */
+- if (skb->protocol == htons(ETH_P_IP))
+- inner_nhdr_len = sizeof(struct iphdr);
+- else if (skb->protocol == htons(ETH_P_IPV6))
+- inner_nhdr_len = sizeof(struct ipv6hdr);
+- if (unlikely(!pskb_may_pull(skb, inner_nhdr_len)))
+- goto tx_error;
+-
+ inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
+ connected = (tunnel->parms.iph.daddr != 0);
+
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index f38cb21d773d..7f56944b020f 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -241,6 +241,9 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+ struct flowi fl;
+
++ if (!pskb_inet_may_pull(skb))
++ goto tx_err;
++
+ memset(&fl, 0, sizeof(fl));
+
+ switch (skb->protocol) {
+@@ -253,15 +256,18 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ break;
+ default:
+- dev->stats.tx_errors++;
+- dev_kfree_skb(skb);
+- return NETDEV_TX_OK;
++ goto tx_err;
+ }
+
+ /* override mark with tunnel output key */
+ fl.flowi_mark = be32_to_cpu(tunnel->parms.o_key);
+
+ return vti_xmit(skb, dev, &fl);
++
++tx_err:
++ dev->stats.tx_errors++;
++ kfree_skb(skb);
++ return NETDEV_TX_OK;
+ }
+
+ static int vti4_err(struct sk_buff *skb, u32 info)
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 5660adcf7a04..f6275aa19b6a 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -69,6 +69,8 @@
+ #include <net/nexthop.h>
+ #include <net/switchdev.h>
+
++#include <linux/nospec.h>
++
+ struct ipmr_rule {
+ struct fib_rule common;
+ };
+@@ -1612,6 +1614,7 @@ int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg)
+ return -EFAULT;
+ if (vr.vifi >= mrt->maxvif)
+ return -EINVAL;
++ vr.vifi = array_index_nospec(vr.vifi, mrt->maxvif);
+ read_lock(&mrt_lock);
+ vif = &mrt->vif_table[vr.vifi];
+ if (VIF_EXISTS(mrt, vr.vifi)) {
+@@ -1686,6 +1689,7 @@ int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+ return -EFAULT;
+ if (vr.vifi >= mrt->maxvif)
+ return -EINVAL;
++ vr.vifi = array_index_nospec(vr.vifi, mrt->maxvif);
+ read_lock(&mrt_lock);
+ vif = &mrt->vif_table[vr.vifi];
+ if (VIF_EXISTS(mrt, vr.vifi)) {
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 4e81ff2f4588..3dfc50cd86d6 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -4711,8 +4711,8 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh,
+ IFA_F_MCAUTOJOIN | IFA_F_OPTIMISTIC;
+
+ idev = ipv6_find_idev(dev);
+- if (IS_ERR(idev))
+- return PTR_ERR(idev);
++ if (!idev)
++ return -ENOBUFS;
+
+ if (!ipv6_allow_optimistic_dad(net, idev))
+ cfg.ifa_flags &= ~IFA_F_OPTIMISTIC;
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index e493b041d4ac..c270726b01b0 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -897,6 +897,9 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
+ struct net_device_stats *stats = &t->dev->stats;
+ int ret;
+
++ if (!pskb_inet_may_pull(skb))
++ goto tx_err;
++
+ if (!ip6_tnl_xmit_ctl(t, &t->parms.laddr, &t->parms.raddr))
+ goto tx_err;
+
+@@ -939,6 +942,9 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ int nhoff;
+ int thoff;
+
++ if (!pskb_inet_may_pull(skb))
++ goto tx_err;
++
+ if (!ip6_tnl_xmit_ctl(t, &t->parms.laddr, &t->parms.raddr))
+ goto tx_err;
+
+@@ -1011,8 +1017,6 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ goto tx_err;
+ }
+ } else {
+- struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+-
+ switch (skb->protocol) {
+ case htons(ETH_P_IP):
+ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
+@@ -1020,7 +1024,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ &dsfield, &encap_limit);
+ break;
+ case htons(ETH_P_IPV6):
+- if (ipv6_addr_equal(&t->parms.raddr, &ipv6h->saddr))
++ if (ipv6_addr_equal(&t->parms.raddr, &ipv6_hdr(skb)->saddr))
+ goto tx_err;
+ if (prepare_ip6gre_xmit_ipv6(skb, dev, &fl6,
+ &dsfield, &encap_limit))
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 2694def1e72c..0bb87f3a10c7 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -378,6 +378,7 @@ static inline int ip6_forward_finish(struct net *net, struct sock *sk,
+ __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
+ __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
+
++ skb->tstamp = 0;
+ return dst_output(net, sk, skb);
+ }
+
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index a9d06d4dd057..0c6403cf8b52 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -901,6 +901,7 @@ static int ipxip6_rcv(struct sk_buff *skb, u8 ipproto,
+ goto drop;
+ if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
+ goto drop;
++ ipv6h = ipv6_hdr(skb);
+ if (!ip6_tnl_rcv_ctl(t, &ipv6h->daddr, &ipv6h->saddr))
+ goto drop;
+ if (iptunnel_pull_header(skb, 0, tpi->proto, false))
+@@ -1242,10 +1243,6 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
+ u8 tproto;
+ int err;
+
+- /* ensure we can access the full inner ip header */
+- if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+- return -1;
+-
+ iph = ip_hdr(skb);
+ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
+
+@@ -1320,9 +1317,6 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
+ u8 tproto;
+ int err;
+
+- if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
+- return -1;
+-
+ ipv6h = ipv6_hdr(skb);
+ tproto = READ_ONCE(t->parms.proto);
+ if ((tproto != IPPROTO_IPV6 && tproto != 0) ||
+@@ -1404,6 +1398,9 @@ ip6_tnl_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ struct net_device_stats *stats = &t->dev->stats;
+ int ret;
+
++ if (!pskb_inet_may_pull(skb))
++ goto tx_err;
++
+ switch (skb->protocol) {
+ case htons(ETH_P_IP):
+ ret = ip4ip6_tnl_xmit(skb, dev);
+diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
+index b283f293ee4a..caad40d6e74d 100644
+--- a/net/ipv6/ip6_udp_tunnel.c
++++ b/net/ipv6/ip6_udp_tunnel.c
+@@ -15,7 +15,7 @@
+ int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
+ struct socket **sockp)
+ {
+- struct sockaddr_in6 udp6_addr;
++ struct sockaddr_in6 udp6_addr = {};
+ int err;
+ struct socket *sock = NULL;
+
+@@ -42,6 +42,7 @@ int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
+ goto error;
+
+ if (cfg->peer_udp_port) {
++ memset(&udp6_addr, 0, sizeof(udp6_addr));
+ udp6_addr.sin6_family = AF_INET6;
+ memcpy(&udp6_addr.sin6_addr, &cfg->peer_ip6,
+ sizeof(udp6_addr.sin6_addr));
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index eeaf7455d51e..8b6eefff2f7e 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -318,6 +318,7 @@ static int vti6_rcv(struct sk_buff *skb)
+ return 0;
+ }
+
++ ipv6h = ipv6_hdr(skb);
+ if (!ip6_tnl_rcv_ctl(t, &ipv6h->daddr, &ipv6h->saddr)) {
+ t->dev->stats.rx_dropped++;
+ rcu_read_unlock();
+@@ -521,18 +522,18 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ip6_tnl *t = netdev_priv(dev);
+ struct net_device_stats *stats = &t->dev->stats;
+- struct ipv6hdr *ipv6h;
+ struct flowi fl;
+ int ret;
+
++ if (!pskb_inet_may_pull(skb))
++ goto tx_err;
++
+ memset(&fl, 0, sizeof(fl));
+
+ switch (skb->protocol) {
+ case htons(ETH_P_IPV6):
+- ipv6h = ipv6_hdr(skb);
+-
+ if ((t->parms.proto != IPPROTO_IPV6 && t->parms.proto != 0) ||
+- vti6_addr_conflict(t, ipv6h))
++ vti6_addr_conflict(t, ipv6_hdr(skb)))
+ goto tx_err;
+
+ xfrm_decode_session(skb, &fl, AF_INET6);
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index d0b7e0249c13..331e6b6dd252 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -51,6 +51,9 @@
+ #include <linux/export.h>
+ #include <net/ip6_checksum.h>
+ #include <linux/netconf.h>
++#include <net/ip_tunnels.h>
++
++#include <linux/nospec.h>
+
+ struct ip6mr_rule {
+ struct fib_rule common;
+@@ -591,13 +594,12 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
+ .flowi6_iif = skb->skb_iif ? : LOOPBACK_IFINDEX,
+ .flowi6_mark = skb->mark,
+ };
+- int err;
+
+- err = ip6mr_fib_lookup(net, &fl6, &mrt);
+- if (err < 0) {
+- kfree_skb(skb);
+- return err;
+- }
++ if (!pskb_inet_may_pull(skb))
++ goto tx_err;
++
++ if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0)
++ goto tx_err;
+
+ read_lock(&mrt_lock);
+ dev->stats.tx_bytes += skb->len;
+@@ -606,6 +608,11 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
+ read_unlock(&mrt_lock);
+ kfree_skb(skb);
+ return NETDEV_TX_OK;
++
++tx_err:
++ dev->stats.tx_errors++;
++ kfree_skb(skb);
++ return NETDEV_TX_OK;
+ }
+
+ static int reg_vif_get_iflink(const struct net_device *dev)
+@@ -1831,6 +1838,7 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void __user *arg)
+ return -EFAULT;
+ if (vr.mifi >= mrt->maxvif)
+ return -EINVAL;
++ vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif);
+ read_lock(&mrt_lock);
+ vif = &mrt->vif_table[vr.mifi];
+ if (VIF_EXISTS(mrt, vr.mifi)) {
+@@ -1905,6 +1913,7 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+ return -EFAULT;
+ if (vr.mifi >= mrt->maxvif)
+ return -EINVAL;
++ vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif);
+ read_lock(&mrt_lock);
+ vif = &mrt->vif_table[vr.mifi];
+ if (VIF_EXISTS(mrt, vr.mifi)) {
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index d3fd2d7e5aa4..7c943392c128 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -384,6 +384,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
+ if (skb_try_coalesce(head, fp, &headstolen, &delta)) {
+ kfree_skb_partial(fp, headstolen);
+ } else {
++ fp->sk = NULL;
+ if (!skb_shinfo(head)->frag_list)
+ skb_shinfo(head)->frag_list = fp;
+ head->data_len += fp->len;
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index a33681dc4796..08c4516ae4a4 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -210,7 +210,9 @@ struct neighbour *ip6_neigh_lookup(const struct in6_addr *gw,
+ n = __ipv6_neigh_lookup(dev, daddr);
+ if (n)
+ return n;
+- return neigh_create(&nd_tbl, daddr, dev);
++
++ n = neigh_create(&nd_tbl, daddr, dev);
++ return IS_ERR(n) ? NULL : n;
+ }
+
+ static struct neighbour *ip6_dst_neigh_lookup(const struct dst_entry *dst,
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index e9400ffa7875..eb162bd0e041 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1021,6 +1021,9 @@ tx_error:
+ static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
+ struct net_device *dev)
+ {
++ if (!pskb_inet_may_pull(skb))
++ goto tx_err;
++
+ switch (skb->protocol) {
+ case htons(ETH_P_IP):
+ sit_tunnel_xmit__(skb, dev, IPPROTO_IPIP);
+diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
+index 03f37c4e64fe..1d3144d19903 100644
+--- a/net/netrom/af_netrom.c
++++ b/net/netrom/af_netrom.c
+@@ -153,7 +153,7 @@ static struct sock *nr_find_listener(ax25_address *addr)
+ sk_for_each(s, &nr_list)
+ if (!ax25cmp(&nr_sk(s)->source_addr, addr) &&
+ s->sk_state == TCP_LISTEN) {
+- bh_lock_sock(s);
++ sock_hold(s);
+ goto found;
+ }
+ s = NULL;
+@@ -174,7 +174,7 @@ static struct sock *nr_find_socket(unsigned char index, unsigned char id)
+ struct nr_sock *nr = nr_sk(s);
+
+ if (nr->my_index == index && nr->my_id == id) {
+- bh_lock_sock(s);
++ sock_hold(s);
+ goto found;
+ }
+ }
+@@ -198,7 +198,7 @@ static struct sock *nr_find_peer(unsigned char index, unsigned char id,
+
+ if (nr->your_index == index && nr->your_id == id &&
+ !ax25cmp(&nr->dest_addr, dest)) {
+- bh_lock_sock(s);
++ sock_hold(s);
+ goto found;
+ }
+ }
+@@ -224,7 +224,7 @@ static unsigned short nr_find_next_circuit(void)
+ if (i != 0 && j != 0) {
+ if ((sk=nr_find_socket(i, j)) == NULL)
+ break;
+- bh_unlock_sock(sk);
++ sock_put(sk);
+ }
+
+ id++;
+@@ -920,6 +920,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+ }
+
+ if (sk != NULL) {
++ bh_lock_sock(sk);
+ skb_reset_transport_header(skb);
+
+ if (frametype == NR_CONNACK && skb->len == 22)
+@@ -929,6 +930,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+
+ ret = nr_process_rx_frame(sk, skb);
+ bh_unlock_sock(sk);
++ sock_put(sk);
+ return ret;
+ }
+
+@@ -960,10 +962,12 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+ (make = nr_make_new(sk)) == NULL) {
+ nr_transmit_refusal(skb, 0);
+ if (sk)
+- bh_unlock_sock(sk);
++ sock_put(sk);
+ return 0;
+ }
+
++ bh_lock_sock(sk);
++
+ window = skb->data[20];
+
+ skb->sk = make;
+@@ -1016,6 +1020,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+ sk->sk_data_ready(sk);
+
+ bh_unlock_sock(sk);
++ sock_put(sk);
+
+ nr_insert_socket(make);
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 6477b131e809..0541cfc93440 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2625,8 +2625,10 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ sll_addr)))
+ goto out;
+ proto = saddr->sll_protocol;
+- addr = saddr->sll_addr;
++ addr = saddr->sll_halen ? saddr->sll_addr : NULL;
+ dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
++ if (addr && dev && saddr->sll_halen < dev->addr_len)
++ goto out;
+ }
+
+ err = -ENXIO;
+@@ -2823,8 +2825,10 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
+ goto out;
+ proto = saddr->sll_protocol;
+- addr = saddr->sll_addr;
++ addr = saddr->sll_halen ? saddr->sll_addr : NULL;
+ dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
++ if (addr && dev && saddr->sll_halen < dev->addr_len)
++ goto out;
+ }
+
+ err = -ENXIO;
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index fc6c5e4bffa5..7f0539db5604 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -101,6 +101,7 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
+ if (addr) {
+ addr->a.v6.sin6_family = AF_INET6;
+ addr->a.v6.sin6_port = 0;
++ addr->a.v6.sin6_flowinfo = 0;
+ addr->a.v6.sin6_addr = ifa->addr;
+ addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
+ addr->valid = 1;
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 80e2119f1c70..2b8f95290627 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -145,8 +145,14 @@ static int smc_release(struct socket *sock)
+ sk->sk_shutdown |= SHUTDOWN_MASK;
+ }
+ if (smc->clcsock) {
++ if (smc->use_fallback && sk->sk_state == SMC_LISTEN) {
++ /* wake up clcsock accept */
++ rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);
++ }
++ mutex_lock(&smc->clcsock_release_lock);
+ sock_release(smc->clcsock);
+ smc->clcsock = NULL;
++ mutex_unlock(&smc->clcsock_release_lock);
+ }
+ if (smc->use_fallback) {
+ if (sk->sk_state != SMC_LISTEN && sk->sk_state != SMC_INIT)
+@@ -203,6 +209,7 @@ static struct sock *smc_sock_alloc(struct net *net, struct socket *sock,
+ spin_lock_init(&smc->conn.send_lock);
+ sk->sk_prot->hash(sk);
+ sk_refcnt_debug_inc(sk);
++ mutex_init(&smc->clcsock_release_lock);
+
+ return sk;
+ }
+@@ -818,7 +825,7 @@ static int smc_clcsock_accept(struct smc_sock *lsmc, struct smc_sock **new_smc)
+ struct socket *new_clcsock = NULL;
+ struct sock *lsk = &lsmc->sk;
+ struct sock *new_sk;
+- int rc;
++ int rc = -EINVAL;
+
+ release_sock(lsk);
+ new_sk = smc_sock_alloc(sock_net(lsk), NULL, lsk->sk_protocol);
+@@ -831,7 +838,10 @@ static int smc_clcsock_accept(struct smc_sock *lsmc, struct smc_sock **new_smc)
+ }
+ *new_smc = smc_sk(new_sk);
+
+- rc = kernel_accept(lsmc->clcsock, &new_clcsock, 0);
++ mutex_lock(&lsmc->clcsock_release_lock);
++ if (lsmc->clcsock)
++ rc = kernel_accept(lsmc->clcsock, &new_clcsock, 0);
++ mutex_unlock(&lsmc->clcsock_release_lock);
+ lock_sock(lsk);
+ if (rc < 0)
+ lsk->sk_err = -rc;
+diff --git a/net/smc/smc.h b/net/smc/smc.h
+index 08786ace6010..5721416d0605 100644
+--- a/net/smc/smc.h
++++ b/net/smc/smc.h
+@@ -219,6 +219,10 @@ struct smc_sock { /* smc sock container */
+ * started, waiting for unsent
+ * data to be sent
+ */
++ struct mutex clcsock_release_lock;
++ /* protects clcsock of a listen
++ * socket
++ * */
+ };
+
+ static inline struct smc_sock *smc_sk(const struct sock *sk)
+diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
+index 5445145e639c..fc1c0d9ef57d 100644
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -574,7 +574,7 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
+ /* Don't enable netstamp, sunrpc doesn't
+ need that much accuracy */
+ }
+- svsk->sk_sk->sk_stamp = skb->tstamp;
++ sock_write_timestamp(svsk->sk_sk, skb->tstamp);
+ set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags); /* there may be more data... */
+
+ len = skb->len;
+diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
+index 645c16052052..2649a0a0d45e 100644
+--- a/net/tipc/bearer.c
++++ b/net/tipc/bearer.c
+@@ -317,7 +317,6 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ res = tipc_disc_create(net, b, &b->bcast_addr, &skb);
+ if (res) {
+ bearer_disable(net, b);
+- kfree(b);
+ errstr = "failed to create discoverer";
+ goto rejected;
+ }
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 366ce0bf2658..e1bdaf056c8f 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -878,7 +878,6 @@ static int tipc_send_group_unicast(struct socket *sock, struct msghdr *m,
+ DECLARE_SOCKADDR(struct sockaddr_tipc *, dest, m->msg_name);
+ int blks = tsk_blocks(GROUP_H_SIZE + dlen);
+ struct tipc_sock *tsk = tipc_sk(sk);
+- struct tipc_group *grp = tsk->group;
+ struct net *net = sock_net(sk);
+ struct tipc_member *mb = NULL;
+ u32 node, port;
+@@ -892,7 +891,9 @@ static int tipc_send_group_unicast(struct socket *sock, struct msghdr *m,
+ /* Block or return if destination link or member is congested */
+ rc = tipc_wait_for_cond(sock, &timeout,
+ !tipc_dest_find(&tsk->cong_links, node, 0) &&
+- !tipc_group_cong(grp, node, port, blks, &mb));
++ tsk->group &&
++ !tipc_group_cong(tsk->group, node, port, blks,
++ &mb));
+ if (unlikely(rc))
+ return rc;
+
+@@ -922,7 +923,6 @@ static int tipc_send_group_anycast(struct socket *sock, struct msghdr *m,
+ struct tipc_sock *tsk = tipc_sk(sk);
+ struct list_head *cong_links = &tsk->cong_links;
+ int blks = tsk_blocks(GROUP_H_SIZE + dlen);
+- struct tipc_group *grp = tsk->group;
+ struct tipc_msg *hdr = &tsk->phdr;
+ struct tipc_member *first = NULL;
+ struct tipc_member *mbr = NULL;
+@@ -939,9 +939,10 @@ static int tipc_send_group_anycast(struct socket *sock, struct msghdr *m,
+ type = msg_nametype(hdr);
+ inst = dest->addr.name.name.instance;
+ scope = msg_lookup_scope(hdr);
+- exclude = tipc_group_exclude(grp);
+
+ while (++lookups < 4) {
++ exclude = tipc_group_exclude(tsk->group);
++
+ first = NULL;
+
+ /* Look for a non-congested destination member, if any */
+@@ -950,7 +951,8 @@ static int tipc_send_group_anycast(struct socket *sock, struct msghdr *m,
+ &dstcnt, exclude, false))
+ return -EHOSTUNREACH;
+ tipc_dest_pop(&dsts, &node, &port);
+- cong = tipc_group_cong(grp, node, port, blks, &mbr);
++ cong = tipc_group_cong(tsk->group, node, port, blks,
++ &mbr);
+ if (!cong)
+ break;
+ if (mbr == first)
+@@ -969,7 +971,8 @@ static int tipc_send_group_anycast(struct socket *sock, struct msghdr *m,
+ /* Block or return if destination link or member is congested */
+ rc = tipc_wait_for_cond(sock, &timeout,
+ !tipc_dest_find(cong_links, node, 0) &&
+- !tipc_group_cong(grp, node, port,
++ tsk->group &&
++ !tipc_group_cong(tsk->group, node, port,
+ blks, &mbr));
+ if (unlikely(rc))
+ return rc;
+@@ -1004,8 +1007,7 @@ static int tipc_send_group_bcast(struct socket *sock, struct msghdr *m,
+ struct sock *sk = sock->sk;
+ struct net *net = sock_net(sk);
+ struct tipc_sock *tsk = tipc_sk(sk);
+- struct tipc_group *grp = tsk->group;
+- struct tipc_nlist *dsts = tipc_group_dests(grp);
++ struct tipc_nlist *dsts;
+ struct tipc_mc_method *method = &tsk->mc_method;
+ bool ack = method->mandatory && method->rcast;
+ int blks = tsk_blocks(MCAST_H_SIZE + dlen);
+@@ -1014,15 +1016,17 @@ static int tipc_send_group_bcast(struct socket *sock, struct msghdr *m,
+ struct sk_buff_head pkts;
+ int rc = -EHOSTUNREACH;
+
+- if (!dsts->local && !dsts->remote)
+- return -EHOSTUNREACH;
+-
+ /* Block or return if any destination link or member is congested */
+- rc = tipc_wait_for_cond(sock, &timeout, !tsk->cong_link_cnt &&
+- !tipc_group_bc_cong(grp, blks));
++ rc = tipc_wait_for_cond(sock, &timeout,
++ !tsk->cong_link_cnt && tsk->group &&
++ !tipc_group_bc_cong(tsk->group, blks));
+ if (unlikely(rc))
+ return rc;
+
++ dsts = tipc_group_dests(tsk->group);
++ if (!dsts->local && !dsts->remote)
++ return -EHOSTUNREACH;
++
+ /* Complete message header */
+ if (dest) {
+ msg_set_type(hdr, TIPC_GRP_MCAST_MSG);
+@@ -1034,7 +1038,7 @@ static int tipc_send_group_bcast(struct socket *sock, struct msghdr *m,
+ msg_set_hdr_sz(hdr, GROUP_H_SIZE);
+ msg_set_destport(hdr, 0);
+ msg_set_destnode(hdr, 0);
+- msg_set_grp_bc_seqno(hdr, tipc_group_bc_snd_nxt(grp));
++ msg_set_grp_bc_seqno(hdr, tipc_group_bc_snd_nxt(tsk->group));
+
+ /* Avoid getting stuck with repeated forced replicasts */
+ msg_set_grp_bc_ack_req(hdr, ack);
+@@ -2683,11 +2687,15 @@ void tipc_sk_reinit(struct net *net)
+ rhashtable_walk_start(&iter);
+
+ while ((tsk = rhashtable_walk_next(&iter)) && !IS_ERR(tsk)) {
+- spin_lock_bh(&tsk->sk.sk_lock.slock);
++ sock_hold(&tsk->sk);
++ rhashtable_walk_stop(&iter);
++ lock_sock(&tsk->sk);
+ msg = &tsk->phdr;
+ msg_set_prevnode(msg, tipc_own_addr(net));
+ msg_set_orignode(msg, tipc_own_addr(net));
+- spin_unlock_bh(&tsk->sk.sk_lock.slock);
++ release_sock(&tsk->sk);
++ rhashtable_walk_start(&iter);
++ sock_put(&tsk->sk);
+ }
+
+ rhashtable_walk_stop(&iter);
+diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
+index 9783101bc4a9..da2d311476ab 100644
+--- a/net/tipc/udp_media.c
++++ b/net/tipc/udp_media.c
+@@ -245,10 +245,8 @@ static int tipc_udp_send_msg(struct net *net, struct sk_buff *skb,
+ }
+
+ err = tipc_udp_xmit(net, _skb, ub, src, &rcast->addr);
+- if (err) {
+- kfree_skb(_skb);
++ if (err)
+ goto out;
+- }
+ }
+ err = 0;
+ out:
+@@ -680,6 +678,11 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
+ if (err)
+ goto err;
+
++ if (remote.proto != local.proto) {
++ err = -EINVAL;
++ goto err;
++ }
++
+ /* Autoconfigure own node identity if needed */
+ if (!tipc_own_id(net)) {
+ memcpy(node_id, local.ipv6.in6_u.u6_addr8, 16);
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index 523622dc74f8..7fab2891ce7f 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -550,7 +550,7 @@ static struct tls_context *create_ctx(struct sock *sk)
+ struct inet_connection_sock *icsk = inet_csk(sk);
+ struct tls_context *ctx;
+
+- ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
++ ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
+ if (!ctx)
+ return NULL;
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index cb332adb84cd..c361ce782412 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -263,6 +263,31 @@ vmci_transport_send_control_pkt_bh(struct sockaddr_vm *src,
+ false);
+ }
+
++static int
++vmci_transport_alloc_send_control_pkt(struct sockaddr_vm *src,
++ struct sockaddr_vm *dst,
++ enum vmci_transport_packet_type type,
++ u64 size,
++ u64 mode,
++ struct vmci_transport_waiting_info *wait,
++ u16 proto,
++ struct vmci_handle handle)
++{
++ struct vmci_transport_packet *pkt;
++ int err;
++
++ pkt = kmalloc(sizeof(*pkt), GFP_KERNEL);
++ if (!pkt)
++ return -ENOMEM;
++
++ err = __vmci_transport_send_control_pkt(pkt, src, dst, type, size,
++ mode, wait, proto, handle,
++ true);
++ kfree(pkt);
++
++ return err;
++}
++
+ static int
+ vmci_transport_send_control_pkt(struct sock *sk,
+ enum vmci_transport_packet_type type,
+@@ -272,9 +297,7 @@ vmci_transport_send_control_pkt(struct sock *sk,
+ u16 proto,
+ struct vmci_handle handle)
+ {
+- struct vmci_transport_packet *pkt;
+ struct vsock_sock *vsk;
+- int err;
+
+ vsk = vsock_sk(sk);
+
+@@ -284,17 +307,10 @@ vmci_transport_send_control_pkt(struct sock *sk,
+ if (!vsock_addr_bound(&vsk->remote_addr))
+ return -EINVAL;
+
+- pkt = kmalloc(sizeof(*pkt), GFP_KERNEL);
+- if (!pkt)
+- return -ENOMEM;
+-
+- err = __vmci_transport_send_control_pkt(pkt, &vsk->local_addr,
+- &vsk->remote_addr, type, size,
+- mode, wait, proto, handle,
+- true);
+- kfree(pkt);
+-
+- return err;
++ return vmci_transport_alloc_send_control_pkt(&vsk->local_addr,
++ &vsk->remote_addr,
++ type, size, mode,
++ wait, proto, handle);
+ }
+
+ static int vmci_transport_send_reset_bh(struct sockaddr_vm *dst,
+@@ -312,12 +328,29 @@ static int vmci_transport_send_reset_bh(struct sockaddr_vm *dst,
+ static int vmci_transport_send_reset(struct sock *sk,
+ struct vmci_transport_packet *pkt)
+ {
++ struct sockaddr_vm *dst_ptr;
++ struct sockaddr_vm dst;
++ struct vsock_sock *vsk;
++
+ if (pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST)
+ return 0;
+- return vmci_transport_send_control_pkt(sk,
+- VMCI_TRANSPORT_PACKET_TYPE_RST,
+- 0, 0, NULL, VSOCK_PROTO_INVALID,
+- VMCI_INVALID_HANDLE);
++
++ vsk = vsock_sk(sk);
++
++ if (!vsock_addr_bound(&vsk->local_addr))
++ return -EINVAL;
++
++ if (vsock_addr_bound(&vsk->remote_addr)) {
++ dst_ptr = &vsk->remote_addr;
++ } else {
++ vsock_addr_init(&dst, pkt->dg.src.context,
++ pkt->src_port);
++ dst_ptr = &dst;
++ }
++ return vmci_transport_alloc_send_control_pkt(&vsk->local_addr, dst_ptr,
++ VMCI_TRANSPORT_PACKET_TYPE_RST,
++ 0, 0, NULL, VSOCK_PROTO_INVALID,
++ VMCI_INVALID_HANDLE);
+ }
+
+ static int vmci_transport_send_negotiate(struct sock *sk, size_t size)
+diff --git a/sound/core/pcm.c b/sound/core/pcm.c
+index fdb9b92fc8d6..01b9d62eef14 100644
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -25,6 +25,7 @@
+ #include <linux/time.h>
+ #include <linux/mutex.h>
+ #include <linux/device.h>
++#include <linux/nospec.h>
+ #include <sound/core.h>
+ #include <sound/minors.h>
+ #include <sound/pcm.h>
+@@ -129,6 +130,7 @@ static int snd_pcm_control_ioctl(struct snd_card *card,
+ return -EFAULT;
+ if (stream < 0 || stream > 1)
+ return -EINVAL;
++ stream = array_index_nospec(stream, 2);
+ if (get_user(subdevice, &info->subdevice))
+ return -EFAULT;
+ mutex_lock(®ister_mutex);
+diff --git a/sound/firewire/amdtp-stream-trace.h b/sound/firewire/amdtp-stream-trace.h
+index 54cdd4ffa9ce..ac20acf48fc6 100644
+--- a/sound/firewire/amdtp-stream-trace.h
++++ b/sound/firewire/amdtp-stream-trace.h
+@@ -131,7 +131,7 @@ TRACE_EVENT(in_packet_without_header,
+ __entry->index = index;
+ ),
+ TP_printk(
+- "%02u %04u %04x %04x %02d %03u %3u %3u %02u %01u %02u",
++ "%02u %04u %04x %04x %02d %03u %02u %03u %02u %01u %02u",
+ __entry->second,
+ __entry->cycle,
+ __entry->src,
+@@ -169,7 +169,7 @@ TRACE_EVENT(out_packet_without_header,
+ __entry->dest = fw_parent_device(s->unit)->node_id;
+ __entry->payload_quadlets = payload_length / 4;
+ __entry->data_blocks = data_blocks,
+- __entry->data_blocks = s->data_block_counter,
++ __entry->data_block_counter = s->data_block_counter,
+ __entry->packet_index = s->packet_index;
+ __entry->irq = !!in_interrupt();
+ __entry->index = index;
+diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c
+index cb9acfe60f6a..293933f469d6 100644
+--- a/sound/firewire/amdtp-stream.c
++++ b/sound/firewire/amdtp-stream.c
+@@ -629,15 +629,17 @@ end:
+ }
+
+ static int handle_in_packet_without_header(struct amdtp_stream *s,
+- unsigned int payload_quadlets, unsigned int cycle,
++ unsigned int payload_length, unsigned int cycle,
+ unsigned int index)
+ {
+ __be32 *buffer;
++ unsigned int payload_quadlets;
+ unsigned int data_blocks;
+ struct snd_pcm_substream *pcm;
+ unsigned int pcm_frames;
+
+ buffer = s->buffer.packets[s->packet_index].buffer;
++ payload_quadlets = payload_length / 4;
+ data_blocks = payload_quadlets / s->data_block_quadlets;
+
+ trace_in_packet_without_header(s, cycle, payload_quadlets, data_blocks,
+diff --git a/sound/firewire/fireface/ff-protocol-ff400.c b/sound/firewire/fireface/ff-protocol-ff400.c
+index 654a50319198..4d191172fe3f 100644
+--- a/sound/firewire/fireface/ff-protocol-ff400.c
++++ b/sound/firewire/fireface/ff-protocol-ff400.c
+@@ -152,7 +152,7 @@ static int ff400_switch_fetching_mode(struct snd_ff *ff, bool enable)
+ if (reg == NULL)
+ return -ENOMEM;
+
+- if (enable) {
++ if (!enable) {
+ /*
+ * Each quadlet is corresponding to data channels in a data
+ * blocks in reverse order. Precisely, quadlets for available
+diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
+index 6ebe817801ea..1f25e6d029d8 100644
+--- a/sound/pci/emu10k1/emufx.c
++++ b/sound/pci/emu10k1/emufx.c
+@@ -36,6 +36,7 @@
+ #include <linux/init.h>
+ #include <linux/mutex.h>
+ #include <linux/moduleparam.h>
++#include <linux/nospec.h>
+
+ #include <sound/core.h>
+ #include <sound/tlv.h>
+@@ -1026,6 +1027,8 @@ static int snd_emu10k1_ipcm_poke(struct snd_emu10k1 *emu,
+
+ if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT)
+ return -EINVAL;
++ ipcm->substream = array_index_nospec(ipcm->substream,
++ EMU10K1_FX8010_PCM_COUNT);
+ if (ipcm->channels > 32)
+ return -EINVAL;
+ pcm = &emu->fx8010.pcm[ipcm->substream];
+@@ -1072,6 +1075,8 @@ static int snd_emu10k1_ipcm_peek(struct snd_emu10k1 *emu,
+
+ if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT)
+ return -EINVAL;
++ ipcm->substream = array_index_nospec(ipcm->substream,
++ EMU10K1_FX8010_PCM_COUNT);
+ pcm = &emu->fx8010.pcm[ipcm->substream];
+ mutex_lock(&emu->fx8010.lock);
+ spin_lock_irq(&emu->reg_lock);
+diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
+index 0621920f7617..e85fb04ec7be 100644
+--- a/sound/pci/hda/hda_tegra.c
++++ b/sound/pci/hda/hda_tegra.c
+@@ -249,10 +249,12 @@ static int hda_tegra_suspend(struct device *dev)
+ struct snd_card *card = dev_get_drvdata(dev);
+ struct azx *chip = card->private_data;
+ struct hda_tegra *hda = container_of(chip, struct hda_tegra, chip);
++ struct hdac_bus *bus = azx_bus(chip);
+
+ snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+
+ azx_stop_chip(chip);
++ synchronize_irq(bus->irq);
+ azx_enter_link_reset(chip);
+ hda_tegra_disable_clocks(hda);
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 3c5f2a603754..f9176e3b4d37 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -923,6 +923,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
++ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 8a3d0694d2e5..854d63c01dd2 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6424,7 +6424,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ [ALC294_FIXUP_ASUS_HEADSET_MIC] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+- { 0x19, 0x01a1113c }, /* use as headset mic, without its own jack detect */
++ { 0x19, 0x01a1103c }, /* use as headset mic */
+ { }
+ },
+ .chained = true,
+@@ -6573,6 +6573,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK),
+ SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
+index 1bff4b1b39cd..ba99ff0e93e0 100644
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -30,6 +30,7 @@
+ #include <linux/math64.h>
+ #include <linux/vmalloc.h>
+ #include <linux/io.h>
++#include <linux/nospec.h>
+
+ #include <sound/core.h>
+ #include <sound/control.h>
+@@ -4092,15 +4093,16 @@ static int snd_hdsp_channel_info(struct snd_pcm_substream *substream,
+ struct snd_pcm_channel_info *info)
+ {
+ struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+- int mapped_channel;
++ unsigned int channel = info->channel;
+
+- if (snd_BUG_ON(info->channel >= hdsp->max_channels))
++ if (snd_BUG_ON(channel >= hdsp->max_channels))
+ return -EINVAL;
++ channel = array_index_nospec(channel, hdsp->max_channels);
+
+- if ((mapped_channel = hdsp->channel_map[info->channel]) < 0)
++ if (hdsp->channel_map[channel] < 0)
+ return -EINVAL;
+
+- info->offset = mapped_channel * HDSP_CHANNEL_BUFFER_BYTES;
++ info->offset = hdsp->channel_map[channel] * HDSP_CHANNEL_BUFFER_BYTES;
+ info->first = 0;
+ info->step = 32;
+ return 0;
+diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+index 9d9f6e41d81c..08a5152e635a 100644
+--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
++++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+@@ -389,6 +389,20 @@ static struct snd_soc_card snd_soc_card_cht = {
+ };
+
+ static const struct dmi_system_id cht_max98090_quirk_table[] = {
++ {
++ /* Clapper model Chromebook */
++ .matches = {
++ DMI_MATCH(DMI_PRODUCT_NAME, "Clapper"),
++ },
++ .driver_data = (void *)QUIRK_PMC_PLT_CLK_0,
++ },
++ {
++ /* Gnawty model Chromebook (Acer Chromebook CB3-111) */
++ .matches = {
++ DMI_MATCH(DMI_PRODUCT_NAME, "Gnawty"),
++ },
++ .driver_data = (void *)QUIRK_PMC_PLT_CLK_0,
++ },
+ {
+ /* Swanky model Chromebook (Toshiba Chromebook 2) */
+ .matches = {
+diff --git a/sound/synth/emux/emux_hwdep.c b/sound/synth/emux/emux_hwdep.c
+index e557946718a9..d9fcae071b47 100644
+--- a/sound/synth/emux/emux_hwdep.c
++++ b/sound/synth/emux/emux_hwdep.c
+@@ -22,9 +22,9 @@
+ #include <sound/core.h>
+ #include <sound/hwdep.h>
+ #include <linux/uaccess.h>
++#include <linux/nospec.h>
+ #include "emux_voice.h"
+
+-
+ #define TMP_CLIENT_ID 0x1001
+
+ /*
+@@ -66,13 +66,16 @@ snd_emux_hwdep_misc_mode(struct snd_emux *emu, void __user *arg)
+ return -EFAULT;
+ if (info.mode < 0 || info.mode >= EMUX_MD_END)
+ return -EINVAL;
++ info.mode = array_index_nospec(info.mode, EMUX_MD_END);
+
+ if (info.port < 0) {
+ for (i = 0; i < emu->num_ports; i++)
+ emu->portptrs[i]->ctrls[info.mode] = info.value;
+ } else {
+- if (info.port < emu->num_ports)
++ if (info.port < emu->num_ports) {
++ info.port = array_index_nospec(info.port, emu->num_ports);
+ emu->portptrs[info.port]->ctrls[info.mode] = info.value;
++ }
+ }
+ return 0;
+ }
+diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
+index ce1e20227c64..75de355a63d6 100644
+--- a/tools/lib/traceevent/event-parse.c
++++ b/tools/lib/traceevent/event-parse.c
+@@ -4968,6 +4968,7 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event
+
+ if (arg->type == PRINT_BSTRING) {
+ trace_seq_puts(s, arg->string.string);
++ arg = arg->next;
+ break;
+ }
+
+diff --git a/tools/perf/arch/common.c b/tools/perf/arch/common.c
+index 82657c01a3b8..5f69fd0b745a 100644
+--- a/tools/perf/arch/common.c
++++ b/tools/perf/arch/common.c
+@@ -200,3 +200,13 @@ int perf_env__lookup_objdump(struct perf_env *env, const char **path)
+
+ return perf_env__lookup_binutils_path(env, "objdump", path);
+ }
++
++/*
++ * Some architectures have a single address space for kernel and user addresses,
++ * which makes it possible to determine if an address is in kernel space or user
++ * space.
++ */
++bool perf_env__single_address_space(struct perf_env *env)
++{
++ return strcmp(perf_env__arch(env), "sparc");
++}
+diff --git a/tools/perf/arch/common.h b/tools/perf/arch/common.h
+index 2167001b18c5..c298a446d1f6 100644
+--- a/tools/perf/arch/common.h
++++ b/tools/perf/arch/common.h
+@@ -5,5 +5,6 @@
+ #include "../util/env.h"
+
+ int perf_env__lookup_objdump(struct perf_env *env, const char **path);
++bool perf_env__single_address_space(struct perf_env *env);
+
+ #endif /* ARCH_PERF_COMMON_H */
+diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
+index ba481d73f910..6c1e7ceedcf3 100644
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -727,8 +727,8 @@ static int perf_sample__fprintf_brstack(struct perf_sample *sample,
+ if (PRINT_FIELD(DSO)) {
+ memset(&alf, 0, sizeof(alf));
+ memset(&alt, 0, sizeof(alt));
+- thread__find_map(thread, sample->cpumode, from, &alf);
+- thread__find_map(thread, sample->cpumode, to, &alt);
++ thread__find_map_fb(thread, sample->cpumode, from, &alf);
++ thread__find_map_fb(thread, sample->cpumode, to, &alt);
+ }
+
+ printed += fprintf(fp, " 0x%"PRIx64, from);
+@@ -774,8 +774,8 @@ static int perf_sample__fprintf_brstacksym(struct perf_sample *sample,
+ from = br->entries[i].from;
+ to = br->entries[i].to;
+
+- thread__find_symbol(thread, sample->cpumode, from, &alf);
+- thread__find_symbol(thread, sample->cpumode, to, &alt);
++ thread__find_symbol_fb(thread, sample->cpumode, from, &alf);
++ thread__find_symbol_fb(thread, sample->cpumode, to, &alt);
+
+ printed += symbol__fprintf_symname_offs(alf.sym, &alf, fp);
+ if (PRINT_FIELD(DSO)) {
+@@ -819,11 +819,11 @@ static int perf_sample__fprintf_brstackoff(struct perf_sample *sample,
+ from = br->entries[i].from;
+ to = br->entries[i].to;
+
+- if (thread__find_map(thread, sample->cpumode, from, &alf) &&
++ if (thread__find_map_fb(thread, sample->cpumode, from, &alf) &&
+ !alf.map->dso->adjust_symbols)
+ from = map__map_ip(alf.map, from);
+
+- if (thread__find_map(thread, sample->cpumode, to, &alt) &&
++ if (thread__find_map_fb(thread, sample->cpumode, to, &alt) &&
+ !alt.map->dso->adjust_symbols)
+ to = map__map_ip(alt.map, to);
+
+diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c
+index 59f38c7693f8..4c23779e271a 100644
+--- a/tools/perf/util/env.c
++++ b/tools/perf/util/env.c
+@@ -166,7 +166,7 @@ const char *perf_env__arch(struct perf_env *env)
+ struct utsname uts;
+ char *arch_name;
+
+- if (!env) { /* Assume local operation */
++ if (!env || !env->arch) { /* Assume local operation */
+ if (uname(&uts) < 0)
+ return NULL;
+ arch_name = uts.machine;
+diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
+index bc646185f8d9..aa9c7df120ca 100644
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -1576,6 +1576,24 @@ struct map *thread__find_map(struct thread *thread, u8 cpumode, u64 addr,
+ return al->map;
+ }
+
++/*
++ * For branch stacks or branch samples, the sample cpumode might not be correct
++ * because it applies only to the sample 'ip' and not necessary to 'addr' or
++ * branch stack addresses. If possible, use a fallback to deal with those cases.
++ */
++struct map *thread__find_map_fb(struct thread *thread, u8 cpumode, u64 addr,
++ struct addr_location *al)
++{
++ struct map *map = thread__find_map(thread, cpumode, addr, al);
++ struct machine *machine = thread->mg->machine;
++ u8 addr_cpumode = machine__addr_cpumode(machine, cpumode, addr);
++
++ if (map || addr_cpumode == cpumode)
++ return map;
++
++ return thread__find_map(thread, addr_cpumode, addr, al);
++}
++
+ struct symbol *thread__find_symbol(struct thread *thread, u8 cpumode,
+ u64 addr, struct addr_location *al)
+ {
+@@ -1585,6 +1603,15 @@ struct symbol *thread__find_symbol(struct thread *thread, u8 cpumode,
+ return al->sym;
+ }
+
++struct symbol *thread__find_symbol_fb(struct thread *thread, u8 cpumode,
++ u64 addr, struct addr_location *al)
++{
++ al->sym = NULL;
++ if (thread__find_map_fb(thread, cpumode, addr, al))
++ al->sym = map__find_symbol(al->map, al->addr);
++ return al->sym;
++}
++
+ /*
+ * Callers need to drop the reference to al->thread, obtained in
+ * machine__findnew_thread()
+@@ -1678,7 +1705,7 @@ bool sample_addr_correlates_sym(struct perf_event_attr *attr)
+ void thread__resolve(struct thread *thread, struct addr_location *al,
+ struct perf_sample *sample)
+ {
+- thread__find_map(thread, sample->cpumode, sample->addr, al);
++ thread__find_map_fb(thread, sample->cpumode, sample->addr, al);
+
+ al->cpu = sample->cpu;
+ al->sym = NULL;
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index 8ee8ab39d8ac..d7403d1207d7 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -2575,6 +2575,33 @@ int machine__get_kernel_start(struct machine *machine)
+ return err;
+ }
+
++u8 machine__addr_cpumode(struct machine *machine, u8 cpumode, u64 addr)
++{
++ u8 addr_cpumode = cpumode;
++ bool kernel_ip;
++
++ if (!machine->single_address_space)
++ goto out;
++
++ kernel_ip = machine__kernel_ip(machine, addr);
++ switch (cpumode) {
++ case PERF_RECORD_MISC_KERNEL:
++ case PERF_RECORD_MISC_USER:
++ addr_cpumode = kernel_ip ? PERF_RECORD_MISC_KERNEL :
++ PERF_RECORD_MISC_USER;
++ break;
++ case PERF_RECORD_MISC_GUEST_KERNEL:
++ case PERF_RECORD_MISC_GUEST_USER:
++ addr_cpumode = kernel_ip ? PERF_RECORD_MISC_GUEST_KERNEL :
++ PERF_RECORD_MISC_GUEST_USER;
++ break;
++ default:
++ break;
++ }
++out:
++ return addr_cpumode;
++}
++
+ struct dso *machine__findnew_dso(struct machine *machine, const char *filename)
+ {
+ return dsos__findnew(&machine->dsos, filename);
+diff --git a/tools/perf/util/machine.h b/tools/perf/util/machine.h
+index d856b85862e2..ebde3ea70225 100644
+--- a/tools/perf/util/machine.h
++++ b/tools/perf/util/machine.h
+@@ -42,6 +42,7 @@ struct machine {
+ u16 id_hdr_size;
+ bool comm_exec;
+ bool kptr_restrict_warned;
++ bool single_address_space;
+ char *root_dir;
+ char *mmap_name;
+ struct threads threads[THREADS__TABLE_SIZE];
+@@ -99,6 +100,8 @@ static inline bool machine__kernel_ip(struct machine *machine, u64 ip)
+ return ip >= kernel_start;
+ }
+
++u8 machine__addr_cpumode(struct machine *machine, u8 cpumode, u64 addr);
++
+ struct thread *machine__find_thread(struct machine *machine, pid_t pid,
+ pid_t tid);
+ struct comm *machine__thread_exec_comm(struct machine *machine,
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index 7e49baad304d..7348eea0248f 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -145,7 +145,7 @@ static int perf_pmu__parse_scale(struct perf_pmu_alias *alias, char *dir, char *
+ int fd, ret = -1;
+ char path[PATH_MAX];
+
+- snprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
++ scnprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1)
+@@ -175,7 +175,7 @@ static int perf_pmu__parse_unit(struct perf_pmu_alias *alias, char *dir, char *n
+ ssize_t sret;
+ int fd;
+
+- snprintf(path, PATH_MAX, "%s/%s.unit", dir, name);
++ scnprintf(path, PATH_MAX, "%s/%s.unit", dir, name);
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1)
+@@ -205,7 +205,7 @@ perf_pmu__parse_per_pkg(struct perf_pmu_alias *alias, char *dir, char *name)
+ char path[PATH_MAX];
+ int fd;
+
+- snprintf(path, PATH_MAX, "%s/%s.per-pkg", dir, name);
++ scnprintf(path, PATH_MAX, "%s/%s.per-pkg", dir, name);
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1)
+@@ -223,7 +223,7 @@ static int perf_pmu__parse_snapshot(struct perf_pmu_alias *alias,
+ char path[PATH_MAX];
+ int fd;
+
+- snprintf(path, PATH_MAX, "%s/%s.snapshot", dir, name);
++ scnprintf(path, PATH_MAX, "%s/%s.snapshot", dir, name);
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1)
+diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
+index dfc6093f118c..05d95de14e20 100644
+--- a/tools/perf/util/scripting-engines/trace-event-python.c
++++ b/tools/perf/util/scripting-engines/trace-event-python.c
+@@ -494,14 +494,14 @@ static PyObject *python_process_brstack(struct perf_sample *sample,
+ pydict_set_item_string_decref(pyelem, "cycles",
+ PyLong_FromUnsignedLongLong(br->entries[i].flags.cycles));
+
+- thread__find_map(thread, sample->cpumode,
+- br->entries[i].from, &al);
++ thread__find_map_fb(thread, sample->cpumode,
++ br->entries[i].from, &al);
+ dsoname = get_dsoname(al.map);
+ pydict_set_item_string_decref(pyelem, "from_dsoname",
+ _PyUnicode_FromString(dsoname));
+
+- thread__find_map(thread, sample->cpumode,
+- br->entries[i].to, &al);
++ thread__find_map_fb(thread, sample->cpumode,
++ br->entries[i].to, &al);
+ dsoname = get_dsoname(al.map);
+ pydict_set_item_string_decref(pyelem, "to_dsoname",
+ _PyUnicode_FromString(dsoname));
+@@ -576,14 +576,14 @@ static PyObject *python_process_brstacksym(struct perf_sample *sample,
+ if (!pyelem)
+ Py_FatalError("couldn't create Python dictionary");
+
+- thread__find_symbol(thread, sample->cpumode,
+- br->entries[i].from, &al);
++ thread__find_symbol_fb(thread, sample->cpumode,
++ br->entries[i].from, &al);
+ get_symoff(al.sym, &al, true, bf, sizeof(bf));
+ pydict_set_item_string_decref(pyelem, "from",
+ _PyUnicode_FromString(bf));
+
+- thread__find_symbol(thread, sample->cpumode,
+- br->entries[i].to, &al);
++ thread__find_symbol_fb(thread, sample->cpumode,
++ br->entries[i].to, &al);
+ get_symoff(al.sym, &al, true, bf, sizeof(bf));
+ pydict_set_item_string_decref(pyelem, "to",
+ _PyUnicode_FromString(bf));
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 8b9369303561..11086097fc9f 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -24,6 +24,7 @@
+ #include "thread.h"
+ #include "thread-stack.h"
+ #include "stat.h"
++#include "arch/common.h"
+
+ static int perf_session__deliver_event(struct perf_session *session,
+ union perf_event *event,
+@@ -150,6 +151,9 @@ struct perf_session *perf_session__new(struct perf_data *data,
+ session->machines.host.env = &perf_env;
+ }
+
++ session->machines.host.single_address_space =
++ perf_env__single_address_space(session->machines.host.env);
++
+ if (!data || perf_data__is_write(data)) {
+ /*
+ * In O_RDONLY mode this will be performed when reading the
+diff --git a/tools/perf/util/thread.h b/tools/perf/util/thread.h
+index 07606aa6998d..4e2c3cbdea4b 100644
+--- a/tools/perf/util/thread.h
++++ b/tools/perf/util/thread.h
+@@ -94,9 +94,13 @@ struct thread *thread__main_thread(struct machine *machine, struct thread *threa
+
+ struct map *thread__find_map(struct thread *thread, u8 cpumode, u64 addr,
+ struct addr_location *al);
++struct map *thread__find_map_fb(struct thread *thread, u8 cpumode, u64 addr,
++ struct addr_location *al);
+
+ struct symbol *thread__find_symbol(struct thread *thread, u8 cpumode,
+ u64 addr, struct addr_location *al);
++struct symbol *thread__find_symbol_fb(struct thread *thread, u8 cpumode,
++ u64 addr, struct addr_location *al);
+
+ void thread__find_cpumode_addr_location(struct thread *thread, u64 addr,
+ struct addr_location *al);
+diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
+index f56ff1cf52ec..ceeda7e04a4d 100644
+--- a/virt/kvm/arm/vgic/vgic-mmio.c
++++ b/virt/kvm/arm/vgic/vgic-mmio.c
+@@ -313,36 +313,30 @@ static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
+
+ spin_lock_irqsave(&irq->irq_lock, flags);
+
+- /*
+- * If this virtual IRQ was written into a list register, we
+- * have to make sure the CPU that runs the VCPU thread has
+- * synced back the LR state to the struct vgic_irq.
+- *
+- * As long as the conditions below are true, we know the VCPU thread
+- * may be on its way back from the guest (we kicked the VCPU thread in
+- * vgic_change_active_prepare) and still has to sync back this IRQ,
+- * so we release and re-acquire the spin_lock to let the other thread
+- * sync back the IRQ.
+- *
+- * When accessing VGIC state from user space, requester_vcpu is
+- * NULL, which is fine, because we guarantee that no VCPUs are running
+- * when accessing VGIC state from user space so irq->vcpu->cpu is
+- * always -1.
+- */
+- while (irq->vcpu && /* IRQ may have state in an LR somewhere */
+- irq->vcpu != requester_vcpu && /* Current thread is not the VCPU thread */
+- irq->vcpu->cpu != -1) /* VCPU thread is running */
+- cond_resched_lock(&irq->irq_lock);
+-
+ if (irq->hw) {
+ vgic_hw_irq_change_active(vcpu, irq, active, !requester_vcpu);
+ } else {
+ u32 model = vcpu->kvm->arch.vgic.vgic_model;
++ u8 active_source;
+
+ irq->active = active;
++
++ /*
++ * The GICv2 architecture indicates that the source CPUID for
++ * an SGI should be provided during an EOI which implies that
++ * the active state is stored somewhere, but at the same time
++ * this state is not architecturally exposed anywhere and we
++ * have no way of knowing the right source.
++ *
++ * This may lead to a VCPU not being able to receive
++ * additional instances of a particular SGI after migration
++ * for a GICv2 VM on some GIC implementations. Oh well.
++ */
++ active_source = (requester_vcpu) ? requester_vcpu->vcpu_id : 0;
++
+ if (model == KVM_DEV_TYPE_ARM_VGIC_V2 &&
+ active && vgic_irq_is_sgi(irq->intid))
+- irq->active_source = requester_vcpu->vcpu_id;
++ irq->active_source = active_source;
+ }
+
+ if (irq->active)
+@@ -368,14 +362,16 @@ static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
+ */
+ static void vgic_change_active_prepare(struct kvm_vcpu *vcpu, u32 intid)
+ {
+- if (intid > VGIC_NR_PRIVATE_IRQS)
++ if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
++ intid > VGIC_NR_PRIVATE_IRQS)
+ kvm_arm_halt_guest(vcpu->kvm);
+ }
+
+ /* See vgic_change_active_prepare */
+ static void vgic_change_active_finish(struct kvm_vcpu *vcpu, u32 intid)
+ {
+- if (intid > VGIC_NR_PRIVATE_IRQS)
++ if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
++ intid > VGIC_NR_PRIVATE_IRQS)
+ kvm_arm_resume_guest(vcpu->kvm);
+ }
+
+diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
+index 7cfdfbc910e0..f884a54b2601 100644
+--- a/virt/kvm/arm/vgic/vgic.c
++++ b/virt/kvm/arm/vgic/vgic.c
+@@ -103,13 +103,13 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu,
+ {
+ /* SGIs and PPIs */
+ if (intid <= VGIC_MAX_PRIVATE) {
+- intid = array_index_nospec(intid, VGIC_MAX_PRIVATE);
++ intid = array_index_nospec(intid, VGIC_MAX_PRIVATE + 1);
+ return &vcpu->arch.vgic_cpu.private_irqs[intid];
+ }
+
+ /* SPIs */
+- if (intid <= VGIC_MAX_SPI) {
+- intid = array_index_nospec(intid, VGIC_MAX_SPI);
++ if (intid < (kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS)) {
++ intid = array_index_nospec(intid, kvm->arch.vgic.nr_spis + VGIC_NR_PRIVATE_IRQS);
+ return &kvm->arch.vgic.spis[intid - VGIC_NR_PRIVATE_IRQS];
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-01-13 19:29 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-01-13 19:29 UTC (permalink / raw
To: gentoo-commits
commit: deac9d11b550ed21fa6adccef30f618c1037ed28
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 13 19:28:50 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jan 13 19:28:50 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=deac9d11
proj/linux-patches: Linux patch 4.19.15
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1014_linux-4.19.15.patch | 5529 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5533 insertions(+)
diff --git a/0000_README b/0000_README
index 5bb2bcd..2970cec 100644
--- a/0000_README
+++ b/0000_README
@@ -99,6 +99,10 @@ Patch: 1013_linux-4.19.14.patch
From: http://www.kernel.org
Desc: Linux 4.19.14
+Patch: 1014_linux-4.19.15.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.15
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1014_linux-4.19.15.patch b/1014_linux-4.19.15.patch
new file mode 100644
index 0000000..f589723
--- /dev/null
+++ b/1014_linux-4.19.15.patch
@@ -0,0 +1,5529 @@
+diff --git a/Makefile b/Makefile
+index 3324dd0e11a3..0e30d48274fa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 14
++SUBLEVEL = 15
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -482,18 +482,18 @@ endif
+
+ ifeq ($(cc-name),clang)
+ ifneq ($(CROSS_COMPILE),)
+-CLANG_TARGET := --target=$(notdir $(CROSS_COMPILE:%-=%))
++CLANG_FLAGS := --target=$(notdir $(CROSS_COMPILE:%-=%))
+ GCC_TOOLCHAIN_DIR := $(dir $(shell which $(LD)))
+-CLANG_PREFIX := --prefix=$(GCC_TOOLCHAIN_DIR)
++CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)
+ GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..)
+ endif
+ ifneq ($(GCC_TOOLCHAIN),)
+-CLANG_GCC_TC := --gcc-toolchain=$(GCC_TOOLCHAIN)
++CLANG_FLAGS += --gcc-toolchain=$(GCC_TOOLCHAIN)
+ endif
+-KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) $(CLANG_PREFIX)
+-KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) $(CLANG_PREFIX)
+-KBUILD_CFLAGS += $(call cc-option, -no-integrated-as)
+-KBUILD_AFLAGS += $(call cc-option, -no-integrated-as)
++CLANG_FLAGS += -no-integrated-as
++KBUILD_CFLAGS += $(CLANG_FLAGS)
++KBUILD_AFLAGS += $(CLANG_FLAGS)
++export CLANG_FLAGS
+ endif
+
+ RETPOLINE_CFLAGS_GCC := -mindirect-branch=thunk-extern -mindirect-branch-register
+@@ -954,11 +954,6 @@ ifdef CONFIG_STACK_VALIDATION
+ ifeq ($(has_libelf),1)
+ objtool_target := tools/objtool FORCE
+ else
+- ifdef CONFIG_UNWINDER_ORC
+- $(error "Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+- else
+- $(warning "Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel")
+- endif
+ SKIP_STACK_VALIDATION := 1
+ export SKIP_STACK_VALIDATION
+ endif
+@@ -1115,6 +1110,14 @@ uapi-asm-generic:
+
+ PHONY += prepare-objtool
+ prepare-objtool: $(objtool_target)
++ifeq ($(SKIP_STACK_VALIDATION),1)
++ifdef CONFIG_UNWINDER_ORC
++ @echo "error: Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel" >&2
++ @false
++else
++ @echo "warning: Cannot use CONFIG_STACK_VALIDATION=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel" >&2
++endif
++endif
+
+ # Generate some files
+ # ---------------------------------------------------------------------------
+diff --git a/arch/arm/boot/dts/imx7d-nitrogen7.dts b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+index d8aac4a2d02a..177d21fdeb28 100644
+--- a/arch/arm/boot/dts/imx7d-nitrogen7.dts
++++ b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+@@ -86,13 +86,17 @@
+ compatible = "regulator-fixed";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+- clocks = <&clks IMX7D_CLKO2_ROOT_DIV>;
+- clock-names = "slow";
+ regulator-name = "reg_wlan";
+ startup-delay-us = <70000>;
+ gpio = <&gpio4 21 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+ };
++
++ usdhc2_pwrseq: usdhc2_pwrseq {
++ compatible = "mmc-pwrseq-simple";
++ clocks = <&clks IMX7D_CLKO2_ROOT_DIV>;
++ clock-names = "ext_clock";
++ };
+ };
+
+ &adc1 {
+@@ -375,6 +379,7 @@
+ bus-width = <4>;
+ non-removable;
+ vmmc-supply = <®_wlan>;
++ mmc-pwrseq = <&usdhc2_pwrseq>;
+ cap-power-off-card;
+ keep-power-in-suspend;
+ status = "okay";
+diff --git a/arch/arm/boot/dts/imx7d-pico.dtsi b/arch/arm/boot/dts/imx7d-pico.dtsi
+index 21973eb55671..f27b3849d3ff 100644
+--- a/arch/arm/boot/dts/imx7d-pico.dtsi
++++ b/arch/arm/boot/dts/imx7d-pico.dtsi
+@@ -100,6 +100,19 @@
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ };
++
++ usdhc2_pwrseq: usdhc2_pwrseq {
++ compatible = "mmc-pwrseq-simple";
++ clocks = <&clks IMX7D_CLKO2_ROOT_DIV>;
++ clock-names = "ext_clock";
++ };
++};
++
++&clks {
++ assigned-clocks = <&clks IMX7D_CLKO2_ROOT_SRC>,
++ <&clks IMX7D_CLKO2_ROOT_DIV>;
++ assigned-clock-parents = <&clks IMX7D_CKIL>;
++ assigned-clock-rates = <0>, <32768>;
+ };
+
+ &i2c4 {
+@@ -199,12 +212,13 @@
+
+ &usdhc2 { /* Wifi SDIO */
+ pinctrl-names = "default";
+- pinctrl-0 = <&pinctrl_usdhc2>;
++ pinctrl-0 = <&pinctrl_usdhc2 &pinctrl_wifi_clk>;
+ no-1-8-v;
+ non-removable;
+ keep-power-in-suspend;
+ wakeup-source;
+ vmmc-supply = <®_ap6212>;
++ mmc-pwrseq = <&usdhc2_pwrseq>;
+ status = "okay";
+ };
+
+@@ -301,6 +315,12 @@
+ };
+
+ &iomuxc_lpsr {
++ pinctrl_wifi_clk: wificlkgrp {
++ fsl,pins = <
++ MX7D_PAD_LPSR_GPIO1_IO03__CCM_CLKO2 0x7d
++ >;
++ };
++
+ pinctrl_wdog: wdoggrp {
+ fsl,pins = <
+ MX7D_PAD_LPSR_GPIO1_IO00__WDOG1_WDOG_B 0x74
+diff --git a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+index c7ce4158d6c8..f250b20af493 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+@@ -309,8 +309,8 @@
+
+ ®_dldo3 {
+ regulator-always-on;
+- regulator-min-microvolt = <2500000>;
+- regulator-max-microvolt = <2500000>;
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
+ regulator-name = "vcc-pd";
+ };
+
+diff --git a/arch/arm/mach-imx/cpuidle-imx6sx.c b/arch/arm/mach-imx/cpuidle-imx6sx.c
+index 243a108a940b..fd0053e47a15 100644
+--- a/arch/arm/mach-imx/cpuidle-imx6sx.c
++++ b/arch/arm/mach-imx/cpuidle-imx6sx.c
+@@ -110,7 +110,7 @@ int __init imx6sx_cpuidle_init(void)
+ * except for power up sw2iso which need to be
+ * larger than LDO ramp up time.
+ */
+- imx_gpc_set_arm_power_up_timing(2, 1);
++ imx_gpc_set_arm_power_up_timing(0xf, 1);
+ imx_gpc_set_arm_power_down_timing(1, 1);
+
+ return cpuidle_register(&imx6sx_cpuidle_driver, NULL);
+diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
+index 106039d25e2f..35649ee8ad56 100644
+--- a/arch/arm64/Makefile
++++ b/arch/arm64/Makefile
+@@ -18,7 +18,7 @@ ifeq ($(CONFIG_RELOCATABLE), y)
+ # Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour
+ # for relative relocs, since this leads to better Image compression
+ # with the relocation offsets always being zero.
+-LDFLAGS_vmlinux += -pie -shared -Bsymbolic \
++LDFLAGS_vmlinux += -shared -Bsymbolic -z notext -z norelro \
+ $(call ld-option, --no-apply-dynamic-relocs)
+ endif
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+index a747b7bf132d..387be39d40cd 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+@@ -17,8 +17,13 @@
+ model = "MediaTek MT7622 RFB1 board";
+ compatible = "mediatek,mt7622-rfb1", "mediatek,mt7622";
+
++ aliases {
++ serial0 = &uart0;
++ };
++
+ chosen {
+- bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512";
++ stdout-path = "serial0:115200n8";
++ bootargs = "earlycon=uart8250,mmio32,0x11002000 swiotlb=512";
+ };
+
+ cpus {
+diff --git a/arch/arm64/kernel/image.h b/arch/arm64/kernel/image.h
+index a820ed07fb80..8da289dc843a 100644
+--- a/arch/arm64/kernel/image.h
++++ b/arch/arm64/kernel/image.h
+@@ -75,16 +75,6 @@
+
+ __efistub_stext_offset = stext - _text;
+
+-/*
+- * Prevent the symbol aliases below from being emitted into the kallsyms
+- * table, by forcing them to be absolute symbols (which are conveniently
+- * ignored by scripts/kallsyms) rather than section relative symbols.
+- * The distinction is only relevant for partial linking, and only for symbols
+- * that are defined within a section declaration (which is not the case for
+- * the definitions below) so the resulting values will be identical.
+- */
+-#define KALLSYMS_HIDE(sym) ABSOLUTE(sym)
+-
+ /*
+ * The EFI stub has its own symbol namespace prefixed by __efistub_, to
+ * isolate it from the kernel proper. The following symbols are legally
+@@ -94,28 +84,28 @@ __efistub_stext_offset = stext - _text;
+ * linked at. The routines below are all implemented in assembler in a
+ * position independent manner
+ */
+-__efistub_memcmp = KALLSYMS_HIDE(__pi_memcmp);
+-__efistub_memchr = KALLSYMS_HIDE(__pi_memchr);
+-__efistub_memcpy = KALLSYMS_HIDE(__pi_memcpy);
+-__efistub_memmove = KALLSYMS_HIDE(__pi_memmove);
+-__efistub_memset = KALLSYMS_HIDE(__pi_memset);
+-__efistub_strlen = KALLSYMS_HIDE(__pi_strlen);
+-__efistub_strnlen = KALLSYMS_HIDE(__pi_strnlen);
+-__efistub_strcmp = KALLSYMS_HIDE(__pi_strcmp);
+-__efistub_strncmp = KALLSYMS_HIDE(__pi_strncmp);
+-__efistub_strrchr = KALLSYMS_HIDE(__pi_strrchr);
+-__efistub___flush_dcache_area = KALLSYMS_HIDE(__pi___flush_dcache_area);
++__efistub_memcmp = __pi_memcmp;
++__efistub_memchr = __pi_memchr;
++__efistub_memcpy = __pi_memcpy;
++__efistub_memmove = __pi_memmove;
++__efistub_memset = __pi_memset;
++__efistub_strlen = __pi_strlen;
++__efistub_strnlen = __pi_strnlen;
++__efistub_strcmp = __pi_strcmp;
++__efistub_strncmp = __pi_strncmp;
++__efistub_strrchr = __pi_strrchr;
++__efistub___flush_dcache_area = __pi___flush_dcache_area;
+
+ #ifdef CONFIG_KASAN
+-__efistub___memcpy = KALLSYMS_HIDE(__pi_memcpy);
+-__efistub___memmove = KALLSYMS_HIDE(__pi_memmove);
+-__efistub___memset = KALLSYMS_HIDE(__pi_memset);
++__efistub___memcpy = __pi_memcpy;
++__efistub___memmove = __pi_memmove;
++__efistub___memset = __pi_memset;
+ #endif
+
+-__efistub__text = KALLSYMS_HIDE(_text);
+-__efistub__end = KALLSYMS_HIDE(_end);
+-__efistub__edata = KALLSYMS_HIDE(_edata);
+-__efistub_screen_info = KALLSYMS_HIDE(screen_info);
++__efistub__text = _text;
++__efistub__end = _end;
++__efistub__edata = _edata;
++__efistub_screen_info = screen_info;
+
+ #endif
+
+diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
+index 605d1b60469c..74e469f8a850 100644
+--- a/arch/arm64/kernel/vmlinux.lds.S
++++ b/arch/arm64/kernel/vmlinux.lds.S
+@@ -99,7 +99,8 @@ SECTIONS
+ *(.discard)
+ *(.discard.*)
+ *(.interp .dynamic)
+- *(.dynsym .dynstr .hash)
++ *(.dynsym .dynstr .hash .gnu.hash)
++ *(.eh_frame)
+ }
+
+ . = KIMAGE_VADDR + TEXT_OFFSET;
+@@ -176,12 +177,12 @@ SECTIONS
+
+ PERCPU_SECTION(L1_CACHE_BYTES)
+
+- .rela : ALIGN(8) {
++ .rela.dyn : ALIGN(8) {
+ *(.rela .rela*)
+ }
+
+- __rela_offset = ABSOLUTE(ADDR(.rela) - KIMAGE_VADDR);
+- __rela_size = SIZEOF(.rela);
++ __rela_offset = ABSOLUTE(ADDR(.rela.dyn) - KIMAGE_VADDR);
++ __rela_size = SIZEOF(.rela.dyn);
+
+ . = ALIGN(SEGMENT_ALIGN);
+ __initdata_end = .;
+diff --git a/arch/m68k/kernel/setup_mm.c b/arch/m68k/kernel/setup_mm.c
+index 5d3596c180f9..de44899c0e61 100644
+--- a/arch/m68k/kernel/setup_mm.c
++++ b/arch/m68k/kernel/setup_mm.c
+@@ -165,8 +165,6 @@ static void __init m68k_parse_bootinfo(const struct bi_record *record)
+ be32_to_cpu(m->addr);
+ m68k_memory[m68k_num_memory].size =
+ be32_to_cpu(m->size);
+- memblock_add(m68k_memory[m68k_num_memory].addr,
+- m68k_memory[m68k_num_memory].size);
+ m68k_num_memory++;
+ } else
+ pr_warn("%s: too many memory chunks\n",
+diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
+index 4e17ecb5928a..2eb2b31fb16a 100644
+--- a/arch/m68k/mm/motorola.c
++++ b/arch/m68k/mm/motorola.c
+@@ -228,6 +228,7 @@ void __init paging_init(void)
+
+ min_addr = m68k_memory[0].addr;
+ max_addr = min_addr + m68k_memory[0].size;
++ memblock_add(m68k_memory[0].addr, m68k_memory[0].size);
+ for (i = 1; i < m68k_num_memory;) {
+ if (m68k_memory[i].addr < min_addr) {
+ printk("Ignoring memory chunk at 0x%lx:0x%lx before the first chunk\n",
+@@ -238,6 +239,7 @@ void __init paging_init(void)
+ (m68k_num_memory - i) * sizeof(struct m68k_mem_info));
+ continue;
+ }
++ memblock_add(m68k_memory[i].addr, m68k_memory[i].size);
+ addr = m68k_memory[i].addr + m68k_memory[i].size;
+ if (addr > max_addr)
+ max_addr = addr;
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index d2824b0cc142..c4c03992ee82 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -160,8 +160,17 @@ else
+ CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64
+ endif
+
++ifdef CONFIG_FUNCTION_TRACER
++CC_FLAGS_FTRACE := -pg
+ ifdef CONFIG_MPROFILE_KERNEL
+- CC_FLAGS_FTRACE := -pg -mprofile-kernel
++CC_FLAGS_FTRACE += -mprofile-kernel
++endif
++# Work around gcc code-gen bugs with -pg / -fno-omit-frame-pointer in gcc <= 4.8
++# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=44199
++# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=52828
++ifneq ($(cc-name),clang)
++CC_FLAGS_FTRACE += $(call cc-ifversion, -lt, 0409, -mno-sched-epilog)
++endif
+ endif
+
+ CFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU))
+@@ -229,11 +238,6 @@ ifdef CONFIG_6xx
+ KBUILD_CFLAGS += -mcpu=powerpc
+ endif
+
+-# Work around a gcc code-gen bug with -fno-omit-frame-pointer.
+-ifdef CONFIG_FUNCTION_TRACER
+-KBUILD_CFLAGS += -mno-sched-epilog
+-endif
+-
+ cpu-as-$(CONFIG_4xx) += -Wa,-m405
+ cpu-as-$(CONFIG_ALTIVEC) += $(call as-option,-Wa$(comma)-maltivec)
+ cpu-as-$(CONFIG_E200) += -Wa,-me200
+@@ -408,36 +412,9 @@ archprepare: checkbin
+ # to stdout and these checks are run even on install targets.
+ TOUT := .tmp_gas_check
+
+-# Check gcc and binutils versions:
+-# - gcc-3.4 and binutils-2.14 are a fatal combination
+-# - Require gcc 4.0 or above on 64-bit
+-# - gcc-4.2.0 has issues compiling modules on 64-bit
++# Check toolchain versions:
++# - gcc-4.6 is the minimum kernel-wide version so nothing required.
+ checkbin:
+- @if test "$(cc-name)" != "clang" \
+- && test "$(cc-version)" = "0304" ; then \
+- if ! /bin/echo mftb 5 | $(AS) -v -mppc -many -o $(TOUT) >/dev/null 2>&1 ; then \
+- echo -n '*** ${VERSION}.${PATCHLEVEL} kernels no longer build '; \
+- echo 'correctly with gcc-3.4 and your version of binutils.'; \
+- echo '*** Please upgrade your binutils or downgrade your gcc'; \
+- false; \
+- fi ; \
+- fi
+- @if test "$(cc-name)" != "clang" \
+- && test "$(cc-version)" -lt "0400" \
+- && test "x${CONFIG_PPC64}" = "xy" ; then \
+- echo -n "Sorry, GCC v4.0 or above is required to build " ; \
+- echo "the 64-bit powerpc kernel." ; \
+- false ; \
+- fi
+- @if test "$(cc-name)" != "clang" \
+- && test "$(cc-fullversion)" = "040200" \
+- && test "x${CONFIG_MODULES}${CONFIG_PPC64}" = "xyy" ; then \
+- echo -n '*** GCC-4.2.0 cannot compile the 64-bit powerpc ' ; \
+- echo 'kernel with modules enabled.' ; \
+- echo -n '*** Please use a different GCC version or ' ; \
+- echo 'disable kernel modules' ; \
+- false ; \
+- fi
+ @if test "x${CONFIG_CPU_LITTLE_ENDIAN}" = "xy" \
+ && $(LD) --version | head -1 | grep ' 2\.24$$' >/dev/null ; then \
+ echo -n '*** binutils 2.24 miscompiles weak symbols ' ; \
+diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
+index 0fb96c26136f..25e3184f11f7 100644
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -55,6 +55,11 @@ BOOTAFLAGS := -D__ASSEMBLY__ $(BOOTCFLAGS) -traditional -nostdinc
+
+ BOOTARFLAGS := -cr$(KBUILD_ARFLAGS)
+
++ifdef CONFIG_CC_IS_CLANG
++BOOTCFLAGS += $(CLANG_FLAGS)
++BOOTAFLAGS += $(CLANG_FLAGS)
++endif
++
+ ifdef CONFIG_DEBUG_INFO
+ BOOTCFLAGS += -g
+ endif
+diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
+index 32dfe6d083f3..9b9d17437373 100644
+--- a/arch/powerpc/boot/crt0.S
++++ b/arch/powerpc/boot/crt0.S
+@@ -15,7 +15,7 @@
+ RELA = 7
+ RELACOUNT = 0x6ffffff9
+
+- .text
++ .data
+ /* A procedure descriptor used when booting this as a COFF file.
+ * When making COFF, this comes first in the link and we're
+ * linked at 0x500000.
+@@ -23,6 +23,8 @@ RELACOUNT = 0x6ffffff9
+ .globl _zimage_start_opd
+ _zimage_start_opd:
+ .long 0x500000, 0, 0, 0
++ .text
++ b _zimage_start
+
+ #ifdef __powerpc64__
+ .balign 8
+diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
+index 3b66f2c19c84..eac18790d1b1 100644
+--- a/arch/powerpc/kernel/Makefile
++++ b/arch/powerpc/kernel/Makefile
+@@ -5,6 +5,9 @@
+
+ CFLAGS_ptrace.o += -DUTS_MACHINE='"$(UTS_MACHINE)"'
+
++# Disable clang warning for using setjmp without setjmp.h header
++CFLAGS_crash.o += $(call cc-disable-warning, builtin-requires-header)
++
+ subdir-ccflags-$(CONFIG_PPC_WERROR) := -Werror
+
+ ifdef CONFIG_PPC64
+@@ -22,10 +25,10 @@ CFLAGS_prom.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+
+ ifdef CONFIG_FUNCTION_TRACER
+ # Do not trace early boot code
+-CFLAGS_REMOVE_cputable.o = -mno-sched-epilog $(CC_FLAGS_FTRACE)
+-CFLAGS_REMOVE_prom_init.o = -mno-sched-epilog $(CC_FLAGS_FTRACE)
+-CFLAGS_REMOVE_btext.o = -mno-sched-epilog $(CC_FLAGS_FTRACE)
+-CFLAGS_REMOVE_prom.o = -mno-sched-epilog $(CC_FLAGS_FTRACE)
++CFLAGS_REMOVE_cputable.o = $(CC_FLAGS_FTRACE)
++CFLAGS_REMOVE_prom_init.o = $(CC_FLAGS_FTRACE)
++CFLAGS_REMOVE_btext.o = $(CC_FLAGS_FTRACE)
++CFLAGS_REMOVE_prom.o = $(CC_FLAGS_FTRACE)
+ endif
+
+ obj-y := cputable.o ptrace.o syscalls.o \
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index 6327fd79b0fb..fd59fef9931b 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -848,7 +848,23 @@ static long restore_tm_user_regs(struct pt_regs *regs,
+ /* If TM bits are set to the reserved value, it's an invalid context */
+ if (MSR_TM_RESV(msr_hi))
+ return 1;
+- /* Pull in the MSR TM bits from the user context */
++
++ /*
++ * Disabling preemption, since it is unsafe to be preempted
++ * with MSR[TS] set without recheckpointing.
++ */
++ preempt_disable();
++
++ /*
++ * CAUTION:
++ * After regs->MSR[TS] being updated, make sure that get_user(),
++ * put_user() or similar functions are *not* called. These
++ * functions can generate page faults which will cause the process
++ * to be de-scheduled with MSR[TS] set but without calling
++ * tm_recheckpoint(). This can cause a bug.
++ *
++ * Pull in the MSR TM bits from the user context
++ */
+ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
+ /* Now, recheckpoint. This loads up all of the checkpointed (older)
+ * registers, including FP and V[S]Rs. After recheckpointing, the
+@@ -873,6 +889,8 @@ static long restore_tm_user_regs(struct pt_regs *regs,
+ }
+ #endif
+
++ preempt_enable();
++
+ return 0;
+ }
+ #endif
+@@ -1140,11 +1158,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ {
+ struct rt_sigframe __user *rt_sf;
+ struct pt_regs *regs = current_pt_regs();
+- int tm_restore = 0;
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ struct ucontext __user *uc_transact;
+ unsigned long msr_hi;
+ unsigned long tmp;
++ int tm_restore = 0;
+ #endif
+ /* Always make any pending restarted system calls return -EINTR */
+ current->restart_block.fn = do_no_restart_syscall;
+@@ -1192,19 +1210,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ goto bad;
+ }
+ }
+- if (!tm_restore) {
+- /*
+- * Unset regs->msr because ucontext MSR TS is not
+- * set, and recheckpoint was not called. This avoid
+- * hitting a TM Bad thing at RFID
+- */
+- regs->msr &= ~MSR_TS_MASK;
+- }
+- /* Fall through, for non-TM restore */
+-#endif
+ if (!tm_restore)
+- if (do_setcontext(&rt_sf->uc, regs, 1))
+- goto bad;
++ /* Fall through, for non-TM restore */
++#endif
++ if (do_setcontext(&rt_sf->uc, regs, 1))
++ goto bad;
+
+ /*
+ * It's not clear whether or why it is desirable to save the
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
+index daa28cb72272..bbd1c73243d7 100644
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -467,20 +467,6 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
+ if (MSR_TM_RESV(msr))
+ return -EINVAL;
+
+- /* pull in MSR TS bits from user context */
+- regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
+-
+- /*
+- * Ensure that TM is enabled in regs->msr before we leave the signal
+- * handler. It could be the case that (a) user disabled the TM bit
+- * through the manipulation of the MSR bits in uc_mcontext or (b) the
+- * TM bit was disabled because a sufficient number of context switches
+- * happened whilst in the signal handler and load_tm overflowed,
+- * disabling the TM bit. In either case we can end up with an illegal
+- * TM state leading to a TM Bad Thing when we return to userspace.
+- */
+- regs->msr |= MSR_TM;
+-
+ /* pull in MSR LE from user context */
+ regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
+
+@@ -572,6 +558,34 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
+ tm_enable();
+ /* Make sure the transaction is marked as failed */
+ tsk->thread.tm_texasr |= TEXASR_FS;
++
++ /*
++ * Disabling preemption, since it is unsafe to be preempted
++ * with MSR[TS] set without recheckpointing.
++ */
++ preempt_disable();
++
++ /* pull in MSR TS bits from user context */
++ regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
++
++ /*
++ * Ensure that TM is enabled in regs->msr before we leave the signal
++ * handler. It could be the case that (a) user disabled the TM bit
++ * through the manipulation of the MSR bits in uc_mcontext or (b) the
++ * TM bit was disabled because a sufficient number of context switches
++ * happened whilst in the signal handler and load_tm overflowed,
++ * disabling the TM bit. In either case we can end up with an illegal
++ * TM state leading to a TM Bad Thing when we return to userspace.
++ *
++ * CAUTION:
++ * After regs->MSR[TS] being updated, make sure that get_user(),
++ * put_user() or similar functions are *not* called. These
++ * functions can generate page faults which will cause the process
++ * to be de-scheduled with MSR[TS] set but without calling
++ * tm_recheckpoint(). This can cause a bug.
++ */
++ regs->msr |= MSR_TM;
++
+ /* This loads the checkpointed FP/VEC state, if used */
+ tm_recheckpoint(&tsk->thread);
+
+@@ -585,6 +599,8 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
+ regs->msr |= MSR_VEC;
+ }
+
++ preempt_enable();
++
+ return err;
+ }
+ #endif
+@@ -740,23 +756,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ &uc_transact->uc_mcontext))
+ goto badframe;
+ }
+-#endif
++ else
+ /* Fall through, for non-TM restore */
+- if (!MSR_TM_ACTIVE(msr)) {
+- /*
+- * Unset MSR[TS] on the thread regs since MSR from user
+- * context does not have MSR active, and recheckpoint was
+- * not called since restore_tm_sigcontexts() was not called
+- * also.
+- *
+- * If not unsetting it, the code can RFID to userspace with
+- * MSR[TS] set, but without CPU in the proper state,
+- * causing a TM bad thing.
+- */
+- current->thread.regs->msr &= ~MSR_TS_MASK;
+- if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
+- goto badframe;
+- }
++#endif
++ if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
++ goto badframe;
+
+ if (restore_altstack(&uc->uc_stack))
+ goto badframe;
+diff --git a/arch/powerpc/kernel/trace/Makefile b/arch/powerpc/kernel/trace/Makefile
+index d22d8bafb643..d868ba42032f 100644
+--- a/arch/powerpc/kernel/trace/Makefile
++++ b/arch/powerpc/kernel/trace/Makefile
+@@ -7,7 +7,7 @@ subdir-ccflags-$(CONFIG_PPC_WERROR) := -Werror
+
+ ifdef CONFIG_FUNCTION_TRACER
+ # do not trace tracer code
+-CFLAGS_REMOVE_ftrace.o = -mno-sched-epilog $(CC_FLAGS_FTRACE)
++CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE)
+ endif
+
+ obj32-$(CONFIG_FUNCTION_TRACER) += ftrace_32.o
+diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c
+index bdf33b989f98..8464c2c01c0c 100644
+--- a/arch/powerpc/mm/dump_linuxpagetables.c
++++ b/arch/powerpc/mm/dump_linuxpagetables.c
+@@ -19,6 +19,7 @@
+ #include <linux/hugetlb.h>
+ #include <linux/io.h>
+ #include <linux/mm.h>
++#include <linux/highmem.h>
+ #include <linux/sched.h>
+ #include <linux/seq_file.h>
+ #include <asm/fixmap.h>
+diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
+index 7a9886f98b0c..a5091c034747 100644
+--- a/arch/powerpc/mm/init_64.c
++++ b/arch/powerpc/mm/init_64.c
+@@ -188,15 +188,20 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
+ pr_debug("vmemmap_populate %lx..%lx, node %d\n", start, end, node);
+
+ for (; start < end; start += page_size) {
+- void *p;
++ void *p = NULL;
+ int rc;
+
+ if (vmemmap_populated(start, page_size))
+ continue;
+
++ /*
++ * Allocate from the altmap first if we have one. This may
++ * fail due to alignment issues when using 16MB hugepages, so
++ * fall back to system memory if the altmap allocation fail.
++ */
+ if (altmap)
+ p = altmap_alloc_block_buf(page_size, altmap);
+- else
++ if (!p)
+ p = vmemmap_alloc_block_buf(page_size, node);
+ if (!p)
+ return -ENOMEM;
+@@ -255,8 +260,15 @@ void __ref vmemmap_free(unsigned long start, unsigned long end,
+ {
+ unsigned long page_size = 1 << mmu_psize_defs[mmu_vmemmap_psize].shift;
+ unsigned long page_order = get_order(page_size);
++ unsigned long alt_start = ~0, alt_end = ~0;
++ unsigned long base_pfn;
+
+ start = _ALIGN_DOWN(start, page_size);
++ if (altmap) {
++ alt_start = altmap->base_pfn;
++ alt_end = altmap->base_pfn + altmap->reserve +
++ altmap->free + altmap->alloc + altmap->align;
++ }
+
+ pr_debug("vmemmap_free %lx...%lx\n", start, end);
+
+@@ -280,8 +292,9 @@ void __ref vmemmap_free(unsigned long start, unsigned long end,
+ page = pfn_to_page(addr >> PAGE_SHIFT);
+ section_base = pfn_to_page(vmemmap_section_start(start));
+ nr_pages = 1 << page_order;
++ base_pfn = PHYS_PFN(addr);
+
+- if (altmap) {
++ if (base_pfn >= alt_start && base_pfn < alt_end) {
+ vmem_altmap_free(altmap, nr_pages);
+ } else if (PageReserved(page)) {
+ /* allocated from bootmem */
+diff --git a/arch/powerpc/platforms/powermac/Makefile b/arch/powerpc/platforms/powermac/Makefile
+index f2839eed0f89..561a67d65e4d 100644
+--- a/arch/powerpc/platforms/powermac/Makefile
++++ b/arch/powerpc/platforms/powermac/Makefile
+@@ -3,7 +3,7 @@ CFLAGS_bootx_init.o += -fPIC
+
+ ifdef CONFIG_FUNCTION_TRACER
+ # Do not trace early boot code
+-CFLAGS_REMOVE_bootx_init.o = -mno-sched-epilog $(CC_FLAGS_FTRACE)
++CFLAGS_REMOVE_bootx_init.o = $(CC_FLAGS_FTRACE)
+ endif
+
+ obj-y += pic.o setup.o time.o feature.o pci.o \
+diff --git a/arch/powerpc/xmon/Makefile b/arch/powerpc/xmon/Makefile
+index 1bc3abb237cd..9d7d8e6d705c 100644
+--- a/arch/powerpc/xmon/Makefile
++++ b/arch/powerpc/xmon/Makefile
+@@ -1,14 +1,17 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Makefile for xmon
+
+-subdir-ccflags-$(CONFIG_PPC_WERROR) := -Werror
++# Disable clang warning for using setjmp without setjmp.h header
++subdir-ccflags-y := $(call cc-disable-warning, builtin-requires-header)
++
++subdir-ccflags-$(CONFIG_PPC_WERROR) += -Werror
+
+ GCOV_PROFILE := n
+ UBSAN_SANITIZE := n
+
+ # Disable ftrace for the entire directory
+ ORIG_CFLAGS := $(KBUILD_CFLAGS)
+-KBUILD_CFLAGS = $(subst -mno-sched-epilog,,$(subst $(CC_FLAGS_FTRACE),,$(ORIG_CFLAGS)))
++KBUILD_CFLAGS = $(subst $(CC_FLAGS_FTRACE),,$(ORIG_CFLAGS))
+
+ ccflags-$(CONFIG_PPC64) := $(NO_MINIMAL_TOC)
+
+diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
+index 84bd9bdc1987..88bca456da99 100644
+--- a/arch/x86/include/asm/pgtable_64_types.h
++++ b/arch/x86/include/asm/pgtable_64_types.h
+@@ -111,6 +111,11 @@ extern unsigned int ptrs_per_p4d;
+ */
+ #define MAXMEM (1UL << MAX_PHYSMEM_BITS)
+
++#define GUARD_HOLE_PGD_ENTRY -256UL
++#define GUARD_HOLE_SIZE (16UL << PGDIR_SHIFT)
++#define GUARD_HOLE_BASE_ADDR (GUARD_HOLE_PGD_ENTRY << PGDIR_SHIFT)
++#define GUARD_HOLE_END_ADDR (GUARD_HOLE_BASE_ADDR + GUARD_HOLE_SIZE)
++
+ #define LDT_PGD_ENTRY -240UL
+ #define LDT_BASE_ADDR (LDT_PGD_ENTRY << PGDIR_SHIFT)
+ #define LDT_END_ADDR (LDT_BASE_ADDR + PGDIR_SIZE)
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index a12afff146d1..c05a818224bb 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -53,10 +53,10 @@ struct addr_marker {
+ enum address_markers_idx {
+ USER_SPACE_NR = 0,
+ KERNEL_SPACE_NR,
+- LOW_KERNEL_NR,
+-#if defined(CONFIG_MODIFY_LDT_SYSCALL) && defined(CONFIG_X86_5LEVEL)
++#ifdef CONFIG_MODIFY_LDT_SYSCALL
+ LDT_NR,
+ #endif
++ LOW_KERNEL_NR,
+ VMALLOC_START_NR,
+ VMEMMAP_START_NR,
+ #ifdef CONFIG_KASAN
+@@ -64,9 +64,6 @@ enum address_markers_idx {
+ KASAN_SHADOW_END_NR,
+ #endif
+ CPU_ENTRY_AREA_NR,
+-#if defined(CONFIG_MODIFY_LDT_SYSCALL) && !defined(CONFIG_X86_5LEVEL)
+- LDT_NR,
+-#endif
+ #ifdef CONFIG_X86_ESPFIX64
+ ESPFIX_START_NR,
+ #endif
+@@ -493,11 +490,11 @@ static inline bool is_hypervisor_range(int idx)
+ {
+ #ifdef CONFIG_X86_64
+ /*
+- * ffff800000000000 - ffff87ffffffffff is reserved for
+- * the hypervisor.
++ * A hole in the beginning of kernel address space reserved
++ * for a hypervisor.
+ */
+- return (idx >= pgd_index(__PAGE_OFFSET) - 16) &&
+- (idx < pgd_index(__PAGE_OFFSET));
++ return (idx >= pgd_index(GUARD_HOLE_BASE_ADDR)) &&
++ (idx < pgd_index(GUARD_HOLE_END_ADDR));
+ #else
+ return false;
+ #endif
+diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
+index 2c84c6ad8b50..c8f011e07a15 100644
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -640,19 +640,20 @@ static int __xen_pgd_walk(struct mm_struct *mm, pgd_t *pgd,
+ unsigned long limit)
+ {
+ int i, nr, flush = 0;
+- unsigned hole_low, hole_high;
++ unsigned hole_low = 0, hole_high = 0;
+
+ /* The limit is the last byte to be touched */
+ limit--;
+ BUG_ON(limit >= FIXADDR_TOP);
+
++#ifdef CONFIG_X86_64
+ /*
+ * 64-bit has a great big hole in the middle of the address
+- * space, which contains the Xen mappings. On 32-bit these
+- * will end up making a zero-sized hole and so is a no-op.
++ * space, which contains the Xen mappings.
+ */
+- hole_low = pgd_index(USER_LIMIT);
+- hole_high = pgd_index(PAGE_OFFSET);
++ hole_low = pgd_index(GUARD_HOLE_BASE_ADDR);
++ hole_high = pgd_index(GUARD_HOLE_END_ADDR);
++#endif
+
+ nr = pgd_index(limit) + 1;
+ for (i = 0; i < nr; i++) {
+diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
+index 29bfe8017a2d..da1de190a3b1 100644
+--- a/block/blk-mq-sched.c
++++ b/block/blk-mq-sched.c
+@@ -54,13 +54,14 @@ void blk_mq_sched_assign_ioc(struct request *rq, struct bio *bio)
+ * Mark a hardware queue as needing a restart. For shared queues, maintain
+ * a count of how many hardware queues are marked for restart.
+ */
+-static void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx)
++void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx)
+ {
+ if (test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state))
+ return;
+
+ set_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
+ }
++EXPORT_SYMBOL_GPL(blk_mq_sched_mark_restart_hctx);
+
+ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx)
+ {
+diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
+index 4e028ee42430..fe660764b8d1 100644
+--- a/block/blk-mq-sched.h
++++ b/block/blk-mq-sched.h
+@@ -15,6 +15,7 @@ bool blk_mq_sched_try_merge(struct request_queue *q, struct bio *bio,
+ struct request **merged_request);
+ bool __blk_mq_sched_bio_merge(struct request_queue *q, struct bio *bio);
+ bool blk_mq_sched_try_insert_merge(struct request_queue *q, struct request *rq);
++void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx);
+ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx);
+
+ void blk_mq_sched_insert_request(struct request *rq, bool at_head,
+diff --git a/block/blk-stat.h b/block/blk-stat.h
+index f4a1568e81a4..17b47a86eefb 100644
+--- a/block/blk-stat.h
++++ b/block/blk-stat.h
+@@ -145,6 +145,11 @@ static inline void blk_stat_activate_nsecs(struct blk_stat_callback *cb,
+ mod_timer(&cb->timer, jiffies + nsecs_to_jiffies(nsecs));
+ }
+
++static inline void blk_stat_deactivate(struct blk_stat_callback *cb)
++{
++ del_timer_sync(&cb->timer);
++}
++
+ /**
+ * blk_stat_activate_msecs() - Gather block statistics during a time window in
+ * milliseconds.
+diff --git a/block/blk-wbt.c b/block/blk-wbt.c
+index 8ac93fcbaa2e..0c62bf4eca75 100644
+--- a/block/blk-wbt.c
++++ b/block/blk-wbt.c
+@@ -760,8 +760,10 @@ void wbt_disable_default(struct request_queue *q)
+ if (!rqos)
+ return;
+ rwb = RQWB(rqos);
+- if (rwb->enable_state == WBT_STATE_ON_DEFAULT)
++ if (rwb->enable_state == WBT_STATE_ON_DEFAULT) {
++ blk_stat_deactivate(rwb->cb);
+ rwb->wb_normal = 0;
++ }
+ }
+ EXPORT_SYMBOL_GPL(wbt_disable_default);
+
+diff --git a/block/mq-deadline.c b/block/mq-deadline.c
+index 099a9e05854c..d5e21ce44d2c 100644
+--- a/block/mq-deadline.c
++++ b/block/mq-deadline.c
+@@ -373,9 +373,16 @@ done:
+
+ /*
+ * One confusing aspect here is that we get called for a specific
+- * hardware queue, but we return a request that may not be for a
++ * hardware queue, but we may return a request that is for a
+ * different hardware queue. This is because mq-deadline has shared
+ * state for all hardware queues, in terms of sorting, FIFOs, etc.
++ *
++ * For a zoned block device, __dd_dispatch_request() may return NULL
++ * if all the queued write requests are directed at zones that are already
++ * locked due to on-going write requests. In this case, make sure to mark
++ * the queue as needing a restart to ensure that the queue is run again
++ * and the pending writes dispatched once the target zones for the ongoing
++ * write requests are unlocked in dd_finish_request().
+ */
+ static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx)
+ {
+@@ -384,6 +391,9 @@ static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx)
+
+ spin_lock(&dd->lock);
+ rq = __dd_dispatch_request(dd);
++ if (!rq && blk_queue_is_zoned(hctx->queue) &&
++ !list_empty(&dd->fifo_list[WRITE]))
++ blk_mq_sched_mark_restart_hctx(hctx);
+ spin_unlock(&dd->lock);
+
+ return rq;
+diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c
+index 81c22d20d9d9..60e0b772673f 100644
+--- a/drivers/auxdisplay/charlcd.c
++++ b/drivers/auxdisplay/charlcd.c
+@@ -538,6 +538,9 @@ static inline int handle_lcd_special_code(struct charlcd *lcd)
+ }
+ case 'x': /* gotoxy : LxXXX[yYYY]; */
+ case 'y': /* gotoxy : LyYYY[xXXX]; */
++ if (priv->esc_seq.buf[priv->esc_seq.len - 1] != ';')
++ break;
++
+ /* If the command is valid, move to the new address */
+ if (parse_xy(esc, &priv->addr.x, &priv->addr.y))
+ charlcd_gotoxy(lcd);
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index edfc9f0b1180..2607f859881a 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -931,11 +931,11 @@ static void __device_release_driver(struct device *dev, struct device *parent)
+
+ while (device_links_busy(dev)) {
+ device_unlock(dev);
+- if (parent)
++ if (parent && dev->bus->need_parent_lock)
+ device_unlock(parent);
+
+ device_links_unbind_consumers(dev);
+- if (parent)
++ if (parent && dev->bus->need_parent_lock)
+ device_lock(parent);
+
+ device_lock(dev);
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 66921427d109..e19bf0a750cf 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -382,8 +382,10 @@ static ssize_t backing_dev_store(struct device *dev,
+
+ bdev = bdgrab(I_BDEV(inode));
+ err = blkdev_get(bdev, FMODE_READ | FMODE_WRITE | FMODE_EXCL, zram);
+- if (err < 0)
++ if (err < 0) {
++ bdev = NULL;
+ goto out;
++ }
+
+ nr_pages = i_size_read(inode) >> PAGE_SHIFT;
+ bitmap_sz = BITS_TO_LONGS(nr_pages) * sizeof(long);
+diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
+index 99e2aace8078..2c1f459c0c63 100644
+--- a/drivers/dax/pmem.c
++++ b/drivers/dax/pmem.c
+@@ -48,9 +48,8 @@ static void dax_pmem_percpu_exit(void *data)
+ percpu_ref_exit(ref);
+ }
+
+-static void dax_pmem_percpu_kill(void *data)
++static void dax_pmem_percpu_kill(struct percpu_ref *ref)
+ {
+- struct percpu_ref *ref = data;
+ struct dax_pmem *dax_pmem = to_dax_pmem(ref);
+
+ dev_dbg(dax_pmem->dev, "trace\n");
+@@ -112,17 +111,10 @@ static int dax_pmem_probe(struct device *dev)
+ }
+
+ dax_pmem->pgmap.ref = &dax_pmem->ref;
++ dax_pmem->pgmap.kill = dax_pmem_percpu_kill;
+ addr = devm_memremap_pages(dev, &dax_pmem->pgmap);
+- if (IS_ERR(addr)) {
+- devm_remove_action(dev, dax_pmem_percpu_exit, &dax_pmem->ref);
+- percpu_ref_exit(&dax_pmem->ref);
++ if (IS_ERR(addr))
+ return PTR_ERR(addr);
+- }
+-
+- rc = devm_add_action_or_reset(dev, dax_pmem_percpu_kill,
+- &dax_pmem->ref);
+- if (rc)
+- return rc;
+
+ /* adjust the dax_region resource to the start of data */
+ memcpy(&res, &dax_pmem->pgmap.res, sizeof(res));
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index 6e02148c208b..adc768f908f1 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -773,9 +773,6 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
+ "marvell,armada-370-gpio"))
+ return 0;
+
+- if (IS_ERR(mvchip->clk))
+- return PTR_ERR(mvchip->clk);
+-
+ /*
+ * There are only two sets of PWM configuration registers for
+ * all the GPIO lines on those SoCs which this driver reserves
+@@ -786,6 +783,9 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
+ if (!res)
+ return 0;
+
++ if (IS_ERR(mvchip->clk))
++ return PTR_ERR(mvchip->clk);
++
+ /*
+ * Use set A for lines of GPIO chip with id 0, B for GPIO chip
+ * with id 1. Don't allow further GPIO chips to be used for PWM.
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index b31d121a876b..81001d879322 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -122,14 +122,14 @@ static int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, union drm_amdgpu_cs
+ goto free_chunk;
+ }
+
++ mutex_lock(&p->ctx->lock);
++
+ /* skip guilty context job */
+ if (atomic_read(&p->ctx->guilty) == 1) {
+ ret = -ECANCELED;
+ goto free_chunk;
+ }
+
+- mutex_lock(&p->ctx->lock);
+-
+ /* get chunks */
+ chunk_array_user = u64_to_user_ptr(cs->in.chunks);
+ if (copy_from_user(chunk_array, chunk_array_user,
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 299def84e69c..d792735f1365 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -2894,6 +2894,7 @@ void amdgpu_dm_connector_funcs_reset(struct drm_connector *connector)
+ state->underscan_enable = false;
+ state->underscan_hborder = 0;
+ state->underscan_vborder = 0;
++ state->max_bpc = 8;
+
+ __drm_atomic_helper_connector_reset(connector, &state->base);
+ }
+@@ -2911,6 +2912,7 @@ amdgpu_dm_connector_atomic_duplicate_state(struct drm_connector *connector)
+ if (new_state) {
+ __drm_atomic_helper_connector_duplicate_state(connector,
+ &new_state->base);
++ new_state->max_bpc = state->max_bpc;
+ return &new_state->base;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index 2abcd7bf104f..f889d41a281f 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -1224,8 +1224,16 @@ nv50_mstm_fini(struct nv50_mstm *mstm)
+ static void
+ nv50_mstm_init(struct nv50_mstm *mstm)
+ {
+- if (mstm && mstm->mgr.mst_state)
+- drm_dp_mst_topology_mgr_resume(&mstm->mgr);
++ int ret;
++
++ if (!mstm || !mstm->mgr.mst_state)
++ return;
++
++ ret = drm_dp_mst_topology_mgr_resume(&mstm->mgr);
++ if (ret == -1) {
++ drm_dp_mst_topology_mgr_set_mst(&mstm->mgr, false);
++ drm_kms_helper_hotplug_event(mstm->mgr.dev);
++ }
+ }
+
+ static void
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
+index 79d00d861a31..01ff3c858875 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_psr.c
+@@ -189,12 +189,14 @@ EXPORT_SYMBOL(rockchip_drm_psr_flush_all);
+ int rockchip_drm_psr_register(struct drm_encoder *encoder,
+ int (*psr_set)(struct drm_encoder *, bool enable))
+ {
+- struct rockchip_drm_private *drm_drv = encoder->dev->dev_private;
++ struct rockchip_drm_private *drm_drv;
+ struct psr_drv *psr;
+
+ if (!encoder || !psr_set)
+ return -EINVAL;
+
++ drm_drv = encoder->dev->dev_private;
++
+ psr = kzalloc(sizeof(struct psr_drv), GFP_KERNEL);
+ if (!psr)
+ return -ENOMEM;
+diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
+index a3275fa66b7b..629f40424bba 100644
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -322,6 +322,7 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
+ if (vc4_state->is_unity)
+ vc4_state->x_scaling[0] = VC4_SCALING_PPF;
+ } else {
++ vc4_state->is_yuv = false;
+ vc4_state->x_scaling[1] = VC4_SCALING_NONE;
+ vc4_state->y_scaling[1] = VC4_SCALING_NONE;
+ }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 46182d4dd1ce..b7870e7e41d4 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -17,6 +17,9 @@
+ #ifndef HID_IDS_H_FILE
+ #define HID_IDS_H_FILE
+
++#define USB_VENDOR_ID_258A 0x258a
++#define USB_DEVICE_ID_258A_6A88 0x6a88
++
+ #define USB_VENDOR_ID_3M 0x0596
+ #define USB_DEVICE_ID_3M1968 0x0500
+ #define USB_DEVICE_ID_3M2256 0x0502
+diff --git a/drivers/hid/hid-ite.c b/drivers/hid/hid-ite.c
+index 1882a4ab0f29..98b059d79bc8 100644
+--- a/drivers/hid/hid-ite.c
++++ b/drivers/hid/hid-ite.c
+@@ -42,6 +42,7 @@ static int ite_event(struct hid_device *hdev, struct hid_field *field,
+
+ static const struct hid_device_id ite_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE8595) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_258A, USB_DEVICE_ID_258A_6A88) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, ite_devices);
+diff --git a/drivers/hv/Kconfig b/drivers/hv/Kconfig
+index 97954f575c3f..1c1a2514d6f3 100644
+--- a/drivers/hv/Kconfig
++++ b/drivers/hv/Kconfig
+@@ -4,7 +4,7 @@ menu "Microsoft Hyper-V guest support"
+
+ config HYPERV
+ tristate "Microsoft Hyper-V client drivers"
+- depends on X86 && ACPI && PCI && X86_LOCAL_APIC && HYPERVISOR_GUEST
++ depends on X86 && ACPI && X86_LOCAL_APIC && HYPERVISOR_GUEST
+ select PARAVIRT
+ help
+ Select this option to run Linux as a Hyper-V client operating
+diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
+index d293e55553bd..ba7aaf421f36 100644
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -1423,7 +1423,8 @@ nr_pages_store(struct device *dev, struct device_attribute *attr,
+ if (!end)
+ break;
+
+- len -= end - p;
++ /* consume the number and the following comma, hence +1 */
++ len -= end - p + 1;
+ p = end + 1;
+ } while (len);
+
+diff --git a/drivers/iio/dac/ad5686.c b/drivers/iio/dac/ad5686.c
+index 2ddbfc3fdbae..cba62ad26cd8 100644
+--- a/drivers/iio/dac/ad5686.c
++++ b/drivers/iio/dac/ad5686.c
+@@ -124,7 +124,8 @@ static int ad5686_read_raw(struct iio_dev *indio_dev,
+ mutex_unlock(&indio_dev->mlock);
+ if (ret < 0)
+ return ret;
+- *val = ret;
++ *val = (ret >> chan->scan_type.shift) &
++ GENMASK(chan->scan_type.realbits - 1, 0);
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_SCALE:
+ *val = st->vref_mv;
+diff --git a/drivers/infiniband/core/roce_gid_mgmt.c b/drivers/infiniband/core/roce_gid_mgmt.c
+index 25d43c8f1c2a..558de0b9895c 100644
+--- a/drivers/infiniband/core/roce_gid_mgmt.c
++++ b/drivers/infiniband/core/roce_gid_mgmt.c
+@@ -267,6 +267,9 @@ is_upper_ndev_bond_master_filter(struct ib_device *ib_dev, u8 port,
+ struct net_device *cookie_ndev = cookie;
+ bool match = false;
+
++ if (!rdma_ndev)
++ return false;
++
+ rcu_read_lock();
+ if (netif_is_bond_master(cookie_ndev) &&
+ rdma_is_upper_dev_rcu(rdma_ndev, cookie_ndev))
+diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
+index f2f11e652dcd..02f36ab72ad4 100644
+--- a/drivers/infiniband/hw/mlx5/devx.c
++++ b/drivers/infiniband/hw/mlx5/devx.c
+@@ -857,7 +857,9 @@ static int devx_umem_get(struct mlx5_ib_dev *dev, struct ib_ucontext *ucontext,
+
+ err = uverbs_get_flags32(&access, attrs,
+ MLX5_IB_ATTR_DEVX_UMEM_REG_ACCESS,
+- IB_ACCESS_SUPPORTED);
++ IB_ACCESS_LOCAL_WRITE |
++ IB_ACCESS_REMOTE_WRITE |
++ IB_ACCESS_REMOTE_READ);
+ if (err)
+ return err;
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index fc6c880756da..4111b798fd3c 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -844,11 +844,16 @@ static enum resp_states do_complete(struct rxe_qp *qp,
+
+ memset(&cqe, 0, sizeof(cqe));
+
+- wc->wr_id = wqe->wr_id;
+- wc->status = qp->resp.status;
+- wc->qp = &qp->ibqp;
++ if (qp->rcq->is_user) {
++ uwc->status = qp->resp.status;
++ uwc->qp_num = qp->ibqp.qp_num;
++ uwc->wr_id = wqe->wr_id;
++ } else {
++ wc->status = qp->resp.status;
++ wc->qp = &qp->ibqp;
++ wc->wr_id = wqe->wr_id;
++ }
+
+- /* fields after status are not required for errors */
+ if (wc->status == IB_WC_SUCCESS) {
+ wc->opcode = (pkt->mask & RXE_IMMDT_MASK &&
+ pkt->mask & RXE_WRITE_MASK) ?
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index f37cbad022a2..f4bce5aa0ff8 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2009,6 +2009,14 @@ static void srpt_free_ch(struct kref *kref)
+ kfree_rcu(ch, rcu);
+ }
+
++/*
++ * Shut down the SCSI target session, tell the connection manager to
++ * disconnect the associated RDMA channel, transition the QP to the error
++ * state and remove the channel from the channel list. This function is
++ * typically called from inside srpt_zerolength_write_done(). Concurrent
++ * srpt_zerolength_write() calls from inside srpt_close_ch() are possible
++ * as long as the channel is on sport->nexus_list.
++ */
+ static void srpt_release_channel_work(struct work_struct *w)
+ {
+ struct srpt_rdma_ch *ch;
+@@ -2036,6 +2044,11 @@ static void srpt_release_channel_work(struct work_struct *w)
+ else
+ ib_destroy_cm_id(ch->ib_cm.cm_id);
+
++ sport = ch->sport;
++ mutex_lock(&sport->mutex);
++ list_del_rcu(&ch->list);
++ mutex_unlock(&sport->mutex);
++
+ srpt_destroy_ch_ib(ch);
+
+ srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_ring,
+@@ -2046,11 +2059,6 @@ static void srpt_release_channel_work(struct work_struct *w)
+ sdev, ch->rq_size,
+ srp_max_req_size, DMA_FROM_DEVICE);
+
+- sport = ch->sport;
+- mutex_lock(&sport->mutex);
+- list_del_rcu(&ch->list);
+- mutex_unlock(&sport->mutex);
+-
+ wake_up(&sport->ch_releaseQ);
+
+ kref_put(&ch->kref, srpt_free_ch);
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index a7dc286f406c..840e53732753 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -126,12 +126,8 @@ static irqreturn_t omap4_keypad_irq_handler(int irq, void *dev_id)
+ {
+ struct omap4_keypad *keypad_data = dev_id;
+
+- if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)) {
+- /* Disable interrupts */
+- kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+- OMAP4_VAL_IRQDISABLE);
++ if (kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS))
+ return IRQ_WAKE_THREAD;
+- }
+
+ return IRQ_NONE;
+ }
+@@ -173,11 +169,6 @@ static irqreturn_t omap4_keypad_irq_thread_fn(int irq, void *dev_id)
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+
+- /* enable interrupts */
+- kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+- OMAP4_DEF_IRQENABLE_EVENTEN |
+- OMAP4_DEF_IRQENABLE_LONGKEY);
+-
+ return IRQ_HANDLED;
+ }
+
+@@ -214,9 +205,10 @@ static void omap4_keypad_close(struct input_dev *input)
+
+ disable_irq(keypad_data->irq);
+
+- /* Disable interrupts */
++ /* Disable interrupts and wake-up events */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+ OMAP4_VAL_IRQDISABLE);
++ kbd_writel(keypad_data, OMAP4_KBD_WAKEUPENABLE, 0);
+
+ /* clear pending interrupts */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+@@ -365,7 +357,7 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+ }
+
+ error = request_threaded_irq(keypad_data->irq, omap4_keypad_irq_handler,
+- omap4_keypad_irq_thread_fn, 0,
++ omap4_keypad_irq_thread_fn, IRQF_ONESHOT,
+ "omap4-keypad", keypad_data);
+ if (error) {
+ dev_err(&pdev->dev, "failed to register interrupt\n");
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 2bd5bb11c8ba..b6da0c1267e3 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -171,6 +171,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0046", /* X250 */
+ "LEN004a", /* W541 */
+ "LEN005b", /* P50 */
++ "LEN005e", /* T560 */
+ "LEN0071", /* T480 */
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN0073", /* X1 Carbon G5 (Elantech) */
+@@ -178,6 +179,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN200f", /* T450s */
++ "SYN3052", /* HP EliteBook 840 G4 */
+ "SYN3221", /* HP 15-ay000 */
+ NULL
+ };
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index a76c47f20587..4339177629e3 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2069,7 +2069,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
+ * than default. Unnecessary for PT mode.
+ */
+ if (translation != CONTEXT_TT_PASS_THROUGH) {
+- for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) {
++ for (agaw = domain->agaw; agaw > iommu->agaw; agaw--) {
+ ret = -ENOMEM;
+ pgd = phys_to_virt(dma_pte_addr(pgd));
+ if (!dma_pte_present(pgd))
+@@ -2083,7 +2083,7 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
+ translation = CONTEXT_TT_MULTI_LEVEL;
+
+ context_set_address_root(context, virt_to_phys(pgd));
+- context_set_address_width(context, iommu->agaw);
++ context_set_address_width(context, agaw);
+ } else {
+ /*
+ * In pass through mode, AW must be programmed to
+diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
+index df80c89ebe7f..5d3faae51d59 100644
+--- a/drivers/leds/leds-pwm.c
++++ b/drivers/leds/leds-pwm.c
+@@ -100,8 +100,9 @@ static int led_pwm_add(struct device *dev, struct led_pwm_priv *priv,
+ led_data->pwm = devm_pwm_get(dev, led->name);
+ if (IS_ERR(led_data->pwm)) {
+ ret = PTR_ERR(led_data->pwm);
+- dev_err(dev, "unable to request PWM for %s: %d\n",
+- led->name, ret);
++ if (ret != -EPROBE_DEFER)
++ dev_err(dev, "unable to request PWM for %s: %d\n",
++ led->name, ret);
+ return ret;
+ }
+
+diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
+index 39804d830305..fd5c52b21436 100644
+--- a/drivers/media/pci/cx23885/cx23885-core.c
++++ b/drivers/media/pci/cx23885/cx23885-core.c
+@@ -23,6 +23,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/kmod.h>
+ #include <linux/kernel.h>
++#include <linux/pci.h>
+ #include <linux/slab.h>
+ #include <linux/interrupt.h>
+ #include <linux/delay.h>
+@@ -41,6 +42,18 @@ MODULE_AUTHOR("Steven Toth <stoth@linuxtv.org>");
+ MODULE_LICENSE("GPL");
+ MODULE_VERSION(CX23885_VERSION);
+
++/*
++ * Some platforms have been found to require periodic resetting of the DMA
++ * engine. Ryzen and XEON platforms are known to be affected. The symptom
++ * encountered is "mpeg risc op code error". Only Ryzen platforms employ
++ * this workaround if the option equals 1. The workaround can be explicitly
++ * disabled for all platforms by setting to 0, the workaround can be forced
++ * on for any platform by setting to 2.
++ */
++static unsigned int dma_reset_workaround = 1;
++module_param(dma_reset_workaround, int, 0644);
++MODULE_PARM_DESC(dma_reset_workaround, "periodic RiSC dma engine reset; 0-force disable, 1-driver detect (default), 2-force enable");
++
+ static unsigned int debug;
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "enable debug messages");
+@@ -603,8 +616,13 @@ static void cx23885_risc_disasm(struct cx23885_tsport *port,
+
+ static void cx23885_clear_bridge_error(struct cx23885_dev *dev)
+ {
+- uint32_t reg1_val = cx_read(TC_REQ); /* read-only */
+- uint32_t reg2_val = cx_read(TC_REQ_SET);
++ uint32_t reg1_val, reg2_val;
++
++ if (!dev->need_dma_reset)
++ return;
++
++ reg1_val = cx_read(TC_REQ); /* read-only */
++ reg2_val = cx_read(TC_REQ_SET);
+
+ if (reg1_val && reg2_val) {
+ cx_write(TC_REQ, reg1_val);
+@@ -2058,6 +2076,37 @@ void cx23885_gpio_enable(struct cx23885_dev *dev, u32 mask, int asoutput)
+ /* TODO: 23-19 */
+ }
+
++static struct {
++ int vendor, dev;
++} const broken_dev_id[] = {
++ /* According with
++ * https://openbenchmarking.org/system/1703021-RI-AMDZEN08075/Ryzen%207%201800X/lspci,
++ * 0x1451 is PCI ID for the IOMMU found on Ryzen
++ */
++ { PCI_VENDOR_ID_AMD, 0x1451 },
++};
++
++static bool cx23885_does_need_dma_reset(void)
++{
++ int i;
++ struct pci_dev *pdev = NULL;
++
++ if (dma_reset_workaround == 0)
++ return false;
++ else if (dma_reset_workaround == 2)
++ return true;
++
++ for (i = 0; i < ARRAY_SIZE(broken_dev_id); i++) {
++ pdev = pci_get_device(broken_dev_id[i].vendor,
++ broken_dev_id[i].dev, NULL);
++ if (pdev) {
++ pci_dev_put(pdev);
++ return true;
++ }
++ }
++ return false;
++}
++
+ static int cx23885_initdev(struct pci_dev *pci_dev,
+ const struct pci_device_id *pci_id)
+ {
+@@ -2069,6 +2118,8 @@ static int cx23885_initdev(struct pci_dev *pci_dev,
+ if (NULL == dev)
+ return -ENOMEM;
+
++ dev->need_dma_reset = cx23885_does_need_dma_reset();
++
+ err = v4l2_device_register(&pci_dev->dev, &dev->v4l2_dev);
+ if (err < 0)
+ goto fail_free;
+diff --git a/drivers/media/pci/cx23885/cx23885.h b/drivers/media/pci/cx23885/cx23885.h
+index d54c7ee1ab21..cf965efabe66 100644
+--- a/drivers/media/pci/cx23885/cx23885.h
++++ b/drivers/media/pci/cx23885/cx23885.h
+@@ -451,6 +451,8 @@ struct cx23885_dev {
+ /* Analog raw audio */
+ struct cx23885_audio_dev *audio_dev;
+
++ /* Does the system require periodic DMA resets? */
++ unsigned int need_dma_reset:1;
+ };
+
+ static inline struct cx23885_dev *to_cx23885(struct v4l2_device *v4l2_dev)
+diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
+index 8679e0bd8ec2..f4f8ab602442 100644
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -217,7 +217,7 @@ u32 genwqe_crc32(u8 *buff, size_t len, u32 init)
+ void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size,
+ dma_addr_t *dma_handle)
+ {
+- if (get_order(size) > MAX_ORDER)
++ if (get_order(size) >= MAX_ORDER)
+ return NULL;
+
+ return dma_zalloc_coherent(&cd->pci_dev->dev, size, dma_handle,
+diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+index 3b889efddf78..50dd6bf176d0 100644
+--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+@@ -29,9 +29,6 @@
+ #define RES_RING_CSR 1
+ #define RES_RING_CMD 2
+
+-static const struct of_device_id xgene_enet_of_match[];
+-static const struct acpi_device_id xgene_enet_acpi_match[];
+-
+ static void xgene_enet_init_bufpool(struct xgene_enet_desc_ring *buf_pool)
+ {
+ struct xgene_enet_raw_desc16 *raw_desc;
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+index 0de487a8f0eb..3db54b664aed 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -1282,6 +1282,7 @@ enum sp_rtnl_flag {
+ BNX2X_SP_RTNL_TX_STOP,
+ BNX2X_SP_RTNL_GET_DRV_VERSION,
+ BNX2X_SP_RTNL_CHANGE_UDP_PORT,
++ BNX2X_SP_RTNL_UPDATE_SVID,
+ };
+
+ enum bnx2x_iov_flag {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index fcc2328bb0d9..a585f1025a58 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -2925,6 +2925,10 @@ static void bnx2x_handle_update_svid_cmd(struct bnx2x *bp)
+ func_params.f_obj = &bp->func_obj;
+ func_params.cmd = BNX2X_F_CMD_SWITCH_UPDATE;
+
++ /* Prepare parameters for function state transitions */
++ __set_bit(RAMROD_COMP_WAIT, &func_params.ramrod_flags);
++ __set_bit(RAMROD_RETRY, &func_params.ramrod_flags);
++
+ if (IS_MF_UFP(bp) || IS_MF_BD(bp)) {
+ int func = BP_ABS_FUNC(bp);
+ u32 val;
+@@ -4301,7 +4305,8 @@ static void bnx2x_attn_int_deasserted3(struct bnx2x *bp, u32 attn)
+ bnx2x_handle_eee_event(bp);
+
+ if (val & DRV_STATUS_OEM_UPDATE_SVID)
+- bnx2x_handle_update_svid_cmd(bp);
++ bnx2x_schedule_sp_rtnl(bp,
++ BNX2X_SP_RTNL_UPDATE_SVID, 0);
+
+ if (bp->link_vars.periodic_flags &
+ PERIODIC_FLAGS_LINK_EVENT) {
+@@ -8462,6 +8467,7 @@ int bnx2x_set_vlan_one(struct bnx2x *bp, u16 vlan,
+ /* Fill a user request section if needed */
+ if (!test_bit(RAMROD_CONT, ramrod_flags)) {
+ ramrod_param.user_req.u.vlan.vlan = vlan;
++ __set_bit(BNX2X_VLAN, &ramrod_param.user_req.vlan_mac_flags);
+ /* Set the command: ADD or DEL */
+ if (set)
+ ramrod_param.user_req.cmd = BNX2X_VLAN_MAC_ADD;
+@@ -8482,6 +8488,27 @@ int bnx2x_set_vlan_one(struct bnx2x *bp, u16 vlan,
+ return rc;
+ }
+
++static int bnx2x_del_all_vlans(struct bnx2x *bp)
++{
++ struct bnx2x_vlan_mac_obj *vlan_obj = &bp->sp_objs[0].vlan_obj;
++ unsigned long ramrod_flags = 0, vlan_flags = 0;
++ struct bnx2x_vlan_entry *vlan;
++ int rc;
++
++ __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
++ __set_bit(BNX2X_VLAN, &vlan_flags);
++ rc = vlan_obj->delete_all(bp, vlan_obj, &vlan_flags, &ramrod_flags);
++ if (rc)
++ return rc;
++
++ /* Mark that hw forgot all entries */
++ list_for_each_entry(vlan, &bp->vlan_reg, link)
++ vlan->hw = false;
++ bp->vlan_cnt = 0;
++
++ return 0;
++}
++
+ int bnx2x_del_all_macs(struct bnx2x *bp,
+ struct bnx2x_vlan_mac_obj *mac_obj,
+ int mac_type, bool wait_for_comp)
+@@ -9320,6 +9347,17 @@ void bnx2x_chip_cleanup(struct bnx2x *bp, int unload_mode, bool keep_link)
+ BNX2X_ERR("Failed to schedule DEL commands for UC MACs list: %d\n",
+ rc);
+
++ /* The whole *vlan_obj structure may be not initialized if VLAN
++ * filtering offload is not supported by hardware. Currently this is
++ * true for all hardware covered by CHIP_IS_E1x().
++ */
++ if (!CHIP_IS_E1x(bp)) {
++ /* Remove all currently configured VLANs */
++ rc = bnx2x_del_all_vlans(bp);
++ if (rc < 0)
++ BNX2X_ERR("Failed to delete all VLANs\n");
++ }
++
+ /* Disable LLH */
+ if (!CHIP_IS_E1(bp))
+ REG_WR(bp, NIG_REG_LLH0_FUNC_EN + port*8, 0);
+@@ -10349,6 +10387,9 @@ sp_rtnl_not_reset:
+ &bp->sp_rtnl_state))
+ bnx2x_update_mng_version(bp);
+
++ if (test_and_clear_bit(BNX2X_SP_RTNL_UPDATE_SVID, &bp->sp_rtnl_state))
++ bnx2x_handle_update_svid_cmd(bp);
++
+ if (test_and_clear_bit(BNX2X_SP_RTNL_CHANGE_UDP_PORT,
+ &bp->sp_rtnl_state)) {
+ if (bnx2x_udp_port_update(bp)) {
+@@ -11740,8 +11781,10 @@ static void bnx2x_get_fcoe_info(struct bnx2x *bp)
+ * If maximum allowed number of connections is zero -
+ * disable the feature.
+ */
+- if (!bp->cnic_eth_dev.max_fcoe_conn)
++ if (!bp->cnic_eth_dev.max_fcoe_conn) {
+ bp->flags |= NO_FCOE_FLAG;
++ eth_zero_addr(bp->fip_mac);
++ }
+ }
+
+ static void bnx2x_get_cnic_info(struct bnx2x *bp)
+@@ -13014,13 +13057,6 @@ static void bnx2x_vlan_configure(struct bnx2x *bp, bool set_rx_mode)
+
+ int bnx2x_vlan_reconfigure_vid(struct bnx2x *bp)
+ {
+- struct bnx2x_vlan_entry *vlan;
+-
+- /* The hw forgot all entries after reload */
+- list_for_each_entry(vlan, &bp->vlan_reg, link)
+- vlan->hw = false;
+- bp->vlan_cnt = 0;
+-
+ /* Don't set rx mode here. Our caller will do it. */
+ bnx2x_vlan_configure(bp, false);
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+index 0bf2fd470819..7a6e82db4231 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+@@ -265,6 +265,7 @@ enum {
+ BNX2X_ETH_MAC,
+ BNX2X_ISCSI_ETH_MAC,
+ BNX2X_NETQ_ETH_MAC,
++ BNX2X_VLAN,
+ BNX2X_DONT_CONSUME_CAM_CREDIT,
+ BNX2X_DONT_CONSUME_CAM_CREDIT_DEST,
+ };
+@@ -272,7 +273,8 @@ enum {
+ #define BNX2X_VLAN_MAC_CMP_MASK (1 << BNX2X_UC_LIST_MAC | \
+ 1 << BNX2X_ETH_MAC | \
+ 1 << BNX2X_ISCSI_ETH_MAC | \
+- 1 << BNX2X_NETQ_ETH_MAC)
++ 1 << BNX2X_NETQ_ETH_MAC | \
++ 1 << BNX2X_VLAN)
+ #define BNX2X_VLAN_MAC_CMP_FLAGS(flags) \
+ ((flags) & BNX2X_VLAN_MAC_CMP_MASK)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 240fd36b5074..8f4b2f9a8e07 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -682,6 +682,11 @@ static void macb_set_addr(struct macb *bp, struct macb_dma_desc *desc, dma_addr_
+ if (bp->hw_dma_cap & HW_DMA_CAP_64B) {
+ desc_64 = macb_64b_desc(bp, desc);
+ desc_64->addrh = upper_32_bits(addr);
++ /* The low bits of RX address contain the RX_USED bit, clearing
++ * of which allows packet RX. Make sure the high bits are also
++ * visible to HW at that point.
++ */
++ dma_wmb();
+ }
+ #endif
+ desc->addr = lower_32_bits(addr);
+@@ -930,14 +935,19 @@ static void gem_rx_refill(struct macb_queue *queue)
+
+ if (entry == bp->rx_ring_size - 1)
+ paddr |= MACB_BIT(RX_WRAP);
+- macb_set_addr(bp, desc, paddr);
+ desc->ctrl = 0;
++ /* Setting addr clears RX_USED and allows reception,
++ * make sure ctrl is cleared first to avoid a race.
++ */
++ dma_wmb();
++ macb_set_addr(bp, desc, paddr);
+
+ /* properly align Ethernet header */
+ skb_reserve(skb, NET_IP_ALIGN);
+ } else {
+- desc->addr &= ~MACB_BIT(RX_USED);
+ desc->ctrl = 0;
++ dma_wmb();
++ desc->addr &= ~MACB_BIT(RX_USED);
+ }
+ }
+
+@@ -991,11 +1001,15 @@ static int gem_rx(struct macb_queue *queue, int budget)
+
+ rxused = (desc->addr & MACB_BIT(RX_USED)) ? true : false;
+ addr = macb_get_addr(bp, desc);
+- ctrl = desc->ctrl;
+
+ if (!rxused)
+ break;
+
++ /* Ensure ctrl is at least as up-to-date as rxused */
++ dma_rmb();
++
++ ctrl = desc->ctrl;
++
+ queue->rx_tail++;
+ count++;
+
+@@ -1170,11 +1184,14 @@ static int macb_rx(struct macb_queue *queue, int budget)
+ /* Make hw descriptor updates visible to CPU */
+ rmb();
+
+- ctrl = desc->ctrl;
+-
+ if (!(desc->addr & MACB_BIT(RX_USED)))
+ break;
+
++ /* Ensure ctrl is at least as up-to-date as addr */
++ dma_rmb();
++
++ ctrl = desc->ctrl;
++
+ if (ctrl & MACB_BIT(RX_SOF)) {
+ if (first_frag != -1)
+ discard_partial_frame(queue, first_frag, tail);
+diff --git a/drivers/net/ethernet/cadence/macb_ptp.c b/drivers/net/ethernet/cadence/macb_ptp.c
+index cd5296b84229..a6dc47edc4cf 100644
+--- a/drivers/net/ethernet/cadence/macb_ptp.c
++++ b/drivers/net/ethernet/cadence/macb_ptp.c
+@@ -319,6 +319,8 @@ int gem_ptp_txstamp(struct macb_queue *queue, struct sk_buff *skb,
+ desc_ptp = macb_ptp_desc(queue->bp, desc);
+ tx_timestamp = &queue->tx_timestamps[head];
+ tx_timestamp->skb = skb;
++ /* ensure ts_1/ts_2 is loaded after ctrl (TX_USED check) */
++ dma_rmb();
+ tx_timestamp->desc_ptp.ts_1 = desc_ptp->ts_1;
+ tx_timestamp->desc_ptp.ts_2 = desc_ptp->ts_2;
+ /* move head */
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+index b52029e26d15..ad1779fc410e 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+@@ -379,6 +379,9 @@ static void hns_ae_stop(struct hnae_handle *handle)
+
+ hns_ae_ring_enable_all(handle, 0);
+
++ /* clean rx fbd. */
++ hns_rcb_wait_fbd_clean(handle->qs, handle->q_num, RCB_INT_FLAG_RX);
++
+ (void)hns_mac_vm_config_bc_en(mac_cb, 0, false);
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+index 09e4061d1fa6..aa2c25d7a61d 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+@@ -67,11 +67,14 @@ static void hns_gmac_enable(void *mac_drv, enum mac_commom_mode mode)
+ struct mac_driver *drv = (struct mac_driver *)mac_drv;
+
+ /*enable GE rX/tX */
+- if ((mode == MAC_COMM_MODE_TX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_TX || mode == MAC_COMM_MODE_RX_AND_TX)
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_TX_EN_B, 1);
+
+- if ((mode == MAC_COMM_MODE_RX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_RX || mode == MAC_COMM_MODE_RX_AND_TX) {
++ /* enable rx pcs */
++ dsaf_set_dev_bit(drv, GMAC_PCS_RX_EN_REG, 0, 0);
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_RX_EN_B, 1);
++ }
+ }
+
+ static void hns_gmac_disable(void *mac_drv, enum mac_commom_mode mode)
+@@ -79,11 +82,14 @@ static void hns_gmac_disable(void *mac_drv, enum mac_commom_mode mode)
+ struct mac_driver *drv = (struct mac_driver *)mac_drv;
+
+ /*disable GE rX/tX */
+- if ((mode == MAC_COMM_MODE_TX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_TX || mode == MAC_COMM_MODE_RX_AND_TX)
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_TX_EN_B, 0);
+
+- if ((mode == MAC_COMM_MODE_RX) || (mode == MAC_COMM_MODE_RX_AND_TX))
++ if (mode == MAC_COMM_MODE_RX || mode == MAC_COMM_MODE_RX_AND_TX) {
++ /* disable rx pcs */
++ dsaf_set_dev_bit(drv, GMAC_PCS_RX_EN_REG, 0, 1);
+ dsaf_set_dev_bit(drv, GMAC_PORT_EN_REG, GMAC_PORT_RX_EN_B, 0);
++ }
+ }
+
+ /* hns_gmac_get_en - get port enable
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+index 6ed6f142427e..cfdc92de9dc0 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+@@ -778,6 +778,17 @@ static int hns_mac_register_phy(struct hns_mac_cb *mac_cb)
+ return rc;
+ }
+
++static void hns_mac_remove_phydev(struct hns_mac_cb *mac_cb)
++{
++ if (!to_acpi_device_node(mac_cb->fw_port) || !mac_cb->phy_dev)
++ return;
++
++ phy_device_remove(mac_cb->phy_dev);
++ phy_device_free(mac_cb->phy_dev);
++
++ mac_cb->phy_dev = NULL;
++}
++
+ #define MAC_MEDIA_TYPE_MAX_LEN 16
+
+ static const struct {
+@@ -1117,7 +1128,11 @@ void hns_mac_uninit(struct dsaf_device *dsaf_dev)
+ int max_port_num = hns_mac_get_max_port_num(dsaf_dev);
+
+ for (i = 0; i < max_port_num; i++) {
++ if (!dsaf_dev->mac_cb[i])
++ continue;
++
+ dsaf_dev->misc_op->cpld_reset_led(dsaf_dev->mac_cb[i]);
++ hns_mac_remove_phydev(dsaf_dev->mac_cb[i]);
+ dsaf_dev->mac_cb[i] = NULL;
+ }
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+index e557a4ef5996..3b9e74be5fbd 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -934,6 +934,62 @@ static void hns_dsaf_tcam_mc_cfg(
+ spin_unlock_bh(&dsaf_dev->tcam_lock);
+ }
+
++/**
++ * hns_dsaf_tcam_uc_cfg_vague - INT
++ * @dsaf_dev: dsa fabric device struct pointer
++ * @address,
++ * @ptbl_tcam_data,
++ */
++static void hns_dsaf_tcam_uc_cfg_vague(struct dsaf_device *dsaf_dev,
++ u32 address,
++ struct dsaf_tbl_tcam_data *tcam_data,
++ struct dsaf_tbl_tcam_data *tcam_mask,
++ struct dsaf_tbl_tcam_ucast_cfg *tcam_uc)
++{
++ spin_lock_bh(&dsaf_dev->tcam_lock);
++ hns_dsaf_tbl_tcam_addr_cfg(dsaf_dev, address);
++ hns_dsaf_tbl_tcam_data_cfg(dsaf_dev, tcam_data);
++ hns_dsaf_tbl_tcam_ucast_cfg(dsaf_dev, tcam_uc);
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++ hns_dsaf_tbl_tcam_data_ucast_pul(dsaf_dev);
++
++ /*Restore Match Data*/
++ tcam_mask->tbl_tcam_data_high = 0xffffffff;
++ tcam_mask->tbl_tcam_data_low = 0xffffffff;
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++
++ spin_unlock_bh(&dsaf_dev->tcam_lock);
++}
++
++/**
++ * hns_dsaf_tcam_mc_cfg_vague - INT
++ * @dsaf_dev: dsa fabric device struct pointer
++ * @address,
++ * @ptbl_tcam_data,
++ * @ptbl_tcam_mask
++ * @ptbl_tcam_mcast
++ */
++static void hns_dsaf_tcam_mc_cfg_vague(struct dsaf_device *dsaf_dev,
++ u32 address,
++ struct dsaf_tbl_tcam_data *tcam_data,
++ struct dsaf_tbl_tcam_data *tcam_mask,
++ struct dsaf_tbl_tcam_mcast_cfg *tcam_mc)
++{
++ spin_lock_bh(&dsaf_dev->tcam_lock);
++ hns_dsaf_tbl_tcam_addr_cfg(dsaf_dev, address);
++ hns_dsaf_tbl_tcam_data_cfg(dsaf_dev, tcam_data);
++ hns_dsaf_tbl_tcam_mcast_cfg(dsaf_dev, tcam_mc);
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++ hns_dsaf_tbl_tcam_data_mcast_pul(dsaf_dev);
++
++ /*Restore Match Data*/
++ tcam_mask->tbl_tcam_data_high = 0xffffffff;
++ tcam_mask->tbl_tcam_data_low = 0xffffffff;
++ hns_dsaf_tbl_tcam_match_cfg(dsaf_dev, tcam_mask);
++
++ spin_unlock_bh(&dsaf_dev->tcam_lock);
++}
++
+ /**
+ * hns_dsaf_tcam_mc_invld - INT
+ * @dsaf_id: dsa fabric id
+@@ -1492,6 +1548,27 @@ static u16 hns_dsaf_find_empty_mac_entry(struct dsaf_device *dsaf_dev)
+ return DSAF_INVALID_ENTRY_IDX;
+ }
+
++/**
++ * hns_dsaf_find_empty_mac_entry_reverse
++ * search dsa fabric soft empty-entry from the end
++ * @dsaf_dev: dsa fabric device struct pointer
++ */
++static u16 hns_dsaf_find_empty_mac_entry_reverse(struct dsaf_device *dsaf_dev)
++{
++ struct dsaf_drv_priv *priv = hns_dsaf_dev_priv(dsaf_dev);
++ struct dsaf_drv_soft_mac_tbl *soft_mac_entry;
++ int i;
++
++ soft_mac_entry = priv->soft_mac_tbl + (DSAF_TCAM_SUM - 1);
++ for (i = (DSAF_TCAM_SUM - 1); i > 0; i--) {
++ /* search all entry from end to start.*/
++ if (soft_mac_entry->index == DSAF_INVALID_ENTRY_IDX)
++ return i;
++ soft_mac_entry--;
++ }
++ return DSAF_INVALID_ENTRY_IDX;
++}
++
+ /**
+ * hns_dsaf_set_mac_key - set mac key
+ * @dsaf_dev: dsa fabric device struct pointer
+@@ -2166,9 +2243,9 @@ void hns_dsaf_update_stats(struct dsaf_device *dsaf_dev, u32 node_num)
+ DSAF_INODE_LOCAL_ADDR_FALSE_NUM_0_REG + 0x80 * (u64)node_num);
+
+ hw_stats->vlan_drop += dsaf_read_dev(dsaf_dev,
+- DSAF_INODE_SW_VLAN_TAG_DISC_0_REG + 0x80 * (u64)node_num);
++ DSAF_INODE_SW_VLAN_TAG_DISC_0_REG + 4 * (u64)node_num);
+ hw_stats->stp_drop += dsaf_read_dev(dsaf_dev,
+- DSAF_INODE_IN_DATA_STP_DISC_0_REG + 0x80 * (u64)node_num);
++ DSAF_INODE_IN_DATA_STP_DISC_0_REG + 4 * (u64)node_num);
+
+ /* pfc pause frame statistics stored in dsaf inode*/
+ if ((node_num < DSAF_SERVICE_NW_NUM) && !is_ver1) {
+@@ -2285,237 +2362,237 @@ void hns_dsaf_get_regs(struct dsaf_device *ddev, u32 port, void *data)
+ DSAF_INODE_BD_ORDER_STATUS_0_REG + j * 4);
+ p[223 + i] = dsaf_read_dev(ddev,
+ DSAF_INODE_SW_VLAN_TAG_DISC_0_REG + j * 4);
+- p[224 + i] = dsaf_read_dev(ddev,
++ p[226 + i] = dsaf_read_dev(ddev,
+ DSAF_INODE_IN_DATA_STP_DISC_0_REG + j * 4);
+ }
+
+- p[227] = dsaf_read_dev(ddev, DSAF_INODE_GE_FC_EN_0_REG + port * 4);
++ p[229] = dsaf_read_dev(ddev, DSAF_INODE_GE_FC_EN_0_REG + port * 4);
+
+ for (i = 0; i < DSAF_INODE_NUM / DSAF_COMM_CHN; i++) {
+ j = i * DSAF_COMM_CHN + port;
+- p[228 + i] = dsaf_read_dev(ddev,
++ p[230 + i] = dsaf_read_dev(ddev,
+ DSAF_INODE_VC0_IN_PKT_NUM_0_REG + j * 4);
+ }
+
+- p[231] = dsaf_read_dev(ddev,
+- DSAF_INODE_VC1_IN_PKT_NUM_0_REG + port * 4);
++ p[233] = dsaf_read_dev(ddev,
++ DSAF_INODE_VC1_IN_PKT_NUM_0_REG + port * 0x80);
+
+ /* dsaf inode registers */
+ for (i = 0; i < HNS_DSAF_SBM_NUM(ddev) / DSAF_COMM_CHN; i++) {
+ j = i * DSAF_COMM_CHN + port;
+- p[232 + i] = dsaf_read_dev(ddev,
++ p[234 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_CFG_REG_0_REG + j * 0x80);
+- p[235 + i] = dsaf_read_dev(ddev,
++ p[237 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_0_XGE_REG_0_REG + j * 0x80);
+- p[238 + i] = dsaf_read_dev(ddev,
++ p[240 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_1_REG_0_REG + j * 0x80);
+- p[241 + i] = dsaf_read_dev(ddev,
++ p[243 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_2_XGE_REG_0_REG + j * 0x80);
+- p[244 + i] = dsaf_read_dev(ddev,
++ p[246 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_FREE_CNT_0_0_REG + j * 0x80);
+- p[245 + i] = dsaf_read_dev(ddev,
++ p[249 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_FREE_CNT_1_0_REG + j * 0x80);
+- p[248 + i] = dsaf_read_dev(ddev,
++ p[252 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_0_0_REG + j * 0x80);
+- p[251 + i] = dsaf_read_dev(ddev,
++ p[255 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_1_0_REG + j * 0x80);
+- p[254 + i] = dsaf_read_dev(ddev,
++ p[258 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_2_0_REG + j * 0x80);
+- p[257 + i] = dsaf_read_dev(ddev,
++ p[261 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CNT_3_0_REG + j * 0x80);
+- p[260 + i] = dsaf_read_dev(ddev,
++ p[264 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_INER_ST_0_REG + j * 0x80);
+- p[263 + i] = dsaf_read_dev(ddev,
++ p[267 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_MIB_REQ_FAILED_TC_0_REG + j * 0x80);
+- p[266 + i] = dsaf_read_dev(ddev,
++ p[270 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_CNT_0_REG + j * 0x80);
+- p[269 + i] = dsaf_read_dev(ddev,
++ p[273 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_DROP_CNT_0_REG + j * 0x80);
+- p[272 + i] = dsaf_read_dev(ddev,
++ p[276 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_INF_OUTPORT_CNT_0_REG + j * 0x80);
+- p[275 + i] = dsaf_read_dev(ddev,
++ p[279 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC0_CNT_0_REG + j * 0x80);
+- p[278 + i] = dsaf_read_dev(ddev,
++ p[282 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC1_CNT_0_REG + j * 0x80);
+- p[281 + i] = dsaf_read_dev(ddev,
++ p[285 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC2_CNT_0_REG + j * 0x80);
+- p[284 + i] = dsaf_read_dev(ddev,
++ p[288 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC3_CNT_0_REG + j * 0x80);
+- p[287 + i] = dsaf_read_dev(ddev,
++ p[291 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC4_CNT_0_REG + j * 0x80);
+- p[290 + i] = dsaf_read_dev(ddev,
++ p[294 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC5_CNT_0_REG + j * 0x80);
+- p[293 + i] = dsaf_read_dev(ddev,
++ p[297 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC6_CNT_0_REG + j * 0x80);
+- p[296 + i] = dsaf_read_dev(ddev,
++ p[300 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_INPORT_TC7_CNT_0_REG + j * 0x80);
+- p[299 + i] = dsaf_read_dev(ddev,
++ p[303 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_REQ_CNT_0_REG + j * 0x80);
+- p[302 + i] = dsaf_read_dev(ddev,
++ p[306 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_LNK_RELS_CNT_0_REG + j * 0x80);
+- p[305 + i] = dsaf_read_dev(ddev,
++ p[309 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_3_REG_0_REG + j * 0x80);
+- p[308 + i] = dsaf_read_dev(ddev,
++ p[312 + i] = dsaf_read_dev(ddev,
+ DSAF_SBM_BP_CFG_4_REG_0_REG + j * 0x80);
+ }
+
+ /* dsaf onode registers */
+ for (i = 0; i < DSAF_XOD_NUM; i++) {
+- p[311 + i] = dsaf_read_dev(ddev,
++ p[315 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_TSA_TC0_TC3_CFG_0_REG + i * 0x90);
+- p[319 + i] = dsaf_read_dev(ddev,
++ p[323 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_TSA_TC4_TC7_CFG_0_REG + i * 0x90);
+- p[327 + i] = dsaf_read_dev(ddev,
++ p[331 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_BW_TC0_TC3_CFG_0_REG + i * 0x90);
+- p[335 + i] = dsaf_read_dev(ddev,
++ p[339 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_BW_TC4_TC7_CFG_0_REG + i * 0x90);
+- p[343 + i] = dsaf_read_dev(ddev,
++ p[347 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_BW_OFFSET_CFG_0_REG + i * 0x90);
+- p[351 + i] = dsaf_read_dev(ddev,
++ p[355 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_ETS_TOKEN_CFG_0_REG + i * 0x90);
+ }
+
+- p[359] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_0_0_REG + port * 0x90);
+- p[360] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_1_0_REG + port * 0x90);
+- p[361] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_2_0_REG + port * 0x90);
++ p[363] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_0_0_REG + port * 0x90);
++ p[364] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_1_0_REG + port * 0x90);
++ p[365] = dsaf_read_dev(ddev, DSAF_XOD_PFS_CFG_2_0_REG + port * 0x90);
+
+ for (i = 0; i < DSAF_XOD_BIG_NUM / DSAF_COMM_CHN; i++) {
+ j = i * DSAF_COMM_CHN + port;
+- p[362 + i] = dsaf_read_dev(ddev,
++ p[366 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_GNT_L_0_REG + j * 0x90);
+- p[365 + i] = dsaf_read_dev(ddev,
++ p[369 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_GNT_H_0_REG + j * 0x90);
+- p[368 + i] = dsaf_read_dev(ddev,
++ p[372 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_CONNECT_STATE_0_REG + j * 0x90);
+- p[371 + i] = dsaf_read_dev(ddev,
++ p[375 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVPKT_CNT_0_REG + j * 0x90);
+- p[374 + i] = dsaf_read_dev(ddev,
++ p[378 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC0_CNT_0_REG + j * 0x90);
+- p[377 + i] = dsaf_read_dev(ddev,
++ p[381 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC1_CNT_0_REG + j * 0x90);
+- p[380 + i] = dsaf_read_dev(ddev,
++ p[384 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC2_CNT_0_REG + j * 0x90);
+- p[383 + i] = dsaf_read_dev(ddev,
++ p[387 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVTC3_CNT_0_REG + j * 0x90);
+- p[386 + i] = dsaf_read_dev(ddev,
++ p[390 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVVC0_CNT_0_REG + j * 0x90);
+- p[389 + i] = dsaf_read_dev(ddev,
++ p[393 + i] = dsaf_read_dev(ddev,
+ DSAF_XOD_RCVVC1_CNT_0_REG + j * 0x90);
+ }
+
+- p[392] = dsaf_read_dev(ddev,
++ p[396] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN0_CNT_0_REG + port * 0x90);
+- p[393] = dsaf_read_dev(ddev,
++ p[397] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN1_CNT_0_REG + port * 0x90);
+- p[394] = dsaf_read_dev(ddev,
++ p[398] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN2_CNT_0_REG + port * 0x90);
+- p[395] = dsaf_read_dev(ddev,
++ p[399] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN3_CNT_0_REG + port * 0x90);
+- p[396] = dsaf_read_dev(ddev,
++ p[400] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN4_CNT_0_REG + port * 0x90);
+- p[397] = dsaf_read_dev(ddev,
++ p[401] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN5_CNT_0_REG + port * 0x90);
+- p[398] = dsaf_read_dev(ddev,
++ p[402] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN6_CNT_0_REG + port * 0x90);
+- p[399] = dsaf_read_dev(ddev,
++ p[403] = dsaf_read_dev(ddev,
+ DSAF_XOD_XGE_RCVIN7_CNT_0_REG + port * 0x90);
+- p[400] = dsaf_read_dev(ddev,
++ p[404] = dsaf_read_dev(ddev,
+ DSAF_XOD_PPE_RCVIN0_CNT_0_REG + port * 0x90);
+- p[401] = dsaf_read_dev(ddev,
++ p[405] = dsaf_read_dev(ddev,
+ DSAF_XOD_PPE_RCVIN1_CNT_0_REG + port * 0x90);
+- p[402] = dsaf_read_dev(ddev,
++ p[406] = dsaf_read_dev(ddev,
+ DSAF_XOD_ROCEE_RCVIN0_CNT_0_REG + port * 0x90);
+- p[403] = dsaf_read_dev(ddev,
++ p[407] = dsaf_read_dev(ddev,
+ DSAF_XOD_ROCEE_RCVIN1_CNT_0_REG + port * 0x90);
+- p[404] = dsaf_read_dev(ddev,
++ p[408] = dsaf_read_dev(ddev,
+ DSAF_XOD_FIFO_STATUS_0_REG + port * 0x90);
+
+ /* dsaf voq registers */
+ for (i = 0; i < DSAF_VOQ_NUM / DSAF_COMM_CHN; i++) {
+ j = (i * DSAF_COMM_CHN + port) * 0x90;
+- p[405 + i] = dsaf_read_dev(ddev,
++ p[409 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_ECC_INVERT_EN_0_REG + j);
+- p[408 + i] = dsaf_read_dev(ddev,
++ p[412 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_SRAM_PKT_NUM_0_REG + j);
+- p[411 + i] = dsaf_read_dev(ddev, DSAF_VOQ_IN_PKT_NUM_0_REG + j);
+- p[414 + i] = dsaf_read_dev(ddev,
++ p[415 + i] = dsaf_read_dev(ddev, DSAF_VOQ_IN_PKT_NUM_0_REG + j);
++ p[418 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_OUT_PKT_NUM_0_REG + j);
+- p[417 + i] = dsaf_read_dev(ddev,
++ p[421 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_ECC_ERR_ADDR_0_REG + j);
+- p[420 + i] = dsaf_read_dev(ddev, DSAF_VOQ_BP_STATUS_0_REG + j);
+- p[423 + i] = dsaf_read_dev(ddev, DSAF_VOQ_SPUP_IDLE_0_REG + j);
+- p[426 + i] = dsaf_read_dev(ddev,
++ p[424 + i] = dsaf_read_dev(ddev, DSAF_VOQ_BP_STATUS_0_REG + j);
++ p[427 + i] = dsaf_read_dev(ddev, DSAF_VOQ_SPUP_IDLE_0_REG + j);
++ p[430 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_XGE_XOD_REQ_0_0_REG + j);
+- p[429 + i] = dsaf_read_dev(ddev,
++ p[433 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_XGE_XOD_REQ_1_0_REG + j);
+- p[432 + i] = dsaf_read_dev(ddev,
++ p[436 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_PPE_XOD_REQ_0_REG + j);
+- p[435 + i] = dsaf_read_dev(ddev,
++ p[439 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_ROCEE_XOD_REQ_0_REG + j);
+- p[438 + i] = dsaf_read_dev(ddev,
++ p[442 + i] = dsaf_read_dev(ddev,
+ DSAF_VOQ_BP_ALL_THRD_0_REG + j);
+ }
+
+ /* dsaf tbl registers */
+- p[441] = dsaf_read_dev(ddev, DSAF_TBL_CTRL_0_REG);
+- p[442] = dsaf_read_dev(ddev, DSAF_TBL_INT_MSK_0_REG);
+- p[443] = dsaf_read_dev(ddev, DSAF_TBL_INT_SRC_0_REG);
+- p[444] = dsaf_read_dev(ddev, DSAF_TBL_INT_STS_0_REG);
+- p[445] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_ADDR_0_REG);
+- p[446] = dsaf_read_dev(ddev, DSAF_TBL_LINE_ADDR_0_REG);
+- p[447] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_HIGH_0_REG);
+- p[448] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_LOW_0_REG);
+- p[449] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_4_0_REG);
+- p[450] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_3_0_REG);
+- p[451] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_2_0_REG);
+- p[452] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_1_0_REG);
+- p[453] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_0_0_REG);
+- p[454] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_UCAST_CFG_0_REG);
+- p[455] = dsaf_read_dev(ddev, DSAF_TBL_LIN_CFG_0_REG);
+- p[456] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_HIGH_0_REG);
+- p[457] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_LOW_0_REG);
+- p[458] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA4_0_REG);
+- p[459] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA3_0_REG);
+- p[460] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA2_0_REG);
+- p[461] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA1_0_REG);
+- p[462] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA0_0_REG);
+- p[463] = dsaf_read_dev(ddev, DSAF_TBL_LIN_RDATA_0_REG);
++ p[445] = dsaf_read_dev(ddev, DSAF_TBL_CTRL_0_REG);
++ p[446] = dsaf_read_dev(ddev, DSAF_TBL_INT_MSK_0_REG);
++ p[447] = dsaf_read_dev(ddev, DSAF_TBL_INT_SRC_0_REG);
++ p[448] = dsaf_read_dev(ddev, DSAF_TBL_INT_STS_0_REG);
++ p[449] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_ADDR_0_REG);
++ p[450] = dsaf_read_dev(ddev, DSAF_TBL_LINE_ADDR_0_REG);
++ p[451] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_HIGH_0_REG);
++ p[452] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_LOW_0_REG);
++ p[453] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_4_0_REG);
++ p[454] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_3_0_REG);
++ p[455] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_2_0_REG);
++ p[456] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_1_0_REG);
++ p[457] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_MCAST_CFG_0_0_REG);
++ p[458] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_UCAST_CFG_0_REG);
++ p[459] = dsaf_read_dev(ddev, DSAF_TBL_LIN_CFG_0_REG);
++ p[460] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_HIGH_0_REG);
++ p[461] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RDATA_LOW_0_REG);
++ p[462] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA4_0_REG);
++ p[463] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA3_0_REG);
++ p[464] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA2_0_REG);
++ p[465] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA1_0_REG);
++ p[466] = dsaf_read_dev(ddev, DSAF_TBL_TCAM_RAM_RDATA0_0_REG);
++ p[467] = dsaf_read_dev(ddev, DSAF_TBL_LIN_RDATA_0_REG);
+
+ for (i = 0; i < DSAF_SW_PORT_NUM; i++) {
+ j = i * 0x8;
+- p[464 + 2 * i] = dsaf_read_dev(ddev,
++ p[468 + 2 * i] = dsaf_read_dev(ddev,
+ DSAF_TBL_DA0_MIS_INFO1_0_REG + j);
+- p[465 + 2 * i] = dsaf_read_dev(ddev,
++ p[469 + 2 * i] = dsaf_read_dev(ddev,
+ DSAF_TBL_DA0_MIS_INFO0_0_REG + j);
+ }
+
+- p[480] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO2_0_REG);
+- p[481] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO1_0_REG);
+- p[482] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO0_0_REG);
+- p[483] = dsaf_read_dev(ddev, DSAF_TBL_PUL_0_REG);
+- p[484] = dsaf_read_dev(ddev, DSAF_TBL_OLD_RSLT_0_REG);
+- p[485] = dsaf_read_dev(ddev, DSAF_TBL_OLD_SCAN_VAL_0_REG);
+- p[486] = dsaf_read_dev(ddev, DSAF_TBL_DFX_CTRL_0_REG);
+- p[487] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_0_REG);
+- p[488] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_2_0_REG);
+- p[489] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_I_0_REG);
+- p[490] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_O_0_REG);
+- p[491] = dsaf_read_dev(ddev, DSAF_TBL_UCAST_BCAST_MIS_INFO_0_0_REG);
++ p[484] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO2_0_REG);
++ p[485] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO1_0_REG);
++ p[486] = dsaf_read_dev(ddev, DSAF_TBL_SA_MIS_INFO0_0_REG);
++ p[487] = dsaf_read_dev(ddev, DSAF_TBL_PUL_0_REG);
++ p[488] = dsaf_read_dev(ddev, DSAF_TBL_OLD_RSLT_0_REG);
++ p[489] = dsaf_read_dev(ddev, DSAF_TBL_OLD_SCAN_VAL_0_REG);
++ p[490] = dsaf_read_dev(ddev, DSAF_TBL_DFX_CTRL_0_REG);
++ p[491] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_0_REG);
++ p[492] = dsaf_read_dev(ddev, DSAF_TBL_DFX_STAT_2_0_REG);
++ p[493] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_I_0_REG);
++ p[494] = dsaf_read_dev(ddev, DSAF_TBL_LKUP_NUM_O_0_REG);
++ p[495] = dsaf_read_dev(ddev, DSAF_TBL_UCAST_BCAST_MIS_INFO_0_0_REG);
+
+ /* dsaf other registers */
+- p[492] = dsaf_read_dev(ddev, DSAF_INODE_FIFO_WL_0_REG + port * 0x4);
+- p[493] = dsaf_read_dev(ddev, DSAF_ONODE_FIFO_WL_0_REG + port * 0x4);
+- p[494] = dsaf_read_dev(ddev, DSAF_XGE_GE_WORK_MODE_0_REG + port * 0x4);
+- p[495] = dsaf_read_dev(ddev,
++ p[496] = dsaf_read_dev(ddev, DSAF_INODE_FIFO_WL_0_REG + port * 0x4);
++ p[497] = dsaf_read_dev(ddev, DSAF_ONODE_FIFO_WL_0_REG + port * 0x4);
++ p[498] = dsaf_read_dev(ddev, DSAF_XGE_GE_WORK_MODE_0_REG + port * 0x4);
++ p[499] = dsaf_read_dev(ddev,
+ DSAF_XGE_APP_RX_LINK_UP_0_REG + port * 0x4);
+- p[496] = dsaf_read_dev(ddev, DSAF_NETPORT_CTRL_SIG_0_REG + port * 0x4);
+- p[497] = dsaf_read_dev(ddev, DSAF_XGE_CTRL_SIG_CFG_0_REG + port * 0x4);
++ p[500] = dsaf_read_dev(ddev, DSAF_NETPORT_CTRL_SIG_0_REG + port * 0x4);
++ p[501] = dsaf_read_dev(ddev, DSAF_XGE_CTRL_SIG_CFG_0_REG + port * 0x4);
+
+ if (!is_ver1)
+- p[498] = dsaf_read_dev(ddev, DSAF_PAUSE_CFG_REG + port * 0x4);
++ p[502] = dsaf_read_dev(ddev, DSAF_PAUSE_CFG_REG + port * 0x4);
+
+ /* mark end of dsaf regs */
+- for (i = 499; i < 504; i++)
++ for (i = 503; i < 504; i++)
+ p[i] = 0xdddddddd;
+ }
+
+@@ -2673,58 +2750,156 @@ int hns_dsaf_get_regs_count(void)
+ return DSAF_DUMP_REGS_NUM;
+ }
+
+-/* Reserve the last TCAM entry for promisc support */
+-#define dsaf_promisc_tcam_entry(port) \
+- (DSAF_TCAM_SUM - DSAFV2_MAC_FUZZY_TCAM_NUM + (port))
+-void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev,
+- u32 port, bool enable)
++static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
+ {
++ struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0, 1, 0, 0, 0x80};
++ struct dsaf_tbl_tcam_data tbl_tcam_data_mc = {0x01000000, port};
++ struct dsaf_tbl_tcam_data tbl_tcam_mask_uc = {0x01000000, 0xf};
++ struct dsaf_tbl_tcam_mcast_cfg tbl_tcam_mcast = {0, 0, {0} };
+ struct dsaf_drv_priv *priv = hns_dsaf_dev_priv(dsaf_dev);
+- struct dsaf_drv_soft_mac_tbl *soft_mac_entry = priv->soft_mac_tbl;
+- u16 entry_index;
+- struct dsaf_drv_tbl_tcam_key tbl_tcam_data, tbl_tcam_mask;
+- struct dsaf_tbl_tcam_mcast_cfg mac_data = {0};
++ struct dsaf_tbl_tcam_data tbl_tcam_data_uc = {0, port};
++ struct dsaf_drv_mac_single_dest_entry mask_entry;
++ struct dsaf_drv_tbl_tcam_key temp_key, mask_key;
++ struct dsaf_drv_soft_mac_tbl *soft_mac_entry;
++ u16 entry_index = DSAF_INVALID_ENTRY_IDX;
++ struct dsaf_drv_tbl_tcam_key mac_key;
++ struct hns_mac_cb *mac_cb;
++ u8 addr[ETH_ALEN] = {0};
++ u8 port_num;
++ u16 mskid;
++
++ /* promisc use vague table match with vlanid = 0 & macaddr = 0 */
++ hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr);
++ entry_index = hns_dsaf_find_soft_mac_entry(dsaf_dev, &mac_key);
++ if (entry_index != DSAF_INVALID_ENTRY_IDX)
++ return;
++
++ /* put promisc tcam entry in the end. */
++ /* 1. set promisc unicast vague tcam entry. */
++ entry_index = hns_dsaf_find_empty_mac_entry_reverse(dsaf_dev);
++ if (entry_index == DSAF_INVALID_ENTRY_IDX) {
++ dev_err(dsaf_dev->dev,
++ "enable uc promisc failed (port:%#x)\n",
++ port);
++ return;
++ }
++
++ mac_cb = dsaf_dev->mac_cb[port];
++ (void)hns_mac_get_inner_port_num(mac_cb, 0, &port_num);
++ tbl_tcam_ucast.tbl_ucast_out_port = port_num;
+
+- if ((AE_IS_VER1(dsaf_dev->dsaf_ver)) || HNS_DSAF_IS_DEBUG(dsaf_dev))
++ /* config uc vague table */
++ hns_dsaf_tcam_uc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_uc,
++ &tbl_tcam_mask_uc, &tbl_tcam_ucast);
++
++ /* update software entry */
++ soft_mac_entry = priv->soft_mac_tbl;
++ soft_mac_entry += entry_index;
++ soft_mac_entry->index = entry_index;
++ soft_mac_entry->tcam_key.high.val = mac_key.high.val;
++ soft_mac_entry->tcam_key.low.val = mac_key.low.val;
++ /* step back to the START for mc. */
++ soft_mac_entry = priv->soft_mac_tbl;
++
++ /* 2. set promisc multicast vague tcam entry. */
++ entry_index = hns_dsaf_find_empty_mac_entry_reverse(dsaf_dev);
++ if (entry_index == DSAF_INVALID_ENTRY_IDX) {
++ dev_err(dsaf_dev->dev,
++ "enable mc promisc failed (port:%#x)\n",
++ port);
+ return;
++ }
++
++ memset(&mask_entry, 0x0, sizeof(mask_entry));
++ memset(&mask_key, 0x0, sizeof(mask_key));
++ memset(&temp_key, 0x0, sizeof(temp_key));
++ mask_entry.addr[0] = 0x01;
++ hns_dsaf_set_mac_key(dsaf_dev, &mask_key, mask_entry.in_vlan_id,
++ port, mask_entry.addr);
++ tbl_tcam_mcast.tbl_mcast_item_vld = 1;
++ tbl_tcam_mcast.tbl_mcast_old_en = 0;
+
+- /* find the tcam entry index for promisc */
+- entry_index = dsaf_promisc_tcam_entry(port);
+-
+- memset(&tbl_tcam_data, 0, sizeof(tbl_tcam_data));
+- memset(&tbl_tcam_mask, 0, sizeof(tbl_tcam_mask));
+-
+- /* config key mask */
+- if (enable) {
+- dsaf_set_field(tbl_tcam_data.low.bits.port_vlan,
+- DSAF_TBL_TCAM_KEY_PORT_M,
+- DSAF_TBL_TCAM_KEY_PORT_S, port);
+- dsaf_set_field(tbl_tcam_mask.low.bits.port_vlan,
+- DSAF_TBL_TCAM_KEY_PORT_M,
+- DSAF_TBL_TCAM_KEY_PORT_S, 0xf);
+-
+- /* SUB_QID */
+- dsaf_set_bit(mac_data.tbl_mcast_port_msk[0],
+- DSAF_SERVICE_NW_NUM, true);
+- mac_data.tbl_mcast_item_vld = true; /* item_vld bit */
++ if (port < DSAF_SERVICE_NW_NUM) {
++ mskid = port;
++ } else if (port >= DSAF_BASE_INNER_PORT_NUM) {
++ mskid = port - DSAF_BASE_INNER_PORT_NUM + DSAF_SERVICE_NW_NUM;
+ } else {
+- mac_data.tbl_mcast_item_vld = false; /* item_vld bit */
++ dev_err(dsaf_dev->dev, "%s,pnum(%d)error,key(%#x:%#x)\n",
++ dsaf_dev->ae_dev.name, port,
++ mask_key.high.val, mask_key.low.val);
++ return;
+ }
+
+- dev_dbg(dsaf_dev->dev,
+- "set_promisc_entry, %s Mac key(%#x:%#x) entry_index%d\n",
+- dsaf_dev->ae_dev.name, tbl_tcam_data.high.val,
+- tbl_tcam_data.low.val, entry_index);
++ dsaf_set_bit(tbl_tcam_mcast.tbl_mcast_port_msk[mskid / 32],
++ mskid % 32, 1);
++ memcpy(&temp_key, &mask_key, sizeof(mask_key));
++ hns_dsaf_tcam_mc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_mc,
++ (struct dsaf_tbl_tcam_data *)(&mask_key),
++ &tbl_tcam_mcast);
++
++ /* update software entry */
++ soft_mac_entry += entry_index;
++ soft_mac_entry->index = entry_index;
++ soft_mac_entry->tcam_key.high.val = temp_key.high.val;
++ soft_mac_entry->tcam_key.low.val = temp_key.low.val;
++}
+
+- /* config promisc entry with mask */
+- hns_dsaf_tcam_mc_cfg(dsaf_dev, entry_index,
+- (struct dsaf_tbl_tcam_data *)&tbl_tcam_data,
+- (struct dsaf_tbl_tcam_data *)&tbl_tcam_mask,
+- &mac_data);
++static void set_promisc_tcam_disable(struct dsaf_device *dsaf_dev, u32 port)
++{
++ struct dsaf_tbl_tcam_data tbl_tcam_data_mc = {0x01000000, port};
++ struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0, 0, 0, 0, 0};
++ struct dsaf_tbl_tcam_mcast_cfg tbl_tcam_mcast = {0, 0, {0} };
++ struct dsaf_drv_priv *priv = hns_dsaf_dev_priv(dsaf_dev);
++ struct dsaf_tbl_tcam_data tbl_tcam_data_uc = {0, 0};
++ struct dsaf_tbl_tcam_data tbl_tcam_mask = {0, 0};
++ struct dsaf_drv_soft_mac_tbl *soft_mac_entry;
++ u16 entry_index = DSAF_INVALID_ENTRY_IDX;
++ struct dsaf_drv_tbl_tcam_key mac_key;
++ u8 addr[ETH_ALEN] = {0};
+
+- /* config software entry */
++ /* 1. delete uc vague tcam entry. */
++ /* promisc use vague table match with vlanid = 0 & macaddr = 0 */
++ hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr);
++ entry_index = hns_dsaf_find_soft_mac_entry(dsaf_dev, &mac_key);
++
++ if (entry_index == DSAF_INVALID_ENTRY_IDX)
++ return;
++
++ /* config uc vague table */
++ hns_dsaf_tcam_uc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_uc,
++ &tbl_tcam_mask, &tbl_tcam_ucast);
++ /* update soft management table. */
++ soft_mac_entry = priv->soft_mac_tbl;
++ soft_mac_entry += entry_index;
++ soft_mac_entry->index = DSAF_INVALID_ENTRY_IDX;
++ /* step back to the START for mc. */
++ soft_mac_entry = priv->soft_mac_tbl;
++
++ /* 2. delete mc vague tcam entry. */
++ addr[0] = 0x01;
++ memset(&mac_key, 0x0, sizeof(mac_key));
++ hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr);
++ entry_index = hns_dsaf_find_soft_mac_entry(dsaf_dev, &mac_key);
++
++ if (entry_index == DSAF_INVALID_ENTRY_IDX)
++ return;
++
++ /* config mc vague table */
++ hns_dsaf_tcam_mc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_mc,
++ &tbl_tcam_mask, &tbl_tcam_mcast);
++ /* update soft management table. */
+ soft_mac_entry += entry_index;
+- soft_mac_entry->index = enable ? entry_index : DSAF_INVALID_ENTRY_IDX;
++ soft_mac_entry->index = DSAF_INVALID_ENTRY_IDX;
++}
++
++/* Reserve the last TCAM entry for promisc support */
++void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev,
++ u32 port, bool enable)
++{
++ if (enable)
++ set_promisc_tcam_enable(dsaf_dev, port);
++ else
++ set_promisc_tcam_disable(dsaf_dev, port);
+ }
+
+ int hns_dsaf_wait_pkt_clean(struct dsaf_device *dsaf_dev, int port)
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+index 74d935d82cbc..b9733b0b8482 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+@@ -176,7 +176,7 @@
+ #define DSAF_INODE_IN_DATA_STP_DISC_0_REG 0x1A50
+ #define DSAF_INODE_GE_FC_EN_0_REG 0x1B00
+ #define DSAF_INODE_VC0_IN_PKT_NUM_0_REG 0x1B50
+-#define DSAF_INODE_VC1_IN_PKT_NUM_0_REG 0x1C00
++#define DSAF_INODE_VC1_IN_PKT_NUM_0_REG 0x103C
+ #define DSAF_INODE_IN_PRIO_PAUSE_BASE_REG 0x1C00
+ #define DSAF_INODE_IN_PRIO_PAUSE_BASE_OFFSET 0x100
+ #define DSAF_INODE_IN_PRIO_PAUSE_OFFSET 0x50
+@@ -404,11 +404,11 @@
+ #define RCB_ECC_ERR_ADDR4_REG 0x460
+ #define RCB_ECC_ERR_ADDR5_REG 0x464
+
+-#define RCB_COM_SF_CFG_INTMASK_RING 0x480
+-#define RCB_COM_SF_CFG_RING_STS 0x484
+-#define RCB_COM_SF_CFG_RING 0x488
+-#define RCB_COM_SF_CFG_INTMASK_BD 0x48C
+-#define RCB_COM_SF_CFG_BD_RINT_STS 0x470
++#define RCB_COM_SF_CFG_INTMASK_RING 0x470
++#define RCB_COM_SF_CFG_RING_STS 0x474
++#define RCB_COM_SF_CFG_RING 0x478
++#define RCB_COM_SF_CFG_INTMASK_BD 0x47C
++#define RCB_COM_SF_CFG_BD_RINT_STS 0x480
+ #define RCB_COM_RCB_RD_BD_BUSY 0x490
+ #define RCB_COM_RCB_FBD_CRT_EN 0x494
+ #define RCB_COM_AXI_WR_ERR_INTMASK 0x498
+@@ -534,6 +534,7 @@
+ #define GMAC_LD_LINK_COUNTER_REG 0x01D0UL
+ #define GMAC_LOOP_REG 0x01DCUL
+ #define GMAC_RECV_CONTROL_REG 0x01E0UL
++#define GMAC_PCS_RX_EN_REG 0x01E4UL
+ #define GMAC_VLAN_CODE_REG 0x01E8UL
+ #define GMAC_RX_OVERRUN_CNT_REG 0x01ECUL
+ #define GMAC_RX_LENGTHFIELD_ERR_CNT_REG 0x01F4UL
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 28e907831b0e..6242249c9f4c 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1186,6 +1186,9 @@ int hns_nic_init_phy(struct net_device *ndev, struct hnae_handle *h)
+ if (h->phy_if == PHY_INTERFACE_MODE_XGMII)
+ phy_dev->autoneg = false;
+
++ if (h->phy_if == PHY_INTERFACE_MODE_SGMII)
++ phy_stop(phy_dev);
++
+ return 0;
+ }
+
+@@ -1281,6 +1284,22 @@ static int hns_nic_init_affinity_mask(int q_num, int ring_idx,
+ return cpu;
+ }
+
++static void hns_nic_free_irq(int q_num, struct hns_nic_priv *priv)
++{
++ int i;
++
++ for (i = 0; i < q_num * 2; i++) {
++ if (priv->ring_data[i].ring->irq_init_flag == RCB_IRQ_INITED) {
++ irq_set_affinity_hint(priv->ring_data[i].ring->irq,
++ NULL);
++ free_irq(priv->ring_data[i].ring->irq,
++ &priv->ring_data[i]);
++ priv->ring_data[i].ring->irq_init_flag =
++ RCB_IRQ_NOT_INITED;
++ }
++ }
++}
++
+ static int hns_nic_init_irq(struct hns_nic_priv *priv)
+ {
+ struct hnae_handle *h = priv->ae_handle;
+@@ -1306,7 +1325,7 @@ static int hns_nic_init_irq(struct hns_nic_priv *priv)
+ if (ret) {
+ netdev_err(priv->netdev, "request irq(%d) fail\n",
+ rd->ring->irq);
+- return ret;
++ goto out_free_irq;
+ }
+ disable_irq(rd->ring->irq);
+
+@@ -1321,6 +1340,10 @@ static int hns_nic_init_irq(struct hns_nic_priv *priv)
+ }
+
+ return 0;
++
++out_free_irq:
++ hns_nic_free_irq(h->q_num, priv);
++ return ret;
+ }
+
+ static int hns_nic_net_up(struct net_device *ndev)
+@@ -1330,6 +1353,9 @@ static int hns_nic_net_up(struct net_device *ndev)
+ int i, j;
+ int ret;
+
++ if (!test_bit(NIC_STATE_DOWN, &priv->state))
++ return 0;
++
+ ret = hns_nic_init_irq(priv);
+ if (ret != 0) {
+ netdev_err(ndev, "hns init irq failed! ret=%d\n", ret);
+@@ -1365,6 +1391,7 @@ out_has_some_queues:
+ for (j = i - 1; j >= 0; j--)
+ hns_nic_ring_close(ndev, j);
+
++ hns_nic_free_irq(h->q_num, priv);
+ set_bit(NIC_STATE_DOWN, &priv->state);
+
+ return ret;
+@@ -1482,11 +1509,19 @@ static int hns_nic_net_stop(struct net_device *ndev)
+ }
+
+ static void hns_tx_timeout_reset(struct hns_nic_priv *priv);
++#define HNS_TX_TIMEO_LIMIT (40 * HZ)
+ static void hns_nic_net_timeout(struct net_device *ndev)
+ {
+ struct hns_nic_priv *priv = netdev_priv(ndev);
+
+- hns_tx_timeout_reset(priv);
++ if (ndev->watchdog_timeo < HNS_TX_TIMEO_LIMIT) {
++ ndev->watchdog_timeo *= 2;
++ netdev_info(ndev, "watchdog_timo changed to %d.\n",
++ ndev->watchdog_timeo);
++ } else {
++ ndev->watchdog_timeo = HNS_NIC_TX_TIMEOUT;
++ hns_tx_timeout_reset(priv);
++ }
+ }
+
+ static int hns_nic_do_ioctl(struct net_device *netdev, struct ifreq *ifr,
+@@ -2049,11 +2084,11 @@ static void hns_nic_service_task(struct work_struct *work)
+ = container_of(work, struct hns_nic_priv, service_task);
+ struct hnae_handle *h = priv->ae_handle;
+
++ hns_nic_reset_subtask(priv);
+ hns_nic_update_link_status(priv->netdev);
+ h->dev->ops->update_led_status(h);
+ hns_nic_update_stats(priv->netdev);
+
+- hns_nic_reset_subtask(priv);
+ hns_nic_service_event_complete(priv);
+ }
+
+@@ -2339,7 +2374,7 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
+ ndev->min_mtu = MAC_MIN_MTU;
+ switch (priv->enet_ver) {
+ case AE_VERSION_2:
+- ndev->features |= NETIF_F_TSO | NETIF_F_TSO6;
++ ndev->features |= NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_NTUPLE;
+ ndev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+ NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_GSO |
+ NETIF_F_GRO | NETIF_F_TSO | NETIF_F_TSO6;
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 5ab21a1b5444..c8704b1690eb 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1939,8 +1939,9 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
+ static struct ibmvnic_rwi *get_next_rwi(struct ibmvnic_adapter *adapter)
+ {
+ struct ibmvnic_rwi *rwi;
++ unsigned long flags;
+
+- mutex_lock(&adapter->rwi_lock);
++ spin_lock_irqsave(&adapter->rwi_lock, flags);
+
+ if (!list_empty(&adapter->rwi_list)) {
+ rwi = list_first_entry(&adapter->rwi_list, struct ibmvnic_rwi,
+@@ -1950,7 +1951,7 @@ static struct ibmvnic_rwi *get_next_rwi(struct ibmvnic_adapter *adapter)
+ rwi = NULL;
+ }
+
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ return rwi;
+ }
+
+@@ -2025,6 +2026,7 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ struct list_head *entry, *tmp_entry;
+ struct ibmvnic_rwi *rwi, *tmp;
+ struct net_device *netdev = adapter->netdev;
++ unsigned long flags;
+ int ret;
+
+ if (adapter->state == VNIC_REMOVING ||
+@@ -2041,21 +2043,21 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ goto err;
+ }
+
+- mutex_lock(&adapter->rwi_lock);
++ spin_lock_irqsave(&adapter->rwi_lock, flags);
+
+ list_for_each(entry, &adapter->rwi_list) {
+ tmp = list_entry(entry, struct ibmvnic_rwi, list);
+ if (tmp->reset_reason == reason) {
+ netdev_dbg(netdev, "Skipping matching reset\n");
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ ret = EBUSY;
+ goto err;
+ }
+ }
+
+- rwi = kzalloc(sizeof(*rwi), GFP_KERNEL);
++ rwi = kzalloc(sizeof(*rwi), GFP_ATOMIC);
+ if (!rwi) {
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ ibmvnic_close(netdev);
+ ret = ENOMEM;
+ goto err;
+@@ -2069,7 +2071,7 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ }
+ rwi->reset_reason = reason;
+ list_add_tail(&rwi->list, &adapter->rwi_list);
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ adapter->resetting = true;
+ netdev_dbg(adapter->netdev, "Scheduling reset (reason %d)\n", reason);
+ schedule_work(&adapter->ibmvnic_reset);
+@@ -4700,7 +4702,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
+
+ INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
+ INIT_LIST_HEAD(&adapter->rwi_list);
+- mutex_init(&adapter->rwi_lock);
++ spin_lock_init(&adapter->rwi_lock);
+ adapter->resetting = false;
+
+ adapter->mac_change_pending = false;
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index 735f481b1870..09465397b7ff 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -1068,7 +1068,7 @@ struct ibmvnic_adapter {
+ struct tasklet_struct tasklet;
+ enum vnic_state state;
+ enum ibmvnic_reset_reason reset_reason;
+- struct mutex rwi_lock;
++ spinlock_t rwi_lock;
+ struct list_head rwi_list;
+ struct work_struct ibmvnic_reset;
+ bool resetting;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 3c342700bf5f..ed9d3fc4aaba 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -1539,17 +1539,17 @@ static int i40e_set_mac(struct net_device *netdev, void *p)
+ netdev_info(netdev, "set new mac address %pM\n", addr->sa_data);
+
+ /* Copy the address first, so that we avoid a possible race with
+- * .set_rx_mode(). If we copy after changing the address in the filter
+- * list, we might open ourselves to a narrow race window where
+- * .set_rx_mode could delete our dev_addr filter and prevent traffic
+- * from passing.
++ * .set_rx_mode().
++ * - Remove old address from MAC filter
++ * - Copy new address
++ * - Add new address to MAC filter
+ */
+- ether_addr_copy(netdev->dev_addr, addr->sa_data);
+-
+ spin_lock_bh(&vsi->mac_filter_hash_lock);
+ i40e_del_mac_filter(vsi, netdev->dev_addr);
+- i40e_add_mac_filter(vsi, addr->sa_data);
++ ether_addr_copy(netdev->dev_addr, addr->sa_data);
++ i40e_add_mac_filter(vsi, netdev->dev_addr);
+ spin_unlock_bh(&vsi->mac_filter_hash_lock);
++
+ if (vsi->type == I40E_VSI_MAIN) {
+ i40e_status ret;
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+index eea63a99f29c..f6ffd9fb2079 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+@@ -699,7 +699,6 @@ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
+ u8 num_tcs = adapter->hw_tcs;
+ u32 reg_val;
+ u32 queue;
+- u32 word;
+
+ /* remove VLAN filters beloning to this VF */
+ ixgbe_clear_vf_vlans(adapter, vf);
+@@ -754,6 +753,14 @@ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
+ }
+ }
+
++ IXGBE_WRITE_FLUSH(hw);
++}
++
++static void ixgbe_vf_clear_mbx(struct ixgbe_adapter *adapter, u32 vf)
++{
++ struct ixgbe_hw *hw = &adapter->hw;
++ u32 word;
++
+ /* Clear VF's mailbox memory */
+ for (word = 0; word < IXGBE_VFMAILBOX_SIZE; word++)
+ IXGBE_WRITE_REG_ARRAY(hw, IXGBE_PFMBMEM(vf), word, 0);
+@@ -827,6 +834,8 @@ static int ixgbe_vf_reset_msg(struct ixgbe_adapter *adapter, u32 vf)
+ /* reset the filters for the device */
+ ixgbe_vf_reset_event(adapter, vf);
+
++ ixgbe_vf_clear_mbx(adapter, vf);
++
+ /* set vf mac address */
+ if (!is_zero_ether_addr(vf_mac))
+ ixgbe_set_vf_mac(adapter, vf, vf_mac);
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index aaedf1072460..1393252c6e3c 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -802,14 +802,8 @@ static int lan743x_mac_init(struct lan743x_adapter *adapter)
+ u32 mac_addr_hi = 0;
+ u32 mac_addr_lo = 0;
+ u32 data;
+- int ret;
+
+ netdev = adapter->netdev;
+- lan743x_csr_write(adapter, MAC_CR, MAC_CR_RST_);
+- ret = lan743x_csr_wait_for_bit(adapter, MAC_CR, MAC_CR_RST_,
+- 0, 1000, 20000, 100);
+- if (ret)
+- return ret;
+
+ /* setup auto duplex, and speed detection */
+ data = lan743x_csr_read(adapter, MAC_CR);
+@@ -2722,8 +2716,9 @@ static int lan743x_mdiobus_init(struct lan743x_adapter *adapter)
+ snprintf(adapter->mdiobus->id, MII_BUS_ID_SIZE,
+ "pci-%s", pci_name(adapter->pdev));
+
+- /* set to internal PHY id */
+- adapter->mdiobus->phy_mask = ~(u32)BIT(1);
++ if ((adapter->csr.id_rev & ID_REV_ID_MASK_) == ID_REV_ID_LAN7430_)
++ /* LAN7430 uses internal phy at address 1 */
++ adapter->mdiobus->phy_mask = ~(u32)BIT(1);
+
+ /* register mdiobus */
+ ret = mdiobus_register(adapter->mdiobus);
+diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+index 398011c87643..bf4302e45dcd 100644
+--- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
++++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+@@ -807,7 +807,7 @@ __vxge_hw_vpath_fw_ver_get(struct __vxge_hw_virtualpath *vpath,
+ struct vxge_hw_device_date *fw_date = &hw_info->fw_date;
+ struct vxge_hw_device_version *flash_version = &hw_info->flash_version;
+ struct vxge_hw_device_date *flash_date = &hw_info->flash_date;
+- u64 data0, data1 = 0, steer_ctrl = 0;
++ u64 data0 = 0, data1 = 0, steer_ctrl = 0;
+ enum vxge_hw_status status;
+
+ status = vxge_hw_vpath_fw_api(vpath,
+diff --git a/drivers/net/ethernet/nuvoton/w90p910_ether.c b/drivers/net/ethernet/nuvoton/w90p910_ether.c
+index 052b3d2c07a1..c662c6f5bee3 100644
+--- a/drivers/net/ethernet/nuvoton/w90p910_ether.c
++++ b/drivers/net/ethernet/nuvoton/w90p910_ether.c
+@@ -912,7 +912,7 @@ static const struct net_device_ops w90p910_ether_netdev_ops = {
+ .ndo_validate_addr = eth_validate_addr,
+ };
+
+-static void __init get_mac_address(struct net_device *dev)
++static void get_mac_address(struct net_device *dev)
+ {
+ struct w90p910_ether *ether = netdev_priv(dev);
+ struct platform_device *pdev;
+diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+index 0ea141ece19e..6547a9dd5935 100644
+--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+@@ -1125,7 +1125,8 @@ netxen_validate_firmware(struct netxen_adapter *adapter)
+ return -EINVAL;
+ }
+ val = nx_get_bios_version(adapter);
+- netxen_rom_fast_read(adapter, NX_BIOS_VERSION_OFFSET, (int *)&bios);
++ if (netxen_rom_fast_read(adapter, NX_BIOS_VERSION_OFFSET, (int *)&bios))
++ return -EIO;
+ if ((__force u32)val != bios) {
+ dev_err(&pdev->dev, "%s: firmware bios is incompatible\n",
+ fw_name[fw_type]);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index 14ac9cab2653..2fa1c050a14b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -2485,6 +2485,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
+ if (unlikely(dma_mapping_error(&cdev->pdev->dev, mapping))) {
+ DP_NOTICE(cdev,
+ "Unable to map frag - dropping packet\n");
++ rc = -ENOMEM;
+ goto err;
+ }
+
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index 0ff5a403a8dc..b2ff903a9cb6 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -721,7 +721,7 @@ static void ca8210_mlme_reset_worker(struct work_struct *work)
+ static void ca8210_rx_done(struct cas_control *cas_ctl)
+ {
+ u8 *buf;
+- u8 len;
++ unsigned int len;
+ struct work_priv_container *mlme_reset_wpc;
+ struct ca8210_priv *priv = cas_ctl->priv;
+
+@@ -730,7 +730,7 @@ static void ca8210_rx_done(struct cas_control *cas_ctl)
+ if (len > CA8210_SPI_BUF_SIZE) {
+ dev_crit(
+ &priv->spi->dev,
+- "Received packet len (%d) erroneously long\n",
++ "Received packet len (%u) erroneously long\n",
+ len
+ );
+ goto finish;
+diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
+index bf70ab892e69..624bff4d3636 100644
+--- a/drivers/net/ieee802154/mac802154_hwsim.c
++++ b/drivers/net/ieee802154/mac802154_hwsim.c
+@@ -500,7 +500,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info)
+ !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE])
+ return -EINVAL;
+
+- if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX + 1,
++ if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX,
+ info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE],
+ hwsim_edge_policy, NULL))
+ return -EINVAL;
+@@ -550,7 +550,7 @@ static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info)
+ !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE])
+ return -EINVAL;
+
+- if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX + 1,
++ if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX,
+ info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE],
+ hwsim_edge_policy, NULL))
+ return -EINVAL;
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index c3c9ba44e2a1..8d140495da79 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2335,6 +2335,10 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p)
+ ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
+ ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
+
++ /* Added to support MAC address changes */
++ ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
++ ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index f5bac5075386..774e1ff01c9a 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -151,17 +151,18 @@ static bool qmimux_has_slaves(struct usbnet *dev)
+
+ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ {
+- unsigned int len, offset = sizeof(struct qmimux_hdr);
++ unsigned int len, offset = 0;
+ struct qmimux_hdr *hdr;
+ struct net_device *net;
+ struct sk_buff *skbn;
++ u8 qmimux_hdr_sz = sizeof(*hdr);
+
+- while (offset < skb->len) {
+- hdr = (struct qmimux_hdr *)skb->data;
++ while (offset + qmimux_hdr_sz < skb->len) {
++ hdr = (struct qmimux_hdr *)(skb->data + offset);
+ len = be16_to_cpu(hdr->pkt_len);
+
+ /* drop the packet, bogus length */
+- if (offset + len > skb->len)
++ if (offset + len + qmimux_hdr_sz > skb->len)
+ return 0;
+
+ /* control packet, we do not know what to do */
+@@ -176,7 +177,7 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ return 0;
+ skbn->dev = net;
+
+- switch (skb->data[offset] & 0xf0) {
++ switch (skb->data[offset + qmimux_hdr_sz] & 0xf0) {
+ case 0x40:
+ skbn->protocol = htons(ETH_P_IP);
+ break;
+@@ -188,12 +189,12 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ goto skip;
+ }
+
+- skb_put_data(skbn, skb->data + offset, len);
++ skb_put_data(skbn, skb->data + offset + qmimux_hdr_sz, len);
+ if (netif_rx(skbn) != NET_RX_SUCCESS)
+ return 0;
+
+ skip:
+- offset += len + sizeof(struct qmimux_hdr);
++ offset += len + qmimux_hdr_sz;
+ }
+ return 1;
+ }
+diff --git a/drivers/net/wireless/broadcom/b43/phy_common.c b/drivers/net/wireless/broadcom/b43/phy_common.c
+index 85f2ca989565..ef3ffa5ad466 100644
+--- a/drivers/net/wireless/broadcom/b43/phy_common.c
++++ b/drivers/net/wireless/broadcom/b43/phy_common.c
+@@ -616,7 +616,7 @@ struct b43_c32 b43_cordic(int theta)
+ u8 i;
+ s32 tmp;
+ s8 signx = 1;
+- u32 angle = 0;
++ s32 angle = 0;
+ struct b43_c32 ret = { .i = 39797, .q = 0, };
+
+ while (theta > (180 << 16))
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/init.c b/drivers/net/wireless/mediatek/mt76/mt76x0/init.c
+index 7cdb3e740522..0a3e046d78db 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/init.c
+@@ -681,6 +681,7 @@ int mt76x0_register_device(struct mt76x0_dev *dev)
+ ieee80211_hw_set(hw, SUPPORTS_HT_CCK_RATES);
+ ieee80211_hw_set(hw, AMPDU_AGGREGATION);
+ ieee80211_hw_set(hw, SUPPORTS_RC_TABLE);
++ ieee80211_hw_set(hw, MFP_CAPABLE);
+ hw->max_rates = 1;
+ hw->max_report_rates = 7;
+ hw->max_rate_tries = 1;
+diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
+index af48d43bb7dc..20447fdce4c3 100644
+--- a/drivers/net/wireless/mediatek/mt76/tx.c
++++ b/drivers/net/wireless/mediatek/mt76/tx.c
+@@ -385,7 +385,12 @@ void mt76_stop_tx_queues(struct mt76_dev *dev, struct ieee80211_sta *sta,
+
+ for (i = 0; i < ARRAY_SIZE(sta->txq); i++) {
+ struct ieee80211_txq *txq = sta->txq[i];
+- struct mt76_txq *mtxq = (struct mt76_txq *) txq->drv_priv;
++ struct mt76_txq *mtxq;
++
++ if (!txq)
++ continue;
++
++ mtxq = (struct mt76_txq *)txq->drv_priv;
+
+ spin_lock_bh(&mtxq->hwq->lock);
+ mtxq->send_bar = mtxq->aggr && send_bar;
+diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
+index 2082ae01b9c8..1d432c5ed275 100644
+--- a/drivers/nvdimm/pmem.c
++++ b/drivers/nvdimm/pmem.c
+@@ -309,8 +309,11 @@ static void pmem_release_queue(void *q)
+ blk_cleanup_queue(q);
+ }
+
+-static void pmem_freeze_queue(void *q)
++static void pmem_freeze_queue(struct percpu_ref *ref)
+ {
++ struct request_queue *q;
++
++ q = container_of(ref, typeof(*q), q_usage_counter);
+ blk_freeze_queue_start(q);
+ }
+
+@@ -402,6 +405,7 @@ static int pmem_attach_disk(struct device *dev,
+
+ pmem->pfn_flags = PFN_DEV;
+ pmem->pgmap.ref = &q->q_usage_counter;
++ pmem->pgmap.kill = pmem_freeze_queue;
+ if (is_nd_pfn(dev)) {
+ if (setup_pagemap_fsdax(dev, &pmem->pgmap))
+ return -ENOMEM;
+@@ -427,13 +431,6 @@ static int pmem_attach_disk(struct device *dev,
+ memcpy(&bb_res, &nsio->res, sizeof(bb_res));
+ }
+
+- /*
+- * At release time the queue must be frozen before
+- * devm_memremap_pages is unwound
+- */
+- if (devm_add_action_or_reset(dev, pmem_freeze_queue, q))
+- return -ENOMEM;
+-
+ if (IS_ERR(addr))
+ return PTR_ERR(addr);
+ pmem->virt_addr = addr;
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 70f5fd08891b..3f21ea6a90dc 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -115,9 +115,6 @@ int __weak of_node_to_nid(struct device_node *np)
+ }
+ #endif
+
+-static struct device_node **phandle_cache;
+-static u32 phandle_cache_mask;
+-
+ /*
+ * Assumptions behind phandle_cache implementation:
+ * - phandle property values are in a contiguous range of 1..n
+@@ -126,6 +123,66 @@ static u32 phandle_cache_mask;
+ * - the phandle lookup overhead reduction provided by the cache
+ * will likely be less
+ */
++
++static struct device_node **phandle_cache;
++static u32 phandle_cache_mask;
++
++/*
++ * Caller must hold devtree_lock.
++ */
++static void __of_free_phandle_cache(void)
++{
++ u32 cache_entries = phandle_cache_mask + 1;
++ u32 k;
++
++ if (!phandle_cache)
++ return;
++
++ for (k = 0; k < cache_entries; k++)
++ of_node_put(phandle_cache[k]);
++
++ kfree(phandle_cache);
++ phandle_cache = NULL;
++}
++
++int of_free_phandle_cache(void)
++{
++ unsigned long flags;
++
++ raw_spin_lock_irqsave(&devtree_lock, flags);
++
++ __of_free_phandle_cache();
++
++ raw_spin_unlock_irqrestore(&devtree_lock, flags);
++
++ return 0;
++}
++#if !defined(CONFIG_MODULES)
++late_initcall_sync(of_free_phandle_cache);
++#endif
++
++/*
++ * Caller must hold devtree_lock.
++ */
++void __of_free_phandle_cache_entry(phandle handle)
++{
++ phandle masked_handle;
++ struct device_node *np;
++
++ if (!handle)
++ return;
++
++ masked_handle = handle & phandle_cache_mask;
++
++ if (phandle_cache) {
++ np = phandle_cache[masked_handle];
++ if (np && handle == np->phandle) {
++ of_node_put(np);
++ phandle_cache[masked_handle] = NULL;
++ }
++ }
++}
++
+ void of_populate_phandle_cache(void)
+ {
+ unsigned long flags;
+@@ -135,8 +192,7 @@ void of_populate_phandle_cache(void)
+
+ raw_spin_lock_irqsave(&devtree_lock, flags);
+
+- kfree(phandle_cache);
+- phandle_cache = NULL;
++ __of_free_phandle_cache();
+
+ for_each_of_allnodes(np)
+ if (np->phandle && np->phandle != OF_PHANDLE_ILLEGAL)
+@@ -154,30 +210,15 @@ void of_populate_phandle_cache(void)
+ goto out;
+
+ for_each_of_allnodes(np)
+- if (np->phandle && np->phandle != OF_PHANDLE_ILLEGAL)
++ if (np->phandle && np->phandle != OF_PHANDLE_ILLEGAL) {
++ of_node_get(np);
+ phandle_cache[np->phandle & phandle_cache_mask] = np;
++ }
+
+ out:
+ raw_spin_unlock_irqrestore(&devtree_lock, flags);
+ }
+
+-int of_free_phandle_cache(void)
+-{
+- unsigned long flags;
+-
+- raw_spin_lock_irqsave(&devtree_lock, flags);
+-
+- kfree(phandle_cache);
+- phandle_cache = NULL;
+-
+- raw_spin_unlock_irqrestore(&devtree_lock, flags);
+-
+- return 0;
+-}
+-#if !defined(CONFIG_MODULES)
+-late_initcall_sync(of_free_phandle_cache);
+-#endif
+-
+ void __init of_core_init(void)
+ {
+ struct device_node *np;
+@@ -1150,13 +1191,23 @@ struct device_node *of_find_node_by_phandle(phandle handle)
+ if (phandle_cache[masked_handle] &&
+ handle == phandle_cache[masked_handle]->phandle)
+ np = phandle_cache[masked_handle];
++ if (np && of_node_check_flag(np, OF_DETACHED)) {
++ WARN_ON(1); /* did not uncache np on node removal */
++ of_node_put(np);
++ phandle_cache[masked_handle] = NULL;
++ np = NULL;
++ }
+ }
+
+ if (!np) {
+ for_each_of_allnodes(np)
+- if (np->phandle == handle) {
+- if (phandle_cache)
++ if (np->phandle == handle &&
++ !of_node_check_flag(np, OF_DETACHED)) {
++ if (phandle_cache) {
++ /* will put when removed from cache */
++ of_node_get(np);
+ phandle_cache[masked_handle] = np;
++ }
+ break;
+ }
+ }
+diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
+index f4f8ed9b5454..ecea92f68c87 100644
+--- a/drivers/of/dynamic.c
++++ b/drivers/of/dynamic.c
+@@ -268,6 +268,9 @@ void __of_detach_node(struct device_node *np)
+ }
+
+ of_node_set_flag(np, OF_DETACHED);
++
++ /* race with of_find_node_by_phandle() prevented by devtree_lock */
++ __of_free_phandle_cache_entry(np->phandle);
+ }
+
+ /**
+diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h
+index 216175d11d3d..f5da842841e5 100644
+--- a/drivers/of/of_private.h
++++ b/drivers/of/of_private.h
+@@ -76,6 +76,10 @@ static inline void __of_detach_node_sysfs(struct device_node *np) {}
+ int of_resolve_phandles(struct device_node *tree);
+ #endif
+
++#if defined(CONFIG_OF_DYNAMIC)
++void __of_free_phandle_cache_entry(phandle handle);
++#endif
++
+ #if defined(CONFIG_OF_OVERLAY)
+ void of_overlay_mutex_lock(void);
+ void of_overlay_mutex_unlock(void);
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index bef17c3fca67..33f3f475e5c6 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1251,30 +1251,29 @@ static int pci_pm_runtime_suspend(struct device *dev)
+ return 0;
+ }
+
+- if (!pm || !pm->runtime_suspend)
+- return -ENOSYS;
+-
+ pci_dev->state_saved = false;
+- error = pm->runtime_suspend(dev);
+- if (error) {
++ if (pm && pm->runtime_suspend) {
++ error = pm->runtime_suspend(dev);
+ /*
+ * -EBUSY and -EAGAIN is used to request the runtime PM core
+ * to schedule a new suspend, so log the event only with debug
+ * log level.
+ */
+- if (error == -EBUSY || error == -EAGAIN)
++ if (error == -EBUSY || error == -EAGAIN) {
+ dev_dbg(dev, "can't suspend now (%pf returned %d)\n",
+ pm->runtime_suspend, error);
+- else
++ return error;
++ } else if (error) {
+ dev_err(dev, "can't suspend (%pf returned %d)\n",
+ pm->runtime_suspend, error);
+-
+- return error;
++ return error;
++ }
+ }
+
+ pci_fixup_device(pci_fixup_suspend, pci_dev);
+
+- if (!pci_dev->state_saved && pci_dev->current_state != PCI_D0
++ if (pm && pm->runtime_suspend
++ && !pci_dev->state_saved && pci_dev->current_state != PCI_D0
+ && pci_dev->current_state != PCI_UNKNOWN) {
+ WARN_ONCE(pci_dev->current_state != prev,
+ "PCI PM: State of device not saved by %pF\n",
+@@ -1292,7 +1291,7 @@ static int pci_pm_runtime_suspend(struct device *dev)
+
+ static int pci_pm_runtime_resume(struct device *dev)
+ {
+- int rc;
++ int rc = 0;
+ struct pci_dev *pci_dev = to_pci_dev(dev);
+ const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
+
+@@ -1306,14 +1305,12 @@ static int pci_pm_runtime_resume(struct device *dev)
+ if (!pci_dev->driver)
+ return 0;
+
+- if (!pm || !pm->runtime_resume)
+- return -ENOSYS;
+-
+ pci_fixup_device(pci_fixup_resume_early, pci_dev);
+ pci_enable_wake(pci_dev, PCI_D0, false);
+ pci_fixup_device(pci_fixup_resume, pci_dev);
+
+- rc = pm->runtime_resume(dev);
++ if (pm && pm->runtime_resume)
++ rc = pm->runtime_resume(dev);
+
+ pci_dev->runtime_d3cold = false;
+
+diff --git a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
+index 1b10ea05a914..69372e2bc93c 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
+@@ -30,8 +30,8 @@
+ #define DDRC_FLUX_RCMD 0x38c
+ #define DDRC_PRE_CMD 0x3c0
+ #define DDRC_ACT_CMD 0x3c4
+-#define DDRC_BNK_CHG 0x3c8
+ #define DDRC_RNK_CHG 0x3cc
++#define DDRC_RW_CHG 0x3d0
+ #define DDRC_EVENT_CTRL 0x6C0
+ #define DDRC_INT_MASK 0x6c8
+ #define DDRC_INT_STATUS 0x6cc
+@@ -51,7 +51,7 @@
+
+ static const u32 ddrc_reg_off[] = {
+ DDRC_FLUX_WR, DDRC_FLUX_RD, DDRC_FLUX_WCMD, DDRC_FLUX_RCMD,
+- DDRC_PRE_CMD, DDRC_ACT_CMD, DDRC_BNK_CHG, DDRC_RNK_CHG
++ DDRC_PRE_CMD, DDRC_ACT_CMD, DDRC_RNK_CHG, DDRC_RW_CHG
+ };
+
+ /*
+diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
+index 4f3ab18636a3..c8eff70fdb1c 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson.c
++++ b/drivers/pinctrl/meson/pinctrl-meson.c
+@@ -191,7 +191,8 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,
+ case PIN_CONFIG_BIAS_DISABLE:
+ dev_dbg(pc->dev, "pin %u: disable bias\n", pin);
+
+- meson_calc_reg_and_bit(bank, pin, REG_PULL, ®, &bit);
++ meson_calc_reg_and_bit(bank, pin, REG_PULLEN, ®,
++ &bit);
+ ret = regmap_update_bits(pc->reg_pullen, reg,
+ BIT(bit), 0);
+ if (ret)
+diff --git a/drivers/power/supply/olpc_battery.c b/drivers/power/supply/olpc_battery.c
+index 6da79ae14860..5a97e42a3547 100644
+--- a/drivers/power/supply/olpc_battery.c
++++ b/drivers/power/supply/olpc_battery.c
+@@ -428,14 +428,14 @@ static int olpc_bat_get_property(struct power_supply *psy,
+ if (ret)
+ return ret;
+
+- val->intval = (s16)be16_to_cpu(ec_word) * 100 / 256;
++ val->intval = (s16)be16_to_cpu(ec_word) * 10 / 256;
+ break;
+ case POWER_SUPPLY_PROP_TEMP_AMBIENT:
+ ret = olpc_ec_cmd(EC_AMB_TEMP, NULL, 0, (void *)&ec_word, 2);
+ if (ret)
+ return ret;
+
+- val->intval = (int)be16_to_cpu(ec_word) * 100 / 256;
++ val->intval = (int)be16_to_cpu(ec_word) * 10 / 256;
+ break;
+ case POWER_SUPPLY_PROP_CHARGE_COUNTER:
+ ret = olpc_ec_cmd(EC_BAT_ACR, NULL, 0, (void *)&ec_word, 2);
+diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
+index 94f4d8fe85e0..d1b531fe9ada 100644
+--- a/drivers/s390/scsi/zfcp_aux.c
++++ b/drivers/s390/scsi/zfcp_aux.c
+@@ -275,16 +275,16 @@ static void zfcp_free_low_mem_buffers(struct zfcp_adapter *adapter)
+ */
+ int zfcp_status_read_refill(struct zfcp_adapter *adapter)
+ {
+- while (atomic_read(&adapter->stat_miss) > 0)
++ while (atomic_add_unless(&adapter->stat_miss, -1, 0))
+ if (zfcp_fsf_status_read(adapter->qdio)) {
++ atomic_inc(&adapter->stat_miss); /* undo add -1 */
+ if (atomic_read(&adapter->stat_miss) >=
+ adapter->stat_read_buf_num) {
+ zfcp_erp_adapter_reopen(adapter, 0, "axsref1");
+ return 1;
+ }
+ break;
+- } else
+- atomic_dec(&adapter->stat_miss);
++ }
+ return 0;
+ }
+
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+index f00045813378..3f97ec4aac4b 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+@@ -2371,7 +2371,7 @@ static int _bnx2fc_create(struct net_device *netdev,
+ if (!interface) {
+ printk(KERN_ERR PFX "bnx2fc_interface_create failed\n");
+ rc = -ENOMEM;
+- goto ifput_err;
++ goto netdev_err;
+ }
+
+ if (is_vlan_dev(netdev)) {
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index be2bac9355cd..a490e63c94b6 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -14221,7 +14221,8 @@ lpfc_sli4_queue_alloc(struct lpfc_hba *phba, uint32_t page_size,
+ hw_page_size))/hw_page_size;
+
+ /* If needed, Adjust page count to match the max the adapter supports */
+- if (queue->page_count > phba->sli4_hba.pc_sli4_params.wqpcnt)
++ if (phba->sli4_hba.pc_sli4_params.wqpcnt &&
++ (queue->page_count > phba->sli4_hba.pc_sli4_params.wqpcnt))
+ queue->page_count = phba->sli4_hba.pc_sli4_params.wqpcnt;
+
+ INIT_LIST_HEAD(&queue->list);
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index ae9fd2d01004..42b8f0d3e580 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -4808,10 +4808,10 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
+ fcport->d_id = e->u.new_sess.id;
+ fcport->flags |= FCF_FABRIC_DEVICE;
+ fcport->fw_login_state = DSC_LS_PLOGI_PEND;
+- if (e->u.new_sess.fc4_type & FS_FC4TYPE_FCP)
++ if (e->u.new_sess.fc4_type == FS_FC4TYPE_FCP)
+ fcport->fc4_type = FC4_TYPE_FCP_SCSI;
+
+- if (e->u.new_sess.fc4_type & FS_FC4TYPE_NVME) {
++ if (e->u.new_sess.fc4_type == FS_FC4TYPE_NVME) {
+ fcport->fc4_type = FC4_TYPE_OTHER;
+ fcport->fc4f_nvme = FC4_TYPE_NVME;
+ }
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+index 8de16016b6de..b289b90ae6dc 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+@@ -631,8 +631,11 @@ static void cxgbit_send_halfclose(struct cxgbit_sock *csk)
+
+ static void cxgbit_arp_failure_discard(void *handle, struct sk_buff *skb)
+ {
++ struct cxgbit_sock *csk = handle;
++
+ pr_debug("%s cxgbit_device %p\n", __func__, handle);
+ kfree_skb(skb);
++ cxgbit_put_csk(csk);
+ }
+
+ static void cxgbit_abort_arp_failure(void *handle, struct sk_buff *skb)
+@@ -1190,7 +1193,7 @@ cxgbit_pass_accept_rpl(struct cxgbit_sock *csk, struct cpl_pass_accept_req *req)
+ rpl5->opt0 = cpu_to_be64(opt0);
+ rpl5->opt2 = cpu_to_be32(opt2);
+ set_wr_txq(skb, CPL_PRIORITY_SETUP, csk->ctrlq_idx);
+- t4_set_arp_err_handler(skb, NULL, cxgbit_arp_failure_discard);
++ t4_set_arp_err_handler(skb, csk, cxgbit_arp_failure_discard);
+ cxgbit_l2t_send(csk->com.cdev, skb, csk->l2t);
+ }
+
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_main.c b/drivers/target/iscsi/cxgbit/cxgbit_main.c
+index f3f8856bfb68..c011c826fc26 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_main.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_main.c
+@@ -58,6 +58,7 @@ static void *cxgbit_uld_add(const struct cxgb4_lld_info *lldi)
+ return ERR_PTR(-ENOMEM);
+
+ kref_init(&cdev->kref);
++ spin_lock_init(&cdev->np_lock);
+
+ cdev->lldi = *lldi;
+
+diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
+index 6cf3e9b0728f..3e77475668c0 100644
+--- a/drivers/tty/serial/sunsu.c
++++ b/drivers/tty/serial/sunsu.c
+@@ -1394,22 +1394,43 @@ static inline struct console *SUNSU_CONSOLE(void)
+ static enum su_type su_get_type(struct device_node *dp)
+ {
+ struct device_node *ap = of_find_node_by_path("/aliases");
++ enum su_type rc = SU_PORT_PORT;
+
+ if (ap) {
+ const char *keyb = of_get_property(ap, "keyboard", NULL);
+ const char *ms = of_get_property(ap, "mouse", NULL);
++ struct device_node *match;
+
+ if (keyb) {
+- if (dp == of_find_node_by_path(keyb))
+- return SU_PORT_KBD;
++ match = of_find_node_by_path(keyb);
++
++ /*
++ * The pointer is used as an identifier not
++ * as a pointer, we can drop the refcount on
++ * the of__node immediately after getting it.
++ */
++ of_node_put(match);
++
++ if (dp == match) {
++ rc = SU_PORT_KBD;
++ goto out;
++ }
+ }
+ if (ms) {
+- if (dp == of_find_node_by_path(ms))
+- return SU_PORT_MS;
++ match = of_find_node_by_path(ms);
++
++ of_node_put(match);
++
++ if (dp == match) {
++ rc = SU_PORT_MS;
++ goto out;
++ }
+ }
+ }
+
+- return SU_PORT_PORT;
++out:
++ of_node_put(ap);
++ return rc;
+ }
+
+ static int su_probe(struct platform_device *op)
+diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
+index bbed039617a4..d59c8a59f582 100644
+--- a/drivers/video/fbdev/pxafb.c
++++ b/drivers/video/fbdev/pxafb.c
+@@ -2234,10 +2234,8 @@ static struct pxafb_mach_info *of_pxafb_of_mach_info(struct device *dev)
+ if (!info)
+ return ERR_PTR(-ENOMEM);
+ ret = of_get_pxafb_mode_info(dev, info);
+- if (ret) {
+- kfree(info->modes);
++ if (ret)
+ return ERR_PTR(ret);
+- }
+
+ /*
+ * On purpose, neither lccrX registers nor video memory size can be
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index dd7dfdd2ba13..eadffaa39f4e 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -3566,7 +3566,6 @@ retry:
+ tcap->cap_id = t_cap_id;
+ tcap->seq = t_seq - 1;
+ tcap->issue_seq = t_seq - 1;
+- tcap->mseq = t_mseq;
+ tcap->issued |= issued;
+ tcap->implemented |= issued;
+ if (cap == ci->i_auth_cap)
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index cc91963683de..a928ba008d7d 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -1209,6 +1209,7 @@ static int create_lkb(struct dlm_ls *ls, struct dlm_lkb **lkb_ret)
+
+ if (rv < 0) {
+ log_error(ls, "create_lkb idr error %d", rv);
++ dlm_free_lkb(lkb);
+ return rv;
+ }
+
+@@ -4179,6 +4180,7 @@ static int receive_convert(struct dlm_ls *ls, struct dlm_message *ms)
+ (unsigned long long)lkb->lkb_recover_seq,
+ ms->m_header.h_nodeid, ms->m_lkid);
+ error = -ENOENT;
++ dlm_put_lkb(lkb);
+ goto fail;
+ }
+
+@@ -4232,6 +4234,7 @@ static int receive_unlock(struct dlm_ls *ls, struct dlm_message *ms)
+ lkb->lkb_id, lkb->lkb_remid,
+ ms->m_header.h_nodeid, ms->m_lkid);
+ error = -ENOENT;
++ dlm_put_lkb(lkb);
+ goto fail;
+ }
+
+@@ -5792,20 +5795,20 @@ int dlm_user_request(struct dlm_ls *ls, struct dlm_user_args *ua,
+ goto out;
+ }
+ }
+-
+- /* After ua is attached to lkb it will be freed by dlm_free_lkb().
+- When DLM_IFL_USER is set, the dlm knows that this is a userspace
+- lock and that lkb_astparam is the dlm_user_args structure. */
+-
+ error = set_lock_args(mode, &ua->lksb, flags, namelen, timeout_cs,
+ fake_astfn, ua, fake_bastfn, &args);
+- lkb->lkb_flags |= DLM_IFL_USER;
+-
+ if (error) {
++ kfree(ua->lksb.sb_lvbptr);
++ ua->lksb.sb_lvbptr = NULL;
++ kfree(ua);
+ __put_lkb(ls, lkb);
+ goto out;
+ }
+
++ /* After ua is attached to lkb it will be freed by dlm_free_lkb().
++ When DLM_IFL_USER is set, the dlm knows that this is a userspace
++ lock and that lkb_astparam is the dlm_user_args structure. */
++ lkb->lkb_flags |= DLM_IFL_USER;
+ error = request_lock(ls, lkb, name, namelen, &args);
+
+ switch (error) {
+diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
+index 5ba94be006ee..6a1529e478f3 100644
+--- a/fs/dlm/lockspace.c
++++ b/fs/dlm/lockspace.c
+@@ -680,11 +680,11 @@ static int new_lockspace(const char *name, const char *cluster,
+ kfree(ls->ls_recover_buf);
+ out_lkbidr:
+ idr_destroy(&ls->ls_lkbidr);
++ out_rsbtbl:
+ for (i = 0; i < DLM_REMOVE_NAMES_MAX; i++) {
+ if (ls->ls_remove_names[i])
+ kfree(ls->ls_remove_names[i]);
+ }
+- out_rsbtbl:
+ vfree(ls->ls_rsbtbl);
+ out_lsfree:
+ if (do_unreg)
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index 648f0ca1ad57..998051c4aea7 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -744,17 +744,19 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+ the gfs2 structures. */
+ if (default_acl) {
+ error = __gfs2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
++ if (error)
++ goto fail_gunlock3;
+ posix_acl_release(default_acl);
++ default_acl = NULL;
+ }
+ if (acl) {
+- if (!error)
+- error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
++ error = __gfs2_set_acl(inode, acl, ACL_TYPE_ACCESS);
++ if (error)
++ goto fail_gunlock3;
+ posix_acl_release(acl);
++ acl = NULL;
+ }
+
+- if (error)
+- goto fail_gunlock3;
+-
+ error = security_inode_init_security(&ip->i_inode, &dip->i_inode, name,
+ &gfs2_initxattrs, NULL);
+ if (error)
+@@ -789,10 +791,8 @@ fail_free_inode:
+ }
+ gfs2_rsqa_delete(ip, NULL);
+ fail_free_acls:
+- if (default_acl)
+- posix_acl_release(default_acl);
+- if (acl)
+- posix_acl_release(acl);
++ posix_acl_release(default_acl);
++ posix_acl_release(acl);
+ fail_gunlock:
+ gfs2_dir_no_add(&da);
+ gfs2_glock_dq_uninit(ghs);
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 449d0cb45a84..e978f6930575 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1747,9 +1747,9 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext,
+ goto next_iter;
+ }
+ if (ret == -E2BIG) {
++ n += rbm->bii - initial_bii;
+ rbm->bii = 0;
+ rbm->offset = 0;
+- n += (rbm->bii - initial_bii);
+ goto res_covered_end_of_rgrp;
+ }
+ return ret;
+diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
+index d20b92f271c2..0a67dd4250e9 100644
+--- a/fs/lockd/clntproc.c
++++ b/fs/lockd/clntproc.c
+@@ -442,7 +442,7 @@ nlmclnt_test(struct nlm_rqst *req, struct file_lock *fl)
+ fl->fl_start = req->a_res.lock.fl.fl_start;
+ fl->fl_end = req->a_res.lock.fl.fl_end;
+ fl->fl_type = req->a_res.lock.fl.fl_type;
+- fl->fl_pid = 0;
++ fl->fl_pid = -req->a_res.lock.fl.fl_pid;
+ break;
+ default:
+ status = nlm_stat_to_errno(req->a_res.status);
+diff --git a/fs/lockd/xdr.c b/fs/lockd/xdr.c
+index 7147e4aebecc..9846f7e95282 100644
+--- a/fs/lockd/xdr.c
++++ b/fs/lockd/xdr.c
+@@ -127,7 +127,7 @@ nlm_decode_lock(__be32 *p, struct nlm_lock *lock)
+
+ locks_init_lock(fl);
+ fl->fl_owner = current->files;
+- fl->fl_pid = (pid_t)lock->svid;
++ fl->fl_pid = current->tgid;
+ fl->fl_flags = FL_POSIX;
+ fl->fl_type = F_RDLCK; /* as good as anything else */
+ start = ntohl(*p++);
+@@ -269,7 +269,7 @@ nlmsvc_decode_shareargs(struct svc_rqst *rqstp, __be32 *p)
+ memset(lock, 0, sizeof(*lock));
+ locks_init_lock(&lock->fl);
+ lock->svid = ~(u32) 0;
+- lock->fl.fl_pid = (pid_t)lock->svid;
++ lock->fl.fl_pid = current->tgid;
+
+ if (!(p = nlm_decode_cookie(p, &argp->cookie))
+ || !(p = xdr_decode_string_inplace(p, &lock->caller,
+diff --git a/fs/lockd/xdr4.c b/fs/lockd/xdr4.c
+index 7ed9edf9aed4..70154f376695 100644
+--- a/fs/lockd/xdr4.c
++++ b/fs/lockd/xdr4.c
+@@ -119,7 +119,7 @@ nlm4_decode_lock(__be32 *p, struct nlm_lock *lock)
+
+ locks_init_lock(fl);
+ fl->fl_owner = current->files;
+- fl->fl_pid = (pid_t)lock->svid;
++ fl->fl_pid = current->tgid;
+ fl->fl_flags = FL_POSIX;
+ fl->fl_type = F_RDLCK; /* as good as anything else */
+ p = xdr_decode_hyper(p, &start);
+@@ -266,7 +266,7 @@ nlm4svc_decode_shareargs(struct svc_rqst *rqstp, __be32 *p)
+ memset(lock, 0, sizeof(*lock));
+ locks_init_lock(&lock->fl);
+ lock->svid = ~(u32) 0;
+- lock->fl.fl_pid = (pid_t)lock->svid;
++ lock->fl.fl_pid = current->tgid;
+
+ if (!(p = nlm4_decode_cookie(p, &argp->cookie))
+ || !(p = xdr_decode_string_inplace(p, &lock->caller,
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 9d6b4f0f1a25..f35aa9f88b5e 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1015,8 +1015,6 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+
+ nvecs = svc_fill_write_vector(rqstp, write->wr_pagelist,
+ &write->wr_head, write->wr_buflen);
+- if (!nvecs)
+- return nfserr_io;
+ WARN_ON_ONCE(nvecs > ARRAY_SIZE(rqstp->rq_vec));
+
+ status = nfsd_vfs_write(rqstp, &cstate->current_fh, filp,
+diff --git a/include/linux/hmm.h b/include/linux/hmm.h
+index 4c92e3ba3e16..5ec8635f602c 100644
+--- a/include/linux/hmm.h
++++ b/include/linux/hmm.h
+@@ -499,8 +499,7 @@ struct hmm_devmem {
+ * enough and allocate struct page for it.
+ *
+ * The device driver can wrap the hmm_devmem struct inside a private device
+- * driver struct. The device driver must call hmm_devmem_remove() before the
+- * device goes away and before freeing the hmm_devmem struct memory.
++ * driver struct.
+ */
+ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops,
+ struct device *device,
+@@ -508,7 +507,6 @@ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops,
+ struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops,
+ struct device *device,
+ struct resource *res);
+-void hmm_devmem_remove(struct hmm_devmem *devmem);
+
+ /*
+ * hmm_devmem_page_set_drvdata - set per-page driver data field
+diff --git a/include/linux/memremap.h b/include/linux/memremap.h
+index f91f9e763557..a84572cdc438 100644
+--- a/include/linux/memremap.h
++++ b/include/linux/memremap.h
+@@ -106,6 +106,7 @@ typedef void (*dev_page_free_t)(struct page *page, void *data);
+ * @altmap: pre-allocated/reserved memory for vmemmap allocations
+ * @res: physical address range covered by @ref
+ * @ref: reference count that pins the devm_memremap_pages() mapping
++ * @kill: callback to transition @ref to the dead state
+ * @dev: host device of the mapping for debug
+ * @data: private data pointer for page_free()
+ * @type: memory type: see MEMORY_* in memory_hotplug.h
+@@ -117,6 +118,7 @@ struct dev_pagemap {
+ bool altmap_valid;
+ struct resource res;
+ struct percpu_ref *ref;
++ void (*kill)(struct percpu_ref *ref);
+ struct device *dev;
+ void *data;
+ enum memory_type type;
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index 4a520d3304a2..cf09ab37b45b 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -62,18 +62,6 @@ static inline bool lockdep_nfnl_is_held(__u8 subsys_id)
+ }
+ #endif /* CONFIG_PROVE_LOCKING */
+
+-/*
+- * nfnl_dereference - fetch RCU pointer when updates are prevented by subsys mutex
+- *
+- * @p: The pointer to read, prior to dereferencing
+- * @ss: The nfnetlink subsystem ID
+- *
+- * Return the value of the specified RCU-protected pointer, but omit
+- * the READ_ONCE(), because caller holds the NFNL subsystem mutex.
+- */
+-#define nfnl_dereference(p, ss) \
+- rcu_dereference_protected(p, lockdep_nfnl_is_held(ss))
+-
+ #define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
+ MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
+
+diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
+index 53fbae27b280..61a5799b440b 100644
+--- a/include/uapi/linux/input-event-codes.h
++++ b/include/uapi/linux/input-event-codes.h
+@@ -744,6 +744,15 @@
+
+ #define ABS_MISC 0x28
+
++/*
++ * 0x2e is reserved and should not be used in input drivers.
++ * It was used by HID as ABS_MISC+6 and userspace needs to detect if
++ * the next ABS_* event is correct or is just ABS_MISC + n.
++ * We define here ABS_RESERVED so userspace can rely on it and detect
++ * the situation described above.
++ */
++#define ABS_RESERVED 0x2e
++
+ #define ABS_MT_SLOT 0x2f /* MT slot being modified */
+ #define ABS_MT_TOUCH_MAJOR 0x30 /* Major axis of touching ellipse */
+ #define ABS_MT_TOUCH_MINOR 0x31 /* Minor axis (omit if circular) */
+diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c
+index de87b0282e74..1d2f147f737d 100644
+--- a/kernel/dma/direct.c
++++ b/kernel/dma/direct.c
+@@ -168,7 +168,12 @@ int dma_direct_map_sg(struct device *dev, struct scatterlist *sgl, int nents,
+ int dma_direct_supported(struct device *dev, u64 mask)
+ {
+ #ifdef CONFIG_ZONE_DMA
+- if (mask < phys_to_dma(dev, DMA_BIT_MASK(ARCH_ZONE_DMA_BITS)))
++ /*
++ * This check needs to be against the actual bit mask value, so
++ * use __phys_to_dma() here so that the SME encryption mask isn't
++ * part of the check.
++ */
++ if (mask < __phys_to_dma(dev, DMA_BIT_MASK(ARCH_ZONE_DMA_BITS)))
+ return 0;
+ #else
+ /*
+@@ -176,8 +181,12 @@ int dma_direct_supported(struct device *dev, u64 mask)
+ * to be able to satisfy them - either by not supporting more physical
+ * memory, or by providing a ZONE_DMA32. If neither is the case, the
+ * architecture needs to use an IOMMU instead of the direct mapping.
++ *
++ * This check needs to be against the actual bit mask value, so
++ * use __phys_to_dma() here so that the SME encryption mask isn't
++ * part of the check.
+ */
+- if (mask < phys_to_dma(dev, DMA_BIT_MASK(32)))
++ if (mask < __phys_to_dma(dev, DMA_BIT_MASK(32)))
+ return 0;
+ #endif
+ /*
+diff --git a/kernel/fork.c b/kernel/fork.c
+index f0b58479534f..64ef113e387e 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1784,8 +1784,6 @@ static __latent_entropy struct task_struct *copy_process(
+
+ posix_cpu_timers_init(p);
+
+- p->start_time = ktime_get_ns();
+- p->real_start_time = ktime_get_boot_ns();
+ p->io_context = NULL;
+ audit_set_context(p, NULL);
+ cgroup_fork(p);
+@@ -1949,6 +1947,17 @@ static __latent_entropy struct task_struct *copy_process(
+ if (retval)
+ goto bad_fork_free_pid;
+
++ /*
++ * From this point on we must avoid any synchronous user-space
++ * communication until we take the tasklist-lock. In particular, we do
++ * not want user-space to be able to predict the process start-time by
++ * stalling fork(2) after we recorded the start_time but before it is
++ * visible to the system.
++ */
++
++ p->start_time = ktime_get_ns();
++ p->real_start_time = ktime_get_boot_ns();
++
+ /*
+ * Make it visible to the rest of the system, but dont wake it up yet.
+ * Need tasklist lock for parent etc handling!
+diff --git a/kernel/memremap.c b/kernel/memremap.c
+index 5b8600d39931..7c5fb8a208ac 100644
+--- a/kernel/memremap.c
++++ b/kernel/memremap.c
+@@ -122,23 +122,25 @@ static void devm_memremap_pages_release(void *data)
+ resource_size_t align_start, align_size;
+ unsigned long pfn;
+
++ pgmap->kill(pgmap->ref);
+ for_each_device_pfn(pfn, pgmap)
+ put_page(pfn_to_page(pfn));
+
+- if (percpu_ref_tryget_live(pgmap->ref)) {
+- dev_WARN(dev, "%s: page mapping is still live!\n", __func__);
+- percpu_ref_put(pgmap->ref);
+- }
+-
+ /* pages are dead and unused, undo the arch mapping */
+ align_start = res->start & ~(SECTION_SIZE - 1);
+ align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
+ - align_start;
+
+ mem_hotplug_begin();
+- arch_remove_memory(align_start, align_size, pgmap->altmap_valid ?
+- &pgmap->altmap : NULL);
+- kasan_remove_zero_shadow(__va(align_start), align_size);
++ if (pgmap->type == MEMORY_DEVICE_PRIVATE) {
++ pfn = align_start >> PAGE_SHIFT;
++ __remove_pages(page_zone(pfn_to_page(pfn)), pfn,
++ align_size >> PAGE_SHIFT, NULL);
++ } else {
++ arch_remove_memory(align_start, align_size,
++ pgmap->altmap_valid ? &pgmap->altmap : NULL);
++ kasan_remove_zero_shadow(__va(align_start), align_size);
++ }
+ mem_hotplug_done();
+
+ untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
+@@ -150,7 +152,7 @@ static void devm_memremap_pages_release(void *data)
+ /**
+ * devm_memremap_pages - remap and provide memmap backing for the given resource
+ * @dev: hosting device for @res
+- * @pgmap: pointer to a struct dev_pgmap
++ * @pgmap: pointer to a struct dev_pagemap
+ *
+ * Notes:
+ * 1/ At a minimum the res, ref and type members of @pgmap must be initialized
+@@ -159,11 +161,8 @@ static void devm_memremap_pages_release(void *data)
+ * 2/ The altmap field may optionally be initialized, in which case altmap_valid
+ * must be set to true
+ *
+- * 3/ pgmap.ref must be 'live' on entry and 'dead' before devm_memunmap_pages()
+- * time (or devm release event). The expected order of events is that ref has
+- * been through percpu_ref_kill() before devm_memremap_pages_release(). The
+- * wait for the completion of all references being dropped and
+- * percpu_ref_exit() must occur after devm_memremap_pages_release().
++ * 3/ pgmap->ref must be 'live' on entry and will be killed at
++ * devm_memremap_pages_release() time, or if this routine fails.
+ *
+ * 4/ res is expected to be a host memory range that could feasibly be
+ * treated as a "System RAM" range, i.e. not a device mmio range, but
+@@ -180,6 +179,9 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
+ int error, nid, is_ram;
+ struct dev_pagemap *conflict_pgmap;
+
++ if (!pgmap->ref || !pgmap->kill)
++ return ERR_PTR(-EINVAL);
++
+ align_start = res->start & ~(SECTION_SIZE - 1);
+ align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
+ - align_start;
+@@ -202,18 +204,13 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
+ is_ram = region_intersects(align_start, align_size,
+ IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE);
+
+- if (is_ram == REGION_MIXED) {
+- WARN_ONCE(1, "%s attempted on mixed region %pr\n",
+- __func__, res);
+- return ERR_PTR(-ENXIO);
++ if (is_ram != REGION_DISJOINT) {
++ WARN_ONCE(1, "%s attempted on %s region %pr\n", __func__,
++ is_ram == REGION_MIXED ? "mixed" : "ram", res);
++ error = -ENXIO;
++ goto err_array;
+ }
+
+- if (is_ram == REGION_INTERSECTS)
+- return __va(res->start);
+-
+- if (!pgmap->ref)
+- return ERR_PTR(-EINVAL);
+-
+ pgmap->dev = dev;
+
+ mutex_lock(&pgmap_lock);
+@@ -241,17 +238,40 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
+ goto err_pfn_remap;
+
+ mem_hotplug_begin();
+- error = kasan_add_zero_shadow(__va(align_start), align_size);
+- if (error) {
+- mem_hotplug_done();
+- goto err_kasan;
++
++ /*
++ * For device private memory we call add_pages() as we only need to
++ * allocate and initialize struct page for the device memory. More-
++ * over the device memory is un-accessible thus we do not want to
++ * create a linear mapping for the memory like arch_add_memory()
++ * would do.
++ *
++ * For all other device memory types, which are accessible by
++ * the CPU, we do want the linear mapping and thus use
++ * arch_add_memory().
++ */
++ if (pgmap->type == MEMORY_DEVICE_PRIVATE) {
++ error = add_pages(nid, align_start >> PAGE_SHIFT,
++ align_size >> PAGE_SHIFT, NULL, false);
++ } else {
++ error = kasan_add_zero_shadow(__va(align_start), align_size);
++ if (error) {
++ mem_hotplug_done();
++ goto err_kasan;
++ }
++
++ error = arch_add_memory(nid, align_start, align_size, altmap,
++ false);
++ }
++
++ if (!error) {
++ struct zone *zone;
++
++ zone = &NODE_DATA(nid)->node_zones[ZONE_DEVICE];
++ move_pfn_range_to_zone(zone, align_start >> PAGE_SHIFT,
++ align_size >> PAGE_SHIFT, altmap);
+ }
+
+- error = arch_add_memory(nid, align_start, align_size, altmap, false);
+- if (!error)
+- move_pfn_range_to_zone(&NODE_DATA(nid)->node_zones[ZONE_DEVICE],
+- align_start >> PAGE_SHIFT,
+- align_size >> PAGE_SHIFT, altmap);
+ mem_hotplug_done();
+ if (error)
+ goto err_add_memory;
+@@ -270,7 +290,10 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
+ percpu_ref_get(pgmap->ref);
+ }
+
+- devm_add_action(dev, devm_memremap_pages_release, pgmap);
++ error = devm_add_action_or_reset(dev, devm_memremap_pages_release,
++ pgmap);
++ if (error)
++ return ERR_PTR(error);
+
+ return __va(res->start);
+
+@@ -281,9 +304,11 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
+ err_pfn_remap:
+ err_radix:
+ pgmap_radix_release(res, pgoff);
++ err_array:
++ pgmap->kill(pgmap->ref);
+ return ERR_PTR(error);
+ }
+-EXPORT_SYMBOL(devm_memremap_pages);
++EXPORT_SYMBOL_GPL(devm_memremap_pages);
+
+ unsigned long vmem_altmap_offset(struct vmem_altmap *altmap)
+ {
+diff --git a/kernel/pid.c b/kernel/pid.c
+index cdf63e53a014..b88fe5e494cc 100644
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -233,8 +233,10 @@ out_unlock:
+
+ out_free:
+ spin_lock_irq(&pidmap_lock);
+- while (++i <= ns->level)
+- idr_remove(&ns->idr, (pid->numbers + i)->nr);
++ while (++i <= ns->level) {
++ upid = pid->numbers + i;
++ idr_remove(&upid->ns->idr, upid->nr);
++ }
+
+ /* On failure to allocate the first pid, reset the state */
+ if (ns->pid_allocated == PIDNS_ADDING)
+diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
+index 6c9866a854b1..1ff17e297f0c 100644
+--- a/kernel/rcu/srcutree.c
++++ b/kernel/rcu/srcutree.c
+@@ -448,10 +448,12 @@ static void srcu_gp_start(struct srcu_struct *sp)
+
+ lockdep_assert_held(&ACCESS_PRIVATE(sp, lock));
+ WARN_ON_ONCE(ULONG_CMP_GE(sp->srcu_gp_seq, sp->srcu_gp_seq_needed));
++ spin_lock_rcu_node(sdp); /* Interrupts already disabled. */
+ rcu_segcblist_advance(&sdp->srcu_cblist,
+ rcu_seq_current(&sp->srcu_gp_seq));
+ (void)rcu_segcblist_accelerate(&sdp->srcu_cblist,
+ rcu_seq_snap(&sp->srcu_gp_seq));
++ spin_unlock_rcu_node(sdp); /* Interrupts remain disabled. */
+ smp_mb(); /* Order prior store to ->srcu_gp_seq_needed vs. GP start. */
+ rcu_seq_start(&sp->srcu_gp_seq);
+ state = rcu_seq_state(READ_ONCE(sp->srcu_gp_seq));
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index eabbf6b10b44..7137bc343b4a 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -352,10 +352,9 @@ static inline void list_del_leaf_cfs_rq(struct cfs_rq *cfs_rq)
+ }
+ }
+
+-/* Iterate thr' all leaf cfs_rq's on a runqueue */
+-#define for_each_leaf_cfs_rq_safe(rq, cfs_rq, pos) \
+- list_for_each_entry_safe(cfs_rq, pos, &rq->leaf_cfs_rq_list, \
+- leaf_cfs_rq_list)
++/* Iterate through all leaf cfs_rq's on a runqueue: */
++#define for_each_leaf_cfs_rq(rq, cfs_rq) \
++ list_for_each_entry_rcu(cfs_rq, &rq->leaf_cfs_rq_list, leaf_cfs_rq_list)
+
+ /* Do the two (enqueued) entities belong to the same group ? */
+ static inline struct cfs_rq *
+@@ -447,8 +446,8 @@ static inline void list_del_leaf_cfs_rq(struct cfs_rq *cfs_rq)
+ {
+ }
+
+-#define for_each_leaf_cfs_rq_safe(rq, cfs_rq, pos) \
+- for (cfs_rq = &rq->cfs, pos = NULL; cfs_rq; cfs_rq = pos)
++#define for_each_leaf_cfs_rq(rq, cfs_rq) \
++ for (cfs_rq = &rq->cfs; cfs_rq; cfs_rq = NULL)
+
+ static inline struct sched_entity *parent_entity(struct sched_entity *se)
+ {
+@@ -7371,27 +7370,10 @@ static inline bool others_have_blocked(struct rq *rq)
+
+ #ifdef CONFIG_FAIR_GROUP_SCHED
+
+-static inline bool cfs_rq_is_decayed(struct cfs_rq *cfs_rq)
+-{
+- if (cfs_rq->load.weight)
+- return false;
+-
+- if (cfs_rq->avg.load_sum)
+- return false;
+-
+- if (cfs_rq->avg.util_sum)
+- return false;
+-
+- if (cfs_rq->avg.runnable_load_sum)
+- return false;
+-
+- return true;
+-}
+-
+ static void update_blocked_averages(int cpu)
+ {
+ struct rq *rq = cpu_rq(cpu);
+- struct cfs_rq *cfs_rq, *pos;
++ struct cfs_rq *cfs_rq;
+ const struct sched_class *curr_class;
+ struct rq_flags rf;
+ bool done = true;
+@@ -7403,7 +7385,7 @@ static void update_blocked_averages(int cpu)
+ * Iterates the task_group tree in a bottom up fashion, see
+ * list_add_leaf_cfs_rq() for details.
+ */
+- for_each_leaf_cfs_rq_safe(rq, cfs_rq, pos) {
++ for_each_leaf_cfs_rq(rq, cfs_rq) {
+ struct sched_entity *se;
+
+ /* throttled entities do not contribute to load */
+@@ -7418,13 +7400,6 @@ static void update_blocked_averages(int cpu)
+ if (se && !skip_blocked_update(se))
+ update_load_avg(cfs_rq_of(se), se, 0);
+
+- /*
+- * There can be a lot of idle CPU cgroups. Don't let fully
+- * decayed cfs_rqs linger on the list.
+- */
+- if (cfs_rq_is_decayed(cfs_rq))
+- list_del_leaf_cfs_rq(cfs_rq);
+-
+ /* Don't need periodic decay once load/util_avg are null */
+ if (cfs_rq_has_blocked(cfs_rq))
+ done = false;
+@@ -10196,10 +10171,10 @@ const struct sched_class fair_sched_class = {
+ #ifdef CONFIG_SCHED_DEBUG
+ void print_cfs_stats(struct seq_file *m, int cpu)
+ {
+- struct cfs_rq *cfs_rq, *pos;
++ struct cfs_rq *cfs_rq;
+
+ rcu_read_lock();
+- for_each_leaf_cfs_rq_safe(cpu_rq(cpu), cfs_rq, pos)
++ for_each_leaf_cfs_rq(cpu_rq(cpu), cfs_rq)
+ print_cfs_rq(m, cpu, cfs_rq);
+ rcu_read_unlock();
+ }
+diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile
+index 2f8b61dfd9b0..7ed43eaa02ef 100644
+--- a/lib/raid6/Makefile
++++ b/lib/raid6/Makefile
+@@ -18,6 +18,21 @@ quiet_cmd_unroll = UNROLL $@
+
+ ifeq ($(CONFIG_ALTIVEC),y)
+ altivec_flags := -maltivec $(call cc-option,-mabi=altivec)
++
++ifdef CONFIG_CC_IS_CLANG
++# clang ppc port does not yet support -maltivec when -msoft-float is
++# enabled. A future release of clang will resolve this
++# https://bugs.llvm.org/show_bug.cgi?id=31177
++CFLAGS_REMOVE_altivec1.o += -msoft-float
++CFLAGS_REMOVE_altivec2.o += -msoft-float
++CFLAGS_REMOVE_altivec4.o += -msoft-float
++CFLAGS_REMOVE_altivec8.o += -msoft-float
++CFLAGS_REMOVE_altivec8.o += -msoft-float
++CFLAGS_REMOVE_vpermxor1.o += -msoft-float
++CFLAGS_REMOVE_vpermxor2.o += -msoft-float
++CFLAGS_REMOVE_vpermxor4.o += -msoft-float
++CFLAGS_REMOVE_vpermxor8.o += -msoft-float
++endif
+ endif
+
+ # The GCC option -ffreestanding is required in order to compile code containing
+diff --git a/lib/test_debug_virtual.c b/lib/test_debug_virtual.c
+index d5a06addeb27..bf864c73e462 100644
+--- a/lib/test_debug_virtual.c
++++ b/lib/test_debug_virtual.c
+@@ -5,6 +5,7 @@
+ #include <linux/vmalloc.h>
+ #include <linux/slab.h>
+ #include <linux/sizes.h>
++#include <linux/io.h>
+
+ #include <asm/page.h>
+ #ifdef CONFIG_MIPS
+diff --git a/mm/hmm.c b/mm/hmm.c
+index 90193a7fabce..57f0d2a4ff34 100644
+--- a/mm/hmm.c
++++ b/mm/hmm.c
+@@ -945,7 +945,6 @@ static void hmm_devmem_ref_exit(void *data)
+
+ devmem = container_of(ref, struct hmm_devmem, ref);
+ percpu_ref_exit(ref);
+- devm_remove_action(devmem->device, &hmm_devmem_ref_exit, data);
+ }
+
+ static void hmm_devmem_ref_kill(void *data)
+@@ -956,7 +955,6 @@ static void hmm_devmem_ref_kill(void *data)
+ devmem = container_of(ref, struct hmm_devmem, ref);
+ percpu_ref_kill(ref);
+ wait_for_completion(&devmem->completion);
+- devm_remove_action(devmem->device, &hmm_devmem_ref_kill, data);
+ }
+
+ static int hmm_devmem_fault(struct vm_area_struct *vma,
+@@ -994,7 +992,7 @@ static void hmm_devmem_radix_release(struct resource *resource)
+ mutex_unlock(&hmm_devmem_lock);
+ }
+
+-static void hmm_devmem_release(struct device *dev, void *data)
++static void hmm_devmem_release(void *data)
+ {
+ struct hmm_devmem *devmem = data;
+ struct resource *resource = devmem->resource;
+@@ -1002,11 +1000,6 @@ static void hmm_devmem_release(struct device *dev, void *data)
+ struct zone *zone;
+ struct page *page;
+
+- if (percpu_ref_tryget_live(&devmem->ref)) {
+- dev_WARN(dev, "%s: page mapping is still live!\n", __func__);
+- percpu_ref_put(&devmem->ref);
+- }
+-
+ /* pages are dead and unused, undo the arch mapping */
+ start_pfn = (resource->start & ~(PA_SECTION_SIZE - 1)) >> PAGE_SHIFT;
+ npages = ALIGN(resource_size(resource), PA_SECTION_SIZE) >> PAGE_SHIFT;
+@@ -1130,19 +1123,6 @@ error:
+ return ret;
+ }
+
+-static int hmm_devmem_match(struct device *dev, void *data, void *match_data)
+-{
+- struct hmm_devmem *devmem = data;
+-
+- return devmem->resource == match_data;
+-}
+-
+-static void hmm_devmem_pages_remove(struct hmm_devmem *devmem)
+-{
+- devres_release(devmem->device, &hmm_devmem_release,
+- &hmm_devmem_match, devmem->resource);
+-}
+-
+ /*
+ * hmm_devmem_add() - hotplug ZONE_DEVICE memory for device memory
+ *
+@@ -1170,8 +1150,7 @@ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops,
+
+ dev_pagemap_get_ops();
+
+- devmem = devres_alloc_node(&hmm_devmem_release, sizeof(*devmem),
+- GFP_KERNEL, dev_to_node(device));
++ devmem = devm_kzalloc(device, sizeof(*devmem), GFP_KERNEL);
+ if (!devmem)
+ return ERR_PTR(-ENOMEM);
+
+@@ -1185,11 +1164,11 @@ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops,
+ ret = percpu_ref_init(&devmem->ref, &hmm_devmem_ref_release,
+ 0, GFP_KERNEL);
+ if (ret)
+- goto error_percpu_ref;
++ return ERR_PTR(ret);
+
+- ret = devm_add_action(device, hmm_devmem_ref_exit, &devmem->ref);
++ ret = devm_add_action_or_reset(device, hmm_devmem_ref_exit, &devmem->ref);
+ if (ret)
+- goto error_devm_add_action;
++ return ERR_PTR(ret);
+
+ size = ALIGN(size, PA_SECTION_SIZE);
+ addr = min((unsigned long)iomem_resource.end,
+@@ -1209,16 +1188,12 @@ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops,
+
+ devmem->resource = devm_request_mem_region(device, addr, size,
+ dev_name(device));
+- if (!devmem->resource) {
+- ret = -ENOMEM;
+- goto error_no_resource;
+- }
++ if (!devmem->resource)
++ return ERR_PTR(-ENOMEM);
+ break;
+ }
+- if (!devmem->resource) {
+- ret = -ERANGE;
+- goto error_no_resource;
+- }
++ if (!devmem->resource)
++ return ERR_PTR(-ERANGE);
+
+ devmem->resource->desc = IORES_DESC_DEVICE_PRIVATE_MEMORY;
+ devmem->pfn_first = devmem->resource->start >> PAGE_SHIFT;
+@@ -1227,30 +1202,15 @@ struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops,
+
+ ret = hmm_devmem_pages_create(devmem);
+ if (ret)
+- goto error_pages;
+-
+- devres_add(device, devmem);
++ return ERR_PTR(ret);
+
+- ret = devm_add_action(device, hmm_devmem_ref_kill, &devmem->ref);
+- if (ret) {
+- hmm_devmem_remove(devmem);
++ ret = devm_add_action_or_reset(device, hmm_devmem_release, devmem);
++ if (ret)
+ return ERR_PTR(ret);
+- }
+
+ return devmem;
+-
+-error_pages:
+- devm_release_mem_region(device, devmem->resource->start,
+- resource_size(devmem->resource));
+-error_no_resource:
+-error_devm_add_action:
+- hmm_devmem_ref_kill(&devmem->ref);
+- hmm_devmem_ref_exit(&devmem->ref);
+-error_percpu_ref:
+- devres_free(devmem);
+- return ERR_PTR(ret);
+ }
+-EXPORT_SYMBOL(hmm_devmem_add);
++EXPORT_SYMBOL_GPL(hmm_devmem_add);
+
+ struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops,
+ struct device *device,
+@@ -1264,8 +1224,7 @@ struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops,
+
+ dev_pagemap_get_ops();
+
+- devmem = devres_alloc_node(&hmm_devmem_release, sizeof(*devmem),
+- GFP_KERNEL, dev_to_node(device));
++ devmem = devm_kzalloc(device, sizeof(*devmem), GFP_KERNEL);
+ if (!devmem)
+ return ERR_PTR(-ENOMEM);
+
+@@ -1279,12 +1238,12 @@ struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops,
+ ret = percpu_ref_init(&devmem->ref, &hmm_devmem_ref_release,
+ 0, GFP_KERNEL);
+ if (ret)
+- goto error_percpu_ref;
++ return ERR_PTR(ret);
+
+- ret = devm_add_action(device, hmm_devmem_ref_exit, &devmem->ref);
++ ret = devm_add_action_or_reset(device, hmm_devmem_ref_exit,
++ &devmem->ref);
+ if (ret)
+- goto error_devm_add_action;
+-
++ return ERR_PTR(ret);
+
+ devmem->pfn_first = devmem->resource->start >> PAGE_SHIFT;
+ devmem->pfn_last = devmem->pfn_first +
+@@ -1292,58 +1251,20 @@ struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops,
+
+ ret = hmm_devmem_pages_create(devmem);
+ if (ret)
+- goto error_devm_add_action;
++ return ERR_PTR(ret);
+
+- devres_add(device, devmem);
++ ret = devm_add_action_or_reset(device, hmm_devmem_release, devmem);
++ if (ret)
++ return ERR_PTR(ret);
+
+- ret = devm_add_action(device, hmm_devmem_ref_kill, &devmem->ref);
+- if (ret) {
+- hmm_devmem_remove(devmem);
++ ret = devm_add_action_or_reset(device, hmm_devmem_ref_kill,
++ &devmem->ref);
++ if (ret)
+ return ERR_PTR(ret);
+- }
+
+ return devmem;
+-
+-error_devm_add_action:
+- hmm_devmem_ref_kill(&devmem->ref);
+- hmm_devmem_ref_exit(&devmem->ref);
+-error_percpu_ref:
+- devres_free(devmem);
+- return ERR_PTR(ret);
+-}
+-EXPORT_SYMBOL(hmm_devmem_add_resource);
+-
+-/*
+- * hmm_devmem_remove() - remove device memory (kill and free ZONE_DEVICE)
+- *
+- * @devmem: hmm_devmem struct use to track and manage the ZONE_DEVICE memory
+- *
+- * This will hot-unplug memory that was hotplugged by hmm_devmem_add on behalf
+- * of the device driver. It will free struct page and remove the resource that
+- * reserved the physical address range for this device memory.
+- */
+-void hmm_devmem_remove(struct hmm_devmem *devmem)
+-{
+- resource_size_t start, size;
+- struct device *device;
+- bool cdm = false;
+-
+- if (!devmem)
+- return;
+-
+- device = devmem->device;
+- start = devmem->resource->start;
+- size = resource_size(devmem->resource);
+-
+- cdm = devmem->resource->desc == IORES_DESC_DEVICE_PUBLIC_MEMORY;
+- hmm_devmem_ref_kill(&devmem->ref);
+- hmm_devmem_ref_exit(&devmem->ref);
+- hmm_devmem_pages_remove(devmem);
+-
+- if (!cdm)
+- devm_release_mem_region(device, start, size);
+ }
+-EXPORT_SYMBOL(hmm_devmem_remove);
++EXPORT_SYMBOL_GPL(hmm_devmem_add_resource);
+
+ /*
+ * A device driver that wants to handle multiple devices memory through a
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index e79cb59552d9..9518aefd8cbb 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1666,6 +1666,9 @@ enum oom_status {
+
+ static enum oom_status mem_cgroup_oom(struct mem_cgroup *memcg, gfp_t mask, int order)
+ {
++ enum oom_status ret;
++ bool locked;
++
+ if (order > PAGE_ALLOC_COSTLY_ORDER)
+ return OOM_SKIPPED;
+
+@@ -1698,10 +1701,23 @@ static enum oom_status mem_cgroup_oom(struct mem_cgroup *memcg, gfp_t mask, int
+ return OOM_ASYNC;
+ }
+
++ mem_cgroup_mark_under_oom(memcg);
++
++ locked = mem_cgroup_oom_trylock(memcg);
++
++ if (locked)
++ mem_cgroup_oom_notify(memcg);
++
++ mem_cgroup_unmark_under_oom(memcg);
+ if (mem_cgroup_out_of_memory(memcg, mask, order))
+- return OOM_SUCCESS;
++ ret = OOM_SUCCESS;
++ else
++ ret = OOM_FAILED;
+
+- return OOM_FAILED;
++ if (locked)
++ mem_cgroup_oom_unlock(memcg);
++
++ return ret;
+ }
+
+ /**
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index f3f919728f5c..8a136ffda370 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -35,6 +35,7 @@
+ #include <linux/memblock.h>
+ #include <linux/bootmem.h>
+ #include <linux/compaction.h>
++#include <linux/rmap.h>
+
+ #include <asm/tlbflush.h>
+
+@@ -1393,6 +1394,21 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
+ pfn = page_to_pfn(compound_head(page))
+ + hpage_nr_pages(page) - 1;
+
++ /*
++ * HWPoison pages have elevated reference counts so the migration would
++ * fail on them. It also doesn't make any sense to migrate them in the
++ * first place. Still try to unmap such a page in case it is still mapped
++ * (e.g. current hwpoison implementation doesn't unmap KSM pages but keep
++ * the unmap as the catch all safety net).
++ */
++ if (PageHWPoison(page)) {
++ if (WARN_ON(PageLRU(page)))
++ isolate_lru_page(page);
++ if (page_mapped(page))
++ try_to_unmap(page, TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS);
++ continue;
++ }
++
+ if (!get_page_unless_zero(page))
+ continue;
+ /*
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 8810a6d7d67f..67aaf7ae22ff 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2208,7 +2208,8 @@ int try_to_unuse(unsigned int type, bool frontswap,
+ */
+ if (PageSwapCache(page) &&
+ likely(page_private(page) == entry.val) &&
+- !page_swapped(page))
++ (!PageTransCompound(page) ||
++ !swap_page_trans_huge_swapped(si, entry)))
+ delete_from_swap_cache(compound_head(page));
+
+ /*
+diff --git a/net/9p/client.c b/net/9p/client.c
+index deae53a7dffc..75b7bf7c7f07 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -181,6 +181,12 @@ static int parse_opts(char *opts, struct p9_client *clnt)
+ ret = r;
+ continue;
+ }
++ if (option < 4096) {
++ p9_debug(P9_DEBUG_ERROR,
++ "msize should be at least 4k\n");
++ ret = -EINVAL;
++ continue;
++ }
+ clnt->msize = option;
+ break;
+ case Opt_trans:
+@@ -993,10 +999,18 @@ static int p9_client_version(struct p9_client *c)
+ else if (!strncmp(version, "9P2000", 6))
+ c->proto_version = p9_proto_legacy;
+ else {
++ p9_debug(P9_DEBUG_ERROR,
++ "server returned an unknown version: %s\n", version);
+ err = -EREMOTEIO;
+ goto error;
+ }
+
++ if (msize < 4096) {
++ p9_debug(P9_DEBUG_ERROR,
++ "server returned a msize < 4096: %d\n", msize);
++ err = -EREMOTEIO;
++ goto error;
++ }
+ if (msize < c->msize)
+ c->msize = msize;
+
+@@ -1055,6 +1069,13 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
+ if (clnt->msize > clnt->trans_mod->maxsize)
+ clnt->msize = clnt->trans_mod->maxsize;
+
++ if (clnt->msize < 4096) {
++ p9_debug(P9_DEBUG_ERROR,
++ "Please specify a msize of at least 4k\n");
++ err = -EINVAL;
++ goto free_client;
++ }
++
+ err = p9_client_version(clnt);
+ if (err)
+ goto close_trans;
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 5f3c81e705c7..3a0171a65db3 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -7,6 +7,7 @@
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
+ * Copyright (c) 2016 Intel Deutschland GmbH
++ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -1951,6 +1952,8 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
+ WARN(local->open_count, "%s: open count remains %d\n",
+ wiphy_name(local->hw.wiphy), local->open_count);
+
++ ieee80211_txq_teardown_flows(local);
++
+ mutex_lock(&local->iflist_mtx);
+ list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
+ list_del(&sdata->list);
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 513627896204..68db2a356443 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1198,7 +1198,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ rtnl_unlock();
+ ieee80211_led_exit(local);
+ ieee80211_wep_free(local);
+- ieee80211_txq_teardown_flows(local);
+ fail_flows:
+ destroy_workqueue(local->workqueue);
+ fail_workqueue:
+@@ -1224,7 +1223,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
+ #if IS_ENABLED(CONFIG_IPV6)
+ unregister_inet6addr_notifier(&local->ifa6_notifier);
+ #endif
+- ieee80211_txq_teardown_flows(local);
+
+ rtnl_lock();
+
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index 7fa10d06cc51..534a604b75c2 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -556,6 +556,11 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
+ }
+
+ ieee80211_led_tx(local);
++
++ if (skb_has_frag_list(skb)) {
++ kfree_skb_list(skb_shinfo(skb)->frag_list);
++ skb_shinfo(skb)->frag_list = NULL;
++ }
+ }
+
+ /*
+diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
+index 4eef55da0878..8da228da53ae 100644
+--- a/net/netfilter/ipset/ip_set_list_set.c
++++ b/net/netfilter/ipset/ip_set_list_set.c
+@@ -531,8 +531,8 @@ nla_put_failure:
+ ret = -EMSGSIZE;
+ } else {
+ cb->args[IPSET_CB_ARG0] = i;
++ ipset_nest_end(skb, atd);
+ }
+- ipset_nest_end(skb, atd);
+ out:
+ rcu_read_unlock();
+ return ret;
+diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
+index b6d0f6deea86..9cd180bda092 100644
+--- a/net/netfilter/nf_conncount.c
++++ b/net/netfilter/nf_conncount.c
+@@ -427,7 +427,7 @@ insert_tree(struct net *net,
+ count = 1;
+ rbconn->list.count = count;
+
+- rb_link_node(&rbconn->node, parent, rbnode);
++ rb_link_node_rcu(&rbconn->node, parent, rbnode);
+ rb_insert_color(&rbconn->node, root);
+ out_unlock:
+ spin_unlock_bh(&nf_conncount_locks[hash % CONNCOUNT_LOCK_SLOTS]);
+diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
+index a975efd6b8c3..9da303461069 100644
+--- a/net/netfilter/nf_conntrack_seqadj.c
++++ b/net/netfilter/nf_conntrack_seqadj.c
+@@ -115,12 +115,12 @@ static void nf_ct_sack_block_adjust(struct sk_buff *skb,
+ /* TCP SACK sequence number adjustment */
+ static unsigned int nf_ct_sack_adjust(struct sk_buff *skb,
+ unsigned int protoff,
+- struct tcphdr *tcph,
+ struct nf_conn *ct,
+ enum ip_conntrack_info ctinfo)
+ {
+- unsigned int dir, optoff, optend;
++ struct tcphdr *tcph = (void *)skb->data + protoff;
+ struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
++ unsigned int dir, optoff, optend;
+
+ optoff = protoff + sizeof(struct tcphdr);
+ optend = protoff + tcph->doff * 4;
+@@ -128,6 +128,7 @@ static unsigned int nf_ct_sack_adjust(struct sk_buff *skb,
+ if (!skb_make_writable(skb, optend))
+ return 0;
+
++ tcph = (void *)skb->data + protoff;
+ dir = CTINFO2DIR(ctinfo);
+
+ while (optoff < optend) {
+@@ -207,7 +208,7 @@ int nf_ct_seq_adjust(struct sk_buff *skb,
+ ntohl(newack));
+ tcph->ack_seq = newack;
+
+- res = nf_ct_sack_adjust(skb, protoff, tcph, ct, ctinfo);
++ res = nf_ct_sack_adjust(skb, protoff, ct, ctinfo);
+ out:
+ spin_unlock_bh(&ct->lock);
+
+diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
+index e2b196054dfc..2268b10a9dcf 100644
+--- a/net/netfilter/nf_nat_core.c
++++ b/net/netfilter/nf_nat_core.c
+@@ -117,7 +117,8 @@ int nf_xfrm_me_harder(struct net *net, struct sk_buff *skb, unsigned int family)
+ dst = skb_dst(skb);
+ if (dst->xfrm)
+ dst = ((struct xfrm_dst *)dst)->route;
+- dst_hold(dst);
++ if (!dst_hold_safe(dst))
++ return -EHOSTUNREACH;
+
+ if (sk && !net_eq(net, sock_net(sk)))
+ sk = NULL;
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index fe0558b15fd3..ed9af46720e1 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1199,7 +1199,8 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
+ if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
+ goto nla_put_failure;
+
+- if (basechain->stats && nft_dump_stats(skb, basechain->stats))
++ if (rcu_access_pointer(basechain->stats) &&
++ nft_dump_stats(skb, rcu_dereference(basechain->stats)))
+ goto nla_put_failure;
+ }
+
+@@ -1375,7 +1376,8 @@ static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
+ return newstats;
+ }
+
+-static void nft_chain_stats_replace(struct nft_base_chain *chain,
++static void nft_chain_stats_replace(struct net *net,
++ struct nft_base_chain *chain,
+ struct nft_stats __percpu *newstats)
+ {
+ struct nft_stats __percpu *oldstats;
+@@ -1383,8 +1385,9 @@ static void nft_chain_stats_replace(struct nft_base_chain *chain,
+ if (newstats == NULL)
+ return;
+
+- if (chain->stats) {
+- oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES);
++ if (rcu_access_pointer(chain->stats)) {
++ oldstats = rcu_dereference_protected(chain->stats,
++ lockdep_commit_lock_is_held(net));
+ rcu_assign_pointer(chain->stats, newstats);
+ synchronize_rcu();
+ free_percpu(oldstats);
+@@ -1421,9 +1424,10 @@ static void nf_tables_chain_destroy(struct nft_ctx *ctx)
+ struct nft_base_chain *basechain = nft_base_chain(chain);
+
+ module_put(basechain->type->owner);
+- free_percpu(basechain->stats);
+- if (basechain->stats)
++ if (rcu_access_pointer(basechain->stats)) {
+ static_branch_dec(&nft_counters_enabled);
++ free_percpu(rcu_dereference_raw(basechain->stats));
++ }
+ kfree(chain->name);
+ kfree(basechain);
+ } else {
+@@ -1572,7 +1576,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
+ kfree(basechain);
+ return PTR_ERR(stats);
+ }
+- basechain->stats = stats;
++ rcu_assign_pointer(basechain->stats, stats);
+ static_branch_inc(&nft_counters_enabled);
+ }
+
+@@ -6145,7 +6149,8 @@ static void nft_chain_commit_update(struct nft_trans *trans)
+ return;
+
+ basechain = nft_base_chain(trans->ctx.chain);
+- nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
++ nft_chain_stats_replace(trans->ctx.net, basechain,
++ nft_trans_chain_stats(trans));
+
+ switch (nft_trans_chain_policy(trans)) {
+ case NF_DROP:
+diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
+index ffd5c0f9412b..60f258f2c707 100644
+--- a/net/netfilter/nf_tables_core.c
++++ b/net/netfilter/nf_tables_core.c
+@@ -101,7 +101,7 @@ static noinline void nft_update_chain_stats(const struct nft_chain *chain,
+ struct nft_stats *stats;
+
+ base_chain = nft_base_chain(chain);
+- if (!base_chain->stats)
++ if (!rcu_access_pointer(base_chain->stats))
+ return;
+
+ local_bh_disable();
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index 860f2a1bbb67..1a65f88d021a 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -1122,7 +1122,7 @@ static int svcauth_gss_legacy_init(struct svc_rqst *rqstp,
+ struct kvec *resv = &rqstp->rq_res.head[0];
+ struct rsi *rsip, rsikey;
+ int ret;
+- struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
++ struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
+
+ memset(&rsikey, 0, sizeof(rsikey));
+ ret = gss_read_verf(gc, argv, authp,
+@@ -1233,7 +1233,7 @@ static int svcauth_gss_proxy_init(struct svc_rqst *rqstp,
+ uint64_t handle;
+ int status;
+ int ret;
+- struct net *net = rqstp->rq_xprt->xpt_net;
++ struct net *net = SVC_NET(rqstp);
+ struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+
+ memset(&ud, 0, sizeof(ud));
+@@ -1424,7 +1424,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
+ __be32 *rpcstart;
+ __be32 *reject_stat = resv->iov_base + resv->iov_len;
+ int ret;
+- struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
++ struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
+
+ dprintk("RPC: svcauth_gss: argv->iov_len = %zd\n",
+ argv->iov_len);
+@@ -1714,7 +1714,7 @@ svcauth_gss_release(struct svc_rqst *rqstp)
+ struct rpc_gss_wire_cred *gc = &gsd->clcred;
+ struct xdr_buf *resbuf = &rqstp->rq_res;
+ int stat = -EINVAL;
+- struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
++ struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
+
+ if (gc->gc_proc != RPC_GSS_PROC_DATA)
+ goto out;
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index 109fbe591e7b..b6e8eccf2a52 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -54,6 +54,11 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail)
+ h->last_refresh = now;
+ }
+
++static void cache_fresh_locked(struct cache_head *head, time_t expiry,
++ struct cache_detail *detail);
++static void cache_fresh_unlocked(struct cache_head *head,
++ struct cache_detail *detail);
++
+ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
+ struct cache_head *key, int hash)
+ {
+@@ -95,6 +100,7 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
+ if (cache_is_expired(detail, tmp)) {
+ hlist_del_init(&tmp->cache_list);
+ detail->entries --;
++ cache_fresh_locked(tmp, 0, detail);
+ freeme = tmp;
+ break;
+ }
+@@ -110,8 +116,10 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
+ cache_get(new);
+ write_unlock(&detail->hash_lock);
+
+- if (freeme)
++ if (freeme) {
++ cache_fresh_unlocked(freeme, detail);
+ cache_put(freeme, detail);
++ }
+ return new;
+ }
+ EXPORT_SYMBOL_GPL(sunrpc_cache_lookup);
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 6b7539c0466e..7d8cce1dfcad 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2244,8 +2244,8 @@ static void xs_udp_setup_socket(struct work_struct *work)
+ trace_rpc_socket_connect(xprt, sock, 0);
+ status = 0;
+ out:
+- xprt_unlock_connect(xprt, transport);
+ xprt_clear_connecting(xprt);
++ xprt_unlock_connect(xprt, transport);
+ xprt_wake_pending_tasks(xprt, status);
+ }
+
+@@ -2480,8 +2480,8 @@ static void xs_tcp_setup_socket(struct work_struct *work)
+ }
+ status = -EAGAIN;
+ out:
+- xprt_unlock_connect(xprt, transport);
+ xprt_clear_connecting(xprt);
++ xprt_unlock_connect(xprt, transport);
+ xprt_wake_pending_tasks(xprt, status);
+ }
+
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index 7fab2891ce7f..a091c03abcb2 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -555,6 +555,9 @@ static struct tls_context *create_ctx(struct sock *sk)
+ return NULL;
+
+ icsk->icsk_ulp_data = ctx;
++ ctx->setsockopt = sk->sk_prot->setsockopt;
++ ctx->getsockopt = sk->sk_prot->getsockopt;
++ ctx->sk_proto_close = sk->sk_prot->close;
+ return ctx;
+ }
+
+@@ -685,9 +688,6 @@ static int tls_init(struct sock *sk)
+ rc = -ENOMEM;
+ goto out;
+ }
+- ctx->setsockopt = sk->sk_prot->setsockopt;
+- ctx->getsockopt = sk->sk_prot->getsockopt;
+- ctx->sk_proto_close = sk->sk_prot->close;
+
+ /* Build IPv6 TLS whenever the address of tcpv6 _prot changes */
+ if (ip_ver == TLSV6 &&
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 176edfefcbaa..295cd8d5554f 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -8993,8 +8993,10 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
+ if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
+ int r = validate_pae_over_nl80211(rdev, info);
+
+- if (r < 0)
++ if (r < 0) {
++ kzfree(connkeys);
+ return r;
++ }
+
+ ibss.control_port_over_nl80211 = true;
+ }
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index be3520e429c9..790b514f86b6 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -346,6 +346,12 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+
+ skb->sp->xvec[skb->sp->len++] = x;
+
++ skb_dst_force(skb);
++ if (!skb_dst(skb)) {
++ XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
++ goto drop;
++ }
++
+ lock:
+ spin_lock(&x->lock);
+
+@@ -385,7 +391,6 @@ lock:
+ XFRM_SKB_CB(skb)->seq.input.low = seq;
+ XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
+
+- skb_dst_force(skb);
+ dev_hold(skb->dev);
+
+ if (crypto_done)
+diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
+index 261995d37ced..6d20fbcde000 100644
+--- a/net/xfrm/xfrm_output.c
++++ b/net/xfrm/xfrm_output.c
+@@ -102,6 +102,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
+ skb_dst_force(skb);
+ if (!skb_dst(skb)) {
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
++ err = -EHOSTUNREACH;
+ goto error_nolock;
+ }
+
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 7a34990a68b1..cc0203efb584 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -794,7 +794,7 @@ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
+ {
+ spin_lock_bh(&net->xfrm.xfrm_state_lock);
+ si->sadcnt = net->xfrm.state_num;
+- si->sadhcnt = net->xfrm.state_hmask;
++ si->sadhcnt = net->xfrm.state_hmask + 1;
+ si->sadhmcnt = xfrm_state_hashmax;
+ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+ }
+diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl
+index 8081b6cf67d2..34414c6efad6 100755
+--- a/scripts/checkstack.pl
++++ b/scripts/checkstack.pl
+@@ -47,8 +47,8 @@ my (@stack, $re, $dre, $x, $xs, $funcre);
+ $xs = "[0-9a-f ]"; # hex character or space
+ $funcre = qr/^$x* <(.*)>:$/;
+ if ($arch eq 'aarch64') {
+- #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp,#-80]!
+- $re = qr/^.*stp.*sp,\#-([0-9]{1,8})\]\!/o;
++ #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]!
++ $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o;
+ } elsif ($arch eq 'arm') {
+ #c0008ffc: e24dd064 sub sp, sp, #100 ; 0x64
+ $re = qr/.*sub.*sp, sp, #(([0-9]{2}|[3-9])[0-9]{2})/o;
+diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
+index f4eadd3f7350..b63ef865ce1e 100644
+--- a/security/selinux/ss/policydb.c
++++ b/security/selinux/ss/policydb.c
+@@ -2108,6 +2108,7 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info,
+ {
+ int i, j, rc;
+ u32 nel, len;
++ __be64 prefixbuf[1];
+ __le32 buf[3];
+ struct ocontext *l, *c;
+ u32 nodebuf[8];
+@@ -2217,21 +2218,30 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info,
+ goto out;
+ break;
+ }
+- case OCON_IBPKEY:
+- rc = next_entry(nodebuf, fp, sizeof(u32) * 4);
++ case OCON_IBPKEY: {
++ u32 pkey_lo, pkey_hi;
++
++ rc = next_entry(prefixbuf, fp, sizeof(u64));
++ if (rc)
++ goto out;
++
++ /* we need to have subnet_prefix in CPU order */
++ c->u.ibpkey.subnet_prefix = be64_to_cpu(prefixbuf[0]);
++
++ rc = next_entry(buf, fp, sizeof(u32) * 2);
+ if (rc)
+ goto out;
+
+- c->u.ibpkey.subnet_prefix = be64_to_cpu(*((__be64 *)nodebuf));
++ pkey_lo = le32_to_cpu(buf[0]);
++ pkey_hi = le32_to_cpu(buf[1]);
+
+- if (nodebuf[2] > 0xffff ||
+- nodebuf[3] > 0xffff) {
++ if (pkey_lo > U16_MAX || pkey_hi > U16_MAX) {
+ rc = -EINVAL;
+ goto out;
+ }
+
+- c->u.ibpkey.low_pkey = le32_to_cpu(nodebuf[2]);
+- c->u.ibpkey.high_pkey = le32_to_cpu(nodebuf[3]);
++ c->u.ibpkey.low_pkey = pkey_lo;
++ c->u.ibpkey.high_pkey = pkey_hi;
+
+ rc = context_read_and_validate(&c->context[0],
+ p,
+@@ -2239,7 +2249,10 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info,
+ if (rc)
+ goto out;
+ break;
+- case OCON_IBENDPORT:
++ }
++ case OCON_IBENDPORT: {
++ u32 port;
++
+ rc = next_entry(buf, fp, sizeof(u32) * 2);
+ if (rc)
+ goto out;
+@@ -2249,12 +2262,13 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info,
+ if (rc)
+ goto out;
+
+- if (buf[1] > 0xff || buf[1] == 0) {
++ port = le32_to_cpu(buf[1]);
++ if (port > U8_MAX || port == 0) {
+ rc = -EINVAL;
+ goto out;
+ }
+
+- c->u.ibendport.port = le32_to_cpu(buf[1]);
++ c->u.ibendport.port = port;
+
+ rc = context_read_and_validate(&c->context[0],
+ p,
+@@ -2262,7 +2276,8 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info,
+ if (rc)
+ goto out;
+ break;
+- }
++ } /* end case */
++ } /* end switch */
+ }
+ }
+ rc = 0;
+@@ -3105,6 +3120,7 @@ static int ocontext_write(struct policydb *p, struct policydb_compat_info *info,
+ {
+ unsigned int i, j, rc;
+ size_t nel, len;
++ __be64 prefixbuf[1];
+ __le32 buf[3];
+ u32 nodebuf[8];
+ struct ocontext *c;
+@@ -3192,12 +3208,17 @@ static int ocontext_write(struct policydb *p, struct policydb_compat_info *info,
+ return rc;
+ break;
+ case OCON_IBPKEY:
+- *((__be64 *)nodebuf) = cpu_to_be64(c->u.ibpkey.subnet_prefix);
++ /* subnet_prefix is in CPU order */
++ prefixbuf[0] = cpu_to_be64(c->u.ibpkey.subnet_prefix);
+
+- nodebuf[2] = cpu_to_le32(c->u.ibpkey.low_pkey);
+- nodebuf[3] = cpu_to_le32(c->u.ibpkey.high_pkey);
++ rc = put_entry(prefixbuf, sizeof(u64), 1, fp);
++ if (rc)
++ return rc;
++
++ buf[0] = cpu_to_le32(c->u.ibpkey.low_pkey);
++ buf[1] = cpu_to_le32(c->u.ibpkey.high_pkey);
+
+- rc = put_entry(nodebuf, sizeof(u32), 4, fp);
++ rc = put_entry(buf, sizeof(u32), 2, fp);
+ if (rc)
+ return rc;
+ rc = context_write(p, &c->context[0], fp);
+diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c
+index 598d140bb7cb..5fc497c6d738 100644
+--- a/sound/pci/cs46xx/dsp_spos.c
++++ b/sound/pci/cs46xx/dsp_spos.c
+@@ -903,6 +903,9 @@ int cs46xx_dsp_proc_done (struct snd_cs46xx *chip)
+ struct dsp_spos_instance * ins = chip->dsp_spos_instance;
+ int i;
+
++ if (!ins)
++ return 0;
++
+ snd_info_free_entry(ins->proc_sym_info_entry);
+ ins->proc_sym_info_entry = NULL;
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index a105947eaf55..746a72e23cf9 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -246,7 +246,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
+ h1 = snd_usb_find_csint_desc(host_iface->extra,
+ host_iface->extralen,
+ NULL, UAC_HEADER);
+- if (!h1) {
++ if (!h1 || h1->bLength < sizeof(*h1)) {
+ dev_err(&dev->dev, "cannot find UAC_HEADER\n");
+ return -EINVAL;
+ }
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index c63c84b54969..e7d441d0e839 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -753,8 +753,9 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
+ struct uac_mixer_unit_descriptor *desc)
+ {
+ int mu_channels;
++ void *c;
+
+- if (desc->bLength < 11)
++ if (desc->bLength < sizeof(*desc))
+ return -EINVAL;
+ if (!desc->bNrInPins)
+ return -EINVAL;
+@@ -763,6 +764,8 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
+ case UAC_VERSION_1:
+ case UAC_VERSION_2:
+ default:
++ if (desc->bLength < sizeof(*desc) + desc->bNrInPins + 1)
++ return 0; /* no bmControls -> skip */
+ mu_channels = uac_mixer_unit_bNrChannels(desc);
+ break;
+ case UAC_VERSION_3:
+@@ -772,7 +775,11 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
+ }
+
+ if (!mu_channels)
+- return -EINVAL;
++ return 0;
++
++ c = uac_mixer_unit_bmControls(desc, state->mixer->protocol);
++ if (c - (void *)desc + (mu_channels - 1) / 8 >= desc->bLength)
++ return 0; /* no bmControls -> skip */
+
+ return mu_channels;
+ }
+@@ -944,7 +951,7 @@ static int check_input_term(struct mixer_build *state, int id,
+ struct uac_mixer_unit_descriptor *d = p1;
+
+ err = uac_mixer_unit_get_channels(state, d);
+- if (err < 0)
++ if (err <= 0)
+ return err;
+
+ term->channels = err;
+@@ -2068,11 +2075,15 @@ static int parse_audio_input_terminal(struct mixer_build *state, int unitid,
+
+ if (state->mixer->protocol == UAC_VERSION_2) {
+ struct uac2_input_terminal_descriptor *d_v2 = raw_desc;
++ if (d_v2->bLength < sizeof(*d_v2))
++ return -EINVAL;
+ control = UAC2_TE_CONNECTOR;
+ term_id = d_v2->bTerminalID;
+ bmctls = le16_to_cpu(d_v2->bmControls);
+ } else if (state->mixer->protocol == UAC_VERSION_3) {
+ struct uac3_input_terminal_descriptor *d_v3 = raw_desc;
++ if (d_v3->bLength < sizeof(*d_v3))
++ return -EINVAL;
+ control = UAC3_TE_INSERTION;
+ term_id = d_v3->bTerminalID;
+ bmctls = le32_to_cpu(d_v3->bmControls);
+@@ -2118,7 +2129,7 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
+ if (err < 0)
+ continue;
+ /* no bmControls field (e.g. Maya44) -> ignore */
+- if (desc->bLength <= 10 + input_pins)
++ if (!num_outs)
+ continue;
+ err = check_input_term(state, desc->baSourceID[pin], &iterm);
+ if (err < 0)
+@@ -2314,7 +2325,7 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ char *name)
+ {
+ struct uac_processing_unit_descriptor *desc = raw_desc;
+- int num_ins = desc->bNrInPins;
++ int num_ins;
+ struct usb_mixer_elem_info *cval;
+ struct snd_kcontrol *kctl;
+ int i, err, nameid, type, len;
+@@ -2329,7 +2340,13 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ 0, NULL, default_value_info
+ };
+
+- if (desc->bLength < 13 || desc->bLength < 13 + num_ins ||
++ if (desc->bLength < 13) {
++ usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid);
++ return -EINVAL;
++ }
++
++ num_ins = desc->bNrInPins;
++ if (desc->bLength < 13 + num_ins ||
+ desc->bLength < num_ins + uac_processing_unit_bControlSize(desc, state->mixer->protocol)) {
+ usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid);
+ return -EINVAL;
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 1c73b9ed44a6..57c6209a4ccb 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3326,6 +3326,9 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ }
+ }
+ },
++ {
++ .ifnum = -1
++ },
+ }
+ }
+ },
+@@ -3374,6 +3377,9 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ }
+ }
+ },
++ {
++ .ifnum = -1
++ },
+ }
+ }
+ },
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index 67cf849aa16b..d9e3de495c16 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -596,12 +596,8 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip,
+ csep = snd_usb_find_desc(alts->extra, alts->extralen, NULL, USB_DT_CS_ENDPOINT);
+
+ if (!csep || csep->bLength < 7 ||
+- csep->bDescriptorSubtype != UAC_EP_GENERAL) {
+- usb_audio_warn(chip,
+- "%u:%d : no or invalid class specific endpoint descriptor\n",
+- iface_no, altsd->bAlternateSetting);
+- return 0;
+- }
++ csep->bDescriptorSubtype != UAC_EP_GENERAL)
++ goto error;
+
+ if (protocol == UAC_VERSION_1) {
+ attributes = csep->bmAttributes;
+@@ -609,6 +605,8 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip,
+ struct uac2_iso_endpoint_descriptor *csep2 =
+ (struct uac2_iso_endpoint_descriptor *) csep;
+
++ if (csep2->bLength < sizeof(*csep2))
++ goto error;
+ attributes = csep->bmAttributes & UAC_EP_CS_ATTR_FILL_MAX;
+
+ /* emulate the endpoint attributes of a v1 device */
+@@ -618,12 +616,20 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip,
+ struct uac3_iso_endpoint_descriptor *csep3 =
+ (struct uac3_iso_endpoint_descriptor *) csep;
+
++ if (csep3->bLength < sizeof(*csep3))
++ goto error;
+ /* emulate the endpoint attributes of a v1 device */
+ if (le32_to_cpu(csep3->bmControls) & UAC2_CONTROL_PITCH)
+ attributes |= UAC_EP_CS_ATTR_PITCH_CONTROL;
+ }
+
+ return attributes;
++
++ error:
++ usb_audio_warn(chip,
++ "%u:%d : no or invalid class specific endpoint descriptor\n",
++ iface_no, altsd->bAlternateSetting);
++ return 0;
+ }
+
+ /* find an input terminal descriptor (either UAC1 or UAC2) with the given
+@@ -631,13 +637,17 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip,
+ */
+ static void *
+ snd_usb_find_input_terminal_descriptor(struct usb_host_interface *ctrl_iface,
+- int terminal_id)
++ int terminal_id, bool uac23)
+ {
+ struct uac2_input_terminal_descriptor *term = NULL;
++ size_t minlen = uac23 ? sizeof(struct uac2_input_terminal_descriptor) :
++ sizeof(struct uac_input_terminal_descriptor);
+
+ while ((term = snd_usb_find_csint_desc(ctrl_iface->extra,
+ ctrl_iface->extralen,
+ term, UAC_INPUT_TERMINAL))) {
++ if (term->bLength < minlen)
++ continue;
+ if (term->bTerminalID == terminal_id)
+ return term;
+ }
+@@ -655,7 +665,8 @@ snd_usb_find_output_terminal_descriptor(struct usb_host_interface *ctrl_iface,
+ while ((term = snd_usb_find_csint_desc(ctrl_iface->extra,
+ ctrl_iface->extralen,
+ term, UAC_OUTPUT_TERMINAL))) {
+- if (term->bTerminalID == terminal_id)
++ if (term->bLength >= sizeof(*term) &&
++ term->bTerminalID == terminal_id)
+ return term;
+ }
+
+@@ -729,7 +740,8 @@ snd_usb_get_audioformat_uac12(struct snd_usb_audio *chip,
+ format = le16_to_cpu(as->wFormatTag); /* remember the format value */
+
+ iterm = snd_usb_find_input_terminal_descriptor(chip->ctrl_intf,
+- as->bTerminalLink);
++ as->bTerminalLink,
++ false);
+ if (iterm) {
+ num_channels = iterm->bNrChannels;
+ chconfig = le16_to_cpu(iterm->wChannelConfig);
+@@ -764,7 +776,8 @@ snd_usb_get_audioformat_uac12(struct snd_usb_audio *chip,
+ * to extract the clock
+ */
+ input_term = snd_usb_find_input_terminal_descriptor(chip->ctrl_intf,
+- as->bTerminalLink);
++ as->bTerminalLink,
++ true);
+ if (input_term) {
+ clock = input_term->bCSourceID;
+ if (!chconfig && (num_channels == input_term->bNrChannels))
+@@ -998,7 +1011,8 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip,
+ * to extract the clock
+ */
+ input_term = snd_usb_find_input_terminal_descriptor(chip->ctrl_intf,
+- as->bTerminalLink);
++ as->bTerminalLink,
++ true);
+ if (input_term) {
+ clock = input_term->bCSourceID;
+ goto found_clock;
+diff --git a/tools/testing/nvdimm/test/iomap.c b/tools/testing/nvdimm/test/iomap.c
+index ff9d3a5825e1..c6635fee27d8 100644
+--- a/tools/testing/nvdimm/test/iomap.c
++++ b/tools/testing/nvdimm/test/iomap.c
+@@ -104,16 +104,29 @@ void *__wrap_devm_memremap(struct device *dev, resource_size_t offset,
+ }
+ EXPORT_SYMBOL(__wrap_devm_memremap);
+
++static void nfit_test_kill(void *_pgmap)
++{
++ struct dev_pagemap *pgmap = _pgmap;
++
++ pgmap->kill(pgmap->ref);
++}
++
+ void *__wrap_devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap)
+ {
+ resource_size_t offset = pgmap->res.start;
+ struct nfit_test_resource *nfit_res = get_nfit_res(offset);
+
+- if (nfit_res)
++ if (nfit_res) {
++ int rc;
++
++ rc = devm_add_action_or_reset(dev, nfit_test_kill, pgmap);
++ if (rc)
++ return ERR_PTR(rc);
+ return nfit_res->buf + offset - nfit_res->res.start;
++ }
+ return devm_memremap_pages(dev, pgmap);
+ }
+-EXPORT_SYMBOL(__wrap_devm_memremap_pages);
++EXPORT_SYMBOL_GPL(__wrap_devm_memremap_pages);
+
+ pfn_t __wrap_phys_to_pfn_t(phys_addr_t addr, unsigned long flags)
+ {
+diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
+index fb22bccfbc8a..7ef45a4a3cba 100644
+--- a/tools/virtio/linux/kernel.h
++++ b/tools/virtio/linux/kernel.h
+@@ -23,6 +23,10 @@
+ #define PAGE_MASK (~(PAGE_SIZE-1))
+ #define PAGE_ALIGN(x) ((x + PAGE_SIZE - 1) & PAGE_MASK)
+
++/* generic data direction definitions */
++#define READ 0
++#define WRITE 1
++
+ typedef unsigned long long phys_addr_t;
+ typedef unsigned long long dma_addr_t;
+ typedef size_t __kernel_size_t;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-01-16 23:32 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-01-16 23:32 UTC (permalink / raw
To: gentoo-commits
commit: d15efad0d3fb3fd3b56902ecb343a9830a113c3e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 16 23:32:13 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jan 16 23:32:13 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d15efad0
proj/linux-patches: Linux patch 4.19.16
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1015_linux-4.19.16.patch | 1744 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1748 insertions(+)
diff --git a/0000_README b/0000_README
index 2970cec..3ddd86b 100644
--- a/0000_README
+++ b/0000_README
@@ -103,6 +103,10 @@ Patch: 1014_linux-4.19.15.patch
From: http://www.kernel.org
Desc: Linux 4.19.15
+Patch: 1015_linux-4.19.16.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.16
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1015_linux-4.19.16.patch b/1015_linux-4.19.16.patch
new file mode 100644
index 0000000..0f57c61
--- /dev/null
+++ b/1015_linux-4.19.16.patch
@@ -0,0 +1,1744 @@
+diff --git a/Makefile b/Makefile
+index 0e30d48274fa..e8cb4875b86d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 15
++SUBLEVEL = 16
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
+index 7be666062c7c..010212d35700 100644
+--- a/arch/arm64/kernel/sys_compat.c
++++ b/arch/arm64/kernel/sys_compat.c
+@@ -66,12 +66,11 @@ do_compat_cache_op(unsigned long start, unsigned long end, int flags)
+ /*
+ * Handle all unrecognised system calls.
+ */
+-long compat_arm_syscall(struct pt_regs *regs)
++long compat_arm_syscall(struct pt_regs *regs, int scno)
+ {
+ siginfo_t info;
+- unsigned int no = regs->regs[7];
+
+- switch (no) {
++ switch (scno) {
+ /*
+ * Flush a region from virtual address 'r0' to virtual address 'r1'
+ * _exclusive_. There is no alignment requirement on either address;
+@@ -107,7 +106,7 @@ long compat_arm_syscall(struct pt_regs *regs)
+ * way the calling program can gracefully determine whether
+ * a feature is supported.
+ */
+- if (no < __ARM_NR_COMPAT_END)
++ if (scno < __ARM_NR_COMPAT_END)
+ return -ENOSYS;
+ break;
+ }
+@@ -119,6 +118,6 @@ long compat_arm_syscall(struct pt_regs *regs)
+ info.si_addr = (void __user *)instruction_pointer(regs) -
+ (compat_thumb_mode(regs) ? 2 : 4);
+
+- arm64_notify_die("Oops - bad compat syscall(2)", regs, &info, no);
++ arm64_notify_die("Oops - bad compat syscall(2)", regs, &info, scno);
+ return 0;
+ }
+diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
+index 032d22312881..5610ac01c1ec 100644
+--- a/arch/arm64/kernel/syscall.c
++++ b/arch/arm64/kernel/syscall.c
+@@ -13,16 +13,15 @@
+ #include <asm/thread_info.h>
+ #include <asm/unistd.h>
+
+-long compat_arm_syscall(struct pt_regs *regs);
+-
++long compat_arm_syscall(struct pt_regs *regs, int scno);
+ long sys_ni_syscall(void);
+
+-asmlinkage long do_ni_syscall(struct pt_regs *regs)
++static long do_ni_syscall(struct pt_regs *regs, int scno)
+ {
+ #ifdef CONFIG_COMPAT
+ long ret;
+ if (is_compat_task()) {
+- ret = compat_arm_syscall(regs);
++ ret = compat_arm_syscall(regs, scno);
+ if (ret != -ENOSYS)
+ return ret;
+ }
+@@ -47,7 +46,7 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno,
+ syscall_fn = syscall_table[array_index_nospec(scno, sc_nr)];
+ ret = __invoke_syscall(regs, syscall_fn);
+ } else {
+- ret = do_ni_syscall(regs);
++ ret = do_ni_syscall(regs, scno);
+ }
+
+ regs->regs[0] = ret;
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index abb92c341693..807d06a7acac 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -213,7 +213,7 @@ static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+ static enum spectre_v2_user_mitigation spectre_v2_user __ro_after_init =
+ SPECTRE_V2_USER_NONE;
+
+-#ifdef RETPOLINE
++#ifdef CONFIG_RETPOLINE
+ static bool spectre_v2_bad_module;
+
+ bool retpoline_module_ok(bool has_retpoline)
+diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
+index e938576e58cb..e48eebc27b81 100644
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -951,9 +951,10 @@ static int rc_dma_get_range(struct device *dev, u64 *size)
+ {
+ struct acpi_iort_node *node;
+ struct acpi_iort_root_complex *rc;
++ struct pci_bus *pbus = to_pci_dev(dev)->bus;
+
+ node = iort_scan_node(ACPI_IORT_NODE_PCI_ROOT_COMPLEX,
+- iort_match_node_callback, dev);
++ iort_match_node_callback, &pbus->dev);
+ if (!node || node->revision < 1)
+ return -ENODEV;
+
+diff --git a/drivers/acpi/pmic/intel_pmic_xpower.c b/drivers/acpi/pmic/intel_pmic_xpower.c
+index 316e55174aa9..bb5391f59b8b 100644
+--- a/drivers/acpi/pmic/intel_pmic_xpower.c
++++ b/drivers/acpi/pmic/intel_pmic_xpower.c
+@@ -27,8 +27,11 @@
+ #define GPI1_LDO_ON (3 << 0)
+ #define GPI1_LDO_OFF (4 << 0)
+
+-#define AXP288_ADC_TS_PIN_GPADC 0xf2
+-#define AXP288_ADC_TS_PIN_ON 0xf3
++#define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0)
++#define AXP288_ADC_TS_CURRENT_OFF (0 << 0)
++#define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0)
++#define AXP288_ADC_TS_CURRENT_ON_ONDEMAND (2 << 0)
++#define AXP288_ADC_TS_CURRENT_ON (3 << 0)
+
+ static struct pmic_table power_table[] = {
+ {
+@@ -211,22 +214,44 @@ static int intel_xpower_pmic_update_power(struct regmap *regmap, int reg,
+ */
+ static int intel_xpower_pmic_get_raw_temp(struct regmap *regmap, int reg)
+ {
++ int ret, adc_ts_pin_ctrl;
+ u8 buf[2];
+- int ret;
+
+- ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL,
+- AXP288_ADC_TS_PIN_GPADC);
++ /*
++ * The current-source used for the battery temp-sensor (TS) is shared
++ * with the GPADC. For proper fuel-gauge and charger operation the TS
++ * current-source needs to be permanently on. But to read the GPADC we
++ * need to temporary switch the TS current-source to ondemand, so that
++ * the GPADC can use it, otherwise we will always read an all 0 value.
++ *
++ * Note that the switching from on to on-ondemand is not necessary
++ * when the TS current-source is off (this happens on devices which
++ * do not use the TS-pin).
++ */
++ ret = regmap_read(regmap, AXP288_ADC_TS_PIN_CTRL, &adc_ts_pin_ctrl);
+ if (ret)
+ return ret;
+
+- /* After switching to the GPADC pin give things some time to settle */
+- usleep_range(6000, 10000);
++ if (adc_ts_pin_ctrl & AXP288_ADC_TS_CURRENT_ON_OFF_MASK) {
++ ret = regmap_update_bits(regmap, AXP288_ADC_TS_PIN_CTRL,
++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
++ AXP288_ADC_TS_CURRENT_ON_ONDEMAND);
++ if (ret)
++ return ret;
++
++ /* Wait a bit after switching the current-source */
++ usleep_range(6000, 10000);
++ }
+
+ ret = regmap_bulk_read(regmap, AXP288_GP_ADC_H, buf, 2);
+ if (ret == 0)
+ ret = (buf[0] << 4) + ((buf[1] >> 4) & 0x0f);
+
+- regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON);
++ if (adc_ts_pin_ctrl & AXP288_ADC_TS_CURRENT_ON_OFF_MASK) {
++ regmap_update_bits(regmap, AXP288_ADC_TS_PIN_CTRL,
++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
++ AXP288_ADC_TS_CURRENT_ON);
++ }
+
+ return ret;
+ }
+diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
+index 1b475bc1ae16..665e93ca0b40 100644
+--- a/drivers/acpi/power.c
++++ b/drivers/acpi/power.c
+@@ -131,6 +131,23 @@ void acpi_power_resources_list_free(struct list_head *list)
+ }
+ }
+
++static bool acpi_power_resource_is_dup(union acpi_object *package,
++ unsigned int start, unsigned int i)
++{
++ acpi_handle rhandle, dup;
++ unsigned int j;
++
++ /* The caller is expected to check the package element types */
++ rhandle = package->package.elements[i].reference.handle;
++ for (j = start; j < i; j++) {
++ dup = package->package.elements[j].reference.handle;
++ if (dup == rhandle)
++ return true;
++ }
++
++ return false;
++}
++
+ int acpi_extract_power_resources(union acpi_object *package, unsigned int start,
+ struct list_head *list)
+ {
+@@ -150,6 +167,11 @@ int acpi_extract_power_resources(union acpi_object *package, unsigned int start,
+ err = -ENODEV;
+ break;
+ }
++
++ /* Some ACPI tables contain duplicate power resource references */
++ if (acpi_power_resource_is_dup(package, start, i))
++ continue;
++
+ err = acpi_add_power_resource(rhandle);
+ if (err)
+ break;
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 73ed5f3a862d..585378bc988c 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -5982,7 +5982,6 @@ static ssize_t do_rbd_remove(struct bus_type *bus,
+ struct list_head *tmp;
+ int dev_id;
+ char opt_buf[6];
+- bool already = false;
+ bool force = false;
+ int ret;
+
+@@ -6015,13 +6014,13 @@ static ssize_t do_rbd_remove(struct bus_type *bus,
+ spin_lock_irq(&rbd_dev->lock);
+ if (rbd_dev->open_count && !force)
+ ret = -EBUSY;
+- else
+- already = test_and_set_bit(RBD_DEV_FLAG_REMOVING,
+- &rbd_dev->flags);
++ else if (test_and_set_bit(RBD_DEV_FLAG_REMOVING,
++ &rbd_dev->flags))
++ ret = -EINPROGRESS;
+ spin_unlock_irq(&rbd_dev->lock);
+ }
+ spin_unlock(&rbd_dev_list_lock);
+- if (ret < 0 || already)
++ if (ret)
+ return ret;
+
+ if (force) {
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index 50b1551ba894..3f0693439486 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -52,9 +52,9 @@ scmi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)
+ int ret;
+ struct scmi_data *priv = policy->driver_data;
+ struct scmi_perf_ops *perf_ops = handle->perf_ops;
+- u64 freq = policy->freq_table[index].frequency * 1000;
++ u64 freq = policy->freq_table[index].frequency;
+
+- ret = perf_ops->freq_set(handle, priv->domain_id, freq, false);
++ ret = perf_ops->freq_set(handle, priv->domain_id, freq * 1000, false);
+ if (!ret)
+ arch_set_freq_scale(policy->related_cpus, freq,
+ policy->cpuinfo.max_freq);
+diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
+index cb88528e7b10..e44e567bd789 100644
+--- a/drivers/gpu/drm/Kconfig
++++ b/drivers/gpu/drm/Kconfig
+@@ -110,6 +110,26 @@ config DRM_FBDEV_OVERALLOC
+ is 100. Typical values for double buffering will be 200,
+ triple buffering 300.
+
++config DRM_FBDEV_LEAK_PHYS_SMEM
++ bool "Shamelessly allow leaking of fbdev physical address (DANGEROUS)"
++ depends on DRM_FBDEV_EMULATION && EXPERT
++ default n
++ help
++ In order to keep user-space compatibility, we want in certain
++ use-cases to keep leaking the fbdev physical address to the
++ user-space program handling the fbdev buffer.
++ This affects, not only, Amlogic, Allwinner or Rockchip devices
++ with ARM Mali GPUs using an userspace Blob.
++ This option is not supported by upstream developers and should be
++ removed as soon as possible and be considered as a broken and
++ legacy behaviour from a modern fbdev device driver.
++
++ Please send any bug reports when using this to your proprietary
++ software vendor that requires this.
++
++ If in doubt, say "N" or spread the word to your closed source
++ library vendor.
++
+ config DRM_LOAD_EDID_FIRMWARE
+ bool "Allow to specify an EDID data set instead of probing for it"
+ depends on DRM
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 8e26e1ca14c6..b40e9c76af0c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -753,6 +753,7 @@ static const struct pci_device_id pciidlist[] = {
+ /* VEGAM */
+ {0x1002, 0x694C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM},
+ {0x1002, 0x694E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM},
++ {0x1002, 0x694F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM},
+ /* Vega 10 */
+ {0x1002, 0x6860, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+ {0x1002, 0x6861, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index d792735f1365..a851bb07443f 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -565,22 +565,36 @@ static void s3_handle_mst(struct drm_device *dev, bool suspend)
+ {
+ struct amdgpu_dm_connector *aconnector;
+ struct drm_connector *connector;
++ struct drm_dp_mst_topology_mgr *mgr;
++ int ret;
++ bool need_hotplug = false;
+
+ drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
+
+- list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+- aconnector = to_amdgpu_dm_connector(connector);
+- if (aconnector->dc_link->type == dc_connection_mst_branch &&
+- !aconnector->mst_port) {
++ list_for_each_entry(connector, &dev->mode_config.connector_list,
++ head) {
++ aconnector = to_amdgpu_dm_connector(connector);
++ if (aconnector->dc_link->type != dc_connection_mst_branch ||
++ aconnector->mst_port)
++ continue;
+
+- if (suspend)
+- drm_dp_mst_topology_mgr_suspend(&aconnector->mst_mgr);
+- else
+- drm_dp_mst_topology_mgr_resume(&aconnector->mst_mgr);
+- }
++ mgr = &aconnector->mst_mgr;
++
++ if (suspend) {
++ drm_dp_mst_topology_mgr_suspend(mgr);
++ } else {
++ ret = drm_dp_mst_topology_mgr_resume(mgr);
++ if (ret < 0) {
++ drm_dp_mst_topology_mgr_set_mst(mgr, false);
++ need_hotplug = true;
++ }
++ }
+ }
+
+ drm_modeset_unlock(&dev->mode_config.connection_mutex);
++
++ if (need_hotplug)
++ drm_kms_helper_hotplug_event(dev);
+ }
+
+ static int dm_hw_init(void *handle)
+@@ -736,7 +750,6 @@ static int dm_resume(void *handle)
+ struct drm_plane_state *new_plane_state;
+ struct dm_plane_state *dm_new_plane_state;
+ enum dc_connection_type new_connection_type = dc_connection_none;
+- int ret;
+ int i;
+
+ /* power on hardware */
+@@ -809,13 +822,13 @@ static int dm_resume(void *handle)
+ }
+ }
+
+- ret = drm_atomic_helper_resume(ddev, dm->cached_state);
++ drm_atomic_helper_resume(ddev, dm->cached_state);
+
+ dm->cached_state = NULL;
+
+ amdgpu_dm_irq_resume_late(adev);
+
+- return ret;
++ return 0;
+ }
+
+ static const struct amd_ip_funcs amdgpu_dm_funcs = {
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index fced3c1c2ef5..7c89785fd731 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -2457,11 +2457,11 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx, int option)
+ {
+ struct dc *core_dc = pipe_ctx->stream->ctx->dc;
+
++ core_dc->hwss.blank_stream(pipe_ctx);
++
+ if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
+ deallocate_mst_payload(pipe_ctx);
+
+- core_dc->hwss.blank_stream(pipe_ctx);
+-
+ core_dc->hwss.disable_stream(pipe_ctx, option);
+
+ disable_link(pipe_ctx->stream->sink->link, pipe_ctx->stream->signal);
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 9214c8b02484..b5b9f15549c2 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -56,6 +56,25 @@ MODULE_PARM_DESC(drm_fbdev_overalloc,
+ "Overallocation of the fbdev buffer (%) [default="
+ __MODULE_STRING(CONFIG_DRM_FBDEV_OVERALLOC) "]");
+
++/*
++ * In order to keep user-space compatibility, we want in certain use-cases
++ * to keep leaking the fbdev physical address to the user-space program
++ * handling the fbdev buffer.
++ * This is a bad habit essentially kept into closed source opengl driver
++ * that should really be moved into open-source upstream projects instead
++ * of using legacy physical addresses in user space to communicate with
++ * other out-of-tree kernel modules.
++ *
++ * This module_param *should* be removed as soon as possible and be
++ * considered as a broken and legacy behaviour from a modern fbdev device.
++ */
++#if IS_ENABLED(CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM)
++static bool drm_leak_fbdev_smem = false;
++module_param_unsafe(drm_leak_fbdev_smem, bool, 0600);
++MODULE_PARM_DESC(fbdev_emulation,
++ "Allow unsafe leaking fbdev physical smem address [default=false]");
++#endif
++
+ static LIST_HEAD(kernel_fb_helper_list);
+ static DEFINE_MUTEX(kernel_fb_helper_lock);
+
+@@ -1602,6 +1621,64 @@ static bool drm_fb_pixel_format_equal(const struct fb_var_screeninfo *var_1,
+ var_1->transp.msb_right == var_2->transp.msb_right;
+ }
+
++static void drm_fb_helper_fill_pixel_fmt(struct fb_var_screeninfo *var,
++ u8 depth)
++{
++ switch (depth) {
++ case 8:
++ var->red.offset = 0;
++ var->green.offset = 0;
++ var->blue.offset = 0;
++ var->red.length = 8; /* 8bit DAC */
++ var->green.length = 8;
++ var->blue.length = 8;
++ var->transp.offset = 0;
++ var->transp.length = 0;
++ break;
++ case 15:
++ var->red.offset = 10;
++ var->green.offset = 5;
++ var->blue.offset = 0;
++ var->red.length = 5;
++ var->green.length = 5;
++ var->blue.length = 5;
++ var->transp.offset = 15;
++ var->transp.length = 1;
++ break;
++ case 16:
++ var->red.offset = 11;
++ var->green.offset = 5;
++ var->blue.offset = 0;
++ var->red.length = 5;
++ var->green.length = 6;
++ var->blue.length = 5;
++ var->transp.offset = 0;
++ break;
++ case 24:
++ var->red.offset = 16;
++ var->green.offset = 8;
++ var->blue.offset = 0;
++ var->red.length = 8;
++ var->green.length = 8;
++ var->blue.length = 8;
++ var->transp.offset = 0;
++ var->transp.length = 0;
++ break;
++ case 32:
++ var->red.offset = 16;
++ var->green.offset = 8;
++ var->blue.offset = 0;
++ var->red.length = 8;
++ var->green.length = 8;
++ var->blue.length = 8;
++ var->transp.offset = 24;
++ var->transp.length = 8;
++ break;
++ default:
++ break;
++ }
++}
++
+ /**
+ * drm_fb_helper_check_var - implementation for &fb_ops.fb_check_var
+ * @var: screeninfo to check
+@@ -1631,6 +1708,20 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
+ return -EINVAL;
+ }
+
++ /*
++ * Workaround for SDL 1.2, which is known to be setting all pixel format
++ * fields values to zero in some cases. We treat this situation as a
++ * kind of "use some reasonable autodetected values".
++ */
++ if (!var->red.offset && !var->green.offset &&
++ !var->blue.offset && !var->transp.offset &&
++ !var->red.length && !var->green.length &&
++ !var->blue.length && !var->transp.length &&
++ !var->red.msb_right && !var->green.msb_right &&
++ !var->blue.msb_right && !var->transp.msb_right) {
++ drm_fb_helper_fill_pixel_fmt(var, fb->format->depth);
++ }
++
+ /*
+ * drm fbdev emulation doesn't support changing the pixel format at all,
+ * so reject all pixel format changing requests.
+@@ -1942,59 +2033,7 @@ void drm_fb_helper_fill_var(struct fb_info *info, struct drm_fb_helper *fb_helpe
+ info->var.yoffset = 0;
+ info->var.activate = FB_ACTIVATE_NOW;
+
+- switch (fb->format->depth) {
+- case 8:
+- info->var.red.offset = 0;
+- info->var.green.offset = 0;
+- info->var.blue.offset = 0;
+- info->var.red.length = 8; /* 8bit DAC */
+- info->var.green.length = 8;
+- info->var.blue.length = 8;
+- info->var.transp.offset = 0;
+- info->var.transp.length = 0;
+- break;
+- case 15:
+- info->var.red.offset = 10;
+- info->var.green.offset = 5;
+- info->var.blue.offset = 0;
+- info->var.red.length = 5;
+- info->var.green.length = 5;
+- info->var.blue.length = 5;
+- info->var.transp.offset = 15;
+- info->var.transp.length = 1;
+- break;
+- case 16:
+- info->var.red.offset = 11;
+- info->var.green.offset = 5;
+- info->var.blue.offset = 0;
+- info->var.red.length = 5;
+- info->var.green.length = 6;
+- info->var.blue.length = 5;
+- info->var.transp.offset = 0;
+- break;
+- case 24:
+- info->var.red.offset = 16;
+- info->var.green.offset = 8;
+- info->var.blue.offset = 0;
+- info->var.red.length = 8;
+- info->var.green.length = 8;
+- info->var.blue.length = 8;
+- info->var.transp.offset = 0;
+- info->var.transp.length = 0;
+- break;
+- case 32:
+- info->var.red.offset = 16;
+- info->var.green.offset = 8;
+- info->var.blue.offset = 0;
+- info->var.red.length = 8;
+- info->var.green.length = 8;
+- info->var.blue.length = 8;
+- info->var.transp.offset = 24;
+- info->var.transp.length = 8;
+- break;
+- default:
+- break;
+- }
++ drm_fb_helper_fill_pixel_fmt(&info->var, fb->format->depth);
+
+ info->var.xres = fb_width;
+ info->var.yres = fb_height;
+@@ -3041,6 +3080,12 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
+ fbi->screen_size = fb->height * fb->pitches[0];
+ fbi->fix.smem_len = fbi->screen_size;
+ fbi->screen_buffer = buffer->vaddr;
++ /* Shamelessly leak the physical address to user-space */
++#if IS_ENABLED(CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM)
++ if (drm_leak_fbdev_smem && fbi->fix.smem_start == 0)
++ fbi->fix.smem_start =
++ page_to_phys(virt_to_page(fbi->screen_buffer));
++#endif
+ strcpy(fbi->fix.id, "DRM emulated");
+
+ drm_fb_helper_fill_fix(fbi, fb->pitches[0], fb->format->depth);
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
+index 5f57f4e1fbc8..87411a5aba77 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -2128,6 +2128,7 @@ static struct i915_vma *pd_vma_create(struct gen6_hw_ppgtt *ppgtt, int size)
+ int gen6_ppgtt_pin(struct i915_hw_ppgtt *base)
+ {
+ struct gen6_hw_ppgtt *ppgtt = to_gen6_ppgtt(base);
++ int err;
+
+ /*
+ * Workaround the limited maximum vma->pin_count and the aliasing_ppgtt
+@@ -2143,9 +2144,17 @@ int gen6_ppgtt_pin(struct i915_hw_ppgtt *base)
+ * allocator works in address space sizes, so it's multiplied by page
+ * size. We allocate at the top of the GTT to avoid fragmentation.
+ */
+- return i915_vma_pin(ppgtt->vma,
+- 0, GEN6_PD_ALIGN,
+- PIN_GLOBAL | PIN_HIGH);
++ err = i915_vma_pin(ppgtt->vma,
++ 0, GEN6_PD_ALIGN,
++ PIN_GLOBAL | PIN_HIGH);
++ if (err)
++ goto unpin;
++
++ return 0;
++
++unpin:
++ ppgtt->pin_count = 0;
++ return err;
+ }
+
+ void gen6_ppgtt_unpin(struct i915_hw_ppgtt *base)
+diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
+index 1aca742fde4a..ccd76c71af09 100644
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -470,9 +470,15 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ data_arg.data);
+ }
+ case I2C_RETRIES:
++ if (arg > INT_MAX)
++ return -EINVAL;
++
+ client->adapter->retries = arg;
+ break;
+ case I2C_TIMEOUT:
++ if (arg > INT_MAX)
++ return -EINVAL;
++
+ /* For historical reasons, user-space sets the timeout
+ * value in units of 10 ms.
+ */
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index 8815f3e2b718..880e75f63a19 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -2839,6 +2839,16 @@ static int qcom_nand_host_init_and_register(struct qcom_nand_controller *nandc,
+ if (ret)
+ return ret;
+
++ if (nandc->props->is_bam) {
++ free_bam_transaction(nandc);
++ nandc->bam_txn = alloc_bam_transaction(nandc);
++ if (!nandc->bam_txn) {
++ dev_err(nandc->dev,
++ "failed to allocate bam transaction\n");
++ return -ENOMEM;
++ }
++ }
++
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret)
+ nand_cleanup(chip);
+@@ -2853,16 +2863,6 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc)
+ struct qcom_nand_host *host;
+ int ret;
+
+- if (nandc->props->is_bam) {
+- free_bam_transaction(nandc);
+- nandc->bam_txn = alloc_bam_transaction(nandc);
+- if (!nandc->bam_txn) {
+- dev_err(nandc->dev,
+- "failed to allocate bam transaction\n");
+- return -ENOMEM;
+- }
+- }
+-
+ for_each_available_child_of_node(dn, child) {
+ host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
+ if (!host) {
+diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
+index 29a05759a294..0fa9e8fdce66 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -99,9 +99,6 @@ irqreturn_t dw_handle_msi_irq(struct pcie_port *pp)
+ (i * MAX_MSI_IRQS_PER_CTRL) +
+ pos);
+ generic_handle_irq(irq);
+- dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_STATUS +
+- (i * MSI_REG_CTRL_BLOCK_SIZE),
+- 4, 1 << pos);
+ pos++;
+ }
+ }
+@@ -168,8 +165,8 @@ static void dw_pci_bottom_mask(struct irq_data *data)
+ bit = data->hwirq % MAX_MSI_IRQS_PER_CTRL;
+
+ pp->irq_status[ctrl] &= ~(1 << bit);
+- dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + res, 4,
+- pp->irq_status[ctrl]);
++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + res, 4,
++ ~pp->irq_status[ctrl]);
+ }
+
+ raw_spin_unlock_irqrestore(&pp->lock, flags);
+@@ -191,8 +188,8 @@ static void dw_pci_bottom_unmask(struct irq_data *data)
+ bit = data->hwirq % MAX_MSI_IRQS_PER_CTRL;
+
+ pp->irq_status[ctrl] |= 1 << bit;
+- dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + res, 4,
+- pp->irq_status[ctrl]);
++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + res, 4,
++ ~pp->irq_status[ctrl]);
+ }
+
+ raw_spin_unlock_irqrestore(&pp->lock, flags);
+@@ -200,13 +197,22 @@ static void dw_pci_bottom_unmask(struct irq_data *data)
+
+ static void dw_pci_bottom_ack(struct irq_data *d)
+ {
+- struct msi_desc *msi = irq_data_get_msi_desc(d);
+- struct pcie_port *pp;
++ struct pcie_port *pp = irq_data_get_irq_chip_data(d);
++ unsigned int res, bit, ctrl;
++ unsigned long flags;
++
++ ctrl = d->hwirq / MAX_MSI_IRQS_PER_CTRL;
++ res = ctrl * MSI_REG_CTRL_BLOCK_SIZE;
++ bit = d->hwirq % MAX_MSI_IRQS_PER_CTRL;
++
++ raw_spin_lock_irqsave(&pp->lock, flags);
+
+- pp = msi_desc_to_pci_sysdata(msi);
++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_STATUS + res, 4, 1 << bit);
+
+ if (pp->ops->msi_irq_ack)
+ pp->ops->msi_irq_ack(d->hwirq, pp);
++
++ raw_spin_unlock_irqrestore(&pp->lock, flags);
+ }
+
+ static struct irq_chip dw_pci_msi_bottom_irq_chip = {
+@@ -658,10 +664,15 @@ void dw_pcie_setup_rc(struct pcie_port *pp)
+ num_ctrls = pp->num_vectors / MAX_MSI_IRQS_PER_CTRL;
+
+ /* Initialize IRQ Status array */
+- for (ctrl = 0; ctrl < num_ctrls; ctrl++)
+- dw_pcie_rd_own_conf(pp, PCIE_MSI_INTR0_ENABLE +
++ for (ctrl = 0; ctrl < num_ctrls; ctrl++) {
++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK +
+ (ctrl * MSI_REG_CTRL_BLOCK_SIZE),
+- 4, &pp->irq_status[ctrl]);
++ 4, ~0);
++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE +
++ (ctrl * MSI_REG_CTRL_BLOCK_SIZE),
++ 4, ~0);
++ pp->irq_status[ctrl] = 0;
++ }
+
+ /* Setup RC BARs */
+ dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, 0x00000004);
+diff --git a/drivers/staging/rtl8188eu/core/rtw_security.c b/drivers/staging/rtl8188eu/core/rtw_security.c
+index 2a48b09ea9ae..470ea2c0c433 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_security.c
++++ b/drivers/staging/rtl8188eu/core/rtw_security.c
+@@ -154,7 +154,7 @@ void rtw_wep_encrypt(struct adapter *padapter, u8 *pxmitframe)
+
+ pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + hw_hdr_offset;
+
+- crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep");
++ crypto_ops = lib80211_get_crypto_ops("WEP");
+
+ if (!crypto_ops)
+ return;
+@@ -210,7 +210,7 @@ int rtw_wep_decrypt(struct adapter *padapter, u8 *precvframe)
+ void *crypto_private = NULL;
+ int status = _SUCCESS;
+ const int keyindex = prxattrib->key_index;
+- struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep");
++ struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("WEP");
+ char iv[4], icv[4];
+
+ if (!crypto_ops) {
+@@ -1292,7 +1292,7 @@ u32 rtw_aes_decrypt(struct adapter *padapter, u8 *precvframe)
+ struct sk_buff *skb = ((struct recv_frame *)precvframe)->pkt;
+ void *crypto_private = NULL;
+ u8 *key, *pframe = skb->data;
+- struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("CCMP"), "lib80211_crypt_ccmp");
++ struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("CCMP");
+ struct security_priv *psecuritypriv = &padapter->securitypriv;
+ char iv[8], icv[8];
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 2886b7b477c7..08b8aa5299b5 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1880,6 +1880,13 @@ static const struct usb_device_id acm_ids[] = {
+ .driver_info = IGNORE_DEVICE,
+ },
+
++ { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */
++ .driver_info = SEND_ZERO_PACKET,
++ },
++ { USB_DEVICE(0x1bc7, 0x0023), /* Telit 3G ACM + ECM composition */
++ .driver_info = SEND_ZERO_PACKET,
++ },
++
+ /* control interfaces without any protocol set */
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
+ USB_CDC_PROTO_NONE) },
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 514c5214ddb2..8bc35d53408b 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -394,7 +394,8 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET },
+
+ /* Corsair K70 RGB */
+- { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT |
++ USB_QUIRK_DELAY_CTRL_MSG },
+
+ /* Corsair Strafe */
+ { USB_DEVICE(0x1b1c, 0x1b15), .driver_info = USB_QUIRK_DELAY_INIT |
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index e227bb5b794f..101ebac43c87 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -235,8 +235,12 @@ static int slave_configure(struct scsi_device *sdev)
+ if (!(us->fflags & US_FL_NEEDS_CAP16))
+ sdev->try_rc_10_first = 1;
+
+- /* assume SPC3 or latter devices support sense size > 18 */
+- if (sdev->scsi_level > SCSI_SPC_2)
++ /*
++ * assume SPC3 or latter devices support sense size > 18
++ * unless US_FL_BAD_SENSE quirk is specified.
++ */
++ if (sdev->scsi_level > SCSI_SPC_2 &&
++ !(us->fflags & US_FL_BAD_SENSE))
+ us->fflags |= US_FL_SANE_SENSE;
+
+ /*
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index f7f83b21dc74..ea0d27a94afe 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1265,6 +1265,18 @@ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
++/*
++ * Reported by Icenowy Zheng <icenowy@aosc.io>
++ * The SMI SM3350 USB-UFS bridge controller will enter a wrong state
++ * that do not process read/write command if a long sense is requested,
++ * so force to use 18-byte sense.
++ */
++UNUSUAL_DEV( 0x090c, 0x3350, 0x0000, 0xffff,
++ "SMI",
++ "SM3350 UFS-to-USB-Mass-Storage bridge",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_BAD_SENSE ),
++
+ /*
+ * Reported by Paul Hartman <paul.hartman+linux@gmail.com>
+ * This card reader returns "Illegal Request, Logical Block Address
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index d9fd3188615d..64cbc2d007c9 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -878,7 +878,7 @@ static int vfio_dma_do_unmap(struct vfio_iommu *iommu,
+ return -EINVAL;
+ if (!unmap->size || unmap->size & mask)
+ return -EINVAL;
+- if (unmap->iova + unmap->size < unmap->iova ||
++ if (unmap->iova + unmap->size - 1 < unmap->iova ||
+ unmap->size > SIZE_MAX)
+ return -EINVAL;
+
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index fa18520529f3..7ad6f2eec711 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1051,19 +1051,21 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ parent_start = parent->start;
+
+ /*
+- * If we are COWing a node/leaf from the extent, chunk or device trees,
+- * make sure that we do not finish block group creation of pending block
+- * groups. We do this to avoid a deadlock.
++ * If we are COWing a node/leaf from the extent, chunk, device or free
++ * space trees, make sure that we do not finish block group creation of
++ * pending block groups. We do this to avoid a deadlock.
+ * COWing can result in allocation of a new chunk, and flushing pending
+ * block groups (btrfs_create_pending_block_groups()) can be triggered
+ * when finishing allocation of a new chunk. Creation of a pending block
+- * group modifies the extent, chunk and device trees, therefore we could
+- * deadlock with ourselves since we are holding a lock on an extent
+- * buffer that btrfs_create_pending_block_groups() may try to COW later.
++ * group modifies the extent, chunk, device and free space trees,
++ * therefore we could deadlock with ourselves since we are holding a
++ * lock on an extent buffer that btrfs_create_pending_block_groups() may
++ * try to COW later.
+ */
+ if (root == fs_info->extent_root ||
+ root == fs_info->chunk_root ||
+- root == fs_info->dev_root)
++ root == fs_info->dev_root ||
++ root == fs_info->free_space_root)
+ trans->can_flush_pending_bgs = false;
+
+ cow = btrfs_alloc_tree_block(trans, root, parent_start,
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index ff434663d65b..e1fcb28ad4cc 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -1013,16 +1013,22 @@ out_add_root:
+ btrfs_abort_transaction(trans, ret);
+ goto out_free_path;
+ }
+- spin_lock(&fs_info->qgroup_lock);
+- fs_info->quota_root = quota_root;
+- set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
+- spin_unlock(&fs_info->qgroup_lock);
+
+ ret = btrfs_commit_transaction(trans);
+ trans = NULL;
+ if (ret)
+ goto out_free_path;
+
++ /*
++ * Set quota enabled flag after committing the transaction, to avoid
++ * deadlocks on fs_info->qgroup_ioctl_lock with concurrent snapshot
++ * creation.
++ */
++ spin_lock(&fs_info->qgroup_lock);
++ fs_info->quota_root = quota_root;
++ set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
++ spin_unlock(&fs_info->qgroup_lock);
++
+ ret = qgroup_rescan_init(fs_info, 0, 1);
+ if (!ret) {
+ qgroup_rescan_zero_tracking(fs_info);
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index f4405e430da6..223334f08530 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -3712,6 +3712,7 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
+ int ret;
+ u64 num_devices;
+ unsigned seq;
++ bool reducing_integrity;
+
+ if (btrfs_fs_closing(fs_info) ||
+ atomic_read(&fs_info->balance_pause_req) ||
+@@ -3796,24 +3797,30 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
+ !(bctl->sys.target & allowed)) ||
+ ((bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
+ (fs_info->avail_metadata_alloc_bits & allowed) &&
+- !(bctl->meta.target & allowed))) {
+- if (bctl->flags & BTRFS_BALANCE_FORCE) {
+- btrfs_info(fs_info,
+- "balance: force reducing metadata integrity");
+- } else {
+- btrfs_err(fs_info,
+- "balance: reduces metadata integrity, use --force if you want this");
+- ret = -EINVAL;
+- goto out;
+- }
+- }
++ !(bctl->meta.target & allowed)))
++ reducing_integrity = true;
++ else
++ reducing_integrity = false;
++
++ /* if we're not converting, the target field is uninitialized */
++ meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
++ bctl->meta.target : fs_info->avail_metadata_alloc_bits;
++ data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
++ bctl->data.target : fs_info->avail_data_alloc_bits;
+ } while (read_seqretry(&fs_info->profiles_lock, seq));
+
+- /* if we're not converting, the target field is uninitialized */
+- meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
+- bctl->meta.target : fs_info->avail_metadata_alloc_bits;
+- data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
+- bctl->data.target : fs_info->avail_data_alloc_bits;
++ if (reducing_integrity) {
++ if (bctl->flags & BTRFS_BALANCE_FORCE) {
++ btrfs_info(fs_info,
++ "balance: force reducing metadata integrity");
++ } else {
++ btrfs_err(fs_info,
++ "balance: reduces metadata integrity, use --force if you want this");
++ ret = -EINVAL;
++ goto out;
++ }
++ }
++
+ if (btrfs_get_num_tolerated_disk_barrier_failures(meta_target) <
+ btrfs_get_num_tolerated_disk_barrier_failures(data_target)) {
+ int meta_index = btrfs_bg_flags_to_raid_index(meta_target);
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index ea78c3d6dcfc..f141b45ce349 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -11,6 +11,7 @@
+ #include <linux/security.h>
+ #include <linux/posix_acl_xattr.h>
+ #include <linux/iversion.h>
++#include <linux/sched/mm.h>
+ #include "ctree.h"
+ #include "btrfs_inode.h"
+ #include "transaction.h"
+@@ -422,9 +423,15 @@ static int btrfs_initxattrs(struct inode *inode,
+ {
+ const struct xattr *xattr;
+ struct btrfs_trans_handle *trans = fs_info;
++ unsigned int nofs_flag;
+ char *name;
+ int err = 0;
+
++ /*
++ * We're holding a transaction handle, so use a NOFS memory allocation
++ * context to avoid deadlock if reclaim happens.
++ */
++ nofs_flag = memalloc_nofs_save();
+ for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+ name = kmalloc(XATTR_SECURITY_PREFIX_LEN +
+ strlen(xattr->name) + 1, GFP_KERNEL);
+@@ -440,6 +447,7 @@ static int btrfs_initxattrs(struct inode *inode,
+ if (err < 0)
+ break;
+ }
++ memalloc_nofs_restore(nofs_flag);
+ return err;
+ }
+
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 8d41ca7bfcf1..7b637fc27990 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -1120,10 +1120,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
+
+ /*
+ * Accessing maxBuf is racy with cifs_reconnect - need to store value
+- * and check it for zero before using.
++ * and check it before using.
+ */
+ max_buf = tcon->ses->server->maxBuf;
+- if (!max_buf) {
++ if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) {
+ free_xid(xid);
+ return -EINVAL;
+ }
+@@ -1460,10 +1460,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+
+ /*
+ * Accessing maxBuf is racy with cifs_reconnect - need to store value
+- * and check it for zero before using.
++ * and check it before using.
+ */
+ max_buf = tcon->ses->server->maxBuf;
+- if (!max_buf)
++ if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE)))
+ return -EINVAL;
+
+ max_num = (max_buf - sizeof(struct smb_hdr)) /
+diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
+index 4ed10dd086e6..2fc3d31967ee 100644
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -122,10 +122,10 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+
+ /*
+ * Accessing maxBuf is racy with cifs_reconnect - need to store value
+- * and check it for zero before using.
++ * and check it before using.
+ */
+ max_buf = tcon->ses->server->maxBuf;
+- if (!max_buf)
++ if (max_buf < sizeof(struct smb2_lock_element))
+ return -EINVAL;
+
+ max_num = max_buf / sizeof(struct smb2_lock_element);
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index f54d07bda067..dba986524917 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3185,12 +3185,14 @@ smb2_async_readv(struct cifs_readdata *rdata)
+ if (rdata->credits) {
+ shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
+ SMB2_MAX_BUFFER_SIZE));
+- shdr->CreditRequest = shdr->CreditCharge;
++ shdr->CreditRequest =
++ cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
+ spin_lock(&server->req_lock);
+ server->credits += rdata->credits -
+ le16_to_cpu(shdr->CreditCharge);
+ spin_unlock(&server->req_lock);
+ wake_up(&server->request_q);
++ rdata->credits = le16_to_cpu(shdr->CreditCharge);
+ flags |= CIFS_HAS_CREDITS;
+ }
+
+@@ -3462,12 +3464,14 @@ smb2_async_writev(struct cifs_writedata *wdata,
+ if (wdata->credits) {
+ shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
+ SMB2_MAX_BUFFER_SIZE));
+- shdr->CreditRequest = shdr->CreditCharge;
++ shdr->CreditRequest =
++ cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
+ spin_lock(&server->req_lock);
+ server->credits += wdata->credits -
+ le16_to_cpu(shdr->CreditCharge);
+ spin_unlock(&server->req_lock);
+ wake_up(&server->request_q);
++ wdata->credits = le16_to_cpu(shdr->CreditCharge);
+ flags |= CIFS_HAS_CREDITS;
+ }
+
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 333729cf46cd..66348b3d28e6 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -378,7 +378,7 @@ smbd_done:
+ if (rc < 0 && rc != -EINTR)
+ cifs_dbg(VFS, "Error %d sending data on socket to server\n",
+ rc);
+- else
++ else if (rc > 0)
+ rc = 0;
+
+ return rc;
+@@ -786,7 +786,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ int i, j, rc = 0;
+ int timeout, optype;
+ struct mid_q_entry *midQ[MAX_COMPOUND];
+- unsigned int credits = 0;
++ bool cancelled_mid[MAX_COMPOUND] = {false};
++ unsigned int credits[MAX_COMPOUND] = {0};
+ char *buf;
+
+ timeout = flags & CIFS_TIMEOUT_MASK;
+@@ -804,13 +805,31 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ return -ENOENT;
+
+ /*
+- * Ensure that we do not send more than 50 overlapping requests
+- * to the same server. We may make this configurable later or
+- * use ses->maxReq.
++ * Ensure we obtain 1 credit per request in the compound chain.
++ * It can be optimized further by waiting for all the credits
++ * at once but this can wait long enough if we don't have enough
++ * credits due to some heavy operations in progress or the server
++ * not granting us much, so a fallback to the current approach is
++ * needed anyway.
+ */
+- rc = wait_for_free_request(ses->server, timeout, optype);
+- if (rc)
+- return rc;
++ for (i = 0; i < num_rqst; i++) {
++ rc = wait_for_free_request(ses->server, timeout, optype);
++ if (rc) {
++ /*
++ * We haven't sent an SMB packet to the server yet but
++ * we already obtained credits for i requests in the
++ * compound chain - need to return those credits back
++ * for future use. Note that we need to call add_credits
++ * multiple times to match the way we obtained credits
++ * in the first place and to account for in flight
++ * requests correctly.
++ */
++ for (j = 0; j < i; j++)
++ add_credits(ses->server, 1, optype);
++ return rc;
++ }
++ credits[i] = 1;
++ }
+
+ /*
+ * Make sure that we sign in the same order that we send on this socket
+@@ -826,8 +845,10 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ for (j = 0; j < i; j++)
+ cifs_delete_mid(midQ[j]);
+ mutex_unlock(&ses->server->srv_mutex);
++
+ /* Update # of requests on wire to server */
+- add_credits(ses->server, 1, optype);
++ for (j = 0; j < num_rqst; j++)
++ add_credits(ses->server, credits[j], optype);
+ return PTR_ERR(midQ[i]);
+ }
+
+@@ -874,19 +895,16 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) {
+ midQ[i]->mid_flags |= MID_WAIT_CANCELLED;
+ midQ[i]->callback = DeleteMidQEntry;
+- spin_unlock(&GlobalMid_Lock);
+- add_credits(ses->server, 1, optype);
+- return rc;
++ cancelled_mid[i] = true;
+ }
+ spin_unlock(&GlobalMid_Lock);
+ }
+ }
+
+ for (i = 0; i < num_rqst; i++)
+- if (midQ[i]->resp_buf)
+- credits += ses->server->ops->get_credits(midQ[i]);
+- if (!credits)
+- credits = 1;
++ if (!cancelled_mid[i] && midQ[i]->resp_buf
++ && (midQ[i]->mid_state == MID_RESPONSE_RECEIVED))
++ credits[i] = ses->server->ops->get_credits(midQ[i]);
+
+ for (i = 0; i < num_rqst; i++) {
+ if (rc < 0)
+@@ -894,8 +912,9 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+
+ rc = cifs_sync_mid_result(midQ[i], ses->server);
+ if (rc != 0) {
+- add_credits(ses->server, credits, optype);
+- return rc;
++ /* mark this mid as cancelled to not free it below */
++ cancelled_mid[i] = true;
++ goto out;
+ }
+
+ if (!midQ[i]->resp_buf ||
+@@ -942,9 +961,11 @@ out:
+ * This is prevented above by using a noop callback that will not
+ * wake this thread except for the very last PDU.
+ */
+- for (i = 0; i < num_rqst; i++)
+- cifs_delete_mid(midQ[i]);
+- add_credits(ses->server, credits, optype);
++ for (i = 0; i < num_rqst; i++) {
++ if (!cancelled_mid[i])
++ cifs_delete_mid(midQ[i]);
++ add_credits(ses->server, credits[i], optype);
++ }
+
+ return rc;
+ }
+diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
+index 26a7fe5c4fd3..712f00995390 100644
+--- a/fs/ext4/fsync.c
++++ b/fs/ext4/fsync.c
+@@ -116,8 +116,16 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ goto out;
+ }
+
++ ret = file_write_and_wait_range(file, start, end);
++ if (ret)
++ return ret;
++
+ if (!journal) {
+- ret = __generic_file_fsync(file, start, end, datasync);
++ struct writeback_control wbc = {
++ .sync_mode = WB_SYNC_ALL
++ };
++
++ ret = ext4_write_inode(inode, &wbc);
+ if (!ret)
+ ret = ext4_sync_parent(inode);
+ if (test_opt(inode->i_sb, BARRIER))
+@@ -125,9 +133,6 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ goto out;
+ }
+
+- ret = file_write_and_wait_range(file, start, end);
+- if (ret)
+- return ret;
+ /*
+ * data=writeback,ordered:
+ * The caller's filemap_fdatawrite()/wait will sync the data.
+@@ -159,6 +164,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ ret = err;
+ }
+ out:
++ err = file_check_and_advance_wb_err(file);
++ if (ret == 0)
++ ret = err;
+ trace_ext4_sync_file_exit(inode, ret);
+ return ret;
+ }
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 27373d88b5f0..56f6e1782d5f 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1890,12 +1890,12 @@ int ext4_inline_data_fiemap(struct inode *inode,
+ physical += (char *)ext4_raw_inode(&iloc) - iloc.bh->b_data;
+ physical += offsetof(struct ext4_inode, i_block);
+
+- if (physical)
+- error = fiemap_fill_next_extent(fieinfo, start, physical,
+- inline_len, flags);
+ brelse(iloc.bh);
+ out:
+ up_read(&EXT4_I(inode)->xattr_sem);
++ if (physical)
++ error = fiemap_fill_next_extent(fieinfo, start, physical,
++ inline_len, flags);
+ return (error < 0 ? error : 0);
+ }
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 36abbdafb26e..2c43c5b92229 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -2748,7 +2748,8 @@ static int ext4_writepages(struct address_space *mapping,
+ * We may need to convert up to one extent per block in
+ * the page and we may dirty the inode.
+ */
+- rsv_blocks = 1 + (PAGE_SIZE >> inode->i_blkbits);
++ rsv_blocks = 1 + ext4_chunk_trans_blocks(inode,
++ PAGE_SIZE >> inode->i_blkbits);
+ }
+
+ /*
+@@ -4802,7 +4803,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
+ gid_t i_gid;
+ projid_t i_projid;
+
+- if (((flags & EXT4_IGET_NORMAL) &&
++ if ((!(flags & EXT4_IGET_SPECIAL) &&
+ (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) ||
+ (ino < EXT4_ROOT_INO) ||
+ (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) {
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index ee0f30852835..a1cf7d68b4f0 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4904,7 +4904,7 @@ static int ext4_commit_super(struct super_block *sb, int sync)
+ ext4_superblock_csum_set(sb);
+ if (sync)
+ lock_buffer(sbh);
+- if (buffer_write_io_error(sbh)) {
++ if (buffer_write_io_error(sbh) || !buffer_uptodate(sbh)) {
+ /*
+ * Oh, dear. A previous attempt to write the
+ * superblock failed. This could happen because the
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 4d36b27214fd..0242f6eec4ea 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -75,7 +75,7 @@
+ #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
+ #endif
+
+-#ifdef RETPOLINE
++#ifdef CONFIG_RETPOLINE
+ #define __noretpoline __attribute__((indirect_branch("keep")))
+ #endif
+
+diff --git a/include/linux/module.h b/include/linux/module.h
+index e19ae08c7fb8..904f94628132 100644
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -818,7 +818,7 @@ static inline void module_bug_finalize(const Elf_Ehdr *hdr,
+ static inline void module_bug_cleanup(struct module *mod) {}
+ #endif /* CONFIG_GENERIC_BUG */
+
+-#ifdef RETPOLINE
++#ifdef CONFIG_RETPOLINE
+ extern bool retpoline_module_ok(bool has_retpoline);
+ #else
+ static inline bool retpoline_module_ok(bool has_retpoline)
+diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
+index 73e130a840ce..fdb6b317d974 100644
+--- a/include/linux/sunrpc/svc.h
++++ b/include/linux/sunrpc/svc.h
+@@ -295,9 +295,12 @@ struct svc_rqst {
+ struct svc_cacherep * rq_cacherep; /* cache info */
+ struct task_struct *rq_task; /* service thread */
+ spinlock_t rq_lock; /* per-request lock */
++ struct net *rq_bc_net; /* pointer to backchannel's
++ * net namespace
++ */
+ };
+
+-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
++#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
+
+ /*
+ * Rigorous type checking on sockaddr type conversions
+diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
+index bbb08a3ef5cc..a2644c494a9c 100644
+--- a/include/trace/events/sunrpc.h
++++ b/include/trace/events/sunrpc.h
+@@ -582,7 +582,8 @@ TRACE_EVENT(svc_process,
+ __field(u32, vers)
+ __field(u32, proc)
+ __string(service, name)
+- __string(addr, rqst->rq_xprt->xpt_remotebuf)
++ __string(addr, rqst->rq_xprt ?
++ rqst->rq_xprt->xpt_remotebuf : "(null)")
+ ),
+
+ TP_fast_assign(
+@@ -590,7 +591,8 @@ TRACE_EVENT(svc_process,
+ __entry->vers = rqst->rq_vers;
+ __entry->proc = rqst->rq_proc;
+ __assign_str(service, name);
+- __assign_str(addr, rqst->rq_xprt->xpt_remotebuf);
++ __assign_str(addr, rqst->rq_xprt ?
++ rqst->rq_xprt->xpt_remotebuf : "(null)");
+ ),
+
+ TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u",
+diff --git a/mm/memory.c b/mm/memory.c
+index 5c5df53dbdf9..281172540a9c 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3237,6 +3237,29 @@ static vm_fault_t __do_fault(struct vm_fault *vmf)
+ struct vm_area_struct *vma = vmf->vma;
+ vm_fault_t ret;
+
++ /*
++ * Preallocate pte before we take page_lock because this might lead to
++ * deadlocks for memcg reclaim which waits for pages under writeback:
++ * lock_page(A)
++ * SetPageWriteback(A)
++ * unlock_page(A)
++ * lock_page(B)
++ * lock_page(B)
++ * pte_alloc_pne
++ * shrink_page_list
++ * wait_on_page_writeback(A)
++ * SetPageWriteback(B)
++ * unlock_page(B)
++ * # flush A, B to clear the writeback
++ */
++ if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
++ vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm,
++ vmf->address);
++ if (!vmf->prealloc_pte)
++ return VM_FAULT_OOM;
++ smp_wmb(); /* See comment in __pte_alloc() */
++ }
++
+ ret = vma->vm_ops->fault(vmf);
+ if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
+ VM_FAULT_DONE_COW)))
+diff --git a/mm/slab.c b/mm/slab.c
+index d73c7a4820a4..fad6839e8eab 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -679,8 +679,10 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries,
+ struct alien_cache *alc = NULL;
+
+ alc = kmalloc_node(memsize, gfp, node);
+- init_arraycache(&alc->ac, entries, batch);
+- spin_lock_init(&alc->lock);
++ if (alc) {
++ init_arraycache(&alc->ac, entries, batch);
++ spin_lock_init(&alc->lock);
++ }
+ return alc;
+ }
+
+diff --git a/mm/usercopy.c b/mm/usercopy.c
+index 852eb4e53f06..14faadcedd06 100644
+--- a/mm/usercopy.c
++++ b/mm/usercopy.c
+@@ -247,7 +247,8 @@ static DEFINE_STATIC_KEY_FALSE_RO(bypass_usercopy_checks);
+ /*
+ * Validates that the given object is:
+ * - not bogus address
+- * - known-safe heap or stack object
++ * - fully contained by stack (or stack frame, when available)
++ * - fully within SLAB object (or object whitelist area, when available)
+ * - not in kernel text
+ */
+ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
+@@ -262,9 +263,6 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
+ /* Check for invalid addresses. */
+ check_bogus_address((const unsigned long)ptr, n, to_user);
+
+- /* Check for bad heap object. */
+- check_heap_object(ptr, n, to_user);
+-
+ /* Check for bad stack object. */
+ switch (check_stack_object(ptr, n)) {
+ case NOT_STACK:
+@@ -282,6 +280,9 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
+ usercopy_abort("process stack", NULL, to_user, 0, n);
+ }
+
++ /* Check for bad heap object. */
++ check_heap_object(ptr, n, to_user);
++
+ /* Check for object in kernel to avoid text exposure. */
+ check_kernel_text_object((const unsigned long)ptr, n, to_user);
+ }
+diff --git a/mm/util.c b/mm/util.c
+index 9e3ebd2ef65f..6a24a1025d77 100644
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -485,7 +485,7 @@ bool page_mapped(struct page *page)
+ return true;
+ if (PageHuge(page))
+ return false;
+- for (i = 0; i < hpage_nr_pages(page); i++) {
++ for (i = 0; i < (1 << compound_order(page)); i++) {
+ if (atomic_read(&page[i]._mapcount) >= 0)
+ return true;
+ }
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index d13e05f1a990..d65f8d35de87 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -1144,6 +1144,8 @@ void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
+ static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {}
+ #endif
+
++extern void svc_tcp_prep_reply_hdr(struct svc_rqst *);
++
+ /*
+ * Common routine for processing the RPC request.
+ */
+@@ -1172,7 +1174,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
+ clear_bit(RQ_DROPME, &rqstp->rq_flags);
+
+ /* Setup reply header */
+- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
++ if (rqstp->rq_prot == IPPROTO_TCP)
++ svc_tcp_prep_reply_hdr(rqstp);
+
+ svc_putu32(resv, rqstp->rq_xid);
+
+@@ -1244,7 +1247,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
+ * for lower versions. RPC_PROG_MISMATCH seems to be the closest
+ * fit.
+ */
+- if (versp->vs_need_cong_ctrl &&
++ if (versp->vs_need_cong_ctrl && rqstp->rq_xprt &&
+ !test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags))
+ goto err_bad_vers;
+
+@@ -1336,7 +1339,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
+ return 0;
+
+ close:
+- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
++ if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ svc_close_xprt(rqstp->rq_xprt);
+ dprintk("svc: svc_process close\n");
+ return 0;
+@@ -1459,10 +1462,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
+ dprintk("svc: %s(%p)\n", __func__, req);
+
+ /* Build the svc_rqst used by the common processing routine */
+- rqstp->rq_xprt = serv->sv_bc_xprt;
+ rqstp->rq_xid = req->rq_xid;
+ rqstp->rq_prot = req->rq_xprt->prot;
+ rqstp->rq_server = serv;
++ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
+
+ rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
+ memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 83ccd0221c98..6cf0fd37cbf0 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -469,10 +469,11 @@ out:
+ */
+ void svc_reserve(struct svc_rqst *rqstp, int space)
+ {
++ struct svc_xprt *xprt = rqstp->rq_xprt;
++
+ space += rqstp->rq_res.head[0].iov_len;
+
+- if (space < rqstp->rq_reserved) {
+- struct svc_xprt *xprt = rqstp->rq_xprt;
++ if (xprt && space < rqstp->rq_reserved) {
+ atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
+ rqstp->rq_reserved = space;
+
+diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
+index fc1c0d9ef57d..97a8282955a8 100644
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -1198,7 +1198,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
+ /*
+ * Setup response header. TCP has a 4B record length field.
+ */
+-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
++void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+ {
+ struct kvec *resv = &rqstp->rq_res.head[0];
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 0d998c54564d..5a5b3780456f 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -2157,7 +2157,7 @@ static void add_intree_flag(struct buffer *b, int is_intree)
+ /* Cannot check for assembler */
+ static void add_retpoline(struct buffer *b)
+ {
+- buf_printf(b, "\n#ifdef RETPOLINE\n");
++ buf_printf(b, "\n#ifdef CONFIG_RETPOLINE\n");
+ buf_printf(b, "MODULE_INFO(retpoline, \"Y\");\n");
+ buf_printf(b, "#endif\n");
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 854d63c01dd2..8b9f2487969b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4102,6 +4102,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ case 0x10ec0295:
+ case 0x10ec0289:
+ case 0x10ec0299:
++ alc_process_coef_fw(codec, alc225_pre_hsmode);
+ alc_process_coef_fw(codec, coef0225);
+ break;
+ case 0x10ec0867:
+@@ -5380,6 +5381,13 @@ static void alc285_fixup_invalidate_dacs(struct hda_codec *codec,
+ snd_hda_override_wcaps(codec, 0x03, 0);
+ }
+
++static void alc_fixup_disable_mic_vref(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PRE_PROBE)
++ snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ);
++}
++
+ /* for hda_fixup_thinkpad_acpi() */
+ #include "thinkpad_helper.c"
+
+@@ -5492,6 +5500,7 @@ enum {
+ ALC293_FIXUP_LENOVO_SPK_NOISE,
+ ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
+ ALC255_FIXUP_DELL_SPK_NOISE,
++ ALC225_FIXUP_DISABLE_MIC_VREF,
+ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC295_FIXUP_DISABLE_DAC3,
+ ALC280_FIXUP_HP_HEADSET_MIC,
+@@ -6191,6 +6200,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+ },
++ [ALC225_FIXUP_DISABLE_MIC_VREF] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_disable_mic_vref,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
++ },
+ [ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -6200,7 +6215,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ {}
+ },
+ .chained = true,
+- .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
++ .chain_id = ALC225_FIXUP_DISABLE_MIC_VREF
+ },
+ [ALC280_FIXUP_HP_HEADSET_MIC] = {
+ .type = HDA_FIXUP_FUNC,
+@@ -6503,6 +6518,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
++ SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index 8fb31a7cc22c..91495045ad5a 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -66,7 +66,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
+ static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
+ static u32 kvm_next_vmid;
+ static unsigned int kvm_vmid_bits __read_mostly;
+-static DEFINE_RWLOCK(kvm_vmid_lock);
++static DEFINE_SPINLOCK(kvm_vmid_lock);
+
+ static bool vgic_present;
+
+@@ -482,7 +482,9 @@ void force_vm_exit(const cpumask_t *mask)
+ */
+ static bool need_new_vmid_gen(struct kvm *kvm)
+ {
+- return unlikely(kvm->arch.vmid_gen != atomic64_read(&kvm_vmid_gen));
++ u64 current_vmid_gen = atomic64_read(&kvm_vmid_gen);
++ smp_rmb(); /* Orders read of kvm_vmid_gen and kvm->arch.vmid */
++ return unlikely(READ_ONCE(kvm->arch.vmid_gen) != current_vmid_gen);
+ }
+
+ /**
+@@ -497,16 +499,11 @@ static void update_vttbr(struct kvm *kvm)
+ {
+ phys_addr_t pgd_phys;
+ u64 vmid;
+- bool new_gen;
+
+- read_lock(&kvm_vmid_lock);
+- new_gen = need_new_vmid_gen(kvm);
+- read_unlock(&kvm_vmid_lock);
+-
+- if (!new_gen)
++ if (!need_new_vmid_gen(kvm))
+ return;
+
+- write_lock(&kvm_vmid_lock);
++ spin_lock(&kvm_vmid_lock);
+
+ /*
+ * We need to re-check the vmid_gen here to ensure that if another vcpu
+@@ -514,7 +511,7 @@ static void update_vttbr(struct kvm *kvm)
+ * use the same vmid.
+ */
+ if (!need_new_vmid_gen(kvm)) {
+- write_unlock(&kvm_vmid_lock);
++ spin_unlock(&kvm_vmid_lock);
+ return;
+ }
+
+@@ -537,7 +534,6 @@ static void update_vttbr(struct kvm *kvm)
+ kvm_call_hyp(__kvm_flush_vm_context);
+ }
+
+- kvm->arch.vmid_gen = atomic64_read(&kvm_vmid_gen);
+ kvm->arch.vmid = kvm_next_vmid;
+ kvm_next_vmid++;
+ kvm_next_vmid &= (1 << kvm_vmid_bits) - 1;
+@@ -548,7 +544,10 @@ static void update_vttbr(struct kvm *kvm)
+ vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits);
+ kvm->arch.vttbr = kvm_phys_to_vttbr(pgd_phys) | vmid;
+
+- write_unlock(&kvm_vmid_lock);
++ smp_wmb();
++ WRITE_ONCE(kvm->arch.vmid_gen, atomic64_read(&kvm_vmid_gen));
++
++ spin_unlock(&kvm_vmid_lock);
+ }
+
+ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-01-22 23:06 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-01-22 23:06 UTC (permalink / raw
To: gentoo-commits
commit: 4c1637502cb24d5975265fabab265c23bb5cbb3e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jan 22 23:06:10 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jan 22 23:06:10 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4c163750
proj/linux-patches: Linux patch 4.19.17
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1016_linux-4.19.17.patch | 3869 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3873 insertions(+)
diff --git a/0000_README b/0000_README
index 3ddd86b..f7061f2 100644
--- a/0000_README
+++ b/0000_README
@@ -107,6 +107,10 @@ Patch: 1015_linux-4.19.16.patch
From: http://www.kernel.org
Desc: Linux 4.19.16
+Patch: 1016_linux-4.19.17.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.17
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1016_linux-4.19.17.patch b/1016_linux-4.19.17.patch
new file mode 100644
index 0000000..592d0e3
--- /dev/null
+++ b/1016_linux-4.19.17.patch
@@ -0,0 +1,3869 @@
+diff --git a/Makefile b/Makefile
+index e8cb4875b86d..4b0bce87a36b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 16
++SUBLEVEL = 17
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
+index 176e38d54872..ec0da5b3d7fd 100644
+--- a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
+@@ -27,6 +27,23 @@
+ method = "smc";
+ };
+
++ reserved-memory {
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges;
++
++ /*
++ * This area matches the mapping done with a
++ * mainline U-Boot, and should be updated by the
++ * bootloader.
++ */
++
++ psci-area@4000000 {
++ reg = <0x0 0x4000000 0x0 0x200000>;
++ no-map;
++ };
++ };
++
+ ap806 {
+ #address-cells = <2>;
+ #size-cells = <2>;
+diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
+index 95e3fa7ded8b..8b284cbf8162 100644
+--- a/arch/arm64/include/asm/kvm_arm.h
++++ b/arch/arm64/include/asm/kvm_arm.h
+@@ -24,6 +24,8 @@
+
+ /* Hyp Configuration Register (HCR) bits */
+ #define HCR_FWB (UL(1) << 46)
++#define HCR_API (UL(1) << 41)
++#define HCR_APK (UL(1) << 40)
+ #define HCR_TEA (UL(1) << 37)
+ #define HCR_TERR (UL(1) << 36)
+ #define HCR_TLOR (UL(1) << 35)
+@@ -87,6 +89,7 @@
+ HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW | HCR_TLOR | \
+ HCR_FMO | HCR_IMO)
+ #define HCR_VIRT_EXCP_MASK (HCR_VSE | HCR_VI | HCR_VF)
++#define HCR_HOST_NVHE_FLAGS (HCR_RW | HCR_API | HCR_APK)
+ #define HCR_HOST_VHE_FLAGS (HCR_RW | HCR_TGE | HCR_E2H)
+
+ /* TCR_EL2 Registers bits */
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index b0853069702f..651a06b1980f 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -494,10 +494,9 @@ ENTRY(el2_setup)
+ #endif
+
+ /* Hyp configuration. */
+- mov x0, #HCR_RW // 64-bit EL1
++ mov_q x0, HCR_HOST_NVHE_FLAGS
+ cbz x2, set_hcr
+- orr x0, x0, #HCR_TGE // Enable Host Extensions
+- orr x0, x0, #HCR_E2H
++ mov_q x0, HCR_HOST_VHE_FLAGS
+ set_hcr:
+ msr hcr_el2, x0
+ isb
+diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
+index f0e6ab8abe9c..ba6b41790fcd 100644
+--- a/arch/arm64/kernel/kaslr.c
++++ b/arch/arm64/kernel/kaslr.c
+@@ -14,6 +14,7 @@
+ #include <linux/sched.h>
+ #include <linux/types.h>
+
++#include <asm/cacheflush.h>
+ #include <asm/fixmap.h>
+ #include <asm/kernel-pgtable.h>
+ #include <asm/memory.h>
+@@ -43,7 +44,7 @@ static __init u64 get_kaslr_seed(void *fdt)
+ return ret;
+ }
+
+-static __init const u8 *get_cmdline(void *fdt)
++static __init const u8 *kaslr_get_cmdline(void *fdt)
+ {
+ static __initconst const u8 default_cmdline[] = CONFIG_CMDLINE;
+
+@@ -109,7 +110,7 @@ u64 __init kaslr_early_init(u64 dt_phys)
+ * Check if 'nokaslr' appears on the command line, and
+ * return 0 if that is the case.
+ */
+- cmdline = get_cmdline(fdt);
++ cmdline = kaslr_get_cmdline(fdt);
+ str = strstr(cmdline, "nokaslr");
+ if (str == cmdline || (str > cmdline && *(str - 1) == ' '))
+ return 0;
+@@ -169,5 +170,8 @@ u64 __init kaslr_early_init(u64 dt_phys)
+ module_alloc_base += (module_range * (seed & ((1 << 21) - 1))) >> 21;
+ module_alloc_base &= PAGE_MASK;
+
++ __flush_dcache_area(&module_alloc_base, sizeof(module_alloc_base));
++ __flush_dcache_area(&memstart_offset_seed, sizeof(memstart_offset_seed));
++
+ return offset;
+ }
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index ca46153d7915..a1c32c1f2267 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -157,7 +157,7 @@ static void __hyp_text __deactivate_traps_nvhe(void)
+ mdcr_el2 |= MDCR_EL2_E2PB_MASK << MDCR_EL2_E2PB_SHIFT;
+
+ write_sysreg(mdcr_el2, mdcr_el2);
+- write_sysreg(HCR_RW, hcr_el2);
++ write_sysreg(HCR_HOST_NVHE_FLAGS, hcr_el2);
+ write_sysreg(CPTR_EL2_DEFAULT, cptr_el2);
+ }
+
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 35511999156a..154b811d5894 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -3149,6 +3149,7 @@ config MIPS32_O32
+ config MIPS32_N32
+ bool "Kernel support for n32 binaries"
+ depends on 64BIT
++ select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
+ select COMPAT
+ select MIPS32_COMPAT
+ select SYSVIPC_COMPAT if SYSVIPC
+diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
+index 6054d49e608e..fe3773539eff 100644
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -173,6 +173,31 @@ void __init plat_mem_setup(void)
+ pm_power_off = bcm47xx_machine_halt;
+ }
+
++#ifdef CONFIG_BCM47XX_BCMA
++static struct device * __init bcm47xx_setup_device(void)
++{
++ struct device *dev;
++ int err;
++
++ dev = kzalloc(sizeof(*dev), GFP_KERNEL);
++ if (!dev)
++ return NULL;
++
++ err = dev_set_name(dev, "bcm47xx_soc");
++ if (err) {
++ pr_err("Failed to set SoC device name: %d\n", err);
++ kfree(dev);
++ return NULL;
++ }
++
++ err = dma_coerce_mask_and_coherent(dev, DMA_BIT_MASK(32));
++ if (err)
++ pr_err("Failed to set SoC DMA mask: %d\n", err);
++
++ return dev;
++}
++#endif
++
+ /*
+ * This finishes bus initialization doing things that were not possible without
+ * kmalloc. Make sure to call it late enough (after mm_init).
+@@ -183,6 +208,10 @@ void __init bcm47xx_bus_setup(void)
+ if (bcm47xx_bus_type == BCM47XX_BUS_TYPE_BCMA) {
+ int err;
+
++ bcm47xx_bus.bcma.dev = bcm47xx_setup_device();
++ if (!bcm47xx_bus.bcma.dev)
++ panic("Failed to setup SoC device\n");
++
+ err = bcma_host_soc_init(&bcm47xx_bus.bcma);
+ if (err)
+ panic("Failed to initialize BCMA bus (err %d)", err);
+@@ -235,6 +264,8 @@ static int __init bcm47xx_register_bus_complete(void)
+ #endif
+ #ifdef CONFIG_BCM47XX_BCMA
+ case BCM47XX_BUS_TYPE_BCMA:
++ if (device_register(bcm47xx_bus.bcma.dev))
++ pr_err("Failed to register SoC device\n");
+ bcma_bus_register(&bcm47xx_bus.bcma.bus);
+ break;
+ #endif
+diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
+index f0bc3312ed11..c4ef1c31e0c4 100644
+--- a/arch/mips/lantiq/irq.c
++++ b/arch/mips/lantiq/irq.c
+@@ -224,9 +224,11 @@ static struct irq_chip ltq_eiu_type = {
+ .irq_set_type = ltq_eiu_settype,
+ };
+
+-static void ltq_hw_irqdispatch(int module)
++static void ltq_hw_irq_handler(struct irq_desc *desc)
+ {
++ int module = irq_desc_get_irq(desc) - 2;
+ u32 irq;
++ int hwirq;
+
+ irq = ltq_icu_r32(module, LTQ_ICU_IM0_IOSR);
+ if (irq == 0)
+@@ -237,7 +239,8 @@ static void ltq_hw_irqdispatch(int module)
+ * other bits might be bogus
+ */
+ irq = __fls(irq);
+- do_IRQ((int)irq + MIPS_CPU_IRQ_CASCADE + (INT_NUM_IM_OFFSET * module));
++ hwirq = irq + MIPS_CPU_IRQ_CASCADE + (INT_NUM_IM_OFFSET * module);
++ generic_handle_irq(irq_linear_revmap(ltq_domain, hwirq));
+
+ /* if this is a EBU irq, we need to ack it or get a deadlock */
+ if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
+@@ -245,49 +248,6 @@ static void ltq_hw_irqdispatch(int module)
+ LTQ_EBU_PCC_ISTAT);
+ }
+
+-#define DEFINE_HWx_IRQDISPATCH(x) \
+- static void ltq_hw ## x ## _irqdispatch(void) \
+- { \
+- ltq_hw_irqdispatch(x); \
+- }
+-DEFINE_HWx_IRQDISPATCH(0)
+-DEFINE_HWx_IRQDISPATCH(1)
+-DEFINE_HWx_IRQDISPATCH(2)
+-DEFINE_HWx_IRQDISPATCH(3)
+-DEFINE_HWx_IRQDISPATCH(4)
+-
+-#if MIPS_CPU_TIMER_IRQ == 7
+-static void ltq_hw5_irqdispatch(void)
+-{
+- do_IRQ(MIPS_CPU_TIMER_IRQ);
+-}
+-#else
+-DEFINE_HWx_IRQDISPATCH(5)
+-#endif
+-
+-static void ltq_hw_irq_handler(struct irq_desc *desc)
+-{
+- ltq_hw_irqdispatch(irq_desc_get_irq(desc) - 2);
+-}
+-
+-asmlinkage void plat_irq_dispatch(void)
+-{
+- unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM;
+- int irq;
+-
+- if (!pending) {
+- spurious_interrupt();
+- return;
+- }
+-
+- pending >>= CAUSEB_IP;
+- while (pending) {
+- irq = fls(pending) - 1;
+- do_IRQ(MIPS_CPU_IRQ_BASE + irq);
+- pending &= ~BIT(irq);
+- }
+-}
+-
+ static int icu_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw)
+ {
+ struct irq_chip *chip = <q_irq_type;
+@@ -343,28 +303,10 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent)
+ for (i = 0; i < MAX_IM; i++)
+ irq_set_chained_handler(i + 2, ltq_hw_irq_handler);
+
+- if (cpu_has_vint) {
+- pr_info("Setting up vectored interrupts\n");
+- set_vi_handler(2, ltq_hw0_irqdispatch);
+- set_vi_handler(3, ltq_hw1_irqdispatch);
+- set_vi_handler(4, ltq_hw2_irqdispatch);
+- set_vi_handler(5, ltq_hw3_irqdispatch);
+- set_vi_handler(6, ltq_hw4_irqdispatch);
+- set_vi_handler(7, ltq_hw5_irqdispatch);
+- }
+-
+ ltq_domain = irq_domain_add_linear(node,
+ (MAX_IM * INT_NUM_IM_OFFSET) + MIPS_CPU_IRQ_CASCADE,
+ &irq_domain_ops, 0);
+
+-#ifndef CONFIG_MIPS_MT_SMP
+- set_c0_status(IE_IRQ0 | IE_IRQ1 | IE_IRQ2 |
+- IE_IRQ3 | IE_IRQ4 | IE_IRQ5);
+-#else
+- set_c0_status(IE_SW0 | IE_SW1 | IE_IRQ0 | IE_IRQ1 |
+- IE_IRQ2 | IE_IRQ3 | IE_IRQ4 | IE_IRQ5);
+-#endif
+-
+ /* tell oprofile which irq to use */
+ ltq_perfcount_irq = irq_create_mapping(ltq_domain, LTQ_PERF_IRQ);
+
+diff --git a/arch/mips/pci/msi-octeon.c b/arch/mips/pci/msi-octeon.c
+index 2a5bb849b10e..288b58b00dc8 100644
+--- a/arch/mips/pci/msi-octeon.c
++++ b/arch/mips/pci/msi-octeon.c
+@@ -369,7 +369,9 @@ int __init octeon_msi_initialize(void)
+ int irq;
+ struct irq_chip *msi;
+
+- if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) {
++ if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_INVALID) {
++ return 0;
++ } else if (octeon_dma_bar_type == OCTEON_DMA_BAR_TYPE_PCIE) {
+ msi_rcv_reg[0] = CVMX_PEXP_NPEI_MSI_RCV0;
+ msi_rcv_reg[1] = CVMX_PEXP_NPEI_MSI_RCV1;
+ msi_rcv_reg[2] = CVMX_PEXP_NPEI_MSI_RCV2;
+diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
+index c84f1e039d84..01dcccf9185f 100644
+--- a/arch/x86/xen/time.c
++++ b/arch/x86/xen/time.c
+@@ -361,8 +361,6 @@ void xen_timer_resume(void)
+ {
+ int cpu;
+
+- pvclock_resume();
+-
+ if (xen_clockevent != &xen_vcpuop_clockevent)
+ return;
+
+@@ -379,12 +377,15 @@ static const struct pv_time_ops xen_time_ops __initconst = {
+ };
+
+ static struct pvclock_vsyscall_time_info *xen_clock __read_mostly;
++static u64 xen_clock_value_saved;
+
+ void xen_save_time_memory_area(void)
+ {
+ struct vcpu_register_time_memory_area t;
+ int ret;
+
++ xen_clock_value_saved = xen_clocksource_read() - xen_sched_clock_offset;
++
+ if (!xen_clock)
+ return;
+
+@@ -404,7 +405,7 @@ void xen_restore_time_memory_area(void)
+ int ret;
+
+ if (!xen_clock)
+- return;
++ goto out;
+
+ t.addr.v = &xen_clock->pvti;
+
+@@ -421,6 +422,11 @@ void xen_restore_time_memory_area(void)
+ if (ret != 0)
+ pr_notice("Cannot restore secondary vcpu_time_info (err %d)",
+ ret);
++
++out:
++ /* Need pvclock_resume() before using xen_clocksource_read(). */
++ pvclock_resume();
++ xen_sched_clock_offset = xen_clocksource_read() - xen_clock_value_saved;
+ }
+
+ static void xen_setup_vsyscall_time_info(void)
+diff --git a/block/partition-generic.c b/block/partition-generic.c
+index d3d14e81fb12..5f8db5c5140f 100644
+--- a/block/partition-generic.c
++++ b/block/partition-generic.c
+@@ -249,9 +249,10 @@ struct device_type part_type = {
+ .uevent = part_uevent,
+ };
+
+-static void delete_partition_rcu_cb(struct rcu_head *head)
++static void delete_partition_work_fn(struct work_struct *work)
+ {
+- struct hd_struct *part = container_of(head, struct hd_struct, rcu_head);
++ struct hd_struct *part = container_of(to_rcu_work(work), struct hd_struct,
++ rcu_work);
+
+ part->start_sect = 0;
+ part->nr_sects = 0;
+@@ -262,7 +263,8 @@ static void delete_partition_rcu_cb(struct rcu_head *head)
+ void __delete_partition(struct percpu_ref *ref)
+ {
+ struct hd_struct *part = container_of(ref, struct hd_struct, ref);
+- call_rcu(&part->rcu_head, delete_partition_rcu_cb);
++ INIT_RCU_WORK(&part->rcu_work, delete_partition_work_fn);
++ queue_rcu_work(system_wq, &part->rcu_work);
+ }
+
+ /*
+diff --git a/crypto/authenc.c b/crypto/authenc.c
+index 4fa8d40d947b..3ee10fc25aff 100644
+--- a/crypto/authenc.c
++++ b/crypto/authenc.c
+@@ -58,14 +58,22 @@ int crypto_authenc_extractkeys(struct crypto_authenc_keys *keys, const u8 *key,
+ return -EINVAL;
+ if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
+ return -EINVAL;
+- if (RTA_PAYLOAD(rta) < sizeof(*param))
++
++ /*
++ * RTA_OK() didn't align the rtattr's payload when validating that it
++ * fits in the buffer. Yet, the keys should start on the next 4-byte
++ * aligned boundary. To avoid confusion, require that the rtattr
++ * payload be exactly the param struct, which has a 4-byte aligned size.
++ */
++ if (RTA_PAYLOAD(rta) != sizeof(*param))
+ return -EINVAL;
++ BUILD_BUG_ON(sizeof(*param) % RTA_ALIGNTO);
+
+ param = RTA_DATA(rta);
+ keys->enckeylen = be32_to_cpu(param->enckeylen);
+
+- key += RTA_ALIGN(rta->rta_len);
+- keylen -= RTA_ALIGN(rta->rta_len);
++ key += rta->rta_len;
++ keylen -= rta->rta_len;
+
+ if (keylen < keys->enckeylen)
+ return -EINVAL;
+diff --git a/crypto/authencesn.c b/crypto/authencesn.c
+index 50b804747e20..4eff4be6bd12 100644
+--- a/crypto/authencesn.c
++++ b/crypto/authencesn.c
+@@ -279,7 +279,7 @@ static void authenc_esn_verify_ahash_done(struct crypto_async_request *areq,
+ struct aead_request *req = areq->data;
+
+ err = err ?: crypto_authenc_esn_decrypt_tail(req, 0);
+- aead_request_complete(req, err);
++ authenc_esn_request_complete(req, err);
+ }
+
+ static int crypto_authenc_esn_decrypt(struct aead_request *req)
+diff --git a/crypto/sm3_generic.c b/crypto/sm3_generic.c
+index 9a5c60f08aad..c0cf87ae7ef6 100644
+--- a/crypto/sm3_generic.c
++++ b/crypto/sm3_generic.c
+@@ -100,7 +100,7 @@ static void sm3_compress(u32 *w, u32 *wt, u32 *m)
+
+ for (i = 0; i <= 63; i++) {
+
+- ss1 = rol32((rol32(a, 12) + e + rol32(t(i), i)), 7);
++ ss1 = rol32((rol32(a, 12) + e + rol32(t(i), i & 31)), 7);
+
+ ss2 = ss1 ^ rol32(a, 12);
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index ea9debf59b22..c9c2bcc36e26 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -83,7 +83,7 @@
+ #include <linux/uaccess.h>
+
+ static DEFINE_IDR(loop_index_idr);
+-static DEFINE_MUTEX(loop_index_mutex);
++static DEFINE_MUTEX(loop_ctl_mutex);
+
+ static int max_part;
+ static int part_shift;
+@@ -631,18 +631,7 @@ static void loop_reread_partitions(struct loop_device *lo,
+ {
+ int rc;
+
+- /*
+- * bd_mutex has been held already in release path, so don't
+- * acquire it if this function is called in such case.
+- *
+- * If the reread partition isn't from release path, lo_refcnt
+- * must be at least one and it can only become zero when the
+- * current holder is released.
+- */
+- if (!atomic_read(&lo->lo_refcnt))
+- rc = __blkdev_reread_part(bdev);
+- else
+- rc = blkdev_reread_part(bdev);
++ rc = blkdev_reread_part(bdev);
+ if (rc)
+ pr_warn("%s: partition scan of loop%d (%s) failed (rc=%d)\n",
+ __func__, lo->lo_number, lo->lo_file_name, rc);
+@@ -689,26 +678,30 @@ static int loop_validate_file(struct file *file, struct block_device *bdev)
+ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
+ unsigned int arg)
+ {
+- struct file *file, *old_file;
++ struct file *file = NULL, *old_file;
+ int error;
++ bool partscan;
+
++ error = mutex_lock_killable(&loop_ctl_mutex);
++ if (error)
++ return error;
+ error = -ENXIO;
+ if (lo->lo_state != Lo_bound)
+- goto out;
++ goto out_err;
+
+ /* the loop device has to be read-only */
+ error = -EINVAL;
+ if (!(lo->lo_flags & LO_FLAGS_READ_ONLY))
+- goto out;
++ goto out_err;
+
+ error = -EBADF;
+ file = fget(arg);
+ if (!file)
+- goto out;
++ goto out_err;
+
+ error = loop_validate_file(file, bdev);
+ if (error)
+- goto out_putf;
++ goto out_err;
+
+ old_file = lo->lo_backing_file;
+
+@@ -716,7 +709,7 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
+
+ /* size of the new backing store needs to be the same */
+ if (get_loop_size(lo, file) != get_loop_size(lo, old_file))
+- goto out_putf;
++ goto out_err;
+
+ /* and ... switch */
+ blk_mq_freeze_queue(lo->lo_queue);
+@@ -727,15 +720,22 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
+ lo->old_gfp_mask & ~(__GFP_IO|__GFP_FS));
+ loop_update_dio(lo);
+ blk_mq_unfreeze_queue(lo->lo_queue);
+-
++ partscan = lo->lo_flags & LO_FLAGS_PARTSCAN;
++ mutex_unlock(&loop_ctl_mutex);
++ /*
++ * We must drop file reference outside of loop_ctl_mutex as dropping
++ * the file ref can take bd_mutex which creates circular locking
++ * dependency.
++ */
+ fput(old_file);
+- if (lo->lo_flags & LO_FLAGS_PARTSCAN)
++ if (partscan)
+ loop_reread_partitions(lo, bdev);
+ return 0;
+
+- out_putf:
+- fput(file);
+- out:
++out_err:
++ mutex_unlock(&loop_ctl_mutex);
++ if (file)
++ fput(file);
+ return error;
+ }
+
+@@ -910,6 +910,7 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
+ int lo_flags = 0;
+ int error;
+ loff_t size;
++ bool partscan;
+
+ /* This is safe, since we have a reference from open(). */
+ __module_get(THIS_MODULE);
+@@ -919,13 +920,17 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
+ if (!file)
+ goto out;
+
++ error = mutex_lock_killable(&loop_ctl_mutex);
++ if (error)
++ goto out_putf;
++
+ error = -EBUSY;
+ if (lo->lo_state != Lo_unbound)
+- goto out_putf;
++ goto out_unlock;
+
+ error = loop_validate_file(file, bdev);
+ if (error)
+- goto out_putf;
++ goto out_unlock;
+
+ mapping = file->f_mapping;
+ inode = mapping->host;
+@@ -937,10 +942,10 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
+ error = -EFBIG;
+ size = get_loop_size(lo, file);
+ if ((loff_t)(sector_t)size != size)
+- goto out_putf;
++ goto out_unlock;
+ error = loop_prepare_queue(lo);
+ if (error)
+- goto out_putf;
++ goto out_unlock;
+
+ error = 0;
+
+@@ -972,18 +977,22 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
+ lo->lo_state = Lo_bound;
+ if (part_shift)
+ lo->lo_flags |= LO_FLAGS_PARTSCAN;
+- if (lo->lo_flags & LO_FLAGS_PARTSCAN)
+- loop_reread_partitions(lo, bdev);
++ partscan = lo->lo_flags & LO_FLAGS_PARTSCAN;
+
+ /* Grab the block_device to prevent its destruction after we
+- * put /dev/loopXX inode. Later in loop_clr_fd() we bdput(bdev).
++ * put /dev/loopXX inode. Later in __loop_clr_fd() we bdput(bdev).
+ */
+ bdgrab(bdev);
++ mutex_unlock(&loop_ctl_mutex);
++ if (partscan)
++ loop_reread_partitions(lo, bdev);
+ return 0;
+
+- out_putf:
++out_unlock:
++ mutex_unlock(&loop_ctl_mutex);
++out_putf:
+ fput(file);
+- out:
++out:
+ /* This is safe: open() is still holding a reference. */
+ module_put(THIS_MODULE);
+ return error;
+@@ -1026,39 +1035,31 @@ loop_init_xfer(struct loop_device *lo, struct loop_func_table *xfer,
+ return err;
+ }
+
+-static int loop_clr_fd(struct loop_device *lo)
++static int __loop_clr_fd(struct loop_device *lo, bool release)
+ {
+- struct file *filp = lo->lo_backing_file;
++ struct file *filp = NULL;
+ gfp_t gfp = lo->old_gfp_mask;
+ struct block_device *bdev = lo->lo_device;
++ int err = 0;
++ bool partscan = false;
++ int lo_number;
+
+- if (lo->lo_state != Lo_bound)
+- return -ENXIO;
+-
+- /*
+- * If we've explicitly asked to tear down the loop device,
+- * and it has an elevated reference count, set it for auto-teardown when
+- * the last reference goes away. This stops $!~#$@ udev from
+- * preventing teardown because it decided that it needs to run blkid on
+- * the loopback device whenever they appear. xfstests is notorious for
+- * failing tests because blkid via udev races with a losetup
+- * <dev>/do something like mkfs/losetup -d <dev> causing the losetup -d
+- * command to fail with EBUSY.
+- */
+- if (atomic_read(&lo->lo_refcnt) > 1) {
+- lo->lo_flags |= LO_FLAGS_AUTOCLEAR;
+- mutex_unlock(&lo->lo_ctl_mutex);
+- return 0;
++ mutex_lock(&loop_ctl_mutex);
++ if (WARN_ON_ONCE(lo->lo_state != Lo_rundown)) {
++ err = -ENXIO;
++ goto out_unlock;
+ }
+
+- if (filp == NULL)
+- return -EINVAL;
++ filp = lo->lo_backing_file;
++ if (filp == NULL) {
++ err = -EINVAL;
++ goto out_unlock;
++ }
+
+ /* freeze request queue during the transition */
+ blk_mq_freeze_queue(lo->lo_queue);
+
+ spin_lock_irq(&lo->lo_lock);
+- lo->lo_state = Lo_rundown;
+ lo->lo_backing_file = NULL;
+ spin_unlock_irq(&lo->lo_lock);
+
+@@ -1094,21 +1095,73 @@ static int loop_clr_fd(struct loop_device *lo)
+ module_put(THIS_MODULE);
+ blk_mq_unfreeze_queue(lo->lo_queue);
+
+- if (lo->lo_flags & LO_FLAGS_PARTSCAN && bdev)
+- loop_reread_partitions(lo, bdev);
++ partscan = lo->lo_flags & LO_FLAGS_PARTSCAN && bdev;
++ lo_number = lo->lo_number;
+ lo->lo_flags = 0;
+ if (!part_shift)
+ lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN;
+ loop_unprepare_queue(lo);
+- mutex_unlock(&lo->lo_ctl_mutex);
++out_unlock:
++ mutex_unlock(&loop_ctl_mutex);
++ if (partscan) {
++ /*
++ * bd_mutex has been held already in release path, so don't
++ * acquire it if this function is called in such case.
++ *
++ * If the reread partition isn't from release path, lo_refcnt
++ * must be at least one and it can only become zero when the
++ * current holder is released.
++ */
++ if (release)
++ err = __blkdev_reread_part(bdev);
++ else
++ err = blkdev_reread_part(bdev);
++ pr_warn("%s: partition scan of loop%d failed (rc=%d)\n",
++ __func__, lo_number, err);
++ /* Device is gone, no point in returning error */
++ err = 0;
++ }
+ /*
+- * Need not hold lo_ctl_mutex to fput backing file.
+- * Calling fput holding lo_ctl_mutex triggers a circular
++ * Need not hold loop_ctl_mutex to fput backing file.
++ * Calling fput holding loop_ctl_mutex triggers a circular
+ * lock dependency possibility warning as fput can take
+- * bd_mutex which is usually taken before lo_ctl_mutex.
++ * bd_mutex which is usually taken before loop_ctl_mutex.
+ */
+- fput(filp);
+- return 0;
++ if (filp)
++ fput(filp);
++ return err;
++}
++
++static int loop_clr_fd(struct loop_device *lo)
++{
++ int err;
++
++ err = mutex_lock_killable(&loop_ctl_mutex);
++ if (err)
++ return err;
++ if (lo->lo_state != Lo_bound) {
++ mutex_unlock(&loop_ctl_mutex);
++ return -ENXIO;
++ }
++ /*
++ * If we've explicitly asked to tear down the loop device,
++ * and it has an elevated reference count, set it for auto-teardown when
++ * the last reference goes away. This stops $!~#$@ udev from
++ * preventing teardown because it decided that it needs to run blkid on
++ * the loopback device whenever they appear. xfstests is notorious for
++ * failing tests because blkid via udev races with a losetup
++ * <dev>/do something like mkfs/losetup -d <dev> causing the losetup -d
++ * command to fail with EBUSY.
++ */
++ if (atomic_read(&lo->lo_refcnt) > 1) {
++ lo->lo_flags |= LO_FLAGS_AUTOCLEAR;
++ mutex_unlock(&loop_ctl_mutex);
++ return 0;
++ }
++ lo->lo_state = Lo_rundown;
++ mutex_unlock(&loop_ctl_mutex);
++
++ return __loop_clr_fd(lo, false);
+ }
+
+ static int
+@@ -1117,47 +1170,72 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
+ int err;
+ struct loop_func_table *xfer;
+ kuid_t uid = current_uid();
++ struct block_device *bdev;
++ bool partscan = false;
+
++ err = mutex_lock_killable(&loop_ctl_mutex);
++ if (err)
++ return err;
+ if (lo->lo_encrypt_key_size &&
+ !uid_eq(lo->lo_key_owner, uid) &&
+- !capable(CAP_SYS_ADMIN))
+- return -EPERM;
+- if (lo->lo_state != Lo_bound)
+- return -ENXIO;
+- if ((unsigned int) info->lo_encrypt_key_size > LO_KEY_SIZE)
+- return -EINVAL;
++ !capable(CAP_SYS_ADMIN)) {
++ err = -EPERM;
++ goto out_unlock;
++ }
++ if (lo->lo_state != Lo_bound) {
++ err = -ENXIO;
++ goto out_unlock;
++ }
++ if ((unsigned int) info->lo_encrypt_key_size > LO_KEY_SIZE) {
++ err = -EINVAL;
++ goto out_unlock;
++ }
++
++ if (lo->lo_offset != info->lo_offset ||
++ lo->lo_sizelimit != info->lo_sizelimit) {
++ sync_blockdev(lo->lo_device);
++ kill_bdev(lo->lo_device);
++ }
+
+ /* I/O need to be drained during transfer transition */
+ blk_mq_freeze_queue(lo->lo_queue);
+
+ err = loop_release_xfer(lo);
+ if (err)
+- goto exit;
++ goto out_unfreeze;
+
+ if (info->lo_encrypt_type) {
+ unsigned int type = info->lo_encrypt_type;
+
+ if (type >= MAX_LO_CRYPT) {
+ err = -EINVAL;
+- goto exit;
++ goto out_unfreeze;
+ }
+ xfer = xfer_funcs[type];
+ if (xfer == NULL) {
+ err = -EINVAL;
+- goto exit;
++ goto out_unfreeze;
+ }
+ } else
+ xfer = NULL;
+
+ err = loop_init_xfer(lo, xfer, info);
+ if (err)
+- goto exit;
++ goto out_unfreeze;
+
+ if (lo->lo_offset != info->lo_offset ||
+ lo->lo_sizelimit != info->lo_sizelimit) {
++ /* kill_bdev should have truncated all the pages */
++ if (lo->lo_device->bd_inode->i_mapping->nrpages) {
++ err = -EAGAIN;
++ pr_warn("%s: loop%d (%s) has still dirty pages (nrpages=%lu)\n",
++ __func__, lo->lo_number, lo->lo_file_name,
++ lo->lo_device->bd_inode->i_mapping->nrpages);
++ goto out_unfreeze;
++ }
+ if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) {
+ err = -EFBIG;
+- goto exit;
++ goto out_unfreeze;
+ }
+ }
+
+@@ -1189,15 +1267,20 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
+ /* update dio if lo_offset or transfer is changed */
+ __loop_update_dio(lo, lo->use_dio);
+
+- exit:
++out_unfreeze:
+ blk_mq_unfreeze_queue(lo->lo_queue);
+
+ if (!err && (info->lo_flags & LO_FLAGS_PARTSCAN) &&
+ !(lo->lo_flags & LO_FLAGS_PARTSCAN)) {
+ lo->lo_flags |= LO_FLAGS_PARTSCAN;
+ lo->lo_disk->flags &= ~GENHD_FL_NO_PART_SCAN;
+- loop_reread_partitions(lo, lo->lo_device);
++ bdev = lo->lo_device;
++ partscan = true;
+ }
++out_unlock:
++ mutex_unlock(&loop_ctl_mutex);
++ if (partscan)
++ loop_reread_partitions(lo, bdev);
+
+ return err;
+ }
+@@ -1205,12 +1288,15 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
+ static int
+ loop_get_status(struct loop_device *lo, struct loop_info64 *info)
+ {
+- struct file *file;
++ struct path path;
+ struct kstat stat;
+ int ret;
+
++ ret = mutex_lock_killable(&loop_ctl_mutex);
++ if (ret)
++ return ret;
+ if (lo->lo_state != Lo_bound) {
+- mutex_unlock(&lo->lo_ctl_mutex);
++ mutex_unlock(&loop_ctl_mutex);
+ return -ENXIO;
+ }
+
+@@ -1229,17 +1315,17 @@ loop_get_status(struct loop_device *lo, struct loop_info64 *info)
+ lo->lo_encrypt_key_size);
+ }
+
+- /* Drop lo_ctl_mutex while we call into the filesystem. */
+- file = get_file(lo->lo_backing_file);
+- mutex_unlock(&lo->lo_ctl_mutex);
+- ret = vfs_getattr(&file->f_path, &stat, STATX_INO,
+- AT_STATX_SYNC_AS_STAT);
++ /* Drop loop_ctl_mutex while we call into the filesystem. */
++ path = lo->lo_backing_file->f_path;
++ path_get(&path);
++ mutex_unlock(&loop_ctl_mutex);
++ ret = vfs_getattr(&path, &stat, STATX_INO, AT_STATX_SYNC_AS_STAT);
+ if (!ret) {
+ info->lo_device = huge_encode_dev(stat.dev);
+ info->lo_inode = stat.ino;
+ info->lo_rdevice = huge_encode_dev(stat.rdev);
+ }
+- fput(file);
++ path_put(&path);
+ return ret;
+ }
+
+@@ -1323,10 +1409,8 @@ loop_get_status_old(struct loop_device *lo, struct loop_info __user *arg) {
+ struct loop_info64 info64;
+ int err;
+
+- if (!arg) {
+- mutex_unlock(&lo->lo_ctl_mutex);
++ if (!arg)
+ return -EINVAL;
+- }
+ err = loop_get_status(lo, &info64);
+ if (!err)
+ err = loop_info64_to_old(&info64, &info);
+@@ -1341,10 +1425,8 @@ loop_get_status64(struct loop_device *lo, struct loop_info64 __user *arg) {
+ struct loop_info64 info64;
+ int err;
+
+- if (!arg) {
+- mutex_unlock(&lo->lo_ctl_mutex);
++ if (!arg)
+ return -EINVAL;
+- }
+ err = loop_get_status(lo, &info64);
+ if (!err && copy_to_user(arg, &info64, sizeof(info64)))
+ err = -EFAULT;
+@@ -1376,22 +1458,64 @@ static int loop_set_dio(struct loop_device *lo, unsigned long arg)
+
+ static int loop_set_block_size(struct loop_device *lo, unsigned long arg)
+ {
++ int err = 0;
++
+ if (lo->lo_state != Lo_bound)
+ return -ENXIO;
+
+ if (arg < 512 || arg > PAGE_SIZE || !is_power_of_2(arg))
+ return -EINVAL;
+
++ if (lo->lo_queue->limits.logical_block_size != arg) {
++ sync_blockdev(lo->lo_device);
++ kill_bdev(lo->lo_device);
++ }
++
+ blk_mq_freeze_queue(lo->lo_queue);
+
++ /* kill_bdev should have truncated all the pages */
++ if (lo->lo_queue->limits.logical_block_size != arg &&
++ lo->lo_device->bd_inode->i_mapping->nrpages) {
++ err = -EAGAIN;
++ pr_warn("%s: loop%d (%s) has still dirty pages (nrpages=%lu)\n",
++ __func__, lo->lo_number, lo->lo_file_name,
++ lo->lo_device->bd_inode->i_mapping->nrpages);
++ goto out_unfreeze;
++ }
++
+ blk_queue_logical_block_size(lo->lo_queue, arg);
+ blk_queue_physical_block_size(lo->lo_queue, arg);
+ blk_queue_io_min(lo->lo_queue, arg);
+ loop_update_dio(lo);
+-
++out_unfreeze:
+ blk_mq_unfreeze_queue(lo->lo_queue);
+
+- return 0;
++ return err;
++}
++
++static int lo_simple_ioctl(struct loop_device *lo, unsigned int cmd,
++ unsigned long arg)
++{
++ int err;
++
++ err = mutex_lock_killable(&loop_ctl_mutex);
++ if (err)
++ return err;
++ switch (cmd) {
++ case LOOP_SET_CAPACITY:
++ err = loop_set_capacity(lo);
++ break;
++ case LOOP_SET_DIRECT_IO:
++ err = loop_set_dio(lo, arg);
++ break;
++ case LOOP_SET_BLOCK_SIZE:
++ err = loop_set_block_size(lo, arg);
++ break;
++ default:
++ err = lo->ioctl ? lo->ioctl(lo, cmd, arg) : -EINVAL;
++ }
++ mutex_unlock(&loop_ctl_mutex);
++ return err;
+ }
+
+ static int lo_ioctl(struct block_device *bdev, fmode_t mode,
+@@ -1400,64 +1524,42 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode,
+ struct loop_device *lo = bdev->bd_disk->private_data;
+ int err;
+
+- err = mutex_lock_killable_nested(&lo->lo_ctl_mutex, 1);
+- if (err)
+- goto out_unlocked;
+-
+ switch (cmd) {
+ case LOOP_SET_FD:
+- err = loop_set_fd(lo, mode, bdev, arg);
+- break;
++ return loop_set_fd(lo, mode, bdev, arg);
+ case LOOP_CHANGE_FD:
+- err = loop_change_fd(lo, bdev, arg);
+- break;
++ return loop_change_fd(lo, bdev, arg);
+ case LOOP_CLR_FD:
+- /* loop_clr_fd would have unlocked lo_ctl_mutex on success */
+- err = loop_clr_fd(lo);
+- if (!err)
+- goto out_unlocked;
+- break;
++ return loop_clr_fd(lo);
+ case LOOP_SET_STATUS:
+ err = -EPERM;
+- if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN))
++ if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) {
+ err = loop_set_status_old(lo,
+ (struct loop_info __user *)arg);
++ }
+ break;
+ case LOOP_GET_STATUS:
+- err = loop_get_status_old(lo, (struct loop_info __user *) arg);
+- /* loop_get_status() unlocks lo_ctl_mutex */
+- goto out_unlocked;
++ return loop_get_status_old(lo, (struct loop_info __user *) arg);
+ case LOOP_SET_STATUS64:
+ err = -EPERM;
+- if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN))
++ if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) {
+ err = loop_set_status64(lo,
+ (struct loop_info64 __user *) arg);
++ }
+ break;
+ case LOOP_GET_STATUS64:
+- err = loop_get_status64(lo, (struct loop_info64 __user *) arg);
+- /* loop_get_status() unlocks lo_ctl_mutex */
+- goto out_unlocked;
++ return loop_get_status64(lo, (struct loop_info64 __user *) arg);
+ case LOOP_SET_CAPACITY:
+- err = -EPERM;
+- if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN))
+- err = loop_set_capacity(lo);
+- break;
+ case LOOP_SET_DIRECT_IO:
+- err = -EPERM;
+- if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN))
+- err = loop_set_dio(lo, arg);
+- break;
+ case LOOP_SET_BLOCK_SIZE:
+- err = -EPERM;
+- if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN))
+- err = loop_set_block_size(lo, arg);
+- break;
++ if (!(mode & FMODE_WRITE) && !capable(CAP_SYS_ADMIN))
++ return -EPERM;
++ /* Fall through */
+ default:
+- err = lo->ioctl ? lo->ioctl(lo, cmd, arg) : -EINVAL;
++ err = lo_simple_ioctl(lo, cmd, arg);
++ break;
+ }
+- mutex_unlock(&lo->lo_ctl_mutex);
+
+-out_unlocked:
+ return err;
+ }
+
+@@ -1571,10 +1673,8 @@ loop_get_status_compat(struct loop_device *lo,
+ struct loop_info64 info64;
+ int err;
+
+- if (!arg) {
+- mutex_unlock(&lo->lo_ctl_mutex);
++ if (!arg)
+ return -EINVAL;
+- }
+ err = loop_get_status(lo, &info64);
+ if (!err)
+ err = loop_info64_to_compat(&info64, arg);
+@@ -1589,20 +1689,12 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode,
+
+ switch(cmd) {
+ case LOOP_SET_STATUS:
+- err = mutex_lock_killable(&lo->lo_ctl_mutex);
+- if (!err) {
+- err = loop_set_status_compat(lo,
+- (const struct compat_loop_info __user *)arg);
+- mutex_unlock(&lo->lo_ctl_mutex);
+- }
++ err = loop_set_status_compat(lo,
++ (const struct compat_loop_info __user *)arg);
+ break;
+ case LOOP_GET_STATUS:
+- err = mutex_lock_killable(&lo->lo_ctl_mutex);
+- if (!err) {
+- err = loop_get_status_compat(lo,
+- (struct compat_loop_info __user *)arg);
+- /* loop_get_status() unlocks lo_ctl_mutex */
+- }
++ err = loop_get_status_compat(lo,
++ (struct compat_loop_info __user *)arg);
+ break;
+ case LOOP_SET_CAPACITY:
+ case LOOP_CLR_FD:
+@@ -1626,9 +1718,11 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode,
+ static int lo_open(struct block_device *bdev, fmode_t mode)
+ {
+ struct loop_device *lo;
+- int err = 0;
++ int err;
+
+- mutex_lock(&loop_index_mutex);
++ err = mutex_lock_killable(&loop_ctl_mutex);
++ if (err)
++ return err;
+ lo = bdev->bd_disk->private_data;
+ if (!lo) {
+ err = -ENXIO;
+@@ -1637,26 +1731,30 @@ static int lo_open(struct block_device *bdev, fmode_t mode)
+
+ atomic_inc(&lo->lo_refcnt);
+ out:
+- mutex_unlock(&loop_index_mutex);
++ mutex_unlock(&loop_ctl_mutex);
+ return err;
+ }
+
+-static void __lo_release(struct loop_device *lo)
++static void lo_release(struct gendisk *disk, fmode_t mode)
+ {
+- int err;
++ struct loop_device *lo;
+
++ mutex_lock(&loop_ctl_mutex);
++ lo = disk->private_data;
+ if (atomic_dec_return(&lo->lo_refcnt))
+- return;
++ goto out_unlock;
+
+- mutex_lock(&lo->lo_ctl_mutex);
+ if (lo->lo_flags & LO_FLAGS_AUTOCLEAR) {
++ if (lo->lo_state != Lo_bound)
++ goto out_unlock;
++ lo->lo_state = Lo_rundown;
++ mutex_unlock(&loop_ctl_mutex);
+ /*
+ * In autoclear mode, stop the loop thread
+ * and remove configuration after last close.
+ */
+- err = loop_clr_fd(lo);
+- if (!err)
+- return;
++ __loop_clr_fd(lo, true);
++ return;
+ } else if (lo->lo_state == Lo_bound) {
+ /*
+ * Otherwise keep thread (if running) and config,
+@@ -1666,14 +1764,8 @@ static void __lo_release(struct loop_device *lo)
+ blk_mq_unfreeze_queue(lo->lo_queue);
+ }
+
+- mutex_unlock(&lo->lo_ctl_mutex);
+-}
+-
+-static void lo_release(struct gendisk *disk, fmode_t mode)
+-{
+- mutex_lock(&loop_index_mutex);
+- __lo_release(disk->private_data);
+- mutex_unlock(&loop_index_mutex);
++out_unlock:
++ mutex_unlock(&loop_ctl_mutex);
+ }
+
+ static const struct block_device_operations lo_fops = {
+@@ -1712,10 +1804,10 @@ static int unregister_transfer_cb(int id, void *ptr, void *data)
+ struct loop_device *lo = ptr;
+ struct loop_func_table *xfer = data;
+
+- mutex_lock(&lo->lo_ctl_mutex);
++ mutex_lock(&loop_ctl_mutex);
+ if (lo->lo_encryption == xfer)
+ loop_release_xfer(lo);
+- mutex_unlock(&lo->lo_ctl_mutex);
++ mutex_unlock(&loop_ctl_mutex);
+ return 0;
+ }
+
+@@ -1896,7 +1988,6 @@ static int loop_add(struct loop_device **l, int i)
+ if (!part_shift)
+ disk->flags |= GENHD_FL_NO_PART_SCAN;
+ disk->flags |= GENHD_FL_EXT_DEVT;
+- mutex_init(&lo->lo_ctl_mutex);
+ atomic_set(&lo->lo_refcnt, 0);
+ lo->lo_number = i;
+ spin_lock_init(&lo->lo_lock);
+@@ -1975,7 +2066,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data)
+ struct kobject *kobj;
+ int err;
+
+- mutex_lock(&loop_index_mutex);
++ mutex_lock(&loop_ctl_mutex);
+ err = loop_lookup(&lo, MINOR(dev) >> part_shift);
+ if (err < 0)
+ err = loop_add(&lo, MINOR(dev) >> part_shift);
+@@ -1983,7 +2074,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data)
+ kobj = NULL;
+ else
+ kobj = get_disk_and_module(lo->lo_disk);
+- mutex_unlock(&loop_index_mutex);
++ mutex_unlock(&loop_ctl_mutex);
+
+ *part = 0;
+ return kobj;
+@@ -1993,9 +2084,13 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd,
+ unsigned long parm)
+ {
+ struct loop_device *lo;
+- int ret = -ENOSYS;
++ int ret;
++
++ ret = mutex_lock_killable(&loop_ctl_mutex);
++ if (ret)
++ return ret;
+
+- mutex_lock(&loop_index_mutex);
++ ret = -ENOSYS;
+ switch (cmd) {
+ case LOOP_CTL_ADD:
+ ret = loop_lookup(&lo, parm);
+@@ -2009,21 +2104,15 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd,
+ ret = loop_lookup(&lo, parm);
+ if (ret < 0)
+ break;
+- ret = mutex_lock_killable(&lo->lo_ctl_mutex);
+- if (ret)
+- break;
+ if (lo->lo_state != Lo_unbound) {
+ ret = -EBUSY;
+- mutex_unlock(&lo->lo_ctl_mutex);
+ break;
+ }
+ if (atomic_read(&lo->lo_refcnt) > 0) {
+ ret = -EBUSY;
+- mutex_unlock(&lo->lo_ctl_mutex);
+ break;
+ }
+ lo->lo_disk->private_data = NULL;
+- mutex_unlock(&lo->lo_ctl_mutex);
+ idr_remove(&loop_index_idr, lo->lo_number);
+ loop_remove(lo);
+ break;
+@@ -2033,7 +2122,7 @@ static long loop_control_ioctl(struct file *file, unsigned int cmd,
+ break;
+ ret = loop_add(&lo, -1);
+ }
+- mutex_unlock(&loop_index_mutex);
++ mutex_unlock(&loop_ctl_mutex);
+
+ return ret;
+ }
+@@ -2117,10 +2206,10 @@ static int __init loop_init(void)
+ THIS_MODULE, loop_probe, NULL, NULL);
+
+ /* pre-create number of devices given by config or max_loop */
+- mutex_lock(&loop_index_mutex);
++ mutex_lock(&loop_ctl_mutex);
+ for (i = 0; i < nr; i++)
+ loop_add(&lo, i);
+- mutex_unlock(&loop_index_mutex);
++ mutex_unlock(&loop_ctl_mutex);
+
+ printk(KERN_INFO "loop: module loaded\n");
+ return 0;
+diff --git a/drivers/block/loop.h b/drivers/block/loop.h
+index 4d42c7af7de7..af75a5ee4094 100644
+--- a/drivers/block/loop.h
++++ b/drivers/block/loop.h
+@@ -54,7 +54,6 @@ struct loop_device {
+
+ spinlock_t lo_lock;
+ int lo_state;
+- struct mutex lo_ctl_mutex;
+ struct kthread_worker worker;
+ struct task_struct *worker_task;
+ bool use_dio;
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 14a51254c3db..c13a6d1796a7 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -288,9 +288,10 @@ static void nbd_size_update(struct nbd_device *nbd)
+ blk_queue_physical_block_size(nbd->disk->queue, config->blksize);
+ set_capacity(nbd->disk, config->bytesize >> 9);
+ if (bdev) {
+- if (bdev->bd_disk)
++ if (bdev->bd_disk) {
+ bd_set_size(bdev, config->bytesize);
+- else
++ set_blocksize(bdev, config->blksize);
++ } else
+ bdev->bd_invalidated = 1;
+ bdput(bdev);
+ }
+diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
+index a8c4ce07fc9d..a825b6444459 100644
+--- a/drivers/crypto/Kconfig
++++ b/drivers/crypto/Kconfig
+@@ -681,6 +681,7 @@ config CRYPTO_DEV_BCM_SPU
+ depends on ARCH_BCM_IPROC
+ depends on MAILBOX
+ default m
++ select CRYPTO_AUTHENC
+ select CRYPTO_DES
+ select CRYPTO_MD5
+ select CRYPTO_SHA1
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index 2d1f1db9f807..cd464637b0cb 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -2845,44 +2845,28 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
+ struct spu_hw *spu = &iproc_priv.spu;
+ struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher);
+ struct crypto_tfm *tfm = crypto_aead_tfm(cipher);
+- struct rtattr *rta = (void *)key;
+- struct crypto_authenc_key_param *param;
+- const u8 *origkey = key;
+- const unsigned int origkeylen = keylen;
+-
+- int ret = 0;
++ struct crypto_authenc_keys keys;
++ int ret;
+
+ flow_log("%s() aead:%p key:%p keylen:%u\n", __func__, cipher, key,
+ keylen);
+ flow_dump(" key: ", key, keylen);
+
+- if (!RTA_OK(rta, keylen))
+- goto badkey;
+- if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
+- goto badkey;
+- if (RTA_PAYLOAD(rta) < sizeof(*param))
++ ret = crypto_authenc_extractkeys(&keys, key, keylen);
++ if (ret)
+ goto badkey;
+
+- param = RTA_DATA(rta);
+- ctx->enckeylen = be32_to_cpu(param->enckeylen);
+-
+- key += RTA_ALIGN(rta->rta_len);
+- keylen -= RTA_ALIGN(rta->rta_len);
+-
+- if (keylen < ctx->enckeylen)
+- goto badkey;
+- if (ctx->enckeylen > MAX_KEY_SIZE)
++ if (keys.enckeylen > MAX_KEY_SIZE ||
++ keys.authkeylen > MAX_KEY_SIZE)
+ goto badkey;
+
+- ctx->authkeylen = keylen - ctx->enckeylen;
+-
+- if (ctx->authkeylen > MAX_KEY_SIZE)
+- goto badkey;
++ ctx->enckeylen = keys.enckeylen;
++ ctx->authkeylen = keys.authkeylen;
+
+- memcpy(ctx->enckey, key + ctx->authkeylen, ctx->enckeylen);
++ memcpy(ctx->enckey, keys.enckey, keys.enckeylen);
+ /* May end up padding auth key. So make sure it's zeroed. */
+ memset(ctx->authkey, 0, sizeof(ctx->authkey));
+- memcpy(ctx->authkey, key, ctx->authkeylen);
++ memcpy(ctx->authkey, keys.authkey, keys.authkeylen);
+
+ switch (ctx->alg->cipher_info.alg) {
+ case CIPHER_ALG_DES:
+@@ -2890,7 +2874,7 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
+ u32 tmp[DES_EXPKEY_WORDS];
+ u32 flags = CRYPTO_TFM_RES_WEAK_KEY;
+
+- if (des_ekey(tmp, key) == 0) {
++ if (des_ekey(tmp, keys.enckey) == 0) {
+ if (crypto_aead_get_flags(cipher) &
+ CRYPTO_TFM_REQ_WEAK_KEY) {
+ crypto_aead_set_flags(cipher, flags);
+@@ -2905,7 +2889,7 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
+ break;
+ case CIPHER_ALG_3DES:
+ if (ctx->enckeylen == (DES_KEY_SIZE * 3)) {
+- const u32 *K = (const u32 *)key;
++ const u32 *K = (const u32 *)keys.enckey;
+ u32 flags = CRYPTO_TFM_RES_BAD_KEY_SCHED;
+
+ if (!((K[0] ^ K[2]) | (K[1] ^ K[3])) ||
+@@ -2956,9 +2940,7 @@ static int aead_authenc_setkey(struct crypto_aead *cipher,
+ ctx->fallback_cipher->base.crt_flags &= ~CRYPTO_TFM_REQ_MASK;
+ ctx->fallback_cipher->base.crt_flags |=
+ tfm->crt_flags & CRYPTO_TFM_REQ_MASK;
+- ret =
+- crypto_aead_setkey(ctx->fallback_cipher, origkey,
+- origkeylen);
++ ret = crypto_aead_setkey(ctx->fallback_cipher, key, keylen);
+ if (ret) {
+ flow_log(" fallback setkey() returned:%d\n", ret);
+ tfm->crt_flags &= ~CRYPTO_TFM_RES_MASK;
+diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
+index 43975ab5f09c..f84ca2ff61de 100644
+--- a/drivers/crypto/caam/caamhash.c
++++ b/drivers/crypto/caam/caamhash.c
+@@ -1131,13 +1131,16 @@ static int ahash_final_no_ctx(struct ahash_request *req)
+
+ desc = edesc->hw_desc;
+
+- state->buf_dma = dma_map_single(jrdev, buf, buflen, DMA_TO_DEVICE);
+- if (dma_mapping_error(jrdev, state->buf_dma)) {
+- dev_err(jrdev, "unable to map src\n");
+- goto unmap;
+- }
++ if (buflen) {
++ state->buf_dma = dma_map_single(jrdev, buf, buflen,
++ DMA_TO_DEVICE);
++ if (dma_mapping_error(jrdev, state->buf_dma)) {
++ dev_err(jrdev, "unable to map src\n");
++ goto unmap;
++ }
+
+- append_seq_in_ptr(desc, state->buf_dma, buflen, 0);
++ append_seq_in_ptr(desc, state->buf_dma, buflen, 0);
++ }
+
+ edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
+ digestsize);
+diff --git a/drivers/crypto/ccree/cc_aead.c b/drivers/crypto/ccree/cc_aead.c
+index 01b82b82f8b8..5852d29ae2da 100644
+--- a/drivers/crypto/ccree/cc_aead.c
++++ b/drivers/crypto/ccree/cc_aead.c
+@@ -540,13 +540,12 @@ static int cc_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ unsigned int keylen)
+ {
+ struct cc_aead_ctx *ctx = crypto_aead_ctx(tfm);
+- struct rtattr *rta = (struct rtattr *)key;
+ struct cc_crypto_req cc_req = {};
+- struct crypto_authenc_key_param *param;
+ struct cc_hw_desc desc[MAX_AEAD_SETKEY_SEQ];
+- int rc = -EINVAL;
+ unsigned int seq_len = 0;
+ struct device *dev = drvdata_to_dev(ctx->drvdata);
++ const u8 *enckey, *authkey;
++ int rc;
+
+ dev_dbg(dev, "Setting key in context @%p for %s. key=%p keylen=%u\n",
+ ctx, crypto_tfm_alg_name(crypto_aead_tfm(tfm)), key, keylen);
+@@ -554,35 +553,33 @@ static int cc_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ /* STAT_PHASE_0: Init and sanity checks */
+
+ if (ctx->auth_mode != DRV_HASH_NULL) { /* authenc() alg. */
+- if (!RTA_OK(rta, keylen))
+- goto badkey;
+- if (rta->rta_type != CRYPTO_AUTHENC_KEYA_PARAM)
+- goto badkey;
+- if (RTA_PAYLOAD(rta) < sizeof(*param))
+- goto badkey;
+- param = RTA_DATA(rta);
+- ctx->enc_keylen = be32_to_cpu(param->enckeylen);
+- key += RTA_ALIGN(rta->rta_len);
+- keylen -= RTA_ALIGN(rta->rta_len);
+- if (keylen < ctx->enc_keylen)
++ struct crypto_authenc_keys keys;
++
++ rc = crypto_authenc_extractkeys(&keys, key, keylen);
++ if (rc)
+ goto badkey;
+- ctx->auth_keylen = keylen - ctx->enc_keylen;
++ enckey = keys.enckey;
++ authkey = keys.authkey;
++ ctx->enc_keylen = keys.enckeylen;
++ ctx->auth_keylen = keys.authkeylen;
+
+ if (ctx->cipher_mode == DRV_CIPHER_CTR) {
+ /* the nonce is stored in bytes at end of key */
++ rc = -EINVAL;
+ if (ctx->enc_keylen <
+ (AES_MIN_KEY_SIZE + CTR_RFC3686_NONCE_SIZE))
+ goto badkey;
+ /* Copy nonce from last 4 bytes in CTR key to
+ * first 4 bytes in CTR IV
+ */
+- memcpy(ctx->ctr_nonce, key + ctx->auth_keylen +
+- ctx->enc_keylen - CTR_RFC3686_NONCE_SIZE,
+- CTR_RFC3686_NONCE_SIZE);
++ memcpy(ctx->ctr_nonce, enckey + ctx->enc_keylen -
++ CTR_RFC3686_NONCE_SIZE, CTR_RFC3686_NONCE_SIZE);
+ /* Set CTR key size */
+ ctx->enc_keylen -= CTR_RFC3686_NONCE_SIZE;
+ }
+ } else { /* non-authenc - has just one key */
++ enckey = key;
++ authkey = NULL;
+ ctx->enc_keylen = keylen;
+ ctx->auth_keylen = 0;
+ }
+@@ -594,13 +591,14 @@ static int cc_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ /* STAT_PHASE_1: Copy key to ctx */
+
+ /* Get key material */
+- memcpy(ctx->enckey, key + ctx->auth_keylen, ctx->enc_keylen);
++ memcpy(ctx->enckey, enckey, ctx->enc_keylen);
+ if (ctx->enc_keylen == 24)
+ memset(ctx->enckey + 24, 0, CC_AES_KEY_SIZE_MAX - 24);
+ if (ctx->auth_mode == DRV_HASH_XCBC_MAC) {
+- memcpy(ctx->auth_state.xcbc.xcbc_keys, key, ctx->auth_keylen);
++ memcpy(ctx->auth_state.xcbc.xcbc_keys, authkey,
++ ctx->auth_keylen);
+ } else if (ctx->auth_mode != DRV_HASH_NULL) { /* HMAC */
+- rc = cc_get_plain_hmac_key(tfm, key, ctx->auth_keylen);
++ rc = cc_get_plain_hmac_key(tfm, authkey, ctx->auth_keylen);
+ if (rc)
+ goto badkey;
+ }
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 6988012deca4..f4f3e9a5851e 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -1361,23 +1361,18 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
+ int max_len = is_sec1 ? TALITOS1_MAX_DATA_LEN : TALITOS2_MAX_DATA_LEN;
+- void *err;
+
+ if (cryptlen + authsize > max_len) {
+ dev_err(dev, "length exceeds h/w max limit\n");
+ return ERR_PTR(-EINVAL);
+ }
+
+- if (ivsize)
+- iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE);
+-
+ if (!dst || dst == src) {
+ src_len = assoclen + cryptlen + authsize;
+ src_nents = sg_nents_for_len(src, src_len);
+ if (src_nents < 0) {
+ dev_err(dev, "Invalid number of src SG.\n");
+- err = ERR_PTR(-EINVAL);
+- goto error_sg;
++ return ERR_PTR(-EINVAL);
+ }
+ src_nents = (src_nents == 1) ? 0 : src_nents;
+ dst_nents = dst ? src_nents : 0;
+@@ -1387,16 +1382,14 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
+ src_nents = sg_nents_for_len(src, src_len);
+ if (src_nents < 0) {
+ dev_err(dev, "Invalid number of src SG.\n");
+- err = ERR_PTR(-EINVAL);
+- goto error_sg;
++ return ERR_PTR(-EINVAL);
+ }
+ src_nents = (src_nents == 1) ? 0 : src_nents;
+ dst_len = assoclen + cryptlen + (encrypt ? authsize : 0);
+ dst_nents = sg_nents_for_len(dst, dst_len);
+ if (dst_nents < 0) {
+ dev_err(dev, "Invalid number of dst SG.\n");
+- err = ERR_PTR(-EINVAL);
+- goto error_sg;
++ return ERR_PTR(-EINVAL);
+ }
+ dst_nents = (dst_nents == 1) ? 0 : dst_nents;
+ }
+@@ -1423,11 +1416,14 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
+ /* if its a ahash, add space for a second desc next to the first one */
+ if (is_sec1 && !dst)
+ alloc_len += sizeof(struct talitos_desc);
++ alloc_len += ivsize;
+
+ edesc = kmalloc(alloc_len, GFP_DMA | flags);
+- if (!edesc) {
+- err = ERR_PTR(-ENOMEM);
+- goto error_sg;
++ if (!edesc)
++ return ERR_PTR(-ENOMEM);
++ if (ivsize) {
++ iv = memcpy(((u8 *)edesc) + alloc_len - ivsize, iv, ivsize);
++ iv_dma = dma_map_single(dev, iv, ivsize, DMA_TO_DEVICE);
+ }
+ memset(&edesc->desc, 0, sizeof(edesc->desc));
+
+@@ -1445,10 +1441,6 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
+ DMA_BIDIRECTIONAL);
+ }
+ return edesc;
+-error_sg:
+- if (iv_dma)
+- dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE);
+- return err;
+ }
+
+ static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index b5b9f15549c2..1bda809a7289 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1690,9 +1690,14 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
+ struct drm_fb_helper *fb_helper = info->par;
+ struct drm_framebuffer *fb = fb_helper->fb;
+
+- if (var->pixclock != 0 || in_dbg_master())
++ if (in_dbg_master())
+ return -EINVAL;
+
++ if (var->pixclock != 0) {
++ DRM_DEBUG("fbdev emulation doesn't support changing the pixel clock, value of pixclock is ignored\n");
++ var->pixclock = 0;
++ }
++
+ /*
+ * Changes struct fb_var_screeninfo are currently not pushed back
+ * to KMS, hence fail if different settings are requested.
+diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
+index 9ad89e38f6c0..12e4203c06db 100644
+--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
++++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
+@@ -996,7 +996,7 @@ static int intel_vgpu_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
+ {
+ unsigned int index;
+ u64 virtaddr;
+- unsigned long req_size, pgoff = 0;
++ unsigned long req_size, pgoff, req_start;
+ pgprot_t pg_prot;
+ struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
+
+@@ -1014,7 +1014,17 @@ static int intel_vgpu_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
+ pg_prot = vma->vm_page_prot;
+ virtaddr = vma->vm_start;
+ req_size = vma->vm_end - vma->vm_start;
+- pgoff = vgpu_aperture_pa_base(vgpu) >> PAGE_SHIFT;
++ pgoff = vma->vm_pgoff &
++ ((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
++ req_start = pgoff << PAGE_SHIFT;
++
++ if (!intel_vgpu_in_aperture(vgpu, req_start))
++ return -EINVAL;
++ if (req_start + req_size >
++ vgpu_aperture_offset(vgpu) + vgpu_aperture_sz(vgpu))
++ return -EINVAL;
++
++ pgoff = (gvt_aperture_pa_base(vgpu->gvt) >> PAGE_SHIFT) + pgoff;
+
+ return remap_pfn_range(vma, virtaddr, pgoff, req_size, pg_prot);
+ }
+diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
+index 0385ab438320..f6fa9b115fda 100644
+--- a/drivers/infiniband/core/nldev.c
++++ b/drivers/infiniband/core/nldev.c
+@@ -579,10 +579,6 @@ static int fill_res_pd_entry(struct sk_buff *msg, struct netlink_callback *cb,
+ if (nla_put_u64_64bit(msg, RDMA_NLDEV_ATTR_RES_USECNT,
+ atomic_read(&pd->usecnt), RDMA_NLDEV_ATTR_PAD))
+ goto err;
+- if ((pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY) &&
+- nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_UNSAFE_GLOBAL_RKEY,
+- pd->unsafe_global_rkey))
+- goto err;
+
+ if (fill_res_name_pid(msg, res))
+ goto err;
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
+index 42b8685c997e..3c633ab58052 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
+@@ -427,7 +427,40 @@ static inline enum ib_qp_state pvrdma_qp_state_to_ib(enum pvrdma_qp_state state)
+
+ static inline enum pvrdma_wr_opcode ib_wr_opcode_to_pvrdma(enum ib_wr_opcode op)
+ {
+- return (enum pvrdma_wr_opcode)op;
++ switch (op) {
++ case IB_WR_RDMA_WRITE:
++ return PVRDMA_WR_RDMA_WRITE;
++ case IB_WR_RDMA_WRITE_WITH_IMM:
++ return PVRDMA_WR_RDMA_WRITE_WITH_IMM;
++ case IB_WR_SEND:
++ return PVRDMA_WR_SEND;
++ case IB_WR_SEND_WITH_IMM:
++ return PVRDMA_WR_SEND_WITH_IMM;
++ case IB_WR_RDMA_READ:
++ return PVRDMA_WR_RDMA_READ;
++ case IB_WR_ATOMIC_CMP_AND_SWP:
++ return PVRDMA_WR_ATOMIC_CMP_AND_SWP;
++ case IB_WR_ATOMIC_FETCH_AND_ADD:
++ return PVRDMA_WR_ATOMIC_FETCH_AND_ADD;
++ case IB_WR_LSO:
++ return PVRDMA_WR_LSO;
++ case IB_WR_SEND_WITH_INV:
++ return PVRDMA_WR_SEND_WITH_INV;
++ case IB_WR_RDMA_READ_WITH_INV:
++ return PVRDMA_WR_RDMA_READ_WITH_INV;
++ case IB_WR_LOCAL_INV:
++ return PVRDMA_WR_LOCAL_INV;
++ case IB_WR_REG_MR:
++ return PVRDMA_WR_FAST_REG_MR;
++ case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
++ return PVRDMA_WR_MASKED_ATOMIC_CMP_AND_SWP;
++ case IB_WR_MASKED_ATOMIC_FETCH_AND_ADD:
++ return PVRDMA_WR_MASKED_ATOMIC_FETCH_AND_ADD;
++ case IB_WR_REG_SIG_MR:
++ return PVRDMA_WR_REG_SIG_MR;
++ default:
++ return PVRDMA_WR_ERROR;
++ }
+ }
+
+ static inline enum ib_wc_status pvrdma_wc_status_to_ib(
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
+index 60083c0363a5..9aeb33093279 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
+@@ -721,6 +721,12 @@ int pvrdma_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ wr->opcode == IB_WR_RDMA_WRITE_WITH_IMM)
+ wqe_hdr->ex.imm_data = wr->ex.imm_data;
+
++ if (unlikely(wqe_hdr->opcode == PVRDMA_WR_ERROR)) {
++ *bad_wr = wr;
++ ret = -EINVAL;
++ goto out;
++ }
++
+ switch (qp->ibqp.qp_type) {
+ case IB_QPT_GSI:
+ case IB_QPT_UD:
+diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
+index 1faa64abc74f..6889c25c62cb 100644
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -1933,9 +1933,13 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma)
+ return -EINVAL;
+ }
+ }
++
++ mutex_lock(&q->mmap_lock);
++
+ if (vb2_fileio_is_active(q)) {
+ dprintk(1, "mmap: file io in progress\n");
+- return -EBUSY;
++ ret = -EBUSY;
++ goto unlock;
+ }
+
+ /*
+@@ -1943,7 +1947,7 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma)
+ */
+ ret = __find_plane_by_offset(q, off, &buffer, &plane);
+ if (ret)
+- return ret;
++ goto unlock;
+
+ vb = q->bufs[buffer];
+
+@@ -1956,11 +1960,13 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma)
+ if (length < (vma->vm_end - vma->vm_start)) {
+ dprintk(1,
+ "MMAP invalid, as it would overflow buffer length\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto unlock;
+ }
+
+- mutex_lock(&q->mmap_lock);
+ ret = call_memop(vb, mmap, vb->planes[plane].mem_priv, vma);
++
++unlock:
+ mutex_unlock(&q->mmap_lock);
+ if (ret)
+ return ret;
+diff --git a/drivers/media/platform/vivid/vivid-kthread-cap.c b/drivers/media/platform/vivid/vivid-kthread-cap.c
+index f06003bb8e42..2a92e5aac9ed 100644
+--- a/drivers/media/platform/vivid/vivid-kthread-cap.c
++++ b/drivers/media/platform/vivid/vivid-kthread-cap.c
+@@ -865,8 +865,11 @@ int vivid_start_generating_vid_cap(struct vivid_dev *dev, bool *pstreaming)
+ "%s-vid-cap", dev->v4l2_dev.name);
+
+ if (IS_ERR(dev->kthread_vid_cap)) {
++ int err = PTR_ERR(dev->kthread_vid_cap);
++
++ dev->kthread_vid_cap = NULL;
+ v4l2_err(&dev->v4l2_dev, "kernel_thread() failed\n");
+- return PTR_ERR(dev->kthread_vid_cap);
++ return err;
+ }
+ *pstreaming = true;
+ vivid_grab_controls(dev, true);
+diff --git a/drivers/media/platform/vivid/vivid-kthread-out.c b/drivers/media/platform/vivid/vivid-kthread-out.c
+index 9981e7548019..488590594150 100644
+--- a/drivers/media/platform/vivid/vivid-kthread-out.c
++++ b/drivers/media/platform/vivid/vivid-kthread-out.c
+@@ -236,8 +236,11 @@ int vivid_start_generating_vid_out(struct vivid_dev *dev, bool *pstreaming)
+ "%s-vid-out", dev->v4l2_dev.name);
+
+ if (IS_ERR(dev->kthread_vid_out)) {
++ int err = PTR_ERR(dev->kthread_vid_out);
++
++ dev->kthread_vid_out = NULL;
+ v4l2_err(&dev->v4l2_dev, "kernel_thread() failed\n");
+- return PTR_ERR(dev->kthread_vid_out);
++ return err;
+ }
+ *pstreaming = true;
+ vivid_grab_controls(dev, true);
+diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c
+index be531caa2cdf..2079861d2270 100644
+--- a/drivers/media/platform/vivid/vivid-vid-common.c
++++ b/drivers/media/platform/vivid/vivid-vid-common.c
+@@ -21,7 +21,7 @@ const struct v4l2_dv_timings_cap vivid_dv_timings_cap = {
+ .type = V4L2_DV_BT_656_1120,
+ /* keep this initialization for compatibility with GCC < 4.4.6 */
+ .reserved = { 0 },
+- V4L2_INIT_BT_TIMINGS(0, MAX_WIDTH, 0, MAX_HEIGHT, 14000000, 775000000,
++ V4L2_INIT_BT_TIMINGS(16, MAX_WIDTH, 16, MAX_HEIGHT, 14000000, 775000000,
+ V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+ V4L2_DV_BT_STD_CVT | V4L2_DV_BT_STD_GTF,
+ V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_INTERLACED)
+diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
+index 54afc9c7ee6e..a4d3e94a400c 100644
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -286,6 +286,7 @@ static void v4l_print_format(const void *arg, bool write_only)
+ const struct v4l2_window *win;
+ const struct v4l2_sdr_format *sdr;
+ const struct v4l2_meta_format *meta;
++ u32 planes;
+ unsigned i;
+
+ pr_cont("type=%s", prt_names(p->type, v4l2_type_names));
+@@ -316,7 +317,8 @@ static void v4l_print_format(const void *arg, bool write_only)
+ prt_names(mp->field, v4l2_field_names),
+ mp->colorspace, mp->num_planes, mp->flags,
+ mp->ycbcr_enc, mp->quantization, mp->xfer_func);
+- for (i = 0; i < mp->num_planes; i++)
++ planes = min_t(u32, mp->num_planes, VIDEO_MAX_PLANES);
++ for (i = 0; i < planes; i++)
+ printk(KERN_DEBUG "plane %u: bytesperline=%u sizeimage=%u\n", i,
+ mp->plane_fmt[i].bytesperline,
+ mp->plane_fmt[i].sizeimage);
+diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
+index b89379782741..9c7925ca13cf 100644
+--- a/drivers/mfd/tps6586x.c
++++ b/drivers/mfd/tps6586x.c
+@@ -592,6 +592,29 @@ static int tps6586x_i2c_remove(struct i2c_client *client)
+ return 0;
+ }
+
++static int __maybe_unused tps6586x_i2c_suspend(struct device *dev)
++{
++ struct tps6586x *tps6586x = dev_get_drvdata(dev);
++
++ if (tps6586x->client->irq)
++ disable_irq(tps6586x->client->irq);
++
++ return 0;
++}
++
++static int __maybe_unused tps6586x_i2c_resume(struct device *dev)
++{
++ struct tps6586x *tps6586x = dev_get_drvdata(dev);
++
++ if (tps6586x->client->irq)
++ enable_irq(tps6586x->client->irq);
++
++ return 0;
++}
++
++static SIMPLE_DEV_PM_OPS(tps6586x_pm_ops, tps6586x_i2c_suspend,
++ tps6586x_i2c_resume);
++
+ static const struct i2c_device_id tps6586x_id_table[] = {
+ { "tps6586x", 0 },
+ { },
+@@ -602,6 +625,7 @@ static struct i2c_driver tps6586x_driver = {
+ .driver = {
+ .name = "tps6586x",
+ .of_match_table = of_match_ptr(tps6586x_of_match),
++ .pm = &tps6586x_pm_ops,
+ },
+ .probe = tps6586x_i2c_probe,
+ .remove = tps6586x_i2c_remove,
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 3cc8bfee6c18..8594659cb592 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -258,6 +258,8 @@ struct sdhci_msm_host {
+ bool mci_removed;
+ const struct sdhci_msm_variant_ops *var_ops;
+ const struct sdhci_msm_offset *offset;
++ bool use_cdr;
++ u32 transfer_mode;
+ };
+
+ static const struct sdhci_msm_offset *sdhci_priv_msm_offset(struct sdhci_host *host)
+@@ -1025,6 +1027,26 @@ out:
+ return ret;
+ }
+
++static void sdhci_msm_set_cdr(struct sdhci_host *host, bool enable)
++{
++ const struct sdhci_msm_offset *msm_offset = sdhci_priv_msm_offset(host);
++ u32 config, oldconfig = readl_relaxed(host->ioaddr +
++ msm_offset->core_dll_config);
++
++ config = oldconfig;
++ if (enable) {
++ config |= CORE_CDR_EN;
++ config &= ~CORE_CDR_EXT_EN;
++ } else {
++ config &= ~CORE_CDR_EN;
++ config |= CORE_CDR_EXT_EN;
++ }
++
++ if (config != oldconfig)
++ writel_relaxed(config, host->ioaddr +
++ msm_offset->core_dll_config);
++}
++
+ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ {
+ struct sdhci_host *host = mmc_priv(mmc);
+@@ -1042,8 +1064,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ if (host->clock <= CORE_FREQ_100MHZ ||
+ !(ios.timing == MMC_TIMING_MMC_HS400 ||
+ ios.timing == MMC_TIMING_MMC_HS200 ||
+- ios.timing == MMC_TIMING_UHS_SDR104))
++ ios.timing == MMC_TIMING_UHS_SDR104)) {
++ msm_host->use_cdr = false;
++ sdhci_msm_set_cdr(host, false);
+ return 0;
++ }
++
++ /* Clock-Data-Recovery used to dynamically adjust RX sampling point */
++ msm_host->use_cdr = true;
+
+ /*
+ * For HS400 tuning in HS200 timing requires:
+@@ -1525,6 +1553,19 @@ static int __sdhci_msm_check_write(struct sdhci_host *host, u16 val, int reg)
+ case SDHCI_POWER_CONTROL:
+ req_type = !val ? REQ_BUS_OFF : REQ_BUS_ON;
+ break;
++ case SDHCI_TRANSFER_MODE:
++ msm_host->transfer_mode = val;
++ break;
++ case SDHCI_COMMAND:
++ if (!msm_host->use_cdr)
++ break;
++ if ((msm_host->transfer_mode & SDHCI_TRNS_READ) &&
++ SDHCI_GET_CMD(val) != MMC_SEND_TUNING_BLOCK_HS200 &&
++ SDHCI_GET_CMD(val) != MMC_SEND_TUNING_BLOCK)
++ sdhci_msm_set_cdr(host, true);
++ else
++ sdhci_msm_set_cdr(host, false);
++ break;
+ }
+
+ if (req_type) {
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 3c597569cfae..a6fcc5c96070 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1947,6 +1947,9 @@ static int __bond_release_one(struct net_device *bond_dev,
+ if (!bond_has_slaves(bond)) {
+ bond_set_carrier(bond);
+ eth_hw_addr_random(bond_dev);
++ bond->nest_level = SINGLE_DEPTH_NESTING;
++ } else {
++ bond->nest_level = dev_get_nest_level(bond_dev) + 1;
+ }
+
+ unblock_netpoll_tx();
+diff --git a/drivers/net/dsa/realtek-smi.c b/drivers/net/dsa/realtek-smi.c
+index b4b839a1d095..ad41ec63cc9f 100644
+--- a/drivers/net/dsa/realtek-smi.c
++++ b/drivers/net/dsa/realtek-smi.c
+@@ -347,16 +347,17 @@ int realtek_smi_setup_mdio(struct realtek_smi *smi)
+ struct device_node *mdio_np;
+ int ret;
+
+- mdio_np = of_find_compatible_node(smi->dev->of_node, NULL,
+- "realtek,smi-mdio");
++ mdio_np = of_get_compatible_child(smi->dev->of_node, "realtek,smi-mdio");
+ if (!mdio_np) {
+ dev_err(smi->dev, "no MDIO bus node\n");
+ return -ENODEV;
+ }
+
+ smi->slave_mii_bus = devm_mdiobus_alloc(smi->dev);
+- if (!smi->slave_mii_bus)
+- return -ENOMEM;
++ if (!smi->slave_mii_bus) {
++ ret = -ENOMEM;
++ goto err_put_node;
++ }
+ smi->slave_mii_bus->priv = smi;
+ smi->slave_mii_bus->name = "SMI slave MII";
+ smi->slave_mii_bus->read = realtek_smi_mdio_read;
+@@ -371,10 +372,15 @@ int realtek_smi_setup_mdio(struct realtek_smi *smi)
+ if (ret) {
+ dev_err(smi->dev, "unable to register MDIO bus %s\n",
+ smi->slave_mii_bus->id);
+- of_node_put(mdio_np);
++ goto err_put_node;
+ }
+
+ return 0;
++
++err_put_node:
++ of_node_put(mdio_np);
++
++ return ret;
+ }
+
+ static int realtek_smi_probe(struct platform_device *pdev)
+@@ -457,6 +463,8 @@ static int realtek_smi_remove(struct platform_device *pdev)
+ struct realtek_smi *smi = dev_get_drvdata(&pdev->dev);
+
+ dsa_unregister_switch(smi->ds);
++ if (smi->slave_mii_bus)
++ of_node_put(smi->slave_mii_bus->dev.of_node);
+ gpiod_set_value(smi->reset, 1);
+
+ return 0;
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index 1393252c6e3c..42f5bfa33694 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -962,13 +962,10 @@ static void lan743x_phy_link_status_change(struct net_device *netdev)
+
+ memset(&ksettings, 0, sizeof(ksettings));
+ phy_ethtool_get_link_ksettings(netdev, &ksettings);
+- local_advertisement = phy_read(phydev, MII_ADVERTISE);
+- if (local_advertisement < 0)
+- return;
+-
+- remote_advertisement = phy_read(phydev, MII_LPA);
+- if (remote_advertisement < 0)
+- return;
++ local_advertisement =
++ ethtool_adv_to_mii_adv_t(phydev->advertising);
++ remote_advertisement =
++ ethtool_adv_to_mii_adv_t(phydev->lp_advertising);
+
+ lan743x_phy_update_flowcontrol(adapter,
+ ksettings.base.duplex,
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 9fc8a2bc0ff1..07f3080eca18 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -717,6 +717,7 @@ module_param(use_dac, int, 0);
+ MODULE_PARM_DESC(use_dac, "Enable PCI DAC. Unsafe on 32 bit PCI slot.");
+ module_param_named(debug, debug.msg_enable, int, 0);
+ MODULE_PARM_DESC(debug, "Debug verbosity level (0=none, ..., 16=all)");
++MODULE_SOFTDEP("pre: realtek");
+ MODULE_LICENSE("GPL");
+ MODULE_FIRMWARE(FIRMWARE_8168D_1);
+ MODULE_FIRMWARE(FIRMWARE_8168D_2);
+@@ -1730,11 +1731,13 @@ static bool rtl8169_reset_counters(struct rtl8169_private *tp)
+
+ static bool rtl8169_update_counters(struct rtl8169_private *tp)
+ {
++ u8 val = RTL_R8(tp, ChipCmd);
++
+ /*
+ * Some chips are unable to dump tally counters when the receiver
+- * is disabled.
++ * is disabled. If 0xff chip may be in a PCI power-save state.
+ */
+- if ((RTL_R8(tp, ChipCmd) & CmdRxEnb) == 0)
++ if (!(val & CmdRxEnb) || val == 0xff)
+ return true;
+
+ return rtl8169_do_counters(tp, CounterDump);
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 8c1abcba4cbd..33978b0cdac8 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -859,10 +859,6 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
+ err = 0;
+ }
+
+- rcu_assign_pointer(tfile->tun, tun);
+- rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
+- tun->numqueues++;
+-
+ if (tfile->detached) {
+ tun_enable_queue(tfile);
+ } else {
+@@ -876,6 +872,13 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
+ * refcnt.
+ */
+
++ /* Publish tfile->tun and tun->tfiles only after we've fully
++ * initialized tfile; otherwise we risk using half-initialized
++ * object.
++ */
++ rcu_assign_pointer(tfile->tun, tun);
++ rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
++ tun->numqueues++;
+ out:
+ return err;
+ }
+diff --git a/drivers/of/property.c b/drivers/of/property.c
+index f46828e3b082..43720c2de138 100644
+--- a/drivers/of/property.c
++++ b/drivers/of/property.c
+@@ -806,6 +806,7 @@ struct device_node *of_graph_get_remote_node(const struct device_node *node,
+
+ if (!of_device_is_available(remote)) {
+ pr_debug("not available for remote node\n");
++ of_node_put(remote);
+ return NULL;
+ }
+
+diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
+index b44c1bb687a2..ebc193f7f7dd 100644
+--- a/drivers/scsi/scsi_pm.c
++++ b/drivers/scsi/scsi_pm.c
+@@ -79,8 +79,22 @@ static int scsi_dev_type_resume(struct device *dev,
+
+ if (err == 0) {
+ pm_runtime_disable(dev);
+- pm_runtime_set_active(dev);
++ err = pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
++
++ /*
++ * Forcibly set runtime PM status of request queue to "active"
++ * to make sure we can again get requests from the queue
++ * (see also blk_pm_peek_request()).
++ *
++ * The resume hook will correct runtime PM status of the disk.
++ */
++ if (!err && scsi_is_sdev_device(dev)) {
++ struct scsi_device *sdev = to_scsi_device(dev);
++
++ if (sdev->request_queue->dev)
++ blk_set_runtime_active(sdev->request_queue);
++ }
+ }
+
+ return err;
+@@ -139,16 +153,6 @@ static int scsi_bus_resume_common(struct device *dev,
+ else
+ fn = NULL;
+
+- /*
+- * Forcibly set runtime PM status of request queue to "active" to
+- * make sure we can again get requests from the queue (see also
+- * blk_pm_peek_request()).
+- *
+- * The resume hook will correct runtime PM status of the disk.
+- */
+- if (scsi_is_sdev_device(dev) && pm_runtime_suspended(dev))
+- blk_set_runtime_active(to_scsi_device(dev)->request_queue);
+-
+ if (fn) {
+ async_schedule_domain(fn, dev, &scsi_sd_pm_domain);
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 5c9acb634ff7..0a27917263aa 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -205,6 +205,12 @@ cache_type_store(struct device *dev, struct device_attribute *attr,
+ sp = buffer_data[0] & 0x80 ? 1 : 0;
+ buffer_data[0] &= ~0x80;
+
++ /*
++ * Ensure WP, DPOFUA, and RESERVED fields are cleared in
++ * received mode parameter buffer before doing MODE SELECT.
++ */
++ data.device_specific = 0;
++
+ if (scsi_mode_select(sdp, 1, sp, 8, buffer_data, len, SD_TIMEOUT,
+ SD_MAX_RETRIES, &data, &sshdr)) {
+ if (scsi_sense_valid(&sshdr))
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+index b289b90ae6dc..b19c960d5490 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+@@ -598,9 +598,12 @@ out:
+ mutex_unlock(&cdev_list_lock);
+ }
+
++static void __cxgbit_free_conn(struct cxgbit_sock *csk);
++
+ void cxgbit_free_np(struct iscsi_np *np)
+ {
+ struct cxgbit_np *cnp = np->np_context;
++ struct cxgbit_sock *csk, *tmp;
+
+ cnp->com.state = CSK_STATE_DEAD;
+ if (cnp->com.cdev)
+@@ -608,6 +611,13 @@ void cxgbit_free_np(struct iscsi_np *np)
+ else
+ cxgbit_free_all_np(cnp);
+
++ spin_lock_bh(&cnp->np_accept_lock);
++ list_for_each_entry_safe(csk, tmp, &cnp->np_accept_list, accept_node) {
++ list_del_init(&csk->accept_node);
++ __cxgbit_free_conn(csk);
++ }
++ spin_unlock_bh(&cnp->np_accept_lock);
++
+ np->np_context = NULL;
+ cxgbit_put_cnp(cnp);
+ }
+@@ -708,9 +718,9 @@ void cxgbit_abort_conn(struct cxgbit_sock *csk)
+ csk->tid, 600, __func__);
+ }
+
+-void cxgbit_free_conn(struct iscsi_conn *conn)
++static void __cxgbit_free_conn(struct cxgbit_sock *csk)
+ {
+- struct cxgbit_sock *csk = conn->context;
++ struct iscsi_conn *conn = csk->conn;
+ bool release = false;
+
+ pr_debug("%s: state %d\n",
+@@ -719,7 +729,7 @@ void cxgbit_free_conn(struct iscsi_conn *conn)
+ spin_lock_bh(&csk->lock);
+ switch (csk->com.state) {
+ case CSK_STATE_ESTABLISHED:
+- if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) {
++ if (conn && (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT)) {
+ csk->com.state = CSK_STATE_CLOSING;
+ cxgbit_send_halfclose(csk);
+ } else {
+@@ -744,6 +754,11 @@ void cxgbit_free_conn(struct iscsi_conn *conn)
+ cxgbit_put_csk(csk);
+ }
+
++void cxgbit_free_conn(struct iscsi_conn *conn)
++{
++ __cxgbit_free_conn(conn->context);
++}
++
+ static void cxgbit_set_emss(struct cxgbit_sock *csk, u16 opt)
+ {
+ csk->emss = csk->com.cdev->lldi.mtus[TCPOPT_MSS_G(opt)] -
+@@ -806,6 +821,7 @@ void _cxgbit_free_csk(struct kref *kref)
+ spin_unlock_bh(&cdev->cskq.lock);
+
+ cxgbit_free_skb(csk);
++ cxgbit_put_cnp(csk->cnp);
+ cxgbit_put_cdev(cdev);
+
+ kfree(csk);
+@@ -1354,6 +1370,7 @@ cxgbit_pass_accept_req(struct cxgbit_device *cdev, struct sk_buff *skb)
+ goto rel_skb;
+ }
+
++ cxgbit_get_cnp(cnp);
+ cxgbit_get_cdev(cdev);
+
+ spin_lock(&cdev->cskq.lock);
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index d6f42b528277..052ec16a4e84 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1255,7 +1255,8 @@ static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *
+ static int tty_reopen(struct tty_struct *tty)
+ {
+ struct tty_driver *driver = tty->driver;
+- int retval;
++ struct tty_ldisc *ld;
++ int retval = 0;
+
+ if (driver->type == TTY_DRIVER_TYPE_PTY &&
+ driver->subtype == PTY_TYPE_MASTER)
+@@ -1267,14 +1268,21 @@ static int tty_reopen(struct tty_struct *tty)
+ if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
+ return -EBUSY;
+
+- tty->count++;
++ ld = tty_ldisc_ref_wait(tty);
++ if (ld) {
++ tty_ldisc_deref(ld);
++ } else {
++ retval = tty_ldisc_lock(tty, 5 * HZ);
++ if (retval)
++ return retval;
+
+- if (tty->ldisc)
+- return 0;
++ if (!tty->ldisc)
++ retval = tty_ldisc_reinit(tty, tty->termios.c_line);
++ tty_ldisc_unlock(tty);
++ }
+
+- retval = tty_ldisc_reinit(tty, tty->termios.c_line);
+- if (retval)
+- tty->count--;
++ if (retval == 0)
++ tty->count++;
+
+ return retval;
+ }
+diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c
+index 0c98d88f795a..b989ca26fc78 100644
+--- a/drivers/tty/tty_ldsem.c
++++ b/drivers/tty/tty_ldsem.c
+@@ -293,6 +293,16 @@ down_write_failed(struct ld_semaphore *sem, long count, long timeout)
+ if (!locked)
+ atomic_long_add_return(-LDSEM_WAIT_BIAS, &sem->count);
+ list_del(&waiter.list);
++
++ /*
++ * In case of timeout, wake up every reader who gave the right of way
++ * to writer. Prevent separation readers into two groups:
++ * one that helds semaphore and another that sleeps.
++ * (in case of no contention with a writer)
++ */
++ if (!locked && list_empty(&sem->write_wait))
++ __ldsem_wake_readers(sem);
++
+ raw_spin_unlock_irq(&sem->wait_lock);
+
+ __set_current_state(TASK_RUNNING);
+diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
+index a3edb20ea4c3..a846d32ee653 100644
+--- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
++++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c
+@@ -609,6 +609,8 @@ int omapfb_ioctl(struct fb_info *fbi, unsigned int cmd, unsigned long arg)
+
+ int r = 0;
+
++ memset(&p, 0, sizeof(p));
++
+ switch (cmd) {
+ case OMAPFB_SYNC_GFX:
+ DBG("ioctl SYNC_GFX\n");
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index e6c1934734b7..fe1f16351f94 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1650,7 +1650,7 @@ void xen_callback_vector(void)
+ xen_have_vector_callback = 0;
+ return;
+ }
+- pr_info("Xen HVM callback vector for event delivery is enabled\n");
++ pr_info_once("Xen HVM callback vector for event delivery is enabled\n");
+ alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR,
+ xen_hvm_callback_vector);
+ }
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 38b8ce05cbc7..cdbb888a8d4a 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -104,6 +104,20 @@ void invalidate_bdev(struct block_device *bdev)
+ }
+ EXPORT_SYMBOL(invalidate_bdev);
+
++static void set_init_blocksize(struct block_device *bdev)
++{
++ unsigned bsize = bdev_logical_block_size(bdev);
++ loff_t size = i_size_read(bdev->bd_inode);
++
++ while (bsize < PAGE_SIZE) {
++ if (size & bsize)
++ break;
++ bsize <<= 1;
++ }
++ bdev->bd_block_size = bsize;
++ bdev->bd_inode->i_blkbits = blksize_bits(bsize);
++}
++
+ int set_blocksize(struct block_device *bdev, int size)
+ {
+ /* Size must be a power of two, and between 512 and PAGE_SIZE */
+@@ -1408,18 +1422,9 @@ EXPORT_SYMBOL(check_disk_change);
+
+ void bd_set_size(struct block_device *bdev, loff_t size)
+ {
+- unsigned bsize = bdev_logical_block_size(bdev);
+-
+ inode_lock(bdev->bd_inode);
+ i_size_write(bdev->bd_inode, size);
+ inode_unlock(bdev->bd_inode);
+- while (bsize < PAGE_SIZE) {
+- if (size & bsize)
+- break;
+- bsize <<= 1;
+- }
+- bdev->bd_block_size = bsize;
+- bdev->bd_inode->i_blkbits = blksize_bits(bsize);
+ }
+ EXPORT_SYMBOL(bd_set_size);
+
+@@ -1496,8 +1501,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ }
+ }
+
+- if (!ret)
++ if (!ret) {
+ bd_set_size(bdev,(loff_t)get_capacity(disk)<<9);
++ set_init_blocksize(bdev);
++ }
+
+ /*
+ * If the device is invalidated, rescan partition
+@@ -1532,6 +1539,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ goto out_clear;
+ }
+ bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9);
++ set_init_blocksize(bdev);
+ }
+
+ if (bdev->bd_bdi == &noop_backing_dev_info)
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index d4a7f7ca4145..d96d1390068a 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4155,6 +4155,14 @@ static void btrfs_destroy_all_ordered_extents(struct btrfs_fs_info *fs_info)
+ spin_lock(&fs_info->ordered_root_lock);
+ }
+ spin_unlock(&fs_info->ordered_root_lock);
++
++ /*
++ * We need this here because if we've been flipped read-only we won't
++ * get sync() from the umount, so we need to make sure any ordered
++ * extents that haven't had their dirty pages IO start writeout yet
++ * actually get run and error out properly.
++ */
++ btrfs_wait_ordered_roots(fs_info, U64_MAX, 0, (u64)-1);
+ }
+
+ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 14c85e61134d..4f6dc56b4f4d 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -3151,9 +3151,6 @@ out:
+ /* once for the tree */
+ btrfs_put_ordered_extent(ordered_extent);
+
+- /* Try to release some metadata so we don't get an OOM but don't wait */
+- btrfs_btree_balance_dirty_nodelay(fs_info);
+-
+ return ret;
+ }
+
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 03cd59375abe..eb67bb7f04de 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -713,18 +713,15 @@ static int ramoops_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct ramoops_platform_data *pdata = dev->platform_data;
++ struct ramoops_platform_data pdata_local;
+ struct ramoops_context *cxt = &oops_cxt;
+ size_t dump_mem_sz;
+ phys_addr_t paddr;
+ int err = -EINVAL;
+
+ if (dev_of_node(dev) && !pdata) {
+- pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
+- if (!pdata) {
+- pr_err("cannot allocate platform data buffer\n");
+- err = -ENOMEM;
+- goto fail_out;
+- }
++ pdata = &pdata_local;
++ memset(pdata, 0, sizeof(*pdata));
+
+ err = ramoops_parse_dt(pdev, pdata);
+ if (err < 0)
+diff --git a/include/linux/bcma/bcma_soc.h b/include/linux/bcma/bcma_soc.h
+index 7cca5f859a90..f3c43519baa7 100644
+--- a/include/linux/bcma/bcma_soc.h
++++ b/include/linux/bcma/bcma_soc.h
+@@ -6,6 +6,7 @@
+
+ struct bcma_soc {
+ struct bcma_bus bus;
++ struct device *dev;
+ };
+
+ int __init bcma_host_soc_register(struct bcma_soc *soc);
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index 25c08c6c7f99..f767293b00e6 100644
+--- a/include/linux/genhd.h
++++ b/include/linux/genhd.h
+@@ -129,7 +129,7 @@ struct hd_struct {
+ struct disk_stats dkstats;
+ #endif
+ struct percpu_ref ref;
+- struct rcu_head rcu_head;
++ struct rcu_work rcu_work;
+ };
+
+ #define GENHD_FL_REMOVABLE 1
+diff --git a/include/net/netfilter/nf_conntrack_count.h b/include/net/netfilter/nf_conntrack_count.h
+index 4b2b2baf8ab4..f32fc8289473 100644
+--- a/include/net/netfilter/nf_conntrack_count.h
++++ b/include/net/netfilter/nf_conntrack_count.h
+@@ -5,17 +5,10 @@
+
+ struct nf_conncount_data;
+
+-enum nf_conncount_list_add {
+- NF_CONNCOUNT_ADDED, /* list add was ok */
+- NF_CONNCOUNT_ERR, /* -ENOMEM, must drop skb */
+- NF_CONNCOUNT_SKIP, /* list is already reclaimed by gc */
+-};
+-
+ struct nf_conncount_list {
+ spinlock_t list_lock;
+ struct list_head head; /* connections with the same filtering key */
+ unsigned int count; /* length of list */
+- bool dead;
+ };
+
+ struct nf_conncount_data *nf_conncount_init(struct net *net, unsigned int family,
+@@ -29,18 +22,12 @@ unsigned int nf_conncount_count(struct net *net,
+ const struct nf_conntrack_tuple *tuple,
+ const struct nf_conntrack_zone *zone);
+
+-void nf_conncount_lookup(struct net *net, struct nf_conncount_list *list,
+- const struct nf_conntrack_tuple *tuple,
+- const struct nf_conntrack_zone *zone,
+- bool *addit);
++int nf_conncount_add(struct net *net, struct nf_conncount_list *list,
++ const struct nf_conntrack_tuple *tuple,
++ const struct nf_conntrack_zone *zone);
+
+ void nf_conncount_list_init(struct nf_conncount_list *list);
+
+-enum nf_conncount_list_add
+-nf_conncount_add(struct nf_conncount_list *list,
+- const struct nf_conntrack_tuple *tuple,
+- const struct nf_conntrack_zone *zone);
+-
+ bool nf_conncount_gc_list(struct net *net,
+ struct nf_conncount_list *list);
+
+diff --git a/include/uapi/rdma/vmw_pvrdma-abi.h b/include/uapi/rdma/vmw_pvrdma-abi.h
+index d13fd490b66d..6e73f0274e41 100644
+--- a/include/uapi/rdma/vmw_pvrdma-abi.h
++++ b/include/uapi/rdma/vmw_pvrdma-abi.h
+@@ -78,6 +78,7 @@ enum pvrdma_wr_opcode {
+ PVRDMA_WR_MASKED_ATOMIC_FETCH_AND_ADD,
+ PVRDMA_WR_BIND_MW,
+ PVRDMA_WR_REG_SIG_MR,
++ PVRDMA_WR_ERROR,
+ };
+
+ enum pvrdma_wc_status {
+diff --git a/init/Kconfig b/init/Kconfig
+index 317d5ccb5191..864af10bb1b9 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1102,6 +1102,7 @@ config LD_DEAD_CODE_DATA_ELIMINATION
+ bool "Dead code and data elimination (EXPERIMENTAL)"
+ depends on HAVE_LD_DEAD_CODE_DATA_ELIMINATION
+ depends on EXPERT
++ depends on !(FUNCTION_TRACER && CC_IS_GCC && GCC_VERSION < 40800)
+ depends on $(cc-option,-ffunction-sections -fdata-sections)
+ depends on $(ld-option,--gc-sections)
+ help
+diff --git a/lib/int_sqrt.c b/lib/int_sqrt.c
+index 14436f4ca6bd..30e0f9770f88 100644
+--- a/lib/int_sqrt.c
++++ b/lib/int_sqrt.c
+@@ -52,7 +52,7 @@ u32 int_sqrt64(u64 x)
+ if (x <= ULONG_MAX)
+ return int_sqrt((unsigned long) x);
+
+- m = 1ULL << (fls64(x) & ~1ULL);
++ m = 1ULL << ((fls64(x) - 1) & ~1ULL);
+ while (m != 0) {
+ b = y + m;
+ y >>= 1;
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index 37278dc280eb..e07a7e62c705 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -278,7 +278,7 @@ int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_
+ struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
+ int ret;
+
+- if (neigh->hh.hh_len) {
++ if ((neigh->nud_state & NUD_CONNECTED) && neigh->hh.hh_len) {
+ neigh_hh_bridge(&neigh->hh, skb);
+ skb->dev = nf_bridge->physindev;
+ ret = br_handle_frame_finish(net, sk, skb);
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 491828713e0b..5e55cef0cec3 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -1137,14 +1137,16 @@ static int do_replace(struct net *net, const void __user *user,
+ tmp.name[sizeof(tmp.name) - 1] = 0;
+
+ countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
+- newinfo = vmalloc(sizeof(*newinfo) + countersize);
++ newinfo = __vmalloc(sizeof(*newinfo) + countersize, GFP_KERNEL_ACCOUNT,
++ PAGE_KERNEL);
+ if (!newinfo)
+ return -ENOMEM;
+
+ if (countersize)
+ memset(newinfo->counters, 0, countersize);
+
+- newinfo->entries = vmalloc(tmp.entries_size);
++ newinfo->entries = __vmalloc(tmp.entries_size, GFP_KERNEL_ACCOUNT,
++ PAGE_KERNEL);
+ if (!newinfo->entries) {
+ ret = -ENOMEM;
+ goto free_newinfo;
+diff --git a/net/can/gw.c b/net/can/gw.c
+index faa3da88a127..53859346dc9a 100644
+--- a/net/can/gw.c
++++ b/net/can/gw.c
+@@ -416,13 +416,29 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
+ while (modidx < MAX_MODFUNCTIONS && gwj->mod.modfunc[modidx])
+ (*gwj->mod.modfunc[modidx++])(cf, &gwj->mod);
+
+- /* check for checksum updates when the CAN frame has been modified */
++ /* Has the CAN frame been modified? */
+ if (modidx) {
+- if (gwj->mod.csumfunc.crc8)
++ /* get available space for the processed CAN frame type */
++ int max_len = nskb->len - offsetof(struct can_frame, data);
++
++ /* dlc may have changed, make sure it fits to the CAN frame */
++ if (cf->can_dlc > max_len)
++ goto out_delete;
++
++ /* check for checksum updates in classic CAN length only */
++ if (gwj->mod.csumfunc.crc8) {
++ if (cf->can_dlc > 8)
++ goto out_delete;
++
+ (*gwj->mod.csumfunc.crc8)(cf, &gwj->mod.csum.crc8);
++ }
++
++ if (gwj->mod.csumfunc.xor) {
++ if (cf->can_dlc > 8)
++ goto out_delete;
+
+- if (gwj->mod.csumfunc.xor)
+ (*gwj->mod.csumfunc.xor)(cf, &gwj->mod.csum.xor);
++ }
+ }
+
+ /* clear the skb timestamp if not configured the other way */
+@@ -434,6 +450,14 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
+ gwj->dropped_frames++;
+ else
+ gwj->handled_frames++;
++
++ return;
++
++ out_delete:
++ /* delete frame due to misconfiguration */
++ gwj->deleted_frames++;
++ kfree_skb(nskb);
++ return;
+ }
+
+ static inline int cgw_register_filter(struct net *net, struct cgw_job *gwj)
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 5e00f2b85a56..8c2411fb2509 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2018,18 +2018,19 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb)
+ static int __bpf_redirect_no_mac(struct sk_buff *skb, struct net_device *dev,
+ u32 flags)
+ {
+- /* skb->mac_len is not set on normal egress */
+- unsigned int mlen = skb->network_header - skb->mac_header;
++ unsigned int mlen = skb_network_offset(skb);
+
+- __skb_pull(skb, mlen);
++ if (mlen) {
++ __skb_pull(skb, mlen);
+
+- /* At ingress, the mac header has already been pulled once.
+- * At egress, skb_pospull_rcsum has to be done in case that
+- * the skb is originated from ingress (i.e. a forwarded skb)
+- * to ensure that rcsum starts at net header.
+- */
+- if (!skb_at_tc_ingress(skb))
+- skb_postpull_rcsum(skb, skb_mac_header(skb), mlen);
++ /* At ingress, the mac header has already been pulled once.
++ * At egress, skb_pospull_rcsum has to be done in case that
++ * the skb is originated from ingress (i.e. a forwarded skb)
++ * to ensure that rcsum starts at net header.
++ */
++ if (!skb_at_tc_ingress(skb))
++ skb_postpull_rcsum(skb, skb_mac_header(skb), mlen);
++ }
+ skb_pop_mac_header(skb);
+ skb_reset_mac_len(skb);
+ return flags & BPF_F_INGRESS ?
+diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
+index 3e85437f7106..a648568c5e8f 100644
+--- a/net/core/lwt_bpf.c
++++ b/net/core/lwt_bpf.c
+@@ -63,6 +63,7 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
+ lwt->name ? : "<unknown>");
+ ret = BPF_OK;
+ } else {
++ skb_reset_mac_header(skb);
+ ret = skb_do_redirect(skb);
+ if (ret == 0)
+ ret = BPF_REDIRECT;
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 26c36cccabdc..b7a26120d552 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -148,19 +148,17 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
+
+ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
+ {
++ __be16 _ports[2], *ports;
+ struct sockaddr_in sin;
+- __be16 *ports;
+- int end;
+-
+- end = skb_transport_offset(skb) + 4;
+- if (end > 0 && !pskb_may_pull(skb, end))
+- return;
+
+ /* All current transport protocols have the port numbers in the
+ * first four bytes of the transport header and this function is
+ * written with this assumption in mind.
+ */
+- ports = (__be16 *)skb_transport_header(skb);
++ ports = skb_header_pointer(skb, skb_transport_offset(skb),
++ sizeof(_ports), &_ports);
++ if (!ports)
++ return;
+
+ sin.sin_family = AF_INET;
+ sin.sin_addr.s_addr = ip_hdr(skb)->daddr;
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 57eae8d70ba1..b1b5a648def6 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -224,7 +224,7 @@ static int tcp_write_timeout(struct sock *sk)
+ if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
+ if (icsk->icsk_retransmits) {
+ dst_negative_advice(sk);
+- } else if (!tp->syn_data && !tp->syn_fastopen) {
++ } else {
+ sk_rethink_txhash(sk);
+ }
+ retry_until = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_syn_retries;
+diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
+index 1ede7a16a0be..cb24850d2c7f 100644
+--- a/net/ipv6/datagram.c
++++ b/net/ipv6/datagram.c
+@@ -341,6 +341,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info)
+ skb_reset_network_header(skb);
+ iph = ipv6_hdr(skb);
+ iph->daddr = fl6->daddr;
++ ip6_flow_hdr(iph, 0, 0);
+
+ serr = SKB_EXT_ERR(skb);
+ serr->ee.ee_errno = err;
+@@ -700,17 +701,15 @@ void ip6_datagram_recv_specific_ctl(struct sock *sk, struct msghdr *msg,
+ }
+ if (np->rxopt.bits.rxorigdstaddr) {
+ struct sockaddr_in6 sin6;
+- __be16 *ports;
+- int end;
++ __be16 _ports[2], *ports;
+
+- end = skb_transport_offset(skb) + 4;
+- if (end <= 0 || pskb_may_pull(skb, end)) {
++ ports = skb_header_pointer(skb, skb_transport_offset(skb),
++ sizeof(_ports), &_ports);
++ if (ports) {
+ /* All current transport protocols have the port numbers in the
+ * first four bytes of the transport header and this function is
+ * written with this assumption in mind.
+ */
+- ports = (__be16 *)skb_transport_header(skb);
+-
+ sin6.sin6_family = AF_INET6;
+ sin6.sin6_addr = ipv6_hdr(skb)->daddr;
+ sin6.sin6_port = ports[1];
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index c9c53ade55c3..6d14cbe443f8 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -421,10 +421,10 @@ static int icmp6_iif(const struct sk_buff *skb)
+ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
+ const struct in6_addr *force_saddr)
+ {
+- struct net *net = dev_net(skb->dev);
+ struct inet6_dev *idev = NULL;
+ struct ipv6hdr *hdr = ipv6_hdr(skb);
+ struct sock *sk;
++ struct net *net;
+ struct ipv6_pinfo *np;
+ const struct in6_addr *saddr = NULL;
+ struct dst_entry *dst;
+@@ -435,12 +435,16 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
+ int iif = 0;
+ int addr_type = 0;
+ int len;
+- u32 mark = IP6_REPLY_MARK(net, skb->mark);
++ u32 mark;
+
+ if ((u8 *)hdr < skb->head ||
+ (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
+ return;
+
++ if (!skb->dev)
++ return;
++ net = dev_net(skb->dev);
++ mark = IP6_REPLY_MARK(net, skb->mark);
+ /*
+ * Make sure we respect the rules
+ * i.e. RFC 1885 2.4(e)
+diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
+index 9cd180bda092..7554c56b2e63 100644
+--- a/net/netfilter/nf_conncount.c
++++ b/net/netfilter/nf_conncount.c
+@@ -33,12 +33,6 @@
+
+ #define CONNCOUNT_SLOTS 256U
+
+-#ifdef CONFIG_LOCKDEP
+-#define CONNCOUNT_LOCK_SLOTS 8U
+-#else
+-#define CONNCOUNT_LOCK_SLOTS 256U
+-#endif
+-
+ #define CONNCOUNT_GC_MAX_NODES 8
+ #define MAX_KEYLEN 5
+
+@@ -49,8 +43,6 @@ struct nf_conncount_tuple {
+ struct nf_conntrack_zone zone;
+ int cpu;
+ u32 jiffies32;
+- bool dead;
+- struct rcu_head rcu_head;
+ };
+
+ struct nf_conncount_rb {
+@@ -60,7 +52,7 @@ struct nf_conncount_rb {
+ struct rcu_head rcu_head;
+ };
+
+-static spinlock_t nf_conncount_locks[CONNCOUNT_LOCK_SLOTS] __cacheline_aligned_in_smp;
++static spinlock_t nf_conncount_locks[CONNCOUNT_SLOTS] __cacheline_aligned_in_smp;
+
+ struct nf_conncount_data {
+ unsigned int keylen;
+@@ -89,79 +81,25 @@ static int key_diff(const u32 *a, const u32 *b, unsigned int klen)
+ return memcmp(a, b, klen * sizeof(u32));
+ }
+
+-enum nf_conncount_list_add
+-nf_conncount_add(struct nf_conncount_list *list,
+- const struct nf_conntrack_tuple *tuple,
+- const struct nf_conntrack_zone *zone)
+-{
+- struct nf_conncount_tuple *conn;
+-
+- if (WARN_ON_ONCE(list->count > INT_MAX))
+- return NF_CONNCOUNT_ERR;
+-
+- conn = kmem_cache_alloc(conncount_conn_cachep, GFP_ATOMIC);
+- if (conn == NULL)
+- return NF_CONNCOUNT_ERR;
+-
+- conn->tuple = *tuple;
+- conn->zone = *zone;
+- conn->cpu = raw_smp_processor_id();
+- conn->jiffies32 = (u32)jiffies;
+- conn->dead = false;
+- spin_lock_bh(&list->list_lock);
+- if (list->dead == true) {
+- kmem_cache_free(conncount_conn_cachep, conn);
+- spin_unlock_bh(&list->list_lock);
+- return NF_CONNCOUNT_SKIP;
+- }
+- list_add_tail(&conn->node, &list->head);
+- list->count++;
+- spin_unlock_bh(&list->list_lock);
+- return NF_CONNCOUNT_ADDED;
+-}
+-EXPORT_SYMBOL_GPL(nf_conncount_add);
+-
+-static void __conn_free(struct rcu_head *h)
+-{
+- struct nf_conncount_tuple *conn;
+-
+- conn = container_of(h, struct nf_conncount_tuple, rcu_head);
+- kmem_cache_free(conncount_conn_cachep, conn);
+-}
+-
+-static bool conn_free(struct nf_conncount_list *list,
++static void conn_free(struct nf_conncount_list *list,
+ struct nf_conncount_tuple *conn)
+ {
+- bool free_entry = false;
+-
+- spin_lock_bh(&list->list_lock);
+-
+- if (conn->dead) {
+- spin_unlock_bh(&list->list_lock);
+- return free_entry;
+- }
++ lockdep_assert_held(&list->list_lock);
+
+ list->count--;
+- conn->dead = true;
+- list_del_rcu(&conn->node);
+- if (list->count == 0) {
+- list->dead = true;
+- free_entry = true;
+- }
++ list_del(&conn->node);
+
+- spin_unlock_bh(&list->list_lock);
+- call_rcu(&conn->rcu_head, __conn_free);
+- return free_entry;
++ kmem_cache_free(conncount_conn_cachep, conn);
+ }
+
+ static const struct nf_conntrack_tuple_hash *
+ find_or_evict(struct net *net, struct nf_conncount_list *list,
+- struct nf_conncount_tuple *conn, bool *free_entry)
++ struct nf_conncount_tuple *conn)
+ {
+ const struct nf_conntrack_tuple_hash *found;
+ unsigned long a, b;
+ int cpu = raw_smp_processor_id();
+- __s32 age;
++ u32 age;
+
+ found = nf_conntrack_find_get(net, &conn->zone, &conn->tuple);
+ if (found)
+@@ -176,52 +114,45 @@ find_or_evict(struct net *net, struct nf_conncount_list *list,
+ */
+ age = a - b;
+ if (conn->cpu == cpu || age >= 2) {
+- *free_entry = conn_free(list, conn);
++ conn_free(list, conn);
+ return ERR_PTR(-ENOENT);
+ }
+
+ return ERR_PTR(-EAGAIN);
+ }
+
+-void nf_conncount_lookup(struct net *net,
+- struct nf_conncount_list *list,
+- const struct nf_conntrack_tuple *tuple,
+- const struct nf_conntrack_zone *zone,
+- bool *addit)
++static int __nf_conncount_add(struct net *net,
++ struct nf_conncount_list *list,
++ const struct nf_conntrack_tuple *tuple,
++ const struct nf_conntrack_zone *zone)
+ {
+ const struct nf_conntrack_tuple_hash *found;
+ struct nf_conncount_tuple *conn, *conn_n;
+ struct nf_conn *found_ct;
+ unsigned int collect = 0;
+- bool free_entry = false;
+-
+- /* best effort only */
+- *addit = tuple ? true : false;
+
+ /* check the saved connections */
+ list_for_each_entry_safe(conn, conn_n, &list->head, node) {
+ if (collect > CONNCOUNT_GC_MAX_NODES)
+ break;
+
+- found = find_or_evict(net, list, conn, &free_entry);
++ found = find_or_evict(net, list, conn);
+ if (IS_ERR(found)) {
+ /* Not found, but might be about to be confirmed */
+ if (PTR_ERR(found) == -EAGAIN) {
+- if (!tuple)
+- continue;
+-
+ if (nf_ct_tuple_equal(&conn->tuple, tuple) &&
+ nf_ct_zone_id(&conn->zone, conn->zone.dir) ==
+ nf_ct_zone_id(zone, zone->dir))
+- *addit = false;
+- } else if (PTR_ERR(found) == -ENOENT)
++ return 0; /* already exists */
++ } else {
+ collect++;
++ }
+ continue;
+ }
+
+ found_ct = nf_ct_tuplehash_to_ctrack(found);
+
+- if (tuple && nf_ct_tuple_equal(&conn->tuple, tuple) &&
++ if (nf_ct_tuple_equal(&conn->tuple, tuple) &&
+ nf_ct_zone_equal(found_ct, zone, zone->dir)) {
+ /*
+ * We should not see tuples twice unless someone hooks
+@@ -229,7 +160,8 @@ void nf_conncount_lookup(struct net *net,
+ *
+ * Attempt to avoid a re-add in this case.
+ */
+- *addit = false;
++ nf_ct_put(found_ct);
++ return 0;
+ } else if (already_closed(found_ct)) {
+ /*
+ * we do not care about connections which are
+@@ -243,19 +175,48 @@ void nf_conncount_lookup(struct net *net,
+
+ nf_ct_put(found_ct);
+ }
++
++ if (WARN_ON_ONCE(list->count > INT_MAX))
++ return -EOVERFLOW;
++
++ conn = kmem_cache_alloc(conncount_conn_cachep, GFP_ATOMIC);
++ if (conn == NULL)
++ return -ENOMEM;
++
++ conn->tuple = *tuple;
++ conn->zone = *zone;
++ conn->cpu = raw_smp_processor_id();
++ conn->jiffies32 = (u32)jiffies;
++ list_add_tail(&conn->node, &list->head);
++ list->count++;
++ return 0;
+ }
+-EXPORT_SYMBOL_GPL(nf_conncount_lookup);
++
++int nf_conncount_add(struct net *net,
++ struct nf_conncount_list *list,
++ const struct nf_conntrack_tuple *tuple,
++ const struct nf_conntrack_zone *zone)
++{
++ int ret;
++
++ /* check the saved connections */
++ spin_lock_bh(&list->list_lock);
++ ret = __nf_conncount_add(net, list, tuple, zone);
++ spin_unlock_bh(&list->list_lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(nf_conncount_add);
+
+ void nf_conncount_list_init(struct nf_conncount_list *list)
+ {
+ spin_lock_init(&list->list_lock);
+ INIT_LIST_HEAD(&list->head);
+ list->count = 0;
+- list->dead = false;
+ }
+ EXPORT_SYMBOL_GPL(nf_conncount_list_init);
+
+-/* Return true if the list is empty */
++/* Return true if the list is empty. Must be called with BH disabled. */
+ bool nf_conncount_gc_list(struct net *net,
+ struct nf_conncount_list *list)
+ {
+@@ -263,17 +224,17 @@ bool nf_conncount_gc_list(struct net *net,
+ struct nf_conncount_tuple *conn, *conn_n;
+ struct nf_conn *found_ct;
+ unsigned int collected = 0;
+- bool free_entry = false;
+ bool ret = false;
+
++ /* don't bother if other cpu is already doing GC */
++ if (!spin_trylock(&list->list_lock))
++ return false;
++
+ list_for_each_entry_safe(conn, conn_n, &list->head, node) {
+- found = find_or_evict(net, list, conn, &free_entry);
++ found = find_or_evict(net, list, conn);
+ if (IS_ERR(found)) {
+- if (PTR_ERR(found) == -ENOENT) {
+- if (free_entry)
+- return true;
++ if (PTR_ERR(found) == -ENOENT)
+ collected++;
+- }
+ continue;
+ }
+
+@@ -284,23 +245,19 @@ bool nf_conncount_gc_list(struct net *net,
+ * closed already -> ditch it
+ */
+ nf_ct_put(found_ct);
+- if (conn_free(list, conn))
+- return true;
++ conn_free(list, conn);
+ collected++;
+ continue;
+ }
+
+ nf_ct_put(found_ct);
+ if (collected > CONNCOUNT_GC_MAX_NODES)
+- return false;
++ break;
+ }
+
+- spin_lock_bh(&list->list_lock);
+- if (!list->count) {
+- list->dead = true;
++ if (!list->count)
+ ret = true;
+- }
+- spin_unlock_bh(&list->list_lock);
++ spin_unlock(&list->list_lock);
+
+ return ret;
+ }
+@@ -314,6 +271,7 @@ static void __tree_nodes_free(struct rcu_head *h)
+ kmem_cache_free(conncount_rb_cachep, rbconn);
+ }
+
++/* caller must hold tree nf_conncount_locks[] lock */
+ static void tree_nodes_free(struct rb_root *root,
+ struct nf_conncount_rb *gc_nodes[],
+ unsigned int gc_count)
+@@ -323,8 +281,10 @@ static void tree_nodes_free(struct rb_root *root,
+ while (gc_count) {
+ rbconn = gc_nodes[--gc_count];
+ spin_lock(&rbconn->list.list_lock);
+- rb_erase(&rbconn->node, root);
+- call_rcu(&rbconn->rcu_head, __tree_nodes_free);
++ if (!rbconn->list.count) {
++ rb_erase(&rbconn->node, root);
++ call_rcu(&rbconn->rcu_head, __tree_nodes_free);
++ }
+ spin_unlock(&rbconn->list.list_lock);
+ }
+ }
+@@ -341,20 +301,19 @@ insert_tree(struct net *net,
+ struct rb_root *root,
+ unsigned int hash,
+ const u32 *key,
+- u8 keylen,
+ const struct nf_conntrack_tuple *tuple,
+ const struct nf_conntrack_zone *zone)
+ {
+- enum nf_conncount_list_add ret;
+ struct nf_conncount_rb *gc_nodes[CONNCOUNT_GC_MAX_NODES];
+ struct rb_node **rbnode, *parent;
+ struct nf_conncount_rb *rbconn;
+ struct nf_conncount_tuple *conn;
+ unsigned int count = 0, gc_count = 0;
+- bool node_found = false;
+-
+- spin_lock_bh(&nf_conncount_locks[hash % CONNCOUNT_LOCK_SLOTS]);
++ u8 keylen = data->keylen;
++ bool do_gc = true;
+
++ spin_lock_bh(&nf_conncount_locks[hash]);
++restart:
+ parent = NULL;
+ rbnode = &(root->rb_node);
+ while (*rbnode) {
+@@ -368,45 +327,32 @@ insert_tree(struct net *net,
+ } else if (diff > 0) {
+ rbnode = &((*rbnode)->rb_right);
+ } else {
+- /* unlikely: other cpu added node already */
+- node_found = true;
+- ret = nf_conncount_add(&rbconn->list, tuple, zone);
+- if (ret == NF_CONNCOUNT_ERR) {
++ int ret;
++
++ ret = nf_conncount_add(net, &rbconn->list, tuple, zone);
++ if (ret)
+ count = 0; /* hotdrop */
+- } else if (ret == NF_CONNCOUNT_ADDED) {
++ else
+ count = rbconn->list.count;
+- } else {
+- /* NF_CONNCOUNT_SKIP, rbconn is already
+- * reclaimed by gc, insert a new tree node
+- */
+- node_found = false;
+- }
+- break;
++ tree_nodes_free(root, gc_nodes, gc_count);
++ goto out_unlock;
+ }
+
+ if (gc_count >= ARRAY_SIZE(gc_nodes))
+ continue;
+
+- if (nf_conncount_gc_list(net, &rbconn->list))
++ if (do_gc && nf_conncount_gc_list(net, &rbconn->list))
+ gc_nodes[gc_count++] = rbconn;
+ }
+
+ if (gc_count) {
+ tree_nodes_free(root, gc_nodes, gc_count);
+- /* tree_node_free before new allocation permits
+- * allocator to re-use newly free'd object.
+- *
+- * This is a rare event; in most cases we will find
+- * existing node to re-use. (or gc_count is 0).
+- */
+-
+- if (gc_count >= ARRAY_SIZE(gc_nodes))
+- schedule_gc_worker(data, hash);
++ schedule_gc_worker(data, hash);
++ gc_count = 0;
++ do_gc = false;
++ goto restart;
+ }
+
+- if (node_found)
+- goto out_unlock;
+-
+ /* expected case: match, insert new node */
+ rbconn = kmem_cache_alloc(conncount_rb_cachep, GFP_ATOMIC);
+ if (rbconn == NULL)
+@@ -430,7 +376,7 @@ insert_tree(struct net *net,
+ rb_link_node_rcu(&rbconn->node, parent, rbnode);
+ rb_insert_color(&rbconn->node, root);
+ out_unlock:
+- spin_unlock_bh(&nf_conncount_locks[hash % CONNCOUNT_LOCK_SLOTS]);
++ spin_unlock_bh(&nf_conncount_locks[hash]);
+ return count;
+ }
+
+@@ -441,7 +387,6 @@ count_tree(struct net *net,
+ const struct nf_conntrack_tuple *tuple,
+ const struct nf_conntrack_zone *zone)
+ {
+- enum nf_conncount_list_add ret;
+ struct rb_root *root;
+ struct rb_node *parent;
+ struct nf_conncount_rb *rbconn;
+@@ -454,7 +399,6 @@ count_tree(struct net *net,
+ parent = rcu_dereference_raw(root->rb_node);
+ while (parent) {
+ int diff;
+- bool addit;
+
+ rbconn = rb_entry(parent, struct nf_conncount_rb, node);
+
+@@ -464,31 +408,36 @@ count_tree(struct net *net,
+ } else if (diff > 0) {
+ parent = rcu_dereference_raw(parent->rb_right);
+ } else {
+- /* same source network -> be counted! */
+- nf_conncount_lookup(net, &rbconn->list, tuple, zone,
+- &addit);
++ int ret;
+
+- if (!addit)
++ if (!tuple) {
++ nf_conncount_gc_list(net, &rbconn->list);
+ return rbconn->list.count;
++ }
+
+- ret = nf_conncount_add(&rbconn->list, tuple, zone);
+- if (ret == NF_CONNCOUNT_ERR) {
+- return 0; /* hotdrop */
+- } else if (ret == NF_CONNCOUNT_ADDED) {
+- return rbconn->list.count;
+- } else {
+- /* NF_CONNCOUNT_SKIP, rbconn is already
+- * reclaimed by gc, insert a new tree node
+- */
++ spin_lock_bh(&rbconn->list.list_lock);
++ /* Node might be about to be free'd.
++ * We need to defer to insert_tree() in this case.
++ */
++ if (rbconn->list.count == 0) {
++ spin_unlock_bh(&rbconn->list.list_lock);
+ break;
+ }
++
++ /* same source network -> be counted! */
++ ret = __nf_conncount_add(net, &rbconn->list, tuple, zone);
++ spin_unlock_bh(&rbconn->list.list_lock);
++ if (ret)
++ return 0; /* hotdrop */
++ else
++ return rbconn->list.count;
+ }
+ }
+
+ if (!tuple)
+ return 0;
+
+- return insert_tree(net, data, root, hash, key, keylen, tuple, zone);
++ return insert_tree(net, data, root, hash, key, tuple, zone);
+ }
+
+ static void tree_gc_worker(struct work_struct *work)
+@@ -499,27 +448,47 @@ static void tree_gc_worker(struct work_struct *work)
+ struct rb_node *node;
+ unsigned int tree, next_tree, gc_count = 0;
+
+- tree = data->gc_tree % CONNCOUNT_LOCK_SLOTS;
++ tree = data->gc_tree % CONNCOUNT_SLOTS;
+ root = &data->root[tree];
+
++ local_bh_disable();
+ rcu_read_lock();
+ for (node = rb_first(root); node != NULL; node = rb_next(node)) {
+ rbconn = rb_entry(node, struct nf_conncount_rb, node);
+ if (nf_conncount_gc_list(data->net, &rbconn->list))
+- gc_nodes[gc_count++] = rbconn;
++ gc_count++;
+ }
+ rcu_read_unlock();
++ local_bh_enable();
++
++ cond_resched();
+
+ spin_lock_bh(&nf_conncount_locks[tree]);
++ if (gc_count < ARRAY_SIZE(gc_nodes))
++ goto next; /* do not bother */
+
+- if (gc_count) {
+- tree_nodes_free(root, gc_nodes, gc_count);
++ gc_count = 0;
++ node = rb_first(root);
++ while (node != NULL) {
++ rbconn = rb_entry(node, struct nf_conncount_rb, node);
++ node = rb_next(node);
++
++ if (rbconn->list.count > 0)
++ continue;
++
++ gc_nodes[gc_count++] = rbconn;
++ if (gc_count >= ARRAY_SIZE(gc_nodes)) {
++ tree_nodes_free(root, gc_nodes, gc_count);
++ gc_count = 0;
++ }
+ }
+
++ tree_nodes_free(root, gc_nodes, gc_count);
++next:
+ clear_bit(tree, data->pending_trees);
+
+ next_tree = (tree + 1) % CONNCOUNT_SLOTS;
+- next_tree = find_next_bit(data->pending_trees, next_tree, CONNCOUNT_SLOTS);
++ next_tree = find_next_bit(data->pending_trees, CONNCOUNT_SLOTS, next_tree);
+
+ if (next_tree < CONNCOUNT_SLOTS) {
+ data->gc_tree = next_tree;
+@@ -621,10 +590,7 @@ static int __init nf_conncount_modinit(void)
+ {
+ int i;
+
+- BUILD_BUG_ON(CONNCOUNT_LOCK_SLOTS > CONNCOUNT_SLOTS);
+- BUILD_BUG_ON((CONNCOUNT_SLOTS % CONNCOUNT_LOCK_SLOTS) != 0);
+-
+- for (i = 0; i < CONNCOUNT_LOCK_SLOTS; ++i)
++ for (i = 0; i < CONNCOUNT_SLOTS; ++i)
+ spin_lock_init(&nf_conncount_locks[i]);
+
+ conncount_conn_cachep = kmem_cache_create("nf_conncount_tuple",
+diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
+index b90d96ba4a12..af1497ab9464 100644
+--- a/net/netfilter/nft_connlimit.c
++++ b/net/netfilter/nft_connlimit.c
+@@ -30,7 +30,6 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv,
+ enum ip_conntrack_info ctinfo;
+ const struct nf_conn *ct;
+ unsigned int count;
+- bool addit;
+
+ tuple_ptr = &tuple;
+
+@@ -44,19 +43,12 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv,
+ return;
+ }
+
+- nf_conncount_lookup(nft_net(pkt), &priv->list, tuple_ptr, zone,
+- &addit);
+- count = priv->list.count;
+-
+- if (!addit)
+- goto out;
+-
+- if (nf_conncount_add(&priv->list, tuple_ptr, zone) == NF_CONNCOUNT_ERR) {
++ if (nf_conncount_add(nft_net(pkt), &priv->list, tuple_ptr, zone)) {
+ regs->verdict.code = NF_DROP;
+ return;
+ }
+- count++;
+-out:
++
++ count = priv->list.count;
+
+ if ((count > priv->limit) ^ priv->invert) {
+ regs->verdict.code = NFT_BREAK;
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 0541cfc93440..b6ea0fadb34f 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2628,7 +2628,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ addr = saddr->sll_halen ? saddr->sll_addr : NULL;
+ dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
+ if (addr && dev && saddr->sll_halen < dev->addr_len)
+- goto out;
++ goto out_put;
+ }
+
+ err = -ENXIO;
+@@ -2828,7 +2828,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ addr = saddr->sll_halen ? saddr->sll_addr : NULL;
+ dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
+ if (addr && dev && saddr->sll_halen < dev->addr_len)
+- goto out;
++ goto out_unlock;
+ }
+
+ err = -ENXIO;
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 7f0539db5604..0bae07e9c9e7 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -97,11 +97,9 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
+
+ switch (ev) {
+ case NETDEV_UP:
+- addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
++ addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
+ if (addr) {
+ addr->a.v6.sin6_family = AF_INET6;
+- addr->a.v6.sin6_port = 0;
+- addr->a.v6.sin6_flowinfo = 0;
+ addr->a.v6.sin6_addr = ifa->addr;
+ addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
+ addr->valid = 1;
+@@ -431,7 +429,6 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist,
+ addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
+ if (addr) {
+ addr->a.v6.sin6_family = AF_INET6;
+- addr->a.v6.sin6_port = 0;
+ addr->a.v6.sin6_addr = ifp->addr;
+ addr->a.v6.sin6_scope_id = dev->ifindex;
+ addr->valid = 1;
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index e948db29ab53..d4352111e69d 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -101,7 +101,6 @@ static void sctp_v4_copy_addrlist(struct list_head *addrlist,
+ addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
+ if (addr) {
+ addr->a.v4.sin_family = AF_INET;
+- addr->a.v4.sin_port = 0;
+ addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
+ addr->valid = 1;
+ INIT_LIST_HEAD(&addr->list);
+@@ -776,10 +775,9 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
+
+ switch (ev) {
+ case NETDEV_UP:
+- addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
++ addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
+ if (addr) {
+ addr->a.v4.sin_family = AF_INET;
+- addr->a.v4.sin_port = 0;
+ addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
+ addr->valid = 1;
+ spin_lock_bh(&net->sctp.local_addr_lock);
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 2b8f95290627..e6e506b2db99 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -144,6 +144,9 @@ static int smc_release(struct socket *sock)
+ sock_set_flag(sk, SOCK_DEAD);
+ sk->sk_shutdown |= SHUTDOWN_MASK;
+ }
++
++ sk->sk_prot->unhash(sk);
++
+ if (smc->clcsock) {
+ if (smc->use_fallback && sk->sk_state == SMC_LISTEN) {
+ /* wake up clcsock accept */
+@@ -168,7 +171,6 @@ static int smc_release(struct socket *sock)
+ smc_conn_free(&smc->conn);
+ release_sock(sk);
+
+- sk->sk_prot->unhash(sk);
+ sock_put(sk); /* final sock_put */
+ out:
+ return rc;
+diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
+index c7872bc13860..08b5fa4a2852 100644
+--- a/net/sunrpc/rpcb_clnt.c
++++ b/net/sunrpc/rpcb_clnt.c
+@@ -771,6 +771,12 @@ void rpcb_getport_async(struct rpc_task *task)
+ case RPCBVERS_3:
+ map->r_netid = xprt->address_strings[RPC_DISPLAY_NETID];
+ map->r_addr = rpc_sockaddr2uaddr(sap, GFP_ATOMIC);
++ if (!map->r_addr) {
++ status = -ENOMEM;
++ dprintk("RPC: %5u %s: no memory available\n",
++ task->tk_pid, __func__);
++ goto bailout_free_args;
++ }
+ map->r_owner = "";
+ break;
+ case RPCBVERS_2:
+@@ -793,6 +799,8 @@ void rpcb_getport_async(struct rpc_task *task)
+ rpc_put_task(child);
+ return;
+
++bailout_free_args:
++ kfree(map);
+ bailout_release_client:
+ rpc_release_client(rpcb_clnt);
+ bailout_nofree:
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 6376467e78f8..0b21187d74df 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -87,6 +87,11 @@ static int tipc_skb_tailroom(struct sk_buff *skb)
+ return limit;
+ }
+
++static inline int TLV_GET_DATA_LEN(struct tlv_desc *tlv)
++{
++ return TLV_GET_LEN(tlv) - TLV_SPACE(0);
++}
++
+ static int tipc_add_tlv(struct sk_buff *skb, u16 type, void *data, u16 len)
+ {
+ struct tlv_desc *tlv = (struct tlv_desc *)skb_tail_pointer(skb);
+@@ -166,6 +171,11 @@ static struct sk_buff *tipc_get_err_tlv(char *str)
+ return buf;
+ }
+
++static inline bool string_is_valid(char *s, int len)
++{
++ return memchr(s, '\0', len) ? true : false;
++}
++
+ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
+ struct tipc_nl_compat_msg *msg,
+ struct sk_buff *arg)
+@@ -379,6 +389,7 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd,
+ struct nlattr *prop;
+ struct nlattr *bearer;
+ struct tipc_bearer_config *b;
++ int len;
+
+ b = (struct tipc_bearer_config *)TLV_DATA(msg->req);
+
+@@ -386,6 +397,10 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd,
+ if (!bearer)
+ return -EMSGSIZE;
+
++ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
++ if (!string_is_valid(b->name, len))
++ return -EINVAL;
++
+ if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, b->name))
+ return -EMSGSIZE;
+
+@@ -411,6 +426,7 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd,
+ {
+ char *name;
+ struct nlattr *bearer;
++ int len;
+
+ name = (char *)TLV_DATA(msg->req);
+
+@@ -418,6 +434,10 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd,
+ if (!bearer)
+ return -EMSGSIZE;
+
++ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
++ if (!string_is_valid(name, len))
++ return -EINVAL;
++
+ if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, name))
+ return -EMSGSIZE;
+
+@@ -478,6 +498,7 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
+ struct nlattr *prop[TIPC_NLA_PROP_MAX + 1];
+ struct nlattr *stats[TIPC_NLA_STATS_MAX + 1];
+ int err;
++ int len;
+
+ if (!attrs[TIPC_NLA_LINK])
+ return -EINVAL;
+@@ -504,6 +525,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
+ return err;
+
+ name = (char *)TLV_DATA(msg->req);
++
++ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
++ if (!string_is_valid(name, len))
++ return -EINVAL;
++
+ if (strcmp(name, nla_data(link[TIPC_NLA_LINK_NAME])) != 0)
+ return 0;
+
+@@ -644,6 +670,7 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb,
+ struct nlattr *prop;
+ struct nlattr *media;
+ struct tipc_link_config *lc;
++ int len;
+
+ lc = (struct tipc_link_config *)TLV_DATA(msg->req);
+
+@@ -651,6 +678,10 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb,
+ if (!media)
+ return -EMSGSIZE;
+
++ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME);
++ if (!string_is_valid(lc->name, len))
++ return -EINVAL;
++
+ if (nla_put_string(skb, TIPC_NLA_MEDIA_NAME, lc->name))
+ return -EMSGSIZE;
+
+@@ -671,6 +702,7 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb,
+ struct nlattr *prop;
+ struct nlattr *bearer;
+ struct tipc_link_config *lc;
++ int len;
+
+ lc = (struct tipc_link_config *)TLV_DATA(msg->req);
+
+@@ -678,6 +710,10 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb,
+ if (!bearer)
+ return -EMSGSIZE;
+
++ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME);
++ if (!string_is_valid(lc->name, len))
++ return -EINVAL;
++
+ if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, lc->name))
+ return -EMSGSIZE;
+
+@@ -726,9 +762,14 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd,
+ struct tipc_link_config *lc;
+ struct tipc_bearer *bearer;
+ struct tipc_media *media;
++ int len;
+
+ lc = (struct tipc_link_config *)TLV_DATA(msg->req);
+
++ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
++ if (!string_is_valid(lc->name, len))
++ return -EINVAL;
++
+ media = tipc_media_find(lc->name);
+ if (media) {
+ cmd->doit = &__tipc_nl_media_set;
+@@ -750,6 +791,7 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
+ {
+ char *name;
+ struct nlattr *link;
++ int len;
+
+ name = (char *)TLV_DATA(msg->req);
+
+@@ -757,6 +799,10 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
+ if (!link)
+ return -EMSGSIZE;
+
++ len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
++ if (!string_is_valid(name, len))
++ return -EINVAL;
++
+ if (nla_put_string(skb, TIPC_NLA_LINK_NAME, name))
+ return -EMSGSIZE;
+
+@@ -778,6 +824,8 @@ static int tipc_nl_compat_name_table_dump_header(struct tipc_nl_compat_msg *msg)
+ };
+
+ ntq = (struct tipc_name_table_query *)TLV_DATA(msg->req);
++ if (TLV_GET_DATA_LEN(msg->req) < sizeof(struct tipc_name_table_query))
++ return -EINVAL;
+
+ depth = ntohl(ntq->depth);
+
+@@ -1201,7 +1249,7 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info)
+ }
+
+ len = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
+- if (len && !TLV_OK(msg.req, len)) {
++ if (!len || !TLV_OK(msg.req, len)) {
+ msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_SUPPORTED);
+ err = -EOPNOTSUPP;
+ goto send;
+diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
+index b84c0059214f..d65eed88c495 100644
+--- a/net/tipc/topsrv.c
++++ b/net/tipc/topsrv.c
+@@ -404,7 +404,7 @@ static int tipc_conn_rcv_from_sock(struct tipc_conn *con)
+ ret = sock_recvmsg(con->sock, &msg, MSG_DONTWAIT);
+ if (ret == -EWOULDBLOCK)
+ return -EWOULDBLOCK;
+- if (ret > 0) {
++ if (ret == sizeof(s)) {
+ read_lock_bh(&sk->sk_callback_lock);
+ ret = tipc_conn_rcv_sub(srv, con, &s);
+ read_unlock_bh(&sk->sk_callback_lock);
+diff --git a/security/security.c b/security/security.c
+index 736e78da1ab9..5ce2448f3a45 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -1003,6 +1003,13 @@ int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
+
+ void security_cred_free(struct cred *cred)
+ {
++ /*
++ * There is a failure case in prepare_creds() that
++ * may result in a call here with ->security being NULL.
++ */
++ if (unlikely(cred->security == NULL))
++ return;
++
+ call_void_hook(cred_free, cred);
+ }
+
+diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
+index b63ef865ce1e..d31a52e56b9e 100644
+--- a/security/selinux/ss/policydb.c
++++ b/security/selinux/ss/policydb.c
+@@ -732,7 +732,8 @@ static int sens_destroy(void *key, void *datum, void *p)
+ kfree(key);
+ if (datum) {
+ levdatum = datum;
+- ebitmap_destroy(&levdatum->level->cat);
++ if (levdatum->level)
++ ebitmap_destroy(&levdatum->level->cat);
+ kfree(levdatum->level);
+ }
+ kfree(datum);
+diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
+index ffda91a4a1aa..02514fe558b4 100644
+--- a/security/yama/yama_lsm.c
++++ b/security/yama/yama_lsm.c
+@@ -368,7 +368,9 @@ static int yama_ptrace_access_check(struct task_struct *child,
+ break;
+ case YAMA_SCOPE_RELATIONAL:
+ rcu_read_lock();
+- if (!task_is_descendant(current, child) &&
++ if (!pid_alive(child))
++ rc = -EPERM;
++ if (!rc && !task_is_descendant(current, child) &&
+ !ptracer_exception_found(current, child) &&
+ !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))
+ rc = -EPERM;
+diff --git a/tools/testing/selftests/android/Makefile b/tools/testing/selftests/android/Makefile
+index d9a725478375..72c25a3cb658 100644
+--- a/tools/testing/selftests/android/Makefile
++++ b/tools/testing/selftests/android/Makefile
+@@ -6,7 +6,7 @@ TEST_PROGS := run.sh
+
+ include ../lib.mk
+
+-all: khdr
++all:
+ @for DIR in $(SUBDIRS); do \
+ BUILD_TARGET=$(OUTPUT)/$$DIR; \
+ mkdir $$BUILD_TARGET -p; \
+diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
+index ad1eeb14fda7..30996306cabc 100644
+--- a/tools/testing/selftests/futex/functional/Makefile
++++ b/tools/testing/selftests/futex/functional/Makefile
+@@ -19,6 +19,7 @@ TEST_GEN_FILES := \
+ TEST_PROGS := run.sh
+
+ top_srcdir = ../../../../..
++KSFT_KHDR_INSTALL := 1
+ include ../../lib.mk
+
+ $(TEST_GEN_FILES): $(HEADERS)
+diff --git a/tools/testing/selftests/gpio/Makefile b/tools/testing/selftests/gpio/Makefile
+index 4665cdbf1a8d..59ea4c461978 100644
+--- a/tools/testing/selftests/gpio/Makefile
++++ b/tools/testing/selftests/gpio/Makefile
+@@ -9,6 +9,7 @@ EXTRA_OBJS := ../gpiogpio-event-mon-in.o ../gpiogpio-event-mon.o
+ EXTRA_OBJS += ../gpiogpio-hammer-in.o ../gpiogpio-utils.o ../gpiolsgpio-in.o
+ EXTRA_OBJS += ../gpiolsgpio.o
+
++KSFT_KHDR_INSTALL := 1
+ include ../lib.mk
+
+ all: $(BINARIES)
+diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
+index ec32dad3c3f0..cc83e2fd3787 100644
+--- a/tools/testing/selftests/kvm/Makefile
++++ b/tools/testing/selftests/kvm/Makefile
+@@ -1,6 +1,7 @@
+ all:
+
+ top_srcdir = ../../../../
++KSFT_KHDR_INSTALL := 1
+ UNAME_M := $(shell uname -m)
+
+ LIBKVM = lib/assert.c lib/elf.c lib/io.c lib/kvm_util.c lib/sparsebit.c
+@@ -40,4 +41,3 @@ $(OUTPUT)/libkvm.a: $(LIBKVM_OBJ)
+
+ all: $(STATIC_LIBS)
+ $(TEST_GEN_PROGS): $(STATIC_LIBS)
+-$(STATIC_LIBS):| khdr
+diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
+index 0a8e75886224..8b0f16409ed7 100644
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -16,18 +16,18 @@ TEST_GEN_PROGS := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS))
+ TEST_GEN_PROGS_EXTENDED := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS_EXTENDED))
+ TEST_GEN_FILES := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_FILES))
+
++ifdef KSFT_KHDR_INSTALL
+ top_srcdir ?= ../../../..
+ include $(top_srcdir)/scripts/subarch.include
+ ARCH ?= $(SUBARCH)
+
+-all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
+-
+ .PHONY: khdr
+ khdr:
+ make ARCH=$(ARCH) -C $(top_srcdir) headers_install
+
+-ifdef KSFT_KHDR_INSTALL
+-$(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES):| khdr
++all: khdr $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
++else
++all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
+ endif
+
+ .ONESHELL:
+diff --git a/tools/testing/selftests/networking/timestamping/Makefile b/tools/testing/selftests/networking/timestamping/Makefile
+index 14cfcf006936..c46c0eefab9e 100644
+--- a/tools/testing/selftests/networking/timestamping/Makefile
++++ b/tools/testing/selftests/networking/timestamping/Makefile
+@@ -6,6 +6,7 @@ TEST_PROGS := hwtstamp_config rxtimestamp timestamping txtimestamp
+ all: $(TEST_PROGS)
+
+ top_srcdir = ../../../../..
++KSFT_KHDR_INSTALL := 1
+ include ../../lib.mk
+
+ clean:
+diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
+index e94b7b14bcb2..dc68340a6a96 100644
+--- a/tools/testing/selftests/vm/Makefile
++++ b/tools/testing/selftests/vm/Makefile
+@@ -24,6 +24,7 @@ TEST_GEN_FILES += virtual_address_range
+
+ TEST_PROGS := run_vmtests
+
++KSFT_KHDR_INSTALL := 1
+ include ../lib.mk
+
+ $(OUTPUT)/userfaultfd: LDLIBS += -lpthread
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-01-26 15:09 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-01-26 15:09 UTC (permalink / raw
To: gentoo-commits
commit: ab431e3aad1b05a8e5ab6aff6f0ba86a0fac96b9
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Jan 26 15:08:45 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Jan 26 15:08:45 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ab431e3a
proj/linux-patches: Linux patch 4.19.18
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1017_linux-4.19.18.patch | 4709 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4713 insertions(+)
diff --git a/0000_README b/0000_README
index f7061f2..776e758 100644
--- a/0000_README
+++ b/0000_README
@@ -111,6 +111,10 @@ Patch: 1016_linux-4.19.17.patch
From: http://www.kernel.org
Desc: Linux 4.19.17
+Patch: 1017_linux-4.19.18.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.18
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1017_linux-4.19.18.patch b/1017_linux-4.19.18.patch
new file mode 100644
index 0000000..5cb666f
--- /dev/null
+++ b/1017_linux-4.19.18.patch
@@ -0,0 +1,4709 @@
+diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
+index 22b4b00dee31..06ac6dda9b34 100644
+--- a/Documentation/filesystems/proc.txt
++++ b/Documentation/filesystems/proc.txt
+@@ -496,7 +496,9 @@ manner. The codes are the following:
+
+ Note that there is no guarantee that every flag and associated mnemonic will
+ be present in all further kernel releases. Things get changed, the flags may
+-be vanished or the reverse -- new added.
++be vanished or the reverse -- new added. Interpretation of their meaning
++might change in future as well. So each consumer of these flags has to
++follow each specific kernel version for the exact semantic.
+
+ This file is only present if the CONFIG_MMU kernel configuration option is
+ enabled.
+diff --git a/Makefile b/Makefile
+index 4b0bce87a36b..9f37a8a9feb9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 17
++SUBLEVEL = 18
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
+index 0bcc98dbba56..f90f5d83b228 100644
+--- a/arch/arm64/include/asm/assembler.h
++++ b/arch/arm64/include/asm/assembler.h
+@@ -378,27 +378,33 @@ alternative_endif
+ * size: size of the region
+ * Corrupts: kaddr, size, tmp1, tmp2
+ */
++ .macro __dcache_op_workaround_clean_cache, op, kaddr
++alternative_if_not ARM64_WORKAROUND_CLEAN_CACHE
++ dc \op, \kaddr
++alternative_else
++ dc civac, \kaddr
++alternative_endif
++ .endm
++
+ .macro dcache_by_line_op op, domain, kaddr, size, tmp1, tmp2
+ dcache_line_size \tmp1, \tmp2
+ add \size, \kaddr, \size
+ sub \tmp2, \tmp1, #1
+ bic \kaddr, \kaddr, \tmp2
+ 9998:
+- .if (\op == cvau || \op == cvac)
+-alternative_if_not ARM64_WORKAROUND_CLEAN_CACHE
+- dc \op, \kaddr
+-alternative_else
+- dc civac, \kaddr
+-alternative_endif
+- .elseif (\op == cvap)
+-alternative_if ARM64_HAS_DCPOP
+- sys 3, c7, c12, 1, \kaddr // dc cvap
+-alternative_else
+- dc cvac, \kaddr
+-alternative_endif
++ .ifc \op, cvau
++ __dcache_op_workaround_clean_cache \op, \kaddr
++ .else
++ .ifc \op, cvac
++ __dcache_op_workaround_clean_cache \op, \kaddr
++ .else
++ .ifc \op, cvap
++ sys 3, c7, c12, 1, \kaddr // dc cvap
+ .else
+ dc \op, \kaddr
+ .endif
++ .endif
++ .endif
+ add \kaddr, \kaddr, \tmp1
+ cmp \kaddr, \size
+ b.lo 9998b
+diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
+index b96442960aea..56562ff01076 100644
+--- a/arch/arm64/include/asm/memory.h
++++ b/arch/arm64/include/asm/memory.h
+@@ -76,12 +76,17 @@
+ /*
+ * KASAN requires 1/8th of the kernel virtual address space for the shadow
+ * region. KASAN can bloat the stack significantly, so double the (minimum)
+- * stack size when KASAN is in use.
++ * stack size when KASAN is in use, and then double it again if KASAN_EXTRA is
++ * on.
+ */
+ #ifdef CONFIG_KASAN
+ #define KASAN_SHADOW_SCALE_SHIFT 3
+ #define KASAN_SHADOW_SIZE (UL(1) << (VA_BITS - KASAN_SHADOW_SCALE_SHIFT))
++#ifdef CONFIG_KASAN_EXTRA
++#define KASAN_THREAD_SHIFT 2
++#else
+ #define KASAN_THREAD_SHIFT 1
++#endif /* CONFIG_KASAN_EXTRA */
+ #else
+ #define KASAN_SHADOW_SIZE (0)
+ #define KASAN_THREAD_SHIFT 0
+diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
+index e213f8e867f6..8a91ac067d44 100644
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -1274,6 +1274,7 @@ static struct platform_driver armv8_pmu_driver = {
+ .driver = {
+ .name = ARMV8_PMU_PDEV_NAME,
+ .of_match_table = armv8_pmu_of_device_ids,
++ .suppress_bind_attrs = true,
+ },
+ .probe = armv8_pmu_device_probe,
+ };
+diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S
+index 0c22ede52f90..a194fd0e837f 100644
+--- a/arch/arm64/mm/cache.S
++++ b/arch/arm64/mm/cache.S
+@@ -212,6 +212,9 @@ ENDPROC(__dma_clean_area)
+ * - size - size in question
+ */
+ ENTRY(__clean_dcache_area_pop)
++ alternative_if_not ARM64_HAS_DCPOP
++ b __clean_dcache_area_poc
++ alternative_else_nop_endif
+ dcache_by_line_op cvap, sy, x0, x1, x2, x3
+ ret
+ ENDPIPROC(__clean_dcache_area_pop)
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 154b811d5894..201caf226b47 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -794,6 +794,7 @@ config SIBYTE_SWARM
+ select SYS_SUPPORTS_HIGHMEM
+ select SYS_SUPPORTS_LITTLE_ENDIAN
+ select ZONE_DMA32 if 64BIT
++ select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI
+
+ config SIBYTE_LITTLESUR
+ bool "Sibyte BCM91250C2-LittleSur"
+@@ -814,6 +815,7 @@ config SIBYTE_SENTOSA
+ select SYS_HAS_CPU_SB1
+ select SYS_SUPPORTS_BIG_ENDIAN
+ select SYS_SUPPORTS_LITTLE_ENDIAN
++ select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI
+
+ config SIBYTE_BIGSUR
+ bool "Sibyte BCM91480B-BigSur"
+@@ -826,6 +828,7 @@ config SIBYTE_BIGSUR
+ select SYS_SUPPORTS_HIGHMEM
+ select SYS_SUPPORTS_LITTLE_ENDIAN
+ select ZONE_DMA32 if 64BIT
++ select SWIOTLB if ARCH_DMA_ADDR_T_64BIT && PCI
+
+ config SNI_RM
+ bool "SNI RM200/300/400"
+diff --git a/arch/mips/sibyte/common/Makefile b/arch/mips/sibyte/common/Makefile
+index b3d6bf23a662..3ef3fb658136 100644
+--- a/arch/mips/sibyte/common/Makefile
++++ b/arch/mips/sibyte/common/Makefile
+@@ -1,4 +1,5 @@
+ obj-y := cfe.o
++obj-$(CONFIG_SWIOTLB) += dma.o
+ obj-$(CONFIG_SIBYTE_BUS_WATCHER) += bus_watcher.o
+ obj-$(CONFIG_SIBYTE_CFE_CONSOLE) += cfe_console.o
+ obj-$(CONFIG_SIBYTE_TBPROF) += sb_tbprof.o
+diff --git a/arch/mips/sibyte/common/dma.c b/arch/mips/sibyte/common/dma.c
+new file mode 100644
+index 000000000000..eb47a94f3583
+--- /dev/null
++++ b/arch/mips/sibyte/common/dma.c
+@@ -0,0 +1,14 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * DMA support for Broadcom SiByte platforms.
++ *
++ * Copyright (c) 2018 Maciej W. Rozycki
++ */
++
++#include <linux/swiotlb.h>
++#include <asm/bootinfo.h>
++
++void __init plat_swiotlb_setup(void)
++{
++ swiotlb_init(1);
++}
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 4264aedc7775..dd6badc31f45 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -75,6 +75,9 @@ static int xmon_gate;
+ #define xmon_owner 0
+ #endif /* CONFIG_SMP */
+
++#ifdef CONFIG_PPC_PSERIES
++static int set_indicator_token = RTAS_UNKNOWN_SERVICE;
++#endif
+ static unsigned long in_xmon __read_mostly = 0;
+ static int xmon_on = IS_ENABLED(CONFIG_XMON_DEFAULT);
+
+@@ -358,7 +361,6 @@ static inline void disable_surveillance(void)
+ #ifdef CONFIG_PPC_PSERIES
+ /* Since this can't be a module, args should end up below 4GB. */
+ static struct rtas_args args;
+- int token;
+
+ /*
+ * At this point we have got all the cpus we can into
+@@ -367,11 +369,11 @@ static inline void disable_surveillance(void)
+ * If we did try to take rtas.lock there would be a
+ * real possibility of deadlock.
+ */
+- token = rtas_token("set-indicator");
+- if (token == RTAS_UNKNOWN_SERVICE)
++ if (set_indicator_token == RTAS_UNKNOWN_SERVICE)
+ return;
+
+- rtas_call_unlocked(&args, token, 3, 1, NULL, SURVEILLANCE_TOKEN, 0, 0);
++ rtas_call_unlocked(&args, set_indicator_token, 3, 1, NULL,
++ SURVEILLANCE_TOKEN, 0, 0);
+
+ #endif /* CONFIG_PPC_PSERIES */
+ }
+@@ -3672,6 +3674,14 @@ static void xmon_init(int enable)
+ __debugger_iabr_match = xmon_iabr_match;
+ __debugger_break_match = xmon_break_match;
+ __debugger_fault_handler = xmon_fault_handler;
++
++#ifdef CONFIG_PPC_PSERIES
++ /*
++ * Get the token here to avoid trying to get a lock
++ * during the crash, causing a deadlock.
++ */
++ set_indicator_token = rtas_token("set-indicator");
++#endif
+ } else {
+ __debugger = NULL;
+ __debugger_ipi = NULL;
+diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
+index 3de69330e6c5..afbc87206886 100644
+--- a/arch/x86/include/asm/traps.h
++++ b/arch/x86/include/asm/traps.h
+@@ -104,9 +104,9 @@ extern int panic_on_unrecovered_nmi;
+
+ void math_emulate(struct math_emu_info *);
+ #ifndef CONFIG_X86_32
+-asmlinkage void smp_thermal_interrupt(void);
+-asmlinkage void smp_threshold_interrupt(void);
+-asmlinkage void smp_deferred_error_interrupt(void);
++asmlinkage void smp_thermal_interrupt(struct pt_regs *regs);
++asmlinkage void smp_threshold_interrupt(struct pt_regs *regs);
++asmlinkage void smp_deferred_error_interrupt(struct pt_regs *regs);
+ #endif
+
+ extern void ist_enter(struct pt_regs *regs);
+diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+index e12454e21b8a..9f915a8791cc 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -23,6 +23,7 @@
+ #include <linux/string.h>
+
+ #include <asm/amd_nb.h>
++#include <asm/traps.h>
+ #include <asm/apic.h>
+ #include <asm/mce.h>
+ #include <asm/msr.h>
+@@ -99,7 +100,7 @@ static u32 smca_bank_addrs[MAX_NR_BANKS][NR_BLOCKS] __ro_after_init =
+ [0 ... MAX_NR_BANKS - 1] = { [0 ... NR_BLOCKS - 1] = -1 }
+ };
+
+-const char *smca_get_name(enum smca_bank_types t)
++static const char *smca_get_name(enum smca_bank_types t)
+ {
+ if (t >= N_SMCA_BANK_TYPES)
+ return NULL;
+@@ -824,7 +825,7 @@ static void __log_error(unsigned int bank, u64 status, u64 addr, u64 misc)
+ mce_log(&m);
+ }
+
+-asmlinkage __visible void __irq_entry smp_deferred_error_interrupt(void)
++asmlinkage __visible void __irq_entry smp_deferred_error_interrupt(struct pt_regs *regs)
+ {
+ entering_irq();
+ trace_deferred_error_apic_entry(DEFERRED_ERROR_VECTOR);
+diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
+index 2da67b70ba98..ee229ceee745 100644
+--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
+@@ -25,6 +25,7 @@
+ #include <linux/cpu.h>
+
+ #include <asm/processor.h>
++#include <asm/traps.h>
+ #include <asm/apic.h>
+ #include <asm/mce.h>
+ #include <asm/msr.h>
+@@ -390,7 +391,7 @@ static void unexpected_thermal_interrupt(void)
+
+ static void (*smp_thermal_vector)(void) = unexpected_thermal_interrupt;
+
+-asmlinkage __visible void __irq_entry smp_thermal_interrupt(struct pt_regs *r)
++asmlinkage __visible void __irq_entry smp_thermal_interrupt(struct pt_regs *regs)
+ {
+ entering_irq();
+ trace_thermal_apic_entry(THERMAL_APIC_VECTOR);
+diff --git a/arch/x86/kernel/cpu/mcheck/threshold.c b/arch/x86/kernel/cpu/mcheck/threshold.c
+index 2b584b319eff..c21e0a1efd0f 100644
+--- a/arch/x86/kernel/cpu/mcheck/threshold.c
++++ b/arch/x86/kernel/cpu/mcheck/threshold.c
+@@ -6,6 +6,7 @@
+ #include <linux/kernel.h>
+
+ #include <asm/irq_vectors.h>
++#include <asm/traps.h>
+ #include <asm/apic.h>
+ #include <asm/mce.h>
+ #include <asm/trace/irq_vectors.h>
+@@ -18,7 +19,7 @@ static void default_threshold_interrupt(void)
+
+ void (*mce_threshold_vector)(void) = default_threshold_interrupt;
+
+-asmlinkage __visible void __irq_entry smp_threshold_interrupt(void)
++asmlinkage __visible void __irq_entry smp_threshold_interrupt(struct pt_regs *regs)
+ {
+ entering_irq();
+ trace_threshold_apic_entry(THRESHOLD_APIC_VECTOR);
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index f02ecaf97904..6489067b78a4 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1346,7 +1346,7 @@ void __init calculate_max_logical_packages(void)
+ * extrapolate the boot cpu's data to all packages.
+ */
+ ncpus = cpu_data(0).booted_cores * topology_max_smt_threads();
+- __max_logical_packages = DIV_ROUND_UP(nr_cpu_ids, ncpus);
++ __max_logical_packages = DIV_ROUND_UP(total_cpus, ncpus);
+ pr_info("Max logical packages: %u\n", __max_logical_packages);
+ }
+
+diff --git a/crypto/ecc.c b/crypto/ecc.c
+index 8facafd67802..adcce310f646 100644
+--- a/crypto/ecc.c
++++ b/crypto/ecc.c
+@@ -842,15 +842,23 @@ static void xycz_add_c(u64 *x1, u64 *y1, u64 *x2, u64 *y2, u64 *curve_prime,
+
+ static void ecc_point_mult(struct ecc_point *result,
+ const struct ecc_point *point, const u64 *scalar,
+- u64 *initial_z, u64 *curve_prime,
++ u64 *initial_z, const struct ecc_curve *curve,
+ unsigned int ndigits)
+ {
+ /* R0 and R1 */
+ u64 rx[2][ECC_MAX_DIGITS];
+ u64 ry[2][ECC_MAX_DIGITS];
+ u64 z[ECC_MAX_DIGITS];
++ u64 sk[2][ECC_MAX_DIGITS];
++ u64 *curve_prime = curve->p;
+ int i, nb;
+- int num_bits = vli_num_bits(scalar, ndigits);
++ int num_bits;
++ int carry;
++
++ carry = vli_add(sk[0], scalar, curve->n, ndigits);
++ vli_add(sk[1], sk[0], curve->n, ndigits);
++ scalar = sk[!carry];
++ num_bits = sizeof(u64) * ndigits * 8 + 1;
+
+ vli_set(rx[1], point->x, ndigits);
+ vli_set(ry[1], point->y, ndigits);
+@@ -1004,7 +1012,7 @@ int ecc_make_pub_key(unsigned int curve_id, unsigned int ndigits,
+ goto out;
+ }
+
+- ecc_point_mult(pk, &curve->g, priv, NULL, curve->p, ndigits);
++ ecc_point_mult(pk, &curve->g, priv, NULL, curve, ndigits);
+ if (ecc_point_is_zero(pk)) {
+ ret = -EAGAIN;
+ goto err_free_point;
+@@ -1090,7 +1098,7 @@ int crypto_ecdh_shared_secret(unsigned int curve_id, unsigned int ndigits,
+ goto err_alloc_product;
+ }
+
+- ecc_point_mult(product, pk, priv, rand_z, curve->p, ndigits);
++ ecc_point_mult(product, pk, priv, rand_z, curve, ndigits);
+
+ ecc_swap_digits(product->x, secret, ndigits);
+
+diff --git a/drivers/base/bus.c b/drivers/base/bus.c
+index 8bfd27ec73d6..585e2e1c9c8f 100644
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -31,6 +31,9 @@ static struct kset *system_kset;
+
+ #define to_drv_attr(_attr) container_of(_attr, struct driver_attribute, attr)
+
++#define DRIVER_ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) \
++ struct driver_attribute driver_attr_##_name = \
++ __ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store)
+
+ static int __must_check bus_rescan_devices_helper(struct device *dev,
+ void *data);
+@@ -195,7 +198,7 @@ static ssize_t unbind_store(struct device_driver *drv, const char *buf,
+ bus_put(bus);
+ return err;
+ }
+-static DRIVER_ATTR_WO(unbind);
++static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, S_IWUSR, NULL, unbind_store);
+
+ /*
+ * Manually attach a device to a driver.
+@@ -231,7 +234,7 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
+ bus_put(bus);
+ return err;
+ }
+-static DRIVER_ATTR_WO(bind);
++static DRIVER_ATTR_IGNORE_LOCKDEP(bind, S_IWUSR, NULL, bind_store);
+
+ static ssize_t show_drivers_autoprobe(struct bus_type *bus, char *buf)
+ {
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index cd2e5cf14ea5..77b67a5f21ee 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -343,6 +343,7 @@ static const struct usb_device_id blacklist_table[] = {
+ /* Intel Bluetooth devices */
+ { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW },
+ { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_NEW },
++ { USB_DEVICE(0x8087, 0x0029), .driver_info = BTUSB_INTEL_NEW },
+ { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
+ { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
+ { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
+@@ -2054,6 +2055,35 @@ static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
+ return -EILSEQ;
+ }
+
++static bool btusb_setup_intel_new_get_fw_name(struct intel_version *ver,
++ struct intel_boot_params *params,
++ char *fw_name, size_t len,
++ const char *suffix)
++{
++ switch (ver->hw_variant) {
++ case 0x0b: /* SfP */
++ case 0x0c: /* WsP */
++ snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
++ le16_to_cpu(ver->hw_variant),
++ le16_to_cpu(params->dev_revid),
++ suffix);
++ break;
++ case 0x11: /* JfP */
++ case 0x12: /* ThP */
++ case 0x13: /* HrP */
++ case 0x14: /* CcP */
++ snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
++ le16_to_cpu(ver->hw_variant),
++ le16_to_cpu(ver->hw_revision),
++ le16_to_cpu(ver->fw_revision),
++ suffix);
++ break;
++ default:
++ return false;
++ }
++ return true;
++}
++
+ static int btusb_setup_intel_new(struct hci_dev *hdev)
+ {
+ struct btusb_data *data = hci_get_drvdata(hdev);
+@@ -2105,7 +2135,7 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
+ case 0x11: /* JfP */
+ case 0x12: /* ThP */
+ case 0x13: /* HrP */
+- case 0x14: /* QnJ, IcP */
++ case 0x14: /* CcP */
+ break;
+ default:
+ bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
+@@ -2189,23 +2219,9 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
+ * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
+ *
+ */
+- switch (ver.hw_variant) {
+- case 0x0b: /* SfP */
+- case 0x0c: /* WsP */
+- snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.sfi",
+- le16_to_cpu(ver.hw_variant),
+- le16_to_cpu(params.dev_revid));
+- break;
+- case 0x11: /* JfP */
+- case 0x12: /* ThP */
+- case 0x13: /* HrP */
+- case 0x14: /* QnJ, IcP */
+- snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.sfi",
+- le16_to_cpu(ver.hw_variant),
+- le16_to_cpu(ver.hw_revision),
+- le16_to_cpu(ver.fw_revision));
+- break;
+- default:
++ err = btusb_setup_intel_new_get_fw_name(&ver, ¶ms, fwname,
++ sizeof(fwname), "sfi");
++ if (!err) {
+ bt_dev_err(hdev, "Unsupported Intel firmware naming");
+ return -EINVAL;
+ }
+@@ -2221,23 +2237,9 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
+ /* Save the DDC file name for later use to apply once the firmware
+ * downloading is done.
+ */
+- switch (ver.hw_variant) {
+- case 0x0b: /* SfP */
+- case 0x0c: /* WsP */
+- snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.ddc",
+- le16_to_cpu(ver.hw_variant),
+- le16_to_cpu(params.dev_revid));
+- break;
+- case 0x11: /* JfP */
+- case 0x12: /* ThP */
+- case 0x13: /* HrP */
+- case 0x14: /* QnJ, IcP */
+- snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.ddc",
+- le16_to_cpu(ver.hw_variant),
+- le16_to_cpu(ver.hw_revision),
+- le16_to_cpu(ver.fw_revision));
+- break;
+- default:
++ err = btusb_setup_intel_new_get_fw_name(&ver, ¶ms, fwname,
++ sizeof(fwname), "ddc");
++ if (!err) {
+ bt_dev_err(hdev, "Unsupported Intel firmware naming");
+ return -EINVAL;
+ }
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 7fc9612070a1..d5f7a12e350e 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -29,6 +29,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/workqueue.h>
+ #include <linux/uuid.h>
++#include <linux/nospec.h>
+
+ #define PFX "IPMI message handler: "
+
+@@ -61,7 +62,8 @@ static void ipmi_debug_msg(const char *title, unsigned char *data,
+ { }
+ #endif
+
+-static int initialized;
++static bool initialized;
++static bool drvregistered;
+
+ enum ipmi_panic_event_op {
+ IPMI_SEND_PANIC_EVENT_NONE,
+@@ -611,7 +613,7 @@ static DEFINE_MUTEX(ipmidriver_mutex);
+
+ static LIST_HEAD(ipmi_interfaces);
+ static DEFINE_MUTEX(ipmi_interfaces_mutex);
+-DEFINE_STATIC_SRCU(ipmi_interfaces_srcu);
++struct srcu_struct ipmi_interfaces_srcu;
+
+ /*
+ * List of watchers that want to know when smi's are added and deleted.
+@@ -719,7 +721,15 @@ struct watcher_entry {
+ int ipmi_smi_watcher_register(struct ipmi_smi_watcher *watcher)
+ {
+ struct ipmi_smi *intf;
+- int index;
++ int index, rv;
++
++ /*
++ * Make sure the driver is actually initialized, this handles
++ * problems with initialization order.
++ */
++ rv = ipmi_init_msghandler();
++ if (rv)
++ return rv;
+
+ mutex_lock(&smi_watchers_mutex);
+
+@@ -883,7 +893,7 @@ static int deliver_response(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+
+ if (user) {
+ user->handler->ipmi_recv_hndl(msg, user->handler_data);
+- release_ipmi_user(msg->user, index);
++ release_ipmi_user(user, index);
+ } else {
+ /* User went away, give up. */
+ ipmi_free_recv_msg(msg);
+@@ -1075,7 +1085,7 @@ int ipmi_create_user(unsigned int if_num,
+ {
+ unsigned long flags;
+ struct ipmi_user *new_user;
+- int rv = 0, index;
++ int rv, index;
+ struct ipmi_smi *intf;
+
+ /*
+@@ -1093,18 +1103,9 @@ int ipmi_create_user(unsigned int if_num,
+ * Make sure the driver is actually initialized, this handles
+ * problems with initialization order.
+ */
+- if (!initialized) {
+- rv = ipmi_init_msghandler();
+- if (rv)
+- return rv;
+-
+- /*
+- * The init code doesn't return an error if it was turned
+- * off, but it won't initialize. Check that.
+- */
+- if (!initialized)
+- return -ENODEV;
+- }
++ rv = ipmi_init_msghandler();
++ if (rv)
++ return rv;
+
+ new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
+ if (!new_user)
+@@ -1182,6 +1183,7 @@ EXPORT_SYMBOL(ipmi_get_smi_info);
+ static void free_user(struct kref *ref)
+ {
+ struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
++ cleanup_srcu_struct(&user->release_barrier);
+ kfree(user);
+ }
+
+@@ -1258,7 +1260,6 @@ int ipmi_destroy_user(struct ipmi_user *user)
+ {
+ _ipmi_destroy_user(user);
+
+- cleanup_srcu_struct(&user->release_barrier);
+ kref_put(&user->refcount, free_user);
+
+ return 0;
+@@ -1297,10 +1298,12 @@ int ipmi_set_my_address(struct ipmi_user *user,
+ if (!user)
+ return -ENODEV;
+
+- if (channel >= IPMI_MAX_CHANNELS)
++ if (channel >= IPMI_MAX_CHANNELS) {
+ rv = -EINVAL;
+- else
++ } else {
++ channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
+ user->intf->addrinfo[channel].address = address;
++ }
+ release_ipmi_user(user, index);
+
+ return rv;
+@@ -1317,10 +1320,12 @@ int ipmi_get_my_address(struct ipmi_user *user,
+ if (!user)
+ return -ENODEV;
+
+- if (channel >= IPMI_MAX_CHANNELS)
++ if (channel >= IPMI_MAX_CHANNELS) {
+ rv = -EINVAL;
+- else
++ } else {
++ channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
+ *address = user->intf->addrinfo[channel].address;
++ }
+ release_ipmi_user(user, index);
+
+ return rv;
+@@ -1337,10 +1342,12 @@ int ipmi_set_my_LUN(struct ipmi_user *user,
+ if (!user)
+ return -ENODEV;
+
+- if (channel >= IPMI_MAX_CHANNELS)
++ if (channel >= IPMI_MAX_CHANNELS) {
+ rv = -EINVAL;
+- else
++ } else {
++ channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
+ user->intf->addrinfo[channel].lun = LUN & 0x3;
++ }
+ release_ipmi_user(user, index);
+
+ return 0;
+@@ -1357,10 +1364,12 @@ int ipmi_get_my_LUN(struct ipmi_user *user,
+ if (!user)
+ return -ENODEV;
+
+- if (channel >= IPMI_MAX_CHANNELS)
++ if (channel >= IPMI_MAX_CHANNELS) {
+ rv = -EINVAL;
+- else
++ } else {
++ channel = array_index_nospec(channel, IPMI_MAX_CHANNELS);
+ *address = user->intf->addrinfo[channel].lun;
++ }
+ release_ipmi_user(user, index);
+
+ return rv;
+@@ -2184,6 +2193,7 @@ static int check_addr(struct ipmi_smi *intf,
+ {
+ if (addr->channel >= IPMI_MAX_CHANNELS)
+ return -EINVAL;
++ addr->channel = array_index_nospec(addr->channel, IPMI_MAX_CHANNELS);
+ *lun = intf->addrinfo[addr->channel].lun;
+ *saddr = intf->addrinfo[addr->channel].address;
+ return 0;
+@@ -3294,17 +3304,9 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
+ * Make sure the driver is actually initialized, this handles
+ * problems with initialization order.
+ */
+- if (!initialized) {
+- rv = ipmi_init_msghandler();
+- if (rv)
+- return rv;
+- /*
+- * The init code doesn't return an error if it was turned
+- * off, but it won't initialize. Check that.
+- */
+- if (!initialized)
+- return -ENODEV;
+- }
++ rv = ipmi_init_msghandler();
++ if (rv)
++ return rv;
+
+ intf = kzalloc(sizeof(*intf), GFP_KERNEL);
+ if (!intf)
+@@ -5020,6 +5022,22 @@ static int panic_event(struct notifier_block *this,
+ return NOTIFY_DONE;
+ }
+
++/* Must be called with ipmi_interfaces_mutex held. */
++static int ipmi_register_driver(void)
++{
++ int rv;
++
++ if (drvregistered)
++ return 0;
++
++ rv = driver_register(&ipmidriver.driver);
++ if (rv)
++ pr_err("Could not register IPMI driver\n");
++ else
++ drvregistered = true;
++ return rv;
++}
++
+ static struct notifier_block panic_block = {
+ .notifier_call = panic_event,
+ .next = NULL,
+@@ -5030,66 +5048,74 @@ static int ipmi_init_msghandler(void)
+ {
+ int rv;
+
++ mutex_lock(&ipmi_interfaces_mutex);
++ rv = ipmi_register_driver();
++ if (rv)
++ goto out;
+ if (initialized)
+- return 0;
+-
+- rv = driver_register(&ipmidriver.driver);
+- if (rv) {
+- pr_err(PFX "Could not register IPMI driver\n");
+- return rv;
+- }
++ goto out;
+
+- pr_info("ipmi message handler version " IPMI_DRIVER_VERSION "\n");
++ init_srcu_struct(&ipmi_interfaces_srcu);
+
+ timer_setup(&ipmi_timer, ipmi_timeout, 0);
+ mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
+
+ atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
+
+- initialized = 1;
++ initialized = true;
+
+- return 0;
++out:
++ mutex_unlock(&ipmi_interfaces_mutex);
++ return rv;
+ }
+
+ static int __init ipmi_init_msghandler_mod(void)
+ {
+- ipmi_init_msghandler();
+- return 0;
++ int rv;
++
++ pr_info("version " IPMI_DRIVER_VERSION "\n");
++
++ mutex_lock(&ipmi_interfaces_mutex);
++ rv = ipmi_register_driver();
++ mutex_unlock(&ipmi_interfaces_mutex);
++
++ return rv;
+ }
+
+ static void __exit cleanup_ipmi(void)
+ {
+ int count;
+
+- if (!initialized)
+- return;
+-
+- atomic_notifier_chain_unregister(&panic_notifier_list, &panic_block);
+-
+- /*
+- * This can't be called if any interfaces exist, so no worry
+- * about shutting down the interfaces.
+- */
+-
+- /*
+- * Tell the timer to stop, then wait for it to stop. This
+- * avoids problems with race conditions removing the timer
+- * here.
+- */
+- atomic_inc(&stop_operation);
+- del_timer_sync(&ipmi_timer);
++ if (initialized) {
++ atomic_notifier_chain_unregister(&panic_notifier_list,
++ &panic_block);
+
+- driver_unregister(&ipmidriver.driver);
+-
+- initialized = 0;
++ /*
++ * This can't be called if any interfaces exist, so no worry
++ * about shutting down the interfaces.
++ */
+
+- /* Check for buffer leaks. */
+- count = atomic_read(&smi_msg_inuse_count);
+- if (count != 0)
+- pr_warn(PFX "SMI message count %d at exit\n", count);
+- count = atomic_read(&recv_msg_inuse_count);
+- if (count != 0)
+- pr_warn(PFX "recv message count %d at exit\n", count);
++ /*
++ * Tell the timer to stop, then wait for it to stop. This
++ * avoids problems with race conditions removing the timer
++ * here.
++ */
++ atomic_inc(&stop_operation);
++ del_timer_sync(&ipmi_timer);
++
++ initialized = false;
++
++ /* Check for buffer leaks. */
++ count = atomic_read(&smi_msg_inuse_count);
++ if (count != 0)
++ pr_warn(PFX "SMI message count %d at exit\n", count);
++ count = atomic_read(&recv_msg_inuse_count);
++ if (count != 0)
++ pr_warn(PFX "recv message count %d at exit\n", count);
++ cleanup_srcu_struct(&ipmi_interfaces_srcu);
++ }
++ if (drvregistered)
++ driver_unregister(&ipmidriver.driver);
+ }
+ module_exit(cleanup_ipmi);
+
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 9b786726e426..76c2010ba672 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -630,8 +630,9 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+
+ /* Remove the multi-part read marker. */
+ len -= 2;
++ data += 2;
+ for (i = 0; i < len; i++)
+- ssif_info->data[i] = data[i+2];
++ ssif_info->data[i] = data[i];
+ ssif_info->multi_len = len;
+ ssif_info->multi_pos = 1;
+
+@@ -659,8 +660,19 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ }
+
+ blocknum = data[0];
++ len--;
++ data++;
++
++ if (blocknum != 0xff && len != 31) {
++ /* All blocks but the last must have 31 data bytes. */
++ result = -EIO;
++ if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
++ pr_info("Received middle message <31\n");
+
+- if (ssif_info->multi_len + len - 1 > IPMI_MAX_MSG_LENGTH) {
++ goto continue_op;
++ }
++
++ if (ssif_info->multi_len + len > IPMI_MAX_MSG_LENGTH) {
+ /* Received message too big, abort the operation. */
+ result = -E2BIG;
+ if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+@@ -669,16 +681,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ goto continue_op;
+ }
+
+- /* Remove the blocknum from the data. */
+- len--;
+ for (i = 0; i < len; i++)
+- ssif_info->data[i + ssif_info->multi_len] = data[i + 1];
++ ssif_info->data[i + ssif_info->multi_len] = data[i];
+ ssif_info->multi_len += len;
+ if (blocknum == 0xff) {
+ /* End of read */
+ len = ssif_info->multi_len;
+ data = ssif_info->data;
+- } else if (blocknum + 1 != ssif_info->multi_pos) {
++ } else if (blocknum != ssif_info->multi_pos) {
+ /*
+ * Out of sequence block, just abort. Block
+ * numbers start at zero for the second block,
+@@ -706,6 +716,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ }
+ }
+
++ continue_op:
+ if (result < 0) {
+ ssif_inc_stat(ssif_info, receive_errors);
+ } else {
+@@ -713,8 +724,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ ssif_inc_stat(ssif_info, received_message_parts);
+ }
+
+-
+- continue_op:
+ if (ssif_info->ssif_debug & SSIF_DEBUG_STATE)
+ pr_info(PFX "DONE 1: state = %d, result=%d.\n",
+ ssif_info->ssif_state, result);
+diff --git a/drivers/clk/imx/clk-busy.c b/drivers/clk/imx/clk-busy.c
+index 99036527eb0d..e695622c5aa5 100644
+--- a/drivers/clk/imx/clk-busy.c
++++ b/drivers/clk/imx/clk-busy.c
+@@ -154,7 +154,7 @@ static const struct clk_ops clk_busy_mux_ops = {
+
+ struct clk *imx_clk_busy_mux(const char *name, void __iomem *reg, u8 shift,
+ u8 width, void __iomem *busy_reg, u8 busy_shift,
+- const char **parent_names, int num_parents)
++ const char * const *parent_names, int num_parents)
+ {
+ struct clk_busy_mux *busy;
+ struct clk *clk;
+diff --git a/drivers/clk/imx/clk-fixup-mux.c b/drivers/clk/imx/clk-fixup-mux.c
+index c9b327e0a8dd..44817c1b0b88 100644
+--- a/drivers/clk/imx/clk-fixup-mux.c
++++ b/drivers/clk/imx/clk-fixup-mux.c
+@@ -70,7 +70,7 @@ static const struct clk_ops clk_fixup_mux_ops = {
+ };
+
+ struct clk *imx_clk_fixup_mux(const char *name, void __iomem *reg,
+- u8 shift, u8 width, const char **parents,
++ u8 shift, u8 width, const char * const *parents,
+ int num_parents, void (*fixup)(u32 *val))
+ {
+ struct clk_fixup_mux *fixup_mux;
+diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
+index 8c7c2fcb8d94..c509324f6338 100644
+--- a/drivers/clk/imx/clk-imx6q.c
++++ b/drivers/clk/imx/clk-imx6q.c
+@@ -508,8 +508,12 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ * lvds1_gate and lvds2_gate are pseudo-gates. Both can be
+ * independently configured as clock inputs or outputs. We treat
+ * the "output_enable" bit as a gate, even though it's really just
+- * enabling clock output.
++ * enabling clock output. Initially the gate bits are cleared, as
++ * otherwise the exclusive configuration gets locked in the setup done
++ * by software running before the clock driver, with no way to change
++ * it.
+ */
++ writel(readl(base + 0x160) & ~0x3c00, base + 0x160);
+ clk[IMX6QDL_CLK_LVDS1_GATE] = imx_clk_gate_exclusive("lvds1_gate", "lvds1_sel", base + 0x160, 10, BIT(12));
+ clk[IMX6QDL_CLK_LVDS2_GATE] = imx_clk_gate_exclusive("lvds2_gate", "lvds2_sel", base + 0x160, 11, BIT(13));
+
+diff --git a/drivers/clk/imx/clk.h b/drivers/clk/imx/clk.h
+index 8076ec040f37..e65c1115d978 100644
+--- a/drivers/clk/imx/clk.h
++++ b/drivers/clk/imx/clk.h
+@@ -63,14 +63,14 @@ struct clk *imx_clk_busy_divider(const char *name, const char *parent_name,
+
+ struct clk *imx_clk_busy_mux(const char *name, void __iomem *reg, u8 shift,
+ u8 width, void __iomem *busy_reg, u8 busy_shift,
+- const char **parent_names, int num_parents);
++ const char * const *parent_names, int num_parents);
+
+ struct clk *imx_clk_fixup_divider(const char *name, const char *parent,
+ void __iomem *reg, u8 shift, u8 width,
+ void (*fixup)(u32 *val));
+
+ struct clk *imx_clk_fixup_mux(const char *name, void __iomem *reg,
+- u8 shift, u8 width, const char **parents,
++ u8 shift, u8 width, const char * const *parents,
+ int num_parents, void (*fixup)(u32 *val));
+
+ static inline struct clk *imx_clk_fixed(const char *name, int rate)
+@@ -79,7 +79,8 @@ static inline struct clk *imx_clk_fixed(const char *name, int rate)
+ }
+
+ static inline struct clk *imx_clk_mux_ldb(const char *name, void __iomem *reg,
+- u8 shift, u8 width, const char **parents, int num_parents)
++ u8 shift, u8 width, const char * const *parents,
++ int num_parents)
+ {
+ return clk_register_mux(NULL, name, parents, num_parents,
+ CLK_SET_RATE_NO_REPARENT | CLK_SET_RATE_PARENT, reg,
+@@ -192,7 +193,8 @@ static inline struct clk *imx_clk_gate4(const char *name, const char *parent,
+ }
+
+ static inline struct clk *imx_clk_mux(const char *name, void __iomem *reg,
+- u8 shift, u8 width, const char **parents, int num_parents)
++ u8 shift, u8 width, const char * const *parents,
++ int num_parents)
+ {
+ return clk_register_mux(NULL, name, parents, num_parents,
+ CLK_SET_RATE_NO_REPARENT, reg, shift,
+@@ -200,7 +202,8 @@ static inline struct clk *imx_clk_mux(const char *name, void __iomem *reg,
+ }
+
+ static inline struct clk *imx_clk_mux2(const char *name, void __iomem *reg,
+- u8 shift, u8 width, const char **parents, int num_parents)
++ u8 shift, u8 width, const char * const *parents,
++ int num_parents)
+ {
+ return clk_register_mux(NULL, name, parents, num_parents,
+ CLK_SET_RATE_NO_REPARENT | CLK_OPS_PARENT_ENABLE,
+@@ -208,8 +211,9 @@ static inline struct clk *imx_clk_mux2(const char *name, void __iomem *reg,
+ }
+
+ static inline struct clk *imx_clk_mux_flags(const char *name,
+- void __iomem *reg, u8 shift, u8 width, const char **parents,
+- int num_parents, unsigned long flags)
++ void __iomem *reg, u8 shift, u8 width,
++ const char * const *parents, int num_parents,
++ unsigned long flags)
+ {
+ return clk_register_mux(NULL, name, parents, num_parents,
+ flags | CLK_SET_RATE_NO_REPARENT, reg, shift, width, 0,
+diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
+index 74697e145dde..50060e895e7a 100644
+--- a/drivers/clk/meson/meson8b.c
++++ b/drivers/clk/meson/meson8b.c
+@@ -568,13 +568,14 @@ static struct clk_fixed_factor meson8b_cpu_div3 = {
+ };
+
+ static const struct clk_div_table cpu_scale_table[] = {
+- { .val = 2, .div = 4 },
+- { .val = 3, .div = 6 },
+- { .val = 4, .div = 8 },
+- { .val = 5, .div = 10 },
+- { .val = 6, .div = 12 },
+- { .val = 7, .div = 14 },
+- { .val = 8, .div = 16 },
++ { .val = 1, .div = 4 },
++ { .val = 2, .div = 6 },
++ { .val = 3, .div = 8 },
++ { .val = 4, .div = 10 },
++ { .val = 5, .div = 12 },
++ { .val = 6, .div = 14 },
++ { .val = 7, .div = 16 },
++ { .val = 8, .div = 18 },
+ { /* sentinel */ },
+ };
+
+diff --git a/drivers/clocksource/timer-integrator-ap.c b/drivers/clocksource/timer-integrator-ap.c
+index 62d24690ba02..9701107806a7 100644
+--- a/drivers/clocksource/timer-integrator-ap.c
++++ b/drivers/clocksource/timer-integrator-ap.c
+@@ -181,8 +181,7 @@ static int __init integrator_ap_timer_init_of(struct device_node *node)
+ int irq;
+ struct clk *clk;
+ unsigned long rate;
+- struct device_node *pri_node;
+- struct device_node *sec_node;
++ struct device_node *alias_node;
+
+ base = of_io_request_and_map(node, 0, "integrator-timer");
+ if (IS_ERR(base))
+@@ -204,7 +203,18 @@ static int __init integrator_ap_timer_init_of(struct device_node *node)
+ return err;
+ }
+
+- pri_node = of_find_node_by_path(path);
++ alias_node = of_find_node_by_path(path);
++
++ /*
++ * The pointer is used as an identifier not as a pointer, we
++ * can drop the refcount on the of__node immediately after
++ * getting it.
++ */
++ of_node_put(alias_node);
++
++ if (node == alias_node)
++ /* The primary timer lacks IRQ, use as clocksource */
++ return integrator_clocksource_init(rate, base);
+
+ err = of_property_read_string(of_aliases,
+ "arm,timer-secondary", &path);
+@@ -213,14 +223,11 @@ static int __init integrator_ap_timer_init_of(struct device_node *node)
+ return err;
+ }
+
++ alias_node = of_find_node_by_path(path);
+
+- sec_node = of_find_node_by_path(path);
+-
+- if (node == pri_node)
+- /* The primary timer lacks IRQ, use as clocksource */
+- return integrator_clocksource_init(rate, base);
++ of_node_put(alias_node);
+
+- if (node == sec_node) {
++ if (node == alias_node) {
+ /* The secondary timer will drive the clock event */
+ irq = irq_of_parse_and_map(node, 0);
+ return integrator_clockevent_init(rate, base, irq);
+diff --git a/drivers/cpuidle/cpuidle-pseries.c b/drivers/cpuidle/cpuidle-pseries.c
+index 9e56bc411061..74c247972bb3 100644
+--- a/drivers/cpuidle/cpuidle-pseries.c
++++ b/drivers/cpuidle/cpuidle-pseries.c
+@@ -247,7 +247,13 @@ static int pseries_idle_probe(void)
+ return -ENODEV;
+
+ if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
+- if (lppaca_shared_proc(get_lppaca())) {
++ /*
++ * Use local_paca instead of get_lppaca() since
++ * preemption is not disabled, and it is not required in
++ * fact, since lppaca_ptr does not need to be the value
++ * associated to the current CPU, it can be from any CPU.
++ */
++ if (lppaca_shared_proc(local_paca->lppaca_ptr)) {
+ cpuidle_state_table = shared_states;
+ max_idle_state = ARRAY_SIZE(shared_states);
+ } else {
+diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
+index c51627660dbb..d9845099635e 100644
+--- a/drivers/firmware/efi/libstub/Makefile
++++ b/drivers/firmware/efi/libstub/Makefile
+@@ -9,7 +9,10 @@ cflags-$(CONFIG_X86_32) := -march=i386
+ cflags-$(CONFIG_X86_64) := -mcmodel=small
+ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -O2 \
+ -fPIC -fno-strict-aliasing -mno-red-zone \
+- -mno-mmx -mno-sse -fshort-wchar
++ -mno-mmx -mno-sse -fshort-wchar \
++ -Wno-pointer-sign \
++ $(call cc-disable-warning, address-of-packed-member) \
++ $(call cc-disable-warning, gnu)
+
+ # arm64 uses the full KBUILD_CFLAGS so it's necessary to explicitly
+ # disable the stackleak plugin
+diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
+index 7fa793672a7a..68e4b2b98c8f 100644
+--- a/drivers/fpga/altera-cvp.c
++++ b/drivers/fpga/altera-cvp.c
+@@ -468,14 +468,6 @@ static int altera_cvp_probe(struct pci_dev *pdev,
+ goto err_unmap;
+ }
+
+- ret = driver_create_file(&altera_cvp_driver.driver,
+- &driver_attr_chkcfg);
+- if (ret) {
+- dev_err(&pdev->dev, "Can't create sysfs chkcfg file\n");
+- fpga_mgr_unregister(mgr);
+- goto err_unmap;
+- }
+-
+ return 0;
+
+ err_unmap:
+@@ -493,7 +485,6 @@ static void altera_cvp_remove(struct pci_dev *pdev)
+ struct altera_cvp_conf *conf = mgr->priv;
+ u16 cmd;
+
+- driver_remove_file(&altera_cvp_driver.driver, &driver_attr_chkcfg);
+ fpga_mgr_unregister(mgr);
+ pci_iounmap(pdev, conf->map);
+ pci_release_region(pdev, CVP_BAR);
+@@ -502,7 +493,30 @@ static void altera_cvp_remove(struct pci_dev *pdev)
+ pci_write_config_word(pdev, PCI_COMMAND, cmd);
+ }
+
+-module_pci_driver(altera_cvp_driver);
++static int __init altera_cvp_init(void)
++{
++ int ret;
++
++ ret = pci_register_driver(&altera_cvp_driver);
++ if (ret)
++ return ret;
++
++ ret = driver_create_file(&altera_cvp_driver.driver,
++ &driver_attr_chkcfg);
++ if (ret)
++ pr_warn("Can't create sysfs chkcfg file\n");
++
++ return 0;
++}
++
++static void __exit altera_cvp_exit(void)
++{
++ driver_remove_file(&altera_cvp_driver.driver, &driver_attr_chkcfg);
++ pci_unregister_driver(&altera_cvp_driver);
++}
++
++module_init(altera_cvp_init);
++module_exit(altera_cvp_exit);
+
+ MODULE_LICENSE("GPL v2");
+ MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
+diff --git a/drivers/gpio/gpio-pl061.c b/drivers/gpio/gpio-pl061.c
+index 2afd9de84a0d..dc42571e6fdc 100644
+--- a/drivers/gpio/gpio-pl061.c
++++ b/drivers/gpio/gpio-pl061.c
+@@ -54,6 +54,7 @@ struct pl061 {
+
+ void __iomem *base;
+ struct gpio_chip gc;
++ struct irq_chip irq_chip;
+ int parent_irq;
+
+ #ifdef CONFIG_PM
+@@ -281,15 +282,6 @@ static int pl061_irq_set_wake(struct irq_data *d, unsigned int state)
+ return irq_set_irq_wake(pl061->parent_irq, state);
+ }
+
+-static struct irq_chip pl061_irqchip = {
+- .name = "pl061",
+- .irq_ack = pl061_irq_ack,
+- .irq_mask = pl061_irq_mask,
+- .irq_unmask = pl061_irq_unmask,
+- .irq_set_type = pl061_irq_type,
+- .irq_set_wake = pl061_irq_set_wake,
+-};
+-
+ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
+ {
+ struct device *dev = &adev->dev;
+@@ -328,6 +320,13 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
+ /*
+ * irq_chip support
+ */
++ pl061->irq_chip.name = dev_name(dev);
++ pl061->irq_chip.irq_ack = pl061_irq_ack;
++ pl061->irq_chip.irq_mask = pl061_irq_mask;
++ pl061->irq_chip.irq_unmask = pl061_irq_unmask;
++ pl061->irq_chip.irq_set_type = pl061_irq_type;
++ pl061->irq_chip.irq_set_wake = pl061_irq_set_wake;
++
+ writeb(0, pl061->base + GPIOIE); /* disable irqs */
+ irq = adev->irq[0];
+ if (irq < 0) {
+@@ -336,14 +335,14 @@ static int pl061_probe(struct amba_device *adev, const struct amba_id *id)
+ }
+ pl061->parent_irq = irq;
+
+- ret = gpiochip_irqchip_add(&pl061->gc, &pl061_irqchip,
++ ret = gpiochip_irqchip_add(&pl061->gc, &pl061->irq_chip,
+ 0, handle_bad_irq,
+ IRQ_TYPE_NONE);
+ if (ret) {
+ dev_info(&adev->dev, "could not add irqchip\n");
+ return ret;
+ }
+- gpiochip_set_chained_irqchip(&pl061->gc, &pl061_irqchip,
++ gpiochip_set_chained_irqchip(&pl061->gc, &pl061->irq_chip,
+ irq, pl061_irq_handler);
+
+ amba_set_drvdata(adev, pl061);
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
+index 8a926d1df939..2b4199adcd94 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
+@@ -116,16 +116,16 @@ static int uvd_v4_2_sw_init(void *handle)
+ if (r)
+ return r;
+
+- r = amdgpu_uvd_resume(adev);
+- if (r)
+- return r;
+-
+ ring = &adev->uvd.inst->ring;
+ sprintf(ring->name, "uvd");
+ r = amdgpu_ring_init(adev, ring, 512, &adev->uvd.inst->irq, 0);
+ if (r)
+ return r;
+
++ r = amdgpu_uvd_resume(adev);
++ if (r)
++ return r;
++
+ r = amdgpu_uvd_entity_init(adev);
+
+ return r;
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
+index 50248059412e..88c006c5ee2c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
+@@ -113,16 +113,16 @@ static int uvd_v5_0_sw_init(void *handle)
+ if (r)
+ return r;
+
+- r = amdgpu_uvd_resume(adev);
+- if (r)
+- return r;
+-
+ ring = &adev->uvd.inst->ring;
+ sprintf(ring->name, "uvd");
+ r = amdgpu_ring_init(adev, ring, 512, &adev->uvd.inst->irq, 0);
+ if (r)
+ return r;
+
++ r = amdgpu_uvd_resume(adev);
++ if (r)
++ return r;
++
+ r = amdgpu_uvd_entity_init(adev);
+
+ return r;
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+index 6ae82cc2e55e..d4070839ac80 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+@@ -420,16 +420,16 @@ static int uvd_v6_0_sw_init(void *handle)
+ DRM_INFO("UVD ENC is disabled\n");
+ }
+
+- r = amdgpu_uvd_resume(adev);
+- if (r)
+- return r;
+-
+ ring = &adev->uvd.inst->ring;
+ sprintf(ring->name, "uvd");
+ r = amdgpu_ring_init(adev, ring, 512, &adev->uvd.inst->irq, 0);
+ if (r)
+ return r;
+
++ r = amdgpu_uvd_resume(adev);
++ if (r)
++ return r;
++
+ if (uvd_v6_0_enc_support(adev)) {
+ for (i = 0; i < adev->uvd.num_enc_rings; ++i) {
+ ring = &adev->uvd.inst->ring_enc[i];
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
+index 9b7f8469bc5c..057151b17b45 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
+@@ -444,10 +444,6 @@ static int uvd_v7_0_sw_init(void *handle)
+ DRM_INFO("PSP loading UVD firmware\n");
+ }
+
+- r = amdgpu_uvd_resume(adev);
+- if (r)
+- return r;
+-
+ for (j = 0; j < adev->uvd.num_uvd_inst; j++) {
+ if (adev->uvd.harvest_config & (1 << j))
+ continue;
+@@ -479,6 +475,10 @@ static int uvd_v7_0_sw_init(void *handle)
+ }
+ }
+
++ r = amdgpu_uvd_resume(adev);
++ if (r)
++ return r;
++
+ r = amdgpu_uvd_entity_init(adev);
+ if (r)
+ return r;
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 1427675d0e5a..5aba50f63ac6 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -661,6 +661,7 @@ void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry)
+ {
+ uint32_t patched_ihre[KFD_MAX_RING_ENTRY_SIZE];
+ bool is_patched = false;
++ unsigned long flags;
+
+ if (!kfd->init_complete)
+ return;
+@@ -670,7 +671,7 @@ void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry)
+ return;
+ }
+
+- spin_lock(&kfd->interrupt_lock);
++ spin_lock_irqsave(&kfd->interrupt_lock, flags);
+
+ if (kfd->interrupts_active
+ && interrupt_is_wanted(kfd, ih_ring_entry,
+@@ -679,7 +680,7 @@ void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry)
+ is_patched ? patched_ihre : ih_ring_entry))
+ queue_work(kfd->ih_wq, &kfd->interrupt_work);
+
+- spin_unlock(&kfd->interrupt_lock);
++ spin_unlock_irqrestore(&kfd->interrupt_lock, flags);
+ }
+
+ int kgd2kfd_quiesce_mm(struct mm_struct *mm)
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
+index 9bfb040352e9..6a6d977ddd7a 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
+@@ -60,6 +60,11 @@ int amdgpu_dm_crtc_set_crc_source(struct drm_crtc *crtc, const char *src_name,
+ return -EINVAL;
+ }
+
++ if (!stream_state) {
++ DRM_ERROR("No stream state for CRTC%d\n", crtc->index);
++ return -EINVAL;
++ }
++
+ /* When enabling CRC, we should also disable dithering. */
+ if (source == AMDGPU_DM_PIPE_CRC_SOURCE_AUTO) {
+ if (dc_stream_configure_crc(stream_state->ctx->dc,
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index 1bb4c318bdd4..f77bff5aa307 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -1425,6 +1425,9 @@ void drm_atomic_helper_wait_for_flip_done(struct drm_device *dev,
+ DRM_ERROR("[CRTC:%d:%s] flip_done timed out\n",
+ crtc->base.id, crtc->name);
+ }
++
++ if (old_state->fake_commit)
++ complete_all(&old_state->fake_commit->flip_done);
+ }
+ EXPORT_SYMBOL(drm_atomic_helper_wait_for_flip_done);
+
+diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+index 9973ac893635..3db232429630 100644
+--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+@@ -334,13 +334,16 @@ int usnic_ib_query_port(struct ib_device *ibdev, u8 port,
+
+ usnic_dbg("\n");
+
+- mutex_lock(&us_ibdev->usdev_lock);
+ if (ib_get_eth_speed(ibdev, port, &props->active_speed,
+- &props->active_width)) {
+- mutex_unlock(&us_ibdev->usdev_lock);
++ &props->active_width))
+ return -EINVAL;
+- }
+
++ /*
++ * usdev_lock is acquired after (and not before) ib_get_eth_speed call
++ * because acquiring rtnl_lock in ib_get_eth_speed, while holding
++ * usdev_lock could lead to a deadlock.
++ */
++ mutex_lock(&us_ibdev->usdev_lock);
+ /* props being zeroed by the caller, avoid zeroing it here */
+
+ props->lid = 0;
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 8be27238a86e..fa98a5279647 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -640,6 +640,7 @@ next_wqe:
+ rmr->access = wqe->wr.wr.reg.access;
+ rmr->lkey = wqe->wr.wr.reg.key;
+ rmr->rkey = wqe->wr.wr.reg.key;
++ rmr->iova = wqe->wr.wr.reg.mr->iova;
+ wqe->state = wqe_state_done;
+ wqe->status = IB_WC_SUCCESS;
+ } else {
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 0481223b1deb..f2ec882f96be 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -49,7 +49,7 @@ struct convert_context {
+ struct bio *bio_out;
+ struct bvec_iter iter_in;
+ struct bvec_iter iter_out;
+- sector_t cc_sector;
++ u64 cc_sector;
+ atomic_t cc_pending;
+ union {
+ struct skcipher_request *req;
+@@ -81,7 +81,7 @@ struct dm_crypt_request {
+ struct convert_context *ctx;
+ struct scatterlist sg_in[4];
+ struct scatterlist sg_out[4];
+- sector_t iv_sector;
++ u64 iv_sector;
+ };
+
+ struct crypt_config;
+@@ -160,7 +160,7 @@ struct crypt_config {
+ struct iv_lmk_private lmk;
+ struct iv_tcw_private tcw;
+ } iv_gen_private;
+- sector_t iv_offset;
++ u64 iv_offset;
+ unsigned int iv_size;
+ unsigned short int sector_size;
+ unsigned char sector_shift;
+@@ -2780,7 +2780,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ }
+
+ ret = -EINVAL;
+- if (sscanf(argv[4], "%llu%c", &tmpll, &dummy) != 1) {
++ if (sscanf(argv[4], "%llu%c", &tmpll, &dummy) != 1 || tmpll != (sector_t)tmpll) {
+ ti->error = "Invalid device sector";
+ goto bad;
+ }
+diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
+index 2fb7bb4304ad..fddffe251bf6 100644
+--- a/drivers/md/dm-delay.c
++++ b/drivers/md/dm-delay.c
+@@ -141,7 +141,7 @@ static int delay_class_ctr(struct dm_target *ti, struct delay_class *c, char **a
+ unsigned long long tmpll;
+ char dummy;
+
+- if (sscanf(argv[1], "%llu%c", &tmpll, &dummy) != 1) {
++ if (sscanf(argv[1], "%llu%c", &tmpll, &dummy) != 1 || tmpll != (sector_t)tmpll) {
+ ti->error = "Invalid device sector";
+ return -EINVAL;
+ }
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index 32aabe27b37c..b86d2439ffc7 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -213,7 +213,7 @@ static int flakey_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ devname = dm_shift_arg(&as);
+
+ r = -EINVAL;
+- if (sscanf(dm_shift_arg(&as), "%llu%c", &tmpll, &dummy) != 1) {
++ if (sscanf(dm_shift_arg(&as), "%llu%c", &tmpll, &dummy) != 1 || tmpll != (sector_t)tmpll) {
+ ti->error = "Invalid device sector";
+ goto bad;
+ }
+diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
+index 2fc4213e02b5..671c24332802 100644
+--- a/drivers/md/dm-kcopyd.c
++++ b/drivers/md/dm-kcopyd.c
+@@ -56,15 +56,17 @@ struct dm_kcopyd_client {
+ atomic_t nr_jobs;
+
+ /*
+- * We maintain three lists of jobs:
++ * We maintain four lists of jobs:
+ *
+ * i) jobs waiting for pages
+ * ii) jobs that have pages, and are waiting for the io to be issued.
+- * iii) jobs that have completed.
++ * iii) jobs that don't need to do any IO and just run a callback
++ * iv) jobs that have completed.
+ *
+- * All three of these are protected by job_lock.
++ * All four of these are protected by job_lock.
+ */
+ spinlock_t job_lock;
++ struct list_head callback_jobs;
+ struct list_head complete_jobs;
+ struct list_head io_jobs;
+ struct list_head pages_jobs;
+@@ -625,6 +627,7 @@ static void do_work(struct work_struct *work)
+ struct dm_kcopyd_client *kc = container_of(work,
+ struct dm_kcopyd_client, kcopyd_work);
+ struct blk_plug plug;
++ unsigned long flags;
+
+ /*
+ * The order that these are called is *very* important.
+@@ -633,6 +636,10 @@ static void do_work(struct work_struct *work)
+ * list. io jobs call wake when they complete and it all
+ * starts again.
+ */
++ spin_lock_irqsave(&kc->job_lock, flags);
++ list_splice_tail_init(&kc->callback_jobs, &kc->complete_jobs);
++ spin_unlock_irqrestore(&kc->job_lock, flags);
++
+ blk_start_plug(&plug);
+ process_jobs(&kc->complete_jobs, kc, run_complete_job);
+ process_jobs(&kc->pages_jobs, kc, run_pages_job);
+@@ -650,7 +657,7 @@ static void dispatch_job(struct kcopyd_job *job)
+ struct dm_kcopyd_client *kc = job->kc;
+ atomic_inc(&kc->nr_jobs);
+ if (unlikely(!job->source.count))
+- push(&kc->complete_jobs, job);
++ push(&kc->callback_jobs, job);
+ else if (job->pages == &zero_page_list)
+ push(&kc->io_jobs, job);
+ else
+@@ -858,7 +865,7 @@ void dm_kcopyd_do_callback(void *j, int read_err, unsigned long write_err)
+ job->read_err = read_err;
+ job->write_err = write_err;
+
+- push(&kc->complete_jobs, job);
++ push(&kc->callback_jobs, job);
+ wake(kc);
+ }
+ EXPORT_SYMBOL(dm_kcopyd_do_callback);
+@@ -888,6 +895,7 @@ struct dm_kcopyd_client *dm_kcopyd_client_create(struct dm_kcopyd_throttle *thro
+ return ERR_PTR(-ENOMEM);
+
+ spin_lock_init(&kc->job_lock);
++ INIT_LIST_HEAD(&kc->callback_jobs);
+ INIT_LIST_HEAD(&kc->complete_jobs);
+ INIT_LIST_HEAD(&kc->io_jobs);
+ INIT_LIST_HEAD(&kc->pages_jobs);
+@@ -939,6 +947,7 @@ void dm_kcopyd_client_destroy(struct dm_kcopyd_client *kc)
+ /* Wait for completion of all jobs submitted by this client. */
+ wait_event(kc->destroyq, !atomic_read(&kc->nr_jobs));
+
++ BUG_ON(!list_empty(&kc->callback_jobs));
+ BUG_ON(!list_empty(&kc->complete_jobs));
+ BUG_ON(!list_empty(&kc->io_jobs));
+ BUG_ON(!list_empty(&kc->pages_jobs));
+diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c
+index 2f7c44a006c4..caa08c4b84cd 100644
+--- a/drivers/md/dm-linear.c
++++ b/drivers/md/dm-linear.c
+@@ -45,7 +45,7 @@ static int linear_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ }
+
+ ret = -EINVAL;
+- if (sscanf(argv[1], "%llu%c", &tmp, &dummy) != 1) {
++ if (sscanf(argv[1], "%llu%c", &tmp, &dummy) != 1 || tmp != (sector_t)tmp) {
+ ti->error = "Invalid device sector";
+ goto bad;
+ }
+diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
+index 79eab1071ec2..5a51151f680d 100644
+--- a/drivers/md/dm-raid1.c
++++ b/drivers/md/dm-raid1.c
+@@ -943,7 +943,8 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
+ char dummy;
+ int ret;
+
+- if (sscanf(argv[1], "%llu%c", &offset, &dummy) != 1) {
++ if (sscanf(argv[1], "%llu%c", &offset, &dummy) != 1 ||
++ offset != (sector_t)offset) {
+ ti->error = "Invalid offset";
+ return -EINVAL;
+ }
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index ae4b33d10924..36805b12661e 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -19,6 +19,7 @@
+ #include <linux/vmalloc.h>
+ #include <linux/log2.h>
+ #include <linux/dm-kcopyd.h>
++#include <linux/semaphore.h>
+
+ #include "dm.h"
+
+@@ -105,6 +106,9 @@ struct dm_snapshot {
+ /* The on disk metadata handler */
+ struct dm_exception_store *store;
+
++ /* Maximum number of in-flight COW jobs. */
++ struct semaphore cow_count;
++
+ struct dm_kcopyd_client *kcopyd_client;
+
+ /* Wait for events based on state_bits */
+@@ -145,6 +149,19 @@ struct dm_snapshot {
+ #define RUNNING_MERGE 0
+ #define SHUTDOWN_MERGE 1
+
++/*
++ * Maximum number of chunks being copied on write.
++ *
++ * The value was decided experimentally as a trade-off between memory
++ * consumption, stalling the kernel's workqueues and maintaining a high enough
++ * throughput.
++ */
++#define DEFAULT_COW_THRESHOLD 2048
++
++static int cow_threshold = DEFAULT_COW_THRESHOLD;
++module_param_named(snapshot_cow_threshold, cow_threshold, int, 0644);
++MODULE_PARM_DESC(snapshot_cow_threshold, "Maximum number of chunks being copied on write");
++
+ DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle,
+ "A percentage of time allocated for copy on write");
+
+@@ -1190,6 +1207,8 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ goto bad_hash_tables;
+ }
+
++ sema_init(&s->cow_count, (cow_threshold > 0) ? cow_threshold : INT_MAX);
++
+ s->kcopyd_client = dm_kcopyd_client_create(&dm_kcopyd_throttle);
+ if (IS_ERR(s->kcopyd_client)) {
+ r = PTR_ERR(s->kcopyd_client);
+@@ -1575,6 +1594,7 @@ static void copy_callback(int read_err, unsigned long write_err, void *context)
+ rb_link_node(&pe->out_of_order_node, parent, p);
+ rb_insert_color(&pe->out_of_order_node, &s->out_of_order_tree);
+ }
++ up(&s->cow_count);
+ }
+
+ /*
+@@ -1598,6 +1618,7 @@ static void start_copy(struct dm_snap_pending_exception *pe)
+ dest.count = src.count;
+
+ /* Hand over to kcopyd */
++ down(&s->cow_count);
+ dm_kcopyd_copy(s->kcopyd_client, &src, 1, &dest, 0, copy_callback, pe);
+ }
+
+@@ -1617,6 +1638,7 @@ static void start_full_bio(struct dm_snap_pending_exception *pe,
+ pe->full_bio = bio;
+ pe->full_bio_end_io = bio->bi_end_io;
+
++ down(&s->cow_count);
+ callback_data = dm_kcopyd_prepare_callback(s->kcopyd_client,
+ copy_callback, pe);
+
+diff --git a/drivers/md/dm-unstripe.c b/drivers/md/dm-unstripe.c
+index 954b7ab4e684..e673dacf6418 100644
+--- a/drivers/md/dm-unstripe.c
++++ b/drivers/md/dm-unstripe.c
+@@ -78,7 +78,7 @@ static int unstripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ goto err;
+ }
+
+- if (sscanf(argv[4], "%llu%c", &start, &dummy) != 1) {
++ if (sscanf(argv[4], "%llu%c", &start, &dummy) != 1 || start != (sector_t)start) {
+ ti->error = "Invalid striped device offset";
+ goto err;
+ }
+diff --git a/drivers/media/firewire/firedtv-avc.c b/drivers/media/firewire/firedtv-avc.c
+index 1c933b2cf760..3ef5df1648d7 100644
+--- a/drivers/media/firewire/firedtv-avc.c
++++ b/drivers/media/firewire/firedtv-avc.c
+@@ -968,7 +968,8 @@ static int get_ca_object_length(struct avc_response_frame *r)
+ return r->operand[7];
+ }
+
+-int avc_ca_app_info(struct firedtv *fdtv, char *app_info, unsigned int *len)
++int avc_ca_app_info(struct firedtv *fdtv, unsigned char *app_info,
++ unsigned int *len)
+ {
+ struct avc_command_frame *c = (void *)fdtv->avc_data;
+ struct avc_response_frame *r = (void *)fdtv->avc_data;
+@@ -1009,7 +1010,8 @@ out:
+ return ret;
+ }
+
+-int avc_ca_info(struct firedtv *fdtv, char *app_info, unsigned int *len)
++int avc_ca_info(struct firedtv *fdtv, unsigned char *app_info,
++ unsigned int *len)
+ {
+ struct avc_command_frame *c = (void *)fdtv->avc_data;
+ struct avc_response_frame *r = (void *)fdtv->avc_data;
+diff --git a/drivers/media/firewire/firedtv.h b/drivers/media/firewire/firedtv.h
+index 876cdec8329b..009905a19947 100644
+--- a/drivers/media/firewire/firedtv.h
++++ b/drivers/media/firewire/firedtv.h
+@@ -124,8 +124,10 @@ int avc_lnb_control(struct firedtv *fdtv, char voltage, char burst,
+ struct dvb_diseqc_master_cmd *diseqcmd);
+ void avc_remote_ctrl_work(struct work_struct *work);
+ int avc_register_remote_control(struct firedtv *fdtv);
+-int avc_ca_app_info(struct firedtv *fdtv, char *app_info, unsigned int *len);
+-int avc_ca_info(struct firedtv *fdtv, char *app_info, unsigned int *len);
++int avc_ca_app_info(struct firedtv *fdtv, unsigned char *app_info,
++ unsigned int *len);
++int avc_ca_info(struct firedtv *fdtv, unsigned char *app_info,
++ unsigned int *len);
+ int avc_ca_reset(struct firedtv *fdtv);
+ int avc_ca_pmt(struct firedtv *fdtv, char *app_info, int length);
+ int avc_ca_get_time_date(struct firedtv *fdtv, int *interval);
+diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
+index bb6add9d340e..5b8350e87e75 100644
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -264,6 +264,14 @@ static int venus_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
++ if (!dev->dma_parms) {
++ dev->dma_parms = devm_kzalloc(dev, sizeof(*dev->dma_parms),
++ GFP_KERNEL);
++ if (!dev->dma_parms)
++ return -ENOMEM;
++ }
++ dma_set_max_seg_size(dev, DMA_BIT_MASK(32));
++
+ INIT_LIST_HEAD(&core->instances);
+ mutex_init(&core->lock);
+ INIT_DELAYED_WORK(&core->work, venus_sys_error_handler);
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index d46dc432456c..361abbc00486 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -1824,11 +1824,7 @@ static void uvc_delete(struct kref *kref)
+ usb_put_intf(dev->intf);
+ usb_put_dev(dev->udev);
+
+- if (dev->vdev.dev)
+- v4l2_device_unregister(&dev->vdev);
+ #ifdef CONFIG_MEDIA_CONTROLLER
+- if (media_devnode_is_registered(dev->mdev.devnode))
+- media_device_unregister(&dev->mdev);
+ media_device_cleanup(&dev->mdev);
+ #endif
+
+@@ -1885,6 +1881,15 @@ static void uvc_unregister_video(struct uvc_device *dev)
+
+ uvc_debugfs_cleanup_stream(stream);
+ }
++
++ uvc_status_unregister(dev);
++
++ if (dev->vdev.dev)
++ v4l2_device_unregister(&dev->vdev);
++#ifdef CONFIG_MEDIA_CONTROLLER
++ if (media_devnode_is_registered(dev->mdev.devnode))
++ media_device_unregister(&dev->mdev);
++#endif
+ }
+
+ int uvc_register_video_device(struct uvc_device *dev,
+diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c
+index 0722dc684378..883e4cab45e7 100644
+--- a/drivers/media/usb/uvc/uvc_status.c
++++ b/drivers/media/usb/uvc/uvc_status.c
+@@ -54,7 +54,7 @@ error:
+ return ret;
+ }
+
+-static void uvc_input_cleanup(struct uvc_device *dev)
++static void uvc_input_unregister(struct uvc_device *dev)
+ {
+ if (dev->input)
+ input_unregister_device(dev->input);
+@@ -71,7 +71,7 @@ static void uvc_input_report_key(struct uvc_device *dev, unsigned int code,
+
+ #else
+ #define uvc_input_init(dev)
+-#define uvc_input_cleanup(dev)
++#define uvc_input_unregister(dev)
+ #define uvc_input_report_key(dev, code, value)
+ #endif /* CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV */
+
+@@ -292,12 +292,16 @@ int uvc_status_init(struct uvc_device *dev)
+ return 0;
+ }
+
+-void uvc_status_cleanup(struct uvc_device *dev)
++void uvc_status_unregister(struct uvc_device *dev)
+ {
+ usb_kill_urb(dev->int_urb);
++ uvc_input_unregister(dev);
++}
++
++void uvc_status_cleanup(struct uvc_device *dev)
++{
+ usb_free_urb(dev->int_urb);
+ kfree(dev->status);
+- uvc_input_cleanup(dev);
+ }
+
+ int uvc_status_start(struct uvc_device *dev, gfp_t flags)
+diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
+index e5f5d84f1d1d..a738486fd9d6 100644
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -750,6 +750,7 @@ int uvc_register_video_device(struct uvc_device *dev,
+
+ /* Status */
+ int uvc_status_init(struct uvc_device *dev);
++void uvc_status_unregister(struct uvc_device *dev);
+ void uvc_status_cleanup(struct uvc_device *dev);
+ int uvc_status_start(struct uvc_device *dev, gfp_t flags);
+ void uvc_status_stop(struct uvc_device *dev);
+diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
+index be53044086c7..fbc56ee99682 100644
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -1954,13 +1954,14 @@ static void atmci_tasklet_func(unsigned long priv)
+ }
+
+ atmci_request_end(host, host->mrq);
+- state = STATE_IDLE;
++ goto unlock; /* atmci_request_end() sets host->state */
+ break;
+ }
+ } while (state != prev_state);
+
+ host->state = state;
+
++unlock:
+ spin_unlock(&host->lock);
+ }
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 8da3d39e3218..258918d8a416 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2391,6 +2391,107 @@ static int mv88e6xxx_stats_setup(struct mv88e6xxx_chip *chip)
+ return mv88e6xxx_g1_stats_clear(chip);
+ }
+
++/* The mv88e6390 has some hidden registers used for debug and
++ * development. The errata also makes use of them.
++ */
++static int mv88e6390_hidden_write(struct mv88e6xxx_chip *chip, int port,
++ int reg, u16 val)
++{
++ u16 ctrl;
++ int err;
++
++ err = mv88e6xxx_port_write(chip, PORT_RESERVED_1A_DATA_PORT,
++ PORT_RESERVED_1A, val);
++ if (err)
++ return err;
++
++ ctrl = PORT_RESERVED_1A_BUSY | PORT_RESERVED_1A_WRITE |
++ PORT_RESERVED_1A_BLOCK | port << PORT_RESERVED_1A_PORT_SHIFT |
++ reg;
++
++ return mv88e6xxx_port_write(chip, PORT_RESERVED_1A_CTRL_PORT,
++ PORT_RESERVED_1A, ctrl);
++}
++
++static int mv88e6390_hidden_wait(struct mv88e6xxx_chip *chip)
++{
++ return mv88e6xxx_wait(chip, PORT_RESERVED_1A_CTRL_PORT,
++ PORT_RESERVED_1A, PORT_RESERVED_1A_BUSY);
++}
++
++
++static int mv88e6390_hidden_read(struct mv88e6xxx_chip *chip, int port,
++ int reg, u16 *val)
++{
++ u16 ctrl;
++ int err;
++
++ ctrl = PORT_RESERVED_1A_BUSY | PORT_RESERVED_1A_READ |
++ PORT_RESERVED_1A_BLOCK | port << PORT_RESERVED_1A_PORT_SHIFT |
++ reg;
++
++ err = mv88e6xxx_port_write(chip, PORT_RESERVED_1A_CTRL_PORT,
++ PORT_RESERVED_1A, ctrl);
++ if (err)
++ return err;
++
++ err = mv88e6390_hidden_wait(chip);
++ if (err)
++ return err;
++
++ return mv88e6xxx_port_read(chip, PORT_RESERVED_1A_DATA_PORT,
++ PORT_RESERVED_1A, val);
++}
++
++/* Check if the errata has already been applied. */
++static bool mv88e6390_setup_errata_applied(struct mv88e6xxx_chip *chip)
++{
++ int port;
++ int err;
++ u16 val;
++
++ for (port = 0; port < mv88e6xxx_num_ports(chip); port++) {
++ err = mv88e6390_hidden_read(chip, port, 0, &val);
++ if (err) {
++ dev_err(chip->dev,
++ "Error reading hidden register: %d\n", err);
++ return false;
++ }
++ if (val != 0x01c0)
++ return false;
++ }
++
++ return true;
++}
++
++/* The 6390 copper ports have an errata which require poking magic
++ * values into undocumented hidden registers and then performing a
++ * software reset.
++ */
++static int mv88e6390_setup_errata(struct mv88e6xxx_chip *chip)
++{
++ int port;
++ int err;
++
++ if (mv88e6390_setup_errata_applied(chip))
++ return 0;
++
++ /* Set the ports into blocking mode */
++ for (port = 0; port < mv88e6xxx_num_ports(chip); port++) {
++ err = mv88e6xxx_port_set_state(chip, port, BR_STATE_DISABLED);
++ if (err)
++ return err;
++ }
++
++ for (port = 0; port < mv88e6xxx_num_ports(chip); port++) {
++ err = mv88e6390_hidden_write(chip, port, 0, 0x01c0);
++ if (err)
++ return err;
++ }
++
++ return mv88e6xxx_software_reset(chip);
++}
++
+ static int mv88e6xxx_setup(struct dsa_switch *ds)
+ {
+ struct mv88e6xxx_chip *chip = ds->priv;
+@@ -2403,6 +2504,12 @@ static int mv88e6xxx_setup(struct dsa_switch *ds)
+
+ mutex_lock(&chip->reg_lock);
+
++ if (chip->info->ops->setup_errata) {
++ err = chip->info->ops->setup_errata(chip);
++ if (err)
++ goto unlock;
++ }
++
+ /* Cache the cmode of each port. */
+ for (i = 0; i < mv88e6xxx_num_ports(chip); i++) {
+ if (chip->info->ops->port_get_cmode) {
+@@ -3201,6 +3308,7 @@ static const struct mv88e6xxx_ops mv88e6185_ops = {
+
+ static const struct mv88e6xxx_ops mv88e6190_ops = {
+ /* MV88E6XXX_FAMILY_6390 */
++ .setup_errata = mv88e6390_setup_errata,
+ .irl_init_all = mv88e6390_g2_irl_init_all,
+ .get_eeprom = mv88e6xxx_g2_get_eeprom8,
+ .set_eeprom = mv88e6xxx_g2_set_eeprom8,
+@@ -3243,6 +3351,7 @@ static const struct mv88e6xxx_ops mv88e6190_ops = {
+
+ static const struct mv88e6xxx_ops mv88e6190x_ops = {
+ /* MV88E6XXX_FAMILY_6390 */
++ .setup_errata = mv88e6390_setup_errata,
+ .irl_init_all = mv88e6390_g2_irl_init_all,
+ .get_eeprom = mv88e6xxx_g2_get_eeprom8,
+ .set_eeprom = mv88e6xxx_g2_set_eeprom8,
+@@ -3285,6 +3394,7 @@ static const struct mv88e6xxx_ops mv88e6190x_ops = {
+
+ static const struct mv88e6xxx_ops mv88e6191_ops = {
+ /* MV88E6XXX_FAMILY_6390 */
++ .setup_errata = mv88e6390_setup_errata,
+ .irl_init_all = mv88e6390_g2_irl_init_all,
+ .get_eeprom = mv88e6xxx_g2_get_eeprom8,
+ .set_eeprom = mv88e6xxx_g2_set_eeprom8,
+@@ -3374,6 +3484,7 @@ static const struct mv88e6xxx_ops mv88e6240_ops = {
+
+ static const struct mv88e6xxx_ops mv88e6290_ops = {
+ /* MV88E6XXX_FAMILY_6390 */
++ .setup_errata = mv88e6390_setup_errata,
+ .irl_init_all = mv88e6390_g2_irl_init_all,
+ .get_eeprom = mv88e6xxx_g2_get_eeprom8,
+ .set_eeprom = mv88e6xxx_g2_set_eeprom8,
+@@ -3675,6 +3786,7 @@ static const struct mv88e6xxx_ops mv88e6352_ops = {
+
+ static const struct mv88e6xxx_ops mv88e6390_ops = {
+ /* MV88E6XXX_FAMILY_6390 */
++ .setup_errata = mv88e6390_setup_errata,
+ .irl_init_all = mv88e6390_g2_irl_init_all,
+ .get_eeprom = mv88e6xxx_g2_get_eeprom8,
+ .set_eeprom = mv88e6xxx_g2_set_eeprom8,
+@@ -3722,6 +3834,7 @@ static const struct mv88e6xxx_ops mv88e6390_ops = {
+
+ static const struct mv88e6xxx_ops mv88e6390x_ops = {
+ /* MV88E6XXX_FAMILY_6390 */
++ .setup_errata = mv88e6390_setup_errata,
+ .irl_init_all = mv88e6390_g2_irl_init_all,
+ .get_eeprom = mv88e6xxx_g2_get_eeprom8,
+ .set_eeprom = mv88e6xxx_g2_set_eeprom8,
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h
+index f9ecb7872d32..546651d8c3e1 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.h
++++ b/drivers/net/dsa/mv88e6xxx/chip.h
+@@ -300,6 +300,11 @@ struct mv88e6xxx_mdio_bus {
+ };
+
+ struct mv88e6xxx_ops {
++ /* Switch Setup Errata, called early in the switch setup to
++ * allow any errata actions to be performed
++ */
++ int (*setup_errata)(struct mv88e6xxx_chip *chip);
++
+ int (*ieee_pri_map)(struct mv88e6xxx_chip *chip);
+ int (*ip_pri_map)(struct mv88e6xxx_chip *chip);
+
+diff --git a/drivers/net/dsa/mv88e6xxx/port.h b/drivers/net/dsa/mv88e6xxx/port.h
+index f32f56af8e35..b31910023bb6 100644
+--- a/drivers/net/dsa/mv88e6xxx/port.h
++++ b/drivers/net/dsa/mv88e6xxx/port.h
+@@ -251,6 +251,16 @@
+ /* Offset 0x19: Port IEEE Priority Remapping Registers (4-7) */
+ #define MV88E6095_PORT_IEEE_PRIO_REMAP_4567 0x19
+
++/* Offset 0x1a: Magic undocumented errata register */
++#define PORT_RESERVED_1A 0x1a
++#define PORT_RESERVED_1A_BUSY BIT(15)
++#define PORT_RESERVED_1A_WRITE BIT(14)
++#define PORT_RESERVED_1A_READ 0
++#define PORT_RESERVED_1A_PORT_SHIFT 5
++#define PORT_RESERVED_1A_BLOCK (0xf << 10)
++#define PORT_RESERVED_1A_CTRL_PORT 4
++#define PORT_RESERVED_1A_DATA_PORT 5
++
+ int mv88e6xxx_port_read(struct mv88e6xxx_chip *chip, int port, int reg,
+ u16 *val);
+ int mv88e6xxx_port_write(struct mv88e6xxx_chip *chip, int port, int reg,
+diff --git a/drivers/net/ethernet/intel/e1000e/ptp.c b/drivers/net/ethernet/intel/e1000e/ptp.c
+index 37c76945ad9b..e1f821edbc21 100644
+--- a/drivers/net/ethernet/intel/e1000e/ptp.c
++++ b/drivers/net/ethernet/intel/e1000e/ptp.c
+@@ -173,10 +173,14 @@ static int e1000e_phc_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
+ struct e1000_adapter *adapter = container_of(ptp, struct e1000_adapter,
+ ptp_clock_info);
+ unsigned long flags;
+- u64 ns;
++ u64 cycles, ns;
+
+ spin_lock_irqsave(&adapter->systim_lock, flags);
+- ns = timecounter_read(&adapter->tc);
++
++ /* Use timecounter_cyc2time() to allow non-monotonic SYSTIM readings */
++ cycles = adapter->cc.read(&adapter->cc);
++ ns = timecounter_cyc2time(&adapter->tc, cycles);
++
+ spin_unlock_irqrestore(&adapter->systim_lock, flags);
+
+ *ts = ns_to_timespec64(ns);
+@@ -232,9 +236,12 @@ static void e1000e_systim_overflow_work(struct work_struct *work)
+ systim_overflow_work.work);
+ struct e1000_hw *hw = &adapter->hw;
+ struct timespec64 ts;
++ u64 ns;
+
+- adapter->ptp_clock_info.gettime64(&adapter->ptp_clock_info, &ts);
++ /* Update the timecounter */
++ ns = timecounter_read(&adapter->tc);
+
++ ts = ns_to_timespec64(ns);
+ e_dbg("SYSTIM overflow check at %lld.%09lu\n",
+ (long long) ts.tv_sec, ts.tv_nsec);
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+index add124e0381d..b27f7a968820 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -4,6 +4,7 @@
+ #include "ixgbe.h"
+ #include <net/xfrm.h>
+ #include <crypto/aead.h>
++#include <linux/if_bridge.h>
+
+ /**
+ * ixgbe_ipsec_set_tx_sa - set the Tx SA registers
+@@ -676,7 +677,8 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs)
+ } else {
+ struct tx_sa tsa;
+
+- if (adapter->num_vfs)
++ if (adapter->num_vfs &&
++ adapter->bridge_mode != BRIDGE_MODE_VEPA)
+ return -EOPNOTSUPP;
+
+ /* find the first unused index */
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index 3d1159f8a53f..de821a9fdfaf 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -4635,12 +4635,15 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
+ lower_dev,
+ upper_dev);
+ } else if (netif_is_lag_master(upper_dev)) {
+- if (info->linking)
++ if (info->linking) {
+ err = mlxsw_sp_port_lag_join(mlxsw_sp_port,
+ upper_dev);
+- else
++ } else {
++ mlxsw_sp_port_lag_tx_en_set(mlxsw_sp_port,
++ false);
+ mlxsw_sp_port_lag_leave(mlxsw_sp_port,
+ upper_dev);
++ }
+ } else if (netif_is_ovs_master(upper_dev)) {
+ if (info->linking)
+ err = mlxsw_sp_port_ovs_join(mlxsw_sp_port);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index 4eb64cb0d9a1..0d9ea37c5d21 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -1761,7 +1761,7 @@ static void
+ mlxsw_sp_bridge_port_vlan_del(struct mlxsw_sp_port *mlxsw_sp_port,
+ struct mlxsw_sp_bridge_port *bridge_port, u16 vid)
+ {
+- u16 pvid = mlxsw_sp_port->pvid == vid ? 0 : vid;
++ u16 pvid = mlxsw_sp_port->pvid == vid ? 0 : mlxsw_sp_port->pvid;
+ struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan;
+
+ mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_vid(mlxsw_sp_port, vid);
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 07f3080eca18..5f45ffeeecb4 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -214,6 +214,8 @@ enum cfg_version {
+ };
+
+ static const struct pci_device_id rtl8169_pci_tbl[] = {
++ { PCI_VDEVICE(REALTEK, 0x2502), RTL_CFG_1 },
++ { PCI_VDEVICE(REALTEK, 0x2600), RTL_CFG_1 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8129), 0, 0, RTL_CFG_0 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8136), 0, 0, RTL_CFG_2 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8161), 0, 0, RTL_CFG_1 },
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 774e1ff01c9a..735ad838e2ba 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -123,6 +123,7 @@ static void qmimux_setup(struct net_device *dev)
+ dev->addr_len = 0;
+ dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
+ dev->netdev_ops = &qmimux_netdev_ops;
++ dev->mtu = 1500;
+ dev->needs_free_netdev = true;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/debugfs_sta.c b/drivers/net/wireless/ath/ath10k/debugfs_sta.c
+index a63c97e2c50c..6f10331e986b 100644
+--- a/drivers/net/wireless/ath/ath10k/debugfs_sta.c
++++ b/drivers/net/wireless/ath/ath10k/debugfs_sta.c
+@@ -71,7 +71,7 @@ void ath10k_sta_update_rx_tid_stats_ampdu(struct ath10k *ar, u16 peer_id, u8 tid
+ spin_lock_bh(&ar->data_lock);
+
+ peer = ath10k_peer_find_by_id(ar, peer_id);
+- if (!peer)
++ if (!peer || !peer->sta)
+ goto out;
+
+ arsta = (struct ath10k_sta *)peer->sta->drv_priv;
+diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
+index 4d1cd90d6d27..03d4cc6f35bc 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -2589,7 +2589,7 @@ static void ath10k_htt_fetch_peer_stats(struct ath10k *ar,
+ rcu_read_lock();
+ spin_lock_bh(&ar->data_lock);
+ peer = ath10k_peer_find_by_id(ar, peer_id);
+- if (!peer) {
++ if (!peer || !peer->sta) {
+ ath10k_warn(ar, "Invalid peer id %d peer stats buffer\n",
+ peer_id);
+ goto out;
+@@ -2642,7 +2642,7 @@ static void ath10k_fetch_10_2_tx_stats(struct ath10k *ar, u8 *data)
+ rcu_read_lock();
+ spin_lock_bh(&ar->data_lock);
+ peer = ath10k_peer_find_by_id(ar, peer_id);
+- if (!peer) {
++ if (!peer || !peer->sta) {
+ ath10k_warn(ar, "Invalid peer id %d in peer stats buffer\n",
+ peer_id);
+ goto out;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index afed549f5645..9a764af30f36 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -2938,7 +2938,8 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
+ iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL);
+ }
+
+- iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band);
++ iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
++ false);
+ ret = iwl_mvm_update_sta(mvm, vif, sta);
+ } else if (old_state == IEEE80211_STA_ASSOC &&
+ new_state == IEEE80211_STA_AUTHORIZED) {
+@@ -2954,7 +2955,8 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
+ /* enable beacon filtering */
+ WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
+
+- iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band);
++ iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
++ true);
+
+ ret = 0;
+ } else if (old_state == IEEE80211_STA_AUTHORIZED &&
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+index b3987a0a7018..6b65ad6c9b56 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+@@ -1685,7 +1685,7 @@ iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+ #endif /* CONFIG_IWLWIFI_DEBUGFS */
+
+ /* rate scaling */
+-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool init);
++int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool sync);
+ void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg);
+ int rs_pretty_print_rate(char *buf, int bufsz, const u32 rate);
+ void rs_update_last_rssi(struct iwl_mvm *mvm,
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+index f2830b5693d2..6b9c670fcef8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+@@ -1280,7 +1280,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ (unsigned long)(lq_sta->last_tx +
+ (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) {
+ IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
+- iwl_mvm_rs_rate_init(mvm, sta, info->band);
++ iwl_mvm_rs_rate_init(mvm, sta, info->band, true);
+ return;
+ }
+ lq_sta->last_tx = jiffies;
+@@ -2870,9 +2870,8 @@ void rs_update_last_rssi(struct iwl_mvm *mvm,
+ static void rs_initialize_lq(struct iwl_mvm *mvm,
+ struct ieee80211_sta *sta,
+ struct iwl_lq_sta *lq_sta,
+- enum nl80211_band band)
++ enum nl80211_band band, bool update)
+ {
+- struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+ struct iwl_scale_tbl_info *tbl;
+ struct rs_rate *rate;
+ u8 active_tbl = 0;
+@@ -2901,8 +2900,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm,
+ rs_set_expected_tpt_table(lq_sta, tbl);
+ rs_fill_lq_cmd(mvm, sta, lq_sta, rate);
+ /* TODO restore station should remember the lq cmd */
+- iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq,
+- mvmsta->sta_state < IEEE80211_STA_AUTHORIZED);
++ iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, !update);
+ }
+
+ static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta,
+@@ -3155,7 +3153,7 @@ void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg)
+ * Called after adding a new station to initialize rate scaling
+ */
+ static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- enum nl80211_band band)
++ enum nl80211_band band, bool update)
+ {
+ int i, j;
+ struct ieee80211_hw *hw = mvm->hw;
+@@ -3235,7 +3233,7 @@ static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+ iwl_mvm_reset_frame_stats(mvm);
+ #endif
+- rs_initialize_lq(mvm, sta, lq_sta, band);
++ rs_initialize_lq(mvm, sta, lq_sta, band, update);
+ }
+
+ static void rs_drv_rate_update(void *mvm_r,
+@@ -3255,7 +3253,7 @@ static void rs_drv_rate_update(void *mvm_r,
+ for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
+ ieee80211_stop_tx_ba_session(sta, tid);
+
+- iwl_mvm_rs_rate_init(mvm, sta, sband->band);
++ iwl_mvm_rs_rate_init(mvm, sta, sband->band, true);
+ }
+
+ #ifdef CONFIG_MAC80211_DEBUGFS
+@@ -4112,12 +4110,12 @@ static const struct rate_control_ops rs_mvm_ops_drv = {
+ };
+
+ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- enum nl80211_band band)
++ enum nl80211_band band, bool update)
+ {
+ if (iwl_mvm_has_tlc_offload(mvm))
+ rs_fw_rate_init(mvm, sta, band);
+ else
+- rs_drv_rate_init(mvm, sta, band);
++ rs_drv_rate_init(mvm, sta, band, update);
+ }
+
+ int iwl_mvm_rate_control_register(void)
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+index d2cf484e2b73..8e7f993e2911 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+@@ -420,7 +420,7 @@ struct iwl_lq_sta {
+
+ /* Initialize station's rate scaling information after adding station */
+ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- enum nl80211_band band);
++ enum nl80211_band band, bool init);
+
+ /* Notify RS about Tx status */
+ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+index b002a7afb5f5..6a5349401aa9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+@@ -900,20 +900,19 @@ int iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue, int mac80211_queue,
+
+ /**
+ * iwl_mvm_send_lq_cmd() - Send link quality command
+- * @init: This command is sent as part of station initialization right
+- * after station has been added.
++ * @sync: This command can be sent synchronously.
+ *
+ * The link quality command is sent as the last step of station creation.
+ * This is the special case in which init is set and we call a callback in
+ * this case to clear the state indicating that station creation is in
+ * progress.
+ */
+-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool init)
++int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool sync)
+ {
+ struct iwl_host_cmd cmd = {
+ .id = LQ_CMD,
+ .len = { sizeof(struct iwl_lq_cmd), },
+- .flags = init ? 0 : CMD_ASYNC,
++ .flags = sync ? 0 : CMD_ASYNC,
+ .data = { lq, },
+ };
+
+diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
+index eda57ef12fd0..baa9cee6fa2c 100644
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -378,7 +378,9 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
+ if (ret)
+ return ret;
+
+- return build_changeset_next_level(ovcs, tchild, node);
++ ret = build_changeset_next_level(ovcs, tchild, node);
++ of_node_put(tchild);
++ return ret;
+ }
+
+ if (node->phandle && tchild->phandle)
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index 2d6e272315a8..db3556dc90d1 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -2231,7 +2231,8 @@ static int asus_wmi_add(struct platform_device *pdev)
+ err = asus_wmi_backlight_init(asus);
+ if (err && err != -ENODEV)
+ goto fail_backlight;
+- }
++ } else
++ err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL);
+
+ status = wmi_install_notify_handler(asus->driver->event_guid,
+ asus_wmi_notify, asus);
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c
+index 59ecbb3b53b5..a33628550425 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fp.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
+@@ -1266,7 +1266,7 @@ void mr_update_load_balance_params(struct MR_DRV_RAID_MAP_ALL *drv_map,
+
+ for (ldCount = 0; ldCount < MAX_LOGICAL_DRIVES_EXT; ldCount++) {
+ ld = MR_TargetIdToLdGet(ldCount, drv_map);
+- if (ld >= MAX_LOGICAL_DRIVES_EXT) {
++ if (ld >= MAX_LOGICAL_DRIVES_EXT - 1) {
+ lbInfo[ldCount].loadBalanceFlag = 0;
+ continue;
+ }
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index c7f95bace353..f45c54f02bfa 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -2832,7 +2832,7 @@ static void megasas_build_ld_nonrw_fusion(struct megasas_instance *instance,
+ device_id < instance->fw_supported_vd_count)) {
+
+ ld = MR_TargetIdToLdGet(device_id, local_map_ptr);
+- if (ld >= instance->fw_supported_vd_count)
++ if (ld >= instance->fw_supported_vd_count - 1)
+ fp_possible = 0;
+ else {
+ raid = MR_LdRaidGet(ld, local_map_ptr);
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 59d7844ee022..b59bba3e6516 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -3344,8 +3344,9 @@ _base_mpi_ep_writeq(__u64 b, volatile void __iomem *addr,
+ static inline void
+ _base_writeq(__u64 b, volatile void __iomem *addr, spinlock_t *writeq_lock)
+ {
++ wmb();
+ __raw_writeq(b, addr);
+- mmiowb();
++ barrier();
+ }
+ #else
+ static inline void
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index e5bd035ebad0..4de740da547b 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -952,6 +952,9 @@ static int qedi_find_boot_info(struct qedi_ctx *qedi,
+ cls_sess = iscsi_conn_to_session(cls_conn);
+ sess = cls_sess->dd_data;
+
++ if (!iscsi_is_session_online(cls_sess))
++ continue;
++
+ if (pri_ctrl_flags) {
+ if (!strcmp(pri_tgt->iscsi_name, sess->targetname) &&
+ !strcmp(pri_tgt->ip_addr, ep_ip_addr)) {
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index 2112ea6723c6..8c1a232ac6bf 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -2720,6 +2720,9 @@ static unsigned int pqi_process_io_intr(struct pqi_ctrl_info *ctrl_info,
+ switch (response->header.iu_type) {
+ case PQI_RESPONSE_IU_RAID_PATH_IO_SUCCESS:
+ case PQI_RESPONSE_IU_AIO_PATH_IO_SUCCESS:
++ if (io_request->scmd)
++ io_request->scmd->result = 0;
++ /* fall through */
+ case PQI_RESPONSE_IU_GENERAL_MANAGEMENT:
+ break;
+ case PQI_RESPONSE_IU_TASK_MANAGEMENT:
+@@ -6686,6 +6689,7 @@ static void pqi_shutdown(struct pci_dev *pci_dev)
+ * storage.
+ */
+ rc = pqi_flush_cache(ctrl_info, SHUTDOWN);
++ pqi_free_interrupts(ctrl_info);
+ pqi_reset(ctrl_info);
+ if (rc == 0)
+ return;
+diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c
+index 14da8cc2246a..0346630b67c8 100644
+--- a/drivers/staging/erofs/unzip_vle.c
++++ b/drivers/staging/erofs/unzip_vle.c
+@@ -724,13 +724,18 @@ static void z_erofs_vle_unzip_kickoff(void *ptr, int bios)
+ struct z_erofs_vle_unzip_io *io = tagptr_unfold_ptr(t);
+ bool background = tagptr_unfold_tags(t);
+
+- if (atomic_add_return(bios, &io->pending_bios))
++ if (!background) {
++ unsigned long flags;
++
++ spin_lock_irqsave(&io->u.wait.lock, flags);
++ if (!atomic_add_return(bios, &io->pending_bios))
++ wake_up_locked(&io->u.wait);
++ spin_unlock_irqrestore(&io->u.wait.lock, flags);
+ return;
++ }
+
+- if (background)
++ if (!atomic_add_return(bios, &io->pending_bios))
+ queue_work(z_erofs_workqueue, &io->u.work);
+- else
+- wake_up(&io->u.wait);
+ }
+
+ static inline void z_erofs_vle_read_endio(struct bio *bio)
+diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
+index cb0461a10808..93424db5f002 100644
+--- a/drivers/target/target_core_spc.c
++++ b/drivers/target/target_core_spc.c
+@@ -108,12 +108,17 @@ spc_emulate_inquiry_std(struct se_cmd *cmd, unsigned char *buf)
+
+ buf[7] = 0x2; /* CmdQue=1 */
+
+- memcpy(&buf[8], "LIO-ORG ", 8);
+- memset(&buf[16], 0x20, 16);
++ /*
++ * ASCII data fields described as being left-aligned shall have any
++ * unused bytes at the end of the field (i.e., highest offset) and the
++ * unused bytes shall be filled with ASCII space characters (20h).
++ */
++ memset(&buf[8], 0x20, 8 + 16 + 4);
++ memcpy(&buf[8], "LIO-ORG", sizeof("LIO-ORG") - 1);
+ memcpy(&buf[16], dev->t10_wwn.model,
+- min_t(size_t, strlen(dev->t10_wwn.model), 16));
++ strnlen(dev->t10_wwn.model, 16));
+ memcpy(&buf[32], dev->t10_wwn.revision,
+- min_t(size_t, strlen(dev->t10_wwn.revision), 4));
++ strnlen(dev->t10_wwn.revision, 4));
+ buf[4] = 31; /* Set additional length to 31 */
+
+ return 0;
+@@ -251,7 +256,9 @@ check_t10_vend_desc:
+ buf[off] = 0x2; /* ASCII */
+ buf[off+1] = 0x1; /* T10 Vendor ID */
+ buf[off+2] = 0x0;
+- memcpy(&buf[off+4], "LIO-ORG", 8);
++ /* left align Vendor ID and pad with spaces */
++ memset(&buf[off+4], 0x20, 8);
++ memcpy(&buf[off+4], "LIO-ORG", sizeof("LIO-ORG") - 1);
+ /* Extra Byte for NULL Terminator */
+ id_len++;
+ /* Identifier Length */
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index fc3093d21b96..3f7aad45d215 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -224,19 +224,28 @@ void transport_subsystem_check_init(void)
+ sub_api_initialized = 1;
+ }
+
++static void target_release_sess_cmd_refcnt(struct percpu_ref *ref)
++{
++ struct se_session *sess = container_of(ref, typeof(*sess), cmd_count);
++
++ wake_up(&sess->cmd_list_wq);
++}
++
+ /**
+ * transport_init_session - initialize a session object
+ * @se_sess: Session object pointer.
+ *
+ * The caller must have zero-initialized @se_sess before calling this function.
+ */
+-void transport_init_session(struct se_session *se_sess)
++int transport_init_session(struct se_session *se_sess)
+ {
+ INIT_LIST_HEAD(&se_sess->sess_list);
+ INIT_LIST_HEAD(&se_sess->sess_acl_list);
+ INIT_LIST_HEAD(&se_sess->sess_cmd_list);
+ spin_lock_init(&se_sess->sess_cmd_lock);
+ init_waitqueue_head(&se_sess->cmd_list_wq);
++ return percpu_ref_init(&se_sess->cmd_count,
++ target_release_sess_cmd_refcnt, 0, GFP_KERNEL);
+ }
+ EXPORT_SYMBOL(transport_init_session);
+
+@@ -247,6 +256,7 @@ EXPORT_SYMBOL(transport_init_session);
+ struct se_session *transport_alloc_session(enum target_prot_op sup_prot_ops)
+ {
+ struct se_session *se_sess;
++ int ret;
+
+ se_sess = kmem_cache_zalloc(se_sess_cache, GFP_KERNEL);
+ if (!se_sess) {
+@@ -254,7 +264,11 @@ struct se_session *transport_alloc_session(enum target_prot_op sup_prot_ops)
+ " se_sess_cache\n");
+ return ERR_PTR(-ENOMEM);
+ }
+- transport_init_session(se_sess);
++ ret = transport_init_session(se_sess);
++ if (ret < 0) {
++ kfree(se_sess);
++ return ERR_PTR(ret);
++ }
+ se_sess->sup_prot_ops = sup_prot_ops;
+
+ return se_sess;
+@@ -581,6 +595,7 @@ void transport_free_session(struct se_session *se_sess)
+ sbitmap_queue_free(&se_sess->sess_tag_pool);
+ kvfree(se_sess->sess_cmd_map);
+ }
++ percpu_ref_exit(&se_sess->cmd_count);
+ kmem_cache_free(se_sess_cache, se_sess);
+ }
+ EXPORT_SYMBOL(transport_free_session);
+@@ -2724,6 +2739,7 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref)
+ }
+ se_cmd->transport_state |= CMD_T_PRE_EXECUTE;
+ list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
++ percpu_ref_get(&se_sess->cmd_count);
+ out:
+ spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+
+@@ -2754,8 +2770,6 @@ static void target_release_cmd_kref(struct kref *kref)
+ if (se_sess) {
+ spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
+ list_del_init(&se_cmd->se_cmd_list);
+- if (se_sess->sess_tearing_down && list_empty(&se_sess->sess_cmd_list))
+- wake_up(&se_sess->cmd_list_wq);
+ spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+ }
+
+@@ -2763,6 +2777,8 @@ static void target_release_cmd_kref(struct kref *kref)
+ se_cmd->se_tfo->release_cmd(se_cmd);
+ if (compl)
+ complete(compl);
++
++ percpu_ref_put(&se_sess->cmd_count);
+ }
+
+ /**
+@@ -2891,6 +2907,8 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
+ spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
+ se_sess->sess_tearing_down = 1;
+ spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
++
++ percpu_ref_kill(&se_sess->cmd_count);
+ }
+ EXPORT_SYMBOL(target_sess_cmd_list_set_waiting);
+
+@@ -2905,17 +2923,14 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
+
+ WARN_ON_ONCE(!se_sess->sess_tearing_down);
+
+- spin_lock_irq(&se_sess->sess_cmd_lock);
+ do {
+- ret = wait_event_lock_irq_timeout(
+- se_sess->cmd_list_wq,
+- list_empty(&se_sess->sess_cmd_list),
+- se_sess->sess_cmd_lock, 180 * HZ);
++ ret = wait_event_timeout(se_sess->cmd_list_wq,
++ percpu_ref_is_zero(&se_sess->cmd_count),
++ 180 * HZ);
+ list_for_each_entry(cmd, &se_sess->sess_cmd_list, se_cmd_list)
+ target_show_cmd("session shutdown: still waiting for ",
+ cmd);
+ } while (ret <= 0);
+- spin_unlock_irq(&se_sess->sess_cmd_lock);
+ }
+ EXPORT_SYMBOL(target_wait_for_sess_cmds);
+
+diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
+index 2718a933c0c6..7cdb5d7f6538 100644
+--- a/drivers/target/target_core_xcopy.c
++++ b/drivers/target/target_core_xcopy.c
+@@ -480,6 +480,8 @@ static const struct target_core_fabric_ops xcopy_pt_tfo = {
+
+ int target_xcopy_setup_pt(void)
+ {
++ int ret;
++
+ xcopy_wq = alloc_workqueue("xcopy_wq", WQ_MEM_RECLAIM, 0);
+ if (!xcopy_wq) {
+ pr_err("Unable to allocate xcopy_wq\n");
+@@ -497,7 +499,9 @@ int target_xcopy_setup_pt(void)
+ INIT_LIST_HEAD(&xcopy_pt_nacl.acl_list);
+ INIT_LIST_HEAD(&xcopy_pt_nacl.acl_sess_list);
+ memset(&xcopy_pt_sess, 0, sizeof(struct se_session));
+- transport_init_session(&xcopy_pt_sess);
++ ret = transport_init_session(&xcopy_pt_sess);
++ if (ret < 0)
++ return ret;
+
+ xcopy_pt_nacl.se_tpg = &xcopy_pt_tpg;
+ xcopy_pt_nacl.nacl_sess = &xcopy_pt_sess;
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index ebd33c0232e6..89ade213a1a9 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -2780,6 +2780,7 @@ static struct platform_driver arm_sbsa_uart_platform_driver = {
+ .name = "sbsa-uart",
+ .of_match_table = of_match_ptr(sbsa_uart_of_match),
+ .acpi_match_table = ACPI_PTR(sbsa_uart_acpi_match),
++ .suppress_bind_attrs = IS_BUILTIN(CONFIG_SERIAL_AMBA_PL011),
+ },
+ };
+
+@@ -2808,6 +2809,7 @@ static struct amba_driver pl011_driver = {
+ .drv = {
+ .name = "uart-pl011",
+ .pm = &pl011_dev_pm_ops,
++ .suppress_bind_attrs = IS_BUILTIN(CONFIG_SERIAL_AMBA_PL011),
+ },
+ .id_table = pl011_ids,
+ .probe = pl011_probe,
+diff --git a/drivers/tty/serial/pic32_uart.c b/drivers/tty/serial/pic32_uart.c
+index fd80d999308d..0bdf1687983f 100644
+--- a/drivers/tty/serial/pic32_uart.c
++++ b/drivers/tty/serial/pic32_uart.c
+@@ -919,6 +919,7 @@ static struct platform_driver pic32_uart_platform_driver = {
+ .driver = {
+ .name = PIC32_DEV_NAME,
+ .of_match_table = of_match_ptr(pic32_serial_dt_ids),
++ .suppress_bind_attrs = IS_BUILTIN(CONFIG_SERIAL_PIC32),
+ },
+ };
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 80bb56facfb6..ad126f51d549 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -205,10 +205,15 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state,
+ if (!state->xmit.buf) {
+ state->xmit.buf = (unsigned char *) page;
+ uart_circ_clear(&state->xmit);
++ uart_port_unlock(uport, flags);
+ } else {
++ uart_port_unlock(uport, flags);
++ /*
++ * Do not free() the page under the port lock, see
++ * uart_shutdown().
++ */
+ free_page(page);
+ }
+- uart_port_unlock(uport, flags);
+
+ retval = uport->ops->startup(uport);
+ if (retval == 0) {
+@@ -268,6 +273,7 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
+ struct uart_port *uport = uart_port_check(state);
+ struct tty_port *port = &state->port;
+ unsigned long flags = 0;
++ char *xmit_buf = NULL;
+
+ /*
+ * Set the TTY IO error marker
+@@ -298,14 +304,18 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
+ tty_port_set_suspended(port, 0);
+
+ /*
+- * Free the transmit buffer page.
++ * Do not free() the transmit buffer page under the port lock since
++ * this can create various circular locking scenarios. For instance,
++ * console driver may need to allocate/free a debug object, which
++ * can endup in printk() recursion.
+ */
+ uart_port_lock(state, flags);
+- if (state->xmit.buf) {
+- free_page((unsigned long)state->xmit.buf);
+- state->xmit.buf = NULL;
+- }
++ xmit_buf = state->xmit.buf;
++ state->xmit.buf = NULL;
+ uart_port_unlock(uport, flags);
++
++ if (xmit_buf)
++ free_page((unsigned long)xmit_buf);
+ }
+
+ /**
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index 6ed74735b58c..87d8dd90d605 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1608,6 +1608,7 @@ static struct platform_driver cdns_uart_platform_driver = {
+ .name = CDNS_UART_NAME,
+ .of_match_table = cdns_uart_of_match,
+ .pm = &cdns_uart_dev_pm_ops,
++ .suppress_bind_attrs = IS_BUILTIN(CONFIG_SERIAL_XILINX_PS_UART),
+ },
+ };
+
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index 67d8a501d994..fea02c7ad4f4 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -358,6 +358,7 @@ struct renesas_usb3 {
+ bool extcon_host; /* check id and set EXTCON_USB_HOST */
+ bool extcon_usb; /* check vbus and set EXTCON_USB */
+ bool forced_b_device;
++ bool start_to_connect;
+ };
+
+ #define gadget_to_renesas_usb3(_gadget) \
+@@ -476,7 +477,8 @@ static void usb3_init_axi_bridge(struct renesas_usb3 *usb3)
+ static void usb3_init_epc_registers(struct renesas_usb3 *usb3)
+ {
+ usb3_write(usb3, ~0, USB3_USB_INT_STA_1);
+- usb3_enable_irq_1(usb3, USB_INT_1_VBUS_CNG);
++ if (!usb3->workaround_for_vbus)
++ usb3_enable_irq_1(usb3, USB_INT_1_VBUS_CNG);
+ }
+
+ static bool usb3_wakeup_usb2_phy(struct renesas_usb3 *usb3)
+@@ -700,8 +702,7 @@ static void usb3_mode_config(struct renesas_usb3 *usb3, bool host, bool a_dev)
+ usb3_set_mode_by_role_sw(usb3, host);
+ usb3_vbus_out(usb3, a_dev);
+ /* for A-Peripheral or forced B-device mode */
+- if ((!host && a_dev) ||
+- (usb3->workaround_for_vbus && usb3->forced_b_device))
++ if ((!host && a_dev) || usb3->start_to_connect)
+ usb3_connect(usb3);
+ spin_unlock_irqrestore(&usb3->lock, flags);
+ }
+@@ -2432,7 +2433,11 @@ static ssize_t renesas_usb3_b_device_write(struct file *file,
+ if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
+ return -EFAULT;
+
+- if (!strncmp(buf, "1", 1))
++ usb3->start_to_connect = false;
++ if (usb3->workaround_for_vbus && usb3->forced_b_device &&
++ !strncmp(buf, "2", 1))
++ usb3->start_to_connect = true;
++ else if (!strncmp(buf, "1", 1))
+ usb3->forced_b_device = true;
+ else
+ usb3->forced_b_device = false;
+@@ -2440,7 +2445,7 @@ static ssize_t renesas_usb3_b_device_write(struct file *file,
+ if (usb3->workaround_for_vbus)
+ usb3_disconnect(usb3);
+
+- /* Let this driver call usb3_connect() anyway */
++ /* Let this driver call usb3_connect() if needed */
+ usb3_check_id(usb3);
+
+ return count;
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index c74cc9c309b1..3457c1fdebd1 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -317,6 +317,9 @@ struct tcpm_port {
+ /* Deadline in jiffies to exit src_try_wait state */
+ unsigned long max_wait;
+
++ /* port belongs to a self powered device */
++ bool self_powered;
++
+ #ifdef CONFIG_DEBUG_FS
+ struct dentry *dentry;
+ struct mutex logbuffer_lock; /* log buffer access lock */
+@@ -3257,7 +3260,8 @@ static void run_state_machine(struct tcpm_port *port)
+ case SRC_HARD_RESET_VBUS_OFF:
+ tcpm_set_vconn(port, true);
+ tcpm_set_vbus(port, false);
+- tcpm_set_roles(port, false, TYPEC_SOURCE, TYPEC_HOST);
++ tcpm_set_roles(port, port->self_powered, TYPEC_SOURCE,
++ TYPEC_HOST);
+ tcpm_set_state(port, SRC_HARD_RESET_VBUS_ON, PD_T_SRC_RECOVER);
+ break;
+ case SRC_HARD_RESET_VBUS_ON:
+@@ -3270,7 +3274,8 @@ static void run_state_machine(struct tcpm_port *port)
+ memset(&port->pps_data, 0, sizeof(port->pps_data));
+ tcpm_set_vconn(port, false);
+ tcpm_set_charge(port, false);
+- tcpm_set_roles(port, false, TYPEC_SINK, TYPEC_DEVICE);
++ tcpm_set_roles(port, port->self_powered, TYPEC_SINK,
++ TYPEC_DEVICE);
+ /*
+ * VBUS may or may not toggle, depending on the adapter.
+ * If it doesn't toggle, transition to SNK_HARD_RESET_SINK_ON
+@@ -4415,6 +4420,8 @@ sink:
+ return -EINVAL;
+ port->operating_snk_mw = mw / 1000;
+
++ port->self_powered = fwnode_property_read_bool(fwnode, "self-powered");
++
+ return 0;
+ }
+
+@@ -4723,6 +4730,7 @@ static int tcpm_copy_caps(struct tcpm_port *port,
+ port->typec_caps.prefer_role = tcfg->default_role;
+ port->typec_caps.type = tcfg->type;
+ port->typec_caps.data = tcfg->data;
++ port->self_powered = port->tcpc->config->self_powered;
+
+ return 0;
+ }
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index b2b283e48439..8fed470bb7e1 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -800,39 +800,58 @@ int btrfs_dev_replace_cancel(struct btrfs_fs_info *fs_info)
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED:
+ result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NOT_STARTED;
+ btrfs_dev_replace_write_unlock(dev_replace);
+- goto leave;
++ break;
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED:
++ result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NO_ERROR;
++ tgt_device = dev_replace->tgtdev;
++ src_device = dev_replace->srcdev;
++ btrfs_dev_replace_write_unlock(dev_replace);
++ btrfs_scrub_cancel(fs_info);
++ /* btrfs_dev_replace_finishing() will handle the cleanup part */
++ btrfs_info_in_rcu(fs_info,
++ "dev_replace from %s (devid %llu) to %s canceled",
++ btrfs_dev_name(src_device), src_device->devid,
++ btrfs_dev_name(tgt_device));
++ break;
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED:
++ /*
++ * Scrub doing the replace isn't running so we need to do the
++ * cleanup step of btrfs_dev_replace_finishing() here
++ */
+ result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NO_ERROR;
+ tgt_device = dev_replace->tgtdev;
+ src_device = dev_replace->srcdev;
+ dev_replace->tgtdev = NULL;
+ dev_replace->srcdev = NULL;
+- break;
+- }
+- dev_replace->replace_state = BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED;
+- dev_replace->time_stopped = ktime_get_real_seconds();
+- dev_replace->item_needs_writeback = 1;
+- btrfs_dev_replace_write_unlock(dev_replace);
+- btrfs_scrub_cancel(fs_info);
++ dev_replace->replace_state =
++ BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED;
++ dev_replace->time_stopped = ktime_get_real_seconds();
++ dev_replace->item_needs_writeback = 1;
+
+- trans = btrfs_start_transaction(root, 0);
+- if (IS_ERR(trans)) {
+- mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
+- return PTR_ERR(trans);
+- }
+- ret = btrfs_commit_transaction(trans);
+- WARN_ON(ret);
++ btrfs_dev_replace_write_unlock(dev_replace);
+
+- btrfs_info_in_rcu(fs_info,
+- "dev_replace from %s (devid %llu) to %s canceled",
+- btrfs_dev_name(src_device), src_device->devid,
+- btrfs_dev_name(tgt_device));
++ btrfs_scrub_cancel(fs_info);
++
++ trans = btrfs_start_transaction(root, 0);
++ if (IS_ERR(trans)) {
++ mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
++ return PTR_ERR(trans);
++ }
++ ret = btrfs_commit_transaction(trans);
++ WARN_ON(ret);
+
+- if (tgt_device)
+- btrfs_destroy_dev_replace_tgtdev(tgt_device);
++ btrfs_info_in_rcu(fs_info,
++ "suspended dev_replace from %s (devid %llu) to %s canceled",
++ btrfs_dev_name(src_device), src_device->devid,
++ btrfs_dev_name(tgt_device));
++
++ if (tgt_device)
++ btrfs_destroy_dev_replace_tgtdev(tgt_device);
++ break;
++ default:
++ result = -EINVAL;
++ }
+
+-leave:
+ mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
+ return result;
+ }
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 4f6dc56b4f4d..83b3a626c796 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -6440,14 +6440,19 @@ fail_dir_item:
+ err = btrfs_del_root_ref(trans, key.objectid,
+ root->root_key.objectid, parent_ino,
+ &local_index, name, name_len);
+-
++ if (err)
++ btrfs_abort_transaction(trans, err);
+ } else if (add_backref) {
+ u64 local_index;
+ int err;
+
+ err = btrfs_del_inode_ref(trans, root, name, name_len,
+ ino, parent_ino, &local_index);
++ if (err)
++ btrfs_abort_transaction(trans, err);
+ }
++
++ /* Return the original error code */
+ return ret;
+ }
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 223334f08530..0ee1cd4b56fb 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4768,19 +4768,17 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
+ /*
+ * Use the number of data stripes to figure out how big this chunk
+ * is really going to be in terms of logical address space,
+- * and compare that answer with the max chunk size
++ * and compare that answer with the max chunk size. If it's higher,
++ * we try to reduce stripe_size.
+ */
+ if (stripe_size * data_stripes > max_chunk_size) {
+- stripe_size = div_u64(max_chunk_size, data_stripes);
+-
+- /* bump the answer up to a 16MB boundary */
+- stripe_size = round_up(stripe_size, SZ_16M);
+-
+ /*
+- * But don't go higher than the limits we found while searching
+- * for free extents
++ * Reduce stripe_size, round it up to a 16MB boundary again and
++ * then use it, unless it ends up being even bigger than the
++ * previous value we had already.
+ */
+- stripe_size = min(devices_info[ndevs - 1].max_avail,
++ stripe_size = min(round_up(div_u64(max_chunk_size,
++ data_stripes), SZ_16M),
+ stripe_size);
+ }
+
+@@ -7474,6 +7472,8 @@ int btrfs_verify_dev_extents(struct btrfs_fs_info *fs_info)
+ struct btrfs_path *path;
+ struct btrfs_root *root = fs_info->dev_root;
+ struct btrfs_key key;
++ u64 prev_devid = 0;
++ u64 prev_dev_ext_end = 0;
+ int ret = 0;
+
+ key.objectid = 1;
+@@ -7518,10 +7518,22 @@ int btrfs_verify_dev_extents(struct btrfs_fs_info *fs_info)
+ chunk_offset = btrfs_dev_extent_chunk_offset(leaf, dext);
+ physical_len = btrfs_dev_extent_length(leaf, dext);
+
++ /* Check if this dev extent overlaps with the previous one */
++ if (devid == prev_devid && physical_offset < prev_dev_ext_end) {
++ btrfs_err(fs_info,
++"dev extent devid %llu physical offset %llu overlap with previous dev extent end %llu",
++ devid, physical_offset, prev_dev_ext_end);
++ ret = -EUCLEAN;
++ goto out;
++ }
++
+ ret = verify_one_dev_extent(fs_info, chunk_offset, devid,
+ physical_offset, physical_len);
+ if (ret < 0)
+ goto out;
++ prev_devid = devid;
++ prev_dev_ext_end = physical_offset + physical_len;
++
+ ret = btrfs_next_item(root, path);
+ if (ret < 0)
+ goto out;
+diff --git a/fs/iomap.c b/fs/iomap.c
+index ec15cf2ec696..e57fb1e534c5 100644
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -488,16 +488,29 @@ done:
+ }
+ EXPORT_SYMBOL_GPL(iomap_readpages);
+
++/*
++ * iomap_is_partially_uptodate checks whether blocks within a page are
++ * uptodate or not.
++ *
++ * Returns true if all blocks which correspond to a file portion
++ * we want to read within the page are uptodate.
++ */
+ int
+ iomap_is_partially_uptodate(struct page *page, unsigned long from,
+ unsigned long count)
+ {
+ struct iomap_page *iop = to_iomap_page(page);
+ struct inode *inode = page->mapping->host;
+- unsigned first = from >> inode->i_blkbits;
+- unsigned last = (from + count - 1) >> inode->i_blkbits;
++ unsigned len, first, last;
+ unsigned i;
+
++ /* Limit range to one page */
++ len = min_t(unsigned, PAGE_SIZE - from, count);
++
++ /* First and last blocks in range within page */
++ first = from >> inode->i_blkbits;
++ last = (from + len - 1) >> inode->i_blkbits;
++
+ if (iop) {
+ for (i = first; i <= last; i++)
+ if (!test_bit(i, iop->uptodate))
+diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
+index 902a7dd10e5c..bb6ae387469f 100644
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -101,7 +101,8 @@ static int jffs2_sync_fs(struct super_block *sb, int wait)
+ struct jffs2_sb_info *c = JFFS2_SB_INFO(sb);
+
+ #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
+- cancel_delayed_work_sync(&c->wbuf_dwork);
++ if (jffs2_is_writebuffered(c))
++ cancel_delayed_work_sync(&c->wbuf_dwork);
+ #endif
+
+ mutex_lock(&c->alloc_sem);
+diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
+index 7642b6712c39..30208233f65b 100644
+--- a/fs/ocfs2/localalloc.c
++++ b/fs/ocfs2/localalloc.c
+@@ -345,13 +345,18 @@ int ocfs2_load_local_alloc(struct ocfs2_super *osb)
+ if (num_used
+ || alloc->id1.bitmap1.i_used
+ || alloc->id1.bitmap1.i_total
+- || la->la_bm_off)
+- mlog(ML_ERROR, "Local alloc hasn't been recovered!\n"
++ || la->la_bm_off) {
++ mlog(ML_ERROR, "inconsistent detected, clean journal with"
++ " unrecovered local alloc, please run fsck.ocfs2!\n"
+ "found = %u, set = %u, taken = %u, off = %u\n",
+ num_used, le32_to_cpu(alloc->id1.bitmap1.i_used),
+ le32_to_cpu(alloc->id1.bitmap1.i_total),
+ OCFS2_LOCAL_ALLOC(alloc)->la_bm_off);
+
++ status = -EINVAL;
++ goto bail;
++ }
++
+ osb->local_alloc_bh = alloc_bh;
+ osb->local_alloc_state = OCFS2_LA_ENABLED;
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 0792595ebcfb..3c777ec80d47 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -496,6 +496,11 @@ static int persistent_ram_post_init(struct persistent_ram_zone *prz, u32 sig,
+ sig ^= PERSISTENT_RAM_SIG;
+
+ if (prz->buffer->sig == sig) {
++ if (buffer_size(prz) == 0) {
++ pr_debug("found existing empty buffer\n");
++ return 0;
++ }
++
+ if (buffer_size(prz) > prz->buffer_size ||
+ buffer_start(prz) > buffer_size(prz))
+ pr_info("found existing invalid buffer, size %zu, start %zu\n",
+diff --git a/fs/quota/quota.c b/fs/quota/quota.c
+index f0cbf58ad4da..fd5dd806f1b9 100644
+--- a/fs/quota/quota.c
++++ b/fs/quota/quota.c
+@@ -791,7 +791,8 @@ static int quotactl_cmd_write(int cmd)
+ /* Return true if quotactl command is manipulating quota on/off state */
+ static bool quotactl_cmd_onoff(int cmd)
+ {
+- return (cmd == Q_QUOTAON) || (cmd == Q_QUOTAOFF);
++ return (cmd == Q_QUOTAON) || (cmd == Q_QUOTAOFF) ||
++ (cmd == Q_XQUOTAON) || (cmd == Q_XQUOTAOFF);
+ }
+
+ /*
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index 7a85e609fc27..d8b8323e80f4 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -736,10 +736,18 @@ void mremap_userfaultfd_prep(struct vm_area_struct *vma,
+ struct userfaultfd_ctx *ctx;
+
+ ctx = vma->vm_userfaultfd_ctx.ctx;
+- if (ctx && (ctx->features & UFFD_FEATURE_EVENT_REMAP)) {
++
++ if (!ctx)
++ return;
++
++ if (ctx->features & UFFD_FEATURE_EVENT_REMAP) {
+ vm_ctx->ctx = ctx;
+ userfaultfd_ctx_get(ctx);
+ WRITE_ONCE(ctx->mmap_changing, true);
++ } else {
++ /* Drop uffd context if remap feature not enabled */
++ vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
++ vma->vm_flags &= ~(VM_UFFD_WP | VM_UFFD_MISSING);
+ }
+ }
+
+diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
+index 9a6bc0951cfa..c31157135598 100644
+--- a/include/linux/backing-dev-defs.h
++++ b/include/linux/backing-dev-defs.h
+@@ -258,6 +258,14 @@ static inline void wb_get(struct bdi_writeback *wb)
+ */
+ static inline void wb_put(struct bdi_writeback *wb)
+ {
++ if (WARN_ON_ONCE(!wb->bdi)) {
++ /*
++ * A driver bug might cause a file to be removed before bdi was
++ * initialized.
++ */
++ return;
++ }
++
+ if (wb != &wb->bdi->wb)
+ percpu_ref_put(&wb->refcnt);
+ }
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 6791a0ac0139..ec90d5255cf7 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -665,24 +665,10 @@ static inline u32 bpf_ctx_off_adjust_machine(u32 size)
+ return size;
+ }
+
+-static inline bool bpf_ctx_narrow_align_ok(u32 off, u32 size_access,
+- u32 size_default)
+-{
+- size_default = bpf_ctx_off_adjust_machine(size_default);
+- size_access = bpf_ctx_off_adjust_machine(size_access);
+-
+-#ifdef __LITTLE_ENDIAN
+- return (off & (size_default - 1)) == 0;
+-#else
+- return (off & (size_default - 1)) + size_access == size_default;
+-#endif
+-}
+-
+ static inline bool
+ bpf_ctx_narrow_access_ok(u32 off, u32 size, u32 size_default)
+ {
+- return bpf_ctx_narrow_align_ok(off, size, size_default) &&
+- size <= size_default && (size & (size - 1)) == 0;
++ return size <= size_default && (size & (size - 1)) == 0;
+ }
+
+ #define bpf_classic_proglen(fprog) (fprog->len * sizeof(fprog->filter[0]))
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index 8e2c11e692ba..77221c16733a 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -232,7 +232,6 @@ struct swap_info_struct {
+ unsigned long flags; /* SWP_USED etc: see above */
+ signed short prio; /* swap priority of this type */
+ struct plist_node list; /* entry in swap_active_head */
+- struct plist_node avail_lists[MAX_NUMNODES];/* entry in swap_avail_heads */
+ signed char type; /* strange name for an index */
+ unsigned int max; /* extent of the swap_map */
+ unsigned char *swap_map; /* vmalloc'ed array of usage counts */
+@@ -273,6 +272,16 @@ struct swap_info_struct {
+ */
+ struct work_struct discard_work; /* discard worker */
+ struct swap_cluster_list discard_clusters; /* discard clusters list */
++ struct plist_node avail_lists[0]; /*
++ * entries in swap_avail_heads, one
++ * entry per node.
++ * Must be last as the number of the
++ * array is nr_node_ids, which is not
++ * a fixed value so have to allocate
++ * dynamically.
++ * And it has to be an array so that
++ * plist_for_each_* can work.
++ */
+ };
+
+ #ifdef CONFIG_64BIT
+diff --git a/include/linux/usb/tcpm.h b/include/linux/usb/tcpm.h
+index 7e7fbfb84e8e..50c74a77db55 100644
+--- a/include/linux/usb/tcpm.h
++++ b/include/linux/usb/tcpm.h
+@@ -89,6 +89,7 @@ struct tcpc_config {
+ enum typec_port_data data;
+ enum typec_role default_role;
+ bool try_role_hw; /* try.{src,snk} implemented in hardware */
++ bool self_powered; /* port belongs to a self powered device */
+
+ const struct typec_altmode_desc *alt_modes;
+ };
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 7a4ee7852ca4..2cfd3b4573b0 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -602,6 +602,7 @@ struct se_session {
+ struct se_node_acl *se_node_acl;
+ struct se_portal_group *se_tpg;
+ void *fabric_sess_ptr;
++ struct percpu_ref cmd_count;
+ struct list_head sess_list;
+ struct list_head sess_acl_list;
+ struct list_head sess_cmd_list;
+diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
+index f4147b398431..eb9d0923c55c 100644
+--- a/include/target/target_core_fabric.h
++++ b/include/target/target_core_fabric.h
+@@ -116,7 +116,7 @@ struct se_session *target_setup_session(struct se_portal_group *,
+ struct se_session *, void *));
+ void target_remove_session(struct se_session *);
+
+-void transport_init_session(struct se_session *);
++int transport_init_session(struct se_session *se_sess);
+ struct se_session *transport_alloc_session(enum target_prot_op);
+ int transport_alloc_session_tags(struct se_session *, unsigned int,
+ unsigned int);
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 2954e4b3abd5..341806668f03 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -3285,12 +3285,15 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ return err;
+
+ if (BPF_SRC(insn->code) == BPF_X) {
++ struct bpf_reg_state *src_reg = regs + insn->src_reg;
++ struct bpf_reg_state *dst_reg = regs + insn->dst_reg;
++
+ if (BPF_CLASS(insn->code) == BPF_ALU64) {
+ /* case: R1 = R2
+ * copy register state to dest reg
+ */
+- regs[insn->dst_reg] = regs[insn->src_reg];
+- regs[insn->dst_reg].live |= REG_LIVE_WRITTEN;
++ *dst_reg = *src_reg;
++ dst_reg->live |= REG_LIVE_WRITTEN;
+ } else {
+ /* R1 = (u32) R2 */
+ if (is_pointer_value(env, insn->src_reg)) {
+@@ -3298,9 +3301,14 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ "R%d partial copy of pointer\n",
+ insn->src_reg);
+ return -EACCES;
++ } else if (src_reg->type == SCALAR_VALUE) {
++ *dst_reg = *src_reg;
++ dst_reg->live |= REG_LIVE_WRITTEN;
++ } else {
++ mark_reg_unknown(env, regs,
++ insn->dst_reg);
+ }
+- mark_reg_unknown(env, regs, insn->dst_reg);
+- coerce_reg_to_size(®s[insn->dst_reg], 4);
++ coerce_reg_to_size(dst_reg, 4);
+ }
+ } else {
+ /* case: R = imm
+@@ -5341,10 +5349,10 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
+ int i, cnt, size, ctx_field_size, delta = 0;
+ const int insn_cnt = env->prog->len;
+ struct bpf_insn insn_buf[16], *insn;
++ u32 target_size, size_default, off;
+ struct bpf_prog *new_prog;
+ enum bpf_access_type type;
+ bool is_narrower_load;
+- u32 target_size;
+
+ if (ops->gen_prologue) {
+ cnt = ops->gen_prologue(insn_buf, env->seen_direct_write,
+@@ -5421,9 +5429,9 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
+ * we will apply proper mask to the result.
+ */
+ is_narrower_load = size < ctx_field_size;
++ size_default = bpf_ctx_off_adjust_machine(ctx_field_size);
++ off = insn->off;
+ if (is_narrower_load) {
+- u32 size_default = bpf_ctx_off_adjust_machine(ctx_field_size);
+- u32 off = insn->off;
+ u8 size_code;
+
+ if (type == BPF_WRITE) {
+@@ -5451,12 +5459,23 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
+ }
+
+ if (is_narrower_load && size < target_size) {
+- if (ctx_field_size <= 4)
++ u8 shift = (off & (size_default - 1)) * 8;
++
++ if (ctx_field_size <= 4) {
++ if (shift)
++ insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH,
++ insn->dst_reg,
++ shift);
+ insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg,
+ (1 << size * 8) - 1);
+- else
++ } else {
++ if (shift)
++ insn_buf[cnt++] = BPF_ALU64_IMM(BPF_RSH,
++ insn->dst_reg,
++ shift);
+ insn_buf[cnt++] = BPF_ALU64_IMM(BPF_AND, insn->dst_reg,
+ (1 << size * 8) - 1);
++ }
+ }
+
+ new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 84ae9bf5858a..ea4fd3af3b4b 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -2156,6 +2156,7 @@ int write_cache_pages(struct address_space *mapping,
+ {
+ int ret = 0;
+ int done = 0;
++ int error;
+ struct pagevec pvec;
+ int nr_pages;
+ pgoff_t uninitialized_var(writeback_index);
+@@ -2236,25 +2237,31 @@ continue_unlock:
+ goto continue_unlock;
+
+ trace_wbc_writepage(wbc, inode_to_bdi(mapping->host));
+- ret = (*writepage)(page, wbc, data);
+- if (unlikely(ret)) {
+- if (ret == AOP_WRITEPAGE_ACTIVATE) {
++ error = (*writepage)(page, wbc, data);
++ if (unlikely(error)) {
++ /*
++ * Handle errors according to the type of
++ * writeback. There's no need to continue for
++ * background writeback. Just push done_index
++ * past this page so media errors won't choke
++ * writeout for the entire file. For integrity
++ * writeback, we must process the entire dirty
++ * set regardless of errors because the fs may
++ * still have state to clear for each page. In
++ * that case we continue processing and return
++ * the first error.
++ */
++ if (error == AOP_WRITEPAGE_ACTIVATE) {
+ unlock_page(page);
+- ret = 0;
+- } else {
+- /*
+- * done_index is set past this page,
+- * so media errors will not choke
+- * background writeout for the entire
+- * file. This has consequences for
+- * range_cyclic semantics (ie. it may
+- * not be suitable for data integrity
+- * writeout).
+- */
++ error = 0;
++ } else if (wbc->sync_mode != WB_SYNC_ALL) {
++ ret = error;
+ done_index = page->index + 1;
+ done = 1;
+ break;
+ }
++ if (!ret)
++ ret = error;
+ }
+
+ /*
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 67aaf7ae22ff..340ef3177686 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2820,8 +2820,9 @@ static struct swap_info_struct *alloc_swap_info(void)
+ struct swap_info_struct *p;
+ unsigned int type;
+ int i;
++ int size = sizeof(*p) + nr_node_ids * sizeof(struct plist_node);
+
+- p = kvzalloc(sizeof(*p), GFP_KERNEL);
++ p = kvzalloc(size, GFP_KERNEL);
+ if (!p)
+ return ERR_PTR(-ENOMEM);
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index f12555f23a49..7f800c3480f7 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -5668,6 +5668,12 @@ static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
+ return true;
+ }
+
++ /* Check if request ended in Command Status - no way to retreive
++ * any extra parameters in this case.
++ */
++ if (hdr->evt == HCI_EV_CMD_STATUS)
++ return false;
++
+ if (hdr->evt != HCI_EV_CMD_COMPLETE) {
+ bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
+ hdr->evt);
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
+index 5372e2042adf..2cb8da465b98 100644
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -65,6 +65,7 @@ EXPORT_SYMBOL_GPL(br_dev_queue_push_xmit);
+
+ int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
++ skb->tstamp = 0;
+ return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING,
+ net, sk, skb, NULL, skb->dev,
+ br_dev_queue_push_xmit);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index abbbd7fd17fe..589ec5b9ec5f 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -5258,7 +5258,6 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len,
+ unsigned long chunk;
+ struct sk_buff *skb;
+ struct page *page;
+- gfp_t gfp_head;
+ int i;
+
+ *errcode = -EMSGSIZE;
+@@ -5268,12 +5267,8 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len,
+ if (npages > MAX_SKB_FRAGS)
+ return NULL;
+
+- gfp_head = gfp_mask;
+- if (gfp_head & __GFP_DIRECT_RECLAIM)
+- gfp_head |= __GFP_RETRY_MAYFAIL;
+-
+ *errcode = -ENOBUFS;
+- skb = alloc_skb(header_len, gfp_head);
++ skb = alloc_skb(header_len, gfp_mask);
+ if (!skb)
+ return NULL;
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 5a8a3b76832f..c9668dcb5eb9 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -698,6 +698,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
+ break;
+ case SO_DONTROUTE:
+ sock_valbool_flag(sk, SOCK_LOCALROUTE, valbool);
++ sk_dst_reset(sk);
+ break;
+ case SO_BROADCAST:
+ sock_valbool_flag(sk, SOCK_BROADCAST, valbool);
+diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+index 2c8d313ae216..fb1e7f237f53 100644
+--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+@@ -57,17 +57,14 @@ struct clusterip_config {
+ enum clusterip_hashmode hash_mode; /* which hashing mode */
+ u_int32_t hash_initval; /* hash initialization */
+ struct rcu_head rcu;
+-
++ struct net *net; /* netns for pernet list */
+ char ifname[IFNAMSIZ]; /* device ifname */
+- struct notifier_block notifier; /* refresh c->ifindex in it */
+ };
+
+ #ifdef CONFIG_PROC_FS
+ static const struct file_operations clusterip_proc_fops;
+ #endif
+
+-static unsigned int clusterip_net_id __read_mostly;
+-
+ struct clusterip_net {
+ struct list_head configs;
+ /* lock protects the configs list */
+@@ -78,16 +75,30 @@ struct clusterip_net {
+ #endif
+ };
+
++static unsigned int clusterip_net_id __read_mostly;
++static inline struct clusterip_net *clusterip_pernet(struct net *net)
++{
++ return net_generic(net, clusterip_net_id);
++}
++
+ static inline void
+ clusterip_config_get(struct clusterip_config *c)
+ {
+ refcount_inc(&c->refcount);
+ }
+
+-
+ static void clusterip_config_rcu_free(struct rcu_head *head)
+ {
+- kfree(container_of(head, struct clusterip_config, rcu));
++ struct clusterip_config *config;
++ struct net_device *dev;
++
++ config = container_of(head, struct clusterip_config, rcu);
++ dev = dev_get_by_name(config->net, config->ifname);
++ if (dev) {
++ dev_mc_del(dev, config->clustermac);
++ dev_put(dev);
++ }
++ kfree(config);
+ }
+
+ static inline void
+@@ -101,9 +112,9 @@ clusterip_config_put(struct clusterip_config *c)
+ * entry(rule) is removed, remove the config from lists, but don't free it
+ * yet, since proc-files could still be holding references */
+ static inline void
+-clusterip_config_entry_put(struct net *net, struct clusterip_config *c)
++clusterip_config_entry_put(struct clusterip_config *c)
+ {
+- struct clusterip_net *cn = net_generic(net, clusterip_net_id);
++ struct clusterip_net *cn = clusterip_pernet(c->net);
+
+ local_bh_disable();
+ if (refcount_dec_and_lock(&c->entries, &cn->lock)) {
+@@ -118,8 +129,6 @@ clusterip_config_entry_put(struct net *net, struct clusterip_config *c)
+ spin_unlock(&cn->lock);
+ local_bh_enable();
+
+- unregister_netdevice_notifier(&c->notifier);
+-
+ return;
+ }
+ local_bh_enable();
+@@ -129,7 +138,7 @@ static struct clusterip_config *
+ __clusterip_config_find(struct net *net, __be32 clusterip)
+ {
+ struct clusterip_config *c;
+- struct clusterip_net *cn = net_generic(net, clusterip_net_id);
++ struct clusterip_net *cn = clusterip_pernet(net);
+
+ list_for_each_entry_rcu(c, &cn->configs, list) {
+ if (c->clusterip == clusterip)
+@@ -181,32 +190,37 @@ clusterip_netdev_event(struct notifier_block *this, unsigned long event,
+ void *ptr)
+ {
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++ struct net *net = dev_net(dev);
++ struct clusterip_net *cn = clusterip_pernet(net);
+ struct clusterip_config *c;
+
+- c = container_of(this, struct clusterip_config, notifier);
+- switch (event) {
+- case NETDEV_REGISTER:
+- if (!strcmp(dev->name, c->ifname)) {
+- c->ifindex = dev->ifindex;
+- dev_mc_add(dev, c->clustermac);
+- }
+- break;
+- case NETDEV_UNREGISTER:
+- if (dev->ifindex == c->ifindex) {
+- dev_mc_del(dev, c->clustermac);
+- c->ifindex = -1;
+- }
+- break;
+- case NETDEV_CHANGENAME:
+- if (!strcmp(dev->name, c->ifname)) {
+- c->ifindex = dev->ifindex;
+- dev_mc_add(dev, c->clustermac);
+- } else if (dev->ifindex == c->ifindex) {
+- dev_mc_del(dev, c->clustermac);
+- c->ifindex = -1;
++ spin_lock_bh(&cn->lock);
++ list_for_each_entry_rcu(c, &cn->configs, list) {
++ switch (event) {
++ case NETDEV_REGISTER:
++ if (!strcmp(dev->name, c->ifname)) {
++ c->ifindex = dev->ifindex;
++ dev_mc_add(dev, c->clustermac);
++ }
++ break;
++ case NETDEV_UNREGISTER:
++ if (dev->ifindex == c->ifindex) {
++ dev_mc_del(dev, c->clustermac);
++ c->ifindex = -1;
++ }
++ break;
++ case NETDEV_CHANGENAME:
++ if (!strcmp(dev->name, c->ifname)) {
++ c->ifindex = dev->ifindex;
++ dev_mc_add(dev, c->clustermac);
++ } else if (dev->ifindex == c->ifindex) {
++ dev_mc_del(dev, c->clustermac);
++ c->ifindex = -1;
++ }
++ break;
+ }
+- break;
+ }
++ spin_unlock_bh(&cn->lock);
+
+ return NOTIFY_DONE;
+ }
+@@ -215,30 +229,44 @@ static struct clusterip_config *
+ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i,
+ __be32 ip, const char *iniface)
+ {
+- struct clusterip_net *cn = net_generic(net, clusterip_net_id);
++ struct clusterip_net *cn = clusterip_pernet(net);
+ struct clusterip_config *c;
++ struct net_device *dev;
+ int err;
+
++ if (iniface[0] == '\0') {
++ pr_info("Please specify an interface name\n");
++ return ERR_PTR(-EINVAL);
++ }
++
+ c = kzalloc(sizeof(*c), GFP_ATOMIC);
+ if (!c)
+ return ERR_PTR(-ENOMEM);
+
+- strcpy(c->ifname, iniface);
+- c->ifindex = -1;
+- c->clusterip = ip;
++ dev = dev_get_by_name(net, iniface);
++ if (!dev) {
++ pr_info("no such interface %s\n", iniface);
++ kfree(c);
++ return ERR_PTR(-ENOENT);
++ }
++ c->ifindex = dev->ifindex;
++ strcpy(c->ifname, dev->name);
+ memcpy(&c->clustermac, &i->clustermac, ETH_ALEN);
++ dev_mc_add(dev, c->clustermac);
++ dev_put(dev);
++
++ c->clusterip = ip;
+ c->num_total_nodes = i->num_total_nodes;
+ clusterip_config_init_nodelist(c, i);
+ c->hash_mode = i->hash_mode;
+ c->hash_initval = i->hash_initval;
++ c->net = net;
+ refcount_set(&c->refcount, 1);
+
+ spin_lock_bh(&cn->lock);
+ if (__clusterip_config_find(net, ip)) {
+- spin_unlock_bh(&cn->lock);
+- kfree(c);
+-
+- return ERR_PTR(-EBUSY);
++ err = -EBUSY;
++ goto out_config_put;
+ }
+
+ list_add_rcu(&c->list, &cn->configs);
+@@ -260,22 +288,17 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i,
+ }
+ #endif
+
+- c->notifier.notifier_call = clusterip_netdev_event;
+- err = register_netdevice_notifier(&c->notifier);
+- if (!err) {
+- refcount_set(&c->entries, 1);
+- return c;
+- }
++ refcount_set(&c->entries, 1);
++ return c;
+
+ #ifdef CONFIG_PROC_FS
+- proc_remove(c->pde);
+ err:
+ #endif
+ spin_lock_bh(&cn->lock);
+ list_del_rcu(&c->list);
++out_config_put:
+ spin_unlock_bh(&cn->lock);
+ clusterip_config_put(c);
+-
+ return ERR_PTR(err);
+ }
+
+@@ -475,34 +498,20 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
+ &e->ip.dst.s_addr);
+ return -EINVAL;
+ } else {
+- struct net_device *dev;
+-
+- if (e->ip.iniface[0] == '\0') {
+- pr_info("Please specify an interface name\n");
+- return -EINVAL;
+- }
+-
+- dev = dev_get_by_name(par->net, e->ip.iniface);
+- if (!dev) {
+- pr_info("no such interface %s\n",
+- e->ip.iniface);
+- return -ENOENT;
+- }
+- dev_put(dev);
+-
+ config = clusterip_config_init(par->net, cipinfo,
+ e->ip.dst.s_addr,
+ e->ip.iniface);
+ if (IS_ERR(config))
+ return PTR_ERR(config);
+ }
+- }
++ } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN))
++ return -EINVAL;
+
+ ret = nf_ct_netns_get(par->net, par->family);
+ if (ret < 0) {
+ pr_info("cannot load conntrack support for proto=%u\n",
+ par->family);
+- clusterip_config_entry_put(par->net, config);
++ clusterip_config_entry_put(config);
+ clusterip_config_put(config);
+ return ret;
+ }
+@@ -524,7 +533,7 @@ static void clusterip_tg_destroy(const struct xt_tgdtor_param *par)
+
+ /* if no more entries are referencing the config, remove it
+ * from the list and destroy the proc entry */
+- clusterip_config_entry_put(par->net, cipinfo->config);
++ clusterip_config_entry_put(cipinfo->config);
+
+ clusterip_config_put(cipinfo->config);
+
+@@ -806,7 +815,7 @@ static const struct file_operations clusterip_proc_fops = {
+
+ static int clusterip_net_init(struct net *net)
+ {
+- struct clusterip_net *cn = net_generic(net, clusterip_net_id);
++ struct clusterip_net *cn = clusterip_pernet(net);
+ int ret;
+
+ INIT_LIST_HEAD(&cn->configs);
+@@ -831,13 +840,12 @@ static int clusterip_net_init(struct net *net)
+
+ static void clusterip_net_exit(struct net *net)
+ {
+- struct clusterip_net *cn = net_generic(net, clusterip_net_id);
++ struct clusterip_net *cn = clusterip_pernet(net);
+ #ifdef CONFIG_PROC_FS
+ proc_remove(cn->procdir);
+ cn->procdir = NULL;
+ #endif
+ nf_unregister_net_hook(net, &cip_arp_ops);
+- WARN_ON_ONCE(!list_empty(&cn->configs));
+ }
+
+ static struct pernet_operations clusterip_net_ops = {
+@@ -847,6 +855,10 @@ static struct pernet_operations clusterip_net_ops = {
+ .size = sizeof(struct clusterip_net),
+ };
+
++struct notifier_block cip_netdev_notifier = {
++ .notifier_call = clusterip_netdev_event
++};
++
+ static int __init clusterip_tg_init(void)
+ {
+ int ret;
+@@ -859,11 +871,17 @@ static int __init clusterip_tg_init(void)
+ if (ret < 0)
+ goto cleanup_subsys;
+
++ ret = register_netdevice_notifier(&cip_netdev_notifier);
++ if (ret < 0)
++ goto unregister_target;
++
+ pr_info("ClusterIP Version %s loaded successfully\n",
+ CLUSTERIP_VERSION);
+
+ return 0;
+
++unregister_target:
++ xt_unregister_target(&clusterip_tg_reg);
+ cleanup_subsys:
+ unregister_pernet_subsys(&clusterip_net_ops);
+ return ret;
+@@ -873,6 +891,7 @@ static void __exit clusterip_tg_exit(void)
+ {
+ pr_info("ClusterIP Version %s unloading\n", CLUSTERIP_VERSION);
+
++ unregister_netdevice_notifier(&cip_netdev_notifier);
+ xt_unregister_target(&clusterip_tg_reg);
+ unregister_pernet_subsys(&clusterip_net_ops);
+
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index 9a4261e50272..506b2ae07bb3 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -309,6 +309,7 @@ static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
+
+ /* Check if the address belongs to the host. */
+ if (addr_type == IPV6_ADDR_MAPPED) {
++ struct net_device *dev = NULL;
+ int chk_addr_ret;
+
+ /* Binding to v4-mapped address on a v6-only socket
+@@ -319,9 +320,20 @@ static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
+ goto out;
+ }
+
++ rcu_read_lock();
++ if (sk->sk_bound_dev_if) {
++ dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
++ if (!dev) {
++ err = -ENODEV;
++ goto out_unlock;
++ }
++ }
++
+ /* Reproduce AF_INET checks to make the bindings consistent */
+ v4addr = addr->sin6_addr.s6_addr32[3];
+- chk_addr_ret = inet_addr_type(net, v4addr);
++ chk_addr_ret = inet_addr_type_dev_table(net, dev, v4addr);
++ rcu_read_unlock();
++
+ if (!inet_can_nonlocal_bind(net, inet) &&
+ v4addr != htonl(INADDR_ANY) &&
+ chk_addr_ret != RTN_LOCAL &&
+diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+index c00b6a2e8e3c..13ade5782847 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+@@ -219,10 +219,6 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
+ struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
+ u32 ip;
+
+- /* MAC can be src only */
+- if (!(opt->flags & IPSET_DIM_TWO_SRC))
+- return 0;
+-
+ ip = ntohl(ip4addr(skb, opt->flags & IPSET_DIM_ONE_SRC));
+ if (ip < map->first_ip || ip > map->last_ip)
+ return -IPSET_ERR_BITMAP_RANGE;
+@@ -233,7 +229,11 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
+ return -EINVAL;
+
+ e.id = ip_to_id(map, ip);
+- memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN);
++
++ if (opt->flags & IPSET_DIM_ONE_SRC)
++ ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
++ else
++ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
+
+ return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
+ }
+diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
+index 1ab5ed2f6839..fd87de3ed55b 100644
+--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
++++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
+@@ -103,7 +103,11 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
+ (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ return -EINVAL;
+
+- memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN);
++ if (opt->flags & IPSET_DIM_ONE_SRC)
++ ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
++ else
++ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
++
+ if (ether_addr_equal(e.ether, invalid_ether))
+ return -EINVAL;
+
+@@ -211,15 +215,15 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb,
+ };
+ struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
+
+- /* MAC can be src only */
+- if (!(opt->flags & IPSET_DIM_TWO_SRC))
+- return 0;
+-
+ if (skb_mac_header(skb) < skb->head ||
+ (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ return -EINVAL;
+
+- memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN);
++ if (opt->flags & IPSET_DIM_ONE_SRC)
++ ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
++ else
++ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
++
+ if (ether_addr_equal(e.ether, invalid_ether))
+ return -EINVAL;
+
+diff --git a/net/netfilter/ipset/ip_set_hash_mac.c b/net/netfilter/ipset/ip_set_hash_mac.c
+index f9d5a2a1e3d0..4fe5f243d0a3 100644
+--- a/net/netfilter/ipset/ip_set_hash_mac.c
++++ b/net/netfilter/ipset/ip_set_hash_mac.c
+@@ -81,15 +81,15 @@ hash_mac4_kadt(struct ip_set *set, const struct sk_buff *skb,
+ struct hash_mac4_elem e = { { .foo[0] = 0, .foo[1] = 0 } };
+ struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
+
+- /* MAC can be src only */
+- if (!(opt->flags & IPSET_DIM_ONE_SRC))
+- return 0;
+-
+ if (skb_mac_header(skb) < skb->head ||
+ (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ return -EINVAL;
+
+- ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
++ if (opt->flags & IPSET_DIM_ONE_SRC)
++ ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
++ else
++ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
++
+ if (is_zero_ether_addr(e.ether))
+ return -EINVAL;
+ return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
+diff --git a/samples/bpf/bpf_load.c b/samples/bpf/bpf_load.c
+index 904e775d1a44..cf40a8284a38 100644
+--- a/samples/bpf/bpf_load.c
++++ b/samples/bpf/bpf_load.c
+@@ -55,6 +55,23 @@ static int populate_prog_array(const char *event, int prog_fd)
+ return 0;
+ }
+
++static int write_kprobe_events(const char *val)
++{
++ int fd, ret, flags;
++
++ if ((val != NULL) && (val[0] == '\0'))
++ flags = O_WRONLY | O_TRUNC;
++ else
++ flags = O_WRONLY | O_APPEND;
++
++ fd = open("/sys/kernel/debug/tracing/kprobe_events", flags);
++
++ ret = write(fd, val, strlen(val));
++ close(fd);
++
++ return ret;
++}
++
+ static int load_and_attach(const char *event, struct bpf_insn *prog, int size)
+ {
+ bool is_socket = strncmp(event, "socket", 6) == 0;
+@@ -166,10 +183,9 @@ static int load_and_attach(const char *event, struct bpf_insn *prog, int size)
+
+ #ifdef __x86_64__
+ if (strncmp(event, "sys_", 4) == 0) {
+- snprintf(buf, sizeof(buf),
+- "echo '%c:__x64_%s __x64_%s' >> /sys/kernel/debug/tracing/kprobe_events",
+- is_kprobe ? 'p' : 'r', event, event);
+- err = system(buf);
++ snprintf(buf, sizeof(buf), "%c:__x64_%s __x64_%s",
++ is_kprobe ? 'p' : 'r', event, event);
++ err = write_kprobe_events(buf);
+ if (err >= 0) {
+ need_normal_check = false;
+ event_prefix = "__x64_";
+@@ -177,10 +193,9 @@ static int load_and_attach(const char *event, struct bpf_insn *prog, int size)
+ }
+ #endif
+ if (need_normal_check) {
+- snprintf(buf, sizeof(buf),
+- "echo '%c:%s %s' >> /sys/kernel/debug/tracing/kprobe_events",
+- is_kprobe ? 'p' : 'r', event, event);
+- err = system(buf);
++ snprintf(buf, sizeof(buf), "%c:%s %s",
++ is_kprobe ? 'p' : 'r', event, event);
++ err = write_kprobe_events(buf);
+ if (err < 0) {
+ printf("failed to create kprobe '%s' error '%s'\n",
+ event, strerror(errno));
+@@ -520,7 +535,7 @@ static int do_load_bpf_file(const char *path, fixup_map_cb fixup_map)
+ return 1;
+
+ /* clear all kprobes */
+- i = system("echo \"\" > /sys/kernel/debug/tracing/kprobe_events");
++ i = write_kprobe_events("");
+
+ /* scan over all elf sections to get license and map info */
+ for (i = 1; i < ehdr.e_shnum; i++) {
+diff --git a/scripts/kconfig/zconf.l b/scripts/kconfig/zconf.l
+index 25bd2b89fe3f..c2f577d71964 100644
+--- a/scripts/kconfig/zconf.l
++++ b/scripts/kconfig/zconf.l
+@@ -73,7 +73,7 @@ static void warn_ignored_character(char chr)
+ {
+ fprintf(stderr,
+ "%s:%d:warning: ignoring unsupported character '%c'\n",
+- zconf_curname(), zconf_lineno(), chr);
++ current_file->name, yylineno, chr);
+ }
+ %}
+
+@@ -221,6 +221,8 @@ n [A-Za-z0-9_-]
+ }
+ <<EOF>> {
+ BEGIN(INITIAL);
++ yylval.string = text;
++ return T_WORD_QUOTE;
+ }
+ }
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index fe251c6f09f1..3c3878f0d2fa 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -2934,7 +2934,7 @@ static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
+ return rc;
+
+ /* Allow all mounts performed by the kernel */
+- if (flags & MS_KERNMOUNT)
++ if (flags & (MS_KERNMOUNT | MS_SUBMOUNT))
+ return 0;
+
+ ad.type = LSM_AUDIT_DATA_DENTRY;
+diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig
+index 529d9f405fa9..0cb65d0864cc 100644
+--- a/sound/firewire/Kconfig
++++ b/sound/firewire/Kconfig
+@@ -41,6 +41,7 @@ config SND_OXFW
+ * Mackie(Loud) U.420/U.420d
+ * TASCAM FireOne
+ * Stanton Controllers & Systems 1 Deck/Mixer
++ * APOGEE duet FireWire
+
+ To compile this driver as a module, choose M here: the module
+ will be called snd-oxfw.
+diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
+index 93676354f87f..de4af8a41ff0 100644
+--- a/sound/firewire/bebob/bebob.c
++++ b/sound/firewire/bebob/bebob.c
+@@ -434,7 +434,7 @@ static const struct ieee1394_device_id bebob_id_table[] = {
+ /* Apogee Electronics, DA/AD/DD-16X (X-FireWire card) */
+ SND_BEBOB_DEV_ENTRY(VEN_APOGEE, 0x00010048, &spec_normal),
+ /* Apogee Electronics, Ensemble */
+- SND_BEBOB_DEV_ENTRY(VEN_APOGEE, 0x00001eee, &spec_normal),
++ SND_BEBOB_DEV_ENTRY(VEN_APOGEE, 0x01eeee, &spec_normal),
+ /* ESI, Quatafire610 */
+ SND_BEBOB_DEV_ENTRY(VEN_ESI, 0x00010064, &spec_normal),
+ /* AcousticReality, eARMasterOne */
+diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
+index 2ea8be6c8584..5f82a375725a 100644
+--- a/sound/firewire/oxfw/oxfw.c
++++ b/sound/firewire/oxfw/oxfw.c
+@@ -20,6 +20,7 @@
+ #define VENDOR_LACIE 0x00d04b
+ #define VENDOR_TASCAM 0x00022e
+ #define OUI_STANTON 0x001260
++#define OUI_APOGEE 0x0003db
+
+ #define MODEL_SATELLITE 0x00200f
+
+@@ -436,6 +437,13 @@ static const struct ieee1394_device_id oxfw_id_table[] = {
+ .vendor_id = OUI_STANTON,
+ .model_id = 0x002000,
+ },
++ // APOGEE, duet FireWire
++ {
++ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_MODEL_ID,
++ .vendor_id = OUI_APOGEE,
++ .model_id = 0x01dddd,
++ },
+ { }
+ };
+ MODULE_DEVICE_TABLE(ieee1394, oxfw_id_table);
+diff --git a/sound/soc/amd/acp-pcm-dma.c b/sound/soc/amd/acp-pcm-dma.c
+index 3135e9eafd18..7f376b63a166 100644
+--- a/sound/soc/amd/acp-pcm-dma.c
++++ b/sound/soc/amd/acp-pcm-dma.c
+@@ -1147,18 +1147,21 @@ static int acp_dma_new(struct snd_soc_pcm_runtime *rtd)
+ struct snd_soc_component *component = snd_soc_rtdcom_lookup(rtd,
+ DRV_NAME);
+ struct audio_drv_data *adata = dev_get_drvdata(component->dev);
++ struct device *parent = component->dev->parent;
+
+ switch (adata->asic_type) {
+ case CHIP_STONEY:
+ ret = snd_pcm_lib_preallocate_pages_for_all(rtd->pcm,
+ SNDRV_DMA_TYPE_DEV,
+- NULL, ST_MIN_BUFFER,
++ parent,
++ ST_MIN_BUFFER,
+ ST_MAX_BUFFER);
+ break;
+ default:
+ ret = snd_pcm_lib_preallocate_pages_for_all(rtd->pcm,
+ SNDRV_DMA_TYPE_DEV,
+- NULL, MIN_BUFFER,
++ parent,
++ MIN_BUFFER,
+ MAX_BUFFER);
+ break;
+ }
+diff --git a/sound/soc/codecs/pcm3168a.c b/sound/soc/codecs/pcm3168a.c
+index 3356c91f55b0..e3de1ff3b6c2 100644
+--- a/sound/soc/codecs/pcm3168a.c
++++ b/sound/soc/codecs/pcm3168a.c
+@@ -688,15 +688,22 @@ err_clk:
+ }
+ EXPORT_SYMBOL_GPL(pcm3168a_probe);
+
+-void pcm3168a_remove(struct device *dev)
++static void pcm3168a_disable(struct device *dev)
+ {
+ struct pcm3168a_priv *pcm3168a = dev_get_drvdata(dev);
+
+- pm_runtime_disable(dev);
+ regulator_bulk_disable(ARRAY_SIZE(pcm3168a->supplies),
+- pcm3168a->supplies);
++ pcm3168a->supplies);
+ clk_disable_unprepare(pcm3168a->scki);
+ }
++
++void pcm3168a_remove(struct device *dev)
++{
++ pm_runtime_disable(dev);
++#ifndef CONFIG_PM
++ pcm3168a_disable(dev);
++#endif
++}
+ EXPORT_SYMBOL_GPL(pcm3168a_remove);
+
+ #ifdef CONFIG_PM
+@@ -751,10 +758,7 @@ static int pcm3168a_rt_suspend(struct device *dev)
+
+ regcache_cache_only(pcm3168a->regmap, true);
+
+- regulator_bulk_disable(ARRAY_SIZE(pcm3168a->supplies),
+- pcm3168a->supplies);
+-
+- clk_disable_unprepare(pcm3168a->scki);
++ pcm3168a_disable(dev);
+
+ return 0;
+ }
+diff --git a/tools/lib/subcmd/Makefile b/tools/lib/subcmd/Makefile
+index 95563b8e1ad7..ed61fb3a46c0 100644
+--- a/tools/lib/subcmd/Makefile
++++ b/tools/lib/subcmd/Makefile
+@@ -36,8 +36,6 @@ endif
+ CFLAGS += -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE
+
+ CFLAGS += -I$(srctree)/tools/include/
+-CFLAGS += -I$(srctree)/include/uapi
+-CFLAGS += -I$(srctree)/include
+
+ SUBCMD_IN := $(OUTPUT)libsubcmd-in.o
+
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index e30d20fb482d..f00ea77f5f08 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -294,6 +294,8 @@ ifndef NO_BIONIC
+ $(call feature_check,bionic)
+ ifeq ($(feature-bionic), 1)
+ BIONIC := 1
++ CFLAGS += -DLACKS_SIGQUEUE_PROTOTYPE
++ CFLAGS += -DLACKS_OPEN_MEMSTREAM_PROTOTYPE
+ EXTLIBS := $(filter-out -lrt,$(EXTLIBS))
+ EXTLIBS := $(filter-out -lpthread,$(EXTLIBS))
+ endif
+diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c
+index db0ba8caf5a2..ba8ecaf52200 100644
+--- a/tools/perf/arch/x86/util/intel-pt.c
++++ b/tools/perf/arch/x86/util/intel-pt.c
+@@ -524,10 +524,21 @@ static int intel_pt_validate_config(struct perf_pmu *intel_pt_pmu,
+ struct perf_evsel *evsel)
+ {
+ int err;
++ char c;
+
+ if (!evsel)
+ return 0;
+
++ /*
++ * If supported, force pass-through config term (pt=1) even if user
++ * sets pt=0, which avoids senseless kernel errors.
++ */
++ if (perf_pmu__scan_file(intel_pt_pmu, "format/pt", "%c", &c) == 1 &&
++ !(evsel->attr.config & 1)) {
++ pr_warning("pt=0 doesn't make sense, forcing pt=1\n");
++ evsel->attr.config |= 1;
++ }
++
+ err = intel_pt_val_config_term(intel_pt_pmu, "caps/cycle_thresholds",
+ "cyc_thresh", "caps/psb_cyc",
+ evsel->attr.config);
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index d097b5b47eb8..40720150ccd8 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -1961,7 +1961,7 @@ static int parse_metric_groups(const struct option *opt,
+ return metricgroup__parse_groups(opt, str, &metric_events);
+ }
+
+-static const struct option stat_options[] = {
++static struct option stat_options[] = {
+ OPT_BOOLEAN('T', "transaction", &transaction_run,
+ "hardware transaction statistics"),
+ OPT_CALLBACK('e', "event", &evsel_list, "event",
+@@ -2847,6 +2847,12 @@ int cmd_stat(int argc, const char **argv)
+ return -ENOMEM;
+
+ parse_events__shrink_config_terms();
++
++ /* String-parsing callback-based options would segfault when negated */
++ set_option_flag(stat_options, 'e', "event", PARSE_OPT_NONEG);
++ set_option_flag(stat_options, 'M', "metrics", PARSE_OPT_NONEG);
++ set_option_flag(stat_options, 'G', "cgroup", PARSE_OPT_NONEG);
++
+ argc = parse_options_subcommand(argc, argv, stat_options, stat_subcommands,
+ (const char **) stat_usage,
+ PARSE_OPT_STOP_AT_NON_OPTION);
+diff --git a/tools/perf/builtin-timechart.c b/tools/perf/builtin-timechart.c
+index a827919c6263..775b99833e51 100644
+--- a/tools/perf/builtin-timechart.c
++++ b/tools/perf/builtin-timechart.c
+@@ -43,6 +43,10 @@
+ #include "util/data.h"
+ #include "util/debug.h"
+
++#ifdef LACKS_OPEN_MEMSTREAM_PROTOTYPE
++FILE *open_memstream(char **ptr, size_t *sizeloc);
++#endif
++
+ #define SUPPORT_OLD_POWER_EVENTS 1
+ #define PWR_EVENT_EXIT -1
+
+diff --git a/tools/perf/pmu-events/arch/x86/skylake/skl-metrics.json b/tools/perf/pmu-events/arch/x86/skylake/skl-metrics.json
+index 36c903faed0b..71e9737f4614 100644
+--- a/tools/perf/pmu-events/arch/x86/skylake/skl-metrics.json
++++ b/tools/perf/pmu-events/arch/x86/skylake/skl-metrics.json
+@@ -73,7 +73,7 @@
+ },
+ {
+ "BriefDescription": "Actual Average Latency for L1 data-cache miss demand loads",
+- "MetricExpr": "L1D_PEND_MISS.PENDING / ( MEM_LOAD_RETIRED.L1_MISS_PS + MEM_LOAD_RETIRED.FB_HIT_PS )",
++ "MetricExpr": "L1D_PEND_MISS.PENDING / ( MEM_LOAD_RETIRED.L1_MISS + MEM_LOAD_RETIRED.FB_HIT )",
+ "MetricGroup": "Memory_Bound;Memory_Lat",
+ "MetricName": "Load_Miss_Real_Latency"
+ },
+diff --git a/tools/perf/pmu-events/arch/x86/skylakex/skx-metrics.json b/tools/perf/pmu-events/arch/x86/skylakex/skx-metrics.json
+index 36c903faed0b..71e9737f4614 100644
+--- a/tools/perf/pmu-events/arch/x86/skylakex/skx-metrics.json
++++ b/tools/perf/pmu-events/arch/x86/skylakex/skx-metrics.json
+@@ -73,7 +73,7 @@
+ },
+ {
+ "BriefDescription": "Actual Average Latency for L1 data-cache miss demand loads",
+- "MetricExpr": "L1D_PEND_MISS.PENDING / ( MEM_LOAD_RETIRED.L1_MISS_PS + MEM_LOAD_RETIRED.FB_HIT_PS )",
++ "MetricExpr": "L1D_PEND_MISS.PENDING / ( MEM_LOAD_RETIRED.L1_MISS + MEM_LOAD_RETIRED.FB_HIT )",
+ "MetricGroup": "Memory_Bound;Memory_Lat",
+ "MetricName": "Load_Miss_Real_Latency"
+ },
+diff --git a/tools/perf/tests/bp_signal.c b/tools/perf/tests/bp_signal.c
+index a467615c5a0e..910e25e64188 100644
+--- a/tools/perf/tests/bp_signal.c
++++ b/tools/perf/tests/bp_signal.c
+@@ -291,12 +291,20 @@ int test__bp_signal(struct test *test __maybe_unused, int subtest __maybe_unused
+
+ bool test__bp_signal_is_supported(void)
+ {
+-/*
+- * The powerpc so far does not have support to even create
+- * instruction breakpoint using the perf event interface.
+- * Once it's there we can release this.
+- */
+-#if defined(__powerpc__) || defined(__s390x__)
++ /*
++ * PowerPC and S390 do not support creation of instruction
++ * breakpoints using the perf_event interface.
++ *
++ * ARM requires explicit rounding down of the instruction
++ * pointer in Thumb mode, and then requires the single-step
++ * to be handled explicitly in the overflow handler to avoid
++ * stepping into the SIGIO handler and getting stuck on the
++ * breakpointed instruction.
++ *
++ * Just disable the test for these architectures until these
++ * issues are resolved.
++ */
++#if defined(__powerpc__) || defined(__s390x__) || defined(__arm__)
+ return false;
+ #else
+ return true;
+diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
+index ca577658e890..7b5e15cc6b71 100644
+--- a/tools/perf/util/cs-etm.c
++++ b/tools/perf/util/cs-etm.c
+@@ -1005,7 +1005,7 @@ static int cs_etm__flush(struct cs_etm_queue *etmq)
+ }
+
+ swap_packet:
+- if (etmq->etm->synth_opts.last_branch) {
++ if (etm->sample_branches || etm->synth_opts.last_branch) {
+ /*
+ * Swap PACKET with PREV_PACKET: PACKET becomes PREV_PACKET for
+ * the next incoming packet.
+diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
+index be440df29615..819aa4491b53 100644
+--- a/tools/perf/util/evlist.c
++++ b/tools/perf/util/evlist.c
+@@ -34,6 +34,10 @@
+ #include <linux/log2.h>
+ #include <linux/err.h>
+
++#ifdef LACKS_SIGQUEUE_PROTOTYPE
++int sigqueue(pid_t pid, int sig, const union sigval value);
++#endif
++
+ #define FD(e, x, y) (*(int *)xyarray__entry(e->fd, x, y))
+ #define SID(e, x, y) xyarray__entry(e->sample_id, x, y)
+
+diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
+index f8cd3e7c9186..ebb18a9bc460 100644
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -2454,7 +2454,7 @@ restart:
+ if (!name_only && strlen(syms->alias))
+ snprintf(name, MAX_NAME_LEN, "%s OR %s", syms->symbol, syms->alias);
+ else
+- strncpy(name, syms->symbol, MAX_NAME_LEN);
++ strlcpy(name, syms->symbol, MAX_NAME_LEN);
+
+ evt_list[evt_i] = strdup(name);
+ if (evt_list[evt_i] == NULL)
+diff --git a/tools/perf/util/svghelper.c b/tools/perf/util/svghelper.c
+index 1cbada2dc6be..f735ee038713 100644
+--- a/tools/perf/util/svghelper.c
++++ b/tools/perf/util/svghelper.c
+@@ -334,7 +334,7 @@ static char *cpu_model(void)
+ if (file) {
+ while (fgets(buf, 255, file)) {
+ if (strstr(buf, "model name")) {
+- strncpy(cpu_m, &buf[13], 255);
++ strlcpy(cpu_m, &buf[13], 255);
+ break;
+ }
+ }
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index fff7fb1285fc..f3f874ba186b 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -124,6 +124,16 @@ endif
+ endif
+ endif
+
++# Have one program compiled without "-target bpf" to test whether libbpf loads
++# it successfully
++$(OUTPUT)/test_xdp.o: test_xdp.c
++ $(CLANG) $(CLANG_FLAGS) \
++ -O2 -emit-llvm -c $< -o - | \
++ $(LLC) -march=bpf -mcpu=$(CPU) $(LLC_FLAGS) -filetype=obj -o $@
++ifeq ($(DWARF2BTF),y)
++ $(BTF_PAHOLE) -J $@
++endif
++
+ $(OUTPUT)/%.o: %.c
+ $(CLANG) $(CLANG_FLAGS) \
+ -O2 -target bpf -emit-llvm -c $< -o - | \
+diff --git a/tools/testing/selftests/bpf/test_libbpf.sh b/tools/testing/selftests/bpf/test_libbpf.sh
+index d97dc914cd49..8b1bc96d8e0c 100755
+--- a/tools/testing/selftests/bpf/test_libbpf.sh
++++ b/tools/testing/selftests/bpf/test_libbpf.sh
+@@ -33,17 +33,11 @@ trap exit_handler 0 2 3 6 9
+
+ libbpf_open_file test_l4lb.o
+
+-# TODO: fix libbpf to load noinline functions
+-# [warning] libbpf: incorrect bpf_call opcode
+-#libbpf_open_file test_l4lb_noinline.o
++# Load a program with BPF-to-BPF calls
++libbpf_open_file test_l4lb_noinline.o
+
+-# TODO: fix test_xdp_meta.c to load with libbpf
+-# [warning] libbpf: test_xdp_meta.o doesn't provide kernel version
+-#libbpf_open_file test_xdp_meta.o
+-
+-# TODO: fix libbpf to handle .eh_frame
+-# [warning] libbpf: relocation failed: no section(10)
+-#libbpf_open_file ../../../../samples/bpf/tracex3_kern.o
++# Load a program compiled without the "-target bpf" flag
++libbpf_open_file test_xdp.o
+
+ # Success
+ exit 0
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index e436b67f2426..9db5a7378f40 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -2748,6 +2748,19 @@ static struct bpf_test tests[] = {
+ .result_unpriv = REJECT,
+ .result = ACCEPT,
+ },
++ {
++ "alu32: mov u32 const",
++ .insns = {
++ BPF_MOV32_IMM(BPF_REG_7, 0),
++ BPF_ALU32_IMM(BPF_AND, BPF_REG_7, 1),
++ BPF_MOV32_REG(BPF_REG_0, BPF_REG_7),
++ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
++ BPF_EXIT_INSN(),
++ },
++ .result = ACCEPT,
++ .retval = 0,
++ },
+ {
+ "unpriv: partial copy of pointer",
+ .insns = {
+diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h
+index 6ae3730c4ee3..76d654ef3234 100644
+--- a/tools/testing/selftests/kselftest_harness.h
++++ b/tools/testing/selftests/kselftest_harness.h
+@@ -354,7 +354,7 @@
+ * ASSERT_EQ(expected, measured): expected == measured
+ */
+ #define ASSERT_EQ(expected, seen) \
+- __EXPECT(expected, seen, ==, 1)
++ __EXPECT(expected, #expected, seen, #seen, ==, 1)
+
+ /**
+ * ASSERT_NE(expected, seen)
+@@ -365,7 +365,7 @@
+ * ASSERT_NE(expected, measured): expected != measured
+ */
+ #define ASSERT_NE(expected, seen) \
+- __EXPECT(expected, seen, !=, 1)
++ __EXPECT(expected, #expected, seen, #seen, !=, 1)
+
+ /**
+ * ASSERT_LT(expected, seen)
+@@ -376,7 +376,7 @@
+ * ASSERT_LT(expected, measured): expected < measured
+ */
+ #define ASSERT_LT(expected, seen) \
+- __EXPECT(expected, seen, <, 1)
++ __EXPECT(expected, #expected, seen, #seen, <, 1)
+
+ /**
+ * ASSERT_LE(expected, seen)
+@@ -387,7 +387,7 @@
+ * ASSERT_LE(expected, measured): expected <= measured
+ */
+ #define ASSERT_LE(expected, seen) \
+- __EXPECT(expected, seen, <=, 1)
++ __EXPECT(expected, #expected, seen, #seen, <=, 1)
+
+ /**
+ * ASSERT_GT(expected, seen)
+@@ -398,7 +398,7 @@
+ * ASSERT_GT(expected, measured): expected > measured
+ */
+ #define ASSERT_GT(expected, seen) \
+- __EXPECT(expected, seen, >, 1)
++ __EXPECT(expected, #expected, seen, #seen, >, 1)
+
+ /**
+ * ASSERT_GE(expected, seen)
+@@ -409,7 +409,7 @@
+ * ASSERT_GE(expected, measured): expected >= measured
+ */
+ #define ASSERT_GE(expected, seen) \
+- __EXPECT(expected, seen, >=, 1)
++ __EXPECT(expected, #expected, seen, #seen, >=, 1)
+
+ /**
+ * ASSERT_NULL(seen)
+@@ -419,7 +419,7 @@
+ * ASSERT_NULL(measured): NULL == measured
+ */
+ #define ASSERT_NULL(seen) \
+- __EXPECT(NULL, seen, ==, 1)
++ __EXPECT(NULL, "NULL", seen, #seen, ==, 1)
+
+ /**
+ * ASSERT_TRUE(seen)
+@@ -429,7 +429,7 @@
+ * ASSERT_TRUE(measured): measured != 0
+ */
+ #define ASSERT_TRUE(seen) \
+- ASSERT_NE(0, seen)
++ __EXPECT(0, "0", seen, #seen, !=, 1)
+
+ /**
+ * ASSERT_FALSE(seen)
+@@ -439,7 +439,7 @@
+ * ASSERT_FALSE(measured): measured == 0
+ */
+ #define ASSERT_FALSE(seen) \
+- ASSERT_EQ(0, seen)
++ __EXPECT(0, "0", seen, #seen, ==, 1)
+
+ /**
+ * ASSERT_STREQ(expected, seen)
+@@ -472,7 +472,7 @@
+ * EXPECT_EQ(expected, measured): expected == measured
+ */
+ #define EXPECT_EQ(expected, seen) \
+- __EXPECT(expected, seen, ==, 0)
++ __EXPECT(expected, #expected, seen, #seen, ==, 0)
+
+ /**
+ * EXPECT_NE(expected, seen)
+@@ -483,7 +483,7 @@
+ * EXPECT_NE(expected, measured): expected != measured
+ */
+ #define EXPECT_NE(expected, seen) \
+- __EXPECT(expected, seen, !=, 0)
++ __EXPECT(expected, #expected, seen, #seen, !=, 0)
+
+ /**
+ * EXPECT_LT(expected, seen)
+@@ -494,7 +494,7 @@
+ * EXPECT_LT(expected, measured): expected < measured
+ */
+ #define EXPECT_LT(expected, seen) \
+- __EXPECT(expected, seen, <, 0)
++ __EXPECT(expected, #expected, seen, #seen, <, 0)
+
+ /**
+ * EXPECT_LE(expected, seen)
+@@ -505,7 +505,7 @@
+ * EXPECT_LE(expected, measured): expected <= measured
+ */
+ #define EXPECT_LE(expected, seen) \
+- __EXPECT(expected, seen, <=, 0)
++ __EXPECT(expected, #expected, seen, #seen, <=, 0)
+
+ /**
+ * EXPECT_GT(expected, seen)
+@@ -516,7 +516,7 @@
+ * EXPECT_GT(expected, measured): expected > measured
+ */
+ #define EXPECT_GT(expected, seen) \
+- __EXPECT(expected, seen, >, 0)
++ __EXPECT(expected, #expected, seen, #seen, >, 0)
+
+ /**
+ * EXPECT_GE(expected, seen)
+@@ -527,7 +527,7 @@
+ * EXPECT_GE(expected, measured): expected >= measured
+ */
+ #define EXPECT_GE(expected, seen) \
+- __EXPECT(expected, seen, >=, 0)
++ __EXPECT(expected, #expected, seen, #seen, >=, 0)
+
+ /**
+ * EXPECT_NULL(seen)
+@@ -537,7 +537,7 @@
+ * EXPECT_NULL(measured): NULL == measured
+ */
+ #define EXPECT_NULL(seen) \
+- __EXPECT(NULL, seen, ==, 0)
++ __EXPECT(NULL, "NULL", seen, #seen, ==, 0)
+
+ /**
+ * EXPECT_TRUE(seen)
+@@ -547,7 +547,7 @@
+ * EXPECT_TRUE(measured): 0 != measured
+ */
+ #define EXPECT_TRUE(seen) \
+- EXPECT_NE(0, seen)
++ __EXPECT(0, "0", seen, #seen, !=, 0)
+
+ /**
+ * EXPECT_FALSE(seen)
+@@ -557,7 +557,7 @@
+ * EXPECT_FALSE(measured): 0 == measured
+ */
+ #define EXPECT_FALSE(seen) \
+- EXPECT_EQ(0, seen)
++ __EXPECT(0, "0", seen, #seen, ==, 0)
+
+ /**
+ * EXPECT_STREQ(expected, seen)
+@@ -597,7 +597,7 @@
+ if (_metadata->passed && _metadata->step < 255) \
+ _metadata->step++;
+
+-#define __EXPECT(_expected, _seen, _t, _assert) do { \
++#define __EXPECT(_expected, _expected_str, _seen, _seen_str, _t, _assert) do { \
+ /* Avoid multiple evaluation of the cases */ \
+ __typeof__(_expected) __exp = (_expected); \
+ __typeof__(_seen) __seen = (_seen); \
+@@ -606,8 +606,8 @@
+ unsigned long long __exp_print = (uintptr_t)__exp; \
+ unsigned long long __seen_print = (uintptr_t)__seen; \
+ __TH_LOG("Expected %s (%llu) %s %s (%llu)", \
+- #_expected, __exp_print, #_t, \
+- #_seen, __seen_print); \
++ _expected_str, __exp_print, #_t, \
++ _seen_str, __seen_print); \
+ _metadata->passed = 0; \
+ /* Ensure the optional handler is triggered */ \
+ _metadata->trigger = 1; \
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-01-31 11:28 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-01-31 11:28 UTC (permalink / raw
To: gentoo-commits
commit: 6670ad51f7a31da618109cb0747df2242d01d72d
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jan 31 11:27:26 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jan 31 11:27:26 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6670ad51
proj/linux-patches: Linux patch 4.19.19
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1018_linux-4.19.19.patch | 4389 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4393 insertions(+)
diff --git a/0000_README b/0000_README
index 776e758..b459632 100644
--- a/0000_README
+++ b/0000_README
@@ -115,6 +115,10 @@ Patch: 1017_linux-4.19.18.patch
From: http://www.kernel.org
Desc: Linux 4.19.18
+Patch: 1018_linux-4.19.19.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.19
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1018_linux-4.19.19.patch b/1018_linux-4.19.19.patch
new file mode 100644
index 0000000..ffdaa82
--- /dev/null
+++ b/1018_linux-4.19.19.patch
@@ -0,0 +1,4389 @@
+diff --git a/Makefile b/Makefile
+index 9f37a8a9feb9..39c4e7c3c13c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 18
++SUBLEVEL = 19
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/include/asm/perf_event.h b/arch/arc/include/asm/perf_event.h
+index 9185541035cc..6958545390f0 100644
+--- a/arch/arc/include/asm/perf_event.h
++++ b/arch/arc/include/asm/perf_event.h
+@@ -103,7 +103,8 @@ static const char * const arc_pmu_ev_hw_map[] = {
+
+ /* counts condition */
+ [PERF_COUNT_HW_INSTRUCTIONS] = "iall",
+- [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmp", /* Excludes ZOL jumps */
++ /* All jump instructions that are taken */
++ [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmptak",
+ [PERF_COUNT_ARC_BPOK] = "bpok", /* NP-NT, PT-T, PNT-NT */
+ #ifdef CONFIG_ISA_ARCV2
+ [PERF_COUNT_HW_BRANCH_MISSES] = "bpmp",
+diff --git a/arch/arc/lib/memset-archs.S b/arch/arc/lib/memset-archs.S
+index 62ad4bcb841a..f230bb7092fd 100644
+--- a/arch/arc/lib/memset-archs.S
++++ b/arch/arc/lib/memset-archs.S
+@@ -7,11 +7,39 @@
+ */
+
+ #include <linux/linkage.h>
++#include <asm/cache.h>
+
+-#undef PREALLOC_NOT_AVAIL
++/*
++ * The memset implementation below is optimized to use prefetchw and prealloc
++ * instruction in case of CPU with 64B L1 data cache line (L1_CACHE_SHIFT == 6)
++ * If you want to implement optimized memset for other possible L1 data cache
++ * line lengths (32B and 128B) you should rewrite code carefully checking
++ * we don't call any prefetchw/prealloc instruction for L1 cache lines which
++ * don't belongs to memset area.
++ */
++
++#if L1_CACHE_SHIFT == 6
++
++.macro PREALLOC_INSTR reg, off
++ prealloc [\reg, \off]
++.endm
++
++.macro PREFETCHW_INSTR reg, off
++ prefetchw [\reg, \off]
++.endm
++
++#else
++
++.macro PREALLOC_INSTR
++.endm
++
++.macro PREFETCHW_INSTR
++.endm
++
++#endif
+
+ ENTRY_CFI(memset)
+- prefetchw [r0] ; Prefetch the write location
++ PREFETCHW_INSTR r0, 0 ; Prefetch the first write location
+ mov.f 0, r2
+ ;;; if size is zero
+ jz.d [blink]
+@@ -48,11 +76,8 @@ ENTRY_CFI(memset)
+
+ lpnz @.Lset64bytes
+ ;; LOOP START
+-#ifdef PREALLOC_NOT_AVAIL
+- prefetchw [r3, 64] ;Prefetch the next write location
+-#else
+- prealloc [r3, 64]
+-#endif
++ PREALLOC_INSTR r3, 64 ; alloc next line w/o fetching
++
+ #ifdef CONFIG_ARC_HAS_LL64
+ std.ab r4, [r3, 8]
+ std.ab r4, [r3, 8]
+@@ -85,7 +110,6 @@ ENTRY_CFI(memset)
+ lsr.f lp_count, r2, 5 ;Last remaining max 124 bytes
+ lpnz .Lset32bytes
+ ;; LOOP START
+- prefetchw [r3, 32] ;Prefetch the next write location
+ #ifdef CONFIG_ARC_HAS_LL64
+ std.ab r4, [r3, 8]
+ std.ab r4, [r3, 8]
+diff --git a/arch/arc/mm/init.c b/arch/arc/mm/init.c
+index ba145065c579..f890b2f9f82f 100644
+--- a/arch/arc/mm/init.c
++++ b/arch/arc/mm/init.c
+@@ -138,7 +138,8 @@ void __init setup_arch_memory(void)
+ */
+
+ memblock_add_node(low_mem_start, low_mem_sz, 0);
+- memblock_reserve(low_mem_start, __pa(_end) - low_mem_start);
++ memblock_reserve(CONFIG_LINUX_LINK_BASE,
++ __pa(_end) - CONFIG_LINUX_LINK_BASE);
+
+ #ifdef CONFIG_BLK_DEV_INITRD
+ if (initrd_start)
+diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
+index f1ab9420ccfb..09b61d0e491f 100644
+--- a/arch/s390/include/asm/mmu_context.h
++++ b/arch/s390/include/asm/mmu_context.h
+@@ -89,8 +89,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ {
+ int cpu = smp_processor_id();
+
+- if (prev == next)
+- return;
+ S390_lowcore.user_asce = next->context.asce;
+ cpumask_set_cpu(cpu, &next->context.cpu_attach_mask);
+ /* Clear previous user-ASCE from CR1 and CR7 */
+@@ -102,7 +100,8 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ __ctl_load(S390_lowcore.vdso_asce, 7, 7);
+ clear_cpu_flag(CIF_ASCE_SECONDARY);
+ }
+- cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
++ if (prev != next)
++ cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
+ }
+
+ #define finish_arch_post_lock_switch finish_arch_post_lock_switch
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index 5b28b434f8a1..e7e6608b996c 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -64,10 +64,10 @@ static noinline __init void detect_machine_type(void)
+ if (stsi(vmms, 3, 2, 2) || !vmms->count)
+ return;
+
+- /* Running under KVM? If not we assume z/VM */
++ /* Detect known hypervisors */
+ if (!memcmp(vmms->vm[0].cpi, "\xd2\xe5\xd4", 3))
+ S390_lowcore.machine_flags |= MACHINE_FLAG_KVM;
+- else
++ else if (!memcmp(vmms->vm[0].cpi, "\xa9\x61\xe5\xd4", 4))
+ S390_lowcore.machine_flags |= MACHINE_FLAG_VM;
+ }
+
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index c637c12f9e37..a0097f8bada8 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -882,6 +882,8 @@ void __init setup_arch(char **cmdline_p)
+ pr_info("Linux is running under KVM in 64-bit mode\n");
+ else if (MACHINE_IS_LPAR)
+ pr_info("Linux is running natively in 64-bit mode\n");
++ else
++ pr_info("Linux is running as a guest in 64-bit mode\n");
+
+ /* Have one command line that is parsed and saved in /proc/cmdline */
+ /* boot_command_line has been already set up in early.c */
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index 2f8f7d7dd9a8..da02f4087d61 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -371,9 +371,13 @@ void smp_call_online_cpu(void (*func)(void *), void *data)
+ */
+ void smp_call_ipl_cpu(void (*func)(void *), void *data)
+ {
++ struct lowcore *lc = pcpu_devices->lowcore;
++
++ if (pcpu_devices[0].address == stap())
++ lc = &S390_lowcore;
++
+ pcpu_delegate(&pcpu_devices[0], func, data,
+- pcpu_devices->lowcore->panic_stack -
+- PANIC_FRAME_OFFSET + PAGE_SIZE);
++ lc->panic_stack - PANIC_FRAME_OFFSET + PAGE_SIZE);
+ }
+
+ int smp_find_processor_id(u16 address)
+@@ -1152,7 +1156,11 @@ static ssize_t __ref rescan_store(struct device *dev,
+ {
+ int rc;
+
++ rc = lock_device_hotplug_sysfs();
++ if (rc)
++ return rc;
+ rc = smp_rescan_cpus();
++ unlock_device_hotplug();
+ return rc ? rc : count;
+ }
+ static DEVICE_ATTR_WO(rescan);
+diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
+index 7d0df78db727..40d2834a8101 100644
+--- a/arch/x86/entry/entry_64_compat.S
++++ b/arch/x86/entry/entry_64_compat.S
+@@ -356,7 +356,8 @@ ENTRY(entry_INT80_compat)
+
+ /* Need to switch before accessing the thread stack. */
+ SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
+- movq %rsp, %rdi
++ /* In the Xen PV case we already run on the thread stack. */
++ ALTERNATIVE "movq %rsp, %rdi", "jmp .Lint80_keep_stack", X86_FEATURE_XENPV
+ movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+
+ pushq 6*8(%rdi) /* regs->ss */
+@@ -365,8 +366,9 @@ ENTRY(entry_INT80_compat)
+ pushq 3*8(%rdi) /* regs->cs */
+ pushq 2*8(%rdi) /* regs->ip */
+ pushq 1*8(%rdi) /* regs->orig_ax */
+-
+ pushq (%rdi) /* pt_regs->di */
++.Lint80_keep_stack:
++
+ pushq %rsi /* pt_regs->si */
+ xorl %esi, %esi /* nospec si */
+ pushq %rdx /* pt_regs->dx */
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index eeeb9289c764..2252b63d38b5 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -178,6 +178,10 @@ static inline void switch_ldt(struct mm_struct *prev, struct mm_struct *next)
+
+ void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk);
+
++/*
++ * Init a new mm. Used on mm copies, like at fork()
++ * and on mm's that are brand-new, like at execve().
++ */
+ static inline int init_new_context(struct task_struct *tsk,
+ struct mm_struct *mm)
+ {
+@@ -228,8 +232,22 @@ do { \
+ } while (0)
+ #endif
+
++static inline void arch_dup_pkeys(struct mm_struct *oldmm,
++ struct mm_struct *mm)
++{
++#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
++ if (!cpu_feature_enabled(X86_FEATURE_OSPKE))
++ return;
++
++ /* Duplicate the oldmm pkey state in mm: */
++ mm->context.pkey_allocation_map = oldmm->context.pkey_allocation_map;
++ mm->context.execute_only_pkey = oldmm->context.execute_only_pkey;
++#endif
++}
++
+ static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
+ {
++ arch_dup_pkeys(oldmm, mm);
+ paravirt_arch_dup_mmap(oldmm, mm);
+ return ldt_dup_context(oldmm, mm);
+ }
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index d9b71924c23c..7f89d609095a 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -457,6 +457,7 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
+ #else
+ u64 ipi_bitmap = 0;
+ #endif
++ long ret;
+
+ if (cpumask_empty(mask))
+ return;
+@@ -482,8 +483,9 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
+ } else if (apic_id < min + KVM_IPI_CLUSTER_SIZE) {
+ max = apic_id < max ? max : apic_id;
+ } else {
+- kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
++ ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
+ (unsigned long)(ipi_bitmap >> BITS_PER_LONG), min, icr);
++ WARN_ONCE(ret < 0, "KVM: failed to send PV IPI: %ld", ret);
+ min = max = apic_id;
+ ipi_bitmap = 0;
+ }
+@@ -491,8 +493,9 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
+ }
+
+ if (ipi_bitmap) {
+- kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
++ ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
+ (unsigned long)(ipi_bitmap >> BITS_PER_LONG), min, icr);
++ WARN_ONCE(ret < 0, "KVM: failed to send PV IPI: %ld", ret);
+ }
+
+ local_irq_restore(flags);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 841740045554..39a0e34ff676 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -8290,11 +8290,11 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu)
+ if (r < 0)
+ goto out_vmcs02;
+
+- vmx->nested.cached_vmcs12 = kmalloc(VMCS12_SIZE, GFP_KERNEL);
++ vmx->nested.cached_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
+ if (!vmx->nested.cached_vmcs12)
+ goto out_cached_vmcs12;
+
+- vmx->nested.cached_shadow_vmcs12 = kmalloc(VMCS12_SIZE, GFP_KERNEL);
++ vmx->nested.cached_shadow_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
+ if (!vmx->nested.cached_shadow_vmcs12)
+ goto out_cached_shadow_vmcs12;
+
+@@ -11733,7 +11733,7 @@ static int nested_vmx_check_apicv_controls(struct kvm_vcpu *vcpu,
+ !nested_exit_intr_ack_set(vcpu) ||
+ (vmcs12->posted_intr_nv & 0xff00) ||
+ (vmcs12->posted_intr_desc_addr & 0x3f) ||
+- (!page_address_valid(vcpu, vmcs12->posted_intr_desc_addr))))
++ (vmcs12->posted_intr_desc_addr >> cpuid_maxphyaddr(vcpu))))
+ return -EINVAL;
+
+ /* tpr shadow is needed by all apicv features. */
+@@ -13984,13 +13984,17 @@ static int vmx_get_nested_state(struct kvm_vcpu *vcpu,
+ else if (enable_shadow_vmcs && !vmx->nested.sync_shadow_vmcs)
+ copy_shadow_to_vmcs12(vmx);
+
+- if (copy_to_user(user_kvm_nested_state->data, vmcs12, sizeof(*vmcs12)))
++ /*
++ * Copy over the full allocated size of vmcs12 rather than just the size
++ * of the struct.
++ */
++ if (copy_to_user(user_kvm_nested_state->data, vmcs12, VMCS12_SIZE))
+ return -EFAULT;
+
+ if (nested_cpu_has_shadow_vmcs(vmcs12) &&
+ vmcs12->vmcs_link_pointer != -1ull) {
+ if (copy_to_user(user_kvm_nested_state->data + VMCS12_SIZE,
+- get_shadow_vmcs12(vcpu), sizeof(*vmcs12)))
++ get_shadow_vmcs12(vcpu), VMCS12_SIZE))
+ return -EFAULT;
+ }
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 956eecd227f8..5a9a3ebe8fba 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6277,8 +6277,7 @@ restart:
+ toggle_interruptibility(vcpu, ctxt->interruptibility);
+ vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
+ kvm_rip_write(vcpu, ctxt->eip);
+- if (r == EMULATE_DONE &&
+- (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)))
++ if (r == EMULATE_DONE && ctxt->tf)
+ kvm_vcpu_do_singlestep(vcpu, &r);
+ if (!ctxt->have_exception ||
+ exception_type(ctxt->exception.vector) == EXCPT_TRAP)
+@@ -6868,10 +6867,10 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
+ case KVM_HC_CLOCK_PAIRING:
+ ret = kvm_pv_clock_pairing(vcpu, a0, a1);
+ break;
++#endif
+ case KVM_HC_SEND_IPI:
+ ret = kvm_pv_send_ipi(vcpu->kvm, a0, a1, a2, a3, op_64_bit);
+ break;
+-#endif
+ default:
+ ret = -KVM_ENOSYS;
+ break;
+diff --git a/arch/x86/lib/kaslr.c b/arch/x86/lib/kaslr.c
+index 79778ab200e4..a53665116458 100644
+--- a/arch/x86/lib/kaslr.c
++++ b/arch/x86/lib/kaslr.c
+@@ -36,8 +36,8 @@ static inline u16 i8254(void)
+ u16 status, timer;
+
+ do {
+- outb(I8254_PORT_CONTROL,
+- I8254_CMD_READBACK | I8254_SELECT_COUNTER0);
++ outb(I8254_CMD_READBACK | I8254_SELECT_COUNTER0,
++ I8254_PORT_CONTROL);
+ status = inb(I8254_PORT_COUNTER0);
+ timer = inb(I8254_PORT_COUNTER0);
+ timer |= inb(I8254_PORT_COUNTER0) << 8;
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 75b331f8a16a..ea59c01ce8db 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -391,6 +391,32 @@ static u8 nfit_dsm_revid(unsigned family, unsigned func)
+ return id;
+ }
+
++static int cmd_to_func(struct nfit_mem *nfit_mem, unsigned int cmd,
++ struct nd_cmd_pkg *call_pkg)
++{
++ if (call_pkg) {
++ int i;
++
++ if (nfit_mem->family != call_pkg->nd_family)
++ return -ENOTTY;
++
++ for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
++ if (call_pkg->nd_reserved2[i])
++ return -EINVAL;
++ return call_pkg->nd_command;
++ }
++
++ /* Linux ND commands == NVDIMM_FAMILY_INTEL function numbers */
++ if (nfit_mem->family == NVDIMM_FAMILY_INTEL)
++ return cmd;
++
++ /*
++ * Force function number validation to fail since 0 is never
++ * published as a valid function in dsm_mask.
++ */
++ return 0;
++}
++
+ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc)
+ {
+@@ -404,30 +430,23 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ unsigned long cmd_mask, dsm_mask;
+ u32 offset, fw_status = 0;
+ acpi_handle handle;
+- unsigned int func;
+ const guid_t *guid;
+- int rc, i;
++ int func, rc, i;
+
+ if (cmd_rc)
+ *cmd_rc = -EINVAL;
+- func = cmd;
+- if (cmd == ND_CMD_CALL) {
+- call_pkg = buf;
+- func = call_pkg->nd_command;
+-
+- for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
+- if (call_pkg->nd_reserved2[i])
+- return -EINVAL;
+- }
+
+ if (nvdimm) {
+ struct acpi_device *adev = nfit_mem->adev;
+
+ if (!adev)
+ return -ENOTTY;
+- if (call_pkg && nfit_mem->family != call_pkg->nd_family)
+- return -ENOTTY;
+
++ if (cmd == ND_CMD_CALL)
++ call_pkg = buf;
++ func = cmd_to_func(nfit_mem, cmd, call_pkg);
++ if (func < 0)
++ return func;
+ dimm_name = nvdimm_name(nvdimm);
+ cmd_name = nvdimm_cmd_name(cmd);
+ cmd_mask = nvdimm_cmd_mask(nvdimm);
+@@ -438,6 +457,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ } else {
+ struct acpi_device *adev = to_acpi_dev(acpi_desc);
+
++ func = cmd;
+ cmd_name = nvdimm_bus_cmd_name(cmd);
+ cmd_mask = nd_desc->cmd_mask;
+ dsm_mask = cmd_mask;
+@@ -452,7 +472,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ if (!desc || (cmd && (desc->out_num + desc->in_num == 0)))
+ return -ENOTTY;
+
+- if (!test_bit(cmd, &cmd_mask) || !test_bit(func, &dsm_mask))
++ /*
++ * Check for a valid command. For ND_CMD_CALL, we also have to
++ * make sure that the DSM function is supported.
++ */
++ if (cmd == ND_CMD_CALL && !test_bit(func, &dsm_mask))
++ return -ENOTTY;
++ else if (!test_bit(cmd, &cmd_mask))
+ return -ENOTTY;
+
+ in_obj.type = ACPI_TYPE_PACKAGE;
+@@ -1764,6 +1790,13 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
+ return 0;
+ }
+
++ /*
++ * Function 0 is the command interrogation function, don't
++ * export it to potential userspace use, and enable it to be
++ * used as an error value in acpi_nfit_ctl().
++ */
++ dsm_mask &= ~1UL;
++
+ guid = to_nfit_uuid(nfit_mem->family);
+ for_each_set_bit(i, &dsm_mask, BITS_PER_LONG)
+ if (acpi_check_dsm(adev_dimm->handle, guid,
+diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
+index b5e3103c1175..e43c876a9223 100644
+--- a/drivers/char/mwave/mwavedd.c
++++ b/drivers/char/mwave/mwavedd.c
+@@ -59,6 +59,7 @@
+ #include <linux/mutex.h>
+ #include <linux/delay.h>
+ #include <linux/serial_8250.h>
++#include <linux/nospec.h>
+ #include "smapi.h"
+ #include "mwavedd.h"
+ #include "3780i.h"
+@@ -289,6 +290,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
+ ipcnum);
+ return -EINVAL;
+ }
++ ipcnum = array_index_nospec(ipcnum,
++ ARRAY_SIZE(pDrvData->IPCs));
+ PRINTK_3(TRACE_MWAVE,
+ "mwavedd::mwave_ioctl IOCTL_MW_REGISTER_IPC"
+ " ipcnum %x entry usIntCount %x\n",
+@@ -317,6 +320,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
+ " Invalid ipcnum %x\n", ipcnum);
+ return -EINVAL;
+ }
++ ipcnum = array_index_nospec(ipcnum,
++ ARRAY_SIZE(pDrvData->IPCs));
+ PRINTK_3(TRACE_MWAVE,
+ "mwavedd::mwave_ioctl IOCTL_MW_GET_IPC"
+ " ipcnum %x, usIntCount %x\n",
+@@ -383,6 +388,8 @@ static long mwave_ioctl(struct file *file, unsigned int iocmd,
+ ipcnum);
+ return -EINVAL;
+ }
++ ipcnum = array_index_nospec(ipcnum,
++ ARRAY_SIZE(pDrvData->IPCs));
+ mutex_lock(&mwave_mutex);
+ if (pDrvData->IPCs[ipcnum].bIsEnabled == true) {
+ pDrvData->IPCs[ipcnum].bIsEnabled = false;
+diff --git a/drivers/clk/socfpga/clk-pll-s10.c b/drivers/clk/socfpga/clk-pll-s10.c
+index 2d5d8b43727e..c4d0b6f6abf2 100644
+--- a/drivers/clk/socfpga/clk-pll-s10.c
++++ b/drivers/clk/socfpga/clk-pll-s10.c
+@@ -43,7 +43,7 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hwclk,
+ /* Read mdiv and fdiv from the fdbck register */
+ reg = readl(socfpgaclk->hw.reg + 0x4);
+ mdiv = (reg & SOCFPGA_PLL_MDIV_MASK) >> SOCFPGA_PLL_MDIV_SHIFT;
+- vco_freq = (unsigned long long)parent_rate * (mdiv + 6);
++ vco_freq = (unsigned long long)vco_freq * (mdiv + 6);
+
+ return (unsigned long)vco_freq;
+ }
+diff --git a/drivers/clk/socfpga/clk-s10.c b/drivers/clk/socfpga/clk-s10.c
+index 5b238fc314ac..8281dfbf38c2 100644
+--- a/drivers/clk/socfpga/clk-s10.c
++++ b/drivers/clk/socfpga/clk-s10.c
+@@ -12,17 +12,17 @@
+
+ #include "stratix10-clk.h"
+
+-static const char * const pll_mux[] = { "osc1", "cb_intosc_hs_div2_clk",
+- "f2s_free_clk",};
++static const char * const pll_mux[] = { "osc1", "cb-intosc-hs-div2-clk",
++ "f2s-free-clk",};
+ static const char * const cntr_mux[] = { "main_pll", "periph_pll",
+- "osc1", "cb_intosc_hs_div2_clk",
+- "f2s_free_clk"};
+-static const char * const boot_mux[] = { "osc1", "cb_intosc_hs_div2_clk",};
++ "osc1", "cb-intosc-hs-div2-clk",
++ "f2s-free-clk"};
++static const char * const boot_mux[] = { "osc1", "cb-intosc-hs-div2-clk",};
+
+ static const char * const noc_free_mux[] = {"main_noc_base_clk",
+ "peri_noc_base_clk",
+- "osc1", "cb_intosc_hs_div2_clk",
+- "f2s_free_clk"};
++ "osc1", "cb-intosc-hs-div2-clk",
++ "f2s-free-clk"};
+
+ static const char * const emaca_free_mux[] = {"peri_emaca_clk", "boot_clk"};
+ static const char * const emacb_free_mux[] = {"peri_emacb_clk", "boot_clk"};
+@@ -33,14 +33,14 @@ static const char * const s2f_usr1_free_mux[] = {"peri_s2f_usr1_clk", "boot_clk"
+ static const char * const psi_ref_free_mux[] = {"peri_psi_ref_clk", "boot_clk"};
+ static const char * const mpu_mux[] = { "mpu_free_clk", "boot_clk",};
+
+-static const char * const s2f_usr0_mux[] = {"f2s_free_clk", "boot_clk"};
++static const char * const s2f_usr0_mux[] = {"f2s-free-clk", "boot_clk"};
+ static const char * const emac_mux[] = {"emaca_free_clk", "emacb_free_clk"};
+ static const char * const noc_mux[] = {"noc_free_clk", "boot_clk"};
+
+ static const char * const mpu_free_mux[] = {"main_mpu_base_clk",
+ "peri_mpu_base_clk",
+- "osc1", "cb_intosc_hs_div2_clk",
+- "f2s_free_clk"};
++ "osc1", "cb-intosc-hs-div2-clk",
++ "f2s-free-clk"};
+
+ /* clocks in AO (always on) controller */
+ static const struct stratix10_pll_clock s10_pll_clks[] = {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+index a028661d9e20..92b11de19581 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+@@ -576,6 +576,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
+ { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
++ { 0x1002, 0x6900, 0x17AA, 0x3806, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0, 0, 0, 0, 0 },
+ };
+
+diff --git a/drivers/gpu/drm/meson/meson_crtc.c b/drivers/gpu/drm/meson/meson_crtc.c
+index 191b314f9e9e..709475d5cc30 100644
+--- a/drivers/gpu/drm/meson/meson_crtc.c
++++ b/drivers/gpu/drm/meson/meson_crtc.c
+@@ -45,7 +45,6 @@ struct meson_crtc {
+ struct drm_crtc base;
+ struct drm_pending_vblank_event *event;
+ struct meson_drm *priv;
+- bool enabled;
+ };
+ #define to_meson_crtc(x) container_of(x, struct meson_crtc, base)
+
+@@ -81,7 +80,8 @@ static const struct drm_crtc_funcs meson_crtc_funcs = {
+
+ };
+
+-static void meson_crtc_enable(struct drm_crtc *crtc)
++static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
++ struct drm_crtc_state *old_state)
+ {
+ struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
+ struct drm_crtc_state *crtc_state = crtc->state;
+@@ -103,20 +103,6 @@ static void meson_crtc_enable(struct drm_crtc *crtc)
+
+ drm_crtc_vblank_on(crtc);
+
+- meson_crtc->enabled = true;
+-}
+-
+-static void meson_crtc_atomic_enable(struct drm_crtc *crtc,
+- struct drm_crtc_state *old_state)
+-{
+- struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
+- struct meson_drm *priv = meson_crtc->priv;
+-
+- DRM_DEBUG_DRIVER("\n");
+-
+- if (!meson_crtc->enabled)
+- meson_crtc_enable(crtc);
+-
+ priv->viu.osd1_enabled = true;
+ }
+
+@@ -142,8 +128,6 @@ static void meson_crtc_atomic_disable(struct drm_crtc *crtc,
+
+ crtc->state->event = NULL;
+ }
+-
+- meson_crtc->enabled = false;
+ }
+
+ static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
+@@ -152,9 +136,6 @@ static void meson_crtc_atomic_begin(struct drm_crtc *crtc,
+ struct meson_crtc *meson_crtc = to_meson_crtc(crtc);
+ unsigned long flags;
+
+- if (crtc->state->enable && !meson_crtc->enabled)
+- meson_crtc_enable(crtc);
+-
+ if (crtc->state->event) {
+ WARN_ON(drm_crtc_vblank_get(crtc) != 0);
+
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index d3443125e661..bf5f294f172f 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -82,6 +82,10 @@ static const struct drm_mode_config_funcs meson_mode_config_funcs = {
+ .fb_create = drm_gem_fb_create,
+ };
+
++static const struct drm_mode_config_helper_funcs meson_mode_config_helpers = {
++ .atomic_commit_tail = drm_atomic_helper_commit_tail_rpm,
++};
++
+ static irqreturn_t meson_irq(int irq, void *arg)
+ {
+ struct drm_device *dev = arg;
+@@ -246,6 +250,7 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
+ drm->mode_config.max_width = 3840;
+ drm->mode_config.max_height = 2160;
+ drm->mode_config.funcs = &meson_mode_config_funcs;
++ drm->mode_config.helper_private = &meson_mode_config_helpers;
+
+ /* Hardware Initialization */
+
+diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
+index b1b788082793..d2a735ac9ba1 100644
+--- a/drivers/hv/hv_balloon.c
++++ b/drivers/hv/hv_balloon.c
+@@ -888,12 +888,14 @@ static unsigned long handle_pg_range(unsigned long pg_start,
+ pfn_cnt -= pgs_ol;
+ /*
+ * Check if the corresponding memory block is already
+- * online by checking its last previously backed page.
+- * In case it is we need to bring rest (which was not
+- * backed previously) online too.
++ * online. It is possible to observe struct pages still
++ * being uninitialized here so check section instead.
++ * In case the section is online we need to bring the
++ * rest of pfns (which were not backed previously)
++ * online too.
+ */
+ if (start_pfn > has->start_pfn &&
+- !PageReserved(pfn_to_page(start_pfn - 1)))
++ online_section_nr(pfn_to_section_nr(start_pfn)))
+ hv_bring_pgs_online(has, start_pfn, pgs_ol);
+
+ }
+diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
+index 3e90eb91db45..6cb45f256107 100644
+--- a/drivers/hv/ring_buffer.c
++++ b/drivers/hv/ring_buffer.c
+@@ -164,26 +164,25 @@ hv_get_ringbuffer_availbytes(const struct hv_ring_buffer_info *rbi,
+ }
+
+ /* Get various debug metrics for the specified ring buffer. */
+-void hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
+- struct hv_ring_buffer_debug_info *debug_info)
++int hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
++ struct hv_ring_buffer_debug_info *debug_info)
+ {
+ u32 bytes_avail_towrite;
+ u32 bytes_avail_toread;
+
+- if (ring_info->ring_buffer) {
+- hv_get_ringbuffer_availbytes(ring_info,
+- &bytes_avail_toread,
+- &bytes_avail_towrite);
+-
+- debug_info->bytes_avail_toread = bytes_avail_toread;
+- debug_info->bytes_avail_towrite = bytes_avail_towrite;
+- debug_info->current_read_index =
+- ring_info->ring_buffer->read_index;
+- debug_info->current_write_index =
+- ring_info->ring_buffer->write_index;
+- debug_info->current_interrupt_mask =
+- ring_info->ring_buffer->interrupt_mask;
+- }
++ if (!ring_info->ring_buffer)
++ return -EINVAL;
++
++ hv_get_ringbuffer_availbytes(ring_info,
++ &bytes_avail_toread,
++ &bytes_avail_towrite);
++ debug_info->bytes_avail_toread = bytes_avail_toread;
++ debug_info->bytes_avail_towrite = bytes_avail_towrite;
++ debug_info->current_read_index = ring_info->ring_buffer->read_index;
++ debug_info->current_write_index = ring_info->ring_buffer->write_index;
++ debug_info->current_interrupt_mask
++ = ring_info->ring_buffer->interrupt_mask;
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(hv_ringbuffer_get_debuginfo);
+
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 2c6d5c7a4445..9aa18f387a34 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -313,12 +313,16 @@ static ssize_t out_intr_mask_show(struct device *dev,
+ {
+ struct hv_device *hv_dev = device_to_hv_device(dev);
+ struct hv_ring_buffer_debug_info outbound;
++ int ret;
+
+ if (!hv_dev->channel)
+ return -ENODEV;
+- if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
+- return -EINVAL;
+- hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
++
++ ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
++ &outbound);
++ if (ret < 0)
++ return ret;
++
+ return sprintf(buf, "%d\n", outbound.current_interrupt_mask);
+ }
+ static DEVICE_ATTR_RO(out_intr_mask);
+@@ -328,12 +332,15 @@ static ssize_t out_read_index_show(struct device *dev,
+ {
+ struct hv_device *hv_dev = device_to_hv_device(dev);
+ struct hv_ring_buffer_debug_info outbound;
++ int ret;
+
+ if (!hv_dev->channel)
+ return -ENODEV;
+- if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
+- return -EINVAL;
+- hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
++
++ ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
++ &outbound);
++ if (ret < 0)
++ return ret;
+ return sprintf(buf, "%d\n", outbound.current_read_index);
+ }
+ static DEVICE_ATTR_RO(out_read_index);
+@@ -344,12 +351,15 @@ static ssize_t out_write_index_show(struct device *dev,
+ {
+ struct hv_device *hv_dev = device_to_hv_device(dev);
+ struct hv_ring_buffer_debug_info outbound;
++ int ret;
+
+ if (!hv_dev->channel)
+ return -ENODEV;
+- if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
+- return -EINVAL;
+- hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
++
++ ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
++ &outbound);
++ if (ret < 0)
++ return ret;
+ return sprintf(buf, "%d\n", outbound.current_write_index);
+ }
+ static DEVICE_ATTR_RO(out_write_index);
+@@ -360,12 +370,15 @@ static ssize_t out_read_bytes_avail_show(struct device *dev,
+ {
+ struct hv_device *hv_dev = device_to_hv_device(dev);
+ struct hv_ring_buffer_debug_info outbound;
++ int ret;
+
+ if (!hv_dev->channel)
+ return -ENODEV;
+- if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
+- return -EINVAL;
+- hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
++
++ ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
++ &outbound);
++ if (ret < 0)
++ return ret;
+ return sprintf(buf, "%d\n", outbound.bytes_avail_toread);
+ }
+ static DEVICE_ATTR_RO(out_read_bytes_avail);
+@@ -376,12 +389,15 @@ static ssize_t out_write_bytes_avail_show(struct device *dev,
+ {
+ struct hv_device *hv_dev = device_to_hv_device(dev);
+ struct hv_ring_buffer_debug_info outbound;
++ int ret;
+
+ if (!hv_dev->channel)
+ return -ENODEV;
+- if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
+- return -EINVAL;
+- hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound, &outbound);
++
++ ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->outbound,
++ &outbound);
++ if (ret < 0)
++ return ret;
+ return sprintf(buf, "%d\n", outbound.bytes_avail_towrite);
+ }
+ static DEVICE_ATTR_RO(out_write_bytes_avail);
+@@ -391,12 +407,15 @@ static ssize_t in_intr_mask_show(struct device *dev,
+ {
+ struct hv_device *hv_dev = device_to_hv_device(dev);
+ struct hv_ring_buffer_debug_info inbound;
++ int ret;
+
+ if (!hv_dev->channel)
+ return -ENODEV;
+- if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
+- return -EINVAL;
+- hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
++
++ ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
++ if (ret < 0)
++ return ret;
++
+ return sprintf(buf, "%d\n", inbound.current_interrupt_mask);
+ }
+ static DEVICE_ATTR_RO(in_intr_mask);
+@@ -406,12 +425,15 @@ static ssize_t in_read_index_show(struct device *dev,
+ {
+ struct hv_device *hv_dev = device_to_hv_device(dev);
+ struct hv_ring_buffer_debug_info inbound;
++ int ret;
+
+ if (!hv_dev->channel)
+ return -ENODEV;
+- if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
+- return -EINVAL;
+- hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
++
++ ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
++ if (ret < 0)
++ return ret;
++
+ return sprintf(buf, "%d\n", inbound.current_read_index);
+ }
+ static DEVICE_ATTR_RO(in_read_index);
+@@ -421,12 +443,15 @@ static ssize_t in_write_index_show(struct device *dev,
+ {
+ struct hv_device *hv_dev = device_to_hv_device(dev);
+ struct hv_ring_buffer_debug_info inbound;
++ int ret;
+
+ if (!hv_dev->channel)
+ return -ENODEV;
+- if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
+- return -EINVAL;
+- hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
++
++ ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
++ if (ret < 0)
++ return ret;
++
+ return sprintf(buf, "%d\n", inbound.current_write_index);
+ }
+ static DEVICE_ATTR_RO(in_write_index);
+@@ -437,12 +462,15 @@ static ssize_t in_read_bytes_avail_show(struct device *dev,
+ {
+ struct hv_device *hv_dev = device_to_hv_device(dev);
+ struct hv_ring_buffer_debug_info inbound;
++ int ret;
+
+ if (!hv_dev->channel)
+ return -ENODEV;
+- if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
+- return -EINVAL;
+- hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
++
++ ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
++ if (ret < 0)
++ return ret;
++
+ return sprintf(buf, "%d\n", inbound.bytes_avail_toread);
+ }
+ static DEVICE_ATTR_RO(in_read_bytes_avail);
+@@ -453,12 +481,15 @@ static ssize_t in_write_bytes_avail_show(struct device *dev,
+ {
+ struct hv_device *hv_dev = device_to_hv_device(dev);
+ struct hv_ring_buffer_debug_info inbound;
++ int ret;
+
+ if (!hv_dev->channel)
+ return -ENODEV;
+- if (hv_dev->channel->state != CHANNEL_OPENED_STATE)
+- return -EINVAL;
+- hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
++
++ ret = hv_ringbuffer_get_debuginfo(&hv_dev->channel->inbound, &inbound);
++ if (ret < 0)
++ return ret;
++
+ return sprintf(buf, "%d\n", inbound.bytes_avail_towrite);
+ }
+ static DEVICE_ATTR_RO(in_write_bytes_avail);
+diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
+index 45c997430332..0e51803de0e7 100644
+--- a/drivers/ide/ide-proc.c
++++ b/drivers/ide/ide-proc.c
+@@ -544,7 +544,7 @@ void ide_proc_port_register_devices(ide_hwif_t *hwif)
+ drive->proc = proc_mkdir(drive->name, parent);
+ if (drive->proc) {
+ ide_add_proc_entries(drive->proc, generic_drive_entries, drive);
+- proc_create_data("setting", S_IFREG|S_IRUSR|S_IWUSR,
++ proc_create_data("settings", S_IFREG|S_IRUSR|S_IWUSR,
+ drive->proc, &ide_settings_proc_fops,
+ drive);
+ }
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index cfc8b94527b9..aa4e431cbcd3 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -252,6 +252,8 @@ static const struct xpad_device {
+ { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
+ { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
+ { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX },
++ { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
++ { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+ { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
+ { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
+@@ -428,6 +430,7 @@ static const struct usb_device_id xpad_table[] = {
+ XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f X-Box One controllers */
+ XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */
+ XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */
++ XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries Controllers */
+ XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */
+ XPAD_XBOX360_VENDOR(0x12ab), /* X-Box 360 dance pads */
+ XPAD_XBOX360_VENDOR(0x1430), /* RedOctane X-Box 360 controllers */
+diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
+index 8ec483e8688b..26ec603fe220 100644
+--- a/drivers/input/misc/uinput.c
++++ b/drivers/input/misc/uinput.c
+@@ -39,6 +39,7 @@
+ #include <linux/init.h>
+ #include <linux/fs.h>
+ #include <linux/miscdevice.h>
++#include <linux/overflow.h>
+ #include <linux/input/mt.h>
+ #include "../input-compat.h"
+
+@@ -405,7 +406,7 @@ static int uinput_open(struct inode *inode, struct file *file)
+ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
+ const struct input_absinfo *abs)
+ {
+- int min, max;
++ int min, max, range;
+
+ min = abs->minimum;
+ max = abs->maximum;
+@@ -417,7 +418,7 @@ static int uinput_validate_absinfo(struct input_dev *dev, unsigned int code,
+ return -EINVAL;
+ }
+
+- if (abs->flat > max - min) {
++ if (!check_sub_overflow(max, min, &range) && abs->flat > range) {
+ printk(KERN_DEBUG
+ "%s: abs_flat #%02x out of range: %d (min:%d/max:%d)\n",
+ UINPUT_NAME, code, abs->flat, min, max);
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index c2df341ff6fa..cf3abb8d284f 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2267,13 +2267,14 @@ static void its_free_device(struct its_device *its_dev)
+ kfree(its_dev);
+ }
+
+-static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
++static int its_alloc_device_irq(struct its_device *dev, int nvecs, irq_hw_number_t *hwirq)
+ {
+ int idx;
+
+- idx = find_first_zero_bit(dev->event_map.lpi_map,
+- dev->event_map.nr_lpis);
+- if (idx == dev->event_map.nr_lpis)
++ idx = bitmap_find_free_region(dev->event_map.lpi_map,
++ dev->event_map.nr_lpis,
++ get_count_order(nvecs));
++ if (idx < 0)
+ return -ENOSPC;
+
+ *hwirq = dev->event_map.lpi_base + idx;
+@@ -2369,21 +2370,21 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ int err;
+ int i;
+
+- for (i = 0; i < nr_irqs; i++) {
+- err = its_alloc_device_irq(its_dev, &hwirq);
+- if (err)
+- return err;
++ err = its_alloc_device_irq(its_dev, nr_irqs, &hwirq);
++ if (err)
++ return err;
+
+- err = its_irq_gic_domain_alloc(domain, virq + i, hwirq);
++ for (i = 0; i < nr_irqs; i++) {
++ err = its_irq_gic_domain_alloc(domain, virq + i, hwirq + i);
+ if (err)
+ return err;
+
+ irq_domain_set_hwirq_and_chip(domain, virq + i,
+- hwirq, &its_irq_chip, its_dev);
++ hwirq + i, &its_irq_chip, its_dev);
+ irqd_set_single_target(irq_desc_get_irq_data(irq_to_desc(virq + i)));
+ pr_debug("ID:%d pID:%d vID:%d\n",
+- (int)(hwirq - its_dev->event_map.lpi_base),
+- (int) hwirq, virq + i);
++ (int)(hwirq + i - its_dev->event_map.lpi_base),
++ (int)(hwirq + i), virq + i);
+ }
+
+ return 0;
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index f2ec882f96be..5921ecc670c1 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -2405,9 +2405,21 @@ static int crypt_ctr_cipher_new(struct dm_target *ti, char *cipher_in, char *key
+ * capi:cipher_api_spec-iv:ivopts
+ */
+ tmp = &cipher_in[strlen("capi:")];
+- cipher_api = strsep(&tmp, "-");
+- *ivmode = strsep(&tmp, ":");
+- *ivopts = tmp;
++
++ /* Separate IV options if present, it can contain another '-' in hash name */
++ *ivopts = strrchr(tmp, ':');
++ if (*ivopts) {
++ **ivopts = '\0';
++ (*ivopts)++;
++ }
++ /* Parse IV mode */
++ *ivmode = strrchr(tmp, '-');
++ if (*ivmode) {
++ **ivmode = '\0';
++ (*ivmode)++;
++ }
++ /* The rest is crypto API spec */
++ cipher_api = tmp;
+
+ if (*ivmode && !strcmp(*ivmode, "lmk"))
+ cc->tfms_count = 64;
+@@ -2477,11 +2489,8 @@ static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key
+ goto bad_mem;
+
+ chainmode = strsep(&tmp, "-");
+- *ivopts = strsep(&tmp, "-");
+- *ivmode = strsep(&*ivopts, ":");
+-
+- if (tmp)
+- DMWARN("Ignoring unexpected additional cipher options");
++ *ivmode = strsep(&tmp, ":");
++ *ivopts = tmp;
+
+ /*
+ * For compatibility with the original dm-crypt mapping format, if
+diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
+index 20b0776e39ef..ed3caceaed07 100644
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -1678,7 +1678,7 @@ int dm_thin_remove_range(struct dm_thin_device *td,
+ return r;
+ }
+
+-int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result)
++int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result)
+ {
+ int r;
+ uint32_t ref_count;
+@@ -1686,7 +1686,7 @@ int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *resu
+ down_read(&pmd->root_lock);
+ r = dm_sm_get_count(pmd->data_sm, b, &ref_count);
+ if (!r)
+- *result = (ref_count != 0);
++ *result = (ref_count > 1);
+ up_read(&pmd->root_lock);
+
+ return r;
+diff --git a/drivers/md/dm-thin-metadata.h b/drivers/md/dm-thin-metadata.h
+index 35e954ea20a9..f6be0d733c20 100644
+--- a/drivers/md/dm-thin-metadata.h
++++ b/drivers/md/dm-thin-metadata.h
+@@ -195,7 +195,7 @@ int dm_pool_get_metadata_dev_size(struct dm_pool_metadata *pmd,
+
+ int dm_pool_get_data_dev_size(struct dm_pool_metadata *pmd, dm_block_t *result);
+
+-int dm_pool_block_is_used(struct dm_pool_metadata *pmd, dm_block_t b, bool *result);
++int dm_pool_block_is_shared(struct dm_pool_metadata *pmd, dm_block_t b, bool *result);
+
+ int dm_pool_inc_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_t e);
+ int dm_pool_dec_data_range(struct dm_pool_metadata *pmd, dm_block_t b, dm_block_t e);
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 1f225a1e08dd..c30a7850b2da 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -1048,7 +1048,7 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
+ * passdown we have to check that these blocks are now unused.
+ */
+ int r = 0;
+- bool used = true;
++ bool shared = true;
+ struct thin_c *tc = m->tc;
+ struct pool *pool = tc->pool;
+ dm_block_t b = m->data_block, e, end = m->data_block + m->virt_end - m->virt_begin;
+@@ -1058,11 +1058,11 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
+ while (b != end) {
+ /* find start of unmapped run */
+ for (; b < end; b++) {
+- r = dm_pool_block_is_used(pool->pmd, b, &used);
++ r = dm_pool_block_is_shared(pool->pmd, b, &shared);
+ if (r)
+ goto out;
+
+- if (!used)
++ if (!shared)
+ break;
+ }
+
+@@ -1071,11 +1071,11 @@ static void passdown_double_checking_shared_status(struct dm_thin_new_mapping *m
+
+ /* find end of run */
+ for (e = b + 1; e != end; e++) {
+- r = dm_pool_block_is_used(pool->pmd, e, &used);
++ r = dm_pool_block_is_shared(pool->pmd, e, &shared);
+ if (r)
+ goto out;
+
+- if (used)
++ if (shared)
+ break;
+ }
+
+diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
+index b8aaa684c397..2ed23c99f59f 100644
+--- a/drivers/misc/ibmvmc.c
++++ b/drivers/misc/ibmvmc.c
+@@ -820,21 +820,24 @@ static int ibmvmc_send_msg(struct crq_server_adapter *adapter,
+ *
+ * Return:
+ * 0 - Success
++ * Non-zero - Failure
+ */
+ static int ibmvmc_open(struct inode *inode, struct file *file)
+ {
+ struct ibmvmc_file_session *session;
+- int rc = 0;
+
+ pr_debug("%s: inode = 0x%lx, file = 0x%lx, state = 0x%x\n", __func__,
+ (unsigned long)inode, (unsigned long)file,
+ ibmvmc.state);
+
+ session = kzalloc(sizeof(*session), GFP_KERNEL);
++ if (!session)
++ return -ENOMEM;
++
+ session->file = file;
+ file->private_data = session;
+
+- return rc;
++ return 0;
+ }
+
+ /**
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index e4b10b2d1a08..23739a60517f 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -127,6 +127,8 @@
+ #define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */
+ #define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */
+
++#define MEI_DEV_ID_DNV_IE 0x19E5 /* Denverton IE */
++
+ #define MEI_DEV_ID_GLK 0x319A /* Gemini Lake */
+
+ #define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index ea4e152270a3..c8e21c894a5f 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -88,11 +88,13 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH8_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_DNV_IE, MEI_ME_PCH8_CFG)},
++
+ {MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
+diff --git a/drivers/mmc/host/dw_mmc-bluefield.c b/drivers/mmc/host/dw_mmc-bluefield.c
+index 54c3fbb4a391..db56d4f58aaa 100644
+--- a/drivers/mmc/host/dw_mmc-bluefield.c
++++ b/drivers/mmc/host/dw_mmc-bluefield.c
+@@ -1,11 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+ * Copyright (C) 2018 Mellanox Technologies.
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; either version 2 of the License, or
+- * (at your option) any later version.
+ */
+
+ #include <linux/bitfield.h>
+diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
+index c201c378537e..ef9deaa361c7 100644
+--- a/drivers/mmc/host/meson-gx-mmc.c
++++ b/drivers/mmc/host/meson-gx-mmc.c
+@@ -174,6 +174,8 @@ struct meson_host {
+ struct sd_emmc_desc *descs;
+ dma_addr_t descs_dma_addr;
+
++ int irq;
++
+ bool vqmmc_enabled;
+ };
+
+@@ -1181,7 +1183,7 @@ static int meson_mmc_probe(struct platform_device *pdev)
+ struct resource *res;
+ struct meson_host *host;
+ struct mmc_host *mmc;
+- int ret, irq;
++ int ret;
+
+ mmc = mmc_alloc_host(sizeof(struct meson_host), &pdev->dev);
+ if (!mmc)
+@@ -1228,8 +1230,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
+ goto free_host;
+ }
+
+- irq = platform_get_irq(pdev, 0);
+- if (irq <= 0) {
++ host->irq = platform_get_irq(pdev, 0);
++ if (host->irq <= 0) {
+ dev_err(&pdev->dev, "failed to get interrupt resource.\n");
+ ret = -EINVAL;
+ goto free_host;
+@@ -1283,9 +1285,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
+ writel(IRQ_CRC_ERR | IRQ_TIMEOUTS | IRQ_END_OF_CHAIN,
+ host->regs + SD_EMMC_IRQ_EN);
+
+- ret = devm_request_threaded_irq(&pdev->dev, irq, meson_mmc_irq,
+- meson_mmc_irq_thread, IRQF_SHARED,
+- NULL, host);
++ ret = request_threaded_irq(host->irq, meson_mmc_irq,
++ meson_mmc_irq_thread, IRQF_SHARED, NULL, host);
+ if (ret)
+ goto err_init_clk;
+
+@@ -1303,7 +1304,7 @@ static int meson_mmc_probe(struct platform_device *pdev)
+ if (host->bounce_buf == NULL) {
+ dev_err(host->dev, "Unable to map allocate DMA bounce buffer.\n");
+ ret = -ENOMEM;
+- goto err_init_clk;
++ goto err_free_irq;
+ }
+
+ host->descs = dma_alloc_coherent(host->dev, SD_EMMC_DESC_BUF_LEN,
+@@ -1322,6 +1323,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
+ err_bounce_buf:
+ dma_free_coherent(host->dev, host->bounce_buf_size,
+ host->bounce_buf, host->bounce_dma_addr);
++err_free_irq:
++ free_irq(host->irq, host);
+ err_init_clk:
+ clk_disable_unprepare(host->mmc_clk);
+ err_core_clk:
+@@ -1339,6 +1342,7 @@ static int meson_mmc_remove(struct platform_device *pdev)
+
+ /* disable interrupts */
+ writel(0, host->regs + SD_EMMC_IRQ_EN);
++ free_irq(host->irq, host);
+
+ dma_free_coherent(host->dev, SD_EMMC_DESC_BUF_LEN,
+ host->descs, host->descs_dma_addr);
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 3b3f88ffab53..c05e4d50d43d 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -480,8 +480,6 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
+ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
+ {
+ struct can_priv *priv = netdev_priv(dev);
+- struct sk_buff *skb = priv->echo_skb[idx];
+- struct canfd_frame *cf;
+
+ if (idx >= priv->echo_skb_max) {
+ netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
+@@ -489,20 +487,21 @@ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8
+ return NULL;
+ }
+
+- if (!skb) {
+- netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
+- __func__, idx);
+- return NULL;
+- }
++ if (priv->echo_skb[idx]) {
++ /* Using "struct canfd_frame::len" for the frame
++ * length is supported on both CAN and CANFD frames.
++ */
++ struct sk_buff *skb = priv->echo_skb[idx];
++ struct canfd_frame *cf = (struct canfd_frame *)skb->data;
++ u8 len = cf->len;
+
+- /* Using "struct canfd_frame::len" for the frame
+- * length is supported on both CAN and CANFD frames.
+- */
+- cf = (struct canfd_frame *)skb->data;
+- *len_ptr = cf->len;
+- priv->echo_skb[idx] = NULL;
++ *len_ptr = len;
++ priv->echo_skb[idx] = NULL;
+
+- return skb;
++ return skb;
++ }
++
++ return NULL;
+ }
+
+ /*
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 75ce11395ee8..ae219b8a7754 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -1004,7 +1004,7 @@ static int flexcan_chip_start(struct net_device *dev)
+ }
+ } else {
+ /* clear and invalidate unused mailboxes first */
+- for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= ARRAY_SIZE(regs->mb); i++) {
++ for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i < ARRAY_SIZE(regs->mb); i++) {
+ priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
+ ®s->mb[i].can_ctrl);
+ }
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+index d272dc6984ac..b40d4377cc71 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+@@ -431,8 +431,6 @@
+ #define MAC_MDIOSCAR_PA_WIDTH 5
+ #define MAC_MDIOSCAR_RA_INDEX 0
+ #define MAC_MDIOSCAR_RA_WIDTH 16
+-#define MAC_MDIOSCAR_REG_INDEX 0
+-#define MAC_MDIOSCAR_REG_WIDTH 21
+ #define MAC_MDIOSCCDR_BUSY_INDEX 22
+ #define MAC_MDIOSCCDR_BUSY_WIDTH 1
+ #define MAC_MDIOSCCDR_CMD_INDEX 16
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+index 1e929a1e4ca7..4666084eda16 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+@@ -1284,6 +1284,20 @@ static void xgbe_write_mmd_regs(struct xgbe_prv_data *pdata, int prtad,
+ }
+ }
+
++static unsigned int xgbe_create_mdio_sca(int port, int reg)
++{
++ unsigned int mdio_sca, da;
++
++ da = (reg & MII_ADDR_C45) ? reg >> 16 : 0;
++
++ mdio_sca = 0;
++ XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, RA, reg);
++ XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, PA, port);
++ XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, DA, da);
++
++ return mdio_sca;
++}
++
+ static int xgbe_write_ext_mii_regs(struct xgbe_prv_data *pdata, int addr,
+ int reg, u16 val)
+ {
+@@ -1291,9 +1305,7 @@ static int xgbe_write_ext_mii_regs(struct xgbe_prv_data *pdata, int addr,
+
+ reinit_completion(&pdata->mdio_complete);
+
+- mdio_sca = 0;
+- XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, REG, reg);
+- XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, DA, addr);
++ mdio_sca = xgbe_create_mdio_sca(addr, reg);
+ XGMAC_IOWRITE(pdata, MAC_MDIOSCAR, mdio_sca);
+
+ mdio_sccd = 0;
+@@ -1317,9 +1329,7 @@ static int xgbe_read_ext_mii_regs(struct xgbe_prv_data *pdata, int addr,
+
+ reinit_completion(&pdata->mdio_complete);
+
+- mdio_sca = 0;
+- XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, REG, reg);
+- XGMAC_SET_BITS(mdio_sca, MAC_MDIOSCAR, DA, addr);
++ mdio_sca = xgbe_create_mdio_sca(addr, reg);
+ XGMAC_IOWRITE(pdata, MAC_MDIOSCAR, mdio_sca);
+
+ mdio_sccd = 0;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+index 5890fdfd62c3..c7901a3f2a79 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+@@ -604,29 +604,31 @@ static void mlxsw_pci_cq_tasklet(unsigned long data)
+ u16 wqe_counter = mlxsw_pci_cqe_wqe_counter_get(cqe);
+ u8 sendq = mlxsw_pci_cqe_sr_get(q->u.cq.v, cqe);
+ u8 dqn = mlxsw_pci_cqe_dqn_get(q->u.cq.v, cqe);
++ char ncqe[MLXSW_PCI_CQE_SIZE_MAX];
++
++ memcpy(ncqe, cqe, q->elem_size);
++ mlxsw_pci_queue_doorbell_consumer_ring(mlxsw_pci, q);
+
+ if (sendq) {
+ struct mlxsw_pci_queue *sdq;
+
+ sdq = mlxsw_pci_sdq_get(mlxsw_pci, dqn);
+ mlxsw_pci_cqe_sdq_handle(mlxsw_pci, sdq,
+- wqe_counter, cqe);
++ wqe_counter, ncqe);
+ q->u.cq.comp_sdq_count++;
+ } else {
+ struct mlxsw_pci_queue *rdq;
+
+ rdq = mlxsw_pci_rdq_get(mlxsw_pci, dqn);
+ mlxsw_pci_cqe_rdq_handle(mlxsw_pci, rdq,
+- wqe_counter, q->u.cq.v, cqe);
++ wqe_counter, q->u.cq.v, ncqe);
+ q->u.cq.comp_rdq_count++;
+ }
+ if (++items == credits)
+ break;
+ }
+- if (items) {
+- mlxsw_pci_queue_doorbell_consumer_ring(mlxsw_pci, q);
++ if (items)
+ mlxsw_pci_queue_doorbell_arm_consumer_ring(mlxsw_pci, q);
+- }
+ }
+
+ static u16 mlxsw_pci_cq_elem_count(const struct mlxsw_pci_queue *q)
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
+index 83f452b7ccbb..72cdaa01d56d 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
+@@ -27,7 +27,7 @@
+
+ #define MLXSW_PCI_SW_RESET 0xF0010
+ #define MLXSW_PCI_SW_RESET_RST_BIT BIT(0)
+-#define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS 5000
++#define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS 13000
+ #define MLXSW_PCI_SW_RESET_WAIT_MSECS 100
+ #define MLXSW_PCI_FW_READY 0xA1844
+ #define MLXSW_PCI_FW_READY_MASK 0xFFFF
+@@ -53,6 +53,7 @@
+ #define MLXSW_PCI_WQE_SIZE 32 /* 32 bytes per element */
+ #define MLXSW_PCI_CQE01_SIZE 16 /* 16 bytes per element */
+ #define MLXSW_PCI_CQE2_SIZE 32 /* 32 bytes per element */
++#define MLXSW_PCI_CQE_SIZE_MAX MLXSW_PCI_CQE2_SIZE
+ #define MLXSW_PCI_EQE_SIZE 16 /* 16 bytes per element */
+ #define MLXSW_PCI_WQE_COUNT (MLXSW_PCI_AQ_SIZE / MLXSW_PCI_WQE_SIZE)
+ #define MLXSW_PCI_CQE01_COUNT (MLXSW_PCI_AQ_SIZE / MLXSW_PCI_CQE01_SIZE)
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c
+index 715d24ff937e..562c4429eec7 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c
+@@ -696,8 +696,8 @@ static const struct mlxsw_sp_fid_ops mlxsw_sp_fid_dummy_ops = {
+ static const struct mlxsw_sp_fid_family mlxsw_sp_fid_dummy_family = {
+ .type = MLXSW_SP_FID_TYPE_DUMMY,
+ .fid_size = sizeof(struct mlxsw_sp_fid),
+- .start_index = MLXSW_SP_RFID_BASE - 1,
+- .end_index = MLXSW_SP_RFID_BASE - 1,
++ .start_index = VLAN_N_VID - 1,
++ .end_index = VLAN_N_VID - 1,
+ .ops = &mlxsw_sp_fid_dummy_ops,
+ };
+
+diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
+index 9020b084b953..7ec4eb74fe21 100644
+--- a/drivers/net/ethernet/sun/cassini.c
++++ b/drivers/net/ethernet/sun/cassini.c
+@@ -1,22 +1,9 @@
+-// SPDX-License-Identifier: GPL-2.0
++// SPDX-License-Identifier: GPL-2.0+
+ /* cassini.c: Sun Microsystems Cassini(+) ethernet driver.
+ *
+ * Copyright (C) 2004 Sun Microsystems Inc.
+ * Copyright (C) 2003 Adrian Sun (asun@darksunrising.com)
+ *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License as
+- * published by the Free Software Foundation; either version 2 of the
+- * License, or (at your option) any later version.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- * GNU General Public License for more details.
+- *
+- * You should have received a copy of the GNU General Public License
+- * along with this program; if not, see <http://www.gnu.org/licenses/>.
+- *
+ * This driver uses the sungem driver (c) David Miller
+ * (davem@redhat.com) as its basis.
+ *
+diff --git a/drivers/net/ethernet/sun/cassini.h b/drivers/net/ethernet/sun/cassini.h
+index 13f3860496a8..ae5f05f03f88 100644
+--- a/drivers/net/ethernet/sun/cassini.h
++++ b/drivers/net/ethernet/sun/cassini.h
+@@ -1,23 +1,10 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
++/* SPDX-License-Identifier: GPL-2.0+ */
+ /* $Id: cassini.h,v 1.16 2004/08/17 21:15:16 zaumen Exp $
+ * cassini.h: Definitions for Sun Microsystems Cassini(+) ethernet driver.
+ *
+ * Copyright (C) 2004 Sun Microsystems Inc.
+ * Copyright (c) 2003 Adrian Sun (asun@darksunrising.com)
+ *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License as
+- * published by the Free Software Foundation; either version 2 of the
+- * License, or (at your option) any later version.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- * GNU General Public License for more details.
+- *
+- * You should have received a copy of the GNU General Public License
+- * along with this program; if not, see <http://www.gnu.org/licenses/>.
+- *
+ * vendor id: 0x108E (Sun Microsystems, Inc.)
+ * device id: 0xabba (Cassini)
+ * revision ids: 0x01 = Cassini
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index f7c69ca34056..d71be15c8c69 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -1063,6 +1063,39 @@ static int m88e1145_config_init(struct phy_device *phydev)
+ return 0;
+ }
+
++/* The VOD can be out of specification on link up. Poke an
++ * undocumented register, in an undocumented page, with a magic value
++ * to fix this.
++ */
++static int m88e6390_errata(struct phy_device *phydev)
++{
++ int err;
++
++ err = phy_write(phydev, MII_BMCR,
++ BMCR_ANENABLE | BMCR_SPEED1000 | BMCR_FULLDPLX);
++ if (err)
++ return err;
++
++ usleep_range(300, 400);
++
++ err = phy_write_paged(phydev, 0xf8, 0x08, 0x36);
++ if (err)
++ return err;
++
++ return genphy_soft_reset(phydev);
++}
++
++static int m88e6390_config_aneg(struct phy_device *phydev)
++{
++ int err;
++
++ err = m88e6390_errata(phydev);
++ if (err)
++ return err;
++
++ return m88e1510_config_aneg(phydev);
++}
++
+ /**
+ * fiber_lpa_to_ethtool_lpa_t
+ * @lpa: value of the MII_LPA register for fiber link
+@@ -1418,7 +1451,7 @@ static int m88e1318_set_wol(struct phy_device *phydev,
+ * before enabling it if !phy_interrupt_is_valid()
+ */
+ if (!phy_interrupt_is_valid(phydev))
+- phy_read(phydev, MII_M1011_IEVENT);
++ __phy_read(phydev, MII_M1011_IEVENT);
+
+ /* Enable the WOL interrupt */
+ err = __phy_modify(phydev, MII_88E1318S_PHY_CSIER, 0,
+@@ -2313,7 +2346,7 @@ static struct phy_driver marvell_drivers[] = {
+ .flags = PHY_HAS_INTERRUPT,
+ .probe = m88e6390_probe,
+ .config_init = &marvell_config_init,
+- .config_aneg = &m88e1510_config_aneg,
++ .config_aneg = &m88e6390_config_aneg,
+ .read_status = &marvell_read_status,
+ .ack_interrupt = &marvell_ack_interrupt,
+ .config_intr = &marvell_config_intr,
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index 98f4b1f706df..15c5586d74ff 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -391,6 +391,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
+ if (IS_ERR(gpiod)) {
+ dev_err(&bus->dev, "mii_bus %s couldn't get reset GPIO\n",
+ bus->id);
++ device_del(&bus->dev);
+ return PTR_ERR(gpiod);
+ } else if (gpiod) {
+ bus->reset_gpiod = gpiod;
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index 62dc564b251d..f22639f0116a 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -445,6 +445,7 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
+ if (pskb_trim_rcsum(skb, len))
+ goto drop;
+
++ ph = pppoe_hdr(skb);
+ pn = pppoe_pernet(dev_net(dev));
+
+ /* Note that get_item does a sock_hold(), so sk_pppox(po)
+diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
+index e57f3902beb3..08f997a390d5 100644
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -139,6 +139,10 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc);
+ static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc);
+ static void nvmet_rdma_qp_event(struct ib_event *event, void *priv);
+ static void nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue);
++static void nvmet_rdma_free_rsp(struct nvmet_rdma_device *ndev,
++ struct nvmet_rdma_rsp *r);
++static int nvmet_rdma_alloc_rsp(struct nvmet_rdma_device *ndev,
++ struct nvmet_rdma_rsp *r);
+
+ static const struct nvmet_fabrics_ops nvmet_rdma_ops;
+
+@@ -182,9 +186,17 @@ nvmet_rdma_get_rsp(struct nvmet_rdma_queue *queue)
+ spin_unlock_irqrestore(&queue->rsps_lock, flags);
+
+ if (unlikely(!rsp)) {
+- rsp = kmalloc(sizeof(*rsp), GFP_KERNEL);
++ int ret;
++
++ rsp = kzalloc(sizeof(*rsp), GFP_KERNEL);
+ if (unlikely(!rsp))
+ return NULL;
++ ret = nvmet_rdma_alloc_rsp(queue->dev, rsp);
++ if (unlikely(ret)) {
++ kfree(rsp);
++ return NULL;
++ }
++
+ rsp->allocated = true;
+ }
+
+@@ -196,7 +208,8 @@ nvmet_rdma_put_rsp(struct nvmet_rdma_rsp *rsp)
+ {
+ unsigned long flags;
+
+- if (rsp->allocated) {
++ if (unlikely(rsp->allocated)) {
++ nvmet_rdma_free_rsp(rsp->queue->dev, rsp);
+ kfree(rsp);
+ return;
+ }
+diff --git a/drivers/s390/char/sclp_config.c b/drivers/s390/char/sclp_config.c
+index 194ffd5c8580..039b2074db7e 100644
+--- a/drivers/s390/char/sclp_config.c
++++ b/drivers/s390/char/sclp_config.c
+@@ -60,7 +60,9 @@ static void sclp_cpu_capability_notify(struct work_struct *work)
+
+ static void __ref sclp_cpu_change_notify(struct work_struct *work)
+ {
++ lock_device_hotplug();
+ smp_rescan_cpus();
++ unlock_device_hotplug();
+ }
+
+ static void sclp_conf_receiver_fn(struct evbuf_header *evbuf)
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 0b81d9d03357..12ddb5928a73 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -109,13 +109,19 @@
+ int ufshcd_dump_regs(struct ufs_hba *hba, size_t offset, size_t len,
+ const char *prefix)
+ {
+- u8 *regs;
++ u32 *regs;
++ size_t pos;
++
++ if (offset % 4 != 0 || len % 4 != 0) /* keep readl happy */
++ return -EINVAL;
+
+ regs = kzalloc(len, GFP_KERNEL);
+ if (!regs)
+ return -ENOMEM;
+
+- memcpy_fromio(regs, hba->mmio_base + offset, len);
++ for (pos = 0; pos < len; pos += 4)
++ regs[pos / 4] = ufshcd_readl(hba, offset + pos);
++
+ ufshcd_hex_dump(prefix, regs, len);
+ kfree(regs);
+
+diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+index 28cbd6b3d26c..dfee6985efa6 100644
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -35,6 +35,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
+ {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
+ {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
+ {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
++ {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
+ {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
+ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
+diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
+index dabb391909aa..bb63519db7ae 100644
+--- a/drivers/tty/n_hdlc.c
++++ b/drivers/tty/n_hdlc.c
+@@ -597,6 +597,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
+ /* too large for caller's buffer */
+ ret = -EOVERFLOW;
+ } else {
++ __set_current_state(TASK_RUNNING);
+ if (copy_to_user(buf, rbuf->buf, rbuf->count))
+ ret = -EFAULT;
+ else
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index ad126f51d549..7fe679413188 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -550,10 +550,12 @@ static int uart_put_char(struct tty_struct *tty, unsigned char c)
+ int ret = 0;
+
+ circ = &state->xmit;
+- if (!circ->buf)
++ port = uart_port_lock(state, flags);
++ if (!circ->buf) {
++ uart_port_unlock(port, flags);
+ return 0;
++ }
+
+- port = uart_port_lock(state, flags);
+ if (port && uart_circ_chars_free(circ) != 0) {
+ circ->buf[circ->head] = c;
+ circ->head = (circ->head + 1) & (UART_XMIT_SIZE - 1);
+@@ -586,11 +588,13 @@ static int uart_write(struct tty_struct *tty,
+ return -EL3HLT;
+ }
+
++ port = uart_port_lock(state, flags);
+ circ = &state->xmit;
+- if (!circ->buf)
++ if (!circ->buf) {
++ uart_port_unlock(port, flags);
+ return 0;
++ }
+
+- port = uart_port_lock(state, flags);
+ while (port) {
+ c = CIRC_SPACE_TO_END(circ->head, circ->tail, UART_XMIT_SIZE);
+ if (count < c)
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 052ec16a4e84..e7d192ebecd7 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2188,7 +2188,8 @@ static int tiocsti(struct tty_struct *tty, char __user *p)
+ ld = tty_ldisc_ref_wait(tty);
+ if (!ld)
+ return -EIO;
+- ld->ops->receive_buf(tty, &ch, &mbz, 1);
++ if (ld->ops->receive_buf)
++ ld->ops->receive_buf(tty, &ch, &mbz, 1);
+ tty_ldisc_deref(ld);
+ return 0;
+ }
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 476ec4b1b86c..da335899527b 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1275,6 +1275,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ if (con_is_visible(vc))
+ update_screen(vc);
+ vt_event_post(VT_EVENT_RESIZE, vc->vc_num, vc->vc_num);
++ notify_update(vc);
+ return err;
+ }
+
+@@ -2767,8 +2768,8 @@ rescan_last_byte:
+ con_flush(vc, draw_from, draw_to, &draw_x);
+ vc_uniscr_debug_check(vc);
+ console_conditional_schedule();
+- console_unlock();
+ notify_update(vc);
++ console_unlock();
+ return n;
+ }
+
+@@ -2887,8 +2888,7 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
+ unsigned char c;
+ static DEFINE_SPINLOCK(printing_lock);
+ const ushort *start;
+- ushort cnt = 0;
+- ushort myx;
++ ushort start_x, cnt;
+ int kmsg_console;
+
+ /* console busy or not yet initialized */
+@@ -2901,10 +2901,6 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
+ if (kmsg_console && vc_cons_allocated(kmsg_console - 1))
+ vc = vc_cons[kmsg_console - 1].d;
+
+- /* read `x' only after setting currcons properly (otherwise
+- the `x' macro will read the x of the foreground console). */
+- myx = vc->vc_x;
+-
+ if (!vc_cons_allocated(fg_console)) {
+ /* impossible */
+ /* printk("vt_console_print: tty %d not allocated ??\n", currcons+1); */
+@@ -2919,53 +2915,41 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
+ hide_cursor(vc);
+
+ start = (ushort *)vc->vc_pos;
+-
+- /* Contrived structure to try to emulate original need_wrap behaviour
+- * Problems caused when we have need_wrap set on '\n' character */
++ start_x = vc->vc_x;
++ cnt = 0;
+ while (count--) {
+ c = *b++;
+ if (c == 10 || c == 13 || c == 8 || vc->vc_need_wrap) {
+- if (cnt > 0) {
+- if (con_is_visible(vc))
+- vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x);
+- vc->vc_x += cnt;
+- if (vc->vc_need_wrap)
+- vc->vc_x--;
+- cnt = 0;
+- }
++ if (cnt && con_is_visible(vc))
++ vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x);
++ cnt = 0;
+ if (c == 8) { /* backspace */
+ bs(vc);
+ start = (ushort *)vc->vc_pos;
+- myx = vc->vc_x;
++ start_x = vc->vc_x;
+ continue;
+ }
+ if (c != 13)
+ lf(vc);
+ cr(vc);
+ start = (ushort *)vc->vc_pos;
+- myx = vc->vc_x;
++ start_x = vc->vc_x;
+ if (c == 10 || c == 13)
+ continue;
+ }
++ vc_uniscr_putc(vc, c);
+ scr_writew((vc->vc_attr << 8) + c, (unsigned short *)vc->vc_pos);
+ notify_write(vc, c);
+ cnt++;
+- if (myx == vc->vc_cols - 1) {
+- vc->vc_need_wrap = 1;
+- continue;
+- }
+- vc->vc_pos += 2;
+- myx++;
+- }
+- if (cnt > 0) {
+- if (con_is_visible(vc))
+- vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x);
+- vc->vc_x += cnt;
+- if (vc->vc_x == vc->vc_cols) {
+- vc->vc_x--;
++ if (vc->vc_x == vc->vc_cols - 1) {
+ vc->vc_need_wrap = 1;
++ } else {
++ vc->vc_pos += 2;
++ vc->vc_x++;
+ }
+ }
++ if (cnt && con_is_visible(vc))
++ vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x);
+ set_cursor(vc);
+ notify_update(vc);
+
+diff --git a/drivers/usb/core/ledtrig-usbport.c b/drivers/usb/core/ledtrig-usbport.c
+index dc7f7fd71684..c12ac56606c3 100644
+--- a/drivers/usb/core/ledtrig-usbport.c
++++ b/drivers/usb/core/ledtrig-usbport.c
+@@ -119,11 +119,6 @@ static const struct attribute_group ports_group = {
+ .attrs = ports_attrs,
+ };
+
+-static const struct attribute_group *ports_groups[] = {
+- &ports_group,
+- NULL
+-};
+-
+ /***************************************
+ * Adding & removing ports
+ ***************************************/
+@@ -307,6 +302,7 @@ static int usbport_trig_notify(struct notifier_block *nb, unsigned long action,
+ static int usbport_trig_activate(struct led_classdev *led_cdev)
+ {
+ struct usbport_trig_data *usbport_data;
++ int err;
+
+ usbport_data = kzalloc(sizeof(*usbport_data), GFP_KERNEL);
+ if (!usbport_data)
+@@ -315,6 +311,9 @@ static int usbport_trig_activate(struct led_classdev *led_cdev)
+
+ /* List of ports */
+ INIT_LIST_HEAD(&usbport_data->ports);
++ err = sysfs_create_group(&led_cdev->dev->kobj, &ports_group);
++ if (err)
++ goto err_free;
+ usb_for_each_dev(usbport_data, usbport_trig_add_usb_dev_ports);
+ usbport_trig_update_count(usbport_data);
+
+@@ -322,8 +321,11 @@ static int usbport_trig_activate(struct led_classdev *led_cdev)
+ usbport_data->nb.notifier_call = usbport_trig_notify;
+ led_set_trigger_data(led_cdev, usbport_data);
+ usb_register_notify(&usbport_data->nb);
+-
+ return 0;
++
++err_free:
++ kfree(usbport_data);
++ return err;
+ }
+
+ static void usbport_trig_deactivate(struct led_classdev *led_cdev)
+@@ -335,6 +337,8 @@ static void usbport_trig_deactivate(struct led_classdev *led_cdev)
+ usbport_trig_remove_port(usbport_data, port);
+ }
+
++ sysfs_remove_group(&led_cdev->dev->kobj, &ports_group);
++
+ usb_unregister_notify(&usbport_data->nb);
+
+ kfree(usbport_data);
+@@ -344,7 +348,6 @@ static struct led_trigger usbport_led_trigger = {
+ .name = "usbport",
+ .activate = usbport_trig_activate,
+ .deactivate = usbport_trig_deactivate,
+- .groups = ports_groups,
+ };
+
+ static int __init usbport_trig_init(void)
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 558949b826d0..d8bf9307901e 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -177,6 +177,8 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
+ req->started = false;
+ list_del(&req->list);
+ req->remaining = 0;
++ req->unaligned = false;
++ req->zero = false;
+
+ if (req->request.status == -EINPROGRESS)
+ req->request.status = status;
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index d5b38f096698..5a6df6e9ad57 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -46,6 +46,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) },
++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_TB) },
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID),
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 4e2554d55362..559941ca884d 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -8,6 +8,7 @@
+
+ #define PL2303_VENDOR_ID 0x067b
+ #define PL2303_PRODUCT_ID 0x2303
++#define PL2303_PRODUCT_ID_TB 0x2304
+ #define PL2303_PRODUCT_ID_RSAQ2 0x04bb
+ #define PL2303_PRODUCT_ID_DCU11 0x1234
+ #define PL2303_PRODUCT_ID_PHAROS 0xaaa0
+@@ -20,6 +21,7 @@
+ #define PL2303_PRODUCT_ID_MOTOROLA 0x0307
+ #define PL2303_PRODUCT_ID_ZTEK 0xe1f1
+
++
+ #define ATEN_VENDOR_ID 0x0557
+ #define ATEN_VENDOR_ID2 0x0547
+ #define ATEN_PRODUCT_ID 0x2008
+diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
+index 4d0273508043..edbbb13d6de6 100644
+--- a/drivers/usb/serial/usb-serial-simple.c
++++ b/drivers/usb/serial/usb-serial-simple.c
+@@ -85,7 +85,8 @@ DEVICE(moto_modem, MOTO_IDS);
+ /* Motorola Tetra driver */
+ #define MOTOROLA_TETRA_IDS() \
+ { USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \
+- { USB_DEVICE(0x0cad, 0x9012) } /* MTP6550 */
++ { USB_DEVICE(0x0cad, 0x9012) }, /* MTP6550 */ \
++ { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */
+ DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS);
+
+ /* Novatel Wireless GPS driver */
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index 4e656f89cb22..a86aa65ad66d 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -1024,7 +1024,8 @@ static void handle_rx(struct vhost_net *net)
+ if (nvq->done_idx > VHOST_NET_BATCH)
+ vhost_net_signal_used(nvq);
+ if (unlikely(vq_log))
+- vhost_log_write(vq, vq_log, log, vhost_len);
++ vhost_log_write(vq, vq_log, log, vhost_len,
++ vq->iov, in);
+ total_len += vhost_len;
+ if (unlikely(vhost_exceeds_weight(++recv_pkts, total_len))) {
+ vhost_poll_queue(&vq->poll);
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 55e5aa662ad5..c66fc8308b5e 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -1733,13 +1733,87 @@ static int log_write(void __user *log_base,
+ return r;
+ }
+
++static int log_write_hva(struct vhost_virtqueue *vq, u64 hva, u64 len)
++{
++ struct vhost_umem *umem = vq->umem;
++ struct vhost_umem_node *u;
++ u64 start, end, l, min;
++ int r;
++ bool hit = false;
++
++ while (len) {
++ min = len;
++ /* More than one GPAs can be mapped into a single HVA. So
++ * iterate all possible umems here to be safe.
++ */
++ list_for_each_entry(u, &umem->umem_list, link) {
++ if (u->userspace_addr > hva - 1 + len ||
++ u->userspace_addr - 1 + u->size < hva)
++ continue;
++ start = max(u->userspace_addr, hva);
++ end = min(u->userspace_addr - 1 + u->size,
++ hva - 1 + len);
++ l = end - start + 1;
++ r = log_write(vq->log_base,
++ u->start + start - u->userspace_addr,
++ l);
++ if (r < 0)
++ return r;
++ hit = true;
++ min = min(l, min);
++ }
++
++ if (!hit)
++ return -EFAULT;
++
++ len -= min;
++ hva += min;
++ }
++
++ return 0;
++}
++
++static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len)
++{
++ struct iovec iov[64];
++ int i, ret;
++
++ if (!vq->iotlb)
++ return log_write(vq->log_base, vq->log_addr + used_offset, len);
++
++ ret = translate_desc(vq, (uintptr_t)vq->used + used_offset,
++ len, iov, 64, VHOST_ACCESS_WO);
++ if (ret)
++ return ret;
++
++ for (i = 0; i < ret; i++) {
++ ret = log_write_hva(vq, (uintptr_t)iov[i].iov_base,
++ iov[i].iov_len);
++ if (ret)
++ return ret;
++ }
++
++ return 0;
++}
++
+ int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
+- unsigned int log_num, u64 len)
++ unsigned int log_num, u64 len, struct iovec *iov, int count)
+ {
+ int i, r;
+
+ /* Make sure data written is seen before log. */
+ smp_wmb();
++
++ if (vq->iotlb) {
++ for (i = 0; i < count; i++) {
++ r = log_write_hva(vq, (uintptr_t)iov[i].iov_base,
++ iov[i].iov_len);
++ if (r < 0)
++ return r;
++ }
++ return 0;
++ }
++
+ for (i = 0; i < log_num; ++i) {
+ u64 l = min(log[i].len, len);
+ r = log_write(vq->log_base, log[i].addr, l);
+@@ -1769,9 +1843,8 @@ static int vhost_update_used_flags(struct vhost_virtqueue *vq)
+ smp_wmb();
+ /* Log used flag write. */
+ used = &vq->used->flags;
+- log_write(vq->log_base, vq->log_addr +
+- (used - (void __user *)vq->used),
+- sizeof vq->used->flags);
++ log_used(vq, (used - (void __user *)vq->used),
++ sizeof vq->used->flags);
+ if (vq->log_ctx)
+ eventfd_signal(vq->log_ctx, 1);
+ }
+@@ -1789,9 +1862,8 @@ static int vhost_update_avail_event(struct vhost_virtqueue *vq, u16 avail_event)
+ smp_wmb();
+ /* Log avail event write */
+ used = vhost_avail_event(vq);
+- log_write(vq->log_base, vq->log_addr +
+- (used - (void __user *)vq->used),
+- sizeof *vhost_avail_event(vq));
++ log_used(vq, (used - (void __user *)vq->used),
++ sizeof *vhost_avail_event(vq));
+ if (vq->log_ctx)
+ eventfd_signal(vq->log_ctx, 1);
+ }
+@@ -2191,10 +2263,8 @@ static int __vhost_add_used_n(struct vhost_virtqueue *vq,
+ /* Make sure data is seen before log. */
+ smp_wmb();
+ /* Log used ring entry write. */
+- log_write(vq->log_base,
+- vq->log_addr +
+- ((void __user *)used - (void __user *)vq->used),
+- count * sizeof *used);
++ log_used(vq, ((void __user *)used - (void __user *)vq->used),
++ count * sizeof *used);
+ }
+ old = vq->last_used_idx;
+ new = (vq->last_used_idx += count);
+@@ -2236,9 +2306,8 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads,
+ /* Make sure used idx is seen before log. */
+ smp_wmb();
+ /* Log used index update. */
+- log_write(vq->log_base,
+- vq->log_addr + offsetof(struct vring_used, idx),
+- sizeof vq->used->idx);
++ log_used(vq, offsetof(struct vring_used, idx),
++ sizeof vq->used->idx);
+ if (vq->log_ctx)
+ eventfd_signal(vq->log_ctx, 1);
+ }
+diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
+index 466ef7542291..1b675dad5e05 100644
+--- a/drivers/vhost/vhost.h
++++ b/drivers/vhost/vhost.h
+@@ -205,7 +205,8 @@ bool vhost_vq_avail_empty(struct vhost_dev *, struct vhost_virtqueue *);
+ bool vhost_enable_notify(struct vhost_dev *, struct vhost_virtqueue *);
+
+ int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
+- unsigned int log_num, u64 len);
++ unsigned int log_num, u64 len,
++ struct iovec *iov, int count);
+ int vq_iotlb_prefetch(struct vhost_virtqueue *vq);
+
+ struct vhost_msg_node *vhost_new_msg(struct vhost_virtqueue *vq, int type);
+diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
+index 09731b2f6815..c6b3bdbbdbc9 100644
+--- a/drivers/video/console/vgacon.c
++++ b/drivers/video/console/vgacon.c
+@@ -271,6 +271,7 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
+
+ static void vgacon_restore_screen(struct vc_data *c)
+ {
++ c->vc_origin = c->vc_visible_origin;
+ vgacon_scrollback_cur->save = 0;
+
+ if (!vga_is_gfx && !vgacon_scrollback_cur->restore) {
+@@ -287,8 +288,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
+ int start, end, count, soff;
+
+ if (!lines) {
+- c->vc_visible_origin = c->vc_origin;
+- vga_set_mem_top(c);
++ vgacon_restore_screen(c);
+ return;
+ }
+
+@@ -298,6 +298,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
+ if (!vgacon_scrollback_cur->save) {
+ vgacon_cursor(c, CM_ERASE);
+ vgacon_save_screen(c);
++ c->vc_origin = (unsigned long)c->vc_screenbuf;
+ vgacon_scrollback_cur->save = 1;
+ }
+
+@@ -335,7 +336,7 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
+ int copysize;
+
+ int diff = c->vc_rows - count;
+- void *d = (void *) c->vc_origin;
++ void *d = (void *) c->vc_visible_origin;
+ void *s = (void *) c->vc_screenbuf;
+
+ count *= c->vc_size_row;
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index eadffaa39f4e..c7542e8dd096 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1030,6 +1030,8 @@ static void drop_inode_snap_realm(struct ceph_inode_info *ci)
+ list_del_init(&ci->i_snap_realm_item);
+ ci->i_snap_realm_counter++;
+ ci->i_snap_realm = NULL;
++ if (realm->ino == ci->i_vino.ino)
++ realm->inode = NULL;
+ spin_unlock(&realm->inodes_with_caps_lock);
+ ceph_put_snap_realm(ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc,
+ realm);
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 5657b79dbc99..269471c8f42b 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -1458,18 +1458,26 @@ cifs_discard_remaining_data(struct TCP_Server_Info *server)
+ }
+
+ static int
+-cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
++__cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid,
++ bool malformed)
+ {
+ int length;
+- struct cifs_readdata *rdata = mid->callback_data;
+
+ length = cifs_discard_remaining_data(server);
+- dequeue_mid(mid, rdata->result);
++ dequeue_mid(mid, malformed);
+ mid->resp_buf = server->smallbuf;
+ server->smallbuf = NULL;
+ return length;
+ }
+
++static int
++cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
++{
++ struct cifs_readdata *rdata = mid->callback_data;
++
++ return __cifs_readv_discard(server, mid, rdata->result);
++}
++
+ int
+ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+ {
+@@ -1511,12 +1519,23 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+ return -1;
+ }
+
++ /* set up first two iov for signature check and to get credits */
++ rdata->iov[0].iov_base = buf;
++ rdata->iov[0].iov_len = 4;
++ rdata->iov[1].iov_base = buf + 4;
++ rdata->iov[1].iov_len = server->total_read - 4;
++ cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
++ rdata->iov[0].iov_base, rdata->iov[0].iov_len);
++ cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
++ rdata->iov[1].iov_base, rdata->iov[1].iov_len);
++
+ /* Was the SMB read successful? */
+ rdata->result = server->ops->map_error(buf, false);
+ if (rdata->result != 0) {
+ cifs_dbg(FYI, "%s: server returned error %d\n",
+ __func__, rdata->result);
+- return cifs_readv_discard(server, mid);
++ /* normal error on read response */
++ return __cifs_readv_discard(server, mid, false);
+ }
+
+ /* Is there enough to get to the rest of the READ_RSP header? */
+@@ -1560,14 +1579,6 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+ server->total_read += length;
+ }
+
+- /* set up first iov for signature check */
+- rdata->iov[0].iov_base = buf;
+- rdata->iov[0].iov_len = 4;
+- rdata->iov[1].iov_base = buf + 4;
+- rdata->iov[1].iov_len = server->total_read - 4;
+- cifs_dbg(FYI, "0: iov_base=%p iov_len=%u\n",
+- rdata->iov[0].iov_base, server->total_read);
+-
+ /* how much data is in the response? */
+ #ifdef CONFIG_CIFS_SMB_DIRECT
+ use_rdma_mr = rdata->mr;
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 52d71b64c0c6..d0bba175117c 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -533,6 +533,21 @@ server_unresponsive(struct TCP_Server_Info *server)
+ return false;
+ }
+
++static inline bool
++zero_credits(struct TCP_Server_Info *server)
++{
++ int val;
++
++ spin_lock(&server->req_lock);
++ val = server->credits + server->echo_credits + server->oplock_credits;
++ if (server->in_flight == 0 && val == 0) {
++ spin_unlock(&server->req_lock);
++ return true;
++ }
++ spin_unlock(&server->req_lock);
++ return false;
++}
++
+ static int
+ cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
+ {
+@@ -545,6 +560,12 @@ cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
+ for (total_read = 0; msg_data_left(smb_msg); total_read += length) {
+ try_to_freeze();
+
++ /* reconnect if no credits and no requests in flight */
++ if (zero_credits(server)) {
++ cifs_reconnect(server);
++ return -ECONNABORTED;
++ }
++
+ if (server_unresponsive(server))
+ return -ECONNABORTED;
+ if (cifs_rdma_enabled(server) && server->smbd_conn)
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 6a9c47541c53..7b8b58fb4d3f 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -648,6 +648,13 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ if (rsp->sync_hdr.Command != SMB2_OPLOCK_BREAK)
+ return false;
+
++ if (rsp->sync_hdr.CreditRequest) {
++ spin_lock(&server->req_lock);
++ server->credits += le16_to_cpu(rsp->sync_hdr.CreditRequest);
++ spin_unlock(&server->req_lock);
++ wake_up(&server->request_q);
++ }
++
+ if (rsp->StructureSize !=
+ smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) {
+ if (le16_to_cpu(rsp->StructureSize) == 44)
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index f44bb4a304e9..237d7281ada3 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -34,6 +34,7 @@
+ #include "cifs_ioctl.h"
+ #include "smbdirect.h"
+
++/* Change credits for different ops and return the total number of credits */
+ static int
+ change_conf(struct TCP_Server_Info *server)
+ {
+@@ -41,17 +42,15 @@ change_conf(struct TCP_Server_Info *server)
+ server->oplock_credits = server->echo_credits = 0;
+ switch (server->credits) {
+ case 0:
+- return -1;
++ return 0;
+ case 1:
+ server->echoes = false;
+ server->oplocks = false;
+- cifs_dbg(VFS, "disabling echoes and oplocks\n");
+ break;
+ case 2:
+ server->echoes = true;
+ server->oplocks = false;
+ server->echo_credits = 1;
+- cifs_dbg(FYI, "disabling oplocks\n");
+ break;
+ default:
+ server->echoes = true;
+@@ -64,14 +63,15 @@ change_conf(struct TCP_Server_Info *server)
+ server->echo_credits = 1;
+ }
+ server->credits -= server->echo_credits + server->oplock_credits;
+- return 0;
++ return server->credits + server->echo_credits + server->oplock_credits;
+ }
+
+ static void
+ smb2_add_credits(struct TCP_Server_Info *server, const unsigned int add,
+ const int optype)
+ {
+- int *val, rc = 0;
++ int *val, rc = -1;
++
+ spin_lock(&server->req_lock);
+ val = server->ops->get_credits_field(server, optype);
+ *val += add;
+@@ -95,8 +95,26 @@ smb2_add_credits(struct TCP_Server_Info *server, const unsigned int add,
+ }
+ spin_unlock(&server->req_lock);
+ wake_up(&server->request_q);
+- if (rc)
+- cifs_reconnect(server);
++
++ if (server->tcpStatus == CifsNeedReconnect)
++ return;
++
++ switch (rc) {
++ case -1:
++ /* change_conf hasn't been executed */
++ break;
++ case 0:
++ cifs_dbg(VFS, "Possible client or server bug - zero credits\n");
++ break;
++ case 1:
++ cifs_dbg(VFS, "disabling echoes and oplocks\n");
++ break;
++ case 2:
++ cifs_dbg(FYI, "disabling oplocks\n");
++ break;
++ default:
++ cifs_dbg(FYI, "add %u credits total=%d\n", add, rc);
++ }
+ }
+
+ static void
+@@ -154,14 +172,14 @@ smb2_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
+
+ scredits = server->credits;
+ /* can deadlock with reopen */
+- if (scredits == 1) {
++ if (scredits <= 8) {
+ *num = SMB2_MAX_BUFFER_SIZE;
+ *credits = 0;
+ break;
+ }
+
+- /* leave one credit for a possible reopen */
+- scredits--;
++ /* leave some credits for reopen and other ops */
++ scredits -= 8;
+ *num = min_t(unsigned int, size,
+ scredits * SMB2_MAX_BUFFER_SIZE);
+
+@@ -2901,11 +2919,23 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ server->ops->is_status_pending(buf, server, 0))
+ return -1;
+
+- rdata->result = server->ops->map_error(buf, false);
++ /* set up first two iov to get credits */
++ rdata->iov[0].iov_base = buf;
++ rdata->iov[0].iov_len = 4;
++ rdata->iov[1].iov_base = buf + 4;
++ rdata->iov[1].iov_len =
++ min_t(unsigned int, buf_len, server->vals->read_rsp_size) - 4;
++ cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
++ rdata->iov[0].iov_base, rdata->iov[0].iov_len);
++ cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
++ rdata->iov[1].iov_base, rdata->iov[1].iov_len);
++
++ rdata->result = server->ops->map_error(buf, true);
+ if (rdata->result != 0) {
+ cifs_dbg(FYI, "%s: server returned error %d\n",
+ __func__, rdata->result);
+- dequeue_mid(mid, rdata->result);
++ /* normal error on read response */
++ dequeue_mid(mid, false);
+ return 0;
+ }
+
+@@ -2978,14 +3008,6 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ return 0;
+ }
+
+- /* set up first iov for signature check */
+- rdata->iov[0].iov_base = buf;
+- rdata->iov[0].iov_len = 4;
+- rdata->iov[1].iov_base = buf + 4;
+- rdata->iov[1].iov_len = server->vals->read_rsp_size - 4;
+- cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
+- rdata->iov[0].iov_base, server->vals->read_rsp_size);
+-
+ length = rdata->copy_into_pages(server, rdata, &iter);
+
+ kfree(bvec);
+diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
+index ac6978d3208c..780bba695453 100644
+--- a/fs/notify/inotify/inotify_user.c
++++ b/fs/notify/inotify/inotify_user.c
+@@ -724,8 +724,10 @@ SYSCALL_DEFINE3(inotify_add_watch, int, fd, const char __user *, pathname,
+ return -EBADF;
+
+ /* IN_MASK_ADD and IN_MASK_CREATE don't make sense together */
+- if (unlikely((mask & IN_MASK_ADD) && (mask & IN_MASK_CREATE)))
+- return -EINVAL;
++ if (unlikely((mask & IN_MASK_ADD) && (mask & IN_MASK_CREATE))) {
++ ret = -EINVAL;
++ goto fput_and_out;
++ }
+
+ /* verify that this is indeed an inotify instance */
+ if (unlikely(f.file->f_op != &inotify_fops)) {
+diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
+index 1fd6fa822d2c..91393724e933 100644
+--- a/include/linux/bpf_verifier.h
++++ b/include/linux/bpf_verifier.h
+@@ -134,6 +134,7 @@ struct bpf_verifier_state {
+ struct bpf_func_state *frame[MAX_CALL_FRAMES];
+ struct bpf_verifier_state *parent;
+ u32 curframe;
++ bool speculative;
+ };
+
+ /* linked list of verifier states used to prune search */
+@@ -142,15 +143,25 @@ struct bpf_verifier_state_list {
+ struct bpf_verifier_state_list *next;
+ };
+
++/* Possible states for alu_state member. */
++#define BPF_ALU_SANITIZE_SRC 1U
++#define BPF_ALU_SANITIZE_DST 2U
++#define BPF_ALU_NEG_VALUE (1U << 2)
++#define BPF_ALU_NON_POINTER (1U << 3)
++#define BPF_ALU_SANITIZE (BPF_ALU_SANITIZE_SRC | \
++ BPF_ALU_SANITIZE_DST)
++
+ struct bpf_insn_aux_data {
+ union {
+ enum bpf_reg_type ptr_type; /* pointer type for load/store insns */
+ unsigned long map_state; /* pointer/poison value for maps */
+ s32 call_imm; /* saved imm field of call insn */
++ u32 alu_limit; /* limit for add/sub register with pointer */
+ };
+ int ctx_field_size; /* the ctx field size for load insn, maybe 0 */
+ int sanitize_stack_off; /* stack slot to be cleared */
+ bool seen; /* this insn was processed by the verifier */
++ u8 alu_state; /* used in combination with alu_limit */
+ };
+
+ #define MAX_USED_MAPS 64 /* max number of maps accessed by one eBPF program */
+@@ -186,6 +197,8 @@ struct bpf_subprog_info {
+ * one verifier_env per bpf_check() call
+ */
+ struct bpf_verifier_env {
++ u32 insn_idx;
++ u32 prev_insn_idx;
+ struct bpf_prog *prog; /* eBPF program being verified */
+ const struct bpf_verifier_ops *ops;
+ struct bpf_verifier_stack_elem *head; /* stack of verifier states to be processed */
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index ec90d5255cf7..1a39d57eb88f 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -53,14 +53,10 @@ struct sock_reuseport;
+ #define BPF_REG_D BPF_REG_8 /* data, callee-saved */
+ #define BPF_REG_H BPF_REG_9 /* hlen, callee-saved */
+
+-/* Kernel hidden auxiliary/helper register for hardening step.
+- * Only used by eBPF JITs. It's nothing more than a temporary
+- * register that JITs use internally, only that here it's part
+- * of eBPF instructions that have been rewritten for blinding
+- * constants. See JIT pre-step in bpf_jit_blind_constants().
+- */
++/* Kernel hidden auxiliary/helper register. */
+ #define BPF_REG_AX MAX_BPF_REG
+-#define MAX_BPF_JIT_REG (MAX_BPF_REG + 1)
++#define MAX_BPF_EXT_REG (MAX_BPF_REG + 1)
++#define MAX_BPF_JIT_REG MAX_BPF_EXT_REG
+
+ /* unused opcode to mark special call to bpf_tail_call() helper */
+ #define BPF_TAIL_CALL 0xf0
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index 5185a16b19ba..bbde887ed393 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -1166,8 +1166,9 @@ struct hv_ring_buffer_debug_info {
+ u32 bytes_avail_towrite;
+ };
+
+-void hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
+- struct hv_ring_buffer_debug_info *debug_info);
++
++int hv_ringbuffer_get_debuginfo(const struct hv_ring_buffer_info *ring_info,
++ struct hv_ring_buffer_debug_info *debug_info);
+
+ /* Vmbus interface */
+ #define vmbus_driver_register(driver) \
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 60a2e7646985..5d69e208e8d9 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -3178,6 +3178,7 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len);
+ *
+ * This is exactly the same as pskb_trim except that it ensures the
+ * checksum of received packets are still valid after the operation.
++ * It can change skb pointers.
+ */
+
+ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len)
+diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
+index c9b7b136939d..95eed32d8c6b 100644
+--- a/include/net/ip_fib.h
++++ b/include/net/ip_fib.h
+@@ -230,7 +230,7 @@ int fib_table_delete(struct net *, struct fib_table *, struct fib_config *,
+ struct netlink_ext_ack *extack);
+ int fib_table_dump(struct fib_table *table, struct sk_buff *skb,
+ struct netlink_callback *cb);
+-int fib_table_flush(struct net *net, struct fib_table *table);
++int fib_table_flush(struct net *net, struct fib_table *table, bool flush_all);
+ struct fib_table *fib_trie_unmerge(struct fib_table *main_tb);
+ void fib_table_flush_external(struct fib_table *table);
+ void fib_free_table(struct fib_table *tb);
+diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
+index fb78f6f500f3..f056b2a00d5c 100644
+--- a/include/uapi/linux/input.h
++++ b/include/uapi/linux/input.h
+@@ -26,13 +26,17 @@
+ */
+
+ struct input_event {
+-#if (__BITS_PER_LONG != 32 || !defined(__USE_TIME_BITS64)) && !defined(__KERNEL)
++#if (__BITS_PER_LONG != 32 || !defined(__USE_TIME_BITS64)) && !defined(__KERNEL__)
+ struct timeval time;
+ #define input_event_sec time.tv_sec
+ #define input_event_usec time.tv_usec
+ #else
+ __kernel_ulong_t __sec;
++#if defined(__sparc__) && defined(__arch64__)
++ unsigned int __usec;
++#else
+ __kernel_ulong_t __usec;
++#endif
+ #define input_event_sec __sec
+ #define input_event_usec __usec
+ #endif
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 3f5bf1af0826..474525e3a9db 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -52,6 +52,7 @@
+ #define DST regs[insn->dst_reg]
+ #define SRC regs[insn->src_reg]
+ #define FP regs[BPF_REG_FP]
++#define AX regs[BPF_REG_AX]
+ #define ARG1 regs[BPF_REG_ARG1]
+ #define CTX regs[BPF_REG_CTX]
+ #define IMM insn->imm
+@@ -642,6 +643,26 @@ static int bpf_jit_blind_insn(const struct bpf_insn *from,
+ BUILD_BUG_ON(BPF_REG_AX + 1 != MAX_BPF_JIT_REG);
+ BUILD_BUG_ON(MAX_BPF_REG + 1 != MAX_BPF_JIT_REG);
+
++ /* Constraints on AX register:
++ *
++ * AX register is inaccessible from user space. It is mapped in
++ * all JITs, and used here for constant blinding rewrites. It is
++ * typically "stateless" meaning its contents are only valid within
++ * the executed instruction, but not across several instructions.
++ * There are a few exceptions however which are further detailed
++ * below.
++ *
++ * Constant blinding is only used by JITs, not in the interpreter.
++ * The interpreter uses AX in some occasions as a local temporary
++ * register e.g. in DIV or MOD instructions.
++ *
++ * In restricted circumstances, the verifier can also use the AX
++ * register for rewrites as long as they do not interfere with
++ * the above cases!
++ */
++ if (from->dst_reg == BPF_REG_AX || from->src_reg == BPF_REG_AX)
++ goto out;
++
+ if (from->imm == 0 &&
+ (from->code == (BPF_ALU | BPF_MOV | BPF_K) ||
+ from->code == (BPF_ALU64 | BPF_MOV | BPF_K))) {
+@@ -971,7 +992,6 @@ bool bpf_opcode_in_insntable(u8 code)
+ */
+ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack)
+ {
+- u64 tmp;
+ #define BPF_INSN_2_LBL(x, y) [BPF_##x | BPF_##y] = &&x##_##y
+ #define BPF_INSN_3_LBL(x, y, z) [BPF_##x | BPF_##y | BPF_##z] = &&x##_##y##_##z
+ static const void *jumptable[256] = {
+@@ -1045,36 +1065,36 @@ select_insn:
+ (*(s64 *) &DST) >>= IMM;
+ CONT;
+ ALU64_MOD_X:
+- div64_u64_rem(DST, SRC, &tmp);
+- DST = tmp;
++ div64_u64_rem(DST, SRC, &AX);
++ DST = AX;
+ CONT;
+ ALU_MOD_X:
+- tmp = (u32) DST;
+- DST = do_div(tmp, (u32) SRC);
++ AX = (u32) DST;
++ DST = do_div(AX, (u32) SRC);
+ CONT;
+ ALU64_MOD_K:
+- div64_u64_rem(DST, IMM, &tmp);
+- DST = tmp;
++ div64_u64_rem(DST, IMM, &AX);
++ DST = AX;
+ CONT;
+ ALU_MOD_K:
+- tmp = (u32) DST;
+- DST = do_div(tmp, (u32) IMM);
++ AX = (u32) DST;
++ DST = do_div(AX, (u32) IMM);
+ CONT;
+ ALU64_DIV_X:
+ DST = div64_u64(DST, SRC);
+ CONT;
+ ALU_DIV_X:
+- tmp = (u32) DST;
+- do_div(tmp, (u32) SRC);
+- DST = (u32) tmp;
++ AX = (u32) DST;
++ do_div(AX, (u32) SRC);
++ DST = (u32) AX;
+ CONT;
+ ALU64_DIV_K:
+ DST = div64_u64(DST, IMM);
+ CONT;
+ ALU_DIV_K:
+- tmp = (u32) DST;
+- do_div(tmp, (u32) IMM);
+- DST = (u32) tmp;
++ AX = (u32) DST;
++ do_div(AX, (u32) IMM);
++ DST = (u32) AX;
+ CONT;
+ ALU_END_TO_BE:
+ switch (IMM) {
+@@ -1330,7 +1350,7 @@ STACK_FRAME_NON_STANDARD(___bpf_prog_run); /* jump table */
+ static unsigned int PROG_NAME(stack_size)(const void *ctx, const struct bpf_insn *insn) \
+ { \
+ u64 stack[stack_size / sizeof(u64)]; \
+- u64 regs[MAX_BPF_REG]; \
++ u64 regs[MAX_BPF_EXT_REG]; \
+ \
+ FP = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)]; \
+ ARG1 = (u64) (unsigned long) ctx; \
+@@ -1343,7 +1363,7 @@ static u64 PROG_NAME_ARGS(stack_size)(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5, \
+ const struct bpf_insn *insn) \
+ { \
+ u64 stack[stack_size / sizeof(u64)]; \
+- u64 regs[MAX_BPF_REG]; \
++ u64 regs[MAX_BPF_EXT_REG]; \
+ \
+ FP = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)]; \
+ BPF_R1 = r1; \
+diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
+index 3bfbf4464416..9670ee5ee74e 100644
+--- a/kernel/bpf/map_in_map.c
++++ b/kernel/bpf/map_in_map.c
+@@ -12,6 +12,7 @@
+ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
+ {
+ struct bpf_map *inner_map, *inner_map_meta;
++ u32 inner_map_meta_size;
+ struct fd f;
+
+ f = fdget(inner_map_ufd);
+@@ -35,7 +36,12 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
+ return ERR_PTR(-EINVAL);
+ }
+
+- inner_map_meta = kzalloc(sizeof(*inner_map_meta), GFP_USER);
++ inner_map_meta_size = sizeof(*inner_map_meta);
++ /* In some cases verifier needs to access beyond just base map. */
++ if (inner_map->ops == &array_map_ops)
++ inner_map_meta_size = sizeof(struct bpf_array);
++
++ inner_map_meta = kzalloc(inner_map_meta_size, GFP_USER);
+ if (!inner_map_meta) {
+ fdput(f);
+ return ERR_PTR(-ENOMEM);
+@@ -45,9 +51,16 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
+ inner_map_meta->key_size = inner_map->key_size;
+ inner_map_meta->value_size = inner_map->value_size;
+ inner_map_meta->map_flags = inner_map->map_flags;
+- inner_map_meta->ops = inner_map->ops;
+ inner_map_meta->max_entries = inner_map->max_entries;
+
++ /* Misc members not needed in bpf_map_meta_equal() check. */
++ inner_map_meta->ops = inner_map->ops;
++ if (inner_map->ops == &array_map_ops) {
++ inner_map_meta->unpriv_array = inner_map->unpriv_array;
++ container_of(inner_map_meta, struct bpf_array, map)->index_mask =
++ container_of(inner_map, struct bpf_array, map)->index_mask;
++ }
++
+ fdput(f);
+ return inner_map_meta;
+ }
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 341806668f03..4d81be2d0739 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -156,6 +156,7 @@ struct bpf_verifier_stack_elem {
+
+ #define BPF_COMPLEXITY_LIMIT_INSNS 131072
+ #define BPF_COMPLEXITY_LIMIT_STACK 1024
++#define BPF_COMPLEXITY_LIMIT_STATES 64
+
+ #define BPF_MAP_PTR_UNPRIV 1UL
+ #define BPF_MAP_PTR_POISON ((void *)((0xeB9FUL << 1) + \
+@@ -465,6 +466,7 @@ static int copy_verifier_state(struct bpf_verifier_state *dst_state,
+ free_func_state(dst_state->frame[i]);
+ dst_state->frame[i] = NULL;
+ }
++ dst_state->speculative = src->speculative;
+ dst_state->curframe = src->curframe;
+ dst_state->parent = src->parent;
+ for (i = 0; i <= src->curframe; i++) {
+@@ -510,7 +512,8 @@ static int pop_stack(struct bpf_verifier_env *env, int *prev_insn_idx,
+ }
+
+ static struct bpf_verifier_state *push_stack(struct bpf_verifier_env *env,
+- int insn_idx, int prev_insn_idx)
++ int insn_idx, int prev_insn_idx,
++ bool speculative)
+ {
+ struct bpf_verifier_state *cur = env->cur_state;
+ struct bpf_verifier_stack_elem *elem;
+@@ -528,6 +531,7 @@ static struct bpf_verifier_state *push_stack(struct bpf_verifier_env *env,
+ err = copy_verifier_state(&elem->st, cur);
+ if (err)
+ goto err;
++ elem->st.speculative |= speculative;
+ if (env->stack_size > BPF_COMPLEXITY_LIMIT_STACK) {
+ verbose(env, "BPF program is too complex\n");
+ goto err;
+@@ -1237,6 +1241,31 @@ static int check_stack_read(struct bpf_verifier_env *env,
+ }
+ }
+
++static int check_stack_access(struct bpf_verifier_env *env,
++ const struct bpf_reg_state *reg,
++ int off, int size)
++{
++ /* Stack accesses must be at a fixed offset, so that we
++ * can determine what type of data were returned. See
++ * check_stack_read().
++ */
++ if (!tnum_is_const(reg->var_off)) {
++ char tn_buf[48];
++
++ tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
++ verbose(env, "variable stack access var_off=%s off=%d size=%d",
++ tn_buf, off, size);
++ return -EACCES;
++ }
++
++ if (off >= 0 || off < -MAX_BPF_STACK) {
++ verbose(env, "invalid stack off=%d size=%d\n", off, size);
++ return -EACCES;
++ }
++
++ return 0;
++}
++
+ /* check read/write into map element returned by bpf_map_lookup_elem() */
+ static int __check_map_access(struct bpf_verifier_env *env, u32 regno, int off,
+ int size, bool zero_size_allowed)
+@@ -1268,13 +1297,17 @@ static int check_map_access(struct bpf_verifier_env *env, u32 regno,
+ */
+ if (env->log.level)
+ print_verifier_state(env, state);
++
+ /* The minimum value is only important with signed
+ * comparisons where we can't assume the floor of a
+ * value is 0. If we are using signed variables for our
+ * index'es we need to make sure that whatever we use
+ * will have a set floor within our range.
+ */
+- if (reg->smin_value < 0) {
++ if (reg->smin_value < 0 &&
++ (reg->smin_value == S64_MIN ||
++ (off + reg->smin_value != (s64)(s32)(off + reg->smin_value)) ||
++ reg->smin_value + off < 0)) {
+ verbose(env, "R%d min value is negative, either use unsigned index or do a if (index >=0) check.\n",
+ regno);
+ return -EACCES;
+@@ -1735,24 +1768,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
+ }
+
+ } else if (reg->type == PTR_TO_STACK) {
+- /* stack accesses must be at a fixed offset, so that we can
+- * determine what type of data were returned.
+- * See check_stack_read().
+- */
+- if (!tnum_is_const(reg->var_off)) {
+- char tn_buf[48];
+-
+- tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
+- verbose(env, "variable stack access var_off=%s off=%d size=%d",
+- tn_buf, off, size);
+- return -EACCES;
+- }
+ off += reg->var_off.value;
+- if (off >= 0 || off < -MAX_BPF_STACK) {
+- verbose(env, "invalid stack off=%d size=%d\n", off,
+- size);
+- return -EACCES;
+- }
++ err = check_stack_access(env, reg, off, size);
++ if (err)
++ return err;
+
+ state = func(env, reg);
+ err = update_stack_depth(env, state, off);
+@@ -2682,6 +2701,125 @@ static bool check_reg_sane_offset(struct bpf_verifier_env *env,
+ return true;
+ }
+
++static struct bpf_insn_aux_data *cur_aux(struct bpf_verifier_env *env)
++{
++ return &env->insn_aux_data[env->insn_idx];
++}
++
++static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
++ u32 *ptr_limit, u8 opcode, bool off_is_neg)
++{
++ bool mask_to_left = (opcode == BPF_ADD && off_is_neg) ||
++ (opcode == BPF_SUB && !off_is_neg);
++ u32 off;
++
++ switch (ptr_reg->type) {
++ case PTR_TO_STACK:
++ off = ptr_reg->off + ptr_reg->var_off.value;
++ if (mask_to_left)
++ *ptr_limit = MAX_BPF_STACK + off;
++ else
++ *ptr_limit = -off;
++ return 0;
++ case PTR_TO_MAP_VALUE:
++ if (mask_to_left) {
++ *ptr_limit = ptr_reg->umax_value + ptr_reg->off;
++ } else {
++ off = ptr_reg->smin_value + ptr_reg->off;
++ *ptr_limit = ptr_reg->map_ptr->value_size - off;
++ }
++ return 0;
++ default:
++ return -EINVAL;
++ }
++}
++
++static bool can_skip_alu_sanitation(const struct bpf_verifier_env *env,
++ const struct bpf_insn *insn)
++{
++ return env->allow_ptr_leaks || BPF_SRC(insn->code) == BPF_K;
++}
++
++static int update_alu_sanitation_state(struct bpf_insn_aux_data *aux,
++ u32 alu_state, u32 alu_limit)
++{
++ /* If we arrived here from different branches with different
++ * state or limits to sanitize, then this won't work.
++ */
++ if (aux->alu_state &&
++ (aux->alu_state != alu_state ||
++ aux->alu_limit != alu_limit))
++ return -EACCES;
++
++ /* Corresponding fixup done in fixup_bpf_calls(). */
++ aux->alu_state = alu_state;
++ aux->alu_limit = alu_limit;
++ return 0;
++}
++
++static int sanitize_val_alu(struct bpf_verifier_env *env,
++ struct bpf_insn *insn)
++{
++ struct bpf_insn_aux_data *aux = cur_aux(env);
++
++ if (can_skip_alu_sanitation(env, insn))
++ return 0;
++
++ return update_alu_sanitation_state(aux, BPF_ALU_NON_POINTER, 0);
++}
++
++static int sanitize_ptr_alu(struct bpf_verifier_env *env,
++ struct bpf_insn *insn,
++ const struct bpf_reg_state *ptr_reg,
++ struct bpf_reg_state *dst_reg,
++ bool off_is_neg)
++{
++ struct bpf_verifier_state *vstate = env->cur_state;
++ struct bpf_insn_aux_data *aux = cur_aux(env);
++ bool ptr_is_dst_reg = ptr_reg == dst_reg;
++ u8 opcode = BPF_OP(insn->code);
++ u32 alu_state, alu_limit;
++ struct bpf_reg_state tmp;
++ bool ret;
++
++ if (can_skip_alu_sanitation(env, insn))
++ return 0;
++
++ /* We already marked aux for masking from non-speculative
++ * paths, thus we got here in the first place. We only care
++ * to explore bad access from here.
++ */
++ if (vstate->speculative)
++ goto do_sim;
++
++ alu_state = off_is_neg ? BPF_ALU_NEG_VALUE : 0;
++ alu_state |= ptr_is_dst_reg ?
++ BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST;
++
++ if (retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg))
++ return 0;
++ if (update_alu_sanitation_state(aux, alu_state, alu_limit))
++ return -EACCES;
++do_sim:
++ /* Simulate and find potential out-of-bounds access under
++ * speculative execution from truncation as a result of
++ * masking when off was not within expected range. If off
++ * sits in dst, then we temporarily need to move ptr there
++ * to simulate dst (== 0) +/-= ptr. Needed, for example,
++ * for cases where we use K-based arithmetic in one direction
++ * and truncated reg-based in the other in order to explore
++ * bad access.
++ */
++ if (!ptr_is_dst_reg) {
++ tmp = *dst_reg;
++ *dst_reg = *ptr_reg;
++ }
++ ret = push_stack(env, env->insn_idx + 1, env->insn_idx, true);
++ if (!ptr_is_dst_reg)
++ *dst_reg = tmp;
++ return !ret ? -EFAULT : 0;
++}
++
+ /* Handles arithmetic on a pointer and a scalar: computes new min/max and var_off.
+ * Caller should also handle BPF_MOV case separately.
+ * If we return -EACCES, caller may want to try again treating pointer as a
+@@ -2700,8 +2838,9 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value;
+ u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value,
+ umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value;
++ u32 dst = insn->dst_reg, src = insn->src_reg;
+ u8 opcode = BPF_OP(insn->code);
+- u32 dst = insn->dst_reg;
++ int ret;
+
+ dst_reg = ®s[dst];
+
+@@ -2737,6 +2876,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ dst);
+ return -EACCES;
+ }
++ if (ptr_reg->type == PTR_TO_MAP_VALUE &&
++ !env->allow_ptr_leaks && !known && (smin_val < 0) != (smax_val < 0)) {
++ verbose(env, "R%d has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root\n",
++ off_reg == dst_reg ? dst : src);
++ return -EACCES;
++ }
+
+ /* In case of 'scalar += pointer', dst_reg inherits pointer type and id.
+ * The id may be overwritten later if we create a new variable offset.
+@@ -2750,6 +2895,11 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+
+ switch (opcode) {
+ case BPF_ADD:
++ ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
++ if (ret < 0) {
++ verbose(env, "R%d tried to add from different maps or paths\n", dst);
++ return ret;
++ }
+ /* We can take a fixed offset as long as it doesn't overflow
+ * the s32 'off' field
+ */
+@@ -2800,6 +2950,11 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ }
+ break;
+ case BPF_SUB:
++ ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
++ if (ret < 0) {
++ verbose(env, "R%d tried to sub from different maps or paths\n", dst);
++ return ret;
++ }
+ if (dst_reg == off_reg) {
+ /* scalar -= pointer. Creates an unknown scalar */
+ verbose(env, "R%d tried to subtract pointer from scalar\n",
+@@ -2879,6 +3034,25 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ __update_reg_bounds(dst_reg);
+ __reg_deduce_bounds(dst_reg);
+ __reg_bound_offset(dst_reg);
++
++ /* For unprivileged we require that resulting offset must be in bounds
++ * in order to be able to sanitize access later on.
++ */
++ if (!env->allow_ptr_leaks) {
++ if (dst_reg->type == PTR_TO_MAP_VALUE &&
++ check_map_access(env, dst, dst_reg->off, 1, false)) {
++ verbose(env, "R%d pointer arithmetic of map value goes out of range, "
++ "prohibited for !root\n", dst);
++ return -EACCES;
++ } else if (dst_reg->type == PTR_TO_STACK &&
++ check_stack_access(env, dst_reg, dst_reg->off +
++ dst_reg->var_off.value, 1)) {
++ verbose(env, "R%d stack pointer arithmetic goes out of range, "
++ "prohibited for !root\n", dst);
++ return -EACCES;
++ }
++ }
++
+ return 0;
+ }
+
+@@ -2897,6 +3071,8 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ s64 smin_val, smax_val;
+ u64 umin_val, umax_val;
+ u64 insn_bitness = (BPF_CLASS(insn->code) == BPF_ALU64) ? 64 : 32;
++ u32 dst = insn->dst_reg;
++ int ret;
+
+ if (insn_bitness == 32) {
+ /* Relevant for 32-bit RSH: Information can propagate towards
+@@ -2931,6 +3107,11 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+
+ switch (opcode) {
+ case BPF_ADD:
++ ret = sanitize_val_alu(env, insn);
++ if (ret < 0) {
++ verbose(env, "R%d tried to add from different pointers or scalars\n", dst);
++ return ret;
++ }
+ if (signed_add_overflows(dst_reg->smin_value, smin_val) ||
+ signed_add_overflows(dst_reg->smax_value, smax_val)) {
+ dst_reg->smin_value = S64_MIN;
+@@ -2950,6 +3131,11 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ dst_reg->var_off = tnum_add(dst_reg->var_off, src_reg.var_off);
+ break;
+ case BPF_SUB:
++ ret = sanitize_val_alu(env, insn);
++ if (ret < 0) {
++ verbose(env, "R%d tried to sub from different pointers or scalars\n", dst);
++ return ret;
++ }
+ if (signed_sub_overflows(dst_reg->smin_value, smax_val) ||
+ signed_sub_overflows(dst_reg->smax_value, smin_val)) {
+ /* Overflow possible, we know nothing */
+@@ -3475,6 +3661,79 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *vstate,
+ }
+ }
+
++/* compute branch direction of the expression "if (reg opcode val) goto target;"
++ * and return:
++ * 1 - branch will be taken and "goto target" will be executed
++ * 0 - branch will not be taken and fall-through to next insn
++ * -1 - unknown. Example: "if (reg < 5)" is unknown when register value range [0,10]
++ */
++static int is_branch_taken(struct bpf_reg_state *reg, u64 val, u8 opcode)
++{
++ if (__is_pointer_value(false, reg))
++ return -1;
++
++ switch (opcode) {
++ case BPF_JEQ:
++ if (tnum_is_const(reg->var_off))
++ return !!tnum_equals_const(reg->var_off, val);
++ break;
++ case BPF_JNE:
++ if (tnum_is_const(reg->var_off))
++ return !tnum_equals_const(reg->var_off, val);
++ break;
++ case BPF_JGT:
++ if (reg->umin_value > val)
++ return 1;
++ else if (reg->umax_value <= val)
++ return 0;
++ break;
++ case BPF_JSGT:
++ if (reg->smin_value > (s64)val)
++ return 1;
++ else if (reg->smax_value < (s64)val)
++ return 0;
++ break;
++ case BPF_JLT:
++ if (reg->umax_value < val)
++ return 1;
++ else if (reg->umin_value >= val)
++ return 0;
++ break;
++ case BPF_JSLT:
++ if (reg->smax_value < (s64)val)
++ return 1;
++ else if (reg->smin_value >= (s64)val)
++ return 0;
++ break;
++ case BPF_JGE:
++ if (reg->umin_value >= val)
++ return 1;
++ else if (reg->umax_value < val)
++ return 0;
++ break;
++ case BPF_JSGE:
++ if (reg->smin_value >= (s64)val)
++ return 1;
++ else if (reg->smax_value < (s64)val)
++ return 0;
++ break;
++ case BPF_JLE:
++ if (reg->umax_value <= val)
++ return 1;
++ else if (reg->umin_value > val)
++ return 0;
++ break;
++ case BPF_JSLE:
++ if (reg->smax_value <= (s64)val)
++ return 1;
++ else if (reg->smin_value > (s64)val)
++ return 0;
++ break;
++ }
++
++ return -1;
++}
++
+ /* Adjusts the register min/max values in the case that the dst_reg is the
+ * variable register that we are working on, and src_reg is a constant or we're
+ * simply doing a BPF_K check.
+@@ -3868,28 +4127,23 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,
+
+ dst_reg = ®s[insn->dst_reg];
+
+- /* detect if R == 0 where R was initialized to zero earlier */
+- if (BPF_SRC(insn->code) == BPF_K &&
+- (opcode == BPF_JEQ || opcode == BPF_JNE) &&
+- dst_reg->type == SCALAR_VALUE &&
+- tnum_is_const(dst_reg->var_off)) {
+- if ((opcode == BPF_JEQ && dst_reg->var_off.value == insn->imm) ||
+- (opcode == BPF_JNE && dst_reg->var_off.value != insn->imm)) {
+- /* if (imm == imm) goto pc+off;
+- * only follow the goto, ignore fall-through
+- */
++ if (BPF_SRC(insn->code) == BPF_K) {
++ int pred = is_branch_taken(dst_reg, insn->imm, opcode);
++
++ if (pred == 1) {
++ /* only follow the goto, ignore fall-through */
+ *insn_idx += insn->off;
+ return 0;
+- } else {
+- /* if (imm != imm) goto pc+off;
+- * only follow fall-through branch, since
++ } else if (pred == 0) {
++ /* only follow fall-through branch, since
+ * that's where the program will go
+ */
+ return 0;
+ }
+ }
+
+- other_branch = push_stack(env, *insn_idx + insn->off + 1, *insn_idx);
++ other_branch = push_stack(env, *insn_idx + insn->off + 1, *insn_idx,
++ false);
+ if (!other_branch)
+ return -EFAULT;
+ other_branch_regs = other_branch->frame[other_branch->curframe]->regs;
+@@ -4604,6 +4858,12 @@ static bool states_equal(struct bpf_verifier_env *env,
+ if (old->curframe != cur->curframe)
+ return false;
+
++ /* Verification state from speculative execution simulation
++ * must never prune a non-speculative execution one.
++ */
++ if (old->speculative && !cur->speculative)
++ return false;
++
+ /* for states to be equal callsites have to be the same
+ * and all frame states need to be equivalent
+ */
+@@ -4668,7 +4928,7 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
+ struct bpf_verifier_state_list *new_sl;
+ struct bpf_verifier_state_list *sl;
+ struct bpf_verifier_state *cur = env->cur_state;
+- int i, j, err;
++ int i, j, err, states_cnt = 0;
+
+ sl = env->explored_states[insn_idx];
+ if (!sl)
+@@ -4695,8 +4955,12 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
+ return 1;
+ }
+ sl = sl->next;
++ states_cnt++;
+ }
+
++ if (!env->allow_ptr_leaks && states_cnt > BPF_COMPLEXITY_LIMIT_STATES)
++ return 0;
++
+ /* there were no equivalent states, remember current one.
+ * technically the current state is not proven to be safe yet,
+ * but it will either reach outer most bpf_exit (which means it's safe)
+@@ -4744,7 +5008,6 @@ static int do_check(struct bpf_verifier_env *env)
+ struct bpf_insn *insns = env->prog->insnsi;
+ struct bpf_reg_state *regs;
+ int insn_cnt = env->prog->len, i;
+- int insn_idx, prev_insn_idx = 0;
+ int insn_processed = 0;
+ bool do_print_state = false;
+
+@@ -4752,7 +5015,7 @@ static int do_check(struct bpf_verifier_env *env)
+ if (!state)
+ return -ENOMEM;
+ state->curframe = 0;
+- state->parent = NULL;
++ state->speculative = false;
+ state->frame[0] = kzalloc(sizeof(struct bpf_func_state), GFP_KERNEL);
+ if (!state->frame[0]) {
+ kfree(state);
+@@ -4763,19 +5026,19 @@ static int do_check(struct bpf_verifier_env *env)
+ BPF_MAIN_FUNC /* callsite */,
+ 0 /* frameno */,
+ 0 /* subprogno, zero == main subprog */);
+- insn_idx = 0;
++
+ for (;;) {
+ struct bpf_insn *insn;
+ u8 class;
+ int err;
+
+- if (insn_idx >= insn_cnt) {
++ if (env->insn_idx >= insn_cnt) {
+ verbose(env, "invalid insn idx %d insn_cnt %d\n",
+- insn_idx, insn_cnt);
++ env->insn_idx, insn_cnt);
+ return -EFAULT;
+ }
+
+- insn = &insns[insn_idx];
++ insn = &insns[env->insn_idx];
+ class = BPF_CLASS(insn->code);
+
+ if (++insn_processed > BPF_COMPLEXITY_LIMIT_INSNS) {
+@@ -4785,17 +5048,19 @@ static int do_check(struct bpf_verifier_env *env)
+ return -E2BIG;
+ }
+
+- err = is_state_visited(env, insn_idx);
++ err = is_state_visited(env, env->insn_idx);
+ if (err < 0)
+ return err;
+ if (err == 1) {
+ /* found equivalent state, can prune the search */
+ if (env->log.level) {
+ if (do_print_state)
+- verbose(env, "\nfrom %d to %d: safe\n",
+- prev_insn_idx, insn_idx);
++ verbose(env, "\nfrom %d to %d%s: safe\n",
++ env->prev_insn_idx, env->insn_idx,
++ env->cur_state->speculative ?
++ " (speculative execution)" : "");
+ else
+- verbose(env, "%d: safe\n", insn_idx);
++ verbose(env, "%d: safe\n", env->insn_idx);
+ }
+ goto process_bpf_exit;
+ }
+@@ -4808,10 +5073,12 @@ static int do_check(struct bpf_verifier_env *env)
+
+ if (env->log.level > 1 || (env->log.level && do_print_state)) {
+ if (env->log.level > 1)
+- verbose(env, "%d:", insn_idx);
++ verbose(env, "%d:", env->insn_idx);
+ else
+- verbose(env, "\nfrom %d to %d:",
+- prev_insn_idx, insn_idx);
++ verbose(env, "\nfrom %d to %d%s:",
++ env->prev_insn_idx, env->insn_idx,
++ env->cur_state->speculative ?
++ " (speculative execution)" : "");
+ print_verifier_state(env, state->frame[state->curframe]);
+ do_print_state = false;
+ }
+@@ -4822,19 +5089,20 @@ static int do_check(struct bpf_verifier_env *env)
+ .private_data = env,
+ };
+
+- verbose(env, "%d: ", insn_idx);
++ verbose(env, "%d: ", env->insn_idx);
+ print_bpf_insn(&cbs, insn, env->allow_ptr_leaks);
+ }
+
+ if (bpf_prog_is_dev_bound(env->prog->aux)) {
+- err = bpf_prog_offload_verify_insn(env, insn_idx,
+- prev_insn_idx);
++ err = bpf_prog_offload_verify_insn(env, env->insn_idx,
++ env->prev_insn_idx);
+ if (err)
+ return err;
+ }
+
+ regs = cur_regs(env);
+- env->insn_aux_data[insn_idx].seen = true;
++ env->insn_aux_data[env->insn_idx].seen = true;
++
+ if (class == BPF_ALU || class == BPF_ALU64) {
+ err = check_alu_op(env, insn);
+ if (err)
+@@ -4859,13 +5127,13 @@ static int do_check(struct bpf_verifier_env *env)
+ /* check that memory (src_reg + off) is readable,
+ * the state of dst_reg will be updated by this func
+ */
+- err = check_mem_access(env, insn_idx, insn->src_reg, insn->off,
+- BPF_SIZE(insn->code), BPF_READ,
+- insn->dst_reg, false);
++ err = check_mem_access(env, env->insn_idx, insn->src_reg,
++ insn->off, BPF_SIZE(insn->code),
++ BPF_READ, insn->dst_reg, false);
+ if (err)
+ return err;
+
+- prev_src_type = &env->insn_aux_data[insn_idx].ptr_type;
++ prev_src_type = &env->insn_aux_data[env->insn_idx].ptr_type;
+
+ if (*prev_src_type == NOT_INIT) {
+ /* saw a valid insn
+@@ -4892,10 +5160,10 @@ static int do_check(struct bpf_verifier_env *env)
+ enum bpf_reg_type *prev_dst_type, dst_reg_type;
+
+ if (BPF_MODE(insn->code) == BPF_XADD) {
+- err = check_xadd(env, insn_idx, insn);
++ err = check_xadd(env, env->insn_idx, insn);
+ if (err)
+ return err;
+- insn_idx++;
++ env->insn_idx++;
+ continue;
+ }
+
+@@ -4911,13 +5179,13 @@ static int do_check(struct bpf_verifier_env *env)
+ dst_reg_type = regs[insn->dst_reg].type;
+
+ /* check that memory (dst_reg + off) is writeable */
+- err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
+- BPF_SIZE(insn->code), BPF_WRITE,
+- insn->src_reg, false);
++ err = check_mem_access(env, env->insn_idx, insn->dst_reg,
++ insn->off, BPF_SIZE(insn->code),
++ BPF_WRITE, insn->src_reg, false);
+ if (err)
+ return err;
+
+- prev_dst_type = &env->insn_aux_data[insn_idx].ptr_type;
++ prev_dst_type = &env->insn_aux_data[env->insn_idx].ptr_type;
+
+ if (*prev_dst_type == NOT_INIT) {
+ *prev_dst_type = dst_reg_type;
+@@ -4946,9 +5214,9 @@ static int do_check(struct bpf_verifier_env *env)
+ }
+
+ /* check that memory (dst_reg + off) is writeable */
+- err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
+- BPF_SIZE(insn->code), BPF_WRITE,
+- -1, false);
++ err = check_mem_access(env, env->insn_idx, insn->dst_reg,
++ insn->off, BPF_SIZE(insn->code),
++ BPF_WRITE, -1, false);
+ if (err)
+ return err;
+
+@@ -4966,9 +5234,9 @@ static int do_check(struct bpf_verifier_env *env)
+ }
+
+ if (insn->src_reg == BPF_PSEUDO_CALL)
+- err = check_func_call(env, insn, &insn_idx);
++ err = check_func_call(env, insn, &env->insn_idx);
+ else
+- err = check_helper_call(env, insn->imm, insn_idx);
++ err = check_helper_call(env, insn->imm, env->insn_idx);
+ if (err)
+ return err;
+
+@@ -4981,7 +5249,7 @@ static int do_check(struct bpf_verifier_env *env)
+ return -EINVAL;
+ }
+
+- insn_idx += insn->off + 1;
++ env->insn_idx += insn->off + 1;
+ continue;
+
+ } else if (opcode == BPF_EXIT) {
+@@ -4995,8 +5263,8 @@ static int do_check(struct bpf_verifier_env *env)
+
+ if (state->curframe) {
+ /* exit from nested function */
+- prev_insn_idx = insn_idx;
+- err = prepare_func_exit(env, &insn_idx);
++ env->prev_insn_idx = env->insn_idx;
++ err = prepare_func_exit(env, &env->insn_idx);
+ if (err)
+ return err;
+ do_print_state = true;
+@@ -5022,7 +5290,8 @@ static int do_check(struct bpf_verifier_env *env)
+ if (err)
+ return err;
+ process_bpf_exit:
+- err = pop_stack(env, &prev_insn_idx, &insn_idx);
++ err = pop_stack(env, &env->prev_insn_idx,
++ &env->insn_idx);
+ if (err < 0) {
+ if (err != -ENOENT)
+ return err;
+@@ -5032,7 +5301,7 @@ process_bpf_exit:
+ continue;
+ }
+ } else {
+- err = check_cond_jmp_op(env, insn, &insn_idx);
++ err = check_cond_jmp_op(env, insn, &env->insn_idx);
+ if (err)
+ return err;
+ }
+@@ -5049,8 +5318,8 @@ process_bpf_exit:
+ if (err)
+ return err;
+
+- insn_idx++;
+- env->insn_aux_data[insn_idx].seen = true;
++ env->insn_idx++;
++ env->insn_aux_data[env->insn_idx].seen = true;
+ } else {
+ verbose(env, "invalid BPF_LD mode\n");
+ return -EINVAL;
+@@ -5060,7 +5329,7 @@ process_bpf_exit:
+ return -EINVAL;
+ }
+
+- insn_idx++;
++ env->insn_idx++;
+ }
+
+ verbose(env, "processed %d insns (limit %d), stack depth ",
+@@ -5756,6 +6025,57 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
+ continue;
+ }
+
++ if (insn->code == (BPF_ALU64 | BPF_ADD | BPF_X) ||
++ insn->code == (BPF_ALU64 | BPF_SUB | BPF_X)) {
++ const u8 code_add = BPF_ALU64 | BPF_ADD | BPF_X;
++ const u8 code_sub = BPF_ALU64 | BPF_SUB | BPF_X;
++ struct bpf_insn insn_buf[16];
++ struct bpf_insn *patch = &insn_buf[0];
++ bool issrc, isneg;
++ u32 off_reg;
++
++ aux = &env->insn_aux_data[i + delta];
++ if (!aux->alu_state)
++ continue;
++
++ isneg = aux->alu_state & BPF_ALU_NEG_VALUE;
++ issrc = (aux->alu_state & BPF_ALU_SANITIZE) ==
++ BPF_ALU_SANITIZE_SRC;
++
++ off_reg = issrc ? insn->src_reg : insn->dst_reg;
++ if (isneg)
++ *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);
++ *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit - 1);
++ *patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg);
++ *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);
++ *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);
++ *patch++ = BPF_ALU64_IMM(BPF_ARSH, BPF_REG_AX, 63);
++ if (issrc) {
++ *patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX,
++ off_reg);
++ insn->src_reg = BPF_REG_AX;
++ } else {
++ *patch++ = BPF_ALU64_REG(BPF_AND, off_reg,
++ BPF_REG_AX);
++ }
++ if (isneg)
++ insn->code = insn->code == code_add ?
++ code_sub : code_add;
++ *patch++ = *insn;
++ if (issrc && isneg)
++ *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);
++ cnt = patch - insn_buf;
++
++ new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
++ if (!new_prog)
++ return -ENOMEM;
++
++ delta += cnt - 1;
++ env->prog = prog = new_prog;
++ insn = new_prog->insnsi + i + delta;
++ continue;
++ }
++
+ if (insn->code != (BPF_JMP | BPF_CALL))
+ continue;
+ if (insn->src_reg == BPF_PSEUDO_CALL)
+diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
+index ce32cf741b25..76801b9b481e 100644
+--- a/kernel/time/posix-cpu-timers.c
++++ b/kernel/time/posix-cpu-timers.c
+@@ -685,6 +685,7 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags,
+ * set up the signal and overrun bookkeeping.
+ */
+ timer->it.cpu.incr = timespec64_to_ns(&new->it_interval);
++ timer->it_interval = ns_to_ktime(timer->it.cpu.incr);
+
+ /*
+ * This acts as a modification timestamp for the timer,
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 93e73ccb4dec..9e45553cabd6 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5538,18 +5538,6 @@ not_early:
+ cond_resched();
+ }
+ }
+-#ifdef CONFIG_SPARSEMEM
+- /*
+- * If the zone does not span the rest of the section then
+- * we should at least initialize those pages. Otherwise we
+- * could blow up on a poisoned page in some paths which depend
+- * on full sections being initialized (e.g. memory hotplug).
+- */
+- while (end_pfn % PAGES_PER_SECTION) {
+- __init_single_page(pfn_to_page(end_pfn), end_pfn, zone, nid);
+- end_pfn++;
+- }
+-#endif
+ }
+
+ static void __meminit zone_init_free_lists(struct zone *zone)
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
+index 2cb8da465b98..48ddc60b4fbd 100644
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -36,10 +36,10 @@ static inline int should_deliver(const struct net_bridge_port *p,
+
+ int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
++ skb_push(skb, ETH_HLEN);
+ if (!is_skb_forwardable(skb->dev, skb))
+ goto drop;
+
+- skb_push(skb, ETH_HLEN);
+ br_drop_fake_rtable(skb);
+
+ if (skb->ip_summed == CHECKSUM_PARTIAL &&
+@@ -98,12 +98,11 @@ static void __br_forward(const struct net_bridge_port *to,
+ net = dev_net(indev);
+ } else {
+ if (unlikely(netpoll_tx_running(to->br->dev))) {
+- if (!is_skb_forwardable(skb->dev, skb)) {
++ skb_push(skb, ETH_HLEN);
++ if (!is_skb_forwardable(skb->dev, skb))
+ kfree_skb(skb);
+- } else {
+- skb_push(skb, ETH_HLEN);
++ else
+ br_netpoll_send_skb(to, skb);
+- }
+ return;
+ }
+ br_hook = NF_BR_LOCAL_OUT;
+diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
+index 96c072e71ea2..5811208863b7 100644
+--- a/net/bridge/br_netfilter_ipv6.c
++++ b/net/bridge/br_netfilter_ipv6.c
+@@ -131,6 +131,7 @@ int br_validate_ipv6(struct net *net, struct sk_buff *skb)
+ IPSTATS_MIB_INDISCARDS);
+ goto drop;
+ }
++ hdr = ipv6_hdr(skb);
+ }
+ if (hdr->nexthdr == NEXTHDR_HOP && br_nf_check_hbh_len(skb))
+ goto drop;
+diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
+index 08cbed7d940e..419e8edf23ba 100644
+--- a/net/bridge/netfilter/nft_reject_bridge.c
++++ b/net/bridge/netfilter/nft_reject_bridge.c
+@@ -229,6 +229,7 @@ static bool reject6_br_csum_ok(struct sk_buff *skb, int hook)
+ pskb_trim_rcsum(skb, ntohs(ip6h->payload_len) + sizeof(*ip6h)))
+ return false;
+
++ ip6h = ipv6_hdr(skb);
+ thoff = ipv6_skip_exthdr(skb, ((u8*)(ip6h+1) - skb->data), &proto, &fo);
+ if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0)
+ return false;
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 0af8f0db892a..79bb8afa9c0c 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -67,6 +67,9 @@
+ */
+ #define MAX_NFRAMES 256
+
++/* limit timers to 400 days for sending/timeouts */
++#define BCM_TIMER_SEC_MAX (400 * 24 * 60 * 60)
++
+ /* use of last_frames[index].flags */
+ #define RX_RECV 0x40 /* received data for this element */
+ #define RX_THR 0x80 /* element not been sent due to throttle feature */
+@@ -140,6 +143,22 @@ static inline ktime_t bcm_timeval_to_ktime(struct bcm_timeval tv)
+ return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC);
+ }
+
++/* check limitations for timeval provided by user */
++static bool bcm_is_invalid_tv(struct bcm_msg_head *msg_head)
++{
++ if ((msg_head->ival1.tv_sec < 0) ||
++ (msg_head->ival1.tv_sec > BCM_TIMER_SEC_MAX) ||
++ (msg_head->ival1.tv_usec < 0) ||
++ (msg_head->ival1.tv_usec >= USEC_PER_SEC) ||
++ (msg_head->ival2.tv_sec < 0) ||
++ (msg_head->ival2.tv_sec > BCM_TIMER_SEC_MAX) ||
++ (msg_head->ival2.tv_usec < 0) ||
++ (msg_head->ival2.tv_usec >= USEC_PER_SEC))
++ return true;
++
++ return false;
++}
++
+ #define CFSIZ(flags) ((flags & CAN_FD_FRAME) ? CANFD_MTU : CAN_MTU)
+ #define OPSIZ sizeof(struct bcm_op)
+ #define MHSIZ sizeof(struct bcm_msg_head)
+@@ -873,6 +892,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
+ return -EINVAL;
+
++ /* check timeval limitations */
++ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
++ return -EINVAL;
++
+ /* check the given can_id */
+ op = bcm_find_op(&bo->tx_ops, msg_head, ifindex);
+ if (op) {
+@@ -1053,6 +1076,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ (!(msg_head->can_id & CAN_RTR_FLAG))))
+ return -EINVAL;
+
++ /* check timeval limitations */
++ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
++ return -EINVAL;
++
+ /* check the given can_id */
+ op = bcm_find_op(&bo->rx_ops, msg_head, ifindex);
+ if (op) {
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 0113993e9b2c..958e185a8e8d 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -203,7 +203,7 @@ static void fib_flush(struct net *net)
+ struct fib_table *tb;
+
+ hlist_for_each_entry_safe(tb, tmp, head, tb_hlist)
+- flushed += fib_table_flush(net, tb);
++ flushed += fib_table_flush(net, tb, false);
+ }
+
+ if (flushed)
+@@ -1357,7 +1357,7 @@ static void ip_fib_net_exit(struct net *net)
+
+ hlist_for_each_entry_safe(tb, tmp, head, tb_hlist) {
+ hlist_del(&tb->tb_hlist);
+- fib_table_flush(net, tb);
++ fib_table_flush(net, tb, true);
+ fib_free_table(tb);
+ }
+ }
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 5bc0c89e81e4..3955a6d7ea66 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1856,7 +1856,7 @@ void fib_table_flush_external(struct fib_table *tb)
+ }
+
+ /* Caller must hold RTNL. */
+-int fib_table_flush(struct net *net, struct fib_table *tb)
++int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all)
+ {
+ struct trie *t = (struct trie *)tb->tb_data;
+ struct key_vector *pn = t->kv;
+@@ -1904,8 +1904,17 @@ int fib_table_flush(struct net *net, struct fib_table *tb)
+ hlist_for_each_entry_safe(fa, tmp, &n->leaf, fa_list) {
+ struct fib_info *fi = fa->fa_info;
+
+- if (!fi || !(fi->fib_flags & RTNH_F_DEAD) ||
+- tb->tb_id != fa->tb_id) {
++ if (!fi || tb->tb_id != fa->tb_id ||
++ (!(fi->fib_flags & RTNH_F_DEAD) &&
++ !fib_props[fa->fa_type].error)) {
++ slen = fa->fa_slen;
++ continue;
++ }
++
++ /* Do not flush error routes if network namespace is
++ * not being dismantled
++ */
++ if (!flush_all && fib_props[fa->fa_type].error) {
+ slen = fa->fa_slen;
+ continue;
+ }
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 5ef5df3a06f1..0bfad3e72509 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -570,8 +570,7 @@ err_free_skb:
+ dev->stats.tx_dropped++;
+ }
+
+-static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev,
+- __be16 proto)
++static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+ struct ip_tunnel_info *tun_info;
+@@ -579,10 +578,10 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev,
+ struct erspan_metadata *md;
+ struct rtable *rt = NULL;
+ bool truncate = false;
++ __be16 df, proto;
+ struct flowi4 fl;
+ int tunnel_hlen;
+ int version;
+- __be16 df;
+ int nhoff;
+ int thoff;
+
+@@ -627,18 +626,20 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev,
+ if (version == 1) {
+ erspan_build_header(skb, ntohl(tunnel_id_to_key32(key->tun_id)),
+ ntohl(md->u.index), truncate, true);
++ proto = htons(ETH_P_ERSPAN);
+ } else if (version == 2) {
+ erspan_build_header_v2(skb,
+ ntohl(tunnel_id_to_key32(key->tun_id)),
+ md->u.md2.dir,
+ get_hwid(&md->u.md2),
+ truncate, true);
++ proto = htons(ETH_P_ERSPAN2);
+ } else {
+ goto err_free_rt;
+ }
+
+ gre_build_header(skb, 8, TUNNEL_SEQ,
+- htons(ETH_P_ERSPAN), 0, htonl(tunnel->o_seqno++));
++ proto, 0, htonl(tunnel->o_seqno++));
+
+ df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0;
+
+@@ -722,12 +723,13 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
+ {
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+ bool truncate = false;
++ __be16 proto;
+
+ if (!pskb_inet_may_pull(skb))
+ goto free_skb;
+
+ if (tunnel->collect_md) {
+- erspan_fb_xmit(skb, dev, skb->protocol);
++ erspan_fb_xmit(skb, dev);
+ return NETDEV_TX_OK;
+ }
+
+@@ -743,19 +745,22 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
+ }
+
+ /* Push ERSPAN header */
+- if (tunnel->erspan_ver == 1)
++ if (tunnel->erspan_ver == 1) {
+ erspan_build_header(skb, ntohl(tunnel->parms.o_key),
+ tunnel->index,
+ truncate, true);
+- else if (tunnel->erspan_ver == 2)
++ proto = htons(ETH_P_ERSPAN);
++ } else if (tunnel->erspan_ver == 2) {
+ erspan_build_header_v2(skb, ntohl(tunnel->parms.o_key),
+ tunnel->dir, tunnel->hwid,
+ truncate, true);
+- else
++ proto = htons(ETH_P_ERSPAN2);
++ } else {
+ goto free_skb;
++ }
+
+ tunnel->parms.o_flags &= ~TUNNEL_KEY;
+- __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_ERSPAN));
++ __gre_xmit(skb, dev, &tunnel->parms.iph, proto);
+ return NETDEV_TX_OK;
+
+ free_skb:
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
+index 27c863f6dd83..6f977b0fef54 100644
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -489,6 +489,7 @@ static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net)
+ goto drop;
+ }
+
++ iph = ip_hdr(skb);
+ skb->transport_header = skb->network_header + iph->ihl*4;
+
+ /* Remove any debris in the socket control block */
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index a32a0f4cc138..87fe44197aa1 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1186,7 +1186,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
+ flags = msg->msg_flags;
+
+ if (flags & MSG_ZEROCOPY && size && sock_flag(sk, SOCK_ZEROCOPY)) {
+- if (sk->sk_state != TCP_ESTABLISHED) {
++ if ((1 << sk->sk_state) & ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) {
+ err = -EINVAL;
+ goto out_err;
+ }
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index f8183fdce5b2..e45a5e19e509 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -785,15 +785,23 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
+ const int hlen = skb_network_header_len(skb) +
+ sizeof(struct udphdr);
+
+- if (hlen + cork->gso_size > cork->fragsize)
++ if (hlen + cork->gso_size > cork->fragsize) {
++ kfree_skb(skb);
+ return -EINVAL;
+- if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)
++ }
++ if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {
++ kfree_skb(skb);
+ return -EINVAL;
+- if (sk->sk_no_check_tx)
++ }
++ if (sk->sk_no_check_tx) {
++ kfree_skb(skb);
+ return -EINVAL;
++ }
+ if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite ||
+- dst_xfrm(skb_dst(skb)))
++ dst_xfrm(skb_dst(skb))) {
++ kfree_skb(skb);
+ return -EIO;
++ }
+
+ skb_shinfo(skb)->gso_size = cork->gso_size;
+ skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index c270726b01b0..345e6839f031 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -938,6 +938,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ __u8 dsfield = false;
+ struct flowi6 fl6;
+ int err = -EINVAL;
++ __be16 proto;
+ __u32 mtu;
+ int nhoff;
+ int thoff;
+@@ -1051,8 +1052,9 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ }
+
+ /* Push GRE header. */
+- gre_build_header(skb, 8, TUNNEL_SEQ,
+- htons(ETH_P_ERSPAN), 0, htonl(t->o_seqno++));
++ proto = (t->parms.erspan_ver == 1) ? htons(ETH_P_ERSPAN)
++ : htons(ETH_P_ERSPAN2);
++ gre_build_header(skb, 8, TUNNEL_SEQ, proto, 0, htonl(t->o_seqno++));
+
+ /* TooBig packet may have updated dst->dev's mtu */
+ if (!t->parms.collect_md && dst && dst_mtu(dst) > dst->dev->mtu)
+@@ -1185,6 +1187,10 @@ static void ip6gre_tnl_copy_tnl_parm(struct ip6_tnl *t,
+ t->parms.i_flags = p->i_flags;
+ t->parms.o_flags = p->o_flags;
+ t->parms.fwmark = p->fwmark;
++ t->parms.erspan_ver = p->erspan_ver;
++ t->parms.index = p->index;
++ t->parms.dir = p->dir;
++ t->parms.hwid = p->hwid;
+ dst_cache_reset(&t->dst_cache);
+ }
+
+@@ -2047,9 +2053,9 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
+ struct nlattr *data[],
+ struct netlink_ext_ack *extack)
+ {
+- struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id);
++ struct ip6_tnl *t = netdev_priv(dev);
++ struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
+ struct __ip6_tnl_parm p;
+- struct ip6_tnl *t;
+
+ t = ip6gre_changelink_common(dev, tb, data, &p, extack);
+ if (IS_ERR(t))
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index b36694b6716e..76ba2f34ef6b 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1056,15 +1056,23 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
+ const int hlen = skb_network_header_len(skb) +
+ sizeof(struct udphdr);
+
+- if (hlen + cork->gso_size > cork->fragsize)
++ if (hlen + cork->gso_size > cork->fragsize) {
++ kfree_skb(skb);
+ return -EINVAL;
+- if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)
++ }
++ if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {
++ kfree_skb(skb);
+ return -EINVAL;
+- if (udp_sk(sk)->no_check6_tx)
++ }
++ if (udp_sk(sk)->no_check6_tx) {
++ kfree_skb(skb);
+ return -EINVAL;
++ }
+ if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite ||
+- dst_xfrm(skb_dst(skb)))
++ dst_xfrm(skb_dst(skb))) {
++ kfree_skb(skb);
+ return -EIO;
++ }
+
+ skb_shinfo(skb)->gso_size = cork->gso_size;
+ skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index 865ecef68196..c7b6010b2c09 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -500,7 +500,7 @@ static int __parse_flow_nlattrs(const struct nlattr *attr,
+ return -EINVAL;
+ }
+
+- if (!nz || !is_all_zero(nla_data(nla), expected_len)) {
++ if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) {
+ attrs |= 1 << type;
+ a[type] = nla;
+ }
+diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
+index 681f6f04e7da..0f6601fdf889 100644
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -197,6 +197,15 @@ static const struct nla_policy tunnel_key_policy[TCA_TUNNEL_KEY_MAX + 1] = {
+ [TCA_TUNNEL_KEY_ENC_TTL] = { .type = NLA_U8 },
+ };
+
++static void tunnel_key_release_params(struct tcf_tunnel_key_params *p)
++{
++ if (!p)
++ return;
++ if (p->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
++ dst_release(&p->tcft_enc_metadata->dst);
++ kfree_rcu(p, rcu);
++}
++
+ static int tunnel_key_init(struct net *net, struct nlattr *nla,
+ struct nlattr *est, struct tc_action **a,
+ int ovr, int bind, bool rtnl_held,
+@@ -360,8 +369,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
+ rcu_swap_protected(t->params, params_new,
+ lockdep_is_held(&t->tcf_lock));
+ spin_unlock_bh(&t->tcf_lock);
+- if (params_new)
+- kfree_rcu(params_new, rcu);
++ tunnel_key_release_params(params_new);
+
+ if (ret == ACT_P_CREATED)
+ tcf_idr_insert(tn, *a);
+@@ -385,12 +393,7 @@ static void tunnel_key_release(struct tc_action *a)
+ struct tcf_tunnel_key_params *params;
+
+ params = rcu_dereference_protected(t->params, 1);
+- if (params) {
+- if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
+- dst_release(¶ms->tcft_enc_metadata->dst);
+-
+- kfree_rcu(params, rcu);
+- }
++ tunnel_key_release_params(params);
+ }
+
+ static int tunnel_key_geneve_opts_dump(struct sk_buff *skb,
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 70f144ac5e1d..2167c6ca55e3 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -960,7 +960,6 @@ static int tcf_block_cb_call(struct tcf_block *block, enum tc_setup_type type,
+ int tcf_classify(struct sk_buff *skb, const struct tcf_proto *tp,
+ struct tcf_result *res, bool compat_mode)
+ {
+- __be16 protocol = tc_skb_protocol(skb);
+ #ifdef CONFIG_NET_CLS_ACT
+ const int max_reclassify_loop = 4;
+ const struct tcf_proto *orig_tp = tp;
+@@ -970,6 +969,7 @@ int tcf_classify(struct sk_buff *skb, const struct tcf_proto *tp,
+ reclassify:
+ #endif
+ for (; tp; tp = rcu_dereference_bh(tp->next)) {
++ __be16 protocol = tc_skb_protocol(skb);
+ int err;
+
+ if (tp->protocol != protocol &&
+@@ -1002,7 +1002,6 @@ reset:
+ }
+
+ tp = first_tp;
+- protocol = tc_skb_protocol(skb);
+ goto reclassify;
+ #endif
+ }
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index 7fade7107f95..84893bc67531 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -1176,17 +1176,23 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
+ struct cls_fl_head *head = rtnl_dereference(tp->root);
+ struct cls_fl_filter *fold = *arg;
+ struct cls_fl_filter *fnew;
++ struct fl_flow_mask *mask;
+ struct nlattr **tb;
+- struct fl_flow_mask mask = {};
+ int err;
+
+ if (!tca[TCA_OPTIONS])
+ return -EINVAL;
+
+- tb = kcalloc(TCA_FLOWER_MAX + 1, sizeof(struct nlattr *), GFP_KERNEL);
+- if (!tb)
++ mask = kzalloc(sizeof(struct fl_flow_mask), GFP_KERNEL);
++ if (!mask)
+ return -ENOBUFS;
+
++ tb = kcalloc(TCA_FLOWER_MAX + 1, sizeof(struct nlattr *), GFP_KERNEL);
++ if (!tb) {
++ err = -ENOBUFS;
++ goto errout_mask_alloc;
++ }
++
+ err = nla_parse_nested(tb, TCA_FLOWER_MAX, tca[TCA_OPTIONS],
+ fl_policy, NULL);
+ if (err < 0)
+@@ -1229,12 +1235,12 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
+ }
+ }
+
+- err = fl_set_parms(net, tp, fnew, &mask, base, tb, tca[TCA_RATE], ovr,
++ err = fl_set_parms(net, tp, fnew, mask, base, tb, tca[TCA_RATE], ovr,
+ tp->chain->tmplt_priv, extack);
+ if (err)
+ goto errout_idr;
+
+- err = fl_check_assign_mask(head, fnew, fold, &mask);
++ err = fl_check_assign_mask(head, fnew, fold, mask);
+ if (err)
+ goto errout_idr;
+
+@@ -1281,6 +1287,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
+ }
+
+ kfree(tb);
++ kfree(mask);
+ return 0;
+
+ errout_mask:
+@@ -1294,6 +1301,8 @@ errout:
+ kfree(fnew);
+ errout_tb:
+ kfree(tb);
++errout_mask_alloc:
++ kfree(mask);
+ return err;
+ }
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index f9176e3b4d37..31a84a5a1338 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -931,6 +931,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO),
++ SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 8b9f2487969b..f39f34e12fb6 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6842,7 +6842,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC293_FIXUP_LENOVO_SPK_NOISE, .name = "lenovo-spk-noise"},
+ {.id = ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, .name = "lenovo-hotkey"},
+ {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"},
+- {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc255-dell1"},
++ {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc225-dell1"},
+ {.id = ALC295_FIXUP_DISABLE_DAC3, .name = "alc295-disable-dac3"},
+ {.id = ALC280_FIXUP_HP_HEADSET_MIC, .name = "alc280-hp-headset"},
+ {.id = ALC221_FIXUP_HP_FRONT_MIC, .name = "alc221-hp-mic"},
+diff --git a/sound/soc/codecs/rt5514-spi.c b/sound/soc/codecs/rt5514-spi.c
+index 6478d10c4f4a..cdb1f40009ab 100644
+--- a/sound/soc/codecs/rt5514-spi.c
++++ b/sound/soc/codecs/rt5514-spi.c
+@@ -278,6 +278,8 @@ static int rt5514_spi_pcm_probe(struct snd_soc_component *component)
+
+ rt5514_dsp = devm_kzalloc(component->dev, sizeof(*rt5514_dsp),
+ GFP_KERNEL);
++ if (!rt5514_dsp)
++ return -ENOMEM;
+
+ rt5514_dsp->dev = &rt5514_spi->dev;
+ mutex_init(&rt5514_dsp->dma_lock);
+diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
+index e2b5a11b16d1..f03195d2ab2e 100644
+--- a/sound/soc/codecs/tlv320aic32x4.c
++++ b/sound/soc/codecs/tlv320aic32x4.c
+@@ -822,6 +822,10 @@ static int aic32x4_set_bias_level(struct snd_soc_component *component,
+ case SND_SOC_BIAS_PREPARE:
+ break;
+ case SND_SOC_BIAS_STANDBY:
++ /* Initial cold start */
++ if (snd_soc_component_get_bias_level(component) == SND_SOC_BIAS_OFF)
++ break;
++
+ /* Switch off BCLK_N Divider */
+ snd_soc_component_update_bits(component, AIC32X4_BCLKN,
+ AIC32X4_BCLKEN, 0);
+diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+index 6c36da560877..e662400873ec 100644
+--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+@@ -399,7 +399,13 @@ static int sst_media_hw_params(struct snd_pcm_substream *substream,
+ struct snd_pcm_hw_params *params,
+ struct snd_soc_dai *dai)
+ {
+- snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params));
++ int ret;
++
++ ret =
++ snd_pcm_lib_malloc_pages(substream,
++ params_buffer_bytes(params));
++ if (ret)
++ return ret;
+ memset(substream->runtime->dma_area, 0, params_buffer_bytes(params));
+ return 0;
+ }
+diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
+index 460b4bdf4c1e..5d546dcdbc80 100644
+--- a/tools/testing/selftests/x86/protection_keys.c
++++ b/tools/testing/selftests/x86/protection_keys.c
+@@ -1133,6 +1133,21 @@ void test_pkey_syscalls_bad_args(int *ptr, u16 pkey)
+ pkey_assert(err);
+ }
+
++void become_child(void)
++{
++ pid_t forkret;
++
++ forkret = fork();
++ pkey_assert(forkret >= 0);
++ dprintf3("[%d] fork() ret: %d\n", getpid(), forkret);
++
++ if (!forkret) {
++ /* in the child */
++ return;
++ }
++ exit(0);
++}
++
+ /* Assumes that all pkeys other than 'pkey' are unallocated */
+ void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
+ {
+@@ -1141,7 +1156,7 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
+ int nr_allocated_pkeys = 0;
+ int i;
+
+- for (i = 0; i < NR_PKEYS*2; i++) {
++ for (i = 0; i < NR_PKEYS*3; i++) {
+ int new_pkey;
+ dprintf1("%s() alloc loop: %d\n", __func__, i);
+ new_pkey = alloc_pkey();
+@@ -1152,20 +1167,26 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey)
+ if ((new_pkey == -1) && (errno == ENOSPC)) {
+ dprintf2("%s() failed to allocate pkey after %d tries\n",
+ __func__, nr_allocated_pkeys);
+- break;
++ } else {
++ /*
++ * Ensure the number of successes never
++ * exceeds the number of keys supported
++ * in the hardware.
++ */
++ pkey_assert(nr_allocated_pkeys < NR_PKEYS);
++ allocated_pkeys[nr_allocated_pkeys++] = new_pkey;
+ }
+- pkey_assert(nr_allocated_pkeys < NR_PKEYS);
+- allocated_pkeys[nr_allocated_pkeys++] = new_pkey;
++
++ /*
++ * Make sure that allocation state is properly
++ * preserved across fork().
++ */
++ if (i == NR_PKEYS*2)
++ become_child();
+ }
+
+ dprintf3("%s()::%d\n", __func__, __LINE__);
+
+- /*
+- * ensure it did not reach the end of the loop without
+- * failure:
+- */
+- pkey_assert(i < NR_PKEYS*2);
+-
+ /*
+ * There are 16 pkeys supported in hardware. Three are
+ * allocated by the time we get here:
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-02-06 17:08 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-02-06 17:08 UTC (permalink / raw
To: gentoo-commits
commit: 5594d5e8065325acf45fff423f009f6537d812bb
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 6 17:07:54 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Feb 6 17:07:54 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5594d5e8
proj/linux-patches: Linux patch 4.19.20
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1019_linux-4.19.20.patch | 3120 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3124 insertions(+)
diff --git a/0000_README b/0000_README
index b459632..b213e93 100644
--- a/0000_README
+++ b/0000_README
@@ -119,6 +119,10 @@ Patch: 1018_linux-4.19.19.patch
From: http://www.kernel.org
Desc: Linux 4.19.19
+Patch: 1019_linux-4.19.20.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.20
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1019_linux-4.19.20.patch b/1019_linux-4.19.20.patch
new file mode 100644
index 0000000..522d50f
--- /dev/null
+++ b/1019_linux-4.19.20.patch
@@ -0,0 +1,3120 @@
+diff --git a/Makefile b/Makefile
+index 39c4e7c3c13c..f1859811dca1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 19
++SUBLEVEL = 20
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c
+index 318394ed5c7a..5e11ad3164e0 100644
+--- a/arch/arm/mach-cns3xxx/pcie.c
++++ b/arch/arm/mach-cns3xxx/pcie.c
+@@ -83,7 +83,7 @@ static void __iomem *cns3xxx_pci_map_bus(struct pci_bus *bus,
+ } else /* remote PCI bus */
+ base = cnspci->cfg1_regs + ((busno & 0xf) << 20);
+
+- return base + (where & 0xffc) + (devfn << 12);
++ return base + where + (devfn << 12);
+ }
+
+ static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
+diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
+index 29cdc99688f3..9859e1178e6b 100644
+--- a/arch/arm64/kernel/hibernate.c
++++ b/arch/arm64/kernel/hibernate.c
+@@ -299,8 +299,10 @@ int swsusp_arch_suspend(void)
+ dcache_clean_range(__idmap_text_start, __idmap_text_end);
+
+ /* Clean kvm setup code to PoC? */
+- if (el2_reset_needed())
++ if (el2_reset_needed()) {
+ dcache_clean_range(__hyp_idmap_text_start, __hyp_idmap_text_end);
++ dcache_clean_range(__hyp_text_start, __hyp_text_end);
++ }
+
+ /* make the crash dump kernel image protected again */
+ crash_post_resume();
+diff --git a/arch/arm64/kernel/hyp-stub.S b/arch/arm64/kernel/hyp-stub.S
+index e1261fbaa374..17f325ba831e 100644
+--- a/arch/arm64/kernel/hyp-stub.S
++++ b/arch/arm64/kernel/hyp-stub.S
+@@ -28,6 +28,8 @@
+ #include <asm/virt.h>
+
+ .text
++ .pushsection .hyp.text, "ax"
++
+ .align 11
+
+ ENTRY(__hyp_stub_vectors)
+diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
+index ba6b41790fcd..b09b6f75f759 100644
+--- a/arch/arm64/kernel/kaslr.c
++++ b/arch/arm64/kernel/kaslr.c
+@@ -88,6 +88,7 @@ u64 __init kaslr_early_init(u64 dt_phys)
+ * we end up running with module randomization disabled.
+ */
+ module_alloc_base = (u64)_etext - MODULES_VSIZE;
++ __flush_dcache_area(&module_alloc_base, sizeof(module_alloc_base));
+
+ /*
+ * Try to map the FDT early. If this fails, we simply bail,
+diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
+index 30695a868107..5c9073bace83 100644
+--- a/arch/arm64/mm/flush.c
++++ b/arch/arm64/mm/flush.c
+@@ -33,7 +33,11 @@ void sync_icache_aliases(void *kaddr, unsigned long len)
+ __clean_dcache_area_pou(kaddr, len);
+ __flush_icache_all();
+ } else {
+- flush_icache_range(addr, addr + len);
++ /*
++ * Don't issue kick_all_cpus_sync() after I-cache invalidation
++ * for user mappings.
++ */
++ __flush_icache_range(addr, addr + len);
+ }
+ }
+
+diff --git a/drivers/gpio/gpio-altera-a10sr.c b/drivers/gpio/gpio-altera-a10sr.c
+index 6b11f1314248..7f9e0304b510 100644
+--- a/drivers/gpio/gpio-altera-a10sr.c
++++ b/drivers/gpio/gpio-altera-a10sr.c
+@@ -66,8 +66,10 @@ static int altr_a10sr_gpio_direction_input(struct gpio_chip *gc,
+ static int altr_a10sr_gpio_direction_output(struct gpio_chip *gc,
+ unsigned int nr, int value)
+ {
+- if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT))
++ if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT)) {
++ altr_a10sr_gpio_set(gc, nr, value);
+ return 0;
++ }
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
+index e0d6a0a7bc69..e41223c05f6e 100644
+--- a/drivers/gpio/gpio-eic-sprd.c
++++ b/drivers/gpio/gpio-eic-sprd.c
+@@ -180,7 +180,18 @@ static void sprd_eic_free(struct gpio_chip *chip, unsigned int offset)
+
+ static int sprd_eic_get(struct gpio_chip *chip, unsigned int offset)
+ {
+- return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
++ struct sprd_eic *sprd_eic = gpiochip_get_data(chip);
++
++ switch (sprd_eic->type) {
++ case SPRD_EIC_DEBOUNCE:
++ return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
++ case SPRD_EIC_ASYNC:
++ return sprd_eic_read(chip, offset, SPRD_EIC_ASYNC_DATA);
++ case SPRD_EIC_SYNC:
++ return sprd_eic_read(chip, offset, SPRD_EIC_SYNC_DATA);
++ default:
++ return -ENOTSUPP;
++ }
+ }
+
+ static int sprd_eic_direction_input(struct gpio_chip *chip, unsigned int offset)
+@@ -368,6 +379,7 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_EDGE_BOTH:
++ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+diff --git a/drivers/gpio/gpio-pcf857x.c b/drivers/gpio/gpio-pcf857x.c
+index adf72dda25a2..68a35b65925a 100644
+--- a/drivers/gpio/gpio-pcf857x.c
++++ b/drivers/gpio/gpio-pcf857x.c
+@@ -84,6 +84,7 @@ MODULE_DEVICE_TABLE(of, pcf857x_of_table);
+ */
+ struct pcf857x {
+ struct gpio_chip chip;
++ struct irq_chip irqchip;
+ struct i2c_client *client;
+ struct mutex lock; /* protect 'out' */
+ unsigned out; /* software latch */
+@@ -252,18 +253,6 @@ static void pcf857x_irq_bus_sync_unlock(struct irq_data *data)
+ mutex_unlock(&gpio->lock);
+ }
+
+-static struct irq_chip pcf857x_irq_chip = {
+- .name = "pcf857x",
+- .irq_enable = pcf857x_irq_enable,
+- .irq_disable = pcf857x_irq_disable,
+- .irq_ack = noop,
+- .irq_mask = noop,
+- .irq_unmask = noop,
+- .irq_set_wake = pcf857x_irq_set_wake,
+- .irq_bus_lock = pcf857x_irq_bus_lock,
+- .irq_bus_sync_unlock = pcf857x_irq_bus_sync_unlock,
+-};
+-
+ /*-------------------------------------------------------------------------*/
+
+ static int pcf857x_probe(struct i2c_client *client,
+@@ -376,8 +365,17 @@ static int pcf857x_probe(struct i2c_client *client,
+
+ /* Enable irqchip if we have an interrupt */
+ if (client->irq) {
++ gpio->irqchip.name = "pcf857x",
++ gpio->irqchip.irq_enable = pcf857x_irq_enable,
++ gpio->irqchip.irq_disable = pcf857x_irq_disable,
++ gpio->irqchip.irq_ack = noop,
++ gpio->irqchip.irq_mask = noop,
++ gpio->irqchip.irq_unmask = noop,
++ gpio->irqchip.irq_set_wake = pcf857x_irq_set_wake,
++ gpio->irqchip.irq_bus_lock = pcf857x_irq_bus_lock,
++ gpio->irqchip.irq_bus_sync_unlock = pcf857x_irq_bus_sync_unlock,
+ status = gpiochip_irqchip_add_nested(&gpio->chip,
+- &pcf857x_irq_chip,
++ &gpio->irqchip,
+ 0, handle_level_irq,
+ IRQ_TYPE_NONE);
+ if (status) {
+@@ -392,7 +390,7 @@ static int pcf857x_probe(struct i2c_client *client,
+ if (status)
+ goto fail;
+
+- gpiochip_set_nested_irqchip(&gpio->chip, &pcf857x_irq_chip,
++ gpiochip_set_nested_irqchip(&gpio->chip, &gpio->irqchip,
+ client->irq);
+ gpio->irq_parent = client->irq;
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index a8e01d99919c..b3ab6c428423 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -817,7 +817,15 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
+ /* Do not leak kernel stack to userspace */
+ memset(&ge, 0, sizeof(ge));
+
+- ge.timestamp = le->timestamp;
++ /*
++ * We may be running from a nested threaded interrupt in which case
++ * we didn't get the timestamp from lineevent_irq_handler().
++ */
++ if (!le->timestamp)
++ ge.timestamp = ktime_get_real_ns();
++ else
++ ge.timestamp = le->timestamp;
++
+ level = gpiod_get_value_cansleep(le->desc);
+
+ if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
+diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h
+index 9122ee6e55e4..1fe93920fb25 100644
+--- a/drivers/gpu/drm/msm/msm_gpu.h
++++ b/drivers/gpu/drm/msm/msm_gpu.h
+@@ -63,7 +63,7 @@ struct msm_gpu_funcs {
+ struct msm_ringbuffer *(*active_ring)(struct msm_gpu *gpu);
+ void (*recover)(struct msm_gpu *gpu);
+ void (*destroy)(struct msm_gpu *gpu);
+-#ifdef CONFIG_DEBUG_FS
++#if defined(CONFIG_DEBUG_FS) || defined(CONFIG_DEV_COREDUMP)
+ /* show GPU status in debugfs: */
+ void (*show)(struct msm_gpu *gpu, struct msm_gpu_state *state,
+ struct drm_printer *p);
+diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
+index 1fc75647e47b..34ffca618427 100644
+--- a/drivers/infiniband/hw/hfi1/file_ops.c
++++ b/drivers/infiniband/hw/hfi1/file_ops.c
+@@ -488,7 +488,7 @@ static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma)
+ vmf = 1;
+ break;
+ case STATUS:
+- if (flags & (unsigned long)(VM_WRITE | VM_EXEC)) {
++ if (flags & VM_WRITE) {
+ ret = -EPERM;
+ goto done;
+ }
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 4339177629e3..2b8f5ebae821 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -5230,7 +5230,7 @@ static void intel_iommu_put_resv_regions(struct device *dev,
+ struct iommu_resv_region *entry, *next;
+
+ list_for_each_entry_safe(entry, next, head, list) {
+- if (entry->type == IOMMU_RESV_RESERVED)
++ if (entry->type == IOMMU_RESV_MSI)
+ kfree(entry);
+ }
+ }
+diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
+index e6e925add700..6518b012756f 100644
+--- a/drivers/md/raid5-cache.c
++++ b/drivers/md/raid5-cache.c
+@@ -1935,12 +1935,14 @@ out:
+ }
+
+ static struct stripe_head *
+-r5c_recovery_alloc_stripe(struct r5conf *conf,
+- sector_t stripe_sect)
++r5c_recovery_alloc_stripe(
++ struct r5conf *conf,
++ sector_t stripe_sect,
++ int noblock)
+ {
+ struct stripe_head *sh;
+
+- sh = raid5_get_active_stripe(conf, stripe_sect, 0, 1, 0);
++ sh = raid5_get_active_stripe(conf, stripe_sect, 0, noblock, 0);
+ if (!sh)
+ return NULL; /* no more stripe available */
+
+@@ -2150,7 +2152,7 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
+ stripe_sect);
+
+ if (!sh) {
+- sh = r5c_recovery_alloc_stripe(conf, stripe_sect);
++ sh = r5c_recovery_alloc_stripe(conf, stripe_sect, 1);
+ /*
+ * cannot get stripe from raid5_get_active_stripe
+ * try replay some stripes
+@@ -2159,20 +2161,29 @@ r5c_recovery_analyze_meta_block(struct r5l_log *log,
+ r5c_recovery_replay_stripes(
+ cached_stripe_list, ctx);
+ sh = r5c_recovery_alloc_stripe(
+- conf, stripe_sect);
++ conf, stripe_sect, 1);
+ }
+ if (!sh) {
++ int new_size = conf->min_nr_stripes * 2;
+ pr_debug("md/raid:%s: Increasing stripe cache size to %d to recovery data on journal.\n",
+ mdname(mddev),
+- conf->min_nr_stripes * 2);
+- raid5_set_cache_size(mddev,
+- conf->min_nr_stripes * 2);
+- sh = r5c_recovery_alloc_stripe(conf,
+- stripe_sect);
++ new_size);
++ ret = raid5_set_cache_size(mddev, new_size);
++ if (conf->min_nr_stripes <= new_size / 2) {
++ pr_err("md/raid:%s: Cannot increase cache size, ret=%d, new_size=%d, min_nr_stripes=%d, max_nr_stripes=%d\n",
++ mdname(mddev),
++ ret,
++ new_size,
++ conf->min_nr_stripes,
++ conf->max_nr_stripes);
++ return -ENOMEM;
++ }
++ sh = r5c_recovery_alloc_stripe(
++ conf, stripe_sect, 0);
+ }
+ if (!sh) {
+ pr_err("md/raid:%s: Cannot get enough stripes due to memory pressure. Recovery failed.\n",
+- mdname(mddev));
++ mdname(mddev));
+ return -ENOMEM;
+ }
+ list_add_tail(&sh->lru, cached_stripe_list);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index e4e98f47865d..45a3551d3afd 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -6357,6 +6357,7 @@ raid5_show_stripe_cache_size(struct mddev *mddev, char *page)
+ int
+ raid5_set_cache_size(struct mddev *mddev, int size)
+ {
++ int result = 0;
+ struct r5conf *conf = mddev->private;
+
+ if (size <= 16 || size > 32768)
+@@ -6373,11 +6374,14 @@ raid5_set_cache_size(struct mddev *mddev, int size)
+
+ mutex_lock(&conf->cache_size_mutex);
+ while (size > conf->max_nr_stripes)
+- if (!grow_one_stripe(conf, GFP_KERNEL))
++ if (!grow_one_stripe(conf, GFP_KERNEL)) {
++ conf->min_nr_stripes = conf->max_nr_stripes;
++ result = -ENOMEM;
+ break;
++ }
+ mutex_unlock(&conf->cache_size_mutex);
+
+- return 0;
++ return result;
+ }
+ EXPORT_SYMBOL(raid5_set_cache_size);
+
+diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
+index 768972af8b85..0d3b7473bc21 100644
+--- a/drivers/mmc/host/bcm2835.c
++++ b/drivers/mmc/host/bcm2835.c
+@@ -1427,6 +1427,8 @@ static int bcm2835_probe(struct platform_device *pdev)
+
+ err:
+ dev_dbg(dev, "%s -> err %d\n", __func__, ret);
++ if (host->dma_chan_rxtx)
++ dma_release_channel(host->dma_chan_rxtx);
+ mmc_free_host(mmc);
+
+ return ret;
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index 04841386b65d..f171cce5197d 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -784,7 +784,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
+
+ if (timing == MMC_TIMING_MMC_HS400 &&
+ host->dev_comp->hs400_tune)
+- sdr_set_field(host->base + PAD_CMD_TUNE,
++ sdr_set_field(host->base + tune_reg,
+ MSDC_PAD_TUNE_CMDRRDLY,
+ host->hs400_cmd_int_delay);
+ dev_dbg(host->dev, "sclk: %d, timing: %d\n", host->sclk, timing);
+diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
+index d0e83db42ae5..94eeed2a1b53 100644
+--- a/drivers/mmc/host/sdhci-iproc.c
++++ b/drivers/mmc/host/sdhci-iproc.c
+@@ -279,7 +279,10 @@ static int sdhci_iproc_probe(struct platform_device *pdev)
+
+ iproc_host->data = iproc_data;
+
+- mmc_of_parse(host->mmc);
++ ret = mmc_of_parse(host->mmc);
++ if (ret)
++ goto err;
++
+ sdhci_get_of_property(pdev);
+
+ host->mmc->caps |= iproc_host->data->mmc_caps;
+diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
+index 22a817da861e..1e2b53a934fb 100644
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -1888,6 +1888,8 @@ static void ucc_geth_free_tx(struct ucc_geth_private *ugeth)
+ u16 i, j;
+ u8 __iomem *bd;
+
++ netdev_reset_queue(ugeth->ndev);
++
+ ug_info = ugeth->ug_info;
+ uf_info = &ug_info->uf_info;
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
+index babcfd9c0571..75213046563c 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
+@@ -2064,9 +2064,11 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
+ {
+ struct mlx4_cmd_mailbox *mailbox;
+ __be32 *outbox;
++ u64 qword_field;
+ u32 dword_field;
+- int err;
++ u16 word_field;
+ u8 byte_field;
++ int err;
+ static const u8 a0_dmfs_query_hw_steering[] = {
+ [0] = MLX4_STEERING_DMFS_A0_DEFAULT,
+ [1] = MLX4_STEERING_DMFS_A0_DYNAMIC,
+@@ -2094,19 +2096,32 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
+
+ /* QPC/EEC/CQC/EQC/RDMARC attributes */
+
+- MLX4_GET(param->qpc_base, outbox, INIT_HCA_QPC_BASE_OFFSET);
+- MLX4_GET(param->log_num_qps, outbox, INIT_HCA_LOG_QP_OFFSET);
+- MLX4_GET(param->srqc_base, outbox, INIT_HCA_SRQC_BASE_OFFSET);
+- MLX4_GET(param->log_num_srqs, outbox, INIT_HCA_LOG_SRQ_OFFSET);
+- MLX4_GET(param->cqc_base, outbox, INIT_HCA_CQC_BASE_OFFSET);
+- MLX4_GET(param->log_num_cqs, outbox, INIT_HCA_LOG_CQ_OFFSET);
+- MLX4_GET(param->altc_base, outbox, INIT_HCA_ALTC_BASE_OFFSET);
+- MLX4_GET(param->auxc_base, outbox, INIT_HCA_AUXC_BASE_OFFSET);
+- MLX4_GET(param->eqc_base, outbox, INIT_HCA_EQC_BASE_OFFSET);
+- MLX4_GET(param->log_num_eqs, outbox, INIT_HCA_LOG_EQ_OFFSET);
+- MLX4_GET(param->num_sys_eqs, outbox, INIT_HCA_NUM_SYS_EQS_OFFSET);
+- MLX4_GET(param->rdmarc_base, outbox, INIT_HCA_RDMARC_BASE_OFFSET);
+- MLX4_GET(param->log_rd_per_qp, outbox, INIT_HCA_LOG_RD_OFFSET);
++ MLX4_GET(qword_field, outbox, INIT_HCA_QPC_BASE_OFFSET);
++ param->qpc_base = qword_field & ~((u64)0x1f);
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_QP_OFFSET);
++ param->log_num_qps = byte_field & 0x1f;
++ MLX4_GET(qword_field, outbox, INIT_HCA_SRQC_BASE_OFFSET);
++ param->srqc_base = qword_field & ~((u64)0x1f);
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_SRQ_OFFSET);
++ param->log_num_srqs = byte_field & 0x1f;
++ MLX4_GET(qword_field, outbox, INIT_HCA_CQC_BASE_OFFSET);
++ param->cqc_base = qword_field & ~((u64)0x1f);
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_CQ_OFFSET);
++ param->log_num_cqs = byte_field & 0x1f;
++ MLX4_GET(qword_field, outbox, INIT_HCA_ALTC_BASE_OFFSET);
++ param->altc_base = qword_field;
++ MLX4_GET(qword_field, outbox, INIT_HCA_AUXC_BASE_OFFSET);
++ param->auxc_base = qword_field;
++ MLX4_GET(qword_field, outbox, INIT_HCA_EQC_BASE_OFFSET);
++ param->eqc_base = qword_field & ~((u64)0x1f);
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_EQ_OFFSET);
++ param->log_num_eqs = byte_field & 0x1f;
++ MLX4_GET(word_field, outbox, INIT_HCA_NUM_SYS_EQS_OFFSET);
++ param->num_sys_eqs = word_field & 0xfff;
++ MLX4_GET(qword_field, outbox, INIT_HCA_RDMARC_BASE_OFFSET);
++ param->rdmarc_base = qword_field & ~((u64)0x1f);
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_RD_OFFSET);
++ param->log_rd_per_qp = byte_field & 0x7;
+
+ MLX4_GET(dword_field, outbox, INIT_HCA_FLAGS_OFFSET);
+ if (dword_field & (1 << INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN)) {
+@@ -2125,22 +2140,21 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
+ /* steering attributes */
+ if (param->steering_mode == MLX4_STEERING_MODE_DEVICE_MANAGED) {
+ MLX4_GET(param->mc_base, outbox, INIT_HCA_FS_BASE_OFFSET);
+- MLX4_GET(param->log_mc_entry_sz, outbox,
+- INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET);
+- MLX4_GET(param->log_mc_table_sz, outbox,
+- INIT_HCA_FS_LOG_TABLE_SZ_OFFSET);
+- MLX4_GET(byte_field, outbox,
+- INIT_HCA_FS_A0_OFFSET);
++ MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET);
++ param->log_mc_entry_sz = byte_field & 0x1f;
++ MLX4_GET(byte_field, outbox, INIT_HCA_FS_LOG_TABLE_SZ_OFFSET);
++ param->log_mc_table_sz = byte_field & 0x1f;
++ MLX4_GET(byte_field, outbox, INIT_HCA_FS_A0_OFFSET);
+ param->dmfs_high_steer_mode =
+ a0_dmfs_query_hw_steering[(byte_field >> 6) & 3];
+ } else {
+ MLX4_GET(param->mc_base, outbox, INIT_HCA_MC_BASE_OFFSET);
+- MLX4_GET(param->log_mc_entry_sz, outbox,
+- INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET);
+- MLX4_GET(param->log_mc_hash_sz, outbox,
+- INIT_HCA_LOG_MC_HASH_SZ_OFFSET);
+- MLX4_GET(param->log_mc_table_sz, outbox,
+- INIT_HCA_LOG_MC_TABLE_SZ_OFFSET);
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET);
++ param->log_mc_entry_sz = byte_field & 0x1f;
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_HASH_SZ_OFFSET);
++ param->log_mc_hash_sz = byte_field & 0x1f;
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MC_TABLE_SZ_OFFSET);
++ param->log_mc_table_sz = byte_field & 0x1f;
+ }
+
+ /* CX3 is capable of extending CQEs/EQEs from 32 to 64 bytes */
+@@ -2164,15 +2178,18 @@ int mlx4_QUERY_HCA(struct mlx4_dev *dev,
+ /* TPT attributes */
+
+ MLX4_GET(param->dmpt_base, outbox, INIT_HCA_DMPT_BASE_OFFSET);
+- MLX4_GET(param->mw_enabled, outbox, INIT_HCA_TPT_MW_OFFSET);
+- MLX4_GET(param->log_mpt_sz, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET);
++ MLX4_GET(byte_field, outbox, INIT_HCA_TPT_MW_OFFSET);
++ param->mw_enabled = byte_field >> 7;
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_MPT_SZ_OFFSET);
++ param->log_mpt_sz = byte_field & 0x3f;
+ MLX4_GET(param->mtt_base, outbox, INIT_HCA_MTT_BASE_OFFSET);
+ MLX4_GET(param->cmpt_base, outbox, INIT_HCA_CMPT_BASE_OFFSET);
+
+ /* UAR attributes */
+
+ MLX4_GET(param->uar_page_sz, outbox, INIT_HCA_UAR_PAGE_SZ_OFFSET);
+- MLX4_GET(param->log_uar_sz, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET);
++ MLX4_GET(byte_field, outbox, INIT_HCA_LOG_UAR_SZ_OFFSET);
++ param->log_uar_sz = byte_field & 0xf;
+
+ /* phv_check enable */
+ MLX4_GET(byte_field, outbox, INIT_HCA_CACHELINE_SZ_OFFSET);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index ea7dedc2d5ad..d6706475a3ba 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1133,13 +1133,6 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
+ int err = 0;
+ u8 *smac_v;
+
+- if (vport->info.spoofchk && !is_valid_ether_addr(vport->info.mac)) {
+- mlx5_core_warn(esw->dev,
+- "vport[%d] configure ingress rules failed, illegal mac with spoofchk\n",
+- vport->vport);
+- return -EPERM;
+- }
+-
+ esw_vport_cleanup_ingress_rules(esw, vport);
+
+ if (!vport->info.vlan && !vport->info.qos && !vport->info.spoofchk) {
+@@ -1696,7 +1689,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev)
+ int vport_num;
+ int err;
+
+- if (!MLX5_ESWITCH_MANAGER(dev))
++ if (!MLX5_VPORT_MANAGER(dev))
+ return 0;
+
+ esw_info(dev,
+@@ -1765,7 +1758,7 @@ abort:
+
+ void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)
+ {
+- if (!esw || !MLX5_ESWITCH_MANAGER(esw->dev))
++ if (!esw || !MLX5_VPORT_MANAGER(esw->dev))
+ return;
+
+ esw_info(esw->dev, "cleanup\n");
+@@ -1812,13 +1805,10 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
+ mutex_lock(&esw->state_lock);
+ evport = &esw->vports[vport];
+
+- if (evport->info.spoofchk && !is_valid_ether_addr(mac)) {
++ if (evport->info.spoofchk && !is_valid_ether_addr(mac))
+ mlx5_core_warn(esw->dev,
+- "MAC invalidation is not allowed when spoofchk is on, vport(%d)\n",
++ "Set invalid MAC while spoofchk is on, vport(%d)\n",
+ vport);
+- err = -EPERM;
+- goto unlock;
+- }
+
+ err = mlx5_modify_nic_vport_mac_address(esw->dev, vport, mac);
+ if (err) {
+@@ -1964,6 +1954,10 @@ int mlx5_eswitch_set_vport_spoofchk(struct mlx5_eswitch *esw,
+ evport = &esw->vports[vport];
+ pschk = evport->info.spoofchk;
+ evport->info.spoofchk = spoofchk;
++ if (pschk && !is_valid_ether_addr(evport->info.mac))
++ mlx5_core_warn(esw->dev,
++ "Spoofchk in set while MAC is invalid, vport(%d)\n",
++ evport->vport);
+ if (evport->enabled && esw->mode == SRIOV_LEGACY)
+ err = esw_vport_ingress_config(esw, evport);
+ if (err)
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index d6f753925352..8441c86d9f3b 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -344,7 +344,7 @@ static int ravb_ring_init(struct net_device *ndev, int q)
+ int i;
+
+ priv->rx_buf_sz = (ndev->mtu <= 1492 ? PKT_BUF_SZ : ndev->mtu) +
+- ETH_HLEN + VLAN_HLEN;
++ ETH_HLEN + VLAN_HLEN + sizeof(__sum16);
+
+ /* Allocate RX and TX skb rings */
+ priv->rx_skb[q] = kcalloc(priv->num_rx_ring[q],
+@@ -525,13 +525,15 @@ static void ravb_rx_csum(struct sk_buff *skb)
+ {
+ u8 *hw_csum;
+
+- /* The hardware checksum is 2 bytes appended to packet data */
+- if (unlikely(skb->len < 2))
++ /* The hardware checksum is contained in sizeof(__sum16) (2) bytes
++ * appended to packet data
++ */
++ if (unlikely(skb->len < sizeof(__sum16)))
+ return;
+- hw_csum = skb_tail_pointer(skb) - 2;
++ hw_csum = skb_tail_pointer(skb) - sizeof(__sum16);
+ skb->csum = csum_unfold((__force __sum16)get_unaligned_le16(hw_csum));
+ skb->ip_summed = CHECKSUM_COMPLETE;
+- skb_trim(skb, skb->len - 2);
++ skb_trim(skb, skb->len - sizeof(__sum16));
+ }
+
+ /* Packet receive function for Ethernet AVB */
+diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
+index 4a949569ec4c..5fb541897863 100644
+--- a/drivers/net/ipvlan/ipvlan_main.c
++++ b/drivers/net/ipvlan/ipvlan_main.c
+@@ -97,12 +97,12 @@ static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval)
+ err = ipvlan_register_nf_hook(read_pnet(&port->pnet));
+ if (!err) {
+ mdev->l3mdev_ops = &ipvl_l3mdev_ops;
+- mdev->priv_flags |= IFF_L3MDEV_MASTER;
++ mdev->priv_flags |= IFF_L3MDEV_RX_HANDLER;
+ } else
+ goto fail;
+ } else if (port->mode == IPVLAN_MODE_L3S) {
+ /* Old mode was L3S */
+- mdev->priv_flags &= ~IFF_L3MDEV_MASTER;
++ mdev->priv_flags &= ~IFF_L3MDEV_RX_HANDLER;
+ ipvlan_unregister_nf_hook(read_pnet(&port->pnet));
+ mdev->l3mdev_ops = NULL;
+ }
+@@ -162,7 +162,7 @@ static void ipvlan_port_destroy(struct net_device *dev)
+ struct sk_buff *skb;
+
+ if (port->mode == IPVLAN_MODE_L3S) {
+- dev->priv_flags &= ~IFF_L3MDEV_MASTER;
++ dev->priv_flags &= ~IFF_L3MDEV_RX_HANDLER;
+ ipvlan_unregister_nf_hook(dev_net(dev));
+ dev->l3mdev_ops = NULL;
+ }
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 33978b0cdac8..65844f28db30 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -866,8 +866,6 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
+ tun_napi_init(tun, tfile, napi, napi_frags);
+ }
+
+- tun_set_real_num_queues(tun);
+-
+ /* device is allowed to go away first, so no need to hold extra
+ * refcnt.
+ */
+@@ -879,6 +877,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
+ rcu_assign_pointer(tfile->tun, tun);
+ rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
+ tun->numqueues++;
++ tun_set_real_num_queues(tun);
+ out:
+ return err;
+ }
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index ad14fbfa1864..42feaa4d2916 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -57,6 +57,8 @@ module_param(napi_tx, bool, 0644);
+ #define VIRTIO_XDP_TX BIT(0)
+ #define VIRTIO_XDP_REDIR BIT(1)
+
++#define VIRTIO_XDP_FLAG BIT(0)
++
+ /* RX packet size EWMA. The average packet size is used to determine the packet
+ * buffer size when refilling RX rings. As the entire RX ring may be refilled
+ * at once, the weight is chosen so that the EWMA will be insensitive to short-
+@@ -251,6 +253,21 @@ struct padded_vnet_hdr {
+ char padding[4];
+ };
+
++static bool is_xdp_frame(void *ptr)
++{
++ return (unsigned long)ptr & VIRTIO_XDP_FLAG;
++}
++
++static void *xdp_to_ptr(struct xdp_frame *ptr)
++{
++ return (void *)((unsigned long)ptr | VIRTIO_XDP_FLAG);
++}
++
++static struct xdp_frame *ptr_to_xdp(void *ptr)
++{
++ return (struct xdp_frame *)((unsigned long)ptr & ~VIRTIO_XDP_FLAG);
++}
++
+ /* Converting between virtqueue no. and kernel tx/rx queue no.
+ * 0:rx0 1:tx0 2:rx1 3:tx1 ... 2N:rxN 2N+1:txN 2N+2:cvq
+ */
+@@ -461,7 +478,8 @@ static int __virtnet_xdp_xmit_one(struct virtnet_info *vi,
+
+ sg_init_one(sq->sg, xdpf->data, xdpf->len);
+
+- err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdpf, GFP_ATOMIC);
++ err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdp_to_ptr(xdpf),
++ GFP_ATOMIC);
+ if (unlikely(err))
+ return -ENOSPC; /* Caller handle free/refcnt */
+
+@@ -481,36 +499,37 @@ static int virtnet_xdp_xmit(struct net_device *dev,
+ {
+ struct virtnet_info *vi = netdev_priv(dev);
+ struct receive_queue *rq = vi->rq;
+- struct xdp_frame *xdpf_sent;
+ struct bpf_prog *xdp_prog;
+ struct send_queue *sq;
+ unsigned int len;
+ int drops = 0;
+ int kicks = 0;
+ int ret, err;
++ void *ptr;
+ int i;
+
+- sq = virtnet_xdp_sq(vi);
+-
+- if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
+- ret = -EINVAL;
+- drops = n;
+- goto out;
+- }
+-
+ /* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this
+ * indicate XDP resources have been successfully allocated.
+ */
+ xdp_prog = rcu_dereference(rq->xdp_prog);
+- if (!xdp_prog) {
+- ret = -ENXIO;
++ if (!xdp_prog)
++ return -ENXIO;
++
++ sq = virtnet_xdp_sq(vi);
++
++ if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
++ ret = -EINVAL;
+ drops = n;
+ goto out;
+ }
+
+ /* Free up any pending old buffers before queueing new ones. */
+- while ((xdpf_sent = virtqueue_get_buf(sq->vq, &len)) != NULL)
+- xdp_return_frame(xdpf_sent);
++ while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
++ if (likely(is_xdp_frame(ptr)))
++ xdp_return_frame(ptr_to_xdp(ptr));
++ else
++ napi_consume_skb(ptr, false);
++ }
+
+ for (i = 0; i < n; i++) {
+ struct xdp_frame *xdpf = frames[i];
+@@ -1329,20 +1348,28 @@ static int virtnet_receive(struct receive_queue *rq, int budget,
+ return stats.packets;
+ }
+
+-static void free_old_xmit_skbs(struct send_queue *sq)
++static void free_old_xmit_skbs(struct send_queue *sq, bool in_napi)
+ {
+- struct sk_buff *skb;
+ unsigned int len;
+ unsigned int packets = 0;
+ unsigned int bytes = 0;
++ void *ptr;
+
+- while ((skb = virtqueue_get_buf(sq->vq, &len)) != NULL) {
+- pr_debug("Sent skb %p\n", skb);
++ while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
++ if (likely(!is_xdp_frame(ptr))) {
++ struct sk_buff *skb = ptr;
+
+- bytes += skb->len;
+- packets++;
++ pr_debug("Sent skb %p\n", skb);
++
++ bytes += skb->len;
++ napi_consume_skb(skb, in_napi);
++ } else {
++ struct xdp_frame *frame = ptr_to_xdp(ptr);
+
+- dev_consume_skb_any(skb);
++ bytes += frame->len;
++ xdp_return_frame(frame);
++ }
++ packets++;
+ }
+
+ /* Avoid overhead when no packets have been processed
+@@ -1357,6 +1384,16 @@ static void free_old_xmit_skbs(struct send_queue *sq)
+ u64_stats_update_end(&sq->stats.syncp);
+ }
+
++static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
++{
++ if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
++ return false;
++ else if (q < vi->curr_queue_pairs)
++ return true;
++ else
++ return false;
++}
++
+ static void virtnet_poll_cleantx(struct receive_queue *rq)
+ {
+ struct virtnet_info *vi = rq->vq->vdev->priv;
+@@ -1364,11 +1401,11 @@ static void virtnet_poll_cleantx(struct receive_queue *rq)
+ struct send_queue *sq = &vi->sq[index];
+ struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, index);
+
+- if (!sq->napi.weight)
++ if (!sq->napi.weight || is_xdp_raw_buffer_queue(vi, index))
+ return;
+
+ if (__netif_tx_trylock(txq)) {
+- free_old_xmit_skbs(sq);
++ free_old_xmit_skbs(sq, true);
+ __netif_tx_unlock(txq);
+ }
+
+@@ -1441,10 +1478,18 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget)
+ {
+ struct send_queue *sq = container_of(napi, struct send_queue, napi);
+ struct virtnet_info *vi = sq->vq->vdev->priv;
+- struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, vq2txq(sq->vq));
++ unsigned int index = vq2txq(sq->vq);
++ struct netdev_queue *txq;
+
++ if (unlikely(is_xdp_raw_buffer_queue(vi, index))) {
++ /* We don't need to enable cb for XDP */
++ napi_complete_done(napi, 0);
++ return 0;
++ }
++
++ txq = netdev_get_tx_queue(vi->dev, index);
+ __netif_tx_lock(txq, raw_smp_processor_id());
+- free_old_xmit_skbs(sq);
++ free_old_xmit_skbs(sq, true);
+ __netif_tx_unlock(txq);
+
+ virtqueue_napi_complete(napi, sq->vq, 0);
+@@ -1513,7 +1558,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
+ bool use_napi = sq->napi.weight;
+
+ /* Free up any pending old buffers before queueing new ones. */
+- free_old_xmit_skbs(sq);
++ free_old_xmit_skbs(sq, false);
+
+ if (use_napi && kick)
+ virtqueue_enable_cb_delayed(sq->vq);
+@@ -1556,7 +1601,7 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (!use_napi &&
+ unlikely(!virtqueue_enable_cb_delayed(sq->vq))) {
+ /* More just got used, free them then recheck. */
+- free_old_xmit_skbs(sq);
++ free_old_xmit_skbs(sq, false);
+ if (sq->vq->num_free >= 2+MAX_SKB_FRAGS) {
+ netif_start_subqueue(dev, qnum);
+ virtqueue_disable_cb(sq->vq);
+@@ -2345,6 +2390,10 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
+ return -ENOMEM;
+ }
+
++ old_prog = rtnl_dereference(vi->rq[0].xdp_prog);
++ if (!prog && !old_prog)
++ return 0;
++
+ if (prog) {
+ prog = bpf_prog_add(prog, vi->max_queue_pairs - 1);
+ if (IS_ERR(prog))
+@@ -2352,36 +2401,62 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog,
+ }
+
+ /* Make sure NAPI is not using any XDP TX queues for RX. */
+- if (netif_running(dev))
+- for (i = 0; i < vi->max_queue_pairs; i++)
++ if (netif_running(dev)) {
++ for (i = 0; i < vi->max_queue_pairs; i++) {
+ napi_disable(&vi->rq[i].napi);
++ virtnet_napi_tx_disable(&vi->sq[i].napi);
++ }
++ }
++
++ if (!prog) {
++ for (i = 0; i < vi->max_queue_pairs; i++) {
++ rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
++ if (i == 0)
++ virtnet_restore_guest_offloads(vi);
++ }
++ synchronize_net();
++ }
+
+- netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
+ err = _virtnet_set_queues(vi, curr_qp + xdp_qp);
+ if (err)
+ goto err;
++ netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
+ vi->xdp_queue_pairs = xdp_qp;
+
+- for (i = 0; i < vi->max_queue_pairs; i++) {
+- old_prog = rtnl_dereference(vi->rq[i].xdp_prog);
+- rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
+- if (i == 0) {
+- if (!old_prog)
++ if (prog) {
++ for (i = 0; i < vi->max_queue_pairs; i++) {
++ rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
++ if (i == 0 && !old_prog)
+ virtnet_clear_guest_offloads(vi);
+- if (!prog)
+- virtnet_restore_guest_offloads(vi);
+ }
++ }
++
++ for (i = 0; i < vi->max_queue_pairs; i++) {
+ if (old_prog)
+ bpf_prog_put(old_prog);
+- if (netif_running(dev))
++ if (netif_running(dev)) {
+ virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
++ virtnet_napi_tx_enable(vi, vi->sq[i].vq,
++ &vi->sq[i].napi);
++ }
+ }
+
+ return 0;
+
+ err:
+- for (i = 0; i < vi->max_queue_pairs; i++)
+- virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
++ if (!prog) {
++ virtnet_clear_guest_offloads(vi);
++ for (i = 0; i < vi->max_queue_pairs; i++)
++ rcu_assign_pointer(vi->rq[i].xdp_prog, old_prog);
++ }
++
++ if (netif_running(dev)) {
++ for (i = 0; i < vi->max_queue_pairs; i++) {
++ virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
++ virtnet_napi_tx_enable(vi, vi->sq[i].vq,
++ &vi->sq[i].napi);
++ }
++ }
+ if (prog)
+ bpf_prog_sub(prog, vi->max_queue_pairs - 1);
+ return err;
+@@ -2537,16 +2612,6 @@ static void free_receive_page_frags(struct virtnet_info *vi)
+ put_page(vi->rq[i].alloc_frag.page);
+ }
+
+-static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
+-{
+- if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
+- return false;
+- else if (q < vi->curr_queue_pairs)
+- return true;
+- else
+- return false;
+-}
+-
+ static void free_unused_bufs(struct virtnet_info *vi)
+ {
+ void *buf;
+@@ -2555,10 +2620,10 @@ static void free_unused_bufs(struct virtnet_info *vi)
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+ struct virtqueue *vq = vi->sq[i].vq;
+ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
+- if (!is_xdp_raw_buffer_queue(vi, i))
++ if (!is_xdp_frame(buf))
+ dev_kfree_skb(buf);
+ else
+- put_page(virt_to_head_page(buf));
++ xdp_return_frame(ptr_to_xdp(buf));
+ }
+ }
+
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index 40b9051a7fce..258742830e36 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -221,7 +221,8 @@ static ssize_t of_device_get_modalias(struct device *dev, char *str, ssize_t len
+ return -ENODEV;
+
+ /* Name & Type */
+- csize = snprintf(str, len, "of:N%sT%s", dev->of_node->name,
++ /* %p eats all alphanum characters, so %c must be used here */
++ csize = snprintf(str, len, "of:N%pOFn%c%s", dev->of_node, 'T',
+ dev->of_node->type);
+ tsize = csize;
+ len -= csize;
+@@ -300,7 +301,7 @@ void of_device_uevent(struct device *dev, struct kobj_uevent_env *env)
+ if ((!dev) || (!dev->of_node))
+ return;
+
+- add_uevent_var(env, "OF_NAME=%s", dev->of_node->name);
++ add_uevent_var(env, "OF_NAME=%pOFn", dev->of_node);
+ add_uevent_var(env, "OF_FULLNAME=%pOF", dev->of_node);
+ if (dev->of_node->type && strcmp("<NULL>", dev->of_node->type) != 0)
+ add_uevent_var(env, "OF_TYPE=%s", dev->of_node->type);
+diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
+index ecea92f68c87..45c0b1f4cb69 100644
+--- a/drivers/of/dynamic.c
++++ b/drivers/of/dynamic.c
+@@ -275,9 +275,6 @@ void __of_detach_node(struct device_node *np)
+
+ /**
+ * of_detach_node() - "Unplug" a node from the device tree.
+- *
+- * The caller must hold a reference to the node. The memory associated with
+- * the node is not freed until its refcount goes to zero.
+ */
+ int of_detach_node(struct device_node *np)
+ {
+@@ -333,6 +330,25 @@ void of_node_release(struct kobject *kobj)
+ if (!of_node_check_flag(node, OF_DYNAMIC))
+ return;
+
++ if (of_node_check_flag(node, OF_OVERLAY)) {
++
++ if (!of_node_check_flag(node, OF_OVERLAY_FREE_CSET)) {
++ /* premature refcount of zero, do not free memory */
++ pr_err("ERROR: memory leak before free overlay changeset, %pOF\n",
++ node);
++ return;
++ }
++
++ /*
++ * If node->properties non-empty then properties were added
++ * to this node either by different overlay that has not
++ * yet been removed, or by a non-overlay mechanism.
++ */
++ if (node->properties)
++ pr_err("ERROR: %s(), unexpected properties in %pOF\n",
++ __func__, node);
++ }
++
+ property_list_free(node->properties);
+ property_list_free(node->deadprops);
+
+@@ -437,6 +453,16 @@ struct device_node *__of_node_dup(const struct device_node *np,
+
+ static void __of_changeset_entry_destroy(struct of_changeset_entry *ce)
+ {
++ if (ce->action == OF_RECONFIG_ATTACH_NODE &&
++ of_node_check_flag(ce->np, OF_OVERLAY)) {
++ if (kref_read(&ce->np->kobj.kref) > 1) {
++ pr_err("ERROR: memory leak, expected refcount 1 instead of %d, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node %pOF\n",
++ kref_read(&ce->np->kobj.kref), ce->np);
++ } else {
++ of_node_set_flag(ce->np, OF_OVERLAY_FREE_CSET);
++ }
++ }
++
+ of_node_put(ce->np);
+ list_del(&ce->node);
+ kfree(ce);
+diff --git a/drivers/of/kobj.c b/drivers/of/kobj.c
+index 7a0a18980b98..c72eef988041 100644
+--- a/drivers/of/kobj.c
++++ b/drivers/of/kobj.c
+@@ -133,6 +133,9 @@ int __of_attach_node_sysfs(struct device_node *np)
+ }
+ if (!name)
+ return -ENOMEM;
++
++ of_node_get(np);
++
+ rc = kobject_add(&np->kobj, parent, "%s", name);
+ kfree(name);
+ if (rc)
+@@ -159,6 +162,5 @@ void __of_detach_node_sysfs(struct device_node *np)
+ kobject_del(&np->kobj);
+ }
+
+- /* finally remove the kobj_init ref */
+ of_node_put(np);
+ }
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index e92391d6d1bd..5ad1342f5682 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -97,8 +97,8 @@ static int of_mdiobus_register_phy(struct mii_bus *mdio,
+ return rc;
+ }
+
+- dev_dbg(&mdio->dev, "registered phy %s at address %i\n",
+- child->name, addr);
++ dev_dbg(&mdio->dev, "registered phy %pOFn at address %i\n",
++ child, addr);
+ return 0;
+ }
+
+@@ -127,8 +127,8 @@ static int of_mdiobus_register_device(struct mii_bus *mdio,
+ return rc;
+ }
+
+- dev_dbg(&mdio->dev, "registered mdio device %s at address %i\n",
+- child->name, addr);
++ dev_dbg(&mdio->dev, "registered mdio device %pOFn at address %i\n",
++ child, addr);
+ return 0;
+ }
+
+@@ -263,8 +263,8 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
+ continue;
+
+ /* be noisy to encourage people to set reg property */
+- dev_info(&mdio->dev, "scan phy %s at address %i\n",
+- child->name, addr);
++ dev_info(&mdio->dev, "scan phy %pOFn at address %i\n",
++ child, addr);
+
+ if (of_mdiobus_child_is_phy(child)) {
+ rc = of_mdiobus_register_phy(mdio, child, addr);
+diff --git a/drivers/of/of_numa.c b/drivers/of/of_numa.c
+index 2411ed3c7303..f5b452218092 100644
+--- a/drivers/of/of_numa.c
++++ b/drivers/of/of_numa.c
+@@ -168,8 +168,8 @@ int of_node_to_nid(struct device_node *device)
+ np = of_get_next_parent(np);
+ }
+ if (np && r)
+- pr_warn("Invalid \"numa-node-id\" property in node %s\n",
+- np->name);
++ pr_warn("Invalid \"numa-node-id\" property in node %pOFn\n",
++ np);
+ of_node_put(np);
+
+ /*
+diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
+index baa9cee6fa2c..9808aae4621a 100644
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -23,6 +23,26 @@
+
+ #include "of_private.h"
+
++/**
++ * struct target - info about current target node as recursing through overlay
++ * @np: node where current level of overlay will be applied
++ * @in_livetree: @np is a node in the live devicetree
++ *
++ * Used in the algorithm to create the portion of a changeset that describes
++ * an overlay fragment, which is a devicetree subtree. Initially @np is a node
++ * in the live devicetree where the overlay subtree is targeted to be grafted
++ * into. When recursing to the next level of the overlay subtree, the target
++ * also recurses to the next level of the live devicetree, as long as overlay
++ * subtree node also exists in the live devicetree. When a node in the overlay
++ * subtree does not exist at the same level in the live devicetree, target->np
++ * points to a newly allocated node, and all subsequent targets in the subtree
++ * will be newly allocated nodes.
++ */
++struct target {
++ struct device_node *np;
++ bool in_livetree;
++};
++
+ /**
+ * struct fragment - info about fragment nodes in overlay expanded device tree
+ * @target: target of the overlay operation
+@@ -72,8 +92,7 @@ static int devicetree_corrupt(void)
+ }
+
+ static int build_changeset_next_level(struct overlay_changeset *ovcs,
+- struct device_node *target_node,
+- const struct device_node *overlay_node);
++ struct target *target, const struct device_node *overlay_node);
+
+ /*
+ * of_resolve_phandles() finds the largest phandle in the live tree.
+@@ -257,14 +276,17 @@ err_free_target_path:
+ /**
+ * add_changeset_property() - add @overlay_prop to overlay changeset
+ * @ovcs: overlay changeset
+- * @target_node: where to place @overlay_prop in live tree
++ * @target: where @overlay_prop will be placed
+ * @overlay_prop: property to add or update, from overlay tree
+ * @is_symbols_prop: 1 if @overlay_prop is from node "/__symbols__"
+ *
+- * If @overlay_prop does not already exist in @target_node, add changeset entry
+- * to add @overlay_prop in @target_node, else add changeset entry to update
++ * If @overlay_prop does not already exist in live devicetree, add changeset
++ * entry to add @overlay_prop in @target, else add changeset entry to update
+ * value of @overlay_prop.
+ *
++ * @target may be either in the live devicetree or in a new subtree that
++ * is contained in the changeset.
++ *
+ * Some special properties are not updated (no error returned).
+ *
+ * Update of property in symbols node is not allowed.
+@@ -273,20 +295,22 @@ err_free_target_path:
+ * invalid @overlay.
+ */
+ static int add_changeset_property(struct overlay_changeset *ovcs,
+- struct device_node *target_node,
+- struct property *overlay_prop,
++ struct target *target, struct property *overlay_prop,
+ bool is_symbols_prop)
+ {
+ struct property *new_prop = NULL, *prop;
+ int ret = 0;
+
+- prop = of_find_property(target_node, overlay_prop->name, NULL);
+-
+ if (!of_prop_cmp(overlay_prop->name, "name") ||
+ !of_prop_cmp(overlay_prop->name, "phandle") ||
+ !of_prop_cmp(overlay_prop->name, "linux,phandle"))
+ return 0;
+
++ if (target->in_livetree)
++ prop = of_find_property(target->np, overlay_prop->name, NULL);
++ else
++ prop = NULL;
++
+ if (is_symbols_prop) {
+ if (prop)
+ return -EINVAL;
+@@ -299,10 +323,10 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
+ return -ENOMEM;
+
+ if (!prop)
+- ret = of_changeset_add_property(&ovcs->cset, target_node,
++ ret = of_changeset_add_property(&ovcs->cset, target->np,
+ new_prop);
+ else
+- ret = of_changeset_update_property(&ovcs->cset, target_node,
++ ret = of_changeset_update_property(&ovcs->cset, target->np,
+ new_prop);
+
+ if (ret) {
+@@ -315,14 +339,14 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
+
+ /**
+ * add_changeset_node() - add @node (and children) to overlay changeset
+- * @ovcs: overlay changeset
+- * @target_node: where to place @node in live tree
+- * @node: node from within overlay device tree fragment
++ * @ovcs: overlay changeset
++ * @target: where @node will be placed in live tree or changeset
++ * @node: node from within overlay device tree fragment
+ *
+- * If @node does not already exist in @target_node, add changeset entry
+- * to add @node in @target_node.
++ * If @node does not already exist in @target, add changeset entry
++ * to add @node in @target.
+ *
+- * If @node already exists in @target_node, and the existing node has
++ * If @node already exists in @target, and the existing node has
+ * a phandle, the overlay node is not allowed to have a phandle.
+ *
+ * If @node has child nodes, add the children recursively via
+@@ -355,38 +379,46 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
+ * invalid @overlay.
+ */
+ static int add_changeset_node(struct overlay_changeset *ovcs,
+- struct device_node *target_node, struct device_node *node)
++ struct target *target, struct device_node *node)
+ {
+ const char *node_kbasename;
+ struct device_node *tchild;
++ struct target target_child;
+ int ret = 0;
+
+ node_kbasename = kbasename(node->full_name);
+
+- for_each_child_of_node(target_node, tchild)
++ for_each_child_of_node(target->np, tchild)
+ if (!of_node_cmp(node_kbasename, kbasename(tchild->full_name)))
+ break;
+
+ if (!tchild) {
+- tchild = __of_node_dup(node, node_kbasename);
++ tchild = __of_node_dup(NULL, node_kbasename);
+ if (!tchild)
+ return -ENOMEM;
+
+- tchild->parent = target_node;
++ tchild->parent = target->np;
++ of_node_set_flag(tchild, OF_OVERLAY);
+
+ ret = of_changeset_attach_node(&ovcs->cset, tchild);
+ if (ret)
+ return ret;
+
+- ret = build_changeset_next_level(ovcs, tchild, node);
++ target_child.np = tchild;
++ target_child.in_livetree = false;
++
++ ret = build_changeset_next_level(ovcs, &target_child, node);
+ of_node_put(tchild);
+ return ret;
+ }
+
+- if (node->phandle && tchild->phandle)
++ if (node->phandle && tchild->phandle) {
+ ret = -EINVAL;
+- else
+- ret = build_changeset_next_level(ovcs, tchild, node);
++ } else {
++ target_child.np = tchild;
++ target_child.in_livetree = target->in_livetree;
++ ret = build_changeset_next_level(ovcs, &target_child, node);
++ }
+ of_node_put(tchild);
+
+ return ret;
+@@ -395,7 +427,7 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
+ /**
+ * build_changeset_next_level() - add level of overlay changeset
+ * @ovcs: overlay changeset
+- * @target_node: where to place @overlay_node in live tree
++ * @target: where to place @overlay_node in live tree
+ * @overlay_node: node from within an overlay device tree fragment
+ *
+ * Add the properties (if any) and nodes (if any) from @overlay_node to the
+@@ -408,27 +440,26 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
+ * invalid @overlay_node.
+ */
+ static int build_changeset_next_level(struct overlay_changeset *ovcs,
+- struct device_node *target_node,
+- const struct device_node *overlay_node)
++ struct target *target, const struct device_node *overlay_node)
+ {
+ struct device_node *child;
+ struct property *prop;
+ int ret;
+
+ for_each_property_of_node(overlay_node, prop) {
+- ret = add_changeset_property(ovcs, target_node, prop, 0);
++ ret = add_changeset_property(ovcs, target, prop, 0);
+ if (ret) {
+ pr_debug("Failed to apply prop @%pOF/%s, err=%d\n",
+- target_node, prop->name, ret);
++ target->np, prop->name, ret);
+ return ret;
+ }
+ }
+
+ for_each_child_of_node(overlay_node, child) {
+- ret = add_changeset_node(ovcs, target_node, child);
++ ret = add_changeset_node(ovcs, target, child);
+ if (ret) {
+- pr_debug("Failed to apply node @%pOF/%s, err=%d\n",
+- target_node, child->name, ret);
++ pr_debug("Failed to apply node @%pOF/%pOFn, err=%d\n",
++ target->np, child, ret);
+ of_node_put(child);
+ return ret;
+ }
+@@ -441,17 +472,17 @@ static int build_changeset_next_level(struct overlay_changeset *ovcs,
+ * Add the properties from __overlay__ node to the @ovcs->cset changeset.
+ */
+ static int build_changeset_symbols_node(struct overlay_changeset *ovcs,
+- struct device_node *target_node,
++ struct target *target,
+ const struct device_node *overlay_symbols_node)
+ {
+ struct property *prop;
+ int ret;
+
+ for_each_property_of_node(overlay_symbols_node, prop) {
+- ret = add_changeset_property(ovcs, target_node, prop, 1);
++ ret = add_changeset_property(ovcs, target, prop, 1);
+ if (ret) {
+ pr_debug("Failed to apply prop @%pOF/%s, err=%d\n",
+- target_node, prop->name, ret);
++ target->np, prop->name, ret);
+ return ret;
+ }
+ }
+@@ -474,6 +505,7 @@ static int build_changeset_symbols_node(struct overlay_changeset *ovcs,
+ static int build_changeset(struct overlay_changeset *ovcs)
+ {
+ struct fragment *fragment;
++ struct target target;
+ int fragments_count, i, ret;
+
+ /*
+@@ -488,7 +520,9 @@ static int build_changeset(struct overlay_changeset *ovcs)
+ for (i = 0; i < fragments_count; i++) {
+ fragment = &ovcs->fragments[i];
+
+- ret = build_changeset_next_level(ovcs, fragment->target,
++ target.np = fragment->target;
++ target.in_livetree = true;
++ ret = build_changeset_next_level(ovcs, &target,
+ fragment->overlay);
+ if (ret) {
+ pr_debug("apply failed '%pOF'\n", fragment->target);
+@@ -498,7 +532,10 @@ static int build_changeset(struct overlay_changeset *ovcs)
+
+ if (ovcs->symbols_fragment) {
+ fragment = &ovcs->fragments[ovcs->count - 1];
+- ret = build_changeset_symbols_node(ovcs, fragment->target,
++
++ target.np = fragment->target;
++ target.in_livetree = true;
++ ret = build_changeset_symbols_node(ovcs, &target,
+ fragment->overlay);
+ if (ret) {
+ pr_debug("apply failed '%pOF'\n", fragment->target);
+@@ -516,7 +553,7 @@ static int build_changeset(struct overlay_changeset *ovcs)
+ * 1) "target" property containing the phandle of the target
+ * 2) "target-path" property containing the path of the target
+ */
+-static struct device_node *find_target_node(struct device_node *info_node)
++static struct device_node *find_target(struct device_node *info_node)
+ {
+ struct device_node *node;
+ const char *path;
+@@ -622,7 +659,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
+
+ fragment = &fragments[cnt];
+ fragment->overlay = overlay_node;
+- fragment->target = find_target_node(node);
++ fragment->target = find_target(node);
+ if (!fragment->target) {
+ of_node_put(fragment->overlay);
+ ret = -EINVAL;
+diff --git a/drivers/of/platform.c b/drivers/of/platform.c
+index 6c59673933e9..04ad312fd85b 100644
+--- a/drivers/of/platform.c
++++ b/drivers/of/platform.c
+@@ -91,8 +91,8 @@ static void of_device_make_bus_id(struct device *dev)
+ */
+ reg = of_get_property(node, "reg", NULL);
+ if (reg && (addr = of_translate_address(node, reg)) != OF_BAD_ADDR) {
+- dev_set_name(dev, dev_name(dev) ? "%llx.%s:%s" : "%llx.%s",
+- (unsigned long long)addr, node->name,
++ dev_set_name(dev, dev_name(dev) ? "%llx.%pOFn:%s" : "%llx.%pOFn",
++ (unsigned long long)addr, node,
+ dev_name(dev));
+ return;
+ }
+@@ -142,8 +142,8 @@ struct platform_device *of_device_alloc(struct device_node *np,
+ WARN_ON(rc);
+ }
+ if (of_irq_to_resource_table(np, res, num_irq) != num_irq)
+- pr_debug("not all legacy IRQ resources mapped for %s\n",
+- np->name);
++ pr_debug("not all legacy IRQ resources mapped for %pOFn\n",
++ np);
+ }
+
+ dev->dev.of_node = of_node_get(np);
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 41b49716ac75..7f42314da6ae 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -212,8 +212,8 @@ static int __init of_unittest_check_node_linkage(struct device_node *np)
+
+ for_each_child_of_node(np, child) {
+ if (child->parent != np) {
+- pr_err("Child node %s links to wrong parent %s\n",
+- child->name, np->name);
++ pr_err("Child node %pOFn links to wrong parent %pOFn\n",
++ child, np);
+ rc = -EINVAL;
+ goto put_child;
+ }
+@@ -1046,16 +1046,16 @@ static void __init of_unittest_platform_populate(void)
+ for_each_child_of_node(np, child) {
+ for_each_child_of_node(child, grandchild)
+ unittest(of_find_device_by_node(grandchild),
+- "Could not create device for node '%s'\n",
+- grandchild->name);
++ "Could not create device for node '%pOFn'\n",
++ grandchild);
+ }
+
+ of_platform_depopulate(&test_bus->dev);
+ for_each_child_of_node(np, child) {
+ for_each_child_of_node(child, grandchild)
+ unittest(!of_find_device_by_node(grandchild),
+- "device didn't get destroyed '%s'\n",
+- grandchild->name);
++ "device didn't get destroyed '%pOFn'\n",
++ grandchild);
+ }
+
+ platform_device_unregister(test_bus);
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index db2af09067db..b6f2ff95c3ed 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -442,8 +442,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = {
+ { KE_KEY, 0x30, { KEY_VOLUMEUP } },
+ { KE_KEY, 0x31, { KEY_VOLUMEDOWN } },
+ { KE_KEY, 0x32, { KEY_MUTE } },
+- { KE_KEY, 0x33, { KEY_DISPLAYTOGGLE } }, /* LCD on */
+- { KE_KEY, 0x34, { KEY_DISPLAY_OFF } }, /* LCD off */
++ { KE_KEY, 0x35, { KEY_SCREENLOCK } },
+ { KE_KEY, 0x40, { KEY_PREVIOUSSONG } },
+ { KE_KEY, 0x41, { KEY_NEXTSONG } },
+ { KE_KEY, 0x43, { KEY_STOPCD } }, /* Stop/Eject */
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index a86aa65ad66d..39155d7cc894 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -1114,7 +1114,8 @@ static int vhost_net_open(struct inode *inode, struct file *f)
+ n->vqs[i].rx_ring = NULL;
+ vhost_net_buf_init(&n->vqs[i].rxq);
+ }
+- vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
++ vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX,
++ UIO_MAXIOV + VHOST_NET_BATCH);
+
+ vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, EPOLLOUT, dev);
+ vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, EPOLLIN, dev);
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index e7e3ae13516d..0cfa925be4ec 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -1398,7 +1398,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
+ vqs[i] = &vs->vqs[i].vq;
+ vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
+ }
+- vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ);
++ vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV);
+
+ vhost_scsi_init_inflight(vs, NULL);
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index c66fc8308b5e..cf82e7266397 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -390,9 +390,9 @@ static long vhost_dev_alloc_iovecs(struct vhost_dev *dev)
+ vq->indirect = kmalloc_array(UIO_MAXIOV,
+ sizeof(*vq->indirect),
+ GFP_KERNEL);
+- vq->log = kmalloc_array(UIO_MAXIOV, sizeof(*vq->log),
++ vq->log = kmalloc_array(dev->iov_limit, sizeof(*vq->log),
+ GFP_KERNEL);
+- vq->heads = kmalloc_array(UIO_MAXIOV, sizeof(*vq->heads),
++ vq->heads = kmalloc_array(dev->iov_limit, sizeof(*vq->heads),
+ GFP_KERNEL);
+ if (!vq->indirect || !vq->log || !vq->heads)
+ goto err_nomem;
+@@ -414,7 +414,7 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev)
+ }
+
+ void vhost_dev_init(struct vhost_dev *dev,
+- struct vhost_virtqueue **vqs, int nvqs)
++ struct vhost_virtqueue **vqs, int nvqs, int iov_limit)
+ {
+ struct vhost_virtqueue *vq;
+ int i;
+@@ -427,6 +427,7 @@ void vhost_dev_init(struct vhost_dev *dev,
+ dev->iotlb = NULL;
+ dev->mm = NULL;
+ dev->worker = NULL;
++ dev->iov_limit = iov_limit;
+ init_llist_head(&dev->work_list);
+ init_waitqueue_head(&dev->wait);
+ INIT_LIST_HEAD(&dev->read_list);
+diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
+index 1b675dad5e05..9490e7ddb340 100644
+--- a/drivers/vhost/vhost.h
++++ b/drivers/vhost/vhost.h
+@@ -170,9 +170,11 @@ struct vhost_dev {
+ struct list_head read_list;
+ struct list_head pending_list;
+ wait_queue_head_t wait;
++ int iov_limit;
+ };
+
+-void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs);
++void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs,
++ int nvqs, int iov_limit);
+ long vhost_dev_set_owner(struct vhost_dev *dev);
+ bool vhost_dev_has_owner(struct vhost_dev *dev);
+ long vhost_dev_check_owner(struct vhost_dev *);
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 98ed5be132c6..fa93f6711d8d 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -531,7 +531,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
+ vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick;
+ vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick;
+
+- vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs));
++ vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), UIO_MAXIOV);
+
+ file->private_data = vsock;
+ spin_lock_init(&vsock->send_pkt_list_lock);
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 7ad6f2eec711..48ac8b7c43a5 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1003,6 +1003,48 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
+ return 0;
+ }
+
++static struct extent_buffer *alloc_tree_block_no_bg_flush(
++ struct btrfs_trans_handle *trans,
++ struct btrfs_root *root,
++ u64 parent_start,
++ const struct btrfs_disk_key *disk_key,
++ int level,
++ u64 hint,
++ u64 empty_size)
++{
++ struct btrfs_fs_info *fs_info = root->fs_info;
++ struct extent_buffer *ret;
++
++ /*
++ * If we are COWing a node/leaf from the extent, chunk, device or free
++ * space trees, make sure that we do not finish block group creation of
++ * pending block groups. We do this to avoid a deadlock.
++ * COWing can result in allocation of a new chunk, and flushing pending
++ * block groups (btrfs_create_pending_block_groups()) can be triggered
++ * when finishing allocation of a new chunk. Creation of a pending block
++ * group modifies the extent, chunk, device and free space trees,
++ * therefore we could deadlock with ourselves since we are holding a
++ * lock on an extent buffer that btrfs_create_pending_block_groups() may
++ * try to COW later.
++ * For similar reasons, we also need to delay flushing pending block
++ * groups when splitting a leaf or node, from one of those trees, since
++ * we are holding a write lock on it and its parent or when inserting a
++ * new root node for one of those trees.
++ */
++ if (root == fs_info->extent_root ||
++ root == fs_info->chunk_root ||
++ root == fs_info->dev_root ||
++ root == fs_info->free_space_root)
++ trans->can_flush_pending_bgs = false;
++
++ ret = btrfs_alloc_tree_block(trans, root, parent_start,
++ root->root_key.objectid, disk_key, level,
++ hint, empty_size);
++ trans->can_flush_pending_bgs = true;
++
++ return ret;
++}
++
+ /*
+ * does the dirty work in cow of a single block. The parent block (if
+ * supplied) is updated to point to the new cow copy. The new buffer is marked
+@@ -1050,28 +1092,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ if ((root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) && parent)
+ parent_start = parent->start;
+
+- /*
+- * If we are COWing a node/leaf from the extent, chunk, device or free
+- * space trees, make sure that we do not finish block group creation of
+- * pending block groups. We do this to avoid a deadlock.
+- * COWing can result in allocation of a new chunk, and flushing pending
+- * block groups (btrfs_create_pending_block_groups()) can be triggered
+- * when finishing allocation of a new chunk. Creation of a pending block
+- * group modifies the extent, chunk, device and free space trees,
+- * therefore we could deadlock with ourselves since we are holding a
+- * lock on an extent buffer that btrfs_create_pending_block_groups() may
+- * try to COW later.
+- */
+- if (root == fs_info->extent_root ||
+- root == fs_info->chunk_root ||
+- root == fs_info->dev_root ||
+- root == fs_info->free_space_root)
+- trans->can_flush_pending_bgs = false;
+-
+- cow = btrfs_alloc_tree_block(trans, root, parent_start,
+- root->root_key.objectid, &disk_key, level,
+- search_start, empty_size);
+- trans->can_flush_pending_bgs = true;
++ cow = alloc_tree_block_no_bg_flush(trans, root, parent_start, &disk_key,
++ level, search_start, empty_size);
+ if (IS_ERR(cow))
+ return PTR_ERR(cow);
+
+@@ -3383,8 +3405,8 @@ static noinline int insert_new_root(struct btrfs_trans_handle *trans,
+ else
+ btrfs_node_key(lower, &lower_key, 0);
+
+- c = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
+- &lower_key, level, root->node->start, 0);
++ c = alloc_tree_block_no_bg_flush(trans, root, 0, &lower_key, level,
++ root->node->start, 0);
+ if (IS_ERR(c))
+ return PTR_ERR(c);
+
+@@ -3513,8 +3535,8 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
+ mid = (c_nritems + 1) / 2;
+ btrfs_node_key(c, &disk_key, mid);
+
+- split = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
+- &disk_key, level, c->start, 0);
++ split = alloc_tree_block_no_bg_flush(trans, root, 0, &disk_key, level,
++ c->start, 0);
+ if (IS_ERR(split))
+ return PTR_ERR(split);
+
+@@ -4298,8 +4320,8 @@ again:
+ else
+ btrfs_item_key(l, &disk_key, mid);
+
+- right = btrfs_alloc_tree_block(trans, root, 0, root->root_key.objectid,
+- &disk_key, 0, l->start, 0);
++ right = alloc_tree_block_no_bg_flush(trans, root, 0, &disk_key, 0,
++ l->start, 0);
+ if (IS_ERR(right))
+ return PTR_ERR(right);
+
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 8ad145820ea8..8888337a95b6 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -1677,6 +1677,7 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
+ flags | SB_RDONLY, device_name, data);
+ if (IS_ERR(mnt_root)) {
+ root = ERR_CAST(mnt_root);
++ kfree(subvol_name);
+ goto out;
+ }
+
+@@ -1686,12 +1687,14 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
+ if (error < 0) {
+ root = ERR_PTR(error);
+ mntput(mnt_root);
++ kfree(subvol_name);
+ goto out;
+ }
+ }
+ }
+ if (IS_ERR(mnt_root)) {
+ root = ERR_CAST(mnt_root);
++ kfree(subvol_name);
+ goto out;
+ }
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index d0bba175117c..a5ea742654aa 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -50,6 +50,7 @@
+ #include "cifs_unicode.h"
+ #include "cifs_debug.h"
+ #include "cifs_fs_sb.h"
++#include "dns_resolve.h"
+ #include "ntlmssp.h"
+ #include "nterr.h"
+ #include "rfc1002pdu.h"
+@@ -317,6 +318,53 @@ static void cifs_prune_tlinks(struct work_struct *work);
+ static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
+ const char *devname, bool is_smb3);
+
++/*
++ * Resolve hostname and set ip addr in tcp ses. Useful for hostnames that may
++ * get their ip addresses changed at some point.
++ *
++ * This should be called with server->srv_mutex held.
++ */
++#ifdef CONFIG_CIFS_DFS_UPCALL
++static int reconn_set_ipaddr(struct TCP_Server_Info *server)
++{
++ int rc;
++ int len;
++ char *unc, *ipaddr = NULL;
++
++ if (!server->hostname)
++ return -EINVAL;
++
++ len = strlen(server->hostname) + 3;
++
++ unc = kmalloc(len, GFP_KERNEL);
++ if (!unc) {
++ cifs_dbg(FYI, "%s: failed to create UNC path\n", __func__);
++ return -ENOMEM;
++ }
++ snprintf(unc, len, "\\\\%s", server->hostname);
++
++ rc = dns_resolve_server_name_to_ip(unc, &ipaddr);
++ kfree(unc);
++
++ if (rc < 0) {
++ cifs_dbg(FYI, "%s: failed to resolve server part of %s to IP: %d\n",
++ __func__, server->hostname, rc);
++ return rc;
++ }
++
++ rc = cifs_convert_address((struct sockaddr *)&server->dstaddr, ipaddr,
++ strlen(ipaddr));
++ kfree(ipaddr);
++
++ return !rc ? -1 : 0;
++}
++#else
++static inline int reconn_set_ipaddr(struct TCP_Server_Info *server)
++{
++ return 0;
++}
++#endif
++
+ /*
+ * cifs tcp session reconnection
+ *
+@@ -417,6 +465,11 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ rc = generic_ip_connect(server);
+ if (rc) {
+ cifs_dbg(FYI, "reconnect error %d\n", rc);
++ rc = reconn_set_ipaddr(server);
++ if (rc) {
++ cifs_dbg(FYI, "%s: failed to resolve hostname: %d\n",
++ __func__, rc);
++ }
+ mutex_unlock(&server->srv_mutex);
+ msleep(3000);
+ } else {
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index dba986524917..8a01e89ff827 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3127,8 +3127,17 @@ smb2_readv_callback(struct mid_q_entry *mid)
+ rdata->mr = NULL;
+ }
+ #endif
+- if (rdata->result)
++ if (rdata->result && rdata->result != -ENODATA) {
+ cifs_stats_fail_inc(tcon, SMB2_READ_HE);
++ trace_smb3_read_err(0 /* xid */,
++ rdata->cfile->fid.persistent_fid,
++ tcon->tid, tcon->ses->Suid, rdata->offset,
++ rdata->bytes, rdata->result);
++ } else
++ trace_smb3_read_done(0 /* xid */,
++ rdata->cfile->fid.persistent_fid,
++ tcon->tid, tcon->ses->Suid,
++ rdata->offset, rdata->got_bytes);
+
+ queue_work(cifsiod_wq, &rdata->work);
+ DeleteMidQEntry(mid);
+@@ -3203,13 +3212,11 @@ smb2_async_readv(struct cifs_readdata *rdata)
+ if (rc) {
+ kref_put(&rdata->refcount, cifs_readdata_release);
+ cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);
+- trace_smb3_read_err(rc, 0 /* xid */, io_parms.persistent_fid,
+- io_parms.tcon->tid, io_parms.tcon->ses->Suid,
+- io_parms.offset, io_parms.length);
+- } else
+- trace_smb3_read_done(0 /* xid */, io_parms.persistent_fid,
+- io_parms.tcon->tid, io_parms.tcon->ses->Suid,
+- io_parms.offset, io_parms.length);
++ trace_smb3_read_err(0 /* xid */, io_parms.persistent_fid,
++ io_parms.tcon->tid,
++ io_parms.tcon->ses->Suid,
++ io_parms.offset, io_parms.length, rc);
++ }
+
+ cifs_small_buf_release(buf);
+ return rc;
+@@ -3253,10 +3260,11 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
+ if (rc != -ENODATA) {
+ cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
+ cifs_dbg(VFS, "Send error in read = %d\n", rc);
++ trace_smb3_read_err(xid, req->PersistentFileId,
++ io_parms->tcon->tid, ses->Suid,
++ io_parms->offset, io_parms->length,
++ rc);
+ }
+- trace_smb3_read_err(rc, xid, req->PersistentFileId,
+- io_parms->tcon->tid, ses->Suid,
+- io_parms->offset, io_parms->length);
+ free_rsp_buf(resp_buftype, rsp_iov.iov_base);
+ return rc == -ENODATA ? 0 : rc;
+ } else
+@@ -3342,8 +3350,17 @@ smb2_writev_callback(struct mid_q_entry *mid)
+ wdata->mr = NULL;
+ }
+ #endif
+- if (wdata->result)
++ if (wdata->result) {
+ cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
++ trace_smb3_write_err(0 /* no xid */,
++ wdata->cfile->fid.persistent_fid,
++ tcon->tid, tcon->ses->Suid, wdata->offset,
++ wdata->bytes, wdata->result);
++ } else
++ trace_smb3_write_done(0 /* no xid */,
++ wdata->cfile->fid.persistent_fid,
++ tcon->tid, tcon->ses->Suid,
++ wdata->offset, wdata->bytes);
+
+ queue_work(cifsiod_wq, &wdata->work);
+ DeleteMidQEntry(mid);
+@@ -3485,10 +3502,7 @@ smb2_async_writev(struct cifs_writedata *wdata,
+ wdata->bytes, rc);
+ kref_put(&wdata->refcount, release);
+ cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
+- } else
+- trace_smb3_write_done(0 /* no xid */, req->PersistentFileId,
+- tcon->tid, tcon->ses->Suid, wdata->offset,
+- wdata->bytes);
++ }
+
+ async_writev_out:
+ cifs_small_buf_release(req);
+@@ -3714,8 +3728,8 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
+ rsp->sync_hdr.Status == STATUS_NO_MORE_FILES) {
+ srch_inf->endOfSearch = true;
+ rc = 0;
+- }
+- cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
++ } else
++ cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
+ goto qdir_exit;
+ }
+
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 2e7e8d85e9b4..cb515f183482 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1202,15 +1202,11 @@ static enum lru_status dentry_lru_isolate_shrink(struct list_head *item,
+ */
+ void shrink_dcache_sb(struct super_block *sb)
+ {
+- long freed;
+-
+ do {
+ LIST_HEAD(dispose);
+
+- freed = list_lru_walk(&sb->s_dentry_lru,
++ list_lru_walk(&sb->s_dentry_lru,
+ dentry_lru_isolate_shrink, &dispose, 1024);
+-
+- this_cpu_sub(nr_dentry_unused, freed);
+ shrink_dentry_list(&dispose);
+ } while (list_lru_count(&sb->s_dentry_lru) > 0);
+ }
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index e978f6930575..449d0cb45a84 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1747,9 +1747,9 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext,
+ goto next_iter;
+ }
+ if (ret == -E2BIG) {
+- n += rbm->bii - initial_bii;
+ rbm->bii = 0;
+ rbm->offset = 0;
++ n += (rbm->bii - initial_bii);
+ goto res_covered_end_of_rgrp;
+ }
+ return ret;
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 586726a590d8..d790faff8e47 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -621,11 +621,12 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
+ nfs_set_page_writeback(page);
+ WARN_ON_ONCE(test_bit(PG_CLEAN, &req->wb_flags));
+
+- ret = 0;
++ ret = req->wb_context->error;
+ /* If there is a fatal error that covers this write, just exit */
+- if (nfs_error_is_fatal_on_server(req->wb_context->error))
++ if (nfs_error_is_fatal_on_server(ret))
+ goto out_launder;
+
++ ret = 0;
+ if (!nfs_pageio_add_request(pgio, req)) {
+ ret = pgio->pg_error;
+ /*
+@@ -635,9 +636,9 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
+ nfs_context_set_write_error(req->wb_context, ret);
+ if (nfs_error_is_fatal_on_server(ret))
+ goto out_launder;
+- }
++ } else
++ ret = -EAGAIN;
+ nfs_redirty_request(req);
+- ret = -EAGAIN;
+ } else
+ nfs_add_stats(page_file_mapping(page)->host,
+ NFSIOS_WRITEPAGES, 1);
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index d837dad24b4c..21fef8c5eca7 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1455,6 +1455,7 @@ struct net_device_ops {
+ * @IFF_NO_RX_HANDLER: device doesn't support the rx_handler hook
+ * @IFF_FAILOVER: device is a failover master device
+ * @IFF_FAILOVER_SLAVE: device is lower dev of a failover master device
++ * @IFF_L3MDEV_RX_HANDLER: only invoke the rx handler of L3 master device
+ */
+ enum netdev_priv_flags {
+ IFF_802_1Q_VLAN = 1<<0,
+@@ -1486,6 +1487,7 @@ enum netdev_priv_flags {
+ IFF_NO_RX_HANDLER = 1<<26,
+ IFF_FAILOVER = 1<<27,
+ IFF_FAILOVER_SLAVE = 1<<28,
++ IFF_L3MDEV_RX_HANDLER = 1<<29,
+ };
+
+ #define IFF_802_1Q_VLAN IFF_802_1Q_VLAN
+@@ -1516,6 +1518,7 @@ enum netdev_priv_flags {
+ #define IFF_NO_RX_HANDLER IFF_NO_RX_HANDLER
+ #define IFF_FAILOVER IFF_FAILOVER
+ #define IFF_FAILOVER_SLAVE IFF_FAILOVER_SLAVE
++#define IFF_L3MDEV_RX_HANDLER IFF_L3MDEV_RX_HANDLER
+
+ /**
+ * struct net_device - The DEVICE structure.
+@@ -4464,6 +4467,11 @@ static inline bool netif_supports_nofcs(struct net_device *dev)
+ return dev->priv_flags & IFF_SUPP_NOFCS;
+ }
+
++static inline bool netif_has_l3_rx_handler(const struct net_device *dev)
++{
++ return dev->priv_flags & IFF_L3MDEV_RX_HANDLER;
++}
++
+ static inline bool netif_is_l3_master(const struct net_device *dev)
+ {
+ return dev->priv_flags & IFF_L3MDEV_MASTER;
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 99b0ebf49632..40e58b0e9cf4 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -138,11 +138,16 @@ extern struct device_node *of_aliases;
+ extern struct device_node *of_stdout;
+ extern raw_spinlock_t devtree_lock;
+
+-/* flag descriptions (need to be visible even when !CONFIG_OF) */
+-#define OF_DYNAMIC 1 /* node and properties were allocated via kmalloc */
+-#define OF_DETACHED 2 /* node has been detached from the device tree */
+-#define OF_POPULATED 3 /* device already created for the node */
+-#define OF_POPULATED_BUS 4 /* of_platform_populate recursed to children of this node */
++/*
++ * struct device_node flag descriptions
++ * (need to be visible even when !CONFIG_OF)
++ */
++#define OF_DYNAMIC 1 /* (and properties) allocated via kmalloc */
++#define OF_DETACHED 2 /* detached from the device tree */
++#define OF_POPULATED 3 /* device already created */
++#define OF_POPULATED_BUS 4 /* platform bus created for children */
++#define OF_OVERLAY 5 /* allocated for an overlay */
++#define OF_OVERLAY_FREE_CSET 6 /* in overlay cset being freed */
+
+ #define OF_BAD_ADDR ((u64)-1)
+
+diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h
+index ec912d01126f..ecdc6542070f 100644
+--- a/include/linux/sched/coredump.h
++++ b/include/linux/sched/coredump.h
+@@ -71,6 +71,7 @@ static inline int get_dumpable(struct mm_struct *mm)
+ #define MMF_HUGE_ZERO_PAGE 23 /* mm has ever used the global huge zero page */
+ #define MMF_DISABLE_THP 24 /* disable THP for all VMAs */
+ #define MMF_OOM_VICTIM 25 /* mm is the oom victim */
++#define MMF_OOM_REAP_QUEUED 26 /* mm was queued for oom_reaper */
+ #define MMF_DISABLE_THP_MASK (1 << MMF_DISABLE_THP)
+
+ #define MMF_INIT_MASK (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\
+diff --git a/include/net/l3mdev.h b/include/net/l3mdev.h
+index 3832099289c5..128487658ff7 100644
+--- a/include/net/l3mdev.h
++++ b/include/net/l3mdev.h
+@@ -142,7 +142,8 @@ struct sk_buff *l3mdev_l3_rcv(struct sk_buff *skb, u16 proto)
+
+ if (netif_is_l3_slave(skb->dev))
+ master = netdev_master_upper_dev_get_rcu(skb->dev);
+- else if (netif_is_l3_master(skb->dev))
++ else if (netif_is_l3_master(skb->dev) ||
++ netif_has_l3_rx_handler(skb->dev))
+ master = skb->dev;
+
+ if (master && master->l3mdev_ops->l3mdev_l3_rcv)
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 0e21e6d21f35..55b4fa6d01eb 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -558,12 +558,14 @@ static struct task_struct *find_alive_thread(struct task_struct *p)
+ return NULL;
+ }
+
+-static struct task_struct *find_child_reaper(struct task_struct *father)
++static struct task_struct *find_child_reaper(struct task_struct *father,
++ struct list_head *dead)
+ __releases(&tasklist_lock)
+ __acquires(&tasklist_lock)
+ {
+ struct pid_namespace *pid_ns = task_active_pid_ns(father);
+ struct task_struct *reaper = pid_ns->child_reaper;
++ struct task_struct *p, *n;
+
+ if (likely(reaper != father))
+ return reaper;
+@@ -579,6 +581,12 @@ static struct task_struct *find_child_reaper(struct task_struct *father)
+ panic("Attempted to kill init! exitcode=0x%08x\n",
+ father->signal->group_exit_code ?: father->exit_code);
+ }
++
++ list_for_each_entry_safe(p, n, dead, ptrace_entry) {
++ list_del_init(&p->ptrace_entry);
++ release_task(p);
++ }
++
+ zap_pid_ns_processes(pid_ns);
+ write_lock_irq(&tasklist_lock);
+
+@@ -668,7 +676,7 @@ static void forget_original_parent(struct task_struct *father,
+ exit_ptrace(father, dead);
+
+ /* Can drop and reacquire tasklist_lock */
+- reaper = find_child_reaper(father);
++ reaper = find_child_reaper(father, dead);
+ if (list_empty(&father->children))
+ return;
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 309fb8c969af..10e83672bfbe 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4269,7 +4269,8 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ break;
+ }
+ if (ret & VM_FAULT_RETRY) {
+- if (nonblocking)
++ if (nonblocking &&
++ !(fault_flags & FAULT_FLAG_RETRY_NOWAIT))
+ *nonblocking = 0;
+ *nr_pages = 0;
+ /*
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 0cd3de3550f0..d9b8a2490633 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -372,7 +372,8 @@ static void kill_procs(struct list_head *to_kill, int forcekill, bool fail,
+ if (fail || tk->addr_valid == 0) {
+ pr_err("Memory failure: %#lx: forcibly killing %s:%d because of failure to unmap corrupted page\n",
+ pfn, tk->tsk->comm, tk->tsk->pid);
+- force_sig(SIGKILL, tk->tsk);
++ do_send_sig_info(SIGKILL, SEND_SIG_PRIV,
++ tk->tsk, PIDTYPE_PID);
+ }
+
+ /*
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 8a136ffda370..c6119ad3561e 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -1326,23 +1326,27 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
+ static unsigned long scan_movable_pages(unsigned long start, unsigned long end)
+ {
+ unsigned long pfn;
+- struct page *page;
++
+ for (pfn = start; pfn < end; pfn++) {
+- if (pfn_valid(pfn)) {
+- page = pfn_to_page(pfn);
+- if (PageLRU(page))
+- return pfn;
+- if (__PageMovable(page))
+- return pfn;
+- if (PageHuge(page)) {
+- if (hugepage_migration_supported(page_hstate(page)) &&
+- page_huge_active(page))
+- return pfn;
+- else
+- pfn = round_up(pfn + 1,
+- 1 << compound_order(page)) - 1;
+- }
+- }
++ struct page *page, *head;
++ unsigned long skip;
++
++ if (!pfn_valid(pfn))
++ continue;
++ page = pfn_to_page(pfn);
++ if (PageLRU(page))
++ return pfn;
++ if (__PageMovable(page))
++ return pfn;
++
++ if (!PageHuge(page))
++ continue;
++ head = compound_head(page);
++ if (hugepage_migration_supported(page_hstate(head)) &&
++ page_huge_active(head))
++ return pfn;
++ skip = (1 << compound_order(head)) - (page - head);
++ pfn += skip - 1;
+ }
+ return 0;
+ }
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 84381b55b2bd..ab260260a626 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -1118,10 +1118,13 @@ out:
+ * If migration is successful, decrease refcount of the newpage
+ * which will not free the page because new page owner increased
+ * refcounter. As well, if it is LRU page, add the page to LRU
+- * list in here.
++ * list in here. Use the old state of the isolated source page to
++ * determine if we migrated a LRU page. newpage was already unlocked
++ * and possibly modified by its owner - don't rely on the page
++ * state.
+ */
+ if (rc == MIGRATEPAGE_SUCCESS) {
+- if (unlikely(__PageMovable(newpage)))
++ if (unlikely(!is_lru))
+ put_page(newpage);
+ else
+ putback_lru_page(newpage);
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index f10aa5360616..e66ac8a47dd6 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -634,8 +634,8 @@ static int oom_reaper(void *unused)
+
+ static void wake_oom_reaper(struct task_struct *tsk)
+ {
+- /* tsk is already queued? */
+- if (tsk == oom_reaper_list || tsk->oom_reaper_list)
++ /* mm is already queued? */
++ if (test_and_set_bit(MMF_OOM_REAP_QUEUED, &tsk->signal->oom_mm->flags))
+ return;
+
+ get_task_struct(tsk);
+@@ -962,6 +962,13 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
+ * still freeing memory.
+ */
+ read_lock(&tasklist_lock);
++
++ /*
++ * The task 'p' might have already exited before reaching here. The
++ * put_task_struct() will free task_struct 'p' while the loop still try
++ * to access the field of 'p', so, get an extra reference.
++ */
++ get_task_struct(p);
+ for_each_thread(p, t) {
+ list_for_each_entry(child, &t->children, sibling) {
+ unsigned int child_points;
+@@ -981,6 +988,7 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
+ }
+ }
+ }
++ put_task_struct(p);
+ read_unlock(&tasklist_lock);
+
+ /*
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 1f1aae27d41f..af097ca9cb4f 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -8599,6 +8599,9 @@ int init_dummy_netdev(struct net_device *dev)
+ set_bit(__LINK_STATE_PRESENT, &dev->state);
+ set_bit(__LINK_STATE_START, &dev->state);
+
++ /* napi_busy_loop stats accounting wants this */
++ dev_net_set(dev, &init_net);
++
+ /* Note : We dont allocate pcpu_refcnt for dummy devices,
+ * because users of this 'device' dont need to change
+ * its refcount.
+diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
+index b798862b6be5..f21ea6125fc2 100644
+--- a/net/ipv4/gre_demux.c
++++ b/net/ipv4/gre_demux.c
+@@ -25,6 +25,7 @@
+ #include <linux/spinlock.h>
+ #include <net/protocol.h>
+ #include <net/gre.h>
++#include <net/erspan.h>
+
+ #include <net/icmp.h>
+ #include <net/route.h>
+@@ -118,6 +119,22 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ hdr_len += 4;
+ }
+ tpi->hdr_len = hdr_len;
++
++ /* ERSPAN ver 1 and 2 protocol sets GRE key field
++ * to 0 and sets the configured key in the
++ * inner erspan header field
++ */
++ if (greh->protocol == htons(ETH_P_ERSPAN) ||
++ greh->protocol == htons(ETH_P_ERSPAN2)) {
++ struct erspan_base_hdr *ershdr;
++
++ if (!pskb_may_pull(skb, nhs + hdr_len + sizeof(*ershdr)))
++ return -EINVAL;
++
++ ershdr = (struct erspan_base_hdr *)options;
++ tpi->key = cpu_to_be32(get_session_id(ershdr));
++ }
++
+ return hdr_len;
+ }
+ EXPORT_SYMBOL(gre_parse_header);
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index f8bbd693c19c..d95b32af4a0e 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -425,6 +425,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ * fragment.
+ */
+
++ err = -EINVAL;
+ /* Find out where to put this fragment. */
+ prev_tail = qp->q.fragments_tail;
+ if (!prev_tail)
+@@ -501,7 +502,6 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+
+ discard_qp:
+ inet_frag_kill(&qp->q);
+- err = -EINVAL;
+ __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS);
+ err:
+ kfree_skb(skb);
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 0bfad3e72509..f199945f6e4a 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -269,20 +269,11 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ int len;
+
+ itn = net_generic(net, erspan_net_id);
+- len = gre_hdr_len + sizeof(*ershdr);
+-
+- /* Check based hdr len */
+- if (unlikely(!pskb_may_pull(skb, len)))
+- return PACKET_REJECT;
+
+ iph = ip_hdr(skb);
+ ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
+ ver = ershdr->ver;
+
+- /* The original GRE header does not have key field,
+- * Use ERSPAN 10-bit session ID as key.
+- */
+- tpi->key = cpu_to_be32(get_session_id(ershdr));
+ tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex,
+ tpi->flags | TUNNEL_KEY,
+ iph->saddr, iph->daddr, tpi->key);
+@@ -1471,12 +1462,17 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ {
+ struct ip_tunnel *t = netdev_priv(dev);
+ struct ip_tunnel_parm *p = &t->parms;
++ __be16 o_flags = p->o_flags;
++
++ if ((t->erspan_ver == 1 || t->erspan_ver == 2) &&
++ !t->collect_md)
++ o_flags |= TUNNEL_KEY;
+
+ if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
+ nla_put_be16(skb, IFLA_GRE_IFLAGS,
+ gre_tnl_flags_to_gre_flags(p->i_flags)) ||
+ nla_put_be16(skb, IFLA_GRE_OFLAGS,
+- gre_tnl_flags_to_gre_flags(p->o_flags)) ||
++ gre_tnl_flags_to_gre_flags(o_flags)) ||
+ nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
+ nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
+ nla_put_in_addr(skb, IFLA_GRE_LOCAL, p->iph.saddr) ||
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index 506b2ae07bb3..79fcd9550fd2 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -361,6 +361,9 @@ static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
+ err = -EINVAL;
+ goto out_unlock;
+ }
++ }
++
++ if (sk->sk_bound_dev_if) {
+ dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
+ if (!dev) {
+ err = -ENODEV;
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 345e6839f031..be04877b3827 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -550,13 +550,9 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
+ struct ip6_tnl *tunnel;
+ u8 ver;
+
+- if (unlikely(!pskb_may_pull(skb, sizeof(*ershdr))))
+- return PACKET_REJECT;
+-
+ ipv6h = ipv6_hdr(skb);
+ ershdr = (struct erspan_base_hdr *)skb->data;
+ ver = ershdr->ver;
+- tpi->key = cpu_to_be32(get_session_id(ershdr));
+
+ tunnel = ip6gre_tunnel_lookup(skb->dev,
+ &ipv6h->saddr, &ipv6h->daddr, tpi->key,
+@@ -2124,12 +2120,17 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ {
+ struct ip6_tnl *t = netdev_priv(dev);
+ struct __ip6_tnl_parm *p = &t->parms;
++ __be16 o_flags = p->o_flags;
++
++ if ((p->erspan_ver == 1 || p->erspan_ver == 2) &&
++ !p->collect_md)
++ o_flags |= TUNNEL_KEY;
+
+ if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
+ nla_put_be16(skb, IFLA_GRE_IFLAGS,
+ gre_tnl_flags_to_gre_flags(p->i_flags)) ||
+ nla_put_be16(skb, IFLA_GRE_OFLAGS,
+- gre_tnl_flags_to_gre_flags(p->o_flags)) ||
++ gre_tnl_flags_to_gre_flags(o_flags)) ||
+ nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
+ nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
+ nla_put_in6_addr(skb, IFLA_GRE_LOCAL, &p->laddr) ||
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 331e6b6dd252..10aafea3af0f 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -1506,6 +1506,9 @@ static void mroute_clean_tables(struct mr_table *mrt, bool all)
+ continue;
+ rhltable_remove(&mrt->mfc_hash, &c->mnode, ip6mr_rht_params);
+ list_del_rcu(&c->list);
++ call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net),
++ FIB_EVENT_ENTRY_DEL,
++ (struct mfc6_cache *)c, mrt->id);
+ mr6_netlink_event(mrt, (struct mfc6_cache *)c, RTM_DELROUTE);
+ mr_cache_put(c);
+ }
+@@ -1514,10 +1517,6 @@ static void mroute_clean_tables(struct mr_table *mrt, bool all)
+ spin_lock_bh(&mfc_unres_lock);
+ list_for_each_entry_safe(c, tmp, &mrt->mfc_unres_queue, list) {
+ list_del(&c->list);
+- call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net),
+- FIB_EVENT_ENTRY_DEL,
+- (struct mfc6_cache *)c,
+- mrt->id);
+ mr6_netlink_event(mrt, (struct mfc6_cache *)c,
+ RTM_DELROUTE);
+ ip6mr_destroy_unres(mrt, (struct mfc6_cache *)c);
+diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
+index 8181ee7e1e27..ee5403cbe655 100644
+--- a/net/ipv6/seg6_iptunnel.c
++++ b/net/ipv6/seg6_iptunnel.c
+@@ -146,6 +146,8 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
+ } else {
+ ip6_flow_hdr(hdr, 0, flowlabel);
+ hdr->hop_limit = ip6_dst_hoplimit(skb_dst(skb));
++
++ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ }
+
+ hdr->nexthdr = NEXTHDR_ROUTING;
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 26f1d435696a..fed6becc5daf 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -83,8 +83,7 @@
+ #define L2TP_SLFLAG_S 0x40000000
+ #define L2TP_SL_SEQ_MASK 0x00ffffff
+
+-#define L2TP_HDR_SIZE_SEQ 10
+-#define L2TP_HDR_SIZE_NOSEQ 6
++#define L2TP_HDR_SIZE_MAX 14
+
+ /* Default trace flags */
+ #define L2TP_DEFAULT_DEBUG_FLAGS 0
+@@ -808,7 +807,7 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
+ __skb_pull(skb, sizeof(struct udphdr));
+
+ /* Short packet? */
+- if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
++ if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) {
+ l2tp_info(tunnel, L2TP_MSG_DATA,
+ "%s: recv short packet (len=%d)\n",
+ tunnel->name, skb->len);
+@@ -884,6 +883,10 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
+ goto error;
+ }
+
++ if (tunnel->version == L2TP_HDR_VER_3 &&
++ l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
++ goto error;
++
+ l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);
+ l2tp_session_dec_refcount(session);
+
+diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
+index 9c9afe94d389..b2ce90260c35 100644
+--- a/net/l2tp/l2tp_core.h
++++ b/net/l2tp/l2tp_core.h
+@@ -301,6 +301,26 @@ static inline bool l2tp_tunnel_uses_xfrm(const struct l2tp_tunnel *tunnel)
+ }
+ #endif
+
++static inline int l2tp_v3_ensure_opt_in_linear(struct l2tp_session *session, struct sk_buff *skb,
++ unsigned char **ptr, unsigned char **optr)
++{
++ int opt_len = session->peer_cookie_len + l2tp_get_l2specific_len(session);
++
++ if (opt_len > 0) {
++ int off = *ptr - *optr;
++
++ if (!pskb_may_pull(skb, off + opt_len))
++ return -1;
++
++ if (skb->data != *optr) {
++ *optr = skb->data;
++ *ptr = skb->data + off;
++ }
++ }
++
++ return 0;
++}
++
+ #define l2tp_printk(ptr, type, func, fmt, ...) \
+ do { \
+ if (((ptr)->debug) & (type)) \
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index 35f6f86d4dcc..d4c60523c549 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -165,6 +165,9 @@ static int l2tp_ip_recv(struct sk_buff *skb)
+ print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
+ }
+
++ if (l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
++ goto discard_sess;
++
+ l2tp_recv_common(session, skb, ptr, optr, 0, skb->len);
+ l2tp_session_dec_refcount(session);
+
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index 237f1a4a0b0c..0ae6899edac0 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -178,6 +178,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
+ print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
+ }
+
++ if (l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
++ goto discard_sess;
++
+ l2tp_recv_common(session, skb, ptr, optr, 0, skb->len);
+ l2tp_session_dec_refcount(session);
+
+diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
+index cbd51ed5a2d7..908e53ab47a4 100644
+--- a/net/netrom/nr_timer.c
++++ b/net/netrom/nr_timer.c
+@@ -52,21 +52,21 @@ void nr_start_t1timer(struct sock *sk)
+ {
+ struct nr_sock *nr = nr_sk(sk);
+
+- mod_timer(&nr->t1timer, jiffies + nr->t1);
++ sk_reset_timer(sk, &nr->t1timer, jiffies + nr->t1);
+ }
+
+ void nr_start_t2timer(struct sock *sk)
+ {
+ struct nr_sock *nr = nr_sk(sk);
+
+- mod_timer(&nr->t2timer, jiffies + nr->t2);
++ sk_reset_timer(sk, &nr->t2timer, jiffies + nr->t2);
+ }
+
+ void nr_start_t4timer(struct sock *sk)
+ {
+ struct nr_sock *nr = nr_sk(sk);
+
+- mod_timer(&nr->t4timer, jiffies + nr->t4);
++ sk_reset_timer(sk, &nr->t4timer, jiffies + nr->t4);
+ }
+
+ void nr_start_idletimer(struct sock *sk)
+@@ -74,37 +74,37 @@ void nr_start_idletimer(struct sock *sk)
+ struct nr_sock *nr = nr_sk(sk);
+
+ if (nr->idle > 0)
+- mod_timer(&nr->idletimer, jiffies + nr->idle);
++ sk_reset_timer(sk, &nr->idletimer, jiffies + nr->idle);
+ }
+
+ void nr_start_heartbeat(struct sock *sk)
+ {
+- mod_timer(&sk->sk_timer, jiffies + 5 * HZ);
++ sk_reset_timer(sk, &sk->sk_timer, jiffies + 5 * HZ);
+ }
+
+ void nr_stop_t1timer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->t1timer);
++ sk_stop_timer(sk, &nr_sk(sk)->t1timer);
+ }
+
+ void nr_stop_t2timer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->t2timer);
++ sk_stop_timer(sk, &nr_sk(sk)->t2timer);
+ }
+
+ void nr_stop_t4timer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->t4timer);
++ sk_stop_timer(sk, &nr_sk(sk)->t4timer);
+ }
+
+ void nr_stop_idletimer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->idletimer);
++ sk_stop_timer(sk, &nr_sk(sk)->idletimer);
+ }
+
+ void nr_stop_heartbeat(struct sock *sk)
+ {
+- del_timer(&sk->sk_timer);
++ sk_stop_timer(sk, &sk->sk_timer);
+ }
+
+ int nr_t1timer_running(struct sock *sk)
+diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
+index 77e9f85a2c92..f2ff21d7df08 100644
+--- a/net/rose/rose_route.c
++++ b/net/rose/rose_route.c
+@@ -850,6 +850,7 @@ void rose_link_device_down(struct net_device *dev)
+
+ /*
+ * Route a frame to an appropriate AX.25 connection.
++ * A NULL ax25_cb indicates an internally generated frame.
+ */
+ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
+ {
+@@ -867,6 +868,10 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
+
+ if (skb->len < ROSE_MIN_LEN)
+ return res;
++
++ if (!ax25)
++ return rose_loopback_queue(skb, NULL);
++
+ frametype = skb->data[2];
+ lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
+ if (frametype == ROSE_CALL_REQUEST &&
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 0bae07e9c9e7..4fede55b9010 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -277,7 +277,8 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+
+ if (saddr) {
+ fl6->saddr = saddr->v6.sin6_addr;
+- fl6->fl6_sport = saddr->v6.sin6_port;
++ if (!fl6->fl6_sport)
++ fl6->fl6_sport = saddr->v6.sin6_port;
+
+ pr_debug("src=%pI6 - ", &fl6->saddr);
+ }
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index d4352111e69d..1c9f079e8a50 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -440,7 +440,8 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ }
+ if (saddr) {
+ fl4->saddr = saddr->v4.sin_addr.s_addr;
+- fl4->fl4_sport = saddr->v4.sin_port;
++ if (!fl4->fl4_sport)
++ fl4->fl4_sport = saddr->v4.sin_port;
+ }
+
+ pr_debug("%s: dst:%pI4, src:%pI4 - ", __func__, &fl4->daddr,
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index f4ac6c592e13..d05c57664e36 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -495,7 +495,10 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
+ *
+ * [INIT ACK back to where the INIT came from.]
+ */
+- retval->transport = chunk->transport;
++ if (chunk->transport)
++ retval->transport =
++ sctp_assoc_lookup_paddr(asoc,
++ &chunk->transport->ipaddr);
+
+ retval->subh.init_hdr =
+ sctp_addto_chunk(retval, sizeof(initack), &initack);
+@@ -642,8 +645,10 @@ struct sctp_chunk *sctp_make_cookie_ack(const struct sctp_association *asoc,
+ *
+ * [COOKIE ACK back to where the COOKIE ECHO came from.]
+ */
+- if (retval && chunk)
+- retval->transport = chunk->transport;
++ if (retval && chunk && chunk->transport)
++ retval->transport =
++ sctp_assoc_lookup_paddr(asoc,
++ &chunk->transport->ipaddr);
+
+ return retval;
+ }
+diff --git a/net/sctp/stream.c b/net/sctp/stream.c
+index 3892e7630f3a..80e0ae5534ec 100644
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -585,9 +585,9 @@ struct sctp_chunk *sctp_process_strreset_outreq(
+ struct sctp_strreset_outreq *outreq = param.v;
+ struct sctp_stream *stream = &asoc->stream;
+ __u32 result = SCTP_STRRESET_DENIED;
+- __u16 i, nums, flags = 0;
+ __be16 *str_p = NULL;
+ __u32 request_seq;
++ __u16 i, nums;
+
+ request_seq = ntohl(outreq->request_seq);
+
+@@ -615,6 +615,15 @@ struct sctp_chunk *sctp_process_strreset_outreq(
+ if (!(asoc->strreset_enable & SCTP_ENABLE_RESET_STREAM_REQ))
+ goto out;
+
++ nums = (ntohs(param.p->length) - sizeof(*outreq)) / sizeof(__u16);
++ str_p = outreq->list_of_streams;
++ for (i = 0; i < nums; i++) {
++ if (ntohs(str_p[i]) >= stream->incnt) {
++ result = SCTP_STRRESET_ERR_WRONG_SSN;
++ goto out;
++ }
++ }
++
+ if (asoc->strreset_chunk) {
+ if (!sctp_chunk_lookup_strreset_param(
+ asoc, outreq->response_seq,
+@@ -637,32 +646,19 @@ struct sctp_chunk *sctp_process_strreset_outreq(
+ sctp_chunk_put(asoc->strreset_chunk);
+ asoc->strreset_chunk = NULL;
+ }
+-
+- flags = SCTP_STREAM_RESET_INCOMING_SSN;
+ }
+
+- nums = (ntohs(param.p->length) - sizeof(*outreq)) / sizeof(__u16);
+- if (nums) {
+- str_p = outreq->list_of_streams;
+- for (i = 0; i < nums; i++) {
+- if (ntohs(str_p[i]) >= stream->incnt) {
+- result = SCTP_STRRESET_ERR_WRONG_SSN;
+- goto out;
+- }
+- }
+-
++ if (nums)
+ for (i = 0; i < nums; i++)
+ SCTP_SI(stream, ntohs(str_p[i]))->mid = 0;
+- } else {
++ else
+ for (i = 0; i < stream->incnt; i++)
+ SCTP_SI(stream, i)->mid = 0;
+- }
+
+ result = SCTP_STRRESET_PERFORMED;
+
+ *evp = sctp_ulpevent_make_stream_reset_event(asoc,
+- flags | SCTP_STREAM_RESET_OUTGOING_SSN, nums, str_p,
+- GFP_ATOMIC);
++ SCTP_STREAM_RESET_INCOMING_SSN, nums, str_p, GFP_ATOMIC);
+
+ out:
+ sctp_update_strreset_result(asoc, result);
+@@ -738,9 +734,6 @@ struct sctp_chunk *sctp_process_strreset_inreq(
+
+ result = SCTP_STRRESET_PERFORMED;
+
+- *evp = sctp_ulpevent_make_stream_reset_event(asoc,
+- SCTP_STREAM_RESET_INCOMING_SSN, nums, str_p, GFP_ATOMIC);
+-
+ out:
+ sctp_update_strreset_result(asoc, result);
+ err:
+@@ -873,6 +866,14 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
+ if (!(asoc->strreset_enable & SCTP_ENABLE_CHANGE_ASSOC_REQ))
+ goto out;
+
++ in = ntohs(addstrm->number_of_streams);
++ incnt = stream->incnt + in;
++ if (!in || incnt > SCTP_MAX_STREAM)
++ goto out;
++
++ if (sctp_stream_alloc_in(stream, incnt, GFP_ATOMIC))
++ goto out;
++
+ if (asoc->strreset_chunk) {
+ if (!sctp_chunk_lookup_strreset_param(
+ asoc, 0, SCTP_PARAM_RESET_ADD_IN_STREAMS)) {
+@@ -896,14 +897,6 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
+ }
+ }
+
+- in = ntohs(addstrm->number_of_streams);
+- incnt = stream->incnt + in;
+- if (!in || incnt > SCTP_MAX_STREAM)
+- goto out;
+-
+- if (sctp_stream_alloc_in(stream, incnt, GFP_ATOMIC))
+- goto out;
+-
+ stream->incnt = incnt;
+
+ result = SCTP_STRRESET_PERFORMED;
+@@ -973,9 +966,6 @@ struct sctp_chunk *sctp_process_strreset_addstrm_in(
+
+ result = SCTP_STRRESET_PERFORMED;
+
+- *evp = sctp_ulpevent_make_stream_change_event(asoc,
+- 0, 0, ntohs(addstrm->number_of_streams), GFP_ATOMIC);
+-
+ out:
+ sctp_update_strreset_result(asoc, result);
+ err:
+@@ -1036,10 +1026,10 @@ struct sctp_chunk *sctp_process_strreset_resp(
+ sout->mid_uo = 0;
+ }
+ }
+-
+- flags = SCTP_STREAM_RESET_OUTGOING_SSN;
+ }
+
++ flags |= SCTP_STREAM_RESET_OUTGOING_SSN;
++
+ for (i = 0; i < stream->outcnt; i++)
+ SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN;
+
+@@ -1058,6 +1048,8 @@ struct sctp_chunk *sctp_process_strreset_resp(
+ nums = (ntohs(inreq->param_hdr.length) - sizeof(*inreq)) /
+ sizeof(__u16);
+
++ flags |= SCTP_STREAM_RESET_INCOMING_SSN;
++
+ *evp = sctp_ulpevent_make_stream_reset_event(asoc, flags,
+ nums, str_p, GFP_ATOMIC);
+ } else if (req->type == SCTP_PARAM_RESET_TSN_REQUEST) {
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index f39f34e12fb6..dbb38fe2da7d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -117,6 +117,7 @@ struct alc_spec {
+ int codec_variant; /* flag for other variants */
+ unsigned int has_alc5505_dsp:1;
+ unsigned int no_depop_delay:1;
++ unsigned int done_hp_init:1;
+
+ /* for PLL fix */
+ hda_nid_t pll_nid;
+@@ -3372,6 +3373,48 @@ static void alc_default_shutup(struct hda_codec *codec)
+ snd_hda_shutup_pins(codec);
+ }
+
++static void alc294_hp_init(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ int i, val;
++
++ if (!hp_pin)
++ return;
++
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
++
++ msleep(100);
++
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++
++ alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
++ alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
++
++ /* Wait for depop procedure finish */
++ val = alc_read_coefex_idx(codec, 0x58, 0x01);
++ for (i = 0; i < 20 && val & 0x0080; i++) {
++ msleep(50);
++ val = alc_read_coefex_idx(codec, 0x58, 0x01);
++ }
++ /* Set HP depop to auto mode */
++ alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
++ msleep(50);
++}
++
++static void alc294_init(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (!spec->done_hp_init) {
++ alc294_hp_init(codec);
++ spec->done_hp_init = true;
++ }
++ alc_default_init(codec);
++}
++
+ static void alc5505_coef_set(struct hda_codec *codec, unsigned int index_reg,
+ unsigned int val)
+ {
+@@ -7288,37 +7331,6 @@ static void alc269_fill_coef(struct hda_codec *codec)
+ alc_update_coef_idx(codec, 0x4, 0, 1<<11);
+ }
+
+-static void alc294_hp_init(struct hda_codec *codec)
+-{
+- struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+- int i, val;
+-
+- if (!hp_pin)
+- return;
+-
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+-
+- msleep(100);
+-
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+-
+- alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
+- alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
+-
+- /* Wait for depop procedure finish */
+- val = alc_read_coefex_idx(codec, 0x58, 0x01);
+- for (i = 0; i < 20 && val & 0x0080; i++) {
+- msleep(50);
+- val = alc_read_coefex_idx(codec, 0x58, 0x01);
+- }
+- /* Set HP depop to auto mode */
+- alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
+- msleep(50);
+-}
+-
+ /*
+ */
+ static int patch_alc269(struct hda_codec *codec)
+@@ -7444,7 +7456,7 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->codec_variant = ALC269_TYPE_ALC294;
+ spec->gen.mixer_nid = 0; /* ALC2x4 does not have any loopback mixer path */
+ alc_update_coef_idx(codec, 0x6b, 0x0018, (1<<4) | (1<<3)); /* UAJ MIC Vref control by verb */
+- alc294_hp_init(codec);
++ spec->init_hook = alc294_init;
+ break;
+ case 0x10ec0300:
+ spec->codec_variant = ALC269_TYPE_ALC300;
+@@ -7456,7 +7468,7 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->codec_variant = ALC269_TYPE_ALC700;
+ spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
+ alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
+- alc294_hp_init(codec);
++ spec->init_hook = alc294_init;
+ break;
+
+ }
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 6623cafc94f2..7e93686a430a 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1373,6 +1373,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+
++ case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */
+ case USB_ID(0x152a, 0x85de): /* SMSL D1 DAC */
+ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
+ case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
+diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
+index e1473234968d..83057fa9d391 100644
+--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
+@@ -1563,7 +1563,16 @@ TEST_F(TRACE_poke, getpid_runs_normally)
+ #ifdef SYSCALL_NUM_RET_SHARE_REG
+ # define EXPECT_SYSCALL_RETURN(val, action) EXPECT_EQ(-1, action)
+ #else
+-# define EXPECT_SYSCALL_RETURN(val, action) EXPECT_EQ(val, action)
++# define EXPECT_SYSCALL_RETURN(val, action) \
++ do { \
++ errno = 0; \
++ if (val < 0) { \
++ EXPECT_EQ(-1, action); \
++ EXPECT_EQ(-(val), errno); \
++ } else { \
++ EXPECT_EQ(val, action); \
++ } \
++ } while (0)
+ #endif
+
+ /* Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
+@@ -1602,7 +1611,7 @@ int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
+
+ /* Architecture-specific syscall changing routine. */
+ void change_syscall(struct __test_metadata *_metadata,
+- pid_t tracee, int syscall)
++ pid_t tracee, int syscall, int result)
+ {
+ int ret;
+ ARCH_REGS regs;
+@@ -1661,7 +1670,7 @@ void change_syscall(struct __test_metadata *_metadata,
+ #ifdef SYSCALL_NUM_RET_SHARE_REG
+ TH_LOG("Can't modify syscall return on this architecture");
+ #else
+- regs.SYSCALL_RET = EPERM;
++ regs.SYSCALL_RET = result;
+ #endif
+
+ #ifdef HAVE_GETREGS
+@@ -1689,14 +1698,19 @@ void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee,
+ case 0x1002:
+ /* change getpid to getppid. */
+ EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
+- change_syscall(_metadata, tracee, __NR_getppid);
++ change_syscall(_metadata, tracee, __NR_getppid, 0);
+ break;
+ case 0x1003:
+- /* skip gettid. */
++ /* skip gettid with valid return code. */
+ EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
+- change_syscall(_metadata, tracee, -1);
++ change_syscall(_metadata, tracee, -1, 45000);
+ break;
+ case 0x1004:
++ /* skip openat with error. */
++ EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee));
++ change_syscall(_metadata, tracee, -1, -ESRCH);
++ break;
++ case 0x1005:
+ /* do nothing (allow getppid) */
+ EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
+ break;
+@@ -1729,9 +1743,11 @@ void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
+ nr = get_syscall(_metadata, tracee);
+
+ if (nr == __NR_getpid)
+- change_syscall(_metadata, tracee, __NR_getppid);
++ change_syscall(_metadata, tracee, __NR_getppid, 0);
++ if (nr == __NR_gettid)
++ change_syscall(_metadata, tracee, -1, 45000);
+ if (nr == __NR_openat)
+- change_syscall(_metadata, tracee, -1);
++ change_syscall(_metadata, tracee, -1, -ESRCH);
+ }
+
+ FIXTURE_DATA(TRACE_syscall) {
+@@ -1748,8 +1764,10 @@ FIXTURE_SETUP(TRACE_syscall)
+ BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
+ BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
+ BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
+- BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
++ BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1),
+ BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
++ BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
++ BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005),
+ BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+ };
+
+@@ -1797,15 +1815,26 @@ TEST_F(TRACE_syscall, ptrace_syscall_redirected)
+ EXPECT_NE(self->mypid, syscall(__NR_getpid));
+ }
+
+-TEST_F(TRACE_syscall, ptrace_syscall_dropped)
++TEST_F(TRACE_syscall, ptrace_syscall_errno)
++{
++ /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
++ teardown_trace_fixture(_metadata, self->tracer);
++ self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
++ true);
++
++ /* Tracer should skip the open syscall, resulting in ESRCH. */
++ EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
++}
++
++TEST_F(TRACE_syscall, ptrace_syscall_faked)
+ {
+ /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
+ teardown_trace_fixture(_metadata, self->tracer);
+ self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
+ true);
+
+- /* Tracer should skip the open syscall, resulting in EPERM. */
+- EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_openat));
++ /* Tracer should skip the gettid syscall, resulting fake pid. */
++ EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
+ }
+
+ TEST_F(TRACE_syscall, syscall_allowed)
+@@ -1838,7 +1867,21 @@ TEST_F(TRACE_syscall, syscall_redirected)
+ EXPECT_NE(self->mypid, syscall(__NR_getpid));
+ }
+
+-TEST_F(TRACE_syscall, syscall_dropped)
++TEST_F(TRACE_syscall, syscall_errno)
++{
++ long ret;
++
++ ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
++ ASSERT_EQ(0, ret);
++
++ ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
++ ASSERT_EQ(0, ret);
++
++ /* openat has been skipped and an errno return. */
++ EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
++}
++
++TEST_F(TRACE_syscall, syscall_faked)
+ {
+ long ret;
+
+@@ -1849,8 +1892,7 @@ TEST_F(TRACE_syscall, syscall_dropped)
+ ASSERT_EQ(0, ret);
+
+ /* gettid has been skipped and an altered return value stored. */
+- EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_gettid));
+- EXPECT_NE(self->mytid, syscall(__NR_gettid));
++ EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
+ }
+
+ TEST_F(TRACE_syscall, skip_after_RET_TRACE)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-02-12 20:53 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-02-12 20:53 UTC (permalink / raw
To: gentoo-commits
commit: 1a31279af4f26ab88a68bf8bb958c47c92600c64
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Feb 12 20:53:29 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Feb 12 20:53:29 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=1a31279a
proj/linux-patches: Linux patch 4.19.21
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1020_linux-4.19.21.patch | 9498 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 9502 insertions(+)
diff --git a/0000_README b/0000_README
index b213e93..ff7bed3 100644
--- a/0000_README
+++ b/0000_README
@@ -123,6 +123,10 @@ Patch: 1019_linux-4.19.20.patch
From: http://www.kernel.org
Desc: Linux 4.19.20
+Patch: 1020_linux-4.19.21.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.21
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1020_linux-4.19.21.patch b/1020_linux-4.19.21.patch
new file mode 100644
index 0000000..5b26e96
--- /dev/null
+++ b/1020_linux-4.19.21.patch
@@ -0,0 +1,9498 @@
+diff --git a/Makefile b/Makefile
+index f1859811dca1..ba5f14d38d8e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 20
++SUBLEVEL = 21
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts b/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts
+index df1227613d48..c2ece0b91885 100644
+--- a/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts
++++ b/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts
+@@ -13,7 +13,7 @@
+ bootargs = "console=ttyS4,115200 earlyprintk";
+ };
+
+- memory {
++ memory@80000000 {
+ reg = <0x80000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+index 7a291de02543..22dade6393d0 100644
+--- a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
++++ b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+@@ -13,7 +13,7 @@
+ bootargs = "earlyprintk";
+ };
+
+- memory {
++ memory@80000000 {
+ reg = <0x80000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts b/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts
+index d598b6391362..024e52a6cd0f 100644
+--- a/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts
++++ b/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts
+@@ -14,7 +14,7 @@
+ bootargs = "console=ttyS4,115200 earlyprintk";
+ };
+
+- memory {
++ memory@80000000 {
+ reg = <0x80000000 0x40000000>;
+ };
+
+@@ -322,4 +322,3 @@
+ &adc {
+ status = "okay";
+ };
+-
+diff --git a/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts b/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts
+index 43ed13963d35..33d704541de6 100644
+--- a/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts
++++ b/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts
+@@ -17,7 +17,7 @@
+ bootargs = "console=ttyS4,115200 earlyprintk";
+ };
+
+- memory {
++ memory@80000000 {
+ reg = <0x80000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/gemini-dlink-dir-685.dts b/arch/arm/boot/dts/gemini-dlink-dir-685.dts
+index 6f258b50eb44..502a361d1fe9 100644
+--- a/arch/arm/boot/dts/gemini-dlink-dir-685.dts
++++ b/arch/arm/boot/dts/gemini-dlink-dir-685.dts
+@@ -274,20 +274,16 @@
+ read-only;
+ };
+ /*
+- * Between the boot loader and the rootfs is the kernel
+- * in a custom Storlink format flashed from the boot
+- * menu. The rootfs is in squashfs format.
++ * This firmware image contains the kernel catenated
++ * with the squashfs root filesystem. For some reason
++ * this is called "upgrade" on the vendor system.
+ */
+- partition@1800c0 {
+- label = "rootfs";
+- reg = <0x001800c0 0x01dbff40>;
+- read-only;
+- };
+- partition@1f40000 {
++ partition@40000 {
+ label = "upgrade";
+- reg = <0x01f40000 0x00040000>;
++ reg = <0x00040000 0x01f40000>;
+ read-only;
+ };
++ /* RGDB, Residental Gateway Database? */
+ partition@1f80000 {
+ label = "rgdb";
+ reg = <0x01f80000 0x00040000>;
+diff --git a/arch/arm/boot/dts/imx51-zii-rdu1.dts b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+index 469cce2c0357..6e80254c4562 100644
+--- a/arch/arm/boot/dts/imx51-zii-rdu1.dts
++++ b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+@@ -477,6 +477,15 @@
+ };
+
+ &gpio1 {
++ gpio-line-names = "", "", "", "",
++ "", "", "", "",
++ "", "hp-amp-shutdown-b", "", "",
++ "", "", "", "",
++ "", "", "", "",
++ "", "", "", "",
++ "", "", "", "",
++ "", "", "", "";
++
+ unused-sd3-wp-gpio {
+ /*
+ * See pinctrl_esdhc1 below for more details on this
+@@ -501,9 +510,6 @@
+ hpa1: amp@60 {
+ compatible = "ti,tpa6130a2";
+ reg = <0x60>;
+- pinctrl-names = "default";
+- pinctrl-0 = <&pinctrl_ampgpio>;
+- power-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
+ Vdd-supply = <®_3p3v>;
+ };
+
+@@ -677,7 +683,10 @@
+ };
+
+ &iomuxc {
+- pinctrl_ampgpio: ampgpiogrp {
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_hog>;
++
++ pinctrl_hog: hoggrp {
+ fsl,pins = <
+ MX51_PAD_GPIO1_9__GPIO1_9 0x5e
+ >;
+diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi
+index 766bbb8495b6..47e5b63339d1 100644
+--- a/arch/arm/boot/dts/mmp2.dtsi
++++ b/arch/arm/boot/dts/mmp2.dtsi
+@@ -220,12 +220,15 @@
+ status = "disabled";
+ };
+
+- twsi2: i2c@d4025000 {
++ twsi2: i2c@d4031000 {
+ compatible = "mrvl,mmp-twsi";
+- reg = <0xd4025000 0x1000>;
+- interrupts = <58>;
++ reg = <0xd4031000 0x1000>;
++ interrupt-parent = <&intcmux17>;
++ interrupts = <0>;
+ clocks = <&soc_clocks MMP2_CLK_TWSI1>;
+ resets = <&soc_clocks MMP2_CLK_TWSI1>;
++ #address-cells = <1>;
++ #size-cells = <0>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm/boot/dts/omap4-sdp.dts b/arch/arm/boot/dts/omap4-sdp.dts
+index 490726b52216..9dc7ec7655cb 100644
+--- a/arch/arm/boot/dts/omap4-sdp.dts
++++ b/arch/arm/boot/dts/omap4-sdp.dts
+@@ -33,6 +33,7 @@
+ gpio = <&gpio2 16 GPIO_ACTIVE_HIGH>; /* gpio line 48 */
+ enable-active-high;
+ regulator-boot-on;
++ startup-delay-us = <25000>;
+ };
+
+ vbat: fixedregulator-vbat {
+diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
+index 0978282d5fc2..f574a5e0d589 100644
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -693,6 +693,21 @@ void smp_send_stop(void)
+ pr_warn("SMP: failed to stop secondary CPUs\n");
+ }
+
++/* In case panic() and panic() called at the same time on CPU1 and CPU2,
++ * and CPU 1 calls panic_smp_self_stop() before crash_smp_send_stop()
++ * CPU1 can't receive the ipi irqs from CPU2, CPU1 will be always online,
++ * kdump fails. So split out the panic_smp_self_stop() and add
++ * set_cpu_online(smp_processor_id(), false).
++ */
++void panic_smp_self_stop(void)
++{
++ pr_debug("CPU %u will stop doing anything useful since another CPU has paniced\n",
++ smp_processor_id());
++ set_cpu_online(smp_processor_id(), false);
++ while (1)
++ cpu_relax();
++}
++
+ /*
+ * not supported here
+ */
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index cd65ea4e9c54..ec3789ba17b8 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2397,7 +2397,7 @@ static int __init _init(struct omap_hwmod *oh, void *data)
+ * a stub; implementing this properly requires iclk autoidle usecounting in
+ * the clock code. No return value.
+ */
+-static void __init _setup_iclk_autoidle(struct omap_hwmod *oh)
++static void _setup_iclk_autoidle(struct omap_hwmod *oh)
+ {
+ struct omap_hwmod_ocp_if *os;
+
+@@ -2428,7 +2428,7 @@ static void __init _setup_iclk_autoidle(struct omap_hwmod *oh)
+ * reset. Returns 0 upon success or a negative error code upon
+ * failure.
+ */
+-static int __init _setup_reset(struct omap_hwmod *oh)
++static int _setup_reset(struct omap_hwmod *oh)
+ {
+ int r;
+
+@@ -2489,7 +2489,7 @@ static int __init _setup_reset(struct omap_hwmod *oh)
+ *
+ * No return value.
+ */
+-static void __init _setup_postsetup(struct omap_hwmod *oh)
++static void _setup_postsetup(struct omap_hwmod *oh)
+ {
+ u8 postsetup_state;
+
+diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
+index c5c0ab8ac9f9..024c1fbcc55a 100644
+--- a/arch/arm/mach-pxa/cm-x300.c
++++ b/arch/arm/mach-pxa/cm-x300.c
+@@ -558,7 +558,7 @@ static struct pxa3xx_u2d_platform_data cm_x300_u2d_platform_data = {
+ .exit = cm_x300_u2d_exit,
+ };
+
+-static void cm_x300_init_u2d(void)
++static void __init cm_x300_init_u2d(void)
+ {
+ pxa3xx_set_u2d_info(&cm_x300_u2d_platform_data);
+ }
+diff --git a/arch/arm/mach-pxa/littleton.c b/arch/arm/mach-pxa/littleton.c
+index 9e132b3e48c6..9960ea158829 100644
+--- a/arch/arm/mach-pxa/littleton.c
++++ b/arch/arm/mach-pxa/littleton.c
+@@ -184,7 +184,7 @@ static struct pxafb_mach_info littleton_lcd_info = {
+ .lcd_conn = LCD_COLOR_TFT_16BPP,
+ };
+
+-static void littleton_init_lcd(void)
++static void __init littleton_init_lcd(void)
+ {
+ pxa_set_fb_info(NULL, &littleton_lcd_info);
+ }
+diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
+index e3851795d6d7..68a536de542d 100644
+--- a/arch/arm/mach-pxa/zeus.c
++++ b/arch/arm/mach-pxa/zeus.c
+@@ -559,7 +559,7 @@ static struct pxaohci_platform_data zeus_ohci_platform_data = {
+ .flags = ENABLE_PORT_ALL | POWER_SENSE_LOW,
+ };
+
+-static void zeus_register_ohci(void)
++static void __init zeus_register_ohci(void)
+ {
+ /* Port 2 is shared between host and client interface. */
+ UP2OCR = UP2OCR_HXOE | UP2OCR_HXS | UP2OCR_DMPDE | UP2OCR_DPPDE;
+diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
+index 35b2e50f17fb..49bb9a020a09 100644
+--- a/arch/arm64/include/asm/io.h
++++ b/arch/arm64/include/asm/io.h
+@@ -106,7 +106,23 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
+ }
+
+ /* IO barriers */
+-#define __iormb() rmb()
++#define __iormb(v) \
++({ \
++ unsigned long tmp; \
++ \
++ rmb(); \
++ \
++ /* \
++ * Create a dummy control dependency from the IO read to any \
++ * later instructions. This ensures that a subsequent call to \
++ * udelay() will be ordered due to the ISB in get_cycles(). \
++ */ \
++ asm volatile("eor %0, %1, %1\n" \
++ "cbnz %0, ." \
++ : "=r" (tmp) : "r" ((unsigned long)(v)) \
++ : "memory"); \
++})
++
+ #define __iowmb() wmb()
+
+ #define mmiowb() do { } while (0)
+@@ -131,10 +147,10 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
+ * following Normal memory access. Writes are ordered relative to any prior
+ * Normal memory access.
+ */
+-#define readb(c) ({ u8 __v = readb_relaxed(c); __iormb(); __v; })
+-#define readw(c) ({ u16 __v = readw_relaxed(c); __iormb(); __v; })
+-#define readl(c) ({ u32 __v = readl_relaxed(c); __iormb(); __v; })
+-#define readq(c) ({ u64 __v = readq_relaxed(c); __iormb(); __v; })
++#define readb(c) ({ u8 __v = readb_relaxed(c); __iormb(__v); __v; })
++#define readw(c) ({ u16 __v = readw_relaxed(c); __iormb(__v); __v; })
++#define readl(c) ({ u32 __v = readl_relaxed(c); __iormb(__v); __v; })
++#define readq(c) ({ u64 __v = readq_relaxed(c); __iormb(__v); __v; })
+
+ #define writeb(v,c) ({ __iowmb(); writeb_relaxed((v),(c)); })
+ #define writew(v,c) ({ __iowmb(); writew_relaxed((v),(c)); })
+@@ -185,9 +201,9 @@ extern void __iomem *ioremap_cache(phys_addr_t phys_addr, size_t size);
+ /*
+ * io{read,write}{16,32,64}be() macros
+ */
+-#define ioread16be(p) ({ __u16 __v = be16_to_cpu((__force __be16)__raw_readw(p)); __iormb(); __v; })
+-#define ioread32be(p) ({ __u32 __v = be32_to_cpu((__force __be32)__raw_readl(p)); __iormb(); __v; })
+-#define ioread64be(p) ({ __u64 __v = be64_to_cpu((__force __be64)__raw_readq(p)); __iormb(); __v; })
++#define ioread16be(p) ({ __u16 __v = be16_to_cpu((__force __be16)__raw_readw(p)); __iormb(__v); __v; })
++#define ioread32be(p) ({ __u32 __v = be32_to_cpu((__force __be32)__raw_readl(p)); __iormb(__v); __v; })
++#define ioread64be(p) ({ __u64 __v = be64_to_cpu((__force __be64)__raw_readq(p)); __iormb(__v); __v; })
+
+ #define iowrite16be(v,p) ({ __iowmb(); __raw_writew((__force __u16)cpu_to_be16(v), p); })
+ #define iowrite32be(v,p) ({ __iowmb(); __raw_writel((__force __u32)cpu_to_be32(v), p); })
+diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h
+index 98c4ce55d9c3..ad64d2c92ef5 100644
+--- a/arch/arm64/include/uapi/asm/ptrace.h
++++ b/arch/arm64/include/uapi/asm/ptrace.h
+@@ -130,7 +130,7 @@ struct user_sve_header {
+
+ /* Offset from the start of struct user_sve_header to the register data */
+ #define SVE_PT_REGS_OFFSET \
+- ((sizeof(struct sve_context) + (SVE_VQ_BYTES - 1)) \
++ ((sizeof(struct user_sve_header) + (SVE_VQ_BYTES - 1)) \
+ / SVE_VQ_BYTES * SVE_VQ_BYTES)
+
+ /*
+diff --git a/arch/arm64/kernel/entry-ftrace.S b/arch/arm64/kernel/entry-ftrace.S
+index 1175f5827ae1..295951f3172e 100644
+--- a/arch/arm64/kernel/entry-ftrace.S
++++ b/arch/arm64/kernel/entry-ftrace.S
+@@ -79,7 +79,6 @@
+ .macro mcount_get_lr reg
+ ldr \reg, [x29]
+ ldr \reg, [\reg, #8]
+- mcount_adjust_addr \reg, \reg
+ .endm
+
+ .macro mcount_get_lr_addr reg
+diff --git a/arch/mips/boot/dts/img/boston.dts b/arch/mips/boot/dts/img/boston.dts
+index 65af3f6ba81c..84328afa3a55 100644
+--- a/arch/mips/boot/dts/img/boston.dts
++++ b/arch/mips/boot/dts/img/boston.dts
+@@ -141,6 +141,12 @@
+ #size-cells = <2>;
+ #interrupt-cells = <1>;
+
++ eg20t_phub@2,0,0 {
++ compatible = "pci8086,8801";
++ reg = <0x00020000 0 0 0 0>;
++ intel,eg20t-prefetch = <0>;
++ };
++
+ eg20t_mac@2,0,1 {
+ compatible = "pci8086,8802";
+ reg = <0x00020100 0 0 0 0>;
+diff --git a/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h b/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h
+index e9cc62cfac99..ff50aeb1a933 100644
+--- a/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h
++++ b/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h
+@@ -4,8 +4,6 @@
+
+ struct jz4740_mmc_platform_data {
+ int gpio_power;
+- int gpio_card_detect;
+- int gpio_read_only;
+ unsigned card_detect_active_low:1;
+ unsigned read_only_active_low:1;
+ unsigned power_active_low:1;
+diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h
+index c05dcf5ab414..273ef58f4d43 100644
+--- a/arch/mips/include/uapi/asm/inst.h
++++ b/arch/mips/include/uapi/asm/inst.h
+@@ -369,8 +369,8 @@ enum mm_32a_minor_op {
+ mm_ext_op = 0x02c,
+ mm_pool32axf_op = 0x03c,
+ mm_srl32_op = 0x040,
++ mm_srlv32_op = 0x050,
+ mm_sra_op = 0x080,
+- mm_srlv32_op = 0x090,
+ mm_rotr_op = 0x0c0,
+ mm_lwxs_op = 0x118,
+ mm_addu32_op = 0x150,
+diff --git a/arch/mips/jz4740/board-qi_lb60.c b/arch/mips/jz4740/board-qi_lb60.c
+index af0c8ace0141..705593d40d12 100644
+--- a/arch/mips/jz4740/board-qi_lb60.c
++++ b/arch/mips/jz4740/board-qi_lb60.c
+@@ -43,7 +43,6 @@
+ #include "clock.h"
+
+ /* GPIOs */
+-#define QI_LB60_GPIO_SD_CD JZ_GPIO_PORTD(0)
+ #define QI_LB60_GPIO_SD_VCC_EN_N JZ_GPIO_PORTD(2)
+
+ #define QI_LB60_GPIO_KEYOUT(x) (JZ_GPIO_PORTC(10) + (x))
+@@ -386,12 +385,18 @@ static struct platform_device qi_lb60_gpio_keys = {
+ };
+
+ static struct jz4740_mmc_platform_data qi_lb60_mmc_pdata = {
+- .gpio_card_detect = QI_LB60_GPIO_SD_CD,
+- .gpio_read_only = -1,
+ .gpio_power = QI_LB60_GPIO_SD_VCC_EN_N,
+ .power_active_low = 1,
+ };
+
++static struct gpiod_lookup_table qi_lb60_mmc_gpio_table = {
++ .dev_id = "jz4740-mmc.0",
++ .table = {
++ GPIO_LOOKUP("GPIOD", 0, "cd", GPIO_ACTIVE_HIGH),
++ { },
++ },
++};
++
+ /* beeper */
+ static struct pwm_lookup qi_lb60_pwm_lookup[] = {
+ PWM_LOOKUP("jz4740-pwm", 4, "pwm-beeper", NULL, 0,
+@@ -500,6 +505,7 @@ static int __init qi_lb60_init_platform_devices(void)
+ gpiod_add_lookup_table(&qi_lb60_audio_gpio_table);
+ gpiod_add_lookup_table(&qi_lb60_nand_gpio_table);
+ gpiod_add_lookup_table(&qi_lb60_spigpio_gpio_table);
++ gpiod_add_lookup_table(&qi_lb60_mmc_gpio_table);
+
+ spi_register_board_info(qi_lb60_spi_board_info,
+ ARRAY_SIZE(qi_lb60_spi_board_info));
+diff --git a/arch/mips/ralink/Kconfig b/arch/mips/ralink/Kconfig
+index 1f9cb0e3c79a..613d61763433 100644
+--- a/arch/mips/ralink/Kconfig
++++ b/arch/mips/ralink/Kconfig
+@@ -38,6 +38,7 @@ choice
+
+ config SOC_MT7620
+ bool "MT7620/8"
++ select CPU_MIPSR2_IRQ_VI
+ select HW_HAS_PCI
+
+ config SOC_MT7621
+diff --git a/arch/nds32/mm/Makefile b/arch/nds32/mm/Makefile
+index 6b6855852223..7c5c15ad854a 100644
+--- a/arch/nds32/mm/Makefile
++++ b/arch/nds32/mm/Makefile
+@@ -4,4 +4,8 @@ obj-y := extable.o tlb.o \
+
+ obj-$(CONFIG_ALIGNMENT_TRAP) += alignment.o
+ obj-$(CONFIG_HIGHMEM) += highmem.o
+-CFLAGS_proc-n13.o += -fomit-frame-pointer
++
++ifdef CONFIG_FUNCTION_TRACER
++CFLAGS_REMOVE_proc.o = $(CC_FLAGS_FTRACE)
++endif
++CFLAGS_proc.o += -fomit-frame-pointer
+diff --git a/arch/powerpc/include/asm/fadump.h b/arch/powerpc/include/asm/fadump.h
+index 1e7a33592e29..15bc07a31c46 100644
+--- a/arch/powerpc/include/asm/fadump.h
++++ b/arch/powerpc/include/asm/fadump.h
+@@ -200,7 +200,7 @@ struct fad_crash_memory_ranges {
+ unsigned long long size;
+ };
+
+-extern int is_fadump_boot_memory_area(u64 addr, ulong size);
++extern int is_fadump_memory_area(u64 addr, ulong size);
+ extern int early_init_dt_scan_fw_dump(unsigned long node,
+ const char *uname, int depth, void *data);
+ extern int fadump_reserve_mem(void);
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index bac225bb7f64..23bea99bf8d5 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -63,7 +63,7 @@ static inline int __access_ok(unsigned long addr, unsigned long size,
+ #endif
+
+ #define access_ok(type, addr, size) \
+- (__chk_user_ptr(addr), \
++ (__chk_user_ptr(addr), (void)(type), \
+ __access_ok((__force unsigned long)(addr), (size), get_fs()))
+
+ /*
+diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
+index a711d22339ea..c02c95287a5f 100644
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -118,13 +118,19 @@ int __init early_init_dt_scan_fw_dump(unsigned long node,
+
+ /*
+ * If fadump is registered, check if the memory provided
+- * falls within boot memory area.
++ * falls within boot memory area and reserved memory area.
+ */
+-int is_fadump_boot_memory_area(u64 addr, ulong size)
++int is_fadump_memory_area(u64 addr, ulong size)
+ {
++ u64 d_start = fw_dump.reserve_dump_area_start;
++ u64 d_end = d_start + fw_dump.reserve_dump_area_size;
++
+ if (!fw_dump.dump_registered)
+ return 0;
+
++ if (((addr + size) > d_start) && (addr <= d_end))
++ return 1;
++
+ return (addr + size) > RMA_START && addr <= fw_dump.boot_memory_size;
+ }
+
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 07ae018e550e..53016c753f3c 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -296,6 +296,10 @@ SECTIONS
+ #ifdef CONFIG_PPC32
+ .data : AT(ADDR(.data) - LOAD_OFFSET) {
+ DATA_DATA
++#ifdef CONFIG_UBSAN
++ *(.data..Lubsan_data*)
++ *(.data..Lubsan_type*)
++#endif
+ *(.data.rel*)
+ *(SDATA_MAIN)
+ *(.sdata2)
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index eba5756d5b41..79b79408d92e 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -543,8 +543,11 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
+ #ifdef CONFIG_PPC_BOOK3S_64
+ case KVM_CAP_SPAPR_TCE:
+ case KVM_CAP_SPAPR_TCE_64:
+- /* fallthrough */
++ r = 1;
++ break;
+ case KVM_CAP_SPAPR_TCE_VFIO:
++ r = !!cpu_has_feature(CPU_FTR_HVMODE);
++ break;
+ case KVM_CAP_PPC_RTAS:
+ case KVM_CAP_PPC_FIXUP_HCALL:
+ case KVM_CAP_PPC_ENABLE_HCALL:
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index d51cf5f4e45e..365526ee29b8 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -221,7 +221,9 @@ static int mm_fault_error(struct pt_regs *regs, unsigned long addr,
+ static bool bad_kernel_fault(bool is_exec, unsigned long error_code,
+ unsigned long address)
+ {
+- if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT))) {
++ /* NX faults set DSISR_PROTFAULT on the 8xx, DSISR_NOEXEC_OR_G on others */
++ if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT |
++ DSISR_PROTFAULT))) {
+ printk_ratelimited(KERN_CRIT "kernel tried to execute"
+ " exec-protected page (%lx) -"
+ "exploit attempt? (uid: %d)\n",
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 177de814286f..6a2f65d3d088 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -226,8 +226,13 @@ void isa207_get_mem_weight(u64 *weight)
+ u64 mmcra = mfspr(SPRN_MMCRA);
+ u64 exp = MMCRA_THR_CTR_EXP(mmcra);
+ u64 mantissa = MMCRA_THR_CTR_MANT(mmcra);
++ u64 sier = mfspr(SPRN_SIER);
++ u64 val = (sier & ISA207_SIER_TYPE_MASK) >> ISA207_SIER_TYPE_SHIFT;
+
+- *weight = mantissa << (2 * exp);
++ if (val == 0 || val == 7)
++ *weight = 0;
++ else
++ *weight = mantissa << (2 * exp);
+ }
+
+ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda-tce.c b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+index fe9691040f54..7639b2168755 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda-tce.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+@@ -299,7 +299,7 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+ if (alloc_userspace_copy) {
+ offset = 0;
+ uas = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
+- levels, tce_table_size, &offset,
++ tmplevels, tce_table_size, &offset,
+ &total_allocated_uas);
+ if (!uas)
+ goto free_tces_exit;
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index a0b20c03f078..e3010b14aea5 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -272,6 +272,8 @@ int dlpar_detach_node(struct device_node *dn)
+ if (rc)
+ return rc;
+
++ of_node_put(dn);
++
+ return 0;
+ }
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index c1578f54c626..e4c658cda3a7 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -389,8 +389,11 @@ static bool lmb_is_removable(struct drmem_lmb *lmb)
+ phys_addr = lmb->base_addr;
+
+ #ifdef CONFIG_FA_DUMP
+- /* Don't hot-remove memory that falls in fadump boot memory area */
+- if (is_fadump_boot_memory_area(phys_addr, block_sz))
++ /*
++ * Don't hot-remove memory that falls in fadump boot memory area
++ * and memory that is reserved for capturing old kernel memory.
++ */
++ if (is_fadump_memory_area(phys_addr, block_sz))
+ return false;
+ #endif
+
+diff --git a/arch/s390/include/uapi/asm/zcrypt.h b/arch/s390/include/uapi/asm/zcrypt.h
+index 2bb1f3bb98ac..48c784f2101a 100644
+--- a/arch/s390/include/uapi/asm/zcrypt.h
++++ b/arch/s390/include/uapi/asm/zcrypt.h
+@@ -147,8 +147,8 @@ struct ica_xcRB {
+ * @cprb_len: CPRB header length [0x0020]
+ * @cprb_ver_id: CPRB version id. [0x04]
+ * @pad_000: Alignment pad bytes
+- * @flags: Admin cmd [0x80] or functional cmd [0x00]
+- * @func_id: Function id / subtype [0x5434]
++ * @flags: Admin bit [0x80], Special bit [0x20]
++ * @func_id: Function id / subtype [0x5434] "T4"
+ * @source_id: Source id [originator id]
+ * @target_id: Target id [usage/ctrl domain id]
+ * @ret_code: Return code
+diff --git a/arch/sh/boards/mach-kfr2r09/setup.c b/arch/sh/boards/mach-kfr2r09/setup.c
+index e59c577ed871..c70bc7809dda 100644
+--- a/arch/sh/boards/mach-kfr2r09/setup.c
++++ b/arch/sh/boards/mach-kfr2r09/setup.c
+@@ -25,7 +25,6 @@
+ #include <linux/memblock.h>
+ #include <linux/mfd/tmio.h>
+ #include <linux/mmc/host.h>
+-#include <linux/mtd/onenand.h>
+ #include <linux/mtd/physmap.h>
+ #include <linux/platform_data/lv5207lp.h>
+ #include <linux/platform_device.h>
+diff --git a/arch/um/include/asm/pgtable.h b/arch/um/include/asm/pgtable.h
+index 7485398d0737..9c04562310b3 100644
+--- a/arch/um/include/asm/pgtable.h
++++ b/arch/um/include/asm/pgtable.h
+@@ -197,12 +197,17 @@ static inline pte_t pte_mkold(pte_t pte)
+
+ static inline pte_t pte_wrprotect(pte_t pte)
+ {
+- pte_clear_bits(pte, _PAGE_RW);
++ if (likely(pte_get_bits(pte, _PAGE_RW)))
++ pte_clear_bits(pte, _PAGE_RW);
++ else
++ return pte;
+ return(pte_mknewprot(pte));
+ }
+
+ static inline pte_t pte_mkread(pte_t pte)
+ {
++ if (unlikely(pte_get_bits(pte, _PAGE_USER)))
++ return pte;
+ pte_set_bits(pte, _PAGE_USER);
+ return(pte_mknewprot(pte));
+ }
+@@ -221,6 +226,8 @@ static inline pte_t pte_mkyoung(pte_t pte)
+
+ static inline pte_t pte_mkwrite(pte_t pte)
+ {
++ if (unlikely(pte_get_bits(pte, _PAGE_RW)))
++ return pte;
+ pte_set_bits(pte, _PAGE_RW);
+ return(pte_mknewprot(pte));
+ }
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 155fa4b53c56..d0b186264941 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3439,6 +3439,11 @@ static void free_excl_cntrs(int cpu)
+ }
+
+ static void intel_pmu_cpu_dying(int cpu)
++{
++ fini_debug_store_on_cpu(cpu);
++}
++
++static void intel_pmu_cpu_dead(int cpu)
+ {
+ struct cpu_hw_events *cpuc = &per_cpu(cpu_hw_events, cpu);
+ struct intel_shared_regs *pc;
+@@ -3451,8 +3456,6 @@ static void intel_pmu_cpu_dying(int cpu)
+ }
+
+ free_excl_cntrs(cpu);
+-
+- fini_debug_store_on_cpu(cpu);
+ }
+
+ static void intel_pmu_sched_task(struct perf_event_context *ctx,
+@@ -3541,6 +3544,7 @@ static __initconst const struct x86_pmu core_pmu = {
+ .cpu_prepare = intel_pmu_cpu_prepare,
+ .cpu_starting = intel_pmu_cpu_starting,
+ .cpu_dying = intel_pmu_cpu_dying,
++ .cpu_dead = intel_pmu_cpu_dead,
+ };
+
+ static struct attribute *intel_pmu_attrs[];
+@@ -3581,6 +3585,8 @@ static __initconst const struct x86_pmu intel_pmu = {
+ .cpu_prepare = intel_pmu_cpu_prepare,
+ .cpu_starting = intel_pmu_cpu_starting,
+ .cpu_dying = intel_pmu_cpu_dying,
++ .cpu_dead = intel_pmu_cpu_dead,
++
+ .guest_get_msrs = intel_guest_get_msrs,
+ .sched_task = intel_pmu_sched_task,
+ };
+diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
+index c07bee31abe8..b10e04387f38 100644
+--- a/arch/x86/events/intel/uncore_snbep.c
++++ b/arch/x86/events/intel/uncore_snbep.c
+@@ -1222,6 +1222,8 @@ static struct pci_driver snbep_uncore_pci_driver = {
+ .id_table = snbep_uncore_pci_ids,
+ };
+
++#define NODE_ID_MASK 0x7
++
+ /*
+ * build pci bus to socket mapping
+ */
+@@ -1243,7 +1245,7 @@ static int snbep_pci2phy_map_init(int devid, int nodeid_loc, int idmap_loc, bool
+ err = pci_read_config_dword(ubox_dev, nodeid_loc, &config);
+ if (err)
+ break;
+- nodeid = config;
++ nodeid = config & NODE_ID_MASK;
+ /* get the Node ID mapping */
+ err = pci_read_config_dword(ubox_dev, idmap_loc, &config);
+ if (err)
+diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
+index 69dcdf195b61..fa2c93cb42a2 100644
+--- a/arch/x86/include/asm/fpu/internal.h
++++ b/arch/x86/include/asm/fpu/internal.h
+@@ -106,6 +106,9 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu);
+ #define user_insn(insn, output, input...) \
+ ({ \
+ int err; \
++ \
++ might_fault(); \
++ \
+ asm volatile(ASM_STAC "\n" \
+ "1:" #insn "\n\t" \
+ "2: " ASM_CLAC "\n" \
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 807d06a7acac..1e0c4c74195c 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -69,7 +69,7 @@ void __init check_bugs(void)
+ * identify_boot_cpu() initialized SMT support information, let the
+ * core code know.
+ */
+- cpu_smt_check_topology_early();
++ cpu_smt_check_topology();
+
+ if (!IS_ENABLED(CONFIG_SMP)) {
+ pr_info("CPU: ");
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index cdbedeb3f3db..f9e7096b1804 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -783,6 +783,7 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
+ quirk_no_way_out(i, m, regs);
+
+ if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) {
++ m->bank = i;
+ mce_read_aux(m, i);
+ *msg = tmp;
+ return 1;
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index f1d3fe5a0c65..02ac8fa0cd6d 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -5837,6 +5837,13 @@ static bool svm_cpu_has_accelerated_tpr(void)
+
+ static bool svm_has_emulated_msr(int index)
+ {
++ switch (index) {
++ case MSR_IA32_MCG_EXT_CTL:
++ return false;
++ default:
++ break;
++ }
++
+ return true;
+ }
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 39a0e34ff676..0b2e13dd517b 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -27,6 +27,7 @@
+ #include <linux/mm.h>
+ #include <linux/highmem.h>
+ #include <linux/sched.h>
++#include <linux/sched/smt.h>
+ #include <linux/moduleparam.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/trace_events.h>
+@@ -8469,6 +8470,7 @@ static void free_nested(struct vcpu_vmx *vmx)
+ if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
+ return;
+
++ hrtimer_cancel(&vmx->nested.preemption_timer);
+ vmx->nested.vmxon = false;
+ vmx->nested.smm.vmxon = false;
+ free_vpid(vmx->nested.vpid02);
+@@ -11128,7 +11130,7 @@ static int vmx_vm_init(struct kvm *kvm)
+ * Warn upon starting the first VM in a potentially
+ * insecure environment.
+ */
+- if (cpu_smt_control == CPU_SMT_ENABLED)
++ if (sched_smt_active())
+ pr_warn_once(L1TF_MSG_SMT);
+ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER)
+ pr_warn_once(L1TF_MSG_L1D);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 5a9a3ebe8fba..3a7cf7c6b28a 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -4904,6 +4904,13 @@ int kvm_read_guest_virt(struct kvm_vcpu *vcpu,
+ {
+ u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0;
+
++ /*
++ * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
++ * is returned, but our callers are not ready for that and they blindly
++ * call kvm_inject_page_fault. Ensure that they at least do not leak
++ * uninitialized kernel stack memory into cr2 and error code.
++ */
++ memset(exception, 0, sizeof(*exception));
+ return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
+ exception);
+ }
+diff --git a/arch/x86/pci/broadcom_bus.c b/arch/x86/pci/broadcom_bus.c
+index 526536c81ddc..ca1e8e6dccc8 100644
+--- a/arch/x86/pci/broadcom_bus.c
++++ b/arch/x86/pci/broadcom_bus.c
+@@ -50,8 +50,8 @@ static void __init cnb20le_res(u8 bus, u8 slot, u8 func)
+ word1 = read_pci_config_16(bus, slot, func, 0xc0);
+ word2 = read_pci_config_16(bus, slot, func, 0xc2);
+ if (word1 != word2) {
+- res.start = (word1 << 16) | 0x0000;
+- res.end = (word2 << 16) | 0xffff;
++ res.start = ((resource_size_t) word1 << 16) | 0x0000;
++ res.end = ((resource_size_t) word2 << 16) | 0xffff;
+ res.flags = IORESOURCE_MEM;
+ update_res(info, res.start, res.end, res.flags, 0);
+ }
+diff --git a/arch/xtensa/boot/dts/xtfpga.dtsi b/arch/xtensa/boot/dts/xtfpga.dtsi
+index 1090528825ec..e46ae07bab05 100644
+--- a/arch/xtensa/boot/dts/xtfpga.dtsi
++++ b/arch/xtensa/boot/dts/xtfpga.dtsi
+@@ -103,7 +103,7 @@
+ };
+ };
+
+- spi0: spi-master@0d0a0000 {
++ spi0: spi@0d0a0000 {
+ compatible = "cdns,xtfpga-spi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/crypto/Kconfig b/crypto/Kconfig
+index 59e32623a7ce..0fb9586766a7 100644
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -1056,7 +1056,8 @@ config CRYPTO_AES_TI
+ 8 for decryption), this implementation only uses just two S-boxes of
+ 256 bytes each, and attempts to eliminate data dependent latencies by
+ prefetching the entire table into the cache at the start of each
+- block.
++ block. Interrupts are also disabled to avoid races where cachelines
++ are evicted when the CPU is interrupted to do something else.
+
+ config CRYPTO_AES_586
+ tristate "AES cipher algorithms (i586)"
+diff --git a/crypto/aes_ti.c b/crypto/aes_ti.c
+index 03023b2290e8..1ff9785b30f5 100644
+--- a/crypto/aes_ti.c
++++ b/crypto/aes_ti.c
+@@ -269,6 +269,7 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+ const u32 *rkp = ctx->key_enc + 4;
+ int rounds = 6 + ctx->key_length / 4;
+ u32 st0[4], st1[4];
++ unsigned long flags;
+ int round;
+
+ st0[0] = ctx->key_enc[0] ^ get_unaligned_le32(in);
+@@ -276,6 +277,12 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+ st0[2] = ctx->key_enc[2] ^ get_unaligned_le32(in + 8);
+ st0[3] = ctx->key_enc[3] ^ get_unaligned_le32(in + 12);
+
++ /*
++ * Temporarily disable interrupts to avoid races where cachelines are
++ * evicted when the CPU is interrupted to do something else.
++ */
++ local_irq_save(flags);
++
+ st0[0] ^= __aesti_sbox[ 0] ^ __aesti_sbox[128];
+ st0[1] ^= __aesti_sbox[32] ^ __aesti_sbox[160];
+ st0[2] ^= __aesti_sbox[64] ^ __aesti_sbox[192];
+@@ -300,6 +307,8 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+ put_unaligned_le32(subshift(st1, 1) ^ rkp[5], out + 4);
+ put_unaligned_le32(subshift(st1, 2) ^ rkp[6], out + 8);
+ put_unaligned_le32(subshift(st1, 3) ^ rkp[7], out + 12);
++
++ local_irq_restore(flags);
+ }
+
+ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+@@ -308,6 +317,7 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+ const u32 *rkp = ctx->key_dec + 4;
+ int rounds = 6 + ctx->key_length / 4;
+ u32 st0[4], st1[4];
++ unsigned long flags;
+ int round;
+
+ st0[0] = ctx->key_dec[0] ^ get_unaligned_le32(in);
+@@ -315,6 +325,12 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+ st0[2] = ctx->key_dec[2] ^ get_unaligned_le32(in + 8);
+ st0[3] = ctx->key_dec[3] ^ get_unaligned_le32(in + 12);
+
++ /*
++ * Temporarily disable interrupts to avoid races where cachelines are
++ * evicted when the CPU is interrupted to do something else.
++ */
++ local_irq_save(flags);
++
+ st0[0] ^= __aesti_inv_sbox[ 0] ^ __aesti_inv_sbox[128];
+ st0[1] ^= __aesti_inv_sbox[32] ^ __aesti_inv_sbox[160];
+ st0[2] ^= __aesti_inv_sbox[64] ^ __aesti_inv_sbox[192];
+@@ -339,6 +355,8 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+ put_unaligned_le32(inv_subshift(st1, 1) ^ rkp[5], out + 4);
+ put_unaligned_le32(inv_subshift(st1, 2) ^ rkp[6], out + 8);
+ put_unaligned_le32(inv_subshift(st1, 3) ^ rkp[7], out + 12);
++
++ local_irq_restore(flags);
+ }
+
+ static struct crypto_alg aes_alg = {
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 02c6fd9caff7..f008ba7c9ced 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -691,6 +691,8 @@ static void __ghes_panic(struct ghes *ghes)
+ {
+ __ghes_print_estatus(KERN_EMERG, ghes->generic, ghes->estatus);
+
++ ghes_clear_estatus(ghes);
++
+ /* reboot to log the error! */
+ if (!panic_timeout)
+ panic_timeout = ghes_panic_timeout;
+diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
+index 9d52743080a4..c336784d0bcb 100644
+--- a/drivers/acpi/spcr.c
++++ b/drivers/acpi/spcr.c
+@@ -148,6 +148,13 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
+ }
+
+ switch (table->baud_rate) {
++ case 0:
++ /*
++ * SPCR 1.04 defines 0 as a preconfigured state of UART.
++ * Assume firmware or bootloader configures console correctly.
++ */
++ baud_rate = 0;
++ break;
+ case 3:
+ baud_rate = 9600;
+ break;
+@@ -196,6 +203,10 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
+ * UART so don't attempt to change to the baud rate state
+ * in the table because driver cannot calculate the dividers
+ */
++ baud_rate = 0;
++ }
++
++ if (!baud_rate) {
+ snprintf(opts, sizeof(opts), "%s,%s,0x%llx", uart, iotype,
+ table->serial_port.address);
+ } else {
+diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
+index 10ecb232245d..03867f539f3a 100644
+--- a/drivers/ata/sata_rcar.c
++++ b/drivers/ata/sata_rcar.c
+@@ -895,7 +895,9 @@ static int sata_rcar_probe(struct platform_device *pdev)
+ int ret = 0;
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq <= 0)
++ if (irq < 0)
++ return irq;
++ if (!irq)
+ return -EINVAL;
+
+ priv = devm_kzalloc(dev, sizeof(struct sata_rcar_priv), GFP_KERNEL);
+diff --git a/drivers/base/bus.c b/drivers/base/bus.c
+index 585e2e1c9c8f..e06a57936cc9 100644
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -614,8 +614,10 @@ static void remove_probe_files(struct bus_type *bus)
+ static ssize_t uevent_store(struct device_driver *drv, const char *buf,
+ size_t count)
+ {
+- kobject_synth_uevent(&drv->p->kobj, buf, count);
+- return count;
++ int rc;
++
++ rc = kobject_synth_uevent(&drv->p->kobj, buf, count);
++ return rc ? rc : count;
+ }
+ static DRIVER_ATTR_WO(uevent);
+
+@@ -831,8 +833,10 @@ static void klist_devices_put(struct klist_node *n)
+ static ssize_t bus_uevent_store(struct bus_type *bus,
+ const char *buf, size_t count)
+ {
+- kobject_synth_uevent(&bus->p->subsys.kobj, buf, count);
+- return count;
++ int rc;
++
++ rc = kobject_synth_uevent(&bus->p->subsys.kobj, buf, count);
++ return rc ? rc : count;
+ }
+ static BUS_ATTR(uevent, S_IWUSR, NULL, bus_uevent_store);
+
+diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
+index 5d5b5988e88b..dd6a6850cb45 100644
+--- a/drivers/base/cacheinfo.c
++++ b/drivers/base/cacheinfo.c
+@@ -79,8 +79,7 @@ static void cache_size(struct cacheinfo *this_leaf, struct device_node *np)
+ ct_idx = get_cacheinfo_idx(this_leaf->type);
+ propname = cache_type_info[ct_idx].size_prop;
+
+- if (of_property_read_u32(np, propname, &this_leaf->size))
+- this_leaf->size = 0;
++ of_property_read_u32(np, propname, &this_leaf->size);
+ }
+
+ /* not cache_line_size() because that's a macro in include/linux/cache.h */
+@@ -114,8 +113,7 @@ static void cache_nr_sets(struct cacheinfo *this_leaf, struct device_node *np)
+ ct_idx = get_cacheinfo_idx(this_leaf->type);
+ propname = cache_type_info[ct_idx].nr_sets_prop;
+
+- if (of_property_read_u32(np, propname, &this_leaf->number_of_sets))
+- this_leaf->number_of_sets = 0;
++ of_property_read_u32(np, propname, &this_leaf->number_of_sets);
+ }
+
+ static void cache_associativity(struct cacheinfo *this_leaf)
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 04bbcd779e11..92e2c32c2227 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1067,8 +1067,14 @@ out:
+ static ssize_t uevent_store(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
+- if (kobject_synth_uevent(&dev->kobj, buf, count))
++ int rc;
++
++ rc = kobject_synth_uevent(&dev->kobj, buf, count);
++
++ if (rc) {
+ dev_err(dev, "uevent: failed to send synthetic uevent\n");
++ return rc;
++ }
+
+ return count;
+ }
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 2607f859881a..7caa1adaf62a 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -926,9 +926,6 @@ static void __device_release_driver(struct device *dev, struct device *parent)
+
+ drv = dev->driver;
+ if (drv) {
+- if (driver_allows_async_probing(drv))
+- async_synchronize_full();
+-
+ while (device_links_busy(dev)) {
+ device_unlock(dev);
+ if (parent && dev->bus->need_parent_lock)
+@@ -1034,6 +1031,9 @@ void driver_detach(struct device_driver *drv)
+ struct device_private *dev_prv;
+ struct device *dev;
+
++ if (driver_allows_async_probing(drv))
++ async_synchronize_full();
++
+ for (;;) {
+ spin_lock(&drv->p->klist_devices.k_lock);
+ if (list_empty(&drv->p->klist_devices.k_list)) {
+diff --git a/drivers/base/devres.c b/drivers/base/devres.c
+index f98a097e73f2..d68b52cf9225 100644
+--- a/drivers/base/devres.c
++++ b/drivers/base/devres.c
+@@ -24,8 +24,14 @@ struct devres_node {
+
+ struct devres {
+ struct devres_node node;
+- /* -- 3 pointers */
+- unsigned long long data[]; /* guarantee ull alignment */
++ /*
++ * Some archs want to perform DMA into kmalloc caches
++ * and need a guaranteed alignment larger than
++ * the alignment of a 64-bit integer.
++ * Thus we use ARCH_KMALLOC_MINALIGN here and get exactly the same
++ * buffer alignment as if it was allocated by plain kmalloc().
++ */
++ u8 __aligned(ARCH_KMALLOC_MINALIGN) data[];
+ };
+
+ struct devres_group {
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index b4f02768ba47..319fabdd63a3 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -668,14 +668,15 @@ drbd_set_role(struct drbd_device *const device, enum drbd_role new_role, int for
+ if (rv == SS_TWO_PRIMARIES) {
+ /* Maybe the peer is detected as dead very soon...
+ retry at most once more in this case. */
+- int timeo;
+- rcu_read_lock();
+- nc = rcu_dereference(connection->net_conf);
+- timeo = nc ? (nc->ping_timeo + 1) * HZ / 10 : 1;
+- rcu_read_unlock();
+- schedule_timeout_interruptible(timeo);
+- if (try < max_tries)
++ if (try < max_tries) {
++ int timeo;
+ try = max_tries - 1;
++ rcu_read_lock();
++ nc = rcu_dereference(connection->net_conf);
++ timeo = nc ? (nc->ping_timeo + 1) * HZ / 10 : 1;
++ rcu_read_unlock();
++ schedule_timeout_interruptible(timeo);
++ }
+ continue;
+ }
+ if (rv < SS_SUCCESS) {
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index 75f6b47169e6..cb919b964066 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -3364,7 +3364,7 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device,
+ enum drbd_conns rv = C_MASK;
+ enum drbd_disk_state mydisk;
+ struct net_conf *nc;
+- int hg, rule_nr, rr_conflict, tentative;
++ int hg, rule_nr, rr_conflict, tentative, always_asbp;
+
+ mydisk = device->state.disk;
+ if (mydisk == D_NEGOTIATING)
+@@ -3415,8 +3415,12 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device,
+
+ rcu_read_lock();
+ nc = rcu_dereference(peer_device->connection->net_conf);
++ always_asbp = nc->always_asbp;
++ rr_conflict = nc->rr_conflict;
++ tentative = nc->tentative;
++ rcu_read_unlock();
+
+- if (hg == 100 || (hg == -100 && nc->always_asbp)) {
++ if (hg == 100 || (hg == -100 && always_asbp)) {
+ int pcount = (device->state.role == R_PRIMARY)
+ + (peer_role == R_PRIMARY);
+ int forced = (hg == -100);
+@@ -3455,9 +3459,6 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device,
+ "Sync from %s node\n",
+ (hg < 0) ? "peer" : "this");
+ }
+- rr_conflict = nc->rr_conflict;
+- tentative = nc->tentative;
+- rcu_read_unlock();
+
+ if (hg == -100) {
+ /* FIXME this log message is not correct if we end up here
+@@ -4141,7 +4142,7 @@ static int receive_uuids(struct drbd_connection *connection, struct packet_info
+ kfree(device->p_uuid);
+ device->p_uuid = p_uuid;
+
+- if (device->state.conn < C_CONNECTED &&
++ if ((device->state.conn < C_CONNECTED || device->state.pdsk == D_DISKLESS) &&
+ device->state.disk < D_INCONSISTENT &&
+ device->state.role == R_PRIMARY &&
+ (device->ed_uuid & ~((u64)1)) != (p_uuid[UI_CURRENT] & ~((u64)1))) {
+diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
+index f68e9baffad7..5d7024057540 100644
+--- a/drivers/block/sunvdc.c
++++ b/drivers/block/sunvdc.c
+@@ -45,6 +45,8 @@ MODULE_VERSION(DRV_MODULE_VERSION);
+ #define WAITING_FOR_GEN_CMD 0x04
+ #define WAITING_FOR_ANY -1
+
++#define VDC_MAX_RETRIES 10
++
+ static struct workqueue_struct *sunvdc_wq;
+
+ struct vdc_req_entry {
+@@ -431,6 +433,7 @@ static int __vdc_tx_trigger(struct vdc_port *port)
+ .end_idx = dr->prod,
+ };
+ int err, delay;
++ int retries = 0;
+
+ hdr.seq = dr->snd_nxt;
+ delay = 1;
+@@ -443,6 +446,8 @@ static int __vdc_tx_trigger(struct vdc_port *port)
+ udelay(delay);
+ if ((delay <<= 1) > 128)
+ delay = 128;
++ if (retries++ > VDC_MAX_RETRIES)
++ break;
+ } while (err == -EAGAIN);
+
+ if (err == -ENOTCONN)
+diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
+index 469541c1e51e..20907a0a043b 100644
+--- a/drivers/block/swim3.c
++++ b/drivers/block/swim3.c
+@@ -1026,7 +1026,11 @@ static void floppy_release(struct gendisk *disk, fmode_t mode)
+ struct swim3 __iomem *sw = fs->swim3;
+
+ mutex_lock(&swim3_mutex);
+- if (fs->ref_count > 0 && --fs->ref_count == 0) {
++ if (fs->ref_count > 0)
++ --fs->ref_count;
++ else if (fs->ref_count == -1)
++ fs->ref_count = 0;
++ if (fs->ref_count == 0) {
+ swim3_action(fs, MOTOR_OFF);
+ out_8(&sw->control_bic, 0xff);
+ swim3_select(fs, RELAX);
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index e19bf0a750cf..a65505db09e5 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -53,6 +53,11 @@ static size_t huge_class_size;
+
+ static void zram_free_page(struct zram *zram, size_t index);
+
++static int zram_slot_trylock(struct zram *zram, u32 index)
++{
++ return bit_spin_trylock(ZRAM_LOCK, &zram->table[index].value);
++}
++
+ static void zram_slot_lock(struct zram *zram, u32 index)
+ {
+ bit_spin_lock(ZRAM_LOCK, &zram->table[index].value);
+@@ -401,7 +406,6 @@ static ssize_t backing_dev_store(struct device *dev,
+ goto out;
+
+ reset_bdev(zram);
+- spin_lock_init(&zram->bitmap_lock);
+
+ zram->old_block_size = old_block_size;
+ zram->bdev = bdev;
+@@ -445,29 +449,24 @@ out:
+
+ static unsigned long get_entry_bdev(struct zram *zram)
+ {
+- unsigned long entry;
+-
+- spin_lock(&zram->bitmap_lock);
++ unsigned long blk_idx = 1;
++retry:
+ /* skip 0 bit to confuse zram.handle = 0 */
+- entry = find_next_zero_bit(zram->bitmap, zram->nr_pages, 1);
+- if (entry == zram->nr_pages) {
+- spin_unlock(&zram->bitmap_lock);
++ blk_idx = find_next_zero_bit(zram->bitmap, zram->nr_pages, blk_idx);
++ if (blk_idx == zram->nr_pages)
+ return 0;
+- }
+
+- set_bit(entry, zram->bitmap);
+- spin_unlock(&zram->bitmap_lock);
++ if (test_and_set_bit(blk_idx, zram->bitmap))
++ goto retry;
+
+- return entry;
++ return blk_idx;
+ }
+
+ static void put_entry_bdev(struct zram *zram, unsigned long entry)
+ {
+ int was_set;
+
+- spin_lock(&zram->bitmap_lock);
+ was_set = test_and_clear_bit(entry, zram->bitmap);
+- spin_unlock(&zram->bitmap_lock);
+ WARN_ON_ONCE(!was_set);
+ }
+
+@@ -888,9 +887,10 @@ static ssize_t debug_stat_show(struct device *dev,
+
+ down_read(&zram->init_lock);
+ ret = scnprintf(buf, PAGE_SIZE,
+- "version: %d\n%8llu\n",
++ "version: %d\n%8llu %8llu\n",
+ version,
+- (u64)atomic64_read(&zram->stats.writestall));
++ (u64)atomic64_read(&zram->stats.writestall),
++ (u64)atomic64_read(&zram->stats.miss_free));
+ up_read(&zram->init_lock);
+
+ return ret;
+@@ -1402,10 +1402,14 @@ static void zram_slot_free_notify(struct block_device *bdev,
+
+ zram = bdev->bd_disk->private_data;
+
+- zram_slot_lock(zram, index);
++ atomic64_inc(&zram->stats.notify_free);
++ if (!zram_slot_trylock(zram, index)) {
++ atomic64_inc(&zram->stats.miss_free);
++ return;
++ }
++
+ zram_free_page(zram, index);
+ zram_slot_unlock(zram, index);
+- atomic64_inc(&zram->stats.notify_free);
+ }
+
+ static int zram_rw_page(struct block_device *bdev, sector_t sector,
+diff --git a/drivers/block/zram/zram_drv.h b/drivers/block/zram/zram_drv.h
+index 72c8584b6dff..d1095dfdffa8 100644
+--- a/drivers/block/zram/zram_drv.h
++++ b/drivers/block/zram/zram_drv.h
+@@ -79,6 +79,7 @@ struct zram_stats {
+ atomic64_t pages_stored; /* no. of pages currently stored */
+ atomic_long_t max_used_pages; /* no. of maximum pages stored */
+ atomic64_t writestall; /* no. of write slow paths */
++ atomic64_t miss_free; /* no. of missed free */
+ };
+
+ struct zram {
+@@ -110,7 +111,6 @@ struct zram {
+ unsigned int old_block_size;
+ unsigned long *bitmap;
+ unsigned long nr_pages;
+- spinlock_t bitmap_lock;
+ #endif
+ #ifdef CONFIG_ZRAM_MEMORY_TRACKING
+ struct dentry *debugfs_dir;
+diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
+index ddbd8c6a0ceb..800132369134 100644
+--- a/drivers/bluetooth/hci_bcm.c
++++ b/drivers/bluetooth/hci_bcm.c
+@@ -907,6 +907,10 @@ static int bcm_get_resources(struct bcm_device *dev)
+
+ dev->clk = devm_clk_get(dev->dev, NULL);
+
++ /* Handle deferred probing */
++ if (dev->clk == ERR_PTR(-EPROBE_DEFER))
++ return PTR_ERR(dev->clk);
++
+ dev->device_wakeup = devm_gpiod_get_optional(dev->dev, "device-wakeup",
+ GPIOD_OUT_LOW);
+ if (IS_ERR(dev->device_wakeup))
+diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
+index ae3a7537cf0f..72cd96a8eb19 100644
+--- a/drivers/cdrom/gdrom.c
++++ b/drivers/cdrom/gdrom.c
+@@ -889,6 +889,7 @@ static void __exit exit_gdrom(void)
+ platform_device_unregister(pd);
+ platform_driver_unregister(&gdrom_driver);
+ kfree(gd.toc);
++ kfree(gd.cd_info);
+ }
+
+ module_init(init_gdrom);
+diff --git a/drivers/clk/imgtec/clk-boston.c b/drivers/clk/imgtec/clk-boston.c
+index 15af423cc0c9..f5d54a64d33c 100644
+--- a/drivers/clk/imgtec/clk-boston.c
++++ b/drivers/clk/imgtec/clk-boston.c
+@@ -73,27 +73,32 @@ static void __init clk_boston_setup(struct device_node *np)
+ hw = clk_hw_register_fixed_rate(NULL, "input", NULL, 0, in_freq);
+ if (IS_ERR(hw)) {
+ pr_err("failed to register input clock: %ld\n", PTR_ERR(hw));
+- return;
++ goto error;
+ }
+ onecell->hws[BOSTON_CLK_INPUT] = hw;
+
+ hw = clk_hw_register_fixed_rate(NULL, "sys", "input", 0, sys_freq);
+ if (IS_ERR(hw)) {
+ pr_err("failed to register sys clock: %ld\n", PTR_ERR(hw));
+- return;
++ goto error;
+ }
+ onecell->hws[BOSTON_CLK_SYS] = hw;
+
+ hw = clk_hw_register_fixed_rate(NULL, "cpu", "input", 0, cpu_freq);
+ if (IS_ERR(hw)) {
+ pr_err("failed to register cpu clock: %ld\n", PTR_ERR(hw));
+- return;
++ goto error;
+ }
+ onecell->hws[BOSTON_CLK_CPU] = hw;
+
+ err = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, onecell);
+ if (err)
+ pr_err("failed to add DT provider: %d\n", err);
++
++ return;
++
++error:
++ kfree(onecell);
+ }
+
+ /*
+diff --git a/drivers/clk/imx/clk-imx6sl.c b/drivers/clk/imx/clk-imx6sl.c
+index eb6bcbf345a3..390e3e0ecc45 100644
+--- a/drivers/clk/imx/clk-imx6sl.c
++++ b/drivers/clk/imx/clk-imx6sl.c
+@@ -17,6 +17,8 @@
+
+ #include "clk.h"
+
++#define CCDR 0x4
++#define BM_CCM_CCDR_MMDC_CH0_MASK (1 << 17)
+ #define CCSR 0xc
+ #define BM_CCSR_PLL1_SW_CLK_SEL (1 << 2)
+ #define CACRR 0x10
+@@ -409,6 +411,10 @@ static void __init imx6sl_clocks_init(struct device_node *ccm_node)
+ clks[IMX6SL_CLK_USDHC3] = imx_clk_gate2("usdhc3", "usdhc3_podf", base + 0x80, 6);
+ clks[IMX6SL_CLK_USDHC4] = imx_clk_gate2("usdhc4", "usdhc4_podf", base + 0x80, 8);
+
++ /* Ensure the MMDC CH0 handshake is bypassed */
++ writel_relaxed(readl_relaxed(base + CCDR) |
++ BM_CCM_CCDR_MMDC_CH0_MASK, base + CCDR);
++
+ imx_check_clocks(clks, ARRAY_SIZE(clks));
+
+ clk_data.clks = clks;
+diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
+index 50060e895e7a..9d79ff857d83 100644
+--- a/drivers/clk/meson/meson8b.c
++++ b/drivers/clk/meson/meson8b.c
+@@ -583,7 +583,7 @@ static struct clk_regmap meson8b_cpu_scale_div = {
+ .data = &(struct clk_regmap_div_data){
+ .offset = HHI_SYS_CPU_CLK_CNTL1,
+ .shift = 20,
+- .width = 9,
++ .width = 10,
+ .table = cpu_scale_table,
+ .flags = CLK_DIVIDER_ALLOW_ZERO,
+ },
+@@ -596,20 +596,27 @@ static struct clk_regmap meson8b_cpu_scale_div = {
+ },
+ };
+
++static u32 mux_table_cpu_scale_out_sel[] = { 0, 1, 3 };
+ static struct clk_regmap meson8b_cpu_scale_out_sel = {
+ .data = &(struct clk_regmap_mux_data){
+ .offset = HHI_SYS_CPU_CLK_CNTL0,
+ .mask = 0x3,
+ .shift = 2,
++ .table = mux_table_cpu_scale_out_sel,
+ },
+ .hw.init = &(struct clk_init_data){
+ .name = "cpu_scale_out_sel",
+ .ops = &clk_regmap_mux_ro_ops,
++ /*
++ * NOTE: We are skipping the parent with value 0x2 (which is
++ * "cpu_div3") because it results in a duty cycle of 33% which
++ * makes the system unstable and can result in a lockup of the
++ * whole system.
++ */
+ .parent_names = (const char *[]) { "cpu_in_sel",
+ "cpu_div2",
+- "cpu_div3",
+ "cpu_scale_div" },
+- .num_parents = 4,
++ .num_parents = 3,
+ .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+@@ -627,7 +634,8 @@ static struct clk_regmap meson8b_cpu_clk = {
+ "cpu_scale_out_sel" },
+ .num_parents = 2,
+ .flags = (CLK_SET_RATE_PARENT |
+- CLK_SET_RATE_NO_REPARENT),
++ CLK_SET_RATE_NO_REPARENT |
++ CLK_IS_CRITICAL),
+ },
+ };
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
+index 13eb5b23c5e7..c40d572a7602 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
+@@ -366,10 +366,10 @@ static SUNXI_CCU_MP_WITH_MUX_GATE(spi1_clk, "spi1", mod0_default_parents, 0x0a4,
+ static const char * const i2s_parents[] = { "pll-audio-8x", "pll-audio-4x",
+ "pll-audio-2x", "pll-audio" };
+ static SUNXI_CCU_MUX_WITH_GATE(i2s0_clk, "i2s0", i2s_parents,
+- 0x0b0, 16, 2, BIT(31), 0);
++ 0x0b0, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
+
+ static SUNXI_CCU_MUX_WITH_GATE(i2s1_clk, "i2s1", i2s_parents,
+- 0x0b4, 16, 2, BIT(31), 0);
++ 0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
+
+ /* TODO: the parent for most of the USB clocks is not known */
+ static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M",
+@@ -446,7 +446,7 @@ static SUNXI_CCU_M_WITH_GATE(ve_clk, "ve", "pll-ve",
+ static SUNXI_CCU_GATE(ac_dig_clk, "ac-dig", "pll-audio",
+ 0x140, BIT(31), CLK_SET_RATE_PARENT);
+ static SUNXI_CCU_GATE(ac_dig_4x_clk, "ac-dig-4x", "pll-audio-4x",
+- 0x140, BIT(30), 0);
++ 0x140, BIT(30), CLK_SET_RATE_PARENT);
+ static SUNXI_CCU_GATE(avs_clk, "avs", "osc24M",
+ 0x144, BIT(31), 0);
+
+diff --git a/drivers/cpuidle/cpuidle-big_little.c b/drivers/cpuidle/cpuidle-big_little.c
+index db2ede565f1a..b44476a1b7ad 100644
+--- a/drivers/cpuidle/cpuidle-big_little.c
++++ b/drivers/cpuidle/cpuidle-big_little.c
+@@ -167,6 +167,7 @@ static int __init bl_idle_init(void)
+ {
+ int ret;
+ struct device_node *root = of_find_node_by_path("/");
++ const struct of_device_id *match_id;
+
+ if (!root)
+ return -ENODEV;
+@@ -174,7 +175,11 @@ static int __init bl_idle_init(void)
+ /*
+ * Initialize the driver just for a compliant set of machines
+ */
+- if (!of_match_node(compatible_machine_match, root))
++ match_id = of_match_node(compatible_machine_match, root);
++
++ of_node_put(root);
++
++ if (!match_id)
+ return -ENODEV;
+
+ if (!mcpm_is_available())
+diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c
+index d2663a4e1f5e..a92a66b1ff46 100644
+--- a/drivers/crypto/ux500/cryp/cryp_core.c
++++ b/drivers/crypto/ux500/cryp/cryp_core.c
+@@ -556,7 +556,7 @@ static int cryp_set_dma_transfer(struct cryp_ctx *ctx,
+ desc = dmaengine_prep_slave_sg(channel,
+ ctx->device->dma.sg_src,
+ ctx->device->dma.sg_src_len,
+- direction, DMA_CTRL_ACK);
++ DMA_MEM_TO_DEV, DMA_CTRL_ACK);
+ break;
+
+ case DMA_FROM_DEVICE:
+@@ -580,7 +580,7 @@ static int cryp_set_dma_transfer(struct cryp_ctx *ctx,
+ desc = dmaengine_prep_slave_sg(channel,
+ ctx->device->dma.sg_dst,
+ ctx->device->dma.sg_dst_len,
+- direction,
++ DMA_DEV_TO_MEM,
+ DMA_CTRL_ACK |
+ DMA_PREP_INTERRUPT);
+
+diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
+index 633321a8dd03..a0bb8a6eec3f 100644
+--- a/drivers/crypto/ux500/hash/hash_core.c
++++ b/drivers/crypto/ux500/hash/hash_core.c
+@@ -166,7 +166,7 @@ static int hash_set_dma_transfer(struct hash_ctx *ctx, struct scatterlist *sg,
+ __func__);
+ desc = dmaengine_prep_slave_sg(channel,
+ ctx->device->dma.sg, ctx->device->dma.sg_len,
+- direction, DMA_CTRL_ACK | DMA_PREP_INTERRUPT);
++ DMA_MEM_TO_DEV, DMA_CTRL_ACK | DMA_PREP_INTERRUPT);
+ if (!desc) {
+ dev_err(ctx->device->dev,
+ "%s: dmaengine_prep_slave_sg() failed!\n", __func__);
+diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
+index 847f84a41a69..2b11d967acd0 100644
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -415,38 +415,32 @@ static void bcm2835_dma_fill_cb_chain_with_sg(
+ }
+ }
+
+-static int bcm2835_dma_abort(void __iomem *chan_base)
++static int bcm2835_dma_abort(struct bcm2835_chan *c)
+ {
+- unsigned long cs;
++ void __iomem *chan_base = c->chan_base;
+ long int timeout = 10000;
+
+- cs = readl(chan_base + BCM2835_DMA_CS);
+- if (!(cs & BCM2835_DMA_ACTIVE))
++ /*
++ * A zero control block address means the channel is idle.
++ * (The ACTIVE flag in the CS register is not a reliable indicator.)
++ */
++ if (!readl(chan_base + BCM2835_DMA_ADDR))
+ return 0;
+
+ /* Write 0 to the active bit - Pause the DMA */
+ writel(0, chan_base + BCM2835_DMA_CS);
+
+ /* Wait for any current AXI transfer to complete */
+- while ((cs & BCM2835_DMA_ISPAUSED) && --timeout) {
++ while ((readl(chan_base + BCM2835_DMA_CS) &
++ BCM2835_DMA_WAITING_FOR_WRITES) && --timeout)
+ cpu_relax();
+- cs = readl(chan_base + BCM2835_DMA_CS);
+- }
+
+- /* We'll un-pause when we set of our next DMA */
++ /* Peripheral might be stuck and fail to signal AXI write responses */
+ if (!timeout)
+- return -ETIMEDOUT;
+-
+- if (!(cs & BCM2835_DMA_ACTIVE))
+- return 0;
+-
+- /* Terminate the control block chain */
+- writel(0, chan_base + BCM2835_DMA_NEXTCB);
+-
+- /* Abort the whole DMA */
+- writel(BCM2835_DMA_ABORT | BCM2835_DMA_ACTIVE,
+- chan_base + BCM2835_DMA_CS);
++ dev_err(c->vc.chan.device->dev,
++ "failed to complete outstanding writes\n");
+
++ writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
+ return 0;
+ }
+
+@@ -485,8 +479,15 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
+
+ spin_lock_irqsave(&c->vc.lock, flags);
+
+- /* Acknowledge interrupt */
+- writel(BCM2835_DMA_INT, c->chan_base + BCM2835_DMA_CS);
++ /*
++ * Clear the INT flag to receive further interrupts. Keep the channel
++ * active in case the descriptor is cyclic or in case the client has
++ * already terminated the descriptor and issued a new one. (May happen
++ * if this IRQ handler is threaded.) If the channel is finished, it
++ * will remain idle despite the ACTIVE flag being set.
++ */
++ writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE,
++ c->chan_base + BCM2835_DMA_CS);
+
+ d = c->desc;
+
+@@ -494,11 +495,7 @@ static irqreturn_t bcm2835_dma_callback(int irq, void *data)
+ if (d->cyclic) {
+ /* call the cyclic callback */
+ vchan_cyclic_callback(&d->vd);
+-
+- /* Keep the DMA engine running */
+- writel(BCM2835_DMA_ACTIVE,
+- c->chan_base + BCM2835_DMA_CS);
+- } else {
++ } else if (!readl(c->chan_base + BCM2835_DMA_ADDR)) {
+ vchan_cookie_complete(&c->desc->vd);
+ bcm2835_dma_start_desc(c);
+ }
+@@ -796,7 +793,6 @@ static int bcm2835_dma_terminate_all(struct dma_chan *chan)
+ struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ struct bcm2835_dmadev *d = to_bcm2835_dma_dev(c->vc.chan.device);
+ unsigned long flags;
+- int timeout = 10000;
+ LIST_HEAD(head);
+
+ spin_lock_irqsave(&c->vc.lock, flags);
+@@ -806,27 +802,11 @@ static int bcm2835_dma_terminate_all(struct dma_chan *chan)
+ list_del_init(&c->node);
+ spin_unlock(&d->lock);
+
+- /*
+- * Stop DMA activity: we assume the callback will not be called
+- * after bcm_dma_abort() returns (even if it does, it will see
+- * c->desc is NULL and exit.)
+- */
++ /* stop DMA activity */
+ if (c->desc) {
+ vchan_terminate_vdesc(&c->desc->vd);
+ c->desc = NULL;
+- bcm2835_dma_abort(c->chan_base);
+-
+- /* Wait for stopping */
+- while (--timeout) {
+- if (!(readl(c->chan_base + BCM2835_DMA_CS) &
+- BCM2835_DMA_ACTIVE))
+- break;
+-
+- cpu_relax();
+- }
+-
+- if (!timeout)
+- dev_err(d->ddev.dev, "DMA transfer could not be terminated\n");
++ bcm2835_dma_abort(c);
+ }
+
+ vchan_get_all_descriptors(&c->vc, &head);
+diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
+index 75b6ff0415ee..118d371a2a4a 100644
+--- a/drivers/dma/imx-dma.c
++++ b/drivers/dma/imx-dma.c
+@@ -617,7 +617,7 @@ static void imxdma_tasklet(unsigned long data)
+ {
+ struct imxdma_channel *imxdmac = (void *)data;
+ struct imxdma_engine *imxdma = imxdmac->imxdma;
+- struct imxdma_desc *desc;
++ struct imxdma_desc *desc, *next_desc;
+ unsigned long flags;
+
+ spin_lock_irqsave(&imxdma->lock, flags);
+@@ -647,10 +647,10 @@ static void imxdma_tasklet(unsigned long data)
+ list_move_tail(imxdmac->ld_active.next, &imxdmac->ld_free);
+
+ if (!list_empty(&imxdmac->ld_queue)) {
+- desc = list_first_entry(&imxdmac->ld_queue, struct imxdma_desc,
+- node);
++ next_desc = list_first_entry(&imxdmac->ld_queue,
++ struct imxdma_desc, node);
+ list_move_tail(imxdmac->ld_queue.next, &imxdmac->ld_active);
+- if (imxdma_xfer_desc(desc) < 0)
++ if (imxdma_xfer_desc(next_desc) < 0)
+ dev_warn(imxdma->dev, "%s: channel: %d couldn't xfer desc\n",
+ __func__, imxdmac->channel);
+ }
+diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
+index c74a88b65039..73de6a6179fc 100644
+--- a/drivers/dma/xilinx/zynqmp_dma.c
++++ b/drivers/dma/xilinx/zynqmp_dma.c
+@@ -163,7 +163,7 @@ struct zynqmp_dma_desc_ll {
+ u32 ctrl;
+ u64 nxtdscraddr;
+ u64 rsvd;
+-}; __aligned(64)
++};
+
+ /**
+ * struct zynqmp_dma_desc_sw - Per Transaction structure
+diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
+index 9336ffdf6e2c..fceaafd67ec6 100644
+--- a/drivers/firmware/efi/vars.c
++++ b/drivers/firmware/efi/vars.c
+@@ -318,7 +318,12 @@ EXPORT_SYMBOL_GPL(efivar_variable_is_removable);
+ static efi_status_t
+ check_var_size(u32 attributes, unsigned long size)
+ {
+- const struct efivar_operations *fops = __efivars->ops;
++ const struct efivar_operations *fops;
++
++ if (!__efivars)
++ return EFI_UNSUPPORTED;
++
++ fops = __efivars->ops;
+
+ if (!fops->query_variable_store)
+ return EFI_UNSUPPORTED;
+@@ -329,7 +334,12 @@ check_var_size(u32 attributes, unsigned long size)
+ static efi_status_t
+ check_var_size_nonblocking(u32 attributes, unsigned long size)
+ {
+- const struct efivar_operations *fops = __efivars->ops;
++ const struct efivar_operations *fops;
++
++ if (!__efivars)
++ return EFI_UNSUPPORTED;
++
++ fops = __efivars->ops;
+
+ if (!fops->query_variable_store)
+ return EFI_UNSUPPORTED;
+@@ -429,13 +439,18 @@ static void dup_variable_bug(efi_char16_t *str16, efi_guid_t *vendor_guid,
+ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
+ void *data, bool duplicates, struct list_head *head)
+ {
+- const struct efivar_operations *ops = __efivars->ops;
++ const struct efivar_operations *ops;
+ unsigned long variable_name_size = 1024;
+ efi_char16_t *variable_name;
+ efi_status_t status;
+ efi_guid_t vendor_guid;
+ int err = 0;
+
++ if (!__efivars)
++ return -EFAULT;
++
++ ops = __efivars->ops;
++
+ variable_name = kzalloc(variable_name_size, GFP_KERNEL);
+ if (!variable_name) {
+ printk(KERN_ERR "efivars: Memory allocation failed.\n");
+@@ -583,12 +598,14 @@ static void efivar_entry_list_del_unlock(struct efivar_entry *entry)
+ */
+ int __efivar_entry_delete(struct efivar_entry *entry)
+ {
+- const struct efivar_operations *ops = __efivars->ops;
+ efi_status_t status;
+
+- status = ops->set_variable(entry->var.VariableName,
+- &entry->var.VendorGuid,
+- 0, 0, NULL);
++ if (!__efivars)
++ return -EINVAL;
++
++ status = __efivars->ops->set_variable(entry->var.VariableName,
++ &entry->var.VendorGuid,
++ 0, 0, NULL);
+
+ return efi_status_to_err(status);
+ }
+@@ -607,12 +624,17 @@ EXPORT_SYMBOL_GPL(__efivar_entry_delete);
+ */
+ int efivar_entry_delete(struct efivar_entry *entry)
+ {
+- const struct efivar_operations *ops = __efivars->ops;
++ const struct efivar_operations *ops;
+ efi_status_t status;
+
+ if (down_interruptible(&efivars_lock))
+ return -EINTR;
+
++ if (!__efivars) {
++ up(&efivars_lock);
++ return -EINVAL;
++ }
++ ops = __efivars->ops;
+ status = ops->set_variable(entry->var.VariableName,
+ &entry->var.VendorGuid,
+ 0, 0, NULL);
+@@ -650,13 +672,19 @@ EXPORT_SYMBOL_GPL(efivar_entry_delete);
+ int efivar_entry_set(struct efivar_entry *entry, u32 attributes,
+ unsigned long size, void *data, struct list_head *head)
+ {
+- const struct efivar_operations *ops = __efivars->ops;
++ const struct efivar_operations *ops;
+ efi_status_t status;
+ efi_char16_t *name = entry->var.VariableName;
+ efi_guid_t vendor = entry->var.VendorGuid;
+
+ if (down_interruptible(&efivars_lock))
+ return -EINTR;
++
++ if (!__efivars) {
++ up(&efivars_lock);
++ return -EINVAL;
++ }
++ ops = __efivars->ops;
+ if (head && efivar_entry_find(name, vendor, head, false)) {
+ up(&efivars_lock);
+ return -EEXIST;
+@@ -687,12 +715,17 @@ static int
+ efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor,
+ u32 attributes, unsigned long size, void *data)
+ {
+- const struct efivar_operations *ops = __efivars->ops;
++ const struct efivar_operations *ops;
+ efi_status_t status;
+
+ if (down_trylock(&efivars_lock))
+ return -EBUSY;
+
++ if (!__efivars) {
++ up(&efivars_lock);
++ return -EINVAL;
++ }
++
+ status = check_var_size_nonblocking(attributes,
+ size + ucs2_strsize(name, 1024));
+ if (status != EFI_SUCCESS) {
+@@ -700,6 +733,7 @@ efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor,
+ return -ENOSPC;
+ }
+
++ ops = __efivars->ops;
+ status = ops->set_variable_nonblocking(name, &vendor, attributes,
+ size, data);
+
+@@ -727,9 +761,13 @@ efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor,
+ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes,
+ bool block, unsigned long size, void *data)
+ {
+- const struct efivar_operations *ops = __efivars->ops;
++ const struct efivar_operations *ops;
+ efi_status_t status;
+
++ if (!__efivars)
++ return -EINVAL;
++
++ ops = __efivars->ops;
+ if (!ops->query_variable_store)
+ return -ENOSYS;
+
+@@ -829,13 +867,18 @@ EXPORT_SYMBOL_GPL(efivar_entry_find);
+ */
+ int efivar_entry_size(struct efivar_entry *entry, unsigned long *size)
+ {
+- const struct efivar_operations *ops = __efivars->ops;
++ const struct efivar_operations *ops;
+ efi_status_t status;
+
+ *size = 0;
+
+ if (down_interruptible(&efivars_lock))
+ return -EINTR;
++ if (!__efivars) {
++ up(&efivars_lock);
++ return -EINVAL;
++ }
++ ops = __efivars->ops;
+ status = ops->get_variable(entry->var.VariableName,
+ &entry->var.VendorGuid, NULL, size, NULL);
+ up(&efivars_lock);
+@@ -861,12 +904,14 @@ EXPORT_SYMBOL_GPL(efivar_entry_size);
+ int __efivar_entry_get(struct efivar_entry *entry, u32 *attributes,
+ unsigned long *size, void *data)
+ {
+- const struct efivar_operations *ops = __efivars->ops;
+ efi_status_t status;
+
+- status = ops->get_variable(entry->var.VariableName,
+- &entry->var.VendorGuid,
+- attributes, size, data);
++ if (!__efivars)
++ return -EINVAL;
++
++ status = __efivars->ops->get_variable(entry->var.VariableName,
++ &entry->var.VendorGuid,
++ attributes, size, data);
+
+ return efi_status_to_err(status);
+ }
+@@ -882,14 +927,19 @@ EXPORT_SYMBOL_GPL(__efivar_entry_get);
+ int efivar_entry_get(struct efivar_entry *entry, u32 *attributes,
+ unsigned long *size, void *data)
+ {
+- const struct efivar_operations *ops = __efivars->ops;
+ efi_status_t status;
+
+ if (down_interruptible(&efivars_lock))
+ return -EINTR;
+- status = ops->get_variable(entry->var.VariableName,
+- &entry->var.VendorGuid,
+- attributes, size, data);
++
++ if (!__efivars) {
++ up(&efivars_lock);
++ return -EINVAL;
++ }
++
++ status = __efivars->ops->get_variable(entry->var.VariableName,
++ &entry->var.VendorGuid,
++ attributes, size, data);
+ up(&efivars_lock);
+
+ return efi_status_to_err(status);
+@@ -921,7 +971,7 @@ EXPORT_SYMBOL_GPL(efivar_entry_get);
+ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
+ unsigned long *size, void *data, bool *set)
+ {
+- const struct efivar_operations *ops = __efivars->ops;
++ const struct efivar_operations *ops;
+ efi_char16_t *name = entry->var.VariableName;
+ efi_guid_t *vendor = &entry->var.VendorGuid;
+ efi_status_t status;
+@@ -940,6 +990,11 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
+ if (down_interruptible(&efivars_lock))
+ return -EINTR;
+
++ if (!__efivars) {
++ err = -EINVAL;
++ goto out;
++ }
++
+ /*
+ * Ensure that the available space hasn't shrunk below the safe level
+ */
+@@ -956,6 +1011,8 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
+ }
+ }
+
++ ops = __efivars->ops;
++
+ status = ops->set_variable(name, vendor, attributes, *size, data);
+ if (status != EFI_SUCCESS) {
+ err = efi_status_to_err(status);
+diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
+index 68e4b2b98c8f..7a42c194b944 100644
+--- a/drivers/fpga/altera-cvp.c
++++ b/drivers/fpga/altera-cvp.c
+@@ -403,6 +403,7 @@ static int altera_cvp_probe(struct pci_dev *pdev,
+ struct altera_cvp_conf *conf;
+ struct fpga_manager *mgr;
+ u16 cmd, val;
++ u32 regval;
+ int ret;
+
+ /*
+@@ -416,6 +417,14 @@ static int altera_cvp_probe(struct pci_dev *pdev,
+ return -ENODEV;
+ }
+
++ pci_read_config_dword(pdev, VSE_CVP_STATUS, ®val);
++ if (!(regval & VSE_CVP_STATUS_CVP_EN)) {
++ dev_err(&pdev->dev,
++ "CVP is disabled for this device: CVP_STATUS Reg 0x%x\n",
++ regval);
++ return -ENODEV;
++ }
++
+ conf = devm_kzalloc(&pdev->dev, sizeof(*conf), GFP_KERNEL);
+ if (!conf)
+ return -ENOMEM;
+@@ -471,7 +480,8 @@ static int altera_cvp_probe(struct pci_dev *pdev,
+ return 0;
+
+ err_unmap:
+- pci_iounmap(pdev, conf->map);
++ if (conf->map)
++ pci_iounmap(pdev, conf->map);
+ pci_release_region(pdev, CVP_BAR);
+ err_disable:
+ cmd &= ~PCI_COMMAND_MEMORY;
+@@ -486,7 +496,8 @@ static void altera_cvp_remove(struct pci_dev *pdev)
+ u16 cmd;
+
+ fpga_mgr_unregister(mgr);
+- pci_iounmap(pdev, conf->map);
++ if (conf->map)
++ pci_iounmap(pdev, conf->map);
+ pci_release_region(pdev, CVP_BAR);
+ pci_read_config_word(pdev, PCI_COMMAND, &cmd);
+ cmd &= ~PCI_COMMAND_MEMORY;
+diff --git a/drivers/gpio/gpio-mt7621.c b/drivers/gpio/gpio-mt7621.c
+index d72af6f6cdbd..00e954f22bc9 100644
+--- a/drivers/gpio/gpio-mt7621.c
++++ b/drivers/gpio/gpio-mt7621.c
+@@ -244,6 +244,8 @@ mediatek_gpio_bank_probe(struct device *dev,
+ rg->chip.of_xlate = mediatek_gpio_xlate;
+ rg->chip.label = devm_kasprintf(dev, GFP_KERNEL, "%s-bank%d",
+ dev_name(dev), bank);
++ if (!rg->chip.label)
++ return -ENOMEM;
+
+ ret = devm_gpiochip_add_data(dev, &rg->chip, mtk);
+ if (ret < 0) {
+@@ -295,6 +297,7 @@ mediatek_gpio_probe(struct platform_device *pdev)
+ struct device_node *np = dev->of_node;
+ struct mtk *mtk;
+ int i;
++ int ret;
+
+ mtk = devm_kzalloc(dev, sizeof(*mtk), GFP_KERNEL);
+ if (!mtk)
+@@ -309,8 +312,11 @@ mediatek_gpio_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, mtk);
+ mediatek_gpio_irq_chip.name = dev_name(dev);
+
+- for (i = 0; i < MTK_BANK_CNT; i++)
+- mediatek_gpio_bank_probe(dev, np, i);
++ for (i = 0; i < MTK_BANK_CNT; i++) {
++ ret = mediatek_gpio_bank_probe(dev, np, i);
++ if (ret)
++ return ret;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index b3ab6c428423..fd713326dcfc 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2279,6 +2279,12 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
+ unsigned long flags;
+ unsigned offset;
+
++ if (label) {
++ label = kstrdup_const(label, GFP_KERNEL);
++ if (!label)
++ return -ENOMEM;
++ }
++
+ spin_lock_irqsave(&gpio_lock, flags);
+
+ /* NOTE: gpio_request() can be called in early boot,
+@@ -2289,6 +2295,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
+ desc_set_label(desc, label ? : "?");
+ status = 0;
+ } else {
++ kfree_const(label);
+ status = -EBUSY;
+ goto done;
+ }
+@@ -2305,6 +2312,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
+
+ if (status < 0) {
+ desc_set_label(desc, NULL);
++ kfree_const(label);
+ clear_bit(FLAG_REQUESTED, &desc->flags);
+ goto done;
+ }
+@@ -2400,6 +2408,7 @@ static bool gpiod_free_commit(struct gpio_desc *desc)
+ chip->free(chip, gpio_chip_hwgpio(desc));
+ spin_lock_irqsave(&gpio_lock, flags);
+ }
++ kfree_const(desc->label);
+ desc_set_label(desc, NULL);
+ clear_bit(FLAG_ACTIVE_LOW, &desc->flags);
+ clear_bit(FLAG_REQUESTED, &desc->flags);
+@@ -3221,11 +3230,19 @@ EXPORT_SYMBOL_GPL(gpiod_cansleep);
+ * @desc: gpio to set the consumer name on
+ * @name: the new consumer name
+ */
+-void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)
++int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)
+ {
+- VALIDATE_DESC_VOID(desc);
+- /* Just overwrite whatever the previous name was */
+- desc->label = name;
++ VALIDATE_DESC(desc);
++ if (name) {
++ name = kstrdup_const(name, GFP_KERNEL);
++ if (!name)
++ return -ENOMEM;
++ }
++
++ kfree_const(desc->label);
++ desc_set_label(desc, name);
++
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(gpiod_set_consumer_name);
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 7c89785fd731..23a7ef97afdd 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -324,7 +324,7 @@ bool dc_link_is_dp_sink_present(struct dc_link *link)
+ {
+ enum gpio_result gpio_result;
+ uint32_t clock_pin = 0;
+-
++ uint8_t retry = 0;
+ struct ddc *ddc;
+
+ enum connector_id connector_id =
+@@ -353,11 +353,22 @@ bool dc_link_is_dp_sink_present(struct dc_link *link)
+ return present;
+ }
+
+- /* Read GPIO: DP sink is present if both clock and data pins are zero */
+- /* [anaumov] in DAL2, there was no check for GPIO failure */
+-
+- gpio_result = dal_gpio_get_value(ddc->pin_clock, &clock_pin);
+- ASSERT(gpio_result == GPIO_RESULT_OK);
++ /*
++ * Read GPIO: DP sink is present if both clock and data pins are zero
++ *
++ * [W/A] plug-unplug DP cable, sometimes customer board has
++ * one short pulse on clk_pin(1V, < 1ms). DP will be config to HDMI/DVI
++ * then monitor can't br light up. Add retry 3 times
++ * But in real passive dongle, it need additional 3ms to detect
++ */
++ do {
++ gpio_result = dal_gpio_get_value(ddc->pin_clock, &clock_pin);
++ ASSERT(gpio_result == GPIO_RESULT_OK);
++ if (clock_pin)
++ udelay(1000);
++ else
++ break;
++ } while (retry++ < 3);
+
+ present = (gpio_result == GPIO_RESULT_OK) && !clock_pin;
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index a7553b6d59c2..05840f5bddd5 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -2240,7 +2240,8 @@ static void get_active_converter_info(
+ translate_dpcd_max_bpc(
+ hdmi_color_caps.bits.MAX_BITS_PER_COLOR_COMPONENT);
+
+- link->dpcd_caps.dongle_caps.extendedCapValid = true;
++ if (link->dpcd_caps.dongle_caps.dp_hdmi_max_pixel_clk != 0)
++ link->dpcd_caps.dongle_caps.extendedCapValid = true;
+ }
+
+ break;
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index ea6beccfd89d..87bf422f16be 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -1917,6 +1917,8 @@ enum dc_status resource_map_pool_resources(
+ }
+ */
+
++ calculate_phy_pix_clks(stream);
++
+ /* acquire new resources */
+ pipe_idx = acquire_first_free_pipe(&context->res_ctx, pool, stream);
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index 0941f3c689bc..580e7e82034f 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -1268,10 +1268,19 @@ static void program_scaler(const struct dc *dc,
+ pipe_ctx->plane_res.scl_data.lb_params.depth,
+ &pipe_ctx->stream->bit_depth_params);
+
+- if (pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color)
++ if (pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color) {
++ /*
++ * The way 420 is packed, 2 channels carry Y component, 1 channel
++ * alternate between Cb and Cr, so both channels need the pixel
++ * value for Y
++ */
++ if (pipe_ctx->stream->timing.pixel_encoding == PIXEL_ENCODING_YCBCR420)
++ color.color_r_cr = color.color_g_y;
++
+ pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color(
+ pipe_ctx->stream_res.tg,
+ &color);
++ }
+
+ pipe_ctx->plane_res.xfm->funcs->transform_set_scaler(pipe_ctx->plane_res.xfm,
+ &pipe_ctx->plane_res.scl_data);
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+index cfcc54f2ce65..4058b59d9bea 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+@@ -1190,7 +1190,8 @@ static bool dcn10_set_input_transfer_func(struct pipe_ctx *pipe_ctx,
+ tf = plane_state->in_transfer_func;
+
+ if (plane_state->gamma_correction &&
+- !plane_state->gamma_correction->is_identity
++ !dpp_base->ctx->dc->debug.always_use_regamma
++ && !plane_state->gamma_correction->is_identity
+ && dce_use_lut(plane_state->format))
+ dpp_base->funcs->dpp_program_input_lut(dpp_base, plane_state->gamma_correction);
+
+@@ -2120,6 +2121,15 @@ static void dcn10_blank_pixel_data(
+ color_space = stream->output_color_space;
+ color_space_to_black_color(dc, color_space, &black_color);
+
++ /*
++ * The way 420 is packed, 2 channels carry Y component, 1 channel
++ * alternate between Cb and Cr, so both channels need the pixel
++ * value for Y
++ */
++ if (stream->timing.pixel_encoding == PIXEL_ENCODING_YCBCR420)
++ black_color.color_r_cr = black_color.color_g_y;
++
++
+ if (stream_res->tg->funcs->set_blank_color)
+ stream_res->tg->funcs->set_blank_color(
+ stream_res->tg,
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
+index 5b67f575cd34..45629f26dbc2 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
+@@ -1528,8 +1528,21 @@ static int polaris10_populate_clock_stretcher_data_table(struct pp_hwmgr *hwmgr)
+ efuse = efuse >> 24;
+
+ if (hwmgr->chip_id == CHIP_POLARIS10) {
+- min = 1000;
+- max = 2300;
++ if (hwmgr->is_kicker) {
++ min = 1200;
++ max = 2500;
++ } else {
++ min = 1000;
++ max = 2300;
++ }
++ } else if (hwmgr->chip_id == CHIP_POLARIS11) {
++ if (hwmgr->is_kicker) {
++ min = 900;
++ max = 2100;
++ } else {
++ min = 1100;
++ max = 2100;
++ }
+ } else {
+ min = 1100;
+ max = 2100;
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index f77bff5aa307..23397c08be11 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -3192,7 +3192,7 @@ EXPORT_SYMBOL(drm_atomic_helper_suspend);
+ int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state,
+ struct drm_modeset_acquire_ctx *ctx)
+ {
+- int i;
++ int i, ret;
+ struct drm_plane *plane;
+ struct drm_plane_state *new_plane_state;
+ struct drm_connector *connector;
+@@ -3211,7 +3211,11 @@ int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state,
+ for_each_new_connector_in_state(state, connector, new_conn_state, i)
+ state->connectors[i].old_state = connector->state;
+
+- return drm_atomic_commit(state);
++ ret = drm_atomic_commit(state);
++
++ state->acquire_ctx = NULL;
++
++ return ret;
+ }
+ EXPORT_SYMBOL(drm_atomic_helper_commit_duplicated_state);
+
+diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
+index ba8cfe65c65b..e2f775d1c112 100644
+--- a/drivers/gpu/drm/drm_bufs.c
++++ b/drivers/gpu/drm/drm_bufs.c
+@@ -36,6 +36,8 @@
+ #include <drm/drmP.h>
+ #include "drm_legacy.h"
+
++#include <linux/nospec.h>
++
+ static struct drm_map_list *drm_find_matching_map(struct drm_device *dev,
+ struct drm_local_map *map)
+ {
+@@ -1417,6 +1419,7 @@ int drm_legacy_freebufs(struct drm_device *dev, void *data,
+ idx, dma->buf_count - 1);
+ return -EINVAL;
+ }
++ idx = array_index_nospec(idx, dma->buf_count);
+ buf = dma->buflist[idx];
+ if (buf->file_priv != file_priv) {
+ DRM_ERROR("Process %d freeing buffer not owned\n",
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+index 14fc7c2a6bb7..c9962a36b86b 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+@@ -331,7 +331,7 @@ static void dpu_encoder_phys_vid_vblank_irq(void *arg, int irq_idx)
+ if (hw_ctl && hw_ctl->ops.get_flush_register)
+ flush_register = hw_ctl->ops.get_flush_register(hw_ctl);
+
+- if (flush_register == 0)
++ if (!(flush_register & hw_ctl->ops.get_pending_flush(hw_ctl)))
+ new_cnt = atomic_add_unless(&phys_enc->pending_kickoff_cnt,
+ -1, 0);
+ spin_unlock_irqrestore(phys_enc->enc_spinlock, lock_flags);
+diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+index 41bec570c518..31205625c734 100644
+--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+@@ -17,7 +17,7 @@
+ * | |
+ * | |
+ * +---------+ | +----------+ | +----+
+- * dsi0vco_clk ---| out_div |--o--| divl_3_0 |--o--| /8 |-- dsi0pllbyte
++ * dsi0vco_clk ---| out_div |--o--| divl_3_0 |--o--| /8 |-- dsi0_phy_pll_out_byteclk
+ * +---------+ | +----------+ | +----+
+ * | |
+ * | | dsi0_pll_by_2_bit_clk
+@@ -25,7 +25,7 @@
+ * | | +----+ | |\ dsi0_pclk_mux
+ * | |--| /2 |--o--| \ |
+ * | | +----+ | \ | +---------+
+- * | --------------| |--o--| div_7_4 |-- dsi0pll
++ * | --------------| |--o--| div_7_4 |-- dsi0_phy_pll_out_dsiclk
+ * |------------------------------| / +---------+
+ * | +-----+ | /
+ * -----------| /4? |--o----------|/
+@@ -690,7 +690,7 @@ static int pll_10nm_register(struct dsi_pll_10nm *pll_10nm)
+
+ hws[num++] = hw;
+
+- snprintf(clk_name, 32, "dsi%dpllbyte", pll_10nm->id);
++ snprintf(clk_name, 32, "dsi%d_phy_pll_out_byteclk", pll_10nm->id);
+ snprintf(parent, 32, "dsi%d_pll_bit_clk", pll_10nm->id);
+
+ /* DSI Byte clock = VCO_CLK / OUT_DIV / BIT_DIV / 8 */
+@@ -739,7 +739,7 @@ static int pll_10nm_register(struct dsi_pll_10nm *pll_10nm)
+
+ hws[num++] = hw;
+
+- snprintf(clk_name, 32, "dsi%dpll", pll_10nm->id);
++ snprintf(clk_name, 32, "dsi%d_phy_pll_out_dsiclk", pll_10nm->id);
+ snprintf(parent, 32, "dsi%d_pclk_mux", pll_10nm->id);
+
+ /* PIX CLK DIV : DIV_CTRL_7_4*/
+diff --git a/drivers/gpu/drm/rockchip/cdn-dp-reg.c b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
+index 3105965fc260..5a485489a1e2 100644
+--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c
++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
+@@ -147,7 +147,7 @@ static int cdn_dp_mailbox_validate_receive(struct cdn_dp_device *dp,
+ }
+
+ static int cdn_dp_mailbox_read_receive(struct cdn_dp_device *dp,
+- u8 *buff, u8 buff_size)
++ u8 *buff, u16 buff_size)
+ {
+ u32 i;
+ int ret;
+diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+index d5240b777a8f..adcdf946c365 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
++++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+@@ -168,6 +168,13 @@ static int sun8i_tcon_top_bind(struct device *dev, struct device *master,
+ goto err_assert_reset;
+ }
+
++ /*
++ * At least on H6, some registers have some bits set by default
++ * which may cause issues. Clear them here.
++ */
++ writel(0, regs + TCON_TOP_PORT_SEL_REG);
++ writel(0, regs + TCON_TOP_GATE_SRC_REG);
++
+ /*
+ * TCON TOP has two muxes, which select parent clock for each TCON TV
+ * channel clock. Parent could be either TCON TV or TVE clock. For now
+diff --git a/drivers/gpu/drm/v3d/v3d_bo.c b/drivers/gpu/drm/v3d/v3d_bo.c
+index 54d96518a131..a08766d39eab 100644
+--- a/drivers/gpu/drm/v3d/v3d_bo.c
++++ b/drivers/gpu/drm/v3d/v3d_bo.c
+@@ -293,6 +293,7 @@ v3d_prime_import_sg_table(struct drm_device *dev,
+ bo->resv = attach->dmabuf->resv;
+
+ bo->sgt = sgt;
++ obj->import_attach = attach;
+ v3d_bo_get_pages(bo);
+
+ v3d_mmu_insert_ptes(bo);
+diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
+index 629f40424bba..ab39315c9078 100644
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -315,12 +315,14 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
+ vc4_get_scaling_mode(vc4_state->src_h[1],
+ vc4_state->crtc_h);
+
+- /* YUV conversion requires that horizontal scaling be enabled,
+- * even on a plane that's otherwise 1:1. Looks like only PPF
+- * works in that case, so let's pick that one.
++ /* YUV conversion requires that horizontal scaling be enabled
++ * on the UV plane even if vc4_get_scaling_mode() returned
++ * VC4_SCALING_NONE (which can happen when the down-scaling
++ * ratio is 0.5). Let's force it to VC4_SCALING_PPF in this
++ * case.
+ */
+- if (vc4_state->is_unity)
+- vc4_state->x_scaling[0] = VC4_SCALING_PPF;
++ if (vc4_state->x_scaling[1] == VC4_SCALING_NONE)
++ vc4_state->x_scaling[1] = VC4_SCALING_PPF;
+ } else {
+ vc4_state->is_yuv = false;
+ vc4_state->x_scaling[1] = VC4_SCALING_NONE;
+diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
+index 0e5620f76ee0..6887db878b38 100644
+--- a/drivers/gpu/drm/vgem/vgem_drv.c
++++ b/drivers/gpu/drm/vgem/vgem_drv.c
+@@ -471,31 +471,31 @@ static int __init vgem_init(void)
+ if (!vgem_device)
+ return -ENOMEM;
+
+- ret = drm_dev_init(&vgem_device->drm, &vgem_driver, NULL);
+- if (ret)
+- goto out_free;
+-
+ vgem_device->platform =
+ platform_device_register_simple("vgem", -1, NULL, 0);
+ if (IS_ERR(vgem_device->platform)) {
+ ret = PTR_ERR(vgem_device->platform);
+- goto out_fini;
++ goto out_free;
+ }
+
+ dma_coerce_mask_and_coherent(&vgem_device->platform->dev,
+ DMA_BIT_MASK(64));
++ ret = drm_dev_init(&vgem_device->drm, &vgem_driver,
++ &vgem_device->platform->dev);
++ if (ret)
++ goto out_unregister;
+
+ /* Final step: expose the device/driver to userspace */
+ ret = drm_dev_register(&vgem_device->drm, 0);
+ if (ret)
+- goto out_unregister;
++ goto out_fini;
+
+ return 0;
+
+-out_unregister:
+- platform_device_unregister(vgem_device->platform);
+ out_fini:
+ drm_dev_fini(&vgem_device->drm);
++out_unregister:
++ platform_device_unregister(vgem_device->platform);
+ out_free:
+ kfree(vgem_device);
+ return ret;
+diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c
+index f4081962784c..91653adc41cc 100644
+--- a/drivers/gpu/ipu-v3/ipu-image-convert.c
++++ b/drivers/gpu/ipu-v3/ipu-image-convert.c
+@@ -1524,7 +1524,7 @@ unlock:
+ EXPORT_SYMBOL_GPL(ipu_image_convert_queue);
+
+ /* Abort any active or pending conversions for this context */
+-void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
++static void __ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
+ {
+ struct ipu_image_convert_chan *chan = ctx->chan;
+ struct ipu_image_convert_priv *priv = chan->priv;
+@@ -1551,7 +1551,7 @@ void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
+
+ need_abort = (run_count || active_run);
+
+- ctx->aborting = need_abort;
++ ctx->aborting = true;
+
+ spin_unlock_irqrestore(&chan->irqlock, flags);
+
+@@ -1572,7 +1572,11 @@ void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
+ dev_warn(priv->ipu->dev, "%s: timeout\n", __func__);
+ force_abort(ctx);
+ }
++}
+
++void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
++{
++ __ipu_image_convert_abort(ctx);
+ ctx->aborting = false;
+ }
+ EXPORT_SYMBOL_GPL(ipu_image_convert_abort);
+@@ -1586,7 +1590,7 @@ void ipu_image_convert_unprepare(struct ipu_image_convert_ctx *ctx)
+ bool put_res;
+
+ /* make sure no runs are hanging around */
+- ipu_image_convert_abort(ctx);
++ __ipu_image_convert_abort(ctx);
+
+ dev_dbg(priv->ipu->dev, "%s: task %u: removing ctx %p\n", __func__,
+ chan->ic_task, ctx);
+diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
+index b48100236df8..ebc9ffde41e9 100644
+--- a/drivers/hid/hid-debug.c
++++ b/drivers/hid/hid-debug.c
+@@ -30,6 +30,7 @@
+
+ #include <linux/debugfs.h>
+ #include <linux/seq_file.h>
++#include <linux/kfifo.h>
+ #include <linux/sched/signal.h>
+ #include <linux/export.h>
+ #include <linux/slab.h>
+@@ -661,17 +662,12 @@ EXPORT_SYMBOL_GPL(hid_dump_device);
+ /* enqueue string to 'events' ring buffer */
+ void hid_debug_event(struct hid_device *hdev, char *buf)
+ {
+- unsigned i;
+ struct hid_debug_list *list;
+ unsigned long flags;
+
+ spin_lock_irqsave(&hdev->debug_list_lock, flags);
+- list_for_each_entry(list, &hdev->debug_list, node) {
+- for (i = 0; buf[i]; i++)
+- list->hid_debug_buf[(list->tail + i) % HID_DEBUG_BUFSIZE] =
+- buf[i];
+- list->tail = (list->tail + i) % HID_DEBUG_BUFSIZE;
+- }
++ list_for_each_entry(list, &hdev->debug_list, node)
++ kfifo_in(&list->hid_debug_fifo, buf, strlen(buf));
+ spin_unlock_irqrestore(&hdev->debug_list_lock, flags);
+
+ wake_up_interruptible(&hdev->debug_wait);
+@@ -722,8 +718,7 @@ void hid_dump_input(struct hid_device *hdev, struct hid_usage *usage, __s32 valu
+ hid_debug_event(hdev, buf);
+
+ kfree(buf);
+- wake_up_interruptible(&hdev->debug_wait);
+-
++ wake_up_interruptible(&hdev->debug_wait);
+ }
+ EXPORT_SYMBOL_GPL(hid_dump_input);
+
+@@ -1088,8 +1083,8 @@ static int hid_debug_events_open(struct inode *inode, struct file *file)
+ goto out;
+ }
+
+- if (!(list->hid_debug_buf = kzalloc(HID_DEBUG_BUFSIZE, GFP_KERNEL))) {
+- err = -ENOMEM;
++ err = kfifo_alloc(&list->hid_debug_fifo, HID_DEBUG_FIFOSIZE, GFP_KERNEL);
++ if (err) {
+ kfree(list);
+ goto out;
+ }
+@@ -1109,77 +1104,57 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer,
+ size_t count, loff_t *ppos)
+ {
+ struct hid_debug_list *list = file->private_data;
+- int ret = 0, len;
++ int ret = 0, copied;
+ DECLARE_WAITQUEUE(wait, current);
+
+ mutex_lock(&list->read_mutex);
+- while (ret == 0) {
+- if (list->head == list->tail) {
+- add_wait_queue(&list->hdev->debug_wait, &wait);
+- set_current_state(TASK_INTERRUPTIBLE);
+-
+- while (list->head == list->tail) {
+- if (file->f_flags & O_NONBLOCK) {
+- ret = -EAGAIN;
+- break;
+- }
+- if (signal_pending(current)) {
+- ret = -ERESTARTSYS;
+- break;
+- }
++ if (kfifo_is_empty(&list->hid_debug_fifo)) {
++ add_wait_queue(&list->hdev->debug_wait, &wait);
++ set_current_state(TASK_INTERRUPTIBLE);
++
++ while (kfifo_is_empty(&list->hid_debug_fifo)) {
++ if (file->f_flags & O_NONBLOCK) {
++ ret = -EAGAIN;
++ break;
++ }
+
+- if (!list->hdev || !list->hdev->debug) {
+- ret = -EIO;
+- set_current_state(TASK_RUNNING);
+- goto out;
+- }
++ if (signal_pending(current)) {
++ ret = -ERESTARTSYS;
++ break;
++ }
+
+- /* allow O_NONBLOCK from other threads */
+- mutex_unlock(&list->read_mutex);
+- schedule();
+- mutex_lock(&list->read_mutex);
+- set_current_state(TASK_INTERRUPTIBLE);
++ /* if list->hdev is NULL we cannot remove_wait_queue().
++ * if list->hdev->debug is 0 then hid_debug_unregister()
++ * was already called and list->hdev is being destroyed.
++ * if we add remove_wait_queue() here we can hit a race.
++ */
++ if (!list->hdev || !list->hdev->debug) {
++ ret = -EIO;
++ set_current_state(TASK_RUNNING);
++ goto out;
+ }
+
+- set_current_state(TASK_RUNNING);
+- remove_wait_queue(&list->hdev->debug_wait, &wait);
++ /* allow O_NONBLOCK from other threads */
++ mutex_unlock(&list->read_mutex);
++ schedule();
++ mutex_lock(&list->read_mutex);
++ set_current_state(TASK_INTERRUPTIBLE);
+ }
+
+- if (ret)
+- goto out;
++ __set_current_state(TASK_RUNNING);
++ remove_wait_queue(&list->hdev->debug_wait, &wait);
+
+- /* pass the ringbuffer contents to userspace */
+-copy_rest:
+- if (list->tail == list->head)
++ if (ret)
+ goto out;
+- if (list->tail > list->head) {
+- len = list->tail - list->head;
+- if (len > count)
+- len = count;
+-
+- if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) {
+- ret = -EFAULT;
+- goto out;
+- }
+- ret += len;
+- list->head += len;
+- } else {
+- len = HID_DEBUG_BUFSIZE - list->head;
+- if (len > count)
+- len = count;
+-
+- if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) {
+- ret = -EFAULT;
+- goto out;
+- }
+- list->head = 0;
+- ret += len;
+- count -= len;
+- if (count > 0)
+- goto copy_rest;
+- }
+-
+ }
++
++ /* pass the fifo content to userspace, locking is not needed with only
++ * one concurrent reader and one concurrent writer
++ */
++ ret = kfifo_to_user(&list->hid_debug_fifo, buffer, count, &copied);
++ if (ret)
++ goto out;
++ ret = copied;
+ out:
+ mutex_unlock(&list->read_mutex);
+ return ret;
+@@ -1190,7 +1165,7 @@ static __poll_t hid_debug_events_poll(struct file *file, poll_table *wait)
+ struct hid_debug_list *list = file->private_data;
+
+ poll_wait(file, &list->hdev->debug_wait, wait);
+- if (list->head != list->tail)
++ if (!kfifo_is_empty(&list->hid_debug_fifo))
+ return EPOLLIN | EPOLLRDNORM;
+ if (!list->hdev->debug)
+ return EPOLLERR | EPOLLHUP;
+@@ -1205,7 +1180,7 @@ static int hid_debug_events_release(struct inode *inode, struct file *file)
+ spin_lock_irqsave(&list->hdev->debug_list_lock, flags);
+ list_del(&list->node);
+ spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags);
+- kfree(list->hid_debug_buf);
++ kfifo_free(&list->hid_debug_fifo);
+ kfree(list);
+
+ return 0;
+@@ -1256,4 +1231,3 @@ void hid_debug_exit(void)
+ {
+ debugfs_remove_recursive(hid_debug_root);
+ }
+-
+diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
+index 643b6eb54442..eacc76d2ab96 100644
+--- a/drivers/hid/hid-lenovo.c
++++ b/drivers/hid/hid-lenovo.c
+@@ -743,7 +743,9 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev)
+ data_pointer->led_mute.brightness_get = lenovo_led_brightness_get_tpkbd;
+ data_pointer->led_mute.brightness_set = lenovo_led_brightness_set_tpkbd;
+ data_pointer->led_mute.dev = dev;
+- led_classdev_register(dev, &data_pointer->led_mute);
++ ret = led_classdev_register(dev, &data_pointer->led_mute);
++ if (ret < 0)
++ goto err;
+
+ data_pointer->led_micmute.name = name_micmute;
+ data_pointer->led_micmute.brightness_get =
+@@ -751,7 +753,11 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev)
+ data_pointer->led_micmute.brightness_set =
+ lenovo_led_brightness_set_tpkbd;
+ data_pointer->led_micmute.dev = dev;
+- led_classdev_register(dev, &data_pointer->led_micmute);
++ ret = led_classdev_register(dev, &data_pointer->led_micmute);
++ if (ret < 0) {
++ led_classdev_unregister(&data_pointer->led_mute);
++ goto err;
++ }
+
+ lenovo_features_set_tpkbd(hdev);
+
+diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
+index 08e3945a6fbf..0e30fa00204c 100644
+--- a/drivers/hwmon/lm80.c
++++ b/drivers/hwmon/lm80.c
+@@ -360,9 +360,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
+ struct i2c_client *client = data->client;
+ unsigned long min, val;
+ u8 reg;
+- int err = kstrtoul(buf, 10, &val);
+- if (err < 0)
+- return err;
++ int rv;
++
++ rv = kstrtoul(buf, 10, &val);
++ if (rv < 0)
++ return rv;
+
+ /* Save fan_min */
+ mutex_lock(&data->update_lock);
+@@ -390,8 +392,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
+ return -EINVAL;
+ }
+
+- reg = (lm80_read_value(client, LM80_REG_FANDIV) &
+- ~(3 << (2 * (nr + 1)))) | (data->fan_div[nr] << (2 * (nr + 1)));
++ rv = lm80_read_value(client, LM80_REG_FANDIV);
++ if (rv < 0)
++ return rv;
++ reg = (rv & ~(3 << (2 * (nr + 1))))
++ | (data->fan_div[nr] << (2 * (nr + 1)));
+ lm80_write_value(client, LM80_REG_FANDIV, reg);
+
+ /* Restore fan_min */
+@@ -623,6 +628,7 @@ static int lm80_probe(struct i2c_client *client,
+ struct device *dev = &client->dev;
+ struct device *hwmon_dev;
+ struct lm80_data *data;
++ int rv;
+
+ data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL);
+ if (!data)
+@@ -635,8 +641,14 @@ static int lm80_probe(struct i2c_client *client,
+ lm80_init_client(client);
+
+ /* A few vars need to be filled upon startup */
+- data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1));
+- data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2));
++ rv = lm80_read_value(client, LM80_REG_FAN_MIN(1));
++ if (rv < 0)
++ return rv;
++ data->fan[f_min][0] = rv;
++ rv = lm80_read_value(client, LM80_REG_FAN_MIN(2));
++ if (rv < 0)
++ return rv;
++ data->fan[f_min][1] = rv;
+
+ hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
+ data, lm80_groups);
+diff --git a/drivers/i2c/busses/i2c-axxia.c b/drivers/i2c/busses/i2c-axxia.c
+index 51d34959709b..fb5bac079e83 100644
+--- a/drivers/i2c/busses/i2c-axxia.c
++++ b/drivers/i2c/busses/i2c-axxia.c
+@@ -296,22 +296,7 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev)
+ i2c_int_disable(idev, MST_STATUS_TFL);
+ }
+
+- if (status & MST_STATUS_SCC) {
+- /* Stop completed */
+- i2c_int_disable(idev, ~MST_STATUS_TSS);
+- complete(&idev->msg_complete);
+- } else if (status & MST_STATUS_SNS) {
+- /* Transfer done */
+- i2c_int_disable(idev, ~MST_STATUS_TSS);
+- if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len)
+- axxia_i2c_empty_rx_fifo(idev);
+- complete(&idev->msg_complete);
+- } else if (status & MST_STATUS_TSS) {
+- /* Transfer timeout */
+- idev->msg_err = -ETIMEDOUT;
+- i2c_int_disable(idev, ~MST_STATUS_TSS);
+- complete(&idev->msg_complete);
+- } else if (unlikely(status & MST_STATUS_ERR)) {
++ if (unlikely(status & MST_STATUS_ERR)) {
+ /* Transfer error */
+ i2c_int_disable(idev, ~0);
+ if (status & MST_STATUS_AL)
+@@ -328,6 +313,21 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev)
+ readl(idev->base + MST_TX_BYTES_XFRD),
+ readl(idev->base + MST_TX_XFER));
+ complete(&idev->msg_complete);
++ } else if (status & MST_STATUS_SCC) {
++ /* Stop completed */
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
++ complete(&idev->msg_complete);
++ } else if (status & MST_STATUS_SNS) {
++ /* Transfer done */
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
++ if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len)
++ axxia_i2c_empty_rx_fifo(idev);
++ complete(&idev->msg_complete);
++ } else if (status & MST_STATUS_TSS) {
++ /* Transfer timeout */
++ idev->msg_err = -ETIMEDOUT;
++ i2c_int_disable(idev, ~MST_STATUS_TSS);
++ complete(&idev->msg_complete);
+ }
+
+ out:
+diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
+index 818cab14e87c..ddcfb6d349d1 100644
+--- a/drivers/i2c/busses/i2c-sh_mobile.c
++++ b/drivers/i2c/busses/i2c-sh_mobile.c
+@@ -800,6 +800,7 @@ static const struct sh_mobile_dt_config r8a7740_dt_config = {
+ static const struct of_device_id sh_mobile_i2c_dt_ids[] = {
+ { .compatible = "renesas,iic-r8a73a4", .data = &fast_clock_dt_config },
+ { .compatible = "renesas,iic-r8a7740", .data = &r8a7740_dt_config },
++ { .compatible = "renesas,iic-r8a774c0", .data = &fast_clock_dt_config },
+ { .compatible = "renesas,iic-r8a7790", .data = &v2_freq_calc_dt_config },
+ { .compatible = "renesas,iic-r8a7791", .data = &fast_clock_dt_config },
+ { .compatible = "renesas,iic-r8a7792", .data = &fast_clock_dt_config },
+@@ -808,6 +809,7 @@ static const struct of_device_id sh_mobile_i2c_dt_ids[] = {
+ { .compatible = "renesas,rcar-gen2-iic", .data = &fast_clock_dt_config },
+ { .compatible = "renesas,iic-r8a7795", .data = &fast_clock_dt_config },
+ { .compatible = "renesas,rcar-gen3-iic", .data = &fast_clock_dt_config },
++ { .compatible = "renesas,iic-r8a77990", .data = &fast_clock_dt_config },
+ { .compatible = "renesas,iic-sh73a0", .data = &fast_clock_dt_config },
+ { .compatible = "renesas,rmobile-iic", .data = &default_dt_config },
+ {},
+diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
+index af53a1084ee5..471caa5323e4 100644
+--- a/drivers/iio/accel/kxcjk-1013.c
++++ b/drivers/iio/accel/kxcjk-1013.c
+@@ -1490,6 +1490,7 @@ static const struct acpi_device_id kx_acpi_match[] = {
+ {"KXCJ1008", KXCJ91008},
+ {"KXCJ9000", KXCJ91008},
+ {"KIOX000A", KXCJ91008},
++ {"KIOX010A", KXCJ91008}, /* KXCJ91008 inside the display of a 2-in-1 */
+ {"KXTJ1009", KXTJ21009},
+ {"SMO8500", KXCJ91008},
+ { },
+diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
+index da2d16dfa63e..5dd104cf0939 100644
+--- a/drivers/iio/adc/meson_saradc.c
++++ b/drivers/iio/adc/meson_saradc.c
+@@ -587,8 +587,11 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev,
+ struct clk_init_data init;
+ const char *clk_parents[1];
+
+- init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_div",
+- indio_dev->dev.of_node);
++ init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%s#adc_div",
++ dev_name(indio_dev->dev.parent));
++ if (!init.name)
++ return -ENOMEM;
++
+ init.flags = 0;
+ init.ops = &clk_divider_ops;
+ clk_parents[0] = __clk_get_name(priv->clkin);
+@@ -606,8 +609,11 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev,
+ if (WARN_ON(IS_ERR(priv->adc_div_clk)))
+ return PTR_ERR(priv->adc_div_clk);
+
+- init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_en",
+- indio_dev->dev.of_node);
++ init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%s#adc_en",
++ dev_name(indio_dev->dev.parent));
++ if (!init.name)
++ return -ENOMEM;
++
+ init.flags = CLK_SET_RATE_PARENT;
+ init.ops = &clk_gate_ops;
+ clk_parents[0] = __clk_get_name(priv->adc_div_clk);
+diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
+index 9bd63abb2dfe..6f013a565353 100644
+--- a/drivers/infiniband/hw/hfi1/rc.c
++++ b/drivers/infiniband/hw/hfi1/rc.c
+@@ -1157,6 +1157,7 @@ void hfi1_rc_send_complete(struct rvt_qp *qp, struct hfi1_opa_header *opah)
+ if (cmp_psn(wqe->lpsn, qp->s_sending_psn) >= 0 &&
+ cmp_psn(qp->s_sending_psn, qp->s_sending_hpsn) <= 0)
+ break;
++ rvt_qp_wqe_unreserve(qp, wqe);
+ s_last = qp->s_last;
+ trace_hfi1_qp_send_completion(qp, wqe, s_last);
+ if (++s_last >= qp->s_size)
+@@ -1209,6 +1210,7 @@ static struct rvt_swqe *do_rc_completion(struct rvt_qp *qp,
+ u32 s_last;
+
+ rvt_put_swqe(wqe);
++ rvt_qp_wqe_unreserve(qp, wqe);
+ s_last = qp->s_last;
+ trace_hfi1_qp_send_completion(qp, wqe, s_last);
+ if (++s_last >= qp->s_size)
+diff --git a/drivers/infiniband/hw/hfi1/ruc.c b/drivers/infiniband/hw/hfi1/ruc.c
+index 5f56f3c1b4c4..62a3832a1ebb 100644
+--- a/drivers/infiniband/hw/hfi1/ruc.c
++++ b/drivers/infiniband/hw/hfi1/ruc.c
+@@ -278,6 +278,8 @@ send:
+ goto op_err;
+ if (!ret)
+ goto rnr_nak;
++ if (wqe->length > qp->r_len)
++ goto inv_err;
+ break;
+
+ case IB_WR_RDMA_WRITE_WITH_IMM:
+@@ -445,7 +447,10 @@ op_err:
+ goto err;
+
+ inv_err:
+- send_status = IB_WC_REM_INV_REQ_ERR;
++ send_status =
++ sqp->ibqp.qp_type == IB_QPT_RC ?
++ IB_WC_REM_INV_REQ_ERR :
++ IB_WC_SUCCESS;
+ wc.status = IB_WC_LOC_QP_OP_ERR;
+ goto err;
+
+diff --git a/drivers/infiniband/hw/qib/qib_ruc.c b/drivers/infiniband/hw/qib/qib_ruc.c
+index f8a7de795beb..563f71e6d1d3 100644
+--- a/drivers/infiniband/hw/qib/qib_ruc.c
++++ b/drivers/infiniband/hw/qib/qib_ruc.c
+@@ -274,6 +274,8 @@ again:
+ goto op_err;
+ if (!ret)
+ goto rnr_nak;
++ if (wqe->length > qp->r_len)
++ goto inv_err;
+ break;
+
+ case IB_WR_RDMA_WRITE_WITH_IMM:
+@@ -434,7 +436,10 @@ op_err:
+ goto err;
+
+ inv_err:
+- send_status = IB_WC_REM_INV_REQ_ERR;
++ send_status =
++ sqp->ibqp.qp_type == IB_QPT_RC ?
++ IB_WC_REM_INV_REQ_ERR :
++ IB_WC_SUCCESS;
+ wc.status = IB_WC_LOC_QP_OP_ERR;
+ goto err;
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index bee0dfb7b93b..34c9aa76a7bd 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -438,7 +438,14 @@ static int iommu_init_device(struct device *dev)
+
+ dev_data->alias = get_alias(dev);
+
+- if (dev_is_pci(dev) && pci_iommuv2_capable(to_pci_dev(dev))) {
++ /*
++ * By default we use passthrough mode for IOMMUv2 capable device.
++ * But if amd_iommu=force_isolation is set (e.g. to debug DMA to
++ * invalid address), we ignore the capability for the device so
++ * it'll be forced to go into translation mode.
++ */
++ if ((iommu_pass_through || !amd_iommu_force_isolation) &&
++ dev_is_pci(dev) && pci_iommuv2_capable(to_pci_dev(dev))) {
+ struct amd_iommu *iommu;
+
+ iommu = amd_iommu_rlookup_table[dev_data->devid];
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index 3e02aace38b1..9ae3678844eb 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -586,7 +586,11 @@ struct arm_smmu_device {
+
+ struct arm_smmu_strtab_cfg strtab_cfg;
+
+- u32 sync_count;
++ /* Hi16xx adds an extra 32 bits of goodness to its MSI payload */
++ union {
++ u32 sync_count;
++ u64 padding;
++ };
+
+ /* IOMMU core code handle */
+ struct iommu_device iommu;
+@@ -684,7 +688,13 @@ static void queue_inc_cons(struct arm_smmu_queue *q)
+ u32 cons = (Q_WRP(q, q->cons) | Q_IDX(q, q->cons)) + 1;
+
+ q->cons = Q_OVF(q, q->cons) | Q_WRP(q, cons) | Q_IDX(q, cons);
+- writel(q->cons, q->cons_reg);
++
++ /*
++ * Ensure that all CPU accesses (reads and writes) to the queue
++ * are complete before we update the cons pointer.
++ */
++ mb();
++ writel_relaxed(q->cons, q->cons_reg);
+ }
+
+ static int queue_sync_prod(struct arm_smmu_queue *q)
+diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
+index e7cbf4fcf61d..ce119cb279c3 100644
+--- a/drivers/iommu/arm-smmu.c
++++ b/drivers/iommu/arm-smmu.c
+@@ -118,6 +118,7 @@ enum arm_smmu_implementation {
+ GENERIC_SMMU,
+ ARM_MMU500,
+ CAVIUM_SMMUV2,
++ QCOM_SMMUV2,
+ };
+
+ struct arm_smmu_s2cr {
+@@ -1912,6 +1913,7 @@ ARM_SMMU_MATCH_DATA(smmu_generic_v2, ARM_SMMU_V2, GENERIC_SMMU);
+ ARM_SMMU_MATCH_DATA(arm_mmu401, ARM_SMMU_V1_64K, GENERIC_SMMU);
+ ARM_SMMU_MATCH_DATA(arm_mmu500, ARM_SMMU_V2, ARM_MMU500);
+ ARM_SMMU_MATCH_DATA(cavium_smmuv2, ARM_SMMU_V2, CAVIUM_SMMUV2);
++ARM_SMMU_MATCH_DATA(qcom_smmuv2, ARM_SMMU_V2, QCOM_SMMUV2);
+
+ static const struct of_device_id arm_smmu_of_match[] = {
+ { .compatible = "arm,smmu-v1", .data = &smmu_generic_v1 },
+@@ -1920,6 +1922,7 @@ static const struct of_device_id arm_smmu_of_match[] = {
+ { .compatible = "arm,mmu-401", .data = &arm_mmu401 },
+ { .compatible = "arm,mmu-500", .data = &arm_mmu500 },
+ { .compatible = "cavium,smmu-v2", .data = &cavium_smmuv2 },
++ { .compatible = "qcom,smmu-v2", .data = &qcom_smmuv2 },
+ { },
+ };
+ MODULE_DEVICE_TABLE(of, arm_smmu_of_match);
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index cf3abb8d284f..4c2246fe5dbe 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -93,9 +93,14 @@ struct its_device;
+ * The ITS structure - contains most of the infrastructure, with the
+ * top-level MSI domain, the command queue, the collections, and the
+ * list of devices writing to it.
++ *
++ * dev_alloc_lock has to be taken for device allocations, while the
++ * spinlock must be taken to parse data structures such as the device
++ * list.
+ */
+ struct its_node {
+ raw_spinlock_t lock;
++ struct mutex dev_alloc_lock;
+ struct list_head entry;
+ void __iomem *base;
+ phys_addr_t phys_base;
+@@ -152,6 +157,7 @@ struct its_device {
+ void *itt;
+ u32 nr_ites;
+ u32 device_id;
++ bool shared;
+ };
+
+ static struct {
+@@ -2290,6 +2296,7 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
+ struct its_device *its_dev;
+ struct msi_domain_info *msi_info;
+ u32 dev_id;
++ int err = 0;
+
+ /*
+ * We ignore "dev" entierely, and rely on the dev_id that has
+@@ -2312,6 +2319,7 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
+ return -EINVAL;
+ }
+
++ mutex_lock(&its->dev_alloc_lock);
+ its_dev = its_find_device(its, dev_id);
+ if (its_dev) {
+ /*
+@@ -2319,18 +2327,22 @@ static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
+ * another alias (PCI bridge of some sort). No need to
+ * create the device.
+ */
++ its_dev->shared = true;
+ pr_debug("Reusing ITT for devID %x\n", dev_id);
+ goto out;
+ }
+
+ its_dev = its_create_device(its, dev_id, nvec, true);
+- if (!its_dev)
+- return -ENOMEM;
++ if (!its_dev) {
++ err = -ENOMEM;
++ goto out;
++ }
+
+ pr_debug("ITT %d entries, %d bits\n", nvec, ilog2(nvec));
+ out:
++ mutex_unlock(&its->dev_alloc_lock);
+ info->scratchpad[0].ptr = its_dev;
+- return 0;
++ return err;
+ }
+
+ static struct msi_domain_ops its_msi_domain_ops = {
+@@ -2434,6 +2446,7 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
+ {
+ struct irq_data *d = irq_domain_get_irq_data(domain, virq);
+ struct its_device *its_dev = irq_data_get_irq_chip_data(d);
++ struct its_node *its = its_dev->its;
+ int i;
+
+ for (i = 0; i < nr_irqs; i++) {
+@@ -2448,8 +2461,14 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
+ irq_domain_reset_irq_data(data);
+ }
+
+- /* If all interrupts have been freed, start mopping the floor */
+- if (bitmap_empty(its_dev->event_map.lpi_map,
++ mutex_lock(&its->dev_alloc_lock);
++
++ /*
++ * If all interrupts have been freed, start mopping the
++ * floor. This is conditionned on the device not being shared.
++ */
++ if (!its_dev->shared &&
++ bitmap_empty(its_dev->event_map.lpi_map,
+ its_dev->event_map.nr_lpis)) {
+ its_lpi_free(its_dev->event_map.lpi_map,
+ its_dev->event_map.lpi_base,
+@@ -2461,6 +2480,8 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
+ its_free_device(its_dev);
+ }
+
++ mutex_unlock(&its->dev_alloc_lock);
++
+ irq_domain_free_irqs_parent(domain, virq, nr_irqs);
+ }
+
+@@ -3385,6 +3406,7 @@ static int __init its_probe_one(struct resource *res,
+ }
+
+ raw_spin_lock_init(&its->lock);
++ mutex_init(&its->dev_alloc_lock);
+ INIT_LIST_HEAD(&its->entry);
+ INIT_LIST_HEAD(&its->its_device_list);
+ typer = gic_read_typer(its_base + GITS_TYPER);
+diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
+index 8e5b03161b2f..64a63711fd95 100644
+--- a/drivers/isdn/hisax/hfc_pci.c
++++ b/drivers/isdn/hisax/hfc_pci.c
+@@ -1170,11 +1170,13 @@ HFCPCI_l1hw(struct PStack *st, int pr, void *arg)
+ if (cs->debug & L1_DEB_LAPD)
+ debugl1(cs, "-> PH_REQUEST_PULL");
+ #endif
++ spin_lock_irqsave(&cs->lock, flags);
+ if (!cs->tx_skb) {
+ test_and_clear_bit(FLG_L1_PULL_REQ, &st->l1.Flags);
+ st->l1.l1l2(st, PH_PULL | CONFIRM, NULL);
+ } else
+ test_and_set_bit(FLG_L1_PULL_REQ, &st->l1.Flags);
++ spin_unlock_irqrestore(&cs->lock, flags);
+ break;
+ case (HW_RESET | REQUEST):
+ spin_lock_irqsave(&cs->lock, flags);
+diff --git a/drivers/lightnvm/pblk-core.c b/drivers/lightnvm/pblk-core.c
+index 2940cdc87af1..95be6e36c7dd 100644
+--- a/drivers/lightnvm/pblk-core.c
++++ b/drivers/lightnvm/pblk-core.c
+@@ -1252,15 +1252,22 @@ int pblk_line_recov_alloc(struct pblk *pblk, struct pblk_line *line)
+
+ ret = pblk_line_alloc_bitmaps(pblk, line);
+ if (ret)
+- return ret;
++ goto fail;
+
+ if (!pblk_line_init_bb(pblk, line, 0)) {
+- list_add(&line->list, &l_mg->free_list);
+- return -EINTR;
++ ret = -EINTR;
++ goto fail;
+ }
+
+ pblk_rl_free_lines_dec(&pblk->rl, line, true);
+ return 0;
++
++fail:
++ spin_lock(&l_mg->free_lock);
++ list_add(&line->list, &l_mg->free_list);
++ spin_unlock(&l_mg->free_lock);
++
++ return ret;
+ }
+
+ void pblk_line_recov_close(struct pblk *pblk, struct pblk_line *line)
+diff --git a/drivers/lightnvm/pblk-write.c b/drivers/lightnvm/pblk-write.c
+index 879227d584e7..c3e038d4b22e 100644
+--- a/drivers/lightnvm/pblk-write.c
++++ b/drivers/lightnvm/pblk-write.c
+@@ -158,9 +158,11 @@ static void pblk_prepare_resubmit(struct pblk *pblk, unsigned int sentry,
+ w_ctx = &entry->w_ctx;
+
+ /* Check if the lba has been overwritten */
+- ppa_l2p = pblk_trans_map_get(pblk, w_ctx->lba);
+- if (!pblk_ppa_comp(ppa_l2p, entry->cacheline))
+- w_ctx->lba = ADDR_EMPTY;
++ if (w_ctx->lba != ADDR_EMPTY) {
++ ppa_l2p = pblk_trans_map_get(pblk, w_ctx->lba);
++ if (!pblk_ppa_comp(ppa_l2p, entry->cacheline))
++ w_ctx->lba = ADDR_EMPTY;
++ }
+
+ /* Mark up the entry as submittable again */
+ flags = READ_ONCE(w_ctx->flags);
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 811427e53126..7033a2880771 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1208,7 +1208,9 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio,
+ struct bio *split = bio_split(bio, max_sectors,
+ gfp, &conf->bio_split);
+ bio_chain(split, bio);
++ allow_barrier(conf);
+ generic_make_request(bio);
++ wait_barrier(conf);
+ bio = split;
+ r10_bio->master_bio = bio;
+ r10_bio->sectors = max_sectors;
+@@ -1513,7 +1515,9 @@ retry_write:
+ struct bio *split = bio_split(bio, r10_bio->sectors,
+ GFP_NOIO, &conf->bio_split);
+ bio_chain(split, bio);
++ allow_barrier(conf);
+ generic_make_request(bio);
++ wait_barrier(conf);
+ bio = split;
+ r10_bio->master_bio = bio;
+ }
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index 82af97430e5b..63c9ac2c6a5f 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -61,6 +61,7 @@ config VIDEO_TDA1997X
+ depends on VIDEO_V4L2 && I2C && VIDEO_V4L2_SUBDEV_API
+ depends on SND_SOC
+ select SND_PCM
++ select HDMI
+ ---help---
+ V4L2 subdevice driver for the NXP TDA1997x HDMI receivers.
+
+@@ -610,6 +611,7 @@ config VIDEO_IMX274
+ tristate "Sony IMX274 sensor support"
+ depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
+ depends on MEDIA_CAMERA_SUPPORT
++ select REGMAP_I2C
+ ---help---
+ This is a V4L2 sensor driver for the Sony IMX274
+ CMOS image sensor.
+diff --git a/drivers/media/i2c/ad9389b.c b/drivers/media/i2c/ad9389b.c
+index 5b008b0002c0..aa8b04cfed0f 100644
+--- a/drivers/media/i2c/ad9389b.c
++++ b/drivers/media/i2c/ad9389b.c
+@@ -578,7 +578,7 @@ static const struct v4l2_dv_timings_cap ad9389b_timings_cap = {
+ .type = V4L2_DV_BT_656_1120,
+ /* keep this initialization for compatibility with GCC < 4.4.6 */
+ .reserved = { 0 },
+- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000,
+ V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+ V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
+ V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
+diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
+index f3899cc84e27..88349b5053cc 100644
+--- a/drivers/media/i2c/adv7511.c
++++ b/drivers/media/i2c/adv7511.c
+@@ -130,7 +130,7 @@ static const struct v4l2_dv_timings_cap adv7511_timings_cap = {
+ .type = V4L2_DV_BT_656_1120,
+ /* keep this initialization for compatibility with GCC < 4.4.6 */
+ .reserved = { 0 },
+- V4L2_INIT_BT_TIMINGS(0, ADV7511_MAX_WIDTH, 0, ADV7511_MAX_HEIGHT,
++ V4L2_INIT_BT_TIMINGS(640, ADV7511_MAX_WIDTH, 350, ADV7511_MAX_HEIGHT,
+ ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK,
+ V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+ V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
+diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
+index c78698199ac5..f01964c36ad5 100644
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -766,7 +766,7 @@ static const struct v4l2_dv_timings_cap adv7604_timings_cap_analog = {
+ .type = V4L2_DV_BT_656_1120,
+ /* keep this initialization for compatibility with GCC < 4.4.6 */
+ .reserved = { 0 },
+- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000,
+ V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+ V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
+ V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
+@@ -777,7 +777,7 @@ static const struct v4l2_dv_timings_cap adv76xx_timings_cap_digital = {
+ .type = V4L2_DV_BT_656_1120,
+ /* keep this initialization for compatibility with GCC < 4.4.6 */
+ .reserved = { 0 },
+- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 225000000,
++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 225000000,
+ V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+ V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
+ V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
+diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
+index 71fe56565f75..bb43a75ed6d0 100644
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -663,7 +663,7 @@ static const struct v4l2_dv_timings_cap adv7842_timings_cap_analog = {
+ .type = V4L2_DV_BT_656_1120,
+ /* keep this initialization for compatibility with GCC < 4.4.6 */
+ .reserved = { 0 },
+- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000,
+ V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+ V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
+ V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
+@@ -674,7 +674,7 @@ static const struct v4l2_dv_timings_cap adv7842_timings_cap_digital = {
+ .type = V4L2_DV_BT_656_1120,
+ /* keep this initialization for compatibility with GCC < 4.4.6 */
+ .reserved = { 0 },
+- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 225000000,
++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 225000000,
+ V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+ V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
+ V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index ff25ea9aca48..26070fb6ce4e 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -59,7 +59,7 @@ static const struct v4l2_dv_timings_cap tc358743_timings_cap = {
+ /* keep this initialization for compatibility with GCC < 4.4.6 */
+ .reserved = { 0 },
+ /* Pixel clock from REF_01 p. 20. Min/max height/width are unknown */
+- V4L2_INIT_BT_TIMINGS(1, 10000, 1, 10000, 0, 165000000,
++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 13000000, 165000000,
+ V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+ V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
+ V4L2_DV_BT_CAP_PROGRESSIVE |
+diff --git a/drivers/media/i2c/ths8200.c b/drivers/media/i2c/ths8200.c
+index 498ad2368cbc..f5ee28058ea2 100644
+--- a/drivers/media/i2c/ths8200.c
++++ b/drivers/media/i2c/ths8200.c
+@@ -49,7 +49,7 @@ static const struct v4l2_dv_timings_cap ths8200_timings_cap = {
+ .type = V4L2_DV_BT_656_1120,
+ /* keep this initialization for compatibility with GCC < 4.4.6 */
+ .reserved = { 0 },
+- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1080, 25000000, 148500000,
++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1080, 25000000, 148500000,
+ V4L2_DV_BT_STD_CEA861, V4L2_DV_BT_CAP_PROGRESSIVE)
+ };
+
+diff --git a/drivers/media/i2c/video-i2c.c b/drivers/media/i2c/video-i2c.c
+index 06d29d8f6be8..f27d294dcbef 100644
+--- a/drivers/media/i2c/video-i2c.c
++++ b/drivers/media/i2c/video-i2c.c
+@@ -510,7 +510,12 @@ static const struct v4l2_ioctl_ops video_i2c_ioctl_ops = {
+
+ static void video_i2c_release(struct video_device *vdev)
+ {
+- kfree(video_get_drvdata(vdev));
++ struct video_i2c_data *data = video_get_drvdata(vdev);
++
++ v4l2_device_unregister(&data->v4l2_dev);
++ mutex_destroy(&data->lock);
++ mutex_destroy(&data->queue_lock);
++ kfree(data);
+ }
+
+ static int video_i2c_probe(struct i2c_client *client,
+@@ -608,10 +613,6 @@ static int video_i2c_remove(struct i2c_client *client)
+ struct video_i2c_data *data = i2c_get_clientdata(client);
+
+ video_unregister_device(&data->vdev);
+- v4l2_device_unregister(&data->v4l2_dev);
+-
+- mutex_destroy(&data->lock);
+- mutex_destroy(&data->queue_lock);
+
+ return 0;
+ }
+diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
+index d26c2d85a009..d20d3df5778b 100644
+--- a/drivers/media/platform/coda/coda-bit.c
++++ b/drivers/media/platform/coda/coda-bit.c
+@@ -991,16 +991,15 @@ static int coda_start_encoding(struct coda_ctx *ctx)
+ else
+ coda_write(dev, CODA_STD_H264,
+ CODA_CMD_ENC_SEQ_COD_STD);
+- if (ctx->params.h264_deblk_enabled) {
+- value = ((ctx->params.h264_deblk_alpha &
+- CODA_264PARAM_DEBLKFILTEROFFSETALPHA_MASK) <<
+- CODA_264PARAM_DEBLKFILTEROFFSETALPHA_OFFSET) |
+- ((ctx->params.h264_deblk_beta &
+- CODA_264PARAM_DEBLKFILTEROFFSETBETA_MASK) <<
+- CODA_264PARAM_DEBLKFILTEROFFSETBETA_OFFSET);
+- } else {
+- value = 1 << CODA_264PARAM_DISABLEDEBLK_OFFSET;
+- }
++ value = ((ctx->params.h264_disable_deblocking_filter_idc &
++ CODA_264PARAM_DISABLEDEBLK_MASK) <<
++ CODA_264PARAM_DISABLEDEBLK_OFFSET) |
++ ((ctx->params.h264_slice_alpha_c0_offset_div2 &
++ CODA_264PARAM_DEBLKFILTEROFFSETALPHA_MASK) <<
++ CODA_264PARAM_DEBLKFILTEROFFSETALPHA_OFFSET) |
++ ((ctx->params.h264_slice_beta_offset_div2 &
++ CODA_264PARAM_DEBLKFILTEROFFSETBETA_MASK) <<
++ CODA_264PARAM_DEBLKFILTEROFFSETBETA_OFFSET);
+ coda_write(dev, value, CODA_CMD_ENC_SEQ_264_PARA);
+ break;
+ case V4L2_PIX_FMT_JPEG:
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index bf7b8417c27f..19d92edcc981 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -1793,14 +1793,13 @@ static int coda_s_ctrl(struct v4l2_ctrl *ctrl)
+ ctx->params.h264_max_qp = ctrl->val;
+ break;
+ case V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA:
+- ctx->params.h264_deblk_alpha = ctrl->val;
++ ctx->params.h264_slice_alpha_c0_offset_div2 = ctrl->val;
+ break;
+ case V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA:
+- ctx->params.h264_deblk_beta = ctrl->val;
++ ctx->params.h264_slice_beta_offset_div2 = ctrl->val;
+ break;
+ case V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_MODE:
+- ctx->params.h264_deblk_enabled = (ctrl->val ==
+- V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED);
++ ctx->params.h264_disable_deblocking_filter_idc = ctrl->val;
+ break;
+ case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
+ /* TODO: switch between baseline and constrained baseline */
+@@ -1882,13 +1881,13 @@ static void coda_encode_ctrls(struct coda_ctx *ctx)
+ v4l2_ctrl_new_std(&ctx->ctrls, &coda_ctrl_ops,
+ V4L2_CID_MPEG_VIDEO_H264_MAX_QP, 0, 51, 1, 51);
+ v4l2_ctrl_new_std(&ctx->ctrls, &coda_ctrl_ops,
+- V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA, 0, 15, 1, 0);
++ V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA, -6, 6, 1, 0);
+ v4l2_ctrl_new_std(&ctx->ctrls, &coda_ctrl_ops,
+- V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA, 0, 15, 1, 0);
++ V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA, -6, 6, 1, 0);
+ v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops,
+ V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_MODE,
+- V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED, 0x0,
+- V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED);
++ V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED_AT_SLICE_BOUNDARY,
++ 0x0, V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED);
+ v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops,
+ V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+ V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE, 0x0,
+diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h
+index 19ac0b9dc6eb..2469ca1dc598 100644
+--- a/drivers/media/platform/coda/coda.h
++++ b/drivers/media/platform/coda/coda.h
+@@ -115,9 +115,9 @@ struct coda_params {
+ u8 h264_inter_qp;
+ u8 h264_min_qp;
+ u8 h264_max_qp;
+- u8 h264_deblk_enabled;
+- u8 h264_deblk_alpha;
+- u8 h264_deblk_beta;
++ u8 h264_disable_deblocking_filter_idc;
++ s8 h264_slice_alpha_c0_offset_div2;
++ s8 h264_slice_beta_offset_div2;
+ u8 h264_profile_idc;
+ u8 h264_level_idc;
+ u8 mpeg4_intra_qp;
+diff --git a/drivers/media/platform/coda/coda_regs.h b/drivers/media/platform/coda/coda_regs.h
+index 5e7b00a97671..e675e38f3475 100644
+--- a/drivers/media/platform/coda/coda_regs.h
++++ b/drivers/media/platform/coda/coda_regs.h
+@@ -292,7 +292,7 @@
+ #define CODA_264PARAM_DEBLKFILTEROFFSETALPHA_OFFSET 8
+ #define CODA_264PARAM_DEBLKFILTEROFFSETALPHA_MASK 0x0f
+ #define CODA_264PARAM_DISABLEDEBLK_OFFSET 6
+-#define CODA_264PARAM_DISABLEDEBLK_MASK 0x01
++#define CODA_264PARAM_DISABLEDEBLK_MASK 0x03
+ #define CODA_264PARAM_CONSTRAINEDINTRAPREDFLAG_OFFSET 5
+ #define CODA_264PARAM_CONSTRAINEDINTRAPREDFLAG_MASK 0x01
+ #define CODA_264PARAM_CHROMAQPOFFSET_OFFSET 0
+diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
+index 18c035ef84cf..df1ae6b5c854 100644
+--- a/drivers/media/platform/davinci/vpbe.c
++++ b/drivers/media/platform/davinci/vpbe.c
+@@ -740,7 +740,7 @@ static int vpbe_initialize(struct device *dev, struct vpbe_device *vpbe_dev)
+ if (ret) {
+ v4l2_err(&vpbe_dev->v4l2_dev, "Failed to set default output %s",
+ def_output);
+- return ret;
++ goto fail_kfree_amp;
+ }
+
+ printk(KERN_NOTICE "Setting default mode to %s\n", def_mode);
+@@ -748,12 +748,15 @@ static int vpbe_initialize(struct device *dev, struct vpbe_device *vpbe_dev)
+ if (ret) {
+ v4l2_err(&vpbe_dev->v4l2_dev, "Failed to set default mode %s",
+ def_mode);
+- return ret;
++ goto fail_kfree_amp;
+ }
+ vpbe_dev->initialized = 1;
+ /* TBD handling of bootargs for default output and mode */
+ return 0;
+
++fail_kfree_amp:
++ mutex_lock(&vpbe_dev->lock);
++ kfree(vpbe_dev->amp);
+ fail_kfree_encoders:
+ kfree(vpbe_dev->encoders);
+ fail_dev_unregister:
+diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
+index 3e73e9db781f..7c025045ea90 100644
+--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c
+@@ -41,25 +41,27 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
+ node = of_parse_phandle(dev->of_node, "mediatek,larb", 0);
+ if (!node) {
+ mtk_v4l2_err("no mediatek,larb found");
+- return -1;
++ return -ENODEV;
+ }
+ pdev = of_find_device_by_node(node);
++ of_node_put(node);
+ if (!pdev) {
+ mtk_v4l2_err("no mediatek,larb device found");
+- return -1;
++ return -ENODEV;
+ }
+ pm->larbvenc = &pdev->dev;
+
+ node = of_parse_phandle(dev->of_node, "mediatek,larb", 1);
+ if (!node) {
+ mtk_v4l2_err("no mediatek,larb found");
+- return -1;
++ return -ENODEV;
+ }
+
+ pdev = of_find_device_by_node(node);
++ of_node_put(node);
+ if (!pdev) {
+ mtk_v4l2_err("no mediatek,larb device found");
+- return -1;
++ return -ENODEV;
+ }
+
+ pm->larbvenclt = &pdev->dev;
+diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
+index 8b2c16dd58bd..0f218afdadaa 100644
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -1956,6 +1956,8 @@ void rc_unregister_device(struct rc_dev *dev)
+ rc_free_rx_device(dev);
+
+ mutex_lock(&dev->lock);
++ if (dev->users && dev->close)
++ dev->close(dev);
+ dev->registered = false;
+ mutex_unlock(&dev->lock);
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index 76382c858c35..1246d69ba187 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -18,6 +18,7 @@
+ #include <linux/delay.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
++#include <linux/pm_runtime.h>
+
+ #define DRIVER_NAME "memstick"
+
+@@ -436,6 +437,7 @@ static void memstick_check(struct work_struct *work)
+ struct memstick_dev *card;
+
+ dev_dbg(&host->dev, "memstick_check started\n");
++ pm_runtime_get_noresume(host->dev.parent);
+ mutex_lock(&host->lock);
+ if (!host->card) {
+ if (memstick_power_on(host))
+@@ -479,6 +481,7 @@ out_power_off:
+ host->set_param(host, MEMSTICK_POWER, MEMSTICK_POWER_OFF);
+
+ mutex_unlock(&host->lock);
++ pm_runtime_put(host->dev.parent);
+ dev_dbg(&host->dev, "memstick_check finished\n");
+ }
+
+diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
+index 0d3b7473bc21..5301302fb531 100644
+--- a/drivers/mmc/host/bcm2835.c
++++ b/drivers/mmc/host/bcm2835.c
+@@ -286,6 +286,7 @@ static void bcm2835_reset(struct mmc_host *mmc)
+
+ if (host->dma_chan)
+ dmaengine_terminate_sync(host->dma_chan);
++ host->dma_chan = NULL;
+ bcm2835_reset_internal(host);
+ }
+
+@@ -772,6 +773,8 @@ static void bcm2835_finish_command(struct bcm2835_host *host)
+
+ if (!(sdhsts & SDHSTS_CRC7_ERROR) ||
+ (host->cmd->opcode != MMC_SEND_OP_COND)) {
++ u32 edm, fsm;
++
+ if (sdhsts & SDHSTS_CMD_TIME_OUT) {
+ host->cmd->error = -ETIMEDOUT;
+ } else {
+@@ -780,6 +783,13 @@ static void bcm2835_finish_command(struct bcm2835_host *host)
+ bcm2835_dumpregs(host);
+ host->cmd->error = -EILSEQ;
+ }
++ edm = readl(host->ioaddr + SDEDM);
++ fsm = edm & SDEDM_FSM_MASK;
++ if (fsm == SDEDM_FSM_READWAIT ||
++ fsm == SDEDM_FSM_WRITESTART1)
++ /* Kick the FSM out of its wait */
++ writel(edm | SDEDM_FORCE_DATA_MODE,
++ host->ioaddr + SDEDM);
+ bcm2835_finish_request(host);
+ return;
+ }
+@@ -837,6 +847,8 @@ static void bcm2835_timeout(struct work_struct *work)
+ dev_err(dev, "timeout waiting for hardware interrupt.\n");
+ bcm2835_dumpregs(host);
+
++ bcm2835_reset(host->mmc);
++
+ if (host->data) {
+ host->data->error = -ETIMEDOUT;
+ bcm2835_finish_data(host);
+diff --git a/drivers/mmc/host/jz4740_mmc.c b/drivers/mmc/host/jz4740_mmc.c
+index 993386c9ea50..864338e308e2 100644
+--- a/drivers/mmc/host/jz4740_mmc.c
++++ b/drivers/mmc/host/jz4740_mmc.c
+@@ -983,17 +983,17 @@ static int jz4740_mmc_request_gpios(struct mmc_host *mmc,
+ if (!pdata->read_only_active_low)
+ mmc->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
+
+- if (gpio_is_valid(pdata->gpio_card_detect)) {
+- ret = mmc_gpio_request_cd(mmc, pdata->gpio_card_detect, 0);
+- if (ret)
+- return ret;
+- }
++ /*
++ * Get optional card detect and write protect GPIOs,
++ * only back out on probe deferral.
++ */
++ ret = mmc_gpiod_request_cd(mmc, "cd", 0, false, 0, NULL);
++ if (ret == -EPROBE_DEFER)
++ return ret;
+
+- if (gpio_is_valid(pdata->gpio_read_only)) {
+- ret = mmc_gpio_request_ro(mmc, pdata->gpio_read_only);
+- if (ret)
+- return ret;
+- }
++ ret = mmc_gpiod_request_ro(mmc, "wp", 0, false, 0, NULL);
++ if (ret == -EPROBE_DEFER)
++ return ret;
+
+ return jz4740_mmc_request_gpio(&pdev->dev, pdata->gpio_power,
+ "MMC read only", true, pdata->power_active_low);
+diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c
+index 2cfec33178c1..9841b447ccde 100644
+--- a/drivers/mmc/host/meson-mx-sdio.c
++++ b/drivers/mmc/host/meson-mx-sdio.c
+@@ -596,6 +596,9 @@ static int meson_mx_mmc_register_clks(struct meson_mx_mmc_host *host)
+ init.name = devm_kasprintf(host->controller_dev, GFP_KERNEL,
+ "%s#fixed_factor",
+ dev_name(host->controller_dev));
++ if (!init.name)
++ return -ENOMEM;
++
+ init.ops = &clk_fixed_factor_ops;
+ init.flags = 0;
+ init.parent_names = &clk_fixed_factor_parent;
+@@ -612,6 +615,9 @@ static int meson_mx_mmc_register_clks(struct meson_mx_mmc_host *host)
+ clk_div_parent = __clk_get_name(host->fixed_factor_clk);
+ init.name = devm_kasprintf(host->controller_dev, GFP_KERNEL,
+ "%s#div", dev_name(host->controller_dev));
++ if (!init.name)
++ return -ENOMEM;
++
+ init.ops = &clk_divider_ops;
+ init.flags = CLK_SET_RATE_PARENT;
+ init.parent_names = &clk_div_parent;
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index 9cb7554a463d..a7bf8515116f 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -526,8 +526,12 @@ static void esdhc_clock_enable(struct sdhci_host *host, bool enable)
+ /* Wait max 20 ms */
+ timeout = ktime_add_ms(ktime_get(), 20);
+ val = ESDHC_CLOCK_STABLE;
+- while (!(sdhci_readl(host, ESDHC_PRSSTAT) & val)) {
+- if (ktime_after(ktime_get(), timeout)) {
++ while (1) {
++ bool timedout = ktime_after(ktime_get(), timeout);
++
++ if (sdhci_readl(host, ESDHC_PRSSTAT) & val)
++ break;
++ if (timedout) {
+ pr_err("%s: Internal clock never stabilised.\n",
+ mmc_hostname(host->mmc));
+ break;
+@@ -591,8 +595,12 @@ static void esdhc_of_set_clock(struct sdhci_host *host, unsigned int clock)
+
+ /* Wait max 20 ms */
+ timeout = ktime_add_ms(ktime_get(), 20);
+- while (!(sdhci_readl(host, ESDHC_PRSSTAT) & ESDHC_CLOCK_STABLE)) {
+- if (ktime_after(ktime_get(), timeout)) {
++ while (1) {
++ bool timedout = ktime_after(ktime_get(), timeout);
++
++ if (sdhci_readl(host, ESDHC_PRSSTAT) & ESDHC_CLOCK_STABLE)
++ break;
++ if (timedout) {
+ pr_err("%s: Internal clock never stabilised.\n",
+ mmc_hostname(host->mmc));
+ return;
+diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
+index d264391616f9..d02f5cf76b3d 100644
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -220,8 +220,12 @@ static void sdhci_omap_conf_bus_power(struct sdhci_omap_host *omap_host,
+
+ /* wait 1ms */
+ timeout = ktime_add_ms(ktime_get(), SDHCI_OMAP_TIMEOUT);
+- while (!(sdhci_omap_readl(omap_host, SDHCI_OMAP_HCTL) & HCTL_SDBP)) {
+- if (WARN_ON(ktime_after(ktime_get(), timeout)))
++ while (1) {
++ bool timedout = ktime_after(ktime_get(), timeout);
++
++ if (sdhci_omap_readl(omap_host, SDHCI_OMAP_HCTL) & HCTL_SDBP)
++ break;
++ if (WARN_ON(timedout))
+ return;
+ usleep_range(5, 10);
+ }
+@@ -653,8 +657,12 @@ static void sdhci_omap_init_74_clocks(struct sdhci_host *host, u8 power_mode)
+
+ /* wait 1ms */
+ timeout = ktime_add_ms(ktime_get(), SDHCI_OMAP_TIMEOUT);
+- while (!(sdhci_omap_readl(omap_host, SDHCI_OMAP_STAT) & INT_CC_EN)) {
+- if (WARN_ON(ktime_after(ktime_get(), timeout)))
++ while (1) {
++ bool timedout = ktime_after(ktime_get(), timeout);
++
++ if (sdhci_omap_readl(omap_host, SDHCI_OMAP_STAT) & INT_CC_EN)
++ break;
++ if (WARN_ON(timedout))
+ return;
+ usleep_range(5, 10);
+ }
+diff --git a/drivers/mmc/host/sdhci-xenon-phy.c b/drivers/mmc/host/sdhci-xenon-phy.c
+index c335052d0c02..caccedc836dc 100644
+--- a/drivers/mmc/host/sdhci-xenon-phy.c
++++ b/drivers/mmc/host/sdhci-xenon-phy.c
+@@ -357,9 +357,13 @@ static int xenon_emmc_phy_enable_dll(struct sdhci_host *host)
+
+ /* Wait max 32 ms */
+ timeout = ktime_add_ms(ktime_get(), 32);
+- while (!(sdhci_readw(host, XENON_SLOT_EXT_PRESENT_STATE) &
+- XENON_DLL_LOCK_STATE)) {
+- if (ktime_after(ktime_get(), timeout)) {
++ while (1) {
++ bool timedout = ktime_after(ktime_get(), timeout);
++
++ if (sdhci_readw(host, XENON_SLOT_EXT_PRESENT_STATE) &
++ XENON_DLL_LOCK_STATE)
++ break;
++ if (timedout) {
+ dev_err(mmc_dev(host->mmc), "Wait for DLL Lock time-out\n");
+ return -ETIMEDOUT;
+ }
+diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
+index 4d0791f6ec23..a0b5089b3274 100644
+--- a/drivers/mmc/host/sdhci-xenon.c
++++ b/drivers/mmc/host/sdhci-xenon.c
+@@ -34,9 +34,13 @@ static int xenon_enable_internal_clk(struct sdhci_host *host)
+ sdhci_writel(host, reg, SDHCI_CLOCK_CONTROL);
+ /* Wait max 20 ms */
+ timeout = ktime_add_ms(ktime_get(), 20);
+- while (!((reg = sdhci_readw(host, SDHCI_CLOCK_CONTROL))
+- & SDHCI_CLOCK_INT_STABLE)) {
+- if (ktime_after(ktime_get(), timeout)) {
++ while (1) {
++ bool timedout = ktime_after(ktime_get(), timeout);
++
++ reg = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
++ if (reg & SDHCI_CLOCK_INT_STABLE)
++ break;
++ if (timedout) {
+ dev_err(mmc_dev(host->mmc), "Internal clock never stabilised.\n");
+ return -ETIMEDOUT;
+ }
+diff --git a/drivers/net/dsa/mv88e6xxx/global1_atu.c b/drivers/net/dsa/mv88e6xxx/global1_atu.c
+index 5200e4bdce93..ea243840ee0f 100644
+--- a/drivers/net/dsa/mv88e6xxx/global1_atu.c
++++ b/drivers/net/dsa/mv88e6xxx/global1_atu.c
+@@ -314,6 +314,7 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
+ {
+ struct mv88e6xxx_chip *chip = dev_id;
+ struct mv88e6xxx_atu_entry entry;
++ int spid;
+ int err;
+ u16 val;
+
+@@ -336,6 +337,8 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
+ if (err)
+ goto out;
+
++ spid = entry.state;
++
+ if (val & MV88E6XXX_G1_ATU_OP_AGE_OUT_VIOLATION) {
+ dev_err_ratelimited(chip->dev,
+ "ATU age out violation for %pM\n",
+@@ -344,23 +347,23 @@ static irqreturn_t mv88e6xxx_g1_atu_prob_irq_thread_fn(int irq, void *dev_id)
+
+ if (val & MV88E6XXX_G1_ATU_OP_MEMBER_VIOLATION) {
+ dev_err_ratelimited(chip->dev,
+- "ATU member violation for %pM portvec %x\n",
+- entry.mac, entry.portvec);
+- chip->ports[entry.portvec].atu_member_violation++;
++ "ATU member violation for %pM portvec %x spid %d\n",
++ entry.mac, entry.portvec, spid);
++ chip->ports[spid].atu_member_violation++;
+ }
+
+ if (val & MV88E6XXX_G1_ATU_OP_MISS_VIOLATION) {
+ dev_err_ratelimited(chip->dev,
+- "ATU miss violation for %pM portvec %x\n",
+- entry.mac, entry.portvec);
+- chip->ports[entry.portvec].atu_miss_violation++;
++ "ATU miss violation for %pM portvec %x spid %d\n",
++ entry.mac, entry.portvec, spid);
++ chip->ports[spid].atu_miss_violation++;
+ }
+
+ if (val & MV88E6XXX_G1_ATU_OP_FULL_VIOLATION) {
+ dev_err_ratelimited(chip->dev,
+- "ATU full violation for %pM portvec %x\n",
+- entry.mac, entry.portvec);
+- chip->ports[entry.portvec].atu_full_violation++;
++ "ATU full violation for %pM portvec %x spid %d\n",
++ entry.mac, entry.portvec, spid);
++ chip->ports[spid].atu_full_violation++;
+ }
+ mutex_unlock(&chip->reg_lock);
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+index c965e65d07db..9939ccaeb125 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+@@ -262,6 +262,8 @@ int hw_atl_utils_soft_reset(struct aq_hw_s *self)
+ AQ_HW_WAIT_FOR((aq_hw_read_reg(self, HW_ATL_MPI_STATE_ADR) &
+ HW_ATL_MPI_STATE_MSK) == MPI_DEINIT,
+ 10, 1000U);
++ if (err)
++ return err;
+ }
+
+ if (self->rbl_enabled)
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 7b6859e4924e..fc16b2b0d0e9 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -519,7 +519,6 @@ static void bcm_sysport_get_wol(struct net_device *dev,
+ struct ethtool_wolinfo *wol)
+ {
+ struct bcm_sysport_priv *priv = netdev_priv(dev);
+- u32 reg;
+
+ wol->supported = WAKE_MAGIC | WAKE_MAGICSECURE | WAKE_FILTER;
+ wol->wolopts = priv->wolopts;
+@@ -527,11 +526,7 @@ static void bcm_sysport_get_wol(struct net_device *dev,
+ if (!(priv->wolopts & WAKE_MAGICSECURE))
+ return;
+
+- /* Return the programmed SecureOn password */
+- reg = umac_readl(priv, UMAC_PSW_MS);
+- put_unaligned_be16(reg, &wol->sopass[0]);
+- reg = umac_readl(priv, UMAC_PSW_LS);
+- put_unaligned_be32(reg, &wol->sopass[2]);
++ memcpy(wol->sopass, priv->sopass, sizeof(priv->sopass));
+ }
+
+ static int bcm_sysport_set_wol(struct net_device *dev,
+@@ -547,13 +542,8 @@ static int bcm_sysport_set_wol(struct net_device *dev,
+ if (wol->wolopts & ~supported)
+ return -EINVAL;
+
+- /* Program the SecureOn password */
+- if (wol->wolopts & WAKE_MAGICSECURE) {
+- umac_writel(priv, get_unaligned_be16(&wol->sopass[0]),
+- UMAC_PSW_MS);
+- umac_writel(priv, get_unaligned_be32(&wol->sopass[2]),
+- UMAC_PSW_LS);
+- }
++ if (wol->wolopts & WAKE_MAGICSECURE)
++ memcpy(priv->sopass, wol->sopass, sizeof(priv->sopass));
+
+ /* Flag the device and relevant IRQ as wakeup capable */
+ if (wol->wolopts) {
+@@ -2588,13 +2578,18 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv)
+ unsigned int index, i = 0;
+ u32 reg;
+
+- /* Password has already been programmed */
+ reg = umac_readl(priv, UMAC_MPD_CTRL);
+ if (priv->wolopts & (WAKE_MAGIC | WAKE_MAGICSECURE))
+ reg |= MPD_EN;
+ reg &= ~PSW_EN;
+- if (priv->wolopts & WAKE_MAGICSECURE)
++ if (priv->wolopts & WAKE_MAGICSECURE) {
++ /* Program the SecureOn password */
++ umac_writel(priv, get_unaligned_be16(&priv->sopass[0]),
++ UMAC_PSW_MS);
++ umac_writel(priv, get_unaligned_be32(&priv->sopass[2]),
++ UMAC_PSW_LS);
+ reg |= PSW_EN;
++ }
+ umac_writel(priv, reg, UMAC_MPD_CTRL);
+
+ if (priv->wolopts & WAKE_FILTER) {
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
+index 046c6c1d97fd..36e0adf5c9b8 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.h
++++ b/drivers/net/ethernet/broadcom/bcmsysport.h
+@@ -12,6 +12,7 @@
+ #define __BCM_SYSPORT_H
+
+ #include <linux/bitmap.h>
++#include <linux/ethtool.h>
+ #include <linux/if_vlan.h>
+ #include <linux/net_dim.h>
+
+@@ -776,6 +777,7 @@ struct bcm_sysport_priv {
+ unsigned int crc_fwd:1;
+ u16 rev;
+ u32 wolopts;
++ u8 sopass[SOPASS_MAX];
+ unsigned int wol_irq_disabled:1;
+
+ /* MIB related fields */
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index e2d92548226a..034f57500f00 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -6073,23 +6073,26 @@ static void bnxt_clear_int_mode(struct bnxt *bp)
+ int bnxt_reserve_rings(struct bnxt *bp)
+ {
+ int tcs = netdev_get_num_tc(bp->dev);
++ bool reinit_irq = false;
+ int rc;
+
+ if (!bnxt_need_reserve_rings(bp))
+ return 0;
+
+- rc = __bnxt_reserve_rings(bp);
+- if (rc) {
+- netdev_err(bp->dev, "ring reservation failure rc: %d\n", rc);
+- return rc;
+- }
+ if (BNXT_NEW_RM(bp) && (bnxt_get_num_msix(bp) != bp->total_irqs)) {
+ bnxt_ulp_irq_stop(bp);
+ bnxt_clear_int_mode(bp);
+- rc = bnxt_init_int_mode(bp);
++ reinit_irq = true;
++ }
++ rc = __bnxt_reserve_rings(bp);
++ if (reinit_irq) {
++ if (!rc)
++ rc = bnxt_init_int_mode(bp);
+ bnxt_ulp_irq_restart(bp, rc);
+- if (rc)
+- return rc;
++ }
++ if (rc) {
++ netdev_err(bp->dev, "ring reservation/IRQ init failure rc: %d\n", rc);
++ return rc;
+ }
+ if (tcs && (bp->tx_nr_rings_per_tc * tcs != bp->tx_nr_rings)) {
+ netdev_err(bp->dev, "tx ring reservation failure\n");
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
+index 60641e202534..9a7f70db20c7 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -1434,7 +1434,8 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
+ * csum is correct or is zero.
+ */
+ if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc &&
+- tcp_udp_csum_ok && ipv4_csum_ok && outer_csum_ok) {
++ tcp_udp_csum_ok && outer_csum_ok &&
++ (ipv4_csum_ok || ipv6)) {
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+ skb->csum_level = encap;
+ }
+diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
+index bc6eb30aa20f..41c6fa200e74 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
+@@ -928,7 +928,7 @@ int memac_add_hash_mac_address(struct fman_mac *memac, enet_addr_t *eth_addr)
+ hash = get_mac_addr_hash_code(addr) & HASH_CTRL_ADDR_MASK;
+
+ /* Create element to be added to the driver hash table */
+- hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL);
++ hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC);
+ if (!hash_entry)
+ return -ENOMEM;
+ hash_entry->addr = addr;
+diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c
+index 40705938eecc..f75b9c11b2d2 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_tgec.c
++++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c
+@@ -553,7 +553,7 @@ int tgec_add_hash_mac_address(struct fman_mac *tgec, enet_addr_t *eth_addr)
+ hash = (crc >> TGEC_HASH_MCAST_SHIFT) & TGEC_HASH_ADR_MSK;
+
+ /* Create element to be added to the driver hash table */
+- hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL);
++ hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC);
+ if (!hash_entry)
+ return -ENOMEM;
+ hash_entry->addr = addr;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index b7b2f8254ce1..0ccfa6a84535 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -2691,6 +2691,8 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+
+ static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv)
+ {
++#define HNS3_VECTOR_PF_MAX_NUM 64
++
+ struct hnae3_handle *h = priv->ae_handle;
+ struct hns3_enet_tqp_vector *tqp_vector;
+ struct hnae3_vector_info *vector;
+@@ -2703,6 +2705,8 @@ static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv)
+ /* RSS size, cpu online and vector_num should be the same */
+ /* Should consider 2p/4p later */
+ vector_num = min_t(u16, num_online_cpus(), tqp_num);
++ vector_num = min_t(u16, vector_num, HNS3_VECTOR_PF_MAX_NUM);
++
+ vector = devm_kcalloc(&pdev->dev, vector_num, sizeof(*vector),
+ GFP_KERNEL);
+ if (!vector)
+@@ -2760,12 +2764,12 @@ static int hns3_nic_uninit_vector_data(struct hns3_nic_priv *priv)
+
+ hns3_free_vector_ring_chain(tqp_vector, &vector_ring_chain);
+
+- if (priv->tqp_vector[i].irq_init_flag == HNS3_VECTOR_INITED) {
+- (void)irq_set_affinity_hint(
+- priv->tqp_vector[i].vector_irq,
+- NULL);
+- free_irq(priv->tqp_vector[i].vector_irq,
+- &priv->tqp_vector[i]);
++ if (tqp_vector->irq_init_flag == HNS3_VECTOR_INITED) {
++ irq_set_affinity_notifier(tqp_vector->vector_irq,
++ NULL);
++ irq_set_affinity_hint(tqp_vector->vector_irq, NULL);
++ free_irq(tqp_vector->vector_irq, tqp_vector);
++ tqp_vector->irq_init_flag = HNS3_VECTOR_NOT_INITED;
+ }
+
+ priv->ring_data[i].ring->irq_init_flag = HNS3_VECTOR_NOT_INITED;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
+index 7a80652e2500..f84e2c2d02c0 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -122,6 +122,7 @@ enum i40e_state_t {
+ __I40E_MDD_EVENT_PENDING,
+ __I40E_VFLR_EVENT_PENDING,
+ __I40E_RESET_RECOVERY_PENDING,
++ __I40E_TIMEOUT_RECOVERY_PENDING,
+ __I40E_MISC_IRQ_REQUESTED,
+ __I40E_RESET_INTR_RECEIVED,
+ __I40E_REINIT_REQUESTED,
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index ed9d3fc4aaba..41fa22c562c1 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -336,6 +336,10 @@ static void i40e_tx_timeout(struct net_device *netdev)
+ (pf->tx_timeout_last_recovery + netdev->watchdog_timeo)))
+ return; /* don't do any new action before the next timeout */
+
++ /* don't kick off another recovery if one is already pending */
++ if (test_and_set_bit(__I40E_TIMEOUT_RECOVERY_PENDING, pf->state))
++ return;
++
+ if (tx_ring) {
+ head = i40e_get_head(tx_ring);
+ /* Read interrupt register */
+@@ -9566,6 +9570,7 @@ end_core_reset:
+ clear_bit(__I40E_RESET_FAILED, pf->state);
+ clear_recovery:
+ clear_bit(__I40E_RESET_RECOVERY_PENDING, pf->state);
++ clear_bit(__I40E_TIMEOUT_RECOVERY_PENDING, pf->state);
+ }
+
+ /**
+@@ -12011,6 +12016,9 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
+ ether_addr_copy(netdev->dev_addr, mac_addr);
+ ether_addr_copy(netdev->perm_addr, mac_addr);
+
++ /* i40iw_net_event() reads 16 bytes from neigh->primary_key */
++ netdev->neigh_priv_len = sizeof(u32) * 4;
++
+ netdev->priv_flags |= IFF_UNICAST_FLT;
+ netdev->priv_flags |= IFF_SUPP_NOFCS;
+ /* Setup netdev TC information */
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 3f047bb43348..db1543bca701 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -4333,8 +4333,12 @@ static void ice_napi_enable_all(struct ice_vsi *vsi)
+ if (!vsi->netdev)
+ return;
+
+- for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++)
+- napi_enable(&vsi->q_vectors[q_idx]->napi);
++ for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) {
++ struct ice_q_vector *q_vector = vsi->q_vectors[q_idx];
++
++ if (q_vector->rx.ring || q_vector->tx.ring)
++ napi_enable(&q_vector->napi);
++ }
+ }
+
+ /**
+@@ -4817,8 +4821,12 @@ static void ice_napi_disable_all(struct ice_vsi *vsi)
+ if (!vsi->netdev)
+ return;
+
+- for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++)
+- napi_disable(&vsi->q_vectors[q_idx]->napi);
++ for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) {
++ struct ice_q_vector *q_vector = vsi->q_vectors[q_idx];
++
++ if (q_vector->rx.ring || q_vector->tx.ring)
++ napi_disable(&q_vector->napi);
++ }
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 0796cef96fa3..ffaa6e031632 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -8770,9 +8770,11 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
+ rtnl_unlock();
+
+ #ifdef CONFIG_PM
+- retval = pci_save_state(pdev);
+- if (retval)
+- return retval;
++ if (!runtime) {
++ retval = pci_save_state(pdev);
++ if (retval)
++ return retval;
++ }
+ #endif
+
+ status = rd32(E1000_STATUS);
+diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
+index 9c08c3650c02..15dea48e0195 100644
+--- a/drivers/net/ethernet/marvell/skge.c
++++ b/drivers/net/ethernet/marvell/skge.c
+@@ -152,8 +152,10 @@ static void skge_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+ memset(p, 0, regs->len);
+ memcpy_fromio(p, io, B3_RAM_ADDR);
+
+- memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
+- regs->len - B3_RI_WTO_R1);
++ if (regs->len > B3_RI_WTO_R1) {
++ memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
++ regs->len - B3_RI_WTO_R1);
++ }
+ }
+
+ /* Wake on Lan only supported on Yukon chips with rev 1 or above */
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 7365899c3ac9..944f21f99d43 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -1758,7 +1758,7 @@ static void mlx5e_close_cq(struct mlx5e_cq *cq)
+
+ static int mlx5e_get_cpu(struct mlx5e_priv *priv, int ix)
+ {
+- return cpumask_first(priv->mdev->priv.irq_info[ix].mask);
++ return cpumask_first(priv->mdev->priv.irq_info[ix + MLX5_EQ_VEC_COMP_BASE].mask);
+ }
+
+ static int mlx5e_open_tx_cqs(struct mlx5e_channel *c,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index 8262f093fec4..d3f794d4fb96 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -707,6 +707,8 @@ static u32 mlx5e_get_fcs(const struct sk_buff *skb)
+ return __get_unaligned_cpu32(fcs_bytes);
+ }
+
++#define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN)
++
+ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ struct mlx5_cqe64 *cqe,
+ struct mlx5e_rq *rq,
+@@ -725,6 +727,17 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ return;
+ }
+
++ /* CQE csum doesn't cover padding octets in short ethernet
++ * frames. And the pad field is appended prior to calculating
++ * and appending the FCS field.
++ *
++ * Detecting these padded frames requires to verify and parse
++ * IP headers, so we simply force all those small frames to be
++ * CHECKSUM_UNNECESSARY even if they are not padded.
++ */
++ if (short_frame(skb->len))
++ goto csum_unnecessary;
++
+ if (likely(is_last_ethertype_ip(skb, &network_depth))) {
+ skb->ip_summed = CHECKSUM_COMPLETE;
+ skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
+@@ -744,6 +757,7 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ return;
+ }
+
++csum_unnecessary:
+ if (likely((cqe->hds_ip_ext & CQE_L3_OK) &&
+ (cqe->hds_ip_ext & CQE_L4_OK))) {
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+index 6dacaeba2fbf..0b03d65474e9 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+@@ -387,8 +387,14 @@ netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
+ num_wqebbs = DIV_ROUND_UP(ds_cnt, MLX5_SEND_WQEBB_NUM_DS);
+ contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi);
+ if (unlikely(contig_wqebbs_room < num_wqebbs)) {
++#ifdef CONFIG_MLX5_EN_IPSEC
++ struct mlx5_wqe_eth_seg cur_eth = wqe->eth;
++#endif
+ mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room);
+ mlx5e_sq_fetch_wqe(sq, &wqe, &pi);
++#ifdef CONFIG_MLX5_EN_IPSEC
++ wqe->eth = cur_eth;
++#endif
+ }
+
+ /* fill wqe */
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+index 3f767cde4c1d..54f1a40a68ed 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+@@ -511,14 +511,14 @@ void mlx5_init_clock(struct mlx5_core_dev *mdev)
+ ktime_to_ns(ktime_get_real()));
+
+ /* Calculate period in seconds to call the overflow watchdog - to make
+- * sure counter is checked at least once every wrap around.
++ * sure counter is checked at least twice every wrap around.
+ * The period is calculated as the minimum between max HW cycles count
+ * (The clock source mask) and max amount of cycles that can be
+ * multiplied by clock multiplier where the result doesn't exceed
+ * 64bits.
+ */
+ overflow_cycles = div64_u64(~0ULL >> 1, clock->cycles.mult);
+- overflow_cycles = min(overflow_cycles, clock->cycles.mask >> 1);
++ overflow_cycles = min(overflow_cycles, div_u64(clock->cycles.mask, 3));
+
+ ns = cyclecounter_cyc2ns(&clock->cycles, overflow_cycles,
+ frac, &frac);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index b5e9f664fc66..563ce3fedab4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -640,18 +640,19 @@ u64 mlx5_read_internal_timer(struct mlx5_core_dev *dev)
+ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
+ {
+ struct mlx5_priv *priv = &mdev->priv;
+- int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i);
++ int vecidx = MLX5_EQ_VEC_COMP_BASE + i;
++ int irq = pci_irq_vector(mdev->pdev, vecidx);
+
+- if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
++ if (!zalloc_cpumask_var(&priv->irq_info[vecidx].mask, GFP_KERNEL)) {
+ mlx5_core_warn(mdev, "zalloc_cpumask_var failed");
+ return -ENOMEM;
+ }
+
+ cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
+- priv->irq_info[i].mask);
++ priv->irq_info[vecidx].mask);
+
+ if (IS_ENABLED(CONFIG_SMP) &&
+- irq_set_affinity_hint(irq, priv->irq_info[i].mask))
++ irq_set_affinity_hint(irq, priv->irq_info[vecidx].mask))
+ mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
+
+ return 0;
+@@ -659,11 +660,12 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
+
+ static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i)
+ {
++ int vecidx = MLX5_EQ_VEC_COMP_BASE + i;
+ struct mlx5_priv *priv = &mdev->priv;
+- int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i);
++ int irq = pci_irq_vector(mdev->pdev, vecidx);
+
+ irq_set_affinity_hint(irq, NULL);
+- free_cpumask_var(priv->irq_info[i].mask);
++ free_cpumask_var(priv->irq_info[vecidx].mask);
+ }
+
+ static int mlx5_irq_set_affinity_hints(struct mlx5_core_dev *mdev)
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index de821a9fdfaf..d64cd8d44d83 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -4235,6 +4235,25 @@ void mlxsw_sp_port_dev_put(struct mlxsw_sp_port *mlxsw_sp_port)
+ dev_put(mlxsw_sp_port->dev);
+ }
+
++static void
++mlxsw_sp_port_lag_uppers_cleanup(struct mlxsw_sp_port *mlxsw_sp_port,
++ struct net_device *lag_dev)
++{
++ struct net_device *br_dev = netdev_master_upper_dev_get(lag_dev);
++ struct net_device *upper_dev;
++ struct list_head *iter;
++
++ if (netif_is_bridge_port(lag_dev))
++ mlxsw_sp_port_bridge_leave(mlxsw_sp_port, lag_dev, br_dev);
++
++ netdev_for_each_upper_dev_rcu(lag_dev, upper_dev, iter) {
++ if (!netif_is_bridge_port(upper_dev))
++ continue;
++ br_dev = netdev_master_upper_dev_get(upper_dev);
++ mlxsw_sp_port_bridge_leave(mlxsw_sp_port, upper_dev, br_dev);
++ }
++}
++
+ static int mlxsw_sp_lag_create(struct mlxsw_sp *mlxsw_sp, u16 lag_id)
+ {
+ char sldr_pl[MLXSW_REG_SLDR_LEN];
+@@ -4427,6 +4446,10 @@ static void mlxsw_sp_port_lag_leave(struct mlxsw_sp_port *mlxsw_sp_port,
+
+ /* Any VLANs configured on the port are no longer valid */
+ mlxsw_sp_port_vlan_flush(mlxsw_sp_port);
++ /* Make the LAG and its directly linked uppers leave bridges they
++ * are memeber in
++ */
++ mlxsw_sp_port_lag_uppers_cleanup(mlxsw_sp_port, lag_dev);
+
+ if (lag->ref_count == 1)
+ mlxsw_sp_lag_destroy(mlxsw_sp, lag_id);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
+index e171513bb32a..30931a2c025b 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
+@@ -95,8 +95,9 @@ int mlxsw_sp_acl_tcam_priority_get(struct mlxsw_sp *mlxsw_sp,
+ if (!MLXSW_CORE_RES_VALID(mlxsw_sp->core, KVD_SIZE))
+ return -EIO;
+
+- max_priority = MLXSW_CORE_RES_GET(mlxsw_sp->core, KVD_SIZE);
+- if (rulei->priority > max_priority)
++ /* Priority range is 1..cap_kvd_size-1. */
++ max_priority = MLXSW_CORE_RES_GET(mlxsw_sp->core, KVD_SIZE) - 1;
++ if (rulei->priority >= max_priority)
+ return -EINVAL;
+
+ /* Unlike in TC, in HW, higher number means higher priority. */
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index 0d9ea37c5d21..cdec48bcc6ad 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -282,30 +282,6 @@ mlxsw_sp_bridge_port_destroy(struct mlxsw_sp_bridge_port *bridge_port)
+ kfree(bridge_port);
+ }
+
+-static bool
+-mlxsw_sp_bridge_port_should_destroy(const struct mlxsw_sp_bridge_port *
+- bridge_port)
+-{
+- struct net_device *dev = bridge_port->dev;
+- struct mlxsw_sp *mlxsw_sp;
+-
+- if (is_vlan_dev(dev))
+- mlxsw_sp = mlxsw_sp_lower_get(vlan_dev_real_dev(dev));
+- else
+- mlxsw_sp = mlxsw_sp_lower_get(dev);
+-
+- /* In case ports were pulled from out of a bridged LAG, then
+- * it's possible the reference count isn't zero, yet the bridge
+- * port should be destroyed, as it's no longer an upper of ours.
+- */
+- if (!mlxsw_sp && list_empty(&bridge_port->vlans_list))
+- return true;
+- else if (bridge_port->ref_count == 0)
+- return true;
+- else
+- return false;
+-}
+-
+ static struct mlxsw_sp_bridge_port *
+ mlxsw_sp_bridge_port_get(struct mlxsw_sp_bridge *bridge,
+ struct net_device *brport_dev)
+@@ -343,8 +319,7 @@ static void mlxsw_sp_bridge_port_put(struct mlxsw_sp_bridge *bridge,
+ {
+ struct mlxsw_sp_bridge_device *bridge_device;
+
+- bridge_port->ref_count--;
+- if (!mlxsw_sp_bridge_port_should_destroy(bridge_port))
++ if (--bridge_port->ref_count != 0)
+ return;
+ bridge_device = bridge_port->bridge_device;
+ mlxsw_sp_bridge_port_destroy(bridge_port);
+diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
+index 9319d84bf49f..d84501441edd 100644
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -8100,6 +8100,8 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
+ start += 3;
+
+ prop_len = niu_pci_eeprom_read(np, start + 4);
++ if (prop_len < 0)
++ return prop_len;
+ err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64);
+ if (err < 0)
+ return err;
+@@ -8144,8 +8146,12 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
+ netif_printk(np, probe, KERN_DEBUG, np->dev,
+ "VPD_SCAN: Reading in property [%s] len[%d]\n",
+ namebuf, prop_len);
+- for (i = 0; i < prop_len; i++)
+- *prop_buf++ = niu_pci_eeprom_read(np, off + i);
++ for (i = 0; i < prop_len; i++) {
++ err = niu_pci_eeprom_read(np, off + i);
++ if (err >= 0)
++ *prop_buf = err;
++ ++prop_buf;
++ }
+ }
+
+ start += len;
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index 29aa8d772b0c..59b3f1fbabd4 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -896,14 +896,14 @@ static void decode_txts(struct dp83640_private *dp83640,
+ struct phy_txts *phy_txts)
+ {
+ struct skb_shared_hwtstamps shhwtstamps;
++ struct dp83640_skb_info *skb_info;
+ struct sk_buff *skb;
+- u64 ns;
+ u8 overflow;
++ u64 ns;
+
+ /* We must already have the skb that triggered this. */
+-
++again:
+ skb = skb_dequeue(&dp83640->tx_queue);
+-
+ if (!skb) {
+ pr_debug("have timestamp but tx_queue empty\n");
+ return;
+@@ -918,6 +918,11 @@ static void decode_txts(struct dp83640_private *dp83640,
+ }
+ return;
+ }
++ skb_info = (struct dp83640_skb_info *)skb->cb;
++ if (time_after(jiffies, skb_info->tmo)) {
++ kfree_skb(skb);
++ goto again;
++ }
+
+ ns = phy2txts(phy_txts);
+ memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+@@ -1470,6 +1475,7 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
+ static void dp83640_txtstamp(struct phy_device *phydev,
+ struct sk_buff *skb, int type)
+ {
++ struct dp83640_skb_info *skb_info = (struct dp83640_skb_info *)skb->cb;
+ struct dp83640_private *dp83640 = phydev->priv;
+
+ switch (dp83640->hwts_tx_en) {
+@@ -1482,6 +1488,7 @@ static void dp83640_txtstamp(struct phy_device *phydev,
+ /* fall through */
+ case HWTSTAMP_TX_ON:
+ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
++ skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT;
+ skb_queue_tail(&dp83640->tx_queue, skb);
+ break;
+
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index d71be15c8c69..73813c7afa49 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -868,8 +868,6 @@ static int m88e1510_config_init(struct phy_device *phydev)
+
+ /* SGMII-to-Copper mode initialization */
+ if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
+- u32 pause;
+-
+ /* Select page 18 */
+ err = marvell_set_page(phydev, 18);
+ if (err < 0)
+@@ -892,16 +890,6 @@ static int m88e1510_config_init(struct phy_device *phydev)
+ err = marvell_set_page(phydev, MII_MARVELL_COPPER_PAGE);
+ if (err < 0)
+ return err;
+-
+- /* There appears to be a bug in the 88e1512 when used in
+- * SGMII to copper mode, where the AN advertisement register
+- * clears the pause bits each time a negotiation occurs.
+- * This means we can never be truely sure what was advertised,
+- * so disable Pause support.
+- */
+- pause = SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+- phydev->supported &= ~pause;
+- phydev->advertising &= ~pause;
+ }
+
+ return m88e1318_config_init(phydev);
+diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
+index f2d01cb6f958..6e971628bb50 100644
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -1295,6 +1295,7 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ dev->net->features |= NETIF_F_RXCSUM;
+
+ dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
++ set_bit(EVENT_NO_IP_ALIGN, &dev->flags);
+
+ smsc95xx_init_mac_address(dev);
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 42feaa4d2916..c88ee376a2eb 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -502,6 +502,8 @@ static int virtnet_xdp_xmit(struct net_device *dev,
+ struct bpf_prog *xdp_prog;
+ struct send_queue *sq;
+ unsigned int len;
++ int packets = 0;
++ int bytes = 0;
+ int drops = 0;
+ int kicks = 0;
+ int ret, err;
+@@ -525,10 +527,18 @@ static int virtnet_xdp_xmit(struct net_device *dev,
+
+ /* Free up any pending old buffers before queueing new ones. */
+ while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
+- if (likely(is_xdp_frame(ptr)))
+- xdp_return_frame(ptr_to_xdp(ptr));
+- else
+- napi_consume_skb(ptr, false);
++ if (likely(is_xdp_frame(ptr))) {
++ struct xdp_frame *frame = ptr_to_xdp(ptr);
++
++ bytes += frame->len;
++ xdp_return_frame(frame);
++ } else {
++ struct sk_buff *skb = ptr;
++
++ bytes += skb->len;
++ napi_consume_skb(skb, false);
++ }
++ packets++;
+ }
+
+ for (i = 0; i < n; i++) {
+@@ -548,6 +558,8 @@ static int virtnet_xdp_xmit(struct net_device *dev,
+ }
+ out:
+ u64_stats_update_begin(&sq->stats.syncp);
++ sq->stats.bytes += bytes;
++ sq->stats.packets += packets;
+ sq->stats.xdp_tx += n;
+ sq->stats.xdp_tx_drops += drops;
+ sq->stats.kicks += kicks;
+diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
+index c40cd129afe7..5210cffb5344 100644
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -532,6 +532,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .hw_ops = &wcn3990_ops,
+ .decap_align_bytes = 1,
+ .num_peers = TARGET_HL_10_TLV_NUM_PEERS,
++ .n_cipher_suites = 8,
+ .ast_skid_limit = TARGET_HL_10_TLV_AST_SKID_LIMIT,
+ .num_wds_entries = TARGET_HL_10_TLV_NUM_WDS_ENTRIES,
+ .target_64bit = true,
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 21ba20981a80..0fca44e91a71 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -272,7 +272,7 @@ struct ath_node {
+ #endif
+ u8 key_idx[4];
+
+- u32 ackto;
++ int ackto;
+ struct list_head list;
+ };
+
+diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
+index 7334c9b09e82..6e236a485431 100644
+--- a/drivers/net/wireless/ath/ath9k/dynack.c
++++ b/drivers/net/wireless/ath/ath9k/dynack.c
+@@ -29,9 +29,13 @@
+ * ath_dynack_ewma - EWMA (Exponentially Weighted Moving Average) calculation
+ *
+ */
+-static inline u32 ath_dynack_ewma(u32 old, u32 new)
++static inline int ath_dynack_ewma(int old, int new)
+ {
+- return (new * (EWMA_DIV - EWMA_LEVEL) + old * EWMA_LEVEL) / EWMA_DIV;
++ if (old > 0)
++ return (new * (EWMA_DIV - EWMA_LEVEL) +
++ old * EWMA_LEVEL) / EWMA_DIV;
++ else
++ return new;
+ }
+
+ /**
+@@ -82,10 +86,10 @@ static inline bool ath_dynack_bssidmask(struct ath_hw *ah, const u8 *mac)
+ */
+ static void ath_dynack_compute_ackto(struct ath_hw *ah)
+ {
+- struct ath_node *an;
+- u32 to = 0;
+- struct ath_dynack *da = &ah->dynack;
+ struct ath_common *common = ath9k_hw_common(ah);
++ struct ath_dynack *da = &ah->dynack;
++ struct ath_node *an;
++ int to = 0;
+
+ list_for_each_entry(an, &da->nodes, list)
+ if (an->ackto > to)
+@@ -144,7 +148,8 @@ static void ath_dynack_compute_to(struct ath_hw *ah)
+ an->ackto = ath_dynack_ewma(an->ackto,
+ ackto);
+ ath_dbg(ath9k_hw_common(ah), DYNACK,
+- "%pM to %u\n", dst, an->ackto);
++ "%pM to %d [%u]\n", dst,
++ an->ackto, ackto);
+ if (time_is_before_jiffies(da->lto)) {
+ ath_dynack_compute_ackto(ah);
+ da->lto = jiffies + COMPUTE_TO;
+@@ -166,10 +171,12 @@ static void ath_dynack_compute_to(struct ath_hw *ah)
+ * @ah: ath hw
+ * @skb: socket buffer
+ * @ts: tx status info
++ * @sta: station pointer
+ *
+ */
+ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
+- struct ath_tx_status *ts)
++ struct ath_tx_status *ts,
++ struct ieee80211_sta *sta)
+ {
+ u8 ridx;
+ struct ieee80211_hdr *hdr;
+@@ -177,7 +184,7 @@ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
+ struct ath_common *common = ath9k_hw_common(ah);
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+- if ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !da->enabled)
++ if (!da->enabled || (info->flags & IEEE80211_TX_CTL_NO_ACK))
+ return;
+
+ spin_lock_bh(&da->qlock);
+@@ -187,11 +194,19 @@ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
+ /* late ACK */
+ if (ts->ts_status & ATH9K_TXERR_XRETRY) {
+ if (ieee80211_is_assoc_req(hdr->frame_control) ||
+- ieee80211_is_assoc_resp(hdr->frame_control)) {
++ ieee80211_is_assoc_resp(hdr->frame_control) ||
++ ieee80211_is_auth(hdr->frame_control)) {
+ ath_dbg(common, DYNACK, "late ack\n");
++
+ ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2);
+ ath9k_hw_set_ack_timeout(ah, LATEACK_TO);
+ ath9k_hw_set_cts_timeout(ah, LATEACK_TO);
++ if (sta) {
++ struct ath_node *an;
++
++ an = (struct ath_node *)sta->drv_priv;
++ an->ackto = -1;
++ }
+ da->lto = jiffies + LATEACK_DELAY;
+ }
+
+@@ -251,7 +266,7 @@ void ath_dynack_sample_ack_ts(struct ath_hw *ah, struct sk_buff *skb,
+ struct ath_common *common = ath9k_hw_common(ah);
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+
+- if (!ath_dynack_bssidmask(ah, hdr->addr1) || !da->enabled)
++ if (!da->enabled || !ath_dynack_bssidmask(ah, hdr->addr1))
+ return;
+
+ spin_lock_bh(&da->qlock);
+diff --git a/drivers/net/wireless/ath/ath9k/dynack.h b/drivers/net/wireless/ath/ath9k/dynack.h
+index 6d7bef976742..cf60224d40df 100644
+--- a/drivers/net/wireless/ath/ath9k/dynack.h
++++ b/drivers/net/wireless/ath/ath9k/dynack.h
+@@ -86,7 +86,8 @@ void ath_dynack_node_deinit(struct ath_hw *ah, struct ath_node *an);
+ void ath_dynack_init(struct ath_hw *ah);
+ void ath_dynack_sample_ack_ts(struct ath_hw *ah, struct sk_buff *skb, u32 ts);
+ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
+- struct ath_tx_status *ts);
++ struct ath_tx_status *ts,
++ struct ieee80211_sta *sta);
+ #else
+ static inline void ath_dynack_init(struct ath_hw *ah) {}
+ static inline void ath_dynack_node_init(struct ath_hw *ah,
+@@ -97,7 +98,8 @@ static inline void ath_dynack_sample_ack_ts(struct ath_hw *ah,
+ struct sk_buff *skb, u32 ts) {}
+ static inline void ath_dynack_sample_tx_ts(struct ath_hw *ah,
+ struct sk_buff *skb,
+- struct ath_tx_status *ts) {}
++ struct ath_tx_status *ts,
++ struct ieee80211_sta *sta) {}
+ #endif
+
+ #endif /* DYNACK_H */
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 43b6c8508e49..4b7a7fc2a0fe 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -629,7 +629,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
+ if (bf == bf->bf_lastbf)
+ ath_dynack_sample_tx_ts(sc->sc_ah,
+ bf->bf_mpdu,
+- ts);
++ ts, sta);
+ }
+
+ ath_tx_complete_buf(sc, bf, txq, &bf_head, sta, ts,
+@@ -773,7 +773,8 @@ static void ath_tx_process_buffer(struct ath_softc *sc, struct ath_txq *txq,
+ memcpy(info->control.rates, bf->rates,
+ sizeof(info->control.rates));
+ ath_tx_rc_status(sc, bf, ts, 1, txok ? 0 : 1, txok);
+- ath_dynack_sample_tx_ts(sc->sc_ah, bf->bf_mpdu, ts);
++ ath_dynack_sample_tx_ts(sc->sc_ah, bf->bf_mpdu, ts,
++ sta);
+ }
+ ath_tx_complete_buf(sc, bf, txq, bf_head, sta, ts, txok);
+ } else
+diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
+index 7debed6bec06..a0fe8cbad104 100644
+--- a/drivers/net/wireless/ath/wil6210/main.c
++++ b/drivers/net/wireless/ath/wil6210/main.c
+@@ -995,10 +995,13 @@ static int wil_target_reset(struct wil6210_priv *wil, int no_flash)
+
+ wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->hw_name);
+
+- /* Clear MAC link up */
+- wil_s(wil, RGF_HP_CTRL, BIT(15));
+- wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_HPAL_PERST_FROM_PAD);
+- wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_CAR_PERST_RST);
++ if (wil->hw_version < HW_VER_TALYN) {
++ /* Clear MAC link up */
++ wil_s(wil, RGF_HP_CTRL, BIT(15));
++ wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0,
++ BIT_HPAL_PERST_FROM_PAD);
++ wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_CAR_PERST_RST);
++ }
+
+ wil_halt_cpu(wil);
+
+diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
+index 6a7943e487fb..75c8aa297107 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx.c
++++ b/drivers/net/wireless/ath/wil6210/txrx.c
+@@ -1313,6 +1313,8 @@ found:
+ wil_dbg_txrx(wil, "BCAST DUP -> ring %d\n", i);
+ wil_set_da_for_vring(wil, skb2, i);
+ wil_tx_ring(wil, vif, v2, skb2);
++ /* successful call to wil_tx_ring takes skb2 ref */
++ dev_kfree_skb_any(skb2);
+ } else {
+ wil_err(wil, "skb_copy failed\n");
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h b/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h
+index 55594c93b014..47dbd2d3e3b4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h
+@@ -442,7 +442,7 @@ struct iwl_he_backoff_conf {
+ * Support for Nss x BW (or RU) matrix:
+ * (0=SISO, 1=MIMO2) x (0-20MHz, 1-40MHz, 2-80MHz, 3-160MHz)
+ * Each entry contains 2 QAM thresholds for 8us and 16us:
+- * 0=BPSK, 1=QPSK, 2=16QAM, 3=64QAM, 4=256QAM, 5=1024QAM, 6/7=RES
++ * 0=BPSK, 1=QPSK, 2=16QAM, 3=64QAM, 4=256QAM, 5=1024QAM, 6=RES, 7=NONE
+ * i.e. QAM_th1 < QAM_th2 such if TX uses QAM_tx:
+ * QAM_tx < QAM_th1 --> PPE=0us
+ * QAM_th1 <= QAM_tx < QAM_th2 --> PPE=8us
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 9a764af30f36..0f357e8c4f94 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -1997,7 +1997,13 @@ static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
+ if (sta->he_cap.he_cap_elem.mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR)
+ sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BQR_SUPP);
+
+- /* If PPE Thresholds exist, parse them into a FW-familiar format */
++ /*
++ * Initialize the PPE thresholds to "None" (7), as described in Table
++ * 9-262ac of 80211.ax/D3.0.
++ */
++ memset(&sta_ctxt_cmd.pkt_ext, 7, sizeof(sta_ctxt_cmd.pkt_ext));
++
++ /* If PPE Thresholds exist, parse them into a FW-familiar format. */
+ if (sta->he_cap.he_cap_elem.phy_cap_info[6] &
+ IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
+ u8 nss = (sta->he_cap.ppe_thres[0] &
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
+index 8169d1450b3b..d1c1a8069c7e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
+@@ -98,8 +98,12 @@ static u8 rs_fw_sgi_cw_support(struct ieee80211_sta *sta)
+ {
+ struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
+ struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
++ struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
+ u8 supp = 0;
+
++ if (he_cap && he_cap->has_he)
++ return 0;
++
+ if (ht_cap->cap & IEEE80211_HT_CAP_SGI_20)
+ supp |= BIT(IWL_TLC_MNG_CH_WIDTH_20MHZ);
+ if (ht_cap->cap & IEEE80211_HT_CAP_SGI_40)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_dfs.c b/drivers/net/wireless/mediatek/mt76/mt76x2_dfs.c
+index 374cc655c11d..16e6b6970e28 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_dfs.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_dfs.c
+@@ -799,7 +799,7 @@ static void mt76x2_dfs_set_bbp_params(struct mt76x2_dev *dev)
+
+ /* enable detection*/
+ mt76_wr(dev, MT_BBP(DFS, 0), MT_DFS_CH_EN << 16);
+- mt76_wr(dev, 0x212c, 0x0c350001);
++ mt76_wr(dev, MT_BBP(IBI, 11), 0x0c350001);
+ }
+
+ void mt76x2_dfs_adjust_agc(struct mt76x2_dev *dev)
+@@ -842,7 +842,11 @@ void mt76x2_dfs_init_params(struct mt76x2_dev *dev)
+ mt76_wr(dev, MT_BBP(DFS, 0), 0);
+ /* clear detector status */
+ mt76_wr(dev, MT_BBP(DFS, 1), 0xf);
+- mt76_wr(dev, 0x212c, 0);
++ if (mt76_chip(&dev->mt76) == 0x7610 ||
++ mt76_chip(&dev->mt76) == 0x7630)
++ mt76_wr(dev, MT_BBP(IBI, 11), 0xfde8081);
++ else
++ mt76_wr(dev, MT_BBP(IBI, 11), 0);
+
+ mt76x2_irq_disable(dev, MT_INT_GPTIMER);
+ mt76_rmw_field(dev, MT_INT_TIMER_EN,
+diff --git a/drivers/net/wireless/st/cw1200/scan.c b/drivers/net/wireless/st/cw1200/scan.c
+index 67213f11acbd..0a9eac93dd01 100644
+--- a/drivers/net/wireless/st/cw1200/scan.c
++++ b/drivers/net/wireless/st/cw1200/scan.c
+@@ -78,6 +78,10 @@ int cw1200_hw_scan(struct ieee80211_hw *hw,
+ if (req->n_ssids > WSM_SCAN_MAX_NUM_OF_SSIDS)
+ return -EINVAL;
+
++ /* will be unlocked in cw1200_scan_work() */
++ down(&priv->scan.lock);
++ mutex_lock(&priv->conf_mutex);
++
+ frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
+ req->ie_len);
+ if (!frame.skb)
+@@ -86,19 +90,15 @@ int cw1200_hw_scan(struct ieee80211_hw *hw,
+ if (req->ie_len)
+ skb_put_data(frame.skb, req->ie, req->ie_len);
+
+- /* will be unlocked in cw1200_scan_work() */
+- down(&priv->scan.lock);
+- mutex_lock(&priv->conf_mutex);
+-
+ ret = wsm_set_template_frame(priv, &frame);
+ if (!ret) {
+ /* Host want to be the probe responder. */
+ ret = wsm_set_probe_responder(priv, true);
+ }
+ if (ret) {
++ dev_kfree_skb(frame.skb);
+ mutex_unlock(&priv->conf_mutex);
+ up(&priv->scan.lock);
+- dev_kfree_skb(frame.skb);
+ return ret;
+ }
+
+@@ -120,10 +120,9 @@ int cw1200_hw_scan(struct ieee80211_hw *hw,
+ ++priv->scan.n_ssids;
+ }
+
+- mutex_unlock(&priv->conf_mutex);
+-
+ if (frame.skb)
+ dev_kfree_skb(frame.skb);
++ mutex_unlock(&priv->conf_mutex);
+ queue_work(priv->workqueue, &priv->scan.work);
+ return 0;
+ }
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 31ff03dbeb83..f3433bf47b10 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -191,12 +191,12 @@ unsigned long dev_pm_opp_get_max_volt_latency(struct device *dev)
+ if (IS_ERR(opp_table))
+ return 0;
+
+- count = opp_table->regulator_count;
+-
+ /* Regulator may not be required for the device */
+- if (!count)
++ if (!opp_table->regulators)
+ goto put_opp_table;
+
++ count = opp_table->regulator_count;
++
+ uV = kmalloc_array(count, sizeof(*uV), GFP_KERNEL);
+ if (!uV)
+ goto put_opp_table;
+@@ -976,6 +976,9 @@ static bool _opp_supported_by_regulators(struct dev_pm_opp *opp,
+ struct regulator *reg;
+ int i;
+
++ if (!opp_table->regulators)
++ return true;
++
+ for (i = 0; i < opp_table->regulator_count; i++) {
+ reg = opp_table->regulators[i];
+
+@@ -1263,7 +1266,7 @@ static int _allocate_set_opp_data(struct opp_table *opp_table)
+ struct dev_pm_set_opp_data *data;
+ int len, count = opp_table->regulator_count;
+
+- if (WARN_ON(!count))
++ if (WARN_ON(!opp_table->regulators))
+ return -EINVAL;
+
+ /* space for set_opp_data */
+diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
+index 975050a69494..3826b444298c 100644
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -66,6 +66,7 @@ struct imx6_pcie {
+ #define PHY_PLL_LOCK_WAIT_USLEEP_MAX 200
+
+ /* PCIe Root Complex registers (memory-mapped) */
++#define PCIE_RC_IMX6_MSI_CAP 0x50
+ #define PCIE_RC_LCR 0x7c
+ #define PCIE_RC_LCR_MAX_LINK_SPEEDS_GEN1 0x1
+ #define PCIE_RC_LCR_MAX_LINK_SPEEDS_GEN2 0x2
+@@ -682,6 +683,7 @@ static int imx6_pcie_probe(struct platform_device *pdev)
+ struct resource *dbi_base;
+ struct device_node *node = dev->of_node;
+ int ret;
++ u16 val;
+
+ imx6_pcie = devm_kzalloc(dev, sizeof(*imx6_pcie), GFP_KERNEL);
+ if (!imx6_pcie)
+@@ -816,6 +818,14 @@ static int imx6_pcie_probe(struct platform_device *pdev)
+ if (ret < 0)
+ return ret;
+
++ if (pci_msi_enabled()) {
++ val = dw_pcie_readw_dbi(pci, PCIE_RC_IMX6_MSI_CAP +
++ PCI_MSI_FLAGS);
++ val |= PCI_MSI_FLAGS_ENABLE;
++ dw_pcie_writew_dbi(pci, PCIE_RC_IMX6_MSI_CAP + PCI_MSI_FLAGS,
++ val);
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index 54a8b30dda38..37d0c15c9eeb 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -800,6 +800,7 @@ static int ioctl_event_ctl(struct switchtec_dev *stdev,
+ {
+ int ret;
+ int nr_idxs;
++ unsigned int event_flags;
+ struct switchtec_ioctl_event_ctl ctl;
+
+ if (copy_from_user(&ctl, uctl, sizeof(ctl)))
+@@ -821,7 +822,9 @@ static int ioctl_event_ctl(struct switchtec_dev *stdev,
+ else
+ return -EINVAL;
+
++ event_flags = ctl.flags;
+ for (ctl.index = 0; ctl.index < nr_idxs; ctl.index++) {
++ ctl.flags = event_flags;
+ ret = event_ctl(stdev, &ctl);
+ if (ret < 0)
+ return ret;
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index 54ec278d2fc4..e1a77b2de78a 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -927,6 +927,11 @@ static int arm_spe_pmu_perf_init(struct arm_spe_pmu *spe_pmu)
+
+ idx = atomic_inc_return(&pmu_idx);
+ name = devm_kasprintf(dev, GFP_KERNEL, "%s_%d", PMUNAME, idx);
++ if (!name) {
++ dev_err(dev, "failed to allocate name for pmu %d\n", idx);
++ return -ENOMEM;
++ }
++
+ return perf_pmu_register(&spe_pmu->pmu, name, -1);
+ }
+
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index d4dcd39b8d76..881078ff73f6 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -126,6 +126,7 @@ struct sun4i_usb_phy_cfg {
+ bool dedicated_clocks;
+ bool enable_pmu_unk1;
+ bool phy0_dual_route;
++ int missing_phys;
+ };
+
+ struct sun4i_usb_phy_data {
+@@ -646,6 +647,9 @@ static struct phy *sun4i_usb_phy_xlate(struct device *dev,
+ if (args->args[0] >= data->cfg->num_phys)
+ return ERR_PTR(-ENODEV);
+
++ if (data->cfg->missing_phys & BIT(args->args[0]))
++ return ERR_PTR(-ENODEV);
++
+ return data->phys[args->args[0]].phy;
+ }
+
+@@ -741,6 +745,9 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
+ struct sun4i_usb_phy *phy = data->phys + i;
+ char name[16];
+
++ if (data->cfg->missing_phys & BIT(i))
++ continue;
++
+ snprintf(name, sizeof(name), "usb%d_vbus", i);
+ phy->vbus = devm_regulator_get_optional(dev, name);
+ if (IS_ERR(phy->vbus)) {
+diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+index fa530913a2c8..08925d24180b 100644
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -90,7 +90,7 @@ struct bcm2835_pinctrl {
+ struct gpio_chip gpio_chip;
+ struct pinctrl_gpio_range gpio_range;
+
+- spinlock_t irq_lock[BCM2835_NUM_BANKS];
++ raw_spinlock_t irq_lock[BCM2835_NUM_BANKS];
+ };
+
+ /* pins are just named GPIO0..GPIO53 */
+@@ -461,10 +461,10 @@ static void bcm2835_gpio_irq_enable(struct irq_data *data)
+ unsigned bank = GPIO_REG_OFFSET(gpio);
+ unsigned long flags;
+
+- spin_lock_irqsave(&pc->irq_lock[bank], flags);
++ raw_spin_lock_irqsave(&pc->irq_lock[bank], flags);
+ set_bit(offset, &pc->enabled_irq_map[bank]);
+ bcm2835_gpio_irq_config(pc, gpio, true);
+- spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
++ raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
+ }
+
+ static void bcm2835_gpio_irq_disable(struct irq_data *data)
+@@ -476,12 +476,12 @@ static void bcm2835_gpio_irq_disable(struct irq_data *data)
+ unsigned bank = GPIO_REG_OFFSET(gpio);
+ unsigned long flags;
+
+- spin_lock_irqsave(&pc->irq_lock[bank], flags);
++ raw_spin_lock_irqsave(&pc->irq_lock[bank], flags);
+ bcm2835_gpio_irq_config(pc, gpio, false);
+ /* Clear events that were latched prior to clearing event sources */
+ bcm2835_gpio_set_bit(pc, GPEDS0, gpio);
+ clear_bit(offset, &pc->enabled_irq_map[bank]);
+- spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
++ raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
+ }
+
+ static int __bcm2835_gpio_irq_set_type_disabled(struct bcm2835_pinctrl *pc,
+@@ -584,7 +584,7 @@ static int bcm2835_gpio_irq_set_type(struct irq_data *data, unsigned int type)
+ unsigned long flags;
+ int ret;
+
+- spin_lock_irqsave(&pc->irq_lock[bank], flags);
++ raw_spin_lock_irqsave(&pc->irq_lock[bank], flags);
+
+ if (test_bit(offset, &pc->enabled_irq_map[bank]))
+ ret = __bcm2835_gpio_irq_set_type_enabled(pc, gpio, type);
+@@ -596,7 +596,7 @@ static int bcm2835_gpio_irq_set_type(struct irq_data *data, unsigned int type)
+ else
+ irq_set_handler_locked(data, handle_level_irq);
+
+- spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
++ raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
+
+ return ret;
+ }
+@@ -1047,7 +1047,7 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
+ for_each_set_bit(offset, &events, 32)
+ bcm2835_gpio_wr(pc, GPEDS0 + i * 4, BIT(offset));
+
+- spin_lock_init(&pc->irq_lock[i]);
++ raw_spin_lock_init(&pc->irq_lock[i]);
+ }
+
+ err = gpiochip_add_data(&pc->gpio_chip, pc);
+diff --git a/drivers/pinctrl/meson/pinctrl-meson8.c b/drivers/pinctrl/meson/pinctrl-meson8.c
+index 86466173114d..e482672e833a 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson8.c
++++ b/drivers/pinctrl/meson/pinctrl-meson8.c
+@@ -807,7 +807,9 @@ static const char * const gpio_groups[] = {
+ "BOOT_5", "BOOT_6", "BOOT_7", "BOOT_8", "BOOT_9",
+ "BOOT_10", "BOOT_11", "BOOT_12", "BOOT_13", "BOOT_14",
+ "BOOT_15", "BOOT_16", "BOOT_17", "BOOT_18",
++};
+
++static const char * const gpio_aobus_groups[] = {
+ "GPIOAO_0", "GPIOAO_1", "GPIOAO_2", "GPIOAO_3",
+ "GPIOAO_4", "GPIOAO_5", "GPIOAO_6", "GPIOAO_7",
+ "GPIOAO_8", "GPIOAO_9", "GPIOAO_10", "GPIOAO_11",
+@@ -1030,6 +1032,7 @@ static struct meson_pmx_func meson8_cbus_functions[] = {
+ };
+
+ static struct meson_pmx_func meson8_aobus_functions[] = {
++ FUNCTION(gpio_aobus),
+ FUNCTION(uart_ao),
+ FUNCTION(remote),
+ FUNCTION(i2c_slave_ao),
+diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
+index 647ad15d5c3c..91cffc051055 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
+@@ -646,16 +646,18 @@ static const char * const gpio_groups[] = {
+ "BOOT_10", "BOOT_11", "BOOT_12", "BOOT_13", "BOOT_14",
+ "BOOT_15", "BOOT_16", "BOOT_17", "BOOT_18",
+
+- "GPIOAO_0", "GPIOAO_1", "GPIOAO_2", "GPIOAO_3",
+- "GPIOAO_4", "GPIOAO_5", "GPIOAO_6", "GPIOAO_7",
+- "GPIOAO_8", "GPIOAO_9", "GPIOAO_10", "GPIOAO_11",
+- "GPIOAO_12", "GPIOAO_13", "GPIO_BSD_EN", "GPIO_TEST_N",
+-
+ "DIF_0_P", "DIF_0_N", "DIF_1_P", "DIF_1_N",
+ "DIF_2_P", "DIF_2_N", "DIF_3_P", "DIF_3_N",
+ "DIF_4_P", "DIF_4_N"
+ };
+
++static const char * const gpio_aobus_groups[] = {
++ "GPIOAO_0", "GPIOAO_1", "GPIOAO_2", "GPIOAO_3",
++ "GPIOAO_4", "GPIOAO_5", "GPIOAO_6", "GPIOAO_7",
++ "GPIOAO_8", "GPIOAO_9", "GPIOAO_10", "GPIOAO_11",
++ "GPIOAO_12", "GPIOAO_13", "GPIO_BSD_EN", "GPIO_TEST_N"
++};
++
+ static const char * const sd_a_groups[] = {
+ "sd_d0_a", "sd_d1_a", "sd_d2_a", "sd_d3_a", "sd_clk_a",
+ "sd_cmd_a"
+@@ -871,6 +873,7 @@ static struct meson_pmx_func meson8b_cbus_functions[] = {
+ };
+
+ static struct meson_pmx_func meson8b_aobus_functions[] = {
++ FUNCTION(gpio_aobus),
+ FUNCTION(uart_ao),
+ FUNCTION(uart_ao_b),
+ FUNCTION(i2c_slave_ao),
+diff --git a/drivers/pinctrl/pinctrl-sx150x.c b/drivers/pinctrl/pinctrl-sx150x.c
+index cbf58a10113d..4d87d75b9c6e 100644
+--- a/drivers/pinctrl/pinctrl-sx150x.c
++++ b/drivers/pinctrl/pinctrl-sx150x.c
+@@ -1166,7 +1166,6 @@ static int sx150x_probe(struct i2c_client *client,
+ }
+
+ /* Register GPIO controller */
+- pctl->gpio.label = devm_kstrdup(dev, client->name, GFP_KERNEL);
+ pctl->gpio.base = -1;
+ pctl->gpio.ngpio = pctl->data->npins;
+ pctl->gpio.get_direction = sx150x_gpio_get_direction;
+@@ -1180,6 +1179,10 @@ static int sx150x_probe(struct i2c_client *client,
+ pctl->gpio.of_node = dev->of_node;
+ #endif
+ pctl->gpio.can_sleep = true;
++ pctl->gpio.label = devm_kstrdup(dev, client->name, GFP_KERNEL);
++ if (!pctl->gpio.label)
++ return -ENOMEM;
++
+ /*
+ * Setting multiple pins is not safe when all pins are not
+ * handled by the same regmap register. The oscio pin (present
+@@ -1200,13 +1203,15 @@ static int sx150x_probe(struct i2c_client *client,
+
+ /* Add Interrupt support if an irq is specified */
+ if (client->irq > 0) {
+- pctl->irq_chip.name = devm_kstrdup(dev, client->name,
+- GFP_KERNEL);
+ pctl->irq_chip.irq_mask = sx150x_irq_mask;
+ pctl->irq_chip.irq_unmask = sx150x_irq_unmask;
+ pctl->irq_chip.irq_set_type = sx150x_irq_set_type;
+ pctl->irq_chip.irq_bus_lock = sx150x_irq_bus_lock;
+ pctl->irq_chip.irq_bus_sync_unlock = sx150x_irq_bus_sync_unlock;
++ pctl->irq_chip.name = devm_kstrdup(dev, client->name,
++ GFP_KERNEL);
++ if (!pctl->irq_chip.name)
++ return -ENOMEM;
+
+ pctl->irq.masked = ~0;
+ pctl->irq.sense = 0;
+diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
+index b6fd4838f60f..e5d5b1adb5a9 100644
+--- a/drivers/platform/chrome/cros_ec_proto.c
++++ b/drivers/platform/chrome/cros_ec_proto.c
+@@ -575,6 +575,7 @@ static int get_keyboard_state_event(struct cros_ec_device *ec_dev)
+
+ int cros_ec_get_next_event(struct cros_ec_device *ec_dev, bool *wake_event)
+ {
++ u8 event_type;
+ u32 host_event;
+ int ret;
+
+@@ -594,11 +595,22 @@ int cros_ec_get_next_event(struct cros_ec_device *ec_dev, bool *wake_event)
+ return ret;
+
+ if (wake_event) {
++ event_type = ec_dev->event_data.event_type;
+ host_event = cros_ec_get_host_event(ec_dev);
+
+- /* Consider non-host_event as wake event */
+- *wake_event = !host_event ||
+- !!(host_event & ec_dev->host_event_wake_mask);
++ /*
++ * Sensor events need to be parsed by the sensor sub-device.
++ * Defer them, and don't report the wakeup here.
++ */
++ if (event_type == EC_MKBP_EVENT_SENSOR_FIFO)
++ *wake_event = false;
++ /* Masked host-events should not count as wake events. */
++ else if (host_event &&
++ !(host_event & ec_dev->host_event_wake_mask))
++ *wake_event = false;
++ /* Consider all other events as wake events. */
++ else
++ *wake_event = true;
+ }
+
+ return ret;
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index d89936c93ba0..78b4aa4410fb 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -83,12 +83,12 @@
+ #define MLXPLAT_CPLD_LPC_REG_TACHO4_OFFSET 0xe7
+ #define MLXPLAT_CPLD_LPC_REG_TACHO5_OFFSET 0xe8
+ #define MLXPLAT_CPLD_LPC_REG_TACHO6_OFFSET 0xe9
+-#define MLXPLAT_CPLD_LPC_REG_TACHO7_OFFSET 0xea
+-#define MLXPLAT_CPLD_LPC_REG_TACHO8_OFFSET 0xeb
+-#define MLXPLAT_CPLD_LPC_REG_TACHO9_OFFSET 0xec
+-#define MLXPLAT_CPLD_LPC_REG_TACHO10_OFFSET 0xed
+-#define MLXPLAT_CPLD_LPC_REG_TACHO11_OFFSET 0xee
+-#define MLXPLAT_CPLD_LPC_REG_TACHO12_OFFSET 0xef
++#define MLXPLAT_CPLD_LPC_REG_TACHO7_OFFSET 0xeb
++#define MLXPLAT_CPLD_LPC_REG_TACHO8_OFFSET 0xec
++#define MLXPLAT_CPLD_LPC_REG_TACHO9_OFFSET 0xed
++#define MLXPLAT_CPLD_LPC_REG_TACHO10_OFFSET 0xee
++#define MLXPLAT_CPLD_LPC_REG_TACHO11_OFFSET 0xef
++#define MLXPLAT_CPLD_LPC_REG_TACHO12_OFFSET 0xf0
+ #define MLXPLAT_CPLD_LPC_IO_RANGE 0x100
+ #define MLXPLAT_CPLD_LPC_I2C_CH1_OFF 0xdb
+ #define MLXPLAT_CPLD_LPC_I2C_CH2_OFF 0xda
+diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
+index 2012551d93e0..796eeffdf93b 100644
+--- a/drivers/ptp/ptp_chardev.c
++++ b/drivers/ptp/ptp_chardev.c
+@@ -228,7 +228,9 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
+ pct->sec = ts.tv_sec;
+ pct->nsec = ts.tv_nsec;
+ pct++;
+- ptp->info->gettime64(ptp->info, &ts);
++ err = ptp->info->gettime64(ptp->info, &ts);
++ if (err)
++ goto out;
+ pct->sec = ts.tv_sec;
+ pct->nsec = ts.tv_nsec;
+ pct++;
+@@ -281,6 +283,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
+ break;
+ }
+
++out:
+ kfree(sysoff);
+ return err;
+ }
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index 7eacc1c4b3b1..c64903a5978f 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -253,8 +253,10 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
+ ptp->dev = device_create_with_groups(ptp_class, parent, ptp->devid,
+ ptp, ptp->pin_attr_groups,
+ "ptp%d", ptp->index);
+- if (IS_ERR(ptp->dev))
++ if (IS_ERR(ptp->dev)) {
++ err = PTR_ERR(ptp->dev);
+ goto no_device;
++ }
+
+ /* Register a new PPS source. */
+ if (info->pps) {
+@@ -265,6 +267,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
+ pps.owner = info->owner;
+ ptp->pps_source = pps_register_source(&pps, PTP_PPS_DEFAULTS);
+ if (!ptp->pps_source) {
++ err = -EINVAL;
+ pr_err("failed to register pps source\n");
+ goto no_pps;
+ }
+diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h
+index 6f7ebc1dbe10..2e1a27bd97d1 100644
+--- a/drivers/s390/crypto/zcrypt_error.h
++++ b/drivers/s390/crypto/zcrypt_error.h
+@@ -52,6 +52,7 @@ struct error_hdr {
+ #define REP82_ERROR_FORMAT_FIELD 0x29
+ #define REP82_ERROR_INVALID_COMMAND 0x30
+ #define REP82_ERROR_MALFORMED_MSG 0x40
++#define REP82_ERROR_INVALID_SPECIAL_CMD 0x41
+ #define REP82_ERROR_INVALID_DOMAIN_PRECHECK 0x42
+ #define REP82_ERROR_RESERVED_FIELDO 0x50 /* old value */
+ #define REP82_ERROR_WORD_ALIGNMENT 0x60
+@@ -90,6 +91,7 @@ static inline int convert_error(struct zcrypt_queue *zq,
+ case REP88_ERROR_MESSAGE_MALFORMD:
+ case REP82_ERROR_INVALID_DOMAIN_PRECHECK:
+ case REP82_ERROR_INVALID_DOMAIN_PENDING:
++ case REP82_ERROR_INVALID_SPECIAL_CMD:
+ // REP88_ERROR_INVALID_KEY // '82' CEX2A
+ // REP88_ERROR_OPERAND // '84' CEX2A
+ // REP88_ERROR_OPERAND_EVEN_MOD // '85' CEX2A
+diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
+index 1391e5f35918..702da909cee5 100644
+--- a/drivers/scsi/aic94xx/aic94xx_init.c
++++ b/drivers/scsi/aic94xx/aic94xx_init.c
+@@ -281,7 +281,7 @@ static ssize_t asd_show_dev_rev(struct device *dev,
+ return snprintf(buf, PAGE_SIZE, "%s\n",
+ asd_dev_rev[asd_ha->revision_id]);
+ }
+-static DEVICE_ATTR(revision, S_IRUGO, asd_show_dev_rev, NULL);
++static DEVICE_ATTR(aic_revision, S_IRUGO, asd_show_dev_rev, NULL);
+
+ static ssize_t asd_show_dev_bios_build(struct device *dev,
+ struct device_attribute *attr,char *buf)
+@@ -478,7 +478,7 @@ static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
+ {
+ int err;
+
+- err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_revision);
++ err = device_create_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
+ if (err)
+ return err;
+
+@@ -500,13 +500,13 @@ err_update_bios:
+ err_biosb:
+ device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
+ err_rev:
+- device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
++ device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
+ return err;
+ }
+
+ static void asd_remove_dev_attrs(struct asd_ha_struct *asd_ha)
+ {
+- device_remove_file(&asd_ha->pcidev->dev, &dev_attr_revision);
++ device_remove_file(&asd_ha->pcidev->dev, &dev_attr_aic_revision);
+ device_remove_file(&asd_ha->pcidev->dev, &dev_attr_bios_build);
+ device_remove_file(&asd_ha->pcidev->dev, &dev_attr_pcba_sn);
+ device_remove_file(&asd_ha->pcidev->dev, &dev_attr_update_bios);
+diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c
+index 6637116529aa..f987c40c47a1 100644
+--- a/drivers/scsi/cxlflash/main.c
++++ b/drivers/scsi/cxlflash/main.c
+@@ -3694,6 +3694,7 @@ static int cxlflash_probe(struct pci_dev *pdev,
+ host->max_cmd_len = CXLFLASH_MAX_CDB_LEN;
+
+ cfg = shost_priv(host);
++ cfg->state = STATE_PROBING;
+ cfg->host = host;
+ rc = alloc_mem(cfg);
+ if (rc) {
+@@ -3782,6 +3783,7 @@ out:
+ return rc;
+
+ out_remove:
++ cfg->state = STATE_PROBED;
+ cxlflash_remove(pdev);
+ goto out;
+ }
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 687ff61bba9f..3922b17e2ea3 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -492,7 +492,7 @@ static void init_reg_v3_hw(struct hisi_hba *hisi_hba)
+ hisi_sas_phy_write32(hisi_hba, i, PHYCTRL_OOB_RESTART_MSK, 0x1);
+ hisi_sas_phy_write32(hisi_hba, i, STP_LINK_TIMER, 0x7f7a120);
+ hisi_sas_phy_write32(hisi_hba, i, CON_CFG_DRIVER, 0x2a0a01);
+-
++ hisi_sas_phy_write32(hisi_hba, i, SAS_SSP_CON_TIMER_CFG, 0x32);
+ /* used for 12G negotiate */
+ hisi_sas_phy_write32(hisi_hba, i, COARSETUNE_TIME, 0x1e);
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 4dda969e947c..0d214e6b8e9a 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -242,6 +242,8 @@ lpfc_prep_els_iocb(struct lpfc_vport *vport, uint8_t expectRsp,
+ icmd->ulpCommand = CMD_ELS_REQUEST64_CR;
+ if (elscmd == ELS_CMD_FLOGI)
+ icmd->ulpTimeout = FF_DEF_RATOV * 2;
++ else if (elscmd == ELS_CMD_LOGO)
++ icmd->ulpTimeout = phba->fc_ratov;
+ else
+ icmd->ulpTimeout = phba->fc_ratov * 2;
+ } else {
+@@ -2682,16 +2684,15 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ goto out;
+ }
+
++ /* The LOGO will not be retried on failure. A LOGO was
++ * issued to the remote rport and a ACC or RJT or no Answer are
++ * all acceptable. Note the failure and move forward with
++ * discovery. The PLOGI will retry.
++ */
+ if (irsp->ulpStatus) {
+- /* Check for retry */
+- if (lpfc_els_retry(phba, cmdiocb, rspiocb)) {
+- /* ELS command is being retried */
+- skip_recovery = 1;
+- goto out;
+- }
+ /* LOGO failed */
+ lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS,
+- "2756 LOGO failure DID:%06X Status:x%x/x%x\n",
++ "2756 LOGO failure, No Retry DID:%06X Status:x%x/x%x\n",
+ ndlp->nlp_DID, irsp->ulpStatus,
+ irsp->un.ulpWord[4]);
+ /* Do not call DSM for lpfc_els_abort'ed ELS cmds */
+@@ -2737,7 +2738,8 @@ out:
+ * For any other port type, the rpi is unregistered as an implicit
+ * LOGO.
+ */
+- if ((ndlp->nlp_type & NLP_FCP_TARGET) && (skip_recovery == 0)) {
++ if (ndlp->nlp_type & (NLP_FCP_TARGET | NLP_NVME_TARGET) &&
++ skip_recovery == 0) {
+ lpfc_cancel_retry_delay_tmo(vport, ndlp);
+ spin_lock_irqsave(shost->host_lock, flags);
+ ndlp->nlp_flag |= NLP_NPR_2B_DISC;
+@@ -2770,6 +2772,8 @@ out:
+ * will be stored into the context1 field of the IOCB for the completion
+ * callback function to the LOGO ELS command.
+ *
++ * Callers of this routine are expected to unregister the RPI first
++ *
+ * Return code
+ * 0 - successfully issued logo
+ * 1 - failed to issue logo
+@@ -2811,22 +2815,6 @@ lpfc_issue_els_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ "Issue LOGO: did:x%x",
+ ndlp->nlp_DID, 0, 0);
+
+- /*
+- * If we are issuing a LOGO, we may try to recover the remote NPort
+- * by issuing a PLOGI later. Even though we issue ELS cmds by the
+- * VPI, if we have a valid RPI, and that RPI gets unreg'ed while
+- * that ELS command is in-flight, the HBA returns a IOERR_INVALID_RPI
+- * for that ELS cmd. To avoid this situation, lets get rid of the
+- * RPI right now, before any ELS cmds are sent.
+- */
+- spin_lock_irq(shost->host_lock);
+- ndlp->nlp_flag |= NLP_ISSUE_LOGO;
+- spin_unlock_irq(shost->host_lock);
+- if (lpfc_unreg_rpi(vport, ndlp)) {
+- lpfc_els_free_iocb(phba, elsiocb);
+- return 0;
+- }
+-
+ phba->fc_stat.elsXmitLOGO++;
+ elsiocb->iocb_cmpl = lpfc_cmpl_els_logo;
+ spin_lock_irq(shost->host_lock);
+@@ -2834,7 +2822,6 @@ lpfc_issue_els_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ ndlp->nlp_flag &= ~NLP_ISSUE_LOGO;
+ spin_unlock_irq(shost->host_lock);
+ rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0);
+-
+ if (rc == IOCB_ERROR) {
+ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag &= ~NLP_LOGO_SND;
+@@ -2842,6 +2829,11 @@ lpfc_issue_els_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ lpfc_els_free_iocb(phba, elsiocb);
+ return 1;
+ }
++
++ spin_lock_irq(shost->host_lock);
++ ndlp->nlp_prev_state = ndlp->nlp_state;
++ spin_unlock_irq(shost->host_lock);
++ lpfc_nlp_set_state(vport, ndlp, NLP_STE_LOGO_ISSUE);
+ return 0;
+ }
+
+@@ -5701,6 +5693,9 @@ error:
+ stat = (struct ls_rjt *)(pcmd + sizeof(uint32_t));
+ stat->un.b.lsRjtRsnCode = LSRJT_UNABLE_TPC;
+
++ if (shdr_add_status == ADD_STATUS_OPERATION_ALREADY_ACTIVE)
++ stat->un.b.lsRjtRsnCodeExp = LSEXP_CMD_IN_PROGRESS;
++
+ elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp;
+ phba->fc_stat.elsXmitLSRJT++;
+ rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0);
+@@ -9502,7 +9497,8 @@ lpfc_sli_abts_recover_port(struct lpfc_vport *vport,
+ "rport in state 0x%x\n", ndlp->nlp_state);
+ return;
+ }
+- lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
++ lpfc_printf_log(phba, KERN_ERR,
++ LOG_ELS | LOG_FCP_ERROR | LOG_NVME_IOERR,
+ "3094 Start rport recovery on shost id 0x%x "
+ "fc_id 0x%06x vpi 0x%x rpi 0x%x state 0x%x "
+ "flags 0x%x\n",
+@@ -9515,8 +9511,8 @@ lpfc_sli_abts_recover_port(struct lpfc_vport *vport,
+ */
+ spin_lock_irqsave(shost->host_lock, flags);
+ ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE;
++ ndlp->nlp_flag |= NLP_ISSUE_LOGO;
+ spin_unlock_irqrestore(shost->host_lock, flags);
+- lpfc_issue_els_logo(vport, ndlp, 0);
+- lpfc_nlp_set_state(vport, ndlp, NLP_STE_LOGO_ISSUE);
++ lpfc_unreg_rpi(vport, ndlp);
+ }
+
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index bd9bce9d9974..a6619fd8238c 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -836,7 +836,9 @@ lpfc_disc_set_adisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
+ struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
+
+ if (!(ndlp->nlp_flag & NLP_RPI_REGISTERED)) {
++ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag &= ~NLP_NPR_ADISC;
++ spin_unlock_irq(shost->host_lock);
+ return 0;
+ }
+
+@@ -851,7 +853,10 @@ lpfc_disc_set_adisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
+ return 1;
+ }
+ }
++
++ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag &= ~NLP_NPR_ADISC;
++ spin_unlock_irq(shost->host_lock);
+ lpfc_unreg_rpi(vport, ndlp);
+ return 0;
+ }
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index 53133cfd420f..622832e55211 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -9809,6 +9809,7 @@ static void scsih_remove(struct pci_dev *pdev)
+
+ /* release all the volumes */
+ _scsih_ir_shutdown(ioc);
++ sas_remove_host(shost);
+ list_for_each_entry_safe(raid_device, next, &ioc->raid_device_list,
+ list) {
+ if (raid_device->starget) {
+@@ -9851,7 +9852,6 @@ static void scsih_remove(struct pci_dev *pdev)
+ ioc->sas_hba.num_phys = 0;
+ }
+
+- sas_remove_host(shost);
+ mpt3sas_base_detach(ioc);
+ spin_lock(&gioc_lock);
+ list_del(&ioc->list);
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index f8cc2677c1cd..20d36061c217 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -834,10 +834,13 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
+ mpt3sas_port->remote_identify.sas_address,
+ mpt3sas_phy->phy_id);
+ mpt3sas_phy->phy_belongs_to_port = 0;
+- sas_port_delete_phy(mpt3sas_port->port, mpt3sas_phy->phy);
++ if (!ioc->remove_host)
++ sas_port_delete_phy(mpt3sas_port->port,
++ mpt3sas_phy->phy);
+ list_del(&mpt3sas_phy->port_siblings);
+ }
+- sas_port_delete(mpt3sas_port->port);
++ if (!ioc->remove_host)
++ sas_port_delete(mpt3sas_port->port);
+ kfree(mpt3sas_port);
+ }
+
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index 8c1a232ac6bf..3781e8109dd7 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -653,6 +653,7 @@ struct bmic_host_wellness_driver_version {
+ u8 driver_version_tag[2];
+ __le16 driver_version_length;
+ char driver_version[32];
++ u8 dont_write_tag[2];
+ u8 end_tag[2];
+ };
+
+@@ -682,6 +683,8 @@ static int pqi_write_driver_version_to_host_wellness(
+ strncpy(buffer->driver_version, "Linux " DRIVER_VERSION,
+ sizeof(buffer->driver_version) - 1);
+ buffer->driver_version[sizeof(buffer->driver_version) - 1] = '\0';
++ buffer->dont_write_tag[0] = 'D';
++ buffer->dont_write_tag[1] = 'W';
+ buffer->end_tag[0] = 'Z';
+ buffer->end_tag[1] = 'Z';
+
+@@ -1181,6 +1184,9 @@ static void pqi_get_volume_status(struct pqi_ctrl_info *ctrl_info,
+ if (rc)
+ goto out;
+
++ if (vpd->page_code != CISS_VPD_LV_STATUS)
++ goto out;
++
+ page_length = offsetof(struct ciss_vpd_logical_volume_status,
+ volume_status) + vpd->page_length;
+ if (page_length < sizeof(*vpd))
+diff --git a/drivers/scsi/smartpqi/smartpqi_sis.c b/drivers/scsi/smartpqi/smartpqi_sis.c
+index 5141bd4c9f06..ca7dfb3a520f 100644
+--- a/drivers/scsi/smartpqi/smartpqi_sis.c
++++ b/drivers/scsi/smartpqi/smartpqi_sis.c
+@@ -59,7 +59,7 @@
+
+ #define SIS_CTRL_KERNEL_UP 0x80
+ #define SIS_CTRL_KERNEL_PANIC 0x100
+-#define SIS_CTRL_READY_TIMEOUT_SECS 30
++#define SIS_CTRL_READY_TIMEOUT_SECS 180
+ #define SIS_CTRL_READY_RESUME_TIMEOUT_SECS 90
+ #define SIS_CTRL_READY_POLL_INTERVAL_MSECS 10
+
+diff --git a/drivers/soc/bcm/brcmstb/common.c b/drivers/soc/bcm/brcmstb/common.c
+index 14185451901d..bf9123f727e8 100644
+--- a/drivers/soc/bcm/brcmstb/common.c
++++ b/drivers/soc/bcm/brcmstb/common.c
+@@ -31,13 +31,17 @@ static const struct of_device_id brcmstb_machine_match[] = {
+
+ bool soc_is_brcmstb(void)
+ {
++ const struct of_device_id *match;
+ struct device_node *root;
+
+ root = of_find_node_by_path("/");
+ if (!root)
+ return false;
+
+- return of_match_node(brcmstb_machine_match, root) != NULL;
++ match = of_match_node(brcmstb_machine_match, root);
++ of_node_put(root);
++
++ return match != NULL;
+ }
+
+ u32 brcmstb_get_family_id(void)
+diff --git a/drivers/soc/tegra/common.c b/drivers/soc/tegra/common.c
+index cd8f41351add..7bfb154d6fa5 100644
+--- a/drivers/soc/tegra/common.c
++++ b/drivers/soc/tegra/common.c
+@@ -22,11 +22,15 @@ static const struct of_device_id tegra_machine_match[] = {
+
+ bool soc_is_tegra(void)
+ {
++ const struct of_device_id *match;
+ struct device_node *root;
+
+ root = of_find_node_by_path("/");
+ if (!root)
+ return false;
+
+- return of_match_node(tegra_machine_match, root) != NULL;
++ match = of_match_node(tegra_machine_match, root);
++ of_node_put(root);
++
++ return match != NULL;
+ }
+diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h
+index 367b39fe46e5..e6313c54e3ad 100644
+--- a/drivers/staging/erofs/internal.h
++++ b/drivers/staging/erofs/internal.h
+@@ -39,7 +39,7 @@
+ #define debugln(x, ...) ((void)0)
+
+ #define dbg_might_sleep() ((void)0)
+-#define DBG_BUGON(...) ((void)0)
++#define DBG_BUGON(x) ((void)(x))
+ #endif
+
+ #ifdef CONFIG_EROFS_FAULT_INJECTION
+diff --git a/drivers/staging/fsl-dpaa2/rtc/rtc.c b/drivers/staging/fsl-dpaa2/rtc/rtc.c
+index 0d52cb85441f..318a33c2f7a7 100644
+--- a/drivers/staging/fsl-dpaa2/rtc/rtc.c
++++ b/drivers/staging/fsl-dpaa2/rtc/rtc.c
+@@ -142,7 +142,10 @@ static int rtc_probe(struct fsl_mc_device *mc_dev)
+
+ err = fsl_mc_portal_allocate(mc_dev, 0, &mc_dev->mc_io);
+ if (err) {
+- dev_err(dev, "fsl_mc_portal_allocate err %d\n", err);
++ if (err == -ENXIO)
++ err = -EPROBE_DEFER;
++ else
++ dev_err(dev, "fsl_mc_portal_allocate err %d\n", err);
+ goto err_exit;
+ }
+
+diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c
+index b736275c10f5..6a48ad067a8b 100644
+--- a/drivers/staging/iio/adc/ad7280a.c
++++ b/drivers/staging/iio/adc/ad7280a.c
+@@ -256,7 +256,9 @@ static int ad7280_read(struct ad7280_state *st, unsigned int devaddr,
+ if (ret)
+ return ret;
+
+- __ad7280_read32(st, &tmp);
++ ret = __ad7280_read32(st, &tmp);
++ if (ret)
++ return ret;
+
+ if (ad7280_check_crc(st, tmp))
+ return -EIO;
+@@ -294,7 +296,9 @@ static int ad7280_read_channel(struct ad7280_state *st, unsigned int devaddr,
+
+ ad7280_delay(st);
+
+- __ad7280_read32(st, &tmp);
++ ret = __ad7280_read32(st, &tmp);
++ if (ret)
++ return ret;
+
+ if (ad7280_check_crc(st, tmp))
+ return -EIO;
+@@ -327,7 +331,9 @@ static int ad7280_read_all_channels(struct ad7280_state *st, unsigned int cnt,
+ ad7280_delay(st);
+
+ for (i = 0; i < cnt; i++) {
+- __ad7280_read32(st, &tmp);
++ ret = __ad7280_read32(st, &tmp);
++ if (ret)
++ return ret;
+
+ if (ad7280_check_crc(st, tmp))
+ return -EIO;
+@@ -370,7 +376,10 @@ static int ad7280_chain_setup(struct ad7280_state *st)
+ return ret;
+
+ for (n = 0; n <= AD7280A_MAX_CHAIN; n++) {
+- __ad7280_read32(st, &val);
++ ret = __ad7280_read32(st, &val);
++ if (ret)
++ return ret;
++
+ if (val == 0)
+ return n - 1;
+
+diff --git a/drivers/staging/iio/adc/ad7780.c b/drivers/staging/iio/adc/ad7780.c
+index 16d72072c076..8bcb5d5de749 100644
+--- a/drivers/staging/iio/adc/ad7780.c
++++ b/drivers/staging/iio/adc/ad7780.c
+@@ -87,12 +87,16 @@ static int ad7780_read_raw(struct iio_dev *indio_dev,
+ long m)
+ {
+ struct ad7780_state *st = iio_priv(indio_dev);
++ int voltage_uv;
+
+ switch (m) {
+ case IIO_CHAN_INFO_RAW:
+ return ad_sigma_delta_single_conversion(indio_dev, chan, val);
+ case IIO_CHAN_INFO_SCALE:
+- *val = st->int_vref_mv * st->gain;
++ voltage_uv = regulator_get_voltage(st->reg);
++ if (voltage_uv < 0)
++ return voltage_uv;
++ *val = (voltage_uv / 1000) * st->gain;
+ *val2 = chan->scan_type.realbits - 1;
+ return IIO_VAL_FRACTIONAL_LOG2;
+ case IIO_CHAN_INFO_OFFSET:
+diff --git a/drivers/staging/iio/resolver/ad2s90.c b/drivers/staging/iio/resolver/ad2s90.c
+index 59586947a936..51cda9151412 100644
+--- a/drivers/staging/iio/resolver/ad2s90.c
++++ b/drivers/staging/iio/resolver/ad2s90.c
+@@ -85,7 +85,12 @@ static int ad2s90_probe(struct spi_device *spi)
+ /* need 600ns between CS and the first falling edge of SCLK */
+ spi->max_speed_hz = 830000;
+ spi->mode = SPI_MODE_3;
+- spi_setup(spi);
++ ret = spi_setup(spi);
++
++ if (ret < 0) {
++ dev_err(&spi->dev, "spi_setup failed!\n");
++ return ret;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/staging/pi433/pi433_if.c b/drivers/staging/pi433/pi433_if.c
+index c85a805a1243..a497ec197872 100644
+--- a/drivers/staging/pi433/pi433_if.c
++++ b/drivers/staging/pi433/pi433_if.c
+@@ -1255,6 +1255,10 @@ static int pi433_probe(struct spi_device *spi)
+
+ /* create cdev */
+ device->cdev = cdev_alloc();
++ if (!device->cdev) {
++ dev_dbg(device->dev, "allocation of cdev failed");
++ goto cdev_failed;
++ }
+ device->cdev->owner = THIS_MODULE;
+ cdev_init(device->cdev, &pi433_fops);
+ retval = cdev_add(device->cdev, device->devt, 1);
+diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c
+index eac63aab8162..93742dbdee77 100644
+--- a/drivers/staging/speakup/spk_ttyio.c
++++ b/drivers/staging/speakup/spk_ttyio.c
+@@ -265,7 +265,8 @@ static void spk_ttyio_send_xchar(char ch)
+ return;
+ }
+
+- speakup_tty->ops->send_xchar(speakup_tty, ch);
++ if (speakup_tty->ops->send_xchar)
++ speakup_tty->ops->send_xchar(speakup_tty, ch);
+ mutex_unlock(&speakup_tty_mutex);
+ }
+
+@@ -277,7 +278,8 @@ static void spk_ttyio_tiocmset(unsigned int set, unsigned int clear)
+ return;
+ }
+
+- speakup_tty->ops->tiocmset(speakup_tty, set, clear);
++ if (speakup_tty->ops->tiocmset)
++ speakup_tty->ops->tiocmset(speakup_tty, set, clear);
+ mutex_unlock(&speakup_tty_mutex);
+ }
+
+diff --git a/drivers/tee/optee/supp.c b/drivers/tee/optee/supp.c
+index df35fc01fd3e..43626e15703a 100644
+--- a/drivers/tee/optee/supp.c
++++ b/drivers/tee/optee/supp.c
+@@ -19,7 +19,7 @@
+ struct optee_supp_req {
+ struct list_head link;
+
+- bool busy;
++ bool in_queue;
+ u32 func;
+ u32 ret;
+ size_t num_params;
+@@ -54,7 +54,6 @@ void optee_supp_release(struct optee_supp *supp)
+
+ /* Abort all request retrieved by supplicant */
+ idr_for_each_entry(&supp->idr, req, id) {
+- req->busy = false;
+ idr_remove(&supp->idr, id);
+ req->ret = TEEC_ERROR_COMMUNICATION;
+ complete(&req->c);
+@@ -63,6 +62,7 @@ void optee_supp_release(struct optee_supp *supp)
+ /* Abort all queued requests */
+ list_for_each_entry_safe(req, req_tmp, &supp->reqs, link) {
+ list_del(&req->link);
++ req->in_queue = false;
+ req->ret = TEEC_ERROR_COMMUNICATION;
+ complete(&req->c);
+ }
+@@ -103,6 +103,7 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params,
+ /* Insert the request in the request list */
+ mutex_lock(&supp->mutex);
+ list_add_tail(&req->link, &supp->reqs);
++ req->in_queue = true;
+ mutex_unlock(&supp->mutex);
+
+ /* Tell an eventual waiter there's a new request */
+@@ -130,9 +131,10 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params,
+ * will serve all requests in a timely manner and
+ * interrupting then wouldn't make sense.
+ */
+- interruptable = !req->busy;
+- if (!req->busy)
++ if (req->in_queue) {
+ list_del(&req->link);
++ req->in_queue = false;
++ }
+ }
+ mutex_unlock(&supp->mutex);
+
+@@ -176,7 +178,7 @@ static struct optee_supp_req *supp_pop_entry(struct optee_supp *supp,
+ return ERR_PTR(-ENOMEM);
+
+ list_del(&req->link);
+- req->busy = true;
++ req->in_queue = false;
+
+ return req;
+ }
+@@ -318,7 +320,6 @@ static struct optee_supp_req *supp_pop_req(struct optee_supp *supp,
+ if ((num_params - nm) != req->num_params)
+ return ERR_PTR(-EINVAL);
+
+- req->busy = false;
+ idr_remove(&supp->idr, id);
+ supp->req_id = -1;
+ *num_meta = nm;
+diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c
+index 23ad4f9f2143..24b006a95142 100644
+--- a/drivers/thermal/broadcom/bcm2835_thermal.c
++++ b/drivers/thermal/broadcom/bcm2835_thermal.c
+@@ -27,6 +27,8 @@
+ #include <linux/platform_device.h>
+ #include <linux/thermal.h>
+
++#include "../thermal_hwmon.h"
++
+ #define BCM2835_TS_TSENSCTL 0x00
+ #define BCM2835_TS_TSENSSTAT 0x04
+
+@@ -275,6 +277,15 @@ static int bcm2835_thermal_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, tz);
+
++ /*
++ * Thermal_zone doesn't enable hwmon as default,
++ * enable it here
++ */
++ tz->tzp->no_hwmon = false;
++ err = thermal_add_hwmon_sysfs(tz);
++ if (err)
++ goto err_tz;
++
+ bcm2835_thermal_debugfs(pdev);
+
+ return 0;
+diff --git a/drivers/thermal/thermal-generic-adc.c b/drivers/thermal/thermal-generic-adc.c
+index bf1c628d4a7a..e22fc60ad36d 100644
+--- a/drivers/thermal/thermal-generic-adc.c
++++ b/drivers/thermal/thermal-generic-adc.c
+@@ -26,7 +26,7 @@ struct gadc_thermal_info {
+
+ static int gadc_thermal_adc_to_temp(struct gadc_thermal_info *gti, int val)
+ {
+- int temp, adc_hi, adc_lo;
++ int temp, temp_hi, temp_lo, adc_hi, adc_lo;
+ int i;
+
+ for (i = 0; i < gti->nlookup_table; i++) {
+@@ -36,13 +36,17 @@ static int gadc_thermal_adc_to_temp(struct gadc_thermal_info *gti, int val)
+
+ if (i == 0) {
+ temp = gti->lookup_table[0];
+- } else if (i >= (gti->nlookup_table - 1)) {
++ } else if (i >= gti->nlookup_table) {
+ temp = gti->lookup_table[2 * (gti->nlookup_table - 1)];
+ } else {
+ adc_hi = gti->lookup_table[2 * i - 1];
+ adc_lo = gti->lookup_table[2 * i + 1];
+- temp = gti->lookup_table[2 * i];
+- temp -= ((val - adc_lo) * 1000) / (adc_hi - adc_lo);
++
++ temp_hi = gti->lookup_table[2 * i - 2];
++ temp_lo = gti->lookup_table[2 * i];
++
++ temp = temp_hi + mult_frac(temp_lo - temp_hi, val - adc_hi,
++ adc_lo - adc_hi);
+ }
+
+ return temp;
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index 441778100887..bf9721fc2824 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -451,16 +451,20 @@ static void update_temperature(struct thermal_zone_device *tz)
+ tz->last_temperature, tz->temperature);
+ }
+
+-static void thermal_zone_device_reset(struct thermal_zone_device *tz)
++static void thermal_zone_device_init(struct thermal_zone_device *tz)
+ {
+ struct thermal_instance *pos;
+-
+ tz->temperature = THERMAL_TEMP_INVALID;
+- tz->passive = 0;
+ list_for_each_entry(pos, &tz->thermal_instances, tz_node)
+ pos->initialized = false;
+ }
+
++static void thermal_zone_device_reset(struct thermal_zone_device *tz)
++{
++ tz->passive = 0;
++ thermal_zone_device_init(tz);
++}
++
+ void thermal_zone_device_update(struct thermal_zone_device *tz,
+ enum thermal_notify_event event)
+ {
+@@ -1502,7 +1506,7 @@ static int thermal_pm_notify(struct notifier_block *nb,
+ case PM_POST_SUSPEND:
+ atomic_set(&in_suspend, 0);
+ list_for_each_entry(tz, &thermal_tz_list, node) {
+- thermal_zone_device_reset(tz);
++ thermal_zone_device_init(tz);
+ thermal_zone_device_update(tz,
+ THERMAL_EVENT_UNSPECIFIED);
+ }
+diff --git a/drivers/thermal/thermal_hwmon.h b/drivers/thermal/thermal_hwmon.h
+index 019f6f88224e..a160b9d62dd0 100644
+--- a/drivers/thermal/thermal_hwmon.h
++++ b/drivers/thermal/thermal_hwmon.h
+@@ -19,13 +19,13 @@
+ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz);
+ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz);
+ #else
+-static int
++static inline int
+ thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
+ {
+ return 0;
+ }
+
+-static void
++static inline void
+ thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
+ {
+ }
+diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c
+index 2241ceae7d7f..aa99edb4dff7 100644
+--- a/drivers/thermal/thermal_sysfs.c
++++ b/drivers/thermal/thermal_sysfs.c
+@@ -712,11 +712,14 @@ cur_state_store(struct device *dev, struct device_attribute *attr,
+ if ((long)state < 0)
+ return -EINVAL;
+
++ mutex_lock(&cdev->lock);
++
+ result = cdev->ops->set_cur_state(cdev, state);
+- if (result)
+- return result;
+- thermal_cooling_device_stats_update(cdev, state);
+- return count;
++ if (!result)
++ thermal_cooling_device_stats_update(cdev, state);
++
++ mutex_unlock(&cdev->lock);
++ return result ? result : count;
+ }
+
+ static struct device_attribute
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index f80a300b5d68..48bd694a5fa1 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -3420,6 +3420,11 @@ static int
+ serial_pci_guess_board(struct pci_dev *dev, struct pciserial_board *board)
+ {
+ int num_iomem, num_port, first_port = -1, i;
++ int rc;
++
++ rc = serial_pci_is_class_communication(dev);
++ if (rc)
++ return rc;
+
+ /*
+ * Should we try to make guesses for multiport serial devices later?
+@@ -3647,10 +3652,6 @@ pciserial_init_one(struct pci_dev *dev, const struct pci_device_id *ent)
+
+ board = &pci_boards[ent->driver_data];
+
+- rc = serial_pci_is_class_communication(dev);
+- if (rc)
+- return rc;
+-
+ rc = serial_pci_is_blacklisted(dev);
+ if (rc)
+ return rc;
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 3f8d1274fc85..7d030c2e42ff 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1477,6 +1477,8 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,
+ else
+ cr1 &= ~UARTCR1_PT;
+ }
++ } else {
++ cr1 &= ~UARTCR1_PE;
+ }
+
+ /* ask the core to calculate the divisor */
+@@ -1688,6 +1690,8 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
+ else
+ ctrl &= ~UARTCTRL_PT;
+ }
++ } else {
++ ctrl &= ~UARTCTRL_PE;
+ }
+
+ /* ask the core to calculate the divisor */
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index 2f8fa184aafa..c6058b52d5d5 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1365,11 +1365,14 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
+ wr_regl(port, S3C2410_ULCON, ulcon);
+ wr_regl(port, S3C2410_UBRDIV, quot);
+
++ port->status &= ~UPSTAT_AUTOCTS;
++
+ umcon = rd_regl(port, S3C2410_UMCON);
+ if (termios->c_cflag & CRTSCTS) {
+ umcon |= S3C2410_UMCOM_AFC;
+ /* Disable RTS when RX FIFO contains 63 bytes */
+ umcon &= ~S3C2412_UMCON_AFC_8;
++ port->status = UPSTAT_AUTOCTS;
+ } else {
+ umcon &= ~S3C2410_UMCOM_AFC;
+ }
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 7fe679413188..f0b354b65a0e 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -130,6 +130,9 @@ static void uart_start(struct tty_struct *tty)
+ struct uart_port *port;
+ unsigned long flags;
+
++ if (!state)
++ return;
++
+ port = uart_port_lock(state, flags);
+ __uart_start(tty);
+ uart_port_unlock(port, flags);
+@@ -727,6 +730,9 @@ static void uart_unthrottle(struct tty_struct *tty)
+ upstat_t mask = UPSTAT_SYNC_FIFO;
+ struct uart_port *port;
+
++ if (!state)
++ return;
++
+ port = uart_port_ref(state);
+ if (!port)
+ return;
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index effba6ce0caa..859b173e3b82 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1331,7 +1331,7 @@ static void sci_tx_dma_release(struct sci_port *s)
+ dma_release_channel(chan);
+ }
+
+-static void sci_submit_rx(struct sci_port *s)
++static int sci_submit_rx(struct sci_port *s, bool port_lock_held)
+ {
+ struct dma_chan *chan = s->chan_rx;
+ struct uart_port *port = &s->port;
+@@ -1359,19 +1359,22 @@ static void sci_submit_rx(struct sci_port *s)
+ s->active_rx = s->cookie_rx[0];
+
+ dma_async_issue_pending(chan);
+- return;
++ return 0;
+
+ fail:
++ /* Switch to PIO */
++ if (!port_lock_held)
++ spin_lock_irqsave(&port->lock, flags);
+ if (i)
+ dmaengine_terminate_async(chan);
+ for (i = 0; i < 2; i++)
+ s->cookie_rx[i] = -EINVAL;
+ s->active_rx = -EINVAL;
+- /* Switch to PIO */
+- spin_lock_irqsave(&port->lock, flags);
+ s->chan_rx = NULL;
+ sci_start_rx(port);
+- spin_unlock_irqrestore(&port->lock, flags);
++ if (!port_lock_held)
++ spin_unlock_irqrestore(&port->lock, flags);
++ return -EAGAIN;
+ }
+
+ static void work_fn_tx(struct work_struct *work)
+@@ -1491,7 +1494,7 @@ static enum hrtimer_restart rx_timer_fn(struct hrtimer *t)
+ }
+
+ if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
+- sci_submit_rx(s);
++ sci_submit_rx(s, true);
+
+ /* Direct new serial port interrupts back to CPU */
+ scr = serial_port_in(port, SCSCR);
+@@ -1617,7 +1620,7 @@ static void sci_request_dma(struct uart_port *port)
+ s->chan_rx_saved = s->chan_rx = chan;
+
+ if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
+- sci_submit_rx(s);
++ sci_submit_rx(s, false);
+ }
+ }
+
+@@ -1666,8 +1669,10 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr)
+ disable_irq_nosync(irq);
+ scr |= SCSCR_RDRQE;
+ } else {
++ if (sci_submit_rx(s, false) < 0)
++ goto handle_pio;
++
+ scr &= ~SCSCR_RIE;
+- sci_submit_rx(s);
+ }
+ serial_port_out(port, SCSCR, scr);
+ /* Clear current interrupt */
+@@ -1679,6 +1684,8 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr)
+
+ return IRQ_HANDLED;
+ }
++
++handle_pio:
+ #endif
+
+ if (s->rx_trigger > 1 && s->rx_fifo_timeout > 0) {
+@@ -1914,7 +1921,7 @@ out_nomem:
+
+ static void sci_free_irq(struct sci_port *port)
+ {
+- int i;
++ int i, j;
+
+ /*
+ * Intentionally in reverse order so we iterate over the muxed
+@@ -1930,6 +1937,13 @@ static void sci_free_irq(struct sci_port *port)
+ if (unlikely(irq < 0))
+ continue;
+
++ /* Check if already freed (irq was muxed) */
++ for (j = 0; j < i; j++)
++ if (port->irqs[j] == irq)
++ j = i + 1;
++ if (j > i)
++ continue;
++
+ free_irq(port->irqs[i], port);
+ kfree(port->irqstr[i]);
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index cc62707c0251..3adff4da2ee1 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1111,6 +1111,16 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ USB_PORT_FEAT_ENABLE);
+ }
+
++ /*
++ * Add debounce if USB3 link is in polling/link training state.
++ * Link will automatically transition to Enabled state after
++ * link training completes.
++ */
++ if (hub_is_superspeed(hdev) &&
++ ((portstatus & USB_PORT_STAT_LINK_STATE) ==
++ USB_SS_PORT_LS_POLLING))
++ need_debounce_delay = true;
++
+ /* Clear status-change flags; we'll debounce later */
+ if (portchange & USB_PORT_STAT_C_CONNECTION) {
+ need_debounce_delay = true;
+diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
+index ef2c199e6059..dff2c6e8d797 100644
+--- a/drivers/usb/dwc2/params.c
++++ b/drivers/usb/dwc2/params.c
+@@ -71,6 +71,13 @@ static void dwc2_set_his_params(struct dwc2_hsotg *hsotg)
+ p->power_down = false;
+ }
+
++static void dwc2_set_s3c6400_params(struct dwc2_hsotg *hsotg)
++{
++ struct dwc2_core_params *p = &hsotg->params;
++
++ p->power_down = 0;
++}
++
+ static void dwc2_set_rk_params(struct dwc2_hsotg *hsotg)
+ {
+ struct dwc2_core_params *p = &hsotg->params;
+@@ -151,7 +158,8 @@ const struct of_device_id dwc2_of_match_table[] = {
+ { .compatible = "lantiq,arx100-usb", .data = dwc2_set_ltq_params },
+ { .compatible = "lantiq,xrx200-usb", .data = dwc2_set_ltq_params },
+ { .compatible = "snps,dwc2" },
+- { .compatible = "samsung,s3c6400-hsotg" },
++ { .compatible = "samsung,s3c6400-hsotg",
++ .data = dwc2_set_s3c6400_params },
+ { .compatible = "amlogic,meson8-usb",
+ .data = dwc2_set_amlogic_params },
+ { .compatible = "amlogic,meson8b-usb",
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index d8bf9307901e..0db90f6f4aa8 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -912,8 +912,6 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
+ struct usb_gadget *gadget = &dwc->gadget;
+ enum usb_device_speed speed = gadget->speed;
+
+- dwc3_ep_inc_enq(dep);
+-
+ trb->size = DWC3_TRB_SIZE_LENGTH(length);
+ trb->bpl = lower_32_bits(dma);
+ trb->bph = upper_32_bits(dma);
+@@ -983,16 +981,20 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
+ usb_endpoint_type(dep->endpoint.desc));
+ }
+
+- /* always enable Continue on Short Packet */
++ /*
++ * Enable Continue on Short Packet
++ * when endpoint is not a stream capable
++ */
+ if (usb_endpoint_dir_out(dep->endpoint.desc)) {
+- trb->ctrl |= DWC3_TRB_CTRL_CSP;
++ if (!dep->stream_capable)
++ trb->ctrl |= DWC3_TRB_CTRL_CSP;
+
+ if (short_not_ok)
+ trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI;
+ }
+
+ if ((!no_interrupt && !chain) ||
+- (dwc3_calc_trbs_left(dep) == 0))
++ (dwc3_calc_trbs_left(dep) == 1))
+ trb->ctrl |= DWC3_TRB_CTRL_IOC;
+
+ if (chain)
+@@ -1003,6 +1005,8 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
+
+ trb->ctrl |= DWC3_TRB_CTRL_HWO;
+
++ dwc3_ep_inc_enq(dep);
++
+ trace_dwc3_prepare_trb(dep, trb);
+ }
+
+@@ -1106,7 +1110,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
+ unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
+ unsigned int rem = length % maxp;
+
+- if (rem && usb_endpoint_dir_out(dep->endpoint.desc)) {
++ if ((!length || rem) && usb_endpoint_dir_out(dep->endpoint.desc)) {
+ struct dwc3 *dwc = dep->dwc;
+ struct dwc3_trb *trb;
+
+diff --git a/drivers/usb/dwc3/trace.h b/drivers/usb/dwc3/trace.h
+index f22714cce070..f27c5cbe285c 100644
+--- a/drivers/usb/dwc3/trace.h
++++ b/drivers/usb/dwc3/trace.h
+@@ -251,9 +251,11 @@ DECLARE_EVENT_CLASS(dwc3_log_trb,
+ s = "2x ";
+ break;
+ case 3:
++ default:
+ s = "3x ";
+ break;
+ }
++ break;
+ default:
+ s = "";
+ } s; }),
+diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c
+index 660878a19505..b77f3126580e 100644
+--- a/drivers/usb/gadget/udc/net2272.c
++++ b/drivers/usb/gadget/udc/net2272.c
+@@ -2083,7 +2083,7 @@ static irqreturn_t net2272_irq(int irq, void *_dev)
+ #if defined(PLX_PCI_RDK2)
+ /* see if PCI int for us by checking irqstat */
+ intcsr = readl(dev->rdk2.fpga_base_addr + RDK2_IRQSTAT);
+- if (!intcsr & (1 << NET2272_PCI_IRQ)) {
++ if (!(intcsr & (1 << NET2272_PCI_IRQ))) {
+ spin_unlock(&dev->lock);
+ return IRQ_NONE;
+ }
+diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
+index d045d8458f81..48d10a61e271 100644
+--- a/drivers/usb/mtu3/mtu3_core.c
++++ b/drivers/usb/mtu3/mtu3_core.c
+@@ -578,8 +578,10 @@ static void mtu3_regs_init(struct mtu3 *mtu)
+ if (mtu->is_u3_ip) {
+ /* disable LGO_U1/U2 by default */
+ mtu3_clrbits(mbase, U3D_LINK_POWER_CONTROL,
+- SW_U1_ACCEPT_ENABLE | SW_U2_ACCEPT_ENABLE |
+ SW_U1_REQUEST_ENABLE | SW_U2_REQUEST_ENABLE);
++ /* enable accept LGO_U1/U2 link command from host */
++ mtu3_setbits(mbase, U3D_LINK_POWER_CONTROL,
++ SW_U1_ACCEPT_ENABLE | SW_U2_ACCEPT_ENABLE);
+ /* device responses to u3_exit from host automatically */
+ mtu3_clrbits(mbase, U3D_LTSSM_CTRL, SOFT_U3_EXIT_EN);
+ /* automatically build U2 link when U3 detect fail */
+diff --git a/drivers/usb/mtu3/mtu3_gadget_ep0.c b/drivers/usb/mtu3/mtu3_gadget_ep0.c
+index 25216e79cd6e..3c464d8ae023 100644
+--- a/drivers/usb/mtu3/mtu3_gadget_ep0.c
++++ b/drivers/usb/mtu3/mtu3_gadget_ep0.c
+@@ -336,9 +336,9 @@ static int ep0_handle_feature_dev(struct mtu3 *mtu,
+
+ lpc = mtu3_readl(mbase, U3D_LINK_POWER_CONTROL);
+ if (set)
+- lpc |= SW_U1_ACCEPT_ENABLE;
++ lpc |= SW_U1_REQUEST_ENABLE;
+ else
+- lpc &= ~SW_U1_ACCEPT_ENABLE;
++ lpc &= ~SW_U1_REQUEST_ENABLE;
+ mtu3_writel(mbase, U3D_LINK_POWER_CONTROL, lpc);
+
+ mtu->u1_enable = !!set;
+@@ -351,9 +351,9 @@ static int ep0_handle_feature_dev(struct mtu3 *mtu,
+
+ lpc = mtu3_readl(mbase, U3D_LINK_POWER_CONTROL);
+ if (set)
+- lpc |= SW_U2_ACCEPT_ENABLE;
++ lpc |= SW_U2_REQUEST_ENABLE;
+ else
+- lpc &= ~SW_U2_ACCEPT_ENABLE;
++ lpc &= ~SW_U2_REQUEST_ENABLE;
+ mtu3_writel(mbase, U3D_LINK_POWER_CONTROL, lpc);
+
+ mtu->u2_enable = !!set;
+diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
+index 23a0df79ef21..403eb97915f8 100644
+--- a/drivers/usb/musb/musb_dsps.c
++++ b/drivers/usb/musb/musb_dsps.c
+@@ -181,9 +181,11 @@ static void dsps_musb_enable(struct musb *musb)
+
+ musb_writel(reg_base, wrp->epintr_set, epmask);
+ musb_writel(reg_base, wrp->coreintr_set, coremask);
+- /* start polling for ID change in dual-role idle mode */
+- if (musb->xceiv->otg->state == OTG_STATE_B_IDLE &&
+- musb->port_mode == MUSB_OTG)
++ /*
++ * start polling for runtime PM active and idle,
++ * and for ID change in dual-role idle mode.
++ */
++ if (musb->xceiv->otg->state == OTG_STATE_B_IDLE)
+ dsps_mod_timer(glue, -1);
+ }
+
+@@ -227,8 +229,13 @@ static int dsps_check_status(struct musb *musb, void *unused)
+
+ switch (musb->xceiv->otg->state) {
+ case OTG_STATE_A_WAIT_VRISE:
+- dsps_mod_timer_optional(glue);
+- break;
++ if (musb->port_mode == MUSB_HOST) {
++ musb->xceiv->otg->state = OTG_STATE_A_WAIT_BCON;
++ dsps_mod_timer_optional(glue);
++ break;
++ }
++ /* fall through */
++
+ case OTG_STATE_A_WAIT_BCON:
+ /* keep VBUS on for host-only mode */
+ if (musb->port_mode == MUSB_HOST) {
+@@ -249,6 +256,10 @@ static int dsps_check_status(struct musb *musb, void *unused)
+ musb->xceiv->otg->state = OTG_STATE_A_IDLE;
+ MUSB_HST_MODE(musb);
+ }
++
++ if (musb->port_mode == MUSB_PERIPHERAL)
++ skip_session = 1;
++
+ if (!(devctl & MUSB_DEVCTL_SESSION) && !skip_session)
+ musb_writeb(mregs, MUSB_DEVCTL,
+ MUSB_DEVCTL_SESSION);
+diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
+index eae8b1b1b45b..ffe462a657b1 100644
+--- a/drivers/usb/musb/musb_gadget.c
++++ b/drivers/usb/musb/musb_gadget.c
+@@ -452,13 +452,10 @@ void musb_g_tx(struct musb *musb, u8 epnum)
+ }
+
+ if (request) {
+- u8 is_dma = 0;
+- bool short_packet = false;
+
+ trace_musb_req_tx(req);
+
+ if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
+- is_dma = 1;
+ csr |= MUSB_TXCSR_P_WZC_BITS;
+ csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
+ MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_AUTOSET);
+@@ -476,16 +473,8 @@ void musb_g_tx(struct musb *musb, u8 epnum)
+ */
+ if ((request->zero && request->length)
+ && (request->length % musb_ep->packet_sz == 0)
+- && (request->actual == request->length))
+- short_packet = true;
++ && (request->actual == request->length)) {
+
+- if ((musb_dma_inventra(musb) || musb_dma_ux500(musb)) &&
+- (is_dma && (!dma->desired_mode ||
+- (request->actual &
+- (musb_ep->packet_sz - 1)))))
+- short_packet = true;
+-
+- if (short_packet) {
+ /*
+ * On DMA completion, FIFO may not be
+ * available yet...
+diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
+index a688f7f87829..5fc6825745f2 100644
+--- a/drivers/usb/musb/musbhsdma.c
++++ b/drivers/usb/musb/musbhsdma.c
+@@ -346,12 +346,10 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
+ channel->status = MUSB_DMA_STATUS_FREE;
+
+ /* completed */
+- if ((devctl & MUSB_DEVCTL_HM)
+- && (musb_channel->transmit)
+- && ((channel->desired_mode == 0)
+- || (channel->actual_len &
+- (musb_channel->max_packet_sz - 1)))
+- ) {
++ if (musb_channel->transmit &&
++ (!channel->desired_mode ||
++ (channel->actual_len %
++ musb_channel->max_packet_sz))) {
+ u8 epnum = musb_channel->epnum;
+ int offset = musb->io.ep_offset(epnum,
+ MUSB_TXCSR);
+@@ -363,11 +361,14 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
+ */
+ musb_ep_select(mbase, epnum);
+ txcsr = musb_readw(mbase, offset);
+- txcsr &= ~(MUSB_TXCSR_DMAENAB
++ if (channel->desired_mode == 1) {
++ txcsr &= ~(MUSB_TXCSR_DMAENAB
+ | MUSB_TXCSR_AUTOSET);
+- musb_writew(mbase, offset, txcsr);
+- /* Send out the packet */
+- txcsr &= ~MUSB_TXCSR_DMAMODE;
++ musb_writew(mbase, offset, txcsr);
++ /* Send out the packet */
++ txcsr &= ~MUSB_TXCSR_DMAMODE;
++ txcsr |= MUSB_TXCSR_DMAENAB;
++ }
+ txcsr |= MUSB_TXCSR_TXPKTRDY;
+ musb_writew(mbase, offset, txcsr);
+ }
+diff --git a/drivers/usb/phy/phy-am335x.c b/drivers/usb/phy/phy-am335x.c
+index 27bdb7222527..f5f0568d8533 100644
+--- a/drivers/usb/phy/phy-am335x.c
++++ b/drivers/usb/phy/phy-am335x.c
+@@ -61,9 +61,6 @@ static int am335x_phy_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
+- ret = usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
+- if (ret)
+- return ret;
+ am_phy->usb_phy_gen.phy.init = am335x_init;
+ am_phy->usb_phy_gen.phy.shutdown = am335x_shutdown;
+
+@@ -82,7 +79,7 @@ static int am335x_phy_probe(struct platform_device *pdev)
+ device_set_wakeup_enable(dev, false);
+ phy_ctrl_power(am_phy->phy_ctrl, am_phy->id, am_phy->dr_mode, false);
+
+- return 0;
++ return usb_add_phy_dev(&am_phy->usb_phy_gen.phy);
+ }
+
+ static int am335x_phy_remove(struct platform_device *pdev)
+diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
+index 4310df46639d..b0792585d5bc 100644
+--- a/drivers/usb/renesas_usbhs/common.c
++++ b/drivers/usb/renesas_usbhs/common.c
+@@ -457,6 +457,10 @@ static int usbhsc_drvcllbck_notify_hotplug(struct platform_device *pdev)
+ * platform functions
+ */
+ static const struct of_device_id usbhs_of_match[] = {
++ {
++ .compatible = "renesas,usbhs-r8a774c0",
++ .data = (void *)USBHS_TYPE_RCAR_GEN3_WITH_PLL,
++ },
+ {
+ .compatible = "renesas,usbhs-r8a7790",
+ .data = (void *)USBHS_TYPE_RCAR_GEN2,
+diff --git a/drivers/video/fbdev/clps711x-fb.c b/drivers/video/fbdev/clps711x-fb.c
+index ff561073ee4e..42f909618f04 100644
+--- a/drivers/video/fbdev/clps711x-fb.c
++++ b/drivers/video/fbdev/clps711x-fb.c
+@@ -287,14 +287,17 @@ static int clps711x_fb_probe(struct platform_device *pdev)
+ }
+
+ ret = of_get_fb_videomode(disp, &cfb->mode, OF_USE_NATIVE_MODE);
+- if (ret)
++ if (ret) {
++ of_node_put(disp);
+ goto out_fb_release;
++ }
+
+ of_property_read_u32(disp, "ac-prescale", &cfb->ac_prescale);
+ cfb->cmap_invert = of_property_read_bool(disp, "cmap-invert");
+
+ ret = of_property_read_u32(disp, "bits-per-pixel",
+ &info->var.bits_per_pixel);
++ of_node_put(disp);
+ if (ret)
+ goto out_fb_release;
+
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 75ebbbf0a1fb..5d961e3ac66e 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -3066,7 +3066,7 @@ static int fbcon_fb_unbind(int idx)
+ for (i = first_fb_vc; i <= last_fb_vc; i++) {
+ if (con2fb_map[i] != idx &&
+ con2fb_map[i] != -1) {
+- new_idx = i;
++ new_idx = con2fb_map[i];
+ break;
+ }
+ }
+diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
+index 20405421a5ed..77cee99fc36c 100644
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -435,7 +435,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
+ image->dx += image->width + 8;
+ }
+ } else if (rotate == FB_ROTATE_UD) {
+- for (x = 0; x < num; x++) {
++ u32 dx = image->dx;
++
++ for (x = 0; x < num && image->dx <= dx; x++) {
+ info->fbops->fb_imageblit(info, image);
+ image->dx -= image->width + 8;
+ }
+@@ -447,7 +449,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
+ image->dy += image->height + 8;
+ }
+ } else if (rotate == FB_ROTATE_CCW) {
+- for (x = 0; x < num; x++) {
++ u32 dy = image->dy;
++
++ for (x = 0; x < num && image->dy <= dy; x++) {
+ info->fbops->fb_imageblit(info, image);
+ image->dy -= image->height + 8;
+ }
+diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
+index 3093655c7b92..1475ed5ffcde 100644
+--- a/drivers/virt/vboxguest/vboxguest_core.c
++++ b/drivers/virt/vboxguest/vboxguest_core.c
+@@ -1312,7 +1312,7 @@ static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
+ return -EINVAL;
+ }
+
+- if (f32bit)
++ if (IS_ENABLED(CONFIG_COMPAT) && f32bit)
+ ret = vbg_hgcm_call32(gdev, client_id,
+ call->function, call->timeout_ms,
+ VBG_IOCTL_HGCM_CALL_PARMS32(call),
+diff --git a/drivers/watchdog/renesas_wdt.c b/drivers/watchdog/renesas_wdt.c
+index 88d81feba4e6..d01efd342dc0 100644
+--- a/drivers/watchdog/renesas_wdt.c
++++ b/drivers/watchdog/renesas_wdt.c
+@@ -77,12 +77,17 @@ static int rwdt_init_timeout(struct watchdog_device *wdev)
+ static int rwdt_start(struct watchdog_device *wdev)
+ {
+ struct rwdt_priv *priv = watchdog_get_drvdata(wdev);
++ u8 val;
+
+ pm_runtime_get_sync(wdev->parent);
+
+- rwdt_write(priv, 0, RWTCSRB);
+- rwdt_write(priv, priv->cks, RWTCSRA);
++ /* Stop the timer before we modify any register */
++ val = readb_relaxed(priv->base + RWTCSRA) & ~RWTCSRA_TME;
++ rwdt_write(priv, val, RWTCSRA);
++
+ rwdt_init_timeout(wdev);
++ rwdt_write(priv, priv->cks, RWTCSRA);
++ rwdt_write(priv, 0, RWTCSRB);
+
+ while (readb_relaxed(priv->base + RWTCSRA) & RWTCSRA_WRFLG)
+ cpu_relax();
+diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
+index 7cde3f46ad26..d0078cbb718b 100644
+--- a/fs/binfmt_script.c
++++ b/fs/binfmt_script.c
+@@ -42,10 +42,14 @@ static int load_script(struct linux_binprm *bprm)
+ fput(bprm->file);
+ bprm->file = NULL;
+
+- bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
+- if ((cp = strchr(bprm->buf, '\n')) == NULL)
+- cp = bprm->buf+BINPRM_BUF_SIZE-1;
++ for (cp = bprm->buf+2;; cp++) {
++ if (cp >= bprm->buf + BINPRM_BUF_SIZE)
++ return -ENOEXEC;
++ if (!*cp || (*cp == '\n'))
++ break;
++ }
+ *cp = '\0';
++
+ while (cp > bprm->buf) {
+ cp--;
+ if ((*cp == ' ') || (*cp == '\t'))
+diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
+index 7177d1d33584..45f5cf9cd203 100644
+--- a/fs/btrfs/btrfs_inode.h
++++ b/fs/btrfs/btrfs_inode.h
+@@ -29,6 +29,7 @@ enum {
+ BTRFS_INODE_IN_DELALLOC_LIST,
+ BTRFS_INODE_READDIO_NEED_LOCK,
+ BTRFS_INODE_HAS_PROPS,
++ BTRFS_INODE_SNAPSHOT_FLUSH,
+ };
+
+ /* in memory btrfs inode */
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 2cddfe7806a4..82682da5a40d 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -3155,7 +3155,7 @@ int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
+ struct inode *inode, u64 new_size,
+ u32 min_type);
+
+-int btrfs_start_delalloc_inodes(struct btrfs_root *root);
++int btrfs_start_delalloc_snapshot(struct btrfs_root *root);
+ int btrfs_start_delalloc_roots(struct btrfs_fs_info *fs_info, int nr);
+ int btrfs_set_extent_delalloc(struct inode *inode, u64 start, u64 end,
+ unsigned int extra_bits,
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 4dd6faab02bb..79f82f2ec4d5 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -3928,12 +3928,25 @@ static int extent_write_cache_pages(struct address_space *mapping,
+ range_whole = 1;
+ scanned = 1;
+ }
+- if (wbc->sync_mode == WB_SYNC_ALL)
++
++ /*
++ * We do the tagged writepage as long as the snapshot flush bit is set
++ * and we are the first one who do the filemap_flush() on this inode.
++ *
++ * The nr_to_write == LONG_MAX is needed to make sure other flushers do
++ * not race in and drop the bit.
++ */
++ if (range_whole && wbc->nr_to_write == LONG_MAX &&
++ test_and_clear_bit(BTRFS_INODE_SNAPSHOT_FLUSH,
++ &BTRFS_I(inode)->runtime_flags))
++ wbc->tagged_writepages = 1;
++
++ if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
+ tag = PAGECACHE_TAG_TOWRITE;
+ else
+ tag = PAGECACHE_TAG_DIRTY;
+ retry:
+- if (wbc->sync_mode == WB_SYNC_ALL)
++ if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
+ tag_pages_for_writeback(mapping, index, end);
+ done_index = index;
+ while (!done && !nr_to_write_done && (index <= end) &&
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 83b3a626c796..59f361f7d0c1 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -10005,7 +10005,7 @@ static struct btrfs_delalloc_work *btrfs_alloc_delalloc_work(struct inode *inode
+ * some fairly slow code that needs optimization. This walks the list
+ * of all the inodes with pending delalloc and forces them to disk.
+ */
+-static int start_delalloc_inodes(struct btrfs_root *root, int nr)
++static int start_delalloc_inodes(struct btrfs_root *root, int nr, bool snapshot)
+ {
+ struct btrfs_inode *binode;
+ struct inode *inode;
+@@ -10033,6 +10033,9 @@ static int start_delalloc_inodes(struct btrfs_root *root, int nr)
+ }
+ spin_unlock(&root->delalloc_lock);
+
++ if (snapshot)
++ set_bit(BTRFS_INODE_SNAPSHOT_FLUSH,
++ &binode->runtime_flags);
+ work = btrfs_alloc_delalloc_work(inode);
+ if (!work) {
+ iput(inode);
+@@ -10066,7 +10069,7 @@ out:
+ return ret;
+ }
+
+-int btrfs_start_delalloc_inodes(struct btrfs_root *root)
++int btrfs_start_delalloc_snapshot(struct btrfs_root *root)
+ {
+ struct btrfs_fs_info *fs_info = root->fs_info;
+ int ret;
+@@ -10074,7 +10077,7 @@ int btrfs_start_delalloc_inodes(struct btrfs_root *root)
+ if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state))
+ return -EROFS;
+
+- ret = start_delalloc_inodes(root, -1);
++ ret = start_delalloc_inodes(root, -1, true);
+ if (ret > 0)
+ ret = 0;
+ return ret;
+@@ -10103,7 +10106,7 @@ int btrfs_start_delalloc_roots(struct btrfs_fs_info *fs_info, int nr)
+ &fs_info->delalloc_roots);
+ spin_unlock(&fs_info->delalloc_root_lock);
+
+- ret = start_delalloc_inodes(root, nr);
++ ret = start_delalloc_inodes(root, nr, false);
+ btrfs_put_fs_root(root);
+ if (ret < 0)
+ goto out;
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index c9152155fcbf..8bf9cce11213 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -778,7 +778,7 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
+ wait_event(root->subv_writers->wait,
+ percpu_counter_sum(&root->subv_writers->counter) == 0);
+
+- ret = btrfs_start_delalloc_inodes(root);
++ ret = btrfs_start_delalloc_snapshot(root);
+ if (ret)
+ goto dec_and_free;
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 0ee1cd4b56fb..285f64f2de5f 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -850,6 +850,35 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ return ERR_PTR(-EEXIST);
+ }
+
++ /*
++ * We are going to replace the device path for a given devid,
++ * make sure it's the same device if the device is mounted
++ */
++ if (device->bdev) {
++ struct block_device *path_bdev;
++
++ path_bdev = lookup_bdev(path);
++ if (IS_ERR(path_bdev)) {
++ mutex_unlock(&fs_devices->device_list_mutex);
++ return ERR_CAST(path_bdev);
++ }
++
++ if (device->bdev != path_bdev) {
++ bdput(path_bdev);
++ mutex_unlock(&fs_devices->device_list_mutex);
++ btrfs_warn_in_rcu(device->fs_info,
++ "duplicate device fsid:devid for %pU:%llu old:%s new:%s",
++ disk_super->fsid, devid,
++ rcu_str_deref(device->name), path);
++ return ERR_PTR(-EEXIST);
++ }
++ bdput(path_bdev);
++ btrfs_info_in_rcu(device->fs_info,
++ "device fsid %pU devid %llu moved old:%s new:%s",
++ disk_super->fsid, devid,
++ rcu_str_deref(device->name), path);
++ }
++
+ name = rcu_string_strdup(path, GFP_NOFS);
+ if (!name) {
+ mutex_unlock(&fs_devices->device_list_mutex);
+diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
+index e169e1a5fd35..3925a7bfc74d 100644
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -655,7 +655,14 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos,
+ /* scan and find it */
+ int i;
+ char *cur_ent;
+- char *end_of_smb = cfile->srch_inf.ntwrk_buf_start +
++ char *end_of_smb;
++
++ if (cfile->srch_inf.ntwrk_buf_start == NULL) {
++ cifs_dbg(VFS, "ntwrk_buf_start is NULL during readdir\n");
++ return -EIO;
++ }
++
++ end_of_smb = cfile->srch_inf.ntwrk_buf_start +
+ server->ops->calc_smb_size(
+ cfile->srch_inf.ntwrk_buf_start,
+ server);
+diff --git a/fs/dlm/ast.c b/fs/dlm/ast.c
+index 562fa8c3edff..47ee66d70109 100644
+--- a/fs/dlm/ast.c
++++ b/fs/dlm/ast.c
+@@ -292,6 +292,8 @@ void dlm_callback_suspend(struct dlm_ls *ls)
+ flush_workqueue(ls->ls_callback_wq);
+ }
+
++#define MAX_CB_QUEUE 25
++
+ void dlm_callback_resume(struct dlm_ls *ls)
+ {
+ struct dlm_lkb *lkb, *safe;
+@@ -302,15 +304,23 @@ void dlm_callback_resume(struct dlm_ls *ls)
+ if (!ls->ls_callback_wq)
+ return;
+
++more:
+ mutex_lock(&ls->ls_cb_mutex);
+ list_for_each_entry_safe(lkb, safe, &ls->ls_cb_delay, lkb_cb_list) {
+ list_del_init(&lkb->lkb_cb_list);
+ queue_work(ls->ls_callback_wq, &lkb->lkb_cb_work);
+ count++;
++ if (count == MAX_CB_QUEUE)
++ break;
+ }
+ mutex_unlock(&ls->ls_cb_mutex);
+
+ if (count)
+ log_rinfo(ls, "dlm_callback_resume %d", count);
++ if (count == MAX_CB_QUEUE) {
++ count = 0;
++ cond_resched();
++ goto more;
++ }
+ }
+
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 42bbe6824b4b..58f48ea0db23 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1154,7 +1154,7 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v
+ * semantics). All the events that happen during that period of time are
+ * chained in ep->ovflist and requeued later on.
+ */
+- if (unlikely(ep->ovflist != EP_UNACTIVE_PTR)) {
++ if (ep->ovflist != EP_UNACTIVE_PTR) {
+ if (epi->next == EP_UNACTIVE_PTR) {
+ epi->next = ep->ovflist;
+ ep->ovflist = epi;
+diff --git a/fs/f2fs/acl.c b/fs/f2fs/acl.c
+index 111824199a88..b9fe937a3c70 100644
+--- a/fs/f2fs/acl.c
++++ b/fs/f2fs/acl.c
+@@ -352,12 +352,14 @@ static int f2fs_acl_create(struct inode *dir, umode_t *mode,
+ return PTR_ERR(p);
+
+ clone = f2fs_acl_clone(p, GFP_NOFS);
+- if (!clone)
+- goto no_mem;
++ if (!clone) {
++ ret = -ENOMEM;
++ goto release_acl;
++ }
+
+ ret = f2fs_acl_create_masq(clone, mode);
+ if (ret < 0)
+- goto no_mem_clone;
++ goto release_clone;
+
+ if (ret == 0)
+ posix_acl_release(clone);
+@@ -371,11 +373,11 @@ static int f2fs_acl_create(struct inode *dir, umode_t *mode,
+
+ return 0;
+
+-no_mem_clone:
++release_clone:
+ posix_acl_release(clone);
+-no_mem:
++release_acl:
+ posix_acl_release(p);
+- return -ENOMEM;
++ return ret;
+ }
+
+ int f2fs_init_acl(struct inode *inode, struct inode *dir, struct page *ipage,
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 11f28342f641..08314fb42652 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2259,6 +2259,7 @@ static int prepare_write_begin(struct f2fs_sb_info *sbi,
+ bool locked = false;
+ struct extent_info ei = {0,0,0};
+ int err = 0;
++ int flag;
+
+ /*
+ * we already allocated all the blocks, so we don't need to get
+@@ -2268,9 +2269,15 @@ static int prepare_write_begin(struct f2fs_sb_info *sbi,
+ !is_inode_flag_set(inode, FI_NO_PREALLOC))
+ return 0;
+
++ /* f2fs_lock_op avoids race between write CP and convert_inline_page */
++ if (f2fs_has_inline_data(inode) && pos + len > MAX_INLINE_DATA(inode))
++ flag = F2FS_GET_BLOCK_DEFAULT;
++ else
++ flag = F2FS_GET_BLOCK_PRE_AIO;
++
+ if (f2fs_has_inline_data(inode) ||
+ (pos & PAGE_MASK) >= i_size_read(inode)) {
+- __do_map_lock(sbi, F2FS_GET_BLOCK_PRE_AIO, true);
++ __do_map_lock(sbi, flag, true);
+ locked = true;
+ }
+ restart:
+@@ -2308,6 +2315,7 @@ restart:
+ f2fs_put_dnode(&dn);
+ __do_map_lock(sbi, F2FS_GET_BLOCK_PRE_AIO,
+ true);
++ WARN_ON(flag != F2FS_GET_BLOCK_PRE_AIO);
+ locked = true;
+ goto restart;
+ }
+@@ -2321,7 +2329,7 @@ out:
+ f2fs_put_dnode(&dn);
+ unlock_out:
+ if (locked)
+- __do_map_lock(sbi, F2FS_GET_BLOCK_PRE_AIO, false);
++ __do_map_lock(sbi, flag, false);
+ return err;
+ }
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index ecb735142276..42aef5c94927 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -2613,10 +2613,19 @@ static inline bool is_dot_dotdot(const struct qstr *str)
+
+ static inline bool f2fs_may_extent_tree(struct inode *inode)
+ {
+- if (!test_opt(F2FS_I_SB(inode), EXTENT_CACHE) ||
++ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
++
++ if (!test_opt(sbi, EXTENT_CACHE) ||
+ is_inode_flag_set(inode, FI_NO_EXTENT))
+ return false;
+
++ /*
++ * for recovered files during mount do not create extents
++ * if shrinker is not registered.
++ */
++ if (list_empty(&sbi->s_list))
++ return false;
++
+ return S_ISREG(inode->i_mode);
+ }
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 5474aaa274b9..fd36aa6569dc 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -220,6 +220,9 @@ static int f2fs_do_sync_file(struct file *file, loff_t start, loff_t end,
+
+ trace_f2fs_sync_file_enter(inode);
+
++ if (S_ISDIR(inode->i_mode))
++ goto go_write;
++
+ /* if fdatasync is triggered, let's do in-place-update */
+ if (datasync || get_dirty_pages(inode) <= SM_I(sbi)->min_fsync_blocks)
+ set_inode_flag(inode, FI_NEED_IPU);
+diff --git a/fs/f2fs/shrinker.c b/fs/f2fs/shrinker.c
+index 36cfd816c160..29042e6d5126 100644
+--- a/fs/f2fs/shrinker.c
++++ b/fs/f2fs/shrinker.c
+@@ -138,6 +138,6 @@ void f2fs_leave_shrinker(struct f2fs_sb_info *sbi)
+ f2fs_shrink_extent_tree(sbi, __count_extent_cache(sbi));
+
+ spin_lock(&f2fs_list_lock);
+- list_del(&sbi->s_list);
++ list_del_init(&sbi->s_list);
+ spin_unlock(&f2fs_list_lock);
+ }
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 338138b34993..c9639ef0e8d5 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1039,9 +1039,6 @@ static void f2fs_put_super(struct super_block *sb)
+ f2fs_write_checkpoint(sbi, &cpc);
+ }
+
+- /* f2fs_write_checkpoint can update stat informaion */
+- f2fs_destroy_stats(sbi);
+-
+ /*
+ * normally superblock is clean, so we need to release this.
+ * In addition, EIO will skip do checkpoint, we need this as well.
+@@ -1061,6 +1058,12 @@ static void f2fs_put_super(struct super_block *sb)
+ iput(sbi->node_inode);
+ iput(sbi->meta_inode);
+
++ /*
++ * iput() can update stat information, if f2fs_write_checkpoint()
++ * above failed with error.
++ */
++ f2fs_destroy_stats(sbi);
++
+ /* destroy f2fs internal modules */
+ f2fs_destroy_node_manager(sbi);
+ f2fs_destroy_segment_manager(sbi);
+@@ -2980,30 +2983,30 @@ try_onemore:
+
+ f2fs_build_gc_manager(sbi);
+
++ err = f2fs_build_stats(sbi);
++ if (err)
++ goto free_nm;
++
+ /* get an inode for node space */
+ sbi->node_inode = f2fs_iget(sb, F2FS_NODE_INO(sbi));
+ if (IS_ERR(sbi->node_inode)) {
+ f2fs_msg(sb, KERN_ERR, "Failed to read node inode");
+ err = PTR_ERR(sbi->node_inode);
+- goto free_nm;
++ goto free_stats;
+ }
+
+- err = f2fs_build_stats(sbi);
+- if (err)
+- goto free_node_inode;
+-
+ /* read root inode and dentry */
+ root = f2fs_iget(sb, F2FS_ROOT_INO(sbi));
+ if (IS_ERR(root)) {
+ f2fs_msg(sb, KERN_ERR, "Failed to read root inode");
+ err = PTR_ERR(root);
+- goto free_stats;
++ goto free_node_inode;
+ }
+ if (!S_ISDIR(root->i_mode) || !root->i_blocks ||
+ !root->i_size || !root->i_nlink) {
+ iput(root);
+ err = -EINVAL;
+- goto free_stats;
++ goto free_node_inode;
+ }
+
+ sb->s_root = d_make_root(root); /* allocate root dentry */
+@@ -3121,12 +3124,12 @@ free_sysfs:
+ free_root_inode:
+ dput(sb->s_root);
+ sb->s_root = NULL;
+-free_stats:
+- f2fs_destroy_stats(sbi);
+ free_node_inode:
+ f2fs_release_ino_entry(sbi, true);
+ truncate_inode_pages_final(NODE_MAPPING(sbi));
+ iput(sbi->node_inode);
++free_stats:
++ f2fs_destroy_stats(sbi);
+ free_nm:
+ f2fs_destroy_node_manager(sbi);
+ free_sm:
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index bf0da0382c9e..baaed4d05b22 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -1698,7 +1698,6 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
+ req->in.h.nodeid = outarg->nodeid;
+ req->in.numargs = 2;
+ req->in.argpages = 1;
+- req->page_descs[0].offset = offset;
+ req->end = fuse_retrieve_end;
+
+ index = outarg->offset >> PAGE_SHIFT;
+@@ -1713,6 +1712,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
+
+ this_num = min_t(unsigned, num, PAGE_SIZE - offset);
+ req->pages[req->num_pages] = page;
++ req->page_descs[req->num_pages].offset = offset;
+ req->page_descs[req->num_pages].length = this_num;
+ req->num_pages++;
+
+@@ -2032,8 +2032,10 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
+
+ ret = fuse_dev_do_write(fud, &cs, len);
+
++ pipe_lock(pipe);
+ for (idx = 0; idx < nbuf; idx++)
+ pipe_buf_release(pipe, &bufs[idx]);
++ pipe_unlock(pipe);
+
+ out:
+ kvfree(bufs);
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index fbd6978479cb..bd500c3b7858 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1778,7 +1778,7 @@ static bool fuse_writepage_in_flight(struct fuse_req *new_req,
+ spin_unlock(&fc->lock);
+
+ dec_wb_stat(&bdi->wb, WB_WRITEBACK);
+- dec_node_page_state(page, NR_WRITEBACK_TEMP);
++ dec_node_page_state(new_req->pages[0], NR_WRITEBACK_TEMP);
+ wb_writeout_inc(&bdi->wb);
+ fuse_writepage_free(fc, new_req);
+ fuse_request_free(new_req);
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index ac4b2f005778..5ef2c71348bd 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2409,8 +2409,7 @@ static int nfs_compare_mount_options(const struct super_block *s, const struct n
+ goto Ebusy;
+ if (a->acdirmax != b->acdirmax)
+ goto Ebusy;
+- if (b->auth_info.flavor_len > 0 &&
+- clnt_a->cl_auth->au_flavor != clnt_b->cl_auth->au_flavor)
++ if (clnt_a->cl_auth->au_flavor != clnt_b->cl_auth->au_flavor)
+ goto Ebusy;
+ return 1;
+ Ebusy:
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index 7fb9f7c667b1..899174c7a8ae 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -1126,6 +1126,8 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size)
+ case 'Y':
+ case 'y':
+ case '1':
++ if (nn->nfsd_serv)
++ return -EBUSY;
+ nfsd4_end_grace(nn);
+ break;
+ default:
+diff --git a/fs/ocfs2/Makefile b/fs/ocfs2/Makefile
+index 99ee093182cb..cc9b32b9db7c 100644
+--- a/fs/ocfs2/Makefile
++++ b/fs/ocfs2/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
+-ccflags-y := -Ifs/ocfs2
++ccflags-y := -I$(src)
+
+ obj-$(CONFIG_OCFS2_FS) += \
+ ocfs2.o \
+diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
+index 1d098c3c00e0..9f8250df99f1 100644
+--- a/fs/ocfs2/buffer_head_io.c
++++ b/fs/ocfs2/buffer_head_io.c
+@@ -152,7 +152,6 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
+ #endif
+ }
+
+- clear_buffer_uptodate(bh);
+ get_bh(bh); /* for end_buffer_read_sync() */
+ bh->b_end_io = end_buffer_read_sync;
+ submit_bh(REQ_OP_READ, 0, bh);
+@@ -306,7 +305,6 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ continue;
+ }
+
+- clear_buffer_uptodate(bh);
+ get_bh(bh); /* for end_buffer_read_sync() */
+ if (validate)
+ set_buffer_needs_validate(bh);
+diff --git a/fs/ocfs2/dlm/Makefile b/fs/ocfs2/dlm/Makefile
+index bd1aab1f49a4..ef2854422a6e 100644
+--- a/fs/ocfs2/dlm/Makefile
++++ b/fs/ocfs2/dlm/Makefile
+@@ -1,4 +1,4 @@
+-ccflags-y := -Ifs/ocfs2
++ccflags-y := -I$(src)/..
+
+ obj-$(CONFIG_OCFS2_FS_O2CB) += ocfs2_dlm.o
+
+diff --git a/fs/ocfs2/dlmfs/Makefile b/fs/ocfs2/dlmfs/Makefile
+index eed3db8c5b49..33431a0296a3 100644
+--- a/fs/ocfs2/dlmfs/Makefile
++++ b/fs/ocfs2/dlmfs/Makefile
+@@ -1,4 +1,4 @@
+-ccflags-y := -Ifs/ocfs2
++ccflags-y := -I$(src)/..
+
+ obj-$(CONFIG_OCFS2_FS) += ocfs2_dlmfs.o
+
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 5df554a9f9c9..ae796e10f68b 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -1357,6 +1357,12 @@ reread:
+
+ iinfo->i_alloc_type = le16_to_cpu(fe->icbTag.flags) &
+ ICBTAG_FLAG_AD_MASK;
++ if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_SHORT &&
++ iinfo->i_alloc_type != ICBTAG_FLAG_AD_LONG &&
++ iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
++ ret = -EIO;
++ goto out;
++ }
+ iinfo->i_unique = 0;
+ iinfo->i_lenEAttr = 0;
+ iinfo->i_lenExtents = 0;
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index 6fc5425b1474..2652d00842d6 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -243,7 +243,7 @@ xfs_attr3_leaf_verify(
+ struct xfs_mount *mp = bp->b_target->bt_mount;
+ struct xfs_attr_leafblock *leaf = bp->b_addr;
+ struct xfs_attr_leaf_entry *entries;
+- uint16_t end;
++ uint32_t end; /* must be 32bit - see below */
+ int i;
+
+ xfs_attr3_leaf_hdr_from_disk(mp->m_attr_geo, &ichdr, leaf);
+@@ -293,6 +293,11 @@ xfs_attr3_leaf_verify(
+ /*
+ * Quickly check the freemap information. Attribute data has to be
+ * aligned to 4-byte boundaries, and likewise for the free space.
++ *
++ * Note that for 64k block size filesystems, the freemap entries cannot
++ * overflow as they are only be16 fields. However, when checking end
++ * pointer of the freemap, we have to be careful to detect overflows and
++ * so use uint32_t for those checks.
+ */
+ for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) {
+ if (ichdr.freemap[i].base > mp->m_attr_geo->blksize)
+@@ -303,7 +308,9 @@ xfs_attr3_leaf_verify(
+ return __this_address;
+ if (ichdr.freemap[i].size & 0x3)
+ return __this_address;
+- end = ichdr.freemap[i].base + ichdr.freemap[i].size;
++
++ /* be care of 16 bit overflows here */
++ end = (uint32_t)ichdr.freemap[i].base + ichdr.freemap[i].size;
+ if (end < ichdr.freemap[i].base)
+ return __this_address;
+ if (end > mp->m_attr_geo->blksize)
+diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
+index a47670332326..3a496ffe6551 100644
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -1683,10 +1683,13 @@ xfs_bmap_add_extent_delay_real(
+ case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING | BMAP_RIGHT_CONTIG:
+ /*
+ * Filling in all of a previously delayed allocation extent.
+- * The right neighbor is contiguous, the left is not.
++ * The right neighbor is contiguous, the left is not. Take care
++ * with delay -> unwritten extent allocation here because the
++ * delalloc record we are overwriting is always written.
+ */
+ PREV.br_startblock = new->br_startblock;
+ PREV.br_blockcount += RIGHT.br_blockcount;
++ PREV.br_state = new->br_state;
+
+ xfs_iext_next(ifp, &bma->icur);
+ xfs_iext_remove(bma->ip, &bma->icur, state);
+diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
+index 34c6d7bd4d18..bbdae2b4559f 100644
+--- a/fs/xfs/libxfs/xfs_btree.c
++++ b/fs/xfs/libxfs/xfs_btree.c
+@@ -330,7 +330,7 @@ xfs_btree_sblock_verify_crc(
+
+ if (xfs_sb_version_hascrc(&mp->m_sb)) {
+ if (!xfs_log_check_lsn(mp, be64_to_cpu(block->bb_u.s.bb_lsn)))
+- return __this_address;
++ return false;
+ return xfs_buf_verify_cksum(bp, XFS_BTREE_SBLOCK_CRC_OFF);
+ }
+
+diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
+index 49f5f5896a43..b697866946d2 100644
+--- a/fs/xfs/xfs_aops.c
++++ b/fs/xfs/xfs_aops.c
+@@ -449,6 +449,7 @@ xfs_map_blocks(
+ }
+
+ wpc->imap = imap;
++ xfs_trim_extent_eof(&wpc->imap, ip);
+ trace_xfs_map_blocks_found(ip, offset, count, wpc->io_type, &imap);
+ return 0;
+ allocate_blocks:
+@@ -459,6 +460,7 @@ allocate_blocks:
+ ASSERT(whichfork == XFS_COW_FORK || cow_fsb == NULLFILEOFF ||
+ imap.br_startoff + imap.br_blockcount <= cow_fsb);
+ wpc->imap = imap;
++ xfs_trim_extent_eof(&wpc->imap, ip);
+ trace_xfs_map_blocks_alloc(ip, offset, count, wpc->io_type, &imap);
+ return 0;
+ }
+diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
+index 6de8d90041ff..211b06e4702e 100644
+--- a/fs/xfs/xfs_bmap_util.c
++++ b/fs/xfs/xfs_bmap_util.c
+@@ -1175,9 +1175,9 @@ xfs_free_file_space(
+ * page could be mmap'd and iomap_zero_range doesn't do that for us.
+ * Writeback of the eof page will do this, albeit clumsily.
+ */
+- if (offset + len >= XFS_ISIZE(ip) && ((offset + len) & PAGE_MASK)) {
++ if (offset + len >= XFS_ISIZE(ip) && offset_in_page(offset + len) > 0) {
+ error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
+- (offset + len) & ~PAGE_MASK, LLONG_MAX);
++ round_down(offset + len, PAGE_SIZE), LLONG_MAX);
+ }
+
+ return error;
+@@ -1824,6 +1824,12 @@ xfs_swap_extents(
+ if (error)
+ goto out_unlock;
+
++ if (xfs_inode_has_cow_data(tip)) {
++ error = xfs_reflink_cancel_cow_range(tip, 0, NULLFILEOFF, true);
++ if (error)
++ return error;
++ }
++
+ /*
+ * Extent "swapping" with rmap requires a permanent reservation and
+ * a block reservation because it's really just a remap operation
+diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
+index 12d8455bfbb2..010db5f8fb00 100644
+--- a/fs/xfs/xfs_buf_item.c
++++ b/fs/xfs/xfs_buf_item.c
+@@ -1233,9 +1233,23 @@ xfs_buf_iodone(
+ }
+
+ /*
+- * Requeue a failed buffer for writeback
++ * Requeue a failed buffer for writeback.
+ *
+- * Return true if the buffer has been re-queued properly, false otherwise
++ * We clear the log item failed state here as well, but we have to be careful
++ * about reference counts because the only active reference counts on the buffer
++ * may be the failed log items. Hence if we clear the log item failed state
++ * before queuing the buffer for IO we can release all active references to
++ * the buffer and free it, leading to use after free problems in
++ * xfs_buf_delwri_queue. It makes no difference to the buffer or log items which
++ * order we process them in - the buffer is locked, and we own the buffer list
++ * so nothing on them is going to change while we are performing this action.
++ *
++ * Hence we can safely queue the buffer for IO before we clear the failed log
++ * item state, therefore always having an active reference to the buffer and
++ * avoiding the transient zero-reference state that leads to use-after-free.
++ *
++ * Return true if the buffer was added to the buffer list, false if it was
++ * already on the buffer list.
+ */
+ bool
+ xfs_buf_resubmit_failed_buffers(
+@@ -1243,16 +1257,16 @@ xfs_buf_resubmit_failed_buffers(
+ struct list_head *buffer_list)
+ {
+ struct xfs_log_item *lip;
++ bool ret;
++
++ ret = xfs_buf_delwri_queue(bp, buffer_list);
+
+ /*
+- * Clear XFS_LI_FAILED flag from all items before resubmit
+- *
+- * XFS_LI_FAILED set/clear is protected by ail_lock, caller this
++ * XFS_LI_FAILED set/clear is protected by ail_lock, caller of this
+ * function already have it acquired
+ */
+ list_for_each_entry(lip, &bp->b_li_list, li_bio_list)
+ xfs_clear_li_failed(lip);
+
+- /* Add this buffer back to the delayed write list */
+- return xfs_buf_delwri_queue(bp, buffer_list);
++ return ret;
+ }
+diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
+index 0ef5ece5634c..bad90479ade2 100644
+--- a/fs/xfs/xfs_ioctl.c
++++ b/fs/xfs/xfs_ioctl.c
+@@ -1616,7 +1616,7 @@ xfs_ioc_getbmap(
+ error = 0;
+ out_free_buf:
+ kmem_free(buf);
+- return 0;
++ return error;
+ }
+
+ struct getfsmap_info {
+diff --git a/fs/xfs/xfs_qm_bhv.c b/fs/xfs/xfs_qm_bhv.c
+index 73a1d77ec187..3091e4bc04ef 100644
+--- a/fs/xfs/xfs_qm_bhv.c
++++ b/fs/xfs/xfs_qm_bhv.c
+@@ -40,7 +40,7 @@ xfs_fill_statvfs_from_dquot(
+ statp->f_files = limit;
+ statp->f_ffree =
+ (statp->f_files > dqp->q_res_icount) ?
+- (statp->f_ffree - dqp->q_res_icount) : 0;
++ (statp->f_files - dqp->q_res_icount) : 0;
+ }
+ }
+
+diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
+index 42ea7bab9144..7088f44c0c59 100644
+--- a/fs/xfs/xfs_reflink.c
++++ b/fs/xfs/xfs_reflink.c
+@@ -302,6 +302,7 @@ xfs_reflink_reserve_cow(
+ if (error)
+ return error;
+
++ xfs_trim_extent(imap, got.br_startoff, got.br_blockcount);
+ trace_xfs_reflink_cow_alloc(ip, &got);
+ return 0;
+ }
+diff --git a/fs/xfs/xfs_stats.c b/fs/xfs/xfs_stats.c
+index 4e4423153071..740ac9674848 100644
+--- a/fs/xfs/xfs_stats.c
++++ b/fs/xfs/xfs_stats.c
+@@ -119,7 +119,7 @@ static int xqmstat_proc_show(struct seq_file *m, void *v)
+ int j;
+
+ seq_printf(m, "qm");
+- for (j = XFSSTAT_END_IBT_V2; j < XFSSTAT_END_XQMSTAT; j++)
++ for (j = XFSSTAT_END_REFCOUNT; j < XFSSTAT_END_XQMSTAT; j++)
+ seq_printf(m, " %u", counter_val(xfsstats.xs_stats, j));
+ seq_putc(m, '\n');
+ return 0;
+diff --git a/include/linux/cpu.h b/include/linux/cpu.h
+index 218df7f4d3e1..5041357d0297 100644
+--- a/include/linux/cpu.h
++++ b/include/linux/cpu.h
+@@ -180,12 +180,10 @@ enum cpuhp_smt_control {
+ #if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_SMT)
+ extern enum cpuhp_smt_control cpu_smt_control;
+ extern void cpu_smt_disable(bool force);
+-extern void cpu_smt_check_topology_early(void);
+ extern void cpu_smt_check_topology(void);
+ #else
+ # define cpu_smt_control (CPU_SMT_ENABLED)
+ static inline void cpu_smt_disable(bool force) { }
+-static inline void cpu_smt_check_topology_early(void) { }
+ static inline void cpu_smt_check_topology(void) { }
+ #endif
+
+diff --git a/include/linux/genl_magic_struct.h b/include/linux/genl_magic_struct.h
+index 5972e4969197..eeae59d3ceb7 100644
+--- a/include/linux/genl_magic_struct.h
++++ b/include/linux/genl_magic_struct.h
+@@ -191,6 +191,7 @@ static inline void ct_assert_unique_operations(void)
+ {
+ switch (0) {
+ #include GENL_MAGIC_INCLUDE_FILE
++ case 0:
+ ;
+ }
+ }
+@@ -209,6 +210,7 @@ static inline void ct_assert_unique_top_level_attributes(void)
+ {
+ switch (0) {
+ #include GENL_MAGIC_INCLUDE_FILE
++ case 0:
+ ;
+ }
+ }
+@@ -218,7 +220,8 @@ static inline void ct_assert_unique_top_level_attributes(void)
+ static inline void ct_assert_unique_ ## s_name ## _attributes(void) \
+ { \
+ switch (0) { \
+- s_fields \
++ s_fields \
++ case 0: \
+ ; \
+ } \
+ }
+diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
+index 21ddbe440030..acc4279ad5e3 100644
+--- a/include/linux/gpio/consumer.h
++++ b/include/linux/gpio/consumer.h
+@@ -142,7 +142,7 @@ int gpiod_is_active_low(const struct gpio_desc *desc);
+ int gpiod_cansleep(const struct gpio_desc *desc);
+
+ int gpiod_to_irq(const struct gpio_desc *desc);
+-void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name);
++int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name);
+
+ /* Convert between the old gpio_ and new gpiod_ interfaces */
+ struct gpio_desc *gpio_to_desc(unsigned gpio);
+@@ -465,10 +465,12 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc)
+ return -EINVAL;
+ }
+
+-static inline void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)
++static inline int gpiod_set_consumer_name(struct gpio_desc *desc,
++ const char *name)
+ {
+ /* GPIO can never have been requested */
+ WARN_ON(1);
++ return -EINVAL;
+ }
+
+ static inline struct gpio_desc *gpio_to_desc(unsigned gpio)
+diff --git a/include/linux/hid-debug.h b/include/linux/hid-debug.h
+index 8663f216c563..2d6100edf204 100644
+--- a/include/linux/hid-debug.h
++++ b/include/linux/hid-debug.h
+@@ -24,7 +24,10 @@
+
+ #ifdef CONFIG_DEBUG_FS
+
++#include <linux/kfifo.h>
++
+ #define HID_DEBUG_BUFSIZE 512
++#define HID_DEBUG_FIFOSIZE 512
+
+ void hid_dump_input(struct hid_device *, struct hid_usage *, __s32);
+ void hid_dump_report(struct hid_device *, int , u8 *, int);
+@@ -37,11 +40,8 @@ void hid_debug_init(void);
+ void hid_debug_exit(void);
+ void hid_debug_event(struct hid_device *, char *);
+
+-
+ struct hid_debug_list {
+- char *hid_debug_buf;
+- int head;
+- int tail;
++ DECLARE_KFIFO_PTR(hid_debug_fifo, char);
+ struct fasync_struct *fasync;
+ struct hid_device *hdev;
+ struct list_head node;
+@@ -64,4 +64,3 @@ struct hid_debug_list {
+ #endif
+
+ #endif
+-
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index c926698040e0..a03d5e264e5e 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -694,7 +694,8 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
+ int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ void *data, unsigned long len);
+ int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+- void *data, int offset, unsigned long len);
++ void *data, unsigned int offset,
++ unsigned long len);
+ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ gpa_t gpa, unsigned long len);
+ int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len);
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index 88a041b73abf..bbcfe2e5fd91 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -1321,7 +1321,7 @@ enum {
+ static inline const struct cpumask *
+ mlx5_get_vector_affinity_hint(struct mlx5_core_dev *dev, int vector)
+ {
+- return dev->priv.irq_info[vector].mask;
++ return dev->priv.irq_info[vector + MLX5_EQ_VEC_COMP_BASE].mask;
+ }
+
+ #endif /* MLX5_DRIVER_H */
+diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
+index ea8c93bbb0e0..e87f2d5b3cc6 100644
+--- a/include/sound/compress_driver.h
++++ b/include/sound/compress_driver.h
+@@ -171,7 +171,11 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)
+ if (snd_BUG_ON(!stream))
+ return;
+
+- stream->runtime->state = SNDRV_PCM_STATE_SETUP;
++ if (stream->direction == SND_COMPRESS_PLAYBACK)
++ stream->runtime->state = SNDRV_PCM_STATE_SETUP;
++ else
++ stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
++
+ wake_up(&stream->runtime->sleep);
+ }
+
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 1aa517908561..e578c3999970 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -1743,7 +1743,7 @@ static int parse_cgroup_root_flags(char *data, unsigned int *root_flags)
+
+ *root_flags = 0;
+
+- if (!data)
++ if (!data || *data == '\0')
+ return 0;
+
+ while ((token = strsep(&data, ",")) != NULL) {
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 1699ff68c412..56f657adcf03 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -355,9 +355,6 @@ void __weak arch_smt_update(void) { }
+
+ #ifdef CONFIG_HOTPLUG_SMT
+ enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
+-EXPORT_SYMBOL_GPL(cpu_smt_control);
+-
+-static bool cpu_smt_available __read_mostly;
+
+ void __init cpu_smt_disable(bool force)
+ {
+@@ -375,25 +372,11 @@ void __init cpu_smt_disable(bool force)
+
+ /*
+ * The decision whether SMT is supported can only be done after the full
+- * CPU identification. Called from architecture code before non boot CPUs
+- * are brought up.
+- */
+-void __init cpu_smt_check_topology_early(void)
+-{
+- if (!topology_smt_supported())
+- cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
+-}
+-
+-/*
+- * If SMT was disabled by BIOS, detect it here, after the CPUs have been
+- * brought online. This ensures the smt/l1tf sysfs entries are consistent
+- * with reality. cpu_smt_available is set to true during the bringup of non
+- * boot CPUs when a SMT sibling is detected. Note, this may overwrite
+- * cpu_smt_control's previous setting.
++ * CPU identification. Called from architecture code.
+ */
+ void __init cpu_smt_check_topology(void)
+ {
+- if (!cpu_smt_available)
++ if (!topology_smt_supported())
+ cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
+ }
+
+@@ -406,18 +389,10 @@ early_param("nosmt", smt_cmdline_disable);
+
+ static inline bool cpu_smt_allowed(unsigned int cpu)
+ {
+- if (topology_is_primary_thread(cpu))
++ if (cpu_smt_control == CPU_SMT_ENABLED)
+ return true;
+
+- /*
+- * If the CPU is not a 'primary' thread and the booted_once bit is
+- * set then the processor has SMT support. Store this information
+- * for the late check of SMT support in cpu_smt_check_topology().
+- */
+- if (per_cpu(cpuhp_state, cpu).booted_once)
+- cpu_smt_available = true;
+-
+- if (cpu_smt_control == CPU_SMT_ENABLED)
++ if (topology_is_primary_thread(cpu))
+ return true;
+
+ /*
+diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
+index 65c0f1363788..94aa9ae0007a 100644
+--- a/kernel/debug/debug_core.c
++++ b/kernel/debug/debug_core.c
+@@ -535,6 +535,8 @@ return_normal:
+ arch_kgdb_ops.correct_hw_break();
+ if (trace_on)
+ tracing_on();
++ kgdb_info[cpu].debuggerinfo = NULL;
++ kgdb_info[cpu].task = NULL;
+ kgdb_info[cpu].exception_state &=
+ ~(DCPU_WANT_MASTER | DCPU_IS_SLAVE);
+ kgdb_info[cpu].enter_kgdb--;
+@@ -667,6 +669,8 @@ kgdb_restore:
+ if (trace_on)
+ tracing_on();
+
++ kgdb_info[cpu].debuggerinfo = NULL;
++ kgdb_info[cpu].task = NULL;
+ kgdb_info[cpu].exception_state &=
+ ~(DCPU_WANT_MASTER | DCPU_IS_SLAVE);
+ kgdb_info[cpu].enter_kgdb--;
+diff --git a/kernel/debug/kdb/kdb_bt.c b/kernel/debug/kdb/kdb_bt.c
+index 7921ae4fca8d..7e2379aa0a1e 100644
+--- a/kernel/debug/kdb/kdb_bt.c
++++ b/kernel/debug/kdb/kdb_bt.c
+@@ -186,7 +186,16 @@ kdb_bt(int argc, const char **argv)
+ kdb_printf("btc: cpu status: ");
+ kdb_parse("cpu\n");
+ for_each_online_cpu(cpu) {
+- sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu));
++ void *kdb_tsk = KDB_TSK(cpu);
++
++ /* If a CPU failed to round up we could be here */
++ if (!kdb_tsk) {
++ kdb_printf("WARNING: no task for cpu %ld\n",
++ cpu);
++ continue;
++ }
++
++ sprintf(buf, "btt 0x%px\n", kdb_tsk);
+ kdb_parse(buf);
+ touch_nmi_watchdog();
+ }
+diff --git a/kernel/debug/kdb/kdb_debugger.c b/kernel/debug/kdb/kdb_debugger.c
+index 15e1a7af5dd0..53a0df6e4d92 100644
+--- a/kernel/debug/kdb/kdb_debugger.c
++++ b/kernel/debug/kdb/kdb_debugger.c
+@@ -118,13 +118,6 @@ int kdb_stub(struct kgdb_state *ks)
+ kdb_bp_remove();
+ KDB_STATE_CLEAR(DOING_SS);
+ KDB_STATE_SET(PAGER);
+- /* zero out any offline cpu data */
+- for_each_present_cpu(i) {
+- if (!cpu_online(i)) {
+- kgdb_info[i].debuggerinfo = NULL;
+- kgdb_info[i].task = NULL;
+- }
+- }
+ if (ks->err_code == DIE_OOPS || reason == KDB_REASON_OOPS) {
+ ks->pass_exception = 1;
+ KDB_FLAG_SET(CATASTROPHIC);
+diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
+index 5d3cf407e374..51386d9105fa 100644
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -724,6 +724,9 @@ struct ring_buffer *rb_alloc(int nr_pages, long watermark, int cpu, int flags)
+ size = sizeof(struct ring_buffer);
+ size += nr_pages * sizeof(void *);
+
++ if (order_base_2(size) >= MAX_ORDER)
++ goto fail;
++
+ rb = kzalloc(size, GFP_KERNEL);
+ if (!rb)
+ goto fail;
+diff --git a/kernel/futex.c b/kernel/futex.c
+index f89abca89513..d7c465fd687c 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2850,35 +2850,39 @@ retry_private:
+ * and BUG when futex_unlock_pi() interleaves with this.
+ *
+ * Therefore acquire wait_lock while holding hb->lock, but drop the
+- * latter before calling rt_mutex_start_proxy_lock(). This still fully
+- * serializes against futex_unlock_pi() as that does the exact same
+- * lock handoff sequence.
++ * latter before calling __rt_mutex_start_proxy_lock(). This
++ * interleaves with futex_unlock_pi() -- which does a similar lock
++ * handoff -- such that the latter can observe the futex_q::pi_state
++ * before __rt_mutex_start_proxy_lock() is done.
+ */
+ raw_spin_lock_irq(&q.pi_state->pi_mutex.wait_lock);
+ spin_unlock(q.lock_ptr);
++ /*
++ * __rt_mutex_start_proxy_lock() unconditionally enqueues the @rt_waiter
++ * such that futex_unlock_pi() is guaranteed to observe the waiter when
++ * it sees the futex_q::pi_state.
++ */
+ ret = __rt_mutex_start_proxy_lock(&q.pi_state->pi_mutex, &rt_waiter, current);
+ raw_spin_unlock_irq(&q.pi_state->pi_mutex.wait_lock);
+
+ if (ret) {
+ if (ret == 1)
+ ret = 0;
+-
+- spin_lock(q.lock_ptr);
+- goto no_block;
++ goto cleanup;
+ }
+
+-
+ if (unlikely(to))
+ hrtimer_start_expires(&to->timer, HRTIMER_MODE_ABS);
+
+ ret = rt_mutex_wait_proxy_lock(&q.pi_state->pi_mutex, to, &rt_waiter);
+
++cleanup:
+ spin_lock(q.lock_ptr);
+ /*
+- * If we failed to acquire the lock (signal/timeout), we must
++ * If we failed to acquire the lock (deadlock/signal/timeout), we must
+ * first acquire the hb->lock before removing the lock from the
+- * rt_mutex waitqueue, such that we can keep the hb and rt_mutex
+- * wait lists consistent.
++ * rt_mutex waitqueue, such that we can keep the hb and rt_mutex wait
++ * lists consistent.
+ *
+ * In particular; it is important that futex_unlock_pi() can not
+ * observe this inconsistency.
+@@ -3002,6 +3006,10 @@ retry:
+ * there is no point where we hold neither; and therefore
+ * wake_futex_pi() must observe a state consistent with what we
+ * observed.
++ *
++ * In particular; this forces __rt_mutex_start_proxy() to
++ * complete such that we're guaranteed to observe the
++ * rt_waiter. Also see the WARN in wake_futex_pi().
+ */
+ raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
+ spin_unlock(&hb->lock);
+diff --git a/kernel/hung_task.c b/kernel/hung_task.c
+index b9132d1269ef..9eca2371f189 100644
+--- a/kernel/hung_task.c
++++ b/kernel/hung_task.c
+@@ -33,7 +33,7 @@ int __read_mostly sysctl_hung_task_check_count = PID_MAX_LIMIT;
+ * is disabled during the critical section. It also controls the size of
+ * the RCU grace period. So it needs to be upper-bound.
+ */
+-#define HUNG_TASK_BATCHING 1024
++#define HUNG_TASK_LOCK_BREAK (HZ / 10)
+
+ /*
+ * Zero means infinite timeout - no checking done:
+@@ -111,8 +111,11 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
+
+ trace_sched_process_hang(t);
+
+- if (!sysctl_hung_task_warnings && !sysctl_hung_task_panic)
+- return;
++ if (sysctl_hung_task_panic) {
++ console_verbose();
++ hung_task_show_lock = true;
++ hung_task_call_panic = true;
++ }
+
+ /*
+ * Ok, the task did not get scheduled for more than 2 minutes,
+@@ -134,11 +137,6 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
+ }
+
+ touch_nmi_watchdog();
+-
+- if (sysctl_hung_task_panic) {
+- hung_task_show_lock = true;
+- hung_task_call_panic = true;
+- }
+ }
+
+ /*
+@@ -172,7 +170,7 @@ static bool rcu_lock_break(struct task_struct *g, struct task_struct *t)
+ static void check_hung_uninterruptible_tasks(unsigned long timeout)
+ {
+ int max_count = sysctl_hung_task_check_count;
+- int batch_count = HUNG_TASK_BATCHING;
++ unsigned long last_break = jiffies;
+ struct task_struct *g, *t;
+
+ /*
+@@ -187,10 +185,10 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout)
+ for_each_process_thread(g, t) {
+ if (!max_count--)
+ goto unlock;
+- if (!--batch_count) {
+- batch_count = HUNG_TASK_BATCHING;
++ if (time_after(jiffies, last_break + HUNG_TASK_LOCK_BREAK)) {
+ if (!rcu_lock_break(g, t))
+ goto unlock;
++ last_break = jiffies;
+ }
+ /* use "==" to skip the TASK_KILLABLE tasks waiting on NFS */
+ if (t->state == TASK_UNINTERRUPTIBLE)
+diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
+index f4f29b9d90ee..e12cdf637c71 100644
+--- a/kernel/irq/affinity.c
++++ b/kernel/irq/affinity.c
+@@ -117,12 +117,11 @@ static int irq_build_affinity_masks(const struct irq_affinity *affd,
+ */
+ if (numvecs <= nodes) {
+ for_each_node_mask(n, nodemsk) {
+- cpumask_copy(masks + curvec, node_to_cpumask[n]);
+- if (++done == numvecs)
+- break;
++ cpumask_or(masks + curvec, masks + curvec, node_to_cpumask[n]);
+ if (++curvec == last_affv)
+ curvec = affd->pre_vectors;
+ }
++ done = numvecs;
+ goto out;
+ }
+
+diff --git a/kernel/kcov.c b/kernel/kcov.c
+index 97959d7b77e2..c2277dbdbfb1 100644
+--- a/kernel/kcov.c
++++ b/kernel/kcov.c
+@@ -112,7 +112,7 @@ void notrace __sanitizer_cov_trace_pc(void)
+ EXPORT_SYMBOL(__sanitizer_cov_trace_pc);
+
+ #ifdef CONFIG_KCOV_ENABLE_COMPARISONS
+-static void write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
++static void notrace write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
+ {
+ struct task_struct *t;
+ u64 *area;
+diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
+index 2823d4163a37..9562aaa2afdc 100644
+--- a/kernel/locking/rtmutex.c
++++ b/kernel/locking/rtmutex.c
+@@ -1726,12 +1726,33 @@ void rt_mutex_proxy_unlock(struct rt_mutex *lock,
+ rt_mutex_set_owner(lock, NULL);
+ }
+
++/**
++ * __rt_mutex_start_proxy_lock() - Start lock acquisition for another task
++ * @lock: the rt_mutex to take
++ * @waiter: the pre-initialized rt_mutex_waiter
++ * @task: the task to prepare
++ *
++ * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock
++ * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that.
++ *
++ * NOTE: does _NOT_ remove the @waiter on failure; must either call
++ * rt_mutex_wait_proxy_lock() or rt_mutex_cleanup_proxy_lock() after this.
++ *
++ * Returns:
++ * 0 - task blocked on lock
++ * 1 - acquired the lock for task, caller should wake it up
++ * <0 - error
++ *
++ * Special API call for PI-futex support.
++ */
+ int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
+ struct rt_mutex_waiter *waiter,
+ struct task_struct *task)
+ {
+ int ret;
+
++ lockdep_assert_held(&lock->wait_lock);
++
+ if (try_to_take_rt_mutex(lock, task, NULL))
+ return 1;
+
+@@ -1749,9 +1770,6 @@ int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
+ ret = 0;
+ }
+
+- if (unlikely(ret))
+- remove_waiter(lock, waiter);
+-
+ debug_rt_mutex_print_deadlock(waiter);
+
+ return ret;
+@@ -1763,12 +1781,18 @@ int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
+ * @waiter: the pre-initialized rt_mutex_waiter
+ * @task: the task to prepare
+ *
++ * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock
++ * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that.
++ *
++ * NOTE: unlike __rt_mutex_start_proxy_lock this _DOES_ remove the @waiter
++ * on failure.
++ *
+ * Returns:
+ * 0 - task blocked on lock
+ * 1 - acquired the lock for task, caller should wake it up
+ * <0 - error
+ *
+- * Special API call for FUTEX_REQUEUE_PI support.
++ * Special API call for PI-futex support.
+ */
+ int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
+ struct rt_mutex_waiter *waiter,
+@@ -1778,6 +1802,8 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
+
+ raw_spin_lock_irq(&lock->wait_lock);
+ ret = __rt_mutex_start_proxy_lock(lock, waiter, task);
++ if (unlikely(ret))
++ remove_waiter(lock, waiter);
+ raw_spin_unlock_irq(&lock->wait_lock);
+
+ return ret;
+@@ -1845,7 +1871,8 @@ int rt_mutex_wait_proxy_lock(struct rt_mutex *lock,
+ * @lock: the rt_mutex we were woken on
+ * @waiter: the pre-initialized rt_mutex_waiter
+ *
+- * Attempt to clean up after a failed rt_mutex_wait_proxy_lock().
++ * Attempt to clean up after a failed __rt_mutex_start_proxy_lock() or
++ * rt_mutex_wait_proxy_lock().
+ *
+ * Unless we acquired the lock; we're still enqueued on the wait-list and can
+ * in fact still be granted ownership until we're removed. Therefore we can
+diff --git a/kernel/module.c b/kernel/module.c
+index 6746c85511fe..38bf28b5cc20 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1207,8 +1207,10 @@ static ssize_t store_uevent(struct module_attribute *mattr,
+ struct module_kobject *mk,
+ const char *buffer, size_t count)
+ {
+- kobject_synth_uevent(&mk->kobj, buffer, count);
+- return count;
++ int rc;
++
++ rc = kobject_synth_uevent(&mk->kobj, buffer, count);
++ return rc ? rc : count;
+ }
+
+ struct module_attribute module_uevent =
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 7137bc343b4a..f7c375d1e601 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -5932,6 +5932,7 @@ static inline int find_idlest_cpu(struct sched_domain *sd, struct task_struct *p
+
+ #ifdef CONFIG_SCHED_SMT
+ DEFINE_STATIC_KEY_FALSE(sched_smt_present);
++EXPORT_SYMBOL_GPL(sched_smt_present);
+
+ static inline void set_idle_cores(int cpu, int val)
+ {
+diff --git a/kernel/smp.c b/kernel/smp.c
+index d86eec5f51c1..084c8b3a2681 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -584,8 +584,6 @@ void __init smp_init(void)
+ num_nodes, (num_nodes > 1 ? "s" : ""),
+ num_cpus, (num_cpus > 1 ? "s" : ""));
+
+- /* Final decision about SMT support */
+- cpu_smt_check_topology();
+ /* Any cleanup work */
+ smp_cpus_done(setup_max_cpus);
+ }
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index cc02050fd0c4..32dea29d05a0 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2767,6 +2767,8 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
+ bool neg;
+
+ left -= proc_skip_spaces(&p);
++ if (!left)
++ break;
+
+ err = proc_get_long(&p, &left, &val, &neg,
+ proc_wspace_sep,
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index f3b22f456fac..7846ce24ecc0 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -50,7 +50,9 @@ enum timekeeping_adv_mode {
+ static struct {
+ seqcount_t seq;
+ struct timekeeper timekeeper;
+-} tk_core ____cacheline_aligned;
++} tk_core ____cacheline_aligned = {
++ .seq = SEQCNT_ZERO(tk_core.seq),
++};
+
+ static DEFINE_RAW_SPINLOCK(timekeeper_lock);
+ static struct timekeeper shadow_timekeeper;
+diff --git a/lib/seq_buf.c b/lib/seq_buf.c
+index 11f2ae0f9099..6aabb609dd87 100644
+--- a/lib/seq_buf.c
++++ b/lib/seq_buf.c
+@@ -144,9 +144,13 @@ int seq_buf_puts(struct seq_buf *s, const char *str)
+
+ WARN_ON(s->size == 0);
+
++ /* Add 1 to len for the trailing null byte which must be there */
++ len += 1;
++
+ if (seq_buf_can_fit(s, len)) {
+ memcpy(s->buffer + s->len, str, len);
+- s->len += len;
++ /* Don't count the trailing null byte against the capacity */
++ s->len += len - 1;
+ return 0;
+ }
+ seq_buf_set_overflow(s);
+diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
+index 82ac39ce5310..aecc0996628f 100644
+--- a/lib/test_rhashtable.c
++++ b/lib/test_rhashtable.c
+@@ -541,38 +541,45 @@ static unsigned int __init print_ht(struct rhltable *rhlt)
+ static int __init test_insert_dup(struct test_obj_rhl *rhl_test_objects,
+ int cnt, bool slow)
+ {
+- struct rhltable rhlt;
++ struct rhltable *rhlt;
+ unsigned int i, ret;
+ const char *key;
+ int err = 0;
+
+- err = rhltable_init(&rhlt, &test_rht_params_dup);
+- if (WARN_ON(err))
++ rhlt = kmalloc(sizeof(*rhlt), GFP_KERNEL);
++ if (WARN_ON(!rhlt))
++ return -EINVAL;
++
++ err = rhltable_init(rhlt, &test_rht_params_dup);
++ if (WARN_ON(err)) {
++ kfree(rhlt);
+ return err;
++ }
+
+ for (i = 0; i < cnt; i++) {
+ rhl_test_objects[i].value.tid = i;
+- key = rht_obj(&rhlt.ht, &rhl_test_objects[i].list_node.rhead);
++ key = rht_obj(&rhlt->ht, &rhl_test_objects[i].list_node.rhead);
+ key += test_rht_params_dup.key_offset;
+
+ if (slow) {
+- err = PTR_ERR(rhashtable_insert_slow(&rhlt.ht, key,
++ err = PTR_ERR(rhashtable_insert_slow(&rhlt->ht, key,
+ &rhl_test_objects[i].list_node.rhead));
+ if (err == -EAGAIN)
+ err = 0;
+ } else
+- err = rhltable_insert(&rhlt,
++ err = rhltable_insert(rhlt,
+ &rhl_test_objects[i].list_node,
+ test_rht_params_dup);
+ if (WARN(err, "error %d on element %d/%d (%s)\n", err, i, cnt, slow? "slow" : "fast"))
+ goto skip_print;
+ }
+
+- ret = print_ht(&rhlt);
++ ret = print_ht(rhlt);
+ WARN(ret != cnt, "missing rhltable elements (%d != %d, %s)\n", ret, cnt, slow? "slow" : "fast");
+
+ skip_print:
+- rhltable_destroy(&rhlt);
++ rhltable_destroy(rhlt);
++ kfree(rhlt);
+
+ return 0;
+ }
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 9e45553cabd6..a9de1dbb9a6c 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -294,6 +294,32 @@ EXPORT_SYMBOL(nr_online_nodes);
+ int page_group_by_mobility_disabled __read_mostly;
+
+ #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
++/*
++ * During boot we initialize deferred pages on-demand, as needed, but once
++ * page_alloc_init_late() has finished, the deferred pages are all initialized,
++ * and we can permanently disable that path.
++ */
++static DEFINE_STATIC_KEY_TRUE(deferred_pages);
++
++/*
++ * Calling kasan_free_pages() only after deferred memory initialization
++ * has completed. Poisoning pages during deferred memory init will greatly
++ * lengthen the process and cause problem in large memory systems as the
++ * deferred pages initialization is done with interrupt disabled.
++ *
++ * Assuming that there will be no reference to those newly initialized
++ * pages before they are ever allocated, this should have no effect on
++ * KASAN memory tracking as the poison will be properly inserted at page
++ * allocation time. The only corner case is when pages are allocated by
++ * on-demand allocation and then freed again before the deferred pages
++ * initialization is done, but this is not likely to happen.
++ */
++static inline void kasan_free_nondeferred_pages(struct page *page, int order)
++{
++ if (!static_branch_unlikely(&deferred_pages))
++ kasan_free_pages(page, order);
++}
++
+ /* Returns true if the struct page for the pfn is uninitialised */
+ static inline bool __meminit early_page_uninitialised(unsigned long pfn)
+ {
+@@ -326,6 +352,8 @@ static inline bool update_defer_init(pg_data_t *pgdat,
+ return true;
+ }
+ #else
++#define kasan_free_nondeferred_pages(p, o) kasan_free_pages(p, o)
++
+ static inline bool early_page_uninitialised(unsigned long pfn)
+ {
+ return false;
+@@ -1030,7 +1058,7 @@ static __always_inline bool free_pages_prepare(struct page *page,
+ arch_free_page(page, order);
+ kernel_poison_pages(page, 1 << order, 0);
+ kernel_map_pages(page, 1 << order, 0);
+- kasan_free_pages(page, order);
++ kasan_free_nondeferred_pages(page, order);
+
+ return true;
+ }
+@@ -1593,13 +1621,6 @@ static int __init deferred_init_memmap(void *data)
+ return 0;
+ }
+
+-/*
+- * During boot we initialize deferred pages on-demand, as needed, but once
+- * page_alloc_init_late() has finished, the deferred pages are all initialized,
+- * and we can permanently disable that path.
+- */
+-static DEFINE_STATIC_KEY_TRUE(deferred_pages);
+-
+ /*
+ * If this zone has deferred pages, try to grow it by initializing enough
+ * deferred pages to satisfy the allocation specified by order, rounded up to
+diff --git a/mm/percpu-km.c b/mm/percpu-km.c
+index 38de70ab1a0d..0f643dc2dc65 100644
+--- a/mm/percpu-km.c
++++ b/mm/percpu-km.c
+@@ -50,6 +50,7 @@ static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
+ const int nr_pages = pcpu_group_sizes[0] >> PAGE_SHIFT;
+ struct pcpu_chunk *chunk;
+ struct page *pages;
++ unsigned long flags;
+ int i;
+
+ chunk = pcpu_alloc_chunk(gfp);
+@@ -68,9 +69,9 @@ static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
+ chunk->data = pages;
+ chunk->base_addr = page_address(pages) - pcpu_group_offsets[0];
+
+- spin_lock_irq(&pcpu_lock);
++ spin_lock_irqsave(&pcpu_lock, flags);
+ pcpu_chunk_populated(chunk, 0, nr_pages, false);
+- spin_unlock_irq(&pcpu_lock);
++ spin_unlock_irqrestore(&pcpu_lock, flags);
+
+ pcpu_stats_chunk_alloc();
+ trace_percpu_create_chunk(chunk->base_addr);
+diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
+index 6eb837a47b5c..baaaeb2b2c42 100644
+--- a/net/dccp/ccid.h
++++ b/net/dccp/ccid.h
+@@ -202,7 +202,7 @@ static inline void ccid_hc_tx_packet_recv(struct ccid *ccid, struct sock *sk,
+ static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk,
+ u8 pkt, u8 opt, u8 *val, u8 len)
+ {
+- if (ccid->ccid_ops->ccid_hc_tx_parse_options == NULL)
++ if (!ccid || !ccid->ccid_ops->ccid_hc_tx_parse_options)
+ return 0;
+ return ccid->ccid_ops->ccid_hc_tx_parse_options(sk, pkt, opt, val, len);
+ }
+@@ -214,7 +214,7 @@ static inline int ccid_hc_tx_parse_options(struct ccid *ccid, struct sock *sk,
+ static inline int ccid_hc_rx_parse_options(struct ccid *ccid, struct sock *sk,
+ u8 pkt, u8 opt, u8 *val, u8 len)
+ {
+- if (ccid->ccid_ops->ccid_hc_rx_parse_options == NULL)
++ if (!ccid || !ccid->ccid_ops->ccid_hc_rx_parse_options)
+ return 0;
+ return ccid->ccid_ops->ccid_hc_rx_parse_options(sk, pkt, opt, val, len);
+ }
+diff --git a/net/dsa/master.c b/net/dsa/master.c
+index c90ee3227dea..aae478d61101 100644
+--- a/net/dsa/master.c
++++ b/net/dsa/master.c
+@@ -158,6 +158,8 @@ static void dsa_master_ethtool_teardown(struct net_device *dev)
+ cpu_dp->orig_ethtool_ops = NULL;
+ }
+
++static struct lock_class_key dsa_master_addr_list_lock_key;
++
+ int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
+ {
+ /* If we use a tagging format that doesn't have an ethertype
+@@ -167,6 +169,8 @@ int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
+ wmb();
+
+ dev->dsa_ptr = cpu_dp;
++ lockdep_set_class(&dev->addr_list_lock,
++ &dsa_master_addr_list_lock_key);
+
+ return dsa_master_ethtool_setup(dev);
+ }
+diff --git a/net/dsa/slave.c b/net/dsa/slave.c
+index 1c45c1d6d241..b39720d0995d 100644
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -140,11 +140,14 @@ static int dsa_slave_close(struct net_device *dev)
+ static void dsa_slave_change_rx_flags(struct net_device *dev, int change)
+ {
+ struct net_device *master = dsa_slave_to_master(dev);
+-
+- if (change & IFF_ALLMULTI)
+- dev_set_allmulti(master, dev->flags & IFF_ALLMULTI ? 1 : -1);
+- if (change & IFF_PROMISC)
+- dev_set_promiscuity(master, dev->flags & IFF_PROMISC ? 1 : -1);
++ if (dev->flags & IFF_UP) {
++ if (change & IFF_ALLMULTI)
++ dev_set_allmulti(master,
++ dev->flags & IFF_ALLMULTI ? 1 : -1);
++ if (change & IFF_PROMISC)
++ dev_set_promiscuity(master,
++ dev->flags & IFF_PROMISC ? 1 : -1);
++ }
+ }
+
+ static void dsa_slave_set_rx_mode(struct net_device *dev)
+@@ -639,7 +642,7 @@ static int dsa_slave_set_eee(struct net_device *dev, struct ethtool_eee *e)
+ int ret;
+
+ /* Port's PHY and MAC both need to be EEE capable */
+- if (!dev->phydev && !dp->pl)
++ if (!dev->phydev || !dp->pl)
+ return -ENODEV;
+
+ if (!ds->ops->set_mac_eee)
+@@ -659,7 +662,7 @@ static int dsa_slave_get_eee(struct net_device *dev, struct ethtool_eee *e)
+ int ret;
+
+ /* Port's PHY and MAC both need to be EEE capable */
+- if (!dev->phydev && !dp->pl)
++ if (!dev->phydev || !dp->pl)
+ return -ENODEV;
+
+ if (!ds->ops->get_mac_eee)
+diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
+index 4a46df8441c9..f5b4febeaa25 100644
+--- a/net/ipv6/xfrm6_tunnel.c
++++ b/net/ipv6/xfrm6_tunnel.c
+@@ -144,6 +144,9 @@ static u32 __xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr)
+ index = __xfrm6_tunnel_spi_check(net, spi);
+ if (index >= 0)
+ goto alloc_spi;
++
++ if (spi == XFRM6_TUNNEL_SPI_MAX)
++ break;
+ }
+ for (spi = XFRM6_TUNNEL_SPI_MIN; spi < xfrm6_tn->spi; spi++) {
+ index = __xfrm6_tunnel_spi_check(net, spi);
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 5e2b4a41acf1..51ad330bf8e8 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -142,6 +142,9 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
+ /* allocate extra bitmaps */
+ if (status->chains)
+ len += 4 * hweight8(status->chains);
++ /* vendor presence bitmap */
++ if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)
++ len += 4;
+
+ if (ieee80211_have_rx_timestamp(status)) {
+ len = ALIGN(len, 8);
+@@ -197,8 +200,6 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
+ if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
+ struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;
+
+- /* vendor presence bitmap */
+- len += 4;
+ /* alignment for fixed 6-byte vendor data header */
+ len = ALIGN(len, 2);
+ /* vendor data header */
+diff --git a/net/rds/bind.c b/net/rds/bind.c
+index 762d2c6788a3..17c9d9f0c848 100644
+--- a/net/rds/bind.c
++++ b/net/rds/bind.c
+@@ -78,10 +78,10 @@ struct rds_sock *rds_find_bound(const struct in6_addr *addr, __be16 port,
+ __rds_create_bind_key(key, addr, port, scope_id);
+ rcu_read_lock();
+ rs = rhashtable_lookup(&bind_hash_table, key, ht_parms);
+- if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD))
+- rds_sock_addref(rs);
+- else
++ if (rs && (sock_flag(rds_rs_to_sk(rs), SOCK_DEAD) ||
++ !refcount_inc_not_zero(&rds_rs_to_sk(rs)->sk_refcnt)))
+ rs = NULL;
++
+ rcu_read_unlock();
+
+ rdsdebug("returning rs %p for %pI6c:%u\n", rs, addr,
+diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
+index 816b19a78809..0374b0623c8b 100644
+--- a/net/rxrpc/recvmsg.c
++++ b/net/rxrpc/recvmsg.c
+@@ -596,6 +596,7 @@ error_requeue_call:
+ }
+ error_no_call:
+ release_sock(&rx->sk);
++error_trace:
+ trace_rxrpc_recvmsg(call, rxrpc_recvmsg_return, 0, 0, 0, ret);
+ return ret;
+
+@@ -604,7 +605,7 @@ wait_interrupted:
+ wait_error:
+ finish_wait(sk_sleep(&rx->sk), &wait);
+ call = NULL;
+- goto error_no_call;
++ goto error_trace;
+ }
+
+ /**
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 876393cf5ed6..e5e70cff5bb3 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -2045,7 +2045,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
+ struct sctp_endpoint *ep = sctp_sk(sk)->ep;
+ struct sctp_transport *transport = NULL;
+ struct sctp_sndrcvinfo _sinfo, *sinfo;
+- struct sctp_association *asoc;
++ struct sctp_association *asoc, *tmp;
+ struct sctp_cmsgs cmsgs;
+ union sctp_addr *daddr;
+ bool new = false;
+@@ -2071,7 +2071,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
+
+ /* SCTP_SENDALL process */
+ if ((sflags & SCTP_SENDALL) && sctp_style(sk, UDP)) {
+- list_for_each_entry(asoc, &ep->asocs, asocs) {
++ list_for_each_entry_safe(asoc, tmp, &ep->asocs, asocs) {
+ err = sctp_sendmsg_check_sflags(asoc, sflags, msg,
+ msg_len);
+ if (err == 0)
+diff --git a/net/sctp/stream.c b/net/sctp/stream.c
+index 80e0ae5534ec..f24633114dfd 100644
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -84,6 +84,19 @@ static void fa_zero(struct flex_array *fa, size_t index, size_t count)
+ }
+ }
+
++static size_t fa_index(struct flex_array *fa, void *elem, size_t count)
++{
++ size_t index = 0;
++
++ while (count--) {
++ if (elem == flex_array_get(fa, index))
++ break;
++ index++;
++ }
++
++ return index;
++}
++
+ /* Migrates chunks from stream queues to new stream queues if needed,
+ * but not across associations. Also, removes those chunks to streams
+ * higher than the new max.
+@@ -147,6 +160,13 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
+
+ if (stream->out) {
+ fa_copy(out, stream->out, 0, min(outcnt, stream->outcnt));
++ if (stream->out_curr) {
++ size_t index = fa_index(stream->out, stream->out_curr,
++ stream->outcnt);
++
++ BUG_ON(index == stream->outcnt);
++ stream->out_curr = flex_array_get(out, index);
++ }
+ fa_free(stream->out);
+ }
+
+diff --git a/net/tipc/node.c b/net/tipc/node.c
+index 488019766433..32556f480a60 100644
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -624,6 +624,12 @@ static void tipc_node_timeout(struct timer_list *t)
+
+ __skb_queue_head_init(&xmitq);
+
++ /* Initial node interval to value larger (10 seconds), then it will be
++ * recalculated with link lowest tolerance
++ */
++ tipc_node_read_lock(n);
++ n->keepalive_intv = 10000;
++ tipc_node_read_unlock(n);
+ for (bearer_id = 0; remains && (bearer_id < MAX_BEARERS); bearer_id++) {
+ tipc_node_read_lock(n);
+ le = &n->links[bearer_id];
+diff --git a/samples/livepatch/livepatch-shadow-fix1.c b/samples/livepatch/livepatch-shadow-fix1.c
+index 49b13553eaae..e8f1bd6b29b1 100644
+--- a/samples/livepatch/livepatch-shadow-fix1.c
++++ b/samples/livepatch/livepatch-shadow-fix1.c
+@@ -89,6 +89,11 @@ struct dummy *livepatch_fix1_dummy_alloc(void)
+ * pointer to handle resource release.
+ */
+ leak = kzalloc(sizeof(int), GFP_KERNEL);
++ if (!leak) {
++ kfree(d);
++ return NULL;
++ }
++
+ klp_shadow_alloc(d, SV_LEAK, sizeof(leak), GFP_KERNEL,
+ shadow_leak_ctor, leak);
+
+diff --git a/samples/livepatch/livepatch-shadow-mod.c b/samples/livepatch/livepatch-shadow-mod.c
+index 4c54b250332d..4aa8a88d3cd6 100644
+--- a/samples/livepatch/livepatch-shadow-mod.c
++++ b/samples/livepatch/livepatch-shadow-mod.c
+@@ -118,6 +118,10 @@ noinline struct dummy *dummy_alloc(void)
+
+ /* Oops, forgot to save leak! */
+ leak = kzalloc(sizeof(int), GFP_KERNEL);
++ if (!leak) {
++ kfree(d);
++ return NULL;
++ }
+
+ pr_info("%s: dummy @ %p, expires @ %lx\n",
+ __func__, d, d->jiffies_expire);
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index 64220e36ce3b..98a7d63a723e 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -78,7 +78,7 @@ parse_symbol() {
+ fi
+
+ # Strip out the base of the path
+- code=${code//$basepath/""}
++ code=${code//^$basepath/""}
+
+ # In the case of inlines, move everything to same line
+ code=${code//$'\n'/' '}
+diff --git a/scripts/gdb/linux/proc.py b/scripts/gdb/linux/proc.py
+index 086d27223c0c..0aebd7565b03 100644
+--- a/scripts/gdb/linux/proc.py
++++ b/scripts/gdb/linux/proc.py
+@@ -41,7 +41,7 @@ class LxVersion(gdb.Command):
+
+ def invoke(self, arg, from_tty):
+ # linux_banner should contain a newline
+- gdb.write(gdb.parse_and_eval("linux_banner").string())
++ gdb.write(gdb.parse_and_eval("(char *)linux_banner").string())
+
+ LxVersion()
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 5a5b3780456f..5a77efd39b3f 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1204,6 +1204,30 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
+ return 1;
+ }
+
++static inline int is_arm_mapping_symbol(const char *str)
++{
++ return str[0] == '$' && strchr("axtd", str[1])
++ && (str[2] == '\0' || str[2] == '.');
++}
++
++/*
++ * If there's no name there, ignore it; likewise, ignore it if it's
++ * one of the magic symbols emitted used by current ARM tools.
++ *
++ * Otherwise if find_symbols_between() returns those symbols, they'll
++ * fail the whitelist tests and cause lots of false alarms ... fixable
++ * only by merging __exit and __init sections into __text, bloating
++ * the kernel (which is especially evil on embedded platforms).
++ */
++static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym)
++{
++ const char *name = elf->strtab + sym->st_name;
++
++ if (!name || !strlen(name))
++ return 0;
++ return !is_arm_mapping_symbol(name);
++}
++
+ /**
+ * Find symbol based on relocation record info.
+ * In some cases the symbol supplied is a valid symbol so
+@@ -1229,6 +1253,8 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
+ continue;
+ if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
+ continue;
++ if (!is_valid_name(elf, sym))
++ continue;
+ if (sym->st_value == addr)
+ return sym;
+ /* Find a symbol nearby - addr are maybe negative */
+@@ -1247,30 +1273,6 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
+ return NULL;
+ }
+
+-static inline int is_arm_mapping_symbol(const char *str)
+-{
+- return str[0] == '$' && strchr("axtd", str[1])
+- && (str[2] == '\0' || str[2] == '.');
+-}
+-
+-/*
+- * If there's no name there, ignore it; likewise, ignore it if it's
+- * one of the magic symbols emitted used by current ARM tools.
+- *
+- * Otherwise if find_symbols_between() returns those symbols, they'll
+- * fail the whitelist tests and cause lots of false alarms ... fixable
+- * only by merging __exit and __init sections into __text, bloating
+- * the kernel (which is especially evil on embedded platforms).
+- */
+-static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym)
+-{
+- const char *name = elf->strtab + sym->st_name;
+-
+- if (!name || !strlen(name))
+- return 0;
+- return !is_arm_mapping_symbol(name);
+-}
+-
+ /*
+ * Find symbols before or equal addr and after addr - in the section sec.
+ * If we find two symbols with equal offset prefer one with a valid name.
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 70d3066e69fe..017c47eb795e 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -4333,6 +4333,12 @@ static int smack_key_permission(key_ref_t key_ref,
+ int request = 0;
+ int rc;
+
++ /*
++ * Validate requested permissions
++ */
++ if (perm & ~KEY_NEED_ALL)
++ return -EINVAL;
++
+ keyp = key_ref_to_ptr(key_ref);
+ if (keyp == NULL)
+ return -EINVAL;
+@@ -4356,10 +4362,10 @@ static int smack_key_permission(key_ref_t key_ref,
+ ad.a.u.key_struct.key = keyp->serial;
+ ad.a.u.key_struct.key_desc = keyp->description;
+ #endif
+- if (perm & KEY_NEED_READ)
+- request = MAY_READ;
++ if (perm & (KEY_NEED_READ | KEY_NEED_SEARCH | KEY_NEED_VIEW))
++ request |= MAY_READ;
+ if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR))
+- request = MAY_WRITE;
++ request |= MAY_WRITE;
+ rc = smk_access(tkp, keyp->security, request, &ad);
+ rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
+ return rc;
+diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
+index d361bb77ca00..8db1890605f6 100644
+--- a/sound/pci/hda/hda_bind.c
++++ b/sound/pci/hda/hda_bind.c
+@@ -109,7 +109,8 @@ static int hda_codec_driver_probe(struct device *dev)
+ err = snd_hda_codec_build_controls(codec);
+ if (err < 0)
+ goto error_module;
+- if (codec->card->registered) {
++ /* only register after the bus probe finished; otherwise it's racy */
++ if (!codec->bus->bus_probing && codec->card->registered) {
+ err = snd_card_register(codec->card);
+ if (err < 0)
+ goto error_module;
+diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
+index 0d98bb9068b1..acacc1900265 100644
+--- a/sound/pci/hda/hda_codec.h
++++ b/sound/pci/hda/hda_codec.h
+@@ -68,6 +68,7 @@ struct hda_bus {
+ unsigned int response_reset:1; /* controller was reset */
+ unsigned int in_reset:1; /* during reset operation */
+ unsigned int no_response_fallback:1; /* don't fallback at RIRB error */
++ unsigned int bus_probing :1; /* during probing process */
+
+ int primary_dig_out_type; /* primary digital out PCM type */
+ unsigned int mixer_assigned; /* codec addr for mixer name */
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 1ddeebc373b3..1bb7613701ac 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2315,6 +2315,7 @@ static int azx_probe_continue(struct azx *chip)
+ int dev = chip->dev_index;
+ int err;
+
++ to_hda_bus(bus)->bus_probing = 1;
+ hda->probe_continued = 1;
+
+ /* bind with i915 if needed */
+@@ -2410,6 +2411,7 @@ i915_power_fail:
+ if (err < 0)
+ hda->init_failed = 1;
+ complete_all(&hda->probe_wait);
++ to_hda_bus(bus)->bus_probing = 0;
+ return err;
+ }
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index dbb38fe2da7d..9199d91d0a59 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -515,6 +515,15 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type)
+ }
+ }
+
++/* get a primary headphone pin if available */
++static hda_nid_t alc_get_hp_pin(struct alc_spec *spec)
++{
++ if (spec->gen.autocfg.hp_pins[0])
++ return spec->gen.autocfg.hp_pins[0];
++ if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
++ return spec->gen.autocfg.line_out_pins[0];
++ return 0;
++}
+
+ /*
+ * Realtek SSID verification
+@@ -725,9 +734,7 @@ do_sku:
+ * 15 : 1 --> enable the function "Mute internal speaker
+ * when the external headphone out jack is plugged"
+ */
+- if (!spec->gen.autocfg.hp_pins[0] &&
+- !(spec->gen.autocfg.line_out_pins[0] &&
+- spec->gen.autocfg.line_out_type == AUTO_PIN_HP_OUT)) {
++ if (!alc_get_hp_pin(spec)) {
+ hda_nid_t nid;
+ tmp = (ass >> 11) & 0x3; /* HP to chassis */
+ nid = ports[tmp];
+@@ -2959,7 +2966,7 @@ static void alc282_restore_default_value(struct hda_codec *codec)
+ static void alc282_init(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp_pin_sense;
+ int coef78;
+
+@@ -2996,7 +3003,7 @@ static void alc282_init(struct hda_codec *codec)
+ static void alc282_shutup(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp_pin_sense;
+ int coef78;
+
+@@ -3074,14 +3081,9 @@ static void alc283_restore_default_value(struct hda_codec *codec)
+ static void alc283_init(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp_pin_sense;
+
+- if (!spec->gen.autocfg.hp_outs) {
+- if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+- hp_pin = spec->gen.autocfg.line_out_pins[0];
+- }
+-
+ alc283_restore_default_value(codec);
+
+ if (!hp_pin)
+@@ -3115,14 +3117,9 @@ static void alc283_init(struct hda_codec *codec)
+ static void alc283_shutup(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp_pin_sense;
+
+- if (!spec->gen.autocfg.hp_outs) {
+- if (spec->gen.autocfg.line_out_type == AC_JACK_HP_OUT)
+- hp_pin = spec->gen.autocfg.line_out_pins[0];
+- }
+-
+ if (!hp_pin) {
+ alc269_shutup(codec);
+ return;
+@@ -3156,7 +3153,7 @@ static void alc283_shutup(struct hda_codec *codec)
+ static void alc256_init(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp_pin_sense;
+
+ if (!hp_pin)
+@@ -3192,7 +3189,7 @@ static void alc256_init(struct hda_codec *codec)
+ static void alc256_shutup(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp_pin_sense;
+
+ if (!hp_pin) {
+@@ -3228,7 +3225,7 @@ static void alc256_shutup(struct hda_codec *codec)
+ static void alc225_init(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp1_pin_sense, hp2_pin_sense;
+
+ if (!hp_pin)
+@@ -3271,7 +3268,7 @@ static void alc225_init(struct hda_codec *codec)
+ static void alc225_shutup(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp1_pin_sense, hp2_pin_sense;
+
+ if (!hp_pin) {
+@@ -3315,7 +3312,7 @@ static void alc225_shutup(struct hda_codec *codec)
+ static void alc_default_init(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp_pin_sense;
+
+ if (!hp_pin)
+@@ -3344,7 +3341,7 @@ static void alc_default_init(struct hda_codec *codec)
+ static void alc_default_shutup(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp_pin_sense;
+
+ if (!hp_pin) {
+@@ -3376,7 +3373,7 @@ static void alc_default_shutup(struct hda_codec *codec)
+ static void alc294_hp_init(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ int i, val;
+
+ if (!hp_pin)
+@@ -4780,7 +4777,7 @@ static void alc_update_headset_mode(struct hda_codec *codec)
+ struct alc_spec *spec = codec->spec;
+
+ hda_nid_t mux_pin = spec->gen.imux_pins[spec->gen.cur_mux[0]];
+- hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
++ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+
+ int new_headset_mode;
+
+@@ -5059,7 +5056,7 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
+ static void alc_shutup_dell_xps13(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+- int hp_pin = spec->gen.autocfg.hp_pins[0];
++ int hp_pin = alc_get_hp_pin(spec);
+
+ /* Prevent pop noises when headphones are plugged in */
+ snd_hda_codec_write(codec, hp_pin, 0,
+@@ -5152,7 +5149,7 @@ static void alc271_hp_gate_mic_jack(struct hda_codec *codec,
+
+ if (action == HDA_FIXUP_ACT_PROBE) {
+ int mic_pin = find_ext_mic_pin(codec);
+- int hp_pin = spec->gen.autocfg.hp_pins[0];
++ int hp_pin = alc_get_hp_pin(spec);
+
+ if (snd_BUG_ON(!mic_pin || !hp_pin))
+ return;
+@@ -5575,6 +5572,7 @@ enum {
+ ALC294_FIXUP_ASUS_MIC,
+ ALC294_FIXUP_ASUS_HEADSET_MIC,
+ ALC294_FIXUP_ASUS_SPK,
++ ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6499,6 +6497,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
+ },
++ [ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x1a, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6677,6 +6684,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig
+index 6ec19fb4a934..2e75b5bc5f1d 100644
+--- a/sound/soc/fsl/Kconfig
++++ b/sound/soc/fsl/Kconfig
+@@ -221,7 +221,7 @@ config SND_SOC_PHYCORE_AC97
+
+ config SND_SOC_EUKREA_TLV320
+ tristate "Eukrea TLV320"
+- depends on ARCH_MXC && I2C
++ depends on ARCH_MXC && !ARM64 && I2C
+ select SND_SOC_TLV320AIC23_I2C
+ select SND_SOC_IMX_AUDMUX
+ select SND_SOC_IMX_SSI
+diff --git a/sound/soc/intel/atom/sst/sst_loader.c b/sound/soc/intel/atom/sst/sst_loader.c
+index 27413ebae956..b8c456753f01 100644
+--- a/sound/soc/intel/atom/sst/sst_loader.c
++++ b/sound/soc/intel/atom/sst/sst_loader.c
+@@ -354,14 +354,14 @@ static int sst_request_fw(struct intel_sst_drv *sst)
+ const struct firmware *fw;
+
+ retval = request_firmware(&fw, sst->firmware_name, sst->dev);
+- if (fw == NULL) {
+- dev_err(sst->dev, "fw is returning as null\n");
+- return -EINVAL;
+- }
+ if (retval) {
+ dev_err(sst->dev, "request fw failed %d\n", retval);
+ return retval;
+ }
++ if (fw == NULL) {
++ dev_err(sst->dev, "fw is returning as null\n");
++ return -EINVAL;
++ }
+ mutex_lock(&sst->sst_lock);
+ retval = sst_cache_and_parse_fw(sst, fw);
+ mutex_unlock(&sst->sst_lock);
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 7e93686a430a..d71e01954975 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1448,6 +1448,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ case 0x20b1: /* XMOS based devices */
+ case 0x152a: /* Thesycon devices */
+ case 0x25ce: /* Mytek devices */
++ case 0x2ab6: /* T+A devices */
+ if (fp->dsd_raw)
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
+index f216b2f5c3d7..42a787856cd8 100644
+--- a/tools/build/Makefile.feature
++++ b/tools/build/Makefile.feature
+@@ -79,8 +79,8 @@ FEATURE_TESTS_EXTRA := \
+ cplus-demangle \
+ hello \
+ libbabeltrace \
+- liberty \
+- liberty-z \
++ libbfd-liberty \
++ libbfd-liberty-z \
+ libunwind-debug-frame \
+ libunwind-debug-frame-arm \
+ libunwind-debug-frame-aarch64 \
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index 0516259be70f..bf8a8ebcca1e 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -15,8 +15,8 @@ FILES= \
+ test-libbfd.bin \
+ test-disassembler-four-args.bin \
+ test-reallocarray.bin \
+- test-liberty.bin \
+- test-liberty-z.bin \
++ test-libbfd-liberty.bin \
++ test-libbfd-liberty-z.bin \
+ test-cplus-demangle.bin \
+ test-libelf.bin \
+ test-libelf-getphdrnum.bin \
+@@ -200,7 +200,7 @@ $(OUTPUT)test-libpython-version.bin:
+ $(BUILD)
+
+ $(OUTPUT)test-libbfd.bin:
+- $(BUILD) -DPACKAGE='"perf"' -lbfd -lz -liberty -ldl
++ $(BUILD) -DPACKAGE='"perf"' -lbfd -ldl
+
+ $(OUTPUT)test-disassembler-four-args.bin:
+ $(BUILD) -DPACKAGE='"perf"' -lbfd -lopcodes
+@@ -208,10 +208,10 @@ $(OUTPUT)test-disassembler-four-args.bin:
+ $(OUTPUT)test-reallocarray.bin:
+ $(BUILD)
+
+-$(OUTPUT)test-liberty.bin:
++$(OUTPUT)test-libbfd-liberty.bin:
+ $(CC) $(CFLAGS) -Wall -Werror -o $@ test-libbfd.c -DPACKAGE='"perf"' $(LDFLAGS) -lbfd -ldl -liberty
+
+-$(OUTPUT)test-liberty-z.bin:
++$(OUTPUT)test-libbfd-liberty-z.bin:
+ $(CC) $(CFLAGS) -Wall -Werror -o $@ test-libbfd.c -DPACKAGE='"perf"' $(LDFLAGS) -lbfd -ldl -liberty -lz
+
+ $(OUTPUT)test-cplus-demangle.bin:
+diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
+index bbb2a8ef367c..d7e06fe0270e 100644
+--- a/tools/hv/hv_kvp_daemon.c
++++ b/tools/hv/hv_kvp_daemon.c
+@@ -1178,6 +1178,7 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
+ FILE *file;
+ char cmd[PATH_MAX];
+ char *mac_addr;
++ int str_len;
+
+ /*
+ * Set the configuration for the specified interface with
+@@ -1301,8 +1302,18 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
+ * invoke the external script to do its magic.
+ */
+
+- snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
+- "hv_set_ifconfig", if_file);
++ str_len = snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
++ "hv_set_ifconfig", if_file);
++ /*
++ * This is a little overcautious, but it's necessary to suppress some
++ * false warnings from gcc 8.0.1.
++ */
++ if (str_len <= 0 || (unsigned int)str_len >= sizeof(cmd)) {
++ syslog(LOG_ERR, "Cmd '%s' (len=%d) may be too long",
++ cmd, str_len);
++ return HV_E_FAIL;
++ }
++
+ if (system(cmd)) {
+ syslog(LOG_ERR, "Failed to execute cmd '%s'; error: %d %s",
+ cmd, errno, strerror(errno));
+diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
+index 60aa4ca8b2c5..7a0014794bff 100644
+--- a/tools/lib/bpf/bpf.c
++++ b/tools/lib/bpf/bpf.c
+@@ -77,6 +77,7 @@ int bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr)
+ {
+ __u32 name_len = create_attr->name ? strlen(create_attr->name) : 0;
+ union bpf_attr attr;
++ int ret;
+
+ memset(&attr, '\0', sizeof(attr));
+
+@@ -94,7 +95,15 @@ int bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr)
+ attr.map_ifindex = create_attr->map_ifindex;
+ attr.inner_map_fd = create_attr->inner_map_fd;
+
+- return sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr));
++ ret = sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr));
++ if (ret < 0 && errno == EINVAL && create_attr->name) {
++ /* Retry the same syscall, but without the name.
++ * Pre v4.14 kernels don't support map names.
++ */
++ memset(attr.map_name, 0, sizeof(attr.map_name));
++ return sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr));
++ }
++ return ret;
+ }
+
+ int bpf_create_map_node(enum bpf_map_type map_type, const char *name,
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index f00ea77f5f08..849b3be15bd8 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -688,18 +688,20 @@ endif
+
+ ifeq ($(feature-libbfd), 1)
+ EXTLIBS += -lbfd
++else
++ # we are on a system that requires -liberty and (maybe) -lz
++ # to link against -lbfd; test each case individually here
+
+ # call all detections now so we get correct
+ # status in VF output
+- $(call feature_check,liberty)
+- $(call feature_check,liberty-z)
+- $(call feature_check,cplus-demangle)
++ $(call feature_check,libbfd-liberty)
++ $(call feature_check,libbfd-liberty-z)
+
+- ifeq ($(feature-liberty), 1)
+- EXTLIBS += -liberty
++ ifeq ($(feature-libbfd-liberty), 1)
++ EXTLIBS += -lbfd -liberty
+ else
+- ifeq ($(feature-liberty-z), 1)
+- EXTLIBS += -liberty -lz
++ ifeq ($(feature-libbfd-liberty-z), 1)
++ EXTLIBS += -lbfd -liberty -lz
+ endif
+ endif
+ endif
+@@ -709,24 +711,24 @@ ifdef NO_DEMANGLE
+ else
+ ifdef HAVE_CPLUS_DEMANGLE_SUPPORT
+ EXTLIBS += -liberty
+- CFLAGS += -DHAVE_CPLUS_DEMANGLE_SUPPORT
+ else
+- ifneq ($(feature-libbfd), 1)
+- ifneq ($(feature-liberty), 1)
+- ifneq ($(feature-liberty-z), 1)
+- # we dont have neither HAVE_CPLUS_DEMANGLE_SUPPORT
+- # or any of 'bfd iberty z' trinity
+- ifeq ($(feature-cplus-demangle), 1)
+- EXTLIBS += -liberty
+- CFLAGS += -DHAVE_CPLUS_DEMANGLE_SUPPORT
+- else
+- msg := $(warning No bfd.h/libbfd found, please install binutils-dev[el]/zlib-static/libiberty-dev to gain symbol demangling)
+- CFLAGS += -DNO_DEMANGLE
+- endif
+- endif
++ ifeq ($(filter -liberty,$(EXTLIBS)),)
++ $(call feature_check,cplus-demangle)
++
++ # we dont have neither HAVE_CPLUS_DEMANGLE_SUPPORT
++ # or any of 'bfd iberty z' trinity
++ ifeq ($(feature-cplus-demangle), 1)
++ EXTLIBS += -liberty
++ else
++ msg := $(warning No bfd.h/libbfd found, please install binutils-dev[el]/zlib-static/libiberty-dev to gain symbol demangling)
++ CFLAGS += -DNO_DEMANGLE
+ endif
+ endif
+ endif
++
++ ifneq ($(filter -liberty,$(EXTLIBS)),)
++ CFLAGS += -DHAVE_CPLUS_DEMANGLE_SUPPORT
++ endif
+ endif
+
+ ifneq ($(filter -lbfd,$(EXTLIBS)),)
+diff --git a/tools/perf/arch/x86/util/kvm-stat.c b/tools/perf/arch/x86/util/kvm-stat.c
+index b32409a0e546..081353d7b095 100644
+--- a/tools/perf/arch/x86/util/kvm-stat.c
++++ b/tools/perf/arch/x86/util/kvm-stat.c
+@@ -156,7 +156,7 @@ int cpu_isa_init(struct perf_kvm_stat *kvm, const char *cpuid)
+ if (strstr(cpuid, "Intel")) {
+ kvm->exit_reasons = vmx_exit_reasons;
+ kvm->exit_reasons_isa = "VMX";
+- } else if (strstr(cpuid, "AMD")) {
++ } else if (strstr(cpuid, "AMD") || strstr(cpuid, "Hygon")) {
+ kvm->exit_reasons = svm_exit_reasons;
+ kvm->exit_reasons_isa = "SVM";
+ } else
+diff --git a/tools/perf/tests/attr.py b/tools/perf/tests/attr.py
+index ff9b60b99f52..44090a9a19f3 100644
+--- a/tools/perf/tests/attr.py
++++ b/tools/perf/tests/attr.py
+@@ -116,7 +116,7 @@ class Event(dict):
+ if not self.has_key(t) or not other.has_key(t):
+ continue
+ if not data_equal(self[t], other[t]):
+- log.warning("expected %s=%s, got %s" % (t, self[t], other[t]))
++ log.warning("expected %s=%s, got %s" % (t, self[t], other[t]))
+
+ # Test file description needs to have following sections:
+ # [config]
+diff --git a/tools/perf/tests/evsel-tp-sched.c b/tools/perf/tests/evsel-tp-sched.c
+index 699561fa512c..67bcbf876776 100644
+--- a/tools/perf/tests/evsel-tp-sched.c
++++ b/tools/perf/tests/evsel-tp-sched.c
+@@ -17,7 +17,7 @@ static int perf_evsel__test_field(struct perf_evsel *evsel, const char *name,
+ return -1;
+ }
+
+- is_signed = !!(field->flags | FIELD_IS_SIGNED);
++ is_signed = !!(field->flags & FIELD_IS_SIGNED);
+ if (should_be_signed && !is_signed) {
+ pr_debug("%s: \"%s\" signedness(%d) is wrong, should be %d\n",
+ evsel->name, name, is_signed, should_be_signed);
+diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
+index bbed90e5d9bb..cee717a3794f 100644
+--- a/tools/perf/util/dso.c
++++ b/tools/perf/util/dso.c
+@@ -295,7 +295,7 @@ static int decompress_kmodule(struct dso *dso, const char *name,
+ unlink(tmpbuf);
+
+ if (pathname && (fd >= 0))
+- strncpy(pathname, tmpbuf, len);
++ strlcpy(pathname, tmpbuf, len);
+
+ return fd;
+ }
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index 3cadc252dd89..bd9226bc5945 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -2636,6 +2636,7 @@ int perf_header__fprintf_info(struct perf_session *session, FILE *fp, bool full)
+ struct perf_header *header = &session->header;
+ int fd = perf_data__fd(session->data);
+ struct stat st;
++ time_t stctime;
+ int ret, bit;
+
+ hd.fp = fp;
+@@ -2645,7 +2646,8 @@ int perf_header__fprintf_info(struct perf_session *session, FILE *fp, bool full)
+ if (ret == -1)
+ return -1;
+
+- fprintf(fp, "# captured on : %s", ctime(&st.st_ctime));
++ stctime = st.st_ctime;
++ fprintf(fp, "# captured on : %s", ctime(&stctime));
+
+ fprintf(fp, "# header version : %u\n", header->version);
+ fprintf(fp, "# data offset : %" PRIu64 "\n", header->data_offset);
+@@ -3521,7 +3523,7 @@ perf_event__synthesize_event_update_unit(struct perf_tool *tool,
+ if (ev == NULL)
+ return -ENOMEM;
+
+- strncpy(ev->data, evsel->unit, size);
++ strlcpy(ev->data, evsel->unit, size + 1);
+ err = process(tool, (union perf_event *)ev, NULL, NULL);
+ free(ev);
+ return err;
+diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c
+index b76088fadf3d..6a6548890d5a 100644
+--- a/tools/perf/util/probe-file.c
++++ b/tools/perf/util/probe-file.c
+@@ -424,7 +424,7 @@ static int probe_cache__open(struct probe_cache *pcache, const char *target,
+
+ if (target && build_id_cache__cached(target)) {
+ /* This is a cached buildid */
+- strncpy(sbuildid, target, SBUILD_ID_SIZE);
++ strlcpy(sbuildid, target, SBUILD_ID_SIZE);
+ dir_name = build_id_cache__linkname(sbuildid, NULL, 0);
+ goto found;
+ }
+diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
+index ce501ba14b08..69f5f6142dcf 100644
+--- a/tools/perf/util/python.c
++++ b/tools/perf/util/python.c
+@@ -939,7 +939,8 @@ static PyObject *pyrf_evlist__get_pollfd(struct pyrf_evlist *pevlist,
+
+ file = PyFile_FromFile(fp, "perf", "r", NULL);
+ #else
+- file = PyFile_FromFd(evlist->pollfd.entries[i].fd, "perf", "r", -1, NULL, NULL, NULL, 1);
++ file = PyFile_FromFd(evlist->pollfd.entries[i].fd, "perf", "r", -1,
++ NULL, NULL, NULL, 0);
+ #endif
+ if (file == NULL)
+ goto free_list;
+diff --git a/tools/perf/util/s390-cpumsf.c b/tools/perf/util/s390-cpumsf.c
+index d2c78ffd9fee..aa7f8c11fbb7 100644
+--- a/tools/perf/util/s390-cpumsf.c
++++ b/tools/perf/util/s390-cpumsf.c
+@@ -499,7 +499,7 @@ static int s390_cpumsf_samples(struct s390_cpumsf_queue *sfq, u64 *ts)
+ aux_ts = get_trailer_time(buf);
+ if (!aux_ts) {
+ pr_err("[%#08" PRIx64 "] Invalid AUX trailer entry TOD clock base\n",
+- sfq->buffer->data_offset);
++ (s64)sfq->buffer->data_offset);
+ aux_ts = ~0ULL;
+ goto out;
+ }
+diff --git a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
+index 84e2b648e622..2fa3c5757bcb 100755
+--- a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
++++ b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
+@@ -585,9 +585,9 @@ current_max_cpu = 0
+
+ read_trace_data(filename)
+
+-clear_trace_file()
+-# Free the memory
+ if interval:
++ clear_trace_file()
++ # Free the memory
+ free_trace_buffer()
+
+ if graph_data_present == False:
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 0ef68204c84b..d029cad08cbd 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -51,10 +51,10 @@ static struct {
+ struct iphdr iph;
+ struct tcphdr tcp;
+ } __packed pkt_v4 = {
+- .eth.h_proto = bpf_htons(ETH_P_IP),
++ .eth.h_proto = __bpf_constant_htons(ETH_P_IP),
+ .iph.ihl = 5,
+ .iph.protocol = 6,
+- .iph.tot_len = bpf_htons(MAGIC_BYTES),
++ .iph.tot_len = __bpf_constant_htons(MAGIC_BYTES),
+ .tcp.urg_ptr = 123,
+ };
+
+@@ -64,9 +64,9 @@ static struct {
+ struct ipv6hdr iph;
+ struct tcphdr tcp;
+ } __packed pkt_v6 = {
+- .eth.h_proto = bpf_htons(ETH_P_IPV6),
++ .eth.h_proto = __bpf_constant_htons(ETH_P_IPV6),
+ .iph.nexthdr = 6,
+- .iph.payload_len = bpf_htons(MAGIC_BYTES),
++ .iph.payload_len = __bpf_constant_htons(MAGIC_BYTES),
+ .tcp.urg_ptr = 123,
+ };
+
+diff --git a/virt/kvm/arm/mmio.c b/virt/kvm/arm/mmio.c
+index dac7ceb1a677..08443a15e6be 100644
+--- a/virt/kvm/arm/mmio.c
++++ b/virt/kvm/arm/mmio.c
+@@ -117,6 +117,12 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
+ vcpu_set_reg(vcpu, vcpu->arch.mmio_decode.rt, data);
+ }
+
++ /*
++ * The MMIO instruction is emulated and should not be re-executed
++ * in the guest.
++ */
++ kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
++
+ return 0;
+ }
+
+@@ -144,11 +150,6 @@ static int decode_hsr(struct kvm_vcpu *vcpu, bool *is_write, int *len)
+ vcpu->arch.mmio_decode.sign_extend = sign_extend;
+ vcpu->arch.mmio_decode.rt = rt;
+
+- /*
+- * The MMIO instruction is emulated and should not be re-executed
+- * in the guest.
+- */
+- kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+ return 0;
+ }
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index f986e31fa68c..0ffb02ff5234 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1959,7 +1959,8 @@ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
+
+ int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+- void *data, int offset, unsigned long len)
++ void *data, unsigned int offset,
++ unsigned long len)
+ {
+ struct kvm_memslots *slots = kvm_memslots(kvm);
+ int r;
+@@ -2912,8 +2913,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
+ if (ops->init)
+ ops->init(dev);
+
++ kvm_get_kvm(kvm);
+ ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
+ if (ret < 0) {
++ kvm_put_kvm(kvm);
+ mutex_lock(&kvm->lock);
+ list_del(&dev->vm_node);
+ mutex_unlock(&kvm->lock);
+@@ -2921,7 +2924,6 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
+ return ret;
+ }
+
+- kvm_get_kvm(kvm);
+ cd->fd = ret;
+ return 0;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-02-15 12:39 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-02-15 12:39 UTC (permalink / raw
To: gentoo-commits
commit: 80d2920109660fb572a5de65ad1479e951848663
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 15 12:38:53 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Feb 15 12:38:53 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=80d29201
proj/linux-patches: Linux patches 4.19.22 and 4.19.23
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 8 +
1021_linux-4.19.22.patch | 1306 ++++++++++++++++++++++++++++++++++++++++++++++
1022_linux-4.19.23.patch | 35 ++
3 files changed, 1349 insertions(+)
diff --git a/0000_README b/0000_README
index ff7bed3..67480bc 100644
--- a/0000_README
+++ b/0000_README
@@ -127,6 +127,14 @@ Patch: 1020_linux-4.19.21.patch
From: http://www.kernel.org
Desc: Linux 4.19.21
+Patch: 1021_linux-4.19.22.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.22
+
+Patch: 1022_linux-4.19.23.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.23
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1021_linux-4.19.22.patch b/1021_linux-4.19.22.patch
new file mode 100644
index 0000000..2d54602
--- /dev/null
+++ b/1021_linux-4.19.22.patch
@@ -0,0 +1,1306 @@
+diff --git a/Makefile b/Makefile
+index ba5f14d38d8e..8cfcb01fcd7b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 21
++SUBLEVEL = 22
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/da850.dtsi b/arch/arm/boot/dts/da850.dtsi
+index 47aa53ba6b92..559659b399d0 100644
+--- a/arch/arm/boot/dts/da850.dtsi
++++ b/arch/arm/boot/dts/da850.dtsi
+@@ -476,7 +476,7 @@
+ clocksource: timer@20000 {
+ compatible = "ti,da830-timer";
+ reg = <0x20000 0x1000>;
+- interrupts = <12>, <13>;
++ interrupts = <21>, <22>;
+ interrupt-names = "tint12", "tint34";
+ clocks = <&pll0_auxclk>;
+ };
+diff --git a/arch/arm/mach-iop32x/n2100.c b/arch/arm/mach-iop32x/n2100.c
+index 3b73813c6b04..23e8c93515d4 100644
+--- a/arch/arm/mach-iop32x/n2100.c
++++ b/arch/arm/mach-iop32x/n2100.c
+@@ -75,8 +75,7 @@ void __init n2100_map_io(void)
+ /*
+ * N2100 PCI.
+ */
+-static int __init
+-n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
++static int n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
+ int irq;
+
+diff --git a/arch/arm/mach-tango/pm.c b/arch/arm/mach-tango/pm.c
+index 028e50c6383f..a32c3b631484 100644
+--- a/arch/arm/mach-tango/pm.c
++++ b/arch/arm/mach-tango/pm.c
+@@ -3,6 +3,7 @@
+ #include <linux/suspend.h>
+ #include <asm/suspend.h>
+ #include "smc.h"
++#include "pm.h"
+
+ static int tango_pm_powerdown(unsigned long arg)
+ {
+@@ -24,10 +25,7 @@ static const struct platform_suspend_ops tango_pm_ops = {
+ .valid = suspend_valid_only_mem,
+ };
+
+-static int __init tango_pm_init(void)
++void __init tango_pm_init(void)
+ {
+ suspend_set_ops(&tango_pm_ops);
+- return 0;
+ }
+-
+-late_initcall(tango_pm_init);
+diff --git a/arch/arm/mach-tango/pm.h b/arch/arm/mach-tango/pm.h
+new file mode 100644
+index 000000000000..35ea705a0ee2
+--- /dev/null
++++ b/arch/arm/mach-tango/pm.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++#ifdef CONFIG_SUSPEND
++void __init tango_pm_init(void);
++#else
++#define tango_pm_init NULL
++#endif
+diff --git a/arch/arm/mach-tango/setup.c b/arch/arm/mach-tango/setup.c
+index 677dd7b5efd9..824f90737b04 100644
+--- a/arch/arm/mach-tango/setup.c
++++ b/arch/arm/mach-tango/setup.c
+@@ -2,6 +2,7 @@
+ #include <asm/mach/arch.h>
+ #include <asm/hardware/cache-l2x0.h>
+ #include "smc.h"
++#include "pm.h"
+
+ static void tango_l2c_write(unsigned long val, unsigned int reg)
+ {
+@@ -15,4 +16,5 @@ DT_MACHINE_START(TANGO_DT, "Sigma Tango DT")
+ .dt_compat = tango_dt_compat,
+ .l2c_aux_mask = ~0,
+ .l2c_write_sec = tango_l2c_write,
++ .init_late = tango_pm_init,
+ MACHINE_END
+diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
+index 8f5bd04f320a..7f3f136572de 100644
+--- a/arch/mips/kernel/mips-cm.c
++++ b/arch/mips/kernel/mips-cm.c
+@@ -457,5 +457,5 @@ void mips_cm_error_report(void)
+ }
+
+ /* reprime cause register */
+- write_gcr_error_cause(0);
++ write_gcr_error_cause(cm_error);
+ }
+diff --git a/arch/mips/loongson64/common/reset.c b/arch/mips/loongson64/common/reset.c
+index a60715e11306..b26892ce871c 100644
+--- a/arch/mips/loongson64/common/reset.c
++++ b/arch/mips/loongson64/common/reset.c
+@@ -59,7 +59,12 @@ static void loongson_poweroff(void)
+ {
+ #ifndef CONFIG_LEFI_FIRMWARE_INTERFACE
+ mach_prepare_shutdown();
+- unreachable();
++
++ /*
++ * It needs a wait loop here, but mips/kernel/reset.c already calls
++ * a generic delay loop, machine_hang(), so simply return.
++ */
++ return;
+ #else
+ void (*fw_poweroff)(void) = (void *)loongson_sysconf.poweroff_addr;
+
+diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
+index 5017d5843c5a..fc29b85cfa92 100644
+--- a/arch/mips/pci/pci-octeon.c
++++ b/arch/mips/pci/pci-octeon.c
+@@ -568,6 +568,11 @@ static int __init octeon_pci_setup(void)
+ if (octeon_has_feature(OCTEON_FEATURE_PCIE))
+ return 0;
+
++ if (!octeon_is_pci_host()) {
++ pr_notice("Not in host mode, PCI Controller not initialized\n");
++ return 0;
++ }
++
+ /* Point pcibios_map_irq() to the PCI version of it */
+ octeon_pcibios_map_irq = octeon_pci_pcibios_map_irq;
+
+@@ -579,11 +584,6 @@ static int __init octeon_pci_setup(void)
+ else
+ octeon_dma_bar_type = OCTEON_DMA_BAR_TYPE_BIG;
+
+- if (!octeon_is_pci_host()) {
+- pr_notice("Not in host mode, PCI Controller not initialized\n");
+- return 0;
+- }
+-
+ /* PCI I/O and PCI MEM values */
+ set_io_port_base(OCTEON_PCI_IOSPACE_BASE);
+ ioport_resource.start = 0;
+diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile
+index 34605ca21498..6f10312e0c76 100644
+--- a/arch/mips/vdso/Makefile
++++ b/arch/mips/vdso/Makefile
+@@ -8,6 +8,7 @@ ccflags-vdso := \
+ $(filter -E%,$(KBUILD_CFLAGS)) \
+ $(filter -mmicromips,$(KBUILD_CFLAGS)) \
+ $(filter -march=%,$(KBUILD_CFLAGS)) \
++ $(filter -m%-float,$(KBUILD_CFLAGS)) \
+ -D__VDSO__
+
+ ifeq ($(cc-name),clang)
+@@ -128,7 +129,7 @@ $(obj)/%-o32.o: $(src)/%.c FORCE
+ $(call cmd,force_checksrc)
+ $(call if_changed_rule,cc_o_c)
+
+-$(obj)/vdso-o32.lds: KBUILD_CPPFLAGS := -mabi=32
++$(obj)/vdso-o32.lds: KBUILD_CPPFLAGS := $(ccflags-vdso) -mabi=32
+ $(obj)/vdso-o32.lds: $(src)/vdso.lds.S FORCE
+ $(call if_changed_dep,cpp_lds_S)
+
+@@ -168,7 +169,7 @@ $(obj)/%-n32.o: $(src)/%.c FORCE
+ $(call cmd,force_checksrc)
+ $(call if_changed_rule,cc_o_c)
+
+-$(obj)/vdso-n32.lds: KBUILD_CPPFLAGS := -mabi=n32
++$(obj)/vdso-n32.lds: KBUILD_CPPFLAGS := $(ccflags-vdso) -mabi=n32
+ $(obj)/vdso-n32.lds: $(src)/vdso.lds.S FORCE
+ $(call if_changed_dep,cpp_lds_S)
+
+diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
+index 2a2486526d1f..855dbae6d351 100644
+--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
++++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
+@@ -1234,21 +1234,13 @@ extern pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
+
+ #define pmd_move_must_withdraw pmd_move_must_withdraw
+ struct spinlock;
+-static inline int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
+- struct spinlock *old_pmd_ptl,
+- struct vm_area_struct *vma)
+-{
+- if (radix_enabled())
+- return false;
+- /*
+- * Archs like ppc64 use pgtable to store per pmd
+- * specific information. So when we switch the pmd,
+- * we should also withdraw and deposit the pgtable
+- */
+- return true;
+-}
+-
+-
++extern int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
++ struct spinlock *old_pmd_ptl,
++ struct vm_area_struct *vma);
++/*
++ * Hash translation mode use the deposited table to store hash pte
++ * slot information.
++ */
+ #define arch_needs_pgtable_deposit arch_needs_pgtable_deposit
+ static inline bool arch_needs_pgtable_deposit(void)
+ {
+diff --git a/arch/powerpc/mm/pgtable-book3s64.c b/arch/powerpc/mm/pgtable-book3s64.c
+index 01d7c0f7c4f0..297db665d953 100644
+--- a/arch/powerpc/mm/pgtable-book3s64.c
++++ b/arch/powerpc/mm/pgtable-book3s64.c
+@@ -477,3 +477,25 @@ void arch_report_meminfo(struct seq_file *m)
+ atomic_long_read(&direct_pages_count[MMU_PAGE_1G]) << 20);
+ }
+ #endif /* CONFIG_PROC_FS */
++
++/*
++ * For hash translation mode, we use the deposited table to store hash slot
++ * information and they are stored at PTRS_PER_PMD offset from related pmd
++ * location. Hence a pmd move requires deposit and withdraw.
++ *
++ * For radix translation with split pmd ptl, we store the deposited table in the
++ * pmd page. Hence if we have different pmd page we need to withdraw during pmd
++ * move.
++ *
++ * With hash we use deposited table always irrespective of anon or not.
++ * With radix we use deposited table only for anonymous mapping.
++ */
++int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
++ struct spinlock *old_pmd_ptl,
++ struct vm_area_struct *vma)
++{
++ if (radix_enabled())
++ return (new_pmd_ptl != old_pmd_ptl) && vma_is_anonymous(vma);
++
++ return true;
++}
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index b8c3f9e6af89..adf28788cab5 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4554,6 +4554,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
+ { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM, },
+ { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM, },
++ { "SAMSUNG MZ7TE512HMHP-000L1", "EXT06L0Q", ATA_HORKAGE_NOLPM, },
+
+ /* devices that don't properly handle queued TRIM commands */
+ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
+index 472c88ae1c0f..92f843eaf1e0 100644
+--- a/drivers/firmware/arm_scmi/bus.c
++++ b/drivers/firmware/arm_scmi/bus.c
+@@ -119,6 +119,11 @@ void scmi_driver_unregister(struct scmi_driver *driver)
+ }
+ EXPORT_SYMBOL_GPL(scmi_driver_unregister);
+
++static void scmi_device_release(struct device *dev)
++{
++ kfree(to_scmi_dev(dev));
++}
++
+ struct scmi_device *
+ scmi_device_create(struct device_node *np, struct device *parent, int protocol)
+ {
+@@ -138,6 +143,7 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol)
+ scmi_dev->dev.parent = parent;
+ scmi_dev->dev.of_node = np;
+ scmi_dev->dev.bus = &scmi_bus_type;
++ scmi_dev->dev.release = scmi_device_release;
+ dev_set_name(&scmi_dev->dev, "scmi_dev.%d", id);
+
+ retval = device_register(&scmi_dev->dev);
+@@ -156,9 +162,8 @@ free_mem:
+ void scmi_device_destroy(struct scmi_device *scmi_dev)
+ {
+ scmi_handle_put(scmi_dev->handle);
+- device_unregister(&scmi_dev->dev);
+ ida_simple_remove(&scmi_bus_id, scmi_dev->id);
+- kfree(scmi_dev);
++ device_unregister(&scmi_dev->dev);
+ }
+
+ void scmi_set_handle(struct scmi_device *scmi_dev)
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+index a63e00653324..1546bc49004f 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+@@ -984,6 +984,7 @@ static int smu10_get_clock_by_type_with_latency(struct pp_hwmgr *hwmgr,
+ break;
+ case amd_pp_dpp_clock:
+ pclk_vol_table = pinfo->vdd_dep_on_dppclk;
++ break;
+ default:
+ return -EINVAL;
+ }
+diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
+index 02db9ac82d7a..a3104d79b48f 100644
+--- a/drivers/gpu/drm/drm_modes.c
++++ b/drivers/gpu/drm/drm_modes.c
+@@ -758,7 +758,7 @@ int drm_mode_hsync(const struct drm_display_mode *mode)
+ if (mode->hsync)
+ return mode->hsync;
+
+- if (mode->htotal < 0)
++ if (mode->htotal <= 0)
+ return 0;
+
+ calc_val = (mode->clock * 1000) / mode->htotal; /* hsync in Hz */
+diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
+index c9af34861d9e..b4b1f9ca05b6 100644
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -1085,7 +1085,7 @@ static uint32_t icl_pll_to_ddi_pll_sel(struct intel_encoder *encoder,
+ return DDI_CLK_SEL_TBT_810;
+ default:
+ MISSING_CASE(clock);
+- break;
++ return DDI_CLK_SEL_NONE;
+ }
+ case DPLL_ID_ICL_MGPLL1:
+ case DPLL_ID_ICL_MGPLL2:
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index bb6dbbe18835..c72b942f2bdf 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -627,13 +627,16 @@ out_fixup:
+ static int vmw_dma_masks(struct vmw_private *dev_priv)
+ {
+ struct drm_device *dev = dev_priv->dev;
++ int ret = 0;
+
+- if (intel_iommu_enabled &&
++ ret = dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(64));
++ if (dev_priv->map_mode != vmw_dma_phys &&
+ (sizeof(unsigned long) == 4 || vmw_restrict_dma_mask)) {
+ DRM_INFO("Restricting DMA addresses to 44 bits.\n");
+- return dma_set_mask(dev->dev, DMA_BIT_MASK(44));
++ return dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(44));
+ }
+- return 0;
++
++ return ret;
+ }
+ #else
+ static int vmw_dma_masks(struct vmw_private *dev_priv)
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index f0ab6b2313bb..c3e2022bda5d 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -3843,7 +3843,7 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv,
+ *p_fence = NULL;
+ }
+
+- return 0;
++ return ret;
+ }
+
+ /**
+diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
+index 031d568b4972..4e339cfd0c54 100644
+--- a/drivers/iio/adc/axp288_adc.c
++++ b/drivers/iio/adc/axp288_adc.c
+@@ -27,9 +27,18 @@
+ #include <linux/iio/machine.h>
+ #include <linux/iio/driver.h>
+
+-#define AXP288_ADC_EN_MASK 0xF1
+-#define AXP288_ADC_TS_PIN_GPADC 0xF2
+-#define AXP288_ADC_TS_PIN_ON 0xF3
++/*
++ * This mask enables all ADCs except for the battery temp-sensor (TS), that is
++ * left as-is to avoid breaking charging on devices without a temp-sensor.
++ */
++#define AXP288_ADC_EN_MASK 0xF0
++#define AXP288_ADC_TS_ENABLE 0x01
++
++#define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0)
++#define AXP288_ADC_TS_CURRENT_OFF (0 << 0)
++#define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0)
++#define AXP288_ADC_TS_CURRENT_ON_ONDEMAND (2 << 0)
++#define AXP288_ADC_TS_CURRENT_ON (3 << 0)
+
+ enum axp288_adc_id {
+ AXP288_ADC_TS,
+@@ -44,6 +53,7 @@ enum axp288_adc_id {
+ struct axp288_adc_info {
+ int irq;
+ struct regmap *regmap;
++ bool ts_enabled;
+ };
+
+ static const struct iio_chan_spec axp288_adc_channels[] = {
+@@ -115,21 +125,33 @@ static int axp288_adc_read_channel(int *val, unsigned long address,
+ return IIO_VAL_INT;
+ }
+
+-static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
+- unsigned long address)
++/*
++ * The current-source used for the battery temp-sensor (TS) is shared
++ * with the GPADC. For proper fuel-gauge and charger operation the TS
++ * current-source needs to be permanently on. But to read the GPADC we
++ * need to temporary switch the TS current-source to ondemand, so that
++ * the GPADC can use it, otherwise we will always read an all 0 value.
++ */
++static int axp288_adc_set_ts(struct axp288_adc_info *info,
++ unsigned int mode, unsigned long address)
+ {
+ int ret;
+
+- /* channels other than GPADC do not need to switch TS pin */
++ /* No need to switch the current-source if the TS pin is disabled */
++ if (!info->ts_enabled)
++ return 0;
++
++ /* Channels other than GPADC do not need the current source */
+ if (address != AXP288_GP_ADC_H)
+ return 0;
+
+- ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
++ ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK, mode);
+ if (ret)
+ return ret;
+
+ /* When switching to the GPADC pin give things some time to settle */
+- if (mode == AXP288_ADC_TS_PIN_GPADC)
++ if (mode == AXP288_ADC_TS_CURRENT_ON_ONDEMAND)
+ usleep_range(6000, 10000);
+
+ return 0;
+@@ -145,14 +167,14 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
+ mutex_lock(&indio_dev->mlock);
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+- if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
++ if (axp288_adc_set_ts(info, AXP288_ADC_TS_CURRENT_ON_ONDEMAND,
+ chan->address)) {
+ dev_err(&indio_dev->dev, "GPADC mode\n");
+ ret = -EINVAL;
+ break;
+ }
+ ret = axp288_adc_read_channel(val, chan->address, info->regmap);
+- if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
++ if (axp288_adc_set_ts(info, AXP288_ADC_TS_CURRENT_ON,
+ chan->address))
+ dev_err(&indio_dev->dev, "TS pin restore\n");
+ break;
+@@ -164,13 +186,35 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
+ return ret;
+ }
+
+-static int axp288_adc_set_state(struct regmap *regmap)
++static int axp288_adc_initialize(struct axp288_adc_info *info)
+ {
+- /* ADC should be always enabled for internal FG to function */
+- if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
+- return -EIO;
++ int ret, adc_enable_val;
++
++ /*
++ * Determine if the TS pin is enabled and set the TS current-source
++ * accordingly.
++ */
++ ret = regmap_read(info->regmap, AXP20X_ADC_EN1, &adc_enable_val);
++ if (ret)
++ return ret;
++
++ if (adc_enable_val & AXP288_ADC_TS_ENABLE) {
++ info->ts_enabled = true;
++ ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
++ AXP288_ADC_TS_CURRENT_ON);
++ } else {
++ info->ts_enabled = false;
++ ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
++ AXP288_ADC_TS_CURRENT_OFF);
++ }
++ if (ret)
++ return ret;
+
+- return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
++ /* Turn on the ADC for all channels except TS, leave TS as is */
++ return regmap_update_bits(info->regmap, AXP20X_ADC_EN1,
++ AXP288_ADC_EN_MASK, AXP288_ADC_EN_MASK);
+ }
+
+ static const struct iio_info axp288_adc_iio_info = {
+@@ -200,7 +244,7 @@ static int axp288_adc_probe(struct platform_device *pdev)
+ * Set ADC to enabled state at all time, including system suspend.
+ * otherwise internal fuel gauge functionality may be affected.
+ */
+- ret = axp288_adc_set_state(axp20x->regmap);
++ ret = axp288_adc_initialize(info);
+ if (ret) {
+ dev_err(&pdev->dev, "unable to enable ADC device\n");
+ return ret;
+diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c
+index 184d686ebd99..8b4568edd5cb 100644
+--- a/drivers/iio/adc/ti-ads8688.c
++++ b/drivers/iio/adc/ti-ads8688.c
+@@ -41,6 +41,7 @@
+
+ #define ADS8688_VREF_MV 4096
+ #define ADS8688_REALBITS 16
++#define ADS8688_MAX_CHANNELS 8
+
+ /*
+ * enum ads8688_range - ADS8688 reference voltage range
+@@ -385,7 +386,7 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p)
+ {
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+- u16 buffer[8];
++ u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)];
+ int i, j = 0;
+
+ for (i = 0; i < indio_dev->masklength; i++) {
+diff --git a/drivers/iio/chemical/atlas-ph-sensor.c b/drivers/iio/chemical/atlas-ph-sensor.c
+index a406ad31b096..3a20cb5d9bff 100644
+--- a/drivers/iio/chemical/atlas-ph-sensor.c
++++ b/drivers/iio/chemical/atlas-ph-sensor.c
+@@ -444,9 +444,8 @@ static int atlas_read_raw(struct iio_dev *indio_dev,
+ case IIO_CHAN_INFO_SCALE:
+ switch (chan->type) {
+ case IIO_TEMP:
+- *val = 1; /* 0.01 */
+- *val2 = 100;
+- break;
++ *val = 10;
++ return IIO_VAL_INT;
+ case IIO_PH:
+ *val = 1; /* 0.001 */
+ *val2 = 1000;
+@@ -477,7 +476,7 @@ static int atlas_write_raw(struct iio_dev *indio_dev,
+ int val, int val2, long mask)
+ {
+ struct atlas_data *data = iio_priv(indio_dev);
+- __be32 reg = cpu_to_be32(val);
++ __be32 reg = cpu_to_be32(val / 10);
+
+ if (val2 != 0 || val < 0 || val > 20000)
+ return -EINVAL;
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index 23739a60517f..bb1ee9834a02 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -139,6 +139,8 @@
+ #define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */
+ #define MEI_DEV_ID_CNP_H_4 0xA364 /* Cannon Point H 4 (iTouch) */
+
++#define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
++
+ /*
+ * MEI HW Section
+ */
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index c8e21c894a5f..4299658d48d6 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -105,6 +105,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
++
+ /* required last entry */
+ {0, }
+ };
+diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c
+index 3633202e18f4..de7f035a176d 100644
+--- a/drivers/misc/mic/vop/vop_main.c
++++ b/drivers/misc/mic/vop/vop_main.c
+@@ -563,6 +563,8 @@ static int _vop_remove_device(struct mic_device_desc __iomem *d,
+ int ret = -1;
+
+ if (ioread8(&dc->config_change) == MIC_VIRTIO_PARAM_DEV_REMOVE) {
++ struct device *dev = get_device(&vdev->vdev.dev);
++
+ dev_dbg(&vpdev->dev,
+ "%s %d config_change %d type %d vdev %p\n",
+ __func__, __LINE__,
+@@ -574,7 +576,7 @@ static int _vop_remove_device(struct mic_device_desc __iomem *d,
+ iowrite8(-1, &dc->h2c_vdev_db);
+ if (status & VIRTIO_CONFIG_S_DRIVER_OK)
+ wait_for_completion(&vdev->reset_done);
+- put_device(&vdev->vdev.dev);
++ put_device(dev);
+ iowrite8(1, &dc->guest_ack);
+ dev_dbg(&vpdev->dev, "%s %d guest_ack %d\n",
+ __func__, __LINE__, ioread8(&dc->guest_ack));
+diff --git a/drivers/misc/vexpress-syscfg.c b/drivers/misc/vexpress-syscfg.c
+index 6c3591cdf855..a3c6c773d9dc 100644
+--- a/drivers/misc/vexpress-syscfg.c
++++ b/drivers/misc/vexpress-syscfg.c
+@@ -61,7 +61,7 @@ static int vexpress_syscfg_exec(struct vexpress_syscfg_func *func,
+ int tries;
+ long timeout;
+
+- if (WARN_ON(index > func->num_templates))
++ if (WARN_ON(index >= func->num_templates))
+ return -EINVAL;
+
+ command = readl(syscfg->base + SYS_CFGCTRL);
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index 99c460facd5e..0bbb23b014f1 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -470,6 +470,10 @@ static struct mtd_part *allocate_partition(struct mtd_info *parent,
+ /* let's register it anyway to preserve ordering */
+ slave->offset = 0;
+ slave->mtd.size = 0;
++
++ /* Initialize ->erasesize to make add_mtd_device() happy. */
++ slave->mtd.erasesize = parent->erasesize;
++
+ printk(KERN_ERR"mtd: partition \"%s\" is out of reach -- disabled\n",
+ part->name);
+ goto out_register;
+diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
+index 88ea2203e263..322a008290e5 100644
+--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c
+@@ -155,9 +155,10 @@ int gpmi_init(struct gpmi_nand_data *this)
+
+ /*
+ * Reset BCH here, too. We got failures otherwise :(
+- * See later BCH reset for explanation of MX23 handling
++ * See later BCH reset for explanation of MX23 and MX28 handling
+ */
+- ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
++ ret = gpmi_reset_block(r->bch_regs,
++ GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
+ if (ret)
+ goto err_out;
+
+@@ -263,12 +264,10 @@ int bch_set_geometry(struct gpmi_nand_data *this)
+ /*
+ * Due to erratum #2847 of the MX23, the BCH cannot be soft reset on this
+ * chip, otherwise it will lock up. So we skip resetting BCH on the MX23.
+- * On the other hand, the MX28 needs the reset, because one case has been
+- * seen where the BCH produced ECC errors constantly after 10000
+- * consecutive reboots. The latter case has not been seen on the MX23
+- * yet, still we don't know if it could happen there as well.
++ * and MX28.
+ */
+- ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
++ ret = gpmi_reset_block(r->bch_regs,
++ GPMI_IS_MX23(this) || GPMI_IS_MX28(this));
+ if (ret)
+ goto err_out;
+
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index 30f83649c481..8c7bf91ce4e1 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -304,24 +304,30 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
+ struct nand_device *nand = spinand_to_nand(spinand);
+ struct mtd_info *mtd = nanddev_to_mtd(nand);
+ struct nand_page_io_req adjreq = *req;
+- unsigned int nbytes = 0;
+- void *buf = NULL;
++ void *buf = spinand->databuf;
++ unsigned int nbytes;
+ u16 column = 0;
+ int ret;
+
+- memset(spinand->databuf, 0xff,
+- nanddev_page_size(nand) +
+- nanddev_per_page_oobsize(nand));
++ /*
++ * Looks like PROGRAM LOAD (AKA write cache) does not necessarily reset
++ * the cache content to 0xFF (depends on vendor implementation), so we
++ * must fill the page cache entirely even if we only want to program
++ * the data portion of the page, otherwise we might corrupt the BBM or
++ * user data previously programmed in OOB area.
++ */
++ nbytes = nanddev_page_size(nand) + nanddev_per_page_oobsize(nand);
++ memset(spinand->databuf, 0xff, nbytes);
++ adjreq.dataoffs = 0;
++ adjreq.datalen = nanddev_page_size(nand);
++ adjreq.databuf.out = spinand->databuf;
++ adjreq.ooblen = nanddev_per_page_oobsize(nand);
++ adjreq.ooboffs = 0;
++ adjreq.oobbuf.out = spinand->oobbuf;
+
+- if (req->datalen) {
++ if (req->datalen)
+ memcpy(spinand->databuf + req->dataoffs, req->databuf.out,
+ req->datalen);
+- adjreq.dataoffs = 0;
+- adjreq.datalen = nanddev_page_size(nand);
+- adjreq.databuf.out = spinand->databuf;
+- nbytes = adjreq.datalen;
+- buf = spinand->databuf;
+- }
+
+ if (req->ooblen) {
+ if (req->mode == MTD_OPS_AUTO_OOB)
+@@ -332,14 +338,6 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
+ else
+ memcpy(spinand->oobbuf + req->ooboffs, req->oobbuf.out,
+ req->ooblen);
+-
+- adjreq.ooblen = nanddev_per_page_oobsize(nand);
+- adjreq.ooboffs = 0;
+- nbytes += nanddev_per_page_oobsize(nand);
+- if (!buf) {
+- buf = spinand->oobbuf;
+- column = nanddev_page_size(nand);
+- }
+ }
+
+ spinand_cache_op_adjust_colum(spinand, &adjreq, &column);
+@@ -370,8 +368,8 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
+
+ /*
+ * We need to use the RANDOM LOAD CACHE operation if there's
+- * more than one iteration, because the LOAD operation resets
+- * the cache to 0xff.
++ * more than one iteration, because the LOAD operation might
++ * reset the cache to 0xff.
+ */
+ if (nbytes) {
+ column = op.addr.val;
+@@ -1016,11 +1014,11 @@ static int spinand_init(struct spinand_device *spinand)
+ for (i = 0; i < nand->memorg.ntargets; i++) {
+ ret = spinand_select_target(spinand, i);
+ if (ret)
+- goto err_free_bufs;
++ goto err_manuf_cleanup;
+
+ ret = spinand_lock_block(spinand, BL_ALL_UNLOCKED);
+ if (ret)
+- goto err_free_bufs;
++ goto err_manuf_cleanup;
+ }
+
+ ret = nanddev_init(nand, &spinand_ops, THIS_MODULE);
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index 6d31ad799987..b7e272d6ae81 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1524,7 +1524,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+ DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_Strago"),
+- DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ },
+ },
+ {
+@@ -1532,7 +1532,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Setzer"),
+- DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ },
+ },
+ {
+@@ -1540,7 +1540,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Cyan"),
+- DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ },
+ },
+ {
+@@ -1548,7 +1548,7 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
+- DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ },
+ },
+ {}
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
+index aa8b58125568..ef4268cc6227 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c
+@@ -588,7 +588,7 @@ static const unsigned int h6_irq_bank_map[] = { 1, 5, 6, 7 };
+ static const struct sunxi_pinctrl_desc h6_pinctrl_data = {
+ .pins = h6_pins,
+ .npins = ARRAY_SIZE(h6_pins),
+- .irq_banks = 3,
++ .irq_banks = 4,
+ .irq_bank_map = h6_irq_bank_map,
+ .irq_read_needs_mux = true,
+ };
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 13b01351dd1c..41ef452c1fcf 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -787,6 +787,13 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
+ struct dentry *dentry = NULL, *trap;
+ struct name_snapshot old_name;
+
++ if (IS_ERR(old_dir))
++ return old_dir;
++ if (IS_ERR(new_dir))
++ return new_dir;
++ if (IS_ERR_OR_NULL(old_dentry))
++ return old_dentry;
++
+ trap = lock_rename(new_dir, old_dir);
+ /* Source or destination directories don't exist? */
+ if (d_really_is_negative(old_dir) || d_really_is_negative(new_dir))
+diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
+index 712f00995390..5508baa11bb6 100644
+--- a/fs/ext4/fsync.c
++++ b/fs/ext4/fsync.c
+@@ -116,16 +116,8 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ goto out;
+ }
+
+- ret = file_write_and_wait_range(file, start, end);
+- if (ret)
+- return ret;
+-
+ if (!journal) {
+- struct writeback_control wbc = {
+- .sync_mode = WB_SYNC_ALL
+- };
+-
+- ret = ext4_write_inode(inode, &wbc);
++ ret = __generic_file_fsync(file, start, end, datasync);
+ if (!ret)
+ ret = ext4_sync_parent(inode);
+ if (test_opt(inode->i_sb, BARRIER))
+@@ -133,6 +125,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ goto out;
+ }
+
++ ret = file_write_and_wait_range(file, start, end);
++ if (ret)
++ return ret;
+ /*
+ * data=writeback,ordered:
+ * The caller's filemap_fdatawrite()/wait will sync the data.
+diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
+index 336fd1a19cca..f30bf500888d 100644
+--- a/include/linux/sunrpc/xprt.h
++++ b/include/linux/sunrpc/xprt.h
+@@ -443,6 +443,11 @@ static inline int xprt_test_and_set_connecting(struct rpc_xprt *xprt)
+ return test_and_set_bit(XPRT_CONNECTING, &xprt->state);
+ }
+
++static inline int xprt_close_wait(struct rpc_xprt *xprt)
++{
++ return test_bit(XPRT_CLOSE_WAIT, &xprt->state);
++}
++
+ static inline void xprt_set_bound(struct rpc_xprt *xprt)
+ {
+ test_and_set_bit(XPRT_BOUND, &xprt->state);
+diff --git a/kernel/signal.c b/kernel/signal.c
+index edc28afc9fb4..c187def3dba6 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -681,6 +681,48 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
+ return signr;
+ }
+
++static int dequeue_synchronous_signal(siginfo_t *info)
++{
++ struct task_struct *tsk = current;
++ struct sigpending *pending = &tsk->pending;
++ struct sigqueue *q, *sync = NULL;
++
++ /*
++ * Might a synchronous signal be in the queue?
++ */
++ if (!((pending->signal.sig[0] & ~tsk->blocked.sig[0]) & SYNCHRONOUS_MASK))
++ return 0;
++
++ /*
++ * Return the first synchronous signal in the queue.
++ */
++ list_for_each_entry(q, &pending->list, list) {
++ /* Synchronous signals have a postive si_code */
++ if ((q->info.si_code > SI_USER) &&
++ (sigmask(q->info.si_signo) & SYNCHRONOUS_MASK)) {
++ sync = q;
++ goto next;
++ }
++ }
++ return 0;
++next:
++ /*
++ * Check if there is another siginfo for the same signal.
++ */
++ list_for_each_entry_continue(q, &pending->list, list) {
++ if (q->info.si_signo == sync->info.si_signo)
++ goto still_pending;
++ }
++
++ sigdelset(&pending->signal, sync->info.si_signo);
++ recalc_sigpending();
++still_pending:
++ list_del_init(&sync->list);
++ copy_siginfo(info, &sync->info);
++ __sigqueue_free(sync);
++ return info->si_signo;
++}
++
+ /*
+ * Tell a process that it has a new active signal..
+ *
+@@ -2390,6 +2432,11 @@ relock:
+ goto relock;
+ }
+
++ /* Has this task already been marked for death? */
++ ksig->info.si_signo = signr = SIGKILL;
++ if (signal_group_exit(signal))
++ goto fatal;
++
+ for (;;) {
+ struct k_sigaction *ka;
+
+@@ -2403,7 +2450,15 @@ relock:
+ goto relock;
+ }
+
+- signr = dequeue_signal(current, ¤t->blocked, &ksig->info);
++ /*
++ * Signals generated by the execution of an instruction
++ * need to be delivered before any other pending signals
++ * so that the instruction pointer in the signal stack
++ * frame points to the faulting instruction.
++ */
++ signr = dequeue_synchronous_signal(&ksig->info);
++ if (!signr)
++ signr = dequeue_signal(current, ¤t->blocked, &ksig->info);
+
+ if (!signr)
+ break; /* will return 0 */
+@@ -2485,6 +2540,7 @@ relock:
+ continue;
+ }
+
++ fatal:
+ spin_unlock_irq(&sighand->siglock);
+
+ /*
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index e696667da29a..a6aebbc848fe 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -5,7 +5,7 @@
+ * Copyright (C) IBM Corporation, 2010-2012
+ * Author: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+ */
+-#define pr_fmt(fmt) "trace_kprobe: " fmt
++#define pr_fmt(fmt) "trace_uprobe: " fmt
+
+ #include <linux/module.h>
+ #include <linux/uaccess.h>
+diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
+index 2f0d42f2f913..08690d06b7be 100644
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -20,7 +20,6 @@
+ #include "main.h"
+
+ #include <linux/atomic.h>
+-#include <linux/bug.h>
+ #include <linux/byteorder/generic.h>
+ #include <linux/errno.h>
+ #include <linux/gfp.h>
+@@ -179,8 +178,10 @@ static bool batadv_is_on_batman_iface(const struct net_device *net_dev)
+ parent_dev = __dev_get_by_index((struct net *)parent_net,
+ dev_get_iflink(net_dev));
+ /* if we got a NULL parent_dev there is something broken.. */
+- if (WARN(!parent_dev, "Cannot find parent device"))
++ if (!parent_dev) {
++ pr_err("Cannot find parent device\n");
+ return false;
++ }
+
+ if (batadv_mutual_parents(net_dev, net, parent_dev, parent_net))
+ return false;
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 626ddca332db..3899fa6e201d 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -221,6 +221,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
+
+ netif_trans_update(soft_iface);
+ vid = batadv_get_vid(skb, 0);
++
++ skb_reset_mac_header(skb);
+ ethhdr = eth_hdr(skb);
+
+ switch (ntohs(ethhdr->h_proto)) {
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 9a1c27c61de8..a127d1442116 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -3240,9 +3240,10 @@ void ceph_con_keepalive(struct ceph_connection *con)
+ dout("con_keepalive %p\n", con);
+ mutex_lock(&con->mutex);
+ clear_standby(con);
++ con_flag_set(con, CON_FLAG_KEEPALIVE_PENDING);
+ mutex_unlock(&con->mutex);
+- if (con_flag_test_and_set(con, CON_FLAG_KEEPALIVE_PENDING) == 0 &&
+- con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
++
++ if (con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
+ queue_con(con);
+ }
+ EXPORT_SYMBOL(ceph_con_keepalive);
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 995a491f73a9..c7ccd7b71b15 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1913,9 +1913,16 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
+ int head_need, bool may_encrypt)
+ {
+ struct ieee80211_local *local = sdata->local;
++ struct ieee80211_hdr *hdr;
++ bool enc_tailroom;
+ int tail_need = 0;
+
+- if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
++ hdr = (struct ieee80211_hdr *) skb->data;
++ enc_tailroom = may_encrypt &&
++ (sdata->crypto_tx_tailroom_needed_cnt ||
++ ieee80211_is_mgmt(hdr->frame_control));
++
++ if (enc_tailroom) {
+ tail_need = IEEE80211_ENCRYPT_TAILROOM;
+ tail_need -= skb_tailroom(skb);
+ tail_need = max_t(int, tail_need, 0);
+@@ -1923,8 +1930,7 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
+
+ if (skb_cloned(skb) &&
+ (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
+- !skb_clone_writable(skb, ETH_HLEN) ||
+- (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt)))
++ !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom))
+ I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
+ else if (head_need || tail_need)
+ I802_DEBUG_INC(local->tx_expand_skb_head);
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 8ea2f5fadd96..1fc812ba9871 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1992,13 +1992,15 @@ call_transmit(struct rpc_task *task)
+ static void
+ call_transmit_status(struct rpc_task *task)
+ {
++ struct rpc_xprt *xprt = task->tk_rqstp->rq_xprt;
+ task->tk_action = call_status;
+
+ /*
+ * Common case: success. Force the compiler to put this
+- * test first.
++ * test first. Or, if any error and xprt_close_wait,
++ * release the xprt lock so the socket can close.
+ */
+- if (task->tk_status == 0) {
++ if (task->tk_status == 0 || xprt_close_wait(xprt)) {
+ xprt_end_transmit(task);
+ rpc_task_force_reencode(task);
+ return;
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+index 8602a5f1b515..e8ad7ddf347a 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+@@ -563,6 +563,99 @@ void svc_rdma_sync_reply_hdr(struct svcxprt_rdma *rdma,
+ DMA_TO_DEVICE);
+ }
+
++/* If the xdr_buf has more elements than the device can
++ * transmit in a single RDMA Send, then the reply will
++ * have to be copied into a bounce buffer.
++ */
++static bool svc_rdma_pull_up_needed(struct svcxprt_rdma *rdma,
++ struct xdr_buf *xdr,
++ __be32 *wr_lst)
++{
++ int elements;
++
++ /* xdr->head */
++ elements = 1;
++
++ /* xdr->pages */
++ if (!wr_lst) {
++ unsigned int remaining;
++ unsigned long pageoff;
++
++ pageoff = xdr->page_base & ~PAGE_MASK;
++ remaining = xdr->page_len;
++ while (remaining) {
++ ++elements;
++ remaining -= min_t(u32, PAGE_SIZE - pageoff,
++ remaining);
++ pageoff = 0;
++ }
++ }
++
++ /* xdr->tail */
++ if (xdr->tail[0].iov_len)
++ ++elements;
++
++ /* assume 1 SGE is needed for the transport header */
++ return elements >= rdma->sc_max_send_sges;
++}
++
++/* The device is not capable of sending the reply directly.
++ * Assemble the elements of @xdr into the transport header
++ * buffer.
++ */
++static int svc_rdma_pull_up_reply_msg(struct svcxprt_rdma *rdma,
++ struct svc_rdma_send_ctxt *ctxt,
++ struct xdr_buf *xdr, __be32 *wr_lst)
++{
++ unsigned char *dst, *tailbase;
++ unsigned int taillen;
++
++ dst = ctxt->sc_xprt_buf;
++ dst += ctxt->sc_sges[0].length;
++
++ memcpy(dst, xdr->head[0].iov_base, xdr->head[0].iov_len);
++ dst += xdr->head[0].iov_len;
++
++ tailbase = xdr->tail[0].iov_base;
++ taillen = xdr->tail[0].iov_len;
++ if (wr_lst) {
++ u32 xdrpad;
++
++ xdrpad = xdr_padsize(xdr->page_len);
++ if (taillen && xdrpad) {
++ tailbase += xdrpad;
++ taillen -= xdrpad;
++ }
++ } else {
++ unsigned int len, remaining;
++ unsigned long pageoff;
++ struct page **ppages;
++
++ ppages = xdr->pages + (xdr->page_base >> PAGE_SHIFT);
++ pageoff = xdr->page_base & ~PAGE_MASK;
++ remaining = xdr->page_len;
++ while (remaining) {
++ len = min_t(u32, PAGE_SIZE - pageoff, remaining);
++
++ memcpy(dst, page_address(*ppages), len);
++ remaining -= len;
++ dst += len;
++ pageoff = 0;
++ }
++ }
++
++ if (taillen)
++ memcpy(dst, tailbase, taillen);
++
++ ctxt->sc_sges[0].length += xdr->len;
++ ib_dma_sync_single_for_device(rdma->sc_pd->device,
++ ctxt->sc_sges[0].addr,
++ ctxt->sc_sges[0].length,
++ DMA_TO_DEVICE);
++
++ return 0;
++}
++
+ /* svc_rdma_map_reply_msg - Map the buffer holding RPC message
+ * @rdma: controlling transport
+ * @ctxt: send_ctxt for the Send WR
+@@ -585,8 +678,10 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
+ u32 xdr_pad;
+ int ret;
+
+- if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
+- return -EIO;
++ if (svc_rdma_pull_up_needed(rdma, xdr, wr_lst))
++ return svc_rdma_pull_up_reply_msg(rdma, ctxt, xdr, wr_lst);
++
++ ++ctxt->sc_cur_sge_no;
+ ret = svc_rdma_dma_map_buf(rdma, ctxt,
+ xdr->head[0].iov_base,
+ xdr->head[0].iov_len);
+@@ -617,8 +712,7 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
+ while (remaining) {
+ len = min_t(u32, PAGE_SIZE - page_off, remaining);
+
+- if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
+- return -EIO;
++ ++ctxt->sc_cur_sge_no;
+ ret = svc_rdma_dma_map_page(rdma, ctxt, *ppages++,
+ page_off, len);
+ if (ret < 0)
+@@ -632,8 +726,7 @@ int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
+ len = xdr->tail[0].iov_len;
+ tail:
+ if (len) {
+- if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
+- return -EIO;
++ ++ctxt->sc_cur_sge_no;
+ ret = svc_rdma_dma_map_buf(rdma, ctxt, base, len);
+ if (ret < 0)
+ return ret;
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+index 2848cafd4a17..ce5c610b49c7 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+@@ -475,13 +475,12 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
+
+ /* Qualify the transport resource defaults with the
+ * capabilities of this particular device */
+- newxprt->sc_max_send_sges = dev->attrs.max_send_sge;
+- /* transport hdr, head iovec, one page list entry, tail iovec */
+- if (newxprt->sc_max_send_sges < 4) {
+- pr_err("svcrdma: too few Send SGEs available (%d)\n",
+- newxprt->sc_max_send_sges);
+- goto errout;
+- }
++ /* Transport header, head iovec, tail iovec */
++ newxprt->sc_max_send_sges = 3;
++ /* Add one SGE per page list entry */
++ newxprt->sc_max_send_sges += (svcrdma_max_req_size / PAGE_SIZE) + 1;
++ if (newxprt->sc_max_send_sges > dev->attrs.max_send_sge)
++ newxprt->sc_max_send_sges = dev->attrs.max_send_sge;
+ newxprt->sc_max_req_size = svcrdma_max_req_size;
+ newxprt->sc_max_requests = svcrdma_max_requests;
+ newxprt->sc_max_bc_requests = svcrdma_max_bc_requests;
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 119a427d9b2b..6ea8036fcdbe 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1628,7 +1628,10 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
+ dst_copy_metrics(dst1, dst);
+
+ if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
+- __u32 mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
++ __u32 mark = 0;
++
++ if (xfrm[i]->props.smark.v || xfrm[i]->props.smark.m)
++ mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
+
+ family = xfrm[i]->props.family;
+ dst = xfrm_dst_lookup(xfrm[i], tos, fl->flowi_oif,
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 566919838d5e..ab557827aac0 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1488,10 +1488,15 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
+ if (!ut[i].family)
+ ut[i].family = family;
+
+- if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
+- (ut[i].family != prev_family))
+- return -EINVAL;
+-
++ switch (ut[i].mode) {
++ case XFRM_MODE_TUNNEL:
++ case XFRM_MODE_BEET:
++ break;
++ default:
++ if (ut[i].family != prev_family)
++ return -EINVAL;
++ break;
++ }
+ if (ut[i].mode >= XFRM_MODE_MAX)
+ return -EINVAL;
+
+diff --git a/samples/mei/mei-amt-version.c b/samples/mei/mei-amt-version.c
+index 57d0d871dcf7..bb9988914a56 100644
+--- a/samples/mei/mei-amt-version.c
++++ b/samples/mei/mei-amt-version.c
+@@ -117,7 +117,7 @@ static bool mei_init(struct mei *me, const uuid_le *guid,
+
+ me->verbose = verbose;
+
+- me->fd = open("/dev/mei", O_RDWR);
++ me->fd = open("/dev/mei0", O_RDWR);
+ if (me->fd == -1) {
+ mei_err(me, "Cannot establish a handle to the Intel MEI driver\n");
+ goto err;
+diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
+index 3040830d7797..84545666a09c 100644
+--- a/tools/iio/iio_generic_buffer.c
++++ b/tools/iio/iio_generic_buffer.c
+@@ -330,7 +330,7 @@ static const struct option longopts[] = {
+
+ int main(int argc, char **argv)
+ {
+- unsigned long long num_loops = 2;
++ long long num_loops = 2;
+ unsigned long timedelay = 1000000;
+ unsigned long buf_len = 128;
+
diff --git a/1022_linux-4.19.23.patch b/1022_linux-4.19.23.patch
new file mode 100644
index 0000000..564858d
--- /dev/null
+++ b/1022_linux-4.19.23.patch
@@ -0,0 +1,35 @@
+diff --git a/Makefile b/Makefile
+index 8cfcb01fcd7b..3dcf3f2363c1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 22
++SUBLEVEL = 23
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
+index d0078cbb718b..7cde3f46ad26 100644
+--- a/fs/binfmt_script.c
++++ b/fs/binfmt_script.c
+@@ -42,14 +42,10 @@ static int load_script(struct linux_binprm *bprm)
+ fput(bprm->file);
+ bprm->file = NULL;
+
+- for (cp = bprm->buf+2;; cp++) {
+- if (cp >= bprm->buf + BINPRM_BUF_SIZE)
+- return -ENOEXEC;
+- if (!*cp || (*cp == '\n'))
+- break;
+- }
++ bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
++ if ((cp = strchr(bprm->buf, '\n')) == NULL)
++ cp = bprm->buf+BINPRM_BUF_SIZE-1;
+ *cp = '\0';
+-
+ while (cp > bprm->buf) {
+ cp--;
+ if ((*cp == ' ') || (*cp == '\t'))
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-02-16 0:42 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-02-16 0:42 UTC (permalink / raw
To: gentoo-commits
commit: bd5c5fedeede91646e26afb9b9d43e71f8769ea2
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 16 00:42:32 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Feb 16 00:42:32 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bd5c5fed
proj/linux-patches: Rename patch for clarity
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 2 +-
....patch => 5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch | 0
2 files changed, 1 insertion(+), 1 deletion(-)
diff --git a/0000_README b/0000_README
index 67480bc..bec430b 100644
--- a/0000_README
+++ b/0000_README
@@ -163,6 +163,6 @@ Patch: 4567_distro-Gentoo-Kconfig.patch
From: Tom Wijsman <TomWij@gentoo.org>
Desc: Add Gentoo Linux support config settings and defaults.
-Patch: 5010_enable-additional-cpu-optimizations-for-gcc.patch
+Patch: 5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
From: https://github.com/graysky2/kernel_gcc_patch/
Desc: Kernel patch enables gcc >= v4.13 optimizations for additional CPUs.
diff --git a/5010_enable-additional-cpu-optimizations-for-gcc.patch b/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
similarity index 100%
rename from 5010_enable-additional-cpu-optimizations-for-gcc.patch
rename to 5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-02-20 11:19 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-02-20 11:19 UTC (permalink / raw
To: gentoo-commits
commit: 9357e267eea9e76458572750473116becb53c079
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 20 11:18:41 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Feb 20 11:18:41 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9357e267
proj/linux-patches: Linux patch 4.19.24
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1023_linux-4.19.24.patch | 3179 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3183 insertions(+)
diff --git a/0000_README b/0000_README
index bec430b..62f98e4 100644
--- a/0000_README
+++ b/0000_README
@@ -135,6 +135,10 @@ Patch: 1022_linux-4.19.23.patch
From: http://www.kernel.org
Desc: Linux 4.19.23
+Patch: 1023_linux-4.19.24.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.24
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1023_linux-4.19.24.patch b/1023_linux-4.19.24.patch
new file mode 100644
index 0000000..9580fbc
--- /dev/null
+++ b/1023_linux-4.19.24.patch
@@ -0,0 +1,3179 @@
+diff --git a/Documentation/devicetree/bindings/eeprom/at24.txt b/Documentation/devicetree/bindings/eeprom/at24.txt
+index aededdbc262b..f9a7c984274c 100644
+--- a/Documentation/devicetree/bindings/eeprom/at24.txt
++++ b/Documentation/devicetree/bindings/eeprom/at24.txt
+@@ -27,6 +27,7 @@ Required properties:
+ "atmel,24c256",
+ "atmel,24c512",
+ "atmel,24c1024",
++ "atmel,24c2048",
+
+ If <manufacturer> is not "atmel", then a fallback must be used
+ with the same <model> and "atmel" as manufacturer.
+diff --git a/Makefile b/Makefile
+index 3dcf3f2363c1..370ad0d34076 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 23
++SUBLEVEL = 24
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/include/asm/irq.h b/arch/alpha/include/asm/irq.h
+index 4d17cacd1462..432402c8e47f 100644
+--- a/arch/alpha/include/asm/irq.h
++++ b/arch/alpha/include/asm/irq.h
+@@ -56,15 +56,15 @@
+
+ #elif defined(CONFIG_ALPHA_DP264) || \
+ defined(CONFIG_ALPHA_LYNX) || \
+- defined(CONFIG_ALPHA_SHARK) || \
+- defined(CONFIG_ALPHA_EIGER)
++ defined(CONFIG_ALPHA_SHARK)
+ # define NR_IRQS 64
+
+ #elif defined(CONFIG_ALPHA_TITAN)
+ #define NR_IRQS 80
+
+ #elif defined(CONFIG_ALPHA_RAWHIDE) || \
+- defined(CONFIG_ALPHA_TAKARA)
++ defined(CONFIG_ALPHA_TAKARA) || \
++ defined(CONFIG_ALPHA_EIGER)
+ # define NR_IRQS 128
+
+ #elif defined(CONFIG_ALPHA_WILDFIRE)
+diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
+index d73dc473fbb9..188fc9256baf 100644
+--- a/arch/alpha/mm/fault.c
++++ b/arch/alpha/mm/fault.c
+@@ -78,7 +78,7 @@ __load_new_mm_context(struct mm_struct *next_mm)
+ /* Macro for exception fixup code to access integer registers. */
+ #define dpf_reg(r) \
+ (((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-16 : \
+- (r) <= 18 ? (r)+8 : (r)-10])
++ (r) <= 18 ? (r)+10 : (r)-10])
+
+ asmlinkage void
+ do_page_fault(unsigned long address, unsigned long mmcsr,
+diff --git a/arch/arm/boot/dts/da850-evm.dts b/arch/arm/boot/dts/da850-evm.dts
+index f9b757905845..016616cc036c 100644
+--- a/arch/arm/boot/dts/da850-evm.dts
++++ b/arch/arm/boot/dts/da850-evm.dts
+@@ -94,6 +94,28 @@
+ regulator-boot-on;
+ };
+
++ baseboard_3v3: fixedregulator-3v3 {
++ /* TPS73701DCQ */
++ compatible = "regulator-fixed";
++ regulator-name = "baseboard_3v3";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ vin-supply = <&vbat>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
++ baseboard_1v8: fixedregulator-1v8 {
++ /* TPS73701DCQ */
++ compatible = "regulator-fixed";
++ regulator-name = "baseboard_1v8";
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ vin-supply = <&vbat>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
+ backlight_lcd: backlight-regulator {
+ compatible = "regulator-fixed";
+ regulator-name = "lcd_backlight_pwr";
+@@ -105,7 +127,7 @@
+
+ sound {
+ compatible = "simple-audio-card";
+- simple-audio-card,name = "DA850/OMAP-L138 EVM";
++ simple-audio-card,name = "DA850-OMAPL138 EVM";
+ simple-audio-card,widgets =
+ "Line", "Line In",
+ "Line", "Line Out";
+@@ -210,10 +232,9 @@
+
+ /* Regulators */
+ IOVDD-supply = <&vdcdc2_reg>;
+- /* Derived from VBAT: Baseboard 3.3V / 1.8V */
+- AVDD-supply = <&vbat>;
+- DRVDD-supply = <&vbat>;
+- DVDD-supply = <&vbat>;
++ AVDD-supply = <&baseboard_3v3>;
++ DRVDD-supply = <&baseboard_3v3>;
++ DVDD-supply = <&baseboard_1v8>;
+ };
+ tca6416: gpio@20 {
+ compatible = "ti,tca6416";
+diff --git a/arch/arm/boot/dts/da850-lcdk.dts b/arch/arm/boot/dts/da850-lcdk.dts
+index 0177e3ed20fe..3a2fa6e035a3 100644
+--- a/arch/arm/boot/dts/da850-lcdk.dts
++++ b/arch/arm/boot/dts/da850-lcdk.dts
+@@ -39,9 +39,39 @@
+ };
+ };
+
++ vcc_5vd: fixedregulator-vcc_5vd {
++ compatible = "regulator-fixed";
++ regulator-name = "vcc_5vd";
++ regulator-min-microvolt = <5000000>;
++ regulator-max-microvolt = <5000000>;
++ regulator-boot-on;
++ };
++
++ vcc_3v3d: fixedregulator-vcc_3v3d {
++ /* TPS650250 - VDCDC1 */
++ compatible = "regulator-fixed";
++ regulator-name = "vcc_3v3d";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ vin-supply = <&vcc_5vd>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
++ vcc_1v8d: fixedregulator-vcc_1v8d {
++ /* TPS650250 - VDCDC2 */
++ compatible = "regulator-fixed";
++ regulator-name = "vcc_1v8d";
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ vin-supply = <&vcc_5vd>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
+ sound {
+ compatible = "simple-audio-card";
+- simple-audio-card,name = "DA850/OMAP-L138 LCDK";
++ simple-audio-card,name = "DA850-OMAPL138 LCDK";
+ simple-audio-card,widgets =
+ "Line", "Line In",
+ "Line", "Line Out";
+@@ -221,6 +251,12 @@
+ compatible = "ti,tlv320aic3106";
+ reg = <0x18>;
+ status = "okay";
++
++ /* Regulators */
++ IOVDD-supply = <&vcc_3v3d>;
++ AVDD-supply = <&vcc_3v3d>;
++ DRVDD-supply = <&vcc_3v3d>;
++ DVDD-supply = <&vcc_1v8d>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/kirkwood-dnskw.dtsi b/arch/arm/boot/dts/kirkwood-dnskw.dtsi
+index cbaf06f2f78e..eb917462b219 100644
+--- a/arch/arm/boot/dts/kirkwood-dnskw.dtsi
++++ b/arch/arm/boot/dts/kirkwood-dnskw.dtsi
+@@ -36,8 +36,8 @@
+ compatible = "gpio-fan";
+ pinctrl-0 = <&pmx_fan_high_speed &pmx_fan_low_speed>;
+ pinctrl-names = "default";
+- gpios = <&gpio1 14 GPIO_ACTIVE_LOW
+- &gpio1 13 GPIO_ACTIVE_LOW>;
++ gpios = <&gpio1 14 GPIO_ACTIVE_HIGH
++ &gpio1 13 GPIO_ACTIVE_HIGH>;
+ gpio-fan,speed-map = <0 0
+ 3000 1
+ 6000 2>;
+diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi
+index ab6f640b282b..8b8db9d8e912 100644
+--- a/arch/arm/boot/dts/omap5-board-common.dtsi
++++ b/arch/arm/boot/dts/omap5-board-common.dtsi
+@@ -317,7 +317,8 @@
+
+ palmas_sys_nirq_pins: pinmux_palmas_sys_nirq_pins {
+ pinctrl-single,pins = <
+- OMAP5_IOPAD(0x068, PIN_INPUT_PULLUP | MUX_MODE0) /* sys_nirq1 */
++ /* sys_nirq1 is pulled down as the SoC is inverting it for GIC */
++ OMAP5_IOPAD(0x068, PIN_INPUT_PULLUP | MUX_MODE0)
+ >;
+ };
+
+@@ -385,7 +386,8 @@
+
+ palmas: palmas@48 {
+ compatible = "ti,palmas";
+- interrupts = <GIC_SPI 7 IRQ_TYPE_NONE>; /* IRQ_SYS_1N */
++ /* sys_nirq/ext_sys_irq pins get inverted at mpuss wakeupgen */
++ interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_LOW>;
+ reg = <0x48>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+@@ -651,7 +653,8 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&twl6040_pins>;
+
+- interrupts = <GIC_SPI 119 IRQ_TYPE_NONE>; /* IRQ_SYS_2N cascaded to gic */
++ /* sys_nirq/ext_sys_irq pins get inverted at mpuss wakeupgen */
++ interrupts = <GIC_SPI 119 IRQ_TYPE_LEVEL_LOW>;
+
+ /* audpwron gpio defined in the board specific dts */
+
+diff --git a/arch/arm/boot/dts/omap5-cm-t54.dts b/arch/arm/boot/dts/omap5-cm-t54.dts
+index 5e21fb430a65..e78d3718f145 100644
+--- a/arch/arm/boot/dts/omap5-cm-t54.dts
++++ b/arch/arm/boot/dts/omap5-cm-t54.dts
+@@ -181,6 +181,13 @@
+ OMAP5_IOPAD(0x0042, PIN_INPUT_PULLDOWN | MUX_MODE6) /* llib_wakereqin.gpio1_wk15 */
+ >;
+ };
++
++ palmas_sys_nirq_pins: pinmux_palmas_sys_nirq_pins {
++ pinctrl-single,pins = <
++ /* sys_nirq1 is pulled down as the SoC is inverting it for GIC */
++ OMAP5_IOPAD(0x068, PIN_INPUT_PULLUP | MUX_MODE0)
++ >;
++ };
+ };
+
+ &omap5_pmx_core {
+@@ -414,8 +421,11 @@
+
+ palmas: palmas@48 {
+ compatible = "ti,palmas";
+- interrupts = <GIC_SPI 7 IRQ_TYPE_NONE>; /* IRQ_SYS_1N */
+ reg = <0x48>;
++ pinctrl-0 = <&palmas_sys_nirq_pins>;
++ pinctrl-names = "default";
++ /* sys_nirq/ext_sys_irq pins get inverted at mpuss wakeupgen */
++ interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ ti,system-power-controller;
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index b17ee03d280b..88286dd483ff 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -467,6 +467,17 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ #endif
+ .endm
+
++ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
++#ifdef CONFIG_CPU_SPECTRE
++ sub \tmp, \limit, #1
++ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
++ addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
++ subhss \tmp, \tmp, \size @ tmp = limit - (addr + size) }
++ movlo \addr, #0 @ if (tmp < 0) addr = NULL
++ csdb
++#endif
++ .endm
++
+ .macro uaccess_disable, tmp, isb=1
+ #ifdef CONFIG_CPU_SW_DOMAIN_PAN
+ /*
+diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
+index 0d289240b6ca..775cac3c02bb 100644
+--- a/arch/arm/include/asm/cputype.h
++++ b/arch/arm/include/asm/cputype.h
+@@ -111,6 +111,7 @@
+ #include <linux/kernel.h>
+
+ extern unsigned int processor_id;
++struct proc_info_list *lookup_processor(u32 midr);
+
+ #ifdef CONFIG_CPU_CP15
+ #define read_cpuid(reg) \
+diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h
+index e25f4392e1b2..e1b6f280ab08 100644
+--- a/arch/arm/include/asm/proc-fns.h
++++ b/arch/arm/include/asm/proc-fns.h
+@@ -23,7 +23,7 @@ struct mm_struct;
+ /*
+ * Don't change this structure - ASM code relies on it.
+ */
+-extern struct processor {
++struct processor {
+ /* MISC
+ * get data abort address/flags
+ */
+@@ -79,9 +79,13 @@ extern struct processor {
+ unsigned int suspend_size;
+ void (*do_suspend)(void *);
+ void (*do_resume)(void *);
+-} processor;
++};
+
+ #ifndef MULTI_CPU
++static inline void init_proc_vtable(const struct processor *p)
++{
++}
++
+ extern void cpu_proc_init(void);
+ extern void cpu_proc_fin(void);
+ extern int cpu_do_idle(void);
+@@ -98,17 +102,50 @@ extern void cpu_reset(unsigned long addr, bool hvc) __attribute__((noreturn));
+ extern void cpu_do_suspend(void *);
+ extern void cpu_do_resume(void *);
+ #else
+-#define cpu_proc_init processor._proc_init
+-#define cpu_proc_fin processor._proc_fin
+-#define cpu_reset processor.reset
+-#define cpu_do_idle processor._do_idle
+-#define cpu_dcache_clean_area processor.dcache_clean_area
+-#define cpu_set_pte_ext processor.set_pte_ext
+-#define cpu_do_switch_mm processor.switch_mm
+
+-/* These three are private to arch/arm/kernel/suspend.c */
+-#define cpu_do_suspend processor.do_suspend
+-#define cpu_do_resume processor.do_resume
++extern struct processor processor;
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++#include <linux/smp.h>
++/*
++ * This can't be a per-cpu variable because we need to access it before
++ * per-cpu has been initialised. We have a couple of functions that are
++ * called in a pre-emptible context, and so can't use smp_processor_id()
++ * there, hence PROC_TABLE(). We insist in init_proc_vtable() that the
++ * function pointers for these are identical across all CPUs.
++ */
++extern struct processor *cpu_vtable[];
++#define PROC_VTABLE(f) cpu_vtable[smp_processor_id()]->f
++#define PROC_TABLE(f) cpu_vtable[0]->f
++static inline void init_proc_vtable(const struct processor *p)
++{
++ unsigned int cpu = smp_processor_id();
++ *cpu_vtable[cpu] = *p;
++ WARN_ON_ONCE(cpu_vtable[cpu]->dcache_clean_area !=
++ cpu_vtable[0]->dcache_clean_area);
++ WARN_ON_ONCE(cpu_vtable[cpu]->set_pte_ext !=
++ cpu_vtable[0]->set_pte_ext);
++}
++#else
++#define PROC_VTABLE(f) processor.f
++#define PROC_TABLE(f) processor.f
++static inline void init_proc_vtable(const struct processor *p)
++{
++ processor = *p;
++}
++#endif
++
++#define cpu_proc_init PROC_VTABLE(_proc_init)
++#define cpu_check_bugs PROC_VTABLE(check_bugs)
++#define cpu_proc_fin PROC_VTABLE(_proc_fin)
++#define cpu_reset PROC_VTABLE(reset)
++#define cpu_do_idle PROC_VTABLE(_do_idle)
++#define cpu_dcache_clean_area PROC_TABLE(dcache_clean_area)
++#define cpu_set_pte_ext PROC_TABLE(set_pte_ext)
++#define cpu_do_switch_mm PROC_VTABLE(switch_mm)
++
++/* These two are private to arch/arm/kernel/suspend.c */
++#define cpu_do_suspend PROC_VTABLE(do_suspend)
++#define cpu_do_resume PROC_VTABLE(do_resume)
+ #endif
+
+ extern void cpu_resume(void);
+diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
+index 9b37b6ab27fe..8f55dc520a3e 100644
+--- a/arch/arm/include/asm/thread_info.h
++++ b/arch/arm/include/asm/thread_info.h
+@@ -121,8 +121,8 @@ extern void vfp_flush_hwstate(struct thread_info *);
+ struct user_vfp;
+ struct user_vfp_exc;
+
+-extern int vfp_preserve_user_clear_hwstate(struct user_vfp __user *,
+- struct user_vfp_exc __user *);
++extern int vfp_preserve_user_clear_hwstate(struct user_vfp *,
++ struct user_vfp_exc *);
+ extern int vfp_restore_user_hwstate(struct user_vfp *,
+ struct user_vfp_exc *);
+ #endif
+diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
+index 5451e1f05a19..c136eef8f690 100644
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -69,6 +69,14 @@ extern int __put_user_bad(void);
+ static inline void set_fs(mm_segment_t fs)
+ {
+ current_thread_info()->addr_limit = fs;
++
++ /*
++ * Prevent a mispredicted conditional call to set_fs from forwarding
++ * the wrong address limit to access_ok under speculation.
++ */
++ dsb(nsh);
++ isb();
++
+ modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_CLIENT : DOMAIN_MANAGER);
+ }
+
+@@ -91,6 +99,32 @@ static inline void set_fs(mm_segment_t fs)
+ #define __inttype(x) \
+ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
+
++/*
++ * Sanitise a uaccess pointer such that it becomes NULL if addr+size
++ * is above the current addr_limit.
++ */
++#define uaccess_mask_range_ptr(ptr, size) \
++ ((__typeof__(ptr))__uaccess_mask_range_ptr(ptr, size))
++static inline void __user *__uaccess_mask_range_ptr(const void __user *ptr,
++ size_t size)
++{
++ void __user *safe_ptr = (void __user *)ptr;
++ unsigned long tmp;
++
++ asm volatile(
++ " sub %1, %3, #1\n"
++ " subs %1, %1, %0\n"
++ " addhs %1, %1, #1\n"
++ " subhss %1, %1, %2\n"
++ " movlo %0, #0\n"
++ : "+r" (safe_ptr), "=&r" (tmp)
++ : "r" (size), "r" (current_thread_info()->addr_limit)
++ : "cc");
++
++ csdb();
++ return safe_ptr;
++}
++
+ /*
+ * Single-value transfer routines. They automatically use the right
+ * size if we just have the right pointer type. Note that the functions
+@@ -362,6 +396,14 @@ do { \
+ __pu_err; \
+ })
+
++#ifdef CONFIG_CPU_SPECTRE
++/*
++ * When mitigating Spectre variant 1.1, all accessors need to include
++ * verification of the address space.
++ */
++#define __put_user(x, ptr) put_user(x, ptr)
++
++#else
+ #define __put_user(x, ptr) \
+ ({ \
+ long __pu_err = 0; \
+@@ -369,12 +411,6 @@ do { \
+ __pu_err; \
+ })
+
+-#define __put_user_error(x, ptr, err) \
+-({ \
+- __put_user_switch((x), (ptr), (err), __put_user_nocheck); \
+- (void) 0; \
+-})
+-
+ #define __put_user_nocheck(x, __pu_ptr, __err, __size) \
+ do { \
+ unsigned long __pu_addr = (unsigned long)__pu_ptr; \
+@@ -454,6 +490,7 @@ do { \
+ : "r" (x), "i" (-EFAULT) \
+ : "cc")
+
++#endif /* !CONFIG_CPU_SPECTRE */
+
+ #ifdef CONFIG_MMU
+ extern unsigned long __must_check
+diff --git a/arch/arm/kernel/bugs.c b/arch/arm/kernel/bugs.c
+index 7be511310191..d41d3598e5e5 100644
+--- a/arch/arm/kernel/bugs.c
++++ b/arch/arm/kernel/bugs.c
+@@ -6,8 +6,8 @@
+ void check_other_bugs(void)
+ {
+ #ifdef MULTI_CPU
+- if (processor.check_bugs)
+- processor.check_bugs();
++ if (cpu_check_bugs)
++ cpu_check_bugs();
+ #endif
+ }
+
+diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S
+index 6e0375e7db05..997b02302c31 100644
+--- a/arch/arm/kernel/head-common.S
++++ b/arch/arm/kernel/head-common.S
+@@ -145,6 +145,9 @@ __mmap_switched_data:
+ #endif
+ .size __mmap_switched_data, . - __mmap_switched_data
+
++ __FINIT
++ .text
++
+ /*
+ * This provides a C-API version of __lookup_processor_type
+ */
+@@ -156,9 +159,6 @@ ENTRY(lookup_processor_type)
+ ldmfd sp!, {r4 - r6, r9, pc}
+ ENDPROC(lookup_processor_type)
+
+- __FINIT
+- .text
+-
+ /*
+ * Read processor ID register (CP#15, CR0), and look up in the linker-built
+ * supported processor list. Note that we can't use the absolute addresses
+diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
+index 4c249cb261f3..7bbaa293a38c 100644
+--- a/arch/arm/kernel/setup.c
++++ b/arch/arm/kernel/setup.c
+@@ -115,6 +115,11 @@ EXPORT_SYMBOL(elf_hwcap2);
+
+ #ifdef MULTI_CPU
+ struct processor processor __ro_after_init;
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++struct processor *cpu_vtable[NR_CPUS] = {
++ [0] = &processor,
++};
++#endif
+ #endif
+ #ifdef MULTI_TLB
+ struct cpu_tlb_fns cpu_tlb __ro_after_init;
+@@ -667,28 +672,33 @@ static void __init smp_build_mpidr_hash(void)
+ }
+ #endif
+
+-static void __init setup_processor(void)
++/*
++ * locate processor in the list of supported processor types. The linker
++ * builds this table for us from the entries in arch/arm/mm/proc-*.S
++ */
++struct proc_info_list *lookup_processor(u32 midr)
+ {
+- struct proc_info_list *list;
++ struct proc_info_list *list = lookup_processor_type(midr);
+
+- /*
+- * locate processor in the list of supported processor
+- * types. The linker builds this table for us from the
+- * entries in arch/arm/mm/proc-*.S
+- */
+- list = lookup_processor_type(read_cpuid_id());
+ if (!list) {
+- pr_err("CPU configuration botched (ID %08x), unable to continue.\n",
+- read_cpuid_id());
+- while (1);
++ pr_err("CPU%u: configuration botched (ID %08x), CPU halted\n",
++ smp_processor_id(), midr);
++ while (1)
++ /* can't use cpu_relax() here as it may require MMU setup */;
+ }
+
++ return list;
++}
++
++static void __init setup_processor(void)
++{
++ unsigned int midr = read_cpuid_id();
++ struct proc_info_list *list = lookup_processor(midr);
++
+ cpu_name = list->cpu_name;
+ __cpu_architecture = __get_cpu_architecture();
+
+-#ifdef MULTI_CPU
+- processor = *list->proc;
+-#endif
++ init_proc_vtable(list->proc);
+ #ifdef MULTI_TLB
+ cpu_tlb = *list->tlb;
+ #endif
+@@ -700,7 +710,7 @@ static void __init setup_processor(void)
+ #endif
+
+ pr_info("CPU: %s [%08x] revision %d (ARMv%s), cr=%08lx\n",
+- cpu_name, read_cpuid_id(), read_cpuid_id() & 15,
++ list->cpu_name, midr, midr & 15,
+ proc_arch[cpu_architecture()], get_cr());
+
+ snprintf(init_utsname()->machine, __NEW_UTS_LEN + 1, "%s%c",
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index b8f766cf3a90..b908382b69ff 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -77,8 +77,6 @@ static int preserve_iwmmxt_context(struct iwmmxt_sigframe __user *frame)
+ kframe->magic = IWMMXT_MAGIC;
+ kframe->size = IWMMXT_STORAGE_SIZE;
+ iwmmxt_task_copy(current_thread_info(), &kframe->storage);
+-
+- err = __copy_to_user(frame, kframe, sizeof(*frame));
+ } else {
+ /*
+ * For bug-compatibility with older kernels, some space
+@@ -86,10 +84,14 @@ static int preserve_iwmmxt_context(struct iwmmxt_sigframe __user *frame)
+ * Set the magic and size appropriately so that properly
+ * written userspace can skip it reliably:
+ */
+- __put_user_error(DUMMY_MAGIC, &frame->magic, err);
+- __put_user_error(IWMMXT_STORAGE_SIZE, &frame->size, err);
++ *kframe = (struct iwmmxt_sigframe) {
++ .magic = DUMMY_MAGIC,
++ .size = IWMMXT_STORAGE_SIZE,
++ };
+ }
+
++ err = __copy_to_user(frame, kframe, sizeof(*kframe));
++
+ return err;
+ }
+
+@@ -135,17 +137,18 @@ static int restore_iwmmxt_context(char __user **auxp)
+
+ static int preserve_vfp_context(struct vfp_sigframe __user *frame)
+ {
+- const unsigned long magic = VFP_MAGIC;
+- const unsigned long size = VFP_STORAGE_SIZE;
++ struct vfp_sigframe kframe;
+ int err = 0;
+
+- __put_user_error(magic, &frame->magic, err);
+- __put_user_error(size, &frame->size, err);
++ memset(&kframe, 0, sizeof(kframe));
++ kframe.magic = VFP_MAGIC;
++ kframe.size = VFP_STORAGE_SIZE;
+
++ err = vfp_preserve_user_clear_hwstate(&kframe.ufp, &kframe.ufp_exc);
+ if (err)
+- return -EFAULT;
++ return err;
+
+- return vfp_preserve_user_clear_hwstate(&frame->ufp, &frame->ufp_exc);
++ return __copy_to_user(frame, &kframe, sizeof(kframe));
+ }
+
+ static int restore_vfp_context(char __user **auxp)
+@@ -288,30 +291,35 @@ static int
+ setup_sigframe(struct sigframe __user *sf, struct pt_regs *regs, sigset_t *set)
+ {
+ struct aux_sigframe __user *aux;
++ struct sigcontext context;
+ int err = 0;
+
+- __put_user_error(regs->ARM_r0, &sf->uc.uc_mcontext.arm_r0, err);
+- __put_user_error(regs->ARM_r1, &sf->uc.uc_mcontext.arm_r1, err);
+- __put_user_error(regs->ARM_r2, &sf->uc.uc_mcontext.arm_r2, err);
+- __put_user_error(regs->ARM_r3, &sf->uc.uc_mcontext.arm_r3, err);
+- __put_user_error(regs->ARM_r4, &sf->uc.uc_mcontext.arm_r4, err);
+- __put_user_error(regs->ARM_r5, &sf->uc.uc_mcontext.arm_r5, err);
+- __put_user_error(regs->ARM_r6, &sf->uc.uc_mcontext.arm_r6, err);
+- __put_user_error(regs->ARM_r7, &sf->uc.uc_mcontext.arm_r7, err);
+- __put_user_error(regs->ARM_r8, &sf->uc.uc_mcontext.arm_r8, err);
+- __put_user_error(regs->ARM_r9, &sf->uc.uc_mcontext.arm_r9, err);
+- __put_user_error(regs->ARM_r10, &sf->uc.uc_mcontext.arm_r10, err);
+- __put_user_error(regs->ARM_fp, &sf->uc.uc_mcontext.arm_fp, err);
+- __put_user_error(regs->ARM_ip, &sf->uc.uc_mcontext.arm_ip, err);
+- __put_user_error(regs->ARM_sp, &sf->uc.uc_mcontext.arm_sp, err);
+- __put_user_error(regs->ARM_lr, &sf->uc.uc_mcontext.arm_lr, err);
+- __put_user_error(regs->ARM_pc, &sf->uc.uc_mcontext.arm_pc, err);
+- __put_user_error(regs->ARM_cpsr, &sf->uc.uc_mcontext.arm_cpsr, err);
+-
+- __put_user_error(current->thread.trap_no, &sf->uc.uc_mcontext.trap_no, err);
+- __put_user_error(current->thread.error_code, &sf->uc.uc_mcontext.error_code, err);
+- __put_user_error(current->thread.address, &sf->uc.uc_mcontext.fault_address, err);
+- __put_user_error(set->sig[0], &sf->uc.uc_mcontext.oldmask, err);
++ context = (struct sigcontext) {
++ .arm_r0 = regs->ARM_r0,
++ .arm_r1 = regs->ARM_r1,
++ .arm_r2 = regs->ARM_r2,
++ .arm_r3 = regs->ARM_r3,
++ .arm_r4 = regs->ARM_r4,
++ .arm_r5 = regs->ARM_r5,
++ .arm_r6 = regs->ARM_r6,
++ .arm_r7 = regs->ARM_r7,
++ .arm_r8 = regs->ARM_r8,
++ .arm_r9 = regs->ARM_r9,
++ .arm_r10 = regs->ARM_r10,
++ .arm_fp = regs->ARM_fp,
++ .arm_ip = regs->ARM_ip,
++ .arm_sp = regs->ARM_sp,
++ .arm_lr = regs->ARM_lr,
++ .arm_pc = regs->ARM_pc,
++ .arm_cpsr = regs->ARM_cpsr,
++
++ .trap_no = current->thread.trap_no,
++ .error_code = current->thread.error_code,
++ .fault_address = current->thread.address,
++ .oldmask = set->sig[0],
++ };
++
++ err |= __copy_to_user(&sf->uc.uc_mcontext, &context, sizeof(context));
+
+ err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(*set));
+
+@@ -328,7 +336,7 @@ setup_sigframe(struct sigframe __user *sf, struct pt_regs *regs, sigset_t *set)
+ if (err == 0)
+ err |= preserve_vfp_context(&aux->vfp);
+ #endif
+- __put_user_error(0, &aux->end_magic, err);
++ err |= __put_user(0, &aux->end_magic);
+
+ return err;
+ }
+@@ -491,7 +499,7 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs)
+ /*
+ * Set uc.uc_flags to a value which sc.trap_no would never have.
+ */
+- __put_user_error(0x5ac3c35a, &frame->uc.uc_flags, err);
++ err = __put_user(0x5ac3c35a, &frame->uc.uc_flags);
+
+ err |= setup_sigframe(frame, regs, set);
+ if (err == 0)
+@@ -511,8 +519,8 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs)
+
+ err |= copy_siginfo_to_user(&frame->info, &ksig->info);
+
+- __put_user_error(0, &frame->sig.uc.uc_flags, err);
+- __put_user_error(NULL, &frame->sig.uc.uc_link, err);
++ err |= __put_user(0, &frame->sig.uc.uc_flags);
++ err |= __put_user(NULL, &frame->sig.uc.uc_link);
+
+ err |= __save_altstack(&frame->sig.uc.uc_stack, regs->ARM_sp);
+ err |= setup_sigframe(&frame->sig, regs, set);
+diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
+index f574a5e0d589..3bf82232b1be 100644
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -42,6 +42,7 @@
+ #include <asm/mmu_context.h>
+ #include <asm/pgtable.h>
+ #include <asm/pgalloc.h>
++#include <asm/procinfo.h>
+ #include <asm/processor.h>
+ #include <asm/sections.h>
+ #include <asm/tlbflush.h>
+@@ -102,6 +103,30 @@ static unsigned long get_arch_pgd(pgd_t *pgd)
+ #endif
+ }
+
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++static int secondary_biglittle_prepare(unsigned int cpu)
++{
++ if (!cpu_vtable[cpu])
++ cpu_vtable[cpu] = kzalloc(sizeof(*cpu_vtable[cpu]), GFP_KERNEL);
++
++ return cpu_vtable[cpu] ? 0 : -ENOMEM;
++}
++
++static void secondary_biglittle_init(void)
++{
++ init_proc_vtable(lookup_processor(read_cpuid_id())->proc);
++}
++#else
++static int secondary_biglittle_prepare(unsigned int cpu)
++{
++ return 0;
++}
++
++static void secondary_biglittle_init(void)
++{
++}
++#endif
++
+ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ {
+ int ret;
+@@ -109,6 +134,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ if (!smp_ops.smp_boot_secondary)
+ return -ENOSYS;
+
++ ret = secondary_biglittle_prepare(cpu);
++ if (ret)
++ return ret;
++
+ /*
+ * We need to tell the secondary core where to find
+ * its stack and the page tables.
+@@ -359,6 +388,8 @@ asmlinkage void secondary_start_kernel(void)
+ struct mm_struct *mm = &init_mm;
+ unsigned int cpu;
+
++ secondary_biglittle_init();
++
+ /*
+ * The identity mapping is uncached (strongly ordered), so
+ * switch away from it before attempting any exclusive accesses.
+diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
+index f0dd4b6ebb63..40da0872170f 100644
+--- a/arch/arm/kernel/sys_oabi-compat.c
++++ b/arch/arm/kernel/sys_oabi-compat.c
+@@ -277,6 +277,7 @@ asmlinkage long sys_oabi_epoll_wait(int epfd,
+ int maxevents, int timeout)
+ {
+ struct epoll_event *kbuf;
++ struct oabi_epoll_event e;
+ mm_segment_t fs;
+ long ret, err, i;
+
+@@ -295,8 +296,11 @@ asmlinkage long sys_oabi_epoll_wait(int epfd,
+ set_fs(fs);
+ err = 0;
+ for (i = 0; i < ret; i++) {
+- __put_user_error(kbuf[i].events, &events->events, err);
+- __put_user_error(kbuf[i].data, &events->data, err);
++ e.events = kbuf[i].events;
++ e.data = kbuf[i].data;
++ err = __copy_to_user(events, &e, sizeof(e));
++ if (err)
++ break;
+ events++;
+ }
+ kfree(kbuf);
+diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
+index a826df3d3814..6709a8d33963 100644
+--- a/arch/arm/lib/copy_from_user.S
++++ b/arch/arm/lib/copy_from_user.S
+@@ -93,11 +93,7 @@ ENTRY(arm_copy_from_user)
+ #ifdef CONFIG_CPU_SPECTRE
+ get_thread_info r3
+ ldr r3, [r3, #TI_ADDR_LIMIT]
+- adds ip, r1, r2 @ ip=addr+size
+- sub r3, r3, #1 @ addr_limit - 1
+- cmpcc ip, r3 @ if (addr+size > addr_limit - 1)
+- movcs r1, #0 @ addr = NULL
+- csdb
++ uaccess_mask_range_ptr r1, r2, r3, ip
+ #endif
+
+ #include "copy_template.S"
+diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
+index caf5019d8161..970abe521197 100644
+--- a/arch/arm/lib/copy_to_user.S
++++ b/arch/arm/lib/copy_to_user.S
+@@ -94,6 +94,11 @@
+
+ ENTRY(__copy_to_user_std)
+ WEAK(arm_copy_to_user)
++#ifdef CONFIG_CPU_SPECTRE
++ get_thread_info r3
++ ldr r3, [r3, #TI_ADDR_LIMIT]
++ uaccess_mask_range_ptr r0, r2, r3, ip
++#endif
+
+ #include "copy_template.S"
+
+@@ -108,4 +113,3 @@ ENDPROC(__copy_to_user_std)
+ rsb r0, r0, r2
+ copy_abort_end
+ .popsection
+-
+diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
+index 9b4ed1728616..73dc7360cbdd 100644
+--- a/arch/arm/lib/uaccess_with_memcpy.c
++++ b/arch/arm/lib/uaccess_with_memcpy.c
+@@ -152,7 +152,8 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
+ n = __copy_to_user_std(to, from, n);
+ uaccess_restore(ua_flags);
+ } else {
+- n = __copy_to_user_memcpy(to, from, n);
++ n = __copy_to_user_memcpy(uaccess_mask_range_ptr(to, n),
++ from, n);
+ }
+ return n;
+ }
+diff --git a/arch/arm/mach-integrator/impd1.c b/arch/arm/mach-integrator/impd1.c
+index a109f6482413..0f916c245a2e 100644
+--- a/arch/arm/mach-integrator/impd1.c
++++ b/arch/arm/mach-integrator/impd1.c
+@@ -393,7 +393,11 @@ static int __ref impd1_probe(struct lm_device *dev)
+ sizeof(*lookup) + 3 * sizeof(struct gpiod_lookup),
+ GFP_KERNEL);
+ chipname = devm_kstrdup(&dev->dev, devname, GFP_KERNEL);
+- mmciname = kasprintf(GFP_KERNEL, "lm%x:00700", dev->id);
++ mmciname = devm_kasprintf(&dev->dev, GFP_KERNEL,
++ "lm%x:00700", dev->id);
++ if (!lookup || !chipname || !mmciname)
++ return -ENOMEM;
++
+ lookup->dev_id = mmciname;
+ /*
+ * Offsets on GPIO block 1:
+diff --git a/arch/arm/mach-omap2/omap-wakeupgen.c b/arch/arm/mach-omap2/omap-wakeupgen.c
+index fc5fb776a710..17558be4bf0a 100644
+--- a/arch/arm/mach-omap2/omap-wakeupgen.c
++++ b/arch/arm/mach-omap2/omap-wakeupgen.c
+@@ -50,6 +50,9 @@
+ #define OMAP4_NR_BANKS 4
+ #define OMAP4_NR_IRQS 128
+
++#define SYS_NIRQ1_EXT_SYS_IRQ_1 7
++#define SYS_NIRQ2_EXT_SYS_IRQ_2 119
++
+ static void __iomem *wakeupgen_base;
+ static void __iomem *sar_base;
+ static DEFINE_RAW_SPINLOCK(wakeupgen_lock);
+@@ -153,6 +156,37 @@ static void wakeupgen_unmask(struct irq_data *d)
+ irq_chip_unmask_parent(d);
+ }
+
++/*
++ * The sys_nirq pins bypass peripheral modules and are wired directly
++ * to MPUSS wakeupgen. They get automatically inverted for GIC.
++ */
++static int wakeupgen_irq_set_type(struct irq_data *d, unsigned int type)
++{
++ bool inverted = false;
++
++ switch (type) {
++ case IRQ_TYPE_LEVEL_LOW:
++ type &= ~IRQ_TYPE_LEVEL_MASK;
++ type |= IRQ_TYPE_LEVEL_HIGH;
++ inverted = true;
++ break;
++ case IRQ_TYPE_EDGE_FALLING:
++ type &= ~IRQ_TYPE_EDGE_BOTH;
++ type |= IRQ_TYPE_EDGE_RISING;
++ inverted = true;
++ break;
++ default:
++ break;
++ }
++
++ if (inverted && d->hwirq != SYS_NIRQ1_EXT_SYS_IRQ_1 &&
++ d->hwirq != SYS_NIRQ2_EXT_SYS_IRQ_2)
++ pr_warn("wakeupgen: irq%li polarity inverted in dts\n",
++ d->hwirq);
++
++ return irq_chip_set_type_parent(d, type);
++}
++
+ #ifdef CONFIG_HOTPLUG_CPU
+ static DEFINE_PER_CPU(u32 [MAX_NR_REG_BANKS], irqmasks);
+
+@@ -446,7 +480,7 @@ static struct irq_chip wakeupgen_chip = {
+ .irq_mask = wakeupgen_mask,
+ .irq_unmask = wakeupgen_unmask,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
+- .irq_set_type = irq_chip_set_type_parent,
++ .irq_set_type = wakeupgen_irq_set_type,
+ .flags = IRQCHIP_SKIP_SET_WAKE | IRQCHIP_MASK_ON_SUSPEND,
+ #ifdef CONFIG_SMP
+ .irq_set_affinity = irq_chip_set_affinity_parent,
+diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
+index 81d0efb055c6..5461d589a1e2 100644
+--- a/arch/arm/mm/proc-macros.S
++++ b/arch/arm/mm/proc-macros.S
+@@ -274,6 +274,13 @@
+ .endm
+
+ .macro define_processor_functions name:req, dabort:req, pabort:req, nommu=0, suspend=0, bugs=0
++/*
++ * If we are building for big.Little with branch predictor hardening,
++ * we need the processor function tables to remain available after boot.
++ */
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++ .section ".rodata"
++#endif
+ .type \name\()_processor_functions, #object
+ .align 2
+ ENTRY(\name\()_processor_functions)
+@@ -309,6 +316,9 @@ ENTRY(\name\()_processor_functions)
+ .endif
+
+ .size \name\()_processor_functions, . - \name\()_processor_functions
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++ .previous
++#endif
+ .endm
+
+ .macro define_cache_functions name:req
+diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c
+index 5544b82a2e7a..9a07916af8dd 100644
+--- a/arch/arm/mm/proc-v7-bugs.c
++++ b/arch/arm/mm/proc-v7-bugs.c
+@@ -52,8 +52,6 @@ static void cpu_v7_spectre_init(void)
+ case ARM_CPU_PART_CORTEX_A17:
+ case ARM_CPU_PART_CORTEX_A73:
+ case ARM_CPU_PART_CORTEX_A75:
+- if (processor.switch_mm != cpu_v7_bpiall_switch_mm)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ harden_branch_predictor_bpiall;
+ spectre_v2_method = "BPIALL";
+@@ -61,8 +59,6 @@ static void cpu_v7_spectre_init(void)
+
+ case ARM_CPU_PART_CORTEX_A15:
+ case ARM_CPU_PART_BRAHMA_B15:
+- if (processor.switch_mm != cpu_v7_iciallu_switch_mm)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ harden_branch_predictor_iciallu;
+ spectre_v2_method = "ICIALLU";
+@@ -88,11 +84,9 @@ static void cpu_v7_spectre_init(void)
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+ if ((int)res.a0 != 0)
+ break;
+- if (processor.switch_mm != cpu_v7_hvc_switch_mm && cpu)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ call_hvc_arch_workaround_1;
+- processor.switch_mm = cpu_v7_hvc_switch_mm;
++ cpu_do_switch_mm = cpu_v7_hvc_switch_mm;
+ spectre_v2_method = "hypervisor";
+ break;
+
+@@ -101,11 +95,9 @@ static void cpu_v7_spectre_init(void)
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+ if ((int)res.a0 != 0)
+ break;
+- if (processor.switch_mm != cpu_v7_smc_switch_mm && cpu)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ call_smc_arch_workaround_1;
+- processor.switch_mm = cpu_v7_smc_switch_mm;
++ cpu_do_switch_mm = cpu_v7_smc_switch_mm;
+ spectre_v2_method = "firmware";
+ break;
+
+@@ -119,11 +111,6 @@ static void cpu_v7_spectre_init(void)
+ if (spectre_v2_method)
+ pr_info("CPU%u: Spectre v2: using %s workaround\n",
+ smp_processor_id(), spectre_v2_method);
+- return;
+-
+-bl_error:
+- pr_err("CPU%u: Spectre v2: incorrect context switching function, system vulnerable\n",
+- cpu);
+ }
+ #else
+ static void cpu_v7_spectre_init(void)
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index dc7e6b50ef67..66c5e693428a 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -553,12 +553,11 @@ void vfp_flush_hwstate(struct thread_info *thread)
+ * Save the current VFP state into the provided structures and prepare
+ * for entry into a new function (signal handler).
+ */
+-int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp,
+- struct user_vfp_exc __user *ufp_exc)
++int vfp_preserve_user_clear_hwstate(struct user_vfp *ufp,
++ struct user_vfp_exc *ufp_exc)
+ {
+ struct thread_info *thread = current_thread_info();
+ struct vfp_hard_struct *hwstate = &thread->vfpstate.hard;
+- int err = 0;
+
+ /* Ensure that the saved hwstate is up-to-date. */
+ vfp_sync_hwstate(thread);
+@@ -567,22 +566,19 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp,
+ * Copy the floating point registers. There can be unused
+ * registers see asm/hwcap.h for details.
+ */
+- err |= __copy_to_user(&ufp->fpregs, &hwstate->fpregs,
+- sizeof(hwstate->fpregs));
++ memcpy(&ufp->fpregs, &hwstate->fpregs, sizeof(hwstate->fpregs));
++
+ /*
+ * Copy the status and control register.
+ */
+- __put_user_error(hwstate->fpscr, &ufp->fpscr, err);
++ ufp->fpscr = hwstate->fpscr;
+
+ /*
+ * Copy the exception registers.
+ */
+- __put_user_error(hwstate->fpexc, &ufp_exc->fpexc, err);
+- __put_user_error(hwstate->fpinst, &ufp_exc->fpinst, err);
+- __put_user_error(hwstate->fpinst2, &ufp_exc->fpinst2, err);
+-
+- if (err)
+- return -EFAULT;
++ ufp_exc->fpexc = hwstate->fpexc;
++ ufp_exc->fpinst = hwstate->fpinst;
++ ufp_exc->fpinst2 = hwstate->fpinst2;
+
+ /* Ensure that VFP is disabled. */
+ vfp_flush_hwstate(thread);
+diff --git a/arch/riscv/include/asm/pgtable-bits.h b/arch/riscv/include/asm/pgtable-bits.h
+index 2fa2942be221..470755cb7558 100644
+--- a/arch/riscv/include/asm/pgtable-bits.h
++++ b/arch/riscv/include/asm/pgtable-bits.h
+@@ -35,6 +35,12 @@
+ #define _PAGE_SPECIAL _PAGE_SOFT
+ #define _PAGE_TABLE _PAGE_PRESENT
+
++/*
++ * _PAGE_PROT_NONE is set on not-present pages (and ignored by the hardware) to
++ * distinguish them from swapped out pages
++ */
++#define _PAGE_PROT_NONE _PAGE_READ
++
+ #define _PAGE_PFN_SHIFT 10
+
+ /* Set of bits to preserve across pte_modify() */
+diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
+index 16301966d65b..a8179a8c1491 100644
+--- a/arch/riscv/include/asm/pgtable.h
++++ b/arch/riscv/include/asm/pgtable.h
+@@ -44,7 +44,7 @@
+ /* Page protection bits */
+ #define _PAGE_BASE (_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_USER)
+
+-#define PAGE_NONE __pgprot(0)
++#define PAGE_NONE __pgprot(_PAGE_PROT_NONE)
+ #define PAGE_READ __pgprot(_PAGE_BASE | _PAGE_READ)
+ #define PAGE_WRITE __pgprot(_PAGE_BASE | _PAGE_READ | _PAGE_WRITE)
+ #define PAGE_EXEC __pgprot(_PAGE_BASE | _PAGE_EXEC)
+@@ -98,7 +98,7 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+
+ static inline int pmd_present(pmd_t pmd)
+ {
+- return (pmd_val(pmd) & _PAGE_PRESENT);
++ return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE));
+ }
+
+ static inline int pmd_none(pmd_t pmd)
+@@ -178,7 +178,7 @@ static inline pte_t *pte_offset_kernel(pmd_t *pmd, unsigned long addr)
+
+ static inline int pte_present(pte_t pte)
+ {
+- return (pte_val(pte) & _PAGE_PRESENT);
++ return (pte_val(pte) & (_PAGE_PRESENT | _PAGE_PROT_NONE));
+ }
+
+ static inline int pte_none(pte_t pte)
+@@ -380,7 +380,7 @@ static inline int ptep_clear_flush_young(struct vm_area_struct *vma,
+ *
+ * Format of swap PTE:
+ * bit 0: _PAGE_PRESENT (zero)
+- * bit 1: reserved for future use (zero)
++ * bit 1: _PAGE_PROT_NONE (zero)
+ * bits 2 to 6: swap type
+ * bits 7 to XLEN-1: swap offset
+ */
+diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c
+index 9f82a7e34c64..9db7d0076375 100644
+--- a/arch/riscv/kernel/ptrace.c
++++ b/arch/riscv/kernel/ptrace.c
+@@ -120,6 +120,6 @@ void do_syscall_trace_exit(struct pt_regs *regs)
+
+ #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
+ if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
+- trace_sys_exit(regs, regs->regs[0]);
++ trace_sys_exit(regs, regs_return_value(regs));
+ #endif
+ }
+diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
+index c8d08da5b308..c04a8813cff9 100644
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -2253,6 +2253,19 @@ void perf_check_microcode(void)
+ x86_pmu.check_microcode();
+ }
+
++static int x86_pmu_check_period(struct perf_event *event, u64 value)
++{
++ if (x86_pmu.check_period && x86_pmu.check_period(event, value))
++ return -EINVAL;
++
++ if (value && x86_pmu.limit_period) {
++ if (x86_pmu.limit_period(event, value) > value)
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ static struct pmu pmu = {
+ .pmu_enable = x86_pmu_enable,
+ .pmu_disable = x86_pmu_disable,
+@@ -2277,6 +2290,7 @@ static struct pmu pmu = {
+ .event_idx = x86_pmu_event_idx,
+ .sched_task = x86_pmu_sched_task,
+ .task_ctx_size = sizeof(struct x86_perf_task_context),
++ .check_period = x86_pmu_check_period,
+ };
+
+ void arch_perf_update_userpage(struct perf_event *event,
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index d0b186264941..fbd7551a8d44 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3465,6 +3465,11 @@ static void intel_pmu_sched_task(struct perf_event_context *ctx,
+ intel_pmu_lbr_sched_task(ctx, sched_in);
+ }
+
++static int intel_pmu_check_period(struct perf_event *event, u64 value)
++{
++ return intel_pmu_has_bts_period(event, value) ? -EINVAL : 0;
++}
++
+ PMU_FORMAT_ATTR(offcore_rsp, "config1:0-63");
+
+ PMU_FORMAT_ATTR(ldlat, "config1:0-15");
+@@ -3545,6 +3550,8 @@ static __initconst const struct x86_pmu core_pmu = {
+ .cpu_starting = intel_pmu_cpu_starting,
+ .cpu_dying = intel_pmu_cpu_dying,
+ .cpu_dead = intel_pmu_cpu_dead,
++
++ .check_period = intel_pmu_check_period,
+ };
+
+ static struct attribute *intel_pmu_attrs[];
+@@ -3589,6 +3596,8 @@ static __initconst const struct x86_pmu intel_pmu = {
+
+ .guest_get_msrs = intel_guest_get_msrs,
+ .sched_task = intel_pmu_sched_task,
++
++ .check_period = intel_pmu_check_period,
+ };
+
+ static __init void intel_clovertown_quirk(void)
+diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
+index c5ad9cc61f4b..0ee3a441ad79 100644
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -644,6 +644,11 @@ struct x86_pmu {
+ * Intel host/guest support (KVM)
+ */
+ struct perf_guest_switch_msr *(*guest_get_msrs)(int *nr);
++
++ /*
++ * Check period value for PERF_EVENT_IOC_PERIOD ioctl.
++ */
++ int (*check_period) (struct perf_event *event, u64 period);
+ };
+
+ struct x86_perf_task_context {
+@@ -855,7 +860,7 @@ static inline int amd_pmu_init(void)
+
+ #ifdef CONFIG_CPU_SUP_INTEL
+
+-static inline bool intel_pmu_has_bts(struct perf_event *event)
++static inline bool intel_pmu_has_bts_period(struct perf_event *event, u64 period)
+ {
+ struct hw_perf_event *hwc = &event->hw;
+ unsigned int hw_event, bts_event;
+@@ -866,7 +871,14 @@ static inline bool intel_pmu_has_bts(struct perf_event *event)
+ hw_event = hwc->config & INTEL_ARCH_EVENT_MASK;
+ bts_event = x86_pmu.event_map(PERF_COUNT_HW_BRANCH_INSTRUCTIONS);
+
+- return hw_event == bts_event && hwc->sample_period == 1;
++ return hw_event == bts_event && period == 1;
++}
++
++static inline bool intel_pmu_has_bts(struct perf_event *event)
++{
++ struct hw_perf_event *hwc = &event->hw;
++
++ return intel_pmu_has_bts_period(event, hwc->sample_period);
+ }
+
+ int intel_pmu_save_and_restart(struct perf_event *event);
+diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
+index 8e02b30cf08e..3ebd77770f98 100644
+--- a/arch/x86/ia32/ia32_aout.c
++++ b/arch/x86/ia32/ia32_aout.c
+@@ -51,7 +51,7 @@ static unsigned long get_dr(int n)
+ /*
+ * fill in the user structure for a core dump..
+ */
+-static void dump_thread32(struct pt_regs *regs, struct user32 *dump)
++static void fill_dump(struct pt_regs *regs, struct user32 *dump)
+ {
+ u32 fs, gs;
+ memset(dump, 0, sizeof(*dump));
+@@ -157,10 +157,12 @@ static int aout_core_dump(struct coredump_params *cprm)
+ fs = get_fs();
+ set_fs(KERNEL_DS);
+ has_dumped = 1;
++
++ fill_dump(cprm->regs, &dump);
++
+ strncpy(dump.u_comm, current->comm, sizeof(current->comm));
+ dump.u_ar0 = offsetof(struct user32, regs);
+ dump.signal = cprm->siginfo->si_signo;
+- dump_thread32(cprm->regs, &dump);
+
+ /*
+ * If the size of the dump file exceeds the rlimit, then see
+diff --git a/arch/x86/include/asm/uv/bios.h b/arch/x86/include/asm/uv/bios.h
+index e652a7cc6186..3f697a9e3f59 100644
+--- a/arch/x86/include/asm/uv/bios.h
++++ b/arch/x86/include/asm/uv/bios.h
+@@ -48,7 +48,8 @@ enum {
+ BIOS_STATUS_SUCCESS = 0,
+ BIOS_STATUS_UNIMPLEMENTED = -ENOSYS,
+ BIOS_STATUS_EINVAL = -EINVAL,
+- BIOS_STATUS_UNAVAIL = -EBUSY
++ BIOS_STATUS_UNAVAIL = -EBUSY,
++ BIOS_STATUS_ABORT = -EINTR,
+ };
+
+ /* Address map parameters */
+@@ -167,4 +168,9 @@ extern long system_serial_number;
+
+ extern struct kobject *sgi_uv_kobj; /* /sys/firmware/sgi_uv */
+
++/*
++ * EFI runtime lock; cf. firmware/efi/runtime-wrappers.c for details
++ */
++extern struct semaphore __efi_uv_runtime_lock;
++
+ #endif /* _ASM_X86_UV_BIOS_H */
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 02ac8fa0cd6d..ee8f8d70b98a 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -6256,6 +6256,9 @@ static int sev_guest_init(struct kvm *kvm, struct kvm_sev_cmd *argp)
+ int asid, ret;
+
+ ret = -EBUSY;
++ if (unlikely(sev->active))
++ return ret;
++
+ asid = sev_asid_new();
+ if (asid < 0)
+ return ret;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 0b2e13dd517b..f6da5c37d2e8 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2757,7 +2757,8 @@ static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
+ if (!entry_only)
+ j = find_msr(&m->host, msr);
+
+- if (i == NR_AUTOLOAD_MSRS || j == NR_AUTOLOAD_MSRS) {
++ if ((i < 0 && m->guest.nr == NR_AUTOLOAD_MSRS) ||
++ (j < 0 && m->host.nr == NR_AUTOLOAD_MSRS)) {
+ printk_once(KERN_WARNING "Not enough msr switch entries. "
+ "Can't add msr %x\n", msr);
+ return;
+@@ -3601,9 +3602,11 @@ static void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, bool apicv)
+ * secondary cpu-based controls. Do not include those that
+ * depend on CPUID bits, they are added later by vmx_cpuid_update.
+ */
+- rdmsr(MSR_IA32_VMX_PROCBASED_CTLS2,
+- msrs->secondary_ctls_low,
+- msrs->secondary_ctls_high);
++ if (msrs->procbased_ctls_high & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS)
++ rdmsr(MSR_IA32_VMX_PROCBASED_CTLS2,
++ msrs->secondary_ctls_low,
++ msrs->secondary_ctls_high);
++
+ msrs->secondary_ctls_low = 0;
+ msrs->secondary_ctls_high &=
+ SECONDARY_EXEC_DESC |
+diff --git a/arch/x86/platform/uv/bios_uv.c b/arch/x86/platform/uv/bios_uv.c
+index 4a6a5a26c582..eb33432f2f24 100644
+--- a/arch/x86/platform/uv/bios_uv.c
++++ b/arch/x86/platform/uv/bios_uv.c
+@@ -29,7 +29,8 @@
+
+ struct uv_systab *uv_systab;
+
+-s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5)
++static s64 __uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3,
++ u64 a4, u64 a5)
+ {
+ struct uv_systab *tab = uv_systab;
+ s64 ret;
+@@ -51,6 +52,19 @@ s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5)
+
+ return ret;
+ }
++
++s64 uv_bios_call(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3, u64 a4, u64 a5)
++{
++ s64 ret;
++
++ if (down_interruptible(&__efi_uv_runtime_lock))
++ return BIOS_STATUS_ABORT;
++
++ ret = __uv_bios_call(which, a1, a2, a3, a4, a5);
++ up(&__efi_uv_runtime_lock);
++
++ return ret;
++}
+ EXPORT_SYMBOL_GPL(uv_bios_call);
+
+ s64 uv_bios_call_irqsave(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3,
+@@ -59,10 +73,15 @@ s64 uv_bios_call_irqsave(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3,
+ unsigned long bios_flags;
+ s64 ret;
+
++ if (down_interruptible(&__efi_uv_runtime_lock))
++ return BIOS_STATUS_ABORT;
++
+ local_irq_save(bios_flags);
+- ret = uv_bios_call(which, a1, a2, a3, a4, a5);
++ ret = __uv_bios_call(which, a1, a2, a3, a4, a5);
+ local_irq_restore(bios_flags);
+
++ up(&__efi_uv_runtime_lock);
++
+ return ret;
+ }
+
+diff --git a/block/blk-flush.c b/block/blk-flush.c
+index ce41f666de3e..76487948a27f 100644
+--- a/block/blk-flush.c
++++ b/block/blk-flush.c
+@@ -424,7 +424,7 @@ static void mq_flush_data_end_io(struct request *rq, blk_status_t error)
+ blk_flush_complete_seq(rq, fq, REQ_FSEQ_DATA, error);
+ spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
+
+- blk_mq_run_hw_queue(hctx, true);
++ blk_mq_sched_restart(hctx);
+ }
+
+ /**
+diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
+index 85167603b9c9..0da58f0bf7e5 100644
+--- a/drivers/acpi/numa.c
++++ b/drivers/acpi/numa.c
+@@ -147,9 +147,9 @@ acpi_table_print_srat_entry(struct acpi_subtable_header *header)
+ {
+ struct acpi_srat_mem_affinity *p =
+ (struct acpi_srat_mem_affinity *)header;
+- pr_debug("SRAT Memory (0x%lx length 0x%lx) in proximity domain %d %s%s%s\n",
+- (unsigned long)p->base_address,
+- (unsigned long)p->length,
++ pr_debug("SRAT Memory (0x%llx length 0x%llx) in proximity domain %d %s%s%s\n",
++ (unsigned long long)p->base_address,
++ (unsigned long long)p->length,
+ p->proximity_domain,
+ (p->flags & ACPI_SRAT_MEM_ENABLED) ?
+ "enabled" : "disabled",
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index f53fb41efb7b..b100260b6ed2 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1530,17 +1530,16 @@ static unsigned int __cpufreq_get(struct cpufreq_policy *policy)
+ {
+ unsigned int ret_freq = 0;
+
+- if (!cpufreq_driver->get)
++ if (unlikely(policy_is_inactive(policy)) || !cpufreq_driver->get)
+ return ret_freq;
+
+ ret_freq = cpufreq_driver->get(policy->cpu);
+
+ /*
+- * Updating inactive policies is invalid, so avoid doing that. Also
+- * if fast frequency switching is used with the given policy, the check
++ * If fast frequency switching is used with the given policy, the check
+ * against policy->cur is pointless, so skip it in that case too.
+ */
+- if (unlikely(policy_is_inactive(policy)) || policy->fast_switch_enabled)
++ if (policy->fast_switch_enabled)
+ return ret_freq;
+
+ if (ret_freq && policy->cur &&
+@@ -1569,10 +1568,7 @@ unsigned int cpufreq_get(unsigned int cpu)
+
+ if (policy) {
+ down_read(&policy->rwsem);
+-
+- if (!policy_is_inactive(policy))
+- ret_freq = __cpufreq_get(policy);
+-
++ ret_freq = __cpufreq_get(policy);
+ up_read(&policy->rwsem);
+
+ cpufreq_cpu_put(policy);
+diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
+index aa66cbf23512..b0aeffd4e269 100644
+--- a/drivers/firmware/efi/runtime-wrappers.c
++++ b/drivers/firmware/efi/runtime-wrappers.c
+@@ -172,6 +172,13 @@ void efi_call_virt_check_flags(unsigned long flags, const char *call)
+ */
+ static DEFINE_SEMAPHORE(efi_runtime_lock);
+
++/*
++ * Expose the EFI runtime lock to the UV platform
++ */
++#ifdef CONFIG_X86_UV
++extern struct semaphore __efi_uv_runtime_lock __alias(efi_runtime_lock);
++#endif
++
+ /*
+ * Calls the appropriate efi_runtime_service() with the appropriate
+ * arguments.
+diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c
+index 995cf0b9e0b1..2d1dfa1e0745 100644
+--- a/drivers/gpio/gpio-mxc.c
++++ b/drivers/gpio/gpio-mxc.c
+@@ -17,6 +17,7 @@
+ #include <linux/irqchip/chained_irq.h>
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
++#include <linux/syscore_ops.h>
+ #include <linux/gpio/driver.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+@@ -550,33 +551,38 @@ static void mxc_gpio_restore_regs(struct mxc_gpio_port *port)
+ writel(port->gpio_saved_reg.dr, port->base + GPIO_DR);
+ }
+
+-static int __maybe_unused mxc_gpio_noirq_suspend(struct device *dev)
++static int mxc_gpio_syscore_suspend(void)
+ {
+- struct platform_device *pdev = to_platform_device(dev);
+- struct mxc_gpio_port *port = platform_get_drvdata(pdev);
++ struct mxc_gpio_port *port;
+
+- mxc_gpio_save_regs(port);
+- clk_disable_unprepare(port->clk);
++ /* walk through all ports */
++ list_for_each_entry(port, &mxc_gpio_ports, node) {
++ mxc_gpio_save_regs(port);
++ clk_disable_unprepare(port->clk);
++ }
+
+ return 0;
+ }
+
+-static int __maybe_unused mxc_gpio_noirq_resume(struct device *dev)
++static void mxc_gpio_syscore_resume(void)
+ {
+- struct platform_device *pdev = to_platform_device(dev);
+- struct mxc_gpio_port *port = platform_get_drvdata(pdev);
++ struct mxc_gpio_port *port;
+ int ret;
+
+- ret = clk_prepare_enable(port->clk);
+- if (ret)
+- return ret;
+- mxc_gpio_restore_regs(port);
+-
+- return 0;
++ /* walk through all ports */
++ list_for_each_entry(port, &mxc_gpio_ports, node) {
++ ret = clk_prepare_enable(port->clk);
++ if (ret) {
++ pr_err("mxc: failed to enable gpio clock %d\n", ret);
++ return;
++ }
++ mxc_gpio_restore_regs(port);
++ }
+ }
+
+-static const struct dev_pm_ops mxc_gpio_dev_pm_ops = {
+- SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(mxc_gpio_noirq_suspend, mxc_gpio_noirq_resume)
++static struct syscore_ops mxc_gpio_syscore_ops = {
++ .suspend = mxc_gpio_syscore_suspend,
++ .resume = mxc_gpio_syscore_resume,
+ };
+
+ static struct platform_driver mxc_gpio_driver = {
+@@ -584,7 +590,6 @@ static struct platform_driver mxc_gpio_driver = {
+ .name = "gpio-mxc",
+ .of_match_table = mxc_gpio_dt_ids,
+ .suppress_bind_attrs = true,
+- .pm = &mxc_gpio_dev_pm_ops,
+ },
+ .probe = mxc_gpio_probe,
+ .id_table = mxc_gpio_devtype,
+@@ -592,6 +597,8 @@ static struct platform_driver mxc_gpio_driver = {
+
+ static int __init gpio_mxc_init(void)
+ {
++ register_syscore_ops(&mxc_gpio_syscore_ops);
++
+ return platform_driver_register(&mxc_gpio_driver);
+ }
+ subsys_initcall(gpio_mxc_init);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 39bf2ce548c6..7f6af421d3e9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -1653,8 +1653,10 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
+
+ amdgpu_amdkfd_device_init(adev);
+
+- if (amdgpu_sriov_vf(adev))
++ if (amdgpu_sriov_vf(adev)) {
++ amdgpu_virt_init_data_exchange(adev);
+ amdgpu_virt_release_full_gpu(adev, true);
++ }
+
+ return 0;
+ }
+@@ -2555,9 +2557,6 @@ fence_driver_init:
+ goto failed;
+ }
+
+- if (amdgpu_sriov_vf(adev))
+- amdgpu_virt_init_data_exchange(adev);
+-
+ amdgpu_fbdev_init(adev);
+
+ r = amdgpu_pm_sysfs_init(adev);
+@@ -3269,6 +3268,7 @@ static int amdgpu_device_reset_sriov(struct amdgpu_device *adev,
+ r = amdgpu_ib_ring_tests(adev);
+
+ error:
++ amdgpu_virt_init_data_exchange(adev);
+ amdgpu_virt_release_full_gpu(adev, true);
+ if (!r && adev->virt.gim_feature & AMDGIM_FEATURE_GIM_FLR_VRAMLOST) {
+ atomic_inc(&adev->vram_lost_counter);
+diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
+index 078f70faedcb..d06332be59d3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
++++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
+@@ -174,7 +174,7 @@ static int xgpu_ai_send_access_requests(struct amdgpu_device *adev,
+ return r;
+ }
+ /* Retrieve checksum from mailbox2 */
+- if (req == IDH_REQ_GPU_INIT_ACCESS) {
++ if (req == IDH_REQ_GPU_INIT_ACCESS || req == IDH_REQ_GPU_RESET_ACCESS) {
+ adev->virt.fw_reserve.checksum_key =
+ RREG32_NO_KIQ(SOC15_REG_OFFSET(NBIO, 0,
+ mmBIF_BX_PF0_MAILBOX_MSGBUF_RCV_DW2));
+diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+index 7c3b634d8d5f..de5a689e1925 100644
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+@@ -71,7 +71,6 @@ static const struct soc15_reg_golden golden_settings_sdma_4[] = {
+ SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_RLC1_RB_WPTR_POLL_CNTL, 0x0000fff0, 0x00403000),
+ SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_PAGE, 0x000003ff, 0x000003c0),
+ SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_UTCL1_WATERMK, 0xfc000000, 0x00000000),
+- SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CHICKEN_BITS, 0xfe931f07, 0x02831f07),
+ SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CLK_CTRL, 0xffffffff, 0x3f000100),
+ SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GFX_IB_CNTL, 0x800f0100, 0x00000100),
+ SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GFX_RB_WPTR_POLL_CNTL, 0x0000fff0, 0x00403000),
+@@ -89,6 +88,7 @@ static const struct soc15_reg_golden golden_settings_sdma_4[] = {
+ static const struct soc15_reg_golden golden_settings_sdma_vg10[] = {
+ SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_GB_ADDR_CONFIG, 0x0018773f, 0x00104002),
+ SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_GB_ADDR_CONFIG_READ, 0x0018773f, 0x00104002),
++ SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CHICKEN_BITS, 0xfe931f07, 0x02831d07),
+ SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GB_ADDR_CONFIG, 0x0018773f, 0x00104002),
+ SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GB_ADDR_CONFIG_READ, 0x0018773f, 0x00104002)
+ };
+@@ -96,6 +96,7 @@ static const struct soc15_reg_golden golden_settings_sdma_vg10[] = {
+ static const struct soc15_reg_golden golden_settings_sdma_vg12[] = {
+ SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_GB_ADDR_CONFIG, 0x0018773f, 0x00104001),
+ SOC15_REG_GOLDEN_VALUE(SDMA0, 0, mmSDMA0_GB_ADDR_CONFIG_READ, 0x0018773f, 0x00104001),
++ SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_CHICKEN_BITS, 0xfe931f07, 0x02831d07),
+ SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GB_ADDR_CONFIG, 0x0018773f, 0x00104001),
+ SOC15_REG_GOLDEN_VALUE(SDMA1, 0, mmSDMA1_GB_ADDR_CONFIG_READ, 0x0018773f, 0x00104001)
+ };
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index 8e28e738cb52..391547358756 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -98,6 +98,8 @@
+ #define DP0_STARTVAL 0x064c
+ #define DP0_ACTIVEVAL 0x0650
+ #define DP0_SYNCVAL 0x0654
++#define SYNCVAL_HS_POL_ACTIVE_LOW (1 << 15)
++#define SYNCVAL_VS_POL_ACTIVE_LOW (1 << 31)
+ #define DP0_MISC 0x0658
+ #define TU_SIZE_RECOMMENDED (63) /* LSCLK cycles per TU */
+ #define BPC_6 (0 << 5)
+@@ -142,6 +144,8 @@
+ #define DP0_LTLOOPCTRL 0x06d8
+ #define DP0_SNKLTCTRL 0x06e4
+
++#define DP1_SRCCTRL 0x07a0
++
+ /* PHY */
+ #define DP_PHY_CTRL 0x0800
+ #define DP_PHY_RST BIT(28) /* DP PHY Global Soft Reset */
+@@ -150,6 +154,7 @@
+ #define PHY_M1_RST BIT(12) /* Reset PHY1 Main Channel */
+ #define PHY_RDY BIT(16) /* PHY Main Channels Ready */
+ #define PHY_M0_RST BIT(8) /* Reset PHY0 Main Channel */
++#define PHY_2LANE BIT(2) /* PHY Enable 2 lanes */
+ #define PHY_A0_EN BIT(1) /* PHY Aux Channel0 Enable */
+ #define PHY_M0_EN BIT(0) /* PHY Main Channel0 Enable */
+
+@@ -540,6 +545,7 @@ static int tc_aux_link_setup(struct tc_data *tc)
+ unsigned long rate;
+ u32 value;
+ int ret;
++ u32 dp_phy_ctrl;
+
+ rate = clk_get_rate(tc->refclk);
+ switch (rate) {
+@@ -564,7 +570,10 @@ static int tc_aux_link_setup(struct tc_data *tc)
+ value |= SYSCLK_SEL_LSCLK | LSCLK_DIV_2;
+ tc_write(SYS_PLLPARAM, value);
+
+- tc_write(DP_PHY_CTRL, BGREN | PWR_SW_EN | BIT(2) | PHY_A0_EN);
++ dp_phy_ctrl = BGREN | PWR_SW_EN | PHY_A0_EN;
++ if (tc->link.base.num_lanes == 2)
++ dp_phy_ctrl |= PHY_2LANE;
++ tc_write(DP_PHY_CTRL, dp_phy_ctrl);
+
+ /*
+ * Initially PLLs are in bypass. Force PLL parameter update,
+@@ -719,7 +728,9 @@ static int tc_set_video_mode(struct tc_data *tc, struct drm_display_mode *mode)
+
+ tc_write(DP0_ACTIVEVAL, (mode->vdisplay << 16) | (mode->hdisplay));
+
+- tc_write(DP0_SYNCVAL, (vsync_len << 16) | (hsync_len << 0));
++ tc_write(DP0_SYNCVAL, (vsync_len << 16) | (hsync_len << 0) |
++ ((mode->flags & DRM_MODE_FLAG_NHSYNC) ? SYNCVAL_HS_POL_ACTIVE_LOW : 0) |
++ ((mode->flags & DRM_MODE_FLAG_NVSYNC) ? SYNCVAL_VS_POL_ACTIVE_LOW : 0));
+
+ tc_write(DPIPXLFMT, VS_POL_ACTIVE_LOW | HS_POL_ACTIVE_LOW |
+ DE_POL_ACTIVE_HIGH | SUB_CFG_TYPE_CONFIG1 | DPI_BPP_RGB888);
+@@ -829,12 +840,11 @@ static int tc_main_link_setup(struct tc_data *tc)
+ if (!tc->mode)
+ return -EINVAL;
+
+- /* from excel file - DP0_SrcCtrl */
+- tc_write(DP0_SRCCTRL, DP0_SRCCTRL_SCRMBLDIS | DP0_SRCCTRL_EN810B |
+- DP0_SRCCTRL_LANESKEW | DP0_SRCCTRL_LANES_2 |
+- DP0_SRCCTRL_BW27 | DP0_SRCCTRL_AUTOCORRECT);
+- /* from excel file - DP1_SrcCtrl */
+- tc_write(0x07a0, 0x00003083);
++ tc_write(DP0_SRCCTRL, tc_srcctrl(tc));
++ /* SSCG and BW27 on DP1 must be set to the same as on DP0 */
++ tc_write(DP1_SRCCTRL,
++ (tc->link.spread ? DP0_SRCCTRL_SSCG : 0) |
++ ((tc->link.base.rate != 162000) ? DP0_SRCCTRL_BW27 : 0));
+
+ rate = clk_get_rate(tc->refclk);
+ switch (rate) {
+@@ -855,8 +865,11 @@ static int tc_main_link_setup(struct tc_data *tc)
+ }
+ value |= SYSCLK_SEL_LSCLK | LSCLK_DIV_2;
+ tc_write(SYS_PLLPARAM, value);
++
+ /* Setup Main Link */
+- dp_phy_ctrl = BGREN | PWR_SW_EN | BIT(2) | PHY_A0_EN | PHY_M0_EN;
++ dp_phy_ctrl = BGREN | PWR_SW_EN | PHY_A0_EN | PHY_M0_EN;
++ if (tc->link.base.num_lanes == 2)
++ dp_phy_ctrl |= PHY_2LANE;
+ tc_write(DP_PHY_CTRL, dp_phy_ctrl);
+ msleep(100);
+
+@@ -1105,10 +1118,20 @@ static bool tc_bridge_mode_fixup(struct drm_bridge *bridge,
+ static enum drm_mode_status tc_connector_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+ {
++ struct tc_data *tc = connector_to_tc(connector);
++ u32 req, avail;
++ u32 bits_per_pixel = 24;
++
+ /* DPI interface clock limitation: upto 154 MHz */
+ if (mode->clock > 154000)
+ return MODE_CLOCK_HIGH;
+
++ req = mode->clock * bits_per_pixel / 8;
++ avail = tc->link.base.num_lanes * tc->link.base.rate;
++
++ if (req > avail)
++ return MODE_BAD;
++
+ return MODE_OK;
+ }
+
+@@ -1195,6 +1218,10 @@ static int tc_bridge_attach(struct drm_bridge *bridge)
+
+ drm_display_info_set_bus_formats(&tc->connector.display_info,
+ &bus_format, 1);
++ tc->connector.display_info.bus_flags =
++ DRM_BUS_FLAG_DE_HIGH |
++ DRM_BUS_FLAG_PIXDATA_NEGEDGE |
++ DRM_BUS_FLAG_SYNC_NEGEDGE;
+ drm_connector_attach_encoder(&tc->connector, tc->bridge.encoder);
+
+ return 0;
+diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
+index fe6bfaf8b53f..086f2adc541b 100644
+--- a/drivers/gpu/drm/drm_lease.c
++++ b/drivers/gpu/drm/drm_lease.c
+@@ -521,7 +521,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
+
+ object_count = cl->object_count;
+
+- object_ids = memdup_user(u64_to_user_ptr(cl->object_ids), object_count * sizeof(__u32));
++ object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
++ array_size(object_count, sizeof(__u32)));
+ if (IS_ERR(object_ids))
+ return PTR_ERR(object_ids);
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 47cc932e23a7..280c851714e6 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1821,6 +1821,16 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
+ return 0;
+ }
+
++static inline bool
++__vma_matches(struct vm_area_struct *vma, struct file *filp,
++ unsigned long addr, unsigned long size)
++{
++ if (vma->vm_file != filp)
++ return false;
++
++ return vma->vm_start == addr && (vma->vm_end - vma->vm_start) == size;
++}
++
+ /**
+ * i915_gem_mmap_ioctl - Maps the contents of an object, returning the address
+ * it is mapped to.
+@@ -1879,7 +1889,7 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
+ return -EINTR;
+ }
+ vma = find_vma(mm, addr);
+- if (vma)
++ if (vma && __vma_matches(vma, obj->base.filp, addr, args->size))
+ vma->vm_page_prot =
+ pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
+ else
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index 8fc61e96754f..50d56498de77 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -209,6 +209,16 @@ struct intel_fbdev {
+ unsigned long vma_flags;
+ async_cookie_t cookie;
+ int preferred_bpp;
++
++ /* Whether or not fbdev hpd processing is temporarily suspended */
++ bool hpd_suspended : 1;
++ /* Set when a hotplug was received while HPD processing was
++ * suspended
++ */
++ bool hpd_waiting : 1;
++
++ /* Protects hpd_suspended */
++ struct mutex hpd_lock;
+ };
+
+ struct intel_encoder {
+diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
+index fb2f9fce34cd..2d6506c08bf7 100644
+--- a/drivers/gpu/drm/i915/intel_fbdev.c
++++ b/drivers/gpu/drm/i915/intel_fbdev.c
+@@ -677,6 +677,7 @@ int intel_fbdev_init(struct drm_device *dev)
+ if (ifbdev == NULL)
+ return -ENOMEM;
+
++ mutex_init(&ifbdev->hpd_lock);
+ drm_fb_helper_prepare(dev, &ifbdev->helper, &intel_fb_helper_funcs);
+
+ if (!intel_fbdev_init_bios(dev, ifbdev))
+@@ -750,6 +751,26 @@ void intel_fbdev_fini(struct drm_i915_private *dev_priv)
+ intel_fbdev_destroy(ifbdev);
+ }
+
++/* Suspends/resumes fbdev processing of incoming HPD events. When resuming HPD
++ * processing, fbdev will perform a full connector reprobe if a hotplug event
++ * was received while HPD was suspended.
++ */
++static void intel_fbdev_hpd_set_suspend(struct intel_fbdev *ifbdev, int state)
++{
++ bool send_hpd = false;
++
++ mutex_lock(&ifbdev->hpd_lock);
++ ifbdev->hpd_suspended = state == FBINFO_STATE_SUSPENDED;
++ send_hpd = !ifbdev->hpd_suspended && ifbdev->hpd_waiting;
++ ifbdev->hpd_waiting = false;
++ mutex_unlock(&ifbdev->hpd_lock);
++
++ if (send_hpd) {
++ DRM_DEBUG_KMS("Handling delayed fbcon HPD event\n");
++ drm_fb_helper_hotplug_event(&ifbdev->helper);
++ }
++}
++
+ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous)
+ {
+ struct drm_i915_private *dev_priv = to_i915(dev);
+@@ -771,6 +792,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
+ */
+ if (state != FBINFO_STATE_RUNNING)
+ flush_work(&dev_priv->fbdev_suspend_work);
++
+ console_lock();
+ } else {
+ /*
+@@ -798,17 +820,26 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
+
+ drm_fb_helper_set_suspend(&ifbdev->helper, state);
+ console_unlock();
++
++ intel_fbdev_hpd_set_suspend(ifbdev, state);
+ }
+
+ void intel_fbdev_output_poll_changed(struct drm_device *dev)
+ {
+ struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
++ bool send_hpd;
+
+ if (!ifbdev)
+ return;
+
+ intel_fbdev_sync(ifbdev);
+- if (ifbdev->vma || ifbdev->helper.deferred_setup)
++
++ mutex_lock(&ifbdev->hpd_lock);
++ send_hpd = !ifbdev->hpd_suspended;
++ ifbdev->hpd_waiting = true;
++ mutex_unlock(&ifbdev->hpd_lock);
++
++ if (send_hpd && (ifbdev->vma || ifbdev->helper.deferred_setup))
+ drm_fb_helper_hotplug_event(&ifbdev->helper);
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/falcon.c b/drivers/gpu/drm/nouveau/nvkm/engine/falcon.c
+index 816ccaedfc73..8675613e142b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/falcon.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/falcon.c
+@@ -22,6 +22,7 @@
+ #include <engine/falcon.h>
+
+ #include <core/gpuobj.h>
++#include <subdev/mc.h>
+ #include <subdev/timer.h>
+ #include <engine/fifo.h>
+
+@@ -107,8 +108,10 @@ nvkm_falcon_fini(struct nvkm_engine *engine, bool suspend)
+ }
+ }
+
+- nvkm_mask(device, base + 0x048, 0x00000003, 0x00000000);
+- nvkm_wr32(device, base + 0x014, 0xffffffff);
++ if (nvkm_mc_enabled(device, engine->subdev.index)) {
++ nvkm_mask(device, base + 0x048, 0x00000003, 0x00000000);
++ nvkm_wr32(device, base + 0x014, 0xffffffff);
++ }
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
+index 3695cde669f8..07914e36939e 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
+@@ -132,11 +132,12 @@ nvkm_therm_update(struct nvkm_therm *therm, int mode)
+ duty = nvkm_therm_update_linear(therm);
+ break;
+ case NVBIOS_THERM_FAN_OTHER:
+- if (therm->cstate)
++ if (therm->cstate) {
+ duty = therm->cstate;
+- else
++ poll = false;
++ } else {
+ duty = nvkm_therm_update_linear_fallback(therm);
+- poll = false;
++ }
+ break;
+ }
+ immd = false;
+diff --git a/drivers/gpu/drm/vkms/vkms_crtc.c b/drivers/gpu/drm/vkms/vkms_crtc.c
+index 875fca662ac0..1ea2dd35bca9 100644
+--- a/drivers/gpu/drm/vkms/vkms_crtc.c
++++ b/drivers/gpu/drm/vkms/vkms_crtc.c
+@@ -1,10 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; either version 2 of the License, or
+- * (at your option) any later version.
+- */
++// SPDX-License-Identifier: GPL-2.0+
+
+ #include "vkms_drv.h"
+ #include <drm/drm_atomic_helper.h>
+diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
+index 6e728b825259..b1201c18d3eb 100644
+--- a/drivers/gpu/drm/vkms/vkms_drv.c
++++ b/drivers/gpu/drm/vkms/vkms_drv.c
+@@ -1,9 +1,4 @@
+-/*
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; either version 2 of the License, or
+- * (at your option) any later version.
+- */
++// SPDX-License-Identifier: GPL-2.0+
+
+ #include <linux/module.h>
+ #include <drm/drm_gem.h>
+diff --git a/drivers/gpu/drm/vkms/vkms_drv.h b/drivers/gpu/drm/vkms/vkms_drv.h
+index 07be29f2dc44..e018752d57bb 100644
+--- a/drivers/gpu/drm/vkms/vkms_drv.h
++++ b/drivers/gpu/drm/vkms/vkms_drv.h
+@@ -1,3 +1,5 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++
+ #ifndef _VKMS_DRV_H_
+ #define _VKMS_DRV_H_
+
+diff --git a/drivers/gpu/drm/vkms/vkms_gem.c b/drivers/gpu/drm/vkms/vkms_gem.c
+index c7e38368602b..ca4a74e04977 100644
+--- a/drivers/gpu/drm/vkms/vkms_gem.c
++++ b/drivers/gpu/drm/vkms/vkms_gem.c
+@@ -1,10 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; either version 2 of the License, or
+- * (at your option) any later version.
+- */
++// SPDX-License-Identifier: GPL-2.0+
+
+ #include <linux/shmem_fs.h>
+
+diff --git a/drivers/gpu/drm/vkms/vkms_output.c b/drivers/gpu/drm/vkms/vkms_output.c
+index 901012cb1af1..5697148e0b73 100644
+--- a/drivers/gpu/drm/vkms/vkms_output.c
++++ b/drivers/gpu/drm/vkms/vkms_output.c
+@@ -1,10 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; either version 2 of the License, or
+- * (at your option) any later version.
+- */
++// SPDX-License-Identifier: GPL-2.0+
+
+ #include "vkms_drv.h"
+ #include <drm/drm_crtc_helper.h>
+diff --git a/drivers/gpu/drm/vkms/vkms_plane.c b/drivers/gpu/drm/vkms/vkms_plane.c
+index 9f75b1e2c1c4..ce043b721e0c 100644
+--- a/drivers/gpu/drm/vkms/vkms_plane.c
++++ b/drivers/gpu/drm/vkms/vkms_plane.c
+@@ -1,10 +1,4 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; either version 2 of the License, or
+- * (at your option) any later version.
+- */
++// SPDX-License-Identifier: GPL-2.0+
+
+ #include "vkms_drv.h"
+ #include <drm/drm_plane_helper.h>
+diff --git a/drivers/input/misc/bma150.c b/drivers/input/misc/bma150.c
+index 1efcfdf9f8a8..dd9dd4e40827 100644
+--- a/drivers/input/misc/bma150.c
++++ b/drivers/input/misc/bma150.c
+@@ -481,13 +481,14 @@ static int bma150_register_input_device(struct bma150_data *bma150)
+ idev->close = bma150_irq_close;
+ input_set_drvdata(idev, bma150);
+
++ bma150->input = idev;
++
+ error = input_register_device(idev);
+ if (error) {
+ input_free_device(idev);
+ return error;
+ }
+
+- bma150->input = idev;
+ return 0;
+ }
+
+@@ -510,15 +511,15 @@ static int bma150_register_polled_device(struct bma150_data *bma150)
+
+ bma150_init_input_device(bma150, ipoll_dev->input);
+
++ bma150->input_polled = ipoll_dev;
++ bma150->input = ipoll_dev->input;
++
+ error = input_register_polled_device(ipoll_dev);
+ if (error) {
+ input_free_polled_device(ipoll_dev);
+ return error;
+ }
+
+- bma150->input_polled = ipoll_dev;
+- bma150->input = ipoll_dev->input;
+-
+ return 0;
+ }
+
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index f322a1768fbb..225ae6980182 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1336,7 +1336,6 @@ MODULE_DEVICE_TABLE(i2c, elan_id);
+ static const struct acpi_device_id elan_acpi_id[] = {
+ { "ELAN0000", 0 },
+ { "ELAN0100", 0 },
+- { "ELAN0501", 0 },
+ { "ELAN0600", 0 },
+ { "ELAN0602", 0 },
+ { "ELAN0605", 0 },
+@@ -1346,6 +1345,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
+ { "ELAN060C", 0 },
+ { "ELAN0611", 0 },
+ { "ELAN0612", 0 },
++ { "ELAN0617", 0 },
+ { "ELAN0618", 0 },
+ { "ELAN061C", 0 },
+ { "ELAN061D", 0 },
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 9fe075c137dc..a7f8b1614559 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1119,6 +1119,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
+ * Asus UX31 0x361f00 20, 15, 0e clickpad
+ * Asus UX32VD 0x361f02 00, 15, 0e clickpad
+ * Avatar AVIU-145A2 0x361f00 ? clickpad
++ * Fujitsu CELSIUS H760 0x570f02 40, 14, 0c 3 hw buttons (**)
++ * Fujitsu CELSIUS H780 0x5d0f02 41, 16, 0d 3 hw buttons (**)
+ * Fujitsu LIFEBOOK E544 0x470f00 d0, 12, 09 2 hw buttons
+ * Fujitsu LIFEBOOK E546 0x470f00 50, 12, 09 2 hw buttons
+ * Fujitsu LIFEBOOK E547 0x470f00 50, 12, 09 2 hw buttons
+@@ -1171,6 +1173,13 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H760"),
+ },
+ },
++ {
++ /* Fujitsu H780 also has a middle button */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H780"),
++ },
++ },
+ #endif
+ { }
+ };
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 5921ecc670c1..f3dcc7640319 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -932,7 +932,7 @@ static int dm_crypt_integrity_io_alloc(struct dm_crypt_io *io, struct bio *bio)
+ if (IS_ERR(bip))
+ return PTR_ERR(bip);
+
+- tag_len = io->cc->on_disk_tag_size * bio_sectors(bio);
++ tag_len = io->cc->on_disk_tag_size * (bio_sectors(bio) >> io->cc->sector_shift);
+
+ bip->bip_iter.bi_size = tag_len;
+ bip->bip_iter.bi_sector = io->cc->start + io->sector;
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index c30a7850b2da..cd4220ee7004 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -257,6 +257,7 @@ struct pool {
+
+ spinlock_t lock;
+ struct bio_list deferred_flush_bios;
++ struct bio_list deferred_flush_completions;
+ struct list_head prepared_mappings;
+ struct list_head prepared_discards;
+ struct list_head prepared_discards_pt2;
+@@ -956,6 +957,39 @@ static void process_prepared_mapping_fail(struct dm_thin_new_mapping *m)
+ mempool_free(m, &m->tc->pool->mapping_pool);
+ }
+
++static void complete_overwrite_bio(struct thin_c *tc, struct bio *bio)
++{
++ struct pool *pool = tc->pool;
++ unsigned long flags;
++
++ /*
++ * If the bio has the REQ_FUA flag set we must commit the metadata
++ * before signaling its completion.
++ */
++ if (!bio_triggers_commit(tc, bio)) {
++ bio_endio(bio);
++ return;
++ }
++
++ /*
++ * Complete bio with an error if earlier I/O caused changes to the
++ * metadata that can't be committed, e.g, due to I/O errors on the
++ * metadata device.
++ */
++ if (dm_thin_aborted_changes(tc->td)) {
++ bio_io_error(bio);
++ return;
++ }
++
++ /*
++ * Batch together any bios that trigger commits and then issue a
++ * single commit for them in process_deferred_bios().
++ */
++ spin_lock_irqsave(&pool->lock, flags);
++ bio_list_add(&pool->deferred_flush_completions, bio);
++ spin_unlock_irqrestore(&pool->lock, flags);
++}
++
+ static void process_prepared_mapping(struct dm_thin_new_mapping *m)
+ {
+ struct thin_c *tc = m->tc;
+@@ -988,7 +1022,7 @@ static void process_prepared_mapping(struct dm_thin_new_mapping *m)
+ */
+ if (bio) {
+ inc_remap_and_issue_cell(tc, m->cell, m->data_block);
+- bio_endio(bio);
++ complete_overwrite_bio(tc, bio);
+ } else {
+ inc_all_io_entry(tc->pool, m->cell->holder);
+ remap_and_issue(tc, m->cell->holder, m->data_block);
+@@ -2317,7 +2351,7 @@ static void process_deferred_bios(struct pool *pool)
+ {
+ unsigned long flags;
+ struct bio *bio;
+- struct bio_list bios;
++ struct bio_list bios, bio_completions;
+ struct thin_c *tc;
+
+ tc = get_first_thin(pool);
+@@ -2328,26 +2362,36 @@ static void process_deferred_bios(struct pool *pool)
+ }
+
+ /*
+- * If there are any deferred flush bios, we must commit
+- * the metadata before issuing them.
++ * If there are any deferred flush bios, we must commit the metadata
++ * before issuing them or signaling their completion.
+ */
+ bio_list_init(&bios);
++ bio_list_init(&bio_completions);
++
+ spin_lock_irqsave(&pool->lock, flags);
+ bio_list_merge(&bios, &pool->deferred_flush_bios);
+ bio_list_init(&pool->deferred_flush_bios);
++
++ bio_list_merge(&bio_completions, &pool->deferred_flush_completions);
++ bio_list_init(&pool->deferred_flush_completions);
+ spin_unlock_irqrestore(&pool->lock, flags);
+
+- if (bio_list_empty(&bios) &&
++ if (bio_list_empty(&bios) && bio_list_empty(&bio_completions) &&
+ !(dm_pool_changed_this_transaction(pool->pmd) && need_commit_due_to_time(pool)))
+ return;
+
+ if (commit(pool)) {
++ bio_list_merge(&bios, &bio_completions);
++
+ while ((bio = bio_list_pop(&bios)))
+ bio_io_error(bio);
+ return;
+ }
+ pool->last_commit_jiffies = jiffies;
+
++ while ((bio = bio_list_pop(&bio_completions)))
++ bio_endio(bio);
++
+ while ((bio = bio_list_pop(&bios)))
+ generic_make_request(bio);
+ }
+@@ -2954,6 +2998,7 @@ static struct pool *pool_create(struct mapped_device *pool_md,
+ INIT_DELAYED_WORK(&pool->no_space_timeout, do_no_space_timeout);
+ spin_lock_init(&pool->lock);
+ bio_list_init(&pool->deferred_flush_bios);
++ bio_list_init(&pool->deferred_flush_completions);
+ INIT_LIST_HEAD(&pool->prepared_mappings);
+ INIT_LIST_HEAD(&pool->prepared_discards);
+ INIT_LIST_HEAD(&pool->prepared_discards_pt2);
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 1d54109071cc..fa47249fa3e4 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1863,6 +1863,20 @@ static void end_sync_read(struct bio *bio)
+ reschedule_retry(r1_bio);
+ }
+
++static void abort_sync_write(struct mddev *mddev, struct r1bio *r1_bio)
++{
++ sector_t sync_blocks = 0;
++ sector_t s = r1_bio->sector;
++ long sectors_to_go = r1_bio->sectors;
++
++ /* make sure these bits don't get cleared. */
++ do {
++ md_bitmap_end_sync(mddev->bitmap, s, &sync_blocks, 1);
++ s += sync_blocks;
++ sectors_to_go -= sync_blocks;
++ } while (sectors_to_go > 0);
++}
++
+ static void end_sync_write(struct bio *bio)
+ {
+ int uptodate = !bio->bi_status;
+@@ -1874,15 +1888,7 @@ static void end_sync_write(struct bio *bio)
+ struct md_rdev *rdev = conf->mirrors[find_bio_disk(r1_bio, bio)].rdev;
+
+ if (!uptodate) {
+- sector_t sync_blocks = 0;
+- sector_t s = r1_bio->sector;
+- long sectors_to_go = r1_bio->sectors;
+- /* make sure these bits doesn't get cleared. */
+- do {
+- md_bitmap_end_sync(mddev->bitmap, s, &sync_blocks, 1);
+- s += sync_blocks;
+- sectors_to_go -= sync_blocks;
+- } while (sectors_to_go > 0);
++ abort_sync_write(mddev, r1_bio);
+ set_bit(WriteErrorSeen, &rdev->flags);
+ if (!test_and_set_bit(WantReplacement, &rdev->flags))
+ set_bit(MD_RECOVERY_NEEDED, &
+@@ -2172,8 +2178,10 @@ static void sync_request_write(struct mddev *mddev, struct r1bio *r1_bio)
+ (i == r1_bio->read_disk ||
+ !test_bit(MD_RECOVERY_SYNC, &mddev->recovery))))
+ continue;
+- if (test_bit(Faulty, &conf->mirrors[i].rdev->flags))
++ if (test_bit(Faulty, &conf->mirrors[i].rdev->flags)) {
++ abort_sync_write(mddev, r1_bio);
+ continue;
++ }
+
+ bio_set_op_attrs(wbio, REQ_OP_WRITE, 0);
+ if (test_bit(FailFast, &conf->mirrors[i].rdev->flags))
+diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig
+index 68a1ac929917..d382b13c27dd 100644
+--- a/drivers/misc/eeprom/Kconfig
++++ b/drivers/misc/eeprom/Kconfig
+@@ -13,7 +13,7 @@ config EEPROM_AT24
+ ones like at24c64, 24lc02 or fm24c04:
+
+ 24c00, 24c01, 24c02, spd (readonly 24c02), 24c04, 24c08,
+- 24c16, 24c32, 24c64, 24c128, 24c256, 24c512, 24c1024
++ 24c16, 24c32, 24c64, 24c128, 24c256, 24c512, 24c1024, 24c2048
+
+ Unless you like data loss puzzles, always be sure that any chip
+ you configure as a 24c32 (32 kbit) or larger is NOT really a
+diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
+index 7e50e1d6f58c..94836fcbe721 100644
+--- a/drivers/misc/eeprom/at24.c
++++ b/drivers/misc/eeprom/at24.c
+@@ -173,6 +173,7 @@ AT24_CHIP_DATA(at24_data_24c128, 131072 / 8, AT24_FLAG_ADDR16);
+ AT24_CHIP_DATA(at24_data_24c256, 262144 / 8, AT24_FLAG_ADDR16);
+ AT24_CHIP_DATA(at24_data_24c512, 524288 / 8, AT24_FLAG_ADDR16);
+ AT24_CHIP_DATA(at24_data_24c1024, 1048576 / 8, AT24_FLAG_ADDR16);
++AT24_CHIP_DATA(at24_data_24c2048, 2097152 / 8, AT24_FLAG_ADDR16);
+ /* identical to 24c08 ? */
+ AT24_CHIP_DATA(at24_data_INT3499, 8192 / 8, 0);
+
+@@ -199,6 +200,7 @@ static const struct i2c_device_id at24_ids[] = {
+ { "24c256", (kernel_ulong_t)&at24_data_24c256 },
+ { "24c512", (kernel_ulong_t)&at24_data_24c512 },
+ { "24c1024", (kernel_ulong_t)&at24_data_24c1024 },
++ { "24c2048", (kernel_ulong_t)&at24_data_24c2048 },
+ { "at24", 0 },
+ { /* END OF LIST */ }
+ };
+@@ -227,6 +229,7 @@ static const struct of_device_id at24_of_match[] = {
+ { .compatible = "atmel,24c256", .data = &at24_data_24c256 },
+ { .compatible = "atmel,24c512", .data = &at24_data_24c512 },
+ { .compatible = "atmel,24c1024", .data = &at24_data_24c1024 },
++ { .compatible = "atmel,24c2048", .data = &at24_data_24c2048 },
+ { /* END OF LIST */ },
+ };
+ MODULE_DEVICE_TABLE(of, at24_of_match);
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index f6755b86eba2..eee004fb3c3e 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2114,7 +2114,7 @@ static void mmc_blk_mq_req_done(struct mmc_request *mrq)
+ if (waiting)
+ wake_up(&mq->wait);
+ else
+- kblockd_schedule_work(&mq->complete_work);
++ queue_work(mq->card->complete_wq, &mq->complete_work);
+
+ return;
+ }
+@@ -2928,6 +2928,13 @@ static int mmc_blk_probe(struct mmc_card *card)
+
+ mmc_fixup_device(card, mmc_blk_fixups);
+
++ card->complete_wq = alloc_workqueue("mmc_complete",
++ WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
++ if (unlikely(!card->complete_wq)) {
++ pr_err("Failed to create mmc completion workqueue");
++ return -ENOMEM;
++ }
++
+ md = mmc_blk_alloc(card);
+ if (IS_ERR(md))
+ return PTR_ERR(md);
+@@ -2991,6 +2998,7 @@ static void mmc_blk_remove(struct mmc_card *card)
+ pm_runtime_put_noidle(&card->dev);
+ mmc_blk_remove_req(md);
+ dev_set_drvdata(&card->dev, NULL);
++ destroy_workqueue(card->complete_wq);
+ }
+
+ static int _mmc_blk_suspend(struct mmc_card *card)
+diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
+index 568349e1fbc2..c4584184525f 100644
+--- a/drivers/mmc/host/sunxi-mmc.c
++++ b/drivers/mmc/host/sunxi-mmc.c
+@@ -1394,6 +1394,21 @@ static int sunxi_mmc_probe(struct platform_device *pdev)
+ if (ret)
+ goto error_free_dma;
+
++ /*
++ * If we don't support delay chains in the SoC, we can't use any
++ * of the higher speed modes. Mask them out in case the device
++ * tree specifies the properties for them, which gets added to
++ * the caps by mmc_of_parse() above.
++ */
++ if (!(host->cfg->clk_delays || host->use_new_timings)) {
++ mmc->caps &= ~(MMC_CAP_3_3V_DDR | MMC_CAP_1_8V_DDR |
++ MMC_CAP_1_2V_DDR | MMC_CAP_UHS);
++ mmc->caps2 &= ~MMC_CAP2_HS200;
++ }
++
++ /* TODO: This driver doesn't support HS400 mode yet */
++ mmc->caps2 &= ~MMC_CAP2_HS400;
++
+ ret = sunxi_mmc_init_host(host);
+ if (ret)
+ goto error_free_dma;
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index e5bddae16ed4..e0d2b7473901 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2095,7 +2095,7 @@ static void nvme_init_subnqn(struct nvme_subsystem *subsys, struct nvme_ctrl *ct
+
+ /* Generate a "fake" NQN per Figure 254 in NVMe 1.3 + ECN 001 */
+ off = snprintf(subsys->subnqn, NVMF_NQN_SIZE,
+- "nqn.2014.08.org.nvmexpress:%4x%4x",
++ "nqn.2014.08.org.nvmexpress:%04x%04x",
+ le16_to_cpu(id->vid), le16_to_cpu(id->ssvid));
+ memcpy(subsys->subnqn + off, id->sn, sizeof(id->sn));
+ off += sizeof(id->sn);
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index c27af277e14e..815509dbed84 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -556,6 +556,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
+ return 0;
+ out_free_ana_log_buf:
+ kfree(ctrl->ana_log_buf);
++ ctrl->ana_log_buf = NULL;
+ out:
+ return error;
+ }
+@@ -563,5 +564,6 @@ out:
+ void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
+ {
+ kfree(ctrl->ana_log_buf);
++ ctrl->ana_log_buf = NULL;
+ }
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index d668682f91df..f46313f441ec 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -908,9 +908,11 @@ static void nvme_complete_cqes(struct nvme_queue *nvmeq, u16 start, u16 end)
+
+ static inline void nvme_update_cq_head(struct nvme_queue *nvmeq)
+ {
+- if (++nvmeq->cq_head == nvmeq->q_depth) {
++ if (nvmeq->cq_head == nvmeq->q_depth - 1) {
+ nvmeq->cq_head = 0;
+ nvmeq->cq_phase = !nvmeq->cq_phase;
++ } else {
++ nvmeq->cq_head++;
+ }
+ }
+
+@@ -1727,8 +1729,9 @@ static void nvme_free_host_mem(struct nvme_dev *dev)
+ struct nvme_host_mem_buf_desc *desc = &dev->host_mem_descs[i];
+ size_t size = le32_to_cpu(desc->size) * dev->ctrl.page_size;
+
+- dma_free_coherent(dev->dev, size, dev->host_mem_desc_bufs[i],
+- le64_to_cpu(desc->addr));
++ dma_free_attrs(dev->dev, size, dev->host_mem_desc_bufs[i],
++ le64_to_cpu(desc->addr),
++ DMA_ATTR_NO_KERNEL_MAPPING | DMA_ATTR_NO_WARN);
+ }
+
+ kfree(dev->host_mem_desc_bufs);
+@@ -1794,8 +1797,9 @@ out_free_bufs:
+ while (--i >= 0) {
+ size_t size = le32_to_cpu(descs[i].size) * dev->ctrl.page_size;
+
+- dma_free_coherent(dev->dev, size, bufs[i],
+- le64_to_cpu(descs[i].addr));
++ dma_free_attrs(dev->dev, size, bufs[i],
++ le64_to_cpu(descs[i].addr),
++ DMA_ATTR_NO_KERNEL_MAPPING | DMA_ATTR_NO_WARN);
+ }
+
+ kfree(bufs);
+diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
+index f039266b275d..a57b969b8973 100644
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -249,7 +249,8 @@ static inline int ap_test_config(unsigned int *field, unsigned int nr)
+ static inline int ap_test_config_card_id(unsigned int id)
+ {
+ if (!ap_configuration) /* QCI not supported */
+- return 1;
++ /* only ids 0...3F may be probed */
++ return id < 0x40 ? 1 : 0;
+ return ap_test_config(ap_configuration->apm, id);
+ }
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 0a27917263aa..58b78702c6c9 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2970,9 +2970,6 @@ static void sd_read_block_characteristics(struct scsi_disk *sdkp)
+ if (rot == 1) {
+ blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
+ blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, q);
+- } else {
+- blk_queue_flag_clear(QUEUE_FLAG_NONROT, q);
+- blk_queue_flag_set(QUEUE_FLAG_ADD_RANDOM, q);
+ }
+
+ if (sdkp->device->type == TYPE_ZBC) {
+@@ -3109,6 +3106,15 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ if (sdkp->media_present) {
+ sd_read_capacity(sdkp, buffer);
+
++ /*
++ * set the default to rotational. All non-rotational devices
++ * support the block characteristics VPD page, which will
++ * cause this to be updated correctly and any device which
++ * doesn't support it should be treated as rotational.
++ */
++ blk_queue_flag_clear(QUEUE_FLAG_NONROT, q);
++ blk_queue_flag_set(QUEUE_FLAG_ADD_RANDOM, q);
++
+ if (scsi_device_supports_vpd(sdp)) {
+ sd_read_block_provisioning(sdkp);
+ sd_read_block_limits(sdkp);
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 7b637fc27990..23db881daab5 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -1128,6 +1128,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
+ return -EINVAL;
+ }
+
++ BUILD_BUG_ON(sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE) >
++ PAGE_SIZE);
++ max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr),
++ PAGE_SIZE);
+ max_num = (max_buf - sizeof(struct smb_hdr)) /
+ sizeof(LOCKING_ANDX_RANGE);
+ buf = kcalloc(max_num, sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL);
+@@ -1466,6 +1470,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+ if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE)))
+ return -EINVAL;
+
++ BUILD_BUG_ON(sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE) >
++ PAGE_SIZE);
++ max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr),
++ PAGE_SIZE);
+ max_num = (max_buf - sizeof(struct smb_hdr)) /
+ sizeof(LOCKING_ANDX_RANGE);
+ buf = kcalloc(max_num, sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL);
+diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
+index 2fc3d31967ee..b204e84b87fb 100644
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -128,6 +128,8 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+ if (max_buf < sizeof(struct smb2_lock_element))
+ return -EINVAL;
+
++ BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
++ max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
+ max_num = max_buf / sizeof(struct smb2_lock_element);
+ buf = kcalloc(max_num, sizeof(struct smb2_lock_element), GFP_KERNEL);
+ if (!buf)
+@@ -264,6 +266,8 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile)
+ return -EINVAL;
+ }
+
++ BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
++ max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
+ max_num = max_buf / sizeof(struct smb2_lock_element);
+ buf = kcalloc(max_num, sizeof(struct smb2_lock_element), GFP_KERNEL);
+ if (!buf) {
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 8a01e89ff827..1e5a1171212f 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2814,9 +2814,10 @@ smb2_echo_callback(struct mid_q_entry *mid)
+ {
+ struct TCP_Server_Info *server = mid->callback_data;
+ struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf;
+- unsigned int credits_received = 1;
++ unsigned int credits_received = 0;
+
+- if (mid->mid_state == MID_RESPONSE_RECEIVED)
++ if (mid->mid_state == MID_RESPONSE_RECEIVED
++ || mid->mid_state == MID_RESPONSE_MALFORMED)
+ credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest);
+
+ DeleteMidQEntry(mid);
+@@ -3073,7 +3074,7 @@ smb2_readv_callback(struct mid_q_entry *mid)
+ struct TCP_Server_Info *server = tcon->ses->server;
+ struct smb2_sync_hdr *shdr =
+ (struct smb2_sync_hdr *)rdata->iov[0].iov_base;
+- unsigned int credits_received = 1;
++ unsigned int credits_received = 0;
+ struct smb_rqst rqst = { .rq_iov = rdata->iov,
+ .rq_nvec = 2,
+ .rq_pages = rdata->pages,
+@@ -3112,6 +3113,9 @@ smb2_readv_callback(struct mid_q_entry *mid)
+ task_io_account_read(rdata->got_bytes);
+ cifs_stats_bytes_read(tcon, rdata->got_bytes);
+ break;
++ case MID_RESPONSE_MALFORMED:
++ credits_received = le16_to_cpu(shdr->CreditRequest);
++ /* fall through */
+ default:
+ if (rdata->result != -ENODATA)
+ rdata->result = -EIO;
+@@ -3305,7 +3309,7 @@ smb2_writev_callback(struct mid_q_entry *mid)
+ struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
+ unsigned int written;
+ struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
+- unsigned int credits_received = 1;
++ unsigned int credits_received = 0;
+
+ switch (mid->mid_state) {
+ case MID_RESPONSE_RECEIVED:
+@@ -3333,6 +3337,9 @@ smb2_writev_callback(struct mid_q_entry *mid)
+ case MID_RETRY_NEEDED:
+ wdata->result = -EAGAIN;
+ break;
++ case MID_RESPONSE_MALFORMED:
++ credits_received = le16_to_cpu(rsp->sync_hdr.CreditRequest);
++ /* fall through */
+ default:
+ wdata->result = -EIO;
+ break;
+diff --git a/fs/inode.c b/fs/inode.c
+index 65ae154df760..42f6d25f32a5 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -730,11 +730,8 @@ static enum lru_status inode_lru_isolate(struct list_head *item,
+ return LRU_REMOVED;
+ }
+
+- /*
+- * Recently referenced inodes and inodes with many attached pages
+- * get one more pass.
+- */
+- if (inode->i_state & I_REFERENCED || inode->i_data.nrpages > 1) {
++ /* recently referenced inodes get one more pass */
++ if (inode->i_state & I_REFERENCED) {
+ inode->i_state &= ~I_REFERENCED;
+ spin_unlock(&inode->i_lock);
+ return LRU_ROTATE;
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index 899174c7a8ae..39b835d7c445 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -1239,8 +1239,8 @@ static __net_init int nfsd_init_net(struct net *net)
+ retval = nfsd_idmap_init(net);
+ if (retval)
+ goto out_idmap_error;
+- nn->nfsd4_lease = 45; /* default lease time */
+- nn->nfsd4_grace = 45;
++ nn->nfsd4_lease = 90; /* default lease time */
++ nn->nfsd4_grace = 90;
+ nn->somebody_reclaimed = false;
+ nn->clverifier_counter = prandom_u32();
+ nn->clientid_counter = prandom_u32();
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index a027473561c6..d76fe166f6ce 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -423,7 +423,7 @@ struct mem_size_stats {
+ };
+
+ static void smaps_account(struct mem_size_stats *mss, struct page *page,
+- bool compound, bool young, bool dirty)
++ bool compound, bool young, bool dirty, bool locked)
+ {
+ int i, nr = compound ? 1 << compound_order(page) : 1;
+ unsigned long size = nr * PAGE_SIZE;
+@@ -450,24 +450,31 @@ static void smaps_account(struct mem_size_stats *mss, struct page *page,
+ else
+ mss->private_clean += size;
+ mss->pss += (u64)size << PSS_SHIFT;
++ if (locked)
++ mss->pss_locked += (u64)size << PSS_SHIFT;
+ return;
+ }
+
+ for (i = 0; i < nr; i++, page++) {
+ int mapcount = page_mapcount(page);
++ unsigned long pss = (PAGE_SIZE << PSS_SHIFT);
+
+ if (mapcount >= 2) {
+ if (dirty || PageDirty(page))
+ mss->shared_dirty += PAGE_SIZE;
+ else
+ mss->shared_clean += PAGE_SIZE;
+- mss->pss += (PAGE_SIZE << PSS_SHIFT) / mapcount;
++ mss->pss += pss / mapcount;
++ if (locked)
++ mss->pss_locked += pss / mapcount;
+ } else {
+ if (dirty || PageDirty(page))
+ mss->private_dirty += PAGE_SIZE;
+ else
+ mss->private_clean += PAGE_SIZE;
+- mss->pss += PAGE_SIZE << PSS_SHIFT;
++ mss->pss += pss;
++ if (locked)
++ mss->pss_locked += pss;
+ }
+ }
+ }
+@@ -490,6 +497,7 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr,
+ {
+ struct mem_size_stats *mss = walk->private;
+ struct vm_area_struct *vma = walk->vma;
++ bool locked = !!(vma->vm_flags & VM_LOCKED);
+ struct page *page = NULL;
+
+ if (pte_present(*pte)) {
+@@ -532,7 +540,7 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr,
+ if (!page)
+ return;
+
+- smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte));
++ smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte), locked);
+ }
+
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+@@ -541,6 +549,7 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
+ {
+ struct mem_size_stats *mss = walk->private;
+ struct vm_area_struct *vma = walk->vma;
++ bool locked = !!(vma->vm_flags & VM_LOCKED);
+ struct page *page;
+
+ /* FOLL_DUMP will return -EFAULT on huge zero page */
+@@ -555,7 +564,7 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
+ /* pass */;
+ else
+ VM_BUG_ON_PAGE(1, page);
+- smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd));
++ smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd), locked);
+ }
+ #else
+ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
+@@ -737,11 +746,8 @@ static void smap_gather_stats(struct vm_area_struct *vma,
+ }
+ }
+ #endif
+-
+ /* mmap_sem is held in m_start */
+ walk_page_vma(vma, &smaps_walk);
+- if (vma->vm_flags & VM_LOCKED)
+- mss->pss_locked += mss->pss;
+ }
+
+ #define SEQ_PUT_DEC(str, val) \
+diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
+index de7377815b6b..8ef330027b13 100644
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -308,6 +308,7 @@ struct mmc_card {
+ unsigned int nr_parts;
+
+ unsigned int bouncesz; /* Bounce buffer size */
++ struct workqueue_struct *complete_wq; /* Private workqueue */
+ };
+
+ static inline bool mmc_large_sector(struct mmc_card *card)
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index 53c500f0ca79..c2876e740514 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -447,6 +447,11 @@ struct pmu {
+ * Filter events for PMU-specific reasons.
+ */
+ int (*filter_match) (struct perf_event *event); /* optional */
++
++ /*
++ * Check period value for PERF_EVENT_IOC_PERIOD ioctl.
++ */
++ int (*check_period) (struct perf_event *event, u64 value); /* optional */
+ };
+
+ enum perf_addr_filter_action_t {
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 5a97f34bc14c..4fb9d5054618 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4963,6 +4963,11 @@ static void __perf_event_period(struct perf_event *event,
+ }
+ }
+
++static int perf_event_check_period(struct perf_event *event, u64 value)
++{
++ return event->pmu->check_period(event, value);
++}
++
+ static int perf_event_period(struct perf_event *event, u64 __user *arg)
+ {
+ u64 value;
+@@ -4979,6 +4984,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
+ if (event->attr.freq && value > sysctl_perf_event_sample_rate)
+ return -EINVAL;
+
++ if (perf_event_check_period(event, value))
++ return -EINVAL;
++
+ event_function_call(event, __perf_event_period, &value);
+
+ return 0;
+@@ -9362,6 +9370,11 @@ static int perf_pmu_nop_int(struct pmu *pmu)
+ return 0;
+ }
+
++static int perf_event_nop_int(struct perf_event *event, u64 value)
++{
++ return 0;
++}
++
+ static DEFINE_PER_CPU(unsigned int, nop_txn_flags);
+
+ static void perf_pmu_start_txn(struct pmu *pmu, unsigned int flags)
+@@ -9662,6 +9675,9 @@ got_cpu_context:
+ pmu->pmu_disable = perf_pmu_nop_void;
+ }
+
++ if (!pmu->check_period)
++ pmu->check_period = perf_event_nop_int;
++
+ if (!pmu->event_idx)
+ pmu->event_idx = perf_event_idx_default;
+
+diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
+index 51386d9105fa..5631af940316 100644
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -724,7 +724,7 @@ struct ring_buffer *rb_alloc(int nr_pages, long watermark, int cpu, int flags)
+ size = sizeof(struct ring_buffer);
+ size += nr_pages * sizeof(void *);
+
+- if (order_base_2(size) >= MAX_ORDER)
++ if (order_base_2(size) >= PAGE_SHIFT+MAX_ORDER)
+ goto fail;
+
+ rb = kzalloc(size, GFP_KERNEL);
+diff --git a/kernel/signal.c b/kernel/signal.c
+index c187def3dba6..9102d60fc5c6 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -2433,9 +2433,12 @@ relock:
+ }
+
+ /* Has this task already been marked for death? */
+- ksig->info.si_signo = signr = SIGKILL;
+- if (signal_group_exit(signal))
++ if (signal_group_exit(signal)) {
++ ksig->info.si_signo = signr = SIGKILL;
++ sigdelset(¤t->pending.signal, SIGKILL);
++ recalc_sigpending();
+ goto fatal;
++ }
+
+ for (;;) {
+ struct k_sigaction *ka;
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index a6aebbc848fe..0da379b90249 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -141,7 +141,14 @@ static void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
+
+ ret = strncpy_from_user(dst, src, maxlen);
+ if (ret == maxlen)
+- dst[--ret] = '\0';
++ dst[ret - 1] = '\0';
++ else if (ret >= 0)
++ /*
++ * Include the terminating null byte. In this case it
++ * was copied by strncpy_from_user but not accounted
++ * for in ret.
++ */
++ ret++;
+
+ if (ret < 0) { /* Failed to fetch string */
+ ((u8 *)get_rloc_data(dest))[0] = '\0';
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 961401c46334..3830066018c1 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -477,16 +477,6 @@ static unsigned long do_shrink_slab(struct shrink_control *shrinkctl,
+ delta *= 4;
+ do_div(delta, shrinker->seeks);
+
+- /*
+- * Make sure we apply some minimal pressure on default priority
+- * even on small cgroups. Stale objects are not only consuming memory
+- * by themselves, but can also hold a reference to a dying cgroup,
+- * preventing it from being reclaimed. A dying cgroup with all
+- * corresponding structures like per-cpu stats and kmem caches
+- * can be really big, so it may lead to a significant waste of memory.
+- */
+- delta = max_t(unsigned long long, delta, min(freeable, batch_size));
+-
+ total_scan += delta;
+ if (total_scan < 0) {
+ pr_err("shrink_slab: %pF negative objects to delete nr=%ld\n",
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 31a84a5a1338..fead0acb29f7 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -924,6 +924,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
++ SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
+diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
+index d00734d31e04..e5b6769b9797 100644
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -795,6 +795,8 @@ static int hdmi_codec_probe(struct platform_device *pdev)
+ if (hcd->spdif)
+ hcp->daidrv[i] = hdmi_spdif_dai;
+
++ dev_set_drvdata(dev, hcp);
++
+ ret = devm_snd_soc_register_component(dev, &hdmi_driver, hcp->daidrv,
+ dai_count);
+ if (ret) {
+@@ -802,8 +804,6 @@ static int hdmi_codec_probe(struct platform_device *pdev)
+ __func__, ret);
+ return ret;
+ }
+-
+- dev_set_drvdata(dev, hcp);
+ return 0;
+ }
+
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 382847154227..db114f3977e0 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -314,6 +314,9 @@ static int search_roland_implicit_fb(struct usb_device *dev, int ifnum,
+ return 0;
+ }
+
++/* Setup an implicit feedback endpoint from a quirk. Returns 0 if no quirk
++ * applies. Returns 1 if a quirk was found.
++ */
+ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ struct usb_device *dev,
+ struct usb_interface_descriptor *altsd,
+@@ -384,7 +387,7 @@ add_sync_ep:
+
+ subs->data_endpoint->sync_master = subs->sync_endpoint;
+
+- return 0;
++ return 1;
+ }
+
+ static int set_sync_endpoint(struct snd_usb_substream *subs,
+@@ -423,6 +426,10 @@ static int set_sync_endpoint(struct snd_usb_substream *subs,
+ if (err < 0)
+ return err;
+
++ /* endpoint set by quirk */
++ if (err > 0)
++ return 0;
++
+ if (altsd->bNumEndpoints < 2)
+ return 0;
+
+diff --git a/tools/arch/riscv/include/uapi/asm/bitsperlong.h b/tools/arch/riscv/include/uapi/asm/bitsperlong.h
+new file mode 100644
+index 000000000000..0b3cb52fd29d
+--- /dev/null
++++ b/tools/arch/riscv/include/uapi/asm/bitsperlong.h
+@@ -0,0 +1,25 @@
++/*
++ * Copyright (C) 2012 ARM Ltd.
++ * Copyright (C) 2015 Regents of the University of California
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program. If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef _UAPI_ASM_RISCV_BITSPERLONG_H
++#define _UAPI_ASM_RISCV_BITSPERLONG_H
++
++#define __BITS_PER_LONG (__SIZEOF_POINTER__ * 8)
++
++#include <asm-generic/bitsperlong.h>
++
++#endif /* _UAPI_ASM_RISCV_BITSPERLONG_H */
+diff --git a/tools/include/uapi/asm/bitsperlong.h b/tools/include/uapi/asm/bitsperlong.h
+index 8dd6aefdafa4..57aaeaf8e192 100644
+--- a/tools/include/uapi/asm/bitsperlong.h
++++ b/tools/include/uapi/asm/bitsperlong.h
+@@ -13,6 +13,10 @@
+ #include "../../arch/mips/include/uapi/asm/bitsperlong.h"
+ #elif defined(__ia64__)
+ #include "../../arch/ia64/include/uapi/asm/bitsperlong.h"
++#elif defined(__riscv)
++#include "../../arch/riscv/include/uapi/asm/bitsperlong.h"
++#elif defined(__alpha__)
++#include "../../arch/alpha/include/uapi/asm/bitsperlong.h"
+ #else
+ #include <asm-generic/bitsperlong.h>
+ #endif
+diff --git a/tools/perf/tests/shell/lib/probe_vfs_getname.sh b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
+index 1c16e56cd93e..7cb99b433888 100644
+--- a/tools/perf/tests/shell/lib/probe_vfs_getname.sh
++++ b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
+@@ -13,7 +13,8 @@ add_probe_vfs_getname() {
+ local verbose=$1
+ if [ $had_vfs_getname -eq 1 ] ; then
+ line=$(perf probe -L getname_flags 2>&1 | egrep 'result.*=.*filename;' | sed -r 's/[[:space:]]+([[:digit:]]+)[[:space:]]+result->uptr.*/\1/')
+- perf probe $verbose "vfs_getname=getname_flags:${line} pathname=result->name:string"
++ perf probe -q "vfs_getname=getname_flags:${line} pathname=result->name:string" || \
++ perf probe $verbose "vfs_getname=getname_flags:${line} pathname=filename:string"
+ fi
+ }
+
+diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
+index 32ef7bdca1cf..dc2212e12184 100644
+--- a/tools/perf/util/callchain.c
++++ b/tools/perf/util/callchain.c
+@@ -766,6 +766,7 @@ static enum match_result match_chain(struct callchain_cursor_node *node,
+ cnode->cycles_count += node->branch_flags.cycles;
+ cnode->iter_count += node->nr_loop_iter;
+ cnode->iter_cycles += node->iter_cycles;
++ cnode->from_count++;
+ }
+ }
+
+@@ -1345,10 +1346,10 @@ static int branch_to_str(char *bf, int bfsize,
+ static int branch_from_str(char *bf, int bfsize,
+ u64 branch_count,
+ u64 cycles_count, u64 iter_count,
+- u64 iter_cycles)
++ u64 iter_cycles, u64 from_count)
+ {
+ int printed = 0, i = 0;
+- u64 cycles;
++ u64 cycles, v = 0;
+
+ cycles = cycles_count / branch_count;
+ if (cycles) {
+@@ -1357,14 +1358,16 @@ static int branch_from_str(char *bf, int bfsize,
+ bf + printed, bfsize - printed);
+ }
+
+- if (iter_count) {
+- printed += count_pri64_printf(i++, "iter",
+- iter_count,
+- bf + printed, bfsize - printed);
++ if (iter_count && from_count) {
++ v = iter_count / from_count;
++ if (v) {
++ printed += count_pri64_printf(i++, "iter",
++ v, bf + printed, bfsize - printed);
+
+- printed += count_pri64_printf(i++, "avg_cycles",
+- iter_cycles / iter_count,
+- bf + printed, bfsize - printed);
++ printed += count_pri64_printf(i++, "avg_cycles",
++ iter_cycles / iter_count,
++ bf + printed, bfsize - printed);
++ }
+ }
+
+ if (i)
+@@ -1377,6 +1380,7 @@ static int counts_str_build(char *bf, int bfsize,
+ u64 branch_count, u64 predicted_count,
+ u64 abort_count, u64 cycles_count,
+ u64 iter_count, u64 iter_cycles,
++ u64 from_count,
+ struct branch_type_stat *brtype_stat)
+ {
+ int printed;
+@@ -1389,7 +1393,8 @@ static int counts_str_build(char *bf, int bfsize,
+ predicted_count, abort_count, brtype_stat);
+ } else {
+ printed = branch_from_str(bf, bfsize, branch_count,
+- cycles_count, iter_count, iter_cycles);
++ cycles_count, iter_count, iter_cycles,
++ from_count);
+ }
+
+ if (!printed)
+@@ -1402,13 +1407,14 @@ static int callchain_counts_printf(FILE *fp, char *bf, int bfsize,
+ u64 branch_count, u64 predicted_count,
+ u64 abort_count, u64 cycles_count,
+ u64 iter_count, u64 iter_cycles,
++ u64 from_count,
+ struct branch_type_stat *brtype_stat)
+ {
+ char str[256];
+
+ counts_str_build(str, sizeof(str), branch_count,
+ predicted_count, abort_count, cycles_count,
+- iter_count, iter_cycles, brtype_stat);
++ iter_count, iter_cycles, from_count, brtype_stat);
+
+ if (fp)
+ return fprintf(fp, "%s", str);
+@@ -1422,6 +1428,7 @@ int callchain_list_counts__printf_value(struct callchain_list *clist,
+ u64 branch_count, predicted_count;
+ u64 abort_count, cycles_count;
+ u64 iter_count, iter_cycles;
++ u64 from_count;
+
+ branch_count = clist->branch_count;
+ predicted_count = clist->predicted_count;
+@@ -1429,11 +1436,12 @@ int callchain_list_counts__printf_value(struct callchain_list *clist,
+ cycles_count = clist->cycles_count;
+ iter_count = clist->iter_count;
+ iter_cycles = clist->iter_cycles;
++ from_count = clist->from_count;
+
+ return callchain_counts_printf(fp, bf, bfsize, branch_count,
+ predicted_count, abort_count,
+ cycles_count, iter_count, iter_cycles,
+- &clist->brtype_stat);
++ from_count, &clist->brtype_stat);
+ }
+
+ static void free_callchain_node(struct callchain_node *node)
+diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
+index 154560b1eb65..99d38ac019b8 100644
+--- a/tools/perf/util/callchain.h
++++ b/tools/perf/util/callchain.h
+@@ -118,6 +118,7 @@ struct callchain_list {
+ bool has_children;
+ };
+ u64 branch_count;
++ u64 from_count;
+ u64 predicted_count;
+ u64 abort_count;
+ u64 cycles_count;
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index d7403d1207d7..b1508ce3e412 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -1988,7 +1988,7 @@ static void save_iterations(struct iterations *iter,
+ {
+ int i;
+
+- iter->nr_loop_iter = nr;
++ iter->nr_loop_iter++;
+ iter->cycles = 0;
+
+ for (i = 0; i < nr; i++)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-02-23 0:46 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-02-23 0:46 UTC (permalink / raw
To: gentoo-commits
commit: 564bafd878ddeefd002deec035c751024695cd73
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 23 00:45:27 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Feb 23 00:45:27 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=564bafd8
proj/linux-patches: cpu optimization patch for gcc v8
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
5011_enable-cpu-optimizations-for-gcc8.patch | 569 +++++++++++++++++++++++++++
2 files changed, 573 insertions(+)
diff --git a/0000_README b/0000_README
index 62f98e4..4b56fba 100644
--- a/0000_README
+++ b/0000_README
@@ -170,3 +170,7 @@ Desc: Add Gentoo Linux support config settings and defaults.
Patch: 5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
From: https://github.com/graysky2/kernel_gcc_patch/
Desc: Kernel patch enables gcc >= v4.13 optimizations for additional CPUs.
+
+Patch: 5011_enable-cpu-optimizations-for-gcc8.patch
+From: https://github.com/graysky2/kernel_gcc_patch/
+Desc: Kernel patch for >= gccv8 enables kernel >= v4.13 optimizations for additional CPUs.
diff --git a/5011_enable-cpu-optimizations-for-gcc8.patch b/5011_enable-cpu-optimizations-for-gcc8.patch
new file mode 100644
index 0000000..bfd2065
--- /dev/null
+++ b/5011_enable-cpu-optimizations-for-gcc8.patch
@@ -0,0 +1,569 @@
+WARNING
+This patch works with gcc versions 8.1+ and with kernel version 4.13+ and should
+NOT be applied when compiling on older versions of gcc due to key name changes
+of the march flags introduced with the version 4.9 release of gcc.[1]
+
+Use the older version of this patch hosted on the same github for older
+versions of gcc.
+
+FEATURES
+This patch adds additional CPU options to the Linux kernel accessible under:
+ Processor type and features --->
+ Processor family --->
+
+The expanded microarchitectures include:
+* AMD Improved K8-family
+* AMD K10-family
+* AMD Family 10h (Barcelona)
+* AMD Family 14h (Bobcat)
+* AMD Family 16h (Jaguar)
+* AMD Family 15h (Bulldozer)
+* AMD Family 15h (Piledriver)
+* AMD Family 15h (Steamroller)
+* AMD Family 15h (Excavator)
+* AMD Family 17h (Zen)
+* Intel Silvermont low-power processors
+* Intel 1st Gen Core i3/i5/i7 (Nehalem)
+* Intel 1.5 Gen Core i3/i5/i7 (Westmere)
+* Intel 2nd Gen Core i3/i5/i7 (Sandybridge)
+* Intel 3rd Gen Core i3/i5/i7 (Ivybridge)
+* Intel 4th Gen Core i3/i5/i7 (Haswell)
+* Intel 5th Gen Core i3/i5/i7 (Broadwell)
+* Intel 6th Gen Core i3/i5/i7 (Skylake)
+* Intel 6th Gen Core i7/i9 (Skylake X)
+* Intel 8th Gen Core i3/i5/i7 (Cannon Lake)
+* Intel 8th Gen Core i7/i9 (Ice Lake)
+
+It also offers to compile passing the 'native' option which, "selects the CPU
+to generate code for at compilation time by determining the processor type of
+the compiling machine. Using -march=native enables all instruction subsets
+supported by the local machine and will produce code optimized for the local
+machine under the constraints of the selected instruction set."[3]
+
+MINOR NOTES
+This patch also changes 'atom' to 'bonnell' in accordance with the gcc v4.9
+changes. Note that upstream is using the deprecated 'match=atom' flags when I
+believe it should use the newer 'march=bonnell' flag for atom processors.[2]
+
+It is not recommended to compile on Atom-CPUs with the 'native' option.[4] The
+recommendation is to use the 'atom' option instead.
+
+BENEFITS
+Small but real speed increases are measurable using a make endpoint comparing
+a generic kernel to one built with one of the respective microarchs.
+
+See the following experimental evidence supporting this statement:
+https://github.com/graysky2/kernel_gcc_patch
+
+REQUIREMENTS
+linux version >=4.20
+gcc version >=8.1
+
+ACKNOWLEDGMENTS
+This patch builds on the seminal work by Jeroen.[5]
+
+REFERENCES
+1. https://gcc.gnu.org/gcc-4.9/changes.html
+2. https://bugzilla.kernel.org/show_bug.cgi?id=77461
+3. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
+4. https://github.com/graysky2/kernel_gcc_patch/issues/15
+5. http://www.linuxforge.net/docs/linux/linux-gcc.php
+
+--- a/arch/x86/Makefile_32.cpu 2019-02-22 09:22:03.426937735 -0500
++++ b/arch/x86/Makefile_32.cpu 2019-02-22 09:37:58.680968580 -0500
+@@ -23,7 +23,18 @@ cflags-$(CONFIG_MK6) += -march=k6
+ # Please note, that patches that add -march=athlon-xp and friends are pointless.
+ # They make zero difference whatsosever to performance at this time.
+ cflags-$(CONFIG_MK7) += -march=athlon
++cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
+ cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8,-march=athlon)
++cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-march=athlon)
++cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10,-march=athlon)
++cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona,-march=athlon)
++cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1,-march=athlon)
++cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2,-march=athlon)
++cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1,-march=athlon)
++cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2,-march=athlon)
++cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3,-march=athlon)
++cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4,-march=athlon)
++cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1,-march=athlon)
+ cflags-$(CONFIG_MCRUSOE) += -march=i686 -falign-functions=0 -falign-jumps=0 -falign-loops=0
+ cflags-$(CONFIG_MEFFICEON) += -march=i686 $(call tune,pentium3) -falign-functions=0 -falign-jumps=0 -falign-loops=0
+ cflags-$(CONFIG_MWINCHIPC6) += $(call cc-option,-march=winchip-c6,-march=i586)
+@@ -32,9 +43,20 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
+ cflags-$(CONFIG_MVIAC3_2) += $(call cc-option,-march=c3-2,-march=i686)
+ cflags-$(CONFIG_MVIAC7) += -march=i686
+ cflags-$(CONFIG_MCORE2) += -march=i686 $(call tune,core2)
+-cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom,$(call cc-option,-march=core2,-march=i686)) \
+- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
+-
++cflags-$(CONFIG_MNEHALEM) += -march=i686 $(call tune,nehalem)
++cflags-$(CONFIG_MWESTMERE) += -march=i686 $(call tune,westmere)
++cflags-$(CONFIG_MSILVERMONT) += -march=i686 $(call tune,silvermont)
++cflags-$(CONFIG_MSANDYBRIDGE) += -march=i686 $(call tune,sandybridge)
++cflags-$(CONFIG_MIVYBRIDGE) += -march=i686 $(call tune,ivybridge)
++cflags-$(CONFIG_MHASWELL) += -march=i686 $(call tune,haswell)
++cflags-$(CONFIG_MBROADWELL) += -march=i686 $(call tune,broadwell)
++cflags-$(CONFIG_MSKYLAKE) += -march=i686 $(call tune,skylake)
++cflags-$(CONFIG_MSKYLAKEX) += -march=i686 $(call tune,skylake-avx512)
++cflags-$(CONFIG_MCANNONLAKE) += -march=i686 $(call tune,cannonlake)
++cflags-$(CONFIG_MICELAKE) += -march=i686 $(call tune,icelake)
++cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell,$(call cc-option,-march=core2,-march=i686)) \
++ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
++
+ # AMD Elan support
+ cflags-$(CONFIG_MELAN) += -march=i486
+
+--- a/arch/x86/Kconfig.cpu 2019-02-22 09:22:11.576958595 -0500
++++ b/arch/x86/Kconfig.cpu 2019-02-22 09:34:16.490003911 -0500
+@@ -116,6 +116,7 @@ config MPENTIUMM
+ config MPENTIUM4
+ bool "Pentium-4/Celeron(P4-based)/Pentium-4 M/older Xeon"
+ depends on X86_32
++ select X86_P6_NOP
+ ---help---
+ Select this for Intel Pentium 4 chips. This includes the
+ Pentium 4, Pentium D, P4-based Celeron and Xeon, and
+@@ -150,7 +151,7 @@ config MPENTIUM4
+
+
+ config MK6
+- bool "K6/K6-II/K6-III"
++ bool "AMD K6/K6-II/K6-III"
+ depends on X86_32
+ ---help---
+ Select this for an AMD K6-family processor. Enables use of
+@@ -158,7 +159,7 @@ config MK6
+ flags to GCC.
+
+ config MK7
+- bool "Athlon/Duron/K7"
++ bool "AMD Athlon/Duron/K7"
+ depends on X86_32
+ ---help---
+ Select this for an AMD Athlon K7-family processor. Enables use of
+@@ -166,11 +167,81 @@ config MK7
+ flags to GCC.
+
+ config MK8
+- bool "Opteron/Athlon64/Hammer/K8"
++ bool "AMD Opteron/Athlon64/Hammer/K8"
+ ---help---
+ Select this for an AMD Opteron or Athlon64 Hammer-family processor.
+ Enables use of some extended instructions, and passes appropriate
+ optimization flags to GCC.
++config MK8SSE3
++ bool "AMD Opteron/Athlon64/Hammer/K8 with SSE3"
++ ---help---
++ Select this for improved AMD Opteron or Athlon64 Hammer-family processors.
++ Enables use of some extended instructions, and passes appropriate
++ optimization flags to GCC.
++
++config MK10
++ bool "AMD 61xx/7x50/PhenomX3/X4/II/K10"
++ ---help---
++ Select this for an AMD 61xx Eight-Core Magny-Cours, Athlon X2 7x50,
++ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
++ Enables use of some extended instructions, and passes appropriate
++ optimization flags to GCC.
++
++config MBARCELONA
++ bool "AMD Barcelona"
++ ---help---
++ Select this for AMD Family 10h Barcelona processors.
++
++ Enables -march=barcelona
++
++config MBOBCAT
++ bool "AMD Bobcat"
++ ---help---
++ Select this for AMD Family 14h Bobcat processors.
++
++ Enables -march=btver1
++
++config MJAGUAR
++ bool "AMD Jaguar"
++ ---help---
++ Select this for AMD Family 16h Jaguar processors.
++
++ Enables -march=btver2
++
++config MBULLDOZER
++ bool "AMD Bulldozer"
++ ---help---
++ Select this for AMD Family 15h Bulldozer processors.
++
++ Enables -march=bdver1
++
++config MPILEDRIVER
++ bool "AMD Piledriver"
++ ---help---
++ Select this for AMD Family 15h Piledriver processors.
++
++ Enables -march=bdver2
++
++config MSTEAMROLLER
++ bool "AMD Steamroller"
++ ---help---
++ Select this for AMD Family 15h Steamroller processors.
++
++ Enables -march=bdver3
++
++config MEXCAVATOR
++ bool "AMD Excavator"
++ ---help---
++ Select this for AMD Family 15h Excavator processors.
++
++ Enables -march=bdver4
++
++config MZEN
++ bool "AMD Zen"
++ ---help---
++ Select this for AMD Family 17h Zen processors.
++
++ Enables -march=znver1
+
+ config MCRUSOE
+ bool "Crusoe"
+@@ -253,6 +324,7 @@ config MVIAC7
+
+ config MPSC
+ bool "Intel P4 / older Netburst based Xeon"
++ select X86_P6_NOP
+ depends on X86_64
+ ---help---
+ Optimize for Intel Pentium 4, Pentium D and older Nocona/Dempsey
+@@ -262,23 +334,126 @@ config MPSC
+ using the cpu family field
+ in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
+
++config MATOM
++ bool "Intel Atom"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Atom platform. Intel Atom CPUs have an
++ in-order pipelining architecture and thus can benefit from
++ accordingly optimized code. Use a recent GCC with specific Atom
++ support in order to fully benefit from selecting this option.
++
+ config MCORE2
+- bool "Core 2/newer Xeon"
++ bool "Intel Core 2"
++ select X86_P6_NOP
++
+ ---help---
+
+ Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
+ 53xx) CPUs. You can distinguish newer from older Xeons by the CPU
+ family in /proc/cpuinfo. Newer ones have 6 and older ones 15
+ (not a typo)
++ Enables -march=core2
+
+-config MATOM
+- bool "Intel Atom"
++config MNEHALEM
++ bool "Intel Nehalem"
++ select X86_P6_NOP
+ ---help---
+
+- Select this for the Intel Atom platform. Intel Atom CPUs have an
+- in-order pipelining architecture and thus can benefit from
+- accordingly optimized code. Use a recent GCC with specific Atom
+- support in order to fully benefit from selecting this option.
++ Select this for 1st Gen Core processors in the Nehalem family.
++
++ Enables -march=nehalem
++
++config MWESTMERE
++ bool "Intel Westmere"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Westmere formerly Nehalem-C family.
++
++ Enables -march=westmere
++
++config MSILVERMONT
++ bool "Intel Silvermont"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Silvermont platform.
++
++ Enables -march=silvermont
++
++config MSANDYBRIDGE
++ bool "Intel Sandy Bridge"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 2nd Gen Core processors in the Sandy Bridge family.
++
++ Enables -march=sandybridge
++
++config MIVYBRIDGE
++ bool "Intel Ivy Bridge"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 3rd Gen Core processors in the Ivy Bridge family.
++
++ Enables -march=ivybridge
++
++config MHASWELL
++ bool "Intel Haswell"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 4th Gen Core processors in the Haswell family.
++
++ Enables -march=haswell
++
++config MBROADWELL
++ bool "Intel Broadwell"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 5th Gen Core processors in the Broadwell family.
++
++ Enables -march=broadwell
++
++config MSKYLAKE
++ bool "Intel Skylake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 6th Gen Core processors in the Skylake family.
++
++ Enables -march=skylake
++
++config MSKYLAKEX
++ bool "Intel Skylake X"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 6th Gen Core processors in the Skylake X family.
++
++ Enables -march=skylake-avx512
++
++config MCANNONLAKE
++ bool "Intel Cannon Lake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 8th Gen Core processors
++
++ Enables -march=cannonlake
++
++config MICELAKE
++ bool "Intel Ice Lake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 8th Gen Core processors in the Ice Lake family.
++
++ Enables -march=icelake
+
+ config GENERIC_CPU
+ bool "Generic-x86-64"
+@@ -287,6 +462,19 @@ config GENERIC_CPU
+ Generic x86-64 CPU.
+ Run equally well on all x86-64 CPUs.
+
++config MNATIVE
++ bool "Native optimizations autodetected by GCC"
++ ---help---
++
++ GCC 4.2 and above support -march=native, which automatically detects
++ the optimum settings to use based on your processor. -march=native
++ also detects and applies additional settings beyond -march specific
++ to your CPU, (eg. -msse4). Unless you have a specific reason not to
++ (e.g. distcc cross-compiling), you should probably be using
++ -march=native rather than anything listed below.
++
++ Enables -march=native
++
+ endchoice
+
+ config X86_GENERIC
+@@ -311,7 +499,7 @@ config X86_INTERNODE_CACHE_SHIFT
+ config X86_L1_CACHE_SHIFT
+ int
+ default "7" if MPENTIUM4 || MPSC
+- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
++ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
+ default "4" if MELAN || M486 || MGEODEGX1
+ default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
+
+@@ -329,39 +517,40 @@ config X86_ALIGNMENT_16
+
+ config X86_INTEL_USERCOPY
+ def_bool y
+- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
++ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MNATIVE
+
+ config X86_USE_PPRO_CHECKSUM
+ def_bool y
+- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
++ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MATOM || MNATIVE
+
+ config X86_USE_3DNOW
+ def_bool y
+ depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
+
+-#
+-# P6_NOPs are a relatively minor optimization that require a family >=
+-# 6 processor, except that it is broken on certain VIA chips.
+-# Furthermore, AMD chips prefer a totally different sequence of NOPs
+-# (which work on all CPUs). In addition, it looks like Virtual PC
+-# does not understand them.
+-#
+-# As a result, disallow these if we're not compiling for X86_64 (these
+-# NOPs do work on all x86-64 capable chips); the list of processors in
+-# the right-hand clause are the cores that benefit from this optimization.
+-#
+ config X86_P6_NOP
+- def_bool y
+- depends on X86_64
+- depends on (MCORE2 || MPENTIUM4 || MPSC)
++ default n
++ bool "Support for P6_NOPs on Intel chips"
++ depends on (MCORE2 || MPENTIUM4 || MPSC || MATOM || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MNATIVE)
++ ---help---
++ P6_NOPs are a relatively minor optimization that require a family >=
++ 6 processor, except that it is broken on certain VIA chips.
++ Furthermore, AMD chips prefer a totally different sequence of NOPs
++ (which work on all CPUs). In addition, it looks like Virtual PC
++ does not understand them.
++
++ As a result, disallow these if we're not compiling for X86_64 (these
++ NOPs do work on all x86-64 capable chips); the list of processors in
++ the right-hand clause are the cores that benefit from this optimization.
+
++ Say Y if you have Intel CPU newer than Pentium Pro, N otherwise.
++
+ config X86_TSC
+ def_bool y
+- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
++ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MNATIVE || MATOM) || X86_64
+
+ config X86_CMPXCHG64
+ def_bool y
+- depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8
++ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
+
+ # this should be set for all -march=.. options where the compiler
+ # generates cmov.
+--- a/arch/x86/Makefile 2019-02-22 09:21:58.196924367 -0500
++++ b/arch/x86/Makefile 2019-02-22 09:36:27.310577832 -0500
+@@ -118,13 +118,46 @@ else
+ KBUILD_CFLAGS += $(call cc-option,-mskip-rax-setup)
+
+ # FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
++ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
+ cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
++ cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-mtune=k8)
++ cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10)
++ cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona)
++ cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1)
++ cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2)
++ cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1)
++ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2)
++ cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3)
++ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4)
++ cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1)
+ cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
+
+ cflags-$(CONFIG_MCORE2) += \
+- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
+- cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
+- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
++ $(call cc-option,-march=core2,$(call cc-option,-mtune=core2))
++ cflags-$(CONFIG_MNEHALEM) += \
++ $(call cc-option,-march=nehalem,$(call cc-option,-mtune=nehalem))
++ cflags-$(CONFIG_MWESTMERE) += \
++ $(call cc-option,-march=westmere,$(call cc-option,-mtune=westmere))
++ cflags-$(CONFIG_MSILVERMONT) += \
++ $(call cc-option,-march=silvermont,$(call cc-option,-mtune=silvermont))
++ cflags-$(CONFIG_MSANDYBRIDGE) += \
++ $(call cc-option,-march=sandybridge,$(call cc-option,-mtune=sandybridge))
++ cflags-$(CONFIG_MIVYBRIDGE) += \
++ $(call cc-option,-march=ivybridge,$(call cc-option,-mtune=ivybridge))
++ cflags-$(CONFIG_MHASWELL) += \
++ $(call cc-option,-march=haswell,$(call cc-option,-mtune=haswell))
++ cflags-$(CONFIG_MBROADWELL) += \
++ $(call cc-option,-march=broadwell,$(call cc-option,-mtune=broadwell))
++ cflags-$(CONFIG_MSKYLAKE) += \
++ $(call cc-option,-march=skylake,$(call cc-option,-mtune=skylake))
++ cflags-$(CONFIG_MSKYLAKEX) += \
++ $(call cc-option,-march=skylake-avx512,$(call cc-option,-mtune=skylake-avx512))
++ cflags-$(CONFIG_MCANNONLAKE) += \
++ $(call cc-option,-march=cannonlake,$(call cc-option,-mtune=cannonlake))
++ cflags-$(CONFIG_MICELAKE) += \
++ $(call cc-option,-march=icelake,$(call cc-option,-mtune=icelake))
++ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell) \
++ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
+ cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
+ KBUILD_CFLAGS += $(cflags-y)
+
+--- a/arch/x86/include/asm/module.h 2019-02-22 09:22:26.726997480 -0500
++++ b/arch/x86/include/asm/module.h 2019-02-22 09:40:04.231493392 -0500
+@@ -25,6 +25,30 @@ struct mod_arch_specific {
+ #define MODULE_PROC_FAMILY "586MMX "
+ #elif defined CONFIG_MCORE2
+ #define MODULE_PROC_FAMILY "CORE2 "
++#elif defined CONFIG_MNATIVE
++#define MODULE_PROC_FAMILY "NATIVE "
++#elif defined CONFIG_MNEHALEM
++#define MODULE_PROC_FAMILY "NEHALEM "
++#elif defined CONFIG_MWESTMERE
++#define MODULE_PROC_FAMILY "WESTMERE "
++#elif defined CONFIG_MSILVERMONT
++#define MODULE_PROC_FAMILY "SILVERMONT "
++#elif defined CONFIG_MSANDYBRIDGE
++#define MODULE_PROC_FAMILY "SANDYBRIDGE "
++#elif defined CONFIG_MIVYBRIDGE
++#define MODULE_PROC_FAMILY "IVYBRIDGE "
++#elif defined CONFIG_MHASWELL
++#define MODULE_PROC_FAMILY "HASWELL "
++#elif defined CONFIG_MBROADWELL
++#define MODULE_PROC_FAMILY "BROADWELL "
++#elif defined CONFIG_MSKYLAKE
++#define MODULE_PROC_FAMILY "SKYLAKE "
++#elif defined CONFIG_MSKYLAKEX
++#define MODULE_PROC_FAMILY "SKYLAKEX "
++#elif defined CONFIG_MCANNONLAKE
++#define MODULE_PROC_FAMILY "CANNONLAKE "
++#elif defined CONFIG_MICELAKE
++#define MODULE_PROC_FAMILY "ICELAKE "
+ #elif defined CONFIG_MATOM
+ #define MODULE_PROC_FAMILY "ATOM "
+ #elif defined CONFIG_M686
+@@ -43,6 +67,26 @@ struct mod_arch_specific {
+ #define MODULE_PROC_FAMILY "K7 "
+ #elif defined CONFIG_MK8
+ #define MODULE_PROC_FAMILY "K8 "
++#elif defined CONFIG_MK8SSE3
++#define MODULE_PROC_FAMILY "K8SSE3 "
++#elif defined CONFIG_MK10
++#define MODULE_PROC_FAMILY "K10 "
++#elif defined CONFIG_MBARCELONA
++#define MODULE_PROC_FAMILY "BARCELONA "
++#elif defined CONFIG_MBOBCAT
++#define MODULE_PROC_FAMILY "BOBCAT "
++#elif defined CONFIG_MBULLDOZER
++#define MODULE_PROC_FAMILY "BULLDOZER "
++#elif defined CONFIG_MPILEDRIVER
++#define MODULE_PROC_FAMILY "PILEDRIVER "
++#elif defined CONFIG_MSTEAMROLLER
++#define MODULE_PROC_FAMILY "STEAMROLLER "
++#elif defined CONFIG_MJAGUAR
++#define MODULE_PROC_FAMILY "JAGUAR "
++#elif defined CONFIG_MEXCAVATOR
++#define MODULE_PROC_FAMILY "EXCAVATOR "
++#elif defined CONFIG_MZEN
++#define MODULE_PROC_FAMILY "ZEN "
+ #elif defined CONFIG_MELAN
+ #define MODULE_PROC_FAMILY "ELAN "
+ #elif defined CONFIG_MCRUSOE
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-02-23 11:35 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-02-23 11:35 UTC (permalink / raw
To: gentoo-commits
commit: 2977abdfac22b14217a40357013c33b40efbef56
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 23 11:34:39 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Feb 23 11:34:39 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2977abdf
proj/linux-patches: Linux patch 4.19.25
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1024_linux-4.19.25.patch | 925 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 929 insertions(+)
diff --git a/0000_README b/0000_README
index 4b56fba..aee0edf 100644
--- a/0000_README
+++ b/0000_README
@@ -139,6 +139,10 @@ Patch: 1023_linux-4.19.24.patch
From: http://www.kernel.org
Desc: Linux 4.19.24
+Patch: 1024_linux-4.19.25.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.25
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1024_linux-4.19.25.patch b/1024_linux-4.19.25.patch
new file mode 100644
index 0000000..3dee03e
--- /dev/null
+++ b/1024_linux-4.19.25.patch
@@ -0,0 +1,925 @@
+diff --git a/Makefile b/Makefile
+index 370ad0d34076..2caa131ff306 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 24
++SUBLEVEL = 25
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index 17eb09d222ff..ec78a04eb136 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -122,8 +122,10 @@ static void alg_do_release(const struct af_alg_type *type, void *private)
+
+ int af_alg_release(struct socket *sock)
+ {
+- if (sock->sk)
++ if (sock->sk) {
+ sock_put(sock->sk);
++ sock->sk = NULL;
++ }
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(af_alg_release);
+diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
+index 0e30fa00204c..f9b8e3e23a8e 100644
+--- a/drivers/hwmon/lm80.c
++++ b/drivers/hwmon/lm80.c
+@@ -393,8 +393,10 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
+ }
+
+ rv = lm80_read_value(client, LM80_REG_FANDIV);
+- if (rv < 0)
++ if (rv < 0) {
++ mutex_unlock(&data->update_lock);
+ return rv;
++ }
+ reg = (rv & ~(3 << (2 * (nr + 1))))
+ | (data->fan_div[nr] << (2 * (nr + 1)));
+ lm80_write_value(client, LM80_REG_FANDIV, reg);
+diff --git a/drivers/isdn/mISDN/timerdev.c b/drivers/isdn/mISDN/timerdev.c
+index 211ed6cffd10..578978711887 100644
+--- a/drivers/isdn/mISDN/timerdev.c
++++ b/drivers/isdn/mISDN/timerdev.c
+@@ -170,8 +170,8 @@ dev_expire_timer(struct timer_list *t)
+ spin_lock_irqsave(&timer->dev->lock, flags);
+ if (timer->id >= 0)
+ list_move_tail(&timer->list, &timer->dev->expired);
+- spin_unlock_irqrestore(&timer->dev->lock, flags);
+ wake_up_interruptible(&timer->dev->wait);
++ spin_unlock_irqrestore(&timer->dev->lock, flags);
+ }
+
+ static int
+diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
+index ef9deaa361c7..ddd98cdd33bc 100644
+--- a/drivers/mmc/host/meson-gx-mmc.c
++++ b/drivers/mmc/host/meson-gx-mmc.c
+@@ -1286,7 +1286,8 @@ static int meson_mmc_probe(struct platform_device *pdev)
+ host->regs + SD_EMMC_IRQ_EN);
+
+ ret = request_threaded_irq(host->irq, meson_mmc_irq,
+- meson_mmc_irq_thread, IRQF_SHARED, NULL, host);
++ meson_mmc_irq_thread, IRQF_SHARED,
++ dev_name(&pdev->dev), host);
+ if (ret)
+ goto err_init_clk;
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 258918d8a416..9f697a5b8e3d 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -261,6 +261,7 @@ static irqreturn_t mv88e6xxx_g1_irq_thread_work(struct mv88e6xxx_chip *chip)
+ unsigned int sub_irq;
+ unsigned int n;
+ u16 reg;
++ u16 ctl1;
+ int err;
+
+ mutex_lock(&chip->reg_lock);
+@@ -270,13 +271,28 @@ static irqreturn_t mv88e6xxx_g1_irq_thread_work(struct mv88e6xxx_chip *chip)
+ if (err)
+ goto out;
+
+- for (n = 0; n < chip->g1_irq.nirqs; ++n) {
+- if (reg & (1 << n)) {
+- sub_irq = irq_find_mapping(chip->g1_irq.domain, n);
+- handle_nested_irq(sub_irq);
+- ++nhandled;
++ do {
++ for (n = 0; n < chip->g1_irq.nirqs; ++n) {
++ if (reg & (1 << n)) {
++ sub_irq = irq_find_mapping(chip->g1_irq.domain,
++ n);
++ handle_nested_irq(sub_irq);
++ ++nhandled;
++ }
+ }
+- }
++
++ mutex_lock(&chip->reg_lock);
++ err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &ctl1);
++ if (err)
++ goto unlock;
++ err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_STS, ®);
++unlock:
++ mutex_unlock(&chip->reg_lock);
++ if (err)
++ goto out;
++ ctl1 &= GENMASK(chip->g1_irq.nirqs, 0);
++ } while (reg & ctl1);
++
+ out:
+ return (nhandled > 0 ? IRQ_HANDLED : IRQ_NONE);
+ }
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index 697d9b374f5e..ae2f35039343 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -5087,7 +5087,7 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ INIT_WORK(&hw->restart_work, sky2_restart);
+
+ pci_set_drvdata(pdev, hw);
+- pdev->d3_delay = 200;
++ pdev->d3_delay = 300;
+
+ return 0;
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index d64cd8d44d83..a12b5710891e 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -841,8 +841,9 @@ int __mlxsw_sp_port_headroom_set(struct mlxsw_sp_port *mlxsw_sp_port, int mtu,
+ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+ bool configure = false;
+ bool pfc = false;
++ u16 thres_cells;
++ u16 delay_cells;
+ bool lossy;
+- u16 thres;
+
+ for (j = 0; j < IEEE_8021QAZ_MAX_TCS; j++) {
+ if (prio_tc[j] == i) {
+@@ -856,10 +857,11 @@ int __mlxsw_sp_port_headroom_set(struct mlxsw_sp_port *mlxsw_sp_port, int mtu,
+ continue;
+
+ lossy = !(pfc || pause_en);
+- thres = mlxsw_sp_pg_buf_threshold_get(mlxsw_sp, mtu);
+- delay = mlxsw_sp_pg_buf_delay_get(mlxsw_sp, mtu, delay, pfc,
+- pause_en);
+- mlxsw_sp_pg_buf_pack(pbmc_pl, i, thres + delay, thres, lossy);
++ thres_cells = mlxsw_sp_pg_buf_threshold_get(mlxsw_sp, mtu);
++ delay_cells = mlxsw_sp_pg_buf_delay_get(mlxsw_sp, mtu, delay,
++ pfc, pause_en);
++ mlxsw_sp_pg_buf_pack(pbmc_pl, i, thres_cells + delay_cells,
++ thres_cells, lossy);
+ }
+
+ return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(pbmc), pbmc_pl);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+index 20299f6f65fc..736e29635b77 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+@@ -241,15 +241,18 @@ static inline void dwmac4_get_timestamp(void *desc, u32 ats, u64 *ts)
+ static int dwmac4_rx_check_timestamp(void *desc)
+ {
+ struct dma_desc *p = (struct dma_desc *)desc;
++ unsigned int rdes0 = le32_to_cpu(p->des0);
++ unsigned int rdes1 = le32_to_cpu(p->des1);
++ unsigned int rdes3 = le32_to_cpu(p->des3);
+ u32 own, ctxt;
+ int ret = 1;
+
+- own = p->des3 & RDES3_OWN;
+- ctxt = ((p->des3 & RDES3_CONTEXT_DESCRIPTOR)
++ own = rdes3 & RDES3_OWN;
++ ctxt = ((rdes3 & RDES3_CONTEXT_DESCRIPTOR)
+ >> RDES3_CONTEXT_DESCRIPTOR_SHIFT);
+
+ if (likely(!own && ctxt)) {
+- if ((p->des0 == 0xffffffff) && (p->des1 == 0xffffffff))
++ if ((rdes0 == 0xffffffff) && (rdes1 == 0xffffffff))
+ /* Corrupted value */
+ ret = -EINVAL;
+ else
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+index 5710864fa809..9caf79ba5ef1 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+@@ -692,25 +692,27 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev,
+ struct ethtool_eee *edata)
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
++ int ret;
+
+- priv->eee_enabled = edata->eee_enabled;
+-
+- if (!priv->eee_enabled)
++ if (!edata->eee_enabled) {
+ stmmac_disable_eee_mode(priv);
+- else {
++ } else {
+ /* We are asking for enabling the EEE but it is safe
+ * to verify all by invoking the eee_init function.
+ * In case of failure it will return an error.
+ */
+- priv->eee_enabled = stmmac_eee_init(priv);
+- if (!priv->eee_enabled)
++ edata->eee_enabled = stmmac_eee_init(priv);
++ if (!edata->eee_enabled)
+ return -EOPNOTSUPP;
+-
+- /* Do not change tx_lpi_timer in case of failure */
+- priv->tx_lpi_timer = edata->tx_lpi_timer;
+ }
+
+- return phy_ethtool_set_eee(dev->phydev, edata);
++ ret = phy_ethtool_set_eee(dev->phydev, edata);
++ if (ret)
++ return ret;
++
++ priv->eee_enabled = edata->eee_enabled;
++ priv->tx_lpi_timer = edata->tx_lpi_timer;
++ return 0;
+ }
+
+ static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv)
+diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c
+index 74a8782313cf..bd6084e315de 100644
+--- a/drivers/net/phy/xilinx_gmii2rgmii.c
++++ b/drivers/net/phy/xilinx_gmii2rgmii.c
+@@ -44,7 +44,10 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev)
+ u16 val = 0;
+ int err;
+
+- err = priv->phy_drv->read_status(phydev);
++ if (priv->phy_drv->read_status)
++ err = priv->phy_drv->read_status(phydev);
++ else
++ err = genphy_read_status(phydev);
+ if (err < 0)
+ return err;
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 27bd586b94b0..9fc9aed6ca9a 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2003,7 +2003,7 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
+ struct pcpu_sw_netstats *tx_stats, *rx_stats;
+ union vxlan_addr loopback;
+ union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip;
+- struct net_device *dev = skb->dev;
++ struct net_device *dev;
+ int len = skb->len;
+
+ tx_stats = this_cpu_ptr(src_vxlan->dev->tstats);
+@@ -2023,9 +2023,15 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
+ #endif
+ }
+
++ rcu_read_lock();
++ dev = skb->dev;
++ if (unlikely(!(dev->flags & IFF_UP))) {
++ kfree_skb(skb);
++ goto drop;
++ }
++
+ if (dst_vxlan->cfg.flags & VXLAN_F_LEARN)
+- vxlan_snoop(skb->dev, &loopback, eth_hdr(skb)->h_source, 0,
+- vni);
++ vxlan_snoop(dev, &loopback, eth_hdr(skb)->h_source, 0, vni);
+
+ u64_stats_update_begin(&tx_stats->syncp);
+ tx_stats->tx_packets++;
+@@ -2038,8 +2044,10 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
+ rx_stats->rx_bytes += len;
+ u64_stats_update_end(&rx_stats->syncp);
+ } else {
++drop:
+ dev->stats.rx_dropped++;
+ }
++ rcu_read_unlock();
+ }
+
+ static int encap_bypass_if_local(struct sk_buff *skb, struct net_device *dev,
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index afc4680c584f..7eb1549cea81 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -6113,7 +6113,8 @@ static int __init pci_setup(char *str)
+ } else if (!strncmp(str, "pcie_scan_all", 13)) {
+ pci_add_flags(PCI_SCAN_ALL_PCIE_DEVS);
+ } else if (!strncmp(str, "disable_acs_redir=", 18)) {
+- disable_acs_redir_param = str + 18;
++ disable_acs_redir_param =
++ kstrdup(str + 18, GFP_KERNEL);
+ } else {
+ printk(KERN_ERR "PCI: Unknown option `%s'\n",
+ str);
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 3f7aad45d215..f1b730b77a31 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -266,7 +266,7 @@ struct se_session *transport_alloc_session(enum target_prot_op sup_prot_ops)
+ }
+ ret = transport_init_session(se_sess);
+ if (ret < 0) {
+- kfree(se_sess);
++ kmem_cache_free(se_sess_cache, se_sess);
+ return ERR_PTR(ret);
+ }
+ se_sess->sup_prot_ops = sup_prot_ops;
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index cf82e7266397..5eaeca805c95 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -1784,7 +1784,7 @@ static int log_used(struct vhost_virtqueue *vq, u64 used_offset, u64 len)
+
+ ret = translate_desc(vq, (uintptr_t)vq->used + used_offset,
+ len, iov, 64, VHOST_ACCESS_WO);
+- if (ret)
++ if (ret < 0)
+ return ret;
+
+ for (i = 0; i < ret; i++) {
+diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
+index 2b2a6dce1630..4c76fe2c8488 100644
+--- a/include/linux/netdev_features.h
++++ b/include/linux/netdev_features.h
+@@ -11,6 +11,8 @@
+ #define _LINUX_NETDEV_FEATURES_H
+
+ #include <linux/types.h>
++#include <linux/bitops.h>
++#include <asm/byteorder.h>
+
+ typedef u64 netdev_features_t;
+
+@@ -154,8 +156,26 @@ enum {
+ #define NETIF_F_HW_TLS_TX __NETIF_F(HW_TLS_TX)
+ #define NETIF_F_HW_TLS_RX __NETIF_F(HW_TLS_RX)
+
+-#define for_each_netdev_feature(mask_addr, bit) \
+- for_each_set_bit(bit, (unsigned long *)mask_addr, NETDEV_FEATURE_COUNT)
++/* Finds the next feature with the highest number of the range of start till 0.
++ */
++static inline int find_next_netdev_feature(u64 feature, unsigned long start)
++{
++ /* like BITMAP_LAST_WORD_MASK() for u64
++ * this sets the most significant 64 - start to 0.
++ */
++ feature &= ~0ULL >> (-start & ((sizeof(feature) * 8) - 1));
++
++ return fls64(feature) - 1;
++}
++
++/* This goes for the MSB to the LSB through the set feature bits,
++ * mask_addr should be a u64 and bit an int
++ */
++#define for_each_netdev_feature(mask_addr, bit) \
++ for ((bit) = find_next_netdev_feature((mask_addr), \
++ NETDEV_FEATURE_COUNT); \
++ (bit) >= 0; \
++ (bit) = find_next_netdev_feature((mask_addr), (bit) - 1))
+
+ /* Features valid for ethtool to change */
+ /* = all defined minus driver/device-class-related */
+diff --git a/include/net/ax25.h b/include/net/ax25.h
+index 3f9aea8087e3..8b7eb46ad72d 100644
+--- a/include/net/ax25.h
++++ b/include/net/ax25.h
+@@ -201,6 +201,18 @@ static inline void ax25_hold_route(ax25_route *ax25_rt)
+
+ void __ax25_put_route(ax25_route *ax25_rt);
+
++extern rwlock_t ax25_route_lock;
++
++static inline void ax25_route_lock_use(void)
++{
++ read_lock(&ax25_route_lock);
++}
++
++static inline void ax25_route_lock_unuse(void)
++{
++ read_unlock(&ax25_route_lock);
++}
++
+ static inline void ax25_put_route(ax25_route *ax25_rt)
+ {
+ if (refcount_dec_and_test(&ax25_rt->refcount))
+diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
+index 00b5e7825508..74ff688568a0 100644
+--- a/include/net/inetpeer.h
++++ b/include/net/inetpeer.h
+@@ -39,6 +39,7 @@ struct inet_peer {
+
+ u32 metrics[RTAX_MAX];
+ u32 rate_tokens; /* rate limiting for ICMP */
++ u32 n_redirects;
+ unsigned long rate_last;
+ /*
+ * Once inet_peer is queued for deletion (refcnt == 0), following field
+diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
+index 70417e9b932d..314bbc8010fb 100644
+--- a/net/ax25/ax25_ip.c
++++ b/net/ax25/ax25_ip.c
+@@ -114,6 +114,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
+ dst = (ax25_address *)(bp + 1);
+ src = (ax25_address *)(bp + 8);
+
++ ax25_route_lock_use();
+ route = ax25_get_route(dst, NULL);
+ if (route) {
+ digipeat = route->digipeat;
+@@ -206,9 +207,8 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
+ ax25_queue_xmit(skb, dev);
+
+ put:
+- if (route)
+- ax25_put_route(route);
+
++ ax25_route_lock_unuse();
+ return NETDEV_TX_OK;
+ }
+
+diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
+index a0eff323af12..66f74c85cf6b 100644
+--- a/net/ax25/ax25_route.c
++++ b/net/ax25/ax25_route.c
+@@ -40,7 +40,7 @@
+ #include <linux/export.h>
+
+ static ax25_route *ax25_route_list;
+-static DEFINE_RWLOCK(ax25_route_lock);
++DEFINE_RWLOCK(ax25_route_lock);
+
+ void ax25_rt_device_down(struct net_device *dev)
+ {
+@@ -335,6 +335,7 @@ const struct seq_operations ax25_rt_seqops = {
+ * Find AX.25 route
+ *
+ * Only routes with a reference count of zero can be destroyed.
++ * Must be called with ax25_route_lock read locked.
+ */
+ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
+ {
+@@ -342,7 +343,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
+ ax25_route *ax25_def_rt = NULL;
+ ax25_route *ax25_rt;
+
+- read_lock(&ax25_route_lock);
+ /*
+ * Bind to the physical interface we heard them on, or the default
+ * route if none is found;
+@@ -365,11 +365,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
+ if (ax25_spe_rt != NULL)
+ ax25_rt = ax25_spe_rt;
+
+- if (ax25_rt != NULL)
+- ax25_hold_route(ax25_rt);
+-
+- read_unlock(&ax25_route_lock);
+-
+ return ax25_rt;
+ }
+
+@@ -400,9 +395,12 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
+ ax25_route *ax25_rt;
+ int err = 0;
+
+- if ((ax25_rt = ax25_get_route(addr, NULL)) == NULL)
++ ax25_route_lock_use();
++ ax25_rt = ax25_get_route(addr, NULL);
++ if (!ax25_rt) {
++ ax25_route_lock_unuse();
+ return -EHOSTUNREACH;
+-
++ }
+ if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL) {
+ err = -EHOSTUNREACH;
+ goto put;
+@@ -437,8 +435,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
+ }
+
+ put:
+- ax25_put_route(ax25_rt);
+-
++ ax25_route_lock_unuse();
+ return err;
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index af097ca9cb4f..5c8c0a572ee9 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -8039,7 +8039,7 @@ static netdev_features_t netdev_sync_upper_features(struct net_device *lower,
+ netdev_features_t feature;
+ int feature_bit;
+
+- for_each_netdev_feature(&upper_disables, feature_bit) {
++ for_each_netdev_feature(upper_disables, feature_bit) {
+ feature = __NETIF_F_BIT(feature_bit);
+ if (!(upper->wanted_features & feature)
+ && (features & feature)) {
+@@ -8059,7 +8059,7 @@ static void netdev_sync_lower_features(struct net_device *upper,
+ netdev_features_t feature;
+ int feature_bit;
+
+- for_each_netdev_feature(&upper_disables, feature_bit) {
++ for_each_netdev_feature(upper_disables, feature_bit) {
+ feature = __NETIF_F_BIT(feature_bit);
+ if (!(features & feature) && (lower->features & feature)) {
+ netdev_dbg(upper, "Disabling feature %pNF on lower dev %s.\n",
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 589ec5b9ec5f..8656b1e20d35 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -353,6 +353,8 @@ static void *__netdev_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
+ */
+ void *netdev_alloc_frag(unsigned int fragsz)
+ {
++ fragsz = SKB_DATA_ALIGN(fragsz);
++
+ return __netdev_alloc_frag(fragsz, GFP_ATOMIC);
+ }
+ EXPORT_SYMBOL(netdev_alloc_frag);
+@@ -366,6 +368,8 @@ static void *__napi_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
+
+ void *napi_alloc_frag(unsigned int fragsz)
+ {
++ fragsz = SKB_DATA_ALIGN(fragsz);
++
+ return __napi_alloc_frag(fragsz, GFP_ATOMIC);
+ }
+ EXPORT_SYMBOL(napi_alloc_frag);
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index d757b9642d0d..be778599bfed 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -216,6 +216,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+ atomic_set(&p->rid, 0);
+ p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
+ p->rate_tokens = 0;
++ p->n_redirects = 0;
+ /* 60*HZ is arbitrary, but chosen enough high so that the first
+ * calculation of tokens is at its maximum.
+ */
+diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic_main.c b/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
+index ac110c1d55b5..481437fc1eb2 100644
+--- a/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
++++ b/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
+@@ -104,6 +104,8 @@ static void fast_csum(struct snmp_ctx *ctx, unsigned char offset)
+ int snmp_version(void *context, size_t hdrlen, unsigned char tag,
+ const void *data, size_t datalen)
+ {
++ if (datalen != 1)
++ return -EINVAL;
+ if (*(unsigned char *)data > 1)
+ return -ENOTSUPP;
+ return 1;
+@@ -113,8 +115,11 @@ int snmp_helper(void *context, size_t hdrlen, unsigned char tag,
+ const void *data, size_t datalen)
+ {
+ struct snmp_ctx *ctx = (struct snmp_ctx *)context;
+- __be32 *pdata = (__be32 *)data;
++ __be32 *pdata;
+
++ if (datalen != 4)
++ return -EINVAL;
++ pdata = (__be32 *)data;
+ if (*pdata == ctx->from) {
+ pr_debug("%s: %pI4 to %pI4\n", __func__,
+ (void *)&ctx->from, (void *)&ctx->to);
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 8501554e96a4..436b46c0e687 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -887,13 +887,15 @@ void ip_rt_send_redirect(struct sk_buff *skb)
+ /* No redirected packets during ip_rt_redirect_silence;
+ * reset the algorithm.
+ */
+- if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence))
++ if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence)) {
+ peer->rate_tokens = 0;
++ peer->n_redirects = 0;
++ }
+
+ /* Too many ignored redirects; do not send anything
+ * set dst.rate_last to the last seen redirected packet.
+ */
+- if (peer->rate_tokens >= ip_rt_redirect_number) {
++ if (peer->n_redirects >= ip_rt_redirect_number) {
+ peer->rate_last = jiffies;
+ goto out_put_peer;
+ }
+@@ -910,6 +912,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
+ icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
+ peer->rate_last = jiffies;
+ ++peer->rate_tokens;
++ ++peer->n_redirects;
+ #ifdef CONFIG_IP_ROUTE_VERBOSE
+ if (log_martians &&
+ peer->rate_tokens == ip_rt_redirect_number)
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 87fe44197aa1..432dc9af1172 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2519,6 +2519,7 @@ void tcp_write_queue_purge(struct sock *sk)
+ sk_mem_reclaim(sk);
+ tcp_clear_all_retrans_hints(tcp_sk(sk));
+ tcp_sk(sk)->packets_out = 0;
++ inet_csk(sk)->icsk_backoff = 0;
+ }
+
+ int tcp_disconnect(struct sock *sk, int flags)
+@@ -2567,7 +2568,6 @@ int tcp_disconnect(struct sock *sk, int flags)
+ tp->write_seq += tp->max_window + 2;
+ if (tp->write_seq == 0)
+ tp->write_seq = 1;
+- icsk->icsk_backoff = 0;
+ tp->snd_cwnd = 2;
+ icsk->icsk_probes_out = 0;
+ tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index cd426313a298..3b83b157b0a1 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -535,14 +535,15 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
+ if (sock_owned_by_user(sk))
+ break;
+
++ skb = tcp_rtx_queue_head(sk);
++ if (WARN_ON_ONCE(!skb))
++ break;
++
+ icsk->icsk_backoff--;
+ icsk->icsk_rto = tp->srtt_us ? __tcp_set_rto(tp) :
+ TCP_TIMEOUT_INIT;
+ icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX);
+
+- skb = tcp_rtx_queue_head(sk);
+- BUG_ON(!skb);
+-
+ tcp_mstamp_refresh(tp);
+ delta_us = (u32)(tp->tcp_mstamp - skb->skb_mstamp);
+ remaining = icsk->icsk_rto -
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 3dfc50cd86d6..c57efd5c5b38 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1148,7 +1148,8 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
+ list_for_each_entry(ifa, &idev->addr_list, if_list) {
+ if (ifa == ifp)
+ continue;
+- if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
++ if (ifa->prefix_len != ifp->prefix_len ||
++ !ipv6_prefix_equal(&ifa->addr, &ifp->addr,
+ ifp->prefix_len))
+ continue;
+ if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index be04877b3827..faed98dab913 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1735,6 +1735,24 @@ static int ip6erspan_tap_validate(struct nlattr *tb[], struct nlattr *data[],
+ return 0;
+ }
+
++static void ip6erspan_set_version(struct nlattr *data[],
++ struct __ip6_tnl_parm *parms)
++{
++ parms->erspan_ver = 1;
++ if (data[IFLA_GRE_ERSPAN_VER])
++ parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
++
++ if (parms->erspan_ver == 1) {
++ if (data[IFLA_GRE_ERSPAN_INDEX])
++ parms->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]);
++ } else if (parms->erspan_ver == 2) {
++ if (data[IFLA_GRE_ERSPAN_DIR])
++ parms->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]);
++ if (data[IFLA_GRE_ERSPAN_HWID])
++ parms->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]);
++ }
++}
++
+ static void ip6gre_netlink_parms(struct nlattr *data[],
+ struct __ip6_tnl_parm *parms)
+ {
+@@ -1783,20 +1801,6 @@ static void ip6gre_netlink_parms(struct nlattr *data[],
+
+ if (data[IFLA_GRE_COLLECT_METADATA])
+ parms->collect_md = true;
+-
+- parms->erspan_ver = 1;
+- if (data[IFLA_GRE_ERSPAN_VER])
+- parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
+-
+- if (parms->erspan_ver == 1) {
+- if (data[IFLA_GRE_ERSPAN_INDEX])
+- parms->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]);
+- } else if (parms->erspan_ver == 2) {
+- if (data[IFLA_GRE_ERSPAN_DIR])
+- parms->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]);
+- if (data[IFLA_GRE_ERSPAN_HWID])
+- parms->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]);
+- }
+ }
+
+ static int ip6gre_tap_init(struct net_device *dev)
+@@ -2225,6 +2229,7 @@ static int ip6erspan_newlink(struct net *src_net, struct net_device *dev,
+ int err;
+
+ ip6gre_netlink_parms(data, &nt->parms);
++ ip6erspan_set_version(data, &nt->parms);
+ ign = net_generic(net, ip6gre_net_id);
+
+ if (nt->parms.collect_md) {
+@@ -2270,6 +2275,7 @@ static int ip6erspan_changelink(struct net_device *dev, struct nlattr *tb[],
+ if (IS_ERR(t))
+ return PTR_ERR(t);
+
++ ip6erspan_set_version(data, &p);
+ ip6gre_tunnel_unlink_md(ign, t);
+ ip6gre_tunnel_unlink(ign, t);
+ ip6erspan_tnl_change(t, &p, !tb[IFLA_MTU]);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index b6ea0fadb34f..c76c21604ffd 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2887,7 +2887,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ goto out_free;
+ } else if (reserve) {
+ skb_reserve(skb, -reserve);
+- if (len < reserve)
++ if (len < reserve + sizeof(struct ipv6hdr) &&
++ dev->min_header_len != dev->hard_header_len)
+ skb_reset_network_header(skb);
+ }
+
+diff --git a/net/sunrpc/auth_gss/gss_krb5_seqnum.c b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
+index c8b9082f4a9d..2d2ed6772fe4 100644
+--- a/net/sunrpc/auth_gss/gss_krb5_seqnum.c
++++ b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
+@@ -44,7 +44,7 @@ krb5_make_rc4_seq_num(struct krb5_ctx *kctx, int direction, s32 seqnum,
+ unsigned char *cksum, unsigned char *buf)
+ {
+ struct crypto_skcipher *cipher;
+- unsigned char plain[8];
++ unsigned char *plain;
+ s32 code;
+
+ dprintk("RPC: %s:\n", __func__);
+@@ -53,6 +53,10 @@ krb5_make_rc4_seq_num(struct krb5_ctx *kctx, int direction, s32 seqnum,
+ if (IS_ERR(cipher))
+ return PTR_ERR(cipher);
+
++ plain = kmalloc(8, GFP_NOFS);
++ if (!plain)
++ return -ENOMEM;
++
+ plain[0] = (unsigned char) ((seqnum >> 24) & 0xff);
+ plain[1] = (unsigned char) ((seqnum >> 16) & 0xff);
+ plain[2] = (unsigned char) ((seqnum >> 8) & 0xff);
+@@ -69,6 +73,7 @@ krb5_make_rc4_seq_num(struct krb5_ctx *kctx, int direction, s32 seqnum,
+ code = krb5_encrypt(cipher, cksum, plain, buf, 8);
+ out:
+ crypto_free_skcipher(cipher);
++ kfree(plain);
+ return code;
+ }
+ s32
+@@ -78,12 +83,17 @@ krb5_make_seq_num(struct krb5_ctx *kctx,
+ u32 seqnum,
+ unsigned char *cksum, unsigned char *buf)
+ {
+- unsigned char plain[8];
++ unsigned char *plain;
++ s32 code;
+
+ if (kctx->enctype == ENCTYPE_ARCFOUR_HMAC)
+ return krb5_make_rc4_seq_num(kctx, direction, seqnum,
+ cksum, buf);
+
++ plain = kmalloc(8, GFP_NOFS);
++ if (!plain)
++ return -ENOMEM;
++
+ plain[0] = (unsigned char) (seqnum & 0xff);
+ plain[1] = (unsigned char) ((seqnum >> 8) & 0xff);
+ plain[2] = (unsigned char) ((seqnum >> 16) & 0xff);
+@@ -94,7 +104,9 @@ krb5_make_seq_num(struct krb5_ctx *kctx,
+ plain[6] = direction;
+ plain[7] = direction;
+
+- return krb5_encrypt(key, cksum, plain, buf, 8);
++ code = krb5_encrypt(key, cksum, plain, buf, 8);
++ kfree(plain);
++ return code;
+ }
+
+ static s32
+@@ -102,7 +114,7 @@ krb5_get_rc4_seq_num(struct krb5_ctx *kctx, unsigned char *cksum,
+ unsigned char *buf, int *direction, s32 *seqnum)
+ {
+ struct crypto_skcipher *cipher;
+- unsigned char plain[8];
++ unsigned char *plain;
+ s32 code;
+
+ dprintk("RPC: %s:\n", __func__);
+@@ -115,20 +127,28 @@ krb5_get_rc4_seq_num(struct krb5_ctx *kctx, unsigned char *cksum,
+ if (code)
+ goto out;
+
++ plain = kmalloc(8, GFP_NOFS);
++ if (!plain) {
++ code = -ENOMEM;
++ goto out;
++ }
++
+ code = krb5_decrypt(cipher, cksum, buf, plain, 8);
+ if (code)
+- goto out;
++ goto out_plain;
+
+ if ((plain[4] != plain[5]) || (plain[4] != plain[6])
+ || (plain[4] != plain[7])) {
+ code = (s32)KG_BAD_SEQ;
+- goto out;
++ goto out_plain;
+ }
+
+ *direction = plain[4];
+
+ *seqnum = ((plain[0] << 24) | (plain[1] << 16) |
+ (plain[2] << 8) | (plain[3]));
++out_plain:
++ kfree(plain);
+ out:
+ crypto_free_skcipher(cipher);
+ return code;
+@@ -141,26 +161,33 @@ krb5_get_seq_num(struct krb5_ctx *kctx,
+ int *direction, u32 *seqnum)
+ {
+ s32 code;
+- unsigned char plain[8];
+ struct crypto_skcipher *key = kctx->seq;
++ unsigned char *plain;
+
+ dprintk("RPC: krb5_get_seq_num:\n");
+
+ if (kctx->enctype == ENCTYPE_ARCFOUR_HMAC)
+ return krb5_get_rc4_seq_num(kctx, cksum, buf,
+ direction, seqnum);
++ plain = kmalloc(8, GFP_NOFS);
++ if (!plain)
++ return -ENOMEM;
+
+ if ((code = krb5_decrypt(key, cksum, buf, plain, 8)))
+- return code;
++ goto out;
+
+ if ((plain[4] != plain[5]) || (plain[4] != plain[6]) ||
+- (plain[4] != plain[7]))
+- return (s32)KG_BAD_SEQ;
++ (plain[4] != plain[7])) {
++ code = (s32)KG_BAD_SEQ;
++ goto out;
++ }
+
+ *direction = plain[4];
+
+ *seqnum = ((plain[0]) |
+ (plain[1] << 8) | (plain[2] << 16) | (plain[3] << 24));
+
+- return 0;
++out:
++ kfree(plain);
++ return code;
+ }
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index c361ce782412..c3d5ab01fba7 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -1651,6 +1651,10 @@ static void vmci_transport_cleanup(struct work_struct *work)
+
+ static void vmci_transport_destruct(struct vsock_sock *vsk)
+ {
++ /* transport can be NULL if we hit a failure at init() time */
++ if (!vmci_trans(vsk))
++ return;
++
+ /* Ensure that the detach callback doesn't use the sk/vsk
+ * we are about to destruct.
+ */
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index d49aa79b7997..fef473c736fa 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -352,17 +352,15 @@ static unsigned int x25_new_lci(struct x25_neigh *nb)
+ unsigned int lci = 1;
+ struct sock *sk;
+
+- read_lock_bh(&x25_list_lock);
+-
+- while ((sk = __x25_find_socket(lci, nb)) != NULL) {
++ while ((sk = x25_find_socket(lci, nb)) != NULL) {
+ sock_put(sk);
+ if (++lci == 4096) {
+ lci = 0;
+ break;
+ }
++ cond_resched();
+ }
+
+- read_unlock_bh(&x25_list_lock);
+ return lci;
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-02-27 11:23 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-02-27 11:23 UTC (permalink / raw
To: gentoo-commits
commit: bfcc3c8f1cb3df7438bb44c51fc44cd1f403e534
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 27 11:23:06 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Feb 27 11:23:06 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bfcc3c8f
proj/linux-patches: Linux patch 4.19.26
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1025_linux-4.19.26.patch | 6610 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6614 insertions(+)
diff --git a/0000_README b/0000_README
index aee0edf..fa1c672 100644
--- a/0000_README
+++ b/0000_README
@@ -143,6 +143,10 @@ Patch: 1024_linux-4.19.25.patch
From: http://www.kernel.org
Desc: Linux 4.19.25
+Patch: 1025_linux-4.19.26.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.26
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1025_linux-4.19.26.patch b/1025_linux-4.19.26.patch
new file mode 100644
index 0000000..b49d24c
--- /dev/null
+++ b/1025_linux-4.19.26.patch
@@ -0,0 +1,6610 @@
+diff --git a/Makefile b/Makefile
+index 2caa131ff306b..b71076cecba9c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 25
++SUBLEVEL = 26
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
+index ff7d3232764a2..db681cf4959c8 100644
+--- a/arch/arc/include/asm/cache.h
++++ b/arch/arc/include/asm/cache.h
+@@ -52,6 +52,17 @@
+ #define cache_line_size() SMP_CACHE_BYTES
+ #define ARCH_DMA_MINALIGN SMP_CACHE_BYTES
+
++/*
++ * Make sure slab-allocated buffers are 64-bit aligned when atomic64_t uses
++ * ARCv2 64-bit atomics (LLOCKD/SCONDD). This guarantess runtime 64-bit
++ * alignment for any atomic64_t embedded in buffer.
++ * Default ARCH_SLAB_MINALIGN is __alignof__(long long) which has a relaxed
++ * value of 4 (and not 8) in ARC ABI.
++ */
++#if defined(CONFIG_ARC_HAS_LL64) && defined(CONFIG_ARC_HAS_LLSC)
++#define ARCH_SLAB_MINALIGN 8
++#endif
++
+ extern void arc_cache_init(void);
+ extern char *arc_cache_mumbojumbo(int cpu_id, char *buf, int len);
+ extern void read_decode_cache_bcr(void);
+diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
+index 8b90d25a15cca..1f945d0f40daa 100644
+--- a/arch/arc/kernel/head.S
++++ b/arch/arc/kernel/head.S
+@@ -17,6 +17,7 @@
+ #include <asm/entry.h>
+ #include <asm/arcregs.h>
+ #include <asm/cache.h>
++#include <asm/irqflags.h>
+
+ .macro CPU_EARLY_SETUP
+
+@@ -47,6 +48,15 @@
+ sr r5, [ARC_REG_DC_CTRL]
+
+ 1:
++
++#ifdef CONFIG_ISA_ARCV2
++ ; Unaligned access is disabled at reset, so re-enable early as
++ ; gcc 7.3.1 (ARC GNU 2018.03) onwards generates unaligned access
++ ; by default
++ lr r5, [status32]
++ bset r5, r5, STATUS_AD_BIT
++ kflag r5
++#endif
+ .endm
+
+ .section .init.text, "ax",@progbits
+@@ -93,9 +103,9 @@ ENTRY(stext)
+ #ifdef CONFIG_ARC_UBOOT_SUPPORT
+ ; Uboot - kernel ABI
+ ; r0 = [0] No uboot interaction, [1] cmdline in r2, [2] DTB in r2
+- ; r1 = magic number (board identity, unused as of now
++ ; r1 = magic number (always zero as of now)
+ ; r2 = pointer to uboot provided cmdline or external DTB in mem
+- ; These are handled later in setup_arch()
++ ; These are handled later in handle_uboot_args()
+ st r0, [@uboot_tag]
+ st r2, [@uboot_arg]
+ #endif
+diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
+index b2cae79a25d71..62a30e58441c5 100644
+--- a/arch/arc/kernel/setup.c
++++ b/arch/arc/kernel/setup.c
+@@ -449,43 +449,80 @@ void setup_processor(void)
+ arc_chk_core_config();
+ }
+
+-static inline int is_kernel(unsigned long addr)
++static inline bool uboot_arg_invalid(unsigned long addr)
+ {
+- if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
+- return 1;
+- return 0;
++ /*
++ * Check that it is a untranslated address (although MMU is not enabled
++ * yet, it being a high address ensures this is not by fluke)
++ */
++ if (addr < PAGE_OFFSET)
++ return true;
++
++ /* Check that address doesn't clobber resident kernel image */
++ return addr >= (unsigned long)_stext && addr <= (unsigned long)_end;
+ }
+
+-void __init setup_arch(char **cmdline_p)
++#define IGNORE_ARGS "Ignore U-boot args: "
++
++/* uboot_tag values for U-boot - kernel ABI revision 0; see head.S */
++#define UBOOT_TAG_NONE 0
++#define UBOOT_TAG_CMDLINE 1
++#define UBOOT_TAG_DTB 2
++
++void __init handle_uboot_args(void)
+ {
++ bool use_embedded_dtb = true;
++ bool append_cmdline = false;
++
+ #ifdef CONFIG_ARC_UBOOT_SUPPORT
+- /* make sure that uboot passed pointer to cmdline/dtb is valid */
+- if (uboot_tag && is_kernel((unsigned long)uboot_arg))
+- panic("Invalid uboot arg\n");
++ /* check that we know this tag */
++ if (uboot_tag != UBOOT_TAG_NONE &&
++ uboot_tag != UBOOT_TAG_CMDLINE &&
++ uboot_tag != UBOOT_TAG_DTB) {
++ pr_warn(IGNORE_ARGS "invalid uboot tag: '%08x'\n", uboot_tag);
++ goto ignore_uboot_args;
++ }
++
++ if (uboot_tag != UBOOT_TAG_NONE &&
++ uboot_arg_invalid((unsigned long)uboot_arg)) {
++ pr_warn(IGNORE_ARGS "invalid uboot arg: '%px'\n", uboot_arg);
++ goto ignore_uboot_args;
++ }
++
++ /* see if U-boot passed an external Device Tree blob */
++ if (uboot_tag == UBOOT_TAG_DTB) {
++ machine_desc = setup_machine_fdt((void *)uboot_arg);
+
+- /* See if u-boot passed an external Device Tree blob */
+- machine_desc = setup_machine_fdt(uboot_arg); /* uboot_tag == 2 */
+- if (!machine_desc)
++ /* external Device Tree blob is invalid - use embedded one */
++ use_embedded_dtb = !machine_desc;
++ }
++
++ if (uboot_tag == UBOOT_TAG_CMDLINE)
++ append_cmdline = true;
++
++ignore_uboot_args:
+ #endif
+- {
+- /* No, so try the embedded one */
++
++ if (use_embedded_dtb) {
+ machine_desc = setup_machine_fdt(__dtb_start);
+ if (!machine_desc)
+ panic("Embedded DT invalid\n");
++ }
+
+- /*
+- * If we are here, it is established that @uboot_arg didn't
+- * point to DT blob. Instead if u-boot says it is cmdline,
+- * append to embedded DT cmdline.
+- * setup_machine_fdt() would have populated @boot_command_line
+- */
+- if (uboot_tag == 1) {
+- /* Ensure a whitespace between the 2 cmdlines */
+- strlcat(boot_command_line, " ", COMMAND_LINE_SIZE);
+- strlcat(boot_command_line, uboot_arg,
+- COMMAND_LINE_SIZE);
+- }
++ /*
++ * NOTE: @boot_command_line is populated by setup_machine_fdt() so this
++ * append processing can only happen after.
++ */
++ if (append_cmdline) {
++ /* Ensure a whitespace between the 2 cmdlines */
++ strlcat(boot_command_line, " ", COMMAND_LINE_SIZE);
++ strlcat(boot_command_line, uboot_arg, COMMAND_LINE_SIZE);
+ }
++}
++
++void __init setup_arch(char **cmdline_p)
++{
++ handle_uboot_args();
+
+ /* Save unparsed command line copy for /proc/cmdline */
+ *cmdline_p = boot_command_line;
+diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c
+index 2c118a6ab3587..0dc23fc227ed2 100644
+--- a/arch/arm/probes/kprobes/opt-arm.c
++++ b/arch/arm/probes/kprobes/opt-arm.c
+@@ -247,7 +247,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *or
+ }
+
+ /* Copy arch-dep-instance from template. */
+- memcpy(code, (unsigned char *)optprobe_template_entry,
++ memcpy(code, (unsigned long *)&optprobe_template_entry,
+ TMPL_END_IDX * sizeof(kprobe_opcode_t));
+
+ /* Adjust buffer according to instruction. */
+diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig
+index 951c4231bdb85..4c47b3fd958b6 100644
+--- a/arch/mips/configs/ath79_defconfig
++++ b/arch/mips/configs/ath79_defconfig
+@@ -71,6 +71,7 @@ CONFIG_SERIAL_8250_CONSOLE=y
+ # CONFIG_SERIAL_8250_PCI is not set
+ CONFIG_SERIAL_8250_NR_UARTS=1
+ CONFIG_SERIAL_8250_RUNTIME_UARTS=1
++CONFIG_SERIAL_OF_PLATFORM=y
+ CONFIG_SERIAL_AR933X=y
+ CONFIG_SERIAL_AR933X_CONSOLE=y
+ # CONFIG_HW_RANDOM is not set
+diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
+index d31bc2f012088..fb2b6d0b77c36 100644
+--- a/arch/mips/jazz/jazzdma.c
++++ b/arch/mips/jazz/jazzdma.c
+@@ -74,14 +74,15 @@ static int __init vdma_init(void)
+ get_order(VDMA_PGTBL_SIZE));
+ BUG_ON(!pgtbl);
+ dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE);
+- pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
++ pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl);
+
+ /*
+ * Clear the R4030 translation table
+ */
+ vdma_pgtbl_init();
+
+- r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
++ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE,
++ CPHYSADDR((unsigned long)pgtbl));
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE);
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0);
+
+diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
+index aeb7b1b0f2024..252c00985c973 100644
+--- a/arch/mips/net/ebpf_jit.c
++++ b/arch/mips/net/ebpf_jit.c
+@@ -343,12 +343,15 @@ static int build_int_epilogue(struct jit_ctx *ctx, int dest_reg)
+ const struct bpf_prog *prog = ctx->skf;
+ int stack_adjust = ctx->stack_size;
+ int store_offset = stack_adjust - 8;
++ enum reg_val_type td;
+ int r0 = MIPS_R_V0;
+
+- if (dest_reg == MIPS_R_RA &&
+- get_reg_val_type(ctx, prog->len, BPF_REG_0) == REG_32BIT_ZERO_EX)
++ if (dest_reg == MIPS_R_RA) {
+ /* Don't let zero extended value escape. */
+- emit_instr(ctx, sll, r0, r0, 0);
++ td = get_reg_val_type(ctx, prog->len, BPF_REG_0);
++ if (td == REG_64BIT || td == REG_32BIT_ZERO_EX)
++ emit_instr(ctx, sll, r0, r0, 0);
++ }
+
+ if (ctx->flags & EBPF_SAVE_RA) {
+ emit_instr(ctx, ld, MIPS_R_RA, store_offset, MIPS_R_SP);
+diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
+index 2582df1c529bb..0964c236e3e5a 100644
+--- a/arch/parisc/kernel/ptrace.c
++++ b/arch/parisc/kernel/ptrace.c
+@@ -308,15 +308,29 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+
+ long do_syscall_trace_enter(struct pt_regs *regs)
+ {
+- if (test_thread_flag(TIF_SYSCALL_TRACE) &&
+- tracehook_report_syscall_entry(regs)) {
++ if (test_thread_flag(TIF_SYSCALL_TRACE)) {
++ int rc = tracehook_report_syscall_entry(regs);
++
+ /*
+- * Tracing decided this syscall should not happen or the
+- * debugger stored an invalid system call number. Skip
+- * the system call and the system call restart handling.
++ * As tracesys_next does not set %r28 to -ENOSYS
++ * when %r20 is set to -1, initialize it here.
+ */
+- regs->gr[20] = -1UL;
+- goto out;
++ regs->gr[28] = -ENOSYS;
++
++ if (rc) {
++ /*
++ * A nonzero return code from
++ * tracehook_report_syscall_entry() tells us
++ * to prevent the syscall execution. Skip
++ * the syscall call and the syscall restart handling.
++ *
++ * Note that the tracer may also just change
++ * regs->gr[20] to an invalid syscall number,
++ * that is handled by tracesys_next.
++ */
++ regs->gr[20] = -1UL;
++ return -1;
++ }
+ }
+
+ /* Do the secure computing check after ptrace. */
+@@ -340,7 +354,6 @@ long do_syscall_trace_enter(struct pt_regs *regs)
+ regs->gr[24] & 0xffffffff,
+ regs->gr[23] & 0xffffffff);
+
+-out:
+ /*
+ * Sign extend the syscall number to 64bit since it may have been
+ * modified by a compat ptrace call
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index 81d4574d1f377..9fd2ff28b8ff2 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -919,11 +919,12 @@ start_here:
+
+ /* set up the PTE pointers for the Abatron bdiGDB.
+ */
+- tovirt(r6,r6)
+ lis r5, abatron_pteptrs@h
+ ori r5, r5, abatron_pteptrs@l
+ stw r5, 0xf0(0) /* Must match your Abatron config file */
+ tophys(r5,r5)
++ lis r6, swapper_pg_dir@h
++ ori r6, r6, swapper_pg_dir@l
+ stw r6, 0(r5)
+
+ /* Now turn on the MMU for real! */
+diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
+index 7bcfa61375c09..98d13c6a64be0 100644
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -337,6 +337,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ unsigned f_mpx = kvm_mpx_supported() ? F(MPX) : 0;
+ unsigned f_xsaves = kvm_x86_ops->xsaves_supported() ? F(XSAVES) : 0;
+ unsigned f_umip = kvm_x86_ops->umip_emulated() ? F(UMIP) : 0;
++ unsigned f_la57 = 0;
+
+ /* cpuid 1.edx */
+ const u32 kvm_cpuid_1_edx_x86_features =
+@@ -491,7 +492,10 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ // TSC_ADJUST is emulated
+ entry->ebx |= F(TSC_ADJUST);
+ entry->ecx &= kvm_cpuid_7_0_ecx_x86_features;
++ f_la57 = entry->ecx & F(LA57);
+ cpuid_mask(&entry->ecx, CPUID_7_ECX);
++ /* Set LA57 based on hardware capability. */
++ entry->ecx |= f_la57;
+ entry->ecx |= f_umip;
+ /* PKU is not yet implemented for shadow paging. */
+ if (!tdp_enabled || !boot_cpu_has(X86_FEATURE_OSPKE))
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 52a7c3faee0cc..782f98b332f05 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -899,10 +899,7 @@ static u64 xen_read_msr_safe(unsigned int msr, int *err)
+ val = native_read_msr_safe(msr, err);
+ switch (msr) {
+ case MSR_IA32_APICBASE:
+-#ifdef CONFIG_X86_X2APIC
+- if (!(cpuid_ecx(1) & (1 << (X86_FEATURE_X2APIC & 31))))
+-#endif
+- val &= ~X2APIC_ENABLE;
++ val &= ~X2APIC_ENABLE;
+ break;
+ }
+ return val;
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index ea59c01ce8db0..f530d35412428 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -719,6 +719,7 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags)
+ struct acpi_nfit_memory_map *memdev;
+ struct acpi_nfit_desc *acpi_desc;
+ struct nfit_mem *nfit_mem;
++ u16 physical_id;
+
+ mutex_lock(&acpi_desc_lock);
+ list_for_each_entry(acpi_desc, &acpi_descs, list) {
+@@ -726,10 +727,11 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags)
+ list_for_each_entry(nfit_mem, &acpi_desc->dimms, list) {
+ memdev = __to_nfit_memdev(nfit_mem);
+ if (memdev->device_handle == device_handle) {
++ *flags = memdev->flags;
++ physical_id = memdev->physical_id;
+ mutex_unlock(&acpi_desc->init_mutex);
+ mutex_unlock(&acpi_desc_lock);
+- *flags = memdev->flags;
+- return memdev->physical_id;
++ return physical_id;
+ }
+ }
+ mutex_unlock(&acpi_desc->init_mutex);
+diff --git a/drivers/atm/he.c b/drivers/atm/he.c
+index 29f102dcfec49..329ce9072ee9f 100644
+--- a/drivers/atm/he.c
++++ b/drivers/atm/he.c
+@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev)
+ instead of '/ 512', use '>> 9' to prevent a call
+ to divdu3 on x86 platforms
+ */
+- rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9;
++ rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9;
+
+ if (rate_cps < 10)
+ rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */
+diff --git a/drivers/gpio/gpio-mt7621.c b/drivers/gpio/gpio-mt7621.c
+index 00e954f22bc92..74401e0adb29c 100644
+--- a/drivers/gpio/gpio-mt7621.c
++++ b/drivers/gpio/gpio-mt7621.c
+@@ -30,6 +30,7 @@
+ #define GPIO_REG_EDGE 0xA0
+
+ struct mtk_gc {
++ struct irq_chip irq_chip;
+ struct gpio_chip chip;
+ spinlock_t lock;
+ int bank;
+@@ -189,13 +190,6 @@ mediatek_gpio_irq_type(struct irq_data *d, unsigned int type)
+ return 0;
+ }
+
+-static struct irq_chip mediatek_gpio_irq_chip = {
+- .irq_unmask = mediatek_gpio_irq_unmask,
+- .irq_mask = mediatek_gpio_irq_mask,
+- .irq_mask_ack = mediatek_gpio_irq_mask,
+- .irq_set_type = mediatek_gpio_irq_type,
+-};
+-
+ static int
+ mediatek_gpio_xlate(struct gpio_chip *chip,
+ const struct of_phandle_args *spec, u32 *flags)
+@@ -254,6 +248,13 @@ mediatek_gpio_bank_probe(struct device *dev,
+ return ret;
+ }
+
++ rg->irq_chip.name = dev_name(dev);
++ rg->irq_chip.parent_device = dev;
++ rg->irq_chip.irq_unmask = mediatek_gpio_irq_unmask;
++ rg->irq_chip.irq_mask = mediatek_gpio_irq_mask;
++ rg->irq_chip.irq_mask_ack = mediatek_gpio_irq_mask;
++ rg->irq_chip.irq_set_type = mediatek_gpio_irq_type;
++
+ if (mtk->gpio_irq) {
+ /*
+ * Manually request the irq here instead of passing
+@@ -270,14 +271,14 @@ mediatek_gpio_bank_probe(struct device *dev,
+ return ret;
+ }
+
+- ret = gpiochip_irqchip_add(&rg->chip, &mediatek_gpio_irq_chip,
++ ret = gpiochip_irqchip_add(&rg->chip, &rg->irq_chip,
+ 0, handle_simple_irq, IRQ_TYPE_NONE);
+ if (ret) {
+ dev_err(dev, "failed to add gpiochip_irqchip\n");
+ return ret;
+ }
+
+- gpiochip_set_chained_irqchip(&rg->chip, &mediatek_gpio_irq_chip,
++ gpiochip_set_chained_irqchip(&rg->chip, &rg->irq_chip,
+ mtk->gpio_irq, NULL);
+ }
+
+@@ -310,7 +311,6 @@ mediatek_gpio_probe(struct platform_device *pdev)
+ mtk->gpio_irq = irq_of_parse_and_map(np, 0);
+ mtk->dev = dev;
+ platform_set_drvdata(pdev, mtk);
+- mediatek_gpio_irq_chip.name = dev_name(dev);
+
+ for (i = 0; i < MTK_BANK_CNT; i++) {
+ ret = mediatek_gpio_bank_probe(dev, np, i);
+diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
+index 9f3f166f17608..eb27fa76e8fc7 100644
+--- a/drivers/gpio/gpio-pxa.c
++++ b/drivers/gpio/gpio-pxa.c
+@@ -245,6 +245,7 @@ static bool pxa_gpio_has_pinctrl(void)
+ {
+ switch (gpio_type) {
+ case PXA3XX_GPIO:
++ case MMP2_GPIO:
+ return false;
+
+ default:
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index fd825d30edf13..c0396e83f3526 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -159,6 +159,7 @@ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags)
+ }
+
+ if (amdgpu_device_is_px(dev)) {
++ dev_pm_set_driver_flags(dev->dev, DPM_FLAG_NEVER_SKIP);
+ pm_runtime_use_autosuspend(dev->dev);
+ pm_runtime_set_autosuspend_delay(dev->dev, 5000);
+ pm_runtime_set_active(dev->dev);
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+index 80f5db4ef75fd..0805c423a5ce0 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -1072,8 +1072,6 @@ static uint32_t kfd_generate_gpu_id(struct kfd_dev *gpu)
+ * the GPU device is not already present in the topology device
+ * list then return NULL. This means a new topology device has to
+ * be created for this GPU.
+- * TODO: Rather than assiging @gpu to first topology device withtout
+- * gpu attached, it will better to have more stringent check.
+ */
+ static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu)
+ {
+@@ -1081,12 +1079,20 @@ static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu)
+ struct kfd_topology_device *out_dev = NULL;
+
+ down_write(&topology_lock);
+- list_for_each_entry(dev, &topology_device_list, list)
++ list_for_each_entry(dev, &topology_device_list, list) {
++ /* Discrete GPUs need their own topology device list
++ * entries. Don't assign them to CPU/APU nodes.
++ */
++ if (!gpu->device_info->needs_iommu_device &&
++ dev->node_props.cpu_cores_count)
++ continue;
++
+ if (!dev->gpu && (dev->node_props.simd_count > 0)) {
+ dev->gpu = gpu;
+ out_dev = dev;
+ break;
+ }
++ }
+ up_write(&topology_lock);
+ return out_dev;
+ }
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index a851bb07443f0..c5ba9128b7361 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -624,12 +624,13 @@ static int dm_suspend(void *handle)
+ struct amdgpu_display_manager *dm = &adev->dm;
+ int ret = 0;
+
++ WARN_ON(adev->dm.cached_state);
++ adev->dm.cached_state = drm_atomic_helper_suspend(adev->ddev);
++
+ s3_handle_mst(adev->ddev, true);
+
+ amdgpu_dm_irq_suspend(adev);
+
+- WARN_ON(adev->dm.cached_state);
+- adev->dm.cached_state = drm_atomic_helper_suspend(adev->ddev);
+
+ dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D3);
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index 580e7e82034fa..53ccacf99eca4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -1000,7 +1000,7 @@ void dce110_enable_audio_stream(struct pipe_ctx *pipe_ctx)
+
+ pipe_ctx->stream_res.audio->funcs->az_enable(pipe_ctx->stream_res.audio);
+
+- if (num_audio == 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
++ if (num_audio >= 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
+ /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/
+ pp_smu->set_pme_wa_enable(&pp_smu->pp_smu);
+ /* un-mute audio */
+@@ -1017,6 +1017,8 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
+ pipe_ctx->stream_res.stream_enc->funcs->audio_mute_control(
+ pipe_ctx->stream_res.stream_enc, true);
+ if (pipe_ctx->stream_res.audio) {
++ struct pp_smu_funcs_rv *pp_smu = dc->res_pool->pp_smu;
++
+ if (option != KEEP_ACQUIRED_RESOURCE ||
+ !dc->debug.az_endpoint_mute_only) {
+ /*only disalbe az_endpoint if power down or free*/
+@@ -1036,6 +1038,9 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
+ update_audio_usage(&dc->current_state->res_ctx, dc->res_pool, pipe_ctx->stream_res.audio, false);
+ pipe_ctx->stream_res.audio = NULL;
+ }
++ if (pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
++ /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/
++ pp_smu->set_pme_wa_enable(&pp_smu->pp_smu);
+
+ /* TODO: notify audio driver for if audio modes list changed
+ * add audio mode list change flag */
+diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
+index 2d6506c08bf72..6f91634880aa2 100644
+--- a/drivers/gpu/drm/i915/intel_fbdev.c
++++ b/drivers/gpu/drm/i915/intel_fbdev.c
+@@ -334,8 +334,8 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
+ bool *enabled, int width, int height)
+ {
+ struct drm_i915_private *dev_priv = to_i915(fb_helper->dev);
+- unsigned long conn_configured, conn_seq, mask;
+ unsigned int count = min(fb_helper->connector_count, BITS_PER_LONG);
++ unsigned long conn_configured, conn_seq;
+ int i, j;
+ bool *save_enabled;
+ bool fallback = true, ret = true;
+@@ -353,10 +353,9 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
+ drm_modeset_backoff(&ctx);
+
+ memcpy(save_enabled, enabled, count);
+- mask = GENMASK(count - 1, 0);
++ conn_seq = GENMASK(count - 1, 0);
+ conn_configured = 0;
+ retry:
+- conn_seq = conn_configured;
+ for (i = 0; i < count; i++) {
+ struct drm_fb_helper_connector *fb_conn;
+ struct drm_connector *connector;
+@@ -369,7 +368,8 @@ retry:
+ if (conn_configured & BIT(i))
+ continue;
+
+- if (conn_seq == 0 && !connector->has_tile)
++ /* First pass, only consider tiled connectors */
++ if (conn_seq == GENMASK(count - 1, 0) && !connector->has_tile)
+ continue;
+
+ if (connector->status == connector_status_connected)
+@@ -473,8 +473,10 @@ retry:
+ conn_configured |= BIT(i);
+ }
+
+- if ((conn_configured & mask) != mask && conn_configured != conn_seq)
++ if (conn_configured != conn_seq) { /* repeat until no more are found */
++ conn_seq = conn_configured;
+ goto retry;
++ }
+
+ /*
+ * If the BIOS didn't enable everything it could, fall back to have the
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index bf5f294f172fa..611ac340fb289 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -368,8 +368,10 @@ static int meson_probe_remote(struct platform_device *pdev,
+ remote_node = of_graph_get_remote_port_parent(ep);
+ if (!remote_node ||
+ remote_node == parent || /* Ignore parent endpoint */
+- !of_device_is_available(remote_node))
++ !of_device_is_available(remote_node)) {
++ of_node_put(remote_node);
+ continue;
++ }
+
+ count += meson_probe_remote(pdev, match, remote, remote_node);
+
+@@ -388,10 +390,13 @@ static int meson_drv_probe(struct platform_device *pdev)
+
+ for_each_endpoint_of_node(np, ep) {
+ remote = of_graph_get_remote_port_parent(ep);
+- if (!remote || !of_device_is_available(remote))
++ if (!remote || !of_device_is_available(remote)) {
++ of_node_put(remote);
+ continue;
++ }
+
+ count += meson_probe_remote(pdev, &match, np, remote);
++ of_node_put(remote);
+ }
+
+ if (count && !match)
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index dec1e081f5295..6a8fb6fd183c3 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -172,6 +172,7 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
+ }
+
+ if (radeon_is_px(dev)) {
++ dev_pm_set_driver_flags(dev->dev, DPM_FLAG_NEVER_SKIP);
+ pm_runtime_use_autosuspend(dev->dev);
+ pm_runtime_set_autosuspend_delay(dev->dev, 5000);
+ pm_runtime_set_active(dev->dev);
+diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
+index d7950b52a1fd9..e30b1f5b9d91a 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
++++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
+@@ -717,17 +717,18 @@ static struct sun4i_frontend *sun4i_backend_find_frontend(struct sun4i_drv *drv,
+ remote = of_graph_get_remote_port_parent(ep);
+ if (!remote)
+ continue;
++ of_node_put(remote);
+
+ /* does this node match any registered engines? */
+ list_for_each_entry(frontend, &drv->frontend_list, list) {
+ if (remote == frontend->node) {
+- of_node_put(remote);
+ of_node_put(port);
++ of_node_put(ep);
+ return frontend;
+ }
+ }
+ }
+-
++ of_node_put(port);
+ return ERR_PTR(-EINVAL);
+ }
+
+diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
+index e36399213324d..ceb3db6f3fdda 100644
+--- a/drivers/hwmon/tmp421.c
++++ b/drivers/hwmon/tmp421.c
+@@ -88,7 +88,7 @@ static const struct of_device_id tmp421_of_match[] = {
+ .data = (void *)2
+ },
+ {
+- .compatible = "ti,tmp422",
++ .compatible = "ti,tmp442",
+ .data = (void *)3
+ },
+ { },
+diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
+index 0d3473b4596e1..21f4239022c7a 100644
+--- a/drivers/infiniband/hw/mthca/mthca_provider.c
++++ b/drivers/infiniband/hw/mthca/mthca_provider.c
+@@ -533,7 +533,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
+ {
+ struct mthca_ucontext *context;
+
+- qp = kmalloc(sizeof *qp, GFP_KERNEL);
++ qp = kzalloc(sizeof(*qp), GFP_KERNEL);
+ if (!qp)
+ return ERR_PTR(-ENOMEM);
+
+@@ -599,7 +599,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
+ if (pd->uobject)
+ return ERR_PTR(-EINVAL);
+
+- qp = kmalloc(sizeof (struct mthca_sqp), GFP_KERNEL);
++ qp = kzalloc(sizeof(struct mthca_sqp), GFP_KERNEL);
+ if (!qp)
+ return ERR_PTR(-ENOMEM);
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 0b34e909505f5..2c1114ee0c6da 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2951,7 +2951,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
+ {
+ struct srp_target_port *target = host_to_target(scmnd->device->host);
+ struct srp_rdma_ch *ch;
+- int i, j;
+ u8 status;
+
+ shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
+@@ -2963,15 +2962,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
+ if (status)
+ return FAILED;
+
+- for (i = 0; i < target->ch_count; i++) {
+- ch = &target->ch[i];
+- for (j = 0; j < target->req_ring_size; ++j) {
+- struct srp_request *req = &ch->req_ring[j];
+-
+- srp_finish_req(ch, req, scmnd->device, DID_RESET << 16);
+- }
+- }
+-
+ return SUCCESS;
+ }
+
+diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
+index 4ac378e489023..40ca1e8fa09fc 100644
+--- a/drivers/isdn/hardware/avm/b1.c
++++ b/drivers/isdn/hardware/avm/b1.c
+@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo)
+ int i, j;
+
+ for (j = 0; j < AVM_MAXVERSION; j++)
+- cinfo->version[j] = "\0\0" + 1;
++ cinfo->version[j] = "";
+ for (i = 0, j = 0;
+ j < AVM_MAXVERSION && i < cinfo->versionlen;
+ j++, i += cinfo->versionbuf[i] + 1)
+diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
+index b730037a0e2d3..9cff667b2d245 100644
+--- a/drivers/isdn/i4l/isdn_tty.c
++++ b/drivers/isdn/i4l/isdn_tty.c
+@@ -1456,15 +1456,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
+ {
+ modem_info *info = (modem_info *) tty->driver_data;
+
++ mutex_lock(&modem_info_mutex);
+ if (!old_termios)
+ isdn_tty_change_speed(info);
+ else {
+ if (tty->termios.c_cflag == old_termios->c_cflag &&
+ tty->termios.c_ispeed == old_termios->c_ispeed &&
+- tty->termios.c_ospeed == old_termios->c_ospeed)
++ tty->termios.c_ospeed == old_termios->c_ospeed) {
++ mutex_unlock(&modem_info_mutex);
+ return;
++ }
+ isdn_tty_change_speed(info);
+ }
++ mutex_unlock(&modem_info_mutex);
+ }
+
+ /*
+diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
+index a2e74feee2b2f..fd64df5a57a5e 100644
+--- a/drivers/leds/leds-lp5523.c
++++ b/drivers/leds/leds-lp5523.c
+@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
+
+ /* Let the programs run for couple of ms and check the engine status */
+ usleep_range(3000, 6000);
+- lp55xx_read(chip, LP5523_REG_STATUS, &status);
++ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
++ if (ret)
++ return ret;
+ status &= LP5523_ENG_STATUS_MASK;
+
+ if (status != LP5523_ENG_STATUS_MASK) {
+diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
+index 30d09d1771717..11ab17f64c649 100644
+--- a/drivers/mfd/ab8500-core.c
++++ b/drivers/mfd/ab8500-core.c
+@@ -261,7 +261,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank,
+ mutex_unlock(&ab8500->lock);
+ dev_vdbg(ab8500->dev, "rd: addr %#x => data %#x\n", addr, ret);
+
+- return ret;
++ return (ret < 0) ? ret : 0;
+ }
+
+ static int ab8500_get_register(struct device *dev, u8 bank,
+diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
+index 0be511dd93d01..f8e0fa97bb31e 100644
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -640,9 +640,9 @@ static const struct mfd_cell axp221_cells[] = {
+
+ static const struct mfd_cell axp223_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp22x_pek_resources),
+- .resources = axp22x_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp22x_pek_resources),
++ .resources = axp22x_pek_resources,
+ }, {
+ .name = "axp22x-adc",
+ .of_compatible = "x-powers,axp221-adc",
+@@ -650,7 +650,7 @@ static const struct mfd_cell axp223_cells[] = {
+ .name = "axp20x-battery-power-supply",
+ .of_compatible = "x-powers,axp221-battery-power-supply",
+ }, {
+- .name = "axp20x-regulator",
++ .name = "axp20x-regulator",
+ }, {
+ .name = "axp20x-ac-power-supply",
+ .of_compatible = "x-powers,axp221-ac-power-supply",
+@@ -666,9 +666,9 @@ static const struct mfd_cell axp223_cells[] = {
+
+ static const struct mfd_cell axp152_cells[] = {
+ {
+- .name = "axp20x-pek",
+- .num_resources = ARRAY_SIZE(axp152_pek_resources),
+- .resources = axp152_pek_resources,
++ .name = "axp20x-pek",
++ .num_resources = ARRAY_SIZE(axp152_pek_resources),
++ .resources = axp152_pek_resources,
+ },
+ };
+
+@@ -697,87 +697,101 @@ static const struct resource axp288_charger_resources[] = {
+
+ static const struct mfd_cell axp288_cells[] = {
+ {
+- .name = "axp288_adc",
+- .num_resources = ARRAY_SIZE(axp288_adc_resources),
+- .resources = axp288_adc_resources,
+- },
+- {
+- .name = "axp288_extcon",
+- .num_resources = ARRAY_SIZE(axp288_extcon_resources),
+- .resources = axp288_extcon_resources,
+- },
+- {
+- .name = "axp288_charger",
+- .num_resources = ARRAY_SIZE(axp288_charger_resources),
+- .resources = axp288_charger_resources,
+- },
+- {
+- .name = "axp288_fuel_gauge",
+- .num_resources = ARRAY_SIZE(axp288_fuel_gauge_resources),
+- .resources = axp288_fuel_gauge_resources,
+- },
+- {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp288_power_button_resources),
+- .resources = axp288_power_button_resources,
+- },
+- {
+- .name = "axp288_pmic_acpi",
++ .name = "axp288_adc",
++ .num_resources = ARRAY_SIZE(axp288_adc_resources),
++ .resources = axp288_adc_resources,
++ }, {
++ .name = "axp288_extcon",
++ .num_resources = ARRAY_SIZE(axp288_extcon_resources),
++ .resources = axp288_extcon_resources,
++ }, {
++ .name = "axp288_charger",
++ .num_resources = ARRAY_SIZE(axp288_charger_resources),
++ .resources = axp288_charger_resources,
++ }, {
++ .name = "axp288_fuel_gauge",
++ .num_resources = ARRAY_SIZE(axp288_fuel_gauge_resources),
++ .resources = axp288_fuel_gauge_resources,
++ }, {
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp288_power_button_resources),
++ .resources = axp288_power_button_resources,
++ }, {
++ .name = "axp288_pmic_acpi",
+ },
+ };
+
+ static const struct mfd_cell axp803_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp803_pek_resources),
+- .resources = axp803_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp803_pek_resources),
++ .resources = axp803_pek_resources,
++ }, {
++ .name = "axp20x-gpio",
++ .of_compatible = "x-powers,axp813-gpio",
++ }, {
++ .name = "axp813-adc",
++ .of_compatible = "x-powers,axp813-adc",
++ }, {
++ .name = "axp20x-battery-power-supply",
++ .of_compatible = "x-powers,axp813-battery-power-supply",
++ }, {
++ .name = "axp20x-ac-power-supply",
++ .of_compatible = "x-powers,axp813-ac-power-supply",
++ .num_resources = ARRAY_SIZE(axp20x_ac_power_supply_resources),
++ .resources = axp20x_ac_power_supply_resources,
+ },
+- { .name = "axp20x-regulator" },
++ { .name = "axp20x-regulator" },
+ };
+
+ static const struct mfd_cell axp806_self_working_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp806_pek_resources),
+- .resources = axp806_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp806_pek_resources),
++ .resources = axp806_pek_resources,
+ },
+- { .name = "axp20x-regulator" },
++ { .name = "axp20x-regulator" },
+ };
+
+ static const struct mfd_cell axp806_cells[] = {
+ {
+- .id = 2,
+- .name = "axp20x-regulator",
++ .id = 2,
++ .name = "axp20x-regulator",
+ },
+ };
+
+ static const struct mfd_cell axp809_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp809_pek_resources),
+- .resources = axp809_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp809_pek_resources),
++ .resources = axp809_pek_resources,
+ }, {
+- .id = 1,
+- .name = "axp20x-regulator",
++ .id = 1,
++ .name = "axp20x-regulator",
+ },
+ };
+
+ static const struct mfd_cell axp813_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp803_pek_resources),
+- .resources = axp803_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp803_pek_resources),
++ .resources = axp803_pek_resources,
+ }, {
+- .name = "axp20x-regulator",
++ .name = "axp20x-regulator",
+ }, {
+- .name = "axp20x-gpio",
+- .of_compatible = "x-powers,axp813-gpio",
++ .name = "axp20x-gpio",
++ .of_compatible = "x-powers,axp813-gpio",
+ }, {
+- .name = "axp813-adc",
+- .of_compatible = "x-powers,axp813-adc",
++ .name = "axp813-adc",
++ .of_compatible = "x-powers,axp813-adc",
+ }, {
+ .name = "axp20x-battery-power-supply",
+ .of_compatible = "x-powers,axp813-battery-power-supply",
++ }, {
++ .name = "axp20x-ac-power-supply",
++ .of_compatible = "x-powers,axp813-ac-power-supply",
++ .num_resources = ARRAY_SIZE(axp20x_ac_power_supply_resources),
++ .resources = axp20x_ac_power_supply_resources,
+ },
+ };
+
+diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c
+index 503979c81dae1..fab3cdc27ed64 100644
+--- a/drivers/mfd/bd9571mwv.c
++++ b/drivers/mfd/bd9571mwv.c
+@@ -59,6 +59,7 @@ static const struct regmap_access_table bd9571mwv_writable_table = {
+ };
+
+ static const struct regmap_range bd9571mwv_volatile_yes_ranges[] = {
++ regmap_reg_range(BD9571MWV_DVFS_MONIVDAC, BD9571MWV_DVFS_MONIVDAC),
+ regmap_reg_range(BD9571MWV_GPIO_IN, BD9571MWV_GPIO_IN),
+ regmap_reg_range(BD9571MWV_GPIO_INT, BD9571MWV_GPIO_INT),
+ regmap_reg_range(BD9571MWV_INT_INTREQ, BD9571MWV_INT_INTREQ),
+diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c
+index 6b22d54a540d1..bccde3eac92ca 100644
+--- a/drivers/mfd/cros_ec_dev.c
++++ b/drivers/mfd/cros_ec_dev.c
+@@ -499,6 +499,7 @@ static int ec_device_remove(struct platform_device *pdev)
+
+ cros_ec_debugfs_remove(ec);
+
++ mfd_remove_devices(ec->dev);
+ cdev_del(&ec->cdev);
+ device_unregister(&ec->class_dev);
+ return 0;
+diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
+index 5970b8def5487..aec20e1c7d3d5 100644
+--- a/drivers/mfd/db8500-prcmu.c
++++ b/drivers/mfd/db8500-prcmu.c
+@@ -2584,7 +2584,7 @@ static struct irq_chip prcmu_irq_chip = {
+ .irq_unmask = prcmu_irq_unmask,
+ };
+
+-static __init char *fw_project_name(u32 project)
++static char *fw_project_name(u32 project)
+ {
+ switch (project) {
+ case PRCMU_FW_PROJECT_U8500:
+@@ -2732,7 +2732,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size)
+ INIT_WORK(&mb0_transfer.mask_work, prcmu_mask_work);
+ }
+
+-static void __init init_prcm_registers(void)
++static void init_prcm_registers(void)
+ {
+ u32 val;
+
+diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
+index c63e331738c17..234febfe6398b 100644
+--- a/drivers/mfd/mc13xxx-core.c
++++ b/drivers/mfd/mc13xxx-core.c
+@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
+
+ mc13xxx->adcflags |= MC13XXX_ADC_WORKING;
+
+- mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
++ ret = mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
++ if (ret)
++ goto out;
+
+ adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2;
+ adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC;
+diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c
+index 77b64bd64df36..ab24e176ef448 100644
+--- a/drivers/mfd/mt6397-core.c
++++ b/drivers/mfd/mt6397-core.c
+@@ -329,8 +329,7 @@ static int mt6397_probe(struct platform_device *pdev)
+
+ default:
+ dev_err(&pdev->dev, "unsupported chip: %d\n", id);
+- ret = -ENODEV;
+- break;
++ return -ENODEV;
+ }
+
+ if (ret) {
+diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c
+index 52fafea06067e..8d420c37b2a61 100644
+--- a/drivers/mfd/qcom_rpm.c
++++ b/drivers/mfd/qcom_rpm.c
+@@ -638,6 +638,10 @@ static int qcom_rpm_probe(struct platform_device *pdev)
+ return -EFAULT;
+ }
+
++ writel(fw_version[0], RPM_CTRL_REG(rpm, 0));
++ writel(fw_version[1], RPM_CTRL_REG(rpm, 1));
++ writel(fw_version[2], RPM_CTRL_REG(rpm, 2));
++
+ dev_info(&pdev->dev, "RPM firmware %u.%u.%u\n", fw_version[0],
+ fw_version[1],
+ fw_version[2]);
+diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c
+index 7a30546880a42..fe8d335a4d74d 100644
+--- a/drivers/mfd/ti_am335x_tscadc.c
++++ b/drivers/mfd/ti_am335x_tscadc.c
+@@ -264,8 +264,9 @@ static int ti_tscadc_probe(struct platform_device *pdev)
+ cell->pdata_size = sizeof(tscadc);
+ }
+
+- err = mfd_add_devices(&pdev->dev, pdev->id, tscadc->cells,
+- tscadc->used_cells, NULL, 0, NULL);
++ err = mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO,
++ tscadc->cells, tscadc->used_cells, NULL,
++ 0, NULL);
+ if (err < 0)
+ goto err_disable_clk;
+
+diff --git a/drivers/mfd/tps65218.c b/drivers/mfd/tps65218.c
+index 910f569ff77c1..8bcdecf494d05 100644
+--- a/drivers/mfd/tps65218.c
++++ b/drivers/mfd/tps65218.c
+@@ -235,9 +235,9 @@ static int tps65218_probe(struct i2c_client *client,
+
+ mutex_init(&tps->tps_lock);
+
+- ret = regmap_add_irq_chip(tps->regmap, tps->irq,
+- IRQF_ONESHOT, 0, &tps65218_irq_chip,
+- &tps->irq_data);
++ ret = devm_regmap_add_irq_chip(&client->dev, tps->regmap, tps->irq,
++ IRQF_ONESHOT, 0, &tps65218_irq_chip,
++ &tps->irq_data);
+ if (ret < 0)
+ return ret;
+
+@@ -253,26 +253,9 @@ static int tps65218_probe(struct i2c_client *client,
+ ARRAY_SIZE(tps65218_cells), NULL, 0,
+ regmap_irq_get_domain(tps->irq_data));
+
+- if (ret < 0)
+- goto err_irq;
+-
+- return 0;
+-
+-err_irq:
+- regmap_del_irq_chip(tps->irq, tps->irq_data);
+-
+ return ret;
+ }
+
+-static int tps65218_remove(struct i2c_client *client)
+-{
+- struct tps65218 *tps = i2c_get_clientdata(client);
+-
+- regmap_del_irq_chip(tps->irq, tps->irq_data);
+-
+- return 0;
+-}
+-
+ static const struct i2c_device_id tps65218_id_table[] = {
+ { "tps65218", TPS65218 },
+ { },
+@@ -285,7 +268,6 @@ static struct i2c_driver tps65218_driver = {
+ .of_match_table = of_tps65218_match_table,
+ },
+ .probe = tps65218_probe,
+- .remove = tps65218_remove,
+ .id_table = tps65218_id_table,
+ };
+
+diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
+index 4be3d239da9ec..299016bc46d90 100644
+--- a/drivers/mfd/twl-core.c
++++ b/drivers/mfd/twl-core.c
+@@ -979,7 +979,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base,
+ * letting it generate the right frequencies for USB, MADC, and
+ * other purposes.
+ */
+-static inline int __init protect_pm_master(void)
++static inline int protect_pm_master(void)
+ {
+ int e = 0;
+
+@@ -988,7 +988,7 @@ static inline int __init protect_pm_master(void)
+ return e;
+ }
+
+-static inline int __init unprotect_pm_master(void)
++static inline int unprotect_pm_master(void)
+ {
+ int e = 0;
+
+diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c
+index 1ee68bd440fbc..16c6e2accfaa5 100644
+--- a/drivers/mfd/wm5110-tables.c
++++ b/drivers/mfd/wm5110-tables.c
+@@ -1618,6 +1618,7 @@ static const struct reg_default wm5110_reg_default[] = {
+ { 0x00000ECD, 0x0000 }, /* R3789 - HPLPF4_2 */
+ { 0x00000EE0, 0x0000 }, /* R3808 - ASRC_ENABLE */
+ { 0x00000EE2, 0x0000 }, /* R3810 - ASRC_RATE1 */
++ { 0x00000EE3, 0x4000 }, /* R3811 - ASRC_RATE2 */
+ { 0x00000EF0, 0x0000 }, /* R3824 - ISRC 1 CTRL 1 */
+ { 0x00000EF1, 0x0000 }, /* R3825 - ISRC 1 CTRL 2 */
+ { 0x00000EF2, 0x0000 }, /* R3826 - ISRC 1 CTRL 3 */
+@@ -2869,6 +2870,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg)
+ case ARIZONA_ASRC_ENABLE:
+ case ARIZONA_ASRC_STATUS:
+ case ARIZONA_ASRC_RATE1:
++ case ARIZONA_ASRC_RATE2:
+ case ARIZONA_ISRC_1_CTRL_1:
+ case ARIZONA_ISRC_1_CTRL_2:
+ case ARIZONA_ISRC_1_CTRL_3:
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 4b73131a0f206..1b5f591cf0a23 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2595,11 +2595,6 @@ static int ena_restore_device(struct ena_adapter *adapter)
+ goto err_device_destroy;
+ }
+
+- clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
+- /* Make sure we don't have a race with AENQ Links state handler */
+- if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags))
+- netif_carrier_on(adapter->netdev);
+-
+ rc = ena_enable_msix_and_set_admin_interrupts(adapter,
+ adapter->num_queues);
+ if (rc) {
+@@ -2616,6 +2611,11 @@ static int ena_restore_device(struct ena_adapter *adapter)
+ }
+
+ set_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
++
++ clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
++ if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags))
++ netif_carrier_on(adapter->netdev);
++
+ mod_timer(&adapter->timer_service, round_jiffies(jiffies + HZ));
+ dev_err(&pdev->dev, "Device reset completed successfully\n");
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 65a22cd9aef26..029730bbe7db1 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2052,6 +2052,7 @@ static int dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ bool nonlinear = skb_is_nonlinear(skb);
+ struct rtnl_link_stats64 *percpu_stats;
+ struct dpaa_percpu_priv *percpu_priv;
++ struct netdev_queue *txq;
+ struct dpaa_priv *priv;
+ struct qm_fd fd;
+ int offset = 0;
+@@ -2101,6 +2102,11 @@ static int dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ if (unlikely(err < 0))
+ goto skb_to_fd_failed;
+
++ txq = netdev_get_tx_queue(net_dev, queue_mapping);
++
++ /* LLTX requires to do our own update of trans_start */
++ txq->trans_start = jiffies;
++
+ if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
+ fd.cmd |= cpu_to_be32(FM_FD_CMD_UPD);
+ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+index ad1779fc410e6..a78bfafd212c8 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+@@ -147,12 +147,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle)
+ struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle);
+ int i;
+
+- vf_cb->mac_cb = NULL;
+-
+- kfree(vf_cb);
+-
+ for (i = 0; i < handle->q_num; i++)
+ hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0;
++
++ kfree(vf_cb);
+ }
+
+ static int hns_ae_wait_flow_down(struct hnae_handle *handle)
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+index a1aeeb8094c37..f5cd9539980f8 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+@@ -620,6 +620,8 @@ static int get_fixed_ipv6_csum(__wsum hw_checksum, struct sk_buff *skb,
+ }
+ #endif
+
++#define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN)
++
+ /* We reach this function only after checking that any of
+ * the (IPv4 | IPv6) bits are set in cqe->status.
+ */
+@@ -627,9 +629,20 @@ static int check_csum(struct mlx4_cqe *cqe, struct sk_buff *skb, void *va,
+ netdev_features_t dev_features)
+ {
+ __wsum hw_checksum = 0;
++ void *hdr;
++
++ /* CQE csum doesn't cover padding octets in short ethernet
++ * frames. And the pad field is appended prior to calculating
++ * and appending the FCS field.
++ *
++ * Detecting these padded frames requires to verify and parse
++ * IP headers, so we simply force all those small frames to skip
++ * checksum complete.
++ */
++ if (short_frame(skb->len))
++ return -EINVAL;
+
+- void *hdr = (u8 *)va + sizeof(struct ethhdr);
+-
++ hdr = (u8 *)va + sizeof(struct ethhdr);
+ hw_checksum = csum_unfold((__force __sum16)cqe->checksum);
+
+ if (cqe->vlan_my_qpn & cpu_to_be32(MLX4_CQE_CVLAN_PRESENT_MASK) &&
+@@ -822,6 +835,11 @@ xdp_drop_no_cnt:
+ skb_record_rx_queue(skb, cq_ring);
+
+ if (likely(dev->features & NETIF_F_RXCSUM)) {
++ /* TODO: For IP non TCP/UDP packets when csum complete is
++ * not an option (not supported or any other reason) we can
++ * actually check cqe IPOK status bit and report
++ * CHECKSUM_UNNECESSARY rather than CHECKSUM_NONE
++ */
+ if ((cqe->status & cpu_to_be16(MLX4_CQE_STATUS_TCP |
+ MLX4_CQE_STATUS_UDP)) &&
+ (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPOK)) &&
+diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
+index 7262c6310650e..288fca826a55c 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
++++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
+@@ -57,12 +57,12 @@ static void mlx4_free_icm_pages(struct mlx4_dev *dev, struct mlx4_icm_chunk *chu
+ int i;
+
+ if (chunk->nsg > 0)
+- pci_unmap_sg(dev->persist->pdev, chunk->mem, chunk->npages,
++ pci_unmap_sg(dev->persist->pdev, chunk->sg, chunk->npages,
+ PCI_DMA_BIDIRECTIONAL);
+
+ for (i = 0; i < chunk->npages; ++i)
+- __free_pages(sg_page(&chunk->mem[i]),
+- get_order(chunk->mem[i].length));
++ __free_pages(sg_page(&chunk->sg[i]),
++ get_order(chunk->sg[i].length));
+ }
+
+ static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk *chunk)
+@@ -71,9 +71,9 @@ static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk *
+
+ for (i = 0; i < chunk->npages; ++i)
+ dma_free_coherent(&dev->persist->pdev->dev,
+- chunk->mem[i].length,
+- lowmem_page_address(sg_page(&chunk->mem[i])),
+- sg_dma_address(&chunk->mem[i]));
++ chunk->buf[i].size,
++ chunk->buf[i].addr,
++ chunk->buf[i].dma_addr);
+ }
+
+ void mlx4_free_icm(struct mlx4_dev *dev, struct mlx4_icm *icm, int coherent)
+@@ -111,22 +111,21 @@ static int mlx4_alloc_icm_pages(struct scatterlist *mem, int order,
+ return 0;
+ }
+
+-static int mlx4_alloc_icm_coherent(struct device *dev, struct scatterlist *mem,
+- int order, gfp_t gfp_mask)
++static int mlx4_alloc_icm_coherent(struct device *dev, struct mlx4_icm_buf *buf,
++ int order, gfp_t gfp_mask)
+ {
+- void *buf = dma_alloc_coherent(dev, PAGE_SIZE << order,
+- &sg_dma_address(mem), gfp_mask);
+- if (!buf)
++ buf->addr = dma_alloc_coherent(dev, PAGE_SIZE << order,
++ &buf->dma_addr, gfp_mask);
++ if (!buf->addr)
+ return -ENOMEM;
+
+- if (offset_in_page(buf)) {
+- dma_free_coherent(dev, PAGE_SIZE << order,
+- buf, sg_dma_address(mem));
++ if (offset_in_page(buf->addr)) {
++ dma_free_coherent(dev, PAGE_SIZE << order, buf->addr,
++ buf->dma_addr);
+ return -ENOMEM;
+ }
+
+- sg_set_buf(mem, buf, PAGE_SIZE << order);
+- sg_dma_len(mem) = PAGE_SIZE << order;
++ buf->size = PAGE_SIZE << order;
+ return 0;
+ }
+
+@@ -159,21 +158,21 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+
+ while (npages > 0) {
+ if (!chunk) {
+- chunk = kmalloc_node(sizeof(*chunk),
++ chunk = kzalloc_node(sizeof(*chunk),
+ gfp_mask & ~(__GFP_HIGHMEM |
+ __GFP_NOWARN),
+ dev->numa_node);
+ if (!chunk) {
+- chunk = kmalloc(sizeof(*chunk),
++ chunk = kzalloc(sizeof(*chunk),
+ gfp_mask & ~(__GFP_HIGHMEM |
+ __GFP_NOWARN));
+ if (!chunk)
+ goto fail;
+ }
++ chunk->coherent = coherent;
+
+- sg_init_table(chunk->mem, MLX4_ICM_CHUNK_LEN);
+- chunk->npages = 0;
+- chunk->nsg = 0;
++ if (!coherent)
++ sg_init_table(chunk->sg, MLX4_ICM_CHUNK_LEN);
+ list_add_tail(&chunk->list, &icm->chunk_list);
+ }
+
+@@ -186,10 +185,10 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+
+ if (coherent)
+ ret = mlx4_alloc_icm_coherent(&dev->persist->pdev->dev,
+- &chunk->mem[chunk->npages],
+- cur_order, mask);
++ &chunk->buf[chunk->npages],
++ cur_order, mask);
+ else
+- ret = mlx4_alloc_icm_pages(&chunk->mem[chunk->npages],
++ ret = mlx4_alloc_icm_pages(&chunk->sg[chunk->npages],
+ cur_order, mask,
+ dev->numa_node);
+
+@@ -205,7 +204,7 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+ if (coherent)
+ ++chunk->nsg;
+ else if (chunk->npages == MLX4_ICM_CHUNK_LEN) {
+- chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem,
++ chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->sg,
+ chunk->npages,
+ PCI_DMA_BIDIRECTIONAL);
+
+@@ -220,7 +219,7 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+ }
+
+ if (!coherent && chunk) {
+- chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem,
++ chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->sg,
+ chunk->npages,
+ PCI_DMA_BIDIRECTIONAL);
+
+@@ -320,7 +319,7 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
+ u64 idx;
+ struct mlx4_icm_chunk *chunk;
+ struct mlx4_icm *icm;
+- struct page *page = NULL;
++ void *addr = NULL;
+
+ if (!table->lowmem)
+ return NULL;
+@@ -336,28 +335,49 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
+
+ list_for_each_entry(chunk, &icm->chunk_list, list) {
+ for (i = 0; i < chunk->npages; ++i) {
++ dma_addr_t dma_addr;
++ size_t len;
++
++ if (table->coherent) {
++ len = chunk->buf[i].size;
++ dma_addr = chunk->buf[i].dma_addr;
++ addr = chunk->buf[i].addr;
++ } else {
++ struct page *page;
++
++ len = sg_dma_len(&chunk->sg[i]);
++ dma_addr = sg_dma_address(&chunk->sg[i]);
++
++ /* XXX: we should never do this for highmem
++ * allocation. This function either needs
++ * to be split, or the kernel virtual address
++ * return needs to be made optional.
++ */
++ page = sg_page(&chunk->sg[i]);
++ addr = lowmem_page_address(page);
++ }
++
+ if (dma_handle && dma_offset >= 0) {
+- if (sg_dma_len(&chunk->mem[i]) > dma_offset)
+- *dma_handle = sg_dma_address(&chunk->mem[i]) +
+- dma_offset;
+- dma_offset -= sg_dma_len(&chunk->mem[i]);
++ if (len > dma_offset)
++ *dma_handle = dma_addr + dma_offset;
++ dma_offset -= len;
+ }
++
+ /*
+ * DMA mapping can merge pages but not split them,
+ * so if we found the page, dma_handle has already
+ * been assigned to.
+ */
+- if (chunk->mem[i].length > offset) {
+- page = sg_page(&chunk->mem[i]);
++ if (len > offset)
+ goto out;
+- }
+- offset -= chunk->mem[i].length;
++ offset -= len;
+ }
+ }
+
++ addr = NULL;
+ out:
+ mutex_unlock(&table->mutex);
+- return page ? lowmem_page_address(page) + offset : NULL;
++ return addr ? addr + offset : NULL;
+ }
+
+ int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
+diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h
+index c9169a490557c..d199874b1c074 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/icm.h
++++ b/drivers/net/ethernet/mellanox/mlx4/icm.h
+@@ -47,11 +47,21 @@ enum {
+ MLX4_ICM_PAGE_SIZE = 1 << MLX4_ICM_PAGE_SHIFT,
+ };
+
++struct mlx4_icm_buf {
++ void *addr;
++ size_t size;
++ dma_addr_t dma_addr;
++};
++
+ struct mlx4_icm_chunk {
+ struct list_head list;
+ int npages;
+ int nsg;
+- struct scatterlist mem[MLX4_ICM_CHUNK_LEN];
++ bool coherent;
++ union {
++ struct scatterlist sg[MLX4_ICM_CHUNK_LEN];
++ struct mlx4_icm_buf buf[MLX4_ICM_CHUNK_LEN];
++ };
+ };
+
+ struct mlx4_icm {
+@@ -114,12 +124,18 @@ static inline void mlx4_icm_next(struct mlx4_icm_iter *iter)
+
+ static inline dma_addr_t mlx4_icm_addr(struct mlx4_icm_iter *iter)
+ {
+- return sg_dma_address(&iter->chunk->mem[iter->page_idx]);
++ if (iter->chunk->coherent)
++ return iter->chunk->buf[iter->page_idx].dma_addr;
++ else
++ return sg_dma_address(&iter->chunk->sg[iter->page_idx]);
+ }
+
+ static inline unsigned long mlx4_icm_size(struct mlx4_icm_iter *iter)
+ {
+- return sg_dma_len(&iter->chunk->mem[iter->page_idx]);
++ if (iter->chunk->coherent)
++ return iter->chunk->buf[iter->page_idx].size;
++ else
++ return sg_dma_len(&iter->chunk->sg[iter->page_idx]);
+ }
+
+ int mlx4_MAP_ICM_AUX(struct mlx4_dev *dev, struct mlx4_icm *icm);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+index 16ceeb1b2c9d8..da52e60d4437c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -633,6 +633,7 @@ enum {
+ MLX5E_STATE_ASYNC_EVENTS_ENABLED,
+ MLX5E_STATE_OPENED,
+ MLX5E_STATE_DESTROYING,
++ MLX5E_STATE_XDP_TX_ENABLED,
+ };
+
+ struct mlx5e_rqt {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+index ad6d471d00dd4..4a33c9a7cac7e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+@@ -262,7 +262,8 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
+ int sq_num;
+ int i;
+
+- if (unlikely(!test_bit(MLX5E_STATE_OPENED, &priv->state)))
++ /* this flag is sufficient, no need to test internal sq state */
++ if (unlikely(!mlx5e_xdp_tx_is_enabled(priv)))
+ return -ENETDOWN;
+
+ if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK))
+@@ -275,9 +276,6 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
+
+ sq = &priv->channels.c[sq_num]->xdpsq;
+
+- if (unlikely(!test_bit(MLX5E_SQ_STATE_ENABLED, &sq->state)))
+- return -ENETDOWN;
+-
+ for (i = 0; i < n; i++) {
+ struct xdp_frame *xdpf = frames[i];
+ struct mlx5e_xdp_info xdpi;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+index 6dfab045925f0..4d096623178b9 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+@@ -49,6 +49,23 @@ bool mlx5e_xmit_xdp_frame(struct mlx5e_xdpsq *sq, struct mlx5e_xdp_info *xdpi);
+ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
+ u32 flags);
+
++static inline void mlx5e_xdp_tx_enable(struct mlx5e_priv *priv)
++{
++ set_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
++}
++
++static inline void mlx5e_xdp_tx_disable(struct mlx5e_priv *priv)
++{
++ clear_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
++ /* let other device's napi(s) see our new state */
++ synchronize_rcu();
++}
++
++static inline bool mlx5e_xdp_tx_is_enabled(struct mlx5e_priv *priv)
++{
++ return test_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
++}
++
+ static inline void mlx5e_xmit_xdp_doorbell(struct mlx5e_xdpsq *sq)
+ {
+ struct mlx5_wq_cyc *wq = &sq->wq;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 944f21f99d437..637d59c01fe5c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -2890,6 +2890,7 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv)
+
+ mlx5e_build_tx2sq_maps(priv);
+ mlx5e_activate_channels(&priv->channels);
++ mlx5e_xdp_tx_enable(priv);
+ netif_tx_start_all_queues(priv->netdev);
+
+ if (MLX5_ESWITCH_MANAGER(priv->mdev))
+@@ -2911,6 +2912,7 @@ void mlx5e_deactivate_priv_channels(struct mlx5e_priv *priv)
+ */
+ netif_tx_stop_all_queues(priv->netdev);
+ netif_tx_disable(priv->netdev);
++ mlx5e_xdp_tx_disable(priv);
+ mlx5e_deactivate_channels(&priv->channels);
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index c9cc9747d21d1..701624a63d2f4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -144,6 +144,7 @@ static void mlx5e_rep_update_sw_counters(struct mlx5e_priv *priv)
+
+ s->tx_packets += sq_stats->packets;
+ s->tx_bytes += sq_stats->bytes;
++ s->tx_queue_dropped += sq_stats->dropped;
+ }
+ }
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index 3092c59c0dc71..9f7f8425f6767 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -96,6 +96,7 @@ struct mlx5e_tc_flow_parse_attr {
+ struct ip_tunnel_info tun_info;
+ struct mlx5_flow_spec spec;
+ int num_mod_hdr_actions;
++ int max_mod_hdr_actions;
+ void *mod_hdr_actions;
+ int mirred_ifindex;
+ };
+@@ -1742,9 +1743,9 @@ static struct mlx5_fields fields[] = {
+ OFFLOAD(UDP_DPORT, 2, udp.dest, 0),
+ };
+
+-/* On input attr->num_mod_hdr_actions tells how many HW actions can be parsed at
+- * max from the SW pedit action. On success, it says how many HW actions were
+- * actually parsed.
++/* On input attr->max_mod_hdr_actions tells how many HW actions can be parsed at
++ * max from the SW pedit action. On success, attr->num_mod_hdr_actions
++ * says how many HW actions were actually parsed.
+ */
+ static int offload_pedit_fields(struct pedit_headers *masks,
+ struct pedit_headers *vals,
+@@ -1767,9 +1768,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
+ add_vals = &vals[TCA_PEDIT_KEY_EX_CMD_ADD];
+
+ action_size = MLX5_UN_SZ_BYTES(set_action_in_add_action_in_auto);
+- action = parse_attr->mod_hdr_actions;
+- max_actions = parse_attr->num_mod_hdr_actions;
+- nactions = 0;
++ action = parse_attr->mod_hdr_actions +
++ parse_attr->num_mod_hdr_actions * action_size;
++
++ max_actions = parse_attr->max_mod_hdr_actions;
++ nactions = parse_attr->num_mod_hdr_actions;
+
+ for (i = 0; i < ARRAY_SIZE(fields); i++) {
+ f = &fields[i];
+@@ -1874,7 +1877,7 @@ static int alloc_mod_hdr_actions(struct mlx5e_priv *priv,
+ if (!parse_attr->mod_hdr_actions)
+ return -ENOMEM;
+
+- parse_attr->num_mod_hdr_actions = max_actions;
++ parse_attr->max_mod_hdr_actions = max_actions;
+ return 0;
+ }
+
+@@ -1918,9 +1921,11 @@ static int parse_tc_pedit_action(struct mlx5e_priv *priv,
+ goto out_err;
+ }
+
+- err = alloc_mod_hdr_actions(priv, a, namespace, parse_attr);
+- if (err)
+- goto out_err;
++ if (!parse_attr->mod_hdr_actions) {
++ err = alloc_mod_hdr_actions(priv, a, namespace, parse_attr);
++ if (err)
++ goto out_err;
++ }
+
+ err = offload_pedit_fields(masks, vals, parse_attr);
+ if (err < 0)
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+index c7901a3f2a794..a903e97793f9a 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+@@ -1367,10 +1367,10 @@ static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci,
+ u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY);
+
+ if ((val & MLXSW_PCI_FW_READY_MASK) == MLXSW_PCI_FW_READY_MAGIC)
+- break;
++ return 0;
+ cond_resched();
+ } while (time_before(jiffies, end));
+- return 0;
++ return -EBUSY;
+ }
+
+ static int mlxsw_pci_alloc_irq_vectors(struct mlxsw_pci *mlxsw_pci)
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
+index e3c6fe8b1d406..1dcf152b28138 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
+@@ -75,7 +75,15 @@ mlxsw_sp_acl_ctcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp,
+ act_set = mlxsw_afa_block_first_set(rulei->act_block);
+ mlxsw_reg_ptce2_flex_action_set_memcpy_to(ptce2_pl, act_set);
+
+- return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl);
++ err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl);
++ if (err)
++ goto err_ptce2_write;
++
++ return 0;
++
++err_ptce2_write:
++ cregion->ops->entry_remove(cregion, centry);
++ return err;
+ }
+
+ static void
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index cdec48bcc6ad5..af673abdb4823 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -1209,7 +1209,7 @@ mlxsw_sp_bridge_port_fdb_flush(struct mlxsw_sp *mlxsw_sp,
+ static enum mlxsw_reg_sfd_rec_policy mlxsw_sp_sfd_rec_policy(bool dynamic)
+ {
+ return dynamic ? MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_INGRESS :
+- MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY;
++ MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_MLAG;
+ }
+
+ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
+@@ -1221,7 +1221,7 @@ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
+ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ const char *mac, u16 fid, bool adding,
+ enum mlxsw_reg_sfd_rec_action action,
+- bool dynamic)
++ enum mlxsw_reg_sfd_rec_policy policy)
+ {
+ char *sfd_pl;
+ u8 num_rec;
+@@ -1232,8 +1232,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ return -ENOMEM;
+
+ mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0);
+- mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic),
+- mac, fid, action, local_port);
++ mlxsw_reg_sfd_uc_pack(sfd_pl, 0, policy, mac, fid, action, local_port);
+ num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl);
+ err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl);
+ if (err)
+@@ -1252,7 +1251,8 @@ static int mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ bool dynamic)
+ {
+ return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid, adding,
+- MLXSW_REG_SFD_REC_ACTION_NOP, dynamic);
++ MLXSW_REG_SFD_REC_ACTION_NOP,
++ mlxsw_sp_sfd_rec_policy(dynamic));
+ }
+
+ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
+@@ -1260,7 +1260,7 @@ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
+ {
+ return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, 0, mac, fid, adding,
+ MLXSW_REG_SFD_REC_ACTION_FORWARD_IP_ROUTER,
+- false);
++ MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY);
+ }
+
+ static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index 2fa1c050a14b4..92cd8abeb41d7 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -1592,6 +1592,10 @@ static void qed_ll2_post_rx_buffer_notify_fw(struct qed_hwfn *p_hwfn,
+ cq_prod = qed_chain_get_prod_idx(&p_rx->rcq_chain);
+ rx_prod.bd_prod = cpu_to_le16(bd_prod);
+ rx_prod.cqe_prod = cpu_to_le16(cq_prod);
++
++ /* Make sure chain element is updated before ringing the doorbell */
++ dma_wmb();
++
+ DIRECT_REG_WR(p_rx->set_prod_addr, *((u32 *)&rx_prod));
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+index 20909036e0028..1c39305274440 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+@@ -260,6 +260,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
+ struct stmmac_extra_stats *x, u32 chan)
+ {
+ u32 intr_status = readl(ioaddr + XGMAC_DMA_CH_STATUS(chan));
++ u32 intr_en = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+ int ret = 0;
+
+ /* ABNORMAL interrupts */
+@@ -279,8 +280,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
+ x->normal_irq_n++;
+
+ if (likely(intr_status & XGMAC_RI)) {
+- u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+- if (likely(value & XGMAC_RIE)) {
++ if (likely(intr_en & XGMAC_RIE)) {
+ x->rx_normal_irq_n++;
+ ret |= handle_rx;
+ }
+@@ -292,7 +292,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
+ }
+
+ /* Clear interrupts */
+- writel(~0x0, ioaddr + XGMAC_DMA_CH_STATUS(chan));
++ writel(intr_en & intr_status, ioaddr + XGMAC_DMA_CH_STATUS(chan));
+
+ return ret;
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 2103b865726ac..123b74e25ed81 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3522,27 +3522,28 @@ static int stmmac_napi_poll(struct napi_struct *napi, int budget)
+ struct stmmac_channel *ch =
+ container_of(napi, struct stmmac_channel, napi);
+ struct stmmac_priv *priv = ch->priv_data;
+- int work_done = 0, work_rem = budget;
++ int work_done, rx_done = 0, tx_done = 0;
+ u32 chan = ch->index;
+
+ priv->xstats.napi_poll++;
+
+- if (ch->has_tx) {
+- int done = stmmac_tx_clean(priv, work_rem, chan);
++ if (ch->has_tx)
++ tx_done = stmmac_tx_clean(priv, budget, chan);
++ if (ch->has_rx)
++ rx_done = stmmac_rx(priv, budget, chan);
+
+- work_done += done;
+- work_rem -= done;
+- }
+-
+- if (ch->has_rx) {
+- int done = stmmac_rx(priv, work_rem, chan);
++ work_done = max(rx_done, tx_done);
++ work_done = min(work_done, budget);
+
+- work_done += done;
+- work_rem -= done;
+- }
++ if (work_done < budget && napi_complete_done(napi, work_done)) {
++ int stat;
+
+- if (work_done < budget && napi_complete_done(napi, work_done))
+ stmmac_enable_dma_irq(priv, priv->ioaddr, chan);
++ stat = stmmac_dma_interrupt_status(priv, priv->ioaddr,
++ &priv->xstats, chan);
++ if (stat && napi_reschedule(napi))
++ stmmac_disable_dma_irq(priv, priv->ioaddr, chan);
++ }
+
+ return work_done;
+ }
+@@ -4191,6 +4192,18 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
+ return ret;
+ }
+
++ /* Rx Watchdog is available in the COREs newer than the 3.40.
++ * In some case, for example on bugged HW this feature
++ * has to be disable and this can be done by passing the
++ * riwt_off field from the platform.
++ */
++ if (((priv->synopsys_id >= DWMAC_CORE_3_50) ||
++ (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) {
++ priv->use_riwt = 1;
++ dev_info(priv->device,
++ "Enable RX Mitigation via HW Watchdog Timer\n");
++ }
++
+ return 0;
+ }
+
+@@ -4323,18 +4336,6 @@ int stmmac_dvr_probe(struct device *device,
+ if (flow_ctrl)
+ priv->flow_ctrl = FLOW_AUTO; /* RX/TX pause on */
+
+- /* Rx Watchdog is available in the COREs newer than the 3.40.
+- * In some case, for example on bugged HW this feature
+- * has to be disable and this can be done by passing the
+- * riwt_off field from the platform.
+- */
+- if (((priv->synopsys_id >= DWMAC_CORE_3_50) ||
+- (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) {
+- priv->use_riwt = 1;
+- dev_info(priv->device,
+- "Enable RX Mitigation via HW Watchdog Timer\n");
+- }
+-
+ /* Setup channels NAPI */
+ maxq = max(priv->plat->rx_queues_to_use, priv->plat->tx_queues_to_use);
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+index c54a50dbd5ac2..d819e8eaba122 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+@@ -299,7 +299,17 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
+ */
+ static void stmmac_pci_remove(struct pci_dev *pdev)
+ {
++ int i;
++
+ stmmac_dvr_remove(&pdev->dev);
++
++ for (i = 0; i <= PCI_STD_RESOURCE_END; i++) {
++ if (pci_resource_len(pdev, i) == 0)
++ continue;
++ pcim_iounmap_regions(pdev, BIT(i));
++ break;
++ }
++
+ pci_disable_device(pdev);
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 531294f4978bc..58ea18af9813a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -301,6 +301,8 @@ static int tc_setup_cbs(struct stmmac_priv *priv,
+ /* Queue 0 is not AVB capable */
+ if (queue <= 0 || queue >= tx_queues_count)
+ return -EINVAL;
++ if (!priv->dma_cap.av)
++ return -EOPNOTSUPP;
+ if (priv->speed != SPEED_100 && priv->speed != SPEED_1000)
+ return -EOPNOTSUPP;
+
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 493cd382b8aa0..01711e6e9a394 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -1406,9 +1406,13 @@ static void geneve_link_config(struct net_device *dev,
+ }
+ #if IS_ENABLED(CONFIG_IPV6)
+ case AF_INET6: {
+- struct rt6_info *rt = rt6_lookup(geneve->net,
+- &info->key.u.ipv6.dst, NULL, 0,
+- NULL, 0);
++ struct rt6_info *rt;
++
++ if (!__in6_dev_get(dev))
++ break;
++
++ rt = rt6_lookup(geneve->net, &info->key.u.ipv6.dst, NULL, 0,
++ NULL, 0);
+
+ if (rt && rt->dst.dev)
+ ldev_mtu = rt->dst.dev->mtu - GENEVE_IPV6_HLEN;
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 70f3f90c2ed69..2787e8b1d668a 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -502,6 +502,17 @@ static void phylink_run_resolve(struct phylink *pl)
+ queue_work(system_power_efficient_wq, &pl->resolve);
+ }
+
++static void phylink_run_resolve_and_disable(struct phylink *pl, int bit)
++{
++ unsigned long state = pl->phylink_disable_state;
++
++ set_bit(bit, &pl->phylink_disable_state);
++ if (state == 0) {
++ queue_work(system_power_efficient_wq, &pl->resolve);
++ flush_work(&pl->resolve);
++ }
++}
++
+ static void phylink_fixed_poll(struct timer_list *t)
+ {
+ struct phylink *pl = container_of(t, struct phylink, link_poll);
+@@ -955,9 +966,7 @@ void phylink_stop(struct phylink *pl)
+ if (pl->link_an_mode == MLO_AN_FIXED && !IS_ERR(pl->link_gpio))
+ del_timer_sync(&pl->link_poll);
+
+- set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
+- queue_work(system_power_efficient_wq, &pl->resolve);
+- flush_work(&pl->resolve);
++ phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_STOPPED);
+ }
+ EXPORT_SYMBOL_GPL(phylink_stop);
+
+@@ -1664,9 +1673,7 @@ static void phylink_sfp_link_down(void *upstream)
+
+ ASSERT_RTNL();
+
+- set_bit(PHYLINK_DISABLE_LINK, &pl->phylink_disable_state);
+- queue_work(system_power_efficient_wq, &pl->resolve);
+- flush_work(&pl->resolve);
++ phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_LINK);
+ }
+
+ static void phylink_sfp_link_up(void *upstream)
+diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
+index ad9db652874dc..fef701bfad62e 100644
+--- a/drivers/net/phy/sfp-bus.c
++++ b/drivers/net/phy/sfp-bus.c
+@@ -347,6 +347,7 @@ static int sfp_register_bus(struct sfp_bus *bus)
+ return ret;
+ }
+ }
++ bus->socket_ops->attach(bus->sfp);
+ if (bus->started)
+ bus->socket_ops->start(bus->sfp);
+ bus->netdev->sfp_bus = bus;
+@@ -362,6 +363,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
+ if (bus->registered) {
+ if (bus->started)
+ bus->socket_ops->stop(bus->sfp);
++ bus->socket_ops->detach(bus->sfp);
+ if (bus->phydev && ops && ops->disconnect_phy)
+ ops->disconnect_phy(bus->upstream);
+ }
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index fd8bb998ae52d..68c8fbf099f87 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -184,6 +184,7 @@ struct sfp {
+
+ struct gpio_desc *gpio[GPIO_MAX];
+
++ bool attached;
+ unsigned int state;
+ struct delayed_work poll;
+ struct delayed_work timeout;
+@@ -1475,7 +1476,7 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
+ */
+ switch (sfp->sm_mod_state) {
+ default:
+- if (event == SFP_E_INSERT) {
++ if (event == SFP_E_INSERT && sfp->attached) {
+ sfp_module_tx_disable(sfp);
+ sfp_sm_ins_next(sfp, SFP_MOD_PROBE, T_PROBE_INIT);
+ }
+@@ -1607,6 +1608,19 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
+ mutex_unlock(&sfp->sm_mutex);
+ }
+
++static void sfp_attach(struct sfp *sfp)
++{
++ sfp->attached = true;
++ if (sfp->state & SFP_F_PRESENT)
++ sfp_sm_event(sfp, SFP_E_INSERT);
++}
++
++static void sfp_detach(struct sfp *sfp)
++{
++ sfp->attached = false;
++ sfp_sm_event(sfp, SFP_E_REMOVE);
++}
++
+ static void sfp_start(struct sfp *sfp)
+ {
+ sfp_sm_event(sfp, SFP_E_DEV_UP);
+@@ -1667,6 +1681,8 @@ static int sfp_module_eeprom(struct sfp *sfp, struct ethtool_eeprom *ee,
+ }
+
+ static const struct sfp_socket_ops sfp_module_ops = {
++ .attach = sfp_attach,
++ .detach = sfp_detach,
+ .start = sfp_start,
+ .stop = sfp_stop,
+ .module_info = sfp_module_info,
+@@ -1834,10 +1850,6 @@ static int sfp_probe(struct platform_device *pdev)
+ dev_info(sfp->dev, "Host maximum power %u.%uW\n",
+ sfp->max_power_mW / 1000, (sfp->max_power_mW / 100) % 10);
+
+- sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops);
+- if (!sfp->sfp_bus)
+- return -ENOMEM;
+-
+ /* Get the initial state, and always signal TX disable,
+ * since the network interface will not be up.
+ */
+@@ -1848,10 +1860,6 @@ static int sfp_probe(struct platform_device *pdev)
+ sfp->state |= SFP_F_RATE_SELECT;
+ sfp_set_state(sfp, sfp->state);
+ sfp_module_tx_disable(sfp);
+- rtnl_lock();
+- if (sfp->state & SFP_F_PRESENT)
+- sfp_sm_event(sfp, SFP_E_INSERT);
+- rtnl_unlock();
+
+ for (i = 0; i < GPIO_MAX; i++) {
+ if (gpio_flags[i] != GPIOD_IN || !sfp->gpio[i])
+@@ -1884,6 +1892,10 @@ static int sfp_probe(struct platform_device *pdev)
+ dev_warn(sfp->dev,
+ "No tx_disable pin: SFP modules will always be emitting.\n");
+
++ sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops);
++ if (!sfp->sfp_bus)
++ return -ENOMEM;
++
+ return 0;
+ }
+
+diff --git a/drivers/net/phy/sfp.h b/drivers/net/phy/sfp.h
+index 31b0acf337e27..64f54b0bbd8c4 100644
+--- a/drivers/net/phy/sfp.h
++++ b/drivers/net/phy/sfp.h
+@@ -7,6 +7,8 @@
+ struct sfp;
+
+ struct sfp_socket_ops {
++ void (*attach)(struct sfp *sfp);
++ void (*detach)(struct sfp *sfp);
+ void (*start)(struct sfp *sfp);
+ void (*stop)(struct sfp *sfp);
+ int (*module_info)(struct sfp *sfp, struct ethtool_modinfo *modinfo);
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 4b6572f0188a7..723814d84b7d8 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -256,17 +256,6 @@ static void __team_option_inst_mark_removed_port(struct team *team,
+ }
+ }
+
+-static bool __team_option_inst_tmp_find(const struct list_head *opts,
+- const struct team_option_inst *needle)
+-{
+- struct team_option_inst *opt_inst;
+-
+- list_for_each_entry(opt_inst, opts, tmp_list)
+- if (opt_inst == needle)
+- return true;
+- return false;
+-}
+-
+ static int __team_options_register(struct team *team,
+ const struct team_option *option,
+ size_t option_count)
+@@ -2463,7 +2452,6 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ int err = 0;
+ int i;
+ struct nlattr *nl_option;
+- LIST_HEAD(opt_inst_list);
+
+ rtnl_lock();
+
+@@ -2483,6 +2471,7 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ struct nlattr *opt_attrs[TEAM_ATTR_OPTION_MAX + 1];
+ struct nlattr *attr;
+ struct nlattr *attr_data;
++ LIST_HEAD(opt_inst_list);
+ enum team_option_type opt_type;
+ int opt_port_ifindex = 0; /* != 0 for per-port options */
+ u32 opt_array_index = 0;
+@@ -2587,23 +2576,17 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ if (err)
+ goto team_put;
+ opt_inst->changed = true;
+-
+- /* dumb/evil user-space can send us duplicate opt,
+- * keep only the last one
+- */
+- if (__team_option_inst_tmp_find(&opt_inst_list,
+- opt_inst))
+- continue;
+-
+ list_add(&opt_inst->tmp_list, &opt_inst_list);
+ }
+ if (!opt_found) {
+ err = -ENOENT;
+ goto team_put;
+ }
+- }
+
+- err = team_nl_send_event_options_get(team, &opt_inst_list);
++ err = team_nl_send_event_options_get(team, &opt_inst_list);
++ if (err)
++ break;
++ }
+
+ team_put:
+ team_nl_team_put(team);
+diff --git a/drivers/pinctrl/pinctrl-max77620.c b/drivers/pinctrl/pinctrl-max77620.c
+index a7f37063518ec..3d05bc1937d40 100644
+--- a/drivers/pinctrl/pinctrl-max77620.c
++++ b/drivers/pinctrl/pinctrl-max77620.c
+@@ -34,14 +34,12 @@ enum max77620_pin_ppdrv {
+ MAX77620_PIN_PP_DRV,
+ };
+
+-enum max77620_pinconf_param {
+- MAX77620_ACTIVE_FPS_SOURCE = PIN_CONFIG_END + 1,
+- MAX77620_ACTIVE_FPS_POWER_ON_SLOTS,
+- MAX77620_ACTIVE_FPS_POWER_DOWN_SLOTS,
+- MAX77620_SUSPEND_FPS_SOURCE,
+- MAX77620_SUSPEND_FPS_POWER_ON_SLOTS,
+- MAX77620_SUSPEND_FPS_POWER_DOWN_SLOTS,
+-};
++#define MAX77620_ACTIVE_FPS_SOURCE (PIN_CONFIG_END + 1)
++#define MAX77620_ACTIVE_FPS_POWER_ON_SLOTS (PIN_CONFIG_END + 2)
++#define MAX77620_ACTIVE_FPS_POWER_DOWN_SLOTS (PIN_CONFIG_END + 3)
++#define MAX77620_SUSPEND_FPS_SOURCE (PIN_CONFIG_END + 4)
++#define MAX77620_SUSPEND_FPS_POWER_ON_SLOTS (PIN_CONFIG_END + 5)
++#define MAX77620_SUSPEND_FPS_POWER_DOWN_SLOTS (PIN_CONFIG_END + 6)
+
+ struct max77620_pin_function {
+ const char *name;
+diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+index bf07735275a49..0fc382cb977bf 100644
+--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
++++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+@@ -1144,7 +1144,7 @@ static void ddp_clear_map(struct cxgbi_device *cdev, struct cxgbi_ppm *ppm,
+ }
+
+ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
+- unsigned int tid, int pg_idx, bool reply)
++ unsigned int tid, int pg_idx)
+ {
+ struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0,
+ GFP_KERNEL);
+@@ -1160,7 +1160,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
+- req->reply = V_NO_REPLY(reply ? 0 : 1);
++ req->reply = V_NO_REPLY(1);
+ req->cpu_idx = 0;
+ req->word = htons(31);
+ req->mask = cpu_to_be64(0xF0000000);
+@@ -1177,11 +1177,10 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
+ * @tid: connection id
+ * @hcrc: header digest enabled
+ * @dcrc: data digest enabled
+- * @reply: request reply from h/w
+ * set up the iscsi digest settings for a connection identified by tid
+ */
+ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+- int hcrc, int dcrc, int reply)
++ int hcrc, int dcrc)
+ {
+ struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0,
+ GFP_KERNEL);
+@@ -1197,7 +1196,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
+- req->reply = V_NO_REPLY(reply ? 0 : 1);
++ req->reply = V_NO_REPLY(1);
+ req->cpu_idx = 0;
+ req->word = htons(31);
+ req->mask = cpu_to_be64(0x0F000000);
+diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+index 211da1d5a8699..689d6c813a50d 100644
+--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
++++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+@@ -1517,16 +1517,22 @@ static void do_set_tcb_rpl(struct cxgbi_device *cdev, struct sk_buff *skb)
+ struct cxgbi_sock *csk;
+
+ csk = lookup_tid(t, tid);
+- if (!csk)
++ if (!csk) {
+ pr_err("can't find conn. for tid %u.\n", tid);
++ return;
++ }
+
+ log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
+ "csk 0x%p,%u,%lx,%u, status 0x%x.\n",
+ csk, csk->state, csk->flags, csk->tid, rpl->status);
+
+- if (rpl->status != CPL_ERR_NONE)
++ if (rpl->status != CPL_ERR_NONE) {
+ pr_err("csk 0x%p,%u, SET_TCB_RPL status %u.\n",
+ csk, tid, rpl->status);
++ csk->err = -EINVAL;
++ }
++
++ complete(&csk->cmpl);
+
+ __kfree_skb(skb);
+ }
+@@ -1903,7 +1909,7 @@ static int ddp_set_map(struct cxgbi_ppm *ppm, struct cxgbi_sock *csk,
+ }
+
+ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
+- int pg_idx, bool reply)
++ int pg_idx)
+ {
+ struct sk_buff *skb;
+ struct cpl_set_tcb_field *req;
+@@ -1919,7 +1925,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ INIT_TP_WR(req, csk->tid);
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, csk->tid));
+- req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid));
++ req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid));
+ req->word_cookie = htons(0);
+ req->mask = cpu_to_be64(0x3 << 8);
+ req->val = cpu_to_be64(pg_idx << 8);
+@@ -1928,12 +1934,15 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
+ log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
+ "csk 0x%p, tid 0x%x, pg_idx %u.\n", csk, csk->tid, pg_idx);
+
++ reinit_completion(&csk->cmpl);
+ cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb);
+- return 0;
++ wait_for_completion(&csk->cmpl);
++
++ return csk->err;
+ }
+
+ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+- int hcrc, int dcrc, int reply)
++ int hcrc, int dcrc)
+ {
+ struct sk_buff *skb;
+ struct cpl_set_tcb_field *req;
+@@ -1951,7 +1960,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ INIT_TP_WR(req, tid);
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
+- req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid));
++ req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid));
+ req->word_cookie = htons(0);
+ req->mask = cpu_to_be64(0x3 << 4);
+ req->val = cpu_to_be64(((hcrc ? ULP_CRC_HEADER : 0) |
+@@ -1961,8 +1970,11 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+ log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
+ "csk 0x%p, tid 0x%x, crc %d,%d.\n", csk, csk->tid, hcrc, dcrc);
+
++ reinit_completion(&csk->cmpl);
+ cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb);
+- return 0;
++ wait_for_completion(&csk->cmpl);
++
++ return csk->err;
+ }
+
+ static struct cxgbi_ppm *cdev2ppm(struct cxgbi_device *cdev)
+diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
+index 3f3af5e74a07d..f2c561ca731a3 100644
+--- a/drivers/scsi/cxgbi/libcxgbi.c
++++ b/drivers/scsi/cxgbi/libcxgbi.c
+@@ -573,6 +573,7 @@ static struct cxgbi_sock *cxgbi_sock_create(struct cxgbi_device *cdev)
+ skb_queue_head_init(&csk->receive_queue);
+ skb_queue_head_init(&csk->write_queue);
+ timer_setup(&csk->retry_timer, NULL, 0);
++ init_completion(&csk->cmpl);
+ rwlock_init(&csk->callback_lock);
+ csk->cdev = cdev;
+ csk->flags = 0;
+@@ -2252,14 +2253,14 @@ int cxgbi_set_conn_param(struct iscsi_cls_conn *cls_conn,
+ if (!err && conn->hdrdgst_en)
+ err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid,
+ conn->hdrdgst_en,
+- conn->datadgst_en, 0);
++ conn->datadgst_en);
+ break;
+ case ISCSI_PARAM_DATADGST_EN:
+ err = iscsi_set_param(cls_conn, param, buf, buflen);
+ if (!err && conn->datadgst_en)
+ err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid,
+ conn->hdrdgst_en,
+- conn->datadgst_en, 0);
++ conn->datadgst_en);
+ break;
+ case ISCSI_PARAM_MAX_R2T:
+ return iscsi_tcp_set_max_r2t(conn, buf);
+@@ -2385,7 +2386,7 @@ int cxgbi_bind_conn(struct iscsi_cls_session *cls_session,
+
+ ppm = csk->cdev->cdev2ppm(csk->cdev);
+ err = csk->cdev->csk_ddp_setup_pgidx(csk, csk->tid,
+- ppm->tformat.pgsz_idx_dflt, 0);
++ ppm->tformat.pgsz_idx_dflt);
+ if (err < 0)
+ return err;
+
+diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
+index dcb190e753434..3bf7414a75e5e 100644
+--- a/drivers/scsi/cxgbi/libcxgbi.h
++++ b/drivers/scsi/cxgbi/libcxgbi.h
+@@ -146,6 +146,7 @@ struct cxgbi_sock {
+ struct sk_buff_head receive_queue;
+ struct sk_buff_head write_queue;
+ struct timer_list retry_timer;
++ struct completion cmpl;
+ int err;
+ rwlock_t callback_lock;
+ void *user_data;
+@@ -487,9 +488,9 @@ struct cxgbi_device {
+ struct cxgbi_ppm *,
+ struct cxgbi_task_tag_info *);
+ int (*csk_ddp_setup_digest)(struct cxgbi_sock *,
+- unsigned int, int, int, int);
++ unsigned int, int, int);
+ int (*csk_ddp_setup_pgidx)(struct cxgbi_sock *,
+- unsigned int, int, bool);
++ unsigned int, int);
+
+ void (*csk_release_offload_resources)(struct cxgbi_sock *);
+ int (*csk_rx_pdu_ready)(struct cxgbi_sock *, struct sk_buff *);
+diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
+index 08c7b1e25fe48..dde84f7443136 100644
+--- a/drivers/scsi/isci/init.c
++++ b/drivers/scsi/isci/init.c
+@@ -588,6 +588,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
+ shost->max_lun = ~0;
+ shost->max_cmd_len = MAX_COMMAND_SIZE;
+
++ /* turn on DIF support */
++ scsi_host_set_prot(shost,
++ SHOST_DIF_TYPE1_PROTECTION |
++ SHOST_DIF_TYPE2_PROTECTION |
++ SHOST_DIF_TYPE3_PROTECTION);
++ scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);
++
+ err = scsi_add_host(shost, &pdev->dev);
+ if (err)
+ goto err_shost;
+@@ -675,13 +682,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto err_host_alloc;
+ }
+ pci_info->hosts[i] = h;
+-
+- /* turn on DIF support */
+- scsi_host_set_prot(to_shost(h),
+- SHOST_DIF_TYPE1_PROTECTION |
+- SHOST_DIF_TYPE2_PROTECTION |
+- SHOST_DIF_TYPE3_PROTECTION);
+- scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC);
+ }
+
+ err = isci_setup_interrupts(pdev);
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index 2f0a4f2c5ff80..d4821b9dea45d 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -954,6 +954,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
+
+ qedi_ep = ep->dd_data;
+ if (qedi_ep->state == EP_STATE_IDLE ||
++ qedi_ep->state == EP_STATE_OFLDCONN_NONE ||
+ qedi_ep->state == EP_STATE_OFLDCONN_FAILED)
+ return -1;
+
+@@ -1036,6 +1037,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
+
+ switch (qedi_ep->state) {
+ case EP_STATE_OFLDCONN_START:
++ case EP_STATE_OFLDCONN_NONE:
+ goto ep_release_conn;
+ case EP_STATE_OFLDCONN_FAILED:
+ break;
+@@ -1226,6 +1228,7 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
+
+ if (!is_valid_ether_addr(&path_data->mac_addr[0])) {
+ QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n");
++ qedi_ep->state = EP_STATE_OFLDCONN_NONE;
+ ret = -EIO;
+ goto set_path_exit;
+ }
+diff --git a/drivers/scsi/qedi/qedi_iscsi.h b/drivers/scsi/qedi/qedi_iscsi.h
+index 11260776212fa..892d70d545537 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.h
++++ b/drivers/scsi/qedi/qedi_iscsi.h
+@@ -59,6 +59,7 @@ enum {
+ EP_STATE_OFLDCONN_FAILED = 0x2000,
+ EP_STATE_CONNECT_FAILED = 0x4000,
+ EP_STATE_DISCONN_TIMEDOUT = 0x8000,
++ EP_STATE_OFLDCONN_NONE = 0x10000,
+ };
+
+ struct qedi_conn;
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index 0e13349dce570..575445c761b48 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -7237,6 +7237,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha,
+
+ rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn,
+ fw_ddb_entry);
++ if (rc)
++ goto free_sess;
+
+ ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n",
+ __func__, fnode_sess->dev.kobj.name);
+diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
+index 14e5bf7af0bb1..c3bcaaec0fc5c 100644
+--- a/drivers/scsi/ufs/ufs.h
++++ b/drivers/scsi/ufs/ufs.h
+@@ -195,7 +195,7 @@ enum ufs_desc_def_size {
+ QUERY_DESC_CONFIGURATION_DEF_SIZE = 0x90,
+ QUERY_DESC_UNIT_DEF_SIZE = 0x23,
+ QUERY_DESC_INTERCONNECT_DEF_SIZE = 0x06,
+- QUERY_DESC_GEOMETRY_DEF_SIZE = 0x44,
++ QUERY_DESC_GEOMETRY_DEF_SIZE = 0x48,
+ QUERY_DESC_POWER_DEF_SIZE = 0x62,
+ QUERY_DESC_HEALTH_DEF_SIZE = 0x25,
+ };
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 12ddb5928a738..6e80dfe4fa979 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -7768,6 +7768,8 @@ out:
+ trace_ufshcd_system_resume(dev_name(hba->dev), ret,
+ ktime_to_us(ktime_sub(ktime_get(), start)),
+ hba->curr_dev_pwr_mode, hba->uic_link_state);
++ if (!ret)
++ hba->is_sys_suspended = false;
+ return ret;
+ }
+ EXPORT_SYMBOL(ufshcd_system_resume);
+diff --git a/drivers/staging/erofs/data.c b/drivers/staging/erofs/data.c
+index ac263a180253e..894e60ecebe20 100644
+--- a/drivers/staging/erofs/data.c
++++ b/drivers/staging/erofs/data.c
+@@ -25,7 +25,7 @@ static inline void read_endio(struct bio *bio)
+ struct page *page = bvec->bv_page;
+
+ /* page is already locked */
+- BUG_ON(PageUptodate(page));
++ DBG_BUGON(PageUptodate(page));
+
+ if (unlikely(err))
+ SetPageError(page);
+@@ -91,12 +91,12 @@ static int erofs_map_blocks_flatmode(struct inode *inode,
+ struct erofs_map_blocks *map,
+ int flags)
+ {
++ int err = 0;
+ erofs_blk_t nblocks, lastblk;
+ u64 offset = map->m_la;
+ struct erofs_vnode *vi = EROFS_V(inode);
+
+ trace_erofs_map_blocks_flatmode_enter(inode, map, flags);
+- BUG_ON(is_inode_layout_compression(inode));
+
+ nblocks = DIV_ROUND_UP(inode->i_size, PAGE_SIZE);
+ lastblk = nblocks - is_inode_layout_inline(inode);
+@@ -123,18 +123,27 @@ static int erofs_map_blocks_flatmode(struct inode *inode,
+ map->m_plen = inode->i_size - offset;
+
+ /* inline data should locate in one meta block */
+- BUG_ON(erofs_blkoff(map->m_pa) + map->m_plen > PAGE_SIZE);
++ if (erofs_blkoff(map->m_pa) + map->m_plen > PAGE_SIZE) {
++ DBG_BUGON(1);
++ err = -EIO;
++ goto err_out;
++ }
++
+ map->m_flags |= EROFS_MAP_META;
+ } else {
+ errln("internal error @ nid: %llu (size %llu), m_la 0x%llx",
+ vi->nid, inode->i_size, map->m_la);
+- BUG();
++ DBG_BUGON(1);
++ err = -EIO;
++ goto err_out;
+ }
+
+ out:
+ map->m_llen = map->m_plen;
++
++err_out:
+ trace_erofs_map_blocks_flatmode_exit(inode, map, flags, 0);
+- return 0;
++ return err;
+ }
+
+ #ifdef CONFIG_EROFS_FS_ZIP
+@@ -190,7 +199,7 @@ static inline struct bio *erofs_read_raw_page(
+ erofs_off_t current_block = (erofs_off_t)page->index;
+ int err;
+
+- BUG_ON(!nblocks);
++ DBG_BUGON(!nblocks);
+
+ if (PageUptodate(page)) {
+ err = 0;
+@@ -233,7 +242,7 @@ submit_bio_retry:
+ }
+
+ /* for RAW access mode, m_plen must be equal to m_llen */
+- BUG_ON(map.m_plen != map.m_llen);
++ DBG_BUGON(map.m_plen != map.m_llen);
+
+ blknr = erofs_blknr(map.m_pa);
+ blkoff = erofs_blkoff(map.m_pa);
+@@ -243,7 +252,7 @@ submit_bio_retry:
+ void *vsrc, *vto;
+ struct page *ipage;
+
+- BUG_ON(map.m_plen > PAGE_SIZE);
++ DBG_BUGON(map.m_plen > PAGE_SIZE);
+
+ ipage = erofs_get_meta_page(inode->i_sb, blknr, 0);
+
+@@ -270,7 +279,7 @@ submit_bio_retry:
+ }
+
+ /* pa must be block-aligned for raw reading */
+- BUG_ON(erofs_blkoff(map.m_pa) != 0);
++ DBG_BUGON(erofs_blkoff(map.m_pa));
+
+ /* max # of continuous pages */
+ if (nblocks > DIV_ROUND_UP(map.m_plen, PAGE_SIZE))
+@@ -331,7 +340,7 @@ static int erofs_raw_access_readpage(struct file *file, struct page *page)
+ if (IS_ERR(bio))
+ return PTR_ERR(bio);
+
+- BUG_ON(bio != NULL); /* since we have only one bio -- must be NULL */
++ DBG_BUGON(bio); /* since we have only one bio -- must be NULL */
+ return 0;
+ }
+
+@@ -369,7 +378,7 @@ static int erofs_raw_access_readpages(struct file *filp,
+ /* pages could still be locked */
+ put_page(page);
+ }
+- BUG_ON(!list_empty(pages));
++ DBG_BUGON(!list_empty(pages));
+
+ /* the rare case (end in gaps) */
+ if (unlikely(bio != NULL))
+diff --git a/drivers/staging/erofs/dir.c b/drivers/staging/erofs/dir.c
+index be6ae3b1bdbe1..04b84ff31d036 100644
+--- a/drivers/staging/erofs/dir.c
++++ b/drivers/staging/erofs/dir.c
+@@ -53,8 +53,11 @@ static int erofs_fill_dentries(struct dir_context *ctx,
+ strnlen(de_name, maxsize - nameoff) :
+ le16_to_cpu(de[1].nameoff) - nameoff;
+
+- /* the corrupted directory found */
+- BUG_ON(de_namelen < 0);
++ /* a corrupted entry is found */
++ if (unlikely(de_namelen < 0)) {
++ DBG_BUGON(1);
++ return -EIO;
++ }
+
+ #ifdef CONFIG_EROFS_FS_DEBUG
+ dbg_namelen = min(EROFS_NAME_LEN - 1, de_namelen);
+diff --git a/drivers/staging/erofs/inode.c b/drivers/staging/erofs/inode.c
+index fbf6ff25cd1bd..9e7815f55a17c 100644
+--- a/drivers/staging/erofs/inode.c
++++ b/drivers/staging/erofs/inode.c
+@@ -132,7 +132,13 @@ static int fill_inline_data(struct inode *inode, void *data, unsigned m_pofs)
+ return -ENOMEM;
+
+ m_pofs += vi->inode_isize + vi->xattr_isize;
+- BUG_ON(m_pofs + inode->i_size > PAGE_SIZE);
++
++ /* inline symlink data shouldn't across page boundary as well */
++ if (unlikely(m_pofs + inode->i_size > PAGE_SIZE)) {
++ DBG_BUGON(1);
++ kfree(lnk);
++ return -EIO;
++ }
+
+ /* get in-page inline data */
+ memcpy(lnk, data + m_pofs, inode->i_size);
+@@ -170,7 +176,7 @@ static int fill_inode(struct inode *inode, int isdir)
+ return PTR_ERR(page);
+ }
+
+- BUG_ON(!PageUptodate(page));
++ DBG_BUGON(!PageUptodate(page));
+ data = page_address(page);
+
+ err = read_inode(inode, data + ofs);
+diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h
+index e6313c54e3ad6..9f44ed8f00239 100644
+--- a/drivers/staging/erofs/internal.h
++++ b/drivers/staging/erofs/internal.h
+@@ -184,50 +184,70 @@ struct erofs_workgroup {
+
+ #define EROFS_LOCKED_MAGIC (INT_MIN | 0xE0F510CCL)
+
+-static inline bool erofs_workgroup_try_to_freeze(
+- struct erofs_workgroup *grp, int v)
++#if defined(CONFIG_SMP)
++static inline bool erofs_workgroup_try_to_freeze(struct erofs_workgroup *grp,
++ int val)
+ {
+-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+- if (v != atomic_cmpxchg(&grp->refcount,
+- v, EROFS_LOCKED_MAGIC))
+- return false;
+ preempt_disable();
++ if (val != atomic_cmpxchg(&grp->refcount, val, EROFS_LOCKED_MAGIC)) {
++ preempt_enable();
++ return false;
++ }
++ return true;
++}
++
++static inline void erofs_workgroup_unfreeze(struct erofs_workgroup *grp,
++ int orig_val)
++{
++ /*
++ * other observers should notice all modifications
++ * in the freezing period.
++ */
++ smp_mb();
++ atomic_set(&grp->refcount, orig_val);
++ preempt_enable();
++}
++
++static inline int erofs_wait_on_workgroup_freezed(struct erofs_workgroup *grp)
++{
++ return atomic_cond_read_relaxed(&grp->refcount,
++ VAL != EROFS_LOCKED_MAGIC);
++}
+ #else
++static inline bool erofs_workgroup_try_to_freeze(struct erofs_workgroup *grp,
++ int val)
++{
+ preempt_disable();
+- if (atomic_read(&grp->refcount) != v) {
++ /* no need to spin on UP platforms, let's just disable preemption. */
++ if (val != atomic_read(&grp->refcount)) {
+ preempt_enable();
+ return false;
+ }
+-#endif
+ return true;
+ }
+
+-static inline void erofs_workgroup_unfreeze(
+- struct erofs_workgroup *grp, int v)
++static inline void erofs_workgroup_unfreeze(struct erofs_workgroup *grp,
++ int orig_val)
+ {
+-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+- atomic_set(&grp->refcount, v);
+-#endif
+ preempt_enable();
+ }
+
++static inline int erofs_wait_on_workgroup_freezed(struct erofs_workgroup *grp)
++{
++ int v = atomic_read(&grp->refcount);
++
++ /* workgroup is never freezed on uniprocessor systems */
++ DBG_BUGON(v == EROFS_LOCKED_MAGIC);
++ return v;
++}
++#endif
++
+ static inline bool erofs_workgroup_get(struct erofs_workgroup *grp, int *ocnt)
+ {
+- const int locked = (int)EROFS_LOCKED_MAGIC;
+ int o;
+
+ repeat:
+- o = atomic_read(&grp->refcount);
+-
+- /* spin if it is temporarily locked at the reclaim path */
+- if (unlikely(o == locked)) {
+-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+- do
+- cpu_relax();
+- while (atomic_read(&grp->refcount) == locked);
+-#endif
+- goto repeat;
+- }
++ o = erofs_wait_on_workgroup_freezed(grp);
+
+ if (unlikely(o <= 0))
+ return -1;
+diff --git a/drivers/staging/erofs/super.c b/drivers/staging/erofs/super.c
+index 2df9768edac96..b0583cdb079ae 100644
+--- a/drivers/staging/erofs/super.c
++++ b/drivers/staging/erofs/super.c
+@@ -40,7 +40,6 @@ static int erofs_init_inode_cache(void)
+
+ static void erofs_exit_inode_cache(void)
+ {
+- BUG_ON(erofs_inode_cachep == NULL);
+ kmem_cache_destroy(erofs_inode_cachep);
+ }
+
+@@ -265,8 +264,8 @@ static int managed_cache_releasepage(struct page *page, gfp_t gfp_mask)
+ int ret = 1; /* 0 - busy */
+ struct address_space *const mapping = page->mapping;
+
+- BUG_ON(!PageLocked(page));
+- BUG_ON(mapping->a_ops != &managed_cache_aops);
++ DBG_BUGON(!PageLocked(page));
++ DBG_BUGON(mapping->a_ops != &managed_cache_aops);
+
+ if (PagePrivate(page))
+ ret = erofs_try_to_free_cached_page(mapping, page);
+@@ -279,10 +278,10 @@ static void managed_cache_invalidatepage(struct page *page,
+ {
+ const unsigned int stop = length + offset;
+
+- BUG_ON(!PageLocked(page));
++ DBG_BUGON(!PageLocked(page));
+
+- /* Check for overflow */
+- BUG_ON(stop > PAGE_SIZE || stop < length);
++ /* Check for potential overflow in debug mode */
++ DBG_BUGON(stop > PAGE_SIZE || stop < length);
+
+ if (offset == 0 && stop == PAGE_SIZE)
+ while (!managed_cache_releasepage(page, GFP_NOFS))
+@@ -404,12 +403,6 @@ static int erofs_read_super(struct super_block *sb,
+
+ erofs_register_super(sb);
+
+- /*
+- * We already have a positive dentry, which was instantiated
+- * by d_make_root. Just need to d_rehash it.
+- */
+- d_rehash(sb->s_root);
+-
+ if (!silent)
+ infoln("mounted on %s with opts: %s.", dev_name,
+ (char *)data);
+@@ -625,7 +618,7 @@ static int erofs_show_options(struct seq_file *seq, struct dentry *root)
+
+ static int erofs_remount(struct super_block *sb, int *flags, char *data)
+ {
+- BUG_ON(!sb_rdonly(sb));
++ DBG_BUGON(!sb_rdonly(sb));
+
+ *flags |= SB_RDONLY;
+ return 0;
+diff --git a/drivers/staging/erofs/unzip_pagevec.h b/drivers/staging/erofs/unzip_pagevec.h
+index 0956615b86f72..23856ba2742d8 100644
+--- a/drivers/staging/erofs/unzip_pagevec.h
++++ b/drivers/staging/erofs/unzip_pagevec.h
+@@ -150,7 +150,7 @@ z_erofs_pagevec_ctor_dequeue(struct z_erofs_pagevec_ctor *ctor,
+ erofs_vtptr_t t;
+
+ if (unlikely(ctor->index >= ctor->nr)) {
+- BUG_ON(ctor->next == NULL);
++ DBG_BUGON(!ctor->next);
+ z_erofs_pagevec_ctor_pagedown(ctor, true);
+ }
+
+diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c
+index 0346630b67c8c..1279241449f4b 100644
+--- a/drivers/staging/erofs/unzip_vle.c
++++ b/drivers/staging/erofs/unzip_vle.c
+@@ -18,9 +18,6 @@ static struct kmem_cache *z_erofs_workgroup_cachep __read_mostly;
+
+ void z_erofs_exit_zip_subsystem(void)
+ {
+- BUG_ON(z_erofs_workqueue == NULL);
+- BUG_ON(z_erofs_workgroup_cachep == NULL);
+-
+ destroy_workqueue(z_erofs_workqueue);
+ kmem_cache_destroy(z_erofs_workgroup_cachep);
+ }
+@@ -293,12 +290,9 @@ z_erofs_vle_work_lookup(struct super_block *sb,
+ *grp_ret = grp = container_of(egrp,
+ struct z_erofs_vle_workgroup, obj);
+
+-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF
+ work = z_erofs_vle_grab_work(grp, pageofs);
++ /* if multiref is disabled, `primary' is always true */
+ primary = true;
+-#else
+- BUG();
+-#endif
+
+ DBG_BUGON(work->pageofs != pageofs);
+
+@@ -365,12 +359,12 @@ z_erofs_vle_work_register(struct super_block *sb,
+ struct z_erofs_vle_workgroup *grp = *grp_ret;
+ struct z_erofs_vle_work *work;
+
+-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF
+- BUG_ON(grp != NULL);
+-#else
+- if (grp != NULL)
+- goto skip;
+-#endif
++ /* if multiref is disabled, grp should never be nullptr */
++ if (unlikely(grp)) {
++ DBG_BUGON(1);
++ return ERR_PTR(-EINVAL);
++ }
++
+ /* no available workgroup, let's allocate one */
+ grp = kmem_cache_zalloc(z_erofs_workgroup_cachep, GFP_NOFS);
+ if (unlikely(grp == NULL))
+@@ -393,13 +387,7 @@ z_erofs_vle_work_register(struct super_block *sb,
+ *hosted = true;
+
+ newgrp = true;
+-#ifdef CONFIG_EROFS_FS_ZIP_MULTIREF
+-skip:
+- /* currently unimplemented */
+- BUG();
+-#else
+ work = z_erofs_vle_grab_primary_work(grp);
+-#endif
+ work->pageofs = pageofs;
+
+ mutex_init(&work->lock);
+@@ -606,7 +594,7 @@ static int z_erofs_do_read_page(struct z_erofs_vle_frontend *fe,
+
+ enum z_erofs_page_type page_type;
+ unsigned cur, end, spiltted, index;
+- int err;
++ int err = 0;
+
+ /* register locked file pages as online pages in pack */
+ z_erofs_onlinepage_init(page);
+@@ -624,7 +612,7 @@ repeat:
+ /* go ahead the next map_blocks */
+ debugln("%s: [out-of-range] pos %llu", __func__, offset + cur);
+
+- if (!z_erofs_vle_work_iter_end(builder))
++ if (z_erofs_vle_work_iter_end(builder))
+ fe->initial = false;
+
+ map->m_la = offset + cur;
+@@ -633,12 +621,11 @@ repeat:
+ if (unlikely(err))
+ goto err_out;
+
+- /* deal with hole (FIXME! broken now) */
+ if (unlikely(!(map->m_flags & EROFS_MAP_MAPPED)))
+ goto hitted;
+
+ DBG_BUGON(map->m_plen != 1 << sbi->clusterbits);
+- BUG_ON(erofs_blkoff(map->m_pa));
++ DBG_BUGON(erofs_blkoff(map->m_pa));
+
+ err = z_erofs_vle_work_iter_begin(builder, sb, map, &fe->owned_head);
+ if (unlikely(err))
+@@ -683,7 +670,7 @@ retry:
+
+ err = z_erofs_vle_work_add_page(builder,
+ newpage, Z_EROFS_PAGE_TYPE_EXCLUSIVE);
+- if (!err)
++ if (likely(!err))
+ goto retry;
+ }
+
+@@ -694,9 +681,10 @@ retry:
+
+ /* FIXME! avoid the last relundant fixup & endio */
+ z_erofs_onlinepage_fixup(page, index, true);
+- ++spiltted;
+
+- /* also update nr_pages and increase queued_pages */
++ /* bump up the number of spiltted parts of a page */
++ ++spiltted;
++ /* also update nr_pages */
+ work->nr_pages = max_t(pgoff_t, work->nr_pages, index + 1);
+ next_part:
+ /* can be used for verification */
+@@ -706,16 +694,18 @@ next_part:
+ if (end > 0)
+ goto repeat;
+
++out:
+ /* FIXME! avoid the last relundant fixup & endio */
+ z_erofs_onlinepage_endio(page);
+
+ debugln("%s, finish page: %pK spiltted: %u map->m_llen %llu",
+ __func__, page, spiltted, map->m_llen);
+- return 0;
++ return err;
+
++ /* if some error occurred while processing this page */
+ err_out:
+- /* TODO: the missing error handing cases */
+- return err;
++ SetPageError(page);
++ goto out;
+ }
+
+ static void z_erofs_vle_unzip_kickoff(void *ptr, int bios)
+@@ -752,7 +742,7 @@ static inline void z_erofs_vle_read_endio(struct bio *bio)
+ bool cachemngd = false;
+
+ DBG_BUGON(PageUptodate(page));
+- BUG_ON(page->mapping == NULL);
++ DBG_BUGON(!page->mapping);
+
+ #ifdef EROFS_FS_HAS_MANAGED_CACHE
+ if (unlikely(mngda == NULL && !z_erofs_is_stagingpage(page))) {
+@@ -796,10 +786,8 @@ static int z_erofs_vle_unzip(struct super_block *sb,
+ const unsigned clusterpages = erofs_clusterpages(sbi);
+
+ struct z_erofs_pagevec_ctor ctor;
+- unsigned nr_pages;
+-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF
+- unsigned sparsemem_pages = 0;
+-#endif
++ unsigned int nr_pages;
++ unsigned int sparsemem_pages = 0;
+ struct page *pages_onstack[Z_EROFS_VLE_VMAP_ONSTACK_PAGES];
+ struct page **pages, **compressed_pages, *page;
+ unsigned i, llen;
+@@ -811,12 +799,8 @@ static int z_erofs_vle_unzip(struct super_block *sb,
+ int err;
+
+ might_sleep();
+-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF
+ work = z_erofs_vle_grab_primary_work(grp);
+-#else
+- BUG();
+-#endif
+- BUG_ON(!READ_ONCE(work->nr_pages));
++ DBG_BUGON(!READ_ONCE(work->nr_pages));
+
+ mutex_lock(&work->lock);
+ nr_pages = work->nr_pages;
+@@ -865,14 +849,12 @@ repeat:
+ else
+ pagenr = z_erofs_onlinepage_index(page);
+
+- BUG_ON(pagenr >= nr_pages);
++ DBG_BUGON(pagenr >= nr_pages);
++ DBG_BUGON(pages[pagenr]);
+
+-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF
+- BUG_ON(pages[pagenr] != NULL);
+- ++sparsemem_pages;
+-#endif
+ pages[pagenr] = page;
+ }
++ sparsemem_pages = i;
+
+ z_erofs_pagevec_ctor_exit(&ctor, true);
+
+@@ -891,9 +873,8 @@ repeat:
+ if (z_erofs_is_stagingpage(page))
+ continue;
+ #ifdef EROFS_FS_HAS_MANAGED_CACHE
+- else if (page->mapping == mngda) {
+- BUG_ON(PageLocked(page));
+- BUG_ON(!PageUptodate(page));
++ if (page->mapping == mngda) {
++ DBG_BUGON(!PageUptodate(page));
+ continue;
+ }
+ #endif
+@@ -901,11 +882,9 @@ repeat:
+ /* only non-head page could be reused as a compressed page */
+ pagenr = z_erofs_onlinepage_index(page);
+
+- BUG_ON(pagenr >= nr_pages);
+-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF
+- BUG_ON(pages[pagenr] != NULL);
++ DBG_BUGON(pagenr >= nr_pages);
++ DBG_BUGON(pages[pagenr]);
+ ++sparsemem_pages;
+-#endif
+ pages[pagenr] = page;
+
+ overlapped = true;
+@@ -914,9 +893,6 @@ repeat:
+ llen = (nr_pages << PAGE_SHIFT) - work->pageofs;
+
+ if (z_erofs_vle_workgrp_fmt(grp) == Z_EROFS_VLE_WORKGRP_FMT_PLAIN) {
+- /* FIXME! this should be fixed in the future */
+- BUG_ON(grp->llen != llen);
+-
+ err = z_erofs_vle_plain_copy(compressed_pages, clusterpages,
+ pages, nr_pages, work->pageofs);
+ goto out;
+@@ -931,12 +907,8 @@ repeat:
+ if (err != -ENOTSUPP)
+ goto out_percpu;
+
+-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF
+- if (sparsemem_pages >= nr_pages) {
+- BUG_ON(sparsemem_pages > nr_pages);
++ if (sparsemem_pages >= nr_pages)
+ goto skip_allocpage;
+- }
+-#endif
+
+ for (i = 0; i < nr_pages; ++i) {
+ if (pages[i] != NULL)
+@@ -945,9 +917,7 @@ repeat:
+ pages[i] = __stagingpage_alloc(page_pool, GFP_NOFS);
+ }
+
+-#ifndef CONFIG_EROFS_FS_ZIP_MULTIREF
+ skip_allocpage:
+-#endif
+ vout = erofs_vmap(pages, nr_pages);
+
+ err = z_erofs_vle_unzip_vmap(compressed_pages,
+@@ -1031,7 +1001,7 @@ static void z_erofs_vle_unzip_wq(struct work_struct *work)
+ struct z_erofs_vle_unzip_io_sb, io.u.work);
+ LIST_HEAD(page_pool);
+
+- BUG_ON(iosb->io.head == Z_EROFS_VLE_WORKGRP_TAIL_CLOSED);
++ DBG_BUGON(iosb->io.head == Z_EROFS_VLE_WORKGRP_TAIL_CLOSED);
+ z_erofs_vle_unzip_all(iosb->sb, &iosb->io, &page_pool);
+
+ put_pages_list(&page_pool);
+@@ -1360,7 +1330,6 @@ static inline int __z_erofs_vle_normalaccess_readpages(
+ continue;
+ }
+
+- BUG_ON(PagePrivate(page));
+ set_page_private(page, (unsigned long)head);
+ head = page;
+ }
+diff --git a/drivers/staging/erofs/unzip_vle.h b/drivers/staging/erofs/unzip_vle.h
+index 3939985008652..3316bc36965d4 100644
+--- a/drivers/staging/erofs/unzip_vle.h
++++ b/drivers/staging/erofs/unzip_vle.h
+@@ -47,13 +47,6 @@ static inline bool z_erofs_gather_if_stagingpage(struct list_head *page_pool,
+ #define Z_EROFS_VLE_INLINE_PAGEVECS 3
+
+ struct z_erofs_vle_work {
+- /* struct z_erofs_vle_work *left, *right; */
+-
+-#ifdef CONFIG_EROFS_FS_ZIP_MULTIREF
+- struct list_head list;
+-
+- atomic_t refcount;
+-#endif
+ struct mutex lock;
+
+ /* I: decompression offset in page */
+@@ -107,10 +100,8 @@ static inline void z_erofs_vle_set_workgrp_fmt(
+ grp->flags = fmt | (grp->flags & ~Z_EROFS_VLE_WORKGRP_FMT_MASK);
+ }
+
+-#ifdef CONFIG_EROFS_FS_ZIP_MULTIREF
+-#error multiref decompression is unimplemented yet
+-#else
+
++/* definitions if multiref is disabled */
+ #define z_erofs_vle_grab_primary_work(grp) (&(grp)->work)
+ #define z_erofs_vle_grab_work(grp, pageofs) (&(grp)->work)
+ #define z_erofs_vle_work_workgroup(wrk, primary) \
+@@ -118,7 +109,6 @@ static inline void z_erofs_vle_set_workgrp_fmt(
+ struct z_erofs_vle_workgroup, work) : \
+ ({ BUG(); (void *)NULL; }))
+
+-#endif
+
+ #define Z_EROFS_WORKGROUP_SIZE sizeof(struct z_erofs_vle_workgroup)
+
+diff --git a/drivers/staging/erofs/unzip_vle_lz4.c b/drivers/staging/erofs/unzip_vle_lz4.c
+index f5b665f15be52..9cb35cd33365a 100644
+--- a/drivers/staging/erofs/unzip_vle_lz4.c
++++ b/drivers/staging/erofs/unzip_vle_lz4.c
+@@ -57,7 +57,7 @@ int z_erofs_vle_plain_copy(struct page **compressed_pages,
+ if (compressed_pages[j] != page)
+ continue;
+
+- BUG_ON(mirrored[j]);
++ DBG_BUGON(mirrored[j]);
+ memcpy(percpu_data + j * PAGE_SIZE, dst, PAGE_SIZE);
+ mirrored[j] = true;
+ break;
+diff --git a/drivers/staging/erofs/utils.c b/drivers/staging/erofs/utils.c
+index 595cf90af9bb2..dd2ac9dbc4b47 100644
+--- a/drivers/staging/erofs/utils.c
++++ b/drivers/staging/erofs/utils.c
+@@ -23,9 +23,6 @@ struct page *erofs_allocpage(struct list_head *pool, gfp_t gfp)
+ list_del(&page->lru);
+ } else {
+ page = alloc_pages(gfp | __GFP_NOFAIL, 0);
+-
+- BUG_ON(page == NULL);
+- BUG_ON(page->mapping != NULL);
+ }
+ return page;
+ }
+@@ -60,7 +57,7 @@ repeat:
+ /* decrease refcount added by erofs_workgroup_put */
+ if (unlikely(oldcount == 1))
+ atomic_long_dec(&erofs_global_shrink_cnt);
+- BUG_ON(index != grp->index);
++ DBG_BUGON(index != grp->index);
+ }
+ rcu_read_unlock();
+ return grp;
+@@ -73,8 +70,11 @@ int erofs_register_workgroup(struct super_block *sb,
+ struct erofs_sb_info *sbi;
+ int err;
+
+- /* grp->refcount should not < 1 */
+- BUG_ON(!atomic_read(&grp->refcount));
++ /* grp shouldn't be broken or used before */
++ if (unlikely(atomic_read(&grp->refcount) != 1)) {
++ DBG_BUGON(1);
++ return -EINVAL;
++ }
+
+ err = radix_tree_preload(GFP_NOFS);
+ if (err)
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 9cd404acdb82b..ac7620120491b 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -148,7 +148,7 @@ struct tcmu_dev {
+ size_t ring_size;
+
+ struct mutex cmdr_lock;
+- struct list_head cmdr_queue;
++ struct list_head qfull_queue;
+
+ uint32_t dbi_max;
+ uint32_t dbi_thresh;
+@@ -159,6 +159,7 @@ struct tcmu_dev {
+
+ struct timer_list cmd_timer;
+ unsigned int cmd_time_out;
++ struct list_head inflight_queue;
+
+ struct timer_list qfull_timer;
+ int qfull_time_out;
+@@ -179,7 +180,7 @@ struct tcmu_dev {
+ struct tcmu_cmd {
+ struct se_cmd *se_cmd;
+ struct tcmu_dev *tcmu_dev;
+- struct list_head cmdr_queue_entry;
++ struct list_head queue_entry;
+
+ uint16_t cmd_id;
+
+@@ -192,6 +193,7 @@ struct tcmu_cmd {
+ unsigned long deadline;
+
+ #define TCMU_CMD_BIT_EXPIRED 0
++#define TCMU_CMD_BIT_INFLIGHT 1
+ unsigned long flags;
+ };
+ /*
+@@ -586,7 +588,7 @@ static struct tcmu_cmd *tcmu_alloc_cmd(struct se_cmd *se_cmd)
+ if (!tcmu_cmd)
+ return NULL;
+
+- INIT_LIST_HEAD(&tcmu_cmd->cmdr_queue_entry);
++ INIT_LIST_HEAD(&tcmu_cmd->queue_entry);
+ tcmu_cmd->se_cmd = se_cmd;
+ tcmu_cmd->tcmu_dev = udev;
+
+@@ -915,11 +917,13 @@ setup_timer:
+ return 0;
+
+ tcmu_cmd->deadline = round_jiffies_up(jiffies + msecs_to_jiffies(tmo));
+- mod_timer(timer, tcmu_cmd->deadline);
++ if (!timer_pending(timer))
++ mod_timer(timer, tcmu_cmd->deadline);
++
+ return 0;
+ }
+
+-static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd)
++static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd)
+ {
+ struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
+ unsigned int tmo;
+@@ -942,7 +946,7 @@ static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd)
+ if (ret)
+ return ret;
+
+- list_add_tail(&tcmu_cmd->cmdr_queue_entry, &udev->cmdr_queue);
++ list_add_tail(&tcmu_cmd->queue_entry, &udev->qfull_queue);
+ pr_debug("adding cmd %u on dev %s to ring space wait queue\n",
+ tcmu_cmd->cmd_id, udev->name);
+ return 0;
+@@ -999,7 +1003,7 @@ static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err)
+ base_command_size = tcmu_cmd_get_base_cmd_size(tcmu_cmd->dbi_cnt);
+ command_size = tcmu_cmd_get_cmd_size(tcmu_cmd, base_command_size);
+
+- if (!list_empty(&udev->cmdr_queue))
++ if (!list_empty(&udev->qfull_queue))
+ goto queue;
+
+ mb = udev->mb_addr;
+@@ -1096,13 +1100,16 @@ static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err)
+ UPDATE_HEAD(mb->cmd_head, command_size, udev->cmdr_size);
+ tcmu_flush_dcache_range(mb, sizeof(*mb));
+
++ list_add_tail(&tcmu_cmd->queue_entry, &udev->inflight_queue);
++ set_bit(TCMU_CMD_BIT_INFLIGHT, &tcmu_cmd->flags);
++
+ /* TODO: only if FLUSH and FUA? */
+ uio_event_notify(&udev->uio_info);
+
+ return 0;
+
+ queue:
+- if (add_to_cmdr_queue(tcmu_cmd)) {
++ if (add_to_qfull_queue(tcmu_cmd)) {
+ *scsi_err = TCM_OUT_OF_RESOURCES;
+ return -1;
+ }
+@@ -1145,6 +1152,8 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
+ if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
+ goto out;
+
++ list_del_init(&cmd->queue_entry);
++
+ tcmu_cmd_reset_dbi_cur(cmd);
+
+ if (entry->hdr.uflags & TCMU_UFLAG_UNKNOWN_OP) {
+@@ -1194,9 +1203,29 @@ out:
+ tcmu_free_cmd(cmd);
+ }
+
++static void tcmu_set_next_deadline(struct list_head *queue,
++ struct timer_list *timer)
++{
++ struct tcmu_cmd *tcmu_cmd, *tmp_cmd;
++ unsigned long deadline = 0;
++
++ list_for_each_entry_safe(tcmu_cmd, tmp_cmd, queue, queue_entry) {
++ if (!time_after(jiffies, tcmu_cmd->deadline)) {
++ deadline = tcmu_cmd->deadline;
++ break;
++ }
++ }
++
++ if (deadline)
++ mod_timer(timer, deadline);
++ else
++ del_timer(timer);
++}
++
+ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ {
+ struct tcmu_mailbox *mb;
++ struct tcmu_cmd *cmd;
+ int handled = 0;
+
+ if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags)) {
+@@ -1210,7 +1239,6 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ while (udev->cmdr_last_cleaned != READ_ONCE(mb->cmd_tail)) {
+
+ struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
+- struct tcmu_cmd *cmd;
+
+ tcmu_flush_dcache_range(entry, sizeof(*entry));
+
+@@ -1243,7 +1271,7 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ /* no more pending commands */
+ del_timer(&udev->cmd_timer);
+
+- if (list_empty(&udev->cmdr_queue)) {
++ if (list_empty(&udev->qfull_queue)) {
+ /*
+ * no more pending or waiting commands so try to
+ * reclaim blocks if needed.
+@@ -1252,6 +1280,8 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ tcmu_global_max_blocks)
+ schedule_delayed_work(&tcmu_unmap_work, 0);
+ }
++ } else if (udev->cmd_time_out) {
++ tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer);
+ }
+
+ return handled;
+@@ -1271,7 +1301,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
+ if (!time_after(jiffies, cmd->deadline))
+ return 0;
+
+- is_running = list_empty(&cmd->cmdr_queue_entry);
++ is_running = test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags);
+ se_cmd = cmd->se_cmd;
+
+ if (is_running) {
+@@ -1288,12 +1318,11 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
+ */
+ scsi_status = SAM_STAT_CHECK_CONDITION;
+ } else {
+- list_del_init(&cmd->cmdr_queue_entry);
+-
+ idr_remove(&udev->commands, id);
+ tcmu_free_cmd(cmd);
+ scsi_status = SAM_STAT_TASK_SET_FULL;
+ }
++ list_del_init(&cmd->queue_entry);
+
+ pr_debug("Timing out cmd %u on dev %s that is %s.\n",
+ id, udev->name, is_running ? "inflight" : "queued");
+@@ -1372,7 +1401,8 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
+
+ INIT_LIST_HEAD(&udev->node);
+ INIT_LIST_HEAD(&udev->timedout_entry);
+- INIT_LIST_HEAD(&udev->cmdr_queue);
++ INIT_LIST_HEAD(&udev->qfull_queue);
++ INIT_LIST_HEAD(&udev->inflight_queue);
+ idr_init(&udev->commands);
+
+ timer_setup(&udev->qfull_timer, tcmu_qfull_timedout, 0);
+@@ -1383,7 +1413,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
+ return &udev->se_dev;
+ }
+
+-static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
++static bool run_qfull_queue(struct tcmu_dev *udev, bool fail)
+ {
+ struct tcmu_cmd *tcmu_cmd, *tmp_cmd;
+ LIST_HEAD(cmds);
+@@ -1391,15 +1421,15 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
+ sense_reason_t scsi_ret;
+ int ret;
+
+- if (list_empty(&udev->cmdr_queue))
++ if (list_empty(&udev->qfull_queue))
+ return true;
+
+ pr_debug("running %s's cmdr queue forcefail %d\n", udev->name, fail);
+
+- list_splice_init(&udev->cmdr_queue, &cmds);
++ list_splice_init(&udev->qfull_queue, &cmds);
+
+- list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, cmdr_queue_entry) {
+- list_del_init(&tcmu_cmd->cmdr_queue_entry);
++ list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, queue_entry) {
++ list_del_init(&tcmu_cmd->queue_entry);
+
+ pr_debug("removing cmd %u on dev %s from queue\n",
+ tcmu_cmd->cmd_id, udev->name);
+@@ -1437,14 +1467,13 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
+ * cmd was requeued, so just put all cmds back in
+ * the queue
+ */
+- list_splice_tail(&cmds, &udev->cmdr_queue);
++ list_splice_tail(&cmds, &udev->qfull_queue);
+ drained = false;
+- goto done;
++ break;
+ }
+ }
+- if (list_empty(&udev->cmdr_queue))
+- del_timer(&udev->qfull_timer);
+-done:
++
++ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
+ return drained;
+ }
+
+@@ -1454,7 +1483,7 @@ static int tcmu_irqcontrol(struct uio_info *info, s32 irq_on)
+
+ mutex_lock(&udev->cmdr_lock);
+ tcmu_handle_completions(udev);
+- run_cmdr_queue(udev, false);
++ run_qfull_queue(udev, false);
+ mutex_unlock(&udev->cmdr_lock);
+
+ return 0;
+@@ -1982,7 +2011,7 @@ static void tcmu_block_dev(struct tcmu_dev *udev)
+ /* complete IO that has executed successfully */
+ tcmu_handle_completions(udev);
+ /* fail IO waiting to be queued */
+- run_cmdr_queue(udev, true);
++ run_qfull_queue(udev, true);
+
+ unlock:
+ mutex_unlock(&udev->cmdr_lock);
+@@ -1997,7 +2026,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
+ mutex_lock(&udev->cmdr_lock);
+
+ idr_for_each_entry(&udev->commands, cmd, i) {
+- if (!list_empty(&cmd->cmdr_queue_entry))
++ if (!test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags))
+ continue;
+
+ pr_debug("removing cmd %u on dev %s from ring (is expired %d)\n",
+@@ -2006,6 +2035,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
+
+ idr_remove(&udev->commands, i);
+ if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
++ list_del_init(&cmd->queue_entry);
+ if (err_level == 1) {
+ /*
+ * Userspace was not able to start the
+@@ -2666,6 +2696,10 @@ static void check_timedout_devices(void)
+
+ mutex_lock(&udev->cmdr_lock);
+ idr_for_each(&udev->commands, tcmu_check_expired_cmd, NULL);
++
++ tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer);
++ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
++
+ mutex_unlock(&udev->cmdr_lock);
+
+ spin_lock_bh(&timed_out_udevs_lock);
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 5eaeca805c95c..b214a72d5caad 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -1035,8 +1035,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
+ int type, ret;
+
+ ret = copy_from_iter(&type, sizeof(type), from);
+- if (ret != sizeof(type))
++ if (ret != sizeof(type)) {
++ ret = -EINVAL;
+ goto done;
++ }
+
+ switch (type) {
+ case VHOST_IOTLB_MSG:
+@@ -1055,8 +1057,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
+
+ iov_iter_advance(from, offset);
+ ret = copy_from_iter(&msg, sizeof(msg), from);
+- if (ret != sizeof(msg))
++ if (ret != sizeof(msg)) {
++ ret = -EINVAL;
+ goto done;
++ }
+ if (vhost_process_iotlb_msg(dev, &msg)) {
+ ret = -EFAULT;
+ goto done;
+diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
+index bdfcc0a71db14..6bde543452f25 100644
+--- a/drivers/video/backlight/pwm_bl.c
++++ b/drivers/video/backlight/pwm_bl.c
+@@ -262,6 +262,16 @@ static int pwm_backlight_parse_dt(struct device *dev,
+
+ memset(data, 0, sizeof(*data));
+
++ /*
++ * These values are optional and set as 0 by default, the out values
++ * are modified only if a valid u32 value can be decoded.
++ */
++ of_property_read_u32(node, "post-pwm-on-delay-ms",
++ &data->post_pwm_on_delay);
++ of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay);
++
++ data->enable_gpio = -EINVAL;
++
+ /*
+ * Determine the number of brightness levels, if this property is not
+ * set a default table of brightness levels will be used.
+@@ -374,15 +384,6 @@ static int pwm_backlight_parse_dt(struct device *dev,
+ data->max_brightness--;
+ }
+
+- /*
+- * These values are optional and set as 0 by default, the out values
+- * are modified only if a valid u32 value can be decoded.
+- */
+- of_property_read_u32(node, "post-pwm-on-delay-ms",
+- &data->post_pwm_on_delay);
+- of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay);
+-
+- data->enable_gpio = -EINVAL;
+ return 0;
+ }
+
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index afbd6101c78eb..070026a7e55a5 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -916,8 +916,6 @@ static int dlfb_ops_open(struct fb_info *info, int user)
+
+ dlfb->fb_count++;
+
+- kref_get(&dlfb->kref);
+-
+ if (fb_defio && (info->fbdefio == NULL)) {
+ /* enable defio at last moment if not disabled by client */
+
+@@ -940,14 +938,17 @@ static int dlfb_ops_open(struct fb_info *info, int user)
+ return 0;
+ }
+
+-/*
+- * Called when all client interfaces to start transactions have been disabled,
+- * and all references to our device instance (dlfb_data) are released.
+- * Every transaction must have a reference, so we know are fully spun down
+- */
+-static void dlfb_free(struct kref *kref)
++static void dlfb_ops_destroy(struct fb_info *info)
+ {
+- struct dlfb_data *dlfb = container_of(kref, struct dlfb_data, kref);
++ struct dlfb_data *dlfb = info->par;
++
++ if (info->cmap.len != 0)
++ fb_dealloc_cmap(&info->cmap);
++ if (info->monspecs.modedb)
++ fb_destroy_modedb(info->monspecs.modedb);
++ vfree(info->screen_base);
++
++ fb_destroy_modelist(&info->modelist);
+
+ while (!list_empty(&dlfb->deferred_free)) {
+ struct dlfb_deferred_free *d = list_entry(dlfb->deferred_free.next, struct dlfb_deferred_free, list);
+@@ -957,40 +958,13 @@ static void dlfb_free(struct kref *kref)
+ }
+ vfree(dlfb->backing_buffer);
+ kfree(dlfb->edid);
++ usb_put_dev(dlfb->udev);
+ kfree(dlfb);
+-}
+-
+-static void dlfb_free_framebuffer(struct dlfb_data *dlfb)
+-{
+- struct fb_info *info = dlfb->info;
+-
+- if (info) {
+- unregister_framebuffer(info);
+-
+- if (info->cmap.len != 0)
+- fb_dealloc_cmap(&info->cmap);
+- if (info->monspecs.modedb)
+- fb_destroy_modedb(info->monspecs.modedb);
+- vfree(info->screen_base);
+-
+- fb_destroy_modelist(&info->modelist);
+-
+- dlfb->info = NULL;
+-
+- /* Assume info structure is freed after this point */
+- framebuffer_release(info);
+- }
+
+- /* ref taken in probe() as part of registering framebfufer */
+- kref_put(&dlfb->kref, dlfb_free);
++ /* Assume info structure is freed after this point */
++ framebuffer_release(info);
+ }
+
+-static void dlfb_free_framebuffer_work(struct work_struct *work)
+-{
+- struct dlfb_data *dlfb = container_of(work, struct dlfb_data,
+- free_framebuffer_work.work);
+- dlfb_free_framebuffer(dlfb);
+-}
+ /*
+ * Assumes caller is holding info->lock mutex (for open and release at least)
+ */
+@@ -1000,10 +974,6 @@ static int dlfb_ops_release(struct fb_info *info, int user)
+
+ dlfb->fb_count--;
+
+- /* We can't free fb_info here - fbmem will touch it when we return */
+- if (dlfb->virtualized && (dlfb->fb_count == 0))
+- schedule_delayed_work(&dlfb->free_framebuffer_work, HZ);
+-
+ if ((dlfb->fb_count == 0) && (info->fbdefio)) {
+ fb_deferred_io_cleanup(info);
+ kfree(info->fbdefio);
+@@ -1013,8 +983,6 @@ static int dlfb_ops_release(struct fb_info *info, int user)
+
+ dev_dbg(info->dev, "release, user=%d count=%d\n", user, dlfb->fb_count);
+
+- kref_put(&dlfb->kref, dlfb_free);
+-
+ return 0;
+ }
+
+@@ -1172,6 +1140,7 @@ static struct fb_ops dlfb_ops = {
+ .fb_blank = dlfb_ops_blank,
+ .fb_check_var = dlfb_ops_check_var,
+ .fb_set_par = dlfb_ops_set_par,
++ .fb_destroy = dlfb_ops_destroy,
+ };
+
+
+@@ -1615,12 +1584,13 @@ success:
+ return true;
+ }
+
+-static void dlfb_init_framebuffer_work(struct work_struct *work);
+-
+ static int dlfb_usb_probe(struct usb_interface *intf,
+ const struct usb_device_id *id)
+ {
++ int i;
++ const struct device_attribute *attr;
+ struct dlfb_data *dlfb;
++ struct fb_info *info;
+ int retval = -ENOMEM;
+ struct usb_device *usbdev = interface_to_usbdev(intf);
+
+@@ -1631,10 +1601,9 @@ static int dlfb_usb_probe(struct usb_interface *intf,
+ goto error;
+ }
+
+- kref_init(&dlfb->kref); /* matching kref_put in usb .disconnect fn */
+ INIT_LIST_HEAD(&dlfb->deferred_free);
+
+- dlfb->udev = usbdev;
++ dlfb->udev = usb_get_dev(usbdev);
+ usb_set_intfdata(intf, dlfb);
+
+ dev_dbg(&intf->dev, "console enable=%d\n", console);
+@@ -1657,42 +1626,6 @@ static int dlfb_usb_probe(struct usb_interface *intf,
+ }
+
+
+- if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
+- retval = -ENOMEM;
+- dev_err(&intf->dev, "unable to allocate urb list\n");
+- goto error;
+- }
+-
+- kref_get(&dlfb->kref); /* matching kref_put in free_framebuffer_work */
+-
+- /* We don't register a new USB class. Our client interface is dlfbev */
+-
+- /* Workitem keep things fast & simple during USB enumeration */
+- INIT_DELAYED_WORK(&dlfb->init_framebuffer_work,
+- dlfb_init_framebuffer_work);
+- schedule_delayed_work(&dlfb->init_framebuffer_work, 0);
+-
+- return 0;
+-
+-error:
+- if (dlfb) {
+-
+- kref_put(&dlfb->kref, dlfb_free); /* last ref from kref_init */
+-
+- /* dev has been deallocated. Do not dereference */
+- }
+-
+- return retval;
+-}
+-
+-static void dlfb_init_framebuffer_work(struct work_struct *work)
+-{
+- int i, retval;
+- struct fb_info *info;
+- const struct device_attribute *attr;
+- struct dlfb_data *dlfb = container_of(work, struct dlfb_data,
+- init_framebuffer_work.work);
+-
+ /* allocates framebuffer driver structure, not framebuffer memory */
+ info = framebuffer_alloc(0, &dlfb->udev->dev);
+ if (!info) {
+@@ -1706,17 +1639,22 @@ static void dlfb_init_framebuffer_work(struct work_struct *work)
+ dlfb->ops = dlfb_ops;
+ info->fbops = &dlfb->ops;
+
++ INIT_LIST_HEAD(&info->modelist);
++
++ if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
++ retval = -ENOMEM;
++ dev_err(&intf->dev, "unable to allocate urb list\n");
++ goto error;
++ }
++
++ /* We don't register a new USB class. Our client interface is dlfbev */
++
+ retval = fb_alloc_cmap(&info->cmap, 256, 0);
+ if (retval < 0) {
+ dev_err(info->device, "cmap allocation failed: %d\n", retval);
+ goto error;
+ }
+
+- INIT_DELAYED_WORK(&dlfb->free_framebuffer_work,
+- dlfb_free_framebuffer_work);
+-
+- INIT_LIST_HEAD(&info->modelist);
+-
+ retval = dlfb_setup_modes(dlfb, info, NULL, 0);
+ if (retval != 0) {
+ dev_err(info->device,
+@@ -1760,10 +1698,16 @@ static void dlfb_init_framebuffer_work(struct work_struct *work)
+ dev_name(info->dev), info->var.xres, info->var.yres,
+ ((dlfb->backing_buffer) ?
+ info->fix.smem_len * 2 : info->fix.smem_len) >> 10);
+- return;
++ return 0;
+
+ error:
+- dlfb_free_framebuffer(dlfb);
++ if (dlfb->info) {
++ dlfb_ops_destroy(dlfb->info);
++ } else if (dlfb) {
++ usb_put_dev(dlfb->udev);
++ kfree(dlfb);
++ }
++ return retval;
+ }
+
+ static void dlfb_usb_disconnect(struct usb_interface *intf)
+@@ -1791,20 +1735,9 @@ static void dlfb_usb_disconnect(struct usb_interface *intf)
+ for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++)
+ device_remove_file(info->dev, &fb_device_attrs[i]);
+ device_remove_bin_file(info->dev, &edid_attr);
+- unlink_framebuffer(info);
+ }
+
+- usb_set_intfdata(intf, NULL);
+- dlfb->udev = NULL;
+-
+- /* if clients still have us open, will be freed on last close */
+- if (dlfb->fb_count == 0)
+- schedule_delayed_work(&dlfb->free_framebuffer_work, 0);
+-
+- /* release reference taken by kref_init in probe() */
+- kref_put(&dlfb->kref, dlfb_free);
+-
+- /* consider dlfb_data freed */
++ unregister_framebuffer(info);
+ }
+
+ static struct usb_driver dlfb_driver = {
+diff --git a/drivers/watchdog/mt7621_wdt.c b/drivers/watchdog/mt7621_wdt.c
+index 5c4a764717c4d..81208cd3f4ecb 100644
+--- a/drivers/watchdog/mt7621_wdt.c
++++ b/drivers/watchdog/mt7621_wdt.c
+@@ -17,6 +17,7 @@
+ #include <linux/watchdog.h>
+ #include <linux/moduleparam.h>
+ #include <linux/platform_device.h>
++#include <linux/mod_devicetable.h>
+
+ #include <asm/mach-ralink/ralink_regs.h>
+
+diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c
+index 98967f0a7d10e..db7c57d82cfdc 100644
+--- a/drivers/watchdog/rt2880_wdt.c
++++ b/drivers/watchdog/rt2880_wdt.c
+@@ -18,6 +18,7 @@
+ #include <linux/watchdog.h>
+ #include <linux/moduleparam.h>
+ #include <linux/platform_device.h>
++#include <linux/mod_devicetable.h>
+
+ #include <asm/mach-ralink/ralink_regs.h>
+
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index b1092fbefa630..d4ea33581ac26 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -160,9 +160,10 @@ static void pvcalls_conn_back_read(void *opaque)
+
+ /* write the data, then modify the indexes */
+ virt_wmb();
+- if (ret < 0)
++ if (ret < 0) {
++ atomic_set(&map->read, 0);
+ intf->in_error = ret;
+- else
++ } else
+ intf->in_prod = prod + ret;
+ /* update the indexes, then notify the other end */
+ virt_wmb();
+@@ -282,13 +283,11 @@ static int pvcalls_back_socket(struct xenbus_device *dev,
+ static void pvcalls_sk_state_change(struct sock *sock)
+ {
+ struct sock_mapping *map = sock->sk_user_data;
+- struct pvcalls_data_intf *intf;
+
+ if (map == NULL)
+ return;
+
+- intf = map->ring;
+- intf->in_error = -ENOTCONN;
++ atomic_inc(&map->read);
+ notify_remote_via_irq(map->irq);
+ }
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 77224d8f3e6fe..91da7e44d5d4f 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -31,6 +31,12 @@
+ #define PVCALLS_NR_RSP_PER_RING __CONST_RING_SIZE(xen_pvcalls, XEN_PAGE_SIZE)
+ #define PVCALLS_FRONT_MAX_SPIN 5000
+
++static struct proto pvcalls_proto = {
++ .name = "PVCalls",
++ .owner = THIS_MODULE,
++ .obj_size = sizeof(struct sock),
++};
++
+ struct pvcalls_bedata {
+ struct xen_pvcalls_front_ring ring;
+ grant_ref_t ref;
+@@ -335,6 +341,42 @@ int pvcalls_front_socket(struct socket *sock)
+ return ret;
+ }
+
++static void free_active_ring(struct sock_mapping *map)
++{
++ if (!map->active.ring)
++ return;
++
++ free_pages((unsigned long)map->active.data.in,
++ map->active.ring->ring_order);
++ free_page((unsigned long)map->active.ring);
++}
++
++static int alloc_active_ring(struct sock_mapping *map)
++{
++ void *bytes;
++
++ map->active.ring = (struct pvcalls_data_intf *)
++ get_zeroed_page(GFP_KERNEL);
++ if (!map->active.ring)
++ goto out;
++
++ map->active.ring->ring_order = PVCALLS_RING_ORDER;
++ bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
++ PVCALLS_RING_ORDER);
++ if (!bytes)
++ goto out;
++
++ map->active.data.in = bytes;
++ map->active.data.out = bytes +
++ XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
++
++ return 0;
++
++out:
++ free_active_ring(map);
++ return -ENOMEM;
++}
++
+ static int create_active(struct sock_mapping *map, int *evtchn)
+ {
+ void *bytes;
+@@ -343,15 +385,7 @@ static int create_active(struct sock_mapping *map, int *evtchn)
+ *evtchn = -1;
+ init_waitqueue_head(&map->active.inflight_conn_req);
+
+- map->active.ring = (struct pvcalls_data_intf *)
+- __get_free_page(GFP_KERNEL | __GFP_ZERO);
+- if (map->active.ring == NULL)
+- goto out_error;
+- map->active.ring->ring_order = PVCALLS_RING_ORDER;
+- bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+- PVCALLS_RING_ORDER);
+- if (bytes == NULL)
+- goto out_error;
++ bytes = map->active.data.in;
+ for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++)
+ map->active.ring->ref[i] = gnttab_grant_foreign_access(
+ pvcalls_front_dev->otherend_id,
+@@ -361,10 +395,6 @@ static int create_active(struct sock_mapping *map, int *evtchn)
+ pvcalls_front_dev->otherend_id,
+ pfn_to_gfn(virt_to_pfn((void *)map->active.ring)), 0);
+
+- map->active.data.in = bytes;
+- map->active.data.out = bytes +
+- XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
+-
+ ret = xenbus_alloc_evtchn(pvcalls_front_dev, evtchn);
+ if (ret)
+ goto out_error;
+@@ -385,8 +415,6 @@ static int create_active(struct sock_mapping *map, int *evtchn)
+ out_error:
+ if (*evtchn >= 0)
+ xenbus_free_evtchn(pvcalls_front_dev, *evtchn);
+- free_pages((unsigned long)map->active.data.in, PVCALLS_RING_ORDER);
+- free_page((unsigned long)map->active.ring);
+ return ret;
+ }
+
+@@ -406,17 +434,24 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
+ return PTR_ERR(map);
+
+ bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
++ ret = alloc_active_ring(map);
++ if (ret < 0) {
++ pvcalls_exit_sock(sock);
++ return ret;
++ }
+
+ spin_lock(&bedata->socket_lock);
+ ret = get_request(bedata, &req_id);
+ if (ret < 0) {
+ spin_unlock(&bedata->socket_lock);
++ free_active_ring(map);
+ pvcalls_exit_sock(sock);
+ return ret;
+ }
+ ret = create_active(map, &evtchn);
+ if (ret < 0) {
+ spin_unlock(&bedata->socket_lock);
++ free_active_ring(map);
+ pvcalls_exit_sock(sock);
+ return ret;
+ }
+@@ -560,15 +595,13 @@ static int __read_ring(struct pvcalls_data_intf *intf,
+ error = intf->in_error;
+ /* get pointers before reading from the ring */
+ virt_rmb();
+- if (error < 0)
+- return error;
+
+ size = pvcalls_queued(prod, cons, array_size);
+ masked_prod = pvcalls_mask(prod, array_size);
+ masked_cons = pvcalls_mask(cons, array_size);
+
+ if (size == 0)
+- return 0;
++ return error ?: size;
+
+ if (len > size)
+ len = size;
+@@ -780,25 +813,36 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
+ }
+ }
+
+- spin_lock(&bedata->socket_lock);
+- ret = get_request(bedata, &req_id);
+- if (ret < 0) {
++ map2 = kzalloc(sizeof(*map2), GFP_KERNEL);
++ if (map2 == NULL) {
+ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
+ (void *)&map->passive.flags);
+- spin_unlock(&bedata->socket_lock);
++ pvcalls_exit_sock(sock);
++ return -ENOMEM;
++ }
++ ret = alloc_active_ring(map2);
++ if (ret < 0) {
++ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
++ (void *)&map->passive.flags);
++ kfree(map2);
+ pvcalls_exit_sock(sock);
+ return ret;
+ }
+- map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
+- if (map2 == NULL) {
++ spin_lock(&bedata->socket_lock);
++ ret = get_request(bedata, &req_id);
++ if (ret < 0) {
+ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
+ (void *)&map->passive.flags);
+ spin_unlock(&bedata->socket_lock);
++ free_active_ring(map2);
++ kfree(map2);
+ pvcalls_exit_sock(sock);
+- return -ENOMEM;
++ return ret;
+ }
++
+ ret = create_active(map2, &evtchn);
+ if (ret < 0) {
++ free_active_ring(map2);
+ kfree(map2);
+ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
+ (void *)&map->passive.flags);
+@@ -839,7 +883,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
+
+ received:
+ map2->sock = newsock;
+- newsock->sk = kzalloc(sizeof(*newsock->sk), GFP_KERNEL);
++ newsock->sk = sk_alloc(sock_net(sock->sk), PF_INET, GFP_KERNEL, &pvcalls_proto, false);
+ if (!newsock->sk) {
+ bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
+ map->passive.inflight_req_id = PVCALLS_INVALID_ID;
+@@ -1032,8 +1076,8 @@ int pvcalls_front_release(struct socket *sock)
+ spin_lock(&bedata->socket_lock);
+ list_del(&map->list);
+ spin_unlock(&bedata->socket_lock);
+- if (READ_ONCE(map->passive.inflight_req_id) !=
+- PVCALLS_INVALID_ID) {
++ if (READ_ONCE(map->passive.inflight_req_id) != PVCALLS_INVALID_ID &&
++ READ_ONCE(map->passive.inflight_req_id) != 0) {
+ pvcalls_front_free_map(bedata,
+ map->passive.accept_map);
+ }
+diff --git a/fs/afs/flock.c b/fs/afs/flock.c
+index dc62d15a964b8..1bb300ef362b0 100644
+--- a/fs/afs/flock.c
++++ b/fs/afs/flock.c
+@@ -208,7 +208,7 @@ again:
+ /* The new front of the queue now owns the state variables. */
+ next = list_entry(vnode->pending_locks.next,
+ struct file_lock, fl_u.afs.link);
+- vnode->lock_key = afs_file_key(next->fl_file);
++ vnode->lock_key = key_get(afs_file_key(next->fl_file));
+ vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+ vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+ goto again;
+@@ -413,7 +413,7 @@ static void afs_dequeue_lock(struct afs_vnode *vnode, struct file_lock *fl)
+ /* The new front of the queue now owns the state variables. */
+ next = list_entry(vnode->pending_locks.next,
+ struct file_lock, fl_u.afs.link);
+- vnode->lock_key = afs_file_key(next->fl_file);
++ vnode->lock_key = key_get(afs_file_key(next->fl_file));
+ vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+ vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+ afs_lock_may_be_available(vnode);
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 071075d775a95..0726e40db0f8b 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -411,7 +411,6 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
+ } else if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
+ valid = true;
+ } else {
+- vnode->cb_s_break = vnode->cb_interest->server->cb_s_break;
+ vnode->cb_v_break = vnode->volume->cb_v_break;
+ valid = false;
+ }
+@@ -543,6 +542,8 @@ void afs_evict_inode(struct inode *inode)
+ #endif
+
+ afs_put_permits(rcu_access_pointer(vnode->permit_cache));
++ key_put(vnode->lock_key);
++ vnode->lock_key = NULL;
+ _leave("");
+ }
+
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index 041c27ea8de15..f74193da0e092 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -616,7 +616,8 @@ int __ceph_finish_cap_snap(struct ceph_inode_info *ci,
+ capsnap->size);
+
+ spin_lock(&mdsc->snap_flush_lock);
+- list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list);
++ if (list_empty(&ci->i_snap_flush_item))
++ list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list);
+ spin_unlock(&mdsc->snap_flush_lock);
+ return 1; /* caller may want to ceph_flush_snaps */
+ }
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 7e9f07bf260d2..81d77b15b3479 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -1084,10 +1084,6 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
+
+ task_lock(p);
+ if (!p->vfork_done && process_shares_mm(p, mm)) {
+- pr_info("updating oom_score_adj for %d (%s) from %d to %d because it shares mm with %d (%s). Report if this is unexpected.\n",
+- task_pid_nr(p), p->comm,
+- p->signal->oom_score_adj, oom_adj,
+- task_pid_nr(task), task->comm);
+ p->signal->oom_score_adj = oom_adj;
+ if (!legacy && has_capability_noaudit(current, CAP_SYS_RESOURCE))
+ p->signal->oom_score_adj_min = (short)oom_adj;
+diff --git a/include/keys/user-type.h b/include/keys/user-type.h
+index e098cbe27db54..12babe9915944 100644
+--- a/include/keys/user-type.h
++++ b/include/keys/user-type.h
+@@ -31,7 +31,7 @@
+ struct user_key_payload {
+ struct rcu_head rcu; /* RCU destructor */
+ unsigned short datalen; /* length of this data */
+- char data[0]; /* actual data */
++ char data[0] __aligned(__alignof__(u64)); /* actual data */
+ };
+
+ extern struct key_type key_type_user;
+diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
+index b1ce500fe8b3d..d756f2318efe0 100644
+--- a/include/linux/compiler-clang.h
++++ b/include/linux/compiler-clang.h
+@@ -3,9 +3,8 @@
+ #error "Please don't include <linux/compiler-clang.h> directly, include <linux/compiler.h> instead."
+ #endif
+
+-/* Some compiler specific definitions are overwritten here
+- * for Clang compiler
+- */
++/* Compiler specific definitions for Clang compiler */
++
+ #define uninitialized_var(x) x = *(&(x))
+
+ /* same as gcc, this was present in clang-2.6 so we can assume it works
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 0242f6eec4eaf..a8ff0ca0c3213 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -58,10 +58,6 @@
+ (typeof(ptr)) (__ptr + (off)); \
+ })
+
+-/* Make the optimizer believe the variable can be manipulated arbitrarily. */
+-#define OPTIMIZER_HIDE_VAR(var) \
+- __asm__ ("" : "=r" (var) : "0" (var))
+-
+ /*
+ * A trick to suppress uninitialized variable warning without generating any
+ * code
+diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
+index 4c7f9befa9f6c..f1fc60f103176 100644
+--- a/include/linux/compiler-intel.h
++++ b/include/linux/compiler-intel.h
+@@ -5,9 +5,7 @@
+
+ #ifdef __ECC
+
+-/* Some compiler specific definitions are overwritten here
+- * for Intel ECC compiler
+- */
++/* Compiler specific definitions for Intel ECC compiler */
+
+ #include <asm/intrinsics.h>
+
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 681d866efb1eb..269d376f5a119 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -158,7 +158,9 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ #endif
+
+ #ifndef OPTIMIZER_HIDE_VAR
+-#define OPTIMIZER_HIDE_VAR(var) barrier()
++/* Make the optimizer believe the variable can be manipulated arbitrarily. */
++#define OPTIMIZER_HIDE_VAR(var) \
++ __asm__ ("" : "=r" (var) : "0" (var))
+ #endif
+
+ /* Not-quite-unique ID. */
+diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h
+index 59ddf9af909e4..2dd0a9ed5b361 100644
+--- a/include/linux/qed/qed_chain.h
++++ b/include/linux/qed/qed_chain.h
+@@ -663,6 +663,37 @@ out:
+ static inline void qed_chain_set_prod(struct qed_chain *p_chain,
+ u32 prod_idx, void *p_prod_elem)
+ {
++ if (p_chain->mode == QED_CHAIN_MODE_PBL) {
++ u32 cur_prod, page_mask, page_cnt, page_diff;
++
++ cur_prod = is_chain_u16(p_chain) ? p_chain->u.chain16.prod_idx :
++ p_chain->u.chain32.prod_idx;
++
++ /* Assume that number of elements in a page is power of 2 */
++ page_mask = ~p_chain->elem_per_page_mask;
++
++ /* Use "cur_prod - 1" and "prod_idx - 1" since producer index
++ * reaches the first element of next page before the page index
++ * is incremented. See qed_chain_produce().
++ * Index wrap around is not a problem because the difference
++ * between current and given producer indices is always
++ * positive and lower than the chain's capacity.
++ */
++ page_diff = (((cur_prod - 1) & page_mask) -
++ ((prod_idx - 1) & page_mask)) /
++ p_chain->elem_per_page;
++
++ page_cnt = qed_chain_get_page_cnt(p_chain);
++ if (is_chain_u16(p_chain))
++ p_chain->pbl.c.u16.prod_page_idx =
++ (p_chain->pbl.c.u16.prod_page_idx -
++ page_diff + page_cnt) % page_cnt;
++ else
++ p_chain->pbl.c.u32.prod_page_idx =
++ (p_chain->pbl.c.u32.prod_page_idx -
++ page_diff + page_cnt) % page_cnt;
++ }
++
+ if (is_chain_u16(p_chain))
+ p_chain->u.chain16.prod_idx = (u16) prod_idx;
+ else
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 5d69e208e8d91..a404d475acee3 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -2392,7 +2392,7 @@ static inline void skb_probe_transport_header(struct sk_buff *skb,
+
+ if (skb_flow_dissect_flow_keys_basic(skb, &keys, NULL, 0, 0, 0, 0))
+ skb_set_transport_header(skb, keys.control.thoff);
+- else
++ else if (offset_hint >= 0)
+ skb_set_transport_header(skb, offset_hint);
+ }
+
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index cb462f9ab7dd5..e0348cb0a1dd7 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -57,6 +57,25 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+
+ if (!skb_partial_csum_set(skb, start, off))
+ return -EINVAL;
++ } else {
++ /* gso packets without NEEDS_CSUM do not set transport_offset.
++ * probe and drop if does not match one of the above types.
++ */
++ if (gso_type && skb->network_header) {
++ if (!skb->protocol)
++ virtio_net_hdr_set_proto(skb, hdr);
++retry:
++ skb_probe_transport_header(skb, -1);
++ if (!skb_transport_header_was_set(skb)) {
++ /* UFO does not specify ipv4 or 6: try both */
++ if (gso_type & SKB_GSO_UDP &&
++ skb->protocol == htons(ETH_P_IP)) {
++ skb->protocol = htons(ETH_P_IPV6);
++ goto retry;
++ }
++ return -EINVAL;
++ }
++ }
+ }
+
+ if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
+index 0e355f4a3d763..0a3de10c6dece 100644
+--- a/include/net/netfilter/nf_flow_table.h
++++ b/include/net/netfilter/nf_flow_table.h
+@@ -84,7 +84,6 @@ struct flow_offload {
+ struct nf_flow_route {
+ struct {
+ struct dst_entry *dst;
+- int ifindex;
+ } tuple[FLOW_OFFLOAD_DIR_MAX];
+ };
+
+diff --git a/include/uapi/linux/inet_diag.h b/include/uapi/linux/inet_diag.h
+index 14565d703291b..e8baca85bac6a 100644
+--- a/include/uapi/linux/inet_diag.h
++++ b/include/uapi/linux/inet_diag.h
+@@ -137,15 +137,21 @@ enum {
+ INET_DIAG_TCLASS,
+ INET_DIAG_SKMEMINFO,
+ INET_DIAG_SHUTDOWN,
+- INET_DIAG_DCTCPINFO,
+- INET_DIAG_PROTOCOL, /* response attribute only */
++
++ /*
++ * Next extenstions cannot be requested in struct inet_diag_req_v2:
++ * its field idiag_ext has only 8 bits.
++ */
++
++ INET_DIAG_DCTCPINFO, /* request as INET_DIAG_VEGASINFO */
++ INET_DIAG_PROTOCOL, /* response attribute only */
+ INET_DIAG_SKV6ONLY,
+ INET_DIAG_LOCALS,
+ INET_DIAG_PEERS,
+ INET_DIAG_PAD,
+- INET_DIAG_MARK,
+- INET_DIAG_BBRINFO,
+- INET_DIAG_CLASS_ID,
++ INET_DIAG_MARK, /* only with CAP_NET_ADMIN */
++ INET_DIAG_BBRINFO, /* request as INET_DIAG_VEGASINFO */
++ INET_DIAG_CLASS_ID, /* request as INET_DIAG_TCLASS */
+ INET_DIAG_MD5SIG,
+ __INET_DIAG_MAX,
+ };
+diff --git a/include/video/udlfb.h b/include/video/udlfb.h
+index 3abd327bada64..7d09e54ae54e0 100644
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -36,12 +36,9 @@ struct dlfb_data {
+ struct usb_device *udev;
+ struct fb_info *info;
+ struct urb_list urbs;
+- struct kref kref;
+ char *backing_buffer;
+ int fb_count;
+ bool virtualized; /* true when physical usb device not present */
+- struct delayed_work init_framebuffer_work;
+- struct delayed_work free_framebuffer_work;
+ atomic_t usb_active; /* 0 = update virtual buffer, but no usb traffic */
+ atomic_t lost_pixels; /* 1 = a render op failed. Need screen refresh */
+ char *edid; /* null until we read edid from hw or get from sysfs */
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index 8061a439ef18c..6a32933cae4ff 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -180,11 +180,14 @@ static inline int stack_map_parse_build_id(void *page_addr,
+
+ if (nhdr->n_type == BPF_BUILD_ID &&
+ nhdr->n_namesz == sizeof("GNU") &&
+- nhdr->n_descsz == BPF_BUILD_ID_SIZE) {
++ nhdr->n_descsz > 0 &&
++ nhdr->n_descsz <= BPF_BUILD_ID_SIZE) {
+ memcpy(build_id,
+ note_start + note_offs +
+ ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr),
+- BPF_BUILD_ID_SIZE);
++ nhdr->n_descsz);
++ memset(build_id + nhdr->n_descsz, 0,
++ BPF_BUILD_ID_SIZE - nhdr->n_descsz);
+ return 0;
+ }
+ new_offs = note_offs + sizeof(Elf32_Nhdr) +
+@@ -260,7 +263,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma,
+ return -EFAULT; /* page not mapped */
+
+ ret = -EINVAL;
+- page_addr = page_address(page);
++ page_addr = kmap_atomic(page);
+ ehdr = (Elf32_Ehdr *)page_addr;
+
+ /* compare magic x7f "ELF" */
+@@ -276,6 +279,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma,
+ else if (ehdr->e_ident[EI_CLASS] == ELFCLASS64)
+ ret = stack_map_get_build_id_64(page_addr, build_id);
+ out:
++ kunmap_atomic(page_addr);
+ put_page(page);
+ return ret;
+ }
+@@ -310,6 +314,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
+ for (i = 0; i < trace_nr; i++) {
+ id_offs[i].status = BPF_STACK_BUILD_ID_IP;
+ id_offs[i].ip = ips[i];
++ memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE);
+ }
+ return;
+ }
+@@ -320,6 +325,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
+ /* per entry fall back to ips */
+ id_offs[i].status = BPF_STACK_BUILD_ID_IP;
+ id_offs[i].ip = ips[i];
++ memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE);
+ continue;
+ }
+ id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + ips[i]
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index bf6f1d70484dc..17bd0c0dfa98a 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -3383,6 +3383,8 @@ static void print_func_help_header_irq(struct trace_buffer *buf, struct seq_file
+ const char tgid_space[] = " ";
+ const char space[] = " ";
+
++ print_event_info(buf, m);
++
+ seq_printf(m, "# %s _-----=> irqs-off\n",
+ tgid ? tgid_space : space);
+ seq_printf(m, "# %s / _----=> need-resched\n",
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 149b6f4cf0233..89d4439516f6c 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1300,7 +1300,7 @@ static int copy_nodes_to_user(unsigned long __user *mask, unsigned long maxnode,
+ nodemask_t *nodes)
+ {
+ unsigned long copy = ALIGN(maxnode-1, 64) / 8;
+- const int nbytes = BITS_TO_LONGS(MAX_NUMNODES) * sizeof(long);
++ unsigned int nbytes = BITS_TO_LONGS(nr_node_ids) * sizeof(long);
+
+ if (copy > nbytes) {
+ if (copy > PAGE_SIZE)
+@@ -1477,7 +1477,7 @@ static int kernel_get_mempolicy(int __user *policy,
+ int uninitialized_var(pval);
+ nodemask_t nodes;
+
+- if (nmask != NULL && maxnode < MAX_NUMNODES)
++ if (nmask != NULL && maxnode < nr_node_ids)
+ return -EINVAL;
+
+ err = do_get_mempolicy(&pval, &nodes, addr, flags);
+@@ -1513,7 +1513,7 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, int __user *, policy,
+ unsigned long nr_bits, alloc_size;
+ DECLARE_BITMAP(bm, MAX_NUMNODES);
+
+- nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
++ nr_bits = min_t(unsigned long, maxnode-1, nr_node_ids);
+ alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
+
+ if (nmask)
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 3899fa6e201dd..a2976adeeedce 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -227,6 +227,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
+
+ switch (ntohs(ethhdr->h_proto)) {
+ case ETH_P_8021Q:
++ if (!pskb_may_pull(skb, sizeof(*vhdr)))
++ goto dropped;
+ vhdr = vlan_eth_hdr(skb);
+
+ /* drop batman-in-batman packets to prevent loops */
+diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
+index 502f663495308..4d4b9b5ea1c17 100644
+--- a/net/bridge/br_fdb.c
++++ b/net/bridge/br_fdb.c
+@@ -1088,6 +1088,8 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
+ err = -ENOMEM;
+ goto err_unlock;
+ }
++ if (swdev_notify)
++ fdb->added_by_user = 1;
+ fdb->added_by_external_learn = 1;
+ fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
+ } else {
+@@ -1107,6 +1109,9 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
+ modified = true;
+ }
+
++ if (swdev_notify)
++ fdb->added_by_user = 1;
++
+ if (modified)
+ fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
+ }
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 6dec8e9b34511..20ed7adcf1cc4 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1420,14 +1420,7 @@ static void br_multicast_query_received(struct net_bridge *br,
+ return;
+
+ br_multicast_update_query_timer(br, query, max_delay);
+-
+- /* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules,
+- * the arrival port for IGMP Queries where the source address
+- * is 0.0.0.0 should not be added to router port list.
+- */
+- if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) ||
+- saddr->proto == htons(ETH_P_IPV6))
+- br_multicast_mark_router(br, port);
++ br_multicast_mark_router(br, port);
+ }
+
+ static void br_ip4_multicast_query(struct net_bridge *br,
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index a127d14421164..f7d7f32ac673c 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -2091,6 +2091,8 @@ static int process_connect(struct ceph_connection *con)
+ dout("process_connect on %p tag %d\n", con, (int)con->in_tag);
+
+ if (con->auth) {
++ int len = le32_to_cpu(con->in_reply.authorizer_len);
++
+ /*
+ * Any connection that defines ->get_authorizer()
+ * should also define ->add_authorizer_challenge() and
+@@ -2100,8 +2102,7 @@ static int process_connect(struct ceph_connection *con)
+ */
+ if (con->in_reply.tag == CEPH_MSGR_TAG_CHALLENGE_AUTHORIZER) {
+ ret = con->ops->add_authorizer_challenge(
+- con, con->auth->authorizer_reply_buf,
+- le32_to_cpu(con->in_reply.authorizer_len));
++ con, con->auth->authorizer_reply_buf, len);
+ if (ret < 0)
+ return ret;
+
+@@ -2111,10 +2112,12 @@ static int process_connect(struct ceph_connection *con)
+ return 0;
+ }
+
+- ret = con->ops->verify_authorizer_reply(con);
+- if (ret < 0) {
+- con->error_msg = "bad authorize reply";
+- return ret;
++ if (len) {
++ ret = con->ops->verify_authorizer_reply(con);
++ if (ret < 0) {
++ con->error_msg = "bad authorize reply";
++ return ret;
++ }
+ }
+ }
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 8c2411fb25090..fb0080e84bd43 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3930,7 +3930,10 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ sk->sk_rcvlowat = val ? : 1;
+ break;
+ case SO_MARK:
+- sk->sk_mark = val;
++ if (sk->sk_mark != val) {
++ sk->sk_mark = val;
++ sk_dst_reset(sk);
++ }
+ break;
+ default:
+ ret = -EINVAL;
+@@ -4001,7 +4004,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ /* Only some options are supported */
+ switch (optname) {
+ case TCP_BPF_IW:
+- if (val <= 0 || tp->data_segs_out > 0)
++ if (val <= 0 || tp->data_segs_out > tp->syn_data)
+ ret = -EINVAL;
+ else
+ tp->snd_cwnd = val;
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 1a4e9ff02762e..5731670c560b0 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -108,6 +108,7 @@ static size_t inet_sk_attr_size(struct sock *sk,
+ + nla_total_size(1) /* INET_DIAG_TOS */
+ + nla_total_size(1) /* INET_DIAG_TCLASS */
+ + nla_total_size(4) /* INET_DIAG_MARK */
++ + nla_total_size(4) /* INET_DIAG_CLASS_ID */
+ + nla_total_size(sizeof(struct inet_diag_meminfo))
+ + nla_total_size(sizeof(struct inet_diag_msg))
+ + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
+@@ -287,12 +288,19 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
+ goto errout;
+ }
+
+- if (ext & (1 << (INET_DIAG_CLASS_ID - 1))) {
++ if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) ||
++ ext & (1 << (INET_DIAG_TCLASS - 1))) {
+ u32 classid = 0;
+
+ #ifdef CONFIG_SOCK_CGROUP_DATA
+ classid = sock_cgroup_classid(&sk->sk_cgrp_data);
+ #endif
++ /* Fallback to socket priority if class id isn't set.
++ * Classful qdiscs use it as direct reference to class.
++ * For cgroup2 classid is always zero.
++ */
++ if (!classid)
++ classid = sk->sk_priority;
+
+ if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid))
+ goto errout;
+diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+index fb1e7f237f531..3cd237b42f446 100644
+--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+@@ -56,7 +56,7 @@ struct clusterip_config {
+ #endif
+ enum clusterip_hashmode hash_mode; /* which hashing mode */
+ u_int32_t hash_initval; /* hash initialization */
+- struct rcu_head rcu;
++ struct rcu_head rcu; /* for call_rcu_bh */
+ struct net *net; /* netns for pernet list */
+ char ifname[IFNAMSIZ]; /* device ifname */
+ };
+@@ -72,6 +72,8 @@ struct clusterip_net {
+
+ #ifdef CONFIG_PROC_FS
+ struct proc_dir_entry *procdir;
++ /* mutex protects the config->pde*/
++ struct mutex mutex;
+ #endif
+ };
+
+@@ -118,17 +120,18 @@ clusterip_config_entry_put(struct clusterip_config *c)
+
+ local_bh_disable();
+ if (refcount_dec_and_lock(&c->entries, &cn->lock)) {
++ list_del_rcu(&c->list);
++ spin_unlock(&cn->lock);
++ local_bh_enable();
+ /* In case anyone still accesses the file, the open/close
+ * functions are also incrementing the refcount on their own,
+ * so it's safe to remove the entry even if it's in use. */
+ #ifdef CONFIG_PROC_FS
++ mutex_lock(&cn->mutex);
+ if (cn->procdir)
+ proc_remove(c->pde);
++ mutex_unlock(&cn->mutex);
+ #endif
+- list_del_rcu(&c->list);
+- spin_unlock(&cn->lock);
+- local_bh_enable();
+-
+ return;
+ }
+ local_bh_enable();
+@@ -278,9 +281,11 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i,
+
+ /* create proc dir entry */
+ sprintf(buffer, "%pI4", &ip);
++ mutex_lock(&cn->mutex);
+ c->pde = proc_create_data(buffer, 0600,
+ cn->procdir,
+ &clusterip_proc_fops, c);
++ mutex_unlock(&cn->mutex);
+ if (!c->pde) {
+ err = -ENOMEM;
+ goto err;
+@@ -833,6 +838,7 @@ static int clusterip_net_init(struct net *net)
+ pr_err("Unable to proc dir entry\n");
+ return -ENOMEM;
+ }
++ mutex_init(&cn->mutex);
+ #endif /* CONFIG_PROC_FS */
+
+ return 0;
+@@ -841,9 +847,12 @@ static int clusterip_net_init(struct net *net)
+ static void clusterip_net_exit(struct net *net)
+ {
+ struct clusterip_net *cn = clusterip_pernet(net);
++
+ #ifdef CONFIG_PROC_FS
++ mutex_lock(&cn->mutex);
+ proc_remove(cn->procdir);
+ cn->procdir = NULL;
++ mutex_unlock(&cn->mutex);
+ #endif
+ nf_unregister_net_hook(net, &cip_arp_ops);
+ }
+diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
+index 8b075f0bc3516..6d0b1f3e927bd 100644
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -23,9 +23,11 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
+ struct sock *sk = sk_to_full_sk(skb->sk);
+ unsigned int hh_len;
+ struct dst_entry *dst;
++ int strict = (ipv6_addr_type(&iph->daddr) &
++ (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
+ struct flowi6 fl6 = {
+ .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
+- rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
++ strict ? skb_dst(skb)->dev->ifindex : 0,
+ .flowi6_mark = skb->mark,
+ .flowi6_uid = sock_net_uid(net, sk),
+ .daddr = iph->daddr,
+diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
+index 8d0ba757a46ce..9b2f272ca1649 100644
+--- a/net/ipv6/seg6.c
++++ b/net/ipv6/seg6.c
+@@ -221,9 +221,7 @@ static int seg6_genl_get_tunsrc(struct sk_buff *skb, struct genl_info *info)
+ rcu_read_unlock();
+
+ genlmsg_end(msg, hdr);
+- genlmsg_reply(msg, info);
+-
+- return 0;
++ return genlmsg_reply(msg, info);
+
+ nla_put_failure:
+ rcu_read_unlock();
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index eb162bd0e0419..da6d5a3f53995 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -546,7 +546,8 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
+ }
+
+ err = 0;
+- if (!ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
++ if (__in6_dev_get(skb->dev) &&
++ !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
+ goto out;
+
+ if (t->parms.iph.daddr == 0)
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 76ba2f34ef6b1..cab8b2b647f96 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1322,10 +1322,7 @@ do_udp_sendmsg:
+ ipc6.opt = opt;
+
+ fl6.flowi6_proto = sk->sk_protocol;
+- if (!ipv6_addr_any(daddr))
+- fl6.daddr = *daddr;
+- else
+- fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
++ fl6.daddr = *daddr;
+ if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
+ fl6.saddr = np->saddr;
+ fl6.fl6_sport = inet->inet_sport;
+@@ -1353,6 +1350,9 @@ do_udp_sendmsg:
+ }
+ }
+
++ if (ipv6_addr_any(&fl6.daddr))
++ fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
++
+ final_p = fl6_update_dst(&fl6, opt, &final);
+ if (final_p)
+ connected = false;
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 5d22eda8a6b1e..c2abe9db1ea24 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -887,6 +887,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+ BSS_CHANGED_P2P_PS |
+ BSS_CHANGED_TXPOWER;
+ int err;
++ int prev_beacon_int;
+
+ old = sdata_dereference(sdata->u.ap.beacon, sdata);
+ if (old)
+@@ -909,6 +910,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+
+ sdata->needed_rx_chains = sdata->local->rx_chains;
+
++ prev_beacon_int = sdata->vif.bss_conf.beacon_int;
+ sdata->vif.bss_conf.beacon_int = params->beacon_interval;
+
+ mutex_lock(&local->mtx);
+@@ -917,8 +919,10 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+ if (!err)
+ ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
+ mutex_unlock(&local->mtx);
+- if (err)
++ if (err) {
++ sdata->vif.bss_conf.beacon_int = prev_beacon_int;
+ return err;
++ }
+
+ /*
+ * Apply control port protocol, this allows us to
+diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
+index 21526630bf655..e84103b405341 100644
+--- a/net/mac80211/mesh.h
++++ b/net/mac80211/mesh.h
+@@ -70,6 +70,7 @@ enum mesh_deferred_task_flags {
+ * @dst: mesh path destination mac address
+ * @mpp: mesh proxy mac address
+ * @rhash: rhashtable list pointer
++ * @walk_list: linked list containing all mesh_path objects.
+ * @gate_list: list pointer for known gates list
+ * @sdata: mesh subif
+ * @next_hop: mesh neighbor to which frames for this destination will be
+@@ -105,6 +106,7 @@ struct mesh_path {
+ u8 dst[ETH_ALEN];
+ u8 mpp[ETH_ALEN]; /* used for MPP or MAP */
+ struct rhash_head rhash;
++ struct hlist_node walk_list;
+ struct hlist_node gate_list;
+ struct ieee80211_sub_if_data *sdata;
+ struct sta_info __rcu *next_hop;
+@@ -133,12 +135,16 @@ struct mesh_path {
+ * gate's mpath may or may not be resolved and active.
+ * @gates_lock: protects updates to known_gates
+ * @rhead: the rhashtable containing struct mesh_paths, keyed by dest addr
++ * @walk_head: linked list containging all mesh_path objects
++ * @walk_lock: lock protecting walk_head
+ * @entries: number of entries in the table
+ */
+ struct mesh_table {
+ struct hlist_head known_gates;
+ spinlock_t gates_lock;
+ struct rhashtable rhead;
++ struct hlist_head walk_head;
++ spinlock_t walk_lock;
+ atomic_t entries; /* Up to MAX_MESH_NEIGHBOURS */
+ };
+
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index a5125624a76dc..c3a7396fb9556 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -59,8 +59,10 @@ static struct mesh_table *mesh_table_alloc(void)
+ return NULL;
+
+ INIT_HLIST_HEAD(&newtbl->known_gates);
++ INIT_HLIST_HEAD(&newtbl->walk_head);
+ atomic_set(&newtbl->entries, 0);
+ spin_lock_init(&newtbl->gates_lock);
++ spin_lock_init(&newtbl->walk_lock);
+
+ return newtbl;
+ }
+@@ -249,28 +251,15 @@ mpp_path_lookup(struct ieee80211_sub_if_data *sdata, const u8 *dst)
+ static struct mesh_path *
+ __mesh_path_lookup_by_idx(struct mesh_table *tbl, int idx)
+ {
+- int i = 0, ret;
+- struct mesh_path *mpath = NULL;
+- struct rhashtable_iter iter;
+-
+- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
+- if (ret)
+- return NULL;
+-
+- rhashtable_walk_start(&iter);
++ int i = 0;
++ struct mesh_path *mpath;
+
+- while ((mpath = rhashtable_walk_next(&iter))) {
+- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
+- continue;
+- if (IS_ERR(mpath))
+- break;
++ hlist_for_each_entry_rcu(mpath, &tbl->walk_head, walk_list) {
+ if (i++ == idx)
+ break;
+ }
+- rhashtable_walk_stop(&iter);
+- rhashtable_walk_exit(&iter);
+
+- if (IS_ERR(mpath) || !mpath)
++ if (!mpath)
+ return NULL;
+
+ if (mpath_expired(mpath)) {
+@@ -432,6 +421,7 @@ struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata,
+ return ERR_PTR(-ENOMEM);
+
+ tbl = sdata->u.mesh.mesh_paths;
++ spin_lock_bh(&tbl->walk_lock);
+ do {
+ ret = rhashtable_lookup_insert_fast(&tbl->rhead,
+ &new_mpath->rhash,
+@@ -441,20 +431,20 @@ struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata,
+ mpath = rhashtable_lookup_fast(&tbl->rhead,
+ dst,
+ mesh_rht_params);
+-
++ else if (!ret)
++ hlist_add_head(&new_mpath->walk_list, &tbl->walk_head);
+ } while (unlikely(ret == -EEXIST && !mpath));
++ spin_unlock_bh(&tbl->walk_lock);
+
+- if (ret && ret != -EEXIST)
+- return ERR_PTR(ret);
+-
+- /* At this point either new_mpath was added, or we found a
+- * matching entry already in the table; in the latter case
+- * free the unnecessary new entry.
+- */
+- if (ret == -EEXIST) {
++ if (ret) {
+ kfree(new_mpath);
++
++ if (ret != -EEXIST)
++ return ERR_PTR(ret);
++
+ new_mpath = mpath;
+ }
++
+ sdata->u.mesh.mesh_paths_generation++;
+ return new_mpath;
+ }
+@@ -480,9 +470,17 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
+
+ memcpy(new_mpath->mpp, mpp, ETH_ALEN);
+ tbl = sdata->u.mesh.mpp_paths;
++
++ spin_lock_bh(&tbl->walk_lock);
+ ret = rhashtable_lookup_insert_fast(&tbl->rhead,
+ &new_mpath->rhash,
+ mesh_rht_params);
++ if (!ret)
++ hlist_add_head_rcu(&new_mpath->walk_list, &tbl->walk_head);
++ spin_unlock_bh(&tbl->walk_lock);
++
++ if (ret)
++ kfree(new_mpath);
+
+ sdata->u.mesh.mpp_paths_generation++;
+ return ret;
+@@ -503,20 +501,9 @@ void mesh_plink_broken(struct sta_info *sta)
+ struct mesh_table *tbl = sdata->u.mesh.mesh_paths;
+ static const u8 bcast[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+ struct mesh_path *mpath;
+- struct rhashtable_iter iter;
+- int ret;
+-
+- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
+- if (ret)
+- return;
+
+- rhashtable_walk_start(&iter);
+-
+- while ((mpath = rhashtable_walk_next(&iter))) {
+- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
+- continue;
+- if (IS_ERR(mpath))
+- break;
++ rcu_read_lock();
++ hlist_for_each_entry_rcu(mpath, &tbl->walk_head, walk_list) {
+ if (rcu_access_pointer(mpath->next_hop) == sta &&
+ mpath->flags & MESH_PATH_ACTIVE &&
+ !(mpath->flags & MESH_PATH_FIXED)) {
+@@ -530,8 +517,7 @@ void mesh_plink_broken(struct sta_info *sta)
+ WLAN_REASON_MESH_PATH_DEST_UNREACHABLE, bcast);
+ }
+ }
+- rhashtable_walk_stop(&iter);
+- rhashtable_walk_exit(&iter);
++ rcu_read_unlock();
+ }
+
+ static void mesh_path_free_rcu(struct mesh_table *tbl,
+@@ -551,6 +537,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl,
+
+ static void __mesh_path_del(struct mesh_table *tbl, struct mesh_path *mpath)
+ {
++ hlist_del_rcu(&mpath->walk_list);
+ rhashtable_remove_fast(&tbl->rhead, &mpath->rhash, mesh_rht_params);
+ mesh_path_free_rcu(tbl, mpath);
+ }
+@@ -571,27 +558,14 @@ void mesh_path_flush_by_nexthop(struct sta_info *sta)
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+ struct mesh_table *tbl = sdata->u.mesh.mesh_paths;
+ struct mesh_path *mpath;
+- struct rhashtable_iter iter;
+- int ret;
+-
+- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
+- if (ret)
+- return;
+-
+- rhashtable_walk_start(&iter);
+-
+- while ((mpath = rhashtable_walk_next(&iter))) {
+- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
+- continue;
+- if (IS_ERR(mpath))
+- break;
++ struct hlist_node *n;
+
++ spin_lock_bh(&tbl->walk_lock);
++ hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
+ if (rcu_access_pointer(mpath->next_hop) == sta)
+ __mesh_path_del(tbl, mpath);
+ }
+-
+- rhashtable_walk_stop(&iter);
+- rhashtable_walk_exit(&iter);
++ spin_unlock_bh(&tbl->walk_lock);
+ }
+
+ static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata,
+@@ -599,51 +573,26 @@ static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata,
+ {
+ struct mesh_table *tbl = sdata->u.mesh.mpp_paths;
+ struct mesh_path *mpath;
+- struct rhashtable_iter iter;
+- int ret;
+-
+- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
+- if (ret)
+- return;
+-
+- rhashtable_walk_start(&iter);
+-
+- while ((mpath = rhashtable_walk_next(&iter))) {
+- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
+- continue;
+- if (IS_ERR(mpath))
+- break;
++ struct hlist_node *n;
+
++ spin_lock_bh(&tbl->walk_lock);
++ hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
+ if (ether_addr_equal(mpath->mpp, proxy))
+ __mesh_path_del(tbl, mpath);
+ }
+-
+- rhashtable_walk_stop(&iter);
+- rhashtable_walk_exit(&iter);
++ spin_unlock_bh(&tbl->walk_lock);
+ }
+
+ static void table_flush_by_iface(struct mesh_table *tbl)
+ {
+ struct mesh_path *mpath;
+- struct rhashtable_iter iter;
+- int ret;
+-
+- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_ATOMIC);
+- if (ret)
+- return;
+-
+- rhashtable_walk_start(&iter);
++ struct hlist_node *n;
+
+- while ((mpath = rhashtable_walk_next(&iter))) {
+- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
+- continue;
+- if (IS_ERR(mpath))
+- break;
++ spin_lock_bh(&tbl->walk_lock);
++ hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
+ __mesh_path_del(tbl, mpath);
+ }
+-
+- rhashtable_walk_stop(&iter);
+- rhashtable_walk_exit(&iter);
++ spin_unlock_bh(&tbl->walk_lock);
+ }
+
+ /**
+@@ -675,7 +624,7 @@ static int table_path_del(struct mesh_table *tbl,
+ {
+ struct mesh_path *mpath;
+
+- rcu_read_lock();
++ spin_lock_bh(&tbl->walk_lock);
+ mpath = rhashtable_lookup_fast(&tbl->rhead, addr, mesh_rht_params);
+ if (!mpath) {
+ rcu_read_unlock();
+@@ -683,7 +632,7 @@ static int table_path_del(struct mesh_table *tbl,
+ }
+
+ __mesh_path_del(tbl, mpath);
+- rcu_read_unlock();
++ spin_unlock_bh(&tbl->walk_lock);
+ return 0;
+ }
+
+@@ -854,28 +803,16 @@ void mesh_path_tbl_expire(struct ieee80211_sub_if_data *sdata,
+ struct mesh_table *tbl)
+ {
+ struct mesh_path *mpath;
+- struct rhashtable_iter iter;
+- int ret;
++ struct hlist_node *n;
+
+- ret = rhashtable_walk_init(&tbl->rhead, &iter, GFP_KERNEL);
+- if (ret)
+- return;
+-
+- rhashtable_walk_start(&iter);
+-
+- while ((mpath = rhashtable_walk_next(&iter))) {
+- if (IS_ERR(mpath) && PTR_ERR(mpath) == -EAGAIN)
+- continue;
+- if (IS_ERR(mpath))
+- break;
++ spin_lock_bh(&tbl->walk_lock);
++ hlist_for_each_entry_safe(mpath, n, &tbl->walk_head, walk_list) {
+ if ((!(mpath->flags & MESH_PATH_RESOLVING)) &&
+ (!(mpath->flags & MESH_PATH_FIXED)) &&
+ time_after(jiffies, mpath->exp_time + MESH_PATH_EXPIRE))
+ __mesh_path_del(tbl, mpath);
+ }
+-
+- rhashtable_walk_stop(&iter);
+- rhashtable_walk_exit(&iter);
++ spin_unlock_bh(&tbl->walk_lock);
+ }
+
+ void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 51ad330bf8e83..828348b2a504d 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2598,6 +2598,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ struct ieee80211_sub_if_data *sdata = rx->sdata;
+ struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+ u16 ac, q, hdrlen;
++ int tailroom = 0;
+
+ hdr = (struct ieee80211_hdr *) skb->data;
+ hdrlen = ieee80211_hdrlen(hdr->frame_control);
+@@ -2684,8 +2685,12 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ if (!ifmsh->mshcfg.dot11MeshForwarding)
+ goto out;
+
++ if (sdata->crypto_tx_tailroom_needed_cnt)
++ tailroom = IEEE80211_ENCRYPT_TAILROOM;
++
+ fwd_skb = skb_copy_expand(skb, local->tx_headroom +
+- sdata->encrypt_headroom, 0, GFP_ATOMIC);
++ sdata->encrypt_headroom,
++ tailroom, GFP_ATOMIC);
+ if (!fwd_skb)
+ goto out;
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index d8125616edc79..e1537ace2b90c 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -28,6 +28,7 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
+ {
+ struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple;
+ struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple;
++ struct dst_entry *other_dst = route->tuple[!dir].dst;
+ struct dst_entry *dst = route->tuple[dir].dst;
+
+ ft->dir = dir;
+@@ -50,8 +51,8 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
+ ft->src_port = ctt->src.u.tcp.port;
+ ft->dst_port = ctt->dst.u.tcp.port;
+
+- ft->iifidx = route->tuple[dir].ifindex;
+- ft->oifidx = route->tuple[!dir].ifindex;
++ ft->iifidx = other_dst->dev->ifindex;
++ ft->oifidx = dst->dev->ifindex;
+ ft->dst_cache = dst;
+ }
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index ed9af46720e14..7d424fd270255 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -291,6 +291,9 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx)
+ int err;
+
+ list_for_each_entry(rule, &ctx->chain->rules, list) {
++ if (!nft_is_active_next(ctx->net, rule))
++ continue;
++
+ err = nft_delrule(ctx, rule);
+ if (err < 0)
+ return err;
+@@ -4439,6 +4442,8 @@ err6:
+ err5:
+ kfree(trans);
+ err4:
++ if (obj)
++ obj->use--;
+ kfree(elem.priv);
+ err3:
+ if (nla[NFTA_SET_ELEM_DATA] != NULL)
+diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
+index 00db27dfd2ff7..b0bc130947c94 100644
+--- a/net/netfilter/nfnetlink_osf.c
++++ b/net/netfilter/nfnetlink_osf.c
+@@ -71,6 +71,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
+ int ttl_check,
+ struct nf_osf_hdr_ctx *ctx)
+ {
++ const __u8 *optpinit = ctx->optp;
+ unsigned int check_WSS = 0;
+ int fmatch = FMATCH_WRONG;
+ int foptsize, optnum;
+@@ -160,6 +161,9 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
+ }
+ }
+
++ if (fmatch != FMATCH_OK)
++ ctx->optp = optpinit;
++
+ return fmatch == FMATCH_OK;
+ }
+
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 29d6fc73caf99..38da1f5436b48 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -282,6 +282,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+ {
+ struct xt_target *target = expr->ops->data;
+ void *info = nft_expr_priv(expr);
++ struct module *me = target->me;
+ struct xt_tgdtor_param par;
+
+ par.net = ctx->net;
+@@ -292,7 +293,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+ par.target->destroy(&par);
+
+ if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
+- module_put(target->me);
++ module_put(me);
+ }
+
+ static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr)
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 5fd4c57c79cc9..436cc14cfc59b 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -12,6 +12,7 @@
+ #include <net/netfilter/nf_conntrack_core.h>
+ #include <linux/netfilter/nf_conntrack_common.h>
+ #include <net/netfilter/nf_flow_table.h>
++#include <net/netfilter/nf_conntrack_helper.h>
+
+ struct nft_flow_offload {
+ struct nft_flowtable *flowtable;
+@@ -29,10 +30,12 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
+ memset(&fl, 0, sizeof(fl));
+ switch (nft_pf(pkt)) {
+ case NFPROTO_IPV4:
+- fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
++ fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
++ fl.u.ip4.flowi4_oif = nft_in(pkt)->ifindex;
+ break;
+ case NFPROTO_IPV6:
+- fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6;
++ fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;
++ fl.u.ip6.flowi6_oif = nft_in(pkt)->ifindex;
+ break;
+ }
+
+@@ -41,9 +44,7 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
+ return -ENOENT;
+
+ route->tuple[dir].dst = this_dst;
+- route->tuple[dir].ifindex = nft_in(pkt)->ifindex;
+ route->tuple[!dir].dst = other_dst;
+- route->tuple[!dir].ifindex = nft_out(pkt)->ifindex;
+
+ return 0;
+ }
+@@ -66,6 +67,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ {
+ struct nft_flow_offload *priv = nft_expr_priv(expr);
+ struct nf_flowtable *flowtable = &priv->flowtable->data;
++ const struct nf_conn_help *help;
+ enum ip_conntrack_info ctinfo;
+ struct nf_flow_route route;
+ struct flow_offload *flow;
+@@ -88,7 +90,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ goto out;
+ }
+
+- if (test_bit(IPS_HELPER_BIT, &ct->status))
++ help = nfct_help(ct);
++ if (help)
+ goto out;
+
+ if (ctinfo == IP_CT_NEW ||
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index c76c21604ffd9..fd16fb836df28 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4275,7 +4275,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ rb->frames_per_block = req->tp_block_size / req->tp_frame_size;
+ if (unlikely(rb->frames_per_block == 0))
+ goto out;
+- if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr))
++ if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr))
+ goto out;
+ if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
+ req->tp_frame_nr))
+diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
+index 9ccc93f257db0..38bb882bb9587 100644
+--- a/net/sched/cls_tcindex.c
++++ b/net/sched/cls_tcindex.c
+@@ -48,7 +48,7 @@ struct tcindex_data {
+ u32 hash; /* hash table size; 0 if undefined */
+ u32 alloc_hash; /* allocated size */
+ u32 fall_through; /* 0: only classify if explicit match */
+- struct rcu_head rcu;
++ struct rcu_work rwork;
+ };
+
+ static inline int tcindex_filter_is_set(struct tcindex_filter_result *r)
+@@ -221,17 +221,11 @@ found:
+ return 0;
+ }
+
+-static int tcindex_destroy_element(struct tcf_proto *tp,
+- void *arg, struct tcf_walker *walker)
+-{
+- bool last;
+-
+- return tcindex_delete(tp, arg, &last, NULL);
+-}
+-
+-static void __tcindex_destroy(struct rcu_head *head)
++static void tcindex_destroy_work(struct work_struct *work)
+ {
+- struct tcindex_data *p = container_of(head, struct tcindex_data, rcu);
++ struct tcindex_data *p = container_of(to_rcu_work(work),
++ struct tcindex_data,
++ rwork);
+
+ kfree(p->perfect);
+ kfree(p->h);
+@@ -258,9 +252,11 @@ static int tcindex_filter_result_init(struct tcindex_filter_result *r)
+ return tcf_exts_init(&r->exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
+ }
+
+-static void __tcindex_partial_destroy(struct rcu_head *head)
++static void tcindex_partial_destroy_work(struct work_struct *work)
+ {
+- struct tcindex_data *p = container_of(head, struct tcindex_data, rcu);
++ struct tcindex_data *p = container_of(to_rcu_work(work),
++ struct tcindex_data,
++ rwork);
+
+ kfree(p->perfect);
+ kfree(p);
+@@ -275,7 +271,7 @@ static void tcindex_free_perfect_hash(struct tcindex_data *cp)
+ kfree(cp->perfect);
+ }
+
+-static int tcindex_alloc_perfect_hash(struct tcindex_data *cp)
++static int tcindex_alloc_perfect_hash(struct net *net, struct tcindex_data *cp)
+ {
+ int i, err = 0;
+
+@@ -289,6 +285,9 @@ static int tcindex_alloc_perfect_hash(struct tcindex_data *cp)
+ TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
+ if (err < 0)
+ goto errout;
++#ifdef CONFIG_NET_CLS_ACT
++ cp->perfect[i].exts.net = net;
++#endif
+ }
+
+ return 0;
+@@ -305,9 +304,9 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ struct nlattr *est, bool ovr, struct netlink_ext_ack *extack)
+ {
+ struct tcindex_filter_result new_filter_result, *old_r = r;
+- struct tcindex_filter_result cr;
+ struct tcindex_data *cp = NULL, *oldp;
+ struct tcindex_filter *f = NULL; /* make gcc behave */
++ struct tcf_result cr = {};
+ int err, balloc = 0;
+ struct tcf_exts e;
+
+@@ -337,7 +336,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ if (p->perfect) {
+ int i;
+
+- if (tcindex_alloc_perfect_hash(cp) < 0)
++ if (tcindex_alloc_perfect_hash(net, cp) < 0)
+ goto errout;
+ for (i = 0; i < cp->hash; i++)
+ cp->perfect[i].res = p->perfect[i].res;
+@@ -346,13 +345,10 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ cp->h = p->h;
+
+ err = tcindex_filter_result_init(&new_filter_result);
+- if (err < 0)
+- goto errout1;
+- err = tcindex_filter_result_init(&cr);
+ if (err < 0)
+ goto errout1;
+ if (old_r)
+- cr.res = r->res;
++ cr = r->res;
+
+ if (tb[TCA_TCINDEX_HASH])
+ cp->hash = nla_get_u32(tb[TCA_TCINDEX_HASH]);
+@@ -406,7 +402,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ err = -ENOMEM;
+ if (!cp->perfect && !cp->h) {
+ if (valid_perfect_hash(cp)) {
+- if (tcindex_alloc_perfect_hash(cp) < 0)
++ if (tcindex_alloc_perfect_hash(net, cp) < 0)
+ goto errout_alloc;
+ balloc = 1;
+ } else {
+@@ -443,8 +439,8 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ }
+
+ if (tb[TCA_TCINDEX_CLASSID]) {
+- cr.res.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]);
+- tcf_bind_filter(tp, &cr.res, base);
++ cr.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]);
++ tcf_bind_filter(tp, &cr, base);
+ }
+
+ if (old_r && old_r != r) {
+@@ -456,7 +452,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ }
+
+ oldp = p;
+- r->res = cr.res;
++ r->res = cr;
+ tcf_exts_change(&r->exts, &e);
+
+ rcu_assign_pointer(tp->root, cp);
+@@ -475,10 +471,12 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ ; /* nothing */
+
+ rcu_assign_pointer(*fp, f);
++ } else {
++ tcf_exts_destroy(&new_filter_result.exts);
+ }
+
+ if (oldp)
+- call_rcu(&oldp->rcu, __tcindex_partial_destroy);
++ tcf_queue_work(&oldp->rwork, tcindex_partial_destroy_work);
+ return 0;
+
+ errout_alloc:
+@@ -487,7 +485,6 @@ errout_alloc:
+ else if (balloc == 2)
+ kfree(cp->h);
+ errout1:
+- tcf_exts_destroy(&cr.exts);
+ tcf_exts_destroy(&new_filter_result.exts);
+ errout:
+ kfree(cp);
+@@ -562,15 +559,34 @@ static void tcindex_destroy(struct tcf_proto *tp,
+ struct netlink_ext_ack *extack)
+ {
+ struct tcindex_data *p = rtnl_dereference(tp->root);
+- struct tcf_walker walker;
++ int i;
+
+ pr_debug("tcindex_destroy(tp %p),p %p\n", tp, p);
+- walker.count = 0;
+- walker.skip = 0;
+- walker.fn = tcindex_destroy_element;
+- tcindex_walk(tp, &walker);
+
+- call_rcu(&p->rcu, __tcindex_destroy);
++ if (p->perfect) {
++ for (i = 0; i < p->hash; i++) {
++ struct tcindex_filter_result *r = p->perfect + i;
++
++ tcf_unbind_filter(tp, &r->res);
++ if (tcf_exts_get_net(&r->exts))
++ tcf_queue_work(&r->rwork,
++ tcindex_destroy_rexts_work);
++ else
++ __tcindex_destroy_rexts(r);
++ }
++ }
++
++ for (i = 0; p->h && i < p->hash; i++) {
++ struct tcindex_filter *f, *next;
++ bool last;
++
++ for (f = rtnl_dereference(p->h[i]); f; f = next) {
++ next = rtnl_dereference(f->next);
++ tcindex_delete(tp, &f->result, &last, NULL);
++ }
++ }
++
++ tcf_queue_work(&p->rwork, tcindex_destroy_work);
+ }
+
+
+diff --git a/net/sctp/diag.c b/net/sctp/diag.c
+index 078f01a8d582a..435847d98b51c 100644
+--- a/net/sctp/diag.c
++++ b/net/sctp/diag.c
+@@ -256,6 +256,7 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc)
+ + nla_total_size(1) /* INET_DIAG_TOS */
+ + nla_total_size(1) /* INET_DIAG_TCLASS */
+ + nla_total_size(4) /* INET_DIAG_MARK */
++ + nla_total_size(4) /* INET_DIAG_CLASS_ID */
+ + nla_total_size(addrlen * asoc->peer.transport_count)
+ + nla_total_size(addrlen * addrcnt)
+ + nla_total_size(sizeof(struct inet_diag_meminfo))
+diff --git a/net/sctp/offload.c b/net/sctp/offload.c
+index 123e9f2dc2265..edfcf16e704c4 100644
+--- a/net/sctp/offload.c
++++ b/net/sctp/offload.c
+@@ -36,6 +36,7 @@ static __le32 sctp_gso_make_checksum(struct sk_buff *skb)
+ {
+ skb->ip_summed = CHECKSUM_NONE;
+ skb->csum_not_inet = 0;
++ gso_reset_checksum(skb, ~0);
+ return sctp_compute_cksum(skb, skb_transport_offset(skb));
+ }
+
+diff --git a/net/sctp/stream.c b/net/sctp/stream.c
+index f24633114dfdf..2936ed17bf9ef 100644
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -144,8 +144,10 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream,
+ }
+ }
+
+- for (i = outcnt; i < stream->outcnt; i++)
++ for (i = outcnt; i < stream->outcnt; i++) {
+ kfree(SCTP_SO(stream, i)->ext);
++ SCTP_SO(stream, i)->ext = NULL;
++ }
+ }
+
+ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
+diff --git a/net/socket.c b/net/socket.c
+index 390a8ecef4bf4..5c820212ba815 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -941,8 +941,7 @@ void dlci_ioctl_set(int (*hook) (unsigned int, void __user *))
+ EXPORT_SYMBOL(dlci_ioctl_set);
+
+ static long sock_do_ioctl(struct net *net, struct socket *sock,
+- unsigned int cmd, unsigned long arg,
+- unsigned int ifreq_size)
++ unsigned int cmd, unsigned long arg)
+ {
+ int err;
+ void __user *argp = (void __user *)arg;
+@@ -968,11 +967,11 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,
+ } else {
+ struct ifreq ifr;
+ bool need_copyout;
+- if (copy_from_user(&ifr, argp, ifreq_size))
++ if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
+ return -EFAULT;
+ err = dev_ioctl(net, cmd, &ifr, &need_copyout);
+ if (!err && need_copyout)
+- if (copy_to_user(argp, &ifr, ifreq_size))
++ if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
+ return -EFAULT;
+ }
+ return err;
+@@ -1071,8 +1070,7 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+ err = open_related_ns(&net->ns, get_net_ns);
+ break;
+ default:
+- err = sock_do_ioctl(net, sock, cmd, arg,
+- sizeof(struct ifreq));
++ err = sock_do_ioctl(net, sock, cmd, arg);
+ break;
+ }
+ return err;
+@@ -2752,8 +2750,7 @@ static int do_siocgstamp(struct net *net, struct socket *sock,
+ int err;
+
+ set_fs(KERNEL_DS);
+- err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv,
+- sizeof(struct compat_ifreq));
++ err = sock_do_ioctl(net, sock, cmd, (unsigned long)&ktv);
+ set_fs(old_fs);
+ if (!err)
+ err = compat_put_timeval(&ktv, up);
+@@ -2769,8 +2766,7 @@ static int do_siocgstampns(struct net *net, struct socket *sock,
+ int err;
+
+ set_fs(KERNEL_DS);
+- err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts,
+- sizeof(struct compat_ifreq));
++ err = sock_do_ioctl(net, sock, cmd, (unsigned long)&kts);
+ set_fs(old_fs);
+ if (!err)
+ err = compat_put_timespec(&kts, up);
+@@ -2966,6 +2962,54 @@ static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
+ return dev_ioctl(net, cmd, &ifreq, NULL);
+ }
+
++static int compat_ifreq_ioctl(struct net *net, struct socket *sock,
++ unsigned int cmd,
++ struct compat_ifreq __user *uifr32)
++{
++ struct ifreq __user *uifr;
++ int err;
++
++ /* Handle the fact that while struct ifreq has the same *layout* on
++ * 32/64 for everything but ifreq::ifru_ifmap and ifreq::ifru_data,
++ * which are handled elsewhere, it still has different *size* due to
++ * ifreq::ifru_ifmap (which is 16 bytes on 32 bit, 24 bytes on 64-bit,
++ * resulting in struct ifreq being 32 and 40 bytes respectively).
++ * As a result, if the struct happens to be at the end of a page and
++ * the next page isn't readable/writable, we get a fault. To prevent
++ * that, copy back and forth to the full size.
++ */
++
++ uifr = compat_alloc_user_space(sizeof(*uifr));
++ if (copy_in_user(uifr, uifr32, sizeof(*uifr32)))
++ return -EFAULT;
++
++ err = sock_do_ioctl(net, sock, cmd, (unsigned long)uifr);
++
++ if (!err) {
++ switch (cmd) {
++ case SIOCGIFFLAGS:
++ case SIOCGIFMETRIC:
++ case SIOCGIFMTU:
++ case SIOCGIFMEM:
++ case SIOCGIFHWADDR:
++ case SIOCGIFINDEX:
++ case SIOCGIFADDR:
++ case SIOCGIFBRDADDR:
++ case SIOCGIFDSTADDR:
++ case SIOCGIFNETMASK:
++ case SIOCGIFPFLAGS:
++ case SIOCGIFTXQLEN:
++ case SIOCGMIIPHY:
++ case SIOCGMIIREG:
++ case SIOCGIFNAME:
++ if (copy_in_user(uifr32, uifr, sizeof(*uifr32)))
++ err = -EFAULT;
++ break;
++ }
++ }
++ return err;
++}
++
+ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
+ struct compat_ifreq __user *uifr32)
+ {
+@@ -3081,8 +3125,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
+ }
+
+ set_fs(KERNEL_DS);
+- ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r,
+- sizeof(struct compat_ifreq));
++ ret = sock_do_ioctl(net, sock, cmd, (unsigned long) r);
+ set_fs(old_fs);
+
+ out:
+@@ -3182,21 +3225,22 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
+ case SIOCSIFTXQLEN:
+ case SIOCBRADDIF:
+ case SIOCBRDELIF:
++ case SIOCGIFNAME:
+ case SIOCSIFNAME:
+ case SIOCGMIIPHY:
+ case SIOCGMIIREG:
+ case SIOCSMIIREG:
+- case SIOCSARP:
+- case SIOCGARP:
+- case SIOCDARP:
+- case SIOCATMARK:
+ case SIOCBONDENSLAVE:
+ case SIOCBONDRELEASE:
+ case SIOCBONDSETHWADDR:
+ case SIOCBONDCHANGEACTIVE:
+- case SIOCGIFNAME:
+- return sock_do_ioctl(net, sock, cmd, arg,
+- sizeof(struct compat_ifreq));
++ return compat_ifreq_ioctl(net, sock, cmd, argp);
++
++ case SIOCSARP:
++ case SIOCGARP:
++ case SIOCDARP:
++ case SIOCATMARK:
++ return sock_do_ioctl(net, sock, cmd, arg);
+ }
+
+ return -ENOIOCTLCMD;
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 956a5ea47b58e..3d6bf790cf1fb 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -872,7 +872,7 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
+ for (i = 0; i <= buf->rb_sc_last; i++) {
+ sc = rpcrdma_sendctx_create(&r_xprt->rx_ia);
+ if (!sc)
+- goto out_destroy;
++ return -ENOMEM;
+
+ sc->sc_xprt = r_xprt;
+ buf->rb_sc_ctxs[i] = sc;
+@@ -880,10 +880,6 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
+ buf->rb_flags = 0;
+
+ return 0;
+-
+-out_destroy:
+- rpcrdma_sendctxs_destroy(buf);
+- return -ENOMEM;
+ }
+
+ /* The sendctx queue is not guaranteed to have a size that is a
+diff --git a/security/keys/key.c b/security/keys/key.c
+index d97c9394b5dd4..249a6da4d2770 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -265,8 +265,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
+
+ spin_lock(&user->lock);
+ if (!(flags & KEY_ALLOC_QUOTA_OVERRUN)) {
+- if (user->qnkeys + 1 >= maxkeys ||
+- user->qnbytes + quotalen >= maxbytes ||
++ if (user->qnkeys + 1 > maxkeys ||
++ user->qnbytes + quotalen > maxbytes ||
+ user->qnbytes + quotalen < user->qnbytes)
+ goto no_quota;
+ }
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index 41bcf57e96f21..99a55145ddcd2 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -661,9 +661,6 @@ static bool search_nested_keyrings(struct key *keyring,
+ BUG_ON((ctx->flags & STATE_CHECKS) == 0 ||
+ (ctx->flags & STATE_CHECKS) == STATE_CHECKS);
+
+- if (ctx->index_key.description)
+- ctx->index_key.desc_len = strlen(ctx->index_key.description);
+-
+ /* Check to see if this top-level keyring is what we are looking for
+ * and whether it is valid or not.
+ */
+@@ -914,6 +911,7 @@ key_ref_t keyring_search(key_ref_t keyring,
+ struct keyring_search_context ctx = {
+ .index_key.type = type,
+ .index_key.description = description,
++ .index_key.desc_len = strlen(description),
+ .cred = current_cred(),
+ .match_data.cmp = key_default_cmp,
+ .match_data.raw_data = description,
+diff --git a/security/keys/proc.c b/security/keys/proc.c
+index 5af2934965d80..d38be9db2cc07 100644
+--- a/security/keys/proc.c
++++ b/security/keys/proc.c
+@@ -166,8 +166,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
+ int rc;
+
+ struct keyring_search_context ctx = {
+- .index_key.type = key->type,
+- .index_key.description = key->description,
++ .index_key = key->index_key,
+ .cred = m->file->f_cred,
+ .match_data.cmp = lookup_user_key_possessed,
+ .match_data.raw_data = key,
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index 114f7408feee6..7385536986497 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -545,6 +545,7 @@ struct key *request_key_and_link(struct key_type *type,
+ struct keyring_search_context ctx = {
+ .index_key.type = type,
+ .index_key.description = description,
++ .index_key.desc_len = strlen(description),
+ .cred = current_cred(),
+ .match_data.cmp = key_default_cmp,
+ .match_data.raw_data = description,
+diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
+index 424e1d90412ea..6797843154f03 100644
+--- a/security/keys/request_key_auth.c
++++ b/security/keys/request_key_auth.c
+@@ -246,7 +246,7 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id)
+ struct key *authkey;
+ key_ref_t authkey_ref;
+
+- sprintf(description, "%x", target_id);
++ ctx.index_key.desc_len = sprintf(description, "%x", target_id);
+
+ authkey_ref = search_process_keyrings(&ctx);
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9199d91d0a594..bf1ffcaab23fe 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1855,6 +1855,8 @@ enum {
+ ALC887_FIXUP_BASS_CHMAP,
+ ALC1220_FIXUP_GB_DUAL_CODECS,
+ ALC1220_FIXUP_CLEVO_P950,
++ ALC1220_FIXUP_SYSTEM76_ORYP5,
++ ALC1220_FIXUP_SYSTEM76_ORYP5_PINS,
+ };
+
+ static void alc889_fixup_coef(struct hda_codec *codec,
+@@ -2056,6 +2058,17 @@ static void alc1220_fixup_clevo_p950(struct hda_codec *codec,
+ snd_hda_override_conn_list(codec, 0x1b, 1, conn1);
+ }
+
++static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action);
++
++static void alc1220_fixup_system76_oryp5(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ alc1220_fixup_clevo_p950(codec, fix, action);
++ alc_fixup_headset_mode_no_hp_mic(codec, fix, action);
++}
++
+ static const struct hda_fixup alc882_fixups[] = {
+ [ALC882_FIXUP_ABIT_AW9D_MAX] = {
+ .type = HDA_FIXUP_PINS,
+@@ -2300,6 +2313,19 @@ static const struct hda_fixup alc882_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc1220_fixup_clevo_p950,
+ },
++ [ALC1220_FIXUP_SYSTEM76_ORYP5] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc1220_fixup_system76_oryp5,
++ },
++ [ALC1220_FIXUP_SYSTEM76_ORYP5_PINS] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ {}
++ },
++ .chained = true,
++ .chain_id = ALC1220_FIXUP_SYSTEM76_ORYP5,
++ },
+ };
+
+ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+@@ -2376,6 +2402,8 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
++ SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
+ SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
+@@ -5573,6 +5601,7 @@ enum {
+ ALC294_FIXUP_ASUS_HEADSET_MIC,
+ ALC294_FIXUP_ASUS_SPK,
+ ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
++ ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6506,6 +6535,17 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+ },
++ [ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* Disable PCBEEP-IN passthrough */
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x36 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x57d7 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC285_FIXUP_LENOVO_HEADPHONE_NOISE
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -7187,7 +7227,7 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60130},
+ {0x19, 0x03a11020},
+ {0x21, 0x0321101f}),
+- SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
++ SND_HDA_PIN_QUIRK(0x10ec0285, 0x17aa, "Lenovo", ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
+ {0x12, 0x90a60130},
+ {0x14, 0x90170110},
+ {0x19, 0x04a11040},
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index d029cad08cbd8..89f8b0dae7ef0 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -1136,7 +1136,9 @@ static void test_stacktrace_build_id(void)
+ int i, j;
+ struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
+ int build_id_matches = 0;
++ int retry = 1;
+
++retry:
+ err = bpf_prog_load(file, BPF_PROG_TYPE_TRACEPOINT, &obj, &prog_fd);
+ if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
+ goto out;
+@@ -1249,6 +1251,19 @@ static void test_stacktrace_build_id(void)
+ previous_key = key;
+ } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
+
++ /* stack_map_get_build_id_offset() is racy and sometimes can return
++ * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID;
++ * try it one more time.
++ */
++ if (build_id_matches < 1 && retry--) {
++ ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
++ close(pmu_fd);
++ bpf_object__close(obj);
++ printf("%s:WARN:Didn't find expected build ID from the map, retrying\n",
++ __func__);
++ goto retry;
++ }
++
+ if (CHECK(build_id_matches < 1, "build id match",
+ "Didn't find expected build ID from the map\n"))
+ goto disable_pmu;
+@@ -1289,7 +1304,9 @@ static void test_stacktrace_build_id_nmi(void)
+ int i, j;
+ struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
+ int build_id_matches = 0;
++ int retry = 1;
+
++retry:
+ err = bpf_prog_load(file, BPF_PROG_TYPE_PERF_EVENT, &obj, &prog_fd);
+ if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
+ return;
+@@ -1384,6 +1401,19 @@ static void test_stacktrace_build_id_nmi(void)
+ previous_key = key;
+ } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
+
++ /* stack_map_get_build_id_offset() is racy and sometimes can return
++ * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID;
++ * try it one more time.
++ */
++ if (build_id_matches < 1 && retry--) {
++ ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
++ close(pmu_fd);
++ bpf_object__close(obj);
++ printf("%s:WARN:Didn't find expected build ID from the map, retrying\n",
++ __func__);
++ goto retry;
++ }
++
+ if (CHECK(build_id_matches < 1, "build id match",
+ "Didn't find expected build ID from the map\n"))
+ goto disable_pmu;
+diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c
+index aeeb76a54d633..e38f1cb7089d3 100644
+--- a/tools/testing/selftests/bpf/test_sock_addr.c
++++ b/tools/testing/selftests/bpf/test_sock_addr.c
+@@ -44,6 +44,7 @@
+ #define SERV6_V4MAPPED_IP "::ffff:192.168.0.4"
+ #define SRC6_IP "::1"
+ #define SRC6_REWRITE_IP "::6"
++#define WILDCARD6_IP "::"
+ #define SERV6_PORT 6060
+ #define SERV6_REWRITE_PORT 6666
+
+@@ -85,12 +86,14 @@ static int bind4_prog_load(const struct sock_addr_test *test);
+ static int bind6_prog_load(const struct sock_addr_test *test);
+ static int connect4_prog_load(const struct sock_addr_test *test);
+ static int connect6_prog_load(const struct sock_addr_test *test);
++static int sendmsg_allow_prog_load(const struct sock_addr_test *test);
+ static int sendmsg_deny_prog_load(const struct sock_addr_test *test);
+ static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test);
+ static int sendmsg4_rw_c_prog_load(const struct sock_addr_test *test);
+ static int sendmsg6_rw_asm_prog_load(const struct sock_addr_test *test);
+ static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test);
+ static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test);
++static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test);
+
+ static struct sock_addr_test tests[] = {
+ /* bind */
+@@ -462,6 +465,34 @@ static struct sock_addr_test tests[] = {
+ SRC6_REWRITE_IP,
+ SYSCALL_ENOTSUPP,
+ },
++ {
++ "sendmsg6: set dst IP = [::] (BSD'ism)",
++ sendmsg6_rw_wildcard_prog_load,
++ BPF_CGROUP_UDP6_SENDMSG,
++ BPF_CGROUP_UDP6_SENDMSG,
++ AF_INET6,
++ SOCK_DGRAM,
++ SERV6_IP,
++ SERV6_PORT,
++ SERV6_REWRITE_IP,
++ SERV6_REWRITE_PORT,
++ SRC6_REWRITE_IP,
++ SUCCESS,
++ },
++ {
++ "sendmsg6: preserve dst IP = [::] (BSD'ism)",
++ sendmsg_allow_prog_load,
++ BPF_CGROUP_UDP6_SENDMSG,
++ BPF_CGROUP_UDP6_SENDMSG,
++ AF_INET6,
++ SOCK_DGRAM,
++ WILDCARD6_IP,
++ SERV6_PORT,
++ SERV6_REWRITE_IP,
++ SERV6_PORT,
++ SRC6_IP,
++ SUCCESS,
++ },
+ {
+ "sendmsg6: deny call",
+ sendmsg_deny_prog_load,
+@@ -714,16 +745,27 @@ static int connect6_prog_load(const struct sock_addr_test *test)
+ return load_path(test, CONNECT6_PROG_PATH);
+ }
+
+-static int sendmsg_deny_prog_load(const struct sock_addr_test *test)
++static int sendmsg_ret_only_prog_load(const struct sock_addr_test *test,
++ int32_t rc)
+ {
+ struct bpf_insn insns[] = {
+- /* return 0 */
+- BPF_MOV64_IMM(BPF_REG_0, 0),
++ /* return rc */
++ BPF_MOV64_IMM(BPF_REG_0, rc),
+ BPF_EXIT_INSN(),
+ };
+ return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn));
+ }
+
++static int sendmsg_allow_prog_load(const struct sock_addr_test *test)
++{
++ return sendmsg_ret_only_prog_load(test, /*rc*/ 1);
++}
++
++static int sendmsg_deny_prog_load(const struct sock_addr_test *test)
++{
++ return sendmsg_ret_only_prog_load(test, /*rc*/ 0);
++}
++
+ static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test)
+ {
+ struct sockaddr_in dst4_rw_addr;
+@@ -844,6 +886,11 @@ static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test)
+ return sendmsg6_rw_dst_asm_prog_load(test, SERV6_V4MAPPED_IP);
+ }
+
++static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test)
++{
++ return sendmsg6_rw_dst_asm_prog_load(test, WILDCARD6_IP);
++}
++
+ static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test)
+ {
+ return load_path(test, SENDMSG6_PROG_PATH);
+diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+index d8313d0438b74..b90dff8d3a94b 100755
+--- a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
++++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+@@ -1,7 +1,7 @@
+ #!/bin/bash
+ # SPDX-License-Identifier: GPL-2.0
+
+-ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding"
++ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion extern_learn"
+ NUM_NETIFS=4
+ CHECK_TC="yes"
+ source lib.sh
+@@ -96,6 +96,51 @@ flooding()
+ flood_test $swp2 $h1 $h2
+ }
+
++vlan_deletion()
++{
++ # Test that the deletion of a VLAN on a bridge port does not affect
++ # the PVID VLAN
++ log_info "Add and delete a VLAN on bridge port $swp1"
++
++ bridge vlan add vid 10 dev $swp1
++ bridge vlan del vid 10 dev $swp1
++
++ ping_ipv4
++ ping_ipv6
++}
++
++extern_learn()
++{
++ local mac=de:ad:be:ef:13:37
++ local ageing_time
++
++ # Test that externally learned FDB entries can roam, but not age out
++ RET=0
++
++ bridge fdb add de:ad:be:ef:13:37 dev $swp1 master extern_learn vlan 1
++
++ bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37
++ check_err $? "Did not find FDB entry when should"
++
++ # Wait for 10 seconds after the ageing time to make sure the FDB entry
++ # was not aged out
++ ageing_time=$(bridge_ageing_time_get br0)
++ sleep $((ageing_time + 10))
++
++ bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37
++ check_err $? "FDB entry was aged out when should not"
++
++ $MZ $h2 -c 1 -p 64 -a $mac -t ip -q
++
++ bridge fdb show brport $swp2 | grep -q de:ad:be:ef:13:37
++ check_err $? "FDB entry did not roam when should"
++
++ log_test "Externally learned FDB entry - ageing & roaming"
++
++ bridge fdb del de:ad:be:ef:13:37 dev $swp2 master vlan 1 &> /dev/null
++ bridge fdb del de:ad:be:ef:13:37 dev $swp1 master vlan 1 &> /dev/null
++}
++
+ trap cleanup EXIT
+
+ setup_prepare
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
+index 637ea0219617f..0da3545cabdb6 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
+@@ -17,7 +17,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -41,7 +41,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 10 pipe index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -65,7 +65,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark continue index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*allow mark.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*allow mark.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -89,7 +89,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 789 drop index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*use mark 789.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*use mark 789.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -113,7 +113,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 656768 reclassify index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 656768.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 656768.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -137,7 +137,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 65 jump 1 index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0xED3E.*use mark 65.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0[xX]ED3E.*use mark 65.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -161,7 +161,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295 reclassify index 90",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 90",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 4294967295.*index 90",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 4294967295.*index 90",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -185,7 +185,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295999 pipe index 90",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 90",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark 4294967295999.*index 90",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark 4294967295999.*index 90",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -207,7 +207,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio pass index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow prio.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow prio.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -231,7 +231,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 7 pipe index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 7.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 7.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -255,7 +255,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 3 continue index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use prio 3.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use prio 3.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -279,7 +279,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio drop index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow prio.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow prio.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -303,7 +303,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 998877 reclassify index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 998877.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 998877.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -327,7 +327,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 998877 jump 10 index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0xED3E.*use prio 998877.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0[xX]ED3E.*use prio 998877.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -351,7 +351,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 4294967295 reclassify index 99",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 99",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 4294967295.*index 99",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 4294967295.*index 99",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -375,7 +375,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 4294967298 pipe index 99",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 99",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 4294967298.*index 99",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 4294967298.*index 99",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -397,7 +397,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -421,7 +421,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 111 pipe index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 111.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 111.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -445,7 +445,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -469,7 +469,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -493,7 +493,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex drop index 77",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 77",
+- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow tcindex.*index 77",
++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow tcindex.*index 77",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -517,7 +517,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex reclassify index 77",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 77",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*allow tcindex.*index 77",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*allow tcindex.*index 77",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -541,7 +541,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex jump 999 index 77",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 77",
+- "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0xED3E.*allow tcindex.*index 77",
++ "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0[xX]ED3E.*allow tcindex.*index 77",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -565,7 +565,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 65535 pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*use tcindex 65535.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*use tcindex 65535.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -589,7 +589,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 65539 pipe index 1",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 65539.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 65539.*index 1",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -611,7 +611,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark src 00:11:22:33:44:55 pipe index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow mark src 00:11:22:33:44:55.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow mark src 00:11:22:33:44:55.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -635,7 +635,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 9876 dst 00:11:22:33:44:55 reclassify index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -659,7 +659,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex src 00:aa:bb:cc:dd:ee dst 00:11:22:33:44:55 pass index 11",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 11",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -683,7 +683,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 7 type 0xfefe pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xFEFE.*use mark 7.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]FEFE.*use mark 7.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -707,7 +707,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 444 type 0xabba pipe index 21",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 21",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xABBA.*use prio 444.*index 21",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ABBA.*use prio 444.*index 21",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -731,7 +731,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 5000 type 0xabcd reclassify index 21",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 21",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xABCD.*use tcindex 5000.*index 21",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ABCD.*use tcindex 5000.*index 21",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -739,7 +739,7 @@
+ },
+ {
+ "id": "fac3",
+- "name": "Create valid ife encode action with index at 32-bit maximnum",
++ "name": "Create valid ife encode action with index at 32-bit maximum",
+ "category": [
+ "actions",
+ "ife"
+@@ -755,7 +755,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 4294967295",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -779,7 +779,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action pass.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action pass.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -803,7 +803,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode pipe index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -827,7 +827,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode continue index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action continue.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action continue.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -851,7 +851,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode drop index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action drop.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action drop.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -875,7 +875,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode reclassify index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -899,7 +899,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode jump 10 index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -923,7 +923,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295999",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4294967295999",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295999",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295999",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -945,7 +945,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark kuka index 4",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0xED3E.*allow mark.*index 4",
++ "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0[xX]ED3E.*allow mark.*index 4",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -967,7 +967,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio pipe index 4 cookie aabbccddeeff112233445566778800a1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -991,7 +991,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow foo pipe index 4",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow foo.*index 4",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow foo.*index 4",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -1013,7 +1013,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio type 70000 pipe index 4",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0x11170.*allow prio.*index 4",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]11170.*allow prio.*index 4",
+ "matchCount": "0",
+ "teardown": []
+ },
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+index 10b2d894e4362..e7e15a7336b6d 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+@@ -81,35 +81,6 @@
+ ]
+ ]
+ },
+- {
+- "id": "ba4e",
+- "name": "Add tunnel_key set action with missing mandatory id parameter",
+- "category": [
+- "actions",
+- "tunnel_key"
+- ],
+- "setup": [
+- [
+- "$TC actions flush action tunnel_key",
+- 0,
+- 1,
+- 255
+- ]
+- ],
+- "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 20.20.20.2",
+- "expExitCode": "255",
+- "verifyCmd": "$TC actions list action tunnel_key",
+- "matchPattern": "action order [0-9]+: tunnel_key set.*src_ip 10.10.10.1.*dst_ip 20.20.20.2",
+- "matchCount": "0",
+- "teardown": [
+- [
+- "$TC actions flush action tunnel_key",
+- 0,
+- 1,
+- 255
+- ]
+- ]
+- },
+ {
+ "id": "a5e0",
+ "name": "Add tunnel_key set action with invalid src_ip parameter",
+@@ -634,7 +605,7 @@
+ "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 10.10.10.2 id 7 index 4 cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action tunnel_key index 4",
+- "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*dst_port 0.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
++ "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action tunnel_key"
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-03-05 18:04 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-03-05 18:04 UTC (permalink / raw
To: gentoo-commits
commit: 1c2d1d001806abcc25bb83dbda4fa5d162151cb4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 5 18:04:25 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Mar 5 18:04:25 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=1c2d1d00
proj/linux-patches: Linux patch 4.19.27
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1026_linux-4.19.27.patch | 2653 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2657 insertions(+)
diff --git a/0000_README b/0000_README
index fa1c672..46efd24 100644
--- a/0000_README
+++ b/0000_README
@@ -147,6 +147,10 @@ Patch: 1025_linux-4.19.26.patch
From: http://www.kernel.org
Desc: Linux 4.19.26
+Patch: 1026_linux-4.19.27.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.27
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1026_linux-4.19.27.patch b/1026_linux-4.19.27.patch
new file mode 100644
index 0000000..541d47b
--- /dev/null
+++ b/1026_linux-4.19.27.patch
@@ -0,0 +1,2653 @@
+diff --git a/Makefile b/Makefile
+index b71076cecba9c..70ed9a53558a5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 26
++SUBLEVEL = 27
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index 8da87feec59aa..99e6d8948f4ac 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -340,7 +340,7 @@ static inline __attribute__ ((const)) int __fls(unsigned long x)
+ /*
+ * __ffs: Similar to ffs, but zero based (0-31)
+ */
+-static inline __attribute__ ((const)) int __ffs(unsigned long word)
++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long word)
+ {
+ if (!word)
+ return word;
+@@ -400,9 +400,9 @@ static inline __attribute__ ((const)) int ffs(unsigned long x)
+ /*
+ * __ffs: Similar to ffs, but zero based (0-31)
+ */
+-static inline __attribute__ ((const)) int __ffs(unsigned long x)
++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long x)
+ {
+- int n;
++ unsigned long n;
+
+ asm volatile(
+ " ffs.f %0, %1 \n" /* 0:31; 31(Z) if src 0 */
+diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
+index e8d9fb4523462..5c6663321e873 100644
+--- a/arch/arc/kernel/troubleshoot.c
++++ b/arch/arc/kernel/troubleshoot.c
+@@ -18,6 +18,8 @@
+ #include <asm/arcregs.h>
+ #include <asm/irqflags.h>
+
++#define ARC_PATH_MAX 256
++
+ /*
+ * Common routine to print scratch regs (r0-r12) or callee regs (r13-r25)
+ * -Prints 3 regs per line and a CR.
+@@ -58,11 +60,12 @@ static void show_callee_regs(struct callee_regs *cregs)
+ print_reg_file(&(cregs->r13), 13);
+ }
+
+-static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
++static void print_task_path_n_nm(struct task_struct *tsk)
+ {
+ char *path_nm = NULL;
+ struct mm_struct *mm;
+ struct file *exe_file;
++ char buf[ARC_PATH_MAX];
+
+ mm = get_task_mm(tsk);
+ if (!mm)
+@@ -72,7 +75,7 @@ static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
+ mmput(mm);
+
+ if (exe_file) {
+- path_nm = file_path(exe_file, buf, 255);
++ path_nm = file_path(exe_file, buf, ARC_PATH_MAX-1);
+ fput(exe_file);
+ }
+
+@@ -80,10 +83,9 @@ done:
+ pr_info("Path: %s\n", !IS_ERR(path_nm) ? path_nm : "?");
+ }
+
+-static void show_faulting_vma(unsigned long address, char *buf)
++static void show_faulting_vma(unsigned long address)
+ {
+ struct vm_area_struct *vma;
+- char *nm = buf;
+ struct mm_struct *active_mm = current->active_mm;
+
+ /* can't use print_vma_addr() yet as it doesn't check for
+@@ -96,8 +98,11 @@ static void show_faulting_vma(unsigned long address, char *buf)
+ * if the container VMA is not found
+ */
+ if (vma && (vma->vm_start <= address)) {
++ char buf[ARC_PATH_MAX];
++ char *nm = "?";
++
+ if (vma->vm_file) {
+- nm = file_path(vma->vm_file, buf, PAGE_SIZE - 1);
++ nm = file_path(vma->vm_file, buf, ARC_PATH_MAX-1);
+ if (IS_ERR(nm))
+ nm = "?";
+ }
+@@ -173,13 +178,8 @@ void show_regs(struct pt_regs *regs)
+ {
+ struct task_struct *tsk = current;
+ struct callee_regs *cregs;
+- char *buf;
+
+- buf = (char *)__get_free_page(GFP_KERNEL);
+- if (!buf)
+- return;
+-
+- print_task_path_n_nm(tsk, buf);
++ print_task_path_n_nm(tsk);
+ show_regs_print_info(KERN_INFO);
+
+ show_ecr_verbose(regs);
+@@ -189,7 +189,7 @@ void show_regs(struct pt_regs *regs)
+ (void *)regs->blink, (void *)regs->ret);
+
+ if (user_mode(regs))
+- show_faulting_vma(regs->ret, buf); /* faulting code, not data */
++ show_faulting_vma(regs->ret); /* faulting code, not data */
+
+ pr_info("[STAT32]: 0x%08lx", regs->status32);
+
+@@ -221,8 +221,6 @@ void show_regs(struct pt_regs *regs)
+ cregs = (struct callee_regs *)current->thread.callee_reg;
+ if (cregs)
+ show_callee_regs(cregs);
+-
+- free_page((unsigned long)buf);
+ }
+
+ void show_kernel_fault_diag(const char *str, struct pt_regs *regs,
+diff --git a/arch/mips/bcm63xx/dev-enet.c b/arch/mips/bcm63xx/dev-enet.c
+index 07b4c65a88a43..8e73d65f34806 100644
+--- a/arch/mips/bcm63xx/dev-enet.c
++++ b/arch/mips/bcm63xx/dev-enet.c
+@@ -70,6 +70,8 @@ static struct platform_device bcm63xx_enet_shared_device = {
+
+ static int shared_device_registered;
+
++static u64 enet_dmamask = DMA_BIT_MASK(32);
++
+ static struct resource enet0_res[] = {
+ {
+ .start = -1, /* filled at runtime */
+@@ -99,6 +101,8 @@ static struct platform_device bcm63xx_enet0_device = {
+ .resource = enet0_res,
+ .dev = {
+ .platform_data = &enet0_pd,
++ .dma_mask = &enet_dmamask,
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
+@@ -131,6 +135,8 @@ static struct platform_device bcm63xx_enet1_device = {
+ .resource = enet1_res,
+ .dev = {
+ .platform_data = &enet1_pd,
++ .dma_mask = &enet_dmamask,
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
+@@ -157,6 +163,8 @@ static struct platform_device bcm63xx_enetsw_device = {
+ .resource = enetsw_res,
+ .dev = {
+ .platform_data = &enetsw_pd,
++ .dma_mask = &enet_dmamask,
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
+diff --git a/arch/mips/kernel/cmpxchg.c b/arch/mips/kernel/cmpxchg.c
+index 0b9535bc2c53d..6b2a4a902a981 100644
+--- a/arch/mips/kernel/cmpxchg.c
++++ b/arch/mips/kernel/cmpxchg.c
+@@ -54,10 +54,9 @@ unsigned long __xchg_small(volatile void *ptr, unsigned long val, unsigned int s
+ unsigned long __cmpxchg_small(volatile void *ptr, unsigned long old,
+ unsigned long new, unsigned int size)
+ {
+- u32 mask, old32, new32, load32;
++ u32 mask, old32, new32, load32, load;
+ volatile u32 *ptr32;
+ unsigned int shift;
+- u8 load;
+
+ /* Check that ptr is naturally aligned */
+ WARN_ON((unsigned long)ptr & (size - 1));
+diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
+index 252c00985c973..9bda82ed75eb7 100644
+--- a/arch/mips/net/ebpf_jit.c
++++ b/arch/mips/net/ebpf_jit.c
+@@ -1818,7 +1818,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+
+ /* Update the icache */
+ flush_icache_range((unsigned long)ctx.target,
+- (unsigned long)(ctx.target + ctx.idx * sizeof(u32)));
++ (unsigned long)&ctx.target[ctx.idx]);
+
+ if (bpf_jit_enable > 1)
+ /* Dump JIT code */
+diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
+index aae77eb8491c0..4111edb3188e2 100644
+--- a/arch/x86/include/asm/uaccess.h
++++ b/arch/x86/include/asm/uaccess.h
+@@ -293,8 +293,7 @@ do { \
+ __put_user_asm(x, ptr, retval, "l", "k", "ir", errret); \
+ break; \
+ case 8: \
+- __put_user_asm_u64((__typeof__(*ptr))(x), ptr, retval, \
+- errret); \
++ __put_user_asm_u64(x, ptr, retval, errret); \
+ break; \
+ default: \
+ __put_user_bad(); \
+@@ -440,8 +439,10 @@ do { \
+ #define __put_user_nocheck(x, ptr, size) \
+ ({ \
+ int __pu_err; \
++ __typeof__(*(ptr)) __pu_val; \
++ __pu_val = x; \
+ __uaccess_begin(); \
+- __put_user_size((x), (ptr), (size), __pu_err, -EFAULT); \
++ __put_user_size(__pu_val, (ptr), (size), __pu_err, -EFAULT);\
+ __uaccess_end(); \
+ __builtin_expect(__pu_err, 0); \
+ })
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index 7654febd51027..652e7ffa9b9de 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -313,14 +313,13 @@ assign_managed_vector(struct irq_data *irqd, const struct cpumask *dest)
+ struct apic_chip_data *apicd = apic_chip_data(irqd);
+ int vector, cpu;
+
+- cpumask_and(vector_searchmask, vector_searchmask, affmsk);
+- cpu = cpumask_first(vector_searchmask);
+- if (cpu >= nr_cpu_ids)
+- return -EINVAL;
++ cpumask_and(vector_searchmask, dest, affmsk);
++
+ /* set_affinity might call here for nothing */
+ if (apicd->vector && cpumask_test_cpu(apicd->cpu, vector_searchmask))
+ return 0;
+- vector = irq_matrix_alloc_managed(vector_matrix, cpu);
++ vector = irq_matrix_alloc_managed(vector_matrix, vector_searchmask,
++ &cpu);
+ trace_vector_alloc_managed(irqd->irq, vector, vector);
+ if (vector < 0)
+ return vector;
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index ee8f8d70b98a2..b475419620121 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3399,6 +3399,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
+ kvm_mmu_reset_context(&svm->vcpu);
+ kvm_mmu_load(&svm->vcpu);
+
++ /*
++ * Drop what we picked up for L2 via svm_complete_interrupts() so it
++ * doesn't end up in L1.
++ */
++ svm->vcpu.arch.nmi_injected = false;
++ kvm_clear_exception_queue(&svm->vcpu);
++ kvm_clear_interrupt_queue(&svm->vcpu);
++
+ return 0;
+ }
+
+@@ -4485,25 +4493,14 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
+ kvm_lapic_reg_write(apic, APIC_ICR, icrl);
+ break;
+ case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
+- int i;
+- struct kvm_vcpu *vcpu;
+- struct kvm *kvm = svm->vcpu.kvm;
+ struct kvm_lapic *apic = svm->vcpu.arch.apic;
+
+ /*
+- * At this point, we expect that the AVIC HW has already
+- * set the appropriate IRR bits on the valid target
+- * vcpus. So, we just need to kick the appropriate vcpu.
++ * Update ICR high and low, then emulate sending IPI,
++ * which is handled when writing APIC_ICR.
+ */
+- kvm_for_each_vcpu(i, vcpu, kvm) {
+- bool m = kvm_apic_match_dest(vcpu, apic,
+- icrl & KVM_APIC_SHORT_MASK,
+- GET_APIC_DEST_FIELD(icrh),
+- icrl & KVM_APIC_DEST_MASK);
+-
+- if (m && !avic_vcpu_is_running(vcpu))
+- kvm_vcpu_wake_up(vcpu);
+- }
++ kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
++ kvm_lapic_reg_write(apic, APIC_ICR, icrl);
+ break;
+ }
+ case AVIC_IPI_FAILURE_INVALID_TARGET:
+diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
+index 7ae36868aed25..c9faf34cbb62e 100644
+--- a/arch/x86/mm/mem_encrypt_identity.c
++++ b/arch/x86/mm/mem_encrypt_identity.c
+@@ -157,8 +157,8 @@ static void __init sme_populate_pgd(struct sme_populate_pgd_data *ppd)
+ pmd = pmd_offset(pud, ppd->vaddr);
+ if (pmd_none(*pmd)) {
+ pte = ppd->pgtable_area;
+- memset(pte, 0, sizeof(pte) * PTRS_PER_PTE);
+- ppd->pgtable_area += sizeof(pte) * PTRS_PER_PTE;
++ memset(pte, 0, sizeof(*pte) * PTRS_PER_PTE);
++ ppd->pgtable_area += sizeof(*pte) * PTRS_PER_PTE;
+ set_pmd(pmd, __pmd(PMD_FLAGS | __pa(pte)));
+ }
+
+diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
+index decffb3826ece..a738af893532f 100644
+--- a/drivers/clk/clk-versaclock5.c
++++ b/drivers/clk/clk-versaclock5.c
+@@ -262,8 +262,10 @@ static int vc5_mux_set_parent(struct clk_hw *hw, u8 index)
+
+ if (vc5->clk_mux_ins == VC5_MUX_IN_XIN)
+ src = VC5_PRIM_SRC_SHDN_EN_XTAL;
+- if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
++ else if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
+ src = VC5_PRIM_SRC_SHDN_EN_CLKIN;
++ else /* Invalid; should have been caught by vc5_probe() */
++ return -EINVAL;
+ }
+
+ return regmap_update_bits(vc5->regmap, VC5_PRIM_SRC_SHDN, mask, src);
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index d31055ae6ec6f..5413ffaf02e23 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -2687,7 +2687,7 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level)
+ seq_printf(s, "\"protect_count\": %d,", c->protect_count);
+ seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c));
+ seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c));
+- seq_printf(s, "\"phase\": %d", clk_core_get_phase(c));
++ seq_printf(s, "\"phase\": %d,", clk_core_get_phase(c));
+ seq_printf(s, "\"duty_cycle\": %u",
+ clk_core_get_scaled_duty_cycle(c, 100000));
+ }
+diff --git a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
+index 269d3595758be..edc31bb56674a 100644
+--- a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
++++ b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
+@@ -133,9 +133,11 @@ static int tegra124_dfll_fcpu_remove(struct platform_device *pdev)
+ struct tegra_dfll_soc_data *soc;
+
+ soc = tegra_dfll_unregister(pdev);
+- if (IS_ERR(soc))
++ if (IS_ERR(soc)) {
+ dev_err(&pdev->dev, "failed to unregister DFLL: %ld\n",
+ PTR_ERR(soc));
++ return PTR_ERR(soc);
++ }
+
+ tegra_cvb_remove_opp_table(soc->dev, soc->cvb, soc->max_freq);
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
+index 16b1a9cf6cf08..743d3c983082d 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
+@@ -32,6 +32,7 @@
+ #include "vega10_pptable.h"
+
+ #define NUM_DSPCLK_LEVELS 8
++#define VEGA10_ENGINECLOCK_HARDMAX 198000
+
+ static void set_hw_cap(struct pp_hwmgr *hwmgr, bool enable,
+ enum phm_platform_caps cap)
+@@ -258,7 +259,26 @@ static int init_over_drive_limits(
+ struct pp_hwmgr *hwmgr,
+ const ATOM_Vega10_POWERPLAYTABLE *powerplay_table)
+ {
+- hwmgr->platform_descriptor.overdriveLimit.engineClock =
++ const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table =
++ (const ATOM_Vega10_GFXCLK_Dependency_Table *)
++ (((unsigned long) powerplay_table) +
++ le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset));
++ bool is_acg_enabled = false;
++ ATOM_Vega10_GFXCLK_Dependency_Record_V2 *patom_record_v2;
++
++ if (gfxclk_dep_table->ucRevId == 1) {
++ patom_record_v2 =
++ (ATOM_Vega10_GFXCLK_Dependency_Record_V2 *)gfxclk_dep_table->entries;
++ is_acg_enabled =
++ (bool)patom_record_v2[gfxclk_dep_table->ucNumEntries-1].ucACGEnable;
++ }
++
++ if (powerplay_table->ulMaxODEngineClock > VEGA10_ENGINECLOCK_HARDMAX &&
++ !is_acg_enabled)
++ hwmgr->platform_descriptor.overdriveLimit.engineClock =
++ VEGA10_ENGINECLOCK_HARDMAX;
++ else
++ hwmgr->platform_descriptor.overdriveLimit.engineClock =
+ le32_to_cpu(powerplay_table->ulMaxODEngineClock);
+ hwmgr->platform_descriptor.overdriveLimit.memoryClock =
+ le32_to_cpu(powerplay_table->ulMaxODMemoryClock);
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index 23397c08be11c..1d74aed7e471f 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -1564,6 +1564,15 @@ int drm_atomic_helper_async_check(struct drm_device *dev,
+ old_plane_state->crtc != new_plane_state->crtc)
+ return -EINVAL;
+
++ /*
++ * FIXME: Since prepare_fb and cleanup_fb are always called on
++ * the new_plane_state for async updates we need to block framebuffer
++ * changes. This prevents use of a fb that's been cleaned up and
++ * double cleanups from occuring.
++ */
++ if (old_plane_state->fb != new_plane_state->fb)
++ return -EINVAL;
++
+ funcs = plane->helper_private;
+ if (!funcs->atomic_async_update)
+ return -EINVAL;
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+index bbb8126ec5c57..9acb9dfaf57e6 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+@@ -896,7 +896,7 @@ static u32 a6xx_gmu_get_arc_level(struct device *dev, unsigned long freq)
+ np = dev_pm_opp_get_of_node(opp);
+
+ if (np) {
+- of_property_read_u32(np, "qcom,level", &val);
++ of_property_read_u32(np, "opp-level", &val);
+ of_node_put(np);
+ }
+
+diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
+index f7a0edea4705b..d4cc5ceb22d01 100644
+--- a/drivers/gpu/drm/msm/msm_rd.c
++++ b/drivers/gpu/drm/msm/msm_rd.c
+@@ -115,7 +115,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)
+ char *fptr = &fifo->buf[fifo->head];
+ int n;
+
+- wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0);
++ wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open);
++ if (!rd->open)
++ return;
+
+ /* Note that smp_load_acquire() is not strictly required
+ * as CIRC_SPACE_TO_END() does not access the tail more
+@@ -213,7 +215,10 @@ out:
+ static int rd_release(struct inode *inode, struct file *file)
+ {
+ struct msm_rd_state *rd = inode->i_private;
++
+ rd->open = false;
++ wake_up_all(&rd->fifo_event);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+index 061d2e0d9011e..416da53767018 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+@@ -92,6 +92,8 @@ static void sun4i_hdmi_disable(struct drm_encoder *encoder)
+ val = readl(hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
+ val &= ~SUN4I_HDMI_VID_CTRL_ENABLE;
+ writel(val, hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
++
++ clk_disable_unprepare(hdmi->tmds_clk);
+ }
+
+ static void sun4i_hdmi_enable(struct drm_encoder *encoder)
+@@ -102,6 +104,8 @@ static void sun4i_hdmi_enable(struct drm_encoder *encoder)
+
+ DRM_DEBUG_DRIVER("Enabling the HDMI Output\n");
+
++ clk_prepare_enable(hdmi->tmds_clk);
++
+ sun4i_hdmi_setup_avi_infoframes(hdmi, mode);
+ val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI);
+ val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END);
+diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c
+index ad70e7c416e30..fbfa7ff6deb16 100644
+--- a/drivers/irqchip/irq-gic-v3-mbi.c
++++ b/drivers/irqchip/irq-gic-v3-mbi.c
+@@ -24,7 +24,7 @@ struct mbi_range {
+ unsigned long *bm;
+ };
+
+-static struct mutex mbi_lock;
++static DEFINE_MUTEX(mbi_lock);
+ static phys_addr_t mbi_phys_base;
+ static struct mbi_range *mbi_ranges;
+ static unsigned int mbi_range_nr;
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 50a5c340307b8..d4f9bfbaf0232 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -95,7 +95,7 @@ static void mmc_should_fail_request(struct mmc_host *host,
+ if (!data)
+ return;
+
+- if (cmd->error || data->error ||
++ if ((cmd && cmd->error) || data->error ||
+ !should_fail(&host->fail_mmc_request, data->blksz * data->blocks))
+ return;
+
+diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
+index 159270e947cf6..a8af682a91821 100644
+--- a/drivers/mmc/host/cqhci.c
++++ b/drivers/mmc/host/cqhci.c
+@@ -201,7 +201,7 @@ static int cqhci_host_alloc_tdl(struct cqhci_host *cq_host)
+ cq_host->desc_size = cq_host->slot_sz * cq_host->num_slots;
+
+ cq_host->data_size = cq_host->trans_desc_len * cq_host->mmc->max_segs *
+- (cq_host->num_slots - 1);
++ cq_host->mmc->cqe_qdepth;
+
+ pr_debug("%s: cqhci: desc_size: %zu data_sz: %zu slot-sz: %d\n",
+ mmc_hostname(cq_host->mmc), cq_host->desc_size, cq_host->data_size,
+@@ -217,12 +217,21 @@ static int cqhci_host_alloc_tdl(struct cqhci_host *cq_host)
+ cq_host->desc_size,
+ &cq_host->desc_dma_base,
+ GFP_KERNEL);
++ if (!cq_host->desc_base)
++ return -ENOMEM;
++
+ cq_host->trans_desc_base = dmam_alloc_coherent(mmc_dev(cq_host->mmc),
+ cq_host->data_size,
+ &cq_host->trans_desc_dma_base,
+ GFP_KERNEL);
+- if (!cq_host->desc_base || !cq_host->trans_desc_base)
++ if (!cq_host->trans_desc_base) {
++ dmam_free_coherent(mmc_dev(cq_host->mmc), cq_host->desc_size,
++ cq_host->desc_base,
++ cq_host->desc_dma_base);
++ cq_host->desc_base = NULL;
++ cq_host->desc_dma_base = 0;
+ return -ENOMEM;
++ }
+
+ pr_debug("%s: cqhci: desc-base: 0x%p trans-base: 0x%p\n desc_dma 0x%llx trans_dma: 0x%llx\n",
+ mmc_hostname(cq_host->mmc), cq_host->desc_base, cq_host->trans_desc_base,
+diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
+index 476e53d301283..67f6bd24a9d0c 100644
+--- a/drivers/mmc/host/mmc_spi.c
++++ b/drivers/mmc/host/mmc_spi.c
+@@ -1447,6 +1447,7 @@ static int mmc_spi_probe(struct spi_device *spi)
+ mmc->caps &= ~MMC_CAP_NEEDS_POLL;
+ mmc_gpiod_request_cd_irq(mmc);
+ }
++ mmc_detect_change(mmc, 0);
+
+ if (host->pdata && host->pdata->flags & MMC_SPI_USE_RO_GPIO) {
+ has_ro = true;
+diff --git a/drivers/mmc/host/renesas_sdhi_sys_dmac.c b/drivers/mmc/host/renesas_sdhi_sys_dmac.c
+index 5389c48218820..c3d63edb545e3 100644
+--- a/drivers/mmc/host/renesas_sdhi_sys_dmac.c
++++ b/drivers/mmc/host/renesas_sdhi_sys_dmac.c
+@@ -68,6 +68,7 @@ static const struct renesas_sdhi_of_data of_rcar_gen2_compatible = {
+ .scc_offset = 0x0300,
+ .taps = rcar_gen2_scc_taps,
+ .taps_num = ARRAY_SIZE(rcar_gen2_scc_taps),
++ .max_blk_count = 0xffffffff,
+ };
+
+ /* Definitions for sampling clocks */
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index f44e49014a440..753973dc16556 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -1097,11 +1097,12 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host)
+ writel(readl(host->ioaddr + SDHCI_HOST_CONTROL)
+ | ESDHC_BURST_LEN_EN_INCR,
+ host->ioaddr + SDHCI_HOST_CONTROL);
++
+ /*
+- * erratum ESDHC_FLAG_ERR004536 fix for MX6Q TO1.2 and MX6DL
+- * TO1.1, it's harmless for MX6SL
+- */
+- writel(readl(host->ioaddr + 0x6c) | BIT(7),
++ * erratum ESDHC_FLAG_ERR004536 fix for MX6Q TO1.2 and MX6DL
++ * TO1.1, it's harmless for MX6SL
++ */
++ writel(readl(host->ioaddr + 0x6c) & ~BIT(7),
+ host->ioaddr + 0x6c);
+
+ /* disable DLL_CTRL delay line settings */
+diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h
+index 5d141f79e175b..7c40a7e1fea1c 100644
+--- a/drivers/mmc/host/tmio_mmc.h
++++ b/drivers/mmc/host/tmio_mmc.h
+@@ -279,6 +279,11 @@ static inline void sd_ctrl_write32_as_16_and_16(struct tmio_mmc_host *host,
+ iowrite16(val >> 16, host->ctl + ((addr + 2) << host->bus_shift));
+ }
+
++static inline void sd_ctrl_write32(struct tmio_mmc_host *host, int addr, u32 val)
++{
++ iowrite32(val, host->ctl + (addr << host->bus_shift));
++}
++
+ static inline void sd_ctrl_write32_rep(struct tmio_mmc_host *host, int addr,
+ const u32 *buf, int count)
+ {
+diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
+index 261b4d62d2b10..7d13ca9ea5347 100644
+--- a/drivers/mmc/host/tmio_mmc_core.c
++++ b/drivers/mmc/host/tmio_mmc_core.c
+@@ -46,6 +46,7 @@
+ #include <linux/regulator/consumer.h>
+ #include <linux/mmc/sdio.h>
+ #include <linux/scatterlist.h>
++#include <linux/sizes.h>
+ #include <linux/spinlock.h>
+ #include <linux/swiotlb.h>
+ #include <linux/workqueue.h>
+@@ -703,7 +704,7 @@ static bool __tmio_mmc_sdcard_irq(struct tmio_mmc_host *host, int ireg,
+ return false;
+ }
+
+-static void __tmio_mmc_sdio_irq(struct tmio_mmc_host *host)
++static bool __tmio_mmc_sdio_irq(struct tmio_mmc_host *host)
+ {
+ struct mmc_host *mmc = host->mmc;
+ struct tmio_mmc_data *pdata = host->pdata;
+@@ -711,7 +712,7 @@ static void __tmio_mmc_sdio_irq(struct tmio_mmc_host *host)
+ unsigned int sdio_status;
+
+ if (!(pdata->flags & TMIO_MMC_SDIO_IRQ))
+- return;
++ return false;
+
+ status = sd_ctrl_read16(host, CTL_SDIO_STATUS);
+ ireg = status & TMIO_SDIO_MASK_ALL & ~host->sdio_irq_mask;
+@@ -724,6 +725,8 @@ static void __tmio_mmc_sdio_irq(struct tmio_mmc_host *host)
+
+ if (mmc->caps & MMC_CAP_SDIO_IRQ && ireg & TMIO_SDIO_STAT_IOIRQ)
+ mmc_signal_sdio_irq(mmc);
++
++ return ireg;
+ }
+
+ irqreturn_t tmio_mmc_irq(int irq, void *devid)
+@@ -742,9 +745,10 @@ irqreturn_t tmio_mmc_irq(int irq, void *devid)
+ if (__tmio_mmc_sdcard_irq(host, ireg, status))
+ return IRQ_HANDLED;
+
+- __tmio_mmc_sdio_irq(host);
++ if (__tmio_mmc_sdio_irq(host))
++ return IRQ_HANDLED;
+
+- return IRQ_HANDLED;
++ return IRQ_NONE;
+ }
+ EXPORT_SYMBOL_GPL(tmio_mmc_irq);
+
+@@ -774,7 +778,10 @@ static int tmio_mmc_start_data(struct tmio_mmc_host *host,
+
+ /* Set transfer length / blocksize */
+ sd_ctrl_write16(host, CTL_SD_XFER_LEN, data->blksz);
+- sd_ctrl_write16(host, CTL_XFER_BLK_COUNT, data->blocks);
++ if (host->mmc->max_blk_count >= SZ_64K)
++ sd_ctrl_write32(host, CTL_XFER_BLK_COUNT, data->blocks);
++ else
++ sd_ctrl_write16(host, CTL_XFER_BLK_COUNT, data->blocks);
+
+ tmio_mmc_start_dma(host, data);
+
+diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
+index baca8f704a459..c3c1195021a2b 100644
+--- a/drivers/net/ethernet/altera/altera_tse_main.c
++++ b/drivers/net/ethernet/altera/altera_tse_main.c
+@@ -714,8 +714,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev)
+
+ phydev = phy_connect(dev, phy_id_fmt, &altera_tse_adjust_link,
+ priv->phy_iface);
+- if (IS_ERR(phydev))
++ if (IS_ERR(phydev)) {
+ netdev_err(dev, "Could not attach to PHY\n");
++ phydev = NULL;
++ }
+
+ } else {
+ int ret;
+diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
+index 91f48c0780734..f70cb4d3c6846 100644
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -1314,7 +1314,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
+ unsigned long lpar_rc;
+ u16 mss = 0;
+
+-restart_poll:
+ while (frames_processed < budget) {
+ if (!ibmveth_rxq_pending_buffer(adapter))
+ break;
+@@ -1402,7 +1401,6 @@ restart_poll:
+ napi_reschedule(napi)) {
+ lpar_rc = h_vio_signal(adapter->vdev->unit_address,
+ VIO_IRQ_DISABLE);
+- goto restart_poll;
+ }
+ }
+
+diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
+index a32ded5b4f416..42d284669b03a 100644
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -144,6 +144,8 @@ struct hv_netvsc_packet {
+ u32 total_data_buflen;
+ };
+
++#define NETVSC_HASH_KEYLEN 40
++
+ struct netvsc_device_info {
+ unsigned char mac_adr[ETH_ALEN];
+ u32 num_chn;
+@@ -151,6 +153,8 @@ struct netvsc_device_info {
+ u32 recv_sections;
+ u32 send_section_size;
+ u32 recv_section_size;
++
++ u8 rss_key[NETVSC_HASH_KEYLEN];
+ };
+
+ enum rndis_device_state {
+@@ -160,8 +164,6 @@ enum rndis_device_state {
+ RNDIS_DEV_DATAINITIALIZED,
+ };
+
+-#define NETVSC_HASH_KEYLEN 40
+-
+ struct rndis_device {
+ struct net_device *ndev;
+
+@@ -210,7 +212,9 @@ int netvsc_recv_callback(struct net_device *net,
+ void netvsc_channel_cb(void *context);
+ int netvsc_poll(struct napi_struct *napi, int budget);
+
+-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev);
++int rndis_set_subchannel(struct net_device *ndev,
++ struct netvsc_device *nvdev,
++ struct netvsc_device_info *dev_info);
+ int rndis_filter_open(struct netvsc_device *nvdev);
+ int rndis_filter_close(struct netvsc_device *nvdev);
+ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index fe01e141c8f87..1a942feab9548 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -84,7 +84,7 @@ static void netvsc_subchan_work(struct work_struct *w)
+
+ rdev = nvdev->extension;
+ if (rdev) {
+- ret = rndis_set_subchannel(rdev->ndev, nvdev);
++ ret = rndis_set_subchannel(rdev->ndev, nvdev, NULL);
+ if (ret == 0) {
+ netif_device_attach(rdev->ndev);
+ } else {
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 1c37a821895b7..c9e2a986ccb72 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -856,6 +856,39 @@ static void netvsc_get_channels(struct net_device *net,
+ }
+ }
+
++/* Alloc struct netvsc_device_info, and initialize it from either existing
++ * struct netvsc_device, or from default values.
++ */
++static struct netvsc_device_info *netvsc_devinfo_get
++ (struct netvsc_device *nvdev)
++{
++ struct netvsc_device_info *dev_info;
++
++ dev_info = kzalloc(sizeof(*dev_info), GFP_ATOMIC);
++
++ if (!dev_info)
++ return NULL;
++
++ if (nvdev) {
++ dev_info->num_chn = nvdev->num_chn;
++ dev_info->send_sections = nvdev->send_section_cnt;
++ dev_info->send_section_size = nvdev->send_section_size;
++ dev_info->recv_sections = nvdev->recv_section_cnt;
++ dev_info->recv_section_size = nvdev->recv_section_size;
++
++ memcpy(dev_info->rss_key, nvdev->extension->rss_key,
++ NETVSC_HASH_KEYLEN);
++ } else {
++ dev_info->num_chn = VRSS_CHANNEL_DEFAULT;
++ dev_info->send_sections = NETVSC_DEFAULT_TX;
++ dev_info->send_section_size = NETVSC_SEND_SECTION_SIZE;
++ dev_info->recv_sections = NETVSC_DEFAULT_RX;
++ dev_info->recv_section_size = NETVSC_RECV_SECTION_SIZE;
++ }
++
++ return dev_info;
++}
++
+ static int netvsc_detach(struct net_device *ndev,
+ struct netvsc_device *nvdev)
+ {
+@@ -907,7 +940,7 @@ static int netvsc_attach(struct net_device *ndev,
+ return PTR_ERR(nvdev);
+
+ if (nvdev->num_chn > 1) {
+- ret = rndis_set_subchannel(ndev, nvdev);
++ ret = rndis_set_subchannel(ndev, nvdev, dev_info);
+
+ /* if unavailable, just proceed with one queue */
+ if (ret) {
+@@ -941,7 +974,7 @@ static int netvsc_set_channels(struct net_device *net,
+ struct net_device_context *net_device_ctx = netdev_priv(net);
+ struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
+ unsigned int orig, count = channels->combined_count;
+- struct netvsc_device_info device_info;
++ struct netvsc_device_info *device_info;
+ int ret;
+
+ /* We do not support separate count for rx, tx, or other */
+@@ -960,24 +993,26 @@ static int netvsc_set_channels(struct net_device *net,
+
+ orig = nvdev->num_chn;
+
+- memset(&device_info, 0, sizeof(device_info));
+- device_info.num_chn = count;
+- device_info.send_sections = nvdev->send_section_cnt;
+- device_info.send_section_size = nvdev->send_section_size;
+- device_info.recv_sections = nvdev->recv_section_cnt;
+- device_info.recv_section_size = nvdev->recv_section_size;
++ device_info = netvsc_devinfo_get(nvdev);
++
++ if (!device_info)
++ return -ENOMEM;
++
++ device_info->num_chn = count;
+
+ ret = netvsc_detach(net, nvdev);
+ if (ret)
+- return ret;
++ goto out;
+
+- ret = netvsc_attach(net, &device_info);
++ ret = netvsc_attach(net, device_info);
+ if (ret) {
+- device_info.num_chn = orig;
+- if (netvsc_attach(net, &device_info))
++ device_info->num_chn = orig;
++ if (netvsc_attach(net, device_info))
+ netdev_err(net, "restoring channel setting failed\n");
+ }
+
++out:
++ kfree(device_info);
+ return ret;
+ }
+
+@@ -1044,48 +1079,45 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
+ struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev);
+ struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
+ int orig_mtu = ndev->mtu;
+- struct netvsc_device_info device_info;
++ struct netvsc_device_info *device_info;
+ int ret = 0;
+
+ if (!nvdev || nvdev->destroy)
+ return -ENODEV;
+
++ device_info = netvsc_devinfo_get(nvdev);
++
++ if (!device_info)
++ return -ENOMEM;
++
+ /* Change MTU of underlying VF netdev first. */
+ if (vf_netdev) {
+ ret = dev_set_mtu(vf_netdev, mtu);
+ if (ret)
+- return ret;
++ goto out;
+ }
+
+- memset(&device_info, 0, sizeof(device_info));
+- device_info.num_chn = nvdev->num_chn;
+- device_info.send_sections = nvdev->send_section_cnt;
+- device_info.send_section_size = nvdev->send_section_size;
+- device_info.recv_sections = nvdev->recv_section_cnt;
+- device_info.recv_section_size = nvdev->recv_section_size;
+-
+ ret = netvsc_detach(ndev, nvdev);
+ if (ret)
+ goto rollback_vf;
+
+ ndev->mtu = mtu;
+
+- ret = netvsc_attach(ndev, &device_info);
+- if (ret)
+- goto rollback;
+-
+- return 0;
++ ret = netvsc_attach(ndev, device_info);
++ if (!ret)
++ goto out;
+
+-rollback:
+ /* Attempt rollback to original MTU */
+ ndev->mtu = orig_mtu;
+
+- if (netvsc_attach(ndev, &device_info))
++ if (netvsc_attach(ndev, device_info))
+ netdev_err(ndev, "restoring mtu failed\n");
+ rollback_vf:
+ if (vf_netdev)
+ dev_set_mtu(vf_netdev, orig_mtu);
+
++out:
++ kfree(device_info);
+ return ret;
+ }
+
+@@ -1690,7 +1722,7 @@ static int netvsc_set_ringparam(struct net_device *ndev,
+ {
+ struct net_device_context *ndevctx = netdev_priv(ndev);
+ struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
+- struct netvsc_device_info device_info;
++ struct netvsc_device_info *device_info;
+ struct ethtool_ringparam orig;
+ u32 new_tx, new_rx;
+ int ret = 0;
+@@ -1710,26 +1742,29 @@ static int netvsc_set_ringparam(struct net_device *ndev,
+ new_rx == orig.rx_pending)
+ return 0; /* no change */
+
+- memset(&device_info, 0, sizeof(device_info));
+- device_info.num_chn = nvdev->num_chn;
+- device_info.send_sections = new_tx;
+- device_info.send_section_size = nvdev->send_section_size;
+- device_info.recv_sections = new_rx;
+- device_info.recv_section_size = nvdev->recv_section_size;
++ device_info = netvsc_devinfo_get(nvdev);
++
++ if (!device_info)
++ return -ENOMEM;
++
++ device_info->send_sections = new_tx;
++ device_info->recv_sections = new_rx;
+
+ ret = netvsc_detach(ndev, nvdev);
+ if (ret)
+- return ret;
++ goto out;
+
+- ret = netvsc_attach(ndev, &device_info);
++ ret = netvsc_attach(ndev, device_info);
+ if (ret) {
+- device_info.send_sections = orig.tx_pending;
+- device_info.recv_sections = orig.rx_pending;
++ device_info->send_sections = orig.tx_pending;
++ device_info->recv_sections = orig.rx_pending;
+
+- if (netvsc_attach(ndev, &device_info))
++ if (netvsc_attach(ndev, device_info))
+ netdev_err(ndev, "restoring ringparam failed");
+ }
+
++out:
++ kfree(device_info);
+ return ret;
+ }
+
+@@ -2158,7 +2193,7 @@ static int netvsc_probe(struct hv_device *dev,
+ {
+ struct net_device *net = NULL;
+ struct net_device_context *net_device_ctx;
+- struct netvsc_device_info device_info;
++ struct netvsc_device_info *device_info = NULL;
+ struct netvsc_device *nvdev;
+ int ret = -ENOMEM;
+
+@@ -2205,21 +2240,21 @@ static int netvsc_probe(struct hv_device *dev,
+ netif_set_real_num_rx_queues(net, 1);
+
+ /* Notify the netvsc driver of the new device */
+- memset(&device_info, 0, sizeof(device_info));
+- device_info.num_chn = VRSS_CHANNEL_DEFAULT;
+- device_info.send_sections = NETVSC_DEFAULT_TX;
+- device_info.send_section_size = NETVSC_SEND_SECTION_SIZE;
+- device_info.recv_sections = NETVSC_DEFAULT_RX;
+- device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE;
+-
+- nvdev = rndis_filter_device_add(dev, &device_info);
++ device_info = netvsc_devinfo_get(NULL);
++
++ if (!device_info) {
++ ret = -ENOMEM;
++ goto devinfo_failed;
++ }
++
++ nvdev = rndis_filter_device_add(dev, device_info);
+ if (IS_ERR(nvdev)) {
+ ret = PTR_ERR(nvdev);
+ netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
+ goto rndis_failed;
+ }
+
+- memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
++ memcpy(net->dev_addr, device_info->mac_adr, ETH_ALEN);
+
+ /* We must get rtnl lock before scheduling nvdev->subchan_work,
+ * otherwise netvsc_subchan_work() can get rtnl lock first and wait
+@@ -2257,12 +2292,16 @@ static int netvsc_probe(struct hv_device *dev,
+
+ list_add(&net_device_ctx->list, &netvsc_dev_list);
+ rtnl_unlock();
++
++ kfree(device_info);
+ return 0;
+
+ register_failed:
+ rtnl_unlock();
+ rndis_filter_device_remove(dev, nvdev);
+ rndis_failed:
++ kfree(device_info);
++devinfo_failed:
+ free_percpu(net_device_ctx->vf_stats);
+ no_stats:
+ hv_set_drvdata(dev, NULL);
+diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
+index 2a5209f23f296..53c6039bffb67 100644
+--- a/drivers/net/hyperv/rndis_filter.c
++++ b/drivers/net/hyperv/rndis_filter.c
+@@ -715,8 +715,8 @@ cleanup:
+ return ret;
+ }
+
+-int rndis_filter_set_rss_param(struct rndis_device *rdev,
+- const u8 *rss_key)
++static int rndis_set_rss_param_msg(struct rndis_device *rdev,
++ const u8 *rss_key, u16 flag)
+ {
+ struct net_device *ndev = rdev->ndev;
+ struct rndis_request *request;
+@@ -745,7 +745,7 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
+ rssp->hdr.type = NDIS_OBJECT_TYPE_RSS_PARAMETERS;
+ rssp->hdr.rev = NDIS_RECEIVE_SCALE_PARAMETERS_REVISION_2;
+ rssp->hdr.size = sizeof(struct ndis_recv_scale_param);
+- rssp->flag = 0;
++ rssp->flag = flag;
+ rssp->hashinfo = NDIS_HASH_FUNC_TOEPLITZ | NDIS_HASH_IPV4 |
+ NDIS_HASH_TCP_IPV4 | NDIS_HASH_IPV6 |
+ NDIS_HASH_TCP_IPV6;
+@@ -770,9 +770,12 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
+
+ wait_for_completion(&request->wait_event);
+ set_complete = &request->response_msg.msg.set_complete;
+- if (set_complete->status == RNDIS_STATUS_SUCCESS)
+- memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
+- else {
++ if (set_complete->status == RNDIS_STATUS_SUCCESS) {
++ if (!(flag & NDIS_RSS_PARAM_FLAG_DISABLE_RSS) &&
++ !(flag & NDIS_RSS_PARAM_FLAG_HASH_KEY_UNCHANGED))
++ memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
++
++ } else {
+ netdev_err(ndev, "Fail to set RSS parameters:0x%x\n",
+ set_complete->status);
+ ret = -EINVAL;
+@@ -783,6 +786,16 @@ cleanup:
+ return ret;
+ }
+
++int rndis_filter_set_rss_param(struct rndis_device *rdev,
++ const u8 *rss_key)
++{
++ /* Disable RSS before change */
++ rndis_set_rss_param_msg(rdev, rss_key,
++ NDIS_RSS_PARAM_FLAG_DISABLE_RSS);
++
++ return rndis_set_rss_param_msg(rdev, rss_key, 0);
++}
++
+ static int rndis_filter_query_device_link_status(struct rndis_device *dev,
+ struct netvsc_device *net_device)
+ {
+@@ -1062,7 +1075,9 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc)
+ * This breaks overlap of processing the host message for the
+ * new primary channel with the initialization of sub-channels.
+ */
+-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
++int rndis_set_subchannel(struct net_device *ndev,
++ struct netvsc_device *nvdev,
++ struct netvsc_device_info *dev_info)
+ {
+ struct nvsp_message *init_packet = &nvdev->channel_init_pkt;
+ struct net_device_context *ndev_ctx = netdev_priv(ndev);
+@@ -1103,7 +1118,10 @@ int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
+ atomic_read(&nvdev->open_chn) == nvdev->num_chn);
+
+ /* ignore failues from setting rss parameters, still have channels */
+- rndis_filter_set_rss_param(rdev, netvsc_hash_key);
++ if (dev_info)
++ rndis_filter_set_rss_param(rdev, dev_info->rss_key);
++ else
++ rndis_filter_set_rss_param(rdev, netvsc_hash_key);
+
+ netif_set_real_num_tx_queues(ndev, nvdev->num_chn);
+ netif_set_real_num_rx_queues(ndev, nvdev->num_chn);
+diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
+index b654f05b2ccd0..3d93993e74da0 100644
+--- a/drivers/net/usb/asix_devices.c
++++ b/drivers/net/usb/asix_devices.c
+@@ -739,8 +739,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
+ asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0);
+ chipcode &= AX_CHIPCODE_MASK;
+
+- (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
+- ax88772a_hw_reset(dev, 0);
++ ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
++ ax88772a_hw_reset(dev, 0);
++
++ if (ret < 0) {
++ netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret);
++ return ret;
++ }
+
+ /* Read PHYID register *AFTER* the PHY was reset properly */
+ phyid = asix_get_phyid(dev);
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 815509dbed846..da8f5ad30c719 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -531,8 +531,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
+ timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0);
+ ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) +
+ ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc);
+- if (!(ctrl->anacap & (1 << 6)))
+- ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
++ ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
+
+ if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) {
+ dev_err(ctrl->device,
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index b6a28de682e85..0939a4e178fb9 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -1672,18 +1672,28 @@ static enum blk_eh_timer_return
+ nvme_rdma_timeout(struct request *rq, bool reserved)
+ {
+ struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
++ struct nvme_rdma_queue *queue = req->queue;
++ struct nvme_rdma_ctrl *ctrl = queue->ctrl;
+
+- dev_warn(req->queue->ctrl->ctrl.device,
+- "I/O %d QID %d timeout, reset controller\n",
+- rq->tag, nvme_rdma_queue_idx(req->queue));
++ dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n",
++ rq->tag, nvme_rdma_queue_idx(queue));
+
+- /* queue error recovery */
+- nvme_rdma_error_recovery(req->queue->ctrl);
++ if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
++ /*
++ * Teardown immediately if controller times out while starting
++ * or we are already started error recovery. all outstanding
++ * requests are completed on shutdown, so we return BLK_EH_DONE.
++ */
++ flush_work(&ctrl->err_work);
++ nvme_rdma_teardown_io_queues(ctrl, false);
++ nvme_rdma_teardown_admin_queue(ctrl, false);
++ return BLK_EH_DONE;
++ }
+
+- /* fail with DNR on cmd timeout */
+- nvme_req(rq)->status = NVME_SC_ABORT_REQ | NVME_SC_DNR;
++ dev_warn(ctrl->ctrl.device, "starting error recovery\n");
++ nvme_rdma_error_recovery(ctrl);
+
+- return BLK_EH_DONE;
++ return BLK_EH_RESET_TIMER;
+ }
+
+ static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
+diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c
+index 6fd6e07ab345f..09a77e556eceb 100644
+--- a/drivers/phy/qualcomm/phy-ath79-usb.c
++++ b/drivers/phy/qualcomm/phy-ath79-usb.c
+@@ -31,7 +31,7 @@ static int ath79_usb_phy_power_on(struct phy *phy)
+
+ err = reset_control_deassert(priv->reset);
+ if (err && priv->no_suspend_override)
+- reset_control_assert(priv->no_suspend_override);
++ reset_control_deassert(priv->no_suspend_override);
+
+ return err;
+ }
+@@ -69,7 +69,7 @@ static int ath79_usb_phy_probe(struct platform_device *pdev)
+ if (!priv)
+ return -ENOMEM;
+
+- priv->reset = devm_reset_control_get(&pdev->dev, "usb-phy");
++ priv->reset = devm_reset_control_get(&pdev->dev, "phy");
+ if (IS_ERR(priv->reset))
+ return PTR_ERR(priv->reset);
+
+diff --git a/drivers/scsi/csiostor/csio_attr.c b/drivers/scsi/csiostor/csio_attr.c
+index 8a004036e3d72..9bd2bd8dc2be2 100644
+--- a/drivers/scsi/csiostor/csio_attr.c
++++ b/drivers/scsi/csiostor/csio_attr.c
+@@ -594,12 +594,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable)
+ }
+
+ fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING);
++ ln->fc_vport = fc_vport;
+
+ if (csio_fcoe_alloc_vnp(hw, ln))
+ goto error;
+
+ *(struct csio_lnode **)fc_vport->dd_data = ln;
+- ln->fc_vport = fc_vport;
+ if (!fc_vport->node_name)
+ fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln));
+ if (!fc_vport->port_name)
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index fadc99cb60df9..a1551ab336165 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -829,6 +829,7 @@ static struct domain_device *sas_ex_discover_end_dev(
+ rphy = sas_end_device_alloc(phy->port);
+ if (!rphy)
+ goto out_free;
++ rphy->identify.phy_identifier = phy_id;
+
+ child->rphy = rphy;
+ get_device(&rphy->dev);
+@@ -856,6 +857,7 @@ static struct domain_device *sas_ex_discover_end_dev(
+
+ child->rphy = rphy;
+ get_device(&rphy->dev);
++ rphy->identify.phy_identifier = phy_id;
+ sas_fill_in_rphy(child, rphy);
+
+ list_add_tail(&child->disco_list_node, &parent->port->disco_list);
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index 918ae18ef8a82..ca62117a2d131 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -297,7 +297,8 @@ lpfc_nvme_localport_delete(struct nvme_fc_local_port *localport)
+ lport);
+
+ /* release any threads waiting for the unreg to complete */
+- complete(&lport->lport_unreg_done);
++ if (lport->vport->localport)
++ complete(lport->lport_unreg_cmp);
+ }
+
+ /* lpfc_nvme_remoteport_delete
+@@ -2556,7 +2557,8 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
+ */
+ void
+ lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
+- struct lpfc_nvme_lport *lport)
++ struct lpfc_nvme_lport *lport,
++ struct completion *lport_unreg_cmp)
+ {
+ #if (IS_ENABLED(CONFIG_NVME_FC))
+ u32 wait_tmo;
+@@ -2568,8 +2570,7 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
+ */
+ wait_tmo = msecs_to_jiffies(LPFC_NVME_WAIT_TMO * 1000);
+ while (true) {
+- ret = wait_for_completion_timeout(&lport->lport_unreg_done,
+- wait_tmo);
++ ret = wait_for_completion_timeout(lport_unreg_cmp, wait_tmo);
+ if (unlikely(!ret)) {
+ lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_IOERR,
+ "6176 Lport %p Localport %p wait "
+@@ -2603,12 +2604,12 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
+ struct lpfc_nvme_lport *lport;
+ struct lpfc_nvme_ctrl_stat *cstat;
+ int ret;
++ DECLARE_COMPLETION_ONSTACK(lport_unreg_cmp);
+
+ if (vport->nvmei_support == 0)
+ return;
+
+ localport = vport->localport;
+- vport->localport = NULL;
+ lport = (struct lpfc_nvme_lport *)localport->private;
+ cstat = lport->cstat;
+
+@@ -2619,13 +2620,14 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
+ /* lport's rport list is clear. Unregister
+ * lport and release resources.
+ */
+- init_completion(&lport->lport_unreg_done);
++ lport->lport_unreg_cmp = &lport_unreg_cmp;
+ ret = nvme_fc_unregister_localport(localport);
+
+ /* Wait for completion. This either blocks
+ * indefinitely or succeeds
+ */
+- lpfc_nvme_lport_unreg_wait(vport, lport);
++ lpfc_nvme_lport_unreg_wait(vport, lport, &lport_unreg_cmp);
++ vport->localport = NULL;
+ kfree(cstat);
+
+ /* Regardless of the unregister upcall response, clear
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h
+index cfd4719be25c3..b234d02989942 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.h
++++ b/drivers/scsi/lpfc/lpfc_nvme.h
+@@ -50,7 +50,7 @@ struct lpfc_nvme_ctrl_stat {
+ /* Declare nvme-based local and remote port definitions. */
+ struct lpfc_nvme_lport {
+ struct lpfc_vport *vport;
+- struct completion lport_unreg_done;
++ struct completion *lport_unreg_cmp;
+ /* Add stats counters here */
+ struct lpfc_nvme_ctrl_stat *cstat;
+ atomic_t fc4NvmeLsRequests;
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index b766afe10d3d7..e2575c8ec93e8 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -1003,7 +1003,8 @@ lpfc_nvmet_targetport_delete(struct nvmet_fc_target_port *targetport)
+ struct lpfc_nvmet_tgtport *tport = targetport->private;
+
+ /* release any threads waiting for the unreg to complete */
+- complete(&tport->tport_unreg_done);
++ if (tport->phba->targetport)
++ complete(tport->tport_unreg_cmp);
+ }
+
+ static void
+@@ -1700,6 +1701,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
+ struct lpfc_nvmet_tgtport *tgtp;
+ struct lpfc_queue *wq;
+ uint32_t qidx;
++ DECLARE_COMPLETION_ONSTACK(tport_unreg_cmp);
+
+ if (phba->nvmet_support == 0)
+ return;
+@@ -1709,9 +1711,9 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
+ wq = phba->sli4_hba.nvme_wq[qidx];
+ lpfc_nvmet_wqfull_flush(phba, wq, NULL);
+ }
+- init_completion(&tgtp->tport_unreg_done);
++ tgtp->tport_unreg_cmp = &tport_unreg_cmp;
+ nvmet_fc_unregister_targetport(phba->targetport);
+- wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
++ wait_for_completion_timeout(&tport_unreg_cmp, 5);
+ lpfc_nvmet_cleanup_io_context(phba);
+ }
+ phba->targetport = NULL;
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
+index 1aaff63f1f419..0ec1082ce7ef6 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.h
++++ b/drivers/scsi/lpfc/lpfc_nvmet.h
+@@ -34,7 +34,7 @@
+ /* Used for NVME Target */
+ struct lpfc_nvmet_tgtport {
+ struct lpfc_hba *phba;
+- struct completion tport_unreg_done;
++ struct completion *tport_unreg_cmp;
+
+ /* Stats counters - lpfc_nvmet_unsol_ls_buffer */
+ atomic_t rcv_ls_req_in;
+diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
+index 99073325b0c00..45c7f829e3872 100644
+--- a/drivers/staging/android/ion/ion.c
++++ b/drivers/staging/android/ion/ion.c
+@@ -237,10 +237,10 @@ static void ion_dma_buf_detatch(struct dma_buf *dmabuf,
+ struct ion_dma_buf_attachment *a = attachment->priv;
+ struct ion_buffer *buffer = dmabuf->priv;
+
+- free_duped_table(a->table);
+ mutex_lock(&buffer->lock);
+ list_del(&a->list);
+ mutex_unlock(&buffer->lock);
++ free_duped_table(a->table);
+
+ kfree(a);
+ }
+diff --git a/drivers/staging/rtl8723bs/include/ieee80211.h b/drivers/staging/rtl8723bs/include/ieee80211.h
+index bcc8dfa8e6728..9efb4dcb9d3a8 100644
+--- a/drivers/staging/rtl8723bs/include/ieee80211.h
++++ b/drivers/staging/rtl8723bs/include/ieee80211.h
+@@ -850,18 +850,18 @@ enum ieee80211_state {
+ #define IP_FMT "%pI4"
+ #define IP_ARG(x) (x)
+
+-extern __inline int is_multicast_mac_addr(const u8 *addr)
++static inline int is_multicast_mac_addr(const u8 *addr)
+ {
+ return ((addr[0] != 0xff) && (0x01 & addr[0]));
+ }
+
+-extern __inline int is_broadcast_mac_addr(const u8 *addr)
++static inline int is_broadcast_mac_addr(const u8 *addr)
+ {
+ return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) && \
+ (addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff));
+ }
+
+-extern __inline int is_zero_mac_addr(const u8 *addr)
++static inline int is_zero_mac_addr(const u8 *addr)
+ {
+ return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) && \
+ (addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00));
+diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c
+index 284cf2c5a8fd9..8e1cf4d789be1 100644
+--- a/drivers/thermal/int340x_thermal/processor_thermal_device.c
++++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c
+@@ -84,7 +84,12 @@ static ssize_t power_limit_##index##_##suffix##_show(struct device *dev, \
+ struct pci_dev *pci_dev; \
+ struct platform_device *pdev; \
+ struct proc_thermal_device *proc_dev; \
+-\
++ \
++ if (proc_thermal_emum_mode == PROC_THERMAL_NONE) { \
++ dev_warn(dev, "Attempted to get power limit before device was initialized!\n"); \
++ return 0; \
++ } \
++ \
+ if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) { \
+ pdev = to_platform_device(dev); \
+ proc_dev = platform_get_drvdata(pdev); \
+@@ -298,11 +303,6 @@ static int proc_thermal_add(struct device *dev,
+ *priv = proc_priv;
+
+ ret = proc_thermal_read_ppcc(proc_priv);
+- if (!ret) {
+- ret = sysfs_create_group(&dev->kobj,
+- &power_limit_attribute_group);
+-
+- }
+ if (ret)
+ return ret;
+
+@@ -316,8 +316,7 @@ static int proc_thermal_add(struct device *dev,
+
+ proc_priv->int340x_zone = int340x_thermal_zone_add(adev, ops);
+ if (IS_ERR(proc_priv->int340x_zone)) {
+- ret = PTR_ERR(proc_priv->int340x_zone);
+- goto remove_group;
++ return PTR_ERR(proc_priv->int340x_zone);
+ } else
+ ret = 0;
+
+@@ -331,9 +330,6 @@ static int proc_thermal_add(struct device *dev,
+
+ remove_zone:
+ int340x_thermal_zone_remove(proc_priv->int340x_zone);
+-remove_group:
+- sysfs_remove_group(&proc_priv->dev->kobj,
+- &power_limit_attribute_group);
+
+ return ret;
+ }
+@@ -364,7 +360,10 @@ static int int3401_add(struct platform_device *pdev)
+ platform_set_drvdata(pdev, proc_priv);
+ proc_thermal_emum_mode = PROC_THERMAL_PLATFORM_DEV;
+
+- return 0;
++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PLATFORM_DEV\n");
++
++ return sysfs_create_group(&pdev->dev.kobj,
++ &power_limit_attribute_group);
+ }
+
+ static int int3401_remove(struct platform_device *pdev)
+@@ -423,7 +422,7 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev,
+ proc_priv->soc_dts = intel_soc_dts_iosf_init(
+ INTEL_SOC_DTS_INTERRUPT_MSI, 2, 0);
+
+- if (proc_priv->soc_dts && pdev->irq) {
++ if (!IS_ERR(proc_priv->soc_dts) && pdev->irq) {
+ ret = pci_enable_msi(pdev);
+ if (!ret) {
+ ret = request_threaded_irq(pdev->irq, NULL,
+@@ -441,7 +440,10 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev,
+ dev_err(&pdev->dev, "No auxiliary DTSs enabled\n");
+ }
+
+- return 0;
++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PCI\n");
++
++ return sysfs_create_group(&pdev->dev.kobj,
++ &power_limit_attribute_group);
+ }
+
+ static void proc_thermal_pci_remove(struct pci_dev *pdev)
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 7d030c2e42ffd..50b6746a8b5d7 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1695,7 +1695,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
+ }
+
+ /* ask the core to calculate the divisor */
+- baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16);
++ baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
+
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 1515074e18fb6..35d1f6fa0e3c3 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -221,7 +221,7 @@ static unsigned int qcom_geni_serial_get_mctrl(struct uart_port *uport)
+ unsigned int mctrl = TIOCM_DSR | TIOCM_CAR;
+ u32 geni_ios;
+
+- if (uart_console(uport) || !uart_cts_enabled(uport)) {
++ if (uart_console(uport)) {
+ mctrl |= TIOCM_CTS;
+ } else {
+ geni_ios = readl_relaxed(uport->membase + SE_GENI_IOS);
+@@ -237,7 +237,7 @@ static void qcom_geni_serial_set_mctrl(struct uart_port *uport,
+ {
+ u32 uart_manual_rfr = 0;
+
+- if (uart_console(uport) || !uart_cts_enabled(uport))
++ if (uart_console(uport))
+ return;
+
+ if (!(mctrl & TIOCM_RTS))
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 0db90f6f4aa81..700fb626ad03b 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1864,6 +1864,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc)
+
+ /* begin to receive SETUP packets */
+ dwc->ep0state = EP0_SETUP_PHASE;
++ dwc->link_state = DWC3_LINK_STATE_SS_DIS;
+ dwc3_ep0_out_start(dwc);
+
+ dwc3_gadget_enable_irq(dwc);
+@@ -3274,6 +3275,8 @@ int dwc3_gadget_suspend(struct dwc3 *dwc)
+ dwc3_disconnect_gadget(dwc);
+ __dwc3_gadget_stop(dwc);
+
++ synchronize_irq(dwc->irq_gadget);
++
+ return 0;
+ }
+
+diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
+index 9cdef108fb1b3..ed68a4860b7d8 100644
+--- a/drivers/usb/gadget/function/f_sourcesink.c
++++ b/drivers/usb/gadget/function/f_sourcesink.c
+@@ -838,7 +838,7 @@ static struct usb_function *source_sink_alloc_func(
+
+ ss = kzalloc(sizeof(*ss), GFP_KERNEL);
+ if (!ss)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ ss_opts = container_of(fi, struct f_ss_opts, func_inst);
+
+diff --git a/fs/direct-io.c b/fs/direct-io.c
+index 1991460360930..1abb7634b2d58 100644
+--- a/fs/direct-io.c
++++ b/fs/direct-io.c
+@@ -679,6 +679,7 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
+ unsigned long fs_count; /* Number of filesystem-sized blocks */
+ int create;
+ unsigned int i_blkbits = sdio->blkbits + sdio->blkfactor;
++ loff_t i_size;
+
+ /*
+ * If there was a memory error and we've overwritten all the
+@@ -708,8 +709,8 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
+ */
+ create = dio->op == REQ_OP_WRITE;
+ if (dio->flags & DIO_SKIP_HOLES) {
+- if (fs_startblk <= ((i_size_read(dio->inode) - 1) >>
+- i_blkbits))
++ i_size = i_size_read(dio->inode);
++ if (i_size && fs_startblk <= (i_size - 1) >> i_blkbits)
+ create = 0;
+ }
+
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 471d863958bc2..82ce6d4f7e314 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -331,11 +331,22 @@ struct inode_switch_wbs_context {
+ struct work_struct work;
+ };
+
++static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi)
++{
++ down_write(&bdi->wb_switch_rwsem);
++}
++
++static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi)
++{
++ up_write(&bdi->wb_switch_rwsem);
++}
++
+ static void inode_switch_wbs_work_fn(struct work_struct *work)
+ {
+ struct inode_switch_wbs_context *isw =
+ container_of(work, struct inode_switch_wbs_context, work);
+ struct inode *inode = isw->inode;
++ struct backing_dev_info *bdi = inode_to_bdi(inode);
+ struct address_space *mapping = inode->i_mapping;
+ struct bdi_writeback *old_wb = inode->i_wb;
+ struct bdi_writeback *new_wb = isw->new_wb;
+@@ -343,6 +354,12 @@ static void inode_switch_wbs_work_fn(struct work_struct *work)
+ bool switched = false;
+ void **slot;
+
++ /*
++ * If @inode switches cgwb membership while sync_inodes_sb() is
++ * being issued, sync_inodes_sb() might miss it. Synchronize.
++ */
++ down_read(&bdi->wb_switch_rwsem);
++
+ /*
+ * By the time control reaches here, RCU grace period has passed
+ * since I_WB_SWITCH assertion and all wb stat update transactions
+@@ -435,6 +452,8 @@ skip_switch:
+ spin_unlock(&new_wb->list_lock);
+ spin_unlock(&old_wb->list_lock);
+
++ up_read(&bdi->wb_switch_rwsem);
++
+ if (switched) {
+ wb_wakeup(new_wb);
+ wb_put(old_wb);
+@@ -475,9 +494,18 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
+ if (inode->i_state & I_WB_SWITCH)
+ return;
+
++ /*
++ * Avoid starting new switches while sync_inodes_sb() is in
++ * progress. Otherwise, if the down_write protected issue path
++ * blocks heavily, we might end up starting a large number of
++ * switches which will block on the rwsem.
++ */
++ if (!down_read_trylock(&bdi->wb_switch_rwsem))
++ return;
++
+ isw = kzalloc(sizeof(*isw), GFP_ATOMIC);
+ if (!isw)
+- return;
++ goto out_unlock;
+
+ /* find and pin the new wb */
+ rcu_read_lock();
+@@ -511,12 +539,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
+ * Let's continue after I_WB_SWITCH is guaranteed to be visible.
+ */
+ call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn);
+- return;
++ goto out_unlock;
+
+ out_free:
+ if (isw->new_wb)
+ wb_put(isw->new_wb);
+ kfree(isw);
++out_unlock:
++ up_read(&bdi->wb_switch_rwsem);
+ }
+
+ /**
+@@ -894,6 +924,9 @@ fs_initcall(cgroup_writeback_init);
+
+ #else /* CONFIG_CGROUP_WRITEBACK */
+
++static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) { }
++static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) { }
++
+ static struct bdi_writeback *
+ locked_inode_to_wb_and_lock_list(struct inode *inode)
+ __releases(&inode->i_lock)
+@@ -2420,8 +2453,11 @@ void sync_inodes_sb(struct super_block *sb)
+ return;
+ WARN_ON(!rwsem_is_locked(&sb->s_umount));
+
++ /* protect against inode wb switch, see inode_switch_wbs_work_fn() */
++ bdi_down_write_wb_switch_rwsem(bdi);
+ bdi_split_work_to_wbs(bdi, &work, false);
+ wb_wait_for_completion(bdi, &done);
++ bdi_up_write_wb_switch_rwsem(bdi);
+
+ wait_sb_inodes(sb);
+ }
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 32920a10100e2..a7fa037b876b7 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -859,6 +859,18 @@ static int hugetlbfs_migrate_page(struct address_space *mapping,
+ rc = migrate_huge_page_move_mapping(mapping, newpage, page);
+ if (rc != MIGRATEPAGE_SUCCESS)
+ return rc;
++
++ /*
++ * page_private is subpool pointer in hugetlb pages. Transfer to
++ * new page. PagePrivate is not associated with page_private for
++ * hugetlb pages and can not be set here as only page_huge_active
++ * pages can be migrated.
++ */
++ if (page_private(page)) {
++ set_page_private(newpage, page_private(page));
++ set_page_private(page, 0);
++ }
++
+ if (mode != MIGRATE_SYNC_NO_COPY)
+ migrate_page_copy(newpage, page);
+ else
+diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
+index c311571355981..07e02d6df5ad9 100644
+--- a/include/linux/backing-dev-defs.h
++++ b/include/linux/backing-dev-defs.h
+@@ -190,6 +190,7 @@ struct backing_dev_info {
+ struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */
+ struct rb_root cgwb_congested_tree; /* their congested states */
+ struct mutex cgwb_release_mutex; /* protect shutdown of wb structs */
++ struct rw_semaphore wb_switch_rwsem; /* no cgwb switch while syncing */
+ #else
+ struct bdi_writeback_congested *wb_congested;
+ #endif
+diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
+index 6756fea18b69f..e44746de95cdf 100644
+--- a/include/linux/if_arp.h
++++ b/include/linux/if_arp.h
+@@ -54,6 +54,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev)
+ case ARPHRD_IPGRE:
+ case ARPHRD_VOID:
+ case ARPHRD_NONE:
++ case ARPHRD_RAWIP:
+ return false;
+ default:
+ return true;
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index 201de12a99571..c9bffda04a450 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -1151,7 +1151,8 @@ void irq_matrix_offline(struct irq_matrix *m);
+ void irq_matrix_assign_system(struct irq_matrix *m, unsigned int bit, bool replace);
+ int irq_matrix_reserve_managed(struct irq_matrix *m, const struct cpumask *msk);
+ void irq_matrix_remove_managed(struct irq_matrix *m, const struct cpumask *msk);
+-int irq_matrix_alloc_managed(struct irq_matrix *m, unsigned int cpu);
++int irq_matrix_alloc_managed(struct irq_matrix *m, const struct cpumask *msk,
++ unsigned int *mapped_cpu);
+ void irq_matrix_reserve(struct irq_matrix *m);
+ void irq_matrix_remove_reserved(struct irq_matrix *m);
+ int irq_matrix_alloc(struct irq_matrix *m, const struct cpumask *msk,
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 55b4fa6d01ebd..d607e23fd0c3e 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -307,7 +307,7 @@ void rcuwait_wake_up(struct rcuwait *w)
+ * MB (A) MB (B)
+ * [L] cond [L] tsk
+ */
+- smp_rmb(); /* (B) */
++ smp_mb(); /* (B) */
+
+ /*
+ * Avoid using task_rcu_dereference() magic as long as we are careful,
+diff --git a/kernel/futex.c b/kernel/futex.c
+index d7c465fd687c6..c5fca746edc46 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1444,11 +1444,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
+ if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n"))
+ return;
+
+- /*
+- * Queue the task for later wakeup for after we've released
+- * the hb->lock. wake_q_add() grabs reference to p.
+- */
+- wake_q_add(wake_q, p);
++ get_task_struct(p);
+ __unqueue_futex(q);
+ /*
+ * The waiting task can free the futex_q as soon as q->lock_ptr = NULL
+@@ -1458,6 +1454,13 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
+ * plist_del in __unqueue_futex().
+ */
+ smp_store_release(&q->lock_ptr, NULL);
++
++ /*
++ * Queue the task for later wakeup for after we've released
++ * the hb->lock. wake_q_add() grabs reference to p.
++ */
++ wake_q_add(wake_q, p);
++ put_task_struct(p);
+ }
+
+ /*
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 9dbdccab3b6a3..5c0ba5ca59308 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -393,6 +393,9 @@ int irq_setup_affinity(struct irq_desc *desc)
+ }
+
+ cpumask_and(&mask, cpu_online_mask, set);
++ if (cpumask_empty(&mask))
++ cpumask_copy(&mask, cpu_online_mask);
++
+ if (node != NUMA_NO_NODE) {
+ const struct cpumask *nodemask = cpumask_of_node(node);
+
+diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
+index 5092494bf2614..92337703ca9fd 100644
+--- a/kernel/irq/matrix.c
++++ b/kernel/irq/matrix.c
+@@ -14,6 +14,7 @@ struct cpumap {
+ unsigned int available;
+ unsigned int allocated;
+ unsigned int managed;
++ unsigned int managed_allocated;
+ bool initialized;
+ bool online;
+ unsigned long alloc_map[IRQ_MATRIX_SIZE];
+@@ -124,6 +125,48 @@ static unsigned int matrix_alloc_area(struct irq_matrix *m, struct cpumap *cm,
+ return area;
+ }
+
++/* Find the best CPU which has the lowest vector allocation count */
++static unsigned int matrix_find_best_cpu(struct irq_matrix *m,
++ const struct cpumask *msk)
++{
++ unsigned int cpu, best_cpu, maxavl = 0;
++ struct cpumap *cm;
++
++ best_cpu = UINT_MAX;
++
++ for_each_cpu(cpu, msk) {
++ cm = per_cpu_ptr(m->maps, cpu);
++
++ if (!cm->online || cm->available <= maxavl)
++ continue;
++
++ best_cpu = cpu;
++ maxavl = cm->available;
++ }
++ return best_cpu;
++}
++
++/* Find the best CPU which has the lowest number of managed IRQs allocated */
++static unsigned int matrix_find_best_cpu_managed(struct irq_matrix *m,
++ const struct cpumask *msk)
++{
++ unsigned int cpu, best_cpu, allocated = UINT_MAX;
++ struct cpumap *cm;
++
++ best_cpu = UINT_MAX;
++
++ for_each_cpu(cpu, msk) {
++ cm = per_cpu_ptr(m->maps, cpu);
++
++ if (!cm->online || cm->managed_allocated > allocated)
++ continue;
++
++ best_cpu = cpu;
++ allocated = cm->managed_allocated;
++ }
++ return best_cpu;
++}
++
+ /**
+ * irq_matrix_assign_system - Assign system wide entry in the matrix
+ * @m: Matrix pointer
+@@ -239,11 +282,21 @@ void irq_matrix_remove_managed(struct irq_matrix *m, const struct cpumask *msk)
+ * @m: Matrix pointer
+ * @cpu: On which CPU the interrupt should be allocated
+ */
+-int irq_matrix_alloc_managed(struct irq_matrix *m, unsigned int cpu)
++int irq_matrix_alloc_managed(struct irq_matrix *m, const struct cpumask *msk,
++ unsigned int *mapped_cpu)
+ {
+- struct cpumap *cm = per_cpu_ptr(m->maps, cpu);
+- unsigned int bit, end = m->alloc_end;
++ unsigned int bit, cpu, end = m->alloc_end;
++ struct cpumap *cm;
+
++ if (cpumask_empty(msk))
++ return -EINVAL;
++
++ cpu = matrix_find_best_cpu_managed(m, msk);
++ if (cpu == UINT_MAX)
++ return -ENOSPC;
++
++ cm = per_cpu_ptr(m->maps, cpu);
++ end = m->alloc_end;
+ /* Get managed bit which are not allocated */
+ bitmap_andnot(m->scratch_map, cm->managed_map, cm->alloc_map, end);
+ bit = find_first_bit(m->scratch_map, end);
+@@ -251,7 +304,9 @@ int irq_matrix_alloc_managed(struct irq_matrix *m, unsigned int cpu)
+ return -ENOSPC;
+ set_bit(bit, cm->alloc_map);
+ cm->allocated++;
++ cm->managed_allocated++;
+ m->total_allocated++;
++ *mapped_cpu = cpu;
+ trace_irq_matrix_alloc_managed(bit, cpu, m, cm);
+ return bit;
+ }
+@@ -322,37 +377,27 @@ void irq_matrix_remove_reserved(struct irq_matrix *m)
+ int irq_matrix_alloc(struct irq_matrix *m, const struct cpumask *msk,
+ bool reserved, unsigned int *mapped_cpu)
+ {
+- unsigned int cpu, best_cpu, maxavl = 0;
++ unsigned int cpu, bit;
+ struct cpumap *cm;
+- unsigned int bit;
+
+- best_cpu = UINT_MAX;
+- for_each_cpu(cpu, msk) {
+- cm = per_cpu_ptr(m->maps, cpu);
+-
+- if (!cm->online || cm->available <= maxavl)
+- continue;
++ cpu = matrix_find_best_cpu(m, msk);
++ if (cpu == UINT_MAX)
++ return -ENOSPC;
+
+- best_cpu = cpu;
+- maxavl = cm->available;
+- }
++ cm = per_cpu_ptr(m->maps, cpu);
++ bit = matrix_alloc_area(m, cm, 1, false);
++ if (bit >= m->alloc_end)
++ return -ENOSPC;
++ cm->allocated++;
++ cm->available--;
++ m->total_allocated++;
++ m->global_available--;
++ if (reserved)
++ m->global_reserved--;
++ *mapped_cpu = cpu;
++ trace_irq_matrix_alloc(bit, cpu, m, cm);
++ return bit;
+
+- if (maxavl) {
+- cm = per_cpu_ptr(m->maps, best_cpu);
+- bit = matrix_alloc_area(m, cm, 1, false);
+- if (bit < m->alloc_end) {
+- cm->allocated++;
+- cm->available--;
+- m->total_allocated++;
+- m->global_available--;
+- if (reserved)
+- m->global_reserved--;
+- *mapped_cpu = best_cpu;
+- trace_irq_matrix_alloc(bit, best_cpu, m, cm);
+- return bit;
+- }
+- }
+- return -ENOSPC;
+ }
+
+ /**
+@@ -373,6 +418,8 @@ void irq_matrix_free(struct irq_matrix *m, unsigned int cpu,
+
+ clear_bit(bit, cm->alloc_map);
+ cm->allocated--;
++ if(managed)
++ cm->managed_allocated--;
+
+ if (cm->online)
+ m->total_allocated--;
+@@ -442,13 +489,14 @@ void irq_matrix_debug_show(struct seq_file *sf, struct irq_matrix *m, int ind)
+ seq_printf(sf, "Total allocated: %6u\n", m->total_allocated);
+ seq_printf(sf, "System: %u: %*pbl\n", nsys, m->matrix_bits,
+ m->system_map);
+- seq_printf(sf, "%*s| CPU | avl | man | act | vectors\n", ind, " ");
++ seq_printf(sf, "%*s| CPU | avl | man | mac | act | vectors\n", ind, " ");
+ cpus_read_lock();
+ for_each_online_cpu(cpu) {
+ struct cpumap *cm = per_cpu_ptr(m->maps, cpu);
+
+- seq_printf(sf, "%*s %4d %4u %4u %4u %*pbl\n", ind, " ",
+- cpu, cm->available, cm->managed, cm->allocated,
++ seq_printf(sf, "%*s %4d %4u %4u %4u %4u %*pbl\n", ind, " ",
++ cpu, cm->available, cm->managed,
++ cm->managed_allocated, cm->allocated,
+ m->matrix_bits, cm->alloc_map);
+ }
+ cpus_read_unlock();
+diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
+index 3064c50e181e1..ef909357b84e1 100644
+--- a/kernel/locking/rwsem-xadd.c
++++ b/kernel/locking/rwsem-xadd.c
+@@ -198,15 +198,22 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem,
+ woken++;
+ tsk = waiter->task;
+
+- wake_q_add(wake_q, tsk);
++ get_task_struct(tsk);
+ list_del(&waiter->list);
+ /*
+- * Ensure that the last operation is setting the reader
++ * Ensure calling get_task_struct() before setting the reader
+ * waiter to nil such that rwsem_down_read_failed() cannot
+ * race with do_exit() by always holding a reference count
+ * to the task to wakeup.
+ */
+ smp_store_release(&waiter->task, NULL);
++ /*
++ * Ensure issuing the wakeup (either by us or someone else)
++ * after setting the reader waiter to nil.
++ */
++ wake_q_add(wake_q, tsk);
++ /* wake_q_add() already take the task ref */
++ put_task_struct(tsk);
+ }
+
+ adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment;
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 13ddfa46d741f..152a0b0c91bb6 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -405,10 +405,11 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task)
+ * its already queued (either by us or someone else) and will get the
+ * wakeup due to that.
+ *
+- * This cmpxchg() executes a full barrier, which pairs with the full
+- * barrier executed by the wakeup in wake_up_q().
++ * In order to ensure that a pending wakeup will observe our pending
++ * state, even in the failed case, an explicit smp_mb() must be used.
+ */
+- if (cmpxchg(&node->next, NULL, WAKE_Q_TAIL))
++ smp_mb__before_atomic();
++ if (cmpxchg_relaxed(&node->next, NULL, WAKE_Q_TAIL))
+ return;
+
+ get_task_struct(task);
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index 8a8bb8796c6c4..72e6d0c55cfad 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -689,6 +689,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
+ INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC);
+ bdi->cgwb_congested_tree = RB_ROOT;
+ mutex_init(&bdi->cgwb_release_mutex);
++ init_rwsem(&bdi->wb_switch_rwsem);
+
+ ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
+ if (!ret) {
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 10e83672bfbec..9e5f66cbf711c 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3624,7 +3624,6 @@ retry_avoidcopy:
+ copy_user_huge_page(new_page, old_page, address, vma,
+ pages_per_huge_page(h));
+ __SetPageUptodate(new_page);
+- set_page_huge_active(new_page);
+
+ mmun_start = haddr;
+ mmun_end = mmun_start + huge_page_size(h);
+@@ -3646,6 +3645,7 @@ retry_avoidcopy:
+ make_huge_pte(vma, new_page, 1));
+ page_remove_rmap(old_page, true);
+ hugepage_add_new_anon_rmap(new_page, vma, haddr);
++ set_page_huge_active(new_page);
+ /* Make the old page be freed below */
+ new_page = old_page;
+ }
+@@ -3730,6 +3730,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
+ pte_t new_pte;
+ spinlock_t *ptl;
+ unsigned long haddr = address & huge_page_mask(h);
++ bool new_page = false;
+
+ /*
+ * Currently, we are forced to kill the process in the event the
+@@ -3791,7 +3792,7 @@ retry:
+ }
+ clear_huge_page(page, address, pages_per_huge_page(h));
+ __SetPageUptodate(page);
+- set_page_huge_active(page);
++ new_page = true;
+
+ if (vma->vm_flags & VM_MAYSHARE) {
+ int err = huge_add_to_page_cache(page, mapping, idx);
+@@ -3862,6 +3863,15 @@ retry:
+ }
+
+ spin_unlock(ptl);
++
++ /*
++ * Only make newly allocated pages active. Existing pages found
++ * in the pagecache could be !page_huge_active() if they have been
++ * isolated for migration.
++ */
++ if (new_page)
++ set_page_huge_active(page);
++
+ unlock_page(page);
+ out:
+ return ret;
+@@ -4096,7 +4106,6 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
+ * the set_pte_at() write.
+ */
+ __SetPageUptodate(page);
+- set_page_huge_active(page);
+
+ mapping = dst_vma->vm_file->f_mapping;
+ idx = vma_hugecache_offset(h, dst_vma, dst_addr);
+@@ -4164,6 +4173,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
+ update_mmu_cache(dst_vma, dst_addr, dst_pte);
+
+ spin_unlock(ptl);
++ set_page_huge_active(page);
+ if (vm_shared)
+ unlock_page(page);
+ ret = 0;
+diff --git a/mm/migrate.c b/mm/migrate.c
+index ab260260a6262..14779c4f9a60a 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -1303,6 +1303,16 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
+ lock_page(hpage);
+ }
+
++ /*
++ * Check for pages which are in the process of being freed. Without
++ * page_mapping() set, hugetlbfs specific move page routine will not
++ * be called and we could leak usage counts for subpools.
++ */
++ if (page_private(hpage) && !page_mapping(hpage)) {
++ rc = -EBUSY;
++ goto out_unlock;
++ }
++
+ if (PageAnon(hpage))
+ anon_vma = page_get_anon_vma(hpage);
+
+@@ -1333,6 +1343,7 @@ put_anon:
+ put_new_page = NULL;
+ }
+
++out_unlock:
+ unlock_page(hpage);
+ out:
+ if (rc != -EAGAIN)
+diff --git a/mm/mmap.c b/mm/mmap.c
+index f7cd9cb966c0f..43507f7e66b41 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2391,12 +2391,11 @@ int expand_downwards(struct vm_area_struct *vma,
+ {
+ struct mm_struct *mm = vma->vm_mm;
+ struct vm_area_struct *prev;
+- int error;
++ int error = 0;
+
+ address &= PAGE_MASK;
+- error = security_mmap_addr(address);
+- if (error)
+- return error;
++ if (address < mmap_min_addr)
++ return -EPERM;
+
+ /* Enforce stack_guard_gap */
+ prev = vma->vm_prev;
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index c2abe9db1ea24..40c5102234679 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1478,6 +1478,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+ if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
+ sta->sta.tdls = true;
+
++ if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
++ !sdata->u.mgd.associated)
++ return -EINVAL;
++
+ err = sta_apply_parameters(local, sta, params);
+ if (err) {
+ sta_info_free(local, sta);
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 828348b2a504d..e946ee4f335bd 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -221,7 +221,7 @@ static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
+ struct ieee80211_hdr_3addr hdr;
+ u8 category;
+ u8 action_code;
+- } __packed action;
++ } __packed __aligned(2) action;
+
+ if (!sdata)
+ return;
+@@ -2678,7 +2678,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ skb_set_queue_mapping(skb, q);
+
+ if (!--mesh_hdr->ttl) {
+- IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
++ if (!is_multicast_ether_addr(hdr->addr1))
++ IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
++ dropped_frames_ttl);
+ goto out;
+ }
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index c7ccd7b71b151..743cde66aaf62 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3614,10 +3614,10 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
+ /* We need a bit of data queued to build aggregates properly, so
+ * instruct the TCP stack to allow more than a single ms of data
+ * to be queued in the stack. The value is a bit-shift of 1
+- * second, so 8 is ~4ms of queued data. Only affects local TCP
++ * second, so 7 is ~8ms of queued data. Only affects local TCP
+ * sockets.
+ */
+- sk_pacing_shift_update(skb->sk, 8);
++ sk_pacing_shift_update(skb->sk, 7);
+
+ fast_tx = rcu_dereference(sta->fast_tx);
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 24cfa2776f50b..8002ace7c9f65 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1249,7 +1249,7 @@ static bool is_valid_rd(const struct ieee80211_regdomain *rd)
+ * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"),
+ * however it is safe for now to assume that a frequency rule should not be
+ * part of a frequency's band if the start freq or end freq are off by more
+- * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the
++ * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the
+ * 60 GHz band.
+ * This resolution can be lowered and should be considered as we add
+ * regulatory rule support for other "bands".
+@@ -1264,7 +1264,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
+ * with the Channel starting frequency above 45 GHz.
+ */
+ u32 limit = freq_khz > 45 * ONE_GHZ_IN_KHZ ?
+- 10 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ;
++ 20 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ;
+ if (abs(freq_khz - freq_range->start_freq_khz) <= limit)
+ return true;
+ if (abs(freq_khz - freq_range->end_freq_khz) <= limit)
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 26b5e245b0747..8b78ddffa509a 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -529,7 +529,8 @@ static int snd_compress_check_input(struct snd_compr_params *params)
+ {
+ /* first let's check the buffer parameter's */
+ if (params->buffer.fragment_size == 0 ||
+- params->buffer.fragments > INT_MAX / params->buffer.fragment_size)
++ params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
++ params->buffer.fragments == 0)
+ return -EINVAL;
+
+ /* now codec parameters */
+diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c
+index d88e673410835..18a931c25ca58 100644
+--- a/sound/soc/codecs/rt274.c
++++ b/sound/soc/codecs/rt274.c
+@@ -1126,8 +1126,11 @@ static int rt274_i2c_probe(struct i2c_client *i2c,
+ return ret;
+ }
+
+- regmap_read(rt274->regmap,
++ ret = regmap_read(rt274->regmap,
+ RT274_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val);
++ if (ret)
++ return ret;
++
+ if (val != RT274_VENDOR_ID) {
+ dev_err(&i2c->dev,
+ "Device with ID register %#x is not rt274\n", val);
+diff --git a/sound/soc/codecs/rt5682.h b/sound/soc/codecs/rt5682.h
+index 8068140ebe3f1..cdd659f4df93d 100644
+--- a/sound/soc/codecs/rt5682.h
++++ b/sound/soc/codecs/rt5682.h
+@@ -849,18 +849,18 @@
+ #define RT5682_SCLK_SRC_PLL2 (0x2 << 13)
+ #define RT5682_SCLK_SRC_SDW (0x3 << 13)
+ #define RT5682_SCLK_SRC_RCCLK (0x4 << 13)
+-#define RT5682_PLL1_SRC_MASK (0x3 << 10)
+-#define RT5682_PLL1_SRC_SFT 10
+-#define RT5682_PLL1_SRC_MCLK (0x0 << 10)
+-#define RT5682_PLL1_SRC_BCLK1 (0x1 << 10)
+-#define RT5682_PLL1_SRC_SDW (0x2 << 10)
+-#define RT5682_PLL1_SRC_RC (0x3 << 10)
+-#define RT5682_PLL2_SRC_MASK (0x3 << 8)
+-#define RT5682_PLL2_SRC_SFT 8
+-#define RT5682_PLL2_SRC_MCLK (0x0 << 8)
+-#define RT5682_PLL2_SRC_BCLK1 (0x1 << 8)
+-#define RT5682_PLL2_SRC_SDW (0x2 << 8)
+-#define RT5682_PLL2_SRC_RC (0x3 << 8)
++#define RT5682_PLL2_SRC_MASK (0x3 << 10)
++#define RT5682_PLL2_SRC_SFT 10
++#define RT5682_PLL2_SRC_MCLK (0x0 << 10)
++#define RT5682_PLL2_SRC_BCLK1 (0x1 << 10)
++#define RT5682_PLL2_SRC_SDW (0x2 << 10)
++#define RT5682_PLL2_SRC_RC (0x3 << 10)
++#define RT5682_PLL1_SRC_MASK (0x3 << 8)
++#define RT5682_PLL1_SRC_SFT 8
++#define RT5682_PLL1_SRC_MCLK (0x0 << 8)
++#define RT5682_PLL1_SRC_BCLK1 (0x1 << 8)
++#define RT5682_PLL1_SRC_SDW (0x2 << 8)
++#define RT5682_PLL1_SRC_RC (0x3 << 8)
+
+
+
+diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c
+index 392d5eef356d3..99e07b01a2ce9 100644
+--- a/sound/soc/fsl/imx-audmux.c
++++ b/sound/soc/fsl/imx-audmux.c
+@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf,
+ if (!buf)
+ return -ENOMEM;
+
+- ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n",
++ ret = scnprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n",
+ pdcr, ptcr);
+
+ if (ptcr & IMX_AUDMUX_V2_PTCR_TFSDIR)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "TxFS output from %s, ",
+ audmux_port_string((ptcr >> 27) & 0x7));
+ else
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "TxFS input, ");
+
+ if (ptcr & IMX_AUDMUX_V2_PTCR_TCLKDIR)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "TxClk output from %s",
+ audmux_port_string((ptcr >> 22) & 0x7));
+ else
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "TxClk input");
+
+- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n");
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n");
+
+ if (ptcr & IMX_AUDMUX_V2_PTCR_SYN) {
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "Port is symmetric");
+ } else {
+ if (ptcr & IMX_AUDMUX_V2_PTCR_RFSDIR)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "RxFS output from %s, ",
+ audmux_port_string((ptcr >> 17) & 0x7));
+ else
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "RxFS input, ");
+
+ if (ptcr & IMX_AUDMUX_V2_PTCR_RCLKDIR)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "RxClk output from %s",
+ audmux_port_string((ptcr >> 12) & 0x7));
+ else
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "RxClk input");
+ }
+
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "\nData received from %s\n",
+ audmux_port_string((pdcr >> 13) & 0x7));
+
+diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c
+index 7b0ee67b4fc8b..78ec97b53f50e 100644
+--- a/sound/soc/intel/boards/broadwell.c
++++ b/sound/soc/intel/boards/broadwell.c
+@@ -192,7 +192,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = {
+ .stream_name = "Loopback",
+ .cpu_dai_name = "Loopback Pin",
+ .platform_name = "haswell-pcm-audio",
+- .dynamic = 0,
++ .dynamic = 1,
+ .codec_name = "snd-soc-dummy",
+ .codec_dai_name = "snd-soc-dummy-dai",
+ .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c
+index eab1f439dd3f1..a4022983a7ce0 100644
+--- a/sound/soc/intel/boards/haswell.c
++++ b/sound/soc/intel/boards/haswell.c
+@@ -146,7 +146,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = {
+ .stream_name = "Loopback",
+ .cpu_dai_name = "Loopback Pin",
+ .platform_name = "haswell-pcm-audio",
+- .dynamic = 0,
++ .dynamic = 1,
+ .codec_name = "snd-soc-dummy",
+ .codec_dai_name = "snd-soc-dummy-dai",
+ .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 461d951917c05..6537069452226 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2028,19 +2028,19 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
+ out = is_connected_output_ep(w, NULL, NULL);
+ }
+
+- ret = snprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d",
++ ret = scnprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d",
+ w->name, w->power ? "On" : "Off",
+ w->force ? " (forced)" : "", in, out);
+
+ if (w->reg >= 0)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ " - R%d(0x%x) mask 0x%x",
+ w->reg, w->reg, w->mask << w->shift);
+
+- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n");
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n");
+
+ if (w->sname)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n",
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n",
+ w->sname,
+ w->active ? "active" : "inactive");
+
+@@ -2053,7 +2053,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
+ if (!p->connect)
+ continue;
+
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ " %s \"%s\" \"%s\"\n",
+ (rdir == SND_SOC_DAPM_DIR_IN) ? "in" : "out",
+ p->name ? p->name : "static",
+diff --git a/tools/testing/selftests/gpio/gpio-mockup-chardev.c b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
+index f8d468f54e986..aaa1e9f083c37 100644
+--- a/tools/testing/selftests/gpio/gpio-mockup-chardev.c
++++ b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
+@@ -37,7 +37,7 @@ static int get_debugfs(char **path)
+ struct libmnt_table *tb;
+ struct libmnt_iter *itr = NULL;
+ struct libmnt_fs *fs;
+- int found = 0;
++ int found = 0, ret;
+
+ cxt = mnt_new_context();
+ if (!cxt)
+@@ -58,8 +58,11 @@ static int get_debugfs(char **path)
+ break;
+ }
+ }
+- if (found)
+- asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
++ if (found) {
++ ret = asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
++ if (ret < 0)
++ err(EXIT_FAILURE, "failed to format string");
++ }
+
+ mnt_free_iter(itr);
+ mnt_free_context(cxt);
+diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
+index 6fd8c089cafcd..fb5d2d1e0c048 100644
+--- a/tools/testing/selftests/kvm/lib/kvm_util.c
++++ b/tools/testing/selftests/kvm/lib/kvm_util.c
+@@ -590,7 +590,7 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
+ * already exist.
+ */
+ region = (struct userspace_mem_region *) userspace_mem_region_find(
+- vm, guest_paddr, guest_paddr + npages * vm->page_size);
++ vm, guest_paddr, (guest_paddr + npages * vm->page_size) - 1);
+ if (region != NULL)
+ TEST_ASSERT(false, "overlapping userspace_mem_region already "
+ "exists\n"
+@@ -606,15 +606,10 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
+ region = region->next) {
+ if (region->region.slot == slot)
+ break;
+- if ((guest_paddr <= (region->region.guest_phys_addr
+- + region->region.memory_size))
+- && ((guest_paddr + npages * vm->page_size)
+- >= region->region.guest_phys_addr))
+- break;
+ }
+ if (region != NULL)
+ TEST_ASSERT(false, "A mem region with the requested slot "
+- "or overlapping physical memory range already exists.\n"
++ "already exists.\n"
+ " requested slot: %u paddr: 0x%lx npages: 0x%lx\n"
+ " existing slot: %u paddr: 0x%lx size: 0x%lx",
+ slot, guest_paddr, npages,
+diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c
+index e20b017e70731..b2065536d4075 100644
+--- a/tools/testing/selftests/rtc/rtctest.c
++++ b/tools/testing/selftests/rtc/rtctest.c
+@@ -145,15 +145,12 @@ TEST_F(rtc, alarm_alm_set) {
+
+ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+ ASSERT_NE(-1, rc);
+- EXPECT_NE(0, rc);
++ ASSERT_NE(0, rc);
+
+ /* Disable alarm interrupts */
+ rc = ioctl(self->fd, RTC_AIE_OFF, 0);
+ ASSERT_NE(-1, rc);
+
+- if (rc == 0)
+- return;
+-
+ rc = read(self->fd, &data, sizeof(unsigned long));
+ ASSERT_NE(-1, rc);
+ TH_LOG("data: %lx", data);
+@@ -202,7 +199,109 @@ TEST_F(rtc, alarm_wkalm_set) {
+
+ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+ ASSERT_NE(-1, rc);
+- EXPECT_NE(0, rc);
++ ASSERT_NE(0, rc);
++
++ rc = read(self->fd, &data, sizeof(unsigned long));
++ ASSERT_NE(-1, rc);
++
++ rc = ioctl(self->fd, RTC_RD_TIME, &tm);
++ ASSERT_NE(-1, rc);
++
++ new = timegm((struct tm *)&tm);
++ ASSERT_EQ(new, secs);
++}
++
++TEST_F(rtc, alarm_alm_set_minute) {
++ struct timeval tv = { .tv_sec = 62 };
++ unsigned long data;
++ struct rtc_time tm;
++ fd_set readfds;
++ time_t secs, new;
++ int rc;
++
++ rc = ioctl(self->fd, RTC_RD_TIME, &tm);
++ ASSERT_NE(-1, rc);
++
++ secs = timegm((struct tm *)&tm) + 60 - tm.tm_sec;
++ gmtime_r(&secs, (struct tm *)&tm);
++
++ rc = ioctl(self->fd, RTC_ALM_SET, &tm);
++ if (rc == -1) {
++ ASSERT_EQ(EINVAL, errno);
++ TH_LOG("skip alarms are not supported.");
++ return;
++ }
++
++ rc = ioctl(self->fd, RTC_ALM_READ, &tm);
++ ASSERT_NE(-1, rc);
++
++ TH_LOG("Alarm time now set to %02d:%02d:%02d.",
++ tm.tm_hour, tm.tm_min, tm.tm_sec);
++
++ /* Enable alarm interrupts */
++ rc = ioctl(self->fd, RTC_AIE_ON, 0);
++ ASSERT_NE(-1, rc);
++
++ FD_ZERO(&readfds);
++ FD_SET(self->fd, &readfds);
++
++ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
++ ASSERT_NE(-1, rc);
++ ASSERT_NE(0, rc);
++
++ /* Disable alarm interrupts */
++ rc = ioctl(self->fd, RTC_AIE_OFF, 0);
++ ASSERT_NE(-1, rc);
++
++ rc = read(self->fd, &data, sizeof(unsigned long));
++ ASSERT_NE(-1, rc);
++ TH_LOG("data: %lx", data);
++
++ rc = ioctl(self->fd, RTC_RD_TIME, &tm);
++ ASSERT_NE(-1, rc);
++
++ new = timegm((struct tm *)&tm);
++ ASSERT_EQ(new, secs);
++}
++
++TEST_F(rtc, alarm_wkalm_set_minute) {
++ struct timeval tv = { .tv_sec = 62 };
++ struct rtc_wkalrm alarm = { 0 };
++ struct rtc_time tm;
++ unsigned long data;
++ fd_set readfds;
++ time_t secs, new;
++ int rc;
++
++ rc = ioctl(self->fd, RTC_RD_TIME, &alarm.time);
++ ASSERT_NE(-1, rc);
++
++ secs = timegm((struct tm *)&alarm.time) + 60 - alarm.time.tm_sec;
++ gmtime_r(&secs, (struct tm *)&alarm.time);
++
++ alarm.enabled = 1;
++
++ rc = ioctl(self->fd, RTC_WKALM_SET, &alarm);
++ if (rc == -1) {
++ ASSERT_EQ(EINVAL, errno);
++ TH_LOG("skip alarms are not supported.");
++ return;
++ }
++
++ rc = ioctl(self->fd, RTC_WKALM_RD, &alarm);
++ ASSERT_NE(-1, rc);
++
++ TH_LOG("Alarm time now set to %02d/%02d/%02d %02d:%02d:%02d.",
++ alarm.time.tm_mday, alarm.time.tm_mon + 1,
++ alarm.time.tm_year + 1900, alarm.time.tm_hour,
++ alarm.time.tm_min, alarm.time.tm_sec);
++
++ FD_ZERO(&readfds);
++ FD_SET(self->fd, &readfds);
++
++ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
++ ASSERT_NE(-1, rc);
++ ASSERT_NE(0, rc);
+
+ rc = read(self->fd, &data, sizeof(unsigned long));
+ ASSERT_NE(-1, rc);
+diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
+index fce7f4ce06925..1760b3e397306 100644
+--- a/tools/testing/selftests/seccomp/Makefile
++++ b/tools/testing/selftests/seccomp/Makefile
+@@ -9,7 +9,7 @@ BINARIES := seccomp_bpf seccomp_benchmark
+ CFLAGS += -Wl,-no-as-needed -Wall
+
+ seccomp_bpf: seccomp_bpf.c ../kselftest_harness.h
+- $(CC) $(CFLAGS) $(LDFLAGS) -lpthread $< -o $@
++ $(CC) $(CFLAGS) $(LDFLAGS) $< -lpthread -o $@
+
+ TEST_PROGS += $(BINARIES)
+ EXTRA_CLEAN := $(BINARIES)
+diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c
+index 36df55132036f..9601bc24454d9 100644
+--- a/tools/testing/selftests/vm/gup_benchmark.c
++++ b/tools/testing/selftests/vm/gup_benchmark.c
+@@ -22,6 +22,7 @@ struct gup_benchmark {
+ __u64 size;
+ __u32 nr_pages_per_call;
+ __u32 flags;
++ __u64 expansion[10]; /* For future use */
+ };
+
+ int main(int argc, char **argv)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-03-06 19:06 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-03-06 19:06 UTC (permalink / raw
To: gentoo-commits
commit: 3f0c1bedfe3bae97e3672735a61ffdee639600a2
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 6 19:06:27 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 6 19:06:27 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3f0c1bed
proj/linux-patches: powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
See bug #679430
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
...pc-vr-get-set-change-to-avoid-gcc-warning.patch | 115 +++++++++++++++++++++
2 files changed, 119 insertions(+)
diff --git a/0000_README b/0000_README
index 46efd24..2190cb3 100644
--- a/0000_README
+++ b/0000_README
@@ -159,6 +159,10 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default.
+Patch: 1700_ppc-vr-get-set-change-to-avoid-gcc-warning.patch
+From: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/patch/?id=ca6d5149d2ad0a8d2f9c28cbe379802260a0a5e0
+Desc: powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
+
Patch: 2500_usb-storage-Disable-UAS-on-JMicron-SATA-enclosure.patch
From: https://bugzilla.redhat.com/show_bug.cgi?id=1260207#c5
Desc: Add UAS disable quirk. See bug #640082.
diff --git a/1700_ppc-vr-get-set-change-to-avoid-gcc-warning.patch b/1700_ppc-vr-get-set-change-to-avoid-gcc-warning.patch
new file mode 100644
index 0000000..bed4b41
--- /dev/null
+++ b/1700_ppc-vr-get-set-change-to-avoid-gcc-warning.patch
@@ -0,0 +1,115 @@
+From ca6d5149d2ad0a8d2f9c28cbe379802260a0a5e0 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Thu, 14 Feb 2019 11:08:29 +1100
+Subject: powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+GCC 8 warns about the logic in vr_get/set(), which with -Werror breaks
+the build:
+
+ In function ‘user_regset_copyin’,
+ inlined from ‘vr_set’ at arch/powerpc/kernel/ptrace.c:628:9:
+ include/linux/regset.h:295:4: error: ‘memcpy’ offset [-527, -529] is
+ out of the bounds [0, 16] of object ‘vrsave’ with type ‘union
+ <anonymous>’ [-Werror=array-bounds]
+ arch/powerpc/kernel/ptrace.c: In function ‘vr_set’:
+ arch/powerpc/kernel/ptrace.c:623:5: note: ‘vrsave’ declared here
+ } vrsave;
+
+This has been identified as a regression in GCC, see GCC bug 88273.
+
+However we can avoid the warning and also simplify the logic and make
+it more robust.
+
+Currently we pass -1 as end_pos to user_regset_copyout(). This says
+"copy up to the end of the regset".
+
+The definition of the regset is:
+ [REGSET_VMX] = {
+ .core_note_type = NT_PPC_VMX, .n = 34,
+ .size = sizeof(vector128), .align = sizeof(vector128),
+ .active = vr_active, .get = vr_get, .set = vr_set
+ },
+
+The end is calculated as (n * size), ie. 34 * sizeof(vector128).
+
+In vr_get/set() we pass start_pos as 33 * sizeof(vector128), meaning
+we can copy up to sizeof(vector128) into/out-of vrsave.
+
+The on-stack vrsave is defined as:
+ union {
+ elf_vrreg_t reg;
+ u32 word;
+ } vrsave;
+
+And elf_vrreg_t is:
+ typedef __vector128 elf_vrreg_t;
+
+So there is no bug, but we rely on all those sizes lining up,
+otherwise we would have a kernel stack exposure/overwrite on our
+hands.
+
+Rather than relying on that we can pass an explict end_pos based on
+the sizeof(vrsave). The result should be exactly the same but it's
+more obviously not over-reading/writing the stack and it avoids the
+compiler warning.
+
+Reported-by: Meelis Roos <mroos@linux.ee>
+Reported-by: Mathieu Malaterre <malat@debian.org>
+Cc: stable@vger.kernel.org
+Tested-by: Mathieu Malaterre <malat@debian.org>
+Tested-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+---
+ arch/powerpc/kernel/ptrace.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
+index 7535f89e08cd..d9ac7d94656e 100644
+--- a/arch/powerpc/kernel/ptrace.c
++++ b/arch/powerpc/kernel/ptrace.c
+@@ -567,6 +567,7 @@ static int vr_get(struct task_struct *target, const struct user_regset *regset,
+ /*
+ * Copy out only the low-order word of vrsave.
+ */
++ int start, end;
+ union {
+ elf_vrreg_t reg;
+ u32 word;
+@@ -575,8 +576,10 @@ static int vr_get(struct task_struct *target, const struct user_regset *regset,
+
+ vrsave.word = target->thread.vrsave;
+
++ start = 33 * sizeof(vector128);
++ end = start + sizeof(vrsave);
+ ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &vrsave,
+- 33 * sizeof(vector128), -1);
++ start, end);
+ }
+
+ return ret;
+@@ -614,6 +617,7 @@ static int vr_set(struct task_struct *target, const struct user_regset *regset,
+ /*
+ * We use only the first word of vrsave.
+ */
++ int start, end;
+ union {
+ elf_vrreg_t reg;
+ u32 word;
+@@ -622,8 +626,10 @@ static int vr_set(struct task_struct *target, const struct user_regset *regset,
+
+ vrsave.word = target->thread.vrsave;
+
++ start = 33 * sizeof(vector128);
++ end = start + sizeof(vrsave);
+ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &vrsave,
+- 33 * sizeof(vector128), -1);
++ start, end);
+ if (!ret)
+ target->thread.vrsave = vrsave.word;
+ }
+--
+cgit 1.2-0.3.lf.el7
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-03-10 14:15 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-03-10 14:15 UTC (permalink / raw
To: gentoo-commits
commit: 1d0ba6c74d9dabecc5ab3378f68b3860a5ac86f6
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 10 14:14:57 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Mar 10 14:14:57 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=1d0ba6c7
proj/linux-patches: Linux patch 4.19.28
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1027_linux-4.19.28.patch | 2598 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2602 insertions(+)
diff --git a/0000_README b/0000_README
index 2190cb3..292278e 100644
--- a/0000_README
+++ b/0000_README
@@ -151,6 +151,10 @@ Patch: 1026_linux-4.19.27.patch
From: http://www.kernel.org
Desc: Linux 4.19.27
+Patch: 1027_linux-4.19.28.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.28
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1027_linux-4.19.28.patch b/1027_linux-4.19.28.patch
new file mode 100644
index 0000000..c2e1d84
--- /dev/null
+++ b/1027_linux-4.19.28.patch
@@ -0,0 +1,2598 @@
+diff --git a/Makefile b/Makefile
+index 70ed9a53558a5..c6ac023ba33a5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 27
++SUBLEVEL = 28
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
+index ba150c755fcce..85b6c60f285d2 100644
+--- a/arch/mips/kernel/irq.c
++++ b/arch/mips/kernel/irq.c
+@@ -52,6 +52,7 @@ asmlinkage void spurious_interrupt(void)
+ void __init init_IRQ(void)
+ {
+ int i;
++ unsigned int order = get_order(IRQ_STACK_SIZE);
+
+ for (i = 0; i < NR_IRQS; i++)
+ irq_set_noprobe(i);
+@@ -62,8 +63,7 @@ void __init init_IRQ(void)
+ arch_init_irq();
+
+ for_each_possible_cpu(i) {
+- int irq_pages = IRQ_STACK_SIZE / PAGE_SIZE;
+- void *s = (void *)__get_free_pages(GFP_KERNEL, irq_pages);
++ void *s = (void *)__get_free_pages(GFP_KERNEL, order);
+
+ irq_stack[i] = s;
+ pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i,
+diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c
+index 9e21573714910..f8debf7aeb4c1 100644
+--- a/arch/x86/boot/compressed/pgtable_64.c
++++ b/arch/x86/boot/compressed/pgtable_64.c
+@@ -1,5 +1,7 @@
++#include <linux/efi.h>
+ #include <asm/e820/types.h>
+ #include <asm/processor.h>
++#include <asm/efi.h>
+ #include "pgtable.h"
+ #include "../string.h"
+
+@@ -37,9 +39,10 @@ int cmdline_find_option_bool(const char *option);
+
+ static unsigned long find_trampoline_placement(void)
+ {
+- unsigned long bios_start, ebda_start;
++ unsigned long bios_start = 0, ebda_start = 0;
+ unsigned long trampoline_start;
+ struct boot_e820_entry *entry;
++ char *signature;
+ int i;
+
+ /*
+@@ -47,8 +50,18 @@ static unsigned long find_trampoline_placement(void)
+ * This code is based on reserve_bios_regions().
+ */
+
+- ebda_start = *(unsigned short *)0x40e << 4;
+- bios_start = *(unsigned short *)0x413 << 10;
++ /*
++ * EFI systems may not provide legacy ROM. The memory may not be mapped
++ * at all.
++ *
++ * Only look for values in the legacy ROM for non-EFI system.
++ */
++ signature = (char *)&boot_params->efi_info.efi_loader_signature;
++ if (strncmp(signature, EFI32_LOADER_SIGNATURE, 4) &&
++ strncmp(signature, EFI64_LOADER_SIGNATURE, 4)) {
++ ebda_start = *(unsigned short *)0x40e << 4;
++ bios_start = *(unsigned short *)0x413 << 10;
++ }
+
+ if (bios_start < BIOS_START_MIN || bios_start > BIOS_START_MAX)
+ bios_start = BIOS_START_MAX;
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index eeea634bee0a7..6a25278e00929 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -818,11 +818,9 @@ static void init_amd_bd(struct cpuinfo_x86 *c)
+ static void init_amd_zn(struct cpuinfo_x86 *c)
+ {
+ set_cpu_cap(c, X86_FEATURE_ZEN);
+- /*
+- * Fix erratum 1076: CPB feature bit not being set in CPUID. It affects
+- * all up to and including B1.
+- */
+- if (c->x86_model <= 1 && c->x86_stepping <= 1)
++
++ /* Fix erratum 1076: CPB feature bit not being set in CPUID. */
++ if (!cpu_has(c, X86_FEATURE_CPB))
+ set_cpu_cap(c, X86_FEATURE_CPB);
+ }
+
+diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
+index 4bb68133a72af..5a0e0bd68b769 100644
+--- a/arch/xtensa/kernel/process.c
++++ b/arch/xtensa/kernel/process.c
+@@ -320,8 +320,8 @@ unsigned long get_wchan(struct task_struct *p)
+
+ /* Stack layout: sp-4: ra, sp-3: sp' */
+
+- pc = MAKE_PC_FROM_RA(*(unsigned long*)sp - 4, sp);
+- sp = *(unsigned long *)sp - 3;
++ pc = MAKE_PC_FROM_RA(SPILL_SLOT(sp, 0), sp);
++ sp = SPILL_SLOT(sp, 1);
+ } while (count++ < 16);
+ return 0;
+ }
+diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
+index 7f9ea8e4c1b22..1342f8e6025cc 100644
+--- a/drivers/bluetooth/btrtl.c
++++ b/drivers/bluetooth/btrtl.c
+@@ -544,10 +544,9 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
+ hdev->bus);
+
+ if (!btrtl_dev->ic_info) {
+- rtl_dev_err(hdev, "rtl: unknown IC info, lmp subver %04x, hci rev %04x, hci ver %04x",
++ rtl_dev_info(hdev, "rtl: unknown IC info, lmp subver %04x, hci rev %04x, hci ver %04x",
+ lmp_subver, hci_rev, hci_ver);
+- ret = -EINVAL;
+- goto err_free;
++ return btrtl_dev;
+ }
+
+ if (btrtl_dev->ic_info->has_rom_version) {
+@@ -602,6 +601,11 @@ int btrtl_download_firmware(struct hci_dev *hdev,
+ * standard btusb. Once that firmware is uploaded, the subver changes
+ * to a different value.
+ */
++ if (!btrtl_dev->ic_info) {
++ rtl_dev_info(hdev, "rtl: assuming no firmware upload needed\n");
++ return 0;
++ }
++
+ switch (btrtl_dev->ic_info->lmp_subver) {
+ case RTL_ROM_LMP_8723A:
+ case RTL_ROM_LMP_3499:
+diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
+index c0a5b1f3a9863..4ccc39e00ced3 100644
+--- a/drivers/char/applicom.c
++++ b/drivers/char/applicom.c
+@@ -32,6 +32,7 @@
+ #include <linux/wait.h>
+ #include <linux/init.h>
+ #include <linux/fs.h>
++#include <linux/nospec.h>
+
+ #include <asm/io.h>
+ #include <linux/uaccess.h>
+@@ -386,7 +387,11 @@ static ssize_t ac_write(struct file *file, const char __user *buf, size_t count,
+ TicCard = st_loc.tic_des_from_pc; /* tic number to send */
+ IndexCard = NumCard - 1;
+
+- if((NumCard < 1) || (NumCard > MAX_BOARD) || !apbs[IndexCard].RamIO)
++ if (IndexCard >= MAX_BOARD)
++ return -EINVAL;
++ IndexCard = array_index_nospec(IndexCard, MAX_BOARD);
++
++ if (!apbs[IndexCard].RamIO)
+ return -EINVAL;
+
+ #ifdef DEBUG
+@@ -697,6 +702,7 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ unsigned char IndexCard;
+ void __iomem *pmem;
+ int ret = 0;
++ static int warncount = 10;
+ volatile unsigned char byte_reset_it;
+ struct st_ram_io *adgl;
+ void __user *argp = (void __user *)arg;
+@@ -711,16 +717,12 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ mutex_lock(&ac_mutex);
+ IndexCard = adgl->num_card-1;
+
+- if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) {
+- static int warncount = 10;
+- if (warncount) {
+- printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1);
+- warncount--;
+- }
+- kfree(adgl);
+- mutex_unlock(&ac_mutex);
+- return -EINVAL;
+- }
++ if (cmd != 6 && IndexCard >= MAX_BOARD)
++ goto err;
++ IndexCard = array_index_nospec(IndexCard, MAX_BOARD);
++
++ if (cmd != 6 && !apbs[IndexCard].RamIO)
++ goto err;
+
+ switch (cmd) {
+
+@@ -838,5 +840,16 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ kfree(adgl);
+ mutex_unlock(&ac_mutex);
+ return 0;
++
++err:
++ if (warncount) {
++ pr_warn("APPLICOM driver IOCTL, bad board number %d\n",
++ (int)IndexCard + 1);
++ warncount--;
++ }
++ kfree(adgl);
++ mutex_unlock(&ac_mutex);
++ return -EINVAL;
++
+ }
+
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index b100260b6ed2e..505c9a55d5551 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -545,13 +545,13 @@ EXPORT_SYMBOL_GPL(cpufreq_policy_transition_delay_us);
+ * SYSFS INTERFACE *
+ *********************************************************************/
+ static ssize_t show_boost(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ return sprintf(buf, "%d\n", cpufreq_driver->boost_enabled);
+ }
+
+-static ssize_t store_boost(struct kobject *kobj, struct attribute *attr,
+- const char *buf, size_t count)
++static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr,
++ const char *buf, size_t count)
+ {
+ int ret, enable;
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index b6a1aadaff9f3..a005711f909ea 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -833,7 +833,7 @@ static void intel_pstate_update_policies(void)
+ /************************** sysfs begin ************************/
+ #define show_one(file_name, object) \
+ static ssize_t show_##file_name \
+- (struct kobject *kobj, struct attribute *attr, char *buf) \
++ (struct kobject *kobj, struct kobj_attribute *attr, char *buf) \
+ { \
+ return sprintf(buf, "%u\n", global.object); \
+ }
+@@ -842,7 +842,7 @@ static ssize_t intel_pstate_show_status(char *buf);
+ static int intel_pstate_update_status(const char *buf, size_t size);
+
+ static ssize_t show_status(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ ssize_t ret;
+
+@@ -853,7 +853,7 @@ static ssize_t show_status(struct kobject *kobj,
+ return ret;
+ }
+
+-static ssize_t store_status(struct kobject *a, struct attribute *b,
++static ssize_t store_status(struct kobject *a, struct kobj_attribute *b,
+ const char *buf, size_t count)
+ {
+ char *p = memchr(buf, '\n', count);
+@@ -867,7 +867,7 @@ static ssize_t store_status(struct kobject *a, struct attribute *b,
+ }
+
+ static ssize_t show_turbo_pct(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ struct cpudata *cpu;
+ int total, no_turbo, turbo_pct;
+@@ -893,7 +893,7 @@ static ssize_t show_turbo_pct(struct kobject *kobj,
+ }
+
+ static ssize_t show_num_pstates(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ struct cpudata *cpu;
+ int total;
+@@ -914,7 +914,7 @@ static ssize_t show_num_pstates(struct kobject *kobj,
+ }
+
+ static ssize_t show_no_turbo(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ ssize_t ret;
+
+@@ -936,7 +936,7 @@ static ssize_t show_no_turbo(struct kobject *kobj,
+ return ret;
+ }
+
+-static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
++static ssize_t store_no_turbo(struct kobject *a, struct kobj_attribute *b,
+ const char *buf, size_t count)
+ {
+ unsigned int input;
+@@ -983,7 +983,7 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
+ return count;
+ }
+
+-static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
++static ssize_t store_max_perf_pct(struct kobject *a, struct kobj_attribute *b,
+ const char *buf, size_t count)
+ {
+ unsigned int input;
+@@ -1013,7 +1013,7 @@ static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
+ return count;
+ }
+
+-static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b,
++static ssize_t store_min_perf_pct(struct kobject *a, struct kobj_attribute *b,
+ const char *buf, size_t count)
+ {
+ unsigned int input;
+@@ -1045,12 +1045,13 @@ static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b,
+ }
+
+ static ssize_t show_hwp_dynamic_boost(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ return sprintf(buf, "%u\n", hwp_boost);
+ }
+
+-static ssize_t store_hwp_dynamic_boost(struct kobject *a, struct attribute *b,
++static ssize_t store_hwp_dynamic_boost(struct kobject *a,
++ struct kobj_attribute *b,
+ const char *buf, size_t count)
+ {
+ unsigned int input;
+diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c
+index 2c22836d3ffd5..4596fde16dfe6 100644
+--- a/drivers/gnss/sirf.c
++++ b/drivers/gnss/sirf.c
+@@ -310,30 +310,26 @@ static int sirf_probe(struct serdev_device *serdev)
+ ret = -ENODEV;
+ goto err_put_device;
+ }
++
++ ret = regulator_enable(data->vcc);
++ if (ret)
++ goto err_put_device;
++
++ /* Wait for chip to boot into hibernate mode. */
++ msleep(SIRF_BOOT_DELAY);
+ }
+
+ if (data->wakeup) {
+ ret = gpiod_to_irq(data->wakeup);
+ if (ret < 0)
+- goto err_put_device;
+-
++ goto err_disable_vcc;
+ data->irq = ret;
+
+- ret = devm_request_threaded_irq(dev, data->irq, NULL,
+- sirf_wakeup_handler,
++ ret = request_threaded_irq(data->irq, NULL, sirf_wakeup_handler,
+ IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+ "wakeup", data);
+ if (ret)
+- goto err_put_device;
+- }
+-
+- if (data->on_off) {
+- ret = regulator_enable(data->vcc);
+- if (ret)
+- goto err_put_device;
+-
+- /* Wait for chip to boot into hibernate mode */
+- msleep(SIRF_BOOT_DELAY);
++ goto err_disable_vcc;
+ }
+
+ if (IS_ENABLED(CONFIG_PM)) {
+@@ -342,7 +338,7 @@ static int sirf_probe(struct serdev_device *serdev)
+ } else {
+ ret = sirf_runtime_resume(dev);
+ if (ret < 0)
+- goto err_disable_vcc;
++ goto err_free_irq;
+ }
+
+ ret = gnss_register_device(gdev);
+@@ -356,6 +352,9 @@ err_disable_rpm:
+ pm_runtime_disable(dev);
+ else
+ sirf_runtime_suspend(dev);
++err_free_irq:
++ if (data->wakeup)
++ free_irq(data->irq, data);
+ err_disable_vcc:
+ if (data->on_off)
+ regulator_disable(data->vcc);
+@@ -376,6 +375,9 @@ static void sirf_remove(struct serdev_device *serdev)
+ else
+ sirf_runtime_suspend(&serdev->dev);
+
++ if (data->wakeup)
++ free_irq(data->irq, data);
++
+ if (data->on_off)
+ regulator_disable(data->vcc);
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 9f697a5b8e3df..c078c791f481a 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -884,7 +884,7 @@ static uint64_t _mv88e6xxx_get_ethtool_stat(struct mv88e6xxx_chip *chip,
+ default:
+ return U64_MAX;
+ }
+- value = (((u64)high) << 16) | low;
++ value = (((u64)high) << 32) | low;
+ return value;
+ }
+
+@@ -3070,7 +3070,7 @@ static const struct mv88e6xxx_ops mv88e6161_ops = {
+ .port_disable_pri_override = mv88e6xxx_port_disable_pri_override,
+ .port_link_state = mv88e6352_port_link_state,
+ .port_get_cmode = mv88e6185_port_get_cmode,
+- .stats_snapshot = mv88e6320_g1_stats_snapshot,
++ .stats_snapshot = mv88e6xxx_g1_stats_snapshot,
+ .stats_set_histogram = mv88e6095_g1_stats_set_histogram,
+ .stats_get_sset_count = mv88e6095_stats_get_sset_count,
+ .stats_get_strings = mv88e6095_stats_get_strings,
+@@ -4188,7 +4188,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
+ .name = "Marvell 88E6190",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .num_gpio = 16,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
+@@ -4211,7 +4211,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
+ .name = "Marvell 88E6190X",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .num_gpio = 16,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
+@@ -4234,7 +4234,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
+ .name = "Marvell 88E6191",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
+ .phy_base_addr = 0x0,
+@@ -4281,7 +4281,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
+ .name = "Marvell 88E6290",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .num_gpio = 16,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
+@@ -4443,7 +4443,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
+ .name = "Marvell 88E6390",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .num_gpio = 16,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
+@@ -4466,7 +4466,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
+ .name = "Marvell 88E6390X",
+ .num_databases = 4096,
+ .num_ports = 11, /* 10 + Z80 */
+- .num_internal_phys = 11,
++ .num_internal_phys = 9,
+ .num_gpio = 16,
+ .max_vid = 8191,
+ .port_base_addr = 0x0,
+@@ -4561,6 +4561,14 @@ static int mv88e6xxx_smi_init(struct mv88e6xxx_chip *chip,
+ return 0;
+ }
+
++static void mv88e6xxx_ports_cmode_init(struct mv88e6xxx_chip *chip)
++{
++ int i;
++
++ for (i = 0; i < mv88e6xxx_num_ports(chip); i++)
++ chip->ports[i].cmode = MV88E6XXX_PORT_STS_CMODE_INVALID;
++}
++
+ static enum dsa_tag_protocol mv88e6xxx_get_tag_protocol(struct dsa_switch *ds,
+ int port)
+ {
+@@ -4597,6 +4605,8 @@ static const char *mv88e6xxx_drv_probe(struct device *dsa_dev,
+ if (err)
+ goto free;
+
++ mv88e6xxx_ports_cmode_init(chip);
++
+ mutex_lock(&chip->reg_lock);
+ err = mv88e6xxx_switch_reset(chip);
+ mutex_unlock(&chip->reg_lock);
+diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
+index 92945841c8e88..7fffce734f0a5 100644
+--- a/drivers/net/dsa/mv88e6xxx/port.c
++++ b/drivers/net/dsa/mv88e6xxx/port.c
+@@ -190,7 +190,7 @@ int mv88e6xxx_port_set_duplex(struct mv88e6xxx_chip *chip, int port, int dup)
+ /* normal duplex detection */
+ break;
+ default:
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ }
+
+ err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_MAC_CTL, reg);
+@@ -374,6 +374,10 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
+ cmode = 0;
+ }
+
++ /* cmode doesn't change, nothing to do for us */
++ if (cmode == chip->ports[port].cmode)
++ return 0;
++
+ lane = mv88e6390x_serdes_get_lane(chip, port);
+ if (lane < 0)
+ return lane;
+@@ -384,7 +388,7 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
+ return err;
+ }
+
+- err = mv88e6390_serdes_power(chip, port, false);
++ err = mv88e6390x_serdes_power(chip, port, false);
+ if (err)
+ return err;
+
+@@ -400,7 +404,7 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
+ if (err)
+ return err;
+
+- err = mv88e6390_serdes_power(chip, port, true);
++ err = mv88e6390x_serdes_power(chip, port, true);
+ if (err)
+ return err;
+
+diff --git a/drivers/net/dsa/mv88e6xxx/port.h b/drivers/net/dsa/mv88e6xxx/port.h
+index b31910023bb64..95b59f5eb3931 100644
+--- a/drivers/net/dsa/mv88e6xxx/port.h
++++ b/drivers/net/dsa/mv88e6xxx/port.h
+@@ -52,6 +52,7 @@
+ #define MV88E6185_PORT_STS_CMODE_1000BASE_X 0x0005
+ #define MV88E6185_PORT_STS_CMODE_PHY 0x0006
+ #define MV88E6185_PORT_STS_CMODE_DISABLED 0x0007
++#define MV88E6XXX_PORT_STS_CMODE_INVALID 0xff
+
+ /* Offset 0x01: MAC (or PCS or Physical) Control Register */
+ #define MV88E6XXX_PORT_MAC_CTL 0x01
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 034f57500f00e..1fdaf86bbe8fb 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -463,6 +463,12 @@ normal_tx:
+ }
+
+ length >>= 9;
++ if (unlikely(length >= ARRAY_SIZE(bnxt_lhint_arr))) {
++ dev_warn_ratelimited(&pdev->dev, "Dropped oversize %d bytes TX packet.\n",
++ skb->len);
++ i = 0;
++ goto tx_dma_error;
++ }
+ flags |= bnxt_lhint_arr[length];
+ txbd->tx_bd_len_flags_type = cpu_to_le32(flags);
+
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index ae2f35039343b..1485f66cf7b0c 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -46,6 +46,7 @@
+ #include <linux/mii.h>
+ #include <linux/of_device.h>
+ #include <linux/of_net.h>
++#include <linux/dmi.h>
+
+ #include <asm/irq.h>
+
+@@ -93,7 +94,7 @@ static int copybreak __read_mostly = 128;
+ module_param(copybreak, int, 0);
+ MODULE_PARM_DESC(copybreak, "Receive copy threshold");
+
+-static int disable_msi = 0;
++static int disable_msi = -1;
+ module_param(disable_msi, int, 0);
+ MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)");
+
+@@ -4931,6 +4932,24 @@ static const char *sky2_name(u8 chipid, char *buf, int sz)
+ return buf;
+ }
+
++static const struct dmi_system_id msi_blacklist[] = {
++ {
++ .ident = "Dell Inspiron 1545",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1545"),
++ },
++ },
++ {
++ .ident = "Gateway P-79",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Gateway"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P-79"),
++ },
++ },
++ {}
++};
++
+ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ struct net_device *dev, *dev1;
+@@ -5042,6 +5061,9 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ goto err_out_free_pci;
+ }
+
++ if (disable_msi == -1)
++ disable_msi = !!dmi_check_system(msi_blacklist);
++
+ if (!disable_msi && pci_enable_msi(pdev) == 0) {
+ err = sky2_test_msi(hw);
+ if (err) {
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index 42f5bfa33694c..de5a6abda7e3f 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -1403,7 +1403,8 @@ static int lan743x_tx_frame_start(struct lan743x_tx *tx,
+ }
+
+ static void lan743x_tx_frame_add_lso(struct lan743x_tx *tx,
+- unsigned int frame_length)
++ unsigned int frame_length,
++ int nr_frags)
+ {
+ /* called only from within lan743x_tx_xmit_frame.
+ * assuming tx->ring_lock has already been acquired.
+@@ -1413,6 +1414,10 @@ static void lan743x_tx_frame_add_lso(struct lan743x_tx *tx,
+
+ /* wrap up previous descriptor */
+ tx->frame_data0 |= TX_DESC_DATA0_EXT_;
++ if (nr_frags <= 0) {
++ tx->frame_data0 |= TX_DESC_DATA0_LS_;
++ tx->frame_data0 |= TX_DESC_DATA0_IOC_;
++ }
+ tx_descriptor = &tx->ring_cpu_ptr[tx->frame_tail];
+ tx_descriptor->data0 = tx->frame_data0;
+
+@@ -1517,8 +1522,11 @@ static void lan743x_tx_frame_end(struct lan743x_tx *tx,
+ u32 tx_tail_flags = 0;
+
+ /* wrap up previous descriptor */
+- tx->frame_data0 |= TX_DESC_DATA0_LS_;
+- tx->frame_data0 |= TX_DESC_DATA0_IOC_;
++ if ((tx->frame_data0 & TX_DESC_DATA0_DTYPE_MASK_) ==
++ TX_DESC_DATA0_DTYPE_DATA_) {
++ tx->frame_data0 |= TX_DESC_DATA0_LS_;
++ tx->frame_data0 |= TX_DESC_DATA0_IOC_;
++ }
+
+ tx_descriptor = &tx->ring_cpu_ptr[tx->frame_tail];
+ buffer_info = &tx->buffer_info[tx->frame_tail];
+@@ -1603,7 +1611,7 @@ static netdev_tx_t lan743x_tx_xmit_frame(struct lan743x_tx *tx,
+ }
+
+ if (gso)
+- lan743x_tx_frame_add_lso(tx, frame_length);
++ lan743x_tx_frame_add_lso(tx, frame_length, nr_frags);
+
+ if (nr_frags <= 0)
+ goto finish;
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 01711e6e9a394..e1427b56a073a 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -636,15 +636,20 @@ out:
+ static int geneve_open(struct net_device *dev)
+ {
+ struct geneve_dev *geneve = netdev_priv(dev);
+- bool ipv6 = !!(geneve->info.mode & IP_TUNNEL_INFO_IPV6);
+ bool metadata = geneve->collect_md;
++ bool ipv4, ipv6;
+ int ret = 0;
+
++ ipv6 = geneve->info.mode & IP_TUNNEL_INFO_IPV6 || metadata;
++ ipv4 = !ipv6 || metadata;
+ #if IS_ENABLED(CONFIG_IPV6)
+- if (ipv6 || metadata)
++ if (ipv6) {
+ ret = geneve_sock_add(geneve, true);
++ if (ret < 0 && ret != -EAFNOSUPPORT)
++ ipv4 = false;
++ }
+ #endif
+- if (!ret && (!ipv6 || metadata))
++ if (ipv4)
+ ret = geneve_sock_add(geneve, false);
+ if (ret < 0)
+ geneve_sock_release(geneve);
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index c9e2a986ccb72..c8320405c8f1d 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -743,6 +743,14 @@ void netvsc_linkstatus_callback(struct net_device *net,
+ schedule_delayed_work(&ndev_ctx->dwork, 0);
+ }
+
++static void netvsc_comp_ipcsum(struct sk_buff *skb)
++{
++ struct iphdr *iph = (struct iphdr *)skb->data;
++
++ iph->check = 0;
++ iph->check = ip_fast_csum(iph, iph->ihl);
++}
++
+ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net,
+ struct napi_struct *napi,
+ const struct ndis_tcp_ip_checksum_info *csum_info,
+@@ -766,9 +774,17 @@ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net,
+ /* skb is already created with CHECKSUM_NONE */
+ skb_checksum_none_assert(skb);
+
+- /*
+- * In Linux, the IP checksum is always checked.
+- * Do L4 checksum offload if enabled and present.
++ /* Incoming packets may have IP header checksum verified by the host.
++ * They may not have IP header checksum computed after coalescing.
++ * We compute it here if the flags are set, because on Linux, the IP
++ * checksum is always checked.
++ */
++ if (csum_info && csum_info->receive.ip_checksum_value_invalid &&
++ csum_info->receive.ip_checksum_succeeded &&
++ skb->protocol == htons(ETH_P_IP))
++ netvsc_comp_ipcsum(skb);
++
++ /* Do L4 checksum offload if enabled and present.
+ */
+ if (csum_info && (net->features & NETIF_F_RXCSUM)) {
+ if (csum_info->receive.tcp_checksum_succeeded ||
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 3db06b40580d3..05a6ae32ff652 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -339,6 +339,17 @@ static int ksz8041_config_aneg(struct phy_device *phydev)
+ return genphy_config_aneg(phydev);
+ }
+
++static int ksz8061_config_init(struct phy_device *phydev)
++{
++ int ret;
++
++ ret = phy_write_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_DEVID1, 0xB61A);
++ if (ret)
++ return ret;
++
++ return kszphy_config_init(phydev);
++}
++
+ static int ksz9021_load_values_from_of(struct phy_device *phydev,
+ const struct device_node *of_node,
+ u16 reg,
+@@ -934,7 +945,7 @@ static struct phy_driver ksphy_driver[] = {
+ .phy_id_mask = MICREL_PHY_ID_MASK,
+ .features = PHY_BASIC_FEATURES,
+ .flags = PHY_HAS_INTERRUPT,
+- .config_init = kszphy_config_init,
++ .config_init = ksz8061_config_init,
+ .ack_interrupt = kszphy_ack_interrupt,
+ .config_intr = kszphy_config_intr,
+ .suspend = genphy_suspend,
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 2787e8b1d668a..f6e70f2dfd12b 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -348,6 +348,10 @@ static int phylink_get_mac_state(struct phylink *pl, struct phylink_link_state *
+ linkmode_zero(state->lp_advertising);
+ state->interface = pl->link_config.interface;
+ state->an_enabled = pl->link_config.an_enabled;
++ state->speed = SPEED_UNKNOWN;
++ state->duplex = DUPLEX_UNKNOWN;
++ state->pause = MLO_PAUSE_NONE;
++ state->an_complete = 0;
+ state->link = 1;
+
+ return pl->ops->mac_link_state(ndev, state);
+diff --git a/drivers/net/team/team_mode_loadbalance.c b/drivers/net/team/team_mode_loadbalance.c
+index a5ef97010eb34..5541e1c19936c 100644
+--- a/drivers/net/team/team_mode_loadbalance.c
++++ b/drivers/net/team/team_mode_loadbalance.c
+@@ -325,6 +325,20 @@ static int lb_bpf_func_set(struct team *team, struct team_gsetter_ctx *ctx)
+ return 0;
+ }
+
++static void lb_bpf_func_free(struct team *team)
++{
++ struct lb_priv *lb_priv = get_lb_priv(team);
++ struct bpf_prog *fp;
++
++ if (!lb_priv->ex->orig_fprog)
++ return;
++
++ __fprog_destroy(lb_priv->ex->orig_fprog);
++ fp = rcu_dereference_protected(lb_priv->fp,
++ lockdep_is_held(&team->lock));
++ bpf_prog_destroy(fp);
++}
++
+ static int lb_tx_method_get(struct team *team, struct team_gsetter_ctx *ctx)
+ {
+ struct lb_priv *lb_priv = get_lb_priv(team);
+@@ -639,6 +653,7 @@ static void lb_exit(struct team *team)
+
+ team_options_unregister(team, lb_options,
+ ARRAY_SIZE(lb_options));
++ lb_bpf_func_free(team);
+ cancel_delayed_work_sync(&lb_priv->ex->stats.refresh_dw);
+ free_percpu(lb_priv->pcpu_stats);
+ kfree(lb_priv->ex);
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 65844f28db30e..f3293355c7849 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -2122,9 +2122,9 @@ static void *tun_ring_recv(struct tun_file *tfile, int noblock, int *err)
+ }
+
+ add_wait_queue(&tfile->wq.wait, &wait);
+- current->state = TASK_INTERRUPTIBLE;
+
+ while (1) {
++ set_current_state(TASK_INTERRUPTIBLE);
+ ptr = ptr_ring_consume(&tfile->tx_ring);
+ if (ptr)
+ break;
+@@ -2140,7 +2140,7 @@ static void *tun_ring_recv(struct tun_file *tfile, int noblock, int *err)
+ schedule();
+ }
+
+- current->state = TASK_RUNNING;
++ __set_current_state(TASK_RUNNING);
+ remove_wait_queue(&tfile->wq.wait, &wait);
+
+ out:
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 735ad838e2ba8..6e381354f658e 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -976,6 +976,13 @@ static const struct usb_device_id products[] = {
+ 0xff),
+ .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr,
+ },
++ { /* Quectel EG12/EM12 */
++ USB_DEVICE_AND_INTERFACE_INFO(0x2c7c, 0x0512,
++ USB_CLASS_VENDOR_SPEC,
++ USB_SUBCLASS_VENDOR_SPEC,
++ 0xff),
++ .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr,
++ },
+
+ /* 3. Combined interface devices matching on interface number */
+ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
+@@ -1343,17 +1350,20 @@ static bool quectel_ec20_detected(struct usb_interface *intf)
+ return false;
+ }
+
+-static bool quectel_ep06_diag_detected(struct usb_interface *intf)
++static bool quectel_diag_detected(struct usb_interface *intf)
+ {
+ struct usb_device *dev = interface_to_usbdev(intf);
+ struct usb_interface_descriptor intf_desc = intf->cur_altsetting->desc;
++ u16 id_vendor = le16_to_cpu(dev->descriptor.idVendor);
++ u16 id_product = le16_to_cpu(dev->descriptor.idProduct);
+
+- if (le16_to_cpu(dev->descriptor.idVendor) == 0x2c7c &&
+- le16_to_cpu(dev->descriptor.idProduct) == 0x0306 &&
+- intf_desc.bNumEndpoints == 2)
+- return true;
++ if (id_vendor != 0x2c7c || intf_desc.bNumEndpoints != 2)
++ return false;
+
+- return false;
++ if (id_product == 0x0306 || id_product == 0x0512)
++ return true;
++ else
++ return false;
+ }
+
+ static int qmi_wwan_probe(struct usb_interface *intf,
+@@ -1390,13 +1400,13 @@ static int qmi_wwan_probe(struct usb_interface *intf,
+ return -ENODEV;
+ }
+
+- /* Quectel EP06/EM06/EG06 supports dynamic interface configuration, so
++ /* Several Quectel modems supports dynamic interface configuration, so
+ * we need to match on class/subclass/protocol. These values are
+ * identical for the diagnostic- and QMI-interface, but bNumEndpoints is
+ * different. Ignore the current interface if the number of endpoints
+ * the number for the diag interface (two).
+ */
+- if (quectel_ep06_diag_detected(intf))
++ if (quectel_diag_detected(intf))
+ return -ENODEV;
+
+ return usbnet_probe(intf, id);
+diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c
+index 0ccb021f1e786..10d580c3dea3f 100644
+--- a/drivers/net/xen-netback/hash.c
++++ b/drivers/net/xen-netback/hash.c
+@@ -454,6 +454,8 @@ void xenvif_init_hash(struct xenvif *vif)
+ if (xenvif_hash_cache_size == 0)
+ return;
+
++ BUG_ON(vif->hash.cache.count);
++
+ spin_lock_init(&vif->hash.cache.lock);
+ INIT_LIST_HEAD(&vif->hash.cache.list);
+ }
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index f6ae23fc3f6b0..82add0ac4a5f6 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -153,6 +153,13 @@ static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb,
+ {
+ struct xenvif *vif = netdev_priv(dev);
+ unsigned int size = vif->hash.size;
++ unsigned int num_queues;
++
++ /* If queues are not set up internally - always return 0
++ * as the packet going to be dropped anyway */
++ num_queues = READ_ONCE(vif->num_queues);
++ if (num_queues < 1)
++ return 0;
+
+ if (vif->hash.alg == XEN_NETIF_CTRL_HASH_ALGORITHM_NONE)
+ return fallback(dev, skb, NULL) % dev->real_num_tx_queues;
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 3621e05a7494c..d5081ffdc8f03 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -1072,11 +1072,6 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s
+ skb_frag_size_set(&frags[i], len);
+ }
+
+- /* Copied all the bits from the frag list -- free it. */
+- skb_frag_list_init(skb);
+- xenvif_skb_zerocopy_prepare(queue, nskb);
+- kfree_skb(nskb);
+-
+ /* Release all the original (foreign) frags. */
+ for (f = 0; f < skb_shinfo(skb)->nr_frags; f++)
+ skb_frag_unref(skb, f);
+@@ -1145,6 +1140,8 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
+ xenvif_fill_frags(queue, skb);
+
+ if (unlikely(skb_has_frag_list(skb))) {
++ struct sk_buff *nskb = skb_shinfo(skb)->frag_list;
++ xenvif_skb_zerocopy_prepare(queue, nskb);
+ if (xenvif_handle_frag_list(queue, skb)) {
+ if (net_ratelimit())
+ netdev_err(queue->vif->dev,
+@@ -1153,6 +1150,9 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
+ kfree_skb(skb);
+ continue;
+ }
++ /* Copied all the bits from the frag list -- free it. */
++ skb_frag_list_init(skb);
++ kfree_skb(nskb);
+ }
+
+ skb->dev = queue->vif->dev;
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index b5f638286037a..18e4289baf993 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -757,6 +757,7 @@ static blk_status_t scsi_result_to_blk_status(struct scsi_cmnd *cmd, int result)
+ set_host_byte(cmd, DID_OK);
+ return BLK_STS_TARGET;
+ case DID_NEXUS_FAILURE:
++ set_host_byte(cmd, DID_OK);
+ return BLK_STS_NEXUS;
+ case DID_ALLOC_FAILURE:
+ set_host_byte(cmd, DID_OK);
+diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
+index a880b5c6c6c32..be815330ed958 100644
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -75,6 +75,9 @@ struct ashmem_range {
+ /* LRU list of unpinned pages, protected by ashmem_mutex */
+ static LIST_HEAD(ashmem_lru_list);
+
++static atomic_t ashmem_shrink_inflight = ATOMIC_INIT(0);
++static DECLARE_WAIT_QUEUE_HEAD(ashmem_shrink_wait);
++
+ /*
+ * long lru_count - The count of pages on our LRU list.
+ *
+@@ -168,19 +171,15 @@ static inline void lru_del(struct ashmem_range *range)
+ * @end: The ending page (inclusive)
+ *
+ * This function is protected by ashmem_mutex.
+- *
+- * Return: 0 if successful, or -ENOMEM if there is an error
+ */
+-static int range_alloc(struct ashmem_area *asma,
+- struct ashmem_range *prev_range, unsigned int purged,
+- size_t start, size_t end)
++static void range_alloc(struct ashmem_area *asma,
++ struct ashmem_range *prev_range, unsigned int purged,
++ size_t start, size_t end,
++ struct ashmem_range **new_range)
+ {
+- struct ashmem_range *range;
+-
+- range = kmem_cache_zalloc(ashmem_range_cachep, GFP_KERNEL);
+- if (!range)
+- return -ENOMEM;
++ struct ashmem_range *range = *new_range;
+
++ *new_range = NULL;
+ range->asma = asma;
+ range->pgstart = start;
+ range->pgend = end;
+@@ -190,8 +189,6 @@ static int range_alloc(struct ashmem_area *asma,
+
+ if (range_on_lru(range))
+ lru_add(range);
+-
+- return 0;
+ }
+
+ /**
+@@ -438,7 +435,6 @@ out:
+ static unsigned long
+ ashmem_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ {
+- struct ashmem_range *range, *next;
+ unsigned long freed = 0;
+
+ /* We might recurse into filesystem code, so bail out if necessary */
+@@ -448,21 +444,33 @@ ashmem_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ if (!mutex_trylock(&ashmem_mutex))
+ return -1;
+
+- list_for_each_entry_safe(range, next, &ashmem_lru_list, lru) {
++ while (!list_empty(&ashmem_lru_list)) {
++ struct ashmem_range *range =
++ list_first_entry(&ashmem_lru_list, typeof(*range), lru);
+ loff_t start = range->pgstart * PAGE_SIZE;
+ loff_t end = (range->pgend + 1) * PAGE_SIZE;
++ struct file *f = range->asma->file;
+
+- range->asma->file->f_op->fallocate(range->asma->file,
+- FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
+- start, end - start);
++ get_file(f);
++ atomic_inc(&ashmem_shrink_inflight);
+ range->purged = ASHMEM_WAS_PURGED;
+ lru_del(range);
+
+ freed += range_size(range);
++ mutex_unlock(&ashmem_mutex);
++ f->f_op->fallocate(f,
++ FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
++ start, end - start);
++ fput(f);
++ if (atomic_dec_and_test(&ashmem_shrink_inflight))
++ wake_up_all(&ashmem_shrink_wait);
++ if (!mutex_trylock(&ashmem_mutex))
++ goto out;
+ if (--sc->nr_to_scan <= 0)
+ break;
+ }
+ mutex_unlock(&ashmem_mutex);
++out:
+ return freed;
+ }
+
+@@ -582,7 +590,8 @@ static int get_name(struct ashmem_area *asma, void __user *name)
+ *
+ * Caller must hold ashmem_mutex.
+ */
+-static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend)
++static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend,
++ struct ashmem_range **new_range)
+ {
+ struct ashmem_range *range, *next;
+ int ret = ASHMEM_NOT_PURGED;
+@@ -635,7 +644,7 @@ static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend)
+ * second half and adjust the first chunk's endpoint.
+ */
+ range_alloc(asma, range, range->purged,
+- pgend + 1, range->pgend);
++ pgend + 1, range->pgend, new_range);
+ range_shrink(range, range->pgstart, pgstart - 1);
+ break;
+ }
+@@ -649,7 +658,8 @@ static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend)
+ *
+ * Caller must hold ashmem_mutex.
+ */
+-static int ashmem_unpin(struct ashmem_area *asma, size_t pgstart, size_t pgend)
++static int ashmem_unpin(struct ashmem_area *asma, size_t pgstart, size_t pgend,
++ struct ashmem_range **new_range)
+ {
+ struct ashmem_range *range, *next;
+ unsigned int purged = ASHMEM_NOT_PURGED;
+@@ -675,7 +685,8 @@ restart:
+ }
+ }
+
+- return range_alloc(asma, range, purged, pgstart, pgend);
++ range_alloc(asma, range, purged, pgstart, pgend, new_range);
++ return 0;
+ }
+
+ /*
+@@ -708,11 +719,19 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
+ struct ashmem_pin pin;
+ size_t pgstart, pgend;
+ int ret = -EINVAL;
++ struct ashmem_range *range = NULL;
+
+ if (copy_from_user(&pin, p, sizeof(pin)))
+ return -EFAULT;
+
++ if (cmd == ASHMEM_PIN || cmd == ASHMEM_UNPIN) {
++ range = kmem_cache_zalloc(ashmem_range_cachep, GFP_KERNEL);
++ if (!range)
++ return -ENOMEM;
++ }
++
+ mutex_lock(&ashmem_mutex);
++ wait_event(ashmem_shrink_wait, !atomic_read(&ashmem_shrink_inflight));
+
+ if (!asma->file)
+ goto out_unlock;
+@@ -735,10 +754,10 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
+
+ switch (cmd) {
+ case ASHMEM_PIN:
+- ret = ashmem_pin(asma, pgstart, pgend);
++ ret = ashmem_pin(asma, pgstart, pgend, &range);
+ break;
+ case ASHMEM_UNPIN:
+- ret = ashmem_unpin(asma, pgstart, pgend);
++ ret = ashmem_unpin(asma, pgstart, pgend, &range);
+ break;
+ case ASHMEM_GET_PIN_STATUS:
+ ret = ashmem_get_pin_status(asma, pgstart, pgend);
+@@ -747,6 +766,8 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
+
+ out_unlock:
+ mutex_unlock(&ashmem_mutex);
++ if (range)
++ kmem_cache_free(ashmem_range_cachep, range);
+
+ return ret;
+ }
+diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c
+index 701eb9f3b0f13..0a1b1ff1be042 100644
+--- a/drivers/staging/android/ion/ion_system_heap.c
++++ b/drivers/staging/android/ion/ion_system_heap.c
+@@ -247,10 +247,10 @@ static void ion_system_heap_destroy_pools(struct ion_page_pool **pools)
+ static int ion_system_heap_create_pools(struct ion_page_pool **pools)
+ {
+ int i;
+- gfp_t gfp_flags = low_order_gfp_flags;
+
+ for (i = 0; i < NUM_ORDERS; i++) {
+ struct ion_page_pool *pool;
++ gfp_t gfp_flags = low_order_gfp_flags;
+
+ if (orders[i] > 4)
+ gfp_flags = high_order_gfp_flags;
+diff --git a/drivers/staging/comedi/drivers/ni_660x.c b/drivers/staging/comedi/drivers/ni_660x.c
+index e521ed9d08870..35bd4d2efe166 100644
+--- a/drivers/staging/comedi/drivers/ni_660x.c
++++ b/drivers/staging/comedi/drivers/ni_660x.c
+@@ -602,6 +602,7 @@ static int ni_660x_set_pfi_routing(struct comedi_device *dev,
+ case NI_660X_PFI_OUTPUT_DIO:
+ if (chan > 31)
+ return -EINVAL;
++ break;
+ default:
+ return -EINVAL;
+ }
+diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c
+index 1279241449f4b..f44662dd795c4 100644
+--- a/drivers/staging/erofs/unzip_vle.c
++++ b/drivers/staging/erofs/unzip_vle.c
+@@ -57,15 +57,30 @@ enum z_erofs_vle_work_role {
+ Z_EROFS_VLE_WORK_SECONDARY,
+ Z_EROFS_VLE_WORK_PRIMARY,
+ /*
+- * The current work has at least been linked with the following
+- * processed chained works, which means if the processing page
+- * is the tail partial page of the work, the current work can
+- * safely use the whole page, as illustrated below:
+- * +--------------+-------------------------------------------+
+- * | tail page | head page (of the previous work) |
+- * +--------------+-------------------------------------------+
+- * /\ which belongs to the current work
+- * [ (*) this page can be used for the current work itself. ]
++ * The current work was the tail of an exist chain, and the previous
++ * processed chained works are all decided to be hooked up to it.
++ * A new chain should be created for the remaining unprocessed works,
++ * therefore different from Z_EROFS_VLE_WORK_PRIMARY_FOLLOWED,
++ * the next work cannot reuse the whole page in the following scenario:
++ * ________________________________________________________________
++ * | tail (partial) page | head (partial) page |
++ * | (belongs to the next work) | (belongs to the current work) |
++ * |_______PRIMARY_FOLLOWED_______|________PRIMARY_HOOKED___________|
++ */
++ Z_EROFS_VLE_WORK_PRIMARY_HOOKED,
++ /*
++ * The current work has been linked with the processed chained works,
++ * and could be also linked with the potential remaining works, which
++ * means if the processing page is the tail partial page of the work,
++ * the current work can safely use the whole page (since the next work
++ * is under control) for in-place decompression, as illustrated below:
++ * ________________________________________________________________
++ * | tail (partial) page | head (partial) page |
++ * | (of the current work) | (of the previous work) |
++ * | PRIMARY_FOLLOWED or | |
++ * |_____PRIMARY_HOOKED____|____________PRIMARY_FOLLOWED____________|
++ *
++ * [ (*) the above page can be used for the current work itself. ]
+ */
+ Z_EROFS_VLE_WORK_PRIMARY_FOLLOWED,
+ Z_EROFS_VLE_WORK_MAX
+@@ -234,10 +249,10 @@ static int z_erofs_vle_work_add_page(
+ return ret ? 0 : -EAGAIN;
+ }
+
+-static inline bool try_to_claim_workgroup(
+- struct z_erofs_vle_workgroup *grp,
+- z_erofs_vle_owned_workgrp_t *owned_head,
+- bool *hosted)
++static enum z_erofs_vle_work_role
++try_to_claim_workgroup(struct z_erofs_vle_workgroup *grp,
++ z_erofs_vle_owned_workgrp_t *owned_head,
++ bool *hosted)
+ {
+ DBG_BUGON(*hosted == true);
+
+@@ -251,6 +266,9 @@ retry:
+
+ *owned_head = grp;
+ *hosted = true;
++ /* lucky, I am the followee :) */
++ return Z_EROFS_VLE_WORK_PRIMARY_FOLLOWED;
++
+ } else if (grp->next == Z_EROFS_VLE_WORKGRP_TAIL) {
+ /*
+ * type 2, link to the end of a existing open chain,
+@@ -260,12 +278,11 @@ retry:
+ if (Z_EROFS_VLE_WORKGRP_TAIL != cmpxchg(&grp->next,
+ Z_EROFS_VLE_WORKGRP_TAIL, *owned_head))
+ goto retry;
+-
+ *owned_head = Z_EROFS_VLE_WORKGRP_TAIL;
+- } else
+- return false; /* :( better luck next time */
++ return Z_EROFS_VLE_WORK_PRIMARY_HOOKED;
++ }
+
+- return true; /* lucky, I am the followee :) */
++ return Z_EROFS_VLE_WORK_PRIMARY; /* :( better luck next time */
+ }
+
+ static struct z_erofs_vle_work *
+@@ -337,12 +354,8 @@ z_erofs_vle_work_lookup(struct super_block *sb,
+ *hosted = false;
+ if (!primary)
+ *role = Z_EROFS_VLE_WORK_SECONDARY;
+- /* claim the workgroup if possible */
+- else if (try_to_claim_workgroup(grp, owned_head, hosted))
+- *role = Z_EROFS_VLE_WORK_PRIMARY_FOLLOWED;
+- else
+- *role = Z_EROFS_VLE_WORK_PRIMARY;
+-
++ else /* claim the workgroup if possible */
++ *role = try_to_claim_workgroup(grp, owned_head, hosted);
+ return work;
+ }
+
+@@ -419,6 +432,9 @@ static inline void __update_workgrp_llen(struct z_erofs_vle_workgroup *grp,
+ }
+ }
+
++#define builder_is_hooked(builder) \
++ ((builder)->role >= Z_EROFS_VLE_WORK_PRIMARY_HOOKED)
++
+ #define builder_is_followed(builder) \
+ ((builder)->role >= Z_EROFS_VLE_WORK_PRIMARY_FOLLOWED)
+
+@@ -583,7 +599,7 @@ static int z_erofs_do_read_page(struct z_erofs_vle_frontend *fe,
+ struct z_erofs_vle_work_builder *const builder = &fe->builder;
+ const loff_t offset = page_offset(page);
+
+- bool tight = builder_is_followed(builder);
++ bool tight = builder_is_hooked(builder);
+ struct z_erofs_vle_work *work = builder->work;
+
+ #ifdef EROFS_FS_HAS_MANAGED_CACHE
+@@ -606,8 +622,12 @@ repeat:
+
+ /* lucky, within the range of the current map_blocks */
+ if (offset + cur >= map->m_la &&
+- offset + cur < map->m_la + map->m_llen)
++ offset + cur < map->m_la + map->m_llen) {
++ /* didn't get a valid unzip work previously (very rare) */
++ if (!builder->work)
++ goto restart_now;
+ goto hitted;
++ }
+
+ /* go ahead the next map_blocks */
+ debugln("%s: [out-of-range] pos %llu", __func__, offset + cur);
+@@ -621,6 +641,7 @@ repeat:
+ if (unlikely(err))
+ goto err_out;
+
++restart_now:
+ if (unlikely(!(map->m_flags & EROFS_MAP_MAPPED)))
+ goto hitted;
+
+@@ -646,7 +667,7 @@ repeat:
+ builder->role = Z_EROFS_VLE_WORK_PRIMARY;
+ #endif
+
+- tight &= builder_is_followed(builder);
++ tight &= builder_is_hooked(builder);
+ work = builder->work;
+ hitted:
+ cur = end - min_t(unsigned, offset + end - map->m_la, end);
+@@ -661,6 +682,9 @@ hitted:
+ (tight ? Z_EROFS_PAGE_TYPE_EXCLUSIVE :
+ Z_EROFS_VLE_PAGE_TYPE_TAIL_SHARED));
+
++ if (cur)
++ tight &= builder_is_followed(builder);
++
+ retry:
+ err = z_erofs_vle_work_add_page(builder, page, page_type);
+ /* should allocate an additional staging page for pagevec */
+@@ -901,11 +925,10 @@ repeat:
+ if (llen > grp->llen)
+ llen = grp->llen;
+
+- err = z_erofs_vle_unzip_fast_percpu(compressed_pages,
+- clusterpages, pages, llen, work->pageofs,
+- z_erofs_onlinepage_endio);
++ err = z_erofs_vle_unzip_fast_percpu(compressed_pages, clusterpages,
++ pages, llen, work->pageofs);
+ if (err != -ENOTSUPP)
+- goto out_percpu;
++ goto out;
+
+ if (sparsemem_pages >= nr_pages)
+ goto skip_allocpage;
+@@ -926,8 +949,25 @@ skip_allocpage:
+ erofs_vunmap(vout, nr_pages);
+
+ out:
++ /* must handle all compressed pages before endding pages */
++ for (i = 0; i < clusterpages; ++i) {
++ page = compressed_pages[i];
++
++#ifdef EROFS_FS_HAS_MANAGED_CACHE
++ if (page->mapping == mngda)
++ continue;
++#endif
++ /* recycle all individual staging pages */
++ (void)z_erofs_gather_if_stagingpage(page_pool, page);
++
++ WRITE_ONCE(compressed_pages[i], NULL);
++ }
++
+ for (i = 0; i < nr_pages; ++i) {
+ page = pages[i];
++ if (!page)
++ continue;
++
+ DBG_BUGON(page->mapping == NULL);
+
+ /* recycle all individual staging pages */
+@@ -940,20 +980,6 @@ out:
+ z_erofs_onlinepage_endio(page);
+ }
+
+-out_percpu:
+- for (i = 0; i < clusterpages; ++i) {
+- page = compressed_pages[i];
+-
+-#ifdef EROFS_FS_HAS_MANAGED_CACHE
+- if (page->mapping == mngda)
+- continue;
+-#endif
+- /* recycle all individual staging pages */
+- (void)z_erofs_gather_if_stagingpage(page_pool, page);
+-
+- WRITE_ONCE(compressed_pages[i], NULL);
+- }
+-
+ if (pages == z_pagemap_global)
+ mutex_unlock(&z_pagemap_global_lock);
+ else if (unlikely(pages != pages_onstack))
+diff --git a/drivers/staging/erofs/unzip_vle.h b/drivers/staging/erofs/unzip_vle.h
+index 3316bc36965d4..684ff06fc7bf8 100644
+--- a/drivers/staging/erofs/unzip_vle.h
++++ b/drivers/staging/erofs/unzip_vle.h
+@@ -218,8 +218,7 @@ extern int z_erofs_vle_plain_copy(struct page **compressed_pages,
+
+ extern int z_erofs_vle_unzip_fast_percpu(struct page **compressed_pages,
+ unsigned clusterpages, struct page **pages,
+- unsigned outlen, unsigned short pageofs,
+- void (*endio)(struct page *));
++ unsigned int outlen, unsigned short pageofs);
+
+ extern int z_erofs_vle_unzip_vmap(struct page **compressed_pages,
+ unsigned clusterpages, void *vaddr, unsigned llen,
+diff --git a/drivers/staging/erofs/unzip_vle_lz4.c b/drivers/staging/erofs/unzip_vle_lz4.c
+index 9cb35cd33365a..055420e8af2cf 100644
+--- a/drivers/staging/erofs/unzip_vle_lz4.c
++++ b/drivers/staging/erofs/unzip_vle_lz4.c
+@@ -105,8 +105,7 @@ int z_erofs_vle_unzip_fast_percpu(struct page **compressed_pages,
+ unsigned clusterpages,
+ struct page **pages,
+ unsigned outlen,
+- unsigned short pageofs,
+- void (*endio)(struct page *))
++ unsigned short pageofs)
+ {
+ void *vin, *vout;
+ unsigned nr_pages, i, j;
+@@ -128,31 +127,30 @@ int z_erofs_vle_unzip_fast_percpu(struct page **compressed_pages,
+ ret = z_erofs_unzip_lz4(vin, vout + pageofs,
+ clusterpages * PAGE_SIZE, outlen);
+
+- if (ret >= 0) {
+- outlen = ret;
+- ret = 0;
+- }
++ if (ret < 0)
++ goto out;
++ ret = 0;
+
+ for (i = 0; i < nr_pages; ++i) {
+ j = min((unsigned)PAGE_SIZE - pageofs, outlen);
+
+ if (pages[i] != NULL) {
+- if (ret < 0)
+- SetPageError(pages[i]);
+- else if (clusterpages == 1 && pages[i] == compressed_pages[0])
++ if (clusterpages == 1 &&
++ pages[i] == compressed_pages[0]) {
+ memcpy(vin + pageofs, vout + pageofs, j);
+- else {
++ } else {
+ void *dst = kmap_atomic(pages[i]);
+
+ memcpy(dst + pageofs, vout + pageofs, j);
+ kunmap_atomic(dst);
+ }
+- endio(pages[i]);
+ }
+ vout += PAGE_SIZE;
+ outlen -= j;
+ pageofs = 0;
+ }
++
++out:
+ preempt_enable();
+
+ if (clusterpages == 1)
+diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c
+index 3b8d237decbf1..649caae2b6033 100644
+--- a/drivers/staging/wilc1000/linux_wlan.c
++++ b/drivers/staging/wilc1000/linux_wlan.c
+@@ -1090,8 +1090,8 @@ int wilc_netdev_init(struct wilc **wilc, struct device *dev, int io_type,
+ vif->wilc = *wilc;
+ vif->ndev = ndev;
+ wl->vif[i] = vif;
+- wl->vif_num = i;
+- vif->idx = wl->vif_num;
++ wl->vif_num = i + 1;
++ vif->idx = i;
+
+ ndev->netdev_ops = &wilc_netdev_ops;
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 09bf6b4b741b8..1493d0fdf5ad1 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -187,6 +187,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_SSIC_PORT_UNUSED;
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
+ xhci->quirks |= XHCI_INTEL_USB_ROLE_SW;
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index c0777a374a88f..4c66edf533fe9 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -61,6 +61,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
+ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
++ { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */
+ { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
+ { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */
+ { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
+@@ -1353,8 +1354,13 @@ static int cp210x_gpio_get(struct gpio_chip *gc, unsigned int gpio)
+ if (priv->partnum == CP210X_PARTNUM_CP2105)
+ req_type = REQTYPE_INTERFACE_TO_HOST;
+
++ result = usb_autopm_get_interface(serial->interface);
++ if (result)
++ return result;
++
+ result = cp210x_read_vendor_block(serial, req_type,
+ CP210X_READ_LATCH, &buf, sizeof(buf));
++ usb_autopm_put_interface(serial->interface);
+ if (result < 0)
+ return result;
+
+@@ -1375,6 +1381,10 @@ static void cp210x_gpio_set(struct gpio_chip *gc, unsigned int gpio, int value)
+
+ buf.mask = BIT(gpio);
+
++ result = usb_autopm_get_interface(serial->interface);
++ if (result)
++ goto out;
++
+ if (priv->partnum == CP210X_PARTNUM_CP2105) {
+ result = cp210x_write_vendor_block(serial,
+ REQTYPE_HOST_TO_INTERFACE,
+@@ -1392,6 +1402,8 @@ static void cp210x_gpio_set(struct gpio_chip *gc, unsigned int gpio, int value)
+ NULL, 0, USB_CTRL_SET_TIMEOUT);
+ }
+
++ usb_autopm_put_interface(serial->interface);
++out:
+ if (result < 0) {
+ dev_err(&serial->interface->dev, "failed to set GPIO value: %d\n",
+ result);
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index b5cef322826f1..1d8077e880a01 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1015,6 +1015,8 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) },
+ { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) },
+ { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) },
++ /* EZPrototypes devices */
++ { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 975d02666c5a0..b863bedb55a13 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1308,6 +1308,12 @@
+ #define IONICS_VID 0x1c0c
+ #define IONICS_PLUGCOMPUTER_PID 0x0102
+
++/*
++ * EZPrototypes (PID reseller)
++ */
++#define EZPROTOTYPES_VID 0x1c40
++#define HJELMSLUND_USB485_ISO_PID 0x0477
++
+ /*
+ * Dresden Elektronik Sensor Terminal Board
+ */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index fb544340888b0..faf833e8f5573 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1148,6 +1148,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+ .driver_info = NCTRL(0) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff), /* Telit ME910 (ECM) */
++ .driver_info = NCTRL(0) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
+diff --git a/fs/aio.c b/fs/aio.c
+index 44551d96eaa4b..45d5ef8dd0a87 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -1661,6 +1661,7 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
+ struct poll_iocb *req = container_of(wait, struct poll_iocb, wait);
+ struct aio_kiocb *iocb = container_of(req, struct aio_kiocb, poll);
+ __poll_t mask = key_to_poll(key);
++ unsigned long flags;
+
+ req->woken = true;
+
+@@ -1669,10 +1670,15 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
+ if (!(mask & req->events))
+ return 0;
+
+- /* try to complete the iocb inline if we can: */
+- if (spin_trylock(&iocb->ki_ctx->ctx_lock)) {
++ /*
++ * Try to complete the iocb inline if we can. Use
++ * irqsave/irqrestore because not all filesystems (e.g. fuse)
++ * call this function with IRQs disabled and because IRQs
++ * have to be disabled before ctx_lock is obtained.
++ */
++ if (spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) {
+ list_del(&iocb->ki_list);
+- spin_unlock(&iocb->ki_ctx->ctx_lock);
++ spin_unlock_irqrestore(&iocb->ki_ctx->ctx_lock, flags);
+
+ list_del_init(&req->wait.entry);
+ aio_poll_complete(iocb, mask);
+diff --git a/fs/exec.c b/fs/exec.c
+index 1ebf6e5a521d9..433b1257694ab 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -929,7 +929,7 @@ int kernel_read_file(struct file *file, void **buf, loff_t *size,
+ bytes = kernel_read(file, *buf + pos, i_size - pos, &pos);
+ if (bytes < 0) {
+ ret = bytes;
+- goto out;
++ goto out_free;
+ }
+
+ if (bytes == 0)
+diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
+index 882a9b9e34bc2..72f59e8321e79 100644
+--- a/include/linux/cpufreq.h
++++ b/include/linux/cpufreq.h
+@@ -254,20 +254,12 @@ __ATTR(_name, 0644, show_##_name, store_##_name)
+ static struct freq_attr _name = \
+ __ATTR(_name, 0200, NULL, store_##_name)
+
+-struct global_attr {
+- struct attribute attr;
+- ssize_t (*show)(struct kobject *kobj,
+- struct attribute *attr, char *buf);
+- ssize_t (*store)(struct kobject *a, struct attribute *b,
+- const char *c, size_t count);
+-};
+-
+ #define define_one_global_ro(_name) \
+-static struct global_attr _name = \
++static struct kobj_attribute _name = \
+ __ATTR(_name, 0444, show_##_name, NULL)
+
+ #define define_one_global_rw(_name) \
+-static struct global_attr _name = \
++static struct kobj_attribute _name = \
+ __ATTR(_name, 0644, show_##_name, store_##_name)
+
+
+diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
+index ec9d6bc658559..fabee6db0abb7 100644
+--- a/include/net/bluetooth/bluetooth.h
++++ b/include/net/bluetooth/bluetooth.h
+@@ -276,7 +276,7 @@ int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
+ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo);
+ int bt_sock_wait_ready(struct sock *sk, unsigned long flags);
+
+-void bt_accept_enqueue(struct sock *parent, struct sock *sk);
++void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh);
+ void bt_accept_unlink(struct sock *sk);
+ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock);
+
+diff --git a/include/net/icmp.h b/include/net/icmp.h
+index 3ef2743a8eecc..8665bf24e3b7a 100644
+--- a/include/net/icmp.h
++++ b/include/net/icmp.h
+@@ -22,6 +22,7 @@
+
+ #include <net/inet_sock.h>
+ #include <net/snmp.h>
++#include <net/ip.h>
+
+ struct icmp_err {
+ int errno;
+@@ -39,7 +40,13 @@ struct net_proto_family;
+ struct sk_buff;
+ struct net;
+
+-void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info);
++void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
++ const struct ip_options *opt);
++static inline void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
++{
++ __icmp_send(skb_in, type, code, info, &IPCB(skb_in)->opt);
++}
++
+ int icmp_rcv(struct sk_buff *skb);
+ void icmp_err(struct sk_buff *skb, u32 info);
+ int icmp_init(void);
+diff --git a/include/net/ip.h b/include/net/ip.h
+index e44b1a44f67ad..71d31e4d4391f 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -638,6 +638,8 @@ static inline int ip_options_echo(struct net *net, struct ip_options *dopt,
+ }
+
+ void ip_options_fragment(struct sk_buff *skb);
++int __ip_options_compile(struct net *net, struct ip_options *opt,
++ struct sk_buff *skb, __be32 *info);
+ int ip_options_compile(struct net *net, struct ip_options *opt,
+ struct sk_buff *skb);
+ int ip_options_get(struct net *net, struct ip_options_rcu **optp,
+@@ -687,7 +689,7 @@ extern int sysctl_icmp_msgs_burst;
+ int ip_misc_proc_init(void);
+ #endif
+
+-int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto,
++int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto, u8 family,
+ struct netlink_ext_ack *extack);
+
+ #endif /* _IP_H */
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index a6d00093f35e7..c44da48de7dfd 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -47,7 +47,10 @@ struct qdisc_size_table {
+ struct qdisc_skb_head {
+ struct sk_buff *head;
+ struct sk_buff *tail;
+- __u32 qlen;
++ union {
++ u32 qlen;
++ atomic_t atomic_qlen;
++ };
+ spinlock_t lock;
+ };
+
+@@ -384,27 +387,19 @@ static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz)
+ BUILD_BUG_ON(sizeof(qcb->data) < sz);
+ }
+
+-static inline int qdisc_qlen_cpu(const struct Qdisc *q)
+-{
+- return this_cpu_ptr(q->cpu_qstats)->qlen;
+-}
+-
+ static inline int qdisc_qlen(const struct Qdisc *q)
+ {
+ return q->q.qlen;
+ }
+
+-static inline int qdisc_qlen_sum(const struct Qdisc *q)
++static inline u32 qdisc_qlen_sum(const struct Qdisc *q)
+ {
+- __u32 qlen = q->qstats.qlen;
+- int i;
++ u32 qlen = q->qstats.qlen;
+
+- if (q->flags & TCQ_F_NOLOCK) {
+- for_each_possible_cpu(i)
+- qlen += per_cpu_ptr(q->cpu_qstats, i)->qlen;
+- } else {
++ if (q->flags & TCQ_F_NOLOCK)
++ qlen += atomic_read(&q->q.atomic_qlen);
++ else
+ qlen += q->q.qlen;
+- }
+
+ return qlen;
+ }
+@@ -776,14 +771,14 @@ static inline void qdisc_qstats_cpu_backlog_inc(struct Qdisc *sch,
+ this_cpu_add(sch->cpu_qstats->backlog, qdisc_pkt_len(skb));
+ }
+
+-static inline void qdisc_qstats_cpu_qlen_inc(struct Qdisc *sch)
++static inline void qdisc_qstats_atomic_qlen_inc(struct Qdisc *sch)
+ {
+- this_cpu_inc(sch->cpu_qstats->qlen);
++ atomic_inc(&sch->q.atomic_qlen);
+ }
+
+-static inline void qdisc_qstats_cpu_qlen_dec(struct Qdisc *sch)
++static inline void qdisc_qstats_atomic_qlen_dec(struct Qdisc *sch)
+ {
+- this_cpu_dec(sch->cpu_qstats->qlen);
++ atomic_dec(&sch->q.atomic_qlen);
+ }
+
+ static inline void qdisc_qstats_cpu_requeues_inc(struct Qdisc *sch)
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 4d81be2d07390..bcb42aaf1b3ae 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -6035,7 +6035,8 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
+ u32 off_reg;
+
+ aux = &env->insn_aux_data[i + delta];
+- if (!aux->alu_state)
++ if (!aux->alu_state ||
++ aux->alu_state == BPF_ALU_NON_POINTER)
+ continue;
+
+ isneg = aux->alu_state & BPF_ALU_NEG_VALUE;
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 5574e862de8d5..5a1c64a26e819 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1301,7 +1301,7 @@ static int parse_pred(const char *str, void *data,
+ /* go past the last quote */
+ i++;
+
+- } else if (isdigit(str[i])) {
++ } else if (isdigit(str[i]) || str[i] == '-') {
+
+ /* Make sure the field is not a string */
+ if (is_string_field(field)) {
+@@ -1314,6 +1314,9 @@ static int parse_pred(const char *str, void *data,
+ goto err_free;
+ }
+
++ if (str[i] == '-')
++ i++;
++
+ /* We allow 0xDEADBEEF */
+ while (isalnum(str[i]))
+ i++;
+diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
+index deacc52d7ff18..8d12198eaa949 100644
+--- a/net/bluetooth/af_bluetooth.c
++++ b/net/bluetooth/af_bluetooth.c
+@@ -154,15 +154,25 @@ void bt_sock_unlink(struct bt_sock_list *l, struct sock *sk)
+ }
+ EXPORT_SYMBOL(bt_sock_unlink);
+
+-void bt_accept_enqueue(struct sock *parent, struct sock *sk)
++void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
+ {
+ BT_DBG("parent %p, sk %p", parent, sk);
+
+ sock_hold(sk);
+- lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
++
++ if (bh)
++ bh_lock_sock_nested(sk);
++ else
++ lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
++
+ list_add_tail(&bt_sk(sk)->accept_q, &bt_sk(parent)->accept_q);
+ bt_sk(sk)->parent = parent;
+- release_sock(sk);
++
++ if (bh)
++ bh_unlock_sock(sk);
++ else
++ release_sock(sk);
++
+ parent->sk_ack_backlog++;
+ }
+ EXPORT_SYMBOL(bt_accept_enqueue);
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index 686bdc6b35b03..a3a2cd55e23a9 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1252,7 +1252,7 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
+
+ l2cap_sock_init(sk, parent);
+
+- bt_accept_enqueue(parent, sk);
++ bt_accept_enqueue(parent, sk, false);
+
+ release_sock(parent);
+
+diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
+index d606e92122916..c044ff2f73e6c 100644
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -988,7 +988,7 @@ int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc *
+ rfcomm_pi(sk)->channel = channel;
+
+ sk->sk_state = BT_CONFIG;
+- bt_accept_enqueue(parent, sk);
++ bt_accept_enqueue(parent, sk, true);
+
+ /* Accept connection and return socket DLC */
+ *d = rfcomm_pi(sk)->dlc;
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 8f0f9279eac9f..a4ca55df73908 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -193,7 +193,7 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
+ conn->sk = sk;
+
+ if (parent)
+- bt_accept_enqueue(parent, sk);
++ bt_accept_enqueue(parent, sk, true);
+ }
+
+ static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
+diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
+index 188d693cb251a..e2fd8baec65f3 100644
+--- a/net/core/gen_stats.c
++++ b/net/core/gen_stats.c
+@@ -256,7 +256,6 @@ __gnet_stats_copy_queue_cpu(struct gnet_stats_queue *qstats,
+ for_each_possible_cpu(i) {
+ const struct gnet_stats_queue *qcpu = per_cpu_ptr(q, i);
+
+- qstats->qlen = 0;
+ qstats->backlog += qcpu->backlog;
+ qstats->drops += qcpu->drops;
+ qstats->requeues += qcpu->requeues;
+@@ -272,7 +271,6 @@ void __gnet_stats_copy_queue(struct gnet_stats_queue *qstats,
+ if (cpu) {
+ __gnet_stats_copy_queue_cpu(qstats, cpu);
+ } else {
+- qstats->qlen = q->qlen;
+ qstats->backlog = q->backlog;
+ qstats->drops = q->drops;
+ qstats->requeues = q->requeues;
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index bd67c4d0fcfdf..2aabb7eb08541 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1547,6 +1547,9 @@ static int register_queue_kobjects(struct net_device *dev)
+ error:
+ netdev_queue_update_kobjects(dev, txq, 0);
+ net_rx_queue_update_kobjects(dev, rxq, 0);
++#ifdef CONFIG_SYSFS
++ kset_unregister(dev->queues_kset);
++#endif
+ return error;
+ }
+
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index 777fa3b7fb13d..f0165c5f376b3 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -667,7 +667,8 @@ static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level)
+ case CIPSO_V4_MAP_PASS:
+ return 0;
+ case CIPSO_V4_MAP_TRANS:
+- if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)
++ if ((level < doi_def->map.std->lvl.cipso_size) &&
++ (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL))
+ return 0;
+ break;
+ }
+@@ -1735,13 +1736,26 @@ validate_return:
+ */
+ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
+ {
++ unsigned char optbuf[sizeof(struct ip_options) + 40];
++ struct ip_options *opt = (struct ip_options *)optbuf;
++
+ if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES)
+ return;
+
++ /*
++ * We might be called above the IP layer,
++ * so we can not use icmp_send and IPCB here.
++ */
++
++ memset(opt, 0, sizeof(struct ip_options));
++ opt->optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr);
++ if (__ip_options_compile(dev_net(skb->dev), opt, skb, NULL))
++ return;
++
+ if (gateway)
+- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0);
++ __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0, opt);
+ else
+- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0);
++ __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0, opt);
+ }
+
+ /**
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 958e185a8e8d1..dae743b649c1d 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -700,6 +700,10 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
+ case RTA_GATEWAY:
+ cfg->fc_gw = nla_get_be32(attr);
+ break;
++ case RTA_VIA:
++ NL_SET_ERR_MSG(extack, "IPv4 does not support RTA_VIA attribute");
++ err = -EINVAL;
++ goto errout;
+ case RTA_PRIORITY:
+ cfg->fc_priority = nla_get_u32(attr);
+ break;
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index 695979b7ef6d0..ad75c468ecfb2 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -570,7 +570,8 @@ relookup_failed:
+ * MUST reply to only the first fragment.
+ */
+
+-void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
++void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
++ const struct ip_options *opt)
+ {
+ struct iphdr *iph;
+ int room;
+@@ -691,7 +692,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
+ iph->tos;
+ mark = IP4_REPLY_MARK(net, skb_in->mark);
+
+- if (ip_options_echo(net, &icmp_param.replyopts.opt.opt, skb_in))
++ if (__ip_options_echo(net, &icmp_param.replyopts.opt.opt, skb_in, opt))
+ goto out_unlock;
+
+
+@@ -742,7 +743,7 @@ out_bh_enable:
+ local_bh_enable();
+ out:;
+ }
+-EXPORT_SYMBOL(icmp_send);
++EXPORT_SYMBOL(__icmp_send);
+
+
+ static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
+index 6f977b0fef545..bd8ef4f87c795 100644
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -308,11 +308,10 @@ drop:
+ }
+
+ static int ip_rcv_finish_core(struct net *net, struct sock *sk,
+- struct sk_buff *skb)
++ struct sk_buff *skb, struct net_device *dev)
+ {
+ const struct iphdr *iph = ip_hdr(skb);
+ int (*edemux)(struct sk_buff *skb);
+- struct net_device *dev = skb->dev;
+ struct rtable *rt;
+ int err;
+
+@@ -401,6 +400,7 @@ drop_error:
+
+ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
++ struct net_device *dev = skb->dev;
+ int ret;
+
+ /* if ingress device is enslaved to an L3 master device pass the
+@@ -410,7 +410,7 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+ if (!skb)
+ return NET_RX_SUCCESS;
+
+- ret = ip_rcv_finish_core(net, sk, skb);
++ ret = ip_rcv_finish_core(net, sk, skb, dev);
+ if (ret != NET_RX_DROP)
+ ret = dst_input(skb);
+ return ret;
+@@ -550,6 +550,7 @@ static void ip_list_rcv_finish(struct net *net, struct sock *sk,
+
+ INIT_LIST_HEAD(&sublist);
+ list_for_each_entry_safe(skb, next, head, list) {
++ struct net_device *dev = skb->dev;
+ struct dst_entry *dst;
+
+ skb_list_del_init(skb);
+@@ -559,7 +560,7 @@ static void ip_list_rcv_finish(struct net *net, struct sock *sk,
+ skb = l3mdev_ip_rcv(skb);
+ if (!skb)
+ continue;
+- if (ip_rcv_finish_core(net, sk, skb) == NET_RX_DROP)
++ if (ip_rcv_finish_core(net, sk, skb, dev) == NET_RX_DROP)
+ continue;
+
+ dst = skb_dst(skb);
+diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
+index ed194d46c00e3..32a35043c9f59 100644
+--- a/net/ipv4/ip_options.c
++++ b/net/ipv4/ip_options.c
+@@ -251,8 +251,9 @@ static void spec_dst_fill(__be32 *spec_dst, struct sk_buff *skb)
+ * If opt == NULL, then skb->data should point to IP header.
+ */
+
+-int ip_options_compile(struct net *net,
+- struct ip_options *opt, struct sk_buff *skb)
++int __ip_options_compile(struct net *net,
++ struct ip_options *opt, struct sk_buff *skb,
++ __be32 *info)
+ {
+ __be32 spec_dst = htonl(INADDR_ANY);
+ unsigned char *pp_ptr = NULL;
+@@ -468,11 +469,22 @@ eol:
+ return 0;
+
+ error:
+- if (skb) {
+- icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((pp_ptr-iph)<<24));
+- }
++ if (info)
++ *info = htonl((pp_ptr-iph)<<24);
+ return -EINVAL;
+ }
++
++int ip_options_compile(struct net *net,
++ struct ip_options *opt, struct sk_buff *skb)
++{
++ int ret;
++ __be32 info;
++
++ ret = __ip_options_compile(net, opt, skb, &info);
++ if (ret != 0 && skb)
++ icmp_send(skb, ICMP_PARAMETERPROB, 0, info);
++ return ret;
++}
+ EXPORT_SYMBOL(ip_options_compile);
+
+ /*
+diff --git a/net/ipv4/netlink.c b/net/ipv4/netlink.c
+index f86bb4f066095..d8e3a1fb8e826 100644
+--- a/net/ipv4/netlink.c
++++ b/net/ipv4/netlink.c
+@@ -3,9 +3,10 @@
+ #include <linux/types.h>
+ #include <net/net_namespace.h>
+ #include <net/netlink.h>
++#include <linux/in6.h>
+ #include <net/ip.h>
+
+-int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto,
++int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto, u8 family,
+ struct netlink_ext_ack *extack)
+ {
+ *ip_proto = nla_get_u8(attr);
+@@ -13,11 +14,19 @@ int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto,
+ switch (*ip_proto) {
+ case IPPROTO_TCP:
+ case IPPROTO_UDP:
++ return 0;
+ case IPPROTO_ICMP:
++ if (family != AF_INET)
++ break;
++ return 0;
++#if IS_ENABLED(CONFIG_IPV6)
++ case IPPROTO_ICMPV6:
++ if (family != AF_INET6)
++ break;
+ return 0;
+- default:
+- NL_SET_ERR_MSG(extack, "Unsupported ip proto");
+- return -EOPNOTSUPP;
++#endif
+ }
++ NL_SET_ERR_MSG(extack, "Unsupported ip proto");
++ return -EOPNOTSUPP;
+ }
+ EXPORT_SYMBOL_GPL(rtm_getroute_parse_ip_proto);
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 436b46c0e687f..ca87bb6784e5d 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2814,7 +2814,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
+
+ if (tb[RTA_IP_PROTO]) {
+ err = rtm_getroute_parse_ip_proto(tb[RTA_IP_PROTO],
+- &ip_proto, extack);
++ &ip_proto, AF_INET, extack);
+ if (err)
+ return err;
+ }
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 10aafea3af0f1..35e7092eceb37 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -1954,10 +1954,10 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+
+ static inline int ip6mr_forward2_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+- __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+- IPSTATS_MIB_OUTFORWDATAGRAMS);
+- __IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)),
+- IPSTATS_MIB_OUTOCTETS, skb->len);
++ IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
++ IPSTATS_MIB_OUTFORWDATAGRAMS);
++ IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)),
++ IPSTATS_MIB_OUTOCTETS, skb->len);
+ return dst_output(net, sk, skb);
+ }
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 08c4516ae4a4d..ba59a9c14e02a 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -4213,6 +4213,10 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
+ cfg->fc_gateway = nla_get_in6_addr(tb[RTA_GATEWAY]);
+ cfg->fc_flags |= RTF_GATEWAY;
+ }
++ if (tb[RTA_VIA]) {
++ NL_SET_ERR_MSG(extack, "IPv6 does not support RTA_VIA attribute");
++ goto errout;
++ }
+
+ if (tb[RTA_DST]) {
+ int plen = (rtm->rtm_dst_len + 7) >> 3;
+@@ -4907,7 +4911,8 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
+
+ if (tb[RTA_IP_PROTO]) {
+ err = rtm_getroute_parse_ip_proto(tb[RTA_IP_PROTO],
+- &fl6.flowi6_proto, extack);
++ &fl6.flowi6_proto, AF_INET6,
++ extack);
+ if (err)
+ goto errout;
+ }
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index da6d5a3f53995..868d7da7a0cb3 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1873,6 +1873,7 @@ static int __net_init sit_init_net(struct net *net)
+
+ err_reg_dev:
+ ipip6_dev_free(sitn->fb_tunnel_dev);
++ free_netdev(sitn->fb_tunnel_dev);
+ err_alloc_dev:
+ return err;
+ }
+diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
+index 8fbe6cdbe255d..d5a4db5b3fe7b 100644
+--- a/net/mpls/af_mpls.c
++++ b/net/mpls/af_mpls.c
+@@ -1822,6 +1822,9 @@ static int rtm_to_route_config(struct sk_buff *skb,
+ goto errout;
+ break;
+ }
++ case RTA_GATEWAY:
++ NL_SET_ERR_MSG(extack, "MPLS does not support RTA_GATEWAY attribute");
++ goto errout;
+ case RTA_VIA:
+ {
+ if (nla_get_via(nla, &cfg->rc_via_alen,
+diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
+index ea7c67050792c..ee3e5b6471a69 100644
+--- a/net/netlabel/netlabel_kapi.c
++++ b/net/netlabel/netlabel_kapi.c
+@@ -903,7 +903,8 @@ int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len,
+ (state == 0 && (byte & bitmask) == 0))
+ return bit_spot;
+
+- bit_spot++;
++ if (++bit_spot >= bitmap_len)
++ return -1;
+ bitmask >>= 1;
+ if (bitmask == 0) {
+ byte = bitmap[++byte_offset];
+diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
+index 6a196e438b6c0..d1fc019e932e0 100644
+--- a/net/nfc/llcp_commands.c
++++ b/net/nfc/llcp_commands.c
+@@ -419,6 +419,10 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
+ sock->service_name,
+ sock->service_name_len,
+ &service_name_tlv_length);
++ if (!service_name_tlv) {
++ err = -ENOMEM;
++ goto error_tlv;
++ }
+ size += service_name_tlv_length;
+ }
+
+@@ -429,9 +433,17 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
+
+ miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
+ &miux_tlv_length);
++ if (!miux_tlv) {
++ err = -ENOMEM;
++ goto error_tlv;
++ }
+ size += miux_tlv_length;
+
+ rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
++ if (!rw_tlv) {
++ err = -ENOMEM;
++ goto error_tlv;
++ }
+ size += rw_tlv_length;
+
+ pr_debug("SKB size %d SN length %zu\n", size, sock->service_name_len);
+@@ -484,9 +496,17 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
+
+ miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
+ &miux_tlv_length);
++ if (!miux_tlv) {
++ err = -ENOMEM;
++ goto error_tlv;
++ }
+ size += miux_tlv_length;
+
+ rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
++ if (!rw_tlv) {
++ err = -ENOMEM;
++ goto error_tlv;
++ }
+ size += rw_tlv_length;
+
+ skb = llcp_allocate_pdu(sock, LLCP_PDU_CC, size);
+diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
+index ef4026a23e802..4fa015208aab1 100644
+--- a/net/nfc/llcp_core.c
++++ b/net/nfc/llcp_core.c
+@@ -532,10 +532,10 @@ static u8 nfc_llcp_reserve_sdp_ssap(struct nfc_llcp_local *local)
+
+ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
+ {
+- u8 *gb_cur, *version_tlv, version, version_length;
+- u8 *lto_tlv, lto_length;
+- u8 *wks_tlv, wks_length;
+- u8 *miux_tlv, miux_length;
++ u8 *gb_cur, version, version_length;
++ u8 lto_length, wks_length, miux_length;
++ u8 *version_tlv = NULL, *lto_tlv = NULL,
++ *wks_tlv = NULL, *miux_tlv = NULL;
+ __be16 wks = cpu_to_be16(local->local_wks);
+ u8 gb_len = 0;
+ int ret = 0;
+@@ -543,17 +543,33 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
+ version = LLCP_VERSION_11;
+ version_tlv = nfc_llcp_build_tlv(LLCP_TLV_VERSION, &version,
+ 1, &version_length);
++ if (!version_tlv) {
++ ret = -ENOMEM;
++ goto out;
++ }
+ gb_len += version_length;
+
+ lto_tlv = nfc_llcp_build_tlv(LLCP_TLV_LTO, &local->lto, 1, <o_length);
++ if (!lto_tlv) {
++ ret = -ENOMEM;
++ goto out;
++ }
+ gb_len += lto_length;
+
+ pr_debug("Local wks 0x%lx\n", local->local_wks);
+ wks_tlv = nfc_llcp_build_tlv(LLCP_TLV_WKS, (u8 *)&wks, 2, &wks_length);
++ if (!wks_tlv) {
++ ret = -ENOMEM;
++ goto out;
++ }
+ gb_len += wks_length;
+
+ miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&local->miux, 0,
+ &miux_length);
++ if (!miux_tlv) {
++ ret = -ENOMEM;
++ goto out;
++ }
+ gb_len += miux_length;
+
+ gb_len += ARRAY_SIZE(llcp_magic);
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index 8525de8116163..334f3a0576713 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -199,8 +199,7 @@ err3:
+ err2:
+ kfree(tname);
+ err1:
+- if (ret == ACT_P_CREATED)
+- tcf_idr_release(*a, bind);
++ tcf_idr_release(*a, bind);
+ return err;
+ }
+
+diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
+index 73e44ce2a8837..86d90fc5e97ea 100644
+--- a/net/sched/act_skbedit.c
++++ b/net/sched/act_skbedit.c
+@@ -191,8 +191,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
+
+ params_new = kzalloc(sizeof(*params_new), GFP_KERNEL);
+ if (unlikely(!params_new)) {
+- if (ret == ACT_P_CREATED)
+- tcf_idr_release(*a, bind);
++ tcf_idr_release(*a, bind);
+ return -ENOMEM;
+ }
+
+diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
+index 0f6601fdf8899..72d9c432e8b42 100644
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -377,7 +377,8 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
+ return ret;
+
+ release_tun_meta:
+- dst_release(&metadata->dst);
++ if (metadata)
++ dst_release(&metadata->dst);
+
+ err_out:
+ if (exists)
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 69078c82963ef..77b289da77636 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -68,7 +68,7 @@ static inline struct sk_buff *__skb_dequeue_bad_txq(struct Qdisc *q)
+ skb = __skb_dequeue(&q->skb_bad_txq);
+ if (qdisc_is_percpu_stats(q)) {
+ qdisc_qstats_cpu_backlog_dec(q, skb);
+- qdisc_qstats_cpu_qlen_dec(q);
++ qdisc_qstats_atomic_qlen_dec(q);
+ } else {
+ qdisc_qstats_backlog_dec(q, skb);
+ q->q.qlen--;
+@@ -108,7 +108,7 @@ static inline void qdisc_enqueue_skb_bad_txq(struct Qdisc *q,
+
+ if (qdisc_is_percpu_stats(q)) {
+ qdisc_qstats_cpu_backlog_inc(q, skb);
+- qdisc_qstats_cpu_qlen_inc(q);
++ qdisc_qstats_atomic_qlen_inc(q);
+ } else {
+ qdisc_qstats_backlog_inc(q, skb);
+ q->q.qlen++;
+@@ -147,7 +147,7 @@ static inline int dev_requeue_skb_locked(struct sk_buff *skb, struct Qdisc *q)
+
+ qdisc_qstats_cpu_requeues_inc(q);
+ qdisc_qstats_cpu_backlog_inc(q, skb);
+- qdisc_qstats_cpu_qlen_inc(q);
++ qdisc_qstats_atomic_qlen_inc(q);
+
+ skb = next;
+ }
+@@ -252,7 +252,7 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate,
+ skb = __skb_dequeue(&q->gso_skb);
+ if (qdisc_is_percpu_stats(q)) {
+ qdisc_qstats_cpu_backlog_dec(q, skb);
+- qdisc_qstats_cpu_qlen_dec(q);
++ qdisc_qstats_atomic_qlen_dec(q);
+ } else {
+ qdisc_qstats_backlog_dec(q, skb);
+ q->q.qlen--;
+@@ -633,7 +633,7 @@ static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc *qdisc,
+ if (unlikely(err))
+ return qdisc_drop_cpu(skb, qdisc, to_free);
+
+- qdisc_qstats_cpu_qlen_inc(qdisc);
++ qdisc_qstats_atomic_qlen_inc(qdisc);
+ /* Note: skb can not be used after skb_array_produce(),
+ * so we better not use qdisc_qstats_cpu_backlog_inc()
+ */
+@@ -658,7 +658,7 @@ static struct sk_buff *pfifo_fast_dequeue(struct Qdisc *qdisc)
+ if (likely(skb)) {
+ qdisc_qstats_cpu_backlog_dec(qdisc, skb);
+ qdisc_bstats_cpu_update(qdisc, skb);
+- qdisc_qstats_cpu_qlen_dec(qdisc);
++ qdisc_qstats_atomic_qlen_dec(qdisc);
+ }
+
+ return skb;
+@@ -702,7 +702,6 @@ static void pfifo_fast_reset(struct Qdisc *qdisc)
+ struct gnet_stats_queue *q = per_cpu_ptr(qdisc->cpu_qstats, i);
+
+ q->backlog = 0;
+- q->qlen = 0;
+ }
+ }
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 74c0f656f28c5..4dfe10b9f96c8 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -440,6 +440,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ int nb = 0;
+ int count = 1;
+ int rc = NET_XMIT_SUCCESS;
++ int rc_drop = NET_XMIT_DROP;
+
+ /* Do not fool qdisc_drop_all() */
+ skb->prev = NULL;
+@@ -479,6 +480,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ q->duplicate = 0;
+ rootq->enqueue(skb2, rootq, to_free);
+ q->duplicate = dupsave;
++ rc_drop = NET_XMIT_SUCCESS;
+ }
+
+ /*
+@@ -491,7 +493,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ if (skb_is_gso(skb)) {
+ segs = netem_segment(skb, sch, to_free);
+ if (!segs)
+- return NET_XMIT_DROP;
++ return rc_drop;
+ } else {
+ segs = skb;
+ }
+@@ -514,8 +516,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ 1<<(prandom_u32() % 8);
+ }
+
+- if (unlikely(sch->q.qlen >= sch->limit))
+- return qdisc_drop_all(skb, sch, to_free);
++ if (unlikely(sch->q.qlen >= sch->limit)) {
++ qdisc_drop_all(skb, sch, to_free);
++ return rc_drop;
++ }
+
+ qdisc_qstats_backlog_inc(sch, skb);
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index e5e70cff5bb30..1b16250c5718d 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1884,6 +1884,7 @@ static int sctp_sendmsg_check_sflags(struct sctp_association *asoc,
+
+ pr_debug("%s: aborting association:%p\n", __func__, asoc);
+ sctp_primitive_ABORT(net, asoc, chunk);
++ iov_iter_revert(&msg->msg_iter, msg_len);
+
+ return 0;
+ }
+diff --git a/net/socket.c b/net/socket.c
+index 5c820212ba815..18d27b8c25116 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -577,6 +577,7 @@ static void __sock_release(struct socket *sock, struct inode *inode)
+ if (inode)
+ inode_lock(inode);
+ sock->ops->release(sock);
++ sock->sk = NULL;
+ if (inode)
+ inode_unlock(inode);
+ sock->ops = NULL;
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index e1bdaf056c8f7..88c307ef13181 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -377,11 +377,13 @@ static int tipc_sk_sock_err(struct socket *sock, long *timeout)
+
+ #define tipc_wait_for_cond(sock_, timeo_, condition_) \
+ ({ \
++ DEFINE_WAIT_FUNC(wait_, woken_wake_function); \
+ struct sock *sk_; \
+ int rc_; \
+ \
+ while ((rc_ = !(condition_))) { \
+- DEFINE_WAIT_FUNC(wait_, woken_wake_function); \
++ /* coupled with smp_wmb() in tipc_sk_proto_rcv() */ \
++ smp_rmb(); \
+ sk_ = (sock_)->sk; \
+ rc_ = tipc_sk_sock_err((sock_), timeo_); \
+ if (rc_) \
+@@ -1318,7 +1320,7 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen)
+
+ if (unlikely(!dest)) {
+ dest = &tsk->peer;
+- if (!syn || dest->family != AF_TIPC)
++ if (!syn && dest->family != AF_TIPC)
+ return -EDESTADDRREQ;
+ }
+
+@@ -1961,6 +1963,8 @@ static void tipc_sk_proto_rcv(struct sock *sk,
+ return;
+ case SOCK_WAKEUP:
+ tipc_dest_del(&tsk->cong_links, msg_orignode(hdr), 0);
++ /* coupled with smp_rmb() in tipc_wait_for_cond() */
++ smp_wmb();
+ tsk->cong_link_cnt--;
+ wakeup = true;
+ break;
+diff --git a/tools/testing/selftests/firmware/fw_lib.sh b/tools/testing/selftests/firmware/fw_lib.sh
+index 6c5f1b2ffb745..1cbb12e284a68 100755
+--- a/tools/testing/selftests/firmware/fw_lib.sh
++++ b/tools/testing/selftests/firmware/fw_lib.sh
+@@ -91,7 +91,7 @@ verify_reqs()
+ if [ "$TEST_REQS_FW_SYSFS_FALLBACK" = "yes" ]; then
+ if [ ! "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
+ echo "usermode helper disabled so ignoring test"
+- exit $ksft_skip
++ exit 0
+ fi
+ fi
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-03-13 22:08 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-03-13 22:08 UTC (permalink / raw
To: gentoo-commits
commit: 1f44abc4f0483b4c40349d848e8bbcd3ebb200ed
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 13 22:07:49 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 13 22:07:49 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=1f44abc4
proj/linux-patches: Linux patch 4.19.29
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1028_linux-4.19.29.patch | 6412 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6416 insertions(+)
diff --git a/0000_README b/0000_README
index 292278e..9c98a66 100644
--- a/0000_README
+++ b/0000_README
@@ -155,6 +155,10 @@ Patch: 1027_linux-4.19.28.patch
From: http://www.kernel.org
Desc: Linux 4.19.28
+Patch: 1028_linux-4.19.29.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.29
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1028_linux-4.19.29.patch b/1028_linux-4.19.29.patch
new file mode 100644
index 0000000..0eb9cf9
--- /dev/null
+++ b/1028_linux-4.19.29.patch
@@ -0,0 +1,6412 @@
+diff --git a/Makefile b/Makefile
+index c6ac023ba33a..6e526583291c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 28
++SUBLEVEL = 29
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi
+index 27a1ee28c3bb..94efca78c42f 100644
+--- a/arch/arm/boot/dts/exynos3250.dtsi
++++ b/arch/arm/boot/dts/exynos3250.dtsi
+@@ -168,6 +168,9 @@
+ interrupt-controller;
+ #interrupt-cells = <3>;
+ interrupt-parent = <&gic>;
++ clock-names = "clkout8";
++ clocks = <&cmu CLK_FIN_PLL>;
++ #clock-cells = <1>;
+ };
+
+ mipi_phy: video-phy {
+diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+index a09e46c9dbc0..00820d239753 100644
+--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
++++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+@@ -49,7 +49,7 @@
+ };
+
+ emmc_pwrseq: pwrseq {
+- pinctrl-0 = <&sd1_cd>;
++ pinctrl-0 = <&emmc_rstn>;
+ pinctrl-names = "default";
+ compatible = "mmc-pwrseq-emmc";
+ reset-gpios = <&gpk1 2 GPIO_ACTIVE_LOW>;
+@@ -161,12 +161,6 @@
+ cpu0-supply = <&buck2_reg>;
+ };
+
+-/* RSTN signal for eMMC */
+-&sd1_cd {
+- samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
+- samsung,pin-drv = <EXYNOS4_PIN_DRV_LV1>;
+-};
+-
+ &pinctrl_1 {
+ gpio_power_key: power_key {
+ samsung,pins = "gpx1-3";
+@@ -184,6 +178,11 @@
+ samsung,pins = "gpx3-7";
+ samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
+ };
++
++ emmc_rstn: emmc-rstn {
++ samsung,pins = "gpk1-2";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
+ };
+
+ &ehci {
+diff --git a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+index 2f4f40882dab..27214e6ebe4f 100644
+--- a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
++++ b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+@@ -334,7 +334,7 @@
+ buck8_reg: BUCK8 {
+ regulator-name = "vdd_1.8v_ldo";
+ regulator-min-microvolt = <800000>;
+- regulator-max-microvolt = <1500000>;
++ regulator-max-microvolt = <2000000>;
+ regulator-always-on;
+ regulator-boot-on;
+ };
+diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
+index 844caa39364f..50083cecc6c9 100644
+--- a/arch/arm/boot/dts/imx6sx.dtsi
++++ b/arch/arm/boot/dts/imx6sx.dtsi
+@@ -462,7 +462,7 @@
+ };
+
+ gpt: gpt@2098000 {
+- compatible = "fsl,imx6sx-gpt", "fsl,imx31-gpt";
++ compatible = "fsl,imx6sx-gpt", "fsl,imx6dl-gpt";
+ reg = <0x02098000 0x4000>;
+ interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX6SX_CLK_GPT_BUS>,
+diff --git a/arch/arm/boot/dts/meson.dtsi b/arch/arm/boot/dts/meson.dtsi
+index 0d9faf1a51ea..a86b89086334 100644
+--- a/arch/arm/boot/dts/meson.dtsi
++++ b/arch/arm/boot/dts/meson.dtsi
+@@ -263,7 +263,7 @@
+ compatible = "amlogic,meson6-dwmac", "snps,dwmac";
+ reg = <0xc9410000 0x10000
+ 0xc1108108 0x4>;
+- interrupts = <GIC_SPI 8 IRQ_TYPE_EDGE_RISING>;
++ interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "macirq";
+ status = "disabled";
+ };
+diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts
+index ef3177d3da3d..8fdeeffecbdb 100644
+--- a/arch/arm/boot/dts/meson8b-odroidc1.dts
++++ b/arch/arm/boot/dts/meson8b-odroidc1.dts
+@@ -125,7 +125,6 @@
+ /* Realtek RTL8211F (0x001cc916) */
+ eth_phy: ethernet-phy@0 {
+ reg = <0>;
+- eee-broken-1000t;
+ interrupt-parent = <&gpio_intc>;
+ /* GPIOH_3 */
+ interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
+@@ -172,8 +171,7 @@
+ cap-sd-highspeed;
+ disable-wp;
+
+- cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
+- cd-inverted;
++ cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
+
+ vmmc-supply = <&tflash_vdd>;
+ vqmmc-supply = <&tf_io>;
+diff --git a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
+index f5853610b20b..6ac02beb5fa7 100644
+--- a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
++++ b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts
+@@ -206,8 +206,7 @@
+ cap-sd-highspeed;
+ disable-wp;
+
+- cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
+- cd-inverted;
++ cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_LOW>;
+
+ vmmc-supply = <&vcc_3v3>;
+ };
+diff --git a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
+index ddc7a7bb33c0..f57acf8f66b9 100644
+--- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
++++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
+@@ -105,7 +105,7 @@
+ interrupts-extended = <
+ &cpcap 15 0 &cpcap 14 0 &cpcap 28 0 &cpcap 19 0
+ &cpcap 18 0 &cpcap 17 0 &cpcap 16 0 &cpcap 49 0
+- &cpcap 48 1
++ &cpcap 48 0
+ >;
+ interrupt-names =
+ "id_ground", "id_float", "se0conn", "vbusvld",
+diff --git a/arch/arm/boot/dts/omap3-n950-n9.dtsi b/arch/arm/boot/dts/omap3-n950-n9.dtsi
+index 0d9b85317529..e142e6c70a59 100644
+--- a/arch/arm/boot/dts/omap3-n950-n9.dtsi
++++ b/arch/arm/boot/dts/omap3-n950-n9.dtsi
+@@ -370,6 +370,19 @@
+ compatible = "ti,omap2-onenand";
+ reg = <0 0 0x20000>; /* CS0, offset 0, IO size 128K */
+
++ /*
++ * These timings are based on CONFIG_OMAP_GPMC_DEBUG=y reported
++ * bootloader set values when booted with v4.19 using both N950
++ * and N9 devices (OneNAND Manufacturer: Samsung):
++ *
++ * gpmc cs0 before gpmc_cs_program_settings:
++ * cs0 GPMC_CS_CONFIG1: 0xfd001202
++ * cs0 GPMC_CS_CONFIG2: 0x00181800
++ * cs0 GPMC_CS_CONFIG3: 0x00030300
++ * cs0 GPMC_CS_CONFIG4: 0x18001804
++ * cs0 GPMC_CS_CONFIG5: 0x03171d1d
++ * cs0 GPMC_CS_CONFIG6: 0x97080000
++ */
+ gpmc,sync-read;
+ gpmc,sync-write;
+ gpmc,burst-length = <16>;
+@@ -379,26 +392,27 @@
+ gpmc,device-width = <2>;
+ gpmc,mux-add-data = <2>;
+ gpmc,cs-on-ns = <0>;
+- gpmc,cs-rd-off-ns = <87>;
+- gpmc,cs-wr-off-ns = <87>;
++ gpmc,cs-rd-off-ns = <122>;
++ gpmc,cs-wr-off-ns = <122>;
+ gpmc,adv-on-ns = <0>;
+- gpmc,adv-rd-off-ns = <10>;
+- gpmc,adv-wr-off-ns = <10>;
+- gpmc,oe-on-ns = <15>;
+- gpmc,oe-off-ns = <87>;
++ gpmc,adv-rd-off-ns = <15>;
++ gpmc,adv-wr-off-ns = <15>;
++ gpmc,oe-on-ns = <20>;
++ gpmc,oe-off-ns = <122>;
+ gpmc,we-on-ns = <0>;
+- gpmc,we-off-ns = <87>;
+- gpmc,rd-cycle-ns = <112>;
+- gpmc,wr-cycle-ns = <112>;
+- gpmc,access-ns = <81>;
++ gpmc,we-off-ns = <122>;
++ gpmc,rd-cycle-ns = <148>;
++ gpmc,wr-cycle-ns = <148>;
++ gpmc,access-ns = <117>;
+ gpmc,page-burst-access-ns = <15>;
+ gpmc,bus-turnaround-ns = <0>;
+ gpmc,cycle2cycle-delay-ns = <0>;
+ gpmc,wait-monitoring-ns = <0>;
+- gpmc,clk-activation-ns = <5>;
+- gpmc,wr-data-mux-bus-ns = <30>;
+- gpmc,wr-access-ns = <81>;
+- gpmc,sync-clk-ps = <15000>;
++ gpmc,clk-activation-ns = <10>;
++ gpmc,wr-data-mux-bus-ns = <40>;
++ gpmc,wr-access-ns = <117>;
++
++ gpmc,sync-clk-ps = <15000>; /* TBC; Where this value came? */
+
+ /*
+ * MTD partition table corresponding to Nokia's MeeGo 1.2
+diff --git a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+index 5d23667dc2d2..25540b7694d5 100644
+--- a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
++++ b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+@@ -53,7 +53,7 @@
+
+ aliases {
+ serial0 = &uart0;
+- /* ethernet0 is the H3 emac, defined in sun8i-h3.dtsi */
++ ethernet0 = &emac;
+ ethernet1 = &sdiowifi;
+ };
+
+diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
+index ed36dcab80f1..f51919974183 100644
+--- a/arch/arm/plat-pxa/ssp.c
++++ b/arch/arm/plat-pxa/ssp.c
+@@ -190,8 +190,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)
+ if (ssp == NULL)
+ return -ENODEV;
+
+- iounmap(ssp->mmio_base);
+-
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ release_mem_region(res->start, resource_size(res));
+
+@@ -201,7 +199,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)
+ list_del(&ssp->node);
+ mutex_unlock(&ssp_lock);
+
+- kfree(ssp);
+ return 0;
+ }
+
+diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+index f4964bee6a1a..e80a792827ed 100644
+--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
++++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+@@ -118,6 +118,7 @@
+ reset-gpios = <&gpio0 5 GPIO_ACTIVE_LOW>;
+ clocks = <&pmic>;
+ clock-names = "ext_clock";
++ post-power-on-delay-ms = <10>;
+ power-off-delay-us = <10>;
+ };
+
+@@ -300,7 +301,6 @@
+
+ dwmmc_0: dwmmc0@f723d000 {
+ cap-mmc-highspeed;
+- mmc-hs200-1_8v;
+ non-removable;
+ bus-width = <0x8>;
+ vmmc-supply = <&ldo19>;
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index cd3865e7a270..8c86c41a0d25 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -399,7 +399,7 @@
+ };
+
+ intc: interrupt-controller@9bc0000 {
+- compatible = "arm,gic-v3";
++ compatible = "qcom,msm8996-gic-v3", "arm,gic-v3";
+ #interrupt-cells = <3>;
+ interrupt-controller;
+ #redistributor-regions = <1>;
+diff --git a/arch/arm64/boot/dts/renesas/r8a7796.dtsi b/arch/arm64/boot/dts/renesas/r8a7796.dtsi
+index cbd35c00b4af..33cb0281c39c 100644
+--- a/arch/arm64/boot/dts/renesas/r8a7796.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a7796.dtsi
+@@ -1161,6 +1161,9 @@
+ <&cpg CPG_CORE R8A7796_CLK_S3D1>,
+ <&scif_clk>;
+ clock-names = "fck", "brg_int", "scif_clk";
++ dmas = <&dmac1 0x13>, <&dmac1 0x12>,
++ <&dmac2 0x13>, <&dmac2 0x12>;
++ dma-names = "tx", "rx", "tx", "rx";
+ power-domains = <&sysc R8A7796_PD_ALWAYS_ON>;
+ resets = <&cpg 310>;
+ status = "disabled";
+diff --git a/arch/arm64/boot/dts/renesas/r8a77965.dtsi b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+index 0cd44461a0bd..f60f08ba1a6f 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77965.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+@@ -951,6 +951,9 @@
+ <&cpg CPG_CORE R8A77965_CLK_S3D1>,
+ <&scif_clk>;
+ clock-names = "fck", "brg_int", "scif_clk";
++ dmas = <&dmac1 0x13>, <&dmac1 0x12>,
++ <&dmac2 0x13>, <&dmac2 0x12>;
++ dma-names = "tx", "rx", "tx", "rx";
+ power-domains = <&sysc R8A77965_PD_ALWAYS_ON>;
+ resets = <&cpg 310>;
+ status = "disabled";
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts
+index eb5e8bddb610..8954c8c6f547 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts
+@@ -101,6 +101,7 @@
+ sdio_pwrseq: sdio_pwrseq {
+ compatible = "mmc-pwrseq-simple";
+ reset-gpios = <&gpio 7 GPIO_ACTIVE_LOW>; /* WIFI_EN */
++ post-power-on-delay-ms = <10>;
+ };
+ };
+
+diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
+index b5a367d4bba6..30bb13797034 100644
+--- a/arch/arm64/kernel/probes/kprobes.c
++++ b/arch/arm64/kernel/probes/kprobes.c
+@@ -478,13 +478,13 @@ bool arch_within_kprobe_blacklist(unsigned long addr)
+ addr < (unsigned long)__entry_text_end) ||
+ (addr >= (unsigned long)__idmap_text_start &&
+ addr < (unsigned long)__idmap_text_end) ||
++ (addr >= (unsigned long)__hyp_text_start &&
++ addr < (unsigned long)__hyp_text_end) ||
+ !!search_exception_tables(addr))
+ return true;
+
+ if (!is_kernel_in_hyp_mode()) {
+- if ((addr >= (unsigned long)__hyp_text_start &&
+- addr < (unsigned long)__hyp_text_end) ||
+- (addr >= (unsigned long)__hyp_idmap_text_start &&
++ if ((addr >= (unsigned long)__hyp_idmap_text_start &&
+ addr < (unsigned long)__hyp_idmap_text_end))
+ return true;
+ }
+diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts
+index 50cff3cbcc6d..4f7b1fa31cf5 100644
+--- a/arch/mips/boot/dts/ingenic/ci20.dts
++++ b/arch/mips/boot/dts/ingenic/ci20.dts
+@@ -76,7 +76,7 @@
+ status = "okay";
+
+ pinctrl-names = "default";
+- pinctrl-0 = <&pins_uart2>;
++ pinctrl-0 = <&pins_uart3>;
+ };
+
+ &uart4 {
+@@ -196,9 +196,9 @@
+ bias-disable;
+ };
+
+- pins_uart2: uart2 {
+- function = "uart2";
+- groups = "uart2-data", "uart2-hwflow";
++ pins_uart3: uart3 {
++ function = "uart3";
++ groups = "uart3-data", "uart3-hwflow";
+ bias-disable;
+ };
+
+diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
+index d4f7fd4550e1..85522c137f19 100644
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -371,7 +371,7 @@ static inline int is_sp_move_ins(union mips_instruction *ip, int *frame_size)
+ static int get_frame_info(struct mips_frame_info *info)
+ {
+ bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS);
+- union mips_instruction insn, *ip, *ip_end;
++ union mips_instruction insn, *ip;
+ const unsigned int max_insns = 128;
+ unsigned int last_insn_size = 0;
+ unsigned int i;
+@@ -384,10 +384,9 @@ static int get_frame_info(struct mips_frame_info *info)
+ if (!ip)
+ goto err;
+
+- ip_end = (void *)ip + info->func_size;
+-
+- for (i = 0; i < max_insns && ip < ip_end; i++) {
++ for (i = 0; i < max_insns; i++) {
+ ip = (void *)ip + last_insn_size;
++
+ if (is_mmips && mm_insn_16bit(ip->halfword[0])) {
+ insn.word = ip->halfword[0] << 16;
+ last_insn_size = 2;
+diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h
+index 3fe4af8147d2..c23578a37b44 100644
+--- a/arch/riscv/include/asm/processor.h
++++ b/arch/riscv/include/asm/processor.h
+@@ -22,7 +22,7 @@
+ * This decides where the kernel will search for a free chunk of vm
+ * space during mmap's.
+ */
+-#define TASK_UNMAPPED_BASE PAGE_ALIGN(TASK_SIZE >> 1)
++#define TASK_UNMAPPED_BASE PAGE_ALIGN(TASK_SIZE / 3)
+
+ #define STACK_TOP TASK_SIZE
+ #define STACK_TOP_MAX STACK_TOP
+diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
+index b2d26d9d8489..9713d4e8c22b 100644
+--- a/arch/riscv/kernel/setup.c
++++ b/arch/riscv/kernel/setup.c
+@@ -186,7 +186,7 @@ static void __init setup_bootmem(void)
+ BUG_ON(mem_size == 0);
+
+ set_max_mapnr(PFN_DOWN(mem_size));
+- max_low_pfn = memblock_end_of_DRAM();
++ max_low_pfn = PFN_DOWN(memblock_end_of_DRAM());
+
+ #ifdef CONFIG_BLK_DEV_INITRD
+ setup_initrd();
+diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
+index 58a522f9bcc3..200a4b315e15 100644
+--- a/arch/riscv/mm/init.c
++++ b/arch/riscv/mm/init.c
+@@ -29,7 +29,8 @@ static void __init zone_sizes_init(void)
+ unsigned long max_zone_pfns[MAX_NR_ZONES] = { 0, };
+
+ #ifdef CONFIG_ZONE_DMA32
+- max_zone_pfns[ZONE_DMA32] = PFN_DOWN(min(4UL * SZ_1G, max_low_pfn));
++ max_zone_pfns[ZONE_DMA32] = PFN_DOWN(min(4UL * SZ_1G,
++ (unsigned long) PFN_PHYS(max_low_pfn)));
+ #endif
+ max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
+
+diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
+index 64037895b085..f105ae8651c9 100644
+--- a/arch/x86/boot/compressed/head_64.S
++++ b/arch/x86/boot/compressed/head_64.S
+@@ -600,6 +600,14 @@ ENTRY(trampoline_32bit_src)
+ leal TRAMPOLINE_32BIT_PGTABLE_OFFSET(%ecx), %eax
+ movl %eax, %cr3
+ 3:
++ /* Set EFER.LME=1 as a precaution in case hypervsior pulls the rug */
++ pushl %ecx
++ movl $MSR_EFER, %ecx
++ rdmsr
++ btsl $_EFER_LME, %eax
++ wrmsr
++ popl %ecx
++
+ /* Enable PAE and LA57 (if required) paging modes */
+ movl $X86_CR4_PAE, %eax
+ cmpl $0, %edx
+diff --git a/arch/x86/boot/compressed/pgtable.h b/arch/x86/boot/compressed/pgtable.h
+index 91f75638f6e6..6ff7e81b5628 100644
+--- a/arch/x86/boot/compressed/pgtable.h
++++ b/arch/x86/boot/compressed/pgtable.h
+@@ -6,7 +6,7 @@
+ #define TRAMPOLINE_32BIT_PGTABLE_OFFSET 0
+
+ #define TRAMPOLINE_32BIT_CODE_OFFSET PAGE_SIZE
+-#define TRAMPOLINE_32BIT_CODE_SIZE 0x60
++#define TRAMPOLINE_32BIT_CODE_SIZE 0x70
+
+ #define TRAMPOLINE_32BIT_STACK_END TRAMPOLINE_32BIT_SIZE
+
+diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
+index c04a8813cff9..a41554350893 100644
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -1970,7 +1970,7 @@ static int x86_pmu_commit_txn(struct pmu *pmu)
+ */
+ static void free_fake_cpuc(struct cpu_hw_events *cpuc)
+ {
+- kfree(cpuc->shared_regs);
++ intel_cpuc_finish(cpuc);
+ kfree(cpuc);
+ }
+
+@@ -1982,14 +1982,11 @@ static struct cpu_hw_events *allocate_fake_cpuc(void)
+ cpuc = kzalloc(sizeof(*cpuc), GFP_KERNEL);
+ if (!cpuc)
+ return ERR_PTR(-ENOMEM);
+-
+- /* only needed, if we have extra_regs */
+- if (x86_pmu.extra_regs) {
+- cpuc->shared_regs = allocate_shared_regs(cpu);
+- if (!cpuc->shared_regs)
+- goto error;
+- }
+ cpuc->is_fake = 1;
++
++ if (intel_cpuc_prepare(cpuc, cpu))
++ goto error;
++
+ return cpuc;
+ error:
+ free_fake_cpuc(cpuc);
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index fbd7551a8d44..220b40b75e6f 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -1995,6 +1995,39 @@ static void intel_pmu_nhm_enable_all(int added)
+ intel_pmu_enable_all(added);
+ }
+
++static void intel_set_tfa(struct cpu_hw_events *cpuc, bool on)
++{
++ u64 val = on ? MSR_TFA_RTM_FORCE_ABORT : 0;
++
++ if (cpuc->tfa_shadow != val) {
++ cpuc->tfa_shadow = val;
++ wrmsrl(MSR_TSX_FORCE_ABORT, val);
++ }
++}
++
++static void intel_tfa_commit_scheduling(struct cpu_hw_events *cpuc, int idx, int cntr)
++{
++ /*
++ * We're going to use PMC3, make sure TFA is set before we touch it.
++ */
++ if (cntr == 3 && !cpuc->is_fake)
++ intel_set_tfa(cpuc, true);
++}
++
++static void intel_tfa_pmu_enable_all(int added)
++{
++ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
++
++ /*
++ * If we find PMC3 is no longer used when we enable the PMU, we can
++ * clear TFA.
++ */
++ if (!test_bit(3, cpuc->active_mask))
++ intel_set_tfa(cpuc, false);
++
++ intel_pmu_enable_all(added);
++}
++
+ static inline u64 intel_pmu_get_status(void)
+ {
+ u64 status;
+@@ -2652,6 +2685,35 @@ intel_stop_scheduling(struct cpu_hw_events *cpuc)
+ raw_spin_unlock(&excl_cntrs->lock);
+ }
+
++static struct event_constraint *
++dyn_constraint(struct cpu_hw_events *cpuc, struct event_constraint *c, int idx)
++{
++ WARN_ON_ONCE(!cpuc->constraint_list);
++
++ if (!(c->flags & PERF_X86_EVENT_DYNAMIC)) {
++ struct event_constraint *cx;
++
++ /*
++ * grab pre-allocated constraint entry
++ */
++ cx = &cpuc->constraint_list[idx];
++
++ /*
++ * initialize dynamic constraint
++ * with static constraint
++ */
++ *cx = *c;
++
++ /*
++ * mark constraint as dynamic
++ */
++ cx->flags |= PERF_X86_EVENT_DYNAMIC;
++ c = cx;
++ }
++
++ return c;
++}
++
+ static struct event_constraint *
+ intel_get_excl_constraints(struct cpu_hw_events *cpuc, struct perf_event *event,
+ int idx, struct event_constraint *c)
+@@ -2682,27 +2744,7 @@ intel_get_excl_constraints(struct cpu_hw_events *cpuc, struct perf_event *event,
+ * only needed when constraint has not yet
+ * been cloned (marked dynamic)
+ */
+- if (!(c->flags & PERF_X86_EVENT_DYNAMIC)) {
+- struct event_constraint *cx;
+-
+- /*
+- * grab pre-allocated constraint entry
+- */
+- cx = &cpuc->constraint_list[idx];
+-
+- /*
+- * initialize dynamic constraint
+- * with static constraint
+- */
+- *cx = *c;
+-
+- /*
+- * mark constraint as dynamic, so we
+- * can free it later on
+- */
+- cx->flags |= PERF_X86_EVENT_DYNAMIC;
+- c = cx;
+- }
++ c = dyn_constraint(cpuc, c, idx);
+
+ /*
+ * From here on, the constraint is dynamic.
+@@ -3229,6 +3271,26 @@ glp_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
+ return c;
+ }
+
++static bool allow_tsx_force_abort = true;
++
++static struct event_constraint *
++tfa_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
++ struct perf_event *event)
++{
++ struct event_constraint *c = hsw_get_event_constraints(cpuc, idx, event);
++
++ /*
++ * Without TFA we must not use PMC3.
++ */
++ if (!allow_tsx_force_abort && test_bit(3, c->idxmsk)) {
++ c = dyn_constraint(cpuc, c, idx);
++ c->idxmsk64 &= ~(1ULL << 3);
++ c->weight--;
++ }
++
++ return c;
++}
++
+ /*
+ * Broadwell:
+ *
+@@ -3282,7 +3344,7 @@ ssize_t intel_event_sysfs_show(char *page, u64 config)
+ return x86_event_sysfs_show(page, config, event);
+ }
+
+-struct intel_shared_regs *allocate_shared_regs(int cpu)
++static struct intel_shared_regs *allocate_shared_regs(int cpu)
+ {
+ struct intel_shared_regs *regs;
+ int i;
+@@ -3314,23 +3376,24 @@ static struct intel_excl_cntrs *allocate_excl_cntrs(int cpu)
+ return c;
+ }
+
+-static int intel_pmu_cpu_prepare(int cpu)
+-{
+- struct cpu_hw_events *cpuc = &per_cpu(cpu_hw_events, cpu);
+
++int intel_cpuc_prepare(struct cpu_hw_events *cpuc, int cpu)
++{
+ if (x86_pmu.extra_regs || x86_pmu.lbr_sel_map) {
+ cpuc->shared_regs = allocate_shared_regs(cpu);
+ if (!cpuc->shared_regs)
+ goto err;
+ }
+
+- if (x86_pmu.flags & PMU_FL_EXCL_CNTRS) {
++ if (x86_pmu.flags & (PMU_FL_EXCL_CNTRS | PMU_FL_TFA)) {
+ size_t sz = X86_PMC_IDX_MAX * sizeof(struct event_constraint);
+
+- cpuc->constraint_list = kzalloc(sz, GFP_KERNEL);
++ cpuc->constraint_list = kzalloc_node(sz, GFP_KERNEL, cpu_to_node(cpu));
+ if (!cpuc->constraint_list)
+ goto err_shared_regs;
++ }
+
++ if (x86_pmu.flags & PMU_FL_EXCL_CNTRS) {
+ cpuc->excl_cntrs = allocate_excl_cntrs(cpu);
+ if (!cpuc->excl_cntrs)
+ goto err_constraint_list;
+@@ -3352,6 +3415,11 @@ err:
+ return -ENOMEM;
+ }
+
++static int intel_pmu_cpu_prepare(int cpu)
++{
++ return intel_cpuc_prepare(&per_cpu(cpu_hw_events, cpu), cpu);
++}
++
+ static void flip_smm_bit(void *data)
+ {
+ unsigned long set = *(unsigned long *)data;
+@@ -3423,9 +3491,8 @@ static void intel_pmu_cpu_starting(int cpu)
+ }
+ }
+
+-static void free_excl_cntrs(int cpu)
++static void free_excl_cntrs(struct cpu_hw_events *cpuc)
+ {
+- struct cpu_hw_events *cpuc = &per_cpu(cpu_hw_events, cpu);
+ struct intel_excl_cntrs *c;
+
+ c = cpuc->excl_cntrs;
+@@ -3433,9 +3500,10 @@ static void free_excl_cntrs(int cpu)
+ if (c->core_id == -1 || --c->refcnt == 0)
+ kfree(c);
+ cpuc->excl_cntrs = NULL;
+- kfree(cpuc->constraint_list);
+- cpuc->constraint_list = NULL;
+ }
++
++ kfree(cpuc->constraint_list);
++ cpuc->constraint_list = NULL;
+ }
+
+ static void intel_pmu_cpu_dying(int cpu)
+@@ -3443,9 +3511,8 @@ static void intel_pmu_cpu_dying(int cpu)
+ fini_debug_store_on_cpu(cpu);
+ }
+
+-static void intel_pmu_cpu_dead(int cpu)
++void intel_cpuc_finish(struct cpu_hw_events *cpuc)
+ {
+- struct cpu_hw_events *cpuc = &per_cpu(cpu_hw_events, cpu);
+ struct intel_shared_regs *pc;
+
+ pc = cpuc->shared_regs;
+@@ -3455,7 +3522,12 @@ static void intel_pmu_cpu_dead(int cpu)
+ cpuc->shared_regs = NULL;
+ }
+
+- free_excl_cntrs(cpu);
++ free_excl_cntrs(cpuc);
++}
++
++static void intel_pmu_cpu_dead(int cpu)
++{
++ intel_cpuc_finish(&per_cpu(cpu_hw_events, cpu));
+ }
+
+ static void intel_pmu_sched_task(struct perf_event_context *ctx,
+@@ -3917,8 +3989,11 @@ static struct attribute *intel_pmu_caps_attrs[] = {
+ NULL
+ };
+
++DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort);
++
+ static struct attribute *intel_pmu_attrs[] = {
+ &dev_attr_freeze_on_smi.attr,
++ NULL, /* &dev_attr_allow_tsx_force_abort.attr.attr */
+ NULL,
+ };
+
+@@ -4374,6 +4449,15 @@ __init int intel_pmu_init(void)
+ x86_pmu.cpu_events = get_hsw_events_attrs();
+ intel_pmu_pebs_data_source_skl(
+ boot_cpu_data.x86_model == INTEL_FAM6_SKYLAKE_X);
++
++ if (boot_cpu_has(X86_FEATURE_TSX_FORCE_ABORT)) {
++ x86_pmu.flags |= PMU_FL_TFA;
++ x86_pmu.get_event_constraints = tfa_get_event_constraints;
++ x86_pmu.enable_all = intel_tfa_pmu_enable_all;
++ x86_pmu.commit_scheduling = intel_tfa_commit_scheduling;
++ intel_pmu_attrs[1] = &dev_attr_allow_tsx_force_abort.attr.attr;
++ }
++
+ pr_cont("Skylake events, ");
+ name = "skylake";
+ break;
+@@ -4515,7 +4599,7 @@ static __init int fixup_ht_bug(void)
+ hardlockup_detector_perf_restart();
+
+ for_each_online_cpu(c)
+- free_excl_cntrs(c);
++ free_excl_cntrs(&per_cpu(cpu_hw_events, c));
+
+ cpus_read_unlock();
+ pr_info("PMU erratum BJ122, BV98, HSD29 workaround disabled, HT off\n");
+diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
+index 0ee3a441ad79..5c424009b71f 100644
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -242,6 +242,11 @@ struct cpu_hw_events {
+ struct intel_excl_cntrs *excl_cntrs;
+ int excl_thread_id; /* 0 or 1 */
+
++ /*
++ * SKL TSX_FORCE_ABORT shadow
++ */
++ u64 tfa_shadow;
++
+ /*
+ * AMD specific bits
+ */
+@@ -679,6 +684,7 @@ do { \
+ #define PMU_FL_EXCL_CNTRS 0x4 /* has exclusive counter requirements */
+ #define PMU_FL_EXCL_ENABLED 0x8 /* exclusive counter active */
+ #define PMU_FL_PEBS_ALL 0x10 /* all events are valid PEBS events */
++#define PMU_FL_TFA 0x20 /* deal with TSX force abort */
+
+ #define EVENT_VAR(_id) event_attr_##_id
+ #define EVENT_PTR(_id) &event_attr_##_id.attr.attr
+@@ -887,7 +893,8 @@ struct event_constraint *
+ x86_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
+ struct perf_event *event);
+
+-struct intel_shared_regs *allocate_shared_regs(int cpu);
++extern int intel_cpuc_prepare(struct cpu_hw_events *cpuc, int cpu);
++extern void intel_cpuc_finish(struct cpu_hw_events *cpuc);
+
+ int intel_pmu_init(void);
+
+@@ -1023,9 +1030,13 @@ static inline int intel_pmu_init(void)
+ return 0;
+ }
+
+-static inline struct intel_shared_regs *allocate_shared_regs(int cpu)
++static inline int intel_cpuc_prepare(struct cpu_hw_event *cpuc, int cpu)
++{
++ return 0;
++}
++
++static inline void intel_cpuc_finish(struct cpu_hw_event *cpuc)
+ {
+- return NULL;
+ }
+
+ static inline int is_ht_workaround_enabled(void)
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 89a048c2faec..7b31ee5223fc 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -340,6 +340,7 @@
+ /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
+ #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */
+ #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
++#define X86_FEATURE_TSX_FORCE_ABORT (18*32+13) /* "" TSX_FORCE_ABORT */
+ #define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */
+ #define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */
+ #define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 1f9de7635bcb..f14ca0be1e3f 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -629,6 +629,12 @@
+
+ #define MSR_IA32_TSC_DEADLINE 0x000006E0
+
++
++#define MSR_TSX_FORCE_ABORT 0x0000010F
++
++#define MSR_TFA_RTM_FORCE_ABORT_BIT 0
++#define MSR_TFA_RTM_FORCE_ABORT BIT_ULL(MSR_TFA_RTM_FORCE_ABORT_BIT)
++
+ /* P4/Xeon+ specific */
+ #define MSR_IA32_MCG_EAX 0x00000180
+ #define MSR_IA32_MCG_EBX 0x00000181
+diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
+index b99d497e342d..0b6352aabbd3 100644
+--- a/arch/x86/include/asm/page_64_types.h
++++ b/arch/x86/include/asm/page_64_types.h
+@@ -7,7 +7,11 @@
+ #endif
+
+ #ifdef CONFIG_KASAN
++#ifdef CONFIG_KASAN_EXTRA
++#define KASAN_STACK_ORDER 2
++#else
+ #define KASAN_STACK_ORDER 1
++#endif
+ #else
+ #define KASAN_STACK_ORDER 0
+ #endif
+diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
+index 07b5fc00b188..a4e7e100ed26 100644
+--- a/arch/x86/kernel/cpu/microcode/amd.c
++++ b/arch/x86/kernel/cpu/microcode/amd.c
+@@ -707,7 +707,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
+ if (!p) {
+ return ret;
+ } else {
+- if (boot_cpu_data.microcode == p->patch_id)
++ if (boot_cpu_data.microcode >= p->patch_id)
+ return ret;
+
+ ret = UCODE_NEW;
+diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
+index 278cd07228dd..9490a2845f14 100644
+--- a/arch/x86/kernel/kexec-bzimage64.c
++++ b/arch/x86/kernel/kexec-bzimage64.c
+@@ -167,6 +167,9 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
+ struct efi_info *current_ei = &boot_params.efi_info;
+ struct efi_info *ei = ¶ms->efi_info;
+
++ if (!efi_enabled(EFI_RUNTIME_SERVICES))
++ return 0;
++
+ if (!current_ei->efi_memmap_size)
+ return 0;
+
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index 13f4485ca388..bd372e896557 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -641,6 +641,22 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334b, quirk_no_aersid);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334c, quirk_no_aersid);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334d, quirk_no_aersid);
+
++static void quirk_intel_th_dnv(struct pci_dev *dev)
++{
++ struct resource *r = &dev->resource[4];
++
++ /*
++ * Denverton reports 2k of RTIT_BAR (intel_th resource 4), which
++ * appears to be 4 MB in reality.
++ */
++ if (r->end == r->start + 0x7ff) {
++ r->start = 0;
++ r->end = 0x3fffff;
++ r->flags |= IORESOURCE_UNSET;
++ }
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x19e1, quirk_intel_th_dnv);
++
+ #ifdef CONFIG_PHYS_ADDR_T_64BIT
+
+ #define AMD_141b_MMIO_BASE(x) (0x80 + (x) * 0x8)
+diff --git a/arch/xtensa/configs/smp_lx200_defconfig b/arch/xtensa/configs/smp_lx200_defconfig
+index 11fed6c06a7c..b5938160fb3d 100644
+--- a/arch/xtensa/configs/smp_lx200_defconfig
++++ b/arch/xtensa/configs/smp_lx200_defconfig
+@@ -33,6 +33,7 @@ CONFIG_SMP=y
+ CONFIG_HOTPLUG_CPU=y
+ # CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set
+ # CONFIG_PCI is not set
++CONFIG_VECTORS_OFFSET=0x00002000
+ CONFIG_XTENSA_PLATFORM_XTFPGA=y
+ CONFIG_CMDLINE_BOOL=y
+ CONFIG_CMDLINE="earlycon=uart8250,mmio32native,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug memmap=96M@0"
+diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
+index 9053a5622d2c..5bd38ea2da38 100644
+--- a/arch/xtensa/kernel/head.S
++++ b/arch/xtensa/kernel/head.S
+@@ -280,12 +280,13 @@ should_never_return:
+
+ movi a2, cpu_start_ccount
+ 1:
++ memw
+ l32i a3, a2, 0
+ beqi a3, 0, 1b
+ movi a3, 0
+ s32i a3, a2, 0
+- memw
+ 1:
++ memw
+ l32i a3, a2, 0
+ beqi a3, 0, 1b
+ wsr a3, ccount
+@@ -321,11 +322,13 @@ ENTRY(cpu_restart)
+ rsr a0, prid
+ neg a2, a0
+ movi a3, cpu_start_id
++ memw
+ s32i a2, a3, 0
+ #if XCHAL_DCACHE_IS_WRITEBACK
+ dhwbi a3, 0
+ #endif
+ 1:
++ memw
+ l32i a2, a3, 0
+ dhi a3, 0
+ bne a2, a0, 1b
+diff --git a/arch/xtensa/kernel/smp.c b/arch/xtensa/kernel/smp.c
+index 932d64689bac..be1f280c322c 100644
+--- a/arch/xtensa/kernel/smp.c
++++ b/arch/xtensa/kernel/smp.c
+@@ -83,7 +83,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
+ {
+ unsigned i;
+
+- for (i = 0; i < max_cpus; ++i)
++ for_each_possible_cpu(i)
+ set_cpu_present(i, true);
+ }
+
+@@ -96,6 +96,11 @@ void __init smp_init_cpus(void)
+ pr_info("%s: Core Count = %d\n", __func__, ncpus);
+ pr_info("%s: Core Id = %d\n", __func__, core_id);
+
++ if (ncpus > NR_CPUS) {
++ ncpus = NR_CPUS;
++ pr_info("%s: limiting core count by %d\n", __func__, ncpus);
++ }
++
+ for (i = 0; i < ncpus; ++i)
+ set_cpu_possible(i, true);
+ }
+@@ -195,9 +200,11 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)
+ int i;
+
+ #ifdef CONFIG_HOTPLUG_CPU
+- cpu_start_id = cpu;
+- system_flush_invalidate_dcache_range(
+- (unsigned long)&cpu_start_id, sizeof(cpu_start_id));
++ WRITE_ONCE(cpu_start_id, cpu);
++ /* Pairs with the third memw in the cpu_restart */
++ mb();
++ system_flush_invalidate_dcache_range((unsigned long)&cpu_start_id,
++ sizeof(cpu_start_id));
+ #endif
+ smp_call_function_single(0, mx_cpu_start, (void *)cpu, 1);
+
+@@ -206,18 +213,21 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)
+ ccount = get_ccount();
+ while (!ccount);
+
+- cpu_start_ccount = ccount;
++ WRITE_ONCE(cpu_start_ccount, ccount);
+
+- while (time_before(jiffies, timeout)) {
++ do {
++ /*
++ * Pairs with the first two memws in the
++ * .Lboot_secondary.
++ */
+ mb();
+- if (!cpu_start_ccount)
+- break;
+- }
++ ccount = READ_ONCE(cpu_start_ccount);
++ } while (ccount && time_before(jiffies, timeout));
+
+- if (cpu_start_ccount) {
++ if (ccount) {
+ smp_call_function_single(0, mx_cpu_stop,
+- (void *)cpu, 1);
+- cpu_start_ccount = 0;
++ (void *)cpu, 1);
++ WRITE_ONCE(cpu_start_ccount, 0);
+ return -EIO;
+ }
+ }
+@@ -237,6 +247,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ pr_debug("%s: Calling wakeup_secondary(cpu:%d, idle:%p, sp: %08lx)\n",
+ __func__, cpu, idle, start_info.stack);
+
++ init_completion(&cpu_running);
+ ret = boot_secondary(cpu, idle);
+ if (ret == 0) {
+ wait_for_completion_timeout(&cpu_running,
+@@ -298,8 +309,10 @@ void __cpu_die(unsigned int cpu)
+ unsigned long timeout = jiffies + msecs_to_jiffies(1000);
+ while (time_before(jiffies, timeout)) {
+ system_invalidate_dcache_range((unsigned long)&cpu_start_id,
+- sizeof(cpu_start_id));
+- if (cpu_start_id == -cpu) {
++ sizeof(cpu_start_id));
++ /* Pairs with the second memw in the cpu_restart */
++ mb();
++ if (READ_ONCE(cpu_start_id) == -cpu) {
+ platform_cpu_kill(cpu);
+ return;
+ }
+diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c
+index fd524a54d2ab..378186b5eb40 100644
+--- a/arch/xtensa/kernel/time.c
++++ b/arch/xtensa/kernel/time.c
+@@ -89,7 +89,7 @@ static int ccount_timer_shutdown(struct clock_event_device *evt)
+ container_of(evt, struct ccount_timer, evt);
+
+ if (timer->irq_enabled) {
+- disable_irq(evt->irq);
++ disable_irq_nosync(evt->irq);
+ timer->irq_enabled = 0;
+ }
+ return 0;
+diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
+index 19923f8a029d..b154e057ca67 100644
+--- a/block/blk-iolatency.c
++++ b/block/blk-iolatency.c
+@@ -72,6 +72,7 @@
+ #include <linux/sched/loadavg.h>
+ #include <linux/sched/signal.h>
+ #include <trace/events/block.h>
++#include <linux/blk-mq.h>
+ #include "blk-rq-qos.h"
+ #include "blk-stat.h"
+
+@@ -568,6 +569,9 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+ return;
+
+ enabled = blk_iolatency_enabled(iolat->blkiolat);
++ if (!enabled)
++ return;
++
+ while (blkg && blkg->parent) {
+ iolat = blkg_to_lat(blkg);
+ if (!iolat) {
+@@ -577,7 +581,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+ rqw = &iolat->rq_wait;
+
+ atomic_dec(&rqw->inflight);
+- if (!enabled || iolat->min_lat_nsec == 0)
++ if (iolat->min_lat_nsec == 0)
+ goto next;
+ iolatency_record_time(iolat, &bio->bi_issue, now,
+ issue_as_root);
+@@ -721,10 +725,13 @@ int blk_iolatency_init(struct request_queue *q)
+ return 0;
+ }
+
+-static void iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val)
++/*
++ * return 1 for enabling iolatency, return -1 for disabling iolatency, otherwise
++ * return 0.
++ */
++static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val)
+ {
+ struct iolatency_grp *iolat = blkg_to_lat(blkg);
+- struct blk_iolatency *blkiolat = iolat->blkiolat;
+ u64 oldval = iolat->min_lat_nsec;
+
+ iolat->min_lat_nsec = val;
+@@ -733,9 +740,10 @@ static void iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val)
+ BLKIOLATENCY_MAX_WIN_SIZE);
+
+ if (!oldval && val)
+- atomic_inc(&blkiolat->enabled);
++ return 1;
+ if (oldval && !val)
+- atomic_dec(&blkiolat->enabled);
++ return -1;
++ return 0;
+ }
+
+ static void iolatency_clear_scaling(struct blkcg_gq *blkg)
+@@ -768,6 +776,7 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf,
+ u64 lat_val = 0;
+ u64 oldval;
+ int ret;
++ int enable = 0;
+
+ ret = blkg_conf_prep(blkcg, &blkcg_policy_iolatency, buf, &ctx);
+ if (ret)
+@@ -803,7 +812,12 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf,
+ blkg = ctx.blkg;
+ oldval = iolat->min_lat_nsec;
+
+- iolatency_set_min_lat_nsec(blkg, lat_val);
++ enable = iolatency_set_min_lat_nsec(blkg, lat_val);
++ if (enable) {
++ WARN_ON_ONCE(!blk_get_queue(blkg->q));
++ blkg_get(blkg);
++ }
++
+ if (oldval != iolat->min_lat_nsec) {
+ iolatency_clear_scaling(blkg);
+ }
+@@ -811,6 +825,24 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf,
+ ret = 0;
+ out:
+ blkg_conf_finish(&ctx);
++ if (ret == 0 && enable) {
++ struct iolatency_grp *tmp = blkg_to_lat(blkg);
++ struct blk_iolatency *blkiolat = tmp->blkiolat;
++
++ blk_mq_freeze_queue(blkg->q);
++
++ if (enable == 1)
++ atomic_inc(&blkiolat->enabled);
++ else if (enable == -1)
++ atomic_dec(&blkiolat->enabled);
++ else
++ WARN_ON_ONCE(1);
++
++ blk_mq_unfreeze_queue(blkg->q);
++
++ blkg_put(blkg);
++ blk_put_queue(blkg->q);
++ }
+ return ret ?: nbytes;
+ }
+
+@@ -910,8 +942,14 @@ static void iolatency_pd_offline(struct blkg_policy_data *pd)
+ {
+ struct iolatency_grp *iolat = pd_to_lat(pd);
+ struct blkcg_gq *blkg = lat_to_blkg(iolat);
++ struct blk_iolatency *blkiolat = iolat->blkiolat;
++ int ret;
+
+- iolatency_set_min_lat_nsec(blkg, 0);
++ ret = iolatency_set_min_lat_nsec(blkg, 0);
++ if (ret == 1)
++ atomic_inc(&blkiolat->enabled);
++ if (ret == -1)
++ atomic_dec(&blkiolat->enabled);
+ iolatency_clear_scaling(blkg);
+ }
+
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 7caa1adaf62a..f5b74856784a 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -963,9 +963,9 @@ static void __device_release_driver(struct device *dev, struct device *parent)
+ drv->remove(dev);
+
+ device_links_driver_cleanup(dev);
+- dma_deconfigure(dev);
+
+ devres_release_all(dev);
++ dma_deconfigure(dev);
+ dev->driver = NULL;
+ dev_set_drvdata(dev, NULL);
+ if (dev->pm_domain && dev->pm_domain->dismiss)
+diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
+index fa1a196350f1..3bf11a620094 100644
+--- a/drivers/clk/qcom/gcc-sdm845.c
++++ b/drivers/clk/qcom/gcc-sdm845.c
+@@ -131,8 +131,8 @@ static const char * const gcc_parent_names_6[] = {
+ "core_bi_pll_test_se",
+ };
+
+-static const char * const gcc_parent_names_7[] = {
+- "bi_tcxo",
++static const char * const gcc_parent_names_7_ao[] = {
++ "bi_tcxo_ao",
+ "gpll0",
+ "gpll0_out_even",
+ "core_bi_pll_test_se",
+@@ -144,6 +144,12 @@ static const char * const gcc_parent_names_8[] = {
+ "core_bi_pll_test_se",
+ };
+
++static const char * const gcc_parent_names_8_ao[] = {
++ "bi_tcxo_ao",
++ "gpll0",
++ "core_bi_pll_test_se",
++};
++
+ static const struct parent_map gcc_parent_map_10[] = {
+ { P_BI_TCXO, 0 },
+ { P_GPLL0_OUT_MAIN, 1 },
+@@ -226,7 +232,7 @@ static struct clk_rcg2 gcc_cpuss_ahb_clk_src = {
+ .freq_tbl = ftbl_gcc_cpuss_ahb_clk_src,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gcc_cpuss_ahb_clk_src",
+- .parent_names = gcc_parent_names_7,
++ .parent_names = gcc_parent_names_7_ao,
+ .num_parents = 4,
+ .ops = &clk_rcg2_ops,
+ },
+@@ -245,7 +251,7 @@ static struct clk_rcg2 gcc_cpuss_rbcpr_clk_src = {
+ .freq_tbl = ftbl_gcc_cpuss_rbcpr_clk_src,
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gcc_cpuss_rbcpr_clk_src",
+- .parent_names = gcc_parent_names_8,
++ .parent_names = gcc_parent_names_8_ao,
+ .num_parents = 3,
+ .ops = &clk_rcg2_ops,
+ },
+diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
+index ccfb4d9a152a..079f0beda8b6 100644
+--- a/drivers/clk/ti/divider.c
++++ b/drivers/clk/ti/divider.c
+@@ -367,8 +367,10 @@ int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div,
+ num_dividers = i;
+
+ tmp = kcalloc(valid_div + 1, sizeof(*tmp), GFP_KERNEL);
+- if (!tmp)
++ if (!tmp) {
++ *table = ERR_PTR(-ENOMEM);
+ return -ENOMEM;
++ }
+
+ valid_div = 0;
+ *width = 0;
+@@ -403,6 +405,7 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
+ {
+ struct clk_omap_divider *div;
+ struct clk_omap_reg *reg;
++ int ret;
+
+ if (!setup)
+ return NULL;
+@@ -422,6 +425,12 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
+ div->flags |= CLK_DIVIDER_POWER_OF_TWO;
+
+ div->table = _get_div_table_from_setup(setup, &div->width);
++ if (IS_ERR(div->table)) {
++ ret = PTR_ERR(div->table);
++ kfree(div);
++ return ERR_PTR(ret);
++ }
++
+
+ div->shift = setup->bit_shift;
+ div->latch = -EINVAL;
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index 4bf72561667c..a75b95fac3bd 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -203,6 +203,7 @@ struct at_xdmac_chan {
+ u32 save_cim;
+ u32 save_cnda;
+ u32 save_cndc;
++ u32 irq_status;
+ unsigned long status;
+ struct tasklet_struct tasklet;
+ struct dma_slave_config sconfig;
+@@ -1580,8 +1581,8 @@ static void at_xdmac_tasklet(unsigned long data)
+ struct at_xdmac_desc *desc;
+ u32 error_mask;
+
+- dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08lx\n",
+- __func__, atchan->status);
++ dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08x\n",
++ __func__, atchan->irq_status);
+
+ error_mask = AT_XDMAC_CIS_RBEIS
+ | AT_XDMAC_CIS_WBEIS
+@@ -1589,15 +1590,15 @@ static void at_xdmac_tasklet(unsigned long data)
+
+ if (at_xdmac_chan_is_cyclic(atchan)) {
+ at_xdmac_handle_cyclic(atchan);
+- } else if ((atchan->status & AT_XDMAC_CIS_LIS)
+- || (atchan->status & error_mask)) {
++ } else if ((atchan->irq_status & AT_XDMAC_CIS_LIS)
++ || (atchan->irq_status & error_mask)) {
+ struct dma_async_tx_descriptor *txd;
+
+- if (atchan->status & AT_XDMAC_CIS_RBEIS)
++ if (atchan->irq_status & AT_XDMAC_CIS_RBEIS)
+ dev_err(chan2dev(&atchan->chan), "read bus error!!!");
+- if (atchan->status & AT_XDMAC_CIS_WBEIS)
++ if (atchan->irq_status & AT_XDMAC_CIS_WBEIS)
+ dev_err(chan2dev(&atchan->chan), "write bus error!!!");
+- if (atchan->status & AT_XDMAC_CIS_ROIS)
++ if (atchan->irq_status & AT_XDMAC_CIS_ROIS)
+ dev_err(chan2dev(&atchan->chan), "request overflow error!!!");
+
+ spin_lock_bh(&atchan->lock);
+@@ -1652,7 +1653,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)
+ atchan = &atxdmac->chan[i];
+ chan_imr = at_xdmac_chan_read(atchan, AT_XDMAC_CIM);
+ chan_status = at_xdmac_chan_read(atchan, AT_XDMAC_CIS);
+- atchan->status = chan_status & chan_imr;
++ atchan->irq_status = chan_status & chan_imr;
+ dev_vdbg(atxdmac->dma.dev,
+ "%s: chan%d: imr=0x%x, status=0x%x\n",
+ __func__, i, chan_imr, chan_status);
+@@ -1666,7 +1667,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)
+ at_xdmac_chan_read(atchan, AT_XDMAC_CDA),
+ at_xdmac_chan_read(atchan, AT_XDMAC_CUBC));
+
+- if (atchan->status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS))
++ if (atchan->irq_status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS))
+ at_xdmac_write(atxdmac, AT_XDMAC_GD, atchan->mask);
+
+ tasklet_schedule(&atchan->tasklet);
+diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
+index aa1712beb0cc..7b7fba0c9253 100644
+--- a/drivers/dma/dmatest.c
++++ b/drivers/dma/dmatest.c
+@@ -642,11 +642,9 @@ static int dmatest_func(void *data)
+ srcs[i] = um->addr[i] + src_off;
+ ret = dma_mapping_error(dev->dev, um->addr[i]);
+ if (ret) {
+- dmaengine_unmap_put(um);
+ result("src mapping error", total_tests,
+ src_off, dst_off, len, ret);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ }
+ um->to_cnt++;
+ }
+@@ -661,11 +659,9 @@ static int dmatest_func(void *data)
+ DMA_BIDIRECTIONAL);
+ ret = dma_mapping_error(dev->dev, dsts[i]);
+ if (ret) {
+- dmaengine_unmap_put(um);
+ result("dst mapping error", total_tests,
+ src_off, dst_off, len, ret);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ }
+ um->bidi_cnt++;
+ }
+@@ -693,12 +689,10 @@ static int dmatest_func(void *data)
+ }
+
+ if (!tx) {
+- dmaengine_unmap_put(um);
+ result("prep error", total_tests, src_off,
+ dst_off, len, ret);
+ msleep(100);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ }
+
+ done->done = false;
+@@ -707,12 +701,10 @@ static int dmatest_func(void *data)
+ cookie = tx->tx_submit(tx);
+
+ if (dma_submit_error(cookie)) {
+- dmaengine_unmap_put(um);
+ result("submit error", total_tests, src_off,
+ dst_off, len, ret);
+ msleep(100);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ }
+ dma_async_issue_pending(chan);
+
+@@ -725,16 +717,14 @@ static int dmatest_func(void *data)
+ dmaengine_unmap_put(um);
+ result("test timed out", total_tests, src_off, dst_off,
+ len, 0);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ } else if (status != DMA_COMPLETE) {
+ dmaengine_unmap_put(um);
+ result(status == DMA_ERROR ?
+ "completion error status" :
+ "completion busy status", total_tests, src_off,
+ dst_off, len, ret);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ }
+
+ dmaengine_unmap_put(um);
+@@ -779,6 +769,12 @@ static int dmatest_func(void *data)
+ verbose_result("test passed", total_tests, src_off,
+ dst_off, len, 0);
+ }
++
++ continue;
++
++error_unmap_continue:
++ dmaengine_unmap_put(um);
++ failed_tests++;
+ }
+ ktime = ktime_sub(ktime_get(), ktime);
+ ktime = ktime_sub(ktime, comparetime);
+diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
+index 6bc8e6640d71..c51462f5aa1e 100644
+--- a/drivers/firmware/iscsi_ibft.c
++++ b/drivers/firmware/iscsi_ibft.c
+@@ -542,6 +542,7 @@ static umode_t __init ibft_check_tgt_for(void *data, int type)
+ case ISCSI_BOOT_TGT_NIC_ASSOC:
+ case ISCSI_BOOT_TGT_CHAP_TYPE:
+ rc = S_IRUGO;
++ break;
+ case ISCSI_BOOT_TGT_NAME:
+ if (tgt->tgt_name_len)
+ rc = S_IRUGO;
+diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
+index d4ad6d0e02a2..7e09ce75ffb2 100644
+--- a/drivers/gpio/gpio-vf610.c
++++ b/drivers/gpio/gpio-vf610.c
+@@ -259,6 +259,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
+ struct vf610_gpio_port *port;
+ struct resource *iores;
+ struct gpio_chip *gc;
++ int i;
+ int ret;
+
+ port = devm_kzalloc(&pdev->dev, sizeof(*port), GFP_KERNEL);
+@@ -298,6 +299,10 @@ static int vf610_gpio_probe(struct platform_device *pdev)
+ if (ret < 0)
+ return ret;
+
++ /* Mask all GPIO interrupts */
++ for (i = 0; i < gc->ngpio; i++)
++ vf610_gpio_writel(0, port->base + PORT_PCR(i));
++
+ /* Clear the interrupt status register for all GPIO's */
+ vf610_gpio_writel(~0, port->base + PORT_ISFR);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+index 7b4e657a95c7..c3df75a9f65d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+@@ -1443,7 +1443,8 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj,
+ effective_mode &= ~S_IWUSR;
+
+ if ((adev->flags & AMD_IS_APU) &&
+- (attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr ||
++ (attr == &sensor_dev_attr_power1_average.dev_attr.attr ||
++ attr == &sensor_dev_attr_power1_cap_max.dev_attr.attr ||
+ attr == &sensor_dev_attr_power1_cap_min.dev_attr.attr||
+ attr == &sensor_dev_attr_power1_cap.dev_attr.attr))
+ return 0;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
+index 1c5d97f4b4dd..8dcf6227ab99 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
+@@ -37,6 +37,7 @@
+ #include "amdgpu_display.h"
+ #include <drm/amdgpu_drm.h>
+ #include <linux/dma-buf.h>
++#include <linux/dma-fence-array.h>
+
+ static const struct dma_buf_ops amdgpu_dmabuf_ops;
+
+@@ -188,6 +189,48 @@ error:
+ return ERR_PTR(ret);
+ }
+
++static int
++__reservation_object_make_exclusive(struct reservation_object *obj)
++{
++ struct dma_fence **fences;
++ unsigned int count;
++ int r;
++
++ if (!reservation_object_get_list(obj)) /* no shared fences to convert */
++ return 0;
++
++ r = reservation_object_get_fences_rcu(obj, NULL, &count, &fences);
++ if (r)
++ return r;
++
++ if (count == 0) {
++ /* Now that was unexpected. */
++ } else if (count == 1) {
++ reservation_object_add_excl_fence(obj, fences[0]);
++ dma_fence_put(fences[0]);
++ kfree(fences);
++ } else {
++ struct dma_fence_array *array;
++
++ array = dma_fence_array_create(count, fences,
++ dma_fence_context_alloc(1), 0,
++ false);
++ if (!array)
++ goto err_fences_put;
++
++ reservation_object_add_excl_fence(obj, &array->base);
++ dma_fence_put(&array->base);
++ }
++
++ return 0;
++
++err_fences_put:
++ while (count--)
++ dma_fence_put(fences[count]);
++ kfree(fences);
++ return -ENOMEM;
++}
++
+ /**
+ * amdgpu_gem_map_attach - &dma_buf_ops.attach implementation
+ * @dma_buf: shared DMA buffer
+@@ -219,16 +262,16 @@ static int amdgpu_gem_map_attach(struct dma_buf *dma_buf,
+
+ if (attach->dev->driver != adev->dev->driver) {
+ /*
+- * Wait for all shared fences to complete before we switch to future
+- * use of exclusive fence on this prime shared bo.
++ * We only create shared fences for internal use, but importers
++ * of the dmabuf rely on exclusive fences for implicitly
++ * tracking write hazards. As any of the current fences may
++ * correspond to a write, we need to convert all existing
++ * fences on the reservation object into a single exclusive
++ * fence.
+ */
+- r = reservation_object_wait_timeout_rcu(bo->tbo.resv,
+- true, false,
+- MAX_SCHEDULE_TIMEOUT);
+- if (unlikely(r < 0)) {
+- DRM_DEBUG_PRIME("Fence wait failed: %li\n", r);
++ r = __reservation_object_make_exclusive(bo->tbo.resv);
++ if (r)
+ goto error_unreserve;
+- }
+ }
+
+ /* pin buffer into GTT */
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index 6a84526e20e0..49fe5084c53d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -3011,14 +3011,15 @@ void amdgpu_vm_get_task_info(struct amdgpu_device *adev, unsigned int pasid,
+ struct amdgpu_task_info *task_info)
+ {
+ struct amdgpu_vm *vm;
++ unsigned long flags;
+
+- spin_lock(&adev->vm_manager.pasid_lock);
++ spin_lock_irqsave(&adev->vm_manager.pasid_lock, flags);
+
+ vm = idr_find(&adev->vm_manager.pasid_idr, pasid);
+ if (vm)
+ *task_info = vm->task_info;
+
+- spin_unlock(&adev->vm_manager.pasid_lock);
++ spin_unlock_irqrestore(&adev->vm_manager.pasid_lock, flags);
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
+index d587779a80b4..a97294ac96d5 100644
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -5676,7 +5676,7 @@ int ci_dpm_init(struct radeon_device *rdev)
+ u16 data_offset, size;
+ u8 frev, crev;
+ struct ci_power_info *pi;
+- enum pci_bus_speed speed_cap;
++ enum pci_bus_speed speed_cap = PCI_SPEED_UNKNOWN;
+ struct pci_dev *root = rdev->pdev->bus->self;
+ int ret;
+
+@@ -5685,7 +5685,8 @@ int ci_dpm_init(struct radeon_device *rdev)
+ return -ENOMEM;
+ rdev->pm.dpm.priv = pi;
+
+- speed_cap = pcie_get_speed_cap(root);
++ if (!pci_is_root_bus(rdev->pdev->bus))
++ speed_cap = pcie_get_speed_cap(root);
+ if (speed_cap == PCI_SPEED_UNKNOWN) {
+ pi->sys_pcie_mask = 0;
+ } else {
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 8fb60b3af015..0a785ef0ab66 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -6899,7 +6899,7 @@ int si_dpm_init(struct radeon_device *rdev)
+ struct ni_power_info *ni_pi;
+ struct si_power_info *si_pi;
+ struct atom_clock_dividers dividers;
+- enum pci_bus_speed speed_cap;
++ enum pci_bus_speed speed_cap = PCI_SPEED_UNKNOWN;
+ struct pci_dev *root = rdev->pdev->bus->self;
+ int ret;
+
+@@ -6911,7 +6911,8 @@ int si_dpm_init(struct radeon_device *rdev)
+ eg_pi = &ni_pi->eg;
+ pi = &eg_pi->rv7xx;
+
+- speed_cap = pcie_get_speed_cap(root);
++ if (!pci_is_root_bus(rdev->pdev->bus))
++ speed_cap = pcie_get_speed_cap(root);
+ if (speed_cap == PCI_SPEED_UNKNOWN) {
+ si_pi->sys_pcie_mask = 0;
+ } else {
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+index 3fb084f802e2..8c31c9ab06f8 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -672,6 +672,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,
+ return PTR_ERR(tcon->sclk0);
+ }
+ }
++ clk_prepare_enable(tcon->sclk0);
+
+ if (tcon->quirks->has_channel_1) {
+ tcon->sclk1 = devm_clk_get(dev, "tcon-ch1");
+@@ -686,6 +687,7 @@ static int sun4i_tcon_init_clocks(struct device *dev,
+
+ static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon)
+ {
++ clk_disable_unprepare(tcon->sclk0);
+ clk_disable_unprepare(tcon->clk);
+ }
+
+diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
+index 65d06a819307..2ac86096ddd9 100644
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -1498,8 +1498,7 @@ static int omap_i2c_remove(struct platform_device *pdev)
+ return 0;
+ }
+
+-#ifdef CONFIG_PM
+-static int omap_i2c_runtime_suspend(struct device *dev)
++static int __maybe_unused omap_i2c_runtime_suspend(struct device *dev)
+ {
+ struct omap_i2c_dev *omap = dev_get_drvdata(dev);
+
+@@ -1525,7 +1524,7 @@ static int omap_i2c_runtime_suspend(struct device *dev)
+ return 0;
+ }
+
+-static int omap_i2c_runtime_resume(struct device *dev)
++static int __maybe_unused omap_i2c_runtime_resume(struct device *dev)
+ {
+ struct omap_i2c_dev *omap = dev_get_drvdata(dev);
+
+@@ -1540,20 +1539,18 @@ static int omap_i2c_runtime_resume(struct device *dev)
+ }
+
+ static const struct dev_pm_ops omap_i2c_pm_ops = {
++ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
++ pm_runtime_force_resume)
+ SET_RUNTIME_PM_OPS(omap_i2c_runtime_suspend,
+ omap_i2c_runtime_resume, NULL)
+ };
+-#define OMAP_I2C_PM_OPS (&omap_i2c_pm_ops)
+-#else
+-#define OMAP_I2C_PM_OPS NULL
+-#endif /* CONFIG_PM */
+
+ static struct platform_driver omap_i2c_driver = {
+ .probe = omap_i2c_probe,
+ .remove = omap_i2c_remove,
+ .driver = {
+ .name = "omap_i2c",
+- .pm = OMAP_I2C_PM_OPS,
++ .pm = &omap_i2c_pm_ops,
+ .of_match_table = of_match_ptr(omap_i2c_of_match),
+ },
+ };
+diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
+index 70d39fc450a1..54eb69564264 100644
+--- a/drivers/infiniband/hw/hfi1/ud.c
++++ b/drivers/infiniband/hw/hfi1/ud.c
+@@ -980,7 +980,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
+ opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
+ wc.ex.imm_data = packet->ohdr->u.ud.imm_data;
+ wc.wc_flags = IB_WC_WITH_IMM;
+- tlen -= sizeof(u32);
+ } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
+ wc.ex.imm_data = 0;
+ wc.wc_flags = 0;
+diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c
+index f8d029a2390f..bce2b5cd3c7b 100644
+--- a/drivers/infiniband/hw/qib/qib_ud.c
++++ b/drivers/infiniband/hw/qib/qib_ud.c
+@@ -513,7 +513,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct ib_header *hdr,
+ opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
+ wc.ex.imm_data = ohdr->u.ud.imm_data;
+ wc.wc_flags = IB_WC_WITH_IMM;
+- tlen -= sizeof(u32);
+ } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
+ wc.ex.imm_data = 0;
+ wc.wc_flags = 0;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
+index 1abe3c62f106..b22d02c9de90 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib.h
++++ b/drivers/infiniband/ulp/ipoib/ipoib.h
+@@ -248,7 +248,6 @@ struct ipoib_cm_tx {
+ struct list_head list;
+ struct net_device *dev;
+ struct ipoib_neigh *neigh;
+- struct ipoib_path *path;
+ struct ipoib_tx_buf *tx_ring;
+ unsigned int tx_head;
+ unsigned int tx_tail;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 0428e01e8f69..aa9dcfc36cd3 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1312,7 +1312,6 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path
+
+ neigh->cm = tx;
+ tx->neigh = neigh;
+- tx->path = path;
+ tx->dev = dev;
+ list_add(&tx->list, &priv->cm.start_list);
+ set_bit(IPOIB_FLAG_INITIALIZED, &tx->flags);
+@@ -1371,7 +1370,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
+ neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+ goto free_neigh;
+ }
+- memcpy(&pathrec, &p->path->pathrec, sizeof(pathrec));
++ memcpy(&pathrec, &path->pathrec, sizeof(pathrec));
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+ netif_tx_unlock_bh(dev);
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index 225ae6980182..628ef617bb2f 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1337,6 +1337,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
+ { "ELAN0000", 0 },
+ { "ELAN0100", 0 },
+ { "ELAN0600", 0 },
++ { "ELAN0601", 0 },
+ { "ELAN0602", 0 },
+ { "ELAN0605", 0 },
+ { "ELAN0608", 0 },
+diff --git a/drivers/input/tablet/wacom_serial4.c b/drivers/input/tablet/wacom_serial4.c
+index 38bfaca48eab..150f9eecaca7 100644
+--- a/drivers/input/tablet/wacom_serial4.c
++++ b/drivers/input/tablet/wacom_serial4.c
+@@ -187,6 +187,7 @@ enum {
+ MODEL_DIGITIZER_II = 0x5544, /* UD */
+ MODEL_GRAPHIRE = 0x4554, /* ET */
+ MODEL_PENPARTNER = 0x4354, /* CT */
++ MODEL_ARTPAD_II = 0x4B54, /* KT */
+ };
+
+ static void wacom_handle_model_response(struct wacom *wacom)
+@@ -245,6 +246,7 @@ static void wacom_handle_model_response(struct wacom *wacom)
+ wacom->flags = F_HAS_STYLUS2 | F_HAS_SCROLLWHEEL;
+ break;
+
++ case MODEL_ARTPAD_II:
+ case MODEL_DIGITIZER_II:
+ wacom->dev->name = "Wacom Digitizer II";
+ wacom->dev->id.version = MODEL_DIGITIZER_II;
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 34c9aa76a7bd..27500abe8ca7 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -1929,16 +1929,13 @@ static void do_attach(struct iommu_dev_data *dev_data,
+
+ static void do_detach(struct iommu_dev_data *dev_data)
+ {
++ struct protection_domain *domain = dev_data->domain;
+ struct amd_iommu *iommu;
+ u16 alias;
+
+ iommu = amd_iommu_rlookup_table[dev_data->devid];
+ alias = dev_data->alias;
+
+- /* decrease reference counters */
+- dev_data->domain->dev_iommu[iommu->index] -= 1;
+- dev_data->domain->dev_cnt -= 1;
+-
+ /* Update data structures */
+ dev_data->domain = NULL;
+ list_del(&dev_data->list);
+@@ -1948,6 +1945,16 @@ static void do_detach(struct iommu_dev_data *dev_data)
+
+ /* Flush the DTE entry */
+ device_flush_dte(dev_data);
++
++ /* Flush IOTLB */
++ domain_flush_tlb_pde(domain);
++
++ /* Wait for the flushes to finish */
++ domain_flush_complete(domain);
++
++ /* decrease reference counters - needs to happen after the flushes */
++ domain->dev_iommu[iommu->index] -= 1;
++ domain->dev_cnt -= 1;
+ }
+
+ /*
+@@ -2555,13 +2562,13 @@ out_unmap:
+ bus_addr = address + s->dma_address + (j << PAGE_SHIFT);
+ iommu_unmap_page(domain, bus_addr, PAGE_SIZE);
+
+- if (--mapped_pages)
++ if (--mapped_pages == 0)
+ goto out_free_iova;
+ }
+ }
+
+ out_free_iova:
+- free_iova_fast(&dma_dom->iovad, address, npages);
++ free_iova_fast(&dma_dom->iovad, address >> PAGE_SHIFT, npages);
+
+ out_err:
+ return 0;
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 4c2246fe5dbe..15579cba1a88 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -1581,6 +1581,9 @@ static unsigned long *its_lpi_alloc(int nr_irqs, u32 *base, int *nr_ids)
+ nr_irqs /= 2;
+ } while (nr_irqs > 0);
+
++ if (!nr_irqs)
++ err = -ENOSPC;
++
+ if (err)
+ goto out;
+
+@@ -1951,6 +1954,29 @@ static void its_free_pending_table(struct page *pt)
+ get_order(max_t(u32, LPI_PENDBASE_SZ, SZ_64K)));
+ }
+
++static u64 its_clear_vpend_valid(void __iomem *vlpi_base)
++{
++ u32 count = 1000000; /* 1s! */
++ bool clean;
++ u64 val;
++
++ val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
++ val &= ~GICR_VPENDBASER_Valid;
++ gits_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);
++
++ do {
++ val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
++ clean = !(val & GICR_VPENDBASER_Dirty);
++ if (!clean) {
++ count--;
++ cpu_relax();
++ udelay(1);
++ }
++ } while (!clean && count);
++
++ return val;
++}
++
+ static void its_cpu_init_lpis(void)
+ {
+ void __iomem *rbase = gic_data_rdist_rd_base();
+@@ -2024,6 +2050,30 @@ static void its_cpu_init_lpis(void)
+ val |= GICR_CTLR_ENABLE_LPIS;
+ writel_relaxed(val, rbase + GICR_CTLR);
+
++ if (gic_rdists->has_vlpis) {
++ void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
++
++ /*
++ * It's possible for CPU to receive VLPIs before it is
++ * sheduled as a vPE, especially for the first CPU, and the
++ * VLPI with INTID larger than 2^(IDbits+1) will be considered
++ * as out of range and dropped by GIC.
++ * So we initialize IDbits to known value to avoid VLPI drop.
++ */
++ val = (LPI_NRBITS - 1) & GICR_VPROPBASER_IDBITS_MASK;
++ pr_debug("GICv4: CPU%d: Init IDbits to 0x%llx for GICR_VPROPBASER\n",
++ smp_processor_id(), val);
++ gits_write_vpropbaser(val, vlpi_base + GICR_VPROPBASER);
++
++ /*
++ * Also clear Valid bit of GICR_VPENDBASER, in case some
++ * ancient programming gets left in and has possibility of
++ * corrupting memory.
++ */
++ val = its_clear_vpend_valid(vlpi_base);
++ WARN_ON(val & GICR_VPENDBASER_Dirty);
++ }
++
+ /* Make sure the GIC has seen the above */
+ dsb(sy);
+ }
+@@ -2644,26 +2694,11 @@ static void its_vpe_schedule(struct its_vpe *vpe)
+ static void its_vpe_deschedule(struct its_vpe *vpe)
+ {
+ void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
+- u32 count = 1000000; /* 1s! */
+- bool clean;
+ u64 val;
+
+- /* We're being scheduled out */
+- val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
+- val &= ~GICR_VPENDBASER_Valid;
+- gits_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);
+-
+- do {
+- val = gits_read_vpendbaser(vlpi_base + GICR_VPENDBASER);
+- clean = !(val & GICR_VPENDBASER_Dirty);
+- if (!clean) {
+- count--;
+- cpu_relax();
+- udelay(1);
+- }
+- } while (!clean && count);
++ val = its_clear_vpend_valid(vlpi_base);
+
+- if (unlikely(!clean && !count)) {
++ if (unlikely(val & GICR_VPENDBASER_Dirty)) {
+ pr_err_ratelimited("ITS virtual pending table not cleaning\n");
+ vpe->idai = false;
+ vpe->pending_last = true;
+diff --git a/drivers/irqchip/irq-mmp.c b/drivers/irqchip/irq-mmp.c
+index 25f32e1d7764..3496b61a312a 100644
+--- a/drivers/irqchip/irq-mmp.c
++++ b/drivers/irqchip/irq-mmp.c
+@@ -34,6 +34,9 @@
+ #define SEL_INT_PENDING (1 << 6)
+ #define SEL_INT_NUM_MASK 0x3f
+
++#define MMP2_ICU_INT_ROUTE_PJ4_IRQ (1 << 5)
++#define MMP2_ICU_INT_ROUTE_PJ4_FIQ (1 << 6)
++
+ struct icu_chip_data {
+ int nr_irqs;
+ unsigned int virq_base;
+@@ -190,7 +193,8 @@ static const struct mmp_intc_conf mmp_conf = {
+ static const struct mmp_intc_conf mmp2_conf = {
+ .conf_enable = 0x20,
+ .conf_disable = 0x0,
+- .conf_mask = 0x7f,
++ .conf_mask = MMP2_ICU_INT_ROUTE_PJ4_IRQ |
++ MMP2_ICU_INT_ROUTE_PJ4_FIQ,
+ };
+
+ static void __exception_irq_entry mmp_handle_irq(struct pt_regs *regs)
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 361abbc00486..6f1fd40fce10 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -1065,11 +1065,19 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
+ return -EINVAL;
+ }
+
+- /* Make sure the terminal type MSB is not null, otherwise it
+- * could be confused with a unit.
++ /*
++ * Reject invalid terminal types that would cause issues:
++ *
++ * - The high byte must be non-zero, otherwise it would be
++ * confused with a unit.
++ *
++ * - Bit 15 must be 0, as we use it internally as a terminal
++ * direction flag.
++ *
++ * Other unknown types are accepted.
+ */
+ type = get_unaligned_le16(&buffer[4]);
+- if ((type & 0xff00) == 0) {
++ if ((type & 0x7f00) == 0 || (type & 0x8000) != 0) {
+ uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol "
+ "interface %d INPUT_TERMINAL %d has invalid "
+ "type 0x%04x, skipping\n", udev->devnum,
+diff --git a/drivers/net/ethernet/altera/altera_msgdma.c b/drivers/net/ethernet/altera/altera_msgdma.c
+index 0fb986ba3290..0ae723f75341 100644
+--- a/drivers/net/ethernet/altera/altera_msgdma.c
++++ b/drivers/net/ethernet/altera/altera_msgdma.c
+@@ -145,7 +145,8 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv)
+ & 0xffff;
+
+ if (inuse) { /* Tx FIFO is not empty */
+- ready = priv->tx_prod - priv->tx_cons - inuse - 1;
++ ready = max_t(int,
++ priv->tx_prod - priv->tx_cons - inuse - 1, 0);
+ } else {
+ /* Check for buffered last packet */
+ status = csrrd32(priv->tx_dma_csr, msgdma_csroffs(status));
+diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
+index 3d45f4c92cf6..9bbaad9f3d63 100644
+--- a/drivers/net/ethernet/cadence/macb.h
++++ b/drivers/net/ethernet/cadence/macb.h
+@@ -643,6 +643,7 @@
+ #define MACB_CAPS_JUMBO 0x00000020
+ #define MACB_CAPS_GEM_HAS_PTP 0x00000040
+ #define MACB_CAPS_BD_RD_PREFETCH 0x00000080
++#define MACB_CAPS_NEEDS_RSTONUBR 0x00000100
+ #define MACB_CAPS_FIFO_MODE 0x10000000
+ #define MACB_CAPS_GIGABIT_MODE_AVAILABLE 0x20000000
+ #define MACB_CAPS_SG_DISABLED 0x40000000
+@@ -1214,6 +1215,8 @@ struct macb {
+
+ int rx_bd_rd_prefetch;
+ int tx_bd_rd_prefetch;
++
++ u32 rx_intr_mask;
+ };
+
+ #ifdef CONFIG_MACB_USE_HWSTAMP
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 8f4b2f9a8e07..8abea1c3844f 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -56,8 +56,7 @@
+ /* level of occupied TX descriptors under which we wake up TX process */
+ #define MACB_TX_WAKEUP_THRESH(bp) (3 * (bp)->tx_ring_size / 4)
+
+-#define MACB_RX_INT_FLAGS (MACB_BIT(RCOMP) | MACB_BIT(RXUBR) \
+- | MACB_BIT(ISR_ROVR))
++#define MACB_RX_INT_FLAGS (MACB_BIT(RCOMP) | MACB_BIT(ISR_ROVR))
+ #define MACB_TX_ERR_FLAGS (MACB_BIT(ISR_TUND) \
+ | MACB_BIT(ISR_RLE) \
+ | MACB_BIT(TXERR))
+@@ -1271,7 +1270,7 @@ static int macb_poll(struct napi_struct *napi, int budget)
+ queue_writel(queue, ISR, MACB_BIT(RCOMP));
+ napi_reschedule(napi);
+ } else {
+- queue_writel(queue, IER, MACB_RX_INT_FLAGS);
++ queue_writel(queue, IER, bp->rx_intr_mask);
+ }
+ }
+
+@@ -1289,7 +1288,7 @@ static void macb_hresp_error_task(unsigned long data)
+ u32 ctrl;
+
+ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
+- queue_writel(queue, IDR, MACB_RX_INT_FLAGS |
++ queue_writel(queue, IDR, bp->rx_intr_mask |
+ MACB_TX_INT_FLAGS |
+ MACB_BIT(HRESP));
+ }
+@@ -1319,7 +1318,7 @@ static void macb_hresp_error_task(unsigned long data)
+
+ /* Enable interrupts */
+ queue_writel(queue, IER,
+- MACB_RX_INT_FLAGS |
++ bp->rx_intr_mask |
+ MACB_TX_INT_FLAGS |
+ MACB_BIT(HRESP));
+ }
+@@ -1373,14 +1372,14 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
+ (unsigned int)(queue - bp->queues),
+ (unsigned long)status);
+
+- if (status & MACB_RX_INT_FLAGS) {
++ if (status & bp->rx_intr_mask) {
+ /* There's no point taking any more interrupts
+ * until we have processed the buffers. The
+ * scheduling call may fail if the poll routine
+ * is already scheduled, so disable interrupts
+ * now.
+ */
+- queue_writel(queue, IDR, MACB_RX_INT_FLAGS);
++ queue_writel(queue, IDR, bp->rx_intr_mask);
+ if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+ queue_writel(queue, ISR, MACB_BIT(RCOMP));
+
+@@ -1413,8 +1412,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
+ /* There is a hardware issue under heavy load where DMA can
+ * stop, this causes endless "used buffer descriptor read"
+ * interrupts but it can be cleared by re-enabling RX. See
+- * the at91 manual, section 41.3.1 or the Zynq manual
+- * section 16.7.4 for details.
++ * the at91rm9200 manual, section 41.3.1 or the Zynq manual
++ * section 16.7.4 for details. RXUBR is only enabled for
++ * these two versions.
+ */
+ if (status & MACB_BIT(RXUBR)) {
+ ctrl = macb_readl(bp, NCR);
+@@ -2264,7 +2264,7 @@ static void macb_init_hw(struct macb *bp)
+
+ /* Enable interrupts */
+ queue_writel(queue, IER,
+- MACB_RX_INT_FLAGS |
++ bp->rx_intr_mask |
+ MACB_TX_INT_FLAGS |
+ MACB_BIT(HRESP));
+ }
+@@ -3912,6 +3912,7 @@ static const struct macb_config sama5d4_config = {
+ };
+
+ static const struct macb_config emac_config = {
++ .caps = MACB_CAPS_NEEDS_RSTONUBR,
+ .clk_init = at91ether_clk_init,
+ .init = at91ether_init,
+ };
+@@ -3933,7 +3934,8 @@ static const struct macb_config zynqmp_config = {
+ };
+
+ static const struct macb_config zynq_config = {
+- .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF,
++ .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF |
++ MACB_CAPS_NEEDS_RSTONUBR,
+ .dma_burst_length = 16,
+ .clk_init = macb_clk_init,
+ .init = macb_init,
+@@ -4088,6 +4090,10 @@ static int macb_probe(struct platform_device *pdev)
+ macb_dma_desc_get_size(bp);
+ }
+
++ bp->rx_intr_mask = MACB_RX_INT_FLAGS;
++ if (bp->caps & MACB_CAPS_NEEDS_RSTONUBR)
++ bp->rx_intr_mask |= MACB_BIT(RXUBR);
++
+ mac = of_get_mac_address(np);
+ if (mac) {
+ ether_addr_copy(bp->dev->dev_addr, mac);
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 6242249c9f4c..b043370c2685 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -2419,6 +2419,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
+ out_notify_fail:
+ (void)cancel_work_sync(&priv->service_task);
+ out_read_prop_fail:
++ /* safe for ACPI FW */
++ of_node_put(to_of_node(priv->fwnode));
+ free_netdev(ndev);
+ return ret;
+ }
+@@ -2448,6 +2450,9 @@ static int hns_nic_dev_remove(struct platform_device *pdev)
+ set_bit(NIC_STATE_REMOVING, &priv->state);
+ (void)cancel_work_sync(&priv->service_task);
+
++ /* safe for ACPI FW */
++ of_node_put(to_of_node(priv->fwnode));
++
+ free_netdev(ndev);
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+index 774beda040a1..e2710ff48fb0 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+@@ -1157,16 +1157,18 @@ static int hns_get_regs_len(struct net_device *net_dev)
+ */
+ static int hns_nic_nway_reset(struct net_device *netdev)
+ {
+- int ret = 0;
+ struct phy_device *phy = netdev->phydev;
+
+- if (netif_running(netdev)) {
+- /* if autoneg is disabled, don't restart auto-negotiation */
+- if (phy && phy->autoneg == AUTONEG_ENABLE)
+- ret = genphy_restart_aneg(phy);
+- }
++ if (!netif_running(netdev))
++ return 0;
+
+- return ret;
++ if (!phy)
++ return -EOPNOTSUPP;
++
++ if (phy->autoneg != AUTONEG_ENABLE)
++ return -EINVAL;
++
++ return genphy_restart_aneg(phy);
+ }
+
+ static u32
+diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
+index 017e08452d8c..baf5cc251f32 100644
+--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
++++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
+@@ -321,7 +321,7 @@ static int hns_mdio_read(struct mii_bus *bus, int phy_id, int regnum)
+ }
+
+ hns_mdio_cmd_write(mdio_dev, is_c45,
+- MDIO_C45_WRITE_ADDR, phy_id, devad);
++ MDIO_C45_READ, phy_id, devad);
+ }
+
+ /* Step 5: waitting for MDIO_COMMAND_REG 's mdio_start==0,*/
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+index 2f69ee9221c6..4dd82a1612aa 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -473,19 +473,19 @@ static void qed_init_qm_pq(struct qed_hwfn *p_hwfn,
+
+ /* get pq index according to PQ_FLAGS */
+ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
+- u32 pq_flags)
++ unsigned long pq_flags)
+ {
+ struct qed_qm_info *qm_info = &p_hwfn->qm_info;
+
+ /* Can't have multiple flags set here */
+- if (bitmap_weight((unsigned long *)&pq_flags,
++ if (bitmap_weight(&pq_flags,
+ sizeof(pq_flags) * BITS_PER_BYTE) > 1) {
+- DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags);
++ DP_ERR(p_hwfn, "requested multiple pq flags 0x%lx\n", pq_flags);
+ goto err;
+ }
+
+ if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) {
+- DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags);
++ DP_ERR(p_hwfn, "pq flag 0x%lx is not set\n", pq_flags);
+ goto err;
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+index 67c02ea93906..64ac95ca4df2 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -609,6 +609,10 @@ qed_sp_update_accept_mode(struct qed_hwfn *p_hwfn,
+ (!!(accept_filter & QED_ACCEPT_MCAST_MATCHED) &&
+ !!(accept_filter & QED_ACCEPT_MCAST_UNMATCHED)));
+
++ SET_FIELD(state, ETH_VPORT_TX_MODE_UCAST_ACCEPT_ALL,
++ (!!(accept_filter & QED_ACCEPT_UCAST_MATCHED) &&
++ !!(accept_filter & QED_ACCEPT_UCAST_UNMATCHED)));
++
+ SET_FIELD(state, ETH_VPORT_TX_MODE_BCAST_ACCEPT_ALL,
+ !!(accept_filter & QED_ACCEPT_BCAST));
+
+@@ -744,6 +748,11 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
+ return rc;
+ }
+
++ if (p_params->update_ctl_frame_check) {
++ p_cmn->ctl_frame_mac_check_en = p_params->mac_chk_en;
++ p_cmn->ctl_frame_ethtype_check_en = p_params->ethtype_chk_en;
++ }
++
+ /* Update mcast bins for VFs, PF doesn't use this functionality */
+ qed_sp_update_mcast_bin(p_hwfn, p_ramrod, p_params);
+
+@@ -2207,7 +2216,7 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,
+ u16 num_queues = 0;
+
+ /* Since the feature controls only queue-zones,
+- * make sure we have the contexts [rx, tx, xdp] to
++ * make sure we have the contexts [rx, xdp, tcs] to
+ * match.
+ */
+ for_each_hwfn(cdev, i) {
+@@ -2217,7 +2226,8 @@ static int qed_fill_eth_dev_info(struct qed_dev *cdev,
+ u16 cids;
+
+ cids = hwfn->pf_params.eth_pf_params.num_cons;
+- num_queues += min_t(u16, l2_queues, cids / 3);
++ cids /= (2 + info->num_tc);
++ num_queues += min_t(u16, l2_queues, cids);
+ }
+
+ /* queues might theoretically be >256, but interrupts'
+@@ -2688,7 +2698,8 @@ static int qed_configure_filter_rx_mode(struct qed_dev *cdev,
+ if (type == QED_FILTER_RX_MODE_TYPE_PROMISC) {
+ accept_flags.rx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
+ QED_ACCEPT_MCAST_UNMATCHED;
+- accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
++ accept_flags.tx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
++ QED_ACCEPT_MCAST_UNMATCHED;
+ } else if (type == QED_FILTER_RX_MODE_TYPE_MULTI_PROMISC) {
+ accept_flags.rx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
+ accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.h b/drivers/net/ethernet/qlogic/qed/qed_l2.h
+index 8d80f1095d17..7127d5aaac42 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.h
+@@ -219,6 +219,9 @@ struct qed_sp_vport_update_params {
+ struct qed_rss_params *rss_params;
+ struct qed_filter_accept_flags accept_flags;
+ struct qed_sge_tpa_params *sge_tpa_params;
++ u8 update_ctl_frame_check;
++ u8 mac_chk_en;
++ u8 ethtype_chk_en;
+ };
+
+ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index 92cd8abeb41d..015de1e0addd 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -2430,19 +2430,24 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
+ {
+ struct qed_ll2_tx_pkt_info pkt;
+ const skb_frag_t *frag;
++ u8 flags = 0, nr_frags;
+ int rc = -EINVAL, i;
+ dma_addr_t mapping;
+ u16 vlan = 0;
+- u8 flags = 0;
+
+ if (unlikely(skb->ip_summed != CHECKSUM_NONE)) {
+ DP_INFO(cdev, "Cannot transmit a checksummed packet\n");
+ return -EINVAL;
+ }
+
+- if (1 + skb_shinfo(skb)->nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
++ /* Cache number of fragments from SKB since SKB may be freed by
++ * the completion routine after calling qed_ll2_prepare_tx_packet()
++ */
++ nr_frags = skb_shinfo(skb)->nr_frags;
++
++ if (1 + nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
+ DP_ERR(cdev, "Cannot transmit a packet with %d fragments\n",
+- 1 + skb_shinfo(skb)->nr_frags);
++ 1 + nr_frags);
+ return -EINVAL;
+ }
+
+@@ -2464,7 +2469,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
+ }
+
+ memset(&pkt, 0, sizeof(pkt));
+- pkt.num_of_bds = 1 + skb_shinfo(skb)->nr_frags;
++ pkt.num_of_bds = 1 + nr_frags;
+ pkt.vlan = vlan;
+ pkt.bd_flags = flags;
+ pkt.tx_dest = QED_LL2_TX_DEST_NW;
+@@ -2475,12 +2480,17 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
+ test_bit(QED_LL2_XMIT_FLAGS_FIP_DISCOVERY, &xmit_flags))
+ pkt.remove_stag = true;
+
++ /* qed_ll2_prepare_tx_packet() may actually send the packet if
++ * there are no fragments in the skb and subsequently the completion
++ * routine may run and free the SKB, so no dereferencing the SKB
++ * beyond this point unless skb has any fragments.
++ */
+ rc = qed_ll2_prepare_tx_packet(&cdev->hwfns[0], cdev->ll2->handle,
+ &pkt, 1);
+ if (rc)
+ goto err;
+
+- for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
++ for (i = 0; i < nr_frags; i++) {
+ frag = &skb_shinfo(skb)->frags[i];
+
+ mapping = skb_frag_dma_map(&cdev->pdev->dev, frag, 0,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+index 3157c0d99441..dae2896e1d8e 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+@@ -380,6 +380,7 @@ void qed_consq_setup(struct qed_hwfn *p_hwfn);
+ * @param p_hwfn
+ */
+ void qed_consq_free(struct qed_hwfn *p_hwfn);
++int qed_spq_pend_post(struct qed_hwfn *p_hwfn);
+
+ /**
+ * @file
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+index 7106ad17afe2..a0ee847f379b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+@@ -402,6 +402,11 @@ int qed_eq_completion(struct qed_hwfn *p_hwfn, void *cookie)
+
+ qed_eq_prod_update(p_hwfn, qed_chain_get_prod_idx(p_chain));
+
++ /* Attempt to post pending requests */
++ spin_lock_bh(&p_hwfn->p_spq->lock);
++ rc = qed_spq_pend_post(p_hwfn);
++ spin_unlock_bh(&p_hwfn->p_spq->lock);
++
+ return rc;
+ }
+
+@@ -745,7 +750,7 @@ static int qed_spq_post_list(struct qed_hwfn *p_hwfn,
+ return 0;
+ }
+
+-static int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
++int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
+ {
+ struct qed_spq *p_spq = p_hwfn->p_spq;
+ struct qed_spq_entry *p_ent = NULL;
+@@ -883,7 +888,6 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
+ struct qed_spq_entry *p_ent = NULL;
+ struct qed_spq_entry *tmp;
+ struct qed_spq_entry *found = NULL;
+- int rc;
+
+ if (!p_hwfn)
+ return -EINVAL;
+@@ -941,12 +945,7 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
+ */
+ qed_spq_return_entry(p_hwfn, found);
+
+- /* Attempt to post pending requests */
+- spin_lock_bh(&p_spq->lock);
+- rc = qed_spq_pend_post(p_hwfn);
+- spin_unlock_bh(&p_spq->lock);
+-
+- return rc;
++ return 0;
+ }
+
+ int qed_consq_alloc(struct qed_hwfn *p_hwfn)
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+index ca6290fa0f30..71a7af134dd8 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+@@ -1969,7 +1969,9 @@ static void qed_iov_vf_mbx_start_vport(struct qed_hwfn *p_hwfn,
+ params.vport_id = vf->vport_id;
+ params.max_buffers_per_cqe = start->max_buffers_per_cqe;
+ params.mtu = vf->mtu;
+- params.check_mac = true;
++
++ /* Non trusted VFs should enable control frame filtering */
++ params.check_mac = !vf->p_vf_info.is_trusted_configured;
+
+ rc = qed_sp_eth_vport_start(p_hwfn, ¶ms);
+ if (rc) {
+@@ -5130,6 +5132,9 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
+ params.opaque_fid = vf->opaque_fid;
+ params.vport_id = vf->vport_id;
+
++ params.update_ctl_frame_check = 1;
++ params.mac_chk_en = !vf_info->is_trusted_configured;
++
+ if (vf_info->rx_accept_mode & mask) {
+ flags->update_rx_mode_config = 1;
+ flags->rx_accept_filter = vf_info->rx_accept_mode;
+@@ -5147,7 +5152,8 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
+ }
+
+ if (flags->update_rx_mode_config ||
+- flags->update_tx_mode_config)
++ flags->update_tx_mode_config ||
++ params.update_ctl_frame_check)
+ qed_sp_vport_update(hwfn, ¶ms,
+ QED_SPQ_MODE_EBLOCK, NULL);
+ }
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+index be118d057b92..6ab3fb008139 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+@@ -261,6 +261,7 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)
+ struct pfvf_acquire_resp_tlv *resp = &p_iov->pf2vf_reply->acquire_resp;
+ struct pf_vf_pfdev_info *pfdev_info = &resp->pfdev_info;
+ struct vf_pf_resc_request *p_resc;
++ u8 retry_cnt = VF_ACQUIRE_THRESH;
+ bool resources_acquired = false;
+ struct vfpf_acquire_tlv *req;
+ int rc = 0, attempts = 0;
+@@ -314,6 +315,15 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)
+
+ /* send acquire request */
+ rc = qed_send_msg2pf(p_hwfn, &resp->hdr.status, sizeof(*resp));
++
++ /* Re-try acquire in case of vf-pf hw channel timeout */
++ if (retry_cnt && rc == -EBUSY) {
++ DP_VERBOSE(p_hwfn, QED_MSG_IOV,
++ "VF retrying to acquire due to VPC timeout\n");
++ retry_cnt--;
++ continue;
++ }
++
+ if (rc)
+ goto exit;
+
+diff --git a/drivers/net/ethernet/qlogic/qede/qede.h b/drivers/net/ethernet/qlogic/qede/qede.h
+index 6a4d266fb8e2..d242a5724069 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede.h
++++ b/drivers/net/ethernet/qlogic/qede/qede.h
+@@ -489,6 +489,9 @@ struct qede_reload_args {
+
+ /* Datapath functions definition */
+ netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev);
++u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb,
++ struct net_device *sb_dev,
++ select_queue_fallback_t fallback);
+ netdev_features_t qede_features_check(struct sk_buff *skb,
+ struct net_device *dev,
+ netdev_features_t features);
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+index 1a78027de071..a96da16f3404 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+@@ -1695,6 +1695,19 @@ netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ return NETDEV_TX_OK;
+ }
+
++u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb,
++ struct net_device *sb_dev,
++ select_queue_fallback_t fallback)
++{
++ struct qede_dev *edev = netdev_priv(dev);
++ int total_txq;
++
++ total_txq = QEDE_TSS_COUNT(edev) * edev->dev_info.num_tc;
++
++ return QEDE_TSS_COUNT(edev) ?
++ fallback(dev, skb, NULL) % total_txq : 0;
++}
++
+ /* 8B udp header + 8B base tunnel header + 32B option length */
+ #define QEDE_MAX_TUN_HDR_LEN 48
+
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
+index 46d0f2eaa0c0..f3d9c40c4115 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
+@@ -631,6 +631,7 @@ static const struct net_device_ops qede_netdev_ops = {
+ .ndo_open = qede_open,
+ .ndo_stop = qede_close,
+ .ndo_start_xmit = qede_start_xmit,
++ .ndo_select_queue = qede_select_queue,
+ .ndo_set_rx_mode = qede_set_rx_mode,
+ .ndo_set_mac_address = qede_set_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+@@ -666,6 +667,7 @@ static const struct net_device_ops qede_netdev_vf_ops = {
+ .ndo_open = qede_open,
+ .ndo_stop = qede_close,
+ .ndo_start_xmit = qede_start_xmit,
++ .ndo_select_queue = qede_select_queue,
+ .ndo_set_rx_mode = qede_set_rx_mode,
+ .ndo_set_mac_address = qede_set_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+@@ -684,6 +686,7 @@ static const struct net_device_ops qede_netdev_vf_xdp_ops = {
+ .ndo_open = qede_open,
+ .ndo_stop = qede_close,
+ .ndo_start_xmit = qede_start_xmit,
++ .ndo_select_queue = qede_select_queue,
+ .ndo_set_rx_mode = qede_set_rx_mode,
+ .ndo_set_mac_address = qede_set_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+index 7b923362ee55..3b174eae77c1 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+@@ -1342,8 +1342,10 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv)
+ }
+
+ ret = phy_power_on(bsp_priv, true);
+- if (ret)
++ if (ret) {
++ gmac_clk_enable(bsp_priv, false);
+ return ret;
++ }
+
+ pm_runtime_enable(dev);
+ pm_runtime_get_sync(dev);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+index 9caf79ba5ef1..4d5fb4b51cc4 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+@@ -719,8 +719,11 @@ static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv)
+ {
+ unsigned long clk = clk_get_rate(priv->plat->stmmac_clk);
+
+- if (!clk)
+- return 0;
++ if (!clk) {
++ clk = priv->plat->clk_ref_rate;
++ if (!clk)
++ return 0;
++ }
+
+ return (usec * (clk / 1000000)) / 256;
+ }
+@@ -729,8 +732,11 @@ static u32 stmmac_riwt2usec(u32 riwt, struct stmmac_priv *priv)
+ {
+ unsigned long clk = clk_get_rate(priv->plat->stmmac_clk);
+
+- if (!clk)
+- return 0;
++ if (!clk) {
++ clk = priv->plat->clk_ref_rate;
++ if (!clk)
++ return 0;
++ }
+
+ return (riwt * 256) / (clk / 1000000);
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 123b74e25ed8..43ab9e905bed 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3028,10 +3028,22 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ tx_q = &priv->tx_queue[queue];
+
++ if (priv->tx_path_in_lpi_mode)
++ stmmac_disable_eee_mode(priv);
++
+ /* Manage oversized TCP frames for GMAC4 device */
+ if (skb_is_gso(skb) && priv->tso) {
+- if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))
++ if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
++ /*
++ * There is no way to determine the number of TSO
++ * capable Queues. Let's use always the Queue 0
++ * because if TSO is supported then at least this
++ * one will be capable.
++ */
++ skb_set_queue_mapping(skb, 0);
++
+ return stmmac_tso_xmit(skb, dev);
++ }
+ }
+
+ if (unlikely(stmmac_tx_avail(priv, queue) < nfrags + 1)) {
+@@ -3046,9 +3058,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
+ return NETDEV_TX_BUSY;
+ }
+
+- if (priv->tx_path_in_lpi_mode)
+- stmmac_disable_eee_mode(priv);
+-
+ entry = tx_q->cur_tx;
+ first_entry = entry;
+ WARN_ON(tx_q->tx_skbuff[first_entry]);
+diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
+index c070a9e51ebf..fae572b38416 100644
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -636,15 +636,15 @@ static int ath9k_of_init(struct ath_softc *sc)
+ ret = ath9k_eeprom_request(sc, eeprom_name);
+ if (ret)
+ return ret;
++
++ ah->ah_flags &= ~AH_USE_EEPROM;
++ ah->ah_flags |= AH_NO_EEP_SWAP;
+ }
+
+ mac = of_get_mac_address(np);
+ if (mac)
+ ether_addr_copy(common->macaddr, mac);
+
+- ah->ah_flags &= ~AH_USE_EEPROM;
+- ah->ah_flags |= AH_NO_EEP_SWAP;
+-
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
+index 750bea3574ee..627df164b7b6 100644
+--- a/drivers/net/wireless/ti/wlcore/sdio.c
++++ b/drivers/net/wireless/ti/wlcore/sdio.c
+@@ -164,6 +164,12 @@ static int wl12xx_sdio_power_on(struct wl12xx_sdio_glue *glue)
+ }
+
+ sdio_claim_host(func);
++ /*
++ * To guarantee that the SDIO card is power cycled, as required to make
++ * the FW programming to succeed, let's do a brute force HW reset.
++ */
++ mmc_hw_reset(card->host);
++
+ sdio_enable_func(func);
+ sdio_release_host(func);
+
+@@ -174,20 +180,13 @@ static int wl12xx_sdio_power_off(struct wl12xx_sdio_glue *glue)
+ {
+ struct sdio_func *func = dev_to_sdio_func(glue->dev);
+ struct mmc_card *card = func->card;
+- int error;
+
+ sdio_claim_host(func);
+ sdio_disable_func(func);
+ sdio_release_host(func);
+
+ /* Let runtime PM know the card is powered off */
+- error = pm_runtime_put(&card->dev);
+- if (error < 0 && error != -EBUSY) {
+- dev_err(&card->dev, "%s failed: %i\n", __func__, error);
+-
+- return error;
+- }
+-
++ pm_runtime_put(&card->dev);
+ return 0;
+ }
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index e0d2b7473901..2cdb3032ca0f 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1182,6 +1182,7 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
+ * effects say only one namespace is affected.
+ */
+ if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
++ mutex_lock(&ctrl->scan_lock);
+ nvme_start_freeze(ctrl);
+ nvme_wait_freeze(ctrl);
+ }
+@@ -1210,8 +1211,10 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
+ */
+ if (effects & NVME_CMD_EFFECTS_LBCC)
+ nvme_update_formats(ctrl);
+- if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK))
++ if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
+ nvme_unfreeze(ctrl);
++ mutex_unlock(&ctrl->scan_lock);
++ }
+ if (effects & NVME_CMD_EFFECTS_CCC)
+ nvme_init_identify(ctrl);
+ if (effects & (NVME_CMD_EFFECTS_NIC | NVME_CMD_EFFECTS_NCC))
+@@ -3292,6 +3295,7 @@ static void nvme_scan_work(struct work_struct *work)
+ if (nvme_identify_ctrl(ctrl, &id))
+ return;
+
++ mutex_lock(&ctrl->scan_lock);
+ nn = le32_to_cpu(id->nn);
+ if (ctrl->vs >= NVME_VS(1, 1, 0) &&
+ !(ctrl->quirks & NVME_QUIRK_IDENTIFY_CNS)) {
+@@ -3300,6 +3304,7 @@ static void nvme_scan_work(struct work_struct *work)
+ }
+ nvme_scan_ns_sequential(ctrl, nn);
+ out_free_id:
++ mutex_unlock(&ctrl->scan_lock);
+ kfree(id);
+ down_write(&ctrl->namespaces_rwsem);
+ list_sort(NULL, &ctrl->namespaces, ns_cmp);
+@@ -3535,6 +3540,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
+
+ ctrl->state = NVME_CTRL_NEW;
+ spin_lock_init(&ctrl->lock);
++ mutex_init(&ctrl->scan_lock);
+ INIT_LIST_HEAD(&ctrl->namespaces);
+ init_rwsem(&ctrl->namespaces_rwsem);
+ ctrl->dev = dev;
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index 60220de2db52..e82cdaec81c9 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -148,6 +148,7 @@ struct nvme_ctrl {
+ enum nvme_ctrl_state state;
+ bool identified;
+ spinlock_t lock;
++ struct mutex scan_lock;
+ const struct nvme_ctrl_ops *ops;
+ struct request_queue *admin_q;
+ struct request_queue *connect_q;
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index f46313f441ec..7b9ef8e734e7 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2260,27 +2260,18 @@ static void nvme_reset_work(struct work_struct *work)
+ if (dev->ctrl.ctrl_config & NVME_CC_ENABLE)
+ nvme_dev_disable(dev, false);
+
+- /*
+- * Introduce CONNECTING state from nvme-fc/rdma transports to mark the
+- * initializing procedure here.
+- */
+- if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
+- dev_warn(dev->ctrl.device,
+- "failed to mark controller CONNECTING\n");
+- goto out;
+- }
+-
++ mutex_lock(&dev->shutdown_lock);
+ result = nvme_pci_enable(dev);
+ if (result)
+- goto out;
++ goto out_unlock;
+
+ result = nvme_pci_configure_admin_queue(dev);
+ if (result)
+- goto out;
++ goto out_unlock;
+
+ result = nvme_alloc_admin_tags(dev);
+ if (result)
+- goto out;
++ goto out_unlock;
+
+ /*
+ * Limit the max command size to prevent iod->sg allocations going
+@@ -2288,6 +2279,17 @@ static void nvme_reset_work(struct work_struct *work)
+ */
+ dev->ctrl.max_hw_sectors = NVME_MAX_KB_SZ << 1;
+ dev->ctrl.max_segments = NVME_MAX_SEGS;
++ mutex_unlock(&dev->shutdown_lock);
++
++ /*
++ * Introduce CONNECTING state from nvme-fc/rdma transports to mark the
++ * initializing procedure here.
++ */
++ if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
++ dev_warn(dev->ctrl.device,
++ "failed to mark controller CONNECTING\n");
++ goto out;
++ }
+
+ result = nvme_init_identify(&dev->ctrl);
+ if (result)
+@@ -2352,6 +2354,8 @@ static void nvme_reset_work(struct work_struct *work)
+ nvme_start_ctrl(&dev->ctrl);
+ return;
+
++ out_unlock:
++ mutex_unlock(&dev->shutdown_lock);
+ out:
+ nvme_remove_dead_ctrl(dev, result);
+ }
+diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
+index cf73a403d22d..cecbce21d01f 100644
+--- a/drivers/pinctrl/pinctrl-mcp23s08.c
++++ b/drivers/pinctrl/pinctrl-mcp23s08.c
+@@ -832,8 +832,13 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
+ break;
+
+ case MCP_TYPE_S18:
++ one_regmap_config =
++ devm_kmemdup(dev, &mcp23x17_regmap,
++ sizeof(struct regmap_config), GFP_KERNEL);
++ if (!one_regmap_config)
++ return -ENOMEM;
+ mcp->regmap = devm_regmap_init(dev, &mcp23sxx_spi_regmap, mcp,
+- &mcp23x17_regmap);
++ one_regmap_config);
+ mcp->reg_shift = 1;
+ mcp->chip.ngpio = 16;
+ mcp->chip.label = "mcp23s18";
+diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
+index 0c1aa6c314f5..7563c07e14e4 100644
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -856,6 +856,7 @@ config TOSHIBA_WMI
+ config ACPI_CMPC
+ tristate "CMPC Laptop Extras"
+ depends on ACPI && INPUT
++ depends on BACKLIGHT_LCD_SUPPORT
+ depends on RFKILL || RFKILL=n
+ select BACKLIGHT_CLASS_DEVICE
+ help
+@@ -1077,6 +1078,7 @@ config INTEL_OAKTRAIL
+ config SAMSUNG_Q10
+ tristate "Samsung Q10 Extras"
+ depends on ACPI
++ depends on BACKLIGHT_LCD_SUPPORT
+ select BACKLIGHT_CLASS_DEVICE
+ ---help---
+ This driver provides support for backlight control on Samsung Q10
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index 970654fcc48d..2d1f6a583641 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -22,6 +22,7 @@
+ #include <linux/hashtable.h>
+ #include <linux/ip.h>
+ #include <linux/refcount.h>
++#include <linux/workqueue.h>
+
+ #include <net/ipv6.h>
+ #include <net/if_inet6.h>
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index b03515d43745..56aacf32f71b 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -565,6 +565,7 @@ static int __qeth_issue_next_read(struct qeth_card *card)
+ QETH_DBF_MESSAGE(2, "%s error in starting next read ccw! "
+ "rc=%i\n", dev_name(&card->gdev->dev), rc);
+ atomic_set(&channel->irq_pending, 0);
++ qeth_release_buffer(channel, iob);
+ card->read_or_write_problem = 1;
+ qeth_schedule_recovery(card);
+ wake_up(&card->wait_q);
+@@ -1187,6 +1188,8 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+ rc = qeth_get_problem(cdev, irb);
+ if (rc) {
+ card->read_or_write_problem = 1;
++ if (iob)
++ qeth_release_buffer(iob->channel, iob);
+ qeth_clear_ipacmd_list(card);
+ qeth_schedule_recovery(card);
+ goto out;
+@@ -1852,6 +1855,7 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel,
+ QETH_DBF_MESSAGE(2, "Error2 in activating channel rc=%d\n", rc);
+ QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
+ atomic_set(&channel->irq_pending, 0);
++ qeth_release_buffer(channel, iob);
+ wake_up(&card->wait_q);
+ return rc;
+ }
+@@ -1923,6 +1927,7 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
+ rc);
+ QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
+ atomic_set(&channel->irq_pending, 0);
++ qeth_release_buffer(channel, iob);
+ wake_up(&card->wait_q);
+ return rc;
+ }
+@@ -2110,6 +2115,7 @@ int qeth_send_control_data(struct qeth_card *card, int len,
+ }
+ reply = qeth_alloc_reply(card);
+ if (!reply) {
++ qeth_release_buffer(channel, iob);
+ return -ENOMEM;
+ }
+ reply->callback = reply_cb;
+@@ -2448,11 +2454,12 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx)
+ return 0;
+ }
+
+-static void qeth_free_qdio_out_buf(struct qeth_qdio_out_q *q)
++static void qeth_free_output_queue(struct qeth_qdio_out_q *q)
+ {
+ if (!q)
+ return;
+
++ qeth_clear_outq_buffers(q, 1);
+ qdio_free_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q);
+ kfree(q);
+ }
+@@ -2526,10 +2533,8 @@ out_freeoutqbufs:
+ card->qdio.out_qs[i]->bufs[j] = NULL;
+ }
+ out_freeoutq:
+- while (i > 0) {
+- qeth_free_qdio_out_buf(card->qdio.out_qs[--i]);
+- qeth_clear_outq_buffers(card->qdio.out_qs[i], 1);
+- }
++ while (i > 0)
++ qeth_free_output_queue(card->qdio.out_qs[--i]);
+ kfree(card->qdio.out_qs);
+ card->qdio.out_qs = NULL;
+ out_freepool:
+@@ -2562,10 +2567,8 @@ static void qeth_free_qdio_buffers(struct qeth_card *card)
+ qeth_free_buffer_pool(card);
+ /* free outbound qdio_qs */
+ if (card->qdio.out_qs) {
+- for (i = 0; i < card->qdio.no_out_queues; ++i) {
+- qeth_clear_outq_buffers(card->qdio.out_qs[i], 1);
+- qeth_free_qdio_out_buf(card->qdio.out_qs[i]);
+- }
++ for (i = 0; i < card->qdio.no_out_queues; i++)
++ qeth_free_output_queue(card->qdio.out_qs[i]);
+ kfree(card->qdio.out_qs);
+ card->qdio.out_qs = NULL;
+ }
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 76b2fba5fba2..b7513c5848cf 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -854,6 +854,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
+
+ if (cgdev->state == CCWGROUP_ONLINE)
+ qeth_l2_set_offline(cgdev);
++
++ cancel_work_sync(&card->close_dev_work);
+ if (qeth_netdev_is_registered(card->dev))
+ unregister_netdev(card->dev);
+ }
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index b7f6a8384543..7f71ca0d08e7 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -2611,6 +2611,7 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)
+ if (cgdev->state == CCWGROUP_ONLINE)
+ qeth_l3_set_offline(cgdev);
+
++ cancel_work_sync(&card->close_dev_work);
+ if (qeth_netdev_is_registered(card->dev))
+ unregister_netdev(card->dev);
+ qeth_l3_clear_ip_htable(card, 0);
+diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
+index 6be77b3aa8a5..ac79f2088b31 100644
+--- a/drivers/scsi/53c700.c
++++ b/drivers/scsi/53c700.c
+@@ -295,7 +295,7 @@ NCR_700_detect(struct scsi_host_template *tpnt,
+ if(tpnt->sdev_attrs == NULL)
+ tpnt->sdev_attrs = NCR_700_dev_attrs;
+
+- memory = dma_alloc_attrs(hostdata->dev, TOTAL_MEM_SIZE, &pScript,
++ memory = dma_alloc_attrs(dev, TOTAL_MEM_SIZE, &pScript,
+ GFP_KERNEL, DMA_ATTR_NON_CONSISTENT);
+ if(memory == NULL) {
+ printk(KERN_ERR "53c700: Failed to allocate memory for driver, detaching\n");
+diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
+index 6e1b022a823d..3236240a4edd 100644
+--- a/drivers/scsi/aacraid/commsup.c
++++ b/drivers/scsi/aacraid/commsup.c
+@@ -1304,8 +1304,9 @@ static void aac_handle_aif(struct aac_dev * dev, struct fib * fibptr)
+ ADD : DELETE;
+ break;
+ }
+- case AifBuManagerEvent:
+- aac_handle_aif_bu(dev, aifcmd);
++ break;
++ case AifBuManagerEvent:
++ aac_handle_aif_bu(dev, aifcmd);
+ break;
+ }
+
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
+index 350257c13a5b..bc9f2a2365f4 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
+@@ -240,6 +240,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
+ return NULL;
+ }
+
++ cmgr->hba = hba;
+ cmgr->free_list = kcalloc(arr_sz, sizeof(*cmgr->free_list),
+ GFP_KERNEL);
+ if (!cmgr->free_list) {
+@@ -256,7 +257,6 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
+ goto mem_err;
+ }
+
+- cmgr->hba = hba;
+ cmgr->cmds = (struct bnx2fc_cmd **)(cmgr + 1);
+
+ for (i = 0; i < arr_sz; i++) {
+@@ -295,7 +295,7 @@ struct bnx2fc_cmd_mgr *bnx2fc_cmd_mgr_alloc(struct bnx2fc_hba *hba)
+
+ /* Allocate pool of io_bdts - one for each bnx2fc_cmd */
+ mem_size = num_ios * sizeof(struct io_bdt *);
+- cmgr->io_bdt_pool = kmalloc(mem_size, GFP_KERNEL);
++ cmgr->io_bdt_pool = kzalloc(mem_size, GFP_KERNEL);
+ if (!cmgr->io_bdt_pool) {
+ printk(KERN_ERR PFX "failed to alloc io_bdt_pool\n");
+ goto mem_err;
+diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
+index be83590ed955..ff943f477d6f 100644
+--- a/drivers/scsi/libfc/fc_lport.c
++++ b/drivers/scsi/libfc/fc_lport.c
+@@ -1726,14 +1726,14 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
+ fc_frame_payload_op(fp) != ELS_LS_ACC) {
+ FC_LPORT_DBG(lport, "FLOGI not accepted or bad response\n");
+ fc_lport_error(lport, fp);
+- goto err;
++ goto out;
+ }
+
+ flp = fc_frame_payload_get(fp, sizeof(*flp));
+ if (!flp) {
+ FC_LPORT_DBG(lport, "FLOGI bad response\n");
+ fc_lport_error(lport, fp);
+- goto err;
++ goto out;
+ }
+
+ mfs = ntohs(flp->fl_csp.sp_bb_data) &
+@@ -1743,7 +1743,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
+ FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, "
+ "lport->mfs:%hu\n", mfs, lport->mfs);
+ fc_lport_error(lport, fp);
+- goto err;
++ goto out;
+ }
+
+ if (mfs <= lport->mfs) {
+diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
+index 372387a450df..1797e47fab38 100644
+--- a/drivers/scsi/libfc/fc_rport.c
++++ b/drivers/scsi/libfc/fc_rport.c
+@@ -184,7 +184,6 @@ void fc_rport_destroy(struct kref *kref)
+ struct fc_rport_priv *rdata;
+
+ rdata = container_of(kref, struct fc_rport_priv, kref);
+- WARN_ON(!list_empty(&rdata->peers));
+ kfree_rcu(rdata, rcu);
+ }
+ EXPORT_SYMBOL(fc_rport_destroy);
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index 60bcc6df97a9..65305b3848bc 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -62,7 +62,7 @@
+
+ /* make sure inq_product_rev string corresponds to this version */
+ #define SDEBUG_VERSION "0188" /* format to fit INQUIRY revision field */
+-static const char *sdebug_version_date = "20180128";
++static const char *sdebug_version_date = "20190125";
+
+ #define MY_NAME "scsi_debug"
+
+@@ -735,7 +735,7 @@ static inline bool scsi_debug_lbp(void)
+ (sdebug_lbpu || sdebug_lbpws || sdebug_lbpws10);
+ }
+
+-static void *fake_store(unsigned long long lba)
++static void *lba2fake_store(unsigned long long lba)
+ {
+ lba = do_div(lba, sdebug_store_sectors);
+
+@@ -2514,8 +2514,8 @@ static int do_device_access(struct scsi_cmnd *scmd, u32 sg_skip, u64 lba,
+ return ret;
+ }
+
+-/* If fake_store(lba,num) compares equal to arr(num), then copy top half of
+- * arr into fake_store(lba,num) and return true. If comparison fails then
++/* If lba2fake_store(lba,num) compares equal to arr(num), then copy top half of
++ * arr into lba2fake_store(lba,num) and return true. If comparison fails then
+ * return false. */
+ static bool comp_write_worker(u64 lba, u32 num, const u8 *arr)
+ {
+@@ -2643,7 +2643,7 @@ static int prot_verify_read(struct scsi_cmnd *SCpnt, sector_t start_sec,
+ if (sdt->app_tag == cpu_to_be16(0xffff))
+ continue;
+
+- ret = dif_verify(sdt, fake_store(sector), sector, ei_lba);
++ ret = dif_verify(sdt, lba2fake_store(sector), sector, ei_lba);
+ if (ret) {
+ dif_errors++;
+ return ret;
+@@ -3261,10 +3261,12 @@ err_out:
+ static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num,
+ u32 ei_lba, bool unmap, bool ndob)
+ {
++ int ret;
+ unsigned long iflags;
+ unsigned long long i;
+- int ret;
+- u64 lba_off;
++ u32 lb_size = sdebug_sector_size;
++ u64 block, lbaa;
++ u8 *fs1p;
+
+ ret = check_device_access_params(scp, lba, num);
+ if (ret)
+@@ -3276,31 +3278,30 @@ static int resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num,
+ unmap_region(lba, num);
+ goto out;
+ }
+-
+- lba_off = lba * sdebug_sector_size;
++ lbaa = lba;
++ block = do_div(lbaa, sdebug_store_sectors);
+ /* if ndob then zero 1 logical block, else fetch 1 logical block */
++ fs1p = fake_storep + (block * lb_size);
+ if (ndob) {
+- memset(fake_storep + lba_off, 0, sdebug_sector_size);
++ memset(fs1p, 0, lb_size);
+ ret = 0;
+ } else
+- ret = fetch_to_dev_buffer(scp, fake_storep + lba_off,
+- sdebug_sector_size);
++ ret = fetch_to_dev_buffer(scp, fs1p, lb_size);
+
+ if (-1 == ret) {
+ write_unlock_irqrestore(&atomic_rw, iflags);
+ return DID_ERROR << 16;
+- } else if (sdebug_verbose && !ndob && (ret < sdebug_sector_size))
++ } else if (sdebug_verbose && !ndob && (ret < lb_size))
+ sdev_printk(KERN_INFO, scp->device,
+ "%s: %s: lb size=%u, IO sent=%d bytes\n",
+- my_name, "write same",
+- sdebug_sector_size, ret);
++ my_name, "write same", lb_size, ret);
+
+ /* Copy first sector to remaining blocks */
+- for (i = 1 ; i < num ; i++)
+- memcpy(fake_storep + ((lba + i) * sdebug_sector_size),
+- fake_storep + lba_off,
+- sdebug_sector_size);
+-
++ for (i = 1 ; i < num ; i++) {
++ lbaa = lba + i;
++ block = do_div(lbaa, sdebug_store_sectors);
++ memmove(fake_storep + (block * lb_size), fs1p, lb_size);
++ }
+ if (scsi_debug_lbp())
+ map_region(lba, num);
+ out:
+diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
+index 8cc015183043..a4ac6073c555 100644
+--- a/drivers/soc/fsl/qbman/qman.c
++++ b/drivers/soc/fsl/qbman/qman.c
+@@ -1081,18 +1081,19 @@ static void qm_mr_process_task(struct work_struct *work);
+ static irqreturn_t portal_isr(int irq, void *ptr)
+ {
+ struct qman_portal *p = ptr;
+-
+- u32 clear = QM_DQAVAIL_MASK | p->irq_sources;
+ u32 is = qm_in(&p->p, QM_REG_ISR) & p->irq_sources;
++ u32 clear = 0;
+
+ if (unlikely(!is))
+ return IRQ_NONE;
+
+ /* DQRR-handling if it's interrupt-driven */
+- if (is & QM_PIRQ_DQRI)
++ if (is & QM_PIRQ_DQRI) {
+ __poll_portal_fast(p, QMAN_POLL_LIMIT);
++ clear = QM_DQAVAIL_MASK | QM_PIRQ_DQRI;
++ }
+ /* Handling of anything else that's interrupt-driven */
+- clear |= __poll_portal_slow(p, is);
++ clear |= __poll_portal_slow(p, is) & QM_PIRQ_SLOW;
+ qm_out(&p->p, QM_REG_ISR, clear);
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/staging/erofs/inode.c b/drivers/staging/erofs/inode.c
+index 9e7815f55a17..7448744cc515 100644
+--- a/drivers/staging/erofs/inode.c
++++ b/drivers/staging/erofs/inode.c
+@@ -184,16 +184,16 @@ static int fill_inode(struct inode *inode, int isdir)
+ /* setup the new inode */
+ if (S_ISREG(inode->i_mode)) {
+ #ifdef CONFIG_EROFS_FS_XATTR
+- if (vi->xattr_isize)
+- inode->i_op = &erofs_generic_xattr_iops;
++ inode->i_op = &erofs_generic_xattr_iops;
+ #endif
+ inode->i_fop = &generic_ro_fops;
+ } else if (S_ISDIR(inode->i_mode)) {
+ inode->i_op =
+ #ifdef CONFIG_EROFS_FS_XATTR
+- vi->xattr_isize ? &erofs_dir_xattr_iops :
+-#endif
++ &erofs_dir_xattr_iops;
++#else
+ &erofs_dir_iops;
++#endif
+ inode->i_fop = &erofs_dir_fops;
+ } else if (S_ISLNK(inode->i_mode)) {
+ /* by default, page_get_link is used for symlink */
+diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h
+index 9f44ed8f0023..c70f0c5237ea 100644
+--- a/drivers/staging/erofs/internal.h
++++ b/drivers/staging/erofs/internal.h
+@@ -327,12 +327,17 @@ static inline erofs_off_t iloc(struct erofs_sb_info *sbi, erofs_nid_t nid)
+ return blknr_to_addr(sbi->meta_blkaddr) + (nid << sbi->islotbits);
+ }
+
+-#define inode_set_inited_xattr(inode) (EROFS_V(inode)->flags |= 1)
+-#define inode_has_inited_xattr(inode) (EROFS_V(inode)->flags & 1)
++/* atomic flag definitions */
++#define EROFS_V_EA_INITED_BIT 0
++
++/* bitlock definitions (arranged in reverse order) */
++#define EROFS_V_BL_XATTR_BIT (BITS_PER_LONG - 1)
+
+ struct erofs_vnode {
+ erofs_nid_t nid;
+- unsigned int flags;
++
++ /* atomic flags (including bitlocks) */
++ unsigned long flags;
+
+ unsigned char data_mapping_mode;
+ /* inline size in bytes */
+@@ -485,8 +490,9 @@ struct erofs_map_blocks_iter {
+ };
+
+
+-static inline struct page *erofs_get_inline_page(struct inode *inode,
+- erofs_blk_t blkaddr)
++static inline struct page *
++erofs_get_inline_page(struct inode *inode,
++ erofs_blk_t blkaddr)
+ {
+ return erofs_get_meta_page(inode->i_sb,
+ blkaddr, S_ISDIR(inode->i_mode));
+diff --git a/drivers/staging/erofs/namei.c b/drivers/staging/erofs/namei.c
+index 546a47156101..023f64fa2c87 100644
+--- a/drivers/staging/erofs/namei.c
++++ b/drivers/staging/erofs/namei.c
+@@ -15,74 +15,77 @@
+
+ #include <trace/events/erofs.h>
+
+-/* based on the value of qn->len is accurate */
+-static inline int dirnamecmp(struct qstr *qn,
+- struct qstr *qd, unsigned *matched)
++struct erofs_qstr {
++ const unsigned char *name;
++ const unsigned char *end;
++};
++
++/* based on the end of qn is accurate and it must have the trailing '\0' */
++static inline int dirnamecmp(const struct erofs_qstr *qn,
++ const struct erofs_qstr *qd,
++ unsigned int *matched)
+ {
+- unsigned i = *matched, len = min(qn->len, qd->len);
+-loop:
+- if (unlikely(i >= len)) {
+- *matched = i;
+- if (qn->len < qd->len) {
+- /*
+- * actually (qn->len == qd->len)
+- * when qd->name[i] == '\0'
+- */
+- return qd->name[i] == '\0' ? 0 : -1;
++ unsigned int i = *matched;
++
++ /*
++ * on-disk error, let's only BUG_ON in the debugging mode.
++ * otherwise, it will return 1 to just skip the invalid name
++ * and go on (in consideration of the lookup performance).
++ */
++ DBG_BUGON(qd->name > qd->end);
++
++ /* qd could not have trailing '\0' */
++ /* However it is absolutely safe if < qd->end */
++ while (qd->name + i < qd->end && qd->name[i] != '\0') {
++ if (qn->name[i] != qd->name[i]) {
++ *matched = i;
++ return qn->name[i] > qd->name[i] ? 1 : -1;
+ }
+- return (qn->len > qd->len);
++ ++i;
+ }
+-
+- if (qn->name[i] != qd->name[i]) {
+- *matched = i;
+- return qn->name[i] > qd->name[i] ? 1 : -1;
+- }
+-
+- ++i;
+- goto loop;
++ *matched = i;
++ /* See comments in __d_alloc on the terminating NUL character */
++ return qn->name[i] == '\0' ? 0 : 1;
+ }
+
+-static struct erofs_dirent *find_target_dirent(
+- struct qstr *name,
+- u8 *data, int maxsize)
++#define nameoff_from_disk(off, sz) (le16_to_cpu(off) & ((sz) - 1))
++
++static struct erofs_dirent *find_target_dirent(struct erofs_qstr *name,
++ u8 *data,
++ unsigned int dirblksize,
++ const int ndirents)
+ {
+- unsigned ndirents, head, back;
+- unsigned startprfx, endprfx;
++ int head, back;
++ unsigned int startprfx, endprfx;
+ struct erofs_dirent *const de = (struct erofs_dirent *)data;
+
+- /* make sure that maxsize is valid */
+- BUG_ON(maxsize < sizeof(struct erofs_dirent));
+-
+- ndirents = le16_to_cpu(de->nameoff) / sizeof(*de);
+-
+- /* corrupted dir (may be unnecessary...) */
+- BUG_ON(!ndirents);
+-
+- head = 0;
++ /* since the 1st dirent has been evaluated previously */
++ head = 1;
+ back = ndirents - 1;
+ startprfx = endprfx = 0;
+
+ while (head <= back) {
+- unsigned mid = head + (back - head) / 2;
+- unsigned nameoff = le16_to_cpu(de[mid].nameoff);
+- unsigned matched = min(startprfx, endprfx);
+-
+- struct qstr dname = QSTR_INIT(data + nameoff,
+- unlikely(mid >= ndirents - 1) ?
+- maxsize - nameoff :
+- le16_to_cpu(de[mid + 1].nameoff) - nameoff);
++ const int mid = head + (back - head) / 2;
++ const int nameoff = nameoff_from_disk(de[mid].nameoff,
++ dirblksize);
++ unsigned int matched = min(startprfx, endprfx);
++ struct erofs_qstr dname = {
++ .name = data + nameoff,
++ .end = unlikely(mid >= ndirents - 1) ?
++ data + dirblksize :
++ data + nameoff_from_disk(de[mid + 1].nameoff,
++ dirblksize)
++ };
+
+ /* string comparison without already matched prefix */
+ int ret = dirnamecmp(name, &dname, &matched);
+
+- if (unlikely(!ret))
++ if (unlikely(!ret)) {
+ return de + mid;
+- else if (ret > 0) {
++ } else if (ret > 0) {
+ head = mid + 1;
+ startprfx = matched;
+- } else if (unlikely(mid < 1)) /* fix "mid" overflow */
+- break;
+- else {
++ } else {
+ back = mid - 1;
+ endprfx = matched;
+ }
+@@ -91,12 +94,12 @@ static struct erofs_dirent *find_target_dirent(
+ return ERR_PTR(-ENOENT);
+ }
+
+-static struct page *find_target_block_classic(
+- struct inode *dir,
+- struct qstr *name, int *_diff)
++static struct page *find_target_block_classic(struct inode *dir,
++ struct erofs_qstr *name,
++ int *_ndirents)
+ {
+- unsigned startprfx, endprfx;
+- unsigned head, back;
++ unsigned int startprfx, endprfx;
++ int head, back;
+ struct address_space *const mapping = dir->i_mapping;
+ struct page *candidate = ERR_PTR(-ENOENT);
+
+@@ -105,41 +108,43 @@ static struct page *find_target_block_classic(
+ back = inode_datablocks(dir) - 1;
+
+ while (head <= back) {
+- unsigned mid = head + (back - head) / 2;
++ const int mid = head + (back - head) / 2;
+ struct page *page = read_mapping_page(mapping, mid, NULL);
+
+- if (IS_ERR(page)) {
+-exact_out:
+- if (!IS_ERR(candidate)) /* valid candidate */
+- put_page(candidate);
+- return page;
+- } else {
+- int diff;
+- unsigned ndirents, matched;
+- struct qstr dname;
++ if (!IS_ERR(page)) {
+ struct erofs_dirent *de = kmap_atomic(page);
+- unsigned nameoff = le16_to_cpu(de->nameoff);
+-
+- ndirents = nameoff / sizeof(*de);
++ const int nameoff = nameoff_from_disk(de->nameoff,
++ EROFS_BLKSIZ);
++ const int ndirents = nameoff / sizeof(*de);
++ int diff;
++ unsigned int matched;
++ struct erofs_qstr dname;
+
+- /* corrupted dir (should have one entry at least) */
+- BUG_ON(!ndirents || nameoff > PAGE_SIZE);
++ if (unlikely(!ndirents)) {
++ DBG_BUGON(1);
++ kunmap_atomic(de);
++ put_page(page);
++ page = ERR_PTR(-EIO);
++ goto out;
++ }
+
+ matched = min(startprfx, endprfx);
+
+ dname.name = (u8 *)de + nameoff;
+- dname.len = ndirents == 1 ?
+- /* since the rest of the last page is 0 */
+- EROFS_BLKSIZ - nameoff
+- : le16_to_cpu(de[1].nameoff) - nameoff;
++ if (ndirents == 1)
++ dname.end = (u8 *)de + EROFS_BLKSIZ;
++ else
++ dname.end = (u8 *)de +
++ nameoff_from_disk(de[1].nameoff,
++ EROFS_BLKSIZ);
+
+ /* string comparison without already matched prefix */
+ diff = dirnamecmp(name, &dname, &matched);
+ kunmap_atomic(de);
+
+ if (unlikely(!diff)) {
+- *_diff = 0;
+- goto exact_out;
++ *_ndirents = 0;
++ goto out;
+ } else if (diff > 0) {
+ head = mid + 1;
+ startprfx = matched;
+@@ -147,45 +152,51 @@ exact_out:
+ if (likely(!IS_ERR(candidate)))
+ put_page(candidate);
+ candidate = page;
++ *_ndirents = ndirents;
+ } else {
+ put_page(page);
+
+- if (unlikely(mid < 1)) /* fix "mid" overflow */
+- break;
+-
+ back = mid - 1;
+ endprfx = matched;
+ }
++ continue;
+ }
++out: /* free if the candidate is valid */
++ if (!IS_ERR(candidate))
++ put_page(candidate);
++ return page;
+ }
+- *_diff = 1;
+ return candidate;
+ }
+
+ int erofs_namei(struct inode *dir,
+- struct qstr *name,
+- erofs_nid_t *nid, unsigned *d_type)
++ struct qstr *name,
++ erofs_nid_t *nid, unsigned int *d_type)
+ {
+- int diff;
++ int ndirents;
+ struct page *page;
+- u8 *data;
++ void *data;
+ struct erofs_dirent *de;
++ struct erofs_qstr qn;
+
+ if (unlikely(!dir->i_size))
+ return -ENOENT;
+
+- diff = 1;
+- page = find_target_block_classic(dir, name, &diff);
++ qn.name = name->name;
++ qn.end = name->name + name->len;
++
++ ndirents = 0;
++ page = find_target_block_classic(dir, &qn, &ndirents);
+
+ if (unlikely(IS_ERR(page)))
+ return PTR_ERR(page);
+
+ data = kmap_atomic(page);
+ /* the target page has been mapped */
+- de = likely(diff) ?
+- /* since the rest of the last page is 0 */
+- find_target_dirent(name, data, EROFS_BLKSIZ) :
+- (struct erofs_dirent *)data;
++ if (ndirents)
++ de = find_target_dirent(&qn, data, EROFS_BLKSIZ, ndirents);
++ else
++ de = (struct erofs_dirent *)data;
+
+ if (likely(!IS_ERR(de))) {
+ *nid = le64_to_cpu(de->nid);
+diff --git a/drivers/staging/erofs/xattr.c b/drivers/staging/erofs/xattr.c
+index 0e9cfeccdf99..2db99cff3c99 100644
+--- a/drivers/staging/erofs/xattr.c
++++ b/drivers/staging/erofs/xattr.c
+@@ -24,36 +24,77 @@ struct xattr_iter {
+
+ static inline void xattr_iter_end(struct xattr_iter *it, bool atomic)
+ {
+- /* only init_inode_xattrs use non-atomic once */
++ /* the only user of kunmap() is 'init_inode_xattrs' */
+ if (unlikely(!atomic))
+ kunmap(it->page);
+ else
+ kunmap_atomic(it->kaddr);
++
+ unlock_page(it->page);
+ put_page(it->page);
+ }
+
+-static void init_inode_xattrs(struct inode *inode)
++static inline void xattr_iter_end_final(struct xattr_iter *it)
++{
++ if (!it->page)
++ return;
++
++ xattr_iter_end(it, true);
++}
++
++static int init_inode_xattrs(struct inode *inode)
+ {
++ struct erofs_vnode *const vi = EROFS_V(inode);
+ struct xattr_iter it;
+ unsigned i;
+ struct erofs_xattr_ibody_header *ih;
+ struct erofs_sb_info *sbi;
+- struct erofs_vnode *vi;
+ bool atomic_map;
++ int ret = 0;
+
+- if (likely(inode_has_inited_xattr(inode)))
+- return;
++ /* the most case is that xattrs of this inode are initialized. */
++ if (test_bit(EROFS_V_EA_INITED_BIT, &vi->flags))
++ return 0;
++
++ if (wait_on_bit_lock(&vi->flags, EROFS_V_BL_XATTR_BIT, TASK_KILLABLE))
++ return -ERESTARTSYS;
+
+- vi = EROFS_V(inode);
+- BUG_ON(!vi->xattr_isize);
++ /* someone has initialized xattrs for us? */
++ if (test_bit(EROFS_V_EA_INITED_BIT, &vi->flags))
++ goto out_unlock;
++
++ /*
++ * bypass all xattr operations if ->xattr_isize is not greater than
++ * sizeof(struct erofs_xattr_ibody_header), in detail:
++ * 1) it is not enough to contain erofs_xattr_ibody_header then
++ * ->xattr_isize should be 0 (it means no xattr);
++ * 2) it is just to contain erofs_xattr_ibody_header, which is on-disk
++ * undefined right now (maybe use later with some new sb feature).
++ */
++ if (vi->xattr_isize == sizeof(struct erofs_xattr_ibody_header)) {
++ errln("xattr_isize %d of nid %llu is not supported yet",
++ vi->xattr_isize, vi->nid);
++ ret = -ENOTSUPP;
++ goto out_unlock;
++ } else if (vi->xattr_isize < sizeof(struct erofs_xattr_ibody_header)) {
++ if (unlikely(vi->xattr_isize)) {
++ DBG_BUGON(1);
++ ret = -EIO;
++ goto out_unlock; /* xattr ondisk layout error */
++ }
++ ret = -ENOATTR;
++ goto out_unlock;
++ }
+
+ sbi = EROFS_I_SB(inode);
+ it.blkaddr = erofs_blknr(iloc(sbi, vi->nid) + vi->inode_isize);
+ it.ofs = erofs_blkoff(iloc(sbi, vi->nid) + vi->inode_isize);
+
+ it.page = erofs_get_inline_page(inode, it.blkaddr);
+- BUG_ON(IS_ERR(it.page));
++ if (IS_ERR(it.page)) {
++ ret = PTR_ERR(it.page);
++ goto out_unlock;
++ }
+
+ /* read in shared xattr array (non-atomic, see kmalloc below) */
+ it.kaddr = kmap(it.page);
+@@ -62,9 +103,13 @@ static void init_inode_xattrs(struct inode *inode)
+ ih = (struct erofs_xattr_ibody_header *)(it.kaddr + it.ofs);
+
+ vi->xattr_shared_count = ih->h_shared_count;
+- vi->xattr_shared_xattrs = (unsigned *)kmalloc_array(
+- vi->xattr_shared_count, sizeof(unsigned),
+- GFP_KERNEL | __GFP_NOFAIL);
++ vi->xattr_shared_xattrs = kmalloc_array(vi->xattr_shared_count,
++ sizeof(uint), GFP_KERNEL);
++ if (!vi->xattr_shared_xattrs) {
++ xattr_iter_end(&it, atomic_map);
++ ret = -ENOMEM;
++ goto out_unlock;
++ }
+
+ /* let's skip ibody header */
+ it.ofs += sizeof(struct erofs_xattr_ibody_header);
+@@ -77,7 +122,12 @@ static void init_inode_xattrs(struct inode *inode)
+
+ it.page = erofs_get_meta_page(inode->i_sb,
+ ++it.blkaddr, S_ISDIR(inode->i_mode));
+- BUG_ON(IS_ERR(it.page));
++ if (IS_ERR(it.page)) {
++ kfree(vi->xattr_shared_xattrs);
++ vi->xattr_shared_xattrs = NULL;
++ ret = PTR_ERR(it.page);
++ goto out_unlock;
++ }
+
+ it.kaddr = kmap_atomic(it.page);
+ atomic_map = true;
+@@ -89,7 +139,11 @@ static void init_inode_xattrs(struct inode *inode)
+ }
+ xattr_iter_end(&it, atomic_map);
+
+- inode_set_inited_xattr(inode);
++ set_bit(EROFS_V_EA_INITED_BIT, &vi->flags);
++
++out_unlock:
++ clear_and_wake_up_bit(EROFS_V_BL_XATTR_BIT, &vi->flags);
++ return ret;
+ }
+
+ struct xattr_iter_handlers {
+@@ -99,18 +153,25 @@ struct xattr_iter_handlers {
+ void (*value)(struct xattr_iter *, unsigned, char *, unsigned);
+ };
+
+-static void xattr_iter_fixup(struct xattr_iter *it)
++static inline int xattr_iter_fixup(struct xattr_iter *it)
+ {
+- if (unlikely(it->ofs >= EROFS_BLKSIZ)) {
+- xattr_iter_end(it, true);
++ if (it->ofs < EROFS_BLKSIZ)
++ return 0;
+
+- it->blkaddr += erofs_blknr(it->ofs);
+- it->page = erofs_get_meta_page(it->sb, it->blkaddr, false);
+- BUG_ON(IS_ERR(it->page));
++ xattr_iter_end(it, true);
+
+- it->kaddr = kmap_atomic(it->page);
+- it->ofs = erofs_blkoff(it->ofs);
++ it->blkaddr += erofs_blknr(it->ofs);
++ it->page = erofs_get_meta_page(it->sb, it->blkaddr, false);
++ if (IS_ERR(it->page)) {
++ int err = PTR_ERR(it->page);
++
++ it->page = NULL;
++ return err;
+ }
++
++ it->kaddr = kmap_atomic(it->page);
++ it->ofs = erofs_blkoff(it->ofs);
++ return 0;
+ }
+
+ static int inline_xattr_iter_begin(struct xattr_iter *it,
+@@ -132,21 +193,24 @@ static int inline_xattr_iter_begin(struct xattr_iter *it,
+ it->ofs = erofs_blkoff(iloc(sbi, vi->nid) + inline_xattr_ofs);
+
+ it->page = erofs_get_inline_page(inode, it->blkaddr);
+- BUG_ON(IS_ERR(it->page));
+- it->kaddr = kmap_atomic(it->page);
++ if (IS_ERR(it->page))
++ return PTR_ERR(it->page);
+
++ it->kaddr = kmap_atomic(it->page);
+ return vi->xattr_isize - xattr_header_sz;
+ }
+
+ static int xattr_foreach(struct xattr_iter *it,
+- struct xattr_iter_handlers *op, unsigned *tlimit)
++ const struct xattr_iter_handlers *op, unsigned int *tlimit)
+ {
+ struct erofs_xattr_entry entry;
+ unsigned value_sz, processed, slice;
+ int err;
+
+ /* 0. fixup blkaddr, ofs, ipage */
+- xattr_iter_fixup(it);
++ err = xattr_iter_fixup(it);
++ if (err)
++ return err;
+
+ /*
+ * 1. read xattr entry to the memory,
+@@ -178,7 +242,9 @@ static int xattr_foreach(struct xattr_iter *it,
+ if (it->ofs >= EROFS_BLKSIZ) {
+ BUG_ON(it->ofs > EROFS_BLKSIZ);
+
+- xattr_iter_fixup(it);
++ err = xattr_iter_fixup(it);
++ if (err)
++ goto out;
+ it->ofs = 0;
+ }
+
+@@ -210,7 +276,10 @@ static int xattr_foreach(struct xattr_iter *it,
+ while (processed < value_sz) {
+ if (it->ofs >= EROFS_BLKSIZ) {
+ BUG_ON(it->ofs > EROFS_BLKSIZ);
+- xattr_iter_fixup(it);
++
++ err = xattr_iter_fixup(it);
++ if (err)
++ goto out;
+ it->ofs = 0;
+ }
+
+@@ -270,7 +339,7 @@ static void xattr_copyvalue(struct xattr_iter *_it,
+ memcpy(it->buffer + processed, buf, len);
+ }
+
+-static struct xattr_iter_handlers find_xattr_handlers = {
++static const struct xattr_iter_handlers find_xattr_handlers = {
+ .entry = xattr_entrymatch,
+ .name = xattr_namematch,
+ .alloc_buffer = xattr_checkbuffer,
+@@ -291,8 +360,11 @@ static int inline_getxattr(struct inode *inode, struct getxattr_iter *it)
+ ret = xattr_foreach(&it->it, &find_xattr_handlers, &remaining);
+ if (ret >= 0)
+ break;
++
++ if (ret != -ENOATTR) /* -ENOMEM, -EIO, etc. */
++ break;
+ }
+- xattr_iter_end(&it->it, true);
++ xattr_iter_end_final(&it->it);
+
+ return ret < 0 ? ret : it->buffer_size;
+ }
+@@ -315,8 +387,10 @@ static int shared_getxattr(struct inode *inode, struct getxattr_iter *it)
+ xattr_iter_end(&it->it, true);
+
+ it->it.page = erofs_get_meta_page(inode->i_sb,
+- blkaddr, false);
+- BUG_ON(IS_ERR(it->it.page));
++ blkaddr, false);
++ if (IS_ERR(it->it.page))
++ return PTR_ERR(it->it.page);
++
+ it->it.kaddr = kmap_atomic(it->it.page);
+ it->it.blkaddr = blkaddr;
+ }
+@@ -324,9 +398,12 @@ static int shared_getxattr(struct inode *inode, struct getxattr_iter *it)
+ ret = xattr_foreach(&it->it, &find_xattr_handlers, NULL);
+ if (ret >= 0)
+ break;
++
++ if (ret != -ENOATTR) /* -ENOMEM, -EIO, etc. */
++ break;
+ }
+ if (vi->xattr_shared_count)
+- xattr_iter_end(&it->it, true);
++ xattr_iter_end_final(&it->it);
+
+ return ret < 0 ? ret : it->buffer_size;
+ }
+@@ -351,7 +428,9 @@ int erofs_getxattr(struct inode *inode, int index,
+ if (unlikely(name == NULL))
+ return -EINVAL;
+
+- init_inode_xattrs(inode);
++ ret = init_inode_xattrs(inode);
++ if (ret)
++ return ret;
+
+ it.index = index;
+
+@@ -374,7 +453,6 @@ static int erofs_xattr_generic_get(const struct xattr_handler *handler,
+ struct dentry *unused, struct inode *inode,
+ const char *name, void *buffer, size_t size)
+ {
+- struct erofs_vnode *const vi = EROFS_V(inode);
+ struct erofs_sb_info *const sbi = EROFS_I_SB(inode);
+
+ switch (handler->flags) {
+@@ -392,9 +470,6 @@ static int erofs_xattr_generic_get(const struct xattr_handler *handler,
+ return -EINVAL;
+ }
+
+- if (!vi->xattr_isize)
+- return -ENOATTR;
+-
+ return erofs_getxattr(inode, handler->flags, name, buffer, size);
+ }
+
+@@ -494,7 +569,7 @@ static int xattr_skipvalue(struct xattr_iter *_it,
+ return 1;
+ }
+
+-static struct xattr_iter_handlers list_xattr_handlers = {
++static const struct xattr_iter_handlers list_xattr_handlers = {
+ .entry = xattr_entrylist,
+ .name = xattr_namelist,
+ .alloc_buffer = xattr_skipvalue,
+@@ -516,7 +591,7 @@ static int inline_listxattr(struct listxattr_iter *it)
+ if (ret < 0)
+ break;
+ }
+- xattr_iter_end(&it->it, true);
++ xattr_iter_end_final(&it->it);
+ return ret < 0 ? ret : it->buffer_ofs;
+ }
+
+@@ -538,8 +613,10 @@ static int shared_listxattr(struct listxattr_iter *it)
+ xattr_iter_end(&it->it, true);
+
+ it->it.page = erofs_get_meta_page(inode->i_sb,
+- blkaddr, false);
+- BUG_ON(IS_ERR(it->it.page));
++ blkaddr, false);
++ if (IS_ERR(it->it.page))
++ return PTR_ERR(it->it.page);
++
+ it->it.kaddr = kmap_atomic(it->it.page);
+ it->it.blkaddr = blkaddr;
+ }
+@@ -549,7 +626,7 @@ static int shared_listxattr(struct listxattr_iter *it)
+ break;
+ }
+ if (vi->xattr_shared_count)
+- xattr_iter_end(&it->it, true);
++ xattr_iter_end_final(&it->it);
+
+ return ret < 0 ? ret : it->buffer_ofs;
+ }
+@@ -560,7 +637,9 @@ ssize_t erofs_listxattr(struct dentry *dentry,
+ int ret;
+ struct listxattr_iter it;
+
+- init_inode_xattrs(d_inode(dentry));
++ ret = init_inode_xattrs(d_inode(dentry));
++ if (ret)
++ return ret;
+
+ it.dentry = dentry;
+ it.buffer = buffer;
+diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
+index d7312eed6088..91ea3083e7ad 100644
+--- a/drivers/usb/phy/Kconfig
++++ b/drivers/usb/phy/Kconfig
+@@ -21,7 +21,7 @@ config AB8500_USB
+
+ config FSL_USB2_OTG
+ bool "Freescale USB OTG Transceiver Driver"
+- depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM && PM
++ depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
+ depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
+ select USB_PHY
+ help
+diff --git a/fs/autofs/expire.c b/fs/autofs/expire.c
+index d441244b79df..28d9c2b1b3bb 100644
+--- a/fs/autofs/expire.c
++++ b/fs/autofs/expire.c
+@@ -596,7 +596,6 @@ int autofs_expire_run(struct super_block *sb,
+ pkt.len = dentry->d_name.len;
+ memcpy(pkt.name, dentry->d_name.name, pkt.len);
+ pkt.name[pkt.len] = '\0';
+- dput(dentry);
+
+ if (copy_to_user(pkt_p, &pkt, sizeof(struct autofs_packet_expire)))
+ ret = -EFAULT;
+@@ -609,6 +608,8 @@ int autofs_expire_run(struct super_block *sb,
+ complete_all(&ino->expire_complete);
+ spin_unlock(&sbi->fs_lock);
+
++ dput(dentry);
++
+ return ret;
+ }
+
+diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
+index 846c052569dd..3c14a8e45ffb 100644
+--- a/fs/autofs/inode.c
++++ b/fs/autofs/inode.c
+@@ -255,8 +255,10 @@ int autofs_fill_super(struct super_block *s, void *data, int silent)
+ }
+ root_inode = autofs_get_inode(s, S_IFDIR | 0755);
+ root = d_make_root(root_inode);
+- if (!root)
++ if (!root) {
++ ret = -ENOMEM;
+ goto fail_ino;
++ }
+ pipe = NULL;
+
+ root->d_fsdata = ino;
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 6f1ae3ac9789..c083c4b3c1e7 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -200,6 +200,7 @@ __find_get_block_slow(struct block_device *bdev, sector_t block)
+ struct buffer_head *head;
+ struct page *page;
+ int all_mapped = 1;
++ static DEFINE_RATELIMIT_STATE(last_warned, HZ, 1);
+
+ index = block >> (PAGE_SHIFT - bd_inode->i_blkbits);
+ page = find_get_page_flags(bd_mapping, index, FGP_ACCESSED);
+@@ -227,15 +228,15 @@ __find_get_block_slow(struct block_device *bdev, sector_t block)
+ * file io on the block device and getblk. It gets dealt with
+ * elsewhere, don't buffer_error if we had some unmapped buffers
+ */
+- if (all_mapped) {
+- printk("__find_get_block_slow() failed. "
+- "block=%llu, b_blocknr=%llu\n",
+- (unsigned long long)block,
+- (unsigned long long)bh->b_blocknr);
+- printk("b_state=0x%08lx, b_size=%zu\n",
+- bh->b_state, bh->b_size);
+- printk("device %pg blocksize: %d\n", bdev,
+- 1 << bd_inode->i_blkbits);
++ ratelimit_set_flags(&last_warned, RATELIMIT_MSG_ON_RELEASE);
++ if (all_mapped && __ratelimit(&last_warned)) {
++ printk("__find_get_block_slow() failed. block=%llu, "
++ "b_blocknr=%llu, b_state=0x%08lx, b_size=%zu, "
++ "device %pg blocksize: %d\n",
++ (unsigned long long)block,
++ (unsigned long long)bh->b_blocknr,
++ bh->b_state, bh->b_size, bdev,
++ 1 << bd_inode->i_blkbits);
+ }
+ out_unlock:
+ spin_unlock(&bd_mapping->private_lock);
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 1e5a1171212f..a2d701775c49 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2243,10 +2243,12 @@ SMB2_open_free(struct smb_rqst *rqst)
+ {
+ int i;
+
+- cifs_small_buf_release(rqst->rq_iov[0].iov_base);
+- for (i = 1; i < rqst->rq_nvec; i++)
+- if (rqst->rq_iov[i].iov_base != smb2_padding)
+- kfree(rqst->rq_iov[i].iov_base);
++ if (rqst && rqst->rq_iov) {
++ cifs_small_buf_release(rqst->rq_iov[0].iov_base);
++ for (i = 1; i < rqst->rq_nvec; i++)
++ if (rqst->rq_iov[i].iov_base != smb2_padding)
++ kfree(rqst->rq_iov[i].iov_base);
++ }
+ }
+
+ int
+@@ -2535,7 +2537,8 @@ SMB2_close_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
+ void
+ SMB2_close_free(struct smb_rqst *rqst)
+ {
+- cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
++ if (rqst && rqst->rq_iov)
++ cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
+ }
+
+ int
+@@ -2685,7 +2688,8 @@ SMB2_query_info_init(struct cifs_tcon *tcon, struct smb_rqst *rqst,
+ void
+ SMB2_query_info_free(struct smb_rqst *rqst)
+ {
+- cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
++ if (rqst && rqst->rq_iov)
++ cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
+ }
+
+ static int
+diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
+index 8fb7887f2b3d..437257d1116f 100644
+--- a/fs/cifs/smb2pdu.h
++++ b/fs/cifs/smb2pdu.h
+@@ -84,8 +84,8 @@
+
+ #define NUMBER_OF_SMB2_COMMANDS 0x0013
+
+-/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */
+-#define MAX_SMB2_HDR_SIZE 0x00b0
++/* 52 transform hdr + 64 hdr + 88 create rsp */
++#define MAX_SMB2_HDR_SIZE 204
+
+ #define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe)
+ #define SMB2_TRANSFORM_PROTO_NUM cpu_to_le32(0x424d53fd)
+diff --git a/fs/drop_caches.c b/fs/drop_caches.c
+index 82377017130f..d31b6c72b476 100644
+--- a/fs/drop_caches.c
++++ b/fs/drop_caches.c
+@@ -21,8 +21,13 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
+ spin_lock(&sb->s_inode_list_lock);
+ list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
+ spin_lock(&inode->i_lock);
++ /*
++ * We must skip inodes in unusual state. We may also skip
++ * inodes without pages but we deliberately won't in case
++ * we need to reschedule to avoid softlockups.
++ */
+ if ((inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) ||
+- (inode->i_mapping->nrpages == 0)) {
++ (inode->i_mapping->nrpages == 0 && !need_resched())) {
+ spin_unlock(&inode->i_lock);
+ continue;
+ }
+@@ -30,6 +35,7 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
+ spin_unlock(&inode->i_lock);
+ spin_unlock(&sb->s_inode_list_lock);
+
++ cond_resched();
+ invalidate_mapping_pages(inode->i_mapping, 0, -1);
+ iput(toput_inode);
+ toput_inode = inode;
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 4614ee25f621..9d566e62684c 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -107,7 +107,7 @@ static int glock_wake_function(wait_queue_entry_t *wait, unsigned int mode,
+
+ static wait_queue_head_t *glock_waitqueue(struct lm_lockname *name)
+ {
+- u32 hash = jhash2((u32 *)name, sizeof(*name) / 4, 0);
++ u32 hash = jhash2((u32 *)name, ht_parms.key_len / 4, 0);
+
+ return glock_wait_table + hash_32(hash, GLOCK_WAIT_TABLE_BITS);
+ }
+diff --git a/fs/iomap.c b/fs/iomap.c
+index e57fb1e534c5..fac45206418a 100644
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -117,6 +117,12 @@ iomap_page_create(struct inode *inode, struct page *page)
+ atomic_set(&iop->read_count, 0);
+ atomic_set(&iop->write_count, 0);
+ bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
++
++ /*
++ * migrate_page_move_mapping() assumes that pages with private data have
++ * their count elevated by 1.
++ */
++ get_page(page);
+ set_page_private(page, (unsigned long)iop);
+ SetPagePrivate(page);
+ return iop;
+@@ -133,6 +139,7 @@ iomap_page_release(struct page *page)
+ WARN_ON_ONCE(atomic_read(&iop->write_count));
+ ClearPagePrivate(page);
+ set_page_private(page, 0);
++ put_page(page);
+ kfree(iop);
+ }
+
+@@ -565,8 +572,10 @@ iomap_migrate_page(struct address_space *mapping, struct page *newpage,
+
+ if (page_has_private(page)) {
+ ClearPagePrivate(page);
++ get_page(newpage);
+ set_page_private(newpage, page_private(page));
+ set_page_private(page, 0);
++ put_page(page);
+ SetPagePrivate(newpage);
+ }
+
+@@ -1778,6 +1787,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
+ loff_t pos = iocb->ki_pos, start = pos;
+ loff_t end = iocb->ki_pos + count - 1, ret = 0;
+ unsigned int flags = IOMAP_DIRECT;
++ bool wait_for_completion = is_sync_kiocb(iocb);
+ struct blk_plug plug;
+ struct iomap_dio *dio;
+
+@@ -1797,7 +1807,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
+ dio->end_io = end_io;
+ dio->error = 0;
+ dio->flags = 0;
+- dio->wait_for_completion = is_sync_kiocb(iocb);
+
+ dio->submit.iter = iter;
+ dio->submit.waiter = current;
+@@ -1852,7 +1861,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
+ dio_warn_stale_pagecache(iocb->ki_filp);
+ ret = 0;
+
+- if (iov_iter_rw(iter) == WRITE && !dio->wait_for_completion &&
++ if (iov_iter_rw(iter) == WRITE && !wait_for_completion &&
+ !inode->i_sb->s_dio_done_wq) {
+ ret = sb_init_dio_done_wq(inode->i_sb);
+ if (ret < 0)
+@@ -1868,7 +1877,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
+ if (ret <= 0) {
+ /* magic error code to fall back to buffered I/O */
+ if (ret == -ENOTBLK) {
+- dio->wait_for_completion = true;
++ wait_for_completion = true;
+ ret = 0;
+ }
+ break;
+@@ -1890,8 +1899,24 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
+ if (dio->flags & IOMAP_DIO_WRITE_FUA)
+ dio->flags &= ~IOMAP_DIO_NEED_SYNC;
+
++ /*
++ * We are about to drop our additional submission reference, which
++ * might be the last reference to the dio. There are three three
++ * different ways we can progress here:
++ *
++ * (a) If this is the last reference we will always complete and free
++ * the dio ourselves.
++ * (b) If this is not the last reference, and we serve an asynchronous
++ * iocb, we must never touch the dio after the decrement, the
++ * I/O completion handler will complete and free it.
++ * (c) If this is not the last reference, but we serve a synchronous
++ * iocb, the I/O completion handler will wake us up on the drop
++ * of the final reference, and we will complete and free it here
++ * after we got woken by the I/O completion handler.
++ */
++ dio->wait_for_completion = wait_for_completion;
+ if (!atomic_dec_and_test(&dio->ref)) {
+- if (!dio->wait_for_completion)
++ if (!wait_for_completion)
+ return -EIOCBQUEUED;
+
+ for (;;) {
+@@ -1908,9 +1933,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
+ __set_current_state(TASK_RUNNING);
+ }
+
+- ret = iomap_dio_complete(dio);
+-
+- return ret;
++ return iomap_dio_complete(dio);
+
+ out_free_dio:
+ kfree(dio);
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 5ef2c71348bd..6b666d187907 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1906,6 +1906,11 @@ static int nfs_parse_devname(const char *dev_name,
+ size_t len;
+ char *end;
+
++ if (unlikely(!dev_name || !*dev_name)) {
++ dfprintk(MOUNT, "NFS: device name not specified\n");
++ return -EINVAL;
++ }
++
+ /* Is the host name protected with square brakcets? */
+ if (*dev_name == '[') {
+ end = strchr(++dev_name, ']');
+diff --git a/fs/proc/generic.c b/fs/proc/generic.c
+index 8ae109429a88..e39bac94dead 100644
+--- a/fs/proc/generic.c
++++ b/fs/proc/generic.c
+@@ -256,7 +256,7 @@ struct dentry *proc_lookup_de(struct inode *dir, struct dentry *dentry,
+ inode = proc_get_inode(dir->i_sb, de);
+ if (!inode)
+ return ERR_PTR(-ENOMEM);
+- d_set_d_op(dentry, &proc_misc_dentry_ops);
++ d_set_d_op(dentry, de->proc_dops);
+ return d_splice_alias(inode, dentry);
+ }
+ read_unlock(&proc_subdir_lock);
+@@ -429,6 +429,8 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent,
+ INIT_LIST_HEAD(&ent->pde_openers);
+ proc_set_user(ent, (*parent)->uid, (*parent)->gid);
+
++ ent->proc_dops = &proc_misc_dentry_ops;
++
+ out:
+ return ent;
+ }
+diff --git a/fs/proc/internal.h b/fs/proc/internal.h
+index 5185d7f6a51e..95b14196f284 100644
+--- a/fs/proc/internal.h
++++ b/fs/proc/internal.h
+@@ -44,6 +44,7 @@ struct proc_dir_entry {
+ struct completion *pde_unload_completion;
+ const struct inode_operations *proc_iops;
+ const struct file_operations *proc_fops;
++ const struct dentry_operations *proc_dops;
+ union {
+ const struct seq_operations *seq_ops;
+ int (*single_show)(struct seq_file *, void *);
+diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
+index d5e0fcb3439e..a7b12435519e 100644
+--- a/fs/proc/proc_net.c
++++ b/fs/proc/proc_net.c
+@@ -38,6 +38,22 @@ static struct net *get_proc_net(const struct inode *inode)
+ return maybe_get_net(PDE_NET(PDE(inode)));
+ }
+
++static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags)
++{
++ return 0;
++}
++
++static const struct dentry_operations proc_net_dentry_ops = {
++ .d_revalidate = proc_net_d_revalidate,
++ .d_delete = always_delete_dentry,
++};
++
++static void pde_force_lookup(struct proc_dir_entry *pde)
++{
++ /* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */
++ pde->proc_dops = &proc_net_dentry_ops;
++}
++
+ static int seq_open_net(struct inode *inode, struct file *file)
+ {
+ unsigned int state_size = PDE(inode)->state_size;
+@@ -90,6 +106,7 @@ struct proc_dir_entry *proc_create_net_data(const char *name, umode_t mode,
+ p = proc_create_reg(name, mode, &parent, data);
+ if (!p)
+ return NULL;
++ pde_force_lookup(p);
+ p->proc_fops = &proc_net_seq_fops;
+ p->seq_ops = ops;
+ p->state_size = state_size;
+@@ -133,6 +150,7 @@ struct proc_dir_entry *proc_create_net_data_write(const char *name, umode_t mode
+ p = proc_create_reg(name, mode, &parent, data);
+ if (!p)
+ return NULL;
++ pde_force_lookup(p);
+ p->proc_fops = &proc_net_seq_fops;
+ p->seq_ops = ops;
+ p->state_size = state_size;
+@@ -181,6 +199,7 @@ struct proc_dir_entry *proc_create_net_single(const char *name, umode_t mode,
+ p = proc_create_reg(name, mode, &parent, data);
+ if (!p)
+ return NULL;
++ pde_force_lookup(p);
+ p->proc_fops = &proc_net_single_fops;
+ p->single_show = show;
+ return proc_register(parent, p);
+@@ -223,6 +242,7 @@ struct proc_dir_entry *proc_create_net_single_write(const char *name, umode_t mo
+ p = proc_create_reg(name, mode, &parent, data);
+ if (!p)
+ return NULL;
++ pde_force_lookup(p);
+ p->proc_fops = &proc_net_single_fops;
+ p->single_show = show;
+ p->write = write;
+diff --git a/include/drm/drm_cache.h b/include/drm/drm_cache.h
+index bfe1639df02d..97fc498dc767 100644
+--- a/include/drm/drm_cache.h
++++ b/include/drm/drm_cache.h
+@@ -47,6 +47,24 @@ static inline bool drm_arch_can_wc_memory(void)
+ return false;
+ #elif defined(CONFIG_MIPS) && defined(CONFIG_CPU_LOONGSON3)
+ return false;
++#elif defined(CONFIG_ARM) || defined(CONFIG_ARM64)
++ /*
++ * The DRM driver stack is designed to work with cache coherent devices
++ * only, but permits an optimization to be enabled in some cases, where
++ * for some buffers, both the CPU and the GPU use uncached mappings,
++ * removing the need for DMA snooping and allocation in the CPU caches.
++ *
++ * The use of uncached GPU mappings relies on the correct implementation
++ * of the PCIe NoSnoop TLP attribute by the platform, otherwise the GPU
++ * will use cached mappings nonetheless. On x86 platforms, this does not
++ * seem to matter, as uncached CPU mappings will snoop the caches in any
++ * case. However, on ARM and arm64, enabling this optimization on a
++ * platform where NoSnoop is ignored results in loss of coherency, which
++ * breaks correct operation of the device. Since we have no way of
++ * detecting whether NoSnoop works or not, just disable this
++ * optimization entirely for ARM and arm64.
++ */
++ return false;
+ #else
+ return true;
+ #endif
+diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
+index 8bdbb5f29494..3188c0bef3e7 100644
+--- a/include/linux/irqchip/arm-gic-v3.h
++++ b/include/linux/irqchip/arm-gic-v3.h
+@@ -319,7 +319,7 @@
+ #define GITS_TYPER_PLPIS (1UL << 0)
+ #define GITS_TYPER_VLPIS (1UL << 1)
+ #define GITS_TYPER_ITT_ENTRY_SIZE_SHIFT 4
+-#define GITS_TYPER_ITT_ENTRY_SIZE(r) ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0x1f) + 1)
++#define GITS_TYPER_ITT_ENTRY_SIZE(r) ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0xf) + 1)
+ #define GITS_TYPER_IDBITS_SHIFT 8
+ #define GITS_TYPER_DEVBITS_SHIFT 13
+ #define GITS_TYPER_DEVBITS(r) ((((r) >> GITS_TYPER_DEVBITS_SHIFT) & 0x1f) + 1)
+diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
+index 7ddfc65586b0..4335bd771ce5 100644
+--- a/include/linux/stmmac.h
++++ b/include/linux/stmmac.h
+@@ -184,6 +184,7 @@ struct plat_stmmacenet_data {
+ struct clk *pclk;
+ struct clk *clk_ptp_ref;
+ unsigned int clk_ptp_rate;
++ unsigned int clk_ref_rate;
+ struct reset_control *stmmac_rst;
+ struct stmmac_axi *axi;
+ int has_gmac4;
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index 03cc59ee9c95..cebadd6af4d9 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -677,7 +677,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
+ }
+
+ if (htab_is_prealloc(htab)) {
+- pcpu_freelist_push(&htab->freelist, &l->fnode);
++ __pcpu_freelist_push(&htab->freelist, &l->fnode);
+ } else {
+ atomic_dec(&htab->count);
+ l->htab = htab;
+@@ -739,7 +739,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
+ } else {
+ struct pcpu_freelist_node *l;
+
+- l = pcpu_freelist_pop(&htab->freelist);
++ l = __pcpu_freelist_pop(&htab->freelist);
+ if (!l)
+ return ERR_PTR(-E2BIG);
+ l_new = container_of(l, struct htab_elem, fnode);
+diff --git a/kernel/bpf/percpu_freelist.c b/kernel/bpf/percpu_freelist.c
+index 673fa6fe2d73..0c1b4ba9e90e 100644
+--- a/kernel/bpf/percpu_freelist.c
++++ b/kernel/bpf/percpu_freelist.c
+@@ -28,8 +28,8 @@ void pcpu_freelist_destroy(struct pcpu_freelist *s)
+ free_percpu(s->freelist);
+ }
+
+-static inline void __pcpu_freelist_push(struct pcpu_freelist_head *head,
+- struct pcpu_freelist_node *node)
++static inline void ___pcpu_freelist_push(struct pcpu_freelist_head *head,
++ struct pcpu_freelist_node *node)
+ {
+ raw_spin_lock(&head->lock);
+ node->next = head->first;
+@@ -37,12 +37,22 @@ static inline void __pcpu_freelist_push(struct pcpu_freelist_head *head,
+ raw_spin_unlock(&head->lock);
+ }
+
+-void pcpu_freelist_push(struct pcpu_freelist *s,
++void __pcpu_freelist_push(struct pcpu_freelist *s,
+ struct pcpu_freelist_node *node)
+ {
+ struct pcpu_freelist_head *head = this_cpu_ptr(s->freelist);
+
+- __pcpu_freelist_push(head, node);
++ ___pcpu_freelist_push(head, node);
++}
++
++void pcpu_freelist_push(struct pcpu_freelist *s,
++ struct pcpu_freelist_node *node)
++{
++ unsigned long flags;
++
++ local_irq_save(flags);
++ __pcpu_freelist_push(s, node);
++ local_irq_restore(flags);
+ }
+
+ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
+@@ -63,7 +73,7 @@ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
+ for_each_possible_cpu(cpu) {
+ again:
+ head = per_cpu_ptr(s->freelist, cpu);
+- __pcpu_freelist_push(head, buf);
++ ___pcpu_freelist_push(head, buf);
+ i++;
+ buf += elem_size;
+ if (i == nr_elems)
+@@ -74,14 +84,12 @@ again:
+ local_irq_restore(flags);
+ }
+
+-struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
++struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *s)
+ {
+ struct pcpu_freelist_head *head;
+ struct pcpu_freelist_node *node;
+- unsigned long flags;
+ int orig_cpu, cpu;
+
+- local_irq_save(flags);
+ orig_cpu = cpu = raw_smp_processor_id();
+ while (1) {
+ head = per_cpu_ptr(s->freelist, cpu);
+@@ -89,16 +97,25 @@ struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
+ node = head->first;
+ if (node) {
+ head->first = node->next;
+- raw_spin_unlock_irqrestore(&head->lock, flags);
++ raw_spin_unlock(&head->lock);
+ return node;
+ }
+ raw_spin_unlock(&head->lock);
+ cpu = cpumask_next(cpu, cpu_possible_mask);
+ if (cpu >= nr_cpu_ids)
+ cpu = 0;
+- if (cpu == orig_cpu) {
+- local_irq_restore(flags);
++ if (cpu == orig_cpu)
+ return NULL;
+- }
+ }
+ }
++
++struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
++{
++ struct pcpu_freelist_node *ret;
++ unsigned long flags;
++
++ local_irq_save(flags);
++ ret = __pcpu_freelist_pop(s);
++ local_irq_restore(flags);
++ return ret;
++}
+diff --git a/kernel/bpf/percpu_freelist.h b/kernel/bpf/percpu_freelist.h
+index 3049aae8ea1e..c3960118e617 100644
+--- a/kernel/bpf/percpu_freelist.h
++++ b/kernel/bpf/percpu_freelist.h
+@@ -22,8 +22,12 @@ struct pcpu_freelist_node {
+ struct pcpu_freelist_node *next;
+ };
+
++/* pcpu_freelist_* do spin_lock_irqsave. */
+ void pcpu_freelist_push(struct pcpu_freelist *, struct pcpu_freelist_node *);
+ struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *);
++/* __pcpu_freelist_* do spin_lock only. caller must disable irqs. */
++void __pcpu_freelist_push(struct pcpu_freelist *, struct pcpu_freelist_node *);
++struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *);
+ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
+ u32 nr_elems);
+ int pcpu_freelist_init(struct pcpu_freelist *);
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 382c09dddf93..cc40b8be1171 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -701,8 +701,13 @@ static int map_lookup_elem(union bpf_attr *attr)
+
+ if (bpf_map_is_dev_bound(map)) {
+ err = bpf_map_offload_lookup_elem(map, key, value);
+- } else if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
+- map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
++ goto done;
++ }
++
++ preempt_disable();
++ this_cpu_inc(bpf_prog_active);
++ if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
++ map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
+ err = bpf_percpu_hash_copy(map, key, value);
+ } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
+ err = bpf_percpu_array_copy(map, key, value);
+@@ -722,7 +727,10 @@ static int map_lookup_elem(union bpf_attr *attr)
+ rcu_read_unlock();
+ err = ptr ? 0 : -ENOENT;
+ }
++ this_cpu_dec(bpf_prog_active);
++ preempt_enable();
+
++done:
+ if (err)
+ goto free_value;
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 4fb9d5054618..aa996a0854b9 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -436,18 +436,18 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp,
+ loff_t *ppos)
+ {
+- int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+-
+- if (ret || !write)
+- return ret;
+-
++ int ret;
++ int perf_cpu = sysctl_perf_cpu_time_max_percent;
+ /*
+ * If throttling is disabled don't allow the write:
+ */
+- if (sysctl_perf_cpu_time_max_percent == 100 ||
+- sysctl_perf_cpu_time_max_percent == 0)
++ if (write && (perf_cpu == 100 || perf_cpu == 0))
+ return -EINVAL;
+
++ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
++ if (ret || !write)
++ return ret;
++
+ max_samples_per_tick = DIV_ROUND_UP(sysctl_perf_event_sample_rate, HZ);
+ perf_sample_period_ns = NSEC_PER_SEC / sysctl_perf_event_sample_rate;
+ update_perf_cpu_limits();
+diff --git a/kernel/relay.c b/kernel/relay.c
+index 04f248644e06..9e0f52375487 100644
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -428,6 +428,8 @@ static struct dentry *relay_create_buf_file(struct rchan *chan,
+ dentry = chan->cb->create_buf_file(tmpname, chan->parent,
+ S_IRUSR, buf,
+ &chan->is_global);
++ if (IS_ERR(dentry))
++ dentry = NULL;
+
+ kfree(tmpname);
+
+@@ -461,7 +463,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu)
+ dentry = chan->cb->create_buf_file(NULL, NULL,
+ S_IRUSR, buf,
+ &chan->is_global);
+- if (WARN_ON(dentry))
++ if (IS_ERR_OR_NULL(dentry))
+ goto free_buf;
+ }
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 9864a35c8bb5..6c28d519447d 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -1158,22 +1158,12 @@ static int __bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *
+
+ int bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *prog)
+ {
+- int err;
+-
+- mutex_lock(&bpf_event_mutex);
+- err = __bpf_probe_register(btp, prog);
+- mutex_unlock(&bpf_event_mutex);
+- return err;
++ return __bpf_probe_register(btp, prog);
+ }
+
+ int bpf_probe_unregister(struct bpf_raw_event_map *btp, struct bpf_prog *prog)
+ {
+- int err;
+-
+- mutex_lock(&bpf_event_mutex);
+- err = tracepoint_probe_unregister(btp->tp, (void *)btp->bpf_func, prog);
+- mutex_unlock(&bpf_event_mutex);
+- return err;
++ return tracepoint_probe_unregister(btp->tp, (void *)btp->bpf_func, prog);
+ }
+
+ int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id,
+diff --git a/lib/test_kmod.c b/lib/test_kmod.c
+index d82d022111e0..9cf77628fc91 100644
+--- a/lib/test_kmod.c
++++ b/lib/test_kmod.c
+@@ -632,7 +632,7 @@ static void __kmod_config_free(struct test_config *config)
+ config->test_driver = NULL;
+
+ kfree_const(config->test_fs);
+- config->test_driver = NULL;
++ config->test_fs = NULL;
+ }
+
+ static void kmod_config_free(struct kmod_test_device *test_dev)
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index c6119ad3561e..156991edec2a 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -1213,11 +1213,13 @@ static inline int pageblock_free(struct page *page)
+ return PageBuddy(page) && page_order(page) >= pageblock_order;
+ }
+
+-/* Return the start of the next active pageblock after a given page */
+-static struct page *next_active_pageblock(struct page *page)
++/* Return the pfn of the start of the next active pageblock after a given pfn */
++static unsigned long next_active_pageblock(unsigned long pfn)
+ {
++ struct page *page = pfn_to_page(pfn);
++
+ /* Ensure the starting page is pageblock-aligned */
+- BUG_ON(page_to_pfn(page) & (pageblock_nr_pages - 1));
++ BUG_ON(pfn & (pageblock_nr_pages - 1));
+
+ /* If the entire pageblock is free, move to the end of free page */
+ if (pageblock_free(page)) {
+@@ -1225,16 +1227,16 @@ static struct page *next_active_pageblock(struct page *page)
+ /* be careful. we don't have locks, page_order can be changed.*/
+ order = page_order(page);
+ if ((order < MAX_ORDER) && (order >= pageblock_order))
+- return page + (1 << order);
++ return pfn + (1 << order);
+ }
+
+- return page + pageblock_nr_pages;
++ return pfn + pageblock_nr_pages;
+ }
+
+-static bool is_pageblock_removable_nolock(struct page *page)
++static bool is_pageblock_removable_nolock(unsigned long pfn)
+ {
++ struct page *page = pfn_to_page(pfn);
+ struct zone *zone;
+- unsigned long pfn;
+
+ /*
+ * We have to be careful here because we are iterating over memory
+@@ -1257,12 +1259,14 @@ static bool is_pageblock_removable_nolock(struct page *page)
+ /* Checks if this range of memory is likely to be hot-removable. */
+ bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
+ {
+- struct page *page = pfn_to_page(start_pfn);
+- struct page *end_page = page + nr_pages;
++ unsigned long end_pfn, pfn;
++
++ end_pfn = min(start_pfn + nr_pages,
++ zone_end_pfn(page_zone(pfn_to_page(start_pfn))));
+
+ /* Check the starting page of each pageblock within the range */
+- for (; page < end_page; page = next_active_pageblock(page)) {
+- if (!is_pageblock_removable_nolock(page))
++ for (pfn = start_pfn; pfn < end_pfn; pfn = next_active_pageblock(pfn)) {
++ if (!is_pageblock_removable_nolock(pfn))
+ return false;
+ cond_resched();
+ }
+@@ -1298,6 +1302,9 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
+ i++;
+ if (i == MAX_ORDER_NR_PAGES || pfn + i >= end_pfn)
+ continue;
++ /* Check if we got outside of the zone */
++ if (zone && !zone_spans_pfn(zone, pfn + i))
++ return 0;
+ page = pfn_to_page(pfn + i);
+ if (zone && page_zone(page) != zone)
+ return 0;
+diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
+index e8090f099eb8..ef0dec20c7d8 100644
+--- a/net/batman-adv/bat_v_elp.c
++++ b/net/batman-adv/bat_v_elp.c
+@@ -104,6 +104,9 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh)
+
+ ret = cfg80211_get_station(real_netdev, neigh->addr, &sinfo);
+
++ /* free the TID stats immediately */
++ cfg80211_sinfo_release_content(&sinfo);
++
+ dev_put(real_netdev);
+ if (ret == -ENOENT) {
+ /* Node is not associated anymore! It would be
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 5e55cef0cec3..6693e209efe8 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2293,9 +2293,12 @@ static int compat_do_replace(struct net *net, void __user *user,
+
+ xt_compat_lock(NFPROTO_BRIDGE);
+
+- ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
+- if (ret < 0)
+- goto out_unlock;
++ if (tmp.nentries) {
++ ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
++ if (ret < 0)
++ goto out_unlock;
++ }
++
+ ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
+ if (ret < 0)
+ goto out_unlock;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index fb0080e84bd4..bed9061102f4 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3909,10 +3909,12 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ /* Only some socketops are supported */
+ switch (optname) {
+ case SO_RCVBUF:
++ val = min_t(u32, val, sysctl_rmem_max);
+ sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
+ sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
+ break;
+ case SO_SNDBUF:
++ val = min_t(u32, val, sysctl_wmem_max);
+ sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
+ sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
+ break;
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index 7f56944b020f..40a7cd56e008 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -74,6 +74,33 @@ drop:
+ return 0;
+ }
+
++static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi,
++ int encap_type)
++{
++ struct ip_tunnel *tunnel;
++ const struct iphdr *iph = ip_hdr(skb);
++ struct net *net = dev_net(skb->dev);
++ struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
++
++ tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
++ iph->saddr, iph->daddr, 0);
++ if (tunnel) {
++ if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
++ goto drop;
++
++ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
++
++ skb->dev = tunnel->dev;
++
++ return xfrm_input(skb, nexthdr, spi, encap_type);
++ }
++
++ return -EINVAL;
++drop:
++ kfree_skb(skb);
++ return 0;
++}
++
+ static int vti_rcv(struct sk_buff *skb)
+ {
+ XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+@@ -82,6 +109,14 @@ static int vti_rcv(struct sk_buff *skb)
+ return vti_input(skb, ip_hdr(skb)->protocol, 0, 0);
+ }
+
++static int vti_rcv_ipip(struct sk_buff *skb)
++{
++ XFRM_SPI_SKB_CB(skb)->family = AF_INET;
++ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
++
++ return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0);
++}
++
+ static int vti_rcv_cb(struct sk_buff *skb, int err)
+ {
+ unsigned short family;
+@@ -435,6 +470,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = {
+ .priority = 100,
+ };
+
++static struct xfrm_tunnel ipip_handler __read_mostly = {
++ .handler = vti_rcv_ipip,
++ .err_handler = vti4_err,
++ .priority = 0,
++};
++
+ static int __net_init vti_init_net(struct net *net)
+ {
+ int err;
+@@ -603,6 +644,13 @@ static int __init vti_init(void)
+ if (err < 0)
+ goto xfrm_proto_comp_failed;
+
++ msg = "ipip tunnel";
++ err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
++ if (err < 0) {
++ pr_info("%s: cant't register tunnel\n",__func__);
++ goto xfrm_tunnel_failed;
++ }
++
+ msg = "netlink interface";
+ err = rtnl_link_register(&vti_link_ops);
+ if (err < 0)
+@@ -612,6 +660,8 @@ static int __init vti_init(void)
+
+ rtnl_link_failed:
+ xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
++xfrm_tunnel_failed:
++ xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
+ xfrm_proto_comp_failed:
+ xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
+ xfrm_proto_ah_failed:
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 518364f4abcc..55a77314340a 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -2220,6 +2220,18 @@ static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user
+ u->tcp_fin_timeout,
+ u->udp_timeout);
+
++#ifdef CONFIG_IP_VS_PROTO_TCP
++ if (u->tcp_timeout < 0 || u->tcp_timeout > (INT_MAX / HZ) ||
++ u->tcp_fin_timeout < 0 || u->tcp_fin_timeout > (INT_MAX / HZ)) {
++ return -EINVAL;
++ }
++#endif
++
++#ifdef CONFIG_IP_VS_PROTO_UDP
++ if (u->udp_timeout < 0 || u->udp_timeout > (INT_MAX / HZ))
++ return -EINVAL;
++#endif
++
+ #ifdef CONFIG_IP_VS_PROTO_TCP
+ if (u->tcp_timeout) {
+ pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 277d02a8cac8..895171a2e1f1 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1007,6 +1007,22 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
+ }
+
+ if (nf_ct_key_equal(h, tuple, zone, net)) {
++ /* Tuple is taken already, so caller will need to find
++ * a new source port to use.
++ *
++ * Only exception:
++ * If the *original tuples* are identical, then both
++ * conntracks refer to the same flow.
++ * This is a rare situation, it can occur e.g. when
++ * more than one UDP packet is sent from same socket
++ * in different threads.
++ *
++ * Let nf_ct_resolve_clash() deal with this later.
++ */
++ if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
++ &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple))
++ continue;
++
+ NF_CT_STAT_INC_ATOMIC(net, found);
+ rcu_read_unlock();
+ return 1;
+diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
+index 0d0d68c989df..1dae02a97ee3 100644
+--- a/net/netfilter/xt_TEE.c
++++ b/net/netfilter/xt_TEE.c
+@@ -14,6 +14,8 @@
+ #include <linux/skbuff.h>
+ #include <linux/route.h>
+ #include <linux/netfilter/x_tables.h>
++#include <net/net_namespace.h>
++#include <net/netns/generic.h>
+ #include <net/route.h>
+ #include <net/netfilter/ipv4/nf_dup_ipv4.h>
+ #include <net/netfilter/ipv6/nf_dup_ipv6.h>
+@@ -25,8 +27,15 @@ struct xt_tee_priv {
+ int oif;
+ };
+
++static unsigned int tee_net_id __read_mostly;
+ static const union nf_inet_addr tee_zero_address;
+
++struct tee_net {
++ struct list_head priv_list;
++ /* lock protects the priv_list */
++ struct mutex lock;
++};
++
+ static unsigned int
+ tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
+ {
+@@ -51,17 +60,16 @@ tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+ }
+ #endif
+
+-static DEFINE_MUTEX(priv_list_mutex);
+-static LIST_HEAD(priv_list);
+-
+ static int tee_netdev_event(struct notifier_block *this, unsigned long event,
+ void *ptr)
+ {
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++ struct net *net = dev_net(dev);
++ struct tee_net *tn = net_generic(net, tee_net_id);
+ struct xt_tee_priv *priv;
+
+- mutex_lock(&priv_list_mutex);
+- list_for_each_entry(priv, &priv_list, list) {
++ mutex_lock(&tn->lock);
++ list_for_each_entry(priv, &tn->priv_list, list) {
+ switch (event) {
+ case NETDEV_REGISTER:
+ if (!strcmp(dev->name, priv->tginfo->oif))
+@@ -79,13 +87,14 @@ static int tee_netdev_event(struct notifier_block *this, unsigned long event,
+ break;
+ }
+ }
+- mutex_unlock(&priv_list_mutex);
++ mutex_unlock(&tn->lock);
+
+ return NOTIFY_DONE;
+ }
+
+ static int tee_tg_check(const struct xt_tgchk_param *par)
+ {
++ struct tee_net *tn = net_generic(par->net, tee_net_id);
+ struct xt_tee_tginfo *info = par->targinfo;
+ struct xt_tee_priv *priv;
+
+@@ -95,6 +104,8 @@ static int tee_tg_check(const struct xt_tgchk_param *par)
+ return -EINVAL;
+
+ if (info->oif[0]) {
++ struct net_device *dev;
++
+ if (info->oif[sizeof(info->oif)-1] != '\0')
+ return -EINVAL;
+
+@@ -106,9 +117,14 @@ static int tee_tg_check(const struct xt_tgchk_param *par)
+ priv->oif = -1;
+ info->priv = priv;
+
+- mutex_lock(&priv_list_mutex);
+- list_add(&priv->list, &priv_list);
+- mutex_unlock(&priv_list_mutex);
++ dev = dev_get_by_name(par->net, info->oif);
++ if (dev) {
++ priv->oif = dev->ifindex;
++ dev_put(dev);
++ }
++ mutex_lock(&tn->lock);
++ list_add(&priv->list, &tn->priv_list);
++ mutex_unlock(&tn->lock);
+ } else
+ info->priv = NULL;
+
+@@ -118,12 +134,13 @@ static int tee_tg_check(const struct xt_tgchk_param *par)
+
+ static void tee_tg_destroy(const struct xt_tgdtor_param *par)
+ {
++ struct tee_net *tn = net_generic(par->net, tee_net_id);
+ struct xt_tee_tginfo *info = par->targinfo;
+
+ if (info->priv) {
+- mutex_lock(&priv_list_mutex);
++ mutex_lock(&tn->lock);
+ list_del(&info->priv->list);
+- mutex_unlock(&priv_list_mutex);
++ mutex_unlock(&tn->lock);
+ kfree(info->priv);
+ }
+ static_key_slow_dec(&xt_tee_enabled);
+@@ -156,6 +173,21 @@ static struct xt_target tee_tg_reg[] __read_mostly = {
+ #endif
+ };
+
++static int __net_init tee_net_init(struct net *net)
++{
++ struct tee_net *tn = net_generic(net, tee_net_id);
++
++ INIT_LIST_HEAD(&tn->priv_list);
++ mutex_init(&tn->lock);
++ return 0;
++}
++
++static struct pernet_operations tee_net_ops = {
++ .init = tee_net_init,
++ .id = &tee_net_id,
++ .size = sizeof(struct tee_net),
++};
++
+ static struct notifier_block tee_netdev_notifier = {
+ .notifier_call = tee_netdev_event,
+ };
+@@ -164,22 +196,32 @@ static int __init tee_tg_init(void)
+ {
+ int ret;
+
+- ret = xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
+- if (ret)
++ ret = register_pernet_subsys(&tee_net_ops);
++ if (ret < 0)
+ return ret;
++
++ ret = xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
++ if (ret < 0)
++ goto cleanup_subsys;
++
+ ret = register_netdevice_notifier(&tee_netdev_notifier);
+- if (ret) {
+- xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
+- return ret;
+- }
++ if (ret < 0)
++ goto unregister_targets;
+
+ return 0;
++
++unregister_targets:
++ xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
++cleanup_subsys:
++ unregister_pernet_subsys(&tee_net_ops);
++ return ret;
+ }
+
+ static void __exit tee_tg_exit(void)
+ {
+ unregister_netdevice_notifier(&tee_netdev_notifier);
+ xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
++ unregister_pernet_subsys(&tee_net_ops);
+ }
+
+ module_init(tee_tg_init);
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 5d3cce9e8744..15eb5d3d4750 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -75,6 +75,9 @@ static u32 virtio_transport_get_local_cid(void)
+ {
+ struct virtio_vsock *vsock = virtio_vsock_get();
+
++ if (!vsock)
++ return VMADDR_CID_ANY;
++
+ return vsock->guest_cid;
+ }
+
+@@ -584,10 +587,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+
+ virtio_vsock_update_guest_cid(vsock);
+
+- ret = vsock_core_init(&virtio_transport.transport);
+- if (ret < 0)
+- goto out_vqs;
+-
+ vsock->rx_buf_nr = 0;
+ vsock->rx_buf_max_nr = 0;
+ atomic_set(&vsock->queued_replies, 0);
+@@ -618,8 +617,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ mutex_unlock(&the_virtio_vsock_mutex);
+ return 0;
+
+-out_vqs:
+- vsock->vdev->config->del_vqs(vsock->vdev);
+ out:
+ kfree(vsock);
+ mutex_unlock(&the_virtio_vsock_mutex);
+@@ -637,6 +634,9 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+ flush_work(&vsock->event_work);
+ flush_work(&vsock->send_pkt_work);
+
++ /* Reset all connected sockets when the device disappear */
++ vsock_for_each_connected_socket(virtio_vsock_reset_sock);
++
+ vdev->config->reset(vdev);
+
+ mutex_lock(&vsock->rx_lock);
+@@ -669,7 +669,6 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+
+ mutex_lock(&the_virtio_vsock_mutex);
+ the_virtio_vsock = NULL;
+- vsock_core_exit();
+ mutex_unlock(&the_virtio_vsock_mutex);
+
+ vdev->config->del_vqs(vdev);
+@@ -702,14 +701,28 @@ static int __init virtio_vsock_init(void)
+ virtio_vsock_workqueue = alloc_workqueue("virtio_vsock", 0, 0);
+ if (!virtio_vsock_workqueue)
+ return -ENOMEM;
++
+ ret = register_virtio_driver(&virtio_vsock_driver);
+ if (ret)
+- destroy_workqueue(virtio_vsock_workqueue);
++ goto out_wq;
++
++ ret = vsock_core_init(&virtio_transport.transport);
++ if (ret)
++ goto out_vdr;
++
++ return 0;
++
++out_vdr:
++ unregister_virtio_driver(&virtio_vsock_driver);
++out_wq:
++ destroy_workqueue(virtio_vsock_workqueue);
+ return ret;
++
+ }
+
+ static void __exit virtio_vsock_exit(void)
+ {
++ vsock_core_exit();
+ unregister_virtio_driver(&virtio_vsock_driver);
+ destroy_workqueue(virtio_vsock_workqueue);
+ }
+diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
+index 08c88de0ffda..11975ec8d566 100644
+--- a/security/apparmor/domain.c
++++ b/security/apparmor/domain.c
+@@ -1444,7 +1444,10 @@ check:
+ new = aa_label_merge(label, target, GFP_KERNEL);
+ if (IS_ERR_OR_NULL(new)) {
+ info = "failed to build target label";
+- error = PTR_ERR(new);
++ if (!new)
++ error = -ENOMEM;
++ else
++ error = PTR_ERR(new);
+ new = NULL;
+ perms.allow = 0;
+ goto audit;
+diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
+index b455930a3eaf..ec73d83d0d31 100644
+--- a/tools/bpf/bpftool/map.c
++++ b/tools/bpf/bpftool/map.c
+@@ -370,6 +370,20 @@ static char **parse_bytes(char **argv, const char *name, unsigned char *val,
+ return argv + i;
+ }
+
++/* on per cpu maps we must copy the provided value on all value instances */
++static void fill_per_cpu_value(struct bpf_map_info *info, void *value)
++{
++ unsigned int i, n, step;
++
++ if (!map_is_per_cpu(info->type))
++ return;
++
++ n = get_possible_cpus();
++ step = round_up(info->value_size, 8);
++ for (i = 1; i < n; i++)
++ memcpy(value + i * step, value, info->value_size);
++}
++
+ static int parse_elem(char **argv, struct bpf_map_info *info,
+ void *key, void *value, __u32 key_size, __u32 value_size,
+ __u32 *flags, __u32 **value_fd)
+@@ -449,6 +463,8 @@ static int parse_elem(char **argv, struct bpf_map_info *info,
+ argv = parse_bytes(argv, "value", value, value_size);
+ if (!argv)
+ return -1;
++
++ fill_per_cpu_value(info, value);
+ }
+
+ return parse_elem(argv, info, key, NULL, key_size, value_size,
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index 0de024a6cc2b..bbba0d61570f 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -109,13 +109,14 @@ static void print_boot_time(__u64 nsecs, char *buf, unsigned int size)
+
+ static int prog_fd_by_tag(unsigned char *tag)
+ {
+- struct bpf_prog_info info = {};
+- __u32 len = sizeof(info);
+ unsigned int id = 0;
+ int err;
+ int fd;
+
+ while (true) {
++ struct bpf_prog_info info = {};
++ __u32 len = sizeof(info);
++
+ err = bpf_prog_get_next_id(id, &id);
+ if (err) {
+ p_err("%s", strerror(errno));
+diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
+index 6c1e7ceedcf3..53c11fc0855e 100644
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -1589,13 +1589,8 @@ static void perf_sample__fprint_metric(struct perf_script *script,
+ .force_header = false,
+ };
+ struct perf_evsel *ev2;
+- static bool init;
+ u64 val;
+
+- if (!init) {
+- perf_stat__init_shadow_stats();
+- init = true;
+- }
+ if (!evsel->stats)
+ perf_evlist__alloc_stats(script->session->evlist, false);
+ if (evsel_script(evsel->leader)->gnum++ == 0)
+@@ -1658,7 +1653,7 @@ static void process_event(struct perf_script *script,
+ return;
+ }
+
+- if (PRINT_FIELD(TRACE)) {
++ if (PRINT_FIELD(TRACE) && sample->raw_data) {
+ event_format__fprintf(evsel->tp_format, sample->cpu,
+ sample->raw_data, sample->raw_size, fp);
+ }
+@@ -2214,6 +2209,8 @@ static int __cmd_script(struct perf_script *script)
+
+ signal(SIGINT, sig_handler);
+
++ perf_stat__init_shadow_stats();
++
+ /* override event processing functions */
+ if (script->show_task_events) {
+ script->tool.comm = process_comm_event;
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index 22ab8e67c760..3f43aedb384d 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -2263,19 +2263,30 @@ static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp);
+
+ static bool perf_evlist__add_vfs_getname(struct perf_evlist *evlist)
+ {
+- struct perf_evsel *evsel = perf_evsel__newtp("probe", "vfs_getname");
++ bool found = false;
++ struct perf_evsel *evsel, *tmp;
++ struct parse_events_error err = { .idx = 0, };
++ int ret = parse_events(evlist, "probe:vfs_getname*", &err);
+
+- if (IS_ERR(evsel))
++ if (ret)
+ return false;
+
+- if (perf_evsel__field(evsel, "pathname") == NULL) {
++ evlist__for_each_entry_safe(evlist, evsel, tmp) {
++ if (!strstarts(perf_evsel__name(evsel), "probe:vfs_getname"))
++ continue;
++
++ if (perf_evsel__field(evsel, "pathname")) {
++ evsel->handler = trace__vfs_getname;
++ found = true;
++ continue;
++ }
++
++ list_del_init(&evsel->node);
++ evsel->evlist = NULL;
+ perf_evsel__delete(evsel);
+- return false;
+ }
+
+- evsel->handler = trace__vfs_getname;
+- perf_evlist__add(evlist, evsel);
+- return true;
++ return found;
+ }
+
+ static struct perf_evsel *perf_evsel__new_pgfault(u64 config)
+diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
+index 1ccbd3342069..383674f448fc 100644
+--- a/tools/perf/util/cpumap.c
++++ b/tools/perf/util/cpumap.c
+@@ -134,7 +134,12 @@ struct cpu_map *cpu_map__new(const char *cpu_list)
+ if (!cpu_list)
+ return cpu_map__read_all_cpu_map();
+
+- if (!isdigit(*cpu_list))
++ /*
++ * must handle the case of empty cpumap to cover
++ * TOPOLOGY header for NUMA nodes with no CPU
++ * ( e.g., because of CPU hotplug)
++ */
++ if (!isdigit(*cpu_list) && *cpu_list != '\0')
+ goto out;
+
+ while (isdigit(*cpu_list)) {
+@@ -181,8 +186,10 @@ struct cpu_map *cpu_map__new(const char *cpu_list)
+
+ if (nr_cpus > 0)
+ cpus = cpu_map__trim_new(nr_cpus, tmp_cpus);
+- else
++ else if (*cpu_list != '\0')
+ cpus = cpu_map__default_new();
++ else
++ cpus = cpu_map__dummy_new();
+ invalid:
+ free(tmp_cpus);
+ out:
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 6e70cc00c161..a701a8a48f00 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -87,6 +87,11 @@ static inline uint8_t elf_sym__type(const GElf_Sym *sym)
+ return GELF_ST_TYPE(sym->st_info);
+ }
+
++static inline uint8_t elf_sym__visibility(const GElf_Sym *sym)
++{
++ return GELF_ST_VISIBILITY(sym->st_other);
++}
++
+ #ifndef STT_GNU_IFUNC
+ #define STT_GNU_IFUNC 10
+ #endif
+@@ -111,7 +116,9 @@ static inline int elf_sym__is_label(const GElf_Sym *sym)
+ return elf_sym__type(sym) == STT_NOTYPE &&
+ sym->st_name != 0 &&
+ sym->st_shndx != SHN_UNDEF &&
+- sym->st_shndx != SHN_ABS;
++ sym->st_shndx != SHN_ABS &&
++ elf_sym__visibility(sym) != STV_HIDDEN &&
++ elf_sym__visibility(sym) != STV_INTERNAL;
+ }
+
+ static bool elf_sym__filter(GElf_Sym *sym)
+diff --git a/tools/testing/selftests/bpf/bpf_util.h b/tools/testing/selftests/bpf/bpf_util.h
+index 315a44fa32af..84fd6f1bf33e 100644
+--- a/tools/testing/selftests/bpf/bpf_util.h
++++ b/tools/testing/selftests/bpf/bpf_util.h
+@@ -13,7 +13,7 @@ static inline unsigned int bpf_num_possible_cpus(void)
+ unsigned int start, end, possible_cpus = 0;
+ char buff[128];
+ FILE *fp;
+- int n;
++ int len, n, i, j = 0;
+
+ fp = fopen(fcpu, "r");
+ if (!fp) {
+@@ -21,17 +21,27 @@ static inline unsigned int bpf_num_possible_cpus(void)
+ exit(1);
+ }
+
+- while (fgets(buff, sizeof(buff), fp)) {
+- n = sscanf(buff, "%u-%u", &start, &end);
+- if (n == 0) {
+- printf("Failed to retrieve # possible CPUs!\n");
+- exit(1);
+- } else if (n == 1) {
+- end = start;
++ if (!fgets(buff, sizeof(buff), fp)) {
++ printf("Failed to read %s!\n", fcpu);
++ exit(1);
++ }
++
++ len = strlen(buff);
++ for (i = 0; i <= len; i++) {
++ if (buff[i] == ',' || buff[i] == '\0') {
++ buff[i] = '\0';
++ n = sscanf(&buff[j], "%u-%u", &start, &end);
++ if (n <= 0) {
++ printf("Failed to retrieve # possible CPUs!\n");
++ exit(1);
++ } else if (n == 1) {
++ end = start;
++ }
++ possible_cpus += end - start + 1;
++ j = i + 1;
+ }
+- possible_cpus = start == 0 ? end + 1 : 0;
+- break;
+ }
++
+ fclose(fp);
+
+ return possible_cpus;
+diff --git a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
+index bab13dd025a6..0d26b5e3f966 100755
+--- a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
++++ b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
+@@ -37,6 +37,10 @@ prerequisite()
+ exit $ksft_skip
+ fi
+
++ present_cpus=`cat $SYSFS/devices/system/cpu/present`
++ present_max=${present_cpus##*-}
++ echo "present_cpus = $present_cpus present_max = $present_max"
++
+ echo -e "\t Cpus in online state: $online_cpus"
+
+ offline_cpus=`cat $SYSFS/devices/system/cpu/offline`
+@@ -151,6 +155,8 @@ online_cpus=0
+ online_max=0
+ offline_cpus=0
+ offline_max=0
++present_cpus=0
++present_max=0
+
+ while getopts e:ahp: opt; do
+ case $opt in
+@@ -190,9 +196,10 @@ if [ $allcpus -eq 0 ]; then
+ online_cpu_expect_success $online_max
+
+ if [[ $offline_cpus -gt 0 ]]; then
+- echo -e "\t offline to online to offline: cpu $offline_max"
+- online_cpu_expect_success $offline_max
+- offline_cpu_expect_success $offline_max
++ echo -e "\t offline to online to offline: cpu $present_max"
++ online_cpu_expect_success $present_max
++ offline_cpu_expect_success $present_max
++ online_cpu $present_max
+ fi
+ exit 0
+ else
+diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
+index 919aa2ac00af..9a3764a1084e 100644
+--- a/tools/testing/selftests/net/Makefile
++++ b/tools/testing/selftests/net/Makefile
+@@ -18,6 +18,6 @@ TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict tls
+ KSFT_KHDR_INSTALL := 1
+ include ../lib.mk
+
+-$(OUTPUT)/reuseport_bpf_numa: LDFLAGS += -lnuma
++$(OUTPUT)/reuseport_bpf_numa: LDLIBS += -lnuma
+ $(OUTPUT)/tcp_mmap: LDFLAGS += -lpthread
+ $(OUTPUT)/tcp_inq: LDFLAGS += -lpthread
+diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
+index 47ed6cef93fb..c9ff2b47bd1c 100644
+--- a/tools/testing/selftests/netfilter/Makefile
++++ b/tools/testing/selftests/netfilter/Makefile
+@@ -1,6 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Makefile for netfilter selftests
+
+-TEST_PROGS := nft_trans_stress.sh
++TEST_PROGS := nft_trans_stress.sh nft_nat.sh
+
+ include ../lib.mk
+diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config
+index 1017313e41a8..59caa8f71cd8 100644
+--- a/tools/testing/selftests/netfilter/config
++++ b/tools/testing/selftests/netfilter/config
+@@ -1,2 +1,2 @@
+ CONFIG_NET_NS=y
+-NF_TABLES_INET=y
++CONFIG_NF_TABLES_INET=y
+diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
+new file mode 100755
+index 000000000000..8ec76681605c
+--- /dev/null
++++ b/tools/testing/selftests/netfilter/nft_nat.sh
+@@ -0,0 +1,762 @@
++#!/bin/bash
++#
++# This test is for basic NAT functionality: snat, dnat, redirect, masquerade.
++#
++
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++ret=0
++
++nft --version > /dev/null 2>&1
++if [ $? -ne 0 ];then
++ echo "SKIP: Could not run test without nft tool"
++ exit $ksft_skip
++fi
++
++ip -Version > /dev/null 2>&1
++if [ $? -ne 0 ];then
++ echo "SKIP: Could not run test without ip tool"
++ exit $ksft_skip
++fi
++
++ip netns add ns0
++ip netns add ns1
++ip netns add ns2
++
++ip link add veth0 netns ns0 type veth peer name eth0 netns ns1
++ip link add veth1 netns ns0 type veth peer name eth0 netns ns2
++
++ip -net ns0 link set lo up
++ip -net ns0 link set veth0 up
++ip -net ns0 addr add 10.0.1.1/24 dev veth0
++ip -net ns0 addr add dead:1::1/64 dev veth0
++
++ip -net ns0 link set veth1 up
++ip -net ns0 addr add 10.0.2.1/24 dev veth1
++ip -net ns0 addr add dead:2::1/64 dev veth1
++
++for i in 1 2; do
++ ip -net ns$i link set lo up
++ ip -net ns$i link set eth0 up
++ ip -net ns$i addr add 10.0.$i.99/24 dev eth0
++ ip -net ns$i route add default via 10.0.$i.1
++ ip -net ns$i addr add dead:$i::99/64 dev eth0
++ ip -net ns$i route add default via dead:$i::1
++done
++
++bad_counter()
++{
++ local ns=$1
++ local counter=$2
++ local expect=$3
++
++ echo "ERROR: $counter counter in $ns has unexpected value (expected $expect)" 1>&2
++ ip netns exec $ns nft list counter inet filter $counter 1>&2
++}
++
++check_counters()
++{
++ ns=$1
++ local lret=0
++
++ cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84")
++ if [ $? -ne 0 ]; then
++ bad_counter $ns ns0in "packets 1 bytes 84"
++ lret=1
++ fi
++ cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84")
++ if [ $? -ne 0 ]; then
++ bad_counter $ns ns0out "packets 1 bytes 84"
++ lret=1
++ fi
++
++ expect="packets 1 bytes 104"
++ cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter $ns ns0in6 "$expect"
++ lret=1
++ fi
++ cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter $ns ns0out6 "$expect"
++ lret=1
++ fi
++
++ return $lret
++}
++
++check_ns0_counters()
++{
++ local ns=$1
++ local lret=0
++
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns0in | grep -q "packets 0 bytes 0")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 ns0in "packets 0 bytes 0"
++ lret=1
++ fi
++
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 ns0in6 "packets 0 bytes 0"
++ lret=1
++ fi
++
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns0out | grep -q "packets 0 bytes 0")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 ns0out "packets 0 bytes 0"
++ lret=1
++ fi
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 ns0out6 "packets 0 bytes 0"
++ lret=1
++ fi
++
++ for dir in "in" "out" ; do
++ expect="packets 1 bytes 84"
++ cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 $ns$dir "$expect"
++ lret=1
++ fi
++
++ expect="packets 1 bytes 104"
++ cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir}6 | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 $ns$dir6 "$expect"
++ lret=1
++ fi
++ done
++
++ return $lret
++}
++
++reset_counters()
++{
++ for i in 0 1 2;do
++ ip netns exec ns$i nft reset counters inet > /dev/null
++ done
++}
++
++test_local_dnat6()
++{
++ local lret=0
++ip netns exec ns0 nft -f - <<EOF
++table ip6 nat {
++ chain output {
++ type nat hook output priority 0; policy accept;
++ ip6 daddr dead:1::99 dnat to dead:2::99
++ }
++}
++EOF
++ if [ $? -ne 0 ]; then
++ echo "SKIP: Could not add add ip6 dnat hook"
++ return $ksft_skip
++ fi
++
++ # ping netns1, expect rewrite to netns2
++ ip netns exec ns0 ping -q -c 1 dead:1::99 > /dev/null
++ if [ $? -ne 0 ]; then
++ lret=1
++ echo "ERROR: ping6 failed"
++ return $lret
++ fi
++
++ expect="packets 0 bytes 0"
++ for dir in "in6" "out6" ; do
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 ns1$dir "$expect"
++ lret=1
++ fi
++ done
++
++ expect="packets 1 bytes 104"
++ for dir in "in6" "out6" ; do
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 ns2$dir "$expect"
++ lret=1
++ fi
++ done
++
++ # expect 0 count in ns1
++ expect="packets 0 bytes 0"
++ for dir in "in6" "out6" ; do
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns0$dir "$expect"
++ lret=1
++ fi
++ done
++
++ # expect 1 packet in ns2
++ expect="packets 1 bytes 104"
++ for dir in "in6" "out6" ; do
++ cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns2 ns0$dir "$expect"
++ lret=1
++ fi
++ done
++
++ test $lret -eq 0 && echo "PASS: ipv6 ping to ns1 was NATted to ns2"
++ ip netns exec ns0 nft flush chain ip6 nat output
++
++ return $lret
++}
++
++test_local_dnat()
++{
++ local lret=0
++ip netns exec ns0 nft -f - <<EOF
++table ip nat {
++ chain output {
++ type nat hook output priority 0; policy accept;
++ ip daddr 10.0.1.99 dnat to 10.0.2.99
++ }
++}
++EOF
++ # ping netns1, expect rewrite to netns2
++ ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
++ if [ $? -ne 0 ]; then
++ lret=1
++ echo "ERROR: ping failed"
++ return $lret
++ fi
++
++ expect="packets 0 bytes 0"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 ns1$dir "$expect"
++ lret=1
++ fi
++ done
++
++ expect="packets 1 bytes 84"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 ns2$dir "$expect"
++ lret=1
++ fi
++ done
++
++ # expect 0 count in ns1
++ expect="packets 0 bytes 0"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns0$dir "$expect"
++ lret=1
++ fi
++ done
++
++ # expect 1 packet in ns2
++ expect="packets 1 bytes 84"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns2 ns0$dir "$expect"
++ lret=1
++ fi
++ done
++
++ test $lret -eq 0 && echo "PASS: ping to ns1 was NATted to ns2"
++
++ ip netns exec ns0 nft flush chain ip nat output
++
++ reset_counters
++ ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
++ if [ $? -ne 0 ]; then
++ lret=1
++ echo "ERROR: ping failed"
++ return $lret
++ fi
++
++ expect="packets 1 bytes 84"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns1$dir "$expect"
++ lret=1
++ fi
++ done
++ expect="packets 0 bytes 0"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 ns2$dir "$expect"
++ lret=1
++ fi
++ done
++
++ # expect 1 count in ns1
++ expect="packets 1 bytes 84"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns0 ns0$dir "$expect"
++ lret=1
++ fi
++ done
++
++ # expect 0 packet in ns2
++ expect="packets 0 bytes 0"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns2 ns2$dir "$expect"
++ lret=1
++ fi
++ done
++
++ test $lret -eq 0 && echo "PASS: ping to ns1 OK after nat output chain flush"
++
++ return $lret
++}
++
++
++test_masquerade6()
++{
++ local lret=0
++
++ ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
++
++ ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
++ if [ $? -ne 0 ] ; then
++ echo "ERROR: cannot ping ns1 from ns2 via ipv6"
++ return 1
++ lret=1
++ fi
++
++ expect="packets 1 bytes 104"
++ for dir in "in6" "out6" ; do
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns2$dir "$expect"
++ lret=1
++ fi
++
++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns2 ns1$dir "$expect"
++ lret=1
++ fi
++ done
++
++ reset_counters
++
++# add masquerading rule
++ip netns exec ns0 nft -f - <<EOF
++table ip6 nat {
++ chain postrouting {
++ type nat hook postrouting priority 0; policy accept;
++ meta oif veth0 masquerade
++ }
++}
++EOF
++ ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
++ if [ $? -ne 0 ] ; then
++ echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerading"
++ lret=1
++ fi
++
++ # ns1 should have seen packets from ns0, due to masquerade
++ expect="packets 1 bytes 104"
++ for dir in "in6" "out6" ; do
++
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns0$dir "$expect"
++ lret=1
++ fi
++
++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns2 ns1$dir "$expect"
++ lret=1
++ fi
++ done
++
++ # ns1 should not have seen packets from ns2, due to masquerade
++ expect="packets 0 bytes 0"
++ for dir in "in6" "out6" ; do
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns0$dir "$expect"
++ lret=1
++ fi
++
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns2 ns1$dir "$expect"
++ lret=1
++ fi
++ done
++
++ ip netns exec ns0 nft flush chain ip6 nat postrouting
++ if [ $? -ne 0 ]; then
++ echo "ERROR: Could not flush ip6 nat postrouting" 1>&2
++ lret=1
++ fi
++
++ test $lret -eq 0 && echo "PASS: IPv6 masquerade for ns2"
++
++ return $lret
++}
++
++test_masquerade()
++{
++ local lret=0
++
++ ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
++ ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
++
++ ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
++ if [ $? -ne 0 ] ; then
++ echo "ERROR: canot ping ns1 from ns2"
++ lret=1
++ fi
++
++ expect="packets 1 bytes 84"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns2$dir "$expect"
++ lret=1
++ fi
++
++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns2 ns1$dir "$expect"
++ lret=1
++ fi
++ done
++
++ reset_counters
++
++# add masquerading rule
++ip netns exec ns0 nft -f - <<EOF
++table ip nat {
++ chain postrouting {
++ type nat hook postrouting priority 0; policy accept;
++ meta oif veth0 masquerade
++ }
++}
++EOF
++ ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
++ if [ $? -ne 0 ] ; then
++ echo "ERROR: cannot ping ns1 from ns2 with active ip masquerading"
++ lret=1
++ fi
++
++ # ns1 should have seen packets from ns0, due to masquerade
++ expect="packets 1 bytes 84"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns0$dir "$expect"
++ lret=1
++ fi
++
++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns2 ns1$dir "$expect"
++ lret=1
++ fi
++ done
++
++ # ns1 should not have seen packets from ns2, due to masquerade
++ expect="packets 0 bytes 0"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns0$dir "$expect"
++ lret=1
++ fi
++
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns2 ns1$dir "$expect"
++ lret=1
++ fi
++ done
++
++ ip netns exec ns0 nft flush chain ip nat postrouting
++ if [ $? -ne 0 ]; then
++ echo "ERROR: Could not flush nat postrouting" 1>&2
++ lret=1
++ fi
++
++ test $lret -eq 0 && echo "PASS: IP masquerade for ns2"
++
++ return $lret
++}
++
++test_redirect6()
++{
++ local lret=0
++
++ ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
++
++ ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
++ if [ $? -ne 0 ] ; then
++ echo "ERROR: cannnot ping ns1 from ns2 via ipv6"
++ lret=1
++ fi
++
++ expect="packets 1 bytes 104"
++ for dir in "in6" "out6" ; do
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns2$dir "$expect"
++ lret=1
++ fi
++
++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns2 ns1$dir "$expect"
++ lret=1
++ fi
++ done
++
++ reset_counters
++
++# add redirect rule
++ip netns exec ns0 nft -f - <<EOF
++table ip6 nat {
++ chain prerouting {
++ type nat hook prerouting priority 0; policy accept;
++ meta iif veth1 meta l4proto icmpv6 ip6 saddr dead:2::99 ip6 daddr dead:1::99 redirect
++ }
++}
++EOF
++ ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
++ if [ $? -ne 0 ] ; then
++ echo "ERROR: cannot ping ns1 from ns2 with active ip6 redirect"
++ lret=1
++ fi
++
++ # ns1 should have seen no packets from ns2, due to redirection
++ expect="packets 0 bytes 0"
++ for dir in "in6" "out6" ; do
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns0$dir "$expect"
++ lret=1
++ fi
++ done
++
++ # ns0 should have seen packets from ns2, due to masquerade
++ expect="packets 1 bytes 104"
++ for dir in "in6" "out6" ; do
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns0$dir "$expect"
++ lret=1
++ fi
++ done
++
++ ip netns exec ns0 nft delete table ip6 nat
++ if [ $? -ne 0 ]; then
++ echo "ERROR: Could not delete ip6 nat table" 1>&2
++ lret=1
++ fi
++
++ test $lret -eq 0 && echo "PASS: IPv6 redirection for ns2"
++
++ return $lret
++}
++
++test_redirect()
++{
++ local lret=0
++
++ ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
++ ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
++
++ ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
++ if [ $? -ne 0 ] ; then
++ echo "ERROR: cannot ping ns1 from ns2"
++ lret=1
++ fi
++
++ expect="packets 1 bytes 84"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns2$dir "$expect"
++ lret=1
++ fi
++
++ cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns2 ns1$dir "$expect"
++ lret=1
++ fi
++ done
++
++ reset_counters
++
++# add redirect rule
++ip netns exec ns0 nft -f - <<EOF
++table ip nat {
++ chain prerouting {
++ type nat hook prerouting priority 0; policy accept;
++ meta iif veth1 ip protocol icmp ip saddr 10.0.2.99 ip daddr 10.0.1.99 redirect
++ }
++}
++EOF
++ ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
++ if [ $? -ne 0 ] ; then
++ echo "ERROR: cannot ping ns1 from ns2 with active ip redirect"
++ lret=1
++ fi
++
++ # ns1 should have seen no packets from ns2, due to redirection
++ expect="packets 0 bytes 0"
++ for dir in "in" "out" ; do
++
++ cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns0$dir "$expect"
++ lret=1
++ fi
++ done
++
++ # ns0 should have seen packets from ns2, due to masquerade
++ expect="packets 1 bytes 84"
++ for dir in "in" "out" ; do
++ cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ bad_counter ns1 ns0$dir "$expect"
++ lret=1
++ fi
++ done
++
++ ip netns exec ns0 nft delete table ip nat
++ if [ $? -ne 0 ]; then
++ echo "ERROR: Could not delete nat table" 1>&2
++ lret=1
++ fi
++
++ test $lret -eq 0 && echo "PASS: IP redirection for ns2"
++
++ return $lret
++}
++
++
++# ip netns exec ns0 ping -c 1 -q 10.0.$i.99
++for i in 0 1 2; do
++ip netns exec ns$i nft -f - <<EOF
++table inet filter {
++ counter ns0in {}
++ counter ns1in {}
++ counter ns2in {}
++
++ counter ns0out {}
++ counter ns1out {}
++ counter ns2out {}
++
++ counter ns0in6 {}
++ counter ns1in6 {}
++ counter ns2in6 {}
++
++ counter ns0out6 {}
++ counter ns1out6 {}
++ counter ns2out6 {}
++
++ map nsincounter {
++ type ipv4_addr : counter
++ elements = { 10.0.1.1 : "ns0in",
++ 10.0.2.1 : "ns0in",
++ 10.0.1.99 : "ns1in",
++ 10.0.2.99 : "ns2in" }
++ }
++
++ map nsincounter6 {
++ type ipv6_addr : counter
++ elements = { dead:1::1 : "ns0in6",
++ dead:2::1 : "ns0in6",
++ dead:1::99 : "ns1in6",
++ dead:2::99 : "ns2in6" }
++ }
++
++ map nsoutcounter {
++ type ipv4_addr : counter
++ elements = { 10.0.1.1 : "ns0out",
++ 10.0.2.1 : "ns0out",
++ 10.0.1.99: "ns1out",
++ 10.0.2.99: "ns2out" }
++ }
++
++ map nsoutcounter6 {
++ type ipv6_addr : counter
++ elements = { dead:1::1 : "ns0out6",
++ dead:2::1 : "ns0out6",
++ dead:1::99 : "ns1out6",
++ dead:2::99 : "ns2out6" }
++ }
++
++ chain input {
++ type filter hook input priority 0; policy accept;
++ counter name ip saddr map @nsincounter
++ icmpv6 type { "echo-request", "echo-reply" } counter name ip6 saddr map @nsincounter6
++ }
++ chain output {
++ type filter hook output priority 0; policy accept;
++ counter name ip daddr map @nsoutcounter
++ icmpv6 type { "echo-request", "echo-reply" } counter name ip6 daddr map @nsoutcounter6
++ }
++}
++EOF
++done
++
++sleep 3
++# test basic connectivity
++for i in 1 2; do
++ ip netns exec ns0 ping -c 1 -q 10.0.$i.99 > /dev/null
++ if [ $? -ne 0 ];then
++ echo "ERROR: Could not reach other namespace(s)" 1>&2
++ ret=1
++ fi
++
++ ip netns exec ns0 ping -c 1 -q dead:$i::99 > /dev/null
++ if [ $? -ne 0 ];then
++ echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2
++ ret=1
++ fi
++ check_counters ns$i
++ if [ $? -ne 0 ]; then
++ ret=1
++ fi
++
++ check_ns0_counters ns$i
++ if [ $? -ne 0 ]; then
++ ret=1
++ fi
++ reset_counters
++done
++
++if [ $ret -eq 0 ];then
++ echo "PASS: netns routing/connectivity: ns0 can reach ns1 and ns2"
++fi
++
++reset_counters
++test_local_dnat
++test_local_dnat6
++
++reset_counters
++test_masquerade
++test_masquerade6
++
++reset_counters
++test_redirect
++test_redirect6
++
++for i in 0 1 2; do ip netns del ns$i;done
++
++exit $ret
+diff --git a/tools/testing/selftests/proc/.gitignore b/tools/testing/selftests/proc/.gitignore
+index 82121a81681f..29bac5ef9a93 100644
+--- a/tools/testing/selftests/proc/.gitignore
++++ b/tools/testing/selftests/proc/.gitignore
+@@ -10,4 +10,5 @@
+ /proc-uptime-002
+ /read
+ /self
++/setns-dcache
+ /thread-self
+diff --git a/tools/testing/selftests/proc/Makefile b/tools/testing/selftests/proc/Makefile
+index 1c12c34cf85d..434d033ee067 100644
+--- a/tools/testing/selftests/proc/Makefile
++++ b/tools/testing/selftests/proc/Makefile
+@@ -14,6 +14,7 @@ TEST_GEN_PROGS += proc-uptime-001
+ TEST_GEN_PROGS += proc-uptime-002
+ TEST_GEN_PROGS += read
+ TEST_GEN_PROGS += self
++TEST_GEN_PROGS += setns-dcache
+ TEST_GEN_PROGS += thread-self
+
+ include ../lib.mk
+diff --git a/tools/testing/selftests/proc/setns-dcache.c b/tools/testing/selftests/proc/setns-dcache.c
+new file mode 100644
+index 000000000000..60ab197a73fc
+--- /dev/null
++++ b/tools/testing/selftests/proc/setns-dcache.c
+@@ -0,0 +1,129 @@
++/*
++ * Copyright © 2019 Alexey Dobriyan <adobriyan@gmail.com>
++ *
++ * Permission to use, copy, modify, and distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
++ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
++ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
++ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++/*
++ * Test that setns(CLONE_NEWNET) points to new /proc/net content even
++ * if old one is in dcache.
++ *
++ * FIXME /proc/net/unix is under CONFIG_UNIX which can be disabled.
++ */
++#undef NDEBUG
++#include <assert.h>
++#include <errno.h>
++#include <sched.h>
++#include <signal.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <unistd.h>
++#include <sys/types.h>
++#include <sys/stat.h>
++#include <fcntl.h>
++#include <sys/socket.h>
++
++static pid_t pid = -1;
++
++static void f(void)
++{
++ if (pid > 0) {
++ kill(pid, SIGTERM);
++ }
++}
++
++int main(void)
++{
++ int fd[2];
++ char _ = 0;
++ int nsfd;
++
++ atexit(f);
++
++ /* Check for priviledges and syscall availability straight away. */
++ if (unshare(CLONE_NEWNET) == -1) {
++ if (errno == ENOSYS || errno == EPERM) {
++ return 4;
++ }
++ return 1;
++ }
++ /* Distinguisher between two otherwise empty net namespaces. */
++ if (socket(AF_UNIX, SOCK_STREAM, 0) == -1) {
++ return 1;
++ }
++
++ if (pipe(fd) == -1) {
++ return 1;
++ }
++
++ pid = fork();
++ if (pid == -1) {
++ return 1;
++ }
++
++ if (pid == 0) {
++ if (unshare(CLONE_NEWNET) == -1) {
++ return 1;
++ }
++
++ if (write(fd[1], &_, 1) != 1) {
++ return 1;
++ }
++
++ pause();
++
++ return 0;
++ }
++
++ if (read(fd[0], &_, 1) != 1) {
++ return 1;
++ }
++
++ {
++ char buf[64];
++ snprintf(buf, sizeof(buf), "/proc/%u/ns/net", pid);
++ nsfd = open(buf, O_RDONLY);
++ if (nsfd == -1) {
++ return 1;
++ }
++ }
++
++ /* Reliably pin dentry into dcache. */
++ (void)open("/proc/net/unix", O_RDONLY);
++
++ if (setns(nsfd, CLONE_NEWNET) == -1) {
++ return 1;
++ }
++
++ kill(pid, SIGTERM);
++ pid = 0;
++
++ {
++ char buf[4096];
++ ssize_t rv;
++ int fd;
++
++ fd = open("/proc/net/unix", O_RDONLY);
++ if (fd == -1) {
++ return 1;
++ }
++
++#define S "Num RefCount Protocol Flags Type St Inode Path\n"
++ rv = read(fd, buf, sizeof(buf));
++
++ assert(rv == strlen(S));
++ assert(memcmp(buf, S, strlen(S)) == 0);
++ }
++
++ return 0;
++}
+diff --git a/tools/testing/selftests/timers/Makefile b/tools/testing/selftests/timers/Makefile
+index c02683cfb6c9..7656c7ce79d9 100644
+--- a/tools/testing/selftests/timers/Makefile
++++ b/tools/testing/selftests/timers/Makefile
+@@ -1,6 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ CFLAGS += -O3 -Wl,-no-as-needed -Wall
+-LDFLAGS += -lrt -lpthread -lm
++LDLIBS += -lrt -lpthread -lm
+
+ # these are all "safe" tests that don't modify
+ # system time or require escalated privileges
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-03-19 16:58 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-03-19 16:58 UTC (permalink / raw
To: gentoo-commits
commit: 042822ed283b2231381d7ed451c6f84dd5e258f9
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 19 16:57:50 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Mar 19 16:57:50 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=042822ed
proj/linux-patches: Linux patch 4.19.30
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1029_linux-4.19.30.patch | 1866 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1870 insertions(+)
diff --git a/0000_README b/0000_README
index 9c98a66..53e44f7 100644
--- a/0000_README
+++ b/0000_README
@@ -159,6 +159,10 @@ Patch: 1028_linux-4.19.29.patch
From: http://www.kernel.org
Desc: Linux 4.19.29
+Patch: 1029_linux-4.19.30.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.30
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1029_linux-4.19.30.patch b/1029_linux-4.19.30.patch
new file mode 100644
index 0000000..f6460e7
--- /dev/null
+++ b/1029_linux-4.19.30.patch
@@ -0,0 +1,1866 @@
+diff --git a/Makefile b/Makefile
+index 6e526583291c..72e27c379eaf 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 29
++SUBLEVEL = 30
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 220b40b75e6f..12453cf7c11b 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3282,7 +3282,7 @@ tfa_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
+ /*
+ * Without TFA we must not use PMC3.
+ */
+- if (!allow_tsx_force_abort && test_bit(3, c->idxmsk)) {
++ if (!allow_tsx_force_abort && test_bit(3, c->idxmsk) && idx >= 0) {
+ c = dyn_constraint(cpuc, c, idx);
+ c->idxmsk64 &= ~(1ULL << 3);
+ c->weight--;
+@@ -3989,7 +3989,7 @@ static struct attribute *intel_pmu_caps_attrs[] = {
+ NULL
+ };
+
+-DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort);
++static DEVICE_BOOL_ATTR(allow_tsx_force_abort, 0644, allow_tsx_force_abort);
+
+ static struct attribute *intel_pmu_attrs[] = {
+ &dev_attr_freeze_on_smi.attr,
+diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
+index 5c424009b71f..42a36280d168 100644
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -1030,12 +1030,12 @@ static inline int intel_pmu_init(void)
+ return 0;
+ }
+
+-static inline int intel_cpuc_prepare(struct cpu_hw_event *cpuc, int cpu)
++static inline int intel_cpuc_prepare(struct cpu_hw_events *cpuc, int cpu)
+ {
+ return 0;
+ }
+
+-static inline void intel_cpuc_finish(struct cpu_hw_event *cpuc)
++static inline void intel_cpuc_finish(struct cpu_hw_events *cpuc)
+ {
+ }
+
+diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
+index ed5e42461094..ad48fd52cb53 100644
+--- a/drivers/connector/cn_proc.c
++++ b/drivers/connector/cn_proc.c
+@@ -250,6 +250,7 @@ void proc_coredump_connector(struct task_struct *task)
+ {
+ struct cn_msg *msg;
+ struct proc_event *ev;
++ struct task_struct *parent;
+ __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
+
+ if (atomic_read(&proc_event_num_listeners) < 1)
+@@ -262,8 +263,14 @@ void proc_coredump_connector(struct task_struct *task)
+ ev->what = PROC_EVENT_COREDUMP;
+ ev->event_data.coredump.process_pid = task->pid;
+ ev->event_data.coredump.process_tgid = task->tgid;
+- ev->event_data.coredump.parent_pid = task->real_parent->pid;
+- ev->event_data.coredump.parent_tgid = task->real_parent->tgid;
++
++ rcu_read_lock();
++ if (pid_alive(task)) {
++ parent = rcu_dereference(task->real_parent);
++ ev->event_data.coredump.parent_pid = parent->pid;
++ ev->event_data.coredump.parent_tgid = parent->tgid;
++ }
++ rcu_read_unlock();
+
+ memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
+ msg->ack = 0; /* not used */
+@@ -276,6 +283,7 @@ void proc_exit_connector(struct task_struct *task)
+ {
+ struct cn_msg *msg;
+ struct proc_event *ev;
++ struct task_struct *parent;
+ __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
+
+ if (atomic_read(&proc_event_num_listeners) < 1)
+@@ -290,8 +298,14 @@ void proc_exit_connector(struct task_struct *task)
+ ev->event_data.exit.process_tgid = task->tgid;
+ ev->event_data.exit.exit_code = task->exit_code;
+ ev->event_data.exit.exit_signal = task->exit_signal;
+- ev->event_data.exit.parent_pid = task->real_parent->pid;
+- ev->event_data.exit.parent_tgid = task->real_parent->tgid;
++
++ rcu_read_lock();
++ if (pid_alive(task)) {
++ parent = rcu_dereference(task->real_parent);
++ ev->event_data.exit.parent_pid = parent->pid;
++ ev->event_data.exit.parent_tgid = parent->tgid;
++ }
++ rcu_read_unlock();
+
+ memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
+ msg->ack = 0; /* not used */
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index 1d74aed7e471..94f5c3646cb7 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -1573,6 +1573,15 @@ int drm_atomic_helper_async_check(struct drm_device *dev,
+ if (old_plane_state->fb != new_plane_state->fb)
+ return -EINVAL;
+
++ /*
++ * FIXME: Since prepare_fb and cleanup_fb are always called on
++ * the new_plane_state for async updates we need to block framebuffer
++ * changes. This prevents use of a fb that's been cleaned up and
++ * double cleanups from occuring.
++ */
++ if (old_plane_state->fb != new_plane_state->fb)
++ return -EINVAL;
++
+ funcs = plane->helper_private;
+ if (!funcs->atomic_async_update)
+ return -EINVAL;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 7033a2880771..9df1334608b7 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -4630,7 +4630,6 @@ read_more:
+ atomic_inc(&r10_bio->remaining);
+ read_bio->bi_next = NULL;
+ generic_make_request(read_bio);
+- sector_nr += nr_sectors;
+ sectors_done += nr_sectors;
+ if (sector_nr <= last)
+ goto read_more;
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index a6fcc5c96070..b2c42cae3081 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1171,29 +1171,22 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb)
+ }
+ }
+
+- /* Link-local multicast packets should be passed to the
+- * stack on the link they arrive as well as pass them to the
+- * bond-master device. These packets are mostly usable when
+- * stack receives it with the link on which they arrive
+- * (e.g. LLDP) they also must be available on master. Some of
+- * the use cases include (but are not limited to): LLDP agents
+- * that must be able to operate both on enslaved interfaces as
+- * well as on bonds themselves; linux bridges that must be able
+- * to process/pass BPDUs from attached bonds when any kind of
+- * STP version is enabled on the network.
++ /*
++ * For packets determined by bond_should_deliver_exact_match() call to
++ * be suppressed we want to make an exception for link-local packets.
++ * This is necessary for e.g. LLDP daemons to be able to monitor
++ * inactive slave links without being forced to bind to them
++ * explicitly.
++ *
++ * At the same time, packets that are passed to the bonding master
++ * (including link-local ones) can have their originating interface
++ * determined via PACKET_ORIGDEV socket option.
+ */
+- if (is_link_local_ether_addr(eth_hdr(skb)->h_dest)) {
+- struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+-
+- if (nskb) {
+- nskb->dev = bond->dev;
+- nskb->queue_mapping = 0;
+- netif_rx(nskb);
+- }
+- return RX_HANDLER_PASS;
+- }
+- if (bond_should_deliver_exact_match(skb, slave, bond))
++ if (bond_should_deliver_exact_match(skb, slave, bond)) {
++ if (is_link_local_ether_addr(eth_hdr(skb)->h_dest))
++ return RX_HANDLER_PASS;
+ return RX_HANDLER_EXACT;
++ }
+
+ skb->dev = bond->dev;
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 41fa22c562c1..f81ad0aa8b09 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -424,9 +424,9 @@ static void i40e_get_netdev_stats_struct(struct net_device *netdev,
+ struct rtnl_link_stats64 *stats)
+ {
+ struct i40e_netdev_priv *np = netdev_priv(netdev);
+- struct i40e_ring *tx_ring, *rx_ring;
+ struct i40e_vsi *vsi = np->vsi;
+ struct rtnl_link_stats64 *vsi_stats = i40e_get_vsi_stats_struct(vsi);
++ struct i40e_ring *ring;
+ int i;
+
+ if (test_bit(__I40E_VSI_DOWN, vsi->state))
+@@ -440,24 +440,26 @@ static void i40e_get_netdev_stats_struct(struct net_device *netdev,
+ u64 bytes, packets;
+ unsigned int start;
+
+- tx_ring = READ_ONCE(vsi->tx_rings[i]);
+- if (!tx_ring)
++ ring = READ_ONCE(vsi->tx_rings[i]);
++ if (!ring)
+ continue;
+- i40e_get_netdev_stats_struct_tx(tx_ring, stats);
++ i40e_get_netdev_stats_struct_tx(ring, stats);
+
+- rx_ring = &tx_ring[1];
++ if (i40e_enabled_xdp_vsi(vsi)) {
++ ring++;
++ i40e_get_netdev_stats_struct_tx(ring, stats);
++ }
+
++ ring++;
+ do {
+- start = u64_stats_fetch_begin_irq(&rx_ring->syncp);
+- packets = rx_ring->stats.packets;
+- bytes = rx_ring->stats.bytes;
+- } while (u64_stats_fetch_retry_irq(&rx_ring->syncp, start));
++ start = u64_stats_fetch_begin_irq(&ring->syncp);
++ packets = ring->stats.packets;
++ bytes = ring->stats.bytes;
++ } while (u64_stats_fetch_retry_irq(&ring->syncp, start));
+
+ stats->rx_packets += packets;
+ stats->rx_bytes += bytes;
+
+- if (i40e_enabled_xdp_vsi(vsi))
+- i40e_get_netdev_stats_struct_tx(&rx_ring[1], stats);
+ }
+ rcu_read_unlock();
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+index e65bc3c95630..857588e2488d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -2645,6 +2645,8 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
+ if (!priv->cmd.context)
+ return -ENOMEM;
+
++ if (mlx4_is_mfunc(dev))
++ mutex_lock(&priv->cmd.slave_cmd_mutex);
+ down_write(&priv->cmd.switch_sem);
+ for (i = 0; i < priv->cmd.max_cmds; ++i) {
+ priv->cmd.context[i].token = i;
+@@ -2670,6 +2672,8 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
+ down(&priv->cmd.poll_sem);
+ priv->cmd.use_events = 1;
+ up_write(&priv->cmd.switch_sem);
++ if (mlx4_is_mfunc(dev))
++ mutex_unlock(&priv->cmd.slave_cmd_mutex);
+
+ return err;
+ }
+@@ -2682,6 +2686,8 @@ void mlx4_cmd_use_polling(struct mlx4_dev *dev)
+ struct mlx4_priv *priv = mlx4_priv(dev);
+ int i;
+
++ if (mlx4_is_mfunc(dev))
++ mutex_lock(&priv->cmd.slave_cmd_mutex);
+ down_write(&priv->cmd.switch_sem);
+ priv->cmd.use_events = 0;
+
+@@ -2689,9 +2695,12 @@ void mlx4_cmd_use_polling(struct mlx4_dev *dev)
+ down(&priv->cmd.event_sem);
+
+ kfree(priv->cmd.context);
++ priv->cmd.context = NULL;
+
+ up(&priv->cmd.poll_sem);
+ up_write(&priv->cmd.switch_sem);
++ if (mlx4_is_mfunc(dev))
++ mutex_unlock(&priv->cmd.slave_cmd_mutex);
+ }
+
+ struct mlx4_cmd_mailbox *mlx4_alloc_cmd_mailbox(struct mlx4_dev *dev)
+diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+index 31bd56727022..676428a57662 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -2719,13 +2719,13 @@ static int qp_get_mtt_size(struct mlx4_qp_context *qpc)
+ int total_pages;
+ int total_mem;
+ int page_offset = (be32_to_cpu(qpc->params2) >> 6) & 0x3f;
++ int tot;
+
+ sq_size = 1 << (log_sq_size + log_sq_sride + 4);
+ rq_size = (srq|rss|xrc) ? 0 : (1 << (log_rq_size + log_rq_stride + 4));
+ total_mem = sq_size + rq_size;
+- total_pages =
+- roundup_pow_of_two((total_mem + (page_offset << 6)) >>
+- page_shift);
++ tot = (total_mem + (page_offset << 6)) >> page_shift;
++ total_pages = !tot ? 1 : roundup_pow_of_two(tot);
+
+ return total_pages;
+ }
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index de5a6abda7e3..208341541087 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -585,8 +585,7 @@ static int lan743x_intr_open(struct lan743x_adapter *adapter)
+
+ if (adapter->csr.flags &
+ LAN743X_CSR_FLAG_SUPPORTS_INTR_AUTO_SET_CLR) {
+- flags = LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_CLEAR |
+- LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_SET |
++ flags = LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_SET |
+ LAN743X_VECTOR_FLAG_SOURCE_ENABLE_AUTO_SET |
+ LAN743X_VECTOR_FLAG_SOURCE_ENABLE_AUTO_CLEAR |
+ LAN743X_VECTOR_FLAG_SOURCE_STATUS_AUTO_CLEAR;
+@@ -599,12 +598,6 @@ static int lan743x_intr_open(struct lan743x_adapter *adapter)
+ /* map TX interrupt to vector */
+ int_vec_map1 |= INT_VEC_MAP1_TX_VEC_(index, vector);
+ lan743x_csr_write(adapter, INT_VEC_MAP1, int_vec_map1);
+- if (flags &
+- LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_CLEAR) {
+- int_vec_en_auto_clr |= INT_VEC_EN_(vector);
+- lan743x_csr_write(adapter, INT_VEC_EN_AUTO_CLR,
+- int_vec_en_auto_clr);
+- }
+
+ /* Remove TX interrupt from shared mask */
+ intr->vector_list[0].int_mask &= ~int_bit;
+@@ -1905,7 +1898,17 @@ static int lan743x_rx_next_index(struct lan743x_rx *rx, int index)
+ return ((++index) % rx->ring_size);
+ }
+
+-static int lan743x_rx_allocate_ring_element(struct lan743x_rx *rx, int index)
++static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx)
++{
++ int length = 0;
++
++ length = (LAN743X_MAX_FRAME_SIZE + ETH_HLEN + 4 + RX_HEAD_PADDING);
++ return __netdev_alloc_skb(rx->adapter->netdev,
++ length, GFP_ATOMIC | GFP_DMA);
++}
++
++static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index,
++ struct sk_buff *skb)
+ {
+ struct lan743x_rx_buffer_info *buffer_info;
+ struct lan743x_rx_descriptor *descriptor;
+@@ -1914,9 +1917,7 @@ static int lan743x_rx_allocate_ring_element(struct lan743x_rx *rx, int index)
+ length = (LAN743X_MAX_FRAME_SIZE + ETH_HLEN + 4 + RX_HEAD_PADDING);
+ descriptor = &rx->ring_cpu_ptr[index];
+ buffer_info = &rx->buffer_info[index];
+- buffer_info->skb = __netdev_alloc_skb(rx->adapter->netdev,
+- length,
+- GFP_ATOMIC | GFP_DMA);
++ buffer_info->skb = skb;
+ if (!(buffer_info->skb))
+ return -ENOMEM;
+ buffer_info->dma_ptr = dma_map_single(&rx->adapter->pdev->dev,
+@@ -2063,8 +2064,19 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx)
+ /* packet is available */
+ if (first_index == last_index) {
+ /* single buffer packet */
++ struct sk_buff *new_skb = NULL;
+ int packet_length;
+
++ new_skb = lan743x_rx_allocate_skb(rx);
++ if (!new_skb) {
++ /* failed to allocate next skb.
++ * Memory is very low.
++ * Drop this packet and reuse buffer.
++ */
++ lan743x_rx_reuse_ring_element(rx, first_index);
++ goto process_extension;
++ }
++
+ buffer_info = &rx->buffer_info[first_index];
+ skb = buffer_info->skb;
+ descriptor = &rx->ring_cpu_ptr[first_index];
+@@ -2084,7 +2096,7 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx)
+ skb_put(skb, packet_length - 4);
+ skb->protocol = eth_type_trans(skb,
+ rx->adapter->netdev);
+- lan743x_rx_allocate_ring_element(rx, first_index);
++ lan743x_rx_init_ring_element(rx, first_index, new_skb);
+ } else {
+ int index = first_index;
+
+@@ -2097,26 +2109,23 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx)
+ if (first_index <= last_index) {
+ while ((index >= first_index) &&
+ (index <= last_index)) {
+- lan743x_rx_release_ring_element(rx,
+- index);
+- lan743x_rx_allocate_ring_element(rx,
+- index);
++ lan743x_rx_reuse_ring_element(rx,
++ index);
+ index = lan743x_rx_next_index(rx,
+ index);
+ }
+ } else {
+ while ((index >= first_index) ||
+ (index <= last_index)) {
+- lan743x_rx_release_ring_element(rx,
+- index);
+- lan743x_rx_allocate_ring_element(rx,
+- index);
++ lan743x_rx_reuse_ring_element(rx,
++ index);
+ index = lan743x_rx_next_index(rx,
+ index);
+ }
+ }
+ }
+
++process_extension:
+ if (extension_index >= 0) {
+ descriptor = &rx->ring_cpu_ptr[extension_index];
+ buffer_info = &rx->buffer_info[extension_index];
+@@ -2293,7 +2302,9 @@ static int lan743x_rx_ring_init(struct lan743x_rx *rx)
+
+ rx->last_head = 0;
+ for (index = 0; index < rx->ring_size; index++) {
+- ret = lan743x_rx_allocate_ring_element(rx, index);
++ struct sk_buff *new_skb = lan743x_rx_allocate_skb(rx);
++
++ ret = lan743x_rx_init_ring_element(rx, index, new_skb);
+ if (ret)
+ goto cleanup;
+ }
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 8441c86d9f3b..5f092bbd0514 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -459,7 +459,7 @@ static int ravb_dmac_init(struct net_device *ndev)
+ RCR_EFFS | RCR_ENCF | RCR_ETS0 | RCR_ESF | 0x18000000, RCR);
+
+ /* Set FIFO size */
+- ravb_write(ndev, TGC_TQP_AVBMODE1 | 0x00222200, TGC);
++ ravb_write(ndev, TGC_TQP_AVBMODE1 | 0x00112200, TGC);
+
+ /* Timestamp enable */
+ ravb_write(ndev, TCCR_TFEN, TCCR);
+diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
+index 5fb541897863..68b8007da82b 100644
+--- a/drivers/net/ipvlan/ipvlan_main.c
++++ b/drivers/net/ipvlan/ipvlan_main.c
+@@ -494,6 +494,8 @@ static int ipvlan_nl_changelink(struct net_device *dev,
+
+ if (!data)
+ return 0;
++ if (!ns_capable(dev_net(ipvlan->phy_dev)->user_ns, CAP_NET_ADMIN))
++ return -EPERM;
+
+ if (data[IFLA_IPVLAN_MODE]) {
+ u16 nmode = nla_get_u16(data[IFLA_IPVLAN_MODE]);
+@@ -596,6 +598,8 @@ int ipvlan_link_new(struct net *src_net, struct net_device *dev,
+ struct ipvl_dev *tmp = netdev_priv(phy_dev);
+
+ phy_dev = tmp->phy_dev;
++ if (!ns_capable(dev_net(phy_dev)->user_ns, CAP_NET_ADMIN))
++ return -EPERM;
+ } else if (!netif_is_ipvlan_port(phy_dev)) {
+ /* Exit early if the underlying link is invalid or busy */
+ if (phy_dev->type != ARPHRD_ETHER ||
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index 15c5586d74ff..c5588d4508f9 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -380,7 +380,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
+ err = device_register(&bus->dev);
+ if (err) {
+ pr_err("mii_bus %s failed to register\n", bus->id);
+- put_device(&bus->dev);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index 67ffe74747a1..7321a4eca235 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -537,6 +537,7 @@ static void pptp_sock_destruct(struct sock *sk)
+ pppox_unbind_sock(sk);
+ }
+ skb_queue_purge(&sk->sk_receive_queue);
++ dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1));
+ }
+
+ static int pptp_create(struct net *net, struct socket *sock, int kern)
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 723814d84b7d..95ee9d815d76 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -1259,7 +1259,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
+ list_add_tail_rcu(&port->list, &team->port_list);
+ team_port_enable(team, port);
+ __team_compute_features(team);
+- __team_port_change_port_added(port, !!netif_carrier_ok(port_dev));
++ __team_port_change_port_added(port, !!netif_oper_up(port_dev));
+ __team_options_change_check(team);
+
+ netdev_info(dev, "Port device %s added\n", portname);
+@@ -2918,7 +2918,7 @@ static int team_device_event(struct notifier_block *unused,
+
+ switch (event) {
+ case NETDEV_UP:
+- if (netif_carrier_ok(dev))
++ if (netif_oper_up(dev))
+ team_port_change_check(port, true);
+ break;
+ case NETDEV_DOWN:
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 9fc9aed6ca9a..52387f7f12ed 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -1469,6 +1469,14 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
+ goto drop;
+ }
+
++ rcu_read_lock();
++
++ if (unlikely(!(vxlan->dev->flags & IFF_UP))) {
++ rcu_read_unlock();
++ atomic_long_inc(&vxlan->dev->rx_dropped);
++ goto drop;
++ }
++
+ stats = this_cpu_ptr(vxlan->dev->tstats);
+ u64_stats_update_begin(&stats->syncp);
+ stats->rx_packets++;
+@@ -1476,6 +1484,9 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
+ u64_stats_update_end(&stats->syncp);
+
+ gro_cells_receive(&vxlan->gro_cells, skb);
++
++ rcu_read_unlock();
++
+ return 0;
+
+ drop:
+@@ -2460,6 +2471,8 @@ static void vxlan_uninit(struct net_device *dev)
+ {
+ struct vxlan_dev *vxlan = netdev_priv(dev);
+
++ gro_cells_destroy(&vxlan->gro_cells);
++
+ vxlan_fdb_delete_default(vxlan, vxlan->cfg.vni);
+
+ free_percpu(dev->tstats);
+@@ -3526,7 +3539,6 @@ static void vxlan_dellink(struct net_device *dev, struct list_head *head)
+
+ vxlan_flush(vxlan, true);
+
+- gro_cells_destroy(&vxlan->gro_cells);
+ list_del(&vxlan->next);
+ unregister_netdevice_queue(dev, head);
+ }
+diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h
+index c70f0c5237ea..58d8cbc3f921 100644
+--- a/drivers/staging/erofs/internal.h
++++ b/drivers/staging/erofs/internal.h
+@@ -260,6 +260,7 @@ repeat:
+ }
+
+ #define __erofs_workgroup_get(grp) atomic_inc(&(grp)->refcount)
++#define __erofs_workgroup_put(grp) atomic_dec(&(grp)->refcount)
+
+ extern int erofs_workgroup_put(struct erofs_workgroup *grp);
+
+diff --git a/drivers/staging/erofs/utils.c b/drivers/staging/erofs/utils.c
+index dd2ac9dbc4b4..2d96820da62e 100644
+--- a/drivers/staging/erofs/utils.c
++++ b/drivers/staging/erofs/utils.c
+@@ -87,12 +87,21 @@ int erofs_register_workgroup(struct super_block *sb,
+ grp = (void *)((unsigned long)grp |
+ 1UL << RADIX_TREE_EXCEPTIONAL_SHIFT);
+
+- err = radix_tree_insert(&sbi->workstn_tree,
+- grp->index, grp);
++ /*
++ * Bump up reference count before making this workgroup
++ * visible to other users in order to avoid potential UAF
++ * without serialized by erofs_workstn_lock.
++ */
++ __erofs_workgroup_get(grp);
+
+- if (!err) {
+- __erofs_workgroup_get(grp);
+- }
++ err = radix_tree_insert(&sbi->workstn_tree,
++ grp->index, grp);
++ if (unlikely(err))
++ /*
++ * it's safe to decrease since the workgroup isn't visible
++ * and refcount >= 2 (cannot be freezed).
++ */
++ __erofs_workgroup_put(grp);
+
+ erofs_workstn_unlock(sbi);
+ radix_tree_preload_end();
+@@ -101,19 +110,99 @@ int erofs_register_workgroup(struct super_block *sb,
+
+ extern void erofs_workgroup_free_rcu(struct erofs_workgroup *grp);
+
++static void __erofs_workgroup_free(struct erofs_workgroup *grp)
++{
++ atomic_long_dec(&erofs_global_shrink_cnt);
++ erofs_workgroup_free_rcu(grp);
++}
++
+ int erofs_workgroup_put(struct erofs_workgroup *grp)
+ {
+ int count = atomic_dec_return(&grp->refcount);
+
+ if (count == 1)
+ atomic_long_inc(&erofs_global_shrink_cnt);
+- else if (!count) {
+- atomic_long_dec(&erofs_global_shrink_cnt);
+- erofs_workgroup_free_rcu(grp);
+- }
++ else if (!count)
++ __erofs_workgroup_free(grp);
+ return count;
+ }
+
++#ifdef EROFS_FS_HAS_MANAGED_CACHE
++/* for cache-managed case, customized reclaim paths exist */
++static void erofs_workgroup_unfreeze_final(struct erofs_workgroup *grp)
++{
++ erofs_workgroup_unfreeze(grp, 0);
++ __erofs_workgroup_free(grp);
++}
++
++bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi,
++ struct erofs_workgroup *grp,
++ bool cleanup)
++{
++ void *entry;
++
++ /*
++ * for managed cache enabled, the refcount of workgroups
++ * themselves could be < 0 (freezed). So there is no guarantee
++ * that all refcount > 0 if managed cache is enabled.
++ */
++ if (!erofs_workgroup_try_to_freeze(grp, 1))
++ return false;
++
++ /*
++ * note that all cached pages should be unlinked
++ * before delete it from the radix tree.
++ * Otherwise some cached pages of an orphan old workgroup
++ * could be still linked after the new one is available.
++ */
++ if (erofs_try_to_free_all_cached_pages(sbi, grp)) {
++ erofs_workgroup_unfreeze(grp, 1);
++ return false;
++ }
++
++ /*
++ * it is impossible to fail after the workgroup is freezed,
++ * however in order to avoid some race conditions, add a
++ * DBG_BUGON to observe this in advance.
++ */
++ entry = radix_tree_delete(&sbi->workstn_tree, grp->index);
++ DBG_BUGON((void *)((unsigned long)entry &
++ ~RADIX_TREE_EXCEPTIONAL_ENTRY) != grp);
++
++ /*
++ * if managed cache is enable, the last refcount
++ * should indicate the related workstation.
++ */
++ erofs_workgroup_unfreeze_final(grp);
++ return true;
++}
++
++#else
++/* for nocache case, no customized reclaim path at all */
++bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi,
++ struct erofs_workgroup *grp,
++ bool cleanup)
++{
++ int cnt = atomic_read(&grp->refcount);
++ void *entry;
++
++ DBG_BUGON(cnt <= 0);
++ DBG_BUGON(cleanup && cnt != 1);
++
++ if (cnt > 1)
++ return false;
++
++ entry = radix_tree_delete(&sbi->workstn_tree, grp->index);
++ DBG_BUGON((void *)((unsigned long)entry &
++ ~RADIX_TREE_EXCEPTIONAL_ENTRY) != grp);
++
++ /* (rarely) could be grabbed again when freeing */
++ erofs_workgroup_put(grp);
++ return true;
++}
++
++#endif
++
+ unsigned long erofs_shrink_workstation(struct erofs_sb_info *sbi,
+ unsigned long nr_shrink,
+ bool cleanup)
+@@ -130,44 +219,16 @@ repeat:
+ batch, first_index, PAGEVEC_SIZE);
+
+ for (i = 0; i < found; ++i) {
+- int cnt;
+ struct erofs_workgroup *grp = (void *)
+ ((unsigned long)batch[i] &
+ ~RADIX_TREE_EXCEPTIONAL_ENTRY);
+
+ first_index = grp->index + 1;
+
+- cnt = atomic_read(&grp->refcount);
+- BUG_ON(cnt <= 0);
+-
+- if (cleanup)
+- BUG_ON(cnt != 1);
+-
+-#ifndef EROFS_FS_HAS_MANAGED_CACHE
+- else if (cnt > 1)
+-#else
+- if (!erofs_workgroup_try_to_freeze(grp, 1))
+-#endif
++ /* try to shrink each valid workgroup */
++ if (!erofs_try_to_release_workgroup(sbi, grp, cleanup))
+ continue;
+
+- if (radix_tree_delete(&sbi->workstn_tree,
+- grp->index) != grp) {
+-#ifdef EROFS_FS_HAS_MANAGED_CACHE
+-skip:
+- erofs_workgroup_unfreeze(grp, 1);
+-#endif
+- continue;
+- }
+-
+-#ifdef EROFS_FS_HAS_MANAGED_CACHE
+- if (erofs_try_to_free_all_cached_pages(sbi, grp))
+- goto skip;
+-
+- erofs_workgroup_unfreeze(grp, 1);
+-#endif
+- /* (rarely) grabbed again when freeing */
+- erofs_workgroup_put(grp);
+-
+ ++freed;
+ if (unlikely(!--nr_shrink))
+ break;
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index fa93f6711d8d..e440f87ae1d6 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -642,7 +642,7 @@ static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid)
+ hash_del_rcu(&vsock->hash);
+
+ vsock->guest_cid = guest_cid;
+- hash_add_rcu(vhost_vsock_hash, &vsock->hash, guest_cid);
++ hash_add_rcu(vhost_vsock_hash, &vsock->hash, vsock->guest_cid);
+ spin_unlock_bh(&vhost_vsock_lock);
+
+ return 0;
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index fd36aa6569dc..81c1dd635a8d 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1736,10 +1736,12 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)
+
+ down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+
+- if (!get_dirty_pages(inode))
+- goto skip_flush;
+-
+- f2fs_msg(F2FS_I_SB(inode)->sb, KERN_WARNING,
++ /*
++ * Should wait end_io to count F2FS_WB_CP_DATA correctly by
++ * f2fs_is_atomic_file.
++ */
++ if (get_dirty_pages(inode))
++ f2fs_msg(F2FS_I_SB(inode)->sb, KERN_WARNING,
+ "Unexpected flush for atomic writes: ino=%lu, npages=%u",
+ inode->i_ino, get_dirty_pages(inode));
+ ret = filemap_write_and_wait_range(inode->i_mapping, 0, LLONG_MAX);
+@@ -1747,7 +1749,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)
+ up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ goto out;
+ }
+-skip_flush:
++
+ set_inode_flag(inode, FI_ATOMIC_FILE);
+ clear_inode_flag(inode, FI_ATOMIC_REVOKE_REQUEST);
+ up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+diff --git a/net/core/gro_cells.c b/net/core/gro_cells.c
+index acf45ddbe924..e095fb871d91 100644
+--- a/net/core/gro_cells.c
++++ b/net/core/gro_cells.c
+@@ -13,22 +13,36 @@ int gro_cells_receive(struct gro_cells *gcells, struct sk_buff *skb)
+ {
+ struct net_device *dev = skb->dev;
+ struct gro_cell *cell;
++ int res;
+
+- if (!gcells->cells || skb_cloned(skb) || netif_elide_gro(dev))
+- return netif_rx(skb);
++ rcu_read_lock();
++ if (unlikely(!(dev->flags & IFF_UP)))
++ goto drop;
++
++ if (!gcells->cells || skb_cloned(skb) || netif_elide_gro(dev)) {
++ res = netif_rx(skb);
++ goto unlock;
++ }
+
+ cell = this_cpu_ptr(gcells->cells);
+
+ if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) {
++drop:
+ atomic_long_inc(&dev->rx_dropped);
+ kfree_skb(skb);
+- return NET_RX_DROP;
++ res = NET_RX_DROP;
++ goto unlock;
+ }
+
+ __skb_queue_tail(&cell->napi_skbs, skb);
+ if (skb_queue_len(&cell->napi_skbs) == 1)
+ napi_schedule(&cell->napi);
+- return NET_RX_SUCCESS;
++
++ res = NET_RX_SUCCESS;
++
++unlock:
++ rcu_read_unlock();
++ return res;
+ }
+ EXPORT_SYMBOL(gro_cells_receive);
+
+diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
+index b8cd43c9ed5b..a97bf326b231 100644
+--- a/net/hsr/hsr_device.c
++++ b/net/hsr/hsr_device.c
+@@ -94,9 +94,8 @@ static void hsr_check_announce(struct net_device *hsr_dev,
+ && (old_operstate != IF_OPER_UP)) {
+ /* Went up */
+ hsr->announce_count = 0;
+- hsr->announce_timer.expires = jiffies +
+- msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL);
+- add_timer(&hsr->announce_timer);
++ mod_timer(&hsr->announce_timer,
++ jiffies + msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL));
+ }
+
+ if ((hsr_dev->operstate != IF_OPER_UP) && (old_operstate == IF_OPER_UP))
+@@ -332,6 +331,7 @@ static void hsr_announce(struct timer_list *t)
+ {
+ struct hsr_priv *hsr;
+ struct hsr_port *master;
++ unsigned long interval;
+
+ hsr = from_timer(hsr, t, announce_timer);
+
+@@ -343,18 +343,16 @@ static void hsr_announce(struct timer_list *t)
+ hsr->protVersion);
+ hsr->announce_count++;
+
+- hsr->announce_timer.expires = jiffies +
+- msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL);
++ interval = msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL);
+ } else {
+ send_hsr_supervision_frame(master, HSR_TLV_LIFE_CHECK,
+ hsr->protVersion);
+
+- hsr->announce_timer.expires = jiffies +
+- msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL);
++ interval = msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL);
+ }
+
+ if (is_admin_up(master->dev))
+- add_timer(&hsr->announce_timer);
++ mod_timer(&hsr->announce_timer, jiffies + interval);
+
+ rcu_read_unlock();
+ }
+@@ -486,7 +484,7 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
+
+ res = hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER);
+ if (res)
+- return res;
++ goto err_add_port;
+
+ res = register_netdevice(hsr_dev);
+ if (res)
+@@ -506,6 +504,8 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
+ fail:
+ hsr_for_each_port(hsr, port)
+ hsr_del_port(port);
++err_add_port:
++ hsr_del_node(&hsr->self_node_db);
+
+ return res;
+ }
+diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
+index 286ceb41ac0c..9af16cb68f76 100644
+--- a/net/hsr/hsr_framereg.c
++++ b/net/hsr/hsr_framereg.c
+@@ -124,6 +124,18 @@ int hsr_create_self_node(struct list_head *self_node_db,
+ return 0;
+ }
+
++void hsr_del_node(struct list_head *self_node_db)
++{
++ struct hsr_node *node;
++
++ rcu_read_lock();
++ node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list);
++ rcu_read_unlock();
++ if (node) {
++ list_del_rcu(&node->mac_list);
++ kfree(node);
++ }
++}
+
+ /* Allocate an hsr_node and add it to node_db. 'addr' is the node's AddressA;
+ * seq_out is used to initialize filtering of outgoing duplicate frames
+diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h
+index 370b45998121..531fd3dfcac1 100644
+--- a/net/hsr/hsr_framereg.h
++++ b/net/hsr/hsr_framereg.h
+@@ -16,6 +16,7 @@
+
+ struct hsr_node;
+
++void hsr_del_node(struct list_head *self_node_db);
+ struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
+ u16 seq_out);
+ struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index ca87bb6784e5..7a556e459375 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1308,6 +1308,10 @@ static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
+ if (fnhe->fnhe_daddr == daddr) {
+ rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
+ fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
++ /* set fnhe_daddr to 0 to ensure it won't bind with
++ * new dsts in rt_bind_exception().
++ */
++ fnhe->fnhe_daddr = 0;
+ fnhe_flush_routes(fnhe);
+ kfree_rcu(fnhe, rcu);
+ break;
+@@ -2155,12 +2159,13 @@ int ip_route_input_rcu(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ int our = 0;
+ int err = -EINVAL;
+
+- if (in_dev)
+- our = ip_check_mc_rcu(in_dev, daddr, saddr,
+- ip_hdr(skb)->protocol);
++ if (!in_dev)
++ return err;
++ our = ip_check_mc_rcu(in_dev, daddr, saddr,
++ ip_hdr(skb)->protocol);
+
+ /* check l3 master if no match yet */
+- if ((!in_dev || !our) && netif_is_l3_slave(dev)) {
++ if (!our && netif_is_l3_slave(dev)) {
+ struct in_device *l3_in_dev;
+
+ l3_in_dev = __in_dev_get_rcu(skb->dev);
+diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
+index c3387dfd725b..f66b2e6d97a7 100644
+--- a/net/ipv4/syncookies.c
++++ b/net/ipv4/syncookies.c
+@@ -216,7 +216,12 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
+ refcount_set(&req->rsk_refcnt, 1);
+ tcp_sk(child)->tsoffset = tsoff;
+ sock_rps_save_rxhash(child, skb);
+- inet_csk_reqsk_queue_add(sk, req, child);
++ if (!inet_csk_reqsk_queue_add(sk, req, child)) {
++ bh_unlock_sock(child);
++ sock_put(child);
++ child = NULL;
++ reqsk_put(req);
++ }
+ } else {
+ reqsk_free(req);
+ }
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 432dc9af1172..30c6e94b06c4 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1901,6 +1901,11 @@ static int tcp_inq_hint(struct sock *sk)
+ inq = tp->rcv_nxt - tp->copied_seq;
+ release_sock(sk);
+ }
++ /* After receiving a FIN, tell the user-space to continue reading
++ * by returning a non-zero inq.
++ */
++ if (inq == 0 && sock_flag(sk, SOCK_DONE))
++ inq = 1;
+ return inq;
+ }
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 664fa7d8f7d9..572f79abd393 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -6514,7 +6514,13 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
+ af_ops->send_synack(fastopen_sk, dst, &fl, req,
+ &foc, TCP_SYNACK_FASTOPEN);
+ /* Add the child socket directly into the accept queue */
+- inet_csk_reqsk_queue_add(sk, req, fastopen_sk);
++ if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
++ reqsk_fastopen_remove(fastopen_sk, req, false);
++ bh_unlock_sock(fastopen_sk);
++ sock_put(fastopen_sk);
++ reqsk_put(req);
++ goto drop;
++ }
+ sk->sk_data_ready(sk);
+ bh_unlock_sock(fastopen_sk);
+ sock_put(fastopen_sk);
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 3b83b157b0a1..30fdf891940b 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1646,15 +1646,8 @@ EXPORT_SYMBOL(tcp_add_backlog);
+ int tcp_filter(struct sock *sk, struct sk_buff *skb)
+ {
+ struct tcphdr *th = (struct tcphdr *)skb->data;
+- unsigned int eaten = skb->len;
+- int err;
+
+- err = sk_filter_trim_cap(sk, skb, th->doff * 4);
+- if (!err) {
+- eaten -= skb->len;
+- TCP_SKB_CB(skb)->end_seq -= eaten;
+- }
+- return err;
++ return sk_filter_trim_cap(sk, skb, th->doff * 4);
+ }
+ EXPORT_SYMBOL(tcp_filter);
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index ba59a9c14e02..66cc94427437 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1282,18 +1282,29 @@ static DEFINE_SPINLOCK(rt6_exception_lock);
+ static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
+ struct rt6_exception *rt6_ex)
+ {
++ struct fib6_info *from;
+ struct net *net;
+
+ if (!bucket || !rt6_ex)
+ return;
+
+ net = dev_net(rt6_ex->rt6i->dst.dev);
++ net->ipv6.rt6_stats->fib_rt_cache--;
++
++ /* purge completely the exception to allow releasing the held resources:
++ * some [sk] cache may keep the dst around for unlimited time
++ */
++ from = rcu_dereference_protected(rt6_ex->rt6i->from,
++ lockdep_is_held(&rt6_exception_lock));
++ rcu_assign_pointer(rt6_ex->rt6i->from, NULL);
++ fib6_info_release(from);
++ dst_dev_put(&rt6_ex->rt6i->dst);
++
+ hlist_del_rcu(&rt6_ex->hlist);
+ dst_release(&rt6_ex->rt6i->dst);
+ kfree_rcu(rt6_ex, rcu);
+ WARN_ON_ONCE(!bucket->depth);
+ bucket->depth--;
+- net->ipv6.rt6_stats->fib_rt_cache--;
+ }
+
+ /* Remove oldest rt6_ex in bucket and free the memory
+@@ -1612,15 +1623,15 @@ static int rt6_remove_exception_rt(struct rt6_info *rt)
+ static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
+ {
+ struct rt6_exception_bucket *bucket;
+- struct fib6_info *from = rt->from;
+ struct in6_addr *src_key = NULL;
+ struct rt6_exception *rt6_ex;
+-
+- if (!from ||
+- !(rt->rt6i_flags & RTF_CACHE))
+- return;
++ struct fib6_info *from;
+
+ rcu_read_lock();
++ from = rcu_dereference(rt->from);
++ if (!from || !(rt->rt6i_flags & RTF_CACHE))
++ goto unlock;
++
+ bucket = rcu_dereference(from->rt6i_exception_bucket);
+
+ #ifdef CONFIG_IPV6_SUBTREES
+@@ -1639,6 +1650,7 @@ static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
+ if (rt6_ex)
+ rt6_ex->stamp = jiffies;
+
++unlock:
+ rcu_read_unlock();
+ }
+
+@@ -2796,20 +2808,24 @@ static int ip6_route_check_nh_onlink(struct net *net,
+ u32 tbid = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN;
+ const struct in6_addr *gw_addr = &cfg->fc_gateway;
+ u32 flags = RTF_LOCAL | RTF_ANYCAST | RTF_REJECT;
++ struct fib6_info *from;
+ struct rt6_info *grt;
+ int err;
+
+ err = 0;
+ grt = ip6_nh_lookup_table(net, cfg, gw_addr, tbid, 0);
+ if (grt) {
++ rcu_read_lock();
++ from = rcu_dereference(grt->from);
+ if (!grt->dst.error &&
+ /* ignore match if it is the default route */
+- grt->from && !ipv6_addr_any(&grt->from->fib6_dst.addr) &&
++ from && !ipv6_addr_any(&from->fib6_dst.addr) &&
+ (grt->rt6i_flags & flags || dev != grt->dst.dev)) {
+ NL_SET_ERR_MSG(extack,
+ "Nexthop has invalid gateway or device mismatch");
+ err = -EINVAL;
+ }
++ rcu_read_unlock();
+
+ ip6_rt_put(grt);
+ }
+@@ -4710,7 +4726,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
+ table = rt->fib6_table->tb6_id;
+ else
+ table = RT6_TABLE_UNSPEC;
+- rtm->rtm_table = table;
++ rtm->rtm_table = table < 256 ? table : RT_TABLE_COMPAT;
+ if (nla_put_u32(skb, RTA_TABLE, table))
+ goto nla_put_failure;
+
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 868d7da7a0cb..de9aa5cb295c 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -778,8 +778,9 @@ static bool check_6rd(struct ip_tunnel *tunnel, const struct in6_addr *v6dst,
+ pbw0 = tunnel->ip6rd.prefixlen >> 5;
+ pbi0 = tunnel->ip6rd.prefixlen & 0x1f;
+
+- d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
+- tunnel->ip6rd.relay_prefixlen;
++ d = tunnel->ip6rd.relay_prefixlen < 32 ?
++ (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
++ tunnel->ip6rd.relay_prefixlen : 0;
+
+ pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;
+ if (pbi1 > 0)
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index 0ae6899edac0..37a69df17cab 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -674,9 +674,6 @@ static int l2tp_ip6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ if (flags & MSG_OOB)
+ goto out;
+
+- if (addr_len)
+- *addr_len = sizeof(*lsa);
+-
+ if (flags & MSG_ERRQUEUE)
+ return ipv6_recv_error(sk, msg, len, addr_len);
+
+@@ -706,6 +703,7 @@ static int l2tp_ip6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ lsa->l2tp_conn_id = 0;
+ if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL)
+ lsa->l2tp_scope_id = inet6_iif(skb);
++ *addr_len = sizeof(*lsa);
+ }
+
+ if (np->rxopt.all)
+diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
+index 521189f4b666..6e419b15a9f8 100644
+--- a/net/rxrpc/conn_client.c
++++ b/net/rxrpc/conn_client.c
+@@ -353,7 +353,7 @@ static int rxrpc_get_client_conn(struct rxrpc_sock *rx,
+ * normally have to take channel_lock but we do this before anyone else
+ * can see the connection.
+ */
+- list_add_tail(&call->chan_wait_link, &candidate->waiting_calls);
++ list_add(&call->chan_wait_link, &candidate->waiting_calls);
+
+ if (cp->exclusive) {
+ call->conn = candidate;
+@@ -432,7 +432,7 @@ found_extant_conn:
+ call->conn = conn;
+ call->security_ix = conn->security_ix;
+ call->service_id = conn->service_id;
+- list_add(&call->chan_wait_link, &conn->waiting_calls);
++ list_add_tail(&call->chan_wait_link, &conn->waiting_calls);
+ spin_unlock(&conn->channel_lock);
+ _leave(" = 0 [extant %d]", conn->debug_id);
+ return 0;
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index 84893bc67531..09b359784629 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -1213,47 +1213,47 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
+ if (err < 0)
+ goto errout;
+
+- if (!handle) {
+- handle = 1;
+- err = idr_alloc_u32(&head->handle_idr, fnew, &handle,
+- INT_MAX, GFP_KERNEL);
+- } else if (!fold) {
+- /* user specifies a handle and it doesn't exist */
+- err = idr_alloc_u32(&head->handle_idr, fnew, &handle,
+- handle, GFP_KERNEL);
+- }
+- if (err)
+- goto errout;
+- fnew->handle = handle;
+-
+ if (tb[TCA_FLOWER_FLAGS]) {
+ fnew->flags = nla_get_u32(tb[TCA_FLOWER_FLAGS]);
+
+ if (!tc_flags_valid(fnew->flags)) {
+ err = -EINVAL;
+- goto errout_idr;
++ goto errout;
+ }
+ }
+
+ err = fl_set_parms(net, tp, fnew, mask, base, tb, tca[TCA_RATE], ovr,
+ tp->chain->tmplt_priv, extack);
+ if (err)
+- goto errout_idr;
++ goto errout;
+
+ err = fl_check_assign_mask(head, fnew, fold, mask);
+ if (err)
+- goto errout_idr;
++ goto errout;
++
++ if (!handle) {
++ handle = 1;
++ err = idr_alloc_u32(&head->handle_idr, fnew, &handle,
++ INT_MAX, GFP_KERNEL);
++ } else if (!fold) {
++ /* user specifies a handle and it doesn't exist */
++ err = idr_alloc_u32(&head->handle_idr, fnew, &handle,
++ handle, GFP_KERNEL);
++ }
++ if (err)
++ goto errout_mask;
++ fnew->handle = handle;
+
+ if (!tc_skip_sw(fnew->flags)) {
+ if (!fold && fl_lookup(fnew->mask, &fnew->mkey)) {
+ err = -EEXIST;
+- goto errout_mask;
++ goto errout_idr;
+ }
+
+ err = rhashtable_insert_fast(&fnew->mask->ht, &fnew->ht_node,
+ fnew->mask->filter_ht_params);
+ if (err)
+- goto errout_mask;
++ goto errout_idr;
+ }
+
+ if (!tc_skip_hw(fnew->flags)) {
+@@ -1290,12 +1290,13 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
+ kfree(mask);
+ return 0;
+
+-errout_mask:
+- fl_mask_put(head, fnew->mask, false);
+-
+ errout_idr:
+ if (!fold)
+ idr_remove(&head->handle_idr, fnew->handle);
++
++errout_mask:
++ fl_mask_put(head, fnew->mask, false);
++
+ errout:
+ tcf_exts_destroy(&fnew->exts);
+ kfree(fnew);
+diff --git a/net/sctp/stream.c b/net/sctp/stream.c
+index 2936ed17bf9e..3b47457862cc 100644
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -230,8 +230,6 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt,
+ for (i = 0; i < stream->outcnt; i++)
+ SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN;
+
+- sched->init(stream);
+-
+ in:
+ sctp_stream_interleave_init(stream);
+ if (!incnt)
+diff --git a/net/smc/smc.h b/net/smc/smc.h
+index 5721416d0605..adbdf195eb08 100644
+--- a/net/smc/smc.h
++++ b/net/smc/smc.h
+@@ -113,9 +113,9 @@ struct smc_host_cdc_msg { /* Connection Data Control message */
+ } __aligned(8);
+
+ enum smc_urg_state {
+- SMC_URG_VALID, /* data present */
+- SMC_URG_NOTYET, /* data pending */
+- SMC_URG_READ /* data was already read */
++ SMC_URG_VALID = 1, /* data present */
++ SMC_URG_NOTYET = 2, /* data pending */
++ SMC_URG_READ = 3, /* data was already read */
+ };
+
+ struct smc_connection {
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index c754f3a90a2e..f601933ad728 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -888,7 +888,7 @@ retry:
+ addr->hash ^= sk->sk_type;
+
+ __unix_remove_socket(sk);
+- u->addr = addr;
++ smp_store_release(&u->addr, addr);
+ __unix_insert_socket(&unix_socket_table[addr->hash], sk);
+ spin_unlock(&unix_table_lock);
+ err = 0;
+@@ -1058,7 +1058,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+
+ err = 0;
+ __unix_remove_socket(sk);
+- u->addr = addr;
++ smp_store_release(&u->addr, addr);
+ __unix_insert_socket(list, sk);
+
+ out_unlock:
+@@ -1329,15 +1329,29 @@ restart:
+ RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq);
+ otheru = unix_sk(other);
+
+- /* copy address information from listening to new sock*/
+- if (otheru->addr) {
+- refcount_inc(&otheru->addr->refcnt);
+- newu->addr = otheru->addr;
+- }
++ /* copy address information from listening to new sock
++ *
++ * The contents of *(otheru->addr) and otheru->path
++ * are seen fully set up here, since we have found
++ * otheru in hash under unix_table_lock. Insertion
++ * into the hash chain we'd found it in had been done
++ * in an earlier critical area protected by unix_table_lock,
++ * the same one where we'd set *(otheru->addr) contents,
++ * as well as otheru->path and otheru->addr itself.
++ *
++ * Using smp_store_release() here to set newu->addr
++ * is enough to make those stores, as well as stores
++ * to newu->path visible to anyone who gets newu->addr
++ * by smp_load_acquire(). IOW, the same warranties
++ * as for unix_sock instances bound in unix_bind() or
++ * in unix_autobind().
++ */
+ if (otheru->path.dentry) {
+ path_get(&otheru->path);
+ newu->path = otheru->path;
+ }
++ refcount_inc(&otheru->addr->refcnt);
++ smp_store_release(&newu->addr, otheru->addr);
+
+ /* Set credentials */
+ copy_peercred(sk, other);
+@@ -1451,7 +1465,7 @@ out:
+ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
+ {
+ struct sock *sk = sock->sk;
+- struct unix_sock *u;
++ struct unix_address *addr;
+ DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr);
+ int err = 0;
+
+@@ -1466,19 +1480,15 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
+ sock_hold(sk);
+ }
+
+- u = unix_sk(sk);
+- unix_state_lock(sk);
+- if (!u->addr) {
++ addr = smp_load_acquire(&unix_sk(sk)->addr);
++ if (!addr) {
+ sunaddr->sun_family = AF_UNIX;
+ sunaddr->sun_path[0] = 0;
+ err = sizeof(short);
+ } else {
+- struct unix_address *addr = u->addr;
+-
+ err = addr->len;
+ memcpy(sunaddr, addr->name, addr->len);
+ }
+- unix_state_unlock(sk);
+ sock_put(sk);
+ out:
+ return err;
+@@ -2071,11 +2081,11 @@ static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg,
+
+ static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
+ {
+- struct unix_sock *u = unix_sk(sk);
++ struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr);
+
+- if (u->addr) {
+- msg->msg_namelen = u->addr->len;
+- memcpy(msg->msg_name, u->addr->name, u->addr->len);
++ if (addr) {
++ msg->msg_namelen = addr->len;
++ memcpy(msg->msg_name, addr->name, addr->len);
+ }
+ }
+
+@@ -2579,15 +2589,14 @@ static int unix_open_file(struct sock *sk)
+ if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+ return -EPERM;
+
+- unix_state_lock(sk);
++ if (!smp_load_acquire(&unix_sk(sk)->addr))
++ return -ENOENT;
++
+ path = unix_sk(sk)->path;
+- if (!path.dentry) {
+- unix_state_unlock(sk);
++ if (!path.dentry)
+ return -ENOENT;
+- }
+
+ path_get(&path);
+- unix_state_unlock(sk);
+
+ fd = get_unused_fd_flags(O_CLOEXEC);
+ if (fd < 0)
+@@ -2828,7 +2837,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+ (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING),
+ sock_i_ino(s));
+
+- if (u->addr) {
++ if (u->addr) { // under unix_table_lock here
+ int i, len;
+ seq_putc(seq, ' ');
+
+diff --git a/net/unix/diag.c b/net/unix/diag.c
+index 384c84e83462..3183d9b8ab33 100644
+--- a/net/unix/diag.c
++++ b/net/unix/diag.c
+@@ -10,7 +10,8 @@
+
+ static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb)
+ {
+- struct unix_address *addr = unix_sk(sk)->addr;
++ /* might or might not have unix_table_lock */
++ struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr);
+
+ if (!addr)
+ return 0;
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index fef473c736fa..f7f53f9ae7ef 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -679,8 +679,7 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
+ int len, i, rc = 0;
+
+- if (!sock_flag(sk, SOCK_ZAPPED) ||
+- addr_len != sizeof(struct sockaddr_x25) ||
++ if (addr_len != sizeof(struct sockaddr_x25) ||
+ addr->sx25_family != AF_X25) {
+ rc = -EINVAL;
+ goto out;
+@@ -695,9 +694,13 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ }
+
+ lock_sock(sk);
+- x25_sk(sk)->source_addr = addr->sx25_addr;
+- x25_insert_socket(sk);
+- sock_reset_flag(sk, SOCK_ZAPPED);
++ if (sock_flag(sk, SOCK_ZAPPED)) {
++ x25_sk(sk)->source_addr = addr->sx25_addr;
++ x25_insert_socket(sk);
++ sock_reset_flag(sk, SOCK_ZAPPED);
++ } else {
++ rc = -EINVAL;
++ }
+ release_sock(sk);
+ SOCK_DEBUG(sk, "x25_bind: socket is bound\n");
+ out:
+@@ -813,8 +816,13 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
+ sock->state = SS_CONNECTED;
+ rc = 0;
+ out_put_neigh:
+- if (rc)
++ if (rc) {
++ read_lock_bh(&x25_list_lock);
+ x25_neigh_put(x25->neighbour);
++ x25->neighbour = NULL;
++ read_unlock_bh(&x25_list_lock);
++ x25->state = X25_STATE_0;
++ }
+ out_put_route:
+ x25_route_put(rt);
+ out:
+diff --git a/security/lsm_audit.c b/security/lsm_audit.c
+index f84001019356..33028c098ef3 100644
+--- a/security/lsm_audit.c
++++ b/security/lsm_audit.c
+@@ -321,6 +321,7 @@ static void dump_common_audit_data(struct audit_buffer *ab,
+ if (a->u.net->sk) {
+ struct sock *sk = a->u.net->sk;
+ struct unix_sock *u;
++ struct unix_address *addr;
+ int len = 0;
+ char *p = NULL;
+
+@@ -351,14 +352,15 @@ static void dump_common_audit_data(struct audit_buffer *ab,
+ #endif
+ case AF_UNIX:
+ u = unix_sk(sk);
++ addr = smp_load_acquire(&u->addr);
++ if (!addr)
++ break;
+ if (u->path.dentry) {
+ audit_log_d_path(ab, " path=", &u->path);
+ break;
+ }
+- if (!u->addr)
+- break;
+- len = u->addr->len-sizeof(short);
+- p = &u->addr->name->sun_path[0];
++ len = addr->len-sizeof(short);
++ p = &addr->name->sun_path[0];
+ audit_log_format(ab, " path=");
+ if (*p)
+ audit_log_untrustedstring(ab, p);
+diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
+index de4af8a41ff0..5636e89ce5c7 100644
+--- a/sound/firewire/bebob/bebob.c
++++ b/sound/firewire/bebob/bebob.c
+@@ -474,7 +474,19 @@ static const struct ieee1394_device_id bebob_id_table[] = {
+ /* Focusrite, SaffirePro 26 I/O */
+ SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000003, &saffirepro_26_spec),
+ /* Focusrite, SaffirePro 10 I/O */
+- SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000006, &saffirepro_10_spec),
++ {
++ // The combination of vendor_id and model_id is the same as the
++ // same as the one of Liquid Saffire 56.
++ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_MODEL_ID |
++ IEEE1394_MATCH_SPECIFIER_ID |
++ IEEE1394_MATCH_VERSION,
++ .vendor_id = VEN_FOCUSRITE,
++ .model_id = 0x000006,
++ .specifier_id = 0x00a02d,
++ .version = 0x010001,
++ .driver_data = (kernel_ulong_t)&saffirepro_10_spec,
++ },
+ /* Focusrite, Saffire(no label and LE) */
+ SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, MODEL_FOCUSRITE_SAFFIRE_BOTH,
+ &saffire_spec),
+diff --git a/sound/firewire/motu/amdtp-motu.c b/sound/firewire/motu/amdtp-motu.c
+index f0555a24d90e..6c9b743ea74b 100644
+--- a/sound/firewire/motu/amdtp-motu.c
++++ b/sound/firewire/motu/amdtp-motu.c
+@@ -136,7 +136,9 @@ static void read_pcm_s32(struct amdtp_stream *s,
+ byte = (u8 *)buffer + p->pcm_byte_offset;
+
+ for (c = 0; c < channels; ++c) {
+- *dst = (byte[0] << 24) | (byte[1] << 16) | byte[2];
++ *dst = (byte[0] << 24) |
++ (byte[1] << 16) |
++ (byte[2] << 8);
+ byte += 3;
+ dst++;
+ }
+diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c
+index 617ff1aa818f..27eb0270a711 100644
+--- a/sound/hda/hdac_i915.c
++++ b/sound/hda/hdac_i915.c
+@@ -144,9 +144,9 @@ int snd_hdac_i915_init(struct hdac_bus *bus)
+ return -ENODEV;
+ if (!acomp->ops) {
+ request_module("i915");
+- /* 10s timeout */
++ /* 60s timeout */
+ wait_for_completion_timeout(&bind_complete,
+- msecs_to_jiffies(10 * 1000));
++ msecs_to_jiffies(60 * 1000));
+ }
+ if (!acomp->ops) {
+ dev_info(bus->dev, "couldn't bind with audio component\n");
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index fead0acb29f7..3cbd2119e148 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -936,6 +936,9 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
+ SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index bf1ffcaab23f..877293149e3a 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -118,6 +118,7 @@ struct alc_spec {
+ unsigned int has_alc5505_dsp:1;
+ unsigned int no_depop_delay:1;
+ unsigned int done_hp_init:1;
++ unsigned int no_shutup_pins:1;
+
+ /* for PLL fix */
+ hda_nid_t pll_nid;
+@@ -476,6 +477,14 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on)
+ set_eapd(codec, *p, on);
+ }
+
++static void alc_shutup_pins(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (!spec->no_shutup_pins)
++ snd_hda_shutup_pins(codec);
++}
++
+ /* generic shutup callback;
+ * just turning off EAPD and a little pause for avoiding pop-noise
+ */
+@@ -486,7 +495,7 @@ static void alc_eapd_shutup(struct hda_codec *codec)
+ alc_auto_setup_eapd(codec, false);
+ if (!spec->no_depop_delay)
+ msleep(200);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ /* generic EAPD initialization */
+@@ -814,7 +823,7 @@ static inline void alc_shutup(struct hda_codec *codec)
+ if (spec && spec->shutup)
+ spec->shutup(codec);
+ else
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc_reboot_notify(struct hda_codec *codec)
+@@ -2950,7 +2959,7 @@ static void alc269_shutup(struct hda_codec *codec)
+ (alc_get_coef0(codec) & 0x00ff) == 0x018) {
+ msleep(150);
+ }
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static struct coef_fw alc282_coefs[] = {
+@@ -3053,14 +3062,15 @@ static void alc282_shutup(struct hda_codec *codec)
+ if (hp_pin_sense)
+ msleep(85);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ alc_write_coef_idx(codec, 0x78, coef78);
+ }
+
+@@ -3166,15 +3176,16 @@ static void alc283_shutup(struct hda_codec *codec)
+ if (hp_pin_sense)
+ msleep(100);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+ if (hp_pin_sense)
+ msleep(100);
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ alc_write_coef_idx(codec, 0x43, 0x9614);
+ }
+
+@@ -3240,14 +3251,15 @@ static void alc256_shutup(struct hda_codec *codec)
+ /* NOTE: call this before clearing the pin, otherwise codec stalls */
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc225_init(struct hda_codec *codec)
+@@ -3334,7 +3346,7 @@ static void alc225_shutup(struct hda_codec *codec)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc_default_init(struct hda_codec *codec)
+@@ -3388,14 +3400,15 @@ static void alc_default_shutup(struct hda_codec *codec)
+ if (hp_pin_sense)
+ msleep(85);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc294_hp_init(struct hda_codec *codec)
+@@ -3412,8 +3425,9 @@ static void alc294_hp_init(struct hda_codec *codec)
+
+ msleep(100);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
+ alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
+@@ -5007,16 +5021,12 @@ static void alc_fixup_auto_mute_via_amp(struct hda_codec *codec,
+ }
+ }
+
+-static void alc_no_shutup(struct hda_codec *codec)
+-{
+-}
+-
+ static void alc_fixup_no_shutup(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ struct alc_spec *spec = codec->spec;
+- spec->shutup = alc_no_shutup;
++ spec->no_shutup_pins = 1;
+ }
+ }
+
+@@ -5602,6 +5612,7 @@ enum {
+ ALC294_FIXUP_ASUS_SPK,
+ ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
+ ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
++ ALC255_FIXUP_ACER_HEADSET_MIC,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6546,6 +6557,16 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC285_FIXUP_LENOVO_HEADPHONE_NOISE
+ },
++ [ALC255_FIXUP_ACER_HEADSET_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x03a11130 },
++ { 0x1a, 0x90a60140 }, /* use as internal mic */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6565,6 +6586,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
+ SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
+@@ -6596,6 +6618,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
++ SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP),
+ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+@@ -6670,11 +6693,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x103c, 0x802e, "HP Z240 SFF", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x802f, "HP Z240", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
+ SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360),
+- SND_PCI_QUIRK(0x103c, 0x82bf, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+- SND_PCI_QUIRK(0x103c, 0x82c0, "HP", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+@@ -6690,7 +6715,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+- SND_PCI_QUIRK(0x1043, 0x14a1, "ASUS UX533FD", ALC294_FIXUP_ASUS_SPK),
+ SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+@@ -7303,6 +7327,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x14, 0x90170110},
+ {0x1b, 0x90a70130},
+ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_SPK,
++ {0x12, 0x90a60130},
++ {0x17, 0x90170110},
++ {0x21, 0x03211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_SPK,
+ {0x12, 0x90a60130},
+ {0x17, 0x90170110},
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-03-23 20:23 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-03-23 20:23 UTC (permalink / raw
To: gentoo-commits
commit: 83df740ec019d6c6572b7a5ce3abf14636ed17cb
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 23 20:22:32 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Mar 23 20:22:32 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=83df740e
Linux patch 4.19.31 and removal of redundant patch
Remove redundant patch:
1700_ppc-vr-get-set-change-to-avoid-gcc-warning.patch
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 8 +-
1030_linux-4.19.31.patch | 12008 +++++++++++++++++++
...pc-vr-get-set-change-to-avoid-gcc-warning.patch | 115 -
3 files changed, 12012 insertions(+), 119 deletions(-)
diff --git a/0000_README b/0000_README
index 53e44f7..730a45b 100644
--- a/0000_README
+++ b/0000_README
@@ -163,6 +163,10 @@ Patch: 1029_linux-4.19.30.patch
From: http://www.kernel.org
Desc: Linux 4.19.30
+Patch: 1030_linux-4.19.31.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.31
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
@@ -171,10 +175,6 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default.
-Patch: 1700_ppc-vr-get-set-change-to-avoid-gcc-warning.patch
-From: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/patch/?id=ca6d5149d2ad0a8d2f9c28cbe379802260a0a5e0
-Desc: powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
-
Patch: 2500_usb-storage-Disable-UAS-on-JMicron-SATA-enclosure.patch
From: https://bugzilla.redhat.com/show_bug.cgi?id=1260207#c5
Desc: Add UAS disable quirk. See bug #640082.
diff --git a/1030_linux-4.19.31.patch b/1030_linux-4.19.31.patch
new file mode 100644
index 0000000..74fc1cf
--- /dev/null
+++ b/1030_linux-4.19.31.patch
@@ -0,0 +1,12008 @@
+diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt
+index 3b2f2dd82225..3c6fc2e08d04 100644
+--- a/Documentation/arm64/silicon-errata.txt
++++ b/Documentation/arm64/silicon-errata.txt
+@@ -44,6 +44,8 @@ stable kernels.
+
+ | Implementor | Component | Erratum ID | Kconfig |
+ +----------------+-----------------+-----------------+-----------------------------+
++| Allwinner | A64/R18 | UNKNOWN1 | SUN50I_ERRATUM_UNKNOWN1 |
++| | | | |
+ | ARM | Cortex-A53 | #826319 | ARM64_ERRATUM_826319 |
+ | ARM | Cortex-A53 | #827319 | ARM64_ERRATUM_827319 |
+ | ARM | Cortex-A53 | #824069 | ARM64_ERRATUM_824069 |
+diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst
+index 0de6f6145cc6..7ba8cd567f84 100644
+--- a/Documentation/process/stable-kernel-rules.rst
++++ b/Documentation/process/stable-kernel-rules.rst
+@@ -38,6 +38,9 @@ Procedure for submitting patches to the -stable tree
+ - If the patch covers files in net/ or drivers/net please follow netdev stable
+ submission guidelines as described in
+ :ref:`Documentation/networking/netdev-FAQ.rst <netdev-FAQ>`
++ after first checking the stable networking queue at
++ https://patchwork.ozlabs.org/bundle/davem/stable/?series=&submitter=&state=*&q=&archive=
++ to ensure the requested patch is not already queued up.
+ - Security patches should not be handled (solely) by the -stable review
+ process but should follow the procedures in
+ :ref:`Documentation/admin-guide/security-bugs.rst <securitybugs>`.
+diff --git a/Makefile b/Makefile
+index 72e27c379eaf..3b1c6cff6700 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 30
++SUBLEVEL = 31
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
+index ac69f307dcfe..74953e76a57d 100644
+--- a/arch/arc/Kconfig
++++ b/arch/arc/Kconfig
+@@ -420,6 +420,14 @@ config ARC_HAS_ACCL_REGS
+ (also referred to as r58:r59). These can also be used by gcc as GPR so
+ kernel needs to save/restore per process
+
++config ARC_IRQ_NO_AUTOSAVE
++ bool "Disable hardware autosave regfile on interrupts"
++ default n
++ help
++ On HS cores, taken interrupt auto saves the regfile on stack.
++ This is programmable and can be optionally disabled in which case
++ software INTERRUPT_PROLOGUE/EPILGUE do the needed work
++
+ endif # ISA_ARCV2
+
+ endmenu # "ARC CPU Configuration"
+diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
+index 49bfbd879caa..bdbdaef902eb 100644
+--- a/arch/arc/include/asm/arcregs.h
++++ b/arch/arc/include/asm/arcregs.h
+@@ -151,6 +151,14 @@ struct bcr_isa_arcv2 {
+ #endif
+ };
+
++struct bcr_uarch_build_arcv2 {
++#ifdef CONFIG_CPU_BIG_ENDIAN
++ unsigned int pad:8, prod:8, maj:8, min:8;
++#else
++ unsigned int min:8, maj:8, prod:8, pad:8;
++#endif
++};
++
+ struct bcr_mpy {
+ #ifdef CONFIG_CPU_BIG_ENDIAN
+ unsigned int pad:8, x1616:8, dsp:4, cycles:2, type:2, ver:8;
+diff --git a/arch/arc/include/asm/entry-arcv2.h b/arch/arc/include/asm/entry-arcv2.h
+index 309f4e6721b3..225e7df2d8ed 100644
+--- a/arch/arc/include/asm/entry-arcv2.h
++++ b/arch/arc/include/asm/entry-arcv2.h
+@@ -17,6 +17,33 @@
+ ;
+ ; Now manually save: r12, sp, fp, gp, r25
+
++#ifdef CONFIG_ARC_IRQ_NO_AUTOSAVE
++.ifnc \called_from, exception
++ st.as r9, [sp, -10] ; save r9 in it's final stack slot
++ sub sp, sp, 12 ; skip JLI, LDI, EI
++
++ PUSH lp_count
++ PUSHAX lp_start
++ PUSHAX lp_end
++ PUSH blink
++
++ PUSH r11
++ PUSH r10
++
++ sub sp, sp, 4 ; skip r9
++
++ PUSH r8
++ PUSH r7
++ PUSH r6
++ PUSH r5
++ PUSH r4
++ PUSH r3
++ PUSH r2
++ PUSH r1
++ PUSH r0
++.endif
++#endif
++
+ #ifdef CONFIG_ARC_HAS_ACCL_REGS
+ PUSH r59
+ PUSH r58
+@@ -86,6 +113,33 @@
+ POP r59
+ #endif
+
++#ifdef CONFIG_ARC_IRQ_NO_AUTOSAVE
++.ifnc \called_from, exception
++ POP r0
++ POP r1
++ POP r2
++ POP r3
++ POP r4
++ POP r5
++ POP r6
++ POP r7
++ POP r8
++ POP r9
++ POP r10
++ POP r11
++
++ POP blink
++ POPAX lp_end
++ POPAX lp_start
++
++ POP r9
++ mov lp_count, r9
++
++ add sp, sp, 12 ; skip JLI, LDI, EI
++ ld.as r9, [sp, -10] ; reload r9 which got clobbered
++.endif
++#endif
++
+ .endm
+
+ /*------------------------------------------------------------------------*/
+diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
+index c9173c02081c..eabc3efa6c6d 100644
+--- a/arch/arc/include/asm/uaccess.h
++++ b/arch/arc/include/asm/uaccess.h
+@@ -207,7 +207,7 @@ raw_copy_from_user(void *to, const void __user *from, unsigned long n)
+ */
+ "=&r" (tmp), "+r" (to), "+r" (from)
+ :
+- : "lp_count", "lp_start", "lp_end", "memory");
++ : "lp_count", "memory");
+
+ return n;
+ }
+@@ -433,7 +433,7 @@ raw_copy_to_user(void __user *to, const void *from, unsigned long n)
+ */
+ "=&r" (tmp), "+r" (to), "+r" (from)
+ :
+- : "lp_count", "lp_start", "lp_end", "memory");
++ : "lp_count", "memory");
+
+ return n;
+ }
+@@ -653,7 +653,7 @@ static inline unsigned long __arc_clear_user(void __user *to, unsigned long n)
+ " .previous \n"
+ : "+r"(d_char), "+r"(res)
+ : "i"(0)
+- : "lp_count", "lp_start", "lp_end", "memory");
++ : "lp_count", "memory");
+
+ return res;
+ }
+@@ -686,7 +686,7 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count)
+ " .previous \n"
+ : "+r"(res), "+r"(dst), "+r"(src), "=r"(val)
+ : "g"(-EFAULT), "r"(count)
+- : "lp_count", "lp_start", "lp_end", "memory");
++ : "lp_count", "memory");
+
+ return res;
+ }
+diff --git a/arch/arc/kernel/entry-arcv2.S b/arch/arc/kernel/entry-arcv2.S
+index cc558a25b8fa..562089d62d9d 100644
+--- a/arch/arc/kernel/entry-arcv2.S
++++ b/arch/arc/kernel/entry-arcv2.S
+@@ -209,7 +209,9 @@ restore_regs:
+ ;####### Return from Intr #######
+
+ debug_marker_l1:
+- bbit1.nt r0, STATUS_DE_BIT, .Lintr_ret_to_delay_slot
++ ; bbit1.nt r0, STATUS_DE_BIT, .Lintr_ret_to_delay_slot
++ btst r0, STATUS_DE_BIT ; Z flag set if bit clear
++ bnz .Lintr_ret_to_delay_slot ; branch if STATUS_DE_BIT set
+
+ .Lisr_ret_fast_path:
+ ; Handle special case #1: (Entry via Exception, Return via IRQ)
+diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c
+index 067ea362fb3e..cf18b3e5a934 100644
+--- a/arch/arc/kernel/intc-arcv2.c
++++ b/arch/arc/kernel/intc-arcv2.c
+@@ -49,11 +49,13 @@ void arc_init_IRQ(void)
+
+ *(unsigned int *)&ictrl = 0;
+
++#ifndef CONFIG_ARC_IRQ_NO_AUTOSAVE
+ ictrl.save_nr_gpr_pairs = 6; /* r0 to r11 (r12 saved manually) */
+ ictrl.save_blink = 1;
+ ictrl.save_lp_regs = 1; /* LP_COUNT, LP_START, LP_END */
+ ictrl.save_u_to_u = 0; /* user ctxt saved on kernel stack */
+ ictrl.save_idx_regs = 1; /* JLI, LDI, EI */
++#endif
+
+ WRITE_AUX(AUX_IRQ_CTRL, ictrl);
+
+diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
+index 62a30e58441c..3320ca2fe20f 100644
+--- a/arch/arc/kernel/setup.c
++++ b/arch/arc/kernel/setup.c
+@@ -196,13 +196,29 @@ static void read_arc_build_cfg_regs(void)
+ cpu->bpu.num_pred = 2048 << bpu.pte;
+
+ if (cpu->core.family >= 0x54) {
+- unsigned int exec_ctrl;
+
+- READ_BCR(AUX_EXEC_CTRL, exec_ctrl);
+- cpu->extn.dual_enb = !(exec_ctrl & 1);
++ struct bcr_uarch_build_arcv2 uarch;
+
+- /* dual issue always present for this core */
+- cpu->extn.dual = 1;
++ /*
++ * The first 0x54 core (uarch maj:min 0:1 or 0:2) was
++ * dual issue only (HS4x). But next uarch rev (1:0)
++ * allows it be configured for single issue (HS3x)
++ * Ensure we fiddle with dual issue only on HS4x
++ */
++ READ_BCR(ARC_REG_MICRO_ARCH_BCR, uarch);
++
++ if (uarch.prod == 4) {
++ unsigned int exec_ctrl;
++
++ /* dual issue hardware always present */
++ cpu->extn.dual = 1;
++
++ READ_BCR(AUX_EXEC_CTRL, exec_ctrl);
++
++ /* dual issue hardware enabled ? */
++ cpu->extn.dual_enb = !(exec_ctrl & 1);
++
++ }
+ }
+ }
+
+diff --git a/arch/arc/lib/memcpy-archs.S b/arch/arc/lib/memcpy-archs.S
+index d61044dd8b58..ea14b0bf3116 100644
+--- a/arch/arc/lib/memcpy-archs.S
++++ b/arch/arc/lib/memcpy-archs.S
+@@ -25,15 +25,11 @@
+ #endif
+
+ #ifdef CONFIG_ARC_HAS_LL64
+-# define PREFETCH_READ(RX) prefetch [RX, 56]
+-# define PREFETCH_WRITE(RX) prefetchw [RX, 64]
+ # define LOADX(DST,RX) ldd.ab DST, [RX, 8]
+ # define STOREX(SRC,RX) std.ab SRC, [RX, 8]
+ # define ZOLSHFT 5
+ # define ZOLAND 0x1F
+ #else
+-# define PREFETCH_READ(RX) prefetch [RX, 28]
+-# define PREFETCH_WRITE(RX) prefetchw [RX, 32]
+ # define LOADX(DST,RX) ld.ab DST, [RX, 4]
+ # define STOREX(SRC,RX) st.ab SRC, [RX, 4]
+ # define ZOLSHFT 4
+@@ -41,8 +37,6 @@
+ #endif
+
+ ENTRY_CFI(memcpy)
+- prefetch [r1] ; Prefetch the read location
+- prefetchw [r0] ; Prefetch the write location
+ mov.f 0, r2
+ ;;; if size is zero
+ jz.d [blink]
+@@ -72,8 +66,6 @@ ENTRY_CFI(memcpy)
+ lpnz @.Lcopy32_64bytes
+ ;; LOOP START
+ LOADX (r6, r1)
+- PREFETCH_READ (r1)
+- PREFETCH_WRITE (r3)
+ LOADX (r8, r1)
+ LOADX (r10, r1)
+ LOADX (r4, r1)
+@@ -117,9 +109,7 @@ ENTRY_CFI(memcpy)
+ lpnz @.Lcopy8bytes_1
+ ;; LOOP START
+ ld.ab r6, [r1, 4]
+- prefetch [r1, 28] ;Prefetch the next read location
+ ld.ab r8, [r1,4]
+- prefetchw [r3, 32] ;Prefetch the next write location
+
+ SHIFT_1 (r7, r6, 24)
+ or r7, r7, r5
+@@ -162,9 +152,7 @@ ENTRY_CFI(memcpy)
+ lpnz @.Lcopy8bytes_2
+ ;; LOOP START
+ ld.ab r6, [r1, 4]
+- prefetch [r1, 28] ;Prefetch the next read location
+ ld.ab r8, [r1,4]
+- prefetchw [r3, 32] ;Prefetch the next write location
+
+ SHIFT_1 (r7, r6, 16)
+ or r7, r7, r5
+@@ -204,9 +192,7 @@ ENTRY_CFI(memcpy)
+ lpnz @.Lcopy8bytes_3
+ ;; LOOP START
+ ld.ab r6, [r1, 4]
+- prefetch [r1, 28] ;Prefetch the next read location
+ ld.ab r8, [r1,4]
+- prefetchw [r3, 32] ;Prefetch the next write location
+
+ SHIFT_1 (r7, r6, 8)
+ or r7, r7, r5
+diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig
+index 9356753c2ed8..c285a83cbf08 100644
+--- a/arch/arc/plat-hsdk/Kconfig
++++ b/arch/arc/plat-hsdk/Kconfig
+@@ -9,6 +9,7 @@ menuconfig ARC_SOC_HSDK
+ bool "ARC HS Development Kit SOC"
+ depends on ISA_ARCV2
+ select ARC_HAS_ACCL_REGS
++ select ARC_IRQ_NO_AUTOSAVE
+ select CLK_HSDK
+ select RESET_HSDK
+ select MIGHT_HAVE_PCI
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index e8cd55a5b04c..cd4c74daf71e 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1444,6 +1444,7 @@ config NR_CPUS
+ config HOTPLUG_CPU
+ bool "Support for hot-pluggable CPUs"
+ depends on SMP
++ select GENERIC_IRQ_MIGRATION
+ help
+ Say Y here to experiment with turning CPUs off and on. CPUs
+ can be controlled through /sys/devices/system/cpu.
+diff --git a/arch/arm/boot/dts/armada-xp-db.dts b/arch/arm/boot/dts/armada-xp-db.dts
+index f3ac7483afed..5d04dc68cf57 100644
+--- a/arch/arm/boot/dts/armada-xp-db.dts
++++ b/arch/arm/boot/dts/armada-xp-db.dts
+@@ -144,30 +144,32 @@
+ status = "okay";
+ };
+
+- nand@d0000 {
++ nand-controller@d0000 {
+ status = "okay";
+- label = "pxa3xx_nand-0";
+- num-cs = <1>;
+- marvell,nand-keep-config;
+- nand-on-flash-bbt;
+-
+- partitions {
+- compatible = "fixed-partitions";
+- #address-cells = <1>;
+- #size-cells = <1>;
+-
+- partition@0 {
+- label = "U-Boot";
+- reg = <0 0x800000>;
+- };
+- partition@800000 {
+- label = "Linux";
+- reg = <0x800000 0x800000>;
+- };
+- partition@1000000 {
+- label = "Filesystem";
+- reg = <0x1000000 0x3f000000>;
+
++ nand@0 {
++ reg = <0>;
++ label = "pxa3xx_nand-0";
++ nand-rb = <0>;
++ nand-on-flash-bbt;
++
++ partitions {
++ compatible = "fixed-partitions";
++ #address-cells = <1>;
++ #size-cells = <1>;
++
++ partition@0 {
++ label = "U-Boot";
++ reg = <0 0x800000>;
++ };
++ partition@800000 {
++ label = "Linux";
++ reg = <0x800000 0x800000>;
++ };
++ partition@1000000 {
++ label = "Filesystem";
++ reg = <0x1000000 0x3f000000>;
++ };
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/armada-xp-gp.dts b/arch/arm/boot/dts/armada-xp-gp.dts
+index 1139e9469a83..b4cca507cf13 100644
+--- a/arch/arm/boot/dts/armada-xp-gp.dts
++++ b/arch/arm/boot/dts/armada-xp-gp.dts
+@@ -160,12 +160,15 @@
+ status = "okay";
+ };
+
+- nand@d0000 {
++ nand-controller@d0000 {
+ status = "okay";
+- label = "pxa3xx_nand-0";
+- num-cs = <1>;
+- marvell,nand-keep-config;
+- nand-on-flash-bbt;
++
++ nand@0 {
++ reg = <0>;
++ label = "pxa3xx_nand-0";
++ nand-rb = <0>;
++ nand-on-flash-bbt;
++ };
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts b/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts
+index bbbb38888bb8..87dcb502f72d 100644
+--- a/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts
++++ b/arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts
+@@ -81,49 +81,52 @@
+
+ };
+
+- nand@d0000 {
++ nand-controller@d0000 {
+ status = "okay";
+- label = "pxa3xx_nand-0";
+- num-cs = <1>;
+- marvell,nand-keep-config;
+- nand-on-flash-bbt;
+-
+- partitions {
+- compatible = "fixed-partitions";
+- #address-cells = <1>;
+- #size-cells = <1>;
+-
+- partition@0 {
+- label = "u-boot";
+- reg = <0x00000000 0x000e0000>;
+- read-only;
+- };
+-
+- partition@e0000 {
+- label = "u-boot-env";
+- reg = <0x000e0000 0x00020000>;
+- read-only;
+- };
+-
+- partition@100000 {
+- label = "u-boot-env2";
+- reg = <0x00100000 0x00020000>;
+- read-only;
+- };
+-
+- partition@120000 {
+- label = "zImage";
+- reg = <0x00120000 0x00400000>;
+- };
+-
+- partition@520000 {
+- label = "initrd";
+- reg = <0x00520000 0x00400000>;
+- };
+
+- partition@e00000 {
+- label = "boot";
+- reg = <0x00e00000 0x3f200000>;
++ nand@0 {
++ reg = <0>;
++ label = "pxa3xx_nand-0";
++ nand-rb = <0>;
++ nand-on-flash-bbt;
++
++ partitions {
++ compatible = "fixed-partitions";
++ #address-cells = <1>;
++ #size-cells = <1>;
++
++ partition@0 {
++ label = "u-boot";
++ reg = <0x00000000 0x000e0000>;
++ read-only;
++ };
++
++ partition@e0000 {
++ label = "u-boot-env";
++ reg = <0x000e0000 0x00020000>;
++ read-only;
++ };
++
++ partition@100000 {
++ label = "u-boot-env2";
++ reg = <0x00100000 0x00020000>;
++ read-only;
++ };
++
++ partition@120000 {
++ label = "zImage";
++ reg = <0x00120000 0x00400000>;
++ };
++
++ partition@520000 {
++ label = "initrd";
++ reg = <0x00520000 0x00400000>;
++ };
++
++ partition@e00000 {
++ label = "boot";
++ reg = <0x00e00000 0x3f200000>;
++ };
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/omap4-droid4-xt894.dts b/arch/arm/boot/dts/omap4-droid4-xt894.dts
+index 04758a2a87f0..67d77eee9433 100644
+--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts
++++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts
+@@ -644,6 +644,17 @@
+ };
+ };
+
++/* Configure pwm clock source for timers 8 & 9 */
++&timer8 {
++ assigned-clocks = <&abe_clkctrl OMAP4_TIMER8_CLKCTRL 24>;
++ assigned-clock-parents = <&sys_clkin_ck>;
++};
++
++&timer9 {
++ assigned-clocks = <&l4_per_clkctrl OMAP4_TIMER9_CLKCTRL 24>;
++ assigned-clock-parents = <&sys_clkin_ck>;
++};
++
+ /*
+ * As uart1 is wired to mdm6600 with rts and cts, we can use the cts pin for
+ * uart1 wakeirq.
+diff --git a/arch/arm/boot/dts/tegra124-nyan.dtsi b/arch/arm/boot/dts/tegra124-nyan.dtsi
+index d5f11d6d987e..bc85b6a166c7 100644
+--- a/arch/arm/boot/dts/tegra124-nyan.dtsi
++++ b/arch/arm/boot/dts/tegra124-nyan.dtsi
+@@ -13,10 +13,25 @@
+ stdout-path = "serial0:115200n8";
+ };
+
+- memory@80000000 {
++ /*
++ * Note that recent version of the device tree compiler (starting with
++ * version 1.4.2) warn about this node containing a reg property, but
++ * missing a unit-address. However, the bootloader on these Chromebook
++ * devices relies on the full name of this node to be exactly /memory.
++ * Adding the unit-address causes the bootloader to create a /memory
++ * node and write the memory bank configuration to that node, which in
++ * turn leads the kernel to believe that the device has 2 GiB of
++ * memory instead of the amount detected by the bootloader.
++ *
++ * The name of this node is effectively ABI and must not be changed.
++ */
++ memory {
++ device_type = "memory";
+ reg = <0x0 0x80000000 0x0 0x80000000>;
+ };
+
++ /delete-node/ memory@80000000;
++
+ host1x@50000000 {
+ hdmi@54280000 {
+ status = "okay";
+diff --git a/arch/arm/crypto/crct10dif-ce-core.S b/arch/arm/crypto/crct10dif-ce-core.S
+index ce45ba0c0687..16019b5961e7 100644
+--- a/arch/arm/crypto/crct10dif-ce-core.S
++++ b/arch/arm/crypto/crct10dif-ce-core.S
+@@ -124,10 +124,10 @@ ENTRY(crc_t10dif_pmull)
+ vext.8 q10, qzr, q0, #4
+
+ // receive the initial 64B data, xor the initial crc value
+- vld1.64 {q0-q1}, [arg2, :128]!
+- vld1.64 {q2-q3}, [arg2, :128]!
+- vld1.64 {q4-q5}, [arg2, :128]!
+- vld1.64 {q6-q7}, [arg2, :128]!
++ vld1.64 {q0-q1}, [arg2]!
++ vld1.64 {q2-q3}, [arg2]!
++ vld1.64 {q4-q5}, [arg2]!
++ vld1.64 {q6-q7}, [arg2]!
+ CPU_LE( vrev64.8 q0, q0 )
+ CPU_LE( vrev64.8 q1, q1 )
+ CPU_LE( vrev64.8 q2, q2 )
+@@ -167,7 +167,7 @@ CPU_LE( vrev64.8 q7, q7 )
+ _fold_64_B_loop:
+
+ .macro fold64, reg1, reg2
+- vld1.64 {q11-q12}, [arg2, :128]!
++ vld1.64 {q11-q12}, [arg2]!
+
+ vmull.p64 q8, \reg1\()h, d21
+ vmull.p64 \reg1, \reg1\()l, d20
+@@ -238,7 +238,7 @@ _16B_reduction_loop:
+ vmull.p64 q7, d15, d21
+ veor.8 q7, q7, q8
+
+- vld1.64 {q0}, [arg2, :128]!
++ vld1.64 {q0}, [arg2]!
+ CPU_LE( vrev64.8 q0, q0 )
+ vswp d0, d1
+ veor.8 q7, q7, q0
+@@ -335,7 +335,7 @@ _less_than_128:
+ vmov.i8 q0, #0
+ vmov s3, arg1_low32 // get the initial crc value
+
+- vld1.64 {q7}, [arg2, :128]!
++ vld1.64 {q7}, [arg2]!
+ CPU_LE( vrev64.8 q7, q7 )
+ vswp d14, d15
+ veor.8 q7, q7, q0
+diff --git a/arch/arm/crypto/crct10dif-ce-glue.c b/arch/arm/crypto/crct10dif-ce-glue.c
+index d428355cf38d..14c19c70a841 100644
+--- a/arch/arm/crypto/crct10dif-ce-glue.c
++++ b/arch/arm/crypto/crct10dif-ce-glue.c
+@@ -35,26 +35,15 @@ static int crct10dif_update(struct shash_desc *desc, const u8 *data,
+ unsigned int length)
+ {
+ u16 *crc = shash_desc_ctx(desc);
+- unsigned int l;
+
+- if (!may_use_simd()) {
+- *crc = crc_t10dif_generic(*crc, data, length);
++ if (length >= CRC_T10DIF_PMULL_CHUNK_SIZE && may_use_simd()) {
++ kernel_neon_begin();
++ *crc = crc_t10dif_pmull(*crc, data, length);
++ kernel_neon_end();
+ } else {
+- if (unlikely((u32)data % CRC_T10DIF_PMULL_CHUNK_SIZE)) {
+- l = min_t(u32, length, CRC_T10DIF_PMULL_CHUNK_SIZE -
+- ((u32)data % CRC_T10DIF_PMULL_CHUNK_SIZE));
+-
+- *crc = crc_t10dif_generic(*crc, data, l);
+-
+- length -= l;
+- data += l;
+- }
+- if (length > 0) {
+- kernel_neon_begin();
+- *crc = crc_t10dif_pmull(*crc, data, length);
+- kernel_neon_end();
+- }
++ *crc = crc_t10dif_generic(*crc, data, length);
+ }
++
+ return 0;
+ }
+
+diff --git a/arch/arm/include/asm/irq.h b/arch/arm/include/asm/irq.h
+index c883fcbe93b6..46d41140df27 100644
+--- a/arch/arm/include/asm/irq.h
++++ b/arch/arm/include/asm/irq.h
+@@ -25,7 +25,6 @@
+ #ifndef __ASSEMBLY__
+ struct irqaction;
+ struct pt_regs;
+-extern void migrate_irqs(void);
+
+ extern void asm_do_IRQ(unsigned int, struct pt_regs *);
+ void handle_IRQ(unsigned int, struct pt_regs *);
+diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
+index 3ad482d2f1eb..d0d0227fc70d 100644
+--- a/arch/arm/include/asm/kvm_host.h
++++ b/arch/arm/include/asm/kvm_host.h
+@@ -48,6 +48,7 @@
+ #define KVM_REQ_SLEEP \
+ KVM_ARCH_REQ_FLAGS(0, KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)
+ #define KVM_REQ_IRQ_PENDING KVM_ARCH_REQ(1)
++#define KVM_REQ_VCPU_RESET KVM_ARCH_REQ(2)
+
+ DECLARE_STATIC_KEY_FALSE(userspace_irqchip_in_use);
+
+@@ -147,6 +148,13 @@ struct kvm_cpu_context {
+
+ typedef struct kvm_cpu_context kvm_cpu_context_t;
+
++struct vcpu_reset_state {
++ unsigned long pc;
++ unsigned long r0;
++ bool be;
++ bool reset;
++};
++
+ struct kvm_vcpu_arch {
+ struct kvm_cpu_context ctxt;
+
+@@ -186,6 +194,8 @@ struct kvm_vcpu_arch {
+ /* Cache some mmu pages needed inside spinlock regions */
+ struct kvm_mmu_memory_cache mmu_page_cache;
+
++ struct vcpu_reset_state reset_state;
++
+ /* Detect first run of a vcpu */
+ bool has_run_once;
+ };
+diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
+index 9908dacf9229..844861368cd5 100644
+--- a/arch/arm/kernel/irq.c
++++ b/arch/arm/kernel/irq.c
+@@ -31,7 +31,6 @@
+ #include <linux/smp.h>
+ #include <linux/init.h>
+ #include <linux/seq_file.h>
+-#include <linux/ratelimit.h>
+ #include <linux/errno.h>
+ #include <linux/list.h>
+ #include <linux/kallsyms.h>
+@@ -109,64 +108,3 @@ int __init arch_probe_nr_irqs(void)
+ return nr_irqs;
+ }
+ #endif
+-
+-#ifdef CONFIG_HOTPLUG_CPU
+-static bool migrate_one_irq(struct irq_desc *desc)
+-{
+- struct irq_data *d = irq_desc_get_irq_data(desc);
+- const struct cpumask *affinity = irq_data_get_affinity_mask(d);
+- struct irq_chip *c;
+- bool ret = false;
+-
+- /*
+- * If this is a per-CPU interrupt, or the affinity does not
+- * include this CPU, then we have nothing to do.
+- */
+- if (irqd_is_per_cpu(d) || !cpumask_test_cpu(smp_processor_id(), affinity))
+- return false;
+-
+- if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids) {
+- affinity = cpu_online_mask;
+- ret = true;
+- }
+-
+- c = irq_data_get_irq_chip(d);
+- if (!c->irq_set_affinity)
+- pr_debug("IRQ%u: unable to set affinity\n", d->irq);
+- else if (c->irq_set_affinity(d, affinity, false) == IRQ_SET_MASK_OK && ret)
+- cpumask_copy(irq_data_get_affinity_mask(d), affinity);
+-
+- return ret;
+-}
+-
+-/*
+- * The current CPU has been marked offline. Migrate IRQs off this CPU.
+- * If the affinity settings do not allow other CPUs, force them onto any
+- * available CPU.
+- *
+- * Note: we must iterate over all IRQs, whether they have an attached
+- * action structure or not, as we need to get chained interrupts too.
+- */
+-void migrate_irqs(void)
+-{
+- unsigned int i;
+- struct irq_desc *desc;
+- unsigned long flags;
+-
+- local_irq_save(flags);
+-
+- for_each_irq_desc(i, desc) {
+- bool affinity_broken;
+-
+- raw_spin_lock(&desc->lock);
+- affinity_broken = migrate_one_irq(desc);
+- raw_spin_unlock(&desc->lock);
+-
+- if (affinity_broken)
+- pr_warn_ratelimited("IRQ%u no longer affine to CPU%u\n",
+- i, smp_processor_id());
+- }
+-
+- local_irq_restore(flags);
+-}
+-#endif /* CONFIG_HOTPLUG_CPU */
+diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
+index 3bf82232b1be..1d6f5ea522f4 100644
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -254,7 +254,7 @@ int __cpu_disable(void)
+ /*
+ * OK - migrate IRQs away from this CPU
+ */
+- migrate_irqs();
++ irq_migrate_all_off_this_cpu();
+
+ /*
+ * Flush user cache and TLB mappings, and then remove this CPU
+diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
+index cb094e55dc5f..fd6cde23bb5d 100644
+--- a/arch/arm/kvm/coproc.c
++++ b/arch/arm/kvm/coproc.c
+@@ -1450,6 +1450,6 @@ void kvm_reset_coprocs(struct kvm_vcpu *vcpu)
+ reset_coproc_regs(vcpu, table, num);
+
+ for (num = 1; num < NR_CP15_REGS; num++)
+- if (vcpu_cp15(vcpu, num) == 0x42424242)
+- panic("Didn't reset vcpu_cp15(vcpu, %zi)", num);
++ WARN(vcpu_cp15(vcpu, num) == 0x42424242,
++ "Didn't reset vcpu_cp15(vcpu, %zi)", num);
+ }
+diff --git a/arch/arm/kvm/reset.c b/arch/arm/kvm/reset.c
+index 5ed0c3ee33d6..e53327912adc 100644
+--- a/arch/arm/kvm/reset.c
++++ b/arch/arm/kvm/reset.c
+@@ -26,6 +26,7 @@
+ #include <asm/cputype.h>
+ #include <asm/kvm_arm.h>
+ #include <asm/kvm_coproc.h>
++#include <asm/kvm_emulate.h>
+
+ #include <kvm/arm_arch_timer.h>
+
+@@ -69,6 +70,29 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
+ /* Reset CP15 registers */
+ kvm_reset_coprocs(vcpu);
+
++ /*
++ * Additional reset state handling that PSCI may have imposed on us.
++ * Must be done after all the sys_reg reset.
++ */
++ if (READ_ONCE(vcpu->arch.reset_state.reset)) {
++ unsigned long target_pc = vcpu->arch.reset_state.pc;
++
++ /* Gracefully handle Thumb2 entry point */
++ if (target_pc & 1) {
++ target_pc &= ~1UL;
++ vcpu_set_thumb(vcpu);
++ }
++
++ /* Propagate caller endianness */
++ if (vcpu->arch.reset_state.be)
++ kvm_vcpu_set_be(vcpu);
++
++ *vcpu_pc(vcpu) = target_pc;
++ vcpu_set_reg(vcpu, 0, vcpu->arch.reset_state.r0);
++
++ vcpu->arch.reset_state.reset = false;
++ }
++
+ /* Reset arch_timer context */
+ return kvm_timer_vcpu_reset(vcpu);
+ }
+diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
+index a8b291f00109..dae514c8276a 100644
+--- a/arch/arm/mach-omap2/cpuidle44xx.c
++++ b/arch/arm/mach-omap2/cpuidle44xx.c
+@@ -152,6 +152,10 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+ mpuss_can_lose_context = (cx->mpu_state == PWRDM_POWER_RET) &&
+ (cx->mpu_logic_state == PWRDM_POWER_OFF);
+
++ /* Enter broadcast mode for periodic timers */
++ tick_broadcast_enable();
++
++ /* Enter broadcast mode for one-shot timers */
+ tick_broadcast_enter();
+
+ /*
+@@ -218,15 +222,6 @@ fail:
+ return index;
+ }
+
+-/*
+- * For each cpu, setup the broadcast timer because local timers
+- * stops for the states above C1.
+- */
+-static void omap_setup_broadcast_timer(void *arg)
+-{
+- tick_broadcast_enable();
+-}
+-
+ static struct cpuidle_driver omap4_idle_driver = {
+ .name = "omap4_idle",
+ .owner = THIS_MODULE,
+@@ -319,8 +314,5 @@ int __init omap4_idle_init(void)
+ if (!cpu_clkdm[0] || !cpu_clkdm[1])
+ return -ENODEV;
+
+- /* Configure the broadcast timer on each cpu */
+- on_each_cpu(omap_setup_broadcast_timer, NULL, 1);
+-
+ return cpuidle_register(idle_driver, cpu_online_mask);
+ }
+diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
+index 9500b6e27380..5d73f2c0b117 100644
+--- a/arch/arm/mach-omap2/display.c
++++ b/arch/arm/mach-omap2/display.c
+@@ -83,6 +83,7 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes)
+ u32 enable_mask, enable_shift;
+ u32 pipd_mask, pipd_shift;
+ u32 reg;
++ int ret;
+
+ if (dsi_id == 0) {
+ enable_mask = OMAP4_DSI1_LANEENABLE_MASK;
+@@ -98,7 +99,11 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes)
+ return -ENODEV;
+ }
+
+- regmap_read(omap4_dsi_mux_syscon, OMAP4_DSIPHY_SYSCON_OFFSET, ®);
++ ret = regmap_read(omap4_dsi_mux_syscon,
++ OMAP4_DSIPHY_SYSCON_OFFSET,
++ ®);
++ if (ret)
++ return ret;
+
+ reg &= ~enable_mask;
+ reg &= ~pipd_mask;
+diff --git a/arch/arm/mach-s3c24xx/mach-osiris-dvs.c b/arch/arm/mach-s3c24xx/mach-osiris-dvs.c
+index 058ce73137e8..5d819b6ea428 100644
+--- a/arch/arm/mach-s3c24xx/mach-osiris-dvs.c
++++ b/arch/arm/mach-s3c24xx/mach-osiris-dvs.c
+@@ -65,16 +65,16 @@ static int osiris_dvs_notify(struct notifier_block *nb,
+
+ switch (val) {
+ case CPUFREQ_PRECHANGE:
+- if (old_dvs & !new_dvs ||
+- cur_dvs & !new_dvs) {
++ if ((old_dvs && !new_dvs) ||
++ (cur_dvs && !new_dvs)) {
+ pr_debug("%s: exiting dvs\n", __func__);
+ cur_dvs = false;
+ gpio_set_value(OSIRIS_GPIO_DVS, 1);
+ }
+ break;
+ case CPUFREQ_POSTCHANGE:
+- if (!old_dvs & new_dvs ||
+- !cur_dvs & new_dvs) {
++ if ((!old_dvs && new_dvs) ||
++ (!cur_dvs && new_dvs)) {
+ pr_debug("entering dvs\n");
+ cur_dvs = true;
+ gpio_set_value(OSIRIS_GPIO_DVS, 0);
+diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
+index 1cb9c0f9b5d6..8211cf45ece1 100644
+--- a/arch/arm/mm/dma-mapping.c
++++ b/arch/arm/mm/dma-mapping.c
+@@ -2400,4 +2400,6 @@ void arch_teardown_dma_ops(struct device *dev)
+ return;
+
+ arm_teardown_iommu_dma_ops(dev);
++ /* Let arch_setup_dma_ops() start again from scratch upon re-probe */
++ set_dma_ops(dev, NULL);
+ }
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts
+index 1ee0dc0d9f10..d1cf404b8708 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts
+@@ -22,7 +22,7 @@
+ backlight = <&backlight>;
+ power-supply = <&pp3300_disp>;
+
+- ports {
++ port {
+ panel_in_edp: endpoint {
+ remote-endpoint = <&edp_out_panel>;
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
+index 2cc7c47d6a85..65637a5a4b21 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
+@@ -43,7 +43,7 @@
+ backlight = <&backlight>;
+ power-supply = <&pp3300_disp>;
+
+- ports {
++ port {
+ panel_in_edp: endpoint {
+ remote-endpoint = <&edp_out_panel>;
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
+index fef2c0608999..b14d83919f14 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
+@@ -50,7 +50,7 @@
+ pinctrl-0 = <&lcd_panel_reset>;
+ power-supply = <&vcc3v3_s0>;
+
+- ports {
++ port {
+ panel_in_edp: endpoint {
+ remote-endpoint = <&edp_out_panel>;
+ };
+diff --git a/arch/arm64/crypto/aes-ce-ccm-core.S b/arch/arm64/crypto/aes-ce-ccm-core.S
+index e3a375c4cb83..1b151442dac1 100644
+--- a/arch/arm64/crypto/aes-ce-ccm-core.S
++++ b/arch/arm64/crypto/aes-ce-ccm-core.S
+@@ -74,12 +74,13 @@ ENTRY(ce_aes_ccm_auth_data)
+ beq 10f
+ ext v0.16b, v0.16b, v0.16b, #1 /* rotate out the mac bytes */
+ b 7b
+-8: mov w7, w8
++8: cbz w8, 91f
++ mov w7, w8
+ add w8, w8, #16
+ 9: ext v1.16b, v1.16b, v1.16b, #1
+ adds w7, w7, #1
+ bne 9b
+- eor v0.16b, v0.16b, v1.16b
++91: eor v0.16b, v0.16b, v1.16b
+ st1 {v0.16b}, [x0]
+ 10: str w8, [x3]
+ ret
+diff --git a/arch/arm64/crypto/aes-ce-ccm-glue.c b/arch/arm64/crypto/aes-ce-ccm-glue.c
+index 68b11aa690e4..986191e8c058 100644
+--- a/arch/arm64/crypto/aes-ce-ccm-glue.c
++++ b/arch/arm64/crypto/aes-ce-ccm-glue.c
+@@ -125,7 +125,7 @@ static void ccm_update_mac(struct crypto_aes_ctx *key, u8 mac[], u8 const in[],
+ abytes -= added;
+ }
+
+- while (abytes > AES_BLOCK_SIZE) {
++ while (abytes >= AES_BLOCK_SIZE) {
+ __aes_arm64_encrypt(key->key_enc, mac, mac,
+ num_rounds(key));
+ crypto_xor(mac, in, AES_BLOCK_SIZE);
+@@ -139,8 +139,6 @@ static void ccm_update_mac(struct crypto_aes_ctx *key, u8 mac[], u8 const in[],
+ num_rounds(key));
+ crypto_xor(mac, in, abytes);
+ *macp = abytes;
+- } else {
+- *macp = 0;
+ }
+ }
+ }
+diff --git a/arch/arm64/crypto/aes-neonbs-core.S b/arch/arm64/crypto/aes-neonbs-core.S
+index e613a87f8b53..8432c8d0dea6 100644
+--- a/arch/arm64/crypto/aes-neonbs-core.S
++++ b/arch/arm64/crypto/aes-neonbs-core.S
+@@ -971,18 +971,22 @@ CPU_LE( rev x8, x8 )
+
+ 8: next_ctr v0
+ st1 {v0.16b}, [x24]
+- cbz x23, 0f
++ cbz x23, .Lctr_done
+
+ cond_yield_neon 98b
+ b 99b
+
+-0: frame_pop
++.Lctr_done:
++ frame_pop
+ ret
+
+ /*
+ * If we are handling the tail of the input (x6 != NULL), return the
+ * final keystream block back to the caller.
+ */
++0: cbz x25, 8b
++ st1 {v0.16b}, [x25]
++ b 8b
+ 1: cbz x25, 8b
+ st1 {v1.16b}, [x25]
+ b 8b
+diff --git a/arch/arm64/crypto/crct10dif-ce-glue.c b/arch/arm64/crypto/crct10dif-ce-glue.c
+index 96f0cae4a022..617bcfc1b080 100644
+--- a/arch/arm64/crypto/crct10dif-ce-glue.c
++++ b/arch/arm64/crypto/crct10dif-ce-glue.c
+@@ -36,26 +36,13 @@ static int crct10dif_update(struct shash_desc *desc, const u8 *data,
+ unsigned int length)
+ {
+ u16 *crc = shash_desc_ctx(desc);
+- unsigned int l;
+
+- if (unlikely((u64)data % CRC_T10DIF_PMULL_CHUNK_SIZE)) {
+- l = min_t(u32, length, CRC_T10DIF_PMULL_CHUNK_SIZE -
+- ((u64)data % CRC_T10DIF_PMULL_CHUNK_SIZE));
+-
+- *crc = crc_t10dif_generic(*crc, data, l);
+-
+- length -= l;
+- data += l;
+- }
+-
+- if (length > 0) {
+- if (may_use_simd()) {
+- kernel_neon_begin();
+- *crc = crc_t10dif_pmull(*crc, data, length);
+- kernel_neon_end();
+- } else {
+- *crc = crc_t10dif_generic(*crc, data, length);
+- }
++ if (length >= CRC_T10DIF_PMULL_CHUNK_SIZE && may_use_simd()) {
++ kernel_neon_begin();
++ *crc = crc_t10dif_pmull(*crc, data, length);
++ kernel_neon_end();
++ } else {
++ *crc = crc_t10dif_generic(*crc, data, length);
+ }
+
+ return 0;
+diff --git a/arch/arm64/include/asm/hardirq.h b/arch/arm64/include/asm/hardirq.h
+index 1473fc2f7ab7..89691c86640a 100644
+--- a/arch/arm64/include/asm/hardirq.h
++++ b/arch/arm64/include/asm/hardirq.h
+@@ -17,8 +17,12 @@
+ #define __ASM_HARDIRQ_H
+
+ #include <linux/cache.h>
++#include <linux/percpu.h>
+ #include <linux/threads.h>
++#include <asm/barrier.h>
+ #include <asm/irq.h>
++#include <asm/kvm_arm.h>
++#include <asm/sysreg.h>
+
+ #define NR_IPI 7
+
+@@ -37,6 +41,33 @@ u64 smp_irq_stat_cpu(unsigned int cpu);
+
+ #define __ARCH_IRQ_EXIT_IRQS_DISABLED 1
+
++struct nmi_ctx {
++ u64 hcr;
++};
++
++DECLARE_PER_CPU(struct nmi_ctx, nmi_contexts);
++
++#define arch_nmi_enter() \
++ do { \
++ if (is_kernel_in_hyp_mode()) { \
++ struct nmi_ctx *nmi_ctx = this_cpu_ptr(&nmi_contexts); \
++ nmi_ctx->hcr = read_sysreg(hcr_el2); \
++ if (!(nmi_ctx->hcr & HCR_TGE)) { \
++ write_sysreg(nmi_ctx->hcr | HCR_TGE, hcr_el2); \
++ isb(); \
++ } \
++ } \
++ } while (0)
++
++#define arch_nmi_exit() \
++ do { \
++ if (is_kernel_in_hyp_mode()) { \
++ struct nmi_ctx *nmi_ctx = this_cpu_ptr(&nmi_contexts); \
++ if (!(nmi_ctx->hcr & HCR_TGE)) \
++ write_sysreg(nmi_ctx->hcr, hcr_el2); \
++ } \
++ } while (0)
++
+ static inline void ack_bad_irq(unsigned int irq)
+ {
+ extern unsigned long irq_err_count;
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index 3d6d7336f871..6abe4002945f 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -48,6 +48,7 @@
+ #define KVM_REQ_SLEEP \
+ KVM_ARCH_REQ_FLAGS(0, KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)
+ #define KVM_REQ_IRQ_PENDING KVM_ARCH_REQ(1)
++#define KVM_REQ_VCPU_RESET KVM_ARCH_REQ(2)
+
+ DECLARE_STATIC_KEY_FALSE(userspace_irqchip_in_use);
+
+@@ -206,6 +207,13 @@ struct kvm_cpu_context {
+
+ typedef struct kvm_cpu_context kvm_cpu_context_t;
+
++struct vcpu_reset_state {
++ unsigned long pc;
++ unsigned long r0;
++ bool be;
++ bool reset;
++};
++
+ struct kvm_vcpu_arch {
+ struct kvm_cpu_context ctxt;
+
+@@ -295,6 +303,9 @@ struct kvm_vcpu_arch {
+ /* Virtual SError ESR to restore when HCR_EL2.VSE is set */
+ u64 vsesr_el2;
+
++ /* Additional reset state */
++ struct vcpu_reset_state reset_state;
++
+ /* True when deferrable sysregs are loaded on the physical CPU,
+ * see kvm_vcpu_load_sysregs and kvm_vcpu_put_sysregs. */
+ bool sysregs_loaded_on_cpu;
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index 651a06b1980f..77ca59598c8b 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -522,8 +522,7 @@ set_hcr:
+ /* GICv3 system register access */
+ mrs x0, id_aa64pfr0_el1
+ ubfx x0, x0, #24, #4
+- cmp x0, #1
+- b.ne 3f
++ cbz x0, 3f
+
+ mrs_s x0, SYS_ICC_SRE_EL2
+ orr x0, x0, #ICC_SRE_EL2_SRE // Set ICC_SRE_EL2.SRE==1
+diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c
+index 780a12f59a8f..92fa81798fb9 100644
+--- a/arch/arm64/kernel/irq.c
++++ b/arch/arm64/kernel/irq.c
+@@ -33,6 +33,9 @@
+
+ unsigned long irq_err_count;
+
++/* Only access this in an NMI enter/exit */
++DEFINE_PER_CPU(struct nmi_ctx, nmi_contexts);
++
+ DEFINE_PER_CPU(unsigned long *, irq_stack_ptr);
+
+ int arch_show_interrupts(struct seq_file *p, int prec)
+diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
+index a20de58061a8..35f184a8fd85 100644
+--- a/arch/arm64/kernel/kgdb.c
++++ b/arch/arm64/kernel/kgdb.c
+@@ -244,27 +244,33 @@ int kgdb_arch_handle_exception(int exception_vector, int signo,
+
+ static int kgdb_brk_fn(struct pt_regs *regs, unsigned int esr)
+ {
++ if (user_mode(regs))
++ return DBG_HOOK_ERROR;
++
+ kgdb_handle_exception(1, SIGTRAP, 0, regs);
+- return 0;
++ return DBG_HOOK_HANDLED;
+ }
+ NOKPROBE_SYMBOL(kgdb_brk_fn)
+
+ static int kgdb_compiled_brk_fn(struct pt_regs *regs, unsigned int esr)
+ {
++ if (user_mode(regs))
++ return DBG_HOOK_ERROR;
++
+ compiled_break = 1;
+ kgdb_handle_exception(1, SIGTRAP, 0, regs);
+
+- return 0;
++ return DBG_HOOK_HANDLED;
+ }
+ NOKPROBE_SYMBOL(kgdb_compiled_brk_fn);
+
+ static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr)
+ {
+- if (!kgdb_single_step)
++ if (user_mode(regs) || !kgdb_single_step)
+ return DBG_HOOK_ERROR;
+
+ kgdb_handle_exception(1, SIGTRAP, 0, regs);
+- return 0;
++ return DBG_HOOK_HANDLED;
+ }
+ NOKPROBE_SYMBOL(kgdb_step_brk_fn);
+
+diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
+index 30bb13797034..2d63df112b89 100644
+--- a/arch/arm64/kernel/probes/kprobes.c
++++ b/arch/arm64/kernel/probes/kprobes.c
+@@ -450,6 +450,9 @@ kprobe_single_step_handler(struct pt_regs *regs, unsigned int esr)
+ struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+ int retval;
+
++ if (user_mode(regs))
++ return DBG_HOOK_ERROR;
++
+ /* return error if this is not our step */
+ retval = kprobe_ss_hit(kcb, instruction_pointer(regs));
+
+@@ -466,6 +469,9 @@ kprobe_single_step_handler(struct pt_regs *regs, unsigned int esr)
+ int __kprobes
+ kprobe_breakpoint_handler(struct pt_regs *regs, unsigned int esr)
+ {
++ if (user_mode(regs))
++ return DBG_HOOK_ERROR;
++
+ kprobe_handler(regs);
+ return DBG_HOOK_HANDLED;
+ }
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index a1c32c1f2267..6290a4e81d57 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -23,6 +23,7 @@
+ #include <kvm/arm_psci.h>
+
+ #include <asm/cpufeature.h>
++#include <asm/kprobes.h>
+ #include <asm/kvm_asm.h>
+ #include <asm/kvm_emulate.h>
+ #include <asm/kvm_host.h>
+@@ -107,6 +108,7 @@ static void activate_traps_vhe(struct kvm_vcpu *vcpu)
+
+ write_sysreg(kvm_get_hyp_vector(), vbar_el1);
+ }
++NOKPROBE_SYMBOL(activate_traps_vhe);
+
+ static void __hyp_text __activate_traps_nvhe(struct kvm_vcpu *vcpu)
+ {
+@@ -146,6 +148,7 @@ static void deactivate_traps_vhe(void)
+ write_sysreg(CPACR_EL1_DEFAULT, cpacr_el1);
+ write_sysreg(vectors, vbar_el1);
+ }
++NOKPROBE_SYMBOL(deactivate_traps_vhe);
+
+ static void __hyp_text __deactivate_traps_nvhe(void)
+ {
+@@ -529,6 +532,7 @@ int kvm_vcpu_run_vhe(struct kvm_vcpu *vcpu)
+
+ return exit_code;
+ }
++NOKPROBE_SYMBOL(kvm_vcpu_run_vhe);
+
+ /* Switch to the guest for legacy non-VHE systems */
+ int __hyp_text __kvm_vcpu_run_nvhe(struct kvm_vcpu *vcpu)
+@@ -636,6 +640,7 @@ static void __hyp_call_panic_vhe(u64 spsr, u64 elr, u64 par,
+ read_sysreg_el2(esr), read_sysreg_el2(far),
+ read_sysreg(hpfar_el2), par, vcpu);
+ }
++NOKPROBE_SYMBOL(__hyp_call_panic_vhe);
+
+ void __hyp_text __noreturn hyp_panic(struct kvm_cpu_context *host_ctxt)
+ {
+diff --git a/arch/arm64/kvm/hyp/sysreg-sr.c b/arch/arm64/kvm/hyp/sysreg-sr.c
+index 9ce223944983..963d669ae3a2 100644
+--- a/arch/arm64/kvm/hyp/sysreg-sr.c
++++ b/arch/arm64/kvm/hyp/sysreg-sr.c
+@@ -18,6 +18,7 @@
+ #include <linux/compiler.h>
+ #include <linux/kvm_host.h>
+
++#include <asm/kprobes.h>
+ #include <asm/kvm_asm.h>
+ #include <asm/kvm_emulate.h>
+ #include <asm/kvm_hyp.h>
+@@ -98,12 +99,14 @@ void sysreg_save_host_state_vhe(struct kvm_cpu_context *ctxt)
+ {
+ __sysreg_save_common_state(ctxt);
+ }
++NOKPROBE_SYMBOL(sysreg_save_host_state_vhe);
+
+ void sysreg_save_guest_state_vhe(struct kvm_cpu_context *ctxt)
+ {
+ __sysreg_save_common_state(ctxt);
+ __sysreg_save_el2_return_state(ctxt);
+ }
++NOKPROBE_SYMBOL(sysreg_save_guest_state_vhe);
+
+ static void __hyp_text __sysreg_restore_common_state(struct kvm_cpu_context *ctxt)
+ {
+@@ -171,12 +174,14 @@ void sysreg_restore_host_state_vhe(struct kvm_cpu_context *ctxt)
+ {
+ __sysreg_restore_common_state(ctxt);
+ }
++NOKPROBE_SYMBOL(sysreg_restore_host_state_vhe);
+
+ void sysreg_restore_guest_state_vhe(struct kvm_cpu_context *ctxt)
+ {
+ __sysreg_restore_common_state(ctxt);
+ __sysreg_restore_el2_return_state(ctxt);
+ }
++NOKPROBE_SYMBOL(sysreg_restore_guest_state_vhe);
+
+ void __hyp_text __sysreg32_save_state(struct kvm_vcpu *vcpu)
+ {
+diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
+index e37c78bbe1ca..18b9a522a2b3 100644
+--- a/arch/arm64/kvm/reset.c
++++ b/arch/arm64/kvm/reset.c
+@@ -31,6 +31,7 @@
+ #include <asm/kvm_arm.h>
+ #include <asm/kvm_asm.h>
+ #include <asm/kvm_coproc.h>
++#include <asm/kvm_emulate.h>
+ #include <asm/kvm_mmu.h>
+
+ /*
+@@ -99,16 +100,33 @@ int kvm_arch_dev_ioctl_check_extension(struct kvm *kvm, long ext)
+ * This function finds the right table above and sets the registers on
+ * the virtual CPU struct to their architecturally defined reset
+ * values.
++ *
++ * Note: This function can be called from two paths: The KVM_ARM_VCPU_INIT
++ * ioctl or as part of handling a request issued by another VCPU in the PSCI
++ * handling code. In the first case, the VCPU will not be loaded, and in the
++ * second case the VCPU will be loaded. Because this function operates purely
++ * on the memory-backed valus of system registers, we want to do a full put if
++ * we were loaded (handling a request) and load the values back at the end of
++ * the function. Otherwise we leave the state alone. In both cases, we
++ * disable preemption around the vcpu reset as we would otherwise race with
++ * preempt notifiers which also call put/load.
+ */
+ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
+ {
+ const struct kvm_regs *cpu_reset;
++ int ret = -EINVAL;
++ bool loaded;
++
++ preempt_disable();
++ loaded = (vcpu->cpu != -1);
++ if (loaded)
++ kvm_arch_vcpu_put(vcpu);
+
+ switch (vcpu->arch.target) {
+ default:
+ if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features)) {
+ if (!cpu_has_32bit_el1())
+- return -EINVAL;
++ goto out;
+ cpu_reset = &default_regs_reset32;
+ } else {
+ cpu_reset = &default_regs_reset;
+@@ -123,6 +141,29 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
+ /* Reset system registers */
+ kvm_reset_sys_regs(vcpu);
+
++ /*
++ * Additional reset state handling that PSCI may have imposed on us.
++ * Must be done after all the sys_reg reset.
++ */
++ if (vcpu->arch.reset_state.reset) {
++ unsigned long target_pc = vcpu->arch.reset_state.pc;
++
++ /* Gracefully handle Thumb2 entry point */
++ if (vcpu_mode_is_32bit(vcpu) && (target_pc & 1)) {
++ target_pc &= ~1UL;
++ vcpu_set_thumb(vcpu);
++ }
++
++ /* Propagate caller endianness */
++ if (vcpu->arch.reset_state.be)
++ kvm_vcpu_set_be(vcpu);
++
++ *vcpu_pc(vcpu) = target_pc;
++ vcpu_set_reg(vcpu, 0, vcpu->arch.reset_state.r0);
++
++ vcpu->arch.reset_state.reset = false;
++ }
++
+ /* Reset PMU */
+ kvm_pmu_vcpu_reset(vcpu);
+
+@@ -131,5 +172,10 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
+ vcpu->arch.workaround_flags |= VCPU_WORKAROUND_2_FLAG;
+
+ /* Reset timer */
+- return kvm_timer_vcpu_reset(vcpu);
++ ret = kvm_timer_vcpu_reset(vcpu);
++out:
++ if (loaded)
++ kvm_arch_vcpu_load(vcpu, smp_processor_id());
++ preempt_enable();
++ return ret;
+ }
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+index 22fbbdbece3c..d112af75680b 100644
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -1456,7 +1456,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
+
+ { SYS_DESC(SYS_DACR32_EL2), NULL, reset_unknown, DACR32_EL2 },
+ { SYS_DESC(SYS_IFSR32_EL2), NULL, reset_unknown, IFSR32_EL2 },
+- { SYS_DESC(SYS_FPEXC32_EL2), NULL, reset_val, FPEXC32_EL2, 0x70 },
++ { SYS_DESC(SYS_FPEXC32_EL2), NULL, reset_val, FPEXC32_EL2, 0x700 },
+ };
+
+ static bool trap_dbgidr(struct kvm_vcpu *vcpu,
+@@ -2586,7 +2586,9 @@ void kvm_reset_sys_regs(struct kvm_vcpu *vcpu)
+ table = get_target_table(vcpu->arch.target, true, &num);
+ reset_sys_reg_descs(vcpu, table, num);
+
+- for (num = 1; num < NR_SYS_REGS; num++)
+- if (__vcpu_sys_reg(vcpu, num) == 0x4242424242424242)
+- panic("Didn't reset __vcpu_sys_reg(%zi)", num);
++ for (num = 1; num < NR_SYS_REGS; num++) {
++ if (WARN(__vcpu_sys_reg(vcpu, num) == 0x4242424242424242,
++ "Didn't reset __vcpu_sys_reg(%zi)\n", num))
++ break;
++ }
+ }
+diff --git a/arch/m68k/Makefile b/arch/m68k/Makefile
+index 997c9f20ea0f..4474e51ee53e 100644
+--- a/arch/m68k/Makefile
++++ b/arch/m68k/Makefile
+@@ -58,7 +58,10 @@ cpuflags-$(CONFIG_M5206e) := $(call cc-option,-mcpu=5206e,-m5200)
+ cpuflags-$(CONFIG_M5206) := $(call cc-option,-mcpu=5206,-m5200)
+
+ KBUILD_AFLAGS += $(cpuflags-y)
+-KBUILD_CFLAGS += $(cpuflags-y) -pipe
++KBUILD_CFLAGS += $(cpuflags-y)
++
++KBUILD_CFLAGS += -pipe -ffreestanding
++
+ ifdef CONFIG_MMU
+ # without -fno-strength-reduce the 53c7xx.c driver fails ;-(
+ KBUILD_CFLAGS += -fno-strength-reduce -ffixed-a2
+diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
+index 2c1c53d12179..f567ace7a9e9 100644
+--- a/arch/mips/include/asm/kvm_host.h
++++ b/arch/mips/include/asm/kvm_host.h
+@@ -1131,7 +1131,7 @@ static inline void kvm_arch_hardware_unsetup(void) {}
+ static inline void kvm_arch_sync_events(struct kvm *kvm) {}
+ static inline void kvm_arch_free_memslot(struct kvm *kvm,
+ struct kvm_memory_slot *free, struct kvm_memory_slot *dont) {}
+-static inline void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots) {}
++static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {}
+ static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
+ static inline void kvm_arch_vcpu_blocking(struct kvm_vcpu *vcpu) {}
+ static inline void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu) {}
+diff --git a/arch/powerpc/include/asm/book3s/64/hugetlb.h b/arch/powerpc/include/asm/book3s/64/hugetlb.h
+index 50888388a359..02544939ef0b 100644
+--- a/arch/powerpc/include/asm/book3s/64/hugetlb.h
++++ b/arch/powerpc/include/asm/book3s/64/hugetlb.h
+@@ -35,6 +35,14 @@ static inline int hstate_get_psize(struct hstate *hstate)
+ #ifdef CONFIG_ARCH_HAS_GIGANTIC_PAGE
+ static inline bool gigantic_page_supported(void)
+ {
++ /*
++ * We used gigantic page reservation with hypervisor assist in some case.
++ * We cannot use runtime allocation of gigantic pages in those platforms
++ * This is hash translation mode LPARs.
++ */
++ if (firmware_has_feature(FW_FEATURE_LPAR) && !radix_enabled())
++ return false;
++
+ return true;
+ }
+ #endif
+diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
+index 906bcbdfd2a1..bccc5051249e 100644
+--- a/arch/powerpc/include/asm/kvm_host.h
++++ b/arch/powerpc/include/asm/kvm_host.h
+@@ -822,7 +822,7 @@ struct kvm_vcpu_arch {
+ static inline void kvm_arch_hardware_disable(void) {}
+ static inline void kvm_arch_hardware_unsetup(void) {}
+ static inline void kvm_arch_sync_events(struct kvm *kvm) {}
+-static inline void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots) {}
++static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {}
+ static inline void kvm_arch_flush_shadow_all(struct kvm *kvm) {}
+ static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
+ static inline void kvm_arch_exit(void) {}
+diff --git a/arch/powerpc/include/asm/powernv.h b/arch/powerpc/include/asm/powernv.h
+index 2f3ff7a27881..d85fcfea32ca 100644
+--- a/arch/powerpc/include/asm/powernv.h
++++ b/arch/powerpc/include/asm/powernv.h
+@@ -23,6 +23,8 @@ extern int pnv_npu2_handle_fault(struct npu_context *context, uintptr_t *ea,
+ unsigned long *flags, unsigned long *status,
+ int count);
+
++void pnv_program_cpu_hotplug_lpcr(unsigned int cpu, u64 lpcr_val);
++
+ void pnv_tm_init(void);
+ #else
+ static inline void powernv_set_nmmu_ptcr(unsigned long ptcr) { }
+diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
+index e58c3f467db5..26b3f853cbf6 100644
+--- a/arch/powerpc/kernel/entry_32.S
++++ b/arch/powerpc/kernel/entry_32.S
+@@ -745,6 +745,9 @@ fast_exception_return:
+ mtcr r10
+ lwz r10,_LINK(r11)
+ mtlr r10
++ /* Clear the exception_marker on the stack to avoid confusing stacktrace */
++ li r10, 0
++ stw r10, 8(r11)
+ REST_GPR(10, r11)
+ #if defined(CONFIG_PPC_8xx) && defined(CONFIG_PERF_EVENTS)
+ mtspr SPRN_NRI, r0
+@@ -982,6 +985,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRED_STWCX)
+ mtcrf 0xFF,r10
+ mtlr r11
+
++ /* Clear the exception_marker on the stack to avoid confusing stacktrace */
++ li r10, 0
++ stw r10, 8(r1)
+ /*
+ * Once we put values in SRR0 and SRR1, we are in a state
+ * where exceptions are not recoverable, since taking an
+@@ -1021,6 +1027,9 @@ exc_exit_restart_end:
+ mtlr r11
+ lwz r10,_CCR(r1)
+ mtcrf 0xff,r10
++ /* Clear the exception_marker on the stack to avoid confusing stacktrace */
++ li r10, 0
++ stw r10, 8(r1)
+ REST_2GPRS(9, r1)
+ .globl exc_exit_restart
+ exc_exit_restart:
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index bb6ac471a784..d29f2dca725b 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -180,7 +180,7 @@ static void __giveup_fpu(struct task_struct *tsk)
+
+ save_fpu(tsk);
+ msr = tsk->thread.regs->msr;
+- msr &= ~MSR_FP;
++ msr &= ~(MSR_FP|MSR_FE0|MSR_FE1);
+ #ifdef CONFIG_VSX
+ if (cpu_has_feature(CPU_FTR_VSX))
+ msr &= ~MSR_VSX;
+diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
+index 9667666eb18e..e08b32ccf1d9 100644
+--- a/arch/powerpc/kernel/ptrace.c
++++ b/arch/powerpc/kernel/ptrace.c
+@@ -561,6 +561,7 @@ static int vr_get(struct task_struct *target, const struct user_regset *regset,
+ /*
+ * Copy out only the low-order word of vrsave.
+ */
++ int start, end;
+ union {
+ elf_vrreg_t reg;
+ u32 word;
+@@ -569,8 +570,10 @@ static int vr_get(struct task_struct *target, const struct user_regset *regset,
+
+ vrsave.word = target->thread.vrsave;
+
++ start = 33 * sizeof(vector128);
++ end = start + sizeof(vrsave);
+ ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &vrsave,
+- 33 * sizeof(vector128), -1);
++ start, end);
+ }
+
+ return ret;
+@@ -608,6 +611,7 @@ static int vr_set(struct task_struct *target, const struct user_regset *regset,
+ /*
+ * We use only the first word of vrsave.
+ */
++ int start, end;
+ union {
+ elf_vrreg_t reg;
+ u32 word;
+@@ -616,8 +620,10 @@ static int vr_set(struct task_struct *target, const struct user_regset *regset,
+
+ vrsave.word = target->thread.vrsave;
+
++ start = 33 * sizeof(vector128);
++ end = start + sizeof(vrsave);
+ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &vrsave,
+- 33 * sizeof(vector128), -1);
++ start, end);
+ if (!ret)
+ target->thread.vrsave = vrsave.word;
+ }
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 8689a02b7df8..02fe6d020174 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -767,15 +767,15 @@ void machine_check_exception(struct pt_regs *regs)
+ if (check_io_access(regs))
+ goto bail;
+
+- /* Must die if the interrupt is not recoverable */
+- if (!(regs->msr & MSR_RI))
+- nmi_panic(regs, "Unrecoverable Machine check");
+-
+ if (!nested)
+ nmi_exit();
+
+ die("Machine check", regs, SIGBUS);
+
++ /* Must die if the interrupt is not recoverable */
++ if (!(regs->msr & MSR_RI))
++ nmi_panic(regs, "Unrecoverable Machine check");
++
+ return;
+
+ bail:
+@@ -1545,8 +1545,8 @@ bail:
+
+ void StackOverflow(struct pt_regs *regs)
+ {
+- printk(KERN_CRIT "Kernel stack overflow in process %p, r1=%lx\n",
+- current, regs->gpr[1]);
++ pr_crit("Kernel stack overflow in process %s[%d], r1=%lx\n",
++ current->comm, task_pid_nr(current), regs->gpr[1]);
+ debugger(regs);
+ show_regs(regs);
+ panic("kernel stack overflow");
+diff --git a/arch/powerpc/platforms/83xx/suspend-asm.S b/arch/powerpc/platforms/83xx/suspend-asm.S
+index 3d1ecd211776..8137f77abad5 100644
+--- a/arch/powerpc/platforms/83xx/suspend-asm.S
++++ b/arch/powerpc/platforms/83xx/suspend-asm.S
+@@ -26,13 +26,13 @@
+ #define SS_MSR 0x74
+ #define SS_SDR1 0x78
+ #define SS_LR 0x7c
+-#define SS_SPRG 0x80 /* 4 SPRGs */
+-#define SS_DBAT 0x90 /* 8 DBATs */
+-#define SS_IBAT 0xd0 /* 8 IBATs */
+-#define SS_TB 0x110
+-#define SS_CR 0x118
+-#define SS_GPREG 0x11c /* r12-r31 */
+-#define STATE_SAVE_SIZE 0x16c
++#define SS_SPRG 0x80 /* 8 SPRGs */
++#define SS_DBAT 0xa0 /* 8 DBATs */
++#define SS_IBAT 0xe0 /* 8 IBATs */
++#define SS_TB 0x120
++#define SS_CR 0x128
++#define SS_GPREG 0x12c /* r12-r31 */
++#define STATE_SAVE_SIZE 0x17c
+
+ .section .data
+ .align 5
+@@ -103,6 +103,16 @@ _GLOBAL(mpc83xx_enter_deep_sleep)
+ stw r7, SS_SPRG+12(r3)
+ stw r8, SS_SDR1(r3)
+
++ mfspr r4, SPRN_SPRG4
++ mfspr r5, SPRN_SPRG5
++ mfspr r6, SPRN_SPRG6
++ mfspr r7, SPRN_SPRG7
++
++ stw r4, SS_SPRG+16(r3)
++ stw r5, SS_SPRG+20(r3)
++ stw r6, SS_SPRG+24(r3)
++ stw r7, SS_SPRG+28(r3)
++
+ mfspr r4, SPRN_DBAT0U
+ mfspr r5, SPRN_DBAT0L
+ mfspr r6, SPRN_DBAT1U
+@@ -493,6 +503,16 @@ mpc83xx_deep_resume:
+ mtspr SPRN_IBAT7U, r6
+ mtspr SPRN_IBAT7L, r7
+
++ lwz r4, SS_SPRG+16(r3)
++ lwz r5, SS_SPRG+20(r3)
++ lwz r6, SS_SPRG+24(r3)
++ lwz r7, SS_SPRG+28(r3)
++
++ mtspr SPRN_SPRG4, r4
++ mtspr SPRN_SPRG5, r5
++ mtspr SPRN_SPRG6, r6
++ mtspr SPRN_SPRG7, r7
++
+ lwz r4, SS_SPRG+0(r3)
+ lwz r5, SS_SPRG+4(r3)
+ lwz r6, SS_SPRG+8(r3)
+diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c
+index 403523c061ba..343bffd20fca 100644
+--- a/arch/powerpc/platforms/embedded6xx/wii.c
++++ b/arch/powerpc/platforms/embedded6xx/wii.c
+@@ -83,6 +83,10 @@ unsigned long __init wii_mmu_mapin_mem2(unsigned long top)
+ /* MEM2 64MB@0x10000000 */
+ delta = wii_hole_start + wii_hole_size;
+ size = top - delta;
++
++ if (__map_without_bats)
++ return delta;
++
+ for (bl = 128<<10; bl < max_size; bl <<= 1) {
+ if (bl * 2 > size)
+ break;
+diff --git a/arch/powerpc/platforms/powernv/idle.c b/arch/powerpc/platforms/powernv/idle.c
+index 35f699ebb662..e52f9b06dd9c 100644
+--- a/arch/powerpc/platforms/powernv/idle.c
++++ b/arch/powerpc/platforms/powernv/idle.c
+@@ -458,7 +458,8 @@ EXPORT_SYMBOL_GPL(pnv_power9_force_smt4_release);
+ #endif /* CONFIG_KVM_BOOK3S_HV_POSSIBLE */
+
+ #ifdef CONFIG_HOTPLUG_CPU
+-static void pnv_program_cpu_hotplug_lpcr(unsigned int cpu, u64 lpcr_val)
++
++void pnv_program_cpu_hotplug_lpcr(unsigned int cpu, u64 lpcr_val)
+ {
+ u64 pir = get_hard_smp_processor_id(cpu);
+
+@@ -481,20 +482,6 @@ unsigned long pnv_cpu_offline(unsigned int cpu)
+ {
+ unsigned long srr1;
+ u32 idle_states = pnv_get_supported_cpuidle_states();
+- u64 lpcr_val;
+-
+- /*
+- * We don't want to take decrementer interrupts while we are
+- * offline, so clear LPCR:PECE1. We keep PECE2 (and
+- * LPCR_PECE_HVEE on P9) enabled as to let IPIs in.
+- *
+- * If the CPU gets woken up by a special wakeup, ensure that
+- * the SLW engine sets LPCR with decrementer bit cleared, else
+- * the CPU will come back to the kernel due to a spurious
+- * wakeup.
+- */
+- lpcr_val = mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1;
+- pnv_program_cpu_hotplug_lpcr(cpu, lpcr_val);
+
+ __ppc64_runlatch_off();
+
+@@ -526,16 +513,6 @@ unsigned long pnv_cpu_offline(unsigned int cpu)
+
+ __ppc64_runlatch_on();
+
+- /*
+- * Re-enable decrementer interrupts in LPCR.
+- *
+- * Further, we want stop states to be woken up by decrementer
+- * for non-hotplug cases. So program the LPCR via stop api as
+- * well.
+- */
+- lpcr_val = mfspr(SPRN_LPCR) | (u64)LPCR_PECE1;
+- pnv_program_cpu_hotplug_lpcr(cpu, lpcr_val);
+-
+ return srr1;
+ }
+ #endif
+diff --git a/arch/powerpc/platforms/powernv/opal-msglog.c b/arch/powerpc/platforms/powernv/opal-msglog.c
+index acd3206dfae3..06628c71cef6 100644
+--- a/arch/powerpc/platforms/powernv/opal-msglog.c
++++ b/arch/powerpc/platforms/powernv/opal-msglog.c
+@@ -98,7 +98,7 @@ static ssize_t opal_msglog_read(struct file *file, struct kobject *kobj,
+ }
+
+ static struct bin_attribute opal_msglog_attr = {
+- .attr = {.name = "msglog", .mode = 0444},
++ .attr = {.name = "msglog", .mode = 0400},
+ .read = opal_msglog_read
+ };
+
+diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
+index 0d354e19ef92..db09c7022635 100644
+--- a/arch/powerpc/platforms/powernv/smp.c
++++ b/arch/powerpc/platforms/powernv/smp.c
+@@ -39,6 +39,7 @@
+ #include <asm/cpuidle.h>
+ #include <asm/kexec.h>
+ #include <asm/reg.h>
++#include <asm/powernv.h>
+
+ #include "powernv.h"
+
+@@ -153,6 +154,7 @@ static void pnv_smp_cpu_kill_self(void)
+ {
+ unsigned int cpu;
+ unsigned long srr1, wmask;
++ u64 lpcr_val;
+
+ /* Standard hot unplug procedure */
+ /*
+@@ -174,6 +176,19 @@ static void pnv_smp_cpu_kill_self(void)
+ if (cpu_has_feature(CPU_FTR_ARCH_207S))
+ wmask = SRR1_WAKEMASK_P8;
+
++ /*
++ * We don't want to take decrementer interrupts while we are
++ * offline, so clear LPCR:PECE1. We keep PECE2 (and
++ * LPCR_PECE_HVEE on P9) enabled so as to let IPIs in.
++ *
++ * If the CPU gets woken up by a special wakeup, ensure that
++ * the SLW engine sets LPCR with decrementer bit cleared, else
++ * the CPU will come back to the kernel due to a spurious
++ * wakeup.
++ */
++ lpcr_val = mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1;
++ pnv_program_cpu_hotplug_lpcr(cpu, lpcr_val);
++
+ while (!generic_check_cpu_restart(cpu)) {
+ /*
+ * Clear IPI flag, since we don't handle IPIs while
+@@ -246,6 +261,16 @@ static void pnv_smp_cpu_kill_self(void)
+
+ }
+
++ /*
++ * Re-enable decrementer interrupts in LPCR.
++ *
++ * Further, we want stop states to be woken up by decrementer
++ * for non-hotplug cases. So program the LPCR via stop api as
++ * well.
++ */
++ lpcr_val = mfspr(SPRN_LPCR) | (u64)LPCR_PECE1;
++ pnv_program_cpu_hotplug_lpcr(cpu, lpcr_val);
++
+ DBG("CPU%d coming online...\n", cpu);
+ }
+
+diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
+index 29c940bf8506..dad110e9f41b 100644
+--- a/arch/s390/include/asm/kvm_host.h
++++ b/arch/s390/include/asm/kvm_host.h
+@@ -865,7 +865,7 @@ static inline void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu) {}
+ static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
+ static inline void kvm_arch_free_memslot(struct kvm *kvm,
+ struct kvm_memory_slot *free, struct kvm_memory_slot *dont) {}
+-static inline void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots) {}
++static inline void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) {}
+ static inline void kvm_arch_flush_shadow_all(struct kvm *kvm) {}
+ static inline void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
+ struct kvm_memory_slot *slot) {}
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index a0097f8bada8..5f85e0dfa66d 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -303,7 +303,7 @@ early_param("vmalloc", parse_vmalloc);
+
+ void *restart_stack __section(.data);
+
+-static void __init setup_lowcore(void)
++static void __init setup_lowcore_dat_off(void)
+ {
+ struct lowcore *lc;
+
+@@ -314,19 +314,16 @@ static void __init setup_lowcore(void)
+ lc = memblock_virt_alloc_low(sizeof(*lc), sizeof(*lc));
+ lc->restart_psw.mask = PSW_KERNEL_BITS;
+ lc->restart_psw.addr = (unsigned long) restart_int_handler;
+- lc->external_new_psw.mask = PSW_KERNEL_BITS |
+- PSW_MASK_DAT | PSW_MASK_MCHECK;
++ lc->external_new_psw.mask = PSW_KERNEL_BITS | PSW_MASK_MCHECK;
+ lc->external_new_psw.addr = (unsigned long) ext_int_handler;
+ lc->svc_new_psw.mask = PSW_KERNEL_BITS |
+- PSW_MASK_DAT | PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK;
++ PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK;
+ lc->svc_new_psw.addr = (unsigned long) system_call;
+- lc->program_new_psw.mask = PSW_KERNEL_BITS |
+- PSW_MASK_DAT | PSW_MASK_MCHECK;
++ lc->program_new_psw.mask = PSW_KERNEL_BITS | PSW_MASK_MCHECK;
+ lc->program_new_psw.addr = (unsigned long) pgm_check_handler;
+ lc->mcck_new_psw.mask = PSW_KERNEL_BITS;
+ lc->mcck_new_psw.addr = (unsigned long) mcck_int_handler;
+- lc->io_new_psw.mask = PSW_KERNEL_BITS |
+- PSW_MASK_DAT | PSW_MASK_MCHECK;
++ lc->io_new_psw.mask = PSW_KERNEL_BITS | PSW_MASK_MCHECK;
+ lc->io_new_psw.addr = (unsigned long) io_int_handler;
+ lc->clock_comparator = clock_comparator_max;
+ lc->kernel_stack = ((unsigned long) &init_thread_union)
+@@ -388,6 +385,16 @@ static void __init setup_lowcore(void)
+ lowcore_ptr[0] = lc;
+ }
+
++static void __init setup_lowcore_dat_on(void)
++{
++ __ctl_clear_bit(0, 28);
++ S390_lowcore.external_new_psw.mask |= PSW_MASK_DAT;
++ S390_lowcore.svc_new_psw.mask |= PSW_MASK_DAT;
++ S390_lowcore.program_new_psw.mask |= PSW_MASK_DAT;
++ S390_lowcore.io_new_psw.mask |= PSW_MASK_DAT;
++ __ctl_set_bit(0, 28);
++}
++
+ static struct resource code_resource = {
+ .name = "Kernel code",
+ .flags = IORESOURCE_BUSY | IORESOURCE_SYSTEM_RAM,
+@@ -946,7 +953,7 @@ void __init setup_arch(char **cmdline_p)
+ #endif
+
+ setup_resources();
+- setup_lowcore();
++ setup_lowcore_dat_off();
+ smp_fill_possible_mask();
+ cpu_detect_mhz_feature();
+ cpu_init();
+@@ -959,6 +966,12 @@ void __init setup_arch(char **cmdline_p)
+ */
+ paging_init();
+
++ /*
++ * After paging_init created the kernel page table, the new PSWs
++ * in lowcore can now run with DAT enabled.
++ */
++ setup_lowcore_dat_on();
++
+ /* Setup default console */
+ conmode_default();
+ set_preferred_console();
+diff --git a/arch/x86/crypto/aegis128-aesni-glue.c b/arch/x86/crypto/aegis128-aesni-glue.c
+index 2a356b948720..3ea71b871813 100644
+--- a/arch/x86/crypto/aegis128-aesni-glue.c
++++ b/arch/x86/crypto/aegis128-aesni-glue.c
+@@ -119,31 +119,20 @@ static void crypto_aegis128_aesni_process_ad(
+ }
+
+ static void crypto_aegis128_aesni_process_crypt(
+- struct aegis_state *state, struct aead_request *req,
++ struct aegis_state *state, struct skcipher_walk *walk,
+ const struct aegis_crypt_ops *ops)
+ {
+- struct skcipher_walk walk;
+- u8 *src, *dst;
+- unsigned int chunksize, base;
+-
+- ops->skcipher_walk_init(&walk, req, false);
+-
+- while (walk.nbytes) {
+- src = walk.src.virt.addr;
+- dst = walk.dst.virt.addr;
+- chunksize = walk.nbytes;
+-
+- ops->crypt_blocks(state, chunksize, src, dst);
+-
+- base = chunksize & ~(AEGIS128_BLOCK_SIZE - 1);
+- src += base;
+- dst += base;
+- chunksize &= AEGIS128_BLOCK_SIZE - 1;
+-
+- if (chunksize > 0)
+- ops->crypt_tail(state, chunksize, src, dst);
++ while (walk->nbytes >= AEGIS128_BLOCK_SIZE) {
++ ops->crypt_blocks(state,
++ round_down(walk->nbytes, AEGIS128_BLOCK_SIZE),
++ walk->src.virt.addr, walk->dst.virt.addr);
++ skcipher_walk_done(walk, walk->nbytes % AEGIS128_BLOCK_SIZE);
++ }
+
+- skcipher_walk_done(&walk, 0);
++ if (walk->nbytes) {
++ ops->crypt_tail(state, walk->nbytes, walk->src.virt.addr,
++ walk->dst.virt.addr);
++ skcipher_walk_done(walk, 0);
+ }
+ }
+
+@@ -186,13 +175,16 @@ static void crypto_aegis128_aesni_crypt(struct aead_request *req,
+ {
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct aegis_ctx *ctx = crypto_aegis128_aesni_ctx(tfm);
++ struct skcipher_walk walk;
+ struct aegis_state state;
+
++ ops->skcipher_walk_init(&walk, req, true);
++
+ kernel_fpu_begin();
+
+ crypto_aegis128_aesni_init(&state, ctx->key.bytes, req->iv);
+ crypto_aegis128_aesni_process_ad(&state, req->src, req->assoclen);
+- crypto_aegis128_aesni_process_crypt(&state, req, ops);
++ crypto_aegis128_aesni_process_crypt(&state, &walk, ops);
+ crypto_aegis128_aesni_final(&state, tag_xor, req->assoclen, cryptlen);
+
+ kernel_fpu_end();
+diff --git a/arch/x86/crypto/aegis128l-aesni-glue.c b/arch/x86/crypto/aegis128l-aesni-glue.c
+index dbe8bb980da1..1b1b39c66c5e 100644
+--- a/arch/x86/crypto/aegis128l-aesni-glue.c
++++ b/arch/x86/crypto/aegis128l-aesni-glue.c
+@@ -119,31 +119,20 @@ static void crypto_aegis128l_aesni_process_ad(
+ }
+
+ static void crypto_aegis128l_aesni_process_crypt(
+- struct aegis_state *state, struct aead_request *req,
++ struct aegis_state *state, struct skcipher_walk *walk,
+ const struct aegis_crypt_ops *ops)
+ {
+- struct skcipher_walk walk;
+- u8 *src, *dst;
+- unsigned int chunksize, base;
+-
+- ops->skcipher_walk_init(&walk, req, false);
+-
+- while (walk.nbytes) {
+- src = walk.src.virt.addr;
+- dst = walk.dst.virt.addr;
+- chunksize = walk.nbytes;
+-
+- ops->crypt_blocks(state, chunksize, src, dst);
+-
+- base = chunksize & ~(AEGIS128L_BLOCK_SIZE - 1);
+- src += base;
+- dst += base;
+- chunksize &= AEGIS128L_BLOCK_SIZE - 1;
+-
+- if (chunksize > 0)
+- ops->crypt_tail(state, chunksize, src, dst);
++ while (walk->nbytes >= AEGIS128L_BLOCK_SIZE) {
++ ops->crypt_blocks(state, round_down(walk->nbytes,
++ AEGIS128L_BLOCK_SIZE),
++ walk->src.virt.addr, walk->dst.virt.addr);
++ skcipher_walk_done(walk, walk->nbytes % AEGIS128L_BLOCK_SIZE);
++ }
+
+- skcipher_walk_done(&walk, 0);
++ if (walk->nbytes) {
++ ops->crypt_tail(state, walk->nbytes, walk->src.virt.addr,
++ walk->dst.virt.addr);
++ skcipher_walk_done(walk, 0);
+ }
+ }
+
+@@ -186,13 +175,16 @@ static void crypto_aegis128l_aesni_crypt(struct aead_request *req,
+ {
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct aegis_ctx *ctx = crypto_aegis128l_aesni_ctx(tfm);
++ struct skcipher_walk walk;
+ struct aegis_state state;
+
++ ops->skcipher_walk_init(&walk, req, true);
++
+ kernel_fpu_begin();
+
+ crypto_aegis128l_aesni_init(&state, ctx->key.bytes, req->iv);
+ crypto_aegis128l_aesni_process_ad(&state, req->src, req->assoclen);
+- crypto_aegis128l_aesni_process_crypt(&state, req, ops);
++ crypto_aegis128l_aesni_process_crypt(&state, &walk, ops);
+ crypto_aegis128l_aesni_final(&state, tag_xor, req->assoclen, cryptlen);
+
+ kernel_fpu_end();
+diff --git a/arch/x86/crypto/aegis256-aesni-glue.c b/arch/x86/crypto/aegis256-aesni-glue.c
+index 8bebda2de92f..6227ca3220a0 100644
+--- a/arch/x86/crypto/aegis256-aesni-glue.c
++++ b/arch/x86/crypto/aegis256-aesni-glue.c
+@@ -119,31 +119,20 @@ static void crypto_aegis256_aesni_process_ad(
+ }
+
+ static void crypto_aegis256_aesni_process_crypt(
+- struct aegis_state *state, struct aead_request *req,
++ struct aegis_state *state, struct skcipher_walk *walk,
+ const struct aegis_crypt_ops *ops)
+ {
+- struct skcipher_walk walk;
+- u8 *src, *dst;
+- unsigned int chunksize, base;
+-
+- ops->skcipher_walk_init(&walk, req, false);
+-
+- while (walk.nbytes) {
+- src = walk.src.virt.addr;
+- dst = walk.dst.virt.addr;
+- chunksize = walk.nbytes;
+-
+- ops->crypt_blocks(state, chunksize, src, dst);
+-
+- base = chunksize & ~(AEGIS256_BLOCK_SIZE - 1);
+- src += base;
+- dst += base;
+- chunksize &= AEGIS256_BLOCK_SIZE - 1;
+-
+- if (chunksize > 0)
+- ops->crypt_tail(state, chunksize, src, dst);
++ while (walk->nbytes >= AEGIS256_BLOCK_SIZE) {
++ ops->crypt_blocks(state,
++ round_down(walk->nbytes, AEGIS256_BLOCK_SIZE),
++ walk->src.virt.addr, walk->dst.virt.addr);
++ skcipher_walk_done(walk, walk->nbytes % AEGIS256_BLOCK_SIZE);
++ }
+
+- skcipher_walk_done(&walk, 0);
++ if (walk->nbytes) {
++ ops->crypt_tail(state, walk->nbytes, walk->src.virt.addr,
++ walk->dst.virt.addr);
++ skcipher_walk_done(walk, 0);
+ }
+ }
+
+@@ -186,13 +175,16 @@ static void crypto_aegis256_aesni_crypt(struct aead_request *req,
+ {
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct aegis_ctx *ctx = crypto_aegis256_aesni_ctx(tfm);
++ struct skcipher_walk walk;
+ struct aegis_state state;
+
++ ops->skcipher_walk_init(&walk, req, true);
++
+ kernel_fpu_begin();
+
+ crypto_aegis256_aesni_init(&state, ctx->key, req->iv);
+ crypto_aegis256_aesni_process_ad(&state, req->src, req->assoclen);
+- crypto_aegis256_aesni_process_crypt(&state, req, ops);
++ crypto_aegis256_aesni_process_crypt(&state, &walk, ops);
+ crypto_aegis256_aesni_final(&state, tag_xor, req->assoclen, cryptlen);
+
+ kernel_fpu_end();
+diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
+index e4b78f962874..917f25e4d0a8 100644
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -830,11 +830,14 @@ static int gcmaes_crypt_by_sg(bool enc, struct aead_request *req,
+ scatterwalk_map_and_copy(assoc, req->src, 0, assoclen, 0);
+ }
+
+- src_sg = scatterwalk_ffwd(src_start, req->src, req->assoclen);
+- scatterwalk_start(&src_sg_walk, src_sg);
+- if (req->src != req->dst) {
+- dst_sg = scatterwalk_ffwd(dst_start, req->dst, req->assoclen);
+- scatterwalk_start(&dst_sg_walk, dst_sg);
++ if (left) {
++ src_sg = scatterwalk_ffwd(src_start, req->src, req->assoclen);
++ scatterwalk_start(&src_sg_walk, src_sg);
++ if (req->src != req->dst) {
++ dst_sg = scatterwalk_ffwd(dst_start, req->dst,
++ req->assoclen);
++ scatterwalk_start(&dst_sg_walk, dst_sg);
++ }
+ }
+
+ kernel_fpu_begin();
+diff --git a/arch/x86/crypto/morus1280_glue.c b/arch/x86/crypto/morus1280_glue.c
+index 0dccdda1eb3a..7e600f8bcdad 100644
+--- a/arch/x86/crypto/morus1280_glue.c
++++ b/arch/x86/crypto/morus1280_glue.c
+@@ -85,31 +85,20 @@ static void crypto_morus1280_glue_process_ad(
+
+ static void crypto_morus1280_glue_process_crypt(struct morus1280_state *state,
+ struct morus1280_ops ops,
+- struct aead_request *req)
++ struct skcipher_walk *walk)
+ {
+- struct skcipher_walk walk;
+- u8 *cursor_src, *cursor_dst;
+- unsigned int chunksize, base;
+-
+- ops.skcipher_walk_init(&walk, req, false);
+-
+- while (walk.nbytes) {
+- cursor_src = walk.src.virt.addr;
+- cursor_dst = walk.dst.virt.addr;
+- chunksize = walk.nbytes;
+-
+- ops.crypt_blocks(state, cursor_src, cursor_dst, chunksize);
+-
+- base = chunksize & ~(MORUS1280_BLOCK_SIZE - 1);
+- cursor_src += base;
+- cursor_dst += base;
+- chunksize &= MORUS1280_BLOCK_SIZE - 1;
+-
+- if (chunksize > 0)
+- ops.crypt_tail(state, cursor_src, cursor_dst,
+- chunksize);
++ while (walk->nbytes >= MORUS1280_BLOCK_SIZE) {
++ ops.crypt_blocks(state, walk->src.virt.addr,
++ walk->dst.virt.addr,
++ round_down(walk->nbytes,
++ MORUS1280_BLOCK_SIZE));
++ skcipher_walk_done(walk, walk->nbytes % MORUS1280_BLOCK_SIZE);
++ }
+
+- skcipher_walk_done(&walk, 0);
++ if (walk->nbytes) {
++ ops.crypt_tail(state, walk->src.virt.addr, walk->dst.virt.addr,
++ walk->nbytes);
++ skcipher_walk_done(walk, 0);
+ }
+ }
+
+@@ -147,12 +136,15 @@ static void crypto_morus1280_glue_crypt(struct aead_request *req,
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct morus1280_ctx *ctx = crypto_aead_ctx(tfm);
+ struct morus1280_state state;
++ struct skcipher_walk walk;
++
++ ops.skcipher_walk_init(&walk, req, true);
+
+ kernel_fpu_begin();
+
+ ctx->ops->init(&state, &ctx->key, req->iv);
+ crypto_morus1280_glue_process_ad(&state, ctx->ops, req->src, req->assoclen);
+- crypto_morus1280_glue_process_crypt(&state, ops, req);
++ crypto_morus1280_glue_process_crypt(&state, ops, &walk);
+ ctx->ops->final(&state, tag_xor, req->assoclen, cryptlen);
+
+ kernel_fpu_end();
+diff --git a/arch/x86/crypto/morus640_glue.c b/arch/x86/crypto/morus640_glue.c
+index 7b58fe4d9bd1..cb3a81732016 100644
+--- a/arch/x86/crypto/morus640_glue.c
++++ b/arch/x86/crypto/morus640_glue.c
+@@ -85,31 +85,19 @@ static void crypto_morus640_glue_process_ad(
+
+ static void crypto_morus640_glue_process_crypt(struct morus640_state *state,
+ struct morus640_ops ops,
+- struct aead_request *req)
++ struct skcipher_walk *walk)
+ {
+- struct skcipher_walk walk;
+- u8 *cursor_src, *cursor_dst;
+- unsigned int chunksize, base;
+-
+- ops.skcipher_walk_init(&walk, req, false);
+-
+- while (walk.nbytes) {
+- cursor_src = walk.src.virt.addr;
+- cursor_dst = walk.dst.virt.addr;
+- chunksize = walk.nbytes;
+-
+- ops.crypt_blocks(state, cursor_src, cursor_dst, chunksize);
+-
+- base = chunksize & ~(MORUS640_BLOCK_SIZE - 1);
+- cursor_src += base;
+- cursor_dst += base;
+- chunksize &= MORUS640_BLOCK_SIZE - 1;
+-
+- if (chunksize > 0)
+- ops.crypt_tail(state, cursor_src, cursor_dst,
+- chunksize);
++ while (walk->nbytes >= MORUS640_BLOCK_SIZE) {
++ ops.crypt_blocks(state, walk->src.virt.addr,
++ walk->dst.virt.addr,
++ round_down(walk->nbytes, MORUS640_BLOCK_SIZE));
++ skcipher_walk_done(walk, walk->nbytes % MORUS640_BLOCK_SIZE);
++ }
+
+- skcipher_walk_done(&walk, 0);
++ if (walk->nbytes) {
++ ops.crypt_tail(state, walk->src.virt.addr, walk->dst.virt.addr,
++ walk->nbytes);
++ skcipher_walk_done(walk, 0);
+ }
+ }
+
+@@ -143,12 +131,15 @@ static void crypto_morus640_glue_crypt(struct aead_request *req,
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct morus640_ctx *ctx = crypto_aead_ctx(tfm);
+ struct morus640_state state;
++ struct skcipher_walk walk;
++
++ ops.skcipher_walk_init(&walk, req, true);
+
+ kernel_fpu_begin();
+
+ ctx->ops->init(&state, &ctx->key, req->iv);
+ crypto_morus640_glue_process_ad(&state, ctx->ops, req->src, req->assoclen);
+- crypto_morus640_glue_process_crypt(&state, ops, req);
++ crypto_morus640_glue_process_crypt(&state, ops, &walk);
+ ctx->ops->final(&state, tag_xor, req->assoclen, cryptlen);
+
+ kernel_fpu_end();
+diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
+index 27a461414b30..2690135bf83f 100644
+--- a/arch/x86/events/intel/uncore.c
++++ b/arch/x86/events/intel/uncore.c
+@@ -740,6 +740,7 @@ static int uncore_pmu_event_init(struct perf_event *event)
+ /* fixed counters have event field hardcoded to zero */
+ hwc->config = 0ULL;
+ } else if (is_freerunning_event(event)) {
++ hwc->config = event->attr.config;
+ if (!check_valid_freerunning_event(box, event))
+ return -EINVAL;
+ event->hw.idx = UNCORE_PMC_IDX_FREERUNNING;
+diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
+index e17ab885b1e9..cc6dd4f78158 100644
+--- a/arch/x86/events/intel/uncore.h
++++ b/arch/x86/events/intel/uncore.h
+@@ -285,8 +285,8 @@ static inline
+ unsigned int uncore_freerunning_counter(struct intel_uncore_box *box,
+ struct perf_event *event)
+ {
+- unsigned int type = uncore_freerunning_type(event->attr.config);
+- unsigned int idx = uncore_freerunning_idx(event->attr.config);
++ unsigned int type = uncore_freerunning_type(event->hw.config);
++ unsigned int idx = uncore_freerunning_idx(event->hw.config);
+ struct intel_uncore_pmu *pmu = box->pmu;
+
+ return pmu->type->freerunning[type].counter_base +
+@@ -360,7 +360,7 @@ static inline
+ unsigned int uncore_freerunning_bits(struct intel_uncore_box *box,
+ struct perf_event *event)
+ {
+- unsigned int type = uncore_freerunning_type(event->attr.config);
++ unsigned int type = uncore_freerunning_type(event->hw.config);
+
+ return box->pmu->type->freerunning[type].bits;
+ }
+@@ -368,7 +368,7 @@ unsigned int uncore_freerunning_bits(struct intel_uncore_box *box,
+ static inline int uncore_num_freerunning(struct intel_uncore_box *box,
+ struct perf_event *event)
+ {
+- unsigned int type = uncore_freerunning_type(event->attr.config);
++ unsigned int type = uncore_freerunning_type(event->hw.config);
+
+ return box->pmu->type->freerunning[type].num_counters;
+ }
+@@ -382,8 +382,8 @@ static inline int uncore_num_freerunning_types(struct intel_uncore_box *box,
+ static inline bool check_valid_freerunning_event(struct intel_uncore_box *box,
+ struct perf_event *event)
+ {
+- unsigned int type = uncore_freerunning_type(event->attr.config);
+- unsigned int idx = uncore_freerunning_idx(event->attr.config);
++ unsigned int type = uncore_freerunning_type(event->hw.config);
++ unsigned int idx = uncore_freerunning_idx(event->hw.config);
+
+ return (type < uncore_num_freerunning_types(box, event)) &&
+ (idx < uncore_num_freerunning(box, event));
+diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
+index bfa25814fe5f..2d328386f83a 100644
+--- a/arch/x86/events/intel/uncore_snb.c
++++ b/arch/x86/events/intel/uncore_snb.c
+@@ -444,9 +444,11 @@ static int snb_uncore_imc_event_init(struct perf_event *event)
+
+ /* must be done before validate_group */
+ event->hw.event_base = base;
+- event->hw.config = cfg;
+ event->hw.idx = idx;
+
++ /* Convert to standard encoding format for freerunning counters */
++ event->hw.config = ((cfg - 1) << 8) | 0x10ff;
++
+ /* no group validation needed, we have free running counters */
+
+ return 0;
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 7ed08a7c3398..0ad25cc895ae 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -55,6 +55,8 @@
+
+ #define INTEL_FAM6_CANNONLAKE_MOBILE 0x66
+
++#define INTEL_FAM6_ICELAKE_MOBILE 0x7E
++
+ /* "Small Core" Processors (Atom) */
+
+ #define INTEL_FAM6_ATOM_PINEVIEW 0x1C
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 728dc661ebb6..46f0b621bd37 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1194,7 +1194,7 @@ void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm,
+ struct kvm_memory_slot *slot,
+ gfn_t gfn_offset, unsigned long mask);
+ void kvm_mmu_zap_all(struct kvm *kvm);
+-void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, struct kvm_memslots *slots);
++void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen);
+ unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm);
+ void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages);
+
+diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
+index 6adf6e6c2933..544bd41a514c 100644
+--- a/arch/x86/kernel/kprobes/opt.c
++++ b/arch/x86/kernel/kprobes/opt.c
+@@ -141,6 +141,11 @@ asm (
+
+ void optprobe_template_func(void);
+ STACK_FRAME_NON_STANDARD(optprobe_template_func);
++NOKPROBE_SYMBOL(optprobe_template_func);
++NOKPROBE_SYMBOL(optprobe_template_entry);
++NOKPROBE_SYMBOL(optprobe_template_val);
++NOKPROBE_SYMBOL(optprobe_template_call);
++NOKPROBE_SYMBOL(optprobe_template_end);
+
+ #define TMPL_MOVE_IDX \
+ ((long)optprobe_template_val - (long)optprobe_template_entry)
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 1b82bc7c3cca..779ed52047d1 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -5774,13 +5774,30 @@ static bool kvm_has_zapped_obsolete_pages(struct kvm *kvm)
+ return unlikely(!list_empty_careful(&kvm->arch.zapped_obsolete_pages));
+ }
+
+-void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, struct kvm_memslots *slots)
++void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen)
+ {
++ gen &= MMIO_GEN_MASK;
++
++ /*
++ * Shift to eliminate the "update in-progress" flag, which isn't
++ * included in the spte's generation number.
++ */
++ gen >>= 1;
++
++ /*
++ * Generation numbers are incremented in multiples of the number of
++ * address spaces in order to provide unique generations across all
++ * address spaces. Strip what is effectively the address space
++ * modifier prior to checking for a wrap of the MMIO generation so
++ * that a wrap in any address space is detected.
++ */
++ gen &= ~((u64)KVM_ADDRESS_SPACE_NUM - 1);
++
+ /*
+- * The very rare case: if the generation-number is round,
++ * The very rare case: if the MMIO generation number has wrapped,
+ * zap all shadow pages.
+ */
+- if (unlikely((slots->generation & MMIO_GEN_MASK) == 0)) {
++ if (unlikely(gen == 0)) {
+ kvm_debug_ratelimited("kvm: zapping shadow pages for mmio generation wraparound\n");
+ kvm_mmu_invalidate_zap_all_pages(kvm);
+ }
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index f6da5c37d2e8..4029d3783e18 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -8184,25 +8184,50 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu,
+ /* Addr = segment_base + offset */
+ /* offset = base + [index * scale] + displacement */
+ off = exit_qualification; /* holds the displacement */
++ if (addr_size == 1)
++ off = (gva_t)sign_extend64(off, 31);
++ else if (addr_size == 0)
++ off = (gva_t)sign_extend64(off, 15);
+ if (base_is_valid)
+ off += kvm_register_read(vcpu, base_reg);
+ if (index_is_valid)
+ off += kvm_register_read(vcpu, index_reg)<<scaling;
+ vmx_get_segment(vcpu, &s, seg_reg);
+- *ret = s.base + off;
+
++ /*
++ * The effective address, i.e. @off, of a memory operand is truncated
++ * based on the address size of the instruction. Note that this is
++ * the *effective address*, i.e. the address prior to accounting for
++ * the segment's base.
++ */
+ if (addr_size == 1) /* 32 bit */
+- *ret &= 0xffffffff;
++ off &= 0xffffffff;
++ else if (addr_size == 0) /* 16 bit */
++ off &= 0xffff;
+
+ /* Checks for #GP/#SS exceptions. */
+ exn = false;
+ if (is_long_mode(vcpu)) {
++ /*
++ * The virtual/linear address is never truncated in 64-bit
++ * mode, e.g. a 32-bit address size can yield a 64-bit virtual
++ * address when using FS/GS with a non-zero base.
++ */
++ *ret = s.base + off;
++
+ /* Long mode: #GP(0)/#SS(0) if the memory address is in a
+ * non-canonical form. This is the only check on the memory
+ * destination for long mode!
+ */
+ exn = is_noncanonical_address(*ret, vcpu);
+ } else if (is_protmode(vcpu)) {
++ /*
++ * When not in long mode, the virtual/linear address is
++ * unconditionally truncated to 32 bits regardless of the
++ * address size.
++ */
++ *ret = (s.base + off) & 0xffffffff;
++
+ /* Protected mode: apply checks for segment validity in the
+ * following order:
+ * - segment type check (#GP(0) may be thrown)
+@@ -8226,10 +8251,16 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu,
+ /* Protected mode: #GP(0)/#SS(0) if the segment is unusable.
+ */
+ exn = (s.unusable != 0);
+- /* Protected mode: #GP(0)/#SS(0) if the memory
+- * operand is outside the segment limit.
++
++ /*
++ * Protected mode: #GP(0)/#SS(0) if the memory operand is
++ * outside the segment limit. All CPUs that support VMX ignore
++ * limit checks for flat segments, i.e. segments with base==0,
++ * limit==0xffffffff and of type expand-up data or code.
+ */
+- exn = exn || (off + sizeof(u64) > s.limit);
++ if (!(s.base == 0 && s.limit == 0xffffffff &&
++ ((s.type & 8) || !(s.type & 4))))
++ exn = exn || (off + sizeof(u64) > s.limit);
+ }
+ if (exn) {
+ kvm_queue_exception_e(vcpu,
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 3a7cf7c6b28a..6181ec19bed2 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -9108,13 +9108,13 @@ out_free:
+ return -ENOMEM;
+ }
+
+-void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots)
++void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen)
+ {
+ /*
+ * memslots->generation has been incremented.
+ * mmio generation may have reached its maximum value.
+ */
+- kvm_mmu_invalidate_mmio_sptes(kvm, slots);
++ kvm_mmu_invalidate_mmio_sptes(kvm, gen);
+ }
+
+ int kvm_arch_prepare_memory_region(struct kvm *kvm,
+diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
+index 67b9568613f3..1826ed9dd1c8 100644
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -181,6 +181,11 @@ static inline bool emul_is_noncanonical_address(u64 la,
+ static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu,
+ gva_t gva, gfn_t gfn, unsigned access)
+ {
++ u64 gen = kvm_memslots(vcpu->kvm)->generation;
++
++ if (unlikely(gen & 1))
++ return;
++
+ /*
+ * If this is a shadow nested page table, the "GVA" is
+ * actually a nGPA.
+@@ -188,7 +193,7 @@ static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu,
+ vcpu->arch.mmio_gva = mmu_is_nested(vcpu) ? 0 : gva & PAGE_MASK;
+ vcpu->arch.access = access;
+ vcpu->arch.mmio_gfn = gfn;
+- vcpu->arch.mmio_gen = kvm_memslots(vcpu->kvm)->generation;
++ vcpu->arch.mmio_gen = gen;
+ }
+
+ static inline bool vcpu_match_mmio_gen(struct kvm_vcpu *vcpu)
+diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
+index c8f011e07a15..73aa0b89a74a 100644
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -2106,10 +2106,10 @@ void __init xen_relocate_p2m(void)
+ pt = early_memremap(pt_phys, PAGE_SIZE);
+ clear_page(pt);
+ for (idx_pte = 0;
+- idx_pte < min(n_pte, PTRS_PER_PTE);
+- idx_pte++) {
+- set_pte(pt + idx_pte,
+- pfn_pte(p2m_pfn, PAGE_KERNEL));
++ idx_pte < min(n_pte, PTRS_PER_PTE);
++ idx_pte++) {
++ pt[idx_pte] = pfn_pte(p2m_pfn,
++ PAGE_KERNEL);
+ p2m_pfn++;
+ }
+ n_pte -= PTRS_PER_PTE;
+@@ -2117,8 +2117,7 @@ void __init xen_relocate_p2m(void)
+ make_lowmem_page_readonly(__va(pt_phys));
+ pin_pagetable_pfn(MMUEXT_PIN_L1_TABLE,
+ PFN_DOWN(pt_phys));
+- set_pmd(pmd + idx_pt,
+- __pmd(_PAGE_TABLE | pt_phys));
++ pmd[idx_pt] = __pmd(_PAGE_TABLE | pt_phys);
+ pt_phys += PAGE_SIZE;
+ }
+ n_pt -= PTRS_PER_PMD;
+@@ -2126,7 +2125,7 @@ void __init xen_relocate_p2m(void)
+ make_lowmem_page_readonly(__va(pmd_phys));
+ pin_pagetable_pfn(MMUEXT_PIN_L2_TABLE,
+ PFN_DOWN(pmd_phys));
+- set_pud(pud + idx_pmd, __pud(_PAGE_TABLE | pmd_phys));
++ pud[idx_pmd] = __pud(_PAGE_TABLE | pmd_phys);
+ pmd_phys += PAGE_SIZE;
+ }
+ n_pmd -= PTRS_PER_PUD;
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 23a53b67cf0d..7d53f2314d7c 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -701,12 +701,20 @@ static void blk_mq_requeue_work(struct work_struct *work)
+ spin_unlock_irq(&q->requeue_lock);
+
+ list_for_each_entry_safe(rq, next, &rq_list, queuelist) {
+- if (!(rq->rq_flags & RQF_SOFTBARRIER))
++ if (!(rq->rq_flags & (RQF_SOFTBARRIER | RQF_DONTPREP)))
+ continue;
+
+ rq->rq_flags &= ~RQF_SOFTBARRIER;
+ list_del_init(&rq->queuelist);
+- blk_mq_sched_insert_request(rq, true, false, false);
++ /*
++ * If RQF_DONTPREP, rq has contained some driver specific
++ * data, so insert it to hctx dispatch list to avoid any
++ * merge.
++ */
++ if (rq->rq_flags & RQF_DONTPREP)
++ blk_mq_request_bypass_insert(rq, false);
++ else
++ blk_mq_sched_insert_request(rq, true, false, false);
+ }
+
+ while (!list_empty(&rq_list)) {
+diff --git a/crypto/aead.c b/crypto/aead.c
+index 60b3bbe973e7..9688ada13981 100644
+--- a/crypto/aead.c
++++ b/crypto/aead.c
+@@ -61,8 +61,10 @@ int crypto_aead_setkey(struct crypto_aead *tfm,
+ else
+ err = crypto_aead_alg(tfm)->setkey(tfm, key, keylen);
+
+- if (err)
++ if (unlikely(err)) {
++ crypto_aead_set_flags(tfm, CRYPTO_TFM_NEED_KEY);
+ return err;
++ }
+
+ crypto_aead_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
+ return 0;
+diff --git a/crypto/aegis128.c b/crypto/aegis128.c
+index c22f4414856d..789716f92e4c 100644
+--- a/crypto/aegis128.c
++++ b/crypto/aegis128.c
+@@ -290,19 +290,19 @@ static void crypto_aegis128_process_crypt(struct aegis_state *state,
+ const struct aegis128_ops *ops)
+ {
+ struct skcipher_walk walk;
+- u8 *src, *dst;
+- unsigned int chunksize;
+
+ ops->skcipher_walk_init(&walk, req, false);
+
+ while (walk.nbytes) {
+- src = walk.src.virt.addr;
+- dst = walk.dst.virt.addr;
+- chunksize = walk.nbytes;
++ unsigned int nbytes = walk.nbytes;
+
+- ops->crypt_chunk(state, dst, src, chunksize);
++ if (nbytes < walk.total)
++ nbytes = round_down(nbytes, walk.stride);
+
+- skcipher_walk_done(&walk, 0);
++ ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
++ nbytes);
++
++ skcipher_walk_done(&walk, walk.nbytes - nbytes);
+ }
+ }
+
+diff --git a/crypto/aegis128l.c b/crypto/aegis128l.c
+index b6fb21ebdc3e..73811448cb6b 100644
+--- a/crypto/aegis128l.c
++++ b/crypto/aegis128l.c
+@@ -353,19 +353,19 @@ static void crypto_aegis128l_process_crypt(struct aegis_state *state,
+ const struct aegis128l_ops *ops)
+ {
+ struct skcipher_walk walk;
+- u8 *src, *dst;
+- unsigned int chunksize;
+
+ ops->skcipher_walk_init(&walk, req, false);
+
+ while (walk.nbytes) {
+- src = walk.src.virt.addr;
+- dst = walk.dst.virt.addr;
+- chunksize = walk.nbytes;
++ unsigned int nbytes = walk.nbytes;
+
+- ops->crypt_chunk(state, dst, src, chunksize);
++ if (nbytes < walk.total)
++ nbytes = round_down(nbytes, walk.stride);
+
+- skcipher_walk_done(&walk, 0);
++ ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
++ nbytes);
++
++ skcipher_walk_done(&walk, walk.nbytes - nbytes);
+ }
+ }
+
+diff --git a/crypto/aegis256.c b/crypto/aegis256.c
+index 11f0f8ec9c7c..8a71e9c06193 100644
+--- a/crypto/aegis256.c
++++ b/crypto/aegis256.c
+@@ -303,19 +303,19 @@ static void crypto_aegis256_process_crypt(struct aegis_state *state,
+ const struct aegis256_ops *ops)
+ {
+ struct skcipher_walk walk;
+- u8 *src, *dst;
+- unsigned int chunksize;
+
+ ops->skcipher_walk_init(&walk, req, false);
+
+ while (walk.nbytes) {
+- src = walk.src.virt.addr;
+- dst = walk.dst.virt.addr;
+- chunksize = walk.nbytes;
++ unsigned int nbytes = walk.nbytes;
+
+- ops->crypt_chunk(state, dst, src, chunksize);
++ if (nbytes < walk.total)
++ nbytes = round_down(nbytes, walk.stride);
+
+- skcipher_walk_done(&walk, 0);
++ ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
++ nbytes);
++
++ skcipher_walk_done(&walk, walk.nbytes - nbytes);
+ }
+ }
+
+diff --git a/crypto/ahash.c b/crypto/ahash.c
+index a64c143165b1..158e716f21a1 100644
+--- a/crypto/ahash.c
++++ b/crypto/ahash.c
+@@ -86,17 +86,17 @@ static int hash_walk_new_entry(struct crypto_hash_walk *walk)
+ int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err)
+ {
+ unsigned int alignmask = walk->alignmask;
+- unsigned int nbytes = walk->entrylen;
+
+ walk->data -= walk->offset;
+
+- if (nbytes && walk->offset & alignmask && !err) {
+- walk->offset = ALIGN(walk->offset, alignmask + 1);
+- nbytes = min(nbytes,
+- ((unsigned int)(PAGE_SIZE)) - walk->offset);
+- walk->entrylen -= nbytes;
++ if (walk->entrylen && (walk->offset & alignmask) && !err) {
++ unsigned int nbytes;
+
++ walk->offset = ALIGN(walk->offset, alignmask + 1);
++ nbytes = min(walk->entrylen,
++ (unsigned int)(PAGE_SIZE - walk->offset));
+ if (nbytes) {
++ walk->entrylen -= nbytes;
+ walk->data += walk->offset;
+ return nbytes;
+ }
+@@ -116,7 +116,7 @@ int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err)
+ if (err)
+ return err;
+
+- if (nbytes) {
++ if (walk->entrylen) {
+ walk->offset = 0;
+ walk->pg++;
+ return hash_walk_next(walk);
+@@ -190,6 +190,21 @@ static int ahash_setkey_unaligned(struct crypto_ahash *tfm, const u8 *key,
+ return ret;
+ }
+
++static int ahash_nosetkey(struct crypto_ahash *tfm, const u8 *key,
++ unsigned int keylen)
++{
++ return -ENOSYS;
++}
++
++static void ahash_set_needkey(struct crypto_ahash *tfm)
++{
++ const struct hash_alg_common *alg = crypto_hash_alg_common(tfm);
++
++ if (tfm->setkey != ahash_nosetkey &&
++ !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY))
++ crypto_ahash_set_flags(tfm, CRYPTO_TFM_NEED_KEY);
++}
++
+ int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key,
+ unsigned int keylen)
+ {
+@@ -201,20 +216,16 @@ int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key,
+ else
+ err = tfm->setkey(tfm, key, keylen);
+
+- if (err)
++ if (unlikely(err)) {
++ ahash_set_needkey(tfm);
+ return err;
++ }
+
+ crypto_ahash_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(crypto_ahash_setkey);
+
+-static int ahash_nosetkey(struct crypto_ahash *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- return -ENOSYS;
+-}
+-
+ static inline unsigned int ahash_align_buffer_size(unsigned len,
+ unsigned long mask)
+ {
+@@ -467,8 +478,7 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm)
+
+ if (alg->setkey) {
+ hash->setkey = alg->setkey;
+- if (!(alg->halg.base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY))
+- crypto_ahash_set_flags(hash, CRYPTO_TFM_NEED_KEY);
++ ahash_set_needkey(hash);
+ }
+
+ return 0;
+diff --git a/crypto/cfb.c b/crypto/cfb.c
+index e81e45673498..4abfe32ff845 100644
+--- a/crypto/cfb.c
++++ b/crypto/cfb.c
+@@ -77,12 +77,14 @@ static int crypto_cfb_encrypt_segment(struct skcipher_walk *walk,
+ do {
+ crypto_cfb_encrypt_one(tfm, iv, dst);
+ crypto_xor(dst, src, bsize);
+- memcpy(iv, dst, bsize);
++ iv = dst;
+
+ src += bsize;
+ dst += bsize;
+ } while ((nbytes -= bsize) >= bsize);
+
++ memcpy(walk->iv, iv, bsize);
++
+ return nbytes;
+ }
+
+@@ -162,7 +164,7 @@ static int crypto_cfb_decrypt_inplace(struct skcipher_walk *walk,
+ const unsigned int bsize = crypto_cfb_bsize(tfm);
+ unsigned int nbytes = walk->nbytes;
+ u8 *src = walk->src.virt.addr;
+- u8 *iv = walk->iv;
++ u8 * const iv = walk->iv;
+ u8 tmp[MAX_CIPHER_BLOCKSIZE];
+
+ do {
+@@ -172,8 +174,6 @@ static int crypto_cfb_decrypt_inplace(struct skcipher_walk *walk,
+ src += bsize;
+ } while ((nbytes -= bsize) >= bsize);
+
+- memcpy(walk->iv, iv, bsize);
+-
+ return nbytes;
+ }
+
+@@ -298,6 +298,12 @@ static int crypto_cfb_create(struct crypto_template *tmpl, struct rtattr **tb)
+ inst->alg.base.cra_blocksize = 1;
+ inst->alg.base.cra_alignmask = alg->cra_alignmask;
+
++ /*
++ * To simplify the implementation, configure the skcipher walk to only
++ * give a partial block at the very end, never earlier.
++ */
++ inst->alg.chunksize = alg->cra_blocksize;
++
+ inst->alg.ivsize = alg->cra_blocksize;
+ inst->alg.min_keysize = alg->cra_cipher.cia_min_keysize;
+ inst->alg.max_keysize = alg->cra_cipher.cia_max_keysize;
+diff --git a/crypto/morus1280.c b/crypto/morus1280.c
+index 3889c188f266..b83576b4eb55 100644
+--- a/crypto/morus1280.c
++++ b/crypto/morus1280.c
+@@ -366,18 +366,19 @@ static void crypto_morus1280_process_crypt(struct morus1280_state *state,
+ const struct morus1280_ops *ops)
+ {
+ struct skcipher_walk walk;
+- u8 *dst;
+- const u8 *src;
+
+ ops->skcipher_walk_init(&walk, req, false);
+
+ while (walk.nbytes) {
+- src = walk.src.virt.addr;
+- dst = walk.dst.virt.addr;
++ unsigned int nbytes = walk.nbytes;
+
+- ops->crypt_chunk(state, dst, src, walk.nbytes);
++ if (nbytes < walk.total)
++ nbytes = round_down(nbytes, walk.stride);
+
+- skcipher_walk_done(&walk, 0);
++ ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
++ nbytes);
++
++ skcipher_walk_done(&walk, walk.nbytes - nbytes);
+ }
+ }
+
+diff --git a/crypto/morus640.c b/crypto/morus640.c
+index da06ec2f6a80..b6a477444f6d 100644
+--- a/crypto/morus640.c
++++ b/crypto/morus640.c
+@@ -365,18 +365,19 @@ static void crypto_morus640_process_crypt(struct morus640_state *state,
+ const struct morus640_ops *ops)
+ {
+ struct skcipher_walk walk;
+- u8 *dst;
+- const u8 *src;
+
+ ops->skcipher_walk_init(&walk, req, false);
+
+ while (walk.nbytes) {
+- src = walk.src.virt.addr;
+- dst = walk.dst.virt.addr;
++ unsigned int nbytes = walk.nbytes;
+
+- ops->crypt_chunk(state, dst, src, walk.nbytes);
++ if (nbytes < walk.total)
++ nbytes = round_down(nbytes, walk.stride);
+
+- skcipher_walk_done(&walk, 0);
++ ops->crypt_chunk(state, walk.dst.virt.addr, walk.src.virt.addr,
++ nbytes);
++
++ skcipher_walk_done(&walk, walk.nbytes - nbytes);
+ }
+ }
+
+diff --git a/crypto/pcbc.c b/crypto/pcbc.c
+index 8aa10144407c..1b182dfedc94 100644
+--- a/crypto/pcbc.c
++++ b/crypto/pcbc.c
+@@ -51,7 +51,7 @@ static int crypto_pcbc_encrypt_segment(struct skcipher_request *req,
+ unsigned int nbytes = walk->nbytes;
+ u8 *src = walk->src.virt.addr;
+ u8 *dst = walk->dst.virt.addr;
+- u8 *iv = walk->iv;
++ u8 * const iv = walk->iv;
+
+ do {
+ crypto_xor(iv, src, bsize);
+@@ -72,7 +72,7 @@ static int crypto_pcbc_encrypt_inplace(struct skcipher_request *req,
+ int bsize = crypto_cipher_blocksize(tfm);
+ unsigned int nbytes = walk->nbytes;
+ u8 *src = walk->src.virt.addr;
+- u8 *iv = walk->iv;
++ u8 * const iv = walk->iv;
+ u8 tmpbuf[MAX_CIPHER_BLOCKSIZE];
+
+ do {
+@@ -84,8 +84,6 @@ static int crypto_pcbc_encrypt_inplace(struct skcipher_request *req,
+ src += bsize;
+ } while ((nbytes -= bsize) >= bsize);
+
+- memcpy(walk->iv, iv, bsize);
+-
+ return nbytes;
+ }
+
+@@ -121,7 +119,7 @@ static int crypto_pcbc_decrypt_segment(struct skcipher_request *req,
+ unsigned int nbytes = walk->nbytes;
+ u8 *src = walk->src.virt.addr;
+ u8 *dst = walk->dst.virt.addr;
+- u8 *iv = walk->iv;
++ u8 * const iv = walk->iv;
+
+ do {
+ crypto_cipher_decrypt_one(tfm, dst, src);
+@@ -132,8 +130,6 @@ static int crypto_pcbc_decrypt_segment(struct skcipher_request *req,
+ dst += bsize;
+ } while ((nbytes -= bsize) >= bsize);
+
+- memcpy(walk->iv, iv, bsize);
+-
+ return nbytes;
+ }
+
+@@ -144,7 +140,7 @@ static int crypto_pcbc_decrypt_inplace(struct skcipher_request *req,
+ int bsize = crypto_cipher_blocksize(tfm);
+ unsigned int nbytes = walk->nbytes;
+ u8 *src = walk->src.virt.addr;
+- u8 *iv = walk->iv;
++ u8 * const iv = walk->iv;
+ u8 tmpbuf[MAX_CIPHER_BLOCKSIZE] __aligned(__alignof__(u32));
+
+ do {
+@@ -156,8 +152,6 @@ static int crypto_pcbc_decrypt_inplace(struct skcipher_request *req,
+ src += bsize;
+ } while ((nbytes -= bsize) >= bsize);
+
+- memcpy(walk->iv, iv, bsize);
+-
+ return nbytes;
+ }
+
+diff --git a/crypto/shash.c b/crypto/shash.c
+index 5d732c6bb4b2..a04145e5306a 100644
+--- a/crypto/shash.c
++++ b/crypto/shash.c
+@@ -53,6 +53,13 @@ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key,
+ return err;
+ }
+
++static void shash_set_needkey(struct crypto_shash *tfm, struct shash_alg *alg)
++{
++ if (crypto_shash_alg_has_setkey(alg) &&
++ !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY))
++ crypto_shash_set_flags(tfm, CRYPTO_TFM_NEED_KEY);
++}
++
+ int crypto_shash_setkey(struct crypto_shash *tfm, const u8 *key,
+ unsigned int keylen)
+ {
+@@ -65,8 +72,10 @@ int crypto_shash_setkey(struct crypto_shash *tfm, const u8 *key,
+ else
+ err = shash->setkey(tfm, key, keylen);
+
+- if (err)
++ if (unlikely(err)) {
++ shash_set_needkey(tfm, shash);
+ return err;
++ }
+
+ crypto_shash_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
+ return 0;
+@@ -368,7 +377,8 @@ int crypto_init_shash_ops_async(struct crypto_tfm *tfm)
+ crt->final = shash_async_final;
+ crt->finup = shash_async_finup;
+ crt->digest = shash_async_digest;
+- crt->setkey = shash_async_setkey;
++ if (crypto_shash_alg_has_setkey(alg))
++ crt->setkey = shash_async_setkey;
+
+ crypto_ahash_set_flags(crt, crypto_shash_get_flags(shash) &
+ CRYPTO_TFM_NEED_KEY);
+@@ -390,9 +400,7 @@ static int crypto_shash_init_tfm(struct crypto_tfm *tfm)
+
+ hash->descsize = alg->descsize;
+
+- if (crypto_shash_alg_has_setkey(alg) &&
+- !(alg->base.cra_flags & CRYPTO_ALG_OPTIONAL_KEY))
+- crypto_shash_set_flags(hash, CRYPTO_TFM_NEED_KEY);
++ shash_set_needkey(hash, alg);
+
+ return 0;
+ }
+diff --git a/crypto/skcipher.c b/crypto/skcipher.c
+index 0bd8c6caa498..46bb300d418f 100644
+--- a/crypto/skcipher.c
++++ b/crypto/skcipher.c
+@@ -584,6 +584,12 @@ static unsigned int crypto_skcipher_extsize(struct crypto_alg *alg)
+ return crypto_alg_extsize(alg);
+ }
+
++static void skcipher_set_needkey(struct crypto_skcipher *tfm)
++{
++ if (tfm->keysize)
++ crypto_skcipher_set_flags(tfm, CRYPTO_TFM_NEED_KEY);
++}
++
+ static int skcipher_setkey_blkcipher(struct crypto_skcipher *tfm,
+ const u8 *key, unsigned int keylen)
+ {
+@@ -597,8 +603,10 @@ static int skcipher_setkey_blkcipher(struct crypto_skcipher *tfm,
+ err = crypto_blkcipher_setkey(blkcipher, key, keylen);
+ crypto_skcipher_set_flags(tfm, crypto_blkcipher_get_flags(blkcipher) &
+ CRYPTO_TFM_RES_MASK);
+- if (err)
++ if (unlikely(err)) {
++ skcipher_set_needkey(tfm);
+ return err;
++ }
+
+ crypto_skcipher_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
+ return 0;
+@@ -676,8 +684,7 @@ static int crypto_init_skcipher_ops_blkcipher(struct crypto_tfm *tfm)
+ skcipher->ivsize = crypto_blkcipher_ivsize(blkcipher);
+ skcipher->keysize = calg->cra_blkcipher.max_keysize;
+
+- if (skcipher->keysize)
+- crypto_skcipher_set_flags(skcipher, CRYPTO_TFM_NEED_KEY);
++ skcipher_set_needkey(skcipher);
+
+ return 0;
+ }
+@@ -697,8 +704,10 @@ static int skcipher_setkey_ablkcipher(struct crypto_skcipher *tfm,
+ crypto_skcipher_set_flags(tfm,
+ crypto_ablkcipher_get_flags(ablkcipher) &
+ CRYPTO_TFM_RES_MASK);
+- if (err)
++ if (unlikely(err)) {
++ skcipher_set_needkey(tfm);
+ return err;
++ }
+
+ crypto_skcipher_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
+ return 0;
+@@ -775,8 +784,7 @@ static int crypto_init_skcipher_ops_ablkcipher(struct crypto_tfm *tfm)
+ sizeof(struct ablkcipher_request);
+ skcipher->keysize = calg->cra_ablkcipher.max_keysize;
+
+- if (skcipher->keysize)
+- crypto_skcipher_set_flags(skcipher, CRYPTO_TFM_NEED_KEY);
++ skcipher_set_needkey(skcipher);
+
+ return 0;
+ }
+@@ -819,8 +827,10 @@ static int skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key,
+ else
+ err = cipher->setkey(tfm, key, keylen);
+
+- if (err)
++ if (unlikely(err)) {
++ skcipher_set_needkey(tfm);
+ return err;
++ }
+
+ crypto_skcipher_clear_flags(tfm, CRYPTO_TFM_NEED_KEY);
+ return 0;
+@@ -852,8 +862,7 @@ static int crypto_skcipher_init_tfm(struct crypto_tfm *tfm)
+ skcipher->ivsize = alg->ivsize;
+ skcipher->keysize = alg->max_keysize;
+
+- if (skcipher->keysize)
+- crypto_skcipher_set_flags(skcipher, CRYPTO_TFM_NEED_KEY);
++ skcipher_set_needkey(skcipher);
+
+ if (alg->exit)
+ skcipher->base.exit = crypto_skcipher_exit_tfm;
+diff --git a/crypto/testmgr.c b/crypto/testmgr.c
+index 54d882ffe438..3664c26f4838 100644
+--- a/crypto/testmgr.c
++++ b/crypto/testmgr.c
+@@ -1894,14 +1894,21 @@ static int alg_test_crc32c(const struct alg_test_desc *desc,
+
+ err = alg_test_hash(desc, driver, type, mask);
+ if (err)
+- goto out;
++ return err;
+
+ tfm = crypto_alloc_shash(driver, type, mask);
+ if (IS_ERR(tfm)) {
++ if (PTR_ERR(tfm) == -ENOENT) {
++ /*
++ * This crc32c implementation is only available through
++ * ahash API, not the shash API, so the remaining part
++ * of the test is not applicable to it.
++ */
++ return 0;
++ }
+ printk(KERN_ERR "alg: crc32c: Failed to load transform for %s: "
+ "%ld\n", driver, PTR_ERR(tfm));
+- err = PTR_ERR(tfm);
+- goto out;
++ return PTR_ERR(tfm);
+ }
+
+ do {
+@@ -1928,7 +1935,6 @@ static int alg_test_crc32c(const struct alg_test_desc *desc,
+
+ crypto_free_shash(tfm);
+
+-out:
+ return err;
+ }
+
+diff --git a/crypto/testmgr.h b/crypto/testmgr.h
+index 11e6f17fe724..862ee1d04263 100644
+--- a/crypto/testmgr.h
++++ b/crypto/testmgr.h
+@@ -11416,6 +11416,31 @@ static const struct cipher_testvec aes_cfb_tv_template[] = {
+ "\x75\xa3\x85\x74\x1a\xb9\xce\xf8"
+ "\x20\x31\x62\x3d\x55\xb1\xe4\x71",
+ .len = 64,
++ .also_non_np = 1,
++ .np = 2,
++ .tap = { 31, 33 },
++ }, { /* > 16 bytes, not a multiple of 16 bytes */
++ .key = "\x2b\x7e\x15\x16\x28\xae\xd2\xa6"
++ "\xab\xf7\x15\x88\x09\xcf\x4f\x3c",
++ .klen = 16,
++ .iv = "\x00\x01\x02\x03\x04\x05\x06\x07"
++ "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
++ .ptext = "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96"
++ "\xe9\x3d\x7e\x11\x73\x93\x17\x2a"
++ "\xae",
++ .ctext = "\x3b\x3f\xd9\x2e\xb7\x2d\xad\x20"
++ "\x33\x34\x49\xf8\xe8\x3c\xfb\x4a"
++ "\xc8",
++ .len = 17,
++ }, { /* < 16 bytes */
++ .key = "\x2b\x7e\x15\x16\x28\xae\xd2\xa6"
++ "\xab\xf7\x15\x88\x09\xcf\x4f\x3c",
++ .klen = 16,
++ .iv = "\x00\x01\x02\x03\x04\x05\x06\x07"
++ "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
++ .ptext = "\x6b\xc1\xbe\xe2\x2e\x40\x9f",
++ .ctext = "\x3b\x3f\xd9\x2e\xb7\x2d\xad",
++ .len = 7,
+ },
+ };
+
+diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
+index 545e91420cde..8940054d6250 100644
+--- a/drivers/acpi/device_sysfs.c
++++ b/drivers/acpi/device_sysfs.c
+@@ -202,11 +202,15 @@ static int create_of_modalias(struct acpi_device *acpi_dev, char *modalias,
+ {
+ struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER };
+ const union acpi_object *of_compatible, *obj;
++ acpi_status status;
+ int len, count;
+ int i, nval;
+ char *c;
+
+- acpi_get_name(acpi_dev->handle, ACPI_SINGLE_NAME, &buf);
++ status = acpi_get_name(acpi_dev->handle, ACPI_SINGLE_NAME, &buf);
++ if (ACPI_FAILURE(status))
++ return -ENODEV;
++
+ /* DT strings are all in lower case */
+ for (c = buf.pointer; *c != '\0'; c++)
+ *c = tolower(*c);
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index f530d3541242..df2175b1169a 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -397,7 +397,7 @@ static int cmd_to_func(struct nfit_mem *nfit_mem, unsigned int cmd,
+ if (call_pkg) {
+ int i;
+
+- if (nfit_mem->family != call_pkg->nd_family)
++ if (nfit_mem && nfit_mem->family != call_pkg->nd_family)
+ return -ENOTTY;
+
+ for (i = 0; i < ARRAY_SIZE(call_pkg->nd_reserved2); i++)
+@@ -406,6 +406,10 @@ static int cmd_to_func(struct nfit_mem *nfit_mem, unsigned int cmd,
+ return call_pkg->nd_command;
+ }
+
++ /* In the !call_pkg case, bus commands == bus functions */
++ if (!nfit_mem)
++ return cmd;
++
+ /* Linux ND commands == NVDIMM_FAMILY_INTEL function numbers */
+ if (nfit_mem->family == NVDIMM_FAMILY_INTEL)
+ return cmd;
+@@ -436,17 +440,18 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ if (cmd_rc)
+ *cmd_rc = -EINVAL;
+
++ if (cmd == ND_CMD_CALL)
++ call_pkg = buf;
++ func = cmd_to_func(nfit_mem, cmd, call_pkg);
++ if (func < 0)
++ return func;
++
+ if (nvdimm) {
+ struct acpi_device *adev = nfit_mem->adev;
+
+ if (!adev)
+ return -ENOTTY;
+
+- if (cmd == ND_CMD_CALL)
+- call_pkg = buf;
+- func = cmd_to_func(nfit_mem, cmd, call_pkg);
+- if (func < 0)
+- return func;
+ dimm_name = nvdimm_name(nvdimm);
+ cmd_name = nvdimm_cmd_name(cmd);
+ cmd_mask = nvdimm_cmd_mask(nvdimm);
+@@ -457,12 +462,9 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ } else {
+ struct acpi_device *adev = to_acpi_dev(acpi_desc);
+
+- func = cmd;
+ cmd_name = nvdimm_bus_cmd_name(cmd);
+ cmd_mask = nd_desc->cmd_mask;
+- dsm_mask = cmd_mask;
+- if (cmd == ND_CMD_CALL)
+- dsm_mask = nd_desc->bus_dsm_mask;
++ dsm_mask = nd_desc->bus_dsm_mask;
+ desc = nd_cmd_bus_desc(cmd);
+ guid = to_nfit_uuid(NFIT_DEV_BUS);
+ handle = adev->handle;
+@@ -533,6 +535,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ return -EINVAL;
+ }
+
++ if (out_obj->type != ACPI_TYPE_BUFFER) {
++ dev_dbg(dev, "%s unexpected output object type cmd: %s type: %d\n",
++ dimm_name, cmd_name, out_obj->type);
++ rc = -EINVAL;
++ goto out;
++ }
++
+ if (call_pkg) {
+ call_pkg->nd_fw_size = out_obj->buffer.length;
+ memcpy(call_pkg->nd_payload + call_pkg->nd_size_in,
+@@ -551,13 +560,6 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ return 0;
+ }
+
+- if (out_obj->package.type != ACPI_TYPE_BUFFER) {
+- dev_dbg(dev, "%s unexpected output object type cmd: %s type: %d\n",
+- dimm_name, cmd_name, out_obj->type);
+- rc = -EINVAL;
+- goto out;
+- }
+-
+ dev_dbg(dev, "%s cmd: %s output length: %d\n", dimm_name,
+ cmd_name, out_obj->buffer.length);
+ print_hex_dump_debug(cmd_name, DUMP_PREFIX_OFFSET, 4, 4,
+@@ -2890,14 +2892,16 @@ static int ars_register(struct acpi_nfit_desc *acpi_desc,
+ {
+ int rc;
+
+- if (no_init_ars || test_bit(ARS_FAILED, &nfit_spa->ars_state))
++ if (test_bit(ARS_FAILED, &nfit_spa->ars_state))
+ return acpi_nfit_register_region(acpi_desc, nfit_spa);
+
+ set_bit(ARS_REQ_SHORT, &nfit_spa->ars_state);
+- set_bit(ARS_REQ_LONG, &nfit_spa->ars_state);
++ if (!no_init_ars)
++ set_bit(ARS_REQ_LONG, &nfit_spa->ars_state);
+
+ switch (acpi_nfit_query_poison(acpi_desc)) {
+ case 0:
++ case -ENOSPC:
+ case -EAGAIN:
+ rc = ars_start(acpi_desc, nfit_spa, ARS_REQ_SHORT);
+ /* shouldn't happen, try again later */
+@@ -2922,7 +2926,6 @@ static int ars_register(struct acpi_nfit_desc *acpi_desc,
+ break;
+ case -EBUSY:
+ case -ENOMEM:
+- case -ENOSPC:
+ /*
+ * BIOS was using ARS, wait for it to complete (or
+ * resources to become available) and then perform our
+diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
+index a43276c76fc6..21393ec3b9a4 100644
+--- a/drivers/auxdisplay/ht16k33.c
++++ b/drivers/auxdisplay/ht16k33.c
+@@ -509,7 +509,7 @@ static int ht16k33_remove(struct i2c_client *client)
+ struct ht16k33_priv *priv = i2c_get_clientdata(client);
+ struct ht16k33_fbdev *fbdev = &priv->fbdev;
+
+- cancel_delayed_work(&fbdev->work);
++ cancel_delayed_work_sync(&fbdev->work);
+ unregister_framebuffer(fbdev->info);
+ framebuffer_release(fbdev->info);
+ free_page((unsigned long) fbdev->buffer);
+diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
+index 5fa1898755a3..7c84f64c74f7 100644
+--- a/drivers/base/power/wakeup.c
++++ b/drivers/base/power/wakeup.c
+@@ -118,7 +118,6 @@ void wakeup_source_drop(struct wakeup_source *ws)
+ if (!ws)
+ return;
+
+- del_timer_sync(&ws->timer);
+ __pm_relax(ws);
+ }
+ EXPORT_SYMBOL_GPL(wakeup_source_drop);
+@@ -205,6 +204,13 @@ void wakeup_source_remove(struct wakeup_source *ws)
+ list_del_rcu(&ws->entry);
+ raw_spin_unlock_irqrestore(&events_lock, flags);
+ synchronize_srcu(&wakeup_srcu);
++
++ del_timer_sync(&ws->timer);
++ /*
++ * Clear timer.function to make wakeup_source_not_registered() treat
++ * this wakeup source as not registered.
++ */
++ ws->timer.function = NULL;
+ }
+ EXPORT_SYMBOL_GPL(wakeup_source_remove);
+
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index fdabd0b74492..a8de56f1936d 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -4084,7 +4084,7 @@ static unsigned int floppy_check_events(struct gendisk *disk,
+
+ if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) {
+ if (lock_fdc(drive))
+- return -EINTR;
++ return 0;
+ poll_drive(false, 0);
+ process_fd_request();
+ }
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index 5faa917df1b6..82d831b103f9 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -2085,6 +2085,11 @@ static int try_smi_init(struct smi_info *new_smi)
+ WARN_ON(new_smi->io.dev->init_name != NULL);
+
+ out_err:
++ if (rv && new_smi->io.io_cleanup) {
++ new_smi->io.io_cleanup(&new_smi->io);
++ new_smi->io.io_cleanup = NULL;
++ }
++
+ kfree(init_name);
+ return rv;
+ }
+diff --git a/drivers/char/ipmi/ipmi_si_mem_io.c b/drivers/char/ipmi/ipmi_si_mem_io.c
+index 1b869d530884..638f4ab88f44 100644
+--- a/drivers/char/ipmi/ipmi_si_mem_io.c
++++ b/drivers/char/ipmi/ipmi_si_mem_io.c
+@@ -81,8 +81,6 @@ int ipmi_si_mem_setup(struct si_sm_io *io)
+ if (!addr)
+ return -ENODEV;
+
+- io->io_cleanup = mem_cleanup;
+-
+ /*
+ * Figure out the actual readb/readw/readl/etc routine to use based
+ * upon the register size.
+@@ -141,5 +139,8 @@ int ipmi_si_mem_setup(struct si_sm_io *io)
+ mem_region_cleanup(io, io->io_size);
+ return -EIO;
+ }
++
++ io->io_cleanup = mem_cleanup;
++
+ return 0;
+ }
+diff --git a/drivers/char/ipmi/ipmi_si_port_io.c b/drivers/char/ipmi/ipmi_si_port_io.c
+index ef6dffcea9fa..03924c32b6e9 100644
+--- a/drivers/char/ipmi/ipmi_si_port_io.c
++++ b/drivers/char/ipmi/ipmi_si_port_io.c
+@@ -68,8 +68,6 @@ int ipmi_si_port_setup(struct si_sm_io *io)
+ if (!addr)
+ return -ENODEV;
+
+- io->io_cleanup = port_cleanup;
+-
+ /*
+ * Figure out the actual inb/inw/inl/etc routine to use based
+ * upon the register size.
+@@ -109,5 +107,8 @@ int ipmi_si_port_setup(struct si_sm_io *io)
+ return -EIO;
+ }
+ }
++
++ io->io_cleanup = port_cleanup;
++
+ return 0;
+ }
+diff --git a/drivers/char/tpm/st33zp24/st33zp24.c b/drivers/char/tpm/st33zp24/st33zp24.c
+index abd675bec88c..694fc58888c1 100644
+--- a/drivers/char/tpm/st33zp24/st33zp24.c
++++ b/drivers/char/tpm/st33zp24/st33zp24.c
+@@ -436,7 +436,7 @@ static int st33zp24_send(struct tpm_chip *chip, unsigned char *buf,
+ goto out_err;
+ }
+
+- return len;
++ return 0;
+ out_err:
+ st33zp24_cancel(chip);
+ release_locality(chip);
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 1010cb79dcc6..43c3f9b87614 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -495,10 +495,19 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip,
+ if (rc < 0) {
+ if (rc != -EPIPE)
+ dev_err(&chip->dev,
+- "%s: tpm_send: error %d\n", __func__, rc);
++ "%s: send(): error %d\n", __func__, rc);
+ goto out;
+ }
+
++ /* A sanity check. send() should just return zero on success e.g.
++ * not the command length.
++ */
++ if (rc > 0) {
++ dev_warn(&chip->dev,
++ "%s: send(): invalid value %d\n", __func__, rc);
++ rc = 0;
++ }
++
+ if (chip->flags & TPM_CHIP_FLAG_IRQ)
+ goto out_recv;
+
+diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
+index 66a14526aaf4..a290b30a0c35 100644
+--- a/drivers/char/tpm/tpm_atmel.c
++++ b/drivers/char/tpm/tpm_atmel.c
+@@ -105,7 +105,7 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ iowrite8(buf[i], priv->iobase);
+ }
+
+- return count;
++ return 0;
+ }
+
+ static void tpm_atml_cancel(struct tpm_chip *chip)
+diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
+index 36952ef98f90..763fc7e6c005 100644
+--- a/drivers/char/tpm/tpm_crb.c
++++ b/drivers/char/tpm/tpm_crb.c
+@@ -287,19 +287,29 @@ static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+ struct crb_priv *priv = dev_get_drvdata(&chip->dev);
+ unsigned int expected;
+
+- /* sanity check */
+- if (count < 6)
++ /* A sanity check that the upper layer wants to get at least the header
++ * as that is the minimum size for any TPM response.
++ */
++ if (count < TPM_HEADER_SIZE)
+ return -EIO;
+
++ /* If this bit is set, according to the spec, the TPM is in
++ * unrecoverable condition.
++ */
+ if (ioread32(&priv->regs_t->ctrl_sts) & CRB_CTRL_STS_ERROR)
+ return -EIO;
+
+- memcpy_fromio(buf, priv->rsp, 6);
+- expected = be32_to_cpup((__be32 *) &buf[2]);
+- if (expected > count || expected < 6)
++ /* Read the first 8 bytes in order to get the length of the response.
++ * We read exactly a quad word in order to make sure that the remaining
++ * reads will be aligned.
++ */
++ memcpy_fromio(buf, priv->rsp, 8);
++
++ expected = be32_to_cpup((__be32 *)&buf[2]);
++ if (expected > count || expected < TPM_HEADER_SIZE)
+ return -EIO;
+
+- memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6);
++ memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8);
+
+ return expected;
+ }
+diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c
+index 95ce2e9ccdc6..32a8e27c5382 100644
+--- a/drivers/char/tpm/tpm_i2c_atmel.c
++++ b/drivers/char/tpm/tpm_i2c_atmel.c
+@@ -65,7 +65,11 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ dev_dbg(&chip->dev,
+ "%s(buf=%*ph len=%0zx) -> sts=%d\n", __func__,
+ (int)min_t(size_t, 64, len), buf, len, status);
+- return status;
++
++ if (status < 0)
++ return status;
++
++ return 0;
+ }
+
+ static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c
+index 9086edc9066b..977fd42daa1b 100644
+--- a/drivers/char/tpm/tpm_i2c_infineon.c
++++ b/drivers/char/tpm/tpm_i2c_infineon.c
+@@ -587,7 +587,7 @@ static int tpm_tis_i2c_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ /* go and do it */
+ iic_tpm_write(TPM_STS(tpm_dev.locality), &sts, 1);
+
+- return len;
++ return 0;
+ out_err:
+ tpm_tis_i2c_ready(chip);
+ /* The TPM needs some time to clean up here,
+diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c
+index f74f451baf6a..b8defdfdf2dc 100644
+--- a/drivers/char/tpm/tpm_i2c_nuvoton.c
++++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
+@@ -469,7 +469,7 @@ static int i2c_nuvoton_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ }
+
+ dev_dbg(dev, "%s() -> %zd\n", __func__, len);
+- return len;
++ return 0;
+ }
+
+ static bool i2c_nuvoton_req_canceled(struct tpm_chip *chip, u8 status)
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index 25f6e2665385..77e47dc5aacc 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -141,14 +141,14 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+ }
+
+ /**
+- * tpm_ibmvtpm_send - Send tpm request
+- *
++ * tpm_ibmvtpm_send() - Send a TPM command
+ * @chip: tpm chip struct
+ * @buf: buffer contains data to send
+ * @count: size of buffer
+ *
+ * Return:
+- * Number of bytes sent or < 0 on error.
++ * 0 on success,
++ * -errno on error
+ */
+ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ {
+@@ -194,7 +194,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ rc = 0;
+ ibmvtpm->tpm_processing_cmd = false;
+ } else
+- rc = count;
++ rc = 0;
+
+ spin_unlock(&ibmvtpm->rtce_lock);
+ return rc;
+diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
+index d8f10047fbba..97f6d4fe0aee 100644
+--- a/drivers/char/tpm/tpm_infineon.c
++++ b/drivers/char/tpm/tpm_infineon.c
+@@ -354,7 +354,7 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count)
+ for (i = 0; i < count; i++) {
+ wait_and_send(chip, buf[i]);
+ }
+- return count;
++ return 0;
+ }
+
+ static void tpm_inf_cancel(struct tpm_chip *chip)
+diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
+index 5d6cce74cd3f..9bee3c5eb4bf 100644
+--- a/drivers/char/tpm/tpm_nsc.c
++++ b/drivers/char/tpm/tpm_nsc.c
+@@ -226,7 +226,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
+ }
+ outb(NSC_COMMAND_EOC, priv->base + NSC_COMMAND);
+
+- return count;
++ return 0;
+ }
+
+ static void tpm_nsc_cancel(struct tpm_chip *chip)
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index d2345d9fd7b5..0eaea3a7b8f4 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -485,7 +485,7 @@ static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len)
+ goto out_err;
+ }
+ }
+- return len;
++ return 0;
+ out_err:
+ tpm_tis_ready(chip);
+ return rc;
+diff --git a/drivers/char/tpm/tpm_vtpm_proxy.c b/drivers/char/tpm/tpm_vtpm_proxy.c
+index 87a0ce47f201..ecbb63f8d231 100644
+--- a/drivers/char/tpm/tpm_vtpm_proxy.c
++++ b/drivers/char/tpm/tpm_vtpm_proxy.c
+@@ -335,7 +335,6 @@ static int vtpm_proxy_is_driver_command(struct tpm_chip *chip,
+ static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ {
+ struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
+- int rc = 0;
+
+ if (count > sizeof(proxy_dev->buffer)) {
+ dev_err(&chip->dev,
+@@ -366,7 +365,7 @@ static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count)
+
+ wake_up_interruptible(&proxy_dev->wq);
+
+- return rc;
++ return 0;
+ }
+
+ static void vtpm_proxy_tpm_op_cancel(struct tpm_chip *chip)
+diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c
+index b150f87f38f5..5a327eb7f63a 100644
+--- a/drivers/char/tpm/xen-tpmfront.c
++++ b/drivers/char/tpm/xen-tpmfront.c
+@@ -173,7 +173,7 @@ static int vtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ return -ETIME;
+ }
+
+- return count;
++ return 0;
+ }
+
+ static int vtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+diff --git a/drivers/clk/clk-twl6040.c b/drivers/clk/clk-twl6040.c
+index 25dfe050ae9f..4bd1b32a4f93 100644
+--- a/drivers/clk/clk-twl6040.c
++++ b/drivers/clk/clk-twl6040.c
+@@ -41,6 +41,43 @@ static int twl6040_pdmclk_is_prepared(struct clk_hw *hw)
+ return pdmclk->enabled;
+ }
+
++static int twl6040_pdmclk_reset_one_clock(struct twl6040_pdmclk *pdmclk,
++ unsigned int reg)
++{
++ const u8 reset_mask = TWL6040_HPLLRST; /* Same for HPPLL and LPPLL */
++ int ret;
++
++ ret = twl6040_set_bits(pdmclk->twl6040, reg, reset_mask);
++ if (ret < 0)
++ return ret;
++
++ ret = twl6040_clear_bits(pdmclk->twl6040, reg, reset_mask);
++ if (ret < 0)
++ return ret;
++
++ return 0;
++}
++
++/*
++ * TWL6040A2 Phoenix Audio IC erratum #6: "PDM Clock Generation Issue At
++ * Cold Temperature". This affects cold boot and deeper idle states it
++ * seems. The workaround consists of resetting HPPLL and LPPLL.
++ */
++static int twl6040_pdmclk_quirk_reset_clocks(struct twl6040_pdmclk *pdmclk)
++{
++ int ret;
++
++ ret = twl6040_pdmclk_reset_one_clock(pdmclk, TWL6040_REG_HPPLLCTL);
++ if (ret)
++ return ret;
++
++ ret = twl6040_pdmclk_reset_one_clock(pdmclk, TWL6040_REG_LPPLLCTL);
++ if (ret)
++ return ret;
++
++ return 0;
++}
++
+ static int twl6040_pdmclk_prepare(struct clk_hw *hw)
+ {
+ struct twl6040_pdmclk *pdmclk = container_of(hw, struct twl6040_pdmclk,
+@@ -48,8 +85,20 @@ static int twl6040_pdmclk_prepare(struct clk_hw *hw)
+ int ret;
+
+ ret = twl6040_power(pdmclk->twl6040, 1);
+- if (!ret)
+- pdmclk->enabled = 1;
++ if (ret)
++ return ret;
++
++ ret = twl6040_pdmclk_quirk_reset_clocks(pdmclk);
++ if (ret)
++ goto out_err;
++
++ pdmclk->enabled = 1;
++
++ return 0;
++
++out_err:
++ dev_err(pdmclk->dev, "%s: error %i\n", __func__, ret);
++ twl6040_power(pdmclk->twl6040, 0);
+
+ return ret;
+ }
+diff --git a/drivers/clk/ingenic/cgu.c b/drivers/clk/ingenic/cgu.c
+index 5ef7d9ba2195..b40160eb3372 100644
+--- a/drivers/clk/ingenic/cgu.c
++++ b/drivers/clk/ingenic/cgu.c
+@@ -426,16 +426,16 @@ ingenic_clk_round_rate(struct clk_hw *hw, unsigned long req_rate,
+ struct ingenic_clk *ingenic_clk = to_ingenic_clk(hw);
+ struct ingenic_cgu *cgu = ingenic_clk->cgu;
+ const struct ingenic_cgu_clk_info *clk_info;
+- long rate = *parent_rate;
++ unsigned int div = 1;
+
+ clk_info = &cgu->clock_info[ingenic_clk->idx];
+
+ if (clk_info->type & CGU_CLK_DIV)
+- rate /= ingenic_clk_calc_div(clk_info, *parent_rate, req_rate);
++ div = ingenic_clk_calc_div(clk_info, *parent_rate, req_rate);
+ else if (clk_info->type & CGU_CLK_FIXDIV)
+- rate /= clk_info->fixdiv.div;
++ div = clk_info->fixdiv.div;
+
+- return rate;
++ return DIV_ROUND_UP(*parent_rate, div);
+ }
+
+ static int
+@@ -455,7 +455,7 @@ ingenic_clk_set_rate(struct clk_hw *hw, unsigned long req_rate,
+
+ if (clk_info->type & CGU_CLK_DIV) {
+ div = ingenic_clk_calc_div(clk_info, parent_rate, req_rate);
+- rate = parent_rate / div;
++ rate = DIV_ROUND_UP(parent_rate, div);
+
+ if (rate != req_rate)
+ return -EINVAL;
+diff --git a/drivers/clk/ingenic/cgu.h b/drivers/clk/ingenic/cgu.h
+index 502bcbb61b04..e12716d8ce3c 100644
+--- a/drivers/clk/ingenic/cgu.h
++++ b/drivers/clk/ingenic/cgu.h
+@@ -80,7 +80,7 @@ struct ingenic_cgu_mux_info {
+ * @reg: offset of the divider control register within the CGU
+ * @shift: number of bits to left shift the divide value by (ie. the index of
+ * the lowest bit of the divide value within its control register)
+- * @div: number of bits to divide the divider value by (i.e. if the
++ * @div: number to divide the divider value by (i.e. if the
+ * effective divider value is the value written to the register
+ * multiplied by some constant)
+ * @bits: the size of the divide value in bits
+diff --git a/drivers/clk/samsung/clk-exynos5-subcmu.c b/drivers/clk/samsung/clk-exynos5-subcmu.c
+index 93306283d764..8ae44b5db4c2 100644
+--- a/drivers/clk/samsung/clk-exynos5-subcmu.c
++++ b/drivers/clk/samsung/clk-exynos5-subcmu.c
+@@ -136,15 +136,20 @@ static int __init exynos5_clk_register_subcmu(struct device *parent,
+ {
+ struct of_phandle_args genpdspec = { .np = pd_node };
+ struct platform_device *pdev;
++ int ret;
++
++ pdev = platform_device_alloc("exynos5-subcmu", PLATFORM_DEVID_AUTO);
++ if (!pdev)
++ return -ENOMEM;
+
+- pdev = platform_device_alloc(info->pd_name, -1);
+ pdev->dev.parent = parent;
+- pdev->driver_override = "exynos5-subcmu";
+ platform_set_drvdata(pdev, (void *)info);
+ of_genpd_add_device(&genpdspec, &pdev->dev);
+- platform_device_add(pdev);
++ ret = platform_device_add(pdev);
++ if (ret)
++ platform_device_put(pdev);
+
+- return 0;
++ return ret;
+ }
+
+ static int __init exynos5_clk_probe(struct platform_device *pdev)
+diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+index 3b97f60540ad..609970c0b666 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
++++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+@@ -264,9 +264,9 @@ static SUNXI_CCU_GATE(ahb1_mmc1_clk, "ahb1-mmc1", "ahb1",
+ static SUNXI_CCU_GATE(ahb1_mmc2_clk, "ahb1-mmc2", "ahb1",
+ 0x060, BIT(10), 0);
+ static SUNXI_CCU_GATE(ahb1_mmc3_clk, "ahb1-mmc3", "ahb1",
+- 0x060, BIT(12), 0);
++ 0x060, BIT(11), 0);
+ static SUNXI_CCU_GATE(ahb1_nand1_clk, "ahb1-nand1", "ahb1",
+- 0x060, BIT(13), 0);
++ 0x060, BIT(12), 0);
+ static SUNXI_CCU_GATE(ahb1_nand0_clk, "ahb1-nand0", "ahb1",
+ 0x060, BIT(13), 0);
+ static SUNXI_CCU_GATE(ahb1_sdram_clk, "ahb1-sdram", "ahb1",
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+index 621b1cd996db..ac12f261f8ca 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+@@ -542,7 +542,7 @@ static struct ccu_reset_map sun8i_v3s_ccu_resets[] = {
+ [RST_BUS_OHCI0] = { 0x2c0, BIT(29) },
+
+ [RST_BUS_VE] = { 0x2c4, BIT(0) },
+- [RST_BUS_TCON0] = { 0x2c4, BIT(3) },
++ [RST_BUS_TCON0] = { 0x2c4, BIT(4) },
+ [RST_BUS_CSI] = { 0x2c4, BIT(8) },
+ [RST_BUS_DE] = { 0x2c4, BIT(12) },
+ [RST_BUS_DBG] = { 0x2c4, BIT(31) },
+diff --git a/drivers/clk/uniphier/clk-uniphier-cpugear.c b/drivers/clk/uniphier/clk-uniphier-cpugear.c
+index ec11f55594ad..5d2d42b7e182 100644
+--- a/drivers/clk/uniphier/clk-uniphier-cpugear.c
++++ b/drivers/clk/uniphier/clk-uniphier-cpugear.c
+@@ -47,7 +47,7 @@ static int uniphier_clk_cpugear_set_parent(struct clk_hw *hw, u8 index)
+ return ret;
+
+ ret = regmap_write_bits(gear->regmap,
+- gear->regbase + UNIPHIER_CLK_CPUGEAR_SET,
++ gear->regbase + UNIPHIER_CLK_CPUGEAR_UPD,
+ UNIPHIER_CLK_CPUGEAR_UPD_BIT,
+ UNIPHIER_CLK_CPUGEAR_UPD_BIT);
+ if (ret)
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index 316d48d7be72..c1ddafa4c299 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -365,6 +365,16 @@ config ARM64_ERRATUM_858921
+ The workaround will be dynamically enabled when an affected
+ core is detected.
+
++config SUN50I_ERRATUM_UNKNOWN1
++ bool "Workaround for Allwinner A64 erratum UNKNOWN1"
++ default y
++ depends on ARM_ARCH_TIMER && ARM64 && ARCH_SUNXI
++ select ARM_ARCH_TIMER_OOL_WORKAROUND
++ help
++ This option enables a workaround for instability in the timer on
++ the Allwinner A64 SoC. The workaround will only be active if the
++ allwinner,erratum-unknown1 property is found in the timer node.
++
+ config ARM_GLOBAL_TIMER
+ bool "Support for the ARM global timer" if COMPILE_TEST
+ select TIMER_OF if OF
+diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
+index d8c7f5750cdb..0445ad7e559e 100644
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -319,6 +319,48 @@ static u64 notrace arm64_858921_read_cntvct_el0(void)
+ }
+ #endif
+
++#ifdef CONFIG_SUN50I_ERRATUM_UNKNOWN1
++/*
++ * The low bits of the counter registers are indeterminate while bit 10 or
++ * greater is rolling over. Since the counter value can jump both backward
++ * (7ff -> 000 -> 800) and forward (7ff -> fff -> 800), ignore register values
++ * with all ones or all zeros in the low bits. Bound the loop by the maximum
++ * number of CPU cycles in 3 consecutive 24 MHz counter periods.
++ */
++#define __sun50i_a64_read_reg(reg) ({ \
++ u64 _val; \
++ int _retries = 150; \
++ \
++ do { \
++ _val = read_sysreg(reg); \
++ _retries--; \
++ } while (((_val + 1) & GENMASK(9, 0)) <= 1 && _retries); \
++ \
++ WARN_ON_ONCE(!_retries); \
++ _val; \
++})
++
++static u64 notrace sun50i_a64_read_cntpct_el0(void)
++{
++ return __sun50i_a64_read_reg(cntpct_el0);
++}
++
++static u64 notrace sun50i_a64_read_cntvct_el0(void)
++{
++ return __sun50i_a64_read_reg(cntvct_el0);
++}
++
++static u32 notrace sun50i_a64_read_cntp_tval_el0(void)
++{
++ return read_sysreg(cntp_cval_el0) - sun50i_a64_read_cntpct_el0();
++}
++
++static u32 notrace sun50i_a64_read_cntv_tval_el0(void)
++{
++ return read_sysreg(cntv_cval_el0) - sun50i_a64_read_cntvct_el0();
++}
++#endif
++
+ #ifdef CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND
+ DEFINE_PER_CPU(const struct arch_timer_erratum_workaround *, timer_unstable_counter_workaround);
+ EXPORT_SYMBOL_GPL(timer_unstable_counter_workaround);
+@@ -408,6 +450,19 @@ static const struct arch_timer_erratum_workaround ool_workarounds[] = {
+ .read_cntvct_el0 = arm64_858921_read_cntvct_el0,
+ },
+ #endif
++#ifdef CONFIG_SUN50I_ERRATUM_UNKNOWN1
++ {
++ .match_type = ate_match_dt,
++ .id = "allwinner,erratum-unknown1",
++ .desc = "Allwinner erratum UNKNOWN1",
++ .read_cntp_tval_el0 = sun50i_a64_read_cntp_tval_el0,
++ .read_cntv_tval_el0 = sun50i_a64_read_cntv_tval_el0,
++ .read_cntpct_el0 = sun50i_a64_read_cntpct_el0,
++ .read_cntvct_el0 = sun50i_a64_read_cntvct_el0,
++ .set_next_event_phys = erratum_set_next_event_tval_phys,
++ .set_next_event_virt = erratum_set_next_event_tval_virt,
++ },
++#endif
+ };
+
+ typedef bool (*ate_match_fn_t)(const struct arch_timer_erratum_workaround *,
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index 7a244b681876..d55c30f6981d 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -388,6 +388,13 @@ static void exynos4_mct_tick_start(unsigned long cycles,
+ exynos4_mct_write(tmp, mevt->base + MCT_L_TCON_OFFSET);
+ }
+
++static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt)
++{
++ /* Clear the MCT tick interrupt */
++ if (readl_relaxed(reg_base + mevt->base + MCT_L_INT_CSTAT_OFFSET) & 1)
++ exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET);
++}
++
+ static int exynos4_tick_set_next_event(unsigned long cycles,
+ struct clock_event_device *evt)
+ {
+@@ -404,6 +411,7 @@ static int set_state_shutdown(struct clock_event_device *evt)
+
+ mevt = container_of(evt, struct mct_clock_event_device, evt);
+ exynos4_mct_tick_stop(mevt);
++ exynos4_mct_tick_clear(mevt);
+ return 0;
+ }
+
+@@ -420,8 +428,11 @@ static int set_state_periodic(struct clock_event_device *evt)
+ return 0;
+ }
+
+-static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt)
++static irqreturn_t exynos4_mct_tick_isr(int irq, void *dev_id)
+ {
++ struct mct_clock_event_device *mevt = dev_id;
++ struct clock_event_device *evt = &mevt->evt;
++
+ /*
+ * This is for supporting oneshot mode.
+ * Mct would generate interrupt periodically
+@@ -430,16 +441,6 @@ static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt)
+ if (!clockevent_state_periodic(&mevt->evt))
+ exynos4_mct_tick_stop(mevt);
+
+- /* Clear the MCT tick interrupt */
+- if (readl_relaxed(reg_base + mevt->base + MCT_L_INT_CSTAT_OFFSET) & 1)
+- exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET);
+-}
+-
+-static irqreturn_t exynos4_mct_tick_isr(int irq, void *dev_id)
+-{
+- struct mct_clock_event_device *mevt = dev_id;
+- struct clock_event_device *evt = &mevt->evt;
+-
+ exynos4_mct_tick_clear(mevt);
+
+ evt->event_handler(evt);
+diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c
+index 4cce6b224b87..3ecf84706640 100644
+--- a/drivers/clocksource/timer-ti-dm.c
++++ b/drivers/clocksource/timer-ti-dm.c
+@@ -154,6 +154,10 @@ static int omap_dm_timer_of_set_source(struct omap_dm_timer *timer)
+ if (IS_ERR(parent))
+ return -ENODEV;
+
++ /* Bail out if both clocks point to fck */
++ if (clk_is_match(parent, timer->fclk))
++ return 0;
++
+ ret = clk_set_parent(timer->fclk, parent);
+ if (ret < 0)
+ pr_err("%s: failed to set parent\n", __func__);
+diff --git a/drivers/cpufreq/pxa2xx-cpufreq.c b/drivers/cpufreq/pxa2xx-cpufreq.c
+index 46254e583982..74e0e0c20c46 100644
+--- a/drivers/cpufreq/pxa2xx-cpufreq.c
++++ b/drivers/cpufreq/pxa2xx-cpufreq.c
+@@ -143,7 +143,7 @@ static int pxa_cpufreq_change_voltage(const struct pxa_freqs *pxa_freq)
+ return ret;
+ }
+
+-static void __init pxa_cpufreq_init_voltages(void)
++static void pxa_cpufreq_init_voltages(void)
+ {
+ vcc_core = regulator_get(NULL, "vcc_core");
+ if (IS_ERR(vcc_core)) {
+@@ -159,7 +159,7 @@ static int pxa_cpufreq_change_voltage(const struct pxa_freqs *pxa_freq)
+ return 0;
+ }
+
+-static void __init pxa_cpufreq_init_voltages(void) { }
++static void pxa_cpufreq_init_voltages(void) { }
+ #endif
+
+ static void find_freq_tables(struct cpufreq_frequency_table **freq_table,
+diff --git a/drivers/cpufreq/qcom-cpufreq-kryo.c b/drivers/cpufreq/qcom-cpufreq-kryo.c
+index 2a3675c24032..a472b814058f 100644
+--- a/drivers/cpufreq/qcom-cpufreq-kryo.c
++++ b/drivers/cpufreq/qcom-cpufreq-kryo.c
+@@ -75,7 +75,7 @@ static enum _msm8996_version qcom_cpufreq_kryo_get_msm_id(void)
+
+ static int qcom_cpufreq_kryo_probe(struct platform_device *pdev)
+ {
+- struct opp_table *opp_tables[NR_CPUS] = {0};
++ struct opp_table **opp_tables;
+ enum _msm8996_version msm8996_version;
+ struct nvmem_cell *speedbin_nvmem;
+ struct device_node *np;
+@@ -133,6 +133,10 @@ static int qcom_cpufreq_kryo_probe(struct platform_device *pdev)
+ }
+ kfree(speedbin);
+
++ opp_tables = kcalloc(num_possible_cpus(), sizeof(*opp_tables), GFP_KERNEL);
++ if (!opp_tables)
++ return -ENOMEM;
++
+ for_each_possible_cpu(cpu) {
+ cpu_dev = get_cpu_device(cpu);
+ if (NULL == cpu_dev) {
+@@ -151,8 +155,10 @@ static int qcom_cpufreq_kryo_probe(struct platform_device *pdev)
+
+ cpufreq_dt_pdev = platform_device_register_simple("cpufreq-dt", -1,
+ NULL, 0);
+- if (!IS_ERR(cpufreq_dt_pdev))
++ if (!IS_ERR(cpufreq_dt_pdev)) {
++ platform_set_drvdata(pdev, opp_tables);
+ return 0;
++ }
+
+ ret = PTR_ERR(cpufreq_dt_pdev);
+ dev_err(cpu_dev, "Failed to register platform device\n");
+@@ -163,13 +169,23 @@ free_opp:
+ break;
+ dev_pm_opp_put_supported_hw(opp_tables[cpu]);
+ }
++ kfree(opp_tables);
+
+ return ret;
+ }
+
+ static int qcom_cpufreq_kryo_remove(struct platform_device *pdev)
+ {
++ struct opp_table **opp_tables = platform_get_drvdata(pdev);
++ unsigned int cpu;
++
+ platform_device_unregister(cpufreq_dt_pdev);
++
++ for_each_possible_cpu(cpu)
++ dev_pm_opp_put_supported_hw(opp_tables[cpu]);
++
++ kfree(opp_tables);
++
+ return 0;
+ }
+
+diff --git a/drivers/cpufreq/tegra124-cpufreq.c b/drivers/cpufreq/tegra124-cpufreq.c
+index 43530254201a..4bb154f6c54c 100644
+--- a/drivers/cpufreq/tegra124-cpufreq.c
++++ b/drivers/cpufreq/tegra124-cpufreq.c
+@@ -134,6 +134,8 @@ static int tegra124_cpufreq_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, priv);
+
++ of_node_put(np);
++
+ return 0;
+
+ out_switch_to_pllx:
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index ec40f991e6c6..9bc54c3c2cb9 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -1005,6 +1005,7 @@ static void init_aead_job(struct aead_request *req,
+ if (unlikely(req->src != req->dst)) {
+ if (edesc->dst_nents == 1) {
+ dst_dma = sg_dma_address(req->dst);
++ out_options = 0;
+ } else {
+ dst_dma = edesc->sec4_sg_dma +
+ sec4_sg_index *
+diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
+index f84ca2ff61de..f5fd00065650 100644
+--- a/drivers/crypto/caam/caamhash.c
++++ b/drivers/crypto/caam/caamhash.c
+@@ -118,6 +118,7 @@ struct caam_hash_ctx {
+ struct caam_hash_state {
+ dma_addr_t buf_dma;
+ dma_addr_t ctx_dma;
++ int ctx_dma_len;
+ u8 buf_0[CAAM_MAX_HASH_BLOCK_SIZE] ____cacheline_aligned;
+ int buflen_0;
+ u8 buf_1[CAAM_MAX_HASH_BLOCK_SIZE] ____cacheline_aligned;
+@@ -170,6 +171,7 @@ static inline int map_seq_out_ptr_ctx(u32 *desc, struct device *jrdev,
+ struct caam_hash_state *state,
+ int ctx_len)
+ {
++ state->ctx_dma_len = ctx_len;
+ state->ctx_dma = dma_map_single(jrdev, state->caam_ctx,
+ ctx_len, DMA_FROM_DEVICE);
+ if (dma_mapping_error(jrdev, state->ctx_dma)) {
+@@ -183,18 +185,6 @@ static inline int map_seq_out_ptr_ctx(u32 *desc, struct device *jrdev,
+ return 0;
+ }
+
+-/* Map req->result, and append seq_out_ptr command that points to it */
+-static inline dma_addr_t map_seq_out_ptr_result(u32 *desc, struct device *jrdev,
+- u8 *result, int digestsize)
+-{
+- dma_addr_t dst_dma;
+-
+- dst_dma = dma_map_single(jrdev, result, digestsize, DMA_FROM_DEVICE);
+- append_seq_out_ptr(desc, dst_dma, digestsize, 0);
+-
+- return dst_dma;
+-}
+-
+ /* Map current buffer in state (if length > 0) and put it in link table */
+ static inline int buf_map_to_sec4_sg(struct device *jrdev,
+ struct sec4_sg_entry *sec4_sg,
+@@ -223,6 +213,7 @@ static inline int ctx_map_to_sec4_sg(struct device *jrdev,
+ struct caam_hash_state *state, int ctx_len,
+ struct sec4_sg_entry *sec4_sg, u32 flag)
+ {
++ state->ctx_dma_len = ctx_len;
+ state->ctx_dma = dma_map_single(jrdev, state->caam_ctx, ctx_len, flag);
+ if (dma_mapping_error(jrdev, state->ctx_dma)) {
+ dev_err(jrdev, "unable to map ctx\n");
+@@ -485,7 +476,6 @@ static int ahash_setkey(struct crypto_ahash *ahash,
+
+ /*
+ * ahash_edesc - s/w-extended ahash descriptor
+- * @dst_dma: physical mapped address of req->result
+ * @sec4_sg_dma: physical mapped address of h/w link table
+ * @src_nents: number of segments in input scatterlist
+ * @sec4_sg_bytes: length of dma mapped sec4_sg space
+@@ -493,7 +483,6 @@ static int ahash_setkey(struct crypto_ahash *ahash,
+ * @sec4_sg: h/w link table
+ */
+ struct ahash_edesc {
+- dma_addr_t dst_dma;
+ dma_addr_t sec4_sg_dma;
+ int src_nents;
+ int sec4_sg_bytes;
+@@ -509,8 +498,6 @@ static inline void ahash_unmap(struct device *dev,
+
+ if (edesc->src_nents)
+ dma_unmap_sg(dev, req->src, edesc->src_nents, DMA_TO_DEVICE);
+- if (edesc->dst_dma)
+- dma_unmap_single(dev, edesc->dst_dma, dst_len, DMA_FROM_DEVICE);
+
+ if (edesc->sec4_sg_bytes)
+ dma_unmap_single(dev, edesc->sec4_sg_dma,
+@@ -527,12 +514,10 @@ static inline void ahash_unmap_ctx(struct device *dev,
+ struct ahash_edesc *edesc,
+ struct ahash_request *req, int dst_len, u32 flag)
+ {
+- struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
+- struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash);
+ struct caam_hash_state *state = ahash_request_ctx(req);
+
+ if (state->ctx_dma) {
+- dma_unmap_single(dev, state->ctx_dma, ctx->ctx_len, flag);
++ dma_unmap_single(dev, state->ctx_dma, state->ctx_dma_len, flag);
+ state->ctx_dma = 0;
+ }
+ ahash_unmap(dev, edesc, req, dst_len);
+@@ -545,9 +530,9 @@ static void ahash_done(struct device *jrdev, u32 *desc, u32 err,
+ struct ahash_edesc *edesc;
+ struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
+ int digestsize = crypto_ahash_digestsize(ahash);
++ struct caam_hash_state *state = ahash_request_ctx(req);
+ #ifdef DEBUG
+ struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash);
+- struct caam_hash_state *state = ahash_request_ctx(req);
+
+ dev_err(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err);
+ #endif
+@@ -556,17 +541,14 @@ static void ahash_done(struct device *jrdev, u32 *desc, u32 err,
+ if (err)
+ caam_jr_strstatus(jrdev, err);
+
+- ahash_unmap(jrdev, edesc, req, digestsize);
++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
++ memcpy(req->result, state->caam_ctx, digestsize);
+ kfree(edesc);
+
+ #ifdef DEBUG
+ print_hex_dump(KERN_ERR, "ctx@"__stringify(__LINE__)": ",
+ DUMP_PREFIX_ADDRESS, 16, 4, state->caam_ctx,
+ ctx->ctx_len, 1);
+- if (req->result)
+- print_hex_dump(KERN_ERR, "result@"__stringify(__LINE__)": ",
+- DUMP_PREFIX_ADDRESS, 16, 4, req->result,
+- digestsize, 1);
+ #endif
+
+ req->base.complete(&req->base, err);
+@@ -614,9 +596,9 @@ static void ahash_done_ctx_src(struct device *jrdev, u32 *desc, u32 err,
+ struct ahash_edesc *edesc;
+ struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
+ int digestsize = crypto_ahash_digestsize(ahash);
++ struct caam_hash_state *state = ahash_request_ctx(req);
+ #ifdef DEBUG
+ struct caam_hash_ctx *ctx = crypto_ahash_ctx(ahash);
+- struct caam_hash_state *state = ahash_request_ctx(req);
+
+ dev_err(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err);
+ #endif
+@@ -625,17 +607,14 @@ static void ahash_done_ctx_src(struct device *jrdev, u32 *desc, u32 err,
+ if (err)
+ caam_jr_strstatus(jrdev, err);
+
+- ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_TO_DEVICE);
++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_BIDIRECTIONAL);
++ memcpy(req->result, state->caam_ctx, digestsize);
+ kfree(edesc);
+
+ #ifdef DEBUG
+ print_hex_dump(KERN_ERR, "ctx@"__stringify(__LINE__)": ",
+ DUMP_PREFIX_ADDRESS, 16, 4, state->caam_ctx,
+ ctx->ctx_len, 1);
+- if (req->result)
+- print_hex_dump(KERN_ERR, "result@"__stringify(__LINE__)": ",
+- DUMP_PREFIX_ADDRESS, 16, 4, req->result,
+- digestsize, 1);
+ #endif
+
+ req->base.complete(&req->base, err);
+@@ -896,7 +875,7 @@ static int ahash_final_ctx(struct ahash_request *req)
+ edesc->sec4_sg_bytes = sec4_sg_bytes;
+
+ ret = ctx_map_to_sec4_sg(jrdev, state, ctx->ctx_len,
+- edesc->sec4_sg, DMA_TO_DEVICE);
++ edesc->sec4_sg, DMA_BIDIRECTIONAL);
+ if (ret)
+ goto unmap_ctx;
+
+@@ -916,14 +895,7 @@ static int ahash_final_ctx(struct ahash_request *req)
+
+ append_seq_in_ptr(desc, edesc->sec4_sg_dma, ctx->ctx_len + buflen,
+ LDST_SGF);
+-
+- edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
+- digestsize);
+- if (dma_mapping_error(jrdev, edesc->dst_dma)) {
+- dev_err(jrdev, "unable to map dst\n");
+- ret = -ENOMEM;
+- goto unmap_ctx;
+- }
++ append_seq_out_ptr(desc, state->ctx_dma, digestsize, 0);
+
+ #ifdef DEBUG
+ print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
+@@ -936,7 +908,7 @@ static int ahash_final_ctx(struct ahash_request *req)
+
+ return -EINPROGRESS;
+ unmap_ctx:
+- ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_BIDIRECTIONAL);
+ kfree(edesc);
+ return ret;
+ }
+@@ -990,7 +962,7 @@ static int ahash_finup_ctx(struct ahash_request *req)
+ edesc->src_nents = src_nents;
+
+ ret = ctx_map_to_sec4_sg(jrdev, state, ctx->ctx_len,
+- edesc->sec4_sg, DMA_TO_DEVICE);
++ edesc->sec4_sg, DMA_BIDIRECTIONAL);
+ if (ret)
+ goto unmap_ctx;
+
+@@ -1004,13 +976,7 @@ static int ahash_finup_ctx(struct ahash_request *req)
+ if (ret)
+ goto unmap_ctx;
+
+- edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
+- digestsize);
+- if (dma_mapping_error(jrdev, edesc->dst_dma)) {
+- dev_err(jrdev, "unable to map dst\n");
+- ret = -ENOMEM;
+- goto unmap_ctx;
+- }
++ append_seq_out_ptr(desc, state->ctx_dma, digestsize, 0);
+
+ #ifdef DEBUG
+ print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
+@@ -1023,7 +989,7 @@ static int ahash_finup_ctx(struct ahash_request *req)
+
+ return -EINPROGRESS;
+ unmap_ctx:
+- ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_BIDIRECTIONAL);
+ kfree(edesc);
+ return ret;
+ }
+@@ -1082,10 +1048,8 @@ static int ahash_digest(struct ahash_request *req)
+
+ desc = edesc->hw_desc;
+
+- edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
+- digestsize);
+- if (dma_mapping_error(jrdev, edesc->dst_dma)) {
+- dev_err(jrdev, "unable to map dst\n");
++ ret = map_seq_out_ptr_ctx(desc, jrdev, state, digestsize);
++ if (ret) {
+ ahash_unmap(jrdev, edesc, req, digestsize);
+ kfree(edesc);
+ return -ENOMEM;
+@@ -1100,7 +1064,7 @@ static int ahash_digest(struct ahash_request *req)
+ if (!ret) {
+ ret = -EINPROGRESS;
+ } else {
+- ahash_unmap(jrdev, edesc, req, digestsize);
++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
+ kfree(edesc);
+ }
+
+@@ -1142,12 +1106,9 @@ static int ahash_final_no_ctx(struct ahash_request *req)
+ append_seq_in_ptr(desc, state->buf_dma, buflen, 0);
+ }
+
+- edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
+- digestsize);
+- if (dma_mapping_error(jrdev, edesc->dst_dma)) {
+- dev_err(jrdev, "unable to map dst\n");
++ ret = map_seq_out_ptr_ctx(desc, jrdev, state, digestsize);
++ if (ret)
+ goto unmap;
+- }
+
+ #ifdef DEBUG
+ print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
+@@ -1158,7 +1119,7 @@ static int ahash_final_no_ctx(struct ahash_request *req)
+ if (!ret) {
+ ret = -EINPROGRESS;
+ } else {
+- ahash_unmap(jrdev, edesc, req, digestsize);
++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
+ kfree(edesc);
+ }
+
+@@ -1357,12 +1318,9 @@ static int ahash_finup_no_ctx(struct ahash_request *req)
+ goto unmap;
+ }
+
+- edesc->dst_dma = map_seq_out_ptr_result(desc, jrdev, req->result,
+- digestsize);
+- if (dma_mapping_error(jrdev, edesc->dst_dma)) {
+- dev_err(jrdev, "unable to map dst\n");
++ ret = map_seq_out_ptr_ctx(desc, jrdev, state, digestsize);
++ if (ret)
+ goto unmap;
+- }
+
+ #ifdef DEBUG
+ print_hex_dump(KERN_ERR, "jobdesc@"__stringify(__LINE__)": ",
+@@ -1373,7 +1331,7 @@ static int ahash_finup_no_ctx(struct ahash_request *req)
+ if (!ret) {
+ ret = -EINPROGRESS;
+ } else {
+- ahash_unmap(jrdev, edesc, req, digestsize);
++ ahash_unmap_ctx(jrdev, edesc, req, digestsize, DMA_FROM_DEVICE);
+ kfree(edesc);
+ }
+
+@@ -1505,6 +1463,7 @@ static int ahash_init(struct ahash_request *req)
+ state->final = ahash_final_no_ctx;
+
+ state->ctx_dma = 0;
++ state->ctx_dma_len = 0;
+ state->current_buf = 0;
+ state->buf_dma = 0;
+ state->buflen_0 = 0;
+diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c
+index dd948e1df9e5..3bcb6bce666e 100644
+--- a/drivers/crypto/ccree/cc_buffer_mgr.c
++++ b/drivers/crypto/ccree/cc_buffer_mgr.c
+@@ -614,10 +614,10 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req)
+ hw_iv_size, DMA_BIDIRECTIONAL);
+ }
+
+- /*In case a pool was set, a table was
+- *allocated and should be released
+- */
+- if (areq_ctx->mlli_params.curr_pool) {
++ /* Release pool */
++ if ((areq_ctx->assoc_buff_type == CC_DMA_BUF_MLLI ||
++ areq_ctx->data_buff_type == CC_DMA_BUF_MLLI) &&
++ (areq_ctx->mlli_params.mlli_virt_addr)) {
+ dev_dbg(dev, "free MLLI buffer: dma=%pad virt=%pK\n",
+ &areq_ctx->mlli_params.mlli_dma_addr,
+ areq_ctx->mlli_params.mlli_virt_addr);
+diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c
+index 7623b29911af..54a39164aab8 100644
+--- a/drivers/crypto/ccree/cc_cipher.c
++++ b/drivers/crypto/ccree/cc_cipher.c
+@@ -79,6 +79,7 @@ static int validate_keys_sizes(struct cc_cipher_ctx *ctx_p, u32 size)
+ default:
+ break;
+ }
++ break;
+ case S_DIN_to_DES:
+ if (size == DES3_EDE_KEY_SIZE || size == DES_KEY_SIZE)
+ return 0;
+@@ -634,6 +635,8 @@ static void cc_cipher_complete(struct device *dev, void *cc_req, int err)
+ unsigned int ivsize = crypto_skcipher_ivsize(sk_tfm);
+ unsigned int len;
+
++ cc_unmap_cipher_request(dev, req_ctx, ivsize, src, dst);
++
+ switch (ctx_p->cipher_mode) {
+ case DRV_CIPHER_CBC:
+ /*
+@@ -663,7 +666,6 @@ static void cc_cipher_complete(struct device *dev, void *cc_req, int err)
+ break;
+ }
+
+- cc_unmap_cipher_request(dev, req_ctx, ivsize, src, dst);
+ kzfree(req_ctx->iv);
+
+ skcipher_request_complete(req, err);
+@@ -781,7 +783,8 @@ static int cc_cipher_decrypt(struct skcipher_request *req)
+
+ memset(req_ctx, 0, sizeof(*req_ctx));
+
+- if (ctx_p->cipher_mode == DRV_CIPHER_CBC) {
++ if ((ctx_p->cipher_mode == DRV_CIPHER_CBC) &&
++ (req->cryptlen >= ivsize)) {
+
+ /* Allocate and save the last IV sized bytes of the source,
+ * which will be lost in case of in-place decryption.
+diff --git a/drivers/crypto/rockchip/rk3288_crypto.c b/drivers/crypto/rockchip/rk3288_crypto.c
+index c9d622abd90c..0ce4a65b95f5 100644
+--- a/drivers/crypto/rockchip/rk3288_crypto.c
++++ b/drivers/crypto/rockchip/rk3288_crypto.c
+@@ -119,7 +119,7 @@ static int rk_load_data(struct rk_crypto_info *dev,
+ count = (dev->left_bytes > PAGE_SIZE) ?
+ PAGE_SIZE : dev->left_bytes;
+
+- if (!sg_pcopy_to_buffer(dev->first, dev->nents,
++ if (!sg_pcopy_to_buffer(dev->first, dev->src_nents,
+ dev->addr_vir, count,
+ dev->total - dev->left_bytes)) {
+ dev_err(dev->dev, "[%s:%d] pcopy err\n",
+diff --git a/drivers/crypto/rockchip/rk3288_crypto.h b/drivers/crypto/rockchip/rk3288_crypto.h
+index d5fb4013fb42..54ee5b3ed9db 100644
+--- a/drivers/crypto/rockchip/rk3288_crypto.h
++++ b/drivers/crypto/rockchip/rk3288_crypto.h
+@@ -207,7 +207,8 @@ struct rk_crypto_info {
+ void *addr_vir;
+ int aligned;
+ int align_size;
+- size_t nents;
++ size_t src_nents;
++ size_t dst_nents;
+ unsigned int total;
+ unsigned int count;
+ dma_addr_t addr_in;
+@@ -244,6 +245,7 @@ struct rk_cipher_ctx {
+ struct rk_crypto_info *dev;
+ unsigned int keylen;
+ u32 mode;
++ u8 iv[AES_BLOCK_SIZE];
+ };
+
+ enum alg_type {
+diff --git a/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c b/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c
+index 639c15c5364b..23305f22072f 100644
+--- a/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c
++++ b/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c
+@@ -242,6 +242,17 @@ static void crypto_dma_start(struct rk_crypto_info *dev)
+ static int rk_set_data_start(struct rk_crypto_info *dev)
+ {
+ int err;
++ struct ablkcipher_request *req =
++ ablkcipher_request_cast(dev->async_req);
++ struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req);
++ struct rk_cipher_ctx *ctx = crypto_ablkcipher_ctx(tfm);
++ u32 ivsize = crypto_ablkcipher_ivsize(tfm);
++ u8 *src_last_blk = page_address(sg_page(dev->sg_src)) +
++ dev->sg_src->offset + dev->sg_src->length - ivsize;
++
++ /* store the iv that need to be updated in chain mode */
++ if (ctx->mode & RK_CRYPTO_DEC)
++ memcpy(ctx->iv, src_last_blk, ivsize);
+
+ err = dev->load_data(dev, dev->sg_src, dev->sg_dst);
+ if (!err)
+@@ -260,8 +271,9 @@ static int rk_ablk_start(struct rk_crypto_info *dev)
+ dev->total = req->nbytes;
+ dev->sg_src = req->src;
+ dev->first = req->src;
+- dev->nents = sg_nents(req->src);
++ dev->src_nents = sg_nents(req->src);
+ dev->sg_dst = req->dst;
++ dev->dst_nents = sg_nents(req->dst);
+ dev->aligned = 1;
+
+ spin_lock_irqsave(&dev->lock, flags);
+@@ -285,6 +297,28 @@ static void rk_iv_copyback(struct rk_crypto_info *dev)
+ memcpy_fromio(req->info, dev->reg + RK_CRYPTO_AES_IV_0, ivsize);
+ }
+
++static void rk_update_iv(struct rk_crypto_info *dev)
++{
++ struct ablkcipher_request *req =
++ ablkcipher_request_cast(dev->async_req);
++ struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req);
++ struct rk_cipher_ctx *ctx = crypto_ablkcipher_ctx(tfm);
++ u32 ivsize = crypto_ablkcipher_ivsize(tfm);
++ u8 *new_iv = NULL;
++
++ if (ctx->mode & RK_CRYPTO_DEC) {
++ new_iv = ctx->iv;
++ } else {
++ new_iv = page_address(sg_page(dev->sg_dst)) +
++ dev->sg_dst->offset + dev->sg_dst->length - ivsize;
++ }
++
++ if (ivsize == DES_BLOCK_SIZE)
++ memcpy_toio(dev->reg + RK_CRYPTO_TDES_IV_0, new_iv, ivsize);
++ else if (ivsize == AES_BLOCK_SIZE)
++ memcpy_toio(dev->reg + RK_CRYPTO_AES_IV_0, new_iv, ivsize);
++}
++
+ /* return:
+ * true some err was occurred
+ * fault no err, continue
+@@ -297,7 +331,7 @@ static int rk_ablk_rx(struct rk_crypto_info *dev)
+
+ dev->unload_data(dev);
+ if (!dev->aligned) {
+- if (!sg_pcopy_from_buffer(req->dst, dev->nents,
++ if (!sg_pcopy_from_buffer(req->dst, dev->dst_nents,
+ dev->addr_vir, dev->count,
+ dev->total - dev->left_bytes -
+ dev->count)) {
+@@ -306,6 +340,7 @@ static int rk_ablk_rx(struct rk_crypto_info *dev)
+ }
+ }
+ if (dev->left_bytes) {
++ rk_update_iv(dev);
+ if (dev->aligned) {
+ if (sg_is_last(dev->sg_src)) {
+ dev_err(dev->dev, "[%s:%d] Lack of data\n",
+diff --git a/drivers/crypto/rockchip/rk3288_crypto_ahash.c b/drivers/crypto/rockchip/rk3288_crypto_ahash.c
+index 821a506b9e17..c336ae75e361 100644
+--- a/drivers/crypto/rockchip/rk3288_crypto_ahash.c
++++ b/drivers/crypto/rockchip/rk3288_crypto_ahash.c
+@@ -206,7 +206,7 @@ static int rk_ahash_start(struct rk_crypto_info *dev)
+ dev->sg_dst = NULL;
+ dev->sg_src = req->src;
+ dev->first = req->src;
+- dev->nents = sg_nents(req->src);
++ dev->src_nents = sg_nents(req->src);
+ rctx = ahash_request_ctx(req);
+ rctx->mode = 0;
+
+diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
+index 1bb1a8e09025..6c94ed750049 100644
+--- a/drivers/dma/sh/usb-dmac.c
++++ b/drivers/dma/sh/usb-dmac.c
+@@ -697,6 +697,8 @@ static int usb_dmac_runtime_resume(struct device *dev)
+ #endif /* CONFIG_PM */
+
+ static const struct dev_pm_ops usb_dmac_pm = {
++ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
++ pm_runtime_force_resume)
+ SET_RUNTIME_PM_OPS(usb_dmac_runtime_suspend, usb_dmac_runtime_resume,
+ NULL)
+ };
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index 023a32cfac42..e0657fc72d31 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -543,7 +543,8 @@ static int pca953x_irq_set_type(struct irq_data *d, unsigned int type)
+
+ static void pca953x_irq_shutdown(struct irq_data *d)
+ {
+- struct pca953x_chip *chip = irq_data_get_irq_chip_data(d);
++ struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
++ struct pca953x_chip *chip = gpiochip_get_data(gc);
+ u8 mask = 1 << (d->hwirq % BANK_SZ);
+
+ chip->irq_trig_raise[d->hwirq / BANK_SZ] &= ~mask;
+diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+index bd039322f697..6342f6499351 100644
+--- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
++++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+@@ -1347,12 +1347,12 @@ void dcn_bw_update_from_pplib(struct dc *dc)
+ struct dm_pp_clock_levels_with_voltage fclks = {0}, dcfclks = {0};
+ bool res;
+
+- kernel_fpu_begin();
+-
+ /* TODO: This is not the proper way to obtain fabric_and_dram_bandwidth, should be min(fclk, memclk) */
+ res = dm_pp_get_clock_levels_by_type_with_voltage(
+ ctx, DM_PP_CLOCK_TYPE_FCLK, &fclks);
+
++ kernel_fpu_begin();
++
+ if (res)
+ res = verify_clock_values(&fclks);
+
+@@ -1371,9 +1371,13 @@ void dcn_bw_update_from_pplib(struct dc *dc)
+ } else
+ BREAK_TO_DEBUGGER();
+
++ kernel_fpu_end();
++
+ res = dm_pp_get_clock_levels_by_type_with_voltage(
+ ctx, DM_PP_CLOCK_TYPE_DCFCLK, &dcfclks);
+
++ kernel_fpu_begin();
++
+ if (res)
+ res = verify_clock_values(&dcfclks);
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index 052e60dfaf9f..b52ccab428a9 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -3487,14 +3487,14 @@ static int smu7_get_gpu_power(struct pp_hwmgr *hwmgr, u32 *query)
+
+ smum_send_msg_to_smc(hwmgr, PPSMC_MSG_PmStatusLogStart);
+ cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC,
+- ixSMU_PM_STATUS_94, 0);
++ ixSMU_PM_STATUS_95, 0);
+
+ for (i = 0; i < 10; i++) {
+- mdelay(1);
++ mdelay(500);
+ smum_send_msg_to_smc(hwmgr, PPSMC_MSG_PmStatusLogSample);
+ tmp = cgs_read_ind_register(hwmgr->device,
+ CGS_IND_REG__SMC,
+- ixSMU_PM_STATUS_94);
++ ixSMU_PM_STATUS_95);
+ if (tmp != 0)
+ break;
+ }
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 1bda809a7289..e65596617239 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -3156,9 +3156,7 @@ static void drm_fbdev_client_unregister(struct drm_client_dev *client)
+
+ static int drm_fbdev_client_restore(struct drm_client_dev *client)
+ {
+- struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
+-
+- drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper);
++ drm_fb_helper_lastclose(client->dev);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 280c851714e6..03cda197fb6b 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1828,7 +1828,8 @@ __vma_matches(struct vm_area_struct *vma, struct file *filp,
+ if (vma->vm_file != filp)
+ return false;
+
+- return vma->vm_start == addr && (vma->vm_end - vma->vm_start) == size;
++ return vma->vm_start == addr &&
++ (vma->vm_end - vma->vm_start) == PAGE_ALIGN(size);
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
+index 3bd0f8a18e74..42daa5c9ff8e 100644
+--- a/drivers/gpu/drm/imx/imx-ldb.c
++++ b/drivers/gpu/drm/imx/imx-ldb.c
+@@ -651,8 +651,10 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
+ int bus_format;
+
+ ret = of_property_read_u32(child, "reg", &i);
+- if (ret || i < 0 || i > 1)
+- return -EINVAL;
++ if (ret || i < 0 || i > 1) {
++ ret = -EINVAL;
++ goto free_child;
++ }
+
+ if (!of_device_is_available(child))
+ continue;
+@@ -665,7 +667,6 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
+ channel = &imx_ldb->channel[i];
+ channel->ldb = imx_ldb;
+ channel->chno = i;
+- channel->child = child;
+
+ /*
+ * The output port is port@4 with an external 4-port mux or
+@@ -675,13 +676,13 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
+ imx_ldb->lvds_mux ? 4 : 2, 0,
+ &channel->panel, &channel->bridge);
+ if (ret && ret != -ENODEV)
+- return ret;
++ goto free_child;
+
+ /* panel ddc only if there is no bridge */
+ if (!channel->bridge) {
+ ret = imx_ldb_panel_ddc(dev, channel, child);
+ if (ret)
+- return ret;
++ goto free_child;
+ }
+
+ bus_format = of_get_bus_format(dev, child);
+@@ -697,18 +698,26 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
+ if (bus_format < 0) {
+ dev_err(dev, "could not determine data mapping: %d\n",
+ bus_format);
+- return bus_format;
++ ret = bus_format;
++ goto free_child;
+ }
+ channel->bus_format = bus_format;
++ channel->child = child;
+
+ ret = imx_ldb_register(drm, channel);
+- if (ret)
+- return ret;
++ if (ret) {
++ channel->child = NULL;
++ goto free_child;
++ }
+ }
+
+ dev_set_drvdata(dev, imx_ldb);
+
+ return 0;
++
++free_child:
++ of_node_put(child);
++ return ret;
+ }
+
+ static void imx_ldb_unbind(struct device *dev, struct device *master,
+diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
+index 203f247d4854..a323a0db2fc1 100644
+--- a/drivers/gpu/drm/imx/ipuv3-plane.c
++++ b/drivers/gpu/drm/imx/ipuv3-plane.c
+@@ -375,9 +375,9 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
+ if (ret)
+ return ret;
+
+- /* CRTC should be enabled */
++ /* nothing to check when disabling or disabled */
+ if (!crtc_state->enable)
+- return -EINVAL;
++ return 0;
+
+ switch (plane->type) {
+ case DRM_PLANE_TYPE_PRIMARY:
+diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
+index 54324330b91f..2f0a5bd50174 100644
+--- a/drivers/gpu/drm/radeon/evergreen_cs.c
++++ b/drivers/gpu/drm/radeon/evergreen_cs.c
+@@ -1299,6 +1299,7 @@ static int evergreen_cs_handle_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
+ return -EINVAL;
+ }
+ ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
++ break;
+ case CB_TARGET_MASK:
+ track->cb_target_mask = radeon_get_ib_value(p, idx);
+ track->cb_dirty = true;
+diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
+index 474b00e19697..0a7d4395d427 100644
+--- a/drivers/gpu/ipu-v3/ipu-common.c
++++ b/drivers/gpu/ipu-v3/ipu-common.c
+@@ -898,8 +898,8 @@ static struct ipu_devtype ipu_type_imx51 = {
+ .cpmem_ofs = 0x1f000000,
+ .srm_ofs = 0x1f040000,
+ .tpm_ofs = 0x1f060000,
+- .csi0_ofs = 0x1f030000,
+- .csi1_ofs = 0x1f038000,
++ .csi0_ofs = 0x1e030000,
++ .csi1_ofs = 0x1e038000,
+ .ic_ofs = 0x1e020000,
+ .disp0_ofs = 0x1e040000,
+ .disp1_ofs = 0x1e048000,
+@@ -914,8 +914,8 @@ static struct ipu_devtype ipu_type_imx53 = {
+ .cpmem_ofs = 0x07000000,
+ .srm_ofs = 0x07040000,
+ .tpm_ofs = 0x07060000,
+- .csi0_ofs = 0x07030000,
+- .csi1_ofs = 0x07038000,
++ .csi0_ofs = 0x06030000,
++ .csi1_ofs = 0x06038000,
+ .ic_ofs = 0x06020000,
+ .disp0_ofs = 0x06040000,
+ .disp1_ofs = 0x06048000,
+diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c
+index 8426b7970c14..cc287cf6eb29 100644
+--- a/drivers/hwtracing/intel_th/gth.c
++++ b/drivers/hwtracing/intel_th/gth.c
+@@ -607,6 +607,7 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev,
+ {
+ struct gth_device *gth = dev_get_drvdata(&thdev->dev);
+ int port = othdev->output.port;
++ int master;
+
+ if (thdev->host_mode)
+ return;
+@@ -615,6 +616,9 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev,
+ othdev->output.port = -1;
+ othdev->output.active = false;
+ gth->output[port].output = NULL;
++ for (master = 0; master < TH_CONFIGURABLE_MASTERS; master++)
++ if (gth->master[master] == port)
++ gth->master[master] = -1;
+ spin_unlock(>h->gth_lock);
+ }
+
+diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
+index 10bcb5d73f90..9d55e104400c 100644
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -244,6 +244,9 @@ static int find_free_channels(unsigned long *bitmap, unsigned int start,
+ ;
+ if (i == width)
+ return pos;
++
++ /* step over [pos..pos+i) to continue search */
++ pos += i;
+ }
+
+ return -1;
+@@ -550,7 +553,7 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg)
+ {
+ struct stm_device *stm = stmf->stm;
+ struct stp_policy_id *id;
+- int ret = -EINVAL;
++ int ret = -EINVAL, wlimit = 1;
+ u32 size;
+
+ if (stmf->output.nr_chans)
+@@ -578,8 +581,10 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg)
+ if (id->__reserved_0 || id->__reserved_1)
+ goto err_free;
+
+- if (id->width < 1 ||
+- id->width > PAGE_SIZE / stm->data->sw_mmiosz)
++ if (stm->data->sw_mmiosz)
++ wlimit = PAGE_SIZE / stm->data->sw_mmiosz;
++
++ if (id->width < 1 || id->width > wlimit)
+ goto err_free;
+
+ ret = stm_file_assign(stmf, id->id, id->width);
+diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
+index 44deae78913e..4d19254f78c8 100644
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -191,6 +191,15 @@ static void bcm2835_i2c_start_transfer(struct bcm2835_i2c_dev *i2c_dev)
+ bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, c);
+ }
+
++static void bcm2835_i2c_finish_transfer(struct bcm2835_i2c_dev *i2c_dev)
++{
++ i2c_dev->curr_msg = NULL;
++ i2c_dev->num_msgs = 0;
++
++ i2c_dev->msg_buf = NULL;
++ i2c_dev->msg_buf_remaining = 0;
++}
++
+ /*
+ * Note about I2C_C_CLEAR on error:
+ * The I2C_C_CLEAR on errors will take some time to resolve -- if you were in
+@@ -291,6 +300,9 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
+
+ time_left = wait_for_completion_timeout(&i2c_dev->completion,
+ adap->timeout);
++
++ bcm2835_i2c_finish_transfer(i2c_dev);
++
+ if (!time_left) {
+ bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C,
+ BCM2835_I2C_C_CLEAR);
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index b13605718291..d917cefc5a19 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -382,8 +382,10 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)
+ * Check for the message size against FIFO depth and set the
+ * 'hold bus' bit if it is greater than FIFO depth.
+ */
+- if (id->recv_count > CDNS_I2C_FIFO_DEPTH)
++ if ((id->recv_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
+ ctrl_reg |= CDNS_I2C_CR_HOLD;
++ else
++ ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
+
+ cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
+
+@@ -440,8 +442,11 @@ static void cdns_i2c_msend(struct cdns_i2c *id)
+ * Check for the message size against FIFO depth and set the
+ * 'hold bus' bit if it is greater than FIFO depth.
+ */
+- if (id->send_count > CDNS_I2C_FIFO_DEPTH)
++ if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
+ ctrl_reg |= CDNS_I2C_CR_HOLD;
++ else
++ ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
++
+ cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
+
+ /* Clear the interrupts in interrupt status register. */
+diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
+index 60c8561fbe65..ef13b6ce9d8d 100644
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -832,7 +832,7 @@ static const struct i2c_algorithm tegra_i2c_algo = {
+ /* payload size is only 12 bit */
+ static const struct i2c_adapter_quirks tegra_i2c_quirks = {
+ .max_read_len = 4096,
+- .max_write_len = 4096,
++ .max_write_len = 4096 - 12,
+ };
+
+ static const struct tegra_i2c_hw_feature tegra20_i2c_hw = {
+diff --git a/drivers/iio/adc/exynos_adc.c b/drivers/iio/adc/exynos_adc.c
+index f10443f92e4c..4be29ed44755 100644
+--- a/drivers/iio/adc/exynos_adc.c
++++ b/drivers/iio/adc/exynos_adc.c
+@@ -915,7 +915,7 @@ static int exynos_adc_remove(struct platform_device *pdev)
+ struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+ struct exynos_adc *info = iio_priv(indio_dev);
+
+- if (IS_REACHABLE(CONFIG_INPUT)) {
++ if (IS_REACHABLE(CONFIG_INPUT) && info->input) {
+ free_irq(info->tsirq, info);
+ input_unregister_device(info->input);
+ }
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index cfd252386356..2ea42c04cfd2 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1425,7 +1425,7 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd,
+ struct hfi1_devdata *dd, u8 hw_pidx, u8 port);
+ void hfi1_free_ctxtdata(struct hfi1_devdata *dd, struct hfi1_ctxtdata *rcd);
+ int hfi1_rcd_put(struct hfi1_ctxtdata *rcd);
+-void hfi1_rcd_get(struct hfi1_ctxtdata *rcd);
++int hfi1_rcd_get(struct hfi1_ctxtdata *rcd);
+ struct hfi1_ctxtdata *hfi1_rcd_get_by_index_safe(struct hfi1_devdata *dd,
+ u16 ctxt);
+ struct hfi1_ctxtdata *hfi1_rcd_get_by_index(struct hfi1_devdata *dd, u16 ctxt);
+diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
+index 758d273c32cf..da786eb18558 100644
+--- a/drivers/infiniband/hw/hfi1/init.c
++++ b/drivers/infiniband/hw/hfi1/init.c
+@@ -213,12 +213,12 @@ static void hfi1_rcd_free(struct kref *kref)
+ struct hfi1_ctxtdata *rcd =
+ container_of(kref, struct hfi1_ctxtdata, kref);
+
+- hfi1_free_ctxtdata(rcd->dd, rcd);
+-
+ spin_lock_irqsave(&rcd->dd->uctxt_lock, flags);
+ rcd->dd->rcd[rcd->ctxt] = NULL;
+ spin_unlock_irqrestore(&rcd->dd->uctxt_lock, flags);
+
++ hfi1_free_ctxtdata(rcd->dd, rcd);
++
+ kfree(rcd);
+ }
+
+@@ -241,10 +241,13 @@ int hfi1_rcd_put(struct hfi1_ctxtdata *rcd)
+ * @rcd: pointer to an initialized rcd data structure
+ *
+ * Use this to get a reference after the init.
++ *
++ * Return : reflect kref_get_unless_zero(), which returns non-zero on
++ * increment, otherwise 0.
+ */
+-void hfi1_rcd_get(struct hfi1_ctxtdata *rcd)
++int hfi1_rcd_get(struct hfi1_ctxtdata *rcd)
+ {
+- kref_get(&rcd->kref);
++ return kref_get_unless_zero(&rcd->kref);
+ }
+
+ /**
+@@ -324,7 +327,8 @@ struct hfi1_ctxtdata *hfi1_rcd_get_by_index(struct hfi1_devdata *dd, u16 ctxt)
+ spin_lock_irqsave(&dd->uctxt_lock, flags);
+ if (dd->rcd[ctxt]) {
+ rcd = dd->rcd[ctxt];
+- hfi1_rcd_get(rcd);
++ if (!hfi1_rcd_get(rcd))
++ rcd = NULL;
+ }
+ spin_unlock_irqrestore(&dd->uctxt_lock, flags);
+
+diff --git a/drivers/input/keyboard/cap11xx.c b/drivers/input/keyboard/cap11xx.c
+index 312916f99597..73686c2460ce 100644
+--- a/drivers/input/keyboard/cap11xx.c
++++ b/drivers/input/keyboard/cap11xx.c
+@@ -75,9 +75,7 @@
+ struct cap11xx_led {
+ struct cap11xx_priv *priv;
+ struct led_classdev cdev;
+- struct work_struct work;
+ u32 reg;
+- enum led_brightness new_brightness;
+ };
+ #endif
+
+@@ -233,30 +231,21 @@ static void cap11xx_input_close(struct input_dev *idev)
+ }
+
+ #ifdef CONFIG_LEDS_CLASS
+-static void cap11xx_led_work(struct work_struct *work)
++static int cap11xx_led_set(struct led_classdev *cdev,
++ enum led_brightness value)
+ {
+- struct cap11xx_led *led = container_of(work, struct cap11xx_led, work);
++ struct cap11xx_led *led = container_of(cdev, struct cap11xx_led, cdev);
+ struct cap11xx_priv *priv = led->priv;
+- int value = led->new_brightness;
+
+ /*
+- * All LEDs share the same duty cycle as this is a HW limitation.
+- * Brightness levels per LED are either 0 (OFF) and 1 (ON).
++ * All LEDs share the same duty cycle as this is a HW
++ * limitation. Brightness levels per LED are either
++ * 0 (OFF) and 1 (ON).
+ */
+- regmap_update_bits(priv->regmap, CAP11XX_REG_LED_OUTPUT_CONTROL,
+- BIT(led->reg), value ? BIT(led->reg) : 0);
+-}
+-
+-static void cap11xx_led_set(struct led_classdev *cdev,
+- enum led_brightness value)
+-{
+- struct cap11xx_led *led = container_of(cdev, struct cap11xx_led, cdev);
+-
+- if (led->new_brightness == value)
+- return;
+-
+- led->new_brightness = value;
+- schedule_work(&led->work);
++ return regmap_update_bits(priv->regmap,
++ CAP11XX_REG_LED_OUTPUT_CONTROL,
++ BIT(led->reg),
++ value ? BIT(led->reg) : 0);
+ }
+
+ static int cap11xx_init_leds(struct device *dev,
+@@ -299,7 +288,7 @@ static int cap11xx_init_leds(struct device *dev,
+ led->cdev.default_trigger =
+ of_get_property(child, "linux,default-trigger", NULL);
+ led->cdev.flags = 0;
+- led->cdev.brightness_set = cap11xx_led_set;
++ led->cdev.brightness_set_blocking = cap11xx_led_set;
+ led->cdev.max_brightness = 1;
+ led->cdev.brightness = LED_OFF;
+
+@@ -312,8 +301,6 @@ static int cap11xx_init_leds(struct device *dev,
+ led->reg = reg;
+ led->priv = priv;
+
+- INIT_WORK(&led->work, cap11xx_led_work);
+-
+ error = devm_led_classdev_register(dev, &led->cdev);
+ if (error) {
+ of_node_put(child);
+diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
+index 403452ef00e6..3d1cb7bf5e35 100644
+--- a/drivers/input/keyboard/matrix_keypad.c
++++ b/drivers/input/keyboard/matrix_keypad.c
+@@ -222,7 +222,7 @@ static void matrix_keypad_stop(struct input_dev *dev)
+ keypad->stopped = true;
+ spin_unlock_irq(&keypad->lock);
+
+- flush_work(&keypad->work.work);
++ flush_delayed_work(&keypad->work);
+ /*
+ * matrix_keypad_scan() will leave IRQs enabled;
+ * we should disable them now.
+diff --git a/drivers/input/keyboard/st-keyscan.c b/drivers/input/keyboard/st-keyscan.c
+index babcfb165e4f..3b85631fde91 100644
+--- a/drivers/input/keyboard/st-keyscan.c
++++ b/drivers/input/keyboard/st-keyscan.c
+@@ -153,6 +153,8 @@ static int keyscan_probe(struct platform_device *pdev)
+
+ input_dev->id.bustype = BUS_HOST;
+
++ keypad_data->input_dev = input_dev;
++
+ error = keypad_matrix_key_parse_dt(keypad_data);
+ if (error)
+ return error;
+@@ -168,8 +170,6 @@ static int keyscan_probe(struct platform_device *pdev)
+
+ input_set_drvdata(input_dev, keypad_data);
+
+- keypad_data->input_dev = input_dev;
+-
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ keypad_data->base = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(keypad_data->base))
+diff --git a/drivers/input/misc/pwm-vibra.c b/drivers/input/misc/pwm-vibra.c
+index 55da191ae550..dbb6d9e1b947 100644
+--- a/drivers/input/misc/pwm-vibra.c
++++ b/drivers/input/misc/pwm-vibra.c
+@@ -34,6 +34,7 @@ struct pwm_vibrator {
+ struct work_struct play_work;
+ u16 level;
+ u32 direction_duty_cycle;
++ bool vcc_on;
+ };
+
+ static int pwm_vibrator_start(struct pwm_vibrator *vibrator)
+@@ -42,10 +43,13 @@ static int pwm_vibrator_start(struct pwm_vibrator *vibrator)
+ struct pwm_state state;
+ int err;
+
+- err = regulator_enable(vibrator->vcc);
+- if (err) {
+- dev_err(pdev, "failed to enable regulator: %d", err);
+- return err;
++ if (!vibrator->vcc_on) {
++ err = regulator_enable(vibrator->vcc);
++ if (err) {
++ dev_err(pdev, "failed to enable regulator: %d", err);
++ return err;
++ }
++ vibrator->vcc_on = true;
+ }
+
+ pwm_get_state(vibrator->pwm, &state);
+@@ -76,11 +80,14 @@ static int pwm_vibrator_start(struct pwm_vibrator *vibrator)
+
+ static void pwm_vibrator_stop(struct pwm_vibrator *vibrator)
+ {
+- regulator_disable(vibrator->vcc);
+-
+ if (vibrator->pwm_dir)
+ pwm_disable(vibrator->pwm_dir);
+ pwm_disable(vibrator->pwm);
++
++ if (vibrator->vcc_on) {
++ regulator_disable(vibrator->vcc);
++ vibrator->vcc_on = false;
++ }
+ }
+
+ static void pwm_vibrator_play_work(struct work_struct *work)
+diff --git a/drivers/input/serio/ps2-gpio.c b/drivers/input/serio/ps2-gpio.c
+index c62cceb97bb1..5e8d8384aa2a 100644
+--- a/drivers/input/serio/ps2-gpio.c
++++ b/drivers/input/serio/ps2-gpio.c
+@@ -76,6 +76,7 @@ static void ps2_gpio_close(struct serio *serio)
+ {
+ struct ps2_gpio_data *drvdata = serio->port_data;
+
++ flush_delayed_work(&drvdata->tx_work);
+ disable_irq(drvdata->irq);
+ }
+
+diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
+index 0e65f609352e..83364fedbf0a 100644
+--- a/drivers/irqchip/irq-brcmstb-l2.c
++++ b/drivers/irqchip/irq-brcmstb-l2.c
+@@ -129,8 +129,9 @@ static void brcmstb_l2_intc_suspend(struct irq_data *d)
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+ struct irq_chip_type *ct = irq_data_get_chip_type(d);
+ struct brcmstb_l2_intc_data *b = gc->private;
++ unsigned long flags;
+
+- irq_gc_lock(gc);
++ irq_gc_lock_irqsave(gc, flags);
+ /* Save the current mask */
+ b->saved_mask = irq_reg_readl(gc, ct->regs.mask);
+
+@@ -139,7 +140,7 @@ static void brcmstb_l2_intc_suspend(struct irq_data *d)
+ irq_reg_writel(gc, ~gc->wake_active, ct->regs.disable);
+ irq_reg_writel(gc, gc->wake_active, ct->regs.enable);
+ }
+- irq_gc_unlock(gc);
++ irq_gc_unlock_irqrestore(gc, flags);
+ }
+
+ static void brcmstb_l2_intc_resume(struct irq_data *d)
+@@ -147,8 +148,9 @@ static void brcmstb_l2_intc_resume(struct irq_data *d)
+ struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+ struct irq_chip_type *ct = irq_data_get_chip_type(d);
+ struct brcmstb_l2_intc_data *b = gc->private;
++ unsigned long flags;
+
+- irq_gc_lock(gc);
++ irq_gc_lock_irqsave(gc, flags);
+ if (ct->chip.irq_ack) {
+ /* Clear unmasked non-wakeup interrupts */
+ irq_reg_writel(gc, ~b->saved_mask & ~gc->wake_active,
+@@ -158,7 +160,7 @@ static void brcmstb_l2_intc_resume(struct irq_data *d)
+ /* Restore the saved mask */
+ irq_reg_writel(gc, b->saved_mask, ct->regs.disable);
+ irq_reg_writel(gc, ~b->saved_mask, ct->regs.enable);
+- irq_gc_unlock(gc);
++ irq_gc_unlock_irqrestore(gc, flags);
+ }
+
+ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 15579cba1a88..78970cdf2ef6 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -1893,6 +1893,8 @@ static int its_alloc_tables(struct its_node *its)
+ indirect = its_parse_indirect_baser(its, baser,
+ psz, &order,
+ its->device_ids);
++ break;
++
+ case GITS_BASER_TYPE_VCPU:
+ indirect = its_parse_indirect_baser(its, baser,
+ psz, &order,
+diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
+index 8ab077ff58f4..96bcabfebc23 100644
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -1396,9 +1396,9 @@ static void flexrm_shutdown(struct mbox_chan *chan)
+
+ /* Clear ring flush state */
+ timeout = 1000; /* timeout of 1s */
+- writel_relaxed(0x0, ring + RING_CONTROL);
++ writel_relaxed(0x0, ring->regs + RING_CONTROL);
+ do {
+- if (!(readl_relaxed(ring + RING_FLUSH_DONE) &
++ if (!(readl_relaxed(ring->regs + RING_FLUSH_DONE) &
+ FLUSH_DONE_MASK))
+ break;
+ mdelay(1);
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index 22944aa7d8e5..4ca3e3d3f9c7 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -392,10 +392,11 @@ static bool check_should_bypass(struct cached_dev *dc, struct bio *bio)
+
+ /*
+ * Flag for bypass if the IO is for read-ahead or background,
+- * unless the read-ahead request is for metadata (eg, for gfs2).
++ * unless the read-ahead request is for metadata
++ * (eg, for gfs2 or xfs).
+ */
+ if (bio->bi_opf & (REQ_RAHEAD|REQ_BACKGROUND) &&
+- !(bio->bi_opf & REQ_META))
++ !(bio->bi_opf & (REQ_META|REQ_PRIO)))
+ goto skip;
+
+ if (bio->bi_iter.bi_sector & (c->sb.block_size - 1) ||
+@@ -877,7 +878,7 @@ static int cached_dev_cache_miss(struct btree *b, struct search *s,
+ }
+
+ if (!(bio->bi_opf & REQ_RAHEAD) &&
+- !(bio->bi_opf & REQ_META) &&
++ !(bio->bi_opf & (REQ_META|REQ_PRIO)) &&
+ s->iop.c->gc_stats.in_use < CUTOFF_CACHE_READA)
+ reada = min_t(sector_t, dc->readahead >> 9,
+ get_capacity(bio->bi_disk) - bio_end_sector(bio));
+diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h
+index d2b9fdbc8994..e75dc33339f6 100644
+--- a/drivers/md/bcache/writeback.h
++++ b/drivers/md/bcache/writeback.h
+@@ -63,6 +63,9 @@ static inline bool should_writeback(struct cached_dev *dc, struct bio *bio,
+ in_use > CUTOFF_WRITEBACK_SYNC)
+ return false;
+
++ if (bio_op(bio) == REQ_OP_DISCARD)
++ return false;
++
+ if (dc->partial_stripes_expensive &&
+ bcache_dev_stripe_dirty(dc, bio->bi_iter.bi_sector,
+ bio_sectors(bio)))
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index e1fa6baf4e8e..96d5fb3f6199 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -1357,8 +1357,8 @@ again:
+ checksums_ptr - checksums, !dio->write ? TAG_CMP : TAG_WRITE);
+ if (unlikely(r)) {
+ if (r > 0) {
+- DMERR("Checksum failed at sector 0x%llx",
+- (unsigned long long)(sector - ((r + ic->tag_size - 1) / ic->tag_size)));
++ DMERR_LIMIT("Checksum failed at sector 0x%llx",
++ (unsigned long long)(sector - ((r + ic->tag_size - 1) / ic->tag_size)));
+ r = -EILSEQ;
+ atomic64_inc(&ic->number_of_mismatches);
+ }
+@@ -1550,8 +1550,8 @@ retry_kmap:
+
+ integrity_sector_checksum(ic, logical_sector, mem + bv.bv_offset, checksums_onstack);
+ if (unlikely(memcmp(checksums_onstack, journal_entry_tag(ic, je), ic->tag_size))) {
+- DMERR("Checksum failed when reading from journal, at sector 0x%llx",
+- (unsigned long long)logical_sector);
++ DMERR_LIMIT("Checksum failed when reading from journal, at sector 0x%llx",
++ (unsigned long long)logical_sector);
+ }
+ }
+ #endif
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 9df1334608b7..25e97de36717 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3959,6 +3959,8 @@ static int raid10_run(struct mddev *mddev)
+ set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
+ mddev->sync_thread = md_register_thread(md_do_sync, mddev,
+ "reshape");
++ if (!mddev->sync_thread)
++ goto out_free_conf;
+ }
+
+ return 0;
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 45a3551d3afd..ae38895c44b2 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -7390,6 +7390,8 @@ static int raid5_run(struct mddev *mddev)
+ set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
+ mddev->sync_thread = md_register_thread(md_do_sync, mddev,
+ "reshape");
++ if (!mddev->sync_thread)
++ goto abort;
+ }
+
+ /* Ok, everything is just fine now */
+diff --git a/drivers/media/common/videobuf2/videobuf2-v4l2.c b/drivers/media/common/videobuf2/videobuf2-v4l2.c
+index 886a2d8d5c6c..9d4a81bb0e59 100644
+--- a/drivers/media/common/videobuf2/videobuf2-v4l2.c
++++ b/drivers/media/common/videobuf2/videobuf2-v4l2.c
+@@ -145,7 +145,6 @@ static void vb2_warn_zero_bytesused(struct vb2_buffer *vb)
+ return;
+
+ check_once = true;
+- WARN_ON(1);
+
+ pr_warn("use of bytesused == 0 is deprecated and will be removed in the future,\n");
+ if (vb->vb2_queue->allow_zero_bytesused)
+diff --git a/drivers/media/dvb-frontends/lgdt330x.c b/drivers/media/dvb-frontends/lgdt330x.c
+index 10d584ce538d..9ee1c1360ab8 100644
+--- a/drivers/media/dvb-frontends/lgdt330x.c
++++ b/drivers/media/dvb-frontends/lgdt330x.c
+@@ -783,7 +783,7 @@ static int lgdt3303_read_status(struct dvb_frontend *fe,
+
+ if ((buf[0] & 0x02) == 0x00)
+ *status |= FE_HAS_SYNC;
+- if ((buf[0] & 0xfd) == 0x01)
++ if ((buf[0] & 0x01) == 0x01)
+ *status |= FE_HAS_VITERBI | FE_HAS_LOCK;
+ break;
+ default:
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 8e7a2a59cd32..d5c0ffc55d46 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -1759,7 +1759,7 @@ static void ov5640_reset(struct ov5640_dev *sensor)
+ usleep_range(1000, 2000);
+
+ gpiod_set_value_cansleep(sensor->reset_gpio, 0);
+- usleep_range(5000, 10000);
++ usleep_range(20000, 25000);
+ }
+
+ static int ov5640_set_power_on(struct ov5640_dev *sensor)
+diff --git a/drivers/media/platform/vimc/Makefile b/drivers/media/platform/vimc/Makefile
+index 4b2e3de7856e..c4fc8e7d365a 100644
+--- a/drivers/media/platform/vimc/Makefile
++++ b/drivers/media/platform/vimc/Makefile
+@@ -5,6 +5,7 @@ vimc_common-objs := vimc-common.o
+ vimc_debayer-objs := vimc-debayer.o
+ vimc_scaler-objs := vimc-scaler.o
+ vimc_sensor-objs := vimc-sensor.o
++vimc_streamer-objs := vimc-streamer.o
+
+ obj-$(CONFIG_VIDEO_VIMC) += vimc.o vimc_capture.o vimc_common.o vimc-debayer.o \
+- vimc_scaler.o vimc_sensor.o
++ vimc_scaler.o vimc_sensor.o vimc_streamer.o
+diff --git a/drivers/media/platform/vimc/vimc-capture.c b/drivers/media/platform/vimc/vimc-capture.c
+index ec68feaac378..65d657daf66f 100644
+--- a/drivers/media/platform/vimc/vimc-capture.c
++++ b/drivers/media/platform/vimc/vimc-capture.c
+@@ -24,6 +24,7 @@
+ #include <media/videobuf2-vmalloc.h>
+
+ #include "vimc-common.h"
++#include "vimc-streamer.h"
+
+ #define VIMC_CAP_DRV_NAME "vimc-capture"
+
+@@ -44,7 +45,7 @@ struct vimc_cap_device {
+ spinlock_t qlock;
+ struct mutex lock;
+ u32 sequence;
+- struct media_pipeline pipe;
++ struct vimc_stream stream;
+ };
+
+ static const struct v4l2_pix_format fmt_default = {
+@@ -248,14 +249,13 @@ static int vimc_cap_start_streaming(struct vb2_queue *vq, unsigned int count)
+ vcap->sequence = 0;
+
+ /* Start the media pipeline */
+- ret = media_pipeline_start(entity, &vcap->pipe);
++ ret = media_pipeline_start(entity, &vcap->stream.pipe);
+ if (ret) {
+ vimc_cap_return_all_buffers(vcap, VB2_BUF_STATE_QUEUED);
+ return ret;
+ }
+
+- /* Enable streaming from the pipe */
+- ret = vimc_pipeline_s_stream(&vcap->vdev.entity, 1);
++ ret = vimc_streamer_s_stream(&vcap->stream, &vcap->ved, 1);
+ if (ret) {
+ media_pipeline_stop(entity);
+ vimc_cap_return_all_buffers(vcap, VB2_BUF_STATE_QUEUED);
+@@ -273,8 +273,7 @@ static void vimc_cap_stop_streaming(struct vb2_queue *vq)
+ {
+ struct vimc_cap_device *vcap = vb2_get_drv_priv(vq);
+
+- /* Disable streaming from the pipe */
+- vimc_pipeline_s_stream(&vcap->vdev.entity, 0);
++ vimc_streamer_s_stream(&vcap->stream, &vcap->ved, 0);
+
+ /* Stop the media pipeline */
+ media_pipeline_stop(&vcap->vdev.entity);
+@@ -355,8 +354,8 @@ static void vimc_cap_comp_unbind(struct device *comp, struct device *master,
+ kfree(vcap);
+ }
+
+-static void vimc_cap_process_frame(struct vimc_ent_device *ved,
+- struct media_pad *sink, const void *frame)
++static void *vimc_cap_process_frame(struct vimc_ent_device *ved,
++ const void *frame)
+ {
+ struct vimc_cap_device *vcap = container_of(ved, struct vimc_cap_device,
+ ved);
+@@ -370,7 +369,7 @@ static void vimc_cap_process_frame(struct vimc_ent_device *ved,
+ typeof(*vimc_buf), list);
+ if (!vimc_buf) {
+ spin_unlock(&vcap->qlock);
+- return;
++ return ERR_PTR(-EAGAIN);
+ }
+
+ /* Remove this entry from the list */
+@@ -391,6 +390,7 @@ static void vimc_cap_process_frame(struct vimc_ent_device *ved,
+ vb2_set_plane_payload(&vimc_buf->vb2.vb2_buf, 0,
+ vcap->format.sizeimage);
+ vb2_buffer_done(&vimc_buf->vb2.vb2_buf, VB2_BUF_STATE_DONE);
++ return NULL;
+ }
+
+ static int vimc_cap_comp_bind(struct device *comp, struct device *master,
+diff --git a/drivers/media/platform/vimc/vimc-common.c b/drivers/media/platform/vimc/vimc-common.c
+index 617415c224fe..204aa6f554e4 100644
+--- a/drivers/media/platform/vimc/vimc-common.c
++++ b/drivers/media/platform/vimc/vimc-common.c
+@@ -207,41 +207,6 @@ const struct vimc_pix_map *vimc_pix_map_by_pixelformat(u32 pixelformat)
+ }
+ EXPORT_SYMBOL_GPL(vimc_pix_map_by_pixelformat);
+
+-int vimc_propagate_frame(struct media_pad *src, const void *frame)
+-{
+- struct media_link *link;
+-
+- if (!(src->flags & MEDIA_PAD_FL_SOURCE))
+- return -EINVAL;
+-
+- /* Send this frame to all sink pads that are direct linked */
+- list_for_each_entry(link, &src->entity->links, list) {
+- if (link->source == src &&
+- (link->flags & MEDIA_LNK_FL_ENABLED)) {
+- struct vimc_ent_device *ved = NULL;
+- struct media_entity *entity = link->sink->entity;
+-
+- if (is_media_entity_v4l2_subdev(entity)) {
+- struct v4l2_subdev *sd =
+- container_of(entity, struct v4l2_subdev,
+- entity);
+- ved = v4l2_get_subdevdata(sd);
+- } else if (is_media_entity_v4l2_video_device(entity)) {
+- struct video_device *vdev =
+- container_of(entity,
+- struct video_device,
+- entity);
+- ved = video_get_drvdata(vdev);
+- }
+- if (ved && ved->process_frame)
+- ved->process_frame(ved, link->sink, frame);
+- }
+- }
+-
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(vimc_propagate_frame);
+-
+ /* Helper function to allocate and initialize pads */
+ struct media_pad *vimc_pads_init(u16 num_pads, const unsigned long *pads_flag)
+ {
+diff --git a/drivers/media/platform/vimc/vimc-common.h b/drivers/media/platform/vimc/vimc-common.h
+index 2e9981b18166..6ed969d9efbb 100644
+--- a/drivers/media/platform/vimc/vimc-common.h
++++ b/drivers/media/platform/vimc/vimc-common.h
+@@ -113,23 +113,12 @@ struct vimc_pix_map {
+ struct vimc_ent_device {
+ struct media_entity *ent;
+ struct media_pad *pads;
+- void (*process_frame)(struct vimc_ent_device *ved,
+- struct media_pad *sink, const void *frame);
++ void * (*process_frame)(struct vimc_ent_device *ved,
++ const void *frame);
+ void (*vdev_get_format)(struct vimc_ent_device *ved,
+ struct v4l2_pix_format *fmt);
+ };
+
+-/**
+- * vimc_propagate_frame - propagate a frame through the topology
+- *
+- * @src: the source pad where the frame is being originated
+- * @frame: the frame to be propagated
+- *
+- * This function will call the process_frame callback from the vimc_ent_device
+- * struct of the nodes directly connected to the @src pad
+- */
+-int vimc_propagate_frame(struct media_pad *src, const void *frame);
+-
+ /**
+ * vimc_pads_init - initialize pads
+ *
+diff --git a/drivers/media/platform/vimc/vimc-debayer.c b/drivers/media/platform/vimc/vimc-debayer.c
+index 77887f66f323..7d77c63b99d2 100644
+--- a/drivers/media/platform/vimc/vimc-debayer.c
++++ b/drivers/media/platform/vimc/vimc-debayer.c
+@@ -321,7 +321,6 @@ static void vimc_deb_set_rgb_mbus_fmt_rgb888_1x24(struct vimc_deb_device *vdeb,
+ static int vimc_deb_s_stream(struct v4l2_subdev *sd, int enable)
+ {
+ struct vimc_deb_device *vdeb = v4l2_get_subdevdata(sd);
+- int ret;
+
+ if (enable) {
+ const struct vimc_pix_map *vpix;
+@@ -351,22 +350,10 @@ static int vimc_deb_s_stream(struct v4l2_subdev *sd, int enable)
+ if (!vdeb->src_frame)
+ return -ENOMEM;
+
+- /* Turn the stream on in the subdevices directly connected */
+- ret = vimc_pipeline_s_stream(&vdeb->sd.entity, 1);
+- if (ret) {
+- vfree(vdeb->src_frame);
+- vdeb->src_frame = NULL;
+- return ret;
+- }
+ } else {
+ if (!vdeb->src_frame)
+ return 0;
+
+- /* Disable streaming from the pipe */
+- ret = vimc_pipeline_s_stream(&vdeb->sd.entity, 0);
+- if (ret)
+- return ret;
+-
+ vfree(vdeb->src_frame);
+ vdeb->src_frame = NULL;
+ }
+@@ -480,9 +467,8 @@ static void vimc_deb_calc_rgb_sink(struct vimc_deb_device *vdeb,
+ }
+ }
+
+-static void vimc_deb_process_frame(struct vimc_ent_device *ved,
+- struct media_pad *sink,
+- const void *sink_frame)
++static void *vimc_deb_process_frame(struct vimc_ent_device *ved,
++ const void *sink_frame)
+ {
+ struct vimc_deb_device *vdeb = container_of(ved, struct vimc_deb_device,
+ ved);
+@@ -491,7 +477,7 @@ static void vimc_deb_process_frame(struct vimc_ent_device *ved,
+
+ /* If the stream in this node is not active, just return */
+ if (!vdeb->src_frame)
+- return;
++ return ERR_PTR(-EINVAL);
+
+ for (i = 0; i < vdeb->sink_fmt.height; i++)
+ for (j = 0; j < vdeb->sink_fmt.width; j++) {
+@@ -499,12 +485,8 @@ static void vimc_deb_process_frame(struct vimc_ent_device *ved,
+ vdeb->set_rgb_src(vdeb, i, j, rgb);
+ }
+
+- /* Propagate the frame through all source pads */
+- for (i = 1; i < vdeb->sd.entity.num_pads; i++) {
+- struct media_pad *pad = &vdeb->sd.entity.pads[i];
++ return vdeb->src_frame;
+
+- vimc_propagate_frame(pad, vdeb->src_frame);
+- }
+ }
+
+ static void vimc_deb_comp_unbind(struct device *comp, struct device *master,
+diff --git a/drivers/media/platform/vimc/vimc-scaler.c b/drivers/media/platform/vimc/vimc-scaler.c
+index b0952ee86296..39b2a73dfcc1 100644
+--- a/drivers/media/platform/vimc/vimc-scaler.c
++++ b/drivers/media/platform/vimc/vimc-scaler.c
+@@ -217,7 +217,6 @@ static const struct v4l2_subdev_pad_ops vimc_sca_pad_ops = {
+ static int vimc_sca_s_stream(struct v4l2_subdev *sd, int enable)
+ {
+ struct vimc_sca_device *vsca = v4l2_get_subdevdata(sd);
+- int ret;
+
+ if (enable) {
+ const struct vimc_pix_map *vpix;
+@@ -245,22 +244,10 @@ static int vimc_sca_s_stream(struct v4l2_subdev *sd, int enable)
+ if (!vsca->src_frame)
+ return -ENOMEM;
+
+- /* Turn the stream on in the subdevices directly connected */
+- ret = vimc_pipeline_s_stream(&vsca->sd.entity, 1);
+- if (ret) {
+- vfree(vsca->src_frame);
+- vsca->src_frame = NULL;
+- return ret;
+- }
+ } else {
+ if (!vsca->src_frame)
+ return 0;
+
+- /* Disable streaming from the pipe */
+- ret = vimc_pipeline_s_stream(&vsca->sd.entity, 0);
+- if (ret)
+- return ret;
+-
+ vfree(vsca->src_frame);
+ vsca->src_frame = NULL;
+ }
+@@ -346,26 +333,19 @@ static void vimc_sca_fill_src_frame(const struct vimc_sca_device *const vsca,
+ vimc_sca_scale_pix(vsca, i, j, sink_frame);
+ }
+
+-static void vimc_sca_process_frame(struct vimc_ent_device *ved,
+- struct media_pad *sink,
+- const void *sink_frame)
++static void *vimc_sca_process_frame(struct vimc_ent_device *ved,
++ const void *sink_frame)
+ {
+ struct vimc_sca_device *vsca = container_of(ved, struct vimc_sca_device,
+ ved);
+- unsigned int i;
+
+ /* If the stream in this node is not active, just return */
+ if (!vsca->src_frame)
+- return;
++ return ERR_PTR(-EINVAL);
+
+ vimc_sca_fill_src_frame(vsca, sink_frame);
+
+- /* Propagate the frame through all source pads */
+- for (i = 1; i < vsca->sd.entity.num_pads; i++) {
+- struct media_pad *pad = &vsca->sd.entity.pads[i];
+-
+- vimc_propagate_frame(pad, vsca->src_frame);
+- }
++ return vsca->src_frame;
+ };
+
+ static void vimc_sca_comp_unbind(struct device *comp, struct device *master,
+diff --git a/drivers/media/platform/vimc/vimc-sensor.c b/drivers/media/platform/vimc/vimc-sensor.c
+index b2b89315e7ba..9e0d70e9f119 100644
+--- a/drivers/media/platform/vimc/vimc-sensor.c
++++ b/drivers/media/platform/vimc/vimc-sensor.c
+@@ -16,8 +16,6 @@
+ */
+
+ #include <linux/component.h>
+-#include <linux/freezer.h>
+-#include <linux/kthread.h>
+ #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/platform_device.h>
+@@ -201,38 +199,27 @@ static const struct v4l2_subdev_pad_ops vimc_sen_pad_ops = {
+ .set_fmt = vimc_sen_set_fmt,
+ };
+
+-static int vimc_sen_tpg_thread(void *data)
++static void *vimc_sen_process_frame(struct vimc_ent_device *ved,
++ const void *sink_frame)
+ {
+- struct vimc_sen_device *vsen = data;
+- unsigned int i;
+-
+- set_freezable();
+- set_current_state(TASK_UNINTERRUPTIBLE);
+-
+- for (;;) {
+- try_to_freeze();
+- if (kthread_should_stop())
+- break;
+-
+- tpg_fill_plane_buffer(&vsen->tpg, 0, 0, vsen->frame);
++ struct vimc_sen_device *vsen = container_of(ved, struct vimc_sen_device,
++ ved);
++ const struct vimc_pix_map *vpix;
++ unsigned int frame_size;
+
+- /* Send the frame to all source pads */
+- for (i = 0; i < vsen->sd.entity.num_pads; i++)
+- vimc_propagate_frame(&vsen->sd.entity.pads[i],
+- vsen->frame);
++ /* Calculate the frame size */
++ vpix = vimc_pix_map_by_code(vsen->mbus_format.code);
++ frame_size = vsen->mbus_format.width * vpix->bpp *
++ vsen->mbus_format.height;
+
+- /* 60 frames per second */
+- schedule_timeout(HZ/60);
+- }
+-
+- return 0;
++ tpg_fill_plane_buffer(&vsen->tpg, 0, 0, vsen->frame);
++ return vsen->frame;
+ }
+
+ static int vimc_sen_s_stream(struct v4l2_subdev *sd, int enable)
+ {
+ struct vimc_sen_device *vsen =
+ container_of(sd, struct vimc_sen_device, sd);
+- int ret;
+
+ if (enable) {
+ const struct vimc_pix_map *vpix;
+@@ -258,26 +245,8 @@ static int vimc_sen_s_stream(struct v4l2_subdev *sd, int enable)
+ /* configure the test pattern generator */
+ vimc_sen_tpg_s_format(vsen);
+
+- /* Initialize the image generator thread */
+- vsen->kthread_sen = kthread_run(vimc_sen_tpg_thread, vsen,
+- "%s-sen", vsen->sd.v4l2_dev->name);
+- if (IS_ERR(vsen->kthread_sen)) {
+- dev_err(vsen->dev, "%s: kernel_thread() failed\n",
+- vsen->sd.name);
+- vfree(vsen->frame);
+- vsen->frame = NULL;
+- return PTR_ERR(vsen->kthread_sen);
+- }
+ } else {
+- if (!vsen->kthread_sen)
+- return 0;
+-
+- /* Stop image generator */
+- ret = kthread_stop(vsen->kthread_sen);
+- if (ret)
+- return ret;
+
+- vsen->kthread_sen = NULL;
+ vfree(vsen->frame);
+ vsen->frame = NULL;
+ return 0;
+@@ -393,6 +362,7 @@ static int vimc_sen_comp_bind(struct device *comp, struct device *master,
+ if (ret)
+ goto err_free_hdl;
+
++ vsen->ved.process_frame = vimc_sen_process_frame;
+ dev_set_drvdata(comp, &vsen->ved);
+ vsen->dev = comp;
+
+diff --git a/drivers/media/platform/vimc/vimc-streamer.c b/drivers/media/platform/vimc/vimc-streamer.c
+new file mode 100644
+index 000000000000..fcc897fb247b
+--- /dev/null
++++ b/drivers/media/platform/vimc/vimc-streamer.c
+@@ -0,0 +1,188 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * vimc-streamer.c Virtual Media Controller Driver
++ *
++ * Copyright (C) 2018 Lucas A. M. Magalhães <lucmaga@gmail.com>
++ *
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/freezer.h>
++#include <linux/kthread.h>
++
++#include "vimc-streamer.h"
++
++/**
++ * vimc_get_source_entity - get the entity connected with the first sink pad
++ *
++ * @ent: reference media_entity
++ *
++ * Helper function that returns the media entity containing the source pad
++ * linked with the first sink pad from the given media entity pad list.
++ */
++static struct media_entity *vimc_get_source_entity(struct media_entity *ent)
++{
++ struct media_pad *pad;
++ int i;
++
++ for (i = 0; i < ent->num_pads; i++) {
++ if (ent->pads[i].flags & MEDIA_PAD_FL_SOURCE)
++ continue;
++ pad = media_entity_remote_pad(&ent->pads[i]);
++ return pad ? pad->entity : NULL;
++ }
++ return NULL;
++}
++
++/*
++ * vimc_streamer_pipeline_terminate - Disable stream in all ved in stream
++ *
++ * @stream: the pointer to the stream structure with the pipeline to be
++ * disabled.
++ *
++ * Calls s_stream to disable the stream in each entity of the pipeline
++ *
++ */
++static void vimc_streamer_pipeline_terminate(struct vimc_stream *stream)
++{
++ struct media_entity *entity;
++ struct v4l2_subdev *sd;
++
++ while (stream->pipe_size) {
++ stream->pipe_size--;
++ entity = stream->ved_pipeline[stream->pipe_size]->ent;
++ entity = vimc_get_source_entity(entity);
++ stream->ved_pipeline[stream->pipe_size] = NULL;
++
++ if (!is_media_entity_v4l2_subdev(entity))
++ continue;
++
++ sd = media_entity_to_v4l2_subdev(entity);
++ v4l2_subdev_call(sd, video, s_stream, 0);
++ }
++}
++
++/*
++ * vimc_streamer_pipeline_init - initializes the stream structure
++ *
++ * @stream: the pointer to the stream structure to be initialized
++ * @ved: the pointer to the vimc entity initializing the stream
++ *
++ * Initializes the stream structure. Walks through the entity graph to
++ * construct the pipeline used later on the streamer thread.
++ * Calls s_stream to enable stream in all entities of the pipeline.
++ */
++static int vimc_streamer_pipeline_init(struct vimc_stream *stream,
++ struct vimc_ent_device *ved)
++{
++ struct media_entity *entity;
++ struct video_device *vdev;
++ struct v4l2_subdev *sd;
++ int ret = 0;
++
++ stream->pipe_size = 0;
++ while (stream->pipe_size < VIMC_STREAMER_PIPELINE_MAX_SIZE) {
++ if (!ved) {
++ vimc_streamer_pipeline_terminate(stream);
++ return -EINVAL;
++ }
++ stream->ved_pipeline[stream->pipe_size++] = ved;
++
++ entity = vimc_get_source_entity(ved->ent);
++ /* Check if the end of the pipeline was reached*/
++ if (!entity)
++ return 0;
++
++ if (is_media_entity_v4l2_subdev(entity)) {
++ sd = media_entity_to_v4l2_subdev(entity);
++ ret = v4l2_subdev_call(sd, video, s_stream, 1);
++ if (ret && ret != -ENOIOCTLCMD) {
++ vimc_streamer_pipeline_terminate(stream);
++ return ret;
++ }
++ ved = v4l2_get_subdevdata(sd);
++ } else {
++ vdev = container_of(entity,
++ struct video_device,
++ entity);
++ ved = video_get_drvdata(vdev);
++ }
++ }
++
++ vimc_streamer_pipeline_terminate(stream);
++ return -EINVAL;
++}
++
++static int vimc_streamer_thread(void *data)
++{
++ struct vimc_stream *stream = data;
++ int i;
++
++ set_freezable();
++ set_current_state(TASK_UNINTERRUPTIBLE);
++
++ for (;;) {
++ try_to_freeze();
++ if (kthread_should_stop())
++ break;
++
++ for (i = stream->pipe_size - 1; i >= 0; i--) {
++ stream->frame = stream->ved_pipeline[i]->process_frame(
++ stream->ved_pipeline[i],
++ stream->frame);
++ if (!stream->frame)
++ break;
++ if (IS_ERR(stream->frame))
++ break;
++ }
++ //wait for 60hz
++ schedule_timeout(HZ / 60);
++ }
++
++ return 0;
++}
++
++int vimc_streamer_s_stream(struct vimc_stream *stream,
++ struct vimc_ent_device *ved,
++ int enable)
++{
++ int ret;
++
++ if (!stream || !ved)
++ return -EINVAL;
++
++ if (enable) {
++ if (stream->kthread)
++ return 0;
++
++ ret = vimc_streamer_pipeline_init(stream, ved);
++ if (ret)
++ return ret;
++
++ stream->kthread = kthread_run(vimc_streamer_thread, stream,
++ "vimc-streamer thread");
++
++ if (IS_ERR(stream->kthread))
++ return PTR_ERR(stream->kthread);
++
++ } else {
++ if (!stream->kthread)
++ return 0;
++
++ ret = kthread_stop(stream->kthread);
++ if (ret)
++ return ret;
++
++ stream->kthread = NULL;
++
++ vimc_streamer_pipeline_terminate(stream);
++ }
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(vimc_streamer_s_stream);
++
++MODULE_DESCRIPTION("Virtual Media Controller Driver (VIMC) Streamer");
++MODULE_AUTHOR("Lucas A. M. Magalhães <lucmaga@gmail.com>");
++MODULE_LICENSE("GPL");
+diff --git a/drivers/media/platform/vimc/vimc-streamer.h b/drivers/media/platform/vimc/vimc-streamer.h
+new file mode 100644
+index 000000000000..752af2e2d5a2
+--- /dev/null
++++ b/drivers/media/platform/vimc/vimc-streamer.h
+@@ -0,0 +1,38 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * vimc-streamer.h Virtual Media Controller Driver
++ *
++ * Copyright (C) 2018 Lucas A. M. Magalhães <lucmaga@gmail.com>
++ *
++ */
++
++#ifndef _VIMC_STREAMER_H_
++#define _VIMC_STREAMER_H_
++
++#include <media/media-device.h>
++
++#include "vimc-common.h"
++
++#define VIMC_STREAMER_PIPELINE_MAX_SIZE 16
++
++struct vimc_stream {
++ struct media_pipeline pipe;
++ struct vimc_ent_device *ved_pipeline[VIMC_STREAMER_PIPELINE_MAX_SIZE];
++ unsigned int pipe_size;
++ u8 *frame;
++ struct task_struct *kthread;
++};
++
++/**
++ * vimc_streamer_s_streamer - start/stop the stream
++ *
++ * @stream: the pointer to the stream to start or stop
++ * @ved: The last entity of the streamer pipeline
++ * @enable: any non-zero number start the stream, zero stop
++ *
++ */
++int vimc_streamer_s_stream(struct vimc_stream *stream,
++ struct vimc_ent_device *ved,
++ int enable);
++
++#endif //_VIMC_STREAMER_H_
+diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
+index 86a99f461fd8..ffffb66d51a0 100644
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -676,6 +676,14 @@ void uvc_video_clock_update(struct uvc_streaming *stream,
+ if (!uvc_hw_timestamps_param)
+ return;
+
++ /*
++ * We will get called from __vb2_queue_cancel() if there are buffers
++ * done but not dequeued by the user, but the sample array has already
++ * been released at that time. Just bail out in that case.
++ */
++ if (!clock->samples)
++ return;
++
+ spin_lock_irqsave(&clock->lock, flags);
+
+ if (clock->count < clock->size)
+diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
+index a530972c5a7e..e0173bf4b0dc 100644
+--- a/drivers/mfd/sm501.c
++++ b/drivers/mfd/sm501.c
+@@ -1145,6 +1145,9 @@ static int sm501_register_gpio_i2c_instance(struct sm501_devdata *sm,
+ lookup = devm_kzalloc(&pdev->dev,
+ sizeof(*lookup) + 3 * sizeof(struct gpiod_lookup),
+ GFP_KERNEL);
++ if (!lookup)
++ return -ENOMEM;
++
+ lookup->dev_id = "i2c-gpio";
+ if (iic->pin_sda < 32)
+ lookup->table[0].chip_label = "SM501-LOW";
+diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c
+index 3bc0c15d4d85..b83a373e3a8d 100644
+--- a/drivers/misc/cxl/guest.c
++++ b/drivers/misc/cxl/guest.c
+@@ -267,6 +267,7 @@ static int guest_reset(struct cxl *adapter)
+ int i, rc;
+
+ pr_devel("Adapter reset request\n");
++ spin_lock(&adapter->afu_list_lock);
+ for (i = 0; i < adapter->slices; i++) {
+ if ((afu = adapter->afu[i])) {
+ pci_error_handlers(afu, CXL_ERROR_DETECTED_EVENT,
+@@ -283,6 +284,7 @@ static int guest_reset(struct cxl *adapter)
+ pci_error_handlers(afu, CXL_RESUME_EVENT, 0);
+ }
+ }
++ spin_unlock(&adapter->afu_list_lock);
+ return rc;
+ }
+
+diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
+index b66d832d3233..787a69a2a726 100644
+--- a/drivers/misc/cxl/pci.c
++++ b/drivers/misc/cxl/pci.c
+@@ -1807,7 +1807,7 @@ static pci_ers_result_t cxl_vphb_error_detected(struct cxl_afu *afu,
+ /* There should only be one entry, but go through the list
+ * anyway
+ */
+- if (afu->phb == NULL)
++ if (afu == NULL || afu->phb == NULL)
+ return result;
+
+ list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) {
+@@ -1834,7 +1834,8 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev,
+ {
+ struct cxl *adapter = pci_get_drvdata(pdev);
+ struct cxl_afu *afu;
+- pci_ers_result_t result = PCI_ERS_RESULT_NEED_RESET, afu_result;
++ pci_ers_result_t result = PCI_ERS_RESULT_NEED_RESET;
++ pci_ers_result_t afu_result = PCI_ERS_RESULT_NEED_RESET;
+ int i;
+
+ /* At this point, we could still have an interrupt pending.
+@@ -1845,6 +1846,7 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev,
+
+ /* If we're permanently dead, give up. */
+ if (state == pci_channel_io_perm_failure) {
++ spin_lock(&adapter->afu_list_lock);
+ for (i = 0; i < adapter->slices; i++) {
+ afu = adapter->afu[i];
+ /*
+@@ -1853,6 +1855,7 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev,
+ */
+ cxl_vphb_error_detected(afu, state);
+ }
++ spin_unlock(&adapter->afu_list_lock);
+ return PCI_ERS_RESULT_DISCONNECT;
+ }
+
+@@ -1934,11 +1937,17 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev,
+ * * In slot_reset, free the old resources and allocate new ones.
+ * * In resume, clear the flag to allow things to start.
+ */
++
++ /* Make sure no one else changes the afu list */
++ spin_lock(&adapter->afu_list_lock);
++
+ for (i = 0; i < adapter->slices; i++) {
+ afu = adapter->afu[i];
+
+- afu_result = cxl_vphb_error_detected(afu, state);
++ if (afu == NULL)
++ continue;
+
++ afu_result = cxl_vphb_error_detected(afu, state);
+ cxl_context_detach_all(afu);
+ cxl_ops->afu_deactivate_mode(afu, afu->current_mode);
+ pci_deconfigure_afu(afu);
+@@ -1950,6 +1959,7 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev,
+ (result == PCI_ERS_RESULT_NEED_RESET))
+ result = PCI_ERS_RESULT_NONE;
+ }
++ spin_unlock(&adapter->afu_list_lock);
+
+ /* should take the context lock here */
+ if (cxl_adapter_context_lock(adapter) != 0)
+@@ -1982,14 +1992,18 @@ static pci_ers_result_t cxl_pci_slot_reset(struct pci_dev *pdev)
+ */
+ cxl_adapter_context_unlock(adapter);
+
++ spin_lock(&adapter->afu_list_lock);
+ for (i = 0; i < adapter->slices; i++) {
+ afu = adapter->afu[i];
+
++ if (afu == NULL)
++ continue;
++
+ if (pci_configure_afu(afu, adapter, pdev))
+- goto err;
++ goto err_unlock;
+
+ if (cxl_afu_select_best_mode(afu))
+- goto err;
++ goto err_unlock;
+
+ if (afu->phb == NULL)
+ continue;
+@@ -2001,16 +2015,16 @@ static pci_ers_result_t cxl_pci_slot_reset(struct pci_dev *pdev)
+ ctx = cxl_get_context(afu_dev);
+
+ if (ctx && cxl_release_context(ctx))
+- goto err;
++ goto err_unlock;
+
+ ctx = cxl_dev_context_init(afu_dev);
+ if (IS_ERR(ctx))
+- goto err;
++ goto err_unlock;
+
+ afu_dev->dev.archdata.cxl_ctx = ctx;
+
+ if (cxl_ops->afu_check_and_enable(afu))
+- goto err;
++ goto err_unlock;
+
+ afu_dev->error_state = pci_channel_io_normal;
+
+@@ -2031,8 +2045,13 @@ static pci_ers_result_t cxl_pci_slot_reset(struct pci_dev *pdev)
+ result = PCI_ERS_RESULT_DISCONNECT;
+ }
+ }
++
++ spin_unlock(&adapter->afu_list_lock);
+ return result;
+
++err_unlock:
++ spin_unlock(&adapter->afu_list_lock);
++
+ err:
+ /* All the bits that happen in both error_detected and cxl_remove
+ * should be idempotent, so we don't need to worry about leaving a mix
+@@ -2053,10 +2072,11 @@ static void cxl_pci_resume(struct pci_dev *pdev)
+ * This is not the place to be checking if everything came back up
+ * properly, because there's no return value: do that in slot_reset.
+ */
++ spin_lock(&adapter->afu_list_lock);
+ for (i = 0; i < adapter->slices; i++) {
+ afu = adapter->afu[i];
+
+- if (afu->phb == NULL)
++ if (afu == NULL || afu->phb == NULL)
+ continue;
+
+ list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) {
+@@ -2065,6 +2085,7 @@ static void cxl_pci_resume(struct pci_dev *pdev)
+ afu_dev->driver->err_handler->resume(afu_dev);
+ }
+ }
++ spin_unlock(&adapter->afu_list_lock);
+ }
+
+ static const struct pci_error_handlers cxl_err_handler = {
+diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
+index fc3872fe7b25..c383322ec2ba 100644
+--- a/drivers/misc/mei/bus.c
++++ b/drivers/misc/mei/bus.c
+@@ -541,17 +541,9 @@ int mei_cldev_enable(struct mei_cl_device *cldev)
+ goto out;
+ }
+
+- if (!mei_cl_bus_module_get(cldev)) {
+- dev_err(&cldev->dev, "get hw module failed");
+- ret = -ENODEV;
+- goto out;
+- }
+-
+ ret = mei_cl_connect(cl, cldev->me_cl, NULL);
+- if (ret < 0) {
++ if (ret < 0)
+ dev_err(&cldev->dev, "cannot connect\n");
+- mei_cl_bus_module_put(cldev);
+- }
+
+ out:
+ mutex_unlock(&bus->device_lock);
+@@ -614,7 +606,6 @@ int mei_cldev_disable(struct mei_cl_device *cldev)
+ if (err < 0)
+ dev_err(bus->dev, "Could not disconnect from the ME client\n");
+
+- mei_cl_bus_module_put(cldev);
+ out:
+ /* Flush queues and remove any pending read */
+ mei_cl_flush_queues(cl, NULL);
+@@ -725,9 +716,16 @@ static int mei_cl_device_probe(struct device *dev)
+ if (!id)
+ return -ENODEV;
+
++ if (!mei_cl_bus_module_get(cldev)) {
++ dev_err(&cldev->dev, "get hw module failed");
++ return -ENODEV;
++ }
++
+ ret = cldrv->probe(cldev, id);
+- if (ret)
++ if (ret) {
++ mei_cl_bus_module_put(cldev);
+ return ret;
++ }
+
+ __module_get(THIS_MODULE);
+ return 0;
+@@ -755,6 +753,7 @@ static int mei_cl_device_remove(struct device *dev)
+
+ mei_cldev_unregister_callbacks(cldev);
+
++ mei_cl_bus_module_put(cldev);
+ module_put(THIS_MODULE);
+ dev->driver = NULL;
+ return ret;
+diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
+index e56f3e72d57a..d39cc2909474 100644
+--- a/drivers/misc/mei/hbm.c
++++ b/drivers/misc/mei/hbm.c
+@@ -986,29 +986,36 @@ static void mei_hbm_config_features(struct mei_device *dev)
+ dev->version.minor_version >= HBM_MINOR_VERSION_PGI)
+ dev->hbm_f_pg_supported = 1;
+
++ dev->hbm_f_dc_supported = 0;
+ if (dev->version.major_version >= HBM_MAJOR_VERSION_DC)
+ dev->hbm_f_dc_supported = 1;
+
++ dev->hbm_f_ie_supported = 0;
+ if (dev->version.major_version >= HBM_MAJOR_VERSION_IE)
+ dev->hbm_f_ie_supported = 1;
+
+ /* disconnect on connect timeout instead of link reset */
++ dev->hbm_f_dot_supported = 0;
+ if (dev->version.major_version >= HBM_MAJOR_VERSION_DOT)
+ dev->hbm_f_dot_supported = 1;
+
+ /* Notification Event Support */
++ dev->hbm_f_ev_supported = 0;
+ if (dev->version.major_version >= HBM_MAJOR_VERSION_EV)
+ dev->hbm_f_ev_supported = 1;
+
+ /* Fixed Address Client Support */
++ dev->hbm_f_fa_supported = 0;
+ if (dev->version.major_version >= HBM_MAJOR_VERSION_FA)
+ dev->hbm_f_fa_supported = 1;
+
+ /* OS ver message Support */
++ dev->hbm_f_os_supported = 0;
+ if (dev->version.major_version >= HBM_MAJOR_VERSION_OS)
+ dev->hbm_f_os_supported = 1;
+
+ /* DMA Ring Support */
++ dev->hbm_f_dr_supported = 0;
+ if (dev->version.major_version > HBM_MAJOR_VERSION_DR ||
+ (dev->version.major_version == HBM_MAJOR_VERSION_DR &&
+ dev->version.minor_version >= HBM_MINOR_VERSION_DR))
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index d4f9bfbaf023..6600b3466dfb 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -2378,9 +2378,9 @@ unsigned int mmc_calc_max_discard(struct mmc_card *card)
+ return card->pref_erase;
+
+ max_discard = mmc_do_calc_max_discard(card, MMC_ERASE_ARG);
+- if (max_discard && mmc_can_trim(card)) {
++ if (mmc_can_trim(card)) {
+ max_trim = mmc_do_calc_max_discard(card, MMC_TRIM_ARG);
+- if (max_trim < max_discard)
++ if (max_trim < max_discard || max_discard == 0)
+ max_discard = max_trim;
+ } else if (max_discard < card->erase_size) {
+ max_discard = 0;
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index 753973dc1655..8dae12b841b3 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -981,6 +981,7 @@ static void esdhc_set_uhs_signaling(struct sdhci_host *host, unsigned timing)
+ case MMC_TIMING_UHS_SDR25:
+ case MMC_TIMING_UHS_SDR50:
+ case MMC_TIMING_UHS_SDR104:
++ case MMC_TIMING_MMC_HS:
+ case MMC_TIMING_MMC_HS200:
+ writel(m, host->ioaddr + ESDHC_MIX_CTRL);
+ break;
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index ae219b8a7754..2646faffd36e 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -140,7 +140,7 @@
+ #define FLEXCAN_TX_MB 63
+ #define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST (FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP + 1)
+ #define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST (FLEXCAN_TX_MB - 1)
+-#define FLEXCAN_IFLAG_MB(x) BIT(x & 0x1f)
++#define FLEXCAN_IFLAG_MB(x) BIT((x) & 0x1f)
+ #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW BIT(7)
+ #define FLEXCAN_IFLAG_RX_FIFO_WARN BIT(6)
+ #define FLEXCAN_IFLAG_RX_FIFO_AVAILABLE BIT(5)
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index fc8b48adf38b..2fa2caf7a746 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -692,7 +692,7 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds)
+ * port, the other ones have already been disabled during
+ * bcm_sf2_sw_setup
+ */
+- for (port = 0; port < DSA_MAX_PORTS; port++) {
++ for (port = 0; port < ds->num_ports; port++) {
+ if (dsa_is_user_port(ds, port) || dsa_is_cpu_port(ds, port))
+ bcm_sf2_port_disable(ds, port, NULL);
+ }
+@@ -724,10 +724,11 @@ static void bcm_sf2_sw_get_wol(struct dsa_switch *ds, int port,
+ {
+ struct net_device *p = ds->ports[port].cpu_dp->master;
+ struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
+- struct ethtool_wolinfo pwol;
++ struct ethtool_wolinfo pwol = { };
+
+ /* Get the parent device WoL settings */
+- p->ethtool_ops->get_wol(p, &pwol);
++ if (p->ethtool_ops->get_wol)
++ p->ethtool_ops->get_wol(p, &pwol);
+
+ /* Advertise the parent device supported settings */
+ wol->supported = pwol.supported;
+@@ -748,9 +749,10 @@ static int bcm_sf2_sw_set_wol(struct dsa_switch *ds, int port,
+ struct net_device *p = ds->ports[port].cpu_dp->master;
+ struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
+ s8 cpu_port = ds->ports[port].cpu_dp->index;
+- struct ethtool_wolinfo pwol;
++ struct ethtool_wolinfo pwol = { };
+
+- p->ethtool_ops->get_wol(p, &pwol);
++ if (p->ethtool_ops->get_wol)
++ p->ethtool_ops->get_wol(p, &pwol);
+ if (wol->wolopts & ~pwol.supported)
+ return -EINVAL;
+
+diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
+index bb41becb6609..31ff1e0d1baa 100644
+--- a/drivers/net/ethernet/atheros/atlx/atl2.c
++++ b/drivers/net/ethernet/atheros/atlx/atl2.c
+@@ -1335,13 +1335,11 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ struct net_device *netdev;
+ struct atl2_adapter *adapter;
+- static int cards_found;
++ static int cards_found = 0;
+ unsigned long mmio_start;
+ int mmio_len;
+ int err;
+
+- cards_found = 0;
+-
+ err = pci_enable_device(pdev);
+ if (err)
+ return err;
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index fc16b2b0d0e9..0bdbc72605e1 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -134,6 +134,10 @@ static int bcm_sysport_set_rx_csum(struct net_device *dev,
+
+ priv->rx_chk_en = !!(wanted & NETIF_F_RXCSUM);
+ reg = rxchk_readl(priv, RXCHK_CONTROL);
++ /* Clear L2 header checks, which would prevent BPDUs
++ * from being received.
++ */
++ reg &= ~RXCHK_L2_HDR_DIS;
+ if (priv->rx_chk_en)
+ reg |= RXCHK_EN;
+ else
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 1fdaf86bbe8f..0bd93bb7d1a2 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -3542,7 +3542,7 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len,
+ if (len)
+ break;
+ /* on first few passes, just barely sleep */
+- if (i < DFLT_HWRM_CMD_TIMEOUT)
++ if (i < HWRM_SHORT_TIMEOUT_COUNTER)
+ usleep_range(HWRM_SHORT_MIN_TIMEOUT,
+ HWRM_SHORT_MAX_TIMEOUT);
+ else
+@@ -3565,7 +3565,7 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len,
+ dma_rmb();
+ if (*valid)
+ break;
+- udelay(1);
++ usleep_range(1, 5);
+ }
+
+ if (j >= HWRM_VALID_BIT_DELAY_USEC) {
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index bde384630a75..cf2d4a6583d5 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -548,7 +548,7 @@ struct rx_tpa_end_cmp_ext {
+ (HWRM_SHORT_TIMEOUT_COUNTER * HWRM_SHORT_MIN_TIMEOUT + \
+ ((n) - HWRM_SHORT_TIMEOUT_COUNTER) * HWRM_MIN_TIMEOUT))
+
+-#define HWRM_VALID_BIT_DELAY_USEC 20
++#define HWRM_VALID_BIT_DELAY_USEC 150
+
+ #define BNXT_RX_EVENT 1
+ #define BNXT_AGG_EVENT 2
+diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
+index 6c8dcb65ff03..90497a27df18 100644
+--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
+@@ -1039,7 +1039,7 @@ static void nic_handle_mbx_intr(struct nicpf *nic, int vf)
+ case NIC_MBOX_MSG_CFG_DONE:
+ /* Last message of VF config msg sequence */
+ nic_enable_vf(nic, vf, true);
+- goto unlock;
++ break;
+ case NIC_MBOX_MSG_SHUTDOWN:
+ /* First msg in VF teardown sequence */
+ if (vf >= nic->num_vf_en)
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+index 88f8a8fa93cd..9800738448ec 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -172,6 +172,17 @@ static int nicvf_check_pf_ready(struct nicvf *nic)
+ return 1;
+ }
+
++static void nicvf_send_cfg_done(struct nicvf *nic)
++{
++ union nic_mbx mbx = {};
++
++ mbx.msg.msg = NIC_MBOX_MSG_CFG_DONE;
++ if (nicvf_send_msg_to_pf(nic, &mbx)) {
++ netdev_err(nic->netdev,
++ "PF didn't respond to CFG DONE msg\n");
++ }
++}
++
+ static void nicvf_read_bgx_stats(struct nicvf *nic, struct bgx_stats_msg *bgx)
+ {
+ if (bgx->rx)
+@@ -1416,7 +1427,6 @@ int nicvf_open(struct net_device *netdev)
+ struct nicvf *nic = netdev_priv(netdev);
+ struct queue_set *qs = nic->qs;
+ struct nicvf_cq_poll *cq_poll = NULL;
+- union nic_mbx mbx = {};
+
+ netif_carrier_off(netdev);
+
+@@ -1512,8 +1522,7 @@ int nicvf_open(struct net_device *netdev)
+ nicvf_enable_intr(nic, NICVF_INTR_RBDR, qidx);
+
+ /* Send VF config done msg to PF */
+- mbx.msg.msg = NIC_MBOX_MSG_CFG_DONE;
+- nicvf_write_to_mbx(nic, &mbx);
++ nicvf_send_cfg_done(nic);
+
+ return 0;
+ cleanup:
+@@ -1941,7 +1950,8 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs,
+
+ /* flush DMAC filters and reset RX mode */
+ mbx.xcast.msg = NIC_MBOX_MSG_RESET_XCAST;
+- nicvf_send_msg_to_pf(nic, &mbx);
++ if (nicvf_send_msg_to_pf(nic, &mbx) < 0)
++ goto free_mc;
+
+ if (mode & BGX_XCAST_MCAST_FILTER) {
+ /* once enabling filtering, we need to signal to PF to add
+@@ -1949,7 +1959,8 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs,
+ */
+ mbx.xcast.msg = NIC_MBOX_MSG_ADD_MCAST;
+ mbx.xcast.data.mac = 0;
+- nicvf_send_msg_to_pf(nic, &mbx);
++ if (nicvf_send_msg_to_pf(nic, &mbx) < 0)
++ goto free_mc;
+ }
+
+ /* check if we have any specific MACs to be added to PF DMAC filter */
+@@ -1958,9 +1969,9 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs,
+ for (idx = 0; idx < mc_addrs->count; idx++) {
+ mbx.xcast.msg = NIC_MBOX_MSG_ADD_MCAST;
+ mbx.xcast.data.mac = mc_addrs->mc[idx];
+- nicvf_send_msg_to_pf(nic, &mbx);
++ if (nicvf_send_msg_to_pf(nic, &mbx) < 0)
++ goto free_mc;
+ }
+- kfree(mc_addrs);
+ }
+
+ /* and finally set rx mode for PF accordingly */
+@@ -1968,6 +1979,8 @@ static void __nicvf_set_rx_mode_task(u8 mode, struct xcast_addr_list *mc_addrs,
+ mbx.xcast.data.mode = mode;
+
+ nicvf_send_msg_to_pf(nic, &mbx);
++free_mc:
++ kfree(mc_addrs);
+ }
+
+ static void nicvf_set_rx_mode_task(struct work_struct *work_arg)
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+index 3b9e74be5fbd..b8155f5e71b4 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -3081,6 +3081,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
+ dsaf_dev = dev_get_drvdata(&pdev->dev);
+ if (!dsaf_dev) {
+ dev_err(&pdev->dev, "dsaf_dev is NULL\n");
++ put_device(&pdev->dev);
+ return -ENODEV;
+ }
+
+@@ -3088,6 +3089,7 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
+ if (AE_IS_VER1(dsaf_dev->dsaf_ver)) {
+ dev_err(dsaf_dev->dev, "%s v1 chip doesn't support RoCE!\n",
+ dsaf_dev->ae_dev.name);
++ put_device(&pdev->dev);
+ return -ENODEV;
+ }
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 6cdd58d9d461..410d5d3aa393 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -3924,8 +3924,11 @@ static void ixgbe_setup_mrqc(struct ixgbe_adapter *adapter)
+ else
+ mrqc = IXGBE_MRQC_VMDQRSS64EN;
+
+- /* Enable L3/L4 for Tx Switched packets */
+- mrqc |= IXGBE_MRQC_L3L4TXSWEN;
++ /* Enable L3/L4 for Tx Switched packets only for X550,
++ * older devices do not support this feature
++ */
++ if (hw->mac.type >= ixgbe_mac_X550)
++ mrqc |= IXGBE_MRQC_L3L4TXSWEN;
+ } else {
+ if (tcs > 4)
+ mrqc = IXGBE_MRQC_RTRSS8TCEN;
+diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
+index 62f204f32316..59007d6cd36d 100644
+--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
++++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
+@@ -2886,7 +2886,7 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)
+
+ ret = mv643xx_eth_shared_of_probe(pdev);
+ if (ret)
+- return ret;
++ goto err_put_clk;
+ pd = dev_get_platdata(&pdev->dev);
+
+ msp->tx_csum_limit = (pd != NULL && pd->tx_csum_limit) ?
+@@ -2894,6 +2894,11 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)
+ infer_hw_params(msp);
+
+ return 0;
++
++err_put_clk:
++ if (!IS_ERR(msp->clk))
++ clk_disable_unprepare(msp->clk);
++ return ret;
+ }
+
+ static int mv643xx_eth_shared_remove(struct platform_device *pdev)
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index a78a39244b79..2ba0d89aaf3c 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -2147,7 +2147,7 @@ err_drop_frame:
+ if (unlikely(!skb))
+ goto err_drop_frame_ret_pool;
+
+- dma_sync_single_range_for_cpu(dev->dev.parent,
++ dma_sync_single_range_for_cpu(&pp->bm_priv->pdev->dev,
+ rx_desc->buf_phys_addr,
+ MVNETA_MH_SIZE + NET_SKB_PAD,
+ rx_bytes,
+diff --git a/drivers/net/ethernet/netronome/nfp/bpf/jit.c b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
+index eff57f7d056a..4e18d95e548f 100644
+--- a/drivers/net/ethernet/netronome/nfp/bpf/jit.c
++++ b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
+@@ -1288,15 +1288,10 @@ wrp_alu64_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta,
+
+ static int
+ wrp_alu32_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta,
+- enum alu_op alu_op, bool skip)
++ enum alu_op alu_op)
+ {
+ const struct bpf_insn *insn = &meta->insn;
+
+- if (skip) {
+- meta->skip = true;
+- return 0;
+- }
+-
+ wrp_alu_imm(nfp_prog, insn->dst_reg * 2, alu_op, insn->imm);
+ wrp_immed(nfp_prog, reg_both(insn->dst_reg * 2 + 1), 0);
+
+@@ -2306,7 +2301,7 @@ static int xor_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+
+ static int xor_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+ {
+- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_XOR, !~meta->insn.imm);
++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_XOR);
+ }
+
+ static int and_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+@@ -2316,7 +2311,7 @@ static int and_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+
+ static int and_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+ {
+- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_AND, !~meta->insn.imm);
++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_AND);
+ }
+
+ static int or_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+@@ -2326,7 +2321,7 @@ static int or_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+
+ static int or_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+ {
+- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_OR, !meta->insn.imm);
++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_OR);
+ }
+
+ static int add_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+@@ -2336,7 +2331,7 @@ static int add_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+
+ static int add_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+ {
+- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_ADD, !meta->insn.imm);
++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_ADD);
+ }
+
+ static int sub_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+@@ -2346,7 +2341,7 @@ static int sub_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+
+ static int sub_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+ {
+- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_SUB, !meta->insn.imm);
++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_SUB);
+ }
+
+ static int mul_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+index e860bdf0f752..b7471e48db7b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -1689,6 +1689,15 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn,
+
+ eth_hlen = ETH_HLEN + (vlan_valid ? sizeof(u32) : 0);
+
++ if (!ether_addr_equal(ethh->h_dest,
++ p_hwfn->p_rdma_info->iwarp.mac_addr)) {
++ DP_VERBOSE(p_hwfn,
++ QED_MSG_RDMA,
++ "Got unexpected mac %pM instead of %pM\n",
++ ethh->h_dest, p_hwfn->p_rdma_info->iwarp.mac_addr);
++ return -EINVAL;
++ }
++
+ ether_addr_copy(remote_mac_addr, ethh->h_source);
+ ether_addr_copy(local_mac_addr, ethh->h_dest);
+
+@@ -2606,7 +2615,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
+ struct qed_iwarp_info *iwarp_info;
+ struct qed_ll2_acquire_data data;
+ struct qed_ll2_cbs cbs;
+- u32 mpa_buff_size;
++ u32 buff_size;
+ u16 n_ooo_bufs;
+ int rc = 0;
+ int i;
+@@ -2633,7 +2642,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
+
+ memset(&data, 0, sizeof(data));
+ data.input.conn_type = QED_LL2_TYPE_IWARP;
+- data.input.mtu = QED_IWARP_MAX_SYN_PKT_SIZE;
++ data.input.mtu = params->max_mtu;
+ data.input.rx_num_desc = QED_IWARP_LL2_SYN_RX_SIZE;
+ data.input.tx_num_desc = QED_IWARP_LL2_SYN_TX_SIZE;
+ data.input.tx_max_bds_per_packet = 1; /* will never be fragmented */
+@@ -2655,9 +2664,10 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
+ goto err;
+ }
+
++ buff_size = QED_IWARP_MAX_BUF_SIZE(params->max_mtu);
+ rc = qed_iwarp_ll2_alloc_buffers(p_hwfn,
+ QED_IWARP_LL2_SYN_RX_SIZE,
+- QED_IWARP_MAX_SYN_PKT_SIZE,
++ buff_size,
+ iwarp_info->ll2_syn_handle);
+ if (rc)
+ goto err;
+@@ -2711,10 +2721,9 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
+ if (rc)
+ goto err;
+
+- mpa_buff_size = QED_IWARP_MAX_BUF_SIZE(params->max_mtu);
+ rc = qed_iwarp_ll2_alloc_buffers(p_hwfn,
+ data.input.rx_num_desc,
+- mpa_buff_size,
++ buff_size,
+ iwarp_info->ll2_mpa_handle);
+ if (rc)
+ goto err;
+@@ -2727,7 +2736,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
+
+ iwarp_info->max_num_partial_fpdus = (u16)p_hwfn->p_rdma_info->num_qps;
+
+- iwarp_info->mpa_intermediate_buf = kzalloc(mpa_buff_size, GFP_KERNEL);
++ iwarp_info->mpa_intermediate_buf = kzalloc(buff_size, GFP_KERNEL);
+ if (!iwarp_info->mpa_intermediate_buf)
+ goto err;
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.h b/drivers/net/ethernet/qlogic/qed/qed_iwarp.h
+index b8f612d00241..7ac959038324 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.h
+@@ -46,7 +46,6 @@ enum qed_iwarp_qp_state qed_roce2iwarp_state(enum qed_roce_qp_state state);
+
+ #define QED_IWARP_LL2_SYN_TX_SIZE (128)
+ #define QED_IWARP_LL2_SYN_RX_SIZE (256)
+-#define QED_IWARP_MAX_SYN_PKT_SIZE (128)
+
+ #define QED_IWARP_LL2_OOO_DEF_TX_SIZE (256)
+ #define QED_IWARP_MAX_OOO (16)
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 6e381354f658..74bebbdb4b15 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1208,8 +1208,8 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */
+ {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */
+ {QMI_FIXED_INTF(0x1199, 0x68a2, 19)}, /* Sierra Wireless MC7710 in QMI mode */
+- {QMI_FIXED_INTF(0x1199, 0x68c0, 8)}, /* Sierra Wireless MC7304/MC7354 */
+- {QMI_FIXED_INTF(0x1199, 0x68c0, 10)}, /* Sierra Wireless MC7304/MC7354 */
++ {QMI_QUIRK_SET_DTR(0x1199, 0x68c0, 8)}, /* Sierra Wireless MC7304/MC7354, WP76xx */
++ {QMI_QUIRK_SET_DTR(0x1199, 0x68c0, 10)},/* Sierra Wireless MC7304/MC7354 */
+ {QMI_FIXED_INTF(0x1199, 0x901c, 8)}, /* Sierra Wireless EM7700 */
+ {QMI_FIXED_INTF(0x1199, 0x901f, 8)}, /* Sierra Wireless EM7355 */
+ {QMI_FIXED_INTF(0x1199, 0x9041, 8)}, /* Sierra Wireless MC7305/MC7355 */
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 4ca6592f5b3a..7cd428c0af43 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3454,7 +3454,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ goto out_err;
+ }
+
+- genlmsg_reply(skb, info);
++ res = genlmsg_reply(skb, info);
+ break;
+ }
+
+diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+index 789337ea676a..6ede6168bd85 100644
+--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+@@ -433,8 +433,6 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
+ skb_tail_pointer(skb),
+ MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn, cardp);
+
+- cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET;
+-
+ lbtf_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n",
+ cardp->rx_urb);
+ ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC);
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index 1d28cd656536..1eeb7be6aa34 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -625,7 +625,7 @@ static const guid_t *to_abstraction_guid(enum nvdimm_claim_class claim_class,
+
+ static int __pmem_label_update(struct nd_region *nd_region,
+ struct nd_mapping *nd_mapping, struct nd_namespace_pmem *nspm,
+- int pos)
++ int pos, unsigned long flags)
+ {
+ struct nd_namespace_common *ndns = &nspm->nsio.common;
+ struct nd_interleave_set *nd_set = nd_region->nd_set;
+@@ -666,7 +666,7 @@ static int __pmem_label_update(struct nd_region *nd_region,
+ memcpy(nd_label->uuid, nspm->uuid, NSLABEL_UUID_LEN);
+ if (nspm->alt_name)
+ memcpy(nd_label->name, nspm->alt_name, NSLABEL_NAME_LEN);
+- nd_label->flags = __cpu_to_le32(NSLABEL_FLAG_UPDATING);
++ nd_label->flags = __cpu_to_le32(flags);
+ nd_label->nlabel = __cpu_to_le16(nd_region->ndr_mappings);
+ nd_label->position = __cpu_to_le16(pos);
+ nd_label->isetcookie = __cpu_to_le64(cookie);
+@@ -1120,13 +1120,13 @@ static int del_labels(struct nd_mapping *nd_mapping, u8 *uuid)
+ int nd_pmem_namespace_label_update(struct nd_region *nd_region,
+ struct nd_namespace_pmem *nspm, resource_size_t size)
+ {
+- int i;
++ int i, rc;
+
+ for (i = 0; i < nd_region->ndr_mappings; i++) {
+ struct nd_mapping *nd_mapping = &nd_region->mapping[i];
+ struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
+ struct resource *res;
+- int rc, count = 0;
++ int count = 0;
+
+ if (size == 0) {
+ rc = del_labels(nd_mapping, nspm->uuid);
+@@ -1144,7 +1144,20 @@ int nd_pmem_namespace_label_update(struct nd_region *nd_region,
+ if (rc < 0)
+ return rc;
+
+- rc = __pmem_label_update(nd_region, nd_mapping, nspm, i);
++ rc = __pmem_label_update(nd_region, nd_mapping, nspm, i,
++ NSLABEL_FLAG_UPDATING);
++ if (rc)
++ return rc;
++ }
++
++ if (size == 0)
++ return 0;
++
++ /* Clear the UPDATING flag per UEFI 2.7 expectations */
++ for (i = 0; i < nd_region->ndr_mappings; i++) {
++ struct nd_mapping *nd_mapping = &nd_region->mapping[i];
++
++ rc = __pmem_label_update(nd_region, nd_mapping, nspm, i, 0);
+ if (rc)
+ return rc;
+ }
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index 4a4266250c28..54d79837f7c6 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -138,6 +138,7 @@ bool nd_is_uuid_unique(struct device *dev, u8 *uuid)
+ bool pmem_should_map_pages(struct device *dev)
+ {
+ struct nd_region *nd_region = to_nd_region(dev->parent);
++ struct nd_namespace_common *ndns = to_ndns(dev);
+ struct nd_namespace_io *nsio;
+
+ if (!IS_ENABLED(CONFIG_ZONE_DEVICE))
+@@ -149,6 +150,9 @@ bool pmem_should_map_pages(struct device *dev)
+ if (is_nd_pfn(dev) || is_nd_btt(dev))
+ return false;
+
++ if (ndns->force_raw)
++ return false;
++
+ nsio = to_nd_namespace_io(dev);
+ if (region_intersects(nsio->res.start, resource_size(&nsio->res),
+ IORESOURCE_SYSTEM_RAM,
+diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
+index 7fe84bfe0878..3ee995a3bfc9 100644
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -534,7 +534,7 @@ static unsigned long init_altmap_base(resource_size_t base)
+
+ static unsigned long init_altmap_reserve(resource_size_t base)
+ {
+- unsigned long reserve = PHYS_PFN(SZ_8K);
++ unsigned long reserve = PFN_UP(SZ_8K);
+ unsigned long base_pfn = PHYS_PFN(base);
+
+ reserve += base_pfn - PFN_SECTION_ALIGN_DOWN(base_pfn);
+@@ -619,7 +619,7 @@ static void trim_pfn_device(struct nd_pfn *nd_pfn, u32 *start_pad, u32 *end_trun
+ if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM,
+ IORES_DESC_NONE) == REGION_MIXED
+ || !IS_ALIGNED(end, nd_pfn->align)
+- || nd_region_conflict(nd_region, start, size + adjust))
++ || nd_region_conflict(nd_region, start, size))
+ *end_trunc = end - phys_pmem_align_down(nd_pfn, end);
+ }
+
+diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
+index 380916bff9e0..dee5b9e35ffd 100644
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -1377,7 +1377,7 @@ static struct superio_struct *find_superio(struct parport *p)
+ {
+ int i;
+ for (i = 0; i < NR_SUPERIOS; i++)
+- if (superios[i].io != p->base)
++ if (superios[i].io == p->base)
+ return &superios[i];
+ return NULL;
+ }
+diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
+index 0fa9e8fdce66..b56e22262a77 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -439,7 +439,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ if (ret)
+ pci->num_viewport = 2;
+
+- if (IS_ENABLED(CONFIG_PCI_MSI)) {
++ if (IS_ENABLED(CONFIG_PCI_MSI) && pci_msi_enabled()) {
+ /*
+ * If a specific SoC driver needs to change the
+ * default number of vectors, it needs to implement
+diff --git a/drivers/pci/pcie/dpc.c b/drivers/pci/pcie/dpc.c
+index f03279fc87cd..1908dd2978d3 100644
+--- a/drivers/pci/pcie/dpc.c
++++ b/drivers/pci/pcie/dpc.c
+@@ -153,6 +153,28 @@ static void dpc_process_rp_pio_error(struct dpc_dev *dpc)
+ pci_write_config_dword(pdev, cap + PCI_EXP_DPC_RP_PIO_STATUS, status);
+ }
+
++static int dpc_get_aer_uncorrect_severity(struct pci_dev *dev,
++ struct aer_err_info *info)
++{
++ int pos = dev->aer_cap;
++ u32 status, mask, sev;
++
++ pci_read_config_dword(dev, pos + PCI_ERR_UNCOR_STATUS, &status);
++ pci_read_config_dword(dev, pos + PCI_ERR_UNCOR_MASK, &mask);
++ status &= ~mask;
++ if (!status)
++ return 0;
++
++ pci_read_config_dword(dev, pos + PCI_ERR_UNCOR_SEVER, &sev);
++ status &= sev;
++ if (status)
++ info->severity = AER_FATAL;
++ else
++ info->severity = AER_NONFATAL;
++
++ return 1;
++}
++
+ static irqreturn_t dpc_handler(int irq, void *context)
+ {
+ struct aer_err_info info;
+@@ -180,9 +202,12 @@ static irqreturn_t dpc_handler(int irq, void *context)
+ /* show RP PIO error detail information */
+ if (dpc->rp_extensions && reason == 3 && ext_reason == 0)
+ dpc_process_rp_pio_error(dpc);
+- else if (reason == 0 && aer_get_device_error_info(pdev, &info)) {
++ else if (reason == 0 &&
++ dpc_get_aer_uncorrect_severity(pdev, &info) &&
++ aer_get_device_error_info(pdev, &info)) {
+ aer_print_error(pdev, &info);
+ pci_cleanup_aer_uncorrect_error_status(pdev);
++ pci_aer_clear_fatal_status(pdev);
+ }
+
+ /* We configure DPC so it only triggers on ERR_FATAL */
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 201f9e5ff55c..4a4c16bfc0d3 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -2038,11 +2038,8 @@ static void pci_configure_ltr(struct pci_dev *dev)
+ {
+ #ifdef CONFIG_PCIEASPM
+ struct pci_host_bridge *host = pci_find_host_bridge(dev->bus);
+- u32 cap;
+ struct pci_dev *bridge;
+-
+- if (!host->native_ltr)
+- return;
++ u32 cap, ctl;
+
+ if (!pci_is_pcie(dev))
+ return;
+@@ -2051,22 +2048,35 @@ static void pci_configure_ltr(struct pci_dev *dev)
+ if (!(cap & PCI_EXP_DEVCAP2_LTR))
+ return;
+
+- /*
+- * Software must not enable LTR in an Endpoint unless the Root
+- * Complex and all intermediate Switches indicate support for LTR.
+- * PCIe r3.1, sec 6.18.
+- */
+- if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
+- dev->ltr_path = 1;
+- else {
++ pcie_capability_read_dword(dev, PCI_EXP_DEVCTL2, &ctl);
++ if (ctl & PCI_EXP_DEVCTL2_LTR_EN) {
++ if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) {
++ dev->ltr_path = 1;
++ return;
++ }
++
+ bridge = pci_upstream_bridge(dev);
+ if (bridge && bridge->ltr_path)
+ dev->ltr_path = 1;
++
++ return;
+ }
+
+- if (dev->ltr_path)
++ if (!host->native_ltr)
++ return;
++
++ /*
++ * Software must not enable LTR in an Endpoint unless the Root
++ * Complex and all intermediate Switches indicate support for LTR.
++ * PCIe r4.0, sec 6.18.
++ */
++ if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT ||
++ ((bridge = pci_upstream_bridge(dev)) &&
++ bridge->ltr_path)) {
+ pcie_capability_set_word(dev, PCI_EXP_DEVCTL2,
+ PCI_EXP_DEVCTL2_LTR_EN);
++ dev->ltr_path = 1;
++ }
+ #endif
+ }
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
+index 91cffc051055..ead4beb5f55f 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
+@@ -665,7 +665,7 @@ static const char * const sd_a_groups[] = {
+
+ static const char * const sdxc_a_groups[] = {
+ "sdxc_d0_0_a", "sdxc_d13_0_a", "sdxc_d47_a", "sdxc_clk_a",
+- "sdxc_cmd_a", "sdxc_d0_1_a", "sdxc_d0_13_1_a"
++ "sdxc_cmd_a", "sdxc_d0_1_a", "sdxc_d13_1_a"
+ };
+
+ static const char * const pcm_a_groups[] = {
+diff --git a/drivers/power/supply/cpcap-charger.c b/drivers/power/supply/cpcap-charger.c
+index e4905bef2663..37be541e057d 100644
+--- a/drivers/power/supply/cpcap-charger.c
++++ b/drivers/power/supply/cpcap-charger.c
+@@ -458,6 +458,7 @@ static void cpcap_usb_detect(struct work_struct *work)
+ goto out_err;
+ }
+
++ power_supply_changed(ddata->usb);
+ return;
+
+ out_err:
+diff --git a/drivers/regulator/max77620-regulator.c b/drivers/regulator/max77620-regulator.c
+index b94e3a721721..cd93cf53e23c 100644
+--- a/drivers/regulator/max77620-regulator.c
++++ b/drivers/regulator/max77620-regulator.c
+@@ -1,7 +1,7 @@
+ /*
+ * Maxim MAX77620 Regulator driver
+ *
+- * Copyright (c) 2016, NVIDIA CORPORATION. All rights reserved.
++ * Copyright (c) 2016-2018, NVIDIA CORPORATION. All rights reserved.
+ *
+ * Author: Mallikarjun Kasoju <mkasoju@nvidia.com>
+ * Laxman Dewangan <ldewangan@nvidia.com>
+@@ -803,6 +803,14 @@ static int max77620_regulator_probe(struct platform_device *pdev)
+ rdesc = &rinfo[id].desc;
+ pmic->rinfo[id] = &max77620_regs_info[id];
+ pmic->enable_power_mode[id] = MAX77620_POWER_MODE_NORMAL;
++ pmic->reg_pdata[id].active_fps_src = -1;
++ pmic->reg_pdata[id].active_fps_pd_slot = -1;
++ pmic->reg_pdata[id].active_fps_pu_slot = -1;
++ pmic->reg_pdata[id].suspend_fps_src = -1;
++ pmic->reg_pdata[id].suspend_fps_pd_slot = -1;
++ pmic->reg_pdata[id].suspend_fps_pu_slot = -1;
++ pmic->reg_pdata[id].power_ok = -1;
++ pmic->reg_pdata[id].ramp_rate_setting = -1;
+
+ ret = max77620_read_slew_rate(pmic, id);
+ if (ret < 0)
+diff --git a/drivers/regulator/s2mpa01.c b/drivers/regulator/s2mpa01.c
+index 095d25f3d2ea..58a1fe583a6c 100644
+--- a/drivers/regulator/s2mpa01.c
++++ b/drivers/regulator/s2mpa01.c
+@@ -298,13 +298,13 @@ static const struct regulator_desc regulators[] = {
+ regulator_desc_ldo(2, STEP_50_MV),
+ regulator_desc_ldo(3, STEP_50_MV),
+ regulator_desc_ldo(4, STEP_50_MV),
+- regulator_desc_ldo(5, STEP_50_MV),
++ regulator_desc_ldo(5, STEP_25_MV),
+ regulator_desc_ldo(6, STEP_25_MV),
+ regulator_desc_ldo(7, STEP_50_MV),
+ regulator_desc_ldo(8, STEP_50_MV),
+ regulator_desc_ldo(9, STEP_50_MV),
+ regulator_desc_ldo(10, STEP_50_MV),
+- regulator_desc_ldo(11, STEP_25_MV),
++ regulator_desc_ldo(11, STEP_50_MV),
+ regulator_desc_ldo(12, STEP_50_MV),
+ regulator_desc_ldo(13, STEP_50_MV),
+ regulator_desc_ldo(14, STEP_50_MV),
+@@ -315,11 +315,11 @@ static const struct regulator_desc regulators[] = {
+ regulator_desc_ldo(19, STEP_50_MV),
+ regulator_desc_ldo(20, STEP_50_MV),
+ regulator_desc_ldo(21, STEP_50_MV),
+- regulator_desc_ldo(22, STEP_25_MV),
+- regulator_desc_ldo(23, STEP_25_MV),
++ regulator_desc_ldo(22, STEP_50_MV),
++ regulator_desc_ldo(23, STEP_50_MV),
+ regulator_desc_ldo(24, STEP_50_MV),
+ regulator_desc_ldo(25, STEP_50_MV),
+- regulator_desc_ldo(26, STEP_50_MV),
++ regulator_desc_ldo(26, STEP_25_MV),
+ regulator_desc_buck1_4(1),
+ regulator_desc_buck1_4(2),
+ regulator_desc_buck1_4(3),
+diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
+index 5bb6f4ca48db..c584bd1ffa9c 100644
+--- a/drivers/regulator/s2mps11.c
++++ b/drivers/regulator/s2mps11.c
+@@ -363,7 +363,7 @@ static const struct regulator_desc s2mps11_regulators[] = {
+ regulator_desc_s2mps11_ldo(32, STEP_50_MV),
+ regulator_desc_s2mps11_ldo(33, STEP_50_MV),
+ regulator_desc_s2mps11_ldo(34, STEP_50_MV),
+- regulator_desc_s2mps11_ldo(35, STEP_50_MV),
++ regulator_desc_s2mps11_ldo(35, STEP_25_MV),
+ regulator_desc_s2mps11_ldo(36, STEP_50_MV),
+ regulator_desc_s2mps11_ldo(37, STEP_50_MV),
+ regulator_desc_s2mps11_ldo(38, STEP_50_MV),
+@@ -373,8 +373,8 @@ static const struct regulator_desc s2mps11_regulators[] = {
+ regulator_desc_s2mps11_buck1_4(4),
+ regulator_desc_s2mps11_buck5,
+ regulator_desc_s2mps11_buck67810(6, MIN_600_MV, STEP_6_25_MV),
+- regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_6_25_MV),
+- regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_6_25_MV),
++ regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_12_5_MV),
++ regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_12_5_MV),
+ regulator_desc_s2mps11_buck9,
+ regulator_desc_s2mps11_buck67810(10, MIN_750_MV, STEP_12_5_MV),
+ };
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index 4e7b55a14b1a..6e294b4d3635 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -4469,6 +4469,14 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp)
+ usrparm.psf_data &= 0x7fffffffULL;
+ usrparm.rssd_result &= 0x7fffffffULL;
+ }
++ /* at least 2 bytes are accessed and should be allocated */
++ if (usrparm.psf_data_len < 2) {
++ DBF_DEV_EVENT(DBF_WARNING, device,
++ "Symmetrix ioctl invalid data length %d",
++ usrparm.psf_data_len);
++ rc = -EINVAL;
++ goto out;
++ }
+ /* alloc I/O data area */
+ psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA);
+ rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
+diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
+index b67dc4974f23..ec54538f7ae1 100644
+--- a/drivers/s390/virtio/virtio_ccw.c
++++ b/drivers/s390/virtio/virtio_ccw.c
+@@ -272,6 +272,8 @@ static void virtio_ccw_drop_indicators(struct virtio_ccw_device *vcdev)
+ {
+ struct virtio_ccw_vq_info *info;
+
++ if (!vcdev->airq_info)
++ return;
+ list_for_each_entry(info, &vcdev->virtqueues, node)
+ drop_airq_indicator(info->vq, vcdev->airq_info);
+ }
+@@ -413,7 +415,7 @@ static int virtio_ccw_read_vq_conf(struct virtio_ccw_device *vcdev,
+ ret = ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_READ_VQ_CONF);
+ if (ret)
+ return ret;
+- return vcdev->config_block->num;
++ return vcdev->config_block->num ?: -ENOENT;
+ }
+
+ static void virtio_ccw_del_vq(struct virtqueue *vq, struct ccw1 *ccw)
+diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
+index 04443577d48b..1046947064a0 100644
+--- a/drivers/scsi/aacraid/linit.c
++++ b/drivers/scsi/aacraid/linit.c
+@@ -413,13 +413,16 @@ static int aac_slave_configure(struct scsi_device *sdev)
+ if (chn < AAC_MAX_BUSES && tid < AAC_MAX_TARGETS && aac->sa_firmware) {
+ devtype = aac->hba_map[chn][tid].devtype;
+
+- if (devtype == AAC_DEVTYPE_NATIVE_RAW)
++ if (devtype == AAC_DEVTYPE_NATIVE_RAW) {
+ depth = aac->hba_map[chn][tid].qd_limit;
+- else if (devtype == AAC_DEVTYPE_ARC_RAW)
++ set_timeout = 1;
++ goto common_config;
++ }
++ if (devtype == AAC_DEVTYPE_ARC_RAW) {
+ set_qd_dev_type = true;
+-
+- set_timeout = 1;
+- goto common_config;
++ set_timeout = 1;
++ goto common_config;
++ }
+ }
+
+ if (aac->jbod && (sdev->type == TYPE_DISK))
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index f78d2e5c1471..4ad61cfa69c0 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -1449,7 +1449,13 @@ static int iscsi_xmit_task(struct iscsi_conn *conn)
+ if (test_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx))
+ return -ENODATA;
+
++ spin_lock_bh(&conn->session->back_lock);
++ if (conn->task == NULL) {
++ spin_unlock_bh(&conn->session->back_lock);
++ return -ENODATA;
++ }
+ __iscsi_get_task(task);
++ spin_unlock_bh(&conn->session->back_lock);
+ spin_unlock_bh(&conn->session->frwd_lock);
+ rc = conn->session->tt->xmit_task(task);
+ spin_lock_bh(&conn->session->frwd_lock);
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 5352c9bbcaf7..f84f9bf15027 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -643,11 +643,14 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha,
+ break;
+ case DSC_LS_PORT_UNAVAIL:
+ default:
+- if (fcport->loop_id != FC_NO_LOOP_ID)
+- qla2x00_clear_loop_id(fcport);
+-
+- fcport->loop_id = loop_id;
+- fcport->fw_login_state = DSC_LS_PORT_UNAVAIL;
++ if (fcport->loop_id == FC_NO_LOOP_ID) {
++ qla2x00_find_new_loop_id(vha, fcport);
++ fcport->fw_login_state =
++ DSC_LS_PORT_UNAVAIL;
++ }
++ ql_dbg(ql_dbg_disc, vha, 0x20e5,
++ "%s %d %8phC\n", __func__, __LINE__,
++ fcport->port_name);
+ qla24xx_fcport_handle_login(vha, fcport);
+ break;
+ }
+@@ -1719,13 +1722,13 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
+
+ /* Issue Marker IOCB */
+ qla2x00_marker(vha, vha->hw->req_q_map[0],
+- vha->hw->rsp_q_map[0], sp->fcport->loop_id, lun,
++ vha->hw->rsp_q_map[0], fcport->loop_id, lun,
+ flags == TCF_LUN_RESET ? MK_SYNC_ID_LUN : MK_SYNC_ID);
+ }
+
+ done_free_sp:
+ sp->free(sp);
+- sp->fcport->flags &= ~FCF_ASYNC_SENT;
++ fcport->flags &= ~FCF_ASYNC_SENT;
+ done:
+ return rval;
+ }
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 58b78702c6c9..a3a5162fa60e 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3066,6 +3066,55 @@ static void sd_read_security(struct scsi_disk *sdkp, unsigned char *buffer)
+ sdkp->security = 1;
+ }
+
++/*
++ * Determine the device's preferred I/O size for reads and writes
++ * unless the reported value is unreasonably small, large, not a
++ * multiple of the physical block size, or simply garbage.
++ */
++static bool sd_validate_opt_xfer_size(struct scsi_disk *sdkp,
++ unsigned int dev_max)
++{
++ struct scsi_device *sdp = sdkp->device;
++ unsigned int opt_xfer_bytes =
++ logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
++
++ if (sdkp->opt_xfer_blocks > dev_max) {
++ sd_first_printk(KERN_WARNING, sdkp,
++ "Optimal transfer size %u logical blocks " \
++ "> dev_max (%u logical blocks)\n",
++ sdkp->opt_xfer_blocks, dev_max);
++ return false;
++ }
++
++ if (sdkp->opt_xfer_blocks > SD_DEF_XFER_BLOCKS) {
++ sd_first_printk(KERN_WARNING, sdkp,
++ "Optimal transfer size %u logical blocks " \
++ "> sd driver limit (%u logical blocks)\n",
++ sdkp->opt_xfer_blocks, SD_DEF_XFER_BLOCKS);
++ return false;
++ }
++
++ if (opt_xfer_bytes < PAGE_SIZE) {
++ sd_first_printk(KERN_WARNING, sdkp,
++ "Optimal transfer size %u bytes < " \
++ "PAGE_SIZE (%u bytes)\n",
++ opt_xfer_bytes, (unsigned int)PAGE_SIZE);
++ return false;
++ }
++
++ if (opt_xfer_bytes & (sdkp->physical_block_size - 1)) {
++ sd_first_printk(KERN_WARNING, sdkp,
++ "Optimal transfer size %u bytes not a " \
++ "multiple of physical block size (%u bytes)\n",
++ opt_xfer_bytes, sdkp->physical_block_size);
++ return false;
++ }
++
++ sd_first_printk(KERN_INFO, sdkp, "Optimal transfer size %u bytes\n",
++ opt_xfer_bytes);
++ return true;
++}
++
+ /**
+ * sd_revalidate_disk - called the first time a new disk is seen,
+ * performs disk spin up, read_capacity, etc.
+@@ -3144,15 +3193,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ dev_max = min_not_zero(dev_max, sdkp->max_xfer_blocks);
+ q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max);
+
+- /*
+- * Determine the device's preferred I/O size for reads and writes
+- * unless the reported value is unreasonably small, large, or
+- * garbage.
+- */
+- if (sdkp->opt_xfer_blocks &&
+- sdkp->opt_xfer_blocks <= dev_max &&
+- sdkp->opt_xfer_blocks <= SD_DEF_XFER_BLOCKS &&
+- logical_to_bytes(sdp, sdkp->opt_xfer_blocks) >= PAGE_SIZE) {
++ if (sd_validate_opt_xfer_size(sdkp, dev_max)) {
+ q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
+ rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
+ } else
+diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
+index 1c72db94270e..3d331a864b2f 100644
+--- a/drivers/scsi/virtio_scsi.c
++++ b/drivers/scsi/virtio_scsi.c
+@@ -621,7 +621,6 @@ static int virtscsi_device_reset(struct scsi_cmnd *sc)
+ return FAILED;
+
+ memset(cmd, 0, sizeof(*cmd));
+- cmd->sc = sc;
+ cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req){
+ .type = VIRTIO_SCSI_T_TMF,
+ .subtype = cpu_to_virtio32(vscsi->vdev,
+@@ -680,7 +679,6 @@ static int virtscsi_abort(struct scsi_cmnd *sc)
+ return FAILED;
+
+ memset(cmd, 0, sizeof(*cmd));
+- cmd->sc = sc;
+ cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req){
+ .type = VIRTIO_SCSI_T_TMF,
+ .subtype = VIRTIO_SCSI_T_TMF_ABORT_TASK,
+diff --git a/drivers/soc/qcom/rpmh.c b/drivers/soc/qcom/rpmh.c
+index c7beb6841289..ab8f731a3426 100644
+--- a/drivers/soc/qcom/rpmh.c
++++ b/drivers/soc/qcom/rpmh.c
+@@ -80,6 +80,7 @@ void rpmh_tx_done(const struct tcs_request *msg, int r)
+ struct rpmh_request *rpm_msg = container_of(msg, struct rpmh_request,
+ msg);
+ struct completion *compl = rpm_msg->completion;
++ bool free = rpm_msg->needs_free;
+
+ rpm_msg->err = r;
+
+@@ -94,7 +95,7 @@ void rpmh_tx_done(const struct tcs_request *msg, int r)
+ complete(compl);
+
+ exit:
+- if (rpm_msg->needs_free)
++ if (free)
+ kfree(rpm_msg);
+ }
+
+@@ -348,11 +349,12 @@ int rpmh_write_batch(const struct device *dev, enum rpmh_state state,
+ {
+ struct batch_cache_req *req;
+ struct rpmh_request *rpm_msgs;
+- DECLARE_COMPLETION_ONSTACK(compl);
++ struct completion *compls;
+ struct rpmh_ctrlr *ctrlr = get_rpmh_ctrlr(dev);
+ unsigned long time_left;
+ int count = 0;
+- int ret, i, j;
++ int ret, i;
++ void *ptr;
+
+ if (!cmd || !n)
+ return -EINVAL;
+@@ -362,10 +364,15 @@ int rpmh_write_batch(const struct device *dev, enum rpmh_state state,
+ if (!count)
+ return -EINVAL;
+
+- req = kzalloc(sizeof(*req) + count * sizeof(req->rpm_msgs[0]),
++ ptr = kzalloc(sizeof(*req) +
++ count * (sizeof(req->rpm_msgs[0]) + sizeof(*compls)),
+ GFP_ATOMIC);
+- if (!req)
++ if (!ptr)
+ return -ENOMEM;
++
++ req = ptr;
++ compls = ptr + sizeof(*req) + count * sizeof(*rpm_msgs);
++
+ req->count = count;
+ rpm_msgs = req->rpm_msgs;
+
+@@ -380,25 +387,26 @@ int rpmh_write_batch(const struct device *dev, enum rpmh_state state,
+ }
+
+ for (i = 0; i < count; i++) {
+- rpm_msgs[i].completion = &compl;
++ struct completion *compl = &compls[i];
++
++ init_completion(compl);
++ rpm_msgs[i].completion = compl;
+ ret = rpmh_rsc_send_data(ctrlr_to_drv(ctrlr), &rpm_msgs[i].msg);
+ if (ret) {
+ pr_err("Error(%d) sending RPMH message addr=%#x\n",
+ ret, rpm_msgs[i].msg.cmds[0].addr);
+- for (j = i; j < count; j++)
+- rpmh_tx_done(&rpm_msgs[j].msg, ret);
+ break;
+ }
+ }
+
+ time_left = RPMH_TIMEOUT_MS;
+- for (i = 0; i < count; i++) {
+- time_left = wait_for_completion_timeout(&compl, time_left);
++ while (i--) {
++ time_left = wait_for_completion_timeout(&compls[i], time_left);
+ if (!time_left) {
+ /*
+ * Better hope they never finish because they'll signal
+- * the completion on our stack and that's bad once
+- * we've returned from the function.
++ * the completion that we're going to free once
++ * we've returned from this function.
+ */
+ WARN_ON(1);
+ ret = -ETIMEDOUT;
+@@ -407,7 +415,7 @@ int rpmh_write_batch(const struct device *dev, enum rpmh_state state,
+ }
+
+ exit:
+- kfree(req);
++ kfree(ptr);
+
+ return ret;
+ }
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index 14f4ea59caff..b624f6fb04ce 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1612,6 +1612,7 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
+ platform_info->enable_dma = false;
+ } else {
+ master->can_dma = pxa2xx_spi_can_dma;
++ master->max_dma_len = MAX_DMA_LEN;
+ }
+ }
+
+diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
+index 5f19016bbf10..b9fb6493cd6b 100644
+--- a/drivers/spi/spi-ti-qspi.c
++++ b/drivers/spi/spi-ti-qspi.c
+@@ -490,8 +490,8 @@ static void ti_qspi_enable_memory_map(struct spi_device *spi)
+ ti_qspi_write(qspi, MM_SWITCH, QSPI_SPI_SWITCH_REG);
+ if (qspi->ctrl_base) {
+ regmap_update_bits(qspi->ctrl_base, qspi->ctrl_reg,
+- MEM_CS_EN(spi->chip_select),
+- MEM_CS_MASK);
++ MEM_CS_MASK,
++ MEM_CS_EN(spi->chip_select));
+ }
+ qspi->mmap_enabled = true;
+ }
+@@ -503,7 +503,7 @@ static void ti_qspi_disable_memory_map(struct spi_device *spi)
+ ti_qspi_write(qspi, 0, QSPI_SPI_SWITCH_REG);
+ if (qspi->ctrl_base)
+ regmap_update_bits(qspi->ctrl_base, qspi->ctrl_reg,
+- 0, MEM_CS_MASK);
++ MEM_CS_MASK, 0);
+ qspi->mmap_enabled = false;
+ }
+
+diff --git a/drivers/staging/media/imx/imx-ic-prpencvf.c b/drivers/staging/media/imx/imx-ic-prpencvf.c
+index 28f41caba05d..fb442499f806 100644
+--- a/drivers/staging/media/imx/imx-ic-prpencvf.c
++++ b/drivers/staging/media/imx/imx-ic-prpencvf.c
+@@ -680,12 +680,23 @@ static int prp_start(struct prp_priv *priv)
+ goto out_free_nfb4eof_irq;
+ }
+
++ /* start upstream */
++ ret = v4l2_subdev_call(priv->src_sd, video, s_stream, 1);
++ ret = (ret && ret != -ENOIOCTLCMD) ? ret : 0;
++ if (ret) {
++ v4l2_err(&ic_priv->sd,
++ "upstream stream on failed: %d\n", ret);
++ goto out_free_eof_irq;
++ }
++
+ /* start the EOF timeout timer */
+ mod_timer(&priv->eof_timeout_timer,
+ jiffies + msecs_to_jiffies(IMX_MEDIA_EOF_TIMEOUT));
+
+ return 0;
+
++out_free_eof_irq:
++ devm_free_irq(ic_priv->dev, priv->eof_irq, priv);
+ out_free_nfb4eof_irq:
+ devm_free_irq(ic_priv->dev, priv->nfb4eof_irq, priv);
+ out_unsetup:
+@@ -717,6 +728,12 @@ static void prp_stop(struct prp_priv *priv)
+ if (ret == 0)
+ v4l2_warn(&ic_priv->sd, "wait last EOF timeout\n");
+
++ /* stop upstream */
++ ret = v4l2_subdev_call(priv->src_sd, video, s_stream, 0);
++ if (ret && ret != -ENOIOCTLCMD)
++ v4l2_warn(&ic_priv->sd,
++ "upstream stream off failed: %d\n", ret);
++
+ devm_free_irq(ic_priv->dev, priv->eof_irq, priv);
+ devm_free_irq(ic_priv->dev, priv->nfb4eof_irq, priv);
+
+@@ -1148,15 +1165,6 @@ static int prp_s_stream(struct v4l2_subdev *sd, int enable)
+ if (ret)
+ goto out;
+
+- /* start/stop upstream */
+- ret = v4l2_subdev_call(priv->src_sd, video, s_stream, enable);
+- ret = (ret && ret != -ENOIOCTLCMD) ? ret : 0;
+- if (ret) {
+- if (enable)
+- prp_stop(priv);
+- goto out;
+- }
+-
+ update_count:
+ priv->stream_count += enable ? 1 : -1;
+ if (priv->stream_count < 0)
+diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c
+index cd2c291e1e94..e22f1239a318 100644
+--- a/drivers/staging/media/imx/imx-media-csi.c
++++ b/drivers/staging/media/imx/imx-media-csi.c
+@@ -626,7 +626,7 @@ out_put_ipu:
+ return ret;
+ }
+
+-static void csi_idmac_stop(struct csi_priv *priv)
++static void csi_idmac_wait_last_eof(struct csi_priv *priv)
+ {
+ unsigned long flags;
+ int ret;
+@@ -643,7 +643,10 @@ static void csi_idmac_stop(struct csi_priv *priv)
+ &priv->last_eof_comp, msecs_to_jiffies(IMX_MEDIA_EOF_TIMEOUT));
+ if (ret == 0)
+ v4l2_warn(&priv->sd, "wait last EOF timeout\n");
++}
+
++static void csi_idmac_stop(struct csi_priv *priv)
++{
+ devm_free_irq(priv->dev, priv->eof_irq, priv);
+ devm_free_irq(priv->dev, priv->nfb4eof_irq, priv);
+
+@@ -719,10 +722,16 @@ static int csi_start(struct csi_priv *priv)
+
+ output_fi = &priv->frame_interval[priv->active_output_pad];
+
++ /* start upstream */
++ ret = v4l2_subdev_call(priv->src_sd, video, s_stream, 1);
++ ret = (ret && ret != -ENOIOCTLCMD) ? ret : 0;
++ if (ret)
++ return ret;
++
+ if (priv->dest == IPU_CSI_DEST_IDMAC) {
+ ret = csi_idmac_start(priv);
+ if (ret)
+- return ret;
++ goto stop_upstream;
+ }
+
+ ret = csi_setup(priv);
+@@ -750,11 +759,26 @@ fim_off:
+ idmac_stop:
+ if (priv->dest == IPU_CSI_DEST_IDMAC)
+ csi_idmac_stop(priv);
++stop_upstream:
++ v4l2_subdev_call(priv->src_sd, video, s_stream, 0);
+ return ret;
+ }
+
+ static void csi_stop(struct csi_priv *priv)
+ {
++ if (priv->dest == IPU_CSI_DEST_IDMAC)
++ csi_idmac_wait_last_eof(priv);
++
++ /*
++ * Disable the CSI asap, after syncing with the last EOF.
++ * Doing so after the IDMA channel is disabled has shown to
++ * create hard system-wide hangs.
++ */
++ ipu_csi_disable(priv->csi);
++
++ /* stop upstream */
++ v4l2_subdev_call(priv->src_sd, video, s_stream, 0);
++
+ if (priv->dest == IPU_CSI_DEST_IDMAC) {
+ csi_idmac_stop(priv);
+
+@@ -762,8 +786,6 @@ static void csi_stop(struct csi_priv *priv)
+ if (priv->fim)
+ imx_media_fim_set_stream(priv->fim, NULL, false);
+ }
+-
+- ipu_csi_disable(priv->csi);
+ }
+
+ static const struct csi_skip_desc csi_skip[12] = {
+@@ -924,23 +946,13 @@ static int csi_s_stream(struct v4l2_subdev *sd, int enable)
+ goto update_count;
+
+ if (enable) {
+- /* upstream must be started first, before starting CSI */
+- ret = v4l2_subdev_call(priv->src_sd, video, s_stream, 1);
+- ret = (ret && ret != -ENOIOCTLCMD) ? ret : 0;
+- if (ret)
+- goto out;
+-
+ dev_dbg(priv->dev, "stream ON\n");
+ ret = csi_start(priv);
+- if (ret) {
+- v4l2_subdev_call(priv->src_sd, video, s_stream, 0);
++ if (ret)
+ goto out;
+- }
+ } else {
+ dev_dbg(priv->dev, "stream OFF\n");
+- /* CSI must be stopped first, then stop upstream */
+ csi_stop(priv);
+- v4l2_subdev_call(priv->src_sd, video, s_stream, 0);
+ }
+
+ update_count:
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index cc756a123fd8..03e9cb156df9 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4045,9 +4045,9 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+ if (se_cmd->se_tfo != NULL) {
+- spin_lock(&se_cmd->t_state_lock);
++ spin_lock_irq(&se_cmd->t_state_lock);
+ se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+- spin_unlock(&se_cmd->t_state_lock);
++ spin_unlock_irq(&se_cmd->t_state_lock);
+ }
+ }
+ spin_unlock_bh(&conn->cmd_lock);
+diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c
+index 877fd7f8a8ed..98125de2f0a6 100644
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -130,6 +130,10 @@ static int of_platform_serial_setup(struct platform_device *ofdev,
+ port->flags |= UPF_IOREMAP;
+ }
+
++ /* Compatibility with the deprecated pxa driver and 8250_pxa drivers. */
++ if (of_device_is_compatible(np, "mrvl,mmp-uart"))
++ port->regshift = 2;
++
+ /* Check for registers offset within the devices address range */
+ if (of_property_read_u32(np, "reg-shift", &prop) == 0)
+ port->regshift = prop;
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 48bd694a5fa1..bbe5cba21522 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -2027,6 +2027,111 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
+ .setup = pci_default_setup,
+ .exit = pci_plx9050_exit,
+ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
+ /*
+ * SBS Technologies, Inc., PMC-OCTALPRO 232
+ */
+@@ -4575,10 +4680,10 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ */
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+@@ -4587,10 +4692,10 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+@@ -4599,10 +4704,10 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+@@ -4611,13 +4716,13 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7951 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+@@ -4626,16 +4731,16 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+@@ -4644,13 +4749,13 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7958 },
++ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7958 },
++ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7958 },
+@@ -4659,19 +4764,19 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ pbn_pericom_PI7C9X7958 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7958 },
++ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7958 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7958 },
++ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7958 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7958 },
++ pbn_pericom_PI7C9X7954 },
+ /*
+ * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke)
+ */
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index 87d8dd90d605..0e3627289047 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -362,7 +362,13 @@ static irqreturn_t cdns_uart_isr(int irq, void *dev_id)
+ cdns_uart_handle_tx(dev_id);
+ isrstatus &= ~CDNS_UART_IXR_TXEMPTY;
+ }
+- if (isrstatus & CDNS_UART_IXR_RXMASK)
++
++ /*
++ * Skip RX processing if RX is disabled as RXEMPTY will never be set
++ * as read bytes will not be removed from the FIFO.
++ */
++ if (isrstatus & CDNS_UART_IXR_RXMASK &&
++ !(readl(port->membase + CDNS_UART_CR) & CDNS_UART_CR_RX_DIS))
+ cdns_uart_handle_rx(dev_id, isrstatus);
+
+ spin_unlock(&port->lock);
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index da335899527b..b9a9a07f1ee9 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -935,8 +935,11 @@ static void flush_scrollback(struct vc_data *vc)
+ {
+ WARN_CONSOLE_UNLOCKED();
+
++ set_origin(vc);
+ if (vc->vc_sw->con_flush_scrollback)
+ vc->vc_sw->con_flush_scrollback(vc);
++ else
++ vc->vc_sw->con_switch(vc);
+ }
+
+ /*
+@@ -1506,8 +1509,10 @@ static void csi_J(struct vc_data *vc, int vpar)
+ count = ((vc->vc_pos - vc->vc_origin) >> 1) + 1;
+ start = (unsigned short *)vc->vc_origin;
+ break;
++ case 3: /* include scrollback */
++ flush_scrollback(vc);
++ /* fallthrough */
+ case 2: /* erase whole display */
+- case 3: /* (and scrollback buffer later) */
+ vc_uniscr_clear_lines(vc, 0, vc->vc_rows);
+ count = vc->vc_cols * vc->vc_rows;
+ start = (unsigned short *)vc->vc_origin;
+@@ -1516,13 +1521,7 @@ static void csi_J(struct vc_data *vc, int vpar)
+ return;
+ }
+ scr_memsetw(start, vc->vc_video_erase_char, 2 * count);
+- if (vpar == 3) {
+- set_origin(vc);
+- flush_scrollback(vc);
+- if (con_is_visible(vc))
+- update_screen(vc);
+- } else if (con_should_update(vc))
+- do_update_region(vc, (unsigned long) start, count);
++ update_region(vc, (unsigned long) start, count);
+ vc->vc_need_wrap = 0;
+ }
+
+diff --git a/drivers/usb/chipidea/ci_hdrc_tegra.c b/drivers/usb/chipidea/ci_hdrc_tegra.c
+index 772851bee99b..12025358bb3c 100644
+--- a/drivers/usb/chipidea/ci_hdrc_tegra.c
++++ b/drivers/usb/chipidea/ci_hdrc_tegra.c
+@@ -130,6 +130,7 @@ static int tegra_udc_remove(struct platform_device *pdev)
+ {
+ struct tegra_udc *udc = platform_get_drvdata(pdev);
+
++ ci_hdrc_remove_device(udc->dev);
+ usb_phy_set_suspend(udc->phy, 1);
+ clk_disable_unprepare(udc->clk);
+
+diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c
+index c84c8c189e90..eb8046f87a54 100644
+--- a/drivers/usb/typec/tps6598x.c
++++ b/drivers/usb/typec/tps6598x.c
+@@ -110,6 +110,20 @@ tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len)
+ return 0;
+ }
+
++static int tps6598x_block_write(struct tps6598x *tps, u8 reg,
++ void *val, size_t len)
++{
++ u8 data[TPS_MAX_LEN + 1];
++
++ if (!tps->i2c_protocol)
++ return regmap_raw_write(tps->regmap, reg, val, len);
++
++ data[0] = len;
++ memcpy(&data[1], val, len);
++
++ return regmap_raw_write(tps->regmap, reg, data, sizeof(data));
++}
++
+ static inline int tps6598x_read16(struct tps6598x *tps, u8 reg, u16 *val)
+ {
+ return tps6598x_block_read(tps, reg, val, sizeof(u16));
+@@ -127,23 +141,23 @@ static inline int tps6598x_read64(struct tps6598x *tps, u8 reg, u64 *val)
+
+ static inline int tps6598x_write16(struct tps6598x *tps, u8 reg, u16 val)
+ {
+- return regmap_raw_write(tps->regmap, reg, &val, sizeof(u16));
++ return tps6598x_block_write(tps, reg, &val, sizeof(u16));
+ }
+
+ static inline int tps6598x_write32(struct tps6598x *tps, u8 reg, u32 val)
+ {
+- return regmap_raw_write(tps->regmap, reg, &val, sizeof(u32));
++ return tps6598x_block_write(tps, reg, &val, sizeof(u32));
+ }
+
+ static inline int tps6598x_write64(struct tps6598x *tps, u8 reg, u64 val)
+ {
+- return regmap_raw_write(tps->regmap, reg, &val, sizeof(u64));
++ return tps6598x_block_write(tps, reg, &val, sizeof(u64));
+ }
+
+ static inline int
+ tps6598x_write_4cc(struct tps6598x *tps, u8 reg, const char *val)
+ {
+- return regmap_raw_write(tps->regmap, reg, &val, sizeof(u32));
++ return tps6598x_block_write(tps, reg, &val, sizeof(u32));
+ }
+
+ static int tps6598x_read_partner_identity(struct tps6598x *tps)
+@@ -229,8 +243,8 @@ static int tps6598x_exec_cmd(struct tps6598x *tps, const char *cmd,
+ return -EBUSY;
+
+ if (in_len) {
+- ret = regmap_raw_write(tps->regmap, TPS_REG_DATA1,
+- in_data, in_len);
++ ret = tps6598x_block_write(tps, TPS_REG_DATA1,
++ in_data, in_len);
+ if (ret)
+ return ret;
+ }
+diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
+index 5a0db6dec8d1..aaee1e6584e6 100644
+--- a/fs/9p/v9fs_vfs.h
++++ b/fs/9p/v9fs_vfs.h
+@@ -40,6 +40,9 @@
+ */
+ #define P9_LOCK_TIMEOUT (30*HZ)
+
++/* flags for v9fs_stat2inode() & v9fs_stat2inode_dotl() */
++#define V9FS_STAT2INODE_KEEP_ISIZE 1
++
+ extern struct file_system_type v9fs_fs_type;
+ extern const struct address_space_operations v9fs_addr_operations;
+ extern const struct file_operations v9fs_file_operations;
+@@ -61,8 +64,10 @@ int v9fs_init_inode(struct v9fs_session_info *v9ses,
+ struct inode *inode, umode_t mode, dev_t);
+ void v9fs_evict_inode(struct inode *inode);
+ ino_t v9fs_qid2ino(struct p9_qid *qid);
+-void v9fs_stat2inode(struct p9_wstat *, struct inode *, struct super_block *);
+-void v9fs_stat2inode_dotl(struct p9_stat_dotl *, struct inode *);
++void v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
++ struct super_block *sb, unsigned int flags);
++void v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode,
++ unsigned int flags);
+ int v9fs_dir_release(struct inode *inode, struct file *filp);
+ int v9fs_file_open(struct inode *inode, struct file *file);
+ void v9fs_inode2stat(struct inode *inode, struct p9_wstat *stat);
+@@ -83,4 +88,18 @@ static inline void v9fs_invalidate_inode_attr(struct inode *inode)
+ }
+
+ int v9fs_open_to_dotl_flags(int flags);
++
++static inline void v9fs_i_size_write(struct inode *inode, loff_t i_size)
++{
++ /*
++ * 32-bit need the lock, concurrent updates could break the
++ * sequences and make i_size_read() loop forever.
++ * 64-bit updates are atomic and can skip the locking.
++ */
++ if (sizeof(i_size) > sizeof(long))
++ spin_lock(&inode->i_lock);
++ i_size_write(inode, i_size);
++ if (sizeof(i_size) > sizeof(long))
++ spin_unlock(&inode->i_lock);
++}
+ #endif
+diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
+index ab3d5f5dbb00..c87e6d6ec069 100644
+--- a/fs/9p/vfs_file.c
++++ b/fs/9p/vfs_file.c
+@@ -442,7 +442,11 @@ v9fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ i_size = i_size_read(inode);
+ if (iocb->ki_pos > i_size) {
+ inode_add_bytes(inode, iocb->ki_pos - i_size);
+- i_size_write(inode, iocb->ki_pos);
++ /*
++ * Need to serialize against i_size_write() in
++ * v9fs_stat2inode()
++ */
++ v9fs_i_size_write(inode, iocb->ki_pos);
+ }
+ return retval;
+ }
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index 85ff859d3af5..72b779bc0942 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -538,7 +538,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
+ if (retval)
+ goto error;
+
+- v9fs_stat2inode(st, inode, sb);
++ v9fs_stat2inode(st, inode, sb, 0);
+ v9fs_cache_inode_get_cookie(inode);
+ unlock_new_inode(inode);
+ return inode;
+@@ -1092,7 +1092,7 @@ v9fs_vfs_getattr(const struct path *path, struct kstat *stat,
+ if (IS_ERR(st))
+ return PTR_ERR(st);
+
+- v9fs_stat2inode(st, d_inode(dentry), dentry->d_sb);
++ v9fs_stat2inode(st, d_inode(dentry), dentry->d_sb, 0);
+ generic_fillattr(d_inode(dentry), stat);
+
+ p9stat_free(st);
+@@ -1170,12 +1170,13 @@ static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
+ * @stat: Plan 9 metadata (mistat) structure
+ * @inode: inode to populate
+ * @sb: superblock of filesystem
++ * @flags: control flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE)
+ *
+ */
+
+ void
+ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
+- struct super_block *sb)
++ struct super_block *sb, unsigned int flags)
+ {
+ umode_t mode;
+ char ext[32];
+@@ -1216,10 +1217,11 @@ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
+ mode = p9mode2perm(v9ses, stat);
+ mode |= inode->i_mode & ~S_IALLUGO;
+ inode->i_mode = mode;
+- i_size_write(inode, stat->length);
+
++ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE))
++ v9fs_i_size_write(inode, stat->length);
+ /* not real number of blocks, but 512 byte ones ... */
+- inode->i_blocks = (i_size_read(inode) + 512 - 1) >> 9;
++ inode->i_blocks = (stat->length + 512 - 1) >> 9;
+ v9inode->cache_validity &= ~V9FS_INO_INVALID_ATTR;
+ }
+
+@@ -1416,9 +1418,9 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
+ {
+ int umode;
+ dev_t rdev;
+- loff_t i_size;
+ struct p9_wstat *st;
+ struct v9fs_session_info *v9ses;
++ unsigned int flags;
+
+ v9ses = v9fs_inode2v9ses(inode);
+ st = p9_client_stat(fid);
+@@ -1431,16 +1433,13 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
+ if ((inode->i_mode & S_IFMT) != (umode & S_IFMT))
+ goto out;
+
+- spin_lock(&inode->i_lock);
+ /*
+ * We don't want to refresh inode->i_size,
+ * because we may have cached data
+ */
+- i_size = inode->i_size;
+- v9fs_stat2inode(st, inode, inode->i_sb);
+- if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE)
+- inode->i_size = i_size;
+- spin_unlock(&inode->i_lock);
++ flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ?
++ V9FS_STAT2INODE_KEEP_ISIZE : 0;
++ v9fs_stat2inode(st, inode, inode->i_sb, flags);
+ out:
+ p9stat_free(st);
+ kfree(st);
+diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
+index 4823e1c46999..a950a927a626 100644
+--- a/fs/9p/vfs_inode_dotl.c
++++ b/fs/9p/vfs_inode_dotl.c
+@@ -143,7 +143,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
+ if (retval)
+ goto error;
+
+- v9fs_stat2inode_dotl(st, inode);
++ v9fs_stat2inode_dotl(st, inode, 0);
+ v9fs_cache_inode_get_cookie(inode);
+ retval = v9fs_get_acl(inode, fid);
+ if (retval)
+@@ -496,7 +496,7 @@ v9fs_vfs_getattr_dotl(const struct path *path, struct kstat *stat,
+ if (IS_ERR(st))
+ return PTR_ERR(st);
+
+- v9fs_stat2inode_dotl(st, d_inode(dentry));
++ v9fs_stat2inode_dotl(st, d_inode(dentry), 0);
+ generic_fillattr(d_inode(dentry), stat);
+ /* Change block size to what the server returned */
+ stat->blksize = st->st_blksize;
+@@ -607,11 +607,13 @@ int v9fs_vfs_setattr_dotl(struct dentry *dentry, struct iattr *iattr)
+ * v9fs_stat2inode_dotl - populate an inode structure with stat info
+ * @stat: stat structure
+ * @inode: inode to populate
++ * @flags: ctrl flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE)
+ *
+ */
+
+ void
+-v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
++v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode,
++ unsigned int flags)
+ {
+ umode_t mode;
+ struct v9fs_inode *v9inode = V9FS_I(inode);
+@@ -631,7 +633,8 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
+ mode |= inode->i_mode & ~S_IALLUGO;
+ inode->i_mode = mode;
+
+- i_size_write(inode, stat->st_size);
++ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE))
++ v9fs_i_size_write(inode, stat->st_size);
+ inode->i_blocks = stat->st_blocks;
+ } else {
+ if (stat->st_result_mask & P9_STATS_ATIME) {
+@@ -661,8 +664,9 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
+ }
+ if (stat->st_result_mask & P9_STATS_RDEV)
+ inode->i_rdev = new_decode_dev(stat->st_rdev);
+- if (stat->st_result_mask & P9_STATS_SIZE)
+- i_size_write(inode, stat->st_size);
++ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE) &&
++ stat->st_result_mask & P9_STATS_SIZE)
++ v9fs_i_size_write(inode, stat->st_size);
+ if (stat->st_result_mask & P9_STATS_BLOCKS)
+ inode->i_blocks = stat->st_blocks;
+ }
+@@ -928,9 +932,9 @@ v9fs_vfs_get_link_dotl(struct dentry *dentry,
+
+ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode)
+ {
+- loff_t i_size;
+ struct p9_stat_dotl *st;
+ struct v9fs_session_info *v9ses;
++ unsigned int flags;
+
+ v9ses = v9fs_inode2v9ses(inode);
+ st = p9_client_getattr_dotl(fid, P9_STATS_ALL);
+@@ -942,16 +946,13 @@ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode)
+ if ((inode->i_mode & S_IFMT) != (st->st_mode & S_IFMT))
+ goto out;
+
+- spin_lock(&inode->i_lock);
+ /*
+ * We don't want to refresh inode->i_size,
+ * because we may have cached data
+ */
+- i_size = inode->i_size;
+- v9fs_stat2inode_dotl(st, inode);
+- if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE)
+- inode->i_size = i_size;
+- spin_unlock(&inode->i_lock);
++ flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ?
++ V9FS_STAT2INODE_KEEP_ISIZE : 0;
++ v9fs_stat2inode_dotl(st, inode, flags);
+ out:
+ kfree(st);
+ return 0;
+diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
+index 48ce50484e80..eeab9953af89 100644
+--- a/fs/9p/vfs_super.c
++++ b/fs/9p/vfs_super.c
+@@ -172,7 +172,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
+ goto release_sb;
+ }
+ d_inode(root)->i_ino = v9fs_qid2ino(&st->qid);
+- v9fs_stat2inode_dotl(st, d_inode(root));
++ v9fs_stat2inode_dotl(st, d_inode(root), 0);
+ kfree(st);
+ } else {
+ struct p9_wstat *st = NULL;
+@@ -183,7 +183,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
+ }
+
+ d_inode(root)->i_ino = v9fs_qid2ino(&st->qid);
+- v9fs_stat2inode(st, d_inode(root), sb);
++ v9fs_stat2inode(st, d_inode(root), sb, 0);
+
+ p9stat_free(st);
+ kfree(st);
+diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
+index 3b66c957ea6f..5810463dc6d2 100644
+--- a/fs/btrfs/acl.c
++++ b/fs/btrfs/acl.c
+@@ -9,6 +9,7 @@
+ #include <linux/posix_acl_xattr.h>
+ #include <linux/posix_acl.h>
+ #include <linux/sched.h>
++#include <linux/sched/mm.h>
+ #include <linux/slab.h>
+
+ #include "ctree.h"
+@@ -72,8 +73,16 @@ static int __btrfs_set_acl(struct btrfs_trans_handle *trans,
+ }
+
+ if (acl) {
++ unsigned int nofs_flag;
++
+ size = posix_acl_xattr_size(acl->a_count);
++ /*
++ * We're holding a transaction handle, so use a NOFS memory
++ * allocation context to avoid deadlock if reclaim happens.
++ */
++ nofs_flag = memalloc_nofs_save();
+ value = kmalloc(size, GFP_KERNEL);
++ memalloc_nofs_restore(nofs_flag);
+ if (!value) {
+ ret = -ENOMEM;
+ goto out;
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index d96d1390068a..b4f61a3d560a 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -17,6 +17,7 @@
+ #include <linux/semaphore.h>
+ #include <linux/error-injection.h>
+ #include <linux/crc32c.h>
++#include <linux/sched/mm.h>
+ #include <asm/unaligned.h>
+ #include "ctree.h"
+ #include "disk-io.h"
+@@ -1236,10 +1237,17 @@ struct btrfs_root *btrfs_create_tree(struct btrfs_trans_handle *trans,
+ struct btrfs_root *tree_root = fs_info->tree_root;
+ struct btrfs_root *root;
+ struct btrfs_key key;
++ unsigned int nofs_flag;
+ int ret = 0;
+ uuid_le uuid = NULL_UUID_LE;
+
++ /*
++ * We're holding a transaction handle, so use a NOFS memory allocation
++ * context to avoid deadlock if reclaim happens.
++ */
++ nofs_flag = memalloc_nofs_save();
+ root = btrfs_alloc_root(fs_info, GFP_KERNEL);
++ memalloc_nofs_restore(nofs_flag);
+ if (!root)
+ return ERR_PTR(-ENOMEM);
+
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 79f82f2ec4d5..90b0a6eff535 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -3002,11 +3002,11 @@ static int __do_readpage(struct extent_io_tree *tree,
+ */
+ if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) &&
+ prev_em_start && *prev_em_start != (u64)-1 &&
+- *prev_em_start != em->orig_start)
++ *prev_em_start != em->start)
+ force_bio_submit = true;
+
+ if (prev_em_start)
+- *prev_em_start = em->orig_start;
++ *prev_em_start = em->start;
+
+ free_extent_map(em);
+ em = NULL;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 285f64f2de5f..c13f62182513 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -6425,10 +6425,10 @@ static int btrfs_check_chunk_valid(struct btrfs_fs_info *fs_info,
+ }
+
+ if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) ||
+- (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes < 1) ||
++ (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes != 2) ||
+ (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) ||
+ (type & BTRFS_BLOCK_GROUP_RAID6 && num_stripes < 3) ||
+- (type & BTRFS_BLOCK_GROUP_DUP && num_stripes > 2) ||
++ (type & BTRFS_BLOCK_GROUP_DUP && num_stripes != 2) ||
+ ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 &&
+ num_stripes != 1)) {
+ btrfs_err(fs_info,
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 9dcaed031843..80f33582059e 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -235,6 +235,8 @@ struct smb_version_operations {
+ int * (*get_credits_field)(struct TCP_Server_Info *, const int);
+ unsigned int (*get_credits)(struct mid_q_entry *);
+ __u64 (*get_next_mid)(struct TCP_Server_Info *);
++ void (*revert_current_mid)(struct TCP_Server_Info *server,
++ const unsigned int val);
+ /* data offset from read response message */
+ unsigned int (*read_data_offset)(char *);
+ /*
+@@ -756,6 +758,22 @@ get_next_mid(struct TCP_Server_Info *server)
+ return cpu_to_le16(mid);
+ }
+
++static inline void
++revert_current_mid(struct TCP_Server_Info *server, const unsigned int val)
++{
++ if (server->ops->revert_current_mid)
++ server->ops->revert_current_mid(server, val);
++}
++
++static inline void
++revert_current_mid_from_hdr(struct TCP_Server_Info *server,
++ const struct smb2_sync_hdr *shdr)
++{
++ unsigned int num = le16_to_cpu(shdr->CreditCharge);
++
++ return revert_current_mid(server, num > 0 ? num : 1);
++}
++
+ static inline __u16
+ get_mid(const struct smb_hdr *smb)
+ {
+@@ -1391,6 +1409,7 @@ struct mid_q_entry {
+ struct kref refcount;
+ struct TCP_Server_Info *server; /* server corresponding to this mid */
+ __u64 mid; /* multiplex id */
++ __u16 credits; /* number of credits consumed by this mid */
+ __u32 pid; /* process id */
+ __u32 sequence_number; /* for CIFS signing */
+ unsigned long when_alloc; /* when mid was created */
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 23db881daab5..08761a6a039d 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -2871,14 +2871,16 @@ cifs_strict_writev(struct kiocb *iocb, struct iov_iter *from)
+ * these pages but not on the region from pos to ppos+len-1.
+ */
+ written = cifs_user_writev(iocb, from);
+- if (written > 0 && CIFS_CACHE_READ(cinode)) {
++ if (CIFS_CACHE_READ(cinode)) {
+ /*
+- * Windows 7 server can delay breaking level2 oplock if a write
+- * request comes - break it on the client to prevent reading
+- * an old data.
++ * We have read level caching and we have just sent a write
++ * request to the server thus making data in the cache stale.
++ * Zap the cache and set oplock/lease level to NONE to avoid
++ * reading stale data from the cache. All subsequent read
++ * operations will read new data from the server.
+ */
+ cifs_zap_mapping(inode);
+- cifs_dbg(FYI, "Set no oplock for inode=%p after a write operation\n",
++ cifs_dbg(FYI, "Set Oplock/Lease to NONE for inode=%p after write\n",
+ inode);
+ cinode->oplock = 0;
+ }
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 7b8b58fb4d3f..58700d2ba8cd 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -517,7 +517,6 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
+ __u8 lease_state;
+ struct list_head *tmp;
+ struct cifsFileInfo *cfile;
+- struct TCP_Server_Info *server = tcon->ses->server;
+ struct cifs_pending_open *open;
+ struct cifsInodeInfo *cinode;
+ int ack_req = le32_to_cpu(rsp->Flags &
+@@ -537,13 +536,25 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
+ cifs_dbg(FYI, "lease key match, lease break 0x%x\n",
+ le32_to_cpu(rsp->NewLeaseState));
+
+- server->ops->set_oplock_level(cinode, lease_state, 0, NULL);
+-
+ if (ack_req)
+ cfile->oplock_break_cancelled = false;
+ else
+ cfile->oplock_break_cancelled = true;
+
++ set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags);
++
++ /*
++ * Set or clear flags depending on the lease state being READ.
++ * HANDLE caching flag should be added when the client starts
++ * to defer closing remote file handles with HANDLE leases.
++ */
++ if (lease_state & SMB2_LEASE_READ_CACHING_HE)
++ set_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
++ &cinode->flags);
++ else
++ clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
++ &cinode->flags);
++
+ queue_work(cifsoplockd_wq, &cfile->oplock_break);
+ kfree(lw);
+ return true;
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 237d7281ada3..d4d7d61a6fe2 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -204,6 +204,15 @@ smb2_get_next_mid(struct TCP_Server_Info *server)
+ return mid;
+ }
+
++static void
++smb2_revert_current_mid(struct TCP_Server_Info *server, const unsigned int val)
++{
++ spin_lock(&GlobalMid_Lock);
++ if (server->CurrentMid >= val)
++ server->CurrentMid -= val;
++ spin_unlock(&GlobalMid_Lock);
++}
++
+ static struct mid_q_entry *
+ smb2_find_mid(struct TCP_Server_Info *server, char *buf)
+ {
+@@ -2300,6 +2309,15 @@ smb2_downgrade_oplock(struct TCP_Server_Info *server,
+ server->ops->set_oplock_level(cinode, 0, 0, NULL);
+ }
+
++static void
++smb21_downgrade_oplock(struct TCP_Server_Info *server,
++ struct cifsInodeInfo *cinode, bool set_level2)
++{
++ server->ops->set_oplock_level(cinode,
++ set_level2 ? SMB2_LEASE_READ_CACHING_HE :
++ 0, 0, NULL);
++}
++
+ static void
+ smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
+ unsigned int epoch, bool *purge_cache)
+@@ -3247,6 +3265,7 @@ struct smb_version_operations smb20_operations = {
+ .get_credits = smb2_get_credits,
+ .wait_mtu_credits = cifs_wait_mtu_credits,
+ .get_next_mid = smb2_get_next_mid,
++ .revert_current_mid = smb2_revert_current_mid,
+ .read_data_offset = smb2_read_data_offset,
+ .read_data_length = smb2_read_data_length,
+ .map_error = map_smb2_to_linux_error,
+@@ -3341,6 +3360,7 @@ struct smb_version_operations smb21_operations = {
+ .get_credits = smb2_get_credits,
+ .wait_mtu_credits = smb2_wait_mtu_credits,
+ .get_next_mid = smb2_get_next_mid,
++ .revert_current_mid = smb2_revert_current_mid,
+ .read_data_offset = smb2_read_data_offset,
+ .read_data_length = smb2_read_data_length,
+ .map_error = map_smb2_to_linux_error,
+@@ -3351,7 +3371,7 @@ struct smb_version_operations smb21_operations = {
+ .print_stats = smb2_print_stats,
+ .is_oplock_break = smb2_is_valid_oplock_break,
+ .handle_cancelled_mid = smb2_handle_cancelled_mid,
+- .downgrade_oplock = smb2_downgrade_oplock,
++ .downgrade_oplock = smb21_downgrade_oplock,
+ .need_neg = smb2_need_neg,
+ .negotiate = smb2_negotiate,
+ .negotiate_wsize = smb2_negotiate_wsize,
+@@ -3436,6 +3456,7 @@ struct smb_version_operations smb30_operations = {
+ .get_credits = smb2_get_credits,
+ .wait_mtu_credits = smb2_wait_mtu_credits,
+ .get_next_mid = smb2_get_next_mid,
++ .revert_current_mid = smb2_revert_current_mid,
+ .read_data_offset = smb2_read_data_offset,
+ .read_data_length = smb2_read_data_length,
+ .map_error = map_smb2_to_linux_error,
+@@ -3447,7 +3468,7 @@ struct smb_version_operations smb30_operations = {
+ .dump_share_caps = smb2_dump_share_caps,
+ .is_oplock_break = smb2_is_valid_oplock_break,
+ .handle_cancelled_mid = smb2_handle_cancelled_mid,
+- .downgrade_oplock = smb2_downgrade_oplock,
++ .downgrade_oplock = smb21_downgrade_oplock,
+ .need_neg = smb2_need_neg,
+ .negotiate = smb2_negotiate,
+ .negotiate_wsize = smb2_negotiate_wsize,
+@@ -3540,6 +3561,7 @@ struct smb_version_operations smb311_operations = {
+ .get_credits = smb2_get_credits,
+ .wait_mtu_credits = smb2_wait_mtu_credits,
+ .get_next_mid = smb2_get_next_mid,
++ .revert_current_mid = smb2_revert_current_mid,
+ .read_data_offset = smb2_read_data_offset,
+ .read_data_length = smb2_read_data_length,
+ .map_error = map_smb2_to_linux_error,
+@@ -3551,7 +3573,7 @@ struct smb_version_operations smb311_operations = {
+ .dump_share_caps = smb2_dump_share_caps,
+ .is_oplock_break = smb2_is_valid_oplock_break,
+ .handle_cancelled_mid = smb2_handle_cancelled_mid,
+- .downgrade_oplock = smb2_downgrade_oplock,
++ .downgrade_oplock = smb21_downgrade_oplock,
+ .need_neg = smb2_need_neg,
+ .negotiate = smb2_negotiate,
+ .negotiate_wsize = smb2_negotiate_wsize,
+diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
+index 7b351c65ee46..63264db78b89 100644
+--- a/fs/cifs/smb2transport.c
++++ b/fs/cifs/smb2transport.c
+@@ -576,6 +576,7 @@ smb2_mid_entry_alloc(const struct smb2_sync_hdr *shdr,
+ struct TCP_Server_Info *server)
+ {
+ struct mid_q_entry *temp;
++ unsigned int credits = le16_to_cpu(shdr->CreditCharge);
+
+ if (server == NULL) {
+ cifs_dbg(VFS, "Null TCP session in smb2_mid_entry_alloc\n");
+@@ -586,6 +587,7 @@ smb2_mid_entry_alloc(const struct smb2_sync_hdr *shdr,
+ memset(temp, 0, sizeof(struct mid_q_entry));
+ kref_init(&temp->refcount);
+ temp->mid = le64_to_cpu(shdr->MessageId);
++ temp->credits = credits > 0 ? credits : 1;
+ temp->pid = current->pid;
+ temp->command = shdr->Command; /* Always LE */
+ temp->when_alloc = jiffies;
+@@ -674,13 +676,18 @@ smb2_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst)
+ smb2_seq_num_into_buf(ses->server, shdr);
+
+ rc = smb2_get_mid_entry(ses, shdr, &mid);
+- if (rc)
++ if (rc) {
++ revert_current_mid_from_hdr(ses->server, shdr);
+ return ERR_PTR(rc);
++ }
++
+ rc = smb2_sign_rqst(rqst, ses->server);
+ if (rc) {
++ revert_current_mid_from_hdr(ses->server, shdr);
+ cifs_delete_mid(mid);
+ return ERR_PTR(rc);
+ }
++
+ return mid;
+ }
+
+@@ -695,11 +702,14 @@ smb2_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst)
+ smb2_seq_num_into_buf(server, shdr);
+
+ mid = smb2_mid_entry_alloc(shdr, server);
+- if (mid == NULL)
++ if (mid == NULL) {
++ revert_current_mid_from_hdr(server, shdr);
+ return ERR_PTR(-ENOMEM);
++ }
+
+ rc = smb2_sign_rqst(rqst, server);
+ if (rc) {
++ revert_current_mid_from_hdr(server, shdr);
+ DeleteMidQEntry(mid);
+ return ERR_PTR(rc);
+ }
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 66348b3d28e6..f2938bd95c40 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -638,6 +638,7 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,
+ cifs_in_send_dec(server);
+
+ if (rc < 0) {
++ revert_current_mid(server, mid->credits);
+ server->sequence_number -= 2;
+ cifs_delete_mid(mid);
+ }
+@@ -842,6 +843,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ for (i = 0; i < num_rqst; i++) {
+ midQ[i] = ses->server->ops->setup_request(ses, &rqst[i]);
+ if (IS_ERR(midQ[i])) {
++ revert_current_mid(ses->server, i);
+ for (j = 0; j < i; j++)
+ cifs_delete_mid(midQ[j]);
+ mutex_unlock(&ses->server->srv_mutex);
+@@ -867,8 +869,10 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ for (i = 0; i < num_rqst; i++)
+ cifs_save_when_sent(midQ[i]);
+
+- if (rc < 0)
++ if (rc < 0) {
++ revert_current_mid(ses->server, num_rqst);
+ ses->server->sequence_number -= 2;
++ }
+
+ mutex_unlock(&ses->server->srv_mutex);
+
+diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
+index c53814539070..553a3f3300ae 100644
+--- a/fs/devpts/inode.c
++++ b/fs/devpts/inode.c
+@@ -455,6 +455,7 @@ devpts_fill_super(struct super_block *s, void *data, int silent)
+ s->s_blocksize_bits = 10;
+ s->s_magic = DEVPTS_SUPER_MAGIC;
+ s->s_op = &devpts_sops;
++ s->s_d_op = &simple_dentry_operations;
+ s->s_time_gran = 1;
+
+ error = -ENOMEM;
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index 0c38e31ec938..364e647d87c0 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -761,7 +761,8 @@ static loff_t ext2_max_size(int bits)
+ {
+ loff_t res = EXT2_NDIR_BLOCKS;
+ int meta_blocks;
+- loff_t upper_limit;
++ unsigned int upper_limit;
++ unsigned int ppb = 1 << (bits-2);
+
+ /* This is calculated to be the largest file size for a
+ * dense, file such that the total number of
+@@ -775,24 +776,34 @@ static loff_t ext2_max_size(int bits)
+ /* total blocks in file system block size */
+ upper_limit >>= (bits - 9);
+
++ /* Compute how many blocks we can address by block tree */
++ res += 1LL << (bits-2);
++ res += 1LL << (2*(bits-2));
++ res += 1LL << (3*(bits-2));
++ /* Does block tree limit file size? */
++ if (res < upper_limit)
++ goto check_lfs;
+
++ res = upper_limit;
++ /* How many metadata blocks are needed for addressing upper_limit? */
++ upper_limit -= EXT2_NDIR_BLOCKS;
+ /* indirect blocks */
+ meta_blocks = 1;
++ upper_limit -= ppb;
+ /* double indirect blocks */
+- meta_blocks += 1 + (1LL << (bits-2));
+- /* tripple indirect blocks */
+- meta_blocks += 1 + (1LL << (bits-2)) + (1LL << (2*(bits-2)));
+-
+- upper_limit -= meta_blocks;
+- upper_limit <<= bits;
+-
+- res += 1LL << (bits-2);
+- res += 1LL << (2*(bits-2));
+- res += 1LL << (3*(bits-2));
++ if (upper_limit < ppb * ppb) {
++ meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb);
++ res -= meta_blocks;
++ goto check_lfs;
++ }
++ meta_blocks += 1 + ppb;
++ upper_limit -= ppb * ppb;
++ /* tripple indirect blocks for the rest */
++ meta_blocks += 1 + DIV_ROUND_UP(upper_limit, ppb) +
++ DIV_ROUND_UP(upper_limit, ppb*ppb);
++ res -= meta_blocks;
++check_lfs:
+ res <<= bits;
+- if (res > upper_limit)
+- res = upper_limit;
+-
+ if (res > MAX_LFS_FILESIZE)
+ res = MAX_LFS_FILESIZE;
+
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 032cf9b92665..2ddf7833350d 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -435,6 +435,9 @@ struct flex_groups {
+ /* Flags that are appropriate for non-directories/regular files. */
+ #define EXT4_OTHER_FLMASK (EXT4_NODUMP_FL | EXT4_NOATIME_FL)
+
++/* The only flags that should be swapped */
++#define EXT4_FL_SHOULD_SWAP (EXT4_HUGE_FILE_FL | EXT4_EXTENTS_FL)
++
+ /* Mask out flags that are inappropriate for the given type of inode. */
+ static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
+ {
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index d37dafa1d133..2e76fb55d94a 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -63,18 +63,20 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2)
+ loff_t isize;
+ struct ext4_inode_info *ei1;
+ struct ext4_inode_info *ei2;
++ unsigned long tmp;
+
+ ei1 = EXT4_I(inode1);
+ ei2 = EXT4_I(inode2);
+
+ swap(inode1->i_version, inode2->i_version);
+- swap(inode1->i_blocks, inode2->i_blocks);
+- swap(inode1->i_bytes, inode2->i_bytes);
+ swap(inode1->i_atime, inode2->i_atime);
+ swap(inode1->i_mtime, inode2->i_mtime);
+
+ memswap(ei1->i_data, ei2->i_data, sizeof(ei1->i_data));
+- swap(ei1->i_flags, ei2->i_flags);
++ tmp = ei1->i_flags & EXT4_FL_SHOULD_SWAP;
++ ei1->i_flags = (ei2->i_flags & EXT4_FL_SHOULD_SWAP) |
++ (ei1->i_flags & ~EXT4_FL_SHOULD_SWAP);
++ ei2->i_flags = tmp | (ei2->i_flags & ~EXT4_FL_SHOULD_SWAP);
+ swap(ei1->i_disksize, ei2->i_disksize);
+ ext4_es_remove_extent(inode1, 0, EXT_MAX_BLOCKS);
+ ext4_es_remove_extent(inode2, 0, EXT_MAX_BLOCKS);
+@@ -115,28 +117,41 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ int err;
+ struct inode *inode_bl;
+ struct ext4_inode_info *ei_bl;
+-
+- if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) ||
+- IS_SWAPFILE(inode) || IS_ENCRYPTED(inode) ||
+- ext4_has_inline_data(inode))
+- return -EINVAL;
+-
+- if (IS_RDONLY(inode) || IS_APPEND(inode) || IS_IMMUTABLE(inode) ||
+- !inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN))
+- return -EPERM;
++ qsize_t size, size_bl, diff;
++ blkcnt_t blocks;
++ unsigned short bytes;
+
+ inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO, EXT4_IGET_SPECIAL);
+ if (IS_ERR(inode_bl))
+ return PTR_ERR(inode_bl);
+ ei_bl = EXT4_I(inode_bl);
+
+- filemap_flush(inode->i_mapping);
+- filemap_flush(inode_bl->i_mapping);
+-
+ /* Protect orig inodes against a truncate and make sure,
+ * that only 1 swap_inode_boot_loader is running. */
+ lock_two_nondirectories(inode, inode_bl);
+
++ if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) ||
++ IS_SWAPFILE(inode) || IS_ENCRYPTED(inode) ||
++ ext4_has_inline_data(inode)) {
++ err = -EINVAL;
++ goto journal_err_out;
++ }
++
++ if (IS_RDONLY(inode) || IS_APPEND(inode) || IS_IMMUTABLE(inode) ||
++ !inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN)) {
++ err = -EPERM;
++ goto journal_err_out;
++ }
++
++ down_write(&EXT4_I(inode)->i_mmap_sem);
++ err = filemap_write_and_wait(inode->i_mapping);
++ if (err)
++ goto err_out;
++
++ err = filemap_write_and_wait(inode_bl->i_mapping);
++ if (err)
++ goto err_out;
++
+ /* Wait for all existing dio workers */
+ inode_dio_wait(inode);
+ inode_dio_wait(inode_bl);
+@@ -147,7 +162,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ handle = ext4_journal_start(inode_bl, EXT4_HT_MOVE_EXTENTS, 2);
+ if (IS_ERR(handle)) {
+ err = -EINVAL;
+- goto journal_err_out;
++ goto err_out;
+ }
+
+ /* Protect extent tree against block allocations via delalloc */
+@@ -170,6 +185,13 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ memset(ei_bl->i_data, 0, sizeof(ei_bl->i_data));
+ }
+
++ err = dquot_initialize(inode);
++ if (err)
++ goto err_out1;
++
++ size = (qsize_t)(inode->i_blocks) * (1 << 9) + inode->i_bytes;
++ size_bl = (qsize_t)(inode_bl->i_blocks) * (1 << 9) + inode_bl->i_bytes;
++ diff = size - size_bl;
+ swap_inode_data(inode, inode_bl);
+
+ inode->i_ctime = inode_bl->i_ctime = current_time(inode);
+@@ -183,27 +205,51 @@ static long swap_inode_boot_loader(struct super_block *sb,
+
+ err = ext4_mark_inode_dirty(handle, inode);
+ if (err < 0) {
++ /* No need to update quota information. */
+ ext4_warning(inode->i_sb,
+ "couldn't mark inode #%lu dirty (err %d)",
+ inode->i_ino, err);
+ /* Revert all changes: */
+ swap_inode_data(inode, inode_bl);
+ ext4_mark_inode_dirty(handle, inode);
+- } else {
+- err = ext4_mark_inode_dirty(handle, inode_bl);
+- if (err < 0) {
+- ext4_warning(inode_bl->i_sb,
+- "couldn't mark inode #%lu dirty (err %d)",
+- inode_bl->i_ino, err);
+- /* Revert all changes: */
+- swap_inode_data(inode, inode_bl);
+- ext4_mark_inode_dirty(handle, inode);
+- ext4_mark_inode_dirty(handle, inode_bl);
+- }
++ goto err_out1;
++ }
++
++ blocks = inode_bl->i_blocks;
++ bytes = inode_bl->i_bytes;
++ inode_bl->i_blocks = inode->i_blocks;
++ inode_bl->i_bytes = inode->i_bytes;
++ err = ext4_mark_inode_dirty(handle, inode_bl);
++ if (err < 0) {
++ /* No need to update quota information. */
++ ext4_warning(inode_bl->i_sb,
++ "couldn't mark inode #%lu dirty (err %d)",
++ inode_bl->i_ino, err);
++ goto revert;
++ }
++
++ /* Bootloader inode should not be counted into quota information. */
++ if (diff > 0)
++ dquot_free_space(inode, diff);
++ else
++ err = dquot_alloc_space(inode, -1 * diff);
++
++ if (err < 0) {
++revert:
++ /* Revert all changes: */
++ inode_bl->i_blocks = blocks;
++ inode_bl->i_bytes = bytes;
++ swap_inode_data(inode, inode_bl);
++ ext4_mark_inode_dirty(handle, inode);
++ ext4_mark_inode_dirty(handle, inode_bl);
+ }
++
++err_out1:
+ ext4_journal_stop(handle);
+ ext4_double_up_write_data_sem(inode, inode_bl);
+
++err_out:
++ up_write(&EXT4_I(inode)->i_mmap_sem);
+ journal_err_out:
+ unlock_two_nondirectories(inode, inode_bl);
+ iput(inode_bl);
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 48421de803b7..3d9b18505c0c 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1960,7 +1960,8 @@ retry:
+ le16_to_cpu(es->s_reserved_gdt_blocks);
+ n_group = n_desc_blocks * EXT4_DESC_PER_BLOCK(sb);
+ n_blocks_count = (ext4_fsblk_t)n_group *
+- EXT4_BLOCKS_PER_GROUP(sb);
++ EXT4_BLOCKS_PER_GROUP(sb) +
++ le32_to_cpu(es->s_first_data_block);
+ n_group--; /* set to last group number */
+ }
+
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index c0b66a7a795b..914e725c82c4 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1219,11 +1219,12 @@ int jbd2_journal_get_undo_access(handle_t *handle, struct buffer_head *bh)
+ struct journal_head *jh;
+ char *committed_data = NULL;
+
+- JBUFFER_TRACE(jh, "entry");
+ if (jbd2_write_access_granted(handle, bh, true))
+ return 0;
+
+ jh = jbd2_journal_add_journal_head(bh);
++ JBUFFER_TRACE(jh, "entry");
++
+ /*
+ * Do this first --- it can drop the journal lock, so we want to
+ * make sure that obtaining the committed_data is done
+@@ -1334,15 +1335,17 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
+
+ if (is_handle_aborted(handle))
+ return -EROFS;
+- if (!buffer_jbd(bh)) {
+- ret = -EUCLEAN;
+- goto out;
+- }
++ if (!buffer_jbd(bh))
++ return -EUCLEAN;
++
+ /*
+ * We don't grab jh reference here since the buffer must be part
+ * of the running transaction.
+ */
+ jh = bh2jh(bh);
++ jbd_debug(5, "journal_head %p\n", jh);
++ JBUFFER_TRACE(jh, "entry");
++
+ /*
+ * This and the following assertions are unreliable since we may see jh
+ * in inconsistent state unless we grab bh_state lock. But this is
+@@ -1376,9 +1379,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
+ }
+
+ journal = transaction->t_journal;
+- jbd_debug(5, "journal_head %p\n", jh);
+- JBUFFER_TRACE(jh, "entry");
+-
+ jbd_lock_bh_state(bh);
+
+ if (jh->b_modified == 0) {
+@@ -1576,14 +1576,21 @@ int jbd2_journal_forget (handle_t *handle, struct buffer_head *bh)
+ /* However, if the buffer is still owned by a prior
+ * (committing) transaction, we can't drop it yet... */
+ JBUFFER_TRACE(jh, "belongs to older transaction");
+- /* ... but we CAN drop it from the new transaction if we
+- * have also modified it since the original commit. */
++ /* ... but we CAN drop it from the new transaction through
++ * marking the buffer as freed and set j_next_transaction to
++ * the new transaction, so that not only the commit code
++ * knows it should clear dirty bits when it is done with the
++ * buffer, but also the buffer can be checkpointed only
++ * after the new transaction commits. */
+
+- if (jh->b_next_transaction) {
+- J_ASSERT(jh->b_next_transaction == transaction);
++ set_buffer_freed(bh);
++
++ if (!jh->b_next_transaction) {
+ spin_lock(&journal->j_list_lock);
+- jh->b_next_transaction = NULL;
++ jh->b_next_transaction = transaction;
+ spin_unlock(&journal->j_list_lock);
++ } else {
++ J_ASSERT(jh->b_next_transaction == transaction);
+
+ /*
+ * only drop a reference if this transaction modified
+diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c
+index ff2716f9322e..0b22c39dad47 100644
+--- a/fs/kernfs/mount.c
++++ b/fs/kernfs/mount.c
+@@ -196,8 +196,10 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn,
+ return dentry;
+
+ knparent = find_next_ancestor(kn, NULL);
+- if (WARN_ON(!knparent))
++ if (WARN_ON(!knparent)) {
++ dput(dentry);
+ return ERR_PTR(-EINVAL);
++ }
+
+ do {
+ struct dentry *dtmp;
+@@ -206,8 +208,10 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn,
+ if (kn == knparent)
+ return dentry;
+ kntmp = find_next_ancestor(kn, knparent);
+- if (WARN_ON(!kntmp))
++ if (WARN_ON(!kntmp)) {
++ dput(dentry);
+ return ERR_PTR(-EINVAL);
++ }
+ dtmp = lookup_one_len_unlocked(kntmp->name, dentry,
+ strlen(kntmp->name));
+ dput(dentry);
+diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c
+index 3f23b6840547..bf34ddaa2ad7 100644
+--- a/fs/nfs/nfs4idmap.c
++++ b/fs/nfs/nfs4idmap.c
+@@ -44,6 +44,7 @@
+ #include <linux/keyctl.h>
+ #include <linux/key-type.h>
+ #include <keys/user-type.h>
++#include <keys/request_key_auth-type.h>
+ #include <linux/module.h>
+
+ #include "internal.h"
+@@ -59,7 +60,7 @@ static struct key_type key_type_id_resolver_legacy;
+ struct idmap_legacy_upcalldata {
+ struct rpc_pipe_msg pipe_msg;
+ struct idmap_msg idmap_msg;
+- struct key_construction *key_cons;
++ struct key *authkey;
+ struct idmap *idmap;
+ };
+
+@@ -384,7 +385,7 @@ static const match_table_t nfs_idmap_tokens = {
+ { Opt_find_err, NULL }
+ };
+
+-static int nfs_idmap_legacy_upcall(struct key_construction *, const char *, void *);
++static int nfs_idmap_legacy_upcall(struct key *, void *);
+ static ssize_t idmap_pipe_downcall(struct file *, const char __user *,
+ size_t);
+ static void idmap_release_pipe(struct inode *);
+@@ -549,11 +550,12 @@ nfs_idmap_prepare_pipe_upcall(struct idmap *idmap,
+ static void
+ nfs_idmap_complete_pipe_upcall_locked(struct idmap *idmap, int ret)
+ {
+- struct key_construction *cons = idmap->idmap_upcall_data->key_cons;
++ struct key *authkey = idmap->idmap_upcall_data->authkey;
+
+ kfree(idmap->idmap_upcall_data);
+ idmap->idmap_upcall_data = NULL;
+- complete_request_key(cons, ret);
++ complete_request_key(authkey, ret);
++ key_put(authkey);
+ }
+
+ static void
+@@ -563,15 +565,14 @@ nfs_idmap_abort_pipe_upcall(struct idmap *idmap, int ret)
+ nfs_idmap_complete_pipe_upcall_locked(idmap, ret);
+ }
+
+-static int nfs_idmap_legacy_upcall(struct key_construction *cons,
+- const char *op,
+- void *aux)
++static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux)
+ {
+ struct idmap_legacy_upcalldata *data;
++ struct request_key_auth *rka = get_request_key_auth(authkey);
+ struct rpc_pipe_msg *msg;
+ struct idmap_msg *im;
+ struct idmap *idmap = (struct idmap *)aux;
+- struct key *key = cons->key;
++ struct key *key = rka->target_key;
+ int ret = -ENOKEY;
+
+ if (!aux)
+@@ -586,7 +587,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
+ msg = &data->pipe_msg;
+ im = &data->idmap_msg;
+ data->idmap = idmap;
+- data->key_cons = cons;
++ data->authkey = key_get(authkey);
+
+ ret = nfs_idmap_prepare_message(key->description, idmap, im, msg);
+ if (ret < 0)
+@@ -604,7 +605,7 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons,
+ out2:
+ kfree(data);
+ out1:
+- complete_request_key(cons, ret);
++ complete_request_key(authkey, ret);
+ return ret;
+ }
+
+@@ -651,9 +652,10 @@ out:
+ static ssize_t
+ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+ {
++ struct request_key_auth *rka;
+ struct rpc_inode *rpci = RPC_I(file_inode(filp));
+ struct idmap *idmap = (struct idmap *)rpci->private;
+- struct key_construction *cons;
++ struct key *authkey;
+ struct idmap_msg im;
+ size_t namelen_in;
+ int ret = -ENOKEY;
+@@ -665,7 +667,8 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+ if (idmap->idmap_upcall_data == NULL)
+ goto out_noupcall;
+
+- cons = idmap->idmap_upcall_data->key_cons;
++ authkey = idmap->idmap_upcall_data->authkey;
++ rka = get_request_key_auth(authkey);
+
+ if (mlen != sizeof(im)) {
+ ret = -ENOSPC;
+@@ -690,9 +693,9 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+
+ ret = nfs_idmap_read_and_verify_message(&im,
+ &idmap->idmap_upcall_data->idmap_msg,
+- cons->key, cons->authkey);
++ rka->target_key, authkey);
+ if (ret >= 0) {
+- key_set_timeout(cons->key, nfs_idmap_cache_timeout);
++ key_set_timeout(rka->target_key, nfs_idmap_cache_timeout);
+ ret = mlen;
+ }
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 8220a168282e..e7abcf7629b3 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -947,6 +947,13 @@ nfs4_sequence_process_interrupted(struct nfs_client *client,
+
+ #endif /* !CONFIG_NFS_V4_1 */
+
++static void nfs41_sequence_res_init(struct nfs4_sequence_res *res)
++{
++ res->sr_timestamp = jiffies;
++ res->sr_status_flags = 0;
++ res->sr_status = 1;
++}
++
+ static
+ void nfs4_sequence_attach_slot(struct nfs4_sequence_args *args,
+ struct nfs4_sequence_res *res,
+@@ -958,10 +965,6 @@ void nfs4_sequence_attach_slot(struct nfs4_sequence_args *args,
+ args->sa_slot = slot;
+
+ res->sr_slot = slot;
+- res->sr_timestamp = jiffies;
+- res->sr_status_flags = 0;
+- res->sr_status = 1;
+-
+ }
+
+ int nfs4_setup_sequence(struct nfs_client *client,
+@@ -1007,6 +1010,7 @@ int nfs4_setup_sequence(struct nfs_client *client,
+
+ trace_nfs4_setup_sequence(session, args);
+ out_start:
++ nfs41_sequence_res_init(res);
+ rpc_call_start(task);
+ return 0;
+
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index 3dbd15b47c27..0ec6bce3dd69 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -989,6 +989,17 @@ static void nfs_pageio_doio(struct nfs_pageio_descriptor *desc)
+ }
+ }
+
++static void
++nfs_pageio_cleanup_request(struct nfs_pageio_descriptor *desc,
++ struct nfs_page *req)
++{
++ LIST_HEAD(head);
++
++ nfs_list_remove_request(req);
++ nfs_list_add_request(req, &head);
++ desc->pg_completion_ops->error_cleanup(&head);
++}
++
+ /**
+ * nfs_pageio_add_request - Attempt to coalesce a request into a page list.
+ * @desc: destination io descriptor
+@@ -1026,10 +1037,8 @@ static int __nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
+ nfs_page_group_unlock(req);
+ desc->pg_moreio = 1;
+ nfs_pageio_doio(desc);
+- if (desc->pg_error < 0)
+- return 0;
+- if (mirror->pg_recoalesce)
+- return 0;
++ if (desc->pg_error < 0 || mirror->pg_recoalesce)
++ goto out_cleanup_subreq;
+ /* retry add_request for this subreq */
+ nfs_page_group_lock(req);
+ continue;
+@@ -1062,6 +1071,10 @@ err_ptr:
+ desc->pg_error = PTR_ERR(subreq);
+ nfs_page_group_unlock(req);
+ return 0;
++out_cleanup_subreq:
++ if (req != subreq)
++ nfs_pageio_cleanup_request(desc, subreq);
++ return 0;
+ }
+
+ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
+@@ -1080,7 +1093,6 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
+ struct nfs_page *req;
+
+ req = list_first_entry(&head, struct nfs_page, wb_list);
+- nfs_list_remove_request(req);
+ if (__nfs_pageio_add_request(desc, req))
+ continue;
+ if (desc->pg_error < 0) {
+@@ -1169,11 +1181,14 @@ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
+ if (nfs_pgio_has_mirroring(desc))
+ desc->pg_mirror_idx = midx;
+ if (!nfs_pageio_add_request_mirror(desc, dupreq))
+- goto out_failed;
++ goto out_cleanup_subreq;
+ }
+
+ return 1;
+
++out_cleanup_subreq:
++ if (req != dupreq)
++ nfs_pageio_cleanup_request(desc, dupreq);
+ out_failed:
+ /* remember fatal errors */
+ if (nfs_error_is_fatal(desc->pg_error))
+@@ -1199,7 +1214,7 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
+ desc->pg_mirror_idx = mirror_idx;
+ for (;;) {
+ nfs_pageio_doio(desc);
+- if (!mirror->pg_recoalesce)
++ if (desc->pg_error < 0 || !mirror->pg_recoalesce)
+ break;
+ if (!nfs_do_recoalesce(desc))
+ break;
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index d790faff8e47..51d0b7913c04 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -238,9 +238,9 @@ out:
+ }
+
+ /* A writeback failed: mark the page as bad, and invalidate the page cache */
+-static void nfs_set_pageerror(struct page *page)
++static void nfs_set_pageerror(struct address_space *mapping)
+ {
+- nfs_zap_mapping(page_file_mapping(page)->host, page_file_mapping(page));
++ nfs_zap_mapping(mapping->host, mapping);
+ }
+
+ /*
+@@ -994,7 +994,7 @@ static void nfs_write_completion(struct nfs_pgio_header *hdr)
+ nfs_list_remove_request(req);
+ if (test_bit(NFS_IOHDR_ERROR, &hdr->flags) &&
+ (hdr->good_bytes < bytes)) {
+- nfs_set_pageerror(req->wb_page);
++ nfs_set_pageerror(page_file_mapping(req->wb_page));
+ nfs_context_set_write_error(req->wb_context, hdr->error);
+ goto remove_req;
+ }
+@@ -1330,7 +1330,8 @@ int nfs_updatepage(struct file *file, struct page *page,
+ unsigned int offset, unsigned int count)
+ {
+ struct nfs_open_context *ctx = nfs_file_open_context(file);
+- struct inode *inode = page_file_mapping(page)->host;
++ struct address_space *mapping = page_file_mapping(page);
++ struct inode *inode = mapping->host;
+ int status = 0;
+
+ nfs_inc_stats(inode, NFSIOS_VFSUPDATEPAGE);
+@@ -1348,7 +1349,7 @@ int nfs_updatepage(struct file *file, struct page *page,
+
+ status = nfs_writepage_setup(ctx, page, offset, count);
+ if (status < 0)
+- nfs_set_pageerror(page);
++ nfs_set_pageerror(mapping);
+ else
+ __set_page_dirty_nobuffers(page);
+ out:
+diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
+index 9eb8086ea841..c9cf46e0c040 100644
+--- a/fs/nfsd/nfs3proc.c
++++ b/fs/nfsd/nfs3proc.c
+@@ -463,8 +463,19 @@ nfsd3_proc_readdir(struct svc_rqst *rqstp)
+ &resp->common, nfs3svc_encode_entry);
+ memcpy(resp->verf, argp->verf, 8);
+ resp->count = resp->buffer - argp->buffer;
+- if (resp->offset)
+- xdr_encode_hyper(resp->offset, argp->cookie);
++ if (resp->offset) {
++ loff_t offset = argp->cookie;
++
++ if (unlikely(resp->offset1)) {
++ /* we ended up with offset on a page boundary */
++ *resp->offset = htonl(offset >> 32);
++ *resp->offset1 = htonl(offset & 0xffffffff);
++ resp->offset1 = NULL;
++ } else {
++ xdr_encode_hyper(resp->offset, offset);
++ }
++ resp->offset = NULL;
++ }
+
+ RETURN_STATUS(nfserr);
+ }
+@@ -533,6 +544,7 @@ nfsd3_proc_readdirplus(struct svc_rqst *rqstp)
+ } else {
+ xdr_encode_hyper(resp->offset, offset);
+ }
++ resp->offset = NULL;
+ }
+
+ RETURN_STATUS(nfserr);
+diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
+index 9b973f4f7d01..83919116d5cb 100644
+--- a/fs/nfsd/nfs3xdr.c
++++ b/fs/nfsd/nfs3xdr.c
+@@ -921,6 +921,7 @@ encode_entry(struct readdir_cd *ccd, const char *name, int namlen,
+ } else {
+ xdr_encode_hyper(cd->offset, offset64);
+ }
++ cd->offset = NULL;
+ }
+
+ /*
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 9c6d1d57b598..bec75600e692 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -1514,16 +1514,16 @@ static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
+ {
+ u32 slotsize = slot_bytes(ca);
+ u32 num = ca->maxreqs;
+- int avail;
++ unsigned long avail, total_avail;
+
+ spin_lock(&nfsd_drc_lock);
+- avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION,
+- nfsd_drc_max_mem - nfsd_drc_mem_used);
++ total_avail = nfsd_drc_max_mem - nfsd_drc_mem_used;
++ avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION, total_avail);
+ /*
+ * Never use more than a third of the remaining memory,
+ * unless it's the only way to give this client a slot:
+ */
+- avail = clamp_t(int, avail, slotsize, avail/3);
++ avail = clamp_t(int, avail, slotsize, total_avail/3);
+ num = min_t(int, num, avail / slotsize);
+ nfsd_drc_mem_used += num * slotsize;
+ spin_unlock(&nfsd_drc_lock);
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index 39b835d7c445..cb69660d0779 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -1126,7 +1126,7 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size)
+ case 'Y':
+ case 'y':
+ case '1':
+- if (nn->nfsd_serv)
++ if (!nn->nfsd_serv)
+ return -EBUSY;
+ nfsd4_end_grace(nn);
+ break;
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 1cc797a08a5b..75eeee08d848 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -501,6 +501,24 @@ static int ovl_copy_up_inode(struct ovl_copy_up_ctx *c, struct dentry *temp)
+ {
+ int err;
+
++ /*
++ * Copy up data first and then xattrs. Writing data after
++ * xattrs will remove security.capability xattr automatically.
++ */
++ if (S_ISREG(c->stat.mode) && !c->metacopy) {
++ struct path upperpath, datapath;
++
++ ovl_path_upper(c->dentry, &upperpath);
++ if (WARN_ON(upperpath.dentry != NULL))
++ return -EIO;
++ upperpath.dentry = temp;
++
++ ovl_path_lowerdata(c->dentry, &datapath);
++ err = ovl_copy_up_data(&datapath, &upperpath, c->stat.size);
++ if (err)
++ return err;
++ }
++
+ err = ovl_copy_xattr(c->lowerpath.dentry, temp);
+ if (err)
+ return err;
+@@ -518,19 +536,6 @@ static int ovl_copy_up_inode(struct ovl_copy_up_ctx *c, struct dentry *temp)
+ return err;
+ }
+
+- if (S_ISREG(c->stat.mode) && !c->metacopy) {
+- struct path upperpath, datapath;
+-
+- ovl_path_upper(c->dentry, &upperpath);
+- BUG_ON(upperpath.dentry != NULL);
+- upperpath.dentry = temp;
+-
+- ovl_path_lowerdata(c->dentry, &datapath);
+- err = ovl_copy_up_data(&datapath, &upperpath, c->stat.size);
+- if (err)
+- return err;
+- }
+-
+ if (c->metacopy) {
+ err = ovl_check_setxattr(c->dentry, temp, OVL_XATTR_METACOPY,
+ NULL, 0, -EOPNOTSUPP);
+@@ -706,6 +711,8 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c)
+ {
+ struct path upperpath, datapath;
+ int err;
++ char *capability = NULL;
++ ssize_t uninitialized_var(cap_size);
+
+ ovl_path_upper(c->dentry, &upperpath);
+ if (WARN_ON(upperpath.dentry == NULL))
+@@ -715,15 +722,37 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c)
+ if (WARN_ON(datapath.dentry == NULL))
+ return -EIO;
+
++ if (c->stat.size) {
++ err = cap_size = ovl_getxattr(upperpath.dentry, XATTR_NAME_CAPS,
++ &capability, 0);
++ if (err < 0 && err != -ENODATA)
++ goto out;
++ }
++
+ err = ovl_copy_up_data(&datapath, &upperpath, c->stat.size);
+ if (err)
+- return err;
++ goto out_free;
++
++ /*
++ * Writing to upper file will clear security.capability xattr. We
++ * don't want that to happen for normal copy-up operation.
++ */
++ if (capability) {
++ err = ovl_do_setxattr(upperpath.dentry, XATTR_NAME_CAPS,
++ capability, cap_size, 0);
++ if (err)
++ goto out_free;
++ }
++
+
+ err = vfs_removexattr(upperpath.dentry, OVL_XATTR_METACOPY);
+ if (err)
+- return err;
++ goto out_free;
+
+ ovl_set_upperdata(d_inode(c->dentry));
++out_free:
++ kfree(capability);
++out:
+ return err;
+ }
+
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index a3c0d9584312..d9c16ceebfe7 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -277,6 +277,8 @@ int ovl_lock_rename_workdir(struct dentry *workdir, struct dentry *upperdir);
+ int ovl_check_metacopy_xattr(struct dentry *dentry);
+ bool ovl_is_metacopy_dentry(struct dentry *dentry);
+ char *ovl_get_redirect_xattr(struct dentry *dentry, int padding);
++ssize_t ovl_getxattr(struct dentry *dentry, char *name, char **value,
++ size_t padding);
+
+ static inline bool ovl_is_impuredir(struct dentry *dentry)
+ {
+diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
+index ace4fe4c39a9..c9a2e3c6d537 100644
+--- a/fs/overlayfs/util.c
++++ b/fs/overlayfs/util.c
+@@ -867,28 +867,49 @@ bool ovl_is_metacopy_dentry(struct dentry *dentry)
+ return (oe->numlower > 1);
+ }
+
+-char *ovl_get_redirect_xattr(struct dentry *dentry, int padding)
++ssize_t ovl_getxattr(struct dentry *dentry, char *name, char **value,
++ size_t padding)
+ {
+- int res;
+- char *s, *next, *buf = NULL;
++ ssize_t res;
++ char *buf = NULL;
+
+- res = vfs_getxattr(dentry, OVL_XATTR_REDIRECT, NULL, 0);
++ res = vfs_getxattr(dentry, name, NULL, 0);
+ if (res < 0) {
+ if (res == -ENODATA || res == -EOPNOTSUPP)
+- return NULL;
++ return -ENODATA;
+ goto fail;
+ }
+
+- buf = kzalloc(res + padding + 1, GFP_KERNEL);
+- if (!buf)
+- return ERR_PTR(-ENOMEM);
++ if (res != 0) {
++ buf = kzalloc(res + padding, GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
+
+- if (res == 0)
+- goto invalid;
++ res = vfs_getxattr(dentry, name, buf, res);
++ if (res < 0)
++ goto fail;
++ }
++ *value = buf;
++
++ return res;
++
++fail:
++ pr_warn_ratelimited("overlayfs: failed to get xattr %s: err=%zi)\n",
++ name, res);
++ kfree(buf);
++ return res;
++}
+
+- res = vfs_getxattr(dentry, OVL_XATTR_REDIRECT, buf, res);
++char *ovl_get_redirect_xattr(struct dentry *dentry, int padding)
++{
++ int res;
++ char *s, *next, *buf = NULL;
++
++ res = ovl_getxattr(dentry, OVL_XATTR_REDIRECT, &buf, padding + 1);
++ if (res == -ENODATA)
++ return NULL;
+ if (res < 0)
+- goto fail;
++ return ERR_PTR(res);
+ if (res == 0)
+ goto invalid;
+
+@@ -904,15 +925,9 @@ char *ovl_get_redirect_xattr(struct dentry *dentry, int padding)
+ }
+
+ return buf;
+-
+-err_free:
+- kfree(buf);
+- return ERR_PTR(res);
+-fail:
+- pr_warn_ratelimited("overlayfs: failed to get redirect (%i)\n", res);
+- goto err_free;
+ invalid:
+ pr_warn_ratelimited("overlayfs: invalid redirect (%s)\n", buf);
+ res = -EINVAL;
+- goto err_free;
++ kfree(buf);
++ return ERR_PTR(res);
+ }
+diff --git a/fs/pipe.c b/fs/pipe.c
+index bdc5d3c0977d..c51750ed4011 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -234,6 +234,14 @@ static const struct pipe_buf_operations anon_pipe_buf_ops = {
+ .get = generic_pipe_buf_get,
+ };
+
++static const struct pipe_buf_operations anon_pipe_buf_nomerge_ops = {
++ .can_merge = 0,
++ .confirm = generic_pipe_buf_confirm,
++ .release = anon_pipe_buf_release,
++ .steal = anon_pipe_buf_steal,
++ .get = generic_pipe_buf_get,
++};
++
+ static const struct pipe_buf_operations packet_pipe_buf_ops = {
+ .can_merge = 0,
+ .confirm = generic_pipe_buf_confirm,
+@@ -242,6 +250,12 @@ static const struct pipe_buf_operations packet_pipe_buf_ops = {
+ .get = generic_pipe_buf_get,
+ };
+
++void pipe_buf_mark_unmergeable(struct pipe_buffer *buf)
++{
++ if (buf->ops == &anon_pipe_buf_ops)
++ buf->ops = &anon_pipe_buf_nomerge_ops;
++}
++
+ static ssize_t
+ pipe_read(struct kiocb *iocb, struct iov_iter *to)
+ {
+diff --git a/fs/splice.c b/fs/splice.c
+index b3daa971f597..29e92b506394 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1593,6 +1593,8 @@ retry:
+ */
+ obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
+
++ pipe_buf_mark_unmergeable(obuf);
++
+ obuf->len = len;
+ opipe->nrbufs++;
+ ibuf->offset += obuf->len;
+@@ -1667,6 +1669,8 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+ */
+ obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
+
++ pipe_buf_mark_unmergeable(obuf);
++
+ if (obuf->len > len)
+ obuf->len = len;
+
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index d7701d466b60..dd38c97933f1 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -727,7 +727,7 @@
+ KEEP(*(.orc_unwind_ip)) \
+ __stop_orc_unwind_ip = .; \
+ } \
+- . = ALIGN(6); \
++ . = ALIGN(2); \
+ .orc_unwind : AT(ADDR(.orc_unwind) - LOAD_OFFSET) { \
+ __start_orc_unwind = .; \
+ KEEP(*(.orc_unwind)) \
+diff --git a/include/keys/request_key_auth-type.h b/include/keys/request_key_auth-type.h
+new file mode 100644
+index 000000000000..a726dd3f1dc6
+--- /dev/null
++++ b/include/keys/request_key_auth-type.h
+@@ -0,0 +1,36 @@
++/* request_key authorisation token key type
++ *
++ * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
++ * Written by David Howells (dhowells@redhat.com)
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public Licence
++ * as published by the Free Software Foundation; either version
++ * 2 of the Licence, or (at your option) any later version.
++ */
++
++#ifndef _KEYS_REQUEST_KEY_AUTH_TYPE_H
++#define _KEYS_REQUEST_KEY_AUTH_TYPE_H
++
++#include <linux/key.h>
++
++/*
++ * Authorisation record for request_key().
++ */
++struct request_key_auth {
++ struct key *target_key;
++ struct key *dest_keyring;
++ const struct cred *cred;
++ void *callout_info;
++ size_t callout_len;
++ pid_t pid;
++ char op[8];
++} __randomize_layout;
++
++static inline struct request_key_auth *get_request_key_auth(const struct key *key)
++{
++ return key->payload.data[0];
++}
++
++
++#endif /* _KEYS_REQUEST_KEY_AUTH_TYPE_H */
+diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
+index 4f31f96bbfab..90ac450745f1 100644
+--- a/include/kvm/arm_vgic.h
++++ b/include/kvm/arm_vgic.h
+@@ -256,7 +256,7 @@ struct vgic_dist {
+ u64 propbaser;
+
+ /* Protects the lpi_list and the count value below. */
+- spinlock_t lpi_list_lock;
++ raw_spinlock_t lpi_list_lock;
+ struct list_head lpi_list_head;
+ int lpi_list_count;
+
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index 6fb0808e87c8..bef2e36c01b4 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -601,7 +601,7 @@ do { \
+ */
+ #define dm_target_offset(ti, sector) ((sector) - (ti)->begin)
+
+-static inline sector_t to_sector(unsigned long n)
++static inline sector_t to_sector(unsigned long long n)
+ {
+ return (n >> SECTOR_SHIFT);
+ }
+diff --git a/include/linux/hardirq.h b/include/linux/hardirq.h
+index 0fbbcdf0c178..da0af631ded5 100644
+--- a/include/linux/hardirq.h
++++ b/include/linux/hardirq.h
+@@ -60,8 +60,14 @@ extern void irq_enter(void);
+ */
+ extern void irq_exit(void);
+
++#ifndef arch_nmi_enter
++#define arch_nmi_enter() do { } while (0)
++#define arch_nmi_exit() do { } while (0)
++#endif
++
+ #define nmi_enter() \
+ do { \
++ arch_nmi_enter(); \
+ printk_nmi_enter(); \
+ lockdep_off(); \
+ ftrace_nmi_enter(); \
+@@ -80,6 +86,7 @@ extern void irq_exit(void);
+ ftrace_nmi_exit(); \
+ lockdep_on(); \
+ printk_nmi_exit(); \
++ arch_nmi_exit(); \
+ } while (0)
+
+ #endif /* LINUX_HARDIRQ_H */
+diff --git a/include/linux/key-type.h b/include/linux/key-type.h
+index 05d8fb5a06c4..d3c5ae8ad498 100644
+--- a/include/linux/key-type.h
++++ b/include/linux/key-type.h
+@@ -17,15 +17,6 @@
+
+ #ifdef CONFIG_KEYS
+
+-/*
+- * key under-construction record
+- * - passed to the request_key actor if supplied
+- */
+-struct key_construction {
+- struct key *key; /* key being constructed */
+- struct key *authkey;/* authorisation for key being constructed */
+-};
+-
+ /*
+ * Pre-parsed payload, used by key add, update and instantiate.
+ *
+@@ -47,8 +38,7 @@ struct key_preparsed_payload {
+ time64_t expiry; /* Expiry time of key */
+ } __randomize_layout;
+
+-typedef int (*request_key_actor_t)(struct key_construction *key,
+- const char *op, void *aux);
++typedef int (*request_key_actor_t)(struct key *auth_key, void *aux);
+
+ /*
+ * Preparsed matching criterion.
+@@ -170,20 +160,20 @@ extern int key_instantiate_and_link(struct key *key,
+ const void *data,
+ size_t datalen,
+ struct key *keyring,
+- struct key *instkey);
++ struct key *authkey);
+ extern int key_reject_and_link(struct key *key,
+ unsigned timeout,
+ unsigned error,
+ struct key *keyring,
+- struct key *instkey);
+-extern void complete_request_key(struct key_construction *cons, int error);
++ struct key *authkey);
++extern void complete_request_key(struct key *authkey, int error);
+
+ static inline int key_negate_and_link(struct key *key,
+ unsigned timeout,
+ struct key *keyring,
+- struct key *instkey)
++ struct key *authkey)
+ {
+- return key_reject_and_link(key, timeout, ENOKEY, keyring, instkey);
++ return key_reject_and_link(key, timeout, ENOKEY, keyring, authkey);
+ }
+
+ extern int generic_key_instantiate(struct key *key, struct key_preparsed_payload *prep);
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index a03d5e264e5e..23c242a7ac52 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -633,7 +633,7 @@ void kvm_arch_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
+ struct kvm_memory_slot *dont);
+ int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot,
+ unsigned long npages);
+-void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots);
++void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen);
+ int kvm_arch_prepare_memory_region(struct kvm *kvm,
+ struct kvm_memory_slot *memslot,
+ const struct kvm_userspace_memory_region *mem,
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index 5a3bb3b7c9ad..3ecd7ea212ae 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -182,6 +182,7 @@ void generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *);
+ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);
++void pipe_buf_mark_unmergeable(struct pipe_buffer *buf);
+
+ extern const struct pipe_buf_operations nosteal_pipe_buf_ops;
+
+diff --git a/include/linux/property.h b/include/linux/property.h
+index ac8a1ebc4c1b..1a12364050d8 100644
+--- a/include/linux/property.h
++++ b/include/linux/property.h
+@@ -258,7 +258,7 @@ struct property_entry {
+ #define PROPERTY_ENTRY_STRING(_name_, _val_) \
+ (struct property_entry) { \
+ .name = _name_, \
+- .length = sizeof(_val_), \
++ .length = sizeof(const char *), \
+ .type = DEV_PROP_STRING, \
+ { .value = { .str = _val_ } }, \
+ }
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index a404d475acee..820903ceac4f 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -4086,6 +4086,12 @@ static inline bool skb_is_gso_sctp(const struct sk_buff *skb)
+ return skb_shinfo(skb)->gso_type & SKB_GSO_SCTP;
+ }
+
++/* Note: Should be called only if skb_is_gso(skb) is true */
++static inline bool skb_is_gso_tcp(const struct sk_buff *skb)
++{
++ return skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6);
++}
++
+ static inline void skb_gso_reset(struct sk_buff *skb)
+ {
+ skb_shinfo(skb)->gso_size = 0;
+diff --git a/include/net/phonet/pep.h b/include/net/phonet/pep.h
+index b669fe6dbc3b..98f31c7ea23d 100644
+--- a/include/net/phonet/pep.h
++++ b/include/net/phonet/pep.h
+@@ -63,10 +63,11 @@ struct pnpipehdr {
+ u8 state_after_reset; /* reset request */
+ u8 error_code; /* any response */
+ u8 pep_type; /* status indication */
+- u8 data[1];
++ u8 data0; /* anything else */
+ };
++ u8 data[];
+ };
+-#define other_pep_type data[1]
++#define other_pep_type data[0]
+
+ static inline struct pnpipehdr *pnp_hdr(struct sk_buff *skb)
+ {
+diff --git a/init/main.c b/init/main.c
+index 18f8f0140fa0..e083fac08aed 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -689,7 +689,6 @@ asmlinkage __visible void __init start_kernel(void)
+ initrd_start = 0;
+ }
+ #endif
+- page_ext_init();
+ kmemleak_init();
+ debug_objects_mem_init();
+ setup_per_cpu_pageset();
+@@ -1140,6 +1139,8 @@ static noinline void __init kernel_init_freeable(void)
+ sched_init_smp();
+
+ page_alloc_init_late();
++ /* Initialize page ext after all struct pages are initialized. */
++ page_ext_init();
+
+ do_basic_setup();
+
+diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
+index 9058317ba9de..4f3138e6ecb2 100644
+--- a/kernel/bpf/lpm_trie.c
++++ b/kernel/bpf/lpm_trie.c
+@@ -432,6 +432,7 @@ static int trie_delete_elem(struct bpf_map *map, void *_key)
+ }
+
+ if (!node || node->prefixlen != key->prefixlen ||
++ node->prefixlen != matchlen ||
+ (node->flags & LPM_TREE_NODE_FLAG_IM)) {
+ ret = -ENOENT;
+ goto out;
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index 6a32933cae4f..7cb7a7f98a37 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -44,7 +44,7 @@ static void do_up_read(struct irq_work *entry)
+ struct stack_map_irq_work *work;
+
+ work = container_of(entry, struct stack_map_irq_work, irq_work);
+- up_read(work->sem);
++ up_read_non_owner(work->sem);
+ work->sem = NULL;
+ }
+
+@@ -338,6 +338,12 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
+ } else {
+ work->sem = ¤t->mm->mmap_sem;
+ irq_work_queue(&work->irq_work);
++ /*
++ * The irq_work will release the mmap_sem with
++ * up_read_non_owner(). The rwsem_release() is called
++ * here to release the lock from lockdep's perspective.
++ */
++ rwsem_release(¤t->mm->mmap_sem.dep_map, 1, _RET_IP_);
+ }
+ }
+
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index e578c3999970..e710ac7fbbbf 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -1998,7 +1998,7 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags,
+ struct cgroup_namespace *ns)
+ {
+ struct dentry *dentry;
+- bool new_sb;
++ bool new_sb = false;
+
+ dentry = kernfs_mount(fs_type, flags, root->kf_root, magic, &new_sb);
+
+@@ -2008,6 +2008,7 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags,
+ */
+ if (!IS_ERR(dentry) && ns != &init_cgroup_ns) {
+ struct dentry *nsdentry;
++ struct super_block *sb = dentry->d_sb;
+ struct cgroup *cgrp;
+
+ mutex_lock(&cgroup_mutex);
+@@ -2018,12 +2019,14 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags,
+ spin_unlock_irq(&css_set_lock);
+ mutex_unlock(&cgroup_mutex);
+
+- nsdentry = kernfs_node_dentry(cgrp->kn, dentry->d_sb);
++ nsdentry = kernfs_node_dentry(cgrp->kn, sb);
+ dput(dentry);
++ if (IS_ERR(nsdentry))
++ deactivate_locked_super(sb);
+ dentry = nsdentry;
+ }
+
+- if (IS_ERR(dentry) || !new_sb)
++ if (!new_sb)
+ cgroup_put(&root->cgrp);
+
+ return dentry;
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 15301ed19da6..f7e89c989df7 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -1689,15 +1689,23 @@ static bool rcu_future_gp_cleanup(struct rcu_state *rsp, struct rcu_node *rnp)
+ }
+
+ /*
+- * Awaken the grace-period kthread for the specified flavor of RCU.
+- * Don't do a self-awaken, and don't bother awakening when there is
+- * nothing for the grace-period kthread to do (as in several CPUs
+- * raced to awaken, and we lost), and finally don't try to awaken
+- * a kthread that has not yet been created.
++ * Awaken the grace-period kthread. Don't do a self-awaken (unless in
++ * an interrupt or softirq handler), and don't bother awakening when there
++ * is nothing for the grace-period kthread to do (as in several CPUs raced
++ * to awaken, and we lost), and finally don't try to awaken a kthread that
++ * has not yet been created. If all those checks are passed, track some
++ * debug information and awaken.
++ *
++ * So why do the self-wakeup when in an interrupt or softirq handler
++ * in the grace-period kthread's context? Because the kthread might have
++ * been interrupted just as it was going to sleep, and just after the final
++ * pre-sleep check of the awaken condition. In this case, a wakeup really
++ * is required, and is therefore supplied.
+ */
+ static void rcu_gp_kthread_wake(struct rcu_state *rsp)
+ {
+- if (current == rsp->gp_kthread ||
++ if ((current == rsp->gp_kthread &&
++ !in_interrupt() && !in_serving_softirq()) ||
+ !READ_ONCE(rsp->gp_flags) ||
+ !rsp->gp_kthread)
+ return;
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 32dea29d05a0..3b86acd5de4e 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2552,7 +2552,16 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp,
+ {
+ struct do_proc_dointvec_minmax_conv_param *param = data;
+ if (write) {
+- int val = *negp ? -*lvalp : *lvalp;
++ int val;
++ if (*negp) {
++ if (*lvalp > (unsigned long) INT_MAX + 1)
++ return -EINVAL;
++ val = -*lvalp;
++ } else {
++ if (*lvalp > (unsigned long) INT_MAX)
++ return -EINVAL;
++ val = *lvalp;
++ }
+ if ((param->min && *param->min > val) ||
+ (param->max && *param->max < val))
+ return -EINVAL;
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 17bd0c0dfa98..1f96b292df31 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -5606,7 +5606,6 @@ out:
+ return ret;
+
+ fail:
+- kfree(iter->trace);
+ kfree(iter);
+ __trace_array_put(tr);
+ mutex_unlock(&trace_types_lock);
+diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
+index 69a3fe926e8c..e6945b55c688 100644
+--- a/kernel/trace/trace_event_perf.c
++++ b/kernel/trace/trace_event_perf.c
+@@ -298,15 +298,13 @@ int perf_uprobe_init(struct perf_event *p_event, bool is_retprobe)
+
+ if (!p_event->attr.uprobe_path)
+ return -EINVAL;
+- path = kzalloc(PATH_MAX, GFP_KERNEL);
+- if (!path)
+- return -ENOMEM;
+- ret = strncpy_from_user(
+- path, u64_to_user_ptr(p_event->attr.uprobe_path), PATH_MAX);
+- if (ret == PATH_MAX)
+- return -E2BIG;
+- if (ret < 0)
+- goto out;
++
++ path = strndup_user(u64_to_user_ptr(p_event->attr.uprobe_path),
++ PATH_MAX);
++ if (IS_ERR(path)) {
++ ret = PTR_ERR(path);
++ return (ret == -EINVAL) ? -E2BIG : ret;
++ }
+ if (path[0] == '\0') {
+ ret = -EINVAL;
+ goto out;
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index eb908ef2ecec..11853e90b649 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -4621,9 +4621,10 @@ static inline void add_to_key(char *compound_key, void *key,
+ /* ensure NULL-termination */
+ if (size > key_field->size - 1)
+ size = key_field->size - 1;
+- }
+
+- memcpy(compound_key + key_field->offset, key, size);
++ strncpy(compound_key + key_field->offset, (char *)key, size);
++ } else
++ memcpy(compound_key + key_field->offset, key, size);
+ }
+
+ static void
+diff --git a/lib/assoc_array.c b/lib/assoc_array.c
+index c6659cb37033..59875eb278ea 100644
+--- a/lib/assoc_array.c
++++ b/lib/assoc_array.c
+@@ -768,9 +768,11 @@ all_leaves_cluster_together:
+ new_s0->index_key[i] =
+ ops->get_key_chunk(index_key, i * ASSOC_ARRAY_KEY_CHUNK_SIZE);
+
+- blank = ULONG_MAX << (level & ASSOC_ARRAY_KEY_CHUNK_MASK);
+- pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, level, blank);
+- new_s0->index_key[keylen - 1] &= ~blank;
++ if (level & ASSOC_ARRAY_KEY_CHUNK_MASK) {
++ blank = ULONG_MAX << (level & ASSOC_ARRAY_KEY_CHUNK_MASK);
++ pr_devel("blank off [%zu] %d: %lx\n", keylen - 1, level, blank);
++ new_s0->index_key[keylen - 1] &= ~blank;
++ }
+
+ /* This now reduces to a node splitting exercise for which we'll need
+ * to regenerate the disparity table.
+diff --git a/mm/gup.c b/mm/gup.c
+index 1abc8b4afff6..0a5374e6e82d 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -1649,7 +1649,8 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
+ if (!pmd_present(pmd))
+ return 0;
+
+- if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd))) {
++ if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd) ||
++ pmd_devmap(pmd))) {
+ /*
+ * NUMA hinting faults need to be handled in the GUP
+ * slowpath for accounting purposes and so that they
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index d9b8a2490633..6edc6db5ec1b 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1823,19 +1823,17 @@ static int soft_offline_in_use_page(struct page *page, int flags)
+ struct page *hpage = compound_head(page);
+
+ if (!PageHuge(page) && PageTransHuge(hpage)) {
+- lock_page(hpage);
+- if (!PageAnon(hpage) || unlikely(split_huge_page(hpage))) {
+- unlock_page(hpage);
+- if (!PageAnon(hpage))
++ lock_page(page);
++ if (!PageAnon(page) || unlikely(split_huge_page(page))) {
++ unlock_page(page);
++ if (!PageAnon(page))
+ pr_info("soft offline: %#lx: non anonymous thp\n", page_to_pfn(page));
+ else
+ pr_info("soft offline: %#lx: thp split failed\n", page_to_pfn(page));
+- put_hwpoison_page(hpage);
++ put_hwpoison_page(page);
+ return -EBUSY;
+ }
+- unlock_page(hpage);
+- get_hwpoison_page(page);
+- put_hwpoison_page(hpage);
++ unlock_page(page);
+ }
+
+ /*
+diff --git a/mm/memory.c b/mm/memory.c
+index 281172540a9c..5b3f71bcd1ae 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3762,10 +3762,13 @@ static vm_fault_t do_shared_fault(struct vm_fault *vmf)
+ * but allow concurrent faults).
+ * The mmap_sem may have been released depending on flags and our
+ * return value. See filemap_fault() and __lock_page_or_retry().
++ * If mmap_sem is released, vma may become invalid (for example
++ * by other thread calling munmap()).
+ */
+ static vm_fault_t do_fault(struct vm_fault *vmf)
+ {
+ struct vm_area_struct *vma = vmf->vma;
++ struct mm_struct *vm_mm = vma->vm_mm;
+ vm_fault_t ret;
+
+ /*
+@@ -3806,7 +3809,7 @@ static vm_fault_t do_fault(struct vm_fault *vmf)
+
+ /* preallocated pagetable is unused: free it */
+ if (vmf->prealloc_pte) {
+- pte_free(vma->vm_mm, vmf->prealloc_pte);
++ pte_free(vm_mm, vmf->prealloc_pte);
+ vmf->prealloc_pte = NULL;
+ }
+ return ret;
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index a9de1dbb9a6c..ef99971c13dd 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4532,11 +4532,11 @@ refill:
+ /* Even if we own the page, we do not use atomic_set().
+ * This would break get_page_unless_zero() users.
+ */
+- page_ref_add(page, size - 1);
++ page_ref_add(page, size);
+
+ /* reset page count bias and offset to start of new frag */
+ nc->pfmemalloc = page_is_pfmemalloc(page);
+- nc->pagecnt_bias = size;
++ nc->pagecnt_bias = size + 1;
+ nc->offset = size;
+ }
+
+@@ -4552,10 +4552,10 @@ refill:
+ size = nc->size;
+ #endif
+ /* OK, page count is 0, we can safely set it */
+- set_page_count(page, size);
++ set_page_count(page, size + 1);
+
+ /* reset page count bias and offset to start of new frag */
+- nc->pagecnt_bias = size;
++ nc->pagecnt_bias = size + 1;
+ offset = size - fragsz;
+ }
+
+diff --git a/mm/page_ext.c b/mm/page_ext.c
+index a9826da84ccb..4961f13b6ec1 100644
+--- a/mm/page_ext.c
++++ b/mm/page_ext.c
+@@ -398,10 +398,8 @@ void __init page_ext_init(void)
+ * We know some arch can have a nodes layout such as
+ * -------------pfn-------------->
+ * N0 | N1 | N2 | N0 | N1 | N2|....
+- *
+- * Take into account DEFERRED_STRUCT_PAGE_INIT.
+ */
+- if (early_pfn_to_nid(pfn) != nid)
++ if (pfn_to_nid(pfn) != nid)
+ continue;
+ if (init_section_page_ext(pfn, nid))
+ goto oom;
+diff --git a/mm/shmem.c b/mm/shmem.c
+index b6cf0e8e685b..3c8742655756 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2895,16 +2895,20 @@ static int shmem_create(struct inode *dir, struct dentry *dentry, umode_t mode,
+ static int shmem_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry)
+ {
+ struct inode *inode = d_inode(old_dentry);
+- int ret;
++ int ret = 0;
+
+ /*
+ * No ordinary (disk based) filesystem counts links as inodes;
+ * but each new link needs a new dentry, pinning lowmem, and
+ * tmpfs dentries cannot be pruned until they are unlinked.
++ * But if an O_TMPFILE file is linked into the tmpfs, the
++ * first link must skip that, to get the accounting right.
+ */
+- ret = shmem_reserve_inode(inode->i_sb);
+- if (ret)
+- goto out;
++ if (inode->i_nlink) {
++ ret = shmem_reserve_inode(inode->i_sb);
++ if (ret)
++ goto out;
++ }
+
+ dir->i_size += BOGO_DIRENT_SIZE;
+ inode->i_ctime = dir->i_ctime = dir->i_mtime = current_time(inode);
+diff --git a/mm/swap.c b/mm/swap.c
+index 26fc9b5f1b6c..a3fc028e338e 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -321,11 +321,6 @@ static inline void activate_page_drain(int cpu)
+ {
+ }
+
+-static bool need_activate_page_drain(int cpu)
+-{
+- return false;
+-}
+-
+ void activate_page(struct page *page)
+ {
+ struct zone *zone = page_zone(page);
+@@ -654,13 +649,15 @@ void lru_add_drain(void)
+ put_cpu();
+ }
+
++#ifdef CONFIG_SMP
++
++static DEFINE_PER_CPU(struct work_struct, lru_add_drain_work);
++
+ static void lru_add_drain_per_cpu(struct work_struct *dummy)
+ {
+ lru_add_drain();
+ }
+
+-static DEFINE_PER_CPU(struct work_struct, lru_add_drain_work);
+-
+ /*
+ * Doesn't need any cpu hotplug locking because we do rely on per-cpu
+ * kworkers being shut down before our page_alloc_cpu_dead callback is
+@@ -703,6 +700,12 @@ void lru_add_drain_all(void)
+
+ mutex_unlock(&lock);
+ }
++#else
++void lru_add_drain_all(void)
++{
++ lru_add_drain();
++}
++#endif
+
+ /**
+ * release_pages - batched put_page()
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index a728fc492557..91a789a46b12 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -2244,7 +2244,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
+ if (!(area->flags & VM_USERMAP))
+ return -EINVAL;
+
+- if (kaddr + size > area->addr + area->size)
++ if (kaddr + size > area->addr + get_vm_area_size(area))
+ return -EINVAL;
+
+ do {
+diff --git a/net/9p/client.c b/net/9p/client.c
+index 75b7bf7c7f07..23ec6187dc07 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -1073,7 +1073,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
+ p9_debug(P9_DEBUG_ERROR,
+ "Please specify a msize of at least 4k\n");
+ err = -EINVAL;
+- goto free_client;
++ goto close_trans;
+ }
+
+ err = p9_client_version(clnt);
+diff --git a/net/core/filter.c b/net/core/filter.c
+index bed9061102f4..eb81e9db4093 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2614,8 +2614,7 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
+ u32 off = skb_mac_header_len(skb);
+ int ret;
+
+- /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+- if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
++ if (skb_is_gso(skb) && !skb_is_gso_tcp(skb))
+ return -ENOTSUPP;
+
+ ret = skb_cow(skb, len_diff);
+@@ -2656,8 +2655,7 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
+ u32 off = skb_mac_header_len(skb);
+ int ret;
+
+- /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+- if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
++ if (skb_is_gso(skb) && !skb_is_gso_tcp(skb))
+ return -ENOTSUPP;
+
+ ret = skb_unclone(skb, GFP_ATOMIC);
+@@ -2782,8 +2780,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)
+ u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
+ int ret;
+
+- /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+- if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
++ if (skb_is_gso(skb) && !skb_is_gso_tcp(skb))
+ return -ENOTSUPP;
+
+ ret = skb_cow(skb, len_diff);
+@@ -2812,8 +2809,7 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
+ u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
+ int ret;
+
+- /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+- if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
++ if (skb_is_gso(skb) && !skb_is_gso_tcp(skb))
+ return -ENOTSUPP;
+
+ ret = skb_unclone(skb, GFP_ATOMIC);
+diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
+index 97689012b357..12a43a5369a5 100644
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -325,7 +325,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
+ skb->len += tailen;
+ skb->data_len += tailen;
+ skb->truesize += tailen;
+- if (sk)
++ if (sk && sk_fullsock(sk))
+ refcount_add(tailen, &sk->sk_wmem_alloc);
+
+ goto out;
+diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+index 3cd237b42f44..2fa196325988 100644
+--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+@@ -846,9 +846,9 @@ static int clusterip_net_init(struct net *net)
+
+ static void clusterip_net_exit(struct net *net)
+ {
++#ifdef CONFIG_PROC_FS
+ struct clusterip_net *cn = clusterip_pernet(net);
+
+-#ifdef CONFIG_PROC_FS
+ mutex_lock(&cn->mutex);
+ proc_remove(cn->procdir);
+ cn->procdir = NULL;
+diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
+index 88a7579c23bd..a7d996148eed 100644
+--- a/net/ipv6/esp6.c
++++ b/net/ipv6/esp6.c
+@@ -293,7 +293,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
+ skb->len += tailen;
+ skb->data_len += tailen;
+ skb->truesize += tailen;
+- if (sk)
++ if (sk && sk_fullsock(sk))
+ refcount_add(tailen, &sk->sk_wmem_alloc);
+
+ goto out;
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 9d61266526e7..7da629d59717 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -196,30 +196,22 @@ static int pfkey_release(struct socket *sock)
+ return 0;
+ }
+
+-static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
+- gfp_t allocation, struct sock *sk)
++static int pfkey_broadcast_one(struct sk_buff *skb, gfp_t allocation,
++ struct sock *sk)
+ {
+ int err = -ENOBUFS;
+
+- sock_hold(sk);
+- if (*skb2 == NULL) {
+- if (refcount_read(&skb->users) != 1) {
+- *skb2 = skb_clone(skb, allocation);
+- } else {
+- *skb2 = skb;
+- refcount_inc(&skb->users);
+- }
+- }
+- if (*skb2 != NULL) {
+- if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) {
+- skb_set_owner_r(*skb2, sk);
+- skb_queue_tail(&sk->sk_receive_queue, *skb2);
+- sk->sk_data_ready(sk);
+- *skb2 = NULL;
+- err = 0;
+- }
++ if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
++ return err;
++
++ skb = skb_clone(skb, allocation);
++
++ if (skb) {
++ skb_set_owner_r(skb, sk);
++ skb_queue_tail(&sk->sk_receive_queue, skb);
++ sk->sk_data_ready(sk);
++ err = 0;
+ }
+- sock_put(sk);
+ return err;
+ }
+
+@@ -234,7 +226,6 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
+ {
+ struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
+ struct sock *sk;
+- struct sk_buff *skb2 = NULL;
+ int err = -ESRCH;
+
+ /* XXX Do we need something like netlink_overrun? I think
+@@ -253,7 +244,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
+ * socket.
+ */
+ if (pfk->promisc)
+- pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk);
++ pfkey_broadcast_one(skb, GFP_ATOMIC, sk);
+
+ /* the exact target will be processed later */
+ if (sk == one_sk)
+@@ -268,7 +259,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
+ continue;
+ }
+
+- err2 = pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk);
++ err2 = pfkey_broadcast_one(skb, GFP_ATOMIC, sk);
+
+ /* Error is cleared after successful sending to at least one
+ * registered KM */
+@@ -278,9 +269,8 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
+ rcu_read_unlock();
+
+ if (one_sk != NULL)
+- err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
++ err = pfkey_broadcast_one(skb, allocation, one_sk);
+
+- kfree_skb(skb2);
+ kfree_skb(skb);
+ return err;
+ }
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+index 69e831bc317b..54821fb1a960 100644
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -8,7 +8,7 @@
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007-2010, Intel Corporation
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
+- * Copyright (C) 2018 Intel Corporation
++ * Copyright (C) 2018 - 2019 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -366,6 +366,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+
+ set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
+
++ ieee80211_agg_stop_txq(sta, tid);
++
+ spin_unlock_bh(&sta->lock);
+
+ ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 716cd6442d86..3deaa01ebee4 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -5,7 +5,7 @@
+ * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
+ * Copyright (C) 2015-2017 Intel Deutschland GmbH
+- * Copyright (C) 2018 Intel Corporation
++ * Copyright (C) 2018-2019 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -2020,6 +2020,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
+ case NL80211_IFTYPE_AP_VLAN:
+ case NL80211_IFTYPE_MONITOR:
+ break;
++ case NL80211_IFTYPE_ADHOC:
++ if (sdata->vif.bss_conf.ibss_joined)
++ WARN_ON(drv_join_ibss(local, sdata));
++ /* fall through */
+ default:
+ ieee80211_reconfig_stations(sdata);
+ /* fall through */
+diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig
+index cad48d07c818..8401cefd9f65 100644
+--- a/net/netfilter/ipvs/Kconfig
++++ b/net/netfilter/ipvs/Kconfig
+@@ -29,6 +29,7 @@ config IP_VS_IPV6
+ bool "IPv6 support for IPVS"
+ depends on IPV6 = y || IP_VS = IPV6
+ select IP6_NF_IPTABLES
++ select NF_DEFRAG_IPV6
+ ---help---
+ Add IPv6 support to IPVS.
+
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index 7ca926a03b81..3f963ea22277 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1536,14 +1536,12 @@ ip_vs_try_to_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
+ /* sorry, all this trouble for a no-hit :) */
+ IP_VS_DBG_PKT(12, af, pp, skb, iph->off,
+ "ip_vs_in: packet continues traversal as normal");
+- if (iph->fragoffs) {
+- /* Fragment that couldn't be mapped to a conn entry
+- * is missing module nf_defrag_ipv6
+- */
+- IP_VS_DBG_RL("Unhandled frag, load nf_defrag_ipv6\n");
++
++ /* Fragment couldn't be mapped to a conn entry */
++ if (iph->fragoffs)
+ IP_VS_DBG_PKT(7, af, pp, skb, iph->off,
+ "unhandled fragment");
+- }
++
+ *verdict = NF_ACCEPT;
+ return 0;
+ }
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 55a77314340a..8fd8d06454d6 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -43,6 +43,7 @@
+ #ifdef CONFIG_IP_VS_IPV6
+ #include <net/ipv6.h>
+ #include <net/ip6_route.h>
++#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
+ #endif
+ #include <net/route.h>
+ #include <net/sock.h>
+@@ -895,6 +896,7 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
+ {
+ struct ip_vs_dest *dest;
+ unsigned int atype, i;
++ int ret = 0;
+
+ EnterFunction(2);
+
+@@ -905,6 +907,10 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
+ atype & IPV6_ADDR_LINKLOCAL) &&
+ !__ip_vs_addr_is_local_v6(svc->ipvs->net, &udest->addr.in6))
+ return -EINVAL;
++
++ ret = nf_defrag_ipv6_enable(svc->ipvs->net);
++ if (ret)
++ return ret;
+ } else
+ #endif
+ {
+@@ -1228,6 +1234,10 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
+ ret = -EINVAL;
+ goto out_err;
+ }
++
++ ret = nf_defrag_ipv6_enable(ipvs->net);
++ if (ret)
++ goto out_err;
+ }
+ #endif
+
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index aecadd471e1d..13e1ac333fa4 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -1899,7 +1899,7 @@ static int __init xt_init(void)
+ seqcount_init(&per_cpu(xt_recseq, i));
+ }
+
+- xt = kmalloc_array(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
++ xt = kcalloc(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
+ if (!xt)
+ return -ENOMEM;
+
+diff --git a/net/phonet/pep.c b/net/phonet/pep.c
+index 9fc76b19cd3c..db3473540303 100644
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -132,7 +132,7 @@ static int pep_indicate(struct sock *sk, u8 id, u8 code,
+ ph->utid = 0;
+ ph->message_id = id;
+ ph->pipe_handle = pn->pipe_handle;
+- ph->data[0] = code;
++ ph->error_code = code;
+ return pn_skb_send(sk, skb, NULL);
+ }
+
+@@ -153,7 +153,7 @@ static int pipe_handler_request(struct sock *sk, u8 id, u8 code,
+ ph->utid = id; /* whatever */
+ ph->message_id = id;
+ ph->pipe_handle = pn->pipe_handle;
+- ph->data[0] = code;
++ ph->error_code = code;
+ return pn_skb_send(sk, skb, NULL);
+ }
+
+@@ -208,7 +208,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code,
+ struct pnpipehdr *ph;
+ struct sockaddr_pn dst;
+ u8 data[4] = {
+- oph->data[0], /* PEP type */
++ oph->pep_type, /* PEP type */
+ code, /* error code, at an unusual offset */
+ PAD, PAD,
+ };
+@@ -221,7 +221,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code,
+ ph->utid = oph->utid;
+ ph->message_id = PNS_PEP_CTRL_RESP;
+ ph->pipe_handle = oph->pipe_handle;
+- ph->data[0] = oph->data[1]; /* CTRL id */
++ ph->data0 = oph->data[0]; /* CTRL id */
+
+ pn_skb_get_src_sockaddr(oskb, &dst);
+ return pn_skb_send(sk, skb, &dst);
+@@ -272,17 +272,17 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
+ return -EINVAL;
+
+ hdr = pnp_hdr(skb);
+- if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
++ if (hdr->pep_type != PN_PEP_TYPE_COMMON) {
+ net_dbg_ratelimited("Phonet unknown PEP type: %u\n",
+- (unsigned int)hdr->data[0]);
++ (unsigned int)hdr->pep_type);
+ return -EOPNOTSUPP;
+ }
+
+- switch (hdr->data[1]) {
++ switch (hdr->data[0]) {
+ case PN_PEP_IND_FLOW_CONTROL:
+ switch (pn->tx_fc) {
+ case PN_LEGACY_FLOW_CONTROL:
+- switch (hdr->data[4]) {
++ switch (hdr->data[3]) {
+ case PEP_IND_BUSY:
+ atomic_set(&pn->tx_credits, 0);
+ break;
+@@ -292,7 +292,7 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
+ }
+ break;
+ case PN_ONE_CREDIT_FLOW_CONTROL:
+- if (hdr->data[4] == PEP_IND_READY)
++ if (hdr->data[3] == PEP_IND_READY)
+ atomic_set(&pn->tx_credits, wake = 1);
+ break;
+ }
+@@ -301,12 +301,12 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
+ case PN_PEP_IND_ID_MCFC_GRANT_CREDITS:
+ if (pn->tx_fc != PN_MULTI_CREDIT_FLOW_CONTROL)
+ break;
+- atomic_add(wake = hdr->data[4], &pn->tx_credits);
++ atomic_add(wake = hdr->data[3], &pn->tx_credits);
+ break;
+
+ default:
+ net_dbg_ratelimited("Phonet unknown PEP indication: %u\n",
+- (unsigned int)hdr->data[1]);
++ (unsigned int)hdr->data[0]);
+ return -EOPNOTSUPP;
+ }
+ if (wake)
+@@ -318,7 +318,7 @@ static int pipe_rcv_created(struct sock *sk, struct sk_buff *skb)
+ {
+ struct pep_sock *pn = pep_sk(sk);
+ struct pnpipehdr *hdr = pnp_hdr(skb);
+- u8 n_sb = hdr->data[0];
++ u8 n_sb = hdr->data0;
+
+ pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL;
+ __skb_pull(skb, sizeof(*hdr));
+@@ -506,7 +506,7 @@ static int pep_connresp_rcv(struct sock *sk, struct sk_buff *skb)
+ return -ECONNREFUSED;
+
+ /* Parse sub-blocks */
+- n_sb = hdr->data[4];
++ n_sb = hdr->data[3];
+ while (n_sb > 0) {
+ u8 type, buf[6], len = sizeof(buf);
+ const u8 *data = pep_get_sb(skb, &type, &len, buf);
+@@ -739,7 +739,7 @@ static int pipe_do_remove(struct sock *sk)
+ ph->utid = 0;
+ ph->message_id = PNS_PIPE_REMOVE_REQ;
+ ph->pipe_handle = pn->pipe_handle;
+- ph->data[0] = PAD;
++ ph->data0 = PAD;
+ return pn_skb_send(sk, skb, NULL);
+ }
+
+@@ -817,7 +817,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp,
+ peer_type = hdr->other_pep_type << 8;
+
+ /* Parse sub-blocks (options) */
+- n_sb = hdr->data[4];
++ n_sb = hdr->data[3];
+ while (n_sb > 0) {
+ u8 type, buf[1], len = sizeof(buf);
+ const u8 *data = pep_get_sb(skb, &type, &len, buf);
+@@ -1109,7 +1109,7 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb)
+ ph->utid = 0;
+ if (pn->aligned) {
+ ph->message_id = PNS_PIPE_ALIGNED_DATA;
+- ph->data[0] = 0; /* padding */
++ ph->data0 = 0; /* padding */
+ } else
+ ph->message_id = PNS_PIPE_DATA;
+ ph->pipe_handle = pn->pipe_handle;
+diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
+index 97a8282955a8..8566531c2f10 100644
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -381,12 +381,16 @@ static int svc_partial_recvfrom(struct svc_rqst *rqstp,
+ /*
+ * Set socket snd and rcv buffer lengths
+ */
+-static void svc_sock_setbufsize(struct socket *sock, unsigned int snd,
+- unsigned int rcv)
++static void svc_sock_setbufsize(struct svc_sock *svsk, unsigned int nreqs)
+ {
++ unsigned int max_mesg = svsk->sk_xprt.xpt_server->sv_max_mesg;
++ struct socket *sock = svsk->sk_sock;
++
++ nreqs = min(nreqs, INT_MAX / 2 / max_mesg);
++
+ lock_sock(sock->sk);
+- sock->sk->sk_sndbuf = snd * 2;
+- sock->sk->sk_rcvbuf = rcv * 2;
++ sock->sk->sk_sndbuf = nreqs * max_mesg * 2;
++ sock->sk->sk_rcvbuf = nreqs * max_mesg * 2;
+ sock->sk->sk_write_space(sock->sk);
+ release_sock(sock->sk);
+ }
+@@ -548,9 +552,7 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
+ * provides an upper bound on the number of threads
+ * which will access the socket.
+ */
+- svc_sock_setbufsize(svsk->sk_sock,
+- (serv->sv_nrthreads+3) * serv->sv_max_mesg,
+- (serv->sv_nrthreads+3) * serv->sv_max_mesg);
++ svc_sock_setbufsize(svsk, serv->sv_nrthreads + 3);
+
+ clear_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
+ skb = NULL;
+@@ -718,9 +720,7 @@ static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv)
+ * receive and respond to one request.
+ * svc_udp_recvfrom will re-adjust if necessary
+ */
+- svc_sock_setbufsize(svsk->sk_sock,
+- 3 * svsk->sk_xprt.xpt_server->sv_max_mesg,
+- 3 * svsk->sk_xprt.xpt_server->sv_max_mesg);
++ svc_sock_setbufsize(svsk, 3);
+
+ /* data might have come in before data_ready set up */
+ set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 3d6bf790cf1f..5ddbf227e7c6 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -546,7 +546,8 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
+
+ sendcq = ib_alloc_cq(ia->ri_device, NULL,
+ ep->rep_attr.cap.max_send_wr + 1,
+- 1, IB_POLL_WORKQUEUE);
++ ia->ri_device->num_comp_vectors > 1 ? 1 : 0,
++ IB_POLL_WORKQUEUE);
+ if (IS_ERR(sendcq)) {
+ rc = PTR_ERR(sendcq);
+ dprintk("RPC: %s: failed to create send CQ: %i\n",
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 6f05e831a73e..82723ef44db3 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -76,10 +76,10 @@ static struct xfrm_if *xfrmi_decode_session(struct sk_buff *skb)
+ int ifindex;
+ struct xfrm_if *xi;
+
+- if (!skb->dev)
++ if (!secpath_exists(skb) || !skb->dev)
+ return NULL;
+
+- xfrmn = net_generic(dev_net(skb->dev), xfrmi_net_id);
++ xfrmn = net_generic(xs_net(xfrm_input_state(skb)), xfrmi_net_id);
+ ifindex = skb->dev->ifindex;
+
+ for_each_xfrmi_rcu(xfrmn->xfrmi[0], xi) {
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 6ea8036fcdbe..bf5d59270f79 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -2340,8 +2340,10 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+
+ if (ifcb) {
+ xi = ifcb->decode_session(skb);
+- if (xi)
++ if (xi) {
+ if_id = xi->p.if_id;
++ net = xi->net;
++ }
+ }
+ rcu_read_unlock();
+
+diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
+index a9186a98a37d..0c9c54b57515 100644
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -120,8 +120,8 @@ static int read_symbol(FILE *in, struct sym_entry *s)
+ fprintf(stderr, "Read error or end of file.\n");
+ return -1;
+ }
+- if (strlen(sym) > KSYM_NAME_LEN) {
+- fprintf(stderr, "Symbol %s too long for kallsyms (%zu vs %d).\n"
++ if (strlen(sym) >= KSYM_NAME_LEN) {
++ fprintf(stderr, "Symbol %s too long for kallsyms (%zu >= %d).\n"
+ "Please increase KSYM_NAME_LEN both in kernel and kallsyms.c\n",
+ sym, strlen(sym), KSYM_NAME_LEN);
+ return -1;
+diff --git a/security/keys/internal.h b/security/keys/internal.h
+index 9f8208dc0e55..a02742621c8d 100644
+--- a/security/keys/internal.h
++++ b/security/keys/internal.h
+@@ -188,20 +188,9 @@ static inline int key_permission(const key_ref_t key_ref, unsigned perm)
+ return key_task_permission(key_ref, current_cred(), perm);
+ }
+
+-/*
+- * Authorisation record for request_key().
+- */
+-struct request_key_auth {
+- struct key *target_key;
+- struct key *dest_keyring;
+- const struct cred *cred;
+- void *callout_info;
+- size_t callout_len;
+- pid_t pid;
+-} __randomize_layout;
+-
+ extern struct key_type key_type_request_key_auth;
+ extern struct key *request_key_auth_new(struct key *target,
++ const char *op,
+ const void *callout_info,
+ size_t callout_len,
+ struct key *dest_keyring);
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index 1ffe60bb2845..ca31af186abd 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -26,6 +26,7 @@
+ #include <linux/security.h>
+ #include <linux/uio.h>
+ #include <linux/uaccess.h>
++#include <keys/request_key_auth-type.h>
+ #include "internal.h"
+
+ #define KEY_MAX_DESC_SIZE 4096
+diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
+index d5b25e535d3a..d776d2114651 100644
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -20,6 +20,7 @@
+ #include <linux/security.h>
+ #include <linux/user_namespace.h>
+ #include <linux/uaccess.h>
++#include <keys/request_key_auth-type.h>
+ #include "internal.h"
+
+ /* Session keyring create vs join semaphore */
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index 738553698649..1a547cec8385 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -18,31 +18,30 @@
+ #include <linux/keyctl.h>
+ #include <linux/slab.h>
+ #include "internal.h"
++#include <keys/request_key_auth-type.h>
+
+ #define key_negative_timeout 60 /* default timeout on a negative key's existence */
+
+ /**
+ * complete_request_key - Complete the construction of a key.
+- * @cons: The key construction record.
++ * @auth_key: The authorisation key.
+ * @error: The success or failute of the construction.
+ *
+ * Complete the attempt to construct a key. The key will be negated
+ * if an error is indicated. The authorisation key will be revoked
+ * unconditionally.
+ */
+-void complete_request_key(struct key_construction *cons, int error)
++void complete_request_key(struct key *authkey, int error)
+ {
+- kenter("{%d,%d},%d", cons->key->serial, cons->authkey->serial, error);
++ struct request_key_auth *rka = get_request_key_auth(authkey);
++ struct key *key = rka->target_key;
++
++ kenter("%d{%d},%d", authkey->serial, key->serial, error);
+
+ if (error < 0)
+- key_negate_and_link(cons->key, key_negative_timeout, NULL,
+- cons->authkey);
++ key_negate_and_link(key, key_negative_timeout, NULL, authkey);
+ else
+- key_revoke(cons->authkey);
+-
+- key_put(cons->key);
+- key_put(cons->authkey);
+- kfree(cons);
++ key_revoke(authkey);
+ }
+ EXPORT_SYMBOL(complete_request_key);
+
+@@ -91,21 +90,19 @@ static int call_usermodehelper_keys(const char *path, char **argv, char **envp,
+ * Request userspace finish the construction of a key
+ * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
+ */
+-static int call_sbin_request_key(struct key_construction *cons,
+- const char *op,
+- void *aux)
++static int call_sbin_request_key(struct key *authkey, void *aux)
+ {
+ static char const request_key[] = "/sbin/request-key";
++ struct request_key_auth *rka = get_request_key_auth(authkey);
+ const struct cred *cred = current_cred();
+ key_serial_t prkey, sskey;
+- struct key *key = cons->key, *authkey = cons->authkey, *keyring,
+- *session;
++ struct key *key = rka->target_key, *keyring, *session;
+ char *argv[9], *envp[3], uid_str[12], gid_str[12];
+ char key_str[12], keyring_str[3][12];
+ char desc[20];
+ int ret, i;
+
+- kenter("{%d},{%d},%s", key->serial, authkey->serial, op);
++ kenter("{%d},{%d},%s", key->serial, authkey->serial, rka->op);
+
+ ret = install_user_keyrings();
+ if (ret < 0)
+@@ -163,7 +160,7 @@ static int call_sbin_request_key(struct key_construction *cons,
+ /* set up the argument list */
+ i = 0;
+ argv[i++] = (char *)request_key;
+- argv[i++] = (char *) op;
++ argv[i++] = (char *)rka->op;
+ argv[i++] = key_str;
+ argv[i++] = uid_str;
+ argv[i++] = gid_str;
+@@ -191,7 +188,7 @@ error_link:
+ key_put(keyring);
+
+ error_alloc:
+- complete_request_key(cons, ret);
++ complete_request_key(authkey, ret);
+ kleave(" = %d", ret);
+ return ret;
+ }
+@@ -205,42 +202,31 @@ static int construct_key(struct key *key, const void *callout_info,
+ size_t callout_len, void *aux,
+ struct key *dest_keyring)
+ {
+- struct key_construction *cons;
+ request_key_actor_t actor;
+ struct key *authkey;
+ int ret;
+
+ kenter("%d,%p,%zu,%p", key->serial, callout_info, callout_len, aux);
+
+- cons = kmalloc(sizeof(*cons), GFP_KERNEL);
+- if (!cons)
+- return -ENOMEM;
+-
+ /* allocate an authorisation key */
+- authkey = request_key_auth_new(key, callout_info, callout_len,
++ authkey = request_key_auth_new(key, "create", callout_info, callout_len,
+ dest_keyring);
+- if (IS_ERR(authkey)) {
+- kfree(cons);
+- ret = PTR_ERR(authkey);
+- authkey = NULL;
+- } else {
+- cons->authkey = key_get(authkey);
+- cons->key = key_get(key);
++ if (IS_ERR(authkey))
++ return PTR_ERR(authkey);
+
+- /* make the call */
+- actor = call_sbin_request_key;
+- if (key->type->request_key)
+- actor = key->type->request_key;
++ /* Make the call */
++ actor = call_sbin_request_key;
++ if (key->type->request_key)
++ actor = key->type->request_key;
+
+- ret = actor(cons, "create", aux);
++ ret = actor(authkey, aux);
+
+- /* check that the actor called complete_request_key() prior to
+- * returning an error */
+- WARN_ON(ret < 0 &&
+- !test_bit(KEY_FLAG_REVOKED, &authkey->flags));
+- key_put(authkey);
+- }
++ /* check that the actor called complete_request_key() prior to
++ * returning an error */
++ WARN_ON(ret < 0 &&
++ !test_bit(KEY_FLAG_REVOKED, &authkey->flags));
+
++ key_put(authkey);
+ kleave(" = %d", ret);
+ return ret;
+ }
+@@ -275,7 +261,7 @@ static int construct_get_dest_keyring(struct key **_dest_keyring)
+ if (cred->request_key_auth) {
+ authkey = cred->request_key_auth;
+ down_read(&authkey->sem);
+- rka = authkey->payload.data[0];
++ rka = get_request_key_auth(authkey);
+ if (!test_bit(KEY_FLAG_REVOKED,
+ &authkey->flags))
+ dest_keyring =
+diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
+index 6797843154f0..5e515791ccd1 100644
+--- a/security/keys/request_key_auth.c
++++ b/security/keys/request_key_auth.c
+@@ -18,7 +18,7 @@
+ #include <linux/slab.h>
+ #include <linux/uaccess.h>
+ #include "internal.h"
+-#include <keys/user-type.h>
++#include <keys/request_key_auth-type.h>
+
+ static int request_key_auth_preparse(struct key_preparsed_payload *);
+ static void request_key_auth_free_preparse(struct key_preparsed_payload *);
+@@ -69,7 +69,7 @@ static int request_key_auth_instantiate(struct key *key,
+ static void request_key_auth_describe(const struct key *key,
+ struct seq_file *m)
+ {
+- struct request_key_auth *rka = key->payload.data[0];
++ struct request_key_auth *rka = get_request_key_auth(key);
+
+ seq_puts(m, "key:");
+ seq_puts(m, key->description);
+@@ -84,7 +84,7 @@ static void request_key_auth_describe(const struct key *key,
+ static long request_key_auth_read(const struct key *key,
+ char __user *buffer, size_t buflen)
+ {
+- struct request_key_auth *rka = key->payload.data[0];
++ struct request_key_auth *rka = get_request_key_auth(key);
+ size_t datalen;
+ long ret;
+
+@@ -110,7 +110,7 @@ static long request_key_auth_read(const struct key *key,
+ */
+ static void request_key_auth_revoke(struct key *key)
+ {
+- struct request_key_auth *rka = key->payload.data[0];
++ struct request_key_auth *rka = get_request_key_auth(key);
+
+ kenter("{%d}", key->serial);
+
+@@ -137,7 +137,7 @@ static void free_request_key_auth(struct request_key_auth *rka)
+ */
+ static void request_key_auth_destroy(struct key *key)
+ {
+- struct request_key_auth *rka = key->payload.data[0];
++ struct request_key_auth *rka = get_request_key_auth(key);
+
+ kenter("{%d}", key->serial);
+
+@@ -148,8 +148,9 @@ static void request_key_auth_destroy(struct key *key)
+ * Create an authorisation token for /sbin/request-key or whoever to gain
+ * access to the caller's security data.
+ */
+-struct key *request_key_auth_new(struct key *target, const void *callout_info,
+- size_t callout_len, struct key *dest_keyring)
++struct key *request_key_auth_new(struct key *target, const char *op,
++ const void *callout_info, size_t callout_len,
++ struct key *dest_keyring)
+ {
+ struct request_key_auth *rka, *irka;
+ const struct cred *cred = current->cred;
+@@ -167,6 +168,7 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
+ if (!rka->callout_info)
+ goto error_free_rka;
+ rka->callout_len = callout_len;
++ strlcpy(rka->op, op, sizeof(rka->op));
+
+ /* see if the calling process is already servicing the key request of
+ * another process */
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 3c3878f0d2fa..6ea3d3aa1a1e 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1034,8 +1034,11 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
+ BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
+
+ /* if fs is reusing a sb, make sure that the contexts match */
+- if (newsbsec->flags & SE_SBINITIALIZED)
++ if (newsbsec->flags & SE_SBINITIALIZED) {
++ if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
++ *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
+ return selinux_cmp_sb_context(oldsb, newsb);
++ }
+
+ mutex_lock(&newsbsec->lock);
+
+@@ -5334,6 +5337,9 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname,
+ return -EINVAL;
+ }
+
++ if (walk_size + len > addrlen)
++ return -EINVAL;
++
+ err = -EINVAL;
+ switch (optname) {
+ /* Bind checks */
+diff --git a/sound/soc/codecs/pcm186x.c b/sound/soc/codecs/pcm186x.c
+index 690c26e7389e..3be0e1478d7d 100644
+--- a/sound/soc/codecs/pcm186x.c
++++ b/sound/soc/codecs/pcm186x.c
+@@ -42,7 +42,7 @@ struct pcm186x_priv {
+ bool is_master_mode;
+ };
+
+-static const DECLARE_TLV_DB_SCALE(pcm186x_pga_tlv, -1200, 4000, 50);
++static const DECLARE_TLV_DB_SCALE(pcm186x_pga_tlv, -1200, 50, 0);
+
+ static const struct snd_kcontrol_new pcm1863_snd_controls[] = {
+ SOC_DOUBLE_R_S_TLV("ADC Capture Volume", PCM186X_PGA_VAL_CH1_L,
+@@ -158,7 +158,7 @@ static const struct snd_soc_dapm_widget pcm1863_dapm_widgets[] = {
+ * Put the codec into SLEEP mode when not in use, allowing the
+ * Energysense mechanism to operate.
+ */
+- SND_SOC_DAPM_ADC("ADC", "HiFi Capture", PCM186X_POWER_CTRL, 1, 0),
++ SND_SOC_DAPM_ADC("ADC", "HiFi Capture", PCM186X_POWER_CTRL, 1, 1),
+ };
+
+ static const struct snd_soc_dapm_widget pcm1865_dapm_widgets[] = {
+@@ -184,8 +184,8 @@ static const struct snd_soc_dapm_widget pcm1865_dapm_widgets[] = {
+ * Put the codec into SLEEP mode when not in use, allowing the
+ * Energysense mechanism to operate.
+ */
+- SND_SOC_DAPM_ADC("ADC1", "HiFi Capture 1", PCM186X_POWER_CTRL, 1, 0),
+- SND_SOC_DAPM_ADC("ADC2", "HiFi Capture 2", PCM186X_POWER_CTRL, 1, 0),
++ SND_SOC_DAPM_ADC("ADC1", "HiFi Capture 1", PCM186X_POWER_CTRL, 1, 1),
++ SND_SOC_DAPM_ADC("ADC2", "HiFi Capture 2", PCM186X_POWER_CTRL, 1, 1),
+ };
+
+ static const struct snd_soc_dapm_route pcm1863_dapm_routes[] = {
+diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
+index afe7d5b19313..79ebcc239786 100644
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -1757,7 +1757,9 @@ static const struct snd_soc_dapm_route rt5682_dapm_routes[] = {
+ {"ADC Stereo1 Filter", NULL, "ADC STO1 ASRC", is_using_asrc},
+ {"DAC Stereo1 Filter", NULL, "DAC STO1 ASRC", is_using_asrc},
+ {"ADC STO1 ASRC", NULL, "AD ASRC"},
++ {"ADC STO1 ASRC", NULL, "DA ASRC"},
+ {"ADC STO1 ASRC", NULL, "CLKDET"},
++ {"DAC STO1 ASRC", NULL, "AD ASRC"},
+ {"DAC STO1 ASRC", NULL, "DA ASRC"},
+ {"DAC STO1 ASRC", NULL, "CLKDET"},
+
+diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
+index c1d1d06783e5..4daefa5b150a 100644
+--- a/sound/soc/fsl/fsl_esai.c
++++ b/sound/soc/fsl/fsl_esai.c
+@@ -398,7 +398,8 @@ static int fsl_esai_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ break;
+ case SND_SOC_DAIFMT_RIGHT_J:
+ /* Data on rising edge of bclk, frame high, right aligned */
+- xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCR_xWA;
++ xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP;
++ xcr |= ESAI_xCR_xWA;
+ break;
+ case SND_SOC_DAIFMT_DSP_A:
+ /* Data on rising edge of bclk, frame high, 1clk before data */
+@@ -455,12 +456,12 @@ static int fsl_esai_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ return -EINVAL;
+ }
+
+- mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR;
++ mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR | ESAI_xCR_xWA;
+ regmap_update_bits(esai_priv->regmap, REG_ESAI_TCR, mask, xcr);
+ regmap_update_bits(esai_priv->regmap, REG_ESAI_RCR, mask, xcr);
+
+ mask = ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCCR_xFSP |
+- ESAI_xCCR_xFSD | ESAI_xCCR_xCKD | ESAI_xCR_xWA;
++ ESAI_xCCR_xFSD | ESAI_xCCR_xCKD;
+ regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR, mask, xccr);
+ regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR, mask, xccr);
+
+diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
+index d6c62aa13041..ce00fe2f6aae 100644
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -700,6 +700,7 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
+ {
+ struct i2s_dai *i2s = to_info(dai);
+ u32 mod, mask = 0, val = 0;
++ struct clk *rclksrc;
+ unsigned long flags;
+
+ WARN_ON(!pm_runtime_active(dai->dev));
+@@ -782,6 +783,10 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
+
+ i2s->frmclk = params_rate(params);
+
++ rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
++ if (rclksrc && !IS_ERR(rclksrc))
++ i2s->rclk_srcrate = clk_get_rate(rclksrc);
++
+ return 0;
+ }
+
+@@ -886,11 +891,6 @@ static int config_setup(struct i2s_dai *i2s)
+ return 0;
+
+ if (!(i2s->quirks & QUIRK_NO_MUXPSR)) {
+- struct clk *rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
+-
+- if (rclksrc && !IS_ERR(rclksrc))
+- i2s->rclk_srcrate = clk_get_rate(rclksrc);
+-
+ psr = i2s->rclk_srcrate / i2s->frmclk / rfs;
+ writel(((psr - 1) << 8) | PSR_PSREN, i2s->addr + I2SPSR);
+ dev_dbg(&i2s->pdev->dev,
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index a566dae3ec8a..9410e0a9b14b 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -283,7 +283,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
+ if (rsnd_ssi_is_multi_slave(mod, io))
+ return 0;
+
+- if (ssi->usrcnt > 1) {
++ if (ssi->usrcnt > 0) {
+ if (ssi->rate != rate) {
+ dev_err(dev, "SSI parent/child should use same rate\n");
+ return -EINVAL;
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 653706945222..9b78fb3daa7b 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -71,12 +71,16 @@ static int dapm_up_seq[] = {
+ [snd_soc_dapm_clock_supply] = 1,
+ [snd_soc_dapm_supply] = 2,
+ [snd_soc_dapm_micbias] = 3,
++ [snd_soc_dapm_vmid] = 3,
+ [snd_soc_dapm_dai_link] = 2,
+ [snd_soc_dapm_dai_in] = 4,
+ [snd_soc_dapm_dai_out] = 4,
+ [snd_soc_dapm_aif_in] = 4,
+ [snd_soc_dapm_aif_out] = 4,
+ [snd_soc_dapm_mic] = 5,
++ [snd_soc_dapm_siggen] = 5,
++ [snd_soc_dapm_input] = 5,
++ [snd_soc_dapm_output] = 5,
+ [snd_soc_dapm_mux] = 6,
+ [snd_soc_dapm_demux] = 6,
+ [snd_soc_dapm_dac] = 7,
+@@ -84,11 +88,19 @@ static int dapm_up_seq[] = {
+ [snd_soc_dapm_mixer] = 8,
+ [snd_soc_dapm_mixer_named_ctl] = 8,
+ [snd_soc_dapm_pga] = 9,
++ [snd_soc_dapm_buffer] = 9,
++ [snd_soc_dapm_scheduler] = 9,
++ [snd_soc_dapm_effect] = 9,
++ [snd_soc_dapm_src] = 9,
++ [snd_soc_dapm_asrc] = 9,
++ [snd_soc_dapm_encoder] = 9,
++ [snd_soc_dapm_decoder] = 9,
+ [snd_soc_dapm_adc] = 10,
+ [snd_soc_dapm_out_drv] = 11,
+ [snd_soc_dapm_hp] = 11,
+ [snd_soc_dapm_spk] = 11,
+ [snd_soc_dapm_line] = 11,
++ [snd_soc_dapm_sink] = 11,
+ [snd_soc_dapm_kcontrol] = 12,
+ [snd_soc_dapm_post] = 13,
+ };
+@@ -101,13 +113,25 @@ static int dapm_down_seq[] = {
+ [snd_soc_dapm_spk] = 3,
+ [snd_soc_dapm_line] = 3,
+ [snd_soc_dapm_out_drv] = 3,
++ [snd_soc_dapm_sink] = 3,
+ [snd_soc_dapm_pga] = 4,
++ [snd_soc_dapm_buffer] = 4,
++ [snd_soc_dapm_scheduler] = 4,
++ [snd_soc_dapm_effect] = 4,
++ [snd_soc_dapm_src] = 4,
++ [snd_soc_dapm_asrc] = 4,
++ [snd_soc_dapm_encoder] = 4,
++ [snd_soc_dapm_decoder] = 4,
+ [snd_soc_dapm_switch] = 5,
+ [snd_soc_dapm_mixer_named_ctl] = 5,
+ [snd_soc_dapm_mixer] = 5,
+ [snd_soc_dapm_dac] = 6,
+ [snd_soc_dapm_mic] = 7,
++ [snd_soc_dapm_siggen] = 7,
++ [snd_soc_dapm_input] = 7,
++ [snd_soc_dapm_output] = 7,
+ [snd_soc_dapm_micbias] = 8,
++ [snd_soc_dapm_vmid] = 8,
+ [snd_soc_dapm_mux] = 9,
+ [snd_soc_dapm_demux] = 9,
+ [snd_soc_dapm_aif_in] = 10,
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 66e77e020745..88a7e860b175 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -2493,6 +2493,7 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp,
+ struct snd_soc_tplg_ops *ops, const struct firmware *fw, u32 id)
+ {
+ struct soc_tplg tplg;
++ int ret;
+
+ /* setup parsing context */
+ memset(&tplg, 0, sizeof(tplg));
+@@ -2506,7 +2507,12 @@ int snd_soc_tplg_component_load(struct snd_soc_component *comp,
+ tplg.bytes_ext_ops = ops->bytes_ext_ops;
+ tplg.bytes_ext_ops_count = ops->bytes_ext_ops_count;
+
+- return soc_tplg_load(&tplg);
++ ret = soc_tplg_load(&tplg);
++ /* free the created components if fail to load topology */
++ if (ret)
++ snd_soc_tplg_component_remove(comp, SND_SOC_TPLG_INDEX_ALL);
++
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(snd_soc_tplg_component_load);
+
+diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
+index db1511359c5e..40c93d8158b5 100644
+--- a/tools/perf/util/auxtrace.c
++++ b/tools/perf/util/auxtrace.c
+@@ -1273,9 +1273,9 @@ static int __auxtrace_mmap__read(struct auxtrace_mmap *mm,
+ }
+
+ /* padding must be written by fn() e.g. record__process_auxtrace() */
+- padding = size & 7;
++ padding = size & (PERF_AUXTRACE_RECORD_ALIGNMENT - 1);
+ if (padding)
+- padding = 8 - padding;
++ padding = PERF_AUXTRACE_RECORD_ALIGNMENT - padding;
+
+ memset(&ev, 0, sizeof(ev));
+ ev.auxtrace.header.type = PERF_RECORD_AUXTRACE;
+diff --git a/tools/perf/util/auxtrace.h b/tools/perf/util/auxtrace.h
+index 71fc3bd74299..136c5f95f9bf 100644
+--- a/tools/perf/util/auxtrace.h
++++ b/tools/perf/util/auxtrace.h
+@@ -38,6 +38,9 @@ struct record_opts;
+ struct auxtrace_info_event;
+ struct events_stats;
+
++/* Auxtrace records must have the same alignment as perf event records */
++#define PERF_AUXTRACE_RECORD_ALIGNMENT 8
++
+ enum auxtrace_type {
+ PERF_AUXTRACE_UNKNOWN,
+ PERF_AUXTRACE_INTEL_PT,
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index d404bed7003a..f3db68abbd9a 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -26,6 +26,7 @@
+
+ #include "../cache.h"
+ #include "../util.h"
++#include "../auxtrace.h"
+
+ #include "intel-pt-insn-decoder.h"
+ #include "intel-pt-pkt-decoder.h"
+@@ -1389,7 +1390,6 @@ static int intel_pt_overflow(struct intel_pt_decoder *decoder)
+ {
+ intel_pt_log("ERROR: Buffer overflow\n");
+ intel_pt_clear_tx_flags(decoder);
+- decoder->cbr = 0;
+ decoder->timestamp_insn_cnt = 0;
+ decoder->pkt_state = INTEL_PT_STATE_ERR_RESYNC;
+ decoder->overflow = true;
+@@ -2559,6 +2559,34 @@ static int intel_pt_tsc_cmp(uint64_t tsc1, uint64_t tsc2)
+ }
+ }
+
++#define MAX_PADDING (PERF_AUXTRACE_RECORD_ALIGNMENT - 1)
++
++/**
++ * adj_for_padding - adjust overlap to account for padding.
++ * @buf_b: second buffer
++ * @buf_a: first buffer
++ * @len_a: size of first buffer
++ *
++ * @buf_a might have up to 7 bytes of padding appended. Adjust the overlap
++ * accordingly.
++ *
++ * Return: A pointer into @buf_b from where non-overlapped data starts
++ */
++static unsigned char *adj_for_padding(unsigned char *buf_b,
++ unsigned char *buf_a, size_t len_a)
++{
++ unsigned char *p = buf_b - MAX_PADDING;
++ unsigned char *q = buf_a + len_a - MAX_PADDING;
++ int i;
++
++ for (i = MAX_PADDING; i; i--, p++, q++) {
++ if (*p != *q)
++ break;
++ }
++
++ return p;
++}
++
+ /**
+ * intel_pt_find_overlap_tsc - determine start of non-overlapped trace data
+ * using TSC.
+@@ -2609,8 +2637,11 @@ static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a,
+
+ /* Same TSC, so buffers are consecutive */
+ if (!cmp && rem_b >= rem_a) {
++ unsigned char *start;
++
+ *consecutive = true;
+- return buf_b + len_b - (rem_b - rem_a);
++ start = buf_b + len_b - (rem_b - rem_a);
++ return adj_for_padding(start, buf_a, len_a);
+ }
+ if (cmp < 0)
+ return buf_b; /* tsc_a < tsc_b => no overlap */
+@@ -2673,7 +2704,7 @@ unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a,
+ found = memmem(buf_a, len_a, buf_b, len_a);
+ if (found) {
+ *consecutive = true;
+- return buf_b + len_a;
++ return adj_for_padding(buf_b + len_a, buf_a, len_a);
+ }
+
+ /* Try again at next PSB in buffer 'a' */
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index 4f48bc11a29c..ff2c41ea94c8 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -2507,6 +2507,8 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
+ }
+
+ pt->timeless_decoding = intel_pt_timeless_decoding(pt);
++ if (pt->timeless_decoding && !pt->tc.time_mult)
++ pt->tc.time_mult = 1;
+ pt->have_tsc = intel_pt_have_tsc(pt);
+ pt->sampling_mode = false;
+ pt->est_tsc = !pt->timeless_decoding;
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index d188b7588152..0715f972a275 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -709,6 +709,8 @@ static int map_groups__split_kallsyms_for_kcore(struct map_groups *kmaps, struct
+ }
+
+ pos->start -= curr_map->start - curr_map->pgoff;
++ if (pos->end > curr_map->end)
++ pos->end = curr_map->end;
+ if (pos->end)
+ pos->end -= curr_map->start - curr_map->pgoff;
+ symbols__insert(&curr_map->dso->symbols, pos);
+diff --git a/tools/testing/selftests/bpf/test_lpm_map.c b/tools/testing/selftests/bpf/test_lpm_map.c
+index 147e34cfceb7..02d7c871862a 100644
+--- a/tools/testing/selftests/bpf/test_lpm_map.c
++++ b/tools/testing/selftests/bpf/test_lpm_map.c
+@@ -474,6 +474,16 @@ static void test_lpm_delete(void)
+ assert(bpf_map_lookup_elem(map_fd, key, &value) == -1 &&
+ errno == ENOENT);
+
++ key->prefixlen = 30; // unused prefix so far
++ inet_pton(AF_INET, "192.255.0.0", key->data);
++ assert(bpf_map_delete_elem(map_fd, key) == -1 &&
++ errno == ENOENT);
++
++ key->prefixlen = 16; // same prefix as the root node
++ inet_pton(AF_INET, "192.255.0.0", key->data);
++ assert(bpf_map_delete_elem(map_fd, key) == -1 &&
++ errno == ENOENT);
++
+ /* assert initial lookup */
+ key->prefixlen = 32;
+ inet_pton(AF_INET, "192.168.0.1", key->data);
+diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
+index 0f45633bd634..a4ccde0e473b 100755
+--- a/tools/testing/selftests/net/fib_tests.sh
++++ b/tools/testing/selftests/net/fib_tests.sh
+@@ -385,6 +385,7 @@ fib_carrier_unicast_test()
+
+ set -e
+ $IP link set dev dummy0 carrier off
++ sleep 1
+ set +e
+
+ echo " Carrier down"
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index 91495045ad5a..1415e36fed3d 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -624,6 +624,13 @@ static void vcpu_req_sleep(struct kvm_vcpu *vcpu)
+ /* Awaken to handle a signal, request we sleep again later. */
+ kvm_make_request(KVM_REQ_SLEEP, vcpu);
+ }
++
++ /*
++ * Make sure we will observe a potential reset request if we've
++ * observed a change to the power state. Pairs with the smp_wmb() in
++ * kvm_psci_vcpu_on().
++ */
++ smp_rmb();
+ }
+
+ static int kvm_vcpu_initialized(struct kvm_vcpu *vcpu)
+@@ -637,6 +644,9 @@ static void check_vcpu_requests(struct kvm_vcpu *vcpu)
+ if (kvm_check_request(KVM_REQ_SLEEP, vcpu))
+ vcpu_req_sleep(vcpu);
+
++ if (kvm_check_request(KVM_REQ_VCPU_RESET, vcpu))
++ kvm_reset_vcpu(vcpu);
++
+ /*
+ * Clear IRQ_PENDING requests that were made to guarantee
+ * that a VCPU sees new virtual interrupts.
+diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
+index 2f405b0be25c..1344557a7085 100644
+--- a/virt/kvm/arm/mmu.c
++++ b/virt/kvm/arm/mmu.c
+@@ -2154,7 +2154,7 @@ int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot,
+ return 0;
+ }
+
+-void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots)
++void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen)
+ {
+ }
+
+diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c
+index 9b73d3ad918a..34d08ee63747 100644
+--- a/virt/kvm/arm/psci.c
++++ b/virt/kvm/arm/psci.c
+@@ -104,12 +104,10 @@ static void kvm_psci_vcpu_off(struct kvm_vcpu *vcpu)
+
+ static unsigned long kvm_psci_vcpu_on(struct kvm_vcpu *source_vcpu)
+ {
++ struct vcpu_reset_state *reset_state;
+ struct kvm *kvm = source_vcpu->kvm;
+ struct kvm_vcpu *vcpu = NULL;
+- struct swait_queue_head *wq;
+ unsigned long cpu_id;
+- unsigned long context_id;
+- phys_addr_t target_pc;
+
+ cpu_id = smccc_get_arg1(source_vcpu) & MPIDR_HWID_BITMASK;
+ if (vcpu_mode_is_32bit(source_vcpu))
+@@ -130,32 +128,30 @@ static unsigned long kvm_psci_vcpu_on(struct kvm_vcpu *source_vcpu)
+ return PSCI_RET_INVALID_PARAMS;
+ }
+
+- target_pc = smccc_get_arg2(source_vcpu);
+- context_id = smccc_get_arg3(source_vcpu);
++ reset_state = &vcpu->arch.reset_state;
+
+- kvm_reset_vcpu(vcpu);
+-
+- /* Gracefully handle Thumb2 entry point */
+- if (vcpu_mode_is_32bit(vcpu) && (target_pc & 1)) {
+- target_pc &= ~((phys_addr_t) 1);
+- vcpu_set_thumb(vcpu);
+- }
++ reset_state->pc = smccc_get_arg2(source_vcpu);
+
+ /* Propagate caller endianness */
+- if (kvm_vcpu_is_be(source_vcpu))
+- kvm_vcpu_set_be(vcpu);
++ reset_state->be = kvm_vcpu_is_be(source_vcpu);
+
+- *vcpu_pc(vcpu) = target_pc;
+ /*
+ * NOTE: We always update r0 (or x0) because for PSCI v0.1
+ * the general puspose registers are undefined upon CPU_ON.
+ */
+- smccc_set_retval(vcpu, context_id, 0, 0, 0);
+- vcpu->arch.power_off = false;
+- smp_mb(); /* Make sure the above is visible */
++ reset_state->r0 = smccc_get_arg3(source_vcpu);
++
++ WRITE_ONCE(reset_state->reset, true);
++ kvm_make_request(KVM_REQ_VCPU_RESET, vcpu);
+
+- wq = kvm_arch_vcpu_wq(vcpu);
+- swake_up_one(wq);
++ /*
++ * Make sure the reset request is observed if the change to
++ * power_state is observed.
++ */
++ smp_wmb();
++
++ vcpu->arch.power_off = false;
++ kvm_vcpu_wake_up(vcpu);
+
+ return PSCI_RET_SUCCESS;
+ }
+diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
+index c0c0b88af1d5..8196e4f8731f 100644
+--- a/virt/kvm/arm/vgic/vgic-init.c
++++ b/virt/kvm/arm/vgic/vgic-init.c
+@@ -64,7 +64,7 @@ void kvm_vgic_early_init(struct kvm *kvm)
+ struct vgic_dist *dist = &kvm->arch.vgic;
+
+ INIT_LIST_HEAD(&dist->lpi_list_head);
+- spin_lock_init(&dist->lpi_list_lock);
++ raw_spin_lock_init(&dist->lpi_list_lock);
+ }
+
+ /* CREATION */
+@@ -231,13 +231,6 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
+ irq->config = VGIC_CONFIG_LEVEL;
+ }
+
+- /*
+- * GICv3 can only be created via the KVM_DEVICE_CREATE API and
+- * so we always know the emulation type at this point as it's
+- * either explicitly configured as GICv3, or explicitly
+- * configured as GICv2, or not configured yet which also
+- * implies GICv2.
+- */
+ if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3)
+ irq->group = 1;
+ else
+@@ -281,7 +274,7 @@ int vgic_init(struct kvm *kvm)
+ {
+ struct vgic_dist *dist = &kvm->arch.vgic;
+ struct kvm_vcpu *vcpu;
+- int ret = 0, i;
++ int ret = 0, i, idx;
+
+ if (vgic_initialized(kvm))
+ return 0;
+@@ -298,6 +291,19 @@ int vgic_init(struct kvm *kvm)
+ if (ret)
+ goto out;
+
++ /* Initialize groups on CPUs created before the VGIC type was known */
++ kvm_for_each_vcpu(idx, vcpu, kvm) {
++ struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
++
++ for (i = 0; i < VGIC_NR_PRIVATE_IRQS; i++) {
++ struct vgic_irq *irq = &vgic_cpu->private_irqs[i];
++ if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3)
++ irq->group = 1;
++ else
++ irq->group = 0;
++ }
++ }
++
+ if (vgic_has_its(kvm)) {
+ ret = vgic_v4_init(kvm);
+ if (ret)
+diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
+index 12502251727e..f376c82afb61 100644
+--- a/virt/kvm/arm/vgic/vgic-its.c
++++ b/virt/kvm/arm/vgic/vgic-its.c
+@@ -73,7 +73,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,
+ irq->target_vcpu = vcpu;
+ irq->group = 1;
+
+- spin_lock_irqsave(&dist->lpi_list_lock, flags);
++ raw_spin_lock_irqsave(&dist->lpi_list_lock, flags);
+
+ /*
+ * There could be a race with another vgic_add_lpi(), so we need to
+@@ -101,7 +101,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,
+ dist->lpi_list_count++;
+
+ out_unlock:
+- spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
++ raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
+
+ /*
+ * We "cache" the configuration table entries in our struct vgic_irq's.
+@@ -339,7 +339,7 @@ int vgic_copy_lpi_list(struct kvm *kvm, struct kvm_vcpu *vcpu, u32 **intid_ptr)
+ if (!intids)
+ return -ENOMEM;
+
+- spin_lock_irqsave(&dist->lpi_list_lock, flags);
++ raw_spin_lock_irqsave(&dist->lpi_list_lock, flags);
+ list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) {
+ if (i == irq_count)
+ break;
+@@ -348,7 +348,7 @@ int vgic_copy_lpi_list(struct kvm *kvm, struct kvm_vcpu *vcpu, u32 **intid_ptr)
+ continue;
+ intids[i++] = irq->intid;
+ }
+- spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
++ raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
+
+ *intid_ptr = intids;
+ return i;
+diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
+index f884a54b2601..c5165e3b80cb 100644
+--- a/virt/kvm/arm/vgic/vgic.c
++++ b/virt/kvm/arm/vgic/vgic.c
+@@ -72,7 +72,7 @@ static struct vgic_irq *vgic_get_lpi(struct kvm *kvm, u32 intid)
+ struct vgic_irq *irq = NULL;
+ unsigned long flags;
+
+- spin_lock_irqsave(&dist->lpi_list_lock, flags);
++ raw_spin_lock_irqsave(&dist->lpi_list_lock, flags);
+
+ list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) {
+ if (irq->intid != intid)
+@@ -88,7 +88,7 @@ static struct vgic_irq *vgic_get_lpi(struct kvm *kvm, u32 intid)
+ irq = NULL;
+
+ out_unlock:
+- spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
++ raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
+
+ return irq;
+ }
+@@ -138,15 +138,15 @@ void vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq)
+ if (irq->intid < VGIC_MIN_LPI)
+ return;
+
+- spin_lock_irqsave(&dist->lpi_list_lock, flags);
++ raw_spin_lock_irqsave(&dist->lpi_list_lock, flags);
+ if (!kref_put(&irq->refcount, vgic_irq_release)) {
+- spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
++ raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
+ return;
+ };
+
+ list_del(&irq->lpi_list);
+ dist->lpi_list_count--;
+- spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
++ raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
+
+ kfree(irq);
+ }
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 0ffb02ff5234..c436d95fd7aa 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -873,6 +873,7 @@ static struct kvm_memslots *install_new_memslots(struct kvm *kvm,
+ int as_id, struct kvm_memslots *slots)
+ {
+ struct kvm_memslots *old_memslots = __kvm_memslots(kvm, as_id);
++ u64 gen;
+
+ /*
+ * Set the low bit in the generation, which disables SPTE caching
+@@ -895,9 +896,11 @@ static struct kvm_memslots *install_new_memslots(struct kvm *kvm,
+ * space 0 will use generations 0, 4, 8, ... while * address space 1 will
+ * use generations 2, 6, 10, 14, ...
+ */
+- slots->generation += KVM_ADDRESS_SPACE_NUM * 2 - 1;
++ gen = slots->generation + KVM_ADDRESS_SPACE_NUM * 2 - 1;
+
+- kvm_arch_memslots_updated(kvm, slots);
++ kvm_arch_memslots_updated(kvm, gen);
++
++ slots->generation = gen;
+
+ return old_memslots;
+ }
diff --git a/1700_ppc-vr-get-set-change-to-avoid-gcc-warning.patch b/1700_ppc-vr-get-set-change-to-avoid-gcc-warning.patch
deleted file mode 100644
index bed4b41..0000000
--- a/1700_ppc-vr-get-set-change-to-avoid-gcc-warning.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From ca6d5149d2ad0a8d2f9c28cbe379802260a0a5e0 Mon Sep 17 00:00:00 2001
-From: Michael Ellerman <mpe@ellerman.id.au>
-Date: Thu, 14 Feb 2019 11:08:29 +1100
-Subject: powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-GCC 8 warns about the logic in vr_get/set(), which with -Werror breaks
-the build:
-
- In function ‘user_regset_copyin’,
- inlined from ‘vr_set’ at arch/powerpc/kernel/ptrace.c:628:9:
- include/linux/regset.h:295:4: error: ‘memcpy’ offset [-527, -529] is
- out of the bounds [0, 16] of object ‘vrsave’ with type ‘union
- <anonymous>’ [-Werror=array-bounds]
- arch/powerpc/kernel/ptrace.c: In function ‘vr_set’:
- arch/powerpc/kernel/ptrace.c:623:5: note: ‘vrsave’ declared here
- } vrsave;
-
-This has been identified as a regression in GCC, see GCC bug 88273.
-
-However we can avoid the warning and also simplify the logic and make
-it more robust.
-
-Currently we pass -1 as end_pos to user_regset_copyout(). This says
-"copy up to the end of the regset".
-
-The definition of the regset is:
- [REGSET_VMX] = {
- .core_note_type = NT_PPC_VMX, .n = 34,
- .size = sizeof(vector128), .align = sizeof(vector128),
- .active = vr_active, .get = vr_get, .set = vr_set
- },
-
-The end is calculated as (n * size), ie. 34 * sizeof(vector128).
-
-In vr_get/set() we pass start_pos as 33 * sizeof(vector128), meaning
-we can copy up to sizeof(vector128) into/out-of vrsave.
-
-The on-stack vrsave is defined as:
- union {
- elf_vrreg_t reg;
- u32 word;
- } vrsave;
-
-And elf_vrreg_t is:
- typedef __vector128 elf_vrreg_t;
-
-So there is no bug, but we rely on all those sizes lining up,
-otherwise we would have a kernel stack exposure/overwrite on our
-hands.
-
-Rather than relying on that we can pass an explict end_pos based on
-the sizeof(vrsave). The result should be exactly the same but it's
-more obviously not over-reading/writing the stack and it avoids the
-compiler warning.
-
-Reported-by: Meelis Roos <mroos@linux.ee>
-Reported-by: Mathieu Malaterre <malat@debian.org>
-Cc: stable@vger.kernel.org
-Tested-by: Mathieu Malaterre <malat@debian.org>
-Tested-by: Meelis Roos <mroos@linux.ee>
-Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
----
- arch/powerpc/kernel/ptrace.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
-index 7535f89e08cd..d9ac7d94656e 100644
---- a/arch/powerpc/kernel/ptrace.c
-+++ b/arch/powerpc/kernel/ptrace.c
-@@ -567,6 +567,7 @@ static int vr_get(struct task_struct *target, const struct user_regset *regset,
- /*
- * Copy out only the low-order word of vrsave.
- */
-+ int start, end;
- union {
- elf_vrreg_t reg;
- u32 word;
-@@ -575,8 +576,10 @@ static int vr_get(struct task_struct *target, const struct user_regset *regset,
-
- vrsave.word = target->thread.vrsave;
-
-+ start = 33 * sizeof(vector128);
-+ end = start + sizeof(vrsave);
- ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &vrsave,
-- 33 * sizeof(vector128), -1);
-+ start, end);
- }
-
- return ret;
-@@ -614,6 +617,7 @@ static int vr_set(struct task_struct *target, const struct user_regset *regset,
- /*
- * We use only the first word of vrsave.
- */
-+ int start, end;
- union {
- elf_vrreg_t reg;
- u32 word;
-@@ -622,8 +626,10 @@ static int vr_set(struct task_struct *target, const struct user_regset *regset,
-
- vrsave.word = target->thread.vrsave;
-
-+ start = 33 * sizeof(vector128);
-+ end = start + sizeof(vrsave);
- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &vrsave,
-- 33 * sizeof(vector128), -1);
-+ start, end);
- if (!ret)
- target->thread.vrsave = vrsave.word;
- }
---
-cgit 1.2-0.3.lf.el7
-
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-03-27 10:22 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-03-27 10:22 UTC (permalink / raw
To: gentoo-commits
commit: 7bf174f798dc7bb10b37ea1de18bf47e7fd28f88
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 27 10:22:21 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 27 10:22:21 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7bf174f7
Linux patch 4.19.32
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1031_linux-4.19.32.patch | 1514 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1518 insertions(+)
diff --git a/0000_README b/0000_README
index 730a45b..1e50242 100644
--- a/0000_README
+++ b/0000_README
@@ -167,6 +167,10 @@ Patch: 1030_linux-4.19.31.patch
From: http://www.kernel.org
Desc: Linux 4.19.31
+Patch: 1031_linux-4.19.32.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.32
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1031_linux-4.19.32.patch b/1031_linux-4.19.32.patch
new file mode 100644
index 0000000..29e4d49
--- /dev/null
+++ b/1031_linux-4.19.32.patch
@@ -0,0 +1,1514 @@
+diff --git a/Makefile b/Makefile
+index 3b1c6cff6700..d66c433df5b1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 31
++SUBLEVEL = 32
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/include/asm/jump_label.h b/arch/mips/include/asm/jump_label.h
+index e77672539e8e..e4456e450f94 100644
+--- a/arch/mips/include/asm/jump_label.h
++++ b/arch/mips/include/asm/jump_label.h
+@@ -21,15 +21,15 @@
+ #endif
+
+ #ifdef CONFIG_CPU_MICROMIPS
+-#define NOP_INSN "nop32"
++#define B_INSN "b32"
+ #else
+-#define NOP_INSN "nop"
++#define B_INSN "b"
+ #endif
+
+ static __always_inline bool arch_static_branch(struct static_key *key, bool branch)
+ {
+- asm_volatile_goto("1:\t" NOP_INSN "\n\t"
+- "nop\n\t"
++ asm_volatile_goto("1:\t" B_INSN " 2f\n\t"
++ "2:\tnop\n\t"
+ ".pushsection __jump_table, \"aw\"\n\t"
+ WORD_INSN " 1b, %l[l_yes], %0\n\t"
+ ".popsection\n\t"
+diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
+index 971a504001c2..36f2e860ba3e 100644
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -140,6 +140,13 @@ SECTIONS
+ PERCPU_SECTION(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
+ #endif
+
++#ifdef CONFIG_MIPS_ELF_APPENDED_DTB
++ .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) {
++ *(.appended_dtb)
++ KEEP(*(.appended_dtb))
++ }
++#endif
++
+ #ifdef CONFIG_RELOCATABLE
+ . = ALIGN(4);
+
+@@ -164,11 +171,6 @@ SECTIONS
+ __appended_dtb = .;
+ /* leave space for appended DTB */
+ . += 0x100000;
+-#elif defined(CONFIG_MIPS_ELF_APPENDED_DTB)
+- .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) {
+- *(.appended_dtb)
+- KEEP(*(.appended_dtb))
+- }
+ #endif
+ /*
+ * Align to 64K in attempt to eliminate holes before the
+diff --git a/arch/mips/loongson64/lemote-2f/irq.c b/arch/mips/loongson64/lemote-2f/irq.c
+index 9e33e45aa17c..b213cecb8e3a 100644
+--- a/arch/mips/loongson64/lemote-2f/irq.c
++++ b/arch/mips/loongson64/lemote-2f/irq.c
+@@ -103,7 +103,7 @@ static struct irqaction ip6_irqaction = {
+ static struct irqaction cascade_irqaction = {
+ .handler = no_action,
+ .name = "cascade",
+- .flags = IRQF_NO_THREAD,
++ .flags = IRQF_NO_THREAD | IRQF_NO_SUSPEND,
+ };
+
+ void __init mach_init_irq(void)
+diff --git a/arch/powerpc/include/asm/vdso_datapage.h b/arch/powerpc/include/asm/vdso_datapage.h
+index 1afe90ade595..bbc06bd72b1f 100644
+--- a/arch/powerpc/include/asm/vdso_datapage.h
++++ b/arch/powerpc/include/asm/vdso_datapage.h
+@@ -82,10 +82,10 @@ struct vdso_data {
+ __u32 icache_block_size; /* L1 i-cache block size */
+ __u32 dcache_log_block_size; /* L1 d-cache log block size */
+ __u32 icache_log_block_size; /* L1 i-cache log block size */
+- __s32 wtom_clock_sec; /* Wall to monotonic clock */
+- __s32 wtom_clock_nsec;
+- struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */
+- __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */
++ __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */
++ __s32 wtom_clock_nsec; /* Wall to monotonic clock nsec */
++ __s64 wtom_clock_sec; /* Wall to monotonic clock sec */
++ struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */
+ __u32 syscall_map_64[SYSCALL_MAP_SIZE]; /* map of syscalls */
+ __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */
+ };
+diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
+index c002adcc694c..afbad2ac3147 100644
+--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
+@@ -92,7 +92,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ * At this point, r4,r5 contain our sec/nsec values.
+ */
+
+- lwa r6,WTOM_CLOCK_SEC(r3)
++ ld r6,WTOM_CLOCK_SEC(r3)
+ lwa r9,WTOM_CLOCK_NSEC(r3)
+
+ /* We now have our result in r6,r9. We create a fake dependency
+@@ -125,7 +125,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ bne cr6,75f
+
+ /* CLOCK_MONOTONIC_COARSE */
+- lwa r6,WTOM_CLOCK_SEC(r3)
++ ld r6,WTOM_CLOCK_SEC(r3)
+ lwa r9,WTOM_CLOCK_NSEC(r3)
+
+ /* check if counter has updated */
+diff --git a/arch/x86/include/asm/unwind.h b/arch/x86/include/asm/unwind.h
+index 1f86e1b0a5cd..499578f7e6d7 100644
+--- a/arch/x86/include/asm/unwind.h
++++ b/arch/x86/include/asm/unwind.h
+@@ -23,6 +23,12 @@ struct unwind_state {
+ #elif defined(CONFIG_UNWINDER_FRAME_POINTER)
+ bool got_irq;
+ unsigned long *bp, *orig_sp, ip;
++ /*
++ * If non-NULL: The current frame is incomplete and doesn't contain a
++ * valid BP. When looking for the next frame, use this instead of the
++ * non-existent saved BP.
++ */
++ unsigned long *next_bp;
+ struct pt_regs *regs;
+ #else
+ unsigned long *sp;
+diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
+index 3dc26f95d46e..9b9fd4826e7a 100644
+--- a/arch/x86/kernel/unwind_frame.c
++++ b/arch/x86/kernel/unwind_frame.c
+@@ -320,10 +320,14 @@ bool unwind_next_frame(struct unwind_state *state)
+ }
+
+ /* Get the next frame pointer: */
+- if (state->regs)
++ if (state->next_bp) {
++ next_bp = state->next_bp;
++ state->next_bp = NULL;
++ } else if (state->regs) {
+ next_bp = (unsigned long *)state->regs->bp;
+- else
++ } else {
+ next_bp = (unsigned long *)READ_ONCE_TASK_STACK(state->task, *state->bp);
++ }
+
+ /* Move to the next frame if it's safe: */
+ if (!update_stack_state(state, next_bp))
+@@ -398,6 +402,21 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+
+ bp = get_frame_pointer(task, regs);
+
++ /*
++ * If we crash with IP==0, the last successfully executed instruction
++ * was probably an indirect function call with a NULL function pointer.
++ * That means that SP points into the middle of an incomplete frame:
++ * *SP is a return pointer, and *(SP-sizeof(unsigned long)) is where we
++ * would have written a frame pointer if we hadn't crashed.
++ * Pretend that the frame is complete and that BP points to it, but save
++ * the real BP so that we can use it when looking for the next frame.
++ */
++ if (regs && regs->ip == 0 &&
++ (unsigned long *)kernel_stack_pointer(regs) >= first_frame) {
++ state->next_bp = bp;
++ bp = ((unsigned long *)kernel_stack_pointer(regs)) - 1;
++ }
++
+ /* Initialize stack info and make sure the frame data is accessible: */
+ get_stack_info(bp, state->task, &state->stack_info,
+ &state->stack_mask);
+@@ -410,7 +429,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ */
+ while (!unwind_done(state) &&
+ (!on_stack(&state->stack_info, first_frame, sizeof(long)) ||
+- state->bp < first_frame))
++ (state->next_bp == NULL && state->bp < first_frame)))
+ unwind_next_frame(state);
+ }
+ EXPORT_SYMBOL_GPL(__unwind_start);
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 26038eacf74a..89be1be1790c 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -113,6 +113,20 @@ static struct orc_entry *orc_ftrace_find(unsigned long ip)
+ }
+ #endif
+
++/*
++ * If we crash with IP==0, the last successfully executed instruction
++ * was probably an indirect function call with a NULL function pointer,
++ * and we don't have unwind information for NULL.
++ * This hardcoded ORC entry for IP==0 allows us to unwind from a NULL function
++ * pointer into its parent and then continue normally from there.
++ */
++static struct orc_entry null_orc_entry = {
++ .sp_offset = sizeof(long),
++ .sp_reg = ORC_REG_SP,
++ .bp_reg = ORC_REG_UNDEFINED,
++ .type = ORC_TYPE_CALL
++};
++
+ static struct orc_entry *orc_find(unsigned long ip)
+ {
+ static struct orc_entry *orc;
+@@ -120,6 +134,9 @@ static struct orc_entry *orc_find(unsigned long ip)
+ if (!orc_init)
+ return NULL;
+
++ if (ip == 0)
++ return &null_orc_entry;
++
+ /* For non-init vmlinux addresses, use the fast lookup table: */
+ if (ip >= LOOKUP_START_IP && ip < LOOKUP_STOP_IP) {
+ unsigned int idx, start, stop;
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index c9c2bcc36e26..0c5aeab4d23a 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -657,7 +657,7 @@ static int loop_validate_file(struct file *file, struct block_device *bdev)
+ return -EBADF;
+
+ l = f->f_mapping->host->i_bdev->bd_disk->private_data;
+- if (l->lo_state == Lo_unbound) {
++ if (l->lo_state != Lo_bound) {
+ return -EINVAL;
+ }
+ f = l->lo_backing_file;
+diff --git a/drivers/bluetooth/h4_recv.h b/drivers/bluetooth/h4_recv.h
+index b432651f8236..307d82166f48 100644
+--- a/drivers/bluetooth/h4_recv.h
++++ b/drivers/bluetooth/h4_recv.h
+@@ -60,6 +60,10 @@ static inline struct sk_buff *h4_recv_buf(struct hci_dev *hdev,
+ const struct h4_recv_pkt *pkts,
+ int pkts_count)
+ {
++ /* Check for error from previous call */
++ if (IS_ERR(skb))
++ skb = NULL;
++
+ while (count) {
+ int i, len;
+
+diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c
+index fb97a3bf069b..5d97d77627c1 100644
+--- a/drivers/bluetooth/hci_h4.c
++++ b/drivers/bluetooth/hci_h4.c
+@@ -174,6 +174,10 @@ struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb,
+ struct hci_uart *hu = hci_get_drvdata(hdev);
+ u8 alignment = hu->alignment ? hu->alignment : 1;
+
++ /* Check for error from previous call */
++ if (IS_ERR(skb))
++ skb = NULL;
++
+ while (count) {
+ int i, len;
+
+diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
+index ea6238ed5c0e..c915daf01a89 100644
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -207,11 +207,11 @@ void hci_uart_init_work(struct work_struct *work)
+ err = hci_register_dev(hu->hdev);
+ if (err < 0) {
+ BT_ERR("Can't register HCI device");
++ clear_bit(HCI_UART_PROTO_READY, &hu->flags);
++ hu->proto->close(hu);
+ hdev = hu->hdev;
+ hu->hdev = NULL;
+ hci_free_dev(hdev);
+- clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+- hu->proto->close(hu);
+ return;
+ }
+
+@@ -616,6 +616,7 @@ static void hci_uart_tty_receive(struct tty_struct *tty, const u8 *data,
+ static int hci_uart_register_dev(struct hci_uart *hu)
+ {
+ struct hci_dev *hdev;
++ int err;
+
+ BT_DBG("");
+
+@@ -659,11 +660,22 @@ static int hci_uart_register_dev(struct hci_uart *hu)
+ else
+ hdev->dev_type = HCI_PRIMARY;
+
++ /* Only call open() for the protocol after hdev is fully initialized as
++ * open() (or a timer/workqueue it starts) may attempt to reference it.
++ */
++ err = hu->proto->open(hu);
++ if (err) {
++ hu->hdev = NULL;
++ hci_free_dev(hdev);
++ return err;
++ }
++
+ if (test_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags))
+ return 0;
+
+ if (hci_register_dev(hdev) < 0) {
+ BT_ERR("Can't register HCI device");
++ hu->proto->close(hu);
+ hu->hdev = NULL;
+ hci_free_dev(hdev);
+ return -ENODEV;
+@@ -683,20 +695,14 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id)
+ if (!p)
+ return -EPROTONOSUPPORT;
+
+- err = p->open(hu);
+- if (err)
+- return err;
+-
+ hu->proto = p;
+- set_bit(HCI_UART_PROTO_READY, &hu->flags);
+
+ err = hci_uart_register_dev(hu);
+ if (err) {
+- clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+- p->close(hu);
+ return err;
+ }
+
++ set_bit(HCI_UART_PROTO_READY, &hu->flags);
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c
+index fcb0ab0abb75..57cc9aa6683a 100644
+--- a/drivers/gpu/drm/drm_mode_object.c
++++ b/drivers/gpu/drm/drm_mode_object.c
+@@ -458,12 +458,13 @@ static int set_property_atomic(struct drm_mode_object *obj,
+ struct drm_modeset_acquire_ctx ctx;
+ int ret;
+
+- drm_modeset_acquire_init(&ctx, 0);
+-
+ state = drm_atomic_state_alloc(dev);
+ if (!state)
+ return -ENOMEM;
++
++ drm_modeset_acquire_init(&ctx, 0);
+ state->acquire_ctx = &ctx;
++
+ retry:
+ if (prop == state->dev->mode_config.dpms_property) {
+ if (obj->type != DRM_MODE_OBJECT_CONNECTOR) {
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+index b913a56f3426..2a9112515f46 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -564,11 +564,9 @@ static int vmw_fb_set_par(struct fb_info *info)
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
+ };
+- struct drm_display_mode *old_mode;
+ struct drm_display_mode *mode;
+ int ret;
+
+- old_mode = par->set_mode;
+ mode = drm_mode_duplicate(vmw_priv->dev, &new_mode);
+ if (!mode) {
+ DRM_ERROR("Could not create new fb mode.\n");
+@@ -579,11 +577,7 @@ static int vmw_fb_set_par(struct fb_info *info)
+ mode->vdisplay = var->yres;
+ vmw_guess_mode_timing(mode);
+
+- if (old_mode && drm_mode_equal(old_mode, mode)) {
+- drm_mode_destroy(vmw_priv->dev, mode);
+- mode = old_mode;
+- old_mode = NULL;
+- } else if (!vmw_kms_validate_mode_vram(vmw_priv,
++ if (!vmw_kms_validate_mode_vram(vmw_priv,
+ mode->hdisplay *
+ DIV_ROUND_UP(var->bits_per_pixel, 8),
+ mode->vdisplay)) {
+@@ -620,8 +614,8 @@ static int vmw_fb_set_par(struct fb_info *info)
+ schedule_delayed_work(&par->local_work, 0);
+
+ out_unlock:
+- if (old_mode)
+- drm_mode_destroy(vmw_priv->dev, old_mode);
++ if (par->set_mode)
++ drm_mode_destroy(vmw_priv->dev, par->set_mode);
+ par->set_mode = mode;
+
+ mutex_unlock(&par->bo_mutex);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+index b93c558dd86e..7da752ca1c34 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+@@ -57,7 +57,7 @@ static int vmw_gmrid_man_get_node(struct ttm_mem_type_manager *man,
+
+ id = ida_alloc_max(&gman->gmr_ida, gman->max_gmr_ids - 1, GFP_KERNEL);
+ if (id < 0)
+- return id;
++ return (id != -ENOMEM ? 0 : id);
+
+ spin_lock(&gman->lock);
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index a36c94930c31..6f5be7802476 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2854,13 +2854,22 @@ static void addr_handler(int status, struct sockaddr *src_addr,
+ {
+ struct rdma_id_private *id_priv = context;
+ struct rdma_cm_event event = {};
++ struct sockaddr *addr;
++ struct sockaddr_storage old_addr;
+
+ mutex_lock(&id_priv->handler_mutex);
+ if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_QUERY,
+ RDMA_CM_ADDR_RESOLVED))
+ goto out;
+
+- memcpy(cma_src_addr(id_priv), src_addr, rdma_addr_size(src_addr));
++ /*
++ * Store the previous src address, so that if we fail to acquire
++ * matching rdma device, old address can be restored back, which helps
++ * to cancel the cma listen operation correctly.
++ */
++ addr = cma_src_addr(id_priv);
++ memcpy(&old_addr, addr, rdma_addr_size(addr));
++ memcpy(addr, src_addr, rdma_addr_size(src_addr));
+ if (!status && !id_priv->cma_dev) {
+ status = cma_acquire_dev(id_priv, NULL);
+ if (status)
+@@ -2871,6 +2880,8 @@ static void addr_handler(int status, struct sockaddr *src_addr,
+ }
+
+ if (status) {
++ memcpy(addr, &old_addr,
++ rdma_addr_size((struct sockaddr *)&old_addr));
+ if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_RESOLVED,
+ RDMA_CM_ADDR_BOUND))
+ goto out;
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 27500abe8ca7..0b3877681e4a 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2543,7 +2543,12 @@ static int map_sg(struct device *dev, struct scatterlist *sglist,
+
+ /* Everything is mapped - write the right values into s->dma_address */
+ for_each_sg(sglist, s, nelems, i) {
+- s->dma_address += address + s->offset;
++ /*
++ * Add in the remaining piece of the scatter-gather offset that
++ * was masked out when we were determining the physical address
++ * via (sg_phys(s) & PAGE_MASK) earlier.
++ */
++ s->dma_address += address + (s->offset & ~PAGE_MASK);
+ s->dma_length = s->length;
+ }
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 78970cdf2ef6..65ab2c80529c 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -1477,7 +1477,7 @@ static int lpi_range_cmp(void *priv, struct list_head *a, struct list_head *b)
+ ra = container_of(a, struct lpi_range, entry);
+ rb = container_of(b, struct lpi_range, entry);
+
+- return rb->base_id - ra->base_id;
++ return ra->base_id - rb->base_id;
+ }
+
+ static void merge_lpi_ranges(void)
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
+index c2ad102bd693..467b1ddaf4e7 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -1212,7 +1212,7 @@ static void uvc_ctrl_fill_event(struct uvc_video_chain *chain,
+
+ __uvc_query_v4l2_ctrl(chain, ctrl, mapping, &v4l2_ctrl);
+
+- memset(ev->reserved, 0, sizeof(ev->reserved));
++ memset(ev, 0, sizeof(*ev));
+ ev->type = V4L2_EVENT_CTRL;
+ ev->id = v4l2_ctrl.id;
+ ev->u.ctrl.value = value;
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
+index 599c1cbff3b9..6ac5f5d42615 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -1379,7 +1379,7 @@ static u32 user_flags(const struct v4l2_ctrl *ctrl)
+
+ static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 changes)
+ {
+- memset(ev->reserved, 0, sizeof(ev->reserved));
++ memset(ev, 0, sizeof(*ev));
+ ev->type = V4L2_EVENT_CTRL;
+ ev->id = ctrl->id;
+ ev->u.ctrl.changes = changes;
+diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
+index de4e6e5bf304..2f604b312767 100644
+--- a/drivers/mmc/host/mxcmmc.c
++++ b/drivers/mmc/host/mxcmmc.c
+@@ -292,11 +292,8 @@ static void mxcmci_swap_buffers(struct mmc_data *data)
+ struct scatterlist *sg;
+ int i;
+
+- for_each_sg(data->sg, sg, data->sg_len, i) {
+- void *buf = kmap_atomic(sg_page(sg) + sg->offset);
+- buffer_swap32(buf, sg->length);
+- kunmap_atomic(buf);
+- }
++ for_each_sg(data->sg, sg, data->sg_len, i)
++ buffer_swap32(sg_virt(sg), sg->length);
+ }
+ #else
+ static inline void mxcmci_swap_buffers(struct mmc_data *data) {}
+@@ -613,7 +610,6 @@ static int mxcmci_transfer_data(struct mxcmci_host *host)
+ {
+ struct mmc_data *data = host->req->data;
+ struct scatterlist *sg;
+- void *buf;
+ int stat, i;
+
+ host->data = data;
+@@ -621,18 +617,14 @@ static int mxcmci_transfer_data(struct mxcmci_host *host)
+
+ if (data->flags & MMC_DATA_READ) {
+ for_each_sg(data->sg, sg, data->sg_len, i) {
+- buf = kmap_atomic(sg_page(sg) + sg->offset);
+- stat = mxcmci_pull(host, buf, sg->length);
+- kunmap(buf);
++ stat = mxcmci_pull(host, sg_virt(sg), sg->length);
+ if (stat)
+ return stat;
+ host->datasize += sg->length;
+ }
+ } else {
+ for_each_sg(data->sg, sg, data->sg_len, i) {
+- buf = kmap_atomic(sg_page(sg) + sg->offset);
+- stat = mxcmci_push(host, buf, sg->length);
+- kunmap(buf);
++ stat = mxcmci_push(host, sg_virt(sg), sg->length);
+ if (stat)
+ return stat;
+ host->datasize += sg->length;
+diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
+index f7ffbf1676b1..00b5465dfb0c 100644
+--- a/drivers/mmc/host/pxamci.c
++++ b/drivers/mmc/host/pxamci.c
+@@ -164,7 +164,7 @@ static void pxamci_dma_irq(void *param);
+ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
+ {
+ struct dma_async_tx_descriptor *tx;
+- enum dma_data_direction direction;
++ enum dma_transfer_direction direction;
+ struct dma_slave_config config;
+ struct dma_chan *chan;
+ unsigned int nob = data->blocks;
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 777e32b0e410..45baf5d9120e 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -557,6 +557,7 @@ int renesas_sdhi_probe(struct platform_device *pdev,
+ struct renesas_sdhi *priv;
+ struct resource *res;
+ int irq, ret, i;
++ u16 ver;
+
+ of_data = of_device_get_match_data(&pdev->dev);
+
+@@ -671,12 +672,17 @@ int renesas_sdhi_probe(struct platform_device *pdev,
+ if (ret)
+ goto efree;
+
++ ver = sd_ctrl_read16(host, CTL_VERSION);
++ /* GEN2_SDR104 is first known SDHI to use 32bit block count */
++ if (ver < SDHI_VER_GEN2_SDR104 && mmc_data->max_blk_count > U16_MAX)
++ mmc_data->max_blk_count = U16_MAX;
++
+ ret = tmio_mmc_host_probe(host);
+ if (ret < 0)
+ goto edisclk;
+
+ /* One Gen2 SDHI incarnation does NOT have a CBSY bit */
+- if (sd_ctrl_read16(host, CTL_VERSION) == SDHI_VER_GEN2_SDR50)
++ if (ver == SDHI_VER_GEN2_SDR50)
+ mmc_data->flags &= ~TMIO_MMC_HAVE_CBSY;
+
+ /* Enable tuning iff we have an SCC and a supported mode */
+diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c
+index faa1a67cf3d2..7ae983e37f64 100644
+--- a/drivers/power/supply/charger-manager.c
++++ b/drivers/power/supply/charger-manager.c
+@@ -1212,7 +1212,6 @@ static int charger_extcon_init(struct charger_manager *cm,
+ if (ret < 0) {
+ pr_info("Cannot register extcon_dev for %s(cable: %s)\n",
+ cable->extcon_name, cable->name);
+- ret = -EINVAL;
+ }
+
+ return ret;
+@@ -1633,7 +1632,7 @@ static int charger_manager_probe(struct platform_device *pdev)
+
+ if (IS_ERR(desc)) {
+ dev_err(&pdev->dev, "No platform data (desc) found\n");
+- return -ENODEV;
++ return PTR_ERR(desc);
+ }
+
+ cm = devm_kzalloc(&pdev->dev, sizeof(*cm), GFP_KERNEL);
+diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
+index 9df8a1a2299c..e60822f07653 100644
+--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
+@@ -96,6 +96,7 @@ static int client_reserve = 1;
+ static char partition_name[96] = "UNKNOWN";
+ static unsigned int partition_number = -1;
+ static LIST_HEAD(ibmvscsi_head);
++static DEFINE_SPINLOCK(ibmvscsi_driver_lock);
+
+ static struct scsi_transport_template *ibmvscsi_transport_template;
+
+@@ -2271,7 +2272,9 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+ }
+
+ dev_set_drvdata(&vdev->dev, hostdata);
++ spin_lock(&ibmvscsi_driver_lock);
+ list_add_tail(&hostdata->host_list, &ibmvscsi_head);
++ spin_unlock(&ibmvscsi_driver_lock);
+ return 0;
+
+ add_srp_port_failed:
+@@ -2293,15 +2296,27 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+ static int ibmvscsi_remove(struct vio_dev *vdev)
+ {
+ struct ibmvscsi_host_data *hostdata = dev_get_drvdata(&vdev->dev);
+- list_del(&hostdata->host_list);
+- unmap_persist_bufs(hostdata);
++ unsigned long flags;
++
++ srp_remove_host(hostdata->host);
++ scsi_remove_host(hostdata->host);
++
++ purge_requests(hostdata, DID_ERROR);
++
++ spin_lock_irqsave(hostdata->host->host_lock, flags);
+ release_event_pool(&hostdata->pool, hostdata);
++ spin_unlock_irqrestore(hostdata->host->host_lock, flags);
++
+ ibmvscsi_release_crq_queue(&hostdata->queue, hostdata,
+ max_events);
+
+ kthread_stop(hostdata->work_thread);
+- srp_remove_host(hostdata->host);
+- scsi_remove_host(hostdata->host);
++ unmap_persist_bufs(hostdata);
++
++ spin_lock(&ibmvscsi_driver_lock);
++ list_del(&hostdata->host_list);
++ spin_unlock(&ibmvscsi_driver_lock);
++
+ scsi_host_put(hostdata->host);
+
+ return 0;
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index a2d701775c49..3d0db37d64ad 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -1500,9 +1500,16 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
+ iov[1].iov_base = unc_path;
+ iov[1].iov_len = unc_path_len;
+
+- /* 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 */
++ /*
++ * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1
++ * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1
++ * (Samba servers don't always set the flag so also check if null user)
++ */
+ if ((ses->server->dialect == SMB311_PROT_ID) &&
+- !smb3_encryption_required(tcon))
++ !smb3_encryption_required(tcon) &&
++ !(ses->session_flags &
++ (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) &&
++ ((ses->user_name != NULL) || (ses->sectype == Kerberos)))
+ req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
+
+ memset(&rqst, 0, sizeof(struct smb_rqst));
+diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
+index 15b6dd733780..df908ef79cce 100644
+--- a/fs/ext4/ext4_jbd2.h
++++ b/fs/ext4/ext4_jbd2.h
+@@ -384,7 +384,7 @@ static inline void ext4_update_inode_fsync_trans(handle_t *handle,
+ {
+ struct ext4_inode_info *ei = EXT4_I(inode);
+
+- if (ext4_handle_valid(handle)) {
++ if (ext4_handle_valid(handle) && !is_handle_aborted(handle)) {
+ ei->i_sync_tid = handle->h_transaction->t_tid;
+ if (datasync)
+ ei->i_datasync_tid = handle->h_transaction->t_tid;
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 69d65d49837b..98ec11f69cd4 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -125,7 +125,7 @@ ext4_unaligned_aio(struct inode *inode, struct iov_iter *from, loff_t pos)
+ struct super_block *sb = inode->i_sb;
+ int blockmask = sb->s_blocksize - 1;
+
+- if (pos >= i_size_read(inode))
++ if (pos >= ALIGN(i_size_read(inode), sb->s_blocksize))
+ return 0;
+
+ if ((pos | iov_iter_alignment(from)) & blockmask)
+diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
+index bf7fa1507e81..9e96a0bd08d9 100644
+--- a/fs/ext4/indirect.c
++++ b/fs/ext4/indirect.c
+@@ -1387,10 +1387,14 @@ end_range:
+ partial->p + 1,
+ partial2->p,
+ (chain+n-1) - partial);
+- BUFFER_TRACE(partial->bh, "call brelse");
+- brelse(partial->bh);
+- BUFFER_TRACE(partial2->bh, "call brelse");
+- brelse(partial2->bh);
++ while (partial > chain) {
++ BUFFER_TRACE(partial->bh, "call brelse");
++ brelse(partial->bh);
++ }
++ while (partial2 > chain2) {
++ BUFFER_TRACE(partial2->bh, "call brelse");
++ brelse(partial2->bh);
++ }
+ return 0;
+ }
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 30779aaa9dba..1fa6f8185766 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -216,7 +216,8 @@ void f2fs_register_inmem_page(struct inode *inode, struct page *page)
+ }
+
+ static int __revoke_inmem_pages(struct inode *inode,
+- struct list_head *head, bool drop, bool recover)
++ struct list_head *head, bool drop, bool recover,
++ bool trylock)
+ {
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct inmem_pages *cur, *tmp;
+@@ -228,7 +229,16 @@ static int __revoke_inmem_pages(struct inode *inode,
+ if (drop)
+ trace_f2fs_commit_inmem_page(page, INMEM_DROP);
+
+- lock_page(page);
++ if (trylock) {
++ /*
++ * to avoid deadlock in between page lock and
++ * inmem_lock.
++ */
++ if (!trylock_page(page))
++ continue;
++ } else {
++ lock_page(page);
++ }
+
+ f2fs_wait_on_page_writeback(page, DATA, true);
+
+@@ -317,13 +327,19 @@ void f2fs_drop_inmem_pages(struct inode *inode)
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct f2fs_inode_info *fi = F2FS_I(inode);
+
+- mutex_lock(&fi->inmem_lock);
+- __revoke_inmem_pages(inode, &fi->inmem_pages, true, false);
+- spin_lock(&sbi->inode_lock[ATOMIC_FILE]);
+- if (!list_empty(&fi->inmem_ilist))
+- list_del_init(&fi->inmem_ilist);
+- spin_unlock(&sbi->inode_lock[ATOMIC_FILE]);
+- mutex_unlock(&fi->inmem_lock);
++ while (!list_empty(&fi->inmem_pages)) {
++ mutex_lock(&fi->inmem_lock);
++ __revoke_inmem_pages(inode, &fi->inmem_pages,
++ true, false, true);
++
++ if (list_empty(&fi->inmem_pages)) {
++ spin_lock(&sbi->inode_lock[ATOMIC_FILE]);
++ if (!list_empty(&fi->inmem_ilist))
++ list_del_init(&fi->inmem_ilist);
++ spin_unlock(&sbi->inode_lock[ATOMIC_FILE]);
++ }
++ mutex_unlock(&fi->inmem_lock);
++ }
+
+ clear_inode_flag(inode, FI_ATOMIC_FILE);
+ fi->i_gc_failures[GC_FAILURE_ATOMIC] = 0;
+@@ -427,12 +443,15 @@ retry:
+ * recovery or rewrite & commit last transaction. For other
+ * error number, revoking was done by filesystem itself.
+ */
+- err = __revoke_inmem_pages(inode, &revoke_list, false, true);
++ err = __revoke_inmem_pages(inode, &revoke_list,
++ false, true, false);
+
+ /* drop all uncommitted pages */
+- __revoke_inmem_pages(inode, &fi->inmem_pages, true, false);
++ __revoke_inmem_pages(inode, &fi->inmem_pages,
++ true, false, false);
+ } else {
+- __revoke_inmem_pages(inode, &revoke_list, false, false);
++ __revoke_inmem_pages(inode, &revoke_list,
++ false, false, false);
+ }
+
+ return err;
+diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c
+index b647f0bd150c..94220ba85628 100644
+--- a/fs/udf/truncate.c
++++ b/fs/udf/truncate.c
+@@ -260,6 +260,9 @@ void udf_truncate_extents(struct inode *inode)
+ epos.block = eloc;
+ epos.bh = udf_tread(sb,
+ udf_get_lb_pblock(sb, &eloc, 0));
++ /* Error reading indirect block? */
++ if (!epos.bh)
++ return;
+ if (elen)
+ indirect_ext_len =
+ (elen + sb->s_blocksize - 1) >>
+diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h
+index 68bb09c29ce8..0b589e684554 100644
+--- a/include/linux/ceph/libceph.h
++++ b/include/linux/ceph/libceph.h
+@@ -292,6 +292,8 @@ extern void ceph_destroy_client(struct ceph_client *client);
+ extern int __ceph_open_session(struct ceph_client *client,
+ unsigned long started);
+ extern int ceph_open_session(struct ceph_client *client);
++int ceph_wait_for_latest_osdmap(struct ceph_client *client,
++ unsigned long timeout);
+
+ /* pagevec.c */
+ extern void ceph_release_page_vector(struct page **pages, int num_pages);
+diff --git a/kernel/futex.c b/kernel/futex.c
+index c5fca746edc4..5a26d843a015 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -3432,6 +3432,10 @@ int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi)
+ {
+ u32 uval, uninitialized_var(nval), mval;
+
++ /* Futex address must be 32bit aligned */
++ if ((((unsigned long)uaddr) % sizeof(*uaddr)) != 0)
++ return -1;
++
+ retry:
+ if (get_user(uval, uaddr))
+ return -1;
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 26b57e24476f..0cbdbbb0729f 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -3567,6 +3567,9 @@ __lock_set_class(struct lockdep_map *lock, const char *name,
+ unsigned int depth;
+ int i;
+
++ if (unlikely(!debug_locks))
++ return 0;
++
+ depth = curr->lockdep_depth;
+ /*
+ * This function is about (re)setting the class of a held lock,
+diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
+index 1506e1632394..d4e2a166ae17 100644
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -831,8 +831,6 @@ static int hci_sock_release(struct socket *sock)
+ if (!sk)
+ return 0;
+
+- hdev = hci_pi(sk)->hdev;
+-
+ switch (hci_pi(sk)->channel) {
+ case HCI_CHANNEL_MONITOR:
+ atomic_dec(&monitor_promisc);
+@@ -854,6 +852,7 @@ static int hci_sock_release(struct socket *sock)
+
+ bt_sock_unlink(&hci_sk_list, sk);
+
++ hdev = hci_pi(sk)->hdev;
+ if (hdev) {
+ if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
+ /* When releasing a user channel exclusive access,
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 6693e209efe8..f77888ec93f1 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -31,10 +31,6 @@
+ /* needed for logical [in,out]-dev filtering */
+ #include "../br_private.h"
+
+-#define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
+- "report to author: "format, ## args)
+-/* #define BUGPRINT(format, args...) */
+-
+ /* Each cpu has its own set of counters, so there is no need for write_lock in
+ * the softirq
+ * For reading or updating the counters, the user context needs to
+@@ -466,8 +462,6 @@ static int ebt_verify_pointers(const struct ebt_replace *repl,
+ /* we make userspace set this right,
+ * so there is no misunderstanding
+ */
+- BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
+- "in distinguisher\n");
+ return -EINVAL;
+ }
+ if (i != NF_BR_NUMHOOKS)
+@@ -485,18 +479,14 @@ static int ebt_verify_pointers(const struct ebt_replace *repl,
+ offset += e->next_offset;
+ }
+ }
+- if (offset != limit) {
+- BUGPRINT("entries_size too small\n");
++ if (offset != limit)
+ return -EINVAL;
+- }
+
+ /* check if all valid hooks have a chain */
+ for (i = 0; i < NF_BR_NUMHOOKS; i++) {
+ if (!newinfo->hook_entry[i] &&
+- (valid_hooks & (1 << i))) {
+- BUGPRINT("Valid hook without chain\n");
++ (valid_hooks & (1 << i)))
+ return -EINVAL;
+- }
+ }
+ return 0;
+ }
+@@ -523,26 +513,20 @@ ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
+ /* this checks if the previous chain has as many entries
+ * as it said it has
+ */
+- if (*n != *cnt) {
+- BUGPRINT("nentries does not equal the nr of entries "
+- "in the chain\n");
++ if (*n != *cnt)
+ return -EINVAL;
+- }
++
+ if (((struct ebt_entries *)e)->policy != EBT_DROP &&
+ ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
+ /* only RETURN from udc */
+ if (i != NF_BR_NUMHOOKS ||
+- ((struct ebt_entries *)e)->policy != EBT_RETURN) {
+- BUGPRINT("bad policy\n");
++ ((struct ebt_entries *)e)->policy != EBT_RETURN)
+ return -EINVAL;
+- }
+ }
+ if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
+ (*udc_cnt)++;
+- if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
+- BUGPRINT("counter_offset != totalcnt");
++ if (((struct ebt_entries *)e)->counter_offset != *totalcnt)
+ return -EINVAL;
+- }
+ *n = ((struct ebt_entries *)e)->nentries;
+ *cnt = 0;
+ return 0;
+@@ -550,15 +534,13 @@ ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
+ /* a plain old entry, heh */
+ if (sizeof(struct ebt_entry) > e->watchers_offset ||
+ e->watchers_offset > e->target_offset ||
+- e->target_offset >= e->next_offset) {
+- BUGPRINT("entry offsets not in right order\n");
++ e->target_offset >= e->next_offset)
+ return -EINVAL;
+- }
++
+ /* this is not checked anywhere else */
+- if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
+- BUGPRINT("target size too small\n");
++ if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target))
+ return -EINVAL;
+- }
++
+ (*cnt)++;
+ (*totalcnt)++;
+ return 0;
+@@ -678,18 +660,15 @@ ebt_check_entry(struct ebt_entry *e, struct net *net,
+ if (e->bitmask == 0)
+ return 0;
+
+- if (e->bitmask & ~EBT_F_MASK) {
+- BUGPRINT("Unknown flag for bitmask\n");
++ if (e->bitmask & ~EBT_F_MASK)
+ return -EINVAL;
+- }
+- if (e->invflags & ~EBT_INV_MASK) {
+- BUGPRINT("Unknown flag for inv bitmask\n");
++
++ if (e->invflags & ~EBT_INV_MASK)
+ return -EINVAL;
+- }
+- if ((e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3)) {
+- BUGPRINT("NOPROTO & 802_3 not allowed\n");
++
++ if ((e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3))
+ return -EINVAL;
+- }
++
+ /* what hook do we belong to? */
+ for (i = 0; i < NF_BR_NUMHOOKS; i++) {
+ if (!newinfo->hook_entry[i])
+@@ -748,13 +727,11 @@ ebt_check_entry(struct ebt_entry *e, struct net *net,
+ t->u.target = target;
+ if (t->u.target == &ebt_standard_target) {
+ if (gap < sizeof(struct ebt_standard_target)) {
+- BUGPRINT("Standard target size too big\n");
+ ret = -EFAULT;
+ goto cleanup_watchers;
+ }
+ if (((struct ebt_standard_target *)t)->verdict <
+ -NUM_STANDARD_TARGETS) {
+- BUGPRINT("Invalid standard target\n");
+ ret = -EFAULT;
+ goto cleanup_watchers;
+ }
+@@ -813,10 +790,9 @@ static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack
+ if (strcmp(t->u.name, EBT_STANDARD_TARGET))
+ goto letscontinue;
+ if (e->target_offset + sizeof(struct ebt_standard_target) >
+- e->next_offset) {
+- BUGPRINT("Standard target size too big\n");
++ e->next_offset)
+ return -1;
+- }
++
+ verdict = ((struct ebt_standard_target *)t)->verdict;
+ if (verdict >= 0) { /* jump to another chain */
+ struct ebt_entries *hlp2 =
+@@ -825,14 +801,12 @@ static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack
+ if (hlp2 == cl_s[i].cs.chaininfo)
+ break;
+ /* bad destination or loop */
+- if (i == udc_cnt) {
+- BUGPRINT("bad destination\n");
++ if (i == udc_cnt)
+ return -1;
+- }
+- if (cl_s[i].cs.n) {
+- BUGPRINT("loop\n");
++
++ if (cl_s[i].cs.n)
+ return -1;
+- }
++
+ if (cl_s[i].hookmask & (1 << hooknr))
+ goto letscontinue;
+ /* this can't be 0, so the loop test is correct */
+@@ -865,24 +839,21 @@ static int translate_table(struct net *net, const char *name,
+ i = 0;
+ while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
+ i++;
+- if (i == NF_BR_NUMHOOKS) {
+- BUGPRINT("No valid hooks specified\n");
++ if (i == NF_BR_NUMHOOKS)
+ return -EINVAL;
+- }
+- if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
+- BUGPRINT("Chains don't start at beginning\n");
++
++ if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries)
+ return -EINVAL;
+- }
++
+ /* make sure chains are ordered after each other in same order
+ * as their corresponding hooks
+ */
+ for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
+ if (!newinfo->hook_entry[j])
+ continue;
+- if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
+- BUGPRINT("Hook order must be followed\n");
++ if (newinfo->hook_entry[j] <= newinfo->hook_entry[i])
+ return -EINVAL;
+- }
++
+ i = j;
+ }
+
+@@ -900,15 +871,11 @@ static int translate_table(struct net *net, const char *name,
+ if (ret != 0)
+ return ret;
+
+- if (i != j) {
+- BUGPRINT("nentries does not equal the nr of entries in the "
+- "(last) chain\n");
++ if (i != j)
+ return -EINVAL;
+- }
+- if (k != newinfo->nentries) {
+- BUGPRINT("Total nentries is wrong\n");
++
++ if (k != newinfo->nentries)
+ return -EINVAL;
+- }
+
+ /* get the location of the udc, put them in an array
+ * while we're at it, allocate the chainstack
+@@ -942,7 +909,6 @@ static int translate_table(struct net *net, const char *name,
+ ebt_get_udc_positions, newinfo, &i, cl_s);
+ /* sanity check */
+ if (i != udc_cnt) {
+- BUGPRINT("i != udc_cnt\n");
+ vfree(cl_s);
+ return -EFAULT;
+ }
+@@ -1042,7 +1008,6 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
+ goto free_unlock;
+
+ if (repl->num_counters && repl->num_counters != t->private->nentries) {
+- BUGPRINT("Wrong nr. of counters requested\n");
+ ret = -EINVAL;
+ goto free_unlock;
+ }
+@@ -1118,15 +1083,12 @@ static int do_replace(struct net *net, const void __user *user,
+ if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+ return -EFAULT;
+
+- if (len != sizeof(tmp) + tmp.entries_size) {
+- BUGPRINT("Wrong len argument\n");
++ if (len != sizeof(tmp) + tmp.entries_size)
+ return -EINVAL;
+- }
+
+- if (tmp.entries_size == 0) {
+- BUGPRINT("Entries_size never zero\n");
++ if (tmp.entries_size == 0)
+ return -EINVAL;
+- }
++
+ /* overflow check */
+ if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
+ NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
+@@ -1153,7 +1115,6 @@ static int do_replace(struct net *net, const void __user *user,
+ }
+ if (copy_from_user(
+ newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
+- BUGPRINT("Couldn't copy entries from userspace\n");
+ ret = -EFAULT;
+ goto free_entries;
+ }
+@@ -1194,10 +1155,8 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table,
+
+ if (input_table == NULL || (repl = input_table->table) == NULL ||
+ repl->entries == NULL || repl->entries_size == 0 ||
+- repl->counters != NULL || input_table->private != NULL) {
+- BUGPRINT("Bad table data for ebt_register_table!!!\n");
++ repl->counters != NULL || input_table->private != NULL)
+ return -EINVAL;
+- }
+
+ /* Don't add one table to multiple lists. */
+ table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
+@@ -1235,13 +1194,10 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table,
+ ((char *)repl->hook_entry[i] - repl->entries);
+ }
+ ret = translate_table(net, repl->name, newinfo);
+- if (ret != 0) {
+- BUGPRINT("Translate_table failed\n");
++ if (ret != 0)
+ goto free_chainstack;
+- }
+
+ if (table->check && table->check(newinfo, table->valid_hooks)) {
+- BUGPRINT("The table doesn't like its own initial data, lol\n");
+ ret = -EINVAL;
+ goto free_chainstack;
+ }
+@@ -1252,7 +1208,6 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table,
+ list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
+ if (strcmp(t->name, table->name) == 0) {
+ ret = -EEXIST;
+- BUGPRINT("Table name already exists\n");
+ goto free_unlock;
+ }
+ }
+@@ -1320,7 +1275,6 @@ static int do_update_counters(struct net *net, const char *name,
+ goto free_tmp;
+
+ if (num_counters != t->private->nentries) {
+- BUGPRINT("Wrong nr of counters\n");
+ ret = -EINVAL;
+ goto unlock_mutex;
+ }
+@@ -1447,10 +1401,8 @@ static int copy_counters_to_user(struct ebt_table *t,
+ if (num_counters == 0)
+ return 0;
+
+- if (num_counters != nentries) {
+- BUGPRINT("Num_counters wrong\n");
++ if (num_counters != nentries)
+ return -EINVAL;
+- }
+
+ counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp)));
+ if (!counterstmp)
+@@ -1496,15 +1448,11 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
+ (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0))
+ return -EINVAL;
+
+- if (tmp.nentries != nentries) {
+- BUGPRINT("Nentries wrong\n");
++ if (tmp.nentries != nentries)
+ return -EINVAL;
+- }
+
+- if (tmp.entries_size != entries_size) {
+- BUGPRINT("Wrong size\n");
++ if (tmp.entries_size != entries_size)
+ return -EINVAL;
+- }
+
+ ret = copy_counters_to_user(t, oldcounters, tmp.counters,
+ tmp.num_counters, nentries);
+@@ -1576,7 +1524,6 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
+ }
+ mutex_unlock(&ebt_mutex);
+ if (copy_to_user(user, &tmp, *len) != 0) {
+- BUGPRINT("c2u Didn't work\n");
+ ret = -EFAULT;
+ break;
+ }
+diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
+index 87afb9ec4c68..20f0c3d7ed50 100644
+--- a/net/ceph/ceph_common.c
++++ b/net/ceph/ceph_common.c
+@@ -729,7 +729,6 @@ int __ceph_open_session(struct ceph_client *client, unsigned long started)
+ }
+ EXPORT_SYMBOL(__ceph_open_session);
+
+-
+ int ceph_open_session(struct ceph_client *client)
+ {
+ int ret;
+@@ -745,6 +744,23 @@ int ceph_open_session(struct ceph_client *client)
+ }
+ EXPORT_SYMBOL(ceph_open_session);
+
++int ceph_wait_for_latest_osdmap(struct ceph_client *client,
++ unsigned long timeout)
++{
++ u64 newest_epoch;
++ int ret;
++
++ ret = ceph_monc_get_version(&client->monc, "osdmap", &newest_epoch);
++ if (ret)
++ return ret;
++
++ if (client->osdc.osdmap->epoch >= newest_epoch)
++ return 0;
++
++ ceph_osdc_maybe_request_map(&client->osdc);
++ return ceph_monc_wait_osdmap(&client->monc, newest_epoch, timeout);
++}
++EXPORT_SYMBOL(ceph_wait_for_latest_osdmap);
+
+ static int __init init_ceph_lib(void)
+ {
+diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
+index 18deb3d889c4..a53e4fbb6319 100644
+--- a/net/ceph/mon_client.c
++++ b/net/ceph/mon_client.c
+@@ -922,6 +922,15 @@ int ceph_monc_blacklist_add(struct ceph_mon_client *monc,
+ mutex_unlock(&monc->mutex);
+
+ ret = wait_generic_request(req);
++ if (!ret)
++ /*
++ * Make sure we have the osdmap that includes the blacklist
++ * entry. This is needed to ensure that the OSDs pick up the
++ * new blacklist before processing any future requests from
++ * this client.
++ */
++ ret = ceph_wait_for_latest_osdmap(monc->client, 0);
++
+ out:
+ put_generic_request(req);
+ return ret;
+diff --git a/sound/ac97/bus.c b/sound/ac97/bus.c
+index 9f0c480489ef..9cbf6927abe9 100644
+--- a/sound/ac97/bus.c
++++ b/sound/ac97/bus.c
+@@ -84,7 +84,7 @@ ac97_of_get_child_device(struct ac97_controller *ac97_ctrl, int idx,
+ if ((idx != of_property_read_u32(node, "reg", ®)) ||
+ !of_device_is_compatible(node, compat))
+ continue;
+- return of_node_get(node);
++ return node;
+ }
+
+ return NULL;
+diff --git a/sound/firewire/motu/motu.c b/sound/firewire/motu/motu.c
+index 300d31b6f191..743015e87a96 100644
+--- a/sound/firewire/motu/motu.c
++++ b/sound/firewire/motu/motu.c
+@@ -36,7 +36,7 @@ static void name_card(struct snd_motu *motu)
+ fw_csr_iterator_init(&it, motu->unit->directory);
+ while (fw_csr_iterator_next(&it, &key, &val)) {
+ switch (key) {
+- case CSR_VERSION:
++ case CSR_MODEL:
+ version = val;
+ break;
+ }
+@@ -46,7 +46,7 @@ static void name_card(struct snd_motu *motu)
+ strcpy(motu->card->shortname, motu->spec->name);
+ strcpy(motu->card->mixername, motu->spec->name);
+ snprintf(motu->card->longname, sizeof(motu->card->longname),
+- "MOTU %s (version:%d), GUID %08x%08x at %s, S%d",
++ "MOTU %s (version:%06x), GUID %08x%08x at %s, S%d",
+ motu->spec->name, version,
+ fw_dev->config_rom[3], fw_dev->config_rom[4],
+ dev_name(&motu->unit->device), 100 << fw_dev->max_speed);
+@@ -258,20 +258,20 @@ static const struct snd_motu_spec motu_audio_express = {
+ #define SND_MOTU_DEV_ENTRY(model, data) \
+ { \
+ .match_flags = IEEE1394_MATCH_VENDOR_ID | \
+- IEEE1394_MATCH_MODEL_ID | \
+- IEEE1394_MATCH_SPECIFIER_ID, \
++ IEEE1394_MATCH_SPECIFIER_ID | \
++ IEEE1394_MATCH_VERSION, \
+ .vendor_id = OUI_MOTU, \
+- .model_id = model, \
+ .specifier_id = OUI_MOTU, \
++ .version = model, \
+ .driver_data = (kernel_ulong_t)data, \
+ }
+
+ static const struct ieee1394_device_id motu_id_table[] = {
+- SND_MOTU_DEV_ENTRY(0x101800, &motu_828mk2),
+- SND_MOTU_DEV_ENTRY(0x107800, &snd_motu_spec_traveler),
+- SND_MOTU_DEV_ENTRY(0x106800, &motu_828mk3), /* FireWire only. */
+- SND_MOTU_DEV_ENTRY(0x100800, &motu_828mk3), /* Hybrid. */
+- SND_MOTU_DEV_ENTRY(0x104800, &motu_audio_express),
++ SND_MOTU_DEV_ENTRY(0x000003, &motu_828mk2),
++ SND_MOTU_DEV_ENTRY(0x000009, &snd_motu_spec_traveler),
++ SND_MOTU_DEV_ENTRY(0x000015, &motu_828mk3), /* FireWire only. */
++ SND_MOTU_DEV_ENTRY(0x000035, &motu_828mk3), /* Hybrid. */
++ SND_MOTU_DEV_ENTRY(0x000033, &motu_audio_express),
+ { }
+ };
+ MODULE_DEVICE_TABLE(ieee1394, motu_id_table);
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 26d348b47867..21de8145f1a6 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2909,6 +2909,7 @@ static void hda_call_codec_resume(struct hda_codec *codec)
+ hda_jackpoll_work(&codec->jackpoll_work.work);
+ else
+ snd_hda_jack_report_sync(codec);
++ codec->core.dev.power.power_state = PMSG_ON;
+ snd_hdac_leave_pm(&codec->core);
+ }
+
+@@ -2942,10 +2943,62 @@ static int hda_codec_runtime_resume(struct device *dev)
+ }
+ #endif /* CONFIG_PM */
+
++#ifdef CONFIG_PM_SLEEP
++static int hda_codec_force_resume(struct device *dev)
++{
++ int ret;
++
++ /* The get/put pair below enforces the runtime resume even if the
++ * device hasn't been used at suspend time. This trick is needed to
++ * update the jack state change during the sleep.
++ */
++ pm_runtime_get_noresume(dev);
++ ret = pm_runtime_force_resume(dev);
++ pm_runtime_put(dev);
++ return ret;
++}
++
++static int hda_codec_pm_suspend(struct device *dev)
++{
++ dev->power.power_state = PMSG_SUSPEND;
++ return pm_runtime_force_suspend(dev);
++}
++
++static int hda_codec_pm_resume(struct device *dev)
++{
++ dev->power.power_state = PMSG_RESUME;
++ return hda_codec_force_resume(dev);
++}
++
++static int hda_codec_pm_freeze(struct device *dev)
++{
++ dev->power.power_state = PMSG_FREEZE;
++ return pm_runtime_force_suspend(dev);
++}
++
++static int hda_codec_pm_thaw(struct device *dev)
++{
++ dev->power.power_state = PMSG_THAW;
++ return hda_codec_force_resume(dev);
++}
++
++static int hda_codec_pm_restore(struct device *dev)
++{
++ dev->power.power_state = PMSG_RESTORE;
++ return hda_codec_force_resume(dev);
++}
++#endif /* CONFIG_PM_SLEEP */
++
+ /* referred in hda_bind.c */
+ const struct dev_pm_ops hda_codec_driver_pm = {
+- SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+- pm_runtime_force_resume)
++#ifdef CONFIG_PM_SLEEP
++ .suspend = hda_codec_pm_suspend,
++ .resume = hda_codec_pm_resume,
++ .freeze = hda_codec_pm_freeze,
++ .thaw = hda_codec_pm_thaw,
++ .poweroff = hda_codec_pm_suspend,
++ .restore = hda_codec_pm_restore,
++#endif /* CONFIG_PM_SLEEP */
+ SET_RUNTIME_PM_OPS(hda_codec_runtime_suspend, hda_codec_runtime_resume,
+ NULL)
+ };
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 1bb7613701ac..7572b8cc7127 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2274,10 +2274,12 @@ static struct snd_pci_quirk power_save_blacklist[] = {
+ SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */
+ SND_PCI_QUIRK(0x8086, 0x2068, "Intel NUC7i3BNB", 0),
+- /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */
+- SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0),
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */
+ SND_PCI_QUIRK(0x17aa, 0x2227, "Lenovo X1 Carbon 3rd Gen", 0),
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1689623 */
++ SND_PCI_QUIRK(0x17aa, 0x367b, "Lenovo IdeaCentre B550", 0),
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */
++ SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0),
+ {}
+ };
+ #endif /* CONFIG_PM */
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index dffd60cebc31..80f73810b21b 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -7394,7 +7394,7 @@ static void ca0132_free(struct hda_codec *codec)
+ ca0132_exit_chip(codec);
+
+ snd_hda_power_down(codec);
+- if (spec->mem_base)
++ if (IS_ENABLED(CONFIG_PCI) && spec->mem_base)
+ pci_iounmap(codec->bus->pci, spec->mem_base);
+ kfree(spec->spec_init_verbs);
+ kfree(codec->spec);
+diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c
+index fa7dca5a68c8..ec50d1d0b5fe 100644
+--- a/sound/x86/intel_hdmi_audio.c
++++ b/sound/x86/intel_hdmi_audio.c
+@@ -1900,7 +1900,6 @@ static int hdmi_lpe_audio_probe(struct platform_device *pdev)
+
+ pm_runtime_use_autosuspend(&pdev->dev);
+ pm_runtime_mark_last_busy(&pdev->dev);
+- pm_runtime_set_active(&pdev->dev);
+
+ dev_dbg(&pdev->dev, "%s: handle pending notification\n", __func__);
+ for_each_port(card_ctx, port) {
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 2928939b98ec..550f17611bd7 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -2157,9 +2157,10 @@ static void cleanup(struct objtool_file *file)
+ elf_close(file->elf);
+ }
+
++static struct objtool_file file;
++
+ int check(const char *_objname, bool orc)
+ {
+- struct objtool_file file;
+ int ret, warnings = 0;
+
+ objname = _objname;
+diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
+index f119eb628dbb..a22e1f538aea 100644
+--- a/tools/perf/util/probe-event.c
++++ b/tools/perf/util/probe-event.c
+@@ -157,8 +157,10 @@ static struct map *kernel_get_module_map(const char *module)
+ if (module && strchr(module, '/'))
+ return dso__new_map(module);
+
+- if (!module)
+- module = "kernel";
++ if (!module) {
++ pos = machine__kernel_map(host_machine);
++ return map__get(pos);
++ }
+
+ for (pos = maps__first(maps); pos; pos = map__next(pos)) {
+ /* short_name is "[module]" */
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-04-03 10:59 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-04-03 10:59 UTC (permalink / raw
To: gentoo-commits
commit: ccb4086de04c26ae9cd4a06cbaf687b32407504c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 3 10:58:50 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 3 10:58:50 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ccb4086d
Linuxpatch 4.19.33
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1032_linux-4.19.33.patch | 4531 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4535 insertions(+)
diff --git a/0000_README b/0000_README
index 1e50242..fe8b3d1 100644
--- a/0000_README
+++ b/0000_README
@@ -171,6 +171,10 @@ Patch: 1031_linux-4.19.32.patch
From: http://www.kernel.org
Desc: Linux 4.19.32
+Patch: 1032_linux-4.19.33.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.33
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1032_linux-4.19.33.patch b/1032_linux-4.19.33.patch
new file mode 100644
index 0000000..018985e
--- /dev/null
+++ b/1032_linux-4.19.33.patch
@@ -0,0 +1,4531 @@
+diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
+index 647f94128a85..8e16017ff397 100644
+--- a/Documentation/virtual/kvm/api.txt
++++ b/Documentation/virtual/kvm/api.txt
+@@ -13,7 +13,7 @@ of a virtual machine. The ioctls belong to three classes
+
+ - VM ioctls: These query and set attributes that affect an entire virtual
+ machine, for example memory layout. In addition a VM ioctl is used to
+- create virtual cpus (vcpus).
++ create virtual cpus (vcpus) and devices.
+
+ Only run VM ioctls from the same process (address space) that was used
+ to create the VM.
+@@ -24,6 +24,11 @@ of a virtual machine. The ioctls belong to three classes
+ Only run vcpu ioctls from the same thread that was used to create the
+ vcpu.
+
++ - device ioctls: These query and set attributes that control the operation
++ of a single device.
++
++ device ioctls must be issued from the same process (address space) that
++ was used to create the VM.
+
+ 2. File descriptors
+ -------------------
+@@ -32,10 +37,11 @@ The kvm API is centered around file descriptors. An initial
+ open("/dev/kvm") obtains a handle to the kvm subsystem; this handle
+ can be used to issue system ioctls. A KVM_CREATE_VM ioctl on this
+ handle will create a VM file descriptor which can be used to issue VM
+-ioctls. A KVM_CREATE_VCPU ioctl on a VM fd will create a virtual cpu
+-and return a file descriptor pointing to it. Finally, ioctls on a vcpu
+-fd can be used to control the vcpu, including the important task of
+-actually running guest code.
++ioctls. A KVM_CREATE_VCPU or KVM_CREATE_DEVICE ioctl on a VM fd will
++create a virtual cpu or device and return a file descriptor pointing to
++the new resource. Finally, ioctls on a vcpu or device fd can be used
++to control the vcpu or device. For vcpus, this includes the important
++task of actually running guest code.
+
+ In general file descriptors can be migrated among processes by means
+ of fork() and the SCM_RIGHTS facility of unix domain socket. These
+diff --git a/Makefile b/Makefile
+index d66c433df5b1..8de5fab711d8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 32
++SUBLEVEL = 33
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -948,9 +948,11 @@ mod_sign_cmd = true
+ endif
+ export mod_sign_cmd
+
++HOST_LIBELF_LIBS = $(shell pkg-config libelf --libs 2>/dev/null || echo -lelf)
++
+ ifdef CONFIG_STACK_VALIDATION
+ has_libelf := $(call try-run,\
+- echo "int main() {}" | $(HOSTCC) -xc -o /dev/null -lelf -,1,0)
++ echo "int main() {}" | $(HOSTCC) -xc -o /dev/null $(HOST_LIBELF_LIBS) -,1,0)
+ ifeq ($(has_libelf),1)
+ objtool_target := tools/objtool FORCE
+ else
+diff --git a/arch/arm/mach-imx/cpuidle-imx6q.c b/arch/arm/mach-imx/cpuidle-imx6q.c
+index bfeb25aaf9a2..326e870d7123 100644
+--- a/arch/arm/mach-imx/cpuidle-imx6q.c
++++ b/arch/arm/mach-imx/cpuidle-imx6q.c
+@@ -16,30 +16,23 @@
+ #include "cpuidle.h"
+ #include "hardware.h"
+
+-static atomic_t master = ATOMIC_INIT(0);
+-static DEFINE_SPINLOCK(master_lock);
++static int num_idle_cpus = 0;
++static DEFINE_SPINLOCK(cpuidle_lock);
+
+ static int imx6q_enter_wait(struct cpuidle_device *dev,
+ struct cpuidle_driver *drv, int index)
+ {
+- if (atomic_inc_return(&master) == num_online_cpus()) {
+- /*
+- * With this lock, we prevent other cpu to exit and enter
+- * this function again and become the master.
+- */
+- if (!spin_trylock(&master_lock))
+- goto idle;
++ spin_lock(&cpuidle_lock);
++ if (++num_idle_cpus == num_online_cpus())
+ imx6_set_lpm(WAIT_UNCLOCKED);
+- cpu_do_idle();
+- imx6_set_lpm(WAIT_CLOCKED);
+- spin_unlock(&master_lock);
+- goto done;
+- }
++ spin_unlock(&cpuidle_lock);
+
+-idle:
+ cpu_do_idle();
+-done:
+- atomic_dec(&master);
++
++ spin_lock(&cpuidle_lock);
++ if (num_idle_cpus-- == num_online_cpus())
++ imx6_set_lpm(WAIT_CLOCKED);
++ spin_unlock(&cpuidle_lock);
+
+ return index;
+ }
+diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h
+index 33b6f9c892c8..40a6c9261a6b 100644
+--- a/arch/powerpc/include/asm/feature-fixups.h
++++ b/arch/powerpc/include/asm/feature-fixups.h
+@@ -221,6 +221,17 @@ label##3: \
+ FTR_ENTRY_OFFSET 953b-954b; \
+ .popsection;
+
++#define START_BTB_FLUSH_SECTION \
++955: \
++
++#define END_BTB_FLUSH_SECTION \
++956: \
++ .pushsection __btb_flush_fixup,"a"; \
++ .align 2; \
++957: \
++ FTR_ENTRY_OFFSET 955b-957b; \
++ FTR_ENTRY_OFFSET 956b-957b; \
++ .popsection;
+
+ #ifndef __ASSEMBLY__
+ #include <linux/types.h>
+@@ -230,6 +241,7 @@ extern long __start___stf_entry_barrier_fixup, __stop___stf_entry_barrier_fixup;
+ extern long __start___stf_exit_barrier_fixup, __stop___stf_exit_barrier_fixup;
+ extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup;
+ extern long __start___barrier_nospec_fixup, __stop___barrier_nospec_fixup;
++extern long __start__btb_flush_fixup, __stop__btb_flush_fixup;
+
+ void apply_feature_fixups(void);
+ void setup_feature_keys(void);
+diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
+index 665af14850e4..2b7135391231 100644
+--- a/arch/powerpc/include/asm/ppc-opcode.h
++++ b/arch/powerpc/include/asm/ppc-opcode.h
+@@ -300,6 +300,7 @@
+ /* Misc instructions for BPF compiler */
+ #define PPC_INST_LBZ 0x88000000
+ #define PPC_INST_LD 0xe8000000
++#define PPC_INST_LDX 0x7c00002a
+ #define PPC_INST_LHZ 0xa0000000
+ #define PPC_INST_LWZ 0x80000000
+ #define PPC_INST_LHBRX 0x7c00062c
+@@ -307,6 +308,7 @@
+ #define PPC_INST_STB 0x98000000
+ #define PPC_INST_STH 0xb0000000
+ #define PPC_INST_STD 0xf8000000
++#define PPC_INST_STDX 0x7c00012a
+ #define PPC_INST_STDU 0xf8000001
+ #define PPC_INST_STW 0x90000000
+ #define PPC_INST_STWU 0x94000000
+diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
+index b5d023680801..5c901bf4c505 100644
+--- a/arch/powerpc/include/asm/ppc_asm.h
++++ b/arch/powerpc/include/asm/ppc_asm.h
+@@ -821,4 +821,14 @@ END_FTR_SECTION_IFCLR(CPU_FTR_601)
+ stringify_in_c(.long (_target) - . ;) \
+ stringify_in_c(.previous)
+
++#ifdef CONFIG_PPC_FSL_BOOK3E
++#define BTB_FLUSH(reg) \
++ lis reg,BUCSR_INIT@h; \
++ ori reg,reg,BUCSR_INIT@l; \
++ mtspr SPRN_BUCSR,reg; \
++ isync;
++#else
++#define BTB_FLUSH(reg)
++#endif /* CONFIG_PPC_FSL_BOOK3E */
++
+ #endif /* _ASM_POWERPC_PPC_ASM_H */
+diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h
+index 1fffbba8d6a5..65676e2325b8 100644
+--- a/arch/powerpc/include/asm/setup.h
++++ b/arch/powerpc/include/asm/setup.h
+@@ -67,6 +67,13 @@ void do_barrier_nospec_fixups_range(bool enable, void *start, void *end);
+ static inline void do_barrier_nospec_fixups_range(bool enable, void *start, void *end) { };
+ #endif
+
++#ifdef CONFIG_PPC_FSL_BOOK3E
++void setup_spectre_v2(void);
++#else
++static inline void setup_spectre_v2(void) {};
++#endif
++void do_btb_flush_fixups(void);
++
+ #endif /* !__ASSEMBLY__ */
+
+ #endif /* _ASM_POWERPC_SETUP_H */
+diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
+index 2206912ea4f0..c806a3c12592 100644
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -80,6 +80,11 @@ END_FTR_SECTION_IFSET(CPU_FTR_TM)
+ std r0,GPR0(r1)
+ std r10,GPR1(r1)
+ beq 2f /* if from kernel mode */
++#ifdef CONFIG_PPC_FSL_BOOK3E
++START_BTB_FLUSH_SECTION
++ BTB_FLUSH(r10)
++END_BTB_FLUSH_SECTION
++#endif
+ ACCOUNT_CPU_USER_ENTRY(r13, r10, r11)
+ 2: std r2,GPR2(r1)
+ std r3,GPR3(r1)
+diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
+index 6d6e144a28ce..447defdd4503 100644
+--- a/arch/powerpc/kernel/exceptions-64e.S
++++ b/arch/powerpc/kernel/exceptions-64e.S
+@@ -296,7 +296,8 @@ ret_from_mc_except:
+ andi. r10,r11,MSR_PR; /* save stack pointer */ \
+ beq 1f; /* branch around if supervisor */ \
+ ld r1,PACAKSAVE(r13); /* get kernel stack coming from usr */\
+-1: cmpdi cr1,r1,0; /* check if SP makes sense */ \
++1: type##_BTB_FLUSH \
++ cmpdi cr1,r1,0; /* check if SP makes sense */ \
+ bge- cr1,exc_##n##_bad_stack;/* bad stack (TODO: out of line) */ \
+ mfspr r10,SPRN_##type##_SRR0; /* read SRR0 before touching stack */
+
+@@ -328,6 +329,30 @@ ret_from_mc_except:
+ #define SPRN_MC_SRR0 SPRN_MCSRR0
+ #define SPRN_MC_SRR1 SPRN_MCSRR1
+
++#ifdef CONFIG_PPC_FSL_BOOK3E
++#define GEN_BTB_FLUSH \
++ START_BTB_FLUSH_SECTION \
++ beq 1f; \
++ BTB_FLUSH(r10) \
++ 1: \
++ END_BTB_FLUSH_SECTION
++
++#define CRIT_BTB_FLUSH \
++ START_BTB_FLUSH_SECTION \
++ BTB_FLUSH(r10) \
++ END_BTB_FLUSH_SECTION
++
++#define DBG_BTB_FLUSH CRIT_BTB_FLUSH
++#define MC_BTB_FLUSH CRIT_BTB_FLUSH
++#define GDBELL_BTB_FLUSH GEN_BTB_FLUSH
++#else
++#define GEN_BTB_FLUSH
++#define CRIT_BTB_FLUSH
++#define DBG_BTB_FLUSH
++#define MC_BTB_FLUSH
++#define GDBELL_BTB_FLUSH
++#endif
++
+ #define NORMAL_EXCEPTION_PROLOG(n, intnum, addition) \
+ EXCEPTION_PROLOG(n, intnum, GEN, addition##_GEN(n))
+
+diff --git a/arch/powerpc/kernel/head_booke.h b/arch/powerpc/kernel/head_booke.h
+index d0862a100d29..306e26c073a0 100644
+--- a/arch/powerpc/kernel/head_booke.h
++++ b/arch/powerpc/kernel/head_booke.h
+@@ -32,6 +32,16 @@
+ */
+ #define THREAD_NORMSAVE(offset) (THREAD_NORMSAVES + (offset * 4))
+
++#ifdef CONFIG_PPC_FSL_BOOK3E
++#define BOOKE_CLEAR_BTB(reg) \
++START_BTB_FLUSH_SECTION \
++ BTB_FLUSH(reg) \
++END_BTB_FLUSH_SECTION
++#else
++#define BOOKE_CLEAR_BTB(reg)
++#endif
++
++
+ #define NORMAL_EXCEPTION_PROLOG(intno) \
+ mtspr SPRN_SPRG_WSCRATCH0, r10; /* save one register */ \
+ mfspr r10, SPRN_SPRG_THREAD; \
+@@ -43,6 +53,7 @@
+ andi. r11, r11, MSR_PR; /* check whether user or kernel */\
+ mr r11, r1; \
+ beq 1f; \
++ BOOKE_CLEAR_BTB(r11) \
+ /* if from user, start at top of this thread's kernel stack */ \
+ lwz r11, THREAD_INFO-THREAD(r10); \
+ ALLOC_STACK_FRAME(r11, THREAD_SIZE); \
+@@ -128,6 +139,7 @@
+ stw r9,_CCR(r8); /* save CR on stack */\
+ mfspr r11,exc_level_srr1; /* check whether user or kernel */\
+ DO_KVM BOOKE_INTERRUPT_##intno exc_level_srr1; \
++ BOOKE_CLEAR_BTB(r10) \
+ andi. r11,r11,MSR_PR; \
+ mfspr r11,SPRN_SPRG_THREAD; /* if from user, start at top of */\
+ lwz r11,THREAD_INFO-THREAD(r11); /* this thread's kernel stack */\
+diff --git a/arch/powerpc/kernel/head_fsl_booke.S b/arch/powerpc/kernel/head_fsl_booke.S
+index e2750b856c8f..2386ce2a9c6e 100644
+--- a/arch/powerpc/kernel/head_fsl_booke.S
++++ b/arch/powerpc/kernel/head_fsl_booke.S
+@@ -453,6 +453,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_EMB_HV)
+ mfcr r13
+ stw r13, THREAD_NORMSAVE(3)(r10)
+ DO_KVM BOOKE_INTERRUPT_DTLB_MISS SPRN_SRR1
++START_BTB_FLUSH_SECTION
++ mfspr r11, SPRN_SRR1
++ andi. r10,r11,MSR_PR
++ beq 1f
++ BTB_FLUSH(r10)
++1:
++END_BTB_FLUSH_SECTION
+ mfspr r10, SPRN_DEAR /* Get faulting address */
+
+ /* If we are faulting a kernel address, we have to use the
+@@ -547,6 +554,14 @@ END_FTR_SECTION_IFSET(CPU_FTR_EMB_HV)
+ mfcr r13
+ stw r13, THREAD_NORMSAVE(3)(r10)
+ DO_KVM BOOKE_INTERRUPT_ITLB_MISS SPRN_SRR1
++START_BTB_FLUSH_SECTION
++ mfspr r11, SPRN_SRR1
++ andi. r10,r11,MSR_PR
++ beq 1f
++ BTB_FLUSH(r10)
++1:
++END_BTB_FLUSH_SECTION
++
+ mfspr r10, SPRN_SRR0 /* Get faulting address */
+
+ /* If we are faulting a kernel address, we have to use the
+diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
+index 1b395b85132b..1341325599a7 100644
+--- a/arch/powerpc/kernel/security.c
++++ b/arch/powerpc/kernel/security.c
+@@ -26,6 +26,10 @@ static enum count_cache_flush_type count_cache_flush_type = COUNT_CACHE_FLUSH_NO
+
+ bool barrier_nospec_enabled;
+ static bool no_nospec;
++static bool btb_flush_enabled;
++#ifdef CONFIG_PPC_FSL_BOOK3E
++static bool no_spectrev2;
++#endif
+
+ static void enable_barrier_nospec(bool enable)
+ {
+@@ -101,6 +105,23 @@ static __init int barrier_nospec_debugfs_init(void)
+ device_initcall(barrier_nospec_debugfs_init);
+ #endif /* CONFIG_DEBUG_FS */
+
++#ifdef CONFIG_PPC_FSL_BOOK3E
++static int __init handle_nospectre_v2(char *p)
++{
++ no_spectrev2 = true;
++
++ return 0;
++}
++early_param("nospectre_v2", handle_nospectre_v2);
++void setup_spectre_v2(void)
++{
++ if (no_spectrev2)
++ do_btb_flush_fixups();
++ else
++ btb_flush_enabled = true;
++}
++#endif /* CONFIG_PPC_FSL_BOOK3E */
++
+ #ifdef CONFIG_PPC_BOOK3S_64
+ ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+@@ -168,31 +189,27 @@ ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, c
+ bcs = security_ftr_enabled(SEC_FTR_BCCTRL_SERIALISED);
+ ccd = security_ftr_enabled(SEC_FTR_COUNT_CACHE_DISABLED);
+
+- if (bcs || ccd || count_cache_flush_type != COUNT_CACHE_FLUSH_NONE) {
+- bool comma = false;
++ if (bcs || ccd) {
+ seq_buf_printf(&s, "Mitigation: ");
+
+- if (bcs) {
++ if (bcs)
+ seq_buf_printf(&s, "Indirect branch serialisation (kernel only)");
+- comma = true;
+- }
+-
+- if (ccd) {
+- if (comma)
+- seq_buf_printf(&s, ", ");
+- seq_buf_printf(&s, "Indirect branch cache disabled");
+- comma = true;
+- }
+
+- if (comma)
++ if (bcs && ccd)
+ seq_buf_printf(&s, ", ");
+
+- seq_buf_printf(&s, "Software count cache flush");
++ if (ccd)
++ seq_buf_printf(&s, "Indirect branch cache disabled");
++ } else if (count_cache_flush_type != COUNT_CACHE_FLUSH_NONE) {
++ seq_buf_printf(&s, "Mitigation: Software count cache flush");
+
+ if (count_cache_flush_type == COUNT_CACHE_FLUSH_HW)
+- seq_buf_printf(&s, "(hardware accelerated)");
+- } else
++ seq_buf_printf(&s, " (hardware accelerated)");
++ } else if (btb_flush_enabled) {
++ seq_buf_printf(&s, "Mitigation: Branch predictor state flush");
++ } else {
+ seq_buf_printf(&s, "Vulnerable");
++ }
+
+ seq_buf_printf(&s, "\n");
+
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index 93fa0c99681e..508244bcf19c 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -973,6 +973,7 @@ void __init setup_arch(char **cmdline_p)
+ ppc_md.setup_arch();
+
+ setup_barrier_nospec();
++ setup_spectre_v2();
+
+ paging_init();
+
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 53016c753f3c..fd35eddf3266 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -164,6 +164,14 @@ SECTIONS
+ }
+ #endif /* CONFIG_PPC_BARRIER_NOSPEC */
+
++#ifdef CONFIG_PPC_FSL_BOOK3E
++ . = ALIGN(8);
++ __spec_btb_flush_fixup : AT(ADDR(__spec_btb_flush_fixup) - LOAD_OFFSET) {
++ __start__btb_flush_fixup = .;
++ *(__btb_flush_fixup)
++ __stop__btb_flush_fixup = .;
++ }
++#endif
+ EXCEPTION_TABLE(0)
+
+ NOTES :kernel :notes
+diff --git a/arch/powerpc/kvm/bookehv_interrupts.S b/arch/powerpc/kvm/bookehv_interrupts.S
+index 81bd8a07aa51..612b7f6a887f 100644
+--- a/arch/powerpc/kvm/bookehv_interrupts.S
++++ b/arch/powerpc/kvm/bookehv_interrupts.S
+@@ -75,6 +75,10 @@
+ PPC_LL r1, VCPU_HOST_STACK(r4)
+ PPC_LL r2, HOST_R2(r1)
+
++START_BTB_FLUSH_SECTION
++ BTB_FLUSH(r10)
++END_BTB_FLUSH_SECTION
++
+ mfspr r10, SPRN_PID
+ lwz r8, VCPU_HOST_PID(r4)
+ PPC_LL r11, VCPU_SHARED(r4)
+diff --git a/arch/powerpc/kvm/e500_emulate.c b/arch/powerpc/kvm/e500_emulate.c
+index 3f8189eb56ed..fde1de08b4d7 100644
+--- a/arch/powerpc/kvm/e500_emulate.c
++++ b/arch/powerpc/kvm/e500_emulate.c
+@@ -277,6 +277,13 @@ int kvmppc_core_emulate_mtspr_e500(struct kvm_vcpu *vcpu, int sprn, ulong spr_va
+ vcpu->arch.pwrmgtcr0 = spr_val;
+ break;
+
++ case SPRN_BUCSR:
++ /*
++ * If we are here, it means that we have already flushed the
++ * branch predictor, so just return to guest.
++ */
++ break;
++
+ /* extra exceptions */
+ #ifdef CONFIG_SPE_POSSIBLE
+ case SPRN_IVOR32:
+diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c
+index e613b02bb2f0..dbe478e7b8e0 100644
+--- a/arch/powerpc/lib/feature-fixups.c
++++ b/arch/powerpc/lib/feature-fixups.c
+@@ -347,6 +347,29 @@ void do_barrier_nospec_fixups_range(bool enable, void *fixup_start, void *fixup_
+
+ printk(KERN_DEBUG "barrier-nospec: patched %d locations\n", i);
+ }
++
++static void patch_btb_flush_section(long *curr)
++{
++ unsigned int *start, *end;
++
++ start = (void *)curr + *curr;
++ end = (void *)curr + *(curr + 1);
++ for (; start < end; start++) {
++ pr_devel("patching dest %lx\n", (unsigned long)start);
++ patch_instruction(start, PPC_INST_NOP);
++ }
++}
++
++void do_btb_flush_fixups(void)
++{
++ long *start, *end;
++
++ start = PTRRELOC(&__start__btb_flush_fixup);
++ end = PTRRELOC(&__stop__btb_flush_fixup);
++
++ for (; start < end; start += 2)
++ patch_btb_flush_section(start);
++}
+ #endif /* CONFIG_PPC_FSL_BOOK3E */
+
+ void do_lwsync_fixups(unsigned long value, void *fixup_start, void *fixup_end)
+diff --git a/arch/powerpc/lib/memcmp_64.S b/arch/powerpc/lib/memcmp_64.S
+index 844d8e774492..b7f6f6e0b6e8 100644
+--- a/arch/powerpc/lib/memcmp_64.S
++++ b/arch/powerpc/lib/memcmp_64.S
+@@ -215,11 +215,20 @@ _GLOBAL_TOC(memcmp)
+ beq .Lzero
+
+ .Lcmp_rest_lt8bytes:
+- /* Here we have only less than 8 bytes to compare with. at least s1
+- * Address is aligned with 8 bytes.
+- * The next double words are load and shift right with appropriate
+- * bits.
++ /*
++ * Here we have less than 8 bytes to compare. At least s1 is aligned to
++ * 8 bytes, but s2 may not be. We must make sure s2 + 7 doesn't cross a
++ * page boundary, otherwise we might read past the end of the buffer and
++ * trigger a page fault. We use 4K as the conservative minimum page
++ * size. If we detect that case we go to the byte-by-byte loop.
++ *
++ * Otherwise the next double word is loaded from s1 and s2, and shifted
++ * right to compare the appropriate bits.
+ */
++ clrldi r6,r4,(64-12) // r6 = r4 & 0xfff
++ cmpdi r6,0xff8
++ bgt .Lshort
++
+ subfic r6,r5,8
+ slwi r6,r6,3
+ LD rA,0,r3
+diff --git a/arch/powerpc/mm/tlb_low_64e.S b/arch/powerpc/mm/tlb_low_64e.S
+index 7fd20c52a8ec..9ed90064f542 100644
+--- a/arch/powerpc/mm/tlb_low_64e.S
++++ b/arch/powerpc/mm/tlb_low_64e.S
+@@ -70,6 +70,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_EMB_HV)
+ std r15,EX_TLB_R15(r12)
+ std r10,EX_TLB_CR(r12)
+ #ifdef CONFIG_PPC_FSL_BOOK3E
++START_BTB_FLUSH_SECTION
++ mfspr r11, SPRN_SRR1
++ andi. r10,r11,MSR_PR
++ beq 1f
++ BTB_FLUSH(r10)
++1:
++END_BTB_FLUSH_SECTION
+ std r7,EX_TLB_R7(r12)
+ #endif
+ TLB_MISS_PROLOG_STATS
+diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
+index 47fc6660845d..68dece206048 100644
+--- a/arch/powerpc/net/bpf_jit.h
++++ b/arch/powerpc/net/bpf_jit.h
+@@ -51,6 +51,8 @@
+ #define PPC_LIS(r, i) PPC_ADDIS(r, 0, i)
+ #define PPC_STD(r, base, i) EMIT(PPC_INST_STD | ___PPC_RS(r) | \
+ ___PPC_RA(base) | ((i) & 0xfffc))
++#define PPC_STDX(r, base, b) EMIT(PPC_INST_STDX | ___PPC_RS(r) | \
++ ___PPC_RA(base) | ___PPC_RB(b))
+ #define PPC_STDU(r, base, i) EMIT(PPC_INST_STDU | ___PPC_RS(r) | \
+ ___PPC_RA(base) | ((i) & 0xfffc))
+ #define PPC_STW(r, base, i) EMIT(PPC_INST_STW | ___PPC_RS(r) | \
+@@ -65,7 +67,9 @@
+ #define PPC_LBZ(r, base, i) EMIT(PPC_INST_LBZ | ___PPC_RT(r) | \
+ ___PPC_RA(base) | IMM_L(i))
+ #define PPC_LD(r, base, i) EMIT(PPC_INST_LD | ___PPC_RT(r) | \
+- ___PPC_RA(base) | IMM_L(i))
++ ___PPC_RA(base) | ((i) & 0xfffc))
++#define PPC_LDX(r, base, b) EMIT(PPC_INST_LDX | ___PPC_RT(r) | \
++ ___PPC_RA(base) | ___PPC_RB(b))
+ #define PPC_LWZ(r, base, i) EMIT(PPC_INST_LWZ | ___PPC_RT(r) | \
+ ___PPC_RA(base) | IMM_L(i))
+ #define PPC_LHZ(r, base, i) EMIT(PPC_INST_LHZ | ___PPC_RT(r) | \
+@@ -85,17 +89,6 @@
+ ___PPC_RA(a) | ___PPC_RB(b))
+ #define PPC_BPF_STDCX(s, a, b) EMIT(PPC_INST_STDCX | ___PPC_RS(s) | \
+ ___PPC_RA(a) | ___PPC_RB(b))
+-
+-#ifdef CONFIG_PPC64
+-#define PPC_BPF_LL(r, base, i) do { PPC_LD(r, base, i); } while(0)
+-#define PPC_BPF_STL(r, base, i) do { PPC_STD(r, base, i); } while(0)
+-#define PPC_BPF_STLU(r, base, i) do { PPC_STDU(r, base, i); } while(0)
+-#else
+-#define PPC_BPF_LL(r, base, i) do { PPC_LWZ(r, base, i); } while(0)
+-#define PPC_BPF_STL(r, base, i) do { PPC_STW(r, base, i); } while(0)
+-#define PPC_BPF_STLU(r, base, i) do { PPC_STWU(r, base, i); } while(0)
+-#endif
+-
+ #define PPC_CMPWI(a, i) EMIT(PPC_INST_CMPWI | ___PPC_RA(a) | IMM_L(i))
+ #define PPC_CMPDI(a, i) EMIT(PPC_INST_CMPDI | ___PPC_RA(a) | IMM_L(i))
+ #define PPC_CMPW(a, b) EMIT(PPC_INST_CMPW | ___PPC_RA(a) | \
+diff --git a/arch/powerpc/net/bpf_jit32.h b/arch/powerpc/net/bpf_jit32.h
+index 6f4daacad296..ade04547703f 100644
+--- a/arch/powerpc/net/bpf_jit32.h
++++ b/arch/powerpc/net/bpf_jit32.h
+@@ -123,6 +123,10 @@ DECLARE_LOAD_FUNC(sk_load_byte_msh);
+ #define PPC_NTOHS_OFFS(r, base, i) PPC_LHZ_OFFS(r, base, i)
+ #endif
+
++#define PPC_BPF_LL(r, base, i) do { PPC_LWZ(r, base, i); } while(0)
++#define PPC_BPF_STL(r, base, i) do { PPC_STW(r, base, i); } while(0)
++#define PPC_BPF_STLU(r, base, i) do { PPC_STWU(r, base, i); } while(0)
++
+ #define SEEN_DATAREF 0x10000 /* might call external helpers */
+ #define SEEN_XREG 0x20000 /* X reg is used */
+ #define SEEN_MEM 0x40000 /* SEEN_MEM+(1<<n) = use mem[n] for temporary
+diff --git a/arch/powerpc/net/bpf_jit64.h b/arch/powerpc/net/bpf_jit64.h
+index 3609be4692b3..47f441f351a6 100644
+--- a/arch/powerpc/net/bpf_jit64.h
++++ b/arch/powerpc/net/bpf_jit64.h
+@@ -68,6 +68,26 @@ static const int b2p[] = {
+ /* PPC NVR range -- update this if we ever use NVRs below r27 */
+ #define BPF_PPC_NVR_MIN 27
+
++/*
++ * WARNING: These can use TMP_REG_2 if the offset is not at word boundary,
++ * so ensure that it isn't in use already.
++ */
++#define PPC_BPF_LL(r, base, i) do { \
++ if ((i) % 4) { \
++ PPC_LI(b2p[TMP_REG_2], (i)); \
++ PPC_LDX(r, base, b2p[TMP_REG_2]); \
++ } else \
++ PPC_LD(r, base, i); \
++ } while(0)
++#define PPC_BPF_STL(r, base, i) do { \
++ if ((i) % 4) { \
++ PPC_LI(b2p[TMP_REG_2], (i)); \
++ PPC_STDX(r, base, b2p[TMP_REG_2]); \
++ } else \
++ PPC_STD(r, base, i); \
++ } while(0)
++#define PPC_BPF_STLU(r, base, i) do { PPC_STDU(r, base, i); } while(0)
++
+ #define SEEN_FUNC 0x1000 /* might call external helpers */
+ #define SEEN_STACK 0x2000 /* uses BPF stack */
+ #define SEEN_TAILCALL 0x4000 /* uses tail calls */
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index 50b129785aee..226eec62d125 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -226,7 +226,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32
+ * if (tail_call_cnt > MAX_TAIL_CALL_CNT)
+ * goto out;
+ */
+- PPC_LD(b2p[TMP_REG_1], 1, bpf_jit_stack_tailcallcnt(ctx));
++ PPC_BPF_LL(b2p[TMP_REG_1], 1, bpf_jit_stack_tailcallcnt(ctx));
+ PPC_CMPLWI(b2p[TMP_REG_1], MAX_TAIL_CALL_CNT);
+ PPC_BCC(COND_GT, out);
+
+@@ -239,7 +239,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32
+ /* prog = array->ptrs[index]; */
+ PPC_MULI(b2p[TMP_REG_1], b2p_index, 8);
+ PPC_ADD(b2p[TMP_REG_1], b2p[TMP_REG_1], b2p_bpf_array);
+- PPC_LD(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_array, ptrs));
++ PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_array, ptrs));
+
+ /*
+ * if (prog == NULL)
+@@ -249,7 +249,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32
+ PPC_BCC(COND_EQ, out);
+
+ /* goto *(prog->bpf_func + prologue_size); */
+- PPC_LD(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_prog, bpf_func));
++ PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_1], offsetof(struct bpf_prog, bpf_func));
+ #ifdef PPC64_ELF_ABI_v1
+ /* skip past the function descriptor */
+ PPC_ADDI(b2p[TMP_REG_1], b2p[TMP_REG_1],
+@@ -573,7 +573,7 @@ bpf_alu32_trunc:
+ * the instructions generated will remain the
+ * same across all passes
+ */
+- PPC_STD(dst_reg, 1, bpf_jit_stack_local(ctx));
++ PPC_BPF_STL(dst_reg, 1, bpf_jit_stack_local(ctx));
+ PPC_ADDI(b2p[TMP_REG_1], 1, bpf_jit_stack_local(ctx));
+ PPC_LDBRX(dst_reg, 0, b2p[TMP_REG_1]);
+ break;
+@@ -629,7 +629,7 @@ emit_clear:
+ PPC_LI32(b2p[TMP_REG_1], imm);
+ src_reg = b2p[TMP_REG_1];
+ }
+- PPC_STD(src_reg, dst_reg, off);
++ PPC_BPF_STL(src_reg, dst_reg, off);
+ break;
+
+ /*
+@@ -676,7 +676,7 @@ emit_clear:
+ break;
+ /* dst = *(u64 *)(ul) (src + off) */
+ case BPF_LDX | BPF_MEM | BPF_DW:
+- PPC_LD(dst_reg, src_reg, off);
++ PPC_BPF_LL(dst_reg, src_reg, off);
+ break;
+
+ /*
+diff --git a/arch/powerpc/platforms/pseries/pseries_energy.c b/arch/powerpc/platforms/pseries/pseries_energy.c
+index 6ed22127391b..921f12182f3e 100644
+--- a/arch/powerpc/platforms/pseries/pseries_energy.c
++++ b/arch/powerpc/platforms/pseries/pseries_energy.c
+@@ -77,18 +77,27 @@ static u32 cpu_to_drc_index(int cpu)
+
+ ret = drc.drc_index_start + (thread_index * drc.sequential_inc);
+ } else {
+- const __be32 *indexes;
+-
+- indexes = of_get_property(dn, "ibm,drc-indexes", NULL);
+- if (indexes == NULL)
+- goto err_of_node_put;
++ u32 nr_drc_indexes, thread_drc_index;
+
+ /*
+- * The first element indexes[0] is the number of drc_indexes
+- * returned in the list. Hence thread_index+1 will get the
+- * drc_index corresponding to core number thread_index.
++ * The first element of ibm,drc-indexes array is the
++ * number of drc_indexes returned in the list. Hence
++ * thread_index+1 will get the drc_index corresponding
++ * to core number thread_index.
+ */
+- ret = indexes[thread_index + 1];
++ rc = of_property_read_u32_index(dn, "ibm,drc-indexes",
++ 0, &nr_drc_indexes);
++ if (rc)
++ goto err_of_node_put;
++
++ WARN_ON_ONCE(thread_index > nr_drc_indexes);
++ rc = of_property_read_u32_index(dn, "ibm,drc-indexes",
++ thread_index + 1,
++ &thread_drc_index);
++ if (rc)
++ goto err_of_node_put;
++
++ ret = thread_drc_index;
+ }
+
+ rc = 0;
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 44c6a82b7ce5..e76d16ac2776 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -2199,14 +2199,8 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING
+ If unsure, leave at the default value.
+
+ config HOTPLUG_CPU
+- bool "Support for hot-pluggable CPUs"
++ def_bool y
+ depends on SMP
+- ---help---
+- Say Y here to allow turning CPUs off and on. CPUs can be
+- controlled through /sys/devices/system/cpu.
+- ( Note: power management support will enable this option
+- automatically on SMP systems. )
+- Say N if you want to disable CPU hotplug.
+
+ config BOOTPARAM_HOTPLUG_CPU0
+ bool "Set default setting of cpu0_hotpluggable"
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 46f0b621bd37..7014dba23d20 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -315,6 +315,7 @@ struct kvm_mmu_page {
+ };
+
+ struct kvm_pio_request {
++ unsigned long linear_rip;
+ unsigned long count;
+ int in;
+ int port;
+@@ -527,6 +528,7 @@ struct kvm_vcpu_arch {
+ bool tpr_access_reporting;
+ u64 ia32_xss;
+ u64 microcode_version;
++ u64 arch_capabilities;
+
+ /*
+ * Paging state of the vcpu
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 4029d3783e18..f99f59625da5 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -970,7 +970,6 @@ struct vcpu_vmx {
+ u64 msr_guest_kernel_gs_base;
+ #endif
+
+- u64 arch_capabilities;
+ u64 spec_ctrl;
+
+ u32 vm_entry_controls_shadow;
+@@ -4104,12 +4103,6 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+
+ msr_info->data = to_vmx(vcpu)->spec_ctrl;
+ break;
+- case MSR_IA32_ARCH_CAPABILITIES:
+- if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_ARCH_CAPABILITIES))
+- return 1;
+- msr_info->data = to_vmx(vcpu)->arch_capabilities;
+- break;
+ case MSR_IA32_SYSENTER_CS:
+ msr_info->data = vmcs_read32(GUEST_SYSENTER_CS);
+ break;
+@@ -4271,11 +4264,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD,
+ MSR_TYPE_W);
+ break;
+- case MSR_IA32_ARCH_CAPABILITIES:
+- if (!msr_info->host_initiated)
+- return 1;
+- vmx->arch_capabilities = data;
+- break;
+ case MSR_IA32_CR_PAT:
+ if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
+ if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
+@@ -6666,8 +6654,6 @@ static void vmx_vcpu_setup(struct vcpu_vmx *vmx)
+ ++vmx->nmsrs;
+ }
+
+- vmx->arch_capabilities = kvm_get_arch_capabilities();
+-
+ vm_exit_controls_init(vmx, vmcs_config.vmexit_ctrl);
+
+ /* 22.2.1, 20.8.1 */
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 6181ec19bed2..4a61e1609c97 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2350,6 +2350,11 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ if (msr_info->host_initiated)
+ vcpu->arch.microcode_version = data;
+ break;
++ case MSR_IA32_ARCH_CAPABILITIES:
++ if (!msr_info->host_initiated)
++ return 1;
++ vcpu->arch.arch_capabilities = data;
++ break;
+ case MSR_EFER:
+ return set_efer(vcpu, data);
+ case MSR_K7_HWCR:
+@@ -2654,6 +2659,12 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ case MSR_IA32_UCODE_REV:
+ msr_info->data = vcpu->arch.microcode_version;
+ break;
++ case MSR_IA32_ARCH_CAPABILITIES:
++ if (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_ARCH_CAPABILITIES))
++ return 1;
++ msr_info->data = vcpu->arch.arch_capabilities;
++ break;
+ case MSR_IA32_TSC:
+ msr_info->data = kvm_scale_tsc(vcpu, rdtsc()) + vcpu->arch.tsc_offset;
+ break;
+@@ -6317,14 +6328,27 @@ int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu,
+ }
+ EXPORT_SYMBOL_GPL(kvm_emulate_instruction_from_buffer);
+
++static int complete_fast_pio_out(struct kvm_vcpu *vcpu)
++{
++ vcpu->arch.pio.count = 0;
++
++ if (unlikely(!kvm_is_linear_rip(vcpu, vcpu->arch.pio.linear_rip)))
++ return 1;
++
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
+ static int kvm_fast_pio_out(struct kvm_vcpu *vcpu, int size,
+ unsigned short port)
+ {
+ unsigned long val = kvm_register_read(vcpu, VCPU_REGS_RAX);
+ int ret = emulator_pio_out_emulated(&vcpu->arch.emulate_ctxt,
+ size, port, &val, 1);
+- /* do not return to emulator after return from userspace */
+- vcpu->arch.pio.count = 0;
++
++ if (!ret) {
++ vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu);
++ vcpu->arch.complete_userspace_io = complete_fast_pio_out;
++ }
+ return ret;
+ }
+
+@@ -6335,6 +6359,11 @@ static int complete_fast_pio_in(struct kvm_vcpu *vcpu)
+ /* We should only ever be called with arch.pio.count equal to 1 */
+ BUG_ON(vcpu->arch.pio.count != 1);
+
++ if (unlikely(!kvm_is_linear_rip(vcpu, vcpu->arch.pio.linear_rip))) {
++ vcpu->arch.pio.count = 0;
++ return 1;
++ }
++
+ /* For size less than 4 we merge, else we zero extend */
+ val = (vcpu->arch.pio.size < 4) ? kvm_register_read(vcpu, VCPU_REGS_RAX)
+ : 0;
+@@ -6347,7 +6376,7 @@ static int complete_fast_pio_in(struct kvm_vcpu *vcpu)
+ vcpu->arch.pio.port, &val, 1);
+ kvm_register_write(vcpu, VCPU_REGS_RAX, val);
+
+- return 1;
++ return kvm_skip_emulated_instruction(vcpu);
+ }
+
+ static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size,
+@@ -6366,6 +6395,7 @@ static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size,
+ return ret;
+ }
+
++ vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu);
+ vcpu->arch.complete_userspace_io = complete_fast_pio_in;
+
+ return 0;
+@@ -6373,16 +6403,13 @@ static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size,
+
+ int kvm_fast_pio(struct kvm_vcpu *vcpu, int size, unsigned short port, int in)
+ {
+- int ret = kvm_skip_emulated_instruction(vcpu);
++ int ret;
+
+- /*
+- * TODO: we might be squashing a KVM_GUESTDBG_SINGLESTEP-triggered
+- * KVM_EXIT_DEBUG here.
+- */
+ if (in)
+- return kvm_fast_pio_in(vcpu, size, port) && ret;
++ ret = kvm_fast_pio_in(vcpu, size, port);
+ else
+- return kvm_fast_pio_out(vcpu, size, port) && ret;
++ ret = kvm_fast_pio_out(vcpu, size, port);
++ return ret && kvm_skip_emulated_instruction(vcpu);
+ }
+ EXPORT_SYMBOL_GPL(kvm_fast_pio);
+
+@@ -8485,6 +8512,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
+
+ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
+ {
++ vcpu->arch.arch_capabilities = kvm_get_arch_capabilities();
+ kvm_vcpu_mtrr_init(vcpu);
+ vcpu_load(vcpu);
+ kvm_vcpu_reset(vcpu, false);
+diff --git a/drivers/char/ipmi/ipmi_si.h b/drivers/char/ipmi/ipmi_si.h
+index 52f6152d1fcb..7ae52c17618e 100644
+--- a/drivers/char/ipmi/ipmi_si.h
++++ b/drivers/char/ipmi/ipmi_si.h
+@@ -25,7 +25,9 @@ void ipmi_irq_finish_setup(struct si_sm_io *io);
+ int ipmi_si_remove_by_dev(struct device *dev);
+ void ipmi_si_remove_by_data(int addr_space, enum si_type si_type,
+ unsigned long addr);
+-int ipmi_si_hardcode_find_bmc(void);
++void ipmi_hardcode_init(void);
++void ipmi_si_hardcode_exit(void);
++int ipmi_si_hardcode_match(int addr_type, unsigned long addr);
+ void ipmi_si_platform_init(void);
+ void ipmi_si_platform_shutdown(void);
+
+diff --git a/drivers/char/ipmi/ipmi_si_hardcode.c b/drivers/char/ipmi/ipmi_si_hardcode.c
+index 10219f24546b..9ae2405c28bb 100644
+--- a/drivers/char/ipmi/ipmi_si_hardcode.c
++++ b/drivers/char/ipmi/ipmi_si_hardcode.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0+
+
+ #include <linux/moduleparam.h>
++#include <linux/platform_device.h>
+ #include "ipmi_si.h"
+
+ #define PFX "ipmi_hardcode: "
+@@ -11,23 +12,22 @@
+
+ #define SI_MAX_PARMS 4
+
+-static char *si_type[SI_MAX_PARMS];
+ #define MAX_SI_TYPE_STR 30
+-static char si_type_str[MAX_SI_TYPE_STR];
++static char si_type_str[MAX_SI_TYPE_STR] __initdata;
+ static unsigned long addrs[SI_MAX_PARMS];
+ static unsigned int num_addrs;
+ static unsigned int ports[SI_MAX_PARMS];
+ static unsigned int num_ports;
+-static int irqs[SI_MAX_PARMS];
+-static unsigned int num_irqs;
+-static int regspacings[SI_MAX_PARMS];
+-static unsigned int num_regspacings;
+-static int regsizes[SI_MAX_PARMS];
+-static unsigned int num_regsizes;
+-static int regshifts[SI_MAX_PARMS];
+-static unsigned int num_regshifts;
+-static int slave_addrs[SI_MAX_PARMS]; /* Leaving 0 chooses the default value */
+-static unsigned int num_slave_addrs;
++static int irqs[SI_MAX_PARMS] __initdata;
++static unsigned int num_irqs __initdata;
++static int regspacings[SI_MAX_PARMS] __initdata;
++static unsigned int num_regspacings __initdata;
++static int regsizes[SI_MAX_PARMS] __initdata;
++static unsigned int num_regsizes __initdata;
++static int regshifts[SI_MAX_PARMS] __initdata;
++static unsigned int num_regshifts __initdata;
++static int slave_addrs[SI_MAX_PARMS] __initdata;
++static unsigned int num_slave_addrs __initdata;
+
+ module_param_string(type, si_type_str, MAX_SI_TYPE_STR, 0);
+ MODULE_PARM_DESC(type, "Defines the type of each interface, each"
+@@ -72,12 +72,133 @@ MODULE_PARM_DESC(slave_addrs, "Set the default IPMB slave address for"
+ " overridden by this parm. This is an array indexed"
+ " by interface number.");
+
+-int ipmi_si_hardcode_find_bmc(void)
++static struct platform_device *ipmi_hc_pdevs[SI_MAX_PARMS];
++
++static void __init ipmi_hardcode_init_one(const char *si_type_str,
++ unsigned int i,
++ unsigned long addr,
++ unsigned int flags)
+ {
+- int ret = -ENODEV;
+- int i;
+- struct si_sm_io io;
++ struct platform_device *pdev;
++ unsigned int num_r = 1, size;
++ struct resource r[4];
++ struct property_entry p[6];
++ enum si_type si_type;
++ unsigned int regspacing, regsize;
++ int rv;
++
++ memset(p, 0, sizeof(p));
++ memset(r, 0, sizeof(r));
++
++ if (!si_type_str || !*si_type_str || strcmp(si_type_str, "kcs") == 0) {
++ size = 2;
++ si_type = SI_KCS;
++ } else if (strcmp(si_type_str, "smic") == 0) {
++ size = 2;
++ si_type = SI_SMIC;
++ } else if (strcmp(si_type_str, "bt") == 0) {
++ size = 3;
++ si_type = SI_BT;
++ } else if (strcmp(si_type_str, "invalid") == 0) {
++ /*
++ * Allow a firmware-specified interface to be
++ * disabled.
++ */
++ size = 1;
++ si_type = SI_TYPE_INVALID;
++ } else {
++ pr_warn("Interface type specified for interface %d, was invalid: %s\n",
++ i, si_type_str);
++ return;
++ }
++
++ regsize = regsizes[i];
++ if (regsize == 0)
++ regsize = DEFAULT_REGSIZE;
++
++ p[0] = PROPERTY_ENTRY_U8("ipmi-type", si_type);
++ p[1] = PROPERTY_ENTRY_U8("slave-addr", slave_addrs[i]);
++ p[2] = PROPERTY_ENTRY_U8("addr-source", SI_HARDCODED);
++ p[3] = PROPERTY_ENTRY_U8("reg-shift", regshifts[i]);
++ p[4] = PROPERTY_ENTRY_U8("reg-size", regsize);
++ /* Last entry must be left NULL to terminate it. */
++
++ /*
++ * Register spacing is derived from the resources in
++ * the IPMI platform code.
++ */
++ regspacing = regspacings[i];
++ if (regspacing == 0)
++ regspacing = regsize;
++
++ r[0].start = addr;
++ r[0].end = r[0].start + regsize - 1;
++ r[0].name = "IPMI Address 1";
++ r[0].flags = flags;
++
++ if (size > 1) {
++ r[1].start = r[0].start + regspacing;
++ r[1].end = r[1].start + regsize - 1;
++ r[1].name = "IPMI Address 2";
++ r[1].flags = flags;
++ num_r++;
++ }
++
++ if (size > 2) {
++ r[2].start = r[1].start + regspacing;
++ r[2].end = r[2].start + regsize - 1;
++ r[2].name = "IPMI Address 3";
++ r[2].flags = flags;
++ num_r++;
++ }
++
++ if (irqs[i]) {
++ r[num_r].start = irqs[i];
++ r[num_r].end = irqs[i];
++ r[num_r].name = "IPMI IRQ";
++ r[num_r].flags = IORESOURCE_IRQ;
++ num_r++;
++ }
++
++ pdev = platform_device_alloc("hardcode-ipmi-si", i);
++ if (!pdev) {
++ pr_err("Error allocating IPMI platform device %d\n", i);
++ return;
++ }
++
++ rv = platform_device_add_resources(pdev, r, num_r);
++ if (rv) {
++ dev_err(&pdev->dev,
++ "Unable to add hard-code resources: %d\n", rv);
++ goto err;
++ }
++
++ rv = platform_device_add_properties(pdev, p);
++ if (rv) {
++ dev_err(&pdev->dev,
++ "Unable to add hard-code properties: %d\n", rv);
++ goto err;
++ }
++
++ rv = platform_device_add(pdev);
++ if (rv) {
++ dev_err(&pdev->dev,
++ "Unable to add hard-code device: %d\n", rv);
++ goto err;
++ }
++
++ ipmi_hc_pdevs[i] = pdev;
++ return;
++
++err:
++ platform_device_put(pdev);
++}
++
++void __init ipmi_hardcode_init(void)
++{
++ unsigned int i;
+ char *str;
++ char *si_type[SI_MAX_PARMS];
+
+ /* Parse out the si_type string into its components. */
+ str = si_type_str;
+@@ -94,54 +215,45 @@ int ipmi_si_hardcode_find_bmc(void)
+ }
+ }
+
+- memset(&io, 0, sizeof(io));
+ for (i = 0; i < SI_MAX_PARMS; i++) {
+- if (!ports[i] && !addrs[i])
+- continue;
+-
+- io.addr_source = SI_HARDCODED;
+- pr_info(PFX "probing via hardcoded address\n");
+-
+- if (!si_type[i] || strcmp(si_type[i], "kcs") == 0) {
+- io.si_type = SI_KCS;
+- } else if (strcmp(si_type[i], "smic") == 0) {
+- io.si_type = SI_SMIC;
+- } else if (strcmp(si_type[i], "bt") == 0) {
+- io.si_type = SI_BT;
+- } else {
+- pr_warn(PFX "Interface type specified for interface %d, was invalid: %s\n",
+- i, si_type[i]);
+- continue;
+- }
++ if (i < num_ports && ports[i])
++ ipmi_hardcode_init_one(si_type[i], i, ports[i],
++ IORESOURCE_IO);
++ if (i < num_addrs && addrs[i])
++ ipmi_hardcode_init_one(si_type[i], i, addrs[i],
++ IORESOURCE_MEM);
++ }
++}
+
+- if (ports[i]) {
+- /* An I/O port */
+- io.addr_data = ports[i];
+- io.addr_type = IPMI_IO_ADDR_SPACE;
+- } else if (addrs[i]) {
+- /* A memory port */
+- io.addr_data = addrs[i];
+- io.addr_type = IPMI_MEM_ADDR_SPACE;
+- } else {
+- pr_warn(PFX "Interface type specified for interface %d, but port and address were not set or set to zero.\n",
+- i);
+- continue;
+- }
++void ipmi_si_hardcode_exit(void)
++{
++ unsigned int i;
+
+- io.addr = NULL;
+- io.regspacing = regspacings[i];
+- if (!io.regspacing)
+- io.regspacing = DEFAULT_REGSPACING;
+- io.regsize = regsizes[i];
+- if (!io.regsize)
+- io.regsize = DEFAULT_REGSIZE;
+- io.regshift = regshifts[i];
+- io.irq = irqs[i];
+- if (io.irq)
+- io.irq_setup = ipmi_std_irq_setup;
+- io.slave_addr = slave_addrs[i];
+-
+- ret = ipmi_si_add_smi(&io);
++ for (i = 0; i < SI_MAX_PARMS; i++) {
++ if (ipmi_hc_pdevs[i])
++ platform_device_unregister(ipmi_hc_pdevs[i]);
+ }
+- return ret;
++}
++
++/*
++ * Returns true of the given address exists as a hardcoded address,
++ * false if not.
++ */
++int ipmi_si_hardcode_match(int addr_type, unsigned long addr)
++{
++ unsigned int i;
++
++ if (addr_type == IPMI_IO_ADDR_SPACE) {
++ for (i = 0; i < num_ports; i++) {
++ if (ports[i] == addr)
++ return 1;
++ }
++ } else {
++ for (i = 0; i < num_addrs; i++) {
++ if (addrs[i] == addr)
++ return 1;
++ }
++ }
++
++ return 0;
+ }
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index 82d831b103f9..75e5006f395a 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -1862,6 +1862,18 @@ int ipmi_si_add_smi(struct si_sm_io *io)
+ int rv = 0;
+ struct smi_info *new_smi, *dup;
+
++ /*
++ * If the user gave us a hard-coded device at the same
++ * address, they presumably want us to use it and not what is
++ * in the firmware.
++ */
++ if (io->addr_source != SI_HARDCODED &&
++ ipmi_si_hardcode_match(io->addr_type, io->addr_data)) {
++ dev_info(io->dev,
++ "Hard-coded device at this address already exists");
++ return -ENODEV;
++ }
++
+ if (!io->io_setup) {
+ if (io->addr_type == IPMI_IO_ADDR_SPACE) {
+ io->io_setup = ipmi_si_port_setup;
+@@ -2094,7 +2106,7 @@ static int try_smi_init(struct smi_info *new_smi)
+ return rv;
+ }
+
+-static int init_ipmi_si(void)
++static int __init init_ipmi_si(void)
+ {
+ struct smi_info *e;
+ enum ipmi_addr_src type = SI_INVALID;
+@@ -2102,12 +2114,9 @@ static int init_ipmi_si(void)
+ if (initialized)
+ return 0;
+
++ ipmi_hardcode_init();
+ pr_info("IPMI System Interface driver.\n");
+
+- /* If the user gave us a device, they presumably want us to use it */
+- if (!ipmi_si_hardcode_find_bmc())
+- goto do_scan;
+-
+ ipmi_si_platform_init();
+
+ ipmi_si_pci_init();
+@@ -2118,7 +2127,6 @@ static int init_ipmi_si(void)
+ with multiple BMCs we assume that there will be several instances
+ of a given type so if we succeed in registering a type then also
+ try to register everything else of the same type */
+-do_scan:
+ mutex_lock(&smi_infos_lock);
+ list_for_each_entry(e, &smi_infos, link) {
+ /* Try to register a device if it has an IRQ and we either
+@@ -2304,6 +2312,8 @@ static void cleanup_ipmi_si(void)
+ list_for_each_entry_safe(e, tmp_e, &smi_infos, link)
+ cleanup_one_si(e);
+ mutex_unlock(&smi_infos_lock);
++
++ ipmi_si_hardcode_exit();
+ }
+ module_exit(cleanup_ipmi_si);
+
+diff --git a/drivers/char/ipmi/ipmi_si_platform.c b/drivers/char/ipmi/ipmi_si_platform.c
+index bf69927502bd..d32b0dd377c5 100644
+--- a/drivers/char/ipmi/ipmi_si_platform.c
++++ b/drivers/char/ipmi/ipmi_si_platform.c
+@@ -126,8 +126,6 @@ ipmi_get_info_from_resources(struct platform_device *pdev,
+ if (res_second->start > io->addr_data)
+ io->regspacing = res_second->start - io->addr_data;
+ }
+- io->regsize = DEFAULT_REGSIZE;
+- io->regshift = 0;
+
+ return res;
+ }
+@@ -135,7 +133,7 @@ ipmi_get_info_from_resources(struct platform_device *pdev,
+ static int platform_ipmi_probe(struct platform_device *pdev)
+ {
+ struct si_sm_io io;
+- u8 type, slave_addr, addr_source;
++ u8 type, slave_addr, addr_source, regsize, regshift;
+ int rv;
+
+ rv = device_property_read_u8(&pdev->dev, "addr-source", &addr_source);
+@@ -147,7 +145,7 @@ static int platform_ipmi_probe(struct platform_device *pdev)
+ if (addr_source == SI_SMBIOS) {
+ if (!si_trydmi)
+ return -ENODEV;
+- } else {
++ } else if (addr_source != SI_HARDCODED) {
+ if (!si_tryplatform)
+ return -ENODEV;
+ }
+@@ -167,11 +165,23 @@ static int platform_ipmi_probe(struct platform_device *pdev)
+ case SI_BT:
+ io.si_type = type;
+ break;
++ case SI_TYPE_INVALID: /* User disabled this in hardcode. */
++ return -ENODEV;
+ default:
+ dev_err(&pdev->dev, "ipmi-type property is invalid\n");
+ return -EINVAL;
+ }
+
++ io.regsize = DEFAULT_REGSIZE;
++ rv = device_property_read_u8(&pdev->dev, "reg-size", ®size);
++ if (!rv)
++ io.regsize = regsize;
++
++ io.regshift = 0;
++ rv = device_property_read_u8(&pdev->dev, "reg-shift", ®shift);
++ if (!rv)
++ io.regshift = regshift;
++
+ if (!ipmi_get_info_from_resources(pdev, &io))
+ return -EINVAL;
+
+@@ -191,7 +201,8 @@ static int platform_ipmi_probe(struct platform_device *pdev)
+
+ io.dev = &pdev->dev;
+
+- pr_info("ipmi_si: SMBIOS: %s %#lx regsize %d spacing %d irq %d\n",
++ pr_info("ipmi_si: %s: %s %#lx regsize %d spacing %d irq %d\n",
++ ipmi_addr_src_to_str(addr_source),
+ (io.addr_type == IPMI_IO_ADDR_SPACE) ? "io" : "mem",
+ io.addr_data, io.regsize, io.regspacing, io.irq);
+
+@@ -356,6 +367,9 @@ static int acpi_ipmi_probe(struct platform_device *pdev)
+ goto err_free;
+ }
+
++ io.regsize = DEFAULT_REGSIZE;
++ io.regshift = 0;
++
+ res = ipmi_get_info_from_resources(pdev, &io);
+ if (!res) {
+ rv = -EINVAL;
+@@ -417,6 +431,11 @@ static int ipmi_remove(struct platform_device *pdev)
+ return ipmi_si_remove_by_dev(&pdev->dev);
+ }
+
++static const struct platform_device_id si_plat_ids[] = {
++ { "hardcode-ipmi-si", 0 },
++ { }
++};
++
+ struct platform_driver ipmi_platform_driver = {
+ .driver = {
+ .name = DEVICE_NAME,
+@@ -425,6 +444,7 @@ struct platform_driver ipmi_platform_driver = {
+ },
+ .probe = ipmi_probe,
+ .remove = ipmi_remove,
++ .id_table = si_plat_ids
+ };
+
+ void ipmi_si_platform_init(void)
+diff --git a/drivers/gpio/gpio-adnp.c b/drivers/gpio/gpio-adnp.c
+index 91b90c0cea73..12acdac85820 100644
+--- a/drivers/gpio/gpio-adnp.c
++++ b/drivers/gpio/gpio-adnp.c
+@@ -132,8 +132,10 @@ static int adnp_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
+ if (err < 0)
+ goto out;
+
+- if (err & BIT(pos))
+- err = -EACCES;
++ if (value & BIT(pos)) {
++ err = -EPERM;
++ goto out;
++ }
+
+ err = 0;
+
+diff --git a/drivers/gpio/gpio-exar.c b/drivers/gpio/gpio-exar.c
+index 0ecd2369c2ca..a09d2f9ebacc 100644
+--- a/drivers/gpio/gpio-exar.c
++++ b/drivers/gpio/gpio-exar.c
+@@ -148,6 +148,8 @@ static int gpio_exar_probe(struct platform_device *pdev)
+ mutex_init(&exar_gpio->lock);
+
+ index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL);
++ if (index < 0)
++ goto err_destroy;
+
+ sprintf(exar_gpio->name, "exar_gpio%d", index);
+ exar_gpio->gpio_chip.label = exar_gpio->name;
+diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
+index a614db310ea2..be15289bff9c 100644
+--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
++++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
+@@ -1446,7 +1446,7 @@ static inline int cmd_address_audit(struct parser_exec_state *s,
+ }
+
+ if (index_mode) {
+- if (guest_gma >= I915_GTT_PAGE_SIZE / sizeof(u64)) {
++ if (guest_gma >= I915_GTT_PAGE_SIZE) {
+ ret = -EFAULT;
+ goto err;
+ }
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+index 1359e5c773e4..f8f9ae6622eb 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -505,6 +505,18 @@ static void vop_core_clks_disable(struct vop *vop)
+ clk_disable(vop->hclk);
+ }
+
++static void vop_win_disable(struct vop *vop, const struct vop_win_data *win)
++{
++ if (win->phy->scl && win->phy->scl->ext) {
++ VOP_SCL_SET_EXT(vop, win, yrgb_hor_scl_mode, SCALE_NONE);
++ VOP_SCL_SET_EXT(vop, win, yrgb_ver_scl_mode, SCALE_NONE);
++ VOP_SCL_SET_EXT(vop, win, cbcr_hor_scl_mode, SCALE_NONE);
++ VOP_SCL_SET_EXT(vop, win, cbcr_ver_scl_mode, SCALE_NONE);
++ }
++
++ VOP_WIN_SET(vop, win, enable, 0);
++}
++
+ static int vop_enable(struct drm_crtc *crtc)
+ {
+ struct vop *vop = to_vop(crtc);
+@@ -550,7 +562,7 @@ static int vop_enable(struct drm_crtc *crtc)
+ struct vop_win *vop_win = &vop->win[i];
+ const struct vop_win_data *win = vop_win->data;
+
+- VOP_WIN_SET(vop, win, enable, 0);
++ vop_win_disable(vop, win);
+ }
+ spin_unlock(&vop->reg_lock);
+
+@@ -694,7 +706,7 @@ static void vop_plane_atomic_disable(struct drm_plane *plane,
+
+ spin_lock(&vop->reg_lock);
+
+- VOP_WIN_SET(vop, win, enable, 0);
++ vop_win_disable(vop, win);
+
+ spin_unlock(&vop->reg_lock);
+ }
+@@ -1449,7 +1461,7 @@ static int vop_initial(struct vop *vop)
+ int channel = i * 2 + 1;
+
+ VOP_WIN_SET(vop, win, channel, (channel + 1) << 4 | channel);
+- VOP_WIN_SET(vop, win, enable, 0);
++ vop_win_disable(vop, win);
+ VOP_WIN_SET(vop, win, gate, 1);
+ }
+
+diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
+index 6887db878b38..4709f08f39e4 100644
+--- a/drivers/gpu/drm/vgem/vgem_drv.c
++++ b/drivers/gpu/drm/vgem/vgem_drv.c
+@@ -191,13 +191,9 @@ static struct drm_gem_object *vgem_gem_create(struct drm_device *dev,
+ ret = drm_gem_handle_create(file, &obj->base, handle);
+ drm_gem_object_put_unlocked(&obj->base);
+ if (ret)
+- goto err;
++ return ERR_PTR(ret);
+
+ return &obj->base;
+-
+-err:
+- __vgem_gem_destroy(obj);
+- return ERR_PTR(ret);
+ }
+
+ static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
+diff --git a/drivers/gpu/drm/vkms/vkms_gem.c b/drivers/gpu/drm/vkms/vkms_gem.c
+index ca4a74e04977..ce394009a36c 100644
+--- a/drivers/gpu/drm/vkms/vkms_gem.c
++++ b/drivers/gpu/drm/vkms/vkms_gem.c
+@@ -110,11 +110,8 @@ struct drm_gem_object *vkms_gem_create(struct drm_device *dev,
+
+ ret = drm_gem_handle_create(file, &obj->gem, handle);
+ drm_gem_object_put_unlocked(&obj->gem);
+- if (ret) {
+- drm_gem_object_release(&obj->gem);
+- kfree(obj);
++ if (ret)
+ return ERR_PTR(ret);
+- }
+
+ return &obj->gem;
+ }
+diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
+index b5948ba6b3b3..fde728ea2900 100644
+--- a/drivers/iommu/io-pgtable-arm-v7s.c
++++ b/drivers/iommu/io-pgtable-arm-v7s.c
+@@ -161,6 +161,14 @@
+
+ #define ARM_V7S_TCR_PD1 BIT(5)
+
++#ifdef CONFIG_ZONE_DMA32
++#define ARM_V7S_TABLE_GFP_DMA GFP_DMA32
++#define ARM_V7S_TABLE_SLAB_FLAGS SLAB_CACHE_DMA32
++#else
++#define ARM_V7S_TABLE_GFP_DMA GFP_DMA
++#define ARM_V7S_TABLE_SLAB_FLAGS SLAB_CACHE_DMA
++#endif
++
+ typedef u32 arm_v7s_iopte;
+
+ static bool selftest_running;
+@@ -198,13 +206,16 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
+ void *table = NULL;
+
+ if (lvl == 1)
+- table = (void *)__get_dma_pages(__GFP_ZERO, get_order(size));
++ table = (void *)__get_free_pages(
++ __GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size));
+ else if (lvl == 2)
+- table = kmem_cache_zalloc(data->l2_tables, gfp | GFP_DMA);
++ table = kmem_cache_zalloc(data->l2_tables, gfp);
+ phys = virt_to_phys(table);
+- if (phys != (arm_v7s_iopte)phys)
++ if (phys != (arm_v7s_iopte)phys) {
+ /* Doesn't fit in PTE */
++ dev_err(dev, "Page table does not fit in PTE: %pa", &phys);
+ goto out_free;
++ }
+ if (table && !(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA)) {
+ dma = dma_map_single(dev, table, size, DMA_TO_DEVICE);
+ if (dma_mapping_error(dev, dma))
+@@ -728,7 +739,7 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,
+ data->l2_tables = kmem_cache_create("io-pgtable_armv7s_l2",
+ ARM_V7S_TABLE_SIZE(2),
+ ARM_V7S_TABLE_SIZE(2),
+- SLAB_CACHE_DMA, NULL);
++ ARM_V7S_TABLE_SLAB_FLAGS, NULL);
+ if (!data->l2_tables)
+ goto out_free_data;
+
+diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
+index 4d85645c87f7..0928fd1f0e0c 100644
+--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
++++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
+@@ -4365,7 +4365,8 @@ setup_pci(struct hfc_multi *hc, struct pci_dev *pdev,
+ if (m->clock2)
+ test_and_set_bit(HFC_CHIP_CLOCK2, &hc->chip);
+
+- if (ent->device == 0xB410) {
++ if (ent->vendor == PCI_VENDOR_ID_DIGIUM &&
++ ent->device == PCI_DEVICE_ID_DIGIUM_HFC4S) {
+ test_and_set_bit(HFC_CHIP_B410P, &hc->chip);
+ test_and_set_bit(HFC_CHIP_PCM_MASTER, &hc->chip);
+ test_and_clear_bit(HFC_CHIP_PCM_SLAVE, &hc->chip);
+diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
+index d03775100f7d..619bf1498a66 100644
+--- a/drivers/net/Kconfig
++++ b/drivers/net/Kconfig
+@@ -213,8 +213,8 @@ config GENEVE
+
+ config GTP
+ tristate "GPRS Tunneling Protocol datapath (GTP-U)"
+- depends on INET && NET_UDP_TUNNEL
+- select NET_IP_TUNNEL
++ depends on INET
++ select NET_UDP_TUNNEL
+ ---help---
+ This allows one to create gtp virtual interfaces that provide
+ the GPRS Tunneling Protocol datapath (GTP-U). This tunneling protocol
+diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
+index cdcde7f8e0b2..bdd8f2df6630 100644
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -620,22 +620,6 @@ qca8k_adjust_link(struct dsa_switch *ds, int port, struct phy_device *phy)
+ qca8k_port_set_status(priv, port, 1);
+ }
+
+-static int
+-qca8k_phy_read(struct dsa_switch *ds, int phy, int regnum)
+-{
+- struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-
+- return mdiobus_read(priv->bus, phy, regnum);
+-}
+-
+-static int
+-qca8k_phy_write(struct dsa_switch *ds, int phy, int regnum, u16 val)
+-{
+- struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv;
+-
+- return mdiobus_write(priv->bus, phy, regnum, val);
+-}
+-
+ static void
+ qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data)
+ {
+@@ -876,8 +860,6 @@ static const struct dsa_switch_ops qca8k_switch_ops = {
+ .setup = qca8k_setup,
+ .adjust_link = qca8k_adjust_link,
+ .get_strings = qca8k_get_strings,
+- .phy_read = qca8k_phy_read,
+- .phy_write = qca8k_phy_write,
+ .get_ethtool_stats = qca8k_get_ethtool_stats,
+ .get_sset_count = qca8k_get_sset_count,
+ .get_mac_eee = qca8k_get_mac_eee,
+diff --git a/drivers/net/ethernet/8390/mac8390.c b/drivers/net/ethernet/8390/mac8390.c
+index 342ae08ec3c2..d60a86aa8aa8 100644
+--- a/drivers/net/ethernet/8390/mac8390.c
++++ b/drivers/net/ethernet/8390/mac8390.c
+@@ -153,8 +153,6 @@ static void dayna_block_input(struct net_device *dev, int count,
+ static void dayna_block_output(struct net_device *dev, int count,
+ const unsigned char *buf, int start_page);
+
+-#define memcmp_withio(a, b, c) memcmp((a), (void *)(b), (c))
+-
+ /* Slow Sane (16-bit chunk memory read/write) Cabletron uses this */
+ static void slow_sane_get_8390_hdr(struct net_device *dev,
+ struct e8390_pkt_hdr *hdr, int ring_page);
+@@ -233,19 +231,26 @@ static enum mac8390_type mac8390_ident(struct nubus_rsrc *fres)
+
+ static enum mac8390_access mac8390_testio(unsigned long membase)
+ {
+- unsigned long outdata = 0xA5A0B5B0;
+- unsigned long indata = 0x00000000;
++ u32 outdata = 0xA5A0B5B0;
++ u32 indata = 0;
++
+ /* Try writing 32 bits */
+- memcpy_toio((void __iomem *)membase, &outdata, 4);
+- /* Now compare them */
+- if (memcmp_withio(&outdata, membase, 4) == 0)
++ nubus_writel(outdata, membase);
++ /* Now read it back */
++ indata = nubus_readl(membase);
++ if (outdata == indata)
+ return ACCESS_32;
++
++ outdata = 0xC5C0D5D0;
++ indata = 0;
++
+ /* Write 16 bit output */
+ word_memcpy_tocard(membase, &outdata, 4);
+ /* Now read it back */
+ word_memcpy_fromcard(&indata, membase, 4);
+ if (outdata == indata)
+ return ACCESS_16;
++
+ return ACCESS_UNKNOWN;
+ }
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index 7134d0d4cdf7..6f3312350cac 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -186,11 +186,12 @@ static void aq_rx_checksum(struct aq_ring_s *self,
+ }
+ if (buff->is_ip_cso) {
+ __skb_incr_checksum_unnecessary(skb);
+- if (buff->is_udp_cso || buff->is_tcp_cso)
+- __skb_incr_checksum_unnecessary(skb);
+ } else {
+ skb->ip_summed = CHECKSUM_NONE;
+ }
++
++ if (buff->is_udp_cso || buff->is_tcp_cso)
++ __skb_incr_checksum_unnecessary(skb);
+ }
+
+ #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+index fcaf18fa3904..9a4cfa61ed93 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+@@ -105,20 +105,19 @@ static inline struct pgcache *nicvf_alloc_page(struct nicvf *nic,
+ /* Check if page can be recycled */
+ if (page) {
+ ref_count = page_ref_count(page);
+- /* Check if this page has been used once i.e 'put_page'
+- * called after packet transmission i.e internal ref_count
+- * and page's ref_count are equal i.e page can be recycled.
++ /* This page can be recycled if internal ref_count and page's
++ * ref_count are equal, indicating that the page has been used
++ * once for packet transmission. For non-XDP mode, internal
++ * ref_count is always '1'.
+ */
+- if (rbdr->is_xdp && (ref_count == pgcache->ref_count))
+- pgcache->ref_count--;
+- else
+- page = NULL;
+-
+- /* In non-XDP mode, page's ref_count needs to be '1' for it
+- * to be recycled.
+- */
+- if (!rbdr->is_xdp && (ref_count != 1))
++ if (rbdr->is_xdp) {
++ if (ref_count == pgcache->ref_count)
++ pgcache->ref_count--;
++ else
++ page = NULL;
++ } else if (ref_count != 1) {
+ page = NULL;
++ }
+ }
+
+ if (!page) {
+@@ -365,11 +364,10 @@ static void nicvf_free_rbdr(struct nicvf *nic, struct rbdr *rbdr)
+ while (head < rbdr->pgcnt) {
+ pgcache = &rbdr->pgcache[head];
+ if (pgcache->page && page_ref_count(pgcache->page) != 0) {
+- if (!rbdr->is_xdp) {
+- put_page(pgcache->page);
+- continue;
++ if (rbdr->is_xdp) {
++ page_ref_sub(pgcache->page,
++ pgcache->ref_count - 1);
+ }
+- page_ref_sub(pgcache->page, pgcache->ref_count - 1);
+ put_page(pgcache->page);
+ }
+ head++;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+index bc83ced94e1b..afed0f0f4027 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
++++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+@@ -111,10 +111,11 @@ static unsigned int is_jumbo_frm(int len, int enh_desc)
+
+ static void refill_desc3(void *priv_ptr, struct dma_desc *p)
+ {
+- struct stmmac_priv *priv = (struct stmmac_priv *)priv_ptr;
++ struct stmmac_rx_queue *rx_q = priv_ptr;
++ struct stmmac_priv *priv = rx_q->priv_data;
+
+ /* Fill DES3 in case of RING mode */
+- if (priv->dma_buf_sz >= BUF_SIZE_8KiB)
++ if (priv->dma_buf_sz == BUF_SIZE_16KiB)
+ p->des3 = cpu_to_le32(le32_to_cpu(p->des2) + BUF_SIZE_8KiB);
+ }
+
+diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c
+index ddc2c5ea3787..7ceebbc4bcc2 100644
+--- a/drivers/net/phy/meson-gxl.c
++++ b/drivers/net/phy/meson-gxl.c
+@@ -211,6 +211,7 @@ static int meson_gxl_ack_interrupt(struct phy_device *phydev)
+ static int meson_gxl_config_intr(struct phy_device *phydev)
+ {
+ u16 val;
++ int ret;
+
+ if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+ val = INTSRC_ANEG_PR
+@@ -223,6 +224,11 @@ static int meson_gxl_config_intr(struct phy_device *phydev)
+ val = 0;
+ }
+
++ /* Ack any pending IRQ */
++ ret = meson_gxl_ack_interrupt(phydev);
++ if (ret)
++ return ret;
++
+ return phy_write(phydev, INTSRC_MASK, val);
+ }
+
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index f3293355c784..044d5c3a4d04 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1718,9 +1718,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ int skb_xdp = 1;
+ bool frags = tun_napi_frags_enabled(tfile);
+
+- if (!(tun->dev->flags & IFF_UP))
+- return -EIO;
+-
+ if (!(tun->flags & IFF_NO_PI)) {
+ if (len < sizeof(pi))
+ return -EINVAL;
+@@ -1822,6 +1819,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ err = skb_copy_datagram_from_iter(skb, 0, from, len);
+
+ if (err) {
++ err = -EFAULT;
++drop:
+ this_cpu_inc(tun->pcpu_stats->rx_dropped);
+ kfree_skb(skb);
+ if (frags) {
+@@ -1829,7 +1828,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ mutex_unlock(&tfile->napi_mutex);
+ }
+
+- return -EFAULT;
++ return err;
+ }
+ }
+
+@@ -1913,6 +1912,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ !tfile->detached)
+ rxhash = __skb_get_hash_symmetric(skb);
+
++ rcu_read_lock();
++ if (unlikely(!(tun->dev->flags & IFF_UP))) {
++ err = -EIO;
++ rcu_read_unlock();
++ goto drop;
++ }
++
+ if (frags) {
+ /* Exercise flow dissector code path. */
+ u32 headlen = eth_get_headlen(skb->data, skb_headlen(skb));
+@@ -1920,6 +1926,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ if (unlikely(headlen > skb_headlen(skb))) {
+ this_cpu_inc(tun->pcpu_stats->rx_dropped);
+ napi_free_frags(&tfile->napi);
++ rcu_read_unlock();
+ mutex_unlock(&tfile->napi_mutex);
+ WARN_ON(1);
+ return -ENOMEM;
+@@ -1947,6 +1954,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
+ } else {
+ netif_rx_ni(skb);
+ }
++ rcu_read_unlock();
+
+ stats = get_cpu_ptr(tun->pcpu_stats);
+ u64_stats_update_begin(&stats->syncp);
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index f93547f257fb..449fc52f9a89 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -1262,6 +1262,7 @@ static void vrf_setup(struct net_device *dev)
+
+ /* default to no qdisc; user can add if desired */
+ dev->priv_flags |= IFF_NO_QUEUE;
++ dev->priv_flags |= IFF_NO_RX_HANDLER;
+ }
+
+ static int vrf_validate(struct nlattr *tb[], struct nlattr *data[],
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 52387f7f12ed..0b1ec44acbf9 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3798,10 +3798,8 @@ static void vxlan_destroy_tunnels(struct net *net, struct list_head *head)
+ /* If vxlan->dev is in the same netns, it has already been added
+ * to the list by the previous loop.
+ */
+- if (!net_eq(dev_net(vxlan->dev), net)) {
+- gro_cells_destroy(&vxlan->gro_cells);
++ if (!net_eq(dev_net(vxlan->dev), net))
+ unregister_netdevice_queue(vxlan->dev, head);
+- }
+ }
+
+ for (h = 0; h < PORT_HASH_SIZE; ++h)
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index 881078ff73f6..15c8fc2abf01 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -481,8 +481,11 @@ static int sun4i_usb_phy_set_mode(struct phy *_phy, enum phy_mode mode)
+ struct sun4i_usb_phy_data *data = to_sun4i_usb_phy_data(phy);
+ int new_mode;
+
+- if (phy->index != 0)
++ if (phy->index != 0) {
++ if (mode == PHY_MODE_USB_HOST)
++ return 0;
+ return -EINVAL;
++ }
+
+ switch (mode) {
+ case PHY_MODE_USB_HOST:
+diff --git a/drivers/platform/x86/intel_cht_int33fe.c b/drivers/platform/x86/intel_cht_int33fe.c
+index 39d4100c60a2..a26f410800c2 100644
+--- a/drivers/platform/x86/intel_cht_int33fe.c
++++ b/drivers/platform/x86/intel_cht_int33fe.c
+@@ -34,7 +34,7 @@ struct cht_int33fe_data {
+ struct i2c_client *fusb302;
+ struct i2c_client *pi3usb30532;
+ /* Contain a list-head must be per device */
+- struct device_connection connections[3];
++ struct device_connection connections[5];
+ };
+
+ /*
+@@ -174,19 +174,20 @@ static int cht_int33fe_probe(struct i2c_client *client)
+ return -EPROBE_DEFER; /* Wait for i2c-adapter to load */
+ }
+
+- data->connections[0].endpoint[0] = "i2c-fusb302";
++ data->connections[0].endpoint[0] = "port0";
+ data->connections[0].endpoint[1] = "i2c-pi3usb30532";
+ data->connections[0].id = "typec-switch";
+- data->connections[1].endpoint[0] = "i2c-fusb302";
++ data->connections[1].endpoint[0] = "port0";
+ data->connections[1].endpoint[1] = "i2c-pi3usb30532";
+ data->connections[1].id = "typec-mux";
+- data->connections[2].endpoint[0] = "i2c-fusb302";
+- data->connections[2].endpoint[1] = "intel_xhci_usb_sw-role-switch";
+- data->connections[2].id = "usb-role-switch";
++ data->connections[2].endpoint[0] = "port0";
++ data->connections[2].endpoint[1] = "i2c-pi3usb30532";
++ data->connections[2].id = "idff01m01";
++ data->connections[3].endpoint[0] = "i2c-fusb302";
++ data->connections[3].endpoint[1] = "intel_xhci_usb_sw-role-switch";
++ data->connections[3].id = "usb-role-switch";
+
+- device_connection_add(&data->connections[0]);
+- device_connection_add(&data->connections[1]);
+- device_connection_add(&data->connections[2]);
++ device_connections_add(data->connections);
+
+ memset(&board_info, 0, sizeof(board_info));
+ strlcpy(board_info.type, "typec_fusb302", I2C_NAME_SIZE);
+@@ -217,9 +218,7 @@ out_unregister_max17047:
+ if (data->max17047)
+ i2c_unregister_device(data->max17047);
+
+- device_connection_remove(&data->connections[2]);
+- device_connection_remove(&data->connections[1]);
+- device_connection_remove(&data->connections[0]);
++ device_connections_remove(data->connections);
+
+ return -EPROBE_DEFER; /* Wait for the i2c-adapter to load */
+ }
+@@ -233,9 +232,7 @@ static int cht_int33fe_remove(struct i2c_client *i2c)
+ if (data->max17047)
+ i2c_unregister_device(data->max17047);
+
+- device_connection_remove(&data->connections[2]);
+- device_connection_remove(&data->connections[1]);
+- device_connection_remove(&data->connections[0]);
++ device_connections_remove(data->connections);
+
+ return 0;
+ }
+diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
+index f47d16b5810b..fabd9798e4c4 100644
+--- a/drivers/s390/cio/vfio_ccw_drv.c
++++ b/drivers/s390/cio/vfio_ccw_drv.c
+@@ -72,20 +72,24 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work)
+ {
+ struct vfio_ccw_private *private;
+ struct irb *irb;
++ bool is_final;
+
+ private = container_of(work, struct vfio_ccw_private, io_work);
+ irb = &private->irb;
+
++ is_final = !(scsw_actl(&irb->scsw) &
++ (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT));
+ if (scsw_is_solicited(&irb->scsw)) {
+ cp_update_scsw(&private->cp, &irb->scsw);
+- cp_free(&private->cp);
++ if (is_final)
++ cp_free(&private->cp);
+ }
+ memcpy(private->io_region->irb_area, irb, sizeof(*irb));
+
+ if (private->io_trigger)
+ eventfd_signal(private->io_trigger, 1);
+
+- if (private->mdev)
++ if (private->mdev && is_final)
+ private->state = VFIO_CCW_STATE_IDLE;
+ }
+
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index e7e6b63905e2..ebdbc457003f 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -643,6 +643,20 @@ static void zfcp_erp_strategy_memwait(struct zfcp_erp_action *erp_action)
+ add_timer(&erp_action->timer);
+ }
+
++void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter,
++ int clear, char *dbftag)
++{
++ unsigned long flags;
++ struct zfcp_port *port;
++
++ write_lock_irqsave(&adapter->erp_lock, flags);
++ read_lock(&adapter->port_list_lock);
++ list_for_each_entry(port, &adapter->port_list, list)
++ _zfcp_erp_port_forced_reopen(port, clear, dbftag);
++ read_unlock(&adapter->port_list_lock);
++ write_unlock_irqrestore(&adapter->erp_lock, flags);
++}
++
+ static void _zfcp_erp_port_reopen_all(struct zfcp_adapter *adapter,
+ int clear, char *id)
+ {
+@@ -1297,6 +1311,9 @@ static void zfcp_erp_try_rport_unblock(struct zfcp_port *port)
+ struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
+ int lun_status;
+
++ if (sdev->sdev_state == SDEV_DEL ||
++ sdev->sdev_state == SDEV_CANCEL)
++ continue;
+ if (zsdev->port != port)
+ continue;
+ /* LUN under port of interest */
+diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
+index bd0c5a9f04cb..1b4d6a3afb8f 100644
+--- a/drivers/s390/scsi/zfcp_ext.h
++++ b/drivers/s390/scsi/zfcp_ext.h
+@@ -69,6 +69,8 @@ extern void zfcp_erp_clear_port_status(struct zfcp_port *, u32);
+ extern void zfcp_erp_port_reopen(struct zfcp_port *port, int clear, char *id);
+ extern void zfcp_erp_port_shutdown(struct zfcp_port *, int, char *);
+ extern void zfcp_erp_port_forced_reopen(struct zfcp_port *, int, char *);
++extern void zfcp_erp_port_forced_reopen_all(struct zfcp_adapter *adapter,
++ int clear, char *dbftag);
+ extern void zfcp_erp_set_lun_status(struct scsi_device *, u32);
+ extern void zfcp_erp_clear_lun_status(struct scsi_device *, u32);
+ extern void zfcp_erp_lun_reopen(struct scsi_device *, int, char *);
+diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
+index a8efcb330bc1..a4bbfa4ef653 100644
+--- a/drivers/s390/scsi/zfcp_scsi.c
++++ b/drivers/s390/scsi/zfcp_scsi.c
+@@ -362,6 +362,10 @@ static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt)
+ struct zfcp_adapter *adapter = zfcp_sdev->port->adapter;
+ int ret = SUCCESS, fc_ret;
+
++ if (!(adapter->connection_features & FSF_FEATURE_NPIV_MODE)) {
++ zfcp_erp_port_forced_reopen_all(adapter, 0, "schrh_p");
++ zfcp_erp_wait(adapter);
++ }
+ zfcp_erp_adapter_reopen(adapter, 0, "schrh_1");
+ zfcp_erp_wait(adapter);
+ fc_ret = fc_block_scsi_eh(scpnt);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index a3a5162fa60e..e925eda93191 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1408,11 +1408,6 @@ static void sd_release(struct gendisk *disk, fmode_t mode)
+ scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW);
+ }
+
+- /*
+- * XXX and what if there are packets in flight and this close()
+- * XXX is followed by a "rmmod sd_mod"?
+- */
+-
+ scsi_disk_put(sdkp);
+ }
+
+@@ -3078,6 +3073,9 @@ static bool sd_validate_opt_xfer_size(struct scsi_disk *sdkp,
+ unsigned int opt_xfer_bytes =
+ logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
+
++ if (sdkp->opt_xfer_blocks == 0)
++ return false;
++
+ if (sdkp->opt_xfer_blocks > dev_max) {
+ sd_first_printk(KERN_WARNING, sdkp,
+ "Optimal transfer size %u logical blocks " \
+@@ -3509,9 +3507,21 @@ static void scsi_disk_release(struct device *dev)
+ {
+ struct scsi_disk *sdkp = to_scsi_disk(dev);
+ struct gendisk *disk = sdkp->disk;
+-
++ struct request_queue *q = disk->queue;
++
+ ida_free(&sd_index_ida, sdkp->index);
+
++ /*
++ * Wait until all requests that are in progress have completed.
++ * This is necessary to avoid that e.g. scsi_end_request() crashes
++ * due to clearing the disk->private_data pointer. Wait from inside
++ * scsi_disk_release() instead of from sd_release() to avoid that
++ * freezing and unfreezing the request queue affects user space I/O
++ * in case multiple processes open a /dev/sd... node concurrently.
++ */
++ blk_mq_freeze_queue(q);
++ blk_mq_unfreeze_queue(q);
++
+ disk->private_data = NULL;
+ put_disk(disk);
+ put_device(&sdkp->device->sdev_gendev);
+diff --git a/drivers/staging/comedi/comedidev.h b/drivers/staging/comedi/comedidev.h
+index 5775a93917f4..fbbdf4b0f6c5 100644
+--- a/drivers/staging/comedi/comedidev.h
++++ b/drivers/staging/comedi/comedidev.h
+@@ -987,6 +987,8 @@ int comedi_dio_insn_config(struct comedi_device *dev,
+ unsigned int mask);
+ unsigned int comedi_dio_update_state(struct comedi_subdevice *s,
+ unsigned int *data);
++unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s,
++ struct comedi_cmd *cmd);
+ unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s);
+ unsigned int comedi_nscans_left(struct comedi_subdevice *s,
+ unsigned int nscans);
+diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
+index 57dd63d548b7..5329a3955214 100644
+--- a/drivers/staging/comedi/drivers.c
++++ b/drivers/staging/comedi/drivers.c
+@@ -381,11 +381,13 @@ unsigned int comedi_dio_update_state(struct comedi_subdevice *s,
+ EXPORT_SYMBOL_GPL(comedi_dio_update_state);
+
+ /**
+- * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes
++ * comedi_bytes_per_scan_cmd() - Get length of asynchronous command "scan" in
++ * bytes
+ * @s: COMEDI subdevice.
++ * @cmd: COMEDI command.
+ *
+ * Determines the overall scan length according to the subdevice type and the
+- * number of channels in the scan.
++ * number of channels in the scan for the specified command.
+ *
+ * For digital input, output or input/output subdevices, samples for
+ * multiple channels are assumed to be packed into one or more unsigned
+@@ -395,9 +397,9 @@ EXPORT_SYMBOL_GPL(comedi_dio_update_state);
+ *
+ * Returns the overall scan length in bytes.
+ */
+-unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s)
++unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s,
++ struct comedi_cmd *cmd)
+ {
+- struct comedi_cmd *cmd = &s->async->cmd;
+ unsigned int num_samples;
+ unsigned int bits_per_sample;
+
+@@ -414,6 +416,29 @@ unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s)
+ }
+ return comedi_samples_to_bytes(s, num_samples);
+ }
++EXPORT_SYMBOL_GPL(comedi_bytes_per_scan_cmd);
++
++/**
++ * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes
++ * @s: COMEDI subdevice.
++ *
++ * Determines the overall scan length according to the subdevice type and the
++ * number of channels in the scan for the current command.
++ *
++ * For digital input, output or input/output subdevices, samples for
++ * multiple channels are assumed to be packed into one or more unsigned
++ * short or unsigned int values according to the subdevice's %SDF_LSAMPL
++ * flag. For other types of subdevice, samples are assumed to occupy a
++ * whole unsigned short or unsigned int according to the %SDF_LSAMPL flag.
++ *
++ * Returns the overall scan length in bytes.
++ */
++unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s)
++{
++ struct comedi_cmd *cmd = &s->async->cmd;
++
++ return comedi_bytes_per_scan_cmd(s, cmd);
++}
+ EXPORT_SYMBOL_GPL(comedi_bytes_per_scan);
+
+ static unsigned int __comedi_nscans_left(struct comedi_subdevice *s,
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index 4dee2fc37aed..d799b1b55de3 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -3516,6 +3516,7 @@ static int ni_cdio_check_chanlist(struct comedi_device *dev,
+ static int ni_cdio_cmdtest(struct comedi_device *dev,
+ struct comedi_subdevice *s, struct comedi_cmd *cmd)
+ {
++ unsigned int bytes_per_scan;
+ int err = 0;
+ int tmp;
+
+@@ -3545,9 +3546,12 @@ static int ni_cdio_cmdtest(struct comedi_device *dev,
+ err |= comedi_check_trigger_arg_is(&cmd->convert_arg, 0);
+ err |= comedi_check_trigger_arg_is(&cmd->scan_end_arg,
+ cmd->chanlist_len);
+- err |= comedi_check_trigger_arg_max(&cmd->stop_arg,
+- s->async->prealloc_bufsz /
+- comedi_bytes_per_scan(s));
++ bytes_per_scan = comedi_bytes_per_scan_cmd(s, cmd);
++ if (bytes_per_scan) {
++ err |= comedi_check_trigger_arg_max(&cmd->stop_arg,
++ s->async->prealloc_bufsz /
++ bytes_per_scan);
++ }
+
+ if (err)
+ return 3;
+diff --git a/drivers/staging/erofs/dir.c b/drivers/staging/erofs/dir.c
+index 04b84ff31d03..0a089cf5c78f 100644
+--- a/drivers/staging/erofs/dir.c
++++ b/drivers/staging/erofs/dir.c
+@@ -23,6 +23,21 @@ static const unsigned char erofs_filetype_table[EROFS_FT_MAX] = {
+ [EROFS_FT_SYMLINK] = DT_LNK,
+ };
+
++static void debug_one_dentry(unsigned char d_type, const char *de_name,
++ unsigned int de_namelen)
++{
++#ifdef CONFIG_EROFS_FS_DEBUG
++ /* since the on-disk name could not have the trailing '\0' */
++ unsigned char dbg_namebuf[EROFS_NAME_LEN + 1];
++
++ memcpy(dbg_namebuf, de_name, de_namelen);
++ dbg_namebuf[de_namelen] = '\0';
++
++ debugln("found dirent %s de_len %u d_type %d", dbg_namebuf,
++ de_namelen, d_type);
++#endif
++}
++
+ static int erofs_fill_dentries(struct dir_context *ctx,
+ void *dentry_blk, unsigned *ofs,
+ unsigned nameoff, unsigned maxsize)
+@@ -33,14 +48,10 @@ static int erofs_fill_dentries(struct dir_context *ctx,
+ de = dentry_blk + *ofs;
+ while (de < end) {
+ const char *de_name;
+- int de_namelen;
++ unsigned int de_namelen;
+ unsigned char d_type;
+-#ifdef CONFIG_EROFS_FS_DEBUG
+- unsigned dbg_namelen;
+- unsigned char dbg_namebuf[EROFS_NAME_LEN];
+-#endif
+
+- if (unlikely(de->file_type < EROFS_FT_MAX))
++ if (de->file_type < EROFS_FT_MAX)
+ d_type = erofs_filetype_table[de->file_type];
+ else
+ d_type = DT_UNKNOWN;
+@@ -48,26 +59,20 @@ static int erofs_fill_dentries(struct dir_context *ctx,
+ nameoff = le16_to_cpu(de->nameoff);
+ de_name = (char *)dentry_blk + nameoff;
+
+- de_namelen = unlikely(de + 1 >= end) ?
+- /* last directory entry */
+- strnlen(de_name, maxsize - nameoff) :
+- le16_to_cpu(de[1].nameoff) - nameoff;
++ /* the last dirent in the block? */
++ if (de + 1 >= end)
++ de_namelen = strnlen(de_name, maxsize - nameoff);
++ else
++ de_namelen = le16_to_cpu(de[1].nameoff) - nameoff;
+
+ /* a corrupted entry is found */
+- if (unlikely(de_namelen < 0)) {
++ if (unlikely(nameoff + de_namelen > maxsize ||
++ de_namelen > EROFS_NAME_LEN)) {
+ DBG_BUGON(1);
+ return -EIO;
+ }
+
+-#ifdef CONFIG_EROFS_FS_DEBUG
+- dbg_namelen = min(EROFS_NAME_LEN - 1, de_namelen);
+- memcpy(dbg_namebuf, de_name, dbg_namelen);
+- dbg_namebuf[dbg_namelen] = '\0';
+-
+- debugln("%s, found de_name %s de_len %d d_type %d", __func__,
+- dbg_namebuf, de_namelen, d_type);
+-#endif
+-
++ debug_one_dentry(d_type, de_name, de_namelen);
+ if (!dir_emit(ctx, de_name, de_namelen,
+ le64_to_cpu(de->nid), d_type))
+ /* stoped by some reason */
+diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c
+index f44662dd795c..ad6fe6d9d00a 100644
+--- a/drivers/staging/erofs/unzip_vle.c
++++ b/drivers/staging/erofs/unzip_vle.c
+@@ -885,6 +885,7 @@ repeat:
+ overlapped = false;
+ compressed_pages = grp->compressed_pages;
+
++ err = 0;
+ for (i = 0; i < clusterpages; ++i) {
+ unsigned pagenr;
+
+@@ -894,26 +895,39 @@ repeat:
+ DBG_BUGON(page == NULL);
+ DBG_BUGON(page->mapping == NULL);
+
+- if (z_erofs_is_stagingpage(page))
+- continue;
++ if (!z_erofs_is_stagingpage(page)) {
+ #ifdef EROFS_FS_HAS_MANAGED_CACHE
+- if (page->mapping == mngda) {
+- DBG_BUGON(!PageUptodate(page));
+- continue;
+- }
++ if (page->mapping == mngda) {
++ if (unlikely(!PageUptodate(page)))
++ err = -EIO;
++ continue;
++ }
+ #endif
+
+- /* only non-head page could be reused as a compressed page */
+- pagenr = z_erofs_onlinepage_index(page);
++ /*
++ * only if non-head page can be selected
++ * for inplace decompression
++ */
++ pagenr = z_erofs_onlinepage_index(page);
+
+- DBG_BUGON(pagenr >= nr_pages);
+- DBG_BUGON(pages[pagenr]);
+- ++sparsemem_pages;
+- pages[pagenr] = page;
++ DBG_BUGON(pagenr >= nr_pages);
++ DBG_BUGON(pages[pagenr]);
++ ++sparsemem_pages;
++ pages[pagenr] = page;
+
+- overlapped = true;
++ overlapped = true;
++ }
++
++ /* PG_error needs checking for inplaced and staging pages */
++ if (unlikely(PageError(page))) {
++ DBG_BUGON(PageUptodate(page));
++ err = -EIO;
++ }
+ }
+
++ if (unlikely(err))
++ goto out;
++
+ llen = (nr_pages << PAGE_SHIFT) - work->pageofs;
+
+ if (z_erofs_vle_workgrp_fmt(grp) == Z_EROFS_VLE_WORKGRP_FMT_PLAIN) {
+@@ -942,6 +956,10 @@ repeat:
+
+ skip_allocpage:
+ vout = erofs_vmap(pages, nr_pages);
++ if (!vout) {
++ err = -ENOMEM;
++ goto out;
++ }
+
+ err = z_erofs_vle_unzip_vmap(compressed_pages,
+ clusterpages, vout, llen, work->pageofs, overlapped);
+@@ -1078,6 +1096,8 @@ static inline bool recover_managed_page(struct z_erofs_vle_workgroup *grp,
+ return true;
+
+ lock_page(page);
++ ClearPageError(page);
++
+ if (unlikely(!PagePrivate(page))) {
+ set_page_private(page, (unsigned long)grp);
+ SetPagePrivate(page);
+diff --git a/drivers/staging/erofs/unzip_vle_lz4.c b/drivers/staging/erofs/unzip_vle_lz4.c
+index 055420e8af2c..3a7428317f0a 100644
+--- a/drivers/staging/erofs/unzip_vle_lz4.c
++++ b/drivers/staging/erofs/unzip_vle_lz4.c
+@@ -116,10 +116,13 @@ int z_erofs_vle_unzip_fast_percpu(struct page **compressed_pages,
+
+ nr_pages = DIV_ROUND_UP(outlen + pageofs, PAGE_SIZE);
+
+- if (clusterpages == 1)
++ if (clusterpages == 1) {
+ vin = kmap_atomic(compressed_pages[0]);
+- else
++ } else {
+ vin = erofs_vmap(compressed_pages, clusterpages);
++ if (!vin)
++ return -ENOMEM;
++ }
+
+ preempt_disable();
+ vout = erofs_pcpubuf[smp_processor_id()].data;
+diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c
+index 947c79532e10..d5383974d40e 100644
+--- a/drivers/staging/speakup/speakup_soft.c
++++ b/drivers/staging/speakup/speakup_soft.c
+@@ -208,12 +208,15 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
+ return -EINVAL;
+
+ spin_lock_irqsave(&speakup_info.spinlock, flags);
++ synth_soft.alive = 1;
+ while (1) {
+ prepare_to_wait(&speakup_event, &wait, TASK_INTERRUPTIBLE);
+- if (!unicode)
+- synth_buffer_skip_nonlatin1();
+- if (!synth_buffer_empty() || speakup_info.flushing)
+- break;
++ if (synth_current() == &synth_soft) {
++ if (!unicode)
++ synth_buffer_skip_nonlatin1();
++ if (!synth_buffer_empty() || speakup_info.flushing)
++ break;
++ }
+ spin_unlock_irqrestore(&speakup_info.spinlock, flags);
+ if (fp->f_flags & O_NONBLOCK) {
+ finish_wait(&speakup_event, &wait);
+@@ -233,6 +236,8 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count,
+
+ /* Keep 3 bytes available for a 16bit UTF-8-encoded character */
+ while (chars_sent <= count - bytes_per_ch) {
++ if (synth_current() != &synth_soft)
++ break;
+ if (speakup_info.flushing) {
+ speakup_info.flushing = 0;
+ ch = '\x18';
+@@ -329,7 +334,8 @@ static __poll_t softsynth_poll(struct file *fp, struct poll_table_struct *wait)
+ poll_wait(fp, &speakup_event, wait);
+
+ spin_lock_irqsave(&speakup_info.spinlock, flags);
+- if (!synth_buffer_empty() || speakup_info.flushing)
++ if (synth_current() == &synth_soft &&
++ (!synth_buffer_empty() || speakup_info.flushing))
+ ret = EPOLLIN | EPOLLRDNORM;
+ spin_unlock_irqrestore(&speakup_info.spinlock, flags);
+ return ret;
+diff --git a/drivers/staging/speakup/spk_priv.h b/drivers/staging/speakup/spk_priv.h
+index 7b3a16e1fa23..796ffcca43c1 100644
+--- a/drivers/staging/speakup/spk_priv.h
++++ b/drivers/staging/speakup/spk_priv.h
+@@ -72,6 +72,7 @@ int synth_request_region(unsigned long start, unsigned long n);
+ int synth_release_region(unsigned long start, unsigned long n);
+ int synth_add(struct spk_synth *in_synth);
+ void synth_remove(struct spk_synth *in_synth);
++struct spk_synth *synth_current(void);
+
+ extern struct speakup_info_t speakup_info;
+
+diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c
+index 25f259ee4ffc..3568bfb89912 100644
+--- a/drivers/staging/speakup/synth.c
++++ b/drivers/staging/speakup/synth.c
+@@ -481,4 +481,10 @@ void synth_remove(struct spk_synth *in_synth)
+ }
+ EXPORT_SYMBOL_GPL(synth_remove);
+
++struct spk_synth *synth_current(void)
++{
++ return synth;
++}
++EXPORT_SYMBOL_GPL(synth_current);
++
+ short spk_punc_masks[] = { 0, SOME, MOST, PUNC, PUNC | B_SYM };
+diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
+index 1ab0e8562d40..607804aa560d 100644
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -1040,8 +1040,6 @@ static void vnt_interrupt_process(struct vnt_private *priv)
+ return;
+ }
+
+- MACvIntDisable(priv->PortOffset);
+-
+ spin_lock_irqsave(&priv->lock, flags);
+
+ /* Read low level stats */
+@@ -1129,8 +1127,6 @@ static void vnt_interrupt_process(struct vnt_private *priv)
+ }
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+-
+- MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE);
+ }
+
+ static void vnt_interrupt_work(struct work_struct *work)
+@@ -1140,14 +1136,17 @@ static void vnt_interrupt_work(struct work_struct *work)
+
+ if (priv->vif)
+ vnt_interrupt_process(priv);
++
++ MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE);
+ }
+
+ static irqreturn_t vnt_interrupt(int irq, void *arg)
+ {
+ struct vnt_private *priv = arg;
+
+- if (priv->vif)
+- schedule_work(&priv->interrupt_work);
++ schedule_work(&priv->interrupt_work);
++
++ MACvIntDisable(priv->PortOffset);
+
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 8e4428725848..bfdd5ad4116f 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -1156,6 +1156,10 @@ static int atmel_prepare_rx_dma(struct uart_port *port)
+ sg_dma_len(&atmel_port->sg_rx)/2,
+ DMA_DEV_TO_MEM,
+ DMA_PREP_INTERRUPT);
++ if (!desc) {
++ dev_err(port->dev, "Preparing DMA cyclic failed\n");
++ goto chan_err;
++ }
+ desc->callback = atmel_complete_rx_dma;
+ desc->callback_param = port;
+ atmel_port->desc_rx = desc;
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index 93d3a0ec5e11..b0aa864f84a9 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -145,8 +145,10 @@ static int configure_kgdboc(void)
+ char *cptr = config;
+ struct console *cons;
+
+- if (!strlen(config) || isspace(config[0]))
++ if (!strlen(config) || isspace(config[0])) {
++ err = 0;
+ goto noconfig;
++ }
+
+ kgdboc_io_ops.is_console = 0;
+ kgdb_tty_driver = NULL;
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 3db48fcd6068..4c4070a202fb 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1419,6 +1419,8 @@ static int max310x_spi_probe(struct spi_device *spi)
+ if (spi->dev.of_node) {
+ const struct of_device_id *of_id =
+ of_match_device(max310x_dt_ids, &spi->dev);
++ if (!of_id)
++ return -ENODEV;
+
+ devtype = (struct max310x_devtype *)of_id->data;
+ } else {
+diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
+index 170e446a2f62..7d26c9b57d8e 100644
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -799,6 +799,9 @@ static int mvebu_uart_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
++ if (!match)
++ return -ENODEV;
++
+ /* Assume that all UART ports have a DT alias or none has */
+ id = of_alias_get_id(pdev->dev.of_node, "serial");
+ if (!pdev->dev.of_node || id < 0)
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 76aa289652f7..34acdf29713d 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -1685,6 +1685,10 @@ static int mxs_auart_probe(struct platform_device *pdev)
+
+ s->port.mapbase = r->start;
+ s->port.membase = ioremap(r->start, resource_size(r));
++ if (!s->port.membase) {
++ ret = -ENOMEM;
++ goto out_disable_clks;
++ }
+ s->port.ops = &mxs_auart_ops;
+ s->port.iotype = UPIO_MEM;
+ s->port.fifosize = MXS_AUART_FIFO_SIZE;
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 35d1f6fa0e3c..5b96df4ad5b3 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -1052,7 +1052,7 @@ static int __init qcom_geni_console_setup(struct console *co, char *options)
+ {
+ struct uart_port *uport;
+ struct qcom_geni_serial_port *port;
+- int baud;
++ int baud = 9600;
+ int bits = 8;
+ int parity = 'n';
+ int flow = 'n';
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 859b173e3b82..cbbf239aea0f 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -838,19 +838,9 @@ static void sci_transmit_chars(struct uart_port *port)
+
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(port);
+- if (uart_circ_empty(xmit)) {
++ if (uart_circ_empty(xmit))
+ sci_stop_tx(port);
+- } else {
+- ctrl = serial_port_in(port, SCSCR);
+-
+- if (port->type != PORT_SCI) {
+- serial_port_in(port, SCxSR); /* Dummy read */
+- sci_clear_SCxSR(port, SCxSR_TDxE_CLEAR(port));
+- }
+
+- ctrl |= SCSCR_TIE;
+- serial_port_out(port, SCSCR, ctrl);
+- }
+ }
+
+ /* On SH3, SCIF may read end-of-break as a space->mark char */
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 08b8aa5299b5..32da5a4182ac 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -558,10 +558,8 @@ static void acm_softint(struct work_struct *work)
+ clear_bit(EVENT_RX_STALL, &acm->flags);
+ }
+
+- if (test_bit(EVENT_TTY_WAKEUP, &acm->flags)) {
++ if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags))
+ tty_port_tty_wakeup(&acm->port);
+- clear_bit(EVENT_TTY_WAKEUP, &acm->flags);
+- }
+ }
+
+ /*
+diff --git a/drivers/usb/common/common.c b/drivers/usb/common/common.c
+index 48277bbc15e4..73c8e6591746 100644
+--- a/drivers/usb/common/common.c
++++ b/drivers/usb/common/common.c
+@@ -145,6 +145,8 @@ enum usb_dr_mode of_usb_get_dr_mode_by_phy(struct device_node *np, int arg0)
+
+ do {
+ controller = of_find_node_with_property(controller, "phys");
++ if (!of_device_is_available(controller))
++ continue;
+ index = 0;
+ do {
+ if (arg0 == -1) {
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index 54e859dcb25c..492bb44153b3 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -391,20 +391,20 @@ try_again:
+ req->complete = f_hidg_req_complete;
+ req->context = hidg;
+
++ spin_unlock_irqrestore(&hidg->write_spinlock, flags);
++
+ status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
+ if (status < 0) {
+ ERROR(hidg->func.config->cdev,
+ "usb_ep_queue error on int endpoint %zd\n", status);
+- goto release_write_pending_unlocked;
++ goto release_write_pending;
+ } else {
+ status = count;
+ }
+- spin_unlock_irqrestore(&hidg->write_spinlock, flags);
+
+ return status;
+ release_write_pending:
+ spin_lock_irqsave(&hidg->write_spinlock, flags);
+-release_write_pending_unlocked:
+ hidg->write_pending = 0;
+ spin_unlock_irqrestore(&hidg->write_spinlock, flags);
+
+diff --git a/drivers/usb/host/xhci-dbgcap.c b/drivers/usb/host/xhci-dbgcap.c
+index 86cff5c28eff..ba841c569c48 100644
+--- a/drivers/usb/host/xhci-dbgcap.c
++++ b/drivers/usb/host/xhci-dbgcap.c
+@@ -516,7 +516,6 @@ static int xhci_do_dbc_stop(struct xhci_hcd *xhci)
+ return -1;
+
+ writel(0, &dbc->regs->control);
+- xhci_dbc_mem_cleanup(xhci);
+ dbc->state = DS_DISABLED;
+
+ return 0;
+@@ -562,8 +561,10 @@ static void xhci_dbc_stop(struct xhci_hcd *xhci)
+ ret = xhci_do_dbc_stop(xhci);
+ spin_unlock_irqrestore(&dbc->lock, flags);
+
+- if (!ret)
++ if (!ret) {
++ xhci_dbc_mem_cleanup(xhci);
+ pm_runtime_put_sync(xhci_to_hcd(xhci)->self.controller);
++ }
+ }
+
+ static void
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 01b5818a4be5..333f9202ec8b 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1501,20 +1501,25 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ port_index = max_ports;
+ while (port_index--) {
+ u32 t1, t2;
+-
++ int retries = 10;
++retry:
+ t1 = readl(ports[port_index]->addr);
+ t2 = xhci_port_state_to_neutral(t1);
+ portsc_buf[port_index] = 0;
+
+- /* Bail out if a USB3 port has a new device in link training */
+- if ((hcd->speed >= HCD_USB3) &&
++ /*
++ * Give a USB3 port in link training time to finish, but don't
++ * prevent suspend as port might be stuck
++ */
++ if ((hcd->speed >= HCD_USB3) && retries-- &&
+ (t1 & PORT_PLS_MASK) == XDEV_POLLING) {
+- bus_state->bus_suspended = 0;
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
+- return -EBUSY;
++ msleep(XHCI_PORT_POLLING_LFPS_TIME);
++ spin_lock_irqsave(&xhci->lock, flags);
++ xhci_dbg(xhci, "port %d polling in bus suspend, waiting\n",
++ port_index);
++ goto retry;
+ }
+-
+ /* suspend ports in U0, or bail out for new connect changes */
+ if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) {
+ if ((t1 & PORT_CSC) && wake_enabled) {
+diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
+index a6e463715779..671bce18782c 100644
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -246,6 +246,7 @@ int xhci_rcar_init_quirk(struct usb_hcd *hcd)
+ if (!xhci_rcar_wait_for_pll_active(hcd))
+ return -ETIMEDOUT;
+
++ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+ return xhci_rcar_download_firmware(hcd);
+ }
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 9ae17a666bdb..f054464347c9 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1643,10 +1643,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ }
+ }
+
+- if ((portsc & PORT_PLC) && (portsc & PORT_PLS_MASK) == XDEV_U0 &&
+- DEV_SUPERSPEED_ANY(portsc)) {
++ if ((portsc & PORT_PLC) &&
++ DEV_SUPERSPEED_ANY(portsc) &&
++ ((portsc & PORT_PLS_MASK) == XDEV_U0 ||
++ (portsc & PORT_PLS_MASK) == XDEV_U1 ||
++ (portsc & PORT_PLS_MASK) == XDEV_U2)) {
+ xhci_dbg(xhci, "resume SS port %d finished\n", port_id);
+- /* We've just brought the device into U0 through either the
++ /* We've just brought the device into U0/1/2 through either the
+ * Resume state after a device remote wakeup, or through the
+ * U3Exit state after a host-initiated resume. If it's a device
+ * initiated remote wake, don't pass up the link state change,
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index e88060ea1e33..dc00f59c8e69 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -452,6 +452,14 @@ struct xhci_op_regs {
+ */
+ #define XHCI_DEFAULT_BESL 4
+
++/*
++ * USB3 specification define a 360ms tPollingLFPSTiemout for USB3 ports
++ * to complete link training. usually link trainig completes much faster
++ * so check status 10 times with 36ms sleep in places we need to wait for
++ * polling to complete.
++ */
++#define XHCI_PORT_POLLING_LFPS_TIME 36
++
+ /**
+ * struct xhci_intr_reg - Interrupt Register Set
+ * @irq_pending: IMAN - Interrupt Management Register. Used to enable
+diff --git a/drivers/usb/mtu3/Kconfig b/drivers/usb/mtu3/Kconfig
+index 40bbf1f53337..fe58904f350b 100644
+--- a/drivers/usb/mtu3/Kconfig
++++ b/drivers/usb/mtu3/Kconfig
+@@ -4,6 +4,7 @@ config USB_MTU3
+ tristate "MediaTek USB3 Dual Role controller"
+ depends on USB || USB_GADGET
+ depends on ARCH_MEDIATEK || COMPILE_TEST
++ depends on EXTCON || !EXTCON
+ select USB_XHCI_MTK if USB_SUPPORT && USB_XHCI_HCD
+ help
+ Say Y or M here if your system runs on MediaTek SoCs with
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 4c66edf533fe..e732949f6567 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -80,6 +80,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */
+ { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */
+ { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */
++ { USB_DEVICE(0x10C4, 0x8056) }, /* Lorenz Messtechnik devices */
+ { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
+ { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */
+ { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 1d8077e880a0..c0dc4bc776db 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -599,6 +599,8 @@ static const struct usb_device_id id_table_combined[] = {
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index b863bedb55a1..5755f0df0025 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -567,7 +567,9 @@
+ /*
+ * NovaTech product ids (FTDI_VID)
+ */
+-#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
++#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
++#define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */
++#define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */
+
+ /*
+ * Synapse Wireless product ids (FTDI_VID)
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index 27109522fd8b..e8f275a0326d 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -366,8 +366,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ if (!urbtrack)
+ return -ENOMEM;
+
+- kref_get(&mos_parport->ref_count);
+- urbtrack->mos_parport = mos_parport;
+ urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC);
+ if (!urbtrack->urb) {
+ kfree(urbtrack);
+@@ -388,6 +386,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ usb_sndctrlpipe(usbdev, 0),
+ (unsigned char *)urbtrack->setup,
+ NULL, 0, async_complete, urbtrack);
++ kref_get(&mos_parport->ref_count);
++ urbtrack->mos_parport = mos_parport;
+ kref_init(&urbtrack->ref_count);
+ INIT_LIST_HEAD(&urbtrack->urblist_entry);
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index faf833e8f557..d8c474b386a8 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -246,6 +246,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_EC25 0x0125
+ #define QUECTEL_PRODUCT_BG96 0x0296
+ #define QUECTEL_PRODUCT_EP06 0x0306
++#define QUECTEL_PRODUCT_EM12 0x0512
+
+ #define CMOTECH_VENDOR_ID 0x16d8
+ #define CMOTECH_PRODUCT_6001 0x6001
+@@ -1066,7 +1067,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(3) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+- { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */
++ .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) },
+ /* Quectel products using Qualcomm vendor ID */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
+@@ -1087,6 +1089,9 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff),
++ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+@@ -1940,10 +1945,12 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */
+ .driver_info = RSVD(4) },
+- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
+- { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */
++ .driver_info = RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
+diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
+index e61dffb27a0c..00141e05bc72 100644
+--- a/drivers/usb/typec/class.c
++++ b/drivers/usb/typec/class.c
+@@ -1500,7 +1500,7 @@ typec_port_register_altmode(struct typec_port *port,
+
+ sprintf(id, "id%04xm%02x", desc->svid, desc->mode);
+
+- mux = typec_mux_get(port->dev.parent, id);
++ mux = typec_mux_get(&port->dev, id);
+ if (IS_ERR(mux))
+ return ERR_CAST(mux);
+
+@@ -1540,18 +1540,6 @@ struct typec_port *typec_register_port(struct device *parent,
+ return ERR_PTR(id);
+ }
+
+- port->sw = typec_switch_get(cap->fwnode ? &port->dev : parent);
+- if (IS_ERR(port->sw)) {
+- ret = PTR_ERR(port->sw);
+- goto err_switch;
+- }
+-
+- port->mux = typec_mux_get(parent, "typec-mux");
+- if (IS_ERR(port->mux)) {
+- ret = PTR_ERR(port->mux);
+- goto err_mux;
+- }
+-
+ switch (cap->type) {
+ case TYPEC_PORT_SRC:
+ port->pwr_role = TYPEC_SOURCE;
+@@ -1592,13 +1580,26 @@ struct typec_port *typec_register_port(struct device *parent,
+ port->port_type = cap->type;
+ port->prefer_role = cap->prefer_role;
+
++ device_initialize(&port->dev);
+ port->dev.class = typec_class;
+ port->dev.parent = parent;
+ port->dev.fwnode = cap->fwnode;
+ port->dev.type = &typec_port_dev_type;
+ dev_set_name(&port->dev, "port%d", id);
+
+- ret = device_register(&port->dev);
++ port->sw = typec_switch_get(&port->dev);
++ if (IS_ERR(port->sw)) {
++ put_device(&port->dev);
++ return ERR_CAST(port->sw);
++ }
++
++ port->mux = typec_mux_get(&port->dev, "typec-mux");
++ if (IS_ERR(port->mux)) {
++ put_device(&port->dev);
++ return ERR_CAST(port->mux);
++ }
++
++ ret = device_add(&port->dev);
+ if (ret) {
+ dev_err(parent, "failed to register port (%d)\n", ret);
+ put_device(&port->dev);
+@@ -1606,15 +1607,6 @@ struct typec_port *typec_register_port(struct device *parent,
+ }
+
+ return port;
+-
+-err_mux:
+- typec_switch_put(port->sw);
+-
+-err_switch:
+- ida_simple_remove(&typec_index_ida, port->id);
+- kfree(port);
+-
+- return ERR_PTR(ret);
+ }
+ EXPORT_SYMBOL_GPL(typec_register_port);
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index a16760b410b1..c0db7785cede 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -5872,7 +5872,7 @@ static void btrfs_calculate_inode_block_rsv_size(struct btrfs_fs_info *fs_info,
+ *
+ * This is overestimating in most cases.
+ */
+- qgroup_rsv_size = outstanding_extents * fs_info->nodesize;
++ qgroup_rsv_size = (u64)outstanding_extents * fs_info->nodesize;
+
+ spin_lock(&block_rsv->lock);
+ block_rsv->size = reserve_size;
+diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
+index df41d7049936..927f9f3daddb 100644
+--- a/fs/btrfs/raid56.c
++++ b/fs/btrfs/raid56.c
+@@ -2429,8 +2429,9 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio,
+ bitmap_clear(rbio->dbitmap, pagenr, 1);
+ kunmap(p);
+
+- for (stripe = 0; stripe < rbio->real_stripes; stripe++)
++ for (stripe = 0; stripe < nr_data; stripe++)
+ kunmap(page_in_rbio(rbio, stripe, pagenr, 0));
++ kunmap(p_page);
+ }
+
+ __free_page(p_page);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 0805f8c5e72d..2f4f0958e5f2 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3532,9 +3532,16 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans,
+ }
+ btrfs_release_path(path);
+
+- /* find the first key from this transaction again */
++ /*
++ * Find the first key from this transaction again. See the note for
++ * log_new_dir_dentries, if we're logging a directory recursively we
++ * won't be holding its i_mutex, which means we can modify the directory
++ * while we're logging it. If we remove an entry between our first
++ * search and this search we'll not find the key again and can just
++ * bail.
++ */
+ ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0);
+- if (WARN_ON(ret != 0))
++ if (ret != 0)
+ goto done;
+
+ /*
+@@ -4504,6 +4511,19 @@ static int logged_inode_size(struct btrfs_root *log, struct btrfs_inode *inode,
+ item = btrfs_item_ptr(path->nodes[0], path->slots[0],
+ struct btrfs_inode_item);
+ *size_ret = btrfs_inode_size(path->nodes[0], item);
++ /*
++ * If the in-memory inode's i_size is smaller then the inode
++ * size stored in the btree, return the inode's i_size, so
++ * that we get a correct inode size after replaying the log
++ * when before a power failure we had a shrinking truncate
++ * followed by addition of a new name (rename / new hard link).
++ * Otherwise return the inode size from the btree, to avoid
++ * data loss when replaying a log due to previously doing a
++ * write that expands the inode's size and logging a new name
++ * immediately after.
++ */
++ if (*size_ret > inode->vfs_inode.i_size)
++ *size_ret = inode->vfs_inode.i_size;
+ }
+
+ btrfs_release_path(path);
+@@ -4665,15 +4685,8 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
+ struct btrfs_file_extent_item);
+
+ if (btrfs_file_extent_type(leaf, extent) ==
+- BTRFS_FILE_EXTENT_INLINE) {
+- len = btrfs_file_extent_ram_bytes(leaf, extent);
+- ASSERT(len == i_size ||
+- (len == fs_info->sectorsize &&
+- btrfs_file_extent_compression(leaf, extent) !=
+- BTRFS_COMPRESS_NONE) ||
+- (len < i_size && i_size < fs_info->sectorsize));
++ BTRFS_FILE_EXTENT_INLINE)
+ return 0;
+- }
+
+ len = btrfs_file_extent_num_bytes(leaf, extent);
+ /* Last extent goes beyond i_size, no need to log a hole. */
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index c13f62182513..207f4e87445d 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -6051,7 +6051,7 @@ static void btrfs_end_bio(struct bio *bio)
+ if (bio_op(bio) == REQ_OP_WRITE)
+ btrfs_dev_stat_inc_and_print(dev,
+ BTRFS_DEV_STAT_WRITE_ERRS);
+- else
++ else if (!(bio->bi_opf & REQ_RAHEAD))
+ btrfs_dev_stat_inc_and_print(dev,
+ BTRFS_DEV_STAT_READ_ERRS);
+ if (bio->bi_opf & REQ_PREFLUSH)
+diff --git a/fs/lockd/host.c b/fs/lockd/host.c
+index 93fb7cf0b92b..f0b5c987d6ae 100644
+--- a/fs/lockd/host.c
++++ b/fs/lockd/host.c
+@@ -290,12 +290,11 @@ void nlmclnt_release_host(struct nlm_host *host)
+
+ WARN_ON_ONCE(host->h_server);
+
+- if (refcount_dec_and_test(&host->h_count)) {
++ if (refcount_dec_and_mutex_lock(&host->h_count, &nlm_host_mutex)) {
+ WARN_ON_ONCE(!list_empty(&host->h_lockowners));
+ WARN_ON_ONCE(!list_empty(&host->h_granted));
+ WARN_ON_ONCE(!list_empty(&host->h_reclaim));
+
+- mutex_lock(&nlm_host_mutex);
+ nlm_destroy_host_locked(host);
+ mutex_unlock(&nlm_host_mutex);
+ }
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index e7abcf7629b3..580e37bc3fe2 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2909,7 +2909,8 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
+ }
+
+ out:
+- nfs4_sequence_free_slot(&opendata->o_res.seq_res);
++ if (!opendata->cancelled)
++ nfs4_sequence_free_slot(&opendata->o_res.seq_res);
+ return ret;
+ }
+
+diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
+index 7a5ee145c733..fc197e599e8c 100644
+--- a/fs/ocfs2/refcounttree.c
++++ b/fs/ocfs2/refcounttree.c
+@@ -4716,22 +4716,23 @@ out:
+
+ /* Lock an inode and grab a bh pointing to the inode. */
+ static int ocfs2_reflink_inodes_lock(struct inode *s_inode,
+- struct buffer_head **bh1,
++ struct buffer_head **bh_s,
+ struct inode *t_inode,
+- struct buffer_head **bh2)
++ struct buffer_head **bh_t)
+ {
+- struct inode *inode1;
+- struct inode *inode2;
++ struct inode *inode1 = s_inode;
++ struct inode *inode2 = t_inode;
+ struct ocfs2_inode_info *oi1;
+ struct ocfs2_inode_info *oi2;
++ struct buffer_head *bh1 = NULL;
++ struct buffer_head *bh2 = NULL;
+ bool same_inode = (s_inode == t_inode);
++ bool need_swap = (inode1->i_ino > inode2->i_ino);
+ int status;
+
+ /* First grab the VFS and rw locks. */
+ lock_two_nondirectories(s_inode, t_inode);
+- inode1 = s_inode;
+- inode2 = t_inode;
+- if (inode1->i_ino > inode2->i_ino)
++ if (need_swap)
+ swap(inode1, inode2);
+
+ status = ocfs2_rw_lock(inode1, 1);
+@@ -4754,17 +4755,13 @@ static int ocfs2_reflink_inodes_lock(struct inode *s_inode,
+ trace_ocfs2_double_lock((unsigned long long)oi1->ip_blkno,
+ (unsigned long long)oi2->ip_blkno);
+
+- if (*bh1)
+- *bh1 = NULL;
+- if (*bh2)
+- *bh2 = NULL;
+-
+ /* We always want to lock the one with the lower lockid first. */
+ if (oi1->ip_blkno > oi2->ip_blkno)
+ mlog_errno(-ENOLCK);
+
+ /* lock id1 */
+- status = ocfs2_inode_lock_nested(inode1, bh1, 1, OI_LS_REFLINK_TARGET);
++ status = ocfs2_inode_lock_nested(inode1, &bh1, 1,
++ OI_LS_REFLINK_TARGET);
+ if (status < 0) {
+ if (status != -ENOENT)
+ mlog_errno(status);
+@@ -4773,15 +4770,25 @@ static int ocfs2_reflink_inodes_lock(struct inode *s_inode,
+
+ /* lock id2 */
+ if (!same_inode) {
+- status = ocfs2_inode_lock_nested(inode2, bh2, 1,
++ status = ocfs2_inode_lock_nested(inode2, &bh2, 1,
+ OI_LS_REFLINK_TARGET);
+ if (status < 0) {
+ if (status != -ENOENT)
+ mlog_errno(status);
+ goto out_cl1;
+ }
+- } else
+- *bh2 = *bh1;
++ } else {
++ bh2 = bh1;
++ }
++
++ /*
++ * If we swapped inode order above, we have to swap the buffer heads
++ * before passing them back to the caller.
++ */
++ if (need_swap)
++ swap(bh1, bh2);
++ *bh_s = bh1;
++ *bh_t = bh2;
+
+ trace_ocfs2_double_lock_end(
+ (unsigned long long)oi1->ip_blkno,
+@@ -4791,8 +4798,7 @@ static int ocfs2_reflink_inodes_lock(struct inode *s_inode,
+
+ out_cl1:
+ ocfs2_inode_unlock(inode1, 1);
+- brelse(*bh1);
+- *bh1 = NULL;
++ brelse(bh1);
+ out_rw2:
+ ocfs2_rw_unlock(inode2, 1);
+ out_i2:
+diff --git a/fs/open.c b/fs/open.c
+index 0285ce7dbd51..f1c2f855fd43 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -733,6 +733,12 @@ static int do_dentry_open(struct file *f,
+ return 0;
+ }
+
++ /* Any file opened for execve()/uselib() has to be a regular file. */
++ if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) {
++ error = -EACCES;
++ goto cleanup_file;
++ }
++
+ if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
+ error = get_write_access(inode);
+ if (unlikely(error))
+diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
+index 4d598a399bbf..d65390727541 100644
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -1626,7 +1626,8 @@ static void drop_sysctl_table(struct ctl_table_header *header)
+ if (--header->nreg)
+ return;
+
+- put_links(header);
++ if (parent)
++ put_links(header);
+ start_unregistering(header);
+ if (!--header->count)
+ kfree_rcu(header, rcu);
+diff --git a/include/linux/device.h b/include/linux/device.h
+index 8f882549edee..3f1066a9e1c3 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -773,6 +773,30 @@ struct device *device_connection_find(struct device *dev, const char *con_id);
+ void device_connection_add(struct device_connection *con);
+ void device_connection_remove(struct device_connection *con);
+
++/**
++ * device_connections_add - Add multiple device connections at once
++ * @cons: Zero terminated array of device connection descriptors
++ */
++static inline void device_connections_add(struct device_connection *cons)
++{
++ struct device_connection *c;
++
++ for (c = cons; c->endpoint[0]; c++)
++ device_connection_add(c);
++}
++
++/**
++ * device_connections_remove - Remove multiple device connections at once
++ * @cons: Zero terminated array of device connection descriptors
++ */
++static inline void device_connections_remove(struct device_connection *cons)
++{
++ struct device_connection *c;
++
++ for (c = cons; c->endpoint[0]; c++)
++ device_connection_remove(c);
++}
++
+ /**
+ * enum device_link_state - Device link states.
+ * @DL_STATE_NONE: The presence of the drivers is not being tracked.
+diff --git a/include/linux/slab.h b/include/linux/slab.h
+index ed9cbddeb4a6..d6393413ef09 100644
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -32,6 +32,8 @@
+ #define SLAB_HWCACHE_ALIGN ((slab_flags_t __force)0x00002000U)
+ /* Use GFP_DMA memory */
+ #define SLAB_CACHE_DMA ((slab_flags_t __force)0x00004000U)
++/* Use GFP_DMA32 memory */
++#define SLAB_CACHE_DMA32 ((slab_flags_t __force)0x00008000U)
+ /* DEBUG: Store the last owner for bug hunting */
+ #define SLAB_STORE_USER ((slab_flags_t __force)0x00010000U)
+ /* Panic if kmem_cache_create() fails */
+diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h
+index 32ee65a30aff..1c6e6c0766ca 100644
+--- a/include/net/sctp/checksum.h
++++ b/include/net/sctp/checksum.h
+@@ -61,7 +61,7 @@ static inline __wsum sctp_csum_combine(__wsum csum, __wsum csum2,
+ static inline __le32 sctp_compute_cksum(const struct sk_buff *skb,
+ unsigned int offset)
+ {
+- struct sctphdr *sh = sctp_hdr(skb);
++ struct sctphdr *sh = (struct sctphdr *)(skb->data + offset);
+ const struct skb_checksum_ops ops = {
+ .update = sctp_csum_update,
+ .combine = sctp_csum_combine,
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 6cb5a545df7d..1ece7736c49c 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -710,6 +710,12 @@ static inline void sk_add_node_rcu(struct sock *sk, struct hlist_head *list)
+ hlist_add_head_rcu(&sk->sk_node, list);
+ }
+
++static inline void sk_add_node_tail_rcu(struct sock *sk, struct hlist_head *list)
++{
++ sock_hold(sk);
++ hlist_add_tail_rcu(&sk->sk_node, list);
++}
++
+ static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
+ {
+ hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index bcb42aaf1b3a..acc2305ad895 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -2815,7 +2815,7 @@ do_sim:
+ *dst_reg = *ptr_reg;
+ }
+ ret = push_stack(env, env->insn_idx + 1, env->insn_idx, true);
+- if (!ptr_is_dst_reg)
++ if (!ptr_is_dst_reg && ret)
+ *dst_reg = tmp;
+ return !ret ? -EFAULT : 0;
+ }
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 56f657adcf03..9d0ecc4a0e79 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -533,6 +533,20 @@ static void undo_cpu_up(unsigned int cpu, struct cpuhp_cpu_state *st)
+ cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
+ }
+
++static inline bool can_rollback_cpu(struct cpuhp_cpu_state *st)
++{
++ if (IS_ENABLED(CONFIG_HOTPLUG_CPU))
++ return true;
++ /*
++ * When CPU hotplug is disabled, then taking the CPU down is not
++ * possible because takedown_cpu() and the architecture and
++ * subsystem specific mechanisms are not available. So the CPU
++ * which would be completely unplugged again needs to stay around
++ * in the current state.
++ */
++ return st->state <= CPUHP_BRINGUP_CPU;
++}
++
+ static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
+ enum cpuhp_state target)
+ {
+@@ -543,8 +557,10 @@ static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
+ st->state++;
+ ret = cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL);
+ if (ret) {
+- st->target = prev_state;
+- undo_cpu_up(cpu, st);
++ if (can_rollback_cpu(st)) {
++ st->target = prev_state;
++ undo_cpu_up(cpu, st);
++ }
+ break;
+ }
+ }
+diff --git a/kernel/watchdog.c b/kernel/watchdog.c
+index 977918d5d350..bbc4940f21af 100644
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -547,13 +547,15 @@ static void softlockup_start_all(void)
+
+ int lockup_detector_online_cpu(unsigned int cpu)
+ {
+- watchdog_enable(cpu);
++ if (cpumask_test_cpu(cpu, &watchdog_allowed_mask))
++ watchdog_enable(cpu);
+ return 0;
+ }
+
+ int lockup_detector_offline_cpu(unsigned int cpu)
+ {
+- watchdog_disable(cpu);
++ if (cpumask_test_cpu(cpu, &watchdog_allowed_mask))
++ watchdog_disable(cpu);
+ return 0;
+ }
+
+diff --git a/lib/rhashtable.c b/lib/rhashtable.c
+index 30526afa8343..6410c857b048 100644
+--- a/lib/rhashtable.c
++++ b/lib/rhashtable.c
+@@ -416,8 +416,12 @@ static void rht_deferred_worker(struct work_struct *work)
+ else if (tbl->nest)
+ err = rhashtable_rehash_alloc(ht, tbl, tbl->size);
+
+- if (!err)
+- err = rhashtable_rehash_table(ht);
++ if (!err || err == -EEXIST) {
++ int nerr;
++
++ nerr = rhashtable_rehash_table(ht);
++ err = err ?: nerr;
++ }
+
+ mutex_unlock(&ht->mutex);
+
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 89d4439516f6..f32d0a5be4fb 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -428,6 +428,13 @@ static inline bool queue_pages_required(struct page *page,
+ return node_isset(nid, *qp->nmask) == !(flags & MPOL_MF_INVERT);
+ }
+
++/*
++ * queue_pages_pmd() has three possible return values:
++ * 1 - pages are placed on the right node or queued successfully.
++ * 0 - THP was split.
++ * -EIO - is migration entry or MPOL_MF_STRICT was specified and an existing
++ * page was already on a node that does not follow the policy.
++ */
+ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
+ unsigned long end, struct mm_walk *walk)
+ {
+@@ -437,7 +444,7 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
+ unsigned long flags;
+
+ if (unlikely(is_pmd_migration_entry(*pmd))) {
+- ret = 1;
++ ret = -EIO;
+ goto unlock;
+ }
+ page = pmd_page(*pmd);
+@@ -454,8 +461,15 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
+ ret = 1;
+ flags = qp->flags;
+ /* go to thp migration */
+- if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
++ if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
++ if (!vma_migratable(walk->vma)) {
++ ret = -EIO;
++ goto unlock;
++ }
++
+ migrate_page_add(page, qp->pagelist, flags);
++ } else
++ ret = -EIO;
+ unlock:
+ spin_unlock(ptl);
+ out:
+@@ -480,8 +494,10 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
+ ptl = pmd_trans_huge_lock(pmd, vma);
+ if (ptl) {
+ ret = queue_pages_pmd(pmd, ptl, addr, end, walk);
+- if (ret)
++ if (ret > 0)
+ return 0;
++ else if (ret < 0)
++ return ret;
+ }
+
+ if (pmd_trans_unstable(pmd))
+@@ -502,11 +518,16 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
+ continue;
+ if (!queue_pages_required(page, qp))
+ continue;
+- migrate_page_add(page, qp->pagelist, flags);
++ if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
++ if (!vma_migratable(vma))
++ break;
++ migrate_page_add(page, qp->pagelist, flags);
++ } else
++ break;
+ }
+ pte_unmap_unlock(pte - 1, ptl);
+ cond_resched();
+- return 0;
++ return addr != end ? -EIO : 0;
+ }
+
+ static int queue_pages_hugetlb(pte_t *pte, unsigned long hmask,
+@@ -576,7 +597,12 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end,
+ unsigned long endvma = vma->vm_end;
+ unsigned long flags = qp->flags;
+
+- if (!vma_migratable(vma))
++ /*
++ * Need check MPOL_MF_STRICT to return -EIO if possible
++ * regardless of vma_migratable
++ */
++ if (!vma_migratable(vma) &&
++ !(flags & MPOL_MF_STRICT))
+ return 1;
+
+ if (endvma > end)
+@@ -603,7 +629,7 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end,
+ }
+
+ /* queue pages from current vma */
+- if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
++ if (flags & MPOL_MF_VALID)
+ return 0;
+ return 1;
+ }
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 14779c4f9a60..b2ea7d1e6f24 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -248,10 +248,8 @@ static bool remove_migration_pte(struct page *page, struct vm_area_struct *vma,
+ pte = swp_entry_to_pte(entry);
+ } else if (is_device_public_page(new)) {
+ pte = pte_mkdevmap(pte);
+- flush_dcache_page(new);
+ }
+- } else
+- flush_dcache_page(new);
++ }
+
+ #ifdef CONFIG_HUGETLB_PAGE
+ if (PageHuge(new)) {
+@@ -983,6 +981,13 @@ static int move_to_new_page(struct page *newpage, struct page *page,
+ */
+ if (!PageMappingFlags(page))
+ page->mapping = NULL;
++
++ if (unlikely(is_zone_device_page(newpage))) {
++ if (is_device_public_page(newpage))
++ flush_dcache_page(newpage);
++ } else
++ flush_dcache_page(newpage);
++
+ }
+ out:
+ return rc;
+diff --git a/mm/slab.c b/mm/slab.c
+index fad6839e8eab..364e42d5a399 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -2124,6 +2124,8 @@ done:
+ cachep->allocflags = __GFP_COMP;
+ if (flags & SLAB_CACHE_DMA)
+ cachep->allocflags |= GFP_DMA;
++ if (flags & SLAB_CACHE_DMA32)
++ cachep->allocflags |= GFP_DMA32;
+ if (flags & SLAB_RECLAIM_ACCOUNT)
+ cachep->allocflags |= __GFP_RECLAIMABLE;
+ cachep->size = size;
+diff --git a/mm/slab.h b/mm/slab.h
+index 58c6c1c2a78e..9632772e14be 100644
+--- a/mm/slab.h
++++ b/mm/slab.h
+@@ -127,7 +127,8 @@ static inline slab_flags_t kmem_cache_flags(unsigned int object_size,
+
+
+ /* Legal flag mask for kmem_cache_create(), for various configurations */
+-#define SLAB_CORE_FLAGS (SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA | SLAB_PANIC | \
++#define SLAB_CORE_FLAGS (SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA | \
++ SLAB_CACHE_DMA32 | SLAB_PANIC | \
+ SLAB_TYPESAFE_BY_RCU | SLAB_DEBUG_OBJECTS )
+
+ #if defined(CONFIG_DEBUG_SLAB)
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index 3a7ac4f15194..4d3c2e76d1ba 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -53,7 +53,7 @@ static DECLARE_WORK(slab_caches_to_rcu_destroy_work,
+ SLAB_FAILSLAB | SLAB_KASAN)
+
+ #define SLAB_MERGE_SAME (SLAB_RECLAIM_ACCOUNT | SLAB_CACHE_DMA | \
+- SLAB_ACCOUNT)
++ SLAB_CACHE_DMA32 | SLAB_ACCOUNT)
+
+ /*
+ * Merge control. If this is set then no merging of slab caches will occur.
+diff --git a/mm/slub.c b/mm/slub.c
+index 8da34a8af53d..09c0e24a06d8 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -3539,6 +3539,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
+ if (s->flags & SLAB_CACHE_DMA)
+ s->allocflags |= GFP_DMA;
+
++ if (s->flags & SLAB_CACHE_DMA32)
++ s->allocflags |= GFP_DMA32;
++
+ if (s->flags & SLAB_RECLAIM_ACCOUNT)
+ s->allocflags |= __GFP_RECLAIMABLE;
+
+@@ -5633,6 +5636,8 @@ static char *create_unique_id(struct kmem_cache *s)
+ */
+ if (s->flags & SLAB_CACHE_DMA)
+ *p++ = 'd';
++ if (s->flags & SLAB_CACHE_DMA32)
++ *p++ = 'D';
+ if (s->flags & SLAB_RECLAIM_ACCOUNT)
+ *p++ = 'a';
+ if (s->flags & SLAB_CONSISTENCY_CHECKS)
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index d17a4736e47c..2c6eabf294b3 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -3336,16 +3336,22 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
+
+ while (len >= L2CAP_CONF_OPT_SIZE) {
+ len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
++ if (len < 0)
++ break;
+
+ hint = type & L2CAP_CONF_HINT;
+ type &= L2CAP_CONF_MASK;
+
+ switch (type) {
+ case L2CAP_CONF_MTU:
++ if (olen != 2)
++ break;
+ mtu = val;
+ break;
+
+ case L2CAP_CONF_FLUSH_TO:
++ if (olen != 2)
++ break;
+ chan->flush_to = val;
+ break;
+
+@@ -3353,26 +3359,30 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
+ break;
+
+ case L2CAP_CONF_RFC:
+- if (olen == sizeof(rfc))
+- memcpy(&rfc, (void *) val, olen);
++ if (olen != sizeof(rfc))
++ break;
++ memcpy(&rfc, (void *) val, olen);
+ break;
+
+ case L2CAP_CONF_FCS:
++ if (olen != 1)
++ break;
+ if (val == L2CAP_FCS_NONE)
+ set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
+ break;
+
+ case L2CAP_CONF_EFS:
+- if (olen == sizeof(efs)) {
+- remote_efs = 1;
+- memcpy(&efs, (void *) val, olen);
+- }
++ if (olen != sizeof(efs))
++ break;
++ remote_efs = 1;
++ memcpy(&efs, (void *) val, olen);
+ break;
+
+ case L2CAP_CONF_EWS:
++ if (olen != 2)
++ break;
+ if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
+ return -ECONNREFUSED;
+-
+ set_bit(FLAG_EXT_CTRL, &chan->flags);
+ set_bit(CONF_EWS_RECV, &chan->conf_state);
+ chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
+@@ -3382,7 +3392,6 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
+ default:
+ if (hint)
+ break;
+-
+ result = L2CAP_CONF_UNKNOWN;
+ *((u8 *) ptr++) = type;
+ break;
+@@ -3547,58 +3556,65 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
+
+ while (len >= L2CAP_CONF_OPT_SIZE) {
+ len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
++ if (len < 0)
++ break;
+
+ switch (type) {
+ case L2CAP_CONF_MTU:
++ if (olen != 2)
++ break;
+ if (val < L2CAP_DEFAULT_MIN_MTU) {
+ *result = L2CAP_CONF_UNACCEPT;
+ chan->imtu = L2CAP_DEFAULT_MIN_MTU;
+ } else
+ chan->imtu = val;
+- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
++ endptr - ptr);
+ break;
+
+ case L2CAP_CONF_FLUSH_TO:
++ if (olen != 2)
++ break;
+ chan->flush_to = val;
+- l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
+- 2, chan->flush_to, endptr - ptr);
++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
++ chan->flush_to, endptr - ptr);
+ break;
+
+ case L2CAP_CONF_RFC:
+- if (olen == sizeof(rfc))
+- memcpy(&rfc, (void *)val, olen);
+-
++ if (olen != sizeof(rfc))
++ break;
++ memcpy(&rfc, (void *)val, olen);
+ if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
+ rfc.mode != chan->mode)
+ return -ECONNREFUSED;
+-
+ chan->fcs = 0;
+-
+- l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+- sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
++ (unsigned long) &rfc, endptr - ptr);
+ break;
+
+ case L2CAP_CONF_EWS:
++ if (olen != 2)
++ break;
+ chan->ack_win = min_t(u16, val, chan->ack_win);
+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
+ chan->tx_win, endptr - ptr);
+ break;
+
+ case L2CAP_CONF_EFS:
+- if (olen == sizeof(efs)) {
+- memcpy(&efs, (void *)val, olen);
+-
+- if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
+- efs.stype != L2CAP_SERV_NOTRAFIC &&
+- efs.stype != chan->local_stype)
+- return -ECONNREFUSED;
+-
+- l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
+- (unsigned long) &efs, endptr - ptr);
+- }
++ if (olen != sizeof(efs))
++ break;
++ memcpy(&efs, (void *)val, olen);
++ if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
++ efs.stype != L2CAP_SERV_NOTRAFIC &&
++ efs.stype != chan->local_stype)
++ return -ECONNREFUSED;
++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
++ (unsigned long) &efs, endptr - ptr);
+ break;
+
+ case L2CAP_CONF_FCS:
++ if (olen != 1)
++ break;
+ if (*result == L2CAP_CONF_PENDING)
+ if (val == L2CAP_FCS_NONE)
+ set_bit(CONF_RECV_NO_FCS,
+@@ -3727,13 +3743,18 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
+
+ while (len >= L2CAP_CONF_OPT_SIZE) {
+ len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
++ if (len < 0)
++ break;
+
+ switch (type) {
+ case L2CAP_CONF_RFC:
+- if (olen == sizeof(rfc))
+- memcpy(&rfc, (void *)val, olen);
++ if (olen != sizeof(rfc))
++ break;
++ memcpy(&rfc, (void *)val, olen);
+ break;
+ case L2CAP_CONF_EWS:
++ if (olen != 2)
++ break;
+ txwin_ext = val;
+ break;
+ }
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index 57f3a6fcfc1e..a487df53a453 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -279,7 +279,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk, unsigned int flags,
+ break;
+
+ sk_busy_loop(sk, flags & MSG_DONTWAIT);
+- } while (!skb_queue_empty(&sk->sk_receive_queue));
++ } while (sk->sk_receive_queue.prev != *last);
+
+ error = -EAGAIN;
+
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index 2aabb7eb0854..bf9a3b6ac885 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -934,6 +934,8 @@ static int rx_queue_add_kobject(struct net_device *dev, int index)
+ if (error)
+ return error;
+
++ dev_hold(queue->dev);
++
+ if (dev->sysfs_rx_queue_group) {
+ error = sysfs_create_group(kobj, dev->sysfs_rx_queue_group);
+ if (error) {
+@@ -943,7 +945,6 @@ static int rx_queue_add_kobject(struct net_device *dev, int index)
+ }
+
+ kobject_uevent(kobj, KOBJ_ADD);
+- dev_hold(queue->dev);
+
+ return error;
+ }
+@@ -1472,6 +1473,8 @@ static int netdev_queue_add_kobject(struct net_device *dev, int index)
+ if (error)
+ return error;
+
++ dev_hold(queue->dev);
++
+ #ifdef CONFIG_BQL
+ error = sysfs_create_group(kobj, &dql_group);
+ if (error) {
+@@ -1481,7 +1484,6 @@ static int netdev_queue_add_kobject(struct net_device *dev, int index)
+ #endif
+
+ kobject_uevent(kobj, KOBJ_ADD);
+- dev_hold(queue->dev);
+
+ return 0;
+ }
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 6344f1b18a6a..58a401e9cf09 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -433,8 +433,8 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
+ newnp->ipv6_mc_list = NULL;
+ newnp->ipv6_ac_list = NULL;
+ newnp->ipv6_fl_list = NULL;
+- newnp->mcast_oif = inet6_iif(skb);
+- newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
++ newnp->mcast_oif = inet_iif(skb);
++ newnp->mcast_hops = ip_hdr(skb)->ttl;
+
+ /*
+ * No need to charge this sock to the relevant IPv6 refcnt debug socks count
+diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
+index 17c455ff69ff..7858fa9ea103 100644
+--- a/net/ipv6/ila/ila_xlat.c
++++ b/net/ipv6/ila/ila_xlat.c
+@@ -420,6 +420,7 @@ int ila_xlat_nl_cmd_flush(struct sk_buff *skb, struct genl_info *info)
+
+ done:
+ rhashtable_walk_stop(&iter);
++ rhashtable_walk_exit(&iter);
+ return ret;
+ }
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 66cc94427437..9006bb3c9e72 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1048,14 +1048,20 @@ static struct rt6_info *ip6_create_rt_rcu(struct fib6_info *rt)
+ struct rt6_info *nrt;
+
+ if (!fib6_info_hold_safe(rt))
+- return NULL;
++ goto fallback;
+
+ nrt = ip6_dst_alloc(dev_net(dev), dev, flags);
+- if (nrt)
+- ip6_rt_copy_init(nrt, rt);
+- else
++ if (!nrt) {
+ fib6_info_release(rt);
++ goto fallback;
++ }
+
++ ip6_rt_copy_init(nrt, rt);
++ return nrt;
++
++fallback:
++ nrt = dev_net(dev)->ipv6.ip6_null_entry;
++ dst_hold(&nrt->dst);
+ return nrt;
+ }
+
+@@ -1104,10 +1110,6 @@ restart:
+ dst_hold(&rt->dst);
+ } else {
+ rt = ip6_create_rt_rcu(f6i);
+- if (!rt) {
+- rt = net->ipv6.ip6_null_entry;
+- dst_hold(&rt->dst);
+- }
+ }
+
+ rcu_read_unlock();
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 03e6b7a2bc53..e7cdfa92c382 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1108,11 +1108,11 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
+ newnp->ipv6_fl_list = NULL;
+ newnp->pktoptions = NULL;
+ newnp->opt = NULL;
+- newnp->mcast_oif = tcp_v6_iif(skb);
+- newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
+- newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
++ newnp->mcast_oif = inet_iif(skb);
++ newnp->mcast_hops = ip_hdr(skb)->ttl;
++ newnp->rcv_flowinfo = 0;
+ if (np->repflow)
+- newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
++ newnp->flow_label = 0;
+
+ /*
+ * No need to charge this sock to the relevant IPv6 refcnt debug socks count
+diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
+index 25eeb6d2a75a..f0ec068e1d02 100644
+--- a/net/netlink/genetlink.c
++++ b/net/netlink/genetlink.c
+@@ -366,7 +366,7 @@ int genl_register_family(struct genl_family *family)
+ start, end + 1, GFP_KERNEL);
+ if (family->id < 0) {
+ err = family->id;
+- goto errout_locked;
++ goto errout_free;
+ }
+
+ err = genl_validate_assign_mc_groups(family);
+@@ -385,6 +385,7 @@ int genl_register_family(struct genl_family *family)
+
+ errout_remove:
+ idr_remove(&genl_fam_idr, family->id);
++errout_free:
+ kfree(family->attrbuf);
+ errout_locked:
+ genl_unlock_all();
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index fd16fb836df2..a0d295478e69 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3245,7 +3245,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
+ }
+
+ mutex_lock(&net->packet.sklist_lock);
+- sk_add_node_rcu(sk, &net->packet.sklist);
++ sk_add_node_tail_rcu(sk, &net->packet.sklist);
+ mutex_unlock(&net->packet.sklist_lock);
+
+ preempt_disable();
+@@ -4194,7 +4194,7 @@ static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order)
+ struct pgv *pg_vec;
+ int i;
+
+- pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL);
++ pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL | __GFP_NOWARN);
+ if (unlikely(!pg_vec))
+ goto out;
+
+diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
+index 7ca57741b2fb..7849f286bb93 100644
+--- a/net/rose/rose_subr.c
++++ b/net/rose/rose_subr.c
+@@ -105,16 +105,17 @@ void rose_write_internal(struct sock *sk, int frametype)
+ struct sk_buff *skb;
+ unsigned char *dptr;
+ unsigned char lci1, lci2;
+- char buffer[100];
+- int len, faclen = 0;
++ int maxfaclen = 0;
++ int len, faclen;
++ int reserve;
+
+- len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN + 1;
++ reserve = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1;
++ len = ROSE_MIN_LEN;
+
+ switch (frametype) {
+ case ROSE_CALL_REQUEST:
+ len += 1 + ROSE_ADDR_LEN + ROSE_ADDR_LEN;
+- faclen = rose_create_facilities(buffer, rose);
+- len += faclen;
++ maxfaclen = 256;
+ break;
+ case ROSE_CALL_ACCEPTED:
+ case ROSE_CLEAR_REQUEST:
+@@ -123,15 +124,16 @@ void rose_write_internal(struct sock *sk, int frametype)
+ break;
+ }
+
+- if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL)
++ skb = alloc_skb(reserve + len + maxfaclen, GFP_ATOMIC);
++ if (!skb)
+ return;
+
+ /*
+ * Space for AX.25 header and PID.
+ */
+- skb_reserve(skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + 1);
++ skb_reserve(skb, reserve);
+
+- dptr = skb_put(skb, skb_tailroom(skb));
++ dptr = skb_put(skb, len);
+
+ lci1 = (rose->lci >> 8) & 0x0F;
+ lci2 = (rose->lci >> 0) & 0xFF;
+@@ -146,7 +148,8 @@ void rose_write_internal(struct sock *sk, int frametype)
+ dptr += ROSE_ADDR_LEN;
+ memcpy(dptr, &rose->source_addr, ROSE_ADDR_LEN);
+ dptr += ROSE_ADDR_LEN;
+- memcpy(dptr, buffer, faclen);
++ faclen = rose_create_facilities(dptr, rose);
++ skb_put(skb, faclen);
+ dptr += faclen;
+ break;
+
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index 8bf66d0a6800..f767e78e38c9 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -159,6 +159,9 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
+ }
+ m = to_mirred(*a);
+
++ if (ret == ACT_P_CREATED)
++ INIT_LIST_HEAD(&m->tcfm_list);
++
+ spin_lock_bh(&m->tcf_lock);
+ m->tcf_action = parm->action;
+ m->tcfm_eaction = parm->eaction;
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 1b16250c5718..8c00a7ef1bcd 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1017,7 +1017,7 @@ static int sctp_setsockopt_bindx(struct sock *sk,
+ if (unlikely(addrs_size <= 0))
+ return -EINVAL;
+
+- kaddrs = vmemdup_user(addrs, addrs_size);
++ kaddrs = memdup_user(addrs, addrs_size);
+ if (unlikely(IS_ERR(kaddrs)))
+ return PTR_ERR(kaddrs);
+
+@@ -1025,7 +1025,7 @@ static int sctp_setsockopt_bindx(struct sock *sk,
+ addr_buf = kaddrs;
+ while (walk_size < addrs_size) {
+ if (walk_size + sizeof(sa_family_t) > addrs_size) {
+- kvfree(kaddrs);
++ kfree(kaddrs);
+ return -EINVAL;
+ }
+
+@@ -1036,7 +1036,7 @@ static int sctp_setsockopt_bindx(struct sock *sk,
+ * causes the address buffer to overflow return EINVAL.
+ */
+ if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
+- kvfree(kaddrs);
++ kfree(kaddrs);
+ return -EINVAL;
+ }
+ addrcnt++;
+@@ -1072,7 +1072,7 @@ static int sctp_setsockopt_bindx(struct sock *sk,
+ }
+
+ out:
+- kvfree(kaddrs);
++ kfree(kaddrs);
+
+ return err;
+ }
+@@ -1347,7 +1347,7 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
+ if (unlikely(addrs_size <= 0))
+ return -EINVAL;
+
+- kaddrs = vmemdup_user(addrs, addrs_size);
++ kaddrs = memdup_user(addrs, addrs_size);
+ if (unlikely(IS_ERR(kaddrs)))
+ return PTR_ERR(kaddrs);
+
+@@ -1367,7 +1367,7 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
+ err = __sctp_connect(sk, kaddrs, addrs_size, flags, assoc_id);
+
+ out_free:
+- kvfree(kaddrs);
++ kfree(kaddrs);
+
+ return err;
+ }
+diff --git a/net/tipc/net.c b/net/tipc/net.c
+index f076edb74338..7ce1e86b024f 100644
+--- a/net/tipc/net.c
++++ b/net/tipc/net.c
+@@ -163,12 +163,9 @@ void tipc_sched_net_finalize(struct net *net, u32 addr)
+
+ void tipc_net_stop(struct net *net)
+ {
+- u32 self = tipc_own_addr(net);
+-
+- if (!self)
++ if (!tipc_own_id(net))
+ return;
+
+- tipc_nametbl_withdraw(net, TIPC_CFG_SRV, self, self, self);
+ rtnl_lock();
+ tipc_bearer_stop(net);
+ tipc_node_stop(net);
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 88c307ef1318..67a7b312a499 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -2310,6 +2310,16 @@ static int tipc_wait_for_connect(struct socket *sock, long *timeo_p)
+ return 0;
+ }
+
++static bool tipc_sockaddr_is_sane(struct sockaddr_tipc *addr)
++{
++ if (addr->family != AF_TIPC)
++ return false;
++ if (addr->addrtype == TIPC_SERVICE_RANGE)
++ return (addr->addr.nameseq.lower <= addr->addr.nameseq.upper);
++ return (addr->addrtype == TIPC_SERVICE_ADDR ||
++ addr->addrtype == TIPC_SOCKET_ADDR);
++}
++
+ /**
+ * tipc_connect - establish a connection to another TIPC port
+ * @sock: socket structure
+@@ -2345,18 +2355,18 @@ static int tipc_connect(struct socket *sock, struct sockaddr *dest,
+ if (!tipc_sk_type_connectionless(sk))
+ res = -EINVAL;
+ goto exit;
+- } else if (dst->family != AF_TIPC) {
+- res = -EINVAL;
+ }
+- if (dst->addrtype != TIPC_ADDR_ID && dst->addrtype != TIPC_ADDR_NAME)
++ if (!tipc_sockaddr_is_sane(dst)) {
+ res = -EINVAL;
+- if (res)
+ goto exit;
+-
++ }
+ /* DGRAM/RDM connect(), just save the destaddr */
+ if (tipc_sk_type_connectionless(sk)) {
+ memcpy(&tsk->peer, dest, destlen);
+ goto exit;
++ } else if (dst->addrtype == TIPC_SERVICE_RANGE) {
++ res = -EINVAL;
++ goto exit;
+ }
+
+ previous = sk->sk_state;
+diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
+index d65eed88c495..2301b09df234 100644
+--- a/net/tipc/topsrv.c
++++ b/net/tipc/topsrv.c
+@@ -371,6 +371,7 @@ static int tipc_conn_rcv_sub(struct tipc_topsrv *srv,
+ struct tipc_subscription *sub;
+
+ if (tipc_sub_read(s, filter) & TIPC_SUB_CANCEL) {
++ s->filter &= __constant_ntohl(~TIPC_SUB_CANCEL);
+ tipc_conn_delete_sub(con, s);
+ return 0;
+ }
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 5a77efd39b3f..858cbe56b100 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -640,7 +640,7 @@ static void handle_modversions(struct module *mod, struct elf_info *info,
+ info->sechdrs[sym->st_shndx].sh_offset -
+ (info->hdr->e_type != ET_REL ?
+ info->sechdrs[sym->st_shndx].sh_addr : 0);
+- crc = *crcp;
++ crc = TO_NATIVE(*crcp);
+ }
+ sym_update_crc(symname + strlen("__crc_"), mod, crc,
+ export);
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index 467039b342b5..41abb8bd466a 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -940,6 +940,28 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
+ oss_frame_size = snd_pcm_format_physical_width(params_format(params)) *
+ params_channels(params) / 8;
+
++ err = snd_pcm_oss_period_size(substream, params, sparams);
++ if (err < 0)
++ goto failure;
++
++ n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size);
++ err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL);
++ if (err < 0)
++ goto failure;
++
++ err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS,
++ runtime->oss.periods, NULL);
++ if (err < 0)
++ goto failure;
++
++ snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
++
++ err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams);
++ if (err < 0) {
++ pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err);
++ goto failure;
++ }
++
+ #ifdef CONFIG_SND_PCM_OSS_PLUGINS
+ snd_pcm_oss_plugin_clear(substream);
+ if (!direct) {
+@@ -974,27 +996,6 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
+ }
+ #endif
+
+- err = snd_pcm_oss_period_size(substream, params, sparams);
+- if (err < 0)
+- goto failure;
+-
+- n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size);
+- err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL);
+- if (err < 0)
+- goto failure;
+-
+- err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS,
+- runtime->oss.periods, NULL);
+- if (err < 0)
+- goto failure;
+-
+- snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+-
+- if ((err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams)) < 0) {
+- pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err);
+- goto failure;
+- }
+-
+ if (runtime->oss.trigger) {
+ sw_params->start_threshold = 1;
+ } else {
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 818dff1de545..b67f6fe08a1b 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -1426,8 +1426,15 @@ static int snd_pcm_pause(struct snd_pcm_substream *substream, int push)
+ static int snd_pcm_pre_suspend(struct snd_pcm_substream *substream, int state)
+ {
+ struct snd_pcm_runtime *runtime = substream->runtime;
+- if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED)
++ switch (runtime->status->state) {
++ case SNDRV_PCM_STATE_SUSPENDED:
+ return -EBUSY;
++ /* unresumable PCM state; return -EBUSY for skipping suspend */
++ case SNDRV_PCM_STATE_OPEN:
++ case SNDRV_PCM_STATE_SETUP:
++ case SNDRV_PCM_STATE_DISCONNECTED:
++ return -EBUSY;
++ }
+ runtime->trigger_master = substream;
+ return 0;
+ }
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index 08d5662039e3..a52d6d16efc4 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -30,6 +30,7 @@
+ #include <linux/module.h>
+ #include <linux/delay.h>
+ #include <linux/mm.h>
++#include <linux/nospec.h>
+ #include <sound/rawmidi.h>
+ #include <sound/info.h>
+ #include <sound/control.h>
+@@ -601,6 +602,7 @@ static int __snd_rawmidi_info_select(struct snd_card *card,
+ return -ENXIO;
+ if (info->stream < 0 || info->stream > 1)
+ return -EINVAL;
++ info->stream = array_index_nospec(info->stream, 2);
+ pstr = &rmidi->streams[info->stream];
+ if (pstr->substream_count == 0)
+ return -ENOENT;
+diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
+index 278ebb993122..c93945917235 100644
+--- a/sound/core/seq/oss/seq_oss_synth.c
++++ b/sound/core/seq/oss/seq_oss_synth.c
+@@ -617,13 +617,14 @@ int
+ snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_info *inf)
+ {
+ struct seq_oss_synth *rec;
++ struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev);
+
+- if (dev < 0 || dev >= dp->max_synthdev)
++ if (!info)
+ return -ENXIO;
+
+- if (dp->synths[dev].is_midi) {
++ if (info->is_midi) {
+ struct midi_info minf;
+- snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped, &minf);
++ snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf);
+ inf->synth_type = SYNTH_TYPE_MIDI;
+ inf->synth_subtype = 0;
+ inf->nr_voices = 16;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 877293149e3a..4c6321ec844d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5613,6 +5613,12 @@ enum {
+ ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
+ ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
+ ALC255_FIXUP_ACER_HEADSET_MIC,
++ ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE,
++ ALC225_FIXUP_WYSE_AUTO_MUTE,
++ ALC225_FIXUP_WYSE_DISABLE_MIC_VREF,
++ ALC286_FIXUP_ACER_AIO_HEADSET_MIC,
++ ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
++ ALC299_FIXUP_PREDATOR_SPK,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6567,6 +6573,54 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC
+ },
++ [ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x16, 0x01011020 }, /* Rear Line out */
++ { 0x19, 0x01a1913c }, /* use as Front headset mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC225_FIXUP_WYSE_AUTO_MUTE
++ },
++ [ALC225_FIXUP_WYSE_AUTO_MUTE] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_auto_mute_via_amp,
++ .chained = true,
++ .chain_id = ALC225_FIXUP_WYSE_DISABLE_MIC_VREF
++ },
++ [ALC225_FIXUP_WYSE_DISABLE_MIC_VREF] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_disable_mic_vref,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
++ },
++ [ALC286_FIXUP_ACER_AIO_HEADSET_MIC] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x4f },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x5029 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE
++ },
++ [ALC256_FIXUP_ASUS_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x04a11120 }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
++ },
++ [ALC299_FIXUP_PREDATOR_SPK] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x21, 0x90170150 }, /* use as headset mic, without its own jack detect */
++ { }
++ }
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6583,9 +6637,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
+ SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
+- SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+- SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+- SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x1099, "Acer Aspire E5-523G", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x110e, "Acer Aspire ES1-432", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK),
++ SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
+@@ -6631,6 +6689,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
++ SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+@@ -6976,6 +7036,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC255_FIXUP_DUMMY_LINEOUT_VERB, .name = "alc255-dummy-lineout"},
+ {.id = ALC255_FIXUP_DELL_HEADSET_MIC, .name = "alc255-dell-headset"},
+ {.id = ALC295_FIXUP_HP_X360, .name = "alc295-hp-x360"},
++ {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"},
+ {}
+ };
+ #define ALC225_STANDARD_PINS \
+@@ -7196,6 +7257,18 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x14, 0x90170110},
+ {0x1b, 0x90a70130},
+ {0x21, 0x03211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
++ {0x12, 0x90a60130},
++ {0x14, 0x90170110},
++ {0x21, 0x03211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
++ {0x12, 0x90a60130},
++ {0x14, 0x90170110},
++ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
++ {0x1a, 0x90a70130},
++ {0x1b, 0x90170110},
++ {0x21, 0x03211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
+ {0x12, 0xb7a60130},
+ {0x13, 0xb8a61140},
+diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
+index c9d038f91af6..53f8be0f4a1f 100644
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -25,14 +25,17 @@ LIBSUBCMD = $(LIBSUBCMD_OUTPUT)libsubcmd.a
+ OBJTOOL := $(OUTPUT)objtool
+ OBJTOOL_IN := $(OBJTOOL)-in.o
+
++LIBELF_FLAGS := $(shell pkg-config libelf --cflags 2>/dev/null)
++LIBELF_LIBS := $(shell pkg-config libelf --libs 2>/dev/null || echo -lelf)
++
+ all: $(OBJTOOL)
+
+ INCLUDES := -I$(srctree)/tools/include \
+ -I$(srctree)/tools/arch/$(HOSTARCH)/include/uapi \
+ -I$(srctree)/tools/objtool/arch/$(ARCH)/include
+ WARNINGS := $(EXTRA_WARNINGS) -Wno-switch-default -Wno-switch-enum -Wno-packed
+-CFLAGS += -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -g $(INCLUDES)
+-LDFLAGS += -lelf $(LIBSUBCMD) $(KBUILD_HOSTLDFLAGS)
++CFLAGS += -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -g $(INCLUDES) $(LIBELF_FLAGS)
++LDFLAGS += $(LIBELF_LIBS) $(LIBSUBCMD) $(KBUILD_HOSTLDFLAGS)
+
+ # Allow old libelf to be used:
+ elfshdr := $(shell echo '$(pound)include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr)
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index f3db68abbd9a..0bc3e6e93c31 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -251,19 +251,15 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params)
+ if (!(decoder->tsc_ctc_ratio_n % decoder->tsc_ctc_ratio_d))
+ decoder->tsc_ctc_mult = decoder->tsc_ctc_ratio_n /
+ decoder->tsc_ctc_ratio_d;
+-
+- /*
+- * Allow for timestamps appearing to backwards because a TSC
+- * packet has slipped past a MTC packet, so allow 2 MTC ticks
+- * or ...
+- */
+- decoder->tsc_slip = multdiv(2 << decoder->mtc_shift,
+- decoder->tsc_ctc_ratio_n,
+- decoder->tsc_ctc_ratio_d);
+ }
+- /* ... or 0x100 paranoia */
+- if (decoder->tsc_slip < 0x100)
+- decoder->tsc_slip = 0x100;
++
++ /*
++ * A TSC packet can slip past MTC packets so that the timestamp appears
++ * to go backwards. One estimate is that can be up to about 40 CPU
++ * cycles, which is certainly less than 0x1000 TSC ticks, but accept
++ * slippage an order of magnitude more to be on the safe side.
++ */
++ decoder->tsc_slip = 0x10000;
+
+ intel_pt_log("timestamp: mtc_shift %u\n", decoder->mtc_shift);
+ intel_pt_log("timestamp: tsc_ctc_ratio_n %u\n", decoder->tsc_ctc_ratio_n);
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index 7348eea0248f..36cfc64c3824 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -773,10 +773,20 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
+
+ if (!is_arm_pmu_core(name)) {
+ pname = pe->pmu ? pe->pmu : "cpu";
++
++ /*
++ * uncore alias may be from different PMU
++ * with common prefix
++ */
++ if (pmu_is_uncore(name) &&
++ !strncmp(pname, name, strlen(pname)))
++ goto new_alias;
++
+ if (strcmp(pname, name))
+ continue;
+ }
+
++new_alias:
+ /* need type casts to override 'const' */
+ __perf_pmu__new_alias(head, NULL, (char *)pe->name,
+ (char *)pe->desc, (char *)pe->event,
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index c436d95fd7aa..6a79df88b546 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2815,6 +2815,9 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl,
+ {
+ struct kvm_device *dev = filp->private_data;
+
++ if (dev->kvm->mm != current->mm)
++ return -EIO;
++
+ switch (ioctl) {
+ case KVM_SET_DEVICE_ATTR:
+ return kvm_device_ioctl_attr(dev, dev->ops->set_attr, arg);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-04-05 21:46 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-04-05 21:46 UTC (permalink / raw
To: gentoo-commits
commit: 86cdbee32996ca63bf3d6e9144a6400a3c4ac2a9
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Apr 5 21:45:59 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Apr 5 21:45:59 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=86cdbee3
Linux patch 4.19.34
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1033_linux-4.19.34.patch | 6193 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6197 insertions(+)
diff --git a/0000_README b/0000_README
index fe8b3d1..e752acc 100644
--- a/0000_README
+++ b/0000_README
@@ -175,6 +175,10 @@ Patch: 1032_linux-4.19.33.patch
From: http://www.kernel.org
Desc: Linux 4.19.33
+Patch: 1033_linux-4.19.34.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.34
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1033_linux-4.19.34.patch b/1033_linux-4.19.34.patch
new file mode 100644
index 0000000..b499004
--- /dev/null
+++ b/1033_linux-4.19.34.patch
@@ -0,0 +1,6193 @@
+diff --git a/Documentation/arm/kernel_mode_neon.txt b/Documentation/arm/kernel_mode_neon.txt
+index 525452726d31..b9e060c5b61e 100644
+--- a/Documentation/arm/kernel_mode_neon.txt
++++ b/Documentation/arm/kernel_mode_neon.txt
+@@ -6,7 +6,7 @@ TL;DR summary
+ * Use only NEON instructions, or VFP instructions that don't rely on support
+ code
+ * Isolate your NEON code in a separate compilation unit, and compile it with
+- '-mfpu=neon -mfloat-abi=softfp'
++ '-march=armv7-a -mfpu=neon -mfloat-abi=softfp'
+ * Put kernel_neon_begin() and kernel_neon_end() calls around the calls into your
+ NEON code
+ * Don't sleep in your NEON code, and be aware that it will be executed with
+@@ -87,7 +87,7 @@ instructions appearing in unexpected places if no special care is taken.
+ Therefore, the recommended and only supported way of using NEON/VFP in the
+ kernel is by adhering to the following rules:
+ * isolate the NEON code in a separate compilation unit and compile it with
+- '-mfpu=neon -mfloat-abi=softfp';
++ '-march=armv7-a -mfpu=neon -mfloat-abi=softfp';
+ * issue the calls to kernel_neon_begin(), kernel_neon_end() as well as the calls
+ into the unit containing the NEON code from a compilation unit which is *not*
+ built with the GCC flag '-mfpu=neon' set.
+diff --git a/Makefile b/Makefile
+index 8de5fab711d8..8fdfe0af5862 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 33
++SUBLEVEL = 34
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -626,12 +626,15 @@ ifeq ($(may-sync-config),1)
+ -include include/config/auto.conf.cmd
+
+ # To avoid any implicit rule to kick in, define an empty command
+-$(KCONFIG_CONFIG) include/config/auto.conf.cmd: ;
++$(KCONFIG_CONFIG): ;
+
+ # The actual configuration files used during the build are stored in
+ # include/generated/ and include/config/. Update them if .config is newer than
+ # include/config/auto.conf (which mirrors .config).
+-include/config/%.conf: $(KCONFIG_CONFIG) include/config/auto.conf.cmd
++#
++# This exploits the 'multi-target pattern rule' trick.
++# The syncconfig should be executed only once to make all the targets.
++%/auto.conf %/auto.conf.cmd %/tristate.conf: $(KCONFIG_CONFIG)
+ $(Q)$(MAKE) -f $(srctree)/Makefile syncconfig
+ else
+ # External modules and some install targets need include/generated/autoconf.h
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index abff7ef7c9cd..4981741377f3 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -230,7 +230,7 @@
+ status = "disabled";
+ };
+
+- i2s1: i2s@2009C000 {
++ i2s1: i2s@2009c000 {
+ compatible = "nxp,lpc3220-i2s";
+ reg = <0x2009C000 0x1000>;
+ };
+@@ -273,7 +273,7 @@
+ status = "disabled";
+ };
+
+- i2c1: i2c@400A0000 {
++ i2c1: i2c@400a0000 {
+ compatible = "nxp,pnx-i2c";
+ reg = <0x400A0000 0x100>;
+ interrupt-parent = <&sic1>;
+@@ -284,7 +284,7 @@
+ clocks = <&clk LPC32XX_CLK_I2C1>;
+ };
+
+- i2c2: i2c@400A8000 {
++ i2c2: i2c@400a8000 {
+ compatible = "nxp,pnx-i2c";
+ reg = <0x400A8000 0x100>;
+ interrupt-parent = <&sic1>;
+@@ -295,7 +295,7 @@
+ clocks = <&clk LPC32XX_CLK_I2C2>;
+ };
+
+- mpwm: mpwm@400E8000 {
++ mpwm: mpwm@400e8000 {
+ compatible = "nxp,lpc3220-motor-pwm";
+ reg = <0x400E8000 0x78>;
+ status = "disabled";
+@@ -394,7 +394,7 @@
+ #gpio-cells = <3>; /* bank, pin, flags */
+ };
+
+- timer4: timer@4002C000 {
++ timer4: timer@4002c000 {
+ compatible = "nxp,lpc3220-timer";
+ reg = <0x4002C000 0x1000>;
+ interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+@@ -412,7 +412,7 @@
+ status = "disabled";
+ };
+
+- watchdog: watchdog@4003C000 {
++ watchdog: watchdog@4003c000 {
+ compatible = "nxp,pnx4008-wdt";
+ reg = <0x4003C000 0x1000>;
+ clocks = <&clk LPC32XX_CLK_WDOG>;
+@@ -451,7 +451,7 @@
+ status = "disabled";
+ };
+
+- timer1: timer@4004C000 {
++ timer1: timer@4004c000 {
+ compatible = "nxp,lpc3220-timer";
+ reg = <0x4004C000 0x1000>;
+ interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
+@@ -475,7 +475,7 @@
+ status = "disabled";
+ };
+
+- pwm1: pwm@4005C000 {
++ pwm1: pwm@4005c000 {
+ compatible = "nxp,lpc3220-pwm";
+ reg = <0x4005C000 0x4>;
+ clocks = <&clk LPC32XX_CLK_PWM1>;
+@@ -484,7 +484,7 @@
+ status = "disabled";
+ };
+
+- pwm2: pwm@4005C004 {
++ pwm2: pwm@4005c004 {
+ compatible = "nxp,lpc3220-pwm";
+ reg = <0x4005C004 0x4>;
+ clocks = <&clk LPC32XX_CLK_PWM2>;
+diff --git a/arch/arm/boot/dts/meson8b.dtsi b/arch/arm/boot/dts/meson8b.dtsi
+index 08f7f6be7254..5b3e5c50c72f 100644
+--- a/arch/arm/boot/dts/meson8b.dtsi
++++ b/arch/arm/boot/dts/meson8b.dtsi
+@@ -207,9 +207,7 @@
+ groups = "eth_tx_clk",
+ "eth_tx_en",
+ "eth_txd1_0",
+- "eth_txd1_1",
+ "eth_txd0_0",
+- "eth_txd0_1",
+ "eth_rx_clk",
+ "eth_rx_dv",
+ "eth_rxd1",
+@@ -218,7 +216,9 @@
+ "eth_mdc",
+ "eth_ref_clk",
+ "eth_txd2",
+- "eth_txd3";
++ "eth_txd3",
++ "eth_rxd3",
++ "eth_rxd2";
+ function = "ethernet";
+ };
+ };
+diff --git a/arch/arm/include/asm/barrier.h b/arch/arm/include/asm/barrier.h
+index 69772e742a0a..83ae97c049d9 100644
+--- a/arch/arm/include/asm/barrier.h
++++ b/arch/arm/include/asm/barrier.h
+@@ -11,6 +11,8 @@
+ #define sev() __asm__ __volatile__ ("sev" : : : "memory")
+ #define wfe() __asm__ __volatile__ ("wfe" : : : "memory")
+ #define wfi() __asm__ __volatile__ ("wfi" : : : "memory")
++#else
++#define wfe() do { } while (0)
+ #endif
+
+ #if __LINUX_ARM_ARCH__ >= 7
+diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
+index 1bf65b47808a..cb2a3423b714 100644
+--- a/arch/arm/include/asm/processor.h
++++ b/arch/arm/include/asm/processor.h
+@@ -95,7 +95,11 @@ extern void release_thread(struct task_struct *);
+ unsigned long get_wchan(struct task_struct *p);
+
+ #if __LINUX_ARM_ARCH__ == 6 || defined(CONFIG_ARM_ERRATA_754327)
+-#define cpu_relax() smp_mb()
++#define cpu_relax() \
++ do { \
++ smp_mb(); \
++ __asm__ __volatile__("nop; nop; nop; nop; nop; nop; nop; nop; nop; nop;"); \
++ } while (0)
+ #else
+ #define cpu_relax() barrier()
+ #endif
+diff --git a/arch/arm/include/asm/v7m.h b/arch/arm/include/asm/v7m.h
+index 187ccf6496ad..2cb00d15831b 100644
+--- a/arch/arm/include/asm/v7m.h
++++ b/arch/arm/include/asm/v7m.h
+@@ -49,7 +49,7 @@
+ * (0 -> msp; 1 -> psp). Bits [1:0] are fixed to 0b01.
+ */
+ #define EXC_RET_STACK_MASK 0x00000004
+-#define EXC_RET_THREADMODE_PROCESSSTACK 0xfffffffd
++#define EXC_RET_THREADMODE_PROCESSSTACK (3 << 2)
+
+ /* Cache related definitions */
+
+diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
+index 773424843d6e..62db1c9746cb 100644
+--- a/arch/arm/kernel/entry-header.S
++++ b/arch/arm/kernel/entry-header.S
+@@ -127,7 +127,8 @@
+ */
+ .macro v7m_exception_slow_exit ret_r0
+ cpsid i
+- ldr lr, =EXC_RET_THREADMODE_PROCESSSTACK
++ ldr lr, =exc_ret
++ ldr lr, [lr]
+
+ @ read original r12, sp, lr, pc and xPSR
+ add r12, sp, #S_IP
+diff --git a/arch/arm/kernel/entry-v7m.S b/arch/arm/kernel/entry-v7m.S
+index abcf47848525..19d2dcd6530d 100644
+--- a/arch/arm/kernel/entry-v7m.S
++++ b/arch/arm/kernel/entry-v7m.S
+@@ -146,3 +146,7 @@ ENTRY(vector_table)
+ .rept CONFIG_CPU_V7M_NUM_IRQ
+ .long __irq_entry @ External Interrupts
+ .endr
++ .align 2
++ .globl exc_ret
++exc_ret:
++ .space 4
+diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
+index dd2eb5f76b9f..76300f3813e8 100644
+--- a/arch/arm/kernel/machine_kexec.c
++++ b/arch/arm/kernel/machine_kexec.c
+@@ -91,8 +91,11 @@ void machine_crash_nonpanic_core(void *unused)
+
+ set_cpu_online(smp_processor_id(), false);
+ atomic_dec(&waiting_for_crash_ipi);
+- while (1)
++
++ while (1) {
+ cpu_relax();
++ wfe();
++ }
+ }
+
+ void crash_smp_send_stop(void)
+diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
+index 1d6f5ea522f4..a3ce7c5365fa 100644
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -604,8 +604,10 @@ static void ipi_cpu_stop(unsigned int cpu)
+ local_fiq_disable();
+ local_irq_disable();
+
+- while (1)
++ while (1) {
+ cpu_relax();
++ wfe();
++ }
+ }
+
+ static DEFINE_PER_CPU(struct completion *, cpu_completion);
+diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
+index 0bee233fef9a..314cfb232a63 100644
+--- a/arch/arm/kernel/unwind.c
++++ b/arch/arm/kernel/unwind.c
+@@ -93,7 +93,7 @@ extern const struct unwind_idx __start_unwind_idx[];
+ static const struct unwind_idx *__origin_unwind_idx;
+ extern const struct unwind_idx __stop_unwind_idx[];
+
+-static DEFINE_SPINLOCK(unwind_lock);
++static DEFINE_RAW_SPINLOCK(unwind_lock);
+ static LIST_HEAD(unwind_tables);
+
+ /* Convert a prel31 symbol to an absolute address */
+@@ -201,7 +201,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr)
+ /* module unwind tables */
+ struct unwind_table *table;
+
+- spin_lock_irqsave(&unwind_lock, flags);
++ raw_spin_lock_irqsave(&unwind_lock, flags);
+ list_for_each_entry(table, &unwind_tables, list) {
+ if (addr >= table->begin_addr &&
+ addr < table->end_addr) {
+@@ -213,7 +213,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned long addr)
+ break;
+ }
+ }
+- spin_unlock_irqrestore(&unwind_lock, flags);
++ raw_spin_unlock_irqrestore(&unwind_lock, flags);
+ }
+
+ pr_debug("%s: idx = %p\n", __func__, idx);
+@@ -529,9 +529,9 @@ struct unwind_table *unwind_table_add(unsigned long start, unsigned long size,
+ tab->begin_addr = text_addr;
+ tab->end_addr = text_addr + text_size;
+
+- spin_lock_irqsave(&unwind_lock, flags);
++ raw_spin_lock_irqsave(&unwind_lock, flags);
+ list_add_tail(&tab->list, &unwind_tables);
+- spin_unlock_irqrestore(&unwind_lock, flags);
++ raw_spin_unlock_irqrestore(&unwind_lock, flags);
+
+ return tab;
+ }
+@@ -543,9 +543,9 @@ void unwind_table_del(struct unwind_table *tab)
+ if (!tab)
+ return;
+
+- spin_lock_irqsave(&unwind_lock, flags);
++ raw_spin_lock_irqsave(&unwind_lock, flags);
+ list_del(&tab->list);
+- spin_unlock_irqrestore(&unwind_lock, flags);
++ raw_spin_unlock_irqrestore(&unwind_lock, flags);
+
+ kfree(tab);
+ }
+diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile
+index ad25fd1872c7..0bff0176db2c 100644
+--- a/arch/arm/lib/Makefile
++++ b/arch/arm/lib/Makefile
+@@ -39,7 +39,7 @@ $(obj)/csumpartialcopy.o: $(obj)/csumpartialcopygeneric.S
+ $(obj)/csumpartialcopyuser.o: $(obj)/csumpartialcopygeneric.S
+
+ ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
+- NEON_FLAGS := -mfloat-abi=softfp -mfpu=neon
++ NEON_FLAGS := -march=armv7-a -mfloat-abi=softfp -mfpu=neon
+ CFLAGS_xor-neon.o += $(NEON_FLAGS)
+ obj-$(CONFIG_XOR_BLOCKS) += xor-neon.o
+ endif
+diff --git a/arch/arm/lib/xor-neon.c b/arch/arm/lib/xor-neon.c
+index 2c40aeab3eaa..c691b901092f 100644
+--- a/arch/arm/lib/xor-neon.c
++++ b/arch/arm/lib/xor-neon.c
+@@ -14,7 +14,7 @@
+ MODULE_LICENSE("GPL");
+
+ #ifndef __ARM_NEON__
+-#error You should compile this file with '-mfloat-abi=softfp -mfpu=neon'
++#error You should compile this file with '-march=armv7-a -mfloat-abi=softfp -mfpu=neon'
+ #endif
+
+ /*
+diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c
+index 058a37e6d11c..fd6e0671f957 100644
+--- a/arch/arm/mach-omap2/prm_common.c
++++ b/arch/arm/mach-omap2/prm_common.c
+@@ -523,8 +523,10 @@ void omap_prm_reset_system(void)
+
+ prm_ll_data->reset_system();
+
+- while (1)
++ while (1) {
+ cpu_relax();
++ wfe();
++ }
+ }
+
+ /**
+diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S
+index 47a5acc64433..92e84181933a 100644
+--- a/arch/arm/mm/proc-v7m.S
++++ b/arch/arm/mm/proc-v7m.S
+@@ -139,6 +139,9 @@ __v7m_setup_cont:
+ cpsie i
+ svc #0
+ 1: cpsid i
++ ldr r0, =exc_ret
++ orr lr, lr, #EXC_RET_THREADMODE_PROCESSSTACK
++ str lr, [r0]
+ ldmia sp, {r0-r3, r12}
+ str r5, [r12, #11 * 4] @ restore the original SVC vector entry
+ mov lr, r6 @ restore LR
+diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
+index 50b30ff30de4..a4c134677285 100644
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -827,11 +827,12 @@ void __init hook_debug_fault_code(int nr,
+ debug_fault_info[nr].name = name;
+ }
+
+-asmlinkage int __exception do_debug_exception(unsigned long addr,
++asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint,
+ unsigned int esr,
+ struct pt_regs *regs)
+ {
+ const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr);
++ unsigned long pc = instruction_pointer(regs);
+ int rv;
+
+ /*
+@@ -841,10 +842,10 @@ asmlinkage int __exception do_debug_exception(unsigned long addr,
+ if (interrupts_enabled(regs))
+ trace_hardirqs_off();
+
+- if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE)
++ if (user_mode(regs) && pc > TASK_SIZE)
+ arm64_apply_bp_hardening();
+
+- if (!inf->fn(addr, esr, regs)) {
++ if (!inf->fn(addr_if_watchpoint, esr, regs)) {
+ rv = 1;
+ } else {
+ struct siginfo info;
+@@ -853,7 +854,7 @@ asmlinkage int __exception do_debug_exception(unsigned long addr,
+ info.si_signo = inf->sig;
+ info.si_errno = 0;
+ info.si_code = inf->code;
+- info.si_addr = (void __user *)addr;
++ info.si_addr = (void __user *)pc;
+ arm64_notify_die(inf->name, regs, &info, esr);
+ rv = 0;
+ }
+diff --git a/arch/h8300/Makefile b/arch/h8300/Makefile
+index 58634e6bae92..55f251810129 100644
+--- a/arch/h8300/Makefile
++++ b/arch/h8300/Makefile
+@@ -27,7 +27,7 @@ KBUILD_LDFLAGS += $(ldflags-y)
+ CHECKFLAGS += -msize-long
+
+ ifeq ($(CROSS_COMPILE),)
+-CROSS_COMPILE := h8300-unknown-linux-
++CROSS_COMPILE := $(call cc-cross-prefix, h8300-unknown-linux- h8300-linux-)
+ endif
+
+ core-y += arch/$(ARCH)/kernel/ arch/$(ARCH)/mm/
+diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
+index a4a718dbfec6..f85e2b01c3df 100644
+--- a/arch/powerpc/include/asm/topology.h
++++ b/arch/powerpc/include/asm/topology.h
+@@ -132,6 +132,8 @@ static inline void shared_proc_topology_init(void) {}
+ #define topology_sibling_cpumask(cpu) (per_cpu(cpu_sibling_map, cpu))
+ #define topology_core_cpumask(cpu) (per_cpu(cpu_core_map, cpu))
+ #define topology_core_id(cpu) (cpu_to_core_id(cpu))
++
++int dlpar_cpu_readd(int cpu);
+ #endif
+ #endif
+
+diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
+index c806a3c12592..7a46e0e57a36 100644
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -994,6 +994,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
+ ld r2,_NIP(r1)
+ mtspr SPRN_SRR0,r2
+
++ /*
++ * Leaving a stale exception_marker on the stack can confuse
++ * the reliable stack unwinder later on. Clear it.
++ */
++ li r2,0
++ std r2,STACK_FRAME_OVERHEAD-16(r1)
++
+ ld r0,GPR0(r1)
+ ld r2,GPR2(r1)
+ ld r3,GPR3(r1)
+diff --git a/arch/powerpc/mm/hugetlbpage-radix.c b/arch/powerpc/mm/hugetlbpage-radix.c
+index 2486bee0f93e..97c7a39ebc00 100644
+--- a/arch/powerpc/mm/hugetlbpage-radix.c
++++ b/arch/powerpc/mm/hugetlbpage-radix.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include <linux/mm.h>
+ #include <linux/hugetlb.h>
++#include <linux/security.h>
+ #include <asm/pgtable.h>
+ #include <asm/pgalloc.h>
+ #include <asm/cacheflush.h>
+@@ -73,7 +74,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ if (addr) {
+ addr = ALIGN(addr, huge_page_size(h));
+ vma = find_vma(mm, addr);
+- if (high_limit - len >= addr &&
++ if (high_limit - len >= addr && addr >= mmap_min_addr &&
+ (!vma || addr + len <= vm_start_gap(vma)))
+ return addr;
+ }
+@@ -83,7 +84,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+ */
+ info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ info.length = len;
+- info.low_limit = PAGE_SIZE;
++ info.low_limit = max(PAGE_SIZE, mmap_min_addr);
+ info.high_limit = mm->mmap_base + (high_limit - DEFAULT_MAP_WINDOW);
+ info.align_mask = PAGE_MASK & ~huge_page_mask(h);
+ info.align_offset = 0;
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 5500e4edabc6..10fb43efef50 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -1461,13 +1461,6 @@ static void reset_topology_timer(void)
+
+ #ifdef CONFIG_SMP
+
+-static void stage_topology_update(int core_id)
+-{
+- cpumask_or(&cpu_associativity_changes_mask,
+- &cpu_associativity_changes_mask, cpu_sibling_mask(core_id));
+- reset_topology_timer();
+-}
+-
+ static int dt_update_callback(struct notifier_block *nb,
+ unsigned long action, void *data)
+ {
+@@ -1480,7 +1473,7 @@ static int dt_update_callback(struct notifier_block *nb,
+ !of_prop_cmp(update->prop->name, "ibm,associativity")) {
+ u32 core_id;
+ of_property_read_u32(update->dn, "reg", &core_id);
+- stage_topology_update(core_id);
++ rc = dlpar_cpu_readd(core_id);
+ rc = NOTIFY_OK;
+ }
+ break;
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda-tce.c b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+index 7639b2168755..f5adb6b756f7 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda-tce.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+@@ -313,7 +313,6 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+ page_shift);
+ tbl->it_level_size = 1ULL << (level_shift - 3);
+ tbl->it_indirect_levels = levels - 1;
+- tbl->it_allocated_size = total_allocated;
+ tbl->it_userspace = uas;
+ tbl->it_nid = nid;
+
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index cde710297a4e..326ca6288bb1 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -2603,8 +2603,13 @@ static long pnv_pci_ioda2_create_table_userspace(
+ int num, __u32 page_shift, __u64 window_size, __u32 levels,
+ struct iommu_table **ptbl)
+ {
+- return pnv_pci_ioda2_create_table(table_group,
++ long ret = pnv_pci_ioda2_create_table(table_group,
+ num, page_shift, window_size, levels, true, ptbl);
++
++ if (!ret)
++ (*ptbl)->it_allocated_size = pnv_pci_ioda2_get_table_size(
++ page_shift, window_size, levels);
++ return ret;
+ }
+
+ static void pnv_ioda2_take_ownership(struct iommu_table_group *table_group)
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index 6ef77caf7bcf..1d3f9313c02f 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -802,6 +802,25 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
+ return rc;
+ }
+
++int dlpar_cpu_readd(int cpu)
++{
++ struct device_node *dn;
++ struct device *dev;
++ u32 drc_index;
++ int rc;
++
++ dev = get_cpu_device(cpu);
++ dn = dev->of_node;
++
++ rc = of_property_read_u32(dn, "ibm,my-drc-index", &drc_index);
++
++ rc = dlpar_cpu_remove_by_index(drc_index);
++ if (!rc)
++ rc = dlpar_cpu_add(drc_index);
++
++ return rc;
++}
++
+ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
+ {
+ u32 count, drc_index;
+diff --git a/arch/powerpc/xmon/ppc-dis.c b/arch/powerpc/xmon/ppc-dis.c
+index 9deea5ee13f6..27f1e6415036 100644
+--- a/arch/powerpc/xmon/ppc-dis.c
++++ b/arch/powerpc/xmon/ppc-dis.c
+@@ -158,7 +158,7 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr)
+ dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7
+ | PPC_OPCODE_POWER8 | PPC_OPCODE_POWER9 | PPC_OPCODE_HTM
+ | PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2
+- | PPC_OPCODE_VSX | PPC_OPCODE_VSX3),
++ | PPC_OPCODE_VSX | PPC_OPCODE_VSX3);
+
+ /* Get the major opcode of the insn. */
+ opcode = NULL;
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index 5c53e977be62..44404836e9d1 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -1600,7 +1600,7 @@ static void aux_sdb_init(unsigned long sdb)
+
+ /*
+ * aux_buffer_setup() - Setup AUX buffer for diagnostic mode sampling
+- * @cpu: On which to allocate, -1 means current
++ * @event: Event the buffer is setup for, event->cpu == -1 means current
+ * @pages: Array of pointers to buffer pages passed from perf core
+ * @nr_pages: Total pages
+ * @snapshot: Flag for snapshot mode
+@@ -1612,8 +1612,8 @@ static void aux_sdb_init(unsigned long sdb)
+ *
+ * Return the private AUX buffer structure if success or NULL if fails.
+ */
+-static void *aux_buffer_setup(int cpu, void **pages, int nr_pages,
+- bool snapshot)
++static void *aux_buffer_setup(struct perf_event *event, void **pages,
++ int nr_pages, bool snapshot)
+ {
+ struct sf_buffer *sfb;
+ struct aux_buffer *aux;
+diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
+index 9b5adae9cc40..e2839b5c246c 100644
+--- a/arch/x86/boot/Makefile
++++ b/arch/x86/boot/Makefile
+@@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmlinux FORCE
+ AFLAGS_header.o += -I$(objtree)/$(obj)
+ $(obj)/header.o: $(obj)/zoffset.h
+
+-LDFLAGS_setup.elf := -T
++LDFLAGS_setup.elf := -m elf_i386 -T
+ $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE
+ $(call if_changed,ld)
+
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index f95dcb209fdf..617df50a11d9 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -627,6 +627,7 @@ ENTRY(interrupt_entry)
+
+ ret
+ END(interrupt_entry)
++_ASM_NOKPROBE(interrupt_entry)
+
+
+ /* Interrupt entry/exit. */
+@@ -826,6 +827,7 @@ native_irq_return_ldt:
+ jmp native_irq_return_iret
+ #endif
+ END(common_interrupt)
++_ASM_NOKPROBE(common_interrupt)
+
+ /*
+ * APIC interrupts.
+@@ -840,6 +842,7 @@ ENTRY(\sym)
+ call \do_sym /* rdi points to pt_regs */
+ jmp ret_from_intr
+ END(\sym)
++_ASM_NOKPROBE(\sym)
+ .endm
+
+ /* Make sure APIC interrupt handlers end up in the irqentry section: */
+@@ -984,6 +987,7 @@ ENTRY(\sym)
+
+ jmp error_exit
+ .endif
++_ASM_NOKPROBE(\sym)
+ END(\sym)
+ .endm
+
+diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
+index 24ffa1e88cf9..7139f6bf27ad 100644
+--- a/arch/x86/events/intel/bts.c
++++ b/arch/x86/events/intel/bts.c
+@@ -77,10 +77,12 @@ static size_t buf_size(struct page *page)
+ }
+
+ static void *
+-bts_buffer_setup_aux(int cpu, void **pages, int nr_pages, bool overwrite)
++bts_buffer_setup_aux(struct perf_event *event, void **pages,
++ int nr_pages, bool overwrite)
+ {
+ struct bts_buffer *buf;
+ struct page *page;
++ int cpu = event->cpu;
+ int node = (cpu == -1) ? cpu : cpu_to_node(cpu);
+ unsigned long offset;
+ size_t size = nr_pages << PAGE_SHIFT;
+diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
+index 8d016ce5b80d..8f4c98fdd03c 100644
+--- a/arch/x86/events/intel/pt.c
++++ b/arch/x86/events/intel/pt.c
+@@ -1104,10 +1104,11 @@ static int pt_buffer_init_topa(struct pt_buffer *buf, unsigned long nr_pages,
+ * Return: Our private PT buffer structure.
+ */
+ static void *
+-pt_buffer_setup_aux(int cpu, void **pages, int nr_pages, bool snapshot)
++pt_buffer_setup_aux(struct perf_event *event, void **pages,
++ int nr_pages, bool snapshot)
+ {
+ struct pt_buffer *buf;
+- int node, ret;
++ int node, ret, cpu = event->cpu;
+
+ if (!nr_pages)
+ return NULL;
+diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
+index 20c876c7c5bf..87abd5145cc9 100644
+--- a/arch/x86/hyperv/hv_init.c
++++ b/arch/x86/hyperv/hv_init.c
+@@ -387,6 +387,13 @@ void hyperv_cleanup(void)
+ /* Reset our OS id */
+ wrmsrl(HV_X64_MSR_GUEST_OS_ID, 0);
+
++ /*
++ * Reset hypercall page reference before reset the page,
++ * let hypercall operations fail safely rather than
++ * panic the kernel for using invalid hypercall page
++ */
++ hv_hypercall_pg = NULL;
++
+ /* Reset the hypercall page */
+ hypercall_msr.as_uint64 = 0;
+ wrmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
+diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
+index 5dd3317d761f..c63bab98780c 100644
+--- a/arch/x86/kernel/vmlinux.lds.S
++++ b/arch/x86/kernel/vmlinux.lds.S
+@@ -411,7 +411,7 @@ SECTIONS
+ * Per-cpu symbols which need to be offset from __per_cpu_load
+ * for the boot processor.
+ */
+-#define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
++#define INIT_PER_CPU(x) init_per_cpu__##x = ABSOLUTE(x) + __per_cpu_load
+ INIT_PER_CPU(gdt_page);
+ INIT_PER_CPU(irq_stack_union);
+
+diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile
+index 4463fa72db94..96cb20de08af 100644
+--- a/arch/x86/realmode/rm/Makefile
++++ b/arch/x86/realmode/rm/Makefile
+@@ -47,7 +47,7 @@ $(obj)/pasyms.h: $(REALMODE_OBJS) FORCE
+ targets += realmode.lds
+ $(obj)/realmode.lds: $(obj)/pasyms.h
+
+-LDFLAGS_realmode.elf := --emit-relocs -T
++LDFLAGS_realmode.elf := -m elf_i386 --emit-relocs -T
+ CPPFLAGS_realmode.lds += -P -C -I$(objtree)/$(obj)
+
+ targets += realmode.elf
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 653100fb719e..c5e2c5a01182 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2215,7 +2215,8 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+
+ if (in_service_bfqq && in_service_bfqq != bfqq &&
+ likely(in_service_bfqq != &bfqd->oom_bfqq) &&
+- bfq_rq_close_to_sector(io_struct, request, bfqd->last_position) &&
++ bfq_rq_close_to_sector(io_struct, request,
++ bfqd->in_serv_last_pos) &&
+ bfqq->entity.parent == in_service_bfqq->entity.parent &&
+ bfq_may_be_close_cooperator(bfqq, in_service_bfqq)) {
+ new_bfqq = bfq_setup_merge(bfqq, in_service_bfqq);
+@@ -2755,6 +2756,8 @@ update_rate_and_reset:
+ bfq_update_rate_reset(bfqd, rq);
+ update_last_values:
+ bfqd->last_position = blk_rq_pos(rq) + blk_rq_sectors(rq);
++ if (RQ_BFQQ(rq) == bfqd->in_service_queue)
++ bfqd->in_serv_last_pos = bfqd->last_position;
+ bfqd->last_dispatch = now_ns;
+ }
+
+diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
+index a8a2e5aca4d4..d5e9e60cb1a5 100644
+--- a/block/bfq-iosched.h
++++ b/block/bfq-iosched.h
+@@ -469,6 +469,9 @@ struct bfq_data {
+ /* on-disk position of the last served request */
+ sector_t last_position;
+
++ /* position of the last served request for the in-service queue */
++ sector_t in_serv_last_pos;
++
+ /* time of last request completion (ns) */
+ u64 last_completion;
+
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index f0b52266b3ac..d73afb562ad9 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -2124,21 +2124,29 @@ static int __init intel_opregion_present(void)
+ return opregion;
+ }
+
++/* Check if the chassis-type indicates there is no builtin LCD panel */
+ static bool dmi_is_desktop(void)
+ {
+ const char *chassis_type;
++ unsigned long type;
+
+ chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
+ if (!chassis_type)
+ return false;
+
+- if (!strcmp(chassis_type, "3") || /* 3: Desktop */
+- !strcmp(chassis_type, "4") || /* 4: Low Profile Desktop */
+- !strcmp(chassis_type, "5") || /* 5: Pizza Box */
+- !strcmp(chassis_type, "6") || /* 6: Mini Tower */
+- !strcmp(chassis_type, "7") || /* 7: Tower */
+- !strcmp(chassis_type, "11")) /* 11: Main Server Chassis */
++ if (kstrtoul(chassis_type, 10, &type) != 0)
++ return false;
++
++ switch (type) {
++ case 0x03: /* Desktop */
++ case 0x04: /* Low Profile Desktop */
++ case 0x05: /* Pizza Box */
++ case 0x06: /* Mini Tower */
++ case 0x07: /* Tower */
++ case 0x10: /* Lunch Box */
++ case 0x11: /* Main Server Chassis */
+ return true;
++ }
+
+ return false;
+ }
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 0c5aeab4d23a..a63da9e07341 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1090,16 +1090,12 @@ static int __loop_clr_fd(struct loop_device *lo, bool release)
+ kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE);
+ }
+ mapping_set_gfp_mask(filp->f_mapping, gfp);
+- lo->lo_state = Lo_unbound;
+ /* This is safe: open() is still holding a reference. */
+ module_put(THIS_MODULE);
+ blk_mq_unfreeze_queue(lo->lo_queue);
+
+ partscan = lo->lo_flags & LO_FLAGS_PARTSCAN && bdev;
+ lo_number = lo->lo_number;
+- lo->lo_flags = 0;
+- if (!part_shift)
+- lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN;
+ loop_unprepare_queue(lo);
+ out_unlock:
+ mutex_unlock(&loop_ctl_mutex);
+@@ -1121,6 +1117,23 @@ out_unlock:
+ /* Device is gone, no point in returning error */
+ err = 0;
+ }
++
++ /*
++ * lo->lo_state is set to Lo_unbound here after above partscan has
++ * finished.
++ *
++ * There cannot be anybody else entering __loop_clr_fd() as
++ * lo->lo_backing_file is already cleared and Lo_rundown state
++ * protects us from all the other places trying to change the 'lo'
++ * device.
++ */
++ mutex_lock(&loop_ctl_mutex);
++ lo->lo_flags = 0;
++ if (!part_shift)
++ lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN;
++ lo->lo_state = Lo_unbound;
++ mutex_unlock(&loop_ctl_mutex);
++
+ /*
+ * Need not hold loop_ctl_mutex to fput backing file.
+ * Calling fput holding loop_ctl_mutex triggers a circular
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index 10802d1fc554..27a82a559ab9 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -265,6 +265,7 @@
+ /* #define ERRLOGMASK (CD_WARNING|CD_OPEN|CD_COUNT_TRACKS|CD_CLOSE) */
+ /* #define ERRLOGMASK (CD_WARNING|CD_REG_UNREG|CD_DO_IOCTL|CD_OPEN|CD_CLOSE|CD_COUNT_TRACKS) */
+
++#include <linux/atomic.h>
+ #include <linux/module.h>
+ #include <linux/fs.h>
+ #include <linux/major.h>
+@@ -3693,9 +3694,9 @@ static struct ctl_table_header *cdrom_sysctl_header;
+
+ static void cdrom_sysctl_register(void)
+ {
+- static int initialized;
++ static atomic_t initialized = ATOMIC_INIT(0);
+
+- if (initialized == 1)
++ if (!atomic_add_unless(&initialized, 1, 1))
+ return;
+
+ cdrom_sysctl_header = register_sysctl_table(cdrom_root_table);
+@@ -3706,8 +3707,6 @@ static void cdrom_sysctl_register(void)
+ cdrom_sysctl_settings.debug = debug;
+ cdrom_sysctl_settings.lock = lockdoor;
+ cdrom_sysctl_settings.check = check_media_type;
+-
+- initialized = 1;
+ }
+
+ static void cdrom_sysctl_unregister(void)
+diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
+index 4a22b4b41aef..9bffcd37cc7b 100644
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -377,7 +377,7 @@ static __init int hpet_mmap_enable(char *str)
+ pr_info("HPET mmap %s\n", hpet_mmap_enabled ? "enabled" : "disabled");
+ return 1;
+ }
+-__setup("hpet_mmap", hpet_mmap_enable);
++__setup("hpet_mmap=", hpet_mmap_enable);
+
+ static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
+ {
+diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
+index b89df66ea1ae..7abd604e938c 100644
+--- a/drivers/char/hw_random/virtio-rng.c
++++ b/drivers/char/hw_random/virtio-rng.c
+@@ -73,7 +73,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait)
+
+ if (!vi->busy) {
+ vi->busy = true;
+- init_completion(&vi->have_data);
++ reinit_completion(&vi->have_data);
+ register_buffer(vi, buf, size);
+ }
+
+diff --git a/drivers/clk/clk-fractional-divider.c b/drivers/clk/clk-fractional-divider.c
+index fdf625fb10fa..083daa293280 100644
+--- a/drivers/clk/clk-fractional-divider.c
++++ b/drivers/clk/clk-fractional-divider.c
+@@ -77,7 +77,7 @@ static long clk_fd_round_rate(struct clk_hw *hw, unsigned long rate,
+ unsigned long m, n;
+ u64 ret;
+
+- if (!rate || rate >= *parent_rate)
++ if (!rate || (!clk_hw_can_set_rate_parent(hw) && rate >= *parent_rate))
+ return *parent_rate;
+
+ if (fd->approximation)
+diff --git a/drivers/clk/meson/meson-aoclk.c b/drivers/clk/meson/meson-aoclk.c
+index f965845917e3..258c8d259ea1 100644
+--- a/drivers/clk/meson/meson-aoclk.c
++++ b/drivers/clk/meson/meson-aoclk.c
+@@ -65,15 +65,20 @@ int meson_aoclkc_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- /*
+- * Populate regmap and register all clks
+- */
+- for (clkid = 0; clkid < data->num_clks; clkid++) {
++ /* Populate regmap */
++ for (clkid = 0; clkid < data->num_clks; clkid++)
+ data->clks[clkid]->map = regmap;
+
++ /* Register all clks */
++ for (clkid = 0; clkid < data->hw_data->num; clkid++) {
++ if (!data->hw_data->hws[clkid])
++ continue;
++
+ ret = devm_clk_hw_register(dev, data->hw_data->hws[clkid]);
+- if (ret)
++ if (ret) {
++ dev_err(dev, "Clock registration failed\n");
+ return ret;
++ }
+ }
+
+ return devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get,
+diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c
+index 2c5426607790..e431661fe874 100644
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -78,17 +78,17 @@ static struct rockchip_pll_rate_table rk3328_pll_rates[] = {
+
+ static struct rockchip_pll_rate_table rk3328_pll_frac_rates[] = {
+ /* _mhz, _refdiv, _fbdiv, _postdiv1, _postdiv2, _dsmpd, _frac */
+- RK3036_PLL_RATE(1016064000, 3, 127, 1, 1, 0, 134217),
++ RK3036_PLL_RATE(1016064000, 3, 127, 1, 1, 0, 134218),
+ /* vco = 1016064000 */
+- RK3036_PLL_RATE(983040000, 24, 983, 1, 1, 0, 671088),
++ RK3036_PLL_RATE(983040000, 24, 983, 1, 1, 0, 671089),
+ /* vco = 983040000 */
+- RK3036_PLL_RATE(491520000, 24, 983, 2, 1, 0, 671088),
++ RK3036_PLL_RATE(491520000, 24, 983, 2, 1, 0, 671089),
+ /* vco = 983040000 */
+- RK3036_PLL_RATE(61440000, 6, 215, 7, 2, 0, 671088),
++ RK3036_PLL_RATE(61440000, 6, 215, 7, 2, 0, 671089),
+ /* vco = 860156000 */
+- RK3036_PLL_RATE(56448000, 12, 451, 4, 4, 0, 9797894),
++ RK3036_PLL_RATE(56448000, 12, 451, 4, 4, 0, 9797895),
+ /* vco = 903168000 */
+- RK3036_PLL_RATE(40960000, 12, 409, 4, 5, 0, 10066329),
++ RK3036_PLL_RATE(40960000, 12, 409, 4, 5, 0, 10066330),
+ /* vco = 819200000 */
+ { /* sentinel */ },
+ };
+diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
+index b61f4ec43e06..aca30f45172e 100644
+--- a/drivers/cpufreq/acpi-cpufreq.c
++++ b/drivers/cpufreq/acpi-cpufreq.c
+@@ -911,8 +911,10 @@ static void __init acpi_cpufreq_boost_init(void)
+ {
+ int ret;
+
+- if (!(boot_cpu_has(X86_FEATURE_CPB) || boot_cpu_has(X86_FEATURE_IDA)))
++ if (!(boot_cpu_has(X86_FEATURE_CPB) || boot_cpu_has(X86_FEATURE_IDA))) {
++ pr_debug("Boost capabilities not present in the processor\n");
+ return;
++ }
+
+ acpi_cpufreq_driver.set_boost = set_boost;
+ acpi_cpufreq_driver.boost_enabled = boost_state(0);
+diff --git a/drivers/crypto/amcc/crypto4xx_trng.c b/drivers/crypto/amcc/crypto4xx_trng.c
+index 5e63742b0d22..53ab1f140a26 100644
+--- a/drivers/crypto/amcc/crypto4xx_trng.c
++++ b/drivers/crypto/amcc/crypto4xx_trng.c
+@@ -80,8 +80,10 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev)
+
+ /* Find the TRNG device node and map it */
+ trng = of_find_matching_node(NULL, ppc4xx_trng_match);
+- if (!trng || !of_device_is_available(trng))
++ if (!trng || !of_device_is_available(trng)) {
++ of_node_put(trng);
+ return;
++ }
+
+ dev->trng_base = of_iomap(trng, 0);
+ of_node_put(trng);
+diff --git a/drivers/crypto/cavium/zip/zip_main.c b/drivers/crypto/cavium/zip/zip_main.c
+index be055b9547f6..6183f9128a8a 100644
+--- a/drivers/crypto/cavium/zip/zip_main.c
++++ b/drivers/crypto/cavium/zip/zip_main.c
+@@ -351,6 +351,7 @@ static struct pci_driver zip_driver = {
+
+ static struct crypto_alg zip_comp_deflate = {
+ .cra_name = "deflate",
++ .cra_driver_name = "deflate-cavium",
+ .cra_flags = CRYPTO_ALG_TYPE_COMPRESS,
+ .cra_ctxsize = sizeof(struct zip_kernel_ctx),
+ .cra_priority = 300,
+@@ -365,6 +366,7 @@ static struct crypto_alg zip_comp_deflate = {
+
+ static struct crypto_alg zip_comp_lzs = {
+ .cra_name = "lzs",
++ .cra_driver_name = "lzs-cavium",
+ .cra_flags = CRYPTO_ALG_TYPE_COMPRESS,
+ .cra_ctxsize = sizeof(struct zip_kernel_ctx),
+ .cra_priority = 300,
+@@ -384,7 +386,7 @@ static struct scomp_alg zip_scomp_deflate = {
+ .decompress = zip_scomp_decompress,
+ .base = {
+ .cra_name = "deflate",
+- .cra_driver_name = "deflate-scomp",
++ .cra_driver_name = "deflate-scomp-cavium",
+ .cra_module = THIS_MODULE,
+ .cra_priority = 300,
+ }
+@@ -397,7 +399,7 @@ static struct scomp_alg zip_scomp_lzs = {
+ .decompress = zip_scomp_decompress,
+ .base = {
+ .cra_name = "lzs",
+- .cra_driver_name = "lzs-scomp",
++ .cra_driver_name = "lzs-scomp-cavium",
+ .cra_module = THIS_MODULE,
+ .cra_priority = 300,
+ }
+diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
+index 118d371a2a4a..dfee0d895ce3 100644
+--- a/drivers/dma/imx-dma.c
++++ b/drivers/dma/imx-dma.c
+@@ -284,7 +284,7 @@ static inline int imxdma_sg_next(struct imxdma_desc *d)
+ struct scatterlist *sg = d->sg;
+ unsigned long now;
+
+- now = min(d->len, sg_dma_len(sg));
++ now = min_t(size_t, d->len, sg_dma_len(sg));
+ if (d->len != IMX_DMA_LENGTH_LOOP)
+ d->len -= now;
+
+diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c
+index 43d4b00b8138..411f91fde734 100644
+--- a/drivers/dma/qcom/hidma.c
++++ b/drivers/dma/qcom/hidma.c
+@@ -138,24 +138,25 @@ static void hidma_process_completed(struct hidma_chan *mchan)
+ desc = &mdesc->desc;
+ last_cookie = desc->cookie;
+
++ llstat = hidma_ll_status(mdma->lldev, mdesc->tre_ch);
++
+ spin_lock_irqsave(&mchan->lock, irqflags);
++ if (llstat == DMA_COMPLETE) {
++ mchan->last_success = last_cookie;
++ result.result = DMA_TRANS_NOERROR;
++ } else {
++ result.result = DMA_TRANS_ABORTED;
++ }
++
+ dma_cookie_complete(desc);
+ spin_unlock_irqrestore(&mchan->lock, irqflags);
+
+- llstat = hidma_ll_status(mdma->lldev, mdesc->tre_ch);
+ dmaengine_desc_get_callback(desc, &cb);
+
+ dma_run_dependencies(desc);
+
+ spin_lock_irqsave(&mchan->lock, irqflags);
+ list_move(&mdesc->node, &mchan->free);
+-
+- if (llstat == DMA_COMPLETE) {
+- mchan->last_success = last_cookie;
+- result.result = DMA_TRANS_NOERROR;
+- } else
+- result.result = DMA_TRANS_ABORTED;
+-
+ spin_unlock_irqrestore(&mchan->lock, irqflags);
+
+ dmaengine_desc_callback_invoke(&cb, &result);
+@@ -415,6 +416,7 @@ hidma_prep_dma_memcpy(struct dma_chan *dmach, dma_addr_t dest, dma_addr_t src,
+ if (!mdesc)
+ return NULL;
+
++ mdesc->desc.flags = flags;
+ hidma_ll_set_transfer_params(mdma->lldev, mdesc->tre_ch,
+ src, dest, len, flags,
+ HIDMA_TRE_MEMCPY);
+@@ -447,6 +449,7 @@ hidma_prep_dma_memset(struct dma_chan *dmach, dma_addr_t dest, int value,
+ if (!mdesc)
+ return NULL;
+
++ mdesc->desc.flags = flags;
+ hidma_ll_set_transfer_params(mdma->lldev, mdesc->tre_ch,
+ value, dest, len, flags,
+ HIDMA_TRE_MEMSET);
+diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
+index 9a558e30c461..8219ab88a507 100644
+--- a/drivers/dma/tegra20-apb-dma.c
++++ b/drivers/dma/tegra20-apb-dma.c
+@@ -636,7 +636,10 @@ static void handle_cont_sngl_cycle_dma_done(struct tegra_dma_channel *tdc,
+
+ sgreq = list_first_entry(&tdc->pending_sg_req, typeof(*sgreq), node);
+ dma_desc = sgreq->dma_desc;
+- dma_desc->bytes_transferred += sgreq->req_len;
++ /* if we dma for long enough the transfer count will wrap */
++ dma_desc->bytes_transferred =
++ (dma_desc->bytes_transferred + sgreq->req_len) %
++ dma_desc->bytes_requested;
+
+ /* Callback need to be call */
+ if (!dma_desc->cb_count)
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index a7902fccdcfa..6090d25dce85 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -546,19 +546,24 @@ EXPORT_SYMBOL_GPL(cper_estatus_check_header);
+ int cper_estatus_check(const struct acpi_hest_generic_status *estatus)
+ {
+ struct acpi_hest_generic_data *gdata;
+- unsigned int data_len, gedata_len;
++ unsigned int data_len, record_size;
+ int rc;
+
+ rc = cper_estatus_check_header(estatus);
+ if (rc)
+ return rc;
++
+ data_len = estatus->data_length;
+
+ apei_estatus_for_each_section(estatus, gdata) {
+- gedata_len = acpi_hest_get_error_length(gdata);
+- if (gedata_len > data_len - acpi_hest_get_size(gdata))
++ if (sizeof(struct acpi_hest_generic_data) > data_len)
++ return -EINVAL;
++
++ record_size = acpi_hest_get_record_size(gdata);
++ if (record_size > data_len)
+ return -EINVAL;
+- data_len -= acpi_hest_get_record_size(gdata);
++
++ data_len -= record_size;
+ }
+ if (data_len)
+ return -EINVAL;
+diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
+index 6920033de6d4..6c09644d620e 100644
+--- a/drivers/firmware/efi/libstub/arm-stub.c
++++ b/drivers/firmware/efi/libstub/arm-stub.c
+@@ -340,6 +340,11 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, unsigned long map_size,
+ paddr = in->phys_addr;
+ size = in->num_pages * EFI_PAGE_SIZE;
+
++ if (novamap()) {
++ in->virt_addr = in->phys_addr;
++ continue;
++ }
++
+ /*
+ * Make the mapping compatible with 64k pages: this allows
+ * a 4k page size kernel to kexec a 64k page size kernel and
+diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
+index e94975f4655b..442f51c2a53d 100644
+--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
++++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
+@@ -34,6 +34,7 @@ static unsigned long __chunk_size = EFI_READ_CHUNK_SIZE;
+
+ static int __section(.data) __nokaslr;
+ static int __section(.data) __quiet;
++static int __section(.data) __novamap;
+
+ int __pure nokaslr(void)
+ {
+@@ -43,6 +44,10 @@ int __pure is_quiet(void)
+ {
+ return __quiet;
+ }
++int __pure novamap(void)
++{
++ return __novamap;
++}
+
+ #define EFI_MMAP_NR_SLACK_SLOTS 8
+
+@@ -482,6 +487,11 @@ efi_status_t efi_parse_options(char const *cmdline)
+ __chunk_size = -1UL;
+ }
+
++ if (!strncmp(str, "novamap", 7)) {
++ str += strlen("novamap");
++ __novamap = 1;
++ }
++
+ /* Group words together, delimited by "," */
+ while (*str && *str != ' ' && *str != ',')
+ str++;
+diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
+index 32799cf039ef..337b52c4702c 100644
+--- a/drivers/firmware/efi/libstub/efistub.h
++++ b/drivers/firmware/efi/libstub/efistub.h
+@@ -27,6 +27,7 @@
+
+ extern int __pure nokaslr(void);
+ extern int __pure is_quiet(void);
++extern int __pure novamap(void);
+
+ #define pr_efi(sys_table, msg) do { \
+ if (!is_quiet()) efi_printk(sys_table, "EFI stub: "msg); \
+diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
+index 0c0d2312f4a8..dba296a44f4e 100644
+--- a/drivers/firmware/efi/libstub/fdt.c
++++ b/drivers/firmware/efi/libstub/fdt.c
+@@ -327,6 +327,9 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
+ if (status == EFI_SUCCESS) {
+ efi_set_virtual_address_map_t *svam;
+
++ if (novamap())
++ return EFI_SUCCESS;
++
+ /* Install the new virtual address map */
+ svam = sys_table->runtime->set_virtual_address_map;
+ status = svam(runtime_entry_count * desc_size, desc_size,
+diff --git a/drivers/firmware/efi/memattr.c b/drivers/firmware/efi/memattr.c
+index 8986757eafaf..aac972b056d9 100644
+--- a/drivers/firmware/efi/memattr.c
++++ b/drivers/firmware/efi/memattr.c
+@@ -94,7 +94,7 @@ static bool entry_is_valid(const efi_memory_desc_t *in, efi_memory_desc_t *out)
+
+ if (!(md->attribute & EFI_MEMORY_RUNTIME))
+ continue;
+- if (md->virt_addr == 0) {
++ if (md->virt_addr == 0 && md->phys_addr != 0) {
+ /* no virtual mapping has been installed by the stub */
+ break;
+ }
+diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
+index e81008678a38..6c1acf642c8e 100644
+--- a/drivers/gpio/gpio-omap.c
++++ b/drivers/gpio/gpio-omap.c
+@@ -888,14 +888,16 @@ static void omap_gpio_unmask_irq(struct irq_data *d)
+ if (trigger)
+ omap_set_gpio_triggering(bank, offset, trigger);
+
+- /* For level-triggered GPIOs, the clearing must be done after
+- * the HW source is cleared, thus after the handler has run */
+- if (bank->level_mask & BIT(offset)) {
+- omap_set_gpio_irqenable(bank, offset, 0);
++ omap_set_gpio_irqenable(bank, offset, 1);
++
++ /*
++ * For level-triggered GPIOs, clearing must be done after the source
++ * is cleared, thus after the handler has run. OMAP4 needs this done
++ * after enabing the interrupt to clear the wakeup status.
++ */
++ if (bank->level_mask & BIT(offset))
+ omap_clear_gpio_irqstatus(bank, offset);
+- }
+
+- omap_set_gpio_irqenable(bank, offset, 1);
+ raw_spin_unlock_irqrestore(&bank->lock, flags);
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index c5ba9128b736..2b8b892eb846 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4368,7 +4368,8 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state,
+ static void amdgpu_dm_crtc_copy_transient_flags(struct drm_crtc_state *crtc_state,
+ struct dc_stream_state *stream_state)
+ {
+- stream_state->mode_changed = crtc_state->mode_changed;
++ stream_state->mode_changed =
++ crtc_state->mode_changed || crtc_state->active_changed;
+ }
+
+ static int amdgpu_dm_atomic_commit(struct drm_device *dev,
+@@ -4389,10 +4390,22 @@ static int amdgpu_dm_atomic_commit(struct drm_device *dev,
+ */
+ for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
+ struct dm_crtc_state *dm_old_crtc_state = to_dm_crtc_state(old_crtc_state);
++ struct dm_crtc_state *dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
+ struct amdgpu_crtc *acrtc = to_amdgpu_crtc(crtc);
+
+- if (drm_atomic_crtc_needs_modeset(new_crtc_state) && dm_old_crtc_state->stream)
++ if (drm_atomic_crtc_needs_modeset(new_crtc_state)
++ && dm_old_crtc_state->stream) {
++ /*
++ * CRC capture was enabled but not disabled.
++ * Release the vblank reference.
++ */
++ if (dm_new_crtc_state->crc_enabled) {
++ drm_crtc_vblank_put(crtc);
++ dm_new_crtc_state->crc_enabled = false;
++ }
++
+ manage_dm_interrupts(adev, acrtc, false);
++ }
+ }
+ /* Add check here for SoC's that support hardware cursor plane, to
+ * unset legacy_cursor_update */
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
+index 6a6d977ddd7a..36a0bed9af07 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
+@@ -51,6 +51,7 @@ int amdgpu_dm_crtc_set_crc_source(struct drm_crtc *crtc, const char *src_name,
+ {
+ struct dm_crtc_state *crtc_state = to_dm_crtc_state(crtc->state);
+ struct dc_stream_state *stream_state = crtc_state->stream;
++ bool enable;
+
+ enum amdgpu_dm_pipe_crc_source source = dm_parse_crc_source(src_name);
+
+@@ -65,28 +66,27 @@ int amdgpu_dm_crtc_set_crc_source(struct drm_crtc *crtc, const char *src_name,
+ return -EINVAL;
+ }
+
++ enable = (source == AMDGPU_DM_PIPE_CRC_SOURCE_AUTO);
++
++ if (!dc_stream_configure_crc(stream_state->ctx->dc, stream_state,
++ enable, enable))
++ return -EINVAL;
++
+ /* When enabling CRC, we should also disable dithering. */
+- if (source == AMDGPU_DM_PIPE_CRC_SOURCE_AUTO) {
+- if (dc_stream_configure_crc(stream_state->ctx->dc,
+- stream_state,
+- true, true)) {
+- crtc_state->crc_enabled = true;
+- dc_stream_set_dither_option(stream_state,
+- DITHER_OPTION_TRUN8);
+- }
+- else
+- return -EINVAL;
+- } else {
+- if (dc_stream_configure_crc(stream_state->ctx->dc,
+- stream_state,
+- false, false)) {
+- crtc_state->crc_enabled = false;
+- dc_stream_set_dither_option(stream_state,
+- DITHER_OPTION_DEFAULT);
+- }
+- else
+- return -EINVAL;
+- }
++ dc_stream_set_dither_option(stream_state,
++ enable ? DITHER_OPTION_TRUN8
++ : DITHER_OPTION_DEFAULT);
++
++ /*
++ * Reading the CRC requires the vblank interrupt handler to be
++ * enabled. Keep a reference until CRC capture stops.
++ */
++ if (!crtc_state->crc_enabled && enable)
++ drm_crtc_vblank_get(crtc);
++ else if (crtc_state->crc_enabled && !enable)
++ drm_crtc_vblank_put(crtc);
++
++ crtc_state->crc_enabled = enable;
+
+ *values_cnt = 3;
+ /* Reset crc_skipped on dm state */
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 9045e6fa0780..bb0cda727605 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -958,6 +958,9 @@ static enum dc_status dc_commit_state_no_check(struct dc *dc, struct dc_state *c
+ /* pplib is notified if disp_num changed */
+ dc->hwss.set_bandwidth(dc, context, true);
+
++ for (i = 0; i < context->stream_count; i++)
++ context->streams[i]->mode_changed = false;
++
+ dc_release_state(dc->current_state);
+
+ dc->current_state = context;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+index 4058b59d9bea..a0355709abd1 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+@@ -2336,9 +2336,10 @@ static void dcn10_apply_ctx_for_surface(
+ }
+ }
+
+- if (!pipe_ctx->plane_state &&
+- old_pipe_ctx->plane_state &&
+- old_pipe_ctx->stream_res.tg == tg) {
++ if ((!pipe_ctx->plane_state ||
++ pipe_ctx->stream_res.tg != old_pipe_ctx->stream_res.tg) &&
++ old_pipe_ctx->plane_state &&
++ old_pipe_ctx->stream_res.tg == tg) {
+
+ dc->hwss.plane_atomic_disconnect(dc, old_pipe_ctx);
+ removed_pipe[i] = true;
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index d708472d93c4..65f58e23e03d 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -3278,6 +3278,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs
+ msg.u.i2c_read.transactions[i].i2c_dev_id = msgs[i].addr;
+ msg.u.i2c_read.transactions[i].num_bytes = msgs[i].len;
+ msg.u.i2c_read.transactions[i].bytes = msgs[i].buf;
++ msg.u.i2c_read.transactions[i].no_stop_bit = !(msgs[i].flags & I2C_M_STOP);
+ }
+ msg.u.i2c_read.read_i2c_device_id = msgs[num - 1].addr;
+ msg.u.i2c_read.num_bytes_read = msgs[num - 1].len;
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index e65596617239..a0663f44e218 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -2877,7 +2877,7 @@ int drm_fb_helper_fbdev_setup(struct drm_device *dev,
+ return 0;
+
+ err_drm_fb_helper_fini:
+- drm_fb_helper_fini(fb_helper);
++ drm_fb_helper_fbdev_teardown(dev);
+
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
+index 6153cbda239f..d36b1be632d9 100644
+--- a/drivers/gpu/drm/drm_plane.c
++++ b/drivers/gpu/drm/drm_plane.c
+@@ -211,6 +211,9 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
+ format_modifier_count++;
+ }
+
++ if (format_modifier_count)
++ config->allow_fb_modifiers = true;
++
+ plane->modifier_count = format_modifier_count;
+ plane->modifiers = kmalloc_array(format_modifier_count,
+ sizeof(format_modifiers[0]),
+diff --git a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c
+index 6a4ca139cf5d..8fd8124d72ba 100644
+--- a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c
++++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c
+@@ -750,7 +750,9 @@ static int nv17_tv_set_property(struct drm_encoder *encoder,
+ /* Disable the crtc to ensure a full modeset is
+ * performed whenever it's turned on again. */
+ if (crtc)
+- drm_crtc_force_disable(crtc);
++ drm_crtc_helper_set_mode(crtc, &crtc->mode,
++ crtc->x, crtc->y,
++ crtc->primary->fb);
+ }
+
+ return 0;
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+index fb46df56f0c4..0386b454e221 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+@@ -300,6 +300,7 @@ static int rcar_du_encoders_init_one(struct rcar_du_device *rcdu,
+ dev_dbg(rcdu->dev,
+ "connected entity %pOF is disabled, skipping\n",
+ entity);
++ of_node_put(entity);
+ return -ENODEV;
+ }
+
+@@ -335,6 +336,7 @@ static int rcar_du_encoders_init_one(struct rcar_du_device *rcdu,
+ dev_warn(rcdu->dev,
+ "no encoder found for endpoint %pOF, skipping\n",
+ ep->local_node);
++ of_node_put(entity);
+ return -ENODEV;
+ }
+
+diff --git a/drivers/gpu/drm/vkms/vkms_crtc.c b/drivers/gpu/drm/vkms/vkms_crtc.c
+index 1ea2dd35bca9..0a271f762a0a 100644
+--- a/drivers/gpu/drm/vkms/vkms_crtc.c
++++ b/drivers/gpu/drm/vkms/vkms_crtc.c
+@@ -55,6 +55,9 @@ bool vkms_get_vblank_timestamp(struct drm_device *dev, unsigned int pipe,
+
+ *vblank_time = output->vblank_hrtimer.node.expires;
+
++ if (!in_vblank_irq)
++ *vblank_time -= output->period_ns;
++
+ return true;
+ }
+
+diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c
+index bfbca7ec54ce..e00b9dbe220f 100644
+--- a/drivers/hid/intel-ish-hid/ipc/ipc.c
++++ b/drivers/hid/intel-ish-hid/ipc/ipc.c
+@@ -91,7 +91,10 @@ static bool check_generated_interrupt(struct ishtp_device *dev)
+ IPC_INT_FROM_ISH_TO_HOST_CHV_AB(pisr_val);
+ } else {
+ pisr_val = ish_reg_read(dev, IPC_REG_PISR_BXT);
+- interrupt_generated = IPC_INT_FROM_ISH_TO_HOST_BXT(pisr_val);
++ interrupt_generated = !!pisr_val;
++ /* only busy-clear bit is RW, others are RO */
++ if (pisr_val)
++ ish_reg_write(dev, IPC_REG_PISR_BXT, pisr_val);
+ }
+
+ return interrupt_generated;
+@@ -843,11 +846,11 @@ int ish_hw_start(struct ishtp_device *dev)
+ {
+ ish_set_host_rdy(dev);
+
++ set_host_ready(dev);
++
+ /* After that we can enable ISH DMA operation and wakeup ISHFW */
+ ish_wakeup(dev);
+
+- set_host_ready(dev);
+-
+ /* wait for FW-initiated reset flow */
+ if (!dev->recvd_hw_ready)
+ wait_event_interruptible_timeout(dev->wait_hw_ready,
+diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c b/drivers/hid/intel-ish-hid/ishtp/bus.c
+index 2623a567ffba..f546635e9ac9 100644
+--- a/drivers/hid/intel-ish-hid/ishtp/bus.c
++++ b/drivers/hid/intel-ish-hid/ishtp/bus.c
+@@ -623,7 +623,8 @@ int ishtp_cl_device_bind(struct ishtp_cl *cl)
+ spin_lock_irqsave(&cl->dev->device_list_lock, flags);
+ list_for_each_entry(cl_device, &cl->dev->device_list,
+ device_link) {
+- if (cl_device->fw_client->client_id == cl->fw_client_id) {
++ if (cl_device->fw_client &&
++ cl_device->fw_client->client_id == cl->fw_client_id) {
+ cl->device = cl_device;
+ rv = 0;
+ break;
+@@ -683,6 +684,7 @@ void ishtp_bus_remove_all_clients(struct ishtp_device *ishtp_dev,
+ spin_lock_irqsave(&ishtp_dev->device_list_lock, flags);
+ list_for_each_entry_safe(cl_device, n, &ishtp_dev->device_list,
+ device_link) {
++ cl_device->fw_client = NULL;
+ if (warm_reset && cl_device->reference_count)
+ continue;
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
+index 677695635211..0f5e03e4df22 100644
+--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
+@@ -181,15 +181,15 @@ static void etm_free_aux(void *data)
+ schedule_work(&event_data->work);
+ }
+
+-static void *etm_setup_aux(int event_cpu, void **pages,
++static void *etm_setup_aux(struct perf_event *event, void **pages,
+ int nr_pages, bool overwrite)
+ {
+- int cpu;
++ int cpu = event->cpu;
+ cpumask_t *mask;
+ struct coresight_device *sink;
+ struct etm_event_data *event_data = NULL;
+
+- event_data = alloc_event_data(event_cpu);
++ event_data = alloc_event_data(cpu);
+ if (!event_data)
+ return NULL;
+ INIT_WORK(&event_data->work, free_event_data);
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
+index 1d94ebec027b..2bce7cf0b0af 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x.c
+@@ -54,7 +54,8 @@ static void etm4_os_unlock(struct etmv4_drvdata *drvdata)
+
+ static bool etm4_arch_supported(u8 arch)
+ {
+- switch (arch) {
++ /* Mask out the minor version number */
++ switch (arch & 0xf0) {
+ case ETM_ARCH_V4:
+ break;
+ default:
+diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c
+index 6cb7ad608bcd..0f01cdba9d2c 100644
+--- a/drivers/i2c/i2c-core-of.c
++++ b/drivers/i2c/i2c-core-of.c
+@@ -121,6 +121,17 @@ static int of_dev_node_match(struct device *dev, void *data)
+ return dev->of_node == data;
+ }
+
++static int of_dev_or_parent_node_match(struct device *dev, void *data)
++{
++ if (dev->of_node == data)
++ return 1;
++
++ if (dev->parent)
++ return dev->parent->of_node == data;
++
++ return 0;
++}
++
+ /* must call put_device() when done with returned i2c_client device */
+ struct i2c_client *of_find_i2c_device_by_node(struct device_node *node)
+ {
+@@ -145,7 +156,8 @@ struct i2c_adapter *of_find_i2c_adapter_by_node(struct device_node *node)
+ struct device *dev;
+ struct i2c_adapter *adapter;
+
+- dev = bus_find_device(&i2c_bus_type, NULL, node, of_dev_node_match);
++ dev = bus_find_device(&i2c_bus_type, NULL, node,
++ of_dev_or_parent_node_match);
+ if (!dev)
+ return NULL;
+
+diff --git a/drivers/iio/adc/qcom-pm8xxx-xoadc.c b/drivers/iio/adc/qcom-pm8xxx-xoadc.c
+index b093ecddf1a8..54db848f0bcd 100644
+--- a/drivers/iio/adc/qcom-pm8xxx-xoadc.c
++++ b/drivers/iio/adc/qcom-pm8xxx-xoadc.c
+@@ -423,18 +423,14 @@ static irqreturn_t pm8xxx_eoc_irq(int irq, void *d)
+ static struct pm8xxx_chan_info *
+ pm8xxx_get_channel(struct pm8xxx_xoadc *adc, u8 chan)
+ {
+- struct pm8xxx_chan_info *ch;
+ int i;
+
+ for (i = 0; i < adc->nchans; i++) {
+- ch = &adc->chans[i];
++ struct pm8xxx_chan_info *ch = &adc->chans[i];
+ if (ch->hwchan->amux_channel == chan)
+- break;
++ return ch;
+ }
+- if (i == adc->nchans)
+- return NULL;
+-
+- return ch;
++ return NULL;
+ }
+
+ static int pm8xxx_read_channel_rsv(struct pm8xxx_xoadc *adc,
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 0f83cbec33f3..a68569ec86bf 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -1904,8 +1904,10 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+ }
+ mutex_unlock(&ep->com.mutex);
+
+- if (release)
++ if (release) {
++ close_complete_upcall(ep, -ECONNRESET);
+ release_ep_resources(ep);
++ }
+ c4iw_put_ep(&ep->com);
+ return 0;
+ }
+@@ -3608,7 +3610,6 @@ int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp)
+ if (close) {
+ if (abrupt) {
+ set_bit(EP_DISC_ABORT, &ep->com.history);
+- close_complete_upcall(ep, -ECONNRESET);
+ ret = send_abort(ep);
+ } else {
+ set_bit(EP_DISC_CLOSE, &ep->com.history);
+diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c
+index fedaf8260105..8c79a480f2b7 100644
+--- a/drivers/infiniband/hw/mlx4/cm.c
++++ b/drivers/infiniband/hw/mlx4/cm.c
+@@ -39,7 +39,7 @@
+
+ #include "mlx4_ib.h"
+
+-#define CM_CLEANUP_CACHE_TIMEOUT (5 * HZ)
++#define CM_CLEANUP_CACHE_TIMEOUT (30 * HZ)
+
+ struct id_map_entry {
+ struct rb_node node;
+diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
+index 23520df7650f..55cd6e0b409c 100644
+--- a/drivers/input/misc/soc_button_array.c
++++ b/drivers/input/misc/soc_button_array.c
+@@ -373,7 +373,7 @@ static struct soc_button_info soc_button_PNP0C40[] = {
+ { "home", 1, EV_KEY, KEY_LEFTMETA, false, true },
+ { "volume_up", 2, EV_KEY, KEY_VOLUMEUP, true, false },
+ { "volume_down", 3, EV_KEY, KEY_VOLUMEDOWN, true, false },
+- { "rotation_lock", 4, EV_SW, SW_ROTATE_LOCK, false, false },
++ { "rotation_lock", 4, EV_KEY, KEY_ROTATE_LOCK_TOGGLE, false, false },
+ { }
+ };
+
+diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
+index fde728ea2900..48d4709a8e93 100644
+--- a/drivers/iommu/io-pgtable-arm-v7s.c
++++ b/drivers/iommu/io-pgtable-arm-v7s.c
+@@ -228,7 +228,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
+ if (dma != phys)
+ goto out_unmap;
+ }
+- kmemleak_ignore(table);
++ if (lvl == 2)
++ kmemleak_ignore(table);
+ return table;
+
+ out_unmap:
+diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c
+index 3d79a6380761..723f2f17497a 100644
+--- a/drivers/leds/leds-lp55xx-common.c
++++ b/drivers/leds/leds-lp55xx-common.c
+@@ -201,7 +201,7 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context)
+
+ if (!fw) {
+ dev_err(dev, "firmware request failed\n");
+- goto out;
++ return;
+ }
+
+ /* handling firmware data is chip dependent */
+@@ -214,9 +214,9 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context)
+
+ mutex_unlock(&chip->lock);
+
+-out:
+ /* firmware should be released for other channel use */
+ release_firmware(chip->fw);
++ chip->fw = NULL;
+ }
+
+ static int lp55xx_request_firmware(struct lp55xx_chip *chip)
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index 26f035a0c5b9..d9481640b3e1 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -283,8 +283,12 @@ STORE(__cached_dev)
+ sysfs_strtoul_clamp(writeback_rate_update_seconds,
+ dc->writeback_rate_update_seconds,
+ 1, WRITEBACK_RATE_UPDATE_SECS_MAX);
+- d_strtoul(writeback_rate_i_term_inverse);
+- d_strtoul_nonzero(writeback_rate_p_term_inverse);
++ sysfs_strtoul_clamp(writeback_rate_i_term_inverse,
++ dc->writeback_rate_i_term_inverse,
++ 1, UINT_MAX);
++ sysfs_strtoul_clamp(writeback_rate_p_term_inverse,
++ dc->writeback_rate_p_term_inverse,
++ 1, UINT_MAX);
+ d_strtoul_nonzero(writeback_rate_minimum);
+
+ sysfs_strtoul_clamp(io_error_limit, dc->error_limit, 0, INT_MAX);
+@@ -295,7 +299,9 @@ STORE(__cached_dev)
+ dc->io_disable = v ? 1 : 0;
+ }
+
+- d_strtoi_h(sequential_cutoff);
++ sysfs_strtoul_clamp(sequential_cutoff,
++ dc->sequential_cutoff,
++ 0, UINT_MAX);
+ d_strtoi_h(readahead);
+
+ if (attr == &sysfs_clear_stats)
+@@ -766,8 +772,17 @@ STORE(__bch_cache_set)
+ c->error_limit = strtoul_or_return(buf);
+
+ /* See count_io_errors() for why 88 */
+- if (attr == &sysfs_io_error_halflife)
+- c->error_decay = strtoul_or_return(buf) / 88;
++ if (attr == &sysfs_io_error_halflife) {
++ unsigned long v = 0;
++ ssize_t ret;
++
++ ret = strtoul_safe_clamp(buf, v, 0, UINT_MAX);
++ if (!ret) {
++ c->error_decay = v / 88;
++ return size;
++ }
++ return ret;
++ }
+
+ if (attr == &sysfs_io_disable) {
+ v = strtoul_or_return(buf);
+diff --git a/drivers/md/bcache/sysfs.h b/drivers/md/bcache/sysfs.h
+index 3fe82425859c..0ad2715a884e 100644
+--- a/drivers/md/bcache/sysfs.h
++++ b/drivers/md/bcache/sysfs.h
+@@ -81,9 +81,16 @@ do { \
+
+ #define sysfs_strtoul_clamp(file, var, min, max) \
+ do { \
+- if (attr == &sysfs_ ## file) \
+- return strtoul_safe_clamp(buf, var, min, max) \
+- ?: (ssize_t) size; \
++ if (attr == &sysfs_ ## file) { \
++ unsigned long v = 0; \
++ ssize_t ret; \
++ ret = strtoul_safe_clamp(buf, v, min, max); \
++ if (!ret) { \
++ var = v; \
++ return size; \
++ } \
++ return ret; \
++ } \
+ } while (0)
+
+ #define strtoul_or_return(cp) \
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index cd4220ee7004..435a2ee4a392 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -3283,6 +3283,13 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ as.argc = argc;
+ as.argv = argv;
+
++ /* make sure metadata and data are different devices */
++ if (!strcmp(argv[0], argv[1])) {
++ ti->error = "Error setting metadata or data device";
++ r = -EINVAL;
++ goto out_unlock;
++ }
++
+ /*
+ * Set default pool features.
+ */
+@@ -4167,6 +4174,12 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ tc->sort_bio_list = RB_ROOT;
+
+ if (argc == 3) {
++ if (!strcmp(argv[0], argv[2])) {
++ ti->error = "Error setting origin device";
++ r = -EINVAL;
++ goto bad_origin_dev;
++ }
++
+ r = dm_get_device(ti, argv[2], FMODE_READ, &origin_dev);
+ if (r) {
+ ti->error = "Error opening origin device";
+diff --git a/drivers/media/i2c/mt9m111.c b/drivers/media/i2c/mt9m111.c
+index efda1aa95ca0..7a7d3969af20 100644
+--- a/drivers/media/i2c/mt9m111.c
++++ b/drivers/media/i2c/mt9m111.c
+@@ -1014,6 +1014,8 @@ static int mt9m111_probe(struct i2c_client *client,
+ mt9m111->rect.top = MT9M111_MIN_DARK_ROWS;
+ mt9m111->rect.width = MT9M111_MAX_WIDTH;
+ mt9m111->rect.height = MT9M111_MAX_HEIGHT;
++ mt9m111->width = mt9m111->rect.width;
++ mt9m111->height = mt9m111->rect.height;
+ mt9m111->fmt = &mt9m111_colour_fmts[0];
+ mt9m111->lastpage = -1;
+ mutex_init(&mt9m111->power_lock);
+diff --git a/drivers/media/i2c/ov7740.c b/drivers/media/i2c/ov7740.c
+index 605f3e25ad82..f5a1ee90a6c5 100644
+--- a/drivers/media/i2c/ov7740.c
++++ b/drivers/media/i2c/ov7740.c
+@@ -1101,6 +1101,9 @@ static int ov7740_probe(struct i2c_client *client,
+ if (ret)
+ return ret;
+
++ pm_runtime_set_active(&client->dev);
++ pm_runtime_enable(&client->dev);
++
+ ret = ov7740_detect(ov7740);
+ if (ret)
+ goto error_detect;
+@@ -1123,8 +1126,6 @@ static int ov7740_probe(struct i2c_client *client,
+ if (ret)
+ goto error_async_register;
+
+- pm_runtime_set_active(&client->dev);
+- pm_runtime_enable(&client->dev);
+ pm_runtime_idle(&client->dev);
+
+ return 0;
+@@ -1134,6 +1135,8 @@ error_async_register:
+ error_init_controls:
+ ov7740_free_controls(ov7740);
+ error_detect:
++ pm_runtime_disable(&client->dev);
++ pm_runtime_set_suspended(&client->dev);
+ ov7740_set_power(ov7740, 0);
+ media_entity_cleanup(&ov7740->subdev.entity);
+
+diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+index 4f24da8afecc..11429633b2fb 100644
+--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
++++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+@@ -702,7 +702,7 @@ end:
+ v4l2_m2m_buf_queue(ctx->fh.m2m_ctx, to_vb2_v4l2_buffer(vb));
+ }
+
+-static void *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx,
++static struct vb2_v4l2_buffer *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx,
+ enum v4l2_buf_type type)
+ {
+ if (V4L2_TYPE_IS_OUTPUT(type))
+@@ -714,7 +714,7 @@ static void *mtk_jpeg_buf_remove(struct mtk_jpeg_ctx *ctx,
+ static int mtk_jpeg_start_streaming(struct vb2_queue *q, unsigned int count)
+ {
+ struct mtk_jpeg_ctx *ctx = vb2_get_drv_priv(q);
+- struct vb2_buffer *vb;
++ struct vb2_v4l2_buffer *vb;
+ int ret = 0;
+
+ ret = pm_runtime_get_sync(ctx->jpeg->dev);
+@@ -724,14 +724,14 @@ static int mtk_jpeg_start_streaming(struct vb2_queue *q, unsigned int count)
+ return 0;
+ err:
+ while ((vb = mtk_jpeg_buf_remove(ctx, q->type)))
+- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(vb), VB2_BUF_STATE_QUEUED);
++ v4l2_m2m_buf_done(vb, VB2_BUF_STATE_QUEUED);
+ return ret;
+ }
+
+ static void mtk_jpeg_stop_streaming(struct vb2_queue *q)
+ {
+ struct mtk_jpeg_ctx *ctx = vb2_get_drv_priv(q);
+- struct vb2_buffer *vb;
++ struct vb2_v4l2_buffer *vb;
+
+ /*
+ * STREAMOFF is an acknowledgment for source change event.
+@@ -743,7 +743,7 @@ static void mtk_jpeg_stop_streaming(struct vb2_queue *q)
+ struct mtk_jpeg_src_buf *src_buf;
+
+ vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+- src_buf = mtk_jpeg_vb2_to_srcbuf(vb);
++ src_buf = mtk_jpeg_vb2_to_srcbuf(&vb->vb2_buf);
+ mtk_jpeg_set_queue_data(ctx, &src_buf->dec_param);
+ ctx->state = MTK_JPEG_RUNNING;
+ } else if (V4L2_TYPE_IS_OUTPUT(q->type)) {
+@@ -751,7 +751,7 @@ static void mtk_jpeg_stop_streaming(struct vb2_queue *q)
+ }
+
+ while ((vb = mtk_jpeg_buf_remove(ctx, q->type)))
+- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(vb), VB2_BUF_STATE_ERROR);
++ v4l2_m2m_buf_done(vb, VB2_BUF_STATE_ERROR);
+
+ pm_runtime_put_sync(ctx->jpeg->dev);
+ }
+@@ -807,7 +807,7 @@ static void mtk_jpeg_device_run(void *priv)
+ {
+ struct mtk_jpeg_ctx *ctx = priv;
+ struct mtk_jpeg_dev *jpeg = ctx->jpeg;
+- struct vb2_buffer *src_buf, *dst_buf;
++ struct vb2_v4l2_buffer *src_buf, *dst_buf;
+ enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
+ unsigned long flags;
+ struct mtk_jpeg_src_buf *jpeg_src_buf;
+@@ -817,11 +817,11 @@ static void mtk_jpeg_device_run(void *priv)
+
+ src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+ dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
+- jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(src_buf);
++ jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf);
+
+ if (jpeg_src_buf->flags & MTK_JPEG_BUF_FLAGS_LAST_FRAME) {
+- for (i = 0; i < dst_buf->num_planes; i++)
+- vb2_set_plane_payload(dst_buf, i, 0);
++ for (i = 0; i < dst_buf->vb2_buf.num_planes; i++)
++ vb2_set_plane_payload(&dst_buf->vb2_buf, i, 0);
+ buf_state = VB2_BUF_STATE_DONE;
+ goto dec_end;
+ }
+@@ -833,8 +833,8 @@ static void mtk_jpeg_device_run(void *priv)
+ return;
+ }
+
+- mtk_jpeg_set_dec_src(ctx, src_buf, &bs);
+- if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, dst_buf, &fb))
++ mtk_jpeg_set_dec_src(ctx, &src_buf->vb2_buf, &bs);
++ if (mtk_jpeg_set_dec_dst(ctx, &jpeg_src_buf->dec_param, &dst_buf->vb2_buf, &fb))
+ goto dec_end;
+
+ spin_lock_irqsave(&jpeg->hw_lock, flags);
+@@ -849,8 +849,8 @@ static void mtk_jpeg_device_run(void *priv)
+ dec_end:
+ v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+ v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf), buf_state);
+- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(dst_buf), buf_state);
++ v4l2_m2m_buf_done(src_buf, buf_state);
++ v4l2_m2m_buf_done(dst_buf, buf_state);
+ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+ }
+
+@@ -921,7 +921,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv)
+ {
+ struct mtk_jpeg_dev *jpeg = priv;
+ struct mtk_jpeg_ctx *ctx;
+- struct vb2_buffer *src_buf, *dst_buf;
++ struct vb2_v4l2_buffer *src_buf, *dst_buf;
+ struct mtk_jpeg_src_buf *jpeg_src_buf;
+ enum vb2_buffer_state buf_state = VB2_BUF_STATE_ERROR;
+ u32 dec_irq_ret;
+@@ -938,7 +938,7 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv)
+
+ src_buf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+ dst_buf = v4l2_m2m_dst_buf_remove(ctx->fh.m2m_ctx);
+- jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(src_buf);
++ jpeg_src_buf = mtk_jpeg_vb2_to_srcbuf(&src_buf->vb2_buf);
+
+ if (dec_irq_ret >= MTK_JPEG_DEC_RESULT_UNDERFLOW)
+ mtk_jpeg_dec_reset(jpeg->dec_reg_base);
+@@ -948,15 +948,15 @@ static irqreturn_t mtk_jpeg_dec_irq(int irq, void *priv)
+ goto dec_end;
+ }
+
+- for (i = 0; i < dst_buf->num_planes; i++)
+- vb2_set_plane_payload(dst_buf, i,
++ for (i = 0; i < dst_buf->vb2_buf.num_planes; i++)
++ vb2_set_plane_payload(&dst_buf->vb2_buf, i,
+ jpeg_src_buf->dec_param.comp_size[i]);
+
+ buf_state = VB2_BUF_STATE_DONE;
+
+ dec_end:
+- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf), buf_state);
+- v4l2_m2m_buf_done(to_vb2_v4l2_buffer(dst_buf), buf_state);
++ v4l2_m2m_buf_done(src_buf, buf_state);
++ v4l2_m2m_buf_done(dst_buf, buf_state);
+ v4l2_m2m_job_finish(jpeg->m2m_dev, ctx->fh.m2m_ctx);
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/media/platform/mx2_emmaprp.c b/drivers/media/platform/mx2_emmaprp.c
+index 64195c4ddeaf..419e1cb10dc6 100644
+--- a/drivers/media/platform/mx2_emmaprp.c
++++ b/drivers/media/platform/mx2_emmaprp.c
+@@ -274,7 +274,7 @@ static void emmaprp_device_run(void *priv)
+ {
+ struct emmaprp_ctx *ctx = priv;
+ struct emmaprp_q_data *s_q_data, *d_q_data;
+- struct vb2_buffer *src_buf, *dst_buf;
++ struct vb2_v4l2_buffer *src_buf, *dst_buf;
+ struct emmaprp_dev *pcdev = ctx->dev;
+ unsigned int s_width, s_height;
+ unsigned int d_width, d_height;
+@@ -294,8 +294,8 @@ static void emmaprp_device_run(void *priv)
+ d_height = d_q_data->height;
+ d_size = d_width * d_height;
+
+- p_in = vb2_dma_contig_plane_dma_addr(src_buf, 0);
+- p_out = vb2_dma_contig_plane_dma_addr(dst_buf, 0);
++ p_in = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0);
++ p_out = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0);
+ if (!p_in || !p_out) {
+ v4l2_err(&pcdev->v4l2_dev,
+ "Acquiring kernel pointers to buffers failed\n");
+diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c
+index ce09799976ef..e1085e3ab3cc 100644
+--- a/drivers/media/platform/rcar-vin/rcar-core.c
++++ b/drivers/media/platform/rcar-vin/rcar-core.c
+@@ -131,9 +131,13 @@ static int rvin_group_link_notify(struct media_link *link, u32 flags,
+ !is_media_entity_v4l2_video_device(link->sink->entity))
+ return 0;
+
+- /* If any entity is in use don't allow link changes. */
++ /*
++ * Don't allow link changes if any entity in the graph is
++ * streaming, modifying the CHSEL register fields can disrupt
++ * running streams.
++ */
+ media_device_for_each_entity(entity, &group->mdev)
+- if (entity->use_count)
++ if (entity->stream_count)
+ return -EBUSY;
+
+ mutex_lock(&group->lock);
+diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
+index ab5a6f95044a..86a76f35a9a1 100644
+--- a/drivers/media/platform/rockchip/rga/rga.c
++++ b/drivers/media/platform/rockchip/rga/rga.c
+@@ -43,7 +43,7 @@ static void device_run(void *prv)
+ {
+ struct rga_ctx *ctx = prv;
+ struct rockchip_rga *rga = ctx->rga;
+- struct vb2_buffer *src, *dst;
++ struct vb2_v4l2_buffer *src, *dst;
+ unsigned long flags;
+
+ spin_lock_irqsave(&rga->ctrl_lock, flags);
+@@ -53,8 +53,8 @@ static void device_run(void *prv)
+ src = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+ dst = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
+
+- rga_buf_map(src);
+- rga_buf_map(dst);
++ rga_buf_map(&src->vb2_buf);
++ rga_buf_map(&dst->vb2_buf);
+
+ rga_hw_start(rga);
+
+diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c
+index e901201b6fcc..1f58574d0b96 100644
+--- a/drivers/media/platform/s5p-g2d/g2d.c
++++ b/drivers/media/platform/s5p-g2d/g2d.c
+@@ -487,7 +487,7 @@ static void device_run(void *prv)
+ {
+ struct g2d_ctx *ctx = prv;
+ struct g2d_dev *dev = ctx->dev;
+- struct vb2_buffer *src, *dst;
++ struct vb2_v4l2_buffer *src, *dst;
+ unsigned long flags;
+ u32 cmd = 0;
+
+@@ -502,10 +502,10 @@ static void device_run(void *prv)
+ spin_lock_irqsave(&dev->ctrl_lock, flags);
+
+ g2d_set_src_size(dev, &ctx->in);
+- g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(src, 0));
++ g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(&src->vb2_buf, 0));
+
+ g2d_set_dst_size(dev, &ctx->out);
+- g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(dst, 0));
++ g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(&dst->vb2_buf, 0));
+
+ g2d_set_rop4(dev, ctx->rop);
+ g2d_set_flip(dev, ctx->flip);
+diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+index 04fd2e0493c0..350afaa29a62 100644
+--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+@@ -793,14 +793,14 @@ static void skip(struct s5p_jpeg_buffer *buf, long len);
+ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx)
+ {
+ struct s5p_jpeg *jpeg = ctx->jpeg;
+- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+ struct s5p_jpeg_buffer jpeg_buffer;
+ unsigned int word;
+ int c, x, components;
+
+ jpeg_buffer.size = 2; /* Ls */
+ jpeg_buffer.data =
+- (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sos + 2;
++ (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2;
+ jpeg_buffer.curr = 0;
+
+ word = 0;
+@@ -830,14 +830,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx)
+ static void exynos4_jpeg_parse_huff_tbl(struct s5p_jpeg_ctx *ctx)
+ {
+ struct s5p_jpeg *jpeg = ctx->jpeg;
+- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+ struct s5p_jpeg_buffer jpeg_buffer;
+ unsigned int word;
+ int c, i, n, j;
+
+ for (j = 0; j < ctx->out_q.dht.n; ++j) {
+ jpeg_buffer.size = ctx->out_q.dht.len[j];
+- jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) +
++ jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) +
+ ctx->out_q.dht.marker[j];
+ jpeg_buffer.curr = 0;
+
+@@ -889,13 +889,13 @@ static void exynos4_jpeg_parse_huff_tbl(struct s5p_jpeg_ctx *ctx)
+ static void exynos4_jpeg_parse_decode_q_tbl(struct s5p_jpeg_ctx *ctx)
+ {
+ struct s5p_jpeg *jpeg = ctx->jpeg;
+- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+ struct s5p_jpeg_buffer jpeg_buffer;
+ int c, x, components;
+
+ jpeg_buffer.size = ctx->out_q.sof_len;
+ jpeg_buffer.data =
+- (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sof;
++ (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sof;
+ jpeg_buffer.curr = 0;
+
+ skip(&jpeg_buffer, 5); /* P, Y, X */
+@@ -920,14 +920,14 @@ static void exynos4_jpeg_parse_decode_q_tbl(struct s5p_jpeg_ctx *ctx)
+ static void exynos4_jpeg_parse_q_tbl(struct s5p_jpeg_ctx *ctx)
+ {
+ struct s5p_jpeg *jpeg = ctx->jpeg;
+- struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
++ struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+ struct s5p_jpeg_buffer jpeg_buffer;
+ unsigned int word;
+ int c, i, j;
+
+ for (j = 0; j < ctx->out_q.dqt.n; ++j) {
+ jpeg_buffer.size = ctx->out_q.dqt.len[j];
+- jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) +
++ jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) +
+ ctx->out_q.dqt.marker[j];
+ jpeg_buffer.curr = 0;
+
+@@ -1293,13 +1293,16 @@ static int s5p_jpeg_querycap(struct file *file, void *priv,
+ return 0;
+ }
+
+-static int enum_fmt(struct s5p_jpeg_fmt *sjpeg_formats, int n,
++static int enum_fmt(struct s5p_jpeg_ctx *ctx,
++ struct s5p_jpeg_fmt *sjpeg_formats, int n,
+ struct v4l2_fmtdesc *f, u32 type)
+ {
+ int i, num = 0;
++ unsigned int fmt_ver_flag = ctx->jpeg->variant->fmt_ver_flag;
+
+ for (i = 0; i < n; ++i) {
+- if (sjpeg_formats[i].flags & type) {
++ if (sjpeg_formats[i].flags & type &&
++ sjpeg_formats[i].flags & fmt_ver_flag) {
+ /* index-th format of type type found ? */
+ if (num == f->index)
+ break;
+@@ -1326,11 +1329,11 @@ static int s5p_jpeg_enum_fmt_vid_cap(struct file *file, void *priv,
+ struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv);
+
+ if (ctx->mode == S5P_JPEG_ENCODE)
+- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
+ SJPEG_FMT_FLAG_ENC_CAPTURE);
+
+- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
+- SJPEG_FMT_FLAG_DEC_CAPTURE);
++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
++ SJPEG_FMT_FLAG_DEC_CAPTURE);
+ }
+
+ static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv,
+@@ -1339,11 +1342,11 @@ static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv,
+ struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv);
+
+ if (ctx->mode == S5P_JPEG_ENCODE)
+- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
+ SJPEG_FMT_FLAG_ENC_OUTPUT);
+
+- return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
+- SJPEG_FMT_FLAG_DEC_OUTPUT);
++ return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
++ SJPEG_FMT_FLAG_DEC_OUTPUT);
+ }
+
+ static struct s5p_jpeg_q_data *get_q_data(struct s5p_jpeg_ctx *ctx,
+@@ -2072,15 +2075,15 @@ static void s5p_jpeg_device_run(void *priv)
+ {
+ struct s5p_jpeg_ctx *ctx = priv;
+ struct s5p_jpeg *jpeg = ctx->jpeg;
+- struct vb2_buffer *src_buf, *dst_buf;
++ struct vb2_v4l2_buffer *src_buf, *dst_buf;
+ unsigned long src_addr, dst_addr, flags;
+
+ spin_lock_irqsave(&ctx->jpeg->slock, flags);
+
+ src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+ dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
+- src_addr = vb2_dma_contig_plane_dma_addr(src_buf, 0);
+- dst_addr = vb2_dma_contig_plane_dma_addr(dst_buf, 0);
++ src_addr = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0);
++ dst_addr = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0);
+
+ s5p_jpeg_reset(jpeg->regs);
+ s5p_jpeg_poweron(jpeg->regs);
+@@ -2153,7 +2156,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx)
+ {
+ struct s5p_jpeg *jpeg = ctx->jpeg;
+ struct s5p_jpeg_fmt *fmt;
+- struct vb2_buffer *vb;
++ struct vb2_v4l2_buffer *vb;
+ struct s5p_jpeg_addr jpeg_addr = {};
+ u32 pix_size, padding_bytes = 0;
+
+@@ -2172,7 +2175,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx)
+ vb = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
+ }
+
+- jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0);
++ jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
+
+ if (fmt->colplanes == 2) {
+ jpeg_addr.cb = jpeg_addr.y + pix_size - padding_bytes;
+@@ -2190,7 +2193,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx)
+ static void exynos4_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx)
+ {
+ struct s5p_jpeg *jpeg = ctx->jpeg;
+- struct vb2_buffer *vb;
++ struct vb2_v4l2_buffer *vb;
+ unsigned int jpeg_addr = 0;
+
+ if (ctx->mode == S5P_JPEG_ENCODE)
+@@ -2198,7 +2201,7 @@ static void exynos4_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx)
+ else
+ vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+
+- jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0);
++ jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
+ if (jpeg->variant->version == SJPEG_EXYNOS5433 &&
+ ctx->mode == S5P_JPEG_DECODE)
+ jpeg_addr += ctx->out_q.sos;
+@@ -2314,7 +2317,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx)
+ {
+ struct s5p_jpeg *jpeg = ctx->jpeg;
+ struct s5p_jpeg_fmt *fmt;
+- struct vb2_buffer *vb;
++ struct vb2_v4l2_buffer *vb;
+ struct s5p_jpeg_addr jpeg_addr = {};
+ u32 pix_size;
+
+@@ -2328,7 +2331,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx)
+ fmt = ctx->cap_q.fmt;
+ }
+
+- jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0);
++ jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
+
+ if (fmt->colplanes == 2) {
+ jpeg_addr.cb = jpeg_addr.y + pix_size;
+@@ -2346,7 +2349,7 @@ static void exynos3250_jpeg_set_img_addr(struct s5p_jpeg_ctx *ctx)
+ static void exynos3250_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx)
+ {
+ struct s5p_jpeg *jpeg = ctx->jpeg;
+- struct vb2_buffer *vb;
++ struct vb2_v4l2_buffer *vb;
+ unsigned int jpeg_addr = 0;
+
+ if (ctx->mode == S5P_JPEG_ENCODE)
+@@ -2354,7 +2357,7 @@ static void exynos3250_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx)
+ else
+ vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+
+- jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0);
++ jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
+ exynos3250_jpeg_jpgadr(jpeg->regs, jpeg_addr);
+ }
+
+diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c
+index 1d274c64de09..03ee9839a03e 100644
+--- a/drivers/media/platform/sh_veu.c
++++ b/drivers/media/platform/sh_veu.c
+@@ -273,13 +273,13 @@ static void sh_veu_process(struct sh_veu_dev *veu,
+ static void sh_veu_device_run(void *priv)
+ {
+ struct sh_veu_dev *veu = priv;
+- struct vb2_buffer *src_buf, *dst_buf;
++ struct vb2_v4l2_buffer *src_buf, *dst_buf;
+
+ src_buf = v4l2_m2m_next_src_buf(veu->m2m_ctx);
+ dst_buf = v4l2_m2m_next_dst_buf(veu->m2m_ctx);
+
+ if (src_buf && dst_buf)
+- sh_veu_process(veu, src_buf, dst_buf);
++ sh_veu_process(veu, &src_buf->vb2_buf, &dst_buf->vb2_buf);
+ }
+
+ /* ========== video ioctls ========== */
+diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
+index c60a7625b1fa..b2873a2432b6 100644
+--- a/drivers/mmc/host/omap.c
++++ b/drivers/mmc/host/omap.c
+@@ -920,7 +920,7 @@ static inline void set_cmd_timeout(struct mmc_omap_host *host, struct mmc_reques
+ reg &= ~(1 << 5);
+ OMAP_MMC_WRITE(host, SDIO, reg);
+ /* Set maximum timeout */
+- OMAP_MMC_WRITE(host, CTO, 0xff);
++ OMAP_MMC_WRITE(host, CTO, 0xfd);
+ }
+
+ static inline void set_data_timeout(struct mmc_omap_host *host, struct mmc_request *req)
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index c078c791f481..dabe89968a78 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -442,12 +442,20 @@ out_mapping:
+
+ static int mv88e6xxx_g1_irq_setup(struct mv88e6xxx_chip *chip)
+ {
++ static struct lock_class_key lock_key;
++ static struct lock_class_key request_key;
+ int err;
+
+ err = mv88e6xxx_g1_irq_setup_common(chip);
+ if (err)
+ return err;
+
++ /* These lock classes tells lockdep that global 1 irqs are in
++ * a different category than their parent GPIO, so it won't
++ * report false recursion.
++ */
++ irq_set_lockdep_class(chip->irq, &lock_key, &request_key);
++
+ err = request_threaded_irq(chip->irq, NULL,
+ mv88e6xxx_g1_irq_thread_fn,
+ IRQF_ONESHOT,
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
+index 9a7f70db20c7..733d9172425b 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -119,7 +119,7 @@ static void enic_init_affinity_hint(struct enic *enic)
+
+ for (i = 0; i < enic->intr_count; i++) {
+ if (enic_is_err_intr(enic, i) || enic_is_notify_intr(enic, i) ||
+- (enic->msix[i].affinity_mask &&
++ (cpumask_available(enic->msix[i].affinity_mask) &&
+ !cpumask_empty(enic->msix[i].affinity_mask)))
+ continue;
+ if (zalloc_cpumask_var(&enic->msix[i].affinity_mask,
+@@ -148,7 +148,7 @@ static void enic_set_affinity_hint(struct enic *enic)
+ for (i = 0; i < enic->intr_count; i++) {
+ if (enic_is_err_intr(enic, i) ||
+ enic_is_notify_intr(enic, i) ||
+- !enic->msix[i].affinity_mask ||
++ !cpumask_available(enic->msix[i].affinity_mask) ||
+ cpumask_empty(enic->msix[i].affinity_mask))
+ continue;
+ err = irq_set_affinity_hint(enic->msix_entry[i].vector,
+@@ -161,7 +161,7 @@ static void enic_set_affinity_hint(struct enic *enic)
+ for (i = 0; i < enic->wq_count; i++) {
+ int wq_intr = enic_msix_wq_intr(enic, i);
+
+- if (enic->msix[wq_intr].affinity_mask &&
++ if (cpumask_available(enic->msix[wq_intr].affinity_mask) &&
+ !cpumask_empty(enic->msix[wq_intr].affinity_mask))
+ netif_set_xps_queue(enic->netdev,
+ enic->msix[wq_intr].affinity_mask,
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 3ba0c90e7055..8b11682ebba2 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -2106,7 +2106,7 @@ static int e1000_request_msix(struct e1000_adapter *adapter)
+ if (strlen(netdev->name) < (IFNAMSIZ - 5))
+ snprintf(adapter->rx_ring->name,
+ sizeof(adapter->rx_ring->name) - 1,
+- "%s-rx-0", netdev->name);
++ "%.14s-rx-0", netdev->name);
+ else
+ memcpy(adapter->rx_ring->name, netdev->name, IFNAMSIZ);
+ err = request_irq(adapter->msix_entries[vector].vector,
+@@ -2122,7 +2122,7 @@ static int e1000_request_msix(struct e1000_adapter *adapter)
+ if (strlen(netdev->name) < (IFNAMSIZ - 5))
+ snprintf(adapter->tx_ring->name,
+ sizeof(adapter->tx_ring->name) - 1,
+- "%s-tx-0", netdev->name);
++ "%.14s-tx-0", netdev->name);
+ else
+ memcpy(adapter->tx_ring->name, netdev->name, IFNAMSIZ);
+ err = request_irq(adapter->msix_entries[vector].vector,
+@@ -5286,8 +5286,13 @@ static void e1000_watchdog_task(struct work_struct *work)
+ /* 8000ES2LAN requires a Rx packet buffer work-around
+ * on link down event; reset the controller to flush
+ * the Rx packet buffer.
++ *
++ * If the link is lost the controller stops DMA, but
++ * if there is queued Tx work it cannot be done. So
++ * reset the controller to flush the Tx packet buffers.
+ */
+- if (adapter->flags & FLAG_RX_NEEDS_RESTART)
++ if ((adapter->flags & FLAG_RX_NEEDS_RESTART) ||
++ e1000_desc_unused(tx_ring) + 1 < tx_ring->count)
+ adapter->flags |= FLAG_RESTART_NOW;
+ else
+ pm_schedule_suspend(netdev->dev.parent,
+@@ -5310,14 +5315,6 @@ link_up:
+ adapter->gotc_old = adapter->stats.gotc;
+ spin_unlock(&adapter->stats64_lock);
+
+- /* If the link is lost the controller stops DMA, but
+- * if there is queued Tx work it cannot be done. So
+- * reset the controller to flush the Tx packet buffers.
+- */
+- if (!netif_carrier_ok(netdev) &&
+- (e1000_desc_unused(tx_ring) + 1 < tx_ring->count))
+- adapter->flags |= FLAG_RESTART_NOW;
+-
+ /* If reset is necessary, do it outside of interrupt context. */
+ if (adapter->flags & FLAG_RESTART_NOW) {
+ schedule_work(&adapter->reset_task);
+@@ -7330,6 +7327,8 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ e1000_print_device_info(adapter);
+
++ dev_pm_set_driver_flags(&pdev->dev, DPM_FLAG_NEVER_SKIP);
++
+ if (pci_dev_run_wake(pdev))
+ pm_runtime_put_noidle(&pdev->dev);
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index f8e4808a8317..9988c89ed9fd 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -1372,13 +1372,9 @@ static void mvpp2_port_reset(struct mvpp2_port *port)
+ for (i = 0; i < ARRAY_SIZE(mvpp2_ethtool_regs); i++)
+ mvpp2_read_count(port, &mvpp2_ethtool_regs[i]);
+
+- val = readl(port->base + MVPP2_GMAC_CTRL_2_REG) &
+- ~MVPP2_GMAC_PORT_RESET_MASK;
++ val = readl(port->base + MVPP2_GMAC_CTRL_2_REG) |
++ MVPP2_GMAC_PORT_RESET_MASK;
+ writel(val, port->base + MVPP2_GMAC_CTRL_2_REG);
+-
+- while (readl(port->base + MVPP2_GMAC_CTRL_2_REG) &
+- MVPP2_GMAC_PORT_RESET_MASK)
+- continue;
+ }
+
+ /* Change maximum receive size of the port */
+@@ -4445,12 +4441,15 @@ static void mvpp2_gmac_config(struct mvpp2_port *port, unsigned int mode,
+ const struct phylink_link_state *state)
+ {
+ u32 an, ctrl0, ctrl2, ctrl4;
++ u32 old_ctrl2;
+
+ an = readl(port->base + MVPP2_GMAC_AUTONEG_CONFIG);
+ ctrl0 = readl(port->base + MVPP2_GMAC_CTRL_0_REG);
+ ctrl2 = readl(port->base + MVPP2_GMAC_CTRL_2_REG);
+ ctrl4 = readl(port->base + MVPP22_GMAC_CTRL_4_REG);
+
++ old_ctrl2 = ctrl2;
++
+ /* Force link down */
+ an &= ~MVPP2_GMAC_FORCE_LINK_PASS;
+ an |= MVPP2_GMAC_FORCE_LINK_DOWN;
+@@ -4523,6 +4522,12 @@ static void mvpp2_gmac_config(struct mvpp2_port *port, unsigned int mode,
+ writel(ctrl2, port->base + MVPP2_GMAC_CTRL_2_REG);
+ writel(ctrl4, port->base + MVPP22_GMAC_CTRL_4_REG);
+ writel(an, port->base + MVPP2_GMAC_AUTONEG_CONFIG);
++
++ if (old_ctrl2 & MVPP2_GMAC_PORT_RESET_MASK) {
++ while (readl(port->base + MVPP2_GMAC_CTRL_2_REG) &
++ MVPP2_GMAC_PORT_RESET_MASK)
++ continue;
++ }
+ }
+
+ static void mvpp2_mac_config(struct net_device *dev, unsigned int mode,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index d6706475a3ba..26c9f9421901 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1797,7 +1797,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
+ u64 node_guid;
+ int err = 0;
+
+- if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
++ if (!esw || !MLX5_CAP_GEN(esw->dev, vport_group_manager))
+ return -EPERM;
+ if (!LEGAL_VPORT(esw, vport) || is_multicast_ether_addr(mac))
+ return -EINVAL;
+@@ -1871,7 +1871,7 @@ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw,
+ {
+ struct mlx5_vport *evport;
+
+- if (!MLX5_CAP_GEN(esw->dev, vport_group_manager))
++ if (!esw || !MLX5_CAP_GEN(esw->dev, vport_group_manager))
+ return -EPERM;
+ if (!LEGAL_VPORT(esw, vport))
+ return -EINVAL;
+@@ -2044,19 +2044,24 @@ static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider)
+ int mlx5_eswitch_set_vport_rate(struct mlx5_eswitch *esw, int vport,
+ u32 max_rate, u32 min_rate)
+ {
+- u32 fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share);
+- bool min_rate_supported = MLX5_CAP_QOS(esw->dev, esw_bw_share) &&
+- fw_max_bw_share >= MLX5_MIN_BW_SHARE;
+- bool max_rate_supported = MLX5_CAP_QOS(esw->dev, esw_rate_limit);
+ struct mlx5_vport *evport;
++ u32 fw_max_bw_share;
+ u32 previous_min_rate;
+ u32 divider;
++ bool min_rate_supported;
++ bool max_rate_supported;
+ int err = 0;
+
+ if (!ESW_ALLOWED(esw))
+ return -EPERM;
+ if (!LEGAL_VPORT(esw, vport))
+ return -EINVAL;
++
++ fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share);
++ min_rate_supported = MLX5_CAP_QOS(esw->dev, esw_bw_share) &&
++ fw_max_bw_share >= MLX5_MIN_BW_SHARE;
++ max_rate_supported = MLX5_CAP_QOS(esw->dev, esw_rate_limit);
++
+ if ((min_rate && !min_rate_supported) || (max_rate && !max_rate_supported))
+ return -EOPNOTSUPP;
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index a12b5710891e..f9bef030ee05 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -1988,7 +1988,7 @@ static void mlxsw_sp_port_get_prio_strings(u8 **p, int prio)
+ int i;
+
+ for (i = 0; i < MLXSW_SP_PORT_HW_PRIO_STATS_LEN; i++) {
+- snprintf(*p, ETH_GSTRING_LEN, "%s_%d",
++ snprintf(*p, ETH_GSTRING_LEN, "%.29s_%.1d",
+ mlxsw_sp_port_hw_prio_stats[i].str, prio);
+ *p += ETH_GSTRING_LEN;
+ }
+@@ -1999,7 +1999,7 @@ static void mlxsw_sp_port_get_tc_strings(u8 **p, int tc)
+ int i;
+
+ for (i = 0; i < MLXSW_SP_PORT_HW_TC_STATS_LEN; i++) {
+- snprintf(*p, ETH_GSTRING_LEN, "%s_%d",
++ snprintf(*p, ETH_GSTRING_LEN, "%.29s_%.1d",
+ mlxsw_sp_port_hw_tc_stats[i].str, tc);
+ *p += ETH_GSTRING_LEN;
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 43ab9e905bed..886176be818e 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -474,7 +474,7 @@ static void stmmac_get_tx_hwtstamp(struct stmmac_priv *priv,
+ struct dma_desc *p, struct sk_buff *skb)
+ {
+ struct skb_shared_hwtstamps shhwtstamp;
+- u64 ns;
++ u64 ns = 0;
+
+ if (!priv->hwts_tx_en)
+ return;
+@@ -513,7 +513,7 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p,
+ {
+ struct skb_shared_hwtstamps *shhwtstamp = NULL;
+ struct dma_desc *desc = p;
+- u64 ns;
++ u64 ns = 0;
+
+ if (!priv->hwts_rx_en)
+ return;
+@@ -558,8 +558,8 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
+ u32 snap_type_sel = 0;
+ u32 ts_master_en = 0;
+ u32 ts_event_en = 0;
++ u32 sec_inc = 0;
+ u32 value = 0;
+- u32 sec_inc;
+ bool xmac;
+
+ xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+index 2293e21f789f..cc60b3fb0892 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+@@ -105,7 +105,7 @@ static int stmmac_get_time(struct ptp_clock_info *ptp, struct timespec64 *ts)
+ struct stmmac_priv *priv =
+ container_of(ptp, struct stmmac_priv, ptp_clock_ops);
+ unsigned long flags;
+- u64 ns;
++ u64 ns = 0;
+
+ spin_lock_irqsave(&priv->ptp_lock, flags);
+ stmmac_get_systime(priv, priv->ptpaddr, &ns);
+diff --git a/drivers/net/phy/phy-c45.c b/drivers/net/phy/phy-c45.c
+index e1225545362d..0ba3607585bd 100644
+--- a/drivers/net/phy/phy-c45.c
++++ b/drivers/net/phy/phy-c45.c
+@@ -147,9 +147,15 @@ int genphy_c45_read_link(struct phy_device *phydev, u32 mmd_mask)
+ mmd_mask &= ~BIT(devad);
+
+ /* The link state is latched low so that momentary link
+- * drops can be detected. Do not double-read the status
+- * register if the link is down.
++ * drops can be detected. Do not double-read the status
++ * in polling mode to detect such short link drops.
+ */
++ if (!phy_polling_mode(phydev)) {
++ val = phy_read_mmd(phydev, devad, MDIO_STAT1);
++ if (val < 0)
++ return val;
++ }
++
+ val = phy_read_mmd(phydev, devad, MDIO_STAT1);
+ if (val < 0)
+ return val;
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 2c32c795f5dd..8a96d985a52f 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1503,10 +1503,15 @@ int genphy_update_link(struct phy_device *phydev)
+ {
+ int status;
+
+- /* Do a fake read */
+- status = phy_read(phydev, MII_BMSR);
+- if (status < 0)
+- return status;
++ /* The link state is latched low so that momentary link
++ * drops can be detected. Do not double-read the status
++ * in polling mode to detect such short link drops.
++ */
++ if (!phy_polling_mode(phydev)) {
++ status = phy_read(phydev, MII_BMSR);
++ if (status < 0)
++ return status;
++ }
+
+ /* Read link and autonegotiation status */
+ status = phy_read(phydev, MII_BMSR);
+diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
+index 18c709c484e7..f761d651c16e 100644
+--- a/drivers/net/wireless/ath/ath10k/ce.c
++++ b/drivers/net/wireless/ath/ath10k/ce.c
+@@ -500,14 +500,8 @@ static int _ath10k_ce_send_nolock(struct ath10k_ce_pipe *ce_state,
+ write_index = CE_RING_IDX_INCR(nentries_mask, write_index);
+
+ /* WORKAROUND */
+- if (!(flags & CE_SEND_FLAG_GATHER)) {
+- if (ar->hw_params.shadow_reg_support)
+- ath10k_ce_shadow_src_ring_write_index_set(ar, ce_state,
+- write_index);
+- else
+- ath10k_ce_src_ring_write_index_set(ar, ctrl_addr,
+- write_index);
+- }
++ if (!(flags & CE_SEND_FLAG_GATHER))
++ ath10k_ce_src_ring_write_index_set(ar, ctrl_addr, write_index);
+
+ src_ring->write_index = write_index;
+ exit:
+@@ -581,8 +575,14 @@ static int _ath10k_ce_send_nolock_64(struct ath10k_ce_pipe *ce_state,
+ /* Update Source Ring Write Index */
+ write_index = CE_RING_IDX_INCR(nentries_mask, write_index);
+
+- if (!(flags & CE_SEND_FLAG_GATHER))
+- ath10k_ce_src_ring_write_index_set(ar, ctrl_addr, write_index);
++ if (!(flags & CE_SEND_FLAG_GATHER)) {
++ if (ar->hw_params.shadow_reg_support)
++ ath10k_ce_shadow_src_ring_write_index_set(ar, ce_state,
++ write_index);
++ else
++ ath10k_ce_src_ring_write_index_set(ar, ctrl_addr,
++ write_index);
++ }
+
+ src_ring->write_index = write_index;
+ exit:
+@@ -1394,12 +1394,12 @@ static int ath10k_ce_alloc_shadow_base(struct ath10k *ar,
+ u32 nentries)
+ {
+ src_ring->shadow_base_unaligned = kcalloc(nentries,
+- sizeof(struct ce_desc),
++ sizeof(struct ce_desc_64),
+ GFP_KERNEL);
+ if (!src_ring->shadow_base_unaligned)
+ return -ENOMEM;
+
+- src_ring->shadow_base = (struct ce_desc *)
++ src_ring->shadow_base = (struct ce_desc_64 *)
+ PTR_ALIGN(src_ring->shadow_base_unaligned,
+ CE_DESC_RING_ALIGN);
+ return 0;
+@@ -1453,7 +1453,7 @@ ath10k_ce_alloc_src_ring(struct ath10k *ar, unsigned int ce_id,
+ ret = ath10k_ce_alloc_shadow_base(ar, src_ring, nentries);
+ if (ret) {
+ dma_free_coherent(ar->dev,
+- (nentries * sizeof(struct ce_desc) +
++ (nentries * sizeof(struct ce_desc_64) +
+ CE_DESC_RING_ALIGN),
+ src_ring->base_addr_owner_space_unaligned,
+ base_addr);
+diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h
+index b8fb5382dede..8088f7a66426 100644
+--- a/drivers/net/wireless/ath/ath10k/ce.h
++++ b/drivers/net/wireless/ath/ath10k/ce.h
+@@ -118,7 +118,7 @@ struct ath10k_ce_ring {
+ u32 base_addr_ce_space;
+
+ char *shadow_base_unaligned;
+- struct ce_desc *shadow_base;
++ struct ce_desc_64 *shadow_base;
+
+ /* keep last */
+ void *per_transfer_context[0];
+diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
+index f79c337105cb..2daf33342b23 100644
+--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
++++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
+@@ -1420,6 +1420,12 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,
+ u8 *buf, *dpos;
+ const u8 *spos;
+
++ if (!ies1)
++ ies1_len = 0;
++
++ if (!ies2)
++ ies2_len = 0;
++
+ if (ies1_len == 0 && ies2_len == 0) {
+ *merged_ies = NULL;
+ *merged_len = 0;
+@@ -1429,17 +1435,19 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,
+ buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+- memcpy(buf, ies1, ies1_len);
++ if (ies1)
++ memcpy(buf, ies1, ies1_len);
+ dpos = buf + ies1_len;
+ spos = ies2;
+- while (spos + 1 < ies2 + ies2_len) {
++ while (spos && (spos + 1 < ies2 + ies2_len)) {
+ /* IE tag at offset 0, length at offset 1 */
+ u16 ielen = 2 + spos[1];
+
+ if (spos + ielen > ies2 + ies2_len)
+ break;
+ if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&
+- !_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) {
++ (!ies1 || !_wil_cfg80211_find_ie(ies1, ies1_len,
++ spos, ielen))) {
+ memcpy(dpos, spos, ielen);
+ dpos += ielen;
+ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+index cd3651069d0c..27893af63ebc 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -149,7 +149,7 @@ static int brcmf_c_process_clm_blob(struct brcmf_if *ifp)
+ return err;
+ }
+
+- err = request_firmware(&clm, clm_name, bus->dev);
++ err = firmware_request_nowarn(&clm, clm_name, bus->dev);
+ if (err) {
+ brcmf_info("no clm_blob available (err=%d), device may have limited channels available\n",
+ err);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 16c6c7f921a8..8b7d70e3a379 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -132,13 +132,17 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
+
+ static int iwl_configure_rxq(struct iwl_mvm *mvm)
+ {
+- int i, num_queues, size;
++ int i, num_queues, size, ret;
+ struct iwl_rfh_queue_config *cmd;
++ struct iwl_host_cmd hcmd = {
++ .id = WIDE_ID(DATA_PATH_GROUP, RFH_QUEUE_CONFIG_CMD),
++ .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
++ };
+
+ /* Do not configure default queue, it is configured via context info */
+ num_queues = mvm->trans->num_rx_queues - 1;
+
+- size = sizeof(*cmd) + num_queues * sizeof(struct iwl_rfh_queue_data);
++ size = struct_size(cmd, data, num_queues);
+
+ cmd = kzalloc(size, GFP_KERNEL);
+ if (!cmd)
+@@ -159,10 +163,14 @@ static int iwl_configure_rxq(struct iwl_mvm *mvm)
+ cmd->data[i].fr_bd_wid = cpu_to_le32(data.fr_bd_wid);
+ }
+
+- return iwl_mvm_send_cmd_pdu(mvm,
+- WIDE_ID(DATA_PATH_GROUP,
+- RFH_QUEUE_CONFIG_CMD),
+- 0, size, cmd);
++ hcmd.data[0] = cmd;
++ hcmd.len[0] = size;
++
++ ret = iwl_mvm_send_cmd(mvm, &hcmd);
++
++ kfree(cmd);
++
++ return ret;
+ }
+
+ static int iwl_mvm_send_dqa_cmd(struct iwl_mvm *mvm)
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index d4a31e014c82..b2905f01b7df 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -502,7 +502,7 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+ struct iwl_rb_allocator *rba = &trans_pcie->rba;
+ struct list_head local_empty;
+- int pending = atomic_xchg(&rba->req_pending, 0);
++ int pending = atomic_read(&rba->req_pending);
+
+ IWL_DEBUG_RX(trans, "Pending allocation requests = %d\n", pending);
+
+@@ -557,11 +557,13 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
+ i++;
+ }
+
++ atomic_dec(&rba->req_pending);
+ pending--;
++
+ if (!pending) {
+- pending = atomic_xchg(&rba->req_pending, 0);
++ pending = atomic_read(&rba->req_pending);
+ IWL_DEBUG_RX(trans,
+- "Pending allocation requests = %d\n",
++ "Got more pending allocation requests = %d\n",
+ pending);
+ }
+
+@@ -573,12 +575,15 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
+ spin_unlock(&rba->lock);
+
+ atomic_inc(&rba->req_ready);
++
+ }
+
+ spin_lock(&rba->lock);
+ /* return unused rbds to the allocator empty list */
+ list_splice_tail(&local_empty, &rba->rbd_empty);
+ spin_unlock(&rba->lock);
++
++ IWL_DEBUG_RX(trans, "%s, exit.\n", __func__);
+ }
+
+ /*
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index adc88433faa8..2d87ebbfa4da 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -4282,11 +4282,13 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
+ wiphy->mgmt_stypes = mwifiex_mgmt_stypes;
+ wiphy->max_remain_on_channel_duration = 5000;
+ wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+- BIT(NL80211_IFTYPE_ADHOC) |
+ BIT(NL80211_IFTYPE_P2P_CLIENT) |
+ BIT(NL80211_IFTYPE_P2P_GO) |
+ BIT(NL80211_IFTYPE_AP);
+
++ if (ISSUPP_ADHOC_ENABLED(adapter->fw_cap_info))
++ wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
++
+ wiphy->bands[NL80211_BAND_2GHZ] = &mwifiex_band_2ghz;
+ if (adapter->config_bands & BAND_A)
+ wiphy->bands[NL80211_BAND_5GHZ] = &mwifiex_band_5ghz;
+@@ -4346,11 +4348,13 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
+ wiphy->available_antennas_tx = BIT(adapter->number_of_antenna) - 1;
+ wiphy->available_antennas_rx = BIT(adapter->number_of_antenna) - 1;
+
+- wiphy->features |= NL80211_FEATURE_HT_IBSS |
+- NL80211_FEATURE_INACTIVITY_TIMER |
++ wiphy->features |= NL80211_FEATURE_INACTIVITY_TIMER |
+ NL80211_FEATURE_LOW_PRIORITY_SCAN |
+ NL80211_FEATURE_NEED_OBSS_SCAN;
+
++ if (ISSUPP_ADHOC_ENABLED(adapter->fw_cap_info))
++ wiphy->features |= NL80211_FEATURE_HT_IBSS;
++
+ if (ISSUPP_RANDOM_MAC(adapter->fw_cap_info))
+ wiphy->features |= NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR |
+ NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR |
+diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c
+index 530e5593765c..a1529920d877 100644
+--- a/drivers/net/wireless/mediatek/mt76/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/eeprom.c
+@@ -54,22 +54,30 @@ mt76_get_of_eeprom(struct mt76_dev *dev, int len)
+ part = np->name;
+
+ mtd = get_mtd_device_nm(part);
+- if (IS_ERR(mtd))
+- return PTR_ERR(mtd);
++ if (IS_ERR(mtd)) {
++ ret = PTR_ERR(mtd);
++ goto out_put_node;
++ }
+
+- if (size <= sizeof(*list))
+- return -EINVAL;
++ if (size <= sizeof(*list)) {
++ ret = -EINVAL;
++ goto out_put_node;
++ }
+
+ offset = be32_to_cpup(list);
+ ret = mtd_read(mtd, offset, len, &retlen, dev->eeprom.data);
+ put_mtd_device(mtd);
+ if (ret)
+- return ret;
++ goto out_put_node;
+
+- if (retlen < len)
+- return -EINVAL;
++ if (retlen < len) {
++ ret = -EINVAL;
++ goto out_put_node;
++ }
+
+- return 0;
++out_put_node:
++ of_node_put(np);
++ return ret;
+ #else
+ return -ENOENT;
+ #endif
+diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
+index 79e59f2379a2..8d40e92fb6f2 100644
+--- a/drivers/net/wireless/mediatek/mt76/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/usb.c
+@@ -796,16 +796,9 @@ int mt76u_alloc_queues(struct mt76_dev *dev)
+
+ err = mt76u_alloc_rx(dev);
+ if (err < 0)
+- goto err;
+-
+- err = mt76u_alloc_tx(dev);
+- if (err < 0)
+- goto err;
++ return err;
+
+- return 0;
+-err:
+- mt76u_queues_deinit(dev);
+- return err;
++ return mt76u_alloc_tx(dev);
+ }
+ EXPORT_SYMBOL_GPL(mt76u_alloc_queues);
+
+diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.h b/drivers/net/wireless/mediatek/mt7601u/eeprom.h
+index 662d12703b69..57b503ae63f1 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.h
++++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.h
+@@ -17,7 +17,7 @@
+
+ struct mt7601u_dev;
+
+-#define MT7601U_EE_MAX_VER 0x0c
++#define MT7601U_EE_MAX_VER 0x0d
+ #define MT7601U_EEPROM_SIZE 256
+
+ #define MT7601U_DEFAULT_TX_POWER 6
+diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
+index 19e3c5a0b715..2ca5658bbc2a 100644
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -1084,8 +1084,11 @@ static int wl12xx_chip_wakeup(struct wl1271 *wl, bool plt)
+ goto out;
+
+ ret = wl12xx_fetch_firmware(wl, plt);
+- if (ret < 0)
+- goto out;
++ if (ret < 0) {
++ kfree(wl->fw_status);
++ kfree(wl->raw_fw_status);
++ kfree(wl->tx_res_if);
++ }
+
+ out:
+ return ret;
+diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c
+index 3ed67676ea2a..e85c5a8206c4 100644
+--- a/drivers/pci/pcie/pme.c
++++ b/drivers/pci/pcie/pme.c
+@@ -363,6 +363,16 @@ static bool pcie_pme_check_wakeup(struct pci_bus *bus)
+ return false;
+ }
+
++static void pcie_pme_disable_interrupt(struct pci_dev *port,
++ struct pcie_pme_service_data *data)
++{
++ spin_lock_irq(&data->lock);
++ pcie_pme_interrupt_enable(port, false);
++ pcie_clear_root_pme_status(port);
++ data->noirq = true;
++ spin_unlock_irq(&data->lock);
++}
++
+ /**
+ * pcie_pme_suspend - Suspend PCIe PME service device.
+ * @srv: PCIe service device to suspend.
+@@ -387,11 +397,7 @@ static int pcie_pme_suspend(struct pcie_device *srv)
+ return 0;
+ }
+
+- spin_lock_irq(&data->lock);
+- pcie_pme_interrupt_enable(port, false);
+- pcie_clear_root_pme_status(port);
+- data->noirq = true;
+- spin_unlock_irq(&data->lock);
++ pcie_pme_disable_interrupt(port, data);
+
+ synchronize_irq(srv->irq);
+
+@@ -427,9 +433,11 @@ static int pcie_pme_resume(struct pcie_device *srv)
+ */
+ static void pcie_pme_remove(struct pcie_device *srv)
+ {
+- pcie_pme_suspend(srv);
++ struct pcie_pme_service_data *data = get_service_data(srv);
++
++ pcie_pme_disable_interrupt(srv->port, data);
+ free_irq(srv->irq, srv);
+- kfree(get_service_data(srv));
++ kfree(data);
+ }
+
+ static struct pcie_port_service_driver pcie_pme_driver = {
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index e1a77b2de78a..3623f6489f49 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -824,10 +824,10 @@ static void arm_spe_pmu_read(struct perf_event *event)
+ {
+ }
+
+-static void *arm_spe_pmu_setup_aux(int cpu, void **pages, int nr_pages,
+- bool snapshot)
++static void *arm_spe_pmu_setup_aux(struct perf_event *event, void **pages,
++ int nr_pages, bool snapshot)
+ {
+- int i;
++ int i, cpu = event->cpu;
+ struct page **pglist;
+ struct arm_spe_pmu_buf *buf;
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
+index ead4beb5f55f..036124fd363c 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
+@@ -346,6 +346,8 @@ static const unsigned int eth_rx_dv_pins[] = { DIF_1_P };
+ static const unsigned int eth_rx_clk_pins[] = { DIF_1_N };
+ static const unsigned int eth_txd0_1_pins[] = { DIF_2_P };
+ static const unsigned int eth_txd1_1_pins[] = { DIF_2_N };
++static const unsigned int eth_rxd3_pins[] = { DIF_2_P };
++static const unsigned int eth_rxd2_pins[] = { DIF_2_N };
+ static const unsigned int eth_tx_en_pins[] = { DIF_3_P };
+ static const unsigned int eth_ref_clk_pins[] = { DIF_3_N };
+ static const unsigned int eth_mdc_pins[] = { DIF_4_P };
+@@ -571,6 +573,8 @@ static struct meson_pmx_group meson8b_cbus_groups[] = {
+ GROUP(eth_ref_clk, 6, 8),
+ GROUP(eth_mdc, 6, 9),
+ GROUP(eth_mdio_en, 6, 10),
++ GROUP(eth_rxd3, 7, 22),
++ GROUP(eth_rxd2, 7, 23),
+ };
+
+ static struct meson_pmx_group meson8b_aobus_groups[] = {
+@@ -720,7 +724,7 @@ static const char * const ethernet_groups[] = {
+ "eth_tx_clk", "eth_tx_en", "eth_txd1_0", "eth_txd1_1",
+ "eth_txd0_0", "eth_txd0_1", "eth_rx_clk", "eth_rx_dv",
+ "eth_rxd1", "eth_rxd0", "eth_mdio_en", "eth_mdc", "eth_ref_clk",
+- "eth_txd2", "eth_txd3"
++ "eth_txd2", "eth_txd3", "eth_rxd3", "eth_rxd2"
+ };
+
+ static const char * const i2c_a_groups[] = {
+diff --git a/drivers/platform/mellanox/mlxreg-hotplug.c b/drivers/platform/mellanox/mlxreg-hotplug.c
+index b6d44550d98c..eca16d00e310 100644
+--- a/drivers/platform/mellanox/mlxreg-hotplug.c
++++ b/drivers/platform/mellanox/mlxreg-hotplug.c
+@@ -248,7 +248,8 @@ mlxreg_hotplug_work_helper(struct mlxreg_hotplug_priv_data *priv,
+ struct mlxreg_core_item *item)
+ {
+ struct mlxreg_core_data *data;
+- u32 asserted, regval, bit;
++ unsigned long asserted;
++ u32 regval, bit;
+ int ret;
+
+ /*
+@@ -281,7 +282,7 @@ mlxreg_hotplug_work_helper(struct mlxreg_hotplug_priv_data *priv,
+ asserted = item->cache ^ regval;
+ item->cache = regval;
+
+- for_each_set_bit(bit, (unsigned long *)&asserted, 8) {
++ for_each_set_bit(bit, &asserted, 8) {
+ data = item->data + bit;
+ if (regval & BIT(bit)) {
+ if (item->inversed)
+diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
+index d4f1259ff5a2..62d4b94e2531 100644
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -989,7 +989,7 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
+ .ident = "Lenovo RESCUER R720-15IKBN",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_BOARD_NAME, "80WW"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo R720-15IKBN"),
+ },
+ },
+ {
+diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
+index 6cf9b7fa5bf0..3201a83073b5 100644
+--- a/drivers/platform/x86/intel-hid.c
++++ b/drivers/platform/x86/intel-hid.c
+@@ -373,7 +373,7 @@ wakeup:
+ * the 5-button array, but still send notifies with power button
+ * event code to this device object on power button actions.
+ *
+- * Report the power button press; catch and ignore the button release.
++ * Report the power button press and release.
+ */
+ if (!priv->array) {
+ if (event == 0xce) {
+@@ -382,8 +382,11 @@ wakeup:
+ return;
+ }
+
+- if (event == 0xcf)
++ if (event == 0xcf) {
++ input_report_key(priv->input_dev, KEY_POWER, 0);
++ input_sync(priv->input_dev);
+ return;
++ }
+ }
+
+ /* 0xC0 is for HID events, other values are for 5 button array */
+diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c
+index 2d272a3e0176..e0dcdb3cc070 100644
+--- a/drivers/platform/x86/intel_pmc_core.c
++++ b/drivers/platform/x86/intel_pmc_core.c
+@@ -333,7 +333,8 @@ static int pmc_core_ppfear_sts_show(struct seq_file *s, void *unused)
+ index < PPFEAR_MAX_NUM_ENTRIES; index++, iter++)
+ pf_regs[index] = pmc_core_reg_read_byte(pmcdev, iter);
+
+- for (index = 0; map[index].name; index++)
++ for (index = 0; map[index].name &&
++ index < pmcdev->map->ppfear_buckets * 8; index++)
+ pmc_core_display_map(s, index, pf_regs[index / 8], map);
+
+ return 0;
+diff --git a/drivers/platform/x86/intel_pmc_core.h b/drivers/platform/x86/intel_pmc_core.h
+index 93a7e99e1f8b..3f9711b03cb4 100644
+--- a/drivers/platform/x86/intel_pmc_core.h
++++ b/drivers/platform/x86/intel_pmc_core.h
+@@ -39,7 +39,7 @@
+ #define SPT_PMC_SLP_S0_RES_COUNTER_STEP 0x64
+ #define PMC_BASE_ADDR_MASK ~(SPT_PMC_MMIO_REG_LEN - 1)
+ #define MTPMC_MASK 0xffff0000
+-#define PPFEAR_MAX_NUM_ENTRIES 5
++#define PPFEAR_MAX_NUM_ENTRIES 12
+ #define SPT_PPFEAR_NUM_ENTRIES 5
+ #define SPT_PMC_READ_DISABLE_BIT 0x16
+ #define SPT_PMC_MSG_FULL_STS_BIT 0x18
+diff --git a/drivers/regulator/act8865-regulator.c b/drivers/regulator/act8865-regulator.c
+index 21e20483bd91..e0239cf3f56d 100644
+--- a/drivers/regulator/act8865-regulator.c
++++ b/drivers/regulator/act8865-regulator.c
+@@ -131,7 +131,7 @@
+ * ACT8865 voltage number
+ */
+ #define ACT8865_VOLTAGE_NUM 64
+-#define ACT8600_SUDCDC_VOLTAGE_NUM 255
++#define ACT8600_SUDCDC_VOLTAGE_NUM 256
+
+ struct act8865 {
+ struct regmap *regmap;
+@@ -222,7 +222,8 @@ static const struct regulator_linear_range act8600_sudcdc_voltage_ranges[] = {
+ REGULATOR_LINEAR_RANGE(3000000, 0, 63, 0),
+ REGULATOR_LINEAR_RANGE(3000000, 64, 159, 100000),
+ REGULATOR_LINEAR_RANGE(12600000, 160, 191, 200000),
+- REGULATOR_LINEAR_RANGE(19000000, 191, 255, 400000),
++ REGULATOR_LINEAR_RANGE(19000000, 192, 247, 400000),
++ REGULATOR_LINEAR_RANGE(41400000, 248, 255, 0),
+ };
+
+ static struct regulator_ops act8865_ops = {
+diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
+index 8684bcec8ff4..00cc96341411 100644
+--- a/drivers/s390/net/ism_drv.c
++++ b/drivers/s390/net/ism_drv.c
+@@ -141,10 +141,13 @@ static int register_ieq(struct ism_dev *ism)
+
+ static int unregister_sba(struct ism_dev *ism)
+ {
++ int ret;
++
+ if (!ism->sba)
+ return 0;
+
+- if (ism_cmd_simple(ism, ISM_UNREG_SBA))
++ ret = ism_cmd_simple(ism, ISM_UNREG_SBA);
++ if (ret && ret != ISM_ERROR)
+ return -EIO;
+
+ dma_free_coherent(&ism->pdev->dev, PAGE_SIZE,
+@@ -158,10 +161,13 @@ static int unregister_sba(struct ism_dev *ism)
+
+ static int unregister_ieq(struct ism_dev *ism)
+ {
++ int ret;
++
+ if (!ism->ieq)
+ return 0;
+
+- if (ism_cmd_simple(ism, ISM_UNREG_IEQ))
++ ret = ism_cmd_simple(ism, ISM_UNREG_IEQ);
++ if (ret && ret != ISM_ERROR)
+ return -EIO;
+
+ dma_free_coherent(&ism->pdev->dev, PAGE_SIZE,
+@@ -288,7 +294,7 @@ static int ism_unregister_dmb(struct smcd_dev *smcd, struct smcd_dmb *dmb)
+ cmd.request.dmb_tok = dmb->dmb_tok;
+
+ ret = ism_cmd(ism, &cmd);
+- if (ret)
++ if (ret && ret != ISM_ERROR)
+ goto out;
+
+ ism_free_dmb(ism, dmb);
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+index 3f97ec4aac4b..780651c4fc0c 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+@@ -1445,7 +1445,7 @@ bind_err:
+ static struct bnx2fc_interface *
+ bnx2fc_interface_create(struct bnx2fc_hba *hba,
+ struct net_device *netdev,
+- enum fip_state fip_mode)
++ enum fip_mode fip_mode)
+ {
+ struct fcoe_ctlr_device *ctlr_dev;
+ struct bnx2fc_interface *interface;
+diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
+index f46b312d04bc..6768b2e8148a 100644
+--- a/drivers/scsi/fcoe/fcoe.c
++++ b/drivers/scsi/fcoe/fcoe.c
+@@ -390,7 +390,7 @@ static int fcoe_interface_setup(struct fcoe_interface *fcoe,
+ * Returns: pointer to a struct fcoe_interface or NULL on error
+ */
+ static struct fcoe_interface *fcoe_interface_create(struct net_device *netdev,
+- enum fip_state fip_mode)
++ enum fip_mode fip_mode)
+ {
+ struct fcoe_ctlr_device *ctlr_dev;
+ struct fcoe_ctlr *ctlr;
+diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
+index 54da3166da8d..7dc4ffa24430 100644
+--- a/drivers/scsi/fcoe/fcoe_ctlr.c
++++ b/drivers/scsi/fcoe/fcoe_ctlr.c
+@@ -147,7 +147,7 @@ static void fcoe_ctlr_map_dest(struct fcoe_ctlr *fip)
+ * fcoe_ctlr_init() - Initialize the FCoE Controller instance
+ * @fip: The FCoE controller to initialize
+ */
+-void fcoe_ctlr_init(struct fcoe_ctlr *fip, enum fip_state mode)
++void fcoe_ctlr_init(struct fcoe_ctlr *fip, enum fip_mode mode)
+ {
+ fcoe_ctlr_set_state(fip, FIP_ST_LINK_WAIT);
+ fip->mode = mode;
+@@ -454,7 +454,10 @@ void fcoe_ctlr_link_up(struct fcoe_ctlr *fip)
+ mutex_unlock(&fip->ctlr_mutex);
+ fc_linkup(fip->lp);
+ } else if (fip->state == FIP_ST_LINK_WAIT) {
+- fcoe_ctlr_set_state(fip, fip->mode);
++ if (fip->mode == FIP_MODE_NON_FIP)
++ fcoe_ctlr_set_state(fip, FIP_ST_NON_FIP);
++ else
++ fcoe_ctlr_set_state(fip, FIP_ST_AUTO);
+ switch (fip->mode) {
+ default:
+ LIBFCOE_FIP_DBG(fip, "invalid mode %d\n", fip->mode);
+diff --git a/drivers/scsi/fcoe/fcoe_transport.c b/drivers/scsi/fcoe/fcoe_transport.c
+index f4909cd206d3..f15d5e1d56b1 100644
+--- a/drivers/scsi/fcoe/fcoe_transport.c
++++ b/drivers/scsi/fcoe/fcoe_transport.c
+@@ -873,7 +873,7 @@ static int fcoe_transport_create(const char *buffer,
+ int rc = -ENODEV;
+ struct net_device *netdev = NULL;
+ struct fcoe_transport *ft = NULL;
+- enum fip_state fip_mode = (enum fip_state)(long)kp->arg;
++ enum fip_mode fip_mode = (enum fip_mode)kp->arg;
+
+ mutex_lock(&ft_mutex);
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
+index a4e2e6aa9a6b..fd9d82c9033d 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -10,6 +10,7 @@
+ */
+
+ #include "hisi_sas.h"
++#include "../libsas/sas_internal.h"
+ #define DRV_NAME "hisi_sas"
+
+ #define DEV_IS_GONE(dev) \
+@@ -809,7 +810,8 @@ static void hisi_sas_do_release_task(struct hisi_hba *hisi_hba, struct sas_task
+ spin_lock_irqsave(&task->task_state_lock, flags);
+ task->task_state_flags &=
+ ~(SAS_TASK_STATE_PENDING | SAS_TASK_AT_INITIATOR);
+- task->task_state_flags |= SAS_TASK_STATE_DONE;
++ if (!slot->is_internal && task->task_proto != SAS_PROTOCOL_SMP)
++ task->task_state_flags |= SAS_TASK_STATE_DONE;
+ spin_unlock_irqrestore(&task->task_state_lock, flags);
+ }
+
+@@ -1879,9 +1881,18 @@ static int hisi_sas_write_gpio(struct sas_ha_struct *sha, u8 reg_type,
+
+ static void hisi_sas_phy_disconnected(struct hisi_sas_phy *phy)
+ {
++ struct asd_sas_phy *sas_phy = &phy->sas_phy;
++ struct sas_phy *sphy = sas_phy->phy;
++ struct sas_phy_data *d = sphy->hostdata;
++
+ phy->phy_attached = 0;
+ phy->phy_type = 0;
+ phy->port = NULL;
++
++ if (d->enable)
++ sphy->negotiated_linkrate = SAS_LINK_RATE_UNKNOWN;
++ else
++ sphy->negotiated_linkrate = SAS_PHY_DISABLED;
+ }
+
+ void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy)
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index f6de7526ded5..acb503ea8f0c 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -4155,6 +4155,7 @@ int megasas_alloc_cmds(struct megasas_instance *instance)
+ if (megasas_create_frame_pool(instance)) {
+ dev_printk(KERN_DEBUG, &instance->pdev->dev, "Error creating frame DMA pool\n");
+ megasas_free_cmds(instance);
++ return -ENOMEM;
+ }
+
+ return 0;
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index 0a5dd5595dd3..cd61905ca2f5 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -1418,7 +1418,7 @@ static struct libfc_function_template qedf_lport_template = {
+
+ static void qedf_fcoe_ctlr_setup(struct qedf_ctx *qedf)
+ {
+- fcoe_ctlr_init(&qedf->ctlr, FIP_ST_AUTO);
++ fcoe_ctlr_init(&qedf->ctlr, FIP_MODE_AUTO);
+
+ qedf->ctlr.send = qedf_fip_send;
+ qedf->ctlr.get_src_addr = qedf_get_src_mac;
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 78ca63dfba4a..9a7e3a3bd5ce 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -220,7 +220,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
+ struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
+
+ sdev = kzalloc(sizeof(*sdev) + shost->transportt->device_size,
+- GFP_ATOMIC);
++ GFP_KERNEL);
+ if (!sdev)
+ goto out;
+
+@@ -796,7 +796,7 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
+ */
+ sdev->inquiry = kmemdup(inq_result,
+ max_t(size_t, sdev->inquiry_len, 36),
+- GFP_ATOMIC);
++ GFP_KERNEL);
+ if (sdev->inquiry == NULL)
+ return SCSI_SCAN_NO_RESPONSE;
+
+@@ -1087,7 +1087,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
+ if (!sdev)
+ goto out;
+
+- result = kmalloc(result_len, GFP_ATOMIC |
++ result = kmalloc(result_len, GFP_KERNEL |
+ ((shost->unchecked_isa_dma) ? __GFP_DMA : 0));
+ if (!result)
+ goto out_free_sdev;
+diff --git a/drivers/soc/qcom/qcom_gsbi.c b/drivers/soc/qcom/qcom_gsbi.c
+index 09c669e70d63..038abc377fdb 100644
+--- a/drivers/soc/qcom/qcom_gsbi.c
++++ b/drivers/soc/qcom/qcom_gsbi.c
+@@ -138,7 +138,7 @@ static int gsbi_probe(struct platform_device *pdev)
+ struct resource *res;
+ void __iomem *base;
+ struct gsbi_info *gsbi;
+- int i;
++ int i, ret;
+ u32 mask, gsbi_num;
+ const struct crci_config *config = NULL;
+
+@@ -221,7 +221,10 @@ static int gsbi_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, gsbi);
+
+- return of_platform_populate(node, NULL, NULL, &pdev->dev);
++ ret = of_platform_populate(node, NULL, NULL, &pdev->dev);
++ if (ret)
++ clk_disable_unprepare(gsbi->hclk);
++ return ret;
+ }
+
+ static int gsbi_remove(struct platform_device *pdev)
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c b/drivers/soc/tegra/fuse/fuse-tegra.c
+index a33ee8ef8b6b..51625703399e 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra.c
+@@ -137,13 +137,17 @@ static int tegra_fuse_probe(struct platform_device *pdev)
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ fuse->phys = res->start;
+ fuse->base = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(fuse->base))
+- return PTR_ERR(fuse->base);
++ if (IS_ERR(fuse->base)) {
++ err = PTR_ERR(fuse->base);
++ fuse->base = base;
++ return err;
++ }
+
+ fuse->clk = devm_clk_get(&pdev->dev, "fuse");
+ if (IS_ERR(fuse->clk)) {
+ dev_err(&pdev->dev, "failed to get FUSE clock: %ld",
+ PTR_ERR(fuse->clk));
++ fuse->base = base;
+ return PTR_ERR(fuse->clk);
+ }
+
+@@ -152,8 +156,10 @@ static int tegra_fuse_probe(struct platform_device *pdev)
+
+ if (fuse->soc->probe) {
+ err = fuse->soc->probe(fuse);
+- if (err < 0)
++ if (err < 0) {
++ fuse->base = base;
+ return err;
++ }
+ }
+
+ if (tegra_fuse_create_sysfs(&pdev->dev, fuse->soc->info->size,
+diff --git a/drivers/staging/mt7621-spi/spi-mt7621.c b/drivers/staging/mt7621-spi/spi-mt7621.c
+index d045b5568e0f..578aa6824ad3 100644
+--- a/drivers/staging/mt7621-spi/spi-mt7621.c
++++ b/drivers/staging/mt7621-spi/spi-mt7621.c
+@@ -429,6 +429,7 @@ static int mt7621_spi_probe(struct platform_device *pdev)
+ int status = 0;
+ struct clk *clk;
+ struct mt7621_spi_ops *ops;
++ int ret;
+
+ match = of_match_device(mt7621_spi_match, &pdev->dev);
+ if (!match)
+@@ -476,7 +477,11 @@ static int mt7621_spi_probe(struct platform_device *pdev)
+ rs->pending_write = 0;
+ dev_info(&pdev->dev, "sys_freq: %u\n", rs->sys_freq);
+
+- device_reset(&pdev->dev);
++ ret = device_reset(&pdev->dev);
++ if (ret) {
++ dev_err(&pdev->dev, "SPI reset failed!\n");
++ return ret;
++ }
+
+ mt7621_spi_reset(rs, 0);
+
+diff --git a/drivers/tty/serial/8250/8250_pxa.c b/drivers/tty/serial/8250/8250_pxa.c
+index b9bcbe20a2be..c47188860e32 100644
+--- a/drivers/tty/serial/8250/8250_pxa.c
++++ b/drivers/tty/serial/8250/8250_pxa.c
+@@ -113,6 +113,10 @@ static int serial_pxa_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
++ ret = of_alias_get_id(pdev->dev.of_node, "serial");
++ if (ret >= 0)
++ uart.port.line = ret;
++
+ uart.port.type = PORT_XSCALE;
+ uart.port.iotype = UPIO_MEM32;
+ uart.port.mapbase = mmres->start;
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index bfdd5ad4116f..1cb80fe5f95c 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -163,6 +163,8 @@ struct atmel_uart_port {
+ unsigned int pending_status;
+ spinlock_t lock_suspended;
+
++ bool hd_start_rx; /* can start RX during half-duplex operation */
++
+ #ifdef CONFIG_PM
+ struct {
+ u32 cr;
+@@ -225,6 +227,12 @@ static inline void atmel_uart_write_char(struct uart_port *port, u8 value)
+ __raw_writeb(value, port->membase + ATMEL_US_THR);
+ }
+
++static inline int atmel_uart_is_half_duplex(struct uart_port *port)
++{
++ return (port->rs485.flags & SER_RS485_ENABLED) &&
++ !(port->rs485.flags & SER_RS485_RX_DURING_TX);
++}
++
+ #ifdef CONFIG_SERIAL_ATMEL_PDC
+ static bool atmel_use_pdc_rx(struct uart_port *port)
+ {
+@@ -481,9 +489,9 @@ static void atmel_stop_tx(struct uart_port *port)
+ /* Disable interrupts */
+ atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask);
+
+- if ((port->rs485.flags & SER_RS485_ENABLED) &&
+- !(port->rs485.flags & SER_RS485_RX_DURING_TX))
++ if (atmel_uart_is_half_duplex(port))
+ atmel_start_rx(port);
++
+ }
+
+ /*
+@@ -500,8 +508,7 @@ static void atmel_start_tx(struct uart_port *port)
+ return;
+
+ if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port))
+- if ((port->rs485.flags & SER_RS485_ENABLED) &&
+- !(port->rs485.flags & SER_RS485_RX_DURING_TX))
++ if (atmel_uart_is_half_duplex(port))
+ atmel_stop_rx(port);
+
+ if (atmel_use_pdc_tx(port))
+@@ -799,10 +806,14 @@ static void atmel_complete_tx_dma(void *arg)
+ */
+ if (!uart_circ_empty(xmit))
+ atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
+- else if ((port->rs485.flags & SER_RS485_ENABLED) &&
+- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) {
+- /* DMA done, stop TX, start RX for RS485 */
+- atmel_start_rx(port);
++ else if (atmel_uart_is_half_duplex(port)) {
++ /*
++ * DMA done, re-enable TXEMPTY and signal that we can stop
++ * TX and start RX for RS485
++ */
++ atmel_port->hd_start_rx = true;
++ atmel_uart_writel(port, ATMEL_US_IER,
++ atmel_port->tx_done_mask);
+ }
+
+ spin_unlock_irqrestore(&port->lock, flags);
+@@ -1248,9 +1259,20 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending)
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+
+ if (pending & atmel_port->tx_done_mask) {
+- /* Either PDC or interrupt transmission */
+ atmel_uart_writel(port, ATMEL_US_IDR,
+ atmel_port->tx_done_mask);
++
++ /* Start RX if flag was set and FIFO is empty */
++ if (atmel_port->hd_start_rx) {
++ if (!(atmel_uart_readl(port, ATMEL_US_CSR)
++ & ATMEL_US_TXEMPTY))
++ dev_warn(port->dev, "Should start RX, but TX fifo is not empty\n");
++
++ atmel_port->hd_start_rx = false;
++ atmel_start_rx(port);
++ return;
++ }
++
+ atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
+ }
+ }
+@@ -1377,8 +1399,7 @@ static void atmel_tx_pdc(struct uart_port *port)
+ atmel_uart_writel(port, ATMEL_US_IER,
+ atmel_port->tx_done_mask);
+ } else {
+- if ((port->rs485.flags & SER_RS485_ENABLED) &&
+- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) {
++ if (atmel_uart_is_half_duplex(port)) {
+ /* DMA done, stop TX, start RX for RS485 */
+ atmel_start_rx(port);
+ }
+diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
+index ae3ce330200e..ee3aa57bc0e7 100644
+--- a/drivers/tty/tty_buffer.c
++++ b/drivers/tty/tty_buffer.c
+@@ -26,7 +26,7 @@
+ * Byte threshold to limit memory consumption for flip buffers.
+ * The actual memory limit is > 2x this amount.
+ */
+-#define TTYB_DEFAULT_MEM_LIMIT 65536
++#define TTYB_DEFAULT_MEM_LIMIT (640 * 1024UL)
+
+ /*
+ * We default to dicing tty buffer allocations to this many characters
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index 85fc6db48e44..159b897c5e80 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -935,8 +935,15 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+ } else if (ci->platdata->usb_phy) {
+ ci->usb_phy = ci->platdata->usb_phy;
+ } else {
++ ci->usb_phy = devm_usb_get_phy_by_phandle(dev->parent, "phys",
++ 0);
+ ci->phy = devm_phy_get(dev->parent, "usb-phy");
+- ci->usb_phy = devm_usb_get_phy(dev->parent, USB_PHY_TYPE_USB2);
++
++ /* Fallback to grabbing any registered USB2 PHY */
++ if (IS_ERR(ci->usb_phy) &&
++ PTR_ERR(ci->usb_phy) != -EPROBE_DEFER)
++ ci->usb_phy = devm_usb_get_phy(dev->parent,
++ USB_PHY_TYPE_USB2);
+
+ /* if both generic PHY and USB PHY layers aren't enabled */
+ if (PTR_ERR(ci->phy) == -ENOSYS &&
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 700fb626ad03..524104eed8a7 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3233,6 +3233,8 @@ int dwc3_gadget_init(struct dwc3 *dwc)
+ goto err4;
+ }
+
++ dwc3_gadget_set_speed(&dwc->gadget, dwc->maximum_speed);
++
+ return 0;
+
+ err4:
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 31e8bf3578c8..aa15593a3ac4 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1008,6 +1008,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
+ * condition with req->complete callback.
+ */
+ usb_ep_dequeue(ep->ep, req);
++ wait_for_completion(&done);
+ interrupted = ep->status < 0;
+ }
+
+diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
+index 6bde543452f2..7ddc0930e98c 100644
+--- a/drivers/video/backlight/pwm_bl.c
++++ b/drivers/video/backlight/pwm_bl.c
+@@ -425,7 +425,7 @@ static int pwm_backlight_initial_power_state(const struct pwm_bl_data *pb)
+ */
+
+ /* if the enable GPIO is disabled, do not enable the backlight */
+- if (pb->enable_gpio && gpiod_get_value(pb->enable_gpio) == 0)
++ if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0)
+ return FB_BLANK_POWERDOWN;
+
+ /* The regulator is disabled, do not enable the backlight */
+diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
+index 77cee99fc36c..c48f083d522a 100644
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -427,6 +427,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
+ {
+ unsigned int x;
+
++ if (image->width > info->var.xres || image->height > info->var.yres)
++ return;
++
+ if (rotate == FB_ROTATE_UR) {
+ for (x = 0;
+ x < num && image->dx + image->width <= info->var.xres;
+diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c
+index cba6b586bfbd..d97fcfc5e558 100644
+--- a/drivers/xen/gntdev-dmabuf.c
++++ b/drivers/xen/gntdev-dmabuf.c
+@@ -80,6 +80,12 @@ struct gntdev_dmabuf_priv {
+ struct list_head imp_list;
+ /* This is the lock which protects dma_buf_xxx lists. */
+ struct mutex lock;
++ /*
++ * We reference this file while exporting dma-bufs, so
++ * the grant device context is not destroyed while there are
++ * external users alive.
++ */
++ struct file *filp;
+ };
+
+ /* DMA buffer export support. */
+@@ -311,6 +317,7 @@ static void dmabuf_exp_release(struct kref *kref)
+
+ dmabuf_exp_wait_obj_signal(gntdev_dmabuf->priv, gntdev_dmabuf);
+ list_del(&gntdev_dmabuf->next);
++ fput(gntdev_dmabuf->priv->filp);
+ kfree(gntdev_dmabuf);
+ }
+
+@@ -423,6 +430,7 @@ static int dmabuf_exp_from_pages(struct gntdev_dmabuf_export_args *args)
+ mutex_lock(&args->dmabuf_priv->lock);
+ list_add(&gntdev_dmabuf->next, &args->dmabuf_priv->exp_list);
+ mutex_unlock(&args->dmabuf_priv->lock);
++ get_file(gntdev_dmabuf->priv->filp);
+ return 0;
+
+ fail:
+@@ -834,7 +842,7 @@ long gntdev_ioctl_dmabuf_imp_release(struct gntdev_priv *priv,
+ return dmabuf_imp_release(priv->dmabuf_priv, op.fd);
+ }
+
+-struct gntdev_dmabuf_priv *gntdev_dmabuf_init(void)
++struct gntdev_dmabuf_priv *gntdev_dmabuf_init(struct file *filp)
+ {
+ struct gntdev_dmabuf_priv *priv;
+
+@@ -847,6 +855,8 @@ struct gntdev_dmabuf_priv *gntdev_dmabuf_init(void)
+ INIT_LIST_HEAD(&priv->exp_wait_list);
+ INIT_LIST_HEAD(&priv->imp_list);
+
++ priv->filp = filp;
++
+ return priv;
+ }
+
+diff --git a/drivers/xen/gntdev-dmabuf.h b/drivers/xen/gntdev-dmabuf.h
+index 7220a53d0fc5..3d9b9cf9d5a1 100644
+--- a/drivers/xen/gntdev-dmabuf.h
++++ b/drivers/xen/gntdev-dmabuf.h
+@@ -14,7 +14,7 @@
+ struct gntdev_dmabuf_priv;
+ struct gntdev_priv;
+
+-struct gntdev_dmabuf_priv *gntdev_dmabuf_init(void);
++struct gntdev_dmabuf_priv *gntdev_dmabuf_init(struct file *filp);
+
+ void gntdev_dmabuf_fini(struct gntdev_dmabuf_priv *priv);
+
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index b0b02a501167..9d8e02cfd480 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -600,7 +600,7 @@ static int gntdev_open(struct inode *inode, struct file *flip)
+ mutex_init(&priv->lock);
+
+ #ifdef CONFIG_XEN_GNTDEV_DMABUF
+- priv->dmabuf_priv = gntdev_dmabuf_init();
++ priv->dmabuf_priv = gntdev_dmabuf_init(flip);
+ if (IS_ERR(priv->dmabuf_priv)) {
+ ret = PTR_ERR(priv->dmabuf_priv);
+ kfree(priv);
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index e1fcb28ad4cc..e46e83e87600 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2427,16 +2427,15 @@ out:
+ /*
+ * Two limits to commit transaction in advance.
+ *
+- * For RATIO, it will be 1/RATIO of the remaining limit
+- * (excluding data and prealloc meta) as threshold.
++ * For RATIO, it will be 1/RATIO of the remaining limit as threshold.
+ * For SIZE, it will be in byte unit as threshold.
+ */
+-#define QGROUP_PERTRANS_RATIO 32
+-#define QGROUP_PERTRANS_SIZE SZ_32M
++#define QGROUP_FREE_RATIO 32
++#define QGROUP_FREE_SIZE SZ_32M
+ static bool qgroup_check_limits(struct btrfs_fs_info *fs_info,
+ const struct btrfs_qgroup *qg, u64 num_bytes)
+ {
+- u64 limit;
++ u64 free;
+ u64 threshold;
+
+ if ((qg->lim_flags & BTRFS_QGROUP_LIMIT_MAX_RFER) &&
+@@ -2455,20 +2454,21 @@ static bool qgroup_check_limits(struct btrfs_fs_info *fs_info,
+ */
+ if ((qg->lim_flags & (BTRFS_QGROUP_LIMIT_MAX_RFER |
+ BTRFS_QGROUP_LIMIT_MAX_EXCL))) {
+- if (qg->lim_flags & BTRFS_QGROUP_LIMIT_MAX_EXCL)
+- limit = qg->max_excl;
+- else
+- limit = qg->max_rfer;
+- threshold = (limit - qg->rsv.values[BTRFS_QGROUP_RSV_DATA] -
+- qg->rsv.values[BTRFS_QGROUP_RSV_META_PREALLOC]) /
+- QGROUP_PERTRANS_RATIO;
+- threshold = min_t(u64, threshold, QGROUP_PERTRANS_SIZE);
++ if (qg->lim_flags & BTRFS_QGROUP_LIMIT_MAX_EXCL) {
++ free = qg->max_excl - qgroup_rsv_total(qg) - qg->excl;
++ threshold = min_t(u64, qg->max_excl / QGROUP_FREE_RATIO,
++ QGROUP_FREE_SIZE);
++ } else {
++ free = qg->max_rfer - qgroup_rsv_total(qg) - qg->rfer;
++ threshold = min_t(u64, qg->max_rfer / QGROUP_FREE_RATIO,
++ QGROUP_FREE_SIZE);
++ }
+
+ /*
+ * Use transaction_kthread to commit transaction, so we no
+ * longer need to bother nested transaction nor lock context.
+ */
+- if (qg->rsv.values[BTRFS_QGROUP_RSV_META_PERTRANS] > threshold)
++ if (free < threshold)
+ btrfs_commit_transaction_locksafe(fs_info);
+ }
+
+diff --git a/fs/buffer.c b/fs/buffer.c
+index c083c4b3c1e7..a550e0d8e965 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -3027,6 +3027,13 @@ void guard_bio_eod(int op, struct bio *bio)
+ /* Uhhuh. We've got a bio that straddles the device size! */
+ truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9);
+
++ /*
++ * The bio contains more than one segment which spans EOD, just return
++ * and let IO layer turn it into an EIO
++ */
++ if (truncated_bytes > bvec->bv_len)
++ return;
++
+ /* Truncate the bio.. */
+ bio->bi_iter.bi_size -= truncated_bytes;
+ bvec->bv_len -= truncated_bytes;
+diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
+index 6b61df117fd4..563e2f6268c3 100644
+--- a/fs/cifs/cifs_dfs_ref.c
++++ b/fs/cifs/cifs_dfs_ref.c
+@@ -271,9 +271,9 @@ static void dump_referral(const struct dfs_info3_param *ref)
+ {
+ cifs_dbg(FYI, "DFS: ref path: %s\n", ref->path_name);
+ cifs_dbg(FYI, "DFS: node path: %s\n", ref->node_name);
+- cifs_dbg(FYI, "DFS: fl: %hd, srv_type: %hd\n",
++ cifs_dbg(FYI, "DFS: fl: %d, srv_type: %d\n",
+ ref->flags, ref->server_type);
+- cifs_dbg(FYI, "DFS: ref_flags: %hd, path_consumed: %hd\n",
++ cifs_dbg(FYI, "DFS: ref_flags: %d, path_consumed: %d\n",
+ ref->ref_flag, ref->path_consumed);
+ }
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index a5ea742654aa..f31339db45fd 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -1347,6 +1347,11 @@ cifs_parse_devname(const char *devname, struct smb_vol *vol)
+ const char *delims = "/\\";
+ size_t len;
+
++ if (unlikely(!devname || !*devname)) {
++ cifs_dbg(VFS, "Device name not specified.\n");
++ return -EINVAL;
++ }
++
+ /* make sure we have a valid UNC double delimiter prefix */
+ len = strspn(devname, delims);
+ if (len != 2)
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 08761a6a039d..d847132ab027 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -1631,8 +1631,20 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type,
+ rc = server->ops->mand_unlock_range(cfile, flock, xid);
+
+ out:
+- if (flock->fl_flags & FL_POSIX && !rc)
++ if (flock->fl_flags & FL_POSIX) {
++ /*
++ * If this is a request to remove all locks because we
++ * are closing the file, it doesn't matter if the
++ * unlocking failed as both cifs.ko and the SMB server
++ * remove the lock on file close
++ */
++ if (rc) {
++ cifs_dbg(VFS, "%s failed rc=%d\n", __func__, rc);
++ if (!(flock->fl_flags & FL_CLOSE))
++ return rc;
++ }
+ rc = locks_lock_file_wait(file, flock);
++ }
+ return rc;
+ }
+
+diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
+index 378151e09e91..47db8eb6cbcf 100644
+--- a/fs/cifs/smb1ops.c
++++ b/fs/cifs/smb1ops.c
+@@ -308,7 +308,7 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr)
+ remaining = tgt_total_cnt - total_in_tgt;
+
+ if (remaining < 0) {
+- cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%hu\n",
++ cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu total_in_tgt=%u\n",
+ tgt_total_cnt, total_in_tgt);
+ return -EPROTO;
+ }
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 3d0db37d64ad..71f32d983384 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -881,8 +881,14 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
+ rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
+ FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
+ (char *)pneg_inbuf, inbuflen, (char **)&pneg_rsp, &rsplen);
+-
+- if (rc != 0) {
++ if (rc == -EOPNOTSUPP) {
++ /*
++ * Old Windows versions or Netapp SMB server can return
++ * not supported error. Client should accept it.
++ */
++ cifs_dbg(VFS, "Server does not support validate negotiate\n");
++ return 0;
++ } else if (rc != 0) {
+ cifs_dbg(VFS, "validate protocol negotiate failed: %d\n", rc);
+ rc = -EIO;
+ goto out_free_inbuf;
+diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
+index 9e96a0bd08d9..e1801b288847 100644
+--- a/fs/ext4/indirect.c
++++ b/fs/ext4/indirect.c
+@@ -1219,6 +1219,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode,
+ ext4_lblk_t offsets[4], offsets2[4];
+ Indirect chain[4], chain2[4];
+ Indirect *partial, *partial2;
++ Indirect *p = NULL, *p2 = NULL;
+ ext4_lblk_t max_block;
+ __le32 nr = 0, nr2 = 0;
+ int n = 0, n2 = 0;
+@@ -1260,7 +1261,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode,
+ }
+
+
+- partial = ext4_find_shared(inode, n, offsets, chain, &nr);
++ partial = p = ext4_find_shared(inode, n, offsets, chain, &nr);
+ if (nr) {
+ if (partial == chain) {
+ /* Shared branch grows from the inode */
+@@ -1285,13 +1286,11 @@ int ext4_ind_remove_space(handle_t *handle, struct inode *inode,
+ partial->p + 1,
+ (__le32 *)partial->bh->b_data+addr_per_block,
+ (chain+n-1) - partial);
+- BUFFER_TRACE(partial->bh, "call brelse");
+- brelse(partial->bh);
+ partial--;
+ }
+
+ end_range:
+- partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
++ partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
+ if (nr2) {
+ if (partial2 == chain2) {
+ /*
+@@ -1321,16 +1320,14 @@ end_range:
+ (__le32 *)partial2->bh->b_data,
+ partial2->p,
+ (chain2+n2-1) - partial2);
+- BUFFER_TRACE(partial2->bh, "call brelse");
+- brelse(partial2->bh);
+ partial2--;
+ }
+ goto do_indirects;
+ }
+
+ /* Punch happened within the same level (n == n2) */
+- partial = ext4_find_shared(inode, n, offsets, chain, &nr);
+- partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
++ partial = p = ext4_find_shared(inode, n, offsets, chain, &nr);
++ partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
+
+ /* Free top, but only if partial2 isn't its subtree. */
+ if (nr) {
+@@ -1387,15 +1384,7 @@ end_range:
+ partial->p + 1,
+ partial2->p,
+ (chain+n-1) - partial);
+- while (partial > chain) {
+- BUFFER_TRACE(partial->bh, "call brelse");
+- brelse(partial->bh);
+- }
+- while (partial2 > chain2) {
+- BUFFER_TRACE(partial2->bh, "call brelse");
+- brelse(partial2->bh);
+- }
+- return 0;
++ goto cleanup;
+ }
+
+ /*
+@@ -1410,8 +1399,6 @@ end_range:
+ partial->p + 1,
+ (__le32 *)partial->bh->b_data+addr_per_block,
+ (chain+n-1) - partial);
+- BUFFER_TRACE(partial->bh, "call brelse");
+- brelse(partial->bh);
+ partial--;
+ }
+ if (partial2 > chain2 && depth2 <= depth) {
+@@ -1419,11 +1406,21 @@ end_range:
+ (__le32 *)partial2->bh->b_data,
+ partial2->p,
+ (chain2+n2-1) - partial2);
+- BUFFER_TRACE(partial2->bh, "call brelse");
+- brelse(partial2->bh);
+ partial2--;
+ }
+ }
++
++cleanup:
++ while (p && p > chain) {
++ BUFFER_TRACE(p->bh, "call brelse");
++ brelse(p->bh);
++ p--;
++ }
++ while (p2 && p2 > chain2) {
++ BUFFER_TRACE(p2->bh, "call brelse");
++ brelse(p2->bh);
++ p2--;
++ }
+ return 0;
+
+ do_indirects:
+@@ -1431,7 +1428,7 @@ do_indirects:
+ switch (offsets[0]) {
+ default:
+ if (++n >= n2)
+- return 0;
++ break;
+ nr = i_data[EXT4_IND_BLOCK];
+ if (nr) {
+ ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 1);
+@@ -1439,7 +1436,7 @@ do_indirects:
+ }
+ case EXT4_IND_BLOCK:
+ if (++n >= n2)
+- return 0;
++ break;
+ nr = i_data[EXT4_DIND_BLOCK];
+ if (nr) {
+ ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 2);
+@@ -1447,7 +1444,7 @@ do_indirects:
+ }
+ case EXT4_DIND_BLOCK:
+ if (++n >= n2)
+- return 0;
++ break;
+ nr = i_data[EXT4_TIND_BLOCK];
+ if (nr) {
+ ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 3);
+@@ -1456,5 +1453,5 @@ do_indirects:
+ case EXT4_TIND_BLOCK:
+ ;
+ }
+- return 0;
++ goto cleanup;
+ }
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 42aef5c94927..a3ba20e5946f 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -450,7 +450,6 @@ struct f2fs_flush_device {
+
+ /* for inline stuff */
+ #define DEF_INLINE_RESERVED_SIZE 1
+-#define DEF_MIN_INLINE_SIZE 1
+ static inline int get_extra_isize(struct inode *inode);
+ static inline int get_inline_xattr_addrs(struct inode *inode);
+ #define MAX_INLINE_DATA(inode) (sizeof(__le32) * \
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index 115dc219344b..92703efde36e 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -661,6 +661,12 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx,
+ if (IS_ERR(ipage))
+ return PTR_ERR(ipage);
+
++ /*
++ * f2fs_readdir was protected by inode.i_rwsem, it is safe to access
++ * ipage without page's lock held.
++ */
++ unlock_page(ipage);
++
+ inline_dentry = inline_data_addr(inode, ipage);
+
+ make_dentry_ptr_inline(inode, &d, inline_dentry);
+@@ -669,7 +675,7 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx,
+ if (!err)
+ ctx->pos = d.max;
+
+- f2fs_put_page(ipage, 1);
++ f2fs_put_page(ipage, 0);
+ return err < 0 ? err : 0;
+ }
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index c9639ef0e8d5..79370b7fa9d2 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -822,12 +822,13 @@ static int parse_options(struct super_block *sb, char *options)
+ "set with inline_xattr option");
+ return -EINVAL;
+ }
+- if (!F2FS_OPTION(sbi).inline_xattr_size ||
+- F2FS_OPTION(sbi).inline_xattr_size >=
+- DEF_ADDRS_PER_INODE -
+- F2FS_TOTAL_EXTRA_ATTR_SIZE -
+- DEF_INLINE_RESERVED_SIZE -
+- DEF_MIN_INLINE_SIZE) {
++ if (F2FS_OPTION(sbi).inline_xattr_size <
++ sizeof(struct f2fs_xattr_header) / sizeof(__le32) ||
++ F2FS_OPTION(sbi).inline_xattr_size >
++ DEF_ADDRS_PER_INODE -
++ F2FS_TOTAL_EXTRA_ATTR_SIZE / sizeof(__le32) -
++ DEF_INLINE_RESERVED_SIZE -
++ MIN_INLINE_DENTRY_SIZE / sizeof(__le32)) {
+ f2fs_msg(sb, KERN_ERR,
+ "inline xattr size is out of range");
+ return -EINVAL;
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index 81c0e5337443..98887187af4c 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -273,10 +273,16 @@ out:
+ return count;
+ }
+
+- *ui = t;
+
+- if (!strcmp(a->attr.name, "iostat_enable") && *ui == 0)
+- f2fs_reset_iostat(sbi);
++ if (!strcmp(a->attr.name, "iostat_enable")) {
++ sbi->iostat_enable = !!t;
++ if (!sbi->iostat_enable)
++ f2fs_reset_iostat(sbi);
++ return count;
++ }
++
++ *ui = (unsigned int)t;
++
+ return count;
+ }
+
+diff --git a/fs/f2fs/trace.c b/fs/f2fs/trace.c
+index a1fcd00bbb2b..8ac1851a21c0 100644
+--- a/fs/f2fs/trace.c
++++ b/fs/f2fs/trace.c
+@@ -17,7 +17,7 @@
+ #include "trace.h"
+
+ static RADIX_TREE(pids, GFP_ATOMIC);
+-static struct mutex pids_lock;
++static spinlock_t pids_lock;
+ static struct last_io_info last_io;
+
+ static inline void __print_last_io(void)
+@@ -61,23 +61,29 @@ void f2fs_trace_pid(struct page *page)
+
+ set_page_private(page, (unsigned long)pid);
+
++retry:
+ if (radix_tree_preload(GFP_NOFS))
+ return;
+
+- mutex_lock(&pids_lock);
++ spin_lock(&pids_lock);
+ p = radix_tree_lookup(&pids, pid);
+ if (p == current)
+ goto out;
+ if (p)
+ radix_tree_delete(&pids, pid);
+
+- f2fs_radix_tree_insert(&pids, pid, current);
++ if (radix_tree_insert(&pids, pid, current)) {
++ spin_unlock(&pids_lock);
++ radix_tree_preload_end();
++ cond_resched();
++ goto retry;
++ }
+
+ trace_printk("%3x:%3x %4x %-16s\n",
+ MAJOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev),
+ pid, current->comm);
+ out:
+- mutex_unlock(&pids_lock);
++ spin_unlock(&pids_lock);
+ radix_tree_preload_end();
+ }
+
+@@ -122,7 +128,7 @@ void f2fs_trace_ios(struct f2fs_io_info *fio, int flush)
+
+ void f2fs_build_trace_ios(void)
+ {
+- mutex_init(&pids_lock);
++ spin_lock_init(&pids_lock);
+ }
+
+ #define PIDVEC_SIZE 128
+@@ -150,7 +156,7 @@ void f2fs_destroy_trace_ios(void)
+ pid_t next_pid = 0;
+ unsigned int found;
+
+- mutex_lock(&pids_lock);
++ spin_lock(&pids_lock);
+ while ((found = gang_lookup_pids(pid, next_pid, PIDVEC_SIZE))) {
+ unsigned idx;
+
+@@ -158,5 +164,5 @@ void f2fs_destroy_trace_ios(void)
+ for (idx = 0; idx < found; idx++)
+ radix_tree_delete(&pids, pid[idx]);
+ }
+- mutex_unlock(&pids_lock);
++ spin_unlock(&pids_lock);
+ }
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 087e53a2d96c..409a637f7a92 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -227,11 +227,11 @@ static struct f2fs_xattr_entry *__find_inline_xattr(struct inode *inode,
+ {
+ struct f2fs_xattr_entry *entry;
+ unsigned int inline_size = inline_xattr_size(inode);
++ void *max_addr = base_addr + inline_size;
+
+ list_for_each_xattr(entry, base_addr) {
+- if ((void *)entry + sizeof(__u32) > base_addr + inline_size ||
+- (void *)XATTR_NEXT_ENTRY(entry) + sizeof(__u32) >
+- base_addr + inline_size) {
++ if ((void *)entry + sizeof(__u32) > max_addr ||
++ (void *)XATTR_NEXT_ENTRY(entry) > max_addr) {
+ *last_addr = entry;
+ return NULL;
+ }
+@@ -242,6 +242,13 @@ static struct f2fs_xattr_entry *__find_inline_xattr(struct inode *inode,
+ if (!memcmp(entry->e_name, name, len))
+ break;
+ }
++
++ /* inline xattr header or entry across max inline xattr size */
++ if (IS_XATTR_LAST_ENTRY(entry) &&
++ (void *)entry + sizeof(__u32) > max_addr) {
++ *last_addr = entry;
++ return NULL;
++ }
+ return entry;
+ }
+
+diff --git a/fs/file.c b/fs/file.c
+index 7ffd6e9d103d..780d29e58847 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -457,6 +457,7 @@ struct files_struct init_files = {
+ .full_fds_bits = init_files.full_fds_bits_init,
+ },
+ .file_lock = __SPIN_LOCK_UNLOCKED(init_files.file_lock),
++ .resize_wait = __WAIT_QUEUE_HEAD_INITIALIZER(init_files.resize_wait),
+ };
+
+ static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start)
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 150cc030b4d7..65ea0355a4f6 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -691,9 +691,11 @@ void jbd2_journal_commit_transaction(journal_t *journal)
+ the last tag we set up. */
+
+ tag->t_flags |= cpu_to_be16(JBD2_FLAG_LAST_TAG);
+-
+- jbd2_descriptor_block_csum_set(journal, descriptor);
+ start_journal_io:
++ if (descriptor)
++ jbd2_descriptor_block_csum_set(journal,
++ descriptor);
++
+ for (i = 0; i < bufs; i++) {
+ struct buffer_head *bh = wbuf[i];
+ /*
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 8ef6b6daaa7a..88f2a49338a1 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1356,6 +1356,10 @@ static int journal_reset(journal_t *journal)
+ return jbd2_journal_start_thread(journal);
+ }
+
++/*
++ * This function expects that the caller will have locked the journal
++ * buffer head, and will return with it unlocked
++ */
+ static int jbd2_write_superblock(journal_t *journal, int write_flags)
+ {
+ struct buffer_head *bh = journal->j_sb_buffer;
+@@ -1365,7 +1369,6 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)
+ trace_jbd2_write_superblock(journal, write_flags);
+ if (!(journal->j_flags & JBD2_BARRIER))
+ write_flags &= ~(REQ_FUA | REQ_PREFLUSH);
+- lock_buffer(bh);
+ if (buffer_write_io_error(bh)) {
+ /*
+ * Oh, dear. A previous attempt to write the journal
+@@ -1424,6 +1427,7 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
+ jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
+ tail_block, tail_tid);
+
++ lock_buffer(journal->j_sb_buffer);
+ sb->s_sequence = cpu_to_be32(tail_tid);
+ sb->s_start = cpu_to_be32(tail_block);
+
+@@ -1454,18 +1458,17 @@ static void jbd2_mark_journal_empty(journal_t *journal, int write_op)
+ journal_superblock_t *sb = journal->j_superblock;
+
+ BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
+- read_lock(&journal->j_state_lock);
+- /* Is it already empty? */
+- if (sb->s_start == 0) {
+- read_unlock(&journal->j_state_lock);
++ lock_buffer(journal->j_sb_buffer);
++ if (sb->s_start == 0) { /* Is it already empty? */
++ unlock_buffer(journal->j_sb_buffer);
+ return;
+ }
++
+ jbd_debug(1, "JBD2: Marking journal as empty (seq %d)\n",
+ journal->j_tail_sequence);
+
+ sb->s_sequence = cpu_to_be32(journal->j_tail_sequence);
+ sb->s_start = cpu_to_be32(0);
+- read_unlock(&journal->j_state_lock);
+
+ jbd2_write_superblock(journal, write_op);
+
+@@ -1488,9 +1491,8 @@ void jbd2_journal_update_sb_errno(journal_t *journal)
+ journal_superblock_t *sb = journal->j_superblock;
+ int errcode;
+
+- read_lock(&journal->j_state_lock);
++ lock_buffer(journal->j_sb_buffer);
+ errcode = journal->j_errno;
+- read_unlock(&journal->j_state_lock);
+ if (errcode == -ESHUTDOWN)
+ errcode = 0;
+ jbd_debug(1, "JBD2: updating superblock error (errno %d)\n", errcode);
+@@ -1894,28 +1896,27 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
+
+ sb = journal->j_superblock;
+
++ /* Load the checksum driver if necessary */
++ if ((journal->j_chksum_driver == NULL) &&
++ INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V3)) {
++ journal->j_chksum_driver = crypto_alloc_shash("crc32c", 0, 0);
++ if (IS_ERR(journal->j_chksum_driver)) {
++ printk(KERN_ERR "JBD2: Cannot load crc32c driver.\n");
++ journal->j_chksum_driver = NULL;
++ return 0;
++ }
++ /* Precompute checksum seed for all metadata */
++ journal->j_csum_seed = jbd2_chksum(journal, ~0, sb->s_uuid,
++ sizeof(sb->s_uuid));
++ }
++
++ lock_buffer(journal->j_sb_buffer);
++
+ /* If enabling v3 checksums, update superblock */
+ if (INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V3)) {
+ sb->s_checksum_type = JBD2_CRC32C_CHKSUM;
+ sb->s_feature_compat &=
+ ~cpu_to_be32(JBD2_FEATURE_COMPAT_CHECKSUM);
+-
+- /* Load the checksum driver */
+- if (journal->j_chksum_driver == NULL) {
+- journal->j_chksum_driver = crypto_alloc_shash("crc32c",
+- 0, 0);
+- if (IS_ERR(journal->j_chksum_driver)) {
+- printk(KERN_ERR "JBD2: Cannot load crc32c "
+- "driver.\n");
+- journal->j_chksum_driver = NULL;
+- return 0;
+- }
+-
+- /* Precompute checksum seed for all metadata */
+- journal->j_csum_seed = jbd2_chksum(journal, ~0,
+- sb->s_uuid,
+- sizeof(sb->s_uuid));
+- }
+ }
+
+ /* If enabling v1 checksums, downgrade superblock */
+@@ -1927,6 +1928,7 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
+ sb->s_feature_compat |= cpu_to_be32(compat);
+ sb->s_feature_ro_compat |= cpu_to_be32(ro);
+ sb->s_feature_incompat |= cpu_to_be32(incompat);
++ unlock_buffer(journal->j_sb_buffer);
+
+ return 1;
+ #undef COMPAT_FEATURE_ON
+diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
+index 0e4166cc23a0..4ac775e32240 100644
+--- a/fs/ocfs2/cluster/nodemanager.c
++++ b/fs/ocfs2/cluster/nodemanager.c
+@@ -621,13 +621,15 @@ static void o2nm_node_group_drop_item(struct config_group *group,
+ struct o2nm_node *node = to_o2nm_node(item);
+ struct o2nm_cluster *cluster = to_o2nm_cluster(group->cg_item.ci_parent);
+
+- o2net_disconnect_node(node);
++ if (cluster->cl_nodes[node->nd_num] == node) {
++ o2net_disconnect_node(node);
+
+- if (cluster->cl_has_local &&
+- (cluster->cl_local_node == node->nd_num)) {
+- cluster->cl_has_local = 0;
+- cluster->cl_local_node = O2NM_INVALID_NODE_NUM;
+- o2net_stop_listening(node);
++ if (cluster->cl_has_local &&
++ (cluster->cl_local_node == node->nd_num)) {
++ cluster->cl_has_local = 0;
++ cluster->cl_local_node = O2NM_INVALID_NODE_NUM;
++ o2net_stop_listening(node);
++ }
+ }
+
+ /* XXX call into net to stop this node from trading messages */
+diff --git a/fs/read_write.c b/fs/read_write.c
+index 8a2737f0d61d..562974a0616c 100644
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -1241,6 +1241,9 @@ COMPAT_SYSCALL_DEFINE5(preadv64v2, unsigned long, fd,
+ const struct compat_iovec __user *,vec,
+ unsigned long, vlen, loff_t, pos, rwf_t, flags)
+ {
++ if (pos == -1)
++ return do_compat_readv(fd, vec, vlen, flags);
++
+ return do_compat_preadv64(fd, vec, vlen, pos, flags);
+ }
+ #endif
+@@ -1347,6 +1350,9 @@ COMPAT_SYSCALL_DEFINE5(pwritev64v2, unsigned long, fd,
+ const struct compat_iovec __user *,vec,
+ unsigned long, vlen, loff_t, pos, rwf_t, flags)
+ {
++ if (pos == -1)
++ return do_compat_writev(fd, vec, vlen, flags);
++
+ return do_compat_pwritev64(fd, vec, vlen, pos, flags);
+ }
+ #endif
+diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
+index 22254c1fe1c5..6002275937f5 100644
+--- a/include/linux/cgroup-defs.h
++++ b/include/linux/cgroup-defs.h
+@@ -597,7 +597,7 @@ struct cgroup_subsys {
+ void (*cancel_fork)(struct task_struct *task);
+ void (*fork)(struct task_struct *task);
+ void (*exit)(struct task_struct *task);
+- void (*free)(struct task_struct *task);
++ void (*release)(struct task_struct *task);
+ void (*bind)(struct cgroup_subsys_state *root_css);
+
+ bool early_init:1;
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index 32c553556bbd..ca51b2c15bcc 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -119,6 +119,7 @@ extern int cgroup_can_fork(struct task_struct *p);
+ extern void cgroup_cancel_fork(struct task_struct *p);
+ extern void cgroup_post_fork(struct task_struct *p);
+ void cgroup_exit(struct task_struct *p);
++void cgroup_release(struct task_struct *p);
+ void cgroup_free(struct task_struct *p);
+
+ int cgroup_init_early(void);
+@@ -699,6 +700,7 @@ static inline int cgroup_can_fork(struct task_struct *p) { return 0; }
+ static inline void cgroup_cancel_fork(struct task_struct *p) {}
+ static inline void cgroup_post_fork(struct task_struct *p) {}
+ static inline void cgroup_exit(struct task_struct *p) {}
++static inline void cgroup_release(struct task_struct *p) {}
+ static inline void cgroup_free(struct task_struct *p) {}
+
+ static inline int cgroup_init_early(void) { return 0; }
+diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
+index 08b1aa70a38d..d1b6d2c3ada6 100644
+--- a/include/linux/clk-provider.h
++++ b/include/linux/clk-provider.h
+@@ -782,6 +782,9 @@ unsigned int __clk_get_enable_count(struct clk *clk);
+ unsigned long clk_hw_get_rate(const struct clk_hw *hw);
+ unsigned long __clk_get_flags(struct clk *clk);
+ unsigned long clk_hw_get_flags(const struct clk_hw *hw);
++#define clk_hw_can_set_rate_parent(hw) \
++ (clk_hw_get_flags((hw)) & CLK_SET_RATE_PARENT)
++
+ bool clk_hw_is_prepared(const struct clk_hw *hw);
+ bool clk_hw_rate_is_protected(const struct clk_hw *hw);
+ bool clk_hw_is_enabled(const struct clk_hw *hw);
+diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
+index f70f8ac9c4f4..40fec5f94949 100644
+--- a/include/linux/f2fs_fs.h
++++ b/include/linux/f2fs_fs.h
+@@ -489,12 +489,12 @@ typedef __le32 f2fs_hash_t;
+
+ /*
+ * space utilization of regular dentry and inline dentry (w/o extra reservation)
+- * regular dentry inline dentry
+- * bitmap 1 * 27 = 27 1 * 23 = 23
+- * reserved 1 * 3 = 3 1 * 7 = 7
+- * dentry 11 * 214 = 2354 11 * 182 = 2002
+- * filename 8 * 214 = 1712 8 * 182 = 1456
+- * total 4096 3488
++ * regular dentry inline dentry (def) inline dentry (min)
++ * bitmap 1 * 27 = 27 1 * 23 = 23 1 * 1 = 1
++ * reserved 1 * 3 = 3 1 * 7 = 7 1 * 1 = 1
++ * dentry 11 * 214 = 2354 11 * 182 = 2002 11 * 2 = 22
++ * filename 8 * 214 = 1712 8 * 182 = 1456 8 * 2 = 16
++ * total 4096 3488 40
+ *
+ * Note: there are more reserved space in inline dentry than in regular
+ * dentry, when converting inline dentry we should handle this carefully.
+@@ -506,6 +506,7 @@ typedef __le32 f2fs_hash_t;
+ #define SIZE_OF_RESERVED (PAGE_SIZE - ((SIZE_OF_DIR_ENTRY + \
+ F2FS_SLOT_LEN) * \
+ NR_DENTRY_IN_BLOCK + SIZE_OF_DENTRY_BITMAP))
++#define MIN_INLINE_DENTRY_SIZE 40 /* just include '.' and '..' entries */
+
+ /* One directory entry slot representing F2FS_SLOT_LEN-sized file name */
+ struct f2fs_dir_entry {
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 1a39d57eb88f..037610845892 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -844,7 +844,9 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
+ unsigned int alignment,
+ bpf_jit_fill_hole_t bpf_fill_ill_insns);
+ void bpf_jit_binary_free(struct bpf_binary_header *hdr);
+-
++u64 bpf_jit_alloc_exec_limit(void);
++void *bpf_jit_alloc_exec(unsigned long size);
++void bpf_jit_free_exec(void *addr);
+ void bpf_jit_free(struct bpf_prog *fp);
+
+ struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *fp);
+diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
+index dd1e40ddac7d..875c41b23f20 100644
+--- a/include/linux/irqdesc.h
++++ b/include/linux/irqdesc.h
+@@ -65,6 +65,7 @@ struct irq_desc {
+ unsigned int core_internal_state__do_not_mess_with_it;
+ unsigned int depth; /* nested irq disables */
+ unsigned int wake_depth; /* nested wake enables */
++ unsigned int tot_count;
+ unsigned int irq_count; /* For detecting broken IRQs */
+ unsigned long last_unhandled; /* Aging timer for unhandled count */
+ unsigned int irqs_unhandled;
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index c2876e740514..42fc852bf512 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -409,7 +409,7 @@ struct pmu {
+ /*
+ * Set up pmu-private data structures for an AUX area
+ */
+- void *(*setup_aux) (int cpu, void **pages,
++ void *(*setup_aux) (struct perf_event *event, void **pages,
+ int nr_pages, bool overwrite);
+ /* optional */
+
+diff --git a/include/linux/relay.h b/include/linux/relay.h
+index e1bdf01a86e2..c759f96e39c1 100644
+--- a/include/linux/relay.h
++++ b/include/linux/relay.h
+@@ -66,7 +66,7 @@ struct rchan
+ struct kref kref; /* channel refcount */
+ void *private_data; /* for user-defined data */
+ size_t last_toobig; /* tried to log event > subbuf size */
+- struct rchan_buf ** __percpu buf; /* per-cpu channel buffers */
++ struct rchan_buf * __percpu *buf; /* per-cpu channel buffers */
+ int is_global; /* One global buffer ? */
+ struct list_head list; /* for channel list */
+ struct dentry *parent; /* parent dentry passed to open */
+diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
+index 0940fda59872..941bfd9b3c89 100644
+--- a/include/linux/ring_buffer.h
++++ b/include/linux/ring_buffer.h
+@@ -128,7 +128,7 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts,
+ unsigned long *lost_events);
+
+ struct ring_buffer_iter *
+-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu);
++ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags);
+ void ring_buffer_read_prepare_sync(void);
+ void ring_buffer_read_start(struct ring_buffer_iter *iter);
+ void ring_buffer_read_finish(struct ring_buffer_iter *iter);
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 4abb5bd74b04..5dc024e28397 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1737,9 +1737,9 @@ static __always_inline bool need_resched(void)
+ static inline unsigned int task_cpu(const struct task_struct *p)
+ {
+ #ifdef CONFIG_THREAD_INFO_IN_TASK
+- return p->cpu;
++ return READ_ONCE(p->cpu);
+ #else
+- return task_thread_info(p)->cpu;
++ return READ_ONCE(task_thread_info(p)->cpu);
+ #endif
+ }
+
+diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h
+index 26347741ba50..15f3f61f7e3b 100644
+--- a/include/linux/sched/topology.h
++++ b/include/linux/sched/topology.h
+@@ -177,10 +177,10 @@ typedef int (*sched_domain_flags_f)(void);
+ #define SDTL_OVERLAP 0x01
+
+ struct sd_data {
+- struct sched_domain **__percpu sd;
+- struct sched_domain_shared **__percpu sds;
+- struct sched_group **__percpu sg;
+- struct sched_group_capacity **__percpu sgc;
++ struct sched_domain *__percpu *sd;
++ struct sched_domain_shared *__percpu *sds;
++ struct sched_group *__percpu *sg;
++ struct sched_group_capacity *__percpu *sgc;
+ };
+
+ struct sched_domain_topology_level {
+diff --git a/include/net/netfilter/br_netfilter.h b/include/net/netfilter/br_netfilter.h
+index 74af19c3a8f7..a4ba601b5d04 100644
+--- a/include/net/netfilter/br_netfilter.h
++++ b/include/net/netfilter/br_netfilter.h
+@@ -49,7 +49,6 @@ static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
+ }
+
+ struct net_device *setup_pre_routing(struct sk_buff *skb);
+-void br_netfilter_enable(void);
+
+ #if IS_ENABLED(CONFIG_IPV6)
+ int br_validate_ipv6(struct net *net, struct sk_buff *skb);
+diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h
+index cb8a273732cf..bb8092fa1e36 100644
+--- a/include/scsi/libfcoe.h
++++ b/include/scsi/libfcoe.h
+@@ -79,7 +79,7 @@ enum fip_state {
+ * It must not change after fcoe_ctlr_init() sets it.
+ */
+ enum fip_mode {
+- FIP_MODE_AUTO = FIP_ST_AUTO,
++ FIP_MODE_AUTO,
+ FIP_MODE_NON_FIP,
+ FIP_MODE_FABRIC,
+ FIP_MODE_VN2VN,
+@@ -250,7 +250,7 @@ struct fcoe_rport {
+ };
+
+ /* FIP API functions */
+-void fcoe_ctlr_init(struct fcoe_ctlr *, enum fip_state);
++void fcoe_ctlr_init(struct fcoe_ctlr *, enum fip_mode);
+ void fcoe_ctlr_destroy(struct fcoe_ctlr *);
+ void fcoe_ctlr_link_up(struct fcoe_ctlr *);
+ int fcoe_ctlr_link_down(struct fcoe_ctlr *);
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index e710ac7fbbbf..63dae7e0ccae 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -195,7 +195,7 @@ static u64 css_serial_nr_next = 1;
+ */
+ static u16 have_fork_callback __read_mostly;
+ static u16 have_exit_callback __read_mostly;
+-static u16 have_free_callback __read_mostly;
++static u16 have_release_callback __read_mostly;
+ static u16 have_canfork_callback __read_mostly;
+
+ /* cgroup namespace for init task */
+@@ -5240,7 +5240,7 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss, bool early)
+
+ have_fork_callback |= (bool)ss->fork << ss->id;
+ have_exit_callback |= (bool)ss->exit << ss->id;
+- have_free_callback |= (bool)ss->free << ss->id;
++ have_release_callback |= (bool)ss->release << ss->id;
+ have_canfork_callback |= (bool)ss->can_fork << ss->id;
+
+ /* At system boot, before all subsystems have been
+@@ -5676,16 +5676,19 @@ void cgroup_exit(struct task_struct *tsk)
+ } while_each_subsys_mask();
+ }
+
+-void cgroup_free(struct task_struct *task)
++void cgroup_release(struct task_struct *task)
+ {
+- struct css_set *cset = task_css_set(task);
+ struct cgroup_subsys *ss;
+ int ssid;
+
+- do_each_subsys_mask(ss, ssid, have_free_callback) {
+- ss->free(task);
++ do_each_subsys_mask(ss, ssid, have_release_callback) {
++ ss->release(task);
+ } while_each_subsys_mask();
++}
+
++void cgroup_free(struct task_struct *task)
++{
++ struct css_set *cset = task_css_set(task);
+ put_css_set(cset);
+ }
+
+diff --git a/kernel/cgroup/pids.c b/kernel/cgroup/pids.c
+index 9829c67ebc0a..c9960baaa14f 100644
+--- a/kernel/cgroup/pids.c
++++ b/kernel/cgroup/pids.c
+@@ -247,7 +247,7 @@ static void pids_cancel_fork(struct task_struct *task)
+ pids_uncharge(pids, 1);
+ }
+
+-static void pids_free(struct task_struct *task)
++static void pids_release(struct task_struct *task)
+ {
+ struct pids_cgroup *pids = css_pids(task_css(task, pids_cgrp_id));
+
+@@ -342,7 +342,7 @@ struct cgroup_subsys pids_cgrp_subsys = {
+ .cancel_attach = pids_cancel_attach,
+ .can_fork = pids_can_fork,
+ .cancel_fork = pids_cancel_fork,
+- .free = pids_free,
++ .release = pids_release,
+ .legacy_cftypes = pids_files,
+ .dfl_cftypes = pids_files,
+ .threaded = true,
+diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c
+index d503d1a9007c..bb95a35e8c2d 100644
+--- a/kernel/cgroup/rstat.c
++++ b/kernel/cgroup/rstat.c
+@@ -87,7 +87,6 @@ static struct cgroup *cgroup_rstat_cpu_pop_updated(struct cgroup *pos,
+ struct cgroup *root, int cpu)
+ {
+ struct cgroup_rstat_cpu *rstatc;
+- struct cgroup *parent;
+
+ if (pos == root)
+ return NULL;
+@@ -115,8 +114,8 @@ static struct cgroup *cgroup_rstat_cpu_pop_updated(struct cgroup *pos,
+ * However, due to the way we traverse, @pos will be the first
+ * child in most cases. The only exception is @root.
+ */
+- parent = cgroup_parent(pos);
+- if (parent && rstatc->updated_next) {
++ if (rstatc->updated_next) {
++ struct cgroup *parent = cgroup_parent(pos);
+ struct cgroup_rstat_cpu *prstatc = cgroup_rstat_cpu(parent, cpu);
+ struct cgroup_rstat_cpu *nrstatc;
+ struct cgroup **nextp;
+@@ -140,9 +139,12 @@ static struct cgroup *cgroup_rstat_cpu_pop_updated(struct cgroup *pos,
+ * updated stat.
+ */
+ smp_mb();
++
++ return pos;
+ }
+
+- return pos;
++ /* only happens for @root */
++ return NULL;
+ }
+
+ /* see cgroup_rstat_flush() */
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 9d0ecc4a0e79..dc250ec2c096 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -313,6 +313,15 @@ void cpus_write_unlock(void)
+
+ void lockdep_assert_cpus_held(void)
+ {
++ /*
++ * We can't have hotplug operations before userspace starts running,
++ * and some init codepaths will knowingly not take the hotplug lock.
++ * This is all valid, so mute lockdep until it makes sense to report
++ * unheld locks.
++ */
++ if (system_state < SYSTEM_RUNNING)
++ return;
++
+ percpu_rwsem_assert_held(&cpu_hotplug_lock);
+ }
+
+diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
+index 5631af940316..474b2ccdbe69 100644
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -648,7 +648,7 @@ int rb_alloc_aux(struct ring_buffer *rb, struct perf_event *event,
+ goto out;
+ }
+
+- rb->aux_priv = event->pmu->setup_aux(event->cpu, rb->aux_pages, nr_pages,
++ rb->aux_priv = event->pmu->setup_aux(event, rb->aux_pages, nr_pages,
+ overwrite);
+ if (!rb->aux_priv)
+ goto out;
+diff --git a/kernel/exit.c b/kernel/exit.c
+index d607e23fd0c3..5c0964dc805a 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -219,6 +219,7 @@ repeat:
+ }
+
+ write_unlock_irq(&tasklist_lock);
++ cgroup_release(p);
+ release_thread(p);
+ call_rcu(&p->rcu, delayed_put_task_struct);
+
+diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
+index a2b3d9de999c..811009ebacd4 100644
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -855,7 +855,11 @@ void handle_percpu_irq(struct irq_desc *desc)
+ {
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+
+- kstat_incr_irqs_this_cpu(desc);
++ /*
++ * PER CPU interrupts are not serialized. Do not touch
++ * desc->tot_count.
++ */
++ __kstat_incr_irqs_this_cpu(desc);
+
+ if (chip->irq_ack)
+ chip->irq_ack(&desc->irq_data);
+@@ -884,7 +888,11 @@ void handle_percpu_devid_irq(struct irq_desc *desc)
+ unsigned int irq = irq_desc_get_irq(desc);
+ irqreturn_t res;
+
+- kstat_incr_irqs_this_cpu(desc);
++ /*
++ * PER CPU interrupts are not serialized. Do not touch
++ * desc->tot_count.
++ */
++ __kstat_incr_irqs_this_cpu(desc);
+
+ if (chip->irq_ack)
+ chip->irq_ack(&desc->irq_data);
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index ca6afa267070..e74e7eea76cf 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -242,12 +242,18 @@ static inline void irq_state_set_masked(struct irq_desc *desc)
+
+ #undef __irqd_to_state
+
+-static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc)
++static inline void __kstat_incr_irqs_this_cpu(struct irq_desc *desc)
+ {
+ __this_cpu_inc(*desc->kstat_irqs);
+ __this_cpu_inc(kstat.irqs_sum);
+ }
+
++static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc)
++{
++ __kstat_incr_irqs_this_cpu(desc);
++ desc->tot_count++;
++}
++
+ static inline int irq_desc_get_node(struct irq_desc *desc)
+ {
+ return irq_common_data_get_node(&desc->irq_common_data);
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index 578d0e5f1b5b..ba454cba4069 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -119,6 +119,7 @@ static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node,
+ desc->depth = 1;
+ desc->irq_count = 0;
+ desc->irqs_unhandled = 0;
++ desc->tot_count = 0;
+ desc->name = NULL;
+ desc->owner = owner;
+ for_each_possible_cpu(cpu)
+@@ -915,11 +916,15 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
+ unsigned int kstat_irqs(unsigned int irq)
+ {
+ struct irq_desc *desc = irq_to_desc(irq);
+- int cpu;
+ unsigned int sum = 0;
++ int cpu;
+
+ if (!desc || !desc->kstat_irqs)
+ return 0;
++ if (!irq_settings_is_per_cpu_devid(desc) &&
++ !irq_settings_is_per_cpu(desc))
++ return desc->tot_count;
++
+ for_each_possible_cpu(cpu)
+ sum += *per_cpu_ptr(desc->kstat_irqs, cpu);
+ return sum;
+diff --git a/kernel/rcu/update.c b/kernel/rcu/update.c
+index 39cb23d22109..81688a133552 100644
+--- a/kernel/rcu/update.c
++++ b/kernel/rcu/update.c
+@@ -52,6 +52,7 @@
+ #include <linux/tick.h>
+ #include <linux/rcupdate_wait.h>
+ #include <linux/sched/isolation.h>
++#include <linux/kprobes.h>
+
+ #define CREATE_TRACE_POINTS
+
+@@ -253,6 +254,7 @@ int notrace debug_lockdep_rcu_enabled(void)
+ current->lockdep_recursion == 0;
+ }
+ EXPORT_SYMBOL_GPL(debug_lockdep_rcu_enabled);
++NOKPROBE_SYMBOL(debug_lockdep_rcu_enabled);
+
+ /**
+ * rcu_read_lock_held() - might we be in RCU read-side critical section?
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 152a0b0c91bb..9a4f57d7e931 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -107,11 +107,12 @@ struct rq *task_rq_lock(struct task_struct *p, struct rq_flags *rf)
+ * [L] ->on_rq
+ * RELEASE (rq->lock)
+ *
+- * If we observe the old CPU in task_rq_lock, the acquire of
++ * If we observe the old CPU in task_rq_lock(), the acquire of
+ * the old rq->lock will fully serialize against the stores.
+ *
+- * If we observe the new CPU in task_rq_lock, the acquire will
+- * pair with the WMB to ensure we must then also see migrating.
++ * If we observe the new CPU in task_rq_lock(), the address
++ * dependency headed by '[L] rq = task_rq()' and the acquire
++ * will pair with the WMB to ensure we then also see migrating.
+ */
+ if (likely(rq == task_rq(p) && !task_on_rq_migrating(p))) {
+ rq_pin_lock(rq, rf);
+@@ -910,7 +911,7 @@ static struct rq *move_queued_task(struct rq *rq, struct rq_flags *rf,
+ {
+ lockdep_assert_held(&rq->lock);
+
+- p->on_rq = TASK_ON_RQ_MIGRATING;
++ WRITE_ONCE(p->on_rq, TASK_ON_RQ_MIGRATING);
+ dequeue_task(rq, p, DEQUEUE_NOCLOCK);
+ set_task_cpu(p, new_cpu);
+ rq_unlock(rq, rf);
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index 6383aa6a60ca..141ea9ff210e 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -315,6 +315,7 @@ void register_sched_domain_sysctl(void)
+ {
+ static struct ctl_table *cpu_entries;
+ static struct ctl_table **cpu_idx;
++ static bool init_done = false;
+ char buf[32];
+ int i;
+
+@@ -344,7 +345,10 @@ void register_sched_domain_sysctl(void)
+ if (!cpumask_available(sd_sysctl_cpus)) {
+ if (!alloc_cpumask_var(&sd_sysctl_cpus, GFP_KERNEL))
+ return;
++ }
+
++ if (!init_done) {
++ init_done = true;
+ /* init to possible to not have holes in @cpu_entries */
+ cpumask_copy(sd_sysctl_cpus, cpu_possible_mask);
+ }
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index b63172288f7b..4c7a837d7c14 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -1331,9 +1331,9 @@ static inline void __set_task_cpu(struct task_struct *p, unsigned int cpu)
+ */
+ smp_wmb();
+ #ifdef CONFIG_THREAD_INFO_IN_TASK
+- p->cpu = cpu;
++ WRITE_ONCE(p->cpu, cpu);
+ #else
+- task_thread_info(p)->cpu = cpu;
++ WRITE_ONCE(task_thread_info(p)->cpu, cpu);
+ #endif
+ p->wake_cpu = cpu;
+ #endif
+@@ -1434,7 +1434,7 @@ static inline int task_on_rq_queued(struct task_struct *p)
+
+ static inline int task_on_rq_migrating(struct task_struct *p)
+ {
+- return p->on_rq == TASK_ON_RQ_MIGRATING;
++ return READ_ONCE(p->on_rq) == TASK_ON_RQ_MIGRATING;
+ }
+
+ /*
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index 505a41c42b96..c0a751464971 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -477,7 +477,7 @@ cpu_attach_domain(struct sched_domain *sd, struct root_domain *rd, int cpu)
+ }
+
+ struct s_data {
+- struct sched_domain ** __percpu sd;
++ struct sched_domain * __percpu *sd;
+ struct root_domain *rd;
+ };
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 3b86acd5de4e..9e22660153ff 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -126,6 +126,7 @@ static int __maybe_unused one = 1;
+ static int __maybe_unused two = 2;
+ static int __maybe_unused four = 4;
+ static unsigned long one_ul = 1;
++static unsigned long long_max = LONG_MAX;
+ static int one_hundred = 100;
+ static int one_thousand = 1000;
+ #ifdef CONFIG_PRINTK
+@@ -1695,6 +1696,8 @@ static struct ctl_table fs_table[] = {
+ .maxlen = sizeof(files_stat.max_files),
+ .mode = 0644,
+ .proc_handler = proc_doulongvec_minmax,
++ .extra1 = &zero,
++ .extra2 = &long_max,
+ },
+ {
+ .procname = "nr_open",
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 65bd4616220d..34b4c32b0692 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -4141,6 +4141,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
+ * ring_buffer_read_prepare - Prepare for a non consuming read of the buffer
+ * @buffer: The ring buffer to read from
+ * @cpu: The cpu buffer to iterate over
++ * @flags: gfp flags to use for memory allocation
+ *
+ * This performs the initial preparations necessary to iterate
+ * through the buffer. Memory is allocated, buffer recording
+@@ -4158,7 +4159,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
+ * This overall must be paired with ring_buffer_read_finish.
+ */
+ struct ring_buffer_iter *
+-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu)
++ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags)
+ {
+ struct ring_buffer_per_cpu *cpu_buffer;
+ struct ring_buffer_iter *iter;
+@@ -4166,7 +4167,7 @@ ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu)
+ if (!cpumask_test_cpu(cpu, buffer->cpumask))
+ return NULL;
+
+- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
++ iter = kmalloc(sizeof(*iter), flags);
+ if (!iter)
+ return NULL;
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 1f96b292df31..c65cea71d1ee 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -3903,7 +3903,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot)
+ if (iter->cpu_file == RING_BUFFER_ALL_CPUS) {
+ for_each_tracing_cpu(cpu) {
+ iter->buffer_iter[cpu] =
+- ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu);
++ ring_buffer_read_prepare(iter->trace_buffer->buffer,
++ cpu, GFP_KERNEL);
+ }
+ ring_buffer_read_prepare_sync();
+ for_each_tracing_cpu(cpu) {
+@@ -3913,7 +3914,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot)
+ } else {
+ cpu = iter->cpu_file;
+ iter->buffer_iter[cpu] =
+- ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu);
++ ring_buffer_read_prepare(iter->trace_buffer->buffer,
++ cpu, GFP_KERNEL);
+ ring_buffer_read_prepare_sync();
+ ring_buffer_read_start(iter->buffer_iter[cpu]);
+ tracing_iter_reset(iter, cpu);
+diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c
+index d953c163a079..810d78a8d14c 100644
+--- a/kernel/trace/trace_kdb.c
++++ b/kernel/trace/trace_kdb.c
+@@ -51,14 +51,16 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file)
+ if (cpu_file == RING_BUFFER_ALL_CPUS) {
+ for_each_tracing_cpu(cpu) {
+ iter.buffer_iter[cpu] =
+- ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu);
++ ring_buffer_read_prepare(iter.trace_buffer->buffer,
++ cpu, GFP_ATOMIC);
+ ring_buffer_read_start(iter.buffer_iter[cpu]);
+ tracing_iter_reset(&iter, cpu);
+ }
+ } else {
+ iter.cpu_file = cpu_file;
+ iter.buffer_iter[cpu_file] =
+- ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu_file);
++ ring_buffer_read_prepare(iter.trace_buffer->buffer,
++ cpu_file, GFP_ATOMIC);
+ ring_buffer_read_start(iter.buffer_iter[cpu_file]);
+ tracing_iter_reset(&iter, cpu_file);
+ }
+diff --git a/lib/bsearch.c b/lib/bsearch.c
+index 18b445b010c3..82512fe7b33c 100644
+--- a/lib/bsearch.c
++++ b/lib/bsearch.c
+@@ -11,6 +11,7 @@
+
+ #include <linux/export.h>
+ #include <linux/bsearch.h>
++#include <linux/kprobes.h>
+
+ /*
+ * bsearch - binary search an array of elements
+@@ -53,3 +54,4 @@ void *bsearch(const void *key, const void *base, size_t num, size_t size,
+ return NULL;
+ }
+ EXPORT_SYMBOL(bsearch);
++NOKPROBE_SYMBOL(bsearch);
+diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile
+index 7ed43eaa02ef..5e0d55c54100 100644
+--- a/lib/raid6/Makefile
++++ b/lib/raid6/Makefile
+@@ -40,7 +40,7 @@ endif
+ ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
+ NEON_FLAGS := -ffreestanding
+ ifeq ($(ARCH),arm)
+-NEON_FLAGS += -mfloat-abi=softfp -mfpu=neon
++NEON_FLAGS += -march=armv7-a -mfloat-abi=softfp -mfpu=neon
+ endif
+ CFLAGS_recov_neon_inner.o += $(NEON_FLAGS)
+ ifeq ($(ARCH),arm64)
+diff --git a/mm/cma.c b/mm/cma.c
+index 4cb76121a3ab..bfe9f5397165 100644
+--- a/mm/cma.c
++++ b/mm/cma.c
+@@ -353,12 +353,14 @@ int __init cma_declare_contiguous(phys_addr_t base,
+
+ ret = cma_init_reserved_mem(base, size, order_per_bit, name, res_cma);
+ if (ret)
+- goto err;
++ goto free_mem;
+
+ pr_info("Reserved %ld MiB at %pa\n", (unsigned long)size / SZ_1M,
+ &base);
+ return 0;
+
++free_mem:
++ memblock_free(base, size);
+ err:
+ pr_err("Failed to reserve %ld MiB\n", (unsigned long)size / SZ_1M);
+ return ret;
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 9518aefd8cbb..7c712c4565e6 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -248,6 +248,12 @@ enum res_type {
+ iter != NULL; \
+ iter = mem_cgroup_iter(NULL, iter, NULL))
+
++static inline bool should_force_charge(void)
++{
++ return tsk_is_oom_victim(current) || fatal_signal_pending(current) ||
++ (current->flags & PF_EXITING);
++}
++
+ /* Some nice accessors for the vmpressure. */
+ struct vmpressure *memcg_to_vmpressure(struct mem_cgroup *memcg)
+ {
+@@ -1382,8 +1388,13 @@ static bool mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
+ };
+ bool ret;
+
+- mutex_lock(&oom_lock);
+- ret = out_of_memory(&oc);
++ if (mutex_lock_killable(&oom_lock))
++ return true;
++ /*
++ * A few threads which were not waiting at mutex_lock_killable() can
++ * fail to bail out. Therefore, check again after holding oom_lock.
++ */
++ ret = should_force_charge() || out_of_memory(&oc);
+ mutex_unlock(&oom_lock);
+ return ret;
+ }
+@@ -2200,9 +2211,7 @@ retry:
+ * bypass the last charges so that they can exit quickly and
+ * free their memory.
+ */
+- if (unlikely(tsk_is_oom_victim(current) ||
+- fatal_signal_pending(current) ||
+- current->flags & PF_EXITING))
++ if (unlikely(should_force_charge()))
+ goto force;
+
+ /*
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index f32d0a5be4fb..360b24bc69e5 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -350,7 +350,7 @@ static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask)
+ {
+ if (!pol)
+ return;
+- if (!mpol_store_user_nodemask(pol) &&
++ if (!mpol_store_user_nodemask(pol) && !(pol->flags & MPOL_F_LOCAL) &&
+ nodes_equal(pol->w.cpuset_mems_allowed, *newmask))
+ return;
+
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index e66ac8a47dd6..dbddb7a409dd 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -915,7 +915,8 @@ static void __oom_kill_process(struct task_struct *victim)
+ */
+ static int oom_kill_memcg_member(struct task_struct *task, void *unused)
+ {
+- if (task->signal->oom_score_adj != OOM_SCORE_ADJ_MIN) {
++ if (task->signal->oom_score_adj != OOM_SCORE_ADJ_MIN &&
++ !is_global_init(task)) {
+ get_task_struct(task);
+ __oom_kill_process(task);
+ }
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index ef99971c13dd..8e6932a140b8 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1922,8 +1922,8 @@ inline void post_alloc_hook(struct page *page, unsigned int order,
+
+ arch_alloc_page(page, order);
+ kernel_map_pages(page, 1 << order, 1);
+- kernel_poison_pages(page, 1 << order, 1);
+ kasan_alloc_pages(page, order);
++ kernel_poison_pages(page, 1 << order, 1);
+ set_page_owner(page, order, gfp_flags);
+ }
+
+diff --git a/mm/page_ext.c b/mm/page_ext.c
+index 4961f13b6ec1..aad120123688 100644
+--- a/mm/page_ext.c
++++ b/mm/page_ext.c
+@@ -273,6 +273,7 @@ static void free_page_ext(void *addr)
+ table_size = get_entry_size() * PAGES_PER_SECTION;
+
+ BUG_ON(PageReserved(page));
++ kmemleak_free(addr);
+ free_pages_exact(addr, table_size);
+ }
+ }
+diff --git a/mm/page_poison.c b/mm/page_poison.c
+index aa2b3d34e8ea..6cfa8e7d7213 100644
+--- a/mm/page_poison.c
++++ b/mm/page_poison.c
+@@ -6,6 +6,7 @@
+ #include <linux/page_ext.h>
+ #include <linux/poison.h>
+ #include <linux/ratelimit.h>
++#include <linux/kasan.h>
+
+ static bool want_page_poisoning __read_mostly;
+
+@@ -34,7 +35,10 @@ static void poison_page(struct page *page)
+ {
+ void *addr = kmap_atomic(page);
+
++ /* KASAN still think the page is in-use, so skip it. */
++ kasan_disable_current();
+ memset(addr, PAGE_POISON, PAGE_SIZE);
++ kasan_enable_current();
+ kunmap_atomic(addr);
+ }
+
+diff --git a/mm/slab.c b/mm/slab.c
+index 364e42d5a399..b8e0ec74330f 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -563,14 +563,6 @@ static void start_cpu_timer(int cpu)
+
+ static void init_arraycache(struct array_cache *ac, int limit, int batch)
+ {
+- /*
+- * The array_cache structures contain pointers to free object.
+- * However, when such objects are allocated or transferred to another
+- * cache the pointers are not cleared and they could be counted as
+- * valid references during a kmemleak scan. Therefore, kmemleak must
+- * not scan such objects.
+- */
+- kmemleak_no_scan(ac);
+ if (ac) {
+ ac->avail = 0;
+ ac->limit = limit;
+@@ -586,6 +578,14 @@ static struct array_cache *alloc_arraycache(int node, int entries,
+ struct array_cache *ac = NULL;
+
+ ac = kmalloc_node(memsize, gfp, node);
++ /*
++ * The array_cache structures contain pointers to free object.
++ * However, when such objects are allocated or transferred to another
++ * cache the pointers are not cleared and they could be counted as
++ * valid references during a kmemleak scan. Therefore, kmemleak must
++ * not scan such objects.
++ */
++ kmemleak_no_scan(ac);
+ init_arraycache(ac, entries, batchcount);
+ return ac;
+ }
+@@ -680,6 +680,7 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries,
+
+ alc = kmalloc_node(memsize, gfp, node);
+ if (alc) {
++ kmemleak_no_scan(alc);
+ init_arraycache(&alc->ac, entries, batch);
+ spin_lock_init(&alc->lock);
+ }
+diff --git a/mm/sparse.c b/mm/sparse.c
+index 10b07eea9a6e..45950a074bdb 100644
+--- a/mm/sparse.c
++++ b/mm/sparse.c
+@@ -196,7 +196,7 @@ static inline int next_present_section_nr(int section_nr)
+ }
+ #define for_each_present_section_nr(start, section_nr) \
+ for (section_nr = next_present_section_nr(start-1); \
+- ((section_nr >= 0) && \
++ ((section_nr != -1) && \
+ (section_nr <= __highest_present_section_nr)); \
+ section_nr = next_present_section_nr(section_nr))
+
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 340ef3177686..0047dcaf9369 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -98,6 +98,15 @@ static atomic_t proc_poll_event = ATOMIC_INIT(0);
+
+ atomic_t nr_rotate_swap = ATOMIC_INIT(0);
+
++static struct swap_info_struct *swap_type_to_swap_info(int type)
++{
++ if (type >= READ_ONCE(nr_swapfiles))
++ return NULL;
++
++ smp_rmb(); /* Pairs with smp_wmb in alloc_swap_info. */
++ return READ_ONCE(swap_info[type]);
++}
++
+ static inline unsigned char swap_count(unsigned char ent)
+ {
+ return ent & ~SWAP_HAS_CACHE; /* may include COUNT_CONTINUED flag */
+@@ -1030,12 +1039,14 @@ noswap:
+ /* The only caller of this function is now suspend routine */
+ swp_entry_t get_swap_page_of_type(int type)
+ {
+- struct swap_info_struct *si;
++ struct swap_info_struct *si = swap_type_to_swap_info(type);
+ pgoff_t offset;
+
+- si = swap_info[type];
++ if (!si)
++ goto fail;
++
+ spin_lock(&si->lock);
+- if (si && (si->flags & SWP_WRITEOK)) {
++ if (si->flags & SWP_WRITEOK) {
+ atomic_long_dec(&nr_swap_pages);
+ /* This is called for allocating swap entry, not cache */
+ offset = scan_swap_map(si, 1);
+@@ -1046,6 +1057,7 @@ swp_entry_t get_swap_page_of_type(int type)
+ atomic_long_inc(&nr_swap_pages);
+ }
+ spin_unlock(&si->lock);
++fail:
+ return (swp_entry_t) {0};
+ }
+
+@@ -1057,9 +1069,9 @@ static struct swap_info_struct *__swap_info_get(swp_entry_t entry)
+ if (!entry.val)
+ goto out;
+ type = swp_type(entry);
+- if (type >= nr_swapfiles)
++ p = swap_type_to_swap_info(type);
++ if (!p)
+ goto bad_nofile;
+- p = swap_info[type];
+ if (!(p->flags & SWP_USED))
+ goto bad_device;
+ offset = swp_offset(entry);
+@@ -1708,10 +1720,9 @@ int swap_type_of(dev_t device, sector_t offset, struct block_device **bdev_p)
+ sector_t swapdev_block(int type, pgoff_t offset)
+ {
+ struct block_device *bdev;
++ struct swap_info_struct *si = swap_type_to_swap_info(type);
+
+- if ((unsigned int)type >= nr_swapfiles)
+- return 0;
+- if (!(swap_info[type]->flags & SWP_WRITEOK))
++ if (!si || !(si->flags & SWP_WRITEOK))
+ return 0;
+ return map_swap_entry(swp_entry(type, offset), &bdev);
+ }
+@@ -2269,7 +2280,7 @@ static sector_t map_swap_entry(swp_entry_t entry, struct block_device **bdev)
+ struct swap_extent *se;
+ pgoff_t offset;
+
+- sis = swap_info[swp_type(entry)];
++ sis = swp_swap_info(entry);
+ *bdev = sis->bdev;
+
+ offset = swp_offset(entry);
+@@ -2707,9 +2718,7 @@ static void *swap_start(struct seq_file *swap, loff_t *pos)
+ if (!l)
+ return SEQ_START_TOKEN;
+
+- for (type = 0; type < nr_swapfiles; type++) {
+- smp_rmb(); /* read nr_swapfiles before swap_info[type] */
+- si = swap_info[type];
++ for (type = 0; (si = swap_type_to_swap_info(type)); type++) {
+ if (!(si->flags & SWP_USED) || !si->swap_map)
+ continue;
+ if (!--l)
+@@ -2729,9 +2738,7 @@ static void *swap_next(struct seq_file *swap, void *v, loff_t *pos)
+ else
+ type = si->type + 1;
+
+- for (; type < nr_swapfiles; type++) {
+- smp_rmb(); /* read nr_swapfiles before swap_info[type] */
+- si = swap_info[type];
++ for (; (si = swap_type_to_swap_info(type)); type++) {
+ if (!(si->flags & SWP_USED) || !si->swap_map)
+ continue;
+ ++*pos;
+@@ -2838,14 +2845,14 @@ static struct swap_info_struct *alloc_swap_info(void)
+ }
+ if (type >= nr_swapfiles) {
+ p->type = type;
+- swap_info[type] = p;
++ WRITE_ONCE(swap_info[type], p);
+ /*
+ * Write swap_info[type] before nr_swapfiles, in case a
+ * racing procfs swap_start() or swap_next() is reading them.
+ * (We never shrink nr_swapfiles, we never free this entry.)
+ */
+ smp_wmb();
+- nr_swapfiles++;
++ WRITE_ONCE(nr_swapfiles, nr_swapfiles + 1);
+ } else {
+ kvfree(p);
+ p = swap_info[type];
+@@ -3365,7 +3372,7 @@ static int __swap_duplicate(swp_entry_t entry, unsigned char usage)
+ {
+ struct swap_info_struct *p;
+ struct swap_cluster_info *ci;
+- unsigned long offset, type;
++ unsigned long offset;
+ unsigned char count;
+ unsigned char has_cache;
+ int err = -EINVAL;
+@@ -3373,10 +3380,10 @@ static int __swap_duplicate(swp_entry_t entry, unsigned char usage)
+ if (non_swap_entry(entry))
+ goto out;
+
+- type = swp_type(entry);
+- if (type >= nr_swapfiles)
++ p = swp_swap_info(entry);
++ if (!p)
+ goto bad_file;
+- p = swap_info[type];
++
+ offset = swp_offset(entry);
+ if (unlikely(offset >= p->max))
+ goto out;
+@@ -3473,7 +3480,7 @@ int swapcache_prepare(swp_entry_t entry)
+
+ struct swap_info_struct *swp_swap_info(swp_entry_t entry)
+ {
+- return swap_info[swp_type(entry)];
++ return swap_type_to_swap_info(swp_type(entry));
+ }
+
+ struct swap_info_struct *page_swap_info(struct page *page)
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 91a789a46b12..a46ec261a44e 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -498,7 +498,11 @@ nocache:
+ }
+
+ found:
+- if (addr + size > vend)
++ /*
++ * Check also calculated address against the vstart,
++ * because it can be 0 because of big align request.
++ */
++ if (addr + size > vend || addr < vstart)
+ goto overflow;
+
+ va->va_start = addr;
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index e07a7e62c705..3b0a03b92080 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -884,11 +884,6 @@ static const struct nf_br_ops br_ops = {
+ .br_dev_xmit_hook = br_nf_dev_xmit,
+ };
+
+-void br_netfilter_enable(void)
+-{
+-}
+-EXPORT_SYMBOL_GPL(br_netfilter_enable);
+-
+ /* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
+ * br_dev_queue_push_xmit is called afterwards */
+ static const struct nf_hook_ops br_nf_ops[] = {
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 895171a2e1f1..9a249478abf2 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -901,10 +901,18 @@ __nf_conntrack_confirm(struct sk_buff *skb)
+ * REJECT will give spurious warnings here.
+ */
+
+- /* No external references means no one else could have
+- * confirmed us.
++ /* Another skb with the same unconfirmed conntrack may
++ * win the race. This may happen for bridge(br_flood)
++ * or broadcast/multicast packets do skb_clone with
++ * unconfirmed conntrack.
+ */
+- WARN_ON(nf_ct_is_confirmed(ct));
++ if (unlikely(nf_ct_is_confirmed(ct))) {
++ WARN_ON_ONCE(1);
++ nf_conntrack_double_unlock(hash, reply_hash);
++ local_bh_enable();
++ return NF_DROP;
++ }
++
+ pr_debug("Confirming conntrack %p\n", ct);
+ /* We have to check the DYING flag after unlink to prevent
+ * a race against nf_ct_get_next_corpse() possibly called from
+diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
+index 247b89784a6f..842f3f86fb2e 100644
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -769,6 +769,12 @@ static int tcp_error(struct net *net, struct nf_conn *tmpl,
+ return NF_ACCEPT;
+ }
+
++static bool nf_conntrack_tcp_established(const struct nf_conn *ct)
++{
++ return ct->proto.tcp.state == TCP_CONNTRACK_ESTABLISHED &&
++ test_bit(IPS_ASSURED_BIT, &ct->status);
++}
++
+ /* Returns verdict for packet, or -1 for invalid. */
+ static int tcp_packet(struct nf_conn *ct,
+ const struct sk_buff *skb,
+@@ -963,16 +969,38 @@ static int tcp_packet(struct nf_conn *ct,
+ new_state = TCP_CONNTRACK_ESTABLISHED;
+ break;
+ case TCP_CONNTRACK_CLOSE:
+- if (index == TCP_RST_SET
+- && (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET)
+- && before(ntohl(th->seq), ct->proto.tcp.seen[!dir].td_maxack)) {
+- /* Invalid RST */
+- spin_unlock_bh(&ct->lock);
+- nf_ct_l4proto_log_invalid(skb, ct, "invalid rst");
+- return -NF_ACCEPT;
++ if (index != TCP_RST_SET)
++ break;
++
++ if (ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_MAXACK_SET) {
++ u32 seq = ntohl(th->seq);
++
++ if (before(seq, ct->proto.tcp.seen[!dir].td_maxack)) {
++ /* Invalid RST */
++ spin_unlock_bh(&ct->lock);
++ nf_ct_l4proto_log_invalid(skb, ct, "invalid rst");
++ return -NF_ACCEPT;
++ }
++
++ if (!nf_conntrack_tcp_established(ct) ||
++ seq == ct->proto.tcp.seen[!dir].td_maxack)
++ break;
++
++ /* Check if rst is part of train, such as
++ * foo:80 > bar:4379: P, 235946583:235946602(19) ack 42
++ * foo:80 > bar:4379: R, 235946602:235946602(0) ack 42
++ */
++ if (ct->proto.tcp.last_index == TCP_ACK_SET &&
++ ct->proto.tcp.last_dir == dir &&
++ seq == ct->proto.tcp.last_end)
++ break;
++
++ /* ... RST sequence number doesn't match exactly, keep
++ * established state to allow a possible challenge ACK.
++ */
++ new_state = old_state;
+ }
+- if (index == TCP_RST_SET
+- && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
++ if (((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
+ && ct->proto.tcp.last_index == TCP_SYN_SET)
+ || (!test_bit(IPS_ASSURED_BIT, &ct->status)
+ && ct->proto.tcp.last_index == TCP_ACK_SET))
+@@ -988,7 +1016,7 @@ static int tcp_packet(struct nf_conn *ct,
+ * segments we ignored. */
+ goto in_window;
+ }
+- /* Just fall through */
++ break;
+ default:
+ /* Keep compilers happy. */
+ break;
+@@ -1023,6 +1051,8 @@ static int tcp_packet(struct nf_conn *ct,
+ if (ct->proto.tcp.retrans >= tn->tcp_max_retrans &&
+ timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
+ timeout = timeouts[TCP_CONNTRACK_RETRANS];
++ else if (unlikely(index == TCP_RST_SET))
++ timeout = timeouts[TCP_CONNTRACK_CLOSE];
+ else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
+ IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
+ timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
+diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
+index 60f258f2c707..a3850414dba2 100644
+--- a/net/netfilter/nf_tables_core.c
++++ b/net/netfilter/nf_tables_core.c
+@@ -98,21 +98,23 @@ static noinline void nft_update_chain_stats(const struct nft_chain *chain,
+ const struct nft_pktinfo *pkt)
+ {
+ struct nft_base_chain *base_chain;
++ struct nft_stats __percpu *pstats;
+ struct nft_stats *stats;
+
+ base_chain = nft_base_chain(chain);
+- if (!rcu_access_pointer(base_chain->stats))
+- return;
+
+- local_bh_disable();
+- stats = this_cpu_ptr(rcu_dereference(base_chain->stats));
+- if (stats) {
++ rcu_read_lock();
++ pstats = READ_ONCE(base_chain->stats);
++ if (pstats) {
++ local_bh_disable();
++ stats = this_cpu_ptr(pstats);
+ u64_stats_update_begin(&stats->syncp);
+ stats->pkts++;
+ stats->bytes += pkt->skb->len;
+ u64_stats_update_end(&stats->syncp);
++ local_bh_enable();
+ }
+- local_bh_enable();
++ rcu_read_unlock();
+ }
+
+ struct nft_jumpstack {
+diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
+index 9d6d67b953ac..05f00fb20b04 100644
+--- a/net/netfilter/xt_physdev.c
++++ b/net/netfilter/xt_physdev.c
+@@ -96,8 +96,7 @@ match_outdev:
+ static int physdev_mt_check(const struct xt_mtchk_param *par)
+ {
+ const struct xt_physdev_info *info = par->matchinfo;
+-
+- br_netfilter_enable();
++ static bool brnf_probed __read_mostly;
+
+ if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
+ info->bitmask & ~XT_PHYSDEV_OP_MASK)
+@@ -111,6 +110,12 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
+ if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
+ return -EINVAL;
+ }
++
++ if (!brnf_probed) {
++ brnf_probed = true;
++ request_module("br_netfilter");
++ }
++
+ return 0;
+ }
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 6ea3d3aa1a1e..4337b6d9369e 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -3458,12 +3458,16 @@ static int selinux_inode_setsecurity(struct inode *inode, const char *name,
+ const void *value, size_t size, int flags)
+ {
+ struct inode_security_struct *isec = inode_security_novalidate(inode);
++ struct superblock_security_struct *sbsec = inode->i_sb->s_security;
+ u32 newsid;
+ int rc;
+
+ if (strcmp(name, XATTR_SELINUX_SUFFIX))
+ return -EOPNOTSUPP;
+
++ if (!(sbsec->flags & SBLABEL_MNT))
++ return -EOPNOTSUPP;
++
+ if (!value || !size)
+ return -EACCES;
+
+@@ -6612,7 +6616,10 @@ static void selinux_inode_invalidate_secctx(struct inode *inode)
+ */
+ static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
+ {
+- return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
++ int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
++ ctx, ctxlen, 0);
++ /* Do not return error when suppressing label (SBLABEL_MNT not set). */
++ return rc == -EOPNOTSUPP ? 0 : rc;
+ }
+
+ /*
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index b67f6fe08a1b..e08c6c6ca029 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -1513,6 +1513,14 @@ int snd_pcm_suspend_all(struct snd_pcm *pcm)
+ /* FIXME: the open/close code should lock this as well */
+ if (substream->runtime == NULL)
+ continue;
++
++ /*
++ * Skip BE dai link PCM's that are internal and may
++ * not have their substream ops set.
++ */
++ if (!substream->ops)
++ continue;
++
+ err = snd_pcm_suspend(substream);
+ if (err < 0 && err != -EBUSY)
+ return err;
+diff --git a/sound/firewire/dice/dice.c b/sound/firewire/dice/dice.c
+index 774eb2205668..3d600f498914 100644
+--- a/sound/firewire/dice/dice.c
++++ b/sound/firewire/dice/dice.c
+@@ -18,6 +18,7 @@ MODULE_LICENSE("GPL v2");
+ #define OUI_ALESIS 0x000595
+ #define OUI_MAUDIO 0x000d6c
+ #define OUI_MYTEK 0x001ee8
++#define OUI_SSL 0x0050c2 // Actually ID reserved by IEEE.
+
+ #define DICE_CATEGORY_ID 0x04
+ #define WEISS_CATEGORY_ID 0x00
+@@ -216,7 +217,7 @@ static int dice_probe(struct fw_unit *unit,
+ struct snd_dice *dice;
+ int err;
+
+- if (!entry->driver_data) {
++ if (!entry->driver_data && entry->vendor_id != OUI_SSL) {
+ err = check_dice_category(unit);
+ if (err < 0)
+ return -ENODEV;
+@@ -382,6 +383,15 @@ static const struct ieee1394_device_id dice_id_table[] = {
+ .model_id = 0x000002,
+ .driver_data = (kernel_ulong_t)snd_dice_detect_mytek_formats,
+ },
++ // Solid State Logic, Duende Classic and Mini.
++ // NOTE: each field of GUID in config ROM is not compliant to standard
++ // DICE scheme.
++ {
++ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_MODEL_ID,
++ .vendor_id = OUI_SSL,
++ .model_id = 0x000070,
++ },
+ {
+ .match_flags = IEEE1394_MATCH_VERSION,
+ .version = DICE_INTERFACE,
+diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c
+index 44433b20435c..600d9be9706e 100644
+--- a/sound/soc/fsl/fsl-asoc-card.c
++++ b/sound/soc/fsl/fsl-asoc-card.c
+@@ -689,6 +689,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev)
+ asrc_fail:
+ of_node_put(asrc_np);
+ of_node_put(codec_np);
++ put_device(&cpu_pdev->dev);
+ fail:
+ of_node_put(cpu_np);
+
+diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
+index c29200cf755a..9b9a7ec52905 100644
+--- a/sound/soc/fsl/imx-sgtl5000.c
++++ b/sound/soc/fsl/imx-sgtl5000.c
+@@ -108,6 +108,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
+ ret = -EPROBE_DEFER;
+ goto fail;
+ }
++ put_device(&ssi_pdev->dev);
+ codec_dev = of_find_i2c_device_by_node(codec_np);
+ if (!codec_dev) {
+ dev_err(&pdev->dev, "failed to find codec platform device\n");
+diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c
+index 4715527054e5..5661025e8cec 100644
+--- a/sound/soc/qcom/common.c
++++ b/sound/soc/qcom/common.c
+@@ -42,6 +42,9 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
+ link = card->dai_link;
+ for_each_child_of_node(dev->of_node, np) {
+ cpu = of_get_child_by_name(np, "cpu");
++ platform = of_get_child_by_name(np, "platform");
++ codec = of_get_child_by_name(np, "codec");
++
+ if (!cpu) {
+ dev_err(dev, "Can't find cpu DT node\n");
+ ret = -EINVAL;
+@@ -63,8 +66,6 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
+ goto err;
+ }
+
+- platform = of_get_child_by_name(np, "platform");
+- codec = of_get_child_by_name(np, "codec");
+ if (codec && platform) {
+ link->platform_of_node = of_parse_phandle(platform,
+ "sound-dai",
+@@ -100,10 +101,15 @@ int qcom_snd_parse_of(struct snd_soc_card *card)
+ link->dpcm_capture = 1;
+ link->stream_name = link->name;
+ link++;
++
++ of_node_put(cpu);
++ of_node_put(codec);
++ of_node_put(platform);
+ }
+
+ return 0;
+ err:
++ of_node_put(np);
+ of_node_put(cpu);
+ of_node_put(codec);
+ of_node_put(platform);
+diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
+index d49902e818b5..3624557550a1 100644
+--- a/tools/lib/bpf/Makefile
++++ b/tools/lib/bpf/Makefile
+@@ -149,7 +149,8 @@ CMD_TARGETS = $(LIB_FILE)
+
+ TARGETS = $(CMD_TARGETS)
+
+-all: fixdep all_cmd
++all: fixdep
++ $(Q)$(MAKE) all_cmd
+
+ all_cmd: $(CMD_TARGETS)
+
+diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
+index 75de355a63d6..10985d991ed2 100644
+--- a/tools/lib/traceevent/event-parse.c
++++ b/tools/lib/traceevent/event-parse.c
+@@ -2416,7 +2416,7 @@ static int arg_num_eval(struct print_arg *arg, long long *val)
+ static char *arg_eval (struct print_arg *arg)
+ {
+ long long val;
+- static char buf[20];
++ static char buf[24];
+
+ switch (arg->type) {
+ case PRINT_ATOM:
+diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
+index f3aa9d02a5ab..763c2edf52e7 100644
+--- a/tools/perf/builtin-c2c.c
++++ b/tools/perf/builtin-c2c.c
+@@ -2055,6 +2055,12 @@ static int setup_nodes(struct perf_session *session)
+ if (!set)
+ return -ENOMEM;
+
++ nodes[node] = set;
++
++ /* empty node, skip */
++ if (cpu_map__empty(map))
++ continue;
++
+ for (cpu = 0; cpu < map->nr; cpu++) {
+ set_bit(map->map[cpu], set);
+
+@@ -2063,8 +2069,6 @@ static int setup_nodes(struct perf_session *session)
+
+ cpu2node[map->map[cpu]] = node;
+ }
+-
+- nodes[node] = set;
+ }
+
+ setup_nodes_header();
+diff --git a/tools/perf/tests/evsel-tp-sched.c b/tools/perf/tests/evsel-tp-sched.c
+index 67bcbf876776..d0406116c905 100644
+--- a/tools/perf/tests/evsel-tp-sched.c
++++ b/tools/perf/tests/evsel-tp-sched.c
+@@ -43,7 +43,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes
+ return -1;
+ }
+
+- if (perf_evsel__test_field(evsel, "prev_comm", 16, true))
++ if (perf_evsel__test_field(evsel, "prev_comm", 16, false))
+ ret = -1;
+
+ if (perf_evsel__test_field(evsel, "prev_pid", 4, true))
+@@ -55,7 +55,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes
+ if (perf_evsel__test_field(evsel, "prev_state", sizeof(long), true))
+ ret = -1;
+
+- if (perf_evsel__test_field(evsel, "next_comm", 16, true))
++ if (perf_evsel__test_field(evsel, "next_comm", 16, false))
+ ret = -1;
+
+ if (perf_evsel__test_field(evsel, "next_pid", 4, true))
+@@ -73,7 +73,7 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes
+ return -1;
+ }
+
+- if (perf_evsel__test_field(evsel, "comm", 16, true))
++ if (perf_evsel__test_field(evsel, "comm", 16, false))
+ ret = -1;
+
+ if (perf_evsel__test_field(evsel, "pid", 4, true))
+diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
+index 28cd6a17491b..dfee110b3a58 100644
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -1862,6 +1862,7 @@ int symbol__annotate(struct symbol *sym, struct map *map,
+ struct annotation_options *options,
+ struct arch **parch)
+ {
++ struct annotation *notes = symbol__annotation(sym);
+ struct annotate_args args = {
+ .privsize = privsize,
+ .evsel = evsel,
+@@ -1892,6 +1893,7 @@ int symbol__annotate(struct symbol *sym, struct map *map,
+
+ args.ms.map = map;
+ args.ms.sym = sym;
++ notes->start = map__rip_2objdump(map, sym->start);
+
+ return symbol__disassemble(sym, &args);
+ }
+@@ -2746,8 +2748,6 @@ int symbol__annotate2(struct symbol *sym, struct map *map, struct perf_evsel *ev
+
+ symbol__calc_percent(sym, evsel);
+
+- notes->start = map__rip_2objdump(map, sym->start);
+-
+ annotation__set_offsets(notes, size);
+ annotation__mark_jump_targets(notes, sym);
+ annotation__compute_ipc(notes, size);
+diff --git a/tools/perf/util/s390-cpumsf.c b/tools/perf/util/s390-cpumsf.c
+index aa7f8c11fbb7..910f2621d211 100644
+--- a/tools/perf/util/s390-cpumsf.c
++++ b/tools/perf/util/s390-cpumsf.c
+@@ -294,6 +294,11 @@ static bool s390_cpumsf_validate(int machine_type,
+ *dsdes = 85;
+ *bsdes = 32;
+ break;
++ case 2964:
++ case 2965:
++ *dsdes = 112;
++ *bsdes = 32;
++ break;
+ default:
+ /* Illegal trailer entry */
+ return false;
+diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
+index 05d95de14e20..9569cc06e0a7 100644
+--- a/tools/perf/util/scripting-engines/trace-event-python.c
++++ b/tools/perf/util/scripting-engines/trace-event-python.c
+@@ -733,8 +733,7 @@ static PyObject *get_perf_sample_dict(struct perf_sample *sample,
+ Py_FatalError("couldn't create Python dictionary");
+
+ pydict_set_item_string_decref(dict, "ev_name", _PyUnicode_FromString(perf_evsel__name(evsel)));
+- pydict_set_item_string_decref(dict, "attr", _PyUnicode_FromStringAndSize(
+- (const char *)&evsel->attr, sizeof(evsel->attr)));
++ pydict_set_item_string_decref(dict, "attr", _PyBytes_FromStringAndSize((const char *)&evsel->attr, sizeof(evsel->attr)));
+
+ pydict_set_item_string_decref(dict_sample, "pid",
+ _PyLong_FromLong(sample->pid));
+@@ -1494,34 +1493,40 @@ static void _free_command_line(wchar_t **command_line, int num)
+ static int python_start_script(const char *script, int argc, const char **argv)
+ {
+ struct tables *tables = &tables_global;
++ PyMODINIT_FUNC (*initfunc)(void);
+ #if PY_MAJOR_VERSION < 3
+ const char **command_line;
+ #else
+ wchar_t **command_line;
+ #endif
+- char buf[PATH_MAX];
++ /*
++ * Use a non-const name variable to cope with python 2.6's
++ * PyImport_AppendInittab prototype
++ */
++ char buf[PATH_MAX], name[19] = "perf_trace_context";
+ int i, err = 0;
+ FILE *fp;
+
+ #if PY_MAJOR_VERSION < 3
++ initfunc = initperf_trace_context;
+ command_line = malloc((argc + 1) * sizeof(const char *));
+ command_line[0] = script;
+ for (i = 1; i < argc + 1; i++)
+ command_line[i] = argv[i - 1];
+ #else
++ initfunc = PyInit_perf_trace_context;
+ command_line = malloc((argc + 1) * sizeof(wchar_t *));
+ command_line[0] = Py_DecodeLocale(script, NULL);
+ for (i = 1; i < argc + 1; i++)
+ command_line[i] = Py_DecodeLocale(argv[i - 1], NULL);
+ #endif
+
++ PyImport_AppendInittab(name, initfunc);
+ Py_Initialize();
+
+ #if PY_MAJOR_VERSION < 3
+- initperf_trace_context();
+ PySys_SetArgv(argc + 1, (char **)command_line);
+ #else
+- PyInit_perf_trace_context();
+ PySys_SetArgv(argc + 1, command_line);
+ #endif
+
+diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
+index b284276ec963..46daa22b86e3 100644
+--- a/tools/perf/util/sort.c
++++ b/tools/perf/util/sort.c
+@@ -229,8 +229,14 @@ static int64_t _sort__sym_cmp(struct symbol *sym_l, struct symbol *sym_r)
+ if (sym_l == sym_r)
+ return 0;
+
+- if (sym_l->inlined || sym_r->inlined)
+- return strcmp(sym_l->name, sym_r->name);
++ if (sym_l->inlined || sym_r->inlined) {
++ int ret = strcmp(sym_l->name, sym_r->name);
++
++ if (ret)
++ return ret;
++ if ((sym_l->start <= sym_r->end) && (sym_l->end >= sym_r->start))
++ return 0;
++ }
+
+ if (sym_l->start != sym_r->start)
+ return (int64_t)(sym_r->start - sym_l->start);
+diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
+index e767c4a9d4d2..af3f9b9f1e8b 100644
+--- a/tools/perf/util/srcline.c
++++ b/tools/perf/util/srcline.c
+@@ -104,7 +104,7 @@ static struct symbol *new_inline_sym(struct dso *dso,
+ } else {
+ /* create a fake symbol for the inline frame */
+ inline_sym = symbol__new(base_sym ? base_sym->start : 0,
+- base_sym ? base_sym->end : 0,
++ base_sym ? (base_sym->end - base_sym->start) : 0,
+ base_sym ? base_sym->binding : 0,
+ base_sym ? base_sym->type : 0,
+ funcname);
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index 9db5a7378f40..294fc18aba2a 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -32,6 +32,7 @@
+ #include <linux/if_ether.h>
+
+ #include <bpf/bpf.h>
++#include <bpf/libbpf.h>
+
+ #ifdef HAVE_GENHDR
+ # include "autoconf.h"
+@@ -56,6 +57,7 @@
+
+ #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
+ static bool unpriv_disabled = false;
++static int skips;
+
+ struct bpf_test {
+ const char *descr;
+@@ -12770,6 +12772,11 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
+ fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
+ prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
+ "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
++ if (fd_prog < 0 && !bpf_probe_prog_type(prog_type, 0)) {
++ printf("SKIP (unsupported program type %d)\n", prog_type);
++ skips++;
++ goto close_fds;
++ }
+
+ expected_ret = unpriv && test->result_unpriv != UNDEF ?
+ test->result_unpriv : test->result;
+@@ -12905,7 +12912,7 @@ static void get_unpriv_disabled()
+
+ static int do_test(bool unpriv, unsigned int from, unsigned int to)
+ {
+- int i, passes = 0, errors = 0, skips = 0;
++ int i, passes = 0, errors = 0;
+
+ for (i = from; i < to; i++) {
+ struct bpf_test *test = &tests[i];
+diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
+index 83057fa9d391..14cad657bc6a 100644
+--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
+@@ -2920,6 +2920,12 @@ TEST(get_metadata)
+ struct seccomp_metadata md;
+ long ret;
+
++ /* Only real root can get metadata. */
++ if (geteuid()) {
++ XFAIL(return, "get_metadata requires real root");
++ return;
++ }
++
+ ASSERT_EQ(0, pipe(pipefd));
+
+ pid = fork();
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-04-19 19:51 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-04-19 19:51 UTC (permalink / raw
To: gentoo-commits
commit: 0f24bbd911eccbda14a4813938f48fd974f5bdb2
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Apr 19 19:51:13 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Apr 19 19:51:13 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0f24bbd9
Linux patch 4.19.35
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1034_linux-4.19.35.patch | 3735 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3739 insertions(+)
diff --git a/0000_README b/0000_README
index e752acc..fbfea55 100644
--- a/0000_README
+++ b/0000_README
@@ -179,6 +179,10 @@ Patch: 1033_linux-4.19.34.patch
From: http://www.kernel.org
Desc: Linux 4.19.34
+Patch: 1034_linux-4.19.35.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.35
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1034_linux-4.19.35.patch b/1034_linux-4.19.35.patch
new file mode 100644
index 0000000..4caf535
--- /dev/null
+++ b/1034_linux-4.19.35.patch
@@ -0,0 +1,3735 @@
+diff --git a/Makefile b/Makefile
+index 8fdfe0af5862..f4229975b48c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 34
++SUBLEVEL = 35
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -483,7 +483,7 @@ endif
+ ifeq ($(cc-name),clang)
+ ifneq ($(CROSS_COMPILE),)
+ CLANG_FLAGS := --target=$(notdir $(CROSS_COMPILE:%-=%))
+-GCC_TOOLCHAIN_DIR := $(dir $(shell which $(LD)))
++GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit))
+ CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)
+ GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..)
+ endif
+diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
+index c87d01297a01..20bbb899b3b7 100644
+--- a/arch/arm/boot/dts/am335x-evm.dts
++++ b/arch/arm/boot/dts/am335x-evm.dts
+@@ -57,6 +57,24 @@
+ enable-active-high;
+ };
+
++ /* TPS79501 */
++ v1_8d_reg: fixedregulator-v1_8d {
++ compatible = "regulator-fixed";
++ regulator-name = "v1_8d";
++ vin-supply = <&vbat>;
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ };
++
++ /* TPS79501 */
++ v3_3d_reg: fixedregulator-v3_3d {
++ compatible = "regulator-fixed";
++ regulator-name = "v3_3d";
++ vin-supply = <&vbat>;
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ };
++
+ matrix_keypad: matrix_keypad0 {
+ compatible = "gpio-matrix-keypad";
+ debounce-delay-ms = <5>;
+@@ -499,10 +517,10 @@
+ status = "okay";
+
+ /* Regulators */
+- AVDD-supply = <&vaux2_reg>;
+- IOVDD-supply = <&vaux2_reg>;
+- DRVDD-supply = <&vaux2_reg>;
+- DVDD-supply = <&vbat>;
++ AVDD-supply = <&v3_3d_reg>;
++ IOVDD-supply = <&v3_3d_reg>;
++ DRVDD-supply = <&v3_3d_reg>;
++ DVDD-supply = <&v1_8d_reg>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
+index bf1a40e45c97..ba589bc41a57 100644
+--- a/arch/arm/boot/dts/am335x-evmsk.dts
++++ b/arch/arm/boot/dts/am335x-evmsk.dts
+@@ -73,6 +73,24 @@
+ enable-active-high;
+ };
+
++ /* TPS79518 */
++ v1_8d_reg: fixedregulator-v1_8d {
++ compatible = "regulator-fixed";
++ regulator-name = "v1_8d";
++ vin-supply = <&vbat>;
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ };
++
++ /* TPS78633 */
++ v3_3d_reg: fixedregulator-v3_3d {
++ compatible = "regulator-fixed";
++ regulator-name = "v3_3d";
++ vin-supply = <&vbat>;
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ };
++
+ leds {
+ pinctrl-names = "default";
+ pinctrl-0 = <&user_leds_s0>;
+@@ -501,10 +519,10 @@
+ status = "okay";
+
+ /* Regulators */
+- AVDD-supply = <&vaux2_reg>;
+- IOVDD-supply = <&vaux2_reg>;
+- DRVDD-supply = <&vaux2_reg>;
+- DVDD-supply = <&vbat>;
++ AVDD-supply = <&v3_3d_reg>;
++ IOVDD-supply = <&v3_3d_reg>;
++ DRVDD-supply = <&v3_3d_reg>;
++ DVDD-supply = <&v1_8d_reg>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
+index 0840ffb3205c..e6a36a792bae 100644
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -70,7 +70,7 @@
+ compatible = "arm,cortex-a12";
+ reg = <0x501>;
+ resets = <&cru SRST_CORE1>;
+- operating-points = <&cpu_opp_table>;
++ operating-points-v2 = <&cpu_opp_table>;
+ #cooling-cells = <2>; /* min followed by max */
+ clock-latency = <40000>;
+ clocks = <&cru ARMCLK>;
+@@ -80,7 +80,7 @@
+ compatible = "arm,cortex-a12";
+ reg = <0x502>;
+ resets = <&cru SRST_CORE2>;
+- operating-points = <&cpu_opp_table>;
++ operating-points-v2 = <&cpu_opp_table>;
+ #cooling-cells = <2>; /* min followed by max */
+ clock-latency = <40000>;
+ clocks = <&cru ARMCLK>;
+@@ -90,7 +90,7 @@
+ compatible = "arm,cortex-a12";
+ reg = <0x503>;
+ resets = <&cru SRST_CORE3>;
+- operating-points = <&cpu_opp_table>;
++ operating-points-v2 = <&cpu_opp_table>;
+ #cooling-cells = <2>; /* min followed by max */
+ clock-latency = <40000>;
+ clocks = <&cru ARMCLK>;
+diff --git a/arch/arm/boot/dts/sama5d2-pinfunc.h b/arch/arm/boot/dts/sama5d2-pinfunc.h
+index 1c01a6f843d8..28a2e45752fe 100644
+--- a/arch/arm/boot/dts/sama5d2-pinfunc.h
++++ b/arch/arm/boot/dts/sama5d2-pinfunc.h
+@@ -518,7 +518,7 @@
+ #define PIN_PC9__GPIO PINMUX_PIN(PIN_PC9, 0, 0)
+ #define PIN_PC9__FIQ PINMUX_PIN(PIN_PC9, 1, 3)
+ #define PIN_PC9__GTSUCOMP PINMUX_PIN(PIN_PC9, 2, 1)
+-#define PIN_PC9__ISC_D0 PINMUX_PIN(PIN_PC9, 2, 1)
++#define PIN_PC9__ISC_D0 PINMUX_PIN(PIN_PC9, 3, 1)
+ #define PIN_PC9__TIOA4 PINMUX_PIN(PIN_PC9, 4, 2)
+ #define PIN_PC10 74
+ #define PIN_PC10__GPIO PINMUX_PIN(PIN_PC10, 0, 0)
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+index 5272e887a434..c142169a58fc 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+@@ -45,8 +45,7 @@
+
+ vcc_host1_5v: vcc_otg_5v: vcc-host1-5v-regulator {
+ compatible = "regulator-fixed";
+- enable-active-high;
+- gpio = <&gpio0 RK_PD3 GPIO_ACTIVE_HIGH>;
++ gpio = <&gpio0 RK_PA2 GPIO_ACTIVE_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&usb20_host_drv>;
+ regulator-name = "vcc_host1_5v";
+@@ -238,7 +237,7 @@
+
+ usb2 {
+ usb20_host_drv: usb20-host-drv {
+- rockchip,pins = <0 RK_PD3 RK_FUNC_GPIO &pcfg_pull_none>;
++ rockchip,pins = <0 RK_PA2 RK_FUNC_GPIO &pcfg_pull_none>;
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index 3f5a2944300f..e065394360bb 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -1356,11 +1356,11 @@
+
+ sdmmc0 {
+ sdmmc0_clk: sdmmc0-clk {
+- rockchip,pins = <1 RK_PA6 1 &pcfg_pull_none_4ma>;
++ rockchip,pins = <1 RK_PA6 1 &pcfg_pull_none_8ma>;
+ };
+
+ sdmmc0_cmd: sdmmc0-cmd {
+- rockchip,pins = <1 RK_PA4 1 &pcfg_pull_up_4ma>;
++ rockchip,pins = <1 RK_PA4 1 &pcfg_pull_up_8ma>;
+ };
+
+ sdmmc0_dectn: sdmmc0-dectn {
+@@ -1372,14 +1372,14 @@
+ };
+
+ sdmmc0_bus1: sdmmc0-bus1 {
+- rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_4ma>;
++ rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_8ma>;
+ };
+
+ sdmmc0_bus4: sdmmc0-bus4 {
+- rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_4ma>,
+- <1 RK_PA1 1 &pcfg_pull_up_4ma>,
+- <1 RK_PA2 1 &pcfg_pull_up_4ma>,
+- <1 RK_PA3 1 &pcfg_pull_up_4ma>;
++ rockchip,pins = <1 RK_PA0 1 &pcfg_pull_up_8ma>,
++ <1 RK_PA1 1 &pcfg_pull_up_8ma>,
++ <1 RK_PA2 1 &pcfg_pull_up_8ma>,
++ <1 RK_PA3 1 &pcfg_pull_up_8ma>;
+ };
+
+ sdmmc0_gpio: sdmmc0-gpio {
+@@ -1553,50 +1553,50 @@
+ rgmiim1_pins: rgmiim1-pins {
+ rockchip,pins =
+ /* mac_txclk */
+- <1 RK_PB4 2 &pcfg_pull_none_12ma>,
++ <1 RK_PB4 2 &pcfg_pull_none_8ma>,
+ /* mac_rxclk */
+- <1 RK_PB5 2 &pcfg_pull_none_2ma>,
++ <1 RK_PB5 2 &pcfg_pull_none_4ma>,
+ /* mac_mdio */
+- <1 RK_PC3 2 &pcfg_pull_none_2ma>,
++ <1 RK_PC3 2 &pcfg_pull_none_4ma>,
+ /* mac_txen */
+- <1 RK_PD1 2 &pcfg_pull_none_12ma>,
++ <1 RK_PD1 2 &pcfg_pull_none_8ma>,
+ /* mac_clk */
+- <1 RK_PC5 2 &pcfg_pull_none_2ma>,
++ <1 RK_PC5 2 &pcfg_pull_none_4ma>,
+ /* mac_rxdv */
+- <1 RK_PC6 2 &pcfg_pull_none_2ma>,
++ <1 RK_PC6 2 &pcfg_pull_none_4ma>,
+ /* mac_mdc */
+- <1 RK_PC7 2 &pcfg_pull_none_2ma>,
++ <1 RK_PC7 2 &pcfg_pull_none_4ma>,
+ /* mac_rxd1 */
+- <1 RK_PB2 2 &pcfg_pull_none_2ma>,
++ <1 RK_PB2 2 &pcfg_pull_none_4ma>,
+ /* mac_rxd0 */
+- <1 RK_PB3 2 &pcfg_pull_none_2ma>,
++ <1 RK_PB3 2 &pcfg_pull_none_4ma>,
+ /* mac_txd1 */
+- <1 RK_PB0 2 &pcfg_pull_none_12ma>,
++ <1 RK_PB0 2 &pcfg_pull_none_8ma>,
+ /* mac_txd0 */
+- <1 RK_PB1 2 &pcfg_pull_none_12ma>,
++ <1 RK_PB1 2 &pcfg_pull_none_8ma>,
+ /* mac_rxd3 */
+- <1 RK_PB6 2 &pcfg_pull_none_2ma>,
++ <1 RK_PB6 2 &pcfg_pull_none_4ma>,
+ /* mac_rxd2 */
+- <1 RK_PB7 2 &pcfg_pull_none_2ma>,
++ <1 RK_PB7 2 &pcfg_pull_none_4ma>,
+ /* mac_txd3 */
+- <1 RK_PC0 2 &pcfg_pull_none_12ma>,
++ <1 RK_PC0 2 &pcfg_pull_none_8ma>,
+ /* mac_txd2 */
+- <1 RK_PC1 2 &pcfg_pull_none_12ma>,
++ <1 RK_PC1 2 &pcfg_pull_none_8ma>,
+
+ /* mac_txclk */
+- <0 RK_PB0 1 &pcfg_pull_none>,
++ <0 RK_PB0 1 &pcfg_pull_none_8ma>,
+ /* mac_txen */
+- <0 RK_PB4 1 &pcfg_pull_none>,
++ <0 RK_PB4 1 &pcfg_pull_none_8ma>,
+ /* mac_clk */
+- <0 RK_PD0 1 &pcfg_pull_none>,
++ <0 RK_PD0 1 &pcfg_pull_none_4ma>,
+ /* mac_txd1 */
+- <0 RK_PC0 1 &pcfg_pull_none>,
++ <0 RK_PC0 1 &pcfg_pull_none_8ma>,
+ /* mac_txd0 */
+- <0 RK_PC1 1 &pcfg_pull_none>,
++ <0 RK_PC1 1 &pcfg_pull_none_8ma>,
+ /* mac_txd3 */
+- <0 RK_PC7 1 &pcfg_pull_none>,
++ <0 RK_PC7 1 &pcfg_pull_none_8ma>,
+ /* mac_txd2 */
+- <0 RK_PC6 1 &pcfg_pull_none>;
++ <0 RK_PC6 1 &pcfg_pull_none_8ma>;
+ };
+
+ rmiim1_pins: rmiim1-pins {
+diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
+index 07fe2479d310..b447b4db423a 100644
+--- a/arch/arm64/include/asm/futex.h
++++ b/arch/arm64/include/asm/futex.h
+@@ -30,8 +30,8 @@ do { \
+ " prfm pstl1strm, %2\n" \
+ "1: ldxr %w1, %2\n" \
+ insn "\n" \
+-"2: stlxr %w3, %w0, %2\n" \
+-" cbnz %w3, 1b\n" \
++"2: stlxr %w0, %w3, %2\n" \
++" cbnz %w0, 1b\n" \
+ " dmb ish\n" \
+ "3:\n" \
+ " .pushsection .fixup,\"ax\"\n" \
+@@ -50,30 +50,30 @@ do { \
+ static inline int
+ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *_uaddr)
+ {
+- int oldval = 0, ret, tmp;
++ int oldval, ret, tmp;
+ u32 __user *uaddr = __uaccess_mask_ptr(_uaddr);
+
+ pagefault_disable();
+
+ switch (op) {
+ case FUTEX_OP_SET:
+- __futex_atomic_op("mov %w0, %w4",
++ __futex_atomic_op("mov %w3, %w4",
+ ret, oldval, uaddr, tmp, oparg);
+ break;
+ case FUTEX_OP_ADD:
+- __futex_atomic_op("add %w0, %w1, %w4",
++ __futex_atomic_op("add %w3, %w1, %w4",
+ ret, oldval, uaddr, tmp, oparg);
+ break;
+ case FUTEX_OP_OR:
+- __futex_atomic_op("orr %w0, %w1, %w4",
++ __futex_atomic_op("orr %w3, %w1, %w4",
+ ret, oldval, uaddr, tmp, oparg);
+ break;
+ case FUTEX_OP_ANDN:
+- __futex_atomic_op("and %w0, %w1, %w4",
++ __futex_atomic_op("and %w3, %w1, %w4",
+ ret, oldval, uaddr, tmp, ~oparg);
+ break;
+ case FUTEX_OP_XOR:
+- __futex_atomic_op("eor %w0, %w1, %w4",
++ __futex_atomic_op("eor %w3, %w1, %w4",
+ ret, oldval, uaddr, tmp, oparg);
+ break;
+ default:
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index b9da093e0341..a0099be4311a 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -101,10 +101,16 @@ static void dump_instr(const char *lvl, struct pt_regs *regs)
+ void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
+ {
+ struct stackframe frame;
+- int skip;
++ int skip = 0;
+
+ pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
+
++ if (regs) {
++ if (user_mode(regs))
++ return;
++ skip = 1;
++ }
++
+ if (!tsk)
+ tsk = current;
+
+@@ -125,7 +131,6 @@ void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
+ frame.graph = tsk->curr_ret_stack;
+ #endif
+
+- skip = !!regs;
+ printk("Call trace:\n");
+ do {
+ /* skip until specified stack frame */
+@@ -175,15 +180,13 @@ static int __die(const char *str, int err, struct pt_regs *regs)
+ return ret;
+
+ print_modules();
+- __show_regs(regs);
+ pr_emerg("Process %.*s (pid: %d, stack limit = 0x%p)\n",
+ TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk),
+ end_of_stack(tsk));
++ show_regs(regs);
+
+- if (!user_mode(regs)) {
+- dump_backtrace(regs, tsk);
++ if (!user_mode(regs))
+ dump_instr(KERN_EMERG, regs);
+- }
+
+ return ret;
+ }
+diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
+index 787e27964ab9..774c3e17c798 100644
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -450,7 +450,7 @@ void __init arm64_memblock_init(void)
+ * memory spans, randomize the linear region as well.
+ */
+ if (memstart_offset_seed > 0 && range >= ARM64_MEMSTART_ALIGN) {
+- range = range / ARM64_MEMSTART_ALIGN + 1;
++ range /= ARM64_MEMSTART_ALIGN;
+ memstart_addr -= ARM64_MEMSTART_ALIGN *
+ ((range * memstart_offset_seed) >> 16);
+ }
+diff --git a/arch/parisc/include/asm/ptrace.h b/arch/parisc/include/asm/ptrace.h
+index 2a27b275ab09..9ff033d261ab 100644
+--- a/arch/parisc/include/asm/ptrace.h
++++ b/arch/parisc/include/asm/ptrace.h
+@@ -22,13 +22,14 @@ unsigned long profile_pc(struct pt_regs *);
+
+ static inline unsigned long regs_return_value(struct pt_regs *regs)
+ {
+- return regs->gr[20];
++ return regs->gr[28];
+ }
+
+ static inline void instruction_pointer_set(struct pt_regs *regs,
+ unsigned long val)
+ {
+- regs->iaoq[0] = val;
++ regs->iaoq[0] = val;
++ regs->iaoq[1] = val + 4;
+ }
+
+ /* Query offset/name of register from its name/offset */
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index eb39e7e380d7..841db71958cd 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -210,12 +210,6 @@ void __cpuidle arch_cpu_idle(void)
+
+ static int __init parisc_idle_init(void)
+ {
+- const char *marker;
+-
+- /* check QEMU/SeaBIOS marker in PAGE0 */
+- marker = (char *) &PAGE0->pad0;
+- running_on_qemu = (memcmp(marker, "SeaBIOS", 8) == 0);
+-
+ if (!running_on_qemu)
+ cpu_idle_poll_ctrl(1);
+
+diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
+index 4e87c35c22b7..79c8b994e7d1 100644
+--- a/arch/parisc/kernel/setup.c
++++ b/arch/parisc/kernel/setup.c
+@@ -399,6 +399,9 @@ void __init start_parisc(void)
+ int ret, cpunum;
+ struct pdc_coproc_cfg coproc_cfg;
+
++ /* check QEMU/SeaBIOS marker in PAGE0 */
++ running_on_qemu = (memcmp(&PAGE0->pad0, "SeaBIOS", 8) == 0);
++
+ cpunum = smp_processor_id();
+
+ init_cpu_topology();
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
+index bbd1c73243d7..14b0f5b6a373 100644
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -755,12 +755,25 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ if (restore_tm_sigcontexts(current, &uc->uc_mcontext,
+ &uc_transact->uc_mcontext))
+ goto badframe;
+- }
+- else
+- /* Fall through, for non-TM restore */
++ } else
+ #endif
+- if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
+- goto badframe;
++ {
++ /*
++ * Fall through, for non-TM restore
++ *
++ * Unset MSR[TS] on the thread regs since MSR from user
++ * context does not have MSR active, and recheckpoint was
++ * not called since restore_tm_sigcontexts() was not called
++ * also.
++ *
++ * If not unsetting it, the code can RFID to userspace with
++ * MSR[TS] set, but without CPU in the proper state,
++ * causing a TM bad thing.
++ */
++ current->thread.regs->msr &= ~MSR_TS_MASK;
++ if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
++ goto badframe;
++ }
+
+ if (restore_altstack(&uc->uc_stack))
+ goto badframe;
+diff --git a/arch/riscv/include/asm/syscall.h b/arch/riscv/include/asm/syscall.h
+index 8d25f8904c00..1dcde0fda435 100644
+--- a/arch/riscv/include/asm/syscall.h
++++ b/arch/riscv/include/asm/syscall.h
+@@ -78,10 +78,11 @@ static inline void syscall_get_arguments(struct task_struct *task,
+ if (i == 0) {
+ args[0] = regs->orig_a0;
+ args++;
+- i++;
+ n--;
++ } else {
++ i--;
+ }
+- memcpy(args, ®s->a1 + i * sizeof(regs->a1), n * sizeof(args[0]));
++ memcpy(args, ®s->a1 + i, n * sizeof(args[0]));
+ }
+
+ static inline void syscall_set_arguments(struct task_struct *task,
+@@ -93,10 +94,11 @@ static inline void syscall_set_arguments(struct task_struct *task,
+ if (i == 0) {
+ regs->orig_a0 = args[0];
+ args++;
+- i++;
+ n--;
+- }
+- memcpy(®s->a1 + i * sizeof(regs->a1), args, n * sizeof(regs->a0));
++ } else {
++ i--;
++ }
++ memcpy(®s->a1 + i, args, n * sizeof(regs->a1));
+ }
+
+ #endif /* _ASM_RISCV_SYSCALL_H */
+diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
+index c3d7ccd25381..5bfe2243a08f 100644
+--- a/arch/x86/entry/vdso/Makefile
++++ b/arch/x86/entry/vdso/Makefile
+@@ -47,7 +47,7 @@ targets += $(vdso_img_sodbg) $(vdso_img-y:%=vdso%.so)
+ CPPFLAGS_vdso.lds += -P -C
+
+ VDSO_LDFLAGS_vdso.lds = -m elf_x86_64 -soname linux-vdso.so.1 --no-undefined \
+- -z max-page-size=4096 -z common-page-size=4096
++ -z max-page-size=4096
+
+ $(obj)/vdso64.so.dbg: $(obj)/vdso.lds $(vobjs) FORCE
+ $(call if_changed,vdso)
+@@ -98,7 +98,7 @@ CFLAGS_REMOVE_vvar.o = -pg
+
+ CPPFLAGS_vdsox32.lds = $(CPPFLAGS_vdso.lds)
+ VDSO_LDFLAGS_vdsox32.lds = -m elf32_x86_64 -soname linux-vdso.so.1 \
+- -z max-page-size=4096 -z common-page-size=4096
++ -z max-page-size=4096
+
+ # x32-rebranded versions
+ vobjx32s-y := $(vobjs-y:.o=-x32.o)
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index c84584bb9402..3e5dd85b019a 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -3,10 +3,14 @@
+ #include <linux/types.h>
+ #include <linux/init.h>
+ #include <linux/slab.h>
++#include <linux/delay.h>
+ #include <asm/apicdef.h>
++#include <asm/nmi.h>
+
+ #include "../perf_event.h"
+
++static DEFINE_PER_CPU(unsigned int, perf_nmi_counter);
++
+ static __initconst const u64 amd_hw_cache_event_ids
+ [PERF_COUNT_HW_CACHE_MAX]
+ [PERF_COUNT_HW_CACHE_OP_MAX]
+@@ -429,6 +433,132 @@ static void amd_pmu_cpu_dead(int cpu)
+ }
+ }
+
++/*
++ * When a PMC counter overflows, an NMI is used to process the event and
++ * reset the counter. NMI latency can result in the counter being updated
++ * before the NMI can run, which can result in what appear to be spurious
++ * NMIs. This function is intended to wait for the NMI to run and reset
++ * the counter to avoid possible unhandled NMI messages.
++ */
++#define OVERFLOW_WAIT_COUNT 50
++
++static void amd_pmu_wait_on_overflow(int idx)
++{
++ unsigned int i;
++ u64 counter;
++
++ /*
++ * Wait for the counter to be reset if it has overflowed. This loop
++ * should exit very, very quickly, but just in case, don't wait
++ * forever...
++ */
++ for (i = 0; i < OVERFLOW_WAIT_COUNT; i++) {
++ rdmsrl(x86_pmu_event_addr(idx), counter);
++ if (counter & (1ULL << (x86_pmu.cntval_bits - 1)))
++ break;
++
++ /* Might be in IRQ context, so can't sleep */
++ udelay(1);
++ }
++}
++
++static void amd_pmu_disable_all(void)
++{
++ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
++ int idx;
++
++ x86_pmu_disable_all();
++
++ /*
++ * This shouldn't be called from NMI context, but add a safeguard here
++ * to return, since if we're in NMI context we can't wait for an NMI
++ * to reset an overflowed counter value.
++ */
++ if (in_nmi())
++ return;
++
++ /*
++ * Check each counter for overflow and wait for it to be reset by the
++ * NMI if it has overflowed. This relies on the fact that all active
++ * counters are always enabled when this function is caled and
++ * ARCH_PERFMON_EVENTSEL_INT is always set.
++ */
++ for (idx = 0; idx < x86_pmu.num_counters; idx++) {
++ if (!test_bit(idx, cpuc->active_mask))
++ continue;
++
++ amd_pmu_wait_on_overflow(idx);
++ }
++}
++
++static void amd_pmu_disable_event(struct perf_event *event)
++{
++ x86_pmu_disable_event(event);
++
++ /*
++ * This can be called from NMI context (via x86_pmu_stop). The counter
++ * may have overflowed, but either way, we'll never see it get reset
++ * by the NMI if we're already in the NMI. And the NMI latency support
++ * below will take care of any pending NMI that might have been
++ * generated by the overflow.
++ */
++ if (in_nmi())
++ return;
++
++ amd_pmu_wait_on_overflow(event->hw.idx);
++}
++
++/*
++ * Because of NMI latency, if multiple PMC counters are active or other sources
++ * of NMIs are received, the perf NMI handler can handle one or more overflowed
++ * PMC counters outside of the NMI associated with the PMC overflow. If the NMI
++ * doesn't arrive at the LAPIC in time to become a pending NMI, then the kernel
++ * back-to-back NMI support won't be active. This PMC handler needs to take into
++ * account that this can occur, otherwise this could result in unknown NMI
++ * messages being issued. Examples of this is PMC overflow while in the NMI
++ * handler when multiple PMCs are active or PMC overflow while handling some
++ * other source of an NMI.
++ *
++ * Attempt to mitigate this by using the number of active PMCs to determine
++ * whether to return NMI_HANDLED if the perf NMI handler did not handle/reset
++ * any PMCs. The per-CPU perf_nmi_counter variable is set to a minimum of the
++ * number of active PMCs or 2. The value of 2 is used in case an NMI does not
++ * arrive at the LAPIC in time to be collapsed into an already pending NMI.
++ */
++static int amd_pmu_handle_irq(struct pt_regs *regs)
++{
++ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
++ int active, handled;
++
++ /*
++ * Obtain the active count before calling x86_pmu_handle_irq() since
++ * it is possible that x86_pmu_handle_irq() may make a counter
++ * inactive (through x86_pmu_stop).
++ */
++ active = __bitmap_weight(cpuc->active_mask, X86_PMC_IDX_MAX);
++
++ /* Process any counter overflows */
++ handled = x86_pmu_handle_irq(regs);
++
++ /*
++ * If a counter was handled, record the number of possible remaining
++ * NMIs that can occur.
++ */
++ if (handled) {
++ this_cpu_write(perf_nmi_counter,
++ min_t(unsigned int, 2, active));
++
++ return handled;
++ }
++
++ if (!this_cpu_read(perf_nmi_counter))
++ return NMI_DONE;
++
++ this_cpu_dec(perf_nmi_counter);
++
++ return NMI_HANDLED;
++}
++
+ static struct event_constraint *
+ amd_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
+ struct perf_event *event)
+@@ -621,11 +751,11 @@ static ssize_t amd_event_sysfs_show(char *page, u64 config)
+
+ static __initconst const struct x86_pmu amd_pmu = {
+ .name = "AMD",
+- .handle_irq = x86_pmu_handle_irq,
+- .disable_all = x86_pmu_disable_all,
++ .handle_irq = amd_pmu_handle_irq,
++ .disable_all = amd_pmu_disable_all,
+ .enable_all = x86_pmu_enable_all,
+ .enable = x86_pmu_enable_event,
+- .disable = x86_pmu_disable_event,
++ .disable = amd_pmu_disable_event,
+ .hw_config = amd_pmu_hw_config,
+ .schedule_events = x86_schedule_events,
+ .eventsel = MSR_K7_EVNTSEL0,
+@@ -728,7 +858,7 @@ void amd_pmu_enable_virt(void)
+ cpuc->perf_ctr_virt_mask = 0;
+
+ /* Reload all events */
+- x86_pmu_disable_all();
++ amd_pmu_disable_all();
+ x86_pmu_enable_all(0);
+ }
+ EXPORT_SYMBOL_GPL(amd_pmu_enable_virt);
+@@ -746,7 +876,7 @@ void amd_pmu_disable_virt(void)
+ cpuc->perf_ctr_virt_mask = AMD64_EVENTSEL_HOSTONLY;
+
+ /* Reload all events */
+- x86_pmu_disable_all();
++ amd_pmu_disable_all();
+ x86_pmu_enable_all(0);
+ }
+ EXPORT_SYMBOL_GPL(amd_pmu_disable_virt);
+diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
+index a41554350893..c9625bff4328 100644
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -1328,8 +1328,9 @@ void x86_pmu_stop(struct perf_event *event, int flags)
+ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+ struct hw_perf_event *hwc = &event->hw;
+
+- if (__test_and_clear_bit(hwc->idx, cpuc->active_mask)) {
++ if (test_bit(hwc->idx, cpuc->active_mask)) {
+ x86_pmu.disable(event);
++ __clear_bit(hwc->idx, cpuc->active_mask);
+ cpuc->events[hwc->idx] = NULL;
+ WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED);
+ hwc->state |= PERF_HES_STOPPED;
+@@ -1426,16 +1427,8 @@ int x86_pmu_handle_irq(struct pt_regs *regs)
+ apic_write(APIC_LVTPC, APIC_DM_NMI);
+
+ for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+- if (!test_bit(idx, cpuc->active_mask)) {
+- /*
+- * Though we deactivated the counter some cpus
+- * might still deliver spurious interrupts still
+- * in flight. Catch them:
+- */
+- if (__test_and_clear_bit(idx, cpuc->running))
+- handled++;
++ if (!test_bit(idx, cpuc->active_mask))
+ continue;
+- }
+
+ event = cpuc->events[idx];
+
+diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
+index 9f645ba57dbb..33611a74bfff 100644
+--- a/arch/x86/include/asm/bitops.h
++++ b/arch/x86/include/asm/bitops.h
+@@ -36,22 +36,17 @@
+ * bit 0 is the LSB of addr; bit 32 is the LSB of (addr+1).
+ */
+
+-#if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 1)
+-/* Technically wrong, but this avoids compilation errors on some gcc
+- versions. */
+-#define BITOP_ADDR(x) "=m" (*(volatile long *) (x))
+-#else
+-#define BITOP_ADDR(x) "+m" (*(volatile long *) (x))
+-#endif
++#define RLONG_ADDR(x) "m" (*(volatile long *) (x))
++#define WBYTE_ADDR(x) "+m" (*(volatile char *) (x))
+
+-#define ADDR BITOP_ADDR(addr)
++#define ADDR RLONG_ADDR(addr)
+
+ /*
+ * We do the locked ops that don't return the old value as
+ * a mask operation on a byte.
+ */
+ #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
+-#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
++#define CONST_MASK_ADDR(nr, addr) WBYTE_ADDR((void *)(addr) + ((nr)>>3))
+ #define CONST_MASK(nr) (1 << ((nr) & 7))
+
+ /**
+@@ -79,7 +74,7 @@ set_bit(long nr, volatile unsigned long *addr)
+ : "memory");
+ } else {
+ asm volatile(LOCK_PREFIX __ASM_SIZE(bts) " %1,%0"
+- : BITOP_ADDR(addr) : "Ir" (nr) : "memory");
++ : : RLONG_ADDR(addr), "Ir" (nr) : "memory");
+ }
+ }
+
+@@ -94,7 +89,7 @@ set_bit(long nr, volatile unsigned long *addr)
+ */
+ static __always_inline void __set_bit(long nr, volatile unsigned long *addr)
+ {
+- asm volatile(__ASM_SIZE(bts) " %1,%0" : ADDR : "Ir" (nr) : "memory");
++ asm volatile(__ASM_SIZE(bts) " %1,%0" : : ADDR, "Ir" (nr) : "memory");
+ }
+
+ /**
+@@ -116,8 +111,7 @@ clear_bit(long nr, volatile unsigned long *addr)
+ : "iq" ((u8)~CONST_MASK(nr)));
+ } else {
+ asm volatile(LOCK_PREFIX __ASM_SIZE(btr) " %1,%0"
+- : BITOP_ADDR(addr)
+- : "Ir" (nr));
++ : : RLONG_ADDR(addr), "Ir" (nr) : "memory");
+ }
+ }
+
+@@ -137,7 +131,7 @@ static __always_inline void clear_bit_unlock(long nr, volatile unsigned long *ad
+
+ static __always_inline void __clear_bit(long nr, volatile unsigned long *addr)
+ {
+- asm volatile(__ASM_SIZE(btr) " %1,%0" : ADDR : "Ir" (nr));
++ asm volatile(__ASM_SIZE(btr) " %1,%0" : : ADDR, "Ir" (nr) : "memory");
+ }
+
+ static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile unsigned long *addr)
+@@ -145,7 +139,7 @@ static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile
+ bool negative;
+ asm volatile(LOCK_PREFIX "andb %2,%1"
+ CC_SET(s)
+- : CC_OUT(s) (negative), ADDR
++ : CC_OUT(s) (negative), WBYTE_ADDR(addr)
+ : "ir" ((char) ~(1 << nr)) : "memory");
+ return negative;
+ }
+@@ -161,13 +155,9 @@ static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile
+ * __clear_bit() is non-atomic and implies release semantics before the memory
+ * operation. It can be used for an unlock if no other CPUs can concurrently
+ * modify other bits in the word.
+- *
+- * No memory barrier is required here, because x86 cannot reorder stores past
+- * older loads. Same principle as spin_unlock.
+ */
+ static __always_inline void __clear_bit_unlock(long nr, volatile unsigned long *addr)
+ {
+- barrier();
+ __clear_bit(nr, addr);
+ }
+
+@@ -182,7 +172,7 @@ static __always_inline void __clear_bit_unlock(long nr, volatile unsigned long *
+ */
+ static __always_inline void __change_bit(long nr, volatile unsigned long *addr)
+ {
+- asm volatile(__ASM_SIZE(btc) " %1,%0" : ADDR : "Ir" (nr));
++ asm volatile(__ASM_SIZE(btc) " %1,%0" : : ADDR, "Ir" (nr) : "memory");
+ }
+
+ /**
+@@ -202,8 +192,7 @@ static __always_inline void change_bit(long nr, volatile unsigned long *addr)
+ : "iq" ((u8)CONST_MASK(nr)));
+ } else {
+ asm volatile(LOCK_PREFIX __ASM_SIZE(btc) " %1,%0"
+- : BITOP_ADDR(addr)
+- : "Ir" (nr));
++ : : RLONG_ADDR(addr), "Ir" (nr) : "memory");
+ }
+ }
+
+@@ -249,8 +238,8 @@ static __always_inline bool __test_and_set_bit(long nr, volatile unsigned long *
+
+ asm(__ASM_SIZE(bts) " %2,%1"
+ CC_SET(c)
+- : CC_OUT(c) (oldbit), ADDR
+- : "Ir" (nr));
++ : CC_OUT(c) (oldbit)
++ : ADDR, "Ir" (nr) : "memory");
+ return oldbit;
+ }
+
+@@ -290,8 +279,8 @@ static __always_inline bool __test_and_clear_bit(long nr, volatile unsigned long
+
+ asm volatile(__ASM_SIZE(btr) " %2,%1"
+ CC_SET(c)
+- : CC_OUT(c) (oldbit), ADDR
+- : "Ir" (nr));
++ : CC_OUT(c) (oldbit)
++ : ADDR, "Ir" (nr) : "memory");
+ return oldbit;
+ }
+
+@@ -302,8 +291,8 @@ static __always_inline bool __test_and_change_bit(long nr, volatile unsigned lon
+
+ asm volatile(__ASM_SIZE(btc) " %2,%1"
+ CC_SET(c)
+- : CC_OUT(c) (oldbit), ADDR
+- : "Ir" (nr) : "memory");
++ : CC_OUT(c) (oldbit)
++ : ADDR, "Ir" (nr) : "memory");
+
+ return oldbit;
+ }
+@@ -335,7 +324,7 @@ static __always_inline bool variable_test_bit(long nr, volatile const unsigned l
+ asm volatile(__ASM_SIZE(bt) " %2,%1"
+ CC_SET(c)
+ : CC_OUT(c) (oldbit)
+- : "m" (*(unsigned long *)addr), "Ir" (nr));
++ : "m" (*(unsigned long *)addr), "Ir" (nr) : "memory");
+
+ return oldbit;
+ }
+diff --git a/arch/x86/include/asm/string_32.h b/arch/x86/include/asm/string_32.h
+index 55d392c6bd29..2fd165f1cffa 100644
+--- a/arch/x86/include/asm/string_32.h
++++ b/arch/x86/include/asm/string_32.h
+@@ -179,14 +179,7 @@ static inline void *__memcpy3d(void *to, const void *from, size_t len)
+ * No 3D Now!
+ */
+
+-#if (__GNUC__ >= 4)
+ #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
+-#else
+-#define memcpy(t, f, n) \
+- (__builtin_constant_p((n)) \
+- ? __constant_memcpy((t), (f), (n)) \
+- : __memcpy((t), (f), (n)))
+-#endif
+
+ #endif
+ #endif /* !CONFIG_FORTIFY_SOURCE */
+@@ -282,12 +275,7 @@ void *__constant_c_and_count_memset(void *s, unsigned long pattern,
+
+ {
+ int d0, d1;
+-#if __GNUC__ == 4 && __GNUC_MINOR__ == 0
+- /* Workaround for broken gcc 4.0 */
+- register unsigned long eax asm("%eax") = pattern;
+-#else
+ unsigned long eax = pattern;
+-#endif
+
+ switch (count % 4) {
+ case 0:
+@@ -321,15 +309,7 @@ void *__constant_c_and_count_memset(void *s, unsigned long pattern,
+ #define __HAVE_ARCH_MEMSET
+ extern void *memset(void *, int, size_t);
+ #ifndef CONFIG_FORTIFY_SOURCE
+-#if (__GNUC__ >= 4)
+ #define memset(s, c, count) __builtin_memset(s, c, count)
+-#else
+-#define memset(s, c, count) \
+- (__builtin_constant_p(c) \
+- ? __constant_c_x_memset((s), (0x01010101UL * (unsigned char)(c)), \
+- (count)) \
+- : __memset((s), (c), (count)))
+-#endif
+ #endif /* !CONFIG_FORTIFY_SOURCE */
+
+ #define __HAVE_ARCH_MEMSET16
+diff --git a/arch/x86/include/asm/string_64.h b/arch/x86/include/asm/string_64.h
+index d33f92b9fa22..052a7a4ac025 100644
+--- a/arch/x86/include/asm/string_64.h
++++ b/arch/x86/include/asm/string_64.h
+@@ -32,21 +32,6 @@ static __always_inline void *__inline_memcpy(void *to, const void *from, size_t
+ extern void *memcpy(void *to, const void *from, size_t len);
+ extern void *__memcpy(void *to, const void *from, size_t len);
+
+-#ifndef CONFIG_FORTIFY_SOURCE
+-#if (__GNUC__ == 4 && __GNUC_MINOR__ < 3) || __GNUC__ < 4
+-#define memcpy(dst, src, len) \
+-({ \
+- size_t __len = (len); \
+- void *__ret; \
+- if (__builtin_constant_p(len) && __len >= 64) \
+- __ret = __memcpy((dst), (src), __len); \
+- else \
+- __ret = __builtin_memcpy((dst), (src), __len); \
+- __ret; \
+-})
+-#endif
+-#endif /* !CONFIG_FORTIFY_SOURCE */
+-
+ #define __HAVE_ARCH_MEMSET
+ void *memset(void *s, int c, size_t n);
+ void *__memset(void *s, int c, size_t n);
+diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
+index ef05bea7010d..6b5c710846f5 100644
+--- a/arch/x86/include/asm/xen/hypercall.h
++++ b/arch/x86/include/asm/xen/hypercall.h
+@@ -206,6 +206,9 @@ xen_single_call(unsigned int call,
+ __HYPERCALL_DECLS;
+ __HYPERCALL_5ARG(a1, a2, a3, a4, a5);
+
++ if (call >= PAGE_SIZE / sizeof(hypercall_page[0]))
++ return -EINVAL;
++
+ asm volatile(CALL_NOSPEC
+ : __HYPERCALL_5PARAM
+ : [thunk_target] "a" (&hypercall_page[call])
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index b47541962012..6dc72804fe6e 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -6398,11 +6398,11 @@ e_free:
+ return ret;
+ }
+
+-static int get_num_contig_pages(int idx, struct page **inpages,
+- unsigned long npages)
++static unsigned long get_num_contig_pages(unsigned long idx,
++ struct page **inpages, unsigned long npages)
+ {
+ unsigned long paddr, next_paddr;
+- int i = idx + 1, pages = 1;
++ unsigned long i = idx + 1, pages = 1;
+
+ /* find the number of contiguous pages starting from idx */
+ paddr = __sme_page_pa(inpages[idx]);
+@@ -6421,12 +6421,12 @@ static int get_num_contig_pages(int idx, struct page **inpages,
+
+ static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
+ {
+- unsigned long vaddr, vaddr_end, next_vaddr, npages, size;
++ unsigned long vaddr, vaddr_end, next_vaddr, npages, pages, size, i;
+ struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
+ struct kvm_sev_launch_update_data params;
+ struct sev_data_launch_update_data *data;
+ struct page **inpages;
+- int i, ret, pages;
++ int ret;
+
+ if (!sev_guest(kvm))
+ return -ENOTTY;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index f99f59625da5..6b6bcafd1d2c 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -11582,6 +11582,17 @@ static int nested_vmx_check_tpr_shadow_controls(struct kvm_vcpu *vcpu,
+ return 0;
+ }
+
++static inline void enable_x2apic_msr_intercepts(unsigned long *msr_bitmap) {
++ int msr;
++
++ for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
++ unsigned word = msr / BITS_PER_LONG;
++
++ msr_bitmap[word] = ~0;
++ msr_bitmap[word + (0x800 / sizeof(long))] = ~0;
++ }
++}
++
+ /*
+ * Merge L0's and L1's MSR bitmap, return false to indicate that
+ * we do not use the hardware.
+@@ -11623,39 +11634,44 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
+ return false;
+
+ msr_bitmap_l1 = (unsigned long *)kmap(page);
+- if (nested_cpu_has_apic_reg_virt(vmcs12)) {
+- /*
+- * L0 need not intercept reads for MSRs between 0x800 and 0x8ff, it
+- * just lets the processor take the value from the virtual-APIC page;
+- * take those 256 bits directly from the L1 bitmap.
+- */
+- for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
+- unsigned word = msr / BITS_PER_LONG;
+- msr_bitmap_l0[word] = msr_bitmap_l1[word];
+- msr_bitmap_l0[word + (0x800 / sizeof(long))] = ~0;
+- }
+- } else {
+- for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
+- unsigned word = msr / BITS_PER_LONG;
+- msr_bitmap_l0[word] = ~0;
+- msr_bitmap_l0[word + (0x800 / sizeof(long))] = ~0;
+- }
+- }
+
+- nested_vmx_disable_intercept_for_msr(
+- msr_bitmap_l1, msr_bitmap_l0,
+- X2APIC_MSR(APIC_TASKPRI),
+- MSR_TYPE_W);
++ /*
++ * To keep the control flow simple, pay eight 8-byte writes (sixteen
++ * 4-byte writes on 32-bit systems) up front to enable intercepts for
++ * the x2APIC MSR range and selectively disable them below.
++ */
++ enable_x2apic_msr_intercepts(msr_bitmap_l0);
++
++ if (nested_cpu_has_virt_x2apic_mode(vmcs12)) {
++ if (nested_cpu_has_apic_reg_virt(vmcs12)) {
++ /*
++ * L0 need not intercept reads for MSRs between 0x800
++ * and 0x8ff, it just lets the processor take the value
++ * from the virtual-APIC page; take those 256 bits
++ * directly from the L1 bitmap.
++ */
++ for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
++ unsigned word = msr / BITS_PER_LONG;
++
++ msr_bitmap_l0[word] = msr_bitmap_l1[word];
++ }
++ }
+
+- if (nested_cpu_has_vid(vmcs12)) {
+- nested_vmx_disable_intercept_for_msr(
+- msr_bitmap_l1, msr_bitmap_l0,
+- X2APIC_MSR(APIC_EOI),
+- MSR_TYPE_W);
+ nested_vmx_disable_intercept_for_msr(
+ msr_bitmap_l1, msr_bitmap_l0,
+- X2APIC_MSR(APIC_SELF_IPI),
+- MSR_TYPE_W);
++ X2APIC_MSR(APIC_TASKPRI),
++ MSR_TYPE_R | MSR_TYPE_W);
++
++ if (nested_cpu_has_vid(vmcs12)) {
++ nested_vmx_disable_intercept_for_msr(
++ msr_bitmap_l1, msr_bitmap_l0,
++ X2APIC_MSR(APIC_EOI),
++ MSR_TYPE_W);
++ nested_vmx_disable_intercept_for_msr(
++ msr_bitmap_l1, msr_bitmap_l0,
++ X2APIC_MSR(APIC_SELF_IPI),
++ MSR_TYPE_W);
++ }
+ }
+
+ if (spec_ctrl)
+@@ -12836,11 +12852,15 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
+ nested_cache_shadow_vmcs12(vcpu, vmcs12);
+
+ /*
+- * If we're entering a halted L2 vcpu and the L2 vcpu won't be woken
+- * by event injection, halt vcpu.
++ * If we're entering a halted L2 vcpu and the L2 vcpu won't be
++ * awakened by event injection or by an NMI-window VM-exit or
++ * by an interrupt-window VM-exit, halt the vcpu.
+ */
+ if ((vmcs12->guest_activity_state == GUEST_ACTIVITY_HLT) &&
+- !(vmcs12->vm_entry_intr_info_field & INTR_INFO_VALID_MASK)) {
++ !(vmcs12->vm_entry_intr_info_field & INTR_INFO_VALID_MASK) &&
++ !(vmcs12->cpu_based_vm_exec_control & CPU_BASED_VIRTUAL_NMI_PENDING) &&
++ !((vmcs12->cpu_based_vm_exec_control & CPU_BASED_VIRTUAL_INTR_PENDING) &&
++ (vmcs12->guest_rflags & X86_EFLAGS_IF))) {
+ vmx->nested.nested_run_pending = 0;
+ return kvm_vcpu_halt(vcpu);
+ }
+diff --git a/arch/xtensa/kernel/stacktrace.c b/arch/xtensa/kernel/stacktrace.c
+index 0df4080fa20f..a94da7dd3eae 100644
+--- a/arch/xtensa/kernel/stacktrace.c
++++ b/arch/xtensa/kernel/stacktrace.c
+@@ -253,10 +253,14 @@ static int return_address_cb(struct stackframe *frame, void *data)
+ return 1;
+ }
+
++/*
++ * level == 0 is for the return address from the caller of this function,
++ * not from this function itself.
++ */
+ unsigned long return_address(unsigned level)
+ {
+ struct return_addr_data r = {
+- .skip = level + 1,
++ .skip = level,
+ };
+ walk_stackframe(stack_pointer(NULL), return_address_cb, &r);
+ return r.addr;
+diff --git a/block/bio.c b/block/bio.c
+index 55a5386fd431..3d757055305f 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -1240,8 +1240,11 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
+ }
+ }
+
+- if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes)
++ if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes) {
++ if (!map_data)
++ __free_page(page);
+ break;
++ }
+
+ len -= bytes;
+ offset = 0;
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index 78f9de260d5f..2f4641e5ecde 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -523,6 +523,10 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,
+ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
++ status = acpi_ut_add_address_range(obj_desc->region.space_id,
++ obj_desc->region.address,
++ obj_desc->region.length, node);
++
+ /* Now the address and length are valid for this opregion */
+
+ obj_desc->region.flags |= AOPOBJ_DATA_VALID;
+diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
+index e10fec99a182..4424997ecf30 100644
+--- a/drivers/acpi/acpica/evgpe.c
++++ b/drivers/acpi/acpica/evgpe.c
+@@ -81,8 +81,12 @@ acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info)
+
+ ACPI_FUNCTION_TRACE(ev_enable_gpe);
+
+- /* Enable the requested GPE */
++ /* Clear the GPE status */
++ status = acpi_hw_clear_gpe(gpe_event_info);
++ if (ACPI_FAILURE(status))
++ return_ACPI_STATUS(status);
+
++ /* Enable the requested GPE */
+ status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_ENABLE);
+ return_ACPI_STATUS(status);
+ }
+diff --git a/drivers/acpi/acpica/nsobject.c b/drivers/acpi/acpica/nsobject.c
+index 8638f43cfc3d..79d86da1c892 100644
+--- a/drivers/acpi/acpica/nsobject.c
++++ b/drivers/acpi/acpica/nsobject.c
+@@ -186,6 +186,10 @@ void acpi_ns_detach_object(struct acpi_namespace_node *node)
+ }
+ }
+
++ if (obj_desc->common.type == ACPI_TYPE_REGION) {
++ acpi_ut_remove_address_range(obj_desc->region.space_id, node);
++ }
++
+ /* Clear the Node entry in all cases */
+
+ node->object = NULL;
+diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
+index 40728491f37b..1df9cb8e659e 100644
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -343,7 +343,7 @@ config XILINX_HWICAP
+
+ config R3964
+ tristate "Siemens R3964 line discipline"
+- depends on TTY
++ depends on TTY && BROKEN
+ ---help---
+ This driver allows synchronous communication with devices using the
+ Siemens R3964 packet protocol. Unless you are dealing with special
+diff --git a/drivers/clk/meson/meson-aoclk.c b/drivers/clk/meson/meson-aoclk.c
+index 258c8d259ea1..f965845917e3 100644
+--- a/drivers/clk/meson/meson-aoclk.c
++++ b/drivers/clk/meson/meson-aoclk.c
+@@ -65,20 +65,15 @@ int meson_aoclkc_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- /* Populate regmap */
+- for (clkid = 0; clkid < data->num_clks; clkid++)
++ /*
++ * Populate regmap and register all clks
++ */
++ for (clkid = 0; clkid < data->num_clks; clkid++) {
+ data->clks[clkid]->map = regmap;
+
+- /* Register all clks */
+- for (clkid = 0; clkid < data->hw_data->num; clkid++) {
+- if (!data->hw_data->hws[clkid])
+- continue;
+-
+ ret = devm_clk_hw_register(dev, data->hw_data->hws[clkid]);
+- if (ret) {
+- dev_err(dev, "Clock registration failed\n");
++ if (ret)
+ return ret;
+- }
+ }
+
+ return devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get,
+diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
+index 00aad8164dec..542f31ce108f 100644
+--- a/drivers/gpu/drm/i915/gvt/gtt.c
++++ b/drivers/gpu/drm/i915/gvt/gtt.c
+@@ -1940,7 +1940,7 @@ void _intel_vgpu_mm_release(struct kref *mm_ref)
+ */
+ void intel_vgpu_unpin_mm(struct intel_vgpu_mm *mm)
+ {
+- atomic_dec(&mm->pincount);
++ atomic_dec_if_positive(&mm->pincount);
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
+index 43aa058e29fc..663a7c9ca3d3 100644
+--- a/drivers/gpu/drm/i915/gvt/scheduler.c
++++ b/drivers/gpu/drm/i915/gvt/scheduler.c
+@@ -1389,8 +1389,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
+ intel_runtime_pm_put(dev_priv);
+ }
+
+- if (ret && (vgpu_is_vm_unhealthy(ret))) {
+- enter_failsafe_mode(vgpu, GVT_FAILSAFE_GUEST_ERR);
++ if (ret) {
++ if (vgpu_is_vm_unhealthy(ret))
++ enter_failsafe_mode(vgpu, GVT_FAILSAFE_GUEST_ERR);
+ intel_vgpu_destroy_workload(workload);
+ return ERR_PTR(ret);
+ }
+diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
+index 9ef515df724b..54e767bd5ddb 100644
+--- a/drivers/gpu/drm/udl/udl_drv.c
++++ b/drivers/gpu/drm/udl/udl_drv.c
+@@ -51,6 +51,7 @@ static struct drm_driver driver = {
+ .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME,
+ .load = udl_driver_load,
+ .unload = udl_driver_unload,
++ .release = udl_driver_release,
+
+ /* gem hooks */
+ .gem_free_object_unlocked = udl_gem_free_object,
+diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
+index e9e9b1ff678e..4ae67d882eae 100644
+--- a/drivers/gpu/drm/udl/udl_drv.h
++++ b/drivers/gpu/drm/udl/udl_drv.h
+@@ -104,6 +104,7 @@ void udl_urb_completion(struct urb *urb);
+
+ int udl_driver_load(struct drm_device *dev, unsigned long flags);
+ void udl_driver_unload(struct drm_device *dev);
++void udl_driver_release(struct drm_device *dev);
+
+ int udl_fbdev_init(struct drm_device *dev);
+ void udl_fbdev_cleanup(struct drm_device *dev);
+diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
+index 1b014d92855b..19055dda3140 100644
+--- a/drivers/gpu/drm/udl/udl_main.c
++++ b/drivers/gpu/drm/udl/udl_main.c
+@@ -378,6 +378,12 @@ void udl_driver_unload(struct drm_device *dev)
+ udl_free_urb_list(dev);
+
+ udl_fbdev_cleanup(dev);
+- udl_modeset_cleanup(dev);
+ kfree(udl);
+ }
++
++void udl_driver_release(struct drm_device *dev)
++{
++ udl_modeset_cleanup(dev);
++ drm_dev_fini(dev);
++ kfree(dev);
++}
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index 81da17a42dc9..c7adaca2ab01 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -1755,6 +1755,7 @@ config SENSORS_VT8231
+ config SENSORS_W83773G
+ tristate "Nuvoton W83773G"
+ depends on I2C
++ select REGMAP_I2C
+ help
+ If you say yes here you get support for the Nuvoton W83773G hardware
+ monitoring chip.
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 96d5fb3f6199..bc6ef2303f0b 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -908,7 +908,7 @@ static void copy_from_journal(struct dm_integrity_c *ic, unsigned section, unsig
+ static bool ranges_overlap(struct dm_integrity_range *range1, struct dm_integrity_range *range2)
+ {
+ return range1->logical_sector < range2->logical_sector + range2->n_sectors &&
+- range2->logical_sector + range2->n_sectors > range2->logical_sector;
++ range1->logical_sector + range1->n_sectors > range2->logical_sector;
+ }
+
+ static bool add_new_range(struct dm_integrity_c *ic, struct dm_integrity_range *new_range, bool check_waiting)
+@@ -954,8 +954,6 @@ static void remove_range_unlocked(struct dm_integrity_c *ic, struct dm_integrity
+ struct dm_integrity_range *last_range =
+ list_first_entry(&ic->wait_list, struct dm_integrity_range, wait_entry);
+ struct task_struct *last_range_task;
+- if (!ranges_overlap(range, last_range))
+- break;
+ last_range_task = last_range->task;
+ list_del(&last_range->wait_entry);
+ if (!add_new_range(ic, last_range, false)) {
+@@ -3174,7 +3172,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ journal_watermark = val;
+ else if (sscanf(opt_string, "commit_time:%u%c", &val, &dummy) == 1)
+ sync_msec = val;
+- else if (!memcmp(opt_string, "meta_device:", strlen("meta_device:"))) {
++ else if (!strncmp(opt_string, "meta_device:", strlen("meta_device:"))) {
+ if (ic->meta_dev) {
+ dm_put_device(ti, ic->meta_dev);
+ ic->meta_dev = NULL;
+@@ -3193,17 +3191,17 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ goto bad;
+ }
+ ic->sectors_per_block = val >> SECTOR_SHIFT;
+- } else if (!memcmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
++ } else if (!strncmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
+ r = get_alg_and_key(opt_string, &ic->internal_hash_alg, &ti->error,
+ "Invalid internal_hash argument");
+ if (r)
+ goto bad;
+- } else if (!memcmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
++ } else if (!strncmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
+ r = get_alg_and_key(opt_string, &ic->journal_crypt_alg, &ti->error,
+ "Invalid journal_crypt argument");
+ if (r)
+ goto bad;
+- } else if (!memcmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
++ } else if (!strncmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
+ r = get_alg_and_key(opt_string, &ic->journal_mac_alg, &ti->error,
+ "Invalid journal_mac argument");
+ if (r)
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 3d0e2c198f06..c7fe4789c40e 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1872,6 +1872,36 @@ static bool dm_table_supports_secure_erase(struct dm_table *t)
+ return true;
+ }
+
++static int device_requires_stable_pages(struct dm_target *ti,
++ struct dm_dev *dev, sector_t start,
++ sector_t len, void *data)
++{
++ struct request_queue *q = bdev_get_queue(dev->bdev);
++
++ return q && bdi_cap_stable_pages_required(q->backing_dev_info);
++}
++
++/*
++ * If any underlying device requires stable pages, a table must require
++ * them as well. Only targets that support iterate_devices are considered:
++ * don't want error, zero, etc to require stable pages.
++ */
++static bool dm_table_requires_stable_pages(struct dm_table *t)
++{
++ struct dm_target *ti;
++ unsigned i;
++
++ for (i = 0; i < dm_table_get_num_targets(t); i++) {
++ ti = dm_table_get_target(t, i);
++
++ if (ti->type->iterate_devices &&
++ ti->type->iterate_devices(ti, device_requires_stable_pages, NULL))
++ return true;
++ }
++
++ return false;
++}
++
+ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
+ struct queue_limits *limits)
+ {
+@@ -1929,6 +1959,15 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
+
+ dm_table_verify_integrity(t);
+
++ /*
++ * Some devices don't use blk_integrity but still want stable pages
++ * because they do their own checksumming.
++ */
++ if (dm_table_requires_stable_pages(t))
++ q->backing_dev_info->capabilities |= BDI_CAP_STABLE_WRITES;
++ else
++ q->backing_dev_info->capabilities &= ~BDI_CAP_STABLE_WRITES;
++
+ /*
+ * Determine whether or not this queue's I/O timings contribute
+ * to the entropy pool, Only request-based targets use this.
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 07d2949a8746..42768fe92b41 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1007,15 +1007,7 @@ int dm_set_target_max_io_len(struct dm_target *ti, sector_t len)
+ return -EINVAL;
+ }
+
+- /*
+- * BIO based queue uses its own splitting. When multipage bvecs
+- * is switched on, size of the incoming bio may be too big to
+- * be handled in some targets, such as crypt.
+- *
+- * When these targets are ready for the big bio, we can remove
+- * the limit.
+- */
+- ti->max_io_len = min_t(uint32_t, len, BIO_MAX_PAGES * PAGE_SIZE);
++ ti->max_io_len = (uint32_t) len;
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 0bd93bb7d1a2..581ad0a17d0c 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1092,6 +1092,8 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
+ tpa_info = &rxr->rx_tpa[agg_id];
+
+ if (unlikely(cons != rxr->rx_next_cons)) {
++ netdev_warn(bp->dev, "TPA cons %x != expected cons %x\n",
++ cons, rxr->rx_next_cons);
+ bnxt_sched_reset(bp, rxr);
+ return;
+ }
+@@ -1544,15 +1546,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons,
+ }
+
+ cons = rxcmp->rx_cmp_opaque;
+- rx_buf = &rxr->rx_buf_ring[cons];
+- data = rx_buf->data;
+- data_ptr = rx_buf->data_ptr;
+ if (unlikely(cons != rxr->rx_next_cons)) {
+ int rc1 = bnxt_discard_rx(bp, bnapi, raw_cons, rxcmp);
+
++ netdev_warn(bp->dev, "RX cons %x != expected cons %x\n",
++ cons, rxr->rx_next_cons);
+ bnxt_sched_reset(bp, rxr);
+ return rc1;
+ }
++ rx_buf = &rxr->rx_buf_ring[cons];
++ data = rx_buf->data;
++ data_ptr = rx_buf->data_ptr;
+ prefetch(data_ptr);
+
+ misc = le32_to_cpu(rxcmp->rx_cmp_misc_v1);
+@@ -1569,11 +1573,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons,
+
+ rx_buf->data = NULL;
+ if (rxcmp1->rx_cmp_cfa_code_errors_v2 & RX_CMP_L2_ERRORS) {
++ u32 rx_err = le32_to_cpu(rxcmp1->rx_cmp_cfa_code_errors_v2);
++
+ bnxt_reuse_rx_data(rxr, cons, data);
+ if (agg_bufs)
+ bnxt_reuse_rx_agg_bufs(bnapi, cp_cons, agg_bufs);
+
+ rc = -EIO;
++ if (rx_err & RX_CMPL_ERRORS_BUFFER_ERROR_MASK) {
++ netdev_warn(bp->dev, "RX buffer error %x\n", rx_err);
++ bnxt_sched_reset(bp, rxr);
++ }
+ goto next_rx;
+ }
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index c8704b1690eb..a475f36ddf8c 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1888,6 +1888,7 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
+ */
+ adapter->state = VNIC_PROBED;
+
++ reinit_completion(&adapter->init_done);
+ rc = init_crq_queue(adapter);
+ if (rc) {
+ netdev_err(adapter->netdev,
+@@ -4569,7 +4570,7 @@ static int ibmvnic_reset_init(struct ibmvnic_adapter *adapter)
+ old_num_rx_queues = adapter->req_rx_queues;
+ old_num_tx_queues = adapter->req_tx_queues;
+
+- init_completion(&adapter->init_done);
++ reinit_completion(&adapter->init_done);
+ adapter->init_done_rc = 0;
+ ibmvnic_send_crq_init(adapter);
+ if (!wait_for_completion_timeout(&adapter->init_done, timeout)) {
+@@ -4624,7 +4625,6 @@ static int ibmvnic_init(struct ibmvnic_adapter *adapter)
+
+ adapter->from_passive_init = false;
+
+- init_completion(&adapter->init_done);
+ adapter->init_done_rc = 0;
+ ibmvnic_send_crq_init(adapter);
+ if (!wait_for_completion_timeout(&adapter->init_done, timeout)) {
+@@ -4703,6 +4703,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
+ INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
+ INIT_LIST_HEAD(&adapter->rwi_list);
+ spin_lock_init(&adapter->rwi_lock);
++ init_completion(&adapter->init_done);
+ adapter->resetting = false;
+
+ adapter->mac_change_pending = false;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+index eac245a93f91..4ab0d030b544 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+@@ -122,7 +122,9 @@ out:
+ return err;
+ }
+
+-/* xoff = ((301+2.16 * len [m]) * speed [Gbps] + 2.72 MTU [B]) */
++/* xoff = ((301+2.16 * len [m]) * speed [Gbps] + 2.72 MTU [B])
++ * minimum speed value is 40Gbps
++ */
+ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
+ {
+ u32 speed;
+@@ -130,10 +132,9 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
+ int err;
+
+ err = mlx5e_port_linkspeed(priv->mdev, &speed);
+- if (err) {
+- mlx5_core_warn(priv->mdev, "cannot get port speed\n");
+- return 0;
+- }
++ if (err)
++ speed = SPEED_40000;
++ speed = max_t(u32, speed, SPEED_40000);
+
+ xoff = (301 + 216 * priv->dcbx.cable_len / 100) * speed / 1000 + 272 * mtu / 100;
+
+@@ -142,7 +143,7 @@ static u32 calculate_xoff(struct mlx5e_priv *priv, unsigned int mtu)
+ }
+
+ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
+- u32 xoff, unsigned int mtu)
++ u32 xoff, unsigned int max_mtu)
+ {
+ int i;
+
+@@ -154,11 +155,12 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
+ }
+
+ if (port_buffer->buffer[i].size <
+- (xoff + mtu + (1 << MLX5E_BUFFER_CELL_SHIFT)))
++ (xoff + max_mtu + (1 << MLX5E_BUFFER_CELL_SHIFT)))
+ return -ENOMEM;
+
+ port_buffer->buffer[i].xoff = port_buffer->buffer[i].size - xoff;
+- port_buffer->buffer[i].xon = port_buffer->buffer[i].xoff - mtu;
++ port_buffer->buffer[i].xon =
++ port_buffer->buffer[i].xoff - max_mtu;
+ }
+
+ return 0;
+@@ -166,7 +168,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
+
+ /**
+ * update_buffer_lossy()
+- * mtu: device's MTU
++ * max_mtu: netdev's max_mtu
+ * pfc_en: <input> current pfc configuration
+ * buffer: <input> current prio to buffer mapping
+ * xoff: <input> xoff value
+@@ -183,7 +185,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
+ * Return 0 if no error.
+ * Set change to true if buffer configuration is modified.
+ */
+-static int update_buffer_lossy(unsigned int mtu,
++static int update_buffer_lossy(unsigned int max_mtu,
+ u8 pfc_en, u8 *buffer, u32 xoff,
+ struct mlx5e_port_buffer *port_buffer,
+ bool *change)
+@@ -220,7 +222,7 @@ static int update_buffer_lossy(unsigned int mtu,
+ }
+
+ if (changed) {
+- err = update_xoff_threshold(port_buffer, xoff, mtu);
++ err = update_xoff_threshold(port_buffer, xoff, max_mtu);
+ if (err)
+ return err;
+
+@@ -230,6 +232,7 @@ static int update_buffer_lossy(unsigned int mtu,
+ return 0;
+ }
+
++#define MINIMUM_MAX_MTU 9216
+ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ u32 change, unsigned int mtu,
+ struct ieee_pfc *pfc,
+@@ -241,12 +244,14 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ bool update_prio2buffer = false;
+ u8 buffer[MLX5E_MAX_PRIORITY];
+ bool update_buffer = false;
++ unsigned int max_mtu;
+ u32 total_used = 0;
+ u8 curr_pfc_en;
+ int err;
+ int i;
+
+ mlx5e_dbg(HW, priv, "%s: change=%x\n", __func__, change);
++ max_mtu = max_t(unsigned int, priv->netdev->max_mtu, MINIMUM_MAX_MTU);
+
+ err = mlx5e_port_query_buffer(priv, &port_buffer);
+ if (err)
+@@ -254,7 +259,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+
+ if (change & MLX5E_PORT_BUFFER_CABLE_LEN) {
+ update_buffer = true;
+- err = update_xoff_threshold(&port_buffer, xoff, mtu);
++ err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
+ if (err)
+ return err;
+ }
+@@ -264,7 +269,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ if (err)
+ return err;
+
+- err = update_buffer_lossy(mtu, pfc->pfc_en, buffer, xoff,
++ err = update_buffer_lossy(max_mtu, pfc->pfc_en, buffer, xoff,
+ &port_buffer, &update_buffer);
+ if (err)
+ return err;
+@@ -276,8 +281,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ if (err)
+ return err;
+
+- err = update_buffer_lossy(mtu, curr_pfc_en, prio2buffer, xoff,
+- &port_buffer, &update_buffer);
++ err = update_buffer_lossy(max_mtu, curr_pfc_en, prio2buffer,
++ xoff, &port_buffer, &update_buffer);
+ if (err)
+ return err;
+ }
+@@ -301,7 +306,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ return -EINVAL;
+
+ update_buffer = true;
+- err = update_xoff_threshold(&port_buffer, xoff, mtu);
++ err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
+ if (err)
+ return err;
+ }
+@@ -309,7 +314,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ /* Need to update buffer configuration if xoff value is changed */
+ if (!update_buffer && xoff != priv->dcbx.xoff) {
+ update_buffer = true;
+- err = update_xoff_threshold(&port_buffer, xoff, mtu);
++ err = update_xoff_threshold(&port_buffer, xoff, max_mtu);
+ if (err)
+ return err;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
+index db3278cc052b..124e4567a4ee 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
+@@ -45,7 +45,9 @@ int mlx5e_create_tir(struct mlx5_core_dev *mdev,
+ if (err)
+ return err;
+
++ mutex_lock(&mdev->mlx5e_res.td.list_lock);
+ list_add(&tir->list, &mdev->mlx5e_res.td.tirs_list);
++ mutex_unlock(&mdev->mlx5e_res.td.list_lock);
+
+ return 0;
+ }
+@@ -53,8 +55,10 @@ int mlx5e_create_tir(struct mlx5_core_dev *mdev,
+ void mlx5e_destroy_tir(struct mlx5_core_dev *mdev,
+ struct mlx5e_tir *tir)
+ {
++ mutex_lock(&mdev->mlx5e_res.td.list_lock);
+ mlx5_core_destroy_tir(mdev, tir->tirn);
+ list_del(&tir->list);
++ mutex_unlock(&mdev->mlx5e_res.td.list_lock);
+ }
+
+ static int mlx5e_create_mkey(struct mlx5_core_dev *mdev, u32 pdn,
+@@ -114,6 +118,7 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev)
+ }
+
+ INIT_LIST_HEAD(&mdev->mlx5e_res.td.tirs_list);
++ mutex_init(&mdev->mlx5e_res.td.list_lock);
+
+ return 0;
+
+@@ -141,15 +146,17 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb)
+ {
+ struct mlx5_core_dev *mdev = priv->mdev;
+ struct mlx5e_tir *tir;
+- int err = -ENOMEM;
++ int err = 0;
+ u32 tirn = 0;
+ int inlen;
+ void *in;
+
+ inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
+ in = kvzalloc(inlen, GFP_KERNEL);
+- if (!in)
++ if (!in) {
++ err = -ENOMEM;
+ goto out;
++ }
+
+ if (enable_uc_lb)
+ MLX5_SET(modify_tir_in, in, ctx.self_lb_block,
+@@ -157,6 +164,7 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb)
+
+ MLX5_SET(modify_tir_in, in, bitmask.self_lb_en, 1);
+
++ mutex_lock(&mdev->mlx5e_res.td.list_lock);
+ list_for_each_entry(tir, &mdev->mlx5e_res.td.tirs_list, list) {
+ tirn = tir->tirn;
+ err = mlx5_core_modify_tir(mdev, tirn, in, inlen);
+@@ -168,6 +176,7 @@ out:
+ kvfree(in);
+ if (err)
+ netdev_err(priv->netdev, "refresh tir(0x%x) failed, %d\n", tirn, err);
++ mutex_unlock(&mdev->mlx5e_res.td.list_lock);
+
+ return err;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
+index 5cf5f2a9d51f..8de64e88c670 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
+@@ -217,15 +217,21 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
+ void *cmd;
+ int ret;
+
++ rcu_read_lock();
++ flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
++ rcu_read_unlock();
++
++ if (!flow) {
++ WARN_ONCE(1, "Received NULL pointer for handle\n");
++ return -EINVAL;
++ }
++
+ buf = kzalloc(size, GFP_ATOMIC);
+ if (!buf)
+ return -ENOMEM;
+
+ cmd = (buf + 1);
+
+- rcu_read_lock();
+- flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
+- rcu_read_unlock();
+ mlx5_fpga_tls_flow_to_cmd(flow, cmd);
+
+ MLX5_SET(tls_cmd, cmd, swid, ntohl(handle));
+@@ -238,6 +244,8 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
+ buf->complete = mlx_tls_kfree_complete;
+
+ ret = mlx5_fpga_sbu_conn_sendmsg(mdev->fpga->tls->conn, buf);
++ if (ret < 0)
++ kfree(buf);
+
+ return ret;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 563ce3fedab4..0e820cf92f8a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -162,26 +162,6 @@ static struct mlx5_profile profile[] = {
+ .size = 8,
+ .limit = 4
+ },
+- .mr_cache[16] = {
+- .size = 8,
+- .limit = 4
+- },
+- .mr_cache[17] = {
+- .size = 8,
+- .limit = 4
+- },
+- .mr_cache[18] = {
+- .size = 8,
+- .limit = 4
+- },
+- .mr_cache[19] = {
+- .size = 4,
+- .limit = 2
+- },
+- .mr_cache[20] = {
+- .size = 4,
+- .limit = 2
+- },
+ },
+ };
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+index 18a09cdcd9c6..aa5869eb2e3f 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+@@ -225,7 +225,7 @@ static netdev_tx_t nfp_repr_xmit(struct sk_buff *skb, struct net_device *netdev)
+ ret = dev_queue_xmit(skb);
+ nfp_repr_inc_tx_stats(netdev, len, ret);
+
+- return ret;
++ return NETDEV_TX_OK;
+ }
+
+ static int nfp_repr_stop(struct net_device *netdev)
+@@ -329,6 +329,8 @@ int nfp_repr_init(struct nfp_app *app, struct net_device *netdev,
+
+ SWITCHDEV_SET_OPS(netdev, &nfp_port_switchdev_ops);
+
++ netdev->priv_flags |= IFF_DISABLE_NETPOLL;
++
+ if (nfp_app_has_tc(app)) {
+ netdev->features |= NETIF_F_HW_TC;
+ netdev->hw_features |= NETIF_F_HW_TC;
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 5f45ffeeecb4..7a50b911b180 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -28,6 +28,7 @@
+ #include <linux/pm_runtime.h>
+ #include <linux/firmware.h>
+ #include <linux/prefetch.h>
++#include <linux/pci-aspm.h>
+ #include <linux/ipv6.h>
+ #include <net/ip6_checksum.h>
+
+@@ -5417,7 +5418,7 @@ static void rtl_hw_start_8168(struct rtl8169_private *tp)
+ tp->cp_cmd |= PktCntrDisable | INTT_1;
+ RTL_W16(tp, CPlusCmd, tp->cp_cmd);
+
+- RTL_W16(tp, IntrMitigate, 0x5151);
++ RTL_W16(tp, IntrMitigate, 0x5100);
+
+ /* Work around for RxFIFO overflow. */
+ if (tp->mac_version == RTL_GIGA_MAC_VER_11) {
+@@ -7324,6 +7325,11 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ return rc;
+ }
+
++ /* Disable ASPM completely as that cause random device stop working
++ * problems as well as full system hangs for some PCIe devices users.
++ */
++ pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1);
++
+ /* enable device (incl. PCI PM wakeup and hotplug setup) */
+ rc = pcim_enable_device(pdev);
+ if (rc < 0) {
+diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
+index 42d284669b03..31d8d83c25ac 100644
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -970,6 +970,7 @@ struct netvsc_device {
+
+ wait_queue_head_t wait_drain;
+ bool destroy;
++ bool tx_disable; /* if true, do not wake up queue again */
+
+ /* Receive buffer allocated by us but manages by NetVSP */
+ void *recv_buf;
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 1a942feab954..fb12b63439c6 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -110,6 +110,7 @@ static struct netvsc_device *alloc_net_device(void)
+
+ init_waitqueue_head(&net_device->wait_drain);
+ net_device->destroy = false;
++ net_device->tx_disable = false;
+
+ net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
+ net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
+@@ -716,7 +717,7 @@ static void netvsc_send_tx_complete(struct net_device *ndev,
+ } else {
+ struct netdev_queue *txq = netdev_get_tx_queue(ndev, q_idx);
+
+- if (netif_tx_queue_stopped(txq) &&
++ if (netif_tx_queue_stopped(txq) && !net_device->tx_disable &&
+ (hv_get_avail_to_write_percent(&channel->outbound) >
+ RING_AVAIL_PERCENT_HIWATER || queue_sends < 1)) {
+ netif_tx_wake_queue(txq);
+@@ -871,7 +872,8 @@ static inline int netvsc_send_pkt(
+ } else if (ret == -EAGAIN) {
+ netif_tx_stop_queue(txq);
+ ndev_ctx->eth_stats.stop_queue++;
+- if (atomic_read(&nvchan->queue_sends) < 1) {
++ if (atomic_read(&nvchan->queue_sends) < 1 &&
++ !net_device->tx_disable) {
+ netif_tx_wake_queue(txq);
+ ndev_ctx->eth_stats.wake_queue++;
+ ret = -ENOSPC;
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index c8320405c8f1..9d699bd5f715 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -109,6 +109,15 @@ static void netvsc_set_rx_mode(struct net_device *net)
+ rcu_read_unlock();
+ }
+
++static void netvsc_tx_enable(struct netvsc_device *nvscdev,
++ struct net_device *ndev)
++{
++ nvscdev->tx_disable = false;
++ virt_wmb(); /* ensure queue wake up mechanism is on */
++
++ netif_tx_wake_all_queues(ndev);
++}
++
+ static int netvsc_open(struct net_device *net)
+ {
+ struct net_device_context *ndev_ctx = netdev_priv(net);
+@@ -129,7 +138,7 @@ static int netvsc_open(struct net_device *net)
+ rdev = nvdev->extension;
+ if (!rdev->link_state) {
+ netif_carrier_on(net);
+- netif_tx_wake_all_queues(net);
++ netvsc_tx_enable(nvdev, net);
+ }
+
+ if (vf_netdev) {
+@@ -184,6 +193,17 @@ static int netvsc_wait_until_empty(struct netvsc_device *nvdev)
+ }
+ }
+
++static void netvsc_tx_disable(struct netvsc_device *nvscdev,
++ struct net_device *ndev)
++{
++ if (nvscdev) {
++ nvscdev->tx_disable = true;
++ virt_wmb(); /* ensure txq will not wake up after stop */
++ }
++
++ netif_tx_disable(ndev);
++}
++
+ static int netvsc_close(struct net_device *net)
+ {
+ struct net_device_context *net_device_ctx = netdev_priv(net);
+@@ -192,7 +212,7 @@ static int netvsc_close(struct net_device *net)
+ struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
+ int ret;
+
+- netif_tx_disable(net);
++ netvsc_tx_disable(nvdev, net);
+
+ /* No need to close rndis filter if it is removed already */
+ if (!nvdev)
+@@ -918,7 +938,7 @@ static int netvsc_detach(struct net_device *ndev,
+
+ /* If device was up (receiving) then shutdown */
+ if (netif_running(ndev)) {
+- netif_tx_disable(ndev);
++ netvsc_tx_disable(nvdev, ndev);
+
+ ret = rndis_filter_close(nvdev);
+ if (ret) {
+@@ -1899,7 +1919,7 @@ static void netvsc_link_change(struct work_struct *w)
+ if (rdev->link_state) {
+ rdev->link_state = false;
+ netif_carrier_on(net);
+- netif_tx_wake_all_queues(net);
++ netvsc_tx_enable(net_device, net);
+ } else {
+ notify = true;
+ }
+@@ -1909,7 +1929,7 @@ static void netvsc_link_change(struct work_struct *w)
+ if (!rdev->link_state) {
+ rdev->link_state = true;
+ netif_carrier_off(net);
+- netif_tx_stop_all_queues(net);
++ netvsc_tx_disable(net_device, net);
+ }
+ kfree(event);
+ break;
+@@ -1918,7 +1938,7 @@ static void netvsc_link_change(struct work_struct *w)
+ if (!rdev->link_state) {
+ rdev->link_state = true;
+ netif_carrier_off(net);
+- netif_tx_stop_all_queues(net);
++ netvsc_tx_disable(net_device, net);
+ event->event = RNDIS_STATUS_MEDIA_CONNECT;
+ spin_lock_irqsave(&ndev_ctx->lock, flags);
+ list_add(&event->list, &ndev_ctx->reconfig_events);
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 74bebbdb4b15..9195f3476b1d 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1203,6 +1203,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */
+ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */
+ {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */
++ {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */
+ {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */
+ {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */
+ {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */
+diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
+index da7c72372ffc..9c397fa8704c 100644
+--- a/drivers/pci/hotplug/pciehp_ctrl.c
++++ b/drivers/pci/hotplug/pciehp_ctrl.c
+@@ -117,6 +117,10 @@ static void remove_board(struct slot *p_slot)
+ * removed from the slot/adapter.
+ */
+ msleep(1000);
++
++ /* Ignore link or presence changes caused by power off */
++ atomic_and(~(PCI_EXP_SLTSTA_DLLSC | PCI_EXP_SLTSTA_PDC),
++ &ctrl->pending_events);
+ }
+
+ /* turn off Green LED */
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index c0673a717239..37d897bc4cf1 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3852,6 +3852,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128,
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130,
+ quirk_dma_func1_alias);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9170,
++ quirk_dma_func1_alias);
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c47 + c57 */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9172,
+ quirk_dma_func1_alias);
+diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
+index 0840d27381ea..e0a04bfc873e 100644
+--- a/drivers/tty/Kconfig
++++ b/drivers/tty/Kconfig
+@@ -441,4 +441,28 @@ config VCC
+ depends on SUN_LDOMS
+ help
+ Support for Sun logical domain consoles.
++
++config LDISC_AUTOLOAD
++ bool "Automatically load TTY Line Disciplines"
++ default y
++ help
++ Historically the kernel has always automatically loaded any
++ line discipline that is in a kernel module when a user asks
++ for it to be loaded with the TIOCSETD ioctl, or through other
++ means. This is not always the best thing to do on systems
++ where you know you will not be using some of the more
++ "ancient" line disciplines, so prevent the kernel from doing
++ this unless the request is coming from a process with the
++ CAP_SYS_MODULE permissions.
++
++ Say 'Y' here if you trust your userspace users to do the right
++ thing, or if you have only provided the line disciplines that
++ you know you will be using, or if you wish to continue to use
++ the traditional method of on-demand loading of these modules
++ by any user.
++
++ This functionality can be changed at runtime with the
++ dev.tty.ldisc_autoload sysctl, this configuration option will
++ only set the default value of this functionality.
++
+ endif # TTY
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index e7d192ebecd7..ac8025cd4a1f 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -512,6 +512,8 @@ static const struct file_operations hung_up_tty_fops = {
+ static DEFINE_SPINLOCK(redirect_lock);
+ static struct file *redirect;
+
++extern void tty_sysctl_init(void);
++
+ /**
+ * tty_wakeup - request more data
+ * @tty: terminal
+@@ -3340,6 +3342,7 @@ void console_sysfs_notify(void)
+ */
+ int __init tty_init(void)
+ {
++ tty_sysctl_init();
+ cdev_init(&tty_cdev, &tty_fops);
+ if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
+ register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
+diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
+index fc4c97cae01e..53bb6d4e9e8d 100644
+--- a/drivers/tty/tty_ldisc.c
++++ b/drivers/tty/tty_ldisc.c
+@@ -156,6 +156,13 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
+ * takes tty_ldiscs_lock to guard against ldisc races
+ */
+
++#if defined(CONFIG_LDISC_AUTOLOAD)
++ #define INITIAL_AUTOLOAD_STATE 1
++#else
++ #define INITIAL_AUTOLOAD_STATE 0
++#endif
++static int tty_ldisc_autoload = INITIAL_AUTOLOAD_STATE;
++
+ static struct tty_ldisc *tty_ldisc_get(struct tty_struct *tty, int disc)
+ {
+ struct tty_ldisc *ld;
+@@ -170,6 +177,8 @@ static struct tty_ldisc *tty_ldisc_get(struct tty_struct *tty, int disc)
+ */
+ ldops = get_ldops(disc);
+ if (IS_ERR(ldops)) {
++ if (!capable(CAP_SYS_MODULE) && !tty_ldisc_autoload)
++ return ERR_PTR(-EPERM);
+ request_module("tty-ldisc-%d", disc);
+ ldops = get_ldops(disc);
+ if (IS_ERR(ldops))
+@@ -829,3 +838,41 @@ void tty_ldisc_deinit(struct tty_struct *tty)
+ tty_ldisc_put(tty->ldisc);
+ tty->ldisc = NULL;
+ }
++
++static int zero;
++static int one = 1;
++static struct ctl_table tty_table[] = {
++ {
++ .procname = "ldisc_autoload",
++ .data = &tty_ldisc_autoload,
++ .maxlen = sizeof(tty_ldisc_autoload),
++ .mode = 0644,
++ .proc_handler = proc_dointvec,
++ .extra1 = &zero,
++ .extra2 = &one,
++ },
++ { }
++};
++
++static struct ctl_table tty_dir_table[] = {
++ {
++ .procname = "tty",
++ .mode = 0555,
++ .child = tty_table,
++ },
++ { }
++};
++
++static struct ctl_table tty_root_table[] = {
++ {
++ .procname = "dev",
++ .mode = 0555,
++ .child = tty_dir_table,
++ },
++ { }
++};
++
++void tty_sysctl_init(void)
++{
++ register_sysctl_table(tty_root_table);
++}
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 814b395007b2..9529e28e1822 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -1086,6 +1086,8 @@ struct virtqueue *vring_create_virtqueue(
+ GFP_KERNEL|__GFP_NOWARN|__GFP_ZERO);
+ if (queue)
+ break;
++ if (!may_reduce_num)
++ return NULL;
+ }
+
+ if (!num)
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index cdbb888a8d4a..1c25dae083a8 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -296,10 +296,10 @@ static void blkdev_bio_end_io(struct bio *bio)
+ struct blkdev_dio *dio = bio->bi_private;
+ bool should_dirty = dio->should_dirty;
+
+- if (dio->multi_bio && !atomic_dec_and_test(&dio->ref)) {
+- if (bio->bi_status && !dio->bio.bi_status)
+- dio->bio.bi_status = bio->bi_status;
+- } else {
++ if (bio->bi_status && !dio->bio.bi_status)
++ dio->bio.bi_status = bio->bi_status;
++
++ if (!dio->multi_bio || atomic_dec_and_test(&dio->ref)) {
+ if (!dio->is_sync) {
+ struct kiocb *iocb = dio->iocb;
+ ssize_t ret;
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 8bf9cce11213..0eb333c62fe4 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -496,6 +496,16 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
++ /*
++ * If the fs is mounted with nologreplay, which requires it to be
++ * mounted in RO mode as well, we can not allow discard on free space
++ * inside block groups, because log trees refer to extents that are not
++ * pinned in a block group's free space cache (pinning the extents is
++ * precisely the first phase of replaying a log tree).
++ */
++ if (btrfs_test_opt(fs_info, NOLOGREPLAY))
++ return -EROFS;
++
+ rcu_read_lock();
+ list_for_each_entry_rcu(device, &fs_info->fs_devices->devices,
+ dev_list) {
+diff --git a/fs/btrfs/props.c b/fs/btrfs/props.c
+index dc6140013ae8..61d22a56c0ba 100644
+--- a/fs/btrfs/props.c
++++ b/fs/btrfs/props.c
+@@ -366,11 +366,11 @@ int btrfs_subvol_inherit_props(struct btrfs_trans_handle *trans,
+
+ static int prop_compression_validate(const char *value, size_t len)
+ {
+- if (!strncmp("lzo", value, len))
++ if (!strncmp("lzo", value, 3))
+ return 0;
+- else if (!strncmp("zlib", value, len))
++ else if (!strncmp("zlib", value, 4))
+ return 0;
+- else if (!strncmp("zstd", value, len))
++ else if (!strncmp("zstd", value, 4))
+ return 0;
+
+ return -EINVAL;
+@@ -396,7 +396,7 @@ static int prop_compression_apply(struct inode *inode,
+ btrfs_set_fs_incompat(fs_info, COMPRESS_LZO);
+ } else if (!strncmp("zlib", value, 4)) {
+ type = BTRFS_COMPRESS_ZLIB;
+- } else if (!strncmp("zstd", value, len)) {
++ } else if (!strncmp("zstd", value, 4)) {
+ type = BTRFS_COMPRESS_ZSTD;
+ btrfs_set_fs_incompat(fs_info, COMPRESS_ZSTD);
+ } else {
+diff --git a/include/linux/bitrev.h b/include/linux/bitrev.h
+index 50fb0dee23e8..d35b8ec1c485 100644
+--- a/include/linux/bitrev.h
++++ b/include/linux/bitrev.h
+@@ -34,41 +34,41 @@ static inline u32 __bitrev32(u32 x)
+
+ #define __constant_bitrev32(x) \
+ ({ \
+- u32 __x = x; \
+- __x = (__x >> 16) | (__x << 16); \
+- __x = ((__x & (u32)0xFF00FF00UL) >> 8) | ((__x & (u32)0x00FF00FFUL) << 8); \
+- __x = ((__x & (u32)0xF0F0F0F0UL) >> 4) | ((__x & (u32)0x0F0F0F0FUL) << 4); \
+- __x = ((__x & (u32)0xCCCCCCCCUL) >> 2) | ((__x & (u32)0x33333333UL) << 2); \
+- __x = ((__x & (u32)0xAAAAAAAAUL) >> 1) | ((__x & (u32)0x55555555UL) << 1); \
+- __x; \
++ u32 ___x = x; \
++ ___x = (___x >> 16) | (___x << 16); \
++ ___x = ((___x & (u32)0xFF00FF00UL) >> 8) | ((___x & (u32)0x00FF00FFUL) << 8); \
++ ___x = ((___x & (u32)0xF0F0F0F0UL) >> 4) | ((___x & (u32)0x0F0F0F0FUL) << 4); \
++ ___x = ((___x & (u32)0xCCCCCCCCUL) >> 2) | ((___x & (u32)0x33333333UL) << 2); \
++ ___x = ((___x & (u32)0xAAAAAAAAUL) >> 1) | ((___x & (u32)0x55555555UL) << 1); \
++ ___x; \
+ })
+
+ #define __constant_bitrev16(x) \
+ ({ \
+- u16 __x = x; \
+- __x = (__x >> 8) | (__x << 8); \
+- __x = ((__x & (u16)0xF0F0U) >> 4) | ((__x & (u16)0x0F0FU) << 4); \
+- __x = ((__x & (u16)0xCCCCU) >> 2) | ((__x & (u16)0x3333U) << 2); \
+- __x = ((__x & (u16)0xAAAAU) >> 1) | ((__x & (u16)0x5555U) << 1); \
+- __x; \
++ u16 ___x = x; \
++ ___x = (___x >> 8) | (___x << 8); \
++ ___x = ((___x & (u16)0xF0F0U) >> 4) | ((___x & (u16)0x0F0FU) << 4); \
++ ___x = ((___x & (u16)0xCCCCU) >> 2) | ((___x & (u16)0x3333U) << 2); \
++ ___x = ((___x & (u16)0xAAAAU) >> 1) | ((___x & (u16)0x5555U) << 1); \
++ ___x; \
+ })
+
+ #define __constant_bitrev8x4(x) \
+ ({ \
+- u32 __x = x; \
+- __x = ((__x & (u32)0xF0F0F0F0UL) >> 4) | ((__x & (u32)0x0F0F0F0FUL) << 4); \
+- __x = ((__x & (u32)0xCCCCCCCCUL) >> 2) | ((__x & (u32)0x33333333UL) << 2); \
+- __x = ((__x & (u32)0xAAAAAAAAUL) >> 1) | ((__x & (u32)0x55555555UL) << 1); \
+- __x; \
++ u32 ___x = x; \
++ ___x = ((___x & (u32)0xF0F0F0F0UL) >> 4) | ((___x & (u32)0x0F0F0F0FUL) << 4); \
++ ___x = ((___x & (u32)0xCCCCCCCCUL) >> 2) | ((___x & (u32)0x33333333UL) << 2); \
++ ___x = ((___x & (u32)0xAAAAAAAAUL) >> 1) | ((___x & (u32)0x55555555UL) << 1); \
++ ___x; \
+ })
+
+ #define __constant_bitrev8(x) \
+ ({ \
+- u8 __x = x; \
+- __x = (__x >> 4) | (__x << 4); \
+- __x = ((__x & (u8)0xCCU) >> 2) | ((__x & (u8)0x33U) << 2); \
+- __x = ((__x & (u8)0xAAU) >> 1) | ((__x & (u8)0x55U) << 1); \
+- __x; \
++ u8 ___x = x; \
++ ___x = (___x >> 4) | (___x << 4); \
++ ___x = ((___x & (u8)0xCCU) >> 2) | ((___x & (u8)0x33U) << 2); \
++ ___x = ((___x & (u8)0xAAU) >> 1) | ((___x & (u8)0x55U) << 1); \
++ ___x; \
+ })
+
+ #define bitrev32(x) \
+diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
+index 652f602167df..cc6b6532eb56 100644
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -559,7 +559,10 @@ struct mem_cgroup *lock_page_memcg(struct page *page);
+ void __unlock_page_memcg(struct mem_cgroup *memcg);
+ void unlock_page_memcg(struct page *page);
+
+-/* idx can be of type enum memcg_stat_item or node_stat_item */
++/*
++ * idx can be of type enum memcg_stat_item or node_stat_item.
++ * Keep in sync with memcg_exact_page_state().
++ */
+ static inline unsigned long memcg_page_state(struct mem_cgroup *memcg,
+ int idx)
+ {
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index bbcfe2e5fd91..e8b92dee5a72 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -776,6 +776,8 @@ struct mlx5_pagefault {
+ };
+
+ struct mlx5_td {
++ /* protects tirs list changes while tirs refresh */
++ struct mutex list_lock;
+ struct list_head tirs_list;
+ u32 tdn;
+ };
+diff --git a/include/linux/netfilter/nf_conntrack_proto_gre.h b/include/linux/netfilter/nf_conntrack_proto_gre.h
+index b8d95564bd53..14edb795ab43 100644
+--- a/include/linux/netfilter/nf_conntrack_proto_gre.h
++++ b/include/linux/netfilter/nf_conntrack_proto_gre.h
+@@ -21,6 +21,19 @@ struct nf_ct_gre_keymap {
+ struct nf_conntrack_tuple tuple;
+ };
+
++enum grep_conntrack {
++ GRE_CT_UNREPLIED,
++ GRE_CT_REPLIED,
++ GRE_CT_MAX
++};
++
++struct netns_proto_gre {
++ struct nf_proto_net nf;
++ rwlock_t keymap_lock;
++ struct list_head keymap_list;
++ unsigned int gre_timeouts[GRE_CT_MAX];
++};
++
+ /* add new tuple->key_reply pair to keymap */
+ int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir,
+ struct nf_conntrack_tuple *t);
+diff --git a/include/linux/string.h b/include/linux/string.h
+index 4a5a0eb7df51..f58e1ef76572 100644
+--- a/include/linux/string.h
++++ b/include/linux/string.h
+@@ -143,6 +143,9 @@ extern void * memscan(void *,int,__kernel_size_t);
+ #ifndef __HAVE_ARCH_MEMCMP
+ extern int memcmp(const void *,const void *,__kernel_size_t);
+ #endif
++#ifndef __HAVE_ARCH_BCMP
++extern int bcmp(const void *,const void *,__kernel_size_t);
++#endif
+ #ifndef __HAVE_ARCH_MEMCHR
+ extern void * memchr(const void *,int,__kernel_size_t);
+ #endif
+diff --git a/include/linux/virtio_ring.h b/include/linux/virtio_ring.h
+index fab02133a919..3dc70adfe5f5 100644
+--- a/include/linux/virtio_ring.h
++++ b/include/linux/virtio_ring.h
+@@ -63,7 +63,7 @@ struct virtqueue;
+ /*
+ * Creates a virtqueue and allocates the descriptor ring. If
+ * may_reduce_num is set, then this may allocate a smaller ring than
+- * expected. The caller should query virtqueue_get_ring_size to learn
++ * expected. The caller should query virtqueue_get_vring_size to learn
+ * the actual size of the ring.
+ */
+ struct virtqueue *vring_create_virtqueue(unsigned int index,
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 71d31e4d4391..cfc3dd5ff085 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -648,7 +648,7 @@ int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
+ unsigned char __user *data, int optlen);
+ void ip_options_undo(struct ip_options *opt);
+ void ip_forward_options(struct sk_buff *skb);
+-int ip_options_rcv_srr(struct sk_buff *skb);
++int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev);
+
+ /*
+ * Functions provided by ip_sockglue.c
+diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
+index 9b5fdc50519a..3f7b166262d7 100644
+--- a/include/net/net_namespace.h
++++ b/include/net/net_namespace.h
+@@ -57,6 +57,7 @@ struct net {
+ */
+ spinlock_t rules_mod_lock;
+
++ u32 hash_mix;
+ atomic64_t cookie_gen;
+
+ struct list_head list; /* list of network namespaces */
+diff --git a/include/net/netns/hash.h b/include/net/netns/hash.h
+index 16a842456189..d9b665151f3d 100644
+--- a/include/net/netns/hash.h
++++ b/include/net/netns/hash.h
+@@ -2,16 +2,10 @@
+ #ifndef __NET_NS_HASH_H__
+ #define __NET_NS_HASH_H__
+
+-#include <asm/cache.h>
+-
+-struct net;
++#include <net/net_namespace.h>
+
+ static inline u32 net_hash_mix(const struct net *net)
+ {
+-#ifdef CONFIG_NET_NS
+- return (u32)(((unsigned long)net) >> ilog2(sizeof(*net)));
+-#else
+- return 0;
+-#endif
++ return net->hash_mix;
+ }
+ #endif
+diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
+index 811009ebacd4..379e89c706c9 100644
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -1384,6 +1384,10 @@ int irq_chip_set_vcpu_affinity_parent(struct irq_data *data, void *vcpu_info)
+ int irq_chip_set_wake_parent(struct irq_data *data, unsigned int on)
+ {
+ data = data->parent_data;
++
++ if (data->chip->flags & IRQCHIP_SKIP_SET_WAKE)
++ return 0;
++
+ if (data->chip->irq_set_wake)
+ return data->chip->irq_set_wake(data, on);
+
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index ba454cba4069..8e009cee6517 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -554,6 +554,7 @@ int __init early_irq_init(void)
+ alloc_masks(&desc[i], node);
+ raw_spin_lock_init(&desc[i].lock);
+ lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
++ mutex_init(&desc[i].request_mutex);
+ desc_set_defaults(i, &desc[i], node, NULL, NULL);
+ }
+ return arch_early_irq_init();
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index f7c375d1e601..640094391169 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7437,10 +7437,10 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq)
+ if (cfs_rq->last_h_load_update == now)
+ return;
+
+- cfs_rq->h_load_next = NULL;
++ WRITE_ONCE(cfs_rq->h_load_next, NULL);
+ for_each_sched_entity(se) {
+ cfs_rq = cfs_rq_of(se);
+- cfs_rq->h_load_next = se;
++ WRITE_ONCE(cfs_rq->h_load_next, se);
+ if (cfs_rq->last_h_load_update == now)
+ break;
+ }
+@@ -7450,7 +7450,7 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq)
+ cfs_rq->last_h_load_update = now;
+ }
+
+- while ((se = cfs_rq->h_load_next) != NULL) {
++ while ((se = READ_ONCE(cfs_rq->h_load_next)) != NULL) {
+ load = cfs_rq->h_load;
+ load = div64_ul(load * se->avg.load_avg,
+ cfs_rq_load_avg(cfs_rq) + 1);
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index fa5de5e8de61..fdeb9bc6affb 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -597,7 +597,7 @@ static ktime_t alarm_timer_remaining(struct k_itimer *timr, ktime_t now)
+ {
+ struct alarm *alarm = &timr->it.alarm.alarmtimer;
+
+- return ktime_sub(now, alarm->node.expires);
++ return ktime_sub(alarm->node.expires, now);
+ }
+
+ /**
+diff --git a/lib/string.c b/lib/string.c
+index 2c0900a5d51a..72125fd5b4a6 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -865,6 +865,26 @@ __visible int memcmp(const void *cs, const void *ct, size_t count)
+ EXPORT_SYMBOL(memcmp);
+ #endif
+
++#ifndef __HAVE_ARCH_BCMP
++/**
++ * bcmp - returns 0 if and only if the buffers have identical contents.
++ * @a: pointer to first buffer.
++ * @b: pointer to second buffer.
++ * @len: size of buffers.
++ *
++ * The sign or magnitude of a non-zero return value has no particular
++ * meaning, and architectures may implement their own more efficient bcmp(). So
++ * while this particular implementation is a simple (tail) call to memcmp, do
++ * not rely on anything but whether the return value is zero or non-zero.
++ */
++#undef bcmp
++int bcmp(const void *a, const void *b, size_t len)
++{
++ return memcmp(a, b, len);
++}
++EXPORT_SYMBOL(bcmp);
++#endif
++
+ #ifndef __HAVE_ARCH_MEMSCAN
+ /**
+ * memscan - Find a character in an area of memory.
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index d2cd70cfaa90..7d08e89361ee 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -734,6 +734,21 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
+ spinlock_t *ptl;
+
+ ptl = pmd_lock(mm, pmd);
++ if (!pmd_none(*pmd)) {
++ if (write) {
++ if (pmd_pfn(*pmd) != pfn_t_to_pfn(pfn)) {
++ WARN_ON_ONCE(!is_huge_zero_pmd(*pmd));
++ goto out_unlock;
++ }
++ entry = pmd_mkyoung(*pmd);
++ entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
++ if (pmdp_set_access_flags(vma, addr, pmd, entry, 1))
++ update_mmu_cache_pmd(vma, addr, pmd);
++ }
++
++ goto out_unlock;
++ }
++
+ entry = pmd_mkhuge(pfn_t_pmd(pfn, prot));
+ if (pfn_t_devmap(pfn))
+ entry = pmd_mkdevmap(entry);
+@@ -745,11 +760,16 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
+ if (pgtable) {
+ pgtable_trans_huge_deposit(mm, pmd, pgtable);
+ mm_inc_nr_ptes(mm);
++ pgtable = NULL;
+ }
+
+ set_pmd_at(mm, addr, pmd, entry);
+ update_mmu_cache_pmd(vma, addr, pmd);
++
++out_unlock:
+ spin_unlock(ptl);
++ if (pgtable)
++ pte_free(mm, pgtable);
+ }
+
+ vm_fault_t vmf_insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
+@@ -800,6 +820,20 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
+ spinlock_t *ptl;
+
+ ptl = pud_lock(mm, pud);
++ if (!pud_none(*pud)) {
++ if (write) {
++ if (pud_pfn(*pud) != pfn_t_to_pfn(pfn)) {
++ WARN_ON_ONCE(!is_huge_zero_pud(*pud));
++ goto out_unlock;
++ }
++ entry = pud_mkyoung(*pud);
++ entry = maybe_pud_mkwrite(pud_mkdirty(entry), vma);
++ if (pudp_set_access_flags(vma, addr, pud, entry, 1))
++ update_mmu_cache_pud(vma, addr, pud);
++ }
++ goto out_unlock;
++ }
++
+ entry = pud_mkhuge(pfn_t_pud(pfn, prot));
+ if (pfn_t_devmap(pfn))
+ entry = pud_mkdevmap(entry);
+@@ -809,6 +843,8 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
+ }
+ set_pud_at(mm, addr, pud, entry);
+ update_mmu_cache_pud(vma, addr, pud);
++
++out_unlock:
+ spin_unlock(ptl);
+ }
+
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 7c712c4565e6..7e7cc0cd89fe 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3897,6 +3897,22 @@ struct wb_domain *mem_cgroup_wb_domain(struct bdi_writeback *wb)
+ return &memcg->cgwb_domain;
+ }
+
++/*
++ * idx can be of type enum memcg_stat_item or node_stat_item.
++ * Keep in sync with memcg_exact_page().
++ */
++static unsigned long memcg_exact_page_state(struct mem_cgroup *memcg, int idx)
++{
++ long x = atomic_long_read(&memcg->stat[idx]);
++ int cpu;
++
++ for_each_online_cpu(cpu)
++ x += per_cpu_ptr(memcg->stat_cpu, cpu)->count[idx];
++ if (x < 0)
++ x = 0;
++ return x;
++}
++
+ /**
+ * mem_cgroup_wb_stats - retrieve writeback related stats from its memcg
+ * @wb: bdi_writeback in question
+@@ -3922,10 +3938,10 @@ void mem_cgroup_wb_stats(struct bdi_writeback *wb, unsigned long *pfilepages,
+ struct mem_cgroup *memcg = mem_cgroup_from_css(wb->memcg_css);
+ struct mem_cgroup *parent;
+
+- *pdirty = memcg_page_state(memcg, NR_FILE_DIRTY);
++ *pdirty = memcg_exact_page_state(memcg, NR_FILE_DIRTY);
+
+ /* this should eventually include NR_UNSTABLE_NFS */
+- *pwriteback = memcg_page_state(memcg, NR_WRITEBACK);
++ *pwriteback = memcg_exact_page_state(memcg, NR_WRITEBACK);
+ *pfilepages = mem_cgroup_nr_lru_pages(memcg, (1 << LRU_INACTIVE_FILE) |
+ (1 << LRU_ACTIVE_FILE));
+ *pheadroom = PAGE_COUNTER_MAX;
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 5c8c0a572ee9..d47554307a6d 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4959,8 +4959,10 @@ static inline void __netif_receive_skb_list_ptype(struct list_head *head,
+ if (pt_prev->list_func != NULL)
+ pt_prev->list_func(head, pt_prev, orig_dev);
+ else
+- list_for_each_entry_safe(skb, next, head, list)
++ list_for_each_entry_safe(skb, next, head, list) {
++ skb_list_del_init(skb);
+ pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
++ }
+ }
+
+ static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemalloc)
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index aeabc4831fca..7cc97f43f138 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -1863,11 +1863,16 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr)
+ WARN_ON_ONCE(!ret);
+
+ gstrings.len = ret;
+- data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
+- if (gstrings.len && !data)
+- return -ENOMEM;
+
+- __ethtool_get_strings(dev, gstrings.string_set, data);
++ if (gstrings.len) {
++ data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
++ if (!data)
++ return -ENOMEM;
++
++ __ethtool_get_strings(dev, gstrings.string_set, data);
++ } else {
++ data = NULL;
++ }
+
+ ret = -EFAULT;
+ if (copy_to_user(useraddr, &gstrings, sizeof(gstrings)))
+@@ -1963,11 +1968,15 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
+ return -EFAULT;
+
+ stats.n_stats = n_stats;
+- data = vzalloc(array_size(n_stats, sizeof(u64)));
+- if (n_stats && !data)
+- return -ENOMEM;
+
+- ops->get_ethtool_stats(dev, &stats, data);
++ if (n_stats) {
++ data = vzalloc(array_size(n_stats, sizeof(u64)));
++ if (!data)
++ return -ENOMEM;
++ ops->get_ethtool_stats(dev, &stats, data);
++ } else {
++ data = NULL;
++ }
+
+ ret = -EFAULT;
+ if (copy_to_user(useraddr, &stats, sizeof(stats)))
+@@ -2007,16 +2016,21 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
+ return -EFAULT;
+
+ stats.n_stats = n_stats;
+- data = vzalloc(array_size(n_stats, sizeof(u64)));
+- if (n_stats && !data)
+- return -ENOMEM;
+
+- if (dev->phydev && !ops->get_ethtool_phy_stats) {
+- ret = phy_ethtool_get_stats(dev->phydev, &stats, data);
+- if (ret < 0)
+- return ret;
++ if (n_stats) {
++ data = vzalloc(array_size(n_stats, sizeof(u64)));
++ if (!data)
++ return -ENOMEM;
++
++ if (dev->phydev && !ops->get_ethtool_phy_stats) {
++ ret = phy_ethtool_get_stats(dev->phydev, &stats, data);
++ if (ret < 0)
++ goto out;
++ } else {
++ ops->get_ethtool_phy_stats(dev, &stats, data);
++ }
+ } else {
+- ops->get_ethtool_phy_stats(dev, &stats, data);
++ data = NULL;
+ }
+
+ ret = -EFAULT;
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 670c84b1bfc2..7320f0844a50 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -304,6 +304,7 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
+
+ refcount_set(&net->count, 1);
+ refcount_set(&net->passive, 1);
++ get_random_bytes(&net->hash_mix, sizeof(u32));
+ net->dev_base_seq = 1;
+ net->user_ns = user_ns;
+ idr_init(&net->netns_ids);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 8656b1e20d35..ceee28e184af 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3832,7 +3832,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
+ unsigned int delta_truesize;
+ struct sk_buff *lp;
+
+- if (unlikely(p->len + len >= 65536))
++ if (unlikely(p->len + len >= 65536 || NAPI_GRO_CB(skb)->flush))
+ return -E2BIG;
+
+ lp = NAPI_GRO_CB(p)->last;
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index f199945f6e4a..3c734832bb7c 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -260,7 +260,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ struct net *net = dev_net(skb->dev);
+ struct metadata_dst *tun_dst = NULL;
+ struct erspan_base_hdr *ershdr;
+- struct erspan_metadata *pkt_md;
+ struct ip_tunnel_net *itn;
+ struct ip_tunnel *tunnel;
+ const struct iphdr *iph;
+@@ -283,9 +282,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ if (unlikely(!pskb_may_pull(skb, len)))
+ return PACKET_REJECT;
+
+- ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
+- pkt_md = (struct erspan_metadata *)(ershdr + 1);
+-
+ if (__iptunnel_pull_header(skb,
+ len,
+ htons(ETH_P_TEB),
+@@ -293,8 +289,9 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ goto drop;
+
+ if (tunnel->collect_md) {
++ struct erspan_metadata *pkt_md, *md;
+ struct ip_tunnel_info *info;
+- struct erspan_metadata *md;
++ unsigned char *gh;
+ __be64 tun_id;
+ __be16 flags;
+
+@@ -307,6 +304,14 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ if (!tun_dst)
+ return PACKET_REJECT;
+
++ /* skb can be uncloned in __iptunnel_pull_header, so
++ * old pkt_md is no longer valid and we need to reset
++ * it
++ */
++ gh = skb_network_header(skb) +
++ skb_network_header_len(skb);
++ pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
++ sizeof(*ershdr));
+ md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
+ md->version = ver;
+ md2 = &md->u.md2;
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
+index bd8ef4f87c79..c3a0683e83df 100644
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -258,11 +258,10 @@ int ip_local_deliver(struct sk_buff *skb)
+ ip_local_deliver_finish);
+ }
+
+-static inline bool ip_rcv_options(struct sk_buff *skb)
++static inline bool ip_rcv_options(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ip_options *opt;
+ const struct iphdr *iph;
+- struct net_device *dev = skb->dev;
+
+ /* It looks as overkill, because not all
+ IP options require packet mangling.
+@@ -298,7 +297,7 @@ static inline bool ip_rcv_options(struct sk_buff *skb)
+ }
+ }
+
+- if (ip_options_rcv_srr(skb))
++ if (ip_options_rcv_srr(skb, dev))
+ goto drop;
+ }
+
+@@ -354,7 +353,7 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk,
+ }
+ #endif
+
+- if (iph->ihl > 5 && ip_rcv_options(skb))
++ if (iph->ihl > 5 && ip_rcv_options(skb, dev))
+ goto drop;
+
+ rt = skb_rtable(skb);
+diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
+index 32a35043c9f5..3db31bb9df50 100644
+--- a/net/ipv4/ip_options.c
++++ b/net/ipv4/ip_options.c
+@@ -612,7 +612,7 @@ void ip_forward_options(struct sk_buff *skb)
+ }
+ }
+
+-int ip_options_rcv_srr(struct sk_buff *skb)
++int ip_options_rcv_srr(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ip_options *opt = &(IPCB(skb)->opt);
+ int srrspace, srrptr;
+@@ -647,7 +647,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
+
+ orefdst = skb->_skb_refdst;
+ skb_dst_set(skb, NULL);
+- err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev);
++ err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, dev);
+ rt2 = skb_rtable(skb);
+ if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) {
+ skb_dst_drop(skb);
+diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
+index ca61e2a659e7..5205c5a5d8d5 100644
+--- a/net/ipv4/tcp_dctcp.c
++++ b/net/ipv4/tcp_dctcp.c
+@@ -66,11 +66,6 @@ static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA;
+ module_param(dctcp_alpha_on_init, uint, 0644);
+ MODULE_PARM_DESC(dctcp_alpha_on_init, "parameter for initial alpha value");
+
+-static unsigned int dctcp_clamp_alpha_on_loss __read_mostly;
+-module_param(dctcp_clamp_alpha_on_loss, uint, 0644);
+-MODULE_PARM_DESC(dctcp_clamp_alpha_on_loss,
+- "parameter for clamping alpha on loss");
+-
+ static struct tcp_congestion_ops dctcp_reno;
+
+ static void dctcp_reset(const struct tcp_sock *tp, struct dctcp *ca)
+@@ -211,21 +206,23 @@ static void dctcp_update_alpha(struct sock *sk, u32 flags)
+ }
+ }
+
+-static void dctcp_state(struct sock *sk, u8 new_state)
++static void dctcp_react_to_loss(struct sock *sk)
+ {
+- if (dctcp_clamp_alpha_on_loss && new_state == TCP_CA_Loss) {
+- struct dctcp *ca = inet_csk_ca(sk);
++ struct dctcp *ca = inet_csk_ca(sk);
++ struct tcp_sock *tp = tcp_sk(sk);
+
+- /* If this extension is enabled, we clamp dctcp_alpha to
+- * max on packet loss; the motivation is that dctcp_alpha
+- * is an indicator to the extend of congestion and packet
+- * loss is an indicator of extreme congestion; setting
+- * this in practice turned out to be beneficial, and
+- * effectively assumes total congestion which reduces the
+- * window by half.
+- */
+- ca->dctcp_alpha = DCTCP_MAX_ALPHA;
+- }
++ ca->loss_cwnd = tp->snd_cwnd;
++ tp->snd_ssthresh = max(tp->snd_cwnd >> 1U, 2U);
++}
++
++static void dctcp_state(struct sock *sk, u8 new_state)
++{
++ if (new_state == TCP_CA_Recovery &&
++ new_state != inet_csk(sk)->icsk_ca_state)
++ dctcp_react_to_loss(sk);
++ /* We handle RTO in dctcp_cwnd_event to ensure that we perform only
++ * one loss-adjustment per RTT.
++ */
+ }
+
+ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
+@@ -237,6 +234,9 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
+ case CA_EVENT_ECN_NO_CE:
+ dctcp_ce_state_1_to_0(sk);
+ break;
++ case CA_EVENT_LOSS:
++ dctcp_react_to_loss(sk);
++ break;
+ default:
+ /* Don't care for the rest. */
+ break;
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 30fdf891940b..11101cf8693b 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -2490,7 +2490,8 @@ static void __net_exit tcp_sk_exit(struct net *net)
+ {
+ int cpu;
+
+- module_put(net->ipv4.tcp_congestion_control->owner);
++ if (net->ipv4.tcp_congestion_control)
++ module_put(net->ipv4.tcp_congestion_control->owner);
+
+ for_each_possible_cpu(cpu)
+ inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu));
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index faed98dab913..c4a7db62658e 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -540,11 +540,10 @@ static int ip6gre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
+ return PACKET_REJECT;
+ }
+
+-static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
+- struct tnl_ptk_info *tpi)
++static int ip6erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
++ int gre_hdr_len)
+ {
+ struct erspan_base_hdr *ershdr;
+- struct erspan_metadata *pkt_md;
+ const struct ipv6hdr *ipv6h;
+ struct erspan_md2 *md2;
+ struct ip6_tnl *tunnel;
+@@ -563,18 +562,16 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
+ if (unlikely(!pskb_may_pull(skb, len)))
+ return PACKET_REJECT;
+
+- ershdr = (struct erspan_base_hdr *)skb->data;
+- pkt_md = (struct erspan_metadata *)(ershdr + 1);
+-
+ if (__iptunnel_pull_header(skb, len,
+ htons(ETH_P_TEB),
+ false, false) < 0)
+ return PACKET_REJECT;
+
+ if (tunnel->parms.collect_md) {
++ struct erspan_metadata *pkt_md, *md;
+ struct metadata_dst *tun_dst;
+ struct ip_tunnel_info *info;
+- struct erspan_metadata *md;
++ unsigned char *gh;
+ __be64 tun_id;
+ __be16 flags;
+
+@@ -587,6 +584,14 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
+ if (!tun_dst)
+ return PACKET_REJECT;
+
++ /* skb can be uncloned in __iptunnel_pull_header, so
++ * old pkt_md is no longer valid and we need to reset
++ * it
++ */
++ gh = skb_network_header(skb) +
++ skb_network_header_len(skb);
++ pkt_md = (struct erspan_metadata *)(gh + gre_hdr_len +
++ sizeof(*ershdr));
+ info = &tun_dst->u.tun_info;
+ md = ip_tunnel_info_opts(info);
+ md->version = ver;
+@@ -623,7 +628,7 @@ static int gre_rcv(struct sk_buff *skb)
+
+ if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) ||
+ tpi.proto == htons(ETH_P_ERSPAN2))) {
+- if (ip6erspan_rcv(skb, hdr_len, &tpi) == PACKET_RCVD)
++ if (ip6erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD)
+ return 0;
+ goto out;
+ }
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 0bb87f3a10c7..eed9231c90ad 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -587,7 +587,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ inet6_sk(skb->sk) : NULL;
+ struct ipv6hdr *tmp_hdr;
+ struct frag_hdr *fh;
+- unsigned int mtu, hlen, left, len;
++ unsigned int mtu, hlen, left, len, nexthdr_offset;
+ int hroom, troom;
+ __be32 frag_id;
+ int ptr, offset = 0, err = 0;
+@@ -598,6 +598,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ goto fail;
+ hlen = err;
+ nexthdr = *prevhdr;
++ nexthdr_offset = prevhdr - skb_network_header(skb);
+
+ mtu = ip6_skb_dst_mtu(skb);
+
+@@ -632,6 +633,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ (err = skb_checksum_help(skb)))
+ goto fail;
+
++ prevhdr = skb_network_header(skb) + nexthdr_offset;
+ hroom = LL_RESERVED_SPACE(rt->dst.dev);
+ if (skb_has_frag_list(skb)) {
+ unsigned int first_len = skb_pagelen(skb);
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 0c6403cf8b52..ade1390c6348 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -627,7 +627,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
+ eiph->daddr, eiph->saddr, 0, 0,
+ IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
+- if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL) {
++ if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL6) {
+ if (!IS_ERR(rt))
+ ip_rt_put(rt);
+ goto out;
+@@ -636,7 +636,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ } else {
+ if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
+ skb2->dev) ||
+- skb_dst(skb2)->dev->type != ARPHRD_TUNNEL)
++ skb_dst(skb2)->dev->type != ARPHRD_TUNNEL6)
+ goto out;
+ }
+
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index de9aa5cb295c..8f6cf8e6b5c1 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -669,6 +669,10 @@ static int ipip6_rcv(struct sk_buff *skb)
+ !net_eq(tunnel->net, dev_net(tunnel->dev))))
+ goto out;
+
++ /* skb can be uncloned in iptunnel_pull_header, so
++ * old iph is no longer valid
++ */
++ iph = (const struct iphdr *)skb_mac_header(skb);
+ err = IP_ECN_decapsulate(iph, skb);
+ if (unlikely(err)) {
+ if (log_ecn_error)
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
+index 571d824e4e24..b919db02c7f9 100644
+--- a/net/kcm/kcmsock.c
++++ b/net/kcm/kcmsock.c
+@@ -2054,14 +2054,14 @@ static int __init kcm_init(void)
+ if (err)
+ goto fail;
+
+- err = sock_register(&kcm_family_ops);
+- if (err)
+- goto sock_register_fail;
+-
+ err = register_pernet_device(&kcm_net_ops);
+ if (err)
+ goto net_ops_fail;
+
++ err = sock_register(&kcm_family_ops);
++ if (err)
++ goto sock_register_fail;
++
+ err = kcm_proc_init();
+ if (err)
+ goto proc_init_fail;
+@@ -2069,12 +2069,12 @@ static int __init kcm_init(void)
+ return 0;
+
+ proc_init_fail:
+- unregister_pernet_device(&kcm_net_ops);
+-
+-net_ops_fail:
+ sock_unregister(PF_KCM);
+
+ sock_register_fail:
++ unregister_pernet_device(&kcm_net_ops);
++
++net_ops_fail:
+ proto_unregister(&kcm_proto);
+
+ fail:
+@@ -2090,8 +2090,8 @@ fail:
+ static void __exit kcm_exit(void)
+ {
+ kcm_proc_exit();
+- unregister_pernet_device(&kcm_net_ops);
+ sock_unregister(PF_KCM);
++ unregister_pernet_device(&kcm_net_ops);
+ proto_unregister(&kcm_proto);
+ destroy_workqueue(kcm_wq);
+
+diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
+index 650eb4fba2c5..841c472aae1c 100644
+--- a/net/netfilter/nf_conntrack_proto_gre.c
++++ b/net/netfilter/nf_conntrack_proto_gre.c
+@@ -43,24 +43,12 @@
+ #include <linux/netfilter/nf_conntrack_proto_gre.h>
+ #include <linux/netfilter/nf_conntrack_pptp.h>
+
+-enum grep_conntrack {
+- GRE_CT_UNREPLIED,
+- GRE_CT_REPLIED,
+- GRE_CT_MAX
+-};
+-
+ static const unsigned int gre_timeouts[GRE_CT_MAX] = {
+ [GRE_CT_UNREPLIED] = 30*HZ,
+ [GRE_CT_REPLIED] = 180*HZ,
+ };
+
+ static unsigned int proto_gre_net_id __read_mostly;
+-struct netns_proto_gre {
+- struct nf_proto_net nf;
+- rwlock_t keymap_lock;
+- struct list_head keymap_list;
+- unsigned int gre_timeouts[GRE_CT_MAX];
+-};
+
+ static inline struct netns_proto_gre *gre_pernet(struct net *net)
+ {
+@@ -408,6 +396,8 @@ static int __init nf_ct_proto_gre_init(void)
+ {
+ int ret;
+
++ BUILD_BUG_ON(offsetof(struct netns_proto_gre, nf) != 0);
++
+ ret = register_pernet_subsys(&proto_gre_net_ops);
+ if (ret < 0)
+ goto out_pernet;
+diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
+index a30f8ba4b89a..70a7382b9787 100644
+--- a/net/netfilter/nfnetlink_cttimeout.c
++++ b/net/netfilter/nfnetlink_cttimeout.c
+@@ -392,7 +392,8 @@ err:
+ static int
+ cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
+ u32 seq, u32 type, int event,
+- const struct nf_conntrack_l4proto *l4proto)
++ const struct nf_conntrack_l4proto *l4proto,
++ const unsigned int *timeouts)
+ {
+ struct nlmsghdr *nlh;
+ struct nfgenmsg *nfmsg;
+@@ -421,7 +422,7 @@ cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
+ if (!nest_parms)
+ goto nla_put_failure;
+
+- ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, NULL);
++ ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, timeouts);
+ if (ret < 0)
+ goto nla_put_failure;
+
+@@ -444,6 +445,7 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl,
+ struct netlink_ext_ack *extack)
+ {
+ const struct nf_conntrack_l4proto *l4proto;
++ unsigned int *timeouts = NULL;
+ struct sk_buff *skb2;
+ int ret, err;
+ __u16 l3num;
+@@ -456,12 +458,55 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl,
+ l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
+ l4proto = nf_ct_l4proto_find_get(l3num, l4num);
+
+- /* This protocol is not supported, skip. */
+- if (l4proto->l4proto != l4num) {
+- err = -EOPNOTSUPP;
++ err = -EOPNOTSUPP;
++ if (l4proto->l4proto != l4num)
+ goto err;
++
++ switch (l4proto->l4proto) {
++ case IPPROTO_ICMP:
++ timeouts = &net->ct.nf_ct_proto.icmp.timeout;
++ break;
++ case IPPROTO_TCP:
++ timeouts = net->ct.nf_ct_proto.tcp.timeouts;
++ break;
++ case IPPROTO_UDP: /* fallthrough */
++ case IPPROTO_UDPLITE:
++ timeouts = net->ct.nf_ct_proto.udp.timeouts;
++ break;
++ case IPPROTO_DCCP:
++#ifdef CONFIG_NF_CT_PROTO_DCCP
++ timeouts = net->ct.nf_ct_proto.dccp.dccp_timeout;
++#endif
++ break;
++ case IPPROTO_ICMPV6:
++ timeouts = &net->ct.nf_ct_proto.icmpv6.timeout;
++ break;
++ case IPPROTO_SCTP:
++#ifdef CONFIG_NF_CT_PROTO_SCTP
++ timeouts = net->ct.nf_ct_proto.sctp.timeouts;
++#endif
++ break;
++ case IPPROTO_GRE:
++#ifdef CONFIG_NF_CT_PROTO_GRE
++ if (l4proto->net_id) {
++ struct netns_proto_gre *net_gre;
++
++ net_gre = net_generic(net, *l4proto->net_id);
++ timeouts = net_gre->gre_timeouts;
++ }
++#endif
++ break;
++ case 255:
++ timeouts = &net->ct.nf_ct_proto.generic.timeout;
++ break;
++ default:
++ WARN_ONCE(1, "Missing timeouts for proto %d", l4proto->l4proto);
++ break;
+ }
+
++ if (!timeouts)
++ goto err;
++
+ skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+ if (skb2 == NULL) {
+ err = -ENOMEM;
+@@ -472,7 +517,7 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl,
+ nlh->nlmsg_seq,
+ NFNL_MSG_TYPE(nlh->nlmsg_type),
+ IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
+- l4proto);
++ l4proto, timeouts);
+ if (ret <= 0) {
+ kfree_skb(skb2);
+ err = -ENOMEM;
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index c7b6010b2c09..eab5e8eaddaa 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -2306,14 +2306,14 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
+
+ struct sw_flow_actions *acts;
+ int new_acts_size;
+- int req_size = NLA_ALIGN(attr_len);
++ size_t req_size = NLA_ALIGN(attr_len);
+ int next_offset = offsetof(struct sw_flow_actions, actions) +
+ (*sfa)->actions_len;
+
+ if (req_size <= (ksize(*sfa) - next_offset))
+ goto out;
+
+- new_acts_size = ksize(*sfa) * 2;
++ new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);
+
+ if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
+ if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {
+diff --git a/net/rds/tcp.c b/net/rds/tcp.c
+index b9bbcf3d6c63..18bb522df282 100644
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -600,7 +600,7 @@ static void rds_tcp_kill_sock(struct net *net)
+ list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
+ struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+
+- if (net != c_net || !tc->t_sock)
++ if (net != c_net)
+ continue;
+ if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) {
+ list_move_tail(&tc->t_tcp_node, &tmp_list);
+diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
+index 6b67aa13d2dd..c7f5d630d97c 100644
+--- a/net/sched/act_sample.c
++++ b/net/sched/act_sample.c
+@@ -43,8 +43,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
+ struct tc_action_net *tn = net_generic(net, sample_net_id);
+ struct nlattr *tb[TCA_SAMPLE_MAX + 1];
+ struct psample_group *psample_group;
++ u32 psample_group_num, rate;
+ struct tc_sample *parm;
+- u32 psample_group_num;
+ struct tcf_sample *s;
+ bool exists = false;
+ int ret, err;
+@@ -80,6 +80,12 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
+ return -EEXIST;
+ }
+
++ rate = nla_get_u32(tb[TCA_SAMPLE_RATE]);
++ if (!rate) {
++ NL_SET_ERR_MSG(extack, "invalid sample rate");
++ tcf_idr_release(*a, bind);
++ return -EINVAL;
++ }
+ psample_group_num = nla_get_u32(tb[TCA_SAMPLE_PSAMPLE_GROUP]);
+ psample_group = psample_group_get(net, psample_group_num);
+ if (!psample_group) {
+@@ -91,7 +97,7 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
+
+ spin_lock_bh(&s->tcf_lock);
+ s->tcf_action = parm->action;
+- s->rate = nla_get_u32(tb[TCA_SAMPLE_RATE]);
++ s->rate = rate;
+ s->psample_group_num = psample_group_num;
+ RCU_INIT_POINTER(s->psample_group, psample_group);
+
+diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
+index 856fa79d4ffd..621bc1d5b057 100644
+--- a/net/sched/cls_matchall.c
++++ b/net/sched/cls_matchall.c
+@@ -126,6 +126,11 @@ static void mall_destroy(struct tcf_proto *tp, struct netlink_ext_ack *extack)
+
+ static void *mall_get(struct tcf_proto *tp, u32 handle)
+ {
++ struct cls_mall_head *head = rtnl_dereference(tp->root);
++
++ if (head && head->handle == handle)
++ return head;
++
+ return NULL;
+ }
+
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index 1c9f079e8a50..d97b2b4b7a8b 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -600,6 +600,7 @@ out:
+ static int sctp_v4_addr_to_user(struct sctp_sock *sp, union sctp_addr *addr)
+ {
+ /* No address mapping for V4 sockets */
++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
+ return sizeof(struct sockaddr_in);
+ }
+
+diff --git a/scripts/package/builddeb b/scripts/package/builddeb
+index 90c9a8ac7adb..0b31f4f1f92c 100755
+--- a/scripts/package/builddeb
++++ b/scripts/package/builddeb
+@@ -81,7 +81,7 @@ else
+ cp System.map "$tmpdir/boot/System.map-$version"
+ cp $KCONFIG_CONFIG "$tmpdir/boot/config-$version"
+ fi
+-cp "$($MAKE -s image_name)" "$tmpdir/$installed_image_path"
++cp "$($MAKE -s -f $srctree/Makefile image_name)" "$tmpdir/$installed_image_path"
+
+ if grep -q "^CONFIG_OF=y" $KCONFIG_CONFIG ; then
+ # Only some architectures with OF support have this target
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 92e6524a3a9d..b55cb96d1fed 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1252,7 +1252,7 @@ static int snd_seq_ioctl_set_client_info(struct snd_seq_client *client,
+
+ /* fill the info fields */
+ if (client_info->name[0])
+- strlcpy(client->name, client_info->name, sizeof(client->name));
++ strscpy(client->name, client_info->name, sizeof(client->name));
+
+ client->filter = client_info->filter;
+ client->event_lost = client_info->event_lost;
+@@ -1530,7 +1530,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
+ /* set queue name */
+ if (!info->name[0])
+ snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue);
+- strlcpy(q->name, info->name, sizeof(q->name));
++ strscpy(q->name, info->name, sizeof(q->name));
+ snd_use_lock_free(&q->use_lock);
+
+ return 0;
+@@ -1592,7 +1592,7 @@ static int snd_seq_ioctl_set_queue_info(struct snd_seq_client *client,
+ queuefree(q);
+ return -EPERM;
+ }
+- strlcpy(q->name, info->name, sizeof(q->name));
++ strscpy(q->name, info->name, sizeof(q->name));
+ queuefree(q);
+
+ return 0;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 7572b8cc7127..9bc8a7cb40ea 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2272,6 +2272,8 @@ static struct snd_pci_quirk power_save_blacklist[] = {
+ SND_PCI_QUIRK(0x8086, 0x2040, "Intel DZ77BH-55K", 0),
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=199607 */
+ SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0),
++ /* https://bugs.launchpad.net/bugs/1821663 */
++ SND_PCI_QUIRK(0x8086, 0x2064, "Intel SDP 8086:2064", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */
+ SND_PCI_QUIRK(0x8086, 0x2068, "Intel NUC7i3BNB", 0),
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */
+@@ -2280,6 +2282,8 @@ static struct snd_pci_quirk power_save_blacklist[] = {
+ SND_PCI_QUIRK(0x17aa, 0x367b, "Lenovo IdeaCentre B550", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */
+ SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0),
++ /* https://bugs.launchpad.net/bugs/1821663 */
++ SND_PCI_QUIRK(0x1631, 0xe017, "Packard Bell NEC IMEDIA 5204", 0),
+ {}
+ };
+ #endif /* CONFIG_PM */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 4c6321ec844d..b9d832bde23e 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1864,8 +1864,8 @@ enum {
+ ALC887_FIXUP_BASS_CHMAP,
+ ALC1220_FIXUP_GB_DUAL_CODECS,
+ ALC1220_FIXUP_CLEVO_P950,
+- ALC1220_FIXUP_SYSTEM76_ORYP5,
+- ALC1220_FIXUP_SYSTEM76_ORYP5_PINS,
++ ALC1220_FIXUP_CLEVO_PB51ED,
++ ALC1220_FIXUP_CLEVO_PB51ED_PINS,
+ };
+
+ static void alc889_fixup_coef(struct hda_codec *codec,
+@@ -2070,7 +2070,7 @@ static void alc1220_fixup_clevo_p950(struct hda_codec *codec,
+ static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action);
+
+-static void alc1220_fixup_system76_oryp5(struct hda_codec *codec,
++static void alc1220_fixup_clevo_pb51ed(struct hda_codec *codec,
+ const struct hda_fixup *fix,
+ int action)
+ {
+@@ -2322,18 +2322,18 @@ static const struct hda_fixup alc882_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc1220_fixup_clevo_p950,
+ },
+- [ALC1220_FIXUP_SYSTEM76_ORYP5] = {
++ [ALC1220_FIXUP_CLEVO_PB51ED] = {
+ .type = HDA_FIXUP_FUNC,
+- .v.func = alc1220_fixup_system76_oryp5,
++ .v.func = alc1220_fixup_clevo_pb51ed,
+ },
+- [ALC1220_FIXUP_SYSTEM76_ORYP5_PINS] = {
++ [ALC1220_FIXUP_CLEVO_PB51ED_PINS] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+ {}
+ },
+ .chained = true,
+- .chain_id = ALC1220_FIXUP_SYSTEM76_ORYP5,
++ .chain_id = ALC1220_FIXUP_CLEVO_PB51ED,
+ },
+ };
+
+@@ -2411,8 +2411,9 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
+- SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
+- SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_SYSTEM76_ORYP5_PINS),
++ SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x65d1, "Tuxedo Book XC1509", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
+@@ -5594,6 +5595,7 @@ enum {
+ ALC233_FIXUP_ASUS_MIC_NO_PRESENCE,
+ ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE,
+ ALC233_FIXUP_LENOVO_MULTI_CODECS,
++ ALC233_FIXUP_ACER_HEADSET_MIC,
+ ALC294_FIXUP_LENOVO_MIC_LOCATION,
+ ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE,
+ ALC700_FIXUP_INTEL_REFERENCE,
+@@ -6401,6 +6403,16 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc233_alc662_fixup_lenovo_dual_codecs,
+ },
++ [ALC233_FIXUP_ACER_HEADSET_MIC] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x45 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x5089 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC233_FIXUP_ASUS_MIC_NO_PRESENCE
++ },
+ [ALC294_FIXUP_LENOVO_MIC_LOCATION] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -6644,6 +6656,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
+diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
+index 4daefa5b150a..38fd32ab443c 100644
+--- a/sound/soc/fsl/fsl_esai.c
++++ b/sound/soc/fsl/fsl_esai.c
+@@ -54,6 +54,8 @@ struct fsl_esai {
+ u32 fifo_depth;
+ u32 slot_width;
+ u32 slots;
++ u32 tx_mask;
++ u32 rx_mask;
+ u32 hck_rate[2];
+ u32 sck_rate[2];
+ bool hck_dir[2];
+@@ -361,21 +363,13 @@ static int fsl_esai_set_dai_tdm_slot(struct snd_soc_dai *dai, u32 tx_mask,
+ regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR,
+ ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots));
+
+- regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMA,
+- ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(tx_mask));
+- regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMB,
+- ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(tx_mask));
+-
+ regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR,
+ ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots));
+
+- regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMA,
+- ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(rx_mask));
+- regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMB,
+- ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(rx_mask));
+-
+ esai_priv->slot_width = slot_width;
+ esai_priv->slots = slots;
++ esai_priv->tx_mask = tx_mask;
++ esai_priv->rx_mask = rx_mask;
+
+ return 0;
+ }
+@@ -596,6 +590,7 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd,
+ bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK;
+ u8 i, channels = substream->runtime->channels;
+ u32 pins = DIV_ROUND_UP(channels, esai_priv->slots);
++ u32 mask;
+
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
+@@ -608,15 +603,38 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd,
+ for (i = 0; tx && i < channels; i++)
+ regmap_write(esai_priv->regmap, REG_ESAI_ETDR, 0x0);
+
++ /*
++ * When set the TE/RE in the end of enablement flow, there
++ * will be channel swap issue for multi data line case.
++ * In order to workaround this issue, we switch the bit
++ * enablement sequence to below sequence
++ * 1) clear the xSMB & xSMA: which is done in probe and
++ * stop state.
++ * 2) set TE/RE
++ * 3) set xSMB
++ * 4) set xSMA: xSMA is the last one in this flow, which
++ * will trigger esai to start.
++ */
+ regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx),
+ tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK,
+ tx ? ESAI_xCR_TE(pins) : ESAI_xCR_RE(pins));
++ mask = tx ? esai_priv->tx_mask : esai_priv->rx_mask;
++
++ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx),
++ ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(mask));
++ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx),
++ ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(mask));
++
+ break;
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+ regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx),
+ tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK, 0);
++ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx),
++ ESAI_xSMA_xS_MASK, 0);
++ regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx),
++ ESAI_xSMB_xS_MASK, 0);
+
+ /* Disable and reset FIFO */
+ regmap_update_bits(esai_priv->regmap, REG_ESAI_xFCR(tx),
+@@ -906,6 +924,15 @@ static int fsl_esai_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++ esai_priv->tx_mask = 0xFFFFFFFF;
++ esai_priv->rx_mask = 0xFFFFFFFF;
++
++ /* Clear the TSMA, TSMB, RSMA, RSMB */
++ regmap_write(esai_priv->regmap, REG_ESAI_TSMA, 0);
++ regmap_write(esai_priv->regmap, REG_ESAI_TSMB, 0);
++ regmap_write(esai_priv->regmap, REG_ESAI_RSMA, 0);
++ regmap_write(esai_priv->regmap, REG_ESAI_RSMB, 0);
++
+ ret = devm_snd_soc_register_component(&pdev->dev, &fsl_esai_component,
+ &fsl_esai_dai, 1);
+ if (ret) {
+diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+index e662400873ec..6868e71e3a3f 100644
+--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+@@ -711,9 +711,17 @@ static int sst_soc_probe(struct snd_soc_component *component)
+ return sst_dsp_init_v2_dpcm(component);
+ }
+
++static void sst_soc_remove(struct snd_soc_component *component)
++{
++ struct sst_data *drv = dev_get_drvdata(component->dev);
++
++ drv->soc_card = NULL;
++}
++
+ static const struct snd_soc_component_driver sst_soc_platform_drv = {
+ .name = DRV_NAME,
+ .probe = sst_soc_probe,
++ .remove = sst_soc_remove,
+ .ops = &sst_platform_ops,
+ .compr_ops = &sst_platform_compr_ops,
+ .pcm_new = sst_pcm_new,
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json b/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
+index 3aca33c00039..618def9bdf0e 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/sample.json
+@@ -143,6 +143,30 @@
+ "$TC actions flush action sample"
+ ]
+ },
++ {
++ "id": "7571",
++ "name": "Add sample action with invalid rate",
++ "category": [
++ "actions",
++ "sample"
++ ],
++ "setup": [
++ [
++ "$TC actions flush action sample",
++ 0,
++ 1,
++ 255
++ ]
++ ],
++ "cmdUnderTest": "$TC actions add action sample rate 0 group 1 index 2",
++ "expExitCode": "255",
++ "verifyCmd": "$TC actions get action sample index 2",
++ "matchPattern": "action order [0-9]+: sample rate 1/0 group 1.*index 2 ref",
++ "matchCount": "0",
++ "teardown": [
++ "$TC actions flush action sample"
++ ]
++ },
+ {
+ "id": "b6d4",
+ "name": "Add sample action with mandatory arguments and invalid control action",
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-04-20 11:09 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-04-20 11:09 UTC (permalink / raw
To: gentoo-commits
commit: 466fe7cb06476e8a577628c1620bdaff6551d949
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Apr 20 11:09:34 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Apr 20 11:09:34 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=466fe7cb
Linux patch 4.19.36
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1035_linux-4.19.36.patch | 7962 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 7966 insertions(+)
diff --git a/0000_README b/0000_README
index fbfea55..043542a 100644
--- a/0000_README
+++ b/0000_README
@@ -183,6 +183,10 @@ Patch: 1034_linux-4.19.35.patch
From: http://www.kernel.org
Desc: Linux 4.19.35
+Patch: 1035_linux-4.19.36.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.36
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1035_linux-4.19.36.patch b/1035_linux-4.19.36.patch
new file mode 100644
index 0000000..a57f768
--- /dev/null
+++ b/1035_linux-4.19.36.patch
@@ -0,0 +1,7962 @@
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 9e9b19ecf6f7..11a59e82d92e 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -7320,6 +7320,12 @@ L: alsa-devel@alsa-project.org (moderated for non-subscribers)
+ S: Supported
+ F: sound/soc/intel/
+
++INTEL ATOMISP2 DUMMY / POWER-MANAGEMENT DRIVER
++M: Hans de Goede <hdegoede@redhat.com>
++L: platform-driver-x86@vger.kernel.org
++S: Maintained
++F: drivers/platform/x86/intel_atomisp2_pm.c
++
+ INTEL C600 SERIES SAS CONTROLLER DRIVER
+ M: Intel SCU Linux support <intel-linux-scu@intel.com>
+ M: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
+diff --git a/Makefile b/Makefile
+index f4229975b48c..3fac08f6a11e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 35
++SUBLEVEL = 36
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
+index 2a1d2cbfee1a..651fa7978e51 100644
+--- a/arch/arc/configs/hsdk_defconfig
++++ b/arch/arc/configs/hsdk_defconfig
+@@ -8,6 +8,7 @@ CONFIG_NAMESPACES=y
+ # CONFIG_UTS_NS is not set
+ # CONFIG_PID_NS is not set
+ CONFIG_BLK_DEV_INITRD=y
++CONFIG_BLK_DEV_RAM=y
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_VM_EVENT_COUNTERS is not set
+diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
+index 1f945d0f40da..208bf2c9e7b0 100644
+--- a/arch/arc/kernel/head.S
++++ b/arch/arc/kernel/head.S
+@@ -107,6 +107,7 @@ ENTRY(stext)
+ ; r2 = pointer to uboot provided cmdline or external DTB in mem
+ ; These are handled later in handle_uboot_args()
+ st r0, [@uboot_tag]
++ st r1, [@uboot_magic]
+ st r2, [@uboot_arg]
+ #endif
+
+diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
+index 3320ca2fe20f..a1218937abd6 100644
+--- a/arch/arc/kernel/setup.c
++++ b/arch/arc/kernel/setup.c
+@@ -35,6 +35,7 @@ unsigned int intr_to_DE_cnt;
+
+ /* Part of U-boot ABI: see head.S */
+ int __initdata uboot_tag;
++int __initdata uboot_magic;
+ char __initdata *uboot_arg;
+
+ const struct machine_desc *machine_desc;
+@@ -484,6 +485,8 @@ static inline bool uboot_arg_invalid(unsigned long addr)
+ #define UBOOT_TAG_NONE 0
+ #define UBOOT_TAG_CMDLINE 1
+ #define UBOOT_TAG_DTB 2
++/* We always pass 0 as magic from U-boot */
++#define UBOOT_MAGIC_VALUE 0
+
+ void __init handle_uboot_args(void)
+ {
+@@ -499,6 +502,11 @@ void __init handle_uboot_args(void)
+ goto ignore_uboot_args;
+ }
+
++ if (uboot_magic != UBOOT_MAGIC_VALUE) {
++ pr_warn(IGNORE_ARGS "non zero uboot magic\n");
++ goto ignore_uboot_args;
++ }
++
+ if (uboot_tag != UBOOT_TAG_NONE &&
+ uboot_arg_invalid((unsigned long)uboot_arg)) {
+ pr_warn(IGNORE_ARGS "invalid uboot arg: '%px'\n", uboot_arg);
+diff --git a/arch/arm/crypto/sha256-armv4.pl b/arch/arm/crypto/sha256-armv4.pl
+index b9ec44060ed3..a03cf4dfb781 100644
+--- a/arch/arm/crypto/sha256-armv4.pl
++++ b/arch/arm/crypto/sha256-armv4.pl
+@@ -212,10 +212,11 @@ K256:
+ .global sha256_block_data_order
+ .type sha256_block_data_order,%function
+ sha256_block_data_order:
++.Lsha256_block_data_order:
+ #if __ARM_ARCH__<7
+ sub r3,pc,#8 @ sha256_block_data_order
+ #else
+- adr r3,sha256_block_data_order
++ adr r3,.Lsha256_block_data_order
+ #endif
+ #if __ARM_MAX_ARCH__>=7 && !defined(__KERNEL__)
+ ldr r12,.LOPENSSL_armcap
+diff --git a/arch/arm/crypto/sha256-core.S_shipped b/arch/arm/crypto/sha256-core.S_shipped
+index 3b58300d611c..054aae0edfce 100644
+--- a/arch/arm/crypto/sha256-core.S_shipped
++++ b/arch/arm/crypto/sha256-core.S_shipped
+@@ -93,10 +93,11 @@ K256:
+ .global sha256_block_data_order
+ .type sha256_block_data_order,%function
+ sha256_block_data_order:
++.Lsha256_block_data_order:
+ #if __ARM_ARCH__<7
+ sub r3,pc,#8 @ sha256_block_data_order
+ #else
+- adr r3,sha256_block_data_order
++ adr r3,.Lsha256_block_data_order
+ #endif
+ #if __ARM_MAX_ARCH__>=7 && !defined(__KERNEL__)
+ ldr r12,.LOPENSSL_armcap
+diff --git a/arch/arm/crypto/sha512-armv4.pl b/arch/arm/crypto/sha512-armv4.pl
+index fb5d15048c0b..788c17b56ecc 100644
+--- a/arch/arm/crypto/sha512-armv4.pl
++++ b/arch/arm/crypto/sha512-armv4.pl
+@@ -274,10 +274,11 @@ WORD64(0x5fcb6fab,0x3ad6faec, 0x6c44198c,0x4a475817)
+ .global sha512_block_data_order
+ .type sha512_block_data_order,%function
+ sha512_block_data_order:
++.Lsha512_block_data_order:
+ #if __ARM_ARCH__<7
+ sub r3,pc,#8 @ sha512_block_data_order
+ #else
+- adr r3,sha512_block_data_order
++ adr r3,.Lsha512_block_data_order
+ #endif
+ #if __ARM_MAX_ARCH__>=7 && !defined(__KERNEL__)
+ ldr r12,.LOPENSSL_armcap
+diff --git a/arch/arm/crypto/sha512-core.S_shipped b/arch/arm/crypto/sha512-core.S_shipped
+index b1c334a49cda..710ea309769e 100644
+--- a/arch/arm/crypto/sha512-core.S_shipped
++++ b/arch/arm/crypto/sha512-core.S_shipped
+@@ -141,10 +141,11 @@ WORD64(0x5fcb6fab,0x3ad6faec, 0x6c44198c,0x4a475817)
+ .global sha512_block_data_order
+ .type sha512_block_data_order,%function
+ sha512_block_data_order:
++.Lsha512_block_data_order:
+ #if __ARM_ARCH__<7
+ sub r3,pc,#8 @ sha512_block_data_order
+ #else
+- adr r3,sha512_block_data_order
++ adr r3,.Lsha512_block_data_order
+ #endif
+ #if __ARM_MAX_ARCH__>=7 && !defined(__KERNEL__)
+ ldr r12,.LOPENSSL_armcap
+diff --git a/arch/arm/kernel/patch.c b/arch/arm/kernel/patch.c
+index a50dc00d79a2..d0a05a3bdb96 100644
+--- a/arch/arm/kernel/patch.c
++++ b/arch/arm/kernel/patch.c
+@@ -16,7 +16,7 @@ struct patch {
+ unsigned int insn;
+ };
+
+-static DEFINE_SPINLOCK(patch_lock);
++static DEFINE_RAW_SPINLOCK(patch_lock);
+
+ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags)
+ __acquires(&patch_lock)
+@@ -33,7 +33,7 @@ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags)
+ return addr;
+
+ if (flags)
+- spin_lock_irqsave(&patch_lock, *flags);
++ raw_spin_lock_irqsave(&patch_lock, *flags);
+ else
+ __acquire(&patch_lock);
+
+@@ -48,7 +48,7 @@ static void __kprobes patch_unmap(int fixmap, unsigned long *flags)
+ clear_fixmap(fixmap);
+
+ if (flags)
+- spin_unlock_irqrestore(&patch_lock, *flags);
++ raw_spin_unlock_irqrestore(&patch_lock, *flags);
+ else
+ __release(&patch_lock);
+ }
+diff --git a/arch/arm/plat-samsung/Kconfig b/arch/arm/plat-samsung/Kconfig
+index b600e38364eb..377ff9cda667 100644
+--- a/arch/arm/plat-samsung/Kconfig
++++ b/arch/arm/plat-samsung/Kconfig
+@@ -256,7 +256,7 @@ config S3C_PM_DEBUG_LED_SMDK
+
+ config SAMSUNG_PM_CHECK
+ bool "S3C2410 PM Suspend Memory CRC"
+- depends on PM
++ depends on PM && (PLAT_S3C24XX || ARCH_S3C64XX || ARCH_S5PV210)
+ select CRC32
+ help
+ Enable the PM code's memory area checksum over sleep. This option
+diff --git a/arch/powerpc/kernel/rtasd.c b/arch/powerpc/kernel/rtasd.c
+index 44d66c33d59d..23b88b923f06 100644
+--- a/arch/powerpc/kernel/rtasd.c
++++ b/arch/powerpc/kernel/rtasd.c
+@@ -274,27 +274,16 @@ void pSeries_log_error(char *buf, unsigned int err_type, int fatal)
+ }
+
+ #ifdef CONFIG_PPC_PSERIES
+-static s32 prrn_update_scope;
+-
+-static void prrn_work_fn(struct work_struct *work)
++static void handle_prrn_event(s32 scope)
+ {
+ /*
+ * For PRRN, we must pass the negative of the scope value in
+ * the RTAS event.
+ */
+- pseries_devicetree_update(-prrn_update_scope);
++ pseries_devicetree_update(-scope);
+ numa_update_cpu_topology(false);
+ }
+
+-static DECLARE_WORK(prrn_work, prrn_work_fn);
+-
+-static void prrn_schedule_update(u32 scope)
+-{
+- flush_work(&prrn_work);
+- prrn_update_scope = scope;
+- schedule_work(&prrn_work);
+-}
+-
+ static void handle_rtas_event(const struct rtas_error_log *log)
+ {
+ if (rtas_error_type(log) != RTAS_TYPE_PRRN || !prrn_is_enabled())
+@@ -303,7 +292,7 @@ static void handle_rtas_event(const struct rtas_error_log *log)
+ /* For PRRN Events the extended log length is used to denote
+ * the scope for calling rtas update-nodes.
+ */
+- prrn_schedule_update(rtas_error_extended_log_length(log));
++ handle_prrn_event(rtas_error_extended_log_length(log));
+ }
+
+ #else
+diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
+index 87abd5145cc9..3fb855155286 100644
+--- a/arch/x86/hyperv/hv_init.c
++++ b/arch/x86/hyperv/hv_init.c
+@@ -101,9 +101,13 @@ static int hv_cpu_init(unsigned int cpu)
+ u64 msr_vp_index;
+ struct hv_vp_assist_page **hvp = &hv_vp_assist_page[smp_processor_id()];
+ void **input_arg;
++ struct page *pg;
+
+ input_arg = (void **)this_cpu_ptr(hyperv_pcpu_input_arg);
+- *input_arg = page_address(alloc_page(GFP_KERNEL));
++ pg = alloc_page(GFP_KERNEL);
++ if (unlikely(!pg))
++ return -ENOMEM;
++ *input_arg = page_address(pg);
+
+ hv_get_vp_index(msr_vp_index);
+
+diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
+index 2c4d5ece7456..93426c5fc70f 100644
+--- a/arch/x86/kernel/aperture_64.c
++++ b/arch/x86/kernel/aperture_64.c
+@@ -14,6 +14,7 @@
+ #define pr_fmt(fmt) "AGP: " fmt
+
+ #include <linux/kernel.h>
++#include <linux/kcore.h>
+ #include <linux/types.h>
+ #include <linux/init.h>
+ #include <linux/memblock.h>
+@@ -57,7 +58,7 @@ int fallback_aper_force __initdata;
+
+ int fix_aperture __initdata = 1;
+
+-#ifdef CONFIG_PROC_VMCORE
++#if defined(CONFIG_PROC_VMCORE) || defined(CONFIG_PROC_KCORE)
+ /*
+ * If the first kernel maps the aperture over e820 RAM, the kdump kernel will
+ * use the same range because it will remain configured in the northbridge.
+@@ -66,20 +67,25 @@ int fix_aperture __initdata = 1;
+ */
+ static unsigned long aperture_pfn_start, aperture_page_count;
+
+-static int gart_oldmem_pfn_is_ram(unsigned long pfn)
++static int gart_mem_pfn_is_ram(unsigned long pfn)
+ {
+ return likely((pfn < aperture_pfn_start) ||
+ (pfn >= aperture_pfn_start + aperture_page_count));
+ }
+
+-static void exclude_from_vmcore(u64 aper_base, u32 aper_order)
++static void __init exclude_from_core(u64 aper_base, u32 aper_order)
+ {
+ aperture_pfn_start = aper_base >> PAGE_SHIFT;
+ aperture_page_count = (32 * 1024 * 1024) << aper_order >> PAGE_SHIFT;
+- WARN_ON(register_oldmem_pfn_is_ram(&gart_oldmem_pfn_is_ram));
++#ifdef CONFIG_PROC_VMCORE
++ WARN_ON(register_oldmem_pfn_is_ram(&gart_mem_pfn_is_ram));
++#endif
++#ifdef CONFIG_PROC_KCORE
++ WARN_ON(register_mem_pfn_is_ram(&gart_mem_pfn_is_ram));
++#endif
+ }
+ #else
+-static void exclude_from_vmcore(u64 aper_base, u32 aper_order)
++static void exclude_from_core(u64 aper_base, u32 aper_order)
+ {
+ }
+ #endif
+@@ -469,7 +475,7 @@ out:
+ * may have allocated the range over its e820 RAM
+ * and fixed up the northbridge
+ */
+- exclude_from_vmcore(last_aper_base, last_aper_order);
++ exclude_from_core(last_aper_base, last_aper_order);
+
+ return 1;
+ }
+@@ -515,7 +521,7 @@ out:
+ * overlap with the first kernel's memory. We can't access the
+ * range through vmcore even though it should be part of the dump.
+ */
+- exclude_from_vmcore(aper_alloc, aper_order);
++ exclude_from_core(aper_alloc, aper_order);
+
+ /* Fix up the north bridges */
+ for (i = 0; i < amd_nb_bus_dev_ranges[i].dev_limit; i++) {
+diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
+index 8949b7ae6d92..fa61c870ada9 100644
+--- a/arch/x86/kernel/cpu/cyrix.c
++++ b/arch/x86/kernel/cpu/cyrix.c
+@@ -124,7 +124,7 @@ static void set_cx86_reorder(void)
+ setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */
+
+ /* Load/Store Serialize to mem access disable (=reorder it) */
+- setCx86_old(CX86_PCR0, getCx86_old(CX86_PCR0) & ~0x80);
++ setCx86(CX86_PCR0, getCx86(CX86_PCR0) & ~0x80);
+ /* set load/store serialize from 1GB to 4GB */
+ ccr3 |= 0xe0;
+ setCx86(CX86_CCR3, ccr3);
+@@ -135,11 +135,11 @@ static void set_cx86_memwb(void)
+ pr_info("Enable Memory-Write-back mode on Cyrix/NSC processor.\n");
+
+ /* CCR2 bit 2: unlock NW bit */
+- setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) & ~0x04);
++ setCx86(CX86_CCR2, getCx86(CX86_CCR2) & ~0x04);
+ /* set 'Not Write-through' */
+ write_cr0(read_cr0() | X86_CR0_NW);
+ /* CCR2 bit 2: lock NW bit and set WT1 */
+- setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) | 0x14);
++ setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x14);
+ }
+
+ /*
+@@ -153,14 +153,14 @@ static void geode_configure(void)
+ local_irq_save(flags);
+
+ /* Suspend on halt power saving and enable #SUSP pin */
+- setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) | 0x88);
++ setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88);
+
+ ccr3 = getCx86(CX86_CCR3);
+ setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */
+
+
+ /* FPU fast, DTE cache, Mem bypass */
+- setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x38);
++ setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x38);
+ setCx86(CX86_CCR3, ccr3); /* disable MAPEN */
+
+ set_cx86_memwb();
+@@ -296,7 +296,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
+ /* GXm supports extended cpuid levels 'ala' AMD */
+ if (c->cpuid_level == 2) {
+ /* Enable cxMMX extensions (GX1 Datasheet 54) */
+- setCx86_old(CX86_CCR7, getCx86_old(CX86_CCR7) | 1);
++ setCx86(CX86_CCR7, getCx86(CX86_CCR7) | 1);
+
+ /*
+ * GXm : 0x30 ... 0x5f GXm datasheet 51
+@@ -319,7 +319,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
+ if (dir1 > 7) {
+ dir0_msn++; /* M II */
+ /* Enable MMX extensions (App note 108) */
+- setCx86_old(CX86_CCR7, getCx86_old(CX86_CCR7)|1);
++ setCx86(CX86_CCR7, getCx86(CX86_CCR7)|1);
+ } else {
+ /* A 6x86MX - it has the bug. */
+ set_cpu_bug(c, X86_BUG_COMA);
+diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
+index b0acb22e5a46..1e3f1f140ffb 100644
+--- a/arch/x86/kernel/hpet.c
++++ b/arch/x86/kernel/hpet.c
+@@ -909,6 +909,8 @@ int __init hpet_enable(void)
+ return 0;
+
+ hpet_set_mapping();
++ if (!hpet_virt_address)
++ return 0;
+
+ /*
+ * Read the period and check for a sane value:
+diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
+index 34a5c1715148..2882fe1d2a78 100644
+--- a/arch/x86/kernel/hw_breakpoint.c
++++ b/arch/x86/kernel/hw_breakpoint.c
+@@ -357,6 +357,7 @@ int hw_breakpoint_arch_parse(struct perf_event *bp,
+ #endif
+ default:
+ WARN_ON_ONCE(1);
++ return -EINVAL;
+ }
+
+ /*
+diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
+index f1c5eb99d445..ddb1ca6923b1 100644
+--- a/arch/x86/kernel/mpparse.c
++++ b/arch/x86/kernel/mpparse.c
+@@ -599,8 +599,8 @@ static int __init smp_scan_config(unsigned long base, unsigned long length)
+ mpf_base = base;
+ mpf_found = true;
+
+- pr_info("found SMP MP-table at [mem %#010lx-%#010lx] mapped at [%p]\n",
+- base, base + sizeof(*mpf) - 1, mpf);
++ pr_info("found SMP MP-table at [mem %#010lx-%#010lx]\n",
++ base, base + sizeof(*mpf) - 1);
+
+ memblock_reserve(base, sizeof(*mpf));
+ if (mpf->physptr)
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 6b6bcafd1d2c..3380a312d186 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -13181,24 +13181,6 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
+ kvm_clear_interrupt_queue(vcpu);
+ }
+
+-static void load_vmcs12_mmu_host_state(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- u32 entry_failure_code;
+-
+- nested_ept_uninit_mmu_context(vcpu);
+-
+- /*
+- * Only PDPTE load can fail as the value of cr3 was checked on entry and
+- * couldn't have changed.
+- */
+- if (nested_vmx_load_cr3(vcpu, vmcs12->host_cr3, false, &entry_failure_code))
+- nested_vmx_abort(vcpu, VMX_ABORT_LOAD_HOST_PDPTE_FAIL);
+-
+- if (!enable_ept)
+- vcpu->arch.walk_mmu->inject_page_fault = kvm_inject_page_fault;
+-}
+-
+ /*
+ * A part of what we need to when the nested L2 guest exits and we want to
+ * run its L1 parent, is to reset L1's guest state to the host state specified
+@@ -13212,6 +13194,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
+ struct vmcs12 *vmcs12)
+ {
+ struct kvm_segment seg;
++ u32 entry_failure_code;
+
+ if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_EFER)
+ vcpu->arch.efer = vmcs12->host_ia32_efer;
+@@ -13238,7 +13221,17 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
+ vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
+ vmx_set_cr4(vcpu, vmcs12->host_cr4);
+
+- load_vmcs12_mmu_host_state(vcpu, vmcs12);
++ nested_ept_uninit_mmu_context(vcpu);
++
++ /*
++ * Only PDPTE load can fail as the value of cr3 was checked on entry and
++ * couldn't have changed.
++ */
++ if (nested_vmx_load_cr3(vcpu, vmcs12->host_cr3, false, &entry_failure_code))
++ nested_vmx_abort(vcpu, VMX_ABORT_LOAD_HOST_PDPTE_FAIL);
++
++ if (!enable_ept)
++ vcpu->arch.walk_mmu->inject_page_fault = kvm_inject_page_fault;
+
+ /*
+ * If vmcs01 don't use VPID, CPU flushes TLB on every
+@@ -13334,6 +13327,140 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
+ nested_vmx_abort(vcpu, VMX_ABORT_LOAD_HOST_MSR_FAIL);
+ }
+
++static inline u64 nested_vmx_get_vmcs01_guest_efer(struct vcpu_vmx *vmx)
++{
++ struct shared_msr_entry *efer_msr;
++ unsigned int i;
++
++ if (vm_entry_controls_get(vmx) & VM_ENTRY_LOAD_IA32_EFER)
++ return vmcs_read64(GUEST_IA32_EFER);
++
++ if (cpu_has_load_ia32_efer)
++ return host_efer;
++
++ for (i = 0; i < vmx->msr_autoload.guest.nr; ++i) {
++ if (vmx->msr_autoload.guest.val[i].index == MSR_EFER)
++ return vmx->msr_autoload.guest.val[i].value;
++ }
++
++ efer_msr = find_msr_entry(vmx, MSR_EFER);
++ if (efer_msr)
++ return efer_msr->data;
++
++ return host_efer;
++}
++
++static void nested_vmx_restore_host_state(struct kvm_vcpu *vcpu)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct vmx_msr_entry g, h;
++ struct msr_data msr;
++ gpa_t gpa;
++ u32 i, j;
++
++ vcpu->arch.pat = vmcs_read64(GUEST_IA32_PAT);
++
++ if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) {
++ /*
++ * L1's host DR7 is lost if KVM_GUESTDBG_USE_HW_BP is set
++ * as vmcs01.GUEST_DR7 contains a userspace defined value
++ * and vcpu->arch.dr7 is not squirreled away before the
++ * nested VMENTER (not worth adding a variable in nested_vmx).
++ */
++ if (vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP)
++ kvm_set_dr(vcpu, 7, DR7_FIXED_1);
++ else
++ WARN_ON(kvm_set_dr(vcpu, 7, vmcs_readl(GUEST_DR7)));
++ }
++
++ /*
++ * Note that calling vmx_set_{efer,cr0,cr4} is important as they
++ * handle a variety of side effects to KVM's software model.
++ */
++ vmx_set_efer(vcpu, nested_vmx_get_vmcs01_guest_efer(vmx));
++
++ vcpu->arch.cr0_guest_owned_bits = X86_CR0_TS;
++ vmx_set_cr0(vcpu, vmcs_readl(CR0_READ_SHADOW));
++
++ vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
++ vmx_set_cr4(vcpu, vmcs_readl(CR4_READ_SHADOW));
++
++ nested_ept_uninit_mmu_context(vcpu);
++ vcpu->arch.cr3 = vmcs_readl(GUEST_CR3);
++ __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
++
++ /*
++ * Use ept_save_pdptrs(vcpu) to load the MMU's cached PDPTRs
++ * from vmcs01 (if necessary). The PDPTRs are not loaded on
++ * VMFail, like everything else we just need to ensure our
++ * software model is up-to-date.
++ */
++ ept_save_pdptrs(vcpu);
++
++ kvm_mmu_reset_context(vcpu);
++
++ if (cpu_has_vmx_msr_bitmap())
++ vmx_update_msr_bitmap(vcpu);
++
++ /*
++ * This nasty bit of open coding is a compromise between blindly
++ * loading L1's MSRs using the exit load lists (incorrect emulation
++ * of VMFail), leaving the nested VM's MSRs in the software model
++ * (incorrect behavior) and snapshotting the modified MSRs (too
++ * expensive since the lists are unbound by hardware). For each
++ * MSR that was (prematurely) loaded from the nested VMEntry load
++ * list, reload it from the exit load list if it exists and differs
++ * from the guest value. The intent is to stuff host state as
++ * silently as possible, not to fully process the exit load list.
++ */
++ msr.host_initiated = false;
++ for (i = 0; i < vmcs12->vm_entry_msr_load_count; i++) {
++ gpa = vmcs12->vm_entry_msr_load_addr + (i * sizeof(g));
++ if (kvm_vcpu_read_guest(vcpu, gpa, &g, sizeof(g))) {
++ pr_debug_ratelimited(
++ "%s read MSR index failed (%u, 0x%08llx)\n",
++ __func__, i, gpa);
++ goto vmabort;
++ }
++
++ for (j = 0; j < vmcs12->vm_exit_msr_load_count; j++) {
++ gpa = vmcs12->vm_exit_msr_load_addr + (j * sizeof(h));
++ if (kvm_vcpu_read_guest(vcpu, gpa, &h, sizeof(h))) {
++ pr_debug_ratelimited(
++ "%s read MSR failed (%u, 0x%08llx)\n",
++ __func__, j, gpa);
++ goto vmabort;
++ }
++ if (h.index != g.index)
++ continue;
++ if (h.value == g.value)
++ break;
++
++ if (nested_vmx_load_msr_check(vcpu, &h)) {
++ pr_debug_ratelimited(
++ "%s check failed (%u, 0x%x, 0x%x)\n",
++ __func__, j, h.index, h.reserved);
++ goto vmabort;
++ }
++
++ msr.index = h.index;
++ msr.data = h.value;
++ if (kvm_set_msr(vcpu, &msr)) {
++ pr_debug_ratelimited(
++ "%s WRMSR failed (%u, 0x%x, 0x%llx)\n",
++ __func__, j, h.index, h.value);
++ goto vmabort;
++ }
++ }
++ }
++
++ return;
++
++vmabort:
++ nested_vmx_abort(vcpu, VMX_ABORT_LOAD_HOST_MSR_FAIL);
++}
++
+ /*
+ * Emulate an exit from nested guest (L2) to L1, i.e., prepare to run L1
+ * and modify vmcs12 to make it see what it would expect to see there if
+@@ -13478,7 +13605,13 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+ */
+ nested_vmx_failValid(vcpu, VMXERR_ENTRY_INVALID_CONTROL_FIELD);
+
+- load_vmcs12_mmu_host_state(vcpu, vmcs12);
++ /*
++ * Restore L1's host state to KVM's software model. We're here
++ * because a consistency check was caught by hardware, which
++ * means some amount of guest state has been propagated to KVM's
++ * model and needs to be unwound to the host's state.
++ */
++ nested_vmx_restore_host_state(vcpu);
+
+ /*
+ * The emulated instruction was already skipped in
+diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
+index b154e057ca67..6b8396ccb5c4 100644
+--- a/block/blk-iolatency.c
++++ b/block/blk-iolatency.c
+@@ -75,6 +75,7 @@
+ #include <linux/blk-mq.h>
+ #include "blk-rq-qos.h"
+ #include "blk-stat.h"
++#include "blk.h"
+
+ #define DEFAULT_SCALE_COOKIE 1000000U
+
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index d4e5610e09c5..49e16f009095 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -194,6 +194,7 @@ static struct workqueue_struct *ec_query_wq;
+ static int EC_FLAGS_QUERY_HANDSHAKE; /* Needs QR_EC issued when SCI_EVT set */
+ static int EC_FLAGS_CORRECT_ECDT; /* Needs ECDT port address correction */
+ static int EC_FLAGS_IGNORE_DSDT_GPE; /* Needs ECDT GPE as correction setting */
++static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
+
+ /* --------------------------------------------------------------------------
+ * Logging/Debugging
+@@ -499,6 +500,26 @@ static inline void __acpi_ec_disable_event(struct acpi_ec *ec)
+ ec_log_drv("event blocked");
+ }
+
++/*
++ * Process _Q events that might have accumulated in the EC.
++ * Run with locked ec mutex.
++ */
++static void acpi_ec_clear(struct acpi_ec *ec)
++{
++ int i, status;
++ u8 value = 0;
++
++ for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
++ status = acpi_ec_query(ec, &value);
++ if (status || !value)
++ break;
++ }
++ if (unlikely(i == ACPI_EC_CLEAR_MAX))
++ pr_warn("Warning: Maximum of %d stale EC events cleared\n", i);
++ else
++ pr_info("%d stale EC events cleared\n", i);
++}
++
+ static void acpi_ec_enable_event(struct acpi_ec *ec)
+ {
+ unsigned long flags;
+@@ -507,6 +528,10 @@ static void acpi_ec_enable_event(struct acpi_ec *ec)
+ if (acpi_ec_started(ec))
+ __acpi_ec_enable_event(ec);
+ spin_unlock_irqrestore(&ec->lock, flags);
++
++ /* Drain additional events if hardware requires that */
++ if (EC_FLAGS_CLEAR_ON_RESUME)
++ acpi_ec_clear(ec);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+@@ -1034,6 +1059,18 @@ void acpi_ec_unblock_transactions(void)
+ acpi_ec_start(first_ec, true);
+ }
+
++void acpi_ec_mark_gpe_for_wake(void)
++{
++ if (first_ec && !ec_no_wakeup)
++ acpi_mark_gpe_for_wake(NULL, first_ec->gpe);
++}
++
++void acpi_ec_set_gpe_wake_mask(u8 action)
++{
++ if (first_ec && !ec_no_wakeup)
++ acpi_set_gpe_wake_mask(NULL, first_ec->gpe, action);
++}
++
+ void acpi_ec_dispatch_gpe(void)
+ {
+ if (first_ec)
+@@ -1808,6 +1845,31 @@ static int ec_flag_query_handshake(const struct dmi_system_id *id)
+ }
+ #endif
+
++/*
++ * On some hardware it is necessary to clear events accumulated by the EC during
++ * sleep. These ECs stop reporting GPEs until they are manually polled, if too
++ * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
++ *
++ * https://bugzilla.kernel.org/show_bug.cgi?id=44161
++ *
++ * Ideally, the EC should also be instructed NOT to accumulate events during
++ * sleep (which Windows seems to do somehow), but the interface to control this
++ * behaviour is not known at this time.
++ *
++ * Models known to be affected are Samsung 530Uxx/535Uxx/540Uxx/550Pxx/900Xxx,
++ * however it is very likely that other Samsung models are affected.
++ *
++ * On systems which don't accumulate _Q events during sleep, this extra check
++ * should be harmless.
++ */
++static int ec_clear_on_resume(const struct dmi_system_id *id)
++{
++ pr_debug("Detected system needing EC poll on resume.\n");
++ EC_FLAGS_CLEAR_ON_RESUME = 1;
++ ec_event_clearing = ACPI_EC_EVT_TIMING_STATUS;
++ return 0;
++}
++
+ /*
+ * Some ECDTs contain wrong register addresses.
+ * MSI MS-171F
+@@ -1857,6 +1919,9 @@ static const struct dmi_system_id ec_dmi_table[] __initconst = {
+ ec_honor_ecdt_gpe, "ASUS X580VD", {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "X580VD"),}, NULL},
++ {
++ ec_clear_on_resume, "Samsung hardware", {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL},
+ {},
+ };
+
+diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
+index 530a3f675490..f59d0b9e2683 100644
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -188,6 +188,8 @@ int acpi_ec_ecdt_probe(void);
+ int acpi_ec_dsdt_probe(void);
+ void acpi_ec_block_transactions(void);
+ void acpi_ec_unblock_transactions(void);
++void acpi_ec_mark_gpe_for_wake(void);
++void acpi_ec_set_gpe_wake_mask(u8 action);
+ void acpi_ec_dispatch_gpe(void);
+ int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
+ acpi_handle handle, acpi_ec_query_func func,
+diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
+index 295b59271189..96c5e27967f4 100644
+--- a/drivers/acpi/sbs.c
++++ b/drivers/acpi/sbs.c
+@@ -441,9 +441,13 @@ static int acpi_ac_get_present(struct acpi_sbs *sbs)
+
+ /*
+ * The spec requires that bit 4 always be 1. If it's not set, assume
+- * that the implementation doesn't support an SBS charger
++ * that the implementation doesn't support an SBS charger.
++ *
++ * And on some MacBooks a status of 0xffff is always returned, no
++ * matter whether the charger is plugged in or not, which is also
++ * wrong, so ignore the SBS charger for those too.
+ */
+- if (!((status >> 4) & 0x1))
++ if (!((status >> 4) & 0x1) || status == 0xffff)
+ return -ENODEV;
+
+ sbs->charger_present = (status >> 15) & 0x1;
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 754d59f95500..74c489047f57 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -940,6 +940,8 @@ static int lps0_device_attach(struct acpi_device *adev,
+
+ acpi_handle_debug(adev->handle, "_DSM function mask: 0x%x\n",
+ bitmask);
++
++ acpi_ec_mark_gpe_for_wake();
+ } else {
+ acpi_handle_debug(adev->handle,
+ "_DSM function 0 evaluation failed\n");
+@@ -968,11 +970,16 @@ static int acpi_s2idle_prepare(void)
+ if (lps0_device_handle) {
+ acpi_sleep_run_lps0_dsm(ACPI_LPS0_SCREEN_OFF);
+ acpi_sleep_run_lps0_dsm(ACPI_LPS0_ENTRY);
++
++ acpi_ec_set_gpe_wake_mask(ACPI_GPE_ENABLE);
+ }
+
+ if (acpi_sci_irq_valid())
+ enable_irq_wake(acpi_sci_irq);
+
++ /* Change the configuration of GPEs to avoid spurious wakeup. */
++ acpi_enable_all_wakeup_gpes();
++ acpi_os_wait_events_complete();
+ return 0;
+ }
+
+@@ -1017,10 +1024,14 @@ static void acpi_s2idle_sync(void)
+
+ static void acpi_s2idle_restore(void)
+ {
++ acpi_enable_all_runtime_gpes();
++
+ if (acpi_sci_irq_valid())
+ disable_irq_wake(acpi_sci_irq);
+
+ if (lps0_device_handle) {
++ acpi_ec_set_gpe_wake_mask(ACPI_GPE_DISABLE);
++
+ acpi_sleep_run_lps0_dsm(ACPI_LPS0_EXIT);
+ acpi_sleep_run_lps0_dsm(ACPI_LPS0_SCREEN_ON);
+ }
+diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c
+index 78db97687f26..c4b06cc075f9 100644
+--- a/drivers/acpi/utils.c
++++ b/drivers/acpi/utils.c
+@@ -800,6 +800,7 @@ bool acpi_dev_present(const char *hid, const char *uid, s64 hrv)
+ match.hrv = hrv;
+
+ dev = bus_find_device(&acpi_bus_type, NULL, &match, acpi_dev_match_cb);
++ put_device(dev);
+ return !!dev;
+ }
+ EXPORT_SYMBOL(acpi_dev_present);
+diff --git a/drivers/auxdisplay/hd44780.c b/drivers/auxdisplay/hd44780.c
+index f1a42f0f1ded..df3da49ff9e8 100644
+--- a/drivers/auxdisplay/hd44780.c
++++ b/drivers/auxdisplay/hd44780.c
+@@ -299,6 +299,8 @@ static int hd44780_remove(struct platform_device *pdev)
+ struct charlcd *lcd = platform_get_drvdata(pdev);
+
+ charlcd_unregister(lcd);
++
++ kfree(lcd);
+ return 0;
+ }
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 1ac4c36e13bb..c3968e2d0a98 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -197,11 +197,16 @@ static ssize_t node_read_vmstat(struct device *dev,
+ sum_zone_numa_state(nid, i));
+ #endif
+
+- for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++)
++ for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++) {
++ /* Skip hidden vmstat items. */
++ if (*vmstat_text[i + NR_VM_ZONE_STAT_ITEMS +
++ NR_VM_NUMA_STAT_ITEMS] == '\0')
++ continue;
+ n += sprintf(buf+n, "%s %lu\n",
+ vmstat_text[i + NR_VM_ZONE_STAT_ITEMS +
+ NR_VM_NUMA_STAT_ITEMS],
+ node_page_state(pgdat, i));
++ }
+
+ return n;
+ }
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index 4b5714199490..bf5be0bfaf77 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -1388,12 +1388,12 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
+ if (IS_ERR(gpd_data))
+ return PTR_ERR(gpd_data);
+
+- genpd_lock(genpd);
+-
+ ret = genpd->attach_dev ? genpd->attach_dev(genpd, dev) : 0;
+ if (ret)
+ goto out;
+
++ genpd_lock(genpd);
++
+ dev_pm_domain_set(dev, &genpd->domain);
+
+ genpd->device_count++;
+@@ -1401,9 +1401,8 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
+
+ list_add_tail(&gpd_data->base.list_node, &genpd->dev_list);
+
+- out:
+ genpd_unlock(genpd);
+-
++ out:
+ if (ret)
+ genpd_free_dev_data(dev, gpd_data);
+ else
+@@ -1452,15 +1451,15 @@ static int genpd_remove_device(struct generic_pm_domain *genpd,
+ genpd->device_count--;
+ genpd->max_off_time_changed = true;
+
+- if (genpd->detach_dev)
+- genpd->detach_dev(genpd, dev);
+-
+ dev_pm_domain_set(dev, NULL);
+
+ list_del_init(&pdd->list_node);
+
+ genpd_unlock(genpd);
+
++ if (genpd->detach_dev)
++ genpd->detach_dev(genpd, dev);
++
+ genpd_free_dev_data(dev, gpd_data);
+
+ return 0;
+diff --git a/drivers/crypto/axis/artpec6_crypto.c b/drivers/crypto/axis/artpec6_crypto.c
+index 7f07a5085e9b..fdcdc751d03b 100644
+--- a/drivers/crypto/axis/artpec6_crypto.c
++++ b/drivers/crypto/axis/artpec6_crypto.c
+@@ -284,6 +284,7 @@ enum artpec6_crypto_hash_flags {
+
+ struct artpec6_crypto_req_common {
+ struct list_head list;
++ struct list_head complete_in_progress;
+ struct artpec6_crypto_dma_descriptors *dma;
+ struct crypto_async_request *req;
+ void (*complete)(struct crypto_async_request *req);
+@@ -2046,7 +2047,8 @@ static int artpec6_crypto_prepare_aead(struct aead_request *areq)
+ return artpec6_crypto_dma_map_descs(common);
+ }
+
+-static void artpec6_crypto_process_queue(struct artpec6_crypto *ac)
++static void artpec6_crypto_process_queue(struct artpec6_crypto *ac,
++ struct list_head *completions)
+ {
+ struct artpec6_crypto_req_common *req;
+
+@@ -2057,7 +2059,7 @@ static void artpec6_crypto_process_queue(struct artpec6_crypto *ac)
+ list_move_tail(&req->list, &ac->pending);
+ artpec6_crypto_start_dma(req);
+
+- req->req->complete(req->req, -EINPROGRESS);
++ list_add_tail(&req->complete_in_progress, completions);
+ }
+
+ /*
+@@ -2087,6 +2089,11 @@ static void artpec6_crypto_task(unsigned long data)
+ struct artpec6_crypto *ac = (struct artpec6_crypto *)data;
+ struct artpec6_crypto_req_common *req;
+ struct artpec6_crypto_req_common *n;
++ struct list_head complete_done;
++ struct list_head complete_in_progress;
++
++ INIT_LIST_HEAD(&complete_done);
++ INIT_LIST_HEAD(&complete_in_progress);
+
+ if (list_empty(&ac->pending)) {
+ pr_debug("Spurious IRQ\n");
+@@ -2120,19 +2127,30 @@ static void artpec6_crypto_task(unsigned long data)
+
+ pr_debug("Completing request %p\n", req);
+
+- list_del(&req->list);
++ list_move_tail(&req->list, &complete_done);
+
+ artpec6_crypto_dma_unmap_all(req);
+ artpec6_crypto_copy_bounce_buffers(req);
+
+ ac->pending_count--;
+ artpec6_crypto_common_destroy(req);
+- req->complete(req->req);
+ }
+
+- artpec6_crypto_process_queue(ac);
++ artpec6_crypto_process_queue(ac, &complete_in_progress);
+
+ spin_unlock_bh(&ac->queue_lock);
++
++ /* Perform the completion callbacks without holding the queue lock
++ * to allow new request submissions from the callbacks.
++ */
++ list_for_each_entry_safe(req, n, &complete_done, list) {
++ req->complete(req->req);
++ }
++
++ list_for_each_entry_safe(req, n, &complete_in_progress,
++ complete_in_progress) {
++ req->req->complete(req->req, -EINPROGRESS);
++ }
+ }
+
+ static void artpec6_crypto_complete_crypto(struct crypto_async_request *req)
+diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
+index eb27fa76e8fc..bcc6be4a5cb2 100644
+--- a/drivers/gpio/gpio-pxa.c
++++ b/drivers/gpio/gpio-pxa.c
+@@ -777,6 +777,9 @@ static int pxa_gpio_suspend(void)
+ struct pxa_gpio_bank *c;
+ int gpio;
+
++ if (!pchip)
++ return 0;
++
+ for_each_gpio_bank(gpio, c, pchip) {
+ c->saved_gplr = readl_relaxed(c->regbase + GPLR_OFFSET);
+ c->saved_gpdr = readl_relaxed(c->regbase + GPDR_OFFSET);
+@@ -795,6 +798,9 @@ static void pxa_gpio_resume(void)
+ struct pxa_gpio_bank *c;
+ int gpio;
+
++ if (!pchip)
++ return;
++
+ for_each_gpio_bank(gpio, c, pchip) {
+ /* restore level with set/clear */
+ writel_relaxed(c->saved_gplr, c->regbase + GPSR_OFFSET);
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c
+index 47243165a082..ae90a99909ef 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c
+@@ -323,57 +323,7 @@ static int init_mqd_hiq(struct mqd_manager *mm, void **mqd,
+ struct kfd_mem_obj **mqd_mem_obj, uint64_t *gart_addr,
+ struct queue_properties *q)
+ {
+- uint64_t addr;
+- struct cik_mqd *m;
+- int retval;
+-
+- retval = kfd_gtt_sa_allocate(mm->dev, sizeof(struct cik_mqd),
+- mqd_mem_obj);
+-
+- if (retval != 0)
+- return -ENOMEM;
+-
+- m = (struct cik_mqd *) (*mqd_mem_obj)->cpu_ptr;
+- addr = (*mqd_mem_obj)->gpu_addr;
+-
+- memset(m, 0, ALIGN(sizeof(struct cik_mqd), 256));
+-
+- m->header = 0xC0310800;
+- m->compute_pipelinestat_enable = 1;
+- m->compute_static_thread_mgmt_se0 = 0xFFFFFFFF;
+- m->compute_static_thread_mgmt_se1 = 0xFFFFFFFF;
+- m->compute_static_thread_mgmt_se2 = 0xFFFFFFFF;
+- m->compute_static_thread_mgmt_se3 = 0xFFFFFFFF;
+-
+- m->cp_hqd_persistent_state = DEFAULT_CP_HQD_PERSISTENT_STATE |
+- PRELOAD_REQ;
+- m->cp_hqd_quantum = QUANTUM_EN | QUANTUM_SCALE_1MS |
+- QUANTUM_DURATION(10);
+-
+- m->cp_mqd_control = MQD_CONTROL_PRIV_STATE_EN;
+- m->cp_mqd_base_addr_lo = lower_32_bits(addr);
+- m->cp_mqd_base_addr_hi = upper_32_bits(addr);
+-
+- m->cp_hqd_ib_control = DEFAULT_MIN_IB_AVAIL_SIZE;
+-
+- /*
+- * Pipe Priority
+- * Identifies the pipe relative priority when this queue is connected
+- * to the pipeline. The pipe priority is against the GFX pipe and HP3D.
+- * In KFD we are using a fixed pipe priority set to CS_MEDIUM.
+- * 0 = CS_LOW (typically below GFX)
+- * 1 = CS_MEDIUM (typically between HP3D and GFX
+- * 2 = CS_HIGH (typically above HP3D)
+- */
+- m->cp_hqd_pipe_priority = 1;
+- m->cp_hqd_queue_priority = 15;
+-
+- *mqd = m;
+- if (gart_addr)
+- *gart_addr = addr;
+- retval = mm->update_mqd(mm, m, q);
+-
+- return retval;
++ return init_mqd(mm, mqd, mqd_mem_obj, gart_addr, q);
+ }
+
+ static int update_mqd_hiq(struct mqd_manager *mm, void *mqd,
+diff --git a/drivers/gpu/drm/cirrus/cirrus_drv.h b/drivers/gpu/drm/cirrus/cirrus_drv.h
+index ce9db7aab225..a29f87e98d9d 100644
+--- a/drivers/gpu/drm/cirrus/cirrus_drv.h
++++ b/drivers/gpu/drm/cirrus/cirrus_drv.h
+@@ -146,7 +146,7 @@ struct cirrus_device {
+
+ struct cirrus_fbdev {
+ struct drm_fb_helper helper;
+- struct drm_framebuffer gfb;
++ struct drm_framebuffer *gfb;
+ void *sysram;
+ int size;
+ int x1, y1, x2, y2; /* dirty rect */
+diff --git a/drivers/gpu/drm/cirrus/cirrus_fbdev.c b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
+index b643ac92801c..82cc82e0bd80 100644
+--- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c
++++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
+@@ -22,14 +22,14 @@ static void cirrus_dirty_update(struct cirrus_fbdev *afbdev,
+ struct drm_gem_object *obj;
+ struct cirrus_bo *bo;
+ int src_offset, dst_offset;
+- int bpp = afbdev->gfb.format->cpp[0];
++ int bpp = afbdev->gfb->format->cpp[0];
+ int ret = -EBUSY;
+ bool unmap = false;
+ bool store_for_later = false;
+ int x2, y2;
+ unsigned long flags;
+
+- obj = afbdev->gfb.obj[0];
++ obj = afbdev->gfb->obj[0];
+ bo = gem_to_cirrus_bo(obj);
+
+ /*
+@@ -82,7 +82,7 @@ static void cirrus_dirty_update(struct cirrus_fbdev *afbdev,
+ }
+ for (i = y; i < y + height; i++) {
+ /* assume equal stride for now */
+- src_offset = dst_offset = i * afbdev->gfb.pitches[0] + (x * bpp);
++ src_offset = dst_offset = i * afbdev->gfb->pitches[0] + (x * bpp);
+ memcpy_toio(bo->kmap.virtual + src_offset, afbdev->sysram + src_offset, width * bpp);
+
+ }
+@@ -192,23 +192,26 @@ static int cirrusfb_create(struct drm_fb_helper *helper,
+ return -ENOMEM;
+
+ info = drm_fb_helper_alloc_fbi(helper);
+- if (IS_ERR(info))
+- return PTR_ERR(info);
++ if (IS_ERR(info)) {
++ ret = PTR_ERR(info);
++ goto err_vfree;
++ }
+
+ info->par = gfbdev;
+
+- ret = cirrus_framebuffer_init(cdev->dev, &gfbdev->gfb, &mode_cmd, gobj);
++ fb = kzalloc(sizeof(*fb), GFP_KERNEL);
++ if (!fb) {
++ ret = -ENOMEM;
++ goto err_drm_gem_object_put_unlocked;
++ }
++
++ ret = cirrus_framebuffer_init(cdev->dev, fb, &mode_cmd, gobj);
+ if (ret)
+- return ret;
++ goto err_kfree;
+
+ gfbdev->sysram = sysram;
+ gfbdev->size = size;
+-
+- fb = &gfbdev->gfb;
+- if (!fb) {
+- DRM_INFO("fb is NULL\n");
+- return -EINVAL;
+- }
++ gfbdev->gfb = fb;
+
+ /* setup helper */
+ gfbdev->helper.fb = fb;
+@@ -241,24 +244,27 @@ static int cirrusfb_create(struct drm_fb_helper *helper,
+ DRM_INFO(" pitch is %d\n", fb->pitches[0]);
+
+ return 0;
++
++err_kfree:
++ kfree(fb);
++err_drm_gem_object_put_unlocked:
++ drm_gem_object_put_unlocked(gobj);
++err_vfree:
++ vfree(sysram);
++ return ret;
+ }
+
+ static int cirrus_fbdev_destroy(struct drm_device *dev,
+ struct cirrus_fbdev *gfbdev)
+ {
+- struct drm_framebuffer *gfb = &gfbdev->gfb;
++ struct drm_framebuffer *gfb = gfbdev->gfb;
+
+ drm_fb_helper_unregister_fbi(&gfbdev->helper);
+
+- if (gfb->obj[0]) {
+- drm_gem_object_put_unlocked(gfb->obj[0]);
+- gfb->obj[0] = NULL;
+- }
+-
+ vfree(gfbdev->sysram);
+ drm_fb_helper_fini(&gfbdev->helper);
+- drm_framebuffer_unregister_private(gfb);
+- drm_framebuffer_cleanup(gfb);
++ if (gfb)
++ drm_framebuffer_put(gfb);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/cirrus/cirrus_mode.c b/drivers/gpu/drm/cirrus/cirrus_mode.c
+index 336bfda40125..90a4e641d3fb 100644
+--- a/drivers/gpu/drm/cirrus/cirrus_mode.c
++++ b/drivers/gpu/drm/cirrus/cirrus_mode.c
+@@ -127,7 +127,7 @@ static int cirrus_crtc_do_set_base(struct drm_crtc *crtc,
+ return ret;
+ }
+
+- if (&cdev->mode_info.gfbdev->gfb == crtc->primary->fb) {
++ if (cdev->mode_info.gfbdev->gfb == crtc->primary->fb) {
+ /* if pushing console in kmap it */
+ ret = ttm_bo_kmap(&bo->bo, 0, bo->bo.num_pages, &bo->kmap);
+ if (ret)
+diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
+index ffbf4a950f69..522d6c46d7b1 100644
+--- a/drivers/gpu/drm/exynos/exynos_mixer.c
++++ b/drivers/gpu/drm/exynos/exynos_mixer.c
+@@ -20,6 +20,7 @@
+ #include "regs-vp.h"
+
+ #include <linux/kernel.h>
++#include <linux/ktime.h>
+ #include <linux/spinlock.h>
+ #include <linux/wait.h>
+ #include <linux/i2c.h>
+@@ -337,15 +338,62 @@ static void mixer_cfg_vp_blend(struct mixer_context *ctx)
+ mixer_reg_write(ctx, MXR_VIDEO_CFG, val);
+ }
+
+-static void mixer_vsync_set_update(struct mixer_context *ctx, bool enable)
++static bool mixer_is_synced(struct mixer_context *ctx)
+ {
+- /* block update on vsync */
+- mixer_reg_writemask(ctx, MXR_STATUS, enable ?
+- MXR_STATUS_SYNC_ENABLE : 0, MXR_STATUS_SYNC_ENABLE);
++ u32 base, shadow;
+
++ if (ctx->mxr_ver == MXR_VER_16_0_33_0 ||
++ ctx->mxr_ver == MXR_VER_128_0_0_184)
++ return !(mixer_reg_read(ctx, MXR_CFG) &
++ MXR_CFG_LAYER_UPDATE_COUNT_MASK);
++
++ if (test_bit(MXR_BIT_VP_ENABLED, &ctx->flags) &&
++ vp_reg_read(ctx, VP_SHADOW_UPDATE))
++ return false;
++
++ base = mixer_reg_read(ctx, MXR_CFG);
++ shadow = mixer_reg_read(ctx, MXR_CFG_S);
++ if (base != shadow)
++ return false;
++
++ base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(0));
++ shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(0));
++ if (base != shadow)
++ return false;
++
++ base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(1));
++ shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(1));
++ if (base != shadow)
++ return false;
++
++ return true;
++}
++
++static int mixer_wait_for_sync(struct mixer_context *ctx)
++{
++ ktime_t timeout = ktime_add_us(ktime_get(), 100000);
++
++ while (!mixer_is_synced(ctx)) {
++ usleep_range(1000, 2000);
++ if (ktime_compare(ktime_get(), timeout) > 0)
++ return -ETIMEDOUT;
++ }
++ return 0;
++}
++
++static void mixer_disable_sync(struct mixer_context *ctx)
++{
++ mixer_reg_writemask(ctx, MXR_STATUS, 0, MXR_STATUS_SYNC_ENABLE);
++}
++
++static void mixer_enable_sync(struct mixer_context *ctx)
++{
++ if (ctx->mxr_ver == MXR_VER_16_0_33_0 ||
++ ctx->mxr_ver == MXR_VER_128_0_0_184)
++ mixer_reg_writemask(ctx, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE);
++ mixer_reg_writemask(ctx, MXR_STATUS, ~0, MXR_STATUS_SYNC_ENABLE);
+ if (test_bit(MXR_BIT_VP_ENABLED, &ctx->flags))
+- vp_reg_write(ctx, VP_SHADOW_UPDATE, enable ?
+- VP_SHADOW_UPDATE_ENABLE : 0);
++ vp_reg_write(ctx, VP_SHADOW_UPDATE, VP_SHADOW_UPDATE_ENABLE);
+ }
+
+ static void mixer_cfg_scan(struct mixer_context *ctx, int width, int height)
+@@ -482,7 +530,6 @@ static void vp_video_buffer(struct mixer_context *ctx,
+
+ spin_lock_irqsave(&ctx->reg_slock, flags);
+
+- vp_reg_write(ctx, VP_SHADOW_UPDATE, 1);
+ /* interlace or progressive scan mode */
+ val = (test_bit(MXR_BIT_INTERLACE, &ctx->flags) ? ~0 : 0);
+ vp_reg_writemask(ctx, VP_MODE, val, VP_MODE_LINE_SKIP);
+@@ -537,11 +584,6 @@ static void vp_video_buffer(struct mixer_context *ctx,
+ vp_regs_dump(ctx);
+ }
+
+-static void mixer_layer_update(struct mixer_context *ctx)
+-{
+- mixer_reg_writemask(ctx, MXR_CFG, ~0, MXR_CFG_LAYER_UPDATE);
+-}
+-
+ static void mixer_graph_buffer(struct mixer_context *ctx,
+ struct exynos_drm_plane *plane)
+ {
+@@ -618,11 +660,6 @@ static void mixer_graph_buffer(struct mixer_context *ctx,
+ mixer_cfg_layer(ctx, win, priority, true);
+ mixer_cfg_gfx_blend(ctx, win, fb->format->has_alpha);
+
+- /* layer update mandatory for mixer 16.0.33.0 */
+- if (ctx->mxr_ver == MXR_VER_16_0_33_0 ||
+- ctx->mxr_ver == MXR_VER_128_0_0_184)
+- mixer_layer_update(ctx);
+-
+ spin_unlock_irqrestore(&ctx->reg_slock, flags);
+
+ mixer_regs_dump(ctx);
+@@ -687,7 +724,7 @@ static void mixer_win_reset(struct mixer_context *ctx)
+ static irqreturn_t mixer_irq_handler(int irq, void *arg)
+ {
+ struct mixer_context *ctx = arg;
+- u32 val, base, shadow;
++ u32 val;
+
+ spin_lock(&ctx->reg_slock);
+
+@@ -701,26 +738,9 @@ static irqreturn_t mixer_irq_handler(int irq, void *arg)
+ val &= ~MXR_INT_STATUS_VSYNC;
+
+ /* interlace scan need to check shadow register */
+- if (test_bit(MXR_BIT_INTERLACE, &ctx->flags)) {
+- if (test_bit(MXR_BIT_VP_ENABLED, &ctx->flags) &&
+- vp_reg_read(ctx, VP_SHADOW_UPDATE))
+- goto out;
+-
+- base = mixer_reg_read(ctx, MXR_CFG);
+- shadow = mixer_reg_read(ctx, MXR_CFG_S);
+- if (base != shadow)
+- goto out;
+-
+- base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(0));
+- shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(0));
+- if (base != shadow)
+- goto out;
+-
+- base = mixer_reg_read(ctx, MXR_GRAPHIC_BASE(1));
+- shadow = mixer_reg_read(ctx, MXR_GRAPHIC_BASE_S(1));
+- if (base != shadow)
+- goto out;
+- }
++ if (test_bit(MXR_BIT_INTERLACE, &ctx->flags)
++ && !mixer_is_synced(ctx))
++ goto out;
+
+ drm_crtc_handle_vblank(&ctx->crtc->base);
+ }
+@@ -895,12 +915,14 @@ static void mixer_disable_vblank(struct exynos_drm_crtc *crtc)
+
+ static void mixer_atomic_begin(struct exynos_drm_crtc *crtc)
+ {
+- struct mixer_context *mixer_ctx = crtc->ctx;
++ struct mixer_context *ctx = crtc->ctx;
+
+- if (!test_bit(MXR_BIT_POWERED, &mixer_ctx->flags))
++ if (!test_bit(MXR_BIT_POWERED, &ctx->flags))
+ return;
+
+- mixer_vsync_set_update(mixer_ctx, false);
++ if (mixer_wait_for_sync(ctx))
++ dev_err(ctx->dev, "timeout waiting for VSYNC\n");
++ mixer_disable_sync(ctx);
+ }
+
+ static void mixer_update_plane(struct exynos_drm_crtc *crtc,
+@@ -942,7 +964,7 @@ static void mixer_atomic_flush(struct exynos_drm_crtc *crtc)
+ if (!test_bit(MXR_BIT_POWERED, &mixer_ctx->flags))
+ return;
+
+- mixer_vsync_set_update(mixer_ctx, true);
++ mixer_enable_sync(mixer_ctx);
+ exynos_crtc_handle_event(crtc);
+ }
+
+@@ -957,7 +979,7 @@ static void mixer_enable(struct exynos_drm_crtc *crtc)
+
+ exynos_drm_pipe_clk_enable(crtc, true);
+
+- mixer_vsync_set_update(ctx, false);
++ mixer_disable_sync(ctx);
+
+ mixer_reg_writemask(ctx, MXR_STATUS, ~0, MXR_STATUS_SOFT_RESET);
+
+@@ -970,7 +992,7 @@ static void mixer_enable(struct exynos_drm_crtc *crtc)
+
+ mixer_commit(ctx);
+
+- mixer_vsync_set_update(ctx, true);
++ mixer_enable_sync(ctx);
+
+ set_bit(MXR_BIT_POWERED, &ctx->flags);
+ }
+diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/volt.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/volt.h
+index 8a0f85f5fc1a..6a765682fbfa 100644
+--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/volt.h
++++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/volt.h
+@@ -38,6 +38,7 @@ int nvkm_volt_set_id(struct nvkm_volt *, u8 id, u8 min_id, u8 temp,
+
+ int nv40_volt_new(struct nvkm_device *, int, struct nvkm_volt **);
+ int gf100_volt_new(struct nvkm_device *, int, struct nvkm_volt **);
++int gf117_volt_new(struct nvkm_device *, int, struct nvkm_volt **);
+ int gk104_volt_new(struct nvkm_device *, int, struct nvkm_volt **);
+ int gk20a_volt_new(struct nvkm_device *, int, struct nvkm_volt **);
+ int gm20b_volt_new(struct nvkm_device *, int, struct nvkm_volt **);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+index 9109b69cd052..9635704a1d86 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c
++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+@@ -161,7 +161,7 @@ nouveau_debugfs_pstate_set(struct file *file, const char __user *ubuf,
+ }
+
+ ret = pm_runtime_get_sync(drm->dev);
+- if (IS_ERR_VALUE(ret) && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES)
+ return ret;
+ ret = nvif_mthd(ctrl, NVIF_CONTROL_PSTATE_USER, &args, sizeof(args));
+ pm_runtime_put_autosuspend(drm->dev);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+index e294013426ce..347a6a4cb339 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+@@ -1613,7 +1613,7 @@ nvd7_chipset = {
+ .pci = gf106_pci_new,
+ .therm = gf119_therm_new,
+ .timer = nv41_timer_new,
+- .volt = gf100_volt_new,
++ .volt = gf117_volt_new,
+ .ce[0] = gf100_ce_new,
+ .disp = gf119_disp_new,
+ .dma = gf119_dma_new,
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/Kbuild b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/Kbuild
+index bcd179ba11d0..146adcdd316a 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/Kbuild
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/Kbuild
+@@ -2,6 +2,7 @@ nvkm-y += nvkm/subdev/volt/base.o
+ nvkm-y += nvkm/subdev/volt/gpio.o
+ nvkm-y += nvkm/subdev/volt/nv40.o
+ nvkm-y += nvkm/subdev/volt/gf100.o
++nvkm-y += nvkm/subdev/volt/gf117.o
+ nvkm-y += nvkm/subdev/volt/gk104.o
+ nvkm-y += nvkm/subdev/volt/gk20a.o
+ nvkm-y += nvkm/subdev/volt/gm20b.o
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gf117.c b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gf117.c
+new file mode 100644
+index 000000000000..547a58f0aeac
+--- /dev/null
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gf117.c
+@@ -0,0 +1,60 @@
++/*
++ * Copyright 2019 Ilia Mirkin
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a
++ * copy of this software and associated documentation files (the "Software"),
++ * to deal in the Software without restriction, including without limitation
++ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
++ * and/or sell copies of the Software, and to permit persons to whom the
++ * Software is furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ * OTHER DEALINGS IN THE SOFTWARE.
++ *
++ * Authors: Ilia Mirkin
++ */
++#include "priv.h"
++
++#include <subdev/fuse.h>
++
++static int
++gf117_volt_speedo_read(struct nvkm_volt *volt)
++{
++ struct nvkm_device *device = volt->subdev.device;
++ struct nvkm_fuse *fuse = device->fuse;
++
++ if (!fuse)
++ return -EINVAL;
++
++ return nvkm_fuse_read(fuse, 0x3a8);
++}
++
++static const struct nvkm_volt_func
++gf117_volt = {
++ .oneinit = gf100_volt_oneinit,
++ .vid_get = nvkm_voltgpio_get,
++ .vid_set = nvkm_voltgpio_set,
++ .speedo_read = gf117_volt_speedo_read,
++};
++
++int
++gf117_volt_new(struct nvkm_device *device, int index, struct nvkm_volt **pvolt)
++{
++ struct nvkm_volt *volt;
++ int ret;
++
++ ret = nvkm_volt_new_(&gf117_volt, device, index, &volt);
++ *pvolt = volt;
++ if (ret)
++ return ret;
++
++ return nvkm_voltgpio_init(volt);
++}
+diff --git a/drivers/gpu/drm/panel/panel-innolux-p079zca.c b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
+index 72edb334d997..88c7d035ace6 100644
+--- a/drivers/gpu/drm/panel/panel-innolux-p079zca.c
++++ b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
+@@ -70,18 +70,12 @@ static inline struct innolux_panel *to_innolux_panel(struct drm_panel *panel)
+ static int innolux_panel_disable(struct drm_panel *panel)
+ {
+ struct innolux_panel *innolux = to_innolux_panel(panel);
+- int err;
+
+ if (!innolux->enabled)
+ return 0;
+
+ backlight_disable(innolux->backlight);
+
+- err = mipi_dsi_dcs_set_display_off(innolux->link);
+- if (err < 0)
+- DRM_DEV_ERROR(panel->dev, "failed to set display off: %d\n",
+- err);
+-
+ innolux->enabled = false;
+
+ return 0;
+@@ -95,6 +89,11 @@ static int innolux_panel_unprepare(struct drm_panel *panel)
+ if (!innolux->prepared)
+ return 0;
+
++ err = mipi_dsi_dcs_set_display_off(innolux->link);
++ if (err < 0)
++ DRM_DEV_ERROR(panel->dev, "failed to set display off: %d\n",
++ err);
++
+ err = mipi_dsi_dcs_enter_sleep_mode(innolux->link);
+ if (err < 0) {
+ DRM_DEV_ERROR(panel->dev, "failed to enter sleep mode: %d\n",
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 7c484729f9b2..268f5a3b3122 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -1445,7 +1445,6 @@ static void ttm_bo_global_kobj_release(struct kobject *kobj)
+ container_of(kobj, struct ttm_bo_global, kobj);
+
+ __free_page(glob->dummy_read_page);
+- kfree(glob);
+ }
+
+ void ttm_bo_global_release(struct drm_global_reference *ref)
+diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
+index 450387c92b63..df73d5ff84a8 100644
+--- a/drivers/gpu/drm/ttm/ttm_memory.c
++++ b/drivers/gpu/drm/ttm/ttm_memory.c
+@@ -216,14 +216,6 @@ static ssize_t ttm_mem_global_store(struct kobject *kobj,
+ return size;
+ }
+
+-static void ttm_mem_global_kobj_release(struct kobject *kobj)
+-{
+- struct ttm_mem_global *glob =
+- container_of(kobj, struct ttm_mem_global, kobj);
+-
+- kfree(glob);
+-}
+-
+ static struct attribute *ttm_mem_global_attrs[] = {
+ &ttm_mem_global_lower_mem_limit,
+ NULL
+@@ -235,7 +227,6 @@ static const struct sysfs_ops ttm_mem_global_ops = {
+ };
+
+ static struct kobj_type ttm_mem_glob_kobj_type = {
+- .release = &ttm_mem_global_kobj_release,
+ .sysfs_ops = &ttm_mem_global_ops,
+ .default_attrs = ttm_mem_global_attrs,
+ };
+diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
+index d5a23295dd80..bb7b58407039 100644
+--- a/drivers/gpu/drm/udl/udl_gem.c
++++ b/drivers/gpu/drm/udl/udl_gem.c
+@@ -224,7 +224,7 @@ int udl_gem_mmap(struct drm_file *file, struct drm_device *dev,
+ *offset = drm_vma_node_offset_addr(&gobj->base.vma_node);
+
+ out:
+- drm_gem_object_put(&gobj->base);
++ drm_gem_object_put_unlocked(&gobj->base);
+ unlock:
+ mutex_unlock(&udl->gem_lock);
+ return ret;
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index b7870e7e41d4..97d33b8ed36c 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -348,6 +348,7 @@
+ #define USB_DEVICE_ID_DMI_ENC 0x5fab
+
+ #define USB_VENDOR_ID_DRAGONRISE 0x0079
++#define USB_DEVICE_ID_REDRAGON_SEYMUR2 0x0006
+ #define USB_DEVICE_ID_DRAGONRISE_WIIU 0x1800
+ #define USB_DEVICE_ID_DRAGONRISE_PS3 0x1801
+ #define USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR 0x1803
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 77316f022c5a..94088c0ed68a 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -70,6 +70,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_2NES2SNES), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_4NES4SNES), HID_QUIRK_MULTI_INPUT },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_REDRAGON_SEYMUR2), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3), HID_QUIRK_MULTI_INPUT },
+diff --git a/drivers/hid/i2c-hid/Makefile b/drivers/hid/i2c-hid/Makefile
+index 832d8f9aaba2..099e1ce2f234 100644
+--- a/drivers/hid/i2c-hid/Makefile
++++ b/drivers/hid/i2c-hid/Makefile
+@@ -3,3 +3,6 @@
+ #
+
+ obj-$(CONFIG_I2C_HID) += i2c-hid.o
++
++i2c-hid-objs = i2c-hid-core.o
++i2c-hid-$(CONFIG_DMI) += i2c-hid-dmi-quirks.o
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+new file mode 100644
+index 000000000000..3cde7c1b9c33
+--- /dev/null
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -0,0 +1,1348 @@
++/*
++ * HID over I2C protocol implementation
++ *
++ * Copyright (c) 2012 Benjamin Tissoires <benjamin.tissoires@gmail.com>
++ * Copyright (c) 2012 Ecole Nationale de l'Aviation Civile, France
++ * Copyright (c) 2012 Red Hat, Inc
++ *
++ * This code is partly based on "USB HID support for Linux":
++ *
++ * Copyright (c) 1999 Andreas Gal
++ * Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
++ * Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
++ * Copyright (c) 2007-2008 Oliver Neukum
++ * Copyright (c) 2006-2010 Jiri Kosina
++ *
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License. See the file COPYING in the main directory of this archive for
++ * more details.
++ */
++
++#include <linux/module.h>
++#include <linux/i2c.h>
++#include <linux/interrupt.h>
++#include <linux/input.h>
++#include <linux/irq.h>
++#include <linux/delay.h>
++#include <linux/slab.h>
++#include <linux/pm.h>
++#include <linux/pm_runtime.h>
++#include <linux/device.h>
++#include <linux/wait.h>
++#include <linux/err.h>
++#include <linux/string.h>
++#include <linux/list.h>
++#include <linux/jiffies.h>
++#include <linux/kernel.h>
++#include <linux/hid.h>
++#include <linux/mutex.h>
++#include <linux/acpi.h>
++#include <linux/of.h>
++#include <linux/regulator/consumer.h>
++
++#include <linux/platform_data/i2c-hid.h>
++
++#include "../hid-ids.h"
++#include "i2c-hid.h"
++
++/* quirks to control the device */
++#define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV BIT(0)
++#define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(1)
++#define I2C_HID_QUIRK_NO_RUNTIME_PM BIT(2)
++#define I2C_HID_QUIRK_DELAY_AFTER_SLEEP BIT(3)
++
++/* flags */
++#define I2C_HID_STARTED 0
++#define I2C_HID_RESET_PENDING 1
++#define I2C_HID_READ_PENDING 2
++
++#define I2C_HID_PWR_ON 0x00
++#define I2C_HID_PWR_SLEEP 0x01
++
++/* debug option */
++static bool debug;
++module_param(debug, bool, 0444);
++MODULE_PARM_DESC(debug, "print a lot of debug information");
++
++#define i2c_hid_dbg(ihid, fmt, arg...) \
++do { \
++ if (debug) \
++ dev_printk(KERN_DEBUG, &(ihid)->client->dev, fmt, ##arg); \
++} while (0)
++
++struct i2c_hid_desc {
++ __le16 wHIDDescLength;
++ __le16 bcdVersion;
++ __le16 wReportDescLength;
++ __le16 wReportDescRegister;
++ __le16 wInputRegister;
++ __le16 wMaxInputLength;
++ __le16 wOutputRegister;
++ __le16 wMaxOutputLength;
++ __le16 wCommandRegister;
++ __le16 wDataRegister;
++ __le16 wVendorID;
++ __le16 wProductID;
++ __le16 wVersionID;
++ __le32 reserved;
++} __packed;
++
++struct i2c_hid_cmd {
++ unsigned int registerIndex;
++ __u8 opcode;
++ unsigned int length;
++ bool wait;
++};
++
++union command {
++ u8 data[0];
++ struct cmd {
++ __le16 reg;
++ __u8 reportTypeID;
++ __u8 opcode;
++ } __packed c;
++};
++
++#define I2C_HID_CMD(opcode_) \
++ .opcode = opcode_, .length = 4, \
++ .registerIndex = offsetof(struct i2c_hid_desc, wCommandRegister)
++
++/* fetch HID descriptor */
++static const struct i2c_hid_cmd hid_descr_cmd = { .length = 2 };
++/* fetch report descriptors */
++static const struct i2c_hid_cmd hid_report_descr_cmd = {
++ .registerIndex = offsetof(struct i2c_hid_desc,
++ wReportDescRegister),
++ .opcode = 0x00,
++ .length = 2 };
++/* commands */
++static const struct i2c_hid_cmd hid_reset_cmd = { I2C_HID_CMD(0x01),
++ .wait = true };
++static const struct i2c_hid_cmd hid_get_report_cmd = { I2C_HID_CMD(0x02) };
++static const struct i2c_hid_cmd hid_set_report_cmd = { I2C_HID_CMD(0x03) };
++static const struct i2c_hid_cmd hid_set_power_cmd = { I2C_HID_CMD(0x08) };
++static const struct i2c_hid_cmd hid_no_cmd = { .length = 0 };
++
++/*
++ * These definitions are not used here, but are defined by the spec.
++ * Keeping them here for documentation purposes.
++ *
++ * static const struct i2c_hid_cmd hid_get_idle_cmd = { I2C_HID_CMD(0x04) };
++ * static const struct i2c_hid_cmd hid_set_idle_cmd = { I2C_HID_CMD(0x05) };
++ * static const struct i2c_hid_cmd hid_get_protocol_cmd = { I2C_HID_CMD(0x06) };
++ * static const struct i2c_hid_cmd hid_set_protocol_cmd = { I2C_HID_CMD(0x07) };
++ */
++
++/* The main device structure */
++struct i2c_hid {
++ struct i2c_client *client; /* i2c client */
++ struct hid_device *hid; /* pointer to corresponding HID dev */
++ union {
++ __u8 hdesc_buffer[sizeof(struct i2c_hid_desc)];
++ struct i2c_hid_desc hdesc; /* the HID Descriptor */
++ };
++ __le16 wHIDDescRegister; /* location of the i2c
++ * register of the HID
++ * descriptor. */
++ unsigned int bufsize; /* i2c buffer size */
++ u8 *inbuf; /* Input buffer */
++ u8 *rawbuf; /* Raw Input buffer */
++ u8 *cmdbuf; /* Command buffer */
++ u8 *argsbuf; /* Command arguments buffer */
++
++ unsigned long flags; /* device flags */
++ unsigned long quirks; /* Various quirks */
++
++ wait_queue_head_t wait; /* For waiting the interrupt */
++
++ struct i2c_hid_platform_data pdata;
++
++ bool irq_wake_enabled;
++ struct mutex reset_lock;
++
++ unsigned long sleep_delay;
++};
++
++static const struct i2c_hid_quirks {
++ __u16 idVendor;
++ __u16 idProduct;
++ __u32 quirks;
++} i2c_hid_quirks[] = {
++ { USB_VENDOR_ID_WEIDA, USB_DEVICE_ID_WEIDA_8752,
++ I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
++ { USB_VENDOR_ID_WEIDA, USB_DEVICE_ID_WEIDA_8755,
++ I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
++ { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
++ I2C_HID_QUIRK_NO_IRQ_AFTER_RESET |
++ I2C_HID_QUIRK_NO_RUNTIME_PM },
++ { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33,
++ I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
++ { 0, 0 }
++};
++
++/*
++ * i2c_hid_lookup_quirk: return any quirks associated with a I2C HID device
++ * @idVendor: the 16-bit vendor ID
++ * @idProduct: the 16-bit product ID
++ *
++ * Returns: a u32 quirks value.
++ */
++static u32 i2c_hid_lookup_quirk(const u16 idVendor, const u16 idProduct)
++{
++ u32 quirks = 0;
++ int n;
++
++ for (n = 0; i2c_hid_quirks[n].idVendor; n++)
++ if (i2c_hid_quirks[n].idVendor == idVendor &&
++ (i2c_hid_quirks[n].idProduct == (__u16)HID_ANY_ID ||
++ i2c_hid_quirks[n].idProduct == idProduct))
++ quirks = i2c_hid_quirks[n].quirks;
++
++ return quirks;
++}
++
++static int __i2c_hid_command(struct i2c_client *client,
++ const struct i2c_hid_cmd *command, u8 reportID,
++ u8 reportType, u8 *args, int args_len,
++ unsigned char *buf_recv, int data_len)
++{
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ union command *cmd = (union command *)ihid->cmdbuf;
++ int ret;
++ struct i2c_msg msg[2];
++ int msg_num = 1;
++
++ int length = command->length;
++ bool wait = command->wait;
++ unsigned int registerIndex = command->registerIndex;
++
++ /* special case for hid_descr_cmd */
++ if (command == &hid_descr_cmd) {
++ cmd->c.reg = ihid->wHIDDescRegister;
++ } else {
++ cmd->data[0] = ihid->hdesc_buffer[registerIndex];
++ cmd->data[1] = ihid->hdesc_buffer[registerIndex + 1];
++ }
++
++ if (length > 2) {
++ cmd->c.opcode = command->opcode;
++ cmd->c.reportTypeID = reportID | reportType << 4;
++ }
++
++ memcpy(cmd->data + length, args, args_len);
++ length += args_len;
++
++ i2c_hid_dbg(ihid, "%s: cmd=%*ph\n", __func__, length, cmd->data);
++
++ msg[0].addr = client->addr;
++ msg[0].flags = client->flags & I2C_M_TEN;
++ msg[0].len = length;
++ msg[0].buf = cmd->data;
++ if (data_len > 0) {
++ msg[1].addr = client->addr;
++ msg[1].flags = client->flags & I2C_M_TEN;
++ msg[1].flags |= I2C_M_RD;
++ msg[1].len = data_len;
++ msg[1].buf = buf_recv;
++ msg_num = 2;
++ set_bit(I2C_HID_READ_PENDING, &ihid->flags);
++ }
++
++ if (wait)
++ set_bit(I2C_HID_RESET_PENDING, &ihid->flags);
++
++ ret = i2c_transfer(client->adapter, msg, msg_num);
++
++ if (data_len > 0)
++ clear_bit(I2C_HID_READ_PENDING, &ihid->flags);
++
++ if (ret != msg_num)
++ return ret < 0 ? ret : -EIO;
++
++ ret = 0;
++
++ if (wait && (ihid->quirks & I2C_HID_QUIRK_NO_IRQ_AFTER_RESET)) {
++ msleep(100);
++ } else if (wait) {
++ i2c_hid_dbg(ihid, "%s: waiting...\n", __func__);
++ if (!wait_event_timeout(ihid->wait,
++ !test_bit(I2C_HID_RESET_PENDING, &ihid->flags),
++ msecs_to_jiffies(5000)))
++ ret = -ENODATA;
++ i2c_hid_dbg(ihid, "%s: finished.\n", __func__);
++ }
++
++ return ret;
++}
++
++static int i2c_hid_command(struct i2c_client *client,
++ const struct i2c_hid_cmd *command,
++ unsigned char *buf_recv, int data_len)
++{
++ return __i2c_hid_command(client, command, 0, 0, NULL, 0,
++ buf_recv, data_len);
++}
++
++static int i2c_hid_get_report(struct i2c_client *client, u8 reportType,
++ u8 reportID, unsigned char *buf_recv, int data_len)
++{
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ u8 args[3];
++ int ret;
++ int args_len = 0;
++ u16 readRegister = le16_to_cpu(ihid->hdesc.wDataRegister);
++
++ i2c_hid_dbg(ihid, "%s\n", __func__);
++
++ if (reportID >= 0x0F) {
++ args[args_len++] = reportID;
++ reportID = 0x0F;
++ }
++
++ args[args_len++] = readRegister & 0xFF;
++ args[args_len++] = readRegister >> 8;
++
++ ret = __i2c_hid_command(client, &hid_get_report_cmd, reportID,
++ reportType, args, args_len, buf_recv, data_len);
++ if (ret) {
++ dev_err(&client->dev,
++ "failed to retrieve report from device.\n");
++ return ret;
++ }
++
++ return 0;
++}
++
++/**
++ * i2c_hid_set_or_send_report: forward an incoming report to the device
++ * @client: the i2c_client of the device
++ * @reportType: 0x03 for HID_FEATURE_REPORT ; 0x02 for HID_OUTPUT_REPORT
++ * @reportID: the report ID
++ * @buf: the actual data to transfer, without the report ID
++ * @len: size of buf
++ * @use_data: true: use SET_REPORT HID command, false: send plain OUTPUT report
++ */
++static int i2c_hid_set_or_send_report(struct i2c_client *client, u8 reportType,
++ u8 reportID, unsigned char *buf, size_t data_len, bool use_data)
++{
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ u8 *args = ihid->argsbuf;
++ const struct i2c_hid_cmd *hidcmd;
++ int ret;
++ u16 dataRegister = le16_to_cpu(ihid->hdesc.wDataRegister);
++ u16 outputRegister = le16_to_cpu(ihid->hdesc.wOutputRegister);
++ u16 maxOutputLength = le16_to_cpu(ihid->hdesc.wMaxOutputLength);
++ u16 size;
++ int args_len;
++ int index = 0;
++
++ i2c_hid_dbg(ihid, "%s\n", __func__);
++
++ if (data_len > ihid->bufsize)
++ return -EINVAL;
++
++ size = 2 /* size */ +
++ (reportID ? 1 : 0) /* reportID */ +
++ data_len /* buf */;
++ args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ +
++ 2 /* dataRegister */ +
++ size /* args */;
++
++ if (!use_data && maxOutputLength == 0)
++ return -ENOSYS;
++
++ if (reportID >= 0x0F) {
++ args[index++] = reportID;
++ reportID = 0x0F;
++ }
++
++ /*
++ * use the data register for feature reports or if the device does not
++ * support the output register
++ */
++ if (use_data) {
++ args[index++] = dataRegister & 0xFF;
++ args[index++] = dataRegister >> 8;
++ hidcmd = &hid_set_report_cmd;
++ } else {
++ args[index++] = outputRegister & 0xFF;
++ args[index++] = outputRegister >> 8;
++ hidcmd = &hid_no_cmd;
++ }
++
++ args[index++] = size & 0xFF;
++ args[index++] = size >> 8;
++
++ if (reportID)
++ args[index++] = reportID;
++
++ memcpy(&args[index], buf, data_len);
++
++ ret = __i2c_hid_command(client, hidcmd, reportID,
++ reportType, args, args_len, NULL, 0);
++ if (ret) {
++ dev_err(&client->dev, "failed to set a report to device.\n");
++ return ret;
++ }
++
++ return data_len;
++}
++
++static int i2c_hid_set_power(struct i2c_client *client, int power_state)
++{
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ int ret;
++ unsigned long now, delay;
++
++ i2c_hid_dbg(ihid, "%s\n", __func__);
++
++ /*
++ * Some devices require to send a command to wakeup before power on.
++ * The call will get a return value (EREMOTEIO) but device will be
++ * triggered and activated. After that, it goes like a normal device.
++ */
++ if (power_state == I2C_HID_PWR_ON &&
++ ihid->quirks & I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV) {
++ ret = i2c_hid_command(client, &hid_set_power_cmd, NULL, 0);
++
++ /* Device was already activated */
++ if (!ret)
++ goto set_pwr_exit;
++ }
++
++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
++ power_state == I2C_HID_PWR_ON) {
++ now = jiffies;
++ if (time_after(ihid->sleep_delay, now)) {
++ delay = jiffies_to_usecs(ihid->sleep_delay - now);
++ usleep_range(delay, delay + 1);
++ }
++ }
++
++ ret = __i2c_hid_command(client, &hid_set_power_cmd, power_state,
++ 0, NULL, 0, NULL, 0);
++
++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
++ power_state == I2C_HID_PWR_SLEEP)
++ ihid->sleep_delay = jiffies + msecs_to_jiffies(20);
++
++ if (ret)
++ dev_err(&client->dev, "failed to change power setting.\n");
++
++set_pwr_exit:
++ return ret;
++}
++
++static int i2c_hid_hwreset(struct i2c_client *client)
++{
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ int ret;
++
++ i2c_hid_dbg(ihid, "%s\n", __func__);
++
++ /*
++ * This prevents sending feature reports while the device is
++ * being reset. Otherwise we may lose the reset complete
++ * interrupt.
++ */
++ mutex_lock(&ihid->reset_lock);
++
++ ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
++ if (ret)
++ goto out_unlock;
++
++ /*
++ * The HID over I2C specification states that if a DEVICE needs time
++ * after the PWR_ON request, it should utilise CLOCK stretching.
++ * However, it has been observered that the Windows driver provides a
++ * 1ms sleep between the PWR_ON and RESET requests and that some devices
++ * rely on this.
++ */
++ usleep_range(1000, 5000);
++
++ i2c_hid_dbg(ihid, "resetting...\n");
++
++ ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0);
++ if (ret) {
++ dev_err(&client->dev, "failed to reset device.\n");
++ i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
++ }
++
++out_unlock:
++ mutex_unlock(&ihid->reset_lock);
++ return ret;
++}
++
++static void i2c_hid_get_input(struct i2c_hid *ihid)
++{
++ int ret;
++ u32 ret_size;
++ int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
++
++ if (size > ihid->bufsize)
++ size = ihid->bufsize;
++
++ ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
++ if (ret != size) {
++ if (ret < 0)
++ return;
++
++ dev_err(&ihid->client->dev, "%s: got %d data instead of %d\n",
++ __func__, ret, size);
++ return;
++ }
++
++ ret_size = ihid->inbuf[0] | ihid->inbuf[1] << 8;
++
++ if (!ret_size) {
++ /* host or device initiated RESET completed */
++ if (test_and_clear_bit(I2C_HID_RESET_PENDING, &ihid->flags))
++ wake_up(&ihid->wait);
++ return;
++ }
++
++ if ((ret_size > size) || (ret_size < 2)) {
++ dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
++ __func__, size, ret_size);
++ return;
++ }
++
++ i2c_hid_dbg(ihid, "input: %*ph\n", ret_size, ihid->inbuf);
++
++ if (test_bit(I2C_HID_STARTED, &ihid->flags))
++ hid_input_report(ihid->hid, HID_INPUT_REPORT, ihid->inbuf + 2,
++ ret_size - 2, 1);
++
++ return;
++}
++
++static irqreturn_t i2c_hid_irq(int irq, void *dev_id)
++{
++ struct i2c_hid *ihid = dev_id;
++
++ if (test_bit(I2C_HID_READ_PENDING, &ihid->flags))
++ return IRQ_HANDLED;
++
++ i2c_hid_get_input(ihid);
++
++ return IRQ_HANDLED;
++}
++
++static int i2c_hid_get_report_length(struct hid_report *report)
++{
++ return ((report->size - 1) >> 3) + 1 +
++ report->device->report_enum[report->type].numbered + 2;
++}
++
++/*
++ * Traverse the supplied list of reports and find the longest
++ */
++static void i2c_hid_find_max_report(struct hid_device *hid, unsigned int type,
++ unsigned int *max)
++{
++ struct hid_report *report;
++ unsigned int size;
++
++ /* We should not rely on wMaxInputLength, as some devices may set it to
++ * a wrong length. */
++ list_for_each_entry(report, &hid->report_enum[type].report_list, list) {
++ size = i2c_hid_get_report_length(report);
++ if (*max < size)
++ *max = size;
++ }
++}
++
++static void i2c_hid_free_buffers(struct i2c_hid *ihid)
++{
++ kfree(ihid->inbuf);
++ kfree(ihid->rawbuf);
++ kfree(ihid->argsbuf);
++ kfree(ihid->cmdbuf);
++ ihid->inbuf = NULL;
++ ihid->rawbuf = NULL;
++ ihid->cmdbuf = NULL;
++ ihid->argsbuf = NULL;
++ ihid->bufsize = 0;
++}
++
++static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size)
++{
++ /* the worst case is computed from the set_report command with a
++ * reportID > 15 and the maximum report length */
++ int args_len = sizeof(__u8) + /* ReportID */
++ sizeof(__u8) + /* optional ReportID byte */
++ sizeof(__u16) + /* data register */
++ sizeof(__u16) + /* size of the report */
++ report_size; /* report */
++
++ ihid->inbuf = kzalloc(report_size, GFP_KERNEL);
++ ihid->rawbuf = kzalloc(report_size, GFP_KERNEL);
++ ihid->argsbuf = kzalloc(args_len, GFP_KERNEL);
++ ihid->cmdbuf = kzalloc(sizeof(union command) + args_len, GFP_KERNEL);
++
++ if (!ihid->inbuf || !ihid->rawbuf || !ihid->argsbuf || !ihid->cmdbuf) {
++ i2c_hid_free_buffers(ihid);
++ return -ENOMEM;
++ }
++
++ ihid->bufsize = report_size;
++
++ return 0;
++}
++
++static int i2c_hid_get_raw_report(struct hid_device *hid,
++ unsigned char report_number, __u8 *buf, size_t count,
++ unsigned char report_type)
++{
++ struct i2c_client *client = hid->driver_data;
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ size_t ret_count, ask_count;
++ int ret;
++
++ if (report_type == HID_OUTPUT_REPORT)
++ return -EINVAL;
++
++ /* +2 bytes to include the size of the reply in the query buffer */
++ ask_count = min(count + 2, (size_t)ihid->bufsize);
++
++ ret = i2c_hid_get_report(client,
++ report_type == HID_FEATURE_REPORT ? 0x03 : 0x01,
++ report_number, ihid->rawbuf, ask_count);
++
++ if (ret < 0)
++ return ret;
++
++ ret_count = ihid->rawbuf[0] | (ihid->rawbuf[1] << 8);
++
++ if (ret_count <= 2)
++ return 0;
++
++ ret_count = min(ret_count, ask_count);
++
++ /* The query buffer contains the size, dropping it in the reply */
++ count = min(count, ret_count - 2);
++ memcpy(buf, ihid->rawbuf + 2, count);
++
++ return count;
++}
++
++static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf,
++ size_t count, unsigned char report_type, bool use_data)
++{
++ struct i2c_client *client = hid->driver_data;
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ int report_id = buf[0];
++ int ret;
++
++ if (report_type == HID_INPUT_REPORT)
++ return -EINVAL;
++
++ mutex_lock(&ihid->reset_lock);
++
++ if (report_id) {
++ buf++;
++ count--;
++ }
++
++ ret = i2c_hid_set_or_send_report(client,
++ report_type == HID_FEATURE_REPORT ? 0x03 : 0x02,
++ report_id, buf, count, use_data);
++
++ if (report_id && ret >= 0)
++ ret++; /* add report_id to the number of transfered bytes */
++
++ mutex_unlock(&ihid->reset_lock);
++
++ return ret;
++}
++
++static int i2c_hid_output_report(struct hid_device *hid, __u8 *buf,
++ size_t count)
++{
++ return i2c_hid_output_raw_report(hid, buf, count, HID_OUTPUT_REPORT,
++ false);
++}
++
++static int i2c_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
++ __u8 *buf, size_t len, unsigned char rtype,
++ int reqtype)
++{
++ switch (reqtype) {
++ case HID_REQ_GET_REPORT:
++ return i2c_hid_get_raw_report(hid, reportnum, buf, len, rtype);
++ case HID_REQ_SET_REPORT:
++ if (buf[0] != reportnum)
++ return -EINVAL;
++ return i2c_hid_output_raw_report(hid, buf, len, rtype, true);
++ default:
++ return -EIO;
++ }
++}
++
++static int i2c_hid_parse(struct hid_device *hid)
++{
++ struct i2c_client *client = hid->driver_data;
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ struct i2c_hid_desc *hdesc = &ihid->hdesc;
++ unsigned int rsize;
++ char *rdesc;
++ int ret;
++ int tries = 3;
++ char *use_override;
++
++ i2c_hid_dbg(ihid, "entering %s\n", __func__);
++
++ rsize = le16_to_cpu(hdesc->wReportDescLength);
++ if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) {
++ dbg_hid("weird size of report descriptor (%u)\n", rsize);
++ return -EINVAL;
++ }
++
++ do {
++ ret = i2c_hid_hwreset(client);
++ if (ret)
++ msleep(1000);
++ } while (tries-- > 0 && ret);
++
++ if (ret)
++ return ret;
++
++ use_override = i2c_hid_get_dmi_hid_report_desc_override(client->name,
++ &rsize);
++
++ if (use_override) {
++ rdesc = use_override;
++ i2c_hid_dbg(ihid, "Using a HID report descriptor override\n");
++ } else {
++ rdesc = kzalloc(rsize, GFP_KERNEL);
++
++ if (!rdesc) {
++ dbg_hid("couldn't allocate rdesc memory\n");
++ return -ENOMEM;
++ }
++
++ i2c_hid_dbg(ihid, "asking HID report descriptor\n");
++
++ ret = i2c_hid_command(client, &hid_report_descr_cmd,
++ rdesc, rsize);
++ if (ret) {
++ hid_err(hid, "reading report descriptor failed\n");
++ kfree(rdesc);
++ return -EIO;
++ }
++ }
++
++ i2c_hid_dbg(ihid, "Report Descriptor: %*ph\n", rsize, rdesc);
++
++ ret = hid_parse_report(hid, rdesc, rsize);
++ if (!use_override)
++ kfree(rdesc);
++
++ if (ret) {
++ dbg_hid("parsing report descriptor failed\n");
++ return ret;
++ }
++
++ return 0;
++}
++
++static int i2c_hid_start(struct hid_device *hid)
++{
++ struct i2c_client *client = hid->driver_data;
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ int ret;
++ unsigned int bufsize = HID_MIN_BUFFER_SIZE;
++
++ i2c_hid_find_max_report(hid, HID_INPUT_REPORT, &bufsize);
++ i2c_hid_find_max_report(hid, HID_OUTPUT_REPORT, &bufsize);
++ i2c_hid_find_max_report(hid, HID_FEATURE_REPORT, &bufsize);
++
++ if (bufsize > ihid->bufsize) {
++ disable_irq(client->irq);
++ i2c_hid_free_buffers(ihid);
++
++ ret = i2c_hid_alloc_buffers(ihid, bufsize);
++ enable_irq(client->irq);
++
++ if (ret)
++ return ret;
++ }
++
++ return 0;
++}
++
++static void i2c_hid_stop(struct hid_device *hid)
++{
++ hid->claimed = 0;
++}
++
++static int i2c_hid_open(struct hid_device *hid)
++{
++ struct i2c_client *client = hid->driver_data;
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ int ret = 0;
++
++ ret = pm_runtime_get_sync(&client->dev);
++ if (ret < 0)
++ return ret;
++
++ set_bit(I2C_HID_STARTED, &ihid->flags);
++ return 0;
++}
++
++static void i2c_hid_close(struct hid_device *hid)
++{
++ struct i2c_client *client = hid->driver_data;
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++
++ clear_bit(I2C_HID_STARTED, &ihid->flags);
++
++ /* Save some power */
++ pm_runtime_put(&client->dev);
++}
++
++static int i2c_hid_power(struct hid_device *hid, int lvl)
++{
++ struct i2c_client *client = hid->driver_data;
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++
++ i2c_hid_dbg(ihid, "%s lvl:%d\n", __func__, lvl);
++
++ switch (lvl) {
++ case PM_HINT_FULLON:
++ pm_runtime_get_sync(&client->dev);
++ break;
++ case PM_HINT_NORMAL:
++ pm_runtime_put(&client->dev);
++ break;
++ }
++ return 0;
++}
++
++struct hid_ll_driver i2c_hid_ll_driver = {
++ .parse = i2c_hid_parse,
++ .start = i2c_hid_start,
++ .stop = i2c_hid_stop,
++ .open = i2c_hid_open,
++ .close = i2c_hid_close,
++ .power = i2c_hid_power,
++ .output_report = i2c_hid_output_report,
++ .raw_request = i2c_hid_raw_request,
++};
++EXPORT_SYMBOL_GPL(i2c_hid_ll_driver);
++
++static int i2c_hid_init_irq(struct i2c_client *client)
++{
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ unsigned long irqflags = 0;
++ int ret;
++
++ dev_dbg(&client->dev, "Requesting IRQ: %d\n", client->irq);
++
++ if (!irq_get_trigger_type(client->irq))
++ irqflags = IRQF_TRIGGER_LOW;
++
++ ret = request_threaded_irq(client->irq, NULL, i2c_hid_irq,
++ irqflags | IRQF_ONESHOT, client->name, ihid);
++ if (ret < 0) {
++ dev_warn(&client->dev,
++ "Could not register for %s interrupt, irq = %d,"
++ " ret = %d\n",
++ client->name, client->irq, ret);
++
++ return ret;
++ }
++
++ return 0;
++}
++
++static int i2c_hid_fetch_hid_descriptor(struct i2c_hid *ihid)
++{
++ struct i2c_client *client = ihid->client;
++ struct i2c_hid_desc *hdesc = &ihid->hdesc;
++ unsigned int dsize;
++ int ret;
++
++ /* i2c hid fetch using a fixed descriptor size (30 bytes) */
++ if (i2c_hid_get_dmi_i2c_hid_desc_override(client->name)) {
++ i2c_hid_dbg(ihid, "Using a HID descriptor override\n");
++ ihid->hdesc =
++ *i2c_hid_get_dmi_i2c_hid_desc_override(client->name);
++ } else {
++ i2c_hid_dbg(ihid, "Fetching the HID descriptor\n");
++ ret = i2c_hid_command(client, &hid_descr_cmd,
++ ihid->hdesc_buffer,
++ sizeof(struct i2c_hid_desc));
++ if (ret) {
++ dev_err(&client->dev, "hid_descr_cmd failed\n");
++ return -ENODEV;
++ }
++ }
++
++ /* Validate the length of HID descriptor, the 4 first bytes:
++ * bytes 0-1 -> length
++ * bytes 2-3 -> bcdVersion (has to be 1.00) */
++ /* check bcdVersion == 1.0 */
++ if (le16_to_cpu(hdesc->bcdVersion) != 0x0100) {
++ dev_err(&client->dev,
++ "unexpected HID descriptor bcdVersion (0x%04hx)\n",
++ le16_to_cpu(hdesc->bcdVersion));
++ return -ENODEV;
++ }
++
++ /* Descriptor length should be 30 bytes as per the specification */
++ dsize = le16_to_cpu(hdesc->wHIDDescLength);
++ if (dsize != sizeof(struct i2c_hid_desc)) {
++ dev_err(&client->dev, "weird size of HID descriptor (%u)\n",
++ dsize);
++ return -ENODEV;
++ }
++ i2c_hid_dbg(ihid, "HID Descriptor: %*ph\n", dsize, ihid->hdesc_buffer);
++ return 0;
++}
++
++#ifdef CONFIG_ACPI
++static const struct acpi_device_id i2c_hid_acpi_blacklist[] = {
++ /*
++ * The CHPN0001 ACPI device, which is used to describe the Chipone
++ * ICN8505 controller, has a _CID of PNP0C50 but is not HID compatible.
++ */
++ {"CHPN0001", 0 },
++ { },
++};
++
++static int i2c_hid_acpi_pdata(struct i2c_client *client,
++ struct i2c_hid_platform_data *pdata)
++{
++ static guid_t i2c_hid_guid =
++ GUID_INIT(0x3CDFF6F7, 0x4267, 0x4555,
++ 0xAD, 0x05, 0xB3, 0x0A, 0x3D, 0x89, 0x38, 0xDE);
++ union acpi_object *obj;
++ struct acpi_device *adev;
++ acpi_handle handle;
++
++ handle = ACPI_HANDLE(&client->dev);
++ if (!handle || acpi_bus_get_device(handle, &adev)) {
++ dev_err(&client->dev, "Error could not get ACPI device\n");
++ return -ENODEV;
++ }
++
++ if (acpi_match_device_ids(adev, i2c_hid_acpi_blacklist) == 0)
++ return -ENODEV;
++
++ obj = acpi_evaluate_dsm_typed(handle, &i2c_hid_guid, 1, 1, NULL,
++ ACPI_TYPE_INTEGER);
++ if (!obj) {
++ dev_err(&client->dev, "Error _DSM call to get HID descriptor address failed\n");
++ return -ENODEV;
++ }
++
++ pdata->hid_descriptor_address = obj->integer.value;
++ ACPI_FREE(obj);
++
++ return 0;
++}
++
++static void i2c_hid_acpi_fix_up_power(struct device *dev)
++{
++ struct acpi_device *adev;
++
++ adev = ACPI_COMPANION(dev);
++ if (adev)
++ acpi_device_fix_up_power(adev);
++}
++
++static const struct acpi_device_id i2c_hid_acpi_match[] = {
++ {"ACPI0C50", 0 },
++ {"PNP0C50", 0 },
++ { },
++};
++MODULE_DEVICE_TABLE(acpi, i2c_hid_acpi_match);
++#else
++static inline int i2c_hid_acpi_pdata(struct i2c_client *client,
++ struct i2c_hid_platform_data *pdata)
++{
++ return -ENODEV;
++}
++
++static inline void i2c_hid_acpi_fix_up_power(struct device *dev) {}
++#endif
++
++#ifdef CONFIG_OF
++static int i2c_hid_of_probe(struct i2c_client *client,
++ struct i2c_hid_platform_data *pdata)
++{
++ struct device *dev = &client->dev;
++ u32 val;
++ int ret;
++
++ ret = of_property_read_u32(dev->of_node, "hid-descr-addr", &val);
++ if (ret) {
++ dev_err(&client->dev, "HID register address not provided\n");
++ return -ENODEV;
++ }
++ if (val >> 16) {
++ dev_err(&client->dev, "Bad HID register address: 0x%08x\n",
++ val);
++ return -EINVAL;
++ }
++ pdata->hid_descriptor_address = val;
++
++ return 0;
++}
++
++static const struct of_device_id i2c_hid_of_match[] = {
++ { .compatible = "hid-over-i2c" },
++ {},
++};
++MODULE_DEVICE_TABLE(of, i2c_hid_of_match);
++#else
++static inline int i2c_hid_of_probe(struct i2c_client *client,
++ struct i2c_hid_platform_data *pdata)
++{
++ return -ENODEV;
++}
++#endif
++
++static void i2c_hid_fwnode_probe(struct i2c_client *client,
++ struct i2c_hid_platform_data *pdata)
++{
++ u32 val;
++
++ if (!device_property_read_u32(&client->dev, "post-power-on-delay-ms",
++ &val))
++ pdata->post_power_delay_ms = val;
++}
++
++static int i2c_hid_probe(struct i2c_client *client,
++ const struct i2c_device_id *dev_id)
++{
++ int ret;
++ struct i2c_hid *ihid;
++ struct hid_device *hid;
++ __u16 hidRegister;
++ struct i2c_hid_platform_data *platform_data = client->dev.platform_data;
++
++ dbg_hid("HID probe called for i2c 0x%02x\n", client->addr);
++
++ if (!client->irq) {
++ dev_err(&client->dev,
++ "HID over i2c has not been provided an Int IRQ\n");
++ return -EINVAL;
++ }
++
++ if (client->irq < 0) {
++ if (client->irq != -EPROBE_DEFER)
++ dev_err(&client->dev,
++ "HID over i2c doesn't have a valid IRQ\n");
++ return client->irq;
++ }
++
++ ihid = devm_kzalloc(&client->dev, sizeof(*ihid), GFP_KERNEL);
++ if (!ihid)
++ return -ENOMEM;
++
++ if (client->dev.of_node) {
++ ret = i2c_hid_of_probe(client, &ihid->pdata);
++ if (ret)
++ return ret;
++ } else if (!platform_data) {
++ ret = i2c_hid_acpi_pdata(client, &ihid->pdata);
++ if (ret)
++ return ret;
++ } else {
++ ihid->pdata = *platform_data;
++ }
++
++ /* Parse platform agnostic common properties from ACPI / device tree */
++ i2c_hid_fwnode_probe(client, &ihid->pdata);
++
++ ihid->pdata.supplies[0].supply = "vdd";
++ ihid->pdata.supplies[1].supply = "vddl";
++
++ ret = devm_regulator_bulk_get(&client->dev,
++ ARRAY_SIZE(ihid->pdata.supplies),
++ ihid->pdata.supplies);
++ if (ret)
++ return ret;
++
++ ret = regulator_bulk_enable(ARRAY_SIZE(ihid->pdata.supplies),
++ ihid->pdata.supplies);
++ if (ret < 0)
++ return ret;
++
++ if (ihid->pdata.post_power_delay_ms)
++ msleep(ihid->pdata.post_power_delay_ms);
++
++ i2c_set_clientdata(client, ihid);
++
++ ihid->client = client;
++
++ hidRegister = ihid->pdata.hid_descriptor_address;
++ ihid->wHIDDescRegister = cpu_to_le16(hidRegister);
++
++ init_waitqueue_head(&ihid->wait);
++ mutex_init(&ihid->reset_lock);
++
++ /* we need to allocate the command buffer without knowing the maximum
++ * size of the reports. Let's use HID_MIN_BUFFER_SIZE, then we do the
++ * real computation later. */
++ ret = i2c_hid_alloc_buffers(ihid, HID_MIN_BUFFER_SIZE);
++ if (ret < 0)
++ goto err_regulator;
++
++ i2c_hid_acpi_fix_up_power(&client->dev);
++
++ pm_runtime_get_noresume(&client->dev);
++ pm_runtime_set_active(&client->dev);
++ pm_runtime_enable(&client->dev);
++ device_enable_async_suspend(&client->dev);
++
++ /* Make sure there is something at this address */
++ ret = i2c_smbus_read_byte(client);
++ if (ret < 0) {
++ dev_dbg(&client->dev, "nothing at this address: %d\n", ret);
++ ret = -ENXIO;
++ goto err_pm;
++ }
++
++ ret = i2c_hid_fetch_hid_descriptor(ihid);
++ if (ret < 0)
++ goto err_pm;
++
++ ret = i2c_hid_init_irq(client);
++ if (ret < 0)
++ goto err_pm;
++
++ hid = hid_allocate_device();
++ if (IS_ERR(hid)) {
++ ret = PTR_ERR(hid);
++ goto err_irq;
++ }
++
++ ihid->hid = hid;
++
++ hid->driver_data = client;
++ hid->ll_driver = &i2c_hid_ll_driver;
++ hid->dev.parent = &client->dev;
++ hid->bus = BUS_I2C;
++ hid->version = le16_to_cpu(ihid->hdesc.bcdVersion);
++ hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID);
++ hid->product = le16_to_cpu(ihid->hdesc.wProductID);
++
++ snprintf(hid->name, sizeof(hid->name), "%s %04hX:%04hX",
++ client->name, hid->vendor, hid->product);
++ strlcpy(hid->phys, dev_name(&client->dev), sizeof(hid->phys));
++
++ ihid->quirks = i2c_hid_lookup_quirk(hid->vendor, hid->product);
++
++ ret = hid_add_device(hid);
++ if (ret) {
++ if (ret != -ENODEV)
++ hid_err(client, "can't add hid device: %d\n", ret);
++ goto err_mem_free;
++ }
++
++ if (!(ihid->quirks & I2C_HID_QUIRK_NO_RUNTIME_PM))
++ pm_runtime_put(&client->dev);
++
++ return 0;
++
++err_mem_free:
++ hid_destroy_device(hid);
++
++err_irq:
++ free_irq(client->irq, ihid);
++
++err_pm:
++ pm_runtime_put_noidle(&client->dev);
++ pm_runtime_disable(&client->dev);
++
++err_regulator:
++ regulator_bulk_disable(ARRAY_SIZE(ihid->pdata.supplies),
++ ihid->pdata.supplies);
++ i2c_hid_free_buffers(ihid);
++ return ret;
++}
++
++static int i2c_hid_remove(struct i2c_client *client)
++{
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ struct hid_device *hid;
++
++ if (!(ihid->quirks & I2C_HID_QUIRK_NO_RUNTIME_PM))
++ pm_runtime_get_sync(&client->dev);
++ pm_runtime_disable(&client->dev);
++ pm_runtime_set_suspended(&client->dev);
++ pm_runtime_put_noidle(&client->dev);
++
++ hid = ihid->hid;
++ hid_destroy_device(hid);
++
++ free_irq(client->irq, ihid);
++
++ if (ihid->bufsize)
++ i2c_hid_free_buffers(ihid);
++
++ regulator_bulk_disable(ARRAY_SIZE(ihid->pdata.supplies),
++ ihid->pdata.supplies);
++
++ return 0;
++}
++
++static void i2c_hid_shutdown(struct i2c_client *client)
++{
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++
++ i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
++ free_irq(client->irq, ihid);
++}
++
++#ifdef CONFIG_PM_SLEEP
++static int i2c_hid_suspend(struct device *dev)
++{
++ struct i2c_client *client = to_i2c_client(dev);
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ struct hid_device *hid = ihid->hid;
++ int ret;
++ int wake_status;
++
++ if (hid->driver && hid->driver->suspend) {
++ /*
++ * Wake up the device so that IO issues in
++ * HID driver's suspend code can succeed.
++ */
++ ret = pm_runtime_resume(dev);
++ if (ret < 0)
++ return ret;
++
++ ret = hid->driver->suspend(hid, PMSG_SUSPEND);
++ if (ret < 0)
++ return ret;
++ }
++
++ if (!pm_runtime_suspended(dev)) {
++ /* Save some power */
++ i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
++
++ disable_irq(client->irq);
++ }
++
++ if (device_may_wakeup(&client->dev)) {
++ wake_status = enable_irq_wake(client->irq);
++ if (!wake_status)
++ ihid->irq_wake_enabled = true;
++ else
++ hid_warn(hid, "Failed to enable irq wake: %d\n",
++ wake_status);
++ } else {
++ regulator_bulk_disable(ARRAY_SIZE(ihid->pdata.supplies),
++ ihid->pdata.supplies);
++ }
++
++ return 0;
++}
++
++static int i2c_hid_resume(struct device *dev)
++{
++ int ret;
++ struct i2c_client *client = to_i2c_client(dev);
++ struct i2c_hid *ihid = i2c_get_clientdata(client);
++ struct hid_device *hid = ihid->hid;
++ int wake_status;
++
++ if (!device_may_wakeup(&client->dev)) {
++ ret = regulator_bulk_enable(ARRAY_SIZE(ihid->pdata.supplies),
++ ihid->pdata.supplies);
++ if (ret)
++ hid_warn(hid, "Failed to enable supplies: %d\n", ret);
++
++ if (ihid->pdata.post_power_delay_ms)
++ msleep(ihid->pdata.post_power_delay_ms);
++ } else if (ihid->irq_wake_enabled) {
++ wake_status = disable_irq_wake(client->irq);
++ if (!wake_status)
++ ihid->irq_wake_enabled = false;
++ else
++ hid_warn(hid, "Failed to disable irq wake: %d\n",
++ wake_status);
++ }
++
++ /* We'll resume to full power */
++ pm_runtime_disable(dev);
++ pm_runtime_set_active(dev);
++ pm_runtime_enable(dev);
++
++ enable_irq(client->irq);
++
++ /* Instead of resetting device, simply powers the device on. This
++ * solves "incomplete reports" on Raydium devices 2386:3118 and
++ * 2386:4B33 and fixes various SIS touchscreens no longer sending
++ * data after a suspend/resume.
++ */
++ ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
++ if (ret)
++ return ret;
++
++ if (hid->driver && hid->driver->reset_resume) {
++ ret = hid->driver->reset_resume(hid);
++ return ret;
++ }
++
++ return 0;
++}
++#endif
++
++#ifdef CONFIG_PM
++static int i2c_hid_runtime_suspend(struct device *dev)
++{
++ struct i2c_client *client = to_i2c_client(dev);
++
++ i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
++ disable_irq(client->irq);
++ return 0;
++}
++
++static int i2c_hid_runtime_resume(struct device *dev)
++{
++ struct i2c_client *client = to_i2c_client(dev);
++
++ enable_irq(client->irq);
++ i2c_hid_set_power(client, I2C_HID_PWR_ON);
++ return 0;
++}
++#endif
++
++static const struct dev_pm_ops i2c_hid_pm = {
++ SET_SYSTEM_SLEEP_PM_OPS(i2c_hid_suspend, i2c_hid_resume)
++ SET_RUNTIME_PM_OPS(i2c_hid_runtime_suspend, i2c_hid_runtime_resume,
++ NULL)
++};
++
++static const struct i2c_device_id i2c_hid_id_table[] = {
++ { "hid", 0 },
++ { "hid-over-i2c", 0 },
++ { },
++};
++MODULE_DEVICE_TABLE(i2c, i2c_hid_id_table);
++
++
++static struct i2c_driver i2c_hid_driver = {
++ .driver = {
++ .name = "i2c_hid",
++ .pm = &i2c_hid_pm,
++ .acpi_match_table = ACPI_PTR(i2c_hid_acpi_match),
++ .of_match_table = of_match_ptr(i2c_hid_of_match),
++ },
++
++ .probe = i2c_hid_probe,
++ .remove = i2c_hid_remove,
++ .shutdown = i2c_hid_shutdown,
++ .id_table = i2c_hid_id_table,
++};
++
++module_i2c_driver(i2c_hid_driver);
++
++MODULE_DESCRIPTION("HID over I2C core driver");
++MODULE_AUTHOR("Benjamin Tissoires <benjamin.tissoires@gmail.com>");
++MODULE_LICENSE("GPL");
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+new file mode 100644
+index 000000000000..1d645c9ab417
+--- /dev/null
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -0,0 +1,376 @@
++// SPDX-License-Identifier: GPL-2.0+
++
++/*
++ * Quirks for I2C-HID devices that do not supply proper descriptors
++ *
++ * Copyright (c) 2018 Julian Sax <jsbc@gmx.de>
++ *
++ */
++
++#include <linux/types.h>
++#include <linux/dmi.h>
++#include <linux/mod_devicetable.h>
++
++#include "i2c-hid.h"
++
++
++struct i2c_hid_desc_override {
++ union {
++ struct i2c_hid_desc *i2c_hid_desc;
++ uint8_t *i2c_hid_desc_buffer;
++ };
++ uint8_t *hid_report_desc;
++ unsigned int hid_report_desc_size;
++ uint8_t *i2c_name;
++};
++
++
++/*
++ * descriptors for the SIPODEV SP1064 touchpad
++ *
++ * This device does not supply any descriptors and on windows a filter
++ * driver operates between the i2c-hid layer and the device and injects
++ * these descriptors when the device is prompted. The descriptors were
++ * extracted by listening to the i2c-hid traffic that occurs between the
++ * windows filter driver and the windows i2c-hid driver.
++ */
++
++static const struct i2c_hid_desc_override sipodev_desc = {
++ .i2c_hid_desc_buffer = (uint8_t [])
++ {0x1e, 0x00, /* Length of descriptor */
++ 0x00, 0x01, /* Version of descriptor */
++ 0xdb, 0x01, /* Length of report descriptor */
++ 0x21, 0x00, /* Location of report descriptor */
++ 0x24, 0x00, /* Location of input report */
++ 0x1b, 0x00, /* Max input report length */
++ 0x25, 0x00, /* Location of output report */
++ 0x11, 0x00, /* Max output report length */
++ 0x22, 0x00, /* Location of command register */
++ 0x23, 0x00, /* Location of data register */
++ 0x11, 0x09, /* Vendor ID */
++ 0x88, 0x52, /* Product ID */
++ 0x06, 0x00, /* Version ID */
++ 0x00, 0x00, 0x00, 0x00 /* Reserved */
++ },
++
++ .hid_report_desc = (uint8_t [])
++ {0x05, 0x01, /* Usage Page (Desktop), */
++ 0x09, 0x02, /* Usage (Mouse), */
++ 0xA1, 0x01, /* Collection (Application), */
++ 0x85, 0x01, /* Report ID (1), */
++ 0x09, 0x01, /* Usage (Pointer), */
++ 0xA1, 0x00, /* Collection (Physical), */
++ 0x05, 0x09, /* Usage Page (Button), */
++ 0x19, 0x01, /* Usage Minimum (01h), */
++ 0x29, 0x02, /* Usage Maximum (02h), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x95, 0x02, /* Report Count (2), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x95, 0x06, /* Report Count (6), */
++ 0x81, 0x01, /* Input (Constant), */
++ 0x05, 0x01, /* Usage Page (Desktop), */
++ 0x09, 0x30, /* Usage (X), */
++ 0x09, 0x31, /* Usage (Y), */
++ 0x15, 0x81, /* Logical Minimum (-127), */
++ 0x25, 0x7F, /* Logical Maximum (127), */
++ 0x75, 0x08, /* Report Size (8), */
++ 0x95, 0x02, /* Report Count (2), */
++ 0x81, 0x06, /* Input (Variable, Relative), */
++ 0xC0, /* End Collection, */
++ 0xC0, /* End Collection, */
++ 0x05, 0x0D, /* Usage Page (Digitizer), */
++ 0x09, 0x05, /* Usage (Touchpad), */
++ 0xA1, 0x01, /* Collection (Application), */
++ 0x85, 0x04, /* Report ID (4), */
++ 0x05, 0x0D, /* Usage Page (Digitizer), */
++ 0x09, 0x22, /* Usage (Finger), */
++ 0xA1, 0x02, /* Collection (Logical), */
++ 0x15, 0x00, /* Logical Minimum (0), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0x09, 0x47, /* Usage (Touch Valid), */
++ 0x09, 0x42, /* Usage (Tip Switch), */
++ 0x95, 0x02, /* Report Count (2), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x75, 0x03, /* Report Size (3), */
++ 0x25, 0x05, /* Logical Maximum (5), */
++ 0x09, 0x51, /* Usage (Contact Identifier), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x95, 0x03, /* Report Count (3), */
++ 0x81, 0x03, /* Input (Constant, Variable), */
++ 0x05, 0x01, /* Usage Page (Desktop), */
++ 0x26, 0x44, 0x0A, /* Logical Maximum (2628), */
++ 0x75, 0x10, /* Report Size (16), */
++ 0x55, 0x0E, /* Unit Exponent (14), */
++ 0x65, 0x11, /* Unit (Centimeter), */
++ 0x09, 0x30, /* Usage (X), */
++ 0x46, 0x1A, 0x04, /* Physical Maximum (1050), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x46, 0xBC, 0x02, /* Physical Maximum (700), */
++ 0x26, 0x34, 0x05, /* Logical Maximum (1332), */
++ 0x09, 0x31, /* Usage (Y), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0xC0, /* End Collection, */
++ 0x05, 0x0D, /* Usage Page (Digitizer), */
++ 0x09, 0x22, /* Usage (Finger), */
++ 0xA1, 0x02, /* Collection (Logical), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0x09, 0x47, /* Usage (Touch Valid), */
++ 0x09, 0x42, /* Usage (Tip Switch), */
++ 0x95, 0x02, /* Report Count (2), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x75, 0x03, /* Report Size (3), */
++ 0x25, 0x05, /* Logical Maximum (5), */
++ 0x09, 0x51, /* Usage (Contact Identifier), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x95, 0x03, /* Report Count (3), */
++ 0x81, 0x03, /* Input (Constant, Variable), */
++ 0x05, 0x01, /* Usage Page (Desktop), */
++ 0x26, 0x44, 0x0A, /* Logical Maximum (2628), */
++ 0x75, 0x10, /* Report Size (16), */
++ 0x09, 0x30, /* Usage (X), */
++ 0x46, 0x1A, 0x04, /* Physical Maximum (1050), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x46, 0xBC, 0x02, /* Physical Maximum (700), */
++ 0x26, 0x34, 0x05, /* Logical Maximum (1332), */
++ 0x09, 0x31, /* Usage (Y), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0xC0, /* End Collection, */
++ 0x05, 0x0D, /* Usage Page (Digitizer), */
++ 0x09, 0x22, /* Usage (Finger), */
++ 0xA1, 0x02, /* Collection (Logical), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0x09, 0x47, /* Usage (Touch Valid), */
++ 0x09, 0x42, /* Usage (Tip Switch), */
++ 0x95, 0x02, /* Report Count (2), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x75, 0x03, /* Report Size (3), */
++ 0x25, 0x05, /* Logical Maximum (5), */
++ 0x09, 0x51, /* Usage (Contact Identifier), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x95, 0x03, /* Report Count (3), */
++ 0x81, 0x03, /* Input (Constant, Variable), */
++ 0x05, 0x01, /* Usage Page (Desktop), */
++ 0x26, 0x44, 0x0A, /* Logical Maximum (2628), */
++ 0x75, 0x10, /* Report Size (16), */
++ 0x09, 0x30, /* Usage (X), */
++ 0x46, 0x1A, 0x04, /* Physical Maximum (1050), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x46, 0xBC, 0x02, /* Physical Maximum (700), */
++ 0x26, 0x34, 0x05, /* Logical Maximum (1332), */
++ 0x09, 0x31, /* Usage (Y), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0xC0, /* End Collection, */
++ 0x05, 0x0D, /* Usage Page (Digitizer), */
++ 0x09, 0x22, /* Usage (Finger), */
++ 0xA1, 0x02, /* Collection (Logical), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0x09, 0x47, /* Usage (Touch Valid), */
++ 0x09, 0x42, /* Usage (Tip Switch), */
++ 0x95, 0x02, /* Report Count (2), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x75, 0x03, /* Report Size (3), */
++ 0x25, 0x05, /* Logical Maximum (5), */
++ 0x09, 0x51, /* Usage (Contact Identifier), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x95, 0x03, /* Report Count (3), */
++ 0x81, 0x03, /* Input (Constant, Variable), */
++ 0x05, 0x01, /* Usage Page (Desktop), */
++ 0x26, 0x44, 0x0A, /* Logical Maximum (2628), */
++ 0x75, 0x10, /* Report Size (16), */
++ 0x09, 0x30, /* Usage (X), */
++ 0x46, 0x1A, 0x04, /* Physical Maximum (1050), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x46, 0xBC, 0x02, /* Physical Maximum (700), */
++ 0x26, 0x34, 0x05, /* Logical Maximum (1332), */
++ 0x09, 0x31, /* Usage (Y), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0xC0, /* End Collection, */
++ 0x05, 0x0D, /* Usage Page (Digitizer), */
++ 0x55, 0x0C, /* Unit Exponent (12), */
++ 0x66, 0x01, 0x10, /* Unit (Seconds), */
++ 0x47, 0xFF, 0xFF, 0x00, 0x00,/* Physical Maximum (65535), */
++ 0x27, 0xFF, 0xFF, 0x00, 0x00,/* Logical Maximum (65535), */
++ 0x75, 0x10, /* Report Size (16), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x09, 0x56, /* Usage (Scan Time), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x09, 0x54, /* Usage (Contact Count), */
++ 0x25, 0x7F, /* Logical Maximum (127), */
++ 0x75, 0x08, /* Report Size (8), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x05, 0x09, /* Usage Page (Button), */
++ 0x09, 0x01, /* Usage (01h), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x81, 0x02, /* Input (Variable), */
++ 0x95, 0x07, /* Report Count (7), */
++ 0x81, 0x03, /* Input (Constant, Variable), */
++ 0x05, 0x0D, /* Usage Page (Digitizer), */
++ 0x85, 0x02, /* Report ID (2), */
++ 0x09, 0x55, /* Usage (Contact Count Maximum), */
++ 0x09, 0x59, /* Usage (59h), */
++ 0x75, 0x04, /* Report Size (4), */
++ 0x95, 0x02, /* Report Count (2), */
++ 0x25, 0x0F, /* Logical Maximum (15), */
++ 0xB1, 0x02, /* Feature (Variable), */
++ 0x05, 0x0D, /* Usage Page (Digitizer), */
++ 0x85, 0x07, /* Report ID (7), */
++ 0x09, 0x60, /* Usage (60h), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0xB1, 0x02, /* Feature (Variable), */
++ 0x95, 0x07, /* Report Count (7), */
++ 0xB1, 0x03, /* Feature (Constant, Variable), */
++ 0x85, 0x06, /* Report ID (6), */
++ 0x06, 0x00, 0xFF, /* Usage Page (FF00h), */
++ 0x09, 0xC5, /* Usage (C5h), */
++ 0x26, 0xFF, 0x00, /* Logical Maximum (255), */
++ 0x75, 0x08, /* Report Size (8), */
++ 0x96, 0x00, 0x01, /* Report Count (256), */
++ 0xB1, 0x02, /* Feature (Variable), */
++ 0xC0, /* End Collection, */
++ 0x06, 0x00, 0xFF, /* Usage Page (FF00h), */
++ 0x09, 0x01, /* Usage (01h), */
++ 0xA1, 0x01, /* Collection (Application), */
++ 0x85, 0x0D, /* Report ID (13), */
++ 0x26, 0xFF, 0x00, /* Logical Maximum (255), */
++ 0x19, 0x01, /* Usage Minimum (01h), */
++ 0x29, 0x02, /* Usage Maximum (02h), */
++ 0x75, 0x08, /* Report Size (8), */
++ 0x95, 0x02, /* Report Count (2), */
++ 0xB1, 0x02, /* Feature (Variable), */
++ 0xC0, /* End Collection, */
++ 0x05, 0x0D, /* Usage Page (Digitizer), */
++ 0x09, 0x0E, /* Usage (Configuration), */
++ 0xA1, 0x01, /* Collection (Application), */
++ 0x85, 0x03, /* Report ID (3), */
++ 0x09, 0x22, /* Usage (Finger), */
++ 0xA1, 0x02, /* Collection (Logical), */
++ 0x09, 0x52, /* Usage (Device Mode), */
++ 0x25, 0x0A, /* Logical Maximum (10), */
++ 0x95, 0x01, /* Report Count (1), */
++ 0xB1, 0x02, /* Feature (Variable), */
++ 0xC0, /* End Collection, */
++ 0x09, 0x22, /* Usage (Finger), */
++ 0xA1, 0x00, /* Collection (Physical), */
++ 0x85, 0x05, /* Report ID (5), */
++ 0x09, 0x57, /* Usage (57h), */
++ 0x09, 0x58, /* Usage (58h), */
++ 0x75, 0x01, /* Report Size (1), */
++ 0x95, 0x02, /* Report Count (2), */
++ 0x25, 0x01, /* Logical Maximum (1), */
++ 0xB1, 0x02, /* Feature (Variable), */
++ 0x95, 0x06, /* Report Count (6), */
++ 0xB1, 0x03, /* Feature (Constant, Variable),*/
++ 0xC0, /* End Collection, */
++ 0xC0 /* End Collection */
++ },
++ .hid_report_desc_size = 475,
++ .i2c_name = "SYNA3602:00"
++};
++
++
++static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
++ {
++ .ident = "Teclast F6 Pro",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TECLAST"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "F6 Pro"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
++ {
++ .ident = "Teclast F7",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TECLAST"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "F7"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
++ {
++ .ident = "Trekstor Primebook C13",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TREKSTOR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Primebook C13"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
++ {
++ .ident = "Trekstor Primebook C11",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TREKSTOR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Primebook C11"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
++ {
++ .ident = "Direkt-Tek DTLAPY116-2",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Direkt-Tek"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "DTLAPY116-2"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
++ {
++ .ident = "Mediacom Flexbook Edge 11",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook edge11 - M-FBE11"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ }
++};
++
++
++struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name)
++{
++ struct i2c_hid_desc_override *override;
++ const struct dmi_system_id *system_id;
++
++ system_id = dmi_first_match(i2c_hid_dmi_desc_override_table);
++ if (!system_id)
++ return NULL;
++
++ override = system_id->driver_data;
++ if (strcmp(override->i2c_name, i2c_name))
++ return NULL;
++
++ return override->i2c_hid_desc;
++}
++
++char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name,
++ unsigned int *size)
++{
++ struct i2c_hid_desc_override *override;
++ const struct dmi_system_id *system_id;
++
++ system_id = dmi_first_match(i2c_hid_dmi_desc_override_table);
++ if (!system_id)
++ return NULL;
++
++ override = system_id->driver_data;
++ if (strcmp(override->i2c_name, i2c_name))
++ return NULL;
++
++ *size = override->hid_report_desc_size;
++ return override->hid_report_desc;
++}
+diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
+deleted file mode 100644
+index 88daa388e1f6..000000000000
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ /dev/null
+@@ -1,1328 +0,0 @@
+-/*
+- * HID over I2C protocol implementation
+- *
+- * Copyright (c) 2012 Benjamin Tissoires <benjamin.tissoires@gmail.com>
+- * Copyright (c) 2012 Ecole Nationale de l'Aviation Civile, France
+- * Copyright (c) 2012 Red Hat, Inc
+- *
+- * This code is partly based on "USB HID support for Linux":
+- *
+- * Copyright (c) 1999 Andreas Gal
+- * Copyright (c) 2000-2005 Vojtech Pavlik <vojtech@suse.cz>
+- * Copyright (c) 2005 Michael Haboustak <mike-@cinci.rr.com> for Concept2, Inc
+- * Copyright (c) 2007-2008 Oliver Neukum
+- * Copyright (c) 2006-2010 Jiri Kosina
+- *
+- * This file is subject to the terms and conditions of the GNU General Public
+- * License. See the file COPYING in the main directory of this archive for
+- * more details.
+- */
+-
+-#include <linux/module.h>
+-#include <linux/i2c.h>
+-#include <linux/interrupt.h>
+-#include <linux/input.h>
+-#include <linux/irq.h>
+-#include <linux/delay.h>
+-#include <linux/slab.h>
+-#include <linux/pm.h>
+-#include <linux/pm_runtime.h>
+-#include <linux/device.h>
+-#include <linux/wait.h>
+-#include <linux/err.h>
+-#include <linux/string.h>
+-#include <linux/list.h>
+-#include <linux/jiffies.h>
+-#include <linux/kernel.h>
+-#include <linux/hid.h>
+-#include <linux/mutex.h>
+-#include <linux/acpi.h>
+-#include <linux/of.h>
+-#include <linux/regulator/consumer.h>
+-
+-#include <linux/platform_data/i2c-hid.h>
+-
+-#include "../hid-ids.h"
+-
+-/* quirks to control the device */
+-#define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV BIT(0)
+-#define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(1)
+-#define I2C_HID_QUIRK_NO_RUNTIME_PM BIT(2)
+-#define I2C_HID_QUIRK_DELAY_AFTER_SLEEP BIT(3)
+-
+-/* flags */
+-#define I2C_HID_STARTED 0
+-#define I2C_HID_RESET_PENDING 1
+-#define I2C_HID_READ_PENDING 2
+-
+-#define I2C_HID_PWR_ON 0x00
+-#define I2C_HID_PWR_SLEEP 0x01
+-
+-/* debug option */
+-static bool debug;
+-module_param(debug, bool, 0444);
+-MODULE_PARM_DESC(debug, "print a lot of debug information");
+-
+-#define i2c_hid_dbg(ihid, fmt, arg...) \
+-do { \
+- if (debug) \
+- dev_printk(KERN_DEBUG, &(ihid)->client->dev, fmt, ##arg); \
+-} while (0)
+-
+-struct i2c_hid_desc {
+- __le16 wHIDDescLength;
+- __le16 bcdVersion;
+- __le16 wReportDescLength;
+- __le16 wReportDescRegister;
+- __le16 wInputRegister;
+- __le16 wMaxInputLength;
+- __le16 wOutputRegister;
+- __le16 wMaxOutputLength;
+- __le16 wCommandRegister;
+- __le16 wDataRegister;
+- __le16 wVendorID;
+- __le16 wProductID;
+- __le16 wVersionID;
+- __le32 reserved;
+-} __packed;
+-
+-struct i2c_hid_cmd {
+- unsigned int registerIndex;
+- __u8 opcode;
+- unsigned int length;
+- bool wait;
+-};
+-
+-union command {
+- u8 data[0];
+- struct cmd {
+- __le16 reg;
+- __u8 reportTypeID;
+- __u8 opcode;
+- } __packed c;
+-};
+-
+-#define I2C_HID_CMD(opcode_) \
+- .opcode = opcode_, .length = 4, \
+- .registerIndex = offsetof(struct i2c_hid_desc, wCommandRegister)
+-
+-/* fetch HID descriptor */
+-static const struct i2c_hid_cmd hid_descr_cmd = { .length = 2 };
+-/* fetch report descriptors */
+-static const struct i2c_hid_cmd hid_report_descr_cmd = {
+- .registerIndex = offsetof(struct i2c_hid_desc,
+- wReportDescRegister),
+- .opcode = 0x00,
+- .length = 2 };
+-/* commands */
+-static const struct i2c_hid_cmd hid_reset_cmd = { I2C_HID_CMD(0x01),
+- .wait = true };
+-static const struct i2c_hid_cmd hid_get_report_cmd = { I2C_HID_CMD(0x02) };
+-static const struct i2c_hid_cmd hid_set_report_cmd = { I2C_HID_CMD(0x03) };
+-static const struct i2c_hid_cmd hid_set_power_cmd = { I2C_HID_CMD(0x08) };
+-static const struct i2c_hid_cmd hid_no_cmd = { .length = 0 };
+-
+-/*
+- * These definitions are not used here, but are defined by the spec.
+- * Keeping them here for documentation purposes.
+- *
+- * static const struct i2c_hid_cmd hid_get_idle_cmd = { I2C_HID_CMD(0x04) };
+- * static const struct i2c_hid_cmd hid_set_idle_cmd = { I2C_HID_CMD(0x05) };
+- * static const struct i2c_hid_cmd hid_get_protocol_cmd = { I2C_HID_CMD(0x06) };
+- * static const struct i2c_hid_cmd hid_set_protocol_cmd = { I2C_HID_CMD(0x07) };
+- */
+-
+-/* The main device structure */
+-struct i2c_hid {
+- struct i2c_client *client; /* i2c client */
+- struct hid_device *hid; /* pointer to corresponding HID dev */
+- union {
+- __u8 hdesc_buffer[sizeof(struct i2c_hid_desc)];
+- struct i2c_hid_desc hdesc; /* the HID Descriptor */
+- };
+- __le16 wHIDDescRegister; /* location of the i2c
+- * register of the HID
+- * descriptor. */
+- unsigned int bufsize; /* i2c buffer size */
+- u8 *inbuf; /* Input buffer */
+- u8 *rawbuf; /* Raw Input buffer */
+- u8 *cmdbuf; /* Command buffer */
+- u8 *argsbuf; /* Command arguments buffer */
+-
+- unsigned long flags; /* device flags */
+- unsigned long quirks; /* Various quirks */
+-
+- wait_queue_head_t wait; /* For waiting the interrupt */
+-
+- struct i2c_hid_platform_data pdata;
+-
+- bool irq_wake_enabled;
+- struct mutex reset_lock;
+-
+- unsigned long sleep_delay;
+-};
+-
+-static const struct i2c_hid_quirks {
+- __u16 idVendor;
+- __u16 idProduct;
+- __u32 quirks;
+-} i2c_hid_quirks[] = {
+- { USB_VENDOR_ID_WEIDA, USB_DEVICE_ID_WEIDA_8752,
+- I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
+- { USB_VENDOR_ID_WEIDA, USB_DEVICE_ID_WEIDA_8755,
+- I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
+- { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
+- I2C_HID_QUIRK_NO_IRQ_AFTER_RESET |
+- I2C_HID_QUIRK_NO_RUNTIME_PM },
+- { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33,
+- I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
+- { 0, 0 }
+-};
+-
+-/*
+- * i2c_hid_lookup_quirk: return any quirks associated with a I2C HID device
+- * @idVendor: the 16-bit vendor ID
+- * @idProduct: the 16-bit product ID
+- *
+- * Returns: a u32 quirks value.
+- */
+-static u32 i2c_hid_lookup_quirk(const u16 idVendor, const u16 idProduct)
+-{
+- u32 quirks = 0;
+- int n;
+-
+- for (n = 0; i2c_hid_quirks[n].idVendor; n++)
+- if (i2c_hid_quirks[n].idVendor == idVendor &&
+- (i2c_hid_quirks[n].idProduct == (__u16)HID_ANY_ID ||
+- i2c_hid_quirks[n].idProduct == idProduct))
+- quirks = i2c_hid_quirks[n].quirks;
+-
+- return quirks;
+-}
+-
+-static int __i2c_hid_command(struct i2c_client *client,
+- const struct i2c_hid_cmd *command, u8 reportID,
+- u8 reportType, u8 *args, int args_len,
+- unsigned char *buf_recv, int data_len)
+-{
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- union command *cmd = (union command *)ihid->cmdbuf;
+- int ret;
+- struct i2c_msg msg[2];
+- int msg_num = 1;
+-
+- int length = command->length;
+- bool wait = command->wait;
+- unsigned int registerIndex = command->registerIndex;
+-
+- /* special case for hid_descr_cmd */
+- if (command == &hid_descr_cmd) {
+- cmd->c.reg = ihid->wHIDDescRegister;
+- } else {
+- cmd->data[0] = ihid->hdesc_buffer[registerIndex];
+- cmd->data[1] = ihid->hdesc_buffer[registerIndex + 1];
+- }
+-
+- if (length > 2) {
+- cmd->c.opcode = command->opcode;
+- cmd->c.reportTypeID = reportID | reportType << 4;
+- }
+-
+- memcpy(cmd->data + length, args, args_len);
+- length += args_len;
+-
+- i2c_hid_dbg(ihid, "%s: cmd=%*ph\n", __func__, length, cmd->data);
+-
+- msg[0].addr = client->addr;
+- msg[0].flags = client->flags & I2C_M_TEN;
+- msg[0].len = length;
+- msg[0].buf = cmd->data;
+- if (data_len > 0) {
+- msg[1].addr = client->addr;
+- msg[1].flags = client->flags & I2C_M_TEN;
+- msg[1].flags |= I2C_M_RD;
+- msg[1].len = data_len;
+- msg[1].buf = buf_recv;
+- msg_num = 2;
+- set_bit(I2C_HID_READ_PENDING, &ihid->flags);
+- }
+-
+- if (wait)
+- set_bit(I2C_HID_RESET_PENDING, &ihid->flags);
+-
+- ret = i2c_transfer(client->adapter, msg, msg_num);
+-
+- if (data_len > 0)
+- clear_bit(I2C_HID_READ_PENDING, &ihid->flags);
+-
+- if (ret != msg_num)
+- return ret < 0 ? ret : -EIO;
+-
+- ret = 0;
+-
+- if (wait && (ihid->quirks & I2C_HID_QUIRK_NO_IRQ_AFTER_RESET)) {
+- msleep(100);
+- } else if (wait) {
+- i2c_hid_dbg(ihid, "%s: waiting...\n", __func__);
+- if (!wait_event_timeout(ihid->wait,
+- !test_bit(I2C_HID_RESET_PENDING, &ihid->flags),
+- msecs_to_jiffies(5000)))
+- ret = -ENODATA;
+- i2c_hid_dbg(ihid, "%s: finished.\n", __func__);
+- }
+-
+- return ret;
+-}
+-
+-static int i2c_hid_command(struct i2c_client *client,
+- const struct i2c_hid_cmd *command,
+- unsigned char *buf_recv, int data_len)
+-{
+- return __i2c_hid_command(client, command, 0, 0, NULL, 0,
+- buf_recv, data_len);
+-}
+-
+-static int i2c_hid_get_report(struct i2c_client *client, u8 reportType,
+- u8 reportID, unsigned char *buf_recv, int data_len)
+-{
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- u8 args[3];
+- int ret;
+- int args_len = 0;
+- u16 readRegister = le16_to_cpu(ihid->hdesc.wDataRegister);
+-
+- i2c_hid_dbg(ihid, "%s\n", __func__);
+-
+- if (reportID >= 0x0F) {
+- args[args_len++] = reportID;
+- reportID = 0x0F;
+- }
+-
+- args[args_len++] = readRegister & 0xFF;
+- args[args_len++] = readRegister >> 8;
+-
+- ret = __i2c_hid_command(client, &hid_get_report_cmd, reportID,
+- reportType, args, args_len, buf_recv, data_len);
+- if (ret) {
+- dev_err(&client->dev,
+- "failed to retrieve report from device.\n");
+- return ret;
+- }
+-
+- return 0;
+-}
+-
+-/**
+- * i2c_hid_set_or_send_report: forward an incoming report to the device
+- * @client: the i2c_client of the device
+- * @reportType: 0x03 for HID_FEATURE_REPORT ; 0x02 for HID_OUTPUT_REPORT
+- * @reportID: the report ID
+- * @buf: the actual data to transfer, without the report ID
+- * @len: size of buf
+- * @use_data: true: use SET_REPORT HID command, false: send plain OUTPUT report
+- */
+-static int i2c_hid_set_or_send_report(struct i2c_client *client, u8 reportType,
+- u8 reportID, unsigned char *buf, size_t data_len, bool use_data)
+-{
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- u8 *args = ihid->argsbuf;
+- const struct i2c_hid_cmd *hidcmd;
+- int ret;
+- u16 dataRegister = le16_to_cpu(ihid->hdesc.wDataRegister);
+- u16 outputRegister = le16_to_cpu(ihid->hdesc.wOutputRegister);
+- u16 maxOutputLength = le16_to_cpu(ihid->hdesc.wMaxOutputLength);
+- u16 size;
+- int args_len;
+- int index = 0;
+-
+- i2c_hid_dbg(ihid, "%s\n", __func__);
+-
+- if (data_len > ihid->bufsize)
+- return -EINVAL;
+-
+- size = 2 /* size */ +
+- (reportID ? 1 : 0) /* reportID */ +
+- data_len /* buf */;
+- args_len = (reportID >= 0x0F ? 1 : 0) /* optional third byte */ +
+- 2 /* dataRegister */ +
+- size /* args */;
+-
+- if (!use_data && maxOutputLength == 0)
+- return -ENOSYS;
+-
+- if (reportID >= 0x0F) {
+- args[index++] = reportID;
+- reportID = 0x0F;
+- }
+-
+- /*
+- * use the data register for feature reports or if the device does not
+- * support the output register
+- */
+- if (use_data) {
+- args[index++] = dataRegister & 0xFF;
+- args[index++] = dataRegister >> 8;
+- hidcmd = &hid_set_report_cmd;
+- } else {
+- args[index++] = outputRegister & 0xFF;
+- args[index++] = outputRegister >> 8;
+- hidcmd = &hid_no_cmd;
+- }
+-
+- args[index++] = size & 0xFF;
+- args[index++] = size >> 8;
+-
+- if (reportID)
+- args[index++] = reportID;
+-
+- memcpy(&args[index], buf, data_len);
+-
+- ret = __i2c_hid_command(client, hidcmd, reportID,
+- reportType, args, args_len, NULL, 0);
+- if (ret) {
+- dev_err(&client->dev, "failed to set a report to device.\n");
+- return ret;
+- }
+-
+- return data_len;
+-}
+-
+-static int i2c_hid_set_power(struct i2c_client *client, int power_state)
+-{
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- int ret;
+- unsigned long now, delay;
+-
+- i2c_hid_dbg(ihid, "%s\n", __func__);
+-
+- /*
+- * Some devices require to send a command to wakeup before power on.
+- * The call will get a return value (EREMOTEIO) but device will be
+- * triggered and activated. After that, it goes like a normal device.
+- */
+- if (power_state == I2C_HID_PWR_ON &&
+- ihid->quirks & I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV) {
+- ret = i2c_hid_command(client, &hid_set_power_cmd, NULL, 0);
+-
+- /* Device was already activated */
+- if (!ret)
+- goto set_pwr_exit;
+- }
+-
+- if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
+- power_state == I2C_HID_PWR_ON) {
+- now = jiffies;
+- if (time_after(ihid->sleep_delay, now)) {
+- delay = jiffies_to_usecs(ihid->sleep_delay - now);
+- usleep_range(delay, delay + 1);
+- }
+- }
+-
+- ret = __i2c_hid_command(client, &hid_set_power_cmd, power_state,
+- 0, NULL, 0, NULL, 0);
+-
+- if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP &&
+- power_state == I2C_HID_PWR_SLEEP)
+- ihid->sleep_delay = jiffies + msecs_to_jiffies(20);
+-
+- if (ret)
+- dev_err(&client->dev, "failed to change power setting.\n");
+-
+-set_pwr_exit:
+- return ret;
+-}
+-
+-static int i2c_hid_hwreset(struct i2c_client *client)
+-{
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- int ret;
+-
+- i2c_hid_dbg(ihid, "%s\n", __func__);
+-
+- /*
+- * This prevents sending feature reports while the device is
+- * being reset. Otherwise we may lose the reset complete
+- * interrupt.
+- */
+- mutex_lock(&ihid->reset_lock);
+-
+- ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
+- if (ret)
+- goto out_unlock;
+-
+- /*
+- * The HID over I2C specification states that if a DEVICE needs time
+- * after the PWR_ON request, it should utilise CLOCK stretching.
+- * However, it has been observered that the Windows driver provides a
+- * 1ms sleep between the PWR_ON and RESET requests and that some devices
+- * rely on this.
+- */
+- usleep_range(1000, 5000);
+-
+- i2c_hid_dbg(ihid, "resetting...\n");
+-
+- ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0);
+- if (ret) {
+- dev_err(&client->dev, "failed to reset device.\n");
+- i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
+- }
+-
+-out_unlock:
+- mutex_unlock(&ihid->reset_lock);
+- return ret;
+-}
+-
+-static void i2c_hid_get_input(struct i2c_hid *ihid)
+-{
+- int ret;
+- u32 ret_size;
+- int size = le16_to_cpu(ihid->hdesc.wMaxInputLength);
+-
+- if (size > ihid->bufsize)
+- size = ihid->bufsize;
+-
+- ret = i2c_master_recv(ihid->client, ihid->inbuf, size);
+- if (ret != size) {
+- if (ret < 0)
+- return;
+-
+- dev_err(&ihid->client->dev, "%s: got %d data instead of %d\n",
+- __func__, ret, size);
+- return;
+- }
+-
+- ret_size = ihid->inbuf[0] | ihid->inbuf[1] << 8;
+-
+- if (!ret_size) {
+- /* host or device initiated RESET completed */
+- if (test_and_clear_bit(I2C_HID_RESET_PENDING, &ihid->flags))
+- wake_up(&ihid->wait);
+- return;
+- }
+-
+- if ((ret_size > size) || (ret_size < 2)) {
+- dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
+- __func__, size, ret_size);
+- return;
+- }
+-
+- i2c_hid_dbg(ihid, "input: %*ph\n", ret_size, ihid->inbuf);
+-
+- if (test_bit(I2C_HID_STARTED, &ihid->flags))
+- hid_input_report(ihid->hid, HID_INPUT_REPORT, ihid->inbuf + 2,
+- ret_size - 2, 1);
+-
+- return;
+-}
+-
+-static irqreturn_t i2c_hid_irq(int irq, void *dev_id)
+-{
+- struct i2c_hid *ihid = dev_id;
+-
+- if (test_bit(I2C_HID_READ_PENDING, &ihid->flags))
+- return IRQ_HANDLED;
+-
+- i2c_hid_get_input(ihid);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static int i2c_hid_get_report_length(struct hid_report *report)
+-{
+- return ((report->size - 1) >> 3) + 1 +
+- report->device->report_enum[report->type].numbered + 2;
+-}
+-
+-/*
+- * Traverse the supplied list of reports and find the longest
+- */
+-static void i2c_hid_find_max_report(struct hid_device *hid, unsigned int type,
+- unsigned int *max)
+-{
+- struct hid_report *report;
+- unsigned int size;
+-
+- /* We should not rely on wMaxInputLength, as some devices may set it to
+- * a wrong length. */
+- list_for_each_entry(report, &hid->report_enum[type].report_list, list) {
+- size = i2c_hid_get_report_length(report);
+- if (*max < size)
+- *max = size;
+- }
+-}
+-
+-static void i2c_hid_free_buffers(struct i2c_hid *ihid)
+-{
+- kfree(ihid->inbuf);
+- kfree(ihid->rawbuf);
+- kfree(ihid->argsbuf);
+- kfree(ihid->cmdbuf);
+- ihid->inbuf = NULL;
+- ihid->rawbuf = NULL;
+- ihid->cmdbuf = NULL;
+- ihid->argsbuf = NULL;
+- ihid->bufsize = 0;
+-}
+-
+-static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size)
+-{
+- /* the worst case is computed from the set_report command with a
+- * reportID > 15 and the maximum report length */
+- int args_len = sizeof(__u8) + /* ReportID */
+- sizeof(__u8) + /* optional ReportID byte */
+- sizeof(__u16) + /* data register */
+- sizeof(__u16) + /* size of the report */
+- report_size; /* report */
+-
+- ihid->inbuf = kzalloc(report_size, GFP_KERNEL);
+- ihid->rawbuf = kzalloc(report_size, GFP_KERNEL);
+- ihid->argsbuf = kzalloc(args_len, GFP_KERNEL);
+- ihid->cmdbuf = kzalloc(sizeof(union command) + args_len, GFP_KERNEL);
+-
+- if (!ihid->inbuf || !ihid->rawbuf || !ihid->argsbuf || !ihid->cmdbuf) {
+- i2c_hid_free_buffers(ihid);
+- return -ENOMEM;
+- }
+-
+- ihid->bufsize = report_size;
+-
+- return 0;
+-}
+-
+-static int i2c_hid_get_raw_report(struct hid_device *hid,
+- unsigned char report_number, __u8 *buf, size_t count,
+- unsigned char report_type)
+-{
+- struct i2c_client *client = hid->driver_data;
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- size_t ret_count, ask_count;
+- int ret;
+-
+- if (report_type == HID_OUTPUT_REPORT)
+- return -EINVAL;
+-
+- /* +2 bytes to include the size of the reply in the query buffer */
+- ask_count = min(count + 2, (size_t)ihid->bufsize);
+-
+- ret = i2c_hid_get_report(client,
+- report_type == HID_FEATURE_REPORT ? 0x03 : 0x01,
+- report_number, ihid->rawbuf, ask_count);
+-
+- if (ret < 0)
+- return ret;
+-
+- ret_count = ihid->rawbuf[0] | (ihid->rawbuf[1] << 8);
+-
+- if (ret_count <= 2)
+- return 0;
+-
+- ret_count = min(ret_count, ask_count);
+-
+- /* The query buffer contains the size, dropping it in the reply */
+- count = min(count, ret_count - 2);
+- memcpy(buf, ihid->rawbuf + 2, count);
+-
+- return count;
+-}
+-
+-static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf,
+- size_t count, unsigned char report_type, bool use_data)
+-{
+- struct i2c_client *client = hid->driver_data;
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- int report_id = buf[0];
+- int ret;
+-
+- if (report_type == HID_INPUT_REPORT)
+- return -EINVAL;
+-
+- mutex_lock(&ihid->reset_lock);
+-
+- if (report_id) {
+- buf++;
+- count--;
+- }
+-
+- ret = i2c_hid_set_or_send_report(client,
+- report_type == HID_FEATURE_REPORT ? 0x03 : 0x02,
+- report_id, buf, count, use_data);
+-
+- if (report_id && ret >= 0)
+- ret++; /* add report_id to the number of transfered bytes */
+-
+- mutex_unlock(&ihid->reset_lock);
+-
+- return ret;
+-}
+-
+-static int i2c_hid_output_report(struct hid_device *hid, __u8 *buf,
+- size_t count)
+-{
+- return i2c_hid_output_raw_report(hid, buf, count, HID_OUTPUT_REPORT,
+- false);
+-}
+-
+-static int i2c_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
+- __u8 *buf, size_t len, unsigned char rtype,
+- int reqtype)
+-{
+- switch (reqtype) {
+- case HID_REQ_GET_REPORT:
+- return i2c_hid_get_raw_report(hid, reportnum, buf, len, rtype);
+- case HID_REQ_SET_REPORT:
+- if (buf[0] != reportnum)
+- return -EINVAL;
+- return i2c_hid_output_raw_report(hid, buf, len, rtype, true);
+- default:
+- return -EIO;
+- }
+-}
+-
+-static int i2c_hid_parse(struct hid_device *hid)
+-{
+- struct i2c_client *client = hid->driver_data;
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- struct i2c_hid_desc *hdesc = &ihid->hdesc;
+- unsigned int rsize;
+- char *rdesc;
+- int ret;
+- int tries = 3;
+-
+- i2c_hid_dbg(ihid, "entering %s\n", __func__);
+-
+- rsize = le16_to_cpu(hdesc->wReportDescLength);
+- if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) {
+- dbg_hid("weird size of report descriptor (%u)\n", rsize);
+- return -EINVAL;
+- }
+-
+- do {
+- ret = i2c_hid_hwreset(client);
+- if (ret)
+- msleep(1000);
+- } while (tries-- > 0 && ret);
+-
+- if (ret)
+- return ret;
+-
+- rdesc = kzalloc(rsize, GFP_KERNEL);
+-
+- if (!rdesc) {
+- dbg_hid("couldn't allocate rdesc memory\n");
+- return -ENOMEM;
+- }
+-
+- i2c_hid_dbg(ihid, "asking HID report descriptor\n");
+-
+- ret = i2c_hid_command(client, &hid_report_descr_cmd, rdesc, rsize);
+- if (ret) {
+- hid_err(hid, "reading report descriptor failed\n");
+- kfree(rdesc);
+- return -EIO;
+- }
+-
+- i2c_hid_dbg(ihid, "Report Descriptor: %*ph\n", rsize, rdesc);
+-
+- ret = hid_parse_report(hid, rdesc, rsize);
+- kfree(rdesc);
+- if (ret) {
+- dbg_hid("parsing report descriptor failed\n");
+- return ret;
+- }
+-
+- return 0;
+-}
+-
+-static int i2c_hid_start(struct hid_device *hid)
+-{
+- struct i2c_client *client = hid->driver_data;
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- int ret;
+- unsigned int bufsize = HID_MIN_BUFFER_SIZE;
+-
+- i2c_hid_find_max_report(hid, HID_INPUT_REPORT, &bufsize);
+- i2c_hid_find_max_report(hid, HID_OUTPUT_REPORT, &bufsize);
+- i2c_hid_find_max_report(hid, HID_FEATURE_REPORT, &bufsize);
+-
+- if (bufsize > ihid->bufsize) {
+- disable_irq(client->irq);
+- i2c_hid_free_buffers(ihid);
+-
+- ret = i2c_hid_alloc_buffers(ihid, bufsize);
+- enable_irq(client->irq);
+-
+- if (ret)
+- return ret;
+- }
+-
+- return 0;
+-}
+-
+-static void i2c_hid_stop(struct hid_device *hid)
+-{
+- hid->claimed = 0;
+-}
+-
+-static int i2c_hid_open(struct hid_device *hid)
+-{
+- struct i2c_client *client = hid->driver_data;
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- int ret = 0;
+-
+- ret = pm_runtime_get_sync(&client->dev);
+- if (ret < 0)
+- return ret;
+-
+- set_bit(I2C_HID_STARTED, &ihid->flags);
+- return 0;
+-}
+-
+-static void i2c_hid_close(struct hid_device *hid)
+-{
+- struct i2c_client *client = hid->driver_data;
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+-
+- clear_bit(I2C_HID_STARTED, &ihid->flags);
+-
+- /* Save some power */
+- pm_runtime_put(&client->dev);
+-}
+-
+-static int i2c_hid_power(struct hid_device *hid, int lvl)
+-{
+- struct i2c_client *client = hid->driver_data;
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+-
+- i2c_hid_dbg(ihid, "%s lvl:%d\n", __func__, lvl);
+-
+- switch (lvl) {
+- case PM_HINT_FULLON:
+- pm_runtime_get_sync(&client->dev);
+- break;
+- case PM_HINT_NORMAL:
+- pm_runtime_put(&client->dev);
+- break;
+- }
+- return 0;
+-}
+-
+-struct hid_ll_driver i2c_hid_ll_driver = {
+- .parse = i2c_hid_parse,
+- .start = i2c_hid_start,
+- .stop = i2c_hid_stop,
+- .open = i2c_hid_open,
+- .close = i2c_hid_close,
+- .power = i2c_hid_power,
+- .output_report = i2c_hid_output_report,
+- .raw_request = i2c_hid_raw_request,
+-};
+-EXPORT_SYMBOL_GPL(i2c_hid_ll_driver);
+-
+-static int i2c_hid_init_irq(struct i2c_client *client)
+-{
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- unsigned long irqflags = 0;
+- int ret;
+-
+- dev_dbg(&client->dev, "Requesting IRQ: %d\n", client->irq);
+-
+- if (!irq_get_trigger_type(client->irq))
+- irqflags = IRQF_TRIGGER_LOW;
+-
+- ret = request_threaded_irq(client->irq, NULL, i2c_hid_irq,
+- irqflags | IRQF_ONESHOT, client->name, ihid);
+- if (ret < 0) {
+- dev_warn(&client->dev,
+- "Could not register for %s interrupt, irq = %d,"
+- " ret = %d\n",
+- client->name, client->irq, ret);
+-
+- return ret;
+- }
+-
+- return 0;
+-}
+-
+-static int i2c_hid_fetch_hid_descriptor(struct i2c_hid *ihid)
+-{
+- struct i2c_client *client = ihid->client;
+- struct i2c_hid_desc *hdesc = &ihid->hdesc;
+- unsigned int dsize;
+- int ret;
+-
+- /* i2c hid fetch using a fixed descriptor size (30 bytes) */
+- i2c_hid_dbg(ihid, "Fetching the HID descriptor\n");
+- ret = i2c_hid_command(client, &hid_descr_cmd, ihid->hdesc_buffer,
+- sizeof(struct i2c_hid_desc));
+- if (ret) {
+- dev_err(&client->dev, "hid_descr_cmd failed\n");
+- return -ENODEV;
+- }
+-
+- /* Validate the length of HID descriptor, the 4 first bytes:
+- * bytes 0-1 -> length
+- * bytes 2-3 -> bcdVersion (has to be 1.00) */
+- /* check bcdVersion == 1.0 */
+- if (le16_to_cpu(hdesc->bcdVersion) != 0x0100) {
+- dev_err(&client->dev,
+- "unexpected HID descriptor bcdVersion (0x%04hx)\n",
+- le16_to_cpu(hdesc->bcdVersion));
+- return -ENODEV;
+- }
+-
+- /* Descriptor length should be 30 bytes as per the specification */
+- dsize = le16_to_cpu(hdesc->wHIDDescLength);
+- if (dsize != sizeof(struct i2c_hid_desc)) {
+- dev_err(&client->dev, "weird size of HID descriptor (%u)\n",
+- dsize);
+- return -ENODEV;
+- }
+- i2c_hid_dbg(ihid, "HID Descriptor: %*ph\n", dsize, ihid->hdesc_buffer);
+- return 0;
+-}
+-
+-#ifdef CONFIG_ACPI
+-static const struct acpi_device_id i2c_hid_acpi_blacklist[] = {
+- /*
+- * The CHPN0001 ACPI device, which is used to describe the Chipone
+- * ICN8505 controller, has a _CID of PNP0C50 but is not HID compatible.
+- */
+- {"CHPN0001", 0 },
+- { },
+-};
+-
+-static int i2c_hid_acpi_pdata(struct i2c_client *client,
+- struct i2c_hid_platform_data *pdata)
+-{
+- static guid_t i2c_hid_guid =
+- GUID_INIT(0x3CDFF6F7, 0x4267, 0x4555,
+- 0xAD, 0x05, 0xB3, 0x0A, 0x3D, 0x89, 0x38, 0xDE);
+- union acpi_object *obj;
+- struct acpi_device *adev;
+- acpi_handle handle;
+-
+- handle = ACPI_HANDLE(&client->dev);
+- if (!handle || acpi_bus_get_device(handle, &adev)) {
+- dev_err(&client->dev, "Error could not get ACPI device\n");
+- return -ENODEV;
+- }
+-
+- if (acpi_match_device_ids(adev, i2c_hid_acpi_blacklist) == 0)
+- return -ENODEV;
+-
+- obj = acpi_evaluate_dsm_typed(handle, &i2c_hid_guid, 1, 1, NULL,
+- ACPI_TYPE_INTEGER);
+- if (!obj) {
+- dev_err(&client->dev, "Error _DSM call to get HID descriptor address failed\n");
+- return -ENODEV;
+- }
+-
+- pdata->hid_descriptor_address = obj->integer.value;
+- ACPI_FREE(obj);
+-
+- return 0;
+-}
+-
+-static void i2c_hid_acpi_fix_up_power(struct device *dev)
+-{
+- struct acpi_device *adev;
+-
+- adev = ACPI_COMPANION(dev);
+- if (adev)
+- acpi_device_fix_up_power(adev);
+-}
+-
+-static const struct acpi_device_id i2c_hid_acpi_match[] = {
+- {"ACPI0C50", 0 },
+- {"PNP0C50", 0 },
+- { },
+-};
+-MODULE_DEVICE_TABLE(acpi, i2c_hid_acpi_match);
+-#else
+-static inline int i2c_hid_acpi_pdata(struct i2c_client *client,
+- struct i2c_hid_platform_data *pdata)
+-{
+- return -ENODEV;
+-}
+-
+-static inline void i2c_hid_acpi_fix_up_power(struct device *dev) {}
+-#endif
+-
+-#ifdef CONFIG_OF
+-static int i2c_hid_of_probe(struct i2c_client *client,
+- struct i2c_hid_platform_data *pdata)
+-{
+- struct device *dev = &client->dev;
+- u32 val;
+- int ret;
+-
+- ret = of_property_read_u32(dev->of_node, "hid-descr-addr", &val);
+- if (ret) {
+- dev_err(&client->dev, "HID register address not provided\n");
+- return -ENODEV;
+- }
+- if (val >> 16) {
+- dev_err(&client->dev, "Bad HID register address: 0x%08x\n",
+- val);
+- return -EINVAL;
+- }
+- pdata->hid_descriptor_address = val;
+-
+- return 0;
+-}
+-
+-static const struct of_device_id i2c_hid_of_match[] = {
+- { .compatible = "hid-over-i2c" },
+- {},
+-};
+-MODULE_DEVICE_TABLE(of, i2c_hid_of_match);
+-#else
+-static inline int i2c_hid_of_probe(struct i2c_client *client,
+- struct i2c_hid_platform_data *pdata)
+-{
+- return -ENODEV;
+-}
+-#endif
+-
+-static void i2c_hid_fwnode_probe(struct i2c_client *client,
+- struct i2c_hid_platform_data *pdata)
+-{
+- u32 val;
+-
+- if (!device_property_read_u32(&client->dev, "post-power-on-delay-ms",
+- &val))
+- pdata->post_power_delay_ms = val;
+-}
+-
+-static int i2c_hid_probe(struct i2c_client *client,
+- const struct i2c_device_id *dev_id)
+-{
+- int ret;
+- struct i2c_hid *ihid;
+- struct hid_device *hid;
+- __u16 hidRegister;
+- struct i2c_hid_platform_data *platform_data = client->dev.platform_data;
+-
+- dbg_hid("HID probe called for i2c 0x%02x\n", client->addr);
+-
+- if (!client->irq) {
+- dev_err(&client->dev,
+- "HID over i2c has not been provided an Int IRQ\n");
+- return -EINVAL;
+- }
+-
+- if (client->irq < 0) {
+- if (client->irq != -EPROBE_DEFER)
+- dev_err(&client->dev,
+- "HID over i2c doesn't have a valid IRQ\n");
+- return client->irq;
+- }
+-
+- ihid = devm_kzalloc(&client->dev, sizeof(*ihid), GFP_KERNEL);
+- if (!ihid)
+- return -ENOMEM;
+-
+- if (client->dev.of_node) {
+- ret = i2c_hid_of_probe(client, &ihid->pdata);
+- if (ret)
+- return ret;
+- } else if (!platform_data) {
+- ret = i2c_hid_acpi_pdata(client, &ihid->pdata);
+- if (ret)
+- return ret;
+- } else {
+- ihid->pdata = *platform_data;
+- }
+-
+- /* Parse platform agnostic common properties from ACPI / device tree */
+- i2c_hid_fwnode_probe(client, &ihid->pdata);
+-
+- ihid->pdata.supplies[0].supply = "vdd";
+- ihid->pdata.supplies[1].supply = "vddl";
+-
+- ret = devm_regulator_bulk_get(&client->dev,
+- ARRAY_SIZE(ihid->pdata.supplies),
+- ihid->pdata.supplies);
+- if (ret)
+- return ret;
+-
+- ret = regulator_bulk_enable(ARRAY_SIZE(ihid->pdata.supplies),
+- ihid->pdata.supplies);
+- if (ret < 0)
+- return ret;
+-
+- if (ihid->pdata.post_power_delay_ms)
+- msleep(ihid->pdata.post_power_delay_ms);
+-
+- i2c_set_clientdata(client, ihid);
+-
+- ihid->client = client;
+-
+- hidRegister = ihid->pdata.hid_descriptor_address;
+- ihid->wHIDDescRegister = cpu_to_le16(hidRegister);
+-
+- init_waitqueue_head(&ihid->wait);
+- mutex_init(&ihid->reset_lock);
+-
+- /* we need to allocate the command buffer without knowing the maximum
+- * size of the reports. Let's use HID_MIN_BUFFER_SIZE, then we do the
+- * real computation later. */
+- ret = i2c_hid_alloc_buffers(ihid, HID_MIN_BUFFER_SIZE);
+- if (ret < 0)
+- goto err_regulator;
+-
+- i2c_hid_acpi_fix_up_power(&client->dev);
+-
+- pm_runtime_get_noresume(&client->dev);
+- pm_runtime_set_active(&client->dev);
+- pm_runtime_enable(&client->dev);
+- device_enable_async_suspend(&client->dev);
+-
+- /* Make sure there is something at this address */
+- ret = i2c_smbus_read_byte(client);
+- if (ret < 0) {
+- dev_dbg(&client->dev, "nothing at this address: %d\n", ret);
+- ret = -ENXIO;
+- goto err_pm;
+- }
+-
+- ret = i2c_hid_fetch_hid_descriptor(ihid);
+- if (ret < 0)
+- goto err_pm;
+-
+- ret = i2c_hid_init_irq(client);
+- if (ret < 0)
+- goto err_pm;
+-
+- hid = hid_allocate_device();
+- if (IS_ERR(hid)) {
+- ret = PTR_ERR(hid);
+- goto err_irq;
+- }
+-
+- ihid->hid = hid;
+-
+- hid->driver_data = client;
+- hid->ll_driver = &i2c_hid_ll_driver;
+- hid->dev.parent = &client->dev;
+- hid->bus = BUS_I2C;
+- hid->version = le16_to_cpu(ihid->hdesc.bcdVersion);
+- hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID);
+- hid->product = le16_to_cpu(ihid->hdesc.wProductID);
+-
+- snprintf(hid->name, sizeof(hid->name), "%s %04hX:%04hX",
+- client->name, hid->vendor, hid->product);
+- strlcpy(hid->phys, dev_name(&client->dev), sizeof(hid->phys));
+-
+- ihid->quirks = i2c_hid_lookup_quirk(hid->vendor, hid->product);
+-
+- ret = hid_add_device(hid);
+- if (ret) {
+- if (ret != -ENODEV)
+- hid_err(client, "can't add hid device: %d\n", ret);
+- goto err_mem_free;
+- }
+-
+- if (!(ihid->quirks & I2C_HID_QUIRK_NO_RUNTIME_PM))
+- pm_runtime_put(&client->dev);
+-
+- return 0;
+-
+-err_mem_free:
+- hid_destroy_device(hid);
+-
+-err_irq:
+- free_irq(client->irq, ihid);
+-
+-err_pm:
+- pm_runtime_put_noidle(&client->dev);
+- pm_runtime_disable(&client->dev);
+-
+-err_regulator:
+- regulator_bulk_disable(ARRAY_SIZE(ihid->pdata.supplies),
+- ihid->pdata.supplies);
+- i2c_hid_free_buffers(ihid);
+- return ret;
+-}
+-
+-static int i2c_hid_remove(struct i2c_client *client)
+-{
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- struct hid_device *hid;
+-
+- if (!(ihid->quirks & I2C_HID_QUIRK_NO_RUNTIME_PM))
+- pm_runtime_get_sync(&client->dev);
+- pm_runtime_disable(&client->dev);
+- pm_runtime_set_suspended(&client->dev);
+- pm_runtime_put_noidle(&client->dev);
+-
+- hid = ihid->hid;
+- hid_destroy_device(hid);
+-
+- free_irq(client->irq, ihid);
+-
+- if (ihid->bufsize)
+- i2c_hid_free_buffers(ihid);
+-
+- regulator_bulk_disable(ARRAY_SIZE(ihid->pdata.supplies),
+- ihid->pdata.supplies);
+-
+- return 0;
+-}
+-
+-static void i2c_hid_shutdown(struct i2c_client *client)
+-{
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+-
+- i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
+- free_irq(client->irq, ihid);
+-}
+-
+-#ifdef CONFIG_PM_SLEEP
+-static int i2c_hid_suspend(struct device *dev)
+-{
+- struct i2c_client *client = to_i2c_client(dev);
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- struct hid_device *hid = ihid->hid;
+- int ret;
+- int wake_status;
+-
+- if (hid->driver && hid->driver->suspend) {
+- /*
+- * Wake up the device so that IO issues in
+- * HID driver's suspend code can succeed.
+- */
+- ret = pm_runtime_resume(dev);
+- if (ret < 0)
+- return ret;
+-
+- ret = hid->driver->suspend(hid, PMSG_SUSPEND);
+- if (ret < 0)
+- return ret;
+- }
+-
+- if (!pm_runtime_suspended(dev)) {
+- /* Save some power */
+- i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
+-
+- disable_irq(client->irq);
+- }
+-
+- if (device_may_wakeup(&client->dev)) {
+- wake_status = enable_irq_wake(client->irq);
+- if (!wake_status)
+- ihid->irq_wake_enabled = true;
+- else
+- hid_warn(hid, "Failed to enable irq wake: %d\n",
+- wake_status);
+- } else {
+- regulator_bulk_disable(ARRAY_SIZE(ihid->pdata.supplies),
+- ihid->pdata.supplies);
+- }
+-
+- return 0;
+-}
+-
+-static int i2c_hid_resume(struct device *dev)
+-{
+- int ret;
+- struct i2c_client *client = to_i2c_client(dev);
+- struct i2c_hid *ihid = i2c_get_clientdata(client);
+- struct hid_device *hid = ihid->hid;
+- int wake_status;
+-
+- if (!device_may_wakeup(&client->dev)) {
+- ret = regulator_bulk_enable(ARRAY_SIZE(ihid->pdata.supplies),
+- ihid->pdata.supplies);
+- if (ret)
+- hid_warn(hid, "Failed to enable supplies: %d\n", ret);
+-
+- if (ihid->pdata.post_power_delay_ms)
+- msleep(ihid->pdata.post_power_delay_ms);
+- } else if (ihid->irq_wake_enabled) {
+- wake_status = disable_irq_wake(client->irq);
+- if (!wake_status)
+- ihid->irq_wake_enabled = false;
+- else
+- hid_warn(hid, "Failed to disable irq wake: %d\n",
+- wake_status);
+- }
+-
+- /* We'll resume to full power */
+- pm_runtime_disable(dev);
+- pm_runtime_set_active(dev);
+- pm_runtime_enable(dev);
+-
+- enable_irq(client->irq);
+-
+- /* Instead of resetting device, simply powers the device on. This
+- * solves "incomplete reports" on Raydium devices 2386:3118 and
+- * 2386:4B33 and fixes various SIS touchscreens no longer sending
+- * data after a suspend/resume.
+- */
+- ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
+- if (ret)
+- return ret;
+-
+- if (hid->driver && hid->driver->reset_resume) {
+- ret = hid->driver->reset_resume(hid);
+- return ret;
+- }
+-
+- return 0;
+-}
+-#endif
+-
+-#ifdef CONFIG_PM
+-static int i2c_hid_runtime_suspend(struct device *dev)
+-{
+- struct i2c_client *client = to_i2c_client(dev);
+-
+- i2c_hid_set_power(client, I2C_HID_PWR_SLEEP);
+- disable_irq(client->irq);
+- return 0;
+-}
+-
+-static int i2c_hid_runtime_resume(struct device *dev)
+-{
+- struct i2c_client *client = to_i2c_client(dev);
+-
+- enable_irq(client->irq);
+- i2c_hid_set_power(client, I2C_HID_PWR_ON);
+- return 0;
+-}
+-#endif
+-
+-static const struct dev_pm_ops i2c_hid_pm = {
+- SET_SYSTEM_SLEEP_PM_OPS(i2c_hid_suspend, i2c_hid_resume)
+- SET_RUNTIME_PM_OPS(i2c_hid_runtime_suspend, i2c_hid_runtime_resume,
+- NULL)
+-};
+-
+-static const struct i2c_device_id i2c_hid_id_table[] = {
+- { "hid", 0 },
+- { "hid-over-i2c", 0 },
+- { },
+-};
+-MODULE_DEVICE_TABLE(i2c, i2c_hid_id_table);
+-
+-
+-static struct i2c_driver i2c_hid_driver = {
+- .driver = {
+- .name = "i2c_hid",
+- .pm = &i2c_hid_pm,
+- .acpi_match_table = ACPI_PTR(i2c_hid_acpi_match),
+- .of_match_table = of_match_ptr(i2c_hid_of_match),
+- },
+-
+- .probe = i2c_hid_probe,
+- .remove = i2c_hid_remove,
+- .shutdown = i2c_hid_shutdown,
+- .id_table = i2c_hid_id_table,
+-};
+-
+-module_i2c_driver(i2c_hid_driver);
+-
+-MODULE_DESCRIPTION("HID over I2C core driver");
+-MODULE_AUTHOR("Benjamin Tissoires <benjamin.tissoires@gmail.com>");
+-MODULE_LICENSE("GPL");
+diff --git a/drivers/hid/i2c-hid/i2c-hid.h b/drivers/hid/i2c-hid/i2c-hid.h
+new file mode 100644
+index 000000000000..a8c19aef5824
+--- /dev/null
++++ b/drivers/hid/i2c-hid/i2c-hid.h
+@@ -0,0 +1,20 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++
++#ifndef I2C_HID_H
++#define I2C_HID_H
++
++
++#ifdef CONFIG_DMI
++struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name);
++char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name,
++ unsigned int *size);
++#else
++static inline struct i2c_hid_desc
++ *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name)
++{ return NULL; }
++static inline char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name,
++ unsigned int *size)
++{ return NULL; }
++#endif
++
++#endif
+diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c
+index 45b2460f3166..e8819d750938 100644
+--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c
++++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c
+@@ -668,6 +668,10 @@ static const struct amba_id debug_ids[] = {
+ .id = 0x000bbd08,
+ .mask = 0x000fffff,
+ },
++ { /* Debug for Cortex-A73 */
++ .id = 0x000bbd09,
++ .mask = 0x000fffff,
++ },
+ { 0, 0 },
+ };
+
+diff --git a/drivers/infiniband/hw/hfi1/qp.c b/drivers/infiniband/hw/hfi1/qp.c
+index 9b1e84a6b1cc..63c5ba66b305 100644
+--- a/drivers/infiniband/hw/hfi1/qp.c
++++ b/drivers/infiniband/hw/hfi1/qp.c
+@@ -784,7 +784,7 @@ void notify_error_qp(struct rvt_qp *qp)
+ write_seqlock(lock);
+ if (!list_empty(&priv->s_iowait.list) &&
+ !(qp->s_flags & RVT_S_BUSY)) {
+- qp->s_flags &= ~RVT_S_ANY_WAIT_IO;
++ qp->s_flags &= ~HFI1_S_ANY_WAIT_IO;
+ list_del_init(&priv->s_iowait.list);
+ priv->s_iowait.lock = NULL;
+ rvt_put_qp(qp);
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
+index a9ea966877f2..dda8e79d4b27 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
+@@ -173,7 +173,12 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
+
+ rcu_read_lock();
+ in = __in_dev_get_rcu(upper_dev);
+- local_ipaddr = ntohl(in->ifa_list->ifa_address);
++
++ if (!in->ifa_list)
++ local_ipaddr = 0;
++ else
++ local_ipaddr = ntohl(in->ifa_list->ifa_address);
++
+ rcu_read_unlock();
+ } else {
+ local_ipaddr = ntohl(ifa->ifa_address);
+@@ -185,6 +190,11 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
+ case NETDEV_UP:
+ /* Fall through */
+ case NETDEV_CHANGEADDR:
++
++ /* Just skip if no need to handle ARP cache */
++ if (!local_ipaddr)
++ break;
++
+ i40iw_manage_arp_cache(iwdev,
+ netdev->dev_addr,
+ &local_ipaddr,
+diff --git a/drivers/infiniband/hw/mlx4/alias_GUID.c b/drivers/infiniband/hw/mlx4/alias_GUID.c
+index 155b4dfc0ae8..baab9afa9174 100644
+--- a/drivers/infiniband/hw/mlx4/alias_GUID.c
++++ b/drivers/infiniband/hw/mlx4/alias_GUID.c
+@@ -804,8 +804,8 @@ void mlx4_ib_destroy_alias_guid_service(struct mlx4_ib_dev *dev)
+ unsigned long flags;
+
+ for (i = 0 ; i < dev->num_ports; i++) {
+- cancel_delayed_work(&dev->sriov.alias_guid.ports_guid[i].alias_guid_work);
+ det = &sriov->alias_guid.ports_guid[i];
++ cancel_delayed_work_sync(&det->alias_guid_work);
+ spin_lock_irqsave(&sriov->alias_guid.ag_work_lock, flags);
+ while (!list_empty(&det->cb_list)) {
+ cb_ctx = list_entry(det->cb_list.next,
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index d9c748b6f9e4..7f9824b0609e 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -144,7 +144,7 @@ dmar_alloc_pci_notify_info(struct pci_dev *dev, unsigned long event)
+ for (tmp = dev; tmp; tmp = tmp->bus->self)
+ level++;
+
+- size = sizeof(*info) + level * sizeof(struct acpi_dmar_pci_path);
++ size = sizeof(*info) + level * sizeof(info->path[0]);
+ if (size <= sizeof(dmar_pci_notify_info_buf)) {
+ info = (struct dmar_pci_notify_info *)dmar_pci_notify_info_buf;
+ } else {
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 2b8f5ebae821..603bf5233a99 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1624,6 +1624,9 @@ static void iommu_disable_protect_mem_regions(struct intel_iommu *iommu)
+ u32 pmen;
+ unsigned long flags;
+
++ if (!cap_plmr(iommu->cap) && !cap_phmr(iommu->cap))
++ return;
++
+ raw_spin_lock_irqsave(&iommu->register_lock, flags);
+ pmen = readl(iommu->reg + DMAR_PMEN_REG);
+ pmen &= ~DMA_PMEN_EPM;
+diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
+index 567b29c47608..98b6e1d4b1a6 100644
+--- a/drivers/irqchip/irq-mbigen.c
++++ b/drivers/irqchip/irq-mbigen.c
+@@ -161,6 +161,9 @@ static void mbigen_write_msg(struct msi_desc *desc, struct msi_msg *msg)
+ void __iomem *base = d->chip_data;
+ u32 val;
+
++ if (!msg->address_lo && !msg->address_hi)
++ return;
++
+ base += get_mbigen_vec_reg(d->hwirq);
+ val = readl_relaxed(base);
+
+diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
+index 0a2088e12d96..97b27f338c30 100644
+--- a/drivers/irqchip/irq-stm32-exti.c
++++ b/drivers/irqchip/irq-stm32-exti.c
+@@ -650,11 +650,6 @@ stm32_exti_chip_data *stm32_exti_chip_init(struct stm32_exti_host_data *h_data,
+ */
+ writel_relaxed(0, base + stm32_bank->imr_ofst);
+ writel_relaxed(0, base + stm32_bank->emr_ofst);
+- writel_relaxed(0, base + stm32_bank->rtsr_ofst);
+- writel_relaxed(0, base + stm32_bank->ftsr_ofst);
+- writel_relaxed(~0UL, base + stm32_bank->rpr_ofst);
+- if (stm32_bank->fpr_ofst != UNDEF_REG)
+- writel_relaxed(~0UL, base + stm32_bank->fpr_ofst);
+
+ pr_info("%s: bank%d, External IRQs available:%#x\n",
+ node->full_name, bank_idx, irqs_mask);
+diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
+index cd363a2100d4..257ae0d8cfe2 100644
+--- a/drivers/media/usb/au0828/au0828-core.c
++++ b/drivers/media/usb/au0828/au0828-core.c
+@@ -629,7 +629,6 @@ static int au0828_usb_probe(struct usb_interface *interface,
+ pr_err("%s() au0282_dev_register failed to register on V4L2\n",
+ __func__);
+ mutex_unlock(&dev->lock);
+- kfree(dev);
+ goto done;
+ }
+
+diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c
+index 2154d1bfd18b..07caaa2cfe1e 100644
+--- a/drivers/misc/lkdtm/core.c
++++ b/drivers/misc/lkdtm/core.c
+@@ -152,7 +152,9 @@ static const struct crashtype crashtypes[] = {
+ CRASHTYPE(EXEC_VMALLOC),
+ CRASHTYPE(EXEC_RODATA),
+ CRASHTYPE(EXEC_USERSPACE),
++ CRASHTYPE(EXEC_NULL),
+ CRASHTYPE(ACCESS_USERSPACE),
++ CRASHTYPE(ACCESS_NULL),
+ CRASHTYPE(WRITE_RO),
+ CRASHTYPE(WRITE_RO_AFTER_INIT),
+ CRASHTYPE(WRITE_KERN),
+diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h
+index 9e513dcfd809..8c3f2e6af256 100644
+--- a/drivers/misc/lkdtm/lkdtm.h
++++ b/drivers/misc/lkdtm/lkdtm.h
+@@ -45,7 +45,9 @@ void lkdtm_EXEC_KMALLOC(void);
+ void lkdtm_EXEC_VMALLOC(void);
+ void lkdtm_EXEC_RODATA(void);
+ void lkdtm_EXEC_USERSPACE(void);
++void lkdtm_EXEC_NULL(void);
+ void lkdtm_ACCESS_USERSPACE(void);
++void lkdtm_ACCESS_NULL(void);
+
+ /* lkdtm_refcount.c */
+ void lkdtm_REFCOUNT_INC_OVERFLOW(void);
+diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c
+index 53b85c9d16b8..62f76d506f04 100644
+--- a/drivers/misc/lkdtm/perms.c
++++ b/drivers/misc/lkdtm/perms.c
+@@ -47,7 +47,7 @@ static noinline void execute_location(void *dst, bool write)
+ {
+ void (*func)(void) = dst;
+
+- pr_info("attempting ok execution at %p\n", do_nothing);
++ pr_info("attempting ok execution at %px\n", do_nothing);
+ do_nothing();
+
+ if (write == CODE_WRITE) {
+@@ -55,7 +55,7 @@ static noinline void execute_location(void *dst, bool write)
+ flush_icache_range((unsigned long)dst,
+ (unsigned long)dst + EXEC_SIZE);
+ }
+- pr_info("attempting bad execution at %p\n", func);
++ pr_info("attempting bad execution at %px\n", func);
+ func();
+ }
+
+@@ -66,14 +66,14 @@ static void execute_user_location(void *dst)
+ /* Intentionally crossing kernel/user memory boundary. */
+ void (*func)(void) = dst;
+
+- pr_info("attempting ok execution at %p\n", do_nothing);
++ pr_info("attempting ok execution at %px\n", do_nothing);
+ do_nothing();
+
+ copied = access_process_vm(current, (unsigned long)dst, do_nothing,
+ EXEC_SIZE, FOLL_WRITE);
+ if (copied < EXEC_SIZE)
+ return;
+- pr_info("attempting bad execution at %p\n", func);
++ pr_info("attempting bad execution at %px\n", func);
+ func();
+ }
+
+@@ -82,7 +82,7 @@ void lkdtm_WRITE_RO(void)
+ /* Explicitly cast away "const" for the test. */
+ unsigned long *ptr = (unsigned long *)&rodata;
+
+- pr_info("attempting bad rodata write at %p\n", ptr);
++ pr_info("attempting bad rodata write at %px\n", ptr);
+ *ptr ^= 0xabcd1234;
+ }
+
+@@ -100,7 +100,7 @@ void lkdtm_WRITE_RO_AFTER_INIT(void)
+ return;
+ }
+
+- pr_info("attempting bad ro_after_init write at %p\n", ptr);
++ pr_info("attempting bad ro_after_init write at %px\n", ptr);
+ *ptr ^= 0xabcd1234;
+ }
+
+@@ -112,7 +112,7 @@ void lkdtm_WRITE_KERN(void)
+ size = (unsigned long)do_overwritten - (unsigned long)do_nothing;
+ ptr = (unsigned char *)do_overwritten;
+
+- pr_info("attempting bad %zu byte write at %p\n", size, ptr);
++ pr_info("attempting bad %zu byte write at %px\n", size, ptr);
+ memcpy(ptr, (unsigned char *)do_nothing, size);
+ flush_icache_range((unsigned long)ptr, (unsigned long)(ptr + size));
+
+@@ -164,6 +164,11 @@ void lkdtm_EXEC_USERSPACE(void)
+ vm_munmap(user_addr, PAGE_SIZE);
+ }
+
++void lkdtm_EXEC_NULL(void)
++{
++ execute_location(NULL, CODE_AS_IS);
++}
++
+ void lkdtm_ACCESS_USERSPACE(void)
+ {
+ unsigned long user_addr, tmp = 0;
+@@ -185,16 +190,29 @@ void lkdtm_ACCESS_USERSPACE(void)
+
+ ptr = (unsigned long *)user_addr;
+
+- pr_info("attempting bad read at %p\n", ptr);
++ pr_info("attempting bad read at %px\n", ptr);
+ tmp = *ptr;
+ tmp += 0xc0dec0de;
+
+- pr_info("attempting bad write at %p\n", ptr);
++ pr_info("attempting bad write at %px\n", ptr);
+ *ptr = tmp;
+
+ vm_munmap(user_addr, PAGE_SIZE);
+ }
+
++void lkdtm_ACCESS_NULL(void)
++{
++ unsigned long tmp;
++ unsigned long *ptr = (unsigned long *)NULL;
++
++ pr_info("attempting bad read at %px\n", ptr);
++ tmp = *ptr;
++ tmp += 0xc0dec0de;
++
++ pr_info("attempting bad write at %px\n", ptr);
++ *ptr = tmp;
++}
++
+ void __init lkdtm_perms_init(void)
+ {
+ /* Make sure we can write to __ro_after_init values during __init */
+diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c
+index 9e68c3645e22..e6f14257a7d0 100644
+--- a/drivers/mmc/host/davinci_mmc.c
++++ b/drivers/mmc/host/davinci_mmc.c
+@@ -1117,7 +1117,7 @@ static inline void mmc_davinci_cpufreq_deregister(struct mmc_davinci_host *host)
+ {
+ }
+ #endif
+-static void __init init_mmcsd_host(struct mmc_davinci_host *host)
++static void init_mmcsd_host(struct mmc_davinci_host *host)
+ {
+
+ mmc_davinci_reset_ctrl(host, 1);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+index afed0f0f4027..c0c75c111abb 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
++++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+@@ -59,7 +59,7 @@ static int jumbo_frm(void *p, struct sk_buff *skb, int csum)
+
+ desc->des3 = cpu_to_le32(des2 + BUF_SIZE_4KiB);
+ stmmac_prepare_tx_desc(priv, desc, 1, bmax, csum,
+- STMMAC_RING_MODE, 0, false, skb->len);
++ STMMAC_RING_MODE, 1, false, skb->len);
+ tx_q->tx_skbuff[entry] = NULL;
+ entry = STMMAC_GET_ENTRY(entry, DMA_TX_SIZE);
+
+@@ -91,7 +91,7 @@ static int jumbo_frm(void *p, struct sk_buff *skb, int csum)
+ tx_q->tx_skbuff_dma[entry].is_jumbo = true;
+ desc->des3 = cpu_to_le32(des2 + BUF_SIZE_4KiB);
+ stmmac_prepare_tx_desc(priv, desc, 1, nopaged_len, csum,
+- STMMAC_RING_MODE, 0, true, skb->len);
++ STMMAC_RING_MODE, 1, true, skb->len);
+ }
+
+ tx_q->cur_tx = entry;
+diff --git a/drivers/net/wireless/rsi/rsi_common.h b/drivers/net/wireless/rsi/rsi_common.h
+index d9ff3b8be86e..60f1f286b030 100644
+--- a/drivers/net/wireless/rsi/rsi_common.h
++++ b/drivers/net/wireless/rsi/rsi_common.h
+@@ -75,7 +75,6 @@ static inline int rsi_kill_thread(struct rsi_thread *handle)
+ atomic_inc(&handle->thread_done);
+ rsi_set_event(&handle->event);
+
+- wait_for_completion(&handle->completion);
+ return kthread_stop(handle->task);
+ }
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 7eb1549cea81..30649addc625 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2489,6 +2489,25 @@ void pci_config_pm_runtime_put(struct pci_dev *pdev)
+ pm_runtime_put_sync(parent);
+ }
+
++static const struct dmi_system_id bridge_d3_blacklist[] = {
++#ifdef CONFIG_X86
++ {
++ /*
++ * Gigabyte X299 root port is not marked as hotplug capable
++ * which allows Linux to power manage it. However, this
++ * confuses the BIOS SMI handler so don't power manage root
++ * ports on that system.
++ */
++ .ident = "X299 DESIGNARE EX-CF",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co., Ltd."),
++ DMI_MATCH(DMI_BOARD_NAME, "X299 DESIGNARE EX-CF"),
++ },
++ },
++#endif
++ { }
++};
++
+ /**
+ * pci_bridge_d3_possible - Is it possible to put the bridge into D3
+ * @bridge: Bridge to check
+@@ -2530,6 +2549,9 @@ bool pci_bridge_d3_possible(struct pci_dev *bridge)
+ if (bridge->is_hotplug_bridge)
+ return false;
+
++ if (dmi_check_system(bridge_d3_blacklist))
++ return false;
++
+ /*
+ * It should be safe to put PCIe ports from 2015 or newer
+ * to D3.
+diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
+index a3dd777e3ce8..c6ff4d5fa482 100644
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -627,7 +627,7 @@ static int pinctrl_generic_group_name_to_selector(struct pinctrl_dev *pctldev,
+ while (selector < ngroups) {
+ const char *gname = ops->get_group_name(pctldev, selector);
+
+- if (!strcmp(function, gname))
++ if (gname && !strcmp(function, gname))
+ return selector;
+
+ selector++;
+@@ -743,7 +743,7 @@ int pinctrl_get_group_selector(struct pinctrl_dev *pctldev,
+ while (group_selector < ngroups) {
+ const char *gname = pctlops->get_group_name(pctldev,
+ group_selector);
+- if (!strcmp(gname, pin_group)) {
++ if (gname && !strcmp(gname, pin_group)) {
+ dev_dbg(pctldev->dev,
+ "found group selector %u for %s\n",
+ group_selector,
+diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
+index 7563c07e14e4..1e2524de6a63 100644
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -1231,6 +1231,18 @@ config I2C_MULTI_INSTANTIATE
+ To compile this driver as a module, choose M here: the module
+ will be called i2c-multi-instantiate.
+
++config INTEL_ATOMISP2_PM
++ tristate "Intel AtomISP2 dummy / power-management driver"
++ depends on PCI && IOSF_MBI && PM
++ help
++ Power-management driver for Intel's Image Signal Processor found on
++ Bay and Cherry Trail devices. This dummy driver's sole purpose is to
++ turn the ISP off (put it in D3) to save power and to allow entering
++ of S0ix modes.
++
++ To compile this driver as a module, choose M here: the module
++ will be called intel_atomisp2_pm.
++
+ endif # X86_PLATFORM_DEVICES
+
+ config PMC_ATOM
+diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
+index e6d1becf81ce..dc29af4d8e2f 100644
+--- a/drivers/platform/x86/Makefile
++++ b/drivers/platform/x86/Makefile
+@@ -92,3 +92,4 @@ obj-$(CONFIG_MLX_PLATFORM) += mlx-platform.o
+ obj-$(CONFIG_INTEL_TURBO_MAX_3) += intel_turbo_max_3.o
+ obj-$(CONFIG_INTEL_CHTDC_TI_PWRBTN) += intel_chtdc_ti_pwrbtn.o
+ obj-$(CONFIG_I2C_MULTI_INSTANTIATE) += i2c-multi-instantiate.o
++obj-$(CONFIG_INTEL_ATOMISP2_PM) += intel_atomisp2_pm.o
+diff --git a/drivers/platform/x86/intel_atomisp2_pm.c b/drivers/platform/x86/intel_atomisp2_pm.c
+new file mode 100644
+index 000000000000..9371603a0ac9
+--- /dev/null
++++ b/drivers/platform/x86/intel_atomisp2_pm.c
+@@ -0,0 +1,119 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Dummy driver for Intel's Image Signal Processor found on Bay and Cherry
++ * Trail devices. The sole purpose of this driver is to allow the ISP to
++ * be put in D3.
++ *
++ * Copyright (C) 2018 Hans de Goede <hdegoede@redhat.com>
++ *
++ * Based on various non upstream patches for ISP support:
++ * Copyright (C) 2010-2017 Intel Corporation. All rights reserved.
++ * Copyright (c) 2010 Silicon Hive www.siliconhive.com.
++ */
++
++#include <linux/delay.h>
++#include <linux/module.h>
++#include <linux/mod_devicetable.h>
++#include <linux/pci.h>
++#include <linux/pm_runtime.h>
++#include <asm/iosf_mbi.h>
++
++/* PCI configuration regs */
++#define PCI_INTERRUPT_CTRL 0x9c
++
++#define PCI_CSI_CONTROL 0xe8
++#define PCI_CSI_CONTROL_PORTS_OFF_MASK 0x7
++
++/* IOSF BT_MBI_UNIT_PMC regs */
++#define ISPSSPM0 0x39
++#define ISPSSPM0_ISPSSC_OFFSET 0
++#define ISPSSPM0_ISPSSC_MASK 0x00000003
++#define ISPSSPM0_ISPSSS_OFFSET 24
++#define ISPSSPM0_ISPSSS_MASK 0x03000000
++#define ISPSSPM0_IUNIT_POWER_ON 0x0
++#define ISPSSPM0_IUNIT_POWER_OFF 0x3
++
++static int isp_probe(struct pci_dev *dev, const struct pci_device_id *id)
++{
++ unsigned long timeout;
++ u32 val;
++
++ pci_write_config_dword(dev, PCI_INTERRUPT_CTRL, 0);
++
++ /*
++ * MRFLD IUNIT DPHY is located in an always-power-on island
++ * MRFLD HW design need all CSI ports are disabled before
++ * powering down the IUNIT.
++ */
++ pci_read_config_dword(dev, PCI_CSI_CONTROL, &val);
++ val |= PCI_CSI_CONTROL_PORTS_OFF_MASK;
++ pci_write_config_dword(dev, PCI_CSI_CONTROL, val);
++
++ /* Write 0x3 to ISPSSPM0 bit[1:0] to power off the IUNIT */
++ iosf_mbi_modify(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0,
++ ISPSSPM0_IUNIT_POWER_OFF, ISPSSPM0_ISPSSC_MASK);
++
++ /*
++ * There should be no IUNIT access while power-down is
++ * in progress HW sighting: 4567865
++ * Wait up to 50 ms for the IUNIT to shut down.
++ */
++ timeout = jiffies + msecs_to_jiffies(50);
++ while (1) {
++ /* Wait until ISPSSPM0 bit[25:24] shows 0x3 */
++ iosf_mbi_read(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0, &val);
++ val = (val & ISPSSPM0_ISPSSS_MASK) >> ISPSSPM0_ISPSSS_OFFSET;
++ if (val == ISPSSPM0_IUNIT_POWER_OFF)
++ break;
++
++ if (time_after(jiffies, timeout)) {
++ dev_err(&dev->dev, "IUNIT power-off timeout.\n");
++ return -EBUSY;
++ }
++ usleep_range(1000, 2000);
++ }
++
++ pm_runtime_allow(&dev->dev);
++ pm_runtime_put_sync_suspend(&dev->dev);
++
++ return 0;
++}
++
++static void isp_remove(struct pci_dev *dev)
++{
++ pm_runtime_get_sync(&dev->dev);
++ pm_runtime_forbid(&dev->dev);
++}
++
++static int isp_pci_suspend(struct device *dev)
++{
++ return 0;
++}
++
++static int isp_pci_resume(struct device *dev)
++{
++ return 0;
++}
++
++static UNIVERSAL_DEV_PM_OPS(isp_pm_ops, isp_pci_suspend,
++ isp_pci_resume, NULL);
++
++static const struct pci_device_id isp_id_table[] = {
++ { PCI_VDEVICE(INTEL, 0x22b8), },
++ { 0, }
++};
++MODULE_DEVICE_TABLE(pci, isp_id_table);
++
++static struct pci_driver isp_pci_driver = {
++ .name = "intel_atomisp2_pm",
++ .id_table = isp_id_table,
++ .probe = isp_probe,
++ .remove = isp_remove,
++ .driver.pm = &isp_pm_ops,
++};
++
++module_pci_driver(isp_pci_driver);
++
++MODULE_DESCRIPTION("Intel AtomISP2 dummy / power-management drv (for suspend)");
++MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
++MODULE_LICENSE("GPL v2");
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 18e4289baf99..655790f30434 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -3095,7 +3095,6 @@ void scsi_device_resume(struct scsi_device *sdev)
+ * device deleted during suspend)
+ */
+ mutex_lock(&sdev->state_mutex);
+- WARN_ON_ONCE(!sdev->quiesced_by);
+ sdev->quiesced_by = NULL;
+ blk_clear_preempt_only(sdev->request_queue);
+ if (sdev->sdev_state == SDEV_QUIESCE)
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 6fd2fe210fc3..4d0fc6b01fa0 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2185,6 +2185,8 @@ void iscsi_remove_session(struct iscsi_cls_session *session)
+ scsi_target_unblock(&session->dev, SDEV_TRANSPORT_OFFLINE);
+ /* flush running scans then delete devices */
+ flush_work(&session->scan_work);
++ /* flush running unbind operations */
++ flush_work(&session->unbind_work);
+ __iscsi_unbind_session(&session->unbind_work);
+
+ /* hw iscsi may not have removed all connections from session */
+diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
+index ed71a4c9c8b2..4b452f36f054 100644
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -524,16 +524,10 @@ EXPORT_SYMBOL(tegra_powergate_power_off);
+ */
+ int tegra_powergate_is_powered(unsigned int id)
+ {
+- int status;
+-
+ if (!tegra_powergate_is_valid(id))
+ return -EINVAL;
+
+- mutex_lock(&pmc->powergates_lock);
+- status = tegra_powergate_state(id);
+- mutex_unlock(&pmc->powergates_lock);
+-
+- return status;
++ return tegra_powergate_state(id);
+ }
+
+ /**
+diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c
+index 24b006a95142..8646fb7425f2 100644
+--- a/drivers/thermal/broadcom/bcm2835_thermal.c
++++ b/drivers/thermal/broadcom/bcm2835_thermal.c
+@@ -128,8 +128,7 @@ static const struct debugfs_reg32 bcm2835_thermal_regs[] = {
+
+ static void bcm2835_thermal_debugfs(struct platform_device *pdev)
+ {
+- struct thermal_zone_device *tz = platform_get_drvdata(pdev);
+- struct bcm2835_thermal_data *data = tz->devdata;
++ struct bcm2835_thermal_data *data = platform_get_drvdata(pdev);
+ struct debugfs_regset32 *regset;
+
+ data->debugfsdir = debugfs_create_dir("bcm2835_thermal", NULL);
+@@ -275,7 +274,7 @@ static int bcm2835_thermal_probe(struct platform_device *pdev)
+
+ data->tz = tz;
+
+- platform_set_drvdata(pdev, tz);
++ platform_set_drvdata(pdev, data);
+
+ /*
+ * Thermal_zone doesn't enable hwmon as default,
+@@ -299,8 +298,8 @@ err_clk:
+
+ static int bcm2835_thermal_remove(struct platform_device *pdev)
+ {
+- struct thermal_zone_device *tz = platform_get_drvdata(pdev);
+- struct bcm2835_thermal_data *data = tz->devdata;
++ struct bcm2835_thermal_data *data = platform_get_drvdata(pdev);
++ struct thermal_zone_device *tz = data->tz;
+
+ debugfs_remove_recursive(data->debugfsdir);
+ thermal_zone_of_sensor_unregister(&pdev->dev, tz);
+diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c
+index e26b01c05e82..e9d58de8b5da 100644
+--- a/drivers/thermal/int340x_thermal/int3400_thermal.c
++++ b/drivers/thermal/int340x_thermal/int3400_thermal.c
+@@ -22,6 +22,13 @@ enum int3400_thermal_uuid {
+ INT3400_THERMAL_PASSIVE_1,
+ INT3400_THERMAL_ACTIVE,
+ INT3400_THERMAL_CRITICAL,
++ INT3400_THERMAL_ADAPTIVE_PERFORMANCE,
++ INT3400_THERMAL_EMERGENCY_CALL_MODE,
++ INT3400_THERMAL_PASSIVE_2,
++ INT3400_THERMAL_POWER_BOSS,
++ INT3400_THERMAL_VIRTUAL_SENSOR,
++ INT3400_THERMAL_COOLING_MODE,
++ INT3400_THERMAL_HARDWARE_DUTY_CYCLING,
+ INT3400_THERMAL_MAXIMUM_UUID,
+ };
+
+@@ -29,6 +36,13 @@ static char *int3400_thermal_uuids[INT3400_THERMAL_MAXIMUM_UUID] = {
+ "42A441D6-AE6A-462b-A84B-4A8CE79027D3",
+ "3A95C389-E4B8-4629-A526-C52C88626BAE",
+ "97C68AE7-15FA-499c-B8C9-5DA81D606E0A",
++ "63BE270F-1C11-48FD-A6F7-3AF253FF3E2D",
++ "5349962F-71E6-431D-9AE8-0A635B710AEE",
++ "9E04115A-AE87-4D1C-9500-0F3E340BFE75",
++ "F5A35014-C209-46A4-993A-EB56DE7530A1",
++ "6ED722A7-9240-48A5-B479-31EEF723D7CF",
++ "16CAF1B7-DD38-40ED-B1C1-1B8A1913D531",
++ "BE84BABF-C4D4-403D-B495-3128FD44dAC1",
+ };
+
+ struct int3400_thermal_priv {
+@@ -302,10 +316,9 @@ static int int3400_thermal_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, priv);
+
+- if (priv->uuid_bitmap & 1 << INT3400_THERMAL_PASSIVE_1) {
+- int3400_thermal_ops.get_mode = int3400_thermal_get_mode;
+- int3400_thermal_ops.set_mode = int3400_thermal_set_mode;
+- }
++ int3400_thermal_ops.get_mode = int3400_thermal_get_mode;
++ int3400_thermal_ops.set_mode = int3400_thermal_set_mode;
++
+ priv->thermal = thermal_zone_device_register("INT3400 Thermal", 0, 0,
+ priv, &int3400_thermal_ops,
+ &int3400_thermal_params, 0, 0);
+diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
+index cde891c54cde..8e8328347c0e 100644
+--- a/drivers/thermal/intel_powerclamp.c
++++ b/drivers/thermal/intel_powerclamp.c
+@@ -101,7 +101,7 @@ struct powerclamp_worker_data {
+ bool clamping;
+ };
+
+-static struct powerclamp_worker_data * __percpu worker_data;
++static struct powerclamp_worker_data __percpu *worker_data;
+ static struct thermal_cooling_device *cooling_dev;
+ static unsigned long *cpu_clamping_mask; /* bit map for tracking per cpu
+ * clamping kthread worker
+@@ -494,7 +494,7 @@ static void start_power_clamp_worker(unsigned long cpu)
+ struct powerclamp_worker_data *w_data = per_cpu_ptr(worker_data, cpu);
+ struct kthread_worker *worker;
+
+- worker = kthread_create_worker_on_cpu(cpu, 0, "kidle_inject/%ld", cpu);
++ worker = kthread_create_worker_on_cpu(cpu, 0, "kidle_inj/%ld", cpu);
+ if (IS_ERR(worker))
+ return;
+
+diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
+index 48eef552cba4..fc9399d9c082 100644
+--- a/drivers/thermal/samsung/exynos_tmu.c
++++ b/drivers/thermal/samsung/exynos_tmu.c
+@@ -666,7 +666,7 @@ static int exynos_get_temp(void *p, int *temp)
+ struct exynos_tmu_data *data = p;
+ int value, ret = 0;
+
+- if (!data || !data->tmu_read || !data->enabled)
++ if (!data || !data->tmu_read)
+ return -EINVAL;
+ else if (!data->enabled)
+ /*
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index 0e3627289047..77efa0a43fe7 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1223,7 +1223,7 @@ static void cdns_uart_console_write(struct console *co, const char *s,
+ *
+ * Return: 0 on success, negative errno otherwise.
+ */
+-static int __init cdns_uart_console_setup(struct console *co, char *options)
++static int cdns_uart_console_setup(struct console *co, char *options)
+ {
+ struct uart_port *port = console_port;
+
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index 89bac3d2f05b..619128b55837 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -61,6 +61,8 @@ enum {
+ Opt_cache_loose, Opt_fscache, Opt_mmap,
+ /* Access options */
+ Opt_access, Opt_posixacl,
++ /* Lock timeout option */
++ Opt_locktimeout,
+ /* Error token */
+ Opt_err
+ };
+@@ -80,6 +82,7 @@ static const match_table_t tokens = {
+ {Opt_cachetag, "cachetag=%s"},
+ {Opt_access, "access=%s"},
+ {Opt_posixacl, "posixacl"},
++ {Opt_locktimeout, "locktimeout=%u"},
+ {Opt_err, NULL}
+ };
+
+@@ -187,6 +190,7 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
+ #ifdef CONFIG_9P_FSCACHE
+ v9ses->cachetag = NULL;
+ #endif
++ v9ses->session_lock_timeout = P9_LOCK_TIMEOUT;
+
+ if (!opts)
+ return 0;
+@@ -359,6 +363,23 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
+ #endif
+ break;
+
++ case Opt_locktimeout:
++ r = match_int(&args[0], &option);
++ if (r < 0) {
++ p9_debug(P9_DEBUG_ERROR,
++ "integer field, but no integer?\n");
++ ret = r;
++ continue;
++ }
++ if (option < 1) {
++ p9_debug(P9_DEBUG_ERROR,
++ "locktimeout must be a greater than zero integer.\n");
++ ret = -EINVAL;
++ continue;
++ }
++ v9ses->session_lock_timeout = (long)option * HZ;
++ break;
++
+ default:
+ continue;
+ }
+diff --git a/fs/9p/v9fs.h b/fs/9p/v9fs.h
+index 982e017acadb..129e5243a6bf 100644
+--- a/fs/9p/v9fs.h
++++ b/fs/9p/v9fs.h
+@@ -116,6 +116,7 @@ struct v9fs_session_info {
+ struct p9_client *clnt; /* 9p client */
+ struct list_head slist; /* list of sessions registered with v9fs */
+ struct rw_semaphore rename_sem;
++ long session_lock_timeout; /* retry interval for blocking locks */
+ };
+
+ /* cache_validity flags */
+diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
+index 48db9a9f13f9..cb6c4031af55 100644
+--- a/fs/9p/vfs_dir.c
++++ b/fs/9p/vfs_dir.c
+@@ -105,7 +105,6 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
+ int err = 0;
+ struct p9_fid *fid;
+ int buflen;
+- int reclen = 0;
+ struct p9_rdir *rdir;
+ struct kvec kvec;
+
+@@ -138,11 +137,10 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
+ while (rdir->head < rdir->tail) {
+ err = p9stat_read(fid->clnt, rdir->buf + rdir->head,
+ rdir->tail - rdir->head, &st);
+- if (err) {
++ if (err <= 0) {
+ p9_debug(P9_DEBUG_VFS, "returned %d\n", err);
+ return -EIO;
+ }
+- reclen = st.size+2;
+
+ over = !dir_emit(ctx, st.name, strlen(st.name),
+ v9fs_qid2ino(&st.qid), dt_type(&st));
+@@ -150,8 +148,8 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
+ if (over)
+ return 0;
+
+- rdir->head += reclen;
+- ctx->pos += reclen;
++ rdir->head += err;
++ ctx->pos += err;
+ }
+ }
+ }
+diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
+index c87e6d6ec069..05454a7e22dc 100644
+--- a/fs/9p/vfs_file.c
++++ b/fs/9p/vfs_file.c
+@@ -154,6 +154,7 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl)
+ uint8_t status = P9_LOCK_ERROR;
+ int res = 0;
+ unsigned char fl_type;
++ struct v9fs_session_info *v9ses;
+
+ fid = filp->private_data;
+ BUG_ON(fid == NULL);
+@@ -189,6 +190,8 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl)
+ if (IS_SETLKW(cmd))
+ flock.flags = P9_LOCK_FLAGS_BLOCK;
+
++ v9ses = v9fs_inode2v9ses(file_inode(filp));
++
+ /*
+ * if its a blocked request and we get P9_LOCK_BLOCKED as the status
+ * for lock request, keep on trying
+@@ -202,7 +205,8 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl)
+ break;
+ if (status == P9_LOCK_BLOCKED && !IS_SETLKW(cmd))
+ break;
+- if (schedule_timeout_interruptible(P9_LOCK_TIMEOUT) != 0)
++ if (schedule_timeout_interruptible(v9ses->session_lock_timeout)
++ != 0)
+ break;
+ /*
+ * p9_client_lock_dotl overwrites flock.client_id with the
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 020f49c15b30..b59ebed4f615 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -780,43 +780,50 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
+ } else if ((rc == -EACCES) && backup_cred(cifs_sb) &&
+ (strcmp(server->vals->version_string, SMB1_VERSION_STRING)
+ == 0)) {
+- /*
+- * For SMB2 and later the backup intent flag is already
+- * sent if needed on open and there is no path based
+- * FindFirst operation to use to retry with
+- */
++ /*
++ * For SMB2 and later the backup intent flag is already
++ * sent if needed on open and there is no path based
++ * FindFirst operation to use to retry with
++ */
+
+- srchinf = kzalloc(sizeof(struct cifs_search_info),
+- GFP_KERNEL);
+- if (srchinf == NULL) {
+- rc = -ENOMEM;
+- goto cgii_exit;
+- }
++ srchinf = kzalloc(sizeof(struct cifs_search_info),
++ GFP_KERNEL);
++ if (srchinf == NULL) {
++ rc = -ENOMEM;
++ goto cgii_exit;
++ }
+
+- srchinf->endOfSearch = false;
++ srchinf->endOfSearch = false;
++ if (tcon->unix_ext)
++ srchinf->info_level = SMB_FIND_FILE_UNIX;
++ else if ((tcon->ses->capabilities &
++ tcon->ses->server->vals->cap_nt_find) == 0)
++ srchinf->info_level = SMB_FIND_FILE_INFO_STANDARD;
++ else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)
+ srchinf->info_level = SMB_FIND_FILE_ID_FULL_DIR_INFO;
++ else /* no srvino useful for fallback to some netapp */
++ srchinf->info_level = SMB_FIND_FILE_DIRECTORY_INFO;
+
+- srchflgs = CIFS_SEARCH_CLOSE_ALWAYS |
+- CIFS_SEARCH_CLOSE_AT_END |
+- CIFS_SEARCH_BACKUP_SEARCH;
++ srchflgs = CIFS_SEARCH_CLOSE_ALWAYS |
++ CIFS_SEARCH_CLOSE_AT_END |
++ CIFS_SEARCH_BACKUP_SEARCH;
+
+- rc = CIFSFindFirst(xid, tcon, full_path,
+- cifs_sb, NULL, srchflgs, srchinf, false);
+- if (!rc) {
+- data =
+- (FILE_ALL_INFO *)srchinf->srch_entries_start;
++ rc = CIFSFindFirst(xid, tcon, full_path,
++ cifs_sb, NULL, srchflgs, srchinf, false);
++ if (!rc) {
++ data = (FILE_ALL_INFO *)srchinf->srch_entries_start;
+
+- cifs_dir_info_to_fattr(&fattr,
+- (FILE_DIRECTORY_INFO *)data, cifs_sb);
+- fattr.cf_uniqueid = le64_to_cpu(
+- ((SEARCH_ID_FULL_DIR_INFO *)data)->UniqueId);
+- validinum = true;
++ cifs_dir_info_to_fattr(&fattr,
++ (FILE_DIRECTORY_INFO *)data, cifs_sb);
++ fattr.cf_uniqueid = le64_to_cpu(
++ ((SEARCH_ID_FULL_DIR_INFO *)data)->UniqueId);
++ validinum = true;
+
+- cifs_buf_release(srchinf->ntwrk_buf_start);
+- }
+- kfree(srchinf);
+- if (rc)
+- goto cgii_exit;
++ cifs_buf_release(srchinf->ntwrk_buf_start);
++ }
++ kfree(srchinf);
++ if (rc)
++ goto cgii_exit;
+ } else
+ goto cgii_exit;
+
+diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c
+index c3ae8c1d6089..18814f1d67d9 100644
+--- a/fs/cifs/smb2maperror.c
++++ b/fs/cifs/smb2maperror.c
+@@ -1036,7 +1036,8 @@ static const struct status_to_posix_error smb2_error_map_table[] = {
+ {STATUS_UNFINISHED_CONTEXT_DELETED, -EIO,
+ "STATUS_UNFINISHED_CONTEXT_DELETED"},
+ {STATUS_NO_TGT_REPLY, -EIO, "STATUS_NO_TGT_REPLY"},
+- {STATUS_OBJECTID_NOT_FOUND, -EIO, "STATUS_OBJECTID_NOT_FOUND"},
++ /* Note that ENOATTTR and ENODATA are the same errno */
++ {STATUS_OBJECTID_NOT_FOUND, -ENODATA, "STATUS_OBJECTID_NOT_FOUND"},
+ {STATUS_NO_IP_ADDRESSES, -EIO, "STATUS_NO_IP_ADDRESSES"},
+ {STATUS_WRONG_CREDENTIAL_HANDLE, -EIO,
+ "STATUS_WRONG_CREDENTIAL_HANDLE"},
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 2e76fb55d94a..5f24fdc140ad 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -999,6 +999,13 @@ resizefs_out:
+ if (!blk_queue_discard(q))
+ return -EOPNOTSUPP;
+
++ /*
++ * We haven't replayed the journal, so we cannot use our
++ * block-bitmap-guided storage zapping commands.
++ */
++ if (test_opt(sb, NOLOAD) && ext4_has_feature_journal(sb))
++ return -EROFS;
++
+ if (copy_from_user(&range, (struct fstrim_range __user *)arg,
+ sizeof(range)))
+ return -EFAULT;
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 3d9b18505c0c..e7ae26e36c9c 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -932,11 +932,18 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
+ memcpy(n_group_desc, o_group_desc,
+ EXT4_SB(sb)->s_gdb_count * sizeof(struct buffer_head *));
+ n_group_desc[gdb_num] = gdb_bh;
++
++ BUFFER_TRACE(gdb_bh, "get_write_access");
++ err = ext4_journal_get_write_access(handle, gdb_bh);
++ if (err) {
++ kvfree(n_group_desc);
++ brelse(gdb_bh);
++ return err;
++ }
++
+ EXT4_SB(sb)->s_group_desc = n_group_desc;
+ EXT4_SB(sb)->s_gdb_count++;
+ kvfree(o_group_desc);
+- BUFFER_TRACE(gdb_bh, "get_write_access");
+- err = ext4_journal_get_write_access(handle, gdb_bh);
+ return err;
+ }
+
+@@ -2073,6 +2080,10 @@ out:
+ free_flex_gd(flex_gd);
+ if (resize_inode != NULL)
+ iput(resize_inode);
+- ext4_msg(sb, KERN_INFO, "resized filesystem to %llu", n_blocks_count);
++ if (err)
++ ext4_warning(sb, "error (%d) occurred during "
++ "file system resize", err);
++ ext4_msg(sb, KERN_INFO, "resized filesystem to %llu",
++ ext4_blocks_count(es));
+ return err;
+ }
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index a1cf7d68b4f0..abba7ece78e9 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -430,6 +430,12 @@ static void ext4_journal_commit_callback(journal_t *journal, transaction_t *txn)
+ spin_unlock(&sbi->s_md_lock);
+ }
+
++static bool system_going_down(void)
++{
++ return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF
++ || system_state == SYSTEM_RESTART;
++}
++
+ /* Deal with the reporting of failure conditions on a filesystem such as
+ * inconsistencies detected or read IO failures.
+ *
+@@ -460,7 +466,12 @@ static void ext4_handle_error(struct super_block *sb)
+ if (journal)
+ jbd2_journal_abort(journal, -EIO);
+ }
+- if (test_opt(sb, ERRORS_RO)) {
++ /*
++ * We force ERRORS_RO behavior when system is rebooting. Otherwise we
++ * could panic during 'reboot -f' as the underlying device got already
++ * disabled.
++ */
++ if (test_opt(sb, ERRORS_RO) || system_going_down()) {
+ ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only");
+ /*
+ * Make sure updated value of ->s_mount_flags will be visible
+@@ -468,8 +479,7 @@ static void ext4_handle_error(struct super_block *sb)
+ */
+ smp_wmb();
+ sb->s_flags |= SB_RDONLY;
+- }
+- if (test_opt(sb, ERRORS_PANIC)) {
++ } else if (test_opt(sb, ERRORS_PANIC)) {
+ if (EXT4_SB(sb)->s_journal &&
+ !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
+ return;
+diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
+index 214a968962a1..ebe649d9793c 100644
+--- a/fs/f2fs/debug.c
++++ b/fs/f2fs/debug.c
+@@ -190,8 +190,7 @@ static void update_mem_info(struct f2fs_sb_info *sbi)
+ si->base_mem += MAIN_SEGS(sbi) * sizeof(struct seg_entry);
+ si->base_mem += f2fs_bitmap_size(MAIN_SEGS(sbi));
+ si->base_mem += 2 * SIT_VBLOCK_MAP_SIZE * MAIN_SEGS(sbi);
+- if (f2fs_discard_en(sbi))
+- si->base_mem += SIT_VBLOCK_MAP_SIZE * MAIN_SEGS(sbi);
++ si->base_mem += SIT_VBLOCK_MAP_SIZE * MAIN_SEGS(sbi);
+ si->base_mem += SIT_VBLOCK_MAP_SIZE;
+ if (sbi->segs_per_sec > 1)
+ si->base_mem += MAIN_SECS(sbi) * sizeof(struct sec_entry);
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index a3ba20e5946f..1f5d5f62bb77 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3409,11 +3409,20 @@ static inline int get_blkz_type(struct f2fs_sb_info *sbi,
+ }
+ #endif
+
+-static inline bool f2fs_discard_en(struct f2fs_sb_info *sbi)
++static inline bool f2fs_hw_should_discard(struct f2fs_sb_info *sbi)
+ {
+- struct request_queue *q = bdev_get_queue(sbi->sb->s_bdev);
++ return f2fs_sb_has_blkzoned(sbi->sb);
++}
+
+- return blk_queue_discard(q) || f2fs_sb_has_blkzoned(sbi->sb);
++static inline bool f2fs_hw_support_discard(struct f2fs_sb_info *sbi)
++{
++ return blk_queue_discard(bdev_get_queue(sbi->sb->s_bdev));
++}
++
++static inline bool f2fs_realtime_discard_enable(struct f2fs_sb_info *sbi)
++{
++ return (test_opt(sbi, DISCARD) && f2fs_hw_support_discard(sbi)) ||
++ f2fs_hw_should_discard(sbi);
+ }
+
+ static inline void set_opt_mode(struct f2fs_sb_info *sbi, unsigned int mt)
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 81c1dd635a8d..b3f46e3bec17 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -770,7 +770,6 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr)
+ {
+ struct inode *inode = d_inode(dentry);
+ int err;
+- bool size_changed = false;
+
+ if (unlikely(f2fs_cp_error(F2FS_I_SB(inode))))
+ return -EIO;
+@@ -830,8 +829,6 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr)
+ down_write(&F2FS_I(inode)->i_sem);
+ F2FS_I(inode)->last_disk_size = i_size_read(inode);
+ up_write(&F2FS_I(inode)->i_sem);
+-
+- size_changed = true;
+ }
+
+ __setattr_copy(inode, attr);
+@@ -845,7 +842,7 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr)
+ }
+
+ /* file size may changed here */
+- f2fs_mark_inode_dirty_sync(inode, size_changed);
++ f2fs_mark_inode_dirty_sync(inode, true);
+
+ /* inode change will produce dirty node pages flushed by checkpoint */
+ f2fs_balance_fs(F2FS_I_SB(inode), true);
+@@ -1983,7 +1980,7 @@ static int f2fs_ioc_fitrim(struct file *filp, unsigned long arg)
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+- if (!blk_queue_discard(q))
++ if (!f2fs_hw_support_discard(F2FS_SB(sb)))
+ return -EOPNOTSUPP;
+
+ if (copy_from_user(&range, (struct fstrim_range __user *)arg,
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 9a8579fb3a30..ae0e5f2e67b4 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -99,8 +99,12 @@ err_out:
+ return ERR_PTR(err);
+ }
+
+-static void del_fsync_inode(struct fsync_inode_entry *entry)
++static void del_fsync_inode(struct fsync_inode_entry *entry, int drop)
+ {
++ if (drop) {
++ /* inode should not be recovered, drop it */
++ f2fs_inode_synced(entry->inode);
++ }
+ iput(entry->inode);
+ list_del(&entry->list);
+ kmem_cache_free(fsync_entry_slab, entry);
+@@ -321,12 +325,12 @@ next:
+ return err;
+ }
+
+-static void destroy_fsync_dnodes(struct list_head *head)
++static void destroy_fsync_dnodes(struct list_head *head, int drop)
+ {
+ struct fsync_inode_entry *entry, *tmp;
+
+ list_for_each_entry_safe(entry, tmp, head, list)
+- del_fsync_inode(entry);
++ del_fsync_inode(entry, drop);
+ }
+
+ static int check_index_in_prev_nodes(struct f2fs_sb_info *sbi,
+@@ -561,7 +565,7 @@ out:
+ }
+
+ static int recover_data(struct f2fs_sb_info *sbi, struct list_head *inode_list,
+- struct list_head *dir_list)
++ struct list_head *tmp_inode_list, struct list_head *dir_list)
+ {
+ struct curseg_info *curseg;
+ struct page *page = NULL;
+@@ -615,7 +619,7 @@ static int recover_data(struct f2fs_sb_info *sbi, struct list_head *inode_list,
+ }
+
+ if (entry->blkaddr == blkaddr)
+- del_fsync_inode(entry);
++ list_move_tail(&entry->list, tmp_inode_list);
+ next:
+ /* check next segment */
+ blkaddr = next_blkaddr_of_node(page);
+@@ -628,7 +632,7 @@ next:
+
+ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only)
+ {
+- struct list_head inode_list;
++ struct list_head inode_list, tmp_inode_list;
+ struct list_head dir_list;
+ int err;
+ int ret = 0;
+@@ -659,6 +663,7 @@ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only)
+ }
+
+ INIT_LIST_HEAD(&inode_list);
++ INIT_LIST_HEAD(&tmp_inode_list);
+ INIT_LIST_HEAD(&dir_list);
+
+ /* prevent checkpoint */
+@@ -677,11 +682,16 @@ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only)
+ need_writecp = true;
+
+ /* step #2: recover data */
+- err = recover_data(sbi, &inode_list, &dir_list);
++ err = recover_data(sbi, &inode_list, &tmp_inode_list, &dir_list);
+ if (!err)
+ f2fs_bug_on(sbi, !list_empty(&inode_list));
++ else {
++ /* restore s_flags to let iput() trash data */
++ sbi->sb->s_flags = s_flags;
++ }
+ skip:
+- destroy_fsync_dnodes(&inode_list);
++ destroy_fsync_dnodes(&inode_list, err);
++ destroy_fsync_dnodes(&tmp_inode_list, err);
+
+ /* truncate meta pages to be used by the recovery */
+ truncate_inode_pages_range(META_MAPPING(sbi),
+@@ -690,13 +700,13 @@ skip:
+ if (err) {
+ truncate_inode_pages_final(NODE_MAPPING(sbi));
+ truncate_inode_pages_final(META_MAPPING(sbi));
++ } else {
++ clear_sbi_flag(sbi, SBI_POR_DOING);
+ }
+-
+- clear_sbi_flag(sbi, SBI_POR_DOING);
+ mutex_unlock(&sbi->cp_mutex);
+
+ /* let's drop all the directory inodes for clean checkpoint */
+- destroy_fsync_dnodes(&dir_list);
++ destroy_fsync_dnodes(&dir_list, err);
+
+ if (need_writecp) {
+ set_sbi_flag(sbi, SBI_IS_RECOVERED);
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 1fa6f8185766..ac038563273d 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -1744,11 +1744,11 @@ static bool add_discard_addrs(struct f2fs_sb_info *sbi, struct cp_control *cpc,
+ struct list_head *head = &SM_I(sbi)->dcc_info->entry_list;
+ int i;
+
+- if (se->valid_blocks == max_blocks || !f2fs_discard_en(sbi))
++ if (se->valid_blocks == max_blocks || !f2fs_hw_support_discard(sbi))
+ return false;
+
+ if (!force) {
+- if (!test_opt(sbi, DISCARD) || !se->valid_blocks ||
++ if (!f2fs_realtime_discard_enable(sbi) || !se->valid_blocks ||
+ SM_I(sbi)->dcc_info->nr_discards >=
+ SM_I(sbi)->dcc_info->max_discards)
+ return false;
+@@ -1854,7 +1854,7 @@ void f2fs_clear_prefree_segments(struct f2fs_sb_info *sbi,
+ dirty_i->nr_dirty[PRE]--;
+ }
+
+- if (!test_opt(sbi, DISCARD))
++ if (!f2fs_realtime_discard_enable(sbi))
+ continue;
+
+ if (force && start >= cpc->trim_start &&
+@@ -2044,8 +2044,7 @@ static void update_sit_entry(struct f2fs_sb_info *sbi, block_t blkaddr, int del)
+ del = 0;
+ }
+
+- if (f2fs_discard_en(sbi) &&
+- !f2fs_test_and_set_bit(offset, se->discard_map))
++ if (!f2fs_test_and_set_bit(offset, se->discard_map))
+ sbi->discard_blks--;
+
+ /* don't overwrite by SSR to keep node chain */
+@@ -2073,8 +2072,7 @@ static void update_sit_entry(struct f2fs_sb_info *sbi, block_t blkaddr, int del)
+ del = 0;
+ }
+
+- if (f2fs_discard_en(sbi) &&
+- f2fs_test_and_clear_bit(offset, se->discard_map))
++ if (f2fs_test_and_clear_bit(offset, se->discard_map))
+ sbi->discard_blks++;
+ }
+ if (!f2fs_test_bit(offset, se->ckpt_valid_map))
+@@ -2690,7 +2688,7 @@ int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range)
+ * discard option. User configuration looks like using runtime discard
+ * or periodic fstrim instead of it.
+ */
+- if (test_opt(sbi, DISCARD))
++ if (f2fs_realtime_discard_enable(sbi))
+ goto out;
+
+ start_block = START_BLOCK(sbi, start_segno);
+@@ -3781,13 +3779,11 @@ static int build_sit_info(struct f2fs_sb_info *sbi)
+ return -ENOMEM;
+ #endif
+
+- if (f2fs_discard_en(sbi)) {
+- sit_i->sentries[start].discard_map
+- = f2fs_kzalloc(sbi, SIT_VBLOCK_MAP_SIZE,
+- GFP_KERNEL);
+- if (!sit_i->sentries[start].discard_map)
+- return -ENOMEM;
+- }
++ sit_i->sentries[start].discard_map
++ = f2fs_kzalloc(sbi, SIT_VBLOCK_MAP_SIZE,
++ GFP_KERNEL);
++ if (!sit_i->sentries[start].discard_map)
++ return -ENOMEM;
+ }
+
+ sit_i->tmp_map = f2fs_kzalloc(sbi, SIT_VBLOCK_MAP_SIZE, GFP_KERNEL);
+@@ -3935,18 +3931,16 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)
+ total_node_blocks += se->valid_blocks;
+
+ /* build discard map only one time */
+- if (f2fs_discard_en(sbi)) {
+- if (is_set_ckpt_flags(sbi, CP_TRIMMED_FLAG)) {
+- memset(se->discard_map, 0xff,
+- SIT_VBLOCK_MAP_SIZE);
+- } else {
+- memcpy(se->discard_map,
+- se->cur_valid_map,
+- SIT_VBLOCK_MAP_SIZE);
+- sbi->discard_blks +=
+- sbi->blocks_per_seg -
+- se->valid_blocks;
+- }
++ if (is_set_ckpt_flags(sbi, CP_TRIMMED_FLAG)) {
++ memset(se->discard_map, 0xff,
++ SIT_VBLOCK_MAP_SIZE);
++ } else {
++ memcpy(se->discard_map,
++ se->cur_valid_map,
++ SIT_VBLOCK_MAP_SIZE);
++ sbi->discard_blks +=
++ sbi->blocks_per_seg -
++ se->valid_blocks;
+ }
+
+ if (sbi->segs_per_sec > 1)
+@@ -3984,16 +3978,13 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)
+ if (IS_NODESEG(se->type))
+ total_node_blocks += se->valid_blocks;
+
+- if (f2fs_discard_en(sbi)) {
+- if (is_set_ckpt_flags(sbi, CP_TRIMMED_FLAG)) {
+- memset(se->discard_map, 0xff,
+- SIT_VBLOCK_MAP_SIZE);
+- } else {
+- memcpy(se->discard_map, se->cur_valid_map,
+- SIT_VBLOCK_MAP_SIZE);
+- sbi->discard_blks += old_valid_blocks;
+- sbi->discard_blks -= se->valid_blocks;
+- }
++ if (is_set_ckpt_flags(sbi, CP_TRIMMED_FLAG)) {
++ memset(se->discard_map, 0xff, SIT_VBLOCK_MAP_SIZE);
++ } else {
++ memcpy(se->discard_map, se->cur_valid_map,
++ SIT_VBLOCK_MAP_SIZE);
++ sbi->discard_blks += old_valid_blocks;
++ sbi->discard_blks -= se->valid_blocks;
+ }
+
+ if (sbi->segs_per_sec > 1) {
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 79370b7fa9d2..2264f27fd26d 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -360,7 +360,6 @@ static int f2fs_check_quota_options(struct f2fs_sb_info *sbi)
+ static int parse_options(struct super_block *sb, char *options)
+ {
+ struct f2fs_sb_info *sbi = F2FS_SB(sb);
+- struct request_queue *q;
+ substring_t args[MAX_OPT_ARGS];
+ char *p, *name;
+ int arg = 0;
+@@ -415,14 +414,7 @@ static int parse_options(struct super_block *sb, char *options)
+ return -EINVAL;
+ break;
+ case Opt_discard:
+- q = bdev_get_queue(sb->s_bdev);
+- if (blk_queue_discard(q)) {
+- set_opt(sbi, DISCARD);
+- } else if (!f2fs_sb_has_blkzoned(sb)) {
+- f2fs_msg(sb, KERN_WARNING,
+- "mounting with \"discard\" option, but "
+- "the device does not support discard");
+- }
++ set_opt(sbi, DISCARD);
+ break;
+ case Opt_nodiscard:
+ if (f2fs_sb_has_blkzoned(sb)) {
+@@ -1033,7 +1025,8 @@ static void f2fs_put_super(struct super_block *sb)
+ /* be sure to wait for any on-going discard commands */
+ dropped = f2fs_wait_discard_bios(sbi);
+
+- if (f2fs_discard_en(sbi) && !sbi->discard_blks && !dropped) {
++ if ((f2fs_hw_support_discard(sbi) || f2fs_hw_should_discard(sbi)) &&
++ !sbi->discard_blks && !dropped) {
+ struct cp_control cpc = {
+ .reason = CP_UMOUNT | CP_TRIMMED,
+ };
+@@ -1403,8 +1396,7 @@ static void default_options(struct f2fs_sb_info *sbi)
+ set_opt(sbi, NOHEAP);
+ sbi->sb->s_flags |= SB_LAZYTIME;
+ set_opt(sbi, FLUSH_MERGE);
+- if (blk_queue_discard(bdev_get_queue(sbi->sb->s_bdev)))
+- set_opt(sbi, DISCARD);
++ set_opt(sbi, DISCARD);
+ if (f2fs_sb_has_blkzoned(sbi->sb))
+ set_opt_mode(sbi, F2FS_MOUNT_LFS);
+ else
+@@ -1893,6 +1885,19 @@ void f2fs_quota_off_umount(struct super_block *sb)
+ }
+ }
+
++static void f2fs_truncate_quota_inode_pages(struct super_block *sb)
++{
++ struct quota_info *dqopt = sb_dqopt(sb);
++ int type;
++
++ for (type = 0; type < MAXQUOTAS; type++) {
++ if (!dqopt->files[type])
++ continue;
++ f2fs_inode_synced(dqopt->files[type]);
++ }
++}
++
++
+ static int f2fs_get_projid(struct inode *inode, kprojid_t *projid)
+ {
+ *projid = F2FS_I(inode)->i_projid;
+@@ -2337,7 +2342,7 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
+ unsigned int segment_count_main;
+ unsigned int cp_pack_start_sum, cp_payload;
+ block_t user_block_count;
+- int i;
++ int i, j;
+
+ total = le32_to_cpu(raw_super->segment_count);
+ fsmeta = le32_to_cpu(raw_super->segment_count_ckpt);
+@@ -2378,11 +2383,43 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
+ if (le32_to_cpu(ckpt->cur_node_segno[i]) >= main_segs ||
+ le16_to_cpu(ckpt->cur_node_blkoff[i]) >= blocks_per_seg)
+ return 1;
++ for (j = i + 1; j < NR_CURSEG_NODE_TYPE; j++) {
++ if (le32_to_cpu(ckpt->cur_node_segno[i]) ==
++ le32_to_cpu(ckpt->cur_node_segno[j])) {
++ f2fs_msg(sbi->sb, KERN_ERR,
++ "Node segment (%u, %u) has the same "
++ "segno: %u", i, j,
++ le32_to_cpu(ckpt->cur_node_segno[i]));
++ return 1;
++ }
++ }
+ }
+ for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {
+ if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs ||
+ le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg)
+ return 1;
++ for (j = i + 1; j < NR_CURSEG_DATA_TYPE; j++) {
++ if (le32_to_cpu(ckpt->cur_data_segno[i]) ==
++ le32_to_cpu(ckpt->cur_data_segno[j])) {
++ f2fs_msg(sbi->sb, KERN_ERR,
++ "Data segment (%u, %u) has the same "
++ "segno: %u", i, j,
++ le32_to_cpu(ckpt->cur_data_segno[i]));
++ return 1;
++ }
++ }
++ }
++ for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {
++ for (j = i; j < NR_CURSEG_DATA_TYPE; j++) {
++ if (le32_to_cpu(ckpt->cur_node_segno[i]) ==
++ le32_to_cpu(ckpt->cur_data_segno[j])) {
++ f2fs_msg(sbi->sb, KERN_ERR,
++ "Data segment (%u) and Data segment (%u)"
++ " has the same segno: %u", i, j,
++ le32_to_cpu(ckpt->cur_node_segno[i]));
++ return 1;
++ }
++ }
+ }
+
+ sit_bitmap_size = le32_to_cpu(ckpt->sit_ver_bitmap_bytesize);
+@@ -3107,10 +3144,10 @@ skip_recovery:
+
+ free_meta:
+ #ifdef CONFIG_QUOTA
++ f2fs_truncate_quota_inode_pages(sb);
+ if (f2fs_sb_has_quota_ino(sb) && !f2fs_readonly(sb))
+ f2fs_quota_off_umount(sbi->sb);
+ #endif
+- f2fs_sync_inode_meta(sbi);
+ /*
+ * Some dirty meta pages can be produced by f2fs_recover_orphan_inodes()
+ * failed by EIO. Then, iput(node_inode) can trigger balance_fs_bg()
+diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
+index 780bba695453..97a51690338e 100644
+--- a/fs/notify/inotify/inotify_user.c
++++ b/fs/notify/inotify/inotify_user.c
+@@ -519,8 +519,10 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
+ fsn_mark = fsnotify_find_mark(&inode->i_fsnotify_marks, group);
+ if (!fsn_mark)
+ return -ENOENT;
+- else if (create)
+- return -EEXIST;
++ else if (create) {
++ ret = -EEXIST;
++ goto out;
++ }
+
+ i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
+
+@@ -548,6 +550,7 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
+ /* return the wd */
+ ret = i_mark->wd;
+
++out:
+ /* match the get from fsnotify_find_mark() */
+ fsnotify_put_mark(fsn_mark);
+
+diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
+index d297fe4472a9..d0137e3e585e 100644
+--- a/fs/proc/kcore.c
++++ b/fs/proc/kcore.c
+@@ -54,6 +54,28 @@ static LIST_HEAD(kclist_head);
+ static DECLARE_RWSEM(kclist_lock);
+ static int kcore_need_update = 1;
+
++/*
++ * Returns > 0 for RAM pages, 0 for non-RAM pages, < 0 on error
++ * Same as oldmem_pfn_is_ram in vmcore
++ */
++static int (*mem_pfn_is_ram)(unsigned long pfn);
++
++int __init register_mem_pfn_is_ram(int (*fn)(unsigned long pfn))
++{
++ if (mem_pfn_is_ram)
++ return -EBUSY;
++ mem_pfn_is_ram = fn;
++ return 0;
++}
++
++static int pfn_is_ram(unsigned long pfn)
++{
++ if (mem_pfn_is_ram)
++ return mem_pfn_is_ram(pfn);
++ else
++ return 1;
++}
++
+ /* This doesn't grab kclist_lock, so it should only be used at init time. */
+ void __init kclist_add(struct kcore_list *new, void *addr, size_t size,
+ int type)
+@@ -465,6 +487,11 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
+ goto out;
+ }
+ m = NULL; /* skip the list anchor */
++ } else if (!pfn_is_ram(__pa(start) >> PAGE_SHIFT)) {
++ if (clear_user(buffer, tsz)) {
++ ret = -EFAULT;
++ goto out;
++ }
+ } else if (m->type == KCORE_VMALLOC) {
+ vread(buf, (char *)start, tsz);
+ /* we have to zero-fill user buffer even if no read */
+diff --git a/include/linux/atalk.h b/include/linux/atalk.h
+index 23f805562f4e..d5cfc0b15b76 100644
+--- a/include/linux/atalk.h
++++ b/include/linux/atalk.h
+@@ -158,19 +158,29 @@ extern int sysctl_aarp_retransmit_limit;
+ extern int sysctl_aarp_resolve_time;
+
+ #ifdef CONFIG_SYSCTL
+-extern void atalk_register_sysctl(void);
++extern int atalk_register_sysctl(void);
+ extern void atalk_unregister_sysctl(void);
+ #else
+-#define atalk_register_sysctl() do { } while(0)
+-#define atalk_unregister_sysctl() do { } while(0)
++static inline int atalk_register_sysctl(void)
++{
++ return 0;
++}
++static inline void atalk_unregister_sysctl(void)
++{
++}
+ #endif
+
+ #ifdef CONFIG_PROC_FS
+ extern int atalk_proc_init(void);
+ extern void atalk_proc_exit(void);
+ #else
+-#define atalk_proc_init() ({ 0; })
+-#define atalk_proc_exit() do { } while(0)
++static inline int atalk_proc_init(void)
++{
++ return 0;
++}
++static inline void atalk_proc_exit(void)
++{
++}
+ #endif /* CONFIG_PROC_FS */
+
+ #endif /* __LINUX_ATALK_H__ */
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 269d376f5a11..81c2238b884c 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -124,7 +124,10 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ # define ASM_UNREACHABLE
+ #endif
+ #ifndef unreachable
+-# define unreachable() do { annotate_reachable(); do { } while (1); } while (0)
++# define unreachable() do { \
++ annotate_unreachable(); \
++ __builtin_unreachable(); \
++} while (0)
+ #endif
+
+ /*
+diff --git a/include/linux/kcore.h b/include/linux/kcore.h
+index 8c3f8c14eeaa..c843f4a9c512 100644
+--- a/include/linux/kcore.h
++++ b/include/linux/kcore.h
+@@ -44,6 +44,8 @@ void kclist_add_remap(struct kcore_list *m, void *addr, void *vaddr, size_t sz)
+ m->vaddr = (unsigned long)vaddr;
+ kclist_add(m, addr, sz, KCORE_REMAP);
+ }
++
++extern int __init register_mem_pfn_is_ram(int (*fn)(unsigned long pfn));
+ #else
+ static inline
+ void kclist_add(struct kcore_list *new, void *addr, size_t size, int type)
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index 77221c16733a..7bd0a6f2ac2b 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -155,9 +155,9 @@ struct swap_extent {
+ /*
+ * Max bad pages in the new format..
+ */
+-#define __swapoffset(x) ((unsigned long)&((union swap_header *)0)->x)
+ #define MAX_SWAP_BADPAGES \
+- ((__swapoffset(magic.magic) - __swapoffset(info.badpages)) / sizeof(int))
++ ((offsetof(union swap_header, magic.magic) - \
++ offsetof(union swap_header, info.badpages)) / sizeof(int))
+
+ enum {
+ SWP_USED = (1 << 0), /* is slot in swap_info[] used? */
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 0db1b9b428b7..1dfb75057580 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -259,6 +259,8 @@ struct hci_dev {
+ __u16 le_max_tx_time;
+ __u16 le_max_rx_len;
+ __u16 le_max_rx_time;
++ __u8 le_max_key_size;
++ __u8 le_min_key_size;
+ __u16 discov_interleaved_timeout;
+ __u16 conn_info_min_age;
+ __u16 conn_info_max_age;
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index da588def3c61..5e3daf53b3d1 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -850,7 +850,7 @@ static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
+ xfrm_pol_put(pols[i]);
+ }
+
+-void __xfrm_state_destroy(struct xfrm_state *);
++void __xfrm_state_destroy(struct xfrm_state *, bool);
+
+ static inline void __xfrm_state_put(struct xfrm_state *x)
+ {
+@@ -860,7 +860,13 @@ static inline void __xfrm_state_put(struct xfrm_state *x)
+ static inline void xfrm_state_put(struct xfrm_state *x)
+ {
+ if (refcount_dec_and_test(&x->refcnt))
+- __xfrm_state_destroy(x);
++ __xfrm_state_destroy(x, false);
++}
++
++static inline void xfrm_state_put_sync(struct xfrm_state *x)
++{
++ if (refcount_dec_and_test(&x->refcnt))
++ __xfrm_state_destroy(x, true);
+ }
+
+ static inline void xfrm_state_hold(struct xfrm_state *x)
+@@ -1616,7 +1622,7 @@ struct xfrmk_spdinfo {
+
+ struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
+ int xfrm_state_delete(struct xfrm_state *x);
+-int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);
++int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync);
+ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid);
+ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
+ void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index 573d5b901fb1..6d182746afab 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -76,6 +76,7 @@ enum rxrpc_client_trace {
+ rxrpc_client_chan_disconnect,
+ rxrpc_client_chan_pass,
+ rxrpc_client_chan_unstarted,
++ rxrpc_client_chan_wait_failed,
+ rxrpc_client_cleanup,
+ rxrpc_client_count,
+ rxrpc_client_discard,
+@@ -275,6 +276,7 @@ enum rxrpc_tx_point {
+ EM(rxrpc_client_chan_disconnect, "ChDisc") \
+ EM(rxrpc_client_chan_pass, "ChPass") \
+ EM(rxrpc_client_chan_unstarted, "ChUnst") \
++ EM(rxrpc_client_chan_wait_failed, "ChWtFl") \
+ EM(rxrpc_client_cleanup, "Clean ") \
+ EM(rxrpc_client_count, "Count ") \
+ EM(rxrpc_client_discard, "Discar") \
+diff --git a/include/uapi/linux/netfilter/xt_cgroup.h b/include/uapi/linux/netfilter/xt_cgroup.h
+index e96dfa1b34f7..b74e370d6133 100644
+--- a/include/uapi/linux/netfilter/xt_cgroup.h
++++ b/include/uapi/linux/netfilter/xt_cgroup.h
+@@ -22,4 +22,20 @@ struct xt_cgroup_info_v1 {
+ void *priv __attribute__((aligned(8)));
+ };
+
++#define XT_CGROUP_PATH_MAX 512
++
++struct xt_cgroup_info_v2 {
++ __u8 has_path;
++ __u8 has_classid;
++ __u8 invert_path;
++ __u8 invert_classid;
++ union {
++ char path[XT_CGROUP_PATH_MAX];
++ __u32 classid;
++ };
++
++ /* kernel internal data */
++ void *priv __attribute__((aligned(8)));
++};
++
+ #endif /* _UAPI_XT_CGROUP_H */
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index 2ada5e21dfa6..4a8f390a2b82 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -554,19 +554,6 @@ struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type typ
+ }
+ EXPORT_SYMBOL(bpf_prog_get_type_path);
+
+-static void bpf_evict_inode(struct inode *inode)
+-{
+- enum bpf_type type;
+-
+- truncate_inode_pages_final(&inode->i_data);
+- clear_inode(inode);
+-
+- if (S_ISLNK(inode->i_mode))
+- kfree(inode->i_link);
+- if (!bpf_inode_type(inode, &type))
+- bpf_any_put(inode->i_private, type);
+-}
+-
+ /*
+ * Display the mount options in /proc/mounts.
+ */
+@@ -579,11 +566,28 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)
+ return 0;
+ }
+
++static void bpf_destroy_inode_deferred(struct rcu_head *head)
++{
++ struct inode *inode = container_of(head, struct inode, i_rcu);
++ enum bpf_type type;
++
++ if (S_ISLNK(inode->i_mode))
++ kfree(inode->i_link);
++ if (!bpf_inode_type(inode, &type))
++ bpf_any_put(inode->i_private, type);
++ free_inode_nonrcu(inode);
++}
++
++static void bpf_destroy_inode(struct inode *inode)
++{
++ call_rcu(&inode->i_rcu, bpf_destroy_inode_deferred);
++}
++
+ static const struct super_operations bpf_super_ops = {
+ .statfs = simple_statfs,
+ .drop_inode = generic_delete_inode,
+ .show_options = bpf_show_options,
+- .evict_inode = bpf_evict_inode,
++ .destroy_inode = bpf_destroy_inode,
+ };
+
+ enum {
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index aa996a0854b9..87bd96399d1c 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -7178,6 +7178,7 @@ static void perf_event_mmap_output(struct perf_event *event,
+ struct perf_output_handle handle;
+ struct perf_sample_data sample;
+ int size = mmap_event->event_id.header.size;
++ u32 type = mmap_event->event_id.header.type;
+ int ret;
+
+ if (!perf_event_mmap_match(event, data))
+@@ -7221,6 +7222,7 @@ static void perf_event_mmap_output(struct perf_event *event,
+ perf_output_end(&handle);
+ out:
+ mmap_event->event_id.header.size = size;
++ mmap_event->event_id.header.type = type;
+ }
+
+ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
+diff --git a/kernel/hung_task.c b/kernel/hung_task.c
+index 9eca2371f189..4a9191617076 100644
+--- a/kernel/hung_task.c
++++ b/kernel/hung_task.c
+@@ -15,6 +15,7 @@
+ #include <linux/lockdep.h>
+ #include <linux/export.h>
+ #include <linux/sysctl.h>
++#include <linux/suspend.h>
+ #include <linux/utsname.h>
+ #include <linux/sched/signal.h>
+ #include <linux/sched/debug.h>
+@@ -240,6 +241,28 @@ void reset_hung_task_detector(void)
+ }
+ EXPORT_SYMBOL_GPL(reset_hung_task_detector);
+
++static bool hung_detector_suspended;
++
++static int hungtask_pm_notify(struct notifier_block *self,
++ unsigned long action, void *hcpu)
++{
++ switch (action) {
++ case PM_SUSPEND_PREPARE:
++ case PM_HIBERNATION_PREPARE:
++ case PM_RESTORE_PREPARE:
++ hung_detector_suspended = true;
++ break;
++ case PM_POST_SUSPEND:
++ case PM_POST_HIBERNATION:
++ case PM_POST_RESTORE:
++ hung_detector_suspended = false;
++ break;
++ default:
++ break;
++ }
++ return NOTIFY_OK;
++}
++
+ /*
+ * kthread which checks for tasks stuck in D state
+ */
+@@ -259,7 +282,8 @@ static int watchdog(void *dummy)
+ interval = min_t(unsigned long, interval, timeout);
+ t = hung_timeout_jiffies(hung_last_checked, interval);
+ if (t <= 0) {
+- if (!atomic_xchg(&reset_hung_task, 0))
++ if (!atomic_xchg(&reset_hung_task, 0) &&
++ !hung_detector_suspended)
+ check_hung_uninterruptible_tasks(timeout);
+ hung_last_checked = jiffies;
+ continue;
+@@ -273,6 +297,10 @@ static int watchdog(void *dummy)
+ static int __init hung_task_init(void)
+ {
+ atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
++
++ /* Disable hung task detector on suspend */
++ pm_notifier(hungtask_pm_notify, 0);
++
+ watchdog_task = kthread_run(watchdog, NULL, "khungtaskd");
+
+ return 0;
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 9a4f57d7e931..d7f409866cdf 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -6930,7 +6930,7 @@ static int __maybe_unused cpu_period_quota_parse(char *buf,
+ {
+ char tok[21]; /* U64_MAX */
+
+- if (!sscanf(buf, "%s %llu", tok, periodp))
++ if (sscanf(buf, "%20s %llu", tok, periodp) < 1)
+ return -EINVAL;
+
+ *periodp *= NSEC_PER_USEC;
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index 3fffad3bc8a8..217f81ecae17 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -50,10 +50,10 @@ struct sugov_cpu {
+
+ bool iowait_boost_pending;
+ unsigned int iowait_boost;
+- unsigned int iowait_boost_max;
+ u64 last_update;
+
+ unsigned long bw_dl;
++ unsigned long min;
+ unsigned long max;
+
+ /* The field below is for single-CPU policies only: */
+@@ -283,8 +283,7 @@ static bool sugov_iowait_reset(struct sugov_cpu *sg_cpu, u64 time,
+ if (delta_ns <= TICK_NSEC)
+ return false;
+
+- sg_cpu->iowait_boost = set_iowait_boost
+- ? sg_cpu->sg_policy->policy->min : 0;
++ sg_cpu->iowait_boost = set_iowait_boost ? sg_cpu->min : 0;
+ sg_cpu->iowait_boost_pending = set_iowait_boost;
+
+ return true;
+@@ -324,14 +323,13 @@ static void sugov_iowait_boost(struct sugov_cpu *sg_cpu, u64 time,
+
+ /* Double the boost at each request */
+ if (sg_cpu->iowait_boost) {
+- sg_cpu->iowait_boost <<= 1;
+- if (sg_cpu->iowait_boost > sg_cpu->iowait_boost_max)
+- sg_cpu->iowait_boost = sg_cpu->iowait_boost_max;
++ sg_cpu->iowait_boost =
++ min_t(unsigned int, sg_cpu->iowait_boost << 1, SCHED_CAPACITY_SCALE);
+ return;
+ }
+
+ /* First wakeup after IO: start with minimum boost */
+- sg_cpu->iowait_boost = sg_cpu->sg_policy->policy->min;
++ sg_cpu->iowait_boost = sg_cpu->min;
+ }
+
+ /**
+@@ -353,47 +351,38 @@ static void sugov_iowait_boost(struct sugov_cpu *sg_cpu, u64 time,
+ * This mechanism is designed to boost high frequently IO waiting tasks, while
+ * being more conservative on tasks which does sporadic IO operations.
+ */
+-static void sugov_iowait_apply(struct sugov_cpu *sg_cpu, u64 time,
+- unsigned long *util, unsigned long *max)
++static unsigned long sugov_iowait_apply(struct sugov_cpu *sg_cpu, u64 time,
++ unsigned long util, unsigned long max)
+ {
+- unsigned int boost_util, boost_max;
++ unsigned long boost;
+
+ /* No boost currently required */
+ if (!sg_cpu->iowait_boost)
+- return;
++ return util;
+
+ /* Reset boost if the CPU appears to have been idle enough */
+ if (sugov_iowait_reset(sg_cpu, time, false))
+- return;
++ return util;
+
+- /*
+- * An IO waiting task has just woken up:
+- * allow to further double the boost value
+- */
+- if (sg_cpu->iowait_boost_pending) {
+- sg_cpu->iowait_boost_pending = false;
+- } else {
++ if (!sg_cpu->iowait_boost_pending) {
+ /*
+- * Otherwise: reduce the boost value and disable it when we
+- * reach the minimum.
++ * No boost pending; reduce the boost value.
+ */
+ sg_cpu->iowait_boost >>= 1;
+- if (sg_cpu->iowait_boost < sg_cpu->sg_policy->policy->min) {
++ if (sg_cpu->iowait_boost < sg_cpu->min) {
+ sg_cpu->iowait_boost = 0;
+- return;
++ return util;
+ }
+ }
+
++ sg_cpu->iowait_boost_pending = false;
++
+ /*
+- * Apply the current boost value: a CPU is boosted only if its current
+- * utilization is smaller then the current IO boost level.
++ * @util is already in capacity scale; convert iowait_boost
++ * into the same scale so we can compare.
+ */
+- boost_util = sg_cpu->iowait_boost;
+- boost_max = sg_cpu->iowait_boost_max;
+- if (*util * boost_max < *max * boost_util) {
+- *util = boost_util;
+- *max = boost_max;
+- }
++ boost = (sg_cpu->iowait_boost * max) >> SCHED_CAPACITY_SHIFT;
++ return max(boost, util);
+ }
+
+ #ifdef CONFIG_NO_HZ_COMMON
+@@ -440,7 +429,7 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
+
+ util = sugov_get_util(sg_cpu);
+ max = sg_cpu->max;
+- sugov_iowait_apply(sg_cpu, time, &util, &max);
++ util = sugov_iowait_apply(sg_cpu, time, util, max);
+ next_f = get_next_freq(sg_policy, util, max);
+ /*
+ * Do not reduce the frequency if the CPU has not been idle
+@@ -480,7 +469,7 @@ static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu, u64 time)
+
+ j_util = sugov_get_util(j_sg_cpu);
+ j_max = j_sg_cpu->max;
+- sugov_iowait_apply(j_sg_cpu, time, &j_util, &j_max);
++ j_util = sugov_iowait_apply(j_sg_cpu, time, j_util, j_max);
+
+ if (j_util * max > j_max * util) {
+ util = j_util;
+@@ -817,7 +806,9 @@ static int sugov_start(struct cpufreq_policy *policy)
+ memset(sg_cpu, 0, sizeof(*sg_cpu));
+ sg_cpu->cpu = cpu;
+ sg_cpu->sg_policy = sg_policy;
+- sg_cpu->iowait_boost_max = policy->cpuinfo.max_freq;
++ sg_cpu->min =
++ (SCHED_CAPACITY_SCALE * policy->cpuinfo.min_freq) /
++ policy->cpuinfo.max_freq;
+ }
+
+ for_each_cpu(cpu, policy->cpus) {
+diff --git a/lib/div64.c b/lib/div64.c
+index 01c8602bb6ff..ee146bb4c558 100644
+--- a/lib/div64.c
++++ b/lib/div64.c
+@@ -109,7 +109,7 @@ u64 div64_u64_rem(u64 dividend, u64 divisor, u64 *remainder)
+ quot = div_u64_rem(dividend, divisor, &rem32);
+ *remainder = rem32;
+ } else {
+- int n = 1 + fls(high);
++ int n = fls(high);
+ quot = div_u64(dividend >> n, divisor >> n);
+
+ if (quot != 0)
+@@ -147,7 +147,7 @@ u64 div64_u64(u64 dividend, u64 divisor)
+ if (high == 0) {
+ quot = div_u64(dividend, divisor);
+ } else {
+- int n = 1 + fls(high);
++ int n = fls(high);
+ quot = div_u64(dividend >> n, divisor >> n);
+
+ if (quot != 0)
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index 7878da76abf2..2878dc4e9af6 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -1547,6 +1547,10 @@ static void zoneinfo_show_print(struct seq_file *m, pg_data_t *pgdat,
+ if (is_zone_first_populated(pgdat, zone)) {
+ seq_printf(m, "\n per-node stats");
+ for (i = 0; i < NR_VM_NODE_STAT_ITEMS; i++) {
++ /* Skip hidden vmstat items. */
++ if (*vmstat_text[i + NR_VM_ZONE_STAT_ITEMS +
++ NR_VM_NUMA_STAT_ITEMS] == '\0')
++ continue;
+ seq_printf(m, "\n %-12s %lu",
+ vmstat_text[i + NR_VM_ZONE_STAT_ITEMS +
+ NR_VM_NUMA_STAT_ITEMS],
+diff --git a/net/9p/protocol.c b/net/9p/protocol.c
+index ee32bbf12675..b4d80c533f89 100644
+--- a/net/9p/protocol.c
++++ b/net/9p/protocol.c
+@@ -571,9 +571,10 @@ int p9stat_read(struct p9_client *clnt, char *buf, int len, struct p9_wstat *st)
+ if (ret) {
+ p9_debug(P9_DEBUG_9P, "<<< p9stat_read failed: %d\n", ret);
+ trace_9p_protocol_dump(clnt, &fake_pdu);
++ return ret;
+ }
+
+- return ret;
++ return fake_pdu.offset;
+ }
+ EXPORT_SYMBOL(p9stat_read);
+
+diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c
+index 8006295f8bd7..dda73991bb54 100644
+--- a/net/appletalk/atalk_proc.c
++++ b/net/appletalk/atalk_proc.c
+@@ -255,7 +255,7 @@ out_interface:
+ goto out;
+ }
+
+-void __exit atalk_proc_exit(void)
++void atalk_proc_exit(void)
+ {
+ remove_proc_entry("interface", atalk_proc_dir);
+ remove_proc_entry("route", atalk_proc_dir);
+diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
+index 9b6bc5abe946..795fbc6c06aa 100644
+--- a/net/appletalk/ddp.c
++++ b/net/appletalk/ddp.c
+@@ -1910,12 +1910,16 @@ static const char atalk_err_snap[] __initconst =
+ /* Called by proto.c on kernel start up */
+ static int __init atalk_init(void)
+ {
+- int rc = proto_register(&ddp_proto, 0);
++ int rc;
+
+- if (rc != 0)
++ rc = proto_register(&ddp_proto, 0);
++ if (rc)
+ goto out;
+
+- (void)sock_register(&atalk_family_ops);
++ rc = sock_register(&atalk_family_ops);
++ if (rc)
++ goto out_proto;
++
+ ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv);
+ if (!ddp_dl)
+ printk(atalk_err_snap);
+@@ -1923,12 +1927,33 @@ static int __init atalk_init(void)
+ dev_add_pack(<alk_packet_type);
+ dev_add_pack(&ppptalk_packet_type);
+
+- register_netdevice_notifier(&ddp_notifier);
++ rc = register_netdevice_notifier(&ddp_notifier);
++ if (rc)
++ goto out_sock;
++
+ aarp_proto_init();
+- atalk_proc_init();
+- atalk_register_sysctl();
++ rc = atalk_proc_init();
++ if (rc)
++ goto out_aarp;
++
++ rc = atalk_register_sysctl();
++ if (rc)
++ goto out_proc;
+ out:
+ return rc;
++out_proc:
++ atalk_proc_exit();
++out_aarp:
++ aarp_cleanup_module();
++ unregister_netdevice_notifier(&ddp_notifier);
++out_sock:
++ dev_remove_pack(&ppptalk_packet_type);
++ dev_remove_pack(<alk_packet_type);
++ unregister_snap_client(ddp_dl);
++ sock_unregister(PF_APPLETALK);
++out_proto:
++ proto_unregister(&ddp_proto);
++ goto out;
+ }
+ module_init(atalk_init);
+
+diff --git a/net/appletalk/sysctl_net_atalk.c b/net/appletalk/sysctl_net_atalk.c
+index c744a853fa5f..d945b7c0176d 100644
+--- a/net/appletalk/sysctl_net_atalk.c
++++ b/net/appletalk/sysctl_net_atalk.c
+@@ -45,9 +45,12 @@ static struct ctl_table atalk_table[] = {
+
+ static struct ctl_table_header *atalk_table_header;
+
+-void atalk_register_sysctl(void)
++int __init atalk_register_sysctl(void)
+ {
+ atalk_table_header = register_net_sysctl(&init_net, "net/appletalk", atalk_table);
++ if (!atalk_table_header)
++ return -ENOMEM;
++ return 0;
+ }
+
+ void atalk_unregister_sysctl(void)
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 74b29c7d841c..a06f03047717 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3084,6 +3084,8 @@ struct hci_dev *hci_alloc_dev(void)
+ hdev->le_max_tx_time = 0x0148;
+ hdev->le_max_rx_len = 0x001b;
+ hdev->le_max_rx_time = 0x0148;
++ hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
++ hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
+ hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
+ hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
+
+diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
+index 73f7211d0431..a1c1b7e8a45c 100644
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -88,9 +88,6 @@ struct smp_dev {
+ u8 local_rand[16];
+ bool debug_key;
+
+- u8 min_key_size;
+- u8 max_key_size;
+-
+ struct crypto_cipher *tfm_aes;
+ struct crypto_shash *tfm_cmac;
+ struct crypto_kpp *tfm_ecdh;
+@@ -720,7 +717,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
+ if (rsp == NULL) {
+ req->io_capability = conn->hcon->io_capability;
+ req->oob_flag = oob_flag;
+- req->max_key_size = SMP_DEV(hdev)->max_key_size;
++ req->max_key_size = hdev->le_max_key_size;
+ req->init_key_dist = local_dist;
+ req->resp_key_dist = remote_dist;
+ req->auth_req = (authreq & AUTH_REQ_MASK(hdev));
+@@ -731,7 +728,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn,
+
+ rsp->io_capability = conn->hcon->io_capability;
+ rsp->oob_flag = oob_flag;
+- rsp->max_key_size = SMP_DEV(hdev)->max_key_size;
++ rsp->max_key_size = hdev->le_max_key_size;
+ rsp->init_key_dist = req->init_key_dist & remote_dist;
+ rsp->resp_key_dist = req->resp_key_dist & local_dist;
+ rsp->auth_req = (authreq & AUTH_REQ_MASK(hdev));
+@@ -745,7 +742,7 @@ static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size)
+ struct hci_dev *hdev = conn->hcon->hdev;
+ struct smp_chan *smp = chan->data;
+
+- if (max_key_size > SMP_DEV(hdev)->max_key_size ||
++ if (max_key_size > hdev->le_max_key_size ||
+ max_key_size < SMP_MIN_ENC_KEY_SIZE)
+ return SMP_ENC_KEY_SIZE;
+
+@@ -3264,8 +3261,6 @@ static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
+ smp->tfm_aes = tfm_aes;
+ smp->tfm_cmac = tfm_cmac;
+ smp->tfm_ecdh = tfm_ecdh;
+- smp->min_key_size = SMP_MIN_ENC_KEY_SIZE;
+- smp->max_key_size = SMP_MAX_ENC_KEY_SIZE;
+
+ create_chan:
+ chan = l2cap_chan_create();
+@@ -3391,7 +3386,7 @@ static ssize_t le_min_key_size_read(struct file *file,
+ struct hci_dev *hdev = file->private_data;
+ char buf[4];
+
+- snprintf(buf, sizeof(buf), "%2u\n", SMP_DEV(hdev)->min_key_size);
++ snprintf(buf, sizeof(buf), "%2u\n", hdev->le_min_key_size);
+
+ return simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
+ }
+@@ -3412,11 +3407,11 @@ static ssize_t le_min_key_size_write(struct file *file,
+
+ sscanf(buf, "%hhu", &key_size);
+
+- if (key_size > SMP_DEV(hdev)->max_key_size ||
++ if (key_size > hdev->le_max_key_size ||
+ key_size < SMP_MIN_ENC_KEY_SIZE)
+ return -EINVAL;
+
+- SMP_DEV(hdev)->min_key_size = key_size;
++ hdev->le_min_key_size = key_size;
+
+ return count;
+ }
+@@ -3435,7 +3430,7 @@ static ssize_t le_max_key_size_read(struct file *file,
+ struct hci_dev *hdev = file->private_data;
+ char buf[4];
+
+- snprintf(buf, sizeof(buf), "%2u\n", SMP_DEV(hdev)->max_key_size);
++ snprintf(buf, sizeof(buf), "%2u\n", hdev->le_max_key_size);
+
+ return simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
+ }
+@@ -3457,10 +3452,10 @@ static ssize_t le_max_key_size_write(struct file *file,
+ sscanf(buf, "%hhu", &key_size);
+
+ if (key_size > SMP_MAX_ENC_KEY_SIZE ||
+- key_size < SMP_DEV(hdev)->min_key_size)
++ key_size < hdev->le_min_key_size)
+ return -EINVAL;
+
+- SMP_DEV(hdev)->max_key_size = key_size;
++ hdev->le_max_key_size = key_size;
+
+ return count;
+ }
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index c4a7db62658e..01ecd510014f 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1743,6 +1743,9 @@ static int ip6erspan_tap_validate(struct nlattr *tb[], struct nlattr *data[],
+ static void ip6erspan_set_version(struct nlattr *data[],
+ struct __ip6_tnl_parm *parms)
+ {
++ if (!data)
++ return;
++
+ parms->erspan_ver = 1;
+ if (data[IFLA_GRE_ERSPAN_VER])
+ parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
+diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
+index f5b4febeaa25..bc65db782bfb 100644
+--- a/net/ipv6/xfrm6_tunnel.c
++++ b/net/ipv6/xfrm6_tunnel.c
+@@ -344,8 +344,8 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
+ struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
+ unsigned int i;
+
+- xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
+ xfrm_flush_gc();
++ xfrm_state_flush(net, IPSEC_PROTO_ANY, false, true);
+
+ for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
+ WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i]));
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 7da629d59717..7d4bed955060 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1773,7 +1773,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_m
+ if (proto == 0)
+ return -EINVAL;
+
+- err = xfrm_state_flush(net, proto, true);
++ err = xfrm_state_flush(net, proto, true, false);
+ err2 = unicast_flush_resp(sk, hdr);
+ if (err || err2) {
+ if (err == -ESRCH) /* empty table - go quietly */
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 7d424fd27025..c06393fc716d 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -7203,9 +7203,6 @@ static void __nft_release_tables(struct net *net)
+
+ list_for_each_entry(chain, &table->chains, list)
+ nf_tables_unregister_hook(net, table, chain);
+- list_for_each_entry(flowtable, &table->flowtables, list)
+- nf_unregister_net_hooks(net, flowtable->ops,
+- flowtable->ops_len);
+ /* No packets are walking on these chains anymore. */
+ ctx.table = table;
+ list_for_each_entry(chain, &table->chains, list) {
+diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
+index 5d92e1781980..5cb1ecb29ea4 100644
+--- a/net/netfilter/xt_cgroup.c
++++ b/net/netfilter/xt_cgroup.c
+@@ -68,6 +68,38 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
+ return 0;
+ }
+
++static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
++{
++ struct xt_cgroup_info_v2 *info = par->matchinfo;
++ struct cgroup *cgrp;
++
++ if ((info->invert_path & ~1) || (info->invert_classid & ~1))
++ return -EINVAL;
++
++ if (!info->has_path && !info->has_classid) {
++ pr_info("xt_cgroup: no path or classid specified\n");
++ return -EINVAL;
++ }
++
++ if (info->has_path && info->has_classid) {
++ pr_info_ratelimited("path and classid specified\n");
++ return -EINVAL;
++ }
++
++ info->priv = NULL;
++ if (info->has_path) {
++ cgrp = cgroup_get_from_path(info->path);
++ if (IS_ERR(cgrp)) {
++ pr_info_ratelimited("invalid path, errno=%ld\n",
++ PTR_ERR(cgrp));
++ return -EINVAL;
++ }
++ info->priv = cgrp;
++ }
++
++ return 0;
++}
++
+ static bool
+ cgroup_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
+ {
+@@ -99,6 +131,24 @@ static bool cgroup_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
+ info->invert_classid;
+ }
+
++static bool cgroup_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
++{
++ const struct xt_cgroup_info_v2 *info = par->matchinfo;
++ struct sock_cgroup_data *skcd = &skb->sk->sk_cgrp_data;
++ struct cgroup *ancestor = info->priv;
++ struct sock *sk = skb->sk;
++
++ if (!sk || !sk_fullsock(sk) || !net_eq(xt_net(par), sock_net(sk)))
++ return false;
++
++ if (ancestor)
++ return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
++ info->invert_path;
++ else
++ return (info->classid == sock_cgroup_classid(skcd)) ^
++ info->invert_classid;
++}
++
+ static void cgroup_mt_destroy_v1(const struct xt_mtdtor_param *par)
+ {
+ struct xt_cgroup_info_v1 *info = par->matchinfo;
+@@ -107,6 +157,14 @@ static void cgroup_mt_destroy_v1(const struct xt_mtdtor_param *par)
+ cgroup_put(info->priv);
+ }
+
++static void cgroup_mt_destroy_v2(const struct xt_mtdtor_param *par)
++{
++ struct xt_cgroup_info_v2 *info = par->matchinfo;
++
++ if (info->priv)
++ cgroup_put(info->priv);
++}
++
+ static struct xt_match cgroup_mt_reg[] __read_mostly = {
+ {
+ .name = "cgroup",
+@@ -134,6 +192,20 @@ static struct xt_match cgroup_mt_reg[] __read_mostly = {
+ (1 << NF_INET_POST_ROUTING) |
+ (1 << NF_INET_LOCAL_IN),
+ },
++ {
++ .name = "cgroup",
++ .revision = 2,
++ .family = NFPROTO_UNSPEC,
++ .checkentry = cgroup_mt_check_v2,
++ .match = cgroup_mt_v2,
++ .matchsize = sizeof(struct xt_cgroup_info_v2),
++ .usersize = offsetof(struct xt_cgroup_info_v2, priv),
++ .destroy = cgroup_mt_destroy_v2,
++ .me = THIS_MODULE,
++ .hooks = (1 << NF_INET_LOCAL_OUT) |
++ (1 << NF_INET_POST_ROUTING) |
++ (1 << NF_INET_LOCAL_IN),
++ },
+ };
+
+ static int __init cgroup_mt_init(void)
+diff --git a/net/rds/rdma.c b/net/rds/rdma.c
+index 98237feb607a..e1965d9cbcf8 100644
+--- a/net/rds/rdma.c
++++ b/net/rds/rdma.c
+@@ -517,9 +517,10 @@ static int rds_rdma_pages(struct rds_iovec iov[], int nr_iovecs)
+ return tot_pages;
+ }
+
+-int rds_rdma_extra_size(struct rds_rdma_args *args)
++int rds_rdma_extra_size(struct rds_rdma_args *args,
++ struct rds_iov_vector *iov)
+ {
+- struct rds_iovec vec;
++ struct rds_iovec *vec;
+ struct rds_iovec __user *local_vec;
+ int tot_pages = 0;
+ unsigned int nr_pages;
+@@ -530,13 +531,23 @@ int rds_rdma_extra_size(struct rds_rdma_args *args)
+ if (args->nr_local == 0)
+ return -EINVAL;
+
++ iov->iov = kcalloc(args->nr_local,
++ sizeof(struct rds_iovec),
++ GFP_KERNEL);
++ if (!iov->iov)
++ return -ENOMEM;
++
++ vec = &iov->iov[0];
++
++ if (copy_from_user(vec, local_vec, args->nr_local *
++ sizeof(struct rds_iovec)))
++ return -EFAULT;
++ iov->len = args->nr_local;
++
+ /* figure out the number of pages in the vector */
+- for (i = 0; i < args->nr_local; i++) {
+- if (copy_from_user(&vec, &local_vec[i],
+- sizeof(struct rds_iovec)))
+- return -EFAULT;
++ for (i = 0; i < args->nr_local; i++, vec++) {
+
+- nr_pages = rds_pages_in_vec(&vec);
++ nr_pages = rds_pages_in_vec(vec);
+ if (nr_pages == 0)
+ return -EINVAL;
+
+@@ -558,15 +569,15 @@ int rds_rdma_extra_size(struct rds_rdma_args *args)
+ * Extract all arguments and set up the rdma_op
+ */
+ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+- struct cmsghdr *cmsg)
++ struct cmsghdr *cmsg,
++ struct rds_iov_vector *vec)
+ {
+ struct rds_rdma_args *args;
+ struct rm_rdma_op *op = &rm->rdma;
+ int nr_pages;
+ unsigned int nr_bytes;
+ struct page **pages = NULL;
+- struct rds_iovec iovstack[UIO_FASTIOV], *iovs = iovstack;
+- int iov_size;
++ struct rds_iovec *iovs;
+ unsigned int i, j;
+ int ret = 0;
+
+@@ -586,31 +597,23 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+ goto out_ret;
+ }
+
+- /* Check whether to allocate the iovec area */
+- iov_size = args->nr_local * sizeof(struct rds_iovec);
+- if (args->nr_local > UIO_FASTIOV) {
+- iovs = sock_kmalloc(rds_rs_to_sk(rs), iov_size, GFP_KERNEL);
+- if (!iovs) {
+- ret = -ENOMEM;
+- goto out_ret;
+- }
++ if (vec->len != args->nr_local) {
++ ret = -EINVAL;
++ goto out_ret;
+ }
+
+- if (copy_from_user(iovs, (struct rds_iovec __user *)(unsigned long) args->local_vec_addr, iov_size)) {
+- ret = -EFAULT;
+- goto out;
+- }
++ iovs = vec->iov;
+
+ nr_pages = rds_rdma_pages(iovs, args->nr_local);
+ if (nr_pages < 0) {
+ ret = -EINVAL;
+- goto out;
++ goto out_ret;
+ }
+
+ pages = kcalloc(nr_pages, sizeof(struct page *), GFP_KERNEL);
+ if (!pages) {
+ ret = -ENOMEM;
+- goto out;
++ goto out_ret;
+ }
+
+ op->op_write = !!(args->flags & RDS_RDMA_READWRITE);
+@@ -623,7 +626,7 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+ op->op_sg = rds_message_alloc_sgs(rm, nr_pages);
+ if (!op->op_sg) {
+ ret = -ENOMEM;
+- goto out;
++ goto out_pages;
+ }
+
+ if (op->op_notify || op->op_recverr) {
+@@ -635,7 +638,7 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+ op->op_notifier = kmalloc(sizeof(struct rds_notifier), GFP_KERNEL);
+ if (!op->op_notifier) {
+ ret = -ENOMEM;
+- goto out;
++ goto out_pages;
+ }
+ op->op_notifier->n_user_token = args->user_token;
+ op->op_notifier->n_status = RDS_RDMA_SUCCESS;
+@@ -681,7 +684,7 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+ */
+ ret = rds_pin_pages(iov->addr, nr, pages, !op->op_write);
+ if (ret < 0)
+- goto out;
++ goto out_pages;
+ else
+ ret = 0;
+
+@@ -714,13 +717,11 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+ nr_bytes,
+ (unsigned int) args->remote_vec.bytes);
+ ret = -EINVAL;
+- goto out;
++ goto out_pages;
+ }
+ op->op_bytes = nr_bytes;
+
+-out:
+- if (iovs != iovstack)
+- sock_kfree_s(rds_rs_to_sk(rs), iovs, iov_size);
++out_pages:
+ kfree(pages);
+ out_ret:
+ if (ret)
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index c4dcf654d8fe..4234ab81b5af 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -386,6 +386,18 @@ static inline void rds_message_zcopy_queue_init(struct rds_msg_zcopy_queue *q)
+ INIT_LIST_HEAD(&q->zcookie_head);
+ }
+
++struct rds_iov_vector {
++ struct rds_iovec *iov;
++ int len;
++};
++
++struct rds_iov_vector_arr {
++ struct rds_iov_vector *vec;
++ int len;
++ int indx;
++ int incr;
++};
++
+ struct rds_message {
+ refcount_t m_refcount;
+ struct list_head m_sock_item;
+@@ -904,13 +916,13 @@ int rds_get_mr(struct rds_sock *rs, char __user *optval, int optlen);
+ int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen);
+ int rds_free_mr(struct rds_sock *rs, char __user *optval, int optlen);
+ void rds_rdma_drop_keys(struct rds_sock *rs);
+-int rds_rdma_extra_size(struct rds_rdma_args *args);
+-int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+- struct cmsghdr *cmsg);
++int rds_rdma_extra_size(struct rds_rdma_args *args,
++ struct rds_iov_vector *iov);
+ int rds_cmsg_rdma_dest(struct rds_sock *rs, struct rds_message *rm,
+ struct cmsghdr *cmsg);
+ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+- struct cmsghdr *cmsg);
++ struct cmsghdr *cmsg,
++ struct rds_iov_vector *vec);
+ int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm,
+ struct cmsghdr *cmsg);
+ void rds_rdma_free_op(struct rm_rdma_op *ro);
+diff --git a/net/rds/send.c b/net/rds/send.c
+index fe785ee819dd..ec2267cbf85f 100644
+--- a/net/rds/send.c
++++ b/net/rds/send.c
+@@ -876,13 +876,15 @@ out:
+ * rds_message is getting to be quite complicated, and we'd like to allocate
+ * it all in one go. This figures out how big it needs to be up front.
+ */
+-static int rds_rm_size(struct msghdr *msg, int num_sgs)
++static int rds_rm_size(struct msghdr *msg, int num_sgs,
++ struct rds_iov_vector_arr *vct)
+ {
+ struct cmsghdr *cmsg;
+ int size = 0;
+ int cmsg_groups = 0;
+ int retval;
+ bool zcopy_cookie = false;
++ struct rds_iov_vector *iov, *tmp_iov;
+
+ for_each_cmsghdr(cmsg, msg) {
+ if (!CMSG_OK(msg, cmsg))
+@@ -893,8 +895,24 @@ static int rds_rm_size(struct msghdr *msg, int num_sgs)
+
+ switch (cmsg->cmsg_type) {
+ case RDS_CMSG_RDMA_ARGS:
++ if (vct->indx >= vct->len) {
++ vct->len += vct->incr;
++ tmp_iov =
++ krealloc(vct->vec,
++ vct->len *
++ sizeof(struct rds_iov_vector),
++ GFP_KERNEL);
++ if (!tmp_iov) {
++ vct->len -= vct->incr;
++ return -ENOMEM;
++ }
++ vct->vec = tmp_iov;
++ }
++ iov = &vct->vec[vct->indx];
++ memset(iov, 0, sizeof(struct rds_iov_vector));
++ vct->indx++;
+ cmsg_groups |= 1;
+- retval = rds_rdma_extra_size(CMSG_DATA(cmsg));
++ retval = rds_rdma_extra_size(CMSG_DATA(cmsg), iov);
+ if (retval < 0)
+ return retval;
+ size += retval;
+@@ -951,10 +969,11 @@ static int rds_cmsg_zcopy(struct rds_sock *rs, struct rds_message *rm,
+ }
+
+ static int rds_cmsg_send(struct rds_sock *rs, struct rds_message *rm,
+- struct msghdr *msg, int *allocated_mr)
++ struct msghdr *msg, int *allocated_mr,
++ struct rds_iov_vector_arr *vct)
+ {
+ struct cmsghdr *cmsg;
+- int ret = 0;
++ int ret = 0, ind = 0;
+
+ for_each_cmsghdr(cmsg, msg) {
+ if (!CMSG_OK(msg, cmsg))
+@@ -968,7 +987,10 @@ static int rds_cmsg_send(struct rds_sock *rs, struct rds_message *rm,
+ */
+ switch (cmsg->cmsg_type) {
+ case RDS_CMSG_RDMA_ARGS:
+- ret = rds_cmsg_rdma_args(rs, rm, cmsg);
++ if (ind >= vct->indx)
++ return -ENOMEM;
++ ret = rds_cmsg_rdma_args(rs, rm, cmsg, &vct->vec[ind]);
++ ind++;
+ break;
+
+ case RDS_CMSG_RDMA_DEST:
+@@ -1084,6 +1106,11 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
+ sock_flag(rds_rs_to_sk(rs), SOCK_ZEROCOPY));
+ int num_sgs = ceil(payload_len, PAGE_SIZE);
+ int namelen;
++ struct rds_iov_vector_arr vct = {0};
++ int ind;
++
++ /* expect 1 RDMA CMSG per rds_sendmsg. can still grow if more needed. */
++ vct.incr = 1;
+
+ /* Mirror Linux UDP mirror of BSD error message compatibility */
+ /* XXX: Perhaps MSG_MORE someday */
+@@ -1220,7 +1247,7 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
+ num_sgs = iov_iter_npages(&msg->msg_iter, INT_MAX);
+ }
+ /* size of rm including all sgs */
+- ret = rds_rm_size(msg, num_sgs);
++ ret = rds_rm_size(msg, num_sgs, &vct);
+ if (ret < 0)
+ goto out;
+
+@@ -1270,7 +1297,7 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
+ rm->m_conn_path = cpath;
+
+ /* Parse any control messages the user may have included. */
+- ret = rds_cmsg_send(rs, rm, msg, &allocated_mr);
++ ret = rds_cmsg_send(rs, rm, msg, &allocated_mr, &vct);
+ if (ret) {
+ /* Trigger connection so that its ready for the next retry */
+ if (ret == -EAGAIN)
+@@ -1348,9 +1375,18 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
+ if (ret)
+ goto out;
+ rds_message_put(rm);
++
++ for (ind = 0; ind < vct.indx; ind++)
++ kfree(vct.vec[ind].iov);
++ kfree(vct.vec);
++
+ return payload_len;
+
+ out:
++ for (ind = 0; ind < vct.indx; ind++)
++ kfree(vct.vec[ind].iov);
++ kfree(vct.vec);
++
+ /* If the user included a RDMA_MAP cmsg, we allocated a MR on the fly.
+ * If the sendmsg goes through, we keep the MR. If it fails with EAGAIN
+ * or in any other way, we need to destroy the MR again */
+diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
+index 6e419b15a9f8..c979a56faaef 100644
+--- a/net/rxrpc/conn_client.c
++++ b/net/rxrpc/conn_client.c
+@@ -707,6 +707,7 @@ int rxrpc_connect_call(struct rxrpc_sock *rx,
+
+ ret = rxrpc_wait_for_channel(call, gfp);
+ if (ret < 0) {
++ trace_rxrpc_client(call->conn, ret, rxrpc_client_chan_wait_failed);
+ rxrpc_disconnect_client_call(call);
+ goto out;
+ }
+@@ -777,16 +778,22 @@ static void rxrpc_set_client_reap_timer(struct rxrpc_net *rxnet)
+ */
+ void rxrpc_disconnect_client_call(struct rxrpc_call *call)
+ {
+- unsigned int channel = call->cid & RXRPC_CHANNELMASK;
+ struct rxrpc_connection *conn = call->conn;
+- struct rxrpc_channel *chan = &conn->channels[channel];
++ struct rxrpc_channel *chan = NULL;
+ struct rxrpc_net *rxnet = conn->params.local->rxnet;
++ unsigned int channel = -1;
++ u32 cid;
+
++ spin_lock(&conn->channel_lock);
++
++ cid = call->cid;
++ if (cid) {
++ channel = cid & RXRPC_CHANNELMASK;
++ chan = &conn->channels[channel];
++ }
+ trace_rxrpc_client(conn, channel, rxrpc_client_chan_disconnect);
+ call->conn = NULL;
+
+- spin_lock(&conn->channel_lock);
+-
+ /* Calls that have never actually been assigned a channel can simply be
+ * discarded. If the conn didn't get used either, it will follow
+ * immediately unless someone else grabs it in the meantime.
+@@ -810,7 +817,10 @@ void rxrpc_disconnect_client_call(struct rxrpc_call *call)
+ goto out;
+ }
+
+- ASSERTCMP(rcu_access_pointer(chan->call), ==, call);
++ if (rcu_access_pointer(chan->call) != call) {
++ spin_unlock(&conn->channel_lock);
++ BUG();
++ }
+
+ /* If a client call was exposed to the world, we save the result for
+ * retransmission.
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index cc0203efb584..3f729cd512af 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -432,7 +432,7 @@ void xfrm_state_free(struct xfrm_state *x)
+ }
+ EXPORT_SYMBOL(xfrm_state_free);
+
+-static void xfrm_state_gc_destroy(struct xfrm_state *x)
++static void ___xfrm_state_destroy(struct xfrm_state *x)
+ {
+ tasklet_hrtimer_cancel(&x->mtimer);
+ del_timer_sync(&x->rtimer);
+@@ -474,7 +474,7 @@ static void xfrm_state_gc_task(struct work_struct *work)
+ synchronize_rcu();
+
+ hlist_for_each_entry_safe(x, tmp, &gc_list, gclist)
+- xfrm_state_gc_destroy(x);
++ ___xfrm_state_destroy(x);
+ }
+
+ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)
+@@ -598,14 +598,19 @@ struct xfrm_state *xfrm_state_alloc(struct net *net)
+ }
+ EXPORT_SYMBOL(xfrm_state_alloc);
+
+-void __xfrm_state_destroy(struct xfrm_state *x)
++void __xfrm_state_destroy(struct xfrm_state *x, bool sync)
+ {
+ WARN_ON(x->km.state != XFRM_STATE_DEAD);
+
+- spin_lock_bh(&xfrm_state_gc_lock);
+- hlist_add_head(&x->gclist, &xfrm_state_gc_list);
+- spin_unlock_bh(&xfrm_state_gc_lock);
+- schedule_work(&xfrm_state_gc_work);
++ if (sync) {
++ synchronize_rcu();
++ ___xfrm_state_destroy(x);
++ } else {
++ spin_lock_bh(&xfrm_state_gc_lock);
++ hlist_add_head(&x->gclist, &xfrm_state_gc_list);
++ spin_unlock_bh(&xfrm_state_gc_lock);
++ schedule_work(&xfrm_state_gc_work);
++ }
+ }
+ EXPORT_SYMBOL(__xfrm_state_destroy);
+
+@@ -708,7 +713,7 @@ xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool
+ }
+ #endif
+
+-int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
++int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync)
+ {
+ int i, err = 0, cnt = 0;
+
+@@ -730,7 +735,10 @@ restart:
+ err = xfrm_state_delete(x);
+ xfrm_audit_state_delete(x, err ? 0 : 1,
+ task_valid);
+- xfrm_state_put(x);
++ if (sync)
++ xfrm_state_put_sync(x);
++ else
++ xfrm_state_put(x);
+ if (!err)
+ cnt++;
+
+@@ -2217,7 +2225,7 @@ void xfrm_state_delete_tunnel(struct xfrm_state *x)
+ if (atomic_read(&t->tunnel_users) == 2)
+ xfrm_state_delete(t);
+ atomic_dec(&t->tunnel_users);
+- xfrm_state_put(t);
++ xfrm_state_put_sync(t);
+ x->tunnel = NULL;
+ }
+ }
+@@ -2377,8 +2385,8 @@ void xfrm_state_fini(struct net *net)
+ unsigned int sz;
+
+ flush_work(&net->xfrm.state_hash_work);
+- xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
+ flush_work(&xfrm_state_gc_work);
++ xfrm_state_flush(net, IPSEC_PROTO_ANY, false, true);
+
+ WARN_ON(!list_empty(&net->xfrm.state_all));
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index ab557827aac0..7e4904b93004 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1932,7 +1932,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
+ struct xfrm_usersa_flush *p = nlmsg_data(nlh);
+ int err;
+
+- err = xfrm_state_flush(net, p->proto, true);
++ err = xfrm_state_flush(net, p->proto, true, false);
+ if (err) {
+ if (err == -ESRCH) /* empty table */
+ return 0;
+diff --git a/sound/drivers/opl3/opl3_voice.h b/sound/drivers/opl3/opl3_voice.h
+index 5b02bd49fde4..4e4ecc21760b 100644
+--- a/sound/drivers/opl3/opl3_voice.h
++++ b/sound/drivers/opl3/opl3_voice.h
+@@ -41,7 +41,7 @@ void snd_opl3_timer_func(struct timer_list *t);
+
+ /* Prototypes for opl3_drums.c */
+ void snd_opl3_load_drums(struct snd_opl3 *opl3);
+-void snd_opl3_drum_switch(struct snd_opl3 *opl3, int note, int on_off, int vel, struct snd_midi_channel *chan);
++void snd_opl3_drum_switch(struct snd_opl3 *opl3, int note, int vel, int on_off, struct snd_midi_channel *chan);
+
+ /* Prototypes for opl3_oss.c */
+ #if IS_ENABLED(CONFIG_SND_SEQUENCER_OSS)
+diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c
+index d77dcba276b5..1eb8b61a185b 100644
+--- a/sound/isa/sb/sb8.c
++++ b/sound/isa/sb/sb8.c
+@@ -111,6 +111,10 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev)
+
+ /* block the 0x388 port to avoid PnP conflicts */
+ acard->fm_res = request_region(0x388, 4, "SoundBlaster FM");
++ if (!acard->fm_res) {
++ err = -EBUSY;
++ goto _err;
++ }
+
+ if (port[dev] != SNDRV_AUTO_PORT) {
+ if ((err = snd_sbdsp_create(card, port[dev], irq[dev],
+diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
+index 907cf1a46712..3ef2b27ebbe8 100644
+--- a/sound/pci/echoaudio/echoaudio.c
++++ b/sound/pci/echoaudio/echoaudio.c
+@@ -1954,6 +1954,11 @@ static int snd_echo_create(struct snd_card *card,
+ }
+ chip->dsp_registers = (volatile u32 __iomem *)
+ ioremap_nocache(chip->dsp_registers_phys, sz);
++ if (!chip->dsp_registers) {
++ dev_err(chip->card->dev, "ioremap failed\n");
++ snd_echo_free(chip);
++ return -ENOMEM;
++ }
+
+ if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED,
+ KBUILD_MODNAME, chip)) {
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b9d832bde23e..bd60eb7168fa 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5604,6 +5604,7 @@ enum {
+ ALC298_FIXUP_TPT470_DOCK,
+ ALC255_FIXUP_DUMMY_LINEOUT_VERB,
+ ALC255_FIXUP_DELL_HEADSET_MIC,
++ ALC256_FIXUP_HUAWEI_MBXP_PINS,
+ ALC295_FIXUP_HP_X360,
+ ALC221_FIXUP_HP_HEADSET_MIC,
+ ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+@@ -5892,6 +5893,22 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MIC
+ },
++ [ALC256_FIXUP_HUAWEI_MBXP_PINS] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ {0x12, 0x90a60130},
++ {0x13, 0x40000000},
++ {0x14, 0x90170110},
++ {0x18, 0x411111f0},
++ {0x19, 0x04a11040},
++ {0x1a, 0x411111f0},
++ {0x1b, 0x90170112},
++ {0x1d, 0x40759a05},
++ {0x1e, 0x411111f0},
++ {0x21, 0x04211020},
++ { }
++ },
++ },
+ [ALC269_FIXUP_ASUS_X101_FUNC] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc269_fixup_x101_headset_mic,
+@@ -6885,6 +6902,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+ SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
++ SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MBXP", ALC256_FIXUP_HUAWEI_MBXP_PINS),
+ SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
+
+ #if 0
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index 592efb370c44..f4dc3d445aae 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -373,7 +373,7 @@ int snd_soc_get_volsw_sx(struct snd_kcontrol *kcontrol,
+ unsigned int rshift = mc->rshift;
+ int max = mc->max;
+ int min = mc->min;
+- unsigned int mask = (1 << (fls(min + max) - 1)) - 1;
++ unsigned int mask = (1U << (fls(min + max) - 1)) - 1;
+ unsigned int val;
+ int ret;
+
+@@ -418,7 +418,7 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol,
+ unsigned int rshift = mc->rshift;
+ int max = mc->max;
+ int min = mc->min;
+- unsigned int mask = (1 << (fls(min + max) - 1)) - 1;
++ unsigned int mask = (1U << (fls(min + max) - 1)) - 1;
+ int err = 0;
+ unsigned int val, val_mask, val2 = 0;
+
+diff --git a/tools/perf/Documentation/perf-config.txt b/tools/perf/Documentation/perf-config.txt
+index 32f4a898e3f2..05c10eb56a0c 100644
+--- a/tools/perf/Documentation/perf-config.txt
++++ b/tools/perf/Documentation/perf-config.txt
+@@ -114,7 +114,7 @@ Given a $HOME/.perfconfig like this:
+
+ [report]
+ # Defaults
+- sort-order = comm,dso,symbol
++ sort_order = comm,dso,symbol
+ percent-limit = 0
+ queue-size = 0
+ children = true
+diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
+index d21d8751e749..33eefc33e0ea 100644
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -1491,8 +1491,9 @@ int cmd_top(int argc, const char **argv)
+ annotation_config__init();
+
+ symbol_conf.try_vmlinux_path = (symbol_conf.vmlinux_name == NULL);
+- if (symbol__init(NULL) < 0)
+- return -1;
++ status = symbol__init(NULL);
++ if (status < 0)
++ goto out_delete_evlist;
+
+ sort__setup_elide(stdout);
+
+diff --git a/tools/perf/tests/evsel-tp-sched.c b/tools/perf/tests/evsel-tp-sched.c
+index d0406116c905..926a8e1b5e94 100644
+--- a/tools/perf/tests/evsel-tp-sched.c
++++ b/tools/perf/tests/evsel-tp-sched.c
+@@ -85,5 +85,6 @@ int test__perf_evsel__tp_sched_test(struct test *test __maybe_unused, int subtes
+ if (perf_evsel__test_field(evsel, "target_cpu", 4, true))
+ ret = -1;
+
++ perf_evsel__delete(evsel);
+ return ret;
+ }
+diff --git a/tools/perf/tests/expr.c b/tools/perf/tests/expr.c
+index 01f0706995a9..9acc1e80b936 100644
+--- a/tools/perf/tests/expr.c
++++ b/tools/perf/tests/expr.c
+@@ -19,7 +19,7 @@ int test__expr(struct test *t __maybe_unused, int subtest __maybe_unused)
+ const char *p;
+ const char **other;
+ double val;
+- int ret;
++ int i, ret;
+ struct parse_ctx ctx;
+ int num_other;
+
+@@ -56,6 +56,9 @@ int test__expr(struct test *t __maybe_unused, int subtest __maybe_unused)
+ TEST_ASSERT_VAL("find other", !strcmp(other[1], "BAZ"));
+ TEST_ASSERT_VAL("find other", !strcmp(other[2], "BOZO"));
+ TEST_ASSERT_VAL("find other", other[3] == NULL);
++
++ for (i = 0; i < num_other; i++)
++ free((void *)other[i]);
+ free((void *)other);
+
+ return 0;
+diff --git a/tools/perf/tests/openat-syscall-all-cpus.c b/tools/perf/tests/openat-syscall-all-cpus.c
+index c531e6deb104..493ecb611540 100644
+--- a/tools/perf/tests/openat-syscall-all-cpus.c
++++ b/tools/perf/tests/openat-syscall-all-cpus.c
+@@ -45,7 +45,7 @@ int test__openat_syscall_event_on_all_cpus(struct test *test __maybe_unused, int
+ if (IS_ERR(evsel)) {
+ tracing_path__strerror_open_tp(errno, errbuf, sizeof(errbuf), "syscalls", "sys_enter_openat");
+ pr_debug("%s\n", errbuf);
+- goto out_thread_map_delete;
++ goto out_cpu_map_delete;
+ }
+
+ if (perf_evsel__open(evsel, cpus, threads) < 0) {
+@@ -119,6 +119,8 @@ out_close_fd:
+ perf_evsel__close_fd(evsel);
+ out_evsel_delete:
+ perf_evsel__delete(evsel);
++out_cpu_map_delete:
++ cpu_map__put(cpus);
+ out_thread_map_delete:
+ thread_map__put(threads);
+ return err;
+diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
+index 04b1d53e4bf9..1d352621bd48 100644
+--- a/tools/perf/util/build-id.c
++++ b/tools/perf/util/build-id.c
+@@ -183,6 +183,7 @@ char *build_id_cache__linkname(const char *sbuild_id, char *bf, size_t size)
+ return bf;
+ }
+
++/* The caller is responsible to free the returned buffer. */
+ char *build_id_cache__origname(const char *sbuild_id)
+ {
+ char *linkname;
+diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c
+index 5ac157056cdf..9bb742accfa5 100644
+--- a/tools/perf/util/config.c
++++ b/tools/perf/util/config.c
+@@ -628,11 +628,10 @@ static int collect_config(const char *var, const char *value,
+ }
+
+ ret = set_value(item, value);
+- return ret;
+
+ out_free:
+ free(key);
+- return -1;
++ return ret;
+ }
+
+ int perf_config_set__collect(struct perf_config_set *set, const char *file_name,
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index e7dbdcc8d465..b65ad5a273eb 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -1274,6 +1274,7 @@ void perf_evsel__exit(struct perf_evsel *evsel)
+ {
+ assert(list_empty(&evsel->node));
+ assert(evsel->evlist == NULL);
++ perf_evsel__free_counts(evsel);
+ perf_evsel__free_fd(evsel);
+ perf_evsel__free_id(evsel);
+ perf_evsel__free_config_terms(evsel);
+diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
+index 828cb9794c76..e1e94b44d588 100644
+--- a/tools/perf/util/hist.c
++++ b/tools/perf/util/hist.c
+@@ -1048,8 +1048,10 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al,
+
+ err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent,
+ iter->evsel, al, max_stack_depth);
+- if (err)
++ if (err) {
++ map__put(alm);
+ return err;
++ }
+
+ err = iter->ops->prepare_entry(iter, al);
+ if (err)
+diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
+index ebb18a9bc460..1a7c76d2baa8 100644
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -2263,6 +2263,7 @@ static bool is_event_supported(u8 type, unsigned config)
+ perf_evsel__delete(evsel);
+ }
+
++ thread_map__put(tmap);
+ return ret;
+ }
+
+@@ -2333,6 +2334,7 @@ void print_sdt_events(const char *subsys_glob, const char *event_glob,
+ printf(" %-50s [%s]\n", buf, "SDT event");
+ free(buf);
+ }
++ free(path);
+ } else
+ printf(" %-50s [%s]\n", nd->s, "SDT event");
+ if (nd2) {
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 980bd9d20646..83964f796edb 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -5054,6 +5054,9 @@ int fork_it(char **argv)
+ signal(SIGQUIT, SIG_IGN);
+ if (waitpid(child_pid, &status, 0) == -1)
+ err(status, "waitpid");
++
++ if (WIFEXITED(status))
++ status = WEXITSTATUS(status);
+ }
+ /*
+ * n.b. fork_it() does not check for errors from for_all_cpus()
+diff --git a/tools/usb/usbip/libsrc/vhci_driver.c b/tools/usb/usbip/libsrc/vhci_driver.c
+index 4204359c9fee..8159fd98680b 100644
+--- a/tools/usb/usbip/libsrc/vhci_driver.c
++++ b/tools/usb/usbip/libsrc/vhci_driver.c
+@@ -150,7 +150,7 @@ static int get_nports(struct udev_device *hc_device)
+
+ static int vhci_hcd_filter(const struct dirent *dirent)
+ {
+- return strcmp(dirent->d_name, "vhci_hcd") >= 0;
++ return !strncmp(dirent->d_name, "vhci_hcd.", 9);
+ }
+
+ static int get_ncontrollers(void)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-04-27 17:36 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-04-27 17:36 UTC (permalink / raw
To: gentoo-commits
commit: 9a14f331fb8aa8fdc24e235cd198f4d86616db6e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Apr 27 17:36:25 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Apr 27 17:36:25 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9a14f331
Linux patch 4.19.37
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1036_linux-4.19.37.patch | 5470 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5474 insertions(+)
diff --git a/0000_README b/0000_README
index 043542a..2acba8b 100644
--- a/0000_README
+++ b/0000_README
@@ -187,6 +187,10 @@ Patch: 1035_linux-4.19.36.patch
From: http://www.kernel.org
Desc: Linux 4.19.36
+Patch: 1036_linux-4.19.37.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.37
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1036_linux-4.19.37.patch b/1036_linux-4.19.37.patch
new file mode 100644
index 0000000..0a0d611
--- /dev/null
+++ b/1036_linux-4.19.37.patch
@@ -0,0 +1,5470 @@
+diff --git a/Makefile b/Makefile
+index 3fac08f6a11e..7b495cad8c2e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 36
++SUBLEVEL = 37
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -661,8 +661,7 @@ KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow)
+ KBUILD_CFLAGS += $(call cc-disable-warning, int-in-bool-context)
+
+ ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+-KBUILD_CFLAGS += $(call cc-option,-Oz,-Os)
+-KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,)
++KBUILD_CFLAGS += -Os $(call cc-disable-warning,maybe-uninitialized,)
+ else
+ ifdef CONFIG_PROFILE_ALL_BRANCHES
+ KBUILD_CFLAGS += -O2 $(call cc-disable-warning,maybe-uninitialized,)
+diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
+index b447b4db423a..fd1e722f3821 100644
+--- a/arch/arm64/include/asm/futex.h
++++ b/arch/arm64/include/asm/futex.h
+@@ -50,7 +50,7 @@ do { \
+ static inline int
+ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *_uaddr)
+ {
+- int oldval, ret, tmp;
++ int oldval = 0, ret, tmp;
+ u32 __user *uaddr = __uaccess_mask_ptr(_uaddr);
+
+ pagefault_disable();
+diff --git a/arch/x86/crypto/poly1305-avx2-x86_64.S b/arch/x86/crypto/poly1305-avx2-x86_64.S
+index 3b6e70d085da..8457cdd47f75 100644
+--- a/arch/x86/crypto/poly1305-avx2-x86_64.S
++++ b/arch/x86/crypto/poly1305-avx2-x86_64.S
+@@ -323,6 +323,12 @@ ENTRY(poly1305_4block_avx2)
+ vpaddq t2,t1,t1
+ vmovq t1x,d4
+
++ # Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 ->
++ # h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small
++ # amount. Careful: we must not assume the carry bits 'd0 >> 26',
++ # 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit
++ # integers. It's true in a single-block implementation, but not here.
++
+ # d1 += d0 >> 26
+ mov d0,%rax
+ shr $26,%rax
+@@ -361,16 +367,16 @@ ENTRY(poly1305_4block_avx2)
+ # h0 += (d4 >> 26) * 5
+ mov d4,%rax
+ shr $26,%rax
+- lea (%eax,%eax,4),%eax
+- add %eax,%ebx
++ lea (%rax,%rax,4),%rax
++ add %rax,%rbx
+ # h4 = d4 & 0x3ffffff
+ mov d4,%rax
+ and $0x3ffffff,%eax
+ mov %eax,h4
+
+ # h1 += h0 >> 26
+- mov %ebx,%eax
+- shr $26,%eax
++ mov %rbx,%rax
++ shr $26,%rax
+ add %eax,h1
+ # h0 = h0 & 0x3ffffff
+ andl $0x3ffffff,%ebx
+diff --git a/arch/x86/crypto/poly1305-sse2-x86_64.S b/arch/x86/crypto/poly1305-sse2-x86_64.S
+index c88c670cb5fc..5851c7418fb7 100644
+--- a/arch/x86/crypto/poly1305-sse2-x86_64.S
++++ b/arch/x86/crypto/poly1305-sse2-x86_64.S
+@@ -253,16 +253,16 @@ ENTRY(poly1305_block_sse2)
+ # h0 += (d4 >> 26) * 5
+ mov d4,%rax
+ shr $26,%rax
+- lea (%eax,%eax,4),%eax
+- add %eax,%ebx
++ lea (%rax,%rax,4),%rax
++ add %rax,%rbx
+ # h4 = d4 & 0x3ffffff
+ mov d4,%rax
+ and $0x3ffffff,%eax
+ mov %eax,h4
+
+ # h1 += h0 >> 26
+- mov %ebx,%eax
+- shr $26,%eax
++ mov %rbx,%rax
++ shr $26,%rax
+ add %eax,h1
+ # h0 = h0 & 0x3ffffff
+ andl $0x3ffffff,%ebx
+@@ -520,6 +520,12 @@ ENTRY(poly1305_2block_sse2)
+ paddq t2,t1
+ movq t1,d4
+
++ # Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 ->
++ # h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small
++ # amount. Careful: we must not assume the carry bits 'd0 >> 26',
++ # 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit
++ # integers. It's true in a single-block implementation, but not here.
++
+ # d1 += d0 >> 26
+ mov d0,%rax
+ shr $26,%rax
+@@ -558,16 +564,16 @@ ENTRY(poly1305_2block_sse2)
+ # h0 += (d4 >> 26) * 5
+ mov d4,%rax
+ shr $26,%rax
+- lea (%eax,%eax,4),%eax
+- add %eax,%ebx
++ lea (%rax,%rax,4),%rax
++ add %rax,%rbx
+ # h4 = d4 & 0x3ffffff
+ mov d4,%rax
+ and $0x3ffffff,%eax
+ mov %eax,h4
+
+ # h1 += h0 >> 26
+- mov %ebx,%eax
+- shr $26,%eax
++ mov %rbx,%rax
++ shr $26,%rax
+ add %eax,h1
+ # h0 = h0 & 0x3ffffff
+ andl $0x3ffffff,%ebx
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index 3e5dd85b019a..263af6312329 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -117,22 +117,39 @@ static __initconst const u64 amd_hw_cache_event_ids
+ };
+
+ /*
+- * AMD Performance Monitor K7 and later.
++ * AMD Performance Monitor K7 and later, up to and including Family 16h:
+ */
+ static const u64 amd_perfmon_event_map[PERF_COUNT_HW_MAX] =
+ {
+- [PERF_COUNT_HW_CPU_CYCLES] = 0x0076,
+- [PERF_COUNT_HW_INSTRUCTIONS] = 0x00c0,
+- [PERF_COUNT_HW_CACHE_REFERENCES] = 0x077d,
+- [PERF_COUNT_HW_CACHE_MISSES] = 0x077e,
+- [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c2,
+- [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c3,
+- [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x00d0, /* "Decoder empty" event */
+- [PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = 0x00d1, /* "Dispatch stalls" event */
++ [PERF_COUNT_HW_CPU_CYCLES] = 0x0076,
++ [PERF_COUNT_HW_INSTRUCTIONS] = 0x00c0,
++ [PERF_COUNT_HW_CACHE_REFERENCES] = 0x077d,
++ [PERF_COUNT_HW_CACHE_MISSES] = 0x077e,
++ [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c2,
++ [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c3,
++ [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x00d0, /* "Decoder empty" event */
++ [PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = 0x00d1, /* "Dispatch stalls" event */
++};
++
++/*
++ * AMD Performance Monitor Family 17h and later:
++ */
++static const u64 amd_f17h_perfmon_event_map[PERF_COUNT_HW_MAX] =
++{
++ [PERF_COUNT_HW_CPU_CYCLES] = 0x0076,
++ [PERF_COUNT_HW_INSTRUCTIONS] = 0x00c0,
++ [PERF_COUNT_HW_CACHE_REFERENCES] = 0xff60,
++ [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c2,
++ [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c3,
++ [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x0287,
++ [PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = 0x0187,
+ };
+
+ static u64 amd_pmu_event_map(int hw_event)
+ {
++ if (boot_cpu_data.x86 >= 0x17)
++ return amd_f17h_perfmon_event_map[hw_event];
++
+ return amd_perfmon_event_map[hw_event];
+ }
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 12453cf7c11b..3dd204d1dd19 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3014,7 +3014,7 @@ static unsigned long intel_pmu_large_pebs_flags(struct perf_event *event)
+ flags &= ~PERF_SAMPLE_TIME;
+ if (!event->attr.exclude_kernel)
+ flags &= ~PERF_SAMPLE_REGS_USER;
+- if (event->attr.sample_regs_user & ~PEBS_REGS)
++ if (event->attr.sample_regs_user & ~PEBS_GP_REGS)
+ flags &= ~(PERF_SAMPLE_REGS_USER | PERF_SAMPLE_REGS_INTR);
+ return flags;
+ }
+diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
+index 42a36280d168..05659c7b43d4 100644
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -96,25 +96,25 @@ struct amd_nb {
+ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_REGS_USER | \
+ PERF_SAMPLE_PERIOD)
+
+-#define PEBS_REGS \
+- (PERF_REG_X86_AX | \
+- PERF_REG_X86_BX | \
+- PERF_REG_X86_CX | \
+- PERF_REG_X86_DX | \
+- PERF_REG_X86_DI | \
+- PERF_REG_X86_SI | \
+- PERF_REG_X86_SP | \
+- PERF_REG_X86_BP | \
+- PERF_REG_X86_IP | \
+- PERF_REG_X86_FLAGS | \
+- PERF_REG_X86_R8 | \
+- PERF_REG_X86_R9 | \
+- PERF_REG_X86_R10 | \
+- PERF_REG_X86_R11 | \
+- PERF_REG_X86_R12 | \
+- PERF_REG_X86_R13 | \
+- PERF_REG_X86_R14 | \
+- PERF_REG_X86_R15)
++#define PEBS_GP_REGS \
++ ((1ULL << PERF_REG_X86_AX) | \
++ (1ULL << PERF_REG_X86_BX) | \
++ (1ULL << PERF_REG_X86_CX) | \
++ (1ULL << PERF_REG_X86_DX) | \
++ (1ULL << PERF_REG_X86_DI) | \
++ (1ULL << PERF_REG_X86_SI) | \
++ (1ULL << PERF_REG_X86_SP) | \
++ (1ULL << PERF_REG_X86_BP) | \
++ (1ULL << PERF_REG_X86_IP) | \
++ (1ULL << PERF_REG_X86_FLAGS) | \
++ (1ULL << PERF_REG_X86_R8) | \
++ (1ULL << PERF_REG_X86_R9) | \
++ (1ULL << PERF_REG_X86_R10) | \
++ (1ULL << PERF_REG_X86_R11) | \
++ (1ULL << PERF_REG_X86_R12) | \
++ (1ULL << PERF_REG_X86_R13) | \
++ (1ULL << PERF_REG_X86_R14) | \
++ (1ULL << PERF_REG_X86_R15))
+
+ /*
+ * Per register state.
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 1e0c4c74195c..e5258bd64200 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -272,7 +272,7 @@ static const struct {
+ const char *option;
+ enum spectre_v2_user_cmd cmd;
+ bool secure;
+-} v2_user_options[] __initdata = {
++} v2_user_options[] __initconst = {
+ { "auto", SPECTRE_V2_USER_CMD_AUTO, false },
+ { "off", SPECTRE_V2_USER_CMD_NONE, false },
+ { "on", SPECTRE_V2_USER_CMD_FORCE, true },
+@@ -407,7 +407,7 @@ static const struct {
+ const char *option;
+ enum spectre_v2_mitigation_cmd cmd;
+ bool secure;
+-} mitigation_options[] __initdata = {
++} mitigation_options[] __initconst = {
+ { "off", SPECTRE_V2_CMD_NONE, false },
+ { "on", SPECTRE_V2_CMD_FORCE, true },
+ { "retpoline", SPECTRE_V2_CMD_RETPOLINE, false },
+@@ -643,7 +643,7 @@ static const char * const ssb_strings[] = {
+ static const struct {
+ const char *option;
+ enum ssb_mitigation_cmd cmd;
+-} ssb_mitigation_options[] __initdata = {
++} ssb_mitigation_options[] __initconst = {
+ { "auto", SPEC_STORE_BYPASS_CMD_AUTO }, /* Platform decides */
+ { "on", SPEC_STORE_BYPASS_CMD_ON }, /* Disable Speculative Store Bypass */
+ { "off", SPEC_STORE_BYPASS_CMD_NONE }, /* Don't touch Speculative Store Bypass */
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index b0d1e81c96bb..acb901b43ce4 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -569,6 +569,7 @@ void arch_prepare_kretprobe(struct kretprobe_instance *ri, struct pt_regs *regs)
+ unsigned long *sara = stack_addr(regs);
+
+ ri->ret_addr = (kprobe_opcode_t *) *sara;
++ ri->fp = sara;
+
+ /* Replace the return addr with trampoline addr */
+ *sara = (unsigned long) &kretprobe_trampoline;
+@@ -759,15 +760,21 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ unsigned long flags, orig_ret_address = 0;
+ unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
+ kprobe_opcode_t *correct_ret_addr = NULL;
++ void *frame_pointer;
++ bool skipped = false;
+
+ INIT_HLIST_HEAD(&empty_rp);
+ kretprobe_hash_lock(current, &head, &flags);
+ /* fixup registers */
+ #ifdef CONFIG_X86_64
+ regs->cs = __KERNEL_CS;
++ /* On x86-64, we use pt_regs->sp for return address holder. */
++ frame_pointer = ®s->sp;
+ #else
+ regs->cs = __KERNEL_CS | get_kernel_rpl();
+ regs->gs = 0;
++ /* On x86-32, we use pt_regs->flags for return address holder. */
++ frame_pointer = ®s->flags;
+ #endif
+ regs->ip = trampoline_address;
+ regs->orig_ax = ~0UL;
+@@ -789,8 +796,25 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ if (ri->task != current)
+ /* another task is sharing our hash bucket */
+ continue;
++ /*
++ * Return probes must be pushed on this hash list correct
++ * order (same as return order) so that it can be poped
++ * correctly. However, if we find it is pushed it incorrect
++ * order, this means we find a function which should not be
++ * probed, because the wrong order entry is pushed on the
++ * path of processing other kretprobe itself.
++ */
++ if (ri->fp != frame_pointer) {
++ if (!skipped)
++ pr_warn("kretprobe is stacked incorrectly. Trying to fixup.\n");
++ skipped = true;
++ continue;
++ }
+
+ orig_ret_address = (unsigned long)ri->ret_addr;
++ if (skipped)
++ pr_warn("%ps must be blacklisted because of incorrect kretprobe order\n",
++ ri->rp->kp.addr);
+
+ if (orig_ret_address != trampoline_address)
+ /*
+@@ -808,6 +832,8 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ if (ri->task != current)
+ /* another task is sharing our hash bucket */
+ continue;
++ if (ri->fp != frame_pointer)
++ continue;
+
+ orig_ret_address = (unsigned long)ri->ret_addr;
+ if (ri->rp && ri->rp->handler) {
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 7d31192296a8..b8b08e61ac73 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -411,6 +411,8 @@ static __always_inline void __speculation_ctrl_update(unsigned long tifp,
+ u64 msr = x86_spec_ctrl_base;
+ bool updmsr = false;
+
++ lockdep_assert_irqs_disabled();
++
+ /*
+ * If TIF_SSBD is different, select the proper mitigation
+ * method. Note that if SSBD mitigation is disabled or permanentely
+@@ -462,10 +464,12 @@ static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk)
+
+ void speculation_ctrl_update(unsigned long tif)
+ {
++ unsigned long flags;
++
+ /* Forced update. Make sure all relevant TIF flags are different */
+- preempt_disable();
++ local_irq_save(flags);
+ __speculation_ctrl_update(~tif, tif);
+- preempt_enable();
++ local_irq_restore(flags);
+ }
+
+ /* Called from seccomp/prctl update */
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 106482da6388..860bd271619d 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -2575,15 +2575,13 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt)
+ * CR0/CR3/CR4/EFER. It's all a bit more complicated if the vCPU
+ * supports long mode.
+ */
+- cr4 = ctxt->ops->get_cr(ctxt, 4);
+ if (emulator_has_longmode(ctxt)) {
+ struct desc_struct cs_desc;
+
+ /* Zero CR4.PCIDE before CR0.PG. */
+- if (cr4 & X86_CR4_PCIDE) {
++ cr4 = ctxt->ops->get_cr(ctxt, 4);
++ if (cr4 & X86_CR4_PCIDE)
+ ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PCIDE);
+- cr4 &= ~X86_CR4_PCIDE;
+- }
+
+ /* A 32-bit code segment is required to clear EFER.LMA. */
+ memset(&cs_desc, 0, sizeof(cs_desc));
+@@ -2597,13 +2595,16 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt)
+ if (cr0 & X86_CR0_PE)
+ ctxt->ops->set_cr(ctxt, 0, cr0 & ~(X86_CR0_PG | X86_CR0_PE));
+
+- /* Now clear CR4.PAE (which must be done before clearing EFER.LME). */
+- if (cr4 & X86_CR4_PAE)
+- ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE);
++ if (emulator_has_longmode(ctxt)) {
++ /* Clear CR4.PAE before clearing EFER.LME. */
++ cr4 = ctxt->ops->get_cr(ctxt, 4);
++ if (cr4 & X86_CR4_PAE)
++ ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE);
+
+- /* And finally go back to 32-bit mode. */
+- efer = 0;
+- ctxt->ops->set_msr(ctxt, MSR_EFER, efer);
++ /* And finally go back to 32-bit mode. */
++ efer = 0;
++ ctxt->ops->set_msr(ctxt, MSR_EFER, efer);
++ }
+
+ smbase = ctxt->ops->get_smbase(ctxt);
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 6dc72804fe6e..813cb60eb401 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -2679,6 +2679,7 @@ static int npf_interception(struct vcpu_svm *svm)
+ static int db_interception(struct vcpu_svm *svm)
+ {
+ struct kvm_run *kvm_run = svm->vcpu.run;
++ struct kvm_vcpu *vcpu = &svm->vcpu;
+
+ if (!(svm->vcpu.guest_debug &
+ (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) &&
+@@ -2689,6 +2690,8 @@ static int db_interception(struct vcpu_svm *svm)
+
+ if (svm->nmi_singlestep) {
+ disable_nmi_singlestep(svm);
++ /* Make sure we check for pending NMIs upon entry */
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
+ }
+
+ if (svm->vcpu.guest_debug &
+@@ -4493,14 +4496,25 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
+ kvm_lapic_reg_write(apic, APIC_ICR, icrl);
+ break;
+ case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
++ int i;
++ struct kvm_vcpu *vcpu;
++ struct kvm *kvm = svm->vcpu.kvm;
+ struct kvm_lapic *apic = svm->vcpu.arch.apic;
+
+ /*
+- * Update ICR high and low, then emulate sending IPI,
+- * which is handled when writing APIC_ICR.
++ * At this point, we expect that the AVIC HW has already
++ * set the appropriate IRR bits on the valid target
++ * vcpus. So, we just need to kick the appropriate vcpu.
+ */
+- kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
+- kvm_lapic_reg_write(apic, APIC_ICR, icrl);
++ kvm_for_each_vcpu(i, vcpu, kvm) {
++ bool m = kvm_apic_match_dest(vcpu, apic,
++ icrl & KVM_APIC_SHORT_MASK,
++ GET_APIC_DEST_FIELD(icrh),
++ icrl & KVM_APIC_DEST_MASK);
++
++ if (m && !avic_vcpu_is_running(vcpu))
++ kvm_vcpu_wake_up(vcpu);
++ }
+ break;
+ }
+ case AVIC_IPI_FAILURE_INVALID_TARGET:
+diff --git a/crypto/testmgr.h b/crypto/testmgr.h
+index 862ee1d04263..74e1454cae1e 100644
+--- a/crypto/testmgr.h
++++ b/crypto/testmgr.h
+@@ -5592,7 +5592,49 @@ static const struct hash_testvec poly1305_tv_template[] = {
+ .psize = 80,
+ .digest = "\x13\x00\x00\x00\x00\x00\x00\x00"
+ "\x00\x00\x00\x00\x00\x00\x00\x00",
+- },
++ }, { /* Regression test for overflow in AVX2 implementation */
++ .plaintext = "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff\xff\xff\xff\xff"
++ "\xff\xff\xff\xff",
++ .psize = 300,
++ .digest = "\xfb\x5e\x96\xd8\x61\xd5\xc7\xc8"
++ "\x78\xe5\x87\xcc\x2d\x5a\x22\xe1",
++ }
+ };
+
+ /*
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index df2175b1169a..925dbc751322 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -1298,19 +1298,30 @@ static ssize_t scrub_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ struct nvdimm_bus_descriptor *nd_desc;
++ struct acpi_nfit_desc *acpi_desc;
+ ssize_t rc = -ENXIO;
++ bool busy;
+
+ device_lock(dev);
+ nd_desc = dev_get_drvdata(dev);
+- if (nd_desc) {
+- struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
++ if (!nd_desc) {
++ device_unlock(dev);
++ return rc;
++ }
++ acpi_desc = to_acpi_desc(nd_desc);
+
+- mutex_lock(&acpi_desc->init_mutex);
+- rc = sprintf(buf, "%d%s", acpi_desc->scrub_count,
+- acpi_desc->scrub_busy
+- && !acpi_desc->cancel ? "+\n" : "\n");
+- mutex_unlock(&acpi_desc->init_mutex);
++ mutex_lock(&acpi_desc->init_mutex);
++ busy = test_bit(ARS_BUSY, &acpi_desc->scrub_flags)
++ && !test_bit(ARS_CANCEL, &acpi_desc->scrub_flags);
++ rc = sprintf(buf, "%d%s", acpi_desc->scrub_count, busy ? "+\n" : "\n");
++ /* Allow an admin to poll the busy state at a higher rate */
++ if (busy && capable(CAP_SYS_RAWIO) && !test_and_set_bit(ARS_POLL,
++ &acpi_desc->scrub_flags)) {
++ acpi_desc->scrub_tmo = 1;
++ mod_delayed_work(nfit_wq, &acpi_desc->dwork, HZ);
+ }
++
++ mutex_unlock(&acpi_desc->init_mutex);
+ device_unlock(dev);
+ return rc;
+ }
+@@ -2529,7 +2540,10 @@ static int ars_start(struct acpi_nfit_desc *acpi_desc,
+
+ if (rc < 0)
+ return rc;
+- return cmd_rc;
++ if (cmd_rc < 0)
++ return cmd_rc;
++ set_bit(ARS_VALID, &acpi_desc->scrub_flags);
++ return 0;
+ }
+
+ static int ars_continue(struct acpi_nfit_desc *acpi_desc)
+@@ -2539,11 +2553,11 @@ static int ars_continue(struct acpi_nfit_desc *acpi_desc)
+ struct nvdimm_bus_descriptor *nd_desc = &acpi_desc->nd_desc;
+ struct nd_cmd_ars_status *ars_status = acpi_desc->ars_status;
+
+- memset(&ars_start, 0, sizeof(ars_start));
+- ars_start.address = ars_status->restart_address;
+- ars_start.length = ars_status->restart_length;
+- ars_start.type = ars_status->type;
+- ars_start.flags = acpi_desc->ars_start_flags;
++ ars_start = (struct nd_cmd_ars_start) {
++ .address = ars_status->restart_address,
++ .length = ars_status->restart_length,
++ .type = ars_status->type,
++ };
+ rc = nd_desc->ndctl(nd_desc, NULL, ND_CMD_ARS_START, &ars_start,
+ sizeof(ars_start), &cmd_rc);
+ if (rc < 0)
+@@ -2622,6 +2636,17 @@ static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc)
+ */
+ if (ars_status->out_length < 44)
+ return 0;
++
++ /*
++ * Ignore potentially stale results that are only refreshed
++ * after a start-ARS event.
++ */
++ if (!test_and_clear_bit(ARS_VALID, &acpi_desc->scrub_flags)) {
++ dev_dbg(acpi_desc->dev, "skip %d stale records\n",
++ ars_status->num_records);
++ return 0;
++ }
++
+ for (i = 0; i < ars_status->num_records; i++) {
+ /* only process full records */
+ if (ars_status->out_length
+@@ -2960,7 +2985,7 @@ static unsigned int __acpi_nfit_scrub(struct acpi_nfit_desc *acpi_desc,
+
+ lockdep_assert_held(&acpi_desc->init_mutex);
+
+- if (acpi_desc->cancel)
++ if (test_bit(ARS_CANCEL, &acpi_desc->scrub_flags))
+ return 0;
+
+ if (query_rc == -EBUSY) {
+@@ -3034,7 +3059,7 @@ static void __sched_ars(struct acpi_nfit_desc *acpi_desc, unsigned int tmo)
+ {
+ lockdep_assert_held(&acpi_desc->init_mutex);
+
+- acpi_desc->scrub_busy = 1;
++ set_bit(ARS_BUSY, &acpi_desc->scrub_flags);
+ /* note this should only be set from within the workqueue */
+ if (tmo)
+ acpi_desc->scrub_tmo = tmo;
+@@ -3050,7 +3075,7 @@ static void notify_ars_done(struct acpi_nfit_desc *acpi_desc)
+ {
+ lockdep_assert_held(&acpi_desc->init_mutex);
+
+- acpi_desc->scrub_busy = 0;
++ clear_bit(ARS_BUSY, &acpi_desc->scrub_flags);
+ acpi_desc->scrub_count++;
+ if (acpi_desc->scrub_count_state)
+ sysfs_notify_dirent(acpi_desc->scrub_count_state);
+@@ -3071,6 +3096,7 @@ static void acpi_nfit_scrub(struct work_struct *work)
+ else
+ notify_ars_done(acpi_desc);
+ memset(acpi_desc->ars_status, 0, acpi_desc->max_ars);
++ clear_bit(ARS_POLL, &acpi_desc->scrub_flags);
+ mutex_unlock(&acpi_desc->init_mutex);
+ }
+
+@@ -3105,6 +3131,7 @@ static int acpi_nfit_register_regions(struct acpi_nfit_desc *acpi_desc)
+ struct nfit_spa *nfit_spa;
+ int rc;
+
++ set_bit(ARS_VALID, &acpi_desc->scrub_flags);
+ list_for_each_entry(nfit_spa, &acpi_desc->spas, list) {
+ switch (nfit_spa_type(nfit_spa->spa)) {
+ case NFIT_SPA_VOLATILE:
+@@ -3322,7 +3349,7 @@ int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc,
+ struct nfit_spa *nfit_spa;
+
+ mutex_lock(&acpi_desc->init_mutex);
+- if (acpi_desc->cancel) {
++ if (test_bit(ARS_CANCEL, &acpi_desc->scrub_flags)) {
+ mutex_unlock(&acpi_desc->init_mutex);
+ return 0;
+ }
+@@ -3401,7 +3428,7 @@ void acpi_nfit_shutdown(void *data)
+ mutex_unlock(&acpi_desc_lock);
+
+ mutex_lock(&acpi_desc->init_mutex);
+- acpi_desc->cancel = 1;
++ set_bit(ARS_CANCEL, &acpi_desc->scrub_flags);
+ cancel_delayed_work_sync(&acpi_desc->dwork);
+ mutex_unlock(&acpi_desc->init_mutex);
+
+diff --git a/drivers/acpi/nfit/nfit.h b/drivers/acpi/nfit/nfit.h
+index 02c10de50386..68848fc4b7c9 100644
+--- a/drivers/acpi/nfit/nfit.h
++++ b/drivers/acpi/nfit/nfit.h
+@@ -181,6 +181,13 @@ struct nfit_mem {
+ bool has_lsw;
+ };
+
++enum scrub_flags {
++ ARS_BUSY,
++ ARS_CANCEL,
++ ARS_VALID,
++ ARS_POLL,
++};
++
+ struct acpi_nfit_desc {
+ struct nvdimm_bus_descriptor nd_desc;
+ struct acpi_table_header acpi_header;
+@@ -194,7 +201,6 @@ struct acpi_nfit_desc {
+ struct list_head idts;
+ struct nvdimm_bus *nvdimm_bus;
+ struct device *dev;
+- u8 ars_start_flags;
+ struct nd_cmd_ars_status *ars_status;
+ struct nfit_spa *scrub_spa;
+ struct delayed_work dwork;
+@@ -203,8 +209,7 @@ struct acpi_nfit_desc {
+ unsigned int max_ars;
+ unsigned int scrub_count;
+ unsigned int scrub_mode;
+- unsigned int scrub_busy:1;
+- unsigned int cancel:1;
++ unsigned long scrub_flags;
+ unsigned long dimm_cmd_force_en;
+ unsigned long bus_cmd_force_en;
+ unsigned long bus_nfit_cmd_force_en;
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index d5f7a12e350e..3fb297b5fb17 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -213,6 +213,9 @@ struct ipmi_user {
+
+ /* Does this interface receive IPMI events? */
+ bool gets_events;
++
++ /* Free must run in process context for RCU cleanup. */
++ struct work_struct remove_work;
+ };
+
+ static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user, int *index)
+@@ -1078,6 +1081,15 @@ static int intf_err_seq(struct ipmi_smi *intf,
+ }
+
+
++static void free_user_work(struct work_struct *work)
++{
++ struct ipmi_user *user = container_of(work, struct ipmi_user,
++ remove_work);
++
++ cleanup_srcu_struct(&user->release_barrier);
++ kfree(user);
++}
++
+ int ipmi_create_user(unsigned int if_num,
+ const struct ipmi_user_hndl *handler,
+ void *handler_data,
+@@ -1121,6 +1133,8 @@ int ipmi_create_user(unsigned int if_num,
+ goto out_kfree;
+
+ found:
++ INIT_WORK(&new_user->remove_work, free_user_work);
++
+ rv = init_srcu_struct(&new_user->release_barrier);
+ if (rv)
+ goto out_kfree;
+@@ -1183,8 +1197,9 @@ EXPORT_SYMBOL(ipmi_get_smi_info);
+ static void free_user(struct kref *ref)
+ {
+ struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
+- cleanup_srcu_struct(&user->release_barrier);
+- kfree(user);
++
++ /* SRCU cleanup must happen in task context. */
++ schedule_work(&user->remove_work);
+ }
+
+ static void _ipmi_destroy_user(struct ipmi_user *user)
+diff --git a/drivers/char/tpm/eventlog/tpm2.c b/drivers/char/tpm/eventlog/tpm2.c
+index 1b8fa9de2cac..41b9f6c92da7 100644
+--- a/drivers/char/tpm/eventlog/tpm2.c
++++ b/drivers/char/tpm/eventlog/tpm2.c
+@@ -37,8 +37,8 @@
+ *
+ * Returns size of the event. If it is an invalid event, returns 0.
+ */
+-static int calc_tpm2_event_size(struct tcg_pcr_event2 *event,
+- struct tcg_pcr_event *event_header)
++static size_t calc_tpm2_event_size(struct tcg_pcr_event2 *event,
++ struct tcg_pcr_event *event_header)
+ {
+ struct tcg_efi_specid_event *efispecid;
+ struct tcg_event_field *event_field;
+diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c
+index 32a8e27c5382..cc4e642d3180 100644
+--- a/drivers/char/tpm/tpm_i2c_atmel.c
++++ b/drivers/char/tpm/tpm_i2c_atmel.c
+@@ -69,6 +69,10 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ if (status < 0)
+ return status;
+
++ /* The upper layer does not support incomplete sends. */
++ if (status != len)
++ return -E2BIG;
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
+index e70a0d4d6db4..c963eec58c70 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
+@@ -164,6 +164,7 @@ static void mmhub_v1_0_init_cache_regs(struct amdgpu_device *adev)
+ tmp = REG_SET_FIELD(tmp, VM_L2_CNTL3,
+ L2_CACHE_BIGK_FRAGMENT_SIZE, 6);
+ }
++ WREG32_SOC15(MMHUB, 0, mmVM_L2_CNTL3, tmp);
+
+ tmp = mmVM_L2_CNTL4_DEFAULT;
+ tmp = REG_SET_FIELD(tmp, VM_L2_CNTL4, VMC_TAP_PDE_REQUEST_PHYSICAL, 0);
+diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+index f841accc2c00..f77c81db161b 100644
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -730,7 +730,8 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags,
+ }
+
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+- if (!(flags & TTM_PAGE_FLAG_DMA32)) {
++ if (!(flags & TTM_PAGE_FLAG_DMA32) &&
++ (npages - i) >= HPAGE_PMD_NR) {
+ for (j = 0; j < HPAGE_PMD_NR; ++j)
+ if (p++ != pages[i + j])
+ break;
+@@ -759,7 +760,7 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags,
+ unsigned max_size, n2free;
+
+ spin_lock_irqsave(&huge->lock, irq_flags);
+- while (i < npages) {
++ while ((npages - i) >= HPAGE_PMD_NR) {
+ struct page *p = pages[i];
+ unsigned j;
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index 1d645c9ab417..cac262a912c1 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -337,7 +337,8 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook edge11 - M-FBE11"),
+ },
+ .driver_data = (void *)&sipodev_desc
+- }
++ },
++ { } /* Terminate list */
+ };
+
+
+diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
+index 471caa5323e4..e5fdca74a630 100644
+--- a/drivers/iio/accel/kxcjk-1013.c
++++ b/drivers/iio/accel/kxcjk-1013.c
+@@ -1437,6 +1437,8 @@ static int kxcjk1013_resume(struct device *dev)
+
+ mutex_lock(&data->mutex);
+ ret = kxcjk1013_set_mode(data, OPERATION);
++ if (ret == 0)
++ ret = kxcjk1013_set_range(data, data->range);
+ mutex_unlock(&data->mutex);
+
+ return ret;
+diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
+index fc9510716ac7..ae2a5097f449 100644
+--- a/drivers/iio/adc/ad_sigma_delta.c
++++ b/drivers/iio/adc/ad_sigma_delta.c
+@@ -121,6 +121,7 @@ static int ad_sd_read_reg_raw(struct ad_sigma_delta *sigma_delta,
+ if (sigma_delta->info->has_registers) {
+ data[0] = reg << sigma_delta->info->addr_shift;
+ data[0] |= sigma_delta->info->read_mask;
++ data[0] |= sigma_delta->comm;
+ spi_message_add_tail(&t[0], &m);
+ }
+ spi_message_add_tail(&t[1], &m);
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index 75d2f73582a3..596841a3c4db 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -704,23 +704,29 @@ static int at91_adc_read_raw(struct iio_dev *idev,
+ ret = wait_event_interruptible_timeout(st->wq_data_avail,
+ st->done,
+ msecs_to_jiffies(1000));
+- if (ret == 0)
+- ret = -ETIMEDOUT;
+- if (ret < 0) {
+- mutex_unlock(&st->lock);
+- return ret;
+- }
+-
+- *val = st->last_value;
+
++ /* Disable interrupts, regardless if adc conversion was
++ * successful or not
++ */
+ at91_adc_writel(st, AT91_ADC_CHDR,
+ AT91_ADC_CH(chan->channel));
+ at91_adc_writel(st, AT91_ADC_IDR, BIT(chan->channel));
+
+- st->last_value = 0;
+- st->done = false;
++ if (ret > 0) {
++ /* a valid conversion took place */
++ *val = st->last_value;
++ st->last_value = 0;
++ st->done = false;
++ ret = IIO_VAL_INT;
++ } else if (ret == 0) {
++ /* conversion timeout */
++ dev_err(&idev->dev, "ADC Channel %d timeout.\n",
++ chan->channel);
++ ret = -ETIMEDOUT;
++ }
++
+ mutex_unlock(&st->lock);
+- return IIO_VAL_INT;
++ return ret;
+
+ case IIO_CHAN_INFO_SCALE:
+ *val = st->vref_mv;
+diff --git a/drivers/iio/chemical/bme680.h b/drivers/iio/chemical/bme680.h
+index e049323f209a..71dd635fce2d 100644
+--- a/drivers/iio/chemical/bme680.h
++++ b/drivers/iio/chemical/bme680.h
+@@ -2,11 +2,9 @@
+ #ifndef BME680_H_
+ #define BME680_H_
+
+-#define BME680_REG_CHIP_I2C_ID 0xD0
+-#define BME680_REG_CHIP_SPI_ID 0x50
++#define BME680_REG_CHIP_ID 0xD0
+ #define BME680_CHIP_ID_VAL 0x61
+-#define BME680_REG_SOFT_RESET_I2C 0xE0
+-#define BME680_REG_SOFT_RESET_SPI 0x60
++#define BME680_REG_SOFT_RESET 0xE0
+ #define BME680_CMD_SOFTRESET 0xB6
+ #define BME680_REG_STATUS 0x73
+ #define BME680_SPI_MEM_PAGE_BIT BIT(4)
+diff --git a/drivers/iio/chemical/bme680_core.c b/drivers/iio/chemical/bme680_core.c
+index 7d9bb62baa3f..b2db59812755 100644
+--- a/drivers/iio/chemical/bme680_core.c
++++ b/drivers/iio/chemical/bme680_core.c
+@@ -63,9 +63,23 @@ struct bme680_data {
+ s32 t_fine;
+ };
+
++static const struct regmap_range bme680_volatile_ranges[] = {
++ regmap_reg_range(BME680_REG_MEAS_STAT_0, BME680_REG_GAS_R_LSB),
++ regmap_reg_range(BME680_REG_STATUS, BME680_REG_STATUS),
++ regmap_reg_range(BME680_T2_LSB_REG, BME680_GH3_REG),
++};
++
++static const struct regmap_access_table bme680_volatile_table = {
++ .yes_ranges = bme680_volatile_ranges,
++ .n_yes_ranges = ARRAY_SIZE(bme680_volatile_ranges),
++};
++
+ const struct regmap_config bme680_regmap_config = {
+ .reg_bits = 8,
+ .val_bits = 8,
++ .max_register = 0xef,
++ .volatile_table = &bme680_volatile_table,
++ .cache_type = REGCACHE_RBTREE,
+ };
+ EXPORT_SYMBOL(bme680_regmap_config);
+
+@@ -330,6 +344,10 @@ static s16 bme680_compensate_temp(struct bme680_data *data,
+ s64 var1, var2, var3;
+ s16 calc_temp;
+
++ /* If the calibration is invalid, attempt to reload it */
++ if (!calib->par_t2)
++ bme680_read_calib(data, calib);
++
+ var1 = (adc_temp >> 3) - (calib->par_t1 << 1);
+ var2 = (var1 * calib->par_t2) >> 11;
+ var3 = ((var1 >> 1) * (var1 >> 1)) >> 12;
+@@ -591,8 +609,7 @@ static int bme680_gas_config(struct bme680_data *data)
+ return ret;
+ }
+
+-static int bme680_read_temp(struct bme680_data *data,
+- int *val, int *val2)
++static int bme680_read_temp(struct bme680_data *data, int *val)
+ {
+ struct device *dev = regmap_get_device(data->regmap);
+ int ret;
+@@ -625,10 +642,9 @@ static int bme680_read_temp(struct bme680_data *data,
+ * compensate_press/compensate_humid to get compensated
+ * pressure/humidity readings.
+ */
+- if (val && val2) {
+- *val = comp_temp;
+- *val2 = 100;
+- return IIO_VAL_FRACTIONAL;
++ if (val) {
++ *val = comp_temp * 10; /* Centidegrees to millidegrees */
++ return IIO_VAL_INT;
+ }
+
+ return ret;
+@@ -643,7 +659,7 @@ static int bme680_read_press(struct bme680_data *data,
+ s32 adc_press;
+
+ /* Read and compensate temperature to get a reading of t_fine */
+- ret = bme680_read_temp(data, NULL, NULL);
++ ret = bme680_read_temp(data, NULL);
+ if (ret < 0)
+ return ret;
+
+@@ -676,7 +692,7 @@ static int bme680_read_humid(struct bme680_data *data,
+ u32 comp_humidity;
+
+ /* Read and compensate temperature to get a reading of t_fine */
+- ret = bme680_read_temp(data, NULL, NULL);
++ ret = bme680_read_temp(data, NULL);
+ if (ret < 0)
+ return ret;
+
+@@ -769,7 +785,7 @@ static int bme680_read_raw(struct iio_dev *indio_dev,
+ case IIO_CHAN_INFO_PROCESSED:
+ switch (chan->type) {
+ case IIO_TEMP:
+- return bme680_read_temp(data, val, val2);
++ return bme680_read_temp(data, val);
+ case IIO_PRESSURE:
+ return bme680_read_press(data, val, val2);
+ case IIO_HUMIDITYRELATIVE:
+@@ -905,8 +921,28 @@ int bme680_core_probe(struct device *dev, struct regmap *regmap,
+ {
+ struct iio_dev *indio_dev;
+ struct bme680_data *data;
++ unsigned int val;
+ int ret;
+
++ ret = regmap_write(regmap, BME680_REG_SOFT_RESET,
++ BME680_CMD_SOFTRESET);
++ if (ret < 0) {
++ dev_err(dev, "Failed to reset chip\n");
++ return ret;
++ }
++
++ ret = regmap_read(regmap, BME680_REG_CHIP_ID, &val);
++ if (ret < 0) {
++ dev_err(dev, "Error reading chip ID\n");
++ return ret;
++ }
++
++ if (val != BME680_CHIP_ID_VAL) {
++ dev_err(dev, "Wrong chip ID, got %x expected %x\n",
++ val, BME680_CHIP_ID_VAL);
++ return -ENODEV;
++ }
++
+ indio_dev = devm_iio_device_alloc(dev, sizeof(*data));
+ if (!indio_dev)
+ return -ENOMEM;
+diff --git a/drivers/iio/chemical/bme680_i2c.c b/drivers/iio/chemical/bme680_i2c.c
+index 06d4be539d2e..cfc4449edf1b 100644
+--- a/drivers/iio/chemical/bme680_i2c.c
++++ b/drivers/iio/chemical/bme680_i2c.c
+@@ -23,8 +23,6 @@ static int bme680_i2c_probe(struct i2c_client *client,
+ {
+ struct regmap *regmap;
+ const char *name = NULL;
+- unsigned int val;
+- int ret;
+
+ regmap = devm_regmap_init_i2c(client, &bme680_regmap_config);
+ if (IS_ERR(regmap)) {
+@@ -33,25 +31,6 @@ static int bme680_i2c_probe(struct i2c_client *client,
+ return PTR_ERR(regmap);
+ }
+
+- ret = regmap_write(regmap, BME680_REG_SOFT_RESET_I2C,
+- BME680_CMD_SOFTRESET);
+- if (ret < 0) {
+- dev_err(&client->dev, "Failed to reset chip\n");
+- return ret;
+- }
+-
+- ret = regmap_read(regmap, BME680_REG_CHIP_I2C_ID, &val);
+- if (ret < 0) {
+- dev_err(&client->dev, "Error reading I2C chip ID\n");
+- return ret;
+- }
+-
+- if (val != BME680_CHIP_ID_VAL) {
+- dev_err(&client->dev, "Wrong chip ID, got %x expected %x\n",
+- val, BME680_CHIP_ID_VAL);
+- return -ENODEV;
+- }
+-
+ if (id)
+ name = id->name;
+
+diff --git a/drivers/iio/chemical/bme680_spi.c b/drivers/iio/chemical/bme680_spi.c
+index c9fb05e8d0b9..881778e55d38 100644
+--- a/drivers/iio/chemical/bme680_spi.c
++++ b/drivers/iio/chemical/bme680_spi.c
+@@ -11,28 +11,93 @@
+
+ #include "bme680.h"
+
++struct bme680_spi_bus_context {
++ struct spi_device *spi;
++ u8 current_page;
++};
++
++/*
++ * In SPI mode there are only 7 address bits, a "page" register determines
++ * which part of the 8-bit range is active. This function looks at the address
++ * and writes the page selection bit if needed
++ */
++static int bme680_regmap_spi_select_page(
++ struct bme680_spi_bus_context *ctx, u8 reg)
++{
++ struct spi_device *spi = ctx->spi;
++ int ret;
++ u8 buf[2];
++ u8 page = (reg & 0x80) ? 0 : 1; /* Page "1" is low range */
++
++ if (page == ctx->current_page)
++ return 0;
++
++ /*
++ * Data sheet claims we're only allowed to change bit 4, so we must do
++ * a read-modify-write on each and every page select
++ */
++ buf[0] = BME680_REG_STATUS;
++ ret = spi_write_then_read(spi, buf, 1, buf + 1, 1);
++ if (ret < 0) {
++ dev_err(&spi->dev, "failed to set page %u\n", page);
++ return ret;
++ }
++
++ buf[0] = BME680_REG_STATUS;
++ if (page)
++ buf[1] |= BME680_SPI_MEM_PAGE_BIT;
++ else
++ buf[1] &= ~BME680_SPI_MEM_PAGE_BIT;
++
++ ret = spi_write(spi, buf, 2);
++ if (ret < 0) {
++ dev_err(&spi->dev, "failed to set page %u\n", page);
++ return ret;
++ }
++
++ ctx->current_page = page;
++
++ return 0;
++}
++
+ static int bme680_regmap_spi_write(void *context, const void *data,
+ size_t count)
+ {
+- struct spi_device *spi = context;
++ struct bme680_spi_bus_context *ctx = context;
++ struct spi_device *spi = ctx->spi;
++ int ret;
+ u8 buf[2];
+
+ memcpy(buf, data, 2);
++
++ ret = bme680_regmap_spi_select_page(ctx, buf[0]);
++ if (ret)
++ return ret;
++
+ /*
+ * The SPI register address (= full register address without bit 7)
+ * and the write command (bit7 = RW = '0')
+ */
+ buf[0] &= ~0x80;
+
+- return spi_write_then_read(spi, buf, 2, NULL, 0);
++ return spi_write(spi, buf, 2);
+ }
+
+ static int bme680_regmap_spi_read(void *context, const void *reg,
+ size_t reg_size, void *val, size_t val_size)
+ {
+- struct spi_device *spi = context;
++ struct bme680_spi_bus_context *ctx = context;
++ struct spi_device *spi = ctx->spi;
++ int ret;
++ u8 addr = *(const u8 *)reg;
++
++ ret = bme680_regmap_spi_select_page(ctx, addr);
++ if (ret)
++ return ret;
+
+- return spi_write_then_read(spi, reg, reg_size, val, val_size);
++ addr |= 0x80; /* bit7 = RW = '1' */
++
++ return spi_write_then_read(spi, &addr, 1, val, val_size);
+ }
+
+ static struct regmap_bus bme680_regmap_bus = {
+@@ -45,8 +110,8 @@ static struct regmap_bus bme680_regmap_bus = {
+ static int bme680_spi_probe(struct spi_device *spi)
+ {
+ const struct spi_device_id *id = spi_get_device_id(spi);
++ struct bme680_spi_bus_context *bus_context;
+ struct regmap *regmap;
+- unsigned int val;
+ int ret;
+
+ spi->bits_per_word = 8;
+@@ -56,45 +121,21 @@ static int bme680_spi_probe(struct spi_device *spi)
+ return ret;
+ }
+
++ bus_context = devm_kzalloc(&spi->dev, sizeof(*bus_context), GFP_KERNEL);
++ if (!bus_context)
++ return -ENOMEM;
++
++ bus_context->spi = spi;
++ bus_context->current_page = 0xff; /* Undefined on warm boot */
++
+ regmap = devm_regmap_init(&spi->dev, &bme680_regmap_bus,
+- &spi->dev, &bme680_regmap_config);
++ bus_context, &bme680_regmap_config);
+ if (IS_ERR(regmap)) {
+ dev_err(&spi->dev, "Failed to register spi regmap %d\n",
+ (int)PTR_ERR(regmap));
+ return PTR_ERR(regmap);
+ }
+
+- ret = regmap_write(regmap, BME680_REG_SOFT_RESET_SPI,
+- BME680_CMD_SOFTRESET);
+- if (ret < 0) {
+- dev_err(&spi->dev, "Failed to reset chip\n");
+- return ret;
+- }
+-
+- /* after power-on reset, Page 0(0x80-0xFF) of spi_mem_page is active */
+- ret = regmap_read(regmap, BME680_REG_CHIP_SPI_ID, &val);
+- if (ret < 0) {
+- dev_err(&spi->dev, "Error reading SPI chip ID\n");
+- return ret;
+- }
+-
+- if (val != BME680_CHIP_ID_VAL) {
+- dev_err(&spi->dev, "Wrong chip ID, got %x expected %x\n",
+- val, BME680_CHIP_ID_VAL);
+- return -ENODEV;
+- }
+- /*
+- * select Page 1 of spi_mem_page to enable access to
+- * to registers from address 0x00 to 0x7F.
+- */
+- ret = regmap_write_bits(regmap, BME680_REG_STATUS,
+- BME680_SPI_MEM_PAGE_BIT,
+- BME680_SPI_MEM_PAGE_1_VAL);
+- if (ret < 0) {
+- dev_err(&spi->dev, "failed to set page 1 of spi_mem_page\n");
+- return ret;
+- }
+-
+ return bme680_core_probe(&spi->dev, regmap, id->name);
+ }
+
+diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
+index 89cb0066a6e0..8d76afb87d87 100644
+--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
++++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
+@@ -103,9 +103,10 @@ static int cros_ec_sensors_read(struct iio_dev *indio_dev,
+ * Do not use IIO_DEGREE_TO_RAD to avoid precision
+ * loss. Round to the nearest integer.
+ */
+- *val = div_s64(val64 * 314159 + 9000000ULL, 1000);
+- *val2 = 18000 << (CROS_EC_SENSOR_BITS - 1);
+- ret = IIO_VAL_FRACTIONAL;
++ *val = 0;
++ *val2 = div_s64(val64 * 3141592653ULL,
++ 180 << (CROS_EC_SENSOR_BITS - 1));
++ ret = IIO_VAL_INT_PLUS_NANO;
+ break;
+ case MOTIONSENSE_TYPE_MAG:
+ /*
+diff --git a/drivers/iio/dac/mcp4725.c b/drivers/iio/dac/mcp4725.c
+index 8b5aad4c32d9..30dc2775cbfb 100644
+--- a/drivers/iio/dac/mcp4725.c
++++ b/drivers/iio/dac/mcp4725.c
+@@ -98,6 +98,7 @@ static ssize_t mcp4725_store_eeprom(struct device *dev,
+
+ inoutbuf[0] = 0x60; /* write EEPROM */
+ inoutbuf[0] |= data->ref_mode << 3;
++ inoutbuf[0] |= data->powerdown ? ((data->powerdown_mode + 1) << 1) : 0;
+ inoutbuf[1] = data->dac_value >> 4;
+ inoutbuf[2] = (data->dac_value & 0xf) << 4;
+
+diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c
+index 63ca31628a93..92c07ab826eb 100644
+--- a/drivers/iio/gyro/bmg160_core.c
++++ b/drivers/iio/gyro/bmg160_core.c
+@@ -582,11 +582,10 @@ static int bmg160_read_raw(struct iio_dev *indio_dev,
+ case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY:
+ return bmg160_get_filter(data, val);
+ case IIO_CHAN_INFO_SCALE:
+- *val = 0;
+ switch (chan->type) {
+ case IIO_TEMP:
+- *val2 = 500000;
+- return IIO_VAL_INT_PLUS_MICRO;
++ *val = 500;
++ return IIO_VAL_INT;
+ case IIO_ANGL_VEL:
+ {
+ int i;
+@@ -594,6 +593,7 @@ static int bmg160_read_raw(struct iio_dev *indio_dev,
+ for (i = 0; i < ARRAY_SIZE(bmg160_scale_table); ++i) {
+ if (bmg160_scale_table[i].dps_range ==
+ data->dps_range) {
++ *val = 0;
+ *val2 = bmg160_scale_table[i].scale;
+ return IIO_VAL_INT_PLUS_MICRO;
+ }
+diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
+index 77fac81a3adc..5ddebede31a6 100644
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -29,7 +29,8 @@
+
+ #include "mpu3050.h"
+
+-#define MPU3050_CHIP_ID 0x69
++#define MPU3050_CHIP_ID 0x68
++#define MPU3050_CHIP_ID_MASK 0x7E
+
+ /*
+ * Register map: anything suffixed *_H is a big-endian high byte and always
+@@ -1176,8 +1177,9 @@ int mpu3050_common_probe(struct device *dev,
+ goto err_power_down;
+ }
+
+- if (val != MPU3050_CHIP_ID) {
+- dev_err(dev, "unsupported chip id %02x\n", (u8)val);
++ if ((val & MPU3050_CHIP_ID_MASK) != MPU3050_CHIP_ID) {
++ dev_err(dev, "unsupported chip id %02x\n",
++ (u8)(val & MPU3050_CHIP_ID_MASK));
+ ret = -ENODEV;
+ goto err_power_down;
+ }
+diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
+index cd5bfe39591b..dadd921a4a30 100644
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -320,9 +320,8 @@ static int iio_scan_mask_set(struct iio_dev *indio_dev,
+ const unsigned long *mask;
+ unsigned long *trialmask;
+
+- trialmask = kmalloc_array(BITS_TO_LONGS(indio_dev->masklength),
+- sizeof(*trialmask),
+- GFP_KERNEL);
++ trialmask = kcalloc(BITS_TO_LONGS(indio_dev->masklength),
++ sizeof(*trialmask), GFP_KERNEL);
+ if (trialmask == NULL)
+ return -ENOMEM;
+ if (!indio_dev->masklength) {
+diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
+index a062cfddc5af..49d4b4f1a457 100644
+--- a/drivers/iio/industrialio-core.c
++++ b/drivers/iio/industrialio-core.c
+@@ -1735,10 +1735,10 @@ EXPORT_SYMBOL(__iio_device_register);
+ **/
+ void iio_device_unregister(struct iio_dev *indio_dev)
+ {
+- mutex_lock(&indio_dev->info_exist_lock);
+-
+ cdev_device_del(&indio_dev->chrdev, &indio_dev->dev);
+
++ mutex_lock(&indio_dev->info_exist_lock);
++
+ iio_device_unregister_debugfs(indio_dev);
+
+ iio_disable_all_buffers(indio_dev);
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index 628ef617bb2f..f9525d6f0bfe 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1339,21 +1339,46 @@ static const struct acpi_device_id elan_acpi_id[] = {
+ { "ELAN0600", 0 },
+ { "ELAN0601", 0 },
+ { "ELAN0602", 0 },
++ { "ELAN0603", 0 },
++ { "ELAN0604", 0 },
+ { "ELAN0605", 0 },
++ { "ELAN0606", 0 },
++ { "ELAN0607", 0 },
+ { "ELAN0608", 0 },
+ { "ELAN0609", 0 },
+ { "ELAN060B", 0 },
+ { "ELAN060C", 0 },
++ { "ELAN060F", 0 },
++ { "ELAN0610", 0 },
+ { "ELAN0611", 0 },
+ { "ELAN0612", 0 },
++ { "ELAN0615", 0 },
++ { "ELAN0616", 0 },
+ { "ELAN0617", 0 },
+ { "ELAN0618", 0 },
++ { "ELAN0619", 0 },
++ { "ELAN061A", 0 },
++ { "ELAN061B", 0 },
+ { "ELAN061C", 0 },
+ { "ELAN061D", 0 },
+ { "ELAN061E", 0 },
++ { "ELAN061F", 0 },
+ { "ELAN0620", 0 },
+ { "ELAN0621", 0 },
+ { "ELAN0622", 0 },
++ { "ELAN0623", 0 },
++ { "ELAN0624", 0 },
++ { "ELAN0625", 0 },
++ { "ELAN0626", 0 },
++ { "ELAN0627", 0 },
++ { "ELAN0628", 0 },
++ { "ELAN0629", 0 },
++ { "ELAN062A", 0 },
++ { "ELAN062B", 0 },
++ { "ELAN062C", 0 },
++ { "ELAN062D", 0 },
++ { "ELAN0631", 0 },
++ { "ELAN0632", 0 },
+ { "ELAN1000", 0 },
+ { }
+ };
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index 8dae12b841b3..629860f7327c 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -429,7 +429,7 @@ static u16 esdhc_readw_le(struct sdhci_host *host, int reg)
+ val = readl(host->ioaddr + ESDHC_MIX_CTRL);
+ else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING)
+ /* the std tuning bits is in ACMD12_ERR for imx6sl */
+- val = readl(host->ioaddr + SDHCI_ACMD12_ERR);
++ val = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ }
+
+ if (val & ESDHC_MIX_CTRL_EXE_TUNE)
+@@ -494,7 +494,7 @@ static void esdhc_writew_le(struct sdhci_host *host, u16 val, int reg)
+ }
+ writel(new_val , host->ioaddr + ESDHC_MIX_CTRL);
+ } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
+- u32 v = readl(host->ioaddr + SDHCI_ACMD12_ERR);
++ u32 v = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ u32 m = readl(host->ioaddr + ESDHC_MIX_CTRL);
+ if (val & SDHCI_CTRL_TUNED_CLK) {
+ v |= ESDHC_MIX_CTRL_SMPCLK_SEL;
+@@ -512,7 +512,7 @@ static void esdhc_writew_le(struct sdhci_host *host, u16 val, int reg)
+ v &= ~ESDHC_MIX_CTRL_EXE_TUNE;
+ }
+
+- writel(v, host->ioaddr + SDHCI_ACMD12_ERR);
++ writel(v, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ writel(m, host->ioaddr + ESDHC_MIX_CTRL);
+ }
+ return;
+@@ -957,9 +957,9 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
+ writel(ctrl, host->ioaddr + ESDHC_MIX_CTRL);
+ writel(0, host->ioaddr + ESDHC_TUNE_CTRL_STATUS);
+ } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
+- ctrl = readl(host->ioaddr + SDHCI_ACMD12_ERR);
++ ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL;
+- writel(ctrl, host->ioaddr + SDHCI_ACMD12_ERR);
++ writel(ctrl, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ }
+ }
+ }
+@@ -1319,7 +1319,7 @@ static int sdhci_esdhc_imx_probe(struct platform_device *pdev)
+
+ /* clear tuning bits in case ROM has set it already */
+ writel(0x0, host->ioaddr + ESDHC_MIX_CTRL);
+- writel(0x0, host->ioaddr + SDHCI_ACMD12_ERR);
++ writel(0x0, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ writel(0x0, host->ioaddr + ESDHC_TUNE_CTRL_STATUS);
+ }
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 654051e00117..c749d3dc1d36 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -82,8 +82,8 @@ void sdhci_dumpregs(struct sdhci_host *host)
+ SDHCI_DUMP("Int enab: 0x%08x | Sig enab: 0x%08x\n",
+ sdhci_readl(host, SDHCI_INT_ENABLE),
+ sdhci_readl(host, SDHCI_SIGNAL_ENABLE));
+- SDHCI_DUMP("AC12 err: 0x%08x | Slot int: 0x%08x\n",
+- sdhci_readw(host, SDHCI_ACMD12_ERR),
++ SDHCI_DUMP("ACmd stat: 0x%08x | Slot int: 0x%08x\n",
++ sdhci_readw(host, SDHCI_AUTO_CMD_STATUS),
+ sdhci_readw(host, SDHCI_SLOT_INT_STATUS));
+ SDHCI_DUMP("Caps: 0x%08x | Caps_1: 0x%08x\n",
+ sdhci_readl(host, SDHCI_CAPABILITIES),
+@@ -841,6 +841,11 @@ static void sdhci_set_transfer_irqs(struct sdhci_host *host)
+ else
+ host->ier = (host->ier & ~dma_irqs) | pio_irqs;
+
++ if (host->flags & (SDHCI_AUTO_CMD23 | SDHCI_AUTO_CMD12))
++ host->ier |= SDHCI_INT_AUTO_CMD_ERR;
++ else
++ host->ier &= ~SDHCI_INT_AUTO_CMD_ERR;
++
+ sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
+ sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
+ }
+@@ -1078,8 +1083,7 @@ static bool sdhci_needs_reset(struct sdhci_host *host, struct mmc_request *mrq)
+ return (!(host->flags & SDHCI_DEVICE_DEAD) &&
+ ((mrq->cmd && mrq->cmd->error) ||
+ (mrq->sbc && mrq->sbc->error) ||
+- (mrq->data && ((mrq->data->error && !mrq->data->stop) ||
+- (mrq->data->stop && mrq->data->stop->error))) ||
++ (mrq->data && mrq->data->stop && mrq->data->stop->error) ||
+ (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST)));
+ }
+
+@@ -1131,6 +1135,16 @@ static void sdhci_finish_data(struct sdhci_host *host)
+ host->data = NULL;
+ host->data_cmd = NULL;
+
++ /*
++ * The controller needs a reset of internal state machines upon error
++ * conditions.
++ */
++ if (data->error) {
++ if (!host->cmd || host->cmd == data_cmd)
++ sdhci_do_reset(host, SDHCI_RESET_CMD);
++ sdhci_do_reset(host, SDHCI_RESET_DATA);
++ }
++
+ if ((host->flags & (SDHCI_REQ_USE_DMA | SDHCI_USE_ADMA)) ==
+ (SDHCI_REQ_USE_DMA | SDHCI_USE_ADMA))
+ sdhci_adma_table_post(host, data);
+@@ -1155,17 +1169,6 @@ static void sdhci_finish_data(struct sdhci_host *host)
+ if (data->stop &&
+ (data->error ||
+ !data->mrq->sbc)) {
+-
+- /*
+- * The controller needs a reset of internal state machines
+- * upon error conditions.
+- */
+- if (data->error) {
+- if (!host->cmd || host->cmd == data_cmd)
+- sdhci_do_reset(host, SDHCI_RESET_CMD);
+- sdhci_do_reset(host, SDHCI_RESET_DATA);
+- }
+-
+ /*
+ * 'cap_cmd_during_tfr' request must not use the command line
+ * after mmc_command_done() has been called. It is upper layer's
+@@ -2642,8 +2645,23 @@ static void sdhci_timeout_data_timer(struct timer_list *t)
+ * *
+ \*****************************************************************************/
+
+-static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask)
++static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p)
+ {
++ /* Handle auto-CMD12 error */
++ if (intmask & SDHCI_INT_AUTO_CMD_ERR && host->data_cmd) {
++ struct mmc_request *mrq = host->data_cmd->mrq;
++ u16 auto_cmd_status = sdhci_readw(host, SDHCI_AUTO_CMD_STATUS);
++ int data_err_bit = (auto_cmd_status & SDHCI_AUTO_CMD_TIMEOUT) ?
++ SDHCI_INT_DATA_TIMEOUT :
++ SDHCI_INT_DATA_CRC;
++
++ /* Treat auto-CMD12 error the same as data error */
++ if (!mrq->sbc && (host->flags & SDHCI_AUTO_CMD12)) {
++ *intmask_p |= data_err_bit;
++ return;
++ }
++ }
++
+ if (!host->cmd) {
+ /*
+ * SDHCI recovers from errors by resetting the cmd and data
+@@ -2665,20 +2683,12 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask)
+ else
+ host->cmd->error = -EILSEQ;
+
+- /*
+- * If this command initiates a data phase and a response
+- * CRC error is signalled, the card can start transferring
+- * data - the card may have received the command without
+- * error. We must not terminate the mmc_request early.
+- *
+- * If the card did not receive the command or returned an
+- * error which prevented it sending data, the data phase
+- * will time out.
+- */
++ /* Treat data command CRC error the same as data CRC error */
+ if (host->cmd->data &&
+ (intmask & (SDHCI_INT_CRC | SDHCI_INT_TIMEOUT)) ==
+ SDHCI_INT_CRC) {
+ host->cmd = NULL;
++ *intmask_p |= SDHCI_INT_DATA_CRC;
+ return;
+ }
+
+@@ -2686,6 +2696,21 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask)
+ return;
+ }
+
++ /* Handle auto-CMD23 error */
++ if (intmask & SDHCI_INT_AUTO_CMD_ERR) {
++ struct mmc_request *mrq = host->cmd->mrq;
++ u16 auto_cmd_status = sdhci_readw(host, SDHCI_AUTO_CMD_STATUS);
++ int err = (auto_cmd_status & SDHCI_AUTO_CMD_TIMEOUT) ?
++ -ETIMEDOUT :
++ -EILSEQ;
++
++ if (mrq->sbc && (host->flags & SDHCI_AUTO_CMD23)) {
++ mrq->sbc->error = err;
++ sdhci_finish_mrq(host, mrq);
++ return;
++ }
++ }
++
+ if (intmask & SDHCI_INT_RESPONSE)
+ sdhci_finish_command(host);
+ }
+@@ -2906,7 +2931,7 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id)
+ }
+
+ if (intmask & SDHCI_INT_CMD_MASK)
+- sdhci_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK);
++ sdhci_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK, &intmask);
+
+ if (intmask & SDHCI_INT_DATA_MASK)
+ sdhci_data_irq(host, intmask & SDHCI_INT_DATA_MASK);
+diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
+index f0bd36ce3817..0f8c4f3ccafc 100644
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -144,14 +144,15 @@
+ #define SDHCI_INT_DATA_CRC 0x00200000
+ #define SDHCI_INT_DATA_END_BIT 0x00400000
+ #define SDHCI_INT_BUS_POWER 0x00800000
+-#define SDHCI_INT_ACMD12ERR 0x01000000
++#define SDHCI_INT_AUTO_CMD_ERR 0x01000000
+ #define SDHCI_INT_ADMA_ERROR 0x02000000
+
+ #define SDHCI_INT_NORMAL_MASK 0x00007FFF
+ #define SDHCI_INT_ERROR_MASK 0xFFFF8000
+
+ #define SDHCI_INT_CMD_MASK (SDHCI_INT_RESPONSE | SDHCI_INT_TIMEOUT | \
+- SDHCI_INT_CRC | SDHCI_INT_END_BIT | SDHCI_INT_INDEX)
++ SDHCI_INT_CRC | SDHCI_INT_END_BIT | SDHCI_INT_INDEX | \
++ SDHCI_INT_AUTO_CMD_ERR)
+ #define SDHCI_INT_DATA_MASK (SDHCI_INT_DATA_END | SDHCI_INT_DMA_END | \
+ SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL | \
+ SDHCI_INT_DATA_TIMEOUT | SDHCI_INT_DATA_CRC | \
+@@ -166,7 +167,11 @@
+
+ #define SDHCI_CQE_INT_MASK (SDHCI_CQE_INT_ERR_MASK | SDHCI_INT_CQE)
+
+-#define SDHCI_ACMD12_ERR 0x3C
++#define SDHCI_AUTO_CMD_STATUS 0x3C
++#define SDHCI_AUTO_CMD_TIMEOUT 0x00000002
++#define SDHCI_AUTO_CMD_CRC 0x00000004
++#define SDHCI_AUTO_CMD_END_BIT 0x00000008
++#define SDHCI_AUTO_CMD_INDEX 0x00000010
+
+ #define SDHCI_HOST_CONTROL2 0x3E
+ #define SDHCI_CTRL_UHS_MASK 0x0007
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index b2c42cae3081..091b454e83fc 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3198,8 +3198,12 @@ static int bond_netdev_event(struct notifier_block *this,
+ return NOTIFY_DONE;
+
+ if (event_dev->flags & IFF_MASTER) {
++ int ret;
++
+ netdev_dbg(event_dev, "IFF_MASTER\n");
+- return bond_master_netdev_event(event, event_dev);
++ ret = bond_master_netdev_event(event, event_dev);
++ if (ret != NOTIFY_DONE)
++ return ret;
+ }
+
+ if (event_dev->flags & IFF_SLAVE) {
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+index 9800738448ec..dca02b35c231 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -32,6 +32,13 @@
+ #define DRV_NAME "nicvf"
+ #define DRV_VERSION "1.0"
+
++/* NOTE: Packets bigger than 1530 are split across multiple pages and XDP needs
++ * the buffer to be contiguous. Allow XDP to be set up only if we don't exceed
++ * this value, keeping headroom for the 14 byte Ethernet header and two
++ * VLAN tags (for QinQ)
++ */
++#define MAX_XDP_MTU (1530 - ETH_HLEN - VLAN_HLEN * 2)
++
+ /* Supported devices */
+ static const struct pci_device_id nicvf_id_table[] = {
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_CAVIUM,
+@@ -1547,6 +1554,15 @@ static int nicvf_change_mtu(struct net_device *netdev, int new_mtu)
+ struct nicvf *nic = netdev_priv(netdev);
+ int orig_mtu = netdev->mtu;
+
++ /* For now just support only the usual MTU sized frames,
++ * plus some headroom for VLAN, QinQ.
++ */
++ if (nic->xdp_prog && new_mtu > MAX_XDP_MTU) {
++ netdev_warn(netdev, "Jumbo frames not yet supported with XDP, current MTU %d.\n",
++ netdev->mtu);
++ return -EINVAL;
++ }
++
+ netdev->mtu = new_mtu;
+
+ if (!netif_running(netdev))
+@@ -1795,8 +1811,10 @@ static int nicvf_xdp_setup(struct nicvf *nic, struct bpf_prog *prog)
+ bool bpf_attached = false;
+ int ret = 0;
+
+- /* For now just support only the usual MTU sized frames */
+- if (prog && (dev->mtu > 1500)) {
++ /* For now just support only the usual MTU sized frames,
++ * plus some headroom for VLAN, QinQ.
++ */
++ if (prog && dev->mtu > MAX_XDP_MTU) {
+ netdev_warn(dev, "Jumbo frames not yet supported with XDP, current MTU %d.\n",
+ dev->mtu);
+ return -EOPNOTSUPP;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
+index 8de64e88c670..22a2ef111514 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
+@@ -148,14 +148,16 @@ static int mlx5_fpga_tls_alloc_swid(struct idr *idr, spinlock_t *idr_spinlock,
+ return ret;
+ }
+
+-static void mlx5_fpga_tls_release_swid(struct idr *idr,
+- spinlock_t *idr_spinlock, u32 swid)
++static void *mlx5_fpga_tls_release_swid(struct idr *idr,
++ spinlock_t *idr_spinlock, u32 swid)
+ {
+ unsigned long flags;
++ void *ptr;
+
+ spin_lock_irqsave(idr_spinlock, flags);
+- idr_remove(idr, swid);
++ ptr = idr_remove(idr, swid);
+ spin_unlock_irqrestore(idr_spinlock, flags);
++ return ptr;
+ }
+
+ static void mlx_tls_kfree_complete(struct mlx5_fpga_conn *conn,
+@@ -165,20 +167,12 @@ static void mlx_tls_kfree_complete(struct mlx5_fpga_conn *conn,
+ kfree(buf);
+ }
+
+-struct mlx5_teardown_stream_context {
+- struct mlx5_fpga_tls_command_context cmd;
+- u32 swid;
+-};
+-
+ static void
+ mlx5_fpga_tls_teardown_completion(struct mlx5_fpga_conn *conn,
+ struct mlx5_fpga_device *fdev,
+ struct mlx5_fpga_tls_command_context *cmd,
+ struct mlx5_fpga_dma_buf *resp)
+ {
+- struct mlx5_teardown_stream_context *ctx =
+- container_of(cmd, struct mlx5_teardown_stream_context, cmd);
+-
+ if (resp) {
+ u32 syndrome = MLX5_GET(tls_resp, resp->sg[0].data, syndrome);
+
+@@ -186,14 +180,6 @@ mlx5_fpga_tls_teardown_completion(struct mlx5_fpga_conn *conn,
+ mlx5_fpga_err(fdev,
+ "Teardown stream failed with syndrome = %d",
+ syndrome);
+- else if (MLX5_GET(tls_cmd, cmd->buf.sg[0].data, direction_sx))
+- mlx5_fpga_tls_release_swid(&fdev->tls->tx_idr,
+- &fdev->tls->tx_idr_spinlock,
+- ctx->swid);
+- else
+- mlx5_fpga_tls_release_swid(&fdev->tls->rx_idr,
+- &fdev->tls->rx_idr_spinlock,
+- ctx->swid);
+ }
+ mlx5_fpga_tls_put_command_ctx(cmd);
+ }
+@@ -217,22 +203,22 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
+ void *cmd;
+ int ret;
+
+- rcu_read_lock();
+- flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
+- rcu_read_unlock();
+-
+- if (!flow) {
+- WARN_ONCE(1, "Received NULL pointer for handle\n");
+- return -EINVAL;
+- }
+-
+ buf = kzalloc(size, GFP_ATOMIC);
+ if (!buf)
+ return -ENOMEM;
+
+ cmd = (buf + 1);
+
++ rcu_read_lock();
++ flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
++ if (unlikely(!flow)) {
++ rcu_read_unlock();
++ WARN_ONCE(1, "Received NULL pointer for handle\n");
++ kfree(buf);
++ return -EINVAL;
++ }
+ mlx5_fpga_tls_flow_to_cmd(flow, cmd);
++ rcu_read_unlock();
+
+ MLX5_SET(tls_cmd, cmd, swid, ntohl(handle));
+ MLX5_SET64(tls_cmd, cmd, tls_rcd_sn, be64_to_cpu(rcd_sn));
+@@ -253,7 +239,7 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq,
+ static void mlx5_fpga_tls_send_teardown_cmd(struct mlx5_core_dev *mdev,
+ void *flow, u32 swid, gfp_t flags)
+ {
+- struct mlx5_teardown_stream_context *ctx;
++ struct mlx5_fpga_tls_command_context *ctx;
+ struct mlx5_fpga_dma_buf *buf;
+ void *cmd;
+
+@@ -261,7 +247,7 @@ static void mlx5_fpga_tls_send_teardown_cmd(struct mlx5_core_dev *mdev,
+ if (!ctx)
+ return;
+
+- buf = &ctx->cmd.buf;
++ buf = &ctx->buf;
+ cmd = (ctx + 1);
+ MLX5_SET(tls_cmd, cmd, command_type, CMD_TEARDOWN_STREAM);
+ MLX5_SET(tls_cmd, cmd, swid, swid);
+@@ -272,8 +258,7 @@ static void mlx5_fpga_tls_send_teardown_cmd(struct mlx5_core_dev *mdev,
+ buf->sg[0].data = cmd;
+ buf->sg[0].size = MLX5_TLS_COMMAND_SIZE;
+
+- ctx->swid = swid;
+- mlx5_fpga_tls_cmd_send(mdev->fpga, &ctx->cmd,
++ mlx5_fpga_tls_cmd_send(mdev->fpga, ctx,
+ mlx5_fpga_tls_teardown_completion);
+ }
+
+@@ -283,13 +268,14 @@ void mlx5_fpga_tls_del_flow(struct mlx5_core_dev *mdev, u32 swid,
+ struct mlx5_fpga_tls *tls = mdev->fpga->tls;
+ void *flow;
+
+- rcu_read_lock();
+ if (direction_sx)
+- flow = idr_find(&tls->tx_idr, swid);
++ flow = mlx5_fpga_tls_release_swid(&tls->tx_idr,
++ &tls->tx_idr_spinlock,
++ swid);
+ else
+- flow = idr_find(&tls->rx_idr, swid);
+-
+- rcu_read_unlock();
++ flow = mlx5_fpga_tls_release_swid(&tls->rx_idr,
++ &tls->rx_idr_spinlock,
++ swid);
+
+ if (!flow) {
+ mlx5_fpga_err(mdev->fpga, "No flow information for swid %u\n",
+@@ -297,6 +283,7 @@ void mlx5_fpga_tls_del_flow(struct mlx5_core_dev *mdev, u32 swid,
+ return;
+ }
+
++ synchronize_rcu(); /* before kfree(flow) */
+ mlx5_fpga_tls_send_teardown_cmd(mdev, flow, swid, flags);
+ }
+
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
+index 7a1e9cd9cc62..777b99416062 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
+@@ -80,8 +80,7 @@ nfp_fl_push_vlan(struct nfp_fl_push_vlan *push_vlan,
+
+ tmp_push_vlan_tci =
+ FIELD_PREP(NFP_FL_PUSH_VLAN_PRIO, tcf_vlan_push_prio(action)) |
+- FIELD_PREP(NFP_FL_PUSH_VLAN_VID, tcf_vlan_push_vid(action)) |
+- NFP_FL_PUSH_VLAN_CFI;
++ FIELD_PREP(NFP_FL_PUSH_VLAN_VID, tcf_vlan_push_vid(action));
+ push_vlan->vlan_tci = cpu_to_be16(tmp_push_vlan_tci);
+ }
+
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
+index 325954b829c8..9b018321e24e 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
++++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
+@@ -55,7 +55,7 @@
+ #define NFP_FLOWER_LAYER2_GENEVE_OP BIT(6)
+
+ #define NFP_FLOWER_MASK_VLAN_PRIO GENMASK(15, 13)
+-#define NFP_FLOWER_MASK_VLAN_CFI BIT(12)
++#define NFP_FLOWER_MASK_VLAN_PRESENT BIT(12)
+ #define NFP_FLOWER_MASK_VLAN_VID GENMASK(11, 0)
+
+ #define NFP_FLOWER_MASK_MPLS_LB GENMASK(31, 12)
+@@ -109,7 +109,6 @@
+ #define NFP_FL_OUT_FLAGS_TYPE_IDX GENMASK(2, 0)
+
+ #define NFP_FL_PUSH_VLAN_PRIO GENMASK(15, 13)
+-#define NFP_FL_PUSH_VLAN_CFI BIT(12)
+ #define NFP_FL_PUSH_VLAN_VID GENMASK(11, 0)
+
+ /* LAG ports */
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/match.c b/drivers/net/ethernet/netronome/nfp/flower/match.c
+index 17acb8cc6044..b99d55cf81f1 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/match.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/match.c
+@@ -56,14 +56,12 @@ nfp_flower_compile_meta_tci(struct nfp_flower_meta_tci *frame,
+ FLOW_DISSECTOR_KEY_VLAN,
+ target);
+ /* Populate the tci field. */
+- if (flow_vlan->vlan_id || flow_vlan->vlan_priority) {
+- tmp_tci = FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
+- flow_vlan->vlan_priority) |
+- FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
+- flow_vlan->vlan_id) |
+- NFP_FLOWER_MASK_VLAN_CFI;
+- frame->tci = cpu_to_be16(tmp_tci);
+- }
++ tmp_tci = NFP_FLOWER_MASK_VLAN_PRESENT;
++ tmp_tci |= FIELD_PREP(NFP_FLOWER_MASK_VLAN_PRIO,
++ flow_vlan->vlan_priority) |
++ FIELD_PREP(NFP_FLOWER_MASK_VLAN_VID,
++ flow_vlan->vlan_id);
++ frame->tci = cpu_to_be16(tmp_tci);
+ }
+ }
+
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 95ee9d815d76..e23eaf3f6d03 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -1250,6 +1250,23 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
+ goto err_option_port_add;
+ }
+
++ /* set promiscuity level to new slave */
++ if (dev->flags & IFF_PROMISC) {
++ err = dev_set_promiscuity(port_dev, 1);
++ if (err)
++ goto err_set_slave_promisc;
++ }
++
++ /* set allmulti level to new slave */
++ if (dev->flags & IFF_ALLMULTI) {
++ err = dev_set_allmulti(port_dev, 1);
++ if (err) {
++ if (dev->flags & IFF_PROMISC)
++ dev_set_promiscuity(port_dev, -1);
++ goto err_set_slave_promisc;
++ }
++ }
++
+ netif_addr_lock_bh(dev);
+ dev_uc_sync_multiple(port_dev, dev);
+ dev_mc_sync_multiple(port_dev, dev);
+@@ -1266,6 +1283,9 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
+
+ return 0;
+
++err_set_slave_promisc:
++ __team_option_inst_del_port(team, port);
++
+ err_option_port_add:
+ team_upper_dev_unlink(team, port);
+
+@@ -1311,6 +1331,12 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
+
+ team_port_disable(team, port);
+ list_del_rcu(&port->list);
++
++ if (dev->flags & IFF_PROMISC)
++ dev_set_promiscuity(port_dev, -1);
++ if (dev->flags & IFF_ALLMULTI)
++ dev_set_allmulti(port_dev, -1);
++
+ team_upper_dev_unlink(team, port);
+ netdev_rx_handler_unregister(port_dev);
+ team_port_disable_netpoll(port);
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00.h b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+index a279a4363bc1..1d21424eae8a 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -672,7 +672,6 @@ enum rt2x00_state_flags {
+ CONFIG_CHANNEL_HT40,
+ CONFIG_POWERSAVING,
+ CONFIG_HT_DISABLED,
+- CONFIG_QOS_DISABLED,
+ CONFIG_MONITORING,
+
+ /*
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+index fa2fd64084ac..da526684596f 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+@@ -642,18 +642,8 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
+ rt2x00dev->intf_associated--;
+
+ rt2x00leds_led_assoc(rt2x00dev, !!rt2x00dev->intf_associated);
+-
+- clear_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags);
+ }
+
+- /*
+- * Check for access point which do not support 802.11e . We have to
+- * generate data frames sequence number in S/W for such AP, because
+- * of H/W bug.
+- */
+- if (changes & BSS_CHANGED_QOS && !bss_conf->qos)
+- set_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags);
+-
+ /*
+ * When the erp information has changed, we should perform
+ * additional configuration steps. For all other changes we are done.
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+index 710e9641552e..85e320178a0e 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -200,15 +200,18 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
+ if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_SW_SEQNO)) {
+ /*
+ * rt2800 has a H/W (or F/W) bug, device incorrectly increase
+- * seqno on retransmited data (non-QOS) frames. To workaround
+- * the problem let's generate seqno in software if QOS is
+- * disabled.
++ * seqno on retransmitted data (non-QOS) and management frames.
++ * To workaround the problem let's generate seqno in software.
++ * Except for beacons which are transmitted periodically by H/W
++ * hence hardware has to assign seqno for them.
+ */
+- if (test_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags))
+- __clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
+- else
++ if (ieee80211_is_beacon(hdr->frame_control)) {
++ __set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
+ /* H/W will generate sequence number */
+ return;
++ }
++
++ __clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
+ }
+
+ /*
+diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
+index 1797e47fab38..3d51a936f6d5 100644
+--- a/drivers/scsi/libfc/fc_rport.c
++++ b/drivers/scsi/libfc/fc_rport.c
+@@ -2153,7 +2153,6 @@ static void fc_rport_recv_logo_req(struct fc_lport *lport, struct fc_frame *fp)
+ FC_RPORT_DBG(rdata, "Received LOGO request while in state %s\n",
+ fc_rport_state(rdata));
+
+- rdata->flags &= ~FC_RP_STARTED;
+ fc_rport_enter_delete(rdata, RPORT_EV_STOP);
+ mutex_unlock(&rdata->rp_mutex);
+ kref_put(&rdata->kref, fc_rport_destroy);
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 655790f30434..1fc832751a4f 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -2149,8 +2149,12 @@ out_put_budget:
+ ret = BLK_STS_DEV_RESOURCE;
+ break;
+ default:
++ if (unlikely(!scsi_device_online(sdev)))
++ scsi_req(req)->result = DID_NO_CONNECT << 16;
++ else
++ scsi_req(req)->result = DID_ERROR << 16;
+ /*
+- * Make sure to release all allocated ressources when
++ * Make sure to release all allocated resources when
+ * we hit an error, as we will never see this command
+ * again.
+ */
+diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c
+index 808ed92ed66f..1bb1cb651349 100644
+--- a/drivers/staging/comedi/drivers/ni_usb6501.c
++++ b/drivers/staging/comedi/drivers/ni_usb6501.c
+@@ -463,10 +463,8 @@ static int ni6501_alloc_usb_buffers(struct comedi_device *dev)
+
+ size = usb_endpoint_maxp(devpriv->ep_tx);
+ devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
+- if (!devpriv->usb_tx_buf) {
+- kfree(devpriv->usb_rx_buf);
++ if (!devpriv->usb_tx_buf)
+ return -ENOMEM;
+- }
+
+ return 0;
+ }
+@@ -518,6 +516,9 @@ static int ni6501_auto_attach(struct comedi_device *dev,
+ if (!devpriv)
+ return -ENOMEM;
+
++ mutex_init(&devpriv->mut);
++ usb_set_intfdata(intf, devpriv);
++
+ ret = ni6501_find_endpoints(dev);
+ if (ret)
+ return ret;
+@@ -526,9 +527,6 @@ static int ni6501_auto_attach(struct comedi_device *dev,
+ if (ret)
+ return ret;
+
+- mutex_init(&devpriv->mut);
+- usb_set_intfdata(intf, devpriv);
+-
+ ret = comedi_alloc_subdevices(dev, 2);
+ if (ret)
+ return ret;
+diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
+index 6234b649d887..65dc6c51037e 100644
+--- a/drivers/staging/comedi/drivers/vmk80xx.c
++++ b/drivers/staging/comedi/drivers/vmk80xx.c
+@@ -682,10 +682,8 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
+
+ size = usb_endpoint_maxp(devpriv->ep_tx);
+ devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
+- if (!devpriv->usb_tx_buf) {
+- kfree(devpriv->usb_rx_buf);
++ if (!devpriv->usb_tx_buf)
+ return -ENOMEM;
+- }
+
+ return 0;
+ }
+@@ -800,6 +798,8 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
+
+ devpriv->model = board->model;
+
++ sema_init(&devpriv->limit_sem, 8);
++
+ ret = vmk80xx_find_usb_endpoints(dev);
+ if (ret)
+ return ret;
+@@ -808,8 +808,6 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
+ if (ret)
+ return ret;
+
+- sema_init(&devpriv->limit_sem, 8);
+-
+ usb_set_intfdata(intf, devpriv);
+
+ if (devpriv->model == VMK8055_MODEL)
+diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
+index df0499fc4802..6857a4bf7297 100644
+--- a/drivers/staging/iio/adc/ad7192.c
++++ b/drivers/staging/iio/adc/ad7192.c
+@@ -109,10 +109,10 @@
+ #define AD7192_CH_AIN3 BIT(6) /* AIN3 - AINCOM */
+ #define AD7192_CH_AIN4 BIT(7) /* AIN4 - AINCOM */
+
+-#define AD7193_CH_AIN1P_AIN2M 0x000 /* AIN1(+) - AIN2(-) */
+-#define AD7193_CH_AIN3P_AIN4M 0x001 /* AIN3(+) - AIN4(-) */
+-#define AD7193_CH_AIN5P_AIN6M 0x002 /* AIN5(+) - AIN6(-) */
+-#define AD7193_CH_AIN7P_AIN8M 0x004 /* AIN7(+) - AIN8(-) */
++#define AD7193_CH_AIN1P_AIN2M 0x001 /* AIN1(+) - AIN2(-) */
++#define AD7193_CH_AIN3P_AIN4M 0x002 /* AIN3(+) - AIN4(-) */
++#define AD7193_CH_AIN5P_AIN6M 0x004 /* AIN5(+) - AIN6(-) */
++#define AD7193_CH_AIN7P_AIN8M 0x008 /* AIN7(+) - AIN8(-) */
+ #define AD7193_CH_TEMP 0x100 /* Temp senseor */
+ #define AD7193_CH_AIN2P_AIN2M 0x200 /* AIN2(+) - AIN2(-) */
+ #define AD7193_CH_AIN1 0x401 /* AIN1 - AINCOM */
+diff --git a/drivers/staging/iio/meter/ade7854.c b/drivers/staging/iio/meter/ade7854.c
+index 029c3bf42d4d..07774c000c5a 100644
+--- a/drivers/staging/iio/meter/ade7854.c
++++ b/drivers/staging/iio/meter/ade7854.c
+@@ -269,7 +269,7 @@ static IIO_DEV_ATTR_VPEAK(0644,
+ static IIO_DEV_ATTR_IPEAK(0644,
+ ade7854_read_32bit,
+ ade7854_write_32bit,
+- ADE7854_VPEAK);
++ ADE7854_IPEAK);
+ static IIO_DEV_ATTR_APHCAL(0644,
+ ade7854_read_16bit,
+ ade7854_write_16bit,
+diff --git a/drivers/staging/most/core.c b/drivers/staging/most/core.c
+index 52ad62722996..25a077f4ea94 100644
+--- a/drivers/staging/most/core.c
++++ b/drivers/staging/most/core.c
+@@ -1412,7 +1412,7 @@ int most_register_interface(struct most_interface *iface)
+
+ INIT_LIST_HEAD(&iface->p->channel_list);
+ iface->p->dev_id = id;
+- snprintf(iface->p->name, STRING_SIZE, "mdev%d", id);
++ strcpy(iface->p->name, iface->description);
+ iface->dev.init_name = iface->p->name;
+ iface->dev.bus = &mc.bus;
+ iface->dev.parent = &mc.dev;
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index cbbf239aea0f..03fe3fb4bff6 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -2497,14 +2497,16 @@ done:
+ * center of the last stop bit in sampling clocks.
+ */
+ int last_stop = bits * 2 - 1;
+- int deviation = min_err * srr * last_stop / 2 / baud;
++ int deviation = DIV_ROUND_CLOSEST(min_err * last_stop *
++ (int)(srr + 1),
++ 2 * (int)baud);
+
+ if (abs(deviation) >= 2) {
+ /* At least two sampling clocks off at the
+ * last stop bit; we can increase the error
+ * margin by shifting the sampling point.
+ */
+- int shift = min(-8, max(7, deviation / 2));
++ int shift = clamp(deviation / 2, -8, 7);
+
+ hssrr |= (shift << HSCIF_SRHP_SHIFT) &
+ HSCIF_SRHP_MASK;
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index b9a9a07f1ee9..3e5ec1cee059 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1521,7 +1521,8 @@ static void csi_J(struct vc_data *vc, int vpar)
+ return;
+ }
+ scr_memsetw(start, vc->vc_video_erase_char, 2 * count);
+- update_region(vc, (unsigned long) start, count);
++ if (con_should_update(vc))
++ do_update_region(vc, (unsigned long) start, count);
+ vc->vc_need_wrap = 0;
+ }
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index b214a72d5caa..c163bc15976a 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -911,8 +911,12 @@ static int vhost_new_umem_range(struct vhost_umem *umem,
+ u64 start, u64 size, u64 end,
+ u64 userspace_addr, int perm)
+ {
+- struct vhost_umem_node *tmp, *node = kmalloc(sizeof(*node), GFP_ATOMIC);
++ struct vhost_umem_node *tmp, *node;
+
++ if (!size)
++ return -EFAULT;
++
++ node = kmalloc(sizeof(*node), GFP_ATOMIC);
+ if (!node)
+ return -ENOMEM;
+
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 80f33582059e..6f227cc781e5 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1263,6 +1263,7 @@ cifsFileInfo_get_locked(struct cifsFileInfo *cifs_file)
+ }
+
+ struct cifsFileInfo *cifsFileInfo_get(struct cifsFileInfo *cifs_file);
++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_hdlr);
+ void cifsFileInfo_put(struct cifsFileInfo *cifs_file);
+
+ #define CIFS_CACHE_READ_FLG 1
+@@ -1763,6 +1764,7 @@ GLOBAL_EXTERN spinlock_t gidsidlock;
+ #endif /* CONFIG_CIFS_ACL */
+
+ void cifs_oplock_break(struct work_struct *work);
++void cifs_queue_oplock_break(struct cifsFileInfo *cfile);
+
+ extern const struct slow_work_ops cifs_oplock_break_ops;
+ extern struct workqueue_struct *cifsiod_wq;
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index d847132ab027..d6b45682833b 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -358,12 +358,30 @@ cifsFileInfo_get(struct cifsFileInfo *cifs_file)
+ return cifs_file;
+ }
+
+-/*
+- * Release a reference on the file private data. This may involve closing
+- * the filehandle out on the server. Must be called without holding
+- * tcon->open_file_lock and cifs_file->file_info_lock.
++/**
++ * cifsFileInfo_put - release a reference of file priv data
++ *
++ * Always potentially wait for oplock handler. See _cifsFileInfo_put().
+ */
+ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
++{
++ _cifsFileInfo_put(cifs_file, true);
++}
++
++/**
++ * _cifsFileInfo_put - release a reference of file priv data
++ *
++ * This may involve closing the filehandle @cifs_file out on the
++ * server. Must be called without holding tcon->open_file_lock and
++ * cifs_file->file_info_lock.
++ *
++ * If @wait_for_oplock_handler is true and we are releasing the last
++ * reference, wait for any running oplock break handler of the file
++ * and cancel any pending one. If calling this function from the
++ * oplock break handler, you need to pass false.
++ *
++ */
++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ {
+ struct inode *inode = d_inode(cifs_file->dentry);
+ struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
+@@ -411,7 +429,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+
+ spin_unlock(&tcon->open_file_lock);
+
+- oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
++ oplock_break_cancelled = wait_oplock_handler ?
++ cancel_work_sync(&cifs_file->oplock_break) : false;
+
+ if (!tcon->need_reconnect && !cifs_file->invalidHandle) {
+ struct TCP_Server_Info *server = tcon->ses->server;
+@@ -4170,6 +4189,7 @@ void cifs_oplock_break(struct work_struct *work)
+ cinode);
+ cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
+ }
++ _cifsFileInfo_put(cfile, false /* do not wait for ourself */);
+ cifs_done_oplock_break(cinode);
+ }
+
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index 6926685e513c..facc94e159a1 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -490,8 +490,7 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
+ CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ &pCifsInode->flags);
+
+- queue_work(cifsoplockd_wq,
+- &netfile->oplock_break);
++ cifs_queue_oplock_break(netfile);
+ netfile->oplock_break_cancelled = false;
+
+ spin_unlock(&tcon->open_file_lock);
+@@ -588,6 +587,28 @@ void cifs_put_writer(struct cifsInodeInfo *cinode)
+ spin_unlock(&cinode->writers_lock);
+ }
+
++/**
++ * cifs_queue_oplock_break - queue the oplock break handler for cfile
++ *
++ * This function is called from the demultiplex thread when it
++ * receives an oplock break for @cfile.
++ *
++ * Assumes the tcon->open_file_lock is held.
++ * Assumes cfile->file_info_lock is NOT held.
++ */
++void cifs_queue_oplock_break(struct cifsFileInfo *cfile)
++{
++ /*
++ * Bump the handle refcount now while we hold the
++ * open_file_lock to enforce the validity of it for the oplock
++ * break handler. The matching put is done at the end of the
++ * handler.
++ */
++ cifsFileInfo_get(cfile);
++
++ queue_work(cifsoplockd_wq, &cfile->oplock_break);
++}
++
+ void cifs_done_oplock_break(struct cifsInodeInfo *cinode)
+ {
+ clear_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags);
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 58700d2ba8cd..0a7ed2e3ad4f 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -555,7 +555,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
+ clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ &cinode->flags);
+
+- queue_work(cifsoplockd_wq, &cfile->oplock_break);
++ cifs_queue_oplock_break(cfile);
+ kfree(lw);
+ return true;
+ }
+@@ -719,8 +719,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ &cinode->flags);
+ spin_unlock(&cfile->file_info_lock);
+- queue_work(cifsoplockd_wq,
+- &cfile->oplock_break);
++
++ cifs_queue_oplock_break(cfile);
+
+ spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index d4d7d61a6fe2..2001184afe70 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1906,6 +1906,8 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
+
+ rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, &err_iov,
+ &resp_buftype);
++ if (!rc)
++ SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid);
+ if (!rc || !err_iov.iov_base) {
+ rc = -ENOENT;
+ goto free_path;
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 71f32d983384..c6fd3acc5560 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3273,8 +3273,6 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
+ rqst.rq_nvec = 1;
+
+ rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
+- cifs_small_buf_release(req);
+-
+ rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
+
+ if (rc) {
+@@ -3293,6 +3291,8 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
+ io_parms->tcon->tid, ses->Suid,
+ io_parms->offset, io_parms->length);
+
++ cifs_small_buf_release(req);
++
+ *nbytes = le32_to_cpu(rsp->DataLength);
+ if ((*nbytes > CIFS_MAX_MSGSIZE) ||
+ (*nbytes > io_parms->length)) {
+@@ -3591,7 +3591,6 @@ SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
+
+ rc = cifs_send_recv(xid, io_parms->tcon->ses, &rqst,
+ &resp_buftype, flags, &rsp_iov);
+- cifs_small_buf_release(req);
+ rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;
+
+ if (rc) {
+@@ -3609,6 +3608,7 @@ SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
+ io_parms->offset, *nbytes);
+ }
+
++ cifs_small_buf_release(req);
+ free_rsp_buf(resp_buftype, rsp);
+ return rc;
+ }
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index d76fe166f6ce..c5819baee35c 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -1138,6 +1138,24 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
+ count = -EINTR;
+ goto out_mm;
+ }
++ /*
++ * Avoid to modify vma->vm_flags
++ * without locked ops while the
++ * coredump reads the vm_flags.
++ */
++ if (!mmget_still_valid(mm)) {
++ /*
++ * Silently return "count"
++ * like if get_task_mm()
++ * failed. FIXME: should this
++ * function have returned
++ * -ESRCH if get_task_mm()
++ * failed like if
++ * get_proc_task() fails?
++ */
++ up_write(&mm->mmap_sem);
++ goto out_mm;
++ }
+ for (vma = mm->mmap; vma; vma = vma->vm_next) {
+ vma->vm_flags &= ~VM_SOFTDIRTY;
+ vma_set_page_prot(vma);
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index d8b8323e80f4..aaca81b5e119 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -630,6 +630,8 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
+
+ /* the various vma->vm_userfaultfd_ctx still points to it */
+ down_write(&mm->mmap_sem);
++ /* no task can run (and in turn coredump) yet */
++ VM_WARN_ON(!mmget_still_valid(mm));
+ for (vma = mm->mmap; vma; vma = vma->vm_next)
+ if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) {
+ vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+@@ -884,6 +886,8 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
+ * taking the mmap_sem for writing.
+ */
+ down_write(&mm->mmap_sem);
++ if (!mmget_still_valid(mm))
++ goto skip_mm;
+ prev = NULL;
+ for (vma = mm->mmap; vma; vma = vma->vm_next) {
+ cond_resched();
+@@ -906,6 +910,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
+ vma->vm_flags = new_flags;
+ vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+ }
++skip_mm:
+ up_write(&mm->mmap_sem);
+ mmput(mm);
+ wakeup:
+@@ -1334,6 +1339,8 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
+ goto out;
+
+ down_write(&mm->mmap_sem);
++ if (!mmget_still_valid(mm))
++ goto out_unlock;
+ vma = find_vma_prev(mm, start, &prev);
+ if (!vma)
+ goto out_unlock;
+@@ -1521,6 +1528,8 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
+ goto out;
+
+ down_write(&mm->mmap_sem);
++ if (!mmget_still_valid(mm))
++ goto out_unlock;
+ vma = find_vma_prev(mm, start, &prev);
+ if (!vma)
+ goto out_unlock;
+diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
+index e909413e4e38..32cae0f35b9d 100644
+--- a/include/linux/kprobes.h
++++ b/include/linux/kprobes.h
+@@ -173,6 +173,7 @@ struct kretprobe_instance {
+ struct kretprobe *rp;
+ kprobe_opcode_t *ret_addr;
+ struct task_struct *task;
++ void *fp;
+ char data[0];
+ };
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 21fef8c5eca7..8c2fec0bcb26 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1456,6 +1456,7 @@ struct net_device_ops {
+ * @IFF_FAILOVER: device is a failover master device
+ * @IFF_FAILOVER_SLAVE: device is lower dev of a failover master device
+ * @IFF_L3MDEV_RX_HANDLER: only invoke the rx handler of L3 master device
++ * @IFF_LIVE_RENAME_OK: rename is allowed while device is up and running
+ */
+ enum netdev_priv_flags {
+ IFF_802_1Q_VLAN = 1<<0,
+@@ -1488,6 +1489,7 @@ enum netdev_priv_flags {
+ IFF_FAILOVER = 1<<27,
+ IFF_FAILOVER_SLAVE = 1<<28,
+ IFF_L3MDEV_RX_HANDLER = 1<<29,
++ IFF_LIVE_RENAME_OK = 1<<30,
+ };
+
+ #define IFF_802_1Q_VLAN IFF_802_1Q_VLAN
+@@ -1519,6 +1521,7 @@ enum netdev_priv_flags {
+ #define IFF_FAILOVER IFF_FAILOVER
+ #define IFF_FAILOVER_SLAVE IFF_FAILOVER_SLAVE
+ #define IFF_L3MDEV_RX_HANDLER IFF_L3MDEV_RX_HANDLER
++#define IFF_LIVE_RENAME_OK IFF_LIVE_RENAME_OK
+
+ /**
+ * struct net_device - The DEVICE structure.
+diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
+index aebb370a0006..cebb79fe2c72 100644
+--- a/include/linux/sched/mm.h
++++ b/include/linux/sched/mm.h
+@@ -49,6 +49,27 @@ static inline void mmdrop(struct mm_struct *mm)
+ __mmdrop(mm);
+ }
+
++/*
++ * This has to be called after a get_task_mm()/mmget_not_zero()
++ * followed by taking the mmap_sem for writing before modifying the
++ * vmas or anything the coredump pretends not to change from under it.
++ *
++ * NOTE: find_extend_vma() called from GUP context is the only place
++ * that can modify the "mm" (notably the vm_start/end) under mmap_sem
++ * for reading and outside the context of the process, so it is also
++ * the only case that holds the mmap_sem for reading that must call
++ * this function. Generally if the mmap_sem is hold for reading
++ * there's no need of this check after get_task_mm()/mmget_not_zero().
++ *
++ * This function can be obsoleted and the check can be removed, after
++ * the coredump code will hold the mmap_sem for writing before
++ * invoking the ->core_dump methods.
++ */
++static inline bool mmget_still_valid(struct mm_struct *mm)
++{
++ return likely(!mm->core_state);
++}
++
+ /**
+ * mmget() - Pin the address space associated with a &struct mm_struct.
+ * @mm: The address space to pin.
+diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
+index 1662cbc0b46b..b02bf737d019 100644
+--- a/include/net/inet_frag.h
++++ b/include/net/inet_frag.h
+@@ -77,8 +77,8 @@ struct inet_frag_queue {
+ struct timer_list timer;
+ spinlock_t lock;
+ refcount_t refcnt;
+- struct sk_buff *fragments; /* Used in IPv6. */
+- struct rb_root rb_fragments; /* Used in IPv4. */
++ struct sk_buff *fragments; /* used in 6lopwpan IPv6. */
++ struct rb_root rb_fragments; /* Used in IPv4/IPv6. */
+ struct sk_buff *fragments_tail;
+ struct sk_buff *last_run_head;
+ ktime_t stamp;
+@@ -153,4 +153,16 @@ static inline void add_frag_mem_limit(struct netns_frags *nf, long val)
+
+ extern const u8 ip_frag_ecn_table[16];
+
++/* Return values of inet_frag_queue_insert() */
++#define IPFRAG_OK 0
++#define IPFRAG_DUP 1
++#define IPFRAG_OVERLAP 2
++int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
++ int offset, int end);
++void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
++ struct sk_buff *parent);
++void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
++ void *reasm_data);
++struct sk_buff *inet_frag_pull_head(struct inet_frag_queue *q);
++
+ #endif
+diff --git a/include/net/ipv6_frag.h b/include/net/ipv6_frag.h
+index 6ced1e6899b6..28aa9b30aece 100644
+--- a/include/net/ipv6_frag.h
++++ b/include/net/ipv6_frag.h
+@@ -82,8 +82,15 @@ ip6frag_expire_frag_queue(struct net *net, struct frag_queue *fq)
+ __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
+
+ /* Don't send error if the first segment did not arrive. */
+- head = fq->q.fragments;
+- if (!(fq->q.flags & INET_FRAG_FIRST_IN) || !head)
++ if (!(fq->q.flags & INET_FRAG_FIRST_IN))
++ goto out;
++
++ /* sk_buff::dev and sk_buff::rbnode are unionized. So we
++ * pull the head out of the tree in order to be able to
++ * deal with head->dev.
++ */
++ head = inet_frag_pull_head(&fq->q);
++ if (!head)
+ goto out;
+
+ head->dev = dev;
+diff --git a/include/net/tls.h b/include/net/tls.h
+index 0a769cf2f5f3..c423b7d0b6ab 100644
+--- a/include/net/tls.h
++++ b/include/net/tls.h
+@@ -317,7 +317,7 @@ tls_validate_xmit_skb(struct sock *sk, struct net_device *dev,
+ static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk)
+ {
+ #ifdef CONFIG_SOCK_VALIDATE_XMIT
+- return sk_fullsock(sk) &
++ return sk_fullsock(sk) &&
+ (smp_load_acquire(&sk->sk_validate_xmit_skb) ==
+ &tls_validate_xmit_skb);
+ #else
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 4344381664cc..29ff6635d259 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -703,7 +703,6 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)
+ static int reuse_unused_kprobe(struct kprobe *ap)
+ {
+ struct optimized_kprobe *op;
+- int ret;
+
+ BUG_ON(!kprobe_unused(ap));
+ /*
+@@ -715,9 +714,8 @@ static int reuse_unused_kprobe(struct kprobe *ap)
+ /* Enable the probe again */
+ ap->flags &= ~KPROBE_FLAG_DISABLED;
+ /* Optimize it again (remove from op->list) */
+- ret = kprobe_optready(ap);
+- if (ret)
+- return ret;
++ if (!kprobe_optready(ap))
++ return -EINVAL;
+
+ optimize_kprobe(ap);
+ return 0;
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 0cbdbbb0729f..26b57e24476f 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -3567,9 +3567,6 @@ __lock_set_class(struct lockdep_map *lock, const char *name,
+ unsigned int depth;
+ int i;
+
+- if (unlikely(!debug_locks))
+- return 0;
+-
+ depth = curr->lockdep_depth;
+ /*
+ * This function is about (re)setting the class of a held lock,
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 640094391169..4aa8e7d90c25 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4847,12 +4847,15 @@ static enum hrtimer_restart sched_cfs_slack_timer(struct hrtimer *timer)
+ return HRTIMER_NORESTART;
+ }
+
++extern const u64 max_cfs_quota_period;
++
+ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)
+ {
+ struct cfs_bandwidth *cfs_b =
+ container_of(timer, struct cfs_bandwidth, period_timer);
+ int overrun;
+ int idle = 0;
++ int count = 0;
+
+ raw_spin_lock(&cfs_b->lock);
+ for (;;) {
+@@ -4860,6 +4863,28 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)
+ if (!overrun)
+ break;
+
++ if (++count > 3) {
++ u64 new, old = ktime_to_ns(cfs_b->period);
++
++ new = (old * 147) / 128; /* ~115% */
++ new = min(new, max_cfs_quota_period);
++
++ cfs_b->period = ns_to_ktime(new);
++
++ /* since max is 1s, this is limited to 1e9^2, which fits in u64 */
++ cfs_b->quota *= new;
++ cfs_b->quota = div64_u64(cfs_b->quota, old);
++
++ pr_warn_ratelimited(
++ "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us %lld, cfs_quota_us = %lld)\n",
++ smp_processor_id(),
++ div_u64(new, NSEC_PER_USEC),
++ div_u64(cfs_b->quota, NSEC_PER_USEC));
++
++ /* reset count so we don't come right back in here */
++ count = 0;
++ }
++
+ idle = do_sched_cfs_period_timer(cfs_b, overrun);
+ }
+ if (idle)
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 9e22660153ff..9a85c7ae7362 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -125,6 +125,7 @@ static int zero;
+ static int __maybe_unused one = 1;
+ static int __maybe_unused two = 2;
+ static int __maybe_unused four = 4;
++static unsigned long zero_ul;
+ static unsigned long one_ul = 1;
+ static unsigned long long_max = LONG_MAX;
+ static int one_hundred = 100;
+@@ -1696,7 +1697,7 @@ static struct ctl_table fs_table[] = {
+ .maxlen = sizeof(files_stat.max_files),
+ .mode = 0644,
+ .proc_handler = proc_doulongvec_minmax,
+- .extra1 = &zero,
++ .extra1 = &zero_ul,
+ .extra2 = &long_max,
+ },
+ {
+diff --git a/kernel/time/sched_clock.c b/kernel/time/sched_clock.c
+index cbc72c2c1fca..78eb05aa8003 100644
+--- a/kernel/time/sched_clock.c
++++ b/kernel/time/sched_clock.c
+@@ -275,7 +275,7 @@ static u64 notrace suspended_sched_clock_read(void)
+ return cd.read_data[seq & 1].epoch_cyc;
+ }
+
+-static int sched_clock_suspend(void)
++int sched_clock_suspend(void)
+ {
+ struct clock_read_data *rd = &cd.read_data[0];
+
+@@ -286,7 +286,7 @@ static int sched_clock_suspend(void)
+ return 0;
+ }
+
+-static void sched_clock_resume(void)
++void sched_clock_resume(void)
+ {
+ struct clock_read_data *rd = &cd.read_data[0];
+
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index 14de3727b18e..a02e0f6b287c 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -491,6 +491,7 @@ void tick_freeze(void)
+ trace_suspend_resume(TPS("timekeeping_freeze"),
+ smp_processor_id(), true);
+ system_state = SYSTEM_SUSPEND;
++ sched_clock_suspend();
+ timekeeping_suspend();
+ } else {
+ tick_suspend_local();
+@@ -514,6 +515,7 @@ void tick_unfreeze(void)
+
+ if (tick_freeze_depth == num_online_cpus()) {
+ timekeeping_resume();
++ sched_clock_resume();
+ system_state = SYSTEM_RUNNING;
+ trace_suspend_resume(TPS("timekeeping_freeze"),
+ smp_processor_id(), false);
+diff --git a/kernel/time/timekeeping.h b/kernel/time/timekeeping.h
+index 7a9b4eb7a1d5..141ab3ab0354 100644
+--- a/kernel/time/timekeeping.h
++++ b/kernel/time/timekeeping.h
+@@ -14,6 +14,13 @@ extern u64 timekeeping_max_deferment(void);
+ extern void timekeeping_warp_clock(void);
+ extern int timekeeping_suspend(void);
+ extern void timekeeping_resume(void);
++#ifdef CONFIG_GENERIC_SCHED_CLOCK
++extern int sched_clock_suspend(void);
++extern void sched_clock_resume(void);
++#else
++static inline int sched_clock_suspend(void) { return 0; }
++static inline void sched_clock_resume(void) { }
++#endif
+
+ extern void do_timer(unsigned long ticks);
+ extern void update_wall_time(void);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index e23eb9fc77aa..1688782f3dfb 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -34,6 +34,7 @@
+ #include <linux/list.h>
+ #include <linux/hash.h>
+ #include <linux/rcupdate.h>
++#include <linux/kprobes.h>
+
+ #include <trace/events/sched.h>
+
+@@ -6250,7 +6251,7 @@ void ftrace_reset_array_ops(struct trace_array *tr)
+ tr->ops->func = ftrace_stub;
+ }
+
+-static inline void
++static nokprobe_inline void
+ __ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
+ struct ftrace_ops *ignored, struct pt_regs *regs)
+ {
+@@ -6310,11 +6311,13 @@ static void ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
+ {
+ __ftrace_ops_list_func(ip, parent_ip, NULL, regs);
+ }
++NOKPROBE_SYMBOL(ftrace_ops_list_func);
+ #else
+ static void ftrace_ops_no_ops(unsigned long ip, unsigned long parent_ip)
+ {
+ __ftrace_ops_list_func(ip, parent_ip, NULL, NULL);
+ }
++NOKPROBE_SYMBOL(ftrace_ops_no_ops);
+ #endif
+
+ /*
+@@ -6341,6 +6344,7 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip,
+ preempt_enable_notrace();
+ trace_clear_recursion(bit);
+ }
++NOKPROBE_SYMBOL(ftrace_ops_assist_func);
+
+ /**
+ * ftrace_ops_get_func - get the function a trampoline should call
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 43507f7e66b4..1480880ff814 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -45,6 +45,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/pkeys.h>
+ #include <linux/oom.h>
++#include <linux/sched/mm.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/cacheflush.h>
+@@ -2491,7 +2492,8 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
+ vma = find_vma_prev(mm, addr, &prev);
+ if (vma && (vma->vm_start <= addr))
+ return vma;
+- if (!prev || expand_stack(prev, addr))
++ /* don't alter vm_end if the coredump is running */
++ if (!prev || !mmget_still_valid(mm) || expand_stack(prev, addr))
+ return NULL;
+ if (prev->vm_flags & VM_LOCKED)
+ populate_vma_page_range(prev, addr, prev->vm_end, NULL);
+@@ -2517,6 +2519,9 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
+ return vma;
+ if (!(vma->vm_flags & VM_GROWSDOWN))
+ return NULL;
++ /* don't alter vm_start if the coredump is running */
++ if (!mmget_still_valid(mm))
++ return NULL;
+ start = vma->vm_start;
+ if (expand_stack(vma, addr))
+ return NULL;
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 4b90682623e9..41e58f3d8fbf 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -2529,8 +2529,8 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
+ ai->groups[group].base_offset = areas[group] - base;
+ }
+
+- pr_info("Embedded %zu pages/cpu @%p s%zu r%zu d%zu u%zu\n",
+- PFN_DOWN(size_sum), base, ai->static_size, ai->reserved_size,
++ pr_info("Embedded %zu pages/cpu s%zu r%zu d%zu u%zu\n",
++ PFN_DOWN(size_sum), ai->static_size, ai->reserved_size,
+ ai->dyn_size, ai->unit_size);
+
+ rc = pcpu_setup_first_chunk(ai, base);
+@@ -2651,8 +2651,8 @@ int __init pcpu_page_first_chunk(size_t reserved_size,
+ }
+
+ /* we're ready, commit */
+- pr_info("%d %s pages/cpu @%p s%zu r%zu d%zu\n",
+- unit_pages, psize_str, vm.addr, ai->static_size,
++ pr_info("%d %s pages/cpu s%zu r%zu d%zu\n",
++ unit_pages, psize_str, ai->static_size,
+ ai->reserved_size, ai->dyn_size);
+
+ rc = pcpu_setup_first_chunk(ai, vm.addr);
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index 2878dc4e9af6..4a387937f9f5 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -1272,13 +1272,8 @@ const char * const vmstat_text[] = {
+ #endif
+ #endif /* CONFIG_MEMORY_BALLOON */
+ #ifdef CONFIG_DEBUG_TLBFLUSH
+-#ifdef CONFIG_SMP
+ "nr_tlb_remote_flush",
+ "nr_tlb_remote_flush_received",
+-#else
+- "", /* nr_tlb_remote_flush */
+- "", /* nr_tlb_remote_flush_received */
+-#endif /* CONFIG_SMP */
+ "nr_tlb_local_flush_all",
+ "nr_tlb_local_flush_one",
+ #endif /* CONFIG_DEBUG_TLBFLUSH */
+diff --git a/net/atm/lec.c b/net/atm/lec.c
+index d7f5cf5b7594..ad4f829193f0 100644
+--- a/net/atm/lec.c
++++ b/net/atm/lec.c
+@@ -710,7 +710,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg)
+
+ static int lec_mcast_attach(struct atm_vcc *vcc, int arg)
+ {
+- if (arg < 0 || arg >= MAX_LEC_ITF || !dev_lec[arg])
++ if (arg < 0 || arg >= MAX_LEC_ITF)
++ return -EINVAL;
++ arg = array_index_nospec(arg, MAX_LEC_ITF);
++ if (!dev_lec[arg])
+ return -EINVAL;
+ vcc->proto_data = dev_lec[arg];
+ return lec_mcast_make(netdev_priv(dev_lec[arg]), vcc);
+@@ -728,6 +731,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
+ i = arg;
+ if (arg >= MAX_LEC_ITF)
+ return -EINVAL;
++ i = array_index_nospec(arg, MAX_LEC_ITF);
+ if (!dev_lec[i]) {
+ int size;
+
+diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
+index 72074276c088..fed0ff446abb 100644
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -195,13 +195,10 @@ static void __br_handle_local_finish(struct sk_buff *skb)
+ /* note: already called with rcu_read_lock */
+ static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+- struct net_bridge_port *p = br_port_get_rcu(skb->dev);
+-
+ __br_handle_local_finish(skb);
+
+- BR_INPUT_SKB_CB(skb)->brdev = p->br->dev;
+- br_pass_frame_up(skb);
+- return 0;
++ /* return 1 to signal the okfn() was called so it's ok to use the skb */
++ return 1;
+ }
+
+ /*
+@@ -278,10 +275,18 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
+ goto forward;
+ }
+
+- /* Deliver packet to local host only */
+- NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, dev_net(skb->dev),
+- NULL, skb, skb->dev, NULL, br_handle_local_finish);
+- return RX_HANDLER_CONSUMED;
++ /* The else clause should be hit when nf_hook():
++ * - returns < 0 (drop/error)
++ * - returns = 0 (stolen/nf_queue)
++ * Thus return 1 from the okfn() to signal the skb is ok to pass
++ */
++ if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
++ dev_net(skb->dev), NULL, skb, skb->dev, NULL,
++ br_handle_local_finish) == 1) {
++ return RX_HANDLER_PASS;
++ } else {
++ return RX_HANDLER_CONSUMED;
++ }
+ }
+
+ forward:
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 20ed7adcf1cc..75901c4641b1 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -2152,7 +2152,8 @@ static void br_multicast_start_querier(struct net_bridge *br,
+
+ __br_multicast_open(br, query);
+
+- list_for_each_entry(port, &br->port_list, list) {
++ rcu_read_lock();
++ list_for_each_entry_rcu(port, &br->port_list, list) {
+ if (port->state == BR_STATE_DISABLED ||
+ port->state == BR_STATE_BLOCKING)
+ continue;
+@@ -2164,6 +2165,7 @@ static void br_multicast_start_querier(struct net_bridge *br,
+ br_multicast_enable(&port->ip6_own_query);
+ #endif
+ }
++ rcu_read_unlock();
+ }
+
+ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
+diff --git a/net/core/dev.c b/net/core/dev.c
+index d47554307a6d..3bcec116a5f2 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1180,7 +1180,21 @@ int dev_change_name(struct net_device *dev, const char *newname)
+ BUG_ON(!dev_net(dev));
+
+ net = dev_net(dev);
+- if (dev->flags & IFF_UP)
++
++ /* Some auto-enslaved devices e.g. failover slaves are
++ * special, as userspace might rename the device after
++ * the interface had been brought up and running since
++ * the point kernel initiated auto-enslavement. Allow
++ * live name change even when these slave devices are
++ * up and running.
++ *
++ * Typically, users of these auto-enslaving devices
++ * don't actually care about slave name change, as
++ * they are supposed to operate on master interface
++ * directly.
++ */
++ if (dev->flags & IFF_UP &&
++ likely(!(dev->priv_flags & IFF_LIVE_RENAME_OK)))
+ return -EBUSY;
+
+ write_seqcount_begin(&devnet_rename_seq);
+diff --git a/net/core/failover.c b/net/core/failover.c
+index 4a92a98ccce9..b5cd3c727285 100644
+--- a/net/core/failover.c
++++ b/net/core/failover.c
+@@ -80,14 +80,14 @@ static int failover_slave_register(struct net_device *slave_dev)
+ goto err_upper_link;
+ }
+
+- slave_dev->priv_flags |= IFF_FAILOVER_SLAVE;
++ slave_dev->priv_flags |= (IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
+
+ if (fops && fops->slave_register &&
+ !fops->slave_register(slave_dev, failover_dev))
+ return NOTIFY_OK;
+
+ netdev_upper_dev_unlink(slave_dev, failover_dev);
+- slave_dev->priv_flags &= ~IFF_FAILOVER_SLAVE;
++ slave_dev->priv_flags &= ~(IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
+ err_upper_link:
+ netdev_rx_handler_unregister(slave_dev);
+ done:
+@@ -121,7 +121,7 @@ int failover_slave_unregister(struct net_device *slave_dev)
+
+ netdev_rx_handler_unregister(slave_dev);
+ netdev_upper_dev_unlink(slave_dev, failover_dev);
+- slave_dev->priv_flags &= ~IFF_FAILOVER_SLAVE;
++ slave_dev->priv_flags &= ~(IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
+
+ if (fops && fops->slave_unregister &&
+ !fops->slave_unregister(slave_dev, failover_dev))
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index ceee28e184af..8b5768113acd 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -5071,7 +5071,8 @@ EXPORT_SYMBOL_GPL(skb_gso_validate_mac_len);
+
+ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
+ {
+- int mac_len;
++ int mac_len, meta_len;
++ void *meta;
+
+ if (skb_cow(skb, skb_headroom(skb)) < 0) {
+ kfree_skb(skb);
+@@ -5083,6 +5084,13 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
+ memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb),
+ mac_len - VLAN_HLEN - ETH_TLEN);
+ }
++
++ meta_len = skb_metadata_len(skb);
++ if (meta_len) {
++ meta = skb_metadata_end(skb) - meta_len;
++ memmove(meta + VLAN_HLEN, meta, meta_len);
++ }
++
+ skb->mac_header += VLAN_HLEN;
+ return skb;
+ }
+diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
+index 500a59906b87..854ff1e4c41f 100644
+--- a/net/ipv4/fou.c
++++ b/net/ipv4/fou.c
+@@ -120,6 +120,7 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
+ struct guehdr *guehdr;
+ void *data;
+ u16 doffset = 0;
++ u8 proto_ctype;
+
+ if (!fou)
+ return 1;
+@@ -211,13 +212,14 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
+ if (unlikely(guehdr->control))
+ return gue_control_message(skb, guehdr);
+
++ proto_ctype = guehdr->proto_ctype;
+ __skb_pull(skb, sizeof(struct udphdr) + hdrlen);
+ skb_reset_transport_header(skb);
+
+ if (iptunnel_pull_offloads(skb))
+ goto drop;
+
+- return -guehdr->proto_ctype;
++ return -proto_ctype;
+
+ drop:
+ kfree_skb(skb);
+diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
+index 760a9e52e02b..9f69411251d0 100644
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -25,6 +25,62 @@
+ #include <net/sock.h>
+ #include <net/inet_frag.h>
+ #include <net/inet_ecn.h>
++#include <net/ip.h>
++#include <net/ipv6.h>
++
++/* Use skb->cb to track consecutive/adjacent fragments coming at
++ * the end of the queue. Nodes in the rb-tree queue will
++ * contain "runs" of one or more adjacent fragments.
++ *
++ * Invariants:
++ * - next_frag is NULL at the tail of a "run";
++ * - the head of a "run" has the sum of all fragment lengths in frag_run_len.
++ */
++struct ipfrag_skb_cb {
++ union {
++ struct inet_skb_parm h4;
++ struct inet6_skb_parm h6;
++ };
++ struct sk_buff *next_frag;
++ int frag_run_len;
++};
++
++#define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb))
++
++static void fragcb_clear(struct sk_buff *skb)
++{
++ RB_CLEAR_NODE(&skb->rbnode);
++ FRAG_CB(skb)->next_frag = NULL;
++ FRAG_CB(skb)->frag_run_len = skb->len;
++}
++
++/* Append skb to the last "run". */
++static void fragrun_append_to_last(struct inet_frag_queue *q,
++ struct sk_buff *skb)
++{
++ fragcb_clear(skb);
++
++ FRAG_CB(q->last_run_head)->frag_run_len += skb->len;
++ FRAG_CB(q->fragments_tail)->next_frag = skb;
++ q->fragments_tail = skb;
++}
++
++/* Create a new "run" with the skb. */
++static void fragrun_create(struct inet_frag_queue *q, struct sk_buff *skb)
++{
++ BUILD_BUG_ON(sizeof(struct ipfrag_skb_cb) > sizeof(skb->cb));
++ fragcb_clear(skb);
++
++ if (q->last_run_head)
++ rb_link_node(&skb->rbnode, &q->last_run_head->rbnode,
++ &q->last_run_head->rbnode.rb_right);
++ else
++ rb_link_node(&skb->rbnode, NULL, &q->rb_fragments.rb_node);
++ rb_insert_color(&skb->rbnode, &q->rb_fragments);
++
++ q->fragments_tail = skb;
++ q->last_run_head = skb;
++}
+
+ /* Given the OR values of all fragments, apply RFC 3168 5.3 requirements
+ * Value : 0xff if frame should be dropped.
+@@ -123,6 +179,28 @@ static void inet_frag_destroy_rcu(struct rcu_head *head)
+ kmem_cache_free(f->frags_cachep, q);
+ }
+
++unsigned int inet_frag_rbtree_purge(struct rb_root *root)
++{
++ struct rb_node *p = rb_first(root);
++ unsigned int sum = 0;
++
++ while (p) {
++ struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode);
++
++ p = rb_next(p);
++ rb_erase(&skb->rbnode, root);
++ while (skb) {
++ struct sk_buff *next = FRAG_CB(skb)->next_frag;
++
++ sum += skb->truesize;
++ kfree_skb(skb);
++ skb = next;
++ }
++ }
++ return sum;
++}
++EXPORT_SYMBOL(inet_frag_rbtree_purge);
++
+ void inet_frag_destroy(struct inet_frag_queue *q)
+ {
+ struct sk_buff *fp;
+@@ -224,3 +302,218 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key)
+ return fq;
+ }
+ EXPORT_SYMBOL(inet_frag_find);
++
++int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
++ int offset, int end)
++{
++ struct sk_buff *last = q->fragments_tail;
++
++ /* RFC5722, Section 4, amended by Errata ID : 3089
++ * When reassembling an IPv6 datagram, if
++ * one or more its constituent fragments is determined to be an
++ * overlapping fragment, the entire datagram (and any constituent
++ * fragments) MUST be silently discarded.
++ *
++ * Duplicates, however, should be ignored (i.e. skb dropped, but the
++ * queue/fragments kept for later reassembly).
++ */
++ if (!last)
++ fragrun_create(q, skb); /* First fragment. */
++ else if (last->ip_defrag_offset + last->len < end) {
++ /* This is the common case: skb goes to the end. */
++ /* Detect and discard overlaps. */
++ if (offset < last->ip_defrag_offset + last->len)
++ return IPFRAG_OVERLAP;
++ if (offset == last->ip_defrag_offset + last->len)
++ fragrun_append_to_last(q, skb);
++ else
++ fragrun_create(q, skb);
++ } else {
++ /* Binary search. Note that skb can become the first fragment,
++ * but not the last (covered above).
++ */
++ struct rb_node **rbn, *parent;
++
++ rbn = &q->rb_fragments.rb_node;
++ do {
++ struct sk_buff *curr;
++ int curr_run_end;
++
++ parent = *rbn;
++ curr = rb_to_skb(parent);
++ curr_run_end = curr->ip_defrag_offset +
++ FRAG_CB(curr)->frag_run_len;
++ if (end <= curr->ip_defrag_offset)
++ rbn = &parent->rb_left;
++ else if (offset >= curr_run_end)
++ rbn = &parent->rb_right;
++ else if (offset >= curr->ip_defrag_offset &&
++ end <= curr_run_end)
++ return IPFRAG_DUP;
++ else
++ return IPFRAG_OVERLAP;
++ } while (*rbn);
++ /* Here we have parent properly set, and rbn pointing to
++ * one of its NULL left/right children. Insert skb.
++ */
++ fragcb_clear(skb);
++ rb_link_node(&skb->rbnode, parent, rbn);
++ rb_insert_color(&skb->rbnode, &q->rb_fragments);
++ }
++
++ skb->ip_defrag_offset = offset;
++
++ return IPFRAG_OK;
++}
++EXPORT_SYMBOL(inet_frag_queue_insert);
++
++void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
++ struct sk_buff *parent)
++{
++ struct sk_buff *fp, *head = skb_rb_first(&q->rb_fragments);
++ struct sk_buff **nextp;
++ int delta;
++
++ if (head != skb) {
++ fp = skb_clone(skb, GFP_ATOMIC);
++ if (!fp)
++ return NULL;
++ FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag;
++ if (RB_EMPTY_NODE(&skb->rbnode))
++ FRAG_CB(parent)->next_frag = fp;
++ else
++ rb_replace_node(&skb->rbnode, &fp->rbnode,
++ &q->rb_fragments);
++ if (q->fragments_tail == skb)
++ q->fragments_tail = fp;
++ skb_morph(skb, head);
++ FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag;
++ rb_replace_node(&head->rbnode, &skb->rbnode,
++ &q->rb_fragments);
++ consume_skb(head);
++ head = skb;
++ }
++ WARN_ON(head->ip_defrag_offset != 0);
++
++ delta = -head->truesize;
++
++ /* Head of list must not be cloned. */
++ if (skb_unclone(head, GFP_ATOMIC))
++ return NULL;
++
++ delta += head->truesize;
++ if (delta)
++ add_frag_mem_limit(q->net, delta);
++
++ /* If the first fragment is fragmented itself, we split
++ * it to two chunks: the first with data and paged part
++ * and the second, holding only fragments.
++ */
++ if (skb_has_frag_list(head)) {
++ struct sk_buff *clone;
++ int i, plen = 0;
++
++ clone = alloc_skb(0, GFP_ATOMIC);
++ if (!clone)
++ return NULL;
++ skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
++ skb_frag_list_init(head);
++ for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
++ plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
++ clone->data_len = head->data_len - plen;
++ clone->len = clone->data_len;
++ head->truesize += clone->truesize;
++ clone->csum = 0;
++ clone->ip_summed = head->ip_summed;
++ add_frag_mem_limit(q->net, clone->truesize);
++ skb_shinfo(head)->frag_list = clone;
++ nextp = &clone->next;
++ } else {
++ nextp = &skb_shinfo(head)->frag_list;
++ }
++
++ return nextp;
++}
++EXPORT_SYMBOL(inet_frag_reasm_prepare);
++
++void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
++ void *reasm_data)
++{
++ struct sk_buff **nextp = (struct sk_buff **)reasm_data;
++ struct rb_node *rbn;
++ struct sk_buff *fp;
++
++ skb_push(head, head->data - skb_network_header(head));
++
++ /* Traverse the tree in order, to build frag_list. */
++ fp = FRAG_CB(head)->next_frag;
++ rbn = rb_next(&head->rbnode);
++ rb_erase(&head->rbnode, &q->rb_fragments);
++ while (rbn || fp) {
++ /* fp points to the next sk_buff in the current run;
++ * rbn points to the next run.
++ */
++ /* Go through the current run. */
++ while (fp) {
++ *nextp = fp;
++ nextp = &fp->next;
++ fp->prev = NULL;
++ memset(&fp->rbnode, 0, sizeof(fp->rbnode));
++ fp->sk = NULL;
++ head->data_len += fp->len;
++ head->len += fp->len;
++ if (head->ip_summed != fp->ip_summed)
++ head->ip_summed = CHECKSUM_NONE;
++ else if (head->ip_summed == CHECKSUM_COMPLETE)
++ head->csum = csum_add(head->csum, fp->csum);
++ head->truesize += fp->truesize;
++ fp = FRAG_CB(fp)->next_frag;
++ }
++ /* Move to the next run. */
++ if (rbn) {
++ struct rb_node *rbnext = rb_next(rbn);
++
++ fp = rb_to_skb(rbn);
++ rb_erase(rbn, &q->rb_fragments);
++ rbn = rbnext;
++ }
++ }
++ sub_frag_mem_limit(q->net, head->truesize);
++
++ *nextp = NULL;
++ skb_mark_not_on_list(head);
++ head->prev = NULL;
++ head->tstamp = q->stamp;
++}
++EXPORT_SYMBOL(inet_frag_reasm_finish);
++
++struct sk_buff *inet_frag_pull_head(struct inet_frag_queue *q)
++{
++ struct sk_buff *head;
++
++ if (q->fragments) {
++ head = q->fragments;
++ q->fragments = head->next;
++ } else {
++ struct sk_buff *skb;
++
++ head = skb_rb_first(&q->rb_fragments);
++ if (!head)
++ return NULL;
++ skb = FRAG_CB(head)->next_frag;
++ if (skb)
++ rb_replace_node(&head->rbnode, &skb->rbnode,
++ &q->rb_fragments);
++ else
++ rb_erase(&head->rbnode, &q->rb_fragments);
++ memset(&head->rbnode, 0, sizeof(head->rbnode));
++ barrier();
++ }
++ if (head == q->fragments_tail)
++ q->fragments_tail = NULL;
++
++ sub_frag_mem_limit(q->net, head->truesize);
++
++ return head;
++}
++EXPORT_SYMBOL(inet_frag_pull_head);
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index d95b32af4a0e..5a1d39e32196 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -57,57 +57,6 @@
+ */
+ static const char ip_frag_cache_name[] = "ip4-frags";
+
+-/* Use skb->cb to track consecutive/adjacent fragments coming at
+- * the end of the queue. Nodes in the rb-tree queue will
+- * contain "runs" of one or more adjacent fragments.
+- *
+- * Invariants:
+- * - next_frag is NULL at the tail of a "run";
+- * - the head of a "run" has the sum of all fragment lengths in frag_run_len.
+- */
+-struct ipfrag_skb_cb {
+- struct inet_skb_parm h;
+- struct sk_buff *next_frag;
+- int frag_run_len;
+-};
+-
+-#define FRAG_CB(skb) ((struct ipfrag_skb_cb *)((skb)->cb))
+-
+-static void ip4_frag_init_run(struct sk_buff *skb)
+-{
+- BUILD_BUG_ON(sizeof(struct ipfrag_skb_cb) > sizeof(skb->cb));
+-
+- FRAG_CB(skb)->next_frag = NULL;
+- FRAG_CB(skb)->frag_run_len = skb->len;
+-}
+-
+-/* Append skb to the last "run". */
+-static void ip4_frag_append_to_last_run(struct inet_frag_queue *q,
+- struct sk_buff *skb)
+-{
+- RB_CLEAR_NODE(&skb->rbnode);
+- FRAG_CB(skb)->next_frag = NULL;
+-
+- FRAG_CB(q->last_run_head)->frag_run_len += skb->len;
+- FRAG_CB(q->fragments_tail)->next_frag = skb;
+- q->fragments_tail = skb;
+-}
+-
+-/* Create a new "run" with the skb. */
+-static void ip4_frag_create_run(struct inet_frag_queue *q, struct sk_buff *skb)
+-{
+- if (q->last_run_head)
+- rb_link_node(&skb->rbnode, &q->last_run_head->rbnode,
+- &q->last_run_head->rbnode.rb_right);
+- else
+- rb_link_node(&skb->rbnode, NULL, &q->rb_fragments.rb_node);
+- rb_insert_color(&skb->rbnode, &q->rb_fragments);
+-
+- ip4_frag_init_run(skb);
+- q->fragments_tail = skb;
+- q->last_run_head = skb;
+-}
+-
+ /* Describe an entry in the "incomplete datagrams" queue. */
+ struct ipq {
+ struct inet_frag_queue q;
+@@ -212,27 +161,9 @@ static void ip_expire(struct timer_list *t)
+ * pull the head out of the tree in order to be able to
+ * deal with head->dev.
+ */
+- if (qp->q.fragments) {
+- head = qp->q.fragments;
+- qp->q.fragments = head->next;
+- } else {
+- head = skb_rb_first(&qp->q.rb_fragments);
+- if (!head)
+- goto out;
+- if (FRAG_CB(head)->next_frag)
+- rb_replace_node(&head->rbnode,
+- &FRAG_CB(head)->next_frag->rbnode,
+- &qp->q.rb_fragments);
+- else
+- rb_erase(&head->rbnode, &qp->q.rb_fragments);
+- memset(&head->rbnode, 0, sizeof(head->rbnode));
+- barrier();
+- }
+- if (head == qp->q.fragments_tail)
+- qp->q.fragments_tail = NULL;
+-
+- sub_frag_mem_limit(qp->q.net, head->truesize);
+-
++ head = inet_frag_pull_head(&qp->q);
++ if (!head)
++ goto out;
+ head->dev = dev_get_by_index_rcu(net, qp->iif);
+ if (!head->dev)
+ goto out;
+@@ -345,12 +276,10 @@ static int ip_frag_reinit(struct ipq *qp)
+ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ {
+ struct net *net = container_of(qp->q.net, struct net, ipv4.frags);
+- struct rb_node **rbn, *parent;
+- struct sk_buff *skb1, *prev_tail;
+- int ihl, end, skb1_run_end;
++ int ihl, end, flags, offset;
++ struct sk_buff *prev_tail;
+ struct net_device *dev;
+ unsigned int fragsize;
+- int flags, offset;
+ int err = -ENOENT;
+ u8 ecn;
+
+@@ -382,7 +311,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ */
+ if (end < qp->q.len ||
+ ((qp->q.flags & INET_FRAG_LAST_IN) && end != qp->q.len))
+- goto err;
++ goto discard_qp;
+ qp->q.flags |= INET_FRAG_LAST_IN;
+ qp->q.len = end;
+ } else {
+@@ -394,82 +323,33 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ if (end > qp->q.len) {
+ /* Some bits beyond end -> corruption. */
+ if (qp->q.flags & INET_FRAG_LAST_IN)
+- goto err;
++ goto discard_qp;
+ qp->q.len = end;
+ }
+ }
+ if (end == offset)
+- goto err;
++ goto discard_qp;
+
+ err = -ENOMEM;
+ if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
+- goto err;
++ goto discard_qp;
+
+ err = pskb_trim_rcsum(skb, end - offset);
+ if (err)
+- goto err;
++ goto discard_qp;
+
+ /* Note : skb->rbnode and skb->dev share the same location. */
+ dev = skb->dev;
+ /* Makes sure compiler wont do silly aliasing games */
+ barrier();
+
+- /* RFC5722, Section 4, amended by Errata ID : 3089
+- * When reassembling an IPv6 datagram, if
+- * one or more its constituent fragments is determined to be an
+- * overlapping fragment, the entire datagram (and any constituent
+- * fragments) MUST be silently discarded.
+- *
+- * We do the same here for IPv4 (and increment an snmp counter) but
+- * we do not want to drop the whole queue in response to a duplicate
+- * fragment.
+- */
+-
+- err = -EINVAL;
+- /* Find out where to put this fragment. */
+ prev_tail = qp->q.fragments_tail;
+- if (!prev_tail)
+- ip4_frag_create_run(&qp->q, skb); /* First fragment. */
+- else if (prev_tail->ip_defrag_offset + prev_tail->len < end) {
+- /* This is the common case: skb goes to the end. */
+- /* Detect and discard overlaps. */
+- if (offset < prev_tail->ip_defrag_offset + prev_tail->len)
+- goto discard_qp;
+- if (offset == prev_tail->ip_defrag_offset + prev_tail->len)
+- ip4_frag_append_to_last_run(&qp->q, skb);
+- else
+- ip4_frag_create_run(&qp->q, skb);
+- } else {
+- /* Binary search. Note that skb can become the first fragment,
+- * but not the last (covered above).
+- */
+- rbn = &qp->q.rb_fragments.rb_node;
+- do {
+- parent = *rbn;
+- skb1 = rb_to_skb(parent);
+- skb1_run_end = skb1->ip_defrag_offset +
+- FRAG_CB(skb1)->frag_run_len;
+- if (end <= skb1->ip_defrag_offset)
+- rbn = &parent->rb_left;
+- else if (offset >= skb1_run_end)
+- rbn = &parent->rb_right;
+- else if (offset >= skb1->ip_defrag_offset &&
+- end <= skb1_run_end)
+- goto err; /* No new data, potential duplicate */
+- else
+- goto discard_qp; /* Found an overlap */
+- } while (*rbn);
+- /* Here we have parent properly set, and rbn pointing to
+- * one of its NULL left/right children. Insert skb.
+- */
+- ip4_frag_init_run(skb);
+- rb_link_node(&skb->rbnode, parent, rbn);
+- rb_insert_color(&skb->rbnode, &qp->q.rb_fragments);
+- }
++ err = inet_frag_queue_insert(&qp->q, skb, offset, end);
++ if (err)
++ goto insert_error;
+
+ if (dev)
+ qp->iif = dev->ifindex;
+- skb->ip_defrag_offset = offset;
+
+ qp->q.stamp = skb->tstamp;
+ qp->q.meat += skb->len;
+@@ -494,15 +374,24 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ skb->_skb_refdst = 0UL;
+ err = ip_frag_reasm(qp, skb, prev_tail, dev);
+ skb->_skb_refdst = orefdst;
++ if (err)
++ inet_frag_kill(&qp->q);
+ return err;
+ }
+
+ skb_dst_drop(skb);
+ return -EINPROGRESS;
+
++insert_error:
++ if (err == IPFRAG_DUP) {
++ kfree_skb(skb);
++ return -EINVAL;
++ }
++ err = -EINVAL;
++ __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS);
+ discard_qp:
+ inet_frag_kill(&qp->q);
+- __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS);
++ __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
+ err:
+ kfree_skb(skb);
+ return err;
+@@ -514,13 +403,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
+ {
+ struct net *net = container_of(qp->q.net, struct net, ipv4.frags);
+ struct iphdr *iph;
+- struct sk_buff *fp, *head = skb_rb_first(&qp->q.rb_fragments);
+- struct sk_buff **nextp; /* To build frag_list. */
+- struct rb_node *rbn;
+- int len;
+- int ihlen;
+- int delta;
+- int err;
++ void *reasm_data;
++ int len, err;
+ u8 ecn;
+
+ ipq_kill(qp);
+@@ -530,117 +414,23 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
+ err = -EINVAL;
+ goto out_fail;
+ }
+- /* Make the one we just received the head. */
+- if (head != skb) {
+- fp = skb_clone(skb, GFP_ATOMIC);
+- if (!fp)
+- goto out_nomem;
+- FRAG_CB(fp)->next_frag = FRAG_CB(skb)->next_frag;
+- if (RB_EMPTY_NODE(&skb->rbnode))
+- FRAG_CB(prev_tail)->next_frag = fp;
+- else
+- rb_replace_node(&skb->rbnode, &fp->rbnode,
+- &qp->q.rb_fragments);
+- if (qp->q.fragments_tail == skb)
+- qp->q.fragments_tail = fp;
+- skb_morph(skb, head);
+- FRAG_CB(skb)->next_frag = FRAG_CB(head)->next_frag;
+- rb_replace_node(&head->rbnode, &skb->rbnode,
+- &qp->q.rb_fragments);
+- consume_skb(head);
+- head = skb;
+- }
+
+- WARN_ON(head->ip_defrag_offset != 0);
+-
+- /* Allocate a new buffer for the datagram. */
+- ihlen = ip_hdrlen(head);
+- len = ihlen + qp->q.len;
++ /* Make the one we just received the head. */
++ reasm_data = inet_frag_reasm_prepare(&qp->q, skb, prev_tail);
++ if (!reasm_data)
++ goto out_nomem;
+
++ len = ip_hdrlen(skb) + qp->q.len;
+ err = -E2BIG;
+ if (len > 65535)
+ goto out_oversize;
+
+- delta = - head->truesize;
+-
+- /* Head of list must not be cloned. */
+- if (skb_unclone(head, GFP_ATOMIC))
+- goto out_nomem;
+-
+- delta += head->truesize;
+- if (delta)
+- add_frag_mem_limit(qp->q.net, delta);
+-
+- /* If the first fragment is fragmented itself, we split
+- * it to two chunks: the first with data and paged part
+- * and the second, holding only fragments. */
+- if (skb_has_frag_list(head)) {
+- struct sk_buff *clone;
+- int i, plen = 0;
+-
+- clone = alloc_skb(0, GFP_ATOMIC);
+- if (!clone)
+- goto out_nomem;
+- skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
+- skb_frag_list_init(head);
+- for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
+- plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
+- clone->len = clone->data_len = head->data_len - plen;
+- head->truesize += clone->truesize;
+- clone->csum = 0;
+- clone->ip_summed = head->ip_summed;
+- add_frag_mem_limit(qp->q.net, clone->truesize);
+- skb_shinfo(head)->frag_list = clone;
+- nextp = &clone->next;
+- } else {
+- nextp = &skb_shinfo(head)->frag_list;
+- }
++ inet_frag_reasm_finish(&qp->q, skb, reasm_data);
+
+- skb_push(head, head->data - skb_network_header(head));
++ skb->dev = dev;
++ IPCB(skb)->frag_max_size = max(qp->max_df_size, qp->q.max_size);
+
+- /* Traverse the tree in order, to build frag_list. */
+- fp = FRAG_CB(head)->next_frag;
+- rbn = rb_next(&head->rbnode);
+- rb_erase(&head->rbnode, &qp->q.rb_fragments);
+- while (rbn || fp) {
+- /* fp points to the next sk_buff in the current run;
+- * rbn points to the next run.
+- */
+- /* Go through the current run. */
+- while (fp) {
+- *nextp = fp;
+- nextp = &fp->next;
+- fp->prev = NULL;
+- memset(&fp->rbnode, 0, sizeof(fp->rbnode));
+- fp->sk = NULL;
+- head->data_len += fp->len;
+- head->len += fp->len;
+- if (head->ip_summed != fp->ip_summed)
+- head->ip_summed = CHECKSUM_NONE;
+- else if (head->ip_summed == CHECKSUM_COMPLETE)
+- head->csum = csum_add(head->csum, fp->csum);
+- head->truesize += fp->truesize;
+- fp = FRAG_CB(fp)->next_frag;
+- }
+- /* Move to the next run. */
+- if (rbn) {
+- struct rb_node *rbnext = rb_next(rbn);
+-
+- fp = rb_to_skb(rbn);
+- rb_erase(rbn, &qp->q.rb_fragments);
+- rbn = rbnext;
+- }
+- }
+- sub_frag_mem_limit(qp->q.net, head->truesize);
+-
+- *nextp = NULL;
+- head->next = NULL;
+- head->prev = NULL;
+- head->dev = dev;
+- head->tstamp = qp->q.stamp;
+- IPCB(head)->frag_max_size = max(qp->max_df_size, qp->q.max_size);
+-
+- iph = ip_hdr(head);
++ iph = ip_hdr(skb);
+ iph->tot_len = htons(len);
+ iph->tos |= ecn;
+
+@@ -653,7 +443,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
+ * from one very small df-fragment and one large non-df frag.
+ */
+ if (qp->max_df_size == qp->q.max_size) {
+- IPCB(head)->flags |= IPSKB_FRAG_PMTU;
++ IPCB(skb)->flags |= IPSKB_FRAG_PMTU;
+ iph->frag_off = htons(IP_DF);
+ } else {
+ iph->frag_off = 0;
+@@ -751,28 +541,6 @@ struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user)
+ }
+ EXPORT_SYMBOL(ip_check_defrag);
+
+-unsigned int inet_frag_rbtree_purge(struct rb_root *root)
+-{
+- struct rb_node *p = rb_first(root);
+- unsigned int sum = 0;
+-
+- while (p) {
+- struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode);
+-
+- p = rb_next(p);
+- rb_erase(&skb->rbnode, root);
+- while (skb) {
+- struct sk_buff *next = FRAG_CB(skb)->next_frag;
+-
+- sum += skb->truesize;
+- kfree_skb(skb);
+- skb = next;
+- }
+- }
+- return sum;
+-}
+-EXPORT_SYMBOL(inet_frag_rbtree_purge);
+-
+ #ifdef CONFIG_SYSCTL
+ static int dist_min;
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 7a556e459375..98c81c21b753 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1187,9 +1187,23 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
+
+ static void ipv4_link_failure(struct sk_buff *skb)
+ {
++ struct ip_options opt;
+ struct rtable *rt;
++ int res;
+
+- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
++ /* Recompile ip options since IPCB may not be valid anymore.
++ */
++ memset(&opt, 0, sizeof(opt));
++ opt.optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr);
++
++ rcu_read_lock();
++ res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);
++ rcu_read_unlock();
++
++ if (res)
++ return;
++
++ __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt);
+
+ rt = skb_rtable(skb);
+ if (rt)
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 572f79abd393..cfdd70e32755 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -402,11 +402,12 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb)
+ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
++ int room;
++
++ room = min_t(int, tp->window_clamp, tcp_space(sk)) - tp->rcv_ssthresh;
+
+ /* Check #1 */
+- if (tp->rcv_ssthresh < tp->window_clamp &&
+- (int)tp->rcv_ssthresh < tcp_space(sk) &&
+- !tcp_under_memory_pressure(sk)) {
++ if (room > 0 && !tcp_under_memory_pressure(sk)) {
+ int incr;
+
+ /* Check #2. Increase window, if skb with such overhead
+@@ -419,8 +420,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
+
+ if (incr) {
+ incr = max_t(int, incr, 2 * skb->len);
+- tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
+- tp->window_clamp);
++ tp->rcv_ssthresh += min(room, incr);
+ inet_csk(sk)->icsk_ack.quick |= 1;
+ }
+ }
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index 043ed8eb0ab9..cb1b4772dac0 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -136,6 +136,9 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
+ }
+ #endif
+
++static int nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *skb,
++ struct sk_buff *prev_tail, struct net_device *dev);
++
+ static inline u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h)
+ {
+ return 1 << (ipv6_get_dsfield(ipv6h) & INET_ECN_MASK);
+@@ -177,9 +180,10 @@ static struct frag_queue *fq_find(struct net *net, __be32 id, u32 user,
+ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
+ const struct frag_hdr *fhdr, int nhoff)
+ {
+- struct sk_buff *prev, *next;
+ unsigned int payload_len;
+- int offset, end;
++ struct net_device *dev;
++ struct sk_buff *prev;
++ int offset, end, err;
+ u8 ecn;
+
+ if (fq->q.flags & INET_FRAG_COMPLETE) {
+@@ -254,55 +258,18 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
+ goto err;
+ }
+
+- /* Find out which fragments are in front and at the back of us
+- * in the chain of fragments so far. We must know where to put
+- * this fragment, right?
+- */
+- prev = fq->q.fragments_tail;
+- if (!prev || prev->ip_defrag_offset < offset) {
+- next = NULL;
+- goto found;
+- }
+- prev = NULL;
+- for (next = fq->q.fragments; next != NULL; next = next->next) {
+- if (next->ip_defrag_offset >= offset)
+- break; /* bingo! */
+- prev = next;
+- }
+-
+-found:
+- /* RFC5722, Section 4:
+- * When reassembling an IPv6 datagram, if
+- * one or more its constituent fragments is determined to be an
+- * overlapping fragment, the entire datagram (and any constituent
+- * fragments, including those not yet received) MUST be silently
+- * discarded.
+- */
+-
+- /* Check for overlap with preceding fragment. */
+- if (prev &&
+- (prev->ip_defrag_offset + prev->len) > offset)
+- goto discard_fq;
+-
+- /* Look for overlap with succeeding segment. */
+- if (next && next->ip_defrag_offset < end)
+- goto discard_fq;
+-
+- /* Note : skb->ip_defrag_offset and skb->dev share the same location */
+- if (skb->dev)
+- fq->iif = skb->dev->ifindex;
++ /* Note : skb->rbnode and skb->dev share the same location. */
++ dev = skb->dev;
+ /* Makes sure compiler wont do silly aliasing games */
+ barrier();
+- skb->ip_defrag_offset = offset;
+
+- /* Insert this fragment in the chain of fragments. */
+- skb->next = next;
+- if (!next)
+- fq->q.fragments_tail = skb;
+- if (prev)
+- prev->next = skb;
+- else
+- fq->q.fragments = skb;
++ prev = fq->q.fragments_tail;
++ err = inet_frag_queue_insert(&fq->q, skb, offset, end);
++ if (err)
++ goto insert_error;
++
++ if (dev)
++ fq->iif = dev->ifindex;
+
+ fq->q.stamp = skb->tstamp;
+ fq->q.meat += skb->len;
+@@ -319,11 +286,25 @@ found:
+ fq->q.flags |= INET_FRAG_FIRST_IN;
+ }
+
+- return 0;
++ if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
++ fq->q.meat == fq->q.len) {
++ unsigned long orefdst = skb->_skb_refdst;
++
++ skb->_skb_refdst = 0UL;
++ err = nf_ct_frag6_reasm(fq, skb, prev, dev);
++ skb->_skb_refdst = orefdst;
++ return err;
++ }
++
++ skb_dst_drop(skb);
++ return -EINPROGRESS;
+
+-discard_fq:
++insert_error:
++ if (err == IPFRAG_DUP)
++ goto err;
+ inet_frag_kill(&fq->q);
+ err:
++ skb_dst_drop(skb);
+ return -EINVAL;
+ }
+
+@@ -333,147 +314,67 @@ err:
+ * It is called with locked fq, and caller must check that
+ * queue is eligible for reassembly i.e. it is not COMPLETE,
+ * the last and the first frames arrived and all the bits are here.
+- *
+- * returns true if *prev skb has been transformed into the reassembled
+- * skb, false otherwise.
+ */
+-static bool
+-nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev, struct net_device *dev)
++static int nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *skb,
++ struct sk_buff *prev_tail, struct net_device *dev)
+ {
+- struct sk_buff *fp, *head = fq->q.fragments;
+- int payload_len, delta;
++ void *reasm_data;
++ int payload_len;
+ u8 ecn;
+
+ inet_frag_kill(&fq->q);
+
+- WARN_ON(head == NULL);
+- WARN_ON(head->ip_defrag_offset != 0);
+-
+ ecn = ip_frag_ecn_table[fq->ecn];
+ if (unlikely(ecn == 0xff))
+- return false;
++ goto err;
++
++ reasm_data = inet_frag_reasm_prepare(&fq->q, skb, prev_tail);
++ if (!reasm_data)
++ goto err;
+
+- /* Unfragmented part is taken from the first segment. */
+- payload_len = ((head->data - skb_network_header(head)) -
++ payload_len = ((skb->data - skb_network_header(skb)) -
+ sizeof(struct ipv6hdr) + fq->q.len -
+ sizeof(struct frag_hdr));
+ if (payload_len > IPV6_MAXPLEN) {
+ net_dbg_ratelimited("nf_ct_frag6_reasm: payload len = %d\n",
+ payload_len);
+- return false;
+- }
+-
+- delta = - head->truesize;
+-
+- /* Head of list must not be cloned. */
+- if (skb_unclone(head, GFP_ATOMIC))
+- return false;
+-
+- delta += head->truesize;
+- if (delta)
+- add_frag_mem_limit(fq->q.net, delta);
+-
+- /* If the first fragment is fragmented itself, we split
+- * it to two chunks: the first with data and paged part
+- * and the second, holding only fragments. */
+- if (skb_has_frag_list(head)) {
+- struct sk_buff *clone;
+- int i, plen = 0;
+-
+- clone = alloc_skb(0, GFP_ATOMIC);
+- if (clone == NULL)
+- return false;
+-
+- clone->next = head->next;
+- head->next = clone;
+- skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
+- skb_frag_list_init(head);
+- for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
+- plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
+- clone->len = clone->data_len = head->data_len - plen;
+- head->data_len -= clone->len;
+- head->len -= clone->len;
+- clone->csum = 0;
+- clone->ip_summed = head->ip_summed;
+-
+- add_frag_mem_limit(fq->q.net, clone->truesize);
+- }
+-
+- /* morph head into last received skb: prev.
+- *
+- * This allows callers of ipv6 conntrack defrag to continue
+- * to use the last skb(frag) passed into the reasm engine.
+- * The last skb frag 'silently' turns into the full reassembled skb.
+- *
+- * Since prev is also part of q->fragments we have to clone it first.
+- */
+- if (head != prev) {
+- struct sk_buff *iter;
+-
+- fp = skb_clone(prev, GFP_ATOMIC);
+- if (!fp)
+- return false;
+-
+- fp->next = prev->next;
+-
+- iter = head;
+- while (iter) {
+- if (iter->next == prev) {
+- iter->next = fp;
+- break;
+- }
+- iter = iter->next;
+- }
+-
+- skb_morph(prev, head);
+- prev->next = head->next;
+- consume_skb(head);
+- head = prev;
++ goto err;
+ }
+
+ /* We have to remove fragment header from datagram and to relocate
+ * header in order to calculate ICV correctly. */
+- skb_network_header(head)[fq->nhoffset] = skb_transport_header(head)[0];
+- memmove(head->head + sizeof(struct frag_hdr), head->head,
+- (head->data - head->head) - sizeof(struct frag_hdr));
+- head->mac_header += sizeof(struct frag_hdr);
+- head->network_header += sizeof(struct frag_hdr);
+-
+- skb_shinfo(head)->frag_list = head->next;
+- skb_reset_transport_header(head);
+- skb_push(head, head->data - skb_network_header(head));
+-
+- for (fp = head->next; fp; fp = fp->next) {
+- head->data_len += fp->len;
+- head->len += fp->len;
+- if (head->ip_summed != fp->ip_summed)
+- head->ip_summed = CHECKSUM_NONE;
+- else if (head->ip_summed == CHECKSUM_COMPLETE)
+- head->csum = csum_add(head->csum, fp->csum);
+- head->truesize += fp->truesize;
+- fp->sk = NULL;
+- }
+- sub_frag_mem_limit(fq->q.net, head->truesize);
++ skb_network_header(skb)[fq->nhoffset] = skb_transport_header(skb)[0];
++ memmove(skb->head + sizeof(struct frag_hdr), skb->head,
++ (skb->data - skb->head) - sizeof(struct frag_hdr));
++ skb->mac_header += sizeof(struct frag_hdr);
++ skb->network_header += sizeof(struct frag_hdr);
++
++ skb_reset_transport_header(skb);
++
++ inet_frag_reasm_finish(&fq->q, skb, reasm_data);
+
+- head->ignore_df = 1;
+- head->next = NULL;
+- head->dev = dev;
+- head->tstamp = fq->q.stamp;
+- ipv6_hdr(head)->payload_len = htons(payload_len);
+- ipv6_change_dsfield(ipv6_hdr(head), 0xff, ecn);
+- IP6CB(head)->frag_max_size = sizeof(struct ipv6hdr) + fq->q.max_size;
++ skb->ignore_df = 1;
++ skb->dev = dev;
++ ipv6_hdr(skb)->payload_len = htons(payload_len);
++ ipv6_change_dsfield(ipv6_hdr(skb), 0xff, ecn);
++ IP6CB(skb)->frag_max_size = sizeof(struct ipv6hdr) + fq->q.max_size;
+
+ /* Yes, and fold redundant checksum back. 8) */
+- if (head->ip_summed == CHECKSUM_COMPLETE)
+- head->csum = csum_partial(skb_network_header(head),
+- skb_network_header_len(head),
+- head->csum);
++ if (skb->ip_summed == CHECKSUM_COMPLETE)
++ skb->csum = csum_partial(skb_network_header(skb),
++ skb_network_header_len(skb),
++ skb->csum);
+
+ fq->q.fragments = NULL;
+ fq->q.rb_fragments = RB_ROOT;
+ fq->q.fragments_tail = NULL;
++ fq->q.last_run_head = NULL;
+
+- return true;
++ return 0;
++
++err:
++ inet_frag_kill(&fq->q);
++ return -EINVAL;
+ }
+
+ /*
+@@ -542,7 +443,6 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
+ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
+ {
+ u16 savethdr = skb->transport_header;
+- struct net_device *dev = skb->dev;
+ int fhoff, nhoff, ret;
+ struct frag_hdr *fhdr;
+ struct frag_queue *fq;
+@@ -565,10 +465,6 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
+ hdr = ipv6_hdr(skb);
+ fhdr = (struct frag_hdr *)skb_transport_header(skb);
+
+- if (skb->len - skb_network_offset(skb) < IPV6_MIN_MTU &&
+- fhdr->frag_off & htons(IP6_MF))
+- return -EINVAL;
+-
+ skb_orphan(skb);
+ fq = fq_find(net, fhdr->identification, user, hdr,
+ skb->dev ? skb->dev->ifindex : 0);
+@@ -580,31 +476,17 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
+ spin_lock_bh(&fq->q.lock);
+
+ ret = nf_ct_frag6_queue(fq, skb, fhdr, nhoff);
+- if (ret < 0) {
+- if (ret == -EPROTO) {
+- skb->transport_header = savethdr;
+- ret = 0;
+- }
+- goto out_unlock;
++ if (ret == -EPROTO) {
++ skb->transport_header = savethdr;
++ ret = 0;
+ }
+
+ /* after queue has assumed skb ownership, only 0 or -EINPROGRESS
+ * must be returned.
+ */
+- ret = -EINPROGRESS;
+- if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
+- fq->q.meat == fq->q.len) {
+- unsigned long orefdst = skb->_skb_refdst;
+-
+- skb->_skb_refdst = 0UL;
+- if (nf_ct_frag6_reasm(fq, skb, dev))
+- ret = 0;
+- skb->_skb_refdst = orefdst;
+- } else {
+- skb_dst_drop(skb);
+- }
++ if (ret)
++ ret = -EINPROGRESS;
+
+-out_unlock:
+ spin_unlock_bh(&fq->q.lock);
+ inet_frag_put(&fq->q);
+ return ret;
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index 7c943392c128..095825f964e2 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -69,8 +69,8 @@ static u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h)
+
+ static struct inet_frags ip6_frags;
+
+-static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
+- struct net_device *dev);
++static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *skb,
++ struct sk_buff *prev_tail, struct net_device *dev);
+
+ static void ip6_frag_expire(struct timer_list *t)
+ {
+@@ -111,21 +111,26 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
+ struct frag_hdr *fhdr, int nhoff,
+ u32 *prob_offset)
+ {
+- struct sk_buff *prev, *next;
+- struct net_device *dev;
+- int offset, end, fragsize;
+ struct net *net = dev_net(skb_dst(skb)->dev);
++ int offset, end, fragsize;
++ struct sk_buff *prev_tail;
++ struct net_device *dev;
++ int err = -ENOENT;
+ u8 ecn;
+
+ if (fq->q.flags & INET_FRAG_COMPLETE)
+ goto err;
+
++ err = -EINVAL;
+ offset = ntohs(fhdr->frag_off) & ~0x7;
+ end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
+ ((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
+
+ if ((unsigned int)end > IPV6_MAXPLEN) {
+ *prob_offset = (u8 *)&fhdr->frag_off - skb_network_header(skb);
++ /* note that if prob_offset is set, the skb is freed elsewhere,
++ * we do not free it here.
++ */
+ return -1;
+ }
+
+@@ -145,7 +150,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
+ */
+ if (end < fq->q.len ||
+ ((fq->q.flags & INET_FRAG_LAST_IN) && end != fq->q.len))
+- goto err;
++ goto discard_fq;
+ fq->q.flags |= INET_FRAG_LAST_IN;
+ fq->q.len = end;
+ } else {
+@@ -162,70 +167,35 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
+ if (end > fq->q.len) {
+ /* Some bits beyond end -> corruption. */
+ if (fq->q.flags & INET_FRAG_LAST_IN)
+- goto err;
++ goto discard_fq;
+ fq->q.len = end;
+ }
+ }
+
+ if (end == offset)
+- goto err;
++ goto discard_fq;
+
++ err = -ENOMEM;
+ /* Point into the IP datagram 'data' part. */
+ if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data))
+- goto err;
+-
+- if (pskb_trim_rcsum(skb, end - offset))
+- goto err;
+-
+- /* Find out which fragments are in front and at the back of us
+- * in the chain of fragments so far. We must know where to put
+- * this fragment, right?
+- */
+- prev = fq->q.fragments_tail;
+- if (!prev || prev->ip_defrag_offset < offset) {
+- next = NULL;
+- goto found;
+- }
+- prev = NULL;
+- for (next = fq->q.fragments; next != NULL; next = next->next) {
+- if (next->ip_defrag_offset >= offset)
+- break; /* bingo! */
+- prev = next;
+- }
+-
+-found:
+- /* RFC5722, Section 4, amended by Errata ID : 3089
+- * When reassembling an IPv6 datagram, if
+- * one or more its constituent fragments is determined to be an
+- * overlapping fragment, the entire datagram (and any constituent
+- * fragments) MUST be silently discarded.
+- */
+-
+- /* Check for overlap with preceding fragment. */
+- if (prev &&
+- (prev->ip_defrag_offset + prev->len) > offset)
+ goto discard_fq;
+
+- /* Look for overlap with succeeding segment. */
+- if (next && next->ip_defrag_offset < end)
++ err = pskb_trim_rcsum(skb, end - offset);
++ if (err)
+ goto discard_fq;
+
+- /* Note : skb->ip_defrag_offset and skb->dev share the same location */
++ /* Note : skb->rbnode and skb->dev share the same location. */
+ dev = skb->dev;
+- if (dev)
+- fq->iif = dev->ifindex;
+ /* Makes sure compiler wont do silly aliasing games */
+ barrier();
+- skb->ip_defrag_offset = offset;
+
+- /* Insert this fragment in the chain of fragments. */
+- skb->next = next;
+- if (!next)
+- fq->q.fragments_tail = skb;
+- if (prev)
+- prev->next = skb;
+- else
+- fq->q.fragments = skb;
++ prev_tail = fq->q.fragments_tail;
++ err = inet_frag_queue_insert(&fq->q, skb, offset, end);
++ if (err)
++ goto insert_error;
++
++ if (dev)
++ fq->iif = dev->ifindex;
+
+ fq->q.stamp = skb->tstamp;
+ fq->q.meat += skb->len;
+@@ -246,44 +216,48 @@ found:
+
+ if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
+ fq->q.meat == fq->q.len) {
+- int res;
+ unsigned long orefdst = skb->_skb_refdst;
+
+ skb->_skb_refdst = 0UL;
+- res = ip6_frag_reasm(fq, prev, dev);
++ err = ip6_frag_reasm(fq, skb, prev_tail, dev);
+ skb->_skb_refdst = orefdst;
+- return res;
++ return err;
+ }
+
+ skb_dst_drop(skb);
+- return -1;
++ return -EINPROGRESS;
+
++insert_error:
++ if (err == IPFRAG_DUP) {
++ kfree_skb(skb);
++ return -EINVAL;
++ }
++ err = -EINVAL;
++ __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
++ IPSTATS_MIB_REASM_OVERLAPS);
+ discard_fq:
+ inet_frag_kill(&fq->q);
+-err:
+ __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+ IPSTATS_MIB_REASMFAILS);
++err:
+ kfree_skb(skb);
+- return -1;
++ return err;
+ }
+
+ /*
+ * Check if this packet is complete.
+- * Returns NULL on failure by any reason, and pointer
+- * to current nexthdr field in reassembled frame.
+ *
+ * It is called with locked fq, and caller must check that
+ * queue is eligible for reassembly i.e. it is not COMPLETE,
+ * the last and the first frames arrived and all the bits are here.
+ */
+-static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
+- struct net_device *dev)
++static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *skb,
++ struct sk_buff *prev_tail, struct net_device *dev)
+ {
+ struct net *net = container_of(fq->q.net, struct net, ipv6.frags);
+- struct sk_buff *fp, *head = fq->q.fragments;
+- int payload_len, delta;
+ unsigned int nhoff;
+- int sum_truesize;
++ void *reasm_data;
++ int payload_len;
+ u8 ecn;
+
+ inet_frag_kill(&fq->q);
+@@ -292,121 +266,40 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
+ if (unlikely(ecn == 0xff))
+ goto out_fail;
+
+- /* Make the one we just received the head. */
+- if (prev) {
+- head = prev->next;
+- fp = skb_clone(head, GFP_ATOMIC);
+-
+- if (!fp)
+- goto out_oom;
+-
+- fp->next = head->next;
+- if (!fp->next)
+- fq->q.fragments_tail = fp;
+- prev->next = fp;
+-
+- skb_morph(head, fq->q.fragments);
+- head->next = fq->q.fragments->next;
+-
+- consume_skb(fq->q.fragments);
+- fq->q.fragments = head;
+- }
+-
+- WARN_ON(head == NULL);
+- WARN_ON(head->ip_defrag_offset != 0);
++ reasm_data = inet_frag_reasm_prepare(&fq->q, skb, prev_tail);
++ if (!reasm_data)
++ goto out_oom;
+
+- /* Unfragmented part is taken from the first segment. */
+- payload_len = ((head->data - skb_network_header(head)) -
++ payload_len = ((skb->data - skb_network_header(skb)) -
+ sizeof(struct ipv6hdr) + fq->q.len -
+ sizeof(struct frag_hdr));
+ if (payload_len > IPV6_MAXPLEN)
+ goto out_oversize;
+
+- delta = - head->truesize;
+-
+- /* Head of list must not be cloned. */
+- if (skb_unclone(head, GFP_ATOMIC))
+- goto out_oom;
+-
+- delta += head->truesize;
+- if (delta)
+- add_frag_mem_limit(fq->q.net, delta);
+-
+- /* If the first fragment is fragmented itself, we split
+- * it to two chunks: the first with data and paged part
+- * and the second, holding only fragments. */
+- if (skb_has_frag_list(head)) {
+- struct sk_buff *clone;
+- int i, plen = 0;
+-
+- clone = alloc_skb(0, GFP_ATOMIC);
+- if (!clone)
+- goto out_oom;
+- clone->next = head->next;
+- head->next = clone;
+- skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
+- skb_frag_list_init(head);
+- for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
+- plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
+- clone->len = clone->data_len = head->data_len - plen;
+- head->data_len -= clone->len;
+- head->len -= clone->len;
+- clone->csum = 0;
+- clone->ip_summed = head->ip_summed;
+- add_frag_mem_limit(fq->q.net, clone->truesize);
+- }
+-
+ /* We have to remove fragment header from datagram and to relocate
+ * header in order to calculate ICV correctly. */
+ nhoff = fq->nhoffset;
+- skb_network_header(head)[nhoff] = skb_transport_header(head)[0];
+- memmove(head->head + sizeof(struct frag_hdr), head->head,
+- (head->data - head->head) - sizeof(struct frag_hdr));
+- if (skb_mac_header_was_set(head))
+- head->mac_header += sizeof(struct frag_hdr);
+- head->network_header += sizeof(struct frag_hdr);
+-
+- skb_reset_transport_header(head);
+- skb_push(head, head->data - skb_network_header(head));
+-
+- sum_truesize = head->truesize;
+- for (fp = head->next; fp;) {
+- bool headstolen;
+- int delta;
+- struct sk_buff *next = fp->next;
+-
+- sum_truesize += fp->truesize;
+- if (head->ip_summed != fp->ip_summed)
+- head->ip_summed = CHECKSUM_NONE;
+- else if (head->ip_summed == CHECKSUM_COMPLETE)
+- head->csum = csum_add(head->csum, fp->csum);
+-
+- if (skb_try_coalesce(head, fp, &headstolen, &delta)) {
+- kfree_skb_partial(fp, headstolen);
+- } else {
+- fp->sk = NULL;
+- if (!skb_shinfo(head)->frag_list)
+- skb_shinfo(head)->frag_list = fp;
+- head->data_len += fp->len;
+- head->len += fp->len;
+- head->truesize += fp->truesize;
+- }
+- fp = next;
+- }
+- sub_frag_mem_limit(fq->q.net, sum_truesize);
++ skb_network_header(skb)[nhoff] = skb_transport_header(skb)[0];
++ memmove(skb->head + sizeof(struct frag_hdr), skb->head,
++ (skb->data - skb->head) - sizeof(struct frag_hdr));
++ if (skb_mac_header_was_set(skb))
++ skb->mac_header += sizeof(struct frag_hdr);
++ skb->network_header += sizeof(struct frag_hdr);
++
++ skb_reset_transport_header(skb);
++
++ inet_frag_reasm_finish(&fq->q, skb, reasm_data);
+
+- head->next = NULL;
+- head->dev = dev;
+- head->tstamp = fq->q.stamp;
+- ipv6_hdr(head)->payload_len = htons(payload_len);
+- ipv6_change_dsfield(ipv6_hdr(head), 0xff, ecn);
+- IP6CB(head)->nhoff = nhoff;
+- IP6CB(head)->flags |= IP6SKB_FRAGMENTED;
+- IP6CB(head)->frag_max_size = fq->q.max_size;
++ skb->dev = dev;
++ ipv6_hdr(skb)->payload_len = htons(payload_len);
++ ipv6_change_dsfield(ipv6_hdr(skb), 0xff, ecn);
++ IP6CB(skb)->nhoff = nhoff;
++ IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
++ IP6CB(skb)->frag_max_size = fq->q.max_size;
+
+ /* Yes, and fold redundant checksum back. 8) */
+- skb_postpush_rcsum(head, skb_network_header(head),
+- skb_network_header_len(head));
++ skb_postpush_rcsum(skb, skb_network_header(skb),
++ skb_network_header_len(skb));
+
+ rcu_read_lock();
+ __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
+@@ -414,6 +307,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
+ fq->q.fragments = NULL;
+ fq->q.rb_fragments = RB_ROOT;
+ fq->q.fragments_tail = NULL;
++ fq->q.last_run_head = NULL;
+ return 1;
+
+ out_oversize:
+@@ -425,6 +319,7 @@ out_fail:
+ rcu_read_lock();
+ __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
+ rcu_read_unlock();
++ inet_frag_kill(&fq->q);
+ return -1;
+ }
+
+@@ -463,10 +358,6 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
+ return 1;
+ }
+
+- if (skb->len - skb_network_offset(skb) < IPV6_MIN_MTU &&
+- fhdr->frag_off & htons(IP6_MF))
+- goto fail_hdr;
+-
+ iif = skb->dev ? skb->dev->ifindex : 0;
+ fq = fq_find(net, fhdr->identification, hdr, iif);
+ if (fq) {
+@@ -484,6 +375,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
+ if (prob_offset) {
+ __IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev),
+ IPSTATS_MIB_INHDRERRORS);
++ /* icmpv6_param_prob() calls kfree_skb(skb) */
+ icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, prob_offset);
+ }
+ return ret;
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 9006bb3c9e72..06fa8425d82c 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2367,6 +2367,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
+
+ rcu_read_lock();
+ from = rcu_dereference(rt6->from);
++ if (!from) {
++ rcu_read_unlock();
++ return;
++ }
+ nrt6 = ip6_rt_cache_alloc(from, daddr, saddr);
+ if (nrt6) {
+ rt6_do_update_pmtu(nrt6, mtu);
+diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
+index 8f6998091d26..2123f6e90fc0 100644
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1166,6 +1166,9 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local,
+ {
+ struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif);
+
++ if (local->in_reconfig)
++ return;
++
+ if (!check_sdata_in_driver(sdata))
+ return;
+
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index 793016d722ec..9fd37d91b5ed 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -1508,32 +1508,29 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free)
+ return idx + (tin << 16);
+ }
+
+-static void cake_wash_diffserv(struct sk_buff *skb)
+-{
+- switch (skb->protocol) {
+- case htons(ETH_P_IP):
+- ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0);
+- break;
+- case htons(ETH_P_IPV6):
+- ipv6_change_dsfield(ipv6_hdr(skb), INET_ECN_MASK, 0);
+- break;
+- default:
+- break;
+- }
+-}
+-
+ static u8 cake_handle_diffserv(struct sk_buff *skb, u16 wash)
+ {
++ int wlen = skb_network_offset(skb);
+ u8 dscp;
+
+- switch (skb->protocol) {
++ switch (tc_skb_protocol(skb)) {
+ case htons(ETH_P_IP):
++ wlen += sizeof(struct iphdr);
++ if (!pskb_may_pull(skb, wlen) ||
++ skb_try_make_writable(skb, wlen))
++ return 0;
++
+ dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
+ if (wash && dscp)
+ ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0);
+ return dscp;
+
+ case htons(ETH_P_IPV6):
++ wlen += sizeof(struct ipv6hdr);
++ if (!pskb_may_pull(skb, wlen) ||
++ skb_try_make_writable(skb, wlen))
++ return 0;
++
+ dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
+ if (wash && dscp)
+ ipv6_change_dsfield(ipv6_hdr(skb), INET_ECN_MASK, 0);
+@@ -1553,25 +1550,27 @@ static struct cake_tin_data *cake_select_tin(struct Qdisc *sch,
+ {
+ struct cake_sched_data *q = qdisc_priv(sch);
+ u32 tin;
++ u8 dscp;
++
++ /* Tin selection: Default to diffserv-based selection, allow overriding
++ * using firewall marks or skb->priority.
++ */
++ dscp = cake_handle_diffserv(skb,
++ q->rate_flags & CAKE_FLAG_WASH);
+
+- if (TC_H_MAJ(skb->priority) == sch->handle &&
+- TC_H_MIN(skb->priority) > 0 &&
+- TC_H_MIN(skb->priority) <= q->tin_cnt) {
++ if (q->tin_mode == CAKE_DIFFSERV_BESTEFFORT)
++ tin = 0;
++
++ else if (TC_H_MAJ(skb->priority) == sch->handle &&
++ TC_H_MIN(skb->priority) > 0 &&
++ TC_H_MIN(skb->priority) <= q->tin_cnt)
+ tin = q->tin_order[TC_H_MIN(skb->priority) - 1];
+
+- if (q->rate_flags & CAKE_FLAG_WASH)
+- cake_wash_diffserv(skb);
+- } else if (q->tin_mode != CAKE_DIFFSERV_BESTEFFORT) {
+- /* extract the Diffserv Precedence field, if it exists */
+- /* and clear DSCP bits if washing */
+- tin = q->tin_index[cake_handle_diffserv(skb,
+- q->rate_flags & CAKE_FLAG_WASH)];
++ else {
++ tin = q->tin_index[dscp];
++
+ if (unlikely(tin >= q->tin_cnt))
+ tin = 0;
+- } else {
+- tin = 0;
+- if (q->rate_flags & CAKE_FLAG_WASH)
+- cake_wash_diffserv(skb);
+ }
+
+ return &q->tins[tin];
+diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
+index 66d5b2c5987a..d72985ca1d55 100644
+--- a/net/tipc/name_table.c
++++ b/net/tipc/name_table.c
+@@ -908,7 +908,8 @@ static int tipc_nl_service_list(struct net *net, struct tipc_nl_msg *msg,
+ for (; i < TIPC_NAMETBL_SIZE; i++) {
+ head = &tn->nametbl->services[i];
+
+- if (*last_type) {
++ if (*last_type ||
++ (!i && *last_key && (*last_lower == *last_key))) {
+ service = tipc_service_find(net, *last_type);
+ if (!service)
+ return -EPIPE;
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index 7be43697ff84..7f40b6aab689 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -47,49 +47,9 @@ typedef struct {
+ struct devtable {
+ const char *device_id; /* name of table, __mod_<name>__*_device_table. */
+ unsigned long id_size;
+- void *function;
++ int (*do_entry)(const char *filename, void *symval, char *alias);
+ };
+
+-#define ___cat(a,b) a ## b
+-#define __cat(a,b) ___cat(a,b)
+-
+-/* we need some special handling for this host tool running eventually on
+- * Darwin. The Mach-O section handling is a bit different than ELF section
+- * handling. The differnces in detail are:
+- * a) we have segments which have sections
+- * b) we need a API call to get the respective section symbols */
+-#if defined(__MACH__)
+-#include <mach-o/getsect.h>
+-
+-#define INIT_SECTION(name) do { \
+- unsigned long name ## _len; \
+- char *__cat(pstart_,name) = getsectdata("__TEXT", \
+- #name, &__cat(name,_len)); \
+- char *__cat(pstop_,name) = __cat(pstart_,name) + \
+- __cat(name, _len); \
+- __cat(__start_,name) = (void *)__cat(pstart_,name); \
+- __cat(__stop_,name) = (void *)__cat(pstop_,name); \
+- } while (0)
+-#define SECTION(name) __attribute__((section("__TEXT, " #name)))
+-
+-struct devtable **__start___devtable, **__stop___devtable;
+-#else
+-#define INIT_SECTION(name) /* no-op for ELF */
+-#define SECTION(name) __attribute__((section(#name)))
+-
+-/* We construct a table of pointers in an ELF section (pointers generally
+- * go unpadded by gcc). ld creates boundary syms for us. */
+-extern struct devtable *__start___devtable[], *__stop___devtable[];
+-#endif /* __MACH__ */
+-
+-#if !defined(__used)
+-# if __GNUC__ == 3 && __GNUC_MINOR__ < 3
+-# define __used __attribute__((__unused__))
+-# else
+-# define __used __attribute__((__used__))
+-# endif
+-#endif
+-
+ /* Define a variable f that holds the value of field f of struct devid
+ * based at address m.
+ */
+@@ -102,16 +62,6 @@ extern struct devtable *__start___devtable[], *__stop___devtable[];
+ #define DEF_FIELD_ADDR(m, devid, f) \
+ typeof(((struct devid *)0)->f) *f = ((m) + OFF_##devid##_##f)
+
+-/* Add a table entry. We test function type matches while we're here. */
+-#define ADD_TO_DEVTABLE(device_id, type, function) \
+- static struct devtable __cat(devtable,__LINE__) = { \
+- device_id + 0*sizeof((function)((const char *)NULL, \
+- (void *)NULL, \
+- (char *)NULL)), \
+- SIZE_##type, (function) }; \
+- static struct devtable *SECTION(__devtable) __used \
+- __cat(devtable_ptr,__LINE__) = &__cat(devtable,__LINE__)
+-
+ #define ADD(str, sep, cond, field) \
+ do { \
+ strcat(str, sep); \
+@@ -431,7 +381,6 @@ static int do_hid_entry(const char *filename,
+
+ return 1;
+ }
+-ADD_TO_DEVTABLE("hid", hid_device_id, do_hid_entry);
+
+ /* Looks like: ieee1394:venNmoNspNverN */
+ static int do_ieee1394_entry(const char *filename,
+@@ -456,7 +405,6 @@ static int do_ieee1394_entry(const char *filename,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("ieee1394", ieee1394_device_id, do_ieee1394_entry);
+
+ /* Looks like: pci:vNdNsvNsdNbcNscNiN. */
+ static int do_pci_entry(const char *filename,
+@@ -500,7 +448,6 @@ static int do_pci_entry(const char *filename,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("pci", pci_device_id, do_pci_entry);
+
+ /* looks like: "ccw:tNmNdtNdmN" */
+ static int do_ccw_entry(const char *filename,
+@@ -524,7 +471,6 @@ static int do_ccw_entry(const char *filename,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("ccw", ccw_device_id, do_ccw_entry);
+
+ /* looks like: "ap:tN" */
+ static int do_ap_entry(const char *filename,
+@@ -535,7 +481,6 @@ static int do_ap_entry(const char *filename,
+ sprintf(alias, "ap:t%02X*", dev_type);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("ap", ap_device_id, do_ap_entry);
+
+ /* looks like: "css:tN" */
+ static int do_css_entry(const char *filename,
+@@ -546,7 +491,6 @@ static int do_css_entry(const char *filename,
+ sprintf(alias, "css:t%01X", type);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("css", css_device_id, do_css_entry);
+
+ /* Looks like: "serio:tyNprNidNexN" */
+ static int do_serio_entry(const char *filename,
+@@ -566,7 +510,6 @@ static int do_serio_entry(const char *filename,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("serio", serio_device_id, do_serio_entry);
+
+ /* looks like: "acpi:ACPI0003" or "acpi:PNP0C0B" or "acpi:LNXVIDEO" or
+ * "acpi:bbsspp" (bb=base-class, ss=sub-class, pp=prog-if)
+@@ -604,7 +547,6 @@ static int do_acpi_entry(const char *filename,
+ }
+ return 1;
+ }
+-ADD_TO_DEVTABLE("acpi", acpi_device_id, do_acpi_entry);
+
+ /* looks like: "pnp:dD" */
+ static void do_pnp_device_entry(void *symval, unsigned long size,
+@@ -725,7 +667,6 @@ static int do_pcmcia_entry(const char *filename,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("pcmcia", pcmcia_device_id, do_pcmcia_entry);
+
+ static int do_vio_entry(const char *filename, void *symval,
+ char *alias)
+@@ -745,7 +686,6 @@ static int do_vio_entry(const char *filename, void *symval,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("vio", vio_device_id, do_vio_entry);
+
+ #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+
+@@ -818,7 +758,6 @@ static int do_input_entry(const char *filename, void *symval,
+ do_input(alias, *swbit, 0, INPUT_DEVICE_ID_SW_MAX);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("input", input_device_id, do_input_entry);
+
+ static int do_eisa_entry(const char *filename, void *symval,
+ char *alias)
+@@ -830,7 +769,6 @@ static int do_eisa_entry(const char *filename, void *symval,
+ strcat(alias, "*");
+ return 1;
+ }
+-ADD_TO_DEVTABLE("eisa", eisa_device_id, do_eisa_entry);
+
+ /* Looks like: parisc:tNhvNrevNsvN */
+ static int do_parisc_entry(const char *filename, void *symval,
+@@ -850,7 +788,6 @@ static int do_parisc_entry(const char *filename, void *symval,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("parisc", parisc_device_id, do_parisc_entry);
+
+ /* Looks like: sdio:cNvNdN. */
+ static int do_sdio_entry(const char *filename,
+@@ -867,7 +804,6 @@ static int do_sdio_entry(const char *filename,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("sdio", sdio_device_id, do_sdio_entry);
+
+ /* Looks like: ssb:vNidNrevN. */
+ static int do_ssb_entry(const char *filename,
+@@ -884,7 +820,6 @@ static int do_ssb_entry(const char *filename,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("ssb", ssb_device_id, do_ssb_entry);
+
+ /* Looks like: bcma:mNidNrevNclN. */
+ static int do_bcma_entry(const char *filename,
+@@ -903,7 +838,6 @@ static int do_bcma_entry(const char *filename,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("bcma", bcma_device_id, do_bcma_entry);
+
+ /* Looks like: virtio:dNvN */
+ static int do_virtio_entry(const char *filename, void *symval,
+@@ -919,7 +853,6 @@ static int do_virtio_entry(const char *filename, void *symval,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("virtio", virtio_device_id, do_virtio_entry);
+
+ /*
+ * Looks like: vmbus:guid
+@@ -942,7 +875,6 @@ static int do_vmbus_entry(const char *filename, void *symval,
+
+ return 1;
+ }
+-ADD_TO_DEVTABLE("vmbus", hv_vmbus_device_id, do_vmbus_entry);
+
+ /* Looks like: rpmsg:S */
+ static int do_rpmsg_entry(const char *filename, void *symval,
+@@ -953,7 +885,6 @@ static int do_rpmsg_entry(const char *filename, void *symval,
+
+ return 1;
+ }
+-ADD_TO_DEVTABLE("rpmsg", rpmsg_device_id, do_rpmsg_entry);
+
+ /* Looks like: i2c:S */
+ static int do_i2c_entry(const char *filename, void *symval,
+@@ -964,7 +895,6 @@ static int do_i2c_entry(const char *filename, void *symval,
+
+ return 1;
+ }
+-ADD_TO_DEVTABLE("i2c", i2c_device_id, do_i2c_entry);
+
+ /* Looks like: spi:S */
+ static int do_spi_entry(const char *filename, void *symval,
+@@ -975,7 +905,6 @@ static int do_spi_entry(const char *filename, void *symval,
+
+ return 1;
+ }
+-ADD_TO_DEVTABLE("spi", spi_device_id, do_spi_entry);
+
+ static const struct dmifield {
+ const char *prefix;
+@@ -1030,7 +959,6 @@ static int do_dmi_entry(const char *filename, void *symval,
+ strcat(alias, ":");
+ return 1;
+ }
+-ADD_TO_DEVTABLE("dmi", dmi_system_id, do_dmi_entry);
+
+ static int do_platform_entry(const char *filename,
+ void *symval, char *alias)
+@@ -1039,7 +967,6 @@ static int do_platform_entry(const char *filename,
+ sprintf(alias, PLATFORM_MODULE_PREFIX "%s", *name);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("platform", platform_device_id, do_platform_entry);
+
+ static int do_mdio_entry(const char *filename,
+ void *symval, char *alias)
+@@ -1064,7 +991,6 @@ static int do_mdio_entry(const char *filename,
+
+ return 1;
+ }
+-ADD_TO_DEVTABLE("mdio", mdio_device_id, do_mdio_entry);
+
+ /* Looks like: zorro:iN. */
+ static int do_zorro_entry(const char *filename, void *symval,
+@@ -1075,7 +1001,6 @@ static int do_zorro_entry(const char *filename, void *symval,
+ ADD(alias, "i", id != ZORRO_WILDCARD, id);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("zorro", zorro_device_id, do_zorro_entry);
+
+ /* looks like: "pnp:dD" */
+ static int do_isapnp_entry(const char *filename,
+@@ -1091,7 +1016,6 @@ static int do_isapnp_entry(const char *filename,
+ (function >> 12) & 0x0f, (function >> 8) & 0x0f);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("isapnp", isapnp_device_id, do_isapnp_entry);
+
+ /* Looks like: "ipack:fNvNdN". */
+ static int do_ipack_entry(const char *filename,
+@@ -1107,7 +1031,6 @@ static int do_ipack_entry(const char *filename,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("ipack", ipack_device_id, do_ipack_entry);
+
+ /*
+ * Append a match expression for a single masked hex digit.
+@@ -1178,7 +1101,6 @@ static int do_amba_entry(const char *filename,
+
+ return 1;
+ }
+-ADD_TO_DEVTABLE("amba", amba_id, do_amba_entry);
+
+ /*
+ * looks like: "mipscdmm:tN"
+@@ -1194,7 +1116,6 @@ static int do_mips_cdmm_entry(const char *filename,
+ sprintf(alias, "mipscdmm:t%02X*", type);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("mipscdmm", mips_cdmm_device_id, do_mips_cdmm_entry);
+
+ /* LOOKS like cpu:type:x86,venVVVVfamFFFFmodMMMM:feature:*,FEAT,*
+ * All fields are numbers. It would be nicer to use strings for vendor
+@@ -1219,7 +1140,6 @@ static int do_x86cpu_entry(const char *filename, void *symval,
+ sprintf(alias + strlen(alias), "%04X*", feature);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("x86cpu", x86_cpu_id, do_x86cpu_entry);
+
+ /* LOOKS like cpu:type:*:feature:*FEAT* */
+ static int do_cpu_entry(const char *filename, void *symval, char *alias)
+@@ -1229,7 +1149,6 @@ static int do_cpu_entry(const char *filename, void *symval, char *alias)
+ sprintf(alias, "cpu:type:*:feature:*%04X*", feature);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("cpu", cpu_feature, do_cpu_entry);
+
+ /* Looks like: mei:S:uuid:N:* */
+ static int do_mei_entry(const char *filename, void *symval,
+@@ -1248,7 +1167,6 @@ static int do_mei_entry(const char *filename, void *symval,
+
+ return 1;
+ }
+-ADD_TO_DEVTABLE("mei", mei_cl_device_id, do_mei_entry);
+
+ /* Looks like: rapidio:vNdNavNadN */
+ static int do_rio_entry(const char *filename,
+@@ -1268,7 +1186,6 @@ static int do_rio_entry(const char *filename,
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("rapidio", rio_device_id, do_rio_entry);
+
+ /* Looks like: ulpi:vNpN */
+ static int do_ulpi_entry(const char *filename, void *symval,
+@@ -1281,7 +1198,6 @@ static int do_ulpi_entry(const char *filename, void *symval,
+
+ return 1;
+ }
+-ADD_TO_DEVTABLE("ulpi", ulpi_device_id, do_ulpi_entry);
+
+ /* Looks like: hdaudio:vNrNaN */
+ static int do_hda_entry(const char *filename, void *symval, char *alias)
+@@ -1298,7 +1214,6 @@ static int do_hda_entry(const char *filename, void *symval, char *alias)
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("hdaudio", hda_device_id, do_hda_entry);
+
+ /* Looks like: sdw:mNpN */
+ static int do_sdw_entry(const char *filename, void *symval, char *alias)
+@@ -1313,7 +1228,6 @@ static int do_sdw_entry(const char *filename, void *symval, char *alias)
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("sdw", sdw_device_id, do_sdw_entry);
+
+ /* Looks like: fsl-mc:vNdN */
+ static int do_fsl_mc_entry(const char *filename, void *symval,
+@@ -1325,7 +1239,6 @@ static int do_fsl_mc_entry(const char *filename, void *symval,
+ sprintf(alias, "fsl-mc:v%08Xd%s", vendor, *obj_type);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("fslmc", fsl_mc_device_id, do_fsl_mc_entry);
+
+ /* Looks like: tbsvc:kSpNvNrN */
+ static int do_tbsvc_entry(const char *filename, void *symval, char *alias)
+@@ -1350,7 +1263,6 @@ static int do_tbsvc_entry(const char *filename, void *symval, char *alias)
+ add_wildcard(alias);
+ return 1;
+ }
+-ADD_TO_DEVTABLE("tbsvc", tb_service_id, do_tbsvc_entry);
+
+ /* Looks like: typec:idNmN */
+ static int do_typec_entry(const char *filename, void *symval, char *alias)
+@@ -1363,7 +1275,6 @@ static int do_typec_entry(const char *filename, void *symval, char *alias)
+
+ return 1;
+ }
+-ADD_TO_DEVTABLE("typec", typec_device_id, do_typec_entry);
+
+ /* Does namelen bytes of name exactly match the symbol? */
+ static bool sym_is(const char *name, unsigned namelen, const char *symbol)
+@@ -1377,12 +1288,11 @@ static bool sym_is(const char *name, unsigned namelen, const char *symbol)
+ static void do_table(void *symval, unsigned long size,
+ unsigned long id_size,
+ const char *device_id,
+- void *function,
++ int (*do_entry)(const char *filename, void *symval, char *alias),
+ struct module *mod)
+ {
+ unsigned int i;
+ char alias[500];
+- int (*do_entry)(const char *, void *entry, char *alias) = function;
+
+ device_id_check(mod->name, device_id, size, id_size, symval);
+ /* Leave last one: it's the terminator. */
+@@ -1396,6 +1306,48 @@ static void do_table(void *symval, unsigned long size,
+ }
+ }
+
++static const struct devtable devtable[] = {
++ {"hid", SIZE_hid_device_id, do_hid_entry},
++ {"ieee1394", SIZE_ieee1394_device_id, do_ieee1394_entry},
++ {"pci", SIZE_pci_device_id, do_pci_entry},
++ {"ccw", SIZE_ccw_device_id, do_ccw_entry},
++ {"ap", SIZE_ap_device_id, do_ap_entry},
++ {"css", SIZE_css_device_id, do_css_entry},
++ {"serio", SIZE_serio_device_id, do_serio_entry},
++ {"acpi", SIZE_acpi_device_id, do_acpi_entry},
++ {"pcmcia", SIZE_pcmcia_device_id, do_pcmcia_entry},
++ {"vio", SIZE_vio_device_id, do_vio_entry},
++ {"input", SIZE_input_device_id, do_input_entry},
++ {"eisa", SIZE_eisa_device_id, do_eisa_entry},
++ {"parisc", SIZE_parisc_device_id, do_parisc_entry},
++ {"sdio", SIZE_sdio_device_id, do_sdio_entry},
++ {"ssb", SIZE_ssb_device_id, do_ssb_entry},
++ {"bcma", SIZE_bcma_device_id, do_bcma_entry},
++ {"virtio", SIZE_virtio_device_id, do_virtio_entry},
++ {"vmbus", SIZE_hv_vmbus_device_id, do_vmbus_entry},
++ {"rpmsg", SIZE_rpmsg_device_id, do_rpmsg_entry},
++ {"i2c", SIZE_i2c_device_id, do_i2c_entry},
++ {"spi", SIZE_spi_device_id, do_spi_entry},
++ {"dmi", SIZE_dmi_system_id, do_dmi_entry},
++ {"platform", SIZE_platform_device_id, do_platform_entry},
++ {"mdio", SIZE_mdio_device_id, do_mdio_entry},
++ {"zorro", SIZE_zorro_device_id, do_zorro_entry},
++ {"isapnp", SIZE_isapnp_device_id, do_isapnp_entry},
++ {"ipack", SIZE_ipack_device_id, do_ipack_entry},
++ {"amba", SIZE_amba_id, do_amba_entry},
++ {"mipscdmm", SIZE_mips_cdmm_device_id, do_mips_cdmm_entry},
++ {"x86cpu", SIZE_x86_cpu_id, do_x86cpu_entry},
++ {"cpu", SIZE_cpu_feature, do_cpu_entry},
++ {"mei", SIZE_mei_cl_device_id, do_mei_entry},
++ {"rapidio", SIZE_rio_device_id, do_rio_entry},
++ {"ulpi", SIZE_ulpi_device_id, do_ulpi_entry},
++ {"hdaudio", SIZE_hda_device_id, do_hda_entry},
++ {"sdw", SIZE_sdw_device_id, do_sdw_entry},
++ {"fslmc", SIZE_fsl_mc_device_id, do_fsl_mc_entry},
++ {"tbsvc", SIZE_tb_service_id, do_tbsvc_entry},
++ {"typec", SIZE_typec_device_id, do_typec_entry},
++};
++
+ /* Create MODULE_ALIAS() statements.
+ * At this time, we cannot write the actual output C source yet,
+ * so we write into the mod->dev_table_buf buffer. */
+@@ -1450,13 +1402,14 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
+ else if (sym_is(name, namelen, "pnp_card"))
+ do_pnp_card_entries(symval, sym->st_size, mod);
+ else {
+- struct devtable **p;
+- INIT_SECTION(__devtable);
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(devtable); i++) {
++ const struct devtable *p = &devtable[i];
+
+- for (p = __start___devtable; p < __stop___devtable; p++) {
+- if (sym_is(name, namelen, (*p)->device_id)) {
+- do_table(symval, sym->st_size, (*p)->id_size,
+- (*p)->device_id, (*p)->function, mod);
++ if (sym_is(name, namelen, p->device_id)) {
++ do_table(symval, sym->st_size, p->id_size,
++ p->device_id, p->do_entry, mod);
+ break;
+ }
+ }
+diff --git a/security/device_cgroup.c b/security/device_cgroup.c
+index cd97929fac66..dc28914fa72e 100644
+--- a/security/device_cgroup.c
++++ b/security/device_cgroup.c
+@@ -560,7 +560,7 @@ static int propagate_exception(struct dev_cgroup *devcg_root,
+ devcg->behavior == DEVCG_DEFAULT_ALLOW) {
+ rc = dev_exception_add(devcg, ex);
+ if (rc)
+- break;
++ return rc;
+ } else {
+ /*
+ * in the other possible cases:
+diff --git a/sound/core/info.c b/sound/core/info.c
+index fe502bc5e6d2..679136fba730 100644
+--- a/sound/core/info.c
++++ b/sound/core/info.c
+@@ -722,8 +722,11 @@ snd_info_create_entry(const char *name, struct snd_info_entry *parent)
+ INIT_LIST_HEAD(&entry->children);
+ INIT_LIST_HEAD(&entry->list);
+ entry->parent = parent;
+- if (parent)
++ if (parent) {
++ mutex_lock(&parent->access);
+ list_add_tail(&entry->list, &parent->children);
++ mutex_unlock(&parent->access);
++ }
+ return entry;
+ }
+
+@@ -805,7 +808,12 @@ void snd_info_free_entry(struct snd_info_entry * entry)
+ list_for_each_entry_safe(p, n, &entry->children, list)
+ snd_info_free_entry(p);
+
+- list_del(&entry->list);
++ p = entry->parent;
++ if (p) {
++ mutex_lock(&p->access);
++ list_del(&entry->list);
++ mutex_unlock(&p->access);
++ }
+ kfree(entry->name);
+ if (entry->private_free)
+ entry->private_free(entry);
+diff --git a/sound/core/init.c b/sound/core/init.c
+index 4849c611c0fe..16b7cc7aa66b 100644
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -407,14 +407,7 @@ int snd_card_disconnect(struct snd_card *card)
+ card->shutdown = 1;
+ spin_unlock(&card->files_lock);
+
+- /* phase 1: disable fops (user space) operations for ALSA API */
+- mutex_lock(&snd_card_mutex);
+- snd_cards[card->number] = NULL;
+- clear_bit(card->number, snd_cards_lock);
+- mutex_unlock(&snd_card_mutex);
+-
+- /* phase 2: replace file->f_op with special dummy operations */
+-
++ /* replace file->f_op with special dummy operations */
+ spin_lock(&card->files_lock);
+ list_for_each_entry(mfile, &card->files_list, list) {
+ /* it's critical part, use endless loop */
+@@ -430,7 +423,7 @@ int snd_card_disconnect(struct snd_card *card)
+ }
+ spin_unlock(&card->files_lock);
+
+- /* phase 3: notify all connected devices about disconnection */
++ /* notify all connected devices about disconnection */
+ /* at this point, they cannot respond to any calls except release() */
+
+ #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
+@@ -446,6 +439,13 @@ int snd_card_disconnect(struct snd_card *card)
+ device_del(&card->card_dev);
+ card->registered = false;
+ }
++
++ /* disable fops (user space) operations for ALSA API */
++ mutex_lock(&snd_card_mutex);
++ snd_cards[card->number] = NULL;
++ clear_bit(card->number, snd_cards_lock);
++ mutex_unlock(&snd_card_mutex);
++
+ #ifdef CONFIG_PM
+ wake_up(&card->power_sleep);
+ #endif
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index bd60eb7168fa..0a745d677b1c 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7170,6 +7170,8 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60140},
+ {0x14, 0x90170150},
+ {0x21, 0x02211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x21, 0x02211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
+ {0x14, 0x90170110},
+ {0x21, 0x02211020}),
+@@ -7280,6 +7282,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x21, 0x0221101f}),
+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC256_STANDARD_PINS),
++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x14, 0x90170110},
++ {0x1b, 0x01011020},
++ {0x21, 0x0221101f}),
+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC,
+ {0x14, 0x90170110},
+ {0x1b, 0x90a70130},
+diff --git a/sound/soc/rockchip/rockchip_pcm.c b/sound/soc/rockchip/rockchip_pcm.c
+index 7029e0b85f9e..4ac78d7a4b2d 100644
+--- a/sound/soc/rockchip/rockchip_pcm.c
++++ b/sound/soc/rockchip/rockchip_pcm.c
+@@ -21,7 +21,8 @@ static const struct snd_pcm_hardware snd_rockchip_hardware = {
+ .info = SNDRV_PCM_INFO_MMAP |
+ SNDRV_PCM_INFO_MMAP_VALID |
+ SNDRV_PCM_INFO_PAUSE |
+- SNDRV_PCM_INFO_RESUME,
++ SNDRV_PCM_INFO_RESUME |
++ SNDRV_PCM_INFO_INTERLEAVED,
+ .period_bytes_min = 32,
+ .period_bytes_max = 8192,
+ .periods_min = 1,
+diff --git a/tools/include/linux/bitops.h b/tools/include/linux/bitops.h
+index acc704bd3998..0b0ef3abc966 100644
+--- a/tools/include/linux/bitops.h
++++ b/tools/include/linux/bitops.h
+@@ -3,8 +3,6 @@
+ #define _TOOLS_LINUX_BITOPS_H_
+
+ #include <asm/types.h>
+-#include <linux/compiler.h>
+-
+ #ifndef __WORDSIZE
+ #define __WORDSIZE (__SIZEOF_LONG__ * 8)
+ #endif
+@@ -12,10 +10,9 @@
+ #ifndef BITS_PER_LONG
+ # define BITS_PER_LONG __WORDSIZE
+ #endif
++#include <linux/bits.h>
++#include <linux/compiler.h>
+
+-#define BIT_MASK(nr) (1UL << ((nr) % BITS_PER_LONG))
+-#define BIT_WORD(nr) ((nr) / BITS_PER_LONG)
+-#define BITS_PER_BYTE 8
+ #define BITS_TO_LONGS(nr) DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
+ #define BITS_TO_U64(nr) DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(u64))
+ #define BITS_TO_U32(nr) DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(u32))
+diff --git a/tools/include/linux/bits.h b/tools/include/linux/bits.h
+new file mode 100644
+index 000000000000..2b7b532c1d51
+--- /dev/null
++++ b/tools/include/linux/bits.h
+@@ -0,0 +1,26 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __LINUX_BITS_H
++#define __LINUX_BITS_H
++#include <asm/bitsperlong.h>
++
++#define BIT(nr) (1UL << (nr))
++#define BIT_ULL(nr) (1ULL << (nr))
++#define BIT_MASK(nr) (1UL << ((nr) % BITS_PER_LONG))
++#define BIT_WORD(nr) ((nr) / BITS_PER_LONG)
++#define BIT_ULL_MASK(nr) (1ULL << ((nr) % BITS_PER_LONG_LONG))
++#define BIT_ULL_WORD(nr) ((nr) / BITS_PER_LONG_LONG)
++#define BITS_PER_BYTE 8
++
++/*
++ * Create a contiguous bitmask starting at bit position @l and ending at
++ * position @h. For example
++ * GENMASK_ULL(39, 21) gives us the 64bit vector 0x000000ffffe00000.
++ */
++#define GENMASK(h, l) \
++ (((~0UL) - (1UL << (l)) + 1) & (~0UL >> (BITS_PER_LONG - 1 - (h))))
++
++#define GENMASK_ULL(h, l) \
++ (((~0ULL) - (1ULL << (l)) + 1) & \
++ (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h))))
++
++#endif /* __LINUX_BITS_H */
+diff --git a/tools/perf/check-headers.sh b/tools/perf/check-headers.sh
+index 466540ee8ea7..c72cc73a6b09 100755
+--- a/tools/perf/check-headers.sh
++++ b/tools/perf/check-headers.sh
+@@ -14,6 +14,7 @@ include/uapi/linux/sched.h
+ include/uapi/linux/stat.h
+ include/uapi/linux/vhost.h
+ include/uapi/sound/asound.h
++include/linux/bits.h
+ include/linux/hash.h
+ include/uapi/linux/hw_breakpoint.h
+ arch/x86/include/asm/disabled-features.h
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-05-02 10:13 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-05-02 10:13 UTC (permalink / raw
To: gentoo-commits
commit: 52f0bee9c888fcd51ddadcf3fa91689ea0a2da70
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu May 2 10:13:36 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu May 2 10:13:36 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=52f0bee9
Linux patch 4.19.38
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1037_linux-4.19.38.patch | 4023 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4027 insertions(+)
diff --git a/0000_README b/0000_README
index 2acba8b..ad3e29c 100644
--- a/0000_README
+++ b/0000_README
@@ -191,6 +191,10 @@ Patch: 1036_linux-4.19.37.patch
From: http://www.kernel.org
Desc: Linux 4.19.37
+Patch: 1037_linux-4.19.38.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.38
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1037_linux-4.19.38.patch b/1037_linux-4.19.38.patch
new file mode 100644
index 0000000..71a6d7d
--- /dev/null
+++ b/1037_linux-4.19.38.patch
@@ -0,0 +1,4023 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index f5acf35c712f..8b6567f7cb9b 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2805,7 +2805,7 @@
+ check bypass). With this option data leaks are possible
+ in the system.
+
+- nospectre_v2 [X86] Disable all mitigations for the Spectre variant 2
++ nospectre_v2 [X86,PPC_FSL_BOOK3E] Disable all mitigations for the Spectre variant 2
+ (indirect branch prediction) vulnerability. System may
+ allow data leaks with this option, which is equivalent
+ to spectre_v2=off.
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index 960de8fe3f40..2c31208528d5 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -410,6 +410,7 @@ tcp_min_rtt_wlen - INTEGER
+ minimum RTT when it is moved to a longer path (e.g., due to traffic
+ engineering). A longer window makes the filter more resistant to RTT
+ inflations such as transient congestion. The unit is seconds.
++ Possible values: 0 - 86400 (1 day)
+ Default: 300
+
+ tcp_moderate_rcvbuf - BOOLEAN
+diff --git a/Makefile b/Makefile
+index 7b495cad8c2e..14d4aeb48907 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 37
++SUBLEVEL = 38
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index 517e0e18f0b8..e205bbbe2794 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -1395,7 +1395,21 @@ ENTRY(efi_stub_entry)
+
+ @ Preserve return value of efi_entry() in r4
+ mov r4, r0
+- bl cache_clean_flush
++
++ @ our cache maintenance code relies on CP15 barrier instructions
++ @ but since we arrived here with the MMU and caches configured
++ @ by UEFI, we must check that the CP15BEN bit is set in SCTLR.
++ @ Note that this bit is RAO/WI on v6 and earlier, so the ISB in
++ @ the enable path will be executed on v7+ only.
++ mrc p15, 0, r1, c1, c0, 0 @ read SCTLR
++ tst r1, #(1 << 5) @ CP15BEN bit set?
++ bne 0f
++ orr r1, r1, #(1 << 5) @ CP15 barrier instructions
++ mcr p15, 0, r1, c1, c0, 0 @ write SCTLR
++ ARM( .inst 0xf57ff06f @ v7+ isb )
++ THUMB( isb )
++
++0: bl cache_clean_flush
+ bl cache_off
+
+ @ Set parameters for booting zImage according to boot protocol
+diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
+index 73913f072e39..579608342ac6 100644
+--- a/arch/mips/kernel/scall64-o32.S
++++ b/arch/mips/kernel/scall64-o32.S
+@@ -125,7 +125,7 @@ trace_a_syscall:
+ subu t1, v0, __NR_O32_Linux
+ move a1, v0
+ bnez t1, 1f /* __NR_syscall at offset 0 */
+- lw a1, PT_R4(sp) /* Arg1 for __NR_syscall case */
++ ld a1, PT_R4(sp) /* Arg1 for __NR_syscall case */
+ .set pop
+
+ 1: jal syscall_trace_enter
+diff --git a/arch/powerpc/configs/skiroot_defconfig b/arch/powerpc/configs/skiroot_defconfig
+index 6bd5e7261335..ffeaed63675b 100644
+--- a/arch/powerpc/configs/skiroot_defconfig
++++ b/arch/powerpc/configs/skiroot_defconfig
+@@ -195,6 +195,7 @@ CONFIG_UDF_FS=m
+ CONFIG_MSDOS_FS=m
+ CONFIG_VFAT_FS=m
+ CONFIG_PROC_KCORE=y
++CONFIG_HUGETLBFS=y
+ CONFIG_TMPFS=y
+ CONFIG_TMPFS_POSIX_ACL=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
+index 769c2624e0a6..75cff3f336b3 100644
+--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
+@@ -98,7 +98,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ * can be used, r7 contains NSEC_PER_SEC.
+ */
+
+- lwz r5,WTOM_CLOCK_SEC(r9)
++ lwz r5,(WTOM_CLOCK_SEC+LOPART)(r9)
+ lwz r6,WTOM_CLOCK_NSEC(r9)
+
+ /* We now have our offset in r5,r6. We create a fake dependency
+diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
+index 6c6a7c72cae4..ad0216c41d2c 100644
+--- a/arch/powerpc/platforms/Kconfig.cputype
++++ b/arch/powerpc/platforms/Kconfig.cputype
+@@ -330,7 +330,7 @@ config ARCH_ENABLE_SPLIT_PMD_PTLOCK
+
+ config PPC_RADIX_MMU
+ bool "Radix MMU Support"
+- depends on PPC_BOOK3S_64
++ depends on PPC_BOOK3S_64 && HUGETLB_PAGE
+ select ARCH_HAS_GIGANTIC_PAGE if (MEMORY_ISOLATION && COMPACTION) || CMA
+ default y
+ help
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index b84f61bc5e7a..ffc823a8312f 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -224,6 +224,15 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
+ # Avoid indirect branches in kernel to deal with Spectre
+ ifdef CONFIG_RETPOLINE
+ KBUILD_CFLAGS += $(RETPOLINE_CFLAGS)
++ # Additionally, avoid generating expensive indirect jumps which
++ # are subject to retpolines for small number of switch cases.
++ # clang turns off jump table generation by default when under
++ # retpoline builds, however, gcc does not for x86. This has
++ # only been fixed starting from gcc stable version 8.4.0 and
++ # onwards, but not for older ones. See gcc bug #86952.
++ ifndef CONFIG_CC_IS_CLANG
++ KBUILD_CFLAGS += $(call cc-option,-fno-jump-tables)
++ endif
+ endif
+
+ archscripts: scripts_basic
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index 9f8084f18d58..6eb76106c469 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -76,15 +76,15 @@
+ * Scope: Package (physical package)
+ * MSR_PKG_C8_RESIDENCY: Package C8 Residency Counter.
+ * perf code: 0x04
+- * Available model: HSW ULT,CNL
++ * Available model: HSW ULT,KBL,CNL
+ * Scope: Package (physical package)
+ * MSR_PKG_C9_RESIDENCY: Package C9 Residency Counter.
+ * perf code: 0x05
+- * Available model: HSW ULT,CNL
++ * Available model: HSW ULT,KBL,CNL
+ * Scope: Package (physical package)
+ * MSR_PKG_C10_RESIDENCY: Package C10 Residency Counter.
+ * perf code: 0x06
+- * Available model: HSW ULT,GLM,CNL
++ * Available model: HSW ULT,KBL,GLM,CNL
+ * Scope: Package (physical package)
+ *
+ */
+@@ -572,8 +572,8 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
+ X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_DESKTOP, snb_cstates),
+ X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_X, snb_cstates),
+
+- X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_MOBILE, snb_cstates),
+- X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_DESKTOP, snb_cstates),
++ X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_MOBILE, hswult_cstates),
++ X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_DESKTOP, hswult_cstates),
+
+ X86_CSTATES_MODEL(INTEL_FAM6_CANNONLAKE_MOBILE, cnl_cstates),
+
+diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
+index cec5fae23eb3..baa549f8e918 100644
+--- a/arch/x86/include/asm/efi.h
++++ b/arch/x86/include/asm/efi.h
+@@ -82,8 +82,7 @@ struct efi_scratch {
+ #define arch_efi_call_virt_setup() \
+ ({ \
+ efi_sync_low_kernel_mappings(); \
+- preempt_disable(); \
+- __kernel_fpu_begin(); \
++ kernel_fpu_begin(); \
+ firmware_restrict_branch_speculation_start(); \
+ \
+ if (!efi_enabled(EFI_OLD_MEMMAP)) \
+@@ -99,8 +98,7 @@ struct efi_scratch {
+ efi_switch_mm(efi_scratch.prev_mm); \
+ \
+ firmware_restrict_branch_speculation_end(); \
+- __kernel_fpu_end(); \
+- preempt_enable(); \
++ kernel_fpu_end(); \
+ })
+
+ extern void __iomem *__init efi_ioremap(unsigned long addr, unsigned long size,
+diff --git a/arch/x86/include/asm/fpu/api.h b/arch/x86/include/asm/fpu/api.h
+index a9caac9d4a72..b56d504af654 100644
+--- a/arch/x86/include/asm/fpu/api.h
++++ b/arch/x86/include/asm/fpu/api.h
+@@ -12,17 +12,12 @@
+ #define _ASM_X86_FPU_API_H
+
+ /*
+- * Careful: __kernel_fpu_begin/end() must be called with preempt disabled
+- * and they don't touch the preempt state on their own.
+- * If you enable preemption after __kernel_fpu_begin(), preempt notifier
+- * should call the __kernel_fpu_end() to prevent the kernel/user FPU
+- * state from getting corrupted. KVM for example uses this model.
+- *
+- * All other cases use kernel_fpu_begin/end() which disable preemption
+- * during kernel FPU usage.
++ * Use kernel_fpu_begin/end() if you intend to use FPU in kernel context. It
++ * disables preemption so be careful if you intend to use it for long periods
++ * of time.
++ * If you intend to use the FPU in softirq you need to check first with
++ * irq_fpu_usable() if it is possible.
+ */
+-extern void __kernel_fpu_begin(void);
+-extern void __kernel_fpu_end(void);
+ extern void kernel_fpu_begin(void);
+ extern void kernel_fpu_end(void);
+ extern bool irq_fpu_usable(void);
+diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
+index 2ea85b32421a..2e5003fef51a 100644
+--- a/arch/x86/kernel/fpu/core.c
++++ b/arch/x86/kernel/fpu/core.c
+@@ -93,7 +93,7 @@ bool irq_fpu_usable(void)
+ }
+ EXPORT_SYMBOL(irq_fpu_usable);
+
+-void __kernel_fpu_begin(void)
++static void __kernel_fpu_begin(void)
+ {
+ struct fpu *fpu = ¤t->thread.fpu;
+
+@@ -111,9 +111,8 @@ void __kernel_fpu_begin(void)
+ __cpu_invalidate_fpregs_state();
+ }
+ }
+-EXPORT_SYMBOL(__kernel_fpu_begin);
+
+-void __kernel_fpu_end(void)
++static void __kernel_fpu_end(void)
+ {
+ struct fpu *fpu = ¤t->thread.fpu;
+
+@@ -122,7 +121,6 @@ void __kernel_fpu_end(void)
+
+ kernel_fpu_enable();
+ }
+-EXPORT_SYMBOL(__kernel_fpu_end);
+
+ void kernel_fpu_begin(void)
+ {
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 030c98f35cca..a654ccfd1a22 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -958,14 +958,13 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
+
+ index = page - alloc->pages;
+ page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
++
++ mm = alloc->vma_vm_mm;
++ if (!mmget_not_zero(mm))
++ goto err_mmget;
++ if (!down_write_trylock(&mm->mmap_sem))
++ goto err_down_write_mmap_sem_failed;
+ vma = binder_alloc_get_vma(alloc);
+- if (vma) {
+- if (!mmget_not_zero(alloc->vma_vm_mm))
+- goto err_mmget;
+- mm = alloc->vma_vm_mm;
+- if (!down_write_trylock(&mm->mmap_sem))
+- goto err_down_write_mmap_sem_failed;
+- }
+
+ list_lru_isolate(lru, item);
+ spin_unlock(lock);
+@@ -978,10 +977,9 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
+ PAGE_SIZE);
+
+ trace_binder_unmap_user_end(alloc, index);
+-
+- up_write(&mm->mmap_sem);
+- mmput(mm);
+ }
++ up_write(&mm->mmap_sem);
++ mmput(mm);
+
+ trace_binder_unmap_kernel_start(alloc, index);
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index a63da9e07341..f1e63eb7cbca 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1112,8 +1112,9 @@ out_unlock:
+ err = __blkdev_reread_part(bdev);
+ else
+ err = blkdev_reread_part(bdev);
+- pr_warn("%s: partition scan of loop%d failed (rc=%d)\n",
+- __func__, lo_number, err);
++ if (err)
++ pr_warn("%s: partition scan of loop%d failed (rc=%d)\n",
++ __func__, lo_number, err);
+ /* Device is gone, no point in returning error */
+ err = 0;
+ }
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index a65505db09e5..70cbd0ee1b07 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -515,18 +515,18 @@ struct zram_work {
+ struct zram *zram;
+ unsigned long entry;
+ struct bio *bio;
++ struct bio_vec bvec;
+ };
+
+ #if PAGE_SIZE != 4096
+ static void zram_sync_read(struct work_struct *work)
+ {
+- struct bio_vec bvec;
+ struct zram_work *zw = container_of(work, struct zram_work, work);
+ struct zram *zram = zw->zram;
+ unsigned long entry = zw->entry;
+ struct bio *bio = zw->bio;
+
+- read_from_bdev_async(zram, &bvec, entry, bio);
++ read_from_bdev_async(zram, &zw->bvec, entry, bio);
+ }
+
+ /*
+@@ -539,6 +539,7 @@ static int read_from_bdev_sync(struct zram *zram, struct bio_vec *bvec,
+ {
+ struct zram_work work;
+
++ work.bvec = *bvec;
+ work.zram = zram;
+ work.entry = entry;
+ work.bio = bio;
+diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
+index 48ee35e2bce6..0b05a1e08d21 100644
+--- a/drivers/dma/sh/rcar-dmac.c
++++ b/drivers/dma/sh/rcar-dmac.c
+@@ -1281,6 +1281,9 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
+ enum dma_status status;
+ unsigned int residue = 0;
+ unsigned int dptr = 0;
++ unsigned int chcrb;
++ unsigned int tcrb;
++ unsigned int i;
+
+ if (!desc)
+ return 0;
+@@ -1328,6 +1331,24 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
+ return 0;
+ }
+
++ /*
++ * We need to read two registers.
++ * Make sure the control register does not skip to next chunk
++ * while reading the counter.
++ * Trying it 3 times should be enough: Initial read, retry, retry
++ * for the paranoid.
++ */
++ for (i = 0; i < 3; i++) {
++ chcrb = rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
++ RCAR_DMACHCRB_DPTR_MASK;
++ tcrb = rcar_dmac_chan_read(chan, RCAR_DMATCRB);
++ /* Still the same? */
++ if (chcrb == (rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
++ RCAR_DMACHCRB_DPTR_MASK))
++ break;
++ }
++ WARN_ONCE(i >= 3, "residue might be not continuous!");
++
+ /*
+ * In descriptor mode the descriptor running pointer is not maintained
+ * by the interrupt handler, find the running descriptor from the
+@@ -1335,8 +1356,7 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
+ * mode just use the running descriptor pointer.
+ */
+ if (desc->hwdescs.use) {
+- dptr = (rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
+- RCAR_DMACHCRB_DPTR_MASK) >> RCAR_DMACHCRB_DPTR_SHIFT;
++ dptr = chcrb >> RCAR_DMACHCRB_DPTR_SHIFT;
+ if (dptr == 0)
+ dptr = desc->nchunks;
+ dptr--;
+@@ -1354,7 +1374,7 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
+ }
+
+ /* Add the residue for the current chunk. */
+- residue += rcar_dmac_chan_read(chan, RCAR_DMATCRB) << desc->xfer_shift;
++ residue += tcrb << desc->xfer_shift;
+
+ return residue;
+ }
+@@ -1367,6 +1387,7 @@ static enum dma_status rcar_dmac_tx_status(struct dma_chan *chan,
+ enum dma_status status;
+ unsigned long flags;
+ unsigned int residue;
++ bool cyclic;
+
+ status = dma_cookie_status(chan, cookie, txstate);
+ if (status == DMA_COMPLETE || !txstate)
+@@ -1374,10 +1395,11 @@ static enum dma_status rcar_dmac_tx_status(struct dma_chan *chan,
+
+ spin_lock_irqsave(&rchan->lock, flags);
+ residue = rcar_dmac_chan_get_residue(rchan, cookie);
++ cyclic = rchan->desc.running ? rchan->desc.running->cyclic : false;
+ spin_unlock_irqrestore(&rchan->lock, flags);
+
+ /* if there's no residue, the cookie is complete */
+- if (!residue)
++ if (!residue && !cyclic)
+ return DMA_COMPLETE;
+
+ dma_set_residue(txstate, residue);
+diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
+index e41223c05f6e..6cf2e2ce4093 100644
+--- a/drivers/gpio/gpio-eic-sprd.c
++++ b/drivers/gpio/gpio-eic-sprd.c
+@@ -414,6 +414,7 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_EDGE_BOTH:
++ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTMODE, 0);
+ sprd_eic_update(chip, offset, SPRD_EIC_SYNC_INTBOTH, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
+index 6f91634880aa..2d6506c08bf7 100644
+--- a/drivers/gpu/drm/i915/intel_fbdev.c
++++ b/drivers/gpu/drm/i915/intel_fbdev.c
+@@ -334,8 +334,8 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
+ bool *enabled, int width, int height)
+ {
+ struct drm_i915_private *dev_priv = to_i915(fb_helper->dev);
++ unsigned long conn_configured, conn_seq, mask;
+ unsigned int count = min(fb_helper->connector_count, BITS_PER_LONG);
+- unsigned long conn_configured, conn_seq;
+ int i, j;
+ bool *save_enabled;
+ bool fallback = true, ret = true;
+@@ -353,9 +353,10 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
+ drm_modeset_backoff(&ctx);
+
+ memcpy(save_enabled, enabled, count);
+- conn_seq = GENMASK(count - 1, 0);
++ mask = GENMASK(count - 1, 0);
+ conn_configured = 0;
+ retry:
++ conn_seq = conn_configured;
+ for (i = 0; i < count; i++) {
+ struct drm_fb_helper_connector *fb_conn;
+ struct drm_connector *connector;
+@@ -368,8 +369,7 @@ retry:
+ if (conn_configured & BIT(i))
+ continue;
+
+- /* First pass, only consider tiled connectors */
+- if (conn_seq == GENMASK(count - 1, 0) && !connector->has_tile)
++ if (conn_seq == 0 && !connector->has_tile)
+ continue;
+
+ if (connector->status == connector_status_connected)
+@@ -473,10 +473,8 @@ retry:
+ conn_configured |= BIT(i);
+ }
+
+- if (conn_configured != conn_seq) { /* repeat until no more are found */
+- conn_seq = conn_configured;
++ if ((conn_configured & mask) != mask && conn_configured != conn_seq)
+ goto retry;
+- }
+
+ /*
+ * If the BIOS didn't enable everything it could, fall back to have the
+diff --git a/drivers/gpu/drm/rockchip/cdn-dp-reg.c b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
+index 5a485489a1e2..6c8b14fb1d2f 100644
+--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c
++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
+@@ -113,7 +113,7 @@ static int cdp_dp_mailbox_write(struct cdn_dp_device *dp, u8 val)
+
+ static int cdn_dp_mailbox_validate_receive(struct cdn_dp_device *dp,
+ u8 module_id, u8 opcode,
+- u8 req_size)
++ u16 req_size)
+ {
+ u32 mbox_size, i;
+ u8 header[4];
+diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
+index 0e6a121858d1..5615ceb15708 100644
+--- a/drivers/gpu/drm/vc4/vc4_crtc.c
++++ b/drivers/gpu/drm/vc4/vc4_crtc.c
+@@ -998,7 +998,7 @@ static void
+ vc4_crtc_reset(struct drm_crtc *crtc)
+ {
+ if (crtc->state)
+- __drm_atomic_helper_crtc_destroy_state(crtc->state);
++ vc4_crtc_destroy_state(crtc, crtc->state);
+
+ crtc->state = kzalloc(sizeof(struct vc4_crtc_state), GFP_KERNEL);
+ if (crtc->state)
+diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c
+index cc287cf6eb29..edc52d75e6bd 100644
+--- a/drivers/hwtracing/intel_th/gth.c
++++ b/drivers/hwtracing/intel_th/gth.c
+@@ -616,7 +616,7 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev,
+ othdev->output.port = -1;
+ othdev->output.active = false;
+ gth->output[port].output = NULL;
+- for (master = 0; master < TH_CONFIGURABLE_MASTERS; master++)
++ for (master = 0; master <= TH_CONFIGURABLE_MASTERS; master++)
+ if (gth->master[master] == port)
+ gth->master[master] = -1;
+ spin_unlock(>h->gth_lock);
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 50be240df331..8cc4da62f050 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -2014,6 +2014,7 @@ static int mlx5_ib_mmap_clock_info_page(struct mlx5_ib_dev *dev,
+
+ if (vma->vm_flags & VM_WRITE)
+ return -EPERM;
++ vma->vm_flags &= ~VM_MAYWRITE;
+
+ if (!dev->mdev->clock_info_page)
+ return -EOPNOTSUPP;
+@@ -2197,6 +2198,7 @@ static int mlx5_ib_mmap(struct ib_ucontext *ibcontext, struct vm_area_struct *vm
+
+ if (vma->vm_flags & VM_WRITE)
+ return -EPERM;
++ vma->vm_flags &= ~VM_MAYWRITE;
+
+ /* Don't expose to user-space information it shouldn't have */
+ if (PAGE_SIZE > 4096)
+diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
+index 49c9541050d4..5819c9d6ffdc 100644
+--- a/drivers/infiniband/sw/rdmavt/mr.c
++++ b/drivers/infiniband/sw/rdmavt/mr.c
+@@ -611,11 +611,6 @@ static int rvt_set_page(struct ib_mr *ibmr, u64 addr)
+ if (unlikely(mapped_segs == mr->mr.max_segs))
+ return -ENOMEM;
+
+- if (mr->mr.length == 0) {
+- mr->mr.user_base = addr;
+- mr->mr.iova = addr;
+- }
+-
+ m = mapped_segs / RVT_SEGSZ;
+ n = mapped_segs % RVT_SEGSZ;
+ mr->mr.map[m]->segs[n].vaddr = (void *)addr;
+@@ -633,17 +628,24 @@ static int rvt_set_page(struct ib_mr *ibmr, u64 addr)
+ * @sg_nents: number of entries in sg
+ * @sg_offset: offset in bytes into sg
+ *
++ * Overwrite rvt_mr length with mr length calculated by ib_sg_to_pages.
++ *
+ * Return: number of sg elements mapped to the memory region
+ */
+ int rvt_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
+ int sg_nents, unsigned int *sg_offset)
+ {
+ struct rvt_mr *mr = to_imr(ibmr);
++ int ret;
+
+ mr->mr.length = 0;
+ mr->mr.page_shift = PAGE_SHIFT;
+- return ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset,
+- rvt_set_page);
++ ret = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rvt_set_page);
++ mr->mr.user_base = ibmr->iova;
++ mr->mr.iova = ibmr->iova;
++ mr->mr.offset = ibmr->iova - (u64)mr->mr.map[0]->segs[0].vaddr;
++ mr->mr.length = (size_t)ibmr->length;
++ return ret;
+ }
+
+ /**
+@@ -674,6 +676,7 @@ int rvt_fast_reg_mr(struct rvt_qp *qp, struct ib_mr *ibmr, u32 key,
+ ibmr->rkey = key;
+ mr->mr.lkey = key;
+ mr->mr.access_flags = access;
++ mr->mr.iova = ibmr->iova;
+ atomic_set(&mr->mr.lkey_invalid, 0);
+
+ return 0;
+diff --git a/drivers/input/rmi4/rmi_f11.c b/drivers/input/rmi4/rmi_f11.c
+index df64d6aed4f7..93901ebd122a 100644
+--- a/drivers/input/rmi4/rmi_f11.c
++++ b/drivers/input/rmi4/rmi_f11.c
+@@ -1230,7 +1230,7 @@ static int rmi_f11_initialize(struct rmi_function *fn)
+ }
+
+ rc = f11_write_control_regs(fn, &f11->sens_query,
+- &f11->dev_controls, fn->fd.query_base_addr);
++ &f11->dev_controls, fn->fd.control_base_addr);
+ if (rc)
+ dev_warn(&fn->dev, "Failed to write control registers\n");
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index dabe89968a78..2caa5c0c2bc4 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -4821,6 +4821,7 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev)
+ if (err)
+ goto out;
+
++ mv88e6xxx_ports_cmode_init(chip);
+ mv88e6xxx_phy_init(chip);
+
+ if (chip->info->ops->get_eeprom) {
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index b043370c2685..cc84133c184d 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1169,6 +1169,12 @@ int hns_nic_init_phy(struct net_device *ndev, struct hnae_handle *h)
+ if (!h->phy_dev)
+ return 0;
+
++ phy_dev->supported &= h->if_support;
++ phy_dev->advertising = phy_dev->supported;
++
++ if (h->phy_if == PHY_INTERFACE_MODE_XGMII)
++ phy_dev->autoneg = false;
++
+ if (h->phy_if != PHY_INTERFACE_MODE_XGMII) {
+ phy_dev->dev_flags = 0;
+
+@@ -1180,15 +1186,6 @@ int hns_nic_init_phy(struct net_device *ndev, struct hnae_handle *h)
+ if (unlikely(ret))
+ return -ENODEV;
+
+- phy_dev->supported &= h->if_support;
+- phy_dev->advertising = phy_dev->supported;
+-
+- if (h->phy_if == PHY_INTERFACE_MODE_XGMII)
+- phy_dev->autoneg = false;
+-
+- if (h->phy_if == PHY_INTERFACE_MODE_SGMII)
+- phy_stop(phy_dev);
+-
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index a475f36ddf8c..426789e2c23d 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1859,7 +1859,7 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+
+ if (adapter->reset_reason != VNIC_RESET_FAILOVER &&
+ adapter->reset_reason != VNIC_RESET_CHANGE_PARAM)
+- netdev_notify_peers(netdev);
++ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev);
+
+ netif_carrier_on(netdev);
+
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_main.c b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+index 3f536541f45f..78a43d688cb1 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_main.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+@@ -41,6 +41,8 @@ static int __init fm10k_init_module(void)
+ /* create driver workqueue */
+ fm10k_workqueue = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0,
+ fm10k_driver_name);
++ if (!fm10k_workqueue)
++ return -ENOMEM;
+
+ fm10k_dbg_init();
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 9988c89ed9fd..9b10abb604cb 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -4272,7 +4272,7 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+ case PHY_INTERFACE_MODE_RGMII_ID:
+ case PHY_INTERFACE_MODE_RGMII_RXID:
+ case PHY_INTERFACE_MODE_RGMII_TXID:
+- if (port->gop_id == 0)
++ if (port->priv->hw_version == MVPP22 && port->gop_id == 0)
+ goto empty_set;
+ break;
+ default:
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+index 4a33c9a7cac7..599114ab7821 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+@@ -33,6 +33,26 @@
+ #include <linux/bpf_trace.h>
+ #include "en/xdp.h"
+
++int mlx5e_xdp_max_mtu(struct mlx5e_params *params)
++{
++ int hr = NET_IP_ALIGN + XDP_PACKET_HEADROOM;
++
++ /* Let S := SKB_DATA_ALIGN(sizeof(struct skb_shared_info)).
++ * The condition checked in mlx5e_rx_is_linear_skb is:
++ * SKB_DATA_ALIGN(sw_mtu + hard_mtu + hr) + S <= PAGE_SIZE (1)
++ * (Note that hw_mtu == sw_mtu + hard_mtu.)
++ * What is returned from this function is:
++ * max_mtu = PAGE_SIZE - S - hr - hard_mtu (2)
++ * After assigning sw_mtu := max_mtu, the left side of (1) turns to
++ * SKB_DATA_ALIGN(PAGE_SIZE - S) + S, which is equal to PAGE_SIZE,
++ * because both PAGE_SIZE and S are already aligned. Any number greater
++ * than max_mtu would make the left side of (1) greater than PAGE_SIZE,
++ * so max_mtu is the maximum MTU allowed.
++ */
++
++ return MLX5E_HW2SW_MTU(params, SKB_MAX_HEAD(hr));
++}
++
+ static inline bool
+ mlx5e_xmit_xdp_buff(struct mlx5e_xdpsq *sq, struct mlx5e_dma_info *di,
+ struct xdp_buff *xdp)
+@@ -207,9 +227,9 @@ bool mlx5e_poll_xdpsq_cq(struct mlx5e_cq *cq)
+ sqcc++;
+
+ if (is_redirect) {
+- xdp_return_frame(xdpi->xdpf);
+ dma_unmap_single(sq->pdev, xdpi->dma_addr,
+ xdpi->xdpf->len, DMA_TO_DEVICE);
++ xdp_return_frame(xdpi->xdpf);
+ } else {
+ /* Recycle RX page */
+ mlx5e_page_release(rq, &xdpi->di, true);
+@@ -243,9 +263,9 @@ void mlx5e_free_xdpsq_descs(struct mlx5e_xdpsq *sq)
+ sq->cc++;
+
+ if (is_redirect) {
+- xdp_return_frame(xdpi->xdpf);
+ dma_unmap_single(sq->pdev, xdpi->dma_addr,
+ xdpi->xdpf->len, DMA_TO_DEVICE);
++ xdp_return_frame(xdpi->xdpf);
+ } else {
+ /* Recycle RX page */
+ mlx5e_page_release(rq, &xdpi->di, false);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+index 4d096623178b..827ceef5fa93 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+@@ -34,12 +34,11 @@
+
+ #include "en.h"
+
+-#define MLX5E_XDP_MAX_MTU ((int)(PAGE_SIZE - \
+- MLX5_SKB_FRAG_SZ(XDP_PACKET_HEADROOM)))
+ #define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN)
+ #define MLX5E_XDP_TX_DS_COUNT \
+ ((sizeof(struct mlx5e_tx_wqe) / MLX5_SEND_WQE_DS) + 1 /* SG DS */)
+
++int mlx5e_xdp_max_mtu(struct mlx5e_params *params);
+ bool mlx5e_xdp_handle(struct mlx5e_rq *rq, struct mlx5e_dma_info *di,
+ void *va, u16 *rx_headroom, u32 *len);
+ bool mlx5e_poll_xdpsq_cq(struct mlx5e_cq *cq);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 5e5423076b03..9ca4f88d7cf6 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1317,7 +1317,7 @@ static int mlx5e_get_module_info(struct net_device *netdev,
+ break;
+ case MLX5_MODULE_ID_SFP:
+ modinfo->type = ETH_MODULE_SFF_8472;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
++ modinfo->eeprom_len = MLX5_EEPROM_PAGE_LENGTH;
+ break;
+ default:
+ netdev_err(priv->netdev, "%s: cable type not recognized:0x%x\n",
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 637d59c01fe5..b190c447aeb0 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3761,7 +3761,7 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
+ if (params->xdp_prog &&
+ !mlx5e_rx_is_linear_skb(priv->mdev, &new_channels.params)) {
+ netdev_err(netdev, "MTU(%d) > %d is not allowed while XDP enabled\n",
+- new_mtu, MLX5E_XDP_MAX_MTU);
++ new_mtu, mlx5e_xdp_max_mtu(params));
+ err = -EINVAL;
+ goto out;
+ }
+@@ -4227,7 +4227,8 @@ static int mlx5e_xdp_allowed(struct mlx5e_priv *priv, struct bpf_prog *prog)
+
+ if (!mlx5e_rx_is_linear_skb(priv->mdev, &new_channels.params)) {
+ netdev_warn(netdev, "XDP is not allowed with MTU(%d) > %d\n",
+- new_channels.params.sw_mtu, MLX5E_XDP_MAX_MTU);
++ new_channels.params.sw_mtu,
++ mlx5e_xdp_max_mtu(&new_channels.params));
+ return -EINVAL;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+index 31a9cbd85689..09b6b1bfbfa8 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+@@ -404,10 +404,6 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev,
+ size -= offset + size - MLX5_EEPROM_PAGE_LENGTH;
+
+ i2c_addr = MLX5_I2C_ADDR_LOW;
+- if (offset >= MLX5_EEPROM_PAGE_LENGTH) {
+- i2c_addr = MLX5_I2C_ADDR_HIGH;
+- offset -= MLX5_EEPROM_PAGE_LENGTH;
+- }
+
+ MLX5_SET(mcia_reg, in, l, 0);
+ MLX5_SET(mcia_reg, in, module, module_num);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
+index 72cdaa01d56d..100618531021 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
+@@ -27,7 +27,7 @@
+
+ #define MLXSW_PCI_SW_RESET 0xF0010
+ #define MLXSW_PCI_SW_RESET_RST_BIT BIT(0)
+-#define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS 13000
++#define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS 20000
+ #define MLXSW_PCI_SW_RESET_WAIT_MSECS 100
+ #define MLXSW_PCI_FW_READY 0xA1844
+ #define MLXSW_PCI_FW_READY_MASK 0xFFFF
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index f9bef030ee05..c5b82e283d13 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -2504,11 +2504,11 @@ mlxsw_sp_port_set_link_ksettings(struct net_device *dev,
+ if (err)
+ return err;
+
++ mlxsw_sp_port->link.autoneg = autoneg;
++
+ if (!netif_running(dev))
+ return 0;
+
+- mlxsw_sp_port->link.autoneg = autoneg;
+-
+ mlxsw_sp_port_admin_status_set(mlxsw_sp_port, false);
+ mlxsw_sp_port_admin_status_set(mlxsw_sp_port, true);
+
+@@ -2783,7 +2783,7 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
+ err = mlxsw_sp_port_ets_set(mlxsw_sp_port,
+ MLXSW_REG_QEEC_HIERARCY_TC,
+ i + 8, i,
+- false, 0);
++ true, 100);
+ if (err)
+ return err;
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 886176be818e..62460a5b4ad9 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -2595,8 +2595,6 @@ static int stmmac_open(struct net_device *dev)
+ u32 chan;
+ int ret;
+
+- stmmac_check_ether_addr(priv);
+-
+ if (priv->hw->pcs != STMMAC_PCS_RGMII &&
+ priv->hw->pcs != STMMAC_PCS_TBI &&
+ priv->hw->pcs != STMMAC_PCS_RTBI) {
+@@ -4296,6 +4294,8 @@ int stmmac_dvr_probe(struct device *device,
+ if (ret)
+ goto error_hw_init;
+
++ stmmac_check_ether_addr(priv);
++
+ /* Configure real RX and TX queues */
+ netif_set_real_num_rx_queues(ndev, priv->plat->rx_queues_to_use);
+ netif_set_real_num_tx_queues(ndev, priv->plat->tx_queues_to_use);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+index d819e8eaba12..cc1e887e47b5 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+@@ -159,6 +159,12 @@ static const struct dmi_system_id quark_pci_dmi[] = {
+ },
+ .driver_data = (void *)&galileo_stmmac_dmi_data,
+ },
++ /*
++ * There are 2 types of SIMATIC IOT2000: IOT20202 and IOT2040.
++ * The asset tag "6ES7647-0AA00-0YA2" is only for IOT2020 which
++ * has only one pci network device while other asset tags are
++ * for IOT2040 which has two.
++ */
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "SIMATIC IOT2000"),
+@@ -170,8 +176,6 @@ static const struct dmi_system_id quark_pci_dmi[] = {
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "SIMATIC IOT2000"),
+- DMI_EXACT_MATCH(DMI_BOARD_ASSET_TAG,
+- "6ES7647-0AA00-1YA2"),
+ },
+ .driver_data = (void *)&iot2040_stmmac_dmi_data,
+ },
+diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
+index f4e93f5fc204..ea90db3c7705 100644
+--- a/drivers/net/slip/slhc.c
++++ b/drivers/net/slip/slhc.c
+@@ -153,7 +153,7 @@ out_fail:
+ void
+ slhc_free(struct slcompress *comp)
+ {
+- if ( comp == NULLSLCOMPR )
++ if ( IS_ERR_OR_NULL(comp) )
+ return;
+
+ if ( comp->tstate != NULLSLSTATE )
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index e23eaf3f6d03..6c6230b44bcd 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -1160,6 +1160,13 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
+ return -EINVAL;
+ }
+
++ if (netdev_has_upper_dev(dev, port_dev)) {
++ NL_SET_ERR_MSG(extack, "Device is already an upper device of the team interface");
++ netdev_err(dev, "Device %s is already an upper device of the team interface\n",
++ portname);
++ return -EBUSY;
++ }
++
+ if (port_dev->features & NETIF_F_VLAN_CHALLENGED &&
+ vlan_uses_dev(dev)) {
+ NL_SET_ERR_MSG(extack, "Device is VLAN challenged and team device has VLAN set up");
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index a1f225f077cd..ef47c226e1d2 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -1899,14 +1899,11 @@ int usb_runtime_idle(struct device *dev)
+ return -EBUSY;
+ }
+
+-int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable)
++static int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable)
+ {
+ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+ int ret = -EPERM;
+
+- if (enable && !udev->usb2_hw_lpm_allowed)
+- return 0;
+-
+ if (hcd->driver->set_usb2_hw_lpm) {
+ ret = hcd->driver->set_usb2_hw_lpm(hcd, udev, enable);
+ if (!ret)
+@@ -1916,6 +1913,24 @@ int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable)
+ return ret;
+ }
+
++int usb_enable_usb2_hardware_lpm(struct usb_device *udev)
++{
++ if (!udev->usb2_hw_lpm_capable ||
++ !udev->usb2_hw_lpm_allowed ||
++ udev->usb2_hw_lpm_enabled)
++ return 0;
++
++ return usb_set_usb2_hardware_lpm(udev, 1);
++}
++
++int usb_disable_usb2_hardware_lpm(struct usb_device *udev)
++{
++ if (!udev->usb2_hw_lpm_enabled)
++ return 0;
++
++ return usb_set_usb2_hardware_lpm(udev, 0);
++}
++
+ #endif /* CONFIG_PM */
+
+ struct bus_type usb_bus_type = {
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 3adff4da2ee1..bbcfa63d0233 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3217,8 +3217,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ }
+
+ /* disable USB2 hardware LPM */
+- if (udev->usb2_hw_lpm_enabled == 1)
+- usb_set_usb2_hardware_lpm(udev, 0);
++ usb_disable_usb2_hardware_lpm(udev);
+
+ if (usb_disable_ltm(udev)) {
+ dev_err(&udev->dev, "Failed to disable LTM before suspend\n");
+@@ -3256,8 +3255,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ usb_enable_ltm(udev);
+ err_ltm:
+ /* Try to enable USB2 hardware LPM again */
+- if (udev->usb2_hw_lpm_capable == 1)
+- usb_set_usb2_hardware_lpm(udev, 1);
++ usb_enable_usb2_hardware_lpm(udev);
+
+ if (udev->do_remote_wakeup)
+ (void) usb_disable_remote_wakeup(udev);
+@@ -3540,8 +3538,7 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
+ hub_port_logical_disconnect(hub, port1);
+ } else {
+ /* Try to enable USB2 hardware LPM */
+- if (udev->usb2_hw_lpm_capable == 1)
+- usb_set_usb2_hardware_lpm(udev, 1);
++ usb_enable_usb2_hardware_lpm(udev);
+
+ /* Try to enable USB3 LTM */
+ usb_enable_ltm(udev);
+@@ -4432,7 +4429,7 @@ static void hub_set_initial_usb2_lpm_policy(struct usb_device *udev)
+ if ((udev->bos->ext_cap->bmAttributes & cpu_to_le32(USB_BESL_SUPPORT)) ||
+ connect_type == USB_PORT_CONNECT_TYPE_HARD_WIRED) {
+ udev->usb2_hw_lpm_allowed = 1;
+- usb_set_usb2_hardware_lpm(udev, 1);
++ usb_enable_usb2_hardware_lpm(udev);
+ }
+ }
+
+@@ -5608,8 +5605,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+ /* Disable USB2 hardware LPM.
+ * It will be re-enabled by the enumeration process.
+ */
+- if (udev->usb2_hw_lpm_enabled == 1)
+- usb_set_usb2_hardware_lpm(udev, 0);
++ usb_disable_usb2_hardware_lpm(udev);
+
+ /* Disable LPM while we reset the device and reinstall the alt settings.
+ * Device-initiated LPM, and system exit latency settings are cleared
+@@ -5712,7 +5708,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+
+ done:
+ /* Now that the alt settings are re-installed, enable LTM and LPM. */
+- usb_set_usb2_hardware_lpm(udev, 1);
++ usb_enable_usb2_hardware_lpm(udev);
+ usb_unlocked_enable_lpm(udev);
+ usb_enable_ltm(udev);
+ usb_release_bos_descriptor(udev);
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index bfa5eda0cc26..4f33eb632a88 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1243,8 +1243,7 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ dev->actconfig->interface[i] = NULL;
+ }
+
+- if (dev->usb2_hw_lpm_enabled == 1)
+- usb_set_usb2_hardware_lpm(dev, 0);
++ usb_disable_usb2_hardware_lpm(dev);
+ usb_unlocked_disable_lpm(dev);
+ usb_disable_ltm(dev);
+
+diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
+index ea18284dfa9a..7e88fdfe3cf5 100644
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -528,7 +528,10 @@ static ssize_t usb2_hardware_lpm_store(struct device *dev,
+
+ if (!ret) {
+ udev->usb2_hw_lpm_allowed = value;
+- ret = usb_set_usb2_hardware_lpm(udev, value);
++ if (value)
++ ret = usb_enable_usb2_hardware_lpm(udev);
++ else
++ ret = usb_disable_usb2_hardware_lpm(udev);
+ }
+
+ usb_unlock_device(udev);
+diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
+index 546a2219454b..d95a5358f73d 100644
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -92,7 +92,8 @@ extern int usb_remote_wakeup(struct usb_device *dev);
+ extern int usb_runtime_suspend(struct device *dev);
+ extern int usb_runtime_resume(struct device *dev);
+ extern int usb_runtime_idle(struct device *dev);
+-extern int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable);
++extern int usb_enable_usb2_hardware_lpm(struct usb_device *udev);
++extern int usb_disable_usb2_hardware_lpm(struct usb_device *udev);
+
+ #else
+
+@@ -112,7 +113,12 @@ static inline int usb_autoresume_device(struct usb_device *udev)
+ return 0;
+ }
+
+-static inline int usb_set_usb2_hardware_lpm(struct usb_device *udev, int enable)
++static inline int usb_enable_usb2_hardware_lpm(struct usb_device *udev)
++{
++ return 0;
++}
++
++static inline int usb_disable_usb2_hardware_lpm(struct usb_device *udev)
+ {
+ return 0;
+ }
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index 64cbc2d007c9..c36275754086 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -58,12 +58,18 @@ module_param_named(disable_hugepages,
+ MODULE_PARM_DESC(disable_hugepages,
+ "Disable VFIO IOMMU support for IOMMU hugepages.");
+
++static unsigned int dma_entry_limit __read_mostly = U16_MAX;
++module_param_named(dma_entry_limit, dma_entry_limit, uint, 0644);
++MODULE_PARM_DESC(dma_entry_limit,
++ "Maximum number of user DMA mappings per container (65535).");
++
+ struct vfio_iommu {
+ struct list_head domain_list;
+ struct vfio_domain *external_domain; /* domain for external user */
+ struct mutex lock;
+ struct rb_root dma_list;
+ struct blocking_notifier_head notifier;
++ unsigned int dma_avail;
+ bool v2;
+ bool nesting;
+ };
+@@ -836,6 +842,7 @@ static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma)
+ vfio_unlink_dma(iommu, dma);
+ put_task_struct(dma->task);
+ kfree(dma);
++ iommu->dma_avail++;
+ }
+
+ static unsigned long vfio_pgsize_bitmap(struct vfio_iommu *iommu)
+@@ -1110,12 +1117,18 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
+ goto out_unlock;
+ }
+
++ if (!iommu->dma_avail) {
++ ret = -ENOSPC;
++ goto out_unlock;
++ }
++
+ dma = kzalloc(sizeof(*dma), GFP_KERNEL);
+ if (!dma) {
+ ret = -ENOMEM;
+ goto out_unlock;
+ }
+
++ iommu->dma_avail--;
+ dma->iova = iova;
+ dma->vaddr = vaddr;
+ dma->prot = prot;
+@@ -1612,6 +1625,7 @@ static void *vfio_iommu_type1_open(unsigned long arg)
+
+ INIT_LIST_HEAD(&iommu->domain_list);
+ iommu->dma_list = RB_ROOT;
++ iommu->dma_avail = dma_entry_limit;
+ mutex_init(&iommu->lock);
+ BLOCKING_INIT_NOTIFIER_HEAD(&iommu->notifier);
+
+diff --git a/fs/aio.c b/fs/aio.c
+index 45d5ef8dd0a8..911e23087dfb 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -161,9 +161,13 @@ struct kioctx {
+ unsigned id;
+ };
+
++/*
++ * First field must be the file pointer in all the
++ * iocb unions! See also 'struct kiocb' in <linux/fs.h>
++ */
+ struct fsync_iocb {
+- struct work_struct work;
+ struct file *file;
++ struct work_struct work;
+ bool datasync;
+ };
+
+@@ -171,14 +175,21 @@ struct poll_iocb {
+ struct file *file;
+ struct wait_queue_head *head;
+ __poll_t events;
+- bool woken;
++ bool done;
+ bool cancelled;
+ struct wait_queue_entry wait;
+ struct work_struct work;
+ };
+
++/*
++ * NOTE! Each of the iocb union members has the file pointer
++ * as the first entry in their struct definition. So you can
++ * access the file pointer through any of the sub-structs,
++ * or directly as just 'ki_filp' in this struct.
++ */
+ struct aio_kiocb {
+ union {
++ struct file *ki_filp;
+ struct kiocb rw;
+ struct fsync_iocb fsync;
+ struct poll_iocb poll;
+@@ -187,8 +198,7 @@ struct aio_kiocb {
+ struct kioctx *ki_ctx;
+ kiocb_cancel_fn *ki_cancel;
+
+- struct iocb __user *ki_user_iocb; /* user's aiocb */
+- __u64 ki_user_data; /* user's data for completion */
++ struct io_event ki_res;
+
+ struct list_head ki_list; /* the aio core uses this
+ * for cancellation */
+@@ -902,7 +912,7 @@ static void put_reqs_available(struct kioctx *ctx, unsigned nr)
+ local_irq_restore(flags);
+ }
+
+-static bool get_reqs_available(struct kioctx *ctx)
++static bool __get_reqs_available(struct kioctx *ctx)
+ {
+ struct kioctx_cpu *kcpu;
+ bool ret = false;
+@@ -994,32 +1004,35 @@ static void user_refill_reqs_available(struct kioctx *ctx)
+ spin_unlock_irq(&ctx->completion_lock);
+ }
+
++static bool get_reqs_available(struct kioctx *ctx)
++{
++ if (__get_reqs_available(ctx))
++ return true;
++ user_refill_reqs_available(ctx);
++ return __get_reqs_available(ctx);
++}
++
+ /* aio_get_req
+ * Allocate a slot for an aio request.
+ * Returns NULL if no requests are free.
++ *
++ * The refcount is initialized to 2 - one for the async op completion,
++ * one for the synchronous code that does this.
+ */
+ static inline struct aio_kiocb *aio_get_req(struct kioctx *ctx)
+ {
+ struct aio_kiocb *req;
+
+- if (!get_reqs_available(ctx)) {
+- user_refill_reqs_available(ctx);
+- if (!get_reqs_available(ctx))
+- return NULL;
+- }
+-
+- req = kmem_cache_alloc(kiocb_cachep, GFP_KERNEL|__GFP_ZERO);
++ req = kmem_cache_alloc(kiocb_cachep, GFP_KERNEL);
+ if (unlikely(!req))
+- goto out_put;
++ return NULL;
+
+ percpu_ref_get(&ctx->reqs);
+- INIT_LIST_HEAD(&req->ki_list);
+- refcount_set(&req->ki_refcnt, 0);
+ req->ki_ctx = ctx;
++ INIT_LIST_HEAD(&req->ki_list);
++ refcount_set(&req->ki_refcnt, 2);
++ req->ki_eventfd = NULL;
+ return req;
+-out_put:
+- put_reqs_available(ctx, 1);
+- return NULL;
+ }
+
+ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
+@@ -1050,19 +1063,18 @@ out:
+ return ret;
+ }
+
+-static inline void iocb_put(struct aio_kiocb *iocb)
++static inline void iocb_destroy(struct aio_kiocb *iocb)
+ {
+- if (refcount_read(&iocb->ki_refcnt) == 0 ||
+- refcount_dec_and_test(&iocb->ki_refcnt)) {
+- percpu_ref_put(&iocb->ki_ctx->reqs);
+- kmem_cache_free(kiocb_cachep, iocb);
+- }
++ if (iocb->ki_filp)
++ fput(iocb->ki_filp);
++ percpu_ref_put(&iocb->ki_ctx->reqs);
++ kmem_cache_free(kiocb_cachep, iocb);
+ }
+
+ /* aio_complete
+ * Called when the io request on the given iocb is complete.
+ */
+-static void aio_complete(struct aio_kiocb *iocb, long res, long res2)
++static void aio_complete(struct aio_kiocb *iocb)
+ {
+ struct kioctx *ctx = iocb->ki_ctx;
+ struct aio_ring *ring;
+@@ -1086,17 +1098,14 @@ static void aio_complete(struct aio_kiocb *iocb, long res, long res2)
+ ev_page = kmap_atomic(ctx->ring_pages[pos / AIO_EVENTS_PER_PAGE]);
+ event = ev_page + pos % AIO_EVENTS_PER_PAGE;
+
+- event->obj = (u64)(unsigned long)iocb->ki_user_iocb;
+- event->data = iocb->ki_user_data;
+- event->res = res;
+- event->res2 = res2;
++ *event = iocb->ki_res;
+
+ kunmap_atomic(ev_page);
+ flush_dcache_page(ctx->ring_pages[pos / AIO_EVENTS_PER_PAGE]);
+
+- pr_debug("%p[%u]: %p: %p %Lx %lx %lx\n",
+- ctx, tail, iocb, iocb->ki_user_iocb, iocb->ki_user_data,
+- res, res2);
++ pr_debug("%p[%u]: %p: %p %Lx %Lx %Lx\n", ctx, tail, iocb,
++ (void __user *)(unsigned long)iocb->ki_res.obj,
++ iocb->ki_res.data, iocb->ki_res.res, iocb->ki_res.res2);
+
+ /* after flagging the request as done, we
+ * must never even look at it again
+@@ -1138,7 +1147,14 @@ static void aio_complete(struct aio_kiocb *iocb, long res, long res2)
+
+ if (waitqueue_active(&ctx->wait))
+ wake_up(&ctx->wait);
+- iocb_put(iocb);
++}
++
++static inline void iocb_put(struct aio_kiocb *iocb)
++{
++ if (refcount_dec_and_test(&iocb->ki_refcnt)) {
++ aio_complete(iocb);
++ iocb_destroy(iocb);
++ }
+ }
+
+ /* aio_read_events_ring
+@@ -1412,18 +1428,17 @@ static void aio_complete_rw(struct kiocb *kiocb, long res, long res2)
+ file_end_write(kiocb->ki_filp);
+ }
+
+- fput(kiocb->ki_filp);
+- aio_complete(iocb, res, res2);
++ iocb->ki_res.res = res;
++ iocb->ki_res.res2 = res2;
++ iocb_put(iocb);
+ }
+
+-static int aio_prep_rw(struct kiocb *req, struct iocb *iocb)
++static int aio_prep_rw(struct kiocb *req, const struct iocb *iocb)
+ {
+ int ret;
+
+- req->ki_filp = fget(iocb->aio_fildes);
+- if (unlikely(!req->ki_filp))
+- return -EBADF;
+ req->ki_complete = aio_complete_rw;
++ req->private = NULL;
+ req->ki_pos = iocb->aio_offset;
+ req->ki_flags = iocb_flags(req->ki_filp);
+ if (iocb->aio_flags & IOCB_FLAG_RESFD)
+@@ -1438,7 +1453,6 @@ static int aio_prep_rw(struct kiocb *req, struct iocb *iocb)
+ ret = ioprio_check_cap(iocb->aio_reqprio);
+ if (ret) {
+ pr_debug("aio ioprio check cap error: %d\n", ret);
+- fput(req->ki_filp);
+ return ret;
+ }
+
+@@ -1448,11 +1462,13 @@ static int aio_prep_rw(struct kiocb *req, struct iocb *iocb)
+
+ ret = kiocb_set_rw_flags(req, iocb->aio_rw_flags);
+ if (unlikely(ret))
+- fput(req->ki_filp);
+- return ret;
++ return ret;
++
++ req->ki_flags &= ~IOCB_HIPRI; /* no one is going to poll for this I/O */
++ return 0;
+ }
+
+-static int aio_setup_rw(int rw, struct iocb *iocb, struct iovec **iovec,
++static int aio_setup_rw(int rw, const struct iocb *iocb, struct iovec **iovec,
+ bool vectored, bool compat, struct iov_iter *iter)
+ {
+ void __user *buf = (void __user *)(uintptr_t)iocb->aio_buf;
+@@ -1487,12 +1503,12 @@ static inline void aio_rw_done(struct kiocb *req, ssize_t ret)
+ ret = -EINTR;
+ /*FALLTHRU*/
+ default:
+- aio_complete_rw(req, ret, 0);
++ req->ki_complete(req, ret, 0);
+ }
+ }
+
+-static ssize_t aio_read(struct kiocb *req, struct iocb *iocb, bool vectored,
+- bool compat)
++static ssize_t aio_read(struct kiocb *req, const struct iocb *iocb,
++ bool vectored, bool compat)
+ {
+ struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
+ struct iov_iter iter;
+@@ -1503,29 +1519,24 @@ static ssize_t aio_read(struct kiocb *req, struct iocb *iocb, bool vectored,
+ if (ret)
+ return ret;
+ file = req->ki_filp;
+-
+- ret = -EBADF;
+ if (unlikely(!(file->f_mode & FMODE_READ)))
+- goto out_fput;
++ return -EBADF;
+ ret = -EINVAL;
+ if (unlikely(!file->f_op->read_iter))
+- goto out_fput;
++ return -EINVAL;
+
+ ret = aio_setup_rw(READ, iocb, &iovec, vectored, compat, &iter);
+ if (ret)
+- goto out_fput;
++ return ret;
+ ret = rw_verify_area(READ, file, &req->ki_pos, iov_iter_count(&iter));
+ if (!ret)
+ aio_rw_done(req, call_read_iter(file, req, &iter));
+ kfree(iovec);
+-out_fput:
+- if (unlikely(ret))
+- fput(file);
+ return ret;
+ }
+
+-static ssize_t aio_write(struct kiocb *req, struct iocb *iocb, bool vectored,
+- bool compat)
++static ssize_t aio_write(struct kiocb *req, const struct iocb *iocb,
++ bool vectored, bool compat)
+ {
+ struct iovec inline_vecs[UIO_FASTIOV], *iovec = inline_vecs;
+ struct iov_iter iter;
+@@ -1537,16 +1548,14 @@ static ssize_t aio_write(struct kiocb *req, struct iocb *iocb, bool vectored,
+ return ret;
+ file = req->ki_filp;
+
+- ret = -EBADF;
+ if (unlikely(!(file->f_mode & FMODE_WRITE)))
+- goto out_fput;
+- ret = -EINVAL;
++ return -EBADF;
+ if (unlikely(!file->f_op->write_iter))
+- goto out_fput;
++ return -EINVAL;
+
+ ret = aio_setup_rw(WRITE, iocb, &iovec, vectored, compat, &iter);
+ if (ret)
+- goto out_fput;
++ return ret;
+ ret = rw_verify_area(WRITE, file, &req->ki_pos, iov_iter_count(&iter));
+ if (!ret) {
+ /*
+@@ -1564,35 +1573,26 @@ static ssize_t aio_write(struct kiocb *req, struct iocb *iocb, bool vectored,
+ aio_rw_done(req, call_write_iter(file, req, &iter));
+ }
+ kfree(iovec);
+-out_fput:
+- if (unlikely(ret))
+- fput(file);
+ return ret;
+ }
+
+ static void aio_fsync_work(struct work_struct *work)
+ {
+- struct fsync_iocb *req = container_of(work, struct fsync_iocb, work);
+- int ret;
++ struct aio_kiocb *iocb = container_of(work, struct aio_kiocb, fsync.work);
+
+- ret = vfs_fsync(req->file, req->datasync);
+- fput(req->file);
+- aio_complete(container_of(req, struct aio_kiocb, fsync), ret, 0);
++ iocb->ki_res.res = vfs_fsync(iocb->fsync.file, iocb->fsync.datasync);
++ iocb_put(iocb);
+ }
+
+-static int aio_fsync(struct fsync_iocb *req, struct iocb *iocb, bool datasync)
++static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb,
++ bool datasync)
+ {
+ if (unlikely(iocb->aio_buf || iocb->aio_offset || iocb->aio_nbytes ||
+ iocb->aio_rw_flags))
+ return -EINVAL;
+
+- req->file = fget(iocb->aio_fildes);
+- if (unlikely(!req->file))
+- return -EBADF;
+- if (unlikely(!req->file->f_op->fsync)) {
+- fput(req->file);
++ if (unlikely(!req->file->f_op->fsync))
+ return -EINVAL;
+- }
+
+ req->datasync = datasync;
+ INIT_WORK(&req->work, aio_fsync_work);
+@@ -1600,14 +1600,6 @@ static int aio_fsync(struct fsync_iocb *req, struct iocb *iocb, bool datasync)
+ return 0;
+ }
+
+-static inline void aio_poll_complete(struct aio_kiocb *iocb, __poll_t mask)
+-{
+- struct file *file = iocb->poll.file;
+-
+- aio_complete(iocb, mangle_poll(mask), 0);
+- fput(file);
+-}
+-
+ static void aio_poll_complete_work(struct work_struct *work)
+ {
+ struct poll_iocb *req = container_of(work, struct poll_iocb, work);
+@@ -1633,9 +1625,11 @@ static void aio_poll_complete_work(struct work_struct *work)
+ return;
+ }
+ list_del_init(&iocb->ki_list);
++ iocb->ki_res.res = mangle_poll(mask);
++ req->done = true;
+ spin_unlock_irq(&ctx->ctx_lock);
+
+- aio_poll_complete(iocb, mask);
++ iocb_put(iocb);
+ }
+
+ /* assumes we are called with irqs disabled */
+@@ -1663,31 +1657,27 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
+ __poll_t mask = key_to_poll(key);
+ unsigned long flags;
+
+- req->woken = true;
+-
+ /* for instances that support it check for an event match first: */
+- if (mask) {
+- if (!(mask & req->events))
+- return 0;
++ if (mask && !(mask & req->events))
++ return 0;
++
++ list_del_init(&req->wait.entry);
+
++ if (mask && spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) {
+ /*
+ * Try to complete the iocb inline if we can. Use
+ * irqsave/irqrestore because not all filesystems (e.g. fuse)
+ * call this function with IRQs disabled and because IRQs
+ * have to be disabled before ctx_lock is obtained.
+ */
+- if (spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) {
+- list_del(&iocb->ki_list);
+- spin_unlock_irqrestore(&iocb->ki_ctx->ctx_lock, flags);
+-
+- list_del_init(&req->wait.entry);
+- aio_poll_complete(iocb, mask);
+- return 1;
+- }
++ list_del(&iocb->ki_list);
++ iocb->ki_res.res = mangle_poll(mask);
++ req->done = true;
++ spin_unlock_irqrestore(&iocb->ki_ctx->ctx_lock, flags);
++ iocb_put(iocb);
++ } else {
++ schedule_work(&req->work);
+ }
+-
+- list_del_init(&req->wait.entry);
+- schedule_work(&req->work);
+ return 1;
+ }
+
+@@ -1714,11 +1704,12 @@ aio_poll_queue_proc(struct file *file, struct wait_queue_head *head,
+ add_wait_queue(head, &pt->iocb->poll.wait);
+ }
+
+-static ssize_t aio_poll(struct aio_kiocb *aiocb, struct iocb *iocb)
++static ssize_t aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb)
+ {
+ struct kioctx *ctx = aiocb->ki_ctx;
+ struct poll_iocb *req = &aiocb->poll;
+ struct aio_poll_table apt;
++ bool cancel = false;
+ __poll_t mask;
+
+ /* reject any unknown events outside the normal event mask. */
+@@ -1730,9 +1721,10 @@ static ssize_t aio_poll(struct aio_kiocb *aiocb, struct iocb *iocb)
+
+ INIT_WORK(&req->work, aio_poll_complete_work);
+ req->events = demangle_poll(iocb->aio_buf) | EPOLLERR | EPOLLHUP;
+- req->file = fget(iocb->aio_fildes);
+- if (unlikely(!req->file))
+- return -EBADF;
++
++ req->head = NULL;
++ req->done = false;
++ req->cancelled = false;
+
+ apt.pt._qproc = aio_poll_queue_proc;
+ apt.pt._key = req->events;
+@@ -1743,83 +1735,79 @@ static ssize_t aio_poll(struct aio_kiocb *aiocb, struct iocb *iocb)
+ INIT_LIST_HEAD(&req->wait.entry);
+ init_waitqueue_func_entry(&req->wait, aio_poll_wake);
+
+- /* one for removal from waitqueue, one for this function */
+- refcount_set(&aiocb->ki_refcnt, 2);
+-
+ mask = vfs_poll(req->file, &apt.pt) & req->events;
+- if (unlikely(!req->head)) {
+- /* we did not manage to set up a waitqueue, done */
+- goto out;
+- }
+-
+ spin_lock_irq(&ctx->ctx_lock);
+- spin_lock(&req->head->lock);
+- if (req->woken) {
+- /* wake_up context handles the rest */
+- mask = 0;
++ if (likely(req->head)) {
++ spin_lock(&req->head->lock);
++ if (unlikely(list_empty(&req->wait.entry))) {
++ if (apt.error)
++ cancel = true;
++ apt.error = 0;
++ mask = 0;
++ }
++ if (mask || apt.error) {
++ list_del_init(&req->wait.entry);
++ } else if (cancel) {
++ WRITE_ONCE(req->cancelled, true);
++ } else if (!req->done) { /* actually waiting for an event */
++ list_add_tail(&aiocb->ki_list, &ctx->active_reqs);
++ aiocb->ki_cancel = aio_poll_cancel;
++ }
++ spin_unlock(&req->head->lock);
++ }
++ if (mask) { /* no async, we'd stolen it */
++ aiocb->ki_res.res = mangle_poll(mask);
+ apt.error = 0;
+- } else if (mask || apt.error) {
+- /* if we get an error or a mask we are done */
+- WARN_ON_ONCE(list_empty(&req->wait.entry));
+- list_del_init(&req->wait.entry);
+- } else {
+- /* actually waiting for an event */
+- list_add_tail(&aiocb->ki_list, &ctx->active_reqs);
+- aiocb->ki_cancel = aio_poll_cancel;
+ }
+- spin_unlock(&req->head->lock);
+ spin_unlock_irq(&ctx->ctx_lock);
+-
+-out:
+- if (unlikely(apt.error)) {
+- fput(req->file);
+- return apt.error;
+- }
+-
+ if (mask)
+- aio_poll_complete(aiocb, mask);
+- iocb_put(aiocb);
+- return 0;
++ iocb_put(aiocb);
++ return apt.error;
+ }
+
+-static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
+- bool compat)
++static int __io_submit_one(struct kioctx *ctx, const struct iocb *iocb,
++ struct iocb __user *user_iocb, bool compat)
+ {
+ struct aio_kiocb *req;
+- struct iocb iocb;
+ ssize_t ret;
+
+- if (unlikely(copy_from_user(&iocb, user_iocb, sizeof(iocb))))
+- return -EFAULT;
+-
+ /* enforce forwards compatibility on users */
+- if (unlikely(iocb.aio_reserved2)) {
++ if (unlikely(iocb->aio_reserved2)) {
+ pr_debug("EINVAL: reserve field set\n");
+ return -EINVAL;
+ }
+
+ /* prevent overflows */
+ if (unlikely(
+- (iocb.aio_buf != (unsigned long)iocb.aio_buf) ||
+- (iocb.aio_nbytes != (size_t)iocb.aio_nbytes) ||
+- ((ssize_t)iocb.aio_nbytes < 0)
++ (iocb->aio_buf != (unsigned long)iocb->aio_buf) ||
++ (iocb->aio_nbytes != (size_t)iocb->aio_nbytes) ||
++ ((ssize_t)iocb->aio_nbytes < 0)
+ )) {
+ pr_debug("EINVAL: overflow check\n");
+ return -EINVAL;
+ }
+
++ if (!get_reqs_available(ctx))
++ return -EAGAIN;
++
++ ret = -EAGAIN;
+ req = aio_get_req(ctx);
+ if (unlikely(!req))
+- return -EAGAIN;
++ goto out_put_reqs_available;
++
++ req->ki_filp = fget(iocb->aio_fildes);
++ ret = -EBADF;
++ if (unlikely(!req->ki_filp))
++ goto out_put_req;
+
+- if (iocb.aio_flags & IOCB_FLAG_RESFD) {
++ if (iocb->aio_flags & IOCB_FLAG_RESFD) {
+ /*
+ * If the IOCB_FLAG_RESFD flag of aio_flags is set, get an
+ * instance of the file* now. The file descriptor must be
+ * an eventfd() fd, and will be signaled for each completed
+ * event using the eventfd_signal() function.
+ */
+- req->ki_eventfd = eventfd_ctx_fdget((int) iocb.aio_resfd);
++ req->ki_eventfd = eventfd_ctx_fdget((int) iocb->aio_resfd);
+ if (IS_ERR(req->ki_eventfd)) {
+ ret = PTR_ERR(req->ki_eventfd);
+ req->ki_eventfd = NULL;
+@@ -1833,54 +1821,70 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
+ goto out_put_req;
+ }
+
+- req->ki_user_iocb = user_iocb;
+- req->ki_user_data = iocb.aio_data;
++ req->ki_res.obj = (u64)(unsigned long)user_iocb;
++ req->ki_res.data = iocb->aio_data;
++ req->ki_res.res = 0;
++ req->ki_res.res2 = 0;
+
+- switch (iocb.aio_lio_opcode) {
++ switch (iocb->aio_lio_opcode) {
+ case IOCB_CMD_PREAD:
+- ret = aio_read(&req->rw, &iocb, false, compat);
++ ret = aio_read(&req->rw, iocb, false, compat);
+ break;
+ case IOCB_CMD_PWRITE:
+- ret = aio_write(&req->rw, &iocb, false, compat);
++ ret = aio_write(&req->rw, iocb, false, compat);
+ break;
+ case IOCB_CMD_PREADV:
+- ret = aio_read(&req->rw, &iocb, true, compat);
++ ret = aio_read(&req->rw, iocb, true, compat);
+ break;
+ case IOCB_CMD_PWRITEV:
+- ret = aio_write(&req->rw, &iocb, true, compat);
++ ret = aio_write(&req->rw, iocb, true, compat);
+ break;
+ case IOCB_CMD_FSYNC:
+- ret = aio_fsync(&req->fsync, &iocb, false);
++ ret = aio_fsync(&req->fsync, iocb, false);
+ break;
+ case IOCB_CMD_FDSYNC:
+- ret = aio_fsync(&req->fsync, &iocb, true);
++ ret = aio_fsync(&req->fsync, iocb, true);
+ break;
+ case IOCB_CMD_POLL:
+- ret = aio_poll(req, &iocb);
++ ret = aio_poll(req, iocb);
+ break;
+ default:
+- pr_debug("invalid aio operation %d\n", iocb.aio_lio_opcode);
++ pr_debug("invalid aio operation %d\n", iocb->aio_lio_opcode);
+ ret = -EINVAL;
+ break;
+ }
+
++ /* Done with the synchronous reference */
++ iocb_put(req);
++
+ /*
+ * If ret is 0, we'd either done aio_complete() ourselves or have
+ * arranged for that to be done asynchronously. Anything non-zero
+ * means that we need to destroy req ourselves.
+ */
+- if (ret)
+- goto out_put_req;
+- return 0;
++ if (!ret)
++ return 0;
++
+ out_put_req:
+- put_reqs_available(ctx, 1);
+- percpu_ref_put(&ctx->reqs);
+ if (req->ki_eventfd)
+ eventfd_ctx_put(req->ki_eventfd);
+- kmem_cache_free(kiocb_cachep, req);
++ iocb_destroy(req);
++out_put_reqs_available:
++ put_reqs_available(ctx, 1);
+ return ret;
+ }
+
++static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
++ bool compat)
++{
++ struct iocb iocb;
++
++ if (unlikely(copy_from_user(&iocb, user_iocb, sizeof(iocb))))
++ return -EFAULT;
++
++ return __io_submit_one(ctx, &iocb, user_iocb, compat);
++}
++
+ /* sys_io_submit:
+ * Queue the nr iocbs pointed to by iocbpp for processing. Returns
+ * the number of iocbs queued. May return -EINVAL if the aio_context
+@@ -1973,24 +1977,6 @@ COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
+ }
+ #endif
+
+-/* lookup_kiocb
+- * Finds a given iocb for cancellation.
+- */
+-static struct aio_kiocb *
+-lookup_kiocb(struct kioctx *ctx, struct iocb __user *iocb)
+-{
+- struct aio_kiocb *kiocb;
+-
+- assert_spin_locked(&ctx->ctx_lock);
+-
+- /* TODO: use a hash or array, this sucks. */
+- list_for_each_entry(kiocb, &ctx->active_reqs, ki_list) {
+- if (kiocb->ki_user_iocb == iocb)
+- return kiocb;
+- }
+- return NULL;
+-}
+-
+ /* sys_io_cancel:
+ * Attempts to cancel an iocb previously passed to io_submit. If
+ * the operation is successfully cancelled, the resulting event is
+@@ -2008,6 +1994,7 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb,
+ struct aio_kiocb *kiocb;
+ int ret = -EINVAL;
+ u32 key;
++ u64 obj = (u64)(unsigned long)iocb;
+
+ if (unlikely(get_user(key, &iocb->aio_key)))
+ return -EFAULT;
+@@ -2019,10 +2006,13 @@ SYSCALL_DEFINE3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb,
+ return -EINVAL;
+
+ spin_lock_irq(&ctx->ctx_lock);
+- kiocb = lookup_kiocb(ctx, iocb);
+- if (kiocb) {
+- ret = kiocb->ki_cancel(&kiocb->rw);
+- list_del_init(&kiocb->ki_list);
++ /* TODO: use a hash or array, this sucks. */
++ list_for_each_entry(kiocb, &ctx->active_reqs, ki_list) {
++ if (kiocb->ki_res.obj == obj) {
++ ret = kiocb->ki_cancel(&kiocb->rw);
++ list_del_init(&kiocb->ki_list);
++ break;
++ }
+ }
+ spin_unlock_irq(&ctx->ctx_lock);
+
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index 82928cea0209..7f3f64ba464f 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -1470,6 +1470,7 @@ void ceph_dentry_lru_del(struct dentry *dn)
+ unsigned ceph_dentry_hash(struct inode *dir, struct dentry *dn)
+ {
+ struct ceph_inode_info *dci = ceph_inode(dir);
++ unsigned hash;
+
+ switch (dci->i_dir_layout.dl_dir_hash) {
+ case 0: /* for backward compat */
+@@ -1477,8 +1478,11 @@ unsigned ceph_dentry_hash(struct inode *dir, struct dentry *dn)
+ return dn->d_name.hash;
+
+ default:
+- return ceph_str_hash(dci->i_dir_layout.dl_dir_hash,
++ spin_lock(&dn->d_lock);
++ hash = ceph_str_hash(dci->i_dir_layout.dl_dir_hash,
+ dn->d_name.name, dn->d_name.len);
++ spin_unlock(&dn->d_lock);
++ return hash;
+ }
+ }
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index bc43c822426a..bfcf11c70bfa 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -1290,6 +1290,15 @@ static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap,
+ list_add(&ci->i_prealloc_cap_flush->i_list, &to_remove);
+ ci->i_prealloc_cap_flush = NULL;
+ }
++
++ if (drop &&
++ ci->i_wrbuffer_ref_head == 0 &&
++ ci->i_wr_ref == 0 &&
++ ci->i_dirty_caps == 0 &&
++ ci->i_flushing_caps == 0) {
++ ceph_put_snap_context(ci->i_head_snapc);
++ ci->i_head_snapc = NULL;
++ }
+ }
+ spin_unlock(&ci->i_ceph_lock);
+ while (!list_empty(&to_remove)) {
+@@ -1945,10 +1954,39 @@ retry:
+ return path;
+ }
+
++/* Duplicate the dentry->d_name.name safely */
++static int clone_dentry_name(struct dentry *dentry, const char **ppath,
++ int *ppathlen)
++{
++ u32 len;
++ char *name;
++
++retry:
++ len = READ_ONCE(dentry->d_name.len);
++ name = kmalloc(len + 1, GFP_NOFS);
++ if (!name)
++ return -ENOMEM;
++
++ spin_lock(&dentry->d_lock);
++ if (dentry->d_name.len != len) {
++ spin_unlock(&dentry->d_lock);
++ kfree(name);
++ goto retry;
++ }
++ memcpy(name, dentry->d_name.name, len);
++ spin_unlock(&dentry->d_lock);
++
++ name[len] = '\0';
++ *ppath = name;
++ *ppathlen = len;
++ return 0;
++}
++
+ static int build_dentry_path(struct dentry *dentry, struct inode *dir,
+ const char **ppath, int *ppathlen, u64 *pino,
+- int *pfreepath)
++ bool *pfreepath, bool parent_locked)
+ {
++ int ret;
+ char *path;
+
+ rcu_read_lock();
+@@ -1957,8 +1995,15 @@ static int build_dentry_path(struct dentry *dentry, struct inode *dir,
+ if (dir && ceph_snap(dir) == CEPH_NOSNAP) {
+ *pino = ceph_ino(dir);
+ rcu_read_unlock();
+- *ppath = dentry->d_name.name;
+- *ppathlen = dentry->d_name.len;
++ if (parent_locked) {
++ *ppath = dentry->d_name.name;
++ *ppathlen = dentry->d_name.len;
++ } else {
++ ret = clone_dentry_name(dentry, ppath, ppathlen);
++ if (ret)
++ return ret;
++ *pfreepath = true;
++ }
+ return 0;
+ }
+ rcu_read_unlock();
+@@ -1966,13 +2011,13 @@ static int build_dentry_path(struct dentry *dentry, struct inode *dir,
+ if (IS_ERR(path))
+ return PTR_ERR(path);
+ *ppath = path;
+- *pfreepath = 1;
++ *pfreepath = true;
+ return 0;
+ }
+
+ static int build_inode_path(struct inode *inode,
+ const char **ppath, int *ppathlen, u64 *pino,
+- int *pfreepath)
++ bool *pfreepath)
+ {
+ struct dentry *dentry;
+ char *path;
+@@ -1988,7 +2033,7 @@ static int build_inode_path(struct inode *inode,
+ if (IS_ERR(path))
+ return PTR_ERR(path);
+ *ppath = path;
+- *pfreepath = 1;
++ *pfreepath = true;
+ return 0;
+ }
+
+@@ -1999,7 +2044,7 @@ static int build_inode_path(struct inode *inode,
+ static int set_request_path_attr(struct inode *rinode, struct dentry *rdentry,
+ struct inode *rdiri, const char *rpath,
+ u64 rino, const char **ppath, int *pathlen,
+- u64 *ino, int *freepath)
++ u64 *ino, bool *freepath, bool parent_locked)
+ {
+ int r = 0;
+
+@@ -2009,7 +2054,7 @@ static int set_request_path_attr(struct inode *rinode, struct dentry *rdentry,
+ ceph_snap(rinode));
+ } else if (rdentry) {
+ r = build_dentry_path(rdentry, rdiri, ppath, pathlen, ino,
+- freepath);
++ freepath, parent_locked);
+ dout(" dentry %p %llx/%.*s\n", rdentry, *ino, *pathlen,
+ *ppath);
+ } else if (rpath || rino) {
+@@ -2035,7 +2080,7 @@ static struct ceph_msg *create_request_message(struct ceph_mds_client *mdsc,
+ const char *path2 = NULL;
+ u64 ino1 = 0, ino2 = 0;
+ int pathlen1 = 0, pathlen2 = 0;
+- int freepath1 = 0, freepath2 = 0;
++ bool freepath1 = false, freepath2 = false;
+ int len;
+ u16 releases;
+ void *p, *end;
+@@ -2043,16 +2088,19 @@ static struct ceph_msg *create_request_message(struct ceph_mds_client *mdsc,
+
+ ret = set_request_path_attr(req->r_inode, req->r_dentry,
+ req->r_parent, req->r_path1, req->r_ino1.ino,
+- &path1, &pathlen1, &ino1, &freepath1);
++ &path1, &pathlen1, &ino1, &freepath1,
++ test_bit(CEPH_MDS_R_PARENT_LOCKED,
++ &req->r_req_flags));
+ if (ret < 0) {
+ msg = ERR_PTR(ret);
+ goto out;
+ }
+
++ /* If r_old_dentry is set, then assume that its parent is locked */
+ ret = set_request_path_attr(NULL, req->r_old_dentry,
+ req->r_old_dentry_dir,
+ req->r_path2, req->r_ino2.ino,
+- &path2, &pathlen2, &ino2, &freepath2);
++ &path2, &pathlen2, &ino2, &freepath2, true);
+ if (ret < 0) {
+ msg = ERR_PTR(ret);
+ goto out_free1;
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index f74193da0e09..1f46b02f7314 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -568,7 +568,12 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci)
+ old_snapc = NULL;
+
+ update_snapc:
+- if (ci->i_head_snapc) {
++ if (ci->i_wrbuffer_ref_head == 0 &&
++ ci->i_wr_ref == 0 &&
++ ci->i_dirty_caps == 0 &&
++ ci->i_flushing_caps == 0) {
++ ci->i_head_snapc = NULL;
++ } else {
+ ci->i_head_snapc = ceph_get_snap_context(new_snapc);
+ dout(" new snapc is %p\n", new_snapc);
+ }
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index b59ebed4f615..1fadd314ae7f 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1735,6 +1735,10 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry,
+ if (rc == 0 || rc != -EBUSY)
+ goto do_rename_exit;
+
++ /* Don't fall back to using SMB on SMB 2+ mount */
++ if (server->vals->protocol_id != 0)
++ goto do_rename_exit;
++
+ /* open-file renames don't work across directories */
+ if (to_dentry->d_parent != from_dentry->d_parent)
+ goto do_rename_exit;
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index c6fd3acc5560..33afb637e6f8 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3285,6 +3285,7 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
+ rc);
+ }
+ free_rsp_buf(resp_buftype, rsp_iov.iov_base);
++ cifs_small_buf_release(req);
+ return rc == -ENODATA ? 0 : rc;
+ } else
+ trace_smb3_read_done(xid, req->PersistentFileId,
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index c0ba5206cd9d..006c277dc22e 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -829,6 +829,7 @@ int ext4_get_inode_usage(struct inode *inode, qsize_t *usage)
+ bh = ext4_sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl, REQ_PRIO);
+ if (IS_ERR(bh)) {
+ ret = PTR_ERR(bh);
++ bh = NULL;
+ goto out;
+ }
+
+@@ -2907,6 +2908,7 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
+ if (error == -EIO)
+ EXT4_ERROR_INODE(inode, "block %llu read error",
+ EXT4_I(inode)->i_file_acl);
++ bh = NULL;
+ goto cleanup;
+ }
+ error = ext4_xattr_check_block(inode, bh);
+@@ -3063,6 +3065,7 @@ ext4_xattr_block_cache_find(struct inode *inode,
+ if (IS_ERR(bh)) {
+ if (PTR_ERR(bh) == -ENOMEM)
+ return NULL;
++ bh = NULL;
+ EXT4_ERROR_INODE(inode, "block %lu read error",
+ (unsigned long)ce->e_value);
+ } else if (ext4_xattr_cmp(header, BHDR(bh)) == 0) {
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 6b666d187907..6df9b85caf20 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2052,7 +2052,8 @@ static int nfs23_validate_mount_data(void *options,
+ memcpy(sap, &data->addr, sizeof(data->addr));
+ args->nfs_server.addrlen = sizeof(data->addr);
+ args->nfs_server.port = ntohs(data->addr.sin_port);
+- if (!nfs_verify_server_address(sap))
++ if (sap->sa_family != AF_INET ||
++ !nfs_verify_server_address(sap))
+ goto out_no_address;
+
+ if (!(data->flags & NFS_MOUNT_TCP))
+diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
+index 601bf33c26a0..ebbb0285addb 100644
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -926,8 +926,9 @@ static void nfsd4_cb_prepare(struct rpc_task *task, void *calldata)
+ cb->cb_seq_status = 1;
+ cb->cb_status = 0;
+ if (minorversion) {
+- if (!nfsd41_cb_get_slot(clp, task))
++ if (!cb->cb_holds_slot && !nfsd41_cb_get_slot(clp, task))
+ return;
++ cb->cb_holds_slot = true;
+ }
+ rpc_call_start(task);
+ }
+@@ -954,6 +955,9 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback
+ return true;
+ }
+
++ if (!cb->cb_holds_slot)
++ goto need_restart;
++
+ switch (cb->cb_seq_status) {
+ case 0:
+ /*
+@@ -992,6 +996,7 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback
+ cb->cb_seq_status);
+ }
+
++ cb->cb_holds_slot = false;
+ clear_bit(0, &clp->cl_cb_slot_busy);
+ rpc_wake_up_next(&clp->cl_cb_waitq);
+ dprintk("%s: freed slot, new seqid=%d\n", __func__,
+@@ -1199,6 +1204,7 @@ void nfsd4_init_cb(struct nfsd4_callback *cb, struct nfs4_client *clp,
+ cb->cb_seq_status = 1;
+ cb->cb_status = 0;
+ cb->cb_need_restart = false;
++ cb->cb_holds_slot = false;
+ }
+
+ void nfsd4_run_cb(struct nfsd4_callback *cb)
+diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
+index 0b15dac7e609..0f07ad6dc1ef 100644
+--- a/fs/nfsd/state.h
++++ b/fs/nfsd/state.h
+@@ -70,6 +70,7 @@ struct nfsd4_callback {
+ int cb_seq_status;
+ int cb_status;
+ bool cb_need_restart;
++ bool cb_holds_slot;
+ };
+
+ struct nfsd4_callback_ops {
+diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
+index d65390727541..7325baa8f9d4 100644
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -1626,9 +1626,11 @@ static void drop_sysctl_table(struct ctl_table_header *header)
+ if (--header->nreg)
+ return;
+
+- if (parent)
++ if (parent) {
+ put_links(header);
+- start_unregistering(header);
++ start_unregistering(header);
++ }
++
+ if (!--header->count)
+ kfree_rcu(header, rcu);
+
+diff --git a/fs/splice.c b/fs/splice.c
+index 29e92b506394..c78e0e3ff6c4 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -333,8 +333,8 @@ const struct pipe_buf_operations default_pipe_buf_ops = {
+ .get = generic_pipe_buf_get,
+ };
+
+-static int generic_pipe_buf_nosteal(struct pipe_inode_info *pipe,
+- struct pipe_buffer *buf)
++int generic_pipe_buf_nosteal(struct pipe_inode_info *pipe,
++ struct pipe_buffer *buf)
+ {
+ return 1;
+ }
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 7b6084854bfe..111c94c4baa1 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -304,13 +304,19 @@ enum rw_hint {
+
+ struct kiocb {
+ struct file *ki_filp;
++
++ /* The 'ki_filp' pointer is shared in a union for aio */
++ randomized_struct_fields_start
++
+ loff_t ki_pos;
+ void (*ki_complete)(struct kiocb *iocb, long ret, long ret2);
+ void *private;
+ int ki_flags;
+ u16 ki_hint;
+ u16 ki_ioprio; /* See linux/ioprio.h */
+-} __randomize_layout;
++
++ randomized_struct_fields_end
++};
+
+ static inline bool is_sync_kiocb(struct kiocb *kiocb)
+ {
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index 3ecd7ea212ae..66ee63cd5968 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -181,6 +181,7 @@ void free_pipe_info(struct pipe_inode_info *);
+ void generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *);
++int generic_pipe_buf_nosteal(struct pipe_inode_info *, struct pipe_buffer *);
+ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);
+ void pipe_buf_mark_unmergeable(struct pipe_buffer *buf);
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 0f39ac487012..f2be5d041ba3 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -382,6 +382,7 @@ void nft_unregister_set(struct nft_set_type *type);
+ * @dtype: data type (verdict or numeric type defined by userspace)
+ * @objtype: object type (see NFT_OBJECT_* definitions)
+ * @size: maximum set size
++ * @use: number of rules references to this set
+ * @nelems: number of elements
+ * @ndeact: number of deactivated elements queued for removal
+ * @timeout: default timeout value in jiffies
+@@ -407,6 +408,7 @@ struct nft_set {
+ u32 dtype;
+ u32 objtype;
+ u32 size;
++ u32 use;
+ atomic_t nelems;
+ u32 ndeact;
+ u64 timeout;
+@@ -416,7 +418,8 @@ struct nft_set {
+ unsigned char *udata;
+ /* runtime data below here */
+ const struct nft_set_ops *ops ____cacheline_aligned;
+- u16 flags:14,
++ u16 flags:13,
++ bound:1,
+ genmask:2;
+ u8 klen;
+ u8 dlen;
+@@ -466,10 +469,15 @@ struct nft_set_binding {
+ u32 flags;
+ };
+
++enum nft_trans_phase;
++void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
++ struct nft_set_binding *binding,
++ enum nft_trans_phase phase);
+ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
+ struct nft_set_binding *binding);
+ void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
+- struct nft_set_binding *binding);
++ struct nft_set_binding *binding, bool commit);
++void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set);
+
+ /**
+ * enum nft_set_extensions - set extension type IDs
+@@ -689,10 +697,12 @@ static inline void nft_set_gc_batch_add(struct nft_set_gc_batch *gcb,
+ gcb->elems[gcb->head.cnt++] = elem;
+ }
+
++struct nft_expr_ops;
+ /**
+ * struct nft_expr_type - nf_tables expression type
+ *
+ * @select_ops: function to select nft_expr_ops
++ * @release_ops: release nft_expr_ops
+ * @ops: default ops, used when no select_ops functions is present
+ * @list: used internally
+ * @name: Identifier
+@@ -705,6 +715,7 @@ static inline void nft_set_gc_batch_add(struct nft_set_gc_batch *gcb,
+ struct nft_expr_type {
+ const struct nft_expr_ops *(*select_ops)(const struct nft_ctx *,
+ const struct nlattr * const tb[]);
++ void (*release_ops)(const struct nft_expr_ops *ops);
+ const struct nft_expr_ops *ops;
+ struct list_head list;
+ const char *name;
+@@ -718,13 +729,22 @@ struct nft_expr_type {
+ #define NFT_EXPR_STATEFUL 0x1
+ #define NFT_EXPR_GC 0x2
+
++enum nft_trans_phase {
++ NFT_TRANS_PREPARE,
++ NFT_TRANS_ABORT,
++ NFT_TRANS_COMMIT,
++ NFT_TRANS_RELEASE
++};
++
+ /**
+ * struct nft_expr_ops - nf_tables expression operations
+ *
+ * @eval: Expression evaluation function
+ * @size: full expression size, including private data size
+ * @init: initialization function
+- * @destroy: destruction function
++ * @activate: activate expression in the next generation
++ * @deactivate: deactivate expression in next generation
++ * @destroy: destruction function, called after synchronize_rcu
+ * @dump: function to dump parameters
+ * @type: expression type
+ * @validate: validate expression, called during loop detection
+@@ -745,7 +765,8 @@ struct nft_expr_ops {
+ void (*activate)(const struct nft_ctx *ctx,
+ const struct nft_expr *expr);
+ void (*deactivate)(const struct nft_ctx *ctx,
+- const struct nft_expr *expr);
++ const struct nft_expr *expr,
++ enum nft_trans_phase phase);
+ void (*destroy)(const struct nft_ctx *ctx,
+ const struct nft_expr *expr);
+ void (*destroy_clone)(const struct nft_ctx *ctx,
+diff --git a/include/net/netrom.h b/include/net/netrom.h
+index 5a0714ff500f..80f15b1c1a48 100644
+--- a/include/net/netrom.h
++++ b/include/net/netrom.h
+@@ -266,7 +266,7 @@ void nr_stop_idletimer(struct sock *);
+ int nr_t1timer_running(struct sock *);
+
+ /* sysctl_net_netrom.c */
+-void nr_register_sysctl(void);
++int nr_register_sysctl(void);
+ void nr_unregister_sysctl(void);
+
+ #endif
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 91e4202b0634..72c07059ef37 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -252,7 +252,6 @@ static void task_non_contending(struct task_struct *p)
+ if (dl_entity_is_special(dl_se))
+ return;
+
+- WARN_ON(hrtimer_active(&dl_se->inactive_timer));
+ WARN_ON(dl_se->dl_non_contending);
+
+ zerolag_time = dl_se->deadline -
+@@ -269,7 +268,7 @@ static void task_non_contending(struct task_struct *p)
+ * If the "0-lag time" already passed, decrease the active
+ * utilization now, instead of starting a timer
+ */
+- if (zerolag_time < 0) {
++ if ((zerolag_time < 0) || hrtimer_active(&dl_se->inactive_timer)) {
+ if (dl_task(p))
+ sub_running_bw(dl_se, dl_rq);
+ if (!dl_task(p) || p->state == TASK_DEAD) {
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 4aa8e7d90c25..d31916366d39 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -2016,6 +2016,10 @@ static u64 numa_get_avg_runtime(struct task_struct *p, u64 *period)
+ if (p->last_task_numa_placement) {
+ delta = runtime - p->last_sum_exec_runtime;
+ *period = now - p->last_task_numa_placement;
++
++ /* Avoid time going backwards, prevent potential divide error: */
++ if (unlikely((s64)*period < 0))
++ *period = 0;
+ } else {
+ delta = p->se.avg.load_sum;
+ *period = LOAD_AVG_MAX;
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 34b4c32b0692..805aef83b5cf 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -730,7 +730,7 @@ u64 ring_buffer_time_stamp(struct ring_buffer *buffer, int cpu)
+
+ preempt_disable_notrace();
+ time = rb_time_stamp(buffer);
+- preempt_enable_no_resched_notrace();
++ preempt_enable_notrace();
+
+ return time;
+ }
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index c65cea71d1ee..5455ee05bc3b 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -496,8 +496,10 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
+ * not modified.
+ */
+ pid_list = kmalloc(sizeof(*pid_list), GFP_KERNEL);
+- if (!pid_list)
++ if (!pid_list) {
++ trace_parser_put(&parser);
+ return -ENOMEM;
++ }
+
+ pid_list->pid_max = READ_ONCE(pid_max);
+
+@@ -507,6 +509,7 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
+
+ pid_list->pids = vzalloc((pid_list->pid_max + 7) >> 3);
+ if (!pid_list->pids) {
++ trace_parser_put(&parser);
+ kfree(pid_list);
+ return -ENOMEM;
+ }
+@@ -6800,19 +6803,23 @@ struct buffer_ref {
+ struct ring_buffer *buffer;
+ void *page;
+ int cpu;
+- int ref;
++ refcount_t refcount;
+ };
+
++static void buffer_ref_release(struct buffer_ref *ref)
++{
++ if (!refcount_dec_and_test(&ref->refcount))
++ return;
++ ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->page);
++ kfree(ref);
++}
++
+ static void buffer_pipe_buf_release(struct pipe_inode_info *pipe,
+ struct pipe_buffer *buf)
+ {
+ struct buffer_ref *ref = (struct buffer_ref *)buf->private;
+
+- if (--ref->ref)
+- return;
+-
+- ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->page);
+- kfree(ref);
++ buffer_ref_release(ref);
+ buf->private = 0;
+ }
+
+@@ -6821,7 +6828,7 @@ static void buffer_pipe_buf_get(struct pipe_inode_info *pipe,
+ {
+ struct buffer_ref *ref = (struct buffer_ref *)buf->private;
+
+- ref->ref++;
++ refcount_inc(&ref->refcount);
+ }
+
+ /* Pipe buffer operations for a buffer. */
+@@ -6829,7 +6836,7 @@ static const struct pipe_buf_operations buffer_pipe_buf_ops = {
+ .can_merge = 0,
+ .confirm = generic_pipe_buf_confirm,
+ .release = buffer_pipe_buf_release,
+- .steal = generic_pipe_buf_steal,
++ .steal = generic_pipe_buf_nosteal,
+ .get = buffer_pipe_buf_get,
+ };
+
+@@ -6842,11 +6849,7 @@ static void buffer_spd_release(struct splice_pipe_desc *spd, unsigned int i)
+ struct buffer_ref *ref =
+ (struct buffer_ref *)spd->partial[i].private;
+
+- if (--ref->ref)
+- return;
+-
+- ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->page);
+- kfree(ref);
++ buffer_ref_release(ref);
+ spd->partial[i].private = 0;
+ }
+
+@@ -6901,7 +6904,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
+ break;
+ }
+
+- ref->ref = 1;
++ refcount_set(&ref->refcount, 1);
+ ref->buffer = iter->trace_buffer->buffer;
+ ref->page = ring_buffer_alloc_read_page(ref->buffer, iter->cpu_file);
+ if (IS_ERR(ref->page)) {
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 0280deac392e..cd8b61bded78 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -2908,6 +2908,9 @@ static bool __flush_work(struct work_struct *work, bool from_cancel)
+ if (WARN_ON(!wq_online))
+ return false;
+
++ if (WARN_ON(!work->func))
++ return false;
++
+ if (!from_cancel) {
+ lock_map_acquire(&work->lockdep_map);
+ lock_map_release(&work->lockdep_map);
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 4966c4fbe7f7..3dea52f7be9c 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -1934,6 +1934,7 @@ config TEST_KMOD
+ depends on m
+ depends on BLOCK && (64BIT || LBDAF) # for XFS, BTRFS
+ depends on NETDEVICES && NET_CORE && INET # for TUN
++ depends on BLOCK
+ select TEST_LKM
+ select XFS_FS
+ select TUN
+diff --git a/mm/memory.c b/mm/memory.c
+index 5b3f71bcd1ae..9c69278173b7 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1787,10 +1787,15 @@ static int insert_pfn(struct vm_area_struct *vma, unsigned long addr,
+ * in may not match the PFN we have mapped if the
+ * mapped PFN is a writeable COW page. In the mkwrite
+ * case we are creating a writable PTE for a shared
+- * mapping and we expect the PFNs to match.
++ * mapping and we expect the PFNs to match. If they
++ * don't match, we are likely racing with block
++ * allocation and mapping invalidation so just skip the
++ * update.
+ */
+- if (WARN_ON_ONCE(pte_pfn(*pte) != pfn_t_to_pfn(pfn)))
++ if (pte_pfn(*pte) != pfn_t_to_pfn(pfn)) {
++ WARN_ON_ONCE(!is_zero_pfn(pte_pfn(*pte)));
+ goto out_unlock;
++ }
+ entry = *pte;
+ goto out_mkwrite;
+ } else
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index f77888ec93f1..0bb4d712b80c 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2032,7 +2032,8 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
+ if (match_kern)
+ match_kern->match_size = ret;
+
+- if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))
++ /* rule should have no remaining data after target */
++ if (type == EBT_COMPAT_TARGET && size_left)
+ return -EINVAL;
+
+ match32 = (struct compat_ebt_entry_mwt *) buf;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 98c81c21b753..8bacbcd2db90 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1185,25 +1185,39 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
+ return dst;
+ }
+
+-static void ipv4_link_failure(struct sk_buff *skb)
++static void ipv4_send_dest_unreach(struct sk_buff *skb)
+ {
+ struct ip_options opt;
+- struct rtable *rt;
+ int res;
+
+ /* Recompile ip options since IPCB may not be valid anymore.
++ * Also check we have a reasonable ipv4 header.
+ */
+- memset(&opt, 0, sizeof(opt));
+- opt.optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr);
++ if (!pskb_network_may_pull(skb, sizeof(struct iphdr)) ||
++ ip_hdr(skb)->version != 4 || ip_hdr(skb)->ihl < 5)
++ return;
+
+- rcu_read_lock();
+- res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);
+- rcu_read_unlock();
++ memset(&opt, 0, sizeof(opt));
++ if (ip_hdr(skb)->ihl > 5) {
++ if (!pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4))
++ return;
++ opt.optlen = ip_hdr(skb)->ihl * 4 - sizeof(struct iphdr);
+
+- if (res)
+- return;
++ rcu_read_lock();
++ res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);
++ rcu_read_unlock();
+
++ if (res)
++ return;
++ }
+ __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt);
++}
++
++static void ipv4_link_failure(struct sk_buff *skb)
++{
++ struct rtable *rt;
++
++ ipv4_send_dest_unreach(skb);
+
+ rt = skb_rtable(skb);
+ if (rt)
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 891ed2f91467..ce64453d337d 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -49,6 +49,7 @@ static int ip_ping_group_range_min[] = { 0, 0 };
+ static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
+ static int comp_sack_nr_max = 255;
+ static u32 u32_max_div_HZ = UINT_MAX / HZ;
++static int one_day_secs = 24 * 3600;
+
+ /* obsolete */
+ static int sysctl_tcp_low_latency __read_mostly;
+@@ -1140,7 +1141,9 @@ static struct ctl_table ipv4_net_table[] = {
+ .data = &init_net.ipv4.sysctl_tcp_min_rtt_wlen,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &zero,
++ .extra2 = &one_day_secs
+ },
+ {
+ .procname = "tcp_autocorking",
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 8fd8d06454d6..2d4e048762f6 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -896,12 +896,13 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
+ {
+ struct ip_vs_dest *dest;
+ unsigned int atype, i;
+- int ret = 0;
+
+ EnterFunction(2);
+
+ #ifdef CONFIG_IP_VS_IPV6
+ if (udest->af == AF_INET6) {
++ int ret;
++
+ atype = ipv6_addr_type(&udest->addr.in6);
+ if ((!(atype & IPV6_ADDR_UNICAST) ||
+ atype & IPV6_ADDR_LINKLOCAL) &&
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index c06393fc716d..1af54119bafc 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -112,6 +112,23 @@ static void nft_trans_destroy(struct nft_trans *trans)
+ kfree(trans);
+ }
+
++static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
++{
++ struct net *net = ctx->net;
++ struct nft_trans *trans;
++
++ if (!nft_set_is_anonymous(set))
++ return;
++
++ list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
++ if (trans->msg_type == NFT_MSG_NEWSET &&
++ nft_trans_set(trans) == set) {
++ set->bound = true;
++ break;
++ }
++ }
++}
++
+ static int nf_tables_register_hook(struct net *net,
+ const struct nft_table *table,
+ struct nft_chain *chain)
+@@ -222,14 +239,15 @@ static void nft_rule_expr_activate(const struct nft_ctx *ctx,
+ }
+
+ static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
+- struct nft_rule *rule)
++ struct nft_rule *rule,
++ enum nft_trans_phase phase)
+ {
+ struct nft_expr *expr;
+
+ expr = nft_expr_first(rule);
+ while (expr != nft_expr_last(rule) && expr->ops) {
+ if (expr->ops->deactivate)
+- expr->ops->deactivate(ctx, expr);
++ expr->ops->deactivate(ctx, expr, phase);
+
+ expr = nft_expr_next(expr);
+ }
+@@ -280,7 +298,7 @@ static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
+ nft_trans_destroy(trans);
+ return err;
+ }
+- nft_rule_expr_deactivate(ctx, rule);
++ nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
+
+ return 0;
+ }
+@@ -301,7 +319,7 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx)
+ return 0;
+ }
+
+-static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
++static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
+ struct nft_set *set)
+ {
+ struct nft_trans *trans;
+@@ -321,7 +339,7 @@ static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
+ return 0;
+ }
+
+-static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
++static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
+ {
+ int err;
+
+@@ -2105,6 +2123,7 @@ struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
+ {
+ struct nft_expr_info info;
+ struct nft_expr *expr;
++ struct module *owner;
+ int err;
+
+ err = nf_tables_expr_parse(ctx, nla, &info);
+@@ -2124,7 +2143,11 @@ struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
+ err3:
+ kfree(expr);
+ err2:
+- module_put(info.ops->type->owner);
++ owner = info.ops->type->owner;
++ if (info.ops->type->release_ops)
++ info.ops->type->release_ops(info.ops);
++
++ module_put(owner);
+ err1:
+ return ERR_PTR(err);
+ }
+@@ -2458,7 +2481,7 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
+ static void nf_tables_rule_release(const struct nft_ctx *ctx,
+ struct nft_rule *rule)
+ {
+- nft_rule_expr_deactivate(ctx, rule);
++ nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
+ nf_tables_rule_destroy(ctx, rule);
+ }
+
+@@ -3562,19 +3585,15 @@ err1:
+
+ static void nft_set_destroy(struct nft_set *set)
+ {
++ if (WARN_ON(set->use > 0))
++ return;
++
+ set->ops->destroy(set);
+ module_put(to_set_type(set->ops)->owner);
+ kfree(set->name);
+ kvfree(set);
+ }
+
+-static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
+-{
+- list_del_rcu(&set->list);
+- nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
+- nft_set_destroy(set);
+-}
+-
+ static int nf_tables_delset(struct net *net, struct sock *nlsk,
+ struct sk_buff *skb, const struct nlmsghdr *nlh,
+ const struct nlattr * const nla[],
+@@ -3609,7 +3628,7 @@ static int nf_tables_delset(struct net *net, struct sock *nlsk,
+ NL_SET_BAD_ATTR(extack, attr);
+ return PTR_ERR(set);
+ }
+- if (!list_empty(&set->bindings) ||
++ if (set->use ||
+ (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
+ NL_SET_BAD_ATTR(extack, attr);
+ return -EBUSY;
+@@ -3639,6 +3658,9 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
+ struct nft_set_binding *i;
+ struct nft_set_iter iter;
+
++ if (set->use == UINT_MAX)
++ return -EOVERFLOW;
++
+ if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
+ return -EBUSY;
+
+@@ -3665,21 +3687,53 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
+ bind:
+ binding->chain = ctx->chain;
+ list_add_tail_rcu(&binding->list, &set->bindings);
++ nft_set_trans_bind(ctx, set);
++ set->use++;
++
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(nf_tables_bind_set);
+
+ void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
+- struct nft_set_binding *binding)
++ struct nft_set_binding *binding, bool event)
+ {
+ list_del_rcu(&binding->list);
+
+- if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
+- nft_is_active(ctx->net, set))
+- nf_tables_set_destroy(ctx, set);
++ if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
++ list_del_rcu(&set->list);
++ if (event)
++ nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
++ GFP_KERNEL);
++ }
+ }
+ EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
+
++void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
++ struct nft_set_binding *binding,
++ enum nft_trans_phase phase)
++{
++ switch (phase) {
++ case NFT_TRANS_PREPARE:
++ set->use--;
++ return;
++ case NFT_TRANS_ABORT:
++ case NFT_TRANS_RELEASE:
++ set->use--;
++ /* fall through */
++ default:
++ nf_tables_unbind_set(ctx, set, binding,
++ phase == NFT_TRANS_COMMIT);
++ }
++}
++EXPORT_SYMBOL_GPL(nf_tables_deactivate_set);
++
++void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
++{
++ if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
++ nft_set_destroy(set);
++}
++EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
++
+ const struct nft_set_ext_type nft_set_ext_types[] = {
+ [NFT_SET_EXT_KEY] = {
+ .align = __alignof__(u32),
+@@ -6429,6 +6483,9 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ nf_tables_rule_notify(&trans->ctx,
+ nft_trans_rule(trans),
+ NFT_MSG_DELRULE);
++ nft_rule_expr_deactivate(&trans->ctx,
++ nft_trans_rule(trans),
++ NFT_TRANS_COMMIT);
+ break;
+ case NFT_MSG_NEWSET:
+ nft_clear(net, nft_trans_set(trans));
+@@ -6577,7 +6634,9 @@ static int __nf_tables_abort(struct net *net)
+ case NFT_MSG_NEWRULE:
+ trans->ctx.chain->use--;
+ list_del_rcu(&nft_trans_rule(trans)->list);
+- nft_rule_expr_deactivate(&trans->ctx, nft_trans_rule(trans));
++ nft_rule_expr_deactivate(&trans->ctx,
++ nft_trans_rule(trans),
++ NFT_TRANS_ABORT);
+ break;
+ case NFT_MSG_DELRULE:
+ trans->ctx.chain->use++;
+@@ -6587,6 +6646,10 @@ static int __nf_tables_abort(struct net *net)
+ break;
+ case NFT_MSG_NEWSET:
+ trans->ctx.table->use--;
++ if (nft_trans_set(trans)->bound) {
++ nft_trans_destroy(trans);
++ break;
++ }
+ list_del_rcu(&nft_trans_set(trans)->list);
+ break;
+ case NFT_MSG_DELSET:
+@@ -6595,8 +6658,11 @@ static int __nf_tables_abort(struct net *net)
+ nft_trans_destroy(trans);
+ break;
+ case NFT_MSG_NEWSETELEM:
++ if (nft_trans_elem_set(trans)->bound) {
++ nft_trans_destroy(trans);
++ break;
++ }
+ te = (struct nft_trans_elem *)trans->data;
+-
+ te->set->ops->remove(net, te->set, &te->elem);
+ atomic_dec(&te->set->nelems);
+ break;
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 38da1f5436b4..1245e02239d9 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -23,19 +23,6 @@
+ #include <linux/netfilter_arp/arp_tables.h>
+ #include <net/netfilter/nf_tables.h>
+
+-struct nft_xt {
+- struct list_head head;
+- struct nft_expr_ops ops;
+- unsigned int refcnt;
+-
+- /* Unlike other expressions, ops doesn't have static storage duration.
+- * nft core assumes they do. We use kfree_rcu so that nft core can
+- * can check expr->ops->size even after nft_compat->destroy() frees
+- * the nft_xt struct that holds the ops structure.
+- */
+- struct rcu_head rcu_head;
+-};
+-
+ /* Used for matches where *info is larger than X byte */
+ #define NFT_MATCH_LARGE_THRESH 192
+
+@@ -43,17 +30,6 @@ struct nft_xt_match_priv {
+ void *info;
+ };
+
+-static bool nft_xt_put(struct nft_xt *xt)
+-{
+- if (--xt->refcnt == 0) {
+- list_del(&xt->head);
+- kfree_rcu(xt, rcu_head);
+- return true;
+- }
+-
+- return false;
+-}
+-
+ static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
+ const char *tablename)
+ {
+@@ -248,7 +224,6 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ struct xt_target *target = expr->ops->data;
+ struct xt_tgchk_param par;
+ size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));
+- struct nft_xt *nft_xt;
+ u16 proto = 0;
+ bool inv = false;
+ union nft_entry e = {};
+@@ -272,8 +247,6 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ if (!target->target)
+ return -EINVAL;
+
+- nft_xt = container_of(expr->ops, struct nft_xt, ops);
+- nft_xt->refcnt++;
+ return 0;
+ }
+
+@@ -292,8 +265,8 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+ if (par.target->destroy != NULL)
+ par.target->destroy(&par);
+
+- if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
+- module_put(me);
++ module_put(me);
++ kfree(expr->ops);
+ }
+
+ static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr)
+@@ -447,7 +420,6 @@ __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ struct xt_match *match = expr->ops->data;
+ struct xt_mtchk_param par;
+ size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));
+- struct nft_xt *nft_xt;
+ u16 proto = 0;
+ bool inv = false;
+ union nft_entry e = {};
+@@ -463,13 +435,7 @@ __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+
+ nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
+
+- ret = xt_check_match(&par, size, proto, inv);
+- if (ret < 0)
+- return ret;
+-
+- nft_xt = container_of(expr->ops, struct nft_xt, ops);
+- nft_xt->refcnt++;
+- return 0;
++ return xt_check_match(&par, size, proto, inv);
+ }
+
+ static int
+@@ -512,8 +478,8 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ if (par.match->destroy != NULL)
+ par.match->destroy(&par);
+
+- if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
+- module_put(me);
++ module_put(me);
++ kfree(expr->ops);
+ }
+
+ static void
+@@ -715,22 +681,13 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = {
+ .cb = nfnl_nft_compat_cb,
+ };
+
+-static LIST_HEAD(nft_match_list);
+-
+ static struct nft_expr_type nft_match_type;
+
+-static bool nft_match_cmp(const struct xt_match *match,
+- const char *name, u32 rev, u32 family)
+-{
+- return strcmp(match->name, name) == 0 && match->revision == rev &&
+- (match->family == NFPROTO_UNSPEC || match->family == family);
+-}
+-
+ static const struct nft_expr_ops *
+ nft_match_select_ops(const struct nft_ctx *ctx,
+ const struct nlattr * const tb[])
+ {
+- struct nft_xt *nft_match;
++ struct nft_expr_ops *ops;
+ struct xt_match *match;
+ unsigned int matchsize;
+ char *mt_name;
+@@ -746,14 +703,6 @@ nft_match_select_ops(const struct nft_ctx *ctx,
+ rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
+ family = ctx->family;
+
+- /* Re-use the existing match if it's already loaded. */
+- list_for_each_entry(nft_match, &nft_match_list, head) {
+- struct xt_match *match = nft_match->ops.data;
+-
+- if (nft_match_cmp(match, mt_name, rev, family))
+- return &nft_match->ops;
+- }
+-
+ match = xt_request_find_match(family, mt_name, rev);
+ if (IS_ERR(match))
+ return ERR_PTR(-ENOENT);
+@@ -763,66 +712,62 @@ nft_match_select_ops(const struct nft_ctx *ctx,
+ goto err;
+ }
+
+- /* This is the first time we use this match, allocate operations */
+- nft_match = kzalloc(sizeof(struct nft_xt), GFP_KERNEL);
+- if (nft_match == NULL) {
++ ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);
++ if (!ops) {
+ err = -ENOMEM;
+ goto err;
+ }
+
+- nft_match->refcnt = 0;
+- nft_match->ops.type = &nft_match_type;
+- nft_match->ops.eval = nft_match_eval;
+- nft_match->ops.init = nft_match_init;
+- nft_match->ops.destroy = nft_match_destroy;
+- nft_match->ops.dump = nft_match_dump;
+- nft_match->ops.validate = nft_match_validate;
+- nft_match->ops.data = match;
++ ops->type = &nft_match_type;
++ ops->eval = nft_match_eval;
++ ops->init = nft_match_init;
++ ops->destroy = nft_match_destroy;
++ ops->dump = nft_match_dump;
++ ops->validate = nft_match_validate;
++ ops->data = match;
+
+ matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize));
+ if (matchsize > NFT_MATCH_LARGE_THRESH) {
+ matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv));
+
+- nft_match->ops.eval = nft_match_large_eval;
+- nft_match->ops.init = nft_match_large_init;
+- nft_match->ops.destroy = nft_match_large_destroy;
+- nft_match->ops.dump = nft_match_large_dump;
++ ops->eval = nft_match_large_eval;
++ ops->init = nft_match_large_init;
++ ops->destroy = nft_match_large_destroy;
++ ops->dump = nft_match_large_dump;
+ }
+
+- nft_match->ops.size = matchsize;
+-
+- list_add(&nft_match->head, &nft_match_list);
++ ops->size = matchsize;
+
+- return &nft_match->ops;
++ return ops;
+ err:
+ module_put(match->me);
+ return ERR_PTR(err);
+ }
+
++static void nft_match_release_ops(const struct nft_expr_ops *ops)
++{
++ struct xt_match *match = ops->data;
++
++ module_put(match->me);
++ kfree(ops);
++}
++
+ static struct nft_expr_type nft_match_type __read_mostly = {
+ .name = "match",
+ .select_ops = nft_match_select_ops,
++ .release_ops = nft_match_release_ops,
+ .policy = nft_match_policy,
+ .maxattr = NFTA_MATCH_MAX,
+ .owner = THIS_MODULE,
+ };
+
+-static LIST_HEAD(nft_target_list);
+-
+ static struct nft_expr_type nft_target_type;
+
+-static bool nft_target_cmp(const struct xt_target *tg,
+- const char *name, u32 rev, u32 family)
+-{
+- return strcmp(tg->name, name) == 0 && tg->revision == rev &&
+- (tg->family == NFPROTO_UNSPEC || tg->family == family);
+-}
+-
+ static const struct nft_expr_ops *
+ nft_target_select_ops(const struct nft_ctx *ctx,
+ const struct nlattr * const tb[])
+ {
+- struct nft_xt *nft_target;
++ struct nft_expr_ops *ops;
+ struct xt_target *target;
+ char *tg_name;
+ u32 rev, family;
+@@ -842,17 +787,6 @@ nft_target_select_ops(const struct nft_ctx *ctx,
+ strcmp(tg_name, "standard") == 0)
+ return ERR_PTR(-EINVAL);
+
+- /* Re-use the existing target if it's already loaded. */
+- list_for_each_entry(nft_target, &nft_target_list, head) {
+- struct xt_target *target = nft_target->ops.data;
+-
+- if (!target->target)
+- continue;
+-
+- if (nft_target_cmp(target, tg_name, rev, family))
+- return &nft_target->ops;
+- }
+-
+ target = xt_request_find_target(family, tg_name, rev);
+ if (IS_ERR(target))
+ return ERR_PTR(-ENOENT);
+@@ -867,38 +801,43 @@ nft_target_select_ops(const struct nft_ctx *ctx,
+ goto err;
+ }
+
+- /* This is the first time we use this target, allocate operations */
+- nft_target = kzalloc(sizeof(struct nft_xt), GFP_KERNEL);
+- if (nft_target == NULL) {
++ ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);
++ if (!ops) {
+ err = -ENOMEM;
+ goto err;
+ }
+
+- nft_target->refcnt = 0;
+- nft_target->ops.type = &nft_target_type;
+- nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
+- nft_target->ops.init = nft_target_init;
+- nft_target->ops.destroy = nft_target_destroy;
+- nft_target->ops.dump = nft_target_dump;
+- nft_target->ops.validate = nft_target_validate;
+- nft_target->ops.data = target;
++ ops->type = &nft_target_type;
++ ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
++ ops->init = nft_target_init;
++ ops->destroy = nft_target_destroy;
++ ops->dump = nft_target_dump;
++ ops->validate = nft_target_validate;
++ ops->data = target;
+
+ if (family == NFPROTO_BRIDGE)
+- nft_target->ops.eval = nft_target_eval_bridge;
++ ops->eval = nft_target_eval_bridge;
+ else
+- nft_target->ops.eval = nft_target_eval_xt;
+-
+- list_add(&nft_target->head, &nft_target_list);
++ ops->eval = nft_target_eval_xt;
+
+- return &nft_target->ops;
++ return ops;
+ err:
+ module_put(target->me);
+ return ERR_PTR(err);
+ }
+
++static void nft_target_release_ops(const struct nft_expr_ops *ops)
++{
++ struct xt_target *target = ops->data;
++
++ module_put(target->me);
++ kfree(ops);
++}
++
+ static struct nft_expr_type nft_target_type __read_mostly = {
+ .name = "target",
+ .select_ops = nft_target_select_ops,
++ .release_ops = nft_target_release_ops,
+ .policy = nft_target_policy,
+ .maxattr = NFTA_TARGET_MAX,
+ .owner = THIS_MODULE,
+@@ -923,7 +862,6 @@ static int __init nft_compat_module_init(void)
+ }
+
+ return ret;
+-
+ err_target:
+ nft_unregister_expr(&nft_target_type);
+ err_match:
+@@ -933,32 +871,6 @@ err_match:
+
+ static void __exit nft_compat_module_exit(void)
+ {
+- struct nft_xt *xt, *next;
+-
+- /* list should be empty here, it can be non-empty only in case there
+- * was an error that caused nft_xt expr to not be initialized fully
+- * and noone else requested the same expression later.
+- *
+- * In this case, the lists contain 0-refcount entries that still
+- * hold module reference.
+- */
+- list_for_each_entry_safe(xt, next, &nft_target_list, head) {
+- struct xt_target *target = xt->ops.data;
+-
+- if (WARN_ON_ONCE(xt->refcnt))
+- continue;
+- module_put(target->me);
+- kfree(xt);
+- }
+-
+- list_for_each_entry_safe(xt, next, &nft_match_list, head) {
+- struct xt_match *match = xt->ops.data;
+-
+- if (WARN_ON_ONCE(xt->refcnt))
+- continue;
+- module_put(match->me);
+- kfree(xt);
+- }
+ nfnetlink_subsys_unregister(&nfnl_compat_subsys);
+ nft_unregister_expr(&nft_target_type);
+ nft_unregister_expr(&nft_match_type);
+diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
+index 6e91a37d57f2..eb7f9a5f2aeb 100644
+--- a/net/netfilter/nft_dynset.c
++++ b/net/netfilter/nft_dynset.c
+@@ -235,14 +235,32 @@ err1:
+ return err;
+ }
+
++static void nft_dynset_deactivate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr,
++ enum nft_trans_phase phase)
++{
++ struct nft_dynset *priv = nft_expr_priv(expr);
++
++ nf_tables_deactivate_set(ctx, priv->set, &priv->binding, phase);
++}
++
++static void nft_dynset_activate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ struct nft_dynset *priv = nft_expr_priv(expr);
++
++ priv->set->use++;
++}
++
+ static void nft_dynset_destroy(const struct nft_ctx *ctx,
+ const struct nft_expr *expr)
+ {
+ struct nft_dynset *priv = nft_expr_priv(expr);
+
+- nf_tables_unbind_set(ctx, priv->set, &priv->binding);
+ if (priv->expr != NULL)
+ nft_expr_destroy(ctx, priv->expr);
++
++ nf_tables_destroy_set(ctx, priv->set);
+ }
+
+ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr)
+@@ -279,6 +297,8 @@ static const struct nft_expr_ops nft_dynset_ops = {
+ .eval = nft_dynset_eval,
+ .init = nft_dynset_init,
+ .destroy = nft_dynset_destroy,
++ .activate = nft_dynset_activate,
++ .deactivate = nft_dynset_deactivate,
+ .dump = nft_dynset_dump,
+ };
+
+diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
+index 0777a93211e2..3f6d1d2a6281 100644
+--- a/net/netfilter/nft_immediate.c
++++ b/net/netfilter/nft_immediate.c
+@@ -72,10 +72,14 @@ static void nft_immediate_activate(const struct nft_ctx *ctx,
+ }
+
+ static void nft_immediate_deactivate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr)
++ const struct nft_expr *expr,
++ enum nft_trans_phase phase)
+ {
+ const struct nft_immediate_expr *priv = nft_expr_priv(expr);
+
++ if (phase == NFT_TRANS_COMMIT)
++ return;
++
+ return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg));
+ }
+
+diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
+index ad13e8643599..161c3451a747 100644
+--- a/net/netfilter/nft_lookup.c
++++ b/net/netfilter/nft_lookup.c
+@@ -121,12 +121,29 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
+ return 0;
+ }
+
++static void nft_lookup_deactivate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr,
++ enum nft_trans_phase phase)
++{
++ struct nft_lookup *priv = nft_expr_priv(expr);
++
++ nf_tables_deactivate_set(ctx, priv->set, &priv->binding, phase);
++}
++
++static void nft_lookup_activate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ struct nft_lookup *priv = nft_expr_priv(expr);
++
++ priv->set->use++;
++}
++
+ static void nft_lookup_destroy(const struct nft_ctx *ctx,
+ const struct nft_expr *expr)
+ {
+ struct nft_lookup *priv = nft_expr_priv(expr);
+
+- nf_tables_unbind_set(ctx, priv->set, &priv->binding);
++ nf_tables_destroy_set(ctx, priv->set);
+ }
+
+ static int nft_lookup_dump(struct sk_buff *skb, const struct nft_expr *expr)
+@@ -209,6 +226,8 @@ static const struct nft_expr_ops nft_lookup_ops = {
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_lookup)),
+ .eval = nft_lookup_eval,
+ .init = nft_lookup_init,
++ .activate = nft_lookup_activate,
++ .deactivate = nft_lookup_deactivate,
+ .destroy = nft_lookup_destroy,
+ .dump = nft_lookup_dump,
+ .validate = nft_lookup_validate,
+diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
+index cdf348f751ec..bf92a40dd1b2 100644
+--- a/net/netfilter/nft_objref.c
++++ b/net/netfilter/nft_objref.c
+@@ -64,21 +64,34 @@ nla_put_failure:
+ return -1;
+ }
+
+-static void nft_objref_destroy(const struct nft_ctx *ctx,
+- const struct nft_expr *expr)
++static void nft_objref_deactivate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr,
++ enum nft_trans_phase phase)
+ {
+ struct nft_object *obj = nft_objref_priv(expr);
+
++ if (phase == NFT_TRANS_COMMIT)
++ return;
++
+ obj->use--;
+ }
+
++static void nft_objref_activate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ struct nft_object *obj = nft_objref_priv(expr);
++
++ obj->use++;
++}
++
+ static struct nft_expr_type nft_objref_type;
+ static const struct nft_expr_ops nft_objref_ops = {
+ .type = &nft_objref_type,
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_object *)),
+ .eval = nft_objref_eval,
+ .init = nft_objref_init,
+- .destroy = nft_objref_destroy,
++ .activate = nft_objref_activate,
++ .deactivate = nft_objref_deactivate,
+ .dump = nft_objref_dump,
+ };
+
+@@ -155,12 +168,29 @@ nla_put_failure:
+ return -1;
+ }
+
++static void nft_objref_map_deactivate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr,
++ enum nft_trans_phase phase)
++{
++ struct nft_objref_map *priv = nft_expr_priv(expr);
++
++ nf_tables_deactivate_set(ctx, priv->set, &priv->binding, phase);
++}
++
++static void nft_objref_map_activate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ struct nft_objref_map *priv = nft_expr_priv(expr);
++
++ priv->set->use++;
++}
++
+ static void nft_objref_map_destroy(const struct nft_ctx *ctx,
+ const struct nft_expr *expr)
+ {
+ struct nft_objref_map *priv = nft_expr_priv(expr);
+
+- nf_tables_unbind_set(ctx, priv->set, &priv->binding);
++ nf_tables_destroy_set(ctx, priv->set);
+ }
+
+ static struct nft_expr_type nft_objref_type;
+@@ -169,6 +199,8 @@ static const struct nft_expr_ops nft_objref_map_ops = {
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_objref_map)),
+ .eval = nft_objref_map_eval,
+ .init = nft_objref_map_init,
++ .activate = nft_objref_map_activate,
++ .deactivate = nft_objref_map_deactivate,
+ .destroy = nft_objref_map_destroy,
+ .dump = nft_objref_map_dump,
+ };
+diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
+index 1d3144d19903..71ffd1a6dc7c 100644
+--- a/net/netrom/af_netrom.c
++++ b/net/netrom/af_netrom.c
+@@ -1392,18 +1392,22 @@ static int __init nr_proto_init(void)
+ int i;
+ int rc = proto_register(&nr_proto, 0);
+
+- if (rc != 0)
+- goto out;
++ if (rc)
++ return rc;
+
+ if (nr_ndevs > 0x7fffffff/sizeof(struct net_device *)) {
+- printk(KERN_ERR "NET/ROM: nr_proto_init - nr_ndevs parameter to large\n");
+- return -1;
++ pr_err("NET/ROM: %s - nr_ndevs parameter too large\n",
++ __func__);
++ rc = -EINVAL;
++ goto unregister_proto;
+ }
+
+ dev_nr = kcalloc(nr_ndevs, sizeof(struct net_device *), GFP_KERNEL);
+- if (dev_nr == NULL) {
+- printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device array\n");
+- return -1;
++ if (!dev_nr) {
++ pr_err("NET/ROM: %s - unable to allocate device array\n",
++ __func__);
++ rc = -ENOMEM;
++ goto unregister_proto;
+ }
+
+ for (i = 0; i < nr_ndevs; i++) {
+@@ -1413,13 +1417,13 @@ static int __init nr_proto_init(void)
+ sprintf(name, "nr%d", i);
+ dev = alloc_netdev(0, name, NET_NAME_UNKNOWN, nr_setup);
+ if (!dev) {
+- printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device structure\n");
++ rc = -ENOMEM;
+ goto fail;
+ }
+
+ dev->base_addr = i;
+- if (register_netdev(dev)) {
+- printk(KERN_ERR "NET/ROM: nr_proto_init - unable to register network device\n");
++ rc = register_netdev(dev);
++ if (rc) {
+ free_netdev(dev);
+ goto fail;
+ }
+@@ -1427,36 +1431,64 @@ static int __init nr_proto_init(void)
+ dev_nr[i] = dev;
+ }
+
+- if (sock_register(&nr_family_ops)) {
+- printk(KERN_ERR "NET/ROM: nr_proto_init - unable to register socket family\n");
++ rc = sock_register(&nr_family_ops);
++ if (rc)
+ goto fail;
+- }
+
+- register_netdevice_notifier(&nr_dev_notifier);
++ rc = register_netdevice_notifier(&nr_dev_notifier);
++ if (rc)
++ goto out_sock;
+
+ ax25_register_pid(&nr_pid);
+ ax25_linkfail_register(&nr_linkfail_notifier);
+
+ #ifdef CONFIG_SYSCTL
+- nr_register_sysctl();
++ rc = nr_register_sysctl();
++ if (rc)
++ goto out_sysctl;
+ #endif
+
+ nr_loopback_init();
+
+- proc_create_seq("nr", 0444, init_net.proc_net, &nr_info_seqops);
+- proc_create_seq("nr_neigh", 0444, init_net.proc_net, &nr_neigh_seqops);
+- proc_create_seq("nr_nodes", 0444, init_net.proc_net, &nr_node_seqops);
+-out:
+- return rc;
++ rc = -ENOMEM;
++ if (!proc_create_seq("nr", 0444, init_net.proc_net, &nr_info_seqops))
++ goto proc_remove1;
++ if (!proc_create_seq("nr_neigh", 0444, init_net.proc_net,
++ &nr_neigh_seqops))
++ goto proc_remove2;
++ if (!proc_create_seq("nr_nodes", 0444, init_net.proc_net,
++ &nr_node_seqops))
++ goto proc_remove3;
++
++ return 0;
++
++proc_remove3:
++ remove_proc_entry("nr_neigh", init_net.proc_net);
++proc_remove2:
++ remove_proc_entry("nr", init_net.proc_net);
++proc_remove1:
++
++ nr_loopback_clear();
++ nr_rt_free();
++
++#ifdef CONFIG_SYSCTL
++ nr_unregister_sysctl();
++out_sysctl:
++#endif
++ ax25_linkfail_release(&nr_linkfail_notifier);
++ ax25_protocol_release(AX25_P_NETROM);
++ unregister_netdevice_notifier(&nr_dev_notifier);
++out_sock:
++ sock_unregister(PF_NETROM);
+ fail:
+ while (--i >= 0) {
+ unregister_netdev(dev_nr[i]);
+ free_netdev(dev_nr[i]);
+ }
+ kfree(dev_nr);
++unregister_proto:
+ proto_unregister(&nr_proto);
+- rc = -1;
+- goto out;
++ return rc;
+ }
+
+ module_init(nr_proto_init);
+diff --git a/net/netrom/nr_loopback.c b/net/netrom/nr_loopback.c
+index 215ad22a9647..93d13f019981 100644
+--- a/net/netrom/nr_loopback.c
++++ b/net/netrom/nr_loopback.c
+@@ -70,7 +70,7 @@ static void nr_loopback_timer(struct timer_list *unused)
+ }
+ }
+
+-void __exit nr_loopback_clear(void)
++void nr_loopback_clear(void)
+ {
+ del_timer_sync(&loopback_timer);
+ skb_queue_purge(&loopback_queue);
+diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
+index 6485f593e2f0..b76aa668a94b 100644
+--- a/net/netrom/nr_route.c
++++ b/net/netrom/nr_route.c
+@@ -953,7 +953,7 @@ const struct seq_operations nr_neigh_seqops = {
+ /*
+ * Free all memory associated with the nodes and routes lists.
+ */
+-void __exit nr_rt_free(void)
++void nr_rt_free(void)
+ {
+ struct nr_neigh *s = NULL;
+ struct nr_node *t = NULL;
+diff --git a/net/netrom/sysctl_net_netrom.c b/net/netrom/sysctl_net_netrom.c
+index ba1c368b3f18..771011b84270 100644
+--- a/net/netrom/sysctl_net_netrom.c
++++ b/net/netrom/sysctl_net_netrom.c
+@@ -146,9 +146,12 @@ static struct ctl_table nr_table[] = {
+ { }
+ };
+
+-void __init nr_register_sysctl(void)
++int __init nr_register_sysctl(void)
+ {
+ nr_table_header = register_net_sysctl(&init_net, "net/netrom", nr_table);
++ if (!nr_table_header)
++ return -ENOMEM;
++ return 0;
+ }
+
+ void nr_unregister_sysctl(void)
+diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
+index 65387e1e6964..cd7e01ea8144 100644
+--- a/net/rds/af_rds.c
++++ b/net/rds/af_rds.c
+@@ -506,6 +506,9 @@ static int rds_connect(struct socket *sock, struct sockaddr *uaddr,
+ struct rds_sock *rs = rds_sk_to_rs(sk);
+ int ret = 0;
+
++ if (addr_len < offsetofend(struct sockaddr, sa_family))
++ return -EINVAL;
++
+ lock_sock(sk);
+
+ switch (uaddr->sa_family) {
+diff --git a/net/rds/bind.c b/net/rds/bind.c
+index 17c9d9f0c848..0f4398e7f2a7 100644
+--- a/net/rds/bind.c
++++ b/net/rds/bind.c
+@@ -173,6 +173,8 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ /* We allow an RDS socket to be bound to either IPv4 or IPv6
+ * address.
+ */
++ if (addr_len < offsetofend(struct sockaddr, sa_family))
++ return -EINVAL;
+ if (uaddr->sa_family == AF_INET) {
+ struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
+
+diff --git a/net/rds/ib_fmr.c b/net/rds/ib_fmr.c
+index e0f70c4051b6..01e764f8f224 100644
+--- a/net/rds/ib_fmr.c
++++ b/net/rds/ib_fmr.c
+@@ -44,6 +44,17 @@ struct rds_ib_mr *rds_ib_alloc_fmr(struct rds_ib_device *rds_ibdev, int npages)
+ else
+ pool = rds_ibdev->mr_1m_pool;
+
++ if (atomic_read(&pool->dirty_count) >= pool->max_items / 10)
++ queue_delayed_work(rds_ib_mr_wq, &pool->flush_worker, 10);
++
++ /* Switch pools if one of the pool is reaching upper limit */
++ if (atomic_read(&pool->dirty_count) >= pool->max_items * 9 / 10) {
++ if (pool->pool_type == RDS_IB_MR_8K_POOL)
++ pool = rds_ibdev->mr_1m_pool;
++ else
++ pool = rds_ibdev->mr_8k_pool;
++ }
++
+ ibmr = rds_ib_try_reuse_ibmr(pool);
+ if (ibmr)
+ return ibmr;
+diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
+index 63c8d107adcf..d664e9ade74d 100644
+--- a/net/rds/ib_rdma.c
++++ b/net/rds/ib_rdma.c
+@@ -454,9 +454,6 @@ struct rds_ib_mr *rds_ib_try_reuse_ibmr(struct rds_ib_mr_pool *pool)
+ struct rds_ib_mr *ibmr = NULL;
+ int iter = 0;
+
+- if (atomic_read(&pool->dirty_count) >= pool->max_items_soft / 10)
+- queue_delayed_work(rds_ib_mr_wq, &pool->flush_worker, 10);
+-
+ while (1) {
+ ibmr = rds_ib_reuse_mr(pool);
+ if (ibmr)
+diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
+index 7af4f99c4a93..094a6621f8e8 100644
+--- a/net/rose/rose_loopback.c
++++ b/net/rose/rose_loopback.c
+@@ -16,6 +16,7 @@
+ #include <linux/init.h>
+
+ static struct sk_buff_head loopback_queue;
++#define ROSE_LOOPBACK_LIMIT 1000
+ static struct timer_list loopback_timer;
+
+ static void rose_set_loopback_timer(void);
+@@ -35,29 +36,27 @@ static int rose_loopback_running(void)
+
+ int rose_loopback_queue(struct sk_buff *skb, struct rose_neigh *neigh)
+ {
+- struct sk_buff *skbn;
++ struct sk_buff *skbn = NULL;
+
+- skbn = skb_clone(skb, GFP_ATOMIC);
++ if (skb_queue_len(&loopback_queue) < ROSE_LOOPBACK_LIMIT)
++ skbn = skb_clone(skb, GFP_ATOMIC);
+
+- kfree_skb(skb);
+-
+- if (skbn != NULL) {
++ if (skbn) {
++ consume_skb(skb);
+ skb_queue_tail(&loopback_queue, skbn);
+
+ if (!rose_loopback_running())
+ rose_set_loopback_timer();
++ } else {
++ kfree_skb(skb);
+ }
+
+ return 1;
+ }
+
+-
+ static void rose_set_loopback_timer(void)
+ {
+- del_timer(&loopback_timer);
+-
+- loopback_timer.expires = jiffies + 10;
+- add_timer(&loopback_timer);
++ mod_timer(&loopback_timer, jiffies + 10);
+ }
+
+ static void rose_loopback_timer(struct timer_list *unused)
+@@ -68,8 +67,12 @@ static void rose_loopback_timer(struct timer_list *unused)
+ struct sock *sk;
+ unsigned short frametype;
+ unsigned int lci_i, lci_o;
++ int count;
+
+- while ((skb = skb_dequeue(&loopback_queue)) != NULL) {
++ for (count = 0; count < ROSE_LOOPBACK_LIMIT; count++) {
++ skb = skb_dequeue(&loopback_queue);
++ if (!skb)
++ return;
+ if (skb->len < ROSE_MIN_LEN) {
+ kfree_skb(skb);
+ continue;
+@@ -106,6 +109,8 @@ static void rose_loopback_timer(struct timer_list *unused)
+ kfree_skb(skb);
+ }
+ }
++ if (!skb_queue_empty(&loopback_queue))
++ mod_timer(&loopback_timer, jiffies + 1);
+ }
+
+ void __exit rose_loopback_clear(void)
+diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
+index 570b49d2da42..d591f54cb91f 100644
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -1155,19 +1155,19 @@ int rxrpc_extract_header(struct rxrpc_skb_priv *sp, struct sk_buff *skb)
+ * handle data received on the local endpoint
+ * - may be called in interrupt context
+ *
+- * The socket is locked by the caller and this prevents the socket from being
+- * shut down and the local endpoint from going away, thus sk_user_data will not
+- * be cleared until this function returns.
++ * [!] Note that as this is called from the encap_rcv hook, the socket is not
++ * held locked by the caller and nothing prevents sk_user_data on the UDP from
++ * being cleared in the middle of processing this function.
+ *
+ * Called with the RCU read lock held from the IP layer via UDP.
+ */
+ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
+ {
++ struct rxrpc_local *local = rcu_dereference_sk_user_data(udp_sk);
+ struct rxrpc_connection *conn;
+ struct rxrpc_channel *chan;
+ struct rxrpc_call *call = NULL;
+ struct rxrpc_skb_priv *sp;
+- struct rxrpc_local *local = udp_sk->sk_user_data;
+ struct rxrpc_peer *peer = NULL;
+ struct rxrpc_sock *rx = NULL;
+ unsigned int channel;
+@@ -1175,6 +1175,10 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
+
+ _enter("%p", udp_sk);
+
++ if (unlikely(!local)) {
++ kfree_skb(skb);
++ return 0;
++ }
+ if (skb->tstamp == 0)
+ skb->tstamp = ktime_get_real();
+
+diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
+index 0906e51d3cfb..10317dbdab5f 100644
+--- a/net/rxrpc/local_object.c
++++ b/net/rxrpc/local_object.c
+@@ -304,7 +304,8 @@ nomem:
+ ret = -ENOMEM;
+ sock_error:
+ mutex_unlock(&rxnet->local_mutex);
+- kfree(local);
++ if (local)
++ call_rcu(&local->rcu, rxrpc_local_rcu);
+ _leave(" = %d", ret);
+ return ERR_PTR(ret);
+
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index b6e8eccf2a52..214440c5b14e 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -54,6 +54,7 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail)
+ h->last_refresh = now;
+ }
+
++static inline int cache_is_valid(struct cache_head *h);
+ static void cache_fresh_locked(struct cache_head *head, time_t expiry,
+ struct cache_detail *detail);
+ static void cache_fresh_unlocked(struct cache_head *head,
+@@ -100,6 +101,8 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
+ if (cache_is_expired(detail, tmp)) {
+ hlist_del_init(&tmp->cache_list);
+ detail->entries --;
++ if (cache_is_valid(tmp) == -EAGAIN)
++ set_bit(CACHE_NEGATIVE, &tmp->flags);
+ cache_fresh_locked(tmp, 0, detail);
+ freeme = tmp;
+ break;
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 0b21187d74df..588d5aa14c41 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -267,8 +267,14 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
+ if (msg->rep_type)
+ tipc_tlv_init(msg->rep, msg->rep_type);
+
+- if (cmd->header)
+- (*cmd->header)(msg);
++ if (cmd->header) {
++ err = (*cmd->header)(msg);
++ if (err) {
++ kfree_skb(msg->rep);
++ msg->rep = NULL;
++ return err;
++ }
++ }
+
+ arg = nlmsg_new(0, GFP_KERNEL);
+ if (!arg) {
+@@ -397,7 +403,12 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd,
+ if (!bearer)
+ return -EMSGSIZE;
+
+- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
++ len = TLV_GET_DATA_LEN(msg->req);
++ len -= offsetof(struct tipc_bearer_config, name);
++ if (len <= 0)
++ return -EINVAL;
++
++ len = min_t(int, len, TIPC_MAX_BEARER_NAME);
+ if (!string_is_valid(b->name, len))
+ return -EINVAL;
+
+@@ -766,7 +777,12 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd,
+
+ lc = (struct tipc_link_config *)TLV_DATA(msg->req);
+
+- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
++ len = TLV_GET_DATA_LEN(msg->req);
++ len -= offsetof(struct tipc_link_config, name);
++ if (len <= 0)
++ return -EINVAL;
++
++ len = min_t(int, len, TIPC_MAX_LINK_NAME);
+ if (!string_is_valid(lc->name, len))
+ return -EINVAL;
+
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index 961b07d4d41c..c9588b682db4 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -874,7 +874,9 @@ int tls_set_device_offload_rx(struct sock *sk, struct tls_context *ctx)
+ goto release_netdev;
+
+ free_sw_resources:
++ up_read(&device_offload_lock);
+ tls_sw_free_resources_rx(sk);
++ down_read(&device_offload_lock);
+ release_ctx:
+ ctx->priv_ctx_rx = NULL;
+ release_netdev:
+@@ -909,8 +911,6 @@ void tls_device_offload_cleanup_rx(struct sock *sk)
+ }
+ out:
+ up_read(&device_offload_lock);
+- kfree(tls_ctx->rx.rec_seq);
+- kfree(tls_ctx->rx.iv);
+ tls_sw_release_resources_rx(sk);
+ }
+
+diff --git a/net/tls/tls_device_fallback.c b/net/tls/tls_device_fallback.c
+index 450a6dbc5a88..ef8934fd8698 100644
+--- a/net/tls/tls_device_fallback.c
++++ b/net/tls/tls_device_fallback.c
+@@ -193,6 +193,9 @@ static void update_chksum(struct sk_buff *skb, int headln)
+
+ static void complete_skb(struct sk_buff *nskb, struct sk_buff *skb, int headln)
+ {
++ struct sock *sk = skb->sk;
++ int delta;
++
+ skb_copy_header(nskb, skb);
+
+ skb_put(nskb, skb->len);
+@@ -200,11 +203,15 @@ static void complete_skb(struct sk_buff *nskb, struct sk_buff *skb, int headln)
+ update_chksum(nskb, headln);
+
+ nskb->destructor = skb->destructor;
+- nskb->sk = skb->sk;
++ nskb->sk = sk;
+ skb->destructor = NULL;
+ skb->sk = NULL;
+- refcount_add(nskb->truesize - skb->truesize,
+- &nskb->sk->sk_wmem_alloc);
++
++ delta = nskb->truesize - skb->truesize;
++ if (likely(delta < 0))
++ WARN_ON_ONCE(refcount_sub_and_test(-delta, &sk->sk_wmem_alloc));
++ else if (delta)
++ refcount_add(delta, &sk->sk_wmem_alloc);
+ }
+
+ /* This function may be called after the user socket is already
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index a091c03abcb2..25b3fb585777 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -290,11 +290,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
+ tls_sw_free_resources_tx(sk);
+ }
+
+- if (ctx->rx_conf == TLS_SW) {
+- kfree(ctx->rx.rec_seq);
+- kfree(ctx->rx.iv);
++ if (ctx->rx_conf == TLS_SW)
+ tls_sw_free_resources_rx(sk);
+- }
+
+ #ifdef CONFIG_TLS_DEVICE
+ if (ctx->rx_conf == TLS_HW)
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index b9c6ecfbcfea..6848a8196711 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -1118,6 +1118,9 @@ void tls_sw_release_resources_rx(struct sock *sk)
+ struct tls_context *tls_ctx = tls_get_ctx(sk);
+ struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
+
++ kfree(tls_ctx->rx.rec_seq);
++ kfree(tls_ctx->rx.iv);
++
+ if (ctx->aead_recv) {
+ kfree_skb(ctx->recv_pkt);
+ ctx->recv_pkt = NULL;
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 3ae3a33da70b..602715fc9a75 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -662,6 +662,8 @@ static int virtio_transport_reset(struct vsock_sock *vsk,
+ */
+ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt)
+ {
++ const struct virtio_transport *t;
++ struct virtio_vsock_pkt *reply;
+ struct virtio_vsock_pkt_info info = {
+ .op = VIRTIO_VSOCK_OP_RST,
+ .type = le16_to_cpu(pkt->hdr.type),
+@@ -672,15 +674,21 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt)
+ if (le16_to_cpu(pkt->hdr.op) == VIRTIO_VSOCK_OP_RST)
+ return 0;
+
+- pkt = virtio_transport_alloc_pkt(&info, 0,
+- le64_to_cpu(pkt->hdr.dst_cid),
+- le32_to_cpu(pkt->hdr.dst_port),
+- le64_to_cpu(pkt->hdr.src_cid),
+- le32_to_cpu(pkt->hdr.src_port));
+- if (!pkt)
++ reply = virtio_transport_alloc_pkt(&info, 0,
++ le64_to_cpu(pkt->hdr.dst_cid),
++ le32_to_cpu(pkt->hdr.dst_port),
++ le64_to_cpu(pkt->hdr.src_cid),
++ le32_to_cpu(pkt->hdr.src_port));
++ if (!reply)
+ return -ENOMEM;
+
+- return virtio_transport_get_ops()->send_pkt(pkt);
++ t = virtio_transport_get_ops();
++ if (!t) {
++ virtio_transport_free_pkt(reply);
++ return -ENOTCONN;
++ }
++
++ return t->send_pkt(reply);
+ }
+
+ static void virtio_transport_wait_close(struct sock *sk, long timeout)
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 80f73810b21b..0436789e7cd8 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -7394,8 +7394,10 @@ static void ca0132_free(struct hda_codec *codec)
+ ca0132_exit_chip(codec);
+
+ snd_hda_power_down(codec);
+- if (IS_ENABLED(CONFIG_PCI) && spec->mem_base)
++#ifdef CONFIG_PCI
++ if (spec->mem_base)
+ pci_iounmap(codec->bus->pci, spec->mem_base);
++#endif
+ kfree(spec->spec_init_verbs);
+ kfree(codec->spec);
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-05-04 18:28 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-05-04 18:28 UTC (permalink / raw
To: gentoo-commits
commit: c517b4f40cdffe3448eec0d4930009ae0d6b416f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat May 4 18:28:20 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat May 4 18:28:20 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c517b4f4
Linux patch 4.19.39
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1038_linux-4.19.39.patch | 2295 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2299 insertions(+)
diff --git a/0000_README b/0000_README
index ad3e29c..be92968 100644
--- a/0000_README
+++ b/0000_README
@@ -195,6 +195,10 @@ Patch: 1037_linux-4.19.38.patch
From: http://www.kernel.org
Desc: Linux 4.19.38
+Patch: 1038_linux-4.19.39.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.39
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1038_linux-4.19.39.patch b/1038_linux-4.19.39.patch
new file mode 100644
index 0000000..489af44
--- /dev/null
+++ b/1038_linux-4.19.39.patch
@@ -0,0 +1,2295 @@
+diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
+index d1ee484a787d..ee9984f35868 100644
+--- a/Documentation/i2c/busses/i2c-i801
++++ b/Documentation/i2c/busses/i2c-i801
+@@ -36,6 +36,7 @@ Supported adapters:
+ * Intel Cannon Lake (PCH)
+ * Intel Cedar Fork (PCH)
+ * Intel Ice Lake (PCH)
++ * Intel Comet Lake (PCH)
+ Datasheets: Publicly available at the Intel website
+
+ On Intel Patsburg and later chipsets, both the normal host SMBus controller
+diff --git a/Makefile b/Makefile
+index 14d4aeb48907..be1bd297bca9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 38
++SUBLEVEL = 39
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index cd4c74daf71e..51794c7fa6d5 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -612,6 +612,7 @@ config ARCH_DAVINCI
+ select HAVE_IDE
+ select PM_GENERIC_DOMAINS if PM
+ select PM_GENERIC_DOMAINS_OF if PM && OF
++ select REGMAP_MMIO
+ select RESET_CONTROLLER
+ select USE_OF
+ select ZONE_DMA
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
+index 5641d162dfdb..28e7513ce617 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
+@@ -93,7 +93,7 @@
+ };
+
+ &hdmi {
+- hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
++ hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
+ };
+
+ &pwm {
+diff --git a/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi b/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi
+index acc3b11fba2a..cde3025d9603 100644
+--- a/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-icore-rqs.dtsi
+@@ -298,7 +298,7 @@
+ pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
+ vmcc-supply = <®_sd3_vmmc>;
+ cd-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>;
+- bus-witdh = <4>;
++ bus-width = <4>;
+ no-1-8-v;
+ status = "okay";
+ };
+@@ -309,7 +309,7 @@
+ pinctrl-1 = <&pinctrl_usdhc4_100mhz>;
+ pinctrl-2 = <&pinctrl_usdhc4_200mhz>;
+ vmcc-supply = <®_sd4_vmmc>;
+- bus-witdh = <8>;
++ bus-width = <8>;
+ no-1-8-v;
+ non-removable;
+ status = "okay";
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+index ed1aafd56973..fe4e89d773f5 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+@@ -89,6 +89,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_enet>;
+ phy-mode = "rgmii";
++ phy-reset-duration = <10>; /* in msecs */
+ phy-reset-gpios = <&gpio3 23 GPIO_ACTIVE_LOW>;
+ phy-supply = <&vdd_eth_io_reg>;
+ status = "disabled";
+diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
+index 265ea9cf7df7..523c499e42db 100644
+--- a/arch/arm/include/asm/kvm_mmu.h
++++ b/arch/arm/include/asm/kvm_mmu.h
+@@ -317,6 +317,17 @@ static inline int kvm_read_guest_lock(struct kvm *kvm,
+ return ret;
+ }
+
++static inline int kvm_write_guest_lock(struct kvm *kvm, gpa_t gpa,
++ const void *data, unsigned long len)
++{
++ int srcu_idx = srcu_read_lock(&kvm->srcu);
++ int ret = kvm_write_guest(kvm, gpa, data, len);
++
++ srcu_read_unlock(&kvm->srcu, srcu_idx);
++
++ return ret;
++}
++
+ static inline void *kvm_get_hyp_vector(void)
+ {
+ switch(read_cpuid_part()) {
+diff --git a/arch/arm/mach-imx/mach-imx51.c b/arch/arm/mach-imx/mach-imx51.c
+index c7169c2f94c4..08c7892866c2 100644
+--- a/arch/arm/mach-imx/mach-imx51.c
++++ b/arch/arm/mach-imx/mach-imx51.c
+@@ -59,6 +59,7 @@ static void __init imx51_m4if_setup(void)
+ return;
+
+ m4if_base = of_iomap(np, 0);
++ of_node_put(np);
+ if (!m4if_base) {
+ pr_err("Unable to map M4IF registers\n");
+ return;
+diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
+index d6fff7de5539..b2558447c67d 100644
+--- a/arch/arm64/include/asm/kvm_mmu.h
++++ b/arch/arm64/include/asm/kvm_mmu.h
+@@ -394,6 +394,17 @@ static inline int kvm_read_guest_lock(struct kvm *kvm,
+ return ret;
+ }
+
++static inline int kvm_write_guest_lock(struct kvm *kvm, gpa_t gpa,
++ const void *data, unsigned long len)
++{
++ int srcu_idx = srcu_read_lock(&kvm->srcu);
++ int ret = kvm_write_guest(kvm, gpa, data, len);
++
++ srcu_read_unlock(&kvm->srcu, srcu_idx);
++
++ return ret;
++}
++
+ #ifdef CONFIG_KVM_INDIRECT_VECTORS
+ /*
+ * EL2 vectors can be mapped and rerouted in a number of ways,
+diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
+index 18b9a522a2b3..0688816f19e2 100644
+--- a/arch/arm64/kvm/reset.c
++++ b/arch/arm64/kvm/reset.c
+@@ -117,6 +117,9 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
+ int ret = -EINVAL;
+ bool loaded;
+
++ /* Reset PMU outside of the non-preemptible section */
++ kvm_pmu_vcpu_reset(vcpu);
++
+ preempt_disable();
+ loaded = (vcpu->cpu != -1);
+ if (loaded)
+@@ -164,9 +167,6 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
+ vcpu->arch.reset_state.reset = false;
+ }
+
+- /* Reset PMU */
+- kvm_pmu_vcpu_reset(vcpu);
+-
+ /* Default workaround setup is enabled (if supported) */
+ if (kvm_arm_have_ssbd() == KVM_SSBD_KERNEL)
+ vcpu->arch.workaround_flags |= VCPU_WORKAROUND_2_FLAG;
+diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
+index 7d22a474a040..f74639a05f0f 100644
+--- a/arch/s390/include/asm/elf.h
++++ b/arch/s390/include/asm/elf.h
+@@ -252,11 +252,14 @@ do { \
+
+ /*
+ * Cache aliasing on the latest machines calls for a mapping granularity
+- * of 512KB. For 64-bit processes use a 512KB alignment and a randomization
+- * of up to 1GB. For 31-bit processes the virtual address space is limited,
+- * use no alignment and limit the randomization to 8MB.
++ * of 512KB for the anonymous mapping base. For 64-bit processes use a
++ * 512KB alignment and a randomization of up to 1GB. For 31-bit processes
++ * the virtual address space is limited, use no alignment and limit the
++ * randomization to 8MB.
++ * For the additional randomization of the program break use 32MB for
++ * 64-bit and 8MB for 31-bit.
+ */
+-#define BRK_RND_MASK (is_compat_task() ? 0x7ffUL : 0x3ffffUL)
++#define BRK_RND_MASK (is_compat_task() ? 0x7ffUL : 0x1fffUL)
+ #define MMAP_RND_MASK (is_compat_task() ? 0x7ffUL : 0x3ff80UL)
+ #define MMAP_ALIGN_MASK (is_compat_task() ? 0 : 0x7fUL)
+ #define STACK_RND_MASK MMAP_RND_MASK
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index 1e95d57760cf..b69f7d428443 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -230,7 +230,7 @@ bool mmap_address_hint_valid(unsigned long addr, unsigned long len)
+ /* Can we access it for direct reading/writing? Must be RAM: */
+ int valid_phys_addr_range(phys_addr_t addr, size_t count)
+ {
+- return addr + count <= __pa(high_memory);
++ return addr + count - 1 <= __pa(high_memory - 1);
+ }
+
+ /* Can we access it through mmap? Must be a valid physical address: */
+diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c
+index d10105825d57..47d097946872 100644
+--- a/arch/x86/realmode/init.c
++++ b/arch/x86/realmode/init.c
+@@ -20,8 +20,6 @@ void __init set_real_mode_mem(phys_addr_t mem, size_t size)
+ void *base = __va(mem);
+
+ real_mode_header = (struct real_mode_header *) base;
+- printk(KERN_DEBUG "Base memory trampoline at [%p] %llx size %zu\n",
+- base, (unsigned long long)mem, size);
+ }
+
+ void __init reserve_real_mode(void)
+diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
+index 4424997ecf30..e10fec99a182 100644
+--- a/drivers/acpi/acpica/evgpe.c
++++ b/drivers/acpi/acpica/evgpe.c
+@@ -81,12 +81,8 @@ acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info)
+
+ ACPI_FUNCTION_TRACE(ev_enable_gpe);
+
+- /* Clear the GPE status */
+- status = acpi_hw_clear_gpe(gpe_event_info);
+- if (ACPI_FAILURE(status))
+- return_ACPI_STATUS(status);
+-
+ /* Enable the requested GPE */
++
+ status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_ENABLE);
+ return_ACPI_STATUS(status);
+ }
+diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
+index b3ed8f9953a8..173e6f2dd9af 100644
+--- a/drivers/ata/libata-zpodd.c
++++ b/drivers/ata/libata-zpodd.c
+@@ -52,38 +52,52 @@ static int eject_tray(struct ata_device *dev)
+ /* Per the spec, only slot type and drawer type ODD can be supported */
+ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
+ {
+- char buf[16];
++ char *buf;
+ unsigned int ret;
+- struct rm_feature_desc *desc = (void *)(buf + 8);
++ struct rm_feature_desc *desc;
+ struct ata_taskfile tf;
+ static const char cdb[] = { GPCMD_GET_CONFIGURATION,
+ 2, /* only 1 feature descriptor requested */
+ 0, 3, /* 3, removable medium feature */
+ 0, 0, 0,/* reserved */
+- 0, sizeof(buf),
++ 0, 16,
+ 0, 0, 0,
+ };
+
++ buf = kzalloc(16, GFP_KERNEL);
++ if (!buf)
++ return ODD_MECH_TYPE_UNSUPPORTED;
++ desc = (void *)(buf + 8);
++
+ ata_tf_init(dev, &tf);
+ tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+ tf.command = ATA_CMD_PACKET;
+ tf.protocol = ATAPI_PROT_PIO;
+- tf.lbam = sizeof(buf);
++ tf.lbam = 16;
+
+ ret = ata_exec_internal(dev, &tf, cdb, DMA_FROM_DEVICE,
+- buf, sizeof(buf), 0);
+- if (ret)
++ buf, 16, 0);
++ if (ret) {
++ kfree(buf);
+ return ODD_MECH_TYPE_UNSUPPORTED;
++ }
+
+- if (be16_to_cpu(desc->feature_code) != 3)
++ if (be16_to_cpu(desc->feature_code) != 3) {
++ kfree(buf);
+ return ODD_MECH_TYPE_UNSUPPORTED;
++ }
+
+- if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1)
++ if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1) {
++ kfree(buf);
+ return ODD_MECH_TYPE_SLOT;
+- else if (desc->mech_type == 1 && desc->load == 0 && desc->eject == 1)
++ } else if (desc->mech_type == 1 && desc->load == 0 &&
++ desc->eject == 1) {
++ kfree(buf);
+ return ODD_MECH_TYPE_DRAWER;
+- else
++ } else {
++ kfree(buf);
+ return ODD_MECH_TYPE_UNSUPPORTED;
++ }
+ }
+
+ /* Test if ODD is zero power ready by sense code */
+diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
+index 2342e154029b..b696ec35efb3 100644
+--- a/drivers/gpio/gpio-aspeed.c
++++ b/drivers/gpio/gpio-aspeed.c
+@@ -1225,6 +1225,8 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev)
+
+ gpio->offset_timer =
+ devm_kzalloc(&pdev->dev, gpio->chip.ngpio, GFP_KERNEL);
++ if (!gpio->offset_timer)
++ return -ENOMEM;
+
+ return aspeed_gpio_setup_irqs(gpio, pdev);
+ }
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index d4e7a09598fa..e0f149bdf98f 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -646,7 +646,13 @@ int of_gpiochip_add(struct gpio_chip *chip)
+
+ of_node_get(chip->of_node);
+
+- return of_gpiochip_scan_gpios(chip);
++ status = of_gpiochip_scan_gpios(chip);
++ if (status) {
++ of_node_put(chip->of_node);
++ gpiochip_remove_pin_ranges(chip);
++ }
++
++ return status;
+ }
+
+ void of_gpiochip_remove(struct gpio_chip *chip)
+diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
+index ea4941da9b27..0201ccb22f4c 100644
+--- a/drivers/gpu/drm/drm_drv.c
++++ b/drivers/gpu/drm/drm_drv.c
+@@ -381,11 +381,7 @@ void drm_dev_unplug(struct drm_device *dev)
+ synchronize_srcu(&drm_unplug_srcu);
+
+ drm_dev_unregister(dev);
+-
+- mutex_lock(&drm_global_mutex);
+- if (dev->open_count == 0)
+- drm_dev_put(dev);
+- mutex_unlock(&drm_global_mutex);
++ drm_dev_put(dev);
+ }
+ EXPORT_SYMBOL(drm_dev_unplug);
+
+diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
+index ffa8dc35515f..e4ccb52c67ea 100644
+--- a/drivers/gpu/drm/drm_file.c
++++ b/drivers/gpu/drm/drm_file.c
+@@ -479,11 +479,9 @@ int drm_release(struct inode *inode, struct file *filp)
+
+ drm_file_free(file_priv);
+
+- if (!--dev->open_count) {
++ if (!--dev->open_count)
+ drm_lastclose(dev);
+- if (drm_dev_is_unplugged(dev))
+- drm_put_dev(dev);
+- }
++
+ mutex_unlock(&drm_global_mutex);
+
+ drm_minor_release(minor);
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 611ac340fb28..588b3b0c8315 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -300,10 +300,12 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
+
+ ret = drm_dev_register(drm, 0);
+ if (ret)
+- goto free_drm;
++ goto uninstall_irq;
+
+ return 0;
+
++uninstall_irq:
++ drm_irq_uninstall(drm);
+ free_drm:
+ drm_dev_put(drm);
+
+@@ -317,10 +319,11 @@ static int meson_drv_bind(struct device *dev)
+
+ static void meson_drv_unbind(struct device *dev)
+ {
+- struct drm_device *drm = dev_get_drvdata(dev);
+- struct meson_drm *priv = drm->dev_private;
++ struct meson_drm *priv = dev_get_drvdata(dev);
++ struct drm_device *drm = priv->drm;
+
+ drm_dev_unregister(drm);
++ drm_irq_uninstall(drm);
+ drm_kms_helper_poll_fini(drm);
+ drm_fbdev_cma_fini(priv->fbdev);
+ drm_mode_config_cleanup(drm);
+diff --git a/drivers/gpu/drm/tegra/hub.c b/drivers/gpu/drm/tegra/hub.c
+index 8f4fcbb515fb..bb97cad1eb69 100644
+--- a/drivers/gpu/drm/tegra/hub.c
++++ b/drivers/gpu/drm/tegra/hub.c
+@@ -378,14 +378,16 @@ static int tegra_shared_plane_atomic_check(struct drm_plane *plane,
+ static void tegra_shared_plane_atomic_disable(struct drm_plane *plane,
+ struct drm_plane_state *old_state)
+ {
+- struct tegra_dc *dc = to_tegra_dc(old_state->crtc);
+ struct tegra_plane *p = to_tegra_plane(plane);
++ struct tegra_dc *dc;
+ u32 value;
+
+ /* rien ne va plus */
+ if (!old_state || !old_state->crtc)
+ return;
+
++ dc = to_tegra_dc(old_state->crtc);
++
+ /*
+ * XXX Legacy helpers seem to sometimes call ->atomic_disable() even
+ * on planes that are already disabled. Make sure we fallback to the
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index ac4b09642f63..8f803812ea24 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -131,6 +131,7 @@ config I2C_I801
+ Cannon Lake (PCH)
+ Cedar Fork (PCH)
+ Ice Lake (PCH)
++ Comet Lake (PCH)
+
+ This driver can also be built as a module. If so, the module
+ will be called i2c-i801.
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index c91e145ef5a5..679c6c41f64b 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -71,6 +71,7 @@
+ * Cannon Lake-LP (PCH) 0x9da3 32 hard yes yes yes
+ * Cedar Fork (PCH) 0x18df 32 hard yes yes yes
+ * Ice Lake-LP (PCH) 0x34a3 32 hard yes yes yes
++ * Comet Lake (PCH) 0x02a3 32 hard yes yes yes
+ *
+ * Features supported by this driver:
+ * Software PEC no
+@@ -240,6 +241,7 @@
+ #define PCI_DEVICE_ID_INTEL_LEWISBURG_SSKU_SMBUS 0xa223
+ #define PCI_DEVICE_ID_INTEL_KABYLAKE_PCH_H_SMBUS 0xa2a3
+ #define PCI_DEVICE_ID_INTEL_CANNONLAKE_H_SMBUS 0xa323
++#define PCI_DEVICE_ID_INTEL_COMETLAKE_SMBUS 0x02a3
+
+ struct i801_mux_config {
+ char *gpio_chip;
+@@ -1038,6 +1040,7 @@ static const struct pci_device_id i801_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CANNONLAKE_H_SMBUS) },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CANNONLAKE_LP_SMBUS) },
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICELAKE_LP_SMBUS) },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_COMETLAKE_SMBUS) },
+ { 0, }
+ };
+
+@@ -1534,6 +1537,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ case PCI_DEVICE_ID_INTEL_DNV_SMBUS:
+ case PCI_DEVICE_ID_INTEL_KABYLAKE_PCH_H_SMBUS:
+ case PCI_DEVICE_ID_INTEL_ICELAKE_LP_SMBUS:
++ case PCI_DEVICE_ID_INTEL_COMETLAKE_SMBUS:
+ priv->features |= FEATURE_I2C_BLOCK_READ;
+ priv->features |= FEATURE_IRQ;
+ priv->features |= FEATURE_SMBUS_PEC;
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 0b3877681e4a..8d9920ff4134 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -3119,21 +3119,24 @@ static void amd_iommu_get_resv_regions(struct device *dev,
+ return;
+
+ list_for_each_entry(entry, &amd_iommu_unity_map, list) {
++ int type, prot = 0;
+ size_t length;
+- int prot = 0;
+
+ if (devid < entry->devid_start || devid > entry->devid_end)
+ continue;
+
++ type = IOMMU_RESV_DIRECT;
+ length = entry->address_end - entry->address_start;
+ if (entry->prot & IOMMU_PROT_IR)
+ prot |= IOMMU_READ;
+ if (entry->prot & IOMMU_PROT_IW)
+ prot |= IOMMU_WRITE;
++ if (entry->prot & IOMMU_UNITY_MAP_FLAG_EXCL_RANGE)
++ /* Exclusion range */
++ type = IOMMU_RESV_RESERVED;
+
+ region = iommu_alloc_resv_region(entry->address_start,
+- length, prot,
+- IOMMU_RESV_DIRECT);
++ length, prot, type);
+ if (!region) {
+ pr_err("Out of memory allocating dm-regions for %s\n",
+ dev_name(dev));
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index e062ab9687c7..be3801d43d48 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -2001,6 +2001,9 @@ static int __init init_unity_map_range(struct ivmd_header *m)
+ if (e == NULL)
+ return -ENOMEM;
+
++ if (m->flags & IVMD_FLAG_EXCL_RANGE)
++ init_exclusion_range(m);
++
+ switch (m->type) {
+ default:
+ kfree(e);
+@@ -2047,9 +2050,7 @@ static int __init init_memory_definitions(struct acpi_table_header *table)
+
+ while (p < end) {
+ m = (struct ivmd_header *)p;
+- if (m->flags & IVMD_FLAG_EXCL_RANGE)
+- init_exclusion_range(m);
+- else if (m->flags & IVMD_FLAG_UNITY_MAP)
++ if (m->flags & (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE))
+ init_unity_map_range(m);
+
+ p += m->length;
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index e2b342e65a7b..69f3d4c95b53 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -373,6 +373,8 @@
+ #define IOMMU_PROT_IR 0x01
+ #define IOMMU_PROT_IW 0x02
+
++#define IOMMU_UNITY_MAP_FLAG_EXCL_RANGE (1 << 2)
++
+ /* IOMMU capabilities */
+ #define IOMMU_CAP_IOTLB 24
+ #define IOMMU_CAP_NPCACHE 26
+diff --git a/drivers/leds/leds-pca9532.c b/drivers/leds/leds-pca9532.c
+index 7fea18b0c15d..7cb4d685a1f1 100644
+--- a/drivers/leds/leds-pca9532.c
++++ b/drivers/leds/leds-pca9532.c
+@@ -513,6 +513,7 @@ static int pca9532_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+ int devid;
++ const struct of_device_id *of_id;
+ struct pca9532_data *data = i2c_get_clientdata(client);
+ struct pca9532_platform_data *pca9532_pdata =
+ dev_get_platdata(&client->dev);
+@@ -528,8 +529,11 @@ static int pca9532_probe(struct i2c_client *client,
+ dev_err(&client->dev, "no platform data\n");
+ return -EINVAL;
+ }
+- devid = (int)(uintptr_t)of_match_device(
+- of_pca9532_leds_match, &client->dev)->data;
++ of_id = of_match_device(of_pca9532_leds_match,
++ &client->dev);
++ if (unlikely(!of_id))
++ return -EINVAL;
++ devid = (int)(uintptr_t) of_id->data;
+ } else {
+ devid = id->driver_data;
+ }
+diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c
+index 3dd3ed46d473..136f86a1627d 100644
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -122,7 +122,8 @@ static ssize_t device_name_store(struct device *dev,
+ trigger_data->net_dev = NULL;
+ }
+
+- strncpy(trigger_data->device_name, buf, size);
++ memcpy(trigger_data->device_name, buf, size);
++ trigger_data->device_name[size] = 0;
+ if (size > 0 && trigger_data->device_name[size - 1] == '\n')
+ trigger_data->device_name[size - 1] = 0;
+
+@@ -301,11 +302,11 @@ static int netdev_trig_notify(struct notifier_block *nb,
+ container_of(nb, struct led_netdev_data, notifier);
+
+ if (evt != NETDEV_UP && evt != NETDEV_DOWN && evt != NETDEV_CHANGE
+- && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER
+- && evt != NETDEV_CHANGENAME)
++ && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER)
+ return NOTIFY_DONE;
+
+- if (strcmp(dev->name, trigger_data->device_name))
++ if (!(dev == trigger_data->net_dev ||
++ (evt == NETDEV_REGISTER && !strcmp(dev->name, trigger_data->device_name))))
+ return NOTIFY_DONE;
+
+ cancel_delayed_work_sync(&trigger_data->work);
+@@ -320,12 +321,9 @@ static int netdev_trig_notify(struct notifier_block *nb,
+ dev_hold(dev);
+ trigger_data->net_dev = dev;
+ break;
+- case NETDEV_CHANGENAME:
+ case NETDEV_UNREGISTER:
+- if (trigger_data->net_dev) {
+- dev_put(trigger_data->net_dev);
+- trigger_data->net_dev = NULL;
+- }
++ dev_put(trigger_data->net_dev);
++ trigger_data->net_dev = NULL;
+ break;
+ case NETDEV_UP:
+ case NETDEV_CHANGE:
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 8abea1c3844f..7d7b51383adf 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -3323,14 +3323,20 @@ static int macb_clk_init(struct platform_device *pdev, struct clk **pclk,
+ *hclk = devm_clk_get(&pdev->dev, "hclk");
+ }
+
+- if (IS_ERR(*pclk)) {
++ if (IS_ERR_OR_NULL(*pclk)) {
+ err = PTR_ERR(*pclk);
++ if (!err)
++ err = -ENODEV;
++
+ dev_err(&pdev->dev, "failed to get macb_clk (%u)\n", err);
+ return err;
+ }
+
+- if (IS_ERR(*hclk)) {
++ if (IS_ERR_OR_NULL(*hclk)) {
+ err = PTR_ERR(*hclk);
++ if (!err)
++ err = -ENODEV;
++
+ dev_err(&pdev->dev, "failed to get hclk (%u)\n", err);
+ return err;
+ }
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index 03f64f40b2a3..506f78322d74 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -3161,6 +3161,7 @@ static ssize_t ehea_probe_port(struct device *dev,
+
+ if (ehea_add_adapter_mr(adapter)) {
+ pr_err("creating MR failed\n");
++ of_node_put(eth_dn);
+ return -EIO;
+ }
+
+diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
+index bd6e9014bc74..b83b070a9eec 100644
+--- a/drivers/net/ethernet/micrel/ks8851.c
++++ b/drivers/net/ethernet/micrel/ks8851.c
+@@ -535,9 +535,8 @@ static void ks8851_rx_pkts(struct ks8851_net *ks)
+ /* set dma read address */
+ ks8851_wrreg16(ks, KS_RXFDPR, RXFDPR_RXFPAI | 0x00);
+
+- /* start the packet dma process, and set auto-dequeue rx */
+- ks8851_wrreg16(ks, KS_RXQCR,
+- ks->rc_rxqcr | RXQCR_SDA | RXQCR_ADRFE);
++ /* start DMA access */
++ ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+
+ if (rxlen > 4) {
+ unsigned int rxalign;
+@@ -568,7 +567,8 @@ static void ks8851_rx_pkts(struct ks8851_net *ks)
+ }
+ }
+
+- ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
++ /* end DMA access and dequeue packet */
++ ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_RRXEF);
+ }
+ }
+
+@@ -785,6 +785,15 @@ static void ks8851_tx_work(struct work_struct *work)
+ static int ks8851_net_open(struct net_device *dev)
+ {
+ struct ks8851_net *ks = netdev_priv(dev);
++ int ret;
++
++ ret = request_threaded_irq(dev->irq, NULL, ks8851_irq,
++ IRQF_TRIGGER_LOW | IRQF_ONESHOT,
++ dev->name, ks);
++ if (ret < 0) {
++ netdev_err(dev, "failed to get irq\n");
++ return ret;
++ }
+
+ /* lock the card, even if we may not actually be doing anything
+ * else at the moment */
+@@ -849,6 +858,7 @@ static int ks8851_net_open(struct net_device *dev)
+ netif_dbg(ks, ifup, ks->netdev, "network device up\n");
+
+ mutex_unlock(&ks->lock);
++ mii_check_link(&ks->mii);
+ return 0;
+ }
+
+@@ -899,6 +909,8 @@ static int ks8851_net_stop(struct net_device *dev)
+ dev_kfree_skb(txb);
+ }
+
++ free_irq(dev->irq, ks);
++
+ return 0;
+ }
+
+@@ -1508,6 +1520,7 @@ static int ks8851_probe(struct spi_device *spi)
+
+ spi_set_drvdata(spi, ks);
+
++ netif_carrier_off(ks->netdev);
+ ndev->if_port = IF_PORT_100BASET;
+ ndev->netdev_ops = &ks8851_netdev_ops;
+ ndev->irq = spi->irq;
+@@ -1529,14 +1542,6 @@ static int ks8851_probe(struct spi_device *spi)
+ ks8851_read_selftest(ks);
+ ks8851_init_mac(ks);
+
+- ret = request_threaded_irq(spi->irq, NULL, ks8851_irq,
+- IRQF_TRIGGER_LOW | IRQF_ONESHOT,
+- ndev->name, ks);
+- if (ret < 0) {
+- dev_err(&spi->dev, "failed to get irq\n");
+- goto err_irq;
+- }
+-
+ ret = register_netdev(ndev);
+ if (ret) {
+ dev_err(&spi->dev, "failed to register network device\n");
+@@ -1549,14 +1554,10 @@ static int ks8851_probe(struct spi_device *spi)
+
+ return 0;
+
+-
+ err_netdev:
+- free_irq(ndev->irq, ks);
+-
+-err_irq:
++err_id:
+ if (gpio_is_valid(gpio))
+ gpio_set_value(gpio, 0);
+-err_id:
+ regulator_disable(ks->vdd_reg);
+ err_reg:
+ regulator_disable(ks->vdd_io);
+@@ -1574,7 +1575,6 @@ static int ks8851_remove(struct spi_device *spi)
+ dev_info(&spi->dev, "remove\n");
+
+ unregister_netdev(priv->netdev);
+- free_irq(spi->irq, priv);
+ if (gpio_is_valid(priv->gpio))
+ gpio_set_value(priv->gpio, 0);
+ regulator_disable(priv->vdd_reg);
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+index 3b0adda7cc9c..a4cd6f2cfb86 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+@@ -1048,6 +1048,8 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode)
+
+ for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) {
+ skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE);
++ if (!skb)
++ break;
+ qlcnic_create_loopback_buff(skb->data, adapter->mac_addr);
+ skb_put(skb, QLCNIC_ILB_PKT_SIZE);
+ adapter->ahw->diag_cnt = 0;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 62460a5b4ad9..39c105092214 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3195,14 +3195,16 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
+ stmmac_prepare_tx_desc(priv, first, 1, nopaged_len,
+ csum_insertion, priv->mode, 1, last_segment,
+ skb->len);
+-
+- /* The own bit must be the latest setting done when prepare the
+- * descriptor and then barrier is needed to make sure that
+- * all is coherent before granting the DMA engine.
+- */
+- wmb();
++ } else {
++ stmmac_set_tx_owner(priv, first);
+ }
+
++ /* The own bit must be the latest setting done when prepare the
++ * descriptor and then barrier is needed to make sure that
++ * all is coherent before granting the DMA engine.
++ */
++ wmb();
++
+ netdev_tx_sent_queue(netdev_get_tx_queue(dev, queue), skb->len);
+
+ stmmac_enable_dma_transmission(priv, priv->ioaddr);
+diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c
+index 72b98e27c992..d177dfd1df89 100644
+--- a/drivers/net/ethernet/ti/netcp_ethss.c
++++ b/drivers/net/ethernet/ti/netcp_ethss.c
+@@ -3655,12 +3655,16 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev,
+
+ ret = netcp_txpipe_init(&gbe_dev->tx_pipe, netcp_device,
+ gbe_dev->dma_chan_name, gbe_dev->tx_queue_id);
+- if (ret)
++ if (ret) {
++ of_node_put(interfaces);
+ return ret;
++ }
+
+ ret = netcp_txpipe_open(&gbe_dev->tx_pipe);
+- if (ret)
++ if (ret) {
++ of_node_put(interfaces);
+ return ret;
++ }
+
+ /* Create network interfaces */
+ INIT_LIST_HEAD(&gbe_dev->gbe_intf_head);
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index f24f48f33802..7cfd7ff38e86 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -1574,12 +1574,14 @@ static int axienet_probe(struct platform_device *pdev)
+ ret = of_address_to_resource(np, 0, &dmares);
+ if (ret) {
+ dev_err(&pdev->dev, "unable to get DMA resource\n");
++ of_node_put(np);
+ goto free_netdev;
+ }
+ lp->dma_regs = devm_ioremap_resource(&pdev->dev, &dmares);
+ if (IS_ERR(lp->dma_regs)) {
+ dev_err(&pdev->dev, "could not map DMA regs\n");
+ ret = PTR_ERR(lp->dma_regs);
++ of_node_put(np);
+ goto free_netdev;
+ }
+ lp->rx_irq = irq_of_parse_and_map(np, 1);
+diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
+index cd1d8faccca5..cd6b95e673a5 100644
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -1268,6 +1268,10 @@ static int adf7242_probe(struct spi_device *spi)
+ INIT_DELAYED_WORK(&lp->work, adf7242_rx_cal_work);
+ lp->wqueue = alloc_ordered_workqueue(dev_name(&spi->dev),
+ WQ_MEM_RECLAIM);
++ if (unlikely(!lp->wqueue)) {
++ ret = -ENOMEM;
++ goto err_hw_init;
++ }
+
+ ret = adf7242_hw_init(lp);
+ if (ret)
+diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
+index 624bff4d3636..f1ed1744801c 100644
+--- a/drivers/net/ieee802154/mac802154_hwsim.c
++++ b/drivers/net/ieee802154/mac802154_hwsim.c
+@@ -332,7 +332,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ goto out_err;
+ }
+
+- genlmsg_reply(skb, info);
++ res = genlmsg_reply(skb, info);
+ break;
+ }
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index da8f5ad30c71..260248fbb8fe 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -349,15 +349,12 @@ static inline bool nvme_state_is_live(enum nvme_ana_state state)
+ static void nvme_update_ns_ana_state(struct nvme_ana_group_desc *desc,
+ struct nvme_ns *ns)
+ {
+- enum nvme_ana_state old;
+-
+ mutex_lock(&ns->head->lock);
+- old = ns->ana_state;
+ ns->ana_grpid = le32_to_cpu(desc->grpid);
+ ns->ana_state = desc->state;
+ clear_bit(NVME_NS_ANA_PENDING, &ns->flags);
+
+- if (nvme_state_is_live(ns->ana_state) && !nvme_state_is_live(old))
++ if (nvme_state_is_live(ns->ana_state))
+ nvme_mpath_set_live(ns);
+ mutex_unlock(&ns->head->lock);
+ }
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index 7f71ca0d08e7..9c5e801b3f6c 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -2586,12 +2586,14 @@ static int qeth_l3_probe_device(struct ccwgroup_device *gdev)
+ struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+ int rc;
+
++ hash_init(card->ip_htable);
++
+ if (gdev->dev.type == &qeth_generic_devtype) {
+ rc = qeth_l3_create_device_attributes(&gdev->dev);
+ if (rc)
+ return rc;
+ }
+- hash_init(card->ip_htable);
++
+ hash_init(card->ip_mc_htable);
+ card->options.layer2 = 0;
+ card->info.hwtrap = 0;
+diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
+index f6c415d6ef48..5eb7aabe2d8b 100644
+--- a/drivers/s390/scsi/zfcp_fc.c
++++ b/drivers/s390/scsi/zfcp_fc.c
+@@ -239,10 +239,6 @@ static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range,
+ list_for_each_entry(port, &adapter->port_list, list) {
+ if ((port->d_id & range) == (ntoh24(page->rscn_fid) & range))
+ zfcp_fc_test_link(port);
+- if (!port->d_id)
+- zfcp_erp_port_reopen(port,
+- ZFCP_STATUS_COMMON_ERP_FAILED,
+- "fcrscn1");
+ }
+ read_unlock_irqrestore(&adapter->port_list_lock, flags);
+ }
+@@ -250,6 +246,7 @@ static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range,
+ static void zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req)
+ {
+ struct fsf_status_read_buffer *status_buffer = (void *)fsf_req->data;
++ struct zfcp_adapter *adapter = fsf_req->adapter;
+ struct fc_els_rscn *head;
+ struct fc_els_rscn_page *page;
+ u16 i;
+@@ -263,6 +260,22 @@ static void zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req)
+ no_entries = be16_to_cpu(head->rscn_plen) /
+ sizeof(struct fc_els_rscn_page);
+
++ if (no_entries > 1) {
++ /* handle failed ports */
++ unsigned long flags;
++ struct zfcp_port *port;
++
++ read_lock_irqsave(&adapter->port_list_lock, flags);
++ list_for_each_entry(port, &adapter->port_list, list) {
++ if (port->d_id)
++ continue;
++ zfcp_erp_port_reopen(port,
++ ZFCP_STATUS_COMMON_ERP_FAILED,
++ "fcrscn1");
++ }
++ read_unlock_irqrestore(&adapter->port_list_lock, flags);
++ }
++
+ for (i = 1; i < no_entries; i++) {
+ /* skip head and start with 1st element */
+ page++;
+diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
+index 39eb415987fc..074760f21014 100644
+--- a/drivers/scsi/aacraid/aacraid.h
++++ b/drivers/scsi/aacraid/aacraid.h
+@@ -2639,9 +2639,14 @@ static inline unsigned int cap_to_cyls(sector_t capacity, unsigned divisor)
+ return capacity;
+ }
+
++static inline int aac_pci_offline(struct aac_dev *dev)
++{
++ return pci_channel_offline(dev->pdev) || dev->handle_pci_error;
++}
++
+ static inline int aac_adapter_check_health(struct aac_dev *dev)
+ {
+- if (unlikely(pci_channel_offline(dev->pdev)))
++ if (unlikely(aac_pci_offline(dev)))
+ return -1;
+
+ return (dev)->a_ops.adapter_check_health(dev);
+diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
+index 3236240a4edd..b7588de4484e 100644
+--- a/drivers/scsi/aacraid/commsup.c
++++ b/drivers/scsi/aacraid/commsup.c
+@@ -673,7 +673,7 @@ int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
+ return -ETIMEDOUT;
+ }
+
+- if (unlikely(pci_channel_offline(dev->pdev)))
++ if (unlikely(aac_pci_offline(dev)))
+ return -EFAULT;
+
+ if ((blink = aac_adapter_check_health(dev)) > 0) {
+@@ -773,7 +773,7 @@ int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback,
+
+ spin_unlock_irqrestore(&fibptr->event_lock, flags);
+
+- if (unlikely(pci_channel_offline(dev->pdev)))
++ if (unlikely(aac_pci_offline(dev)))
+ return -EFAULT;
+
+ fibptr->flags |= FIB_CONTEXT_FLAG_WAIT;
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index b59bba3e6516..8776330175e3 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -3280,12 +3280,18 @@ mpt3sas_base_free_smid(struct MPT3SAS_ADAPTER *ioc, u16 smid)
+
+ if (smid < ioc->hi_priority_smid) {
+ struct scsiio_tracker *st;
++ void *request;
+
+ st = _get_st_from_smid(ioc, smid);
+ if (!st) {
+ _base_recovery_check(ioc);
+ return;
+ }
++
++ /* Clear MPI request frame */
++ request = mpt3sas_base_get_msg_frame(ioc, smid);
++ memset(request, 0, ioc->request_sz);
++
+ mpt3sas_base_clear_st(ioc, st);
+ _base_recovery_check(ioc);
+ return;
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index 622832e55211..73d661a0ecbb 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -1474,11 +1474,23 @@ mpt3sas_scsih_scsi_lookup_get(struct MPT3SAS_ADAPTER *ioc, u16 smid)
+ {
+ struct scsi_cmnd *scmd = NULL;
+ struct scsiio_tracker *st;
++ Mpi25SCSIIORequest_t *mpi_request;
+
+ if (smid > 0 &&
+ smid <= ioc->scsiio_depth - INTERNAL_SCSIIO_CMDS_COUNT) {
+ u32 unique_tag = smid - 1;
+
++ mpi_request = mpt3sas_base_get_msg_frame(ioc, smid);
++
++ /*
++ * If SCSI IO request is outstanding at driver level then
++ * DevHandle filed must be non-zero. If DevHandle is zero
++ * then it means that this smid is free at driver level,
++ * so return NULL.
++ */
++ if (!mpi_request->DevHandle)
++ return scmd;
++
+ scmd = scsi_host_find_tag(ioc->shost, unique_tag);
+ if (scmd) {
+ st = scsi_cmd_priv(scmd);
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index 575445c761b4..5dd3e4e01b10 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -3204,6 +3204,8 @@ static int qla4xxx_conn_bind(struct iscsi_cls_session *cls_session,
+ if (iscsi_conn_bind(cls_session, cls_conn, is_leading))
+ return -EINVAL;
+ ep = iscsi_lookup_endpoint(transport_fd);
++ if (!ep)
++ return -EINVAL;
+ conn = cls_conn->dd_data;
+ qla_conn = conn->dd_data;
+ qla_conn->qla_ep = ep->dd_data;
+diff --git a/drivers/staging/axis-fifo/Kconfig b/drivers/staging/axis-fifo/Kconfig
+index 687537203d9c..d9725888af6f 100644
+--- a/drivers/staging/axis-fifo/Kconfig
++++ b/drivers/staging/axis-fifo/Kconfig
+@@ -3,6 +3,7 @@
+ #
+ config XIL_AXIS_FIFO
+ tristate "Xilinx AXI-Stream FIFO IP core driver"
++ depends on OF
+ default n
+ help
+ This adds support for the Xilinx AXI-Stream
+diff --git a/drivers/staging/mt7621-pci/Kconfig b/drivers/staging/mt7621-pci/Kconfig
+index d33533872a16..c8fa17cfa807 100644
+--- a/drivers/staging/mt7621-pci/Kconfig
++++ b/drivers/staging/mt7621-pci/Kconfig
+@@ -1,6 +1,7 @@
+ config PCI_MT7621
+ tristate "MediaTek MT7621 PCI Controller"
+ depends on RALINK
++ depends on PCI
+ select PCI_DRIVERS_GENERIC
+ help
+ This selects a driver for the MediaTek MT7621 PCI Controller.
+diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c
+index 2130d78e0d9f..dd9b02d316f3 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c
++++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c
+@@ -178,7 +178,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
+
+ pxmitpriv->free_xmit_extbuf_cnt = num_xmit_extbuf;
+
+- rtw_alloc_hwxmits(padapter);
++ res = rtw_alloc_hwxmits(padapter);
++ if (res == _FAIL)
++ goto exit;
+ rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
+
+ for (i = 0; i < 4; i++)
+@@ -1502,7 +1504,7 @@ exit:
+ return res;
+ }
+
+-void rtw_alloc_hwxmits(struct adapter *padapter)
++s32 rtw_alloc_hwxmits(struct adapter *padapter)
+ {
+ struct hw_xmit *hwxmits;
+ struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+@@ -1511,6 +1513,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
+
+ pxmitpriv->hwxmits = kcalloc(pxmitpriv->hwxmit_entry,
+ sizeof(struct hw_xmit), GFP_KERNEL);
++ if (!pxmitpriv->hwxmits)
++ return _FAIL;
+
+ hwxmits = pxmitpriv->hwxmits;
+
+@@ -1518,6 +1522,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
+ hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
+ hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
+ hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
++ return _SUCCESS;
+ }
+
+ void rtw_free_hwxmits(struct adapter *padapter)
+diff --git a/drivers/staging/rtl8188eu/include/rtw_xmit.h b/drivers/staging/rtl8188eu/include/rtw_xmit.h
+index 788f59c74ea1..ba7e15fbde72 100644
+--- a/drivers/staging/rtl8188eu/include/rtw_xmit.h
++++ b/drivers/staging/rtl8188eu/include/rtw_xmit.h
+@@ -336,7 +336,7 @@ s32 rtw_txframes_sta_ac_pending(struct adapter *padapter,
+ void rtw_init_hwxmits(struct hw_xmit *phwxmit, int entry);
+ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter);
+ void _rtw_free_xmit_priv(struct xmit_priv *pxmitpriv);
+-void rtw_alloc_hwxmits(struct adapter *padapter);
++s32 rtw_alloc_hwxmits(struct adapter *padapter);
+ void rtw_free_hwxmits(struct adapter *padapter);
+ s32 rtw_xmit(struct adapter *padapter, struct sk_buff **pkt);
+
+diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c
+index b1dfe9f46619..63bc811681d9 100644
+--- a/drivers/staging/rtl8712/rtl8712_cmd.c
++++ b/drivers/staging/rtl8712/rtl8712_cmd.c
+@@ -159,17 +159,9 @@ static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
+
+ static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
+ {
+- u32 val;
+- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
+ struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
+
+- if (pcmd->rsp && pcmd->rspsz > 0)
+- memcpy(pcmd->rsp, (u8 *)&val, pcmd->rspsz);
+- pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
+- if (!pcmd_callback)
+- r8712_free_cmd_obj(pcmd);
+- else
+- pcmd_callback(padapter, pcmd);
++ r8712_free_cmd_obj(pcmd);
+ return H2C_SUCCESS;
+ }
+
+diff --git a/drivers/staging/rtl8712/rtl8712_cmd.h b/drivers/staging/rtl8712/rtl8712_cmd.h
+index 9181bb6b04c3..a101a0a50955 100644
+--- a/drivers/staging/rtl8712/rtl8712_cmd.h
++++ b/drivers/staging/rtl8712/rtl8712_cmd.h
+@@ -152,7 +152,7 @@ enum rtl8712_h2c_cmd {
+ static struct _cmd_callback cmd_callback[] = {
+ {GEN_CMD_CODE(_Read_MACREG), NULL}, /*0*/
+ {GEN_CMD_CODE(_Write_MACREG), NULL},
+- {GEN_CMD_CODE(_Read_BBREG), &r8712_getbbrfreg_cmdrsp_callback},
++ {GEN_CMD_CODE(_Read_BBREG), NULL},
+ {GEN_CMD_CODE(_Write_BBREG), NULL},
+ {GEN_CMD_CODE(_Read_RFREG), &r8712_getbbrfreg_cmdrsp_callback},
+ {GEN_CMD_CODE(_Write_RFREG), NULL}, /*5*/
+diff --git a/drivers/staging/rtl8723bs/core/rtw_xmit.c b/drivers/staging/rtl8723bs/core/rtw_xmit.c
+index edb678190b4b..16291de5c0d9 100644
+--- a/drivers/staging/rtl8723bs/core/rtw_xmit.c
++++ b/drivers/staging/rtl8723bs/core/rtw_xmit.c
+@@ -260,7 +260,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
+ }
+ }
+
+- rtw_alloc_hwxmits(padapter);
++ res = rtw_alloc_hwxmits(padapter);
++ if (res == _FAIL)
++ goto exit;
+ rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
+
+ for (i = 0; i < 4; i++) {
+@@ -2144,7 +2146,7 @@ exit:
+ return res;
+ }
+
+-void rtw_alloc_hwxmits(struct adapter *padapter)
++s32 rtw_alloc_hwxmits(struct adapter *padapter)
+ {
+ struct hw_xmit *hwxmits;
+ struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+@@ -2155,10 +2157,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
+
+ pxmitpriv->hwxmits = rtw_zmalloc(sizeof(struct hw_xmit) * pxmitpriv->hwxmit_entry);
+
+- if (pxmitpriv->hwxmits == NULL) {
+- DBG_871X("alloc hwxmits fail!...\n");
+- return;
+- }
++ if (!pxmitpriv->hwxmits)
++ return _FAIL;
+
+ hwxmits = pxmitpriv->hwxmits;
+
+@@ -2204,7 +2204,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
+
+ }
+
+-
++ return _SUCCESS;
+ }
+
+ void rtw_free_hwxmits(struct adapter *padapter)
+diff --git a/drivers/staging/rtl8723bs/include/rtw_xmit.h b/drivers/staging/rtl8723bs/include/rtw_xmit.h
+index a75b668d09a6..021c72361fbb 100644
+--- a/drivers/staging/rtl8723bs/include/rtw_xmit.h
++++ b/drivers/staging/rtl8723bs/include/rtw_xmit.h
+@@ -486,7 +486,7 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter);
+ void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv);
+
+
+-void rtw_alloc_hwxmits(struct adapter *padapter);
++s32 rtw_alloc_hwxmits(struct adapter *padapter);
+ void rtw_free_hwxmits(struct adapter *padapter);
+
+
+diff --git a/drivers/staging/rtlwifi/phydm/rtl_phydm.c b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
+index 9930ed954abb..4cc77b2016e1 100644
+--- a/drivers/staging/rtlwifi/phydm/rtl_phydm.c
++++ b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
+@@ -180,6 +180,8 @@ static int rtl_phydm_init_priv(struct rtl_priv *rtlpriv,
+
+ rtlpriv->phydm.internal =
+ kzalloc(sizeof(struct phy_dm_struct), GFP_KERNEL);
++ if (!rtlpriv->phydm.internal)
++ return 0;
+
+ _rtl_phydm_init_com_info(rtlpriv, ic, params);
+
+diff --git a/drivers/staging/rtlwifi/rtl8822be/fw.c b/drivers/staging/rtlwifi/rtl8822be/fw.c
+index a40396614814..c1ed52df05f0 100644
+--- a/drivers/staging/rtlwifi/rtl8822be/fw.c
++++ b/drivers/staging/rtlwifi/rtl8822be/fw.c
+@@ -741,6 +741,8 @@ void rtl8822be_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+ u1_rsvd_page_loc, 3);
+
+ skb = dev_alloc_skb(totalpacketlen);
++ if (!skb)
++ return;
+ memcpy((u8 *)skb_put(skb, totalpacketlen), &reserved_page_packet,
+ totalpacketlen);
+
+diff --git a/drivers/tty/serial/ar933x_uart.c b/drivers/tty/serial/ar933x_uart.c
+index db5df3d54818..3bdd56a1021b 100644
+--- a/drivers/tty/serial/ar933x_uart.c
++++ b/drivers/tty/serial/ar933x_uart.c
+@@ -49,11 +49,6 @@ struct ar933x_uart_port {
+ struct clk *clk;
+ };
+
+-static inline bool ar933x_uart_console_enabled(void)
+-{
+- return IS_ENABLED(CONFIG_SERIAL_AR933X_CONSOLE);
+-}
+-
+ static inline unsigned int ar933x_uart_read(struct ar933x_uart_port *up,
+ int offset)
+ {
+@@ -508,6 +503,7 @@ static const struct uart_ops ar933x_uart_ops = {
+ .verify_port = ar933x_uart_verify_port,
+ };
+
++#ifdef CONFIG_SERIAL_AR933X_CONSOLE
+ static struct ar933x_uart_port *
+ ar933x_console_ports[CONFIG_SERIAL_AR933X_NR_UARTS];
+
+@@ -604,14 +600,7 @@ static struct console ar933x_uart_console = {
+ .index = -1,
+ .data = &ar933x_uart_driver,
+ };
+-
+-static void ar933x_uart_add_console_port(struct ar933x_uart_port *up)
+-{
+- if (!ar933x_uart_console_enabled())
+- return;
+-
+- ar933x_console_ports[up->port.line] = up;
+-}
++#endif /* CONFIG_SERIAL_AR933X_CONSOLE */
+
+ static struct uart_driver ar933x_uart_driver = {
+ .owner = THIS_MODULE,
+@@ -700,7 +689,9 @@ static int ar933x_uart_probe(struct platform_device *pdev)
+ baud = ar933x_uart_get_baud(port->uartclk, 0, AR933X_UART_MAX_STEP);
+ up->max_baud = min_t(unsigned int, baud, AR933X_UART_MAX_BAUD);
+
+- ar933x_uart_add_console_port(up);
++#ifdef CONFIG_SERIAL_AR933X_CONSOLE
++ ar933x_console_ports[up->port.line] = up;
++#endif
+
+ ret = uart_add_one_port(&ar933x_uart_driver, &up->port);
+ if (ret)
+@@ -749,8 +740,9 @@ static int __init ar933x_uart_init(void)
+ {
+ int ret;
+
+- if (ar933x_uart_console_enabled())
+- ar933x_uart_driver.cons = &ar933x_uart_console;
++#ifdef CONFIG_SERIAL_AR933X_CONSOLE
++ ar933x_uart_driver.cons = &ar933x_uart_console;
++#endif
+
+ ret = uart_register_driver(&ar933x_uart_driver);
+ if (ret)
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index 47b41159a8bc..55b178c1bd65 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1481,7 +1481,7 @@ static int __init sc16is7xx_init(void)
+ ret = i2c_add_driver(&sc16is7xx_i2c_uart_driver);
+ if (ret < 0) {
+ pr_err("failed to init sc16is7xx i2c --> %d\n", ret);
+- return ret;
++ goto err_i2c;
+ }
+ #endif
+
+@@ -1489,10 +1489,18 @@ static int __init sc16is7xx_init(void)
+ ret = spi_register_driver(&sc16is7xx_spi_uart_driver);
+ if (ret < 0) {
+ pr_err("failed to init sc16is7xx spi --> %d\n", ret);
+- return ret;
++ goto err_spi;
+ }
+ #endif
+ return ret;
++
++err_spi:
++#ifdef CONFIG_SERIAL_SC16IS7XX_I2C
++ i2c_del_driver(&sc16is7xx_i2c_uart_driver);
++#endif
++err_i2c:
++ uart_unregister_driver(&sc16is7xx_uart);
++ return ret;
+ }
+ module_init(sc16is7xx_init);
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index fdc6e4e403e8..8cced3609e24 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -29,6 +29,7 @@
+ #define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa
+ #define PCI_DEVICE_ID_INTEL_APL 0x5aaa
+ #define PCI_DEVICE_ID_INTEL_KBP 0xa2b0
++#define PCI_DEVICE_ID_INTEL_CMLH 0x02ee
+ #define PCI_DEVICE_ID_INTEL_GLK 0x31aa
+ #define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee
+ #define PCI_DEVICE_ID_INTEL_CNPH 0xa36e
+@@ -305,6 +306,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MRFLD),
+ (kernel_ulong_t) &dwc3_pci_mrfld_properties, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLH),
++ (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_SPTLP),
+ (kernel_ulong_t) &dwc3_pci_intel_properties, },
+
+diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c
+index b77f3126580e..c2011cd7df8c 100644
+--- a/drivers/usb/gadget/udc/net2272.c
++++ b/drivers/usb/gadget/udc/net2272.c
+@@ -945,6 +945,7 @@ net2272_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+ break;
+ }
+ if (&req->req != _req) {
++ ep->stopped = stopped;
+ spin_unlock_irqrestore(&ep->dev->lock, flags);
+ return -EINVAL;
+ }
+diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
+index b02ab2a8d927..ee872cad5270 100644
+--- a/drivers/usb/gadget/udc/net2280.c
++++ b/drivers/usb/gadget/udc/net2280.c
+@@ -866,9 +866,6 @@ static void start_queue(struct net2280_ep *ep, u32 dmactl, u32 td_dma)
+ (void) readl(&ep->dev->pci->pcimstctl);
+
+ writel(BIT(DMA_START), &dma->dmastat);
+-
+- if (!ep->is_in)
+- stop_out_naking(ep);
+ }
+
+ static void start_dma(struct net2280_ep *ep, struct net2280_request *req)
+@@ -907,6 +904,7 @@ static void start_dma(struct net2280_ep *ep, struct net2280_request *req)
+ writel(BIT(DMA_START), &dma->dmastat);
+ return;
+ }
++ stop_out_naking(ep);
+ }
+
+ tmp = dmactl_default;
+@@ -1275,9 +1273,9 @@ static int net2280_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+ break;
+ }
+ if (&req->req != _req) {
++ ep->stopped = stopped;
+ spin_unlock_irqrestore(&ep->dev->lock, flags);
+- dev_err(&ep->dev->pdev->dev, "%s: Request mismatch\n",
+- __func__);
++ ep_dbg(ep->dev, "%s: Request mismatch\n", __func__);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c
+index 5b8a3d9530c4..5cac83aaeac3 100644
+--- a/drivers/usb/host/u132-hcd.c
++++ b/drivers/usb/host/u132-hcd.c
+@@ -3202,6 +3202,9 @@ static int __init u132_hcd_init(void)
+ printk(KERN_INFO "driver %s\n", hcd_name);
+ workqueue = create_singlethread_workqueue("u132");
+ retval = platform_driver_register(&u132_platform_driver);
++ if (retval)
++ destroy_workqueue(workqueue);
++
+ return retval;
+ }
+
+diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
+index a6efb9a72939..5f7734c729b1 100644
+--- a/drivers/usb/misc/usb251xb.c
++++ b/drivers/usb/misc/usb251xb.c
+@@ -601,7 +601,7 @@ static int usb251xb_probe(struct usb251xb *hub)
+ dev);
+ int err;
+
+- if (np) {
++ if (np && of_id) {
+ err = usb251xb_get_ofdata(hub,
+ (struct usb251xb_data *)of_id->data);
+ if (err) {
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 4055ab4d5c52..3e518c2ae2bf 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -524,6 +524,7 @@ static void ceph_i_callback(struct rcu_head *head)
+ struct inode *inode = container_of(head, struct inode, i_rcu);
+ struct ceph_inode_info *ci = ceph_inode(inode);
+
++ kfree(ci->i_symlink);
+ kmem_cache_free(ceph_inode_cachep, ci);
+ }
+
+@@ -561,7 +562,6 @@ void ceph_destroy_inode(struct inode *inode)
+ ceph_put_snap_realm(mdsc, realm);
+ }
+
+- kfree(ci->i_symlink);
+ while ((n = rb_first(&ci->i_fragtree)) != NULL) {
+ frag = rb_entry(n, struct ceph_inode_frag, node);
+ rb_erase(n, &ci->i_fragtree);
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index baaed4d05b22..249de20f752a 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -1989,10 +1989,8 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
+ rem += pipe->bufs[(pipe->curbuf + idx) & (pipe->buffers - 1)].len;
+
+ ret = -EINVAL;
+- if (rem < len) {
+- pipe_unlock(pipe);
+- goto out;
+- }
++ if (rem < len)
++ goto out_free;
+
+ rem = len;
+ while (rem) {
+@@ -2010,7 +2008,9 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
+ pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
+ pipe->nrbufs--;
+ } else {
+- pipe_buf_get(pipe, ibuf);
++ if (!pipe_buf_get(pipe, ibuf))
++ goto out_free;
++
+ *obuf = *ibuf;
+ obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
+ obuf->len = rem;
+@@ -2033,11 +2033,11 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
+ ret = fuse_dev_do_write(fud, &cs, len);
+
+ pipe_lock(pipe);
++out_free:
+ for (idx = 0; idx < nbuf; idx++)
+ pipe_buf_release(pipe, &bufs[idx]);
+ pipe_unlock(pipe);
+
+-out:
+ kvfree(bufs);
+ return ret;
+ }
+diff --git a/fs/nfs/client.c b/fs/nfs/client.c
+index 96d5f8135eb9..751ca65da8a3 100644
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -459,7 +459,7 @@ void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
+ case XPRT_TRANSPORT_RDMA:
+ if (retrans == NFS_UNSPEC_RETRANS)
+ to->to_retries = NFS_DEF_TCP_RETRANS;
+- if (timeo == NFS_UNSPEC_TIMEO || to->to_retries == 0)
++ if (timeo == NFS_UNSPEC_TIMEO || to->to_initval == 0)
+ to->to_initval = NFS_DEF_TCP_TIMEO * HZ / 10;
+ if (to->to_initval > NFS_MAX_TCP_TIMEOUT)
+ to->to_initval = NFS_MAX_TCP_TIMEOUT;
+diff --git a/fs/pipe.c b/fs/pipe.c
+index c51750ed4011..2a297bce381f 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -189,9 +189,9 @@ EXPORT_SYMBOL(generic_pipe_buf_steal);
+ * in the tee() system call, when we duplicate the buffers in one
+ * pipe into another.
+ */
+-void generic_pipe_buf_get(struct pipe_inode_info *pipe, struct pipe_buffer *buf)
++bool generic_pipe_buf_get(struct pipe_inode_info *pipe, struct pipe_buffer *buf)
+ {
+- get_page(buf->page);
++ return try_get_page(buf->page);
+ }
+ EXPORT_SYMBOL(generic_pipe_buf_get);
+
+diff --git a/fs/splice.c b/fs/splice.c
+index c78e0e3ff6c4..485e409ef841 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1584,7 +1584,11 @@ retry:
+ * Get a reference to this pipe buffer,
+ * so we can copy the contents over.
+ */
+- pipe_buf_get(ipipe, ibuf);
++ if (!pipe_buf_get(ipipe, ibuf)) {
++ if (ret == 0)
++ ret = -EFAULT;
++ break;
++ }
+ *obuf = *ibuf;
+
+ /*
+@@ -1658,7 +1662,11 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+ * Get a reference to this pipe buffer,
+ * so we can copy the contents over.
+ */
+- pipe_buf_get(ipipe, ibuf);
++ if (!pipe_buf_get(ipipe, ibuf)) {
++ if (ret == 0)
++ ret = -EFAULT;
++ break;
++ }
+
+ obuf = opipe->bufs + nbuf;
+ *obuf = *ibuf;
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index e899460f1bc5..bdec425c8e14 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -915,6 +915,10 @@ static inline bool is_device_public_page(const struct page *page)
+ }
+ #endif /* CONFIG_DEV_PAGEMAP_OPS */
+
++/* 127: arbitrary random number, small enough to assemble well */
++#define page_ref_zero_or_close_to_overflow(page) \
++ ((unsigned int) page_ref_count(page) + 127u <= 127u)
++
+ static inline void get_page(struct page *page)
+ {
+ page = compound_head(page);
+@@ -922,8 +926,17 @@ static inline void get_page(struct page *page)
+ * Getting a normal page or the head of a compound page
+ * requires to already have an elevated page->_refcount.
+ */
+- VM_BUG_ON_PAGE(page_ref_count(page) <= 0, page);
++ VM_BUG_ON_PAGE(page_ref_zero_or_close_to_overflow(page), page);
++ page_ref_inc(page);
++}
++
++static inline __must_check bool try_get_page(struct page *page)
++{
++ page = compound_head(page);
++ if (WARN_ON_ONCE(page_ref_count(page) <= 0))
++ return false;
+ page_ref_inc(page);
++ return true;
+ }
+
+ static inline void put_page(struct page *page)
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index 66ee63cd5968..7897a3cc05b9 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -108,18 +108,20 @@ struct pipe_buf_operations {
+ /*
+ * Get a reference to the pipe buffer.
+ */
+- void (*get)(struct pipe_inode_info *, struct pipe_buffer *);
++ bool (*get)(struct pipe_inode_info *, struct pipe_buffer *);
+ };
+
+ /**
+ * pipe_buf_get - get a reference to a pipe_buffer
+ * @pipe: the pipe that the buffer belongs to
+ * @buf: the buffer to get a reference to
++ *
++ * Return: %true if the reference was successfully obtained.
+ */
+-static inline void pipe_buf_get(struct pipe_inode_info *pipe,
++static inline __must_check bool pipe_buf_get(struct pipe_inode_info *pipe,
+ struct pipe_buffer *buf)
+ {
+- buf->ops->get(pipe, buf);
++ return buf->ops->get(pipe, buf);
+ }
+
+ /**
+@@ -178,7 +180,7 @@ struct pipe_inode_info *alloc_pipe_info(void);
+ void free_pipe_info(struct pipe_inode_info *);
+
+ /* Generic pipe buffer ops functions */
+-void generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *);
++bool generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_nosteal(struct pipe_inode_info *, struct pipe_buffer *);
+diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
+index 1be35729c2c5..660d78c9af6c 100644
+--- a/include/linux/sched/signal.h
++++ b/include/linux/sched/signal.h
+@@ -417,10 +417,20 @@ static inline void set_restore_sigmask(void)
+ set_thread_flag(TIF_RESTORE_SIGMASK);
+ WARN_ON(!test_thread_flag(TIF_SIGPENDING));
+ }
++
++static inline void clear_tsk_restore_sigmask(struct task_struct *tsk)
++{
++ clear_tsk_thread_flag(tsk, TIF_RESTORE_SIGMASK);
++}
++
+ static inline void clear_restore_sigmask(void)
+ {
+ clear_thread_flag(TIF_RESTORE_SIGMASK);
+ }
++static inline bool test_tsk_restore_sigmask(struct task_struct *tsk)
++{
++ return test_tsk_thread_flag(tsk, TIF_RESTORE_SIGMASK);
++}
+ static inline bool test_restore_sigmask(void)
+ {
+ return test_thread_flag(TIF_RESTORE_SIGMASK);
+@@ -438,6 +448,10 @@ static inline void set_restore_sigmask(void)
+ current->restore_sigmask = true;
+ WARN_ON(!test_thread_flag(TIF_SIGPENDING));
+ }
++static inline void clear_tsk_restore_sigmask(struct task_struct *tsk)
++{
++ tsk->restore_sigmask = false;
++}
+ static inline void clear_restore_sigmask(void)
+ {
+ current->restore_sigmask = false;
+@@ -446,6 +460,10 @@ static inline bool test_restore_sigmask(void)
+ {
+ return current->restore_sigmask;
+ }
++static inline bool test_tsk_restore_sigmask(struct task_struct *tsk)
++{
++ return tsk->restore_sigmask;
++}
+ static inline bool test_and_clear_restore_sigmask(void)
+ {
+ if (!current->restore_sigmask)
+diff --git a/include/net/tc_act/tc_gact.h b/include/net/tc_act/tc_gact.h
+index ef8dd0db70ce..56935bf027a7 100644
+--- a/include/net/tc_act/tc_gact.h
++++ b/include/net/tc_act/tc_gact.h
+@@ -56,7 +56,7 @@ static inline bool is_tcf_gact_goto_chain(const struct tc_action *a)
+
+ static inline u32 tcf_gact_goto_chain_index(const struct tc_action *a)
+ {
+- return a->goto_chain->index;
++ return READ_ONCE(a->tcfa_action) & TC_ACT_EXT_VAL_MASK;
+ }
+
+ #endif /* __NET_TC_GACT_H */
+diff --git a/include/net/xdp_sock.h b/include/net/xdp_sock.h
+index 7161856bcf9c..c2c10cc9ffa0 100644
+--- a/include/net/xdp_sock.h
++++ b/include/net/xdp_sock.h
+@@ -34,7 +34,6 @@ struct xdp_umem {
+ u32 headroom;
+ u32 chunk_size_nohr;
+ struct user_struct *user;
+- struct pid *pid;
+ unsigned long address;
+ refcount_t users;
+ struct work_struct work;
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index 21fec73d45d4..fc0d667f5792 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -29,6 +29,7 @@
+ #include <linux/hw_breakpoint.h>
+ #include <linux/cn_proc.h>
+ #include <linux/compat.h>
++#include <linux/sched/signal.h>
+
+ /*
+ * Access another process' address space via ptrace.
+@@ -925,18 +926,26 @@ int ptrace_request(struct task_struct *child, long request,
+ ret = ptrace_setsiginfo(child, &siginfo);
+ break;
+
+- case PTRACE_GETSIGMASK:
++ case PTRACE_GETSIGMASK: {
++ sigset_t *mask;
++
+ if (addr != sizeof(sigset_t)) {
+ ret = -EINVAL;
+ break;
+ }
+
+- if (copy_to_user(datavp, &child->blocked, sizeof(sigset_t)))
++ if (test_tsk_restore_sigmask(child))
++ mask = &child->saved_sigmask;
++ else
++ mask = &child->blocked;
++
++ if (copy_to_user(datavp, mask, sizeof(sigset_t)))
+ ret = -EFAULT;
+ else
+ ret = 0;
+
+ break;
++ }
+
+ case PTRACE_SETSIGMASK: {
+ sigset_t new_set;
+@@ -962,6 +971,8 @@ int ptrace_request(struct task_struct *child, long request,
+ child->blocked = new_set;
+ spin_unlock_irq(&child->sighand->siglock);
+
++ clear_tsk_restore_sigmask(child);
++
+ ret = 0;
+ break;
+ }
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 5455ee05bc3b..1bd7a758583b 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -6823,12 +6823,16 @@ static void buffer_pipe_buf_release(struct pipe_inode_info *pipe,
+ buf->private = 0;
+ }
+
+-static void buffer_pipe_buf_get(struct pipe_inode_info *pipe,
++static bool buffer_pipe_buf_get(struct pipe_inode_info *pipe,
+ struct pipe_buffer *buf)
+ {
+ struct buffer_ref *ref = (struct buffer_ref *)buf->private;
+
++ if (refcount_read(&ref->refcount) > INT_MAX/2)
++ return false;
++
+ refcount_inc(&ref->refcount);
++ return true;
+ }
+
+ /* Pipe buffer operations for a buffer. */
+diff --git a/mm/gup.c b/mm/gup.c
+index 0a5374e6e82d..caadd31714a5 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -153,7 +153,10 @@ retry:
+ }
+
+ if (flags & FOLL_GET) {
+- get_page(page);
++ if (unlikely(!try_get_page(page))) {
++ page = ERR_PTR(-ENOMEM);
++ goto out;
++ }
+
+ /* drop the pgmap reference now that we hold the page */
+ if (pgmap) {
+@@ -296,7 +299,10 @@ retry_locked:
+ if (pmd_trans_unstable(pmd))
+ ret = -EBUSY;
+ } else {
+- get_page(page);
++ if (unlikely(!try_get_page(page))) {
++ spin_unlock(ptl);
++ return ERR_PTR(-ENOMEM);
++ }
+ spin_unlock(ptl);
+ lock_page(page);
+ ret = split_huge_page(page);
+@@ -480,7 +486,10 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
+ if (is_device_public_page(*page))
+ goto unmap;
+ }
+- get_page(*page);
++ if (unlikely(!try_get_page(*page))) {
++ ret = -ENOMEM;
++ goto unmap;
++ }
+ out:
+ ret = 0;
+ unmap:
+@@ -1368,6 +1377,20 @@ static void undo_dev_pagemap(int *nr, int nr_start, struct page **pages)
+ }
+ }
+
++/*
++ * Return the compund head page with ref appropriately incremented,
++ * or NULL if that failed.
++ */
++static inline struct page *try_get_compound_head(struct page *page, int refs)
++{
++ struct page *head = compound_head(page);
++ if (WARN_ON_ONCE(page_ref_count(head) < 0))
++ return NULL;
++ if (unlikely(!page_cache_add_speculative(head, refs)))
++ return NULL;
++ return head;
++}
++
+ #ifdef CONFIG_ARCH_HAS_PTE_SPECIAL
+ static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
+ int write, struct page **pages, int *nr)
+@@ -1402,9 +1425,9 @@ static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
+
+ VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
+ page = pte_page(pte);
+- head = compound_head(page);
+
+- if (!page_cache_get_speculative(head))
++ head = try_get_compound_head(page, 1);
++ if (!head)
+ goto pte_unmap;
+
+ if (unlikely(pte_val(pte) != pte_val(*ptep))) {
+@@ -1543,8 +1566,8 @@ static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr,
+ refs++;
+ } while (addr += PAGE_SIZE, addr != end);
+
+- head = compound_head(pmd_page(orig));
+- if (!page_cache_add_speculative(head, refs)) {
++ head = try_get_compound_head(pmd_page(orig), refs);
++ if (!head) {
+ *nr -= refs;
+ return 0;
+ }
+@@ -1581,8 +1604,8 @@ static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr,
+ refs++;
+ } while (addr += PAGE_SIZE, addr != end);
+
+- head = compound_head(pud_page(orig));
+- if (!page_cache_add_speculative(head, refs)) {
++ head = try_get_compound_head(pud_page(orig), refs);
++ if (!head) {
+ *nr -= refs;
+ return 0;
+ }
+@@ -1618,8 +1641,8 @@ static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr,
+ refs++;
+ } while (addr += PAGE_SIZE, addr != end);
+
+- head = compound_head(pgd_page(orig));
+- if (!page_cache_add_speculative(head, refs)) {
++ head = try_get_compound_head(pgd_page(orig), refs);
++ if (!head) {
+ *nr -= refs;
+ return 0;
+ }
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 9e5f66cbf711..5fb779cda972 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4299,6 +4299,19 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
+
+ pfn_offset = (vaddr & ~huge_page_mask(h)) >> PAGE_SHIFT;
+ page = pte_page(huge_ptep_get(pte));
++
++ /*
++ * Instead of doing 'try_get_page()' below in the same_page
++ * loop, just check the count once here.
++ */
++ if (unlikely(page_count(page) <= 0)) {
++ if (pages) {
++ spin_unlock(ptl);
++ remainder = 0;
++ err = -ENOMEM;
++ break;
++ }
++ }
+ same_page:
+ if (pages) {
+ pages[i] = mem_map_offset(page, pfn_offset);
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index 3b0a03b92080..212c184c1eee 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -515,6 +515,7 @@ static unsigned int br_nf_pre_routing(void *priv,
+ nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr;
+
+ skb->protocol = htons(ETH_P_IP);
++ skb->transport_header = skb->network_header + ip_hdr(skb)->ihl * 4;
+
+ NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
+ skb->dev, NULL,
+diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
+index 5811208863b7..09d5e0c7b3ba 100644
+--- a/net/bridge/br_netfilter_ipv6.c
++++ b/net/bridge/br_netfilter_ipv6.c
+@@ -235,6 +235,8 @@ unsigned int br_nf_pre_routing_ipv6(void *priv,
+ nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;
+
+ skb->protocol = htons(ETH_P_IPV6);
++ skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
++
+ NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
+ skb->dev, NULL,
+ br_nf_pre_routing_finish_ipv6);
+diff --git a/net/ipv6/netfilter/ip6t_srh.c b/net/ipv6/netfilter/ip6t_srh.c
+index 1059894a6f4c..4cb83fb69844 100644
+--- a/net/ipv6/netfilter/ip6t_srh.c
++++ b/net/ipv6/netfilter/ip6t_srh.c
+@@ -210,6 +210,8 @@ static bool srh1_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+ psidoff = srhoff + sizeof(struct ipv6_sr_hdr) +
+ ((srh->segments_left + 1) * sizeof(struct in6_addr));
+ psid = skb_header_pointer(skb, psidoff, sizeof(_psid), &_psid);
++ if (!psid)
++ return false;
+ if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_PSID,
+ ipv6_masked_addr_cmp(psid, &srhinfo->psid_msk,
+ &srhinfo->psid_addr)))
+@@ -223,6 +225,8 @@ static bool srh1_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+ nsidoff = srhoff + sizeof(struct ipv6_sr_hdr) +
+ ((srh->segments_left - 1) * sizeof(struct in6_addr));
+ nsid = skb_header_pointer(skb, nsidoff, sizeof(_nsid), &_nsid);
++ if (!nsid)
++ return false;
+ if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_NSID,
+ ipv6_masked_addr_cmp(nsid, &srhinfo->nsid_msk,
+ &srhinfo->nsid_addr)))
+@@ -233,6 +237,8 @@ static bool srh1_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+ if (srhinfo->mt_flags & IP6T_SRH_LSID) {
+ lsidoff = srhoff + sizeof(struct ipv6_sr_hdr);
+ lsid = skb_header_pointer(skb, lsidoff, sizeof(_lsid), &_lsid);
++ if (!lsid)
++ return false;
+ if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_LSID,
+ ipv6_masked_addr_cmp(lsid, &srhinfo->lsid_msk,
+ &srhinfo->lsid_addr)))
+diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
+index f61c306de1d0..e0fb56d67d42 100644
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -1003,6 +1003,7 @@ config NETFILTER_XT_TARGET_TEE
+ depends on NETFILTER_ADVANCED
+ depends on IPV6 || IPV6=n
+ depends on !NF_CONNTRACK || NF_CONNTRACK
++ depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
+ select NF_DUP_IPV4
+ select NF_DUP_IPV6 if IP6_NF_IPTABLES
+ ---help---
+diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
+index 0e5ec126f6ad..b3e75f9cb686 100644
+--- a/net/netfilter/nft_set_rbtree.c
++++ b/net/netfilter/nft_set_rbtree.c
+@@ -302,10 +302,6 @@ static void *nft_rbtree_deactivate(const struct net *net,
+ else if (d > 0)
+ parent = parent->rb_right;
+ else {
+- if (!nft_set_elem_active(&rbe->ext, genmask)) {
+- parent = parent->rb_left;
+- continue;
+- }
+ if (nft_rbtree_interval_end(rbe) &&
+ !nft_rbtree_interval_end(this)) {
+ parent = parent->rb_left;
+@@ -314,6 +310,9 @@ static void *nft_rbtree_deactivate(const struct net *net,
+ nft_rbtree_interval_end(this)) {
+ parent = parent->rb_right;
+ continue;
++ } else if (!nft_set_elem_active(&rbe->ext, genmask)) {
++ parent = parent->rb_left;
++ continue;
+ }
+ nft_rbtree_flush(net, set, rbe);
+ return rbe;
+diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
+index bfe2dbea480b..a3b037fbfecd 100644
+--- a/net/xdp/xdp_umem.c
++++ b/net/xdp/xdp_umem.c
+@@ -152,9 +152,6 @@ static void xdp_umem_unaccount_pages(struct xdp_umem *umem)
+
+ static void xdp_umem_release(struct xdp_umem *umem)
+ {
+- struct task_struct *task;
+- struct mm_struct *mm;
+-
+ xdp_umem_clear_dev(umem);
+
+ if (umem->fq) {
+@@ -169,21 +166,10 @@ static void xdp_umem_release(struct xdp_umem *umem)
+
+ xdp_umem_unpin_pages(umem);
+
+- task = get_pid_task(umem->pid, PIDTYPE_PID);
+- put_pid(umem->pid);
+- if (!task)
+- goto out;
+- mm = get_task_mm(task);
+- put_task_struct(task);
+- if (!mm)
+- goto out;
+-
+- mmput(mm);
+ kfree(umem->pages);
+ umem->pages = NULL;
+
+ xdp_umem_unaccount_pages(umem);
+-out:
+ kfree(umem);
+ }
+
+@@ -312,7 +298,6 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
+ if (size_chk < 0)
+ return -EINVAL;
+
+- umem->pid = get_task_pid(current, PIDTYPE_PID);
+ umem->address = (unsigned long)addr;
+ umem->props.chunk_mask = ~((u64)chunk_size - 1);
+ umem->props.size = size;
+@@ -328,7 +313,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
+
+ err = xdp_umem_account_pages(umem);
+ if (err)
+- goto out;
++ return err;
+
+ err = xdp_umem_pin_pages(umem);
+ if (err)
+@@ -347,8 +332,6 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
+
+ out_account:
+ xdp_umem_unaccount_pages(umem);
+-out:
+- put_pid(umem->pid);
+ return err;
+ }
+
+diff --git a/scripts/kconfig/lxdialog/inputbox.c b/scripts/kconfig/lxdialog/inputbox.c
+index fe82ff6d744e..b15c8d1744f5 100644
+--- a/scripts/kconfig/lxdialog/inputbox.c
++++ b/scripts/kconfig/lxdialog/inputbox.c
+@@ -126,7 +126,8 @@ do_resize:
+ case KEY_DOWN:
+ break;
+ case KEY_BACKSPACE:
+- case 127:
++ case 8: /* ^H */
++ case 127: /* ^? */
+ if (pos) {
+ wattrset(dialog, dlg.inputbox.atr);
+ if (input_x == 0) {
+diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c
+index 1ef232ae5ab9..c8ff1c99dd5c 100644
+--- a/scripts/kconfig/nconf.c
++++ b/scripts/kconfig/nconf.c
+@@ -1049,7 +1049,7 @@ static int do_match(int key, struct match_state *state, int *ans)
+ state->match_direction = FIND_NEXT_MATCH_UP;
+ *ans = get_mext_match(state->pattern,
+ state->match_direction);
+- } else if (key == KEY_BACKSPACE || key == 127) {
++ } else if (key == KEY_BACKSPACE || key == 8 || key == 127) {
+ state->pattern[strlen(state->pattern)-1] = '\0';
+ adj_match_dir(&state->match_direction);
+ } else
+diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
+index 88874acfda36..820fc9256532 100644
+--- a/scripts/kconfig/nconf.gui.c
++++ b/scripts/kconfig/nconf.gui.c
+@@ -440,7 +440,8 @@ int dialog_inputbox(WINDOW *main_window,
+ case KEY_F(F_EXIT):
+ case KEY_F(F_BACK):
+ break;
+- case 127:
++ case 8: /* ^H */
++ case 127: /* ^? */
+ case KEY_BACKSPACE:
+ if (cursor_position > 0) {
+ memmove(&result[cursor_position-1],
+diff --git a/scripts/selinux/genheaders/genheaders.c b/scripts/selinux/genheaders/genheaders.c
+index fa48fabcb330..3cc4893d98cc 100644
+--- a/scripts/selinux/genheaders/genheaders.c
++++ b/scripts/selinux/genheaders/genheaders.c
+@@ -9,7 +9,6 @@
+ #include <string.h>
+ #include <errno.h>
+ #include <ctype.h>
+-#include <sys/socket.h>
+
+ struct security_class_mapping {
+ const char *name;
+diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c
+index 073fe7537f6c..6d51b74bc679 100644
+--- a/scripts/selinux/mdp/mdp.c
++++ b/scripts/selinux/mdp/mdp.c
+@@ -32,7 +32,6 @@
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include <string.h>
+-#include <sys/socket.h>
+
+ static void usage(char *name)
+ {
+diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
+index bd5fe0d3204a..201f7e588a29 100644
+--- a/security/selinux/include/classmap.h
++++ b/security/selinux/include/classmap.h
+@@ -1,5 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+ #include <linux/capability.h>
++#include <linux/socket.h>
+
+ #define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \
+ "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append", "map"
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index b1508ce3e412..076718a7b3ea 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -1358,6 +1358,20 @@ static void machine__set_kernel_mmap(struct machine *machine,
+ machine->vmlinux_map->end = ~0ULL;
+ }
+
++static void machine__update_kernel_mmap(struct machine *machine,
++ u64 start, u64 end)
++{
++ struct map *map = machine__kernel_map(machine);
++
++ map__get(map);
++ map_groups__remove(&machine->kmaps, map);
++
++ machine__set_kernel_mmap(machine, start, end);
++
++ map_groups__insert(&machine->kmaps, map);
++ map__put(map);
++}
++
+ int machine__create_kernel_maps(struct machine *machine)
+ {
+ struct dso *kernel = machine__get_kernel(machine);
+@@ -1390,17 +1404,11 @@ int machine__create_kernel_maps(struct machine *machine)
+ goto out_put;
+ }
+
+- /* we have a real start address now, so re-order the kmaps */
+- map = machine__kernel_map(machine);
+-
+- map__get(map);
+- map_groups__remove(&machine->kmaps, map);
+-
+- /* assume it's the last in the kmaps */
+- machine__set_kernel_mmap(machine, addr, ~0ULL);
+-
+- map_groups__insert(&machine->kmaps, map);
+- map__put(map);
++ /*
++ * we have a real start address now, so re-order the kmaps
++ * assume it's the last in the kmaps
++ */
++ machine__update_kernel_mmap(machine, addr, ~0ULL);
+ }
+
+ if (machine__create_extra_kernel_maps(machine, kernel))
+@@ -1536,7 +1544,7 @@ static int machine__process_kernel_mmap_event(struct machine *machine,
+ if (strstr(kernel->long_name, "vmlinux"))
+ dso__set_short_name(kernel, "[kernel.vmlinux]", false);
+
+- machine__set_kernel_mmap(machine, event->mmap.start,
++ machine__update_kernel_mmap(machine, event->mmap.start,
+ event->mmap.start + event->mmap.len);
+
+ /*
+diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
+index f376c82afb61..621bb004067e 100644
+--- a/virt/kvm/arm/vgic/vgic-its.c
++++ b/virt/kvm/arm/vgic/vgic-its.c
+@@ -760,8 +760,9 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id,
+ int l1_tbl_size = GITS_BASER_NR_PAGES(baser) * SZ_64K;
+ u64 indirect_ptr, type = GITS_BASER_TYPE(baser);
+ int esz = GITS_BASER_ENTRY_SIZE(baser);
+- int index;
++ int index, idx;
+ gfn_t gfn;
++ bool ret;
+
+ switch (type) {
+ case GITS_BASER_TYPE_DEVICE:
+@@ -788,7 +789,8 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id,
+
+ if (eaddr)
+ *eaddr = addr;
+- return kvm_is_visible_gfn(its->dev->kvm, gfn);
++
++ goto out;
+ }
+
+ /* calculate and check the index into the 1st level */
+@@ -822,7 +824,12 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id,
+
+ if (eaddr)
+ *eaddr = indirect_ptr;
+- return kvm_is_visible_gfn(its->dev->kvm, gfn);
++
++out:
++ idx = srcu_read_lock(&its->dev->kvm->srcu);
++ ret = kvm_is_visible_gfn(its->dev->kvm, gfn);
++ srcu_read_unlock(&its->dev->kvm->srcu, idx);
++ return ret;
+ }
+
+ static int vgic_its_alloc_collection(struct vgic_its *its,
+@@ -1935,7 +1942,7 @@ static int vgic_its_save_ite(struct vgic_its *its, struct its_device *dev,
+ ((u64)ite->irq->intid << KVM_ITS_ITE_PINTID_SHIFT) |
+ ite->collection->collection_id;
+ val = cpu_to_le64(val);
+- return kvm_write_guest(kvm, gpa, &val, ite_esz);
++ return kvm_write_guest_lock(kvm, gpa, &val, ite_esz);
+ }
+
+ /**
+@@ -2082,7 +2089,7 @@ static int vgic_its_save_dte(struct vgic_its *its, struct its_device *dev,
+ (itt_addr_field << KVM_ITS_DTE_ITTADDR_SHIFT) |
+ (dev->num_eventid_bits - 1));
+ val = cpu_to_le64(val);
+- return kvm_write_guest(kvm, ptr, &val, dte_esz);
++ return kvm_write_guest_lock(kvm, ptr, &val, dte_esz);
+ }
+
+ /**
+@@ -2262,7 +2269,7 @@ static int vgic_its_save_cte(struct vgic_its *its,
+ ((u64)collection->target_addr << KVM_ITS_CTE_RDBASE_SHIFT) |
+ collection->collection_id);
+ val = cpu_to_le64(val);
+- return kvm_write_guest(its->dev->kvm, gpa, &val, esz);
++ return kvm_write_guest_lock(its->dev->kvm, gpa, &val, esz);
+ }
+
+ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz)
+@@ -2333,7 +2340,7 @@ static int vgic_its_save_collection_table(struct vgic_its *its)
+ */
+ val = 0;
+ BUG_ON(cte_esz > sizeof(val));
+- ret = kvm_write_guest(its->dev->kvm, gpa, &val, cte_esz);
++ ret = kvm_write_guest_lock(its->dev->kvm, gpa, &val, cte_esz);
+ return ret;
+ }
+
+diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
+index 9c0dd234ebe8..3f2350a4d4ab 100644
+--- a/virt/kvm/arm/vgic/vgic-v3.c
++++ b/virt/kvm/arm/vgic/vgic-v3.c
+@@ -358,7 +358,7 @@ retry:
+ if (status) {
+ /* clear consumed data */
+ val &= ~(1 << bit_nr);
+- ret = kvm_write_guest(kvm, ptr, &val, 1);
++ ret = kvm_write_guest_lock(kvm, ptr, &val, 1);
+ if (ret)
+ return ret;
+ }
+@@ -409,7 +409,7 @@ int vgic_v3_save_pending_tables(struct kvm *kvm)
+ else
+ val &= ~(1 << bit_nr);
+
+- ret = kvm_write_guest(kvm, ptr, &val, 1);
++ ret = kvm_write_guest_lock(kvm, ptr, &val, 1);
+ if (ret)
+ return ret;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-05-05 13:42 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-05-05 13:42 UTC (permalink / raw
To: gentoo-commits
commit: b058d6c4cd938dce578766f72dd910dabf3db4ab
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun May 5 13:41:52 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun May 5 13:41:52 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b058d6c4
Linux patch 4.19.40
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1039_linux-4.19.40.patch | 1032 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1036 insertions(+)
diff --git a/0000_README b/0000_README
index be92968..27107b1 100644
--- a/0000_README
+++ b/0000_README
@@ -199,6 +199,10 @@ Patch: 1038_linux-4.19.39.patch
From: http://www.kernel.org
Desc: Linux 4.19.39
+Patch: 1039_linux-4.19.40.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.40
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1039_linux-4.19.40.patch b/1039_linux-4.19.40.patch
new file mode 100644
index 0000000..6263b35
--- /dev/null
+++ b/1039_linux-4.19.40.patch
@@ -0,0 +1,1032 @@
+diff --git a/Makefile b/Makefile
+index be1bd297bca9..3822720a8a1c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 39
++SUBLEVEL = 40
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
+index fd23d5778ea1..f1645578d9d0 100644
+--- a/arch/x86/include/uapi/asm/kvm.h
++++ b/arch/x86/include/uapi/asm/kvm.h
+@@ -378,6 +378,7 @@ struct kvm_sync_regs {
+ #define KVM_X86_QUIRK_LINT0_REENABLED (1 << 0)
+ #define KVM_X86_QUIRK_CD_NW_CLEARED (1 << 1)
+ #define KVM_X86_QUIRK_LAPIC_MMIO_HOLE (1 << 2)
++#define KVM_X86_QUIRK_OUT_7E_INC_RIP (1 << 3)
+
+ #define KVM_STATE_NESTED_GUEST_MODE 0x00000001
+ #define KVM_STATE_NESTED_RUN_PENDING 0x00000002
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 3380a312d186..215339c7d161 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -14236,7 +14236,7 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
+ return ret;
+
+ /* Empty 'VMXON' state is permitted */
+- if (kvm_state->size < sizeof(kvm_state) + sizeof(*vmcs12))
++ if (kvm_state->size < sizeof(*kvm_state) + sizeof(*vmcs12))
+ return 0;
+
+ if (kvm_state->vmx.vmcs_pa == kvm_state->vmx.vmxon_pa ||
+@@ -14269,7 +14269,7 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
+ if (nested_cpu_has_shadow_vmcs(vmcs12) &&
+ vmcs12->vmcs_link_pointer != -1ull) {
+ struct vmcs12 *shadow_vmcs12 = get_shadow_vmcs12(vcpu);
+- if (kvm_state->size < sizeof(kvm_state) + 2 * sizeof(*vmcs12))
++ if (kvm_state->size < sizeof(*kvm_state) + 2 * sizeof(*vmcs12))
+ return -EINVAL;
+
+ if (copy_from_user(shadow_vmcs12,
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 4a61e1609c97..f3337adaf9b3 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6328,6 +6328,12 @@ int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu,
+ }
+ EXPORT_SYMBOL_GPL(kvm_emulate_instruction_from_buffer);
+
++static int complete_fast_pio_out_port_0x7e(struct kvm_vcpu *vcpu)
++{
++ vcpu->arch.pio.count = 0;
++ return 1;
++}
++
+ static int complete_fast_pio_out(struct kvm_vcpu *vcpu)
+ {
+ vcpu->arch.pio.count = 0;
+@@ -6344,12 +6350,23 @@ static int kvm_fast_pio_out(struct kvm_vcpu *vcpu, int size,
+ unsigned long val = kvm_register_read(vcpu, VCPU_REGS_RAX);
+ int ret = emulator_pio_out_emulated(&vcpu->arch.emulate_ctxt,
+ size, port, &val, 1);
++ if (ret)
++ return ret;
+
+- if (!ret) {
++ /*
++ * Workaround userspace that relies on old KVM behavior of %rip being
++ * incremented prior to exiting to userspace to handle "OUT 0x7e".
++ */
++ if (port == 0x7e &&
++ kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_OUT_7E_INC_RIP)) {
++ vcpu->arch.complete_userspace_io =
++ complete_fast_pio_out_port_0x7e;
++ kvm_skip_emulated_instruction(vcpu);
++ } else {
+ vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu);
+ vcpu->arch.complete_userspace_io = complete_fast_pio_out;
+ }
+- return ret;
++ return 0;
+ }
+
+ static int complete_fast_pio_in(struct kvm_vcpu *vcpu)
+diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
+index 47c5f272a084..21db1804e85d 100644
+--- a/drivers/net/dsa/bcm_sf2_cfp.c
++++ b/drivers/net/dsa/bcm_sf2_cfp.c
+@@ -742,6 +742,9 @@ static int bcm_sf2_cfp_rule_set(struct dsa_switch *ds, int port,
+ fs->m_ext.data[1]))
+ return -EINVAL;
+
++ if (fs->location != RX_CLS_LOC_ANY && fs->location >= CFP_NUM_RULES)
++ return -EINVAL;
++
+ if (fs->location != RX_CLS_LOC_ANY &&
+ test_bit(fs->location, priv->cfp.used))
+ return -EBUSY;
+@@ -836,6 +839,9 @@ static int bcm_sf2_cfp_rule_del(struct bcm_sf2_priv *priv, int port,
+ u32 next_loc = 0;
+ int ret;
+
++ if (loc >= CFP_NUM_RULES)
++ return -EINVAL;
++
+ /* Refuse deleting unused rules, and those that are not unique since
+ * that could leave IPv6 rules with one of the chained rule in the
+ * table.
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 581ad0a17d0c..de46331aefc1 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1584,7 +1584,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons,
+ netdev_warn(bp->dev, "RX buffer error %x\n", rx_err);
+ bnxt_sched_reset(bp, rxr);
+ }
+- goto next_rx;
++ goto next_rx_no_len;
+ }
+
+ len = le32_to_cpu(rxcmp->rx_cmp_len_flags_type) >> RX_CMP_LEN_SHIFT;
+@@ -1665,12 +1665,13 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons,
+ rc = 1;
+
+ next_rx:
+- rxr->rx_prod = NEXT_RX(prod);
+- rxr->rx_next_cons = NEXT_RX(cons);
+-
+ cpr->rx_packets += 1;
+ cpr->rx_bytes += len;
+
++next_rx_no_len:
++ rxr->rx_prod = NEXT_RX(prod);
++ rxr->rx_next_cons = NEXT_RX(cons);
++
+ next_rx_no_prod_no_len:
+ *raw_cons = tmp_raw_cons;
+
+@@ -7441,8 +7442,15 @@ static int bnxt_cfg_rx_mode(struct bnxt *bp)
+
+ skip_uc:
+ rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0);
++ if (rc && vnic->mc_list_count) {
++ netdev_info(bp->dev, "Failed setting MC filters rc: %d, turning on ALL_MCAST mode\n",
++ rc);
++ vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;
++ vnic->mc_list_count = 0;
++ rc = bnxt_hwrm_cfa_l2_set_rx_mask(bp, 0);
++ }
+ if (rc)
+- netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %x\n",
++ netdev_err(bp->dev, "HWRM cfa l2 rx mask failure rc: %d\n",
+ rc);
+
+ return rc;
+@@ -9077,6 +9085,7 @@ init_err_cleanup_tc:
+ bnxt_clear_int_mode(bp);
+
+ init_err_pci_clean:
++ bnxt_free_hwrm_short_cmd_req(bp);
+ bnxt_free_hwrm_resources(bp);
+ bnxt_cleanup_pci(bp);
+
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 73813c7afa49..bb6107f3b947 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -1513,9 +1513,10 @@ static int marvell_get_sset_count(struct phy_device *phydev)
+
+ static void marvell_get_strings(struct phy_device *phydev, u8 *data)
+ {
++ int count = marvell_get_sset_count(phydev);
+ int i;
+
+- for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++) {
++ for (i = 0; i < count; i++) {
+ strlcpy(data + i * ETH_GSTRING_LEN,
+ marvell_hw_stats[i].string, ETH_GSTRING_LEN);
+ }
+@@ -1543,9 +1544,10 @@ static u64 marvell_get_stat(struct phy_device *phydev, int i)
+ static void marvell_get_stats(struct phy_device *phydev,
+ struct ethtool_stats *stats, u64 *data)
+ {
++ int count = marvell_get_sset_count(phydev);
+ int i;
+
+- for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++)
++ for (i = 0; i < count; i++)
+ data[i] = marvell_get_stat(phydev, i);
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 90f9372dec25..f3b1cfacfe9d 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -5622,7 +5622,7 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
+ }
+
+ if (changed & BSS_CHANGED_MCAST_RATE &&
+- !WARN_ON(ath10k_mac_vif_chan(arvif->vif, &def))) {
++ !ath10k_mac_vif_chan(arvif->vif, &def)) {
+ band = def.chan->band;
+ rateidx = vif->bss_conf.mcast_rate[band] - 1;
+
+diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
+index 6640f84fe536..6d5beac29bc1 100644
+--- a/include/net/sctp/command.h
++++ b/include/net/sctp/command.h
+@@ -105,7 +105,6 @@ enum sctp_verb {
+ SCTP_CMD_T1_RETRAN, /* Mark for retransmission after T1 timeout */
+ SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */
+ SCTP_CMD_SEND_MSG, /* Send the whole use message */
+- SCTP_CMD_SEND_NEXT_ASCONF, /* Send the next ASCONF after ACK */
+ SCTP_CMD_PURGE_ASCONF_QUEUE, /* Purge all asconf queues.*/
+ SCTP_CMD_SET_ASOC, /* Restore association context */
+ SCTP_CMD_LAST
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 9c4e72e9c60a..73894ed12a70 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -519,6 +519,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
+ to->pkt_type = from->pkt_type;
+ to->priority = from->priority;
+ to->protocol = from->protocol;
++ to->skb_iif = from->skb_iif;
+ skb_dst_drop(to);
+ skb_dst_copy(to, from);
+ to->dev = from->dev;
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index cbe46175bb59..3e2a9bd3459c 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -889,9 +889,7 @@ static void fib6_drop_pcpu_from(struct fib6_info *f6i,
+ if (pcpu_rt) {
+ struct fib6_info *from;
+
+- from = rcu_dereference_protected(pcpu_rt->from,
+- lockdep_is_held(&table->tb6_lock));
+- rcu_assign_pointer(pcpu_rt->from, NULL);
++ from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL);
+ fib6_info_release(from);
+ }
+ }
+diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
+index cb54a8a3c273..be5f3d7ceb96 100644
+--- a/net/ipv6/ip6_flowlabel.c
++++ b/net/ipv6/ip6_flowlabel.c
+@@ -94,15 +94,21 @@ static struct ip6_flowlabel *fl_lookup(struct net *net, __be32 label)
+ return fl;
+ }
+
++static void fl_free_rcu(struct rcu_head *head)
++{
++ struct ip6_flowlabel *fl = container_of(head, struct ip6_flowlabel, rcu);
++
++ if (fl->share == IPV6_FL_S_PROCESS)
++ put_pid(fl->owner.pid);
++ kfree(fl->opt);
++ kfree(fl);
++}
++
+
+ static void fl_free(struct ip6_flowlabel *fl)
+ {
+- if (fl) {
+- if (fl->share == IPV6_FL_S_PROCESS)
+- put_pid(fl->owner.pid);
+- kfree(fl->opt);
+- kfree_rcu(fl, rcu);
+- }
++ if (fl)
++ call_rcu(&fl->rcu, fl_free_rcu);
+ }
+
+ static void fl_release(struct ip6_flowlabel *fl)
+@@ -633,9 +639,9 @@ recheck:
+ if (fl1->share == IPV6_FL_S_EXCL ||
+ fl1->share != fl->share ||
+ ((fl1->share == IPV6_FL_S_PROCESS) &&
+- (fl1->owner.pid == fl->owner.pid)) ||
++ (fl1->owner.pid != fl->owner.pid)) ||
+ ((fl1->share == IPV6_FL_S_USER) &&
+- uid_eq(fl1->owner.uid, fl->owner.uid)))
++ !uid_eq(fl1->owner.uid, fl->owner.uid)))
+ goto release;
+
+ err = -ENOMEM;
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 06fa8425d82c..2e519f7b983c 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -382,11 +382,8 @@ static void ip6_dst_destroy(struct dst_entry *dst)
+ in6_dev_put(idev);
+ }
+
+- rcu_read_lock();
+- from = rcu_dereference(rt->from);
+- rcu_assign_pointer(rt->from, NULL);
++ from = xchg((__force struct fib6_info **)&rt->from, NULL);
+ fib6_info_release(from);
+- rcu_read_unlock();
+ }
+
+ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+@@ -1296,9 +1293,7 @@ static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
+ /* purge completely the exception to allow releasing the held resources:
+ * some [sk] cache may keep the dst around for unlimited time
+ */
+- from = rcu_dereference_protected(rt6_ex->rt6i->from,
+- lockdep_is_held(&rt6_exception_lock));
+- rcu_assign_pointer(rt6_ex->rt6i->from, NULL);
++ from = xchg((__force struct fib6_info **)&rt6_ex->rt6i->from, NULL);
+ fib6_info_release(from);
+ dst_dev_put(&rt6_ex->rt6i->dst);
+
+@@ -3454,11 +3449,8 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
+
+ rcu_read_lock();
+ from = rcu_dereference(rt->from);
+- /* This fib6_info_hold() is safe here because we hold reference to rt
+- * and rt already holds reference to fib6_info.
+- */
+- fib6_info_hold(from);
+- rcu_read_unlock();
++ if (!from)
++ goto out;
+
+ nrt = ip6_rt_cache_alloc(from, &msg->dest, NULL);
+ if (!nrt)
+@@ -3470,10 +3462,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
+
+ nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key;
+
+- /* No need to remove rt from the exception table if rt is
+- * a cached route because rt6_insert_exception() will
+- * takes care of it
+- */
++ /* rt6_insert_exception() will take care of duplicated exceptions */
+ if (rt6_insert_exception(nrt, from)) {
+ dst_release_immediate(&nrt->dst);
+ goto out;
+@@ -3486,7 +3475,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
+ call_netevent_notifiers(NETEVENT_REDIRECT, &netevent);
+
+ out:
+- fib6_info_release(from);
++ rcu_read_unlock();
+ neigh_release(neigh);
+ }
+
+@@ -4991,16 +4980,20 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
+
+ rcu_read_lock();
+ from = rcu_dereference(rt->from);
+-
+- if (fibmatch)
+- err = rt6_fill_node(net, skb, from, NULL, NULL, NULL, iif,
+- RTM_NEWROUTE, NETLINK_CB(in_skb).portid,
+- nlh->nlmsg_seq, 0);
+- else
+- err = rt6_fill_node(net, skb, from, dst, &fl6.daddr,
+- &fl6.saddr, iif, RTM_NEWROUTE,
+- NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
+- 0);
++ if (from) {
++ if (fibmatch)
++ err = rt6_fill_node(net, skb, from, NULL, NULL, NULL,
++ iif, RTM_NEWROUTE,
++ NETLINK_CB(in_skb).portid,
++ nlh->nlmsg_seq, 0);
++ else
++ err = rt6_fill_node(net, skb, from, dst, &fl6.daddr,
++ &fl6.saddr, iif, RTM_NEWROUTE,
++ NETLINK_CB(in_skb).portid,
++ nlh->nlmsg_seq, 0);
++ } else {
++ err = -ENETUNREACH;
++ }
+ rcu_read_unlock();
+
+ if (err < 0) {
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index fed6becc5daf..52b5a2797c0c 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -169,8 +169,8 @@ struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
+
+ rcu_read_lock_bh();
+ list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
+- if (tunnel->tunnel_id == tunnel_id) {
+- l2tp_tunnel_inc_refcount(tunnel);
++ if (tunnel->tunnel_id == tunnel_id &&
++ refcount_inc_not_zero(&tunnel->ref_count)) {
+ rcu_read_unlock_bh();
+
+ return tunnel;
+@@ -190,8 +190,8 @@ struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth)
+
+ rcu_read_lock_bh();
+ list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
+- if (++count > nth) {
+- l2tp_tunnel_inc_refcount(tunnel);
++ if (++count > nth &&
++ refcount_inc_not_zero(&tunnel->ref_count)) {
+ rcu_read_unlock_bh();
+ return tunnel;
+ }
+@@ -909,7 +909,7 @@ int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+ {
+ struct l2tp_tunnel *tunnel;
+
+- tunnel = l2tp_tunnel(sk);
++ tunnel = rcu_dereference_sk_user_data(sk);
+ if (tunnel == NULL)
+ goto pass_up;
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index a0d295478e69..ebbb30064251 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2603,8 +2603,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ void *ph;
+ DECLARE_SOCKADDR(struct sockaddr_ll *, saddr, msg->msg_name);
+ bool need_wait = !(msg->msg_flags & MSG_DONTWAIT);
++ unsigned char *addr = NULL;
+ int tp_len, size_max;
+- unsigned char *addr;
+ void *data;
+ int len_sum = 0;
+ int status = TP_STATUS_AVAILABLE;
+@@ -2615,7 +2615,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ if (likely(saddr == NULL)) {
+ dev = packet_cached_dev_get(po);
+ proto = po->num;
+- addr = NULL;
+ } else {
+ err = -EINVAL;
+ if (msg->msg_namelen < sizeof(struct sockaddr_ll))
+@@ -2625,10 +2624,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ sll_addr)))
+ goto out;
+ proto = saddr->sll_protocol;
+- addr = saddr->sll_halen ? saddr->sll_addr : NULL;
+ dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
+- if (addr && dev && saddr->sll_halen < dev->addr_len)
+- goto out_put;
++ if (po->sk.sk_socket->type == SOCK_DGRAM) {
++ if (dev && msg->msg_namelen < dev->addr_len +
++ offsetof(struct sockaddr_ll, sll_addr))
++ goto out_put;
++ addr = saddr->sll_addr;
++ }
+ }
+
+ err = -ENXIO;
+@@ -2800,7 +2802,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ struct sk_buff *skb;
+ struct net_device *dev;
+ __be16 proto;
+- unsigned char *addr;
++ unsigned char *addr = NULL;
+ int err, reserve = 0;
+ struct sockcm_cookie sockc;
+ struct virtio_net_hdr vnet_hdr = { 0 };
+@@ -2817,7 +2819,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ if (likely(saddr == NULL)) {
+ dev = packet_cached_dev_get(po);
+ proto = po->num;
+- addr = NULL;
+ } else {
+ err = -EINVAL;
+ if (msg->msg_namelen < sizeof(struct sockaddr_ll))
+@@ -2825,10 +2826,13 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
+ goto out;
+ proto = saddr->sll_protocol;
+- addr = saddr->sll_halen ? saddr->sll_addr : NULL;
+ dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
+- if (addr && dev && saddr->sll_halen < dev->addr_len)
+- goto out_unlock;
++ if (sock->type == SOCK_DGRAM) {
++ if (dev && msg->msg_namelen < dev->addr_len +
++ offsetof(struct sockaddr_ll, sll_addr))
++ goto out_unlock;
++ addr = saddr->sll_addr;
++ }
+ }
+
+ err = -ENXIO;
+diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
+index 8f1a8f85b1f9..215f4d98baa0 100644
+--- a/net/rxrpc/call_object.c
++++ b/net/rxrpc/call_object.c
+@@ -701,30 +701,30 @@ void rxrpc_destroy_all_calls(struct rxrpc_net *rxnet)
+
+ _enter("");
+
+- if (list_empty(&rxnet->calls))
+- return;
++ if (!list_empty(&rxnet->calls)) {
++ write_lock(&rxnet->call_lock);
+
+- write_lock(&rxnet->call_lock);
++ while (!list_empty(&rxnet->calls)) {
++ call = list_entry(rxnet->calls.next,
++ struct rxrpc_call, link);
++ _debug("Zapping call %p", call);
+
+- while (!list_empty(&rxnet->calls)) {
+- call = list_entry(rxnet->calls.next, struct rxrpc_call, link);
+- _debug("Zapping call %p", call);
++ rxrpc_see_call(call);
++ list_del_init(&call->link);
+
+- rxrpc_see_call(call);
+- list_del_init(&call->link);
++ pr_err("Call %p still in use (%d,%s,%lx,%lx)!\n",
++ call, atomic_read(&call->usage),
++ rxrpc_call_states[call->state],
++ call->flags, call->events);
+
+- pr_err("Call %p still in use (%d,%s,%lx,%lx)!\n",
+- call, atomic_read(&call->usage),
+- rxrpc_call_states[call->state],
+- call->flags, call->events);
++ write_unlock(&rxnet->call_lock);
++ cond_resched();
++ write_lock(&rxnet->call_lock);
++ }
+
+ write_unlock(&rxnet->call_lock);
+- cond_resched();
+- write_lock(&rxnet->call_lock);
+ }
+
+- write_unlock(&rxnet->call_lock);
+-
+ atomic_dec(&rxnet->nr_calls);
+ wait_var_event(&rxnet->nr_calls, !atomic_read(&rxnet->nr_calls));
+ }
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 85d393090238..48fe8f01265f 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -1112,32 +1112,6 @@ static void sctp_cmd_send_msg(struct sctp_association *asoc,
+ }
+
+
+-/* Sent the next ASCONF packet currently stored in the association.
+- * This happens after the ASCONF_ACK was succeffully processed.
+- */
+-static void sctp_cmd_send_asconf(struct sctp_association *asoc)
+-{
+- struct net *net = sock_net(asoc->base.sk);
+-
+- /* Send the next asconf chunk from the addip chunk
+- * queue.
+- */
+- if (!list_empty(&asoc->addip_chunk_list)) {
+- struct list_head *entry = asoc->addip_chunk_list.next;
+- struct sctp_chunk *asconf = list_entry(entry,
+- struct sctp_chunk, list);
+- list_del_init(entry);
+-
+- /* Hold the chunk until an ASCONF_ACK is received. */
+- sctp_chunk_hold(asconf);
+- if (sctp_primitive_ASCONF(net, asoc, asconf))
+- sctp_chunk_free(asconf);
+- else
+- asoc->addip_last_asconf = asconf;
+- }
+-}
+-
+-
+ /* These three macros allow us to pull the debugging code out of the
+ * main flow of sctp_do_sm() to keep attention focused on the real
+ * functionality there.
+@@ -1783,9 +1757,6 @@ static int sctp_cmd_interpreter(enum sctp_event event_type,
+ }
+ sctp_cmd_send_msg(asoc, cmd->obj.msg, gfp);
+ break;
+- case SCTP_CMD_SEND_NEXT_ASCONF:
+- sctp_cmd_send_asconf(asoc);
+- break;
+ case SCTP_CMD_PURGE_ASCONF_QUEUE:
+ sctp_asconf_queue_teardown(asoc);
+ break;
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index c9ae3404b1bb..713a669d2058 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -3824,6 +3824,29 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net,
+ return SCTP_DISPOSITION_CONSUME;
+ }
+
++static enum sctp_disposition sctp_send_next_asconf(
++ struct net *net,
++ const struct sctp_endpoint *ep,
++ struct sctp_association *asoc,
++ const union sctp_subtype type,
++ struct sctp_cmd_seq *commands)
++{
++ struct sctp_chunk *asconf;
++ struct list_head *entry;
++
++ if (list_empty(&asoc->addip_chunk_list))
++ return SCTP_DISPOSITION_CONSUME;
++
++ entry = asoc->addip_chunk_list.next;
++ asconf = list_entry(entry, struct sctp_chunk, list);
++
++ list_del_init(entry);
++ sctp_chunk_hold(asconf);
++ asoc->addip_last_asconf = asconf;
++
++ return sctp_sf_do_prm_asconf(net, ep, asoc, type, asconf, commands);
++}
++
+ /*
+ * ADDIP Section 4.3 General rules for address manipulation
+ * When building TLV parameters for the ASCONF Chunk that will add or
+@@ -3915,14 +3938,10 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
+ SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
+
+ if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
+- asconf_ack)) {
+- /* Successfully processed ASCONF_ACK. We can
+- * release the next asconf if we have one.
+- */
+- sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
+- SCTP_NULL());
+- return SCTP_DISPOSITION_CONSUME;
+- }
++ asconf_ack))
++ return sctp_send_next_asconf(net, ep,
++ (struct sctp_association *)asoc,
++ type, commands);
+
+ abort = sctp_make_abort(asoc, asconf_ack,
+ sizeof(struct sctp_errhdr));
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index c9588b682db4..f4a19eac975d 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -569,7 +569,7 @@ void handle_device_resync(struct sock *sk, u32 seq, u64 rcd_sn)
+ static int tls_device_reencrypt(struct sock *sk, struct sk_buff *skb)
+ {
+ struct strp_msg *rxm = strp_msg(skb);
+- int err = 0, offset = rxm->offset, copy, nsg;
++ int err = 0, offset = rxm->offset, copy, nsg, data_len, pos;
+ struct sk_buff *skb_iter, *unused;
+ struct scatterlist sg[1];
+ char *orig_buf, *buf;
+@@ -600,25 +600,42 @@ static int tls_device_reencrypt(struct sock *sk, struct sk_buff *skb)
+ else
+ err = 0;
+
+- copy = min_t(int, skb_pagelen(skb) - offset,
+- rxm->full_len - TLS_CIPHER_AES_GCM_128_TAG_SIZE);
++ data_len = rxm->full_len - TLS_CIPHER_AES_GCM_128_TAG_SIZE;
+
+- if (skb->decrypted)
+- skb_store_bits(skb, offset, buf, copy);
++ if (skb_pagelen(skb) > offset) {
++ copy = min_t(int, skb_pagelen(skb) - offset, data_len);
+
+- offset += copy;
+- buf += copy;
++ if (skb->decrypted)
++ skb_store_bits(skb, offset, buf, copy);
+
++ offset += copy;
++ buf += copy;
++ }
++
++ pos = skb_pagelen(skb);
+ skb_walk_frags(skb, skb_iter) {
+- copy = min_t(int, skb_iter->len,
+- rxm->full_len - offset + rxm->offset -
+- TLS_CIPHER_AES_GCM_128_TAG_SIZE);
++ int frag_pos;
++
++ /* Practically all frags must belong to msg if reencrypt
++ * is needed with current strparser and coalescing logic,
++ * but strparser may "get optimized", so let's be safe.
++ */
++ if (pos + skb_iter->len <= offset)
++ goto done_with_frag;
++ if (pos >= data_len + rxm->offset)
++ break;
++
++ frag_pos = offset - pos;
++ copy = min_t(int, skb_iter->len - frag_pos,
++ data_len + rxm->offset - offset);
+
+ if (skb_iter->decrypted)
+- skb_store_bits(skb_iter, offset, buf, copy);
++ skb_store_bits(skb_iter, frag_pos, buf, copy);
+
+ offset += copy;
+ buf += copy;
++done_with_frag:
++ pos += skb_iter->len;
+ }
+
+ free_buf:
+diff --git a/net/tls/tls_device_fallback.c b/net/tls/tls_device_fallback.c
+index ef8934fd8698..426dd97725e4 100644
+--- a/net/tls/tls_device_fallback.c
++++ b/net/tls/tls_device_fallback.c
+@@ -200,13 +200,14 @@ static void complete_skb(struct sk_buff *nskb, struct sk_buff *skb, int headln)
+
+ skb_put(nskb, skb->len);
+ memcpy(nskb->data, skb->data, headln);
+- update_chksum(nskb, headln);
+
+ nskb->destructor = skb->destructor;
+ nskb->sk = sk;
+ skb->destructor = NULL;
+ skb->sk = NULL;
+
++ update_chksum(nskb, headln);
++
+ delta = nskb->truesize - skb->truesize;
+ if (likely(delta < 0))
+ WARN_ON_ONCE(refcount_sub_and_test(-delta, &sk->sk_wmem_alloc));
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index c1376bfdc90b..aa28510d23ad 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -351,12 +351,16 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
+ {
+ struct usb_device *usbdev = line6->usbdev;
+ int ret;
+- unsigned char len;
++ unsigned char *len;
+ unsigned count;
+
+ if (address > 0xffff || datalen > 0xff)
+ return -EINVAL;
+
++ len = kmalloc(sizeof(*len), GFP_KERNEL);
++ if (!len)
++ return -ENOMEM;
++
+ /* query the serial number: */
+ ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+@@ -365,7 +369,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
+
+ if (ret < 0) {
+ dev_err(line6->ifcdev, "read request failed (error %d)\n", ret);
+- return ret;
++ goto exit;
+ }
+
+ /* Wait for data length. We'll get 0xff until length arrives. */
+@@ -375,28 +379,29 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
+ ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE |
+ USB_DIR_IN,
+- 0x0012, 0x0000, &len, 1,
++ 0x0012, 0x0000, len, 1,
+ LINE6_TIMEOUT * HZ);
+ if (ret < 0) {
+ dev_err(line6->ifcdev,
+ "receive length failed (error %d)\n", ret);
+- return ret;
++ goto exit;
+ }
+
+- if (len != 0xff)
++ if (*len != 0xff)
+ break;
+ }
+
+- if (len == 0xff) {
++ ret = -EIO;
++ if (*len == 0xff) {
+ dev_err(line6->ifcdev, "read failed after %d retries\n",
+ count);
+- return -EIO;
+- } else if (len != datalen) {
++ goto exit;
++ } else if (*len != datalen) {
+ /* should be equal or something went wrong */
+ dev_err(line6->ifcdev,
+ "length mismatch (expected %d, got %d)\n",
+- (int)datalen, (int)len);
+- return -EIO;
++ (int)datalen, (int)*len);
++ goto exit;
+ }
+
+ /* receive the result: */
+@@ -405,12 +410,12 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
+ 0x0013, 0x0000, data, datalen,
+ LINE6_TIMEOUT * HZ);
+
+- if (ret < 0) {
++ if (ret < 0)
+ dev_err(line6->ifcdev, "read failed (error %d)\n", ret);
+- return ret;
+- }
+
+- return 0;
++exit:
++ kfree(len);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(line6_read_data);
+
+@@ -422,12 +427,16 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
+ {
+ struct usb_device *usbdev = line6->usbdev;
+ int ret;
+- unsigned char status;
++ unsigned char *status;
+ int count;
+
+ if (address > 0xffff || datalen > 0xffff)
+ return -EINVAL;
+
++ status = kmalloc(sizeof(*status), GFP_KERNEL);
++ if (!status)
++ return -ENOMEM;
++
+ ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+ 0x0022, address, data, datalen,
+@@ -436,7 +445,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
+ if (ret < 0) {
+ dev_err(line6->ifcdev,
+ "write request failed (error %d)\n", ret);
+- return ret;
++ goto exit;
+ }
+
+ for (count = 0; count < LINE6_READ_WRITE_MAX_RETRIES; count++) {
+@@ -447,28 +456,29 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE |
+ USB_DIR_IN,
+ 0x0012, 0x0000,
+- &status, 1, LINE6_TIMEOUT * HZ);
++ status, 1, LINE6_TIMEOUT * HZ);
+
+ if (ret < 0) {
+ dev_err(line6->ifcdev,
+ "receiving status failed (error %d)\n", ret);
+- return ret;
++ goto exit;
+ }
+
+- if (status != 0xff)
++ if (*status != 0xff)
+ break;
+ }
+
+- if (status == 0xff) {
++ if (*status == 0xff) {
+ dev_err(line6->ifcdev, "write failed after %d retries\n",
+ count);
+- return -EIO;
+- } else if (status != 0) {
++ ret = -EIO;
++ } else if (*status != 0) {
+ dev_err(line6->ifcdev, "write failed (error %d)\n", ret);
+- return -EIO;
++ ret = -EIO;
+ }
+-
+- return 0;
++exit:
++ kfree(status);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(line6_write_data);
+
+diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
+index 36ed9c85c0eb..5f3c87264e66 100644
+--- a/sound/usb/line6/podhd.c
++++ b/sound/usb/line6/podhd.c
+@@ -225,28 +225,32 @@ static void podhd_startup_start_workqueue(struct timer_list *t)
+ static int podhd_dev_start(struct usb_line6_podhd *pod)
+ {
+ int ret;
+- u8 init_bytes[8];
++ u8 *init_bytes;
+ int i;
+ struct usb_device *usbdev = pod->line6.usbdev;
+
++ init_bytes = kmalloc(8, GFP_KERNEL);
++ if (!init_bytes)
++ return -ENOMEM;
++
+ ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0),
+ 0x67, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+ 0x11, 0,
+ NULL, 0, LINE6_TIMEOUT * HZ);
+ if (ret < 0) {
+ dev_err(pod->line6.ifcdev, "read request failed (error %d)\n", ret);
+- return ret;
++ goto exit;
+ }
+
+ /* NOTE: looks like some kind of ping message */
+ ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+ 0x11, 0x0,
+- &init_bytes, 3, LINE6_TIMEOUT * HZ);
++ init_bytes, 3, LINE6_TIMEOUT * HZ);
+ if (ret < 0) {
+ dev_err(pod->line6.ifcdev,
+ "receive length failed (error %d)\n", ret);
+- return ret;
++ goto exit;
+ }
+
+ pod->firmware_version =
+@@ -255,7 +259,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod)
+ for (i = 0; i <= 16; i++) {
+ ret = line6_read_data(&pod->line6, 0xf000 + 0x08 * i, init_bytes, 8);
+ if (ret < 0)
+- return ret;
++ goto exit;
+ }
+
+ ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0),
+@@ -263,10 +267,9 @@ static int podhd_dev_start(struct usb_line6_podhd *pod)
+ USB_TYPE_STANDARD | USB_RECIP_DEVICE | USB_DIR_OUT,
+ 1, 0,
+ NULL, 0, LINE6_TIMEOUT * HZ);
+- if (ret < 0)
+- return ret;
+-
+- return 0;
++exit:
++ kfree(init_bytes);
++ return ret;
+ }
+
+ static void podhd_startup_workqueue(struct work_struct *work)
+diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c
+index f47ba94e6f4a..19bee725de00 100644
+--- a/sound/usb/line6/toneport.c
++++ b/sound/usb/line6/toneport.c
+@@ -365,16 +365,21 @@ static bool toneport_has_source_select(struct usb_line6_toneport *toneport)
+ /*
+ Setup Toneport device.
+ */
+-static void toneport_setup(struct usb_line6_toneport *toneport)
++static int toneport_setup(struct usb_line6_toneport *toneport)
+ {
+- u32 ticks;
++ u32 *ticks;
+ struct usb_line6 *line6 = &toneport->line6;
+ struct usb_device *usbdev = line6->usbdev;
+
++ ticks = kmalloc(sizeof(*ticks), GFP_KERNEL);
++ if (!ticks)
++ return -ENOMEM;
++
+ /* sync time on device with host: */
+ /* note: 32-bit timestamps overflow in year 2106 */
+- ticks = (u32)ktime_get_real_seconds();
+- line6_write_data(line6, 0x80c6, &ticks, 4);
++ *ticks = (u32)ktime_get_real_seconds();
++ line6_write_data(line6, 0x80c6, ticks, 4);
++ kfree(ticks);
+
+ /* enable device: */
+ toneport_send_cmd(usbdev, 0x0301, 0x0000);
+@@ -389,6 +394,7 @@ static void toneport_setup(struct usb_line6_toneport *toneport)
+ toneport_update_led(toneport);
+
+ mod_timer(&toneport->timer, jiffies + TONEPORT_PCM_DELAY * HZ);
++ return 0;
+ }
+
+ /*
+@@ -451,7 +457,9 @@ static int toneport_init(struct usb_line6 *line6,
+ return err;
+ }
+
+- toneport_setup(toneport);
++ err = toneport_setup(toneport);
++ if (err)
++ return err;
+
+ /* register audio system: */
+ return snd_card_register(line6->card);
+@@ -463,7 +471,11 @@ static int toneport_init(struct usb_line6 *line6,
+ */
+ static int toneport_reset_resume(struct usb_interface *interface)
+ {
+- toneport_setup(usb_get_intfdata(interface));
++ int err;
++
++ err = toneport_setup(usb_get_intfdata(interface));
++ if (err)
++ return err;
+ return line6_resume(interface);
+ }
+ #endif
+diff --git a/tools/testing/selftests/net/fib_rule_tests.sh b/tools/testing/selftests/net/fib_rule_tests.sh
+index d4cfb6a7a086..d84193bdc307 100755
+--- a/tools/testing/selftests/net/fib_rule_tests.sh
++++ b/tools/testing/selftests/net/fib_rule_tests.sh
+@@ -27,6 +27,7 @@ log_test()
+ nsuccess=$((nsuccess+1))
+ printf "\n TEST: %-50s [ OK ]\n" "${msg}"
+ else
++ ret=1
+ nfail=$((nfail+1))
+ printf "\n TEST: %-50s [FAIL]\n" "${msg}"
+ if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
+@@ -245,4 +246,9 @@ setup
+ run_fibrule_tests
+ cleanup
+
++if [ "$TESTS" != "none" ]; then
++ printf "\nTests passed: %3d\n" ${nsuccess}
++ printf "Tests failed: %3d\n" ${nfail}
++fi
++
+ exit $ret
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-05-08 10:06 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-05-08 10:06 UTC (permalink / raw
To: gentoo-commits
commit: af12f60dec7a14cd24cf8f9f064b310ac3a90b68
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 8 10:06:00 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 8 10:06:00 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=af12f60d
Linux patch 4.19.41
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1040_linux-4.19.41.patch | 3563 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3567 insertions(+)
diff --git a/0000_README b/0000_README
index 27107b1..ba19d17 100644
--- a/0000_README
+++ b/0000_README
@@ -203,6 +203,10 @@ Patch: 1039_linux-4.19.40.patch
From: http://www.kernel.org
Desc: Linux 4.19.40
+Patch: 1040_linux-4.19.41.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.41
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1040_linux-4.19.41.patch b/1040_linux-4.19.41.patch
new file mode 100644
index 0000000..6dabf37
--- /dev/null
+++ b/1040_linux-4.19.41.patch
@@ -0,0 +1,3563 @@
+diff --git a/Documentation/driver-api/usb/power-management.rst b/Documentation/driver-api/usb/power-management.rst
+index 79beb807996b..4a74cf6f2797 100644
+--- a/Documentation/driver-api/usb/power-management.rst
++++ b/Documentation/driver-api/usb/power-management.rst
+@@ -370,11 +370,15 @@ autosuspend the interface's device. When the usage counter is = 0
+ then the interface is considered to be idle, and the kernel may
+ autosuspend the device.
+
+-Drivers need not be concerned about balancing changes to the usage
+-counter; the USB core will undo any remaining "get"s when a driver
+-is unbound from its interface. As a corollary, drivers must not call
+-any of the ``usb_autopm_*`` functions after their ``disconnect``
+-routine has returned.
++Drivers must be careful to balance their overall changes to the usage
++counter. Unbalanced "get"s will remain in effect when a driver is
++unbound from its interface, preventing the device from going into
++runtime suspend should the interface be bound to a driver again. On
++the other hand, drivers are allowed to achieve this balance by calling
++the ``usb_autopm_*`` functions even after their ``disconnect`` routine
++has returned -- say from within a work-queue routine -- provided they
++retain an active reference to the interface (via ``usb_get_intf`` and
++``usb_put_intf``).
+
+ Drivers using the async routines are responsible for their own
+ synchronization and mutual exclusion.
+diff --git a/Makefile b/Makefile
+index 3822720a8a1c..ba3b8504b689 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 40
++SUBLEVEL = 41
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
+index e6a36a792bae..c706adf4aed2 100644
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -1261,27 +1261,27 @@
+ gpu_opp_table: gpu-opp-table {
+ compatible = "operating-points-v2";
+
+- opp@100000000 {
++ opp-100000000 {
+ opp-hz = /bits/ 64 <100000000>;
+ opp-microvolt = <950000>;
+ };
+- opp@200000000 {
++ opp-200000000 {
+ opp-hz = /bits/ 64 <200000000>;
+ opp-microvolt = <950000>;
+ };
+- opp@300000000 {
++ opp-300000000 {
+ opp-hz = /bits/ 64 <300000000>;
+ opp-microvolt = <1000000>;
+ };
+- opp@400000000 {
++ opp-400000000 {
+ opp-hz = /bits/ 64 <400000000>;
+ opp-microvolt = <1100000>;
+ };
+- opp@500000000 {
++ opp-500000000 {
+ opp-hz = /bits/ 64 <500000000>;
+ opp-microvolt = <1200000>;
+ };
+- opp@600000000 {
++ opp-600000000 {
+ opp-hz = /bits/ 64 <600000000>;
+ opp-microvolt = <1250000>;
+ };
+diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
+index 32fae4dbd63b..0921e2c10edf 100644
+--- a/arch/arm/mach-at91/pm.c
++++ b/arch/arm/mach-at91/pm.c
+@@ -594,13 +594,13 @@ static int __init at91_pm_backup_init(void)
+
+ np = of_find_compatible_node(NULL, NULL, "atmel,sama5d2-securam");
+ if (!np)
+- goto securam_fail;
++ goto securam_fail_no_ref_dev;
+
+ pdev = of_find_device_by_node(np);
+ of_node_put(np);
+ if (!pdev) {
+ pr_warn("%s: failed to find securam device!\n", __func__);
+- goto securam_fail;
++ goto securam_fail_no_ref_dev;
+ }
+
+ sram_pool = gen_pool_get(&pdev->dev, NULL);
+@@ -623,6 +623,8 @@ static int __init at91_pm_backup_init(void)
+ return 0;
+
+ securam_fail:
++ put_device(&pdev->dev);
++securam_fail_no_ref_dev:
+ iounmap(pm_data.sfrbu);
+ pm_data.sfrbu = NULL;
+ return ret;
+diff --git a/arch/arm/mach-iop13xx/setup.c b/arch/arm/mach-iop13xx/setup.c
+index 53c316f7301e..fe4932fda01d 100644
+--- a/arch/arm/mach-iop13xx/setup.c
++++ b/arch/arm/mach-iop13xx/setup.c
+@@ -300,7 +300,7 @@ static struct resource iop13xx_adma_2_resources[] = {
+ }
+ };
+
+-static u64 iop13xx_adma_dmamask = DMA_BIT_MASK(64);
++static u64 iop13xx_adma_dmamask = DMA_BIT_MASK(32);
+ static struct iop_adma_platform_data iop13xx_adma_0_data = {
+ .hw_id = 0,
+ .pool_size = PAGE_SIZE,
+@@ -324,7 +324,7 @@ static struct platform_device iop13xx_adma_0_channel = {
+ .resource = iop13xx_adma_0_resources,
+ .dev = {
+ .dma_mask = &iop13xx_adma_dmamask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ .platform_data = (void *) &iop13xx_adma_0_data,
+ },
+ };
+@@ -336,7 +336,7 @@ static struct platform_device iop13xx_adma_1_channel = {
+ .resource = iop13xx_adma_1_resources,
+ .dev = {
+ .dma_mask = &iop13xx_adma_dmamask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ .platform_data = (void *) &iop13xx_adma_1_data,
+ },
+ };
+@@ -348,7 +348,7 @@ static struct platform_device iop13xx_adma_2_channel = {
+ .resource = iop13xx_adma_2_resources,
+ .dev = {
+ .dma_mask = &iop13xx_adma_dmamask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ .platform_data = (void *) &iop13xx_adma_2_data,
+ },
+ };
+diff --git a/arch/arm/mach-iop13xx/tpmi.c b/arch/arm/mach-iop13xx/tpmi.c
+index db511ec2b1df..116feb6b261e 100644
+--- a/arch/arm/mach-iop13xx/tpmi.c
++++ b/arch/arm/mach-iop13xx/tpmi.c
+@@ -152,7 +152,7 @@ static struct resource iop13xx_tpmi_3_resources[] = {
+ }
+ };
+
+-u64 iop13xx_tpmi_mask = DMA_BIT_MASK(64);
++u64 iop13xx_tpmi_mask = DMA_BIT_MASK(32);
+ static struct platform_device iop13xx_tpmi_0_device = {
+ .name = "iop-tpmi",
+ .id = 0,
+@@ -160,7 +160,7 @@ static struct platform_device iop13xx_tpmi_0_device = {
+ .resource = iop13xx_tpmi_0_resources,
+ .dev = {
+ .dma_mask = &iop13xx_tpmi_mask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
+@@ -171,7 +171,7 @@ static struct platform_device iop13xx_tpmi_1_device = {
+ .resource = iop13xx_tpmi_1_resources,
+ .dev = {
+ .dma_mask = &iop13xx_tpmi_mask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
+@@ -182,7 +182,7 @@ static struct platform_device iop13xx_tpmi_2_device = {
+ .resource = iop13xx_tpmi_2_resources,
+ .dev = {
+ .dma_mask = &iop13xx_tpmi_mask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
+@@ -193,7 +193,7 @@ static struct platform_device iop13xx_tpmi_3_device = {
+ .resource = iop13xx_tpmi_3_resources,
+ .dev = {
+ .dma_mask = &iop13xx_tpmi_mask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ },
+ };
+
+diff --git a/arch/arm/plat-iop/adma.c b/arch/arm/plat-iop/adma.c
+index a4d1f8de3b5b..d9612221e484 100644
+--- a/arch/arm/plat-iop/adma.c
++++ b/arch/arm/plat-iop/adma.c
+@@ -143,7 +143,7 @@ struct platform_device iop3xx_dma_0_channel = {
+ .resource = iop3xx_dma_0_resources,
+ .dev = {
+ .dma_mask = &iop3xx_adma_dmamask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ .platform_data = (void *) &iop3xx_dma_0_data,
+ },
+ };
+@@ -155,7 +155,7 @@ struct platform_device iop3xx_dma_1_channel = {
+ .resource = iop3xx_dma_1_resources,
+ .dev = {
+ .dma_mask = &iop3xx_adma_dmamask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ .platform_data = (void *) &iop3xx_dma_1_data,
+ },
+ };
+@@ -167,7 +167,7 @@ struct platform_device iop3xx_aau_channel = {
+ .resource = iop3xx_aau_resources,
+ .dev = {
+ .dma_mask = &iop3xx_adma_dmamask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ .platform_data = (void *) &iop3xx_aau_data,
+ },
+ };
+diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c
+index a2399fd66e97..1e970873439c 100644
+--- a/arch/arm/plat-orion/common.c
++++ b/arch/arm/plat-orion/common.c
+@@ -622,7 +622,7 @@ static struct platform_device orion_xor0_shared = {
+ .resource = orion_xor0_shared_resources,
+ .dev = {
+ .dma_mask = &orion_xor_dmamask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ .platform_data = &orion_xor0_pdata,
+ },
+ };
+@@ -683,7 +683,7 @@ static struct platform_device orion_xor1_shared = {
+ .resource = orion_xor1_shared_resources,
+ .dev = {
+ .dma_mask = &orion_xor_dmamask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
++ .coherent_dma_mask = DMA_BIT_MASK(32),
+ .platform_data = &orion_xor1_pdata,
+ },
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+index 246c317f6a68..91061d9cf78b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+@@ -94,8 +94,8 @@
+ snps,reset-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>;
+ snps,reset-active-low;
+ snps,reset-delays-us = <0 10000 50000>;
+- tx_delay = <0x25>;
+- rx_delay = <0x11>;
++ tx_delay = <0x24>;
++ rx_delay = <0x18>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/kernel/sdei.c b/arch/arm64/kernel/sdei.c
+index 5ba4465e44f0..ea94cf8f9dc6 100644
+--- a/arch/arm64/kernel/sdei.c
++++ b/arch/arm64/kernel/sdei.c
+@@ -94,6 +94,9 @@ static bool on_sdei_normal_stack(unsigned long sp, struct stack_info *info)
+ unsigned long low = (unsigned long)raw_cpu_read(sdei_stack_normal_ptr);
+ unsigned long high = low + SDEI_STACK_SIZE;
+
++ if (!low)
++ return false;
++
+ if (sp < low || sp >= high)
+ return false;
+
+@@ -111,6 +114,9 @@ static bool on_sdei_critical_stack(unsigned long sp, struct stack_info *info)
+ unsigned long low = (unsigned long)raw_cpu_read(sdei_stack_critical_ptr);
+ unsigned long high = low + SDEI_STACK_SIZE;
+
++ if (!low)
++ return false;
++
+ if (sp < low || sp >= high)
+ return false;
+
+diff --git a/arch/powerpc/kernel/kvm.c b/arch/powerpc/kernel/kvm.c
+index 683b5b3805bd..cd381e2291df 100644
+--- a/arch/powerpc/kernel/kvm.c
++++ b/arch/powerpc/kernel/kvm.c
+@@ -22,6 +22,7 @@
+ #include <linux/kvm_host.h>
+ #include <linux/init.h>
+ #include <linux/export.h>
++#include <linux/kmemleak.h>
+ #include <linux/kvm_para.h>
+ #include <linux/slab.h>
+ #include <linux/of.h>
+@@ -712,6 +713,12 @@ static void kvm_use_magic_page(void)
+
+ static __init void kvm_free_tmp(void)
+ {
++ /*
++ * Inform kmemleak about the hole in the .bss section since the
++ * corresponding pages will be unmapped with DEBUG_PAGEALLOC=y.
++ */
++ kmemleak_free_part(&kvm_tmp[kvm_tmp_index],
++ ARRAY_SIZE(kvm_tmp) - kvm_tmp_index);
+ free_reserved_area(&kvm_tmp[kvm_tmp_index],
+ &kvm_tmp[ARRAY_SIZE(kvm_tmp)], -1, NULL);
+ }
+diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
+index 4f213ba33491..53e9b58e83c2 100644
+--- a/arch/powerpc/mm/slice.c
++++ b/arch/powerpc/mm/slice.c
+@@ -31,6 +31,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/export.h>
+ #include <linux/hugetlb.h>
++#include <linux/security.h>
+ #include <asm/mman.h>
+ #include <asm/mmu.h>
+ #include <asm/copro.h>
+@@ -376,6 +377,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
+ int pshift = max_t(int, mmu_psize_defs[psize].shift, PAGE_SHIFT);
+ unsigned long addr, found, prev;
+ struct vm_unmapped_area_info info;
++ unsigned long min_addr = max(PAGE_SIZE, mmap_min_addr);
+
+ info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ info.length = len;
+@@ -392,7 +394,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
+ if (high_limit > DEFAULT_MAP_WINDOW)
+ addr += mm->context.slb_addr_limit - DEFAULT_MAP_WINDOW;
+
+- while (addr > PAGE_SIZE) {
++ while (addr > min_addr) {
+ info.high_limit = addr;
+ if (!slice_scan_available(addr - 1, available, 0, &addr))
+ continue;
+@@ -404,8 +406,8 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
+ * Check if we need to reduce the range, or if we can
+ * extend it to cover the previous available slice.
+ */
+- if (addr < PAGE_SIZE)
+- addr = PAGE_SIZE;
++ if (addr < min_addr)
++ addr = min_addr;
+ else if (slice_scan_available(addr - 1, available, 0, &prev)) {
+ addr = prev;
+ goto prev_slice;
+@@ -527,7 +529,7 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
+ addr = _ALIGN_UP(addr, page_size);
+ slice_dbg(" aligned addr=%lx\n", addr);
+ /* Ignore hint if it's too large or overlaps a VMA */
+- if (addr > high_limit - len ||
++ if (addr > high_limit - len || addr < mmap_min_addr ||
+ !slice_area_is_free(mm, addr, len))
+ addr = 0;
+ }
+diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
+index 8c3e3e3c8be1..f0ea3156192d 100644
+--- a/arch/riscv/include/asm/uaccess.h
++++ b/arch/riscv/include/asm/uaccess.h
+@@ -307,7 +307,7 @@ do { \
+ " .balign 4\n" \
+ "4:\n" \
+ " li %0, %6\n" \
+- " jump 2b, %1\n" \
++ " jump 3b, %1\n" \
+ " .previous\n" \
+ " .section __ex_table,\"a\"\n" \
+ " .balign " RISCV_SZPTR "\n" \
+diff --git a/arch/sh/boards/of-generic.c b/arch/sh/boards/of-generic.c
+index 26789ad28193..cb99df514a1c 100644
+--- a/arch/sh/boards/of-generic.c
++++ b/arch/sh/boards/of-generic.c
+@@ -175,10 +175,10 @@ static struct sh_machine_vector __initmv sh_of_generic_mv = {
+
+ struct sh_clk_ops;
+
+-void __init arch_init_clk_ops(struct sh_clk_ops **ops, int idx)
++void __init __weak arch_init_clk_ops(struct sh_clk_ops **ops, int idx)
+ {
+ }
+
+-void __init plat_irq_setup(void)
++void __init __weak plat_irq_setup(void)
+ {
+ }
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index 263af6312329..27ade3cb6482 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -116,6 +116,110 @@ static __initconst const u64 amd_hw_cache_event_ids
+ },
+ };
+
++static __initconst const u64 amd_hw_cache_event_ids_f17h
++ [PERF_COUNT_HW_CACHE_MAX]
++ [PERF_COUNT_HW_CACHE_OP_MAX]
++ [PERF_COUNT_HW_CACHE_RESULT_MAX] = {
++[C(L1D)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0x0040, /* Data Cache Accesses */
++ [C(RESULT_MISS)] = 0xc860, /* L2$ access from DC Miss */
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = 0xff5a, /* h/w prefetch DC Fills */
++ [C(RESULT_MISS)] = 0,
++ },
++},
++[C(L1I)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0x0080, /* Instruction cache fetches */
++ [C(RESULT_MISS)] = 0x0081, /* Instruction cache misses */
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++},
++[C(LL)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++},
++[C(DTLB)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0xff45, /* All L2 DTLB accesses */
++ [C(RESULT_MISS)] = 0xf045, /* L2 DTLB misses (PT walks) */
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++},
++[C(ITLB)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0x0084, /* L1 ITLB misses, L2 ITLB hits */
++ [C(RESULT_MISS)] = 0xff85, /* L1 ITLB misses, L2 misses */
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++},
++[C(BPU)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0x00c2, /* Retired Branch Instr. */
++ [C(RESULT_MISS)] = 0x00c3, /* Retired Mispredicted BI */
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++},
++[C(NODE)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++},
++};
++
+ /*
+ * AMD Performance Monitor K7 and later, up to and including Family 16h:
+ */
+@@ -861,9 +965,10 @@ __init int amd_pmu_init(void)
+ x86_pmu.amd_nb_constraints = 0;
+ }
+
+- /* Events are common for all AMDs */
+- memcpy(hw_cache_event_ids, amd_hw_cache_event_ids,
+- sizeof(hw_cache_event_ids));
++ if (boot_cpu_data.x86 >= 0x17)
++ memcpy(hw_cache_event_ids, amd_hw_cache_event_ids_f17h, sizeof(hw_cache_event_ids));
++ else
++ memcpy(hw_cache_event_ids, amd_hw_cache_event_ids, sizeof(hw_cache_event_ids));
+
+ return 0;
+ }
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+index f34d89c01edc..06f7c04a44e2 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+@@ -165,6 +165,11 @@ static struct severity {
+ SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, MCI_UC_SAR|MCI_ADDR|MCACOD_DATA),
+ KERNEL
+ ),
++ MCESEV(
++ PANIC, "Instruction fetch error in kernel",
++ SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, MCI_UC_SAR|MCI_ADDR|MCACOD_INSTR),
++ KERNEL
++ ),
+ #endif
+ MCESEV(
+ PANIC, "Action required: unknown MCACOD",
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 813cb60eb401..8dd9208ae4de 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -6789,7 +6789,8 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
+ struct page **src_p, **dst_p;
+ struct kvm_sev_dbg debug;
+ unsigned long n;
+- int ret, size;
++ unsigned int size;
++ int ret;
+
+ if (!sev_guest(kvm))
+ return -ENOTTY;
+@@ -6797,6 +6798,11 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
+ if (copy_from_user(&debug, (void __user *)(uintptr_t)argp->data, sizeof(debug)))
+ return -EFAULT;
+
++ if (!debug.len || debug.src_uaddr + debug.len < debug.src_uaddr)
++ return -EINVAL;
++ if (!debug.dst_uaddr)
++ return -EINVAL;
++
+ vaddr = debug.src_uaddr;
+ size = debug.len;
+ vaddr_end = vaddr + size;
+@@ -6847,8 +6853,8 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec)
+ dst_vaddr,
+ len, &argp->error);
+
+- sev_unpin_memory(kvm, src_p, 1);
+- sev_unpin_memory(kvm, dst_p, 1);
++ sev_unpin_memory(kvm, src_p, n);
++ sev_unpin_memory(kvm, dst_p, n);
+
+ if (ret)
+ goto err;
+diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
+index d883869437b5..fb5f29c60019 100644
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -6,6 +6,7 @@
+ #include <linux/bootmem.h> /* for max_low_pfn */
+ #include <linux/swapfile.h>
+ #include <linux/swapops.h>
++#include <linux/kmemleak.h>
+
+ #include <asm/set_memory.h>
+ #include <asm/e820/api.h>
+@@ -767,6 +768,11 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+ if (debug_pagealloc_enabled()) {
+ pr_info("debug: unmapping init [mem %#010lx-%#010lx]\n",
+ begin, end - 1);
++ /*
++ * Inform kmemleak about the hole in the memory since the
++ * corresponding pages will be unmapped.
++ */
++ kmemleak_free_part((void *)begin, end - begin);
+ set_memory_np(begin, (end - begin) >> PAGE_SHIFT);
+ } else {
+ /*
+diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c
+index 61db77b0eda9..0988971069c9 100644
+--- a/arch/x86/mm/kaslr.c
++++ b/arch/x86/mm/kaslr.c
+@@ -93,7 +93,7 @@ void __init kernel_randomize_memory(void)
+ if (!kaslr_memory_enabled())
+ return;
+
+- kaslr_regions[0].size_tb = 1 << (__PHYSICAL_MASK_SHIFT - TB_SHIFT);
++ kaslr_regions[0].size_tb = 1 << (MAX_PHYSMEM_BITS - TB_SHIFT);
+ kaslr_regions[1].size_tb = VMALLOC_SIZE_TB;
+
+ /*
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index a6d1b0241aea..a6836ab0fcc7 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -694,7 +694,7 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
+ {
+ int cpu;
+
+- struct flush_tlb_info info __aligned(SMP_CACHE_BYTES) = {
++ struct flush_tlb_info info = {
+ .mm = mm,
+ };
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index eb8b52241453..33488b1426b7 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -980,6 +980,10 @@ static void blk_rq_timed_out_timer(struct timer_list *t)
+ kblockd_schedule_work(&q->timeout_work);
+ }
+
++static void blk_timeout_work_dummy(struct work_struct *work)
++{
++}
++
+ /**
+ * blk_alloc_queue_node - allocate a request queue
+ * @gfp_mask: memory allocation flags
+@@ -1034,7 +1038,7 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id,
+ timer_setup(&q->backing_dev_info->laptop_mode_wb_timer,
+ laptop_mode_timer_fn, 0);
+ timer_setup(&q->timeout, blk_rq_timed_out_timer, 0);
+- INIT_WORK(&q->timeout_work, NULL);
++ INIT_WORK(&q->timeout_work, blk_timeout_work_dummy);
+ INIT_LIST_HEAD(&q->timeout_list);
+ INIT_LIST_HEAD(&q->icq_list);
+ #ifdef CONFIG_BLK_CGROUP
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 7d53f2314d7c..414656796ecf 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2236,7 +2236,7 @@ static int blk_mq_init_hctx(struct request_queue *q,
+ return 0;
+
+ free_fq:
+- kfree(hctx->fq);
++ blk_free_flush_queue(hctx->fq);
+ exit_hctx:
+ if (set->ops->exit_hctx)
+ set->ops->exit_hctx(hctx, hctx_idx);
+diff --git a/drivers/block/xsysace.c b/drivers/block/xsysace.c
+index c24589414c75..0f36db0cf74a 100644
+--- a/drivers/block/xsysace.c
++++ b/drivers/block/xsysace.c
+@@ -1063,6 +1063,8 @@ static int ace_setup(struct ace_device *ace)
+ return 0;
+
+ err_read:
++ /* prevent double queue cleanup */
++ ace->gd->queue = NULL;
+ put_disk(ace->gd);
+ err_alloc_disk:
+ blk_cleanup_queue(ace->queue);
+diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
+index 4593baff2bc9..19eecf198321 100644
+--- a/drivers/bluetooth/btmtkuart.c
++++ b/drivers/bluetooth/btmtkuart.c
+@@ -115,11 +115,13 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev, u8 op, u8 flag, u16 plen,
+ TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
+ if (err == -EINTR) {
+ bt_dev_err(hdev, "Execution of wmt command interrupted");
++ clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
+ return err;
+ }
+
+ if (err) {
+ bt_dev_err(hdev, "Execution of wmt command timed out");
++ clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
+ return -ETIMEDOUT;
+ }
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 77b67a5f21ee..40a4f95f6178 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -2888,6 +2888,7 @@ static int btusb_config_oob_wake(struct hci_dev *hdev)
+ return 0;
+ }
+
++ irq_set_status_flags(irq, IRQ_NOAUTOEN);
+ ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
+ 0, "OOB Wake-on-BT", data);
+ if (ret) {
+@@ -2902,7 +2903,6 @@ static int btusb_config_oob_wake(struct hci_dev *hdev)
+ }
+
+ data->oob_wake_irq = irq;
+- disable_irq(irq);
+ bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
+ return 0;
+ }
+diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
+index 9f0ae403d5f5..cd937ce6aaaf 100644
+--- a/drivers/clk/qcom/gcc-msm8998.c
++++ b/drivers/clk/qcom/gcc-msm8998.c
+@@ -1101,6 +1101,7 @@ static struct clk_rcg2 ufs_axi_clk_src = {
+
+ static const struct freq_tbl ftbl_usb30_master_clk_src[] = {
+ F(19200000, P_XO, 1, 0, 0),
++ F(60000000, P_GPLL0_OUT_MAIN, 10, 0, 0),
+ F(120000000, P_GPLL0_OUT_MAIN, 5, 0, 0),
+ F(150000000, P_GPLL0_OUT_MAIN, 4, 0, 0),
+ { }
+diff --git a/drivers/clk/x86/clk-pmc-atom.c b/drivers/clk/x86/clk-pmc-atom.c
+index d977193842df..19174835693b 100644
+--- a/drivers/clk/x86/clk-pmc-atom.c
++++ b/drivers/clk/x86/clk-pmc-atom.c
+@@ -165,7 +165,7 @@ static const struct clk_ops plt_clk_ops = {
+ };
+
+ static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
+- void __iomem *base,
++ const struct pmc_clk_data *pmc_data,
+ const char **parent_names,
+ int num_parents)
+ {
+@@ -184,9 +184,17 @@ static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
+ init.num_parents = num_parents;
+
+ pclk->hw.init = &init;
+- pclk->reg = base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
++ pclk->reg = pmc_data->base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
+ spin_lock_init(&pclk->lock);
+
++ /*
++ * On some systems, the pmc_plt_clocks already enabled by the
++ * firmware are being marked as critical to avoid them being
++ * gated by the clock framework.
++ */
++ if (pmc_data->critical && plt_clk_is_enabled(&pclk->hw))
++ init.flags |= CLK_IS_CRITICAL;
++
+ ret = devm_clk_hw_register(&pdev->dev, &pclk->hw);
+ if (ret) {
+ pclk = ERR_PTR(ret);
+@@ -332,7 +340,7 @@ static int plt_clk_probe(struct platform_device *pdev)
+ return PTR_ERR(parent_names);
+
+ for (i = 0; i < PMC_CLK_NUM; i++) {
+- data->clks[i] = plt_clk_register(pdev, i, pmc_data->base,
++ data->clks[i] = plt_clk_register(pdev, i, pmc_data,
+ parent_names, data->nparents);
+ if (IS_ERR(data->clks[i])) {
+ err = PTR_ERR(data->clks[i]);
+diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
+index b0aeffd4e269..1606abead22c 100644
+--- a/drivers/firmware/efi/runtime-wrappers.c
++++ b/drivers/firmware/efi/runtime-wrappers.c
+@@ -95,7 +95,7 @@ struct efi_runtime_work {
+ efi_rts_work.status = EFI_ABORTED; \
+ \
+ init_completion(&efi_rts_work.efi_rts_comp); \
+- INIT_WORK_ONSTACK(&efi_rts_work.work, efi_call_rts); \
++ INIT_WORK(&efi_rts_work.work, efi_call_rts); \
+ efi_rts_work.arg1 = _arg1; \
+ efi_rts_work.arg2 = _arg2; \
+ efi_rts_work.arg3 = _arg3; \
+diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c
+index 2d1dfa1e0745..e86e61dda4b7 100644
+--- a/drivers/gpio/gpio-mxc.c
++++ b/drivers/gpio/gpio-mxc.c
+@@ -438,8 +438,11 @@ static int mxc_gpio_probe(struct platform_device *pdev)
+
+ /* the controller clock is optional */
+ port->clk = devm_clk_get(&pdev->dev, NULL);
+- if (IS_ERR(port->clk))
++ if (IS_ERR(port->clk)) {
++ if (PTR_ERR(port->clk) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
+ port->clk = NULL;
++ }
+
+ err = clk_prepare_enable(port->clk);
+ if (err) {
+diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
+index ebc9ffde41e9..a353a011fbdf 100644
+--- a/drivers/hid/hid-debug.c
++++ b/drivers/hid/hid-debug.c
+@@ -1060,10 +1060,15 @@ static int hid_debug_rdesc_show(struct seq_file *f, void *p)
+ seq_printf(f, "\n\n");
+
+ /* dump parsed data and input mappings */
++ if (down_interruptible(&hdev->driver_input_lock))
++ return 0;
++
+ hid_dump_device(hdev, f);
+ seq_printf(f, "\n");
+ hid_dump_input_mapping(hdev, f);
+
++ up(&hdev->driver_input_lock);
++
+ return 0;
+ }
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index a3916e58dbf5..e649940e065d 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -982,6 +982,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ case 0x1b8: map_key_clear(KEY_VIDEO); break;
+ case 0x1bc: map_key_clear(KEY_MESSENGER); break;
+ case 0x1bd: map_key_clear(KEY_INFO); break;
++ case 0x1cb: map_key_clear(KEY_ASSISTANT); break;
+ case 0x201: map_key_clear(KEY_NEW); break;
+ case 0x202: map_key_clear(KEY_OPEN); break;
+ case 0x203: map_key_clear(KEY_CLOSE); break;
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 19cc980eebce..8425d3548a41 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -1907,6 +1907,13 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
+ kfree(data);
+ return -ENOMEM;
+ }
++ data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
++ if (!data->wq) {
++ kfree(data->effect_ids);
++ kfree(data);
++ return -ENOMEM;
++ }
++
+ data->hidpp = hidpp;
+ data->feature_index = feature_index;
+ data->version = version;
+@@ -1951,7 +1958,6 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
+ /* ignore boost value at response.fap.params[2] */
+
+ /* init the hardware command queue */
+- data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
+ atomic_set(&data->workqueue_size, 0);
+
+ /* initialize with zero autocenter to get wheel in usable state */
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 94088c0ed68a..e24790c988c0 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -744,7 +744,6 @@ static const struct hid_device_id hid_ignore_list[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_DEALEXTREAME, USB_DEVICE_ID_DEALEXTREAME_RADIO_SI4701) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DELORME, USB_DEVICE_ID_DELORME_EARTHMATE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DELORME, USB_DEVICE_ID_DELORME_EM_LT20) },
+- { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, 0x0400) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC5UH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC4UM) },
+@@ -1025,6 +1024,10 @@ bool hid_ignore(struct hid_device *hdev)
+ if (hdev->product == 0x0401 &&
+ strncmp(hdev->name, "ELAN0800", 8) != 0)
+ return true;
++ /* Same with product id 0x0400 */
++ if (hdev->product == 0x0400 &&
++ strncmp(hdev->name, "QTEC0001", 8) != 0)
++ return true;
+ break;
+ }
+
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index c406700789e1..7bd409eaf0ac 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -510,9 +510,9 @@ static int i2c_imx_clk_notifier_call(struct notifier_block *nb,
+ unsigned long action, void *data)
+ {
+ struct clk_notifier_data *ndata = data;
+- struct imx_i2c_struct *i2c_imx = container_of(&ndata->clk,
++ struct imx_i2c_struct *i2c_imx = container_of(nb,
+ struct imx_i2c_struct,
+- clk);
++ clk_change_nb);
+
+ if (action & POST_RATE_CHANGE)
+ i2c_imx_set_clk(i2c_imx, ndata->new_rate);
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index 62d023e737d9..a492da9fd0d3 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -424,7 +424,7 @@ static int stm32f7_i2c_compute_timing(struct stm32f7_i2c_dev *i2c_dev,
+ STM32F7_I2C_ANALOG_FILTER_DELAY_MAX : 0);
+ dnf_delay = setup->dnf * i2cclk;
+
+- sdadel_min = setup->fall_time - i2c_specs[setup->speed].hddat_min -
++ sdadel_min = i2c_specs[setup->speed].hddat_min + setup->fall_time -
+ af_delay_min - (setup->dnf + 3) * i2cclk;
+
+ sdadel_max = i2c_specs[setup->speed].vddat_max - setup->rise_time -
+diff --git a/drivers/i2c/busses/i2c-synquacer.c b/drivers/i2c/busses/i2c-synquacer.c
+index 915f5edbab33..e6c554e6ba58 100644
+--- a/drivers/i2c/busses/i2c-synquacer.c
++++ b/drivers/i2c/busses/i2c-synquacer.c
+@@ -602,6 +602,8 @@ static int synquacer_i2c_probe(struct platform_device *pdev)
+ i2c->adapter = synquacer_i2c_ops;
+ i2c_set_adapdata(&i2c->adapter, i2c);
+ i2c->adapter.dev.parent = &pdev->dev;
++ i2c->adapter.dev.of_node = pdev->dev.of_node;
++ ACPI_COMPANION_SET(&i2c->adapter.dev, ACPI_COMPANION(&pdev->dev));
+ i2c->adapter.nr = pdev->id;
+ init_completion(&i2c->completion);
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 9200e349f29e..5b0e1d9e5adc 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -306,10 +306,7 @@ static int i2c_smbus_host_notify_to_irq(const struct i2c_client *client)
+ if (client->flags & I2C_CLIENT_TEN)
+ return -EINVAL;
+
+- irq = irq_find_mapping(adap->host_notify_domain, client->addr);
+- if (!irq)
+- irq = irq_create_mapping(adap->host_notify_domain,
+- client->addr);
++ irq = irq_create_mapping(adap->host_notify_domain, client->addr);
+
+ return irq > 0 ? irq : -ENXIO;
+ }
+@@ -330,6 +327,8 @@ static int i2c_device_probe(struct device *dev)
+
+ if (client->flags & I2C_CLIENT_HOST_NOTIFY) {
+ dev_dbg(dev, "Using Host Notify IRQ\n");
++ /* Keep adapter active when Host Notify is required */
++ pm_runtime_get_sync(&client->adapter->dev);
+ irq = i2c_smbus_host_notify_to_irq(client);
+ } else if (dev->of_node) {
+ irq = of_irq_get_byname(dev->of_node, "irq");
+@@ -433,6 +432,10 @@ static int i2c_device_remove(struct device *dev)
+ dev_pm_clear_wake_irq(&client->dev);
+ device_init_wakeup(&client->dev, false);
+
++ client->irq = client->init_irq;
++ if (client->flags & I2C_CLIENT_HOST_NOTIFY)
++ pm_runtime_put(&client->adapter->dev);
++
+ return status;
+ }
+
+@@ -742,10 +745,11 @@ i2c_new_device(struct i2c_adapter *adap, struct i2c_board_info const *info)
+ client->flags = info->flags;
+ client->addr = info->addr;
+
+- client->irq = info->irq;
+- if (!client->irq)
+- client->irq = i2c_dev_irq_from_resources(info->resources,
++ client->init_irq = info->irq;
++ if (!client->init_irq)
++ client->init_irq = i2c_dev_irq_from_resources(info->resources,
+ info->num_resources);
++ client->irq = client->init_irq;
+
+ strlcpy(client->name, info->type, sizeof(client->name));
+
+diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
+index 9b0bea8303e0..b79b61bd6ee4 100644
+--- a/drivers/infiniband/core/security.c
++++ b/drivers/infiniband/core/security.c
+@@ -711,16 +711,20 @@ int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
+ agent->device->name,
+ agent->port_num);
+ if (ret)
+- return ret;
++ goto free_security;
+
+ agent->lsm_nb.notifier_call = ib_mad_agent_security_change;
+ ret = register_lsm_notifier(&agent->lsm_nb);
+ if (ret)
+- return ret;
++ goto free_security;
+
+ agent->smp_allowed = true;
+ agent->lsm_nb_reg = true;
+ return 0;
++
++free_security:
++ security_ib_free_security(agent->security);
++ return ret;
+ }
+
+ void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
+@@ -728,9 +732,10 @@ void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
+ if (!rdma_protocol_ib(agent->device, agent->port_num))
+ return;
+
+- security_ib_free_security(agent->security);
+ if (agent->lsm_nb_reg)
+ unregister_lsm_notifier(&agent->lsm_nb);
++
++ security_ib_free_security(agent->security);
+ }
+
+ int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index 6ee03d6089eb..82f309fb3ce5 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1087,8 +1087,8 @@ struct ib_qp *ib_open_qp(struct ib_xrcd *xrcd,
+ }
+ EXPORT_SYMBOL(ib_open_qp);
+
+-static struct ib_qp *ib_create_xrc_qp(struct ib_qp *qp,
+- struct ib_qp_init_attr *qp_init_attr)
++static struct ib_qp *create_xrc_qp(struct ib_qp *qp,
++ struct ib_qp_init_attr *qp_init_attr)
+ {
+ struct ib_qp *real_qp = qp;
+
+@@ -1103,10 +1103,10 @@ static struct ib_qp *ib_create_xrc_qp(struct ib_qp *qp,
+
+ qp = __ib_open_qp(real_qp, qp_init_attr->event_handler,
+ qp_init_attr->qp_context);
+- if (!IS_ERR(qp))
+- __ib_insert_xrcd_qp(qp_init_attr->xrcd, real_qp);
+- else
+- real_qp->device->destroy_qp(real_qp);
++ if (IS_ERR(qp))
++ return qp;
++
++ __ib_insert_xrcd_qp(qp_init_attr->xrcd, real_qp);
+ return qp;
+ }
+
+@@ -1137,10 +1137,8 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
+ return qp;
+
+ ret = ib_create_qp_security(qp, device);
+- if (ret) {
+- ib_destroy_qp(qp);
+- return ERR_PTR(ret);
+- }
++ if (ret)
++ goto err;
+
+ qp->real_qp = qp;
+ qp->qp_type = qp_init_attr->qp_type;
+@@ -1153,8 +1151,15 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
+ INIT_LIST_HEAD(&qp->sig_mrs);
+ qp->port = 0;
+
+- if (qp_init_attr->qp_type == IB_QPT_XRC_TGT)
+- return ib_create_xrc_qp(qp, qp_init_attr);
++ if (qp_init_attr->qp_type == IB_QPT_XRC_TGT) {
++ struct ib_qp *xrc_qp = create_xrc_qp(qp, qp_init_attr);
++
++ if (IS_ERR(xrc_qp)) {
++ ret = PTR_ERR(xrc_qp);
++ goto err;
++ }
++ return xrc_qp;
++ }
+
+ qp->event_handler = qp_init_attr->event_handler;
+ qp->qp_context = qp_init_attr->qp_context;
+@@ -1181,11 +1186,8 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
+
+ if (qp_init_attr->cap.max_rdma_ctxs) {
+ ret = rdma_rw_init_mrs(qp, qp_init_attr);
+- if (ret) {
+- pr_err("failed to init MR pool ret= %d\n", ret);
+- ib_destroy_qp(qp);
+- return ERR_PTR(ret);
+- }
++ if (ret)
++ goto err;
+ }
+
+ /*
+@@ -1198,6 +1200,11 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
+ device->attrs.max_sge_rd);
+
+ return qp;
++
++err:
++ ib_destroy_qp(qp);
++ return ERR_PTR(ret);
++
+ }
+ EXPORT_SYMBOL(ib_create_qp);
+
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index f4bce5aa0ff8..ea4afdeb06a4 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2793,8 +2793,19 @@ static void srpt_queue_tm_rsp(struct se_cmd *cmd)
+ srpt_queue_response(cmd);
+ }
+
++/*
++ * This function is called for aborted commands if no response is sent to the
++ * initiator. Make sure that the credits freed by aborting a command are
++ * returned to the initiator the next time a response is sent by incrementing
++ * ch->req_lim_delta.
++ */
+ static void srpt_aborted_task(struct se_cmd *cmd)
+ {
++ struct srpt_send_ioctx *ioctx = container_of(cmd,
++ struct srpt_send_ioctx, cmd);
++ struct srpt_rdma_ch *ch = ioctx->ch;
++
++ atomic_inc(&ch->req_lim_delta);
+ }
+
+ static int srpt_queue_status(struct se_cmd *cmd)
+diff --git a/drivers/input/keyboard/snvs_pwrkey.c b/drivers/input/keyboard/snvs_pwrkey.c
+index effb63205d3d..4c67cf30a5d9 100644
+--- a/drivers/input/keyboard/snvs_pwrkey.c
++++ b/drivers/input/keyboard/snvs_pwrkey.c
+@@ -148,6 +148,9 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev)
+ return error;
+ }
+
++ pdata->input = input;
++ platform_set_drvdata(pdev, pdata);
++
+ error = devm_request_irq(&pdev->dev, pdata->irq,
+ imx_snvs_pwrkey_interrupt,
+ 0, pdev->name, pdev);
+@@ -163,9 +166,6 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev)
+ return error;
+ }
+
+- pdata->input = input;
+- platform_set_drvdata(pdev, pdata);
+-
+ device_init_wakeup(&pdev->dev, pdata->wakeup);
+
+ return 0;
+diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c
+index 704e99046916..b6f95f20f924 100644
+--- a/drivers/input/touchscreen/stmfts.c
++++ b/drivers/input/touchscreen/stmfts.c
+@@ -106,27 +106,29 @@ struct stmfts_data {
+ bool running;
+ };
+
+-static void stmfts_brightness_set(struct led_classdev *led_cdev,
++static int stmfts_brightness_set(struct led_classdev *led_cdev,
+ enum led_brightness value)
+ {
+ struct stmfts_data *sdata = container_of(led_cdev,
+ struct stmfts_data, led_cdev);
+ int err;
+
+- if (value == sdata->led_status || !sdata->ledvdd)
+- return;
+-
+- if (!value) {
+- regulator_disable(sdata->ledvdd);
+- } else {
+- err = regulator_enable(sdata->ledvdd);
+- if (err)
+- dev_warn(&sdata->client->dev,
+- "failed to disable ledvdd regulator: %d\n",
+- err);
++ if (value != sdata->led_status && sdata->ledvdd) {
++ if (!value) {
++ regulator_disable(sdata->ledvdd);
++ } else {
++ err = regulator_enable(sdata->ledvdd);
++ if (err) {
++ dev_warn(&sdata->client->dev,
++ "failed to disable ledvdd regulator: %d\n",
++ err);
++ return err;
++ }
++ }
++ sdata->led_status = value;
+ }
+
+- sdata->led_status = value;
++ return 0;
+ }
+
+ static enum led_brightness stmfts_brightness_get(struct led_classdev *led_cdev)
+@@ -608,7 +610,7 @@ static int stmfts_enable_led(struct stmfts_data *sdata)
+ sdata->led_cdev.name = STMFTS_DEV_NAME;
+ sdata->led_cdev.max_brightness = LED_ON;
+ sdata->led_cdev.brightness = LED_OFF;
+- sdata->led_cdev.brightness_set = stmfts_brightness_set;
++ sdata->led_cdev.brightness_set_blocking = stmfts_brightness_set;
+ sdata->led_cdev.brightness_get = stmfts_brightness_get;
+
+ err = devm_led_classdev_register(&sdata->client->dev, &sdata->led_cdev);
+diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
+index 64d1402882c8..1f71c14c8aab 100644
+--- a/drivers/media/i2c/ov7670.c
++++ b/drivers/media/i2c/ov7670.c
+@@ -159,10 +159,10 @@ MODULE_PARM_DESC(debug, "Debug level (0-1)");
+ #define REG_GFIX 0x69 /* Fix gain control */
+
+ #define REG_DBLV 0x6b /* PLL control an debugging */
+-#define DBLV_BYPASS 0x00 /* Bypass PLL */
+-#define DBLV_X4 0x01 /* clock x4 */
+-#define DBLV_X6 0x10 /* clock x6 */
+-#define DBLV_X8 0x11 /* clock x8 */
++#define DBLV_BYPASS 0x0a /* Bypass PLL */
++#define DBLV_X4 0x4a /* clock x4 */
++#define DBLV_X6 0x8a /* clock x6 */
++#define DBLV_X8 0xca /* clock x8 */
+
+ #define REG_SCALING_XSC 0x70 /* Test pattern and horizontal scale factor */
+ #define TEST_PATTTERN_0 0x80
+@@ -862,7 +862,7 @@ static int ov7675_set_framerate(struct v4l2_subdev *sd,
+ if (ret < 0)
+ return ret;
+
+- return ov7670_write(sd, REG_DBLV, DBLV_X4);
++ return 0;
+ }
+
+ static void ov7670_get_framerate_legacy(struct v4l2_subdev *sd,
+@@ -1797,11 +1797,7 @@ static int ov7670_probe(struct i2c_client *client,
+ if (config->clock_speed)
+ info->clock_speed = config->clock_speed;
+
+- /*
+- * It should be allowed for ov7670 too when it is migrated to
+- * the new frame rate formula.
+- */
+- if (config->pll_bypass && id->driver_data != MODEL_OV7670)
++ if (config->pll_bypass)
+ info->pll_bypass = true;
+
+ if (config->pclk_hb_disable)
+diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
+index 299016bc46d9..104477b512a2 100644
+--- a/drivers/mfd/twl-core.c
++++ b/drivers/mfd/twl-core.c
+@@ -1245,6 +1245,28 @@ free:
+ return status;
+ }
+
++static int __maybe_unused twl_suspend(struct device *dev)
++{
++ struct i2c_client *client = to_i2c_client(dev);
++
++ if (client->irq)
++ disable_irq(client->irq);
++
++ return 0;
++}
++
++static int __maybe_unused twl_resume(struct device *dev)
++{
++ struct i2c_client *client = to_i2c_client(dev);
++
++ if (client->irq)
++ enable_irq(client->irq);
++
++ return 0;
++}
++
++static SIMPLE_DEV_PM_OPS(twl_dev_pm_ops, twl_suspend, twl_resume);
++
+ static const struct i2c_device_id twl_ids[] = {
+ { "twl4030", TWL4030_VAUX2 }, /* "Triton 2" */
+ { "twl5030", 0 }, /* T2 updated */
+@@ -1262,6 +1284,7 @@ static const struct i2c_device_id twl_ids[] = {
+ /* One Client Driver , 4 Clients */
+ static struct i2c_driver twl_driver = {
+ .driver.name = DRIVER_NAME,
++ .driver.pm = &twl_dev_pm_ops,
+ .id_table = twl_ids,
+ .probe = twl_probe,
+ .remove = twl_remove,
+diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
+index 2f120b2ffef0..4985268e2273 100644
+--- a/drivers/net/bonding/bond_sysfs_slave.c
++++ b/drivers/net/bonding/bond_sysfs_slave.c
+@@ -55,7 +55,9 @@ static SLAVE_ATTR_RO(link_failure_count);
+
+ static ssize_t perm_hwaddr_show(struct slave *slave, char *buf)
+ {
+- return sprintf(buf, "%pM\n", slave->perm_hwaddr);
++ return sprintf(buf, "%*phC\n",
++ slave->dev->addr_len,
++ slave->perm_hwaddr);
+ }
+ static SLAVE_ATTR_RO(perm_hwaddr);
+
+diff --git a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
+index 74849be5f004..e2919005ead3 100644
+--- a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
++++ b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c
+@@ -354,7 +354,10 @@ static struct cxgbi_ppm_pool *ppm_alloc_cpu_pool(unsigned int *total,
+ ppmax = max;
+
+ /* pool size must be multiple of unsigned long */
+- bmap = BITS_TO_LONGS(ppmax);
++ bmap = ppmax / BITS_PER_TYPE(unsigned long);
++ if (!bmap)
++ return NULL;
++
+ ppmax = (bmap * sizeof(unsigned long)) << 3;
+
+ alloc_sz = sizeof(*pools) + sizeof(unsigned long) * bmap;
+@@ -402,6 +405,10 @@ int cxgbi_ppm_init(void **ppm_pp, struct net_device *ndev,
+ if (reserve_factor) {
+ ppmax_pool = ppmax / reserve_factor;
+ pool = ppm_alloc_cpu_pool(&ppmax_pool, &pool_index_max);
++ if (!pool) {
++ ppmax_pool = 0;
++ reserve_factor = 0;
++ }
+
+ pr_debug("%s: ppmax %u, cpu total %u, per cpu %u.\n",
+ ndev->name, ppmax, ppmax_pool, pool_index_max);
+diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
+index 79d03f8ee7b1..c7fa97a7e1f4 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
++++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
+@@ -150,7 +150,6 @@ out_buffer_fail:
+ /* free desc along with its attached buffer */
+ static void hnae_free_desc(struct hnae_ring *ring)
+ {
+- hnae_free_buffers(ring);
+ dma_unmap_single(ring_to_dev(ring), ring->desc_dma_addr,
+ ring->desc_num * sizeof(ring->desc[0]),
+ ring_to_dma_dir(ring));
+@@ -183,6 +182,9 @@ static int hnae_alloc_desc(struct hnae_ring *ring)
+ /* fini ring, also free the buffer for the ring */
+ static void hnae_fini_ring(struct hnae_ring *ring)
+ {
++ if (is_rx_ring(ring))
++ hnae_free_buffers(ring);
++
+ hnae_free_desc(ring);
+ kfree(ring->desc_cb);
+ ring->desc_cb = NULL;
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+index b8155f5e71b4..fdff5526d2e8 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -2750,6 +2750,17 @@ int hns_dsaf_get_regs_count(void)
+ return DSAF_DUMP_REGS_NUM;
+ }
+
++static int hns_dsaf_get_port_id(u8 port)
++{
++ if (port < DSAF_SERVICE_NW_NUM)
++ return port;
++
++ if (port >= DSAF_BASE_INNER_PORT_NUM)
++ return port - DSAF_BASE_INNER_PORT_NUM + DSAF_SERVICE_NW_NUM;
++
++ return -EINVAL;
++}
++
+ static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
+ {
+ struct dsaf_tbl_tcam_ucast_cfg tbl_tcam_ucast = {0, 1, 0, 0, 0x80};
+@@ -2815,23 +2826,33 @@ static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
+ memset(&temp_key, 0x0, sizeof(temp_key));
+ mask_entry.addr[0] = 0x01;
+ hns_dsaf_set_mac_key(dsaf_dev, &mask_key, mask_entry.in_vlan_id,
+- port, mask_entry.addr);
++ 0xf, mask_entry.addr);
+ tbl_tcam_mcast.tbl_mcast_item_vld = 1;
+ tbl_tcam_mcast.tbl_mcast_old_en = 0;
+
+- if (port < DSAF_SERVICE_NW_NUM) {
+- mskid = port;
+- } else if (port >= DSAF_BASE_INNER_PORT_NUM) {
+- mskid = port - DSAF_BASE_INNER_PORT_NUM + DSAF_SERVICE_NW_NUM;
+- } else {
++ /* set MAC port to handle multicast */
++ mskid = hns_dsaf_get_port_id(port);
++ if (mskid == -EINVAL) {
+ dev_err(dsaf_dev->dev, "%s,pnum(%d)error,key(%#x:%#x)\n",
+ dsaf_dev->ae_dev.name, port,
+ mask_key.high.val, mask_key.low.val);
+ return;
+ }
++ dsaf_set_bit(tbl_tcam_mcast.tbl_mcast_port_msk[mskid / 32],
++ mskid % 32, 1);
+
++ /* set pool bit map to handle multicast */
++ mskid = hns_dsaf_get_port_id(port_num);
++ if (mskid == -EINVAL) {
++ dev_err(dsaf_dev->dev,
++ "%s, pool bit map pnum(%d)error,key(%#x:%#x)\n",
++ dsaf_dev->ae_dev.name, port_num,
++ mask_key.high.val, mask_key.low.val);
++ return;
++ }
+ dsaf_set_bit(tbl_tcam_mcast.tbl_mcast_port_msk[mskid / 32],
+ mskid % 32, 1);
++
+ memcpy(&temp_key, &mask_key, sizeof(mask_key));
+ hns_dsaf_tcam_mc_cfg_vague(dsaf_dev, entry_index, &tbl_tcam_data_mc,
+ (struct dsaf_tbl_tcam_data *)(&mask_key),
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
+index ba4316910dea..a60f207768fc 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
+@@ -129,7 +129,7 @@ static void hns_xgmac_lf_rf_control_init(struct mac_driver *mac_drv)
+ dsaf_set_bit(val, XGMAC_UNIDIR_EN_B, 0);
+ dsaf_set_bit(val, XGMAC_RF_TX_EN_B, 1);
+ dsaf_set_field(val, XGMAC_LF_RF_INSERT_M, XGMAC_LF_RF_INSERT_S, 0);
+- dsaf_write_reg(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val);
++ dsaf_write_dev(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val);
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index cc84133c184d..1c70f9aa0aa7 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -29,9 +29,6 @@
+
+ #define SERVICE_TIMER_HZ (1 * HZ)
+
+-#define NIC_TX_CLEAN_MAX_NUM 256
+-#define NIC_RX_CLEAN_MAX_NUM 64
+-
+ #define RCB_IRQ_NOT_INITED 0
+ #define RCB_IRQ_INITED 1
+ #define HNS_BUFFER_SIZE_2048 2048
+@@ -376,8 +373,6 @@ netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
+ wmb(); /* commit all data before submit */
+ assert(skb->queue_mapping < priv->ae_handle->q_num);
+ hnae_queue_xmit(priv->ae_handle->qs[skb->queue_mapping], buf_num);
+- ring->stats.tx_pkts++;
+- ring->stats.tx_bytes += skb->len;
+
+ return NETDEV_TX_OK;
+
+@@ -999,6 +994,9 @@ static int hns_nic_tx_poll_one(struct hns_nic_ring_data *ring_data,
+ /* issue prefetch for next Tx descriptor */
+ prefetch(&ring->desc_cb[ring->next_to_clean]);
+ }
++ /* update tx ring statistics. */
++ ring->stats.tx_pkts += pkts;
++ ring->stats.tx_bytes += bytes;
+
+ NETIF_TX_UNLOCK(ring);
+
+@@ -2150,7 +2148,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv)
+ hns_nic_tx_fini_pro_v2;
+
+ netif_napi_add(priv->netdev, &rd->napi,
+- hns_nic_common_poll, NIC_TX_CLEAN_MAX_NUM);
++ hns_nic_common_poll, NAPI_POLL_WEIGHT);
+ rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED;
+ }
+ for (i = h->q_num; i < h->q_num * 2; i++) {
+@@ -2163,7 +2161,7 @@ static int hns_nic_init_ring_data(struct hns_nic_priv *priv)
+ hns_nic_rx_fini_pro_v2;
+
+ netif_napi_add(priv->netdev, &rd->napi,
+- hns_nic_common_poll, NIC_RX_CLEAN_MAX_NUM);
++ hns_nic_common_poll, NAPI_POLL_WEIGHT);
+ rd->ring->irq_init_flag = RCB_IRQ_NOT_INITED;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile b/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
+index cb8ddd043476..d278fc7ea3ed 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/Makefile
+@@ -3,7 +3,7 @@
+ # Makefile for the HISILICON network device drivers.
+ #
+
+-ccflags-y := -Idrivers/net/ethernet/hisilicon/hns3
++ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3
+
+ obj-$(CONFIG_HNS3_HCLGE) += hclge.o
+ hclge-objs = hclge_main.o hclge_cmd.o hclge_mdio.o hclge_tm.o hclge_mbx.o
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile b/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
+index fb93bbd35845..6193f8fa7cf3 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/Makefile
+@@ -3,7 +3,7 @@
+ # Makefile for the HISILICON network device drivers.
+ #
+
+-ccflags-y := -Idrivers/net/ethernet/hisilicon/hns3
++ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3
+
+ obj-$(CONFIG_HNS3_HCLGEVF) += hclgevf.o
+ hclgevf-objs = hclgevf_main.o hclgevf_cmd.o hclgevf_mbx.o
+\ No newline at end of file
+diff --git a/drivers/net/ethernet/intel/igb/e1000_defines.h b/drivers/net/ethernet/intel/igb/e1000_defines.h
+index 8a28f3388f69..dca671591ef6 100644
+--- a/drivers/net/ethernet/intel/igb/e1000_defines.h
++++ b/drivers/net/ethernet/intel/igb/e1000_defines.h
+@@ -194,6 +194,8 @@
+ /* enable link status from external LINK_0 and LINK_1 pins */
+ #define E1000_CTRL_SWDPIN0 0x00040000 /* SWDPIN 0 value */
+ #define E1000_CTRL_SWDPIN1 0x00080000 /* SWDPIN 1 value */
++#define E1000_CTRL_ADVD3WUC 0x00100000 /* D3 WUC */
++#define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000 /* PHY PM enable */
+ #define E1000_CTRL_SDP0_DIR 0x00400000 /* SDP0 Data direction */
+ #define E1000_CTRL_SDP1_DIR 0x00800000 /* SDP1 Data direction */
+ #define E1000_CTRL_RST 0x04000000 /* Global reset */
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index ffaa6e031632..aa39a068858e 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -8754,9 +8754,7 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
+ struct e1000_hw *hw = &adapter->hw;
+ u32 ctrl, rctl, status;
+ u32 wufc = runtime ? E1000_WUFC_LNKC : adapter->wol;
+-#ifdef CONFIG_PM
+- int retval = 0;
+-#endif
++ bool wake;
+
+ rtnl_lock();
+ netif_device_detach(netdev);
+@@ -8769,14 +8767,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
+ igb_clear_interrupt_scheme(adapter);
+ rtnl_unlock();
+
+-#ifdef CONFIG_PM
+- if (!runtime) {
+- retval = pci_save_state(pdev);
+- if (retval)
+- return retval;
+- }
+-#endif
+-
+ status = rd32(E1000_STATUS);
+ if (status & E1000_STATUS_LU)
+ wufc &= ~E1000_WUFC_LNKC;
+@@ -8793,10 +8783,6 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
+ }
+
+ ctrl = rd32(E1000_CTRL);
+- /* advertise wake from D3Cold */
+- #define E1000_CTRL_ADVD3WUC 0x00100000
+- /* phy power management enable */
+- #define E1000_CTRL_EN_PHY_PWR_MGMT 0x00200000
+ ctrl |= E1000_CTRL_ADVD3WUC;
+ wr32(E1000_CTRL, ctrl);
+
+@@ -8810,12 +8796,15 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake,
+ wr32(E1000_WUFC, 0);
+ }
+
+- *enable_wake = wufc || adapter->en_mng_pt;
+- if (!*enable_wake)
++ wake = wufc || adapter->en_mng_pt;
++ if (!wake)
+ igb_power_down_link(adapter);
+ else
+ igb_power_up_link(adapter);
+
++ if (enable_wake)
++ *enable_wake = wake;
++
+ /* Release control of h/w to f/w. If f/w is AMT enabled, this
+ * would have already happened in close and is redundant.
+ */
+@@ -8858,22 +8847,7 @@ static void igb_deliver_wake_packet(struct net_device *netdev)
+
+ static int __maybe_unused igb_suspend(struct device *dev)
+ {
+- int retval;
+- bool wake;
+- struct pci_dev *pdev = to_pci_dev(dev);
+-
+- retval = __igb_shutdown(pdev, &wake, 0);
+- if (retval)
+- return retval;
+-
+- if (wake) {
+- pci_prepare_to_sleep(pdev);
+- } else {
+- pci_wake_from_d3(pdev, false);
+- pci_set_power_state(pdev, PCI_D3hot);
+- }
+-
+- return 0;
++ return __igb_shutdown(to_pci_dev(dev), NULL, 0);
+ }
+
+ static int __maybe_unused igb_resume(struct device *dev)
+@@ -8944,22 +8918,7 @@ static int __maybe_unused igb_runtime_idle(struct device *dev)
+
+ static int __maybe_unused igb_runtime_suspend(struct device *dev)
+ {
+- struct pci_dev *pdev = to_pci_dev(dev);
+- int retval;
+- bool wake;
+-
+- retval = __igb_shutdown(pdev, &wake, 1);
+- if (retval)
+- return retval;
+-
+- if (wake) {
+- pci_prepare_to_sleep(pdev);
+- } else {
+- pci_wake_from_d3(pdev, false);
+- pci_set_power_state(pdev, PCI_D3hot);
+- }
+-
+- return 0;
++ return __igb_shutdown(to_pci_dev(dev), NULL, 1);
+ }
+
+ static int __maybe_unused igb_runtime_resume(struct device *dev)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index 26c9f9421901..55ccd90beeb0 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -80,8 +80,7 @@ static int arm_vport_context_events_cmd(struct mlx5_core_dev *dev, u16 vport,
+ opcode, MLX5_CMD_OP_MODIFY_NIC_VPORT_CONTEXT);
+ MLX5_SET(modify_nic_vport_context_in, in, field_select.change_event, 1);
+ MLX5_SET(modify_nic_vport_context_in, in, vport_number, vport);
+- if (vport)
+- MLX5_SET(modify_nic_vport_context_in, in, other_vport, 1);
++ MLX5_SET(modify_nic_vport_context_in, in, other_vport, 1);
+ nic_vport_ctx = MLX5_ADDR_OF(modify_nic_vport_context_in,
+ in, nic_vport_context);
+
+@@ -109,8 +108,7 @@ static int modify_esw_vport_context_cmd(struct mlx5_core_dev *dev, u16 vport,
+ MLX5_SET(modify_esw_vport_context_in, in, opcode,
+ MLX5_CMD_OP_MODIFY_ESW_VPORT_CONTEXT);
+ MLX5_SET(modify_esw_vport_context_in, in, vport_number, vport);
+- if (vport)
+- MLX5_SET(modify_esw_vport_context_in, in, other_vport, 1);
++ MLX5_SET(modify_esw_vport_context_in, in, other_vport, 1);
+ return mlx5_cmd_exec(dev, in, inlen, out, sizeof(out));
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+index 40d6356a7e73..3dfb07a78952 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h
++++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h
+@@ -29,11 +29,13 @@
+ /* Specific functions used for Ring mode */
+
+ /* Enhanced descriptors */
+-static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end)
++static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end,
++ int bfsize)
+ {
+- p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
+- << ERDES1_BUFFER2_SIZE_SHIFT)
+- & ERDES1_BUFFER2_SIZE_MASK);
++ if (bfsize == BUF_SIZE_16KiB)
++ p->des1 |= cpu_to_le32((BUF_SIZE_8KiB
++ << ERDES1_BUFFER2_SIZE_SHIFT)
++ & ERDES1_BUFFER2_SIZE_MASK);
+
+ if (end)
+ p->des1 |= cpu_to_le32(ERDES1_END_RING);
+@@ -59,11 +61,15 @@ static inline void enh_set_tx_desc_len_on_ring(struct dma_desc *p, int len)
+ }
+
+ /* Normal descriptors */
+-static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end)
++static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize)
+ {
+- p->des1 |= cpu_to_le32(((BUF_SIZE_2KiB - 1)
+- << RDES1_BUFFER2_SIZE_SHIFT)
+- & RDES1_BUFFER2_SIZE_MASK);
++ if (bfsize >= BUF_SIZE_2KiB) {
++ int bfsize2;
++
++ bfsize2 = min(bfsize - BUF_SIZE_2KiB + 1, BUF_SIZE_2KiB - 1);
++ p->des1 |= cpu_to_le32((bfsize2 << RDES1_BUFFER2_SIZE_SHIFT)
++ & RDES1_BUFFER2_SIZE_MASK);
++ }
+
+ if (end)
+ p->des1 |= cpu_to_le32(RDES1_END_RING);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+index 736e29635b77..313a58b68fee 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+@@ -296,7 +296,7 @@ exit:
+ }
+
+ static void dwmac4_rd_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
+- int mode, int end)
++ int mode, int end, int bfsize)
+ {
+ dwmac4_set_rx_owner(p, disable_rx_ic);
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
+index 1d858fdec997..98fa471da7c0 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c
+@@ -123,7 +123,7 @@ static int dwxgmac2_get_rx_timestamp_status(void *desc, void *next_desc,
+ }
+
+ static void dwxgmac2_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
+- int mode, int end)
++ int mode, int end, int bfsize)
+ {
+ dwxgmac2_set_rx_owner(p, disable_rx_ic);
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+index 5ef91a790f9d..5202d6ad7919 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+@@ -201,6 +201,11 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
+ if (unlikely(rdes0 & RDES0_OWN))
+ return dma_own;
+
++ if (unlikely(!(rdes0 & RDES0_LAST_DESCRIPTOR))) {
++ stats->rx_length_errors++;
++ return discard_frame;
++ }
++
+ if (unlikely(rdes0 & RDES0_ERROR_SUMMARY)) {
+ if (unlikely(rdes0 & RDES0_DESCRIPTOR_ERROR)) {
+ x->rx_desc++;
+@@ -231,9 +236,10 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
+ * It doesn't match with the information reported into the databook.
+ * At any rate, we need to understand if the CSUM hw computation is ok
+ * and report this info to the upper layers. */
+- ret = enh_desc_coe_rdes0(!!(rdes0 & RDES0_IPC_CSUM_ERROR),
+- !!(rdes0 & RDES0_FRAME_TYPE),
+- !!(rdes0 & ERDES0_RX_MAC_ADDR));
++ if (likely(ret == good_frame))
++ ret = enh_desc_coe_rdes0(!!(rdes0 & RDES0_IPC_CSUM_ERROR),
++ !!(rdes0 & RDES0_FRAME_TYPE),
++ !!(rdes0 & ERDES0_RX_MAC_ADDR));
+
+ if (unlikely(rdes0 & RDES0_DRIBBLING))
+ x->dribbling_bit++;
+@@ -259,15 +265,19 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
+ }
+
+ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
+- int mode, int end)
++ int mode, int end, int bfsize)
+ {
++ int bfsize1;
++
+ p->des0 |= cpu_to_le32(RDES0_OWN);
+- p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK);
++
++ bfsize1 = min(bfsize, BUF_SIZE_8KiB);
++ p->des1 |= cpu_to_le32(bfsize1 & ERDES1_BUFFER1_SIZE_MASK);
+
+ if (mode == STMMAC_CHAIN_MODE)
+ ehn_desc_rx_set_on_chain(p);
+ else
+- ehn_desc_rx_set_on_ring(p, end);
++ ehn_desc_rx_set_on_ring(p, end, bfsize);
+
+ if (disable_rx_ic)
+ p->des1 |= cpu_to_le32(ERDES1_DISABLE_IC);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
+index 92b8944f26e3..5bb00234d961 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
++++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
+@@ -33,7 +33,7 @@ struct dma_extended_desc;
+ struct stmmac_desc_ops {
+ /* DMA RX descriptor ring initialization */
+ void (*init_rx_desc)(struct dma_desc *p, int disable_rx_ic, int mode,
+- int end);
++ int end, int bfsize);
+ /* DMA TX descriptor ring initialization */
+ void (*init_tx_desc)(struct dma_desc *p, int mode, int end);
+ /* Invoked by the xmit function to prepare the tx descriptor */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+index de65bb29feba..b7dd4e3c760d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+@@ -91,8 +91,6 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
+ return dma_own;
+
+ if (unlikely(!(rdes0 & RDES0_LAST_DESCRIPTOR))) {
+- pr_warn("%s: Oversized frame spanned multiple buffers\n",
+- __func__);
+ stats->rx_length_errors++;
+ return discard_frame;
+ }
+@@ -135,15 +133,19 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
+ }
+
+ static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
+- int end)
++ int end, int bfsize)
+ {
++ int bfsize1;
++
+ p->des0 |= cpu_to_le32(RDES0_OWN);
+- p->des1 |= cpu_to_le32((BUF_SIZE_2KiB - 1) & RDES1_BUFFER1_SIZE_MASK);
++
++ bfsize1 = min(bfsize, BUF_SIZE_2KiB - 1);
++ p->des1 |= cpu_to_le32(bfsize & RDES1_BUFFER1_SIZE_MASK);
+
+ if (mode == STMMAC_CHAIN_MODE)
+ ndesc_rx_set_on_chain(p, end);
+ else
+- ndesc_rx_set_on_ring(p, end);
++ ndesc_rx_set_on_ring(p, end, bfsize);
+
+ if (disable_rx_ic)
+ p->des1 |= cpu_to_le32(RDES1_DISABLE_IC);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 39c105092214..5debe93ea4eb 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -1111,11 +1111,13 @@ static void stmmac_clear_rx_descriptors(struct stmmac_priv *priv, u32 queue)
+ if (priv->extend_desc)
+ stmmac_init_rx_desc(priv, &rx_q->dma_erx[i].basic,
+ priv->use_riwt, priv->mode,
+- (i == DMA_RX_SIZE - 1));
++ (i == DMA_RX_SIZE - 1),
++ priv->dma_buf_sz);
+ else
+ stmmac_init_rx_desc(priv, &rx_q->dma_rx[i],
+ priv->use_riwt, priv->mode,
+- (i == DMA_RX_SIZE - 1));
++ (i == DMA_RX_SIZE - 1),
++ priv->dma_buf_sz);
+ }
+
+ /**
+@@ -3331,9 +3333,8 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ {
+ struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+ struct stmmac_channel *ch = &priv->channel[queue];
+- unsigned int entry = rx_q->cur_rx;
++ unsigned int next_entry = rx_q->cur_rx;
+ int coe = priv->hw->rx_csum;
+- unsigned int next_entry;
+ unsigned int count = 0;
+ bool xmac;
+
+@@ -3351,10 +3352,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ stmmac_display_ring(priv, rx_head, DMA_RX_SIZE, true);
+ }
+ while (count < limit) {
+- int status;
++ int entry, status;
+ struct dma_desc *p;
+ struct dma_desc *np;
+
++ entry = next_entry;
++
+ if (priv->extend_desc)
+ p = (struct dma_desc *)(rx_q->dma_erx + entry);
+ else
+@@ -3410,11 +3413,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ * ignored
+ */
+ if (frame_len > priv->dma_buf_sz) {
+- netdev_err(priv->dev,
+- "len %d larger than size (%d)\n",
+- frame_len, priv->dma_buf_sz);
++ if (net_ratelimit())
++ netdev_err(priv->dev,
++ "len %d larger than size (%d)\n",
++ frame_len, priv->dma_buf_sz);
+ priv->dev->stats.rx_length_errors++;
+- break;
++ continue;
+ }
+
+ /* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3
+@@ -3449,7 +3453,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ dev_warn(priv->device,
+ "packet dropped\n");
+ priv->dev->stats.rx_dropped++;
+- break;
++ continue;
+ }
+
+ dma_sync_single_for_cpu(priv->device,
+@@ -3469,11 +3473,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ } else {
+ skb = rx_q->rx_skbuff[entry];
+ if (unlikely(!skb)) {
+- netdev_err(priv->dev,
+- "%s: Inconsistent Rx chain\n",
+- priv->dev->name);
++ if (net_ratelimit())
++ netdev_err(priv->dev,
++ "%s: Inconsistent Rx chain\n",
++ priv->dev->name);
+ priv->dev->stats.rx_dropped++;
+- break;
++ continue;
+ }
+ prefetch(skb->data - NET_IP_ALIGN);
+ rx_q->rx_skbuff[entry] = NULL;
+@@ -3508,7 +3513,6 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ priv->dev->stats.rx_packets++;
+ priv->dev->stats.rx_bytes += frame_len;
+ }
+- entry = next_entry;
+ }
+
+ stmmac_rx_refill(priv, queue);
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/5000.c b/drivers/net/wireless/intel/iwlwifi/cfg/5000.c
+index 36151e61a26f..c04d934b23b4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/5000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/5000.c
+@@ -1,7 +1,7 @@
+ /******************************************************************************
+ *
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+@@ -140,6 +140,7 @@ const struct iwl_cfg iwl5350_agn_cfg = {
+ .ht_params = &iwl5000_ht_params,
+ .led_mode = IWL_LED_BLINK,
+ .internal_wimax_coex = true,
++ .csr = &iwl_csr_v1,
+ };
+
+ #define IWL_DEVICE_5150 \
+diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
+index d49fbd58afa7..bfbe3aa058d9 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
++++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
+@@ -181,7 +181,7 @@ static int mwifiex_sdio_resume(struct device *dev)
+
+ adapter = card->adapter;
+
+- if (test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
++ if (!test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
+ mwifiex_dbg(adapter, WARN,
+ "device already resumed\n");
+ return 0;
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index b5ec96abd048..776b7e9e23b9 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -921,6 +921,15 @@ bool nvmet_host_allowed(struct nvmet_req *req, struct nvmet_subsys *subsys,
+ return __nvmet_host_allowed(subsys, hostnqn);
+ }
+
++static void nvmet_fatal_error_handler(struct work_struct *work)
++{
++ struct nvmet_ctrl *ctrl =
++ container_of(work, struct nvmet_ctrl, fatal_err_work);
++
++ pr_err("ctrl %d fatal error occurred!\n", ctrl->cntlid);
++ ctrl->ops->delete_ctrl(ctrl);
++}
++
+ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn,
+ struct nvmet_req *req, u32 kato, struct nvmet_ctrl **ctrlp)
+ {
+@@ -962,6 +971,7 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn,
+
+ INIT_WORK(&ctrl->async_event_work, nvmet_async_event_work);
+ INIT_LIST_HEAD(&ctrl->async_events);
++ INIT_WORK(&ctrl->fatal_err_work, nvmet_fatal_error_handler);
+
+ memcpy(ctrl->subsysnqn, subsysnqn, NVMF_NQN_SIZE);
+ memcpy(ctrl->hostnqn, hostnqn, NVMF_NQN_SIZE);
+@@ -1076,21 +1086,11 @@ void nvmet_ctrl_put(struct nvmet_ctrl *ctrl)
+ kref_put(&ctrl->ref, nvmet_ctrl_free);
+ }
+
+-static void nvmet_fatal_error_handler(struct work_struct *work)
+-{
+- struct nvmet_ctrl *ctrl =
+- container_of(work, struct nvmet_ctrl, fatal_err_work);
+-
+- pr_err("ctrl %d fatal error occurred!\n", ctrl->cntlid);
+- ctrl->ops->delete_ctrl(ctrl);
+-}
+-
+ void nvmet_ctrl_fatal_error(struct nvmet_ctrl *ctrl)
+ {
+ mutex_lock(&ctrl->lock);
+ if (!(ctrl->csts & NVME_CSTS_CFS)) {
+ ctrl->csts |= NVME_CSTS_CFS;
+- INIT_WORK(&ctrl->fatal_err_work, nvmet_fatal_error_handler);
+ schedule_work(&ctrl->fatal_err_work);
+ }
+ mutex_unlock(&ctrl->lock);
+diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c
+index e0dcdb3cc070..088d1c2047e6 100644
+--- a/drivers/platform/x86/intel_pmc_core.c
++++ b/drivers/platform/x86/intel_pmc_core.c
+@@ -185,7 +185,7 @@ static const struct pmc_bit_map cnp_pfear_map[] = {
+ {"CNVI", BIT(3)},
+ {"UFS0", BIT(4)},
+ {"EMMC", BIT(5)},
+- {"Res_6", BIT(6)},
++ {"SPF", BIT(6)},
+ {"SBR6", BIT(7)},
+
+ {"SBR7", BIT(0)},
+@@ -682,7 +682,7 @@ static int __init pmc_core_probe(void)
+ * Sunrisepoint PCH regmap can't be used. Use Cannonlake PCH regmap
+ * in this case.
+ */
+- if (!pci_dev_present(pmc_pci_ids))
++ if (pmcdev->map == &spt_reg_map && !pci_dev_present(pmc_pci_ids))
+ pmcdev->map = &cnp_reg_map;
+
+ if (lpit_read_residency_count_address(&slp_s0_addr))
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index 8f018b3f3cd4..eaec2d306481 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -17,6 +17,7 @@
+
+ #include <linux/debugfs.h>
+ #include <linux/device.h>
++#include <linux/dmi.h>
+ #include <linux/init.h>
+ #include <linux/io.h>
+ #include <linux/platform_data/x86/clk-pmc-atom.h>
+@@ -391,11 +392,27 @@ static int pmc_dbgfs_register(struct pmc_dev *pmc)
+ }
+ #endif /* CONFIG_DEBUG_FS */
+
++/*
++ * Some systems need one or more of their pmc_plt_clks to be
++ * marked as critical.
++ */
++static const struct dmi_system_id critclk_systems[] __initconst = {
++ {
++ .ident = "MPL CEC1x",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MPL AG"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "CEC10 Family"),
++ },
++ },
++ { /*sentinel*/ }
++};
++
+ static int pmc_setup_clks(struct pci_dev *pdev, void __iomem *pmc_regmap,
+ const struct pmc_data *pmc_data)
+ {
+ struct platform_device *clkdev;
+ struct pmc_clk_data *clk_data;
++ const struct dmi_system_id *d = dmi_first_match(critclk_systems);
+
+ clk_data = kzalloc(sizeof(*clk_data), GFP_KERNEL);
+ if (!clk_data)
+@@ -403,6 +420,10 @@ static int pmc_setup_clks(struct pci_dev *pdev, void __iomem *pmc_regmap,
+
+ clk_data->base = pmc_regmap; /* offset is added by client */
+ clk_data->clks = pmc_data->clks;
++ if (d) {
++ clk_data->critical = true;
++ pr_info("%s critclks quirk enabled\n", d->ident);
++ }
+
+ clkdev = platform_device_register_data(&pdev->dev, "clk-pmc-atom",
+ PLATFORM_DEVID_NONE,
+diff --git a/drivers/reset/reset-meson-audio-arb.c b/drivers/reset/reset-meson-audio-arb.c
+index 91751617b37a..c53a2185a039 100644
+--- a/drivers/reset/reset-meson-audio-arb.c
++++ b/drivers/reset/reset-meson-audio-arb.c
+@@ -130,6 +130,7 @@ static int meson_audio_arb_probe(struct platform_device *pdev)
+ arb->rstc.nr_resets = ARRAY_SIZE(axg_audio_arb_reset_bits);
+ arb->rstc.ops = &meson_audio_arb_rstc_ops;
+ arb->rstc.of_node = dev->of_node;
++ arb->rstc.owner = THIS_MODULE;
+
+ /*
+ * Enable general :
+diff --git a/drivers/rtc/rtc-cros-ec.c b/drivers/rtc/rtc-cros-ec.c
+index e5444296075e..4d6bf9304ceb 100644
+--- a/drivers/rtc/rtc-cros-ec.c
++++ b/drivers/rtc/rtc-cros-ec.c
+@@ -298,7 +298,7 @@ static int cros_ec_rtc_suspend(struct device *dev)
+ struct cros_ec_rtc *cros_ec_rtc = dev_get_drvdata(&pdev->dev);
+
+ if (device_may_wakeup(dev))
+- enable_irq_wake(cros_ec_rtc->cros_ec->irq);
++ return enable_irq_wake(cros_ec_rtc->cros_ec->irq);
+
+ return 0;
+ }
+@@ -309,7 +309,7 @@ static int cros_ec_rtc_resume(struct device *dev)
+ struct cros_ec_rtc *cros_ec_rtc = dev_get_drvdata(&pdev->dev);
+
+ if (device_may_wakeup(dev))
+- disable_irq_wake(cros_ec_rtc->cros_ec->irq);
++ return disable_irq_wake(cros_ec_rtc->cros_ec->irq);
+
+ return 0;
+ }
+diff --git a/drivers/rtc/rtc-da9063.c b/drivers/rtc/rtc-da9063.c
+index b4e054c64bad..69b54e5556c0 100644
+--- a/drivers/rtc/rtc-da9063.c
++++ b/drivers/rtc/rtc-da9063.c
+@@ -480,6 +480,13 @@ static int da9063_rtc_probe(struct platform_device *pdev)
+ da9063_data_to_tm(data, &rtc->alarm_time, rtc);
+ rtc->rtc_sync = false;
+
++ /*
++ * TODO: some models have alarms on a minute boundary but still support
++ * real hardware interrupts. Add this once the core supports it.
++ */
++ if (config->rtc_data_start != RTC_SEC)
++ rtc->rtc_dev->uie_unsupported = 1;
++
+ irq_alarm = platform_get_irq_byname(pdev, "ALARM");
+ ret = devm_request_threaded_irq(&pdev->dev, irq_alarm, NULL,
+ da9063_alarm_event,
+diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
+index 51ba414798a8..3d7414e5ed35 100644
+--- a/drivers/rtc/rtc-sh.c
++++ b/drivers/rtc/rtc-sh.c
+@@ -377,7 +377,7 @@ static int sh_rtc_set_time(struct device *dev, struct rtc_time *tm)
+ static inline int sh_rtc_read_alarm_value(struct sh_rtc *rtc, int reg_off)
+ {
+ unsigned int byte;
+- int value = 0xff; /* return 0xff for ignored values */
++ int value = -1; /* return -1 for ignored values */
+
+ byte = readb(rtc->regbase + reg_off);
+ if (byte & AR_ENB) {
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index c4cbfd07b916..a08ff3bd6310 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -238,6 +238,7 @@ static struct {
+ {"NETAPP", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+ {"LSI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+ {"ENGENIO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
++ {"LENOVO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+ {"SMSC", "USB 2 HS-CF", NULL, BLIST_SPARSELUN | BLIST_INQUIRY_36},
+ {"SONY", "CD-ROM CDU-8001", NULL, BLIST_BORKEN},
+ {"SONY", "TSL", NULL, BLIST_FORCELUN}, /* DDS3 & DDS4 autoloaders */
+diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c
+index 5a58cbf3a75d..c14006ac98f9 100644
+--- a/drivers/scsi/scsi_dh.c
++++ b/drivers/scsi/scsi_dh.c
+@@ -75,6 +75,7 @@ static const struct scsi_dh_blist scsi_dh_blist[] = {
+ {"NETAPP", "INF-01-00", "rdac", },
+ {"LSI", "INF-01-00", "rdac", },
+ {"ENGENIO", "INF-01-00", "rdac", },
++ {"LENOVO", "DE_Series", "rdac", },
+ {NULL, NULL, NULL },
+ };
+
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index f03dc03a42c3..0c2ba075bc71 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -664,13 +664,22 @@ static void handle_sc_creation(struct vmbus_channel *new_sc)
+ static void handle_multichannel_storage(struct hv_device *device, int max_chns)
+ {
+ struct storvsc_device *stor_device;
+- int num_cpus = num_online_cpus();
+ int num_sc;
+ struct storvsc_cmd_request *request;
+ struct vstor_packet *vstor_packet;
+ int ret, t;
+
+- num_sc = ((max_chns > num_cpus) ? num_cpus : max_chns);
++ /*
++ * If the number of CPUs is artificially restricted, such as
++ * with maxcpus=1 on the kernel boot line, Hyper-V could offer
++ * sub-channels >= the number of CPUs. These sub-channels
++ * should not be created. The primary channel is already created
++ * and assigned to one CPU, so check against # CPUs - 1.
++ */
++ num_sc = min((int)(num_online_cpus() - 1), max_chns);
++ if (!num_sc)
++ return;
++
+ stor_device = get_out_stor_device(device);
+ if (!stor_device)
+ return;
+diff --git a/drivers/staging/iio/addac/adt7316.c b/drivers/staging/iio/addac/adt7316.c
+index 3f22d1088713..68866f552290 100644
+--- a/drivers/staging/iio/addac/adt7316.c
++++ b/drivers/staging/iio/addac/adt7316.c
+@@ -47,6 +47,8 @@
+ #define ADT7516_MSB_AIN3 0xA
+ #define ADT7516_MSB_AIN4 0xB
+ #define ADT7316_DA_DATA_BASE 0x10
++#define ADT7316_DA_10_BIT_LSB_SHIFT 6
++#define ADT7316_DA_12_BIT_LSB_SHIFT 4
+ #define ADT7316_DA_MSB_DATA_REGS 4
+ #define ADT7316_LSB_DAC_A 0x10
+ #define ADT7316_MSB_DAC_A 0x11
+@@ -1086,7 +1088,7 @@ static ssize_t adt7316_store_DAC_internal_Vref(struct device *dev,
+ ldac_config = chip->ldac_config & (~ADT7516_DAC_IN_VREF_MASK);
+ if (data & 0x1)
+ ldac_config |= ADT7516_DAC_AB_IN_VREF;
+- else if (data & 0x2)
++ if (data & 0x2)
+ ldac_config |= ADT7516_DAC_CD_IN_VREF;
+ } else {
+ ret = kstrtou8(buf, 16, &data);
+@@ -1408,7 +1410,7 @@ static IIO_DEVICE_ATTR(ex_analog_temp_offset, 0644,
+ static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip,
+ int channel, char *buf)
+ {
+- u16 data;
++ u16 data = 0;
+ u8 msb, lsb, offset;
+ int ret;
+
+@@ -1433,7 +1435,11 @@ static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip,
+ if (ret)
+ return -EIO;
+
+- data = (msb << offset) + (lsb & ((1 << offset) - 1));
++ if (chip->dac_bits == 12)
++ data = lsb >> ADT7316_DA_12_BIT_LSB_SHIFT;
++ else if (chip->dac_bits == 10)
++ data = lsb >> ADT7316_DA_10_BIT_LSB_SHIFT;
++ data |= msb << offset;
+
+ return sprintf(buf, "%d\n", data);
+ }
+@@ -1441,7 +1447,7 @@ static ssize_t adt7316_show_DAC(struct adt7316_chip_info *chip,
+ static ssize_t adt7316_store_DAC(struct adt7316_chip_info *chip,
+ int channel, const char *buf, size_t len)
+ {
+- u8 msb, lsb, offset;
++ u8 msb, lsb, lsb_reg, offset;
+ u16 data;
+ int ret;
+
+@@ -1459,9 +1465,13 @@ static ssize_t adt7316_store_DAC(struct adt7316_chip_info *chip,
+ return -EINVAL;
+
+ if (chip->dac_bits > 8) {
+- lsb = data & (1 << offset);
++ lsb = data & ((1 << offset) - 1);
++ if (chip->dac_bits == 12)
++ lsb_reg = lsb << ADT7316_DA_12_BIT_LSB_SHIFT;
++ else
++ lsb_reg = lsb << ADT7316_DA_10_BIT_LSB_SHIFT;
+ ret = chip->bus.write(chip->bus.client,
+- ADT7316_DA_DATA_BASE + channel * 2, lsb);
++ ADT7316_DA_DATA_BASE + channel * 2, lsb_reg);
+ if (ret)
+ return -EIO;
+ }
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index ef47c226e1d2..3255b2bb0fd5 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -473,11 +473,6 @@ static int usb_unbind_interface(struct device *dev)
+ pm_runtime_disable(dev);
+ pm_runtime_set_suspended(dev);
+
+- /* Undo any residual pm_autopm_get_interface_* calls */
+- for (r = atomic_read(&intf->pm_usage_cnt); r > 0; --r)
+- usb_autopm_put_interface_no_suspend(intf);
+- atomic_set(&intf->pm_usage_cnt, 0);
+-
+ if (!error)
+ usb_autosuspend_device(udev);
+
+@@ -1636,7 +1631,6 @@ void usb_autopm_put_interface(struct usb_interface *intf)
+ int status;
+
+ usb_mark_last_busy(udev);
+- atomic_dec(&intf->pm_usage_cnt);
+ status = pm_runtime_put_sync(&intf->dev);
+ dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
+ __func__, atomic_read(&intf->dev.power.usage_count),
+@@ -1665,7 +1659,6 @@ void usb_autopm_put_interface_async(struct usb_interface *intf)
+ int status;
+
+ usb_mark_last_busy(udev);
+- atomic_dec(&intf->pm_usage_cnt);
+ status = pm_runtime_put(&intf->dev);
+ dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
+ __func__, atomic_read(&intf->dev.power.usage_count),
+@@ -1687,7 +1680,6 @@ void usb_autopm_put_interface_no_suspend(struct usb_interface *intf)
+ struct usb_device *udev = interface_to_usbdev(intf);
+
+ usb_mark_last_busy(udev);
+- atomic_dec(&intf->pm_usage_cnt);
+ pm_runtime_put_noidle(&intf->dev);
+ }
+ EXPORT_SYMBOL_GPL(usb_autopm_put_interface_no_suspend);
+@@ -1718,8 +1710,6 @@ int usb_autopm_get_interface(struct usb_interface *intf)
+ status = pm_runtime_get_sync(&intf->dev);
+ if (status < 0)
+ pm_runtime_put_sync(&intf->dev);
+- else
+- atomic_inc(&intf->pm_usage_cnt);
+ dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
+ __func__, atomic_read(&intf->dev.power.usage_count),
+ status);
+@@ -1753,8 +1743,6 @@ int usb_autopm_get_interface_async(struct usb_interface *intf)
+ status = pm_runtime_get(&intf->dev);
+ if (status < 0 && status != -EINPROGRESS)
+ pm_runtime_put_noidle(&intf->dev);
+- else
+- atomic_inc(&intf->pm_usage_cnt);
+ dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
+ __func__, atomic_read(&intf->dev.power.usage_count),
+ status);
+@@ -1778,7 +1766,6 @@ void usb_autopm_get_interface_no_resume(struct usb_interface *intf)
+ struct usb_device *udev = interface_to_usbdev(intf);
+
+ usb_mark_last_busy(udev);
+- atomic_inc(&intf->pm_usage_cnt);
+ pm_runtime_get_noresume(&intf->dev);
+ }
+ EXPORT_SYMBOL_GPL(usb_autopm_get_interface_no_resume);
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index 4f33eb632a88..4020ce8db6ce 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -820,9 +820,11 @@ int usb_string(struct usb_device *dev, int index, char *buf, size_t size)
+
+ if (dev->state == USB_STATE_SUSPENDED)
+ return -EHOSTUNREACH;
+- if (size <= 0 || !buf || !index)
++ if (size <= 0 || !buf)
+ return -EINVAL;
+ buf[0] = 0;
++ if (index <= 0 || index >= 256)
++ return -EINVAL;
+ tbuf = kmalloc(256, GFP_NOIO);
+ if (!tbuf)
+ return -ENOMEM;
+diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
+index baf72f95f0f1..213b52508621 100644
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -979,8 +979,18 @@ static int dummy_udc_start(struct usb_gadget *g,
+ struct dummy_hcd *dum_hcd = gadget_to_dummy_hcd(g);
+ struct dummy *dum = dum_hcd->dum;
+
+- if (driver->max_speed == USB_SPEED_UNKNOWN)
++ switch (g->speed) {
++ /* All the speeds we support */
++ case USB_SPEED_LOW:
++ case USB_SPEED_FULL:
++ case USB_SPEED_HIGH:
++ case USB_SPEED_SUPER:
++ break;
++ default:
++ dev_err(dummy_dev(dum_hcd), "Unsupported driver max speed %d\n",
++ driver->max_speed);
+ return -EINVAL;
++ }
+
+ /*
+ * SLAVE side init ... the layer above hardware, which
+@@ -1784,9 +1794,10 @@ static void dummy_timer(struct timer_list *t)
+ /* Bus speed is 500000 bytes/ms, so use a little less */
+ total = 490000;
+ break;
+- default:
++ default: /* Can't happen */
+ dev_err(dummy_dev(dum_hcd), "bogus device speed\n");
+- return;
++ total = 0;
++ break;
+ }
+
+ /* FIXME if HZ != 1000 this will probably misbehave ... */
+@@ -1828,7 +1839,7 @@ restart:
+
+ /* Used up this frame's bandwidth? */
+ if (total <= 0)
+- break;
++ continue;
+
+ /* find the gadget's ep for this request (if configured) */
+ address = usb_pipeendpoint (urb->pipe);
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index 6d9fd5f64903..7b306aa22d25 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -314,6 +314,7 @@ static void yurex_disconnect(struct usb_interface *interface)
+ usb_deregister_dev(interface, &yurex_class);
+
+ /* prevent more I/O from starting */
++ usb_poison_urb(dev->urb);
+ mutex_lock(&dev->io_mutex);
+ dev->interface = NULL;
+ mutex_unlock(&dev->io_mutex);
+diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
+index 31b024441938..cc794e25a0b6 100644
+--- a/drivers/usb/storage/realtek_cr.c
++++ b/drivers/usb/storage/realtek_cr.c
+@@ -763,18 +763,16 @@ static void rts51x_suspend_timer_fn(struct timer_list *t)
+ break;
+ case RTS51X_STAT_IDLE:
+ case RTS51X_STAT_SS:
+- usb_stor_dbg(us, "RTS51X_STAT_SS, intf->pm_usage_cnt:%d, power.usage:%d\n",
+- atomic_read(&us->pusb_intf->pm_usage_cnt),
++ usb_stor_dbg(us, "RTS51X_STAT_SS, power.usage:%d\n",
+ atomic_read(&us->pusb_intf->dev.power.usage_count));
+
+- if (atomic_read(&us->pusb_intf->pm_usage_cnt) > 0) {
++ if (atomic_read(&us->pusb_intf->dev.power.usage_count) > 0) {
+ usb_stor_dbg(us, "Ready to enter SS state\n");
+ rts51x_set_stat(chip, RTS51X_STAT_SS);
+ /* ignore mass storage interface's children */
+ pm_suspend_ignore_children(&us->pusb_intf->dev, true);
+ usb_autopm_put_interface_async(us->pusb_intf);
+- usb_stor_dbg(us, "RTS51X_STAT_SS 01, intf->pm_usage_cnt:%d, power.usage:%d\n",
+- atomic_read(&us->pusb_intf->pm_usage_cnt),
++ usb_stor_dbg(us, "RTS51X_STAT_SS 01, power.usage:%d\n",
+ atomic_read(&us->pusb_intf->dev.power.usage_count));
+ }
+ break;
+@@ -807,11 +805,10 @@ static void rts51x_invoke_transport(struct scsi_cmnd *srb, struct us_data *us)
+ int ret;
+
+ if (working_scsi(srb)) {
+- usb_stor_dbg(us, "working scsi, intf->pm_usage_cnt:%d, power.usage:%d\n",
+- atomic_read(&us->pusb_intf->pm_usage_cnt),
++ usb_stor_dbg(us, "working scsi, power.usage:%d\n",
+ atomic_read(&us->pusb_intf->dev.power.usage_count));
+
+- if (atomic_read(&us->pusb_intf->pm_usage_cnt) <= 0) {
++ if (atomic_read(&us->pusb_intf->dev.power.usage_count) <= 0) {
+ ret = usb_autopm_get_interface(us->pusb_intf);
+ usb_stor_dbg(us, "working scsi, ret=%d\n", ret);
+ }
+diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
+index 97b09a42a10c..dbfb2f24d71e 100644
+--- a/drivers/usb/usbip/stub_rx.c
++++ b/drivers/usb/usbip/stub_rx.c
+@@ -361,16 +361,10 @@ static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu)
+ }
+
+ if (usb_endpoint_xfer_isoc(epd)) {
+- /* validate packet size and number of packets */
+- unsigned int maxp, packets, bytes;
+-
+- maxp = usb_endpoint_maxp(epd);
+- maxp *= usb_endpoint_maxp_mult(epd);
+- bytes = pdu->u.cmd_submit.transfer_buffer_length;
+- packets = DIV_ROUND_UP(bytes, maxp);
+-
++ /* validate number of packets */
+ if (pdu->u.cmd_submit.number_of_packets < 0 ||
+- pdu->u.cmd_submit.number_of_packets > packets) {
++ pdu->u.cmd_submit.number_of_packets >
++ USBIP_MAX_ISO_PACKETS) {
+ dev_err(&sdev->udev->dev,
+ "CMD_SUBMIT: isoc invalid num packets %d\n",
+ pdu->u.cmd_submit.number_of_packets);
+diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
+index bf8afe9b5883..8be857a4fa13 100644
+--- a/drivers/usb/usbip/usbip_common.h
++++ b/drivers/usb/usbip/usbip_common.h
+@@ -121,6 +121,13 @@ extern struct device_attribute dev_attr_usbip_debug;
+ #define USBIP_DIR_OUT 0x00
+ #define USBIP_DIR_IN 0x01
+
++/*
++ * Arbitrary limit for the maximum number of isochronous packets in an URB,
++ * compare for example the uhci_submit_isochronous function in
++ * drivers/usb/host/uhci-q.c
++ */
++#define USBIP_MAX_ISO_PACKETS 1024
++
+ /**
+ * struct usbip_header_basic - data pertinent to every request
+ * @command: the usbip request type
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index cddb453a1ba5..6cf00d9f512b 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -1443,11 +1443,11 @@ static void __init vfio_pci_fill_ids(void)
+ rc = pci_add_dynid(&vfio_pci_driver, vendor, device,
+ subvendor, subdevice, class, class_mask, 0);
+ if (rc)
+- pr_warn("failed to add dynamic id [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x (%d)\n",
++ pr_warn("failed to add dynamic id [%04x:%04x[%04x:%04x]] class %#08x/%08x (%d)\n",
+ vendor, device, subvendor, subdevice,
+ class, class_mask, rc);
+ else
+- pr_info("add [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x\n",
++ pr_info("add [%04x:%04x[%04x:%04x]] class %#08x/%08x\n",
+ vendor, device, subvendor, subdevice,
+ class, class_mask);
+ }
+diff --git a/drivers/w1/masters/ds2490.c b/drivers/w1/masters/ds2490.c
+index 0f4ecfcdb549..a9fb77585272 100644
+--- a/drivers/w1/masters/ds2490.c
++++ b/drivers/w1/masters/ds2490.c
+@@ -1016,15 +1016,15 @@ static int ds_probe(struct usb_interface *intf,
+ /* alternative 3, 1ms interrupt (greatly speeds search), 64 byte bulk */
+ alt = 3;
+ err = usb_set_interface(dev->udev,
+- intf->altsetting[alt].desc.bInterfaceNumber, alt);
++ intf->cur_altsetting->desc.bInterfaceNumber, alt);
+ if (err) {
+ dev_err(&dev->udev->dev, "Failed to set alternative setting %d "
+ "for %d interface: err=%d.\n", alt,
+- intf->altsetting[alt].desc.bInterfaceNumber, err);
++ intf->cur_altsetting->desc.bInterfaceNumber, err);
+ goto err_out_clear;
+ }
+
+- iface_desc = &intf->altsetting[alt];
++ iface_desc = intf->cur_altsetting;
+ if (iface_desc->desc.bNumEndpoints != NUM_EP-1) {
+ pr_info("Num endpoints=%d. It is not DS9490R.\n",
+ iface_desc->desc.bNumEndpoints);
+diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
+index c3e201025ef0..0782ff3c2273 100644
+--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
+@@ -622,9 +622,7 @@ static int xenbus_file_open(struct inode *inode, struct file *filp)
+ if (xen_store_evtchn == 0)
+ return -ENOENT;
+
+- nonseekable_open(inode, filp);
+-
+- filp->f_mode &= ~FMODE_ATOMIC_POS; /* cdev-style semantics */
++ stream_open(inode, filp);
+
+ u = kzalloc(sizeof(*u), GFP_KERNEL);
+ if (u == NULL)
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 41ef452c1fcf..e5126fad57c5 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -163,19 +163,24 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root)
+ return 0;
+ }
+
+-static void debugfs_evict_inode(struct inode *inode)
++static void debugfs_i_callback(struct rcu_head *head)
+ {
+- truncate_inode_pages_final(&inode->i_data);
+- clear_inode(inode);
++ struct inode *inode = container_of(head, struct inode, i_rcu);
+ if (S_ISLNK(inode->i_mode))
+ kfree(inode->i_link);
++ free_inode_nonrcu(inode);
++}
++
++static void debugfs_destroy_inode(struct inode *inode)
++{
++ call_rcu(&inode->i_rcu, debugfs_i_callback);
+ }
+
+ static const struct super_operations debugfs_super_operations = {
+ .statfs = simple_statfs,
+ .remount_fs = debugfs_remount,
+ .show_options = debugfs_show_options,
+- .evict_inode = debugfs_evict_inode,
++ .destroy_inode = debugfs_destroy_inode,
+ };
+
+ static void debugfs_release_dentry(struct dentry *dentry)
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index a7fa037b876b..a3a3d256fb0e 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -741,11 +741,17 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
+ umode_t mode, dev_t dev)
+ {
+ struct inode *inode;
+- struct resv_map *resv_map;
++ struct resv_map *resv_map = NULL;
+
+- resv_map = resv_map_alloc();
+- if (!resv_map)
+- return NULL;
++ /*
++ * Reserve maps are only needed for inodes that can have associated
++ * page allocations.
++ */
++ if (S_ISREG(mode) || S_ISLNK(mode)) {
++ resv_map = resv_map_alloc();
++ if (!resv_map)
++ return NULL;
++ }
+
+ inode = new_inode(sb);
+ if (inode) {
+@@ -780,8 +786,10 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
+ break;
+ }
+ lockdep_annotate_inode_mutex_key(inode);
+- } else
+- kref_put(&resv_map->refs, resv_map_release);
++ } else {
++ if (resv_map)
++ kref_put(&resv_map->refs, resv_map_release);
++ }
+
+ return inode;
+ }
+diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
+index 389ea53ea487..bccfc40b3a74 100644
+--- a/fs/jffs2/readinode.c
++++ b/fs/jffs2/readinode.c
+@@ -1414,11 +1414,6 @@ void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
+
+ jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
+
+- if (f->target) {
+- kfree(f->target);
+- f->target = NULL;
+- }
+-
+ fds = f->dents;
+ while(fds) {
+ fd = fds;
+diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
+index bb6ae387469f..05d892c79339 100644
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -47,7 +47,10 @@ static struct inode *jffs2_alloc_inode(struct super_block *sb)
+ static void jffs2_i_callback(struct rcu_head *head)
+ {
+ struct inode *inode = container_of(head, struct inode, i_rcu);
+- kmem_cache_free(jffs2_inode_cachep, JFFS2_INODE_INFO(inode));
++ struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
++
++ kfree(f->target);
++ kmem_cache_free(jffs2_inode_cachep, f);
+ }
+
+ static void jffs2_destroy_inode(struct inode *inode)
+diff --git a/fs/open.c b/fs/open.c
+index f1c2f855fd43..a00350018a47 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -1215,3 +1215,21 @@ int nonseekable_open(struct inode *inode, struct file *filp)
+ }
+
+ EXPORT_SYMBOL(nonseekable_open);
++
++/*
++ * stream_open is used by subsystems that want stream-like file descriptors.
++ * Such file descriptors are not seekable and don't have notion of position
++ * (file.f_pos is always 0). Contrary to file descriptors of other regular
++ * files, .read() and .write() can run simultaneously.
++ *
++ * stream_open never fails and is marked to return int so that it could be
++ * directly used as file_operations.open .
++ */
++int stream_open(struct inode *inode, struct file *filp)
++{
++ filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS);
++ filp->f_mode |= FMODE_STREAM;
++ return 0;
++}
++
++EXPORT_SYMBOL(stream_open);
+diff --git a/fs/read_write.c b/fs/read_write.c
+index 562974a0616c..85fd7a8ee29e 100644
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -560,12 +560,13 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_
+
+ static inline loff_t file_pos_read(struct file *file)
+ {
+- return file->f_pos;
++ return file->f_mode & FMODE_STREAM ? 0 : file->f_pos;
+ }
+
+ static inline void file_pos_write(struct file *file, loff_t pos)
+ {
+- file->f_pos = pos;
++ if ((file->f_mode & FMODE_STREAM) == 0)
++ file->f_pos = pos;
+ }
+
+ ssize_t ksys_read(unsigned int fd, char __user *buf, size_t count)
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 111c94c4baa1..d4e1b43a53c3 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -153,6 +153,9 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
+ #define FMODE_OPENED ((__force fmode_t)0x80000)
+ #define FMODE_CREATED ((__force fmode_t)0x100000)
+
++/* File is stream-like */
++#define FMODE_STREAM ((__force fmode_t)0x200000)
++
+ /* File was opened by fanotify and shouldn't generate fanotify events */
+ #define FMODE_NONOTIFY ((__force fmode_t)0x4000000)
+
+@@ -3019,6 +3022,7 @@ extern loff_t no_seek_end_llseek_size(struct file *, loff_t, int, loff_t);
+ extern loff_t no_seek_end_llseek(struct file *, loff_t, int);
+ extern int generic_file_open(struct inode * inode, struct file * filp);
+ extern int nonseekable_open(struct inode * inode, struct file * filp);
++extern int stream_open(struct inode * inode, struct file * filp);
+
+ #ifdef CONFIG_BLOCK
+ typedef void (dio_submit_t)(struct bio *bio, struct inode *inode,
+diff --git a/include/linux/i2c.h b/include/linux/i2c.h
+index 65b4eaed1d96..7e748648c7d3 100644
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -333,6 +333,7 @@ struct i2c_client {
+ char name[I2C_NAME_SIZE];
+ struct i2c_adapter *adapter; /* the adapter we sit on */
+ struct device dev; /* the device structure */
++ int init_irq; /* irq set at initialization */
+ int irq; /* irq issued by device */
+ struct list_head detected;
+ #if IS_ENABLED(CONFIG_I2C_SLAVE)
+diff --git a/include/linux/platform_data/x86/clk-pmc-atom.h b/include/linux/platform_data/x86/clk-pmc-atom.h
+index 3ab892208343..7a37ac27d0fb 100644
+--- a/include/linux/platform_data/x86/clk-pmc-atom.h
++++ b/include/linux/platform_data/x86/clk-pmc-atom.h
+@@ -35,10 +35,13 @@ struct pmc_clk {
+ *
+ * @base: PMC clock register base offset
+ * @clks: pointer to set of registered clocks, typically 0..5
++ * @critical: flag to indicate if firmware enabled pmc_plt_clks
++ * should be marked as critial or not
+ */
+ struct pmc_clk_data {
+ void __iomem *base;
+ const struct pmc_clk *clks;
++ bool critical;
+ };
+
+ #endif /* __PLATFORM_DATA_X86_CLK_PMC_ATOM_H */
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 5e49e82c4368..ff010d1fd1c7 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -200,7 +200,6 @@ usb_find_last_int_out_endpoint(struct usb_host_interface *alt,
+ * @dev: driver model's view of this device
+ * @usb_dev: if an interface is bound to the USB major, this will point
+ * to the sysfs representation for that device.
+- * @pm_usage_cnt: PM usage counter for this interface
+ * @reset_ws: Used for scheduling resets from atomic context.
+ * @resetting_device: USB core reset the device, so use alt setting 0 as
+ * current; needs bandwidth alloc after reset.
+@@ -257,7 +256,6 @@ struct usb_interface {
+
+ struct device dev; /* interface specific device info */
+ struct device *usb_dev;
+- atomic_t pm_usage_cnt; /* usage counter for autosuspend */
+ struct work_struct reset_ws; /* for resets in atomic context */
+ };
+ #define to_usb_interface(d) container_of(d, struct usb_interface, dev)
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index 17dd883198ae..72e3fb3bb037 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -1373,6 +1373,7 @@ static void scan_block(void *_start, void *_end,
+ /*
+ * Scan a large memory block in MAX_SCAN_SIZE chunks to reduce the latency.
+ */
++#ifdef CONFIG_SMP
+ static void scan_large_block(void *start, void *end)
+ {
+ void *next;
+@@ -1384,6 +1385,7 @@ static void scan_large_block(void *start, void *end)
+ cond_resched();
+ }
+ }
++#endif
+
+ /*
+ * Scan a memory block corresponding to a kmemleak_object. A condition is
+@@ -1501,11 +1503,6 @@ static void kmemleak_scan(void)
+ }
+ rcu_read_unlock();
+
+- /* data/bss scanning */
+- scan_large_block(_sdata, _edata);
+- scan_large_block(__bss_start, __bss_stop);
+- scan_large_block(__start_ro_after_init, __end_ro_after_init);
+-
+ #ifdef CONFIG_SMP
+ /* per-cpu sections scanning */
+ for_each_possible_cpu(i)
+@@ -2036,6 +2033,17 @@ void __init kmemleak_init(void)
+ }
+ local_irq_restore(flags);
+
++ /* register the data/bss sections */
++ create_object((unsigned long)_sdata, _edata - _sdata,
++ KMEMLEAK_GREY, GFP_ATOMIC);
++ create_object((unsigned long)__bss_start, __bss_stop - __bss_start,
++ KMEMLEAK_GREY, GFP_ATOMIC);
++ /* only register .data..ro_after_init if not within .data */
++ if (__start_ro_after_init < _sdata || __end_ro_after_init > _edata)
++ create_object((unsigned long)__start_ro_after_init,
++ __end_ro_after_init - __start_ro_after_init,
++ KMEMLEAK_GREY, GFP_ATOMIC);
++
+ /*
+ * This is the point where tracking allocations is safe. Automatic
+ * scanning is started during the late initcall. Add the early logged
+diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
+index ef0dec20c7d8..5da183b2f4c9 100644
+--- a/net/batman-adv/bat_v_elp.c
++++ b/net/batman-adv/bat_v_elp.c
+@@ -104,8 +104,10 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh)
+
+ ret = cfg80211_get_station(real_netdev, neigh->addr, &sinfo);
+
+- /* free the TID stats immediately */
+- cfg80211_sinfo_release_content(&sinfo);
++ if (!ret) {
++ /* free the TID stats immediately */
++ cfg80211_sinfo_release_content(&sinfo);
++ }
+
+ dev_put(real_netdev);
+ if (ret == -ENOENT) {
+diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
+index 5f1aeeded0e3..85faf25c2912 100644
+--- a/net/batman-adv/bridge_loop_avoidance.c
++++ b/net/batman-adv/bridge_loop_avoidance.c
+@@ -803,6 +803,8 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
+ const u8 *mac, const unsigned short vid)
+ {
+ struct batadv_bla_claim search_claim, *claim;
++ struct batadv_bla_claim *claim_removed_entry;
++ struct hlist_node *claim_removed_node;
+
+ ether_addr_copy(search_claim.addr, mac);
+ search_claim.vid = vid;
+@@ -813,10 +815,18 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
+ batadv_dbg(BATADV_DBG_BLA, bat_priv, "%s(): %pM, vid %d\n", __func__,
+ mac, batadv_print_vid(vid));
+
+- batadv_hash_remove(bat_priv->bla.claim_hash, batadv_compare_claim,
+- batadv_choose_claim, claim);
+- batadv_claim_put(claim); /* reference from the hash is gone */
++ claim_removed_node = batadv_hash_remove(bat_priv->bla.claim_hash,
++ batadv_compare_claim,
++ batadv_choose_claim, claim);
++ if (!claim_removed_node)
++ goto free_claim;
+
++ /* reference from the hash is gone */
++ claim_removed_entry = hlist_entry(claim_removed_node,
++ struct batadv_bla_claim, hash_entry);
++ batadv_claim_put(claim_removed_entry);
++
++free_claim:
+ /* don't need the reference from hash_find() anymore */
+ batadv_claim_put(claim);
+ }
+diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
+index d21624c44665..359ec1a6e822 100644
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -616,14 +616,26 @@ static void batadv_tt_global_free(struct batadv_priv *bat_priv,
+ struct batadv_tt_global_entry *tt_global,
+ const char *message)
+ {
++ struct batadv_tt_global_entry *tt_removed_entry;
++ struct hlist_node *tt_removed_node;
++
+ batadv_dbg(BATADV_DBG_TT, bat_priv,
+ "Deleting global tt entry %pM (vid: %d): %s\n",
+ tt_global->common.addr,
+ batadv_print_vid(tt_global->common.vid), message);
+
+- batadv_hash_remove(bat_priv->tt.global_hash, batadv_compare_tt,
+- batadv_choose_tt, &tt_global->common);
+- batadv_tt_global_entry_put(tt_global);
++ tt_removed_node = batadv_hash_remove(bat_priv->tt.global_hash,
++ batadv_compare_tt,
++ batadv_choose_tt,
++ &tt_global->common);
++ if (!tt_removed_node)
++ return;
++
++ /* drop reference of remove hash entry */
++ tt_removed_entry = hlist_entry(tt_removed_node,
++ struct batadv_tt_global_entry,
++ common.hash_entry);
++ batadv_tt_global_entry_put(tt_removed_entry);
+ }
+
+ /**
+@@ -1332,9 +1344,10 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr,
+ unsigned short vid, const char *message,
+ bool roaming)
+ {
++ struct batadv_tt_local_entry *tt_removed_entry;
+ struct batadv_tt_local_entry *tt_local_entry;
+ u16 flags, curr_flags = BATADV_NO_FLAGS;
+- void *tt_entry_exists;
++ struct hlist_node *tt_removed_node;
+
+ tt_local_entry = batadv_tt_local_hash_find(bat_priv, addr, vid);
+ if (!tt_local_entry)
+@@ -1363,15 +1376,18 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr,
+ */
+ batadv_tt_local_event(bat_priv, tt_local_entry, BATADV_TT_CLIENT_DEL);
+
+- tt_entry_exists = batadv_hash_remove(bat_priv->tt.local_hash,
++ tt_removed_node = batadv_hash_remove(bat_priv->tt.local_hash,
+ batadv_compare_tt,
+ batadv_choose_tt,
+ &tt_local_entry->common);
+- if (!tt_entry_exists)
++ if (!tt_removed_node)
+ goto out;
+
+- /* extra call to free the local tt entry */
+- batadv_tt_local_entry_put(tt_local_entry);
++ /* drop reference of remove hash entry */
++ tt_removed_entry = hlist_entry(tt_removed_node,
++ struct batadv_tt_local_entry,
++ common.hash_entry);
++ batadv_tt_local_entry_put(tt_removed_entry);
+
+ out:
+ if (tt_local_entry)
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index c813207bb123..d37d4acafebf 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -838,7 +838,7 @@ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
+
+ dir = sdata->vif.debugfs_dir;
+
+- if (!dir)
++ if (IS_ERR_OR_NULL(dir))
+ return;
+
+ sprintf(buf, "netdev:%s", sdata->name);
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index c054ac85793c..f20bb39f492d 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -167,8 +167,10 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
+ * The driver doesn't know anything about VLAN interfaces.
+ * Hence, don't send GTKs for VLAN interfaces to the driver.
+ */
+- if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE))
++ if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
++ ret = 1;
+ goto out_unsupported;
++ }
+ }
+
+ ret = drv_set_key(key->local, SET_KEY, sdata,
+@@ -213,11 +215,8 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
+ /* all of these we can do in software - if driver can */
+ if (ret == 1)
+ return 0;
+- if (ieee80211_hw_check(&key->local->hw, SW_CRYPTO_CONTROL)) {
+- if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+- return 0;
++ if (ieee80211_hw_check(&key->local->hw, SW_CRYPTO_CONTROL))
+ return -EINVAL;
+- }
+ return 0;
+ default:
+ return -EINVAL;
+diff --git a/scripts/coccinelle/api/stream_open.cocci b/scripts/coccinelle/api/stream_open.cocci
+new file mode 100644
+index 000000000000..350145da7669
+--- /dev/null
++++ b/scripts/coccinelle/api/stream_open.cocci
+@@ -0,0 +1,363 @@
++// SPDX-License-Identifier: GPL-2.0
++// Author: Kirill Smelkov (kirr@nexedi.com)
++//
++// Search for stream-like files that are using nonseekable_open and convert
++// them to stream_open. A stream-like file is a file that does not use ppos in
++// its read and write. Rationale for the conversion is to avoid deadlock in
++// between read and write.
++
++virtual report
++virtual patch
++virtual explain // explain decisions in the patch (SPFLAGS="-D explain")
++
++// stream-like reader & writer - ones that do not depend on f_pos.
++@ stream_reader @
++identifier readstream, ppos;
++identifier f, buf, len;
++type loff_t;
++@@
++ ssize_t readstream(struct file *f, char *buf, size_t len, loff_t *ppos)
++ {
++ ... when != ppos
++ }
++
++@ stream_writer @
++identifier writestream, ppos;
++identifier f, buf, len;
++type loff_t;
++@@
++ ssize_t writestream(struct file *f, const char *buf, size_t len, loff_t *ppos)
++ {
++ ... when != ppos
++ }
++
++
++// a function that blocks
++@ blocks @
++identifier block_f;
++identifier wait_event =~ "^wait_event_.*";
++@@
++ block_f(...) {
++ ... when exists
++ wait_event(...)
++ ... when exists
++ }
++
++// stream_reader that can block inside.
++//
++// XXX wait_* can be called not directly from current function (e.g. func -> f -> g -> wait())
++// XXX currently reader_blocks supports only direct and 1-level indirect cases.
++@ reader_blocks_direct @
++identifier stream_reader.readstream;
++identifier wait_event =~ "^wait_event_.*";
++@@
++ readstream(...)
++ {
++ ... when exists
++ wait_event(...)
++ ... when exists
++ }
++
++@ reader_blocks_1 @
++identifier stream_reader.readstream;
++identifier blocks.block_f;
++@@
++ readstream(...)
++ {
++ ... when exists
++ block_f(...)
++ ... when exists
++ }
++
++@ reader_blocks depends on reader_blocks_direct || reader_blocks_1 @
++identifier stream_reader.readstream;
++@@
++ readstream(...) {
++ ...
++ }
++
++
++// file_operations + whether they have _any_ .read, .write, .llseek ... at all.
++//
++// XXX add support for file_operations xxx[N] = ... (sound/core/pcm_native.c)
++@ fops0 @
++identifier fops;
++@@
++ struct file_operations fops = {
++ ...
++ };
++
++@ has_read @
++identifier fops0.fops;
++identifier read_f;
++@@
++ struct file_operations fops = {
++ .read = read_f,
++ };
++
++@ has_read_iter @
++identifier fops0.fops;
++identifier read_iter_f;
++@@
++ struct file_operations fops = {
++ .read_iter = read_iter_f,
++ };
++
++@ has_write @
++identifier fops0.fops;
++identifier write_f;
++@@
++ struct file_operations fops = {
++ .write = write_f,
++ };
++
++@ has_write_iter @
++identifier fops0.fops;
++identifier write_iter_f;
++@@
++ struct file_operations fops = {
++ .write_iter = write_iter_f,
++ };
++
++@ has_llseek @
++identifier fops0.fops;
++identifier llseek_f;
++@@
++ struct file_operations fops = {
++ .llseek = llseek_f,
++ };
++
++@ has_no_llseek @
++identifier fops0.fops;
++@@
++ struct file_operations fops = {
++ .llseek = no_llseek,
++ };
++
++@ has_mmap @
++identifier fops0.fops;
++identifier mmap_f;
++@@
++ struct file_operations fops = {
++ .mmap = mmap_f,
++ };
++
++@ has_copy_file_range @
++identifier fops0.fops;
++identifier copy_file_range_f;
++@@
++ struct file_operations fops = {
++ .copy_file_range = copy_file_range_f,
++ };
++
++@ has_remap_file_range @
++identifier fops0.fops;
++identifier remap_file_range_f;
++@@
++ struct file_operations fops = {
++ .remap_file_range = remap_file_range_f,
++ };
++
++@ has_splice_read @
++identifier fops0.fops;
++identifier splice_read_f;
++@@
++ struct file_operations fops = {
++ .splice_read = splice_read_f,
++ };
++
++@ has_splice_write @
++identifier fops0.fops;
++identifier splice_write_f;
++@@
++ struct file_operations fops = {
++ .splice_write = splice_write_f,
++ };
++
++
++// file_operations that is candidate for stream_open conversion - it does not
++// use mmap and other methods that assume @offset access to file.
++//
++// XXX for simplicity require no .{read/write}_iter and no .splice_{read/write} for now.
++// XXX maybe_steam.fops cannot be used in other rules - it gives "bad rule maybe_stream or bad variable fops".
++@ maybe_stream depends on (!has_llseek || has_no_llseek) && !has_mmap && !has_copy_file_range && !has_remap_file_range && !has_read_iter && !has_write_iter && !has_splice_read && !has_splice_write @
++identifier fops0.fops;
++@@
++ struct file_operations fops = {
++ };
++
++
++// ---- conversions ----
++
++// XXX .open = nonseekable_open -> .open = stream_open
++// XXX .open = func -> openfunc -> nonseekable_open
++
++// read & write
++//
++// if both are used in the same file_operations together with an opener -
++// under that conditions we can use stream_open instead of nonseekable_open.
++@ fops_rw depends on maybe_stream @
++identifier fops0.fops, openfunc;
++identifier stream_reader.readstream;
++identifier stream_writer.writestream;
++@@
++ struct file_operations fops = {
++ .open = openfunc,
++ .read = readstream,
++ .write = writestream,
++ };
++
++@ report_rw depends on report @
++identifier fops_rw.openfunc;
++position p1;
++@@
++ openfunc(...) {
++ <...
++ nonseekable_open@p1
++ ...>
++ }
++
++@ script:python depends on report && reader_blocks @
++fops << fops0.fops;
++p << report_rw.p1;
++@@
++coccilib.report.print_report(p[0],
++ "ERROR: %s: .read() can deadlock .write(); change nonseekable_open -> stream_open to fix." % (fops,))
++
++@ script:python depends on report && !reader_blocks @
++fops << fops0.fops;
++p << report_rw.p1;
++@@
++coccilib.report.print_report(p[0],
++ "WARNING: %s: .read() and .write() have stream semantic; safe to change nonseekable_open -> stream_open." % (fops,))
++
++
++@ explain_rw_deadlocked depends on explain && reader_blocks @
++identifier fops_rw.openfunc;
++@@
++ openfunc(...) {
++ <...
++- nonseekable_open
+++ nonseekable_open /* read & write (was deadlock) */
++ ...>
++ }
++
++
++@ explain_rw_nodeadlock depends on explain && !reader_blocks @
++identifier fops_rw.openfunc;
++@@
++ openfunc(...) {
++ <...
++- nonseekable_open
+++ nonseekable_open /* read & write (no direct deadlock) */
++ ...>
++ }
++
++@ patch_rw depends on patch @
++identifier fops_rw.openfunc;
++@@
++ openfunc(...) {
++ <...
++- nonseekable_open
+++ stream_open
++ ...>
++ }
++
++
++// read, but not write
++@ fops_r depends on maybe_stream && !has_write @
++identifier fops0.fops, openfunc;
++identifier stream_reader.readstream;
++@@
++ struct file_operations fops = {
++ .open = openfunc,
++ .read = readstream,
++ };
++
++@ report_r depends on report @
++identifier fops_r.openfunc;
++position p1;
++@@
++ openfunc(...) {
++ <...
++ nonseekable_open@p1
++ ...>
++ }
++
++@ script:python depends on report @
++fops << fops0.fops;
++p << report_r.p1;
++@@
++coccilib.report.print_report(p[0],
++ "WARNING: %s: .read() has stream semantic; safe to change nonseekable_open -> stream_open." % (fops,))
++
++@ explain_r depends on explain @
++identifier fops_r.openfunc;
++@@
++ openfunc(...) {
++ <...
++- nonseekable_open
+++ nonseekable_open /* read only */
++ ...>
++ }
++
++@ patch_r depends on patch @
++identifier fops_r.openfunc;
++@@
++ openfunc(...) {
++ <...
++- nonseekable_open
+++ stream_open
++ ...>
++ }
++
++
++// write, but not read
++@ fops_w depends on maybe_stream && !has_read @
++identifier fops0.fops, openfunc;
++identifier stream_writer.writestream;
++@@
++ struct file_operations fops = {
++ .open = openfunc,
++ .write = writestream,
++ };
++
++@ report_w depends on report @
++identifier fops_w.openfunc;
++position p1;
++@@
++ openfunc(...) {
++ <...
++ nonseekable_open@p1
++ ...>
++ }
++
++@ script:python depends on report @
++fops << fops0.fops;
++p << report_w.p1;
++@@
++coccilib.report.print_report(p[0],
++ "WARNING: %s: .write() has stream semantic; safe to change nonseekable_open -> stream_open." % (fops,))
++
++@ explain_w depends on explain @
++identifier fops_w.openfunc;
++@@
++ openfunc(...) {
++ <...
++- nonseekable_open
+++ nonseekable_open /* write only */
++ ...>
++ }
++
++@ patch_w depends on patch @
++identifier fops_w.openfunc;
++@@
++ openfunc(...) {
++ <...
++- nonseekable_open
+++ stream_open
++ ...>
++ }
++
++
++// no read, no write - don't change anything
+diff --git a/security/selinux/avc.c b/security/selinux/avc.c
+index 635e5c1e3e48..5de18a6d5c3f 100644
+--- a/security/selinux/avc.c
++++ b/security/selinux/avc.c
+@@ -838,6 +838,7 @@ out:
+ * @ssid,@tsid,@tclass : identifier of an AVC entry
+ * @seqno : sequence number when decision was made
+ * @xpd: extended_perms_decision to be added to the node
++ * @flags: the AVC_* flags, e.g. AVC_NONBLOCKING, AVC_EXTENDED_PERMS, or 0.
+ *
+ * if a valid AVC entry doesn't exist,this function returns -ENOENT.
+ * if kmalloc() called internal returns NULL, this function returns -ENOMEM.
+@@ -856,6 +857,23 @@ static int avc_update_node(struct selinux_avc *avc,
+ struct hlist_head *head;
+ spinlock_t *lock;
+
++ /*
++ * If we are in a non-blocking code path, e.g. VFS RCU walk,
++ * then we must not add permissions to a cache entry
++ * because we cannot safely audit the denial. Otherwise,
++ * during the subsequent blocking retry (e.g. VFS ref walk), we
++ * will find the permissions already granted in the cache entry
++ * and won't audit anything at all, leading to silent denials in
++ * permissive mode that only appear when in enforcing mode.
++ *
++ * See the corresponding handling in slow_avc_audit(), and the
++ * logic in selinux_inode_follow_link and selinux_inode_permission
++ * for the VFS MAY_NOT_BLOCK flag, which is transliterated into
++ * AVC_NONBLOCKING for avc_has_perm_noaudit().
++ */
++ if (flags & AVC_NONBLOCKING)
++ return 0;
++
+ node = avc_alloc_node(avc);
+ if (!node) {
+ rc = -ENOMEM;
+@@ -1115,7 +1133,7 @@ decision:
+ * @tsid: target security identifier
+ * @tclass: target security class
+ * @requested: requested permissions, interpreted based on @tclass
+- * @flags: AVC_STRICT or 0
++ * @flags: AVC_STRICT, AVC_NONBLOCKING, or 0
+ * @avd: access vector decisions
+ *
+ * Check the AVC to determine whether the @requested permissions are granted
+@@ -1199,7 +1217,8 @@ int avc_has_perm_flags(struct selinux_state *state,
+ struct av_decision avd;
+ int rc, rc2;
+
+- rc = avc_has_perm_noaudit(state, ssid, tsid, tclass, requested, 0,
++ rc = avc_has_perm_noaudit(state, ssid, tsid, tclass, requested,
++ (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
+ &avd);
+
+ rc2 = avc_audit(state, ssid, tsid, tclass, requested, &avd, rc,
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 4337b6d9369e..cba19b8c3e51 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -497,16 +497,10 @@ static int may_context_mount_inode_relabel(u32 sid,
+ return rc;
+ }
+
+-static int selinux_is_sblabel_mnt(struct super_block *sb)
++static int selinux_is_genfs_special_handling(struct super_block *sb)
+ {
+- struct superblock_security_struct *sbsec = sb->s_security;
+-
+- return sbsec->behavior == SECURITY_FS_USE_XATTR ||
+- sbsec->behavior == SECURITY_FS_USE_TRANS ||
+- sbsec->behavior == SECURITY_FS_USE_TASK ||
+- sbsec->behavior == SECURITY_FS_USE_NATIVE ||
+- /* Special handling. Genfs but also in-core setxattr handler */
+- !strcmp(sb->s_type->name, "sysfs") ||
++ /* Special handling. Genfs but also in-core setxattr handler */
++ return !strcmp(sb->s_type->name, "sysfs") ||
+ !strcmp(sb->s_type->name, "pstore") ||
+ !strcmp(sb->s_type->name, "debugfs") ||
+ !strcmp(sb->s_type->name, "tracefs") ||
+@@ -516,6 +510,34 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
+ !strcmp(sb->s_type->name, "cgroup2")));
+ }
+
++static int selinux_is_sblabel_mnt(struct super_block *sb)
++{
++ struct superblock_security_struct *sbsec = sb->s_security;
++
++ /*
++ * IMPORTANT: Double-check logic in this function when adding a new
++ * SECURITY_FS_USE_* definition!
++ */
++ BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
++
++ switch (sbsec->behavior) {
++ case SECURITY_FS_USE_XATTR:
++ case SECURITY_FS_USE_TRANS:
++ case SECURITY_FS_USE_TASK:
++ case SECURITY_FS_USE_NATIVE:
++ return 1;
++
++ case SECURITY_FS_USE_GENFS:
++ return selinux_is_genfs_special_handling(sb);
++
++ /* Never allow relabeling on context mounts */
++ case SECURITY_FS_USE_MNTPOINT:
++ case SECURITY_FS_USE_NONE:
++ default:
++ return 0;
++ }
++}
++
+ static int sb_finish_set_opts(struct super_block *sb)
+ {
+ struct superblock_security_struct *sbsec = sb->s_security;
+@@ -3199,7 +3221,9 @@ static int selinux_inode_permission(struct inode *inode, int mask)
+ return PTR_ERR(isec);
+
+ rc = avc_has_perm_noaudit(&selinux_state,
+- sid, isec->sid, isec->sclass, perms, 0, &avd);
++ sid, isec->sid, isec->sclass, perms,
++ (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
++ &avd);
+ audited = avc_audit_required(perms, &avd, rc,
+ from_access ? FILE__AUDIT_ACCESS : 0,
+ &denied);
+diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
+index ef899bcfd2cb..74ea50977c20 100644
+--- a/security/selinux/include/avc.h
++++ b/security/selinux/include/avc.h
+@@ -142,6 +142,7 @@ static inline int avc_audit(struct selinux_state *state,
+
+ #define AVC_STRICT 1 /* Ignore permissive mode. */
+ #define AVC_EXTENDED_PERMS 2 /* update extended permissions */
++#define AVC_NONBLOCKING 4 /* non blocking */
+ int avc_has_perm_noaudit(struct selinux_state *state,
+ u32 ssid, u32 tsid,
+ u16 tclass, u32 requested,
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 0a745d677b1c..75a0be2aa9c2 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5448,6 +5448,8 @@ static void alc274_fixup_bind_dacs(struct hda_codec *codec,
+ return;
+
+ spec->gen.preferred_dacs = preferred_pairs;
++ spec->gen.auto_mute_via_amp = 1;
++ codec->power_save_node = 0;
+ }
+
+ /* The DAC of NID 0x3 will introduce click/pop noise on headphones, so invalidate it */
+@@ -7172,6 +7174,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x21, 0x02211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x21, 0x02211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x12, 0x40000000},
++ {0x14, 0x90170110},
++ {0x21, 0x02211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
+ {0x14, 0x90170110},
+ {0x21, 0x02211020}),
+@@ -7445,6 +7451,13 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60130},
+ {0x17, 0x90170110},
+ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1043, "ASUS", ALC294_FIXUP_ASUS_SPK,
++ {0x12, 0x90a60130},
++ {0x17, 0x90170110},
++ {0x21, 0x03211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x14, 0x90170110},
++ {0x21, 0x04211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC295_STANDARD_PINS,
+ {0x17, 0x21014020},
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index 4d3ec295679d..a651fed62a27 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -3441,8 +3441,6 @@ int wm_adsp_compr_trigger(struct snd_compr_stream *stream, int cmd)
+ }
+ }
+
+- wm_adsp_buffer_clear(compr->buf);
+-
+ /* Trigger the IRQ at one fragment of data */
+ ret = wm_adsp_buffer_write(compr->buf,
+ HOST_BUFFER_FIELD(high_water_mark),
+@@ -3454,6 +3452,8 @@ int wm_adsp_compr_trigger(struct snd_compr_stream *stream, int cmd)
+ }
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
++ if (wm_adsp_compr_attached(compr))
++ wm_adsp_buffer_clear(compr->buf);
+ break;
+ default:
+ ret = -EINVAL;
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index f8a68bdb3885..b74bbee111c6 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -267,7 +267,7 @@ static const struct snd_soc_dapm_route byt_rt5651_audio_map[] = {
+ static const struct snd_soc_dapm_route byt_rt5651_intmic_dmic_map[] = {
+ {"DMIC L1", NULL, "Internal Mic"},
+ {"DMIC R1", NULL, "Internal Mic"},
+- {"IN3P", NULL, "Headset Mic"},
++ {"IN2P", NULL, "Headset Mic"},
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5651_intmic_in1_map[] = {
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index 06fba9650ac4..85c4b6d8e89d 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -1194,7 +1194,6 @@ static int stm32_sai_sub_dais_init(struct platform_device *pdev,
+ if (!sai->cpu_dai_drv)
+ return -ENOMEM;
+
+- sai->cpu_dai_drv->name = dev_name(&pdev->dev);
+ if (STM_SAI_IS_PLAYBACK(sai)) {
+ memcpy(sai->cpu_dai_drv, &stm32_sai_playback_dai,
+ sizeof(stm32_sai_playback_dai));
+@@ -1204,6 +1203,7 @@ static int stm32_sai_sub_dais_init(struct platform_device *pdev,
+ sizeof(stm32_sai_capture_dai));
+ sai->cpu_dai_drv->capture.stream_name = sai->cpu_dai_drv->name;
+ }
++ sai->cpu_dai_drv->name = dev_name(&pdev->dev);
+
+ return 0;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-05-10 19:40 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-05-10 19:40 UTC (permalink / raw
To: gentoo-commits
commit: 85602c336bfa5919a66fc97856a7f452614f5349
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri May 10 19:40:07 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri May 10 19:40:07 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=85602c33
Linux patch 4.19.42
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1041_linux-4.19.42.patch | 4659 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4663 insertions(+)
diff --git a/0000_README b/0000_README
index ba19d17..9a195d3 100644
--- a/0000_README
+++ b/0000_README
@@ -207,6 +207,10 @@ Patch: 1040_linux-4.19.41.patch
From: http://www.kernel.org
Desc: Linux 4.19.41
+Patch: 1041_linux-4.19.42.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.42
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1041_linux-4.19.42.patch b/1041_linux-4.19.42.patch
new file mode 100644
index 0000000..ad6da18
--- /dev/null
+++ b/1041_linux-4.19.42.patch
@@ -0,0 +1,4659 @@
+diff --git a/Makefile b/Makefile
+index ba3b8504b689..914d69b9e3fd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 41
++SUBLEVEL = 42
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
+index fd1e722f3821..c7e30a6ed56e 100644
+--- a/arch/arm64/include/asm/futex.h
++++ b/arch/arm64/include/asm/futex.h
+@@ -23,26 +23,34 @@
+
+ #include <asm/errno.h>
+
++#define FUTEX_MAX_LOOPS 128 /* What's the largest number you can think of? */
++
+ #define __futex_atomic_op(insn, ret, oldval, uaddr, tmp, oparg) \
+ do { \
++ unsigned int loops = FUTEX_MAX_LOOPS; \
++ \
+ uaccess_enable(); \
+ asm volatile( \
+ " prfm pstl1strm, %2\n" \
+ "1: ldxr %w1, %2\n" \
+ insn "\n" \
+ "2: stlxr %w0, %w3, %2\n" \
+-" cbnz %w0, 1b\n" \
+-" dmb ish\n" \
++" cbz %w0, 3f\n" \
++" sub %w4, %w4, %w0\n" \
++" cbnz %w4, 1b\n" \
++" mov %w0, %w7\n" \
+ "3:\n" \
++" dmb ish\n" \
+ " .pushsection .fixup,\"ax\"\n" \
+ " .align 2\n" \
+-"4: mov %w0, %w5\n" \
++"4: mov %w0, %w6\n" \
+ " b 3b\n" \
+ " .popsection\n" \
+ _ASM_EXTABLE(1b, 4b) \
+ _ASM_EXTABLE(2b, 4b) \
+- : "=&r" (ret), "=&r" (oldval), "+Q" (*uaddr), "=&r" (tmp) \
+- : "r" (oparg), "Ir" (-EFAULT) \
++ : "=&r" (ret), "=&r" (oldval), "+Q" (*uaddr), "=&r" (tmp), \
++ "+r" (loops) \
++ : "r" (oparg), "Ir" (-EFAULT), "Ir" (-EAGAIN) \
+ : "memory"); \
+ uaccess_disable(); \
+ } while (0)
+@@ -57,23 +65,23 @@ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *_uaddr)
+
+ switch (op) {
+ case FUTEX_OP_SET:
+- __futex_atomic_op("mov %w3, %w4",
++ __futex_atomic_op("mov %w3, %w5",
+ ret, oldval, uaddr, tmp, oparg);
+ break;
+ case FUTEX_OP_ADD:
+- __futex_atomic_op("add %w3, %w1, %w4",
++ __futex_atomic_op("add %w3, %w1, %w5",
+ ret, oldval, uaddr, tmp, oparg);
+ break;
+ case FUTEX_OP_OR:
+- __futex_atomic_op("orr %w3, %w1, %w4",
++ __futex_atomic_op("orr %w3, %w1, %w5",
+ ret, oldval, uaddr, tmp, oparg);
+ break;
+ case FUTEX_OP_ANDN:
+- __futex_atomic_op("and %w3, %w1, %w4",
++ __futex_atomic_op("and %w3, %w1, %w5",
+ ret, oldval, uaddr, tmp, ~oparg);
+ break;
+ case FUTEX_OP_XOR:
+- __futex_atomic_op("eor %w3, %w1, %w4",
++ __futex_atomic_op("eor %w3, %w1, %w5",
+ ret, oldval, uaddr, tmp, oparg);
+ break;
+ default:
+@@ -93,6 +101,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *_uaddr,
+ u32 oldval, u32 newval)
+ {
+ int ret = 0;
++ unsigned int loops = FUTEX_MAX_LOOPS;
+ u32 val, tmp;
+ u32 __user *uaddr;
+
+@@ -104,20 +113,24 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *_uaddr,
+ asm volatile("// futex_atomic_cmpxchg_inatomic\n"
+ " prfm pstl1strm, %2\n"
+ "1: ldxr %w1, %2\n"
+-" sub %w3, %w1, %w4\n"
+-" cbnz %w3, 3f\n"
+-"2: stlxr %w3, %w5, %2\n"
+-" cbnz %w3, 1b\n"
+-" dmb ish\n"
++" sub %w3, %w1, %w5\n"
++" cbnz %w3, 4f\n"
++"2: stlxr %w3, %w6, %2\n"
++" cbz %w3, 3f\n"
++" sub %w4, %w4, %w3\n"
++" cbnz %w4, 1b\n"
++" mov %w0, %w8\n"
+ "3:\n"
++" dmb ish\n"
++"4:\n"
+ " .pushsection .fixup,\"ax\"\n"
+-"4: mov %w0, %w6\n"
+-" b 3b\n"
++"5: mov %w0, %w7\n"
++" b 4b\n"
+ " .popsection\n"
+- _ASM_EXTABLE(1b, 4b)
+- _ASM_EXTABLE(2b, 4b)
+- : "+r" (ret), "=&r" (val), "+Q" (*uaddr), "=&r" (tmp)
+- : "r" (oldval), "r" (newval), "Ir" (-EFAULT)
++ _ASM_EXTABLE(1b, 5b)
++ _ASM_EXTABLE(2b, 5b)
++ : "+r" (ret), "=&r" (val), "+Q" (*uaddr), "=&r" (tmp), "+r" (loops)
++ : "r" (oldval), "r" (newval), "Ir" (-EFAULT), "Ir" (-EAGAIN)
+ : "memory");
+ uaccess_disable();
+
+diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
+index eb6c0d582626..2c1e30ca7ee4 100644
+--- a/arch/mips/kernel/kgdb.c
++++ b/arch/mips/kernel/kgdb.c
+@@ -33,6 +33,7 @@
+ #include <asm/processor.h>
+ #include <asm/sigcontext.h>
+ #include <linux/uaccess.h>
++#include <asm/irq_regs.h>
+
+ static struct hard_trap_info {
+ unsigned char tt; /* Trap type code for MIPS R3xxx and R4xxx */
+@@ -214,7 +215,7 @@ static void kgdb_call_nmi_hook(void *ignored)
+ old_fs = get_fs();
+ set_fs(get_ds());
+
+- kgdb_nmicallback(raw_smp_processor_id(), NULL);
++ kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs());
+
+ set_fs(old_fs);
+ }
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 3dd204d1dd19..f9958ad4d335 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3068,7 +3068,7 @@ static int intel_pmu_hw_config(struct perf_event *event)
+ return ret;
+
+ if (event->attr.precise_ip) {
+- if (!event->attr.freq) {
++ if (!(event->attr.freq || event->attr.wakeup_events)) {
+ event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD;
+ if (!(event->attr.sample_type &
+ ~intel_pmu_large_pebs_flags(event)))
+@@ -3447,6 +3447,12 @@ static void intel_pmu_cpu_starting(int cpu)
+
+ cpuc->lbr_sel = NULL;
+
++ if (x86_pmu.flags & PMU_FL_TFA) {
++ WARN_ON_ONCE(cpuc->tfa_shadow);
++ cpuc->tfa_shadow = ~0ULL;
++ intel_set_tfa(cpuc, false);
++ }
++
+ if (x86_pmu.version > 1)
+ flip_smm_bit(&x86_pmu.attr_freeze_on_smi);
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 23752dc99b00..dd64f586679e 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -446,6 +446,8 @@ static int init_vq(struct virtio_blk *vblk)
+ if (err)
+ num_vqs = 1;
+
++ num_vqs = min_t(unsigned int, nr_cpu_ids, num_vqs);
++
+ vblk->vqs = kmalloc_array(num_vqs, sizeof(*vblk->vqs), GFP_KERNEL);
+ if (!vblk->vqs)
+ return -ENOMEM;
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 6628ffa31383..4d4f6d842c31 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -1571,6 +1571,7 @@ static struct clk_regmap gxbb_vdec_1_div = {
+ .offset = HHI_VDEC_CLK_CNTL,
+ .shift = 0,
+ .width = 7,
++ .flags = CLK_DIVIDER_ROUND_CLOSEST,
+ },
+ .hw.init = &(struct clk_init_data){
+ .name = "vdec_1_div",
+@@ -1616,6 +1617,7 @@ static struct clk_regmap gxbb_vdec_hevc_div = {
+ .offset = HHI_VDEC2_CLK_CNTL,
+ .shift = 16,
+ .width = 7,
++ .flags = CLK_DIVIDER_ROUND_CLOSEST,
+ },
+ .hw.init = &(struct clk_init_data){
+ .name = "vdec_hevc_div",
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index 75491fc841a6..0df16eb1eb3c 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -359,11 +359,11 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ struct armada_37xx_dvfs *dvfs;
+ struct platform_device *pdev;
+ unsigned long freq;
+- unsigned int cur_frequency;
++ unsigned int cur_frequency, base_frequency;
+ struct regmap *nb_pm_base, *avs_base;
+ struct device *cpu_dev;
+ int load_lvl, ret;
+- struct clk *clk;
++ struct clk *clk, *parent;
+
+ nb_pm_base =
+ syscon_regmap_lookup_by_compatible("marvell,armada-3700-nb-pm");
+@@ -399,6 +399,22 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ return PTR_ERR(clk);
+ }
+
++ parent = clk_get_parent(clk);
++ if (IS_ERR(parent)) {
++ dev_err(cpu_dev, "Cannot get parent clock for CPU0\n");
++ clk_put(clk);
++ return PTR_ERR(parent);
++ }
++
++ /* Get parent CPU frequency */
++ base_frequency = clk_get_rate(parent);
++
++ if (!base_frequency) {
++ dev_err(cpu_dev, "Failed to get parent clock rate for CPU\n");
++ clk_put(clk);
++ return -EINVAL;
++ }
++
+ /* Get nominal (current) CPU frequency */
+ cur_frequency = clk_get_rate(clk);
+ if (!cur_frequency) {
+@@ -431,7 +447,7 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ for (load_lvl = ARMADA_37XX_DVFS_LOAD_0; load_lvl < LOAD_LEVEL_NR;
+ load_lvl++) {
+ unsigned long u_volt = avs_map[dvfs->avs[load_lvl]] * 1000;
+- freq = cur_frequency / dvfs->divider[load_lvl];
++ freq = base_frequency / dvfs->divider[load_lvl];
+ ret = dev_pm_opp_add(cpu_dev, freq, u_volt);
+ if (ret)
+ goto remove_opp;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 2b8b892eb846..76ee2de43ea6 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4028,6 +4028,7 @@ static void handle_cursor_update(struct drm_plane *plane,
+ amdgpu_crtc->cursor_width = plane->state->crtc_w;
+ amdgpu_crtc->cursor_height = plane->state->crtc_h;
+
++ memset(&attributes, 0, sizeof(attributes));
+ attributes.address.high_part = upper_32_bits(address);
+ attributes.address.low_part = lower_32_bits(address);
+ attributes.width = plane->state->crtc_w;
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 643f5edd68fe..62444a3a5742 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1473,7 +1473,6 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ if (IS_ERR(regmap))
+ ret = PTR_ERR(regmap);
+ if (ret) {
+- ret = PTR_ERR(regmap);
+ dev_err(dev,
+ "Failed to get system configuration registers: %d\n",
+ ret);
+@@ -1509,6 +1508,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ of_node_put(remote);
+
+ hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np);
++ of_node_put(i2c_np);
+ if (!hdmi->ddc_adpt) {
+ dev_err(dev, "Failed to get ddc i2c adapter by node\n");
+ return -EINVAL;
+diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
+index 340383150fb9..ebf9c96d43ee 100644
+--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
++++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
+@@ -175,6 +175,7 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
+ REG_FLD_MOD(core->base, HDMI_CORE_SYS_INTR_UNMASK4, 0, 3, 3);
+ hdmi_wp_clear_irqenable(core->wp, HDMI_IRQ_CORE);
+ hdmi_wp_set_irqstatus(core->wp, HDMI_IRQ_CORE);
++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
+ hdmi4_core_disable(core);
+ return 0;
+ }
+@@ -182,16 +183,24 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
+ if (err)
+ return err;
+
++ /*
++ * Initialize CEC clock divider: CEC needs 2MHz clock hence
++ * set the divider to 24 to get 48/24=2MHz clock
++ */
++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0x18, 5, 0);
++
+ /* Clear TX FIFO */
+ if (!hdmi_cec_clear_tx_fifo(adap)) {
+ pr_err("cec-%s: could not clear TX FIFO\n", adap->name);
+- return -EIO;
++ err = -EIO;
++ goto err_disable_clk;
+ }
+
+ /* Clear RX FIFO */
+ if (!hdmi_cec_clear_rx_fifo(adap)) {
+ pr_err("cec-%s: could not clear RX FIFO\n", adap->name);
+- return -EIO;
++ err = -EIO;
++ goto err_disable_clk;
+ }
+
+ /* Clear CEC interrupts */
+@@ -236,6 +245,12 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
+ hdmi_write_reg(core->base, HDMI_CEC_INT_STATUS_1, temp);
+ }
+ return 0;
++
++err_disable_clk:
++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
++ hdmi4_core_disable(core);
++
++ return err;
+ }
+
+ static int hdmi_cec_adap_log_addr(struct cec_adapter *adap, u8 log_addr)
+@@ -333,11 +348,8 @@ int hdmi4_cec_init(struct platform_device *pdev, struct hdmi_core_data *core,
+ return ret;
+ core->wp = wp;
+
+- /*
+- * Initialize CEC clock divider: CEC needs 2MHz clock hence
+- * set the devider to 24 to get 48/24=2MHz clock
+- */
+- REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0x18, 5, 0);
++ /* Disable clock initially, hdmi_cec_adap_enable() manages it */
++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
+
+ ret = cec_register_adapter(core->adap, &pdev->dev);
+ if (ret < 0) {
+diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+index adcdf946c365..dfbcd1ad81a5 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
++++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+@@ -217,7 +217,7 @@ static int sun8i_tcon_top_bind(struct device *dev, struct device *master,
+
+ err_unregister_gates:
+ for (i = 0; i < CLK_NUM; i++)
+- if (clk_data->hws[i])
++ if (!IS_ERR_OR_NULL(clk_data->hws[i]))
+ clk_hw_unregister_gate(clk_data->hws[i]);
+ clk_disable_unprepare(tcon_top->bus);
+ err_assert_reset:
+@@ -235,7 +235,8 @@ static void sun8i_tcon_top_unbind(struct device *dev, struct device *master,
+
+ of_clk_del_provider(dev->of_node);
+ for (i = 0; i < CLK_NUM; i++)
+- clk_hw_unregister_gate(clk_data->hws[i]);
++ if (clk_data->hws[i])
++ clk_hw_unregister_gate(clk_data->hws[i]);
+
+ clk_disable_unprepare(tcon_top->bus);
+ reset_control_assert(tcon_top->rst);
+diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
+index 748a1c4172a6..8e923e70e594 100644
+--- a/drivers/hv/hv.c
++++ b/drivers/hv/hv.c
+@@ -402,7 +402,6 @@ int hv_synic_cleanup(unsigned int cpu)
+
+ clockevents_unbind_device(hv_cpu->clk_evt, cpu);
+ hv_ce_shutdown(hv_cpu->clk_evt);
+- put_cpu_ptr(hv_cpu);
+ }
+
+ hv_get_synint_state(VMBUS_MESSAGE_SINT, shared_sint.as_uint64);
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 1cf6290d6435..70f2cb90adc5 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -165,6 +165,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x34a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Comet Lake */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x02a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ { 0 },
+ };
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 902d12d6d88b..b12c8ff8ed66 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -13388,7 +13388,7 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
+ int total_contexts;
+ int ret;
+ unsigned ngroups;
+- int qos_rmt_count;
++ int rmt_count;
+ int user_rmt_reduced;
+ u32 n_usr_ctxts;
+ u32 send_contexts = chip_send_contexts(dd);
+@@ -13450,10 +13450,20 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
+ n_usr_ctxts = rcv_contexts - total_contexts;
+ }
+
+- /* each user context requires an entry in the RMT */
+- qos_rmt_count = qos_rmt_entries(dd, NULL, NULL);
+- if (qos_rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) {
+- user_rmt_reduced = NUM_MAP_ENTRIES - qos_rmt_count;
++ /*
++ * The RMT entries are currently allocated as shown below:
++ * 1. QOS (0 to 128 entries);
++ * 2. FECN for PSM (num_user_contexts + num_vnic_contexts);
++ * 3. VNIC (num_vnic_contexts).
++ * It should be noted that PSM FECN oversubscribe num_vnic_contexts
++ * entries of RMT because both VNIC and PSM could allocate any receive
++ * context between dd->first_dyn_alloc_text and dd->num_rcv_contexts,
++ * and PSM FECN must reserve an RMT entry for each possible PSM receive
++ * context.
++ */
++ rmt_count = qos_rmt_entries(dd, NULL, NULL) + (num_vnic_contexts * 2);
++ if (rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) {
++ user_rmt_reduced = NUM_MAP_ENTRIES - rmt_count;
+ dd_dev_err(dd,
+ "RMT size is reducing the number of user receive contexts from %u to %d\n",
+ n_usr_ctxts,
+@@ -14441,9 +14451,11 @@ static void init_user_fecn_handling(struct hfi1_devdata *dd,
+ u64 reg;
+ int i, idx, regoff, regidx;
+ u8 offset;
++ u32 total_cnt;
+
+ /* there needs to be enough room in the map table */
+- if (rmt->used + dd->num_user_contexts >= NUM_MAP_ENTRIES) {
++ total_cnt = dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt;
++ if (rmt->used + total_cnt >= NUM_MAP_ENTRIES) {
+ dd_dev_err(dd, "User FECN handling disabled - too many user contexts allocated\n");
+ return;
+ }
+@@ -14497,7 +14509,7 @@ static void init_user_fecn_handling(struct hfi1_devdata *dd,
+ /* add rule 1 */
+ add_rsm_rule(dd, RSM_INS_FECN, &rrd);
+
+- rmt->used += dd->num_user_contexts;
++ rmt->used += total_cnt;
+ }
+
+ /* Initialize RSM for VNIC */
+diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
+index 6f013a565353..770c78c65730 100644
+--- a/drivers/infiniband/hw/hfi1/rc.c
++++ b/drivers/infiniband/hw/hfi1/rc.c
+@@ -2303,7 +2303,7 @@ send_last:
+ update_ack_queue(qp, next);
+ }
+ e = &qp->s_ack_queue[qp->r_head_ack_queue];
+- if (e->opcode == OP(RDMA_READ_REQUEST) && e->rdma_sge.mr) {
++ if (e->rdma_sge.mr) {
+ rvt_put_mr(e->rdma_sge.mr);
+ e->rdma_sge.mr = NULL;
+ }
+@@ -2377,7 +2377,7 @@ send_last:
+ update_ack_queue(qp, next);
+ }
+ e = &qp->s_ack_queue[qp->r_head_ack_queue];
+- if (e->opcode == OP(RDMA_READ_REQUEST) && e->rdma_sge.mr) {
++ if (e->rdma_sge.mr) {
+ rvt_put_mr(e->rdma_sge.mr);
+ e->rdma_sge.mr = NULL;
+ }
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index f6faefed96e8..a73d388b7093 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -745,6 +745,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev,
+ idx_offset = (obj & (table->num_obj - 1)) % obj_per_chunk;
+ dma_offset = offset = idx_offset * table->obj_size;
+ } else {
++ u32 seg_size = 64; /* 8 bytes per BA and 8 BA per segment */
++
+ hns_roce_calc_hem_mhop(hr_dev, table, &mhop_obj, &mhop);
+ /* mtt mhop */
+ i = mhop.l0_idx;
+@@ -756,8 +758,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev,
+ hem_idx = i;
+
+ hem = table->hem[hem_idx];
+- dma_offset = offset = (obj & (table->num_obj - 1)) *
+- table->obj_size % mhop.bt_chunk_size;
++ dma_offset = offset = (obj & (table->num_obj - 1)) * seg_size %
++ mhop.bt_chunk_size;
+ if (mhop.hop_num == 2)
+ dma_offset = offset = 0;
+ }
+diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
+index eb26a5f6fc58..41a538d23b80 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
+@@ -707,7 +707,6 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev,
+ struct hns_roce_hem_table *table;
+ dma_addr_t dma_handle;
+ __le64 *mtts;
+- u32 s = start_index * sizeof(u64);
+ u32 bt_page_size;
+ u32 i;
+
+@@ -730,7 +729,8 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev,
+ table = &hr_dev->mr_table.mtt_cqe_table;
+
+ mtts = hns_roce_table_find(hr_dev, table,
+- mtt->first_seg + s / hr_dev->caps.mtt_entry_sz,
++ mtt->first_seg +
++ start_index / HNS_ROCE_MTT_ENTRY_PER_SEG,
+ &dma_handle);
+ if (!mtts)
+ return -ENOMEM;
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+index a5719899f49a..ed99f0a08dc4 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+@@ -1123,6 +1123,8 @@ static void pvrdma_pci_remove(struct pci_dev *pdev)
+ pvrdma_page_dir_cleanup(dev, &dev->cq_pdir);
+ pvrdma_page_dir_cleanup(dev, &dev->async_pdir);
+ pvrdma_free_slots(dev);
++ dma_free_coherent(&pdev->dev, sizeof(*dev->dsr), dev->dsr,
++ dev->dsrbase);
+
+ iounmap(dev->regs);
+ kfree(dev->sgid_tbl);
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index be3801d43d48..3a1d30304f7e 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -356,7 +356,7 @@ static void iommu_write_l2(struct amd_iommu *iommu, u8 address, u32 val)
+ static void iommu_set_exclusion_range(struct amd_iommu *iommu)
+ {
+ u64 start = iommu->exclusion_start & PAGE_MASK;
+- u64 limit = (start + iommu->exclusion_length) & PAGE_MASK;
++ u64 limit = (start + iommu->exclusion_length - 1) & PAGE_MASK;
+ u64 entry;
+
+ if (!iommu->exclusion_start)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+index b7dd4e3c760d..6d690678c20e 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+@@ -140,7 +140,7 @@ static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode,
+ p->des0 |= cpu_to_le32(RDES0_OWN);
+
+ bfsize1 = min(bfsize, BUF_SIZE_2KiB - 1);
+- p->des1 |= cpu_to_le32(bfsize & RDES1_BUFFER1_SIZE_MASK);
++ p->des1 |= cpu_to_le32(bfsize1 & RDES1_BUFFER1_SIZE_MASK);
+
+ if (mode == STMMAC_CHAIN_MODE)
+ ndesc_rx_set_on_chain(p, end);
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 9375fa705d82..67dec8860bf3 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1844,7 +1844,7 @@ nvme_fc_init_queue(struct nvme_fc_ctrl *ctrl, int idx)
+ memset(queue, 0, sizeof(*queue));
+ queue->ctrl = ctrl;
+ queue->qnum = idx;
+- atomic_set(&queue->csn, 1);
++ atomic_set(&queue->csn, 0);
+ queue->dev = ctrl->dev;
+
+ if (idx > 0)
+@@ -1886,7 +1886,7 @@ nvme_fc_free_queue(struct nvme_fc_queue *queue)
+ */
+
+ queue->connection_id = 0;
+- atomic_set(&queue->csn, 1);
++ atomic_set(&queue->csn, 0);
+ }
+
+ static void
+@@ -2182,7 +2182,6 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
+ {
+ struct nvme_fc_cmd_iu *cmdiu = &op->cmd_iu;
+ struct nvme_command *sqe = &cmdiu->sqe;
+- u32 csn;
+ int ret, opstate;
+
+ /*
+@@ -2197,8 +2196,6 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
+
+ /* format the FC-NVME CMD IU and fcp_req */
+ cmdiu->connection_id = cpu_to_be64(queue->connection_id);
+- csn = atomic_inc_return(&queue->csn);
+- cmdiu->csn = cpu_to_be32(csn);
+ cmdiu->data_len = cpu_to_be32(data_len);
+ switch (io_dir) {
+ case NVMEFC_FCP_WRITE:
+@@ -2256,11 +2253,24 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
+ if (!(op->flags & FCOP_FLAGS_AEN))
+ blk_mq_start_request(op->rq);
+
++ cmdiu->csn = cpu_to_be32(atomic_inc_return(&queue->csn));
+ ret = ctrl->lport->ops->fcp_io(&ctrl->lport->localport,
+ &ctrl->rport->remoteport,
+ queue->lldd_handle, &op->fcp_req);
+
+ if (ret) {
++ /*
++ * If the lld fails to send the command is there an issue with
++ * the csn value? If the command that fails is the Connect,
++ * no - as the connection won't be live. If it is a command
++ * post-connect, it's possible a gap in csn may be created.
++ * Does this matter? As Linux initiators don't send fused
++ * commands, no. The gap would exist, but as there's nothing
++ * that depends on csn order to be delivered on the target
++ * side, it shouldn't hurt. It would be difficult for a
++ * target to even detect the csn gap as it has no idea when the
++ * cmd with the csn was supposed to arrive.
++ */
+ opstate = atomic_xchg(&op->state, FCPOP_STATE_COMPLETE);
+ __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
+
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index eaec2d306481..c7039f52ad51 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -396,7 +396,7 @@ static int pmc_dbgfs_register(struct pmc_dev *pmc)
+ * Some systems need one or more of their pmc_plt_clks to be
+ * marked as critical.
+ */
+-static const struct dmi_system_id critclk_systems[] __initconst = {
++static const struct dmi_system_id critclk_systems[] = {
+ {
+ .ident = "MPL CEC1x",
+ .matches = {
+diff --git a/drivers/scsi/csiostor/csio_scsi.c b/drivers/scsi/csiostor/csio_scsi.c
+index dab0d3f9bee1..e09c7f360dbd 100644
+--- a/drivers/scsi/csiostor/csio_scsi.c
++++ b/drivers/scsi/csiostor/csio_scsi.c
+@@ -1713,8 +1713,11 @@ csio_scsi_err_handler(struct csio_hw *hw, struct csio_ioreq *req)
+ }
+
+ out:
+- if (req->nsge > 0)
++ if (req->nsge > 0) {
+ scsi_dma_unmap(cmnd);
++ if (req->dcopy && (host_status == DID_OK))
++ host_status = csio_scsi_copy_to_sgl(hw, req);
++ }
+
+ cmnd->result = (((host_status) << 16) | scsi_status);
+ cmnd->scsi_done(cmnd);
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index a1551ab33616..e9ecc667e3fb 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -48,17 +48,16 @@ static void smp_task_timedout(struct timer_list *t)
+ unsigned long flags;
+
+ spin_lock_irqsave(&task->task_state_lock, flags);
+- if (!(task->task_state_flags & SAS_TASK_STATE_DONE))
++ if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) {
+ task->task_state_flags |= SAS_TASK_STATE_ABORTED;
++ complete(&task->slow_task->completion);
++ }
+ spin_unlock_irqrestore(&task->task_state_lock, flags);
+-
+- complete(&task->slow_task->completion);
+ }
+
+ static void smp_task_done(struct sas_task *task)
+ {
+- if (!del_timer(&task->slow_task->timer))
+- return;
++ del_timer(&task->slow_task->timer);
+ complete(&task->slow_task->completion);
+ }
+
+diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
+index 1a6ed9b0a249..cb19b12e7211 100644
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -117,7 +117,7 @@ static ssize_t
+ lpfc_drvr_version_show(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+- return snprintf(buf, PAGE_SIZE, LPFC_MODULE_DESC "\n");
++ return scnprintf(buf, PAGE_SIZE, LPFC_MODULE_DESC "\n");
+ }
+
+ /**
+@@ -137,9 +137,9 @@ lpfc_enable_fip_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_hba *phba = vport->phba;
+
+ if (phba->hba_flag & HBA_FIP_SUPPORT)
+- return snprintf(buf, PAGE_SIZE, "1\n");
++ return scnprintf(buf, PAGE_SIZE, "1\n");
+ else
+- return snprintf(buf, PAGE_SIZE, "0\n");
++ return scnprintf(buf, PAGE_SIZE, "0\n");
+ }
+
+ static ssize_t
+@@ -517,14 +517,15 @@ lpfc_bg_info_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- if (phba->cfg_enable_bg)
++ if (phba->cfg_enable_bg) {
+ if (phba->sli3_options & LPFC_SLI3_BG_ENABLED)
+- return snprintf(buf, PAGE_SIZE, "BlockGuard Enabled\n");
++ return scnprintf(buf, PAGE_SIZE,
++ "BlockGuard Enabled\n");
+ else
+- return snprintf(buf, PAGE_SIZE,
++ return scnprintf(buf, PAGE_SIZE,
+ "BlockGuard Not Supported\n");
+- else
+- return snprintf(buf, PAGE_SIZE,
++ } else
++ return scnprintf(buf, PAGE_SIZE,
+ "BlockGuard Disabled\n");
+ }
+
+@@ -536,7 +537,7 @@ lpfc_bg_guard_err_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%llu\n",
++ return scnprintf(buf, PAGE_SIZE, "%llu\n",
+ (unsigned long long)phba->bg_guard_err_cnt);
+ }
+
+@@ -548,7 +549,7 @@ lpfc_bg_apptag_err_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%llu\n",
++ return scnprintf(buf, PAGE_SIZE, "%llu\n",
+ (unsigned long long)phba->bg_apptag_err_cnt);
+ }
+
+@@ -560,7 +561,7 @@ lpfc_bg_reftag_err_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%llu\n",
++ return scnprintf(buf, PAGE_SIZE, "%llu\n",
+ (unsigned long long)phba->bg_reftag_err_cnt);
+ }
+
+@@ -578,7 +579,7 @@ lpfc_info_show(struct device *dev, struct device_attribute *attr,
+ {
+ struct Scsi_Host *host = class_to_shost(dev);
+
+- return snprintf(buf, PAGE_SIZE, "%s\n",lpfc_info(host));
++ return scnprintf(buf, PAGE_SIZE, "%s\n", lpfc_info(host));
+ }
+
+ /**
+@@ -597,7 +598,7 @@ lpfc_serialnum_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%s\n",phba->SerialNumber);
++ return scnprintf(buf, PAGE_SIZE, "%s\n", phba->SerialNumber);
+ }
+
+ /**
+@@ -619,7 +620,7 @@ lpfc_temp_sensor_show(struct device *dev, struct device_attribute *attr,
+ struct Scsi_Host *shost = class_to_shost(dev);
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+- return snprintf(buf, PAGE_SIZE, "%d\n",phba->temp_sensor_support);
++ return scnprintf(buf, PAGE_SIZE, "%d\n", phba->temp_sensor_support);
+ }
+
+ /**
+@@ -638,7 +639,7 @@ lpfc_modeldesc_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%s\n",phba->ModelDesc);
++ return scnprintf(buf, PAGE_SIZE, "%s\n", phba->ModelDesc);
+ }
+
+ /**
+@@ -657,7 +658,7 @@ lpfc_modelname_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%s\n",phba->ModelName);
++ return scnprintf(buf, PAGE_SIZE, "%s\n", phba->ModelName);
+ }
+
+ /**
+@@ -676,7 +677,7 @@ lpfc_programtype_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%s\n",phba->ProgramType);
++ return scnprintf(buf, PAGE_SIZE, "%s\n", phba->ProgramType);
+ }
+
+ /**
+@@ -694,7 +695,7 @@ lpfc_mlomgmt_show(struct device *dev, struct device_attribute *attr, char *buf)
+ struct lpfc_vport *vport = (struct lpfc_vport *)shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n",
++ return scnprintf(buf, PAGE_SIZE, "%d\n",
+ (phba->sli.sli_flag & LPFC_MENLO_MAINT));
+ }
+
+@@ -714,7 +715,7 @@ lpfc_vportnum_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%s\n",phba->Port);
++ return scnprintf(buf, PAGE_SIZE, "%s\n", phba->Port);
+ }
+
+ /**
+@@ -742,10 +743,10 @@ lpfc_fwrev_show(struct device *dev, struct device_attribute *attr,
+ sli_family = phba->sli4_hba.pc_sli4_params.sli_family;
+
+ if (phba->sli_rev < LPFC_SLI_REV4)
+- len = snprintf(buf, PAGE_SIZE, "%s, sli-%d\n",
++ len = scnprintf(buf, PAGE_SIZE, "%s, sli-%d\n",
+ fwrev, phba->sli_rev);
+ else
+- len = snprintf(buf, PAGE_SIZE, "%s, sli-%d:%d:%x\n",
++ len = scnprintf(buf, PAGE_SIZE, "%s, sli-%d:%d:%x\n",
+ fwrev, phba->sli_rev, if_type, sli_family);
+
+ return len;
+@@ -769,7 +770,7 @@ lpfc_hdw_show(struct device *dev, struct device_attribute *attr, char *buf)
+ lpfc_vpd_t *vp = &phba->vpd;
+
+ lpfc_jedec_to_ascii(vp->rev.biuRev, hdw);
+- return snprintf(buf, PAGE_SIZE, "%s\n", hdw);
++ return scnprintf(buf, PAGE_SIZE, "%s\n", hdw);
+ }
+
+ /**
+@@ -790,10 +791,11 @@ lpfc_option_rom_version_show(struct device *dev, struct device_attribute *attr,
+ char fwrev[FW_REV_STR_SIZE];
+
+ if (phba->sli_rev < LPFC_SLI_REV4)
+- return snprintf(buf, PAGE_SIZE, "%s\n", phba->OptionROMVersion);
++ return scnprintf(buf, PAGE_SIZE, "%s\n",
++ phba->OptionROMVersion);
+
+ lpfc_decode_firmware_rev(phba, fwrev, 1);
+- return snprintf(buf, PAGE_SIZE, "%s\n", fwrev);
++ return scnprintf(buf, PAGE_SIZE, "%s\n", fwrev);
+ }
+
+ /**
+@@ -824,20 +826,20 @@ lpfc_link_state_show(struct device *dev, struct device_attribute *attr,
+ case LPFC_LINK_DOWN:
+ case LPFC_HBA_ERROR:
+ if (phba->hba_flag & LINK_DISABLED)
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Link Down - User disabled\n");
+ else
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Link Down\n");
+ break;
+ case LPFC_LINK_UP:
+ case LPFC_CLEAR_LA:
+ case LPFC_HBA_READY:
+- len += snprintf(buf + len, PAGE_SIZE-len, "Link Up - ");
++ len += scnprintf(buf + len, PAGE_SIZE-len, "Link Up - ");
+
+ switch (vport->port_state) {
+ case LPFC_LOCAL_CFG_LINK:
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Configuring Link\n");
+ break;
+ case LPFC_FDISC:
+@@ -847,38 +849,40 @@ lpfc_link_state_show(struct device *dev, struct device_attribute *attr,
+ case LPFC_NS_QRY:
+ case LPFC_BUILD_DISC_LIST:
+ case LPFC_DISC_AUTH:
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "Discovery\n");
+ break;
+ case LPFC_VPORT_READY:
+- len += snprintf(buf + len, PAGE_SIZE - len, "Ready\n");
++ len += scnprintf(buf + len, PAGE_SIZE - len,
++ "Ready\n");
+ break;
+
+ case LPFC_VPORT_FAILED:
+- len += snprintf(buf + len, PAGE_SIZE - len, "Failed\n");
++ len += scnprintf(buf + len, PAGE_SIZE - len,
++ "Failed\n");
+ break;
+
+ case LPFC_VPORT_UNKNOWN:
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "Unknown\n");
+ break;
+ }
+ if (phba->sli.sli_flag & LPFC_MENLO_MAINT)
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ " Menlo Maint Mode\n");
+ else if (phba->fc_topology == LPFC_TOPOLOGY_LOOP) {
+ if (vport->fc_flag & FC_PUBLIC_LOOP)
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ " Public Loop\n");
+ else
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ " Private Loop\n");
+ } else {
+ if (vport->fc_flag & FC_FABRIC)
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ " Fabric\n");
+ else
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ " Point-2-Point\n");
+ }
+ }
+@@ -903,15 +907,15 @@ lpfc_sli4_protocol_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_hba *phba = vport->phba;
+
+ if (phba->sli_rev < LPFC_SLI_REV4)
+- return snprintf(buf, PAGE_SIZE, "fc\n");
++ return scnprintf(buf, PAGE_SIZE, "fc\n");
+
+ if (phba->sli4_hba.lnk_info.lnk_dv == LPFC_LNK_DAT_VAL) {
+ if (phba->sli4_hba.lnk_info.lnk_tp == LPFC_LNK_TYPE_GE)
+- return snprintf(buf, PAGE_SIZE, "fcoe\n");
++ return scnprintf(buf, PAGE_SIZE, "fcoe\n");
+ if (phba->sli4_hba.lnk_info.lnk_tp == LPFC_LNK_TYPE_FC)
+- return snprintf(buf, PAGE_SIZE, "fc\n");
++ return scnprintf(buf, PAGE_SIZE, "fc\n");
+ }
+- return snprintf(buf, PAGE_SIZE, "unknown\n");
++ return scnprintf(buf, PAGE_SIZE, "unknown\n");
+ }
+
+ /**
+@@ -931,7 +935,7 @@ lpfc_oas_supported_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *)shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n",
++ return scnprintf(buf, PAGE_SIZE, "%d\n",
+ phba->sli4_hba.pc_sli4_params.oas_supported);
+ }
+
+@@ -989,7 +993,7 @@ lpfc_num_discovered_ports_show(struct device *dev,
+ struct Scsi_Host *shost = class_to_shost(dev);
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n",
++ return scnprintf(buf, PAGE_SIZE, "%d\n",
+ vport->fc_map_cnt + vport->fc_unmap_cnt);
+ }
+
+@@ -1427,7 +1431,7 @@ lpfc_nport_evt_cnt_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", phba->nport_event_cnt);
++ return scnprintf(buf, PAGE_SIZE, "%d\n", phba->nport_event_cnt);
+ }
+
+ /**
+@@ -1456,7 +1460,7 @@ lpfc_board_mode_show(struct device *dev, struct device_attribute *attr,
+ else
+ state = "online";
+
+- return snprintf(buf, PAGE_SIZE, "%s\n", state);
++ return scnprintf(buf, PAGE_SIZE, "%s\n", state);
+ }
+
+ /**
+@@ -1669,8 +1673,8 @@ lpfc_max_rpi_show(struct device *dev, struct device_attribute *attr,
+ uint32_t cnt;
+
+ if (lpfc_get_hba_info(phba, NULL, NULL, &cnt, NULL, NULL, NULL))
+- return snprintf(buf, PAGE_SIZE, "%d\n", cnt);
+- return snprintf(buf, PAGE_SIZE, "Unknown\n");
++ return scnprintf(buf, PAGE_SIZE, "%d\n", cnt);
++ return scnprintf(buf, PAGE_SIZE, "Unknown\n");
+ }
+
+ /**
+@@ -1697,8 +1701,8 @@ lpfc_used_rpi_show(struct device *dev, struct device_attribute *attr,
+ uint32_t cnt, acnt;
+
+ if (lpfc_get_hba_info(phba, NULL, NULL, &cnt, &acnt, NULL, NULL))
+- return snprintf(buf, PAGE_SIZE, "%d\n", (cnt - acnt));
+- return snprintf(buf, PAGE_SIZE, "Unknown\n");
++ return scnprintf(buf, PAGE_SIZE, "%d\n", (cnt - acnt));
++ return scnprintf(buf, PAGE_SIZE, "Unknown\n");
+ }
+
+ /**
+@@ -1725,8 +1729,8 @@ lpfc_max_xri_show(struct device *dev, struct device_attribute *attr,
+ uint32_t cnt;
+
+ if (lpfc_get_hba_info(phba, &cnt, NULL, NULL, NULL, NULL, NULL))
+- return snprintf(buf, PAGE_SIZE, "%d\n", cnt);
+- return snprintf(buf, PAGE_SIZE, "Unknown\n");
++ return scnprintf(buf, PAGE_SIZE, "%d\n", cnt);
++ return scnprintf(buf, PAGE_SIZE, "Unknown\n");
+ }
+
+ /**
+@@ -1753,8 +1757,8 @@ lpfc_used_xri_show(struct device *dev, struct device_attribute *attr,
+ uint32_t cnt, acnt;
+
+ if (lpfc_get_hba_info(phba, &cnt, &acnt, NULL, NULL, NULL, NULL))
+- return snprintf(buf, PAGE_SIZE, "%d\n", (cnt - acnt));
+- return snprintf(buf, PAGE_SIZE, "Unknown\n");
++ return scnprintf(buf, PAGE_SIZE, "%d\n", (cnt - acnt));
++ return scnprintf(buf, PAGE_SIZE, "Unknown\n");
+ }
+
+ /**
+@@ -1781,8 +1785,8 @@ lpfc_max_vpi_show(struct device *dev, struct device_attribute *attr,
+ uint32_t cnt;
+
+ if (lpfc_get_hba_info(phba, NULL, NULL, NULL, NULL, &cnt, NULL))
+- return snprintf(buf, PAGE_SIZE, "%d\n", cnt);
+- return snprintf(buf, PAGE_SIZE, "Unknown\n");
++ return scnprintf(buf, PAGE_SIZE, "%d\n", cnt);
++ return scnprintf(buf, PAGE_SIZE, "Unknown\n");
+ }
+
+ /**
+@@ -1809,8 +1813,8 @@ lpfc_used_vpi_show(struct device *dev, struct device_attribute *attr,
+ uint32_t cnt, acnt;
+
+ if (lpfc_get_hba_info(phba, NULL, NULL, NULL, NULL, &cnt, &acnt))
+- return snprintf(buf, PAGE_SIZE, "%d\n", (cnt - acnt));
+- return snprintf(buf, PAGE_SIZE, "Unknown\n");
++ return scnprintf(buf, PAGE_SIZE, "%d\n", (cnt - acnt));
++ return scnprintf(buf, PAGE_SIZE, "Unknown\n");
+ }
+
+ /**
+@@ -1835,10 +1839,10 @@ lpfc_npiv_info_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_hba *phba = vport->phba;
+
+ if (!(phba->max_vpi))
+- return snprintf(buf, PAGE_SIZE, "NPIV Not Supported\n");
++ return scnprintf(buf, PAGE_SIZE, "NPIV Not Supported\n");
+ if (vport->port_type == LPFC_PHYSICAL_PORT)
+- return snprintf(buf, PAGE_SIZE, "NPIV Physical\n");
+- return snprintf(buf, PAGE_SIZE, "NPIV Virtual (VPI %d)\n", vport->vpi);
++ return scnprintf(buf, PAGE_SIZE, "NPIV Physical\n");
++ return scnprintf(buf, PAGE_SIZE, "NPIV Virtual (VPI %d)\n", vport->vpi);
+ }
+
+ /**
+@@ -1860,7 +1864,7 @@ lpfc_poll_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%#x\n", phba->cfg_poll);
++ return scnprintf(buf, PAGE_SIZE, "%#x\n", phba->cfg_poll);
+ }
+
+ /**
+@@ -1964,7 +1968,7 @@ lpfc_fips_level_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", phba->fips_level);
++ return scnprintf(buf, PAGE_SIZE, "%d\n", phba->fips_level);
+ }
+
+ /**
+@@ -1983,7 +1987,7 @@ lpfc_fips_rev_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", phba->fips_spec_rev);
++ return scnprintf(buf, PAGE_SIZE, "%d\n", phba->fips_spec_rev);
+ }
+
+ /**
+@@ -2002,7 +2006,7 @@ lpfc_dss_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%s - %sOperational\n",
++ return scnprintf(buf, PAGE_SIZE, "%s - %sOperational\n",
+ (phba->cfg_enable_dss) ? "Enabled" : "Disabled",
+ (phba->sli3_options & LPFC_SLI3_DSS_ENABLED) ?
+ "" : "Not ");
+@@ -2031,7 +2035,7 @@ lpfc_sriov_hw_max_virtfn_show(struct device *dev,
+ uint16_t max_nr_virtfn;
+
+ max_nr_virtfn = lpfc_sli_sriov_nr_virtfn_get(phba);
+- return snprintf(buf, PAGE_SIZE, "%d\n", max_nr_virtfn);
++ return scnprintf(buf, PAGE_SIZE, "%d\n", max_nr_virtfn);
+ }
+
+ static inline bool lpfc_rangecheck(uint val, uint min, uint max)
+@@ -2091,7 +2095,7 @@ lpfc_##attr##_show(struct device *dev, struct device_attribute *attr, \
+ struct Scsi_Host *shost = class_to_shost(dev);\
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;\
+ struct lpfc_hba *phba = vport->phba;\
+- return snprintf(buf, PAGE_SIZE, "%d\n",\
++ return scnprintf(buf, PAGE_SIZE, "%d\n",\
+ phba->cfg_##attr);\
+ }
+
+@@ -2119,7 +2123,7 @@ lpfc_##attr##_show(struct device *dev, struct device_attribute *attr, \
+ struct lpfc_hba *phba = vport->phba;\
+ uint val = 0;\
+ val = phba->cfg_##attr;\
+- return snprintf(buf, PAGE_SIZE, "%#x\n",\
++ return scnprintf(buf, PAGE_SIZE, "%#x\n",\
+ phba->cfg_##attr);\
+ }
+
+@@ -2255,7 +2259,7 @@ lpfc_##attr##_show(struct device *dev, struct device_attribute *attr, \
+ { \
+ struct Scsi_Host *shost = class_to_shost(dev);\
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;\
+- return snprintf(buf, PAGE_SIZE, "%d\n", vport->cfg_##attr);\
++ return scnprintf(buf, PAGE_SIZE, "%d\n", vport->cfg_##attr);\
+ }
+
+ /**
+@@ -2280,7 +2284,7 @@ lpfc_##attr##_show(struct device *dev, struct device_attribute *attr, \
+ { \
+ struct Scsi_Host *shost = class_to_shost(dev);\
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;\
+- return snprintf(buf, PAGE_SIZE, "%#x\n", vport->cfg_##attr);\
++ return scnprintf(buf, PAGE_SIZE, "%#x\n", vport->cfg_##attr);\
+ }
+
+ /**
+@@ -2551,7 +2555,7 @@ lpfc_soft_wwpn_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+ struct lpfc_hba *phba = vport->phba;
+
+- return snprintf(buf, PAGE_SIZE, "0x%llx\n",
++ return scnprintf(buf, PAGE_SIZE, "0x%llx\n",
+ (unsigned long long)phba->cfg_soft_wwpn);
+ }
+
+@@ -2648,7 +2652,7 @@ lpfc_soft_wwnn_show(struct device *dev, struct device_attribute *attr,
+ {
+ struct Scsi_Host *shost = class_to_shost(dev);
+ struct lpfc_hba *phba = ((struct lpfc_vport *)shost->hostdata)->phba;
+- return snprintf(buf, PAGE_SIZE, "0x%llx\n",
++ return scnprintf(buf, PAGE_SIZE, "0x%llx\n",
+ (unsigned long long)phba->cfg_soft_wwnn);
+ }
+
+@@ -2714,7 +2718,7 @@ lpfc_oas_tgt_show(struct device *dev, struct device_attribute *attr,
+ struct Scsi_Host *shost = class_to_shost(dev);
+ struct lpfc_hba *phba = ((struct lpfc_vport *)shost->hostdata)->phba;
+
+- return snprintf(buf, PAGE_SIZE, "0x%llx\n",
++ return scnprintf(buf, PAGE_SIZE, "0x%llx\n",
+ wwn_to_u64(phba->cfg_oas_tgt_wwpn));
+ }
+
+@@ -2782,7 +2786,7 @@ lpfc_oas_priority_show(struct device *dev, struct device_attribute *attr,
+ struct Scsi_Host *shost = class_to_shost(dev);
+ struct lpfc_hba *phba = ((struct lpfc_vport *)shost->hostdata)->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", phba->cfg_oas_priority);
++ return scnprintf(buf, PAGE_SIZE, "%d\n", phba->cfg_oas_priority);
+ }
+
+ /**
+@@ -2845,7 +2849,7 @@ lpfc_oas_vpt_show(struct device *dev, struct device_attribute *attr,
+ struct Scsi_Host *shost = class_to_shost(dev);
+ struct lpfc_hba *phba = ((struct lpfc_vport *)shost->hostdata)->phba;
+
+- return snprintf(buf, PAGE_SIZE, "0x%llx\n",
++ return scnprintf(buf, PAGE_SIZE, "0x%llx\n",
+ wwn_to_u64(phba->cfg_oas_vpt_wwpn));
+ }
+
+@@ -2916,7 +2920,7 @@ lpfc_oas_lun_state_show(struct device *dev, struct device_attribute *attr,
+ struct Scsi_Host *shost = class_to_shost(dev);
+ struct lpfc_hba *phba = ((struct lpfc_vport *)shost->hostdata)->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", phba->cfg_oas_lun_state);
++ return scnprintf(buf, PAGE_SIZE, "%d\n", phba->cfg_oas_lun_state);
+ }
+
+ /**
+@@ -2980,7 +2984,7 @@ lpfc_oas_lun_status_show(struct device *dev, struct device_attribute *attr,
+ if (!(phba->cfg_oas_flags & OAS_LUN_VALID))
+ return -EFAULT;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", phba->cfg_oas_lun_status);
++ return scnprintf(buf, PAGE_SIZE, "%d\n", phba->cfg_oas_lun_status);
+ }
+ static DEVICE_ATTR(lpfc_xlane_lun_status, S_IRUGO,
+ lpfc_oas_lun_status_show, NULL);
+@@ -3132,7 +3136,7 @@ lpfc_oas_lun_show(struct device *dev, struct device_attribute *attr,
+ if (oas_lun != NOT_OAS_ENABLED_LUN)
+ phba->cfg_oas_flags |= OAS_LUN_VALID;
+
+- len += snprintf(buf + len, PAGE_SIZE-len, "0x%llx", oas_lun);
++ len += scnprintf(buf + len, PAGE_SIZE-len, "0x%llx", oas_lun);
+
+ return len;
+ }
+@@ -3266,7 +3270,7 @@ lpfc_iocb_hw_show(struct device *dev, struct device_attribute *attr, char *buf)
+ struct Scsi_Host *shost = class_to_shost(dev);
+ struct lpfc_hba *phba = ((struct lpfc_vport *) shost->hostdata)->phba;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", phba->iocb_max);
++ return scnprintf(buf, PAGE_SIZE, "%d\n", phba->iocb_max);
+ }
+
+ static DEVICE_ATTR(iocb_hw, S_IRUGO,
+@@ -3278,7 +3282,7 @@ lpfc_txq_hw_show(struct device *dev, struct device_attribute *attr, char *buf)
+ struct lpfc_hba *phba = ((struct lpfc_vport *) shost->hostdata)->phba;
+ struct lpfc_sli_ring *pring = lpfc_phba_elsring(phba);
+
+- return snprintf(buf, PAGE_SIZE, "%d\n",
++ return scnprintf(buf, PAGE_SIZE, "%d\n",
+ pring ? pring->txq_max : 0);
+ }
+
+@@ -3292,7 +3296,7 @@ lpfc_txcmplq_hw_show(struct device *dev, struct device_attribute *attr,
+ struct lpfc_hba *phba = ((struct lpfc_vport *) shost->hostdata)->phba;
+ struct lpfc_sli_ring *pring = lpfc_phba_elsring(phba);
+
+- return snprintf(buf, PAGE_SIZE, "%d\n",
++ return scnprintf(buf, PAGE_SIZE, "%d\n",
+ pring ? pring->txcmplq_max : 0);
+ }
+
+@@ -3328,7 +3332,7 @@ lpfc_nodev_tmo_show(struct device *dev, struct device_attribute *attr,
+ struct Scsi_Host *shost = class_to_shost(dev);
+ struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", vport->cfg_devloss_tmo);
++ return scnprintf(buf, PAGE_SIZE, "%d\n", vport->cfg_devloss_tmo);
+ }
+
+ /**
+@@ -4830,19 +4834,19 @@ lpfc_fcp_cpu_map_show(struct device *dev, struct device_attribute *attr,
+
+ switch (phba->cfg_fcp_cpu_map) {
+ case 0:
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "fcp_cpu_map: No mapping (%d)\n",
+ phba->cfg_fcp_cpu_map);
+ return len;
+ case 1:
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "fcp_cpu_map: HBA centric mapping (%d): "
+ "%d online CPUs\n",
+ phba->cfg_fcp_cpu_map,
+ phba->sli4_hba.num_online_cpu);
+ break;
+ case 2:
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "fcp_cpu_map: Driver centric mapping (%d): "
+ "%d online CPUs\n",
+ phba->cfg_fcp_cpu_map,
+@@ -4855,14 +4859,14 @@ lpfc_fcp_cpu_map_show(struct device *dev, struct device_attribute *attr,
+
+ /* margin should fit in this and the truncated message */
+ if (cpup->irq == LPFC_VECTOR_MAP_EMPTY)
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "CPU %02d io_chan %02d "
+ "physid %d coreid %d\n",
+ phba->sli4_hba.curr_disp_cpu,
+ cpup->channel_id, cpup->phys_id,
+ cpup->core_id);
+ else
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "CPU %02d io_chan %02d "
+ "physid %d coreid %d IRQ %d\n",
+ phba->sli4_hba.curr_disp_cpu,
+@@ -4875,7 +4879,7 @@ lpfc_fcp_cpu_map_show(struct device *dev, struct device_attribute *attr,
+ if (phba->sli4_hba.curr_disp_cpu <
+ phba->sli4_hba.num_present_cpu &&
+ (len >= (PAGE_SIZE - 64))) {
+- len += snprintf(buf + len, PAGE_SIZE-len, "more...\n");
++ len += scnprintf(buf + len, PAGE_SIZE-len, "more...\n");
+ break;
+ }
+ }
+@@ -6296,7 +6300,7 @@ lpfc_show_rport_##field (struct device *dev, \
+ { \
+ struct fc_rport *rport = transport_class_to_rport(dev); \
+ struct lpfc_rport_data *rdata = rport->hostdata; \
+- return snprintf(buf, sz, format_string, \
++ return scnprintf(buf, sz, format_string, \
+ (rdata->target) ? cast rdata->target->field : 0); \
+ }
+
+diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
+index 1cbdc892ff95..1a964e71582f 100644
+--- a/drivers/scsi/lpfc/lpfc_ct.c
++++ b/drivers/scsi/lpfc/lpfc_ct.c
+@@ -1220,7 +1220,7 @@ lpfc_vport_symbolic_port_name(struct lpfc_vport *vport, char *symbol,
+ * Name object. NPIV is not in play so this integer
+ * value is sufficient and unique per FC-ID.
+ */
+- n = snprintf(symbol, size, "%d", vport->phba->brd_no);
++ n = scnprintf(symbol, size, "%d", vport->phba->brd_no);
+ return n;
+ }
+
+@@ -1234,26 +1234,26 @@ lpfc_vport_symbolic_node_name(struct lpfc_vport *vport, char *symbol,
+
+ lpfc_decode_firmware_rev(vport->phba, fwrev, 0);
+
+- n = snprintf(symbol, size, "Emulex %s", vport->phba->ModelName);
++ n = scnprintf(symbol, size, "Emulex %s", vport->phba->ModelName);
+ if (size < n)
+ return n;
+
+- n += snprintf(symbol + n, size - n, " FV%s", fwrev);
++ n += scnprintf(symbol + n, size - n, " FV%s", fwrev);
+ if (size < n)
+ return n;
+
+- n += snprintf(symbol + n, size - n, " DV%s.",
++ n += scnprintf(symbol + n, size - n, " DV%s.",
+ lpfc_release_version);
+ if (size < n)
+ return n;
+
+- n += snprintf(symbol + n, size - n, " HN:%s.",
++ n += scnprintf(symbol + n, size - n, " HN:%s.",
+ init_utsname()->nodename);
+ if (size < n)
+ return n;
+
+ /* Note :- OS name is "Linux" */
+- n += snprintf(symbol + n, size - n, " OS:%s\n",
++ n += scnprintf(symbol + n, size - n, " OS:%s\n",
+ init_utsname()->sysname);
+ return n;
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index ca6c3982548d..f1951c432766 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -170,7 +170,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
+ snprintf(buffer,
+ LPFC_DEBUG_TRC_ENTRY_SIZE, "%010d:%010d ms:%s\n",
+ dtp->seq_cnt, ms, dtp->fmt);
+- len += snprintf(buf+len, size-len, buffer,
++ len += scnprintf(buf+len, size-len, buffer,
+ dtp->data1, dtp->data2, dtp->data3);
+ }
+ for (i = 0; i < index; i++) {
+@@ -181,7 +181,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
+ snprintf(buffer,
+ LPFC_DEBUG_TRC_ENTRY_SIZE, "%010d:%010d ms:%s\n",
+ dtp->seq_cnt, ms, dtp->fmt);
+- len += snprintf(buf+len, size-len, buffer,
++ len += scnprintf(buf+len, size-len, buffer,
+ dtp->data1, dtp->data2, dtp->data3);
+ }
+
+@@ -236,7 +236,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
+ snprintf(buffer,
+ LPFC_DEBUG_TRC_ENTRY_SIZE, "%010d:%010d ms:%s\n",
+ dtp->seq_cnt, ms, dtp->fmt);
+- len += snprintf(buf+len, size-len, buffer,
++ len += scnprintf(buf+len, size-len, buffer,
+ dtp->data1, dtp->data2, dtp->data3);
+ }
+ for (i = 0; i < index; i++) {
+@@ -247,7 +247,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
+ snprintf(buffer,
+ LPFC_DEBUG_TRC_ENTRY_SIZE, "%010d:%010d ms:%s\n",
+ dtp->seq_cnt, ms, dtp->fmt);
+- len += snprintf(buf+len, size-len, buffer,
++ len += scnprintf(buf+len, size-len, buffer,
+ dtp->data1, dtp->data2, dtp->data3);
+ }
+
+@@ -307,7 +307,7 @@ lpfc_debugfs_hbqinfo_data(struct lpfc_hba *phba, char *buf, int size)
+
+ i = lpfc_debugfs_last_hbq;
+
+- len += snprintf(buf+len, size-len, "HBQ %d Info\n", i);
++ len += scnprintf(buf+len, size-len, "HBQ %d Info\n", i);
+
+ hbqs = &phba->hbqs[i];
+ posted = 0;
+@@ -315,21 +315,21 @@ lpfc_debugfs_hbqinfo_data(struct lpfc_hba *phba, char *buf, int size)
+ posted++;
+
+ hip = lpfc_hbq_defs[i];
+- len += snprintf(buf+len, size-len,
++ len += scnprintf(buf+len, size-len,
+ "idx:%d prof:%d rn:%d bufcnt:%d icnt:%d acnt:%d posted %d\n",
+ hip->hbq_index, hip->profile, hip->rn,
+ hip->buffer_count, hip->init_count, hip->add_count, posted);
+
+ raw_index = phba->hbq_get[i];
+ getidx = le32_to_cpu(raw_index);
+- len += snprintf(buf+len, size-len,
++ len += scnprintf(buf+len, size-len,
+ "entries:%d bufcnt:%d Put:%d nPut:%d localGet:%d hbaGet:%d\n",
+ hbqs->entry_count, hbqs->buffer_count, hbqs->hbqPutIdx,
+ hbqs->next_hbqPutIdx, hbqs->local_hbqGetIdx, getidx);
+
+ hbqe = (struct lpfc_hbq_entry *) phba->hbqs[i].hbq_virt;
+ for (j=0; j<hbqs->entry_count; j++) {
+- len += snprintf(buf+len, size-len,
++ len += scnprintf(buf+len, size-len,
+ "%03d: %08x %04x %05x ", j,
+ le32_to_cpu(hbqe->bde.addrLow),
+ le32_to_cpu(hbqe->bde.tus.w),
+@@ -341,14 +341,16 @@ lpfc_debugfs_hbqinfo_data(struct lpfc_hba *phba, char *buf, int size)
+ low = hbqs->hbqPutIdx - posted;
+ if (low >= 0) {
+ if ((j >= hbqs->hbqPutIdx) || (j < low)) {
+- len += snprintf(buf+len, size-len, "Unused\n");
++ len += scnprintf(buf + len, size - len,
++ "Unused\n");
+ goto skipit;
+ }
+ }
+ else {
+ if ((j >= hbqs->hbqPutIdx) &&
+ (j < (hbqs->entry_count+low))) {
+- len += snprintf(buf+len, size-len, "Unused\n");
++ len += scnprintf(buf + len, size - len,
++ "Unused\n");
+ goto skipit;
+ }
+ }
+@@ -358,7 +360,7 @@ lpfc_debugfs_hbqinfo_data(struct lpfc_hba *phba, char *buf, int size)
+ hbq_buf = container_of(d_buf, struct hbq_dmabuf, dbuf);
+ phys = ((uint64_t)hbq_buf->dbuf.phys & 0xffffffff);
+ if (phys == le32_to_cpu(hbqe->bde.addrLow)) {
+- len += snprintf(buf+len, size-len,
++ len += scnprintf(buf+len, size-len,
+ "Buf%d: %p %06x\n", i,
+ hbq_buf->dbuf.virt, hbq_buf->tag);
+ found = 1;
+@@ -367,7 +369,7 @@ lpfc_debugfs_hbqinfo_data(struct lpfc_hba *phba, char *buf, int size)
+ i++;
+ }
+ if (!found) {
+- len += snprintf(buf+len, size-len, "No DMAinfo?\n");
++ len += scnprintf(buf+len, size-len, "No DMAinfo?\n");
+ }
+ skipit:
+ hbqe++;
+@@ -413,7 +415,7 @@ lpfc_debugfs_dumpHBASlim_data(struct lpfc_hba *phba, char *buf, int size)
+ off = 0;
+ spin_lock_irq(&phba->hbalock);
+
+- len += snprintf(buf+len, size-len, "HBA SLIM\n");
++ len += scnprintf(buf+len, size-len, "HBA SLIM\n");
+ lpfc_memcpy_from_slim(buffer,
+ phba->MBslimaddr + lpfc_debugfs_last_hba_slim_off, 1024);
+
+@@ -427,7 +429,7 @@ lpfc_debugfs_dumpHBASlim_data(struct lpfc_hba *phba, char *buf, int size)
+
+ i = 1024;
+ while (i > 0) {
+- len += snprintf(buf+len, size-len,
++ len += scnprintf(buf+len, size-len,
+ "%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
+ off, *ptr, *(ptr+1), *(ptr+2), *(ptr+3), *(ptr+4),
+ *(ptr+5), *(ptr+6), *(ptr+7));
+@@ -471,11 +473,11 @@ lpfc_debugfs_dumpHostSlim_data(struct lpfc_hba *phba, char *buf, int size)
+ off = 0;
+ spin_lock_irq(&phba->hbalock);
+
+- len += snprintf(buf+len, size-len, "SLIM Mailbox\n");
++ len += scnprintf(buf+len, size-len, "SLIM Mailbox\n");
+ ptr = (uint32_t *)phba->slim2p.virt;
+ i = sizeof(MAILBOX_t);
+ while (i > 0) {
+- len += snprintf(buf+len, size-len,
++ len += scnprintf(buf+len, size-len,
+ "%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
+ off, *ptr, *(ptr+1), *(ptr+2), *(ptr+3), *(ptr+4),
+ *(ptr+5), *(ptr+6), *(ptr+7));
+@@ -484,11 +486,11 @@ lpfc_debugfs_dumpHostSlim_data(struct lpfc_hba *phba, char *buf, int size)
+ off += (8 * sizeof(uint32_t));
+ }
+
+- len += snprintf(buf+len, size-len, "SLIM PCB\n");
++ len += scnprintf(buf+len, size-len, "SLIM PCB\n");
+ ptr = (uint32_t *)phba->pcb;
+ i = sizeof(PCB_t);
+ while (i > 0) {
+- len += snprintf(buf+len, size-len,
++ len += scnprintf(buf+len, size-len,
+ "%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
+ off, *ptr, *(ptr+1), *(ptr+2), *(ptr+3), *(ptr+4),
+ *(ptr+5), *(ptr+6), *(ptr+7));
+@@ -501,7 +503,7 @@ lpfc_debugfs_dumpHostSlim_data(struct lpfc_hba *phba, char *buf, int size)
+ for (i = 0; i < 4; i++) {
+ pgpp = &phba->port_gp[i];
+ pring = &psli->sli3_ring[i];
+- len += snprintf(buf+len, size-len,
++ len += scnprintf(buf+len, size-len,
+ "Ring %d: CMD GetInx:%d "
+ "(Max:%d Next:%d "
+ "Local:%d flg:x%x) "
+@@ -518,7 +520,7 @@ lpfc_debugfs_dumpHostSlim_data(struct lpfc_hba *phba, char *buf, int size)
+ word1 = readl(phba->CAregaddr);
+ word2 = readl(phba->HSregaddr);
+ word3 = readl(phba->HCregaddr);
+- len += snprintf(buf+len, size-len, "HA:%08x CA:%08x HS:%08x "
++ len += scnprintf(buf+len, size-len, "HA:%08x CA:%08x HS:%08x "
+ "HC:%08x\n", word0, word1, word2, word3);
+ }
+ spin_unlock_irq(&phba->hbalock);
+@@ -557,12 +559,12 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
+ cnt = (LPFC_NODELIST_SIZE / LPFC_NODELIST_ENTRY_SIZE);
+ outio = 0;
+
+- len += snprintf(buf+len, size-len, "\nFCP Nodelist Entries ...\n");
++ len += scnprintf(buf+len, size-len, "\nFCP Nodelist Entries ...\n");
+ spin_lock_irq(shost->host_lock);
+ list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp) {
+ iocnt = 0;
+ if (!cnt) {
+- len += snprintf(buf+len, size-len,
++ len += scnprintf(buf+len, size-len,
+ "Missing Nodelist Entries\n");
+ break;
+ }
+@@ -600,62 +602,62 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
+ default:
+ statep = "UNKNOWN";
+ }
+- len += snprintf(buf+len, size-len, "%s DID:x%06x ",
++ len += scnprintf(buf+len, size-len, "%s DID:x%06x ",
+ statep, ndlp->nlp_DID);
+- len += snprintf(buf+len, size-len,
++ len += scnprintf(buf+len, size-len,
+ "WWPN x%llx ",
+ wwn_to_u64(ndlp->nlp_portname.u.wwn));
+- len += snprintf(buf+len, size-len,
++ len += scnprintf(buf+len, size-len,
+ "WWNN x%llx ",
+ wwn_to_u64(ndlp->nlp_nodename.u.wwn));
+ if (ndlp->nlp_flag & NLP_RPI_REGISTERED)
+- len += snprintf(buf+len, size-len, "RPI:%03d ",
++ len += scnprintf(buf+len, size-len, "RPI:%03d ",
+ ndlp->nlp_rpi);
+ else
+- len += snprintf(buf+len, size-len, "RPI:none ");
+- len += snprintf(buf+len, size-len, "flag:x%08x ",
++ len += scnprintf(buf+len, size-len, "RPI:none ");
++ len += scnprintf(buf+len, size-len, "flag:x%08x ",
+ ndlp->nlp_flag);
+ if (!ndlp->nlp_type)
+- len += snprintf(buf+len, size-len, "UNKNOWN_TYPE ");
++ len += scnprintf(buf+len, size-len, "UNKNOWN_TYPE ");
+ if (ndlp->nlp_type & NLP_FC_NODE)
+- len += snprintf(buf+len, size-len, "FC_NODE ");
++ len += scnprintf(buf+len, size-len, "FC_NODE ");
+ if (ndlp->nlp_type & NLP_FABRIC) {
+- len += snprintf(buf+len, size-len, "FABRIC ");
++ len += scnprintf(buf+len, size-len, "FABRIC ");
+ iocnt = 0;
+ }
+ if (ndlp->nlp_type & NLP_FCP_TARGET)
+- len += snprintf(buf+len, size-len, "FCP_TGT sid:%d ",
++ len += scnprintf(buf+len, size-len, "FCP_TGT sid:%d ",
+ ndlp->nlp_sid);
+ if (ndlp->nlp_type & NLP_FCP_INITIATOR)
+- len += snprintf(buf+len, size-len, "FCP_INITIATOR ");
++ len += scnprintf(buf+len, size-len, "FCP_INITIATOR ");
+ if (ndlp->nlp_type & NLP_NVME_TARGET)
+- len += snprintf(buf + len,
++ len += scnprintf(buf + len,
+ size - len, "NVME_TGT sid:%d ",
+ NLP_NO_SID);
+ if (ndlp->nlp_type & NLP_NVME_INITIATOR)
+- len += snprintf(buf + len,
++ len += scnprintf(buf + len,
+ size - len, "NVME_INITIATOR ");
+- len += snprintf(buf+len, size-len, "usgmap:%x ",
++ len += scnprintf(buf+len, size-len, "usgmap:%x ",
+ ndlp->nlp_usg_map);
+- len += snprintf(buf+len, size-len, "refcnt:%x",
++ len += scnprintf(buf+len, size-len, "refcnt:%x",
+ kref_read(&ndlp->kref));
+ if (iocnt) {
+ i = atomic_read(&ndlp->cmd_pending);
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ " OutIO:x%x Qdepth x%x",
+ i, ndlp->cmd_qdepth);
+ outio += i;
+ }
+- len += snprintf(buf+len, size-len, "\n");
++ len += scnprintf(buf+len, size-len, "\n");
+ }
+ spin_unlock_irq(shost->host_lock);
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "\nOutstanding IO x%x\n", outio);
+
+ if (phba->nvmet_support && phba->targetport && (vport == phba->pport)) {
+ tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "\nNVME Targetport Entry ...\n");
+
+ /* Port state is only one of two values for now. */
+@@ -663,18 +665,18 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
+ statep = "REGISTERED";
+ else
+ statep = "INIT";
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "TGT WWNN x%llx WWPN x%llx State %s\n",
+ wwn_to_u64(vport->fc_nodename.u.wwn),
+ wwn_to_u64(vport->fc_portname.u.wwn),
+ statep);
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ " Targetport DID x%06x\n",
+ phba->targetport->port_id);
+ goto out_exit;
+ }
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "\nNVME Lport/Rport Entries ...\n");
+
+ localport = vport->localport;
+@@ -689,11 +691,11 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
+ else
+ statep = "UNKNOWN ";
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "Lport DID x%06x PortState %s\n",
+ localport->port_id, statep);
+
+- len += snprintf(buf + len, size - len, "\tRport List:\n");
++ len += scnprintf(buf + len, size - len, "\tRport List:\n");
+ list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp) {
+ /* local short-hand pointer. */
+ spin_lock(&phba->hbalock);
+@@ -720,32 +722,32 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
+ }
+
+ /* Tab in to show lport ownership. */
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "\t%s Port ID:x%06x ",
+ statep, nrport->port_id);
+- len += snprintf(buf + len, size - len, "WWPN x%llx ",
++ len += scnprintf(buf + len, size - len, "WWPN x%llx ",
+ nrport->port_name);
+- len += snprintf(buf + len, size - len, "WWNN x%llx ",
++ len += scnprintf(buf + len, size - len, "WWNN x%llx ",
+ nrport->node_name);
+
+ /* An NVME rport can have multiple roles. */
+ if (nrport->port_role & FC_PORT_ROLE_NVME_INITIATOR)
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "INITIATOR ");
+ if (nrport->port_role & FC_PORT_ROLE_NVME_TARGET)
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "TARGET ");
+ if (nrport->port_role & FC_PORT_ROLE_NVME_DISCOVERY)
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "DISCSRVC ");
+ if (nrport->port_role & ~(FC_PORT_ROLE_NVME_INITIATOR |
+ FC_PORT_ROLE_NVME_TARGET |
+ FC_PORT_ROLE_NVME_DISCOVERY))
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "UNKNOWN ROLE x%x",
+ nrport->port_role);
+ /* Terminate the string. */
+- len += snprintf(buf + len, size - len, "\n");
++ len += scnprintf(buf + len, size - len, "\n");
+ }
+
+ spin_unlock_irq(shost->host_lock);
+@@ -784,35 +786,35 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
+ if (!phba->targetport)
+ return len;
+ tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "\nNVME Targetport Statistics\n");
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "LS: Rcv %08x Drop %08x Abort %08x\n",
+ atomic_read(&tgtp->rcv_ls_req_in),
+ atomic_read(&tgtp->rcv_ls_req_drop),
+ atomic_read(&tgtp->xmt_ls_abort));
+ if (atomic_read(&tgtp->rcv_ls_req_in) !=
+ atomic_read(&tgtp->rcv_ls_req_out)) {
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "Rcv LS: in %08x != out %08x\n",
+ atomic_read(&tgtp->rcv_ls_req_in),
+ atomic_read(&tgtp->rcv_ls_req_out));
+ }
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "LS: Xmt %08x Drop %08x Cmpl %08x\n",
+ atomic_read(&tgtp->xmt_ls_rsp),
+ atomic_read(&tgtp->xmt_ls_drop),
+ atomic_read(&tgtp->xmt_ls_rsp_cmpl));
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "LS: RSP Abort %08x xb %08x Err %08x\n",
+ atomic_read(&tgtp->xmt_ls_rsp_aborted),
+ atomic_read(&tgtp->xmt_ls_rsp_xb_set),
+ atomic_read(&tgtp->xmt_ls_rsp_error));
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "FCP: Rcv %08x Defer %08x Release %08x "
+ "Drop %08x\n",
+ atomic_read(&tgtp->rcv_fcp_cmd_in),
+@@ -822,13 +824,13 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
+
+ if (atomic_read(&tgtp->rcv_fcp_cmd_in) !=
+ atomic_read(&tgtp->rcv_fcp_cmd_out)) {
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "Rcv FCP: in %08x != out %08x\n",
+ atomic_read(&tgtp->rcv_fcp_cmd_in),
+ atomic_read(&tgtp->rcv_fcp_cmd_out));
+ }
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "FCP Rsp: read %08x readrsp %08x "
+ "write %08x rsp %08x\n",
+ atomic_read(&tgtp->xmt_fcp_read),
+@@ -836,31 +838,31 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
+ atomic_read(&tgtp->xmt_fcp_write),
+ atomic_read(&tgtp->xmt_fcp_rsp));
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "FCP Rsp Cmpl: %08x err %08x drop %08x\n",
+ atomic_read(&tgtp->xmt_fcp_rsp_cmpl),
+ atomic_read(&tgtp->xmt_fcp_rsp_error),
+ atomic_read(&tgtp->xmt_fcp_rsp_drop));
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "FCP Rsp Abort: %08x xb %08x xricqe %08x\n",
+ atomic_read(&tgtp->xmt_fcp_rsp_aborted),
+ atomic_read(&tgtp->xmt_fcp_rsp_xb_set),
+ atomic_read(&tgtp->xmt_fcp_xri_abort_cqe));
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "ABORT: Xmt %08x Cmpl %08x\n",
+ atomic_read(&tgtp->xmt_fcp_abort),
+ atomic_read(&tgtp->xmt_fcp_abort_cmpl));
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "ABORT: Sol %08x Usol %08x Err %08x Cmpl %08x",
+ atomic_read(&tgtp->xmt_abort_sol),
+ atomic_read(&tgtp->xmt_abort_unsol),
+ atomic_read(&tgtp->xmt_abort_rsp),
+ atomic_read(&tgtp->xmt_abort_rsp_error));
+
+- len += snprintf(buf + len, size - len, "\n");
++ len += scnprintf(buf + len, size - len, "\n");
+
+ cnt = 0;
+ spin_lock(&phba->sli4_hba.abts_nvme_buf_list_lock);
+@@ -871,7 +873,7 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
+ }
+ spin_unlock(&phba->sli4_hba.abts_nvme_buf_list_lock);
+ if (cnt) {
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "ABORT: %d ctx entries\n", cnt);
+ spin_lock(&phba->sli4_hba.abts_nvme_buf_list_lock);
+ list_for_each_entry_safe(ctxp, next_ctxp,
+@@ -879,7 +881,7 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
+ list) {
+ if (len >= (size - LPFC_DEBUG_OUT_LINE_SZ))
+ break;
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "Entry: oxid %x state %x "
+ "flag %x\n",
+ ctxp->oxid, ctxp->state,
+@@ -893,7 +895,7 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
+ tot += atomic_read(&tgtp->xmt_fcp_release);
+ tot = atomic_read(&tgtp->rcv_fcp_cmd_in) - tot;
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "IO_CTX: %08x WAIT: cur %08x tot %08x\n"
+ "CTX Outstanding %08llx\n",
+ phba->sli4_hba.nvmet_xri_cnt,
+@@ -911,10 +913,10 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
+ if (!lport)
+ return len;
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "\nNVME Lport Statistics\n");
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "LS: Xmt %016x Cmpl %016x\n",
+ atomic_read(&lport->fc4NvmeLsRequests),
+ atomic_read(&lport->fc4NvmeLsCmpls));
+@@ -938,20 +940,20 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
+ if (i >= 32)
+ continue;
+
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "FCP (%d): Rd %016llx Wr %016llx "
+ "IO %016llx ",
+ i, data1, data2, data3);
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "Cmpl %016llx OutIO %016llx\n",
+ tot, ((data1 + data2 + data3) - tot));
+ }
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "Total FCP Cmpl %016llx Issue %016llx "
+ "OutIO %016llx\n",
+ totin, totout, totout - totin);
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "LS Xmt Err: Abrt %08x Err %08x "
+ "Cmpl Err: xb %08x Err %08x\n",
+ atomic_read(&lport->xmt_ls_abort),
+@@ -959,7 +961,7 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
+ atomic_read(&lport->cmpl_ls_xb),
+ atomic_read(&lport->cmpl_ls_err));
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "FCP Xmt Err: noxri %06x nondlp %06x "
+ "qdepth %06x wqerr %06x err %06x Abrt %06x\n",
+ atomic_read(&lport->xmt_fcp_noxri),
+@@ -969,7 +971,7 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
+ atomic_read(&lport->xmt_fcp_err),
+ atomic_read(&lport->xmt_fcp_abort));
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "FCP Cmpl Err: xb %08x Err %08x\n",
+ atomic_read(&lport->cmpl_fcp_xb),
+ atomic_read(&lport->cmpl_fcp_err));
+@@ -1001,58 +1003,58 @@ lpfc_debugfs_nvmektime_data(struct lpfc_vport *vport, char *buf, int size)
+
+ if (phba->nvmet_support == 0) {
+ /* NVME Initiator */
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "ktime %s: Total Samples: %lld\n",
+ (phba->ktime_on ? "Enabled" : "Disabled"),
+ phba->ktime_data_samples);
+ if (phba->ktime_data_samples == 0)
+ return len;
+
+- len += snprintf(
++ len += scnprintf(
+ buf + len, PAGE_SIZE - len,
+ "Segment 1: Last NVME Cmd cmpl "
+ "done -to- Start of next NVME cnd (in driver)\n");
+- len += snprintf(
++ len += scnprintf(
+ buf + len, PAGE_SIZE - len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg1_total,
+ phba->ktime_data_samples),
+ phba->ktime_seg1_min,
+ phba->ktime_seg1_max);
+- len += snprintf(
++ len += scnprintf(
+ buf + len, PAGE_SIZE - len,
+ "Segment 2: Driver start of NVME cmd "
+ "-to- Firmware WQ doorbell\n");
+- len += snprintf(
++ len += scnprintf(
+ buf + len, PAGE_SIZE - len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg2_total,
+ phba->ktime_data_samples),
+ phba->ktime_seg2_min,
+ phba->ktime_seg2_max);
+- len += snprintf(
++ len += scnprintf(
+ buf + len, PAGE_SIZE - len,
+ "Segment 3: Firmware WQ doorbell -to- "
+ "MSI-X ISR cmpl\n");
+- len += snprintf(
++ len += scnprintf(
+ buf + len, PAGE_SIZE - len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg3_total,
+ phba->ktime_data_samples),
+ phba->ktime_seg3_min,
+ phba->ktime_seg3_max);
+- len += snprintf(
++ len += scnprintf(
+ buf + len, PAGE_SIZE - len,
+ "Segment 4: MSI-X ISR cmpl -to- "
+ "NVME cmpl done\n");
+- len += snprintf(
++ len += scnprintf(
+ buf + len, PAGE_SIZE - len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg4_total,
+ phba->ktime_data_samples),
+ phba->ktime_seg4_min,
+ phba->ktime_seg4_max);
+- len += snprintf(
++ len += scnprintf(
+ buf + len, PAGE_SIZE - len,
+ "Total IO avg time: %08lld\n",
+ div_u64(phba->ktime_seg1_total +
+@@ -1064,7 +1066,7 @@ lpfc_debugfs_nvmektime_data(struct lpfc_vport *vport, char *buf, int size)
+ }
+
+ /* NVME Target */
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "ktime %s: Total Samples: %lld %lld\n",
+ (phba->ktime_on ? "Enabled" : "Disabled"),
+ phba->ktime_data_samples,
+@@ -1072,46 +1074,46 @@ lpfc_debugfs_nvmektime_data(struct lpfc_vport *vport, char *buf, int size)
+ if (phba->ktime_data_samples == 0)
+ return len;
+
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Segment 1: MSI-X ISR Rcv cmd -to- "
+ "cmd pass to NVME Layer\n");
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg1_total,
+ phba->ktime_data_samples),
+ phba->ktime_seg1_min,
+ phba->ktime_seg1_max);
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Segment 2: cmd pass to NVME Layer- "
+ "-to- Driver rcv cmd OP (action)\n");
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg2_total,
+ phba->ktime_data_samples),
+ phba->ktime_seg2_min,
+ phba->ktime_seg2_max);
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Segment 3: Driver rcv cmd OP -to- "
+ "Firmware WQ doorbell: cmd\n");
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg3_total,
+ phba->ktime_data_samples),
+ phba->ktime_seg3_min,
+ phba->ktime_seg3_max);
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Segment 4: Firmware WQ doorbell: cmd "
+ "-to- MSI-X ISR for cmd cmpl\n");
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg4_total,
+ phba->ktime_data_samples),
+ phba->ktime_seg4_min,
+ phba->ktime_seg4_max);
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Segment 5: MSI-X ISR for cmd cmpl "
+ "-to- NVME layer passed cmd done\n");
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg5_total,
+ phba->ktime_data_samples),
+@@ -1119,10 +1121,10 @@ lpfc_debugfs_nvmektime_data(struct lpfc_vport *vport, char *buf, int size)
+ phba->ktime_seg5_max);
+
+ if (phba->ktime_status_samples == 0) {
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Total: cmd received by MSI-X ISR "
+ "-to- cmd completed on wire\n");
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "avg:%08lld min:%08lld "
+ "max %08lld\n",
+ div_u64(phba->ktime_seg10_total,
+@@ -1132,46 +1134,46 @@ lpfc_debugfs_nvmektime_data(struct lpfc_vport *vport, char *buf, int size)
+ return len;
+ }
+
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Segment 6: NVME layer passed cmd done "
+ "-to- Driver rcv rsp status OP\n");
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg6_total,
+ phba->ktime_status_samples),
+ phba->ktime_seg6_min,
+ phba->ktime_seg6_max);
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Segment 7: Driver rcv rsp status OP "
+ "-to- Firmware WQ doorbell: status\n");
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg7_total,
+ phba->ktime_status_samples),
+ phba->ktime_seg7_min,
+ phba->ktime_seg7_max);
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Segment 8: Firmware WQ doorbell: status"
+ " -to- MSI-X ISR for status cmpl\n");
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg8_total,
+ phba->ktime_status_samples),
+ phba->ktime_seg8_min,
+ phba->ktime_seg8_max);
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Segment 9: MSI-X ISR for status cmpl "
+ "-to- NVME layer passed status done\n");
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg9_total,
+ phba->ktime_status_samples),
+ phba->ktime_seg9_min,
+ phba->ktime_seg9_max);
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "Total: cmd received by MSI-X ISR -to- "
+ "cmd completed on wire\n");
+- len += snprintf(buf + len, PAGE_SIZE-len,
++ len += scnprintf(buf + len, PAGE_SIZE-len,
+ "avg:%08lld min:%08lld max %08lld\n",
+ div_u64(phba->ktime_seg10_total,
+ phba->ktime_status_samples),
+@@ -1206,7 +1208,7 @@ lpfc_debugfs_nvmeio_trc_data(struct lpfc_hba *phba, char *buf, int size)
+ (phba->nvmeio_trc_size - 1);
+ skip = phba->nvmeio_trc_output_idx;
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "%s IO Trace %s: next_idx %d skip %d size %d\n",
+ (phba->nvmet_support ? "NVME" : "NVMET"),
+ (state ? "Enabled" : "Disabled"),
+@@ -1228,18 +1230,18 @@ lpfc_debugfs_nvmeio_trc_data(struct lpfc_hba *phba, char *buf, int size)
+ if (!dtp->fmt)
+ continue;
+
+- len += snprintf(buf + len, size - len, dtp->fmt,
++ len += scnprintf(buf + len, size - len, dtp->fmt,
+ dtp->data1, dtp->data2, dtp->data3);
+
+ if (phba->nvmeio_trc_output_idx >= phba->nvmeio_trc_size) {
+ phba->nvmeio_trc_output_idx = 0;
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "Trace Complete\n");
+ goto out;
+ }
+
+ if (len >= (size - LPFC_DEBUG_OUT_LINE_SZ)) {
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "Trace Continue (%d of %d)\n",
+ phba->nvmeio_trc_output_idx,
+ phba->nvmeio_trc_size);
+@@ -1257,18 +1259,18 @@ lpfc_debugfs_nvmeio_trc_data(struct lpfc_hba *phba, char *buf, int size)
+ if (!dtp->fmt)
+ continue;
+
+- len += snprintf(buf + len, size - len, dtp->fmt,
++ len += scnprintf(buf + len, size - len, dtp->fmt,
+ dtp->data1, dtp->data2, dtp->data3);
+
+ if (phba->nvmeio_trc_output_idx >= phba->nvmeio_trc_size) {
+ phba->nvmeio_trc_output_idx = 0;
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "Trace Complete\n");
+ goto out;
+ }
+
+ if (len >= (size - LPFC_DEBUG_OUT_LINE_SZ)) {
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "Trace Continue (%d of %d)\n",
+ phba->nvmeio_trc_output_idx,
+ phba->nvmeio_trc_size);
+@@ -1276,7 +1278,7 @@ lpfc_debugfs_nvmeio_trc_data(struct lpfc_hba *phba, char *buf, int size)
+ }
+ }
+
+- len += snprintf(buf + len, size - len,
++ len += scnprintf(buf + len, size - len,
+ "Trace Done\n");
+ out:
+ return len;
+@@ -1308,39 +1310,39 @@ lpfc_debugfs_cpucheck_data(struct lpfc_vport *vport, char *buf, int size)
+
+ if (phba->nvmet_support == 0) {
+ /* NVME Initiator */
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "CPUcheck %s\n",
+ (phba->cpucheck_on & LPFC_CHECK_NVME_IO ?
+ "Enabled" : "Disabled"));
+ for (i = 0; i < phba->sli4_hba.num_present_cpu; i++) {
+ if (i >= LPFC_CHECK_CPU_CNT)
+ break;
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "%02d: xmit x%08x cmpl x%08x\n",
+ i, phba->cpucheck_xmt_io[i],
+ phba->cpucheck_cmpl_io[i]);
+ tot_xmt += phba->cpucheck_xmt_io[i];
+ tot_cmpl += phba->cpucheck_cmpl_io[i];
+ }
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "tot:xmit x%08x cmpl x%08x\n",
+ tot_xmt, tot_cmpl);
+ return len;
+ }
+
+ /* NVME Target */
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "CPUcheck %s ",
+ (phba->cpucheck_on & LPFC_CHECK_NVMET_IO ?
+ "IO Enabled - " : "IO Disabled - "));
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "%s\n",
+ (phba->cpucheck_on & LPFC_CHECK_NVMET_RCV ?
+ "Rcv Enabled\n" : "Rcv Disabled\n"));
+ for (i = 0; i < phba->sli4_hba.num_present_cpu; i++) {
+ if (i >= LPFC_CHECK_CPU_CNT)
+ break;
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "%02d: xmit x%08x ccmpl x%08x "
+ "cmpl x%08x rcv x%08x\n",
+ i, phba->cpucheck_xmt_io[i],
+@@ -1352,7 +1354,7 @@ lpfc_debugfs_cpucheck_data(struct lpfc_vport *vport, char *buf, int size)
+ tot_cmpl += phba->cpucheck_cmpl_io[i];
+ tot_ccmpl += phba->cpucheck_ccmpl_io[i];
+ }
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "tot:xmit x%08x ccmpl x%08x cmpl x%08x rcv x%08x\n",
+ tot_xmt, tot_ccmpl, tot_cmpl, tot_rcv);
+ return len;
+@@ -1797,28 +1799,29 @@ lpfc_debugfs_dif_err_read(struct file *file, char __user *buf,
+ int cnt = 0;
+
+ if (dent == phba->debug_writeGuard)
+- cnt = snprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wgrd_cnt);
++ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wgrd_cnt);
+ else if (dent == phba->debug_writeApp)
+- cnt = snprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wapp_cnt);
++ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wapp_cnt);
+ else if (dent == phba->debug_writeRef)
+- cnt = snprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wref_cnt);
++ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wref_cnt);
+ else if (dent == phba->debug_readGuard)
+- cnt = snprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rgrd_cnt);
++ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rgrd_cnt);
+ else if (dent == phba->debug_readApp)
+- cnt = snprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rapp_cnt);
++ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rapp_cnt);
+ else if (dent == phba->debug_readRef)
+- cnt = snprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rref_cnt);
++ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rref_cnt);
+ else if (dent == phba->debug_InjErrNPortID)
+- cnt = snprintf(cbuf, 32, "0x%06x\n", phba->lpfc_injerr_nportid);
++ cnt = scnprintf(cbuf, 32, "0x%06x\n",
++ phba->lpfc_injerr_nportid);
+ else if (dent == phba->debug_InjErrWWPN) {
+ memcpy(&tmp, &phba->lpfc_injerr_wwpn, sizeof(struct lpfc_name));
+ tmp = cpu_to_be64(tmp);
+- cnt = snprintf(cbuf, 32, "0x%016llx\n", tmp);
++ cnt = scnprintf(cbuf, 32, "0x%016llx\n", tmp);
+ } else if (dent == phba->debug_InjErrLBA) {
+ if (phba->lpfc_injerr_lba == (sector_t)(-1))
+- cnt = snprintf(cbuf, 32, "off\n");
++ cnt = scnprintf(cbuf, 32, "off\n");
+ else
+- cnt = snprintf(cbuf, 32, "0x%llx\n",
++ cnt = scnprintf(cbuf, 32, "0x%llx\n",
+ (uint64_t) phba->lpfc_injerr_lba);
+ } else
+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+@@ -2624,17 +2627,17 @@ lpfc_idiag_pcicfg_read(struct file *file, char __user *buf, size_t nbytes,
+ switch (count) {
+ case SIZE_U8: /* byte (8 bits) */
+ pci_read_config_byte(pdev, where, &u8val);
+- len += snprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
+ "%03x: %02x\n", where, u8val);
+ break;
+ case SIZE_U16: /* word (16 bits) */
+ pci_read_config_word(pdev, where, &u16val);
+- len += snprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
+ "%03x: %04x\n", where, u16val);
+ break;
+ case SIZE_U32: /* double word (32 bits) */
+ pci_read_config_dword(pdev, where, &u32val);
+- len += snprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
+ "%03x: %08x\n", where, u32val);
+ break;
+ case LPFC_PCI_CFG_BROWSE: /* browse all */
+@@ -2654,25 +2657,25 @@ pcicfg_browse:
+ offset = offset_label;
+
+ /* Read PCI config space */
+- len += snprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
+ "%03x: ", offset_label);
+ while (index > 0) {
+ pci_read_config_dword(pdev, offset, &u32val);
+- len += snprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
+ "%08x ", u32val);
+ offset += sizeof(uint32_t);
+ if (offset >= LPFC_PCI_CFG_SIZE) {
+- len += snprintf(pbuffer+len,
++ len += scnprintf(pbuffer+len,
+ LPFC_PCI_CFG_SIZE-len, "\n");
+ break;
+ }
+ index -= sizeof(uint32_t);
+ if (!index)
+- len += snprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
+ "\n");
+ else if (!(index % (8 * sizeof(uint32_t)))) {
+ offset_label += (8 * sizeof(uint32_t));
+- len += snprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_PCI_CFG_SIZE-len,
+ "\n%03x: ", offset_label);
+ }
+ }
+@@ -2943,7 +2946,7 @@ lpfc_idiag_baracc_read(struct file *file, char __user *buf, size_t nbytes,
+ if (acc_range == SINGLE_WORD) {
+ offset_run = offset;
+ u32val = readl(mem_mapped_bar + offset_run);
+- len += snprintf(pbuffer+len, LPFC_PCI_BAR_RD_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_PCI_BAR_RD_BUF_SIZE-len,
+ "%05x: %08x\n", offset_run, u32val);
+ } else
+ goto baracc_browse;
+@@ -2957,35 +2960,35 @@ baracc_browse:
+ offset_run = offset_label;
+
+ /* Read PCI bar memory mapped space */
+- len += snprintf(pbuffer+len, LPFC_PCI_BAR_RD_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_PCI_BAR_RD_BUF_SIZE-len,
+ "%05x: ", offset_label);
+ index = LPFC_PCI_BAR_RD_SIZE;
+ while (index > 0) {
+ u32val = readl(mem_mapped_bar + offset_run);
+- len += snprintf(pbuffer+len, LPFC_PCI_BAR_RD_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_PCI_BAR_RD_BUF_SIZE-len,
+ "%08x ", u32val);
+ offset_run += sizeof(uint32_t);
+ if (acc_range == LPFC_PCI_BAR_BROWSE) {
+ if (offset_run >= bar_size) {
+- len += snprintf(pbuffer+len,
++ len += scnprintf(pbuffer+len,
+ LPFC_PCI_BAR_RD_BUF_SIZE-len, "\n");
+ break;
+ }
+ } else {
+ if (offset_run >= offset +
+ (acc_range * sizeof(uint32_t))) {
+- len += snprintf(pbuffer+len,
++ len += scnprintf(pbuffer+len,
+ LPFC_PCI_BAR_RD_BUF_SIZE-len, "\n");
+ break;
+ }
+ }
+ index -= sizeof(uint32_t);
+ if (!index)
+- len += snprintf(pbuffer+len,
++ len += scnprintf(pbuffer+len,
+ LPFC_PCI_BAR_RD_BUF_SIZE-len, "\n");
+ else if (!(index % (8 * sizeof(uint32_t)))) {
+ offset_label += (8 * sizeof(uint32_t));
+- len += snprintf(pbuffer+len,
++ len += scnprintf(pbuffer+len,
+ LPFC_PCI_BAR_RD_BUF_SIZE-len,
+ "\n%05x: ", offset_label);
+ }
+@@ -3158,19 +3161,19 @@ __lpfc_idiag_print_wq(struct lpfc_queue *qp, char *wqtype,
+ if (!qp)
+ return len;
+
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "\t\t%s WQ info: ", wqtype);
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "AssocCQID[%04d]: WQ-STAT[oflow:x%x posted:x%llx]\n",
+ qp->assoc_qid, qp->q_cnt_1,
+ (unsigned long long)qp->q_cnt_4);
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "\t\tWQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+ "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
+ qp->queue_id, qp->entry_count,
+ qp->entry_size, qp->host_index,
+ qp->hba_index, qp->entry_repost);
+- len += snprintf(pbuffer + len,
++ len += scnprintf(pbuffer + len,
+ LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
+ return len;
+ }
+@@ -3208,21 +3211,21 @@ __lpfc_idiag_print_cq(struct lpfc_queue *qp, char *cqtype,
+ if (!qp)
+ return len;
+
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "\t%s CQ info: ", cqtype);
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "AssocEQID[%02d]: CQ STAT[max:x%x relw:x%x "
+ "xabt:x%x wq:x%llx]\n",
+ qp->assoc_qid, qp->q_cnt_1, qp->q_cnt_2,
+ qp->q_cnt_3, (unsigned long long)qp->q_cnt_4);
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "\tCQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+ "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
+ qp->queue_id, qp->entry_count,
+ qp->entry_size, qp->host_index,
+ qp->hba_index, qp->entry_repost);
+
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
+
+ return len;
+ }
+@@ -3234,19 +3237,19 @@ __lpfc_idiag_print_rqpair(struct lpfc_queue *qp, struct lpfc_queue *datqp,
+ if (!qp || !datqp)
+ return len;
+
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "\t\t%s RQ info: ", rqtype);
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "AssocCQID[%02d]: RQ-STAT[nopost:x%x nobuf:x%x "
+ "posted:x%x rcv:x%llx]\n",
+ qp->assoc_qid, qp->q_cnt_1, qp->q_cnt_2,
+ qp->q_cnt_3, (unsigned long long)qp->q_cnt_4);
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "\t\tHQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+ "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]\n",
+ qp->queue_id, qp->entry_count, qp->entry_size,
+ qp->host_index, qp->hba_index, qp->entry_repost);
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "\t\tDQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+ "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]\n",
+ datqp->queue_id, datqp->entry_count,
+@@ -3331,17 +3334,17 @@ __lpfc_idiag_print_eq(struct lpfc_queue *qp, char *eqtype,
+ if (!qp)
+ return len;
+
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "\n%s EQ info: EQ-STAT[max:x%x noE:x%x "
+ "cqe_proc:x%x eqe_proc:x%llx eqd %d]\n",
+ eqtype, qp->q_cnt_1, qp->q_cnt_2, qp->q_cnt_3,
+ (unsigned long long)qp->q_cnt_4, qp->q_mode);
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "EQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+ "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
+ qp->queue_id, qp->entry_count, qp->entry_size,
+ qp->host_index, qp->hba_index, qp->entry_repost);
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
+
+ return len;
+ }
+@@ -3399,7 +3402,7 @@ lpfc_idiag_queinfo_read(struct file *file, char __user *buf, size_t nbytes,
+ if (phba->cfg_fof == 0)
+ phba->lpfc_idiag_last_eq = 0;
+
+- len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
+ "EQ %d out of %d HBA EQs\n",
+ x, phba->io_channel_irqs);
+
+@@ -3512,7 +3515,7 @@ fof:
+ return simple_read_from_buffer(buf, nbytes, ppos, pbuffer, len);
+
+ too_big:
+- len += snprintf(pbuffer + len,
++ len += scnprintf(pbuffer + len,
+ LPFC_QUE_INFO_GET_BUF_SIZE - len, "Truncated ...\n");
+ out:
+ spin_unlock_irq(&phba->hbalock);
+@@ -3568,22 +3571,22 @@ lpfc_idiag_queacc_read_qe(char *pbuffer, int len, struct lpfc_queue *pque,
+ return 0;
+
+ esize = pque->entry_size;
+- len += snprintf(pbuffer+len, LPFC_QUE_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_QUE_ACC_BUF_SIZE-len,
+ "QE-INDEX[%04d]:\n", index);
+
+ offset = 0;
+ pentry = pque->qe[index].address;
+ while (esize > 0) {
+- len += snprintf(pbuffer+len, LPFC_QUE_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_QUE_ACC_BUF_SIZE-len,
+ "%08x ", *pentry);
+ pentry++;
+ offset += sizeof(uint32_t);
+ esize -= sizeof(uint32_t);
+ if (esize > 0 && !(offset % (4 * sizeof(uint32_t))))
+- len += snprintf(pbuffer+len,
++ len += scnprintf(pbuffer+len,
+ LPFC_QUE_ACC_BUF_SIZE-len, "\n");
+ }
+- len += snprintf(pbuffer+len, LPFC_QUE_ACC_BUF_SIZE-len, "\n");
++ len += scnprintf(pbuffer+len, LPFC_QUE_ACC_BUF_SIZE-len, "\n");
+
+ return len;
+ }
+@@ -3989,27 +3992,27 @@ lpfc_idiag_drbacc_read_reg(struct lpfc_hba *phba, char *pbuffer,
+
+ switch (drbregid) {
+ case LPFC_DRB_EQ:
+- len += snprintf(pbuffer + len, LPFC_DRB_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer + len, LPFC_DRB_ACC_BUF_SIZE-len,
+ "EQ-DRB-REG: 0x%08x\n",
+ readl(phba->sli4_hba.EQDBregaddr));
+ break;
+ case LPFC_DRB_CQ:
+- len += snprintf(pbuffer + len, LPFC_DRB_ACC_BUF_SIZE - len,
++ len += scnprintf(pbuffer + len, LPFC_DRB_ACC_BUF_SIZE - len,
+ "CQ-DRB-REG: 0x%08x\n",
+ readl(phba->sli4_hba.CQDBregaddr));
+ break;
+ case LPFC_DRB_MQ:
+- len += snprintf(pbuffer+len, LPFC_DRB_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_DRB_ACC_BUF_SIZE-len,
+ "MQ-DRB-REG: 0x%08x\n",
+ readl(phba->sli4_hba.MQDBregaddr));
+ break;
+ case LPFC_DRB_WQ:
+- len += snprintf(pbuffer+len, LPFC_DRB_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_DRB_ACC_BUF_SIZE-len,
+ "WQ-DRB-REG: 0x%08x\n",
+ readl(phba->sli4_hba.WQDBregaddr));
+ break;
+ case LPFC_DRB_RQ:
+- len += snprintf(pbuffer+len, LPFC_DRB_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_DRB_ACC_BUF_SIZE-len,
+ "RQ-DRB-REG: 0x%08x\n",
+ readl(phba->sli4_hba.RQDBregaddr));
+ break;
+@@ -4199,37 +4202,37 @@ lpfc_idiag_ctlacc_read_reg(struct lpfc_hba *phba, char *pbuffer,
+
+ switch (ctlregid) {
+ case LPFC_CTL_PORT_SEM:
+- len += snprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
+ "Port SemReg: 0x%08x\n",
+ readl(phba->sli4_hba.conf_regs_memmap_p +
+ LPFC_CTL_PORT_SEM_OFFSET));
+ break;
+ case LPFC_CTL_PORT_STA:
+- len += snprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
+ "Port StaReg: 0x%08x\n",
+ readl(phba->sli4_hba.conf_regs_memmap_p +
+ LPFC_CTL_PORT_STA_OFFSET));
+ break;
+ case LPFC_CTL_PORT_CTL:
+- len += snprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
+ "Port CtlReg: 0x%08x\n",
+ readl(phba->sli4_hba.conf_regs_memmap_p +
+ LPFC_CTL_PORT_CTL_OFFSET));
+ break;
+ case LPFC_CTL_PORT_ER1:
+- len += snprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
+ "Port Er1Reg: 0x%08x\n",
+ readl(phba->sli4_hba.conf_regs_memmap_p +
+ LPFC_CTL_PORT_ER1_OFFSET));
+ break;
+ case LPFC_CTL_PORT_ER2:
+- len += snprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
+ "Port Er2Reg: 0x%08x\n",
+ readl(phba->sli4_hba.conf_regs_memmap_p +
+ LPFC_CTL_PORT_ER2_OFFSET));
+ break;
+ case LPFC_CTL_PDEV_CTL:
+- len += snprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_CTL_ACC_BUF_SIZE-len,
+ "PDev CtlReg: 0x%08x\n",
+ readl(phba->sli4_hba.conf_regs_memmap_p +
+ LPFC_CTL_PDEV_CTL_OFFSET));
+@@ -4422,13 +4425,13 @@ lpfc_idiag_mbxacc_get_setup(struct lpfc_hba *phba, char *pbuffer)
+ mbx_dump_cnt = idiag.cmd.data[IDIAG_MBXACC_DPCNT_INDX];
+ mbx_word_cnt = idiag.cmd.data[IDIAG_MBXACC_WDCNT_INDX];
+
+- len += snprintf(pbuffer+len, LPFC_MBX_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_MBX_ACC_BUF_SIZE-len,
+ "mbx_dump_map: 0x%08x\n", mbx_dump_map);
+- len += snprintf(pbuffer+len, LPFC_MBX_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_MBX_ACC_BUF_SIZE-len,
+ "mbx_dump_cnt: %04d\n", mbx_dump_cnt);
+- len += snprintf(pbuffer+len, LPFC_MBX_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_MBX_ACC_BUF_SIZE-len,
+ "mbx_word_cnt: %04d\n", mbx_word_cnt);
+- len += snprintf(pbuffer+len, LPFC_MBX_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_MBX_ACC_BUF_SIZE-len,
+ "mbx_mbox_cmd: 0x%02x\n", mbx_mbox_cmd);
+
+ return len;
+@@ -4577,35 +4580,35 @@ lpfc_idiag_extacc_avail_get(struct lpfc_hba *phba, char *pbuffer, int len)
+ {
+ uint16_t ext_cnt, ext_size;
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\nAvailable Extents Information:\n");
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tPort Available VPI extents: ");
+ lpfc_sli4_get_avail_extnt_rsrc(phba, LPFC_RSC_TYPE_FCOE_VPI,
+ &ext_cnt, &ext_size);
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "Count %3d, Size %3d\n", ext_cnt, ext_size);
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tPort Available VFI extents: ");
+ lpfc_sli4_get_avail_extnt_rsrc(phba, LPFC_RSC_TYPE_FCOE_VFI,
+ &ext_cnt, &ext_size);
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "Count %3d, Size %3d\n", ext_cnt, ext_size);
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tPort Available RPI extents: ");
+ lpfc_sli4_get_avail_extnt_rsrc(phba, LPFC_RSC_TYPE_FCOE_RPI,
+ &ext_cnt, &ext_size);
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "Count %3d, Size %3d\n", ext_cnt, ext_size);
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tPort Available XRI extents: ");
+ lpfc_sli4_get_avail_extnt_rsrc(phba, LPFC_RSC_TYPE_FCOE_XRI,
+ &ext_cnt, &ext_size);
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "Count %3d, Size %3d\n", ext_cnt, ext_size);
+
+ return len;
+@@ -4629,55 +4632,55 @@ lpfc_idiag_extacc_alloc_get(struct lpfc_hba *phba, char *pbuffer, int len)
+ uint16_t ext_cnt, ext_size;
+ int rc;
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\nAllocated Extents Information:\n");
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tHost Allocated VPI extents: ");
+ rc = lpfc_sli4_get_allocated_extnts(phba, LPFC_RSC_TYPE_FCOE_VPI,
+ &ext_cnt, &ext_size);
+ if (!rc)
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "Port %d Extent %3d, Size %3d\n",
+ phba->brd_no, ext_cnt, ext_size);
+ else
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "N/A\n");
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tHost Allocated VFI extents: ");
+ rc = lpfc_sli4_get_allocated_extnts(phba, LPFC_RSC_TYPE_FCOE_VFI,
+ &ext_cnt, &ext_size);
+ if (!rc)
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "Port %d Extent %3d, Size %3d\n",
+ phba->brd_no, ext_cnt, ext_size);
+ else
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "N/A\n");
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tHost Allocated RPI extents: ");
+ rc = lpfc_sli4_get_allocated_extnts(phba, LPFC_RSC_TYPE_FCOE_RPI,
+ &ext_cnt, &ext_size);
+ if (!rc)
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "Port %d Extent %3d, Size %3d\n",
+ phba->brd_no, ext_cnt, ext_size);
+ else
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "N/A\n");
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tHost Allocated XRI extents: ");
+ rc = lpfc_sli4_get_allocated_extnts(phba, LPFC_RSC_TYPE_FCOE_XRI,
+ &ext_cnt, &ext_size);
+ if (!rc)
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "Port %d Extent %3d, Size %3d\n",
+ phba->brd_no, ext_cnt, ext_size);
+ else
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "N/A\n");
+
+ return len;
+@@ -4701,49 +4704,49 @@ lpfc_idiag_extacc_drivr_get(struct lpfc_hba *phba, char *pbuffer, int len)
+ struct lpfc_rsrc_blks *rsrc_blks;
+ int index;
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\nDriver Extents Information:\n");
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tVPI extents:\n");
+ index = 0;
+ list_for_each_entry(rsrc_blks, &phba->lpfc_vpi_blk_list, list) {
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\t\tBlock %3d: Start %4d, Count %4d\n",
+ index, rsrc_blks->rsrc_start,
+ rsrc_blks->rsrc_size);
+ index++;
+ }
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tVFI extents:\n");
+ index = 0;
+ list_for_each_entry(rsrc_blks, &phba->sli4_hba.lpfc_vfi_blk_list,
+ list) {
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\t\tBlock %3d: Start %4d, Count %4d\n",
+ index, rsrc_blks->rsrc_start,
+ rsrc_blks->rsrc_size);
+ index++;
+ }
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tRPI extents:\n");
+ index = 0;
+ list_for_each_entry(rsrc_blks, &phba->sli4_hba.lpfc_rpi_blk_list,
+ list) {
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\t\tBlock %3d: Start %4d, Count %4d\n",
+ index, rsrc_blks->rsrc_start,
+ rsrc_blks->rsrc_size);
+ index++;
+ }
+
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\tXRI extents:\n");
+ index = 0;
+ list_for_each_entry(rsrc_blks, &phba->sli4_hba.lpfc_xri_blk_list,
+ list) {
+- len += snprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
++ len += scnprintf(pbuffer+len, LPFC_EXT_ACC_BUF_SIZE-len,
+ "\t\tBlock %3d: Start %4d, Count %4d\n",
+ index, rsrc_blks->rsrc_start,
+ rsrc_blks->rsrc_size);
+@@ -5137,11 +5140,11 @@ lpfc_idiag_mbxacc_dump_bsg_mbox(struct lpfc_hba *phba, enum nemb_type nemb_tp,
+ if (i != 0)
+ pr_err("%s\n", line_buf);
+ len = 0;
+- len += snprintf(line_buf+len,
++ len += scnprintf(line_buf+len,
+ LPFC_MBX_ACC_LBUF_SZ-len,
+ "%03d: ", i);
+ }
+- len += snprintf(line_buf+len, LPFC_MBX_ACC_LBUF_SZ-len,
++ len += scnprintf(line_buf+len, LPFC_MBX_ACC_LBUF_SZ-len,
+ "%08x ", (uint32_t)*pword);
+ pword++;
+ }
+@@ -5204,11 +5207,11 @@ lpfc_idiag_mbxacc_dump_issue_mbox(struct lpfc_hba *phba, MAILBOX_t *pmbox)
+ pr_err("%s\n", line_buf);
+ len = 0;
+ memset(line_buf, 0, LPFC_MBX_ACC_LBUF_SZ);
+- len += snprintf(line_buf+len,
++ len += scnprintf(line_buf+len,
+ LPFC_MBX_ACC_LBUF_SZ-len,
+ "%03d: ", i);
+ }
+- len += snprintf(line_buf+len, LPFC_MBX_ACC_LBUF_SZ-len,
++ len += scnprintf(line_buf+len, LPFC_MBX_ACC_LBUF_SZ-len,
+ "%08x ",
+ ((uint32_t)*pword) & 0xffffffff);
+ pword++;
+@@ -5227,18 +5230,18 @@ lpfc_idiag_mbxacc_dump_issue_mbox(struct lpfc_hba *phba, MAILBOX_t *pmbox)
+ pr_err("%s\n", line_buf);
+ len = 0;
+ memset(line_buf, 0, LPFC_MBX_ACC_LBUF_SZ);
+- len += snprintf(line_buf+len,
++ len += scnprintf(line_buf+len,
+ LPFC_MBX_ACC_LBUF_SZ-len,
+ "%03d: ", i);
+ }
+ for (j = 0; j < 4; j++) {
+- len += snprintf(line_buf+len,
++ len += scnprintf(line_buf+len,
+ LPFC_MBX_ACC_LBUF_SZ-len,
+ "%02x",
+ ((uint8_t)*pbyte) & 0xff);
+ pbyte++;
+ }
+- len += snprintf(line_buf+len,
++ len += scnprintf(line_buf+len,
+ LPFC_MBX_ACC_LBUF_SZ-len, " ");
+ }
+ if ((i - 1) % 8)
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
+index 30efc7bf91bd..824de3e410ca 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.h
++++ b/drivers/scsi/lpfc/lpfc_debugfs.h
+@@ -342,7 +342,7 @@ lpfc_debug_dump_qe(struct lpfc_queue *q, uint32_t idx)
+ pword = q->qe[idx].address;
+
+ len = 0;
+- len += snprintf(line_buf+len, LPFC_LBUF_SZ-len, "QE[%04d]: ", idx);
++ len += scnprintf(line_buf+len, LPFC_LBUF_SZ-len, "QE[%04d]: ", idx);
+ if (qe_word_cnt > 8)
+ printk(KERN_ERR "%s\n", line_buf);
+
+@@ -353,11 +353,11 @@ lpfc_debug_dump_qe(struct lpfc_queue *q, uint32_t idx)
+ if (qe_word_cnt > 8) {
+ len = 0;
+ memset(line_buf, 0, LPFC_LBUF_SZ);
+- len += snprintf(line_buf+len, LPFC_LBUF_SZ-len,
++ len += scnprintf(line_buf+len, LPFC_LBUF_SZ-len,
+ "%03d: ", i);
+ }
+ }
+- len += snprintf(line_buf+len, LPFC_LBUF_SZ-len, "%08x ",
++ len += scnprintf(line_buf+len, LPFC_LBUF_SZ-len, "%08x ",
+ ((uint32_t)*pword) & 0xffffffff);
+ pword++;
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index 4888b999e82f..f8f4d3ea67f3 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -345,7 +345,7 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj,
+ }
+
+ ha->optrom_region_start = start;
+- ha->optrom_region_size = start + size;
++ ha->optrom_region_size = size;
+
+ ha->optrom_state = QLA_SREADING;
+ ha->optrom_buffer = vmalloc(ha->optrom_region_size);
+@@ -418,7 +418,7 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj,
+ }
+
+ ha->optrom_region_start = start;
+- ha->optrom_region_size = start + size;
++ ha->optrom_region_size = size;
+
+ ha->optrom_state = QLA_SWRITING;
+ ha->optrom_buffer = vmalloc(ha->optrom_region_size);
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index d2888b30a8a3..a8c67cd17625 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -981,6 +981,8 @@ void qlt_free_session_done(struct work_struct *work)
+ sess->send_els_logo);
+
+ if (!IS_SW_RESV_ADDR(sess->d_id)) {
++ qla2x00_mark_device_lost(vha, sess, 0, 0);
++
+ if (sess->send_els_logo) {
+ qlt_port_logo_t logo;
+
+@@ -1161,8 +1163,6 @@ void qlt_unreg_sess(struct fc_port *sess)
+ if (sess->se_sess)
+ vha->hw->tgt.tgt_ops->clear_nacl_from_fcport_map(sess);
+
+- qla2x00_mark_device_lost(vha, sess, 0, 0);
+-
+ sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
+ sess->disc_state = DSC_DELETE_PEND;
+ sess->last_rscn_gen = sess->rscn_gen;
+diff --git a/drivers/soc/sunxi/Kconfig b/drivers/soc/sunxi/Kconfig
+index 353b07e40176..e84eb4e59f58 100644
+--- a/drivers/soc/sunxi/Kconfig
++++ b/drivers/soc/sunxi/Kconfig
+@@ -4,6 +4,7 @@
+ config SUNXI_SRAM
+ bool
+ default ARCH_SUNXI
++ select REGMAP_MMIO
+ help
+ Say y here to enable the SRAM controller support. This
+ device is responsible on mapping the SRAM in the sunXi SoCs
+diff --git a/drivers/staging/greybus/power_supply.c b/drivers/staging/greybus/power_supply.c
+index 0529e5628c24..ae5c0285a942 100644
+--- a/drivers/staging/greybus/power_supply.c
++++ b/drivers/staging/greybus/power_supply.c
+@@ -520,7 +520,7 @@ static int gb_power_supply_prop_descriptors_get(struct gb_power_supply *gbpsy)
+
+ op = gb_operation_create(connection,
+ GB_POWER_SUPPLY_TYPE_GET_PROP_DESCRIPTORS,
+- sizeof(req), sizeof(*resp) + props_count *
++ sizeof(*req), sizeof(*resp) + props_count *
+ sizeof(struct gb_power_supply_props_desc),
+ GFP_KERNEL);
+ if (!op)
+diff --git a/drivers/staging/most/cdev/cdev.c b/drivers/staging/most/cdev/cdev.c
+index 4569838f27a0..0b48677fa958 100644
+--- a/drivers/staging/most/cdev/cdev.c
++++ b/drivers/staging/most/cdev/cdev.c
+@@ -546,7 +546,7 @@ static void __exit mod_exit(void)
+ destroy_cdev(c);
+ destroy_channel(c);
+ }
+- unregister_chrdev_region(comp.devno, 1);
++ unregister_chrdev_region(comp.devno, CHRDEV_REGION_SIZE);
+ ida_destroy(&comp.minor_id);
+ class_destroy(comp.class);
+ }
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 32da5a4182ac..5b442bc68a76 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -470,12 +470,12 @@ static void acm_read_bulk_callback(struct urb *urb)
+ struct acm *acm = rb->instance;
+ unsigned long flags;
+ int status = urb->status;
++ bool stopped = false;
++ bool stalled = false;
+
+ dev_vdbg(&acm->data->dev, "got urb %d, len %d, status %d\n",
+ rb->index, urb->actual_length, status);
+
+- set_bit(rb->index, &acm->read_urbs_free);
+-
+ if (!acm->dev) {
+ dev_dbg(&acm->data->dev, "%s - disconnected\n", __func__);
+ return;
+@@ -488,15 +488,16 @@ static void acm_read_bulk_callback(struct urb *urb)
+ break;
+ case -EPIPE:
+ set_bit(EVENT_RX_STALL, &acm->flags);
+- schedule_work(&acm->work);
+- return;
++ stalled = true;
++ break;
+ case -ENOENT:
+ case -ECONNRESET:
+ case -ESHUTDOWN:
+ dev_dbg(&acm->data->dev,
+ "%s - urb shutting down with status: %d\n",
+ __func__, status);
+- return;
++ stopped = true;
++ break;
+ default:
+ dev_dbg(&acm->data->dev,
+ "%s - nonzero urb status received: %d\n",
+@@ -505,10 +506,24 @@ static void acm_read_bulk_callback(struct urb *urb)
+ }
+
+ /*
+- * Unthrottle may run on another CPU which needs to see events
+- * in the same order. Submission has an implict barrier
++ * Make sure URB processing is done before marking as free to avoid
++ * racing with unthrottle() on another CPU. Matches the barriers
++ * implied by the test_and_clear_bit() in acm_submit_read_urb().
+ */
+ smp_mb__before_atomic();
++ set_bit(rb->index, &acm->read_urbs_free);
++ /*
++ * Make sure URB is marked as free before checking the throttled flag
++ * to avoid racing with unthrottle() on another CPU. Matches the
++ * smp_mb() in unthrottle().
++ */
++ smp_mb__after_atomic();
++
++ if (stopped || stalled) {
++ if (stalled)
++ schedule_work(&acm->work);
++ return;
++ }
+
+ /* throttle device if requested by tty */
+ spin_lock_irqsave(&acm->read_lock, flags);
+@@ -842,6 +857,9 @@ static void acm_tty_unthrottle(struct tty_struct *tty)
+ acm->throttle_req = 0;
+ spin_unlock_irq(&acm->read_lock);
+
++ /* Matches the smp_mb__after_atomic() in acm_read_bulk_callback(). */
++ smp_mb();
++
+ if (was_throttled)
+ acm_submit_read_urbs(acm, GFP_KERNEL);
+ }
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index fec97465ccac..4d5c7dda8f54 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1214,7 +1214,7 @@ static void dwc3_get_properties(struct dwc3 *dwc)
+ u8 tx_max_burst_prd;
+
+ /* default to highest possible threshold */
+- lpm_nyet_threshold = 0xff;
++ lpm_nyet_threshold = 0xf;
+
+ /* default to -3.5dB de-emphasis */
+ tx_de_emphasis = 1;
+diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
+index ad08895e78f9..c3dae7d5cb6e 100644
+--- a/drivers/usb/musb/Kconfig
++++ b/drivers/usb/musb/Kconfig
+@@ -66,7 +66,7 @@ config USB_MUSB_SUNXI
+ depends on NOP_USB_XCEIV
+ depends on PHY_SUN4I_USB
+ depends on EXTCON
+- depends on GENERIC_PHY
++ select GENERIC_PHY
+ select SUNXI_SRAM
+
+ config USB_MUSB_DAVINCI
+diff --git a/drivers/usb/serial/f81232.c b/drivers/usb/serial/f81232.c
+index 96036f87b1de..087e5f1656f8 100644
+--- a/drivers/usb/serial/f81232.c
++++ b/drivers/usb/serial/f81232.c
+@@ -556,9 +556,12 @@ static int f81232_open(struct tty_struct *tty, struct usb_serial_port *port)
+
+ static void f81232_close(struct usb_serial_port *port)
+ {
++ struct f81232_private *port_priv = usb_get_serial_port_data(port);
++
+ f81232_port_disable(port);
+ usb_serial_generic_close(port);
+ usb_kill_urb(port->interrupt_in_urb);
++ flush_work(&port_priv->interrupt_work);
+ }
+
+ static void f81232_dtr_rts(struct usb_serial_port *port, int on)
+@@ -652,6 +655,40 @@ static int f81232_port_remove(struct usb_serial_port *port)
+ return 0;
+ }
+
++static int f81232_suspend(struct usb_serial *serial, pm_message_t message)
++{
++ struct usb_serial_port *port = serial->port[0];
++ struct f81232_private *port_priv = usb_get_serial_port_data(port);
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(port->read_urbs); ++i)
++ usb_kill_urb(port->read_urbs[i]);
++
++ usb_kill_urb(port->interrupt_in_urb);
++
++ if (port_priv)
++ flush_work(&port_priv->interrupt_work);
++
++ return 0;
++}
++
++static int f81232_resume(struct usb_serial *serial)
++{
++ struct usb_serial_port *port = serial->port[0];
++ int result;
++
++ if (tty_port_initialized(&port->port)) {
++ result = usb_submit_urb(port->interrupt_in_urb, GFP_NOIO);
++ if (result) {
++ dev_err(&port->dev, "submit interrupt urb failed: %d\n",
++ result);
++ return result;
++ }
++ }
++
++ return usb_serial_generic_resume(serial);
++}
++
+ static struct usb_serial_driver f81232_device = {
+ .driver = {
+ .owner = THIS_MODULE,
+@@ -675,6 +712,8 @@ static struct usb_serial_driver f81232_device = {
+ .read_int_callback = f81232_read_int_callback,
+ .port_probe = f81232_port_probe,
+ .port_remove = f81232_port_remove,
++ .suspend = f81232_suspend,
++ .resume = f81232_resume,
+ };
+
+ static struct usb_serial_driver * const serial_drivers[] = {
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index 101ebac43c87..59d82b45e758 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -65,6 +65,7 @@ static const char* host_info(struct Scsi_Host *host)
+ static int slave_alloc (struct scsi_device *sdev)
+ {
+ struct us_data *us = host_to_us(sdev->host);
++ int maxp;
+
+ /*
+ * Set the INQUIRY transfer length to 36. We don't use any of
+@@ -74,20 +75,17 @@ static int slave_alloc (struct scsi_device *sdev)
+ sdev->inquiry_len = 36;
+
+ /*
+- * USB has unusual DMA-alignment requirements: Although the
+- * starting address of each scatter-gather element doesn't matter,
+- * the length of each element except the last must be divisible
+- * by the Bulk maxpacket value. There's currently no way to
+- * express this by block-layer constraints, so we'll cop out
+- * and simply require addresses to be aligned at 512-byte
+- * boundaries. This is okay since most block I/O involves
+- * hardware sectors that are multiples of 512 bytes in length,
+- * and since host controllers up through USB 2.0 have maxpacket
+- * values no larger than 512.
+- *
+- * But it doesn't suffice for Wireless USB, where Bulk maxpacket
+- * values can be as large as 2048. To make that work properly
+- * will require changes to the block layer.
++ * USB has unusual scatter-gather requirements: the length of each
++ * scatterlist element except the last must be divisible by the
++ * Bulk maxpacket value. Fortunately this value is always a
++ * power of 2. Inform the block layer about this requirement.
++ */
++ maxp = usb_maxpacket(us->pusb_dev, us->recv_bulk_pipe, 0);
++ blk_queue_virt_boundary(sdev->request_queue, maxp - 1);
++
++ /*
++ * Some host controllers may have alignment requirements.
++ * We'll play it safe by requiring 512-byte alignment always.
+ */
+ blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
+
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index 1f7b401c4d04..5b1d09367475 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -796,24 +796,33 @@ static int uas_slave_alloc(struct scsi_device *sdev)
+ {
+ struct uas_dev_info *devinfo =
+ (struct uas_dev_info *)sdev->host->hostdata;
++ int maxp;
+
+ sdev->hostdata = devinfo;
+
+ /*
+- * USB has unusual DMA-alignment requirements: Although the
+- * starting address of each scatter-gather element doesn't matter,
+- * the length of each element except the last must be divisible
+- * by the Bulk maxpacket value. There's currently no way to
+- * express this by block-layer constraints, so we'll cop out
+- * and simply require addresses to be aligned at 512-byte
+- * boundaries. This is okay since most block I/O involves
+- * hardware sectors that are multiples of 512 bytes in length,
+- * and since host controllers up through USB 2.0 have maxpacket
+- * values no larger than 512.
++ * We have two requirements here. We must satisfy the requirements
++ * of the physical HC and the demands of the protocol, as we
++ * definitely want no additional memory allocation in this path
++ * ruling out using bounce buffers.
+ *
+- * But it doesn't suffice for Wireless USB, where Bulk maxpacket
+- * values can be as large as 2048. To make that work properly
+- * will require changes to the block layer.
++ * For a transmission on USB to continue we must never send
++ * a package that is smaller than maxpacket. Hence the length of each
++ * scatterlist element except the last must be divisible by the
++ * Bulk maxpacket value.
++ * If the HC does not ensure that through SG,
++ * the upper layer must do that. We must assume nothing
++ * about the capabilities off the HC, so we use the most
++ * pessimistic requirement.
++ */
++
++ maxp = usb_maxpacket(devinfo->udev, devinfo->data_in_pipe, 0);
++ blk_queue_virt_boundary(sdev->request_queue, maxp - 1);
++
++ /*
++ * The protocol has no requirements on alignment in the strict sense.
++ * Controllers may or may not have alignment restrictions.
++ * As this is not exported, we use an extremely conservative guess.
+ */
+ blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
+
+diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
+index 465a6f5142cc..45b04bc91f24 100644
+--- a/drivers/virtio/virtio_pci_common.c
++++ b/drivers/virtio/virtio_pci_common.c
+@@ -255,9 +255,11 @@ void vp_del_vqs(struct virtio_device *vdev)
+ for (i = 0; i < vp_dev->msix_used_vectors; ++i)
+ free_irq(pci_irq_vector(vp_dev->pci_dev, i), vp_dev);
+
+- for (i = 0; i < vp_dev->msix_vectors; i++)
+- if (vp_dev->msix_affinity_masks[i])
+- free_cpumask_var(vp_dev->msix_affinity_masks[i]);
++ if (vp_dev->msix_affinity_masks) {
++ for (i = 0; i < vp_dev->msix_vectors; i++)
++ if (vp_dev->msix_affinity_masks[i])
++ free_cpumask_var(vp_dev->msix_affinity_masks[i]);
++ }
+
+ if (vp_dev->msix_enabled) {
+ /* Disable the vector used for configuration */
+diff --git a/include/linux/kernel.h b/include/linux/kernel.h
+index d6aac75b51ba..3d83ebb302cf 100644
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -73,8 +73,8 @@
+
+ #define u64_to_user_ptr(x) ( \
+ { \
+- typecheck(u64, x); \
+- (void __user *)(uintptr_t)x; \
++ typecheck(u64, (x)); \
++ (void __user *)(uintptr_t)(x); \
+ } \
+ )
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 1dfb75057580..cc2d0c3b475b 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -182,6 +182,9 @@ struct adv_info {
+
+ #define HCI_MAX_SHORT_NAME_LENGTH 10
+
++/* Min encryption key size to match with SMP */
++#define HCI_MIN_ENC_KEY_SIZE 7
++
+ /* Default LE RPA expiry time, 15 minutes */
+ #define HCI_DEFAULT_RPA_TIMEOUT (15 * 60)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 87bd96399d1c..171b83ebed4a 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -2007,8 +2007,8 @@ event_sched_out(struct perf_event *event,
+ event->pmu->del(event, 0);
+ event->oncpu = -1;
+
+- if (event->pending_disable) {
+- event->pending_disable = 0;
++ if (READ_ONCE(event->pending_disable) >= 0) {
++ WRITE_ONCE(event->pending_disable, -1);
+ state = PERF_EVENT_STATE_OFF;
+ }
+ perf_event_set_state(event, state);
+@@ -2196,7 +2196,8 @@ EXPORT_SYMBOL_GPL(perf_event_disable);
+
+ void perf_event_disable_inatomic(struct perf_event *event)
+ {
+- event->pending_disable = 1;
++ WRITE_ONCE(event->pending_disable, smp_processor_id());
++ /* can fail, see perf_pending_event_disable() */
+ irq_work_queue(&event->pending);
+ }
+
+@@ -5803,10 +5804,45 @@ void perf_event_wakeup(struct perf_event *event)
+ }
+ }
+
++static void perf_pending_event_disable(struct perf_event *event)
++{
++ int cpu = READ_ONCE(event->pending_disable);
++
++ if (cpu < 0)
++ return;
++
++ if (cpu == smp_processor_id()) {
++ WRITE_ONCE(event->pending_disable, -1);
++ perf_event_disable_local(event);
++ return;
++ }
++
++ /*
++ * CPU-A CPU-B
++ *
++ * perf_event_disable_inatomic()
++ * @pending_disable = CPU-A;
++ * irq_work_queue();
++ *
++ * sched-out
++ * @pending_disable = -1;
++ *
++ * sched-in
++ * perf_event_disable_inatomic()
++ * @pending_disable = CPU-B;
++ * irq_work_queue(); // FAILS
++ *
++ * irq_work_run()
++ * perf_pending_event()
++ *
++ * But the event runs on CPU-B and wants disabling there.
++ */
++ irq_work_queue_on(&event->pending, cpu);
++}
++
+ static void perf_pending_event(struct irq_work *entry)
+ {
+- struct perf_event *event = container_of(entry,
+- struct perf_event, pending);
++ struct perf_event *event = container_of(entry, struct perf_event, pending);
+ int rctx;
+
+ rctx = perf_swevent_get_recursion_context();
+@@ -5815,10 +5851,7 @@ static void perf_pending_event(struct irq_work *entry)
+ * and we won't recurse 'further'.
+ */
+
+- if (event->pending_disable) {
+- event->pending_disable = 0;
+- perf_event_disable_local(event);
+- }
++ perf_pending_event_disable(event);
+
+ if (event->pending_wakeup) {
+ event->pending_wakeup = 0;
+@@ -9969,6 +10002,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+
+
+ init_waitqueue_head(&event->waitq);
++ event->pending_disable = -1;
+ init_irq_work(&event->pending, perf_pending_event);
+
+ mutex_init(&event->mmap_mutex);
+diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
+index 474b2ccdbe69..99c7f199f2d4 100644
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -393,7 +393,7 @@ void *perf_aux_output_begin(struct perf_output_handle *handle,
+ * store that will be enabled on successful return
+ */
+ if (!handle->size) { /* A, matches D */
+- event->pending_disable = 1;
++ event->pending_disable = smp_processor_id();
+ perf_output_wakeup(handle);
+ local_set(&rb->aux_nest, 0);
+ goto err_put;
+@@ -471,7 +471,7 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size)
+
+ if (wakeup) {
+ if (handle->aux_flags & PERF_AUX_FLAG_TRUNCATED)
+- handle->event->pending_disable = 1;
++ handle->event->pending_disable = smp_processor_id();
+ perf_output_wakeup(handle);
+ }
+
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 5a26d843a015..afdc5eadce6e 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1306,13 +1306,15 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval,
+
+ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
+ {
++ int err;
+ u32 uninitialized_var(curval);
+
+ if (unlikely(should_fail_futex(true)))
+ return -EFAULT;
+
+- if (unlikely(cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)))
+- return -EFAULT;
++ err = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval);
++ if (unlikely(err))
++ return err;
+
+ /* If user space value changed, let the caller retry */
+ return curval != uval ? -EAGAIN : 0;
+@@ -1498,10 +1500,8 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_
+ if (unlikely(should_fail_futex(true)))
+ ret = -EFAULT;
+
+- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval)) {
+- ret = -EFAULT;
+-
+- } else if (curval != uval) {
++ ret = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval);
++ if (!ret && (curval != uval)) {
+ /*
+ * If a unconditional UNLOCK_PI operation (user space did not
+ * try the TID->0 transition) raced with a waiter setting the
+@@ -1696,32 +1696,32 @@ retry_private:
+ double_lock_hb(hb1, hb2);
+ op_ret = futex_atomic_op_inuser(op, uaddr2);
+ if (unlikely(op_ret < 0)) {
+-
+ double_unlock_hb(hb1, hb2);
+
+-#ifndef CONFIG_MMU
+- /*
+- * we don't get EFAULT from MMU faults if we don't have an MMU,
+- * but we might get them from range checking
+- */
+- ret = op_ret;
+- goto out_put_keys;
+-#endif
+-
+- if (unlikely(op_ret != -EFAULT)) {
++ if (!IS_ENABLED(CONFIG_MMU) ||
++ unlikely(op_ret != -EFAULT && op_ret != -EAGAIN)) {
++ /*
++ * we don't get EFAULT from MMU faults if we don't have
++ * an MMU, but we might get them from range checking
++ */
+ ret = op_ret;
+ goto out_put_keys;
+ }
+
+- ret = fault_in_user_writeable(uaddr2);
+- if (ret)
+- goto out_put_keys;
++ if (op_ret == -EFAULT) {
++ ret = fault_in_user_writeable(uaddr2);
++ if (ret)
++ goto out_put_keys;
++ }
+
+- if (!(flags & FLAGS_SHARED))
++ if (!(flags & FLAGS_SHARED)) {
++ cond_resched();
+ goto retry_private;
++ }
+
+ put_futex_key(&key2);
+ put_futex_key(&key1);
++ cond_resched();
+ goto retry;
+ }
+
+@@ -2346,7 +2346,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
+ u32 uval, uninitialized_var(curval), newval;
+ struct task_struct *oldowner, *newowner;
+ u32 newtid;
+- int ret;
++ int ret, err = 0;
+
+ lockdep_assert_held(q->lock_ptr);
+
+@@ -2417,14 +2417,17 @@ retry:
+ if (!pi_state->owner)
+ newtid |= FUTEX_OWNER_DIED;
+
+- if (get_futex_value_locked(&uval, uaddr))
+- goto handle_fault;
++ err = get_futex_value_locked(&uval, uaddr);
++ if (err)
++ goto handle_err;
+
+ for (;;) {
+ newval = (uval & FUTEX_OWNER_DIED) | newtid;
+
+- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
+- goto handle_fault;
++ err = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval);
++ if (err)
++ goto handle_err;
++
+ if (curval == uval)
+ break;
+ uval = curval;
+@@ -2452,23 +2455,37 @@ retry:
+ return 0;
+
+ /*
+- * To handle the page fault we need to drop the locks here. That gives
+- * the other task (either the highest priority waiter itself or the
+- * task which stole the rtmutex) the chance to try the fixup of the
+- * pi_state. So once we are back from handling the fault we need to
+- * check the pi_state after reacquiring the locks and before trying to
+- * do another fixup. When the fixup has been done already we simply
+- * return.
++ * In order to reschedule or handle a page fault, we need to drop the
++ * locks here. In the case of a fault, this gives the other task
++ * (either the highest priority waiter itself or the task which stole
++ * the rtmutex) the chance to try the fixup of the pi_state. So once we
++ * are back from handling the fault we need to check the pi_state after
++ * reacquiring the locks and before trying to do another fixup. When
++ * the fixup has been done already we simply return.
+ *
+ * Note: we hold both hb->lock and pi_mutex->wait_lock. We can safely
+ * drop hb->lock since the caller owns the hb -> futex_q relation.
+ * Dropping the pi_mutex->wait_lock requires the state revalidate.
+ */
+-handle_fault:
++handle_err:
+ raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
+ spin_unlock(q->lock_ptr);
+
+- ret = fault_in_user_writeable(uaddr);
++ switch (err) {
++ case -EFAULT:
++ ret = fault_in_user_writeable(uaddr);
++ break;
++
++ case -EAGAIN:
++ cond_resched();
++ ret = 0;
++ break;
++
++ default:
++ WARN_ON_ONCE(1);
++ ret = err;
++ break;
++ }
+
+ spin_lock(q->lock_ptr);
+ raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
+@@ -3037,10 +3054,8 @@ retry:
+ * A unconditional UNLOCK_PI op raced against a waiter
+ * setting the FUTEX_WAITERS bit. Try again.
+ */
+- if (ret == -EAGAIN) {
+- put_futex_key(&key);
+- goto retry;
+- }
++ if (ret == -EAGAIN)
++ goto pi_retry;
+ /*
+ * wake_futex_pi has detected invalid state. Tell user
+ * space.
+@@ -3055,9 +3070,19 @@ retry:
+ * preserve the WAITERS bit not the OWNER_DIED one. We are the
+ * owner.
+ */
+- if (cmpxchg_futex_value_locked(&curval, uaddr, uval, 0)) {
++ if ((ret = cmpxchg_futex_value_locked(&curval, uaddr, uval, 0))) {
+ spin_unlock(&hb->lock);
+- goto pi_faulted;
++ switch (ret) {
++ case -EFAULT:
++ goto pi_faulted;
++
++ case -EAGAIN:
++ goto pi_retry;
++
++ default:
++ WARN_ON_ONCE(1);
++ goto out_putkey;
++ }
+ }
+
+ /*
+@@ -3071,6 +3096,11 @@ out_putkey:
+ put_futex_key(&key);
+ return ret;
+
++pi_retry:
++ put_futex_key(&key);
++ cond_resched();
++ goto retry;
++
+ pi_faulted:
+ put_futex_key(&key);
+
+@@ -3431,6 +3461,7 @@ err_unlock:
+ int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi)
+ {
+ u32 uval, uninitialized_var(nval), mval;
++ int err;
+
+ /* Futex address must be 32bit aligned */
+ if ((((unsigned long)uaddr) % sizeof(*uaddr)) != 0)
+@@ -3440,42 +3471,57 @@ retry:
+ if (get_user(uval, uaddr))
+ return -1;
+
+- if ((uval & FUTEX_TID_MASK) == task_pid_vnr(curr)) {
+- /*
+- * Ok, this dying thread is truly holding a futex
+- * of interest. Set the OWNER_DIED bit atomically
+- * via cmpxchg, and if the value had FUTEX_WAITERS
+- * set, wake up a waiter (if any). (We have to do a
+- * futex_wake() even if OWNER_DIED is already set -
+- * to handle the rare but possible case of recursive
+- * thread-death.) The rest of the cleanup is done in
+- * userspace.
+- */
+- mval = (uval & FUTEX_WAITERS) | FUTEX_OWNER_DIED;
+- /*
+- * We are not holding a lock here, but we want to have
+- * the pagefault_disable/enable() protection because
+- * we want to handle the fault gracefully. If the
+- * access fails we try to fault in the futex with R/W
+- * verification via get_user_pages. get_user() above
+- * does not guarantee R/W access. If that fails we
+- * give up and leave the futex locked.
+- */
+- if (cmpxchg_futex_value_locked(&nval, uaddr, uval, mval)) {
++ if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr))
++ return 0;
++
++ /*
++ * Ok, this dying thread is truly holding a futex
++ * of interest. Set the OWNER_DIED bit atomically
++ * via cmpxchg, and if the value had FUTEX_WAITERS
++ * set, wake up a waiter (if any). (We have to do a
++ * futex_wake() even if OWNER_DIED is already set -
++ * to handle the rare but possible case of recursive
++ * thread-death.) The rest of the cleanup is done in
++ * userspace.
++ */
++ mval = (uval & FUTEX_WAITERS) | FUTEX_OWNER_DIED;
++
++ /*
++ * We are not holding a lock here, but we want to have
++ * the pagefault_disable/enable() protection because
++ * we want to handle the fault gracefully. If the
++ * access fails we try to fault in the futex with R/W
++ * verification via get_user_pages. get_user() above
++ * does not guarantee R/W access. If that fails we
++ * give up and leave the futex locked.
++ */
++ if ((err = cmpxchg_futex_value_locked(&nval, uaddr, uval, mval))) {
++ switch (err) {
++ case -EFAULT:
+ if (fault_in_user_writeable(uaddr))
+ return -1;
+ goto retry;
+- }
+- if (nval != uval)
++
++ case -EAGAIN:
++ cond_resched();
+ goto retry;
+
+- /*
+- * Wake robust non-PI futexes here. The wakeup of
+- * PI futexes happens in exit_pi_state():
+- */
+- if (!pi && (uval & FUTEX_WAITERS))
+- futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY);
++ default:
++ WARN_ON_ONCE(1);
++ return err;
++ }
+ }
++
++ if (nval != uval)
++ goto retry;
++
++ /*
++ * Wake robust non-PI futexes here. The wakeup of
++ * PI futexes happens in exit_pi_state():
++ */
++ if (!pi && (uval & FUTEX_WAITERS))
++ futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY);
++
+ return 0;
+ }
+
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 5c0ba5ca5930..cd4f9f3e8345 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -356,8 +356,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify)
+ desc->affinity_notify = notify;
+ raw_spin_unlock_irqrestore(&desc->lock, flags);
+
+- if (old_notify)
++ if (old_notify) {
++ cancel_work_sync(&old_notify->work);
+ kref_put(&old_notify->kref, old_notify->release);
++ }
+
+ return 0;
+ }
+diff --git a/lib/ubsan.c b/lib/ubsan.c
+index e4162f59a81c..1e9e2ab25539 100644
+--- a/lib/ubsan.c
++++ b/lib/ubsan.c
+@@ -86,11 +86,13 @@ static bool is_inline_int(struct type_descriptor *type)
+ return bits <= inline_bits;
+ }
+
+-static s_max get_signed_val(struct type_descriptor *type, unsigned long val)
++static s_max get_signed_val(struct type_descriptor *type, void *val)
+ {
+ if (is_inline_int(type)) {
+ unsigned extra_bits = sizeof(s_max)*8 - type_bit_width(type);
+- return ((s_max)val) << extra_bits >> extra_bits;
++ unsigned long ulong_val = (unsigned long)val;
++
++ return ((s_max)ulong_val) << extra_bits >> extra_bits;
+ }
+
+ if (type_bit_width(type) == 64)
+@@ -99,15 +101,15 @@ static s_max get_signed_val(struct type_descriptor *type, unsigned long val)
+ return *(s_max *)val;
+ }
+
+-static bool val_is_negative(struct type_descriptor *type, unsigned long val)
++static bool val_is_negative(struct type_descriptor *type, void *val)
+ {
+ return type_is_signed(type) && get_signed_val(type, val) < 0;
+ }
+
+-static u_max get_unsigned_val(struct type_descriptor *type, unsigned long val)
++static u_max get_unsigned_val(struct type_descriptor *type, void *val)
+ {
+ if (is_inline_int(type))
+- return val;
++ return (unsigned long)val;
+
+ if (type_bit_width(type) == 64)
+ return *(u64 *)val;
+@@ -116,7 +118,7 @@ static u_max get_unsigned_val(struct type_descriptor *type, unsigned long val)
+ }
+
+ static void val_to_string(char *str, size_t size, struct type_descriptor *type,
+- unsigned long value)
++ void *value)
+ {
+ if (type_is_int(type)) {
+ if (type_bit_width(type) == 128) {
+@@ -163,8 +165,8 @@ static void ubsan_epilogue(unsigned long *flags)
+ current->in_ubsan--;
+ }
+
+-static void handle_overflow(struct overflow_data *data, unsigned long lhs,
+- unsigned long rhs, char op)
++static void handle_overflow(struct overflow_data *data, void *lhs,
++ void *rhs, char op)
+ {
+
+ struct type_descriptor *type = data->type;
+@@ -191,8 +193,7 @@ static void handle_overflow(struct overflow_data *data, unsigned long lhs,
+ }
+
+ void __ubsan_handle_add_overflow(struct overflow_data *data,
+- unsigned long lhs,
+- unsigned long rhs)
++ void *lhs, void *rhs)
+ {
+
+ handle_overflow(data, lhs, rhs, '+');
+@@ -200,23 +201,21 @@ void __ubsan_handle_add_overflow(struct overflow_data *data,
+ EXPORT_SYMBOL(__ubsan_handle_add_overflow);
+
+ void __ubsan_handle_sub_overflow(struct overflow_data *data,
+- unsigned long lhs,
+- unsigned long rhs)
++ void *lhs, void *rhs)
+ {
+ handle_overflow(data, lhs, rhs, '-');
+ }
+ EXPORT_SYMBOL(__ubsan_handle_sub_overflow);
+
+ void __ubsan_handle_mul_overflow(struct overflow_data *data,
+- unsigned long lhs,
+- unsigned long rhs)
++ void *lhs, void *rhs)
+ {
+ handle_overflow(data, lhs, rhs, '*');
+ }
+ EXPORT_SYMBOL(__ubsan_handle_mul_overflow);
+
+ void __ubsan_handle_negate_overflow(struct overflow_data *data,
+- unsigned long old_val)
++ void *old_val)
+ {
+ unsigned long flags;
+ char old_val_str[VALUE_LENGTH];
+@@ -237,8 +236,7 @@ EXPORT_SYMBOL(__ubsan_handle_negate_overflow);
+
+
+ void __ubsan_handle_divrem_overflow(struct overflow_data *data,
+- unsigned long lhs,
+- unsigned long rhs)
++ void *lhs, void *rhs)
+ {
+ unsigned long flags;
+ char rhs_val_str[VALUE_LENGTH];
+@@ -323,7 +321,7 @@ static void ubsan_type_mismatch_common(struct type_mismatch_data_common *data,
+ }
+
+ void __ubsan_handle_type_mismatch(struct type_mismatch_data *data,
+- unsigned long ptr)
++ void *ptr)
+ {
+ struct type_mismatch_data_common common_data = {
+ .location = &data->location,
+@@ -332,12 +330,12 @@ void __ubsan_handle_type_mismatch(struct type_mismatch_data *data,
+ .type_check_kind = data->type_check_kind
+ };
+
+- ubsan_type_mismatch_common(&common_data, ptr);
++ ubsan_type_mismatch_common(&common_data, (unsigned long)ptr);
+ }
+ EXPORT_SYMBOL(__ubsan_handle_type_mismatch);
+
+ void __ubsan_handle_type_mismatch_v1(struct type_mismatch_data_v1 *data,
+- unsigned long ptr)
++ void *ptr)
+ {
+
+ struct type_mismatch_data_common common_data = {
+@@ -347,12 +345,12 @@ void __ubsan_handle_type_mismatch_v1(struct type_mismatch_data_v1 *data,
+ .type_check_kind = data->type_check_kind
+ };
+
+- ubsan_type_mismatch_common(&common_data, ptr);
++ ubsan_type_mismatch_common(&common_data, (unsigned long)ptr);
+ }
+ EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1);
+
+ void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data,
+- unsigned long bound)
++ void *bound)
+ {
+ unsigned long flags;
+ char bound_str[VALUE_LENGTH];
+@@ -369,8 +367,7 @@ void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data,
+ }
+ EXPORT_SYMBOL(__ubsan_handle_vla_bound_not_positive);
+
+-void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data,
+- unsigned long index)
++void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index)
+ {
+ unsigned long flags;
+ char index_str[VALUE_LENGTH];
+@@ -388,7 +385,7 @@ void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data,
+ EXPORT_SYMBOL(__ubsan_handle_out_of_bounds);
+
+ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
+- unsigned long lhs, unsigned long rhs)
++ void *lhs, void *rhs)
+ {
+ unsigned long flags;
+ struct type_descriptor *rhs_type = data->rhs_type;
+@@ -439,7 +436,7 @@ void __ubsan_handle_builtin_unreachable(struct unreachable_data *data)
+ EXPORT_SYMBOL(__ubsan_handle_builtin_unreachable);
+
+ void __ubsan_handle_load_invalid_value(struct invalid_value_data *data,
+- unsigned long val)
++ void *val)
+ {
+ unsigned long flags;
+ char val_str[VALUE_LENGTH];
+diff --git a/mm/slab.c b/mm/slab.c
+index b8e0ec74330f..018d32496e8d 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -4305,7 +4305,8 @@ static void show_symbol(struct seq_file *m, unsigned long address)
+
+ static int leaks_show(struct seq_file *m, void *p)
+ {
+- struct kmem_cache *cachep = list_entry(p, struct kmem_cache, list);
++ struct kmem_cache *cachep = list_entry(p, struct kmem_cache,
++ root_caches_node);
+ struct page *page;
+ struct kmem_cache_node *n;
+ const char *name;
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index bd4978ce8c45..3cf0764d5793 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1276,6 +1276,14 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
+ !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ return 0;
+
++ /* The minimum encryption key size needs to be enforced by the
++ * host stack before establishing any L2CAP connections. The
++ * specification in theory allows a minimum of 1, but to align
++ * BR/EDR and LE transports, a minimum of 7 is chosen.
++ */
++ if (conn->enc_key_size < HCI_MIN_ENC_KEY_SIZE)
++ return 0;
++
+ return 1;
+ }
+
+diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
+index 1eaac01f85de..7f36fa73ffee 100644
+--- a/net/bluetooth/hidp/sock.c
++++ b/net/bluetooth/hidp/sock.c
+@@ -76,6 +76,7 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
+ sockfd_put(csock);
+ return err;
+ }
++ ca.name[sizeof(ca.name)-1] = 0;
+
+ err = hidp_connection_add(&ca, csock, isock);
+ if (!err && copy_to_user(argp, &ca, sizeof(ca)))
+diff --git a/sound/soc/codecs/cs35l35.c b/sound/soc/codecs/cs35l35.c
+index bd6226bde45f..17e0101081ef 100644
+--- a/sound/soc/codecs/cs35l35.c
++++ b/sound/soc/codecs/cs35l35.c
+@@ -1634,6 +1634,16 @@ err:
+ return ret;
+ }
+
++static int cs35l35_i2c_remove(struct i2c_client *i2c_client)
++{
++ struct cs35l35_private *cs35l35 = i2c_get_clientdata(i2c_client);
++
++ regulator_bulk_disable(cs35l35->num_supplies, cs35l35->supplies);
++ gpiod_set_value_cansleep(cs35l35->reset_gpio, 0);
++
++ return 0;
++}
++
+ static const struct of_device_id cs35l35_of_match[] = {
+ {.compatible = "cirrus,cs35l35"},
+ {},
+@@ -1654,6 +1664,7 @@ static struct i2c_driver cs35l35_i2c_driver = {
+ },
+ .id_table = cs35l35_id,
+ .probe = cs35l35_i2c_probe,
++ .remove = cs35l35_i2c_remove,
+ };
+
+ module_i2c_driver(cs35l35_i2c_driver);
+diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
+index 3c266eeb89bf..007ce9f48e44 100644
+--- a/sound/soc/codecs/cs4270.c
++++ b/sound/soc/codecs/cs4270.c
+@@ -642,6 +642,7 @@ static const struct regmap_config cs4270_regmap = {
+ .reg_defaults = cs4270_reg_defaults,
+ .num_reg_defaults = ARRAY_SIZE(cs4270_reg_defaults),
+ .cache_type = REGCACHE_RBTREE,
++ .write_flag_mask = CS4270_I2C_INCR,
+
+ .readable_reg = cs4270_reg_is_readable,
+ .volatile_reg = cs4270_reg_is_volatile,
+diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
+index e5b6769b9797..d5f73c837281 100644
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -529,73 +529,71 @@ static int hdmi_codec_set_fmt(struct snd_soc_dai *dai,
+ {
+ struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai);
+ struct hdmi_codec_daifmt cf = { 0 };
+- int ret = 0;
+
+ dev_dbg(dai->dev, "%s()\n", __func__);
+
+- if (dai->id == DAI_ID_SPDIF) {
+- cf.fmt = HDMI_SPDIF;
+- } else {
+- switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+- case SND_SOC_DAIFMT_CBM_CFM:
+- cf.bit_clk_master = 1;
+- cf.frame_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBS_CFM:
+- cf.frame_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBM_CFS:
+- cf.bit_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBS_CFS:
+- break;
+- default:
+- return -EINVAL;
+- }
++ if (dai->id == DAI_ID_SPDIF)
++ return 0;
++
++ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++ case SND_SOC_DAIFMT_CBM_CFM:
++ cf.bit_clk_master = 1;
++ cf.frame_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBS_CFM:
++ cf.frame_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBM_CFS:
++ cf.bit_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBS_CFS:
++ break;
++ default:
++ return -EINVAL;
++ }
+
+- switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+- case SND_SOC_DAIFMT_NB_NF:
+- break;
+- case SND_SOC_DAIFMT_NB_IF:
+- cf.frame_clk_inv = 1;
+- break;
+- case SND_SOC_DAIFMT_IB_NF:
+- cf.bit_clk_inv = 1;
+- break;
+- case SND_SOC_DAIFMT_IB_IF:
+- cf.frame_clk_inv = 1;
+- cf.bit_clk_inv = 1;
+- break;
+- }
++ switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
++ case SND_SOC_DAIFMT_NB_NF:
++ break;
++ case SND_SOC_DAIFMT_NB_IF:
++ cf.frame_clk_inv = 1;
++ break;
++ case SND_SOC_DAIFMT_IB_NF:
++ cf.bit_clk_inv = 1;
++ break;
++ case SND_SOC_DAIFMT_IB_IF:
++ cf.frame_clk_inv = 1;
++ cf.bit_clk_inv = 1;
++ break;
++ }
+
+- switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+- case SND_SOC_DAIFMT_I2S:
+- cf.fmt = HDMI_I2S;
+- break;
+- case SND_SOC_DAIFMT_DSP_A:
+- cf.fmt = HDMI_DSP_A;
+- break;
+- case SND_SOC_DAIFMT_DSP_B:
+- cf.fmt = HDMI_DSP_B;
+- break;
+- case SND_SOC_DAIFMT_RIGHT_J:
+- cf.fmt = HDMI_RIGHT_J;
+- break;
+- case SND_SOC_DAIFMT_LEFT_J:
+- cf.fmt = HDMI_LEFT_J;
+- break;
+- case SND_SOC_DAIFMT_AC97:
+- cf.fmt = HDMI_AC97;
+- break;
+- default:
+- dev_err(dai->dev, "Invalid DAI interface format\n");
+- return -EINVAL;
+- }
++ switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
++ case SND_SOC_DAIFMT_I2S:
++ cf.fmt = HDMI_I2S;
++ break;
++ case SND_SOC_DAIFMT_DSP_A:
++ cf.fmt = HDMI_DSP_A;
++ break;
++ case SND_SOC_DAIFMT_DSP_B:
++ cf.fmt = HDMI_DSP_B;
++ break;
++ case SND_SOC_DAIFMT_RIGHT_J:
++ cf.fmt = HDMI_RIGHT_J;
++ break;
++ case SND_SOC_DAIFMT_LEFT_J:
++ cf.fmt = HDMI_LEFT_J;
++ break;
++ case SND_SOC_DAIFMT_AC97:
++ cf.fmt = HDMI_AC97;
++ break;
++ default:
++ dev_err(dai->dev, "Invalid DAI interface format\n");
++ return -EINVAL;
+ }
+
+ hcp->daifmt[dai->id] = cf;
+
+- return ret;
++ return 0;
+ }
+
+ static int hdmi_codec_digital_mute(struct snd_soc_dai *dai, int mute)
+@@ -792,8 +790,10 @@ static int hdmi_codec_probe(struct platform_device *pdev)
+ i++;
+ }
+
+- if (hcd->spdif)
++ if (hcd->spdif) {
+ hcp->daidrv[i] = hdmi_spdif_dai;
++ hcp->daifmt[DAI_ID_SPDIF].fmt = HDMI_SPDIF;
++ }
+
+ dev_set_drvdata(dev, hcp);
+
+diff --git a/sound/soc/codecs/nau8810.c b/sound/soc/codecs/nau8810.c
+index bfd74b86c9d2..645aa0794123 100644
+--- a/sound/soc/codecs/nau8810.c
++++ b/sound/soc/codecs/nau8810.c
+@@ -411,9 +411,9 @@ static const struct snd_soc_dapm_widget nau8810_dapm_widgets[] = {
+ SND_SOC_DAPM_MIXER("Mono Mixer", NAU8810_REG_POWER3,
+ NAU8810_MOUTMX_EN_SFT, 0, &nau8810_mono_mixer_controls[0],
+ ARRAY_SIZE(nau8810_mono_mixer_controls)),
+- SND_SOC_DAPM_DAC("DAC", "HiFi Playback", NAU8810_REG_POWER3,
++ SND_SOC_DAPM_DAC("DAC", "Playback", NAU8810_REG_POWER3,
+ NAU8810_DAC_EN_SFT, 0),
+- SND_SOC_DAPM_ADC("ADC", "HiFi Capture", NAU8810_REG_POWER2,
++ SND_SOC_DAPM_ADC("ADC", "Capture", NAU8810_REG_POWER2,
+ NAU8810_ADC_EN_SFT, 0),
+ SND_SOC_DAPM_PGA("SpkN Out", NAU8810_REG_POWER3,
+ NAU8810_NSPK_EN_SFT, 0, NULL, 0),
+diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
+index 468d5143e2c4..663a208c2f78 100644
+--- a/sound/soc/codecs/nau8824.c
++++ b/sound/soc/codecs/nau8824.c
+@@ -681,8 +681,8 @@ static const struct snd_soc_dapm_widget nau8824_dapm_widgets[] = {
+ SND_SOC_DAPM_ADC("ADCR", NULL, NAU8824_REG_ANALOG_ADC_2,
+ NAU8824_ADCR_EN_SFT, 0),
+
+- SND_SOC_DAPM_AIF_OUT("AIFTX", "HiFi Capture", 0, SND_SOC_NOPM, 0, 0),
+- SND_SOC_DAPM_AIF_IN("AIFRX", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("AIFRX", "Playback", 0, SND_SOC_NOPM, 0, 0),
+
+ SND_SOC_DAPM_DAC("DACL", NULL, NAU8824_REG_RDAC,
+ NAU8824_DACL_EN_SFT, 0),
+@@ -831,6 +831,36 @@ static void nau8824_int_status_clear_all(struct regmap *regmap)
+ }
+ }
+
++static void nau8824_dapm_disable_pin(struct nau8824 *nau8824, const char *pin)
++{
++ struct snd_soc_dapm_context *dapm = nau8824->dapm;
++ const char *prefix = dapm->component->name_prefix;
++ char prefixed_pin[80];
++
++ if (prefix) {
++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
++ prefix, pin);
++ snd_soc_dapm_disable_pin(dapm, prefixed_pin);
++ } else {
++ snd_soc_dapm_disable_pin(dapm, pin);
++ }
++}
++
++static void nau8824_dapm_enable_pin(struct nau8824 *nau8824, const char *pin)
++{
++ struct snd_soc_dapm_context *dapm = nau8824->dapm;
++ const char *prefix = dapm->component->name_prefix;
++ char prefixed_pin[80];
++
++ if (prefix) {
++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
++ prefix, pin);
++ snd_soc_dapm_force_enable_pin(dapm, prefixed_pin);
++ } else {
++ snd_soc_dapm_force_enable_pin(dapm, pin);
++ }
++}
++
+ static void nau8824_eject_jack(struct nau8824 *nau8824)
+ {
+ struct snd_soc_dapm_context *dapm = nau8824->dapm;
+@@ -839,8 +869,8 @@ static void nau8824_eject_jack(struct nau8824 *nau8824)
+ /* Clear all interruption status */
+ nau8824_int_status_clear_all(regmap);
+
+- snd_soc_dapm_disable_pin(dapm, "SAR");
+- snd_soc_dapm_disable_pin(dapm, "MICBIAS");
++ nau8824_dapm_disable_pin(nau8824, "SAR");
++ nau8824_dapm_disable_pin(nau8824, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+
+ /* Enable the insertion interruption, disable the ejection
+@@ -870,8 +900,8 @@ static void nau8824_jdet_work(struct work_struct *work)
+ struct regmap *regmap = nau8824->regmap;
+ int adc_value, event = 0, event_mask = 0;
+
+- snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
+- snd_soc_dapm_force_enable_pin(dapm, "SAR");
++ nau8824_dapm_enable_pin(nau8824, "MICBIAS");
++ nau8824_dapm_enable_pin(nau8824, "SAR");
+ snd_soc_dapm_sync(dapm);
+
+ msleep(100);
+@@ -882,8 +912,8 @@ static void nau8824_jdet_work(struct work_struct *work)
+ if (adc_value < HEADSET_SARADC_THD) {
+ event |= SND_JACK_HEADPHONE;
+
+- snd_soc_dapm_disable_pin(dapm, "SAR");
+- snd_soc_dapm_disable_pin(dapm, "MICBIAS");
++ nau8824_dapm_disable_pin(nau8824, "SAR");
++ nau8824_dapm_disable_pin(nau8824, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+ } else {
+ event |= SND_JACK_HEADSET;
+diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
+index 79ebcc239786..6f5dac09cede 100644
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -1196,7 +1196,7 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
+ struct snd_soc_component *component =
+ snd_soc_dapm_to_component(w->dapm);
+ struct rt5682_priv *rt5682 = snd_soc_component_get_drvdata(component);
+- int ref, val, reg, sft, mask, idx = -EINVAL;
++ int ref, val, reg, idx = -EINVAL;
+ static const int div_f[] = {1, 2, 3, 4, 6, 8, 12, 16, 24, 32, 48};
+ static const int div_o[] = {1, 2, 4, 6, 8, 12, 16, 24, 32, 48};
+
+@@ -1210,15 +1210,10 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
+
+ idx = rt5682_div_sel(rt5682, ref, div_f, ARRAY_SIZE(div_f));
+
+- if (w->shift == RT5682_PWR_ADC_S1F_BIT) {
++ if (w->shift == RT5682_PWR_ADC_S1F_BIT)
+ reg = RT5682_PLL_TRACK_3;
+- sft = RT5682_ADC_OSR_SFT;
+- mask = RT5682_ADC_OSR_MASK;
+- } else {
++ else
+ reg = RT5682_PLL_TRACK_2;
+- sft = RT5682_DAC_OSR_SFT;
+- mask = RT5682_DAC_OSR_MASK;
+- }
+
+ snd_soc_component_update_bits(component, reg,
+ RT5682_FILTER_CLK_DIV_MASK, idx << RT5682_FILTER_CLK_DIV_SFT);
+@@ -1230,7 +1225,8 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
+ }
+
+ snd_soc_component_update_bits(component, RT5682_ADDA_CLK_1,
+- mask, idx << sft);
++ RT5682_ADC_OSR_MASK | RT5682_DAC_OSR_MASK,
++ (idx << RT5682_ADC_OSR_SFT) | (idx << RT5682_DAC_OSR_SFT));
+
+ return 0;
+ }
+diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
+index f03195d2ab2e..45d9f4a09044 100644
+--- a/sound/soc/codecs/tlv320aic32x4.c
++++ b/sound/soc/codecs/tlv320aic32x4.c
+@@ -462,6 +462,8 @@ static const struct snd_soc_dapm_widget aic32x4_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("IN2_R"),
+ SND_SOC_DAPM_INPUT("IN3_L"),
+ SND_SOC_DAPM_INPUT("IN3_R"),
++ SND_SOC_DAPM_INPUT("CM_L"),
++ SND_SOC_DAPM_INPUT("CM_R"),
+ };
+
+ static const struct snd_soc_dapm_route aic32x4_dapm_routes[] = {
+diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
+index 6a271e6e6b8f..6c0a3dad44b8 100644
+--- a/sound/soc/codecs/tlv320aic3x.c
++++ b/sound/soc/codecs/tlv320aic3x.c
+@@ -1599,7 +1599,6 @@ static int aic3x_probe(struct snd_soc_component *component)
+ struct aic3x_priv *aic3x = snd_soc_component_get_drvdata(component);
+ int ret, i;
+
+- INIT_LIST_HEAD(&aic3x->list);
+ aic3x->component = component;
+
+ for (i = 0; i < ARRAY_SIZE(aic3x->supplies); i++) {
+@@ -1682,7 +1681,6 @@ static void aic3x_remove(struct snd_soc_component *component)
+ struct aic3x_priv *aic3x = snd_soc_component_get_drvdata(component);
+ int i;
+
+- list_del(&aic3x->list);
+ for (i = 0; i < ARRAY_SIZE(aic3x->supplies); i++)
+ regulator_unregister_notifier(aic3x->supplies[i].consumer,
+ &aic3x->disable_nb[i].nb);
+@@ -1880,6 +1878,7 @@ static int aic3x_i2c_probe(struct i2c_client *i2c,
+ if (ret != 0)
+ goto err_gpio;
+
++ INIT_LIST_HEAD(&aic3x->list);
+ list_add(&aic3x->list, &reset_list);
+
+ return 0;
+@@ -1896,6 +1895,8 @@ static int aic3x_i2c_remove(struct i2c_client *client)
+ {
+ struct aic3x_priv *aic3x = i2c_get_clientdata(client);
+
++ list_del(&aic3x->list);
++
+ if (gpio_is_valid(aic3x->gpio_reset) &&
+ !aic3x_is_shared_reset(aic3x)) {
+ gpio_set_value(aic3x->gpio_reset, 0);
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index a651fed62a27..ee85056a8577 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -3819,11 +3819,13 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ struct regmap *regmap = dsp->regmap;
+ int ret = 0;
+
++ mutex_lock(&dsp->pwr_lock);
++
+ ret = regmap_read(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL, &val);
+ if (ret) {
+ adsp_err(dsp,
+ "Failed to read Region Lock Ctrl register: %d\n", ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ if (val & ADSP2_WDT_TIMEOUT_STS_MASK) {
+@@ -3842,7 +3844,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ adsp_err(dsp,
+ "Failed to read Bus Err Addr register: %d\n",
+ ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ adsp_err(dsp, "bus error address = 0x%x\n",
+@@ -3855,7 +3857,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ adsp_err(dsp,
+ "Failed to read Pmem Xmem Err Addr register: %d\n",
+ ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ adsp_err(dsp, "xmem error address = 0x%x\n",
+@@ -3868,6 +3870,9 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ regmap_update_bits(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL,
+ ADSP2_CTRL_ERR_EINT, ADSP2_CTRL_ERR_EINT);
+
++error:
++ mutex_unlock(&dsp->pwr_lock);
++
+ return IRQ_HANDLED;
+ }
+ EXPORT_SYMBOL_GPL(wm_adsp2_bus_error);
+diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+index a892b37eab7c..b8a03f58ac8c 100644
+--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+@@ -406,7 +406,7 @@ static const struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
+ };
+
+ static const unsigned int dmic_2ch[] = {
+- 4,
++ 2,
+ };
+
+ static const struct snd_pcm_hw_constraint_list constraints_dmic_2ch = {
+diff --git a/sound/soc/intel/common/sst-firmware.c b/sound/soc/intel/common/sst-firmware.c
+index 11041aedea31..6cfcc1042989 100644
+--- a/sound/soc/intel/common/sst-firmware.c
++++ b/sound/soc/intel/common/sst-firmware.c
+@@ -1251,11 +1251,15 @@ struct sst_dsp *sst_dsp_new(struct device *dev,
+ goto irq_err;
+
+ err = sst_dma_new(sst);
+- if (err)
+- dev_warn(dev, "sst_dma_new failed %d\n", err);
++ if (err) {
++ dev_err(dev, "sst_dma_new failed %d\n", err);
++ goto dma_err;
++ }
+
+ return sst;
+
++dma_err:
++ free_irq(sst->irq, sst);
+ irq_err:
+ if (sst->ops->free)
+ sst->ops->free(sst);
+diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
+index 823e39103edd..6b2c8c6e7a00 100644
+--- a/sound/soc/intel/skylake/skl-pcm.c
++++ b/sound/soc/intel/skylake/skl-pcm.c
+@@ -180,6 +180,7 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params)
+ struct hdac_stream *hstream;
+ struct hdac_ext_stream *stream;
+ struct hdac_ext_link *link;
++ unsigned char stream_tag;
+
+ hstream = snd_hdac_get_stream(bus, params->stream,
+ params->link_dma_id + 1);
+@@ -198,10 +199,13 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params)
+
+ snd_hdac_ext_link_stream_setup(stream, format_val);
+
+- list_for_each_entry(link, &bus->hlink_list, list) {
+- if (link->index == params->link_index)
+- snd_hdac_ext_link_set_stream_id(link,
+- hstream->stream_tag);
++ stream_tag = hstream->stream_tag;
++ if (stream->hstream.direction == SNDRV_PCM_STREAM_PLAYBACK) {
++ list_for_each_entry(link, &bus->hlink_list, list) {
++ if (link->index == params->link_index)
++ snd_hdac_ext_link_set_stream_id(link,
++ stream_tag);
++ }
+ }
+
+ stream->link_prepared = 1;
+@@ -640,6 +644,7 @@ static int skl_link_hw_free(struct snd_pcm_substream *substream,
+ struct hdac_ext_stream *link_dev =
+ snd_soc_dai_get_dma_data(dai, substream);
+ struct hdac_ext_link *link;
++ unsigned char stream_tag;
+
+ dev_dbg(dai->dev, "%s: %s\n", __func__, dai->name);
+
+@@ -649,7 +654,11 @@ static int skl_link_hw_free(struct snd_pcm_substream *substream,
+ if (!link)
+ return -EINVAL;
+
+- snd_hdac_ext_link_clear_stream_id(link, hdac_stream(link_dev)->stream_tag);
++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
++ stream_tag = hdac_stream(link_dev)->stream_tag;
++ snd_hdac_ext_link_clear_stream_id(link, stream_tag);
++ }
++
+ snd_hdac_ext_stream_release(link_dev, HDAC_EXT_STREAM_TYPE_LINK);
+ return 0;
+ }
+diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c
+index 400e29edb1c9..8a2e3bbce3a1 100644
+--- a/sound/soc/rockchip/rockchip_pdm.c
++++ b/sound/soc/rockchip/rockchip_pdm.c
+@@ -208,7 +208,9 @@ static int rockchip_pdm_set_fmt(struct snd_soc_dai *cpu_dai,
+ return -EINVAL;
+ }
+
++ pm_runtime_get_sync(cpu_dai->dev);
+ regmap_update_bits(pdm->regmap, PDM_CLK_CTRL, mask, val);
++ pm_runtime_put(cpu_dai->dev);
+
+ return 0;
+ }
+diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c
+index e7b371b07230..45c6d7396785 100644
+--- a/sound/soc/samsung/odroid.c
++++ b/sound/soc/samsung/odroid.c
+@@ -64,11 +64,11 @@ static int odroid_card_hw_params(struct snd_pcm_substream *substream,
+ return ret;
+
+ /*
+- * We add 1 to the rclk_freq value in order to avoid too low clock
++ * We add 2 to the rclk_freq value in order to avoid too low clock
+ * frequency values due to the EPLL output frequency not being exact
+ * multiple of the audio sampling rate.
+ */
+- rclk_freq = params_rate(params) * rfs + 1;
++ rclk_freq = params_rate(params) * rfs + 2;
+
+ ret = clk_set_rate(priv->sclk_i2s, rclk_freq);
+ if (ret < 0)
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 9b78fb3daa7b..2257b1b0151c 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3847,6 +3847,10 @@ snd_soc_dapm_free_kcontrol(struct snd_soc_card *card,
+ int count;
+
+ devm_kfree(card->dev, (void *)*private_value);
++
++ if (!w_param_text)
++ return;
++
+ for (count = 0 ; count < num_params; count++)
+ devm_kfree(card->dev, (void *)w_param_text[count]);
+ devm_kfree(card->dev, w_param_text);
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index e8b98bfd4cf1..33060af18b5a 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -957,10 +957,13 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream,
+ codec_params = *params;
+
+ /* fixup params based on TDM slot masks */
+- if (codec_dai->tx_mask)
++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
++ codec_dai->tx_mask)
+ soc_pcm_codec_params_fixup(&codec_params,
+ codec_dai->tx_mask);
+- if (codec_dai->rx_mask)
++
++ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE &&
++ codec_dai->rx_mask)
+ soc_pcm_codec_params_fixup(&codec_params,
+ codec_dai->rx_mask);
+
+diff --git a/sound/soc/stm/stm32_adfsdm.c b/sound/soc/stm/stm32_adfsdm.c
+index 706ff005234f..24948b95eb19 100644
+--- a/sound/soc/stm/stm32_adfsdm.c
++++ b/sound/soc/stm/stm32_adfsdm.c
+@@ -9,6 +9,7 @@
+
+ #include <linux/clk.h>
+ #include <linux/module.h>
++#include <linux/mutex.h>
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+
+@@ -37,6 +38,8 @@ struct stm32_adfsdm_priv {
+ /* PCM buffer */
+ unsigned char *pcm_buff;
+ unsigned int pos;
++
++ struct mutex lock; /* protect against race condition on iio state */
+ };
+
+ static const struct snd_pcm_hardware stm32_adfsdm_pcm_hw = {
+@@ -62,10 +65,12 @@ static void stm32_adfsdm_shutdown(struct snd_pcm_substream *substream,
+ {
+ struct stm32_adfsdm_priv *priv = snd_soc_dai_get_drvdata(dai);
+
++ mutex_lock(&priv->lock);
+ if (priv->iio_active) {
+ iio_channel_stop_all_cb(priv->iio_cb);
+ priv->iio_active = false;
+ }
++ mutex_unlock(&priv->lock);
+ }
+
+ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
+@@ -74,13 +79,19 @@ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
+ struct stm32_adfsdm_priv *priv = snd_soc_dai_get_drvdata(dai);
+ int ret;
+
++ mutex_lock(&priv->lock);
++ if (priv->iio_active) {
++ iio_channel_stop_all_cb(priv->iio_cb);
++ priv->iio_active = false;
++ }
++
+ ret = iio_write_channel_attribute(priv->iio_ch,
+ substream->runtime->rate, 0,
+ IIO_CHAN_INFO_SAMP_FREQ);
+ if (ret < 0) {
+ dev_err(dai->dev, "%s: Failed to set %d sampling rate\n",
+ __func__, substream->runtime->rate);
+- return ret;
++ goto out;
+ }
+
+ if (!priv->iio_active) {
+@@ -92,6 +103,9 @@ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
+ __func__, ret);
+ }
+
++out:
++ mutex_unlock(&priv->lock);
++
+ return ret;
+ }
+
+@@ -290,6 +304,7 @@ MODULE_DEVICE_TABLE(of, stm32_adfsdm_of_match);
+ static int stm32_adfsdm_probe(struct platform_device *pdev)
+ {
+ struct stm32_adfsdm_priv *priv;
++ struct snd_soc_component *component;
+ int ret;
+
+ priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+@@ -298,6 +313,7 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
+
+ priv->dev = &pdev->dev;
+ priv->dai_drv = stm32_adfsdm_dai;
++ mutex_init(&priv->lock);
+
+ dev_set_drvdata(&pdev->dev, priv);
+
+@@ -316,9 +332,15 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
+ if (IS_ERR(priv->iio_cb))
+ return PTR_ERR(priv->iio_cb);
+
+- ret = devm_snd_soc_register_component(&pdev->dev,
+- &stm32_adfsdm_soc_platform,
+- NULL, 0);
++ component = devm_kzalloc(&pdev->dev, sizeof(*component), GFP_KERNEL);
++ if (!component)
++ return -ENOMEM;
++#ifdef CONFIG_DEBUG_FS
++ component->debugfs_prefix = "pcm";
++#endif
++
++ ret = snd_soc_add_component(&pdev->dev, component,
++ &stm32_adfsdm_soc_platform, NULL, 0);
+ if (ret < 0)
+ dev_err(&pdev->dev, "%s: Failed to register PCM platform\n",
+ __func__);
+@@ -326,12 +348,20 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++static int stm32_adfsdm_remove(struct platform_device *pdev)
++{
++ snd_soc_unregister_component(&pdev->dev);
++
++ return 0;
++}
++
+ static struct platform_driver stm32_adfsdm_driver = {
+ .driver = {
+ .name = STM32_ADFSDM_DRV_NAME,
+ .of_match_table = stm32_adfsdm_of_match,
+ },
+ .probe = stm32_adfsdm_probe,
++ .remove = stm32_adfsdm_remove,
+ };
+
+ module_platform_driver(stm32_adfsdm_driver);
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index 85c4b6d8e89d..2fb2b914e78b 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -96,7 +96,7 @@
+ * @slot_mask: rx or tx active slots mask. set at init or at runtime
+ * @data_size: PCM data width. corresponds to PCM substream width.
+ * @spdif_frm_cnt: S/PDIF playback frame counter
+- * @snd_aes_iec958: iec958 data
++ * @iec958: iec958 data
+ * @ctrl_lock: control lock
+ */
+ struct stm32_sai_sub_data {
+@@ -498,6 +498,14 @@ static int stm32_sai_startup(struct snd_pcm_substream *substream,
+
+ sai->substream = substream;
+
++ if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) {
++ snd_pcm_hw_constraint_mask64(substream->runtime,
++ SNDRV_PCM_HW_PARAM_FORMAT,
++ SNDRV_PCM_FMTBIT_S32_LE);
++ snd_pcm_hw_constraint_single(substream->runtime,
++ SNDRV_PCM_HW_PARAM_CHANNELS, 2);
++ }
++
+ ret = clk_prepare_enable(sai->sai_ck);
+ if (ret < 0) {
+ dev_err(cpu_dai->dev, "Failed to enable clock: %d\n", ret);
+@@ -888,11 +896,12 @@ static int stm32_sai_pcm_new(struct snd_soc_pcm_runtime *rtd,
+ struct snd_soc_dai *cpu_dai)
+ {
+ struct stm32_sai_sub_data *sai = dev_get_drvdata(cpu_dai->dev);
++ struct snd_kcontrol_new knew = iec958_ctls;
+
+ if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) {
+ dev_dbg(&sai->pdev->dev, "%s: register iec controls", __func__);
+- return snd_ctl_add(rtd->pcm->card,
+- snd_ctl_new1(&iec958_ctls, sai));
++ knew.device = rtd->pcm->device;
++ return snd_ctl_add(rtd->pcm->card, snd_ctl_new1(&knew, sai));
+ }
+
+ return 0;
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 550f17611bd7..ef152daccc33 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -165,6 +165,7 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
+ "fortify_panic",
+ "usercopy_abort",
+ "machine_real_restart",
++ "rewind_stack_do_exit",
+ };
+
+ if (func->bind == STB_WEAK)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-05-14 21:00 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-05-14 21:00 UTC (permalink / raw
To: gentoo-commits
commit: e4f15aa89a4f85d797b8b3791b558ccd42bda503
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue May 14 21:00:26 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue May 14 21:00:26 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e4f15aa8
Linux patch 4.19.43
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1042_linux-4.19.43.patch | 3611 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3615 insertions(+)
diff --git a/0000_README b/0000_README
index 9a195d3..0fb9c26 100644
--- a/0000_README
+++ b/0000_README
@@ -211,6 +211,10 @@ Patch: 1041_linux-4.19.42.patch
From: http://www.kernel.org
Desc: Linux 4.19.42
+Patch: 1042_linux-4.19.43.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.43
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1042_linux-4.19.43.patch b/1042_linux-4.19.43.patch
new file mode 100644
index 0000000..e914c0a
--- /dev/null
+++ b/1042_linux-4.19.43.patch
@@ -0,0 +1,3611 @@
+diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
+index 73318225a368..8718d4ad227b 100644
+--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
++++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
+@@ -477,6 +477,7 @@ What: /sys/devices/system/cpu/vulnerabilities
+ /sys/devices/system/cpu/vulnerabilities/spectre_v2
+ /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
+ /sys/devices/system/cpu/vulnerabilities/l1tf
++ /sys/devices/system/cpu/vulnerabilities/mds
+ Date: January 2018
+ Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>
+ Description: Information about CPU vulnerabilities
+@@ -489,8 +490,7 @@ Description: Information about CPU vulnerabilities
+ "Vulnerable" CPU is affected and no mitigation in effect
+ "Mitigation: $M" CPU is affected and mitigation $M is in effect
+
+- Details about the l1tf file can be found in
+- Documentation/admin-guide/l1tf.rst
++ See also: Documentation/admin-guide/hw-vuln/index.rst
+
+ What: /sys/devices/system/cpu/smt
+ /sys/devices/system/cpu/smt/active
+diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst
+new file mode 100644
+index 000000000000..ffc064c1ec68
+--- /dev/null
++++ b/Documentation/admin-guide/hw-vuln/index.rst
+@@ -0,0 +1,13 @@
++========================
++Hardware vulnerabilities
++========================
++
++This section describes CPU vulnerabilities and provides an overview of the
++possible mitigations along with guidance for selecting mitigations if they
++are configurable at compile, boot or run time.
++
++.. toctree::
++ :maxdepth: 1
++
++ l1tf
++ mds
+diff --git a/Documentation/admin-guide/hw-vuln/l1tf.rst b/Documentation/admin-guide/hw-vuln/l1tf.rst
+new file mode 100644
+index 000000000000..31653a9f0e1b
+--- /dev/null
++++ b/Documentation/admin-guide/hw-vuln/l1tf.rst
+@@ -0,0 +1,615 @@
++L1TF - L1 Terminal Fault
++========================
++
++L1 Terminal Fault is a hardware vulnerability which allows unprivileged
++speculative access to data which is available in the Level 1 Data Cache
++when the page table entry controlling the virtual address, which is used
++for the access, has the Present bit cleared or other reserved bits set.
++
++Affected processors
++-------------------
++
++This vulnerability affects a wide range of Intel processors. The
++vulnerability is not present on:
++
++ - Processors from AMD, Centaur and other non Intel vendors
++
++ - Older processor models, where the CPU family is < 6
++
++ - A range of Intel ATOM processors (Cedarview, Cloverview, Lincroft,
++ Penwell, Pineview, Silvermont, Airmont, Merrifield)
++
++ - The Intel XEON PHI family
++
++ - Intel processors which have the ARCH_CAP_RDCL_NO bit set in the
++ IA32_ARCH_CAPABILITIES MSR. If the bit is set the CPU is not affected
++ by the Meltdown vulnerability either. These CPUs should become
++ available by end of 2018.
++
++Whether a processor is affected or not can be read out from the L1TF
++vulnerability file in sysfs. See :ref:`l1tf_sys_info`.
++
++Related CVEs
++------------
++
++The following CVE entries are related to the L1TF vulnerability:
++
++ ============= ================= ==============================
++ CVE-2018-3615 L1 Terminal Fault SGX related aspects
++ CVE-2018-3620 L1 Terminal Fault OS, SMM related aspects
++ CVE-2018-3646 L1 Terminal Fault Virtualization related aspects
++ ============= ================= ==============================
++
++Problem
++-------
++
++If an instruction accesses a virtual address for which the relevant page
++table entry (PTE) has the Present bit cleared or other reserved bits set,
++then speculative execution ignores the invalid PTE and loads the referenced
++data if it is present in the Level 1 Data Cache, as if the page referenced
++by the address bits in the PTE was still present and accessible.
++
++While this is a purely speculative mechanism and the instruction will raise
++a page fault when it is retired eventually, the pure act of loading the
++data and making it available to other speculative instructions opens up the
++opportunity for side channel attacks to unprivileged malicious code,
++similar to the Meltdown attack.
++
++While Meltdown breaks the user space to kernel space protection, L1TF
++allows to attack any physical memory address in the system and the attack
++works across all protection domains. It allows an attack of SGX and also
++works from inside virtual machines because the speculation bypasses the
++extended page table (EPT) protection mechanism.
++
++
++Attack scenarios
++----------------
++
++1. Malicious user space
++^^^^^^^^^^^^^^^^^^^^^^^
++
++ Operating Systems store arbitrary information in the address bits of a
++ PTE which is marked non present. This allows a malicious user space
++ application to attack the physical memory to which these PTEs resolve.
++ In some cases user-space can maliciously influence the information
++ encoded in the address bits of the PTE, thus making attacks more
++ deterministic and more practical.
++
++ The Linux kernel contains a mitigation for this attack vector, PTE
++ inversion, which is permanently enabled and has no performance
++ impact. The kernel ensures that the address bits of PTEs, which are not
++ marked present, never point to cacheable physical memory space.
++
++ A system with an up to date kernel is protected against attacks from
++ malicious user space applications.
++
++2. Malicious guest in a virtual machine
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ The fact that L1TF breaks all domain protections allows malicious guest
++ OSes, which can control the PTEs directly, and malicious guest user
++ space applications, which run on an unprotected guest kernel lacking the
++ PTE inversion mitigation for L1TF, to attack physical host memory.
++
++ A special aspect of L1TF in the context of virtualization is symmetric
++ multi threading (SMT). The Intel implementation of SMT is called
++ HyperThreading. The fact that Hyperthreads on the affected processors
++ share the L1 Data Cache (L1D) is important for this. As the flaw allows
++ only to attack data which is present in L1D, a malicious guest running
++ on one Hyperthread can attack the data which is brought into the L1D by
++ the context which runs on the sibling Hyperthread of the same physical
++ core. This context can be host OS, host user space or a different guest.
++
++ If the processor does not support Extended Page Tables, the attack is
++ only possible, when the hypervisor does not sanitize the content of the
++ effective (shadow) page tables.
++
++ While solutions exist to mitigate these attack vectors fully, these
++ mitigations are not enabled by default in the Linux kernel because they
++ can affect performance significantly. The kernel provides several
++ mechanisms which can be utilized to address the problem depending on the
++ deployment scenario. The mitigations, their protection scope and impact
++ are described in the next sections.
++
++ The default mitigations and the rationale for choosing them are explained
++ at the end of this document. See :ref:`default_mitigations`.
++
++.. _l1tf_sys_info:
++
++L1TF system information
++-----------------------
++
++The Linux kernel provides a sysfs interface to enumerate the current L1TF
++status of the system: whether the system is vulnerable, and which
++mitigations are active. The relevant sysfs file is:
++
++/sys/devices/system/cpu/vulnerabilities/l1tf
++
++The possible values in this file are:
++
++ =========================== ===============================
++ 'Not affected' The processor is not vulnerable
++ 'Mitigation: PTE Inversion' The host protection is active
++ =========================== ===============================
++
++If KVM/VMX is enabled and the processor is vulnerable then the following
++information is appended to the 'Mitigation: PTE Inversion' part:
++
++ - SMT status:
++
++ ===================== ================
++ 'VMX: SMT vulnerable' SMT is enabled
++ 'VMX: SMT disabled' SMT is disabled
++ ===================== ================
++
++ - L1D Flush mode:
++
++ ================================ ====================================
++ 'L1D vulnerable' L1D flushing is disabled
++
++ 'L1D conditional cache flushes' L1D flush is conditionally enabled
++
++ 'L1D cache flushes' L1D flush is unconditionally enabled
++ ================================ ====================================
++
++The resulting grade of protection is discussed in the following sections.
++
++
++Host mitigation mechanism
++-------------------------
++
++The kernel is unconditionally protected against L1TF attacks from malicious
++user space running on the host.
++
++
++Guest mitigation mechanisms
++---------------------------
++
++.. _l1d_flush:
++
++1. L1D flush on VMENTER
++^^^^^^^^^^^^^^^^^^^^^^^
++
++ To make sure that a guest cannot attack data which is present in the L1D
++ the hypervisor flushes the L1D before entering the guest.
++
++ Flushing the L1D evicts not only the data which should not be accessed
++ by a potentially malicious guest, it also flushes the guest
++ data. Flushing the L1D has a performance impact as the processor has to
++ bring the flushed guest data back into the L1D. Depending on the
++ frequency of VMEXIT/VMENTER and the type of computations in the guest
++ performance degradation in the range of 1% to 50% has been observed. For
++ scenarios where guest VMEXIT/VMENTER are rare the performance impact is
++ minimal. Virtio and mechanisms like posted interrupts are designed to
++ confine the VMEXITs to a bare minimum, but specific configurations and
++ application scenarios might still suffer from a high VMEXIT rate.
++
++ The kernel provides two L1D flush modes:
++ - conditional ('cond')
++ - unconditional ('always')
++
++ The conditional mode avoids L1D flushing after VMEXITs which execute
++ only audited code paths before the corresponding VMENTER. These code
++ paths have been verified that they cannot expose secrets or other
++ interesting data to an attacker, but they can leak information about the
++ address space layout of the hypervisor.
++
++ Unconditional mode flushes L1D on all VMENTER invocations and provides
++ maximum protection. It has a higher overhead than the conditional
++ mode. The overhead cannot be quantified correctly as it depends on the
++ workload scenario and the resulting number of VMEXITs.
++
++ The general recommendation is to enable L1D flush on VMENTER. The kernel
++ defaults to conditional mode on affected processors.
++
++ **Note**, that L1D flush does not prevent the SMT problem because the
++ sibling thread will also bring back its data into the L1D which makes it
++ attackable again.
++
++ L1D flush can be controlled by the administrator via the kernel command
++ line and sysfs control files. See :ref:`mitigation_control_command_line`
++ and :ref:`mitigation_control_kvm`.
++
++.. _guest_confinement:
++
++2. Guest VCPU confinement to dedicated physical cores
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ To address the SMT problem, it is possible to make a guest or a group of
++ guests affine to one or more physical cores. The proper mechanism for
++ that is to utilize exclusive cpusets to ensure that no other guest or
++ host tasks can run on these cores.
++
++ If only a single guest or related guests run on sibling SMT threads on
++ the same physical core then they can only attack their own memory and
++ restricted parts of the host memory.
++
++ Host memory is attackable, when one of the sibling SMT threads runs in
++ host OS (hypervisor) context and the other in guest context. The amount
++ of valuable information from the host OS context depends on the context
++ which the host OS executes, i.e. interrupts, soft interrupts and kernel
++ threads. The amount of valuable data from these contexts cannot be
++ declared as non-interesting for an attacker without deep inspection of
++ the code.
++
++ **Note**, that assigning guests to a fixed set of physical cores affects
++ the ability of the scheduler to do load balancing and might have
++ negative effects on CPU utilization depending on the hosting
++ scenario. Disabling SMT might be a viable alternative for particular
++ scenarios.
++
++ For further information about confining guests to a single or to a group
++ of cores consult the cpusets documentation:
++
++ https://www.kernel.org/doc/Documentation/cgroup-v1/cpusets.txt
++
++.. _interrupt_isolation:
++
++3. Interrupt affinity
++^^^^^^^^^^^^^^^^^^^^^
++
++ Interrupts can be made affine to logical CPUs. This is not universally
++ true because there are types of interrupts which are truly per CPU
++ interrupts, e.g. the local timer interrupt. Aside of that multi queue
++ devices affine their interrupts to single CPUs or groups of CPUs per
++ queue without allowing the administrator to control the affinities.
++
++ Moving the interrupts, which can be affinity controlled, away from CPUs
++ which run untrusted guests, reduces the attack vector space.
++
++ Whether the interrupts with are affine to CPUs, which run untrusted
++ guests, provide interesting data for an attacker depends on the system
++ configuration and the scenarios which run on the system. While for some
++ of the interrupts it can be assumed that they won't expose interesting
++ information beyond exposing hints about the host OS memory layout, there
++ is no way to make general assumptions.
++
++ Interrupt affinity can be controlled by the administrator via the
++ /proc/irq/$NR/smp_affinity[_list] files. Limited documentation is
++ available at:
++
++ https://www.kernel.org/doc/Documentation/IRQ-affinity.txt
++
++.. _smt_control:
++
++4. SMT control
++^^^^^^^^^^^^^^
++
++ To prevent the SMT issues of L1TF it might be necessary to disable SMT
++ completely. Disabling SMT can have a significant performance impact, but
++ the impact depends on the hosting scenario and the type of workloads.
++ The impact of disabling SMT needs also to be weighted against the impact
++ of other mitigation solutions like confining guests to dedicated cores.
++
++ The kernel provides a sysfs interface to retrieve the status of SMT and
++ to control it. It also provides a kernel command line interface to
++ control SMT.
++
++ The kernel command line interface consists of the following options:
++
++ =========== ==========================================================
++ nosmt Affects the bring up of the secondary CPUs during boot. The
++ kernel tries to bring all present CPUs online during the
++ boot process. "nosmt" makes sure that from each physical
++ core only one - the so called primary (hyper) thread is
++ activated. Due to a design flaw of Intel processors related
++ to Machine Check Exceptions the non primary siblings have
++ to be brought up at least partially and are then shut down
++ again. "nosmt" can be undone via the sysfs interface.
++
++ nosmt=force Has the same effect as "nosmt" but it does not allow to
++ undo the SMT disable via the sysfs interface.
++ =========== ==========================================================
++
++ The sysfs interface provides two files:
++
++ - /sys/devices/system/cpu/smt/control
++ - /sys/devices/system/cpu/smt/active
++
++ /sys/devices/system/cpu/smt/control:
++
++ This file allows to read out the SMT control state and provides the
++ ability to disable or (re)enable SMT. The possible states are:
++
++ ============== ===================================================
++ on SMT is supported by the CPU and enabled. All
++ logical CPUs can be onlined and offlined without
++ restrictions.
++
++ off SMT is supported by the CPU and disabled. Only
++ the so called primary SMT threads can be onlined
++ and offlined without restrictions. An attempt to
++ online a non-primary sibling is rejected
++
++ forceoff Same as 'off' but the state cannot be controlled.
++ Attempts to write to the control file are rejected.
++
++ notsupported The processor does not support SMT. It's therefore
++ not affected by the SMT implications of L1TF.
++ Attempts to write to the control file are rejected.
++ ============== ===================================================
++
++ The possible states which can be written into this file to control SMT
++ state are:
++
++ - on
++ - off
++ - forceoff
++
++ /sys/devices/system/cpu/smt/active:
++
++ This file reports whether SMT is enabled and active, i.e. if on any
++ physical core two or more sibling threads are online.
++
++ SMT control is also possible at boot time via the l1tf kernel command
++ line parameter in combination with L1D flush control. See
++ :ref:`mitigation_control_command_line`.
++
++5. Disabling EPT
++^^^^^^^^^^^^^^^^
++
++ Disabling EPT for virtual machines provides full mitigation for L1TF even
++ with SMT enabled, because the effective page tables for guests are
++ managed and sanitized by the hypervisor. Though disabling EPT has a
++ significant performance impact especially when the Meltdown mitigation
++ KPTI is enabled.
++
++ EPT can be disabled in the hypervisor via the 'kvm-intel.ept' parameter.
++
++There is ongoing research and development for new mitigation mechanisms to
++address the performance impact of disabling SMT or EPT.
++
++.. _mitigation_control_command_line:
++
++Mitigation control on the kernel command line
++---------------------------------------------
++
++The kernel command line allows to control the L1TF mitigations at boot
++time with the option "l1tf=". The valid arguments for this option are:
++
++ ============ =============================================================
++ full Provides all available mitigations for the L1TF
++ vulnerability. Disables SMT and enables all mitigations in
++ the hypervisors, i.e. unconditional L1D flushing
++
++ SMT control and L1D flush control via the sysfs interface
++ is still possible after boot. Hypervisors will issue a
++ warning when the first VM is started in a potentially
++ insecure configuration, i.e. SMT enabled or L1D flush
++ disabled.
++
++ full,force Same as 'full', but disables SMT and L1D flush runtime
++ control. Implies the 'nosmt=force' command line option.
++ (i.e. sysfs control of SMT is disabled.)
++
++ flush Leaves SMT enabled and enables the default hypervisor
++ mitigation, i.e. conditional L1D flushing
++
++ SMT control and L1D flush control via the sysfs interface
++ is still possible after boot. Hypervisors will issue a
++ warning when the first VM is started in a potentially
++ insecure configuration, i.e. SMT enabled or L1D flush
++ disabled.
++
++ flush,nosmt Disables SMT and enables the default hypervisor mitigation,
++ i.e. conditional L1D flushing.
++
++ SMT control and L1D flush control via the sysfs interface
++ is still possible after boot. Hypervisors will issue a
++ warning when the first VM is started in a potentially
++ insecure configuration, i.e. SMT enabled or L1D flush
++ disabled.
++
++ flush,nowarn Same as 'flush', but hypervisors will not warn when a VM is
++ started in a potentially insecure configuration.
++
++ off Disables hypervisor mitigations and doesn't emit any
++ warnings.
++ It also drops the swap size and available RAM limit restrictions
++ on both hypervisor and bare metal.
++
++ ============ =============================================================
++
++The default is 'flush'. For details about L1D flushing see :ref:`l1d_flush`.
++
++
++.. _mitigation_control_kvm:
++
++Mitigation control for KVM - module parameter
++-------------------------------------------------------------
++
++The KVM hypervisor mitigation mechanism, flushing the L1D cache when
++entering a guest, can be controlled with a module parameter.
++
++The option/parameter is "kvm-intel.vmentry_l1d_flush=". It takes the
++following arguments:
++
++ ============ ==============================================================
++ always L1D cache flush on every VMENTER.
++
++ cond Flush L1D on VMENTER only when the code between VMEXIT and
++ VMENTER can leak host memory which is considered
++ interesting for an attacker. This still can leak host memory
++ which allows e.g. to determine the hosts address space layout.
++
++ never Disables the mitigation
++ ============ ==============================================================
++
++The parameter can be provided on the kernel command line, as a module
++parameter when loading the modules and at runtime modified via the sysfs
++file:
++
++/sys/module/kvm_intel/parameters/vmentry_l1d_flush
++
++The default is 'cond'. If 'l1tf=full,force' is given on the kernel command
++line, then 'always' is enforced and the kvm-intel.vmentry_l1d_flush
++module parameter is ignored and writes to the sysfs file are rejected.
++
++.. _mitigation_selection:
++
++Mitigation selection guide
++--------------------------
++
++1. No virtualization in use
++^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ The system is protected by the kernel unconditionally and no further
++ action is required.
++
++2. Virtualization with trusted guests
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ If the guest comes from a trusted source and the guest OS kernel is
++ guaranteed to have the L1TF mitigations in place the system is fully
++ protected against L1TF and no further action is required.
++
++ To avoid the overhead of the default L1D flushing on VMENTER the
++ administrator can disable the flushing via the kernel command line and
++ sysfs control files. See :ref:`mitigation_control_command_line` and
++ :ref:`mitigation_control_kvm`.
++
++
++3. Virtualization with untrusted guests
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++3.1. SMT not supported or disabled
++""""""""""""""""""""""""""""""""""
++
++ If SMT is not supported by the processor or disabled in the BIOS or by
++ the kernel, it's only required to enforce L1D flushing on VMENTER.
++
++ Conditional L1D flushing is the default behaviour and can be tuned. See
++ :ref:`mitigation_control_command_line` and :ref:`mitigation_control_kvm`.
++
++3.2. EPT not supported or disabled
++""""""""""""""""""""""""""""""""""
++
++ If EPT is not supported by the processor or disabled in the hypervisor,
++ the system is fully protected. SMT can stay enabled and L1D flushing on
++ VMENTER is not required.
++
++ EPT can be disabled in the hypervisor via the 'kvm-intel.ept' parameter.
++
++3.3. SMT and EPT supported and active
++"""""""""""""""""""""""""""""""""""""
++
++ If SMT and EPT are supported and active then various degrees of
++ mitigations can be employed:
++
++ - L1D flushing on VMENTER:
++
++ L1D flushing on VMENTER is the minimal protection requirement, but it
++ is only potent in combination with other mitigation methods.
++
++ Conditional L1D flushing is the default behaviour and can be tuned. See
++ :ref:`mitigation_control_command_line` and :ref:`mitigation_control_kvm`.
++
++ - Guest confinement:
++
++ Confinement of guests to a single or a group of physical cores which
++ are not running any other processes, can reduce the attack surface
++ significantly, but interrupts, soft interrupts and kernel threads can
++ still expose valuable data to a potential attacker. See
++ :ref:`guest_confinement`.
++
++ - Interrupt isolation:
++
++ Isolating the guest CPUs from interrupts can reduce the attack surface
++ further, but still allows a malicious guest to explore a limited amount
++ of host physical memory. This can at least be used to gain knowledge
++ about the host address space layout. The interrupts which have a fixed
++ affinity to the CPUs which run the untrusted guests can depending on
++ the scenario still trigger soft interrupts and schedule kernel threads
++ which might expose valuable information. See
++ :ref:`interrupt_isolation`.
++
++The above three mitigation methods combined can provide protection to a
++certain degree, but the risk of the remaining attack surface has to be
++carefully analyzed. For full protection the following methods are
++available:
++
++ - Disabling SMT:
++
++ Disabling SMT and enforcing the L1D flushing provides the maximum
++ amount of protection. This mitigation is not depending on any of the
++ above mitigation methods.
++
++ SMT control and L1D flushing can be tuned by the command line
++ parameters 'nosmt', 'l1tf', 'kvm-intel.vmentry_l1d_flush' and at run
++ time with the matching sysfs control files. See :ref:`smt_control`,
++ :ref:`mitigation_control_command_line` and
++ :ref:`mitigation_control_kvm`.
++
++ - Disabling EPT:
++
++ Disabling EPT provides the maximum amount of protection as well. It is
++ not depending on any of the above mitigation methods. SMT can stay
++ enabled and L1D flushing is not required, but the performance impact is
++ significant.
++
++ EPT can be disabled in the hypervisor via the 'kvm-intel.ept'
++ parameter.
++
++3.4. Nested virtual machines
++""""""""""""""""""""""""""""
++
++When nested virtualization is in use, three operating systems are involved:
++the bare metal hypervisor, the nested hypervisor and the nested virtual
++machine. VMENTER operations from the nested hypervisor into the nested
++guest will always be processed by the bare metal hypervisor. If KVM is the
++bare metal hypervisor it will:
++
++ - Flush the L1D cache on every switch from the nested hypervisor to the
++ nested virtual machine, so that the nested hypervisor's secrets are not
++ exposed to the nested virtual machine;
++
++ - Flush the L1D cache on every switch from the nested virtual machine to
++ the nested hypervisor; this is a complex operation, and flushing the L1D
++ cache avoids that the bare metal hypervisor's secrets are exposed to the
++ nested virtual machine;
++
++ - Instruct the nested hypervisor to not perform any L1D cache flush. This
++ is an optimization to avoid double L1D flushing.
++
++
++.. _default_mitigations:
++
++Default mitigations
++-------------------
++
++ The kernel default mitigations for vulnerable processors are:
++
++ - PTE inversion to protect against malicious user space. This is done
++ unconditionally and cannot be controlled. The swap storage is limited
++ to ~16TB.
++
++ - L1D conditional flushing on VMENTER when EPT is enabled for
++ a guest.
++
++ The kernel does not by default enforce the disabling of SMT, which leaves
++ SMT systems vulnerable when running untrusted guests with EPT enabled.
++
++ The rationale for this choice is:
++
++ - Force disabling SMT can break existing setups, especially with
++ unattended updates.
++
++ - If regular users run untrusted guests on their machine, then L1TF is
++ just an add on to other malware which might be embedded in an untrusted
++ guest, e.g. spam-bots or attacks on the local network.
++
++ There is no technical way to prevent a user from running untrusted code
++ on their machines blindly.
++
++ - It's technically extremely unlikely and from today's knowledge even
++ impossible that L1TF can be exploited via the most popular attack
++ mechanisms like JavaScript because these mechanisms have no way to
++ control PTEs. If this would be possible and not other mitigation would
++ be possible, then the default might be different.
++
++ - The administrators of cloud and hosting setups have to carefully
++ analyze the risk for their scenarios and make the appropriate
++ mitigation choices, which might even vary across their deployed
++ machines and also result in other changes of their overall setup.
++ There is no way for the kernel to provide a sensible default for this
++ kind of scenarios.
+diff --git a/Documentation/admin-guide/hw-vuln/mds.rst b/Documentation/admin-guide/hw-vuln/mds.rst
+new file mode 100644
+index 000000000000..e3a796c0d3a2
+--- /dev/null
++++ b/Documentation/admin-guide/hw-vuln/mds.rst
+@@ -0,0 +1,308 @@
++MDS - Microarchitectural Data Sampling
++======================================
++
++Microarchitectural Data Sampling is a hardware vulnerability which allows
++unprivileged speculative access to data which is available in various CPU
++internal buffers.
++
++Affected processors
++-------------------
++
++This vulnerability affects a wide range of Intel processors. The
++vulnerability is not present on:
++
++ - Processors from AMD, Centaur and other non Intel vendors
++
++ - Older processor models, where the CPU family is < 6
++
++ - Some Atoms (Bonnell, Saltwell, Goldmont, GoldmontPlus)
++
++ - Intel processors which have the ARCH_CAP_MDS_NO bit set in the
++ IA32_ARCH_CAPABILITIES MSR.
++
++Whether a processor is affected or not can be read out from the MDS
++vulnerability file in sysfs. See :ref:`mds_sys_info`.
++
++Not all processors are affected by all variants of MDS, but the mitigation
++is identical for all of them so the kernel treats them as a single
++vulnerability.
++
++Related CVEs
++------------
++
++The following CVE entries are related to the MDS vulnerability:
++
++ ============== ===== ===================================================
++ CVE-2018-12126 MSBDS Microarchitectural Store Buffer Data Sampling
++ CVE-2018-12130 MFBDS Microarchitectural Fill Buffer Data Sampling
++ CVE-2018-12127 MLPDS Microarchitectural Load Port Data Sampling
++ CVE-2019-11091 MDSUM Microarchitectural Data Sampling Uncacheable Memory
++ ============== ===== ===================================================
++
++Problem
++-------
++
++When performing store, load, L1 refill operations, processors write data
++into temporary microarchitectural structures (buffers). The data in the
++buffer can be forwarded to load operations as an optimization.
++
++Under certain conditions, usually a fault/assist caused by a load
++operation, data unrelated to the load memory address can be speculatively
++forwarded from the buffers. Because the load operation causes a fault or
++assist and its result will be discarded, the forwarded data will not cause
++incorrect program execution or state changes. But a malicious operation
++may be able to forward this speculative data to a disclosure gadget which
++allows in turn to infer the value via a cache side channel attack.
++
++Because the buffers are potentially shared between Hyper-Threads cross
++Hyper-Thread attacks are possible.
++
++Deeper technical information is available in the MDS specific x86
++architecture section: :ref:`Documentation/x86/mds.rst <mds>`.
++
++
++Attack scenarios
++----------------
++
++Attacks against the MDS vulnerabilities can be mounted from malicious non
++priviledged user space applications running on hosts or guest. Malicious
++guest OSes can obviously mount attacks as well.
++
++Contrary to other speculation based vulnerabilities the MDS vulnerability
++does not allow the attacker to control the memory target address. As a
++consequence the attacks are purely sampling based, but as demonstrated with
++the TLBleed attack samples can be postprocessed successfully.
++
++Web-Browsers
++^^^^^^^^^^^^
++
++ It's unclear whether attacks through Web-Browsers are possible at
++ all. The exploitation through Java-Script is considered very unlikely,
++ but other widely used web technologies like Webassembly could possibly be
++ abused.
++
++
++.. _mds_sys_info:
++
++MDS system information
++-----------------------
++
++The Linux kernel provides a sysfs interface to enumerate the current MDS
++status of the system: whether the system is vulnerable, and which
++mitigations are active. The relevant sysfs file is:
++
++/sys/devices/system/cpu/vulnerabilities/mds
++
++The possible values in this file are:
++
++ .. list-table::
++
++ * - 'Not affected'
++ - The processor is not vulnerable
++ * - 'Vulnerable'
++ - The processor is vulnerable, but no mitigation enabled
++ * - 'Vulnerable: Clear CPU buffers attempted, no microcode'
++ - The processor is vulnerable but microcode is not updated.
++
++ The mitigation is enabled on a best effort basis. See :ref:`vmwerv`
++ * - 'Mitigation: Clear CPU buffers'
++ - The processor is vulnerable and the CPU buffer clearing mitigation is
++ enabled.
++
++If the processor is vulnerable then the following information is appended
++to the above information:
++
++ ======================== ============================================
++ 'SMT vulnerable' SMT is enabled
++ 'SMT mitigated' SMT is enabled and mitigated
++ 'SMT disabled' SMT is disabled
++ 'SMT Host state unknown' Kernel runs in a VM, Host SMT state unknown
++ ======================== ============================================
++
++.. _vmwerv:
++
++Best effort mitigation mode
++^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ If the processor is vulnerable, but the availability of the microcode based
++ mitigation mechanism is not advertised via CPUID the kernel selects a best
++ effort mitigation mode. This mode invokes the mitigation instructions
++ without a guarantee that they clear the CPU buffers.
++
++ This is done to address virtualization scenarios where the host has the
++ microcode update applied, but the hypervisor is not yet updated to expose
++ the CPUID to the guest. If the host has updated microcode the protection
++ takes effect otherwise a few cpu cycles are wasted pointlessly.
++
++ The state in the mds sysfs file reflects this situation accordingly.
++
++
++Mitigation mechanism
++-------------------------
++
++The kernel detects the affected CPUs and the presence of the microcode
++which is required.
++
++If a CPU is affected and the microcode is available, then the kernel
++enables the mitigation by default. The mitigation can be controlled at boot
++time via a kernel command line option. See
++:ref:`mds_mitigation_control_command_line`.
++
++.. _cpu_buffer_clear:
++
++CPU buffer clearing
++^^^^^^^^^^^^^^^^^^^
++
++ The mitigation for MDS clears the affected CPU buffers on return to user
++ space and when entering a guest.
++
++ If SMT is enabled it also clears the buffers on idle entry when the CPU
++ is only affected by MSBDS and not any other MDS variant, because the
++ other variants cannot be protected against cross Hyper-Thread attacks.
++
++ For CPUs which are only affected by MSBDS the user space, guest and idle
++ transition mitigations are sufficient and SMT is not affected.
++
++.. _virt_mechanism:
++
++Virtualization mitigation
++^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ The protection for host to guest transition depends on the L1TF
++ vulnerability of the CPU:
++
++ - CPU is affected by L1TF:
++
++ If the L1D flush mitigation is enabled and up to date microcode is
++ available, the L1D flush mitigation is automatically protecting the
++ guest transition.
++
++ If the L1D flush mitigation is disabled then the MDS mitigation is
++ invoked explicit when the host MDS mitigation is enabled.
++
++ For details on L1TF and virtualization see:
++ :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst <mitigation_control_kvm>`.
++
++ - CPU is not affected by L1TF:
++
++ CPU buffers are flushed before entering the guest when the host MDS
++ mitigation is enabled.
++
++ The resulting MDS protection matrix for the host to guest transition:
++
++ ============ ===== ============= ============ =================
++ L1TF MDS VMX-L1FLUSH Host MDS MDS-State
++
++ Don't care No Don't care N/A Not affected
++
++ Yes Yes Disabled Off Vulnerable
++
++ Yes Yes Disabled Full Mitigated
++
++ Yes Yes Enabled Don't care Mitigated
++
++ No Yes N/A Off Vulnerable
++
++ No Yes N/A Full Mitigated
++ ============ ===== ============= ============ =================
++
++ This only covers the host to guest transition, i.e. prevents leakage from
++ host to guest, but does not protect the guest internally. Guests need to
++ have their own protections.
++
++.. _xeon_phi:
++
++XEON PHI specific considerations
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ The XEON PHI processor family is affected by MSBDS which can be exploited
++ cross Hyper-Threads when entering idle states. Some XEON PHI variants allow
++ to use MWAIT in user space (Ring 3) which opens an potential attack vector
++ for malicious user space. The exposure can be disabled on the kernel
++ command line with the 'ring3mwait=disable' command line option.
++
++ XEON PHI is not affected by the other MDS variants and MSBDS is mitigated
++ before the CPU enters a idle state. As XEON PHI is not affected by L1TF
++ either disabling SMT is not required for full protection.
++
++.. _mds_smt_control:
++
++SMT control
++^^^^^^^^^^^
++
++ All MDS variants except MSBDS can be attacked cross Hyper-Threads. That
++ means on CPUs which are affected by MFBDS or MLPDS it is necessary to
++ disable SMT for full protection. These are most of the affected CPUs; the
++ exception is XEON PHI, see :ref:`xeon_phi`.
++
++ Disabling SMT can have a significant performance impact, but the impact
++ depends on the type of workloads.
++
++ See the relevant chapter in the L1TF mitigation documentation for details:
++ :ref:`Documentation/admin-guide/hw-vuln/l1tf.rst <smt_control>`.
++
++
++.. _mds_mitigation_control_command_line:
++
++Mitigation control on the kernel command line
++---------------------------------------------
++
++The kernel command line allows to control the MDS mitigations at boot
++time with the option "mds=". The valid arguments for this option are:
++
++ ============ =============================================================
++ full If the CPU is vulnerable, enable all available mitigations
++ for the MDS vulnerability, CPU buffer clearing on exit to
++ userspace and when entering a VM. Idle transitions are
++ protected as well if SMT is enabled.
++
++ It does not automatically disable SMT.
++
++ full,nosmt The same as mds=full, with SMT disabled on vulnerable
++ CPUs. This is the complete mitigation.
++
++ off Disables MDS mitigations completely.
++
++ ============ =============================================================
++
++Not specifying this option is equivalent to "mds=full".
++
++
++Mitigation selection guide
++--------------------------
++
++1. Trusted userspace
++^^^^^^^^^^^^^^^^^^^^
++
++ If all userspace applications are from a trusted source and do not
++ execute untrusted code which is supplied externally, then the mitigation
++ can be disabled.
++
++
++2. Virtualization with trusted guests
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ The same considerations as above versus trusted user space apply.
++
++3. Virtualization with untrusted guests
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ The protection depends on the state of the L1TF mitigations.
++ See :ref:`virt_mechanism`.
++
++ If the MDS mitigation is enabled and SMT is disabled, guest to host and
++ guest to guest attacks are prevented.
++
++.. _mds_default_mitigations:
++
++Default mitigations
++-------------------
++
++ The kernel default mitigations for vulnerable processors are:
++
++ - Enable CPU buffer clearing
++
++ The kernel does not by default enforce the disabling of SMT, which leaves
++ SMT systems vulnerable when running untrusted code. The same rationale as
++ for L1TF applies.
++ See :ref:`Documentation/admin-guide/hw-vuln//l1tf.rst <default_mitigations>`.
+diff --git a/Documentation/admin-guide/index.rst b/Documentation/admin-guide/index.rst
+index 0873685bab0f..89abc5057349 100644
+--- a/Documentation/admin-guide/index.rst
++++ b/Documentation/admin-guide/index.rst
+@@ -17,14 +17,12 @@ etc.
+ kernel-parameters
+ devices
+
+-This section describes CPU vulnerabilities and provides an overview of the
+-possible mitigations along with guidance for selecting mitigations if they
+-are configurable at compile, boot or run time.
++This section describes CPU vulnerabilities and their mitigations.
+
+ .. toctree::
+ :maxdepth: 1
+
+- l1tf
++ hw-vuln/index
+
+ Here is a set of documents aimed at users who are trying to track down
+ problems and bugs in particular.
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 8b6567f7cb9b..a29301d6e6c6 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2079,7 +2079,7 @@
+
+ Default is 'flush'.
+
+- For details see: Documentation/admin-guide/l1tf.rst
++ For details see: Documentation/admin-guide/hw-vuln/l1tf.rst
+
+ l2cr= [PPC]
+
+@@ -2319,6 +2319,32 @@
+ Format: <first>,<last>
+ Specifies range of consoles to be captured by the MDA.
+
++ mds= [X86,INTEL]
++ Control mitigation for the Micro-architectural Data
++ Sampling (MDS) vulnerability.
++
++ Certain CPUs are vulnerable to an exploit against CPU
++ internal buffers which can forward information to a
++ disclosure gadget under certain conditions.
++
++ In vulnerable processors, the speculatively
++ forwarded data can be used in a cache side channel
++ attack, to access data to which the attacker does
++ not have direct access.
++
++ This parameter controls the MDS mitigation. The
++ options are:
++
++ full - Enable MDS mitigation on vulnerable CPUs
++ full,nosmt - Enable MDS mitigation and disable
++ SMT on vulnerable CPUs
++ off - Unconditionally disable MDS mitigation
++
++ Not specifying this option is equivalent to
++ mds=full.
++
++ For details see: Documentation/admin-guide/hw-vuln/mds.rst
++
+ mem=nn[KMG] [KNL,BOOT] Force usage of a specific amount of memory
+ Amount of memory to be used when the kernel is not able
+ to see the whole system memory or for test.
+@@ -2476,6 +2502,40 @@
+ in the "bleeding edge" mini2440 support kernel at
+ http://repo.or.cz/w/linux-2.6/mini2440.git
+
++ mitigations=
++ [X86,PPC,S390] Control optional mitigations for CPU
++ vulnerabilities. This is a set of curated,
++ arch-independent options, each of which is an
++ aggregation of existing arch-specific options.
++
++ off
++ Disable all optional CPU mitigations. This
++ improves system performance, but it may also
++ expose users to several CPU vulnerabilities.
++ Equivalent to: nopti [X86,PPC]
++ nospectre_v1 [PPC]
++ nobp=0 [S390]
++ nospectre_v2 [X86,PPC,S390]
++ spectre_v2_user=off [X86]
++ spec_store_bypass_disable=off [X86,PPC]
++ l1tf=off [X86]
++ mds=off [X86]
++
++ auto (default)
++ Mitigate all CPU vulnerabilities, but leave SMT
++ enabled, even if it's vulnerable. This is for
++ users who don't want to be surprised by SMT
++ getting disabled across kernel upgrades, or who
++ have other ways of avoiding SMT-based attacks.
++ Equivalent to: (default behavior)
++
++ auto,nosmt
++ Mitigate all CPU vulnerabilities, disabling SMT
++ if needed. This is for users who always want to
++ be fully mitigated, even if it means losing SMT.
++ Equivalent to: l1tf=flush,nosmt [X86]
++ mds=full,nosmt [X86]
++
+ mminit_loglevel=
+ [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this
+ parameter allows control of the logging verbosity for
+diff --git a/Documentation/admin-guide/l1tf.rst b/Documentation/admin-guide/l1tf.rst
+deleted file mode 100644
+index 9f5924f81f89..000000000000
+--- a/Documentation/admin-guide/l1tf.rst
++++ /dev/null
+@@ -1,614 +0,0 @@
+-L1TF - L1 Terminal Fault
+-========================
+-
+-L1 Terminal Fault is a hardware vulnerability which allows unprivileged
+-speculative access to data which is available in the Level 1 Data Cache
+-when the page table entry controlling the virtual address, which is used
+-for the access, has the Present bit cleared or other reserved bits set.
+-
+-Affected processors
+--------------------
+-
+-This vulnerability affects a wide range of Intel processors. The
+-vulnerability is not present on:
+-
+- - Processors from AMD, Centaur and other non Intel vendors
+-
+- - Older processor models, where the CPU family is < 6
+-
+- - A range of Intel ATOM processors (Cedarview, Cloverview, Lincroft,
+- Penwell, Pineview, Silvermont, Airmont, Merrifield)
+-
+- - The Intel XEON PHI family
+-
+- - Intel processors which have the ARCH_CAP_RDCL_NO bit set in the
+- IA32_ARCH_CAPABILITIES MSR. If the bit is set the CPU is not affected
+- by the Meltdown vulnerability either. These CPUs should become
+- available by end of 2018.
+-
+-Whether a processor is affected or not can be read out from the L1TF
+-vulnerability file in sysfs. See :ref:`l1tf_sys_info`.
+-
+-Related CVEs
+-------------
+-
+-The following CVE entries are related to the L1TF vulnerability:
+-
+- ============= ================= ==============================
+- CVE-2018-3615 L1 Terminal Fault SGX related aspects
+- CVE-2018-3620 L1 Terminal Fault OS, SMM related aspects
+- CVE-2018-3646 L1 Terminal Fault Virtualization related aspects
+- ============= ================= ==============================
+-
+-Problem
+--------
+-
+-If an instruction accesses a virtual address for which the relevant page
+-table entry (PTE) has the Present bit cleared or other reserved bits set,
+-then speculative execution ignores the invalid PTE and loads the referenced
+-data if it is present in the Level 1 Data Cache, as if the page referenced
+-by the address bits in the PTE was still present and accessible.
+-
+-While this is a purely speculative mechanism and the instruction will raise
+-a page fault when it is retired eventually, the pure act of loading the
+-data and making it available to other speculative instructions opens up the
+-opportunity for side channel attacks to unprivileged malicious code,
+-similar to the Meltdown attack.
+-
+-While Meltdown breaks the user space to kernel space protection, L1TF
+-allows to attack any physical memory address in the system and the attack
+-works across all protection domains. It allows an attack of SGX and also
+-works from inside virtual machines because the speculation bypasses the
+-extended page table (EPT) protection mechanism.
+-
+-
+-Attack scenarios
+-----------------
+-
+-1. Malicious user space
+-^^^^^^^^^^^^^^^^^^^^^^^
+-
+- Operating Systems store arbitrary information in the address bits of a
+- PTE which is marked non present. This allows a malicious user space
+- application to attack the physical memory to which these PTEs resolve.
+- In some cases user-space can maliciously influence the information
+- encoded in the address bits of the PTE, thus making attacks more
+- deterministic and more practical.
+-
+- The Linux kernel contains a mitigation for this attack vector, PTE
+- inversion, which is permanently enabled and has no performance
+- impact. The kernel ensures that the address bits of PTEs, which are not
+- marked present, never point to cacheable physical memory space.
+-
+- A system with an up to date kernel is protected against attacks from
+- malicious user space applications.
+-
+-2. Malicious guest in a virtual machine
+-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+-
+- The fact that L1TF breaks all domain protections allows malicious guest
+- OSes, which can control the PTEs directly, and malicious guest user
+- space applications, which run on an unprotected guest kernel lacking the
+- PTE inversion mitigation for L1TF, to attack physical host memory.
+-
+- A special aspect of L1TF in the context of virtualization is symmetric
+- multi threading (SMT). The Intel implementation of SMT is called
+- HyperThreading. The fact that Hyperthreads on the affected processors
+- share the L1 Data Cache (L1D) is important for this. As the flaw allows
+- only to attack data which is present in L1D, a malicious guest running
+- on one Hyperthread can attack the data which is brought into the L1D by
+- the context which runs on the sibling Hyperthread of the same physical
+- core. This context can be host OS, host user space or a different guest.
+-
+- If the processor does not support Extended Page Tables, the attack is
+- only possible, when the hypervisor does not sanitize the content of the
+- effective (shadow) page tables.
+-
+- While solutions exist to mitigate these attack vectors fully, these
+- mitigations are not enabled by default in the Linux kernel because they
+- can affect performance significantly. The kernel provides several
+- mechanisms which can be utilized to address the problem depending on the
+- deployment scenario. The mitigations, their protection scope and impact
+- are described in the next sections.
+-
+- The default mitigations and the rationale for choosing them are explained
+- at the end of this document. See :ref:`default_mitigations`.
+-
+-.. _l1tf_sys_info:
+-
+-L1TF system information
+------------------------
+-
+-The Linux kernel provides a sysfs interface to enumerate the current L1TF
+-status of the system: whether the system is vulnerable, and which
+-mitigations are active. The relevant sysfs file is:
+-
+-/sys/devices/system/cpu/vulnerabilities/l1tf
+-
+-The possible values in this file are:
+-
+- =========================== ===============================
+- 'Not affected' The processor is not vulnerable
+- 'Mitigation: PTE Inversion' The host protection is active
+- =========================== ===============================
+-
+-If KVM/VMX is enabled and the processor is vulnerable then the following
+-information is appended to the 'Mitigation: PTE Inversion' part:
+-
+- - SMT status:
+-
+- ===================== ================
+- 'VMX: SMT vulnerable' SMT is enabled
+- 'VMX: SMT disabled' SMT is disabled
+- ===================== ================
+-
+- - L1D Flush mode:
+-
+- ================================ ====================================
+- 'L1D vulnerable' L1D flushing is disabled
+-
+- 'L1D conditional cache flushes' L1D flush is conditionally enabled
+-
+- 'L1D cache flushes' L1D flush is unconditionally enabled
+- ================================ ====================================
+-
+-The resulting grade of protection is discussed in the following sections.
+-
+-
+-Host mitigation mechanism
+--------------------------
+-
+-The kernel is unconditionally protected against L1TF attacks from malicious
+-user space running on the host.
+-
+-
+-Guest mitigation mechanisms
+----------------------------
+-
+-.. _l1d_flush:
+-
+-1. L1D flush on VMENTER
+-^^^^^^^^^^^^^^^^^^^^^^^
+-
+- To make sure that a guest cannot attack data which is present in the L1D
+- the hypervisor flushes the L1D before entering the guest.
+-
+- Flushing the L1D evicts not only the data which should not be accessed
+- by a potentially malicious guest, it also flushes the guest
+- data. Flushing the L1D has a performance impact as the processor has to
+- bring the flushed guest data back into the L1D. Depending on the
+- frequency of VMEXIT/VMENTER and the type of computations in the guest
+- performance degradation in the range of 1% to 50% has been observed. For
+- scenarios where guest VMEXIT/VMENTER are rare the performance impact is
+- minimal. Virtio and mechanisms like posted interrupts are designed to
+- confine the VMEXITs to a bare minimum, but specific configurations and
+- application scenarios might still suffer from a high VMEXIT rate.
+-
+- The kernel provides two L1D flush modes:
+- - conditional ('cond')
+- - unconditional ('always')
+-
+- The conditional mode avoids L1D flushing after VMEXITs which execute
+- only audited code paths before the corresponding VMENTER. These code
+- paths have been verified that they cannot expose secrets or other
+- interesting data to an attacker, but they can leak information about the
+- address space layout of the hypervisor.
+-
+- Unconditional mode flushes L1D on all VMENTER invocations and provides
+- maximum protection. It has a higher overhead than the conditional
+- mode. The overhead cannot be quantified correctly as it depends on the
+- workload scenario and the resulting number of VMEXITs.
+-
+- The general recommendation is to enable L1D flush on VMENTER. The kernel
+- defaults to conditional mode on affected processors.
+-
+- **Note**, that L1D flush does not prevent the SMT problem because the
+- sibling thread will also bring back its data into the L1D which makes it
+- attackable again.
+-
+- L1D flush can be controlled by the administrator via the kernel command
+- line and sysfs control files. See :ref:`mitigation_control_command_line`
+- and :ref:`mitigation_control_kvm`.
+-
+-.. _guest_confinement:
+-
+-2. Guest VCPU confinement to dedicated physical cores
+-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+-
+- To address the SMT problem, it is possible to make a guest or a group of
+- guests affine to one or more physical cores. The proper mechanism for
+- that is to utilize exclusive cpusets to ensure that no other guest or
+- host tasks can run on these cores.
+-
+- If only a single guest or related guests run on sibling SMT threads on
+- the same physical core then they can only attack their own memory and
+- restricted parts of the host memory.
+-
+- Host memory is attackable, when one of the sibling SMT threads runs in
+- host OS (hypervisor) context and the other in guest context. The amount
+- of valuable information from the host OS context depends on the context
+- which the host OS executes, i.e. interrupts, soft interrupts and kernel
+- threads. The amount of valuable data from these contexts cannot be
+- declared as non-interesting for an attacker without deep inspection of
+- the code.
+-
+- **Note**, that assigning guests to a fixed set of physical cores affects
+- the ability of the scheduler to do load balancing and might have
+- negative effects on CPU utilization depending on the hosting
+- scenario. Disabling SMT might be a viable alternative for particular
+- scenarios.
+-
+- For further information about confining guests to a single or to a group
+- of cores consult the cpusets documentation:
+-
+- https://www.kernel.org/doc/Documentation/cgroup-v1/cpusets.txt
+-
+-.. _interrupt_isolation:
+-
+-3. Interrupt affinity
+-^^^^^^^^^^^^^^^^^^^^^
+-
+- Interrupts can be made affine to logical CPUs. This is not universally
+- true because there are types of interrupts which are truly per CPU
+- interrupts, e.g. the local timer interrupt. Aside of that multi queue
+- devices affine their interrupts to single CPUs or groups of CPUs per
+- queue without allowing the administrator to control the affinities.
+-
+- Moving the interrupts, which can be affinity controlled, away from CPUs
+- which run untrusted guests, reduces the attack vector space.
+-
+- Whether the interrupts with are affine to CPUs, which run untrusted
+- guests, provide interesting data for an attacker depends on the system
+- configuration and the scenarios which run on the system. While for some
+- of the interrupts it can be assumed that they won't expose interesting
+- information beyond exposing hints about the host OS memory layout, there
+- is no way to make general assumptions.
+-
+- Interrupt affinity can be controlled by the administrator via the
+- /proc/irq/$NR/smp_affinity[_list] files. Limited documentation is
+- available at:
+-
+- https://www.kernel.org/doc/Documentation/IRQ-affinity.txt
+-
+-.. _smt_control:
+-
+-4. SMT control
+-^^^^^^^^^^^^^^
+-
+- To prevent the SMT issues of L1TF it might be necessary to disable SMT
+- completely. Disabling SMT can have a significant performance impact, but
+- the impact depends on the hosting scenario and the type of workloads.
+- The impact of disabling SMT needs also to be weighted against the impact
+- of other mitigation solutions like confining guests to dedicated cores.
+-
+- The kernel provides a sysfs interface to retrieve the status of SMT and
+- to control it. It also provides a kernel command line interface to
+- control SMT.
+-
+- The kernel command line interface consists of the following options:
+-
+- =========== ==========================================================
+- nosmt Affects the bring up of the secondary CPUs during boot. The
+- kernel tries to bring all present CPUs online during the
+- boot process. "nosmt" makes sure that from each physical
+- core only one - the so called primary (hyper) thread is
+- activated. Due to a design flaw of Intel processors related
+- to Machine Check Exceptions the non primary siblings have
+- to be brought up at least partially and are then shut down
+- again. "nosmt" can be undone via the sysfs interface.
+-
+- nosmt=force Has the same effect as "nosmt" but it does not allow to
+- undo the SMT disable via the sysfs interface.
+- =========== ==========================================================
+-
+- The sysfs interface provides two files:
+-
+- - /sys/devices/system/cpu/smt/control
+- - /sys/devices/system/cpu/smt/active
+-
+- /sys/devices/system/cpu/smt/control:
+-
+- This file allows to read out the SMT control state and provides the
+- ability to disable or (re)enable SMT. The possible states are:
+-
+- ============== ===================================================
+- on SMT is supported by the CPU and enabled. All
+- logical CPUs can be onlined and offlined without
+- restrictions.
+-
+- off SMT is supported by the CPU and disabled. Only
+- the so called primary SMT threads can be onlined
+- and offlined without restrictions. An attempt to
+- online a non-primary sibling is rejected
+-
+- forceoff Same as 'off' but the state cannot be controlled.
+- Attempts to write to the control file are rejected.
+-
+- notsupported The processor does not support SMT. It's therefore
+- not affected by the SMT implications of L1TF.
+- Attempts to write to the control file are rejected.
+- ============== ===================================================
+-
+- The possible states which can be written into this file to control SMT
+- state are:
+-
+- - on
+- - off
+- - forceoff
+-
+- /sys/devices/system/cpu/smt/active:
+-
+- This file reports whether SMT is enabled and active, i.e. if on any
+- physical core two or more sibling threads are online.
+-
+- SMT control is also possible at boot time via the l1tf kernel command
+- line parameter in combination with L1D flush control. See
+- :ref:`mitigation_control_command_line`.
+-
+-5. Disabling EPT
+-^^^^^^^^^^^^^^^^
+-
+- Disabling EPT for virtual machines provides full mitigation for L1TF even
+- with SMT enabled, because the effective page tables for guests are
+- managed and sanitized by the hypervisor. Though disabling EPT has a
+- significant performance impact especially when the Meltdown mitigation
+- KPTI is enabled.
+-
+- EPT can be disabled in the hypervisor via the 'kvm-intel.ept' parameter.
+-
+-There is ongoing research and development for new mitigation mechanisms to
+-address the performance impact of disabling SMT or EPT.
+-
+-.. _mitigation_control_command_line:
+-
+-Mitigation control on the kernel command line
+----------------------------------------------
+-
+-The kernel command line allows to control the L1TF mitigations at boot
+-time with the option "l1tf=". The valid arguments for this option are:
+-
+- ============ =============================================================
+- full Provides all available mitigations for the L1TF
+- vulnerability. Disables SMT and enables all mitigations in
+- the hypervisors, i.e. unconditional L1D flushing
+-
+- SMT control and L1D flush control via the sysfs interface
+- is still possible after boot. Hypervisors will issue a
+- warning when the first VM is started in a potentially
+- insecure configuration, i.e. SMT enabled or L1D flush
+- disabled.
+-
+- full,force Same as 'full', but disables SMT and L1D flush runtime
+- control. Implies the 'nosmt=force' command line option.
+- (i.e. sysfs control of SMT is disabled.)
+-
+- flush Leaves SMT enabled and enables the default hypervisor
+- mitigation, i.e. conditional L1D flushing
+-
+- SMT control and L1D flush control via the sysfs interface
+- is still possible after boot. Hypervisors will issue a
+- warning when the first VM is started in a potentially
+- insecure configuration, i.e. SMT enabled or L1D flush
+- disabled.
+-
+- flush,nosmt Disables SMT and enables the default hypervisor mitigation,
+- i.e. conditional L1D flushing.
+-
+- SMT control and L1D flush control via the sysfs interface
+- is still possible after boot. Hypervisors will issue a
+- warning when the first VM is started in a potentially
+- insecure configuration, i.e. SMT enabled or L1D flush
+- disabled.
+-
+- flush,nowarn Same as 'flush', but hypervisors will not warn when a VM is
+- started in a potentially insecure configuration.
+-
+- off Disables hypervisor mitigations and doesn't emit any
+- warnings.
+- It also drops the swap size and available RAM limit restrictions
+- on both hypervisor and bare metal.
+-
+- ============ =============================================================
+-
+-The default is 'flush'. For details about L1D flushing see :ref:`l1d_flush`.
+-
+-
+-.. _mitigation_control_kvm:
+-
+-Mitigation control for KVM - module parameter
+--------------------------------------------------------------
+-
+-The KVM hypervisor mitigation mechanism, flushing the L1D cache when
+-entering a guest, can be controlled with a module parameter.
+-
+-The option/parameter is "kvm-intel.vmentry_l1d_flush=". It takes the
+-following arguments:
+-
+- ============ ==============================================================
+- always L1D cache flush on every VMENTER.
+-
+- cond Flush L1D on VMENTER only when the code between VMEXIT and
+- VMENTER can leak host memory which is considered
+- interesting for an attacker. This still can leak host memory
+- which allows e.g. to determine the hosts address space layout.
+-
+- never Disables the mitigation
+- ============ ==============================================================
+-
+-The parameter can be provided on the kernel command line, as a module
+-parameter when loading the modules and at runtime modified via the sysfs
+-file:
+-
+-/sys/module/kvm_intel/parameters/vmentry_l1d_flush
+-
+-The default is 'cond'. If 'l1tf=full,force' is given on the kernel command
+-line, then 'always' is enforced and the kvm-intel.vmentry_l1d_flush
+-module parameter is ignored and writes to the sysfs file are rejected.
+-
+-
+-Mitigation selection guide
+---------------------------
+-
+-1. No virtualization in use
+-^^^^^^^^^^^^^^^^^^^^^^^^^^^
+-
+- The system is protected by the kernel unconditionally and no further
+- action is required.
+-
+-2. Virtualization with trusted guests
+-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+-
+- If the guest comes from a trusted source and the guest OS kernel is
+- guaranteed to have the L1TF mitigations in place the system is fully
+- protected against L1TF and no further action is required.
+-
+- To avoid the overhead of the default L1D flushing on VMENTER the
+- administrator can disable the flushing via the kernel command line and
+- sysfs control files. See :ref:`mitigation_control_command_line` and
+- :ref:`mitigation_control_kvm`.
+-
+-
+-3. Virtualization with untrusted guests
+-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+-
+-3.1. SMT not supported or disabled
+-""""""""""""""""""""""""""""""""""
+-
+- If SMT is not supported by the processor or disabled in the BIOS or by
+- the kernel, it's only required to enforce L1D flushing on VMENTER.
+-
+- Conditional L1D flushing is the default behaviour and can be tuned. See
+- :ref:`mitigation_control_command_line` and :ref:`mitigation_control_kvm`.
+-
+-3.2. EPT not supported or disabled
+-""""""""""""""""""""""""""""""""""
+-
+- If EPT is not supported by the processor or disabled in the hypervisor,
+- the system is fully protected. SMT can stay enabled and L1D flushing on
+- VMENTER is not required.
+-
+- EPT can be disabled in the hypervisor via the 'kvm-intel.ept' parameter.
+-
+-3.3. SMT and EPT supported and active
+-"""""""""""""""""""""""""""""""""""""
+-
+- If SMT and EPT are supported and active then various degrees of
+- mitigations can be employed:
+-
+- - L1D flushing on VMENTER:
+-
+- L1D flushing on VMENTER is the minimal protection requirement, but it
+- is only potent in combination with other mitigation methods.
+-
+- Conditional L1D flushing is the default behaviour and can be tuned. See
+- :ref:`mitigation_control_command_line` and :ref:`mitigation_control_kvm`.
+-
+- - Guest confinement:
+-
+- Confinement of guests to a single or a group of physical cores which
+- are not running any other processes, can reduce the attack surface
+- significantly, but interrupts, soft interrupts and kernel threads can
+- still expose valuable data to a potential attacker. See
+- :ref:`guest_confinement`.
+-
+- - Interrupt isolation:
+-
+- Isolating the guest CPUs from interrupts can reduce the attack surface
+- further, but still allows a malicious guest to explore a limited amount
+- of host physical memory. This can at least be used to gain knowledge
+- about the host address space layout. The interrupts which have a fixed
+- affinity to the CPUs which run the untrusted guests can depending on
+- the scenario still trigger soft interrupts and schedule kernel threads
+- which might expose valuable information. See
+- :ref:`interrupt_isolation`.
+-
+-The above three mitigation methods combined can provide protection to a
+-certain degree, but the risk of the remaining attack surface has to be
+-carefully analyzed. For full protection the following methods are
+-available:
+-
+- - Disabling SMT:
+-
+- Disabling SMT and enforcing the L1D flushing provides the maximum
+- amount of protection. This mitigation is not depending on any of the
+- above mitigation methods.
+-
+- SMT control and L1D flushing can be tuned by the command line
+- parameters 'nosmt', 'l1tf', 'kvm-intel.vmentry_l1d_flush' and at run
+- time with the matching sysfs control files. See :ref:`smt_control`,
+- :ref:`mitigation_control_command_line` and
+- :ref:`mitigation_control_kvm`.
+-
+- - Disabling EPT:
+-
+- Disabling EPT provides the maximum amount of protection as well. It is
+- not depending on any of the above mitigation methods. SMT can stay
+- enabled and L1D flushing is not required, but the performance impact is
+- significant.
+-
+- EPT can be disabled in the hypervisor via the 'kvm-intel.ept'
+- parameter.
+-
+-3.4. Nested virtual machines
+-""""""""""""""""""""""""""""
+-
+-When nested virtualization is in use, three operating systems are involved:
+-the bare metal hypervisor, the nested hypervisor and the nested virtual
+-machine. VMENTER operations from the nested hypervisor into the nested
+-guest will always be processed by the bare metal hypervisor. If KVM is the
+-bare metal hypervisor it wiil:
+-
+- - Flush the L1D cache on every switch from the nested hypervisor to the
+- nested virtual machine, so that the nested hypervisor's secrets are not
+- exposed to the nested virtual machine;
+-
+- - Flush the L1D cache on every switch from the nested virtual machine to
+- the nested hypervisor; this is a complex operation, and flushing the L1D
+- cache avoids that the bare metal hypervisor's secrets are exposed to the
+- nested virtual machine;
+-
+- - Instruct the nested hypervisor to not perform any L1D cache flush. This
+- is an optimization to avoid double L1D flushing.
+-
+-
+-.. _default_mitigations:
+-
+-Default mitigations
+--------------------
+-
+- The kernel default mitigations for vulnerable processors are:
+-
+- - PTE inversion to protect against malicious user space. This is done
+- unconditionally and cannot be controlled. The swap storage is limited
+- to ~16TB.
+-
+- - L1D conditional flushing on VMENTER when EPT is enabled for
+- a guest.
+-
+- The kernel does not by default enforce the disabling of SMT, which leaves
+- SMT systems vulnerable when running untrusted guests with EPT enabled.
+-
+- The rationale for this choice is:
+-
+- - Force disabling SMT can break existing setups, especially with
+- unattended updates.
+-
+- - If regular users run untrusted guests on their machine, then L1TF is
+- just an add on to other malware which might be embedded in an untrusted
+- guest, e.g. spam-bots or attacks on the local network.
+-
+- There is no technical way to prevent a user from running untrusted code
+- on their machines blindly.
+-
+- - It's technically extremely unlikely and from today's knowledge even
+- impossible that L1TF can be exploited via the most popular attack
+- mechanisms like JavaScript because these mechanisms have no way to
+- control PTEs. If this would be possible and not other mitigation would
+- be possible, then the default might be different.
+-
+- - The administrators of cloud and hosting setups have to carefully
+- analyze the risk for their scenarios and make the appropriate
+- mitigation choices, which might even vary across their deployed
+- machines and also result in other changes of their overall setup.
+- There is no way for the kernel to provide a sensible default for this
+- kind of scenarios.
+diff --git a/Documentation/index.rst b/Documentation/index.rst
+index 5db7e87c7cb1..1cdc139adb40 100644
+--- a/Documentation/index.rst
++++ b/Documentation/index.rst
+@@ -104,6 +104,7 @@ implementation.
+ :maxdepth: 2
+
+ sh/index
++ x86/index
+
+ Filesystem Documentation
+ ------------------------
+diff --git a/Documentation/x86/conf.py b/Documentation/x86/conf.py
+new file mode 100644
+index 000000000000..33c5c3142e20
+--- /dev/null
++++ b/Documentation/x86/conf.py
+@@ -0,0 +1,10 @@
++# -*- coding: utf-8; mode: python -*-
++
++project = "X86 architecture specific documentation"
++
++tags.add("subproject")
++
++latex_documents = [
++ ('index', 'x86.tex', project,
++ 'The kernel development community', 'manual'),
++]
+diff --git a/Documentation/x86/index.rst b/Documentation/x86/index.rst
+new file mode 100644
+index 000000000000..ef389dcf1b1d
+--- /dev/null
++++ b/Documentation/x86/index.rst
+@@ -0,0 +1,8 @@
++==========================
++x86 architecture specifics
++==========================
++
++.. toctree::
++ :maxdepth: 1
++
++ mds
+diff --git a/Documentation/x86/mds.rst b/Documentation/x86/mds.rst
+new file mode 100644
+index 000000000000..534e9baa4e1d
+--- /dev/null
++++ b/Documentation/x86/mds.rst
+@@ -0,0 +1,225 @@
++Microarchitectural Data Sampling (MDS) mitigation
++=================================================
++
++.. _mds:
++
++Overview
++--------
++
++Microarchitectural Data Sampling (MDS) is a family of side channel attacks
++on internal buffers in Intel CPUs. The variants are:
++
++ - Microarchitectural Store Buffer Data Sampling (MSBDS) (CVE-2018-12126)
++ - Microarchitectural Fill Buffer Data Sampling (MFBDS) (CVE-2018-12130)
++ - Microarchitectural Load Port Data Sampling (MLPDS) (CVE-2018-12127)
++ - Microarchitectural Data Sampling Uncacheable Memory (MDSUM) (CVE-2019-11091)
++
++MSBDS leaks Store Buffer Entries which can be speculatively forwarded to a
++dependent load (store-to-load forwarding) as an optimization. The forward
++can also happen to a faulting or assisting load operation for a different
++memory address, which can be exploited under certain conditions. Store
++buffers are partitioned between Hyper-Threads so cross thread forwarding is
++not possible. But if a thread enters or exits a sleep state the store
++buffer is repartitioned which can expose data from one thread to the other.
++
++MFBDS leaks Fill Buffer Entries. Fill buffers are used internally to manage
++L1 miss situations and to hold data which is returned or sent in response
++to a memory or I/O operation. Fill buffers can forward data to a load
++operation and also write data to the cache. When the fill buffer is
++deallocated it can retain the stale data of the preceding operations which
++can then be forwarded to a faulting or assisting load operation, which can
++be exploited under certain conditions. Fill buffers are shared between
++Hyper-Threads so cross thread leakage is possible.
++
++MLPDS leaks Load Port Data. Load ports are used to perform load operations
++from memory or I/O. The received data is then forwarded to the register
++file or a subsequent operation. In some implementations the Load Port can
++contain stale data from a previous operation which can be forwarded to
++faulting or assisting loads under certain conditions, which again can be
++exploited eventually. Load ports are shared between Hyper-Threads so cross
++thread leakage is possible.
++
++MDSUM is a special case of MSBDS, MFBDS and MLPDS. An uncacheable load from
++memory that takes a fault or assist can leave data in a microarchitectural
++structure that may later be observed using one of the same methods used by
++MSBDS, MFBDS or MLPDS.
++
++Exposure assumptions
++--------------------
++
++It is assumed that attack code resides in user space or in a guest with one
++exception. The rationale behind this assumption is that the code construct
++needed for exploiting MDS requires:
++
++ - to control the load to trigger a fault or assist
++
++ - to have a disclosure gadget which exposes the speculatively accessed
++ data for consumption through a side channel.
++
++ - to control the pointer through which the disclosure gadget exposes the
++ data
++
++The existence of such a construct in the kernel cannot be excluded with
++100% certainty, but the complexity involved makes it extremly unlikely.
++
++There is one exception, which is untrusted BPF. The functionality of
++untrusted BPF is limited, but it needs to be thoroughly investigated
++whether it can be used to create such a construct.
++
++
++Mitigation strategy
++-------------------
++
++All variants have the same mitigation strategy at least for the single CPU
++thread case (SMT off): Force the CPU to clear the affected buffers.
++
++This is achieved by using the otherwise unused and obsolete VERW
++instruction in combination with a microcode update. The microcode clears
++the affected CPU buffers when the VERW instruction is executed.
++
++For virtualization there are two ways to achieve CPU buffer
++clearing. Either the modified VERW instruction or via the L1D Flush
++command. The latter is issued when L1TF mitigation is enabled so the extra
++VERW can be avoided. If the CPU is not affected by L1TF then VERW needs to
++be issued.
++
++If the VERW instruction with the supplied segment selector argument is
++executed on a CPU without the microcode update there is no side effect
++other than a small number of pointlessly wasted CPU cycles.
++
++This does not protect against cross Hyper-Thread attacks except for MSBDS
++which is only exploitable cross Hyper-thread when one of the Hyper-Threads
++enters a C-state.
++
++The kernel provides a function to invoke the buffer clearing:
++
++ mds_clear_cpu_buffers()
++
++The mitigation is invoked on kernel/userspace, hypervisor/guest and C-state
++(idle) transitions.
++
++As a special quirk to address virtualization scenarios where the host has
++the microcode updated, but the hypervisor does not (yet) expose the
++MD_CLEAR CPUID bit to guests, the kernel issues the VERW instruction in the
++hope that it might actually clear the buffers. The state is reflected
++accordingly.
++
++According to current knowledge additional mitigations inside the kernel
++itself are not required because the necessary gadgets to expose the leaked
++data cannot be controlled in a way which allows exploitation from malicious
++user space or VM guests.
++
++Kernel internal mitigation modes
++--------------------------------
++
++ ======= ============================================================
++ off Mitigation is disabled. Either the CPU is not affected or
++ mds=off is supplied on the kernel command line
++
++ full Mitigation is enabled. CPU is affected and MD_CLEAR is
++ advertised in CPUID.
++
++ vmwerv Mitigation is enabled. CPU is affected and MD_CLEAR is not
++ advertised in CPUID. That is mainly for virtualization
++ scenarios where the host has the updated microcode but the
++ hypervisor does not expose MD_CLEAR in CPUID. It's a best
++ effort approach without guarantee.
++ ======= ============================================================
++
++If the CPU is affected and mds=off is not supplied on the kernel command
++line then the kernel selects the appropriate mitigation mode depending on
++the availability of the MD_CLEAR CPUID bit.
++
++Mitigation points
++-----------------
++
++1. Return to user space
++^^^^^^^^^^^^^^^^^^^^^^^
++
++ When transitioning from kernel to user space the CPU buffers are flushed
++ on affected CPUs when the mitigation is not disabled on the kernel
++ command line. The migitation is enabled through the static key
++ mds_user_clear.
++
++ The mitigation is invoked in prepare_exit_to_usermode() which covers
++ most of the kernel to user space transitions. There are a few exceptions
++ which are not invoking prepare_exit_to_usermode() on return to user
++ space. These exceptions use the paranoid exit code.
++
++ - Non Maskable Interrupt (NMI):
++
++ Access to sensible data like keys, credentials in the NMI context is
++ mostly theoretical: The CPU can do prefetching or execute a
++ misspeculated code path and thereby fetching data which might end up
++ leaking through a buffer.
++
++ But for mounting other attacks the kernel stack address of the task is
++ already valuable information. So in full mitigation mode, the NMI is
++ mitigated on the return from do_nmi() to provide almost complete
++ coverage.
++
++ - Double fault (#DF):
++
++ A double fault is usually fatal, but the ESPFIX workaround, which can
++ be triggered from user space through modify_ldt(2) is a recoverable
++ double fault. #DF uses the paranoid exit path, so explicit mitigation
++ in the double fault handler is required.
++
++ - Machine Check Exception (#MC):
++
++ Another corner case is a #MC which hits between the CPU buffer clear
++ invocation and the actual return to user. As this still is in kernel
++ space it takes the paranoid exit path which does not clear the CPU
++ buffers. So the #MC handler repopulates the buffers to some
++ extent. Machine checks are not reliably controllable and the window is
++ extremly small so mitigation would just tick a checkbox that this
++ theoretical corner case is covered. To keep the amount of special
++ cases small, ignore #MC.
++
++ - Debug Exception (#DB):
++
++ This takes the paranoid exit path only when the INT1 breakpoint is in
++ kernel space. #DB on a user space address takes the regular exit path,
++ so no extra mitigation required.
++
++
++2. C-State transition
++^^^^^^^^^^^^^^^^^^^^^
++
++ When a CPU goes idle and enters a C-State the CPU buffers need to be
++ cleared on affected CPUs when SMT is active. This addresses the
++ repartitioning of the store buffer when one of the Hyper-Threads enters
++ a C-State.
++
++ When SMT is inactive, i.e. either the CPU does not support it or all
++ sibling threads are offline CPU buffer clearing is not required.
++
++ The idle clearing is enabled on CPUs which are only affected by MSBDS
++ and not by any other MDS variant. The other MDS variants cannot be
++ protected against cross Hyper-Thread attacks because the Fill Buffer and
++ the Load Ports are shared. So on CPUs affected by other variants, the
++ idle clearing would be a window dressing exercise and is therefore not
++ activated.
++
++ The invocation is controlled by the static key mds_idle_clear which is
++ switched depending on the chosen mitigation mode and the SMT state of
++ the system.
++
++ The buffer clear is only invoked before entering the C-State to prevent
++ that stale data from the idling CPU from spilling to the Hyper-Thread
++ sibling after the store buffer got repartitioned and all entries are
++ available to the non idle sibling.
++
++ When coming out of idle the store buffer is partitioned again so each
++ sibling has half of it available. The back from idle CPU could be then
++ speculatively exposed to contents of the sibling. The buffers are
++ flushed either on exit to user space or on VMENTER so malicious code
++ in user space or the guest cannot speculatively access them.
++
++ The mitigation is hooked into all variants of halt()/mwait(), but does
++ not cover the legacy ACPI IO-Port mechanism because the ACPI idle driver
++ has been superseded by the intel_idle driver around 2010 and is
++ preferred on all affected CPUs which are expected to gain the MD_CLEAR
++ functionality in microcode. Aside of that the IO-Port mechanism is a
++ legacy interface which is only used on older systems which are either
++ not affected or do not receive microcode updates anymore.
+diff --git a/Makefile b/Makefile
+index 914d69b9e3fd..be894b3a97d5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 42
++SUBLEVEL = 43
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
+index 1341325599a7..4ccbf611a3c5 100644
+--- a/arch/powerpc/kernel/security.c
++++ b/arch/powerpc/kernel/security.c
+@@ -56,7 +56,7 @@ void setup_barrier_nospec(void)
+ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
+ security_ftr_enabled(SEC_FTR_BNDS_CHK_SPEC_BAR);
+
+- if (!no_nospec)
++ if (!no_nospec && !cpu_mitigations_off())
+ enable_barrier_nospec(enable);
+ }
+
+@@ -115,7 +115,7 @@ static int __init handle_nospectre_v2(char *p)
+ early_param("nospectre_v2", handle_nospectre_v2);
+ void setup_spectre_v2(void)
+ {
+- if (no_spectrev2)
++ if (no_spectrev2 || cpu_mitigations_off())
+ do_btb_flush_fixups();
+ else
+ btb_flush_enabled = true;
+@@ -299,7 +299,7 @@ void setup_stf_barrier(void)
+
+ stf_enabled_flush_types = type;
+
+- if (!no_stf_barrier)
++ if (!no_stf_barrier && !cpu_mitigations_off())
+ stf_barrier_enable(enable);
+ }
+
+diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
+index faf00222b324..eaf7300be5ab 100644
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -955,7 +955,7 @@ void setup_rfi_flush(enum l1d_flush_type types, bool enable)
+
+ enabled_flush_types = types;
+
+- if (!no_rfi_flush)
++ if (!no_rfi_flush && !cpu_mitigations_off())
+ rfi_flush_enable(enable);
+ }
+
+diff --git a/arch/s390/kernel/nospec-branch.c b/arch/s390/kernel/nospec-branch.c
+index bdddaae96559..649135cbedd5 100644
+--- a/arch/s390/kernel/nospec-branch.c
++++ b/arch/s390/kernel/nospec-branch.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include <linux/module.h>
+ #include <linux/device.h>
++#include <linux/cpu.h>
+ #include <asm/nospec-branch.h>
+
+ static int __init nobp_setup_early(char *str)
+@@ -58,7 +59,7 @@ early_param("nospectre_v2", nospectre_v2_setup_early);
+
+ void __init nospec_auto_detect(void)
+ {
+- if (test_facility(156)) {
++ if (test_facility(156) || cpu_mitigations_off()) {
+ /*
+ * The machine supports etokens.
+ * Disable expolines and disable nobp.
+diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
+index 3b2490b81918..8353348ddeaf 100644
+--- a/arch/x86/entry/common.c
++++ b/arch/x86/entry/common.c
+@@ -31,6 +31,7 @@
+ #include <asm/vdso.h>
+ #include <linux/uaccess.h>
+ #include <asm/cpufeature.h>
++#include <asm/nospec-branch.h>
+
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/syscalls.h>
+@@ -212,6 +213,8 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs)
+ #endif
+
+ user_enter_irqoff();
++
++ mds_user_clear_cpu_buffers();
+ }
+
+ #define SYSCALL_EXIT_WORK_FLAGS \
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index f9958ad4d335..a759e59990fb 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -4132,11 +4132,11 @@ __init int intel_pmu_init(void)
+ name = "nehalem";
+ break;
+
+- case INTEL_FAM6_ATOM_PINEVIEW:
+- case INTEL_FAM6_ATOM_LINCROFT:
+- case INTEL_FAM6_ATOM_PENWELL:
+- case INTEL_FAM6_ATOM_CLOVERVIEW:
+- case INTEL_FAM6_ATOM_CEDARVIEW:
++ case INTEL_FAM6_ATOM_BONNELL:
++ case INTEL_FAM6_ATOM_BONNELL_MID:
++ case INTEL_FAM6_ATOM_SALTWELL:
++ case INTEL_FAM6_ATOM_SALTWELL_MID:
++ case INTEL_FAM6_ATOM_SALTWELL_TABLET:
+ memcpy(hw_cache_event_ids, atom_hw_cache_event_ids,
+ sizeof(hw_cache_event_ids));
+
+@@ -4149,9 +4149,11 @@ __init int intel_pmu_init(void)
+ name = "bonnell";
+ break;
+
+- case INTEL_FAM6_ATOM_SILVERMONT1:
+- case INTEL_FAM6_ATOM_SILVERMONT2:
++ case INTEL_FAM6_ATOM_SILVERMONT:
++ case INTEL_FAM6_ATOM_SILVERMONT_X:
++ case INTEL_FAM6_ATOM_SILVERMONT_MID:
+ case INTEL_FAM6_ATOM_AIRMONT:
++ case INTEL_FAM6_ATOM_AIRMONT_MID:
+ memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
+ sizeof(hw_cache_event_ids));
+ memcpy(hw_cache_extra_regs, slm_hw_cache_extra_regs,
+@@ -4170,7 +4172,7 @@ __init int intel_pmu_init(void)
+ break;
+
+ case INTEL_FAM6_ATOM_GOLDMONT:
+- case INTEL_FAM6_ATOM_DENVERTON:
++ case INTEL_FAM6_ATOM_GOLDMONT_X:
+ memcpy(hw_cache_event_ids, glm_hw_cache_event_ids,
+ sizeof(hw_cache_event_ids));
+ memcpy(hw_cache_extra_regs, glm_hw_cache_extra_regs,
+@@ -4196,7 +4198,7 @@ __init int intel_pmu_init(void)
+ name = "goldmont";
+ break;
+
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ memcpy(hw_cache_event_ids, glp_hw_cache_event_ids,
+ sizeof(hw_cache_event_ids));
+ memcpy(hw_cache_extra_regs, glp_hw_cache_extra_regs,
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index 6eb76106c469..56194c571299 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -559,8 +559,8 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
+
+ X86_CSTATES_MODEL(INTEL_FAM6_HASWELL_ULT, hswult_cstates),
+
+- X86_CSTATES_MODEL(INTEL_FAM6_ATOM_SILVERMONT1, slm_cstates),
+- X86_CSTATES_MODEL(INTEL_FAM6_ATOM_SILVERMONT2, slm_cstates),
++ X86_CSTATES_MODEL(INTEL_FAM6_ATOM_SILVERMONT, slm_cstates),
++ X86_CSTATES_MODEL(INTEL_FAM6_ATOM_SILVERMONT_X, slm_cstates),
+ X86_CSTATES_MODEL(INTEL_FAM6_ATOM_AIRMONT, slm_cstates),
+
+ X86_CSTATES_MODEL(INTEL_FAM6_BROADWELL_CORE, snb_cstates),
+@@ -581,9 +581,9 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
+ X86_CSTATES_MODEL(INTEL_FAM6_XEON_PHI_KNM, knl_cstates),
+
+ X86_CSTATES_MODEL(INTEL_FAM6_ATOM_GOLDMONT, glm_cstates),
+- X86_CSTATES_MODEL(INTEL_FAM6_ATOM_DENVERTON, glm_cstates),
++ X86_CSTATES_MODEL(INTEL_FAM6_ATOM_GOLDMONT_X, glm_cstates),
+
+- X86_CSTATES_MODEL(INTEL_FAM6_ATOM_GEMINI_LAKE, glm_cstates),
++ X86_CSTATES_MODEL(INTEL_FAM6_ATOM_GOLDMONT_PLUS, glm_cstates),
+ { },
+ };
+ MODULE_DEVICE_TABLE(x86cpu, intel_cstates_match);
+diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
+index 32f3e9423e99..91039ffed633 100644
+--- a/arch/x86/events/intel/rapl.c
++++ b/arch/x86/events/intel/rapl.c
+@@ -777,9 +777,9 @@ static const struct x86_cpu_id rapl_cpu_match[] __initconst = {
+ X86_RAPL_MODEL_MATCH(INTEL_FAM6_CANNONLAKE_MOBILE, skl_rapl_init),
+
+ X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_GOLDMONT, hsw_rapl_init),
+- X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_DENVERTON, hsw_rapl_init),
++ X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_GOLDMONT_X, hsw_rapl_init),
+
+- X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_GEMINI_LAKE, hsw_rapl_init),
++ X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_GOLDMONT_PLUS, hsw_rapl_init),
+ {},
+ };
+
+diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c
+index b4771a6ddbc1..1b9f85abf9bc 100644
+--- a/arch/x86/events/msr.c
++++ b/arch/x86/events/msr.c
+@@ -69,14 +69,14 @@ static bool test_intel(int idx)
+ case INTEL_FAM6_BROADWELL_GT3E:
+ case INTEL_FAM6_BROADWELL_X:
+
+- case INTEL_FAM6_ATOM_SILVERMONT1:
+- case INTEL_FAM6_ATOM_SILVERMONT2:
++ case INTEL_FAM6_ATOM_SILVERMONT:
++ case INTEL_FAM6_ATOM_SILVERMONT_X:
+ case INTEL_FAM6_ATOM_AIRMONT:
+
+ case INTEL_FAM6_ATOM_GOLDMONT:
+- case INTEL_FAM6_ATOM_DENVERTON:
++ case INTEL_FAM6_ATOM_GOLDMONT_X:
+
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+
+ case INTEL_FAM6_XEON_PHI_KNL:
+ case INTEL_FAM6_XEON_PHI_KNM:
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 7b31ee5223fc..69037da75ea0 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -341,6 +341,7 @@
+ #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */
+ #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
+ #define X86_FEATURE_TSX_FORCE_ABORT (18*32+13) /* "" TSX_FORCE_ABORT */
++#define X86_FEATURE_MD_CLEAR (18*32+10) /* VERW clears CPU buffers */
+ #define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */
+ #define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */
+ #define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */
+@@ -378,5 +379,7 @@
+ #define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */
+ #define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */
+ #define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */
++#define X86_BUG_MDS X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */
++#define X86_BUG_MSBDS_ONLY X86_BUG(20) /* CPU is only affected by the MSDBS variant of BUG_MDS */
+
+ #endif /* _ASM_X86_CPUFEATURES_H */
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 0ad25cc895ae..058b1a1994c4 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -8,9 +8,6 @@
+ * The "_X" parts are generally the EP and EX Xeons, or the
+ * "Extreme" ones, like Broadwell-E.
+ *
+- * Things ending in "2" are usually because we have no better
+- * name for them. There's no processor called "SILVERMONT2".
+- *
+ * While adding a new CPUID for a new microarchitecture, add a new
+ * group to keep logically sorted out in chronological order. Within
+ * that group keep the CPUID for the variants sorted by model number.
+@@ -59,19 +56,23 @@
+
+ /* "Small Core" Processors (Atom) */
+
+-#define INTEL_FAM6_ATOM_PINEVIEW 0x1C
+-#define INTEL_FAM6_ATOM_LINCROFT 0x26
+-#define INTEL_FAM6_ATOM_PENWELL 0x27
+-#define INTEL_FAM6_ATOM_CLOVERVIEW 0x35
+-#define INTEL_FAM6_ATOM_CEDARVIEW 0x36
+-#define INTEL_FAM6_ATOM_SILVERMONT1 0x37 /* BayTrail/BYT / Valleyview */
+-#define INTEL_FAM6_ATOM_SILVERMONT2 0x4D /* Avaton/Rangely */
+-#define INTEL_FAM6_ATOM_AIRMONT 0x4C /* CherryTrail / Braswell */
+-#define INTEL_FAM6_ATOM_MERRIFIELD 0x4A /* Tangier */
+-#define INTEL_FAM6_ATOM_MOOREFIELD 0x5A /* Anniedale */
+-#define INTEL_FAM6_ATOM_GOLDMONT 0x5C
+-#define INTEL_FAM6_ATOM_DENVERTON 0x5F /* Goldmont Microserver */
+-#define INTEL_FAM6_ATOM_GEMINI_LAKE 0x7A
++#define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */
++#define INTEL_FAM6_ATOM_BONNELL_MID 0x26 /* Silverthorne, Lincroft */
++
++#define INTEL_FAM6_ATOM_SALTWELL 0x36 /* Cedarview */
++#define INTEL_FAM6_ATOM_SALTWELL_MID 0x27 /* Penwell */
++#define INTEL_FAM6_ATOM_SALTWELL_TABLET 0x35 /* Cloverview */
++
++#define INTEL_FAM6_ATOM_SILVERMONT 0x37 /* Bay Trail, Valleyview */
++#define INTEL_FAM6_ATOM_SILVERMONT_X 0x4D /* Avaton, Rangely */
++#define INTEL_FAM6_ATOM_SILVERMONT_MID 0x4A /* Merriefield */
++
++#define INTEL_FAM6_ATOM_AIRMONT 0x4C /* Cherry Trail, Braswell */
++#define INTEL_FAM6_ATOM_AIRMONT_MID 0x5A /* Moorefield */
++
++#define INTEL_FAM6_ATOM_GOLDMONT 0x5C /* Apollo Lake */
++#define INTEL_FAM6_ATOM_GOLDMONT_X 0x5F /* Denverton */
++#define INTEL_FAM6_ATOM_GOLDMONT_PLUS 0x7A /* Gemini Lake */
+
+ /* Xeon Phi */
+
+diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
+index 15450a675031..c99c66b41e53 100644
+--- a/arch/x86/include/asm/irqflags.h
++++ b/arch/x86/include/asm/irqflags.h
+@@ -6,6 +6,8 @@
+
+ #ifndef __ASSEMBLY__
+
++#include <asm/nospec-branch.h>
++
+ /* Provide __cpuidle; we can't safely include <linux/cpu.h> */
+ #define __cpuidle __attribute__((__section__(".cpuidle.text")))
+
+@@ -54,11 +56,13 @@ static inline void native_irq_enable(void)
+
+ static inline __cpuidle void native_safe_halt(void)
+ {
++ mds_idle_clear_cpu_buffers();
+ asm volatile("sti; hlt": : :"memory");
+ }
+
+ static inline __cpuidle void native_halt(void)
+ {
++ mds_idle_clear_cpu_buffers();
+ asm volatile("hlt": : :"memory");
+ }
+
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index f14ca0be1e3f..f85f43db9225 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -2,6 +2,8 @@
+ #ifndef _ASM_X86_MSR_INDEX_H
+ #define _ASM_X86_MSR_INDEX_H
+
++#include <linux/bits.h>
++
+ /*
+ * CPU model specific register (MSR) numbers.
+ *
+@@ -40,14 +42,14 @@
+ /* Intel MSRs. Some also available on other CPUs */
+
+ #define MSR_IA32_SPEC_CTRL 0x00000048 /* Speculation Control */
+-#define SPEC_CTRL_IBRS (1 << 0) /* Indirect Branch Restricted Speculation */
++#define SPEC_CTRL_IBRS BIT(0) /* Indirect Branch Restricted Speculation */
+ #define SPEC_CTRL_STIBP_SHIFT 1 /* Single Thread Indirect Branch Predictor (STIBP) bit */
+-#define SPEC_CTRL_STIBP (1 << SPEC_CTRL_STIBP_SHIFT) /* STIBP mask */
++#define SPEC_CTRL_STIBP BIT(SPEC_CTRL_STIBP_SHIFT) /* STIBP mask */
+ #define SPEC_CTRL_SSBD_SHIFT 2 /* Speculative Store Bypass Disable bit */
+-#define SPEC_CTRL_SSBD (1 << SPEC_CTRL_SSBD_SHIFT) /* Speculative Store Bypass Disable */
++#define SPEC_CTRL_SSBD BIT(SPEC_CTRL_SSBD_SHIFT) /* Speculative Store Bypass Disable */
+
+ #define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */
+-#define PRED_CMD_IBPB (1 << 0) /* Indirect Branch Prediction Barrier */
++#define PRED_CMD_IBPB BIT(0) /* Indirect Branch Prediction Barrier */
+
+ #define MSR_PPIN_CTL 0x0000004e
+ #define MSR_PPIN 0x0000004f
+@@ -69,20 +71,25 @@
+ #define MSR_MTRRcap 0x000000fe
+
+ #define MSR_IA32_ARCH_CAPABILITIES 0x0000010a
+-#define ARCH_CAP_RDCL_NO (1 << 0) /* Not susceptible to Meltdown */
+-#define ARCH_CAP_IBRS_ALL (1 << 1) /* Enhanced IBRS support */
+-#define ARCH_CAP_SKIP_VMENTRY_L1DFLUSH (1 << 3) /* Skip L1D flush on vmentry */
+-#define ARCH_CAP_SSB_NO (1 << 4) /*
+- * Not susceptible to Speculative Store Bypass
+- * attack, so no Speculative Store Bypass
+- * control required.
+- */
++#define ARCH_CAP_RDCL_NO BIT(0) /* Not susceptible to Meltdown */
++#define ARCH_CAP_IBRS_ALL BIT(1) /* Enhanced IBRS support */
++#define ARCH_CAP_SKIP_VMENTRY_L1DFLUSH BIT(3) /* Skip L1D flush on vmentry */
++#define ARCH_CAP_SSB_NO BIT(4) /*
++ * Not susceptible to Speculative Store Bypass
++ * attack, so no Speculative Store Bypass
++ * control required.
++ */
++#define ARCH_CAP_MDS_NO BIT(5) /*
++ * Not susceptible to
++ * Microarchitectural Data
++ * Sampling (MDS) vulnerabilities.
++ */
+
+ #define MSR_IA32_FLUSH_CMD 0x0000010b
+-#define L1D_FLUSH (1 << 0) /*
+- * Writeback and invalidate the
+- * L1 data cache.
+- */
++#define L1D_FLUSH BIT(0) /*
++ * Writeback and invalidate the
++ * L1 data cache.
++ */
+
+ #define MSR_IA32_BBL_CR_CTL 0x00000119
+ #define MSR_IA32_BBL_CR_CTL3 0x0000011e
+diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h
+index 39a2fb29378a..eb0f80ce8524 100644
+--- a/arch/x86/include/asm/mwait.h
++++ b/arch/x86/include/asm/mwait.h
+@@ -6,6 +6,7 @@
+ #include <linux/sched/idle.h>
+
+ #include <asm/cpufeature.h>
++#include <asm/nospec-branch.h>
+
+ #define MWAIT_SUBSTATE_MASK 0xf
+ #define MWAIT_CSTATE_MASK 0xf
+@@ -40,6 +41,8 @@ static inline void __monitorx(const void *eax, unsigned long ecx,
+
+ static inline void __mwait(unsigned long eax, unsigned long ecx)
+ {
++ mds_idle_clear_cpu_buffers();
++
+ /* "mwait %eax, %ecx;" */
+ asm volatile(".byte 0x0f, 0x01, 0xc9;"
+ :: "a" (eax), "c" (ecx));
+@@ -74,6 +77,8 @@ static inline void __mwait(unsigned long eax, unsigned long ecx)
+ static inline void __mwaitx(unsigned long eax, unsigned long ebx,
+ unsigned long ecx)
+ {
++ /* No MDS buffer clear as this is AMD/HYGON only */
++
+ /* "mwaitx %eax, %ebx, %ecx;" */
+ asm volatile(".byte 0x0f, 0x01, 0xfb;"
+ :: "a" (eax), "b" (ebx), "c" (ecx));
+@@ -81,6 +86,8 @@ static inline void __mwaitx(unsigned long eax, unsigned long ebx,
+
+ static inline void __sti_mwait(unsigned long eax, unsigned long ecx)
+ {
++ mds_idle_clear_cpu_buffers();
++
+ trace_hardirqs_on();
+ /* "mwait %eax, %ecx;" */
+ asm volatile("sti; .byte 0x0f, 0x01, 0xc9;"
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 032b6009baab..599c273f5d00 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -317,6 +317,56 @@ DECLARE_STATIC_KEY_FALSE(switch_to_cond_stibp);
+ DECLARE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
+ DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
++DECLARE_STATIC_KEY_FALSE(mds_user_clear);
++DECLARE_STATIC_KEY_FALSE(mds_idle_clear);
++
++#include <asm/segment.h>
++
++/**
++ * mds_clear_cpu_buffers - Mitigation for MDS vulnerability
++ *
++ * This uses the otherwise unused and obsolete VERW instruction in
++ * combination with microcode which triggers a CPU buffer flush when the
++ * instruction is executed.
++ */
++static inline void mds_clear_cpu_buffers(void)
++{
++ static const u16 ds = __KERNEL_DS;
++
++ /*
++ * Has to be the memory-operand variant because only that
++ * guarantees the CPU buffer flush functionality according to
++ * documentation. The register-operand variant does not.
++ * Works with any segment selector, but a valid writable
++ * data segment is the fastest variant.
++ *
++ * "cc" clobber is required because VERW modifies ZF.
++ */
++ asm volatile("verw %[ds]" : : [ds] "m" (ds) : "cc");
++}
++
++/**
++ * mds_user_clear_cpu_buffers - Mitigation for MDS vulnerability
++ *
++ * Clear CPU buffers if the corresponding static key is enabled
++ */
++static inline void mds_user_clear_cpu_buffers(void)
++{
++ if (static_branch_likely(&mds_user_clear))
++ mds_clear_cpu_buffers();
++}
++
++/**
++ * mds_idle_clear_cpu_buffers - Mitigation for MDS vulnerability
++ *
++ * Clear CPU buffers if the corresponding static key is enabled
++ */
++static inline void mds_idle_clear_cpu_buffers(void)
++{
++ if (static_branch_likely(&mds_idle_clear))
++ mds_clear_cpu_buffers();
++}
++
+ #endif /* __ASSEMBLY__ */
+
+ /*
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index d53c54b842da..b54f25697beb 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -997,4 +997,10 @@ enum l1tf_mitigations {
+
+ extern enum l1tf_mitigations l1tf_mitigation;
+
++enum mds_mitigations {
++ MDS_MITIGATION_OFF,
++ MDS_MITIGATION_FULL,
++ MDS_MITIGATION_VMWERV,
++};
++
+ #endif /* _ASM_X86_PROCESSOR_H */
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index e5258bd64200..9b096f26d1c8 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -35,6 +35,7 @@
+ static void __init spectre_v2_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
++static void __init mds_select_mitigation(void);
+
+ /* The base value of the SPEC_CTRL MSR that always has to be preserved. */
+ u64 x86_spec_ctrl_base;
+@@ -61,6 +62,13 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
+ /* Control unconditional IBPB in switch_mm() */
+ DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
++/* Control MDS CPU buffer clear before returning to user space */
++DEFINE_STATIC_KEY_FALSE(mds_user_clear);
++EXPORT_SYMBOL_GPL(mds_user_clear);
++/* Control MDS CPU buffer clear before idling (halt, mwait) */
++DEFINE_STATIC_KEY_FALSE(mds_idle_clear);
++EXPORT_SYMBOL_GPL(mds_idle_clear);
++
+ void __init check_bugs(void)
+ {
+ identify_boot_cpu();
+@@ -99,6 +107,10 @@ void __init check_bugs(void)
+
+ l1tf_select_mitigation();
+
++ mds_select_mitigation();
++
++ arch_smt_update();
++
+ #ifdef CONFIG_X86_32
+ /*
+ * Check whether we are able to run this kernel safely on SMP.
+@@ -204,6 +216,61 @@ static void x86_amd_ssb_disable(void)
+ wrmsrl(MSR_AMD64_LS_CFG, msrval);
+ }
+
++#undef pr_fmt
++#define pr_fmt(fmt) "MDS: " fmt
++
++/* Default mitigation for MDS-affected CPUs */
++static enum mds_mitigations mds_mitigation __ro_after_init = MDS_MITIGATION_FULL;
++static bool mds_nosmt __ro_after_init = false;
++
++static const char * const mds_strings[] = {
++ [MDS_MITIGATION_OFF] = "Vulnerable",
++ [MDS_MITIGATION_FULL] = "Mitigation: Clear CPU buffers",
++ [MDS_MITIGATION_VMWERV] = "Vulnerable: Clear CPU buffers attempted, no microcode",
++};
++
++static void __init mds_select_mitigation(void)
++{
++ if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off()) {
++ mds_mitigation = MDS_MITIGATION_OFF;
++ return;
++ }
++
++ if (mds_mitigation == MDS_MITIGATION_FULL) {
++ if (!boot_cpu_has(X86_FEATURE_MD_CLEAR))
++ mds_mitigation = MDS_MITIGATION_VMWERV;
++
++ static_branch_enable(&mds_user_clear);
++
++ if (!boot_cpu_has(X86_BUG_MSBDS_ONLY) &&
++ (mds_nosmt || cpu_mitigations_auto_nosmt()))
++ cpu_smt_disable(false);
++ }
++
++ pr_info("%s\n", mds_strings[mds_mitigation]);
++}
++
++static int __init mds_cmdline(char *str)
++{
++ if (!boot_cpu_has_bug(X86_BUG_MDS))
++ return 0;
++
++ if (!str)
++ return -EINVAL;
++
++ if (!strcmp(str, "off"))
++ mds_mitigation = MDS_MITIGATION_OFF;
++ else if (!strcmp(str, "full"))
++ mds_mitigation = MDS_MITIGATION_FULL;
++ else if (!strcmp(str, "full,nosmt")) {
++ mds_mitigation = MDS_MITIGATION_FULL;
++ mds_nosmt = true;
++ }
++
++ return 0;
++}
++early_param("mds", mds_cmdline);
++
+ #undef pr_fmt
+ #define pr_fmt(fmt) "Spectre V2 : " fmt
+
+@@ -428,7 +495,8 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ char arg[20];
+ int ret, i;
+
+- if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
++ if (cmdline_find_option_bool(boot_command_line, "nospectre_v2") ||
++ cpu_mitigations_off())
+ return SPECTRE_V2_CMD_NONE;
+
+ ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
+@@ -560,9 +628,6 @@ specv2_set_mode:
+
+ /* Set up IBPB and STIBP depending on the general spectre V2 command */
+ spectre_v2_user_select_mitigation(cmd);
+-
+- /* Enable STIBP if appropriate */
+- arch_smt_update();
+ }
+
+ static void update_stibp_msr(void * __unused)
+@@ -596,6 +661,31 @@ static void update_indir_branch_cond(void)
+ static_branch_disable(&switch_to_cond_stibp);
+ }
+
++#undef pr_fmt
++#define pr_fmt(fmt) fmt
++
++/* Update the static key controlling the MDS CPU buffer clear in idle */
++static void update_mds_branch_idle(void)
++{
++ /*
++ * Enable the idle clearing if SMT is active on CPUs which are
++ * affected only by MSBDS and not any other MDS variant.
++ *
++ * The other variants cannot be mitigated when SMT is enabled, so
++ * clearing the buffers on idle just to prevent the Store Buffer
++ * repartitioning leak would be a window dressing exercise.
++ */
++ if (!boot_cpu_has_bug(X86_BUG_MSBDS_ONLY))
++ return;
++
++ if (sched_smt_active())
++ static_branch_enable(&mds_idle_clear);
++ else
++ static_branch_disable(&mds_idle_clear);
++}
++
++#define MDS_MSG_SMT "MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.\n"
++
+ void arch_smt_update(void)
+ {
+ /* Enhanced IBRS implies STIBP. No update required. */
+@@ -616,6 +706,17 @@ void arch_smt_update(void)
+ break;
+ }
+
++ switch (mds_mitigation) {
++ case MDS_MITIGATION_FULL:
++ case MDS_MITIGATION_VMWERV:
++ if (sched_smt_active() && !boot_cpu_has(X86_BUG_MSBDS_ONLY))
++ pr_warn_once(MDS_MSG_SMT);
++ update_mds_branch_idle();
++ break;
++ case MDS_MITIGATION_OFF:
++ break;
++ }
++
+ mutex_unlock(&spec_ctrl_mutex);
+ }
+
+@@ -657,7 +758,8 @@ static enum ssb_mitigation_cmd __init ssb_parse_cmdline(void)
+ char arg[20];
+ int ret, i;
+
+- if (cmdline_find_option_bool(boot_command_line, "nospec_store_bypass_disable")) {
++ if (cmdline_find_option_bool(boot_command_line, "nospec_store_bypass_disable") ||
++ cpu_mitigations_off()) {
+ return SPEC_STORE_BYPASS_CMD_NONE;
+ } else {
+ ret = cmdline_find_option(boot_command_line, "spec_store_bypass_disable",
+@@ -978,6 +1080,11 @@ static void __init l1tf_select_mitigation(void)
+ if (!boot_cpu_has_bug(X86_BUG_L1TF))
+ return;
+
++ if (cpu_mitigations_off())
++ l1tf_mitigation = L1TF_MITIGATION_OFF;
++ else if (cpu_mitigations_auto_nosmt())
++ l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOSMT;
++
+ override_cache_bits(&boot_cpu_data);
+
+ switch (l1tf_mitigation) {
+@@ -1006,7 +1113,7 @@ static void __init l1tf_select_mitigation(void)
+ pr_info("You may make it effective by booting the kernel with mem=%llu parameter.\n",
+ half_pa);
+ pr_info("However, doing so will make a part of your RAM unusable.\n");
+- pr_info("Reading https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html might help you decide.\n");
++ pr_info("Reading https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html might help you decide.\n");
+ return;
+ }
+
+@@ -1039,6 +1146,7 @@ static int __init l1tf_cmdline(char *str)
+ early_param("l1tf", l1tf_cmdline);
+
+ #undef pr_fmt
++#define pr_fmt(fmt) fmt
+
+ #ifdef CONFIG_SYSFS
+
+@@ -1077,6 +1185,23 @@ static ssize_t l1tf_show_state(char *buf)
+ }
+ #endif
+
++static ssize_t mds_show_state(char *buf)
++{
++ if (!hypervisor_is_type(X86_HYPER_NATIVE)) {
++ return sprintf(buf, "%s; SMT Host state unknown\n",
++ mds_strings[mds_mitigation]);
++ }
++
++ if (boot_cpu_has(X86_BUG_MSBDS_ONLY)) {
++ return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
++ (mds_mitigation == MDS_MITIGATION_OFF ? "vulnerable" :
++ sched_smt_active() ? "mitigated" : "disabled"));
++ }
++
++ return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
++ sched_smt_active() ? "vulnerable" : "disabled");
++}
++
+ static char *stibp_state(void)
+ {
+ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+@@ -1141,6 +1266,10 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ if (boot_cpu_has(X86_FEATURE_L1TF_PTEINV))
+ return l1tf_show_state(buf);
+ break;
++
++ case X86_BUG_MDS:
++ return mds_show_state(buf);
++
+ default:
+ break;
+ }
+@@ -1172,4 +1301,9 @@ ssize_t cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *b
+ {
+ return cpu_show_common(dev, attr, buf, X86_BUG_L1TF);
+ }
++
++ssize_t cpu_show_mds(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ return cpu_show_common(dev, attr, buf, X86_BUG_MDS);
++}
+ #endif
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 44c4ef3d989b..1073118b9bf0 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -948,60 +948,73 @@ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
+ #endif
+ }
+
+-static const __initconst struct x86_cpu_id cpu_no_speculation[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_CEDARVIEW, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_CLOVERVIEW, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_LINCROFT, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_PENWELL, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_PINEVIEW, X86_FEATURE_ANY },
+- { X86_VENDOR_CENTAUR, 5 },
+- { X86_VENDOR_INTEL, 5 },
+- { X86_VENDOR_NSC, 5 },
+- { X86_VENDOR_ANY, 4 },
++#define NO_SPECULATION BIT(0)
++#define NO_MELTDOWN BIT(1)
++#define NO_SSB BIT(2)
++#define NO_L1TF BIT(3)
++#define NO_MDS BIT(4)
++#define MSBDS_ONLY BIT(5)
++
++#define VULNWL(_vendor, _family, _model, _whitelist) \
++ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist }
++
++#define VULNWL_INTEL(model, whitelist) \
++ VULNWL(INTEL, 6, INTEL_FAM6_##model, whitelist)
++
++#define VULNWL_AMD(family, whitelist) \
++ VULNWL(AMD, family, X86_MODEL_ANY, whitelist)
++
++static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
++ VULNWL(ANY, 4, X86_MODEL_ANY, NO_SPECULATION),
++ VULNWL(CENTAUR, 5, X86_MODEL_ANY, NO_SPECULATION),
++ VULNWL(INTEL, 5, X86_MODEL_ANY, NO_SPECULATION),
++ VULNWL(NSC, 5, X86_MODEL_ANY, NO_SPECULATION),
++
++ /* Intel Family 6 */
++ VULNWL_INTEL(ATOM_SALTWELL, NO_SPECULATION),
++ VULNWL_INTEL(ATOM_SALTWELL_TABLET, NO_SPECULATION),
++ VULNWL_INTEL(ATOM_SALTWELL_MID, NO_SPECULATION),
++ VULNWL_INTEL(ATOM_BONNELL, NO_SPECULATION),
++ VULNWL_INTEL(ATOM_BONNELL_MID, NO_SPECULATION),
++
++ VULNWL_INTEL(ATOM_SILVERMONT, NO_SSB | NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(ATOM_SILVERMONT_X, NO_SSB | NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(ATOM_SILVERMONT_MID, NO_SSB | NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(ATOM_AIRMONT, NO_SSB | NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(XEON_PHI_KNL, NO_SSB | NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(XEON_PHI_KNM, NO_SSB | NO_L1TF | MSBDS_ONLY),
++
++ VULNWL_INTEL(CORE_YONAH, NO_SSB),
++
++ VULNWL_INTEL(ATOM_AIRMONT_MID, NO_L1TF | MSBDS_ONLY),
++
++ VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF),
++ VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF),
++ VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF),
++
++ /* AMD Family 0xf - 0x12 */
++ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
++ VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
++ VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
++ VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
++
++ /* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */
++ VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS),
+ {}
+ };
+
+-static const __initconst struct x86_cpu_id cpu_no_meltdown[] = {
+- { X86_VENDOR_AMD },
+- {}
+-};
+-
+-/* Only list CPUs which speculate but are non susceptible to SSB */
+-static const __initconst struct x86_cpu_id cpu_no_spec_store_bypass[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1 },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT2 },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_MERRIFIELD },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_CORE_YONAH },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNL },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNM },
+- { X86_VENDOR_AMD, 0x12, },
+- { X86_VENDOR_AMD, 0x11, },
+- { X86_VENDOR_AMD, 0x10, },
+- { X86_VENDOR_AMD, 0xf, },
+- {}
+-};
++static bool __init cpu_matches(unsigned long which)
++{
++ const struct x86_cpu_id *m = x86_match_cpu(cpu_vuln_whitelist);
+
+-static const __initconst struct x86_cpu_id cpu_no_l1tf[] = {
+- /* in addition to cpu_no_speculation */
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1 },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT2 },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_MERRIFIELD },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_MOOREFIELD },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_DENVERTON },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GEMINI_LAKE },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNL },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNM },
+- {}
+-};
++ return m && !!(m->driver_data & which);
++}
+
+ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ {
+ u64 ia32_cap = 0;
+
+- if (x86_match_cpu(cpu_no_speculation))
++ if (cpu_matches(NO_SPECULATION))
+ return;
+
+ setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
+@@ -1010,15 +1023,20 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ if (cpu_has(c, X86_FEATURE_ARCH_CAPABILITIES))
+ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap);
+
+- if (!x86_match_cpu(cpu_no_spec_store_bypass) &&
+- !(ia32_cap & ARCH_CAP_SSB_NO) &&
++ if (!cpu_matches(NO_SSB) && !(ia32_cap & ARCH_CAP_SSB_NO) &&
+ !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
+ setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
+
+ if (ia32_cap & ARCH_CAP_IBRS_ALL)
+ setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
+
+- if (x86_match_cpu(cpu_no_meltdown))
++ if (!cpu_matches(NO_MDS) && !(ia32_cap & ARCH_CAP_MDS_NO)) {
++ setup_force_cpu_bug(X86_BUG_MDS);
++ if (cpu_matches(MSBDS_ONLY))
++ setup_force_cpu_bug(X86_BUG_MSBDS_ONLY);
++ }
++
++ if (cpu_matches(NO_MELTDOWN))
+ return;
+
+ /* Rogue Data Cache Load? No! */
+@@ -1027,7 +1045,7 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+
+ setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
+
+- if (x86_match_cpu(cpu_no_l1tf))
++ if (cpu_matches(NO_L1TF))
+ return;
+
+ setup_force_cpu_bug(X86_BUG_L1TF);
+diff --git a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
+index f8c260d522ca..912d53939f4f 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
++++ b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
+@@ -91,7 +91,7 @@ static u64 get_prefetch_disable_bits(void)
+ */
+ return 0xF;
+ case INTEL_FAM6_ATOM_GOLDMONT:
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ /*
+ * SDM defines bits of MSR_MISC_FEATURE_CONTROL register
+ * as:
+@@ -995,7 +995,7 @@ static int measure_cycles_perf_fn(void *_plr)
+
+ switch (boot_cpu_data.x86_model) {
+ case INTEL_FAM6_ATOM_GOLDMONT:
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ l2_hit_bits = (0x52ULL << 16) | (0x2 << 8) | 0xd1;
+ l2_miss_bits = (0x52ULL << 16) | (0x10 << 8) | 0xd1;
+ break;
+diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
+index 18bc9b51ac9b..086cf1d1d71d 100644
+--- a/arch/x86/kernel/nmi.c
++++ b/arch/x86/kernel/nmi.c
+@@ -34,6 +34,7 @@
+ #include <asm/x86_init.h>
+ #include <asm/reboot.h>
+ #include <asm/cache.h>
++#include <asm/nospec-branch.h>
+
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/nmi.h>
+@@ -533,6 +534,9 @@ nmi_restart:
+ write_cr2(this_cpu_read(nmi_cr2));
+ if (this_cpu_dec_return(nmi_state))
+ goto nmi_restart;
++
++ if (user_mode(regs))
++ mds_user_clear_cpu_buffers();
+ }
+ NOKPROBE_SYMBOL(do_nmi);
+
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index e6db475164ed..0a5efd764914 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -58,6 +58,7 @@
+ #include <asm/alternative.h>
+ #include <asm/fpu/xstate.h>
+ #include <asm/trace/mpx.h>
++#include <asm/nospec-branch.h>
+ #include <asm/mpx.h>
+ #include <asm/vm86.h>
+ #include <asm/umip.h>
+@@ -387,6 +388,13 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
+ regs->ip = (unsigned long)general_protection;
+ regs->sp = (unsigned long)&gpregs->orig_ax;
+
++ /*
++ * This situation can be triggered by userspace via
++ * modify_ldt(2) and the return does not take the regular
++ * user space exit, so a CPU buffer clear is required when
++ * MDS mitigation is enabled.
++ */
++ mds_user_clear_cpu_buffers();
+ return;
+ }
+ #endif
+diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
+index 6d5dc5dabfd7..03b7529333a6 100644
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -636,7 +636,7 @@ unsigned long native_calibrate_tsc(void)
+ case INTEL_FAM6_KABYLAKE_DESKTOP:
+ crystal_khz = 24000; /* 24.0 MHz */
+ break;
+- case INTEL_FAM6_ATOM_DENVERTON:
++ case INTEL_FAM6_ATOM_GOLDMONT_X:
+ crystal_khz = 25000; /* 25.0 MHz */
+ break;
+ case INTEL_FAM6_ATOM_GOLDMONT:
+diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
+index 27ef714d886c..3d0e9aeea7c8 100644
+--- a/arch/x86/kernel/tsc_msr.c
++++ b/arch/x86/kernel/tsc_msr.c
+@@ -59,12 +59,12 @@ static const struct freq_desc freq_desc_ann = {
+ };
+
+ static const struct x86_cpu_id tsc_msr_cpu_ids[] = {
+- INTEL_CPU_FAM6(ATOM_PENWELL, freq_desc_pnw),
+- INTEL_CPU_FAM6(ATOM_CLOVERVIEW, freq_desc_clv),
+- INTEL_CPU_FAM6(ATOM_SILVERMONT1, freq_desc_byt),
++ INTEL_CPU_FAM6(ATOM_SALTWELL_MID, freq_desc_pnw),
++ INTEL_CPU_FAM6(ATOM_SALTWELL_TABLET, freq_desc_clv),
++ INTEL_CPU_FAM6(ATOM_SILVERMONT, freq_desc_byt),
++ INTEL_CPU_FAM6(ATOM_SILVERMONT_MID, freq_desc_tng),
+ INTEL_CPU_FAM6(ATOM_AIRMONT, freq_desc_cht),
+- INTEL_CPU_FAM6(ATOM_MERRIFIELD, freq_desc_tng),
+- INTEL_CPU_FAM6(ATOM_MOOREFIELD, freq_desc_ann),
++ INTEL_CPU_FAM6(ATOM_AIRMONT_MID, freq_desc_ann),
+ {}
+ };
+
+diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
+index 98d13c6a64be..b810102a9cfa 100644
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -382,7 +382,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ /* cpuid 0x80000008.ebx */
+ const u32 kvm_cpuid_8000_0008_ebx_x86_features =
+ F(AMD_IBPB) | F(AMD_IBRS) | F(AMD_SSBD) | F(VIRT_SSBD) |
+- F(AMD_SSB_NO);
++ F(AMD_SSB_NO) | F(AMD_STIBP);
+
+ /* cpuid 0xC0000001.edx */
+ const u32 kvm_cpuid_C000_0001_edx_x86_features =
+@@ -412,7 +412,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ /* cpuid 7.0.edx*/
+ const u32 kvm_cpuid_7_0_edx_x86_features =
+ F(AVX512_4VNNIW) | F(AVX512_4FMAPS) | F(SPEC_CTRL) |
+- F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES);
++ F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES) | F(INTEL_STIBP) |
++ F(MD_CLEAR);
+
+ /* all calls to cpuid_count() should be made on the same cpu */
+ get_cpu();
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 215339c7d161..73d6d585dd66 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10765,8 +10765,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ evmcs_rsp = static_branch_unlikely(&enable_evmcs) ?
+ (unsigned long)¤t_evmcs->host_rsp : 0;
+
++ /* L1D Flush includes CPU buffer clear to mitigate MDS */
+ if (static_branch_unlikely(&vmx_l1d_should_flush))
+ vmx_l1d_flush(vcpu);
++ else if (static_branch_unlikely(&mds_user_clear))
++ mds_clear_cpu_buffers();
+
+ asm(
+ /* Store host registers */
+@@ -11127,8 +11130,8 @@ free_vcpu:
+ return ERR_PTR(err);
+ }
+
+-#define L1TF_MSG_SMT "L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.\n"
+-#define L1TF_MSG_L1D "L1TF CPU bug present and virtualization mitigation disabled, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.\n"
++#define L1TF_MSG_SMT "L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
++#define L1TF_MSG_L1D "L1TF CPU bug present and virtualization mitigation disabled, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
+
+ static int vmx_vm_init(struct kvm *kvm)
+ {
+diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
+index c1fc1ae6b429..4df3e5c89d57 100644
+--- a/arch/x86/mm/pti.c
++++ b/arch/x86/mm/pti.c
+@@ -35,6 +35,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/mm.h>
+ #include <linux/uaccess.h>
++#include <linux/cpu.h>
+
+ #include <asm/cpufeature.h>
+ #include <asm/hypervisor.h>
+@@ -115,7 +116,8 @@ void __init pti_check_boottime_disable(void)
+ }
+ }
+
+- if (cmdline_find_option_bool(boot_command_line, "nopti")) {
++ if (cmdline_find_option_bool(boot_command_line, "nopti") ||
++ cpu_mitigations_off()) {
+ pti_mode = PTI_FORCE_OFF;
+ pti_print_if_insecure("disabled on command line.");
+ return;
+diff --git a/arch/x86/platform/atom/punit_atom_debug.c b/arch/x86/platform/atom/punit_atom_debug.c
+index 034813d4ab1e..41dae0f0d898 100644
+--- a/arch/x86/platform/atom/punit_atom_debug.c
++++ b/arch/x86/platform/atom/punit_atom_debug.c
+@@ -143,8 +143,8 @@ static void punit_dbgfs_unregister(void)
+ (kernel_ulong_t)&drv_data }
+
+ static const struct x86_cpu_id intel_punit_cpu_ids[] = {
+- ICPU(INTEL_FAM6_ATOM_SILVERMONT1, punit_device_byt),
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD, punit_device_tng),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT, punit_device_byt),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_MID, punit_device_tng),
+ ICPU(INTEL_FAM6_ATOM_AIRMONT, punit_device_cht),
+ {}
+ };
+diff --git a/arch/x86/platform/intel-mid/device_libs/platform_bt.c b/arch/x86/platform/intel-mid/device_libs/platform_bt.c
+index 5a0483e7bf66..31dce781364c 100644
+--- a/arch/x86/platform/intel-mid/device_libs/platform_bt.c
++++ b/arch/x86/platform/intel-mid/device_libs/platform_bt.c
+@@ -68,7 +68,7 @@ static struct bt_sfi_data tng_bt_sfi_data __initdata = {
+ { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (kernel_ulong_t)&ddata }
+
+ static const struct x86_cpu_id bt_sfi_cpu_ids[] = {
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD, tng_bt_sfi_data),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_MID, tng_bt_sfi_data),
+ {}
+ };
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 969bf8d515c0..c651e206d796 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -292,7 +292,7 @@ static const struct lpss_device_desc bsw_spi_dev_desc = {
+ #define ICPU(model) { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, }
+
+ static const struct x86_cpu_id lpss_cpu_ids[] = {
+- ICPU(INTEL_FAM6_ATOM_SILVERMONT1), /* Valleyview, Bay Trail */
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT), /* Valleyview, Bay Trail */
+ ICPU(INTEL_FAM6_ATOM_AIRMONT), /* Braswell, Cherry Trail */
+ {}
+ };
+diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
+index 06c31ec3cc70..9a8e286dd86f 100644
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -54,7 +54,7 @@ static const struct always_present_id always_present_ids[] = {
+ * Bay / Cherry Trail PWM directly poked by GPU driver in win10,
+ * but Linux uses a separate PWM driver, harmless if not used.
+ */
+- ENTRY("80860F09", "1", ICPU(INTEL_FAM6_ATOM_SILVERMONT1), {}),
++ ENTRY("80860F09", "1", ICPU(INTEL_FAM6_ATOM_SILVERMONT), {}),
+ ENTRY("80862288", "1", ICPU(INTEL_FAM6_ATOM_AIRMONT), {}),
+ /*
+ * The INT0002 device is necessary to clear wakeup interrupt sources
+diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
+index eb9443d5bae1..2fd6ca1021c2 100644
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -546,11 +546,18 @@ ssize_t __weak cpu_show_l1tf(struct device *dev,
+ return sprintf(buf, "Not affected\n");
+ }
+
++ssize_t __weak cpu_show_mds(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ return sprintf(buf, "Not affected\n");
++}
++
+ static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
+ static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
+ static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
+ static DEVICE_ATTR(spec_store_bypass, 0444, cpu_show_spec_store_bypass, NULL);
+ static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL);
++static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL);
+
+ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_meltdown.attr,
+@@ -558,6 +565,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_spectre_v2.attr,
+ &dev_attr_spec_store_bypass.attr,
+ &dev_attr_l1tf.attr,
++ &dev_attr_mds.attr,
+ NULL
+ };
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index a005711f909e..29f25d5d65e0 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -1779,7 +1779,7 @@ static const struct pstate_funcs knl_funcs = {
+ static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
+ ICPU(INTEL_FAM6_SANDYBRIDGE, core_funcs),
+ ICPU(INTEL_FAM6_SANDYBRIDGE_X, core_funcs),
+- ICPU(INTEL_FAM6_ATOM_SILVERMONT1, silvermont_funcs),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT, silvermont_funcs),
+ ICPU(INTEL_FAM6_IVYBRIDGE, core_funcs),
+ ICPU(INTEL_FAM6_HASWELL_CORE, core_funcs),
+ ICPU(INTEL_FAM6_BROADWELL_CORE, core_funcs),
+@@ -1796,7 +1796,7 @@ static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
+ ICPU(INTEL_FAM6_XEON_PHI_KNL, knl_funcs),
+ ICPU(INTEL_FAM6_XEON_PHI_KNM, knl_funcs),
+ ICPU(INTEL_FAM6_ATOM_GOLDMONT, core_funcs),
+- ICPU(INTEL_FAM6_ATOM_GEMINI_LAKE, core_funcs),
++ ICPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, core_funcs),
+ ICPU(INTEL_FAM6_SKYLAKE_X, core_funcs),
+ {}
+ };
+diff --git a/drivers/edac/pnd2_edac.c b/drivers/edac/pnd2_edac.c
+index df28b65358d2..903a4f1fadcc 100644
+--- a/drivers/edac/pnd2_edac.c
++++ b/drivers/edac/pnd2_edac.c
+@@ -1541,7 +1541,7 @@ static struct dunit_ops dnv_ops = {
+
+ static const struct x86_cpu_id pnd2_cpuids[] = {
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT, 0, (kernel_ulong_t)&apl_ops },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_DENVERTON, 0, (kernel_ulong_t)&dnv_ops },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT_X, 0, (kernel_ulong_t)&dnv_ops },
+ { }
+ };
+ MODULE_DEVICE_TABLE(x86cpu, pnd2_cpuids);
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index b2ccce5fb071..c4bb67ed8da3 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -1076,14 +1076,14 @@ static const struct x86_cpu_id intel_idle_ids[] __initconst = {
+ ICPU(INTEL_FAM6_WESTMERE, idle_cpu_nehalem),
+ ICPU(INTEL_FAM6_WESTMERE_EP, idle_cpu_nehalem),
+ ICPU(INTEL_FAM6_NEHALEM_EX, idle_cpu_nehalem),
+- ICPU(INTEL_FAM6_ATOM_PINEVIEW, idle_cpu_atom),
+- ICPU(INTEL_FAM6_ATOM_LINCROFT, idle_cpu_lincroft),
++ ICPU(INTEL_FAM6_ATOM_BONNELL, idle_cpu_atom),
++ ICPU(INTEL_FAM6_ATOM_BONNELL_MID, idle_cpu_lincroft),
+ ICPU(INTEL_FAM6_WESTMERE_EX, idle_cpu_nehalem),
+ ICPU(INTEL_FAM6_SANDYBRIDGE, idle_cpu_snb),
+ ICPU(INTEL_FAM6_SANDYBRIDGE_X, idle_cpu_snb),
+- ICPU(INTEL_FAM6_ATOM_CEDARVIEW, idle_cpu_atom),
+- ICPU(INTEL_FAM6_ATOM_SILVERMONT1, idle_cpu_byt),
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD, idle_cpu_tangier),
++ ICPU(INTEL_FAM6_ATOM_SALTWELL, idle_cpu_atom),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT, idle_cpu_byt),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_MID, idle_cpu_tangier),
+ ICPU(INTEL_FAM6_ATOM_AIRMONT, idle_cpu_cht),
+ ICPU(INTEL_FAM6_IVYBRIDGE, idle_cpu_ivb),
+ ICPU(INTEL_FAM6_IVYBRIDGE_X, idle_cpu_ivt),
+@@ -1091,7 +1091,7 @@ static const struct x86_cpu_id intel_idle_ids[] __initconst = {
+ ICPU(INTEL_FAM6_HASWELL_X, idle_cpu_hsw),
+ ICPU(INTEL_FAM6_HASWELL_ULT, idle_cpu_hsw),
+ ICPU(INTEL_FAM6_HASWELL_GT3E, idle_cpu_hsw),
+- ICPU(INTEL_FAM6_ATOM_SILVERMONT2, idle_cpu_avn),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_X, idle_cpu_avn),
+ ICPU(INTEL_FAM6_BROADWELL_CORE, idle_cpu_bdw),
+ ICPU(INTEL_FAM6_BROADWELL_GT3E, idle_cpu_bdw),
+ ICPU(INTEL_FAM6_BROADWELL_X, idle_cpu_bdw),
+@@ -1104,8 +1104,8 @@ static const struct x86_cpu_id intel_idle_ids[] __initconst = {
+ ICPU(INTEL_FAM6_XEON_PHI_KNL, idle_cpu_knl),
+ ICPU(INTEL_FAM6_XEON_PHI_KNM, idle_cpu_knl),
+ ICPU(INTEL_FAM6_ATOM_GOLDMONT, idle_cpu_bxt),
+- ICPU(INTEL_FAM6_ATOM_GEMINI_LAKE, idle_cpu_bxt),
+- ICPU(INTEL_FAM6_ATOM_DENVERTON, idle_cpu_dnv),
++ ICPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, idle_cpu_bxt),
++ ICPU(INTEL_FAM6_ATOM_GOLDMONT_X, idle_cpu_dnv),
+ {}
+ };
+
+@@ -1322,7 +1322,7 @@ static void intel_idle_state_table_update(void)
+ ivt_idle_state_table_update();
+ break;
+ case INTEL_FAM6_ATOM_GOLDMONT:
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ bxt_idle_state_table_update();
+ break;
+ case INTEL_FAM6_SKYLAKE_DESKTOP:
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index c61109f7b793..57c1ec322e42 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -247,7 +247,7 @@ static const struct sdhci_acpi_chip sdhci_acpi_chip_int = {
+ static bool sdhci_acpi_byt(void)
+ {
+ static const struct x86_cpu_id byt[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1 },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT },
+ {}
+ };
+
+diff --git a/drivers/pci/pci-mid.c b/drivers/pci/pci-mid.c
+index 314e135014dc..30fbe2ea6eab 100644
+--- a/drivers/pci/pci-mid.c
++++ b/drivers/pci/pci-mid.c
+@@ -62,8 +62,8 @@ static const struct pci_platform_pm_ops mid_pci_platform_pm = {
+ * arch/x86/platform/intel-mid/pwr.c.
+ */
+ static const struct x86_cpu_id lpss_cpu_ids[] = {
+- ICPU(INTEL_FAM6_ATOM_PENWELL),
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD),
++ ICPU(INTEL_FAM6_ATOM_SALTWELL_MID),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_MID),
+ {}
+ };
+
+diff --git a/drivers/platform/x86/intel_int0002_vgpio.c b/drivers/platform/x86/intel_int0002_vgpio.c
+index a473dc51b18d..e89ad4964dc1 100644
+--- a/drivers/platform/x86/intel_int0002_vgpio.c
++++ b/drivers/platform/x86/intel_int0002_vgpio.c
+@@ -60,7 +60,7 @@ static const struct x86_cpu_id int0002_cpu_ids[] = {
+ /*
+ * Limit ourselves to Cherry Trail for now, until testing shows we
+ * need to handle the INT0002 device on Baytrail too.
+- * ICPU(INTEL_FAM6_ATOM_SILVERMONT1), * Valleyview, Bay Trail *
++ * ICPU(INTEL_FAM6_ATOM_SILVERMONT), * Valleyview, Bay Trail *
+ */
+ ICPU(INTEL_FAM6_ATOM_AIRMONT), /* Braswell, Cherry Trail */
+ {}
+diff --git a/drivers/platform/x86/intel_mid_powerbtn.c b/drivers/platform/x86/intel_mid_powerbtn.c
+index d79fbf924b13..5ad44204a9c3 100644
+--- a/drivers/platform/x86/intel_mid_powerbtn.c
++++ b/drivers/platform/x86/intel_mid_powerbtn.c
+@@ -125,8 +125,8 @@ static const struct mid_pb_ddata mrfld_ddata = {
+ { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (kernel_ulong_t)&ddata }
+
+ static const struct x86_cpu_id mid_pb_cpu_ids[] = {
+- ICPU(INTEL_FAM6_ATOM_PENWELL, mfld_ddata),
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD, mrfld_ddata),
++ ICPU(INTEL_FAM6_ATOM_SALTWELL_MID, mfld_ddata),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_MID, mrfld_ddata),
+ {}
+ };
+
+diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c
+index 1423fa8710fd..b998d7da97fb 100644
+--- a/drivers/platform/x86/intel_telemetry_debugfs.c
++++ b/drivers/platform/x86/intel_telemetry_debugfs.c
+@@ -320,7 +320,7 @@ static struct telemetry_debugfs_conf telem_apl_debugfs_conf = {
+
+ static const struct x86_cpu_id telemetry_debugfs_cpu_ids[] = {
+ TELEM_DEBUGFS_CPU(INTEL_FAM6_ATOM_GOLDMONT, telem_apl_debugfs_conf),
+- TELEM_DEBUGFS_CPU(INTEL_FAM6_ATOM_GEMINI_LAKE, telem_apl_debugfs_conf),
++ TELEM_DEBUGFS_CPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, telem_apl_debugfs_conf),
+ {}
+ };
+
+diff --git a/drivers/platform/x86/intel_telemetry_pltdrv.c b/drivers/platform/x86/intel_telemetry_pltdrv.c
+index 2f889d6c270e..fcc6bee51a42 100644
+--- a/drivers/platform/x86/intel_telemetry_pltdrv.c
++++ b/drivers/platform/x86/intel_telemetry_pltdrv.c
+@@ -192,7 +192,7 @@ static struct telemetry_plt_config telem_glk_config = {
+
+ static const struct x86_cpu_id telemetry_cpu_ids[] = {
+ TELEM_CPU(INTEL_FAM6_ATOM_GOLDMONT, telem_apl_config),
+- TELEM_CPU(INTEL_FAM6_ATOM_GEMINI_LAKE, telem_glk_config),
++ TELEM_CPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, telem_glk_config),
+ {}
+ };
+
+diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
+index 295d8dcba48c..8cbfcce57a06 100644
+--- a/drivers/powercap/intel_rapl.c
++++ b/drivers/powercap/intel_rapl.c
+@@ -1164,13 +1164,13 @@ static const struct x86_cpu_id rapl_ids[] __initconst = {
+ RAPL_CPU(INTEL_FAM6_KABYLAKE_DESKTOP, rapl_defaults_core),
+ RAPL_CPU(INTEL_FAM6_CANNONLAKE_MOBILE, rapl_defaults_core),
+
+- RAPL_CPU(INTEL_FAM6_ATOM_SILVERMONT1, rapl_defaults_byt),
++ RAPL_CPU(INTEL_FAM6_ATOM_SILVERMONT, rapl_defaults_byt),
+ RAPL_CPU(INTEL_FAM6_ATOM_AIRMONT, rapl_defaults_cht),
+- RAPL_CPU(INTEL_FAM6_ATOM_MERRIFIELD, rapl_defaults_tng),
+- RAPL_CPU(INTEL_FAM6_ATOM_MOOREFIELD, rapl_defaults_ann),
++ RAPL_CPU(INTEL_FAM6_ATOM_SILVERMONT_MID, rapl_defaults_tng),
++ RAPL_CPU(INTEL_FAM6_ATOM_AIRMONT_MID, rapl_defaults_ann),
+ RAPL_CPU(INTEL_FAM6_ATOM_GOLDMONT, rapl_defaults_core),
+- RAPL_CPU(INTEL_FAM6_ATOM_GEMINI_LAKE, rapl_defaults_core),
+- RAPL_CPU(INTEL_FAM6_ATOM_DENVERTON, rapl_defaults_core),
++ RAPL_CPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, rapl_defaults_core),
++ RAPL_CPU(INTEL_FAM6_ATOM_GOLDMONT_X, rapl_defaults_core),
+
+ RAPL_CPU(INTEL_FAM6_XEON_PHI_KNL, rapl_defaults_hsw_server),
+ RAPL_CPU(INTEL_FAM6_XEON_PHI_KNM, rapl_defaults_hsw_server),
+diff --git a/drivers/thermal/intel_soc_dts_thermal.c b/drivers/thermal/intel_soc_dts_thermal.c
+index 1e47511a6bd5..d748527d7a38 100644
+--- a/drivers/thermal/intel_soc_dts_thermal.c
++++ b/drivers/thermal/intel_soc_dts_thermal.c
+@@ -45,7 +45,7 @@ static irqreturn_t soc_irq_thread_fn(int irq, void *dev_data)
+ }
+
+ static const struct x86_cpu_id soc_thermal_ids[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1, 0,
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT, 0,
+ BYT_SOC_DTS_APIC_IRQ},
+ {}
+ };
+diff --git a/include/linux/cpu.h b/include/linux/cpu.h
+index 5041357d0297..57ae83c4d5f4 100644
+--- a/include/linux/cpu.h
++++ b/include/linux/cpu.h
+@@ -57,6 +57,8 @@ extern ssize_t cpu_show_spec_store_bypass(struct device *dev,
+ struct device_attribute *attr, char *buf);
+ extern ssize_t cpu_show_l1tf(struct device *dev,
+ struct device_attribute *attr, char *buf);
++extern ssize_t cpu_show_mds(struct device *dev,
++ struct device_attribute *attr, char *buf);
+
+ extern __printf(4, 5)
+ struct device *cpu_device_create(struct device *parent, void *drvdata,
+@@ -187,4 +189,28 @@ static inline void cpu_smt_disable(bool force) { }
+ static inline void cpu_smt_check_topology(void) { }
+ #endif
+
++/*
++ * These are used for a global "mitigations=" cmdline option for toggling
++ * optional CPU mitigations.
++ */
++enum cpu_mitigations {
++ CPU_MITIGATIONS_OFF,
++ CPU_MITIGATIONS_AUTO,
++ CPU_MITIGATIONS_AUTO_NOSMT,
++};
++
++extern enum cpu_mitigations cpu_mitigations;
++
++/* mitigations=off */
++static inline bool cpu_mitigations_off(void)
++{
++ return cpu_mitigations == CPU_MITIGATIONS_OFF;
++}
++
++/* mitigations=auto,nosmt */
++static inline bool cpu_mitigations_auto_nosmt(void)
++{
++ return cpu_mitigations == CPU_MITIGATIONS_AUTO_NOSMT;
++}
++
+ #endif /* _LINUX_CPU_H_ */
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index dc250ec2c096..bc6c880a093f 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2278,3 +2278,18 @@ void __init boot_cpu_hotplug_init(void)
+ #endif
+ this_cpu_write(cpuhp_state.state, CPUHP_ONLINE);
+ }
++
++enum cpu_mitigations cpu_mitigations __ro_after_init = CPU_MITIGATIONS_AUTO;
++
++static int __init mitigations_parse_cmdline(char *arg)
++{
++ if (!strcmp(arg, "off"))
++ cpu_mitigations = CPU_MITIGATIONS_OFF;
++ else if (!strcmp(arg, "auto"))
++ cpu_mitigations = CPU_MITIGATIONS_AUTO;
++ else if (!strcmp(arg, "auto,nosmt"))
++ cpu_mitigations = CPU_MITIGATIONS_AUTO_NOSMT;
++
++ return 0;
++}
++early_param("mitigations", mitigations_parse_cmdline);
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index b74bbee111c6..c6c8d20be1d2 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -787,7 +787,7 @@ static struct snd_soc_card byt_rt5651_card = {
+ };
+
+ static const struct x86_cpu_id baytrail_cpu_ids[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1 }, /* Valleyview */
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT }, /* Valleyview */
+ {}
+ };
+
+diff --git a/tools/power/x86/turbostat/Makefile b/tools/power/x86/turbostat/Makefile
+index 2ab25aa38263..ff058bfbca3e 100644
+--- a/tools/power/x86/turbostat/Makefile
++++ b/tools/power/x86/turbostat/Makefile
+@@ -9,7 +9,7 @@ ifeq ("$(origin O)", "command line")
+ endif
+
+ turbostat : turbostat.c
+-CFLAGS += -Wall
++CFLAGS += -Wall -I../../../include
+ CFLAGS += -DMSRHEADER='"../../../../arch/x86/include/asm/msr-index.h"'
+ CFLAGS += -DINTEL_FAMILY_HEADER='"../../../../arch/x86/include/asm/intel-family.h"'
+
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 83964f796edb..fbb53c952b73 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -2082,7 +2082,7 @@ int has_turbo_ratio_group_limits(int family, int model)
+ switch (model) {
+ case INTEL_FAM6_ATOM_GOLDMONT:
+ case INTEL_FAM6_SKYLAKE_X:
+- case INTEL_FAM6_ATOM_DENVERTON:
++ case INTEL_FAM6_ATOM_GOLDMONT_X:
+ return 1;
+ }
+ return 0;
+@@ -3149,9 +3149,9 @@ int probe_nhm_msrs(unsigned int family, unsigned int model)
+ pkg_cstate_limits = skx_pkg_cstate_limits;
+ has_misc_feature_control = 1;
+ break;
+- case INTEL_FAM6_ATOM_SILVERMONT1: /* BYT */
++ case INTEL_FAM6_ATOM_SILVERMONT: /* BYT */
+ no_MSR_MISC_PWR_MGMT = 1;
+- case INTEL_FAM6_ATOM_SILVERMONT2: /* AVN */
++ case INTEL_FAM6_ATOM_SILVERMONT_X: /* AVN */
+ pkg_cstate_limits = slv_pkg_cstate_limits;
+ break;
+ case INTEL_FAM6_ATOM_AIRMONT: /* AMT */
+@@ -3163,8 +3163,8 @@ int probe_nhm_msrs(unsigned int family, unsigned int model)
+ pkg_cstate_limits = phi_pkg_cstate_limits;
+ break;
+ case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
+- case INTEL_FAM6_ATOM_DENVERTON: /* DNV */
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
++ case INTEL_FAM6_ATOM_GOLDMONT_X: /* DNV */
+ pkg_cstate_limits = bxt_pkg_cstate_limits;
+ break;
+ default:
+@@ -3193,9 +3193,9 @@ int has_slv_msrs(unsigned int family, unsigned int model)
+ return 0;
+
+ switch (model) {
+- case INTEL_FAM6_ATOM_SILVERMONT1:
+- case INTEL_FAM6_ATOM_MERRIFIELD:
+- case INTEL_FAM6_ATOM_MOOREFIELD:
++ case INTEL_FAM6_ATOM_SILVERMONT:
++ case INTEL_FAM6_ATOM_SILVERMONT_MID:
++ case INTEL_FAM6_ATOM_AIRMONT_MID:
+ return 1;
+ }
+ return 0;
+@@ -3207,7 +3207,7 @@ int is_dnv(unsigned int family, unsigned int model)
+ return 0;
+
+ switch (model) {
+- case INTEL_FAM6_ATOM_DENVERTON:
++ case INTEL_FAM6_ATOM_GOLDMONT_X:
+ return 1;
+ }
+ return 0;
+@@ -3724,8 +3724,8 @@ double get_tdp(unsigned int model)
+ return ((msr >> 0) & RAPL_POWER_GRANULARITY) * rapl_power_units;
+
+ switch (model) {
+- case INTEL_FAM6_ATOM_SILVERMONT1:
+- case INTEL_FAM6_ATOM_SILVERMONT2:
++ case INTEL_FAM6_ATOM_SILVERMONT:
++ case INTEL_FAM6_ATOM_SILVERMONT_X:
+ return 30.0;
+ default:
+ return 135.0;
+@@ -3791,7 +3791,7 @@ void rapl_probe(unsigned int family, unsigned int model)
+ }
+ break;
+ case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ do_rapl = RAPL_PKG | RAPL_PKG_POWER_INFO;
+ if (rapl_joules)
+ BIC_PRESENT(BIC_Pkg_J);
+@@ -3850,8 +3850,8 @@ void rapl_probe(unsigned int family, unsigned int model)
+ BIC_PRESENT(BIC_RAMWatt);
+ }
+ break;
+- case INTEL_FAM6_ATOM_SILVERMONT1: /* BYT */
+- case INTEL_FAM6_ATOM_SILVERMONT2: /* AVN */
++ case INTEL_FAM6_ATOM_SILVERMONT: /* BYT */
++ case INTEL_FAM6_ATOM_SILVERMONT_X: /* AVN */
+ do_rapl = RAPL_PKG | RAPL_CORES;
+ if (rapl_joules) {
+ BIC_PRESENT(BIC_Pkg_J);
+@@ -3861,7 +3861,7 @@ void rapl_probe(unsigned int family, unsigned int model)
+ BIC_PRESENT(BIC_CorWatt);
+ }
+ break;
+- case INTEL_FAM6_ATOM_DENVERTON: /* DNV */
++ case INTEL_FAM6_ATOM_GOLDMONT_X: /* DNV */
+ do_rapl = RAPL_PKG | RAPL_DRAM | RAPL_DRAM_POWER_INFO | RAPL_DRAM_PERF_STATUS | RAPL_PKG_PERF_STATUS | RAPL_PKG_POWER_INFO | RAPL_CORES_ENERGY_STATUS;
+ BIC_PRESENT(BIC_PKG__);
+ BIC_PRESENT(BIC_RAM__);
+@@ -3884,7 +3884,7 @@ void rapl_probe(unsigned int family, unsigned int model)
+ return;
+
+ rapl_power_units = 1.0 / (1 << (msr & 0xF));
+- if (model == INTEL_FAM6_ATOM_SILVERMONT1)
++ if (model == INTEL_FAM6_ATOM_SILVERMONT)
+ rapl_energy_units = 1.0 * (1 << (msr >> 8 & 0x1F)) / 1000000;
+ else
+ rapl_energy_units = 1.0 / (1 << (msr >> 8 & 0x1F));
+@@ -4141,8 +4141,8 @@ int has_snb_msrs(unsigned int family, unsigned int model)
+ case INTEL_FAM6_CANNONLAKE_MOBILE: /* CNL */
+ case INTEL_FAM6_SKYLAKE_X: /* SKX */
+ case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
+- case INTEL_FAM6_ATOM_DENVERTON: /* DNV */
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
++ case INTEL_FAM6_ATOM_GOLDMONT_X: /* DNV */
+ return 1;
+ }
+ return 0;
+@@ -4174,7 +4174,7 @@ int has_hsw_msrs(unsigned int family, unsigned int model)
+ case INTEL_FAM6_KABYLAKE_DESKTOP: /* KBL */
+ case INTEL_FAM6_CANNONLAKE_MOBILE: /* CNL */
+ case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ return 1;
+ }
+ return 0;
+@@ -4209,8 +4209,8 @@ int is_slm(unsigned int family, unsigned int model)
+ if (!genuine_intel)
+ return 0;
+ switch (model) {
+- case INTEL_FAM6_ATOM_SILVERMONT1: /* BYT */
+- case INTEL_FAM6_ATOM_SILVERMONT2: /* AVN */
++ case INTEL_FAM6_ATOM_SILVERMONT: /* BYT */
++ case INTEL_FAM6_ATOM_SILVERMONT_X: /* AVN */
+ return 1;
+ }
+ return 0;
+@@ -4581,11 +4581,11 @@ void process_cpuid()
+ case INTEL_FAM6_KABYLAKE_DESKTOP: /* KBL */
+ crystal_hz = 24000000; /* 24.0 MHz */
+ break;
+- case INTEL_FAM6_ATOM_DENVERTON: /* DNV */
++ case INTEL_FAM6_ATOM_GOLDMONT_X: /* DNV */
+ crystal_hz = 25000000; /* 25.0 MHz */
+ break;
+ case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ crystal_hz = 19200000; /* 19.2 MHz */
+ break;
+ default:
+diff --git a/tools/power/x86/x86_energy_perf_policy/Makefile b/tools/power/x86/x86_energy_perf_policy/Makefile
+index f4534fb8b951..da781b430937 100644
+--- a/tools/power/x86/x86_energy_perf_policy/Makefile
++++ b/tools/power/x86/x86_energy_perf_policy/Makefile
+@@ -9,7 +9,7 @@ ifeq ("$(origin O)", "command line")
+ endif
+
+ x86_energy_perf_policy : x86_energy_perf_policy.c
+-CFLAGS += -Wall
++CFLAGS += -Wall -I../../../include
+ CFLAGS += -DMSRHEADER='"../../../../arch/x86/include/asm/msr-index.h"'
+
+ %: %.c
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-05-16 23:03 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-05-16 23:03 UTC (permalink / raw
To: gentoo-commits
commit: 3a75bc17ef5cdd8ac3cd3a694ffed2dcb8370e13
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu May 16 23:03:28 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu May 16 23:03:28 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3a75bc17
Linux patch 4.19.44
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1043_linux-4.19.44.patch | 3766 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3770 insertions(+)
diff --git a/0000_README b/0000_README
index 0fb9c26..f799222 100644
--- a/0000_README
+++ b/0000_README
@@ -215,6 +215,10 @@ Patch: 1042_linux-4.19.43.patch
From: http://www.kernel.org
Desc: Linux 4.19.43
+Patch: 1043_linux-4.19.44.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.44
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1043_linux-4.19.44.patch b/1043_linux-4.19.44.patch
new file mode 100644
index 0000000..fbdd5f6
--- /dev/null
+++ b/1043_linux-4.19.44.patch
@@ -0,0 +1,3766 @@
+diff --git a/Makefile b/Makefile
+index be894b3a97d5..dd11f5a83d2f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 43
++SUBLEVEL = 44
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
+index ec29de250076..cab89479d15e 100644
+--- a/arch/arm/kernel/head-nommu.S
++++ b/arch/arm/kernel/head-nommu.S
+@@ -133,9 +133,9 @@ __secondary_data:
+ */
+ .text
+ __after_proc_init:
+-#ifdef CONFIG_ARM_MPU
+ M_CLASS(movw r12, #:lower16:BASEADDR_V7M_SCB)
+ M_CLASS(movt r12, #:upper16:BASEADDR_V7M_SCB)
++#ifdef CONFIG_ARM_MPU
+ M_CLASS(ldr r3, [r12, 0x50])
+ AR_CLASS(mrc p15, 0, r3, c0, c1, 4) @ Read ID_MMFR0
+ and r3, r3, #(MMFR0_PMSA) @ PMSA field
+diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
+index 4c7a93f4039a..7c0b2e6cdfbd 100644
+--- a/arch/mips/ath79/setup.c
++++ b/arch/mips/ath79/setup.c
+@@ -211,12 +211,6 @@ const char *get_system_type(void)
+ return ath79_sys_type;
+ }
+
+-int get_c0_perfcount_int(void)
+-{
+- return ATH79_MISC_IRQ(5);
+-}
+-EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
+-
+ unsigned int get_c0_compare_int(void)
+ {
+ return CP0_LEGACY_COMPARE_IRQ;
+diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h
+index 391ed2c3b697..f9019b579903 100644
+--- a/arch/powerpc/include/asm/book3s/64/pgalloc.h
++++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h
+@@ -83,6 +83,9 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+
+ pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+ pgtable_gfp_flags(mm, GFP_KERNEL));
++ if (unlikely(!pgd))
++ return pgd;
++
+ /*
+ * Don't scan the PGD for pointers, it contains references to PUDs but
+ * those references are not full pointers and so can't be recognised by
+diff --git a/arch/powerpc/include/asm/reg_booke.h b/arch/powerpc/include/asm/reg_booke.h
+index eb2a33d5df26..e382bd6ede84 100644
+--- a/arch/powerpc/include/asm/reg_booke.h
++++ b/arch/powerpc/include/asm/reg_booke.h
+@@ -41,7 +41,7 @@
+ #if defined(CONFIG_PPC_BOOK3E_64)
+ #define MSR_64BIT MSR_CM
+
+-#define MSR_ (MSR_ME | MSR_CE)
++#define MSR_ (MSR_ME | MSR_RI | MSR_CE)
+ #define MSR_KERNEL (MSR_ | MSR_64BIT)
+ #define MSR_USER32 (MSR_ | MSR_PR | MSR_EE)
+ #define MSR_USER64 (MSR_USER32 | MSR_64BIT)
+diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
+index 7f5ac2e8581b..36178000a2f2 100644
+--- a/arch/powerpc/kernel/idle_book3s.S
++++ b/arch/powerpc/kernel/idle_book3s.S
+@@ -170,6 +170,9 @@ core_idle_lock_held:
+ bne- core_idle_lock_held
+ blr
+
++/* Reuse an unused pt_regs slot for IAMR */
++#define PNV_POWERSAVE_IAMR _DAR
++
+ /*
+ * Pass requested state in r3:
+ * r3 - PNV_THREAD_NAP/SLEEP/WINKLE in POWER8
+@@ -200,6 +203,12 @@ pnv_powersave_common:
+ /* Continue saving state */
+ SAVE_GPR(2, r1)
+ SAVE_NVGPRS(r1)
++
++BEGIN_FTR_SECTION
++ mfspr r5, SPRN_IAMR
++ std r5, PNV_POWERSAVE_IAMR(r1)
++END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
++
+ mfcr r5
+ std r5,_CCR(r1)
+ std r1,PACAR1(r13)
+@@ -924,6 +933,17 @@ BEGIN_FTR_SECTION
+ END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)
+ REST_NVGPRS(r1)
+ REST_GPR(2, r1)
++
++BEGIN_FTR_SECTION
++ /* IAMR was saved in pnv_powersave_common() */
++ ld r5, PNV_POWERSAVE_IAMR(r1)
++ mtspr SPRN_IAMR, r5
++ /*
++ * We don't need an isync here because the upcoming mtmsrd is
++ * execution synchronizing.
++ */
++END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
++
+ ld r4,PACAKMSR(r13)
+ ld r5,_LINK(r1)
+ ld r6,_CCR(r1)
+diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
+index 4ccbf611a3c5..70568ccbd9fd 100644
+--- a/arch/powerpc/kernel/security.c
++++ b/arch/powerpc/kernel/security.c
+@@ -4,6 +4,7 @@
+ //
+ // Copyright 2018, Michael Ellerman, IBM Corporation.
+
++#include <linux/cpu.h>
+ #include <linux/kernel.h>
+ #include <linux/device.h>
+ #include <linux/seq_buf.h>
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index 61c1fadbc644..6dc43205382b 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -338,13 +338,12 @@ void arch_send_call_function_ipi_mask(const struct cpumask *mask)
+ * NMI IPIs may not be recoverable, so should not be used as ongoing part of
+ * a running system. They can be used for crash, debug, halt/reboot, etc.
+ *
+- * NMI IPIs are globally single threaded. No more than one in progress at
+- * any time.
+- *
+ * The IPI call waits with interrupts disabled until all targets enter the
+- * NMI handler, then the call returns.
++ * NMI handler, then returns. Subsequent IPIs can be issued before targets
++ * have returned from their handlers, so there is no guarantee about
++ * concurrency or re-entrancy.
+ *
+- * No new NMI can be initiated until targets exit the handler.
++ * A new NMI can be issued before all targets exit the handler.
+ *
+ * The IPI call may time out without all targets entering the NMI handler.
+ * In that case, there is some logic to recover (and ignore subsequent
+@@ -355,7 +354,7 @@ void arch_send_call_function_ipi_mask(const struct cpumask *mask)
+
+ static atomic_t __nmi_ipi_lock = ATOMIC_INIT(0);
+ static struct cpumask nmi_ipi_pending_mask;
+-static int nmi_ipi_busy_count = 0;
++static bool nmi_ipi_busy = false;
+ static void (*nmi_ipi_function)(struct pt_regs *) = NULL;
+
+ static void nmi_ipi_lock_start(unsigned long *flags)
+@@ -394,7 +393,7 @@ static void nmi_ipi_unlock_end(unsigned long *flags)
+ */
+ int smp_handle_nmi_ipi(struct pt_regs *regs)
+ {
+- void (*fn)(struct pt_regs *);
++ void (*fn)(struct pt_regs *) = NULL;
+ unsigned long flags;
+ int me = raw_smp_processor_id();
+ int ret = 0;
+@@ -405,29 +404,17 @@ int smp_handle_nmi_ipi(struct pt_regs *regs)
+ * because the caller may have timed out.
+ */
+ nmi_ipi_lock_start(&flags);
+- if (!nmi_ipi_busy_count)
+- goto out;
+- if (!cpumask_test_cpu(me, &nmi_ipi_pending_mask))
+- goto out;
+-
+- fn = nmi_ipi_function;
+- if (!fn)
+- goto out;
+-
+- cpumask_clear_cpu(me, &nmi_ipi_pending_mask);
+- nmi_ipi_busy_count++;
+- nmi_ipi_unlock();
+-
+- ret = 1;
+-
+- fn(regs);
+-
+- nmi_ipi_lock();
+- if (nmi_ipi_busy_count > 1) /* Can race with caller time-out */
+- nmi_ipi_busy_count--;
+-out:
++ if (cpumask_test_cpu(me, &nmi_ipi_pending_mask)) {
++ cpumask_clear_cpu(me, &nmi_ipi_pending_mask);
++ fn = READ_ONCE(nmi_ipi_function);
++ WARN_ON_ONCE(!fn);
++ ret = 1;
++ }
+ nmi_ipi_unlock_end(&flags);
+
++ if (fn)
++ fn(regs);
++
+ return ret;
+ }
+
+@@ -453,7 +440,7 @@ static void do_smp_send_nmi_ipi(int cpu, bool safe)
+ * - cpu is the target CPU (must not be this CPU), or NMI_IPI_ALL_OTHERS.
+ * - fn is the target callback function.
+ * - delay_us > 0 is the delay before giving up waiting for targets to
+- * complete executing the handler, == 0 specifies indefinite delay.
++ * begin executing the handler, == 0 specifies indefinite delay.
+ */
+ int __smp_send_nmi_ipi(int cpu, void (*fn)(struct pt_regs *), u64 delay_us, bool safe)
+ {
+@@ -467,31 +454,33 @@ int __smp_send_nmi_ipi(int cpu, void (*fn)(struct pt_regs *), u64 delay_us, bool
+ if (unlikely(!smp_ops))
+ return 0;
+
+- /* Take the nmi_ipi_busy count/lock with interrupts hard disabled */
+ nmi_ipi_lock_start(&flags);
+- while (nmi_ipi_busy_count) {
++ while (nmi_ipi_busy) {
+ nmi_ipi_unlock_end(&flags);
+- spin_until_cond(nmi_ipi_busy_count == 0);
++ spin_until_cond(!nmi_ipi_busy);
+ nmi_ipi_lock_start(&flags);
+ }
+-
++ nmi_ipi_busy = true;
+ nmi_ipi_function = fn;
+
++ WARN_ON_ONCE(!cpumask_empty(&nmi_ipi_pending_mask));
++
+ if (cpu < 0) {
+ /* ALL_OTHERS */
+ cpumask_copy(&nmi_ipi_pending_mask, cpu_online_mask);
+ cpumask_clear_cpu(me, &nmi_ipi_pending_mask);
+ } else {
+- /* cpumask starts clear */
+ cpumask_set_cpu(cpu, &nmi_ipi_pending_mask);
+ }
+- nmi_ipi_busy_count++;
++
+ nmi_ipi_unlock();
+
++ /* Interrupts remain hard disabled */
++
+ do_smp_send_nmi_ipi(cpu, safe);
+
+ nmi_ipi_lock();
+- /* nmi_ipi_busy_count is held here, so unlock/lock is okay */
++ /* nmi_ipi_busy is set here, so unlock/lock is okay */
+ while (!cpumask_empty(&nmi_ipi_pending_mask)) {
+ nmi_ipi_unlock();
+ udelay(1);
+@@ -503,29 +492,15 @@ int __smp_send_nmi_ipi(int cpu, void (*fn)(struct pt_regs *), u64 delay_us, bool
+ }
+ }
+
+- while (nmi_ipi_busy_count > 1) {
+- nmi_ipi_unlock();
+- udelay(1);
+- nmi_ipi_lock();
+- if (delay_us) {
+- delay_us--;
+- if (!delay_us)
+- break;
+- }
+- }
+-
+ if (!cpumask_empty(&nmi_ipi_pending_mask)) {
+ /* Timeout waiting for CPUs to call smp_handle_nmi_ipi */
+ ret = 0;
+ cpumask_clear(&nmi_ipi_pending_mask);
+ }
+- if (nmi_ipi_busy_count > 1) {
+- /* Timeout waiting for CPUs to execute fn */
+- ret = 0;
+- nmi_ipi_busy_count = 1;
+- }
+
+- nmi_ipi_busy_count--;
++ nmi_ipi_function = NULL;
++ nmi_ipi_busy = false;
++
+ nmi_ipi_unlock_end(&flags);
+
+ return ret;
+@@ -593,17 +568,8 @@ void crash_send_ipi(void (*crash_ipi_callback)(struct pt_regs *))
+ static void nmi_stop_this_cpu(struct pt_regs *regs)
+ {
+ /*
+- * This is a special case because it never returns, so the NMI IPI
+- * handling would never mark it as done, which makes any later
+- * smp_send_nmi_ipi() call spin forever. Mark it done now.
+- *
+ * IRQs are already hard disabled by the smp_handle_nmi_ipi.
+ */
+- nmi_ipi_lock();
+- if (nmi_ipi_busy_count > 1)
+- nmi_ipi_busy_count--;
+- nmi_ipi_unlock();
+-
+ spin_begin();
+ while (1)
+ spin_cpu_relax();
+diff --git a/arch/um/drivers/port_user.c b/arch/um/drivers/port_user.c
+index 9a8e1b64c22e..5f56d11b886f 100644
+--- a/arch/um/drivers/port_user.c
++++ b/arch/um/drivers/port_user.c
+@@ -168,7 +168,7 @@ int port_connection(int fd, int *socket, int *pid_out)
+ {
+ int new, err;
+ char *argv[] = { "/usr/sbin/in.telnetd", "-L",
+- "/usr/lib/uml/port-helper", NULL };
++ OS_LIB_PATH "/uml/port-helper", NULL };
+ struct port_pre_exec_data data;
+
+ new = accept(fd, NULL, 0);
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index acb901b43ce4..544bc2dfe408 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -749,11 +749,16 @@ asm(
+ NOKPROBE_SYMBOL(kretprobe_trampoline);
+ STACK_FRAME_NON_STANDARD(kretprobe_trampoline);
+
++static struct kprobe kretprobe_kprobe = {
++ .addr = (void *)kretprobe_trampoline,
++};
++
+ /*
+ * Called from kretprobe_trampoline
+ */
+ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ {
++ struct kprobe_ctlblk *kcb;
+ struct kretprobe_instance *ri = NULL;
+ struct hlist_head *head, empty_rp;
+ struct hlist_node *tmp;
+@@ -763,6 +768,17 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ void *frame_pointer;
+ bool skipped = false;
+
++ preempt_disable();
++
++ /*
++ * Set a dummy kprobe for avoiding kretprobe recursion.
++ * Since kretprobe never run in kprobe handler, kprobe must not
++ * be running at this point.
++ */
++ kcb = get_kprobe_ctlblk();
++ __this_cpu_write(current_kprobe, &kretprobe_kprobe);
++ kcb->kprobe_status = KPROBE_HIT_ACTIVE;
++
+ INIT_HLIST_HEAD(&empty_rp);
+ kretprobe_hash_lock(current, &head, &flags);
+ /* fixup registers */
+@@ -838,10 +854,9 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ orig_ret_address = (unsigned long)ri->ret_addr;
+ if (ri->rp && ri->rp->handler) {
+ __this_cpu_write(current_kprobe, &ri->rp->kp);
+- get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
+ ri->ret_addr = correct_ret_addr;
+ ri->rp->handler(ri, regs);
+- __this_cpu_write(current_kprobe, NULL);
++ __this_cpu_write(current_kprobe, &kretprobe_kprobe);
+ }
+
+ recycle_rp_inst(ri, &empty_rp);
+@@ -857,6 +872,9 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+
+ kretprobe_hash_unlock(current, &flags);
+
++ __this_cpu_write(current_kprobe, NULL);
++ preempt_enable();
++
+ hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
+ hlist_del(&ri->hlist);
+ kfree(ri);
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 725624b6c0c0..8fd3cedd9acc 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -81,6 +81,19 @@ static int __init set_bios_reboot(const struct dmi_system_id *d)
+ return 0;
+ }
+
++/*
++ * Some machines don't handle the default ACPI reboot method and
++ * require the EFI reboot method:
++ */
++static int __init set_efi_reboot(const struct dmi_system_id *d)
++{
++ if (reboot_type != BOOT_EFI && !efi_runtime_disabled()) {
++ reboot_type = BOOT_EFI;
++ pr_info("%s series board detected. Selecting EFI-method for reboot.\n", d->ident);
++ }
++ return 0;
++}
++
+ void __noreturn machine_real_restart(unsigned int type)
+ {
+ local_irq_disable();
+@@ -166,6 +179,14 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "AOA110"),
+ },
+ },
++ { /* Handle reboot issue on Acer TravelMate X514-51T */
++ .callback = set_efi_reboot,
++ .ident = "Acer TravelMate X514-51T",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate X514-51T"),
++ },
++ },
+
+ /* Apple */
+ { /* Handle problems with rebooting on Apple MacBook5 */
+diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
+index c63bab98780c..85e6d5620188 100644
+--- a/arch/x86/kernel/vmlinux.lds.S
++++ b/arch/x86/kernel/vmlinux.lds.S
+@@ -372,7 +372,7 @@ SECTIONS
+ .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
+ __bss_start = .;
+ *(.bss..page_aligned)
+- *(.bss)
++ *(BSS_MAIN)
+ BSS_DECRYPTED
+ . = ALIGN(PAGE_SIZE);
+ __bss_stop = .;
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 3692de84c420..d2f5aa220355 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -133,6 +133,7 @@ static inline bool kvm_apic_map_get_logical_dest(struct kvm_apic_map *map,
+ if (offset <= max_apic_id) {
+ u8 cluster_size = min(max_apic_id - offset + 1, 16U);
+
++ offset = array_index_nospec(offset, map->max_apic_id + 1);
+ *cluster = &map->phys_map[offset];
+ *mask = dest_id & (0xffff >> (16 - cluster_size));
+ } else {
+@@ -896,7 +897,8 @@ static inline bool kvm_apic_map_get_dest_lapic(struct kvm *kvm,
+ if (irq->dest_id > map->max_apic_id) {
+ *bitmap = 0;
+ } else {
+- *dst = &map->phys_map[irq->dest_id];
++ u32 dest_id = array_index_nospec(irq->dest_id, map->max_apic_id + 1);
++ *dst = &map->phys_map[dest_id];
+ *bitmap = 1;
+ }
+ return true;
+diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
+index 0f997683404f..b3f219b7c840 100644
+--- a/arch/x86/kvm/trace.h
++++ b/arch/x86/kvm/trace.h
+@@ -438,13 +438,13 @@ TRACE_EVENT(kvm_apic_ipi,
+ );
+
+ TRACE_EVENT(kvm_apic_accept_irq,
+- TP_PROTO(__u32 apicid, __u16 dm, __u8 tm, __u8 vec),
++ TP_PROTO(__u32 apicid, __u16 dm, __u16 tm, __u8 vec),
+ TP_ARGS(apicid, dm, tm, vec),
+
+ TP_STRUCT__entry(
+ __field( __u32, apicid )
+ __field( __u16, dm )
+- __field( __u8, tm )
++ __field( __u16, tm )
+ __field( __u8, vec )
+ ),
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index c5e2c5a01182..15e8c9955b79 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -5226,7 +5226,7 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
+ return min_shallow;
+ }
+
+-static int bfq_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int index)
++static void bfq_depth_updated(struct blk_mq_hw_ctx *hctx)
+ {
+ struct bfq_data *bfqd = hctx->queue->elevator->elevator_data;
+ struct blk_mq_tags *tags = hctx->sched_tags;
+@@ -5234,6 +5234,11 @@ static int bfq_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int index)
+
+ min_shallow = bfq_update_depths(bfqd, &tags->bitmap_tags);
+ sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, min_shallow);
++}
++
++static int bfq_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int index)
++{
++ bfq_depth_updated(hctx);
+ return 0;
+ }
+
+@@ -5656,6 +5661,7 @@ static struct elevator_type iosched_bfq_mq = {
+ .requests_merged = bfq_requests_merged,
+ .request_merged = bfq_request_merged,
+ .has_work = bfq_has_work,
++ .depth_updated = bfq_depth_updated,
+ .init_hctx = bfq_init_hctx,
+ .init_sched = bfq_init_queue,
+ .exit_sched = bfq_exit_queue,
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 414656796ecf..4e563ee462cb 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2887,6 +2887,8 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
+ }
+ if (ret)
+ break;
++ if (q->elevator && q->elevator->type->ops.mq.depth_updated)
++ q->elevator->type->ops.mq.depth_updated(hctx);
+ }
+
+ if (!ret)
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 925dbc751322..8340c81b258b 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -542,6 +542,12 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ goto out;
+ }
+
++ dev_dbg(dev, "%s cmd: %s output length: %d\n", dimm_name,
++ cmd_name, out_obj->buffer.length);
++ print_hex_dump_debug(cmd_name, DUMP_PREFIX_OFFSET, 4, 4,
++ out_obj->buffer.pointer,
++ min_t(u32, 128, out_obj->buffer.length), true);
++
+ if (call_pkg) {
+ call_pkg->nd_fw_size = out_obj->buffer.length;
+ memcpy(call_pkg->nd_payload + call_pkg->nd_size_in,
+@@ -560,12 +566,6 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
+ return 0;
+ }
+
+- dev_dbg(dev, "%s cmd: %s output length: %d\n", dimm_name,
+- cmd_name, out_obj->buffer.length);
+- print_hex_dump_debug(cmd_name, DUMP_PREFIX_OFFSET, 4, 4,
+- out_obj->buffer.pointer,
+- min_t(u32, 128, out_obj->buffer.length), true);
+-
+ for (i = 0, offset = 0; i < desc->out_num; i++) {
+ u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i, buf,
+ (u32 *) out_obj->buffer.pointer,
+diff --git a/drivers/char/ipmi/ipmi_si_hardcode.c b/drivers/char/ipmi/ipmi_si_hardcode.c
+index 9ae2405c28bb..0c28e872ad3a 100644
+--- a/drivers/char/ipmi/ipmi_si_hardcode.c
++++ b/drivers/char/ipmi/ipmi_si_hardcode.c
+@@ -200,6 +200,8 @@ void __init ipmi_hardcode_init(void)
+ char *str;
+ char *si_type[SI_MAX_PARMS];
+
++ memset(si_type, 0, sizeof(si_type));
++
+ /* Parse out the si_type string into its components. */
+ str = si_type_str;
+ if (*str != '\0') {
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index c1ddafa4c299..4d37f018d846 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -136,6 +136,7 @@ config VT8500_TIMER
+ config NPCM7XX_TIMER
+ bool "NPCM7xx timer driver" if COMPILE_TEST
+ depends on HAS_IOMEM
++ select TIMER_OF
+ select CLKSRC_MMIO
+ help
+ Enable 24-bit TIMER0 and TIMER1 counters in the NPCM7xx architecture,
+diff --git a/drivers/clocksource/timer-oxnas-rps.c b/drivers/clocksource/timer-oxnas-rps.c
+index eed6feff8b5f..30c6f4ce672b 100644
+--- a/drivers/clocksource/timer-oxnas-rps.c
++++ b/drivers/clocksource/timer-oxnas-rps.c
+@@ -296,4 +296,4 @@ err_alloc:
+ TIMER_OF_DECLARE(ox810se_rps,
+ "oxsemi,ox810se-rps-timer", oxnas_rps_timer_init);
+ TIMER_OF_DECLARE(ox820_rps,
+- "oxsemi,ox820se-rps-timer", oxnas_rps_timer_init);
++ "oxsemi,ox820-rps-timer", oxnas_rps_timer_init);
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index bb0cda727605..e3f5e5d6f0c1 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -1213,6 +1213,11 @@ static enum surface_update_type det_surface_update(const struct dc *dc,
+ return UPDATE_TYPE_FULL;
+ }
+
++ if (u->surface->force_full_update) {
++ update_flags->bits.full_update = 1;
++ return UPDATE_TYPE_FULL;
++ }
++
+ type = get_plane_info_update_type(u);
+ elevate_update_type(&overall_type, type);
+
+@@ -1467,6 +1472,14 @@ void dc_commit_updates_for_stream(struct dc *dc,
+ }
+
+ dc_resource_state_copy_construct(state, context);
++
++ for (i = 0; i < dc->res_pool->pipe_count; i++) {
++ struct pipe_ctx *new_pipe = &context->res_ctx.pipe_ctx[i];
++ struct pipe_ctx *old_pipe = &dc->current_state->res_ctx.pipe_ctx[i];
++
++ if (new_pipe->plane_state && new_pipe->plane_state != old_pipe->plane_state)
++ new_pipe->plane_state->force_full_update = true;
++ }
+ }
+
+
+@@ -1510,6 +1523,12 @@ void dc_commit_updates_for_stream(struct dc *dc,
+ dc->current_state = context;
+ dc_release_state(old);
+
++ for (i = 0; i < dc->res_pool->pipe_count; i++) {
++ struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
++
++ if (pipe_ctx->plane_state && pipe_ctx->stream == stream)
++ pipe_ctx->plane_state->force_full_update = false;
++ }
+ }
+ /*let's use current_state to update watermark etc*/
+ if (update_type >= UPDATE_TYPE_FULL)
+diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
+index 6c9990bef267..4094b4f50111 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc.h
++++ b/drivers/gpu/drm/amd/display/dc/dc.h
+@@ -505,6 +505,9 @@ struct dc_plane_state {
+ struct dc_plane_status status;
+ struct dc_context *ctx;
+
++ /* HACK: Workaround for forcing full reprogramming under some conditions */
++ bool force_full_update;
++
+ /* private to dc_surface.c */
+ enum dc_irq_source irq_source;
+ struct kref refcount;
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_aux.c b/drivers/gpu/drm/amd/display/dc/dce/dce_aux.c
+index 3f5b2e6f7553..df936edac5c7 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_aux.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_aux.c
+@@ -189,6 +189,12 @@ static void submit_channel_request(
+ 1,
+ 0);
+ }
++
++ REG_UPDATE(AUX_INTERRUPT_CONTROL, AUX_SW_DONE_ACK, 1);
++
++ REG_WAIT(AUX_SW_STATUS, AUX_SW_DONE, 0,
++ 10, aux110->timeout_period/10);
++
+ /* set the delay and the number of bytes to write */
+
+ /* The length include
+@@ -241,9 +247,6 @@ static void submit_channel_request(
+ }
+ }
+
+- REG_UPDATE(AUX_INTERRUPT_CONTROL, AUX_SW_DONE_ACK, 1);
+- REG_WAIT(AUX_SW_STATUS, AUX_SW_DONE, 0,
+- 10, aux110->timeout_period/10);
+ REG_UPDATE(AUX_SW_CONTROL, AUX_SW_GO, 1);
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h b/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h
+index f7caab85dc80..2c6f50b4245a 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_aux.h
+@@ -69,11 +69,11 @@ enum { /* This is the timeout as defined in DP 1.2a,
+ * at most within ~240usec. That means,
+ * increasing this timeout will not affect normal operation,
+ * and we'll timeout after
+- * SW_AUX_TIMEOUT_PERIOD_MULTIPLIER * AUX_TIMEOUT_PERIOD = 1600usec.
++ * SW_AUX_TIMEOUT_PERIOD_MULTIPLIER * AUX_TIMEOUT_PERIOD = 2400usec.
+ * This timeout is especially important for
+- * resume from S3 and CTS.
++ * converters, resume from S3, and CTS.
+ */
+- SW_AUX_TIMEOUT_PERIOD_MULTIPLIER = 4
++ SW_AUX_TIMEOUT_PERIOD_MULTIPLIER = 6
+ };
+ struct aux_engine_dce110 {
+ struct aux_engine base;
+diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
+index 7d4b710b837a..11e2dcdd6b18 100644
+--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
+@@ -78,7 +78,7 @@ static void ipu_crtc_disable_planes(struct ipu_crtc *ipu_crtc,
+ if (disable_partial)
+ ipu_plane_disable(ipu_crtc->plane[1], true);
+ if (disable_full)
+- ipu_plane_disable(ipu_crtc->plane[0], false);
++ ipu_plane_disable(ipu_crtc->plane[0], true);
+ }
+
+ static void ipu_crtc_atomic_disable(struct drm_crtc *crtc,
+diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
+index 8b0cd08034e0..57f61ec4bc6b 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
++++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
+@@ -92,6 +92,8 @@ static int sun4i_drv_bind(struct device *dev)
+ ret = -ENOMEM;
+ goto free_drm;
+ }
++
++ dev_set_drvdata(dev, drm);
+ drm->dev_private = drv;
+ INIT_LIST_HEAD(&drv->frontend_list);
+ INIT_LIST_HEAD(&drv->engine_list);
+@@ -156,7 +158,10 @@ static void sun4i_drv_unbind(struct device *dev)
+ drm_kms_helper_poll_fini(drm);
+ sun4i_framebuffer_free(drm);
+ drm_mode_config_cleanup(drm);
++
++ component_unbind_all(dev, NULL);
+ of_reserved_mem_device_release(dev);
++
+ drm_dev_put(drm);
+ }
+
+@@ -405,6 +410,8 @@ static int sun4i_drv_probe(struct platform_device *pdev)
+
+ static int sun4i_drv_remove(struct platform_device *pdev)
+ {
++ component_master_del(&pdev->dev, &sun4i_drv_master_ops);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/ipu-v3/ipu-dp.c b/drivers/gpu/ipu-v3/ipu-dp.c
+index 9b2b3fa479c4..5e44ff1f2085 100644
+--- a/drivers/gpu/ipu-v3/ipu-dp.c
++++ b/drivers/gpu/ipu-v3/ipu-dp.c
+@@ -195,7 +195,8 @@ int ipu_dp_setup_channel(struct ipu_dp *dp,
+ ipu_dp_csc_init(flow, flow->foreground.in_cs, flow->out_cs,
+ DP_COM_CONF_CSC_DEF_BOTH);
+ } else {
+- if (flow->foreground.in_cs == flow->out_cs)
++ if (flow->foreground.in_cs == IPUV3_COLORSPACE_UNKNOWN ||
++ flow->foreground.in_cs == flow->out_cs)
+ /*
+ * foreground identical to output, apply color
+ * conversion on background
+@@ -261,6 +262,8 @@ void ipu_dp_disable_channel(struct ipu_dp *dp, bool sync)
+ struct ipu_dp_priv *priv = flow->priv;
+ u32 reg, csc;
+
++ dp->in_cs = IPUV3_COLORSPACE_UNKNOWN;
++
+ if (!dp->foreground)
+ return;
+
+@@ -268,8 +271,9 @@ void ipu_dp_disable_channel(struct ipu_dp *dp, bool sync)
+
+ reg = readl(flow->base + DP_COM_CONF);
+ csc = reg & DP_COM_CONF_CSC_DEF_MASK;
+- if (csc == DP_COM_CONF_CSC_DEF_FG)
+- reg &= ~DP_COM_CONF_CSC_DEF_MASK;
++ reg &= ~DP_COM_CONF_CSC_DEF_MASK;
++ if (csc == DP_COM_CONF_CSC_DEF_BOTH || csc == DP_COM_CONF_CSC_DEF_BG)
++ reg |= DP_COM_CONF_CSC_DEF_BG;
+
+ reg &= ~DP_COM_CONF_FG_EN;
+ writel(reg, flow->base + DP_COM_CONF);
+@@ -347,6 +351,8 @@ int ipu_dp_init(struct ipu_soc *ipu, struct device *dev, unsigned long base)
+ mutex_init(&priv->mutex);
+
+ for (i = 0; i < IPUV3_NUM_FLOWS; i++) {
++ priv->flow[i].background.in_cs = IPUV3_COLORSPACE_UNKNOWN;
++ priv->flow[i].foreground.in_cs = IPUV3_COLORSPACE_UNKNOWN;
+ priv->flow[i].foreground.foreground = true;
+ priv->flow[i].base = priv->base + ipu_dp_flow_base[i];
+ priv->flow[i].priv = priv;
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index e649940e065d..d988b92b20c8 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -677,6 +677,14 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ break;
+ }
+
++ if ((usage->hid & 0xf0) == 0xb0) { /* SC - Display */
++ switch (usage->hid & 0xf) {
++ case 0x05: map_key_clear(KEY_SWITCHVIDEOMODE); break;
++ default: goto ignore;
++ }
++ break;
++ }
++
+ /*
+ * Some lazy vendors declare 255 usages for System Control,
+ * leading to the creation of ABS_X|Y axis and too many others.
+@@ -895,6 +903,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ case 0x074: map_key_clear(KEY_BRIGHTNESS_MAX); break;
+ case 0x075: map_key_clear(KEY_BRIGHTNESS_AUTO); break;
+
++ case 0x079: map_key_clear(KEY_KBDILLUMUP); break;
++ case 0x07a: map_key_clear(KEY_KBDILLUMDOWN); break;
++ case 0x07c: map_key_clear(KEY_KBDILLUMTOGGLE); break;
++
+ case 0x082: map_key_clear(KEY_VIDEO_NEXT); break;
+ case 0x083: map_key_clear(KEY_LAST); break;
+ case 0x084: map_key_clear(KEY_ENTER); break;
+@@ -1026,6 +1038,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ case 0x2cb: map_key_clear(KEY_KBDINPUTASSIST_ACCEPT); break;
+ case 0x2cc: map_key_clear(KEY_KBDINPUTASSIST_CANCEL); break;
+
++ case 0x29f: map_key_clear(KEY_SCALE); break;
++
+ default: map_key_clear(KEY_UNKNOWN);
+ }
+ break;
+diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
+index 9d611dd268e1..7f01fad0d3e3 100644
+--- a/drivers/hwmon/pwm-fan.c
++++ b/drivers/hwmon/pwm-fan.c
+@@ -250,7 +250,7 @@ static int pwm_fan_probe(struct platform_device *pdev)
+
+ ret = pwm_fan_of_get_cooling_data(&pdev->dev, ctx);
+ if (ret)
+- return ret;
++ goto err_pwm_disable;
+
+ ctx->pwm_fan_state = ctx->pwm_fan_max_state;
+ if (IS_ENABLED(CONFIG_THERMAL)) {
+diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
+index 3f6be5ac049a..1ae86e7359f7 100644
+--- a/drivers/iio/adc/xilinx-xadc-core.c
++++ b/drivers/iio/adc/xilinx-xadc-core.c
+@@ -1290,6 +1290,7 @@ static int xadc_probe(struct platform_device *pdev)
+
+ err_free_irq:
+ free_irq(xadc->irq, indio_dev);
++ cancel_delayed_work_sync(&xadc->zynq_unmask_work);
+ err_clk_disable_unprepare:
+ clk_disable_unprepare(xadc->clk);
+ err_free_samplerate_trigger:
+@@ -1319,8 +1320,8 @@ static int xadc_remove(struct platform_device *pdev)
+ iio_triggered_buffer_cleanup(indio_dev);
+ }
+ free_irq(xadc->irq, indio_dev);
++ cancel_delayed_work_sync(&xadc->zynq_unmask_work);
+ clk_disable_unprepare(xadc->clk);
+- cancel_delayed_work(&xadc->zynq_unmask_work);
+ kfree(xadc->data);
+ kfree(indio_dev->channels);
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index efb7e961ca65..2fa4fb17f6d3 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -494,7 +494,7 @@ static int hns_roce_set_kernel_sq_size(struct hns_roce_dev *hr_dev,
+
+ static int hns_roce_qp_has_sq(struct ib_qp_init_attr *attr)
+ {
+- if (attr->qp_type == IB_QPT_XRC_TGT)
++ if (attr->qp_type == IB_QPT_XRC_TGT || !attr->cap.max_send_wr)
+ return 0;
+
+ return 1;
+diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
+index fc3ab93b7aea..7fb358f96195 100644
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -860,7 +860,7 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
+
+ error = rmi_register_function(fn);
+ if (error)
+- goto err_put_fn;
++ return error;
+
+ if (pdt->function_number == 0x01)
+ data->f01_container = fn;
+@@ -870,10 +870,6 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
+ list_add_tail(&fn->node, &data->function_list);
+
+ return RMI_SCAN_CONTINUE;
+-
+-err_put_fn:
+- put_device(&fn->dev);
+- return error;
+ }
+
+ void rmi_enable_irq(struct rmi_device *rmi_dev, bool clear_wake)
+diff --git a/drivers/irqchip/irq-ath79-misc.c b/drivers/irqchip/irq-ath79-misc.c
+index aa7290784636..0390603170b4 100644
+--- a/drivers/irqchip/irq-ath79-misc.c
++++ b/drivers/irqchip/irq-ath79-misc.c
+@@ -22,6 +22,15 @@
+ #define AR71XX_RESET_REG_MISC_INT_ENABLE 4
+
+ #define ATH79_MISC_IRQ_COUNT 32
++#define ATH79_MISC_PERF_IRQ 5
++
++static int ath79_perfcount_irq;
++
++int get_c0_perfcount_int(void)
++{
++ return ath79_perfcount_irq;
++}
++EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
+
+ static void ath79_misc_irq_handler(struct irq_desc *desc)
+ {
+@@ -113,6 +122,8 @@ static void __init ath79_misc_intc_domain_init(
+ {
+ void __iomem *base = domain->host_data;
+
++ ath79_perfcount_irq = irq_create_mapping(domain, ATH79_MISC_PERF_IRQ);
++
+ /* Disable and clear all interrupts */
+ __raw_writel(0, base + AR71XX_RESET_REG_MISC_INT_ENABLE);
+ __raw_writel(0, base + AR71XX_RESET_REG_MISC_INT_STATUS);
+diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
+index ecdeb89645d0..149b1aca52a2 100644
+--- a/drivers/isdn/gigaset/bas-gigaset.c
++++ b/drivers/isdn/gigaset/bas-gigaset.c
+@@ -958,6 +958,7 @@ static void write_iso_callback(struct urb *urb)
+ */
+ static int starturbs(struct bc_state *bcs)
+ {
++ struct usb_device *udev = bcs->cs->hw.bas->udev;
+ struct bas_bc_state *ubc = bcs->hw.bas;
+ struct urb *urb;
+ int j, k;
+@@ -975,8 +976,8 @@ static int starturbs(struct bc_state *bcs)
+ rc = -EFAULT;
+ goto error;
+ }
+- usb_fill_int_urb(urb, bcs->cs->hw.bas->udev,
+- usb_rcvisocpipe(urb->dev, 3 + 2 * bcs->channel),
++ usb_fill_int_urb(urb, udev,
++ usb_rcvisocpipe(udev, 3 + 2 * bcs->channel),
+ ubc->isoinbuf + k * BAS_INBUFSIZE,
+ BAS_INBUFSIZE, read_iso_callback, bcs,
+ BAS_FRAMETIME);
+@@ -1006,8 +1007,8 @@ static int starturbs(struct bc_state *bcs)
+ rc = -EFAULT;
+ goto error;
+ }
+- usb_fill_int_urb(urb, bcs->cs->hw.bas->udev,
+- usb_sndisocpipe(urb->dev, 4 + 2 * bcs->channel),
++ usb_fill_int_urb(urb, udev,
++ usb_sndisocpipe(udev, 4 + 2 * bcs->channel),
+ ubc->isooutbuf->data,
+ sizeof(ubc->isooutbuf->data),
+ write_iso_callback, &ubc->isoouturbs[k],
+diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
+index 18c0a1281914..b2abc44fa5cb 100644
+--- a/drivers/isdn/mISDN/socket.c
++++ b/drivers/isdn/mISDN/socket.c
+@@ -711,10 +711,10 @@ base_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+ struct sock *sk = sock->sk;
+ int err = 0;
+
+- if (!maddr || maddr->family != AF_ISDN)
++ if (addr_len < sizeof(struct sockaddr_mISDN))
+ return -EINVAL;
+
+- if (addr_len < sizeof(struct sockaddr_mISDN))
++ if (!maddr || maddr->family != AF_ISDN)
+ return -EINVAL;
+
+ lock_sock(sk);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index ae38895c44b2..828d86605fb6 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -4221,26 +4221,15 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
+ case check_state_check_result:
+ sh->check_state = check_state_idle;
+
++ if (s->failed > 1)
++ break;
+ /* handle a successful check operation, if parity is correct
+ * we are done. Otherwise update the mismatch count and repair
+ * parity if !MD_RECOVERY_CHECK
+ */
+ if (sh->ops.zero_sum_result == 0) {
+- /* both parities are correct */
+- if (!s->failed)
+- set_bit(STRIPE_INSYNC, &sh->state);
+- else {
+- /* in contrast to the raid5 case we can validate
+- * parity, but still have a failure to write
+- * back
+- */
+- sh->check_state = check_state_compute_result;
+- /* Returning at this point means that we may go
+- * off and bring p and/or q uptodate again so
+- * we make sure to check zero_sum_result again
+- * to verify if p or q need writeback
+- */
+- }
++ /* Any parity checked was correct */
++ set_bit(STRIPE_INSYNC, &sh->state);
+ } else {
+ atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches);
+ if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery)) {
+diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
+index 4d5d01cb8141..80867bd8f44c 100644
+--- a/drivers/net/bonding/bond_options.c
++++ b/drivers/net/bonding/bond_options.c
+@@ -1098,13 +1098,6 @@ static int bond_option_arp_validate_set(struct bonding *bond,
+ {
+ netdev_dbg(bond->dev, "Setting arp_validate to %s (%llu)\n",
+ newval->string, newval->value);
+-
+- if (bond->dev->flags & IFF_UP) {
+- if (!newval->value)
+- bond->recv_probe = NULL;
+- else if (bond->params.arp_interval)
+- bond->recv_probe = bond_arp_rcv;
+- }
+ bond->params.arp_validate = newval->value;
+
+ return 0;
+diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
+index 7fffce734f0a..fdeddbfa829d 100644
+--- a/drivers/net/dsa/mv88e6xxx/port.c
++++ b/drivers/net/dsa/mv88e6xxx/port.c
+@@ -379,18 +379,22 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
+ return 0;
+
+ lane = mv88e6390x_serdes_get_lane(chip, port);
+- if (lane < 0)
++ if (lane < 0 && lane != -ENODEV)
+ return lane;
+
+- if (chip->ports[port].serdes_irq) {
+- err = mv88e6390_serdes_irq_disable(chip, port, lane);
++ if (lane >= 0) {
++ if (chip->ports[port].serdes_irq) {
++ err = mv88e6390_serdes_irq_disable(chip, port, lane);
++ if (err)
++ return err;
++ }
++
++ err = mv88e6390x_serdes_power(chip, port, false);
+ if (err)
+ return err;
+ }
+
+- err = mv88e6390x_serdes_power(chip, port, false);
+- if (err)
+- return err;
++ chip->ports[port].cmode = 0;
+
+ if (cmode) {
+ err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_STS, ®);
+@@ -404,6 +408,12 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
+ if (err)
+ return err;
+
++ chip->ports[port].cmode = cmode;
++
++ lane = mv88e6390x_serdes_get_lane(chip, port);
++ if (lane < 0)
++ return lane;
++
+ err = mv88e6390x_serdes_power(chip, port, true);
+ if (err)
+ return err;
+@@ -415,8 +425,6 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
+ }
+ }
+
+- chip->ports[port].cmode = cmode;
+-
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 7d7b51383adf..74eeb3a985bf 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -2419,12 +2419,12 @@ static int macb_open(struct net_device *dev)
+ return err;
+ }
+
+- bp->macbgem_ops.mog_init_rings(bp);
+- macb_init_hw(bp);
+-
+ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue)
+ napi_enable(&queue->napi);
+
++ bp->macbgem_ops.mog_init_rings(bp);
++ macb_init_hw(bp);
++
+ /* schedule a link state check */
+ phy_start(dev->phydev);
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 029730bbe7db..d7915cd68dc1 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -1648,7 +1648,7 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+ qm_sg_entry_get_len(&sgt[0]), dma_dir);
+
+ /* remaining pages were mapped with skb_frag_dma_map() */
+- for (i = 1; i < nr_frags; i++) {
++ for (i = 1; i <= nr_frags; i++) {
+ WARN_ON(qm_sg_entry_is_ext(&sgt[i]));
+
+ dma_unmap_page(dev, qm_sg_addr(&sgt[i]),
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 7b98bb75ba8a..ad41ace0a27a 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -1850,13 +1850,9 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
+ int ret;
+
+ if (enable) {
+- ret = clk_prepare_enable(fep->clk_ahb);
+- if (ret)
+- return ret;
+-
+ ret = clk_prepare_enable(fep->clk_enet_out);
+ if (ret)
+- goto failed_clk_enet_out;
++ return ret;
+
+ if (fep->clk_ptp) {
+ mutex_lock(&fep->ptp_clk_mutex);
+@@ -1876,7 +1872,6 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
+
+ phy_reset_after_clk_enable(ndev->phydev);
+ } else {
+- clk_disable_unprepare(fep->clk_ahb);
+ clk_disable_unprepare(fep->clk_enet_out);
+ if (fep->clk_ptp) {
+ mutex_lock(&fep->ptp_clk_mutex);
+@@ -1895,8 +1890,6 @@ failed_clk_ref:
+ failed_clk_ptp:
+ if (fep->clk_enet_out)
+ clk_disable_unprepare(fep->clk_enet_out);
+-failed_clk_enet_out:
+- clk_disable_unprepare(fep->clk_ahb);
+
+ return ret;
+ }
+@@ -3485,6 +3478,9 @@ fec_probe(struct platform_device *pdev)
+ ret = clk_prepare_enable(fep->clk_ipg);
+ if (ret)
+ goto failed_clk_ipg;
++ ret = clk_prepare_enable(fep->clk_ahb);
++ if (ret)
++ goto failed_clk_ahb;
+
+ fep->reg_phy = devm_regulator_get(&pdev->dev, "phy");
+ if (!IS_ERR(fep->reg_phy)) {
+@@ -3578,6 +3574,9 @@ failed_reset:
+ pm_runtime_put(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ failed_regulator:
++ clk_disable_unprepare(fep->clk_ahb);
++failed_clk_ahb:
++ clk_disable_unprepare(fep->clk_ipg);
+ failed_clk_ipg:
+ fec_enet_clk_enable(ndev, false);
+ failed_clk:
+@@ -3701,6 +3700,7 @@ static int __maybe_unused fec_runtime_suspend(struct device *dev)
+ struct net_device *ndev = dev_get_drvdata(dev);
+ struct fec_enet_private *fep = netdev_priv(ndev);
+
++ clk_disable_unprepare(fep->clk_ahb);
+ clk_disable_unprepare(fep->clk_ipg);
+
+ return 0;
+@@ -3710,8 +3710,20 @@ static int __maybe_unused fec_runtime_resume(struct device *dev)
+ {
+ struct net_device *ndev = dev_get_drvdata(dev);
+ struct fec_enet_private *fep = netdev_priv(ndev);
++ int ret;
+
+- return clk_prepare_enable(fep->clk_ipg);
++ ret = clk_prepare_enable(fep->clk_ahb);
++ if (ret)
++ return ret;
++ ret = clk_prepare_enable(fep->clk_ipg);
++ if (ret)
++ goto failed_clk_ipg;
++
++ return 0;
++
++failed_clk_ipg:
++ clk_disable_unprepare(fep->clk_ahb);
++ return ret;
+ }
+
+ static const struct dev_pm_ops fec_pm_ops = {
+diff --git a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
+index 0beee2cc2ddd..722b6de24816 100644
+--- a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
++++ b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
+@@ -252,14 +252,12 @@ uec_set_ringparam(struct net_device *netdev,
+ return -EINVAL;
+ }
+
++ if (netif_running(netdev))
++ return -EBUSY;
++
+ ug_info->bdRingLenRx[queue] = ring->rx_pending;
+ ug_info->bdRingLenTx[queue] = ring->tx_pending;
+
+- if (netif_running(netdev)) {
+- /* FIXME: restart automatically */
+- netdev_info(netdev, "Please re-open the interface\n");
+- }
+-
+ return ret;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index f7154f358f27..2e6df5804b35 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -568,7 +568,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
+ if (!(mlxsw_core->bus->features & MLXSW_BUS_F_TXRX))
+ return 0;
+
+- emad_wq = alloc_workqueue("mlxsw_core_emad", WQ_MEM_RECLAIM, 0);
++ emad_wq = alloc_workqueue("mlxsw_core_emad", 0, 0);
+ if (!emad_wq)
+ return -ENOMEM;
+ mlxsw_core->emad_wq = emad_wq;
+@@ -1875,10 +1875,10 @@ static int __init mlxsw_core_module_init(void)
+ {
+ int err;
+
+- mlxsw_wq = alloc_workqueue(mlxsw_core_driver_name, WQ_MEM_RECLAIM, 0);
++ mlxsw_wq = alloc_workqueue(mlxsw_core_driver_name, 0, 0);
+ if (!mlxsw_wq)
+ return -ENOMEM;
+- mlxsw_owq = alloc_ordered_workqueue("%s_ordered", WQ_MEM_RECLAIM,
++ mlxsw_owq = alloc_ordered_workqueue("%s_ordered", 0,
+ mlxsw_core_driver_name);
+ if (!mlxsw_owq) {
+ err = -ENOMEM;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index af673abdb482..a4f237f815d1 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -1585,7 +1585,7 @@ static int mlxsw_sp_port_mdb_add(struct mlxsw_sp_port *mlxsw_sp_port,
+ u16 fid_index;
+ int err = 0;
+
+- if (switchdev_trans_ph_prepare(trans))
++ if (switchdev_trans_ph_commit(trans))
+ return 0;
+
+ bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp->bridge, orig_dev);
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 0bdd3c400c92..10291198decd 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -605,7 +605,7 @@ static int ocelot_mact_mc_add(struct ocelot_port *port,
+ struct netdev_hw_addr *hw_addr)
+ {
+ struct ocelot *ocelot = port->ocelot;
+- struct netdev_hw_addr *ha = kzalloc(sizeof(*ha), GFP_KERNEL);
++ struct netdev_hw_addr *ha = kzalloc(sizeof(*ha), GFP_ATOMIC);
+
+ if (!ha)
+ return -ENOMEM;
+diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+index bf4302e45dcd..28f765664702 100644
+--- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
++++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
+@@ -2365,6 +2365,7 @@ static void *__vxge_hw_blockpool_malloc(struct __vxge_hw_device *devh, u32 size,
+ dma_object->addr))) {
+ vxge_os_dma_free(devh->pdev, memblock,
+ &dma_object->acc_handle);
++ memblock = NULL;
+ goto exit;
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_ptp.c b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
+index 013ff567283c..5e574c3b625e 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_ptp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
+@@ -490,18 +490,17 @@ int qede_ptp_enable(struct qede_dev *edev, bool init_tc)
+
+ ptp->clock = ptp_clock_register(&ptp->clock_info, &edev->pdev->dev);
+ if (IS_ERR(ptp->clock)) {
+- rc = -EINVAL;
+ DP_ERR(edev, "PTP clock registration failed\n");
++ qede_ptp_disable(edev);
++ rc = -EINVAL;
+ goto err2;
+ }
+
+ return 0;
+
+-err2:
+- qede_ptp_disable(edev);
+- ptp->clock = NULL;
+ err1:
+ kfree(ptp);
++err2:
+ edev->ptp = NULL;
+
+ return rc;
+diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c
+index 70cce63a6081..696037d5ac3d 100644
+--- a/drivers/net/ethernet/seeq/sgiseeq.c
++++ b/drivers/net/ethernet/seeq/sgiseeq.c
+@@ -735,6 +735,7 @@ static int sgiseeq_probe(struct platform_device *pdev)
+ }
+
+ platform_set_drvdata(pdev, dev);
++ SET_NETDEV_DEV(dev, &pdev->dev);
+ sp = netdev_priv(dev);
+
+ /* Make private data page aligned */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index 0f660af01a4b..49a896a16391 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -1015,6 +1015,8 @@ static struct mac_device_info *sun8i_dwmac_setup(void *ppriv)
+ mac->mac = &sun8i_dwmac_ops;
+ mac->dma = &sun8i_dwmac_dma_ops;
+
++ priv->dev->priv_flags |= IFF_UNICAST_FLT;
++
+ /* The loopback bit seems to be re-set when link change
+ * Simply mask it each time
+ * Speed 10/100/1000 are set in BIT(2)/BIT(3)
+diff --git a/drivers/net/phy/spi_ks8995.c b/drivers/net/phy/spi_ks8995.c
+index f17b3441779b..d8ea4147dfe7 100644
+--- a/drivers/net/phy/spi_ks8995.c
++++ b/drivers/net/phy/spi_ks8995.c
+@@ -162,6 +162,14 @@ static const struct spi_device_id ks8995_id[] = {
+ };
+ MODULE_DEVICE_TABLE(spi, ks8995_id);
+
++static const struct of_device_id ks8895_spi_of_match[] = {
++ { .compatible = "micrel,ks8995" },
++ { .compatible = "micrel,ksz8864" },
++ { .compatible = "micrel,ksz8795" },
++ { },
++ };
++MODULE_DEVICE_TABLE(of, ks8895_spi_of_match);
++
+ static inline u8 get_chip_id(u8 val)
+ {
+ return (val >> ID1_CHIPID_S) & ID1_CHIPID_M;
+@@ -529,6 +537,7 @@ static int ks8995_remove(struct spi_device *spi)
+ static struct spi_driver ks8995_driver = {
+ .driver = {
+ .name = "spi-ks8995",
++ .of_match_table = of_match_ptr(ks8895_spi_of_match),
+ },
+ .probe = ks8995_probe,
+ .remove = ks8995_remove,
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 044d5c3a4d04..78d34e0306e0 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -599,13 +599,18 @@ static u16 tun_automq_select_queue(struct tun_struct *tun, struct sk_buff *skb)
+ static u16 tun_ebpf_select_queue(struct tun_struct *tun, struct sk_buff *skb)
+ {
+ struct tun_prog *prog;
++ u32 numqueues;
+ u16 ret = 0;
+
++ numqueues = READ_ONCE(tun->numqueues);
++ if (!numqueues)
++ return 0;
++
+ prog = rcu_dereference(tun->steering_prog);
+ if (prog)
+ ret = bpf_prog_run_clear_cb(prog->prog, skb);
+
+- return ret % tun->numqueues;
++ return ret % numqueues;
+ }
+
+ static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
+@@ -703,6 +708,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
+ tun->tfiles[tun->numqueues - 1]);
+ ntfile = rtnl_dereference(tun->tfiles[index]);
+ ntfile->queue_index = index;
++ rcu_assign_pointer(tun->tfiles[tun->numqueues - 1],
++ NULL);
+
+ --tun->numqueues;
+ if (clean) {
+@@ -1085,7 +1092,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ tfile = rcu_dereference(tun->tfiles[txq]);
+
+ /* Drop packet if interface is not attached */
+- if (txq >= tun->numqueues)
++ if (!tfile)
+ goto drop;
+
+ if (!rcu_dereference(tun->steering_prog))
+@@ -1276,6 +1283,7 @@ static int tun_xdp_xmit(struct net_device *dev, int n,
+
+ rcu_read_lock();
+
++resample:
+ numqueues = READ_ONCE(tun->numqueues);
+ if (!numqueues) {
+ rcu_read_unlock();
+@@ -1284,6 +1292,8 @@ static int tun_xdp_xmit(struct net_device *dev, int n,
+
+ tfile = rcu_dereference(tun->tfiles[smp_processor_id() %
+ numqueues]);
++ if (unlikely(!tfile))
++ goto resample;
+
+ spin_lock(&tfile->tx_ring.producer_lock);
+ for (i = 0; i < n; i++) {
+diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
+index 8e4e9b6919e0..ffc565ac2192 100644
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -441,6 +441,9 @@ static const struct ieee80211_rate mwl8k_rates_50[] = {
+ #define MWL8K_CMD_UPDATE_STADB 0x1123
+ #define MWL8K_CMD_BASTREAM 0x1125
+
++#define MWL8K_LEGACY_5G_RATE_OFFSET \
++ (ARRAY_SIZE(mwl8k_rates_24) - ARRAY_SIZE(mwl8k_rates_50))
++
+ static const char *mwl8k_cmd_name(__le16 cmd, char *buf, int bufsize)
+ {
+ u16 command = le16_to_cpu(cmd);
+@@ -1016,8 +1019,9 @@ mwl8k_rxd_ap_process(void *_rxd, struct ieee80211_rx_status *status,
+
+ if (rxd->channel > 14) {
+ status->band = NL80211_BAND_5GHZ;
+- if (!(status->encoding == RX_ENC_HT))
+- status->rate_idx -= 5;
++ if (!(status->encoding == RX_ENC_HT) &&
++ status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
++ status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
+ } else {
+ status->band = NL80211_BAND_2GHZ;
+ }
+@@ -1124,8 +1128,9 @@ mwl8k_rxd_sta_process(void *_rxd, struct ieee80211_rx_status *status,
+
+ if (rxd->channel > 14) {
+ status->band = NL80211_BAND_5GHZ;
+- if (!(status->encoding == RX_ENC_HT))
+- status->rate_idx -= 5;
++ if (!(status->encoding == RX_ENC_HT) &&
++ status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
++ status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
+ } else {
+ status->band = NL80211_BAND_2GHZ;
+ }
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c
+index 545115db507e..4dc9f4e96263 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c
+@@ -1699,6 +1699,7 @@ static void _rtl8723e_read_adapter_info(struct ieee80211_hw *hw,
+ rtlhal->oem_id = RT_CID_819X_LENOVO;
+ break;
+ }
++ break;
+ case 0x1025:
+ rtlhal->oem_id = RT_CID_819X_ACER;
+ break;
+diff --git a/drivers/net/wireless/st/cw1200/scan.c b/drivers/net/wireless/st/cw1200/scan.c
+index 0a9eac93dd01..71e9b91cf15b 100644
+--- a/drivers/net/wireless/st/cw1200/scan.c
++++ b/drivers/net/wireless/st/cw1200/scan.c
+@@ -84,8 +84,11 @@ int cw1200_hw_scan(struct ieee80211_hw *hw,
+
+ frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
+ req->ie_len);
+- if (!frame.skb)
++ if (!frame.skb) {
++ mutex_unlock(&priv->conf_mutex);
++ up(&priv->scan.lock);
+ return -ENOMEM;
++ }
+
+ if (req->ie_len)
+ skb_put_data(frame.skb, req->ie, req->ie_len);
+diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c
+index 2b26f762fbc3..01acb6e53365 100644
+--- a/drivers/nfc/st95hf/core.c
++++ b/drivers/nfc/st95hf/core.c
+@@ -1074,6 +1074,12 @@ static const struct spi_device_id st95hf_id[] = {
+ };
+ MODULE_DEVICE_TABLE(spi, st95hf_id);
+
++static const struct of_device_id st95hf_spi_of_match[] = {
++ { .compatible = "st,st95hf" },
++ { },
++};
++MODULE_DEVICE_TABLE(of, st95hf_spi_of_match);
++
+ static int st95hf_probe(struct spi_device *nfc_spi_dev)
+ {
+ int ret;
+@@ -1260,6 +1266,7 @@ static struct spi_driver st95hf_driver = {
+ .driver = {
+ .name = "st95hf",
+ .owner = THIS_MODULE,
++ .of_match_table = of_match_ptr(st95hf_spi_of_match),
+ },
+ .id_table = st95hf_id,
+ .probe = st95hf_probe,
+diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c
+index 795ad4ff35ca..e341498876ca 100644
+--- a/drivers/nvdimm/btt_devs.c
++++ b/drivers/nvdimm/btt_devs.c
+@@ -190,14 +190,15 @@ static struct device *__nd_btt_create(struct nd_region *nd_region,
+ return NULL;
+
+ nd_btt->id = ida_simple_get(&nd_region->btt_ida, 0, 0, GFP_KERNEL);
+- if (nd_btt->id < 0) {
+- kfree(nd_btt);
+- return NULL;
+- }
++ if (nd_btt->id < 0)
++ goto out_nd_btt;
+
+ nd_btt->lbasize = lbasize;
+- if (uuid)
++ if (uuid) {
+ uuid = kmemdup(uuid, 16, GFP_KERNEL);
++ if (!uuid)
++ goto out_put_id;
++ }
+ nd_btt->uuid = uuid;
+ dev = &nd_btt->dev;
+ dev_set_name(dev, "btt%d.%d", nd_region->id, nd_btt->id);
+@@ -212,6 +213,13 @@ static struct device *__nd_btt_create(struct nd_region *nd_region,
+ return NULL;
+ }
+ return dev;
++
++out_put_id:
++ ida_simple_remove(&nd_region->btt_ida, nd_btt->id);
++
++out_nd_btt:
++ kfree(nd_btt);
++ return NULL;
+ }
+
+ struct device *nd_btt_create(struct nd_region *nd_region)
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index 54d79837f7c6..73a444c41cde 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -2251,9 +2251,12 @@ static struct device *create_namespace_blk(struct nd_region *nd_region,
+ if (!nsblk->uuid)
+ goto blk_err;
+ memcpy(name, nd_label->name, NSLABEL_NAME_LEN);
+- if (name[0])
++ if (name[0]) {
+ nsblk->alt_name = kmemdup(name, NSLABEL_NAME_LEN,
+ GFP_KERNEL);
++ if (!nsblk->alt_name)
++ goto blk_err;
++ }
+ res = nsblk_add_resource(nd_region, ndd, nsblk,
+ __le64_to_cpu(nd_label->dpa));
+ if (!res)
+diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
+index 1d432c5ed275..cff027fc2676 100644
+--- a/drivers/nvdimm/pmem.c
++++ b/drivers/nvdimm/pmem.c
+@@ -113,13 +113,13 @@ static void write_pmem(void *pmem_addr, struct page *page,
+
+ while (len) {
+ mem = kmap_atomic(page);
+- chunk = min_t(unsigned int, len, PAGE_SIZE);
++ chunk = min_t(unsigned int, len, PAGE_SIZE - off);
+ memcpy_flushcache(pmem_addr, mem + off, chunk);
+ kunmap_atomic(mem);
+ len -= chunk;
+ off = 0;
+ page++;
+- pmem_addr += PAGE_SIZE;
++ pmem_addr += chunk;
+ }
+ }
+
+@@ -132,7 +132,7 @@ static blk_status_t read_pmem(struct page *page, unsigned int off,
+
+ while (len) {
+ mem = kmap_atomic(page);
+- chunk = min_t(unsigned int, len, PAGE_SIZE);
++ chunk = min_t(unsigned int, len, PAGE_SIZE - off);
+ rem = memcpy_mcsafe(mem + off, pmem_addr, chunk);
+ kunmap_atomic(mem);
+ if (rem)
+@@ -140,7 +140,7 @@ static blk_status_t read_pmem(struct page *page, unsigned int off,
+ len -= chunk;
+ off = 0;
+ page++;
+- pmem_addr += PAGE_SIZE;
++ pmem_addr += chunk;
+ }
+ return BLK_STS_OK;
+ }
+diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
+index 9ba4d12c179c..808a182830e5 100644
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -1491,6 +1491,21 @@ static void hv_pci_assign_slots(struct hv_pcibus_device *hbus)
+ }
+ }
+
++/*
++ * Remove entries in sysfs pci slot directory.
++ */
++static void hv_pci_remove_slots(struct hv_pcibus_device *hbus)
++{
++ struct hv_pci_dev *hpdev;
++
++ list_for_each_entry(hpdev, &hbus->children, list_entry) {
++ if (!hpdev->pci_slot)
++ continue;
++ pci_destroy_slot(hpdev->pci_slot);
++ hpdev->pci_slot = NULL;
++ }
++}
++
+ /**
+ * create_root_hv_pci_bus() - Expose a new root PCI bus
+ * @hbus: Root PCI bus, as understood by this driver
+@@ -1766,6 +1781,10 @@ static void pci_devices_present_work(struct work_struct *work)
+ hpdev = list_first_entry(&removed, struct hv_pci_dev,
+ list_entry);
+ list_del(&hpdev->list_entry);
++
++ if (hpdev->pci_slot)
++ pci_destroy_slot(hpdev->pci_slot);
++
+ put_pcichild(hpdev);
+ }
+
+@@ -1905,6 +1924,9 @@ static void hv_eject_device_work(struct work_struct *work)
+ sizeof(*ejct_pkt), (unsigned long)&ctxt.pkt,
+ VM_PKT_DATA_INBAND, 0);
+
++ /* For the get_pcichild() in hv_pci_eject_device() */
++ put_pcichild(hpdev);
++ /* For the two refs got in new_pcichild_device() */
+ put_pcichild(hpdev);
+ put_pcichild(hpdev);
+ put_hvpcibus(hpdev->hbus);
+@@ -2682,6 +2704,7 @@ static int hv_pci_remove(struct hv_device *hdev)
+ pci_lock_rescan_remove();
+ pci_stop_root_bus(hbus->pci_bus);
+ pci_remove_root_bus(hbus->pci_bus);
++ hv_pci_remove_slots(hbus);
+ pci_unlock_rescan_remove();
+ hbus->state = hv_pcibus_removed;
+ }
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index 06978c14c83b..3433986d5220 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -532,7 +532,7 @@ static void dell_rfkill_query(struct rfkill *rfkill, void *data)
+ return;
+ }
+
+- dell_fill_request(&buffer, 0, 0x2, 0, 0);
++ dell_fill_request(&buffer, 0x2, 0, 0, 0);
+ ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL);
+ hwswitch = buffer.output[1];
+
+@@ -563,7 +563,7 @@ static int dell_debugfs_show(struct seq_file *s, void *data)
+ return ret;
+ status = buffer.output[1];
+
+- dell_fill_request(&buffer, 0, 0x2, 0, 0);
++ dell_fill_request(&buffer, 0x2, 0, 0, 0);
+ hwswitch_ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL);
+ if (hwswitch_ret)
+ return hwswitch_ret;
+@@ -648,7 +648,7 @@ static void dell_update_rfkill(struct work_struct *ignored)
+ if (ret != 0)
+ return;
+
+- dell_fill_request(&buffer, 0, 0x2, 0, 0);
++ dell_fill_request(&buffer, 0x2, 0, 0, 0);
+ ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL);
+
+ if (ret == 0 && (status & BIT(0)))
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index b205b037fd61..b50f8f73fb47 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -4424,14 +4424,16 @@ sony_pic_read_possible_resource(struct acpi_resource *resource, void *context)
+ }
+ return AE_OK;
+ }
++
++ case ACPI_RESOURCE_TYPE_END_TAG:
++ return AE_OK;
++
+ default:
+ dprintk("Resource %d isn't an IRQ nor an IO port\n",
+ resource->type);
++ return AE_CTRL_TERMINATE;
+
+- case ACPI_RESOURCE_TYPE_END_TAG:
+- return AE_OK;
+ }
+- return AE_CTRL_TERMINATE;
+ }
+
+ static int sony_pic_possible_resources(struct acpi_device *device)
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index fde08a997557..8f85bb4fe784 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -79,7 +79,7 @@
+ #include <linux/jiffies.h>
+ #include <linux/workqueue.h>
+ #include <linux/acpi.h>
+-#include <linux/pci_ids.h>
++#include <linux/pci.h>
+ #include <linux/power_supply.h>
+ #include <linux/thinkpad_acpi.h>
+ #include <sound/core.h>
+@@ -4496,6 +4496,74 @@ static void bluetooth_exit(void)
+ bluetooth_shutdown();
+ }
+
++static const struct dmi_system_id bt_fwbug_list[] __initconst = {
++ {
++ .ident = "ThinkPad E485",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20KU"),
++ },
++ },
++ {
++ .ident = "ThinkPad E585",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20KV"),
++ },
++ },
++ {
++ .ident = "ThinkPad A285 - 20MW",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MW"),
++ },
++ },
++ {
++ .ident = "ThinkPad A285 - 20MX",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MX"),
++ },
++ },
++ {
++ .ident = "ThinkPad A485 - 20MU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MU"),
++ },
++ },
++ {
++ .ident = "ThinkPad A485 - 20MV",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MV"),
++ },
++ },
++ {}
++};
++
++static const struct pci_device_id fwbug_cards_ids[] __initconst = {
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x24F3) },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x24FD) },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2526) },
++ {}
++};
++
++
++static int __init have_bt_fwbug(void)
++{
++ /*
++ * Some AMD based ThinkPads have a firmware bug that calling
++ * "GBDC" will cause bluetooth on Intel wireless cards blocked
++ */
++ if (dmi_check_system(bt_fwbug_list) && pci_dev_present(fwbug_cards_ids)) {
++ vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_RFKILL,
++ FW_BUG "disable bluetooth subdriver for Intel cards\n");
++ return 1;
++ } else
++ return 0;
++}
++
+ static int __init bluetooth_init(struct ibm_init_struct *iibm)
+ {
+ int res;
+@@ -4508,7 +4576,7 @@ static int __init bluetooth_init(struct ibm_init_struct *iibm)
+
+ /* bluetooth not supported on 570, 600e/x, 770e, 770x, A21e, A2xm/p,
+ G4x, R30, R31, R40e, R50e, T20-22, X20-21 */
+- tp_features.bluetooth = hkey_handle &&
++ tp_features.bluetooth = !have_bt_fwbug() && hkey_handle &&
+ acpi_evalf(hkey_handle, &status, "GBDC", "qd");
+
+ vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_RFKILL,
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index 6e294b4d3635..f89f9d02e788 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -2004,14 +2004,14 @@ static int dasd_eckd_end_analysis(struct dasd_block *block)
+ blk_per_trk = recs_per_track(&private->rdc_data, 0, block->bp_block);
+
+ raw:
+- block->blocks = (private->real_cyl *
++ block->blocks = ((unsigned long) private->real_cyl *
+ private->rdc_data.trk_per_cyl *
+ blk_per_trk);
+
+ dev_info(&device->cdev->dev,
+- "DASD with %d KB/block, %d KB total size, %d KB/track, "
++ "DASD with %u KB/block, %lu KB total size, %u KB/track, "
+ "%s\n", (block->bp_block >> 10),
+- ((private->real_cyl *
++ (((unsigned long) private->real_cyl *
+ private->rdc_data.trk_per_cyl *
+ blk_per_trk * (block->bp_block >> 9)) >> 1),
+ ((blk_per_trk * block->bp_block) >> 10),
+diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c
+index fd2146bcc0ad..e17364e13d2f 100644
+--- a/drivers/s390/char/con3270.c
++++ b/drivers/s390/char/con3270.c
+@@ -629,7 +629,7 @@ con3270_init(void)
+ (void (*)(unsigned long)) con3270_read_tasklet,
+ (unsigned long) condev->read);
+
+- raw3270_add_view(&condev->view, &con3270_fn, 1);
++ raw3270_add_view(&condev->view, &con3270_fn, 1, RAW3270_VIEW_LOCK_IRQ);
+
+ INIT_LIST_HEAD(&condev->freemem);
+ for (i = 0; i < CON3270_STRING_PAGES; i++) {
+diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
+index 16a4e8528bbc..2f9905ee047c 100644
+--- a/drivers/s390/char/fs3270.c
++++ b/drivers/s390/char/fs3270.c
+@@ -463,7 +463,8 @@ fs3270_open(struct inode *inode, struct file *filp)
+
+ init_waitqueue_head(&fp->wait);
+ fp->fs_pid = get_pid(task_pid(current));
+- rc = raw3270_add_view(&fp->view, &fs3270_fn, minor);
++ rc = raw3270_add_view(&fp->view, &fs3270_fn, minor,
++ RAW3270_VIEW_LOCK_BH);
+ if (rc) {
+ fs3270_free_view(&fp->view);
+ goto out;
+diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
+index f8cd2935fbfd..63a41b168761 100644
+--- a/drivers/s390/char/raw3270.c
++++ b/drivers/s390/char/raw3270.c
+@@ -920,7 +920,7 @@ raw3270_deactivate_view(struct raw3270_view *view)
+ * Add view to device with minor "minor".
+ */
+ int
+-raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor)
++raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor, int subclass)
+ {
+ unsigned long flags;
+ struct raw3270 *rp;
+@@ -942,6 +942,7 @@ raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor)
+ view->cols = rp->cols;
+ view->ascebc = rp->ascebc;
+ spin_lock_init(&view->lock);
++ lockdep_set_subclass(&view->lock, subclass);
+ list_add(&view->list, &rp->view_list);
+ rc = 0;
+ spin_unlock_irqrestore(get_ccwdev_lock(rp->cdev), flags);
+diff --git a/drivers/s390/char/raw3270.h b/drivers/s390/char/raw3270.h
+index 114ca7cbf889..3afaa35f7351 100644
+--- a/drivers/s390/char/raw3270.h
++++ b/drivers/s390/char/raw3270.h
+@@ -150,6 +150,8 @@ struct raw3270_fn {
+ struct raw3270_view {
+ struct list_head list;
+ spinlock_t lock;
++#define RAW3270_VIEW_LOCK_IRQ 0
++#define RAW3270_VIEW_LOCK_BH 1
+ atomic_t ref_count;
+ struct raw3270 *dev;
+ struct raw3270_fn *fn;
+@@ -158,7 +160,7 @@ struct raw3270_view {
+ unsigned char *ascebc; /* ascii -> ebcdic table */
+ };
+
+-int raw3270_add_view(struct raw3270_view *, struct raw3270_fn *, int);
++int raw3270_add_view(struct raw3270_view *, struct raw3270_fn *, int, int);
+ int raw3270_activate_view(struct raw3270_view *);
+ void raw3270_del_view(struct raw3270_view *);
+ void raw3270_deactivate_view(struct raw3270_view *);
+diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
+index 5b8af2782282..81067f5bb178 100644
+--- a/drivers/s390/char/tty3270.c
++++ b/drivers/s390/char/tty3270.c
+@@ -980,7 +980,8 @@ static int tty3270_install(struct tty_driver *driver, struct tty_struct *tty)
+ return PTR_ERR(tp);
+
+ rc = raw3270_add_view(&tp->view, &tty3270_fn,
+- tty->index + RAW3270_FIRSTMINOR);
++ tty->index + RAW3270_FIRSTMINOR,
++ RAW3270_VIEW_LOCK_BH);
+ if (rc) {
+ tty3270_free_view(tp);
+ return rc;
+diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
+index 1b4001e0285f..b16344479959 100644
+--- a/drivers/s390/crypto/pkey_api.c
++++ b/drivers/s390/crypto/pkey_api.c
+@@ -45,7 +45,8 @@ static debug_info_t *debug_info;
+
+ static void __init pkey_debug_init(void)
+ {
+- debug_info = debug_register("pkey", 1, 1, 4 * sizeof(long));
++ /* 5 arguments per dbf entry (including the format string ptr) */
++ debug_info = debug_register("pkey", 1, 1, 5 * sizeof(long));
+ debug_register_view(debug_info, &debug_sprintf_view);
+ debug_set_level(debug_info, 3);
+ }
+diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
+index 7617d21cb296..f63c5c871d3d 100644
+--- a/drivers/s390/net/ctcm_main.c
++++ b/drivers/s390/net/ctcm_main.c
+@@ -1595,6 +1595,7 @@ static int ctcm_new_device(struct ccwgroup_device *cgdev)
+ if (priv->channel[direction] == NULL) {
+ if (direction == CTCM_WRITE)
+ channel_free(priv->channel[CTCM_READ]);
++ result = -ENODEV;
+ goto out_dev;
+ }
+ priv->channel[direction]->netdev = dev;
+diff --git a/drivers/scsi/aic7xxx/aic7770_osm.c b/drivers/scsi/aic7xxx/aic7770_osm.c
+index 3d401d02c019..bdd177e3d762 100644
+--- a/drivers/scsi/aic7xxx/aic7770_osm.c
++++ b/drivers/scsi/aic7xxx/aic7770_osm.c
+@@ -91,6 +91,7 @@ aic7770_probe(struct device *dev)
+ ahc = ahc_alloc(&aic7xxx_driver_template, name);
+ if (ahc == NULL)
+ return (ENOMEM);
++ ahc->dev = dev;
+ error = aic7770_config(ahc, aic7770_ident_table + edev->id.driver_data,
+ eisaBase);
+ if (error != 0) {
+diff --git a/drivers/scsi/aic7xxx/aic7xxx.h b/drivers/scsi/aic7xxx/aic7xxx.h
+index 4ce4e903a759..7f6e83296dfa 100644
+--- a/drivers/scsi/aic7xxx/aic7xxx.h
++++ b/drivers/scsi/aic7xxx/aic7xxx.h
+@@ -949,6 +949,7 @@ struct ahc_softc {
+ * Platform specific device information.
+ */
+ ahc_dev_softc_t dev_softc;
++ struct device *dev;
+
+ /*
+ * Bus specific device information.
+diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
+index c6be3aeb302b..306d0bf33478 100644
+--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
++++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
+@@ -861,8 +861,8 @@ int
+ ahc_dmamem_alloc(struct ahc_softc *ahc, bus_dma_tag_t dmat, void** vaddr,
+ int flags, bus_dmamap_t *mapp)
+ {
+- *vaddr = pci_alloc_consistent(ahc->dev_softc,
+- dmat->maxsize, mapp);
++ /* XXX: check if we really need the GFP_ATOMIC and unwind this mess! */
++ *vaddr = dma_alloc_coherent(ahc->dev, dmat->maxsize, mapp, GFP_ATOMIC);
+ if (*vaddr == NULL)
+ return ENOMEM;
+ return 0;
+@@ -872,8 +872,7 @@ void
+ ahc_dmamem_free(struct ahc_softc *ahc, bus_dma_tag_t dmat,
+ void* vaddr, bus_dmamap_t map)
+ {
+- pci_free_consistent(ahc->dev_softc, dmat->maxsize,
+- vaddr, map);
++ dma_free_coherent(ahc->dev, dmat->maxsize, vaddr, map);
+ }
+
+ int
+@@ -1124,8 +1123,7 @@ ahc_linux_register_host(struct ahc_softc *ahc, struct scsi_host_template *templa
+
+ host->transportt = ahc_linux_transport_template;
+
+- retval = scsi_add_host(host,
+- (ahc->dev_softc ? &ahc->dev_softc->dev : NULL));
++ retval = scsi_add_host(host, ahc->dev);
+ if (retval) {
+ printk(KERN_WARNING "aic7xxx: scsi_add_host failed\n");
+ scsi_host_put(host);
+diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
+index 0fc14dac7070..717d8d1082ce 100644
+--- a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
++++ b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
+@@ -250,6 +250,7 @@ ahc_linux_pci_dev_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ }
+ }
+ ahc->dev_softc = pci;
++ ahc->dev = &pci->dev;
+ error = ahc_pci_config(ahc, entry);
+ if (error != 0) {
+ ahc_free(ahc);
+diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
+index 2274d9625f63..0fff4968ea1b 100644
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -376,6 +376,7 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
+ struct usb_serial_port *port = urb->context;
+ unsigned char *data = urb->transfer_buffer;
+ unsigned long flags;
++ bool stopped = false;
+ int status = urb->status;
+ int i;
+
+@@ -383,33 +384,51 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
+ if (urb == port->read_urbs[i])
+ break;
+ }
+- set_bit(i, &port->read_urbs_free);
+
+ dev_dbg(&port->dev, "%s - urb %d, len %d\n", __func__, i,
+ urb->actual_length);
+ switch (status) {
+ case 0:
++ usb_serial_debug_data(&port->dev, __func__, urb->actual_length,
++ data);
++ port->serial->type->process_read_urb(urb);
+ break;
+ case -ENOENT:
+ case -ECONNRESET:
+ case -ESHUTDOWN:
+ dev_dbg(&port->dev, "%s - urb stopped: %d\n",
+ __func__, status);
+- return;
++ stopped = true;
++ break;
+ case -EPIPE:
+ dev_err(&port->dev, "%s - urb stopped: %d\n",
+ __func__, status);
+- return;
++ stopped = true;
++ break;
+ default:
+ dev_dbg(&port->dev, "%s - nonzero urb status: %d\n",
+ __func__, status);
+- goto resubmit;
++ break;
+ }
+
+- usb_serial_debug_data(&port->dev, __func__, urb->actual_length, data);
+- port->serial->type->process_read_urb(urb);
++ /*
++ * Make sure URB processing is done before marking as free to avoid
++ * racing with unthrottle() on another CPU. Matches the barriers
++ * implied by the test_and_clear_bit() in
++ * usb_serial_generic_submit_read_urb().
++ */
++ smp_mb__before_atomic();
++ set_bit(i, &port->read_urbs_free);
++ /*
++ * Make sure URB is marked as free before checking the throttled flag
++ * to avoid racing with unthrottle() on another CPU. Matches the
++ * smp_mb() in unthrottle().
++ */
++ smp_mb__after_atomic();
++
++ if (stopped)
++ return;
+
+-resubmit:
+ /* Throttle the device if requested by tty */
+ spin_lock_irqsave(&port->lock, flags);
+ port->throttled = port->throttle_req;
+@@ -484,6 +503,12 @@ void usb_serial_generic_unthrottle(struct tty_struct *tty)
+ port->throttled = port->throttle_req = 0;
+ spin_unlock_irq(&port->lock);
+
++ /*
++ * Matches the smp_mb__after_atomic() in
++ * usb_serial_generic_read_bulk_callback().
++ */
++ smp_mb();
++
+ if (was_throttled)
+ usb_serial_generic_submit_read_urbs(port, GFP_KERNEL);
+ }
+diff --git a/drivers/usb/typec/typec_wcove.c b/drivers/usb/typec/typec_wcove.c
+index 423208e19383..6770afd40765 100644
+--- a/drivers/usb/typec/typec_wcove.c
++++ b/drivers/usb/typec/typec_wcove.c
+@@ -615,8 +615,13 @@ static int wcove_typec_probe(struct platform_device *pdev)
+ wcove->dev = &pdev->dev;
+ wcove->regmap = pmic->regmap;
+
+- irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr,
+- platform_get_irq(pdev, 0));
++ irq = platform_get_irq(pdev, 0);
++ if (irq < 0) {
++ dev_err(&pdev->dev, "Failed to get IRQ: %d\n", irq);
++ return irq;
++ }
++
++ irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq);
+ if (irq < 0)
+ return irq;
+
+diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
+index 8ba726e600e9..1bbd910d4ddb 100644
+--- a/drivers/virt/fsl_hypervisor.c
++++ b/drivers/virt/fsl_hypervisor.c
+@@ -215,6 +215,9 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
+ * hypervisor.
+ */
+ lb_offset = param.local_vaddr & (PAGE_SIZE - 1);
++ if (param.count == 0 ||
++ param.count > U64_MAX - lb_offset - PAGE_SIZE + 1)
++ return -EINVAL;
+ num_pages = (param.count + lb_offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+ /* Allocate the buffers we need */
+@@ -331,8 +334,8 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
+ struct fsl_hv_ioctl_prop param;
+ char __user *upath, *upropname;
+ void __user *upropval;
+- char *path = NULL, *propname = NULL;
+- void *propval = NULL;
++ char *path, *propname;
++ void *propval;
+ int ret = 0;
+
+ /* Get the parameters from the user. */
+@@ -344,32 +347,30 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
+ upropval = (void __user *)(uintptr_t)param.propval;
+
+ path = strndup_user(upath, FH_DTPROP_MAX_PATHLEN);
+- if (IS_ERR(path)) {
+- ret = PTR_ERR(path);
+- goto out;
+- }
++ if (IS_ERR(path))
++ return PTR_ERR(path);
+
+ propname = strndup_user(upropname, FH_DTPROP_MAX_PATHLEN);
+ if (IS_ERR(propname)) {
+ ret = PTR_ERR(propname);
+- goto out;
++ goto err_free_path;
+ }
+
+ if (param.proplen > FH_DTPROP_MAX_PROPLEN) {
+ ret = -EINVAL;
+- goto out;
++ goto err_free_propname;
+ }
+
+ propval = kmalloc(param.proplen, GFP_KERNEL);
+ if (!propval) {
+ ret = -ENOMEM;
+- goto out;
++ goto err_free_propname;
+ }
+
+ if (set) {
+ if (copy_from_user(propval, upropval, param.proplen)) {
+ ret = -EFAULT;
+- goto out;
++ goto err_free_propval;
+ }
+
+ param.ret = fh_partition_set_dtprop(param.handle,
+@@ -388,7 +389,7 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
+ if (copy_to_user(upropval, propval, param.proplen) ||
+ put_user(param.proplen, &p->proplen)) {
+ ret = -EFAULT;
+- goto out;
++ goto err_free_propval;
+ }
+ }
+ }
+@@ -396,10 +397,12 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
+ if (put_user(param.ret, &p->ret))
+ ret = -EFAULT;
+
+-out:
+- kfree(path);
++err_free_propval:
+ kfree(propval);
++err_free_propname:
+ kfree(propname);
++err_free_path:
++ kfree(path);
+
+ return ret;
+ }
+diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
+index 1475ed5ffcde..0afef60d0638 100644
+--- a/drivers/virt/vboxguest/vboxguest_core.c
++++ b/drivers/virt/vboxguest/vboxguest_core.c
+@@ -1263,6 +1263,20 @@ static int vbg_ioctl_hgcm_disconnect(struct vbg_dev *gdev,
+ return ret;
+ }
+
++static bool vbg_param_valid(enum vmmdev_hgcm_function_parameter_type type)
++{
++ switch (type) {
++ case VMMDEV_HGCM_PARM_TYPE_32BIT:
++ case VMMDEV_HGCM_PARM_TYPE_64BIT:
++ case VMMDEV_HGCM_PARM_TYPE_LINADDR:
++ case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
++ case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
+ struct vbg_session *session, bool f32bit,
+ struct vbg_ioctl_hgcm_call *call)
+@@ -1298,6 +1312,23 @@ static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
+ }
+ call->hdr.size_out = actual_size;
+
++ /* Validate parameter types */
++ if (f32bit) {
++ struct vmmdev_hgcm_function_parameter32 *parm =
++ VBG_IOCTL_HGCM_CALL_PARMS32(call);
++
++ for (i = 0; i < call->parm_count; i++)
++ if (!vbg_param_valid(parm[i].type))
++ return -EINVAL;
++ } else {
++ struct vmmdev_hgcm_function_parameter *parm =
++ VBG_IOCTL_HGCM_CALL_PARMS(call);
++
++ for (i = 0; i < call->parm_count; i++)
++ if (!vbg_param_valid(parm[i].type))
++ return -EINVAL;
++ }
++
+ /*
+ * Validate the client id.
+ */
+diff --git a/fs/afs/write.c b/fs/afs/write.c
+index 19c04caf3c01..e00461a6de9a 100644
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -253,6 +253,7 @@ static void afs_kill_pages(struct address_space *mapping,
+ first = page->index + 1;
+ lock_page(page);
+ generic_error_remove_page(mapping, page);
++ unlock_page(page);
+ }
+
+ __pagevec_release(&pv);
+diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
+index 4ca0b5c18192..853a69e493f5 100644
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -650,11 +650,10 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
+ kn->id.generation = gen;
+
+ /*
+- * set ino first. This barrier is paired with atomic_inc_not_zero in
++ * set ino first. This RELEASE is paired with atomic_inc_not_zero in
+ * kernfs_find_and_get_node_by_ino
+ */
+- smp_mb__before_atomic();
+- atomic_set(&kn->count, 1);
++ atomic_set_release(&kn->count, 1);
+ atomic_set(&kn->active, KN_DEACTIVATED_BIAS);
+ RB_CLEAR_NODE(&kn->rb);
+
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index 401e4b254e30..cc3391796c0b 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -1564,7 +1564,12 @@ efi_status_t efi_setup_gop(efi_system_table_t *sys_table_arg,
+ struct screen_info *si, efi_guid_t *proto,
+ unsigned long size);
+
+-bool efi_runtime_disabled(void);
++#ifdef CONFIG_EFI
++extern bool efi_runtime_disabled(void);
++#else
++static inline bool efi_runtime_disabled(void) { return true; }
++#endif
++
+ extern void efi_call_virt_check_flags(unsigned long flags, const char *call);
+
+ enum efi_secureboot_mode {
+diff --git a/include/linux/elevator.h b/include/linux/elevator.h
+index a02deea30185..a2bf4a6b9316 100644
+--- a/include/linux/elevator.h
++++ b/include/linux/elevator.h
+@@ -99,6 +99,7 @@ struct elevator_mq_ops {
+ void (*exit_sched)(struct elevator_queue *);
+ int (*init_hctx)(struct blk_mq_hw_ctx *, unsigned int);
+ void (*exit_hctx)(struct blk_mq_hw_ctx *, unsigned int);
++ void (*depth_updated)(struct blk_mq_hw_ctx *);
+
+ bool (*allow_merge)(struct request_queue *, struct request *, struct bio *);
+ bool (*bio_merge)(struct blk_mq_hw_ctx *, struct bio *);
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 23c242a7ac52..30efb3663892 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -28,6 +28,7 @@
+ #include <linux/irqbypass.h>
+ #include <linux/swait.h>
+ #include <linux/refcount.h>
++#include <linux/nospec.h>
+ #include <asm/signal.h>
+
+ #include <linux/kvm.h>
+@@ -491,10 +492,10 @@ static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx)
+
+ static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i)
+ {
+- /* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu, in case
+- * the caller has read kvm->online_vcpus before (as is the case
+- * for kvm_for_each_vcpu, for example).
+- */
++ int num_vcpus = atomic_read(&kvm->online_vcpus);
++ i = array_index_nospec(i, num_vcpus);
++
++ /* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu. */
+ smp_rmb();
+ return kvm->vcpus[i];
+ }
+@@ -578,6 +579,7 @@ void kvm_put_kvm(struct kvm *kvm);
+
+ static inline struct kvm_memslots *__kvm_memslots(struct kvm *kvm, int as_id)
+ {
++ as_id = array_index_nospec(as_id, KVM_ADDRESS_SPACE_NUM);
+ return srcu_dereference_check(kvm->memslots[as_id], &kvm->srcu,
+ lockdep_is_held(&kvm->slots_lock) ||
+ !refcount_read(&kvm->users_count));
+diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
+index 7e012312cd61..f45141bdbb83 100644
+--- a/include/net/netfilter/nf_conntrack.h
++++ b/include/net/netfilter/nf_conntrack.h
+@@ -313,6 +313,8 @@ struct nf_conn *nf_ct_tmpl_alloc(struct net *net,
+ gfp_t flags);
+ void nf_ct_tmpl_free(struct nf_conn *tmpl);
+
++u32 nf_ct_get_id(const struct nf_conn *ct);
++
+ static inline void
+ nf_ct_set(struct sk_buff *skb, struct nf_conn *ct, enum ip_conntrack_info info)
+ {
+diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
+index 87499b6b35d6..df5c69db68af 100644
+--- a/include/net/nfc/nci_core.h
++++ b/include/net/nfc/nci_core.h
+@@ -166,7 +166,7 @@ struct nci_conn_info {
+ * According to specification 102 622 chapter 4.4 Pipes,
+ * the pipe identifier is 7 bits long.
+ */
+-#define NCI_HCI_MAX_PIPES 127
++#define NCI_HCI_MAX_PIPES 128
+
+ struct nci_hci_gate {
+ u8 gate;
+diff --git a/init/main.c b/init/main.c
+index e083fac08aed..020972fed117 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -568,6 +568,8 @@ asmlinkage __visible void __init start_kernel(void)
+ page_alloc_init();
+
+ pr_notice("Kernel command line: %s\n", boot_command_line);
++ /* parameters may set static keys */
++ jump_label_init();
+ parse_early_param();
+ after_dashes = parse_args("Booting kernel",
+ static_command_line, __start___param,
+@@ -577,8 +579,6 @@ asmlinkage __visible void __init start_kernel(void)
+ parse_args("Setting init args", after_dashes, NULL, 0, -1, -1,
+ NULL, set_init_arg);
+
+- jump_label_init();
+-
+ /*
+ * These use large bootmem allocations and must precede
+ * kmem_cache_init()
+diff --git a/mm/memory.c b/mm/memory.c
+index 9c69278173b7..e0010cb870e0 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1796,10 +1796,12 @@ static int insert_pfn(struct vm_area_struct *vma, unsigned long addr,
+ WARN_ON_ONCE(!is_zero_pfn(pte_pfn(*pte)));
+ goto out_unlock;
+ }
+- entry = *pte;
+- goto out_mkwrite;
+- } else
+- goto out_unlock;
++ entry = pte_mkyoung(*pte);
++ entry = maybe_mkwrite(pte_mkdirty(entry), vma);
++ if (ptep_set_access_flags(vma, addr, pte, entry, 1))
++ update_mmu_cache(vma, addr, pte);
++ }
++ goto out_unlock;
+ }
+
+ /* Ok, finally just insert the thing.. */
+@@ -1808,7 +1810,6 @@ static int insert_pfn(struct vm_area_struct *vma, unsigned long addr,
+ else
+ entry = pte_mkspecial(pfn_t_pte(pfn, prot));
+
+-out_mkwrite:
+ if (mkwrite) {
+ entry = pte_mkyoung(entry);
+ entry = maybe_mkwrite(pte_mkdirty(entry), vma);
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 156991edec2a..af6735562215 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -901,6 +901,7 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ
+ */
+ mem = find_memory_block(__pfn_to_section(pfn));
+ nid = mem->nid;
++ put_device(&mem->dev);
+
+ /* associate pfn range with the zone */
+ zone = move_pfn_range(online_type, nid, pfn, nr_pages);
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 3830066018c1..ee545d1e9894 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2190,7 +2190,6 @@ static void shrink_active_list(unsigned long nr_to_scan,
+ * 10TB 320 32GB
+ */
+ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
+- struct mem_cgroup *memcg,
+ struct scan_control *sc, bool actual_reclaim)
+ {
+ enum lru_list active_lru = file * LRU_FILE + LRU_ACTIVE;
+@@ -2211,16 +2210,12 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
+ inactive = lruvec_lru_size(lruvec, inactive_lru, sc->reclaim_idx);
+ active = lruvec_lru_size(lruvec, active_lru, sc->reclaim_idx);
+
+- if (memcg)
+- refaults = memcg_page_state(memcg, WORKINGSET_ACTIVATE);
+- else
+- refaults = node_page_state(pgdat, WORKINGSET_ACTIVATE);
+-
+ /*
+ * When refaults are being observed, it means a new workingset
+ * is being established. Disable active list protection to get
+ * rid of the stale workingset quickly.
+ */
++ refaults = lruvec_page_state(lruvec, WORKINGSET_ACTIVATE);
+ if (file && actual_reclaim && lruvec->refaults != refaults) {
+ inactive_ratio = 0;
+ } else {
+@@ -2241,12 +2236,10 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
+ }
+
+ static unsigned long shrink_list(enum lru_list lru, unsigned long nr_to_scan,
+- struct lruvec *lruvec, struct mem_cgroup *memcg,
+- struct scan_control *sc)
++ struct lruvec *lruvec, struct scan_control *sc)
+ {
+ if (is_active_lru(lru)) {
+- if (inactive_list_is_low(lruvec, is_file_lru(lru),
+- memcg, sc, true))
++ if (inactive_list_is_low(lruvec, is_file_lru(lru), sc, true))
+ shrink_active_list(nr_to_scan, lruvec, sc, lru);
+ return 0;
+ }
+@@ -2346,7 +2339,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg,
+ * anonymous pages on the LRU in eligible zones.
+ * Otherwise, the small LRU gets thrashed.
+ */
+- if (!inactive_list_is_low(lruvec, false, memcg, sc, false) &&
++ if (!inactive_list_is_low(lruvec, false, sc, false) &&
+ lruvec_lru_size(lruvec, LRU_INACTIVE_ANON, sc->reclaim_idx)
+ >> sc->priority) {
+ scan_balance = SCAN_ANON;
+@@ -2364,7 +2357,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg,
+ * lruvec even if it has plenty of old anonymous pages unless the
+ * system is under heavy pressure.
+ */
+- if (!inactive_list_is_low(lruvec, true, memcg, sc, false) &&
++ if (!inactive_list_is_low(lruvec, true, sc, false) &&
+ lruvec_lru_size(lruvec, LRU_INACTIVE_FILE, sc->reclaim_idx) >> sc->priority) {
+ scan_balance = SCAN_FILE;
+ goto out;
+@@ -2517,7 +2510,7 @@ static void shrink_node_memcg(struct pglist_data *pgdat, struct mem_cgroup *memc
+ nr[lru] -= nr_to_scan;
+
+ nr_reclaimed += shrink_list(lru, nr_to_scan,
+- lruvec, memcg, sc);
++ lruvec, sc);
+ }
+ }
+
+@@ -2584,7 +2577,7 @@ static void shrink_node_memcg(struct pglist_data *pgdat, struct mem_cgroup *memc
+ * Even if we did not try to evict anon pages at all, we want to
+ * rebalance the anon lru active/inactive ratio.
+ */
+- if (inactive_list_is_low(lruvec, false, memcg, sc, true))
++ if (inactive_list_is_low(lruvec, false, sc, true))
+ shrink_active_list(SWAP_CLUSTER_MAX, lruvec,
+ sc, LRU_ACTIVE_ANON);
+ }
+@@ -2982,12 +2975,8 @@ static void snapshot_refaults(struct mem_cgroup *root_memcg, pg_data_t *pgdat)
+ unsigned long refaults;
+ struct lruvec *lruvec;
+
+- if (memcg)
+- refaults = memcg_page_state(memcg, WORKINGSET_ACTIVATE);
+- else
+- refaults = node_page_state(pgdat, WORKINGSET_ACTIVATE);
+-
+ lruvec = mem_cgroup_lruvec(pgdat, memcg);
++ refaults = lruvec_page_state(lruvec, WORKINGSET_ACTIVATE);
+ lruvec->refaults = refaults;
+ } while ((memcg = mem_cgroup_iter(root_memcg, memcg, NULL)));
+ }
+@@ -3344,7 +3333,7 @@ static void age_active_anon(struct pglist_data *pgdat,
+ do {
+ struct lruvec *lruvec = mem_cgroup_lruvec(pgdat, memcg);
+
+- if (inactive_list_is_low(lruvec, false, memcg, sc, true))
++ if (inactive_list_is_low(lruvec, false, sc, true))
+ shrink_active_list(SWAP_CLUSTER_MAX, lruvec,
+ sc, LRU_ACTIVE_ANON);
+
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 546af0e73ac3..fce3b7eebffb 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -368,10 +368,12 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ ifrr.ifr_ifru = ifr->ifr_ifru;
+
+ switch (cmd) {
++ case SIOCSHWTSTAMP:
++ if (!net_eq(dev_net(dev), &init_net))
++ break;
+ case SIOCGMIIPHY:
+ case SIOCGMIIREG:
+ case SIOCSMIIREG:
+- case SIOCSHWTSTAMP:
+ case SIOCGHWTSTAMP:
+ if (netif_device_present(real_dev) && ops->ndo_do_ioctl)
+ err = ops->ndo_do_ioctl(real_dev, &ifrr, cmd);
+diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
+index 0363f1bdc401..ed2b6002ae53 100644
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -603,13 +603,15 @@ int br_add_if(struct net_bridge *br, struct net_device *dev,
+ call_netdevice_notifiers(NETDEV_JOIN, dev);
+
+ err = dev_set_allmulti(dev, 1);
+- if (err)
+- goto put_back;
++ if (err) {
++ kfree(p); /* kobject not yet init'd, manually free */
++ goto err1;
++ }
+
+ err = kobject_init_and_add(&p->kobj, &brport_ktype, &(dev->dev.kobj),
+ SYSFS_BRIDGE_PORT_ATTR);
+ if (err)
+- goto err1;
++ goto err2;
+
+ err = br_sysfs_addif(p);
+ if (err)
+@@ -692,12 +694,9 @@ err3:
+ sysfs_remove_link(br->ifobj, p->dev->name);
+ err2:
+ kobject_put(&p->kobj);
+- p = NULL; /* kobject_put frees */
+-err1:
+ dev_set_allmulti(dev, -1);
+-put_back:
++err1:
+ dev_put(dev);
+- kfree(p);
+ return err;
+ }
+
+diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
+index 0ff3953f64aa..338147b14d0e 100644
+--- a/net/core/fib_rules.c
++++ b/net/core/fib_rules.c
+@@ -756,9 +756,9 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (err)
+ goto errout;
+
+- if ((nlh->nlmsg_flags & NLM_F_EXCL) &&
+- rule_exists(ops, frh, tb, rule)) {
+- err = -EEXIST;
++ if (rule_exists(ops, frh, tb, rule)) {
++ if (nlh->nlmsg_flags & NLM_F_EXCL)
++ err = -EEXIST;
+ goto errout_free;
+ }
+
+diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
+index 9f3209ff7ffd..601534a5bfe8 100644
+--- a/net/dsa/dsa.c
++++ b/net/dsa/dsa.c
+@@ -293,15 +293,22 @@ static int __init dsa_init_module(void)
+
+ rc = dsa_slave_register_notifier();
+ if (rc)
+- return rc;
++ goto register_notifier_fail;
+
+ rc = dsa_legacy_register();
+ if (rc)
+- return rc;
++ goto legacy_register_fail;
+
+ dev_add_pack(&dsa_pack_type);
+
+ return 0;
++
++legacy_register_fail:
++ dsa_slave_unregister_notifier();
++register_notifier_fail:
++ destroy_workqueue(dsa_owq);
++
++ return rc;
+ }
+ module_init(dsa_init_module);
+
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index 33df4d76db2d..711a5c75bd4b 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -174,6 +174,7 @@ static int icmp_filter(const struct sock *sk, const struct sk_buff *skb)
+ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash)
+ {
+ int sdif = inet_sdif(skb);
++ int dif = inet_iif(skb);
+ struct sock *sk;
+ struct hlist_head *head;
+ int delivered = 0;
+@@ -186,8 +187,7 @@ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash)
+
+ net = dev_net(skb->dev);
+ sk = __raw_v4_lookup(net, __sk_head(head), iph->protocol,
+- iph->saddr, iph->daddr,
+- skb->dev->ifindex, sdif);
++ iph->saddr, iph->daddr, dif, sdif);
+
+ while (sk) {
+ delivered = 1;
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 8f6cf8e6b5c1..41b3fe8ac3bc 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1084,7 +1084,7 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
+ if (!tdev && tunnel->parms.link)
+ tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
+
+- if (tdev) {
++ if (tdev && !netif_is_l3_master(tdev)) {
+ int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+
+ dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index c3a7396fb955..49a90217622b 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -23,7 +23,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl, struct mesh_path *mpath);
+ static u32 mesh_table_hash(const void *addr, u32 len, u32 seed)
+ {
+ /* Use last four bytes of hw addr as hash index */
+- return jhash_1word(*(u32 *)(addr+2), seed);
++ return jhash_1word(__get_unaligned_cpu32((u8 *)addr + 2), seed);
+ }
+
+ static const struct rhashtable_params mesh_rht_params = {
+diff --git a/net/mac80211/trace_msg.h b/net/mac80211/trace_msg.h
+index 366b9e6f043e..40141df09f25 100644
+--- a/net/mac80211/trace_msg.h
++++ b/net/mac80211/trace_msg.h
+@@ -1,4 +1,9 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Portions of this file
++ * Copyright (C) 2019 Intel Corporation
++ */
++
+ #ifdef CONFIG_MAC80211_MESSAGE_TRACING
+
+ #if !defined(__MAC80211_MSG_DRIVER_TRACE) || defined(TRACE_HEADER_MULTI_READ)
+@@ -11,7 +16,7 @@
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM mac80211_msg
+
+-#define MAX_MSG_LEN 100
++#define MAX_MSG_LEN 120
+
+ DECLARE_EVENT_CLASS(mac80211_msg_event,
+ TP_PROTO(struct va_format *vaf),
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 743cde66aaf6..2f726cde9998 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3185,6 +3185,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
+ u8 max_subframes = sta->sta.max_amsdu_subframes;
+ int max_frags = local->hw.max_tx_fragments;
+ int max_amsdu_len = sta->sta.max_amsdu_len;
++ int orig_truesize;
+ __be16 len;
+ void *data;
+ bool ret = false;
+@@ -3218,6 +3219,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
+ if (!head)
+ goto out;
+
++ orig_truesize = head->truesize;
+ orig_len = head->len;
+
+ if (skb->len + head->len > max_amsdu_len)
+@@ -3272,6 +3274,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
+ *frag_tail = skb;
+
+ out_recalc:
++ fq->memory_usage += head->truesize - orig_truesize;
+ if (head->len != orig_len) {
+ flow->backlog += head->len - orig_len;
+ tin->backlog_bytes += head->len - orig_len;
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index 3f963ea22277..a42c1bc7c698 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1647,7 +1647,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
+ if (!cp) {
+ int v;
+
+- if (!sysctl_schedule_icmp(ipvs))
++ if (ipip || !sysctl_schedule_icmp(ipvs))
+ return NF_ACCEPT;
+
+ if (!ip_vs_try_to_schedule(ipvs, AF_INET, skb, pd, &v, &cp, &ciph))
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 9a249478abf2..27eff89fad01 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -25,6 +25,7 @@
+ #include <linux/slab.h>
+ #include <linux/random.h>
+ #include <linux/jhash.h>
++#include <linux/siphash.h>
+ #include <linux/err.h>
+ #include <linux/percpu.h>
+ #include <linux/moduleparam.h>
+@@ -424,6 +425,40 @@ nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
+ }
+ EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
+
++/* Generate a almost-unique pseudo-id for a given conntrack.
++ *
++ * intentionally doesn't re-use any of the seeds used for hash
++ * table location, we assume id gets exposed to userspace.
++ *
++ * Following nf_conn items do not change throughout lifetime
++ * of the nf_conn after it has been committed to main hash table:
++ *
++ * 1. nf_conn address
++ * 2. nf_conn->ext address
++ * 3. nf_conn->master address (normally NULL)
++ * 4. tuple
++ * 5. the associated net namespace
++ */
++u32 nf_ct_get_id(const struct nf_conn *ct)
++{
++ static __read_mostly siphash_key_t ct_id_seed;
++ unsigned long a, b, c, d;
++
++ net_get_random_once(&ct_id_seed, sizeof(ct_id_seed));
++
++ a = (unsigned long)ct;
++ b = (unsigned long)ct->master ^ net_hash_mix(nf_ct_net(ct));
++ c = (unsigned long)ct->ext;
++ d = (unsigned long)siphash(&ct->tuplehash, sizeof(ct->tuplehash),
++ &ct_id_seed);
++#ifdef CONFIG_64BIT
++ return siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &ct_id_seed);
++#else
++ return siphash_4u32((u32)a, (u32)b, (u32)c, (u32)d, &ct_id_seed);
++#endif
++}
++EXPORT_SYMBOL_GPL(nf_ct_get_id);
++
+ static void
+ clean_from_lists(struct nf_conn *ct)
+ {
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 036207ecaf16..47e5a076522d 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -29,6 +29,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/interrupt.h>
+ #include <linux/slab.h>
++#include <linux/siphash.h>
+
+ #include <linux/netfilter.h>
+ #include <net/netlink.h>
+@@ -487,7 +488,9 @@ nla_put_failure:
+
+ static int ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
+ {
+- if (nla_put_be32(skb, CTA_ID, htonl((unsigned long)ct)))
++ __be32 id = (__force __be32)nf_ct_get_id(ct);
++
++ if (nla_put_be32(skb, CTA_ID, id))
+ goto nla_put_failure;
+ return 0;
+
+@@ -1275,8 +1278,9 @@ static int ctnetlink_del_conntrack(struct net *net, struct sock *ctnl,
+ }
+
+ if (cda[CTA_ID]) {
+- u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));
+- if (id != (u32)(unsigned long)ct) {
++ __be32 id = nla_get_be32(cda[CTA_ID]);
++
++ if (id != (__force __be32)nf_ct_get_id(ct)) {
+ nf_ct_put(ct);
+ return -ENOENT;
+ }
+@@ -2675,6 +2679,25 @@ nla_put_failure:
+
+ static const union nf_inet_addr any_addr;
+
++static __be32 nf_expect_get_id(const struct nf_conntrack_expect *exp)
++{
++ static __read_mostly siphash_key_t exp_id_seed;
++ unsigned long a, b, c, d;
++
++ net_get_random_once(&exp_id_seed, sizeof(exp_id_seed));
++
++ a = (unsigned long)exp;
++ b = (unsigned long)exp->helper;
++ c = (unsigned long)exp->master;
++ d = (unsigned long)siphash(&exp->tuple, sizeof(exp->tuple), &exp_id_seed);
++
++#ifdef CONFIG_64BIT
++ return (__force __be32)siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &exp_id_seed);
++#else
++ return (__force __be32)siphash_4u32((u32)a, (u32)b, (u32)c, (u32)d, &exp_id_seed);
++#endif
++}
++
+ static int
+ ctnetlink_exp_dump_expect(struct sk_buff *skb,
+ const struct nf_conntrack_expect *exp)
+@@ -2722,7 +2745,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
+ }
+ #endif
+ if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) ||
+- nla_put_be32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp)) ||
++ nla_put_be32(skb, CTA_EXPECT_ID, nf_expect_get_id(exp)) ||
+ nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) ||
+ nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))
+ goto nla_put_failure;
+@@ -3027,7 +3050,8 @@ static int ctnetlink_get_expect(struct net *net, struct sock *ctnl,
+
+ if (cda[CTA_EXPECT_ID]) {
+ __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
+- if (ntohl(id) != (u32)(unsigned long)exp) {
++
++ if (id != nf_expect_get_id(exp)) {
+ nf_ct_expect_put(exp);
+ return -ENOENT;
+ }
+diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
+index 51c5d7eec0a3..e903ef9b96cf 100644
+--- a/net/netfilter/nf_conntrack_proto.c
++++ b/net/netfilter/nf_conntrack_proto.c
+@@ -86,7 +86,7 @@ void nf_l4proto_log_invalid(const struct sk_buff *skb,
+ struct va_format vaf;
+ va_list args;
+
+- if (net->ct.sysctl_log_invalid != protonum ||
++ if (net->ct.sysctl_log_invalid != protonum &&
+ net->ct.sysctl_log_invalid != IPPROTO_RAW)
+ return;
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 1af54119bafc..ebfcfe1dcbdb 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1496,7 +1496,7 @@ static int nft_chain_parse_hook(struct net *net,
+ if (IS_ERR(type))
+ return PTR_ERR(type);
+ }
+- if (!(type->hook_mask & (1 << hook->num)))
++ if (hook->num > NF_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
+ return -EOPNOTSUPP;
+
+ if (type->type == NFT_CHAIN_T_NAT &&
+@@ -2113,9 +2113,11 @@ err1:
+ static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
+ struct nft_expr *expr)
+ {
++ const struct nft_expr_type *type = expr->ops->type;
++
+ if (expr->ops->destroy)
+ expr->ops->destroy(ctx, expr);
+- module_put(expr->ops->type->owner);
++ module_put(type->owner);
+ }
+
+ struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
+@@ -2717,8 +2719,11 @@ err2:
+ nf_tables_rule_release(&ctx, rule);
+ err1:
+ for (i = 0; i < n; i++) {
+- if (info[i].ops != NULL)
++ if (info[i].ops) {
+ module_put(info[i].ops->type->owner);
++ if (info[i].ops->type->release_ops)
++ info[i].ops->type->release_ops(info[i].ops);
++ }
+ }
+ kvfree(info);
+ return err;
+diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
+index ddfc52ac1f9b..c0d323b58e73 100644
+--- a/net/nfc/nci/hci.c
++++ b/net/nfc/nci/hci.c
+@@ -312,6 +312,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
+ create_info = (struct nci_hci_create_pipe_resp *)skb->data;
+ dest_gate = create_info->dest_gate;
+ new_pipe = create_info->pipe;
++ if (new_pipe >= NCI_HCI_MAX_PIPES) {
++ status = NCI_HCI_ANY_E_NOK;
++ goto exit;
++ }
+
+ /* Save the new created pipe and bind with local gate,
+ * the description for skb->data[3] is destination gate id
+@@ -336,6 +340,10 @@ static void nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
+ goto exit;
+ }
+ delete_info = (struct nci_hci_delete_pipe_noti *)skb->data;
++ if (delete_info->pipe >= NCI_HCI_MAX_PIPES) {
++ status = NCI_HCI_ANY_E_NOK;
++ goto exit;
++ }
+
+ ndev->hci_dev->pipes[delete_info->pipe].gate =
+ NCI_HCI_INVALID_GATE;
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index ebbb30064251..18df3bce73da 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4578,14 +4578,29 @@ static void __exit packet_exit(void)
+
+ static int __init packet_init(void)
+ {
+- int rc = proto_register(&packet_proto, 0);
++ int rc;
+
+- if (rc != 0)
++ rc = proto_register(&packet_proto, 0);
++ if (rc)
+ goto out;
++ rc = sock_register(&packet_family_ops);
++ if (rc)
++ goto out_proto;
++ rc = register_pernet_subsys(&packet_net_ops);
++ if (rc)
++ goto out_sock;
++ rc = register_netdevice_notifier(&packet_netdev_notifier);
++ if (rc)
++ goto out_pernet;
+
+- sock_register(&packet_family_ops);
+- register_pernet_subsys(&packet_net_ops);
+- register_netdevice_notifier(&packet_netdev_notifier);
++ return 0;
++
++out_pernet:
++ unregister_pernet_subsys(&packet_net_ops);
++out_sock:
++ sock_unregister(PF_PACKET);
++out_proto:
++ proto_unregister(&packet_proto);
+ out:
+ return rc;
+ }
+diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
+index da1a676860ca..0f4e42792878 100644
+--- a/net/strparser/strparser.c
++++ b/net/strparser/strparser.c
+@@ -140,13 +140,11 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
+ /* We are going to append to the frags_list of head.
+ * Need to unshare the frag_list.
+ */
+- if (skb_has_frag_list(head)) {
+- err = skb_unclone(head, GFP_ATOMIC);
+- if (err) {
+- STRP_STATS_INCR(strp->stats.mem_fail);
+- desc->error = err;
+- return 0;
+- }
++ err = skb_unclone(head, GFP_ATOMIC);
++ if (err) {
++ STRP_STATS_INCR(strp->stats.mem_fail);
++ desc->error = err;
++ return 0;
+ }
+
+ if (unlikely(skb_shinfo(head)->frag_list)) {
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 67a7b312a499..6c91f1217dcf 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -726,11 +726,11 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
+
+ switch (sk->sk_state) {
+ case TIPC_ESTABLISHED:
+- case TIPC_CONNECTING:
+ if (!tsk->cong_link_cnt && !tsk_conn_cong(tsk))
+ revents |= EPOLLOUT;
+ /* fall thru' */
+ case TIPC_LISTEN:
++ case TIPC_CONNECTING:
+ if (!skb_queue_empty(&sk->sk_receive_queue))
+ revents |= EPOLLIN | EPOLLRDNORM;
+ break;
+@@ -2039,7 +2039,7 @@ static bool tipc_sk_filter_connect(struct tipc_sock *tsk, struct sk_buff *skb)
+ return true;
+
+ /* If empty 'ACK-' message, wake up sleeping connect() */
+- sk->sk_data_ready(sk);
++ sk->sk_state_change(sk);
+
+ /* 'ACK-' message is neither accepted nor rejected: */
+ msg_set_dest_droppable(hdr, 1);
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index f4a19eac975d..fdf22cb0b3e6 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -52,8 +52,11 @@ static DEFINE_SPINLOCK(tls_device_lock);
+
+ static void tls_device_free_ctx(struct tls_context *ctx)
+ {
+- if (ctx->tx_conf == TLS_HW)
++ if (ctx->tx_conf == TLS_HW) {
+ kfree(tls_offload_ctx_tx(ctx));
++ kfree(ctx->tx.rec_seq);
++ kfree(ctx->tx.iv);
++ }
+
+ if (ctx->rx_conf == TLS_HW)
+ kfree(tls_offload_ctx_rx(ctx));
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 295cd8d5554f..048e004ed0ee 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -13392,7 +13392,8 @@ static const struct genl_ops nl80211_ops[] = {
+ .policy = nl80211_policy,
+ .flags = GENL_UNS_ADMIN_PERM,
+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+- NL80211_FLAG_NEED_RTNL,
++ NL80211_FLAG_NEED_RTNL |
++ NL80211_FLAG_CLEAR_SKB,
+ },
+ {
+ .cmd = NL80211_CMD_DEAUTHENTICATE,
+@@ -13443,7 +13444,8 @@ static const struct genl_ops nl80211_ops[] = {
+ .policy = nl80211_policy,
+ .flags = GENL_UNS_ADMIN_PERM,
+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+- NL80211_FLAG_NEED_RTNL,
++ NL80211_FLAG_NEED_RTNL |
++ NL80211_FLAG_CLEAR_SKB,
+ },
+ {
+ .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
+@@ -13451,7 +13453,8 @@ static const struct genl_ops nl80211_ops[] = {
+ .policy = nl80211_policy,
+ .flags = GENL_ADMIN_PERM,
+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+- NL80211_FLAG_NEED_RTNL,
++ NL80211_FLAG_NEED_RTNL |
++ NL80211_FLAG_CLEAR_SKB,
+ },
+ {
+ .cmd = NL80211_CMD_DISCONNECT,
+@@ -13480,7 +13483,8 @@ static const struct genl_ops nl80211_ops[] = {
+ .policy = nl80211_policy,
+ .flags = GENL_UNS_ADMIN_PERM,
+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+- NL80211_FLAG_NEED_RTNL,
++ NL80211_FLAG_NEED_RTNL |
++ NL80211_FLAG_CLEAR_SKB,
+ },
+ {
+ .cmd = NL80211_CMD_DEL_PMKSA,
+@@ -13832,7 +13836,8 @@ static const struct genl_ops nl80211_ops[] = {
+ .policy = nl80211_policy,
+ .flags = GENL_UNS_ADMIN_PERM,
+ .internal_flags = NL80211_FLAG_NEED_WIPHY |
+- NL80211_FLAG_NEED_RTNL,
++ NL80211_FLAG_NEED_RTNL |
++ NL80211_FLAG_CLEAR_SKB,
+ },
+ {
+ .cmd = NL80211_CMD_SET_QOS_MAP,
+@@ -13887,7 +13892,8 @@ static const struct genl_ops nl80211_ops[] = {
+ .doit = nl80211_set_pmk,
+ .policy = nl80211_policy,
+ .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+- NL80211_FLAG_NEED_RTNL,
++ NL80211_FLAG_NEED_RTNL |
++ NL80211_FLAG_CLEAR_SKB,
+ },
+ {
+ .cmd = NL80211_CMD_DEL_PMK,
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 8002ace7c9f6..8a47297ff206 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1287,6 +1287,16 @@ reg_intersect_dfs_region(const enum nl80211_dfs_regions dfs_region1,
+ return dfs_region1;
+ }
+
++static void reg_wmm_rules_intersect(const struct ieee80211_wmm_ac *wmm_ac1,
++ const struct ieee80211_wmm_ac *wmm_ac2,
++ struct ieee80211_wmm_ac *intersect)
++{
++ intersect->cw_min = max_t(u16, wmm_ac1->cw_min, wmm_ac2->cw_min);
++ intersect->cw_max = max_t(u16, wmm_ac1->cw_max, wmm_ac2->cw_max);
++ intersect->cot = min_t(u16, wmm_ac1->cot, wmm_ac2->cot);
++ intersect->aifsn = max_t(u8, wmm_ac1->aifsn, wmm_ac2->aifsn);
++}
++
+ /*
+ * Helper for regdom_intersect(), this does the real
+ * mathematical intersection fun
+@@ -1301,6 +1311,8 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
+ struct ieee80211_freq_range *freq_range;
+ const struct ieee80211_power_rule *power_rule1, *power_rule2;
+ struct ieee80211_power_rule *power_rule;
++ const struct ieee80211_wmm_rule *wmm_rule1, *wmm_rule2;
++ struct ieee80211_wmm_rule *wmm_rule;
+ u32 freq_diff, max_bandwidth1, max_bandwidth2;
+
+ freq_range1 = &rule1->freq_range;
+@@ -1311,6 +1323,10 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
+ power_rule2 = &rule2->power_rule;
+ power_rule = &intersected_rule->power_rule;
+
++ wmm_rule1 = &rule1->wmm_rule;
++ wmm_rule2 = &rule2->wmm_rule;
++ wmm_rule = &intersected_rule->wmm_rule;
++
+ freq_range->start_freq_khz = max(freq_range1->start_freq_khz,
+ freq_range2->start_freq_khz);
+ freq_range->end_freq_khz = min(freq_range1->end_freq_khz,
+@@ -1354,6 +1370,29 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
+ intersected_rule->dfs_cac_ms = max(rule1->dfs_cac_ms,
+ rule2->dfs_cac_ms);
+
++ if (rule1->has_wmm && rule2->has_wmm) {
++ u8 ac;
++
++ for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
++ reg_wmm_rules_intersect(&wmm_rule1->client[ac],
++ &wmm_rule2->client[ac],
++ &wmm_rule->client[ac]);
++ reg_wmm_rules_intersect(&wmm_rule1->ap[ac],
++ &wmm_rule2->ap[ac],
++ &wmm_rule->ap[ac]);
++ }
++
++ intersected_rule->has_wmm = true;
++ } else if (rule1->has_wmm) {
++ *wmm_rule = *wmm_rule1;
++ intersected_rule->has_wmm = true;
++ } else if (rule2->has_wmm) {
++ *wmm_rule = *wmm_rule2;
++ intersected_rule->has_wmm = true;
++ } else {
++ intersected_rule->has_wmm = false;
++ }
++
+ if (!is_valid_reg_rule(intersected_rule))
+ return -EINVAL;
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index cba19b8c3e51..70bad15ed7a0 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -4800,7 +4800,7 @@ static int selinux_socket_connect_helper(struct socket *sock,
+ struct lsm_network_audit net = {0,};
+ struct sockaddr_in *addr4 = NULL;
+ struct sockaddr_in6 *addr6 = NULL;
+- unsigned short snum;
++ unsigned short snum = 0;
+ u32 sid, perm;
+
+ /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
+@@ -4823,12 +4823,12 @@ static int selinux_socket_connect_helper(struct socket *sock,
+ break;
+ default:
+ /* Note that SCTP services expect -EINVAL, whereas
+- * others expect -EAFNOSUPPORT.
++ * others must handle this at the protocol level:
++ * connect(AF_UNSPEC) on a connected socket is
++ * a documented way disconnect the socket.
+ */
+ if (sksec->sclass == SECCLASS_SCTP_SOCKET)
+ return -EINVAL;
+- else
+- return -EAFNOSUPPORT;
+ }
+
+ err = sel_netport_sid(sk->sk_protocol, snum, &sid);
+diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
+index 10985d991ed2..6ccfd13d5cf9 100644
+--- a/tools/lib/traceevent/event-parse.c
++++ b/tools/lib/traceevent/event-parse.c
+@@ -2192,7 +2192,7 @@ eval_type_str(unsigned long long val, const char *type, int pointer)
+ return val & 0xffffffff;
+
+ if (strcmp(type, "u64") == 0 ||
+- strcmp(type, "s64"))
++ strcmp(type, "s64") == 0)
+ return val;
+
+ if (strcmp(type, "s8") == 0)
+diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
+index a4ccde0e473b..2f190aa8fc5f 100755
+--- a/tools/testing/selftests/net/fib_tests.sh
++++ b/tools/testing/selftests/net/fib_tests.sh
+@@ -602,6 +602,39 @@ run_cmd()
+ return $rc
+ }
+
++check_expected()
++{
++ local out="$1"
++ local expected="$2"
++ local rc=0
++
++ [ "${out}" = "${expected}" ] && return 0
++
++ if [ -z "${out}" ]; then
++ if [ "$VERBOSE" = "1" ]; then
++ printf "\nNo route entry found\n"
++ printf "Expected:\n"
++ printf " ${expected}\n"
++ fi
++ return 1
++ fi
++
++ # tricky way to convert output to 1-line without ip's
++ # messy '\'; this drops all extra white space
++ out=$(echo ${out})
++ if [ "${out}" != "${expected}" ]; then
++ rc=1
++ if [ "${VERBOSE}" = "1" ]; then
++ printf " Unexpected route entry. Have:\n"
++ printf " ${out}\n"
++ printf " Expected:\n"
++ printf " ${expected}\n\n"
++ fi
++ fi
++
++ return $rc
++}
++
+ # add route for a prefix, flushing any existing routes first
+ # expected to be the first step of a test
+ add_route6()
+@@ -646,31 +679,7 @@ check_route6()
+ local rc=0
+
+ out=$($IP -6 ro ls match ${pfx} | sed -e 's/ pref medium//')
+- [ "${out}" = "${expected}" ] && return 0
+-
+- if [ -z "${out}" ]; then
+- if [ "$VERBOSE" = "1" ]; then
+- printf "\nNo route entry found\n"
+- printf "Expected:\n"
+- printf " ${expected}\n"
+- fi
+- return 1
+- fi
+-
+- # tricky way to convert output to 1-line without ip's
+- # messy '\'; this drops all extra white space
+- out=$(echo ${out})
+- if [ "${out}" != "${expected}" ]; then
+- rc=1
+- if [ "${VERBOSE}" = "1" ]; then
+- printf " Unexpected route entry. Have:\n"
+- printf " ${out}\n"
+- printf " Expected:\n"
+- printf " ${expected}\n\n"
+- fi
+- fi
+-
+- return $rc
++ check_expected "${out}" "${expected}"
+ }
+
+ route_cleanup()
+@@ -714,7 +723,7 @@ route_setup()
+ $IP addr add 172.16.103.2/24 dev veth4
+ $IP addr add 172.16.104.1/24 dev dummy1
+
+- set +ex
++ set +e
+ }
+
+ # assumption is that basic add of a single path route works
+@@ -949,7 +958,8 @@ ipv6_addr_metric_test()
+ run_cmd "$IP li set dev dummy2 down"
+ rc=$?
+ if [ $rc -eq 0 ]; then
+- check_route6 ""
++ out=$($IP -6 ro ls match 2001:db8:104::/64)
++ check_expected "${out}" ""
+ rc=$?
+ fi
+ log_test $rc 0 "Prefix route removed on link down"
+@@ -1009,34 +1019,9 @@ check_route()
+ local pfx="172.16.104.0/24"
+ local expected="$1"
+ local out
+- local rc=0
+
+ out=$($IP ro ls match ${pfx})
+- [ "${out}" = "${expected}" ] && return 0
+-
+- if [ -z "${out}" ]; then
+- if [ "$VERBOSE" = "1" ]; then
+- printf "\nNo route entry found\n"
+- printf "Expected:\n"
+- printf " ${expected}\n"
+- fi
+- return 1
+- fi
+-
+- # tricky way to convert output to 1-line without ip's
+- # messy '\'; this drops all extra white space
+- out=$(echo ${out})
+- if [ "${out}" != "${expected}" ]; then
+- rc=1
+- if [ "${VERBOSE}" = "1" ]; then
+- printf " Unexpected route entry. Have:\n"
+- printf " ${out}\n"
+- printf " Expected:\n"
+- printf " ${expected}\n\n"
+- fi
+- fi
+-
+- return $rc
++ check_expected "${out}" "${expected}"
+ }
+
+ # assumption is that basic add of a single path route works
+@@ -1301,7 +1286,8 @@ ipv4_addr_metric_test()
+ run_cmd "$IP li set dev dummy2 down"
+ rc=$?
+ if [ $rc -eq 0 ]; then
+- check_route ""
++ out=$($IP ro ls match 172.16.104.0/24)
++ check_expected "${out}" ""
+ rc=$?
+ fi
+ log_test $rc 0 "Prefix route removed on link down"
+diff --git a/tools/testing/selftests/net/run_netsocktests b/tools/testing/selftests/net/run_netsocktests
+index b093f39c298c..14e41faf2c57 100755
+--- a/tools/testing/selftests/net/run_netsocktests
++++ b/tools/testing/selftests/net/run_netsocktests
+@@ -7,7 +7,7 @@ echo "--------------------"
+ ./socket
+ if [ $? -ne 0 ]; then
+ echo "[FAIL]"
++ exit 1
+ else
+ echo "[PASS]"
+ fi
+-
+diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
+index c9ff2b47bd1c..a37cb1192c6a 100644
+--- a/tools/testing/selftests/netfilter/Makefile
++++ b/tools/testing/selftests/netfilter/Makefile
+@@ -1,6 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Makefile for netfilter selftests
+
+-TEST_PROGS := nft_trans_stress.sh nft_nat.sh
++TEST_PROGS := nft_trans_stress.sh nft_nat.sh conntrack_icmp_related.sh
+
+ include ../lib.mk
+diff --git a/tools/testing/selftests/netfilter/conntrack_icmp_related.sh b/tools/testing/selftests/netfilter/conntrack_icmp_related.sh
+new file mode 100755
+index 000000000000..b48e1833bc89
+--- /dev/null
++++ b/tools/testing/selftests/netfilter/conntrack_icmp_related.sh
+@@ -0,0 +1,283 @@
++#!/bin/bash
++#
++# check that ICMP df-needed/pkttoobig icmp are set are set as related
++# state
++#
++# Setup is:
++#
++# nsclient1 -> nsrouter1 -> nsrouter2 -> nsclient2
++# MTU 1500, except for nsrouter2 <-> nsclient2 link (1280).
++# ping nsclient2 from nsclient1, checking that conntrack did set RELATED
++# 'fragmentation needed' icmp packet.
++#
++# In addition, nsrouter1 will perform IP masquerading, i.e. also
++# check the icmp errors are propagated to the correct host as per
++# nat of "established" icmp-echo "connection".
++
++# Kselftest framework requirement - SKIP code is 4.
++ksft_skip=4
++ret=0
++
++nft --version > /dev/null 2>&1
++if [ $? -ne 0 ];then
++ echo "SKIP: Could not run test without nft tool"
++ exit $ksft_skip
++fi
++
++ip -Version > /dev/null 2>&1
++if [ $? -ne 0 ];then
++ echo "SKIP: Could not run test without ip tool"
++ exit $ksft_skip
++fi
++
++cleanup() {
++ for i in 1 2;do ip netns del nsclient$i;done
++ for i in 1 2;do ip netns del nsrouter$i;done
++}
++
++ipv4() {
++ echo -n 192.168.$1.2
++}
++
++ipv6 () {
++ echo -n dead:$1::2
++}
++
++check_counter()
++{
++ ns=$1
++ name=$2
++ expect=$3
++ local lret=0
++
++ cnt=$(ip netns exec $ns nft list counter inet filter "$name" | grep -q "$expect")
++ if [ $? -ne 0 ]; then
++ echo "ERROR: counter $name in $ns has unexpected value (expected $expect)" 1>&2
++ ip netns exec $ns nft list counter inet filter "$name" 1>&2
++ lret=1
++ fi
++
++ return $lret
++}
++
++check_unknown()
++{
++ expect="packets 0 bytes 0"
++ for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
++ check_counter $n "unknown" "$expect"
++ if [ $? -ne 0 ] ;then
++ return 1
++ fi
++ done
++
++ return 0
++}
++
++for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
++ ip netns add $n
++ ip -net $n link set lo up
++done
++
++DEV=veth0
++ip link add $DEV netns nsclient1 type veth peer name eth1 netns nsrouter1
++DEV=veth0
++ip link add $DEV netns nsclient2 type veth peer name eth1 netns nsrouter2
++
++DEV=veth0
++ip link add $DEV netns nsrouter1 type veth peer name eth2 netns nsrouter2
++
++DEV=veth0
++for i in 1 2; do
++ ip -net nsclient$i link set $DEV up
++ ip -net nsclient$i addr add $(ipv4 $i)/24 dev $DEV
++ ip -net nsclient$i addr add $(ipv6 $i)/64 dev $DEV
++done
++
++ip -net nsrouter1 link set eth1 up
++ip -net nsrouter1 link set veth0 up
++
++ip -net nsrouter2 link set eth1 up
++ip -net nsrouter2 link set eth2 up
++
++ip -net nsclient1 route add default via 192.168.1.1
++ip -net nsclient1 -6 route add default via dead:1::1
++
++ip -net nsclient2 route add default via 192.168.2.1
++ip -net nsclient2 route add default via dead:2::1
++
++i=3
++ip -net nsrouter1 addr add 192.168.1.1/24 dev eth1
++ip -net nsrouter1 addr add 192.168.3.1/24 dev veth0
++ip -net nsrouter1 addr add dead:1::1/64 dev eth1
++ip -net nsrouter1 addr add dead:3::1/64 dev veth0
++ip -net nsrouter1 route add default via 192.168.3.10
++ip -net nsrouter1 -6 route add default via dead:3::10
++
++ip -net nsrouter2 addr add 192.168.2.1/24 dev eth1
++ip -net nsrouter2 addr add 192.168.3.10/24 dev eth2
++ip -net nsrouter2 addr add dead:2::1/64 dev eth1
++ip -net nsrouter2 addr add dead:3::10/64 dev eth2
++ip -net nsrouter2 route add default via 192.168.3.1
++ip -net nsrouter2 route add default via dead:3::1
++
++sleep 2
++for i in 4 6; do
++ ip netns exec nsrouter1 sysctl -q net.ipv$i.conf.all.forwarding=1
++ ip netns exec nsrouter2 sysctl -q net.ipv$i.conf.all.forwarding=1
++done
++
++for netns in nsrouter1 nsrouter2; do
++ip netns exec $netns nft -f - <<EOF
++table inet filter {
++ counter unknown { }
++ counter related { }
++ chain forward {
++ type filter hook forward priority 0; policy accept;
++ meta l4proto icmpv6 icmpv6 type "packet-too-big" ct state "related" counter name "related" accept
++ meta l4proto icmp icmp type "destination-unreachable" ct state "related" counter name "related" accept
++ meta l4proto { icmp, icmpv6 } ct state new,established accept
++ counter name "unknown" drop
++ }
++}
++EOF
++done
++
++ip netns exec nsclient1 nft -f - <<EOF
++table inet filter {
++ counter unknown { }
++ counter related { }
++ chain input {
++ type filter hook input priority 0; policy accept;
++ meta l4proto { icmp, icmpv6 } ct state established,untracked accept
++
++ meta l4proto { icmp, icmpv6 } ct state "related" counter name "related" accept
++ counter name "unknown" drop
++ }
++}
++EOF
++
++ip netns exec nsclient2 nft -f - <<EOF
++table inet filter {
++ counter unknown { }
++ counter new { }
++ counter established { }
++
++ chain input {
++ type filter hook input priority 0; policy accept;
++ meta l4proto { icmp, icmpv6 } ct state established,untracked accept
++
++ meta l4proto { icmp, icmpv6 } ct state "new" counter name "new" accept
++ meta l4proto { icmp, icmpv6 } ct state "established" counter name "established" accept
++ counter name "unknown" drop
++ }
++ chain output {
++ type filter hook output priority 0; policy accept;
++ meta l4proto { icmp, icmpv6 } ct state established,untracked accept
++
++ meta l4proto { icmp, icmpv6 } ct state "new" counter name "new"
++ meta l4proto { icmp, icmpv6 } ct state "established" counter name "established"
++ counter name "unknown" drop
++ }
++}
++EOF
++
++
++# make sure NAT core rewrites adress of icmp error if nat is used according to
++# conntrack nat information (icmp error will be directed at nsrouter1 address,
++# but it needs to be routed to nsclient1 address).
++ip netns exec nsrouter1 nft -f - <<EOF
++table ip nat {
++ chain postrouting {
++ type nat hook postrouting priority 0; policy accept;
++ ip protocol icmp oifname "veth0" counter masquerade
++ }
++}
++table ip6 nat {
++ chain postrouting {
++ type nat hook postrouting priority 0; policy accept;
++ ip6 nexthdr icmpv6 oifname "veth0" counter masquerade
++ }
++}
++EOF
++
++ip netns exec nsrouter2 ip link set eth1 mtu 1280
++ip netns exec nsclient2 ip link set veth0 mtu 1280
++sleep 1
++
++ip netns exec nsclient1 ping -c 1 -s 1000 -q -M do 192.168.2.2 >/dev/null
++if [ $? -ne 0 ]; then
++ echo "ERROR: netns ip routing/connectivity broken" 1>&2
++ cleanup
++ exit 1
++fi
++ip netns exec nsclient1 ping6 -q -c 1 -s 1000 dead:2::2 >/dev/null
++if [ $? -ne 0 ]; then
++ echo "ERROR: netns ipv6 routing/connectivity broken" 1>&2
++ cleanup
++ exit 1
++fi
++
++check_unknown
++if [ $? -ne 0 ]; then
++ ret=1
++fi
++
++expect="packets 0 bytes 0"
++for netns in nsrouter1 nsrouter2 nsclient1;do
++ check_counter "$netns" "related" "$expect"
++ if [ $? -ne 0 ]; then
++ ret=1
++ fi
++done
++
++expect="packets 2 bytes 2076"
++check_counter nsclient2 "new" "$expect"
++if [ $? -ne 0 ]; then
++ ret=1
++fi
++
++ip netns exec nsclient1 ping -q -c 1 -s 1300 -M do 192.168.2.2 > /dev/null
++if [ $? -eq 0 ]; then
++ echo "ERROR: ping should have failed with PMTU too big error" 1>&2
++ ret=1
++fi
++
++# nsrouter2 should have generated the icmp error, so
++# related counter should be 0 (its in forward).
++expect="packets 0 bytes 0"
++check_counter "nsrouter2" "related" "$expect"
++if [ $? -ne 0 ]; then
++ ret=1
++fi
++
++# but nsrouter1 should have seen it, same for nsclient1.
++expect="packets 1 bytes 576"
++for netns in nsrouter1 nsclient1;do
++ check_counter "$netns" "related" "$expect"
++ if [ $? -ne 0 ]; then
++ ret=1
++ fi
++done
++
++ip netns exec nsclient1 ping6 -c 1 -s 1300 dead:2::2 > /dev/null
++if [ $? -eq 0 ]; then
++ echo "ERROR: ping6 should have failed with PMTU too big error" 1>&2
++ ret=1
++fi
++
++expect="packets 2 bytes 1856"
++for netns in nsrouter1 nsclient1;do
++ check_counter "$netns" "related" "$expect"
++ if [ $? -ne 0 ]; then
++ ret=1
++ fi
++done
++
++if [ $ret -eq 0 ];then
++ echo "PASS: icmp mtu error had RELATED state"
++else
++ echo "ERROR: icmp error RELATED state test has failed"
++fi
++
++cleanup
++exit $ret
+diff --git a/virt/kvm/irqchip.c b/virt/kvm/irqchip.c
+index b1286c4e0712..0bd0683640bd 100644
+--- a/virt/kvm/irqchip.c
++++ b/virt/kvm/irqchip.c
+@@ -144,18 +144,19 @@ static int setup_routing_entry(struct kvm *kvm,
+ {
+ struct kvm_kernel_irq_routing_entry *ei;
+ int r;
++ u32 gsi = array_index_nospec(ue->gsi, KVM_MAX_IRQ_ROUTES);
+
+ /*
+ * Do not allow GSI to be mapped to the same irqchip more than once.
+ * Allow only one to one mapping between GSI and non-irqchip routing.
+ */
+- hlist_for_each_entry(ei, &rt->map[ue->gsi], link)
++ hlist_for_each_entry(ei, &rt->map[gsi], link)
+ if (ei->type != KVM_IRQ_ROUTING_IRQCHIP ||
+ ue->type != KVM_IRQ_ROUTING_IRQCHIP ||
+ ue->u.irqchip.irqchip == ei->irqchip.irqchip)
+ return -EINVAL;
+
+- e->gsi = ue->gsi;
++ e->gsi = gsi;
+ e->type = ue->type;
+ r = kvm_set_routing_entry(kvm, e, ue);
+ if (r)
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 6a79df88b546..e909d9907b50 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2887,12 +2887,14 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
+ struct kvm_device_ops *ops = NULL;
+ struct kvm_device *dev;
+ bool test = cd->flags & KVM_CREATE_DEVICE_TEST;
++ int type;
+ int ret;
+
+ if (cd->type >= ARRAY_SIZE(kvm_device_ops_table))
+ return -ENODEV;
+
+- ops = kvm_device_ops_table[cd->type];
++ type = array_index_nospec(cd->type, ARRAY_SIZE(kvm_device_ops_table));
++ ops = kvm_device_ops_table[type];
+ if (ops == NULL)
+ return -ENODEV;
+
+@@ -2907,7 +2909,7 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
+ dev->kvm = kvm;
+
+ mutex_lock(&kvm->lock);
+- ret = ops->create(dev, cd->type);
++ ret = ops->create(dev, type);
+ if (ret < 0) {
+ mutex_unlock(&kvm->lock);
+ kfree(dev);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-05-22 11:02 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-05-22 11:02 UTC (permalink / raw
To: gentoo-commits
commit: 83105289af6c14d9d1d9d80b3aa2bbdbf01edd7e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 22 11:02:15 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 22 11:02:15 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=83105289
Linux patch 4.19.45
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1044_linux-4.19.45.patch | 4188 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4192 insertions(+)
diff --git a/0000_README b/0000_README
index f799222..f87fede 100644
--- a/0000_README
+++ b/0000_README
@@ -219,6 +219,10 @@ Patch: 1043_linux-4.19.44.patch
From: http://www.kernel.org
Desc: Linux 4.19.44
+Patch: 1044_linux-4.19.45.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.45
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1044_linux-4.19.45.patch b/1044_linux-4.19.45.patch
new file mode 100644
index 0000000..f52ef78
--- /dev/null
+++ b/1044_linux-4.19.45.patch
@@ -0,0 +1,4188 @@
+diff --git a/Documentation/x86/mds.rst b/Documentation/x86/mds.rst
+index 534e9baa4e1d..5d4330be200f 100644
+--- a/Documentation/x86/mds.rst
++++ b/Documentation/x86/mds.rst
+@@ -142,45 +142,13 @@ Mitigation points
+ mds_user_clear.
+
+ The mitigation is invoked in prepare_exit_to_usermode() which covers
+- most of the kernel to user space transitions. There are a few exceptions
+- which are not invoking prepare_exit_to_usermode() on return to user
+- space. These exceptions use the paranoid exit code.
++ all but one of the kernel to user space transitions. The exception
++ is when we return from a Non Maskable Interrupt (NMI), which is
++ handled directly in do_nmi().
+
+- - Non Maskable Interrupt (NMI):
+-
+- Access to sensible data like keys, credentials in the NMI context is
+- mostly theoretical: The CPU can do prefetching or execute a
+- misspeculated code path and thereby fetching data which might end up
+- leaking through a buffer.
+-
+- But for mounting other attacks the kernel stack address of the task is
+- already valuable information. So in full mitigation mode, the NMI is
+- mitigated on the return from do_nmi() to provide almost complete
+- coverage.
+-
+- - Double fault (#DF):
+-
+- A double fault is usually fatal, but the ESPFIX workaround, which can
+- be triggered from user space through modify_ldt(2) is a recoverable
+- double fault. #DF uses the paranoid exit path, so explicit mitigation
+- in the double fault handler is required.
+-
+- - Machine Check Exception (#MC):
+-
+- Another corner case is a #MC which hits between the CPU buffer clear
+- invocation and the actual return to user. As this still is in kernel
+- space it takes the paranoid exit path which does not clear the CPU
+- buffers. So the #MC handler repopulates the buffers to some
+- extent. Machine checks are not reliably controllable and the window is
+- extremly small so mitigation would just tick a checkbox that this
+- theoretical corner case is covered. To keep the amount of special
+- cases small, ignore #MC.
+-
+- - Debug Exception (#DB):
+-
+- This takes the paranoid exit path only when the INT1 breakpoint is in
+- kernel space. #DB on a user space address takes the regular exit path,
+- so no extra mitigation required.
++ (The reason that NMI is special is that prepare_exit_to_usermode() can
++ enable IRQs. In NMI context, NMIs are blocked, and we don't want to
++ enable IRQs with NMIs blocked.)
+
+
+ 2. C-State transition
+diff --git a/Makefile b/Makefile
+index dd11f5a83d2f..b21dd3866b63 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 44
++SUBLEVEL = 45
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -623,7 +623,7 @@ ifeq ($(may-sync-config),1)
+ # Read in dependencies to all Kconfig* files, make sure to run syncconfig if
+ # changes are detected. This should be included after arch/$(SRCARCH)/Makefile
+ # because some architectures define CROSS_COMPILE there.
+--include include/config/auto.conf.cmd
++include include/config/auto.conf.cmd
+
+ # To avoid any implicit rule to kick in, define an empty command
+ $(KCONFIG_CONFIG): ;
+diff --git a/arch/arm/boot/dts/exynos5260.dtsi b/arch/arm/boot/dts/exynos5260.dtsi
+index 55167850619c..33a085ffc447 100644
+--- a/arch/arm/boot/dts/exynos5260.dtsi
++++ b/arch/arm/boot/dts/exynos5260.dtsi
+@@ -223,7 +223,7 @@
+ wakeup-interrupt-controller {
+ compatible = "samsung,exynos4210-wakeup-eint";
+ interrupt-parent = <&gic>;
+- interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-audio.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-audio.dtsi
+index e84544b220b9..b90cea8b7368 100644
+--- a/arch/arm/boot/dts/exynos5422-odroidxu3-audio.dtsi
++++ b/arch/arm/boot/dts/exynos5422-odroidxu3-audio.dtsi
+@@ -22,7 +22,7 @@
+ "Headphone Jack", "HPL",
+ "Headphone Jack", "HPR",
+ "Headphone Jack", "MICBIAS",
+- "IN1", "Headphone Jack",
++ "IN12", "Headphone Jack",
+ "Speakers", "SPKL",
+ "Speakers", "SPKR";
+
+diff --git a/arch/arm/crypto/aes-neonbs-glue.c b/arch/arm/crypto/aes-neonbs-glue.c
+index 07e31941dc67..617c2c99ebfb 100644
+--- a/arch/arm/crypto/aes-neonbs-glue.c
++++ b/arch/arm/crypto/aes-neonbs-glue.c
+@@ -278,6 +278,8 @@ static int __xts_crypt(struct skcipher_request *req,
+ int err;
+
+ err = skcipher_walk_virt(&walk, req, true);
++ if (err)
++ return err;
+
+ crypto_cipher_encrypt_one(ctx->tweak_tfm, walk.iv, walk.iv);
+
+diff --git a/arch/arm/mach-exynos/firmware.c b/arch/arm/mach-exynos/firmware.c
+index be1f20fe28f4..fbe1db61115f 100644
+--- a/arch/arm/mach-exynos/firmware.c
++++ b/arch/arm/mach-exynos/firmware.c
+@@ -196,6 +196,7 @@ void __init exynos_firmware_init(void)
+ return;
+
+ addr = of_get_address(nd, 0, NULL, NULL);
++ of_node_put(nd);
+ if (!addr) {
+ pr_err("%s: No address specified.\n", __func__);
+ return;
+diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
+index 7ead3acd6fa4..b1fe53e8b460 100644
+--- a/arch/arm/mach-exynos/suspend.c
++++ b/arch/arm/mach-exynos/suspend.c
+@@ -639,8 +639,10 @@ void __init exynos_pm_init(void)
+
+ if (WARN_ON(!of_find_property(np, "interrupt-controller", NULL))) {
+ pr_warn("Outdated DT detected, suspend/resume will NOT work\n");
++ of_node_put(np);
+ return;
+ }
++ of_node_put(np);
+
+ pm_data = (const struct exynos_pm_data *) match->data;
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index c88e603396f6..df7e62d9a670 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -305,6 +305,7 @@
+ phys = <&emmc_phy>;
+ phy-names = "phy_arasan";
+ power-domains = <&power RK3399_PD_EMMC>;
++ disable-cqe-dcmd;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm64/crypto/aes-neonbs-glue.c b/arch/arm64/crypto/aes-neonbs-glue.c
+index e7a95a566462..5cc248967387 100644
+--- a/arch/arm64/crypto/aes-neonbs-glue.c
++++ b/arch/arm64/crypto/aes-neonbs-glue.c
+@@ -304,6 +304,8 @@ static int __xts_crypt(struct skcipher_request *req,
+ int err;
+
+ err = skcipher_walk_virt(&walk, req, false);
++ if (err)
++ return err;
+
+ kernel_neon_begin();
+ neon_aes_ecb_encrypt(walk.iv, walk.iv, ctx->twkey, ctx->key.rounds, 1);
+diff --git a/arch/arm64/crypto/ghash-ce-glue.c b/arch/arm64/crypto/ghash-ce-glue.c
+index 067d8937d5af..1ed227bf6106 100644
+--- a/arch/arm64/crypto/ghash-ce-glue.c
++++ b/arch/arm64/crypto/ghash-ce-glue.c
+@@ -418,9 +418,11 @@ static int gcm_encrypt(struct aead_request *req)
+ put_unaligned_be32(2, iv + GCM_IV_SIZE);
+
+ while (walk.nbytes >= (2 * AES_BLOCK_SIZE)) {
+- int blocks = walk.nbytes / AES_BLOCK_SIZE;
++ const int blocks =
++ walk.nbytes / (2 * AES_BLOCK_SIZE) * 2;
+ u8 *dst = walk.dst.virt.addr;
+ u8 *src = walk.src.virt.addr;
++ int remaining = blocks;
+
+ do {
+ __aes_arm64_encrypt(ctx->aes_key.key_enc,
+@@ -430,9 +432,9 @@ static int gcm_encrypt(struct aead_request *req)
+
+ dst += AES_BLOCK_SIZE;
+ src += AES_BLOCK_SIZE;
+- } while (--blocks > 0);
++ } while (--remaining > 0);
+
+- ghash_do_update(walk.nbytes / AES_BLOCK_SIZE, dg,
++ ghash_do_update(blocks, dg,
+ walk.dst.virt.addr, &ctx->ghash_key,
+ NULL);
+
+@@ -553,7 +555,7 @@ static int gcm_decrypt(struct aead_request *req)
+ put_unaligned_be32(2, iv + GCM_IV_SIZE);
+
+ while (walk.nbytes >= (2 * AES_BLOCK_SIZE)) {
+- int blocks = walk.nbytes / AES_BLOCK_SIZE;
++ int blocks = walk.nbytes / (2 * AES_BLOCK_SIZE) * 2;
+ u8 *dst = walk.dst.virt.addr;
+ u8 *src = walk.src.virt.addr;
+
+diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
+index f2a234d6516c..93e07512b4b6 100644
+--- a/arch/arm64/include/asm/arch_timer.h
++++ b/arch/arm64/include/asm/arch_timer.h
+@@ -148,18 +148,47 @@ static inline void arch_timer_set_cntkctl(u32 cntkctl)
+ isb();
+ }
+
++/*
++ * Ensure that reads of the counter are treated the same as memory reads
++ * for the purposes of ordering by subsequent memory barriers.
++ *
++ * This insanity brought to you by speculative system register reads,
++ * out-of-order memory accesses, sequence locks and Thomas Gleixner.
++ *
++ * http://lists.infradead.org/pipermail/linux-arm-kernel/2019-February/631195.html
++ */
++#define arch_counter_enforce_ordering(val) do { \
++ u64 tmp, _val = (val); \
++ \
++ asm volatile( \
++ " eor %0, %1, %1\n" \
++ " add %0, sp, %0\n" \
++ " ldr xzr, [%0]" \
++ : "=r" (tmp) : "r" (_val)); \
++} while (0)
++
+ static inline u64 arch_counter_get_cntpct(void)
+ {
++ u64 cnt;
++
+ isb();
+- return arch_timer_reg_read_stable(cntpct_el0);
++ cnt = arch_timer_reg_read_stable(cntpct_el0);
++ arch_counter_enforce_ordering(cnt);
++ return cnt;
+ }
+
+ static inline u64 arch_counter_get_cntvct(void)
+ {
++ u64 cnt;
++
+ isb();
+- return arch_timer_reg_read_stable(cntvct_el0);
++ cnt = arch_timer_reg_read_stable(cntvct_el0);
++ arch_counter_enforce_ordering(cnt);
++ return cnt;
+ }
+
++#undef arch_counter_enforce_ordering
++
+ static inline int arch_timer_arch_init(void)
+ {
+ return 0;
+diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
+index 79657ad91397..def5a5e807f0 100644
+--- a/arch/arm64/include/asm/processor.h
++++ b/arch/arm64/include/asm/processor.h
+@@ -53,7 +53,15 @@
+ * TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area.
+ */
+ #ifdef CONFIG_COMPAT
++#ifdef CONFIG_ARM64_64K_PAGES
++/*
++ * With CONFIG_ARM64_64K_PAGES enabled, the last page is occupied
++ * by the compat vectors page.
++ */
+ #define TASK_SIZE_32 UL(0x100000000)
++#else
++#define TASK_SIZE_32 (UL(0x100000000) - PAGE_SIZE)
++#endif /* CONFIG_ARM64_64K_PAGES */
+ #define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \
+ TASK_SIZE_32 : TASK_SIZE_64)
+ #define TASK_SIZE_OF(tsk) (test_tsk_thread_flag(tsk, TIF_32BIT) ? \
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index 06ca574495af..262925b98f42 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -135,6 +135,7 @@ NOKPROBE_SYMBOL(disable_debug_monitors);
+ */
+ static int clear_os_lock(unsigned int cpu)
+ {
++ write_sysreg(0, osdlr_el1);
+ write_sysreg(0, oslar_el1);
+ isb();
+ return 0;
+diff --git a/arch/arm64/kernel/sys.c b/arch/arm64/kernel/sys.c
+index b44065fb1616..6f91e8116514 100644
+--- a/arch/arm64/kernel/sys.c
++++ b/arch/arm64/kernel/sys.c
+@@ -31,7 +31,7 @@
+
+ SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len,
+ unsigned long, prot, unsigned long, flags,
+- unsigned long, fd, off_t, off)
++ unsigned long, fd, unsigned long, off)
+ {
+ if (offset_in_page(off) != 0)
+ return -EINVAL;
+diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S
+index c39872a7b03c..e8f60112818f 100644
+--- a/arch/arm64/kernel/vdso/gettimeofday.S
++++ b/arch/arm64/kernel/vdso/gettimeofday.S
+@@ -73,6 +73,13 @@ x_tmp .req x8
+ movn x_tmp, #0xff00, lsl #48
+ and \res, x_tmp, \res
+ mul \res, \res, \mult
++ /*
++ * Fake address dependency from the value computed from the counter
++ * register to subsequent data page accesses so that the sequence
++ * locking also orders the read of the counter.
++ */
++ and x_tmp, \res, xzr
++ add vdso_data, vdso_data, x_tmp
+ .endm
+
+ /*
+@@ -147,12 +154,12 @@ ENTRY(__kernel_gettimeofday)
+ /* w11 = cs_mono_mult, w12 = cs_shift */
+ ldp w11, w12, [vdso_data, #VDSO_CS_MONO_MULT]
+ ldp x13, x14, [vdso_data, #VDSO_XTIME_CLK_SEC]
+- seqcnt_check fail=1b
+
+ get_nsec_per_sec res=x9
+ lsl x9, x9, x12
+
+ get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
++ seqcnt_check fail=1b
+ get_ts_realtime res_sec=x10, res_nsec=x11, \
+ clock_nsec=x15, xtime_sec=x13, xtime_nsec=x14, nsec_to_sec=x9
+
+@@ -211,13 +218,13 @@ realtime:
+ /* w11 = cs_mono_mult, w12 = cs_shift */
+ ldp w11, w12, [vdso_data, #VDSO_CS_MONO_MULT]
+ ldp x13, x14, [vdso_data, #VDSO_XTIME_CLK_SEC]
+- seqcnt_check fail=realtime
+
+ /* All computations are done with left-shifted nsecs. */
+ get_nsec_per_sec res=x9
+ lsl x9, x9, x12
+
+ get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
++ seqcnt_check fail=realtime
+ get_ts_realtime res_sec=x10, res_nsec=x11, \
+ clock_nsec=x15, xtime_sec=x13, xtime_nsec=x14, nsec_to_sec=x9
+ clock_gettime_return, shift=1
+@@ -231,7 +238,6 @@ monotonic:
+ ldp w11, w12, [vdso_data, #VDSO_CS_MONO_MULT]
+ ldp x13, x14, [vdso_data, #VDSO_XTIME_CLK_SEC]
+ ldp x3, x4, [vdso_data, #VDSO_WTM_CLK_SEC]
+- seqcnt_check fail=monotonic
+
+ /* All computations are done with left-shifted nsecs. */
+ lsl x4, x4, x12
+@@ -239,6 +245,7 @@ monotonic:
+ lsl x9, x9, x12
+
+ get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
++ seqcnt_check fail=monotonic
+ get_ts_realtime res_sec=x10, res_nsec=x11, \
+ clock_nsec=x15, xtime_sec=x13, xtime_nsec=x14, nsec_to_sec=x9
+
+@@ -253,13 +260,13 @@ monotonic_raw:
+ /* w11 = cs_raw_mult, w12 = cs_shift */
+ ldp w12, w11, [vdso_data, #VDSO_CS_SHIFT]
+ ldp x13, x14, [vdso_data, #VDSO_RAW_TIME_SEC]
+- seqcnt_check fail=monotonic_raw
+
+ /* All computations are done with left-shifted nsecs. */
+ get_nsec_per_sec res=x9
+ lsl x9, x9, x12
+
+ get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
++ seqcnt_check fail=monotonic_raw
+ get_ts_clock_raw res_sec=x10, res_nsec=x11, \
+ clock_nsec=x15, nsec_to_sec=x9
+
+diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
+index 03646e6a2ef4..8cce091b6c21 100644
+--- a/arch/arm64/mm/proc.S
++++ b/arch/arm64/mm/proc.S
+@@ -70,24 +70,25 @@ ENTRY(cpu_do_suspend)
+ mrs x2, tpidr_el0
+ mrs x3, tpidrro_el0
+ mrs x4, contextidr_el1
+- mrs x5, cpacr_el1
+- mrs x6, tcr_el1
+- mrs x7, vbar_el1
+- mrs x8, mdscr_el1
+- mrs x9, oslsr_el1
+- mrs x10, sctlr_el1
++ mrs x5, osdlr_el1
++ mrs x6, cpacr_el1
++ mrs x7, tcr_el1
++ mrs x8, vbar_el1
++ mrs x9, mdscr_el1
++ mrs x10, oslsr_el1
++ mrs x11, sctlr_el1
+ alternative_if_not ARM64_HAS_VIRT_HOST_EXTN
+- mrs x11, tpidr_el1
++ mrs x12, tpidr_el1
+ alternative_else
+- mrs x11, tpidr_el2
++ mrs x12, tpidr_el2
+ alternative_endif
+- mrs x12, sp_el0
++ mrs x13, sp_el0
+ stp x2, x3, [x0]
+- stp x4, xzr, [x0, #16]
+- stp x5, x6, [x0, #32]
+- stp x7, x8, [x0, #48]
+- stp x9, x10, [x0, #64]
+- stp x11, x12, [x0, #80]
++ stp x4, x5, [x0, #16]
++ stp x6, x7, [x0, #32]
++ stp x8, x9, [x0, #48]
++ stp x10, x11, [x0, #64]
++ stp x12, x13, [x0, #80]
+ ret
+ ENDPROC(cpu_do_suspend)
+
+@@ -110,8 +111,8 @@ ENTRY(cpu_do_resume)
+ msr cpacr_el1, x6
+
+ /* Don't change t0sz here, mask those bits when restoring */
+- mrs x5, tcr_el1
+- bfi x8, x5, TCR_T0SZ_OFFSET, TCR_TxSZ_WIDTH
++ mrs x7, tcr_el1
++ bfi x8, x7, TCR_T0SZ_OFFSET, TCR_TxSZ_WIDTH
+
+ msr tcr_el1, x8
+ msr vbar_el1, x9
+@@ -135,6 +136,7 @@ alternative_endif
+ /*
+ * Restore oslsr_el1 by writing oslar_el1
+ */
++ msr osdlr_el1, x5
+ ubfx x11, x11, #1, #1
+ msr oslar_el1, x11
+ reset_pmuserenr_el0 x0 // Disable PMU access from EL0
+diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h
+index 783de51a6c4e..6c881659ee8a 100644
+--- a/arch/arm64/net/bpf_jit.h
++++ b/arch/arm64/net/bpf_jit.h
+@@ -100,12 +100,6 @@
+ #define A64_STXR(sf, Rt, Rn, Rs) \
+ A64_LSX(sf, Rt, Rn, Rs, STORE_EX)
+
+-/* Prefetch */
+-#define A64_PRFM(Rn, type, target, policy) \
+- aarch64_insn_gen_prefetch(Rn, AARCH64_INSN_PRFM_TYPE_##type, \
+- AARCH64_INSN_PRFM_TARGET_##target, \
+- AARCH64_INSN_PRFM_POLICY_##policy)
+-
+ /* Add/subtract (immediate) */
+ #define A64_ADDSUB_IMM(sf, Rd, Rn, imm12, type) \
+ aarch64_insn_gen_add_sub_imm(Rd, Rn, imm12, \
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index a6fdaea07c63..2eef156b38bb 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -736,7 +736,6 @@ emit_cond_jmp:
+ case BPF_STX | BPF_XADD | BPF_DW:
+ emit_a64_mov_i(1, tmp, off, ctx);
+ emit(A64_ADD(1, tmp, tmp, dst), ctx);
+- emit(A64_PRFM(tmp, PST, L1, STRM), ctx);
+ emit(A64_LDXR(isdw, tmp2, tmp), ctx);
+ emit(A64_ADD(isdw, tmp2, tmp2, src), ctx);
+ emit(A64_STXR(isdw, tmp2, tmp, tmp3), ctx);
+diff --git a/arch/x86/crypto/crct10dif-pclmul_glue.c b/arch/x86/crypto/crct10dif-pclmul_glue.c
+index cd4df9322501..7bbfe7d35da7 100644
+--- a/arch/x86/crypto/crct10dif-pclmul_glue.c
++++ b/arch/x86/crypto/crct10dif-pclmul_glue.c
+@@ -76,15 +76,14 @@ static int chksum_final(struct shash_desc *desc, u8 *out)
+ return 0;
+ }
+
+-static int __chksum_finup(__u16 *crcp, const u8 *data, unsigned int len,
+- u8 *out)
++static int __chksum_finup(__u16 crc, const u8 *data, unsigned int len, u8 *out)
+ {
+ if (irq_fpu_usable()) {
+ kernel_fpu_begin();
+- *(__u16 *)out = crc_t10dif_pcl(*crcp, data, len);
++ *(__u16 *)out = crc_t10dif_pcl(crc, data, len);
+ kernel_fpu_end();
+ } else
+- *(__u16 *)out = crc_t10dif_generic(*crcp, data, len);
++ *(__u16 *)out = crc_t10dif_generic(crc, data, len);
+ return 0;
+ }
+
+@@ -93,15 +92,13 @@ static int chksum_finup(struct shash_desc *desc, const u8 *data,
+ {
+ struct chksum_desc_ctx *ctx = shash_desc_ctx(desc);
+
+- return __chksum_finup(&ctx->crc, data, len, out);
++ return __chksum_finup(ctx->crc, data, len, out);
+ }
+
+ static int chksum_digest(struct shash_desc *desc, const u8 *data,
+ unsigned int length, u8 *out)
+ {
+- struct chksum_desc_ctx *ctx = shash_desc_ctx(desc);
+-
+- return __chksum_finup(&ctx->crc, data, length, out);
++ return __chksum_finup(0, data, length, out);
+ }
+
+ static struct shash_alg alg = {
+diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
+index fbbf1ba57ec6..b5c2b1091b18 100644
+--- a/arch/x86/entry/entry_32.S
++++ b/arch/x86/entry/entry_32.S
+@@ -648,6 +648,7 @@ ENTRY(__switch_to_asm)
+ pushl %ebx
+ pushl %edi
+ pushl %esi
++ pushfl
+
+ /* switch stack */
+ movl %esp, TASK_threadsp(%eax)
+@@ -670,6 +671,7 @@ ENTRY(__switch_to_asm)
+ #endif
+
+ /* restore callee-saved registers */
++ popfl
+ popl %esi
+ popl %edi
+ popl %ebx
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index 617df50a11d9..585bbc5b3216 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -352,6 +352,7 @@ ENTRY(__switch_to_asm)
+ pushq %r13
+ pushq %r14
+ pushq %r15
++ pushfq
+
+ /* switch stack */
+ movq %rsp, TASK_threadsp(%rdi)
+@@ -374,6 +375,7 @@ ENTRY(__switch_to_asm)
+ #endif
+
+ /* restore callee-saved registers */
++ popfq
+ popq %r15
+ popq %r14
+ popq %r13
+diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
+index 7cf1a270d891..157149d4129c 100644
+--- a/arch/x86/include/asm/switch_to.h
++++ b/arch/x86/include/asm/switch_to.h
+@@ -40,6 +40,7 @@ asmlinkage void ret_from_fork(void);
+ * order of the fields must match the code in __switch_to_asm().
+ */
+ struct inactive_task_frame {
++ unsigned long flags;
+ #ifdef CONFIG_X86_64
+ unsigned long r15;
+ unsigned long r14;
+diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
+index d3e593eb189f..020efe0f9614 100644
+--- a/arch/x86/kernel/process_32.c
++++ b/arch/x86/kernel/process_32.c
+@@ -130,6 +130,13 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long sp,
+ struct task_struct *tsk;
+ int err;
+
++ /*
++ * For a new task use the RESET flags value since there is no before.
++ * All the status flags are zero; DF and all the system flags must also
++ * be 0, specifically IF must be 0 because we context switch to the new
++ * task with interrupts disabled.
++ */
++ frame->flags = X86_EFLAGS_FIXED;
+ frame->bp = 0;
+ frame->ret_addr = (unsigned long) ret_from_fork;
+ p->thread.sp = (unsigned long) fork_frame;
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index a0854f283efd..59f71d0f2b23 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -300,6 +300,14 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long sp,
+ childregs = task_pt_regs(p);
+ fork_frame = container_of(childregs, struct fork_frame, regs);
+ frame = &fork_frame->frame;
++
++ /*
++ * For a new task use the RESET flags value since there is no before.
++ * All the status flags are zero; DF and all the system flags must also
++ * be 0, specifically IF must be 0 because we context switch to the new
++ * task with interrupts disabled.
++ */
++ frame->flags = X86_EFLAGS_FIXED;
+ frame->bp = 0;
+ frame->ret_addr = (unsigned long) ret_from_fork;
+ p->thread.sp = (unsigned long) fork_frame;
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index 0a5efd764914..e6db475164ed 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -58,7 +58,6 @@
+ #include <asm/alternative.h>
+ #include <asm/fpu/xstate.h>
+ #include <asm/trace/mpx.h>
+-#include <asm/nospec-branch.h>
+ #include <asm/mpx.h>
+ #include <asm/vm86.h>
+ #include <asm/umip.h>
+@@ -388,13 +387,6 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
+ regs->ip = (unsigned long)general_protection;
+ regs->sp = (unsigned long)&gpregs->orig_ax;
+
+- /*
+- * This situation can be triggered by userspace via
+- * modify_ldt(2) and the return does not take the regular
+- * user space exit, so a CPU buffer clear is required when
+- * MDS mitigation is enabled.
+- */
+- mds_user_clear_cpu_buffers();
+ return;
+ }
+ #endif
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index d2f5aa220355..cba414db14cb 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -1449,7 +1449,7 @@ static void apic_timer_expired(struct kvm_lapic *apic)
+ if (swait_active(q))
+ swake_up_one(q);
+
+- if (apic_lvtt_tscdeadline(apic))
++ if (apic_lvtt_tscdeadline(apic) || ktimer->hv_timer_in_use)
+ ktimer->expired_tscdeadline = ktimer->tscdeadline;
+ }
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index f3337adaf9b3..d0eb37c069b8 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1162,31 +1162,42 @@ static int do_get_msr_feature(struct kvm_vcpu *vcpu, unsigned index, u64 *data)
+ return 0;
+ }
+
+-bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer)
++static bool __kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer)
+ {
+- if (efer & efer_reserved_bits)
+- return false;
+-
+ if (efer & EFER_FFXSR && !guest_cpuid_has(vcpu, X86_FEATURE_FXSR_OPT))
+- return false;
++ return false;
+
+ if (efer & EFER_SVME && !guest_cpuid_has(vcpu, X86_FEATURE_SVM))
+- return false;
++ return false;
+
+ return true;
++
++}
++bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer)
++{
++ if (efer & efer_reserved_bits)
++ return false;
++
++ return __kvm_valid_efer(vcpu, efer);
+ }
+ EXPORT_SYMBOL_GPL(kvm_valid_efer);
+
+-static int set_efer(struct kvm_vcpu *vcpu, u64 efer)
++static int set_efer(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ {
+ u64 old_efer = vcpu->arch.efer;
++ u64 efer = msr_info->data;
+
+- if (!kvm_valid_efer(vcpu, efer))
+- return 1;
++ if (efer & efer_reserved_bits)
++ return false;
+
+- if (is_paging(vcpu)
+- && (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME))
+- return 1;
++ if (!msr_info->host_initiated) {
++ if (!__kvm_valid_efer(vcpu, efer))
++ return 1;
++
++ if (is_paging(vcpu) &&
++ (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME))
++ return 1;
++ }
+
+ efer &= ~EFER_LMA;
+ efer |= vcpu->arch.efer & EFER_LMA;
+@@ -2356,7 +2367,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ vcpu->arch.arch_capabilities = data;
+ break;
+ case MSR_EFER:
+- return set_efer(vcpu, data);
++ return set_efer(vcpu, msr_info);
+ case MSR_K7_HWCR:
+ data &= ~(u64)0x40; /* ignore flush filter disable */
+ data &= ~(u64)0x100; /* ignore ignne emulation enable */
+diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c
+index f7f77023288a..dab07827d25e 100644
+--- a/arch/x86/xen/enlighten_pvh.c
++++ b/arch/x86/xen/enlighten_pvh.c
+@@ -97,6 +97,7 @@ void __init xen_prepare_pvh(void)
+ }
+
+ xen_pvh = 1;
++ xen_domain_type = XEN_HVM_DOMAIN;
+ xen_start_flags = pvh_start_info.flags;
+
+ msr = cpuid_ebx(xen_cpuid_base() + 2);
+diff --git a/crypto/ccm.c b/crypto/ccm.c
+index 0a083342ec8c..8104c564dd31 100644
+--- a/crypto/ccm.c
++++ b/crypto/ccm.c
+@@ -455,7 +455,6 @@ static void crypto_ccm_free(struct aead_instance *inst)
+
+ static int crypto_ccm_create_common(struct crypto_template *tmpl,
+ struct rtattr **tb,
+- const char *full_name,
+ const char *ctr_name,
+ const char *mac_name)
+ {
+@@ -483,7 +482,8 @@ static int crypto_ccm_create_common(struct crypto_template *tmpl,
+
+ mac = __crypto_hash_alg_common(mac_alg);
+ err = -EINVAL;
+- if (mac->digestsize != 16)
++ if (strncmp(mac->base.cra_name, "cbcmac(", 7) != 0 ||
++ mac->digestsize != 16)
+ goto out_put_mac;
+
+ inst = kzalloc(sizeof(*inst) + sizeof(*ictx), GFP_KERNEL);
+@@ -506,23 +506,27 @@ static int crypto_ccm_create_common(struct crypto_template *tmpl,
+
+ ctr = crypto_spawn_skcipher_alg(&ictx->ctr);
+
+- /* Not a stream cipher? */
++ /* The skcipher algorithm must be CTR mode, using 16-byte blocks. */
+ err = -EINVAL;
+- if (ctr->base.cra_blocksize != 1)
++ if (strncmp(ctr->base.cra_name, "ctr(", 4) != 0 ||
++ crypto_skcipher_alg_ivsize(ctr) != 16 ||
++ ctr->base.cra_blocksize != 1)
+ goto err_drop_ctr;
+
+- /* We want the real thing! */
+- if (crypto_skcipher_alg_ivsize(ctr) != 16)
++ /* ctr and cbcmac must use the same underlying block cipher. */
++ if (strcmp(ctr->base.cra_name + 4, mac->base.cra_name + 7) != 0)
+ goto err_drop_ctr;
+
+ err = -ENAMETOOLONG;
++ if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
++ "ccm(%s", ctr->base.cra_name + 4) >= CRYPTO_MAX_ALG_NAME)
++ goto err_drop_ctr;
++
+ if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
+ "ccm_base(%s,%s)", ctr->base.cra_driver_name,
+ mac->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
+ goto err_drop_ctr;
+
+- memcpy(inst->alg.base.cra_name, full_name, CRYPTO_MAX_ALG_NAME);
+-
+ inst->alg.base.cra_flags = ctr->base.cra_flags & CRYPTO_ALG_ASYNC;
+ inst->alg.base.cra_priority = (mac->base.cra_priority +
+ ctr->base.cra_priority) / 2;
+@@ -564,7 +568,6 @@ static int crypto_ccm_create(struct crypto_template *tmpl, struct rtattr **tb)
+ const char *cipher_name;
+ char ctr_name[CRYPTO_MAX_ALG_NAME];
+ char mac_name[CRYPTO_MAX_ALG_NAME];
+- char full_name[CRYPTO_MAX_ALG_NAME];
+
+ cipher_name = crypto_attr_alg_name(tb[1]);
+ if (IS_ERR(cipher_name))
+@@ -578,12 +581,7 @@ static int crypto_ccm_create(struct crypto_template *tmpl, struct rtattr **tb)
+ cipher_name) >= CRYPTO_MAX_ALG_NAME)
+ return -ENAMETOOLONG;
+
+- if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "ccm(%s)", cipher_name) >=
+- CRYPTO_MAX_ALG_NAME)
+- return -ENAMETOOLONG;
+-
+- return crypto_ccm_create_common(tmpl, tb, full_name, ctr_name,
+- mac_name);
++ return crypto_ccm_create_common(tmpl, tb, ctr_name, mac_name);
+ }
+
+ static struct crypto_template crypto_ccm_tmpl = {
+@@ -596,23 +594,17 @@ static int crypto_ccm_base_create(struct crypto_template *tmpl,
+ struct rtattr **tb)
+ {
+ const char *ctr_name;
+- const char *cipher_name;
+- char full_name[CRYPTO_MAX_ALG_NAME];
++ const char *mac_name;
+
+ ctr_name = crypto_attr_alg_name(tb[1]);
+ if (IS_ERR(ctr_name))
+ return PTR_ERR(ctr_name);
+
+- cipher_name = crypto_attr_alg_name(tb[2]);
+- if (IS_ERR(cipher_name))
+- return PTR_ERR(cipher_name);
+-
+- if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "ccm_base(%s,%s)",
+- ctr_name, cipher_name) >= CRYPTO_MAX_ALG_NAME)
+- return -ENAMETOOLONG;
++ mac_name = crypto_attr_alg_name(tb[2]);
++ if (IS_ERR(mac_name))
++ return PTR_ERR(mac_name);
+
+- return crypto_ccm_create_common(tmpl, tb, full_name, ctr_name,
+- cipher_name);
++ return crypto_ccm_create_common(tmpl, tb, ctr_name, mac_name);
+ }
+
+ static struct crypto_template crypto_ccm_base_tmpl = {
+diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c
+index 600afa99941f..4d6f51bcdfab 100644
+--- a/crypto/chacha20poly1305.c
++++ b/crypto/chacha20poly1305.c
+@@ -647,8 +647,8 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb,
+
+ err = -ENAMETOOLONG;
+ if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
+- "%s(%s,%s)", name, chacha_name,
+- poly_name) >= CRYPTO_MAX_ALG_NAME)
++ "%s(%s,%s)", name, chacha->base.cra_name,
++ poly->cra_name) >= CRYPTO_MAX_ALG_NAME)
+ goto out_drop_chacha;
+ if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
+ "%s(%s,%s)", name, chacha->base.cra_driver_name,
+diff --git a/crypto/crct10dif_generic.c b/crypto/crct10dif_generic.c
+index 8e94e29dc6fc..d08048ae5552 100644
+--- a/crypto/crct10dif_generic.c
++++ b/crypto/crct10dif_generic.c
+@@ -65,10 +65,9 @@ static int chksum_final(struct shash_desc *desc, u8 *out)
+ return 0;
+ }
+
+-static int __chksum_finup(__u16 *crcp, const u8 *data, unsigned int len,
+- u8 *out)
++static int __chksum_finup(__u16 crc, const u8 *data, unsigned int len, u8 *out)
+ {
+- *(__u16 *)out = crc_t10dif_generic(*crcp, data, len);
++ *(__u16 *)out = crc_t10dif_generic(crc, data, len);
+ return 0;
+ }
+
+@@ -77,15 +76,13 @@ static int chksum_finup(struct shash_desc *desc, const u8 *data,
+ {
+ struct chksum_desc_ctx *ctx = shash_desc_ctx(desc);
+
+- return __chksum_finup(&ctx->crc, data, len, out);
++ return __chksum_finup(ctx->crc, data, len, out);
+ }
+
+ static int chksum_digest(struct shash_desc *desc, const u8 *data,
+ unsigned int length, u8 *out)
+ {
+- struct chksum_desc_ctx *ctx = shash_desc_ctx(desc);
+-
+- return __chksum_finup(&ctx->crc, data, length, out);
++ return __chksum_finup(0, data, length, out);
+ }
+
+ static struct shash_alg alg = {
+diff --git a/crypto/gcm.c b/crypto/gcm.c
+index 0ad879e1f9b2..9b0ea3ded1a4 100644
+--- a/crypto/gcm.c
++++ b/crypto/gcm.c
+@@ -597,7 +597,6 @@ static void crypto_gcm_free(struct aead_instance *inst)
+
+ static int crypto_gcm_create_common(struct crypto_template *tmpl,
+ struct rtattr **tb,
+- const char *full_name,
+ const char *ctr_name,
+ const char *ghash_name)
+ {
+@@ -638,7 +637,8 @@ static int crypto_gcm_create_common(struct crypto_template *tmpl,
+ goto err_free_inst;
+
+ err = -EINVAL;
+- if (ghash->digestsize != 16)
++ if (strcmp(ghash->base.cra_name, "ghash") != 0 ||
++ ghash->digestsize != 16)
+ goto err_drop_ghash;
+
+ crypto_set_skcipher_spawn(&ctx->ctr, aead_crypto_instance(inst));
+@@ -650,24 +650,24 @@ static int crypto_gcm_create_common(struct crypto_template *tmpl,
+
+ ctr = crypto_spawn_skcipher_alg(&ctx->ctr);
+
+- /* We only support 16-byte blocks. */
++ /* The skcipher algorithm must be CTR mode, using 16-byte blocks. */
+ err = -EINVAL;
+- if (crypto_skcipher_alg_ivsize(ctr) != 16)
++ if (strncmp(ctr->base.cra_name, "ctr(", 4) != 0 ||
++ crypto_skcipher_alg_ivsize(ctr) != 16 ||
++ ctr->base.cra_blocksize != 1)
+ goto out_put_ctr;
+
+- /* Not a stream cipher? */
+- if (ctr->base.cra_blocksize != 1)
++ err = -ENAMETOOLONG;
++ if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
++ "gcm(%s", ctr->base.cra_name + 4) >= CRYPTO_MAX_ALG_NAME)
+ goto out_put_ctr;
+
+- err = -ENAMETOOLONG;
+ if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
+ "gcm_base(%s,%s)", ctr->base.cra_driver_name,
+ ghash_alg->cra_driver_name) >=
+ CRYPTO_MAX_ALG_NAME)
+ goto out_put_ctr;
+
+- memcpy(inst->alg.base.cra_name, full_name, CRYPTO_MAX_ALG_NAME);
+-
+ inst->alg.base.cra_flags = (ghash->base.cra_flags |
+ ctr->base.cra_flags) & CRYPTO_ALG_ASYNC;
+ inst->alg.base.cra_priority = (ghash->base.cra_priority +
+@@ -709,7 +709,6 @@ static int crypto_gcm_create(struct crypto_template *tmpl, struct rtattr **tb)
+ {
+ const char *cipher_name;
+ char ctr_name[CRYPTO_MAX_ALG_NAME];
+- char full_name[CRYPTO_MAX_ALG_NAME];
+
+ cipher_name = crypto_attr_alg_name(tb[1]);
+ if (IS_ERR(cipher_name))
+@@ -719,12 +718,7 @@ static int crypto_gcm_create(struct crypto_template *tmpl, struct rtattr **tb)
+ CRYPTO_MAX_ALG_NAME)
+ return -ENAMETOOLONG;
+
+- if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "gcm(%s)", cipher_name) >=
+- CRYPTO_MAX_ALG_NAME)
+- return -ENAMETOOLONG;
+-
+- return crypto_gcm_create_common(tmpl, tb, full_name,
+- ctr_name, "ghash");
++ return crypto_gcm_create_common(tmpl, tb, ctr_name, "ghash");
+ }
+
+ static struct crypto_template crypto_gcm_tmpl = {
+@@ -738,7 +732,6 @@ static int crypto_gcm_base_create(struct crypto_template *tmpl,
+ {
+ const char *ctr_name;
+ const char *ghash_name;
+- char full_name[CRYPTO_MAX_ALG_NAME];
+
+ ctr_name = crypto_attr_alg_name(tb[1]);
+ if (IS_ERR(ctr_name))
+@@ -748,12 +741,7 @@ static int crypto_gcm_base_create(struct crypto_template *tmpl,
+ if (IS_ERR(ghash_name))
+ return PTR_ERR(ghash_name);
+
+- if (snprintf(full_name, CRYPTO_MAX_ALG_NAME, "gcm_base(%s,%s)",
+- ctr_name, ghash_name) >= CRYPTO_MAX_ALG_NAME)
+- return -ENAMETOOLONG;
+-
+- return crypto_gcm_create_common(tmpl, tb, full_name,
+- ctr_name, ghash_name);
++ return crypto_gcm_create_common(tmpl, tb, ctr_name, ghash_name);
+ }
+
+ static struct crypto_template crypto_gcm_base_tmpl = {
+diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c
+index 8c77bc78a09f..df8fc0f54374 100644
+--- a/crypto/salsa20_generic.c
++++ b/crypto/salsa20_generic.c
+@@ -161,7 +161,7 @@ static int salsa20_crypt(struct skcipher_request *req)
+
+ err = skcipher_walk_virt(&walk, req, true);
+
+- salsa20_init(state, ctx, walk.iv);
++ salsa20_init(state, ctx, req->iv);
+
+ while (walk.nbytes > 0) {
+ unsigned int nbytes = walk.nbytes;
+diff --git a/crypto/skcipher.c b/crypto/skcipher.c
+index 46bb300d418f..b664cf867f5f 100644
+--- a/crypto/skcipher.c
++++ b/crypto/skcipher.c
+@@ -131,8 +131,13 @@ unmap_src:
+ memcpy(walk->dst.virt.addr, walk->page, n);
+ skcipher_unmap_dst(walk);
+ } else if (unlikely(walk->flags & SKCIPHER_WALK_SLOW)) {
+- if (WARN_ON(err)) {
+- /* unexpected case; didn't process all bytes */
++ if (err) {
++ /*
++ * Didn't process all bytes. Either the algorithm is
++ * broken, or this was the last step and it turned out
++ * the message wasn't evenly divisible into blocks but
++ * the algorithm requires it.
++ */
+ err = -EINVAL;
+ goto finish;
+ }
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 74c489047f57..847db3edcb5b 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -977,6 +977,8 @@ static int acpi_s2idle_prepare(void)
+ if (acpi_sci_irq_valid())
+ enable_irq_wake(acpi_sci_irq);
+
++ acpi_enable_wakeup_devices(ACPI_STATE_S0);
++
+ /* Change the configuration of GPEs to avoid spurious wakeup. */
+ acpi_enable_all_wakeup_gpes();
+ acpi_os_wait_events_complete();
+@@ -1026,6 +1028,8 @@ static void acpi_s2idle_restore(void)
+ {
+ acpi_enable_all_runtime_gpes();
+
++ acpi_disable_wakeup_devices(ACPI_STATE_S0);
++
+ if (acpi_sci_irq_valid())
+ disable_irq_wake(acpi_sci_irq);
+
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 76c2010ba672..af44db2dfb68 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -688,12 +688,16 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ /* End of read */
+ len = ssif_info->multi_len;
+ data = ssif_info->data;
+- } else if (blocknum != ssif_info->multi_pos) {
++ } else if (blocknum + 1 != ssif_info->multi_pos) {
+ /*
+ * Out of sequence block, just abort. Block
+ * numbers start at zero for the second block,
+ * but multi_pos starts at one, so the +1.
+ */
++ if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
++ dev_dbg(&ssif_info->client->dev,
++ "Received message out of sequence, expected %u, got %u\n",
++ ssif_info->multi_pos - 1, blocknum);
+ result = -EIO;
+ } else {
+ ssif_inc_stat(ssif_info, received_message_parts);
+diff --git a/drivers/crypto/amcc/crypto4xx_alg.c b/drivers/crypto/amcc/crypto4xx_alg.c
+index f5c07498ea4f..0c85a5123f85 100644
+--- a/drivers/crypto/amcc/crypto4xx_alg.c
++++ b/drivers/crypto/amcc/crypto4xx_alg.c
+@@ -141,9 +141,10 @@ static int crypto4xx_setkey_aes(struct crypto_skcipher *cipher,
+ /* Setup SA */
+ sa = ctx->sa_in;
+
+- set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, (cm == CRYPTO_MODE_CBC ?
+- SA_SAVE_IV : SA_NOT_SAVE_IV),
+- SA_LOAD_HASH_FROM_SA, SA_LOAD_IV_FROM_STATE,
++ set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, (cm == CRYPTO_MODE_ECB ?
++ SA_NOT_SAVE_IV : SA_SAVE_IV),
++ SA_NOT_LOAD_HASH, (cm == CRYPTO_MODE_ECB ?
++ SA_LOAD_IV_FROM_SA : SA_LOAD_IV_FROM_STATE),
+ SA_NO_HEADER_PROC, SA_HASH_ALG_NULL,
+ SA_CIPHER_ALG_AES, SA_PAD_TYPE_ZERO,
+ SA_OP_GROUP_BASIC, SA_OPCODE_DECRYPT,
+@@ -162,6 +163,11 @@ static int crypto4xx_setkey_aes(struct crypto_skcipher *cipher,
+ memcpy(ctx->sa_out, ctx->sa_in, ctx->sa_len * 4);
+ sa = ctx->sa_out;
+ sa->sa_command_0.bf.dir = DIR_OUTBOUND;
++ /*
++ * SA_OPCODE_ENCRYPT is the same value as SA_OPCODE_DECRYPT.
++ * it's the DIR_(IN|OUT)BOUND that matters
++ */
++ sa->sa_command_0.bf.opcode = SA_OPCODE_ENCRYPT;
+
+ return 0;
+ }
+diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
+index 6eaec9ba0f68..d2ec9fd1b8bb 100644
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -712,7 +712,23 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
+ size_t offset_to_sr_ptr;
+ u32 gd_idx = 0;
+ int tmp;
+- bool is_busy;
++ bool is_busy, force_sd;
++
++ /*
++ * There's a very subtile/disguised "bug" in the hardware that
++ * gets indirectly mentioned in 18.1.3.5 Encryption/Decryption
++ * of the hardware spec:
++ * *drum roll* the AES/(T)DES OFB and CFB modes are listed as
++ * operation modes for >>> "Block ciphers" <<<.
++ *
++ * To workaround this issue and stop the hardware from causing
++ * "overran dst buffer" on crypttexts that are not a multiple
++ * of 16 (AES_BLOCK_SIZE), we force the driver to use the
++ * scatter buffers.
++ */
++ force_sd = (req_sa->sa_command_1.bf.crypto_mode9_8 == CRYPTO_MODE_CFB
++ || req_sa->sa_command_1.bf.crypto_mode9_8 == CRYPTO_MODE_OFB)
++ && (datalen % AES_BLOCK_SIZE);
+
+ /* figure how many gd are needed */
+ tmp = sg_nents_for_len(src, assoclen + datalen);
+@@ -730,7 +746,7 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
+ }
+
+ /* figure how many sd are needed */
+- if (sg_is_last(dst)) {
++ if (sg_is_last(dst) && force_sd == false) {
+ num_sd = 0;
+ } else {
+ if (datalen > PPC4XX_SD_BUFFER_SIZE) {
+@@ -805,9 +821,10 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
+ pd->sa_len = sa_len;
+
+ pd_uinfo = &dev->pdr_uinfo[pd_entry];
+- pd_uinfo->async_req = req;
+ pd_uinfo->num_gd = num_gd;
+ pd_uinfo->num_sd = num_sd;
++ pd_uinfo->dest_va = dst;
++ pd_uinfo->async_req = req;
+
+ if (iv_len)
+ memcpy(pd_uinfo->sr_va->save_iv, iv, iv_len);
+@@ -826,7 +843,6 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
+ /* get first gd we are going to use */
+ gd_idx = fst_gd;
+ pd_uinfo->first_gd = fst_gd;
+- pd_uinfo->num_gd = num_gd;
+ gd = crypto4xx_get_gdp(dev, &gd_dma, gd_idx);
+ pd->src = gd_dma;
+ /* enable gather */
+@@ -863,17 +879,14 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
+ * Indicate gather array is not used
+ */
+ pd_uinfo->first_gd = 0xffffffff;
+- pd_uinfo->num_gd = 0;
+ }
+- if (sg_is_last(dst)) {
++ if (!num_sd) {
+ /*
+ * we know application give us dst a whole piece of memory
+ * no need to use scatter ring.
+ */
+ pd_uinfo->using_sd = 0;
+ pd_uinfo->first_sd = 0xffffffff;
+- pd_uinfo->num_sd = 0;
+- pd_uinfo->dest_va = dst;
+ sa->sa_command_0.bf.scatter = 0;
+ pd->dest = (u32)dma_map_page(dev->core_dev->device,
+ sg_page(dst), dst->offset,
+@@ -887,9 +900,7 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
+ nbytes = datalen;
+ sa->sa_command_0.bf.scatter = 1;
+ pd_uinfo->using_sd = 1;
+- pd_uinfo->dest_va = dst;
+ pd_uinfo->first_sd = fst_sd;
+- pd_uinfo->num_sd = num_sd;
+ sd = crypto4xx_get_sdp(dev, &sd_dma, sd_idx);
+ pd->dest = sd_dma;
+ /* setup scatter descriptor */
+diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c
+index 72790d88236d..1603dc8d2d75 100644
+--- a/drivers/crypto/ccp/psp-dev.c
++++ b/drivers/crypto/ccp/psp-dev.c
+@@ -935,7 +935,7 @@ void psp_pci_init(void)
+ rc = sev_platform_init(&error);
+ if (rc) {
+ dev_err(sp->dev, "SEV: failed to INIT error %#x\n", error);
+- goto err;
++ return;
+ }
+
+ dev_info(sp->dev, "SEV API:%d.%d build:%d\n", psp_master->api_major,
+diff --git a/drivers/crypto/ccree/cc_aead.c b/drivers/crypto/ccree/cc_aead.c
+index 5852d29ae2da..0669033f5be5 100644
+--- a/drivers/crypto/ccree/cc_aead.c
++++ b/drivers/crypto/ccree/cc_aead.c
+@@ -415,7 +415,7 @@ static int validate_keys_sizes(struct cc_aead_ctx *ctx)
+ /* This function prepers the user key so it can pass to the hmac processing
+ * (copy to intenral buffer or hash in case of key longer than block
+ */
+-static int cc_get_plain_hmac_key(struct crypto_aead *tfm, const u8 *key,
++static int cc_get_plain_hmac_key(struct crypto_aead *tfm, const u8 *authkey,
+ unsigned int keylen)
+ {
+ dma_addr_t key_dma_addr = 0;
+@@ -428,6 +428,7 @@ static int cc_get_plain_hmac_key(struct crypto_aead *tfm, const u8 *key,
+ unsigned int hashmode;
+ unsigned int idx = 0;
+ int rc = 0;
++ u8 *key = NULL;
+ struct cc_hw_desc desc[MAX_AEAD_SETKEY_SEQ];
+ dma_addr_t padded_authkey_dma_addr =
+ ctx->auth_state.hmac.padded_authkey_dma_addr;
+@@ -446,11 +447,17 @@ static int cc_get_plain_hmac_key(struct crypto_aead *tfm, const u8 *key,
+ }
+
+ if (keylen != 0) {
++
++ key = kmemdup(authkey, keylen, GFP_KERNEL);
++ if (!key)
++ return -ENOMEM;
++
+ key_dma_addr = dma_map_single(dev, (void *)key, keylen,
+ DMA_TO_DEVICE);
+ if (dma_mapping_error(dev, key_dma_addr)) {
+ dev_err(dev, "Mapping key va=0x%p len=%u for DMA failed\n",
+ key, keylen);
++ kzfree(key);
+ return -ENOMEM;
+ }
+ if (keylen > blocksize) {
+@@ -533,6 +540,8 @@ static int cc_get_plain_hmac_key(struct crypto_aead *tfm, const u8 *key,
+ if (key_dma_addr)
+ dma_unmap_single(dev, key_dma_addr, keylen, DMA_TO_DEVICE);
+
++ kzfree(key);
++
+ return rc;
+ }
+
+diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c
+index 3bcb6bce666e..90b4870078fb 100644
+--- a/drivers/crypto/ccree/cc_buffer_mgr.c
++++ b/drivers/crypto/ccree/cc_buffer_mgr.c
+@@ -83,24 +83,17 @@ static void cc_copy_mac(struct device *dev, struct aead_request *req,
+ */
+ static unsigned int cc_get_sgl_nents(struct device *dev,
+ struct scatterlist *sg_list,
+- unsigned int nbytes, u32 *lbytes,
+- bool *is_chained)
++ unsigned int nbytes, u32 *lbytes)
+ {
+ unsigned int nents = 0;
+
+ while (nbytes && sg_list) {
+- if (sg_list->length) {
+- nents++;
+- /* get the number of bytes in the last entry */
+- *lbytes = nbytes;
+- nbytes -= (sg_list->length > nbytes) ?
+- nbytes : sg_list->length;
+- sg_list = sg_next(sg_list);
+- } else {
+- sg_list = (struct scatterlist *)sg_page(sg_list);
+- if (is_chained)
+- *is_chained = true;
+- }
++ nents++;
++ /* get the number of bytes in the last entry */
++ *lbytes = nbytes;
++ nbytes -= (sg_list->length > nbytes) ?
++ nbytes : sg_list->length;
++ sg_list = sg_next(sg_list);
+ }
+ dev_dbg(dev, "nents %d last bytes %d\n", nents, *lbytes);
+ return nents;
+@@ -142,7 +135,7 @@ void cc_copy_sg_portion(struct device *dev, u8 *dest, struct scatterlist *sg,
+ {
+ u32 nents, lbytes;
+
+- nents = cc_get_sgl_nents(dev, sg, end, &lbytes, NULL);
++ nents = cc_get_sgl_nents(dev, sg, end, &lbytes);
+ sg_copy_buffer(sg, nents, (void *)dest, (end - to_skip + 1), to_skip,
+ (direct == CC_SG_TO_BUF));
+ }
+@@ -311,40 +304,10 @@ static void cc_add_sg_entry(struct device *dev, struct buffer_array *sgl_data,
+ sgl_data->num_of_buffers++;
+ }
+
+-static int cc_dma_map_sg(struct device *dev, struct scatterlist *sg, u32 nents,
+- enum dma_data_direction direction)
+-{
+- u32 i, j;
+- struct scatterlist *l_sg = sg;
+-
+- for (i = 0; i < nents; i++) {
+- if (!l_sg)
+- break;
+- if (dma_map_sg(dev, l_sg, 1, direction) != 1) {
+- dev_err(dev, "dma_map_page() sg buffer failed\n");
+- goto err;
+- }
+- l_sg = sg_next(l_sg);
+- }
+- return nents;
+-
+-err:
+- /* Restore mapped parts */
+- for (j = 0; j < i; j++) {
+- if (!sg)
+- break;
+- dma_unmap_sg(dev, sg, 1, direction);
+- sg = sg_next(sg);
+- }
+- return 0;
+-}
+-
+ static int cc_map_sg(struct device *dev, struct scatterlist *sg,
+ unsigned int nbytes, int direction, u32 *nents,
+ u32 max_sg_nents, u32 *lbytes, u32 *mapped_nents)
+ {
+- bool is_chained = false;
+-
+ if (sg_is_last(sg)) {
+ /* One entry only case -set to DLLI */
+ if (dma_map_sg(dev, sg, 1, direction) != 1) {
+@@ -358,35 +321,21 @@ static int cc_map_sg(struct device *dev, struct scatterlist *sg,
+ *nents = 1;
+ *mapped_nents = 1;
+ } else { /*sg_is_last*/
+- *nents = cc_get_sgl_nents(dev, sg, nbytes, lbytes,
+- &is_chained);
++ *nents = cc_get_sgl_nents(dev, sg, nbytes, lbytes);
+ if (*nents > max_sg_nents) {
+ *nents = 0;
+ dev_err(dev, "Too many fragments. current %d max %d\n",
+ *nents, max_sg_nents);
+ return -ENOMEM;
+ }
+- if (!is_chained) {
+- /* In case of mmu the number of mapped nents might
+- * be changed from the original sgl nents
+- */
+- *mapped_nents = dma_map_sg(dev, sg, *nents, direction);
+- if (*mapped_nents == 0) {
+- *nents = 0;
+- dev_err(dev, "dma_map_sg() sg buffer failed\n");
+- return -ENOMEM;
+- }
+- } else {
+- /*In this case the driver maps entry by entry so it
+- * must have the same nents before and after map
+- */
+- *mapped_nents = cc_dma_map_sg(dev, sg, *nents,
+- direction);
+- if (*mapped_nents != *nents) {
+- *nents = *mapped_nents;
+- dev_err(dev, "dma_map_sg() sg buffer failed\n");
+- return -ENOMEM;
+- }
++ /* In case of mmu the number of mapped nents might
++ * be changed from the original sgl nents
++ */
++ *mapped_nents = dma_map_sg(dev, sg, *nents, direction);
++ if (*mapped_nents == 0) {
++ *nents = 0;
++ dev_err(dev, "dma_map_sg() sg buffer failed\n");
++ return -ENOMEM;
+ }
+ }
+
+@@ -571,7 +520,6 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req)
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct cc_drvdata *drvdata = dev_get_drvdata(dev);
+ u32 dummy;
+- bool chained;
+ u32 size_to_unmap = 0;
+
+ if (areq_ctx->mac_buf_dma_addr) {
+@@ -612,6 +560,7 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req)
+ if (areq_ctx->gen_ctx.iv_dma_addr) {
+ dma_unmap_single(dev, areq_ctx->gen_ctx.iv_dma_addr,
+ hw_iv_size, DMA_BIDIRECTIONAL);
++ kzfree(areq_ctx->gen_ctx.iv);
+ }
+
+ /* Release pool */
+@@ -636,15 +585,14 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req)
+ size_to_unmap += crypto_aead_ivsize(tfm);
+
+ dma_unmap_sg(dev, req->src,
+- cc_get_sgl_nents(dev, req->src, size_to_unmap,
+- &dummy, &chained),
++ cc_get_sgl_nents(dev, req->src, size_to_unmap, &dummy),
+ DMA_BIDIRECTIONAL);
+ if (req->src != req->dst) {
+ dev_dbg(dev, "Unmapping dst sgl: req->dst=%pK\n",
+ sg_virt(req->dst));
+ dma_unmap_sg(dev, req->dst,
+ cc_get_sgl_nents(dev, req->dst, size_to_unmap,
+- &dummy, &chained),
++ &dummy),
+ DMA_BIDIRECTIONAL);
+ }
+ if (drvdata->coherent &&
+@@ -717,19 +665,27 @@ static int cc_aead_chain_iv(struct cc_drvdata *drvdata,
+ struct aead_req_ctx *areq_ctx = aead_request_ctx(req);
+ unsigned int hw_iv_size = areq_ctx->hw_iv_size;
+ struct device *dev = drvdata_to_dev(drvdata);
++ gfp_t flags = cc_gfp_flags(&req->base);
+ int rc = 0;
+
+ if (!req->iv) {
+ areq_ctx->gen_ctx.iv_dma_addr = 0;
++ areq_ctx->gen_ctx.iv = NULL;
+ goto chain_iv_exit;
+ }
+
+- areq_ctx->gen_ctx.iv_dma_addr = dma_map_single(dev, req->iv,
+- hw_iv_size,
+- DMA_BIDIRECTIONAL);
++ areq_ctx->gen_ctx.iv = kmemdup(req->iv, hw_iv_size, flags);
++ if (!areq_ctx->gen_ctx.iv)
++ return -ENOMEM;
++
++ areq_ctx->gen_ctx.iv_dma_addr =
++ dma_map_single(dev, areq_ctx->gen_ctx.iv, hw_iv_size,
++ DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(dev, areq_ctx->gen_ctx.iv_dma_addr)) {
+ dev_err(dev, "Mapping iv %u B at va=%pK for DMA failed\n",
+ hw_iv_size, req->iv);
++ kzfree(areq_ctx->gen_ctx.iv);
++ areq_ctx->gen_ctx.iv = NULL;
+ rc = -ENOMEM;
+ goto chain_iv_exit;
+ }
+@@ -1022,7 +978,6 @@ static int cc_aead_chain_data(struct cc_drvdata *drvdata,
+ unsigned int size_for_map = req->assoclen + req->cryptlen;
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ u32 sg_index = 0;
+- bool chained = false;
+ bool is_gcm4543 = areq_ctx->is_gcm4543;
+ u32 size_to_skip = req->assoclen;
+
+@@ -1043,7 +998,7 @@ static int cc_aead_chain_data(struct cc_drvdata *drvdata,
+ size_for_map += (direct == DRV_CRYPTO_DIRECTION_ENCRYPT) ?
+ authsize : 0;
+ src_mapped_nents = cc_get_sgl_nents(dev, req->src, size_for_map,
+- &src_last_bytes, &chained);
++ &src_last_bytes);
+ sg_index = areq_ctx->src_sgl->length;
+ //check where the data starts
+ while (sg_index <= size_to_skip) {
+@@ -1085,7 +1040,7 @@ static int cc_aead_chain_data(struct cc_drvdata *drvdata,
+ }
+
+ dst_mapped_nents = cc_get_sgl_nents(dev, req->dst, size_for_map,
+- &dst_last_bytes, &chained);
++ &dst_last_bytes);
+ sg_index = areq_ctx->dst_sgl->length;
+ offset = size_to_skip;
+
+@@ -1486,7 +1441,7 @@ int cc_map_hash_request_update(struct cc_drvdata *drvdata, void *ctx,
+ dev_dbg(dev, " less than one block: curr_buff=%pK *curr_buff_cnt=0x%X copy_to=%pK\n",
+ curr_buff, *curr_buff_cnt, &curr_buff[*curr_buff_cnt]);
+ areq_ctx->in_nents =
+- cc_get_sgl_nents(dev, src, nbytes, &dummy, NULL);
++ cc_get_sgl_nents(dev, src, nbytes, &dummy);
+ sg_copy_to_buffer(src, areq_ctx->in_nents,
+ &curr_buff[*curr_buff_cnt], nbytes);
+ *curr_buff_cnt += nbytes;
+diff --git a/drivers/crypto/ccree/cc_driver.h b/drivers/crypto/ccree/cc_driver.h
+index d608a4faf662..be7f9bd5c559 100644
+--- a/drivers/crypto/ccree/cc_driver.h
++++ b/drivers/crypto/ccree/cc_driver.h
+@@ -162,6 +162,7 @@ struct cc_alg_template {
+
+ struct async_gen_req_ctx {
+ dma_addr_t iv_dma_addr;
++ u8 *iv;
+ enum drv_crypto_direction op_type;
+ };
+
+diff --git a/drivers/crypto/ccree/cc_fips.c b/drivers/crypto/ccree/cc_fips.c
+index b4d0a6d983e0..09f708f6418e 100644
+--- a/drivers/crypto/ccree/cc_fips.c
++++ b/drivers/crypto/ccree/cc_fips.c
+@@ -72,20 +72,28 @@ static inline void tee_fips_error(struct device *dev)
+ dev_err(dev, "TEE reported error!\n");
+ }
+
++/*
++ * This function check if cryptocell tee fips error occurred
++ * and in such case triggers system error
++ */
++void cc_tee_handle_fips_error(struct cc_drvdata *p_drvdata)
++{
++ struct device *dev = drvdata_to_dev(p_drvdata);
++
++ if (!cc_get_tee_fips_status(p_drvdata))
++ tee_fips_error(dev);
++}
++
+ /* Deferred service handler, run as interrupt-fired tasklet */
+ static void fips_dsr(unsigned long devarg)
+ {
+ struct cc_drvdata *drvdata = (struct cc_drvdata *)devarg;
+- struct device *dev = drvdata_to_dev(drvdata);
+- u32 irq, state, val;
++ u32 irq, val;
+
+ irq = (drvdata->irq & (CC_GPR0_IRQ_MASK));
+
+ if (irq) {
+- state = cc_ioread(drvdata, CC_REG(GPR_HOST));
+-
+- if (state != (CC_FIPS_SYNC_TEE_STATUS | CC_FIPS_SYNC_MODULE_OK))
+- tee_fips_error(dev);
++ cc_tee_handle_fips_error(drvdata);
+ }
+
+ /* after verifing that there is nothing to do,
+@@ -113,8 +121,7 @@ int cc_fips_init(struct cc_drvdata *p_drvdata)
+ dev_dbg(dev, "Initializing fips tasklet\n");
+ tasklet_init(&fips_h->tasklet, fips_dsr, (unsigned long)p_drvdata);
+
+- if (!cc_get_tee_fips_status(p_drvdata))
+- tee_fips_error(dev);
++ cc_tee_handle_fips_error(p_drvdata);
+
+ return 0;
+ }
+diff --git a/drivers/crypto/ccree/cc_fips.h b/drivers/crypto/ccree/cc_fips.h
+index 645e096a7a82..67d5fbfa09b5 100644
+--- a/drivers/crypto/ccree/cc_fips.h
++++ b/drivers/crypto/ccree/cc_fips.h
+@@ -18,6 +18,7 @@ int cc_fips_init(struct cc_drvdata *p_drvdata);
+ void cc_fips_fini(struct cc_drvdata *drvdata);
+ void fips_handler(struct cc_drvdata *drvdata);
+ void cc_set_ree_fips_status(struct cc_drvdata *drvdata, bool ok);
++void cc_tee_handle_fips_error(struct cc_drvdata *p_drvdata);
+
+ #else /* CONFIG_CRYPTO_FIPS */
+
+@@ -30,6 +31,7 @@ static inline void cc_fips_fini(struct cc_drvdata *drvdata) {}
+ static inline void cc_set_ree_fips_status(struct cc_drvdata *drvdata,
+ bool ok) {}
+ static inline void fips_handler(struct cc_drvdata *drvdata) {}
++static inline void cc_tee_handle_fips_error(struct cc_drvdata *p_drvdata) {}
+
+ #endif /* CONFIG_CRYPTO_FIPS */
+
+diff --git a/drivers/crypto/ccree/cc_hash.c b/drivers/crypto/ccree/cc_hash.c
+index b9313306c36f..2cadd7a21844 100644
+--- a/drivers/crypto/ccree/cc_hash.c
++++ b/drivers/crypto/ccree/cc_hash.c
+@@ -64,6 +64,7 @@ struct cc_hash_alg {
+ struct hash_key_req_ctx {
+ u32 keylen;
+ dma_addr_t key_dma_addr;
++ u8 *key;
+ };
+
+ /* hash per-session context */
+@@ -724,13 +725,20 @@ static int cc_hash_setkey(struct crypto_ahash *ahash, const u8 *key,
+ ctx->key_params.keylen = keylen;
+ ctx->key_params.key_dma_addr = 0;
+ ctx->is_hmac = true;
++ ctx->key_params.key = NULL;
+
+ if (keylen) {
++ ctx->key_params.key = kmemdup(key, keylen, GFP_KERNEL);
++ if (!ctx->key_params.key)
++ return -ENOMEM;
++
+ ctx->key_params.key_dma_addr =
+- dma_map_single(dev, (void *)key, keylen, DMA_TO_DEVICE);
++ dma_map_single(dev, (void *)ctx->key_params.key, keylen,
++ DMA_TO_DEVICE);
+ if (dma_mapping_error(dev, ctx->key_params.key_dma_addr)) {
+ dev_err(dev, "Mapping key va=0x%p len=%u for DMA failed\n",
+- key, keylen);
++ ctx->key_params.key, keylen);
++ kzfree(ctx->key_params.key);
+ return -ENOMEM;
+ }
+ dev_dbg(dev, "mapping key-buffer: key_dma_addr=%pad keylen=%u\n",
+@@ -881,6 +889,9 @@ out:
+ dev_dbg(dev, "Unmapped key-buffer: key_dma_addr=%pad keylen=%u\n",
+ &ctx->key_params.key_dma_addr, ctx->key_params.keylen);
+ }
++
++ kzfree(ctx->key_params.key);
++
+ return rc;
+ }
+
+@@ -907,11 +918,16 @@ static int cc_xcbc_setkey(struct crypto_ahash *ahash,
+
+ ctx->key_params.keylen = keylen;
+
++ ctx->key_params.key = kmemdup(key, keylen, GFP_KERNEL);
++ if (!ctx->key_params.key)
++ return -ENOMEM;
++
+ ctx->key_params.key_dma_addr =
+- dma_map_single(dev, (void *)key, keylen, DMA_TO_DEVICE);
++ dma_map_single(dev, ctx->key_params.key, keylen, DMA_TO_DEVICE);
+ if (dma_mapping_error(dev, ctx->key_params.key_dma_addr)) {
+ dev_err(dev, "Mapping key va=0x%p len=%u for DMA failed\n",
+ key, keylen);
++ kzfree(ctx->key_params.key);
+ return -ENOMEM;
+ }
+ dev_dbg(dev, "mapping key-buffer: key_dma_addr=%pad keylen=%u\n",
+@@ -963,6 +979,8 @@ static int cc_xcbc_setkey(struct crypto_ahash *ahash,
+ dev_dbg(dev, "Unmapped key-buffer: key_dma_addr=%pad keylen=%u\n",
+ &ctx->key_params.key_dma_addr, ctx->key_params.keylen);
+
++ kzfree(ctx->key_params.key);
++
+ return rc;
+ }
+
+@@ -1598,7 +1616,7 @@ static struct cc_hash_template driver_hash[] = {
+ .setkey = cc_hash_setkey,
+ .halg = {
+ .digestsize = SHA224_DIGEST_SIZE,
+- .statesize = CC_STATE_SIZE(SHA224_DIGEST_SIZE),
++ .statesize = CC_STATE_SIZE(SHA256_DIGEST_SIZE),
+ },
+ },
+ .hash_mode = DRV_HASH_SHA224,
+@@ -1623,7 +1641,7 @@ static struct cc_hash_template driver_hash[] = {
+ .setkey = cc_hash_setkey,
+ .halg = {
+ .digestsize = SHA384_DIGEST_SIZE,
+- .statesize = CC_STATE_SIZE(SHA384_DIGEST_SIZE),
++ .statesize = CC_STATE_SIZE(SHA512_DIGEST_SIZE),
+ },
+ },
+ .hash_mode = DRV_HASH_SHA384,
+diff --git a/drivers/crypto/ccree/cc_ivgen.c b/drivers/crypto/ccree/cc_ivgen.c
+index 769458323394..1abec3896a78 100644
+--- a/drivers/crypto/ccree/cc_ivgen.c
++++ b/drivers/crypto/ccree/cc_ivgen.c
+@@ -154,9 +154,6 @@ void cc_ivgen_fini(struct cc_drvdata *drvdata)
+ }
+
+ ivgen_ctx->pool = NULL_SRAM_ADDR;
+-
+- /* release "this" context */
+- kfree(ivgen_ctx);
+ }
+
+ /*!
+@@ -174,10 +171,12 @@ int cc_ivgen_init(struct cc_drvdata *drvdata)
+ int rc;
+
+ /* Allocate "this" context */
+- ivgen_ctx = kzalloc(sizeof(*ivgen_ctx), GFP_KERNEL);
++ ivgen_ctx = devm_kzalloc(device, sizeof(*ivgen_ctx), GFP_KERNEL);
+ if (!ivgen_ctx)
+ return -ENOMEM;
+
++ drvdata->ivgen_handle = ivgen_ctx;
++
+ /* Allocate pool's header for initial enc. key/IV */
+ ivgen_ctx->pool_meta = dma_alloc_coherent(device, CC_IVPOOL_META_SIZE,
+ &ivgen_ctx->pool_meta_dma,
+@@ -196,8 +195,6 @@ int cc_ivgen_init(struct cc_drvdata *drvdata)
+ goto out;
+ }
+
+- drvdata->ivgen_handle = ivgen_ctx;
+-
+ return cc_init_iv_sram(drvdata);
+
+ out:
+diff --git a/drivers/crypto/ccree/cc_pm.c b/drivers/crypto/ccree/cc_pm.c
+index d990f472e89f..79fc0a37ba6e 100644
+--- a/drivers/crypto/ccree/cc_pm.c
++++ b/drivers/crypto/ccree/cc_pm.c
+@@ -11,6 +11,7 @@
+ #include "cc_ivgen.h"
+ #include "cc_hash.h"
+ #include "cc_pm.h"
++#include "cc_fips.h"
+
+ #define POWER_DOWN_ENABLE 0x01
+ #define POWER_DOWN_DISABLE 0x00
+@@ -25,13 +26,13 @@ int cc_pm_suspend(struct device *dev)
+ int rc;
+
+ dev_dbg(dev, "set HOST_POWER_DOWN_EN\n");
+- cc_iowrite(drvdata, CC_REG(HOST_POWER_DOWN_EN), POWER_DOWN_ENABLE);
+ rc = cc_suspend_req_queue(drvdata);
+ if (rc) {
+ dev_err(dev, "cc_suspend_req_queue (%x)\n", rc);
+ return rc;
+ }
+ fini_cc_regs(drvdata);
++ cc_iowrite(drvdata, CC_REG(HOST_POWER_DOWN_EN), POWER_DOWN_ENABLE);
+ cc_clk_off(drvdata);
+ return 0;
+ }
+@@ -42,19 +43,21 @@ int cc_pm_resume(struct device *dev)
+ struct cc_drvdata *drvdata = dev_get_drvdata(dev);
+
+ dev_dbg(dev, "unset HOST_POWER_DOWN_EN\n");
+- cc_iowrite(drvdata, CC_REG(HOST_POWER_DOWN_EN), POWER_DOWN_DISABLE);
+-
++ /* Enables the device source clk */
+ rc = cc_clk_on(drvdata);
+ if (rc) {
+ dev_err(dev, "failed getting clock back on. We're toast.\n");
+ return rc;
+ }
+
++ cc_iowrite(drvdata, CC_REG(HOST_POWER_DOWN_EN), POWER_DOWN_DISABLE);
+ rc = init_cc_regs(drvdata, false);
+ if (rc) {
+ dev_err(dev, "init_cc_regs (%x)\n", rc);
+ return rc;
+ }
++ /* check if tee fips error occurred during power down */
++ cc_tee_handle_fips_error(drvdata);
+
+ rc = cc_resume_req_queue(drvdata);
+ if (rc) {
+diff --git a/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c b/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c
+index 23305f22072f..204e4ad62c38 100644
+--- a/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c
++++ b/drivers/crypto/rockchip/rk3288_crypto_ablkcipher.c
+@@ -250,9 +250,14 @@ static int rk_set_data_start(struct rk_crypto_info *dev)
+ u8 *src_last_blk = page_address(sg_page(dev->sg_src)) +
+ dev->sg_src->offset + dev->sg_src->length - ivsize;
+
+- /* store the iv that need to be updated in chain mode */
+- if (ctx->mode & RK_CRYPTO_DEC)
++ /* Store the iv that need to be updated in chain mode.
++ * And update the IV buffer to contain the next IV for decryption mode.
++ */
++ if (ctx->mode & RK_CRYPTO_DEC) {
+ memcpy(ctx->iv, src_last_blk, ivsize);
++ sg_pcopy_to_buffer(dev->first, dev->src_nents, req->info,
++ ivsize, dev->total - ivsize);
++ }
+
+ err = dev->load_data(dev, dev->sg_src, dev->sg_dst);
+ if (!err)
+@@ -288,13 +293,19 @@ static void rk_iv_copyback(struct rk_crypto_info *dev)
+ struct ablkcipher_request *req =
+ ablkcipher_request_cast(dev->async_req);
+ struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(req);
++ struct rk_cipher_ctx *ctx = crypto_ablkcipher_ctx(tfm);
+ u32 ivsize = crypto_ablkcipher_ivsize(tfm);
+
+- if (ivsize == DES_BLOCK_SIZE)
+- memcpy_fromio(req->info, dev->reg + RK_CRYPTO_TDES_IV_0,
+- ivsize);
+- else if (ivsize == AES_BLOCK_SIZE)
+- memcpy_fromio(req->info, dev->reg + RK_CRYPTO_AES_IV_0, ivsize);
++ /* Update the IV buffer to contain the next IV for encryption mode. */
++ if (!(ctx->mode & RK_CRYPTO_DEC)) {
++ if (dev->aligned) {
++ memcpy(req->info, sg_virt(dev->sg_dst) +
++ dev->sg_dst->length - ivsize, ivsize);
++ } else {
++ memcpy(req->info, dev->addr_vir +
++ dev->count - ivsize, ivsize);
++ }
++ }
+ }
+
+ static void rk_update_iv(struct rk_crypto_info *dev)
+diff --git a/drivers/crypto/vmx/aesp8-ppc.pl b/drivers/crypto/vmx/aesp8-ppc.pl
+index d6a9f63d65ba..de78282b8f44 100644
+--- a/drivers/crypto/vmx/aesp8-ppc.pl
++++ b/drivers/crypto/vmx/aesp8-ppc.pl
+@@ -1854,7 +1854,7 @@ Lctr32_enc8x_three:
+ stvx_u $out1,$x10,$out
+ stvx_u $out2,$x20,$out
+ addi $out,$out,0x30
+- b Lcbc_dec8x_done
++ b Lctr32_enc8x_done
+
+ .align 5
+ Lctr32_enc8x_two:
+@@ -1866,7 +1866,7 @@ Lctr32_enc8x_two:
+ stvx_u $out0,$x00,$out
+ stvx_u $out1,$x10,$out
+ addi $out,$out,0x20
+- b Lcbc_dec8x_done
++ b Lctr32_enc8x_done
+
+ .align 5
+ Lctr32_enc8x_one:
+diff --git a/drivers/dax/device.c b/drivers/dax/device.c
+index 948806e57cee..a89ebd94c670 100644
+--- a/drivers/dax/device.c
++++ b/drivers/dax/device.c
+@@ -325,8 +325,7 @@ static vm_fault_t __dev_dax_pmd_fault(struct dev_dax *dev_dax,
+
+ *pfn = phys_to_pfn_t(phys, dax_region->pfn_flags);
+
+- return vmf_insert_pfn_pmd(vmf->vma, vmf->address, vmf->pmd, *pfn,
+- vmf->flags & FAULT_FLAG_WRITE);
++ return vmf_insert_pfn_pmd(vmf, *pfn, vmf->flags & FAULT_FLAG_WRITE);
+ }
+
+ #ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
+@@ -376,8 +375,7 @@ static vm_fault_t __dev_dax_pud_fault(struct dev_dax *dev_dax,
+
+ *pfn = phys_to_pfn_t(phys, dax_region->pfn_flags);
+
+- return vmf_insert_pfn_pud(vmf->vma, vmf->address, vmf->pud, *pfn,
+- vmf->flags & FAULT_FLAG_WRITE);
++ return vmf_insert_pfn_pud(vmf, *pfn, vmf->flags & FAULT_FLAG_WRITE);
+ }
+ #else
+ static vm_fault_t __dev_dax_pud_fault(struct dev_dax *dev_dax,
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 522c7426f3a0..772258ee1f51 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -540,11 +540,11 @@ static void journal_reclaim(struct cache_set *c)
+ ca->sb.nr_this_dev);
+ }
+
+- bkey_init(k);
+- SET_KEY_PTRS(k, n);
+-
+- if (n)
++ if (n) {
++ bkey_init(k);
++ SET_KEY_PTRS(k, n);
+ c->journal.blocks_free = c->sb.bucket_size >> c->block_bits;
++ }
+ out:
+ if (!journal_full(&c->journal))
+ __closure_wake_up(&c->journal.wait);
+@@ -671,6 +671,9 @@ static void journal_write_unlocked(struct closure *cl)
+ ca->journal.seq[ca->journal.cur_idx] = w->data->seq;
+ }
+
++ /* If KEY_PTRS(k) == 0, this jset gets lost in air */
++ BUG_ON(i == 0);
++
+ atomic_dec_bug(&fifo_back(&c->journal.pin));
+ bch_journal_next(&c->journal);
+ journal_reclaim(c);
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 03bb5cee2b83..2c0d35c882ed 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1511,6 +1511,7 @@ static void cache_set_free(struct closure *cl)
+ bch_btree_cache_free(c);
+ bch_journal_free(c);
+
++ mutex_lock(&bch_register_lock);
+ for_each_cache(ca, c, i)
+ if (ca) {
+ ca->set = NULL;
+@@ -1529,7 +1530,6 @@ static void cache_set_free(struct closure *cl)
+ mempool_exit(&c->search);
+ kfree(c->devices);
+
+- mutex_lock(&bch_register_lock);
+ list_del(&c->list);
+ mutex_unlock(&bch_register_lock);
+
+diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
+index 6edffeed9953..18aae28845ec 100644
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -494,6 +494,7 @@ void mmc_cleanup_queue(struct mmc_queue *mq)
+ blk_mq_unquiesce_queue(q);
+
+ blk_cleanup_queue(q);
++ blk_mq_free_tag_set(&mq->tag_set);
+
+ /*
+ * A request can be completed before the next request, potentially
+diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
+index a40bcc27f187..7fdac277e382 100644
+--- a/drivers/mmc/host/sdhci-of-arasan.c
++++ b/drivers/mmc/host/sdhci-of-arasan.c
+@@ -814,7 +814,10 @@ static int sdhci_arasan_probe(struct platform_device *pdev)
+ host->mmc_host_ops.start_signal_voltage_switch =
+ sdhci_arasan_voltage_switch;
+ sdhci_arasan->has_cqe = true;
+- host->mmc->caps2 |= MMC_CAP2_CQE | MMC_CAP2_CQE_DCMD;
++ host->mmc->caps2 |= MMC_CAP2_CQE;
++
++ if (!of_property_read_bool(np, "disable-cqe-dcmd"))
++ host->mmc->caps2 |= MMC_CAP2_CQE_DCMD;
+ }
+
+ ret = sdhci_arasan_add_host(sdhci_arasan);
+diff --git a/drivers/mtd/spi-nor/intel-spi.c b/drivers/mtd/spi-nor/intel-spi.c
+index af0a22019516..d60cbf23d9aa 100644
+--- a/drivers/mtd/spi-nor/intel-spi.c
++++ b/drivers/mtd/spi-nor/intel-spi.c
+@@ -632,6 +632,10 @@ static ssize_t intel_spi_read(struct spi_nor *nor, loff_t from, size_t len,
+ while (len > 0) {
+ block_size = min_t(size_t, len, INTEL_SPI_FIFO_SZ);
+
++ /* Read cannot cross 4K boundary */
++ block_size = min_t(loff_t, from + block_size,
++ round_up(from + 1, SZ_4K)) - from;
++
+ writel(from, ispi->base + FADDR);
+
+ val = readl(ispi->base + HSFSTS_CTL);
+@@ -685,6 +689,10 @@ static ssize_t intel_spi_write(struct spi_nor *nor, loff_t to, size_t len,
+ while (len > 0) {
+ block_size = min_t(size_t, len, INTEL_SPI_FIFO_SZ);
+
++ /* Write cannot cross 4K boundary */
++ block_size = min_t(loff_t, to + block_size,
++ round_up(to + 1, SZ_4K)) - to;
++
+ writel(to, ispi->base + FADDR);
+
+ val = readl(ispi->base + HSFSTS_CTL);
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index 1eeb7be6aa34..452ad379ed70 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -623,6 +623,17 @@ static const guid_t *to_abstraction_guid(enum nvdimm_claim_class claim_class,
+ return &guid_null;
+ }
+
++static void reap_victim(struct nd_mapping *nd_mapping,
++ struct nd_label_ent *victim)
++{
++ struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
++ u32 slot = to_slot(ndd, victim->label);
++
++ dev_dbg(ndd->dev, "free: %d\n", slot);
++ nd_label_free_slot(ndd, slot);
++ victim->label = NULL;
++}
++
+ static int __pmem_label_update(struct nd_region *nd_region,
+ struct nd_mapping *nd_mapping, struct nd_namespace_pmem *nspm,
+ int pos, unsigned long flags)
+@@ -630,9 +641,9 @@ static int __pmem_label_update(struct nd_region *nd_region,
+ struct nd_namespace_common *ndns = &nspm->nsio.common;
+ struct nd_interleave_set *nd_set = nd_region->nd_set;
+ struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
+- struct nd_label_ent *label_ent, *victim = NULL;
+ struct nd_namespace_label *nd_label;
+ struct nd_namespace_index *nsindex;
++ struct nd_label_ent *label_ent;
+ struct nd_label_id label_id;
+ struct resource *res;
+ unsigned long *free;
+@@ -701,18 +712,10 @@ static int __pmem_label_update(struct nd_region *nd_region,
+ list_for_each_entry(label_ent, &nd_mapping->labels, list) {
+ if (!label_ent->label)
+ continue;
+- if (memcmp(nspm->uuid, label_ent->label->uuid,
+- NSLABEL_UUID_LEN) != 0)
+- continue;
+- victim = label_ent;
+- list_move_tail(&victim->list, &nd_mapping->labels);
+- break;
+- }
+- if (victim) {
+- dev_dbg(ndd->dev, "free: %d\n", slot);
+- slot = to_slot(ndd, victim->label);
+- nd_label_free_slot(ndd, slot);
+- victim->label = NULL;
++ if (test_and_clear_bit(ND_LABEL_REAP, &label_ent->flags)
++ || memcmp(nspm->uuid, label_ent->label->uuid,
++ NSLABEL_UUID_LEN) == 0)
++ reap_victim(nd_mapping, label_ent);
+ }
+
+ /* update index */
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index 73a444c41cde..5dc3b407d7bd 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -1248,12 +1248,27 @@ static int namespace_update_uuid(struct nd_region *nd_region,
+ for (i = 0; i < nd_region->ndr_mappings; i++) {
+ struct nd_mapping *nd_mapping = &nd_region->mapping[i];
+ struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
++ struct nd_label_ent *label_ent;
+ struct resource *res;
+
+ for_each_dpa_resource(ndd, res)
+ if (strcmp(res->name, old_label_id.id) == 0)
+ sprintf((void *) res->name, "%s",
+ new_label_id.id);
++
++ mutex_lock(&nd_mapping->lock);
++ list_for_each_entry(label_ent, &nd_mapping->labels, list) {
++ struct nd_namespace_label *nd_label = label_ent->label;
++ struct nd_label_id label_id;
++
++ if (!nd_label)
++ continue;
++ nd_label_gen_id(&label_id, nd_label->uuid,
++ __le32_to_cpu(nd_label->flags));
++ if (strcmp(old_label_id.id, label_id.id) == 0)
++ set_bit(ND_LABEL_REAP, &label_ent->flags);
++ }
++ mutex_unlock(&nd_mapping->lock);
+ }
+ kfree(*old_uuid);
+ out:
+diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
+index 98317e7ce5b5..01e194a5824e 100644
+--- a/drivers/nvdimm/nd.h
++++ b/drivers/nvdimm/nd.h
+@@ -113,8 +113,12 @@ struct nd_percpu_lane {
+ spinlock_t lock;
+ };
+
++enum nd_label_flags {
++ ND_LABEL_REAP,
++};
+ struct nd_label_ent {
+ struct list_head list;
++ unsigned long flags;
+ struct nd_namespace_label *label;
+ };
+
+diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
+index 735658ee1c60..c60659fb21de 100644
+--- a/drivers/power/supply/axp288_charger.c
++++ b/drivers/power/supply/axp288_charger.c
+@@ -832,6 +832,10 @@ static int axp288_charger_probe(struct platform_device *pdev)
+ /* Register charger interrupts */
+ for (i = 0; i < CHRG_INTR_END; i++) {
+ pirq = platform_get_irq(info->pdev, i);
++ if (pirq < 0) {
++ dev_err(&pdev->dev, "Failed to get IRQ: %d\n", pirq);
++ return pirq;
++ }
+ info->irq[i] = regmap_irq_get_virq(info->regmap_irqc, pirq);
+ if (info->irq[i] < 0) {
+ dev_warn(&info->pdev->dev,
+diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c
+index 084c8ba9749d..ab0b6e78ca02 100644
+--- a/drivers/power/supply/axp288_fuel_gauge.c
++++ b/drivers/power/supply/axp288_fuel_gauge.c
+@@ -695,6 +695,26 @@ intr_failed:
+ * detection reports one despite it not being there.
+ */
+ static const struct dmi_system_id axp288_fuel_gauge_blacklist[] = {
++ {
++ /* ACEPC T8 Cherry Trail Z8350 mini PC */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T8"),
++ /* also match on somewhat unique bios-version */
++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++ },
++ },
++ {
++ /* ACEPC T11 Cherry Trail Z8350 mini PC */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T11"),
++ /* also match on somewhat unique bios-version */
++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++ },
++ },
+ {
+ /* Intel Cherry Trail Compute Stick, Windows version */
+ .matches = {
+diff --git a/drivers/tty/hvc/hvc_riscv_sbi.c b/drivers/tty/hvc/hvc_riscv_sbi.c
+index 75155bde2b88..31f53fa77e4a 100644
+--- a/drivers/tty/hvc/hvc_riscv_sbi.c
++++ b/drivers/tty/hvc/hvc_riscv_sbi.c
+@@ -53,7 +53,6 @@ device_initcall(hvc_sbi_init);
+ static int __init hvc_sbi_console_init(void)
+ {
+ hvc_instantiate(0, 0, &hvc_sbi_ops);
+- add_preferred_console("hvc", 0, NULL);
+
+ return 0;
+ }
+diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
+index 88312c6c92cc..0617e87ab343 100644
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -123,6 +123,7 @@ static const int NR_TYPES = ARRAY_SIZE(max_vals);
+ static struct input_handler kbd_handler;
+ static DEFINE_SPINLOCK(kbd_event_lock);
+ static DEFINE_SPINLOCK(led_lock);
++static DEFINE_SPINLOCK(func_buf_lock); /* guard 'func_buf' and friends */
+ static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)]; /* keyboard key bitmap */
+ static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */
+ static bool dead_key_next;
+@@ -1990,11 +1991,12 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+ char *p;
+ u_char *q;
+ u_char __user *up;
+- int sz;
++ int sz, fnw_sz;
+ int delta;
+ char *first_free, *fj, *fnw;
+ int i, j, k;
+ int ret;
++ unsigned long flags;
+
+ if (!capable(CAP_SYS_TTY_CONFIG))
+ perm = 0;
+@@ -2037,7 +2039,14 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+ goto reterr;
+ }
+
++ fnw = NULL;
++ fnw_sz = 0;
++ /* race aginst other writers */
++ again:
++ spin_lock_irqsave(&func_buf_lock, flags);
+ q = func_table[i];
++
++ /* fj pointer to next entry after 'q' */
+ first_free = funcbufptr + (funcbufsize - funcbufleft);
+ for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++)
+ ;
+@@ -2045,10 +2054,12 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+ fj = func_table[j];
+ else
+ fj = first_free;
+-
++ /* buffer usage increase by new entry */
+ delta = (q ? -strlen(q) : 1) + strlen(kbs->kb_string);
++
+ if (delta <= funcbufleft) { /* it fits in current buf */
+ if (j < MAX_NR_FUNC) {
++ /* make enough space for new entry at 'fj' */
+ memmove(fj + delta, fj, first_free - fj);
+ for (k = j; k < MAX_NR_FUNC; k++)
+ if (func_table[k])
+@@ -2061,20 +2072,28 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+ sz = 256;
+ while (sz < funcbufsize - funcbufleft + delta)
+ sz <<= 1;
+- fnw = kmalloc(sz, GFP_KERNEL);
+- if(!fnw) {
+- ret = -ENOMEM;
+- goto reterr;
++ if (fnw_sz != sz) {
++ spin_unlock_irqrestore(&func_buf_lock, flags);
++ kfree(fnw);
++ fnw = kmalloc(sz, GFP_KERNEL);
++ fnw_sz = sz;
++ if (!fnw) {
++ ret = -ENOMEM;
++ goto reterr;
++ }
++ goto again;
+ }
+
+ if (!q)
+ func_table[i] = fj;
++ /* copy data before insertion point to new location */
+ if (fj > funcbufptr)
+ memmove(fnw, funcbufptr, fj - funcbufptr);
+ for (k = 0; k < j; k++)
+ if (func_table[k])
+ func_table[k] = fnw + (func_table[k] - funcbufptr);
+
++ /* copy data after insertion point to new location */
+ if (first_free > fj) {
+ memmove(fnw + (fj - funcbufptr) + delta, fj, first_free - fj);
+ for (k = j; k < MAX_NR_FUNC; k++)
+@@ -2087,7 +2106,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+ funcbufleft = funcbufleft - delta + sz - funcbufsize;
+ funcbufsize = sz;
+ }
++ /* finally insert item itself */
+ strcpy(func_table[i], kbs->kb_string);
++ spin_unlock_irqrestore(&func_buf_lock, flags);
+ break;
+ }
+ ret = 0;
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 3e5ec1cee059..f93b948acfa5 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -4155,8 +4155,6 @@ void do_blank_screen(int entering_gfx)
+ return;
+ }
+
+- if (blank_state != blank_normal_wait)
+- return;
+ blank_state = blank_off;
+
+ /* don't blank graphics */
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index ae750b1574a2..2a4f52c7be22 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -1452,8 +1452,8 @@ int btrfs_find_all_roots(struct btrfs_trans_handle *trans,
+ * callers (such as fiemap) which want to know whether the extent is
+ * shared but do not need a ref count.
+ *
+- * This attempts to allocate a transaction in order to account for
+- * delayed refs, but continues on even when the alloc fails.
++ * This attempts to attach to the running transaction in order to account for
++ * delayed refs, but continues on even when no running transaction exists.
+ *
+ * Return: 0 if extent is not shared, 1 if it is shared, < 0 on error.
+ */
+@@ -1476,13 +1476,16 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr)
+ tmp = ulist_alloc(GFP_NOFS);
+ roots = ulist_alloc(GFP_NOFS);
+ if (!tmp || !roots) {
+- ulist_free(tmp);
+- ulist_free(roots);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto out;
+ }
+
+- trans = btrfs_join_transaction(root);
++ trans = btrfs_attach_transaction(root);
+ if (IS_ERR(trans)) {
++ if (PTR_ERR(trans) != -ENOENT && PTR_ERR(trans) != -EROFS) {
++ ret = PTR_ERR(trans);
++ goto out;
++ }
+ trans = NULL;
+ down_read(&fs_info->commit_root_sem);
+ } else {
+@@ -1515,6 +1518,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr)
+ } else {
+ up_read(&fs_info->commit_root_sem);
+ }
++out:
+ ulist_free(tmp);
+ ulist_free(roots);
+ return ret;
+@@ -1904,13 +1908,19 @@ int iterate_extent_inodes(struct btrfs_fs_info *fs_info,
+ extent_item_objectid);
+
+ if (!search_commit_root) {
+- trans = btrfs_join_transaction(fs_info->extent_root);
+- if (IS_ERR(trans))
+- return PTR_ERR(trans);
++ trans = btrfs_attach_transaction(fs_info->extent_root);
++ if (IS_ERR(trans)) {
++ if (PTR_ERR(trans) != -ENOENT &&
++ PTR_ERR(trans) != -EROFS)
++ return PTR_ERR(trans);
++ trans = NULL;
++ }
++ }
++
++ if (trans)
+ btrfs_get_tree_mod_seq(fs_info, &tree_mod_seq_elem);
+- } else {
++ else
+ down_read(&fs_info->commit_root_sem);
+- }
+
+ ret = btrfs_find_all_leafs(trans, fs_info, extent_item_objectid,
+ tree_mod_seq_elem.seq, &refs,
+@@ -1943,7 +1953,7 @@ int iterate_extent_inodes(struct btrfs_fs_info *fs_info,
+
+ free_leaf_list(refs);
+ out:
+- if (!search_commit_root) {
++ if (trans) {
+ btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem);
+ btrfs_end_transaction(trans);
+ } else {
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 48ac8b7c43a5..79ac1ebabaf7 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -2436,6 +2436,16 @@ read_block_for_search(struct btrfs_root *root, struct btrfs_path *p,
+ if (tmp) {
+ /* first we do an atomic uptodate check */
+ if (btrfs_buffer_uptodate(tmp, gen, 1) > 0) {
++ /*
++ * Do extra check for first_key, eb can be stale due to
++ * being cached, read from scrub, or have multiple
++ * parents (shared tree blocks).
++ */
++ if (btrfs_verify_level_key(fs_info, tmp,
++ parent_level - 1, &first_key, gen)) {
++ free_extent_buffer(tmp);
++ return -EUCLEAN;
++ }
+ *eb_ret = tmp;
+ return 0;
+ }
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index b4f61a3d560a..b2dc613ebed2 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -408,9 +408,9 @@ static int btrfs_check_super_csum(struct btrfs_fs_info *fs_info,
+ return ret;
+ }
+
+-static int verify_level_key(struct btrfs_fs_info *fs_info,
+- struct extent_buffer *eb, int level,
+- struct btrfs_key *first_key, u64 parent_transid)
++int btrfs_verify_level_key(struct btrfs_fs_info *fs_info,
++ struct extent_buffer *eb, int level,
++ struct btrfs_key *first_key, u64 parent_transid)
+ {
+ int found_level;
+ struct btrfs_key found_key;
+@@ -487,8 +487,8 @@ static int btree_read_extent_buffer_pages(struct btrfs_fs_info *fs_info,
+ if (verify_parent_transid(io_tree, eb,
+ parent_transid, 0))
+ ret = -EIO;
+- else if (verify_level_key(fs_info, eb, level,
+- first_key, parent_transid))
++ else if (btrfs_verify_level_key(fs_info, eb, level,
++ first_key, parent_transid))
+ ret = -EUCLEAN;
+ else
+ break;
+@@ -995,13 +995,18 @@ void readahead_tree_block(struct btrfs_fs_info *fs_info, u64 bytenr)
+ {
+ struct extent_buffer *buf = NULL;
+ struct inode *btree_inode = fs_info->btree_inode;
++ int ret;
+
+ buf = btrfs_find_create_tree_block(fs_info, bytenr);
+ if (IS_ERR(buf))
+ return;
+- read_extent_buffer_pages(&BTRFS_I(btree_inode)->io_tree,
+- buf, WAIT_NONE, 0);
+- free_extent_buffer(buf);
++
++ ret = read_extent_buffer_pages(&BTRFS_I(btree_inode)->io_tree, buf,
++ WAIT_NONE, 0);
++ if (ret < 0)
++ free_extent_buffer_stale(buf);
++ else
++ free_extent_buffer(buf);
+ }
+
+ int reada_tree_block_flagged(struct btrfs_fs_info *fs_info, u64 bytenr,
+@@ -1021,12 +1026,12 @@ int reada_tree_block_flagged(struct btrfs_fs_info *fs_info, u64 bytenr,
+ ret = read_extent_buffer_pages(io_tree, buf, WAIT_PAGE_LOCK,
+ mirror_num);
+ if (ret) {
+- free_extent_buffer(buf);
++ free_extent_buffer_stale(buf);
+ return ret;
+ }
+
+ if (test_bit(EXTENT_BUFFER_CORRUPT, &buf->bflags)) {
+- free_extent_buffer(buf);
++ free_extent_buffer_stale(buf);
+ return -EIO;
+ } else if (extent_buffer_uptodate(buf)) {
+ *eb = buf;
+@@ -1080,7 +1085,7 @@ struct extent_buffer *read_tree_block(struct btrfs_fs_info *fs_info, u64 bytenr,
+ ret = btree_read_extent_buffer_pages(fs_info, buf, parent_transid,
+ level, first_key);
+ if (ret) {
+- free_extent_buffer(buf);
++ free_extent_buffer_stale(buf);
+ return ERR_PTR(ret);
+ }
+ return buf;
+diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
+index 4cccba22640f..7a4a60f26dbf 100644
+--- a/fs/btrfs/disk-io.h
++++ b/fs/btrfs/disk-io.h
+@@ -39,6 +39,9 @@ static inline u64 btrfs_sb_offset(int mirror)
+ struct btrfs_device;
+ struct btrfs_fs_devices;
+
++int btrfs_verify_level_key(struct btrfs_fs_info *fs_info,
++ struct extent_buffer *eb, int level,
++ struct btrfs_key *first_key, u64 parent_transid);
+ struct extent_buffer *read_tree_block(struct btrfs_fs_info *fs_info, u64 bytenr,
+ u64 parent_transid, int level,
+ struct btrfs_key *first_key);
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index c0db7785cede..809c2c307c64 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10789,9 +10789,9 @@ int btrfs_error_unpin_extent_range(struct btrfs_fs_info *fs_info,
+ * held back allocations.
+ */
+ static int btrfs_trim_free_extents(struct btrfs_device *device,
+- u64 minlen, u64 *trimmed)
++ struct fstrim_range *range, u64 *trimmed)
+ {
+- u64 start = 0, len = 0;
++ u64 start = range->start, len = 0;
+ int ret;
+
+ *trimmed = 0;
+@@ -10834,8 +10834,8 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ if (!trans)
+ up_read(&fs_info->commit_root_sem);
+
+- ret = find_free_dev_extent_start(trans, device, minlen, start,
+- &start, &len);
++ ret = find_free_dev_extent_start(trans, device, range->minlen,
++ start, &start, &len);
+ if (trans) {
+ up_read(&fs_info->commit_root_sem);
+ btrfs_put_transaction(trans);
+@@ -10848,6 +10848,16 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ break;
+ }
+
++ /* If we are out of the passed range break */
++ if (start > range->start + range->len - 1) {
++ mutex_unlock(&fs_info->chunk_mutex);
++ ret = 0;
++ break;
++ }
++
++ start = max(range->start, start);
++ len = min(range->len, len);
++
+ ret = btrfs_issue_discard(device->bdev, start, len, &bytes);
+ mutex_unlock(&fs_info->chunk_mutex);
+
+@@ -10857,6 +10867,10 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ start += len;
+ *trimmed += bytes;
+
++ /* We've trimmed enough */
++ if (*trimmed >= range->len)
++ break;
++
+ if (fatal_signal_pending(current)) {
+ ret = -ERESTARTSYS;
+ break;
+@@ -10940,8 +10954,7 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+ devices = &fs_info->fs_devices->devices;
+ list_for_each_entry(device, devices, dev_list) {
+- ret = btrfs_trim_free_extents(device, range->minlen,
+- &group_trimmed);
++ ret = btrfs_trim_free_extents(device, range, &group_trimmed);
+ if (ret) {
+ dev_failed++;
+ dev_ret = ret;
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 84cb6e5ef36c..635e419f2a2d 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -6583,6 +6583,38 @@ commit_trans:
+ return btrfs_commit_transaction(trans);
+ }
+
++/*
++ * Make sure any existing dellaloc is flushed for any root used by a send
++ * operation so that we do not miss any data and we do not race with writeback
++ * finishing and changing a tree while send is using the tree. This could
++ * happen if a subvolume is in RW mode, has delalloc, is turned to RO mode and
++ * a send operation then uses the subvolume.
++ * After flushing delalloc ensure_commit_roots_uptodate() must be called.
++ */
++static int flush_delalloc_roots(struct send_ctx *sctx)
++{
++ struct btrfs_root *root = sctx->parent_root;
++ int ret;
++ int i;
++
++ if (root) {
++ ret = btrfs_start_delalloc_snapshot(root);
++ if (ret)
++ return ret;
++ btrfs_wait_ordered_extents(root, U64_MAX, 0, U64_MAX);
++ }
++
++ for (i = 0; i < sctx->clone_roots_cnt; i++) {
++ root = sctx->clone_roots[i].root;
++ ret = btrfs_start_delalloc_snapshot(root);
++ if (ret)
++ return ret;
++ btrfs_wait_ordered_extents(root, U64_MAX, 0, U64_MAX);
++ }
++
++ return 0;
++}
++
+ static void btrfs_root_dec_send_in_progress(struct btrfs_root* root)
+ {
+ spin_lock(&root->root_item_lock);
+@@ -6807,6 +6839,10 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg)
+ NULL);
+ sort_clone_roots = 1;
+
++ ret = flush_delalloc_roots(sctx);
++ if (ret)
++ goto out;
++
+ ret = ensure_commit_roots_uptodate(sctx);
+ if (ret)
+ goto out;
+diff --git a/fs/dax.c b/fs/dax.c
+index 09fa70683c41..004c8ac1117c 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -1660,8 +1660,7 @@ static vm_fault_t dax_iomap_pmd_fault(struct vm_fault *vmf, pfn_t *pfnp,
+ }
+
+ trace_dax_pmd_insert_mapping(inode, vmf, PMD_SIZE, pfn, entry);
+- result = vmf_insert_pfn_pmd(vma, vmf->address, vmf->pmd, pfn,
+- write);
++ result = vmf_insert_pfn_pmd(vmf, pfn, write);
+ break;
+ case IOMAP_UNWRITTEN:
+ case IOMAP_HOLE:
+@@ -1775,8 +1774,7 @@ static vm_fault_t dax_insert_pfn_mkwrite(struct vm_fault *vmf,
+ break;
+ #ifdef CONFIG_FS_DAX_PMD
+ case PE_SIZE_PMD:
+- ret = vmf_insert_pfn_pmd(vmf->vma, vmf->address, vmf->pmd,
+- pfn, true);
++ ret = vmf_insert_pfn_pmd(vmf, pfn, FAULT_FLAG_WRITE);
+ break;
+ #endif
+ default:
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 2ddf7833350d..1ee51d3a978a 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1670,6 +1670,8 @@ static inline void ext4_clear_state_flags(struct ext4_inode_info *ei)
+ #define EXT4_FEATURE_INCOMPAT_INLINE_DATA 0x8000 /* data in inode */
+ #define EXT4_FEATURE_INCOMPAT_ENCRYPT 0x10000
+
++extern void ext4_update_dynamic_rev(struct super_block *sb);
++
+ #define EXT4_FEATURE_COMPAT_FUNCS(name, flagname) \
+ static inline bool ext4_has_feature_##name(struct super_block *sb) \
+ { \
+@@ -1678,6 +1680,7 @@ static inline bool ext4_has_feature_##name(struct super_block *sb) \
+ } \
+ static inline void ext4_set_feature_##name(struct super_block *sb) \
+ { \
++ ext4_update_dynamic_rev(sb); \
+ EXT4_SB(sb)->s_es->s_feature_compat |= \
+ cpu_to_le32(EXT4_FEATURE_COMPAT_##flagname); \
+ } \
+@@ -1695,6 +1698,7 @@ static inline bool ext4_has_feature_##name(struct super_block *sb) \
+ } \
+ static inline void ext4_set_feature_##name(struct super_block *sb) \
+ { \
++ ext4_update_dynamic_rev(sb); \
+ EXT4_SB(sb)->s_es->s_feature_ro_compat |= \
+ cpu_to_le32(EXT4_FEATURE_RO_COMPAT_##flagname); \
+ } \
+@@ -1712,6 +1716,7 @@ static inline bool ext4_has_feature_##name(struct super_block *sb) \
+ } \
+ static inline void ext4_set_feature_##name(struct super_block *sb) \
+ { \
++ ext4_update_dynamic_rev(sb); \
+ EXT4_SB(sb)->s_es->s_feature_incompat |= \
+ cpu_to_le32(EXT4_FEATURE_INCOMPAT_##flagname); \
+ } \
+@@ -2679,7 +2684,6 @@ do { \
+
+ #endif
+
+-extern void ext4_update_dynamic_rev(struct super_block *sb);
+ extern int ext4_update_compat_feature(handle_t *handle, struct super_block *sb,
+ __u32 compat);
+ extern int ext4_update_rocompat_feature(handle_t *handle,
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 72a361d5ef74..45aea792d22a 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -1035,6 +1035,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
+ __le32 border;
+ ext4_fsblk_t *ablocks = NULL; /* array of allocated blocks */
+ int err = 0;
++ size_t ext_size = 0;
+
+ /* make decision: where to split? */
+ /* FIXME: now decision is simplest: at current extent */
+@@ -1126,6 +1127,10 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
+ le16_add_cpu(&neh->eh_entries, m);
+ }
+
++ /* zero out unused area in the extent block */
++ ext_size = sizeof(struct ext4_extent_header) +
++ sizeof(struct ext4_extent) * le16_to_cpu(neh->eh_entries);
++ memset(bh->b_data + ext_size, 0, inode->i_sb->s_blocksize - ext_size);
+ ext4_extent_block_csum_set(inode, neh);
+ set_buffer_uptodate(bh);
+ unlock_buffer(bh);
+@@ -1205,6 +1210,11 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
+ sizeof(struct ext4_extent_idx) * m);
+ le16_add_cpu(&neh->eh_entries, m);
+ }
++ /* zero out unused area in the extent block */
++ ext_size = sizeof(struct ext4_extent_header) +
++ (sizeof(struct ext4_extent) * le16_to_cpu(neh->eh_entries));
++ memset(bh->b_data + ext_size, 0,
++ inode->i_sb->s_blocksize - ext_size);
+ ext4_extent_block_csum_set(inode, neh);
+ set_buffer_uptodate(bh);
+ unlock_buffer(bh);
+@@ -1270,6 +1280,7 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,
+ ext4_fsblk_t newblock, goal = 0;
+ struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
+ int err = 0;
++ size_t ext_size = 0;
+
+ /* Try to prepend new index to old one */
+ if (ext_depth(inode))
+@@ -1295,9 +1306,11 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,
+ goto out;
+ }
+
++ ext_size = sizeof(EXT4_I(inode)->i_data);
+ /* move top-level index/leaf into new block */
+- memmove(bh->b_data, EXT4_I(inode)->i_data,
+- sizeof(EXT4_I(inode)->i_data));
++ memmove(bh->b_data, EXT4_I(inode)->i_data, ext_size);
++ /* zero out unused area in the extent block */
++ memset(bh->b_data + ext_size, 0, inode->i_sb->s_blocksize - ext_size);
+
+ /* set size of new block */
+ neh = ext_block_hdr(bh);
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 98ec11f69cd4..2c5baa5e8291 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -264,6 +264,13 @@ ext4_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ }
+
+ ret = __generic_file_write_iter(iocb, from);
++ /*
++ * Unaligned direct AIO must be the only IO in flight. Otherwise
++ * overlapping aligned IO after unaligned might result in data
++ * corruption.
++ */
++ if (ret == -EIOCBQUEUED && unaligned_aio)
++ ext4_unwritten_wait(inode);
+ inode_unlock(inode);
+
+ if (ret > 0)
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 2c43c5b92229..67e8aa35197e 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5320,7 +5320,6 @@ static int ext4_do_update_inode(handle_t *handle,
+ err = ext4_journal_get_write_access(handle, EXT4_SB(sb)->s_sbh);
+ if (err)
+ goto out_brelse;
+- ext4_update_dynamic_rev(sb);
+ ext4_set_feature_large_file(sb);
+ ext4_handle_sync(handle);
+ err = ext4_handle_dirty_super(handle, sb);
+@@ -5971,7 +5970,7 @@ int ext4_expand_extra_isize(struct inode *inode,
+
+ ext4_write_lock_xattr(inode, &no_expand);
+
+- BUFFER_TRACE(iloc.bh, "get_write_access");
++ BUFFER_TRACE(iloc->bh, "get_write_access");
+ error = ext4_journal_get_write_access(handle, iloc->bh);
+ if (error) {
+ brelse(iloc->bh);
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 5f24fdc140ad..53d57cdf3c4d 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -977,7 +977,7 @@ mext_out:
+ if (err == 0)
+ err = err2;
+ mnt_drop_write_file(filp);
+- if (!err && (o_group > EXT4_SB(sb)->s_groups_count) &&
++ if (!err && (o_group < EXT4_SB(sb)->s_groups_count) &&
+ ext4_has_group_desc_csum(sb) &&
+ test_opt(sb, INIT_INODE_TABLE))
+ err = ext4_register_li_request(sb, o_group);
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index e29fce2fbf25..cc229f3357f7 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -1539,7 +1539,7 @@ static int mb_find_extent(struct ext4_buddy *e4b, int block,
+ ex->fe_len += 1 << order;
+ }
+
+- if (ex->fe_start + ex->fe_len > (1 << (e4b->bd_blkbits + 3))) {
++ if (ex->fe_start + ex->fe_len > EXT4_CLUSTERS_PER_GROUP(e4b->bd_sb)) {
+ /* Should never happen! (but apparently sometimes does?!?) */
+ WARN_ON(1);
+ ext4_error(e4b->bd_sb, "corruption or bug in mb_find_extent "
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 4f8de2b9e87e..4c5aa5df6573 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -871,12 +871,15 @@ static void dx_release(struct dx_frame *frames)
+ {
+ struct dx_root_info *info;
+ int i;
++ unsigned int indirect_levels;
+
+ if (frames[0].bh == NULL)
+ return;
+
+ info = &((struct dx_root *)frames[0].bh->b_data)->info;
+- for (i = 0; i <= info->indirect_levels; i++) {
++ /* save local copy, "info" may be freed after brelse() */
++ indirect_levels = info->indirect_levels;
++ for (i = 0; i <= indirect_levels; i++) {
+ if (frames[i].bh == NULL)
+ break;
+ brelse(frames[i].bh);
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index e7ae26e36c9c..4d5c0fc9d23a 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -874,6 +874,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ err = ext4_handle_dirty_metadata(handle, NULL, gdb_bh);
+ if (unlikely(err)) {
+ ext4_std_error(sb, err);
++ iloc.bh = NULL;
+ goto errout;
+ }
+ brelse(dind);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index abba7ece78e9..a270391228af 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -698,7 +698,7 @@ void __ext4_abort(struct super_block *sb, const char *function,
+ jbd2_journal_abort(EXT4_SB(sb)->s_journal, -EIO);
+ save_error_info(sb, function, line);
+ }
+- if (test_opt(sb, ERRORS_PANIC)) {
++ if (test_opt(sb, ERRORS_PANIC) && !system_going_down()) {
+ if (EXT4_SB(sb)->s_journal &&
+ !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
+ return;
+@@ -2259,7 +2259,6 @@ static int ext4_setup_super(struct super_block *sb, struct ext4_super_block *es,
+ es->s_max_mnt_count = cpu_to_le16(EXT4_DFL_MAX_MNT_COUNT);
+ le16_add_cpu(&es->s_mnt_count, 1);
+ ext4_update_tstamp(es, s_mtime);
+- ext4_update_dynamic_rev(sb);
+ if (sbi->s_journal)
+ ext4_set_feature_journal_needs_recovery(sb);
+
+@@ -3514,6 +3513,37 @@ int ext4_calculate_overhead(struct super_block *sb)
+ return 0;
+ }
+
++static void ext4_clamp_want_extra_isize(struct super_block *sb)
++{
++ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ struct ext4_super_block *es = sbi->s_es;
++
++ /* determine the minimum size of new large inodes, if present */
++ if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE &&
++ sbi->s_want_extra_isize == 0) {
++ sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
++ EXT4_GOOD_OLD_INODE_SIZE;
++ if (ext4_has_feature_extra_isize(sb)) {
++ if (sbi->s_want_extra_isize <
++ le16_to_cpu(es->s_want_extra_isize))
++ sbi->s_want_extra_isize =
++ le16_to_cpu(es->s_want_extra_isize);
++ if (sbi->s_want_extra_isize <
++ le16_to_cpu(es->s_min_extra_isize))
++ sbi->s_want_extra_isize =
++ le16_to_cpu(es->s_min_extra_isize);
++ }
++ }
++ /* Check if enough inode space is available */
++ if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >
++ sbi->s_inode_size) {
++ sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
++ EXT4_GOOD_OLD_INODE_SIZE;
++ ext4_msg(sb, KERN_INFO,
++ "required extra inode space not available");
++ }
++}
++
+ static void ext4_set_resv_clusters(struct super_block *sb)
+ {
+ ext4_fsblk_t resv_clusters;
+@@ -4239,7 +4269,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ "data=, fs mounted w/o journal");
+ goto failed_mount_wq;
+ }
+- sbi->s_def_mount_opt &= EXT4_MOUNT_JOURNAL_CHECKSUM;
++ sbi->s_def_mount_opt &= ~EXT4_MOUNT_JOURNAL_CHECKSUM;
+ clear_opt(sb, JOURNAL_CHECKSUM);
+ clear_opt(sb, DATA_FLAGS);
+ sbi->s_journal = NULL;
+@@ -4388,30 +4418,7 @@ no_journal:
+ } else if (ret)
+ goto failed_mount4a;
+
+- /* determine the minimum size of new large inodes, if present */
+- if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE &&
+- sbi->s_want_extra_isize == 0) {
+- sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
+- EXT4_GOOD_OLD_INODE_SIZE;
+- if (ext4_has_feature_extra_isize(sb)) {
+- if (sbi->s_want_extra_isize <
+- le16_to_cpu(es->s_want_extra_isize))
+- sbi->s_want_extra_isize =
+- le16_to_cpu(es->s_want_extra_isize);
+- if (sbi->s_want_extra_isize <
+- le16_to_cpu(es->s_min_extra_isize))
+- sbi->s_want_extra_isize =
+- le16_to_cpu(es->s_min_extra_isize);
+- }
+- }
+- /* Check if enough inode space is available */
+- if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >
+- sbi->s_inode_size) {
+- sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
+- EXT4_GOOD_OLD_INODE_SIZE;
+- ext4_msg(sb, KERN_INFO, "required extra inode space not"
+- "available");
+- }
++ ext4_clamp_want_extra_isize(sb);
+
+ ext4_set_resv_clusters(sb);
+
+@@ -5197,6 +5204,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ goto restore_opts;
+ }
+
++ ext4_clamp_want_extra_isize(sb);
++
+ if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^
+ test_opt(sb, JOURNAL_CHECKSUM)) {
+ ext4_msg(sb, KERN_ERR, "changing journal_checksum "
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 006c277dc22e..f73fc90e5daa 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1700,7 +1700,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
+
+ /* No failures allowed past this point. */
+
+- if (!s->not_found && here->e_value_size && here->e_value_offs) {
++ if (!s->not_found && here->e_value_size && !here->e_value_inum) {
+ /* Remove the old value. */
+ void *first_val = s->base + min_offs;
+ size_t offs = le16_to_cpu(here->e_value_offs);
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 82ce6d4f7e31..9544e2f8b79f 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -530,8 +530,6 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
+
+ isw->inode = inode;
+
+- atomic_inc(&isw_nr_in_flight);
+-
+ /*
+ * In addition to synchronizing among switchers, I_WB_SWITCH tells
+ * the RCU protected stat update paths to grab the i_page
+@@ -539,6 +537,9 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
+ * Let's continue after I_WB_SWITCH is guaranteed to be visible.
+ */
+ call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn);
++
++ atomic_inc(&isw_nr_in_flight);
++
+ goto out_unlock;
+
+ out_free:
+@@ -908,7 +909,11 @@ restart:
+ void cgroup_writeback_umount(void)
+ {
+ if (atomic_read(&isw_nr_in_flight)) {
+- synchronize_rcu();
++ /*
++ * Use rcu_barrier() to wait for all pending callbacks to
++ * ensure that all in-flight wb switches are in the workqueue.
++ */
++ rcu_barrier();
+ flush_workqueue(isw_wq);
+ }
+ }
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index a3a3d256fb0e..7a24f91af29e 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -426,9 +426,7 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
+ u32 hash;
+
+ index = page->index;
+- hash = hugetlb_fault_mutex_hash(h, current->mm,
+- &pseudo_vma,
+- mapping, index, 0);
++ hash = hugetlb_fault_mutex_hash(h, mapping, index, 0);
+ mutex_lock(&hugetlb_fault_mutex_table[hash]);
+
+ /*
+@@ -625,8 +623,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
+ addr = index * hpage_size;
+
+ /* mutex taken here, fault path and hole punch */
+- hash = hugetlb_fault_mutex_hash(h, mm, &pseudo_vma, mapping,
+- index, addr);
++ hash = hugetlb_fault_mutex_hash(h, mapping, index, addr);
+ mutex_lock(&hugetlb_fault_mutex_table[hash]);
+
+ /* See if already present in mapping to avoid alloc/free */
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 88f2a49338a1..e9cf88f0bc29 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1366,6 +1366,10 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)
+ journal_superblock_t *sb = journal->j_superblock;
+ int ret;
+
++ /* Buffer got discarded which means block device got invalidated */
++ if (!buffer_mapped(bh))
++ return -EIO;
++
+ trace_jbd2_write_superblock(journal, write_flags);
+ if (!(journal->j_flags & JBD2_BARRIER))
+ write_flags &= ~(REQ_FUA | REQ_PREFLUSH);
+@@ -2385,22 +2389,19 @@ static struct kmem_cache *jbd2_journal_head_cache;
+ static atomic_t nr_journal_heads = ATOMIC_INIT(0);
+ #endif
+
+-static int jbd2_journal_init_journal_head_cache(void)
++static int __init jbd2_journal_init_journal_head_cache(void)
+ {
+- int retval;
+-
+- J_ASSERT(jbd2_journal_head_cache == NULL);
++ J_ASSERT(!jbd2_journal_head_cache);
+ jbd2_journal_head_cache = kmem_cache_create("jbd2_journal_head",
+ sizeof(struct journal_head),
+ 0, /* offset */
+ SLAB_TEMPORARY | SLAB_TYPESAFE_BY_RCU,
+ NULL); /* ctor */
+- retval = 0;
+ if (!jbd2_journal_head_cache) {
+- retval = -ENOMEM;
+ printk(KERN_EMERG "JBD2: no memory for journal_head cache\n");
++ return -ENOMEM;
+ }
+- return retval;
++ return 0;
+ }
+
+ static void jbd2_journal_destroy_journal_head_cache(void)
+@@ -2646,28 +2647,38 @@ static void __exit jbd2_remove_jbd_stats_proc_entry(void)
+
+ struct kmem_cache *jbd2_handle_cache, *jbd2_inode_cache;
+
++static int __init jbd2_journal_init_inode_cache(void)
++{
++ J_ASSERT(!jbd2_inode_cache);
++ jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
++ if (!jbd2_inode_cache) {
++ pr_emerg("JBD2: failed to create inode cache\n");
++ return -ENOMEM;
++ }
++ return 0;
++}
++
+ static int __init jbd2_journal_init_handle_cache(void)
+ {
++ J_ASSERT(!jbd2_handle_cache);
+ jbd2_handle_cache = KMEM_CACHE(jbd2_journal_handle, SLAB_TEMPORARY);
+- if (jbd2_handle_cache == NULL) {
++ if (!jbd2_handle_cache) {
+ printk(KERN_EMERG "JBD2: failed to create handle cache\n");
+ return -ENOMEM;
+ }
+- jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
+- if (jbd2_inode_cache == NULL) {
+- printk(KERN_EMERG "JBD2: failed to create inode cache\n");
+- kmem_cache_destroy(jbd2_handle_cache);
+- return -ENOMEM;
+- }
+ return 0;
+ }
+
++static void jbd2_journal_destroy_inode_cache(void)
++{
++ kmem_cache_destroy(jbd2_inode_cache);
++ jbd2_inode_cache = NULL;
++}
++
+ static void jbd2_journal_destroy_handle_cache(void)
+ {
+ kmem_cache_destroy(jbd2_handle_cache);
+ jbd2_handle_cache = NULL;
+- kmem_cache_destroy(jbd2_inode_cache);
+- jbd2_inode_cache = NULL;
+ }
+
+ /*
+@@ -2678,11 +2689,15 @@ static int __init journal_init_caches(void)
+ {
+ int ret;
+
+- ret = jbd2_journal_init_revoke_caches();
++ ret = jbd2_journal_init_revoke_record_cache();
++ if (ret == 0)
++ ret = jbd2_journal_init_revoke_table_cache();
+ if (ret == 0)
+ ret = jbd2_journal_init_journal_head_cache();
+ if (ret == 0)
+ ret = jbd2_journal_init_handle_cache();
++ if (ret == 0)
++ ret = jbd2_journal_init_inode_cache();
+ if (ret == 0)
+ ret = jbd2_journal_init_transaction_cache();
+ return ret;
+@@ -2690,9 +2705,11 @@ static int __init journal_init_caches(void)
+
+ static void jbd2_journal_destroy_caches(void)
+ {
+- jbd2_journal_destroy_revoke_caches();
++ jbd2_journal_destroy_revoke_record_cache();
++ jbd2_journal_destroy_revoke_table_cache();
+ jbd2_journal_destroy_journal_head_cache();
+ jbd2_journal_destroy_handle_cache();
++ jbd2_journal_destroy_inode_cache();
+ jbd2_journal_destroy_transaction_cache();
+ jbd2_journal_destroy_slabs();
+ }
+diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
+index a1143e57a718..69b9bc329964 100644
+--- a/fs/jbd2/revoke.c
++++ b/fs/jbd2/revoke.c
+@@ -178,33 +178,41 @@ static struct jbd2_revoke_record_s *find_revoke_record(journal_t *journal,
+ return NULL;
+ }
+
+-void jbd2_journal_destroy_revoke_caches(void)
++void jbd2_journal_destroy_revoke_record_cache(void)
+ {
+ kmem_cache_destroy(jbd2_revoke_record_cache);
+ jbd2_revoke_record_cache = NULL;
++}
++
++void jbd2_journal_destroy_revoke_table_cache(void)
++{
+ kmem_cache_destroy(jbd2_revoke_table_cache);
+ jbd2_revoke_table_cache = NULL;
+ }
+
+-int __init jbd2_journal_init_revoke_caches(void)
++int __init jbd2_journal_init_revoke_record_cache(void)
+ {
+ J_ASSERT(!jbd2_revoke_record_cache);
+- J_ASSERT(!jbd2_revoke_table_cache);
+-
+ jbd2_revoke_record_cache = KMEM_CACHE(jbd2_revoke_record_s,
+ SLAB_HWCACHE_ALIGN|SLAB_TEMPORARY);
+- if (!jbd2_revoke_record_cache)
+- goto record_cache_failure;
+
++ if (!jbd2_revoke_record_cache) {
++ pr_emerg("JBD2: failed to create revoke_record cache\n");
++ return -ENOMEM;
++ }
++ return 0;
++}
++
++int __init jbd2_journal_init_revoke_table_cache(void)
++{
++ J_ASSERT(!jbd2_revoke_table_cache);
+ jbd2_revoke_table_cache = KMEM_CACHE(jbd2_revoke_table_s,
+ SLAB_TEMPORARY);
+- if (!jbd2_revoke_table_cache)
+- goto table_cache_failure;
+- return 0;
+-table_cache_failure:
+- jbd2_journal_destroy_revoke_caches();
+-record_cache_failure:
++ if (!jbd2_revoke_table_cache) {
++ pr_emerg("JBD2: failed to create revoke_table cache\n");
+ return -ENOMEM;
++ }
++ return 0;
+ }
+
+ static struct jbd2_revoke_table_s *jbd2_journal_init_revoke_table(int hash_size)
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 914e725c82c4..e20a6703531f 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -42,9 +42,11 @@ int __init jbd2_journal_init_transaction_cache(void)
+ 0,
+ SLAB_HWCACHE_ALIGN|SLAB_TEMPORARY,
+ NULL);
+- if (transaction_cache)
+- return 0;
+- return -ENOMEM;
++ if (!transaction_cache) {
++ pr_emerg("JBD2: failed to create transaction cache\n");
++ return -ENOMEM;
++ }
++ return 0;
+ }
+
+ void jbd2_journal_destroy_transaction_cache(void)
+diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c
+index 4bf8d5854b27..af2888d23de3 100644
+--- a/fs/ocfs2/export.c
++++ b/fs/ocfs2/export.c
+@@ -148,16 +148,24 @@ static struct dentry *ocfs2_get_parent(struct dentry *child)
+ u64 blkno;
+ struct dentry *parent;
+ struct inode *dir = d_inode(child);
++ int set;
+
+ trace_ocfs2_get_parent(child, child->d_name.len, child->d_name.name,
+ (unsigned long long)OCFS2_I(dir)->ip_blkno);
+
++ status = ocfs2_nfs_sync_lock(OCFS2_SB(dir->i_sb), 1);
++ if (status < 0) {
++ mlog(ML_ERROR, "getting nfs sync lock(EX) failed %d\n", status);
++ parent = ERR_PTR(status);
++ goto bail;
++ }
++
+ status = ocfs2_inode_lock(dir, NULL, 0);
+ if (status < 0) {
+ if (status != -ENOENT)
+ mlog_errno(status);
+ parent = ERR_PTR(status);
+- goto bail;
++ goto unlock_nfs_sync;
+ }
+
+ status = ocfs2_lookup_ino_from_name(dir, "..", 2, &blkno);
+@@ -166,11 +174,31 @@ static struct dentry *ocfs2_get_parent(struct dentry *child)
+ goto bail_unlock;
+ }
+
++ status = ocfs2_test_inode_bit(OCFS2_SB(dir->i_sb), blkno, &set);
++ if (status < 0) {
++ if (status == -EINVAL) {
++ status = -ESTALE;
++ } else
++ mlog(ML_ERROR, "test inode bit failed %d\n", status);
++ parent = ERR_PTR(status);
++ goto bail_unlock;
++ }
++
++ trace_ocfs2_get_dentry_test_bit(status, set);
++ if (!set) {
++ status = -ESTALE;
++ parent = ERR_PTR(status);
++ goto bail_unlock;
++ }
++
+ parent = d_obtain_alias(ocfs2_iget(OCFS2_SB(dir->i_sb), blkno, 0, 0));
+
+ bail_unlock:
+ ocfs2_inode_unlock(dir, 0);
+
++unlock_nfs_sync:
++ ocfs2_nfs_sync_unlock(OCFS2_SB(dir->i_sb), 1);
++
+ bail:
+ trace_ocfs2_get_parent_end(parent);
+
+diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c
+index 5fcb845b9fec..8cf2218b46a7 100644
+--- a/fs/pstore/inode.c
++++ b/fs/pstore/inode.c
+@@ -482,12 +482,10 @@ static struct file_system_type pstore_fs_type = {
+ .kill_sb = pstore_kill_sb,
+ };
+
+-static int __init init_pstore_fs(void)
++int __init pstore_init_fs(void)
+ {
+ int err;
+
+- pstore_choose_compression();
+-
+ /* Create a convenient mount point for people to access pstore */
+ err = sysfs_create_mount_point(fs_kobj, "pstore");
+ if (err)
+@@ -500,14 +498,9 @@ static int __init init_pstore_fs(void)
+ out:
+ return err;
+ }
+-module_init(init_pstore_fs)
+
+-static void __exit exit_pstore_fs(void)
++void __exit pstore_exit_fs(void)
+ {
+ unregister_filesystem(&pstore_fs_type);
+ sysfs_remove_mount_point(fs_kobj, "pstore");
+ }
+-module_exit(exit_pstore_fs)
+-
+-MODULE_AUTHOR("Tony Luck <tony.luck@intel.com>");
+-MODULE_LICENSE("GPL");
+diff --git a/fs/pstore/internal.h b/fs/pstore/internal.h
+index fb767e28aeb2..7062ea4bc57c 100644
+--- a/fs/pstore/internal.h
++++ b/fs/pstore/internal.h
+@@ -37,7 +37,8 @@ extern bool pstore_is_mounted(void);
+ extern void pstore_record_init(struct pstore_record *record,
+ struct pstore_info *psi);
+
+-/* Called during module_init() */
+-extern void __init pstore_choose_compression(void);
++/* Called during pstore init/exit. */
++int __init pstore_init_fs(void);
++void __exit pstore_exit_fs(void);
+
+ #endif
+diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
+index 15e99d5a681d..b821054ca3ed 100644
+--- a/fs/pstore/platform.c
++++ b/fs/pstore/platform.c
+@@ -274,36 +274,56 @@ static int pstore_decompress(void *in, void *out,
+
+ static void allocate_buf_for_compression(void)
+ {
++ struct crypto_comp *ctx;
++ int size;
++ char *buf;
++
++ /* Skip if not built-in or compression backend not selected yet. */
+ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESS) || !zbackend)
+ return;
+
++ /* Skip if no pstore backend yet or compression init already done. */
++ if (!psinfo || tfm)
++ return;
++
+ if (!crypto_has_comp(zbackend->name, 0, 0)) {
+- pr_err("No %s compression\n", zbackend->name);
++ pr_err("Unknown compression: %s\n", zbackend->name);
+ return;
+ }
+
+- big_oops_buf_sz = zbackend->zbufsize(psinfo->bufsize);
+- if (big_oops_buf_sz <= 0)
++ size = zbackend->zbufsize(psinfo->bufsize);
++ if (size <= 0) {
++ pr_err("Invalid compression size for %s: %d\n",
++ zbackend->name, size);
+ return;
++ }
+
+- big_oops_buf = kmalloc(big_oops_buf_sz, GFP_KERNEL);
+- if (!big_oops_buf) {
+- pr_err("allocate compression buffer error!\n");
++ buf = kmalloc(size, GFP_KERNEL);
++ if (!buf) {
++ pr_err("Failed %d byte compression buffer allocation for: %s\n",
++ size, zbackend->name);
+ return;
+ }
+
+- tfm = crypto_alloc_comp(zbackend->name, 0, 0);
+- if (IS_ERR_OR_NULL(tfm)) {
+- kfree(big_oops_buf);
+- big_oops_buf = NULL;
+- pr_err("crypto_alloc_comp() failed!\n");
++ ctx = crypto_alloc_comp(zbackend->name, 0, 0);
++ if (IS_ERR_OR_NULL(ctx)) {
++ kfree(buf);
++ pr_err("crypto_alloc_comp('%s') failed: %ld\n", zbackend->name,
++ PTR_ERR(ctx));
+ return;
+ }
++
++ /* A non-NULL big_oops_buf indicates compression is available. */
++ tfm = ctx;
++ big_oops_buf_sz = size;
++ big_oops_buf = buf;
++
++ pr_info("Using compression: %s\n", zbackend->name);
+ }
+
+ static void free_buf_for_compression(void)
+ {
+- if (IS_ENABLED(CONFIG_PSTORE_COMPRESS) && !IS_ERR_OR_NULL(tfm))
++ if (IS_ENABLED(CONFIG_PSTORE_COMPRESS) && tfm)
+ crypto_free_comp(tfm);
+ kfree(big_oops_buf);
+ big_oops_buf = NULL;
+@@ -774,14 +794,43 @@ void __init pstore_choose_compression(void)
+ for (step = zbackends; step->name; step++) {
+ if (!strcmp(compress, step->name)) {
+ zbackend = step;
+- pr_info("using %s compression\n", zbackend->name);
+ return;
+ }
+ }
+ }
+
++static int __init pstore_init(void)
++{
++ int ret;
++
++ pstore_choose_compression();
++
++ /*
++ * Check if any pstore backends registered earlier but did not
++ * initialize compression because crypto was not ready. If so,
++ * initialize compression now.
++ */
++ allocate_buf_for_compression();
++
++ ret = pstore_init_fs();
++ if (ret)
++ return ret;
++
++ return 0;
++}
++late_initcall(pstore_init);
++
++static void __exit pstore_exit(void)
++{
++ pstore_exit_fs();
++}
++module_exit(pstore_exit)
++
+ module_param(compress, charp, 0444);
+ MODULE_PARM_DESC(compress, "Pstore compression to use");
+
+ module_param(backend, charp, 0444);
+ MODULE_PARM_DESC(backend, "Pstore backend to use");
++
++MODULE_AUTHOR("Tony Luck <tony.luck@intel.com>");
++MODULE_LICENSE("GPL");
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index eb67bb7f04de..44ed6b193d2e 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -956,7 +956,7 @@ static int __init ramoops_init(void)
+
+ return ret;
+ }
+-late_initcall(ramoops_init);
++postcore_initcall(ramoops_init);
+
+ static void __exit ramoops_exit(void)
+ {
+diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
+index fdcb45999b26..77227224ca88 100644
+--- a/include/linux/huge_mm.h
++++ b/include/linux/huge_mm.h
+@@ -47,10 +47,8 @@ extern bool move_huge_pmd(struct vm_area_struct *vma, unsigned long old_addr,
+ extern int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
+ unsigned long addr, pgprot_t newprot,
+ int prot_numa);
+-vm_fault_t vmf_insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
+- pmd_t *pmd, pfn_t pfn, bool write);
+-vm_fault_t vmf_insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
+- pud_t *pud, pfn_t pfn, bool write);
++vm_fault_t vmf_insert_pfn_pmd(struct vm_fault *vmf, pfn_t pfn, bool write);
++vm_fault_t vmf_insert_pfn_pud(struct vm_fault *vmf, pfn_t pfn, bool write);
+ enum transparent_hugepage_flag {
+ TRANSPARENT_HUGEPAGE_FLAG,
+ TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG,
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 087fd5f48c91..d34112fb3d52 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -123,9 +123,7 @@ void move_hugetlb_state(struct page *oldpage, struct page *newpage, int reason);
+ void free_huge_page(struct page *page);
+ void hugetlb_fix_reserve_counts(struct inode *inode);
+ extern struct mutex *hugetlb_fault_mutex_table;
+-u32 hugetlb_fault_mutex_hash(struct hstate *h, struct mm_struct *mm,
+- struct vm_area_struct *vma,
+- struct address_space *mapping,
++u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
+ pgoff_t idx, unsigned long address);
+
+ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud);
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index b708e5169d1d..583b82b5a1e9 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -1317,7 +1317,7 @@ extern void __wait_on_journal (journal_t *);
+
+ /* Transaction cache support */
+ extern void jbd2_journal_destroy_transaction_cache(void);
+-extern int jbd2_journal_init_transaction_cache(void);
++extern int __init jbd2_journal_init_transaction_cache(void);
+ extern void jbd2_journal_free_transaction(transaction_t *);
+
+ /*
+@@ -1445,8 +1445,10 @@ static inline void jbd2_free_inode(struct jbd2_inode *jinode)
+ /* Primary revoke support */
+ #define JOURNAL_REVOKE_DEFAULT_HASH 256
+ extern int jbd2_journal_init_revoke(journal_t *, int);
+-extern void jbd2_journal_destroy_revoke_caches(void);
+-extern int jbd2_journal_init_revoke_caches(void);
++extern void jbd2_journal_destroy_revoke_record_cache(void);
++extern void jbd2_journal_destroy_revoke_table_cache(void);
++extern int __init jbd2_journal_init_revoke_record_cache(void);
++extern int __init jbd2_journal_init_revoke_table_cache(void);
+
+ extern void jbd2_journal_destroy_revoke(journal_t *);
+ extern int jbd2_journal_revoke (handle_t *, unsigned long long, struct buffer_head *);
+diff --git a/include/linux/mfd/da9063/registers.h b/include/linux/mfd/da9063/registers.h
+index 5d42859cb441..844fc2973392 100644
+--- a/include/linux/mfd/da9063/registers.h
++++ b/include/linux/mfd/da9063/registers.h
+@@ -215,9 +215,9 @@
+
+ /* DA9063 Configuration registers */
+ /* OTP */
+-#define DA9063_REG_OPT_COUNT 0x101
+-#define DA9063_REG_OPT_ADDR 0x102
+-#define DA9063_REG_OPT_DATA 0x103
++#define DA9063_REG_OTP_CONT 0x101
++#define DA9063_REG_OTP_ADDR 0x102
++#define DA9063_REG_OTP_DATA 0x103
+
+ /* Customer Trim and Configuration */
+ #define DA9063_REG_T_OFFSET 0x104
+diff --git a/include/linux/mfd/max77620.h b/include/linux/mfd/max77620.h
+index ad2a9a852aea..b4fd5a7c2aaa 100644
+--- a/include/linux/mfd/max77620.h
++++ b/include/linux/mfd/max77620.h
+@@ -136,8 +136,8 @@
+ #define MAX77620_FPS_PERIOD_MIN_US 40
+ #define MAX20024_FPS_PERIOD_MIN_US 20
+
+-#define MAX77620_FPS_PERIOD_MAX_US 2560
+-#define MAX20024_FPS_PERIOD_MAX_US 5120
++#define MAX20024_FPS_PERIOD_MAX_US 2560
++#define MAX77620_FPS_PERIOD_MAX_US 5120
+
+ #define MAX77620_REG_FPS_GPIO1 0x54
+ #define MAX77620_REG_FPS_GPIO2 0x55
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 64ef113e387e..69874db3fba8 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -907,6 +907,15 @@ static void mm_init_aio(struct mm_struct *mm)
+ #endif
+ }
+
++static __always_inline void mm_clear_owner(struct mm_struct *mm,
++ struct task_struct *p)
++{
++#ifdef CONFIG_MEMCG
++ if (mm->owner == p)
++ WRITE_ONCE(mm->owner, NULL);
++#endif
++}
++
+ static void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
+ {
+ #ifdef CONFIG_MEMCG
+@@ -1286,6 +1295,7 @@ static struct mm_struct *dup_mm(struct task_struct *tsk)
+ free_pt:
+ /* don't put binfmt in mmput, we haven't got module yet */
+ mm->binfmt = NULL;
++ mm_init_owner(mm, NULL);
+ mmput(mm);
+
+ fail_nomem:
+@@ -1617,6 +1627,21 @@ static inline void rcu_copy_process(struct task_struct *p)
+ #endif /* #ifdef CONFIG_TASKS_RCU */
+ }
+
++static void __delayed_free_task(struct rcu_head *rhp)
++{
++ struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
++
++ free_task(tsk);
++}
++
++static __always_inline void delayed_free_task(struct task_struct *tsk)
++{
++ if (IS_ENABLED(CONFIG_MEMCG))
++ call_rcu(&tsk->rcu, __delayed_free_task);
++ else
++ free_task(tsk);
++}
++
+ /*
+ * This creates a new process as a copy of the old one,
+ * but does not actually start it yet.
+@@ -2072,8 +2097,10 @@ bad_fork_cleanup_io:
+ bad_fork_cleanup_namespaces:
+ exit_task_namespaces(p);
+ bad_fork_cleanup_mm:
+- if (p->mm)
++ if (p->mm) {
++ mm_clear_owner(p->mm, p);
+ mmput(p->mm);
++ }
+ bad_fork_cleanup_signal:
+ if (!(clone_flags & CLONE_THREAD))
+ free_signal_struct(p->signal);
+@@ -2104,7 +2131,7 @@ bad_fork_cleanup_count:
+ bad_fork_free:
+ p->state = TASK_DEAD;
+ put_task_stack(p);
+- free_task(p);
++ delayed_free_task(p);
+ fork_out:
+ spin_lock_irq(¤t->sighand->siglock);
+ hlist_del_init(&delayed.node);
+diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
+index ef909357b84e..e41e4b4b5267 100644
+--- a/kernel/locking/rwsem-xadd.c
++++ b/kernel/locking/rwsem-xadd.c
+@@ -130,6 +130,7 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem,
+ {
+ struct rwsem_waiter *waiter, *tmp;
+ long oldcount, woken = 0, adjustment = 0;
++ struct list_head wlist;
+
+ /*
+ * Take a peek at the queue head waiter such that we can determine
+@@ -188,18 +189,42 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem,
+ * of the queue. We know that woken will be at least 1 as we accounted
+ * for above. Note we increment the 'active part' of the count by the
+ * number of readers before waking any processes up.
++ *
++ * We have to do wakeup in 2 passes to prevent the possibility that
++ * the reader count may be decremented before it is incremented. It
++ * is because the to-be-woken waiter may not have slept yet. So it
++ * may see waiter->task got cleared, finish its critical section and
++ * do an unlock before the reader count increment.
++ *
++ * 1) Collect the read-waiters in a separate list, count them and
++ * fully increment the reader count in rwsem.
++ * 2) For each waiters in the new list, clear waiter->task and
++ * put them into wake_q to be woken up later.
+ */
+- list_for_each_entry_safe(waiter, tmp, &sem->wait_list, list) {
+- struct task_struct *tsk;
+-
++ list_for_each_entry(waiter, &sem->wait_list, list) {
+ if (waiter->type == RWSEM_WAITING_FOR_WRITE)
+ break;
+
+ woken++;
+- tsk = waiter->task;
++ }
++ list_cut_before(&wlist, &sem->wait_list, &waiter->list);
++
++ adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment;
++ if (list_empty(&sem->wait_list)) {
++ /* hit end of list above */
++ adjustment -= RWSEM_WAITING_BIAS;
++ }
++
++ if (adjustment)
++ atomic_long_add(adjustment, &sem->count);
++
++ /* 2nd pass */
++ list_for_each_entry_safe(waiter, tmp, &wlist, list) {
++ struct task_struct *tsk;
+
++ tsk = waiter->task;
+ get_task_struct(tsk);
+- list_del(&waiter->list);
++
+ /*
+ * Ensure calling get_task_struct() before setting the reader
+ * waiter to nil such that rwsem_down_read_failed() cannot
+@@ -215,15 +240,6 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem,
+ /* wake_q_add() already take the task ref */
+ put_task_struct(tsk);
+ }
+-
+- adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment;
+- if (list_empty(&sem->wait_list)) {
+- /* hit end of list above */
+- adjustment -= RWSEM_WAITING_BIAS;
+- }
+-
+- if (adjustment)
+- atomic_long_add(adjustment, &sem->count);
+ }
+
+ /*
+diff --git a/lib/iov_iter.c b/lib/iov_iter.c
+index 8be175df3075..acd7b97c16f2 100644
+--- a/lib/iov_iter.c
++++ b/lib/iov_iter.c
+@@ -817,8 +817,21 @@ EXPORT_SYMBOL(_copy_from_iter_full_nocache);
+
+ static inline bool page_copy_sane(struct page *page, size_t offset, size_t n)
+ {
+- struct page *head = compound_head(page);
+- size_t v = n + offset + page_address(page) - page_address(head);
++ struct page *head;
++ size_t v = n + offset;
++
++ /*
++ * The general case needs to access the page order in order
++ * to compute the page size.
++ * However, we mostly deal with order-0 pages and thus can
++ * avoid a possible cache line miss for requests that fit all
++ * page orders.
++ */
++ if (n <= v && v <= PAGE_SIZE)
++ return true;
++
++ head = compound_head(page);
++ v += (page - head) << PAGE_SHIFT;
+
+ if (likely(n <= v && v <= (PAGE_SIZE << compound_order(head))))
+ return true;
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 7d08e89361ee..6fad1864ba03 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -772,11 +772,13 @@ out_unlock:
+ pte_free(mm, pgtable);
+ }
+
+-vm_fault_t vmf_insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
+- pmd_t *pmd, pfn_t pfn, bool write)
++vm_fault_t vmf_insert_pfn_pmd(struct vm_fault *vmf, pfn_t pfn, bool write)
+ {
++ unsigned long addr = vmf->address & PMD_MASK;
++ struct vm_area_struct *vma = vmf->vma;
+ pgprot_t pgprot = vma->vm_page_prot;
+ pgtable_t pgtable = NULL;
++
+ /*
+ * If we had pmd_special, we could avoid all these restrictions,
+ * but we need to be consistent with PTEs and architectures that
+@@ -799,7 +801,7 @@ vm_fault_t vmf_insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
+
+ track_pfn_insert(vma, &pgprot, pfn);
+
+- insert_pfn_pmd(vma, addr, pmd, pfn, pgprot, write, pgtable);
++ insert_pfn_pmd(vma, addr, vmf->pmd, pfn, pgprot, write, pgtable);
+ return VM_FAULT_NOPAGE;
+ }
+ EXPORT_SYMBOL_GPL(vmf_insert_pfn_pmd);
+@@ -848,10 +850,12 @@ out_unlock:
+ spin_unlock(ptl);
+ }
+
+-vm_fault_t vmf_insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
+- pud_t *pud, pfn_t pfn, bool write)
++vm_fault_t vmf_insert_pfn_pud(struct vm_fault *vmf, pfn_t pfn, bool write)
+ {
++ unsigned long addr = vmf->address & PUD_MASK;
++ struct vm_area_struct *vma = vmf->vma;
+ pgprot_t pgprot = vma->vm_page_prot;
++
+ /*
+ * If we had pud_special, we could avoid all these restrictions,
+ * but we need to be consistent with PTEs and architectures that
+@@ -868,7 +872,7 @@ vm_fault_t vmf_insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
+
+ track_pfn_insert(vma, &pgprot, pfn);
+
+- insert_pfn_pud(vma, addr, pud, pfn, pgprot, write);
++ insert_pfn_pud(vma, addr, vmf->pud, pfn, pgprot, write);
+ return VM_FAULT_NOPAGE;
+ }
+ EXPORT_SYMBOL_GPL(vmf_insert_pfn_pud);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 5fb779cda972..0bbb033d7d8c 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1572,8 +1572,9 @@ static struct page *alloc_surplus_huge_page(struct hstate *h, gfp_t gfp_mask,
+ */
+ if (h->surplus_huge_pages >= h->nr_overcommit_huge_pages) {
+ SetPageHugeTemporary(page);
++ spin_unlock(&hugetlb_lock);
+ put_page(page);
+- page = NULL;
++ return NULL;
+ } else {
+ h->surplus_huge_pages++;
+ h->surplus_huge_pages_node[page_to_nid(page)]++;
+@@ -3777,8 +3778,7 @@ retry:
+ * handling userfault. Reacquire after handling
+ * fault to make calling code simpler.
+ */
+- hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping,
+- idx, haddr);
++ hash = hugetlb_fault_mutex_hash(h, mapping, idx, haddr);
+ mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ ret = handle_userfault(&vmf, VM_UFFD_MISSING);
+ mutex_lock(&hugetlb_fault_mutex_table[hash]);
+@@ -3886,21 +3886,14 @@ backout_unlocked:
+ }
+
+ #ifdef CONFIG_SMP
+-u32 hugetlb_fault_mutex_hash(struct hstate *h, struct mm_struct *mm,
+- struct vm_area_struct *vma,
+- struct address_space *mapping,
++u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
+ pgoff_t idx, unsigned long address)
+ {
+ unsigned long key[2];
+ u32 hash;
+
+- if (vma->vm_flags & VM_SHARED) {
+- key[0] = (unsigned long) mapping;
+- key[1] = idx;
+- } else {
+- key[0] = (unsigned long) mm;
+- key[1] = address >> huge_page_shift(h);
+- }
++ key[0] = (unsigned long) mapping;
++ key[1] = idx;
+
+ hash = jhash2((u32 *)&key, sizeof(key)/sizeof(u32), 0);
+
+@@ -3911,9 +3904,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct mm_struct *mm,
+ * For uniprocesor systems we always use a single mutex, so just
+ * return 0 and avoid the hashing overhead.
+ */
+-u32 hugetlb_fault_mutex_hash(struct hstate *h, struct mm_struct *mm,
+- struct vm_area_struct *vma,
+- struct address_space *mapping,
++u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
+ pgoff_t idx, unsigned long address)
+ {
+ return 0;
+@@ -3958,7 +3949,7 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ * get spurious allocation failures if two CPUs race to instantiate
+ * the same page in the page cache.
+ */
+- hash = hugetlb_fault_mutex_hash(h, mm, vma, mapping, idx, haddr);
++ hash = hugetlb_fault_mutex_hash(h, mapping, idx, haddr);
+ mutex_lock(&hugetlb_fault_mutex_table[hash]);
+
+ entry = huge_ptep_get(ptep);
+diff --git a/mm/mincore.c b/mm/mincore.c
+index fc37afe226e6..2732c8c0764c 100644
+--- a/mm/mincore.c
++++ b/mm/mincore.c
+@@ -169,6 +169,22 @@ out:
+ return 0;
+ }
+
++static inline bool can_do_mincore(struct vm_area_struct *vma)
++{
++ if (vma_is_anonymous(vma))
++ return true;
++ if (!vma->vm_file)
++ return false;
++ /*
++ * Reveal pagecache information only for non-anonymous mappings that
++ * correspond to the files the calling process could (if tried) open
++ * for writing; otherwise we'd be including shared non-exclusive
++ * mappings, which opens a side channel.
++ */
++ return inode_owner_or_capable(file_inode(vma->vm_file)) ||
++ inode_permission(file_inode(vma->vm_file), MAY_WRITE) == 0;
++}
++
+ /*
+ * Do a chunk of "sys_mincore()". We've already checked
+ * all the arguments, we hold the mmap semaphore: we should
+@@ -189,8 +205,13 @@ static long do_mincore(unsigned long addr, unsigned long pages, unsigned char *v
+ vma = find_vma(current->mm, addr);
+ if (!vma || addr < vma->vm_start)
+ return -ENOMEM;
+- mincore_walk.mm = vma->vm_mm;
+ end = min(vma->vm_end, addr + (pages << PAGE_SHIFT));
++ if (!can_do_mincore(vma)) {
++ unsigned long pages = DIV_ROUND_UP(end - addr, PAGE_SIZE);
++ memset(vec, 1, pages);
++ return pages;
++ }
++ mincore_walk.mm = vma->vm_mm;
+ err = walk_page_range(addr, end, &mincore_walk);
+ if (err < 0)
+ return err;
+diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
+index 458acda96f20..7529d3fcc899 100644
+--- a/mm/userfaultfd.c
++++ b/mm/userfaultfd.c
+@@ -271,8 +271,7 @@ retry:
+ */
+ idx = linear_page_index(dst_vma, dst_addr);
+ mapping = dst_vma->vm_file->f_mapping;
+- hash = hugetlb_fault_mutex_hash(h, dst_mm, dst_vma, mapping,
+- idx, dst_addr);
++ hash = hugetlb_fault_mutex_hash(h, mapping, idx, dst_addr);
+ mutex_lock(&hugetlb_fault_mutex_table[hash]);
+
+ err = -ENOMEM;
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index cb587dce67a9..35931a18418f 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1548,9 +1548,11 @@ static bool hdmi_present_sense_via_verbs(struct hdmi_spec_per_pin *per_pin,
+ ret = !repoll || !eld->monitor_present || eld->eld_valid;
+
+ jack = snd_hda_jack_tbl_get(codec, pin_nid);
+- if (jack)
++ if (jack) {
+ jack->block_report = !ret;
+-
++ jack->pin_sense = (eld->monitor_present && eld->eld_valid) ?
++ AC_PINSENSE_PRESENCE : 0;
++ }
+ mutex_unlock(&per_pin->lock);
+ return ret;
+ }
+@@ -1660,6 +1662,11 @@ static void hdmi_repoll_eld(struct work_struct *work)
+ container_of(to_delayed_work(work), struct hdmi_spec_per_pin, work);
+ struct hda_codec *codec = per_pin->codec;
+ struct hdmi_spec *spec = codec->spec;
++ struct hda_jack_tbl *jack;
++
++ jack = snd_hda_jack_tbl_get(codec, per_pin->pin_nid);
++ if (jack)
++ jack->jack_dirty = 1;
+
+ if (per_pin->repoll_count++ > 6)
+ per_pin->repoll_count = 0;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 75a0be2aa9c2..adce5b60d5b4 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -477,12 +477,45 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on)
+ set_eapd(codec, *p, on);
+ }
+
++static int find_ext_mic_pin(struct hda_codec *codec);
++
++static void alc_headset_mic_no_shutup(struct hda_codec *codec)
++{
++ const struct hda_pincfg *pin;
++ int mic_pin = find_ext_mic_pin(codec);
++ int i;
++
++ /* don't shut up pins when unloading the driver; otherwise it breaks
++ * the default pin setup at the next load of the driver
++ */
++ if (codec->bus->shutdown)
++ return;
++
++ snd_array_for_each(&codec->init_pins, i, pin) {
++ /* use read here for syncing after issuing each verb */
++ if (pin->nid != mic_pin)
++ snd_hda_codec_read(codec, pin->nid, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
++ }
++
++ codec->pins_shutup = 1;
++}
++
+ static void alc_shutup_pins(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+
+- if (!spec->no_shutup_pins)
+- snd_hda_shutup_pins(codec);
++ switch (codec->core.vendor_id) {
++ case 0x10ec0286:
++ case 0x10ec0288:
++ case 0x10ec0298:
++ alc_headset_mic_no_shutup(codec);
++ break;
++ default:
++ if (!spec->no_shutup_pins)
++ snd_hda_shutup_pins(codec);
++ break;
++ }
+ }
+
+ /* generic shutup callback;
+@@ -803,11 +836,10 @@ static int alc_init(struct hda_codec *codec)
+ if (spec->init_hook)
+ spec->init_hook(codec);
+
++ snd_hda_gen_init(codec);
+ alc_fix_pll(codec);
+ alc_auto_init_amp(codec, spec->init_amp);
+
+- snd_hda_gen_init(codec);
+-
+ snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT);
+
+ return 0;
+@@ -2924,27 +2956,6 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
+ return alc_parse_auto_config(codec, alc269_ignore, ssids);
+ }
+
+-static int find_ext_mic_pin(struct hda_codec *codec);
+-
+-static void alc286_shutup(struct hda_codec *codec)
+-{
+- const struct hda_pincfg *pin;
+- int i;
+- int mic_pin = find_ext_mic_pin(codec);
+- /* don't shut up pins when unloading the driver; otherwise it breaks
+- * the default pin setup at the next load of the driver
+- */
+- if (codec->bus->shutdown)
+- return;
+- snd_array_for_each(&codec->init_pins, i, pin) {
+- /* use read here for syncing after issuing each verb */
+- if (pin->nid != mic_pin)
+- snd_hda_codec_read(codec, pin->nid, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
+- }
+- codec->pins_shutup = 1;
+-}
+-
+ static void alc269vb_toggle_power_output(struct hda_codec *codec, int power_up)
+ {
+ alc_update_coef_idx(codec, 0x04, 1 << 11, power_up ? (1 << 11) : 0);
+@@ -6841,6 +6852,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8550, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8551, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8560, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1558, 0x8561, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+@@ -6883,7 +6898,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+- SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
++ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK),
+@@ -7608,7 +7623,6 @@ static int patch_alc269(struct hda_codec *codec)
+ case 0x10ec0286:
+ case 0x10ec0288:
+ spec->codec_variant = ALC269_TYPE_ALC286;
+- spec->shutup = alc286_shutup;
+ break;
+ case 0x10ec0298:
+ spec->codec_variant = ALC269_TYPE_ALC298;
+diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
+index b61d518f4fef..63487240b61e 100644
+--- a/sound/soc/codecs/hdac_hdmi.c
++++ b/sound/soc/codecs/hdac_hdmi.c
+@@ -1828,6 +1828,17 @@ static int hdmi_codec_probe(struct snd_soc_component *component)
+ /* Imp: Store the card pointer in hda_codec */
+ hdmi->card = dapm->card->snd_card;
+
++ /*
++ * Setup a device_link between card device and HDMI codec device.
++ * The card device is the consumer and the HDMI codec device is
++ * the supplier. With this setting, we can make sure that the audio
++ * domain in display power will be always turned on before operating
++ * on the HDMI audio codec registers.
++ * Let's use the flag DL_FLAG_AUTOREMOVE_CONSUMER. This can make
++ * sure the device link is freed when the machine driver is removed.
++ */
++ device_link_add(component->card->dev, &hdev->dev, DL_FLAG_RPM_ACTIVE |
++ DL_FLAG_AUTOREMOVE_CONSUMER);
+ /*
+ * hdac_device core already sets the state to active and calls
+ * get_noresume. So enable runtime and set the device to suspend.
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index c97f21836c66..f06ae43650a3 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1209,14 +1209,14 @@ static const struct snd_soc_dapm_widget max98090_dapm_widgets[] = {
+ &max98090_right_rcv_mixer_controls[0],
+ ARRAY_SIZE(max98090_right_rcv_mixer_controls)),
+
+- SND_SOC_DAPM_MUX("LINMOD Mux", M98090_REG_LOUTR_MIXER,
+- M98090_LINMOD_SHIFT, 0, &max98090_linmod_mux),
++ SND_SOC_DAPM_MUX("LINMOD Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_linmod_mux),
+
+- SND_SOC_DAPM_MUX("MIXHPLSEL Mux", M98090_REG_HP_CONTROL,
+- M98090_MIXHPLSEL_SHIFT, 0, &max98090_mixhplsel_mux),
++ SND_SOC_DAPM_MUX("MIXHPLSEL Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_mixhplsel_mux),
+
+- SND_SOC_DAPM_MUX("MIXHPRSEL Mux", M98090_REG_HP_CONTROL,
+- M98090_MIXHPRSEL_SHIFT, 0, &max98090_mixhprsel_mux),
++ SND_SOC_DAPM_MUX("MIXHPRSEL Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_mixhprsel_mux),
+
+ SND_SOC_DAPM_PGA("HP Left Out", M98090_REG_OUTPUT_ENABLE,
+ M98090_HPLEN_SHIFT, 0, NULL, 0),
+diff --git a/sound/soc/codecs/rt5677-spi.c b/sound/soc/codecs/rt5677-spi.c
+index bd51f3655ee3..06abcd017650 100644
+--- a/sound/soc/codecs/rt5677-spi.c
++++ b/sound/soc/codecs/rt5677-spi.c
+@@ -58,13 +58,15 @@ static DEFINE_MUTEX(spi_mutex);
+ * RT5677_SPI_READ/WRITE_32: Transfer 4 bytes
+ * RT5677_SPI_READ/WRITE_BURST: Transfer any multiples of 8 bytes
+ *
+- * For example, reading 260 bytes at 0x60030002 uses the following commands:
+- * 0x60030002 RT5677_SPI_READ_16 2 bytes
++ * Note:
++ * 16 Bit writes and reads are restricted to the address range
++ * 0x18020000 ~ 0x18021000
++ *
++ * For example, reading 256 bytes at 0x60030004 uses the following commands:
+ * 0x60030004 RT5677_SPI_READ_32 4 bytes
+ * 0x60030008 RT5677_SPI_READ_BURST 240 bytes
+ * 0x600300F8 RT5677_SPI_READ_BURST 8 bytes
+ * 0x60030100 RT5677_SPI_READ_32 4 bytes
+- * 0x60030104 RT5677_SPI_READ_16 2 bytes
+ *
+ * Input:
+ * @read: true for read commands; false for write commands
+@@ -79,15 +81,13 @@ static u8 rt5677_spi_select_cmd(bool read, u32 align, u32 remain, u32 *len)
+ {
+ u8 cmd;
+
+- if (align == 2 || align == 6 || remain == 2) {
+- cmd = RT5677_SPI_READ_16;
+- *len = 2;
+- } else if (align == 4 || remain <= 6) {
++ if (align == 4 || remain <= 4) {
+ cmd = RT5677_SPI_READ_32;
+ *len = 4;
+ } else {
+ cmd = RT5677_SPI_READ_BURST;
+- *len = min_t(u32, remain & ~7, RT5677_SPI_BURST_LEN);
++ *len = (((remain - 1) >> 3) + 1) << 3;
++ *len = min_t(u32, *len, RT5677_SPI_BURST_LEN);
+ }
+ return read ? cmd : cmd + 1;
+ }
+@@ -108,7 +108,7 @@ static void rt5677_spi_reverse(u8 *dst, u32 dstlen, const u8 *src, u32 srclen)
+ }
+ }
+
+-/* Read DSP address space using SPI. addr and len have to be 2-byte aligned. */
++/* Read DSP address space using SPI. addr and len have to be 4-byte aligned. */
+ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ {
+ u32 offset;
+@@ -124,7 +124,7 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ if (!g_spi)
+ return -ENODEV;
+
+- if ((addr & 1) || (len & 1)) {
++ if ((addr & 3) || (len & 3)) {
+ dev_err(&g_spi->dev, "Bad read align 0x%x(%zu)\n", addr, len);
+ return -EACCES;
+ }
+@@ -159,13 +159,13 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ }
+ EXPORT_SYMBOL_GPL(rt5677_spi_read);
+
+-/* Write DSP address space using SPI. addr has to be 2-byte aligned.
+- * If len is not 2-byte aligned, an extra byte of zero is written at the end
++/* Write DSP address space using SPI. addr has to be 4-byte aligned.
++ * If len is not 4-byte aligned, then extra zeros are written at the end
+ * as padding.
+ */
+ int rt5677_spi_write(u32 addr, const void *txbuf, size_t len)
+ {
+- u32 offset, len_with_pad = len;
++ u32 offset;
+ int status = 0;
+ struct spi_transfer t;
+ struct spi_message m;
+@@ -178,22 +178,19 @@ int rt5677_spi_write(u32 addr, const void *txbuf, size_t len)
+ if (!g_spi)
+ return -ENODEV;
+
+- if (addr & 1) {
++ if (addr & 3) {
+ dev_err(&g_spi->dev, "Bad write align 0x%x(%zu)\n", addr, len);
+ return -EACCES;
+ }
+
+- if (len & 1)
+- len_with_pad = len + 1;
+-
+ memset(&t, 0, sizeof(t));
+ t.tx_buf = buf;
+ t.speed_hz = RT5677_SPI_FREQ;
+ spi_message_init_with_transfers(&m, &t, 1);
+
+- for (offset = 0; offset < len_with_pad;) {
++ for (offset = 0; offset < len;) {
+ spi_cmd = rt5677_spi_select_cmd(false, (addr + offset) & 7,
+- len_with_pad - offset, &t.len);
++ len - offset, &t.len);
+
+ /* Construct SPI message header */
+ buf[0] = spi_cmd;
+diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
+index 38fd32ab443c..ff96db91f818 100644
+--- a/sound/soc/fsl/fsl_esai.c
++++ b/sound/soc/fsl/fsl_esai.c
+@@ -251,7 +251,7 @@ static int fsl_esai_set_dai_sysclk(struct snd_soc_dai *dai, int clk_id,
+ break;
+ case ESAI_HCKT_EXTAL:
+ ecr |= ESAI_ECR_ETI;
+- /* fall through */
++ break;
+ case ESAI_HCKR_EXTAL:
+ ecr |= ESAI_ECR_ERI;
+ break;
+diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c
+index 19bee725de00..325b07b98b3c 100644
+--- a/sound/usb/line6/toneport.c
++++ b/sound/usb/line6/toneport.c
+@@ -54,8 +54,8 @@ struct usb_line6_toneport {
+ /* Firmware version (x 100) */
+ u8 firmware_version;
+
+- /* Timer for delayed PCM startup */
+- struct timer_list timer;
++ /* Work for delayed PCM startup */
++ struct delayed_work pcm_work;
+
+ /* Device type */
+ enum line6_device_type type;
+@@ -241,9 +241,10 @@ static int snd_toneport_source_put(struct snd_kcontrol *kcontrol,
+ return 1;
+ }
+
+-static void toneport_start_pcm(struct timer_list *t)
++static void toneport_start_pcm(struct work_struct *work)
+ {
+- struct usb_line6_toneport *toneport = from_timer(toneport, t, timer);
++ struct usb_line6_toneport *toneport =
++ container_of(work, struct usb_line6_toneport, pcm_work.work);
+ struct usb_line6 *line6 = &toneport->line6;
+
+ line6_pcm_acquire(line6->line6pcm, LINE6_STREAM_MONITOR, true);
+@@ -393,7 +394,8 @@ static int toneport_setup(struct usb_line6_toneport *toneport)
+ if (toneport_has_led(toneport))
+ toneport_update_led(toneport);
+
+- mod_timer(&toneport->timer, jiffies + TONEPORT_PCM_DELAY * HZ);
++ schedule_delayed_work(&toneport->pcm_work,
++ msecs_to_jiffies(TONEPORT_PCM_DELAY * 1000));
+ return 0;
+ }
+
+@@ -405,7 +407,7 @@ static void line6_toneport_disconnect(struct usb_line6 *line6)
+ struct usb_line6_toneport *toneport =
+ (struct usb_line6_toneport *)line6;
+
+- del_timer_sync(&toneport->timer);
++ cancel_delayed_work_sync(&toneport->pcm_work);
+
+ if (toneport_has_led(toneport))
+ toneport_remove_leds(toneport);
+@@ -422,7 +424,7 @@ static int toneport_init(struct usb_line6 *line6,
+ struct usb_line6_toneport *toneport = (struct usb_line6_toneport *) line6;
+
+ toneport->type = id->driver_info;
+- timer_setup(&toneport->timer, toneport_start_pcm, 0);
++ INIT_DELAYED_WORK(&toneport->pcm_work, toneport_start_pcm);
+
+ line6->disconnect = line6_toneport_disconnect;
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index e7d441d0e839..5a10b1b7f6b9 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2679,6 +2679,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
+ kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
+ if (! kctl) {
+ usb_audio_err(state->chip, "cannot malloc kcontrol\n");
++ for (i = 0; i < desc->bNrInPins; i++)
++ kfree(namelist[i]);
+ kfree(namelist);
+ kfree(cval);
+ return -ENOMEM;
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index ef152daccc33..46be34576620 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -1805,7 +1805,8 @@ static int validate_branch(struct objtool_file *file, struct instruction *first,
+ return 1;
+ }
+
+- func = insn->func ? insn->func->pfunc : NULL;
++ if (insn->func)
++ func = insn->func->pfunc;
+
+ if (func && insn->ignore) {
+ WARN_FUNC("BUG: why am I validating an ignored function?",
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-05-26 17:10 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-05-26 17:10 UTC (permalink / raw
To: gentoo-commits
commit: 11fcf185af6a32a517ff7a82d5f19ac144ed85c5
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun May 26 17:09:43 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun May 26 17:09:43 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=11fcf185
Linux patch 4.19.46
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1045_linux-4.19.46.patch | 4313 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4317 insertions(+)
diff --git a/0000_README b/0000_README
index f87fede..87c4eaf 100644
--- a/0000_README
+++ b/0000_README
@@ -223,6 +223,10 @@ Patch: 1044_linux-4.19.45.patch
From: http://www.kernel.org
Desc: Linux 4.19.45
+Patch: 1045_linux-4.19.46.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.46
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1045_linux-4.19.46.patch b/1045_linux-4.19.46.patch
new file mode 100644
index 0000000..12e081e
--- /dev/null
+++ b/1045_linux-4.19.46.patch
@@ -0,0 +1,4313 @@
+diff --git a/Documentation/filesystems/porting b/Documentation/filesystems/porting
+index 7b7b845c490a..32b5186be412 100644
+--- a/Documentation/filesystems/porting
++++ b/Documentation/filesystems/porting
+@@ -622,3 +622,8 @@ in your dentry operations instead.
+ alloc_file_clone(file, flags, ops) does not affect any caller's references.
+ On success you get a new struct file sharing the mount/dentry with the
+ original, on failure - ERR_PTR().
++--
++[mandatory]
++ DCACHE_RCUACCESS is gone; having an RCU delay on dentry freeing is the
++ default. DCACHE_NORCU opts out, and only d_alloc_pseudo() has any
++ business doing so.
+diff --git a/Makefile b/Makefile
+index b21dd3866b63..5383dd317d59 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 45
++SUBLEVEL = 46
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
+index 413863508f6f..d67fb64e908c 100644
+--- a/arch/mips/kernel/perf_event_mipsxx.c
++++ b/arch/mips/kernel/perf_event_mipsxx.c
+@@ -64,17 +64,11 @@ struct mips_perf_event {
+ #define CNTR_EVEN 0x55555555
+ #define CNTR_ODD 0xaaaaaaaa
+ #define CNTR_ALL 0xffffffff
+-#ifdef CONFIG_MIPS_MT_SMP
+ enum {
+ T = 0,
+ V = 1,
+ P = 2,
+ } range;
+-#else
+- #define T
+- #define V
+- #define P
+-#endif
+ };
+
+ static struct mips_perf_event raw_event;
+@@ -325,9 +319,7 @@ static void mipsxx_pmu_enable_event(struct hw_perf_event *evt, int idx)
+ {
+ struct perf_event *event = container_of(evt, struct perf_event, hw);
+ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+-#ifdef CONFIG_MIPS_MT_SMP
+ unsigned int range = evt->event_base >> 24;
+-#endif /* CONFIG_MIPS_MT_SMP */
+
+ WARN_ON(idx < 0 || idx >= mipspmu.num_counters);
+
+@@ -336,21 +328,15 @@ static void mipsxx_pmu_enable_event(struct hw_perf_event *evt, int idx)
+ /* Make sure interrupt enabled. */
+ MIPS_PERFCTRL_IE;
+
+-#ifdef CONFIG_CPU_BMIPS5000
+- {
++ if (IS_ENABLED(CONFIG_CPU_BMIPS5000)) {
+ /* enable the counter for the calling thread */
+ cpuc->saved_ctrl[idx] |=
+ (1 << (12 + vpe_id())) | BRCM_PERFCTRL_TC;
+- }
+-#else
+-#ifdef CONFIG_MIPS_MT_SMP
+- if (range > V) {
++ } else if (IS_ENABLED(CONFIG_MIPS_MT_SMP) && range > V) {
+ /* The counter is processor wide. Set it up to count all TCs. */
+ pr_debug("Enabling perf counter for all TCs\n");
+ cpuc->saved_ctrl[idx] |= M_TC_EN_ALL;
+- } else
+-#endif /* CONFIG_MIPS_MT_SMP */
+- {
++ } else {
+ unsigned int cpu, ctrl;
+
+ /*
+@@ -365,7 +351,6 @@ static void mipsxx_pmu_enable_event(struct hw_perf_event *evt, int idx)
+ cpuc->saved_ctrl[idx] |= ctrl;
+ pr_debug("Enabling perf counter for CPU%d\n", cpu);
+ }
+-#endif /* CONFIG_CPU_BMIPS5000 */
+ /*
+ * We do not actually let the counter run. Leave it until start().
+ */
+diff --git a/arch/parisc/boot/compressed/head.S b/arch/parisc/boot/compressed/head.S
+index 5aba20fa48aa..e8b798fd0cf0 100644
+--- a/arch/parisc/boot/compressed/head.S
++++ b/arch/parisc/boot/compressed/head.S
+@@ -22,7 +22,7 @@
+ __HEAD
+
+ ENTRY(startup)
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ #define PSW_W_SM 0x200
+ #define PSW_W_BIT 36
+@@ -63,7 +63,7 @@ $bss_loop:
+ load32 BOOTADDR(decompress_kernel),%r3
+
+ #ifdef CONFIG_64BIT
+- .level LEVEL
++ .level PA_ASM_LEVEL
+ ssm PSW_W_SM, %r0 /* set W-bit */
+ depdi 0, 31, 32, %r3
+ #endif
+@@ -72,7 +72,7 @@ $bss_loop:
+
+ startup_continue:
+ #ifdef CONFIG_64BIT
+- .level LEVEL
++ .level PA_ASM_LEVEL
+ rsm PSW_W_SM, %r0 /* clear W-bit */
+ #endif
+
+diff --git a/arch/parisc/include/asm/assembly.h b/arch/parisc/include/asm/assembly.h
+index e9c6385ef0d1..6f30fa5bdaed 100644
+--- a/arch/parisc/include/asm/assembly.h
++++ b/arch/parisc/include/asm/assembly.h
+@@ -61,14 +61,14 @@
+ #define LDCW ldcw,co
+ #define BL b,l
+ # ifdef CONFIG_64BIT
+-# define LEVEL 2.0w
++# define PA_ASM_LEVEL 2.0w
+ # else
+-# define LEVEL 2.0
++# define PA_ASM_LEVEL 2.0
+ # endif
+ #else
+ #define LDCW ldcw
+ #define BL bl
+-#define LEVEL 1.1
++#define PA_ASM_LEVEL 1.1
+ #endif
+
+ #ifdef __ASSEMBLY__
+diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
+index fbb4e43fda05..f56cbab64ac1 100644
+--- a/arch/parisc/kernel/head.S
++++ b/arch/parisc/kernel/head.S
+@@ -22,7 +22,7 @@
+ #include <linux/linkage.h>
+ #include <linux/init.h>
+
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ __INITDATA
+ ENTRY(boot_args)
+@@ -258,7 +258,7 @@ stext_pdc_ret:
+ ldo R%PA(fault_vector_11)(%r10),%r10
+
+ $is_pa20:
+- .level LEVEL /* restore 1.1 || 2.0w */
++ .level PA_ASM_LEVEL /* restore 1.1 || 2.0w */
+ #endif /*!CONFIG_64BIT*/
+ load32 PA(fault_vector_20),%r10
+
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index 841db71958cd..97c206734e24 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -193,6 +193,7 @@ int dump_task_fpu (struct task_struct *tsk, elf_fpregset_t *r)
+ */
+
+ int running_on_qemu __read_mostly;
++EXPORT_SYMBOL(running_on_qemu);
+
+ void __cpuidle arch_cpu_idle_dead(void)
+ {
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index f453997a7b8f..61a647a55c69 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -48,7 +48,7 @@ registers).
+ */
+ #define KILL_INSN break 0,0
+
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ .text
+
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index 585bbc5b3216..c90e00db5c13 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -905,7 +905,7 @@ apicinterrupt IRQ_WORK_VECTOR irq_work_interrupt smp_irq_work_interrupt
+ */
+ #define CPU_TSS_IST(x) PER_CPU_VAR(cpu_tss_rw) + (TSS_ist + ((x) - 1) * 8)
+
+-.macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1
++.macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1 create_gap=0
+ ENTRY(\sym)
+ UNWIND_HINT_IRET_REGS offset=\has_error_code*8
+
+@@ -925,6 +925,20 @@ ENTRY(\sym)
+ jnz .Lfrom_usermode_switch_stack_\@
+ .endif
+
++ .if \create_gap == 1
++ /*
++ * If coming from kernel space, create a 6-word gap to allow the
++ * int3 handler to emulate a call instruction.
++ */
++ testb $3, CS-ORIG_RAX(%rsp)
++ jnz .Lfrom_usermode_no_gap_\@
++ .rept 6
++ pushq 5*8(%rsp)
++ .endr
++ UNWIND_HINT_IRET_REGS offset=8
++.Lfrom_usermode_no_gap_\@:
++ .endif
++
+ .if \paranoid
+ call paranoid_entry
+ .else
+@@ -1154,7 +1168,7 @@ apicinterrupt3 HYPERV_STIMER0_VECTOR \
+ #endif /* CONFIG_HYPERV */
+
+ idtentry debug do_debug has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK
+-idtentry int3 do_int3 has_error_code=0
++idtentry int3 do_int3 has_error_code=0 create_gap=1
+ idtentry stack_segment do_stack_segment has_error_code=1
+
+ #ifdef CONFIG_XEN
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index a759e59990fb..09c53bcbd497 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -2074,15 +2074,19 @@ static void intel_pmu_disable_event(struct perf_event *event)
+ cpuc->intel_ctrl_host_mask &= ~(1ull << hwc->idx);
+ cpuc->intel_cp_status &= ~(1ull << hwc->idx);
+
+- if (unlikely(event->attr.precise_ip))
+- intel_pmu_pebs_disable(event);
+-
+ if (unlikely(hwc->config_base == MSR_ARCH_PERFMON_FIXED_CTR_CTRL)) {
+ intel_pmu_disable_fixed(hwc);
+ return;
+ }
+
+ x86_pmu_disable_event(event);
++
++ /*
++ * Needs to be called after x86_pmu_disable_event,
++ * so we don't trigger the event without PEBS bit set.
++ */
++ if (unlikely(event->attr.precise_ip))
++ intel_pmu_pebs_disable(event);
+ }
+
+ static void intel_pmu_del_event(struct perf_event *event)
+diff --git a/arch/x86/include/asm/text-patching.h b/arch/x86/include/asm/text-patching.h
+index e85ff65c43c3..05861cc08787 100644
+--- a/arch/x86/include/asm/text-patching.h
++++ b/arch/x86/include/asm/text-patching.h
+@@ -39,4 +39,32 @@ extern int poke_int3_handler(struct pt_regs *regs);
+ extern void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler);
+ extern int after_bootmem;
+
++static inline void int3_emulate_jmp(struct pt_regs *regs, unsigned long ip)
++{
++ regs->ip = ip;
++}
++
++#define INT3_INSN_SIZE 1
++#define CALL_INSN_SIZE 5
++
++#ifdef CONFIG_X86_64
++static inline void int3_emulate_push(struct pt_regs *regs, unsigned long val)
++{
++ /*
++ * The int3 handler in entry_64.S adds a gap between the
++ * stack where the break point happened, and the saving of
++ * pt_regs. We can extend the original stack because of
++ * this gap. See the idtentry macro's create_gap option.
++ */
++ regs->sp -= sizeof(unsigned long);
++ *(unsigned long *)regs->sp = val;
++}
++
++static inline void int3_emulate_call(struct pt_regs *regs, unsigned long func)
++{
++ int3_emulate_push(regs, regs->ip - INT3_INSN_SIZE + CALL_INSN_SIZE);
++ int3_emulate_jmp(regs, func);
++}
++#endif
++
+ #endif /* _ASM_X86_TEXT_PATCHING_H */
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index 7ee8067cbf45..4d2a401c178b 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -29,6 +29,7 @@
+ #include <asm/kprobes.h>
+ #include <asm/ftrace.h>
+ #include <asm/nops.h>
++#include <asm/text-patching.h>
+
+ #ifdef CONFIG_DYNAMIC_FTRACE
+
+@@ -228,6 +229,7 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
+ }
+
+ static unsigned long ftrace_update_func;
++static unsigned long ftrace_update_func_call;
+
+ static int update_ftrace_func(unsigned long ip, void *new)
+ {
+@@ -256,6 +258,8 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
+ unsigned char *new;
+ int ret;
+
++ ftrace_update_func_call = (unsigned long)func;
++
+ new = ftrace_call_replace(ip, (unsigned long)func);
+ ret = update_ftrace_func(ip, new);
+
+@@ -291,13 +295,28 @@ int ftrace_int3_handler(struct pt_regs *regs)
+ if (WARN_ON_ONCE(!regs))
+ return 0;
+
+- ip = regs->ip - 1;
+- if (!ftrace_location(ip) && !is_ftrace_caller(ip))
+- return 0;
++ ip = regs->ip - INT3_INSN_SIZE;
+
+- regs->ip += MCOUNT_INSN_SIZE - 1;
++#ifdef CONFIG_X86_64
++ if (ftrace_location(ip)) {
++ int3_emulate_call(regs, (unsigned long)ftrace_regs_caller);
++ return 1;
++ } else if (is_ftrace_caller(ip)) {
++ if (!ftrace_update_func_call) {
++ int3_emulate_jmp(regs, ip + CALL_INSN_SIZE);
++ return 1;
++ }
++ int3_emulate_call(regs, ftrace_update_func_call);
++ return 1;
++ }
++#else
++ if (ftrace_location(ip) || is_ftrace_caller(ip)) {
++ int3_emulate_jmp(regs, ip + CALL_INSN_SIZE);
++ return 1;
++ }
++#endif
+
+- return 1;
++ return 0;
+ }
+
+ static int ftrace_write(unsigned long ip, const char *val, int size)
+@@ -868,6 +887,8 @@ void arch_ftrace_update_trampoline(struct ftrace_ops *ops)
+
+ func = ftrace_ops_get_func(ops);
+
++ ftrace_update_func_call = (unsigned long)func;
++
+ /* Do a safe modify in case the trampoline is executing */
+ new = ftrace_call_replace(ip, (unsigned long)func);
+ ret = update_ftrace_func(ip, new);
+@@ -964,6 +985,7 @@ static int ftrace_mod_jmp(unsigned long ip, void *func)
+ {
+ unsigned char *new;
+
++ ftrace_update_func_call = 0UL;
+ new = ftrace_jmp_replace(ip, (unsigned long)func);
+
+ return update_ftrace_func(ip, new);
+diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
+index 01d209ab5481..229d99605165 100644
+--- a/arch/x86/kvm/hyperv.c
++++ b/arch/x86/kvm/hyperv.c
+@@ -1291,7 +1291,16 @@ static u64 kvm_hv_flush_tlb(struct kvm_vcpu *current_vcpu, u64 ingpa,
+ flush.address_space, flush.flags);
+
+ sparse_banks[0] = flush.processor_mask;
+- all_cpus = flush.flags & HV_FLUSH_ALL_PROCESSORS;
++
++ /*
++ * Work around possible WS2012 bug: it sends hypercalls
++ * with processor_mask = 0x0 and HV_FLUSH_ALL_PROCESSORS clear,
++ * while also expecting us to flush something and crashing if
++ * we don't. Let's treat processor_mask == 0 same as
++ * HV_FLUSH_ALL_PROCESSORS.
++ */
++ all_cpus = (flush.flags & HV_FLUSH_ALL_PROCESSORS) ||
++ flush.processor_mask == 0;
+ } else {
+ if (unlikely(kvm_read_guest(kvm, ingpa, &flush_ex,
+ sizeof(flush_ex))))
+diff --git a/arch/x86/lib/Makefile b/arch/x86/lib/Makefile
+index 25a972c61b0a..3c19d60316a8 100644
+--- a/arch/x86/lib/Makefile
++++ b/arch/x86/lib/Makefile
+@@ -6,6 +6,18 @@
+ # Produces uninteresting flaky coverage.
+ KCOV_INSTRUMENT_delay.o := n
+
++# Early boot use of cmdline; don't instrument it
++ifdef CONFIG_AMD_MEM_ENCRYPT
++KCOV_INSTRUMENT_cmdline.o := n
++KASAN_SANITIZE_cmdline.o := n
++
++ifdef CONFIG_FUNCTION_TRACER
++CFLAGS_REMOVE_cmdline.o = -pg
++endif
++
++CFLAGS_cmdline.o := $(call cc-option, -fno-stack-protector)
++endif
++
+ inat_tables_script = $(srctree)/arch/x86/tools/gen-insn-attr-x86.awk
+ inat_tables_maps = $(srctree)/arch/x86/lib/x86-opcode-map.txt
+ quiet_cmd_inat_tables = GEN $@
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index f5b74856784a..d48b310c4760 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -482,7 +482,7 @@ re_probe:
+
+ ret = dma_configure(dev);
+ if (ret)
+- goto dma_failed;
++ goto probe_failed;
+
+ if (driver_sysfs_add(dev)) {
+ printk(KERN_ERR "%s: driver_sysfs_add(%s) failed\n",
+@@ -537,14 +537,13 @@ re_probe:
+ goto done;
+
+ probe_failed:
+- dma_deconfigure(dev);
+-dma_failed:
+ if (dev->bus)
+ blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
+ BUS_NOTIFY_DRIVER_NOT_BOUND, dev);
+ pinctrl_bind_failed:
+ device_links_no_driver(dev);
+ devres_release_all(dev);
++ dma_deconfigure(dev);
+ driver_sysfs_remove(dev);
+ dev->driver = NULL;
+ dev_set_drvdata(dev, NULL);
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index c18586fccb6f..17defbf4f332 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -96,13 +96,8 @@ static struct page *brd_insert_page(struct brd_device *brd, sector_t sector)
+ /*
+ * Must use NOIO because we don't want to recurse back into the
+ * block or filesystem layers from page reclaim.
+- *
+- * Cannot support DAX and highmem, because our ->direct_access
+- * routine for DAX must return memory that is always addressable.
+- * If DAX was reworked to use pfns and kmap throughout, this
+- * restriction might be able to be lifted.
+ */
+- gfp_flags = GFP_NOIO | __GFP_ZERO;
++ gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM;
+ page = alloc_page(gfp_flags);
+ if (!page)
+ return NULL;
+diff --git a/drivers/clk/hisilicon/clk-hi3660.c b/drivers/clk/hisilicon/clk-hi3660.c
+index f40419959656..794eeff0d5d2 100644
+--- a/drivers/clk/hisilicon/clk-hi3660.c
++++ b/drivers/clk/hisilicon/clk-hi3660.c
+@@ -163,8 +163,12 @@ static const struct hisi_gate_clock hi3660_crgctrl_gate_sep_clks[] = {
+ "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 17, 0, },
+ { HI3660_CLK_GATE_ISP_SNCLK2, "clk_gate_isp_snclk2",
+ "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 18, 0, },
++ /*
++ * clk_gate_ufs_subsys is a system bus clock, mark it as critical
++ * clock and keep it on for system suspend and resume.
++ */
+ { HI3660_CLK_GATE_UFS_SUBSYS, "clk_gate_ufs_subsys", "clk_div_sysbus",
+- CLK_SET_RATE_PARENT, 0x50, 21, 0, },
++ CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, 0x50, 21, 0, },
+ { HI3660_PCLK_GATE_DSI0, "pclk_gate_dsi0", "clk_div_cfgbus",
+ CLK_SET_RATE_PARENT, 0x50, 28, 0, },
+ { HI3660_PCLK_GATE_DSI1, "pclk_gate_dsi1", "clk_div_cfgbus",
+diff --git a/drivers/clk/mediatek/clk-pll.c b/drivers/clk/mediatek/clk-pll.c
+index f54e4015b0b1..18842d660317 100644
+--- a/drivers/clk/mediatek/clk-pll.c
++++ b/drivers/clk/mediatek/clk-pll.c
+@@ -88,6 +88,32 @@ static unsigned long __mtk_pll_recalc_rate(struct mtk_clk_pll *pll, u32 fin,
+ return ((unsigned long)vco + postdiv - 1) / postdiv;
+ }
+
++static void __mtk_pll_tuner_enable(struct mtk_clk_pll *pll)
++{
++ u32 r;
++
++ if (pll->tuner_en_addr) {
++ r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit);
++ writel(r, pll->tuner_en_addr);
++ } else if (pll->tuner_addr) {
++ r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN;
++ writel(r, pll->tuner_addr);
++ }
++}
++
++static void __mtk_pll_tuner_disable(struct mtk_clk_pll *pll)
++{
++ u32 r;
++
++ if (pll->tuner_en_addr) {
++ r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit);
++ writel(r, pll->tuner_en_addr);
++ } else if (pll->tuner_addr) {
++ r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN;
++ writel(r, pll->tuner_addr);
++ }
++}
++
+ static void mtk_pll_set_rate_regs(struct mtk_clk_pll *pll, u32 pcw,
+ int postdiv)
+ {
+@@ -96,6 +122,9 @@ static void mtk_pll_set_rate_regs(struct mtk_clk_pll *pll, u32 pcw,
+
+ pll_en = readl(pll->base_addr + REG_CON0) & CON0_BASE_EN;
+
++ /* disable tuner */
++ __mtk_pll_tuner_disable(pll);
++
+ /* set postdiv */
+ val = readl(pll->pd_addr);
+ val &= ~(POSTDIV_MASK << pll->data->pd_shift);
+@@ -122,6 +151,9 @@ static void mtk_pll_set_rate_regs(struct mtk_clk_pll *pll, u32 pcw,
+ if (pll->tuner_addr)
+ writel(con1 + 1, pll->tuner_addr);
+
++ /* restore tuner_en */
++ __mtk_pll_tuner_enable(pll);
++
+ if (pll_en)
+ udelay(20);
+ }
+@@ -228,13 +260,7 @@ static int mtk_pll_prepare(struct clk_hw *hw)
+ r |= pll->data->en_mask;
+ writel(r, pll->base_addr + REG_CON0);
+
+- if (pll->tuner_en_addr) {
+- r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit);
+- writel(r, pll->tuner_en_addr);
+- } else if (pll->tuner_addr) {
+- r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN;
+- writel(r, pll->tuner_addr);
+- }
++ __mtk_pll_tuner_enable(pll);
+
+ udelay(20);
+
+@@ -258,13 +284,7 @@ static void mtk_pll_unprepare(struct clk_hw *hw)
+ writel(r, pll->base_addr + REG_CON0);
+ }
+
+- if (pll->tuner_en_addr) {
+- r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit);
+- writel(r, pll->tuner_en_addr);
+- } else if (pll->tuner_addr) {
+- r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN;
+- writel(r, pll->tuner_addr);
+- }
++ __mtk_pll_tuner_disable(pll);
+
+ r = readl(pll->base_addr + REG_CON0);
+ r &= ~CON0_BASE_EN;
+diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c
+index e431661fe874..ecbae8acd05b 100644
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -458,7 +458,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+ RK3328_CLKSEL_CON(35), 15, 1, MFLAGS, 8, 7, DFLAGS,
+ RK3328_CLKGATE_CON(2), 12, GFLAGS),
+ COMPOSITE(SCLK_CRYPTO, "clk_crypto", mux_2plls_p, 0,
+- RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 7, DFLAGS,
++ RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(2), 4, GFLAGS),
+ COMPOSITE_NOMUX(SCLK_TSADC, "clk_tsadc", "clk_24m", 0,
+ RK3328_CLKSEL_CON(22), 0, 10, DFLAGS,
+@@ -550,15 +550,15 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+ GATE(0, "hclk_rkvenc_niu", "hclk_rkvenc", 0,
+ RK3328_CLKGATE_CON(25), 1, GFLAGS),
+ GATE(ACLK_H265, "aclk_h265", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 2, GFLAGS),
+ GATE(PCLK_H265, "pclk_h265", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 3, GFLAGS),
+ GATE(ACLK_H264, "aclk_h264", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 4, GFLAGS),
+ GATE(HCLK_H264, "hclk_h264", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 5, GFLAGS),
+ GATE(ACLK_AXISRAM, "aclk_axisram", "aclk_rkvenc", CLK_IGNORE_UNUSED,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 6, GFLAGS),
+
+ COMPOSITE(SCLK_VENC_CORE, "sclk_venc_core", mux_4plls_p, 0,
+ RK3328_CLKSEL_CON(51), 14, 2, MFLAGS, 8, 5, DFLAGS,
+@@ -663,7 +663,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+
+ /* PD_GMAC */
+ COMPOSITE(ACLK_GMAC, "aclk_gmac", mux_2plls_hdmiphy_p, 0,
+- RK3328_CLKSEL_CON(35), 6, 2, MFLAGS, 0, 5, DFLAGS,
++ RK3328_CLKSEL_CON(25), 6, 2, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(3), 2, GFLAGS),
+ COMPOSITE_NOMUX(PCLK_GMAC, "pclk_gmac", "aclk_gmac", 0,
+ RK3328_CLKSEL_CON(25), 8, 3, DFLAGS,
+@@ -733,7 +733,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+
+ /* PD_PERI */
+ GATE(0, "aclk_peri_noc", "aclk_peri", CLK_IGNORE_UNUSED, RK3328_CLKGATE_CON(19), 11, GFLAGS),
+- GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 4, GFLAGS),
++ GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 14, GFLAGS),
+
+ GATE(HCLK_SDMMC, "hclk_sdmmc", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 0, GFLAGS),
+ GATE(HCLK_SDIO, "hclk_sdio", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 1, GFLAGS),
+@@ -913,7 +913,7 @@ static void __init rk3328_clk_init(struct device_node *np)
+ &rk3328_cpuclk_data, rk3328_cpuclk_rates,
+ ARRAY_SIZE(rk3328_cpuclk_rates));
+
+- rockchip_register_softrst(np, 11, reg_base + RK3328_SOFTRST_CON(0),
++ rockchip_register_softrst(np, 12, reg_base + RK3328_SOFTRST_CON(0),
+ ROCKCHIP_SOFTRST_HIWORD_MASK);
+
+ rockchip_register_restart_notifier(ctx, RK3328_GLB_SRST_FST, NULL);
+diff --git a/drivers/clk/sunxi-ng/ccu_nkmp.c b/drivers/clk/sunxi-ng/ccu_nkmp.c
+index ebd9436d2c7c..1ad53d1016a3 100644
+--- a/drivers/clk/sunxi-ng/ccu_nkmp.c
++++ b/drivers/clk/sunxi-ng/ccu_nkmp.c
+@@ -160,7 +160,7 @@ static int ccu_nkmp_set_rate(struct clk_hw *hw, unsigned long rate,
+ unsigned long parent_rate)
+ {
+ struct ccu_nkmp *nkmp = hw_to_ccu_nkmp(hw);
+- u32 n_mask, k_mask, m_mask, p_mask;
++ u32 n_mask = 0, k_mask = 0, m_mask = 0, p_mask = 0;
+ struct _ccu_nkmp _nkmp;
+ unsigned long flags;
+ u32 reg;
+@@ -179,10 +179,18 @@ static int ccu_nkmp_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ ccu_nkmp_find_best(parent_rate, rate, &_nkmp);
+
+- n_mask = GENMASK(nkmp->n.width + nkmp->n.shift - 1, nkmp->n.shift);
+- k_mask = GENMASK(nkmp->k.width + nkmp->k.shift - 1, nkmp->k.shift);
+- m_mask = GENMASK(nkmp->m.width + nkmp->m.shift - 1, nkmp->m.shift);
+- p_mask = GENMASK(nkmp->p.width + nkmp->p.shift - 1, nkmp->p.shift);
++ if (nkmp->n.width)
++ n_mask = GENMASK(nkmp->n.width + nkmp->n.shift - 1,
++ nkmp->n.shift);
++ if (nkmp->k.width)
++ k_mask = GENMASK(nkmp->k.width + nkmp->k.shift - 1,
++ nkmp->k.shift);
++ if (nkmp->m.width)
++ m_mask = GENMASK(nkmp->m.width + nkmp->m.shift - 1,
++ nkmp->m.shift);
++ if (nkmp->p.width)
++ p_mask = GENMASK(nkmp->p.width + nkmp->p.shift - 1,
++ nkmp->p.shift);
+
+ spin_lock_irqsave(nkmp->common.lock, flags);
+
+diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
+index 830d1c87fa7c..dc87866233b9 100644
+--- a/drivers/clk/tegra/clk-pll.c
++++ b/drivers/clk/tegra/clk-pll.c
+@@ -662,8 +662,8 @@ static void _update_pll_mnp(struct tegra_clk_pll *pll,
+ pll_override_writel(val, params->pmc_divp_reg, pll);
+
+ val = pll_override_readl(params->pmc_divnm_reg, pll);
+- val &= ~(divm_mask(pll) << div_nmp->override_divm_shift) |
+- ~(divn_mask(pll) << div_nmp->override_divn_shift);
++ val &= ~((divm_mask(pll) << div_nmp->override_divm_shift) |
++ (divn_mask(pll) << div_nmp->override_divn_shift));
+ val |= (cfg->m << div_nmp->override_divm_shift) |
+ (cfg->n << div_nmp->override_divn_shift);
+ pll_override_writel(val, params->pmc_divnm_reg, pll);
+diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
+index ba7aaf421f36..8ff326c0c406 100644
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -84,6 +84,7 @@ struct msc_iter {
+ * @reg_base: register window base address
+ * @thdev: intel_th_device pointer
+ * @win_list: list of windows in multiblock mode
++ * @single_sgt: single mode buffer
+ * @nr_pages: total number of pages allocated for this buffer
+ * @single_sz: amount of data in single mode
+ * @single_wrap: single mode wrap occurred
+@@ -104,6 +105,7 @@ struct msc {
+ struct intel_th_device *thdev;
+
+ struct list_head win_list;
++ struct sg_table single_sgt;
+ unsigned long nr_pages;
+ unsigned long single_sz;
+ unsigned int single_wrap : 1;
+@@ -617,22 +619,45 @@ static void intel_th_msc_deactivate(struct intel_th_device *thdev)
+ */
+ static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size)
+ {
++ unsigned long nr_pages = size >> PAGE_SHIFT;
+ unsigned int order = get_order(size);
+ struct page *page;
++ int ret;
+
+ if (!size)
+ return 0;
+
++ ret = sg_alloc_table(&msc->single_sgt, 1, GFP_KERNEL);
++ if (ret)
++ goto err_out;
++
++ ret = -ENOMEM;
+ page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
+ if (!page)
+- return -ENOMEM;
++ goto err_free_sgt;
+
+ split_page(page, order);
+- msc->nr_pages = size >> PAGE_SHIFT;
++ sg_set_buf(msc->single_sgt.sgl, page_address(page), size);
++
++ ret = dma_map_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, 1,
++ DMA_FROM_DEVICE);
++ if (ret < 0)
++ goto err_free_pages;
++
++ msc->nr_pages = nr_pages;
+ msc->base = page_address(page);
+- msc->base_addr = page_to_phys(page);
++ msc->base_addr = sg_dma_address(msc->single_sgt.sgl);
+
+ return 0;
++
++err_free_pages:
++ __free_pages(page, order);
++
++err_free_sgt:
++ sg_free_table(&msc->single_sgt);
++
++err_out:
++ return ret;
+ }
+
+ /**
+@@ -643,6 +668,10 @@ static void msc_buffer_contig_free(struct msc *msc)
+ {
+ unsigned long off;
+
++ dma_unmap_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl,
++ 1, DMA_FROM_DEVICE);
++ sg_free_table(&msc->single_sgt);
++
+ for (off = 0; off < msc->nr_pages << PAGE_SHIFT; off += PAGE_SIZE) {
+ struct page *page = virt_to_page(msc->base + off);
+
+diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
+index 9d55e104400c..9ec9197edffa 100644
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -166,11 +166,10 @@ stm_master(struct stm_device *stm, unsigned int idx)
+ static int stp_master_alloc(struct stm_device *stm, unsigned int idx)
+ {
+ struct stp_master *master;
+- size_t size;
+
+- size = ALIGN(stm->data->sw_nchannels, 8) / 8;
+- size += sizeof(struct stp_master);
+- master = kzalloc(size, GFP_ATOMIC);
++ master = kzalloc(struct_size(master, chan_map,
++ BITS_TO_LONGS(stm->data->sw_nchannels)),
++ GFP_ATOMIC);
+ if (!master)
+ return -ENOMEM;
+
+@@ -218,8 +217,8 @@ stm_output_disclaim(struct stm_device *stm, struct stm_output *output)
+ bitmap_release_region(&master->chan_map[0], output->channel,
+ ilog2(output->nr_chans));
+
+- output->nr_chans = 0;
+ master->nr_free += output->nr_chans;
++ output->nr_chans = 0;
+ }
+
+ /*
+diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
+index 0d03341317c4..121d3cb7ddd1 100644
+--- a/drivers/iommu/tegra-smmu.c
++++ b/drivers/iommu/tegra-smmu.c
+@@ -102,7 +102,6 @@ static inline u32 smmu_readl(struct tegra_smmu *smmu, unsigned long offset)
+ #define SMMU_TLB_FLUSH_VA_MATCH_ALL (0 << 0)
+ #define SMMU_TLB_FLUSH_VA_MATCH_SECTION (2 << 0)
+ #define SMMU_TLB_FLUSH_VA_MATCH_GROUP (3 << 0)
+-#define SMMU_TLB_FLUSH_ASID(x) (((x) & 0x7f) << 24)
+ #define SMMU_TLB_FLUSH_VA_SECTION(addr) ((((addr) & 0xffc00000) >> 12) | \
+ SMMU_TLB_FLUSH_VA_MATCH_SECTION)
+ #define SMMU_TLB_FLUSH_VA_GROUP(addr) ((((addr) & 0xffffc000) >> 12) | \
+@@ -205,8 +204,12 @@ static inline void smmu_flush_tlb_asid(struct tegra_smmu *smmu,
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_MATCH_ALL;
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_MATCH_ALL;
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
+@@ -216,8 +219,12 @@ static inline void smmu_flush_tlb_section(struct tegra_smmu *smmu,
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_SECTION(iova);
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_SECTION(iova);
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
+@@ -227,8 +234,12 @@ static inline void smmu_flush_tlb_group(struct tegra_smmu *smmu,
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_GROUP(iova);
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_GROUP(iova);
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index 6fc93834da44..151aa95775be 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -1167,11 +1167,18 @@ static int __load_discards(struct dm_cache_metadata *cmd,
+ if (r)
+ return r;
+
+- for (b = 0; b < from_dblock(cmd->discard_nr_blocks); b++) {
++ for (b = 0; ; b++) {
+ r = fn(context, cmd->discard_block_size, to_dblock(b),
+ dm_bitset_cursor_get_value(&c));
+ if (r)
+ break;
++
++ if (b >= (from_dblock(cmd->discard_nr_blocks) - 1))
++ break;
++
++ r = dm_bitset_cursor_next(&c);
++ if (r)
++ break;
+ }
+
+ dm_bitset_cursor_end(&c);
+diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
+index fddffe251bf6..f496213f8b67 100644
+--- a/drivers/md/dm-delay.c
++++ b/drivers/md/dm-delay.c
+@@ -121,7 +121,8 @@ static void delay_dtr(struct dm_target *ti)
+ {
+ struct delay_c *dc = ti->private;
+
+- destroy_workqueue(dc->kdelayd_wq);
++ if (dc->kdelayd_wq)
++ destroy_workqueue(dc->kdelayd_wq);
+
+ if (dc->read.dev)
+ dm_put_device(ti, dc->read.dev);
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index bc6ef2303f0b..dbdcc543832d 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -2557,7 +2557,7 @@ static int calculate_device_limits(struct dm_integrity_c *ic)
+ if (last_sector < ic->start || last_sector >= ic->meta_device_sectors)
+ return -EINVAL;
+ } else {
+- __u64 meta_size = ic->provided_data_sectors * ic->tag_size;
++ __u64 meta_size = (ic->provided_data_sectors >> ic->sb->log2_sectors_per_block) * ic->tag_size;
+ meta_size = (meta_size + ((1U << (ic->log2_buffer_sectors + SECTOR_SHIFT)) - 1))
+ >> (ic->log2_buffer_sectors + SECTOR_SHIFT);
+ meta_size <<= ic->log2_buffer_sectors;
+@@ -3428,7 +3428,7 @@ try_smaller_buffer:
+ DEBUG_print(" journal_sections %u\n", (unsigned)le32_to_cpu(ic->sb->journal_sections));
+ DEBUG_print(" journal_entries %u\n", ic->journal_entries);
+ DEBUG_print(" log2_interleave_sectors %d\n", ic->sb->log2_interleave_sectors);
+- DEBUG_print(" device_sectors 0x%llx\n", (unsigned long long)ic->device_sectors);
++ DEBUG_print(" data_device_sectors 0x%llx\n", (unsigned long long)ic->data_device_sectors);
+ DEBUG_print(" initial_sectors 0x%x\n", ic->initial_sectors);
+ DEBUG_print(" metadata_run 0x%x\n", ic->metadata_run);
+ DEBUG_print(" log2_metadata_run %d\n", ic->log2_metadata_run);
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 419362c2d8ac..baa966e2778c 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -892,6 +892,7 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
+ if (attached_handler_name || m->hw_handler_name) {
+ INIT_DELAYED_WORK(&p->activate_path, activate_path_work);
+ r = setup_scsi_dh(p->path.dev->bdev, m, &attached_handler_name, &ti->error);
++ kfree(attached_handler_name);
+ if (r) {
+ dm_put_device(ti, p->path.dev);
+ goto bad;
+@@ -906,7 +907,6 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
+
+ return p;
+ bad:
+- kfree(attached_handler_name);
+ free_pgpath(p);
+ return ERR_PTR(r);
+ }
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index fa68336560c3..d8334cd45d7c 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -1169,6 +1169,9 @@ static int dmz_init_zones(struct dmz_metadata *zmd)
+ goto out;
+ }
+
++ if (!nr_blkz)
++ break;
++
+ /* Process report */
+ for (i = 0; i < nr_blkz; i++) {
+ ret = dmz_init_zone(zmd, zone, &blkz[i]);
+@@ -1204,6 +1207,8 @@ static int dmz_update_zone(struct dmz_metadata *zmd, struct dm_zone *zone)
+ /* Get zone information from disk */
+ ret = blkdev_report_zones(zmd->dev->bdev, dmz_start_sect(zmd, zone),
+ &blkz, &nr_blkz, GFP_NOIO);
++ if (!nr_blkz)
++ ret = -EIO;
+ if (ret) {
+ dmz_dev_err(zmd->dev, "Get zone %u report failed",
+ dmz_id(zmd, zone));
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 8668793262d0..b924f62e2cd5 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -132,24 +132,6 @@ static inline int speed_max(struct mddev *mddev)
+ mddev->sync_speed_max : sysctl_speed_limit_max;
+ }
+
+-static void * flush_info_alloc(gfp_t gfp_flags, void *data)
+-{
+- return kzalloc(sizeof(struct flush_info), gfp_flags);
+-}
+-static void flush_info_free(void *flush_info, void *data)
+-{
+- kfree(flush_info);
+-}
+-
+-static void * flush_bio_alloc(gfp_t gfp_flags, void *data)
+-{
+- return kzalloc(sizeof(struct flush_bio), gfp_flags);
+-}
+-static void flush_bio_free(void *flush_bio, void *data)
+-{
+- kfree(flush_bio);
+-}
+-
+ static struct ctl_table_header *raid_table_header;
+
+ static struct ctl_table raid_table[] = {
+@@ -429,54 +411,31 @@ static int md_congested(void *data, int bits)
+ /*
+ * Generic flush handling for md
+ */
+-static void submit_flushes(struct work_struct *ws)
+-{
+- struct flush_info *fi = container_of(ws, struct flush_info, flush_work);
+- struct mddev *mddev = fi->mddev;
+- struct bio *bio = fi->bio;
+-
+- bio->bi_opf &= ~REQ_PREFLUSH;
+- md_handle_request(mddev, bio);
+-
+- mempool_free(fi, mddev->flush_pool);
+-}
+
+-static void md_end_flush(struct bio *fbio)
++static void md_end_flush(struct bio *bio)
+ {
+- struct flush_bio *fb = fbio->bi_private;
+- struct md_rdev *rdev = fb->rdev;
+- struct flush_info *fi = fb->fi;
+- struct bio *bio = fi->bio;
+- struct mddev *mddev = fi->mddev;
++ struct md_rdev *rdev = bio->bi_private;
++ struct mddev *mddev = rdev->mddev;
+
+ rdev_dec_pending(rdev, mddev);
+
+- if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0) {
+- /* an empty barrier - all done */
+- bio_endio(bio);
+- mempool_free(fi, mddev->flush_pool);
+- } else {
+- INIT_WORK(&fi->flush_work, submit_flushes);
+- queue_work(md_wq, &fi->flush_work);
+- }
++ if (atomic_dec_and_test(&mddev->flush_pending)) {
++ /* The pre-request flush has finished */
++ queue_work(md_wq, &mddev->flush_work);
+ }
+-
+- mempool_free(fb, mddev->flush_bio_pool);
+- bio_put(fbio);
++ bio_put(bio);
+ }
+
+-void md_flush_request(struct mddev *mddev, struct bio *bio)
++static void md_submit_flush_data(struct work_struct *ws);
++
++static void submit_flushes(struct work_struct *ws)
+ {
++ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
+ struct md_rdev *rdev;
+- struct flush_info *fi;
+-
+- fi = mempool_alloc(mddev->flush_pool, GFP_NOIO);
+-
+- fi->bio = bio;
+- fi->mddev = mddev;
+- atomic_set(&fi->flush_pending, 1);
+
++ mddev->start_flush = ktime_get_boottime();
++ INIT_WORK(&mddev->flush_work, md_submit_flush_data);
++ atomic_set(&mddev->flush_pending, 1);
+ rcu_read_lock();
+ rdev_for_each_rcu(rdev, mddev)
+ if (rdev->raid_disk >= 0 &&
+@@ -486,37 +445,74 @@ void md_flush_request(struct mddev *mddev, struct bio *bio)
+ * we reclaim rcu_read_lock
+ */
+ struct bio *bi;
+- struct flush_bio *fb;
+ atomic_inc(&rdev->nr_pending);
+ atomic_inc(&rdev->nr_pending);
+ rcu_read_unlock();
+-
+- fb = mempool_alloc(mddev->flush_bio_pool, GFP_NOIO);
+- fb->fi = fi;
+- fb->rdev = rdev;
+-
+ bi = bio_alloc_mddev(GFP_NOIO, 0, mddev);
+- bio_set_dev(bi, rdev->bdev);
+ bi->bi_end_io = md_end_flush;
+- bi->bi_private = fb;
++ bi->bi_private = rdev;
++ bio_set_dev(bi, rdev->bdev);
+ bi->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+-
+- atomic_inc(&fi->flush_pending);
++ atomic_inc(&mddev->flush_pending);
+ submit_bio(bi);
+-
+ rcu_read_lock();
+ rdev_dec_pending(rdev, mddev);
+ }
+ rcu_read_unlock();
++ if (atomic_dec_and_test(&mddev->flush_pending))
++ queue_work(md_wq, &mddev->flush_work);
++}
++
++static void md_submit_flush_data(struct work_struct *ws)
++{
++ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
++ struct bio *bio = mddev->flush_bio;
++
++ /*
++ * must reset flush_bio before calling into md_handle_request to avoid a
++ * deadlock, because other bios passed md_handle_request suspend check
++ * could wait for this and below md_handle_request could wait for those
++ * bios because of suspend check
++ */
++ mddev->last_flush = mddev->start_flush;
++ mddev->flush_bio = NULL;
++ wake_up(&mddev->sb_wait);
+
+- if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0) {
++ if (bio->bi_iter.bi_size == 0) {
++ /* an empty barrier - all done */
++ bio_endio(bio);
++ } else {
++ bio->bi_opf &= ~REQ_PREFLUSH;
++ md_handle_request(mddev, bio);
++ }
++}
++
++void md_flush_request(struct mddev *mddev, struct bio *bio)
++{
++ ktime_t start = ktime_get_boottime();
++ spin_lock_irq(&mddev->lock);
++ wait_event_lock_irq(mddev->sb_wait,
++ !mddev->flush_bio ||
++ ktime_after(mddev->last_flush, start),
++ mddev->lock);
++ if (!ktime_after(mddev->last_flush, start)) {
++ WARN_ON(mddev->flush_bio);
++ mddev->flush_bio = bio;
++ bio = NULL;
++ }
++ spin_unlock_irq(&mddev->lock);
++
++ if (!bio) {
++ INIT_WORK(&mddev->flush_work, submit_flushes);
++ queue_work(md_wq, &mddev->flush_work);
++ } else {
++ /* flush was performed for some other bio while we waited. */
++ if (bio->bi_iter.bi_size == 0)
+ /* an empty barrier - all done */
+ bio_endio(bio);
+- mempool_free(fi, mddev->flush_pool);
+- } else {
+- INIT_WORK(&fi->flush_work, submit_flushes);
+- queue_work(md_wq, &fi->flush_work);
++ else {
++ bio->bi_opf &= ~REQ_PREFLUSH;
++ mddev->pers->make_request(mddev, bio);
+ }
+ }
+ }
+@@ -566,6 +562,7 @@ void mddev_init(struct mddev *mddev)
+ atomic_set(&mddev->openers, 0);
+ atomic_set(&mddev->active_io, 0);
+ spin_lock_init(&mddev->lock);
++ atomic_set(&mddev->flush_pending, 0);
+ init_waitqueue_head(&mddev->sb_wait);
+ init_waitqueue_head(&mddev->recovery_wait);
+ mddev->reshape_position = MaxSector;
+@@ -2863,8 +2860,10 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
+ err = 0;
+ }
+ } else if (cmd_match(buf, "re-add")) {
+- if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
+- rdev->saved_raid_disk >= 0) {
++ if (!rdev->mddev->pers)
++ err = -EINVAL;
++ else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
++ rdev->saved_raid_disk >= 0) {
+ /* clear_bit is performed _after_ all the devices
+ * have their local Faulty bit cleared. If any writes
+ * happen in the meantime in the local node, they
+@@ -5519,22 +5518,6 @@ int md_run(struct mddev *mddev)
+ if (err)
+ return err;
+ }
+- if (mddev->flush_pool == NULL) {
+- mddev->flush_pool = mempool_create(NR_FLUSH_INFOS, flush_info_alloc,
+- flush_info_free, mddev);
+- if (!mddev->flush_pool) {
+- err = -ENOMEM;
+- goto abort;
+- }
+- }
+- if (mddev->flush_bio_pool == NULL) {
+- mddev->flush_bio_pool = mempool_create(NR_FLUSH_BIOS, flush_bio_alloc,
+- flush_bio_free, mddev);
+- if (!mddev->flush_bio_pool) {
+- err = -ENOMEM;
+- goto abort;
+- }
+- }
+
+ spin_lock(&pers_lock);
+ pers = find_pers(mddev->level, mddev->clevel);
+@@ -5694,15 +5677,8 @@ int md_run(struct mddev *mddev)
+ return 0;
+
+ abort:
+- if (mddev->flush_bio_pool) {
+- mempool_destroy(mddev->flush_bio_pool);
+- mddev->flush_bio_pool = NULL;
+- }
+- if (mddev->flush_pool){
+- mempool_destroy(mddev->flush_pool);
+- mddev->flush_pool = NULL;
+- }
+-
++ bioset_exit(&mddev->bio_set);
++ bioset_exit(&mddev->sync_set);
+ return err;
+ }
+ EXPORT_SYMBOL_GPL(md_run);
+@@ -5906,14 +5882,6 @@ static void __md_stop(struct mddev *mddev)
+ mddev->to_remove = &md_redundancy_group;
+ module_put(pers->owner);
+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+- if (mddev->flush_bio_pool) {
+- mempool_destroy(mddev->flush_bio_pool);
+- mddev->flush_bio_pool = NULL;
+- }
+- if (mddev->flush_pool) {
+- mempool_destroy(mddev->flush_pool);
+- mddev->flush_pool = NULL;
+- }
+ }
+
+ void md_stop(struct mddev *mddev)
+diff --git a/drivers/md/md.h b/drivers/md/md.h
+index 8afd6bfdbfb9..325cb2136a49 100644
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -252,19 +252,6 @@ enum mddev_sb_flags {
+ MD_SB_NEED_REWRITE, /* metadata write needs to be repeated */
+ };
+
+-#define NR_FLUSH_INFOS 8
+-#define NR_FLUSH_BIOS 64
+-struct flush_info {
+- struct bio *bio;
+- struct mddev *mddev;
+- struct work_struct flush_work;
+- atomic_t flush_pending;
+-};
+-struct flush_bio {
+- struct flush_info *fi;
+- struct md_rdev *rdev;
+-};
+-
+ struct mddev {
+ void *private;
+ struct md_personality *pers;
+@@ -470,8 +457,16 @@ struct mddev {
+ * metadata and bitmap writes
+ */
+
+- mempool_t *flush_pool;
+- mempool_t *flush_bio_pool;
++ /* Generic flush handling.
++ * The last to finish preflush schedules a worker to submit
++ * the rest of the request (without the REQ_PREFLUSH flag).
++ */
++ struct bio *flush_bio;
++ atomic_t flush_pending;
++ ktime_t start_flush, last_flush; /* last_flush is when the last completed
++ * flush was started.
++ */
++ struct work_struct flush_work;
+ struct work_struct event_work; /* used by dm to report failure event */
+ void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
+ struct md_cluster_info *cluster_info;
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 828d86605fb6..f237d6f30752 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -4185,7 +4185,7 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
+ /* now write out any block on a failed drive,
+ * or P or Q if they were recomputed
+ */
+- BUG_ON(s->uptodate < disks - 1); /* We don't need Q to recover */
++ dev = NULL;
+ if (s->failed == 2) {
+ dev = &sh->dev[s->failed_num[1]];
+ s->locked++;
+@@ -4210,6 +4210,14 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
+ set_bit(R5_LOCKED, &dev->flags);
+ set_bit(R5_Wantwrite, &dev->flags);
+ }
++ if (WARN_ONCE(dev && !test_bit(R5_UPTODATE, &dev->flags),
++ "%s: disk%td not up to date\n",
++ mdname(conf->mddev),
++ dev - (struct r5dev *) &sh->dev)) {
++ clear_bit(R5_LOCKED, &dev->flags);
++ clear_bit(R5_Wantwrite, &dev->flags);
++ s->locked--;
++ }
+ clear_bit(STRIPE_DEGRADED, &sh->state);
+
+ set_bit(STRIPE_INSYNC, &sh->state);
+@@ -4221,15 +4229,26 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
+ case check_state_check_result:
+ sh->check_state = check_state_idle;
+
+- if (s->failed > 1)
+- break;
+ /* handle a successful check operation, if parity is correct
+ * we are done. Otherwise update the mismatch count and repair
+ * parity if !MD_RECOVERY_CHECK
+ */
+ if (sh->ops.zero_sum_result == 0) {
+- /* Any parity checked was correct */
+- set_bit(STRIPE_INSYNC, &sh->state);
++ /* both parities are correct */
++ if (!s->failed)
++ set_bit(STRIPE_INSYNC, &sh->state);
++ else {
++ /* in contrast to the raid5 case we can validate
++ * parity, but still have a failure to write
++ * back
++ */
++ sh->check_state = check_state_compute_result;
++ /* Returning at this point means that we may go
++ * off and bring p and/or q uptodate again so
++ * we make sure to check zero_sum_result again
++ * to verify if p or q need writeback
++ */
++ }
+ } else {
+ atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches);
+ if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery)) {
+diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
+index 17a34b4a819d..a9264d515e54 100644
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -815,6 +815,8 @@ static int ov6650_video_probe(struct i2c_client *client)
+ if (ret < 0)
+ return ret;
+
++ msleep(20);
++
+ /*
+ * check and show product ID and manufacturer ID
+ */
+diff --git a/drivers/memory/tegra/mc.c b/drivers/memory/tegra/mc.c
+index bd25faf6d13d..c8f16666256c 100644
+--- a/drivers/memory/tegra/mc.c
++++ b/drivers/memory/tegra/mc.c
+@@ -280,7 +280,7 @@ static int tegra_mc_setup_latency_allowance(struct tegra_mc *mc)
+ u32 value;
+
+ /* compute the number of MC clock cycles per tick */
+- tick = mc->tick * clk_get_rate(mc->clk);
++ tick = (unsigned long long)mc->tick * clk_get_rate(mc->clk);
+ do_div(tick, NSEC_PER_SEC);
+
+ value = readl(mc->regs + MC_EMEM_ARB_CFG);
+diff --git a/drivers/net/Makefile b/drivers/net/Makefile
+index 21cde7e78621..0d3ba056cda3 100644
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -40,7 +40,7 @@ obj-$(CONFIG_ARCNET) += arcnet/
+ obj-$(CONFIG_DEV_APPLETALK) += appletalk/
+ obj-$(CONFIG_CAIF) += caif/
+ obj-$(CONFIG_CAN) += can/
+-obj-$(CONFIG_NET_DSA) += dsa/
++obj-y += dsa/
+ obj-$(CONFIG_ETHERNET) += ethernet/
+ obj-$(CONFIG_FDDI) += fddi/
+ obj-$(CONFIG_HIPPI) += hippi/
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
+index ffed2d4c9403..9c481823b3e8 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
+@@ -1492,7 +1492,7 @@ int mlx4_flow_steer_promisc_add(struct mlx4_dev *dev, u8 port,
+ rule.port = port;
+ rule.qpn = qpn;
+ INIT_LIST_HEAD(&rule.list);
+- mlx4_err(dev, "going promisc on %x\n", port);
++ mlx4_info(dev, "going promisc on %x\n", port);
+
+ return mlx4_flow_attach(dev, &rule, regid_p);
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+index 37a551436e4a..b7e3b8902e7e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
++++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+@@ -8,6 +8,7 @@ config MLX5_CORE
+ depends on PCI
+ imply PTP_1588_CLOCK
+ imply VXLAN
++ imply MLXFW
+ default n
+ ---help---
+ Core driver for low level functionality of the ConnectX-4 and
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 9ca4f88d7cf6..792bb8bc0cd3 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1609,6 +1609,22 @@ static int mlx5e_flash_device(struct net_device *dev,
+ return mlx5e_ethtool_flash_device(priv, flash);
+ }
+
++#ifndef CONFIG_MLX5_EN_RXNFC
++/* When CONFIG_MLX5_EN_RXNFC=n we only support ETHTOOL_GRXRINGS
++ * otherwise this function will be defined from en_fs_ethtool.c
++ */
++static int mlx5e_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *info, u32 *rule_locs)
++{
++ struct mlx5e_priv *priv = netdev_priv(dev);
++
++ if (info->cmd != ETHTOOL_GRXRINGS)
++ return -EOPNOTSUPP;
++ /* ring_count is needed by ethtool -x */
++ info->data = priv->channels.params.num_channels;
++ return 0;
++}
++#endif
++
+ const struct ethtool_ops mlx5e_ethtool_ops = {
+ .get_drvinfo = mlx5e_get_drvinfo,
+ .get_link = ethtool_op_get_link,
+@@ -1627,8 +1643,8 @@ const struct ethtool_ops mlx5e_ethtool_ops = {
+ .get_rxfh_indir_size = mlx5e_get_rxfh_indir_size,
+ .get_rxfh = mlx5e_get_rxfh,
+ .set_rxfh = mlx5e_set_rxfh,
+-#ifdef CONFIG_MLX5_EN_RXNFC
+ .get_rxnfc = mlx5e_get_rxnfc,
++#ifdef CONFIG_MLX5_EN_RXNFC
+ .set_rxnfc = mlx5e_set_rxnfc,
+ #endif
+ .flash_device = mlx5e_flash_device,
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+index 382bb93cb090..ff5c74120c12 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+@@ -194,6 +194,7 @@ void nfp_tunnel_keep_alive(struct nfp_app *app, struct sk_buff *skb)
+ return;
+ }
+
++ rcu_read_lock();
+ for (i = 0; i < count; i++) {
+ ipv4_addr = payload->tun_info[i].ipv4;
+ port = be32_to_cpu(payload->tun_info[i].egress_port);
+@@ -209,6 +210,7 @@ void nfp_tunnel_keep_alive(struct nfp_app *app, struct sk_buff *skb)
+ neigh_event_send(n, NULL);
+ neigh_release(n);
+ }
++ rcu_read_unlock();
+ }
+
+ static bool nfp_tun_is_netdev_to_offload(struct net_device *netdev)
+@@ -404,9 +406,10 @@ void nfp_tunnel_request_route(struct nfp_app *app, struct sk_buff *skb)
+
+ payload = nfp_flower_cmsg_get_data(skb);
+
++ rcu_read_lock();
+ netdev = nfp_app_repr_get(app, be32_to_cpu(payload->ingress_port));
+ if (!netdev)
+- goto route_fail_warning;
++ goto fail_rcu_unlock;
+
+ flow.daddr = payload->ipv4_addr;
+ flow.flowi4_proto = IPPROTO_UDP;
+@@ -416,21 +419,23 @@ void nfp_tunnel_request_route(struct nfp_app *app, struct sk_buff *skb)
+ rt = ip_route_output_key(dev_net(netdev), &flow);
+ err = PTR_ERR_OR_ZERO(rt);
+ if (err)
+- goto route_fail_warning;
++ goto fail_rcu_unlock;
+ #else
+- goto route_fail_warning;
++ goto fail_rcu_unlock;
+ #endif
+
+ /* Get the neighbour entry for the lookup */
+ n = dst_neigh_lookup(&rt->dst, &flow.daddr);
+ ip_rt_put(rt);
+ if (!n)
+- goto route_fail_warning;
+- nfp_tun_write_neigh(n->dev, app, &flow, n, GFP_KERNEL);
++ goto fail_rcu_unlock;
++ nfp_tun_write_neigh(n->dev, app, &flow, n, GFP_ATOMIC);
+ neigh_release(n);
++ rcu_read_unlock();
+ return;
+
+-route_fail_warning:
++fail_rcu_unlock:
++ rcu_read_unlock();
+ nfp_flower_cmsg_warn(app, "Requested route not found.\n");
+ }
+
+diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
+index 04891429a554..fe4057fca83d 100644
+--- a/drivers/net/ieee802154/mcr20a.c
++++ b/drivers/net/ieee802154/mcr20a.c
+@@ -539,6 +539,8 @@ mcr20a_start(struct ieee802154_hw *hw)
+ dev_dbg(printdev(lp), "no slotted operation\n");
+ ret = regmap_update_bits(lp->regmap_dar, DAR_PHY_CTRL1,
+ DAR_PHY_CTRL1_SLOTTED, 0x0);
++ if (ret < 0)
++ return ret;
+
+ /* enable irq */
+ enable_irq(lp->spi->irq);
+@@ -546,11 +548,15 @@ mcr20a_start(struct ieee802154_hw *hw)
+ /* Unmask SEQ interrupt */
+ ret = regmap_update_bits(lp->regmap_dar, DAR_PHY_CTRL2,
+ DAR_PHY_CTRL2_SEQMSK, 0x0);
++ if (ret < 0)
++ return ret;
+
+ /* Start the RX sequence */
+ dev_dbg(printdev(lp), "start the RX sequence\n");
+ ret = regmap_update_bits(lp->regmap_dar, DAR_PHY_CTRL1,
+ DAR_PHY_CTRL1_XCVSEQ_MASK, MCR20A_XCVSEQ_RX);
++ if (ret < 0)
++ return ret;
+
+ return 0;
+ }
+diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c
+index b5edc7f96a39..685e875f5164 100644
+--- a/drivers/net/ppp/ppp_deflate.c
++++ b/drivers/net/ppp/ppp_deflate.c
+@@ -610,12 +610,20 @@ static struct compressor ppp_deflate_draft = {
+
+ static int __init deflate_init(void)
+ {
+- int answer = ppp_register_compressor(&ppp_deflate);
+- if (answer == 0)
+- printk(KERN_INFO
+- "PPP Deflate Compression module registered\n");
+- ppp_register_compressor(&ppp_deflate_draft);
+- return answer;
++ int rc;
++
++ rc = ppp_register_compressor(&ppp_deflate);
++ if (rc)
++ return rc;
++
++ rc = ppp_register_compressor(&ppp_deflate_draft);
++ if (rc) {
++ ppp_unregister_compressor(&ppp_deflate);
++ return rc;
++ }
++
++ pr_info("PPP Deflate Compression module registered\n");
++ return 0;
+ }
+
+ static void __exit deflate_cleanup(void)
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 9195f3476b1d..366217263d70 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1122,9 +1122,16 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x0846, 0x68d3, 8)}, /* Netgear Aircard 779S */
+ {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */
+ {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */
++ {QMI_FIXED_INTF(0x1435, 0x0918, 3)}, /* Wistron NeWeb D16Q1 */
++ {QMI_FIXED_INTF(0x1435, 0x0918, 4)}, /* Wistron NeWeb D16Q1 */
++ {QMI_FIXED_INTF(0x1435, 0x0918, 5)}, /* Wistron NeWeb D16Q1 */
++ {QMI_FIXED_INTF(0x1435, 0x3185, 4)}, /* Wistron NeWeb M18Q5 */
++ {QMI_FIXED_INTF(0x1435, 0xd111, 4)}, /* M9615A DM11-1 D51QC */
+ {QMI_FIXED_INTF(0x1435, 0xd181, 3)}, /* Wistron NeWeb D18Q1 */
+ {QMI_FIXED_INTF(0x1435, 0xd181, 4)}, /* Wistron NeWeb D18Q1 */
+ {QMI_FIXED_INTF(0x1435, 0xd181, 5)}, /* Wistron NeWeb D18Q1 */
++ {QMI_FIXED_INTF(0x1435, 0xd182, 4)}, /* Wistron NeWeb D18 */
++ {QMI_FIXED_INTF(0x1435, 0xd182, 5)}, /* Wistron NeWeb D18 */
+ {QMI_FIXED_INTF(0x1435, 0xd191, 4)}, /* Wistron NeWeb D19Q1 */
+ {QMI_QUIRK_SET_DTR(0x1508, 0x1001, 4)}, /* Fibocom NL668 series */
+ {QMI_FIXED_INTF(0x16d8, 0x6003, 0)}, /* CMOTech 6003 */
+@@ -1180,6 +1187,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x19d2, 0x0265, 4)}, /* ONDA MT8205 4G LTE */
+ {QMI_FIXED_INTF(0x19d2, 0x0284, 4)}, /* ZTE MF880 */
+ {QMI_FIXED_INTF(0x19d2, 0x0326, 4)}, /* ZTE MF821D */
++ {QMI_FIXED_INTF(0x19d2, 0x0396, 3)}, /* ZTE ZM8620 */
+ {QMI_FIXED_INTF(0x19d2, 0x0412, 4)}, /* Telewell TW-LTE 4G */
+ {QMI_FIXED_INTF(0x19d2, 0x1008, 4)}, /* ZTE (Vodafone) K3570-Z */
+ {QMI_FIXED_INTF(0x19d2, 0x1010, 4)}, /* ZTE (Vodafone) K3571-Z */
+@@ -1200,7 +1208,9 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x19d2, 0x1425, 2)},
+ {QMI_FIXED_INTF(0x19d2, 0x1426, 2)}, /* ZTE MF91 */
+ {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */
++ {QMI_FIXED_INTF(0x19d2, 0x1432, 3)}, /* ZTE ME3620 */
+ {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */
++ {QMI_FIXED_INTF(0x2001, 0x7e16, 3)}, /* D-Link DWM-221 */
+ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */
+ {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */
+ {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */
+@@ -1240,6 +1250,8 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */
+ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)}, /* Telit LE910Cx */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)}, /* Telit LE910Cx */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)}, /* Telit LN940 series */
+ {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)}, /* Telewell TW-3G HSPA+ */
+ {QMI_FIXED_INTF(0x1c9e, 0x9803, 4)}, /* Telewell TW-3G HSPA+ */
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index b53148f972a4..036d1d82d93e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -143,9 +143,9 @@ static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
+ }
+
+ /* iwl_mvm_create_skb Adds the rxb to a new skb */
+-static void iwl_mvm_create_skb(struct sk_buff *skb, struct ieee80211_hdr *hdr,
+- u16 len, u8 crypt_len,
+- struct iwl_rx_cmd_buffer *rxb)
++static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
++ struct ieee80211_hdr *hdr, u16 len, u8 crypt_len,
++ struct iwl_rx_cmd_buffer *rxb)
+ {
+ struct iwl_rx_packet *pkt = rxb_addr(rxb);
+ struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
+@@ -178,6 +178,20 @@ static void iwl_mvm_create_skb(struct sk_buff *skb, struct ieee80211_hdr *hdr,
+ * present before copying packet data.
+ */
+ hdrlen += crypt_len;
++
++ if (WARN_ONCE(headlen < hdrlen,
++ "invalid packet lengths (hdrlen=%d, len=%d, crypt_len=%d)\n",
++ hdrlen, len, crypt_len)) {
++ /*
++ * We warn and trace because we want to be able to see
++ * it in trace-cmd as well.
++ */
++ IWL_DEBUG_RX(mvm,
++ "invalid packet lengths (hdrlen=%d, len=%d, crypt_len=%d)\n",
++ hdrlen, len, crypt_len);
++ return -EINVAL;
++ }
++
+ skb_put_data(skb, hdr, hdrlen);
+ skb_put_data(skb, (u8 *)hdr + hdrlen + pad_len, headlen - hdrlen);
+
+@@ -190,6 +204,8 @@ static void iwl_mvm_create_skb(struct sk_buff *skb, struct ieee80211_hdr *hdr,
+ skb_add_rx_frag(skb, 0, rxb_steal_page(rxb), offset,
+ fraglen, rxb->truesize);
+ }
++
++ return 0;
+ }
+
+ /* iwl_mvm_pass_packet_to_mac80211 - passes the packet for mac80211 */
+@@ -1425,7 +1441,11 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
+ rx_status->boottime_ns = ktime_get_boot_ns();
+ }
+
+- iwl_mvm_create_skb(skb, hdr, len, crypt_len, rxb);
++ if (iwl_mvm_create_skb(mvm, skb, hdr, len, crypt_len, rxb)) {
++ kfree_skb(skb);
++ goto out;
++ }
++
+ if (!iwl_mvm_reorder(mvm, napi, queue, sta, skb, desc))
+ iwl_mvm_pass_packet_to_mac80211(mvm, napi, skb, queue, sta);
+ out:
+diff --git a/drivers/net/wireless/intersil/p54/p54pci.c b/drivers/net/wireless/intersil/p54/p54pci.c
+index 27a49068d32d..57ad56435dda 100644
+--- a/drivers/net/wireless/intersil/p54/p54pci.c
++++ b/drivers/net/wireless/intersil/p54/p54pci.c
+@@ -554,7 +554,7 @@ static int p54p_probe(struct pci_dev *pdev,
+ err = pci_enable_device(pdev);
+ if (err) {
+ dev_err(&pdev->dev, "Cannot enable new PCI device\n");
+- return err;
++ goto err_put;
+ }
+
+ mem_addr = pci_resource_start(pdev, 0);
+@@ -639,6 +639,7 @@ static int p54p_probe(struct pci_dev *pdev,
+ pci_release_regions(pdev);
+ err_disable_dev:
+ pci_disable_device(pdev);
++err_put:
+ pci_dev_put(pdev);
+ return err;
+ }
+diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
+index 0c6e8b44b4ed..c60b465f6fe4 100644
+--- a/drivers/parisc/led.c
++++ b/drivers/parisc/led.c
+@@ -568,6 +568,9 @@ int __init register_led_driver(int model, unsigned long cmd_reg, unsigned long d
+ break;
+
+ case DISPLAY_MODEL_LASI:
++ /* Skip to register LED in QEMU */
++ if (running_on_qemu)
++ return 1;
+ LED_DATA_REG = data_reg;
+ led_func_ptr = led_LASI_driver;
+ printk(KERN_INFO "LED display at %lx registered\n", LED_DATA_REG);
+diff --git a/drivers/pci/controller/pcie-rcar.c b/drivers/pci/controller/pcie-rcar.c
+index c8febb009454..6a4e435bd35f 100644
+--- a/drivers/pci/controller/pcie-rcar.c
++++ b/drivers/pci/controller/pcie-rcar.c
+@@ -46,6 +46,7 @@
+
+ /* Transfer control */
+ #define PCIETCTLR 0x02000
++#define DL_DOWN BIT(3)
+ #define CFINIT 1
+ #define PCIETSTR 0x02004
+ #define DATA_LINK_ACTIVE 1
+@@ -94,6 +95,7 @@
+ #define MACCTLR 0x011058
+ #define SPEED_CHANGE BIT(24)
+ #define SCRAMBLE_DISABLE BIT(27)
++#define PMSR 0x01105c
+ #define MACS2R 0x011078
+ #define MACCGSPSETR 0x011084
+ #define SPCNGRSN BIT(31)
+@@ -1130,6 +1132,7 @@ static int rcar_pcie_probe(struct platform_device *pdev)
+ pcie = pci_host_bridge_priv(bridge);
+
+ pcie->dev = dev;
++ platform_set_drvdata(pdev, pcie);
+
+ err = pci_parse_request_of_pci_ranges(dev, &pcie->resources, NULL);
+ if (err)
+@@ -1221,10 +1224,28 @@ err_free_bridge:
+ return err;
+ }
+
++static int rcar_pcie_resume_noirq(struct device *dev)
++{
++ struct rcar_pcie *pcie = dev_get_drvdata(dev);
++
++ if (rcar_pci_read_reg(pcie, PMSR) &&
++ !(rcar_pci_read_reg(pcie, PCIETCTLR) & DL_DOWN))
++ return 0;
++
++ /* Re-establish the PCIe link */
++ rcar_pci_write_reg(pcie, CFINIT, PCIETCTLR);
++ return rcar_pcie_wait_for_dl(pcie);
++}
++
++static const struct dev_pm_ops rcar_pcie_pm_ops = {
++ .resume_noirq = rcar_pcie_resume_noirq,
++};
++
+ static struct platform_driver rcar_pcie_driver = {
+ .driver = {
+ .name = "rcar-pcie",
+ .of_match_table = rcar_pcie_of_match,
++ .pm = &rcar_pcie_pm_ops,
+ .suppress_bind_attrs = true,
+ },
+ .probe = rcar_pcie_probe,
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 30649addc625..61f2ef28ea1c 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -6135,8 +6135,7 @@ static int __init pci_setup(char *str)
+ } else if (!strncmp(str, "pcie_scan_all", 13)) {
+ pci_add_flags(PCI_SCAN_ALL_PCIE_DEVS);
+ } else if (!strncmp(str, "disable_acs_redir=", 18)) {
+- disable_acs_redir_param =
+- kstrdup(str + 18, GFP_KERNEL);
++ disable_acs_redir_param = str + 18;
+ } else {
+ printk(KERN_ERR "PCI: Unknown option `%s'\n",
+ str);
+@@ -6147,3 +6146,19 @@ static int __init pci_setup(char *str)
+ return 0;
+ }
+ early_param("pci", pci_setup);
++
++/*
++ * 'disable_acs_redir_param' is initialized in pci_setup(), above, to point
++ * to data in the __initdata section which will be freed after the init
++ * sequence is complete. We can't allocate memory in pci_setup() because some
++ * architectures do not have any memory allocation service available during
++ * an early_param() call. So we allocate memory and copy the variable here
++ * before the init section is freed.
++ */
++static int __init pci_realloc_setup_params(void)
++{
++ disable_acs_redir_param = kstrdup(disable_acs_redir_param, GFP_KERNEL);
++
++ return 0;
++}
++pure_initcall(pci_realloc_setup_params);
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 6e0d1528d471..ab25752f00d9 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -530,7 +530,7 @@ void pci_aer_clear_fatal_status(struct pci_dev *dev);
+ void pci_aer_clear_device_status(struct pci_dev *dev);
+ #else
+ static inline void pci_no_aer(void) { }
+-static inline int pci_aer_init(struct pci_dev *d) { return -ENODEV; }
++static inline void pci_aer_init(struct pci_dev *d) { }
+ static inline void pci_aer_exit(struct pci_dev *d) { }
+ static inline void pci_aer_clear_fatal_status(struct pci_dev *dev) { }
+ static inline void pci_aer_clear_device_status(struct pci_dev *dev) { }
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index f78860ce884b..1117b25fbe0b 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -198,6 +198,38 @@ static void pcie_clkpm_cap_init(struct pcie_link_state *link, int blacklist)
+ link->clkpm_capable = (blacklist) ? 0 : capable;
+ }
+
++static bool pcie_retrain_link(struct pcie_link_state *link)
++{
++ struct pci_dev *parent = link->pdev;
++ unsigned long start_jiffies;
++ u16 reg16;
++
++ pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16);
++ reg16 |= PCI_EXP_LNKCTL_RL;
++ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
++ if (parent->clear_retrain_link) {
++ /*
++ * Due to an erratum in some devices the Retrain Link bit
++ * needs to be cleared again manually to allow the link
++ * training to succeed.
++ */
++ reg16 &= ~PCI_EXP_LNKCTL_RL;
++ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
++ }
++
++ /* Wait for link training end. Break out after waiting for timeout */
++ start_jiffies = jiffies;
++ for (;;) {
++ pcie_capability_read_word(parent, PCI_EXP_LNKSTA, ®16);
++ if (!(reg16 & PCI_EXP_LNKSTA_LT))
++ break;
++ if (time_after(jiffies, start_jiffies + LINK_RETRAIN_TIMEOUT))
++ break;
++ msleep(1);
++ }
++ return !(reg16 & PCI_EXP_LNKSTA_LT);
++}
++
+ /*
+ * pcie_aspm_configure_common_clock: check if the 2 ends of a link
+ * could use common clock. If they are, configure them to use the
+@@ -207,7 +239,6 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
+ {
+ int same_clock = 1;
+ u16 reg16, parent_reg, child_reg[8];
+- unsigned long start_jiffies;
+ struct pci_dev *child, *parent = link->pdev;
+ struct pci_bus *linkbus = parent->subordinate;
+ /*
+@@ -265,21 +296,7 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
+ reg16 &= ~PCI_EXP_LNKCTL_CCC;
+ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
+
+- /* Retrain link */
+- reg16 |= PCI_EXP_LNKCTL_RL;
+- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
+-
+- /* Wait for link training end. Break out after waiting for timeout */
+- start_jiffies = jiffies;
+- for (;;) {
+- pcie_capability_read_word(parent, PCI_EXP_LNKSTA, ®16);
+- if (!(reg16 & PCI_EXP_LNKSTA_LT))
+- break;
+- if (time_after(jiffies, start_jiffies + LINK_RETRAIN_TIMEOUT))
+- break;
+- msleep(1);
+- }
+- if (!(reg16 & PCI_EXP_LNKSTA_LT))
++ if (pcie_retrain_link(link))
+ return;
+
+ /* Training failed. Restore common clock configurations */
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 4a4c16bfc0d3..fa4c386c8cd8 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -535,16 +535,9 @@ static void pci_release_host_bridge_dev(struct device *dev)
+ kfree(to_pci_host_bridge(dev));
+ }
+
+-struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
++static void pci_init_host_bridge(struct pci_host_bridge *bridge)
+ {
+- struct pci_host_bridge *bridge;
+-
+- bridge = kzalloc(sizeof(*bridge) + priv, GFP_KERNEL);
+- if (!bridge)
+- return NULL;
+-
+ INIT_LIST_HEAD(&bridge->windows);
+- bridge->dev.release = pci_release_host_bridge_dev;
+
+ /*
+ * We assume we can manage these PCIe features. Some systems may
+@@ -557,6 +550,18 @@ struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
+ bridge->native_shpc_hotplug = 1;
+ bridge->native_pme = 1;
+ bridge->native_ltr = 1;
++}
++
++struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
++{
++ struct pci_host_bridge *bridge;
++
++ bridge = kzalloc(sizeof(*bridge) + priv, GFP_KERNEL);
++ if (!bridge)
++ return NULL;
++
++ pci_init_host_bridge(bridge);
++ bridge->dev.release = pci_release_host_bridge_dev;
+
+ return bridge;
+ }
+@@ -571,7 +576,7 @@ struct pci_host_bridge *devm_pci_alloc_host_bridge(struct device *dev,
+ if (!bridge)
+ return NULL;
+
+- INIT_LIST_HEAD(&bridge->windows);
++ pci_init_host_bridge(bridge);
+ bridge->dev.release = devm_pci_release_host_bridge_dev;
+
+ return bridge;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 37d897bc4cf1..28c64f84bfe7 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2220,6 +2220,23 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s);
+
++/*
++ * Some Pericom PCIe-to-PCI bridges in reverse mode need the PCIe Retrain
++ * Link bit cleared after starting the link retrain process to allow this
++ * process to finish.
++ *
++ * Affected devices: PI7C9X110, PI7C9X111SL, PI7C9X130. See also the
++ * Pericom Errata Sheet PI7C9X111SLB_errata_rev1.2_102711.pdf.
++ */
++static void quirk_enable_clear_retrain_link(struct pci_dev *dev)
++{
++ dev->clear_retrain_link = 1;
++ pci_info(dev, "Enable PCIe Retrain Link quirk\n");
++}
++DECLARE_PCI_FIXUP_HEADER(0x12d8, 0xe110, quirk_enable_clear_retrain_link);
++DECLARE_PCI_FIXUP_HEADER(0x12d8, 0xe111, quirk_enable_clear_retrain_link);
++DECLARE_PCI_FIXUP_HEADER(0x12d8, 0xe130, quirk_enable_clear_retrain_link);
++
+ static void fixup_rev1_53c810(struct pci_dev *dev)
+ {
+ u32 class = dev->class;
+@@ -3383,6 +3400,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset);
+
+ /*
+ * Root port on some Cavium CN8xxx chips do not successfully complete a bus
+@@ -4878,6 +4896,7 @@ static void quirk_no_ats(struct pci_dev *pdev)
+
+ /* AMD Stoney platform GPU */
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_no_ats);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_no_ats);
+ #endif /* CONFIG_PCI_ATS */
+
+ /* Freescale PCIe doesn't support MSI in RC mode */
+diff --git a/drivers/phy/ti/phy-ti-pipe3.c b/drivers/phy/ti/phy-ti-pipe3.c
+index 68ce4a082b9b..693acc167351 100644
+--- a/drivers/phy/ti/phy-ti-pipe3.c
++++ b/drivers/phy/ti/phy-ti-pipe3.c
+@@ -303,7 +303,7 @@ static void ti_pipe3_calibrate(struct ti_pipe3 *phy)
+
+ val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY);
+ val &= ~(INTERFACE_MASK | LOSD_MASK | MEM_PLLDIV);
+- val = (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT);
++ val |= (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT);
+ ti_pipe3_writel(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY, val);
+
+ val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_DIGITAL_MODES);
+diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c
+index 98ba07869c3b..3bae02380bb2 100644
+--- a/drivers/power/supply/cpcap-battery.c
++++ b/drivers/power/supply/cpcap-battery.c
+@@ -221,6 +221,9 @@ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata,
+ int avg_current;
+ u32 cc_lsb;
+
++ if (!divider)
++ return 0;
++
+ sample &= 0xffffff; /* 24-bits, unsigned */
+ offset &= 0x7ff; /* 10-bits, signed */
+
+diff --git a/drivers/power/supply/power_supply_sysfs.c b/drivers/power/supply/power_supply_sysfs.c
+index 6170ed8b6854..5a2757a7f408 100644
+--- a/drivers/power/supply/power_supply_sysfs.c
++++ b/drivers/power/supply/power_supply_sysfs.c
+@@ -382,15 +382,11 @@ int power_supply_uevent(struct device *dev, struct kobj_uevent_env *env)
+ char *prop_buf;
+ char *attrname;
+
+- dev_dbg(dev, "uevent\n");
+-
+ if (!psy || !psy->desc) {
+ dev_dbg(dev, "No power supply yet\n");
+ return ret;
+ }
+
+- dev_dbg(dev, "POWER_SUPPLY_NAME=%s\n", psy->desc->name);
+-
+ ret = add_uevent_var(env, "POWER_SUPPLY_NAME=%s", psy->desc->name);
+ if (ret)
+ return ret;
+@@ -426,8 +422,6 @@ int power_supply_uevent(struct device *dev, struct kobj_uevent_env *env)
+ goto out;
+ }
+
+- dev_dbg(dev, "prop %s=%s\n", attrname, prop_buf);
+-
+ ret = add_uevent_var(env, "POWER_SUPPLY_%s=%s", attrname, prop_buf);
+ kfree(attrname);
+ if (ret)
+diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c
+index e22f1239a318..d17ce1fb4ef5 100644
+--- a/drivers/staging/media/imx/imx-media-csi.c
++++ b/drivers/staging/media/imx/imx-media-csi.c
+@@ -153,9 +153,10 @@ static inline bool requires_passthrough(struct v4l2_fwnode_endpoint *ep,
+ /*
+ * Parses the fwnode endpoint from the source pad of the entity
+ * connected to this CSI. This will either be the entity directly
+- * upstream from the CSI-2 receiver, or directly upstream from the
+- * video mux. The endpoint is needed to determine the bus type and
+- * bus config coming into the CSI.
++ * upstream from the CSI-2 receiver, directly upstream from the
++ * video mux, or directly upstream from the CSI itself. The endpoint
++ * is needed to determine the bus type and bus config coming into
++ * the CSI.
+ */
+ static int csi_get_upstream_endpoint(struct csi_priv *priv,
+ struct v4l2_fwnode_endpoint *ep)
+@@ -168,7 +169,8 @@ static int csi_get_upstream_endpoint(struct csi_priv *priv,
+ if (!priv->src_sd)
+ return -EPIPE;
+
+- src = &priv->src_sd->entity;
++ sd = priv->src_sd;
++ src = &sd->entity;
+
+ if (src->function == MEDIA_ENT_F_VID_MUX) {
+ /*
+@@ -182,6 +184,14 @@ static int csi_get_upstream_endpoint(struct csi_priv *priv,
+ src = &sd->entity;
+ }
+
++ /*
++ * If the source is neither the video mux nor the CSI-2 receiver,
++ * get the source pad directly upstream from CSI itself.
++ */
++ if (src->function != MEDIA_ENT_F_VID_MUX &&
++ sd->grp_id != IMX_MEDIA_GRP_ID_CSI2)
++ src = &priv->sd.entity;
++
+ /* get source pad of entity directly upstream from src */
+ pad = imx_media_find_upstream_pad(priv->md, src, 0);
+ if (IS_ERR(pad))
+diff --git a/drivers/staging/media/imx/imx-media-of.c b/drivers/staging/media/imx/imx-media-of.c
+index acde372c6795..1647da216bf9 100644
+--- a/drivers/staging/media/imx/imx-media-of.c
++++ b/drivers/staging/media/imx/imx-media-of.c
+@@ -233,15 +233,18 @@ int imx_media_create_csi_of_links(struct imx_media_dev *imxmd,
+ struct v4l2_subdev *csi)
+ {
+ struct device_node *csi_np = csi->dev->of_node;
+- struct fwnode_handle *fwnode, *csi_ep;
+- struct v4l2_fwnode_link link;
+ struct device_node *ep;
+- int ret;
+-
+- link.local_node = of_fwnode_handle(csi_np);
+- link.local_port = CSI_SINK_PAD;
+
+ for_each_child_of_node(csi_np, ep) {
++ struct fwnode_handle *fwnode, *csi_ep;
++ struct v4l2_fwnode_link link;
++ int ret;
++
++ memset(&link, 0, sizeof(link));
++
++ link.local_node = of_fwnode_handle(csi_np);
++ link.local_port = CSI_SINK_PAD;
++
+ csi_ep = of_fwnode_handle(ep);
+
+ fwnode = fwnode_graph_get_remote_endpoint(csi_ep);
+diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
+index ba906876cc45..fd02e8a4841d 100644
+--- a/drivers/video/fbdev/efifb.c
++++ b/drivers/video/fbdev/efifb.c
+@@ -476,8 +476,12 @@ static int efifb_probe(struct platform_device *dev)
+ * If the UEFI memory map covers the efifb region, we may only
+ * remap it using the attributes the memory map prescribes.
+ */
+- mem_flags |= EFI_MEMORY_WT | EFI_MEMORY_WB;
+- mem_flags &= md.attribute;
++ md.attribute &= EFI_MEMORY_UC | EFI_MEMORY_WC |
++ EFI_MEMORY_WT | EFI_MEMORY_WB;
++ if (md.attribute) {
++ mem_flags |= EFI_MEMORY_WT | EFI_MEMORY_WB;
++ mem_flags &= md.attribute;
++ }
+ }
+ if (mem_flags & EFI_MEMORY_WC)
+ info->screen_base = ioremap_wc(efifb_fix.smem_start,
+diff --git a/drivers/video/fbdev/sm712.h b/drivers/video/fbdev/sm712.h
+index aad1cc4be34a..c7ebf03b8d53 100644
+--- a/drivers/video/fbdev/sm712.h
++++ b/drivers/video/fbdev/sm712.h
+@@ -15,14 +15,10 @@
+
+ #define FB_ACCEL_SMI_LYNX 88
+
+-#define SCREEN_X_RES 1024
+-#define SCREEN_Y_RES 600
+-#define SCREEN_BPP 16
+-
+-/*Assume SM712 graphics chip has 4MB VRAM */
+-#define SM712_VIDEOMEMORYSIZE 0x00400000
+-/*Assume SM722 graphics chip has 8MB VRAM */
+-#define SM722_VIDEOMEMORYSIZE 0x00800000
++#define SCREEN_X_RES 1024
++#define SCREEN_Y_RES_PC 768
++#define SCREEN_Y_RES_NETBOOK 600
++#define SCREEN_BPP 16
+
+ #define dac_reg (0x3c8)
+ #define dac_val (0x3c9)
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 502d0de2feec..f1dcc6766d1e 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -530,6 +530,65 @@ static const struct modeinit vgamode[] = {
+ 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x15, 0x03,
+ },
+ },
++ { /* 1024 x 768 16Bpp 60Hz */
++ 1024, 768, 16, 60,
++ /* Init_MISC */
++ 0xEB,
++ { /* Init_SR0_SR4 */
++ 0x03, 0x01, 0x0F, 0x03, 0x0E,
++ },
++ { /* Init_SR10_SR24 */
++ 0xF3, 0xB6, 0xC0, 0xDD, 0x00, 0x0E, 0x17, 0x2C,
++ 0x99, 0x02, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0xC4, 0x30, 0x02, 0x01, 0x01,
++ },
++ { /* Init_SR30_SR75 */
++ 0x38, 0x03, 0x20, 0x09, 0xC0, 0x3A, 0x3A, 0x3A,
++ 0x3A, 0x3A, 0x3A, 0x3A, 0x00, 0x00, 0x03, 0xFF,
++ 0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC,
++ 0x20, 0x0C, 0x44, 0x20, 0x00, 0x00, 0x00, 0x3A,
++ 0x06, 0x68, 0xA7, 0x7F, 0x83, 0x24, 0xFF, 0x03,
++ 0x0F, 0x60, 0x59, 0x3A, 0x3A, 0x00, 0x00, 0x3A,
++ 0x01, 0x80, 0x7E, 0x1A, 0x1A, 0x00, 0x00, 0x00,
++ 0x50, 0x03, 0x74, 0x14, 0x3B, 0x0D, 0x09, 0x02,
++ 0x04, 0x45, 0x30, 0x30, 0x40, 0x20,
++ },
++ { /* Init_SR80_SR93 */
++ 0xFF, 0x07, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x3A,
++ 0xF7, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x3A, 0x3A,
++ 0x00, 0x00, 0x00, 0x00,
++ },
++ { /* Init_SRA0_SRAF */
++ 0x00, 0xFB, 0x9F, 0x01, 0x00, 0xED, 0xED, 0xED,
++ 0x7B, 0xFB, 0xFF, 0xFF, 0x97, 0xEF, 0xBF, 0xDF,
++ },
++ { /* Init_GR00_GR08 */
++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
++ 0xFF,
++ },
++ { /* Init_AR00_AR14 */
++ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++ 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
++ 0x41, 0x00, 0x0F, 0x00, 0x00,
++ },
++ { /* Init_CR00_CR18 */
++ 0xA3, 0x7F, 0x7F, 0x00, 0x85, 0x16, 0x24, 0xF5,
++ 0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x03, 0x09, 0xFF, 0x80, 0x40, 0xFF, 0x00, 0xE3,
++ 0xFF,
++ },
++ { /* Init_CR30_CR4D */
++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x02, 0x20,
++ 0x00, 0x00, 0x00, 0x40, 0x00, 0xFF, 0xBF, 0xFF,
++ 0xA3, 0x7F, 0x00, 0x86, 0x15, 0x24, 0xFF, 0x00,
++ 0x01, 0x07, 0xE5, 0x20, 0x7F, 0xFF,
++ },
++ { /* Init_CR90_CRA7 */
++ 0x55, 0xD9, 0x5D, 0xE1, 0x86, 0x1B, 0x8E, 0x26,
++ 0xDA, 0x8D, 0xDE, 0x94, 0x00, 0x00, 0x18, 0x00,
++ 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x15, 0x03,
++ },
++ },
+ { /* mode#5: 1024 x 768 24Bpp 60Hz */
+ 1024, 768, 24, 60,
+ /* Init_MISC */
+@@ -827,67 +886,80 @@ static inline unsigned int chan_to_field(unsigned int chan,
+
+ static int smtc_blank(int blank_mode, struct fb_info *info)
+ {
++ struct smtcfb_info *sfb = info->par;
++
+ /* clear DPMS setting */
+ switch (blank_mode) {
+ case FB_BLANK_UNBLANK:
+ /* Screen On: HSync: On, VSync : On */
++
++ switch (sfb->chip_id) {
++ case 0x710:
++ case 0x712:
++ smtc_seqw(0x6a, 0x16);
++ smtc_seqw(0x6b, 0x02);
++ break;
++ case 0x720:
++ smtc_seqw(0x6a, 0x0d);
++ smtc_seqw(0x6b, 0x02);
++ break;
++ }
++
++ smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0)));
+ smtc_seqw(0x01, (smtc_seqr(0x01) & (~0x20)));
+- smtc_seqw(0x6a, 0x16);
+- smtc_seqw(0x6b, 0x02);
+ smtc_seqw(0x21, (smtc_seqr(0x21) & 0x77));
+ smtc_seqw(0x22, (smtc_seqr(0x22) & (~0x30)));
+- smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0)));
+- smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01));
+ smtc_seqw(0x31, (smtc_seqr(0x31) | 0x03));
++ smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01));
+ break;
+ case FB_BLANK_NORMAL:
+ /* Screen Off: HSync: On, VSync : On Soft blank */
++ smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01));
++ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
++ smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0)));
+ smtc_seqw(0x01, (smtc_seqr(0x01) & (~0x20)));
++ smtc_seqw(0x22, (smtc_seqr(0x22) & (~0x30)));
+ smtc_seqw(0x6a, 0x16);
+ smtc_seqw(0x6b, 0x02);
+- smtc_seqw(0x22, (smtc_seqr(0x22) & (~0x30)));
+- smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0)));
+- smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01));
+- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+ break;
+ case FB_BLANK_VSYNC_SUSPEND:
+ /* Screen On: HSync: On, VSync : Off */
++ smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
++ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
++ smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0x20));
+ smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20));
+- smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+- smtc_seqw(0x6a, 0x0c);
+- smtc_seqw(0x6b, 0x02);
+ smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88));
++ smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+ smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x20));
+- smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0x20));
+- smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
+- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+ smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80));
++ smtc_seqw(0x6a, 0x0c);
++ smtc_seqw(0x6b, 0x02);
+ break;
+ case FB_BLANK_HSYNC_SUSPEND:
+ /* Screen On: HSync: Off, VSync : On */
++ smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
++ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
++ smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8));
+ smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20));
+- smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+- smtc_seqw(0x6a, 0x0c);
+- smtc_seqw(0x6b, 0x02);
+ smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88));
++ smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+ smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x10));
+- smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8));
+- smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
+- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+ smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80));
++ smtc_seqw(0x6a, 0x0c);
++ smtc_seqw(0x6b, 0x02);
+ break;
+ case FB_BLANK_POWERDOWN:
+ /* Screen On: HSync: Off, VSync : Off */
++ smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
++ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
++ smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8));
+ smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20));
+- smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+- smtc_seqw(0x6a, 0x0c);
+- smtc_seqw(0x6b, 0x02);
+ smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88));
++ smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+ smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x30));
+- smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8));
+- smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
+- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+ smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80));
++ smtc_seqw(0x6a, 0x0c);
++ smtc_seqw(0x6b, 0x02);
+ break;
+ default:
+ return -EINVAL;
+@@ -1145,8 +1217,10 @@ static void sm7xx_set_timing(struct smtcfb_info *sfb)
+
+ /* init SEQ register SR30 - SR75 */
+ for (i = 0; i < SIZE_SR30_SR75; i++)
+- if ((i + 0x30) != 0x62 && (i + 0x30) != 0x6a &&
+- (i + 0x30) != 0x6b)
++ if ((i + 0x30) != 0x30 && (i + 0x30) != 0x62 &&
++ (i + 0x30) != 0x6a && (i + 0x30) != 0x6b &&
++ (i + 0x30) != 0x70 && (i + 0x30) != 0x71 &&
++ (i + 0x30) != 0x74 && (i + 0x30) != 0x75)
+ smtc_seqw(i + 0x30,
+ vgamode[j].init_sr30_sr75[i]);
+
+@@ -1171,8 +1245,12 @@ static void sm7xx_set_timing(struct smtcfb_info *sfb)
+ smtc_crtcw(i, vgamode[j].init_cr00_cr18[i]);
+
+ /* init CRTC register CR30 - CR4D */
+- for (i = 0; i < SIZE_CR30_CR4D; i++)
++ for (i = 0; i < SIZE_CR30_CR4D; i++) {
++ if ((i + 0x30) >= 0x3B && (i + 0x30) <= 0x3F)
++ /* side-effect, don't write to CR3B-CR3F */
++ continue;
+ smtc_crtcw(i + 0x30, vgamode[j].init_cr30_cr4d[i]);
++ }
+
+ /* init CRTC register CR90 - CRA7 */
+ for (i = 0; i < SIZE_CR90_CRA7; i++)
+@@ -1323,6 +1401,11 @@ static int smtc_map_smem(struct smtcfb_info *sfb,
+ {
+ sfb->fb->fix.smem_start = pci_resource_start(pdev, 0);
+
++ if (sfb->chip_id == 0x720)
++ /* on SM720, the framebuffer starts at the 1 MB offset */
++ sfb->fb->fix.smem_start += 0x00200000;
++
++ /* XXX: is it safe for SM720 on Big-Endian? */
+ if (sfb->fb->var.bits_per_pixel == 32)
+ sfb->fb->fix.smem_start += big_addr;
+
+@@ -1360,12 +1443,82 @@ static inline void sm7xx_init_hw(void)
+ outb_p(0x11, 0x3c5);
+ }
+
++static u_long sm7xx_vram_probe(struct smtcfb_info *sfb)
++{
++ u8 vram;
++
++ switch (sfb->chip_id) {
++ case 0x710:
++ case 0x712:
++ /*
++ * Assume SM712 graphics chip has 4MB VRAM.
++ *
++ * FIXME: SM712 can have 2MB VRAM, which is used on earlier
++ * laptops, such as IBM Thinkpad 240X. This driver would
++ * probably crash on those machines. If anyone gets one of
++ * those and is willing to help, run "git blame" and send me
++ * an E-mail.
++ */
++ return 0x00400000;
++ case 0x720:
++ outb_p(0x76, 0x3c4);
++ vram = inb_p(0x3c5) >> 6;
++
++ if (vram == 0x00)
++ return 0x00800000; /* 8 MB */
++ else if (vram == 0x01)
++ return 0x01000000; /* 16 MB */
++ else if (vram == 0x02)
++ return 0x00400000; /* illegal, fallback to 4 MB */
++ else if (vram == 0x03)
++ return 0x00400000; /* 4 MB */
++ }
++ return 0; /* unknown hardware */
++}
++
++static void sm7xx_resolution_probe(struct smtcfb_info *sfb)
++{
++ /* get mode parameter from smtc_scr_info */
++ if (smtc_scr_info.lfb_width != 0) {
++ sfb->fb->var.xres = smtc_scr_info.lfb_width;
++ sfb->fb->var.yres = smtc_scr_info.lfb_height;
++ sfb->fb->var.bits_per_pixel = smtc_scr_info.lfb_depth;
++ goto final;
++ }
++
++ /*
++ * No parameter, default resolution is 1024x768-16.
++ *
++ * FIXME: earlier laptops, such as IBM Thinkpad 240X, has a 800x600
++ * panel, also see the comments about Thinkpad 240X above.
++ */
++ sfb->fb->var.xres = SCREEN_X_RES;
++ sfb->fb->var.yres = SCREEN_Y_RES_PC;
++ sfb->fb->var.bits_per_pixel = SCREEN_BPP;
++
++#ifdef CONFIG_MIPS
++ /*
++ * Loongson MIPS netbooks use 1024x600 LCD panels, which is the original
++ * target platform of this driver, but nearly all old x86 laptops have
++ * 1024x768. Lighting 768 panels using 600's timings would partially
++ * garble the display, so we don't want that. But it's not possible to
++ * distinguish them reliably.
++ *
++ * So we change the default to 768, but keep 600 as-is on MIPS.
++ */
++ sfb->fb->var.yres = SCREEN_Y_RES_NETBOOK;
++#endif
++
++final:
++ big_pixel_depth(sfb->fb->var.bits_per_pixel, smtc_scr_info.lfb_depth);
++}
++
+ static int smtcfb_pci_probe(struct pci_dev *pdev,
+ const struct pci_device_id *ent)
+ {
+ struct smtcfb_info *sfb;
+ struct fb_info *info;
+- u_long smem_size = 0x00800000; /* default 8MB */
++ u_long smem_size;
+ int err;
+ unsigned long mmio_base;
+
+@@ -1405,29 +1558,19 @@ static int smtcfb_pci_probe(struct pci_dev *pdev,
+
+ sm7xx_init_hw();
+
+- /* get mode parameter from smtc_scr_info */
+- if (smtc_scr_info.lfb_width != 0) {
+- sfb->fb->var.xres = smtc_scr_info.lfb_width;
+- sfb->fb->var.yres = smtc_scr_info.lfb_height;
+- sfb->fb->var.bits_per_pixel = smtc_scr_info.lfb_depth;
+- } else {
+- /* default resolution 1024x600 16bit mode */
+- sfb->fb->var.xres = SCREEN_X_RES;
+- sfb->fb->var.yres = SCREEN_Y_RES;
+- sfb->fb->var.bits_per_pixel = SCREEN_BPP;
+- }
+-
+- big_pixel_depth(sfb->fb->var.bits_per_pixel, smtc_scr_info.lfb_depth);
+ /* Map address and memory detection */
+ mmio_base = pci_resource_start(pdev, 0);
+ pci_read_config_byte(pdev, PCI_REVISION_ID, &sfb->chip_rev_id);
+
++ smem_size = sm7xx_vram_probe(sfb);
++ dev_info(&pdev->dev, "%lu MiB of VRAM detected.\n",
++ smem_size / 1048576);
++
+ switch (sfb->chip_id) {
+ case 0x710:
+ case 0x712:
+ sfb->fb->fix.mmio_start = mmio_base + 0x00400000;
+ sfb->fb->fix.mmio_len = 0x00400000;
+- smem_size = SM712_VIDEOMEMORYSIZE;
+ sfb->lfb = ioremap(mmio_base, mmio_addr);
+ if (!sfb->lfb) {
+ dev_err(&pdev->dev,
+@@ -1459,8 +1602,7 @@ static int smtcfb_pci_probe(struct pci_dev *pdev,
+ case 0x720:
+ sfb->fb->fix.mmio_start = mmio_base;
+ sfb->fb->fix.mmio_len = 0x00200000;
+- smem_size = SM722_VIDEOMEMORYSIZE;
+- sfb->dp_regs = ioremap(mmio_base, 0x00a00000);
++ sfb->dp_regs = ioremap(mmio_base, 0x00200000 + smem_size);
+ sfb->lfb = sfb->dp_regs + 0x00200000;
+ sfb->mmio = (smtc_regbaseaddress =
+ sfb->dp_regs + 0x000c0000);
+@@ -1477,6 +1619,9 @@ static int smtcfb_pci_probe(struct pci_dev *pdev,
+ goto failed_fb;
+ }
+
++ /* probe and decide resolution */
++ sm7xx_resolution_probe(sfb);
++
+ /* can support 32 bpp */
+ if (sfb->fb->var.bits_per_pixel == 15)
+ sfb->fb->var.bits_per_pixel = 16;
+@@ -1487,7 +1632,11 @@ static int smtcfb_pci_probe(struct pci_dev *pdev,
+ if (err)
+ goto failed;
+
+- smtcfb_setmode(sfb);
++ /*
++ * The screen would be temporarily garbled when sm712fb takes over
++ * vesafb or VGA text mode. Zero the framebuffer.
++ */
++ memset_io(sfb->lfb, 0, sfb->fb->fix.smem_len);
+
+ err = register_framebuffer(info);
+ if (err < 0)
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index 070026a7e55a..2001910fd241 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -594,8 +594,7 @@ static int dlfb_render_hline(struct dlfb_data *dlfb, struct urb **urb_ptr,
+ return 0;
+ }
+
+-static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y,
+- int width, int height, char *data)
++static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
+ {
+ int i, ret;
+ char *cmd;
+@@ -607,21 +606,29 @@ static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y,
+
+ start_cycles = get_cycles();
+
++ mutex_lock(&dlfb->render_mutex);
++
+ aligned_x = DL_ALIGN_DOWN(x, sizeof(unsigned long));
+ width = DL_ALIGN_UP(width + (x-aligned_x), sizeof(unsigned long));
+ x = aligned_x;
+
+ if ((width <= 0) ||
+ (x + width > dlfb->info->var.xres) ||
+- (y + height > dlfb->info->var.yres))
+- return -EINVAL;
++ (y + height > dlfb->info->var.yres)) {
++ ret = -EINVAL;
++ goto unlock_ret;
++ }
+
+- if (!atomic_read(&dlfb->usb_active))
+- return 0;
++ if (!atomic_read(&dlfb->usb_active)) {
++ ret = 0;
++ goto unlock_ret;
++ }
+
+ urb = dlfb_get_urb(dlfb);
+- if (!urb)
+- return 0;
++ if (!urb) {
++ ret = 0;
++ goto unlock_ret;
++ }
+ cmd = urb->transfer_buffer;
+
+ for (i = y; i < y + height ; i++) {
+@@ -641,7 +648,7 @@ static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y,
+ *cmd++ = 0xAF;
+ /* Send partial buffer remaining before exiting */
+ len = cmd - (char *) urb->transfer_buffer;
+- ret = dlfb_submit_urb(dlfb, urb, len);
++ dlfb_submit_urb(dlfb, urb, len);
+ bytes_sent += len;
+ } else
+ dlfb_urb_completion(urb);
+@@ -655,7 +662,55 @@ error:
+ >> 10)), /* Kcycles */
+ &dlfb->cpu_kcycles_used);
+
+- return 0;
++ ret = 0;
++
++unlock_ret:
++ mutex_unlock(&dlfb->render_mutex);
++ return ret;
++}
++
++static void dlfb_init_damage(struct dlfb_data *dlfb)
++{
++ dlfb->damage_x = INT_MAX;
++ dlfb->damage_x2 = 0;
++ dlfb->damage_y = INT_MAX;
++ dlfb->damage_y2 = 0;
++}
++
++static void dlfb_damage_work(struct work_struct *w)
++{
++ struct dlfb_data *dlfb = container_of(w, struct dlfb_data, damage_work);
++ int x, x2, y, y2;
++
++ spin_lock_irq(&dlfb->damage_lock);
++ x = dlfb->damage_x;
++ x2 = dlfb->damage_x2;
++ y = dlfb->damage_y;
++ y2 = dlfb->damage_y2;
++ dlfb_init_damage(dlfb);
++ spin_unlock_irq(&dlfb->damage_lock);
++
++ if (x < x2 && y < y2)
++ dlfb_handle_damage(dlfb, x, y, x2 - x, y2 - y);
++}
++
++static void dlfb_offload_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
++{
++ unsigned long flags;
++ int x2 = x + width;
++ int y2 = y + height;
++
++ if (x >= x2 || y >= y2)
++ return;
++
++ spin_lock_irqsave(&dlfb->damage_lock, flags);
++ dlfb->damage_x = min(x, dlfb->damage_x);
++ dlfb->damage_x2 = max(x2, dlfb->damage_x2);
++ dlfb->damage_y = min(y, dlfb->damage_y);
++ dlfb->damage_y2 = max(y2, dlfb->damage_y2);
++ spin_unlock_irqrestore(&dlfb->damage_lock, flags);
++
++ schedule_work(&dlfb->damage_work);
+ }
+
+ /*
+@@ -679,7 +734,7 @@ static ssize_t dlfb_ops_write(struct fb_info *info, const char __user *buf,
+ (u32)info->var.yres);
+
+ dlfb_handle_damage(dlfb, 0, start, info->var.xres,
+- lines, info->screen_base);
++ lines);
+ }
+
+ return result;
+@@ -694,8 +749,8 @@ static void dlfb_ops_copyarea(struct fb_info *info,
+
+ sys_copyarea(info, area);
+
+- dlfb_handle_damage(dlfb, area->dx, area->dy,
+- area->width, area->height, info->screen_base);
++ dlfb_offload_damage(dlfb, area->dx, area->dy,
++ area->width, area->height);
+ }
+
+ static void dlfb_ops_imageblit(struct fb_info *info,
+@@ -705,8 +760,8 @@ static void dlfb_ops_imageblit(struct fb_info *info,
+
+ sys_imageblit(info, image);
+
+- dlfb_handle_damage(dlfb, image->dx, image->dy,
+- image->width, image->height, info->screen_base);
++ dlfb_offload_damage(dlfb, image->dx, image->dy,
++ image->width, image->height);
+ }
+
+ static void dlfb_ops_fillrect(struct fb_info *info,
+@@ -716,8 +771,8 @@ static void dlfb_ops_fillrect(struct fb_info *info,
+
+ sys_fillrect(info, rect);
+
+- dlfb_handle_damage(dlfb, rect->dx, rect->dy, rect->width,
+- rect->height, info->screen_base);
++ dlfb_offload_damage(dlfb, rect->dx, rect->dy, rect->width,
++ rect->height);
+ }
+
+ /*
+@@ -739,17 +794,19 @@ static void dlfb_dpy_deferred_io(struct fb_info *info,
+ int bytes_identical = 0;
+ int bytes_rendered = 0;
+
++ mutex_lock(&dlfb->render_mutex);
++
+ if (!fb_defio)
+- return;
++ goto unlock_ret;
+
+ if (!atomic_read(&dlfb->usb_active))
+- return;
++ goto unlock_ret;
+
+ start_cycles = get_cycles();
+
+ urb = dlfb_get_urb(dlfb);
+ if (!urb)
+- return;
++ goto unlock_ret;
+
+ cmd = urb->transfer_buffer;
+
+@@ -782,6 +839,8 @@ error:
+ atomic_add(((unsigned int) ((end_cycles - start_cycles)
+ >> 10)), /* Kcycles */
+ &dlfb->cpu_kcycles_used);
++unlock_ret:
++ mutex_unlock(&dlfb->render_mutex);
+ }
+
+ static int dlfb_get_edid(struct dlfb_data *dlfb, char *edid, int len)
+@@ -859,8 +918,7 @@ static int dlfb_ops_ioctl(struct fb_info *info, unsigned int cmd,
+ if (area.y > info->var.yres)
+ area.y = info->var.yres;
+
+- dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h,
+- info->screen_base);
++ dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h);
+ }
+
+ return 0;
+@@ -942,6 +1000,10 @@ static void dlfb_ops_destroy(struct fb_info *info)
+ {
+ struct dlfb_data *dlfb = info->par;
+
++ cancel_work_sync(&dlfb->damage_work);
++
++ mutex_destroy(&dlfb->render_mutex);
++
+ if (info->cmap.len != 0)
+ fb_dealloc_cmap(&info->cmap);
+ if (info->monspecs.modedb)
+@@ -1065,8 +1127,7 @@ static int dlfb_ops_set_par(struct fb_info *info)
+ pix_framebuffer[i] = 0x37e6;
+ }
+
+- dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres,
+- info->screen_base);
++ dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres);
+
+ return 0;
+ }
+@@ -1639,6 +1700,11 @@ static int dlfb_usb_probe(struct usb_interface *intf,
+ dlfb->ops = dlfb_ops;
+ info->fbops = &dlfb->ops;
+
++ mutex_init(&dlfb->render_mutex);
++ dlfb_init_damage(dlfb);
++ spin_lock_init(&dlfb->damage_lock);
++ INIT_WORK(&dlfb->damage_work, dlfb_damage_work);
++
+ INIT_LIST_HEAD(&info->modelist);
+
+ if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index eab1359d0553..c5cf46e43f2e 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -819,6 +819,12 @@ static void ceph_umount_begin(struct super_block *sb)
+ return;
+ }
+
++static int ceph_remount(struct super_block *sb, int *flags, char *data)
++{
++ sync_filesystem(sb);
++ return 0;
++}
++
+ static const struct super_operations ceph_super_ops = {
+ .alloc_inode = ceph_alloc_inode,
+ .destroy_inode = ceph_destroy_inode,
+@@ -826,6 +832,7 @@ static const struct super_operations ceph_super_ops = {
+ .drop_inode = ceph_drop_inode,
+ .sync_fs = ceph_sync_fs,
+ .put_super = ceph_put_super,
++ .remount_fs = ceph_remount,
+ .show_options = ceph_show_options,
+ .statfs = ceph_statfs,
+ .umount_begin = ceph_umount_begin,
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 2001184afe70..0ccf8f9b63a2 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2348,26 +2348,28 @@ smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
+ unsigned int epoch, bool *purge_cache)
+ {
+ char message[5] = {0};
++ unsigned int new_oplock = 0;
+
+ oplock &= 0xFF;
+ if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE)
+ return;
+
+- cinode->oplock = 0;
+ if (oplock & SMB2_LEASE_READ_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_READ_FLG;
++ new_oplock |= CIFS_CACHE_READ_FLG;
+ strcat(message, "R");
+ }
+ if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_HANDLE_FLG;
++ new_oplock |= CIFS_CACHE_HANDLE_FLG;
+ strcat(message, "H");
+ }
+ if (oplock & SMB2_LEASE_WRITE_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_WRITE_FLG;
++ new_oplock |= CIFS_CACHE_WRITE_FLG;
+ strcat(message, "W");
+ }
+- if (!cinode->oplock)
+- strcat(message, "None");
++ if (!new_oplock)
++ strncpy(message, "None", sizeof(message));
++
++ cinode->oplock = new_oplock;
+ cifs_dbg(FYI, "%s Lease granted on inode %p\n", message,
+ &cinode->vfs_inode);
+ }
+diff --git a/fs/dcache.c b/fs/dcache.c
+index cb515f183482..6e0022326afe 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -344,7 +344,7 @@ static void dentry_free(struct dentry *dentry)
+ }
+ }
+ /* if dentry was never visible to RCU, immediate free is OK */
+- if (!(dentry->d_flags & DCACHE_RCUACCESS))
++ if (dentry->d_flags & DCACHE_NORCU)
+ __d_free(&dentry->d_u.d_rcu);
+ else
+ call_rcu(&dentry->d_u.d_rcu, __d_free);
+@@ -1694,7 +1694,6 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
+ struct dentry *dentry = __d_alloc(parent->d_sb, name);
+ if (!dentry)
+ return NULL;
+- dentry->d_flags |= DCACHE_RCUACCESS;
+ spin_lock(&parent->d_lock);
+ /*
+ * don't need child lock because it is not subject
+@@ -1719,7 +1718,7 @@ struct dentry *d_alloc_cursor(struct dentry * parent)
+ {
+ struct dentry *dentry = d_alloc_anon(parent->d_sb);
+ if (dentry) {
+- dentry->d_flags |= DCACHE_RCUACCESS | DCACHE_DENTRY_CURSOR;
++ dentry->d_flags |= DCACHE_DENTRY_CURSOR;
+ dentry->d_parent = dget(parent);
+ }
+ return dentry;
+@@ -1732,10 +1731,17 @@ struct dentry *d_alloc_cursor(struct dentry * parent)
+ *
+ * For a filesystem that just pins its dentries in memory and never
+ * performs lookups at all, return an unhashed IS_ROOT dentry.
++ * This is used for pipes, sockets et.al. - the stuff that should
++ * never be anyone's children or parents. Unlike all other
++ * dentries, these will not have RCU delay between dropping the
++ * last reference and freeing them.
+ */
+ struct dentry *d_alloc_pseudo(struct super_block *sb, const struct qstr *name)
+ {
+- return __d_alloc(sb, name);
++ struct dentry *dentry = __d_alloc(sb, name);
++ if (likely(dentry))
++ dentry->d_flags |= DCACHE_NORCU;
++ return dentry;
+ }
+ EXPORT_SYMBOL(d_alloc_pseudo);
+
+@@ -1899,12 +1905,10 @@ struct dentry *d_make_root(struct inode *root_inode)
+
+ if (root_inode) {
+ res = d_alloc_anon(root_inode->i_sb);
+- if (res) {
+- res->d_flags |= DCACHE_RCUACCESS;
++ if (res)
+ d_instantiate(res, root_inode);
+- } else {
++ else
+ iput(root_inode);
+- }
+ }
+ return res;
+ }
+@@ -2769,9 +2773,7 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
+ copy_name(dentry, target);
+ target->d_hash.pprev = NULL;
+ dentry->d_parent->d_lockref.count++;
+- if (dentry == old_parent)
+- dentry->d_flags |= DCACHE_RCUACCESS;
+- else
++ if (dentry != old_parent) /* wasn't IS_ROOT */
+ WARN_ON(!--old_parent->d_lockref.count);
+ } else {
+ target->d_parent = old_parent;
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index bd500c3b7858..59e8bb72dc14 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -179,7 +179,9 @@ void fuse_finish_open(struct inode *inode, struct file *file)
+ file->f_op = &fuse_direct_io_file_operations;
+ if (!(ff->open_flags & FOPEN_KEEP_CACHE))
+ invalidate_inode_pages2(inode->i_mapping);
+- if (ff->open_flags & FOPEN_NONSEEKABLE)
++ if (ff->open_flags & FOPEN_STREAM)
++ stream_open(inode, file);
++ else if (ff->open_flags & FOPEN_NONSEEKABLE)
+ nonseekable_open(inode, file);
+ if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) {
+ struct fuse_inode *fi = get_fuse_inode(inode);
+@@ -1526,7 +1528,7 @@ __acquires(fc->lock)
+ {
+ struct fuse_conn *fc = get_fuse_conn(inode);
+ struct fuse_inode *fi = get_fuse_inode(inode);
+- size_t crop = i_size_read(inode);
++ loff_t crop = i_size_read(inode);
+ struct fuse_req *req;
+
+ while (fi->writectr >= 0 && !list_empty(&fi->queued_writes)) {
+@@ -2975,6 +2977,13 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
+ }
+ }
+
++ if (!(mode & FALLOC_FL_KEEP_SIZE) &&
++ offset + length > i_size_read(inode)) {
++ err = inode_newsize_ok(inode, offset + length);
++ if (err)
++ return err;
++ }
++
+ if (!(mode & FALLOC_FL_KEEP_SIZE))
+ set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+
+diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
+index d175724ff566..2478a69da0f0 100644
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -904,7 +904,7 @@ fl_pnfs_update_layout(struct inode *ino,
+ status = filelayout_check_deviceid(lo, fl, gfp_flags);
+ if (status) {
+ pnfs_put_lseg(lseg);
+- lseg = ERR_PTR(status);
++ lseg = NULL;
+ }
+ out:
+ return lseg;
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index d2f645d34eb1..3ba2087469ac 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -159,6 +159,10 @@ int nfs40_discover_server_trunking(struct nfs_client *clp,
+ /* Sustain the lease, even if it's empty. If the clientid4
+ * goes stale it's of no use for trunking discovery. */
+ nfs4_schedule_state_renewal(*result);
++
++ /* If the client state need to recover, do it. */
++ if (clp->cl_state)
++ nfs4_schedule_state_manager(clp);
+ }
+ out:
+ return status;
+diff --git a/fs/nsfs.c b/fs/nsfs.c
+index 60702d677bd4..30d150a4f0c6 100644
+--- a/fs/nsfs.c
++++ b/fs/nsfs.c
+@@ -85,13 +85,12 @@ slow:
+ inode->i_fop = &ns_file_operations;
+ inode->i_private = ns;
+
+- dentry = d_alloc_pseudo(mnt->mnt_sb, &empty_name);
++ dentry = d_alloc_anon(mnt->mnt_sb);
+ if (!dentry) {
+ iput(inode);
+ return ERR_PTR(-ENOMEM);
+ }
+ d_instantiate(dentry, inode);
+- dentry->d_flags |= DCACHE_RCUACCESS;
+ dentry->d_fsdata = (void *)ns->ops;
+ d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
+ if (d) {
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 75eeee08d848..ffc73600216b 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -878,14 +878,14 @@ static bool ovl_open_need_copy_up(struct dentry *dentry, int flags)
+ return true;
+ }
+
+-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags)
++int ovl_maybe_copy_up(struct dentry *dentry, int flags)
+ {
+ int err = 0;
+
+- if (ovl_open_need_copy_up(dentry, file_flags)) {
++ if (ovl_open_need_copy_up(dentry, flags)) {
+ err = ovl_want_write(dentry);
+ if (!err) {
+- err = ovl_copy_up_flags(dentry, file_flags);
++ err = ovl_copy_up_flags(dentry, flags);
+ ovl_drop_write(dentry);
+ }
+ }
+diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
+index 986313da0c88..0c810f20f778 100644
+--- a/fs/overlayfs/file.c
++++ b/fs/overlayfs/file.c
+@@ -116,11 +116,10 @@ static int ovl_real_fdget(const struct file *file, struct fd *real)
+
+ static int ovl_open(struct inode *inode, struct file *file)
+ {
+- struct dentry *dentry = file_dentry(file);
+ struct file *realfile;
+ int err;
+
+- err = ovl_open_maybe_copy_up(dentry, file->f_flags);
++ err = ovl_maybe_copy_up(file_dentry(file), file->f_flags);
+ if (err)
+ return err;
+
+@@ -390,7 +389,7 @@ static long ovl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ if (ret)
+ return ret;
+
+- ret = ovl_copy_up_with_data(file_dentry(file));
++ ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY);
+ if (!ret) {
+ ret = ovl_real_ioctl(file, cmd, arg);
+
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index d9c16ceebfe7..80fb66426760 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -411,7 +411,7 @@ extern const struct file_operations ovl_file_operations;
+ int ovl_copy_up(struct dentry *dentry);
+ int ovl_copy_up_with_data(struct dentry *dentry);
+ int ovl_copy_up_flags(struct dentry *dentry, int flags);
+-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags);
++int ovl_maybe_copy_up(struct dentry *dentry, int flags);
+ int ovl_copy_xattr(struct dentry *old, struct dentry *new);
+ int ovl_set_attr(struct dentry *upper, struct kstat *stat);
+ struct ovl_fh *ovl_encode_real_fh(struct dentry *real, bool is_upper);
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 81d77b15b347..f999e8bd3771 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2542,6 +2542,11 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
+ rcu_read_unlock();
+ return -EACCES;
+ }
++ /* Prevent changes to overridden credentials. */
++ if (current_cred() != current_real_cred()) {
++ rcu_read_unlock();
++ return -EBUSY;
++ }
+ rcu_read_unlock();
+
+ if (count > PAGE_SIZE)
+diff --git a/fs/ufs/util.h b/fs/ufs/util.h
+index 1fd3011ea623..7fd4802222b8 100644
+--- a/fs/ufs/util.h
++++ b/fs/ufs/util.h
+@@ -229,7 +229,7 @@ ufs_get_inode_gid(struct super_block *sb, struct ufs_inode *inode)
+ case UFS_UID_44BSD:
+ return fs32_to_cpu(sb, inode->ui_u3.ui_44.ui_gid);
+ case UFS_UID_EFT:
+- if (inode->ui_u1.oldids.ui_suid == 0xFFFF)
++ if (inode->ui_u1.oldids.ui_sgid == 0xFFFF)
+ return fs32_to_cpu(sb, inode->ui_u3.ui_sun.ui_gid);
+ /* Fall through */
+ default:
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 523481a3471b..16f6beef5cad 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -34,6 +34,7 @@ struct bpf_map_ops {
+ void (*map_free)(struct bpf_map *map);
+ int (*map_get_next_key)(struct bpf_map *map, void *key, void *next_key);
+ void (*map_release_uref)(struct bpf_map *map);
++ void *(*map_lookup_elem_sys_only)(struct bpf_map *map, void *key);
+
+ /* funcs callable from userspace and from eBPF programs */
+ void *(*map_lookup_elem)(struct bpf_map *map, void *key);
+@@ -400,7 +401,7 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
+ } \
+ _out: \
+ rcu_read_unlock(); \
+- preempt_enable_no_resched(); \
++ preempt_enable(); \
+ _ret; \
+ })
+
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index ef4b70f64f33..0880baefd85f 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -175,7 +175,6 @@ struct dentry_operations {
+ * typically using d_splice_alias. */
+
+ #define DCACHE_REFERENCED 0x00000040 /* Recently used, don't discard. */
+-#define DCACHE_RCUACCESS 0x00000080 /* Entry has ever been RCU-visible */
+
+ #define DCACHE_CANT_MOUNT 0x00000100
+ #define DCACHE_GENOCIDE 0x00000200
+@@ -216,6 +215,7 @@ struct dentry_operations {
+
+ #define DCACHE_PAR_LOOKUP 0x10000000 /* being looked up (with parent locked shared) */
+ #define DCACHE_DENTRY_CURSOR 0x20000000
++#define DCACHE_NORCU 0x40000000 /* No RCU delay for freeing */
+
+ extern seqlock_t rename_lock;
+
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 40e58b0e9cf4..f2c80cc4641d 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -236,8 +236,8 @@ extern struct device_node *of_find_all_nodes(struct device_node *prev);
+ static inline u64 of_read_number(const __be32 *cell, int size)
+ {
+ u64 r = 0;
+- while (size--)
+- r = (r << 32) | be32_to_cpu(*(cell++));
++ for (; size--; cell++)
++ r = (r << 32) | be32_to_cpu(*cell);
+ return r;
+ }
+
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 6925828f9f25..b1f297f4b7b0 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -346,6 +346,8 @@ struct pci_dev {
+ unsigned int hotplug_user_indicators:1; /* SlotCtl indicators
+ controlled exclusively by
+ user sysfs */
++ unsigned int clear_retrain_link:1; /* Need to clear Retrain Link
++ bit manually */
+ unsigned int d3_delay; /* D3->D0 transition time in ms */
+ unsigned int d3cold_delay; /* D3cold->D0 transition time in ms */
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 820903ceac4f..28baccb1efd5 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1333,10 +1333,12 @@ static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
+ struct ubuf_info *uarg = skb_zcopy(skb);
+
+ if (uarg) {
+- if (uarg->callback == sock_zerocopy_callback) {
++ if (skb_zcopy_is_nouarg(skb)) {
++ /* no notification callback */
++ } else if (uarg->callback == sock_zerocopy_callback) {
+ uarg->zerocopy = uarg->zerocopy && zerocopy;
+ sock_zerocopy_put(uarg);
+- } else if (!skb_zcopy_is_nouarg(skb)) {
++ } else {
+ uarg->callback(uarg, zerocopy);
+ }
+
+@@ -2587,7 +2589,8 @@ static inline int skb_orphan_frags(struct sk_buff *skb, gfp_t gfp_mask)
+ {
+ if (likely(!skb_zcopy(skb)))
+ return 0;
+- if (skb_uarg(skb)->callback == sock_zerocopy_callback)
++ if (!skb_zcopy_is_nouarg(skb) &&
++ skb_uarg(skb)->callback == sock_zerocopy_callback)
+ return 0;
+ return skb_copy_ubufs(skb, gfp_mask);
+ }
+diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
+index 2d31e22babd8..983f7a1a3f1d 100644
+--- a/include/net/ip6_fib.h
++++ b/include/net/ip6_fib.h
+@@ -171,7 +171,8 @@ struct fib6_info {
+ dst_nocount:1,
+ dst_nopolicy:1,
+ dst_host:1,
+- unused:3;
++ fib6_destroying:1,
++ unused:2;
+
+ struct fib6_nh fib6_nh;
+ struct rcu_head rcu;
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index 5e3daf53b3d1..4ddd2b13ac8d 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -295,7 +295,8 @@ struct xfrm_replay {
+ };
+
+ struct xfrm_if_cb {
+- struct xfrm_if *(*decode_session)(struct sk_buff *skb);
++ struct xfrm_if *(*decode_session)(struct sk_buff *skb,
++ unsigned short family);
+ };
+
+ void xfrm_if_register_cb(const struct xfrm_if_cb *ifcb);
+@@ -1430,6 +1431,23 @@ static inline int xfrm_state_kern(const struct xfrm_state *x)
+ return atomic_read(&x->tunnel_users);
+ }
+
++static inline bool xfrm_id_proto_valid(u8 proto)
++{
++ switch (proto) {
++ case IPPROTO_AH:
++ case IPPROTO_ESP:
++ case IPPROTO_COMP:
++#if IS_ENABLED(CONFIG_IPV6)
++ case IPPROTO_ROUTING:
++ case IPPROTO_DSTOPTS:
++#endif
++ return true;
++ default:
++ return false;
++ }
++}
++
++/* IPSEC_PROTO_ANY only matches 3 IPsec protocols, 0 could match all. */
+ static inline int xfrm_id_proto_match(u8 proto, u8 userproto)
+ {
+ return (!userproto || proto == userproto ||
+diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h
+index 92fa24c24c92..2170e58a2a97 100644
+--- a/include/uapi/linux/fuse.h
++++ b/include/uapi/linux/fuse.h
+@@ -219,10 +219,12 @@ struct fuse_file_lock {
+ * FOPEN_DIRECT_IO: bypass page cache for this open file
+ * FOPEN_KEEP_CACHE: don't invalidate the data cache on open
+ * FOPEN_NONSEEKABLE: the file is not seekable
++ * FOPEN_STREAM: the file is stream-like (no file position at all)
+ */
+ #define FOPEN_DIRECT_IO (1 << 0)
+ #define FOPEN_KEEP_CACHE (1 << 1)
+ #define FOPEN_NONSEEKABLE (1 << 2)
++#define FOPEN_STREAM (1 << 4)
+
+ /**
+ * INIT request/reply flags
+diff --git a/include/video/udlfb.h b/include/video/udlfb.h
+index 7d09e54ae54e..58fb5732831a 100644
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -48,6 +48,13 @@ struct dlfb_data {
+ int base8;
+ u32 pseudo_palette[256];
+ int blank_mode; /*one of FB_BLANK_ */
++ struct mutex render_mutex;
++ int damage_x;
++ int damage_y;
++ int damage_x2;
++ int damage_y2;
++ spinlock_t damage_lock;
++ struct work_struct damage_work;
+ struct fb_ops ops;
+ /* blit-only rendering path metrics, exposed through sysfs */
+ atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index cebadd6af4d9..6fe72792312d 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -518,18 +518,30 @@ static u32 htab_map_gen_lookup(struct bpf_map *map, struct bpf_insn *insn_buf)
+ return insn - insn_buf;
+ }
+
+-static void *htab_lru_map_lookup_elem(struct bpf_map *map, void *key)
++static __always_inline void *__htab_lru_map_lookup_elem(struct bpf_map *map,
++ void *key, const bool mark)
+ {
+ struct htab_elem *l = __htab_map_lookup_elem(map, key);
+
+ if (l) {
+- bpf_lru_node_set_ref(&l->lru_node);
++ if (mark)
++ bpf_lru_node_set_ref(&l->lru_node);
+ return l->key + round_up(map->key_size, 8);
+ }
+
+ return NULL;
+ }
+
++static void *htab_lru_map_lookup_elem(struct bpf_map *map, void *key)
++{
++ return __htab_lru_map_lookup_elem(map, key, true);
++}
++
++static void *htab_lru_map_lookup_elem_sys(struct bpf_map *map, void *key)
++{
++ return __htab_lru_map_lookup_elem(map, key, false);
++}
++
+ static u32 htab_lru_map_gen_lookup(struct bpf_map *map,
+ struct bpf_insn *insn_buf)
+ {
+@@ -1206,6 +1218,7 @@ const struct bpf_map_ops htab_lru_map_ops = {
+ .map_free = htab_map_free,
+ .map_get_next_key = htab_map_get_next_key,
+ .map_lookup_elem = htab_lru_map_lookup_elem,
++ .map_lookup_elem_sys_only = htab_lru_map_lookup_elem_sys,
+ .map_update_elem = htab_lru_map_update_elem,
+ .map_delete_elem = htab_lru_map_delete_elem,
+ .map_gen_lookup = htab_lru_map_gen_lookup,
+@@ -1237,7 +1250,6 @@ static void *htab_lru_percpu_map_lookup_elem(struct bpf_map *map, void *key)
+
+ int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value)
+ {
+- struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
+ struct htab_elem *l;
+ void __percpu *pptr;
+ int ret = -ENOENT;
+@@ -1253,8 +1265,9 @@ int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value)
+ l = __htab_map_lookup_elem(map, key);
+ if (!l)
+ goto out;
+- if (htab_is_lru(htab))
+- bpf_lru_node_set_ref(&l->lru_node);
++ /* We do not mark LRU map element here in order to not mess up
++ * eviction heuristics when user space does a map walk.
++ */
+ pptr = htab_elem_get_ptr(l, map->key_size);
+ for_each_possible_cpu(cpu) {
+ bpf_long_memcpy(value + off,
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index 4a8f390a2b82..dc9d7ac8228d 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -518,7 +518,7 @@ out:
+ static struct bpf_prog *__get_prog_inode(struct inode *inode, enum bpf_prog_type type)
+ {
+ struct bpf_prog *prog;
+- int ret = inode_permission(inode, MAY_READ | MAY_WRITE);
++ int ret = inode_permission(inode, MAY_READ);
+ if (ret)
+ return ERR_PTR(ret);
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index cc40b8be1171..ede82382dd32 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -721,7 +721,10 @@ static int map_lookup_elem(union bpf_attr *attr)
+ err = bpf_fd_reuseport_array_lookup_elem(map, key, value);
+ } else {
+ rcu_read_lock();
+- ptr = map->ops->map_lookup_elem(map, key);
++ if (map->ops->map_lookup_elem_sys_only)
++ ptr = map->ops->map_lookup_elem_sys_only(map, key);
++ else
++ ptr = map->ops->map_lookup_elem(map, key);
+ if (ptr)
+ memcpy(value, ptr, value_size);
+ rcu_read_unlock();
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index 217f81ecae17..4e3625109b28 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -751,6 +751,7 @@ out:
+ return 0;
+
+ fail:
++ kobject_put(&tunables->attr_set.kobj);
+ policy->governor_data = NULL;
+ sugov_tunables_free(tunables);
+
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index f94be0c2827b..7345f5f8f3fe 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -1318,9 +1318,6 @@ event_id_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+ char buf[32];
+ int len;
+
+- if (*ppos)
+- return 0;
+-
+ if (unlikely(!id))
+ return -ENODEV;
+
+diff --git a/lib/Makefile b/lib/Makefile
+index 423876446810..0ab808318202 100644
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -17,6 +17,17 @@ KCOV_INSTRUMENT_list_debug.o := n
+ KCOV_INSTRUMENT_debugobjects.o := n
+ KCOV_INSTRUMENT_dynamic_debug.o := n
+
++# Early boot use of cmdline, don't instrument it
++ifdef CONFIG_AMD_MEM_ENCRYPT
++KASAN_SANITIZE_string.o := n
++
++ifdef CONFIG_FUNCTION_TRACER
++CFLAGS_REMOVE_string.o = -pg
++endif
++
++CFLAGS_string.o := $(call cc-option, -fno-stack-protector)
++endif
++
+ lib-y := ctype.o string.o vsprintf.o cmdline.o \
+ rbtree.o radix-tree.o timerqueue.o\
+ idr.o int_sqrt.o extable.o \
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 3bcec116a5f2..13a82744a00a 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -8716,7 +8716,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
+
+ refcnt = netdev_refcnt_read(dev);
+
+- if (time_after(jiffies, warning_time + 10 * HZ)) {
++ if (refcnt && time_after(jiffies, warning_time + 10 * HZ)) {
+ pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
+ dev->name, refcnt);
+ warning_time = jiffies;
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index ebde98b565e9..3932eed379a4 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1496,14 +1496,15 @@ static int put_master_ifindex(struct sk_buff *skb, struct net_device *dev)
+ return ret;
+ }
+
+-static int nla_put_iflink(struct sk_buff *skb, const struct net_device *dev)
++static int nla_put_iflink(struct sk_buff *skb, const struct net_device *dev,
++ bool force)
+ {
+ int ifindex = dev_get_iflink(dev);
+
+- if (dev->ifindex == ifindex)
+- return 0;
++ if (force || dev->ifindex != ifindex)
++ return nla_put_u32(skb, IFLA_LINK, ifindex);
+
+- return nla_put_u32(skb, IFLA_LINK, ifindex);
++ return 0;
+ }
+
+ static noinline_for_stack int nla_put_ifalias(struct sk_buff *skb,
+@@ -1520,6 +1521,8 @@ static int rtnl_fill_link_netnsid(struct sk_buff *skb,
+ const struct net_device *dev,
+ struct net *src_net)
+ {
++ bool put_iflink = false;
++
+ if (dev->rtnl_link_ops && dev->rtnl_link_ops->get_link_net) {
+ struct net *link_net = dev->rtnl_link_ops->get_link_net(dev);
+
+@@ -1528,10 +1531,12 @@ static int rtnl_fill_link_netnsid(struct sk_buff *skb,
+
+ if (nla_put_s32(skb, IFLA_LINK_NETNSID, id))
+ return -EMSGSIZE;
++
++ put_iflink = true;
+ }
+ }
+
+- return 0;
++ return nla_put_iflink(skb, dev, put_iflink);
+ }
+
+ static int rtnl_fill_link_af(struct sk_buff *skb,
+@@ -1617,7 +1622,6 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
+ #ifdef CONFIG_RPS
+ nla_put_u32(skb, IFLA_NUM_RX_QUEUES, dev->num_rx_queues) ||
+ #endif
+- nla_put_iflink(skb, dev) ||
+ put_master_ifindex(skb, dev) ||
+ nla_put_u8(skb, IFLA_CARRIER, netif_carrier_ok(dev)) ||
+ (dev->qdisc &&
+diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
+index 12a43a5369a5..114f9def1ec5 100644
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -223,7 +223,7 @@ static void esp_output_fill_trailer(u8 *tail, int tfclen, int plen, __u8 proto)
+ tail[plen - 1] = proto;
+ }
+
+-static void esp_output_udp_encap(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp)
++static int esp_output_udp_encap(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp)
+ {
+ int encap_type;
+ struct udphdr *uh;
+@@ -231,6 +231,7 @@ static void esp_output_udp_encap(struct xfrm_state *x, struct sk_buff *skb, stru
+ __be16 sport, dport;
+ struct xfrm_encap_tmpl *encap = x->encap;
+ struct ip_esp_hdr *esph = esp->esph;
++ unsigned int len;
+
+ spin_lock_bh(&x->lock);
+ sport = encap->encap_sport;
+@@ -238,11 +239,14 @@ static void esp_output_udp_encap(struct xfrm_state *x, struct sk_buff *skb, stru
+ encap_type = encap->encap_type;
+ spin_unlock_bh(&x->lock);
+
++ len = skb->len + esp->tailen - skb_transport_offset(skb);
++ if (len + sizeof(struct iphdr) >= IP_MAX_MTU)
++ return -EMSGSIZE;
++
+ uh = (struct udphdr *)esph;
+ uh->source = sport;
+ uh->dest = dport;
+- uh->len = htons(skb->len + esp->tailen
+- - skb_transport_offset(skb));
++ uh->len = htons(len);
+ uh->check = 0;
+
+ switch (encap_type) {
+@@ -259,6 +263,8 @@ static void esp_output_udp_encap(struct xfrm_state *x, struct sk_buff *skb, stru
+
+ *skb_mac_header(skb) = IPPROTO_UDP;
+ esp->esph = esph;
++
++ return 0;
+ }
+
+ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp)
+@@ -272,8 +278,12 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
+ int tailen = esp->tailen;
+
+ /* this is non-NULL only with UDP Encapsulation */
+- if (x->encap)
+- esp_output_udp_encap(x, skb, esp);
++ if (x->encap) {
++ int err = esp_output_udp_encap(x, skb, esp);
++
++ if (err < 0)
++ return err;
++ }
+
+ if (!skb_cloned(skb)) {
+ if (tailen <= skb_tailroom(skb)) {
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index 40a7cd56e008..808f8d15c519 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -659,9 +659,9 @@ static int __init vti_init(void)
+ return err;
+
+ rtnl_link_failed:
+- xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
+-xfrm_tunnel_failed:
+ xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
++xfrm_tunnel_failed:
++ xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
+ xfrm_proto_comp_failed:
+ xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
+ xfrm_proto_ah_failed:
+@@ -676,6 +676,7 @@ pernet_dev_failed:
+ static void __exit vti_fini(void)
+ {
+ rtnl_link_unregister(&vti_link_ops);
++ xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
+ xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
+ xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
+ xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
+diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
+index d73a6d6652f6..2b144b92ae46 100644
+--- a/net/ipv4/xfrm4_policy.c
++++ b/net/ipv4/xfrm4_policy.c
+@@ -111,7 +111,8 @@ static void
+ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
+ {
+ const struct iphdr *iph = ip_hdr(skb);
+- u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
++ int ihl = iph->ihl;
++ u8 *xprth = skb_network_header(skb) + ihl * 4;
+ struct flowi4 *fl4 = &fl->u.ip4;
+ int oif = 0;
+
+@@ -122,6 +123,11 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
+ fl4->flowi4_mark = skb->mark;
+ fl4->flowi4_oif = reverse ? skb->skb_iif : oif;
+
++ fl4->flowi4_proto = iph->protocol;
++ fl4->daddr = reverse ? iph->saddr : iph->daddr;
++ fl4->saddr = reverse ? iph->daddr : iph->saddr;
++ fl4->flowi4_tos = iph->tos;
++
+ if (!ip_is_fragment(iph)) {
+ switch (iph->protocol) {
+ case IPPROTO_UDP:
+@@ -133,7 +139,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
+ pskb_may_pull(skb, xprth + 4 - skb->data)) {
+ __be16 *ports;
+
+- xprth = skb_network_header(skb) + iph->ihl * 4;
++ xprth = skb_network_header(skb) + ihl * 4;
+ ports = (__be16 *)xprth;
+
+ fl4->fl4_sport = ports[!!reverse];
+@@ -146,7 +152,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
+ pskb_may_pull(skb, xprth + 2 - skb->data)) {
+ u8 *icmp;
+
+- xprth = skb_network_header(skb) + iph->ihl * 4;
++ xprth = skb_network_header(skb) + ihl * 4;
+ icmp = xprth;
+
+ fl4->fl4_icmp_type = icmp[0];
+@@ -159,7 +165,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
+ pskb_may_pull(skb, xprth + 4 - skb->data)) {
+ __be32 *ehdr;
+
+- xprth = skb_network_header(skb) + iph->ihl * 4;
++ xprth = skb_network_header(skb) + ihl * 4;
+ ehdr = (__be32 *)xprth;
+
+ fl4->fl4_ipsec_spi = ehdr[0];
+@@ -171,7 +177,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
+ pskb_may_pull(skb, xprth + 8 - skb->data)) {
+ __be32 *ah_hdr;
+
+- xprth = skb_network_header(skb) + iph->ihl * 4;
++ xprth = skb_network_header(skb) + ihl * 4;
+ ah_hdr = (__be32 *)xprth;
+
+ fl4->fl4_ipsec_spi = ah_hdr[1];
+@@ -183,7 +189,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
+ pskb_may_pull(skb, xprth + 4 - skb->data)) {
+ __be16 *ipcomp_hdr;
+
+- xprth = skb_network_header(skb) + iph->ihl * 4;
++ xprth = skb_network_header(skb) + ihl * 4;
+ ipcomp_hdr = (__be16 *)xprth;
+
+ fl4->fl4_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
+@@ -196,7 +202,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
+ __be16 *greflags;
+ __be32 *gre_hdr;
+
+- xprth = skb_network_header(skb) + iph->ihl * 4;
++ xprth = skb_network_header(skb) + ihl * 4;
+ greflags = (__be16 *)xprth;
+ gre_hdr = (__be32 *)xprth;
+
+@@ -213,10 +219,6 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
+ break;
+ }
+ }
+- fl4->flowi4_proto = iph->protocol;
+- fl4->daddr = reverse ? iph->saddr : iph->daddr;
+- fl4->saddr = reverse ? iph->daddr : iph->saddr;
+- fl4->flowi4_tos = iph->tos;
+ }
+
+ static void xfrm4_update_pmtu(struct dst_entry *dst, struct sock *sk,
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 3e2a9bd3459c..a6c0479c1d55 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -877,6 +877,12 @@ static void fib6_drop_pcpu_from(struct fib6_info *f6i,
+ {
+ int cpu;
+
++ /* Make sure rt6_make_pcpu_route() wont add other percpu routes
++ * while we are cleaning them here.
++ */
++ f6i->fib6_destroying = 1;
++ mb(); /* paired with the cmpxchg() in rt6_make_pcpu_route() */
++
+ /* release the reference to this fib entry from
+ * all of its cached pcpu routes
+ */
+@@ -900,6 +906,9 @@ static void fib6_purge_rt(struct fib6_info *rt, struct fib6_node *fn,
+ {
+ struct fib6_table *table = rt->fib6_table;
+
++ if (rt->rt6i_pcpu)
++ fib6_drop_pcpu_from(rt, table);
++
+ if (atomic_read(&rt->fib6_ref) != 1) {
+ /* This route is used as dummy address holder in some split
+ * nodes. It is not leaked, but it still holds other resources,
+@@ -921,9 +930,6 @@ static void fib6_purge_rt(struct fib6_info *rt, struct fib6_node *fn,
+ fn = rcu_dereference_protected(fn->parent,
+ lockdep_is_held(&table->tb6_lock));
+ }
+-
+- if (rt->rt6i_pcpu)
+- fib6_drop_pcpu_from(rt, table);
+ }
+ }
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 2e519f7b983c..bf0940c42810 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -110,8 +110,8 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
+ int iif, int type, u32 portid, u32 seq,
+ unsigned int flags);
+ static struct rt6_info *rt6_find_cached_rt(struct fib6_info *rt,
+- struct in6_addr *daddr,
+- struct in6_addr *saddr);
++ const struct in6_addr *daddr,
++ const struct in6_addr *saddr);
+
+ #ifdef CONFIG_IPV6_ROUTE_INFO
+ static struct fib6_info *rt6_add_route_info(struct net *net,
+@@ -1268,6 +1268,13 @@ static struct rt6_info *rt6_make_pcpu_route(struct net *net,
+ prev = cmpxchg(p, NULL, pcpu_rt);
+ BUG_ON(prev);
+
++ if (rt->fib6_destroying) {
++ struct fib6_info *from;
++
++ from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL);
++ fib6_info_release(from);
++ }
++
+ return pcpu_rt;
+ }
+
+@@ -1542,31 +1549,44 @@ out:
+ * Caller has to hold rcu_read_lock()
+ */
+ static struct rt6_info *rt6_find_cached_rt(struct fib6_info *rt,
+- struct in6_addr *daddr,
+- struct in6_addr *saddr)
++ const struct in6_addr *daddr,
++ const struct in6_addr *saddr)
+ {
++ const struct in6_addr *src_key = NULL;
+ struct rt6_exception_bucket *bucket;
+- struct in6_addr *src_key = NULL;
+ struct rt6_exception *rt6_ex;
+ struct rt6_info *res = NULL;
+
+- bucket = rcu_dereference(rt->rt6i_exception_bucket);
+-
+ #ifdef CONFIG_IPV6_SUBTREES
+ /* rt6i_src.plen != 0 indicates rt is in subtree
+ * and exception table is indexed by a hash of
+ * both rt6i_dst and rt6i_src.
+- * Otherwise, the exception table is indexed by
+- * a hash of only rt6i_dst.
++ * However, the src addr used to create the hash
++ * might not be exactly the passed in saddr which
++ * is a /128 addr from the flow.
++ * So we need to use f6i->fib6_src to redo lookup
++ * if the passed in saddr does not find anything.
++ * (See the logic in ip6_rt_cache_alloc() on how
++ * rt->rt6i_src is updated.)
+ */
+ if (rt->fib6_src.plen)
+ src_key = saddr;
++find_ex:
+ #endif
++ bucket = rcu_dereference(rt->rt6i_exception_bucket);
+ rt6_ex = __rt6_find_exception_rcu(&bucket, daddr, src_key);
+
+ if (rt6_ex && !rt6_check_expired(rt6_ex->rt6i))
+ res = rt6_ex->rt6i;
+
++#ifdef CONFIG_IPV6_SUBTREES
++ /* Use fib6_src as src_key and redo lookup */
++ if (!res && src_key && src_key != &rt->fib6_src.addr) {
++ src_key = &rt->fib6_src.addr;
++ goto find_ex;
++ }
++#endif
++
+ return res;
+ }
+
+@@ -2650,10 +2670,8 @@ out:
+ u32 ip6_mtu_from_fib6(struct fib6_info *f6i, struct in6_addr *daddr,
+ struct in6_addr *saddr)
+ {
+- struct rt6_exception_bucket *bucket;
+- struct rt6_exception *rt6_ex;
+- struct in6_addr *src_key;
+ struct inet6_dev *idev;
++ struct rt6_info *rt;
+ u32 mtu = 0;
+
+ if (unlikely(fib6_metric_locked(f6i, RTAX_MTU))) {
+@@ -2662,18 +2680,10 @@ u32 ip6_mtu_from_fib6(struct fib6_info *f6i, struct in6_addr *daddr,
+ goto out;
+ }
+
+- src_key = NULL;
+-#ifdef CONFIG_IPV6_SUBTREES
+- if (f6i->fib6_src.plen)
+- src_key = saddr;
+-#endif
+-
+- bucket = rcu_dereference(f6i->rt6i_exception_bucket);
+- rt6_ex = __rt6_find_exception_rcu(&bucket, daddr, src_key);
+- if (rt6_ex && !rt6_check_expired(rt6_ex->rt6i))
+- mtu = dst_metric_raw(&rt6_ex->rt6i->dst, RTAX_MTU);
+-
+- if (likely(!mtu)) {
++ rt = rt6_find_cached_rt(f6i, daddr, saddr);
++ if (unlikely(rt)) {
++ mtu = dst_metric_raw(&rt->dst, RTAX_MTU);
++ } else {
+ struct net_device *dev = fib6_info_nh_dev(f6i);
+
+ mtu = IPV6_MIN_MTU;
+diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
+index bc65db782bfb..d9e5f6808811 100644
+--- a/net/ipv6/xfrm6_tunnel.c
++++ b/net/ipv6/xfrm6_tunnel.c
+@@ -345,7 +345,7 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
+ unsigned int i;
+
+ xfrm_flush_gc();
+- xfrm_state_flush(net, IPSEC_PROTO_ANY, false, true);
++ xfrm_state_flush(net, 0, false, true);
+
+ for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
+ WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i]));
+@@ -402,6 +402,10 @@ static void __exit xfrm6_tunnel_fini(void)
+ xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6);
+ xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
+ unregister_pernet_subsys(&xfrm6_tunnel_net_ops);
++ /* Someone maybe has gotten the xfrm6_tunnel_spi.
++ * So need to wait it.
++ */
++ rcu_barrier();
+ kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
+ }
+
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 7d4bed955060..0b79c9aa8eb1 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1951,8 +1951,10 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
+
+ if (rq->sadb_x_ipsecrequest_mode == 0)
+ return -EINVAL;
++ if (!xfrm_id_proto_valid(rq->sadb_x_ipsecrequest_proto))
++ return -EINVAL;
+
+- t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */
++ t->id.proto = rq->sadb_x_ipsecrequest_proto;
+ if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0)
+ return -EINVAL;
+ t->mode = mode;
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 3a0171a65db3..152d4365f961 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1910,6 +1910,9 @@ void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata)
+ list_del_rcu(&sdata->list);
+ mutex_unlock(&sdata->local->iflist_mtx);
+
++ if (sdata->vif.txq)
++ ieee80211_txq_purge(sdata->local, to_txq_info(sdata->vif.txq));
++
+ synchronize_rcu();
+
+ if (sdata->dev) {
+diff --git a/net/tipc/core.c b/net/tipc/core.c
+index 5b38f5164281..d7b0688c98dd 100644
+--- a/net/tipc/core.c
++++ b/net/tipc/core.c
+@@ -66,6 +66,10 @@ static int __net_init tipc_init_net(struct net *net)
+ INIT_LIST_HEAD(&tn->node_list);
+ spin_lock_init(&tn->node_list_lock);
+
++ err = tipc_socket_init();
++ if (err)
++ goto out_socket;
++
+ err = tipc_sk_rht_init(net);
+ if (err)
+ goto out_sk_rht;
+@@ -92,6 +96,8 @@ out_subscr:
+ out_nametbl:
+ tipc_sk_rht_destroy(net);
+ out_sk_rht:
++ tipc_socket_stop();
++out_socket:
+ return err;
+ }
+
+@@ -102,6 +108,7 @@ static void __net_exit tipc_exit_net(struct net *net)
+ tipc_bcast_stop(net);
+ tipc_nametbl_stop(net);
+ tipc_sk_rht_destroy(net);
++ tipc_socket_stop();
+ }
+
+ static struct pernet_operations tipc_net_ops = {
+@@ -129,10 +136,6 @@ static int __init tipc_init(void)
+ if (err)
+ goto out_netlink_compat;
+
+- err = tipc_socket_init();
+- if (err)
+- goto out_socket;
+-
+ err = tipc_register_sysctl();
+ if (err)
+ goto out_sysctl;
+@@ -152,8 +155,6 @@ out_bearer:
+ out_pernet:
+ tipc_unregister_sysctl();
+ out_sysctl:
+- tipc_socket_stop();
+-out_socket:
+ tipc_netlink_compat_stop();
+ out_netlink_compat:
+ tipc_netlink_stop();
+@@ -168,7 +169,6 @@ static void __exit tipc_exit(void)
+ unregister_pernet_subsys(&tipc_net_ops);
+ tipc_netlink_stop();
+ tipc_netlink_compat_stop();
+- tipc_socket_stop();
+ tipc_unregister_sysctl();
+
+ pr_info("Deactivated\n");
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 15eb5d3d4750..96ab344f17bb 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -702,28 +702,27 @@ static int __init virtio_vsock_init(void)
+ if (!virtio_vsock_workqueue)
+ return -ENOMEM;
+
+- ret = register_virtio_driver(&virtio_vsock_driver);
++ ret = vsock_core_init(&virtio_transport.transport);
+ if (ret)
+ goto out_wq;
+
+- ret = vsock_core_init(&virtio_transport.transport);
++ ret = register_virtio_driver(&virtio_vsock_driver);
+ if (ret)
+- goto out_vdr;
++ goto out_vci;
+
+ return 0;
+
+-out_vdr:
+- unregister_virtio_driver(&virtio_vsock_driver);
++out_vci:
++ vsock_core_exit();
+ out_wq:
+ destroy_workqueue(virtio_vsock_workqueue);
+ return ret;
+-
+ }
+
+ static void __exit virtio_vsock_exit(void)
+ {
+- vsock_core_exit();
+ unregister_virtio_driver(&virtio_vsock_driver);
++ vsock_core_exit();
+ destroy_workqueue(virtio_vsock_workqueue);
+ }
+
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 602715fc9a75..f3f3d06cb6d8 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -786,12 +786,19 @@ static bool virtio_transport_close(struct vsock_sock *vsk)
+
+ void virtio_transport_release(struct vsock_sock *vsk)
+ {
++ struct virtio_vsock_sock *vvs = vsk->trans;
++ struct virtio_vsock_pkt *pkt, *tmp;
+ struct sock *sk = &vsk->sk;
+ bool remove_sock = true;
+
+ lock_sock(sk);
+ if (sk->sk_type == SOCK_STREAM)
+ remove_sock = virtio_transport_close(vsk);
++
++ list_for_each_entry_safe(pkt, tmp, &vvs->rx_queue, list) {
++ list_del(&pkt->list);
++ virtio_transport_free_pkt(pkt);
++ }
+ release_sock(sk);
+
+ if (remove_sock)
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 82723ef44db3..555ee2aca6c0 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -70,17 +70,28 @@ static struct xfrm_if *xfrmi_lookup(struct net *net, struct xfrm_state *x)
+ return NULL;
+ }
+
+-static struct xfrm_if *xfrmi_decode_session(struct sk_buff *skb)
++static struct xfrm_if *xfrmi_decode_session(struct sk_buff *skb,
++ unsigned short family)
+ {
+ struct xfrmi_net *xfrmn;
+- int ifindex;
+ struct xfrm_if *xi;
++ int ifindex = 0;
+
+ if (!secpath_exists(skb) || !skb->dev)
+ return NULL;
+
++ switch (family) {
++ case AF_INET6:
++ ifindex = inet6_sdif(skb);
++ break;
++ case AF_INET:
++ ifindex = inet_sdif(skb);
++ break;
++ }
++ if (!ifindex)
++ ifindex = skb->dev->ifindex;
++
+ xfrmn = net_generic(xs_net(xfrm_input_state(skb)), xfrmi_net_id);
+- ifindex = skb->dev->ifindex;
+
+ for_each_xfrmi_rcu(xfrmn->xfrmi[0], xi) {
+ if (ifindex == xi->dev->ifindex &&
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index bf5d59270f79..ce1b262ce964 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -2339,7 +2339,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+ ifcb = xfrm_if_get_cb();
+
+ if (ifcb) {
+- xi = ifcb->decode_session(skb);
++ xi = ifcb->decode_session(skb, family);
+ if (xi) {
+ if_id = xi->p.if_id;
+ net = xi->net;
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 3f729cd512af..11e09eb138d6 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -2386,7 +2386,7 @@ void xfrm_state_fini(struct net *net)
+
+ flush_work(&net->xfrm.state_hash_work);
+ flush_work(&xfrm_state_gc_work);
+- xfrm_state_flush(net, IPSEC_PROTO_ANY, false, true);
++ xfrm_state_flush(net, 0, false, true);
+
+ WARN_ON(!list_empty(&net->xfrm.state_all));
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 7e4904b93004..2122f89f6155 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1424,7 +1424,7 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
+ ret = verify_policy_dir(p->dir);
+ if (ret)
+ return ret;
+- if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir))
++ if (p->index && (xfrm_policy_id2dir(p->index) != p->dir))
+ return -EINVAL;
+
+ return 0;
+@@ -1513,20 +1513,8 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
+ return -EINVAL;
+ }
+
+- switch (ut[i].id.proto) {
+- case IPPROTO_AH:
+- case IPPROTO_ESP:
+- case IPPROTO_COMP:
+-#if IS_ENABLED(CONFIG_IPV6)
+- case IPPROTO_ROUTING:
+- case IPPROTO_DSTOPTS:
+-#endif
+- case IPSEC_PROTO_ANY:
+- break;
+- default:
++ if (!xfrm_id_proto_valid(ut[i].id.proto))
+ return -EINVAL;
+- }
+-
+ }
+
+ return 0;
+diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
+index e09fe4d7307c..40e3a098f6fb 100644
+--- a/security/apparmor/apparmorfs.c
++++ b/security/apparmor/apparmorfs.c
+@@ -123,17 +123,22 @@ static int aafs_show_path(struct seq_file *seq, struct dentry *dentry)
+ return 0;
+ }
+
+-static void aafs_evict_inode(struct inode *inode)
++static void aafs_i_callback(struct rcu_head *head)
+ {
+- truncate_inode_pages_final(&inode->i_data);
+- clear_inode(inode);
++ struct inode *inode = container_of(head, struct inode, i_rcu);
+ if (S_ISLNK(inode->i_mode))
+ kfree(inode->i_link);
++ free_inode_nonrcu(inode);
++}
++
++static void aafs_destroy_inode(struct inode *inode)
++{
++ call_rcu(&inode->i_rcu, aafs_i_callback);
+ }
+
+ static const struct super_operations aafs_super_ops = {
+ .statfs = simple_statfs,
+- .evict_inode = aafs_evict_inode,
++ .destroy_inode = aafs_destroy_inode,
+ .show_path = aafs_show_path,
+ };
+
+diff --git a/security/inode.c b/security/inode.c
+index 8dd9ca8848e4..829f15672e01 100644
+--- a/security/inode.c
++++ b/security/inode.c
+@@ -26,17 +26,22 @@
+ static struct vfsmount *mount;
+ static int mount_count;
+
+-static void securityfs_evict_inode(struct inode *inode)
++static void securityfs_i_callback(struct rcu_head *head)
+ {
+- truncate_inode_pages_final(&inode->i_data);
+- clear_inode(inode);
++ struct inode *inode = container_of(head, struct inode, i_rcu);
+ if (S_ISLNK(inode->i_mode))
+ kfree(inode->i_link);
++ free_inode_nonrcu(inode);
++}
++
++static void securityfs_destroy_inode(struct inode *inode)
++{
++ call_rcu(&inode->i_rcu, securityfs_i_callback);
+ }
+
+ static const struct super_operations securityfs_super_operations = {
+ .statfs = simple_statfs,
+- .evict_inode = securityfs_evict_inode,
++ .destroy_inode = securityfs_destroy_inode,
+ };
+
+ static int fill_super(struct super_block *sb, void *data, int silent)
+diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
+index 53f8be0f4a1f..88158239622b 100644
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -7,11 +7,12 @@ ARCH := x86
+ endif
+
+ # always use the host compiler
++HOSTAR ?= ar
+ HOSTCC ?= gcc
+ HOSTLD ?= ld
++AR = $(HOSTAR)
+ CC = $(HOSTCC)
+ LD = $(HOSTLD)
+-AR = ar
+
+ ifeq ($(srctree),)
+ srctree := $(patsubst %/,%,$(dir $(CURDIR)))
+diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
+index 44195514b19e..fa56fde6e8d8 100644
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -38,6 +38,10 @@
+ #include <numa.h>
+ #include <numaif.h>
+
++#ifndef RUSAGE_THREAD
++# define RUSAGE_THREAD 1
++#endif
++
+ /*
+ * Regular printout to the terminal, supressed if -q is specified:
+ */
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index 0bc3e6e93c31..4357141c7c92 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -58,6 +58,7 @@ enum intel_pt_pkt_state {
+ INTEL_PT_STATE_NO_IP,
+ INTEL_PT_STATE_ERR_RESYNC,
+ INTEL_PT_STATE_IN_SYNC,
++ INTEL_PT_STATE_TNT_CONT,
+ INTEL_PT_STATE_TNT,
+ INTEL_PT_STATE_TIP,
+ INTEL_PT_STATE_TIP_PGD,
+@@ -72,8 +73,9 @@ static inline bool intel_pt_sample_time(enum intel_pt_pkt_state pkt_state)
+ case INTEL_PT_STATE_NO_IP:
+ case INTEL_PT_STATE_ERR_RESYNC:
+ case INTEL_PT_STATE_IN_SYNC:
+- case INTEL_PT_STATE_TNT:
++ case INTEL_PT_STATE_TNT_CONT:
+ return true;
++ case INTEL_PT_STATE_TNT:
+ case INTEL_PT_STATE_TIP:
+ case INTEL_PT_STATE_TIP_PGD:
+ case INTEL_PT_STATE_FUP:
+@@ -888,16 +890,20 @@ static uint64_t intel_pt_next_period(struct intel_pt_decoder *decoder)
+ timestamp = decoder->timestamp + decoder->timestamp_insn_cnt;
+ masked_timestamp = timestamp & decoder->period_mask;
+ if (decoder->continuous_period) {
+- if (masked_timestamp != decoder->last_masked_timestamp)
++ if (masked_timestamp > decoder->last_masked_timestamp)
+ return 1;
+ } else {
+ timestamp += 1;
+ masked_timestamp = timestamp & decoder->period_mask;
+- if (masked_timestamp != decoder->last_masked_timestamp) {
++ if (masked_timestamp > decoder->last_masked_timestamp) {
+ decoder->last_masked_timestamp = masked_timestamp;
+ decoder->continuous_period = true;
+ }
+ }
++
++ if (masked_timestamp < decoder->last_masked_timestamp)
++ return decoder->period_ticks;
++
+ return decoder->period_ticks - (timestamp - masked_timestamp);
+ }
+
+@@ -926,7 +932,10 @@ static void intel_pt_sample_insn(struct intel_pt_decoder *decoder)
+ case INTEL_PT_PERIOD_TICKS:
+ timestamp = decoder->timestamp + decoder->timestamp_insn_cnt;
+ masked_timestamp = timestamp & decoder->period_mask;
+- decoder->last_masked_timestamp = masked_timestamp;
++ if (masked_timestamp > decoder->last_masked_timestamp)
++ decoder->last_masked_timestamp = masked_timestamp;
++ else
++ decoder->last_masked_timestamp += decoder->period_ticks;
+ break;
+ case INTEL_PT_PERIOD_NONE:
+ case INTEL_PT_PERIOD_MTC:
+@@ -1249,7 +1258,9 @@ static int intel_pt_walk_tnt(struct intel_pt_decoder *decoder)
+ return -ENOENT;
+ }
+ decoder->tnt.count -= 1;
+- if (!decoder->tnt.count)
++ if (decoder->tnt.count)
++ decoder->pkt_state = INTEL_PT_STATE_TNT_CONT;
++ else
+ decoder->pkt_state = INTEL_PT_STATE_IN_SYNC;
+ decoder->tnt.payload <<= 1;
+ decoder->state.from_ip = decoder->ip;
+@@ -1280,7 +1291,9 @@ static int intel_pt_walk_tnt(struct intel_pt_decoder *decoder)
+
+ if (intel_pt_insn.branch == INTEL_PT_BR_CONDITIONAL) {
+ decoder->tnt.count -= 1;
+- if (!decoder->tnt.count)
++ if (decoder->tnt.count)
++ decoder->pkt_state = INTEL_PT_STATE_TNT_CONT;
++ else
+ decoder->pkt_state = INTEL_PT_STATE_IN_SYNC;
+ if (decoder->tnt.payload & BIT63) {
+ decoder->tnt.payload <<= 1;
+@@ -1300,8 +1313,11 @@ static int intel_pt_walk_tnt(struct intel_pt_decoder *decoder)
+ return 0;
+ }
+ decoder->ip += intel_pt_insn.length;
+- if (!decoder->tnt.count)
++ if (!decoder->tnt.count) {
++ decoder->sample_timestamp = decoder->timestamp;
++ decoder->sample_insn_cnt = decoder->timestamp_insn_cnt;
+ return -EAGAIN;
++ }
+ decoder->tnt.payload <<= 1;
+ continue;
+ }
+@@ -2349,6 +2365,7 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder)
+ err = intel_pt_walk_trace(decoder);
+ break;
+ case INTEL_PT_STATE_TNT:
++ case INTEL_PT_STATE_TNT_CONT:
+ err = intel_pt_walk_tnt(decoder);
+ if (err == -EAGAIN)
+ err = intel_pt_walk_trace(decoder);
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index 294fc18aba2a..9db5a7378f40 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -32,7 +32,6 @@
+ #include <linux/if_ether.h>
+
+ #include <bpf/bpf.h>
+-#include <bpf/libbpf.h>
+
+ #ifdef HAVE_GENHDR
+ # include "autoconf.h"
+@@ -57,7 +56,6 @@
+
+ #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
+ static bool unpriv_disabled = false;
+-static int skips;
+
+ struct bpf_test {
+ const char *descr;
+@@ -12772,11 +12770,6 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
+ fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
+ prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
+ "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
+- if (fd_prog < 0 && !bpf_probe_prog_type(prog_type, 0)) {
+- printf("SKIP (unsupported program type %d)\n", prog_type);
+- skips++;
+- goto close_fds;
+- }
+
+ expected_ret = unpriv && test->result_unpriv != UNDEF ?
+ test->result_unpriv : test->result;
+@@ -12912,7 +12905,7 @@ static void get_unpriv_disabled()
+
+ static int do_test(bool unpriv, unsigned int from, unsigned int to)
+ {
+- int i, passes = 0, errors = 0;
++ int i, passes = 0, errors = 0, skips = 0;
+
+ for (i = from; i < to; i++) {
+ struct bpf_test *test = &tests[i];
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index 1415e36fed3d..fef3527af3bd 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -949,7 +949,7 @@ int kvm_vm_ioctl_irq_line(struct kvm *kvm, struct kvm_irq_level *irq_level,
+ static int kvm_vcpu_set_target(struct kvm_vcpu *vcpu,
+ const struct kvm_vcpu_init *init)
+ {
+- unsigned int i;
++ unsigned int i, ret;
+ int phys_target = kvm_target_cpu();
+
+ if (init->target != phys_target)
+@@ -984,9 +984,14 @@ static int kvm_vcpu_set_target(struct kvm_vcpu *vcpu,
+ vcpu->arch.target = phys_target;
+
+ /* Now we know what it is, we can reset it. */
+- return kvm_reset_vcpu(vcpu);
+-}
++ ret = kvm_reset_vcpu(vcpu);
++ if (ret) {
++ vcpu->arch.target = -1;
++ bitmap_zero(vcpu->arch.features, KVM_VCPU_MAX_FEATURES);
++ }
+
++ return ret;
++}
+
+ static int kvm_arch_vcpu_ioctl_vcpu_init(struct kvm_vcpu *vcpu,
+ struct kvm_vcpu_init *init)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-05-31 15:02 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-05-31 15:02 UTC (permalink / raw
To: gentoo-commits
commit: 598ad5bdcb5346e952e480a99a53f2b9157112d0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri May 31 15:02:12 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri May 31 15:02:12 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=598ad5bd
Linux patch 4.19.47
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1046_linux-4.19.47.patch | 9410 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 9414 insertions(+)
diff --git a/0000_README b/0000_README
index 87c4eaf..0c0cd1a 100644
--- a/0000_README
+++ b/0000_README
@@ -227,6 +227,10 @@ Patch: 1045_linux-4.19.46.patch
From: http://www.kernel.org
Desc: Linux 4.19.46
+Patch: 1046_linux-4.19.47.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.47
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1046_linux-4.19.47.patch b/1046_linux-4.19.47.patch
new file mode 100644
index 0000000..645af41
--- /dev/null
+++ b/1046_linux-4.19.47.patch
@@ -0,0 +1,9410 @@
+diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt
+index 3c6fc2e08d04..eeb3fc9d777b 100644
+--- a/Documentation/arm64/silicon-errata.txt
++++ b/Documentation/arm64/silicon-errata.txt
+@@ -58,6 +58,7 @@ stable kernels.
+ | ARM | Cortex-A72 | #853709 | N/A |
+ | ARM | Cortex-A73 | #858921 | ARM64_ERRATUM_858921 |
+ | ARM | Cortex-A55 | #1024718 | ARM64_ERRATUM_1024718 |
++| ARM | Cortex-A76 | #1463225 | ARM64_ERRATUM_1463225 |
+ | ARM | MMU-500 | #841119,#826419 | N/A |
+ | | | | |
+ | Cavium | ThunderX ITS | #22375, #24313 | CAVIUM_ERRATUM_22375 |
+diff --git a/Documentation/sysctl/net.txt b/Documentation/sysctl/net.txt
+index 9ecde517728c..2793d4eac55f 100644
+--- a/Documentation/sysctl/net.txt
++++ b/Documentation/sysctl/net.txt
+@@ -92,6 +92,14 @@ Values :
+ 0 - disable JIT kallsyms export (default value)
+ 1 - enable JIT kallsyms export for privileged users only
+
++bpf_jit_limit
++-------------
++
++This enforces a global limit for memory allocations to the BPF JIT
++compiler in order to reject unprivileged JIT requests once it has
++been surpassed. bpf_jit_limit contains the value of the global limit
++in bytes.
++
+ dev_weight
+ --------------
+
+diff --git a/Makefile b/Makefile
+index 5383dd317d59..b3ba28ff73d5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 46
++SUBLEVEL = 47
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/include/asm/cp15.h b/arch/arm/include/asm/cp15.h
+index 07e27f212dc7..d2453e2d3f1f 100644
+--- a/arch/arm/include/asm/cp15.h
++++ b/arch/arm/include/asm/cp15.h
+@@ -68,6 +68,8 @@
+ #define BPIALL __ACCESS_CP15(c7, 0, c5, 6)
+ #define ICIALLU __ACCESS_CP15(c7, 0, c5, 0)
+
++#define CNTVCT __ACCESS_CP15_64(1, c14)
++
+ extern unsigned long cr_alignment; /* defined in entry-armv.S */
+
+ static inline unsigned long get_cr(void)
+diff --git a/arch/arm/vdso/vgettimeofday.c b/arch/arm/vdso/vgettimeofday.c
+index a9dd619c6c29..7bdbf5d5c47d 100644
+--- a/arch/arm/vdso/vgettimeofday.c
++++ b/arch/arm/vdso/vgettimeofday.c
+@@ -18,9 +18,9 @@
+ #include <linux/compiler.h>
+ #include <linux/hrtimer.h>
+ #include <linux/time.h>
+-#include <asm/arch_timer.h>
+ #include <asm/barrier.h>
+ #include <asm/bug.h>
++#include <asm/cp15.h>
+ #include <asm/page.h>
+ #include <asm/unistd.h>
+ #include <asm/vdso_datapage.h>
+@@ -123,7 +123,8 @@ static notrace u64 get_ns(struct vdso_data *vdata)
+ u64 cycle_now;
+ u64 nsec;
+
+- cycle_now = arch_counter_get_cntvct();
++ isb();
++ cycle_now = read_sysreg(CNTVCT);
+
+ cycle_delta = (cycle_now - vdata->cs_cycle_last) & vdata->cs_mask;
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 1b1a0e95c751..8790a29d0af4 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -479,6 +479,24 @@ config ARM64_ERRATUM_1024718
+
+ If unsure, say Y.
+
++config ARM64_ERRATUM_1463225
++ bool "Cortex-A76: Software Step might prevent interrupt recognition"
++ default y
++ help
++ This option adds a workaround for Arm Cortex-A76 erratum 1463225.
++
++ On the affected Cortex-A76 cores (r0p0 to r3p1), software stepping
++ of a system call instruction (SVC) can prevent recognition of
++ subsequent interrupts when software stepping is disabled in the
++ exception handler of the system call and either kernel debugging
++ is enabled or VHE is in use.
++
++ Work around the erratum by triggering a dummy step exception
++ when handling a system call from a task that is being stepped
++ in a VHE configuration of the kernel.
++
++ If unsure, say Y.
++
+ config CAVIUM_ERRATUM_22375
+ bool "Cavium erratum 22375, 24313"
+ default y
+diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h
+index ae1f70450fb2..25ce9056cf64 100644
+--- a/arch/arm64/include/asm/cpucaps.h
++++ b/arch/arm64/include/asm/cpucaps.h
+@@ -51,7 +51,8 @@
+ #define ARM64_SSBD 30
+ #define ARM64_MISMATCHED_CACHE_TYPE 31
+ #define ARM64_HAS_STAGE2_FWB 32
++#define ARM64_WORKAROUND_1463225 33
+
+-#define ARM64_NCAPS 33
++#define ARM64_NCAPS 34
+
+ #endif /* __ASM_CPUCAPS_H */
+diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
+index ea690b3562af..b4a48419769f 100644
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -86,6 +86,7 @@
+ #define ARM_CPU_PART_CORTEX_A75 0xD0A
+ #define ARM_CPU_PART_CORTEX_A35 0xD04
+ #define ARM_CPU_PART_CORTEX_A55 0xD05
++#define ARM_CPU_PART_CORTEX_A76 0xD0B
+
+ #define APM_CPU_PART_POTENZA 0x000
+
+@@ -110,6 +111,7 @@
+ #define MIDR_CORTEX_A75 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A75)
+ #define MIDR_CORTEX_A35 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A35)
+ #define MIDR_CORTEX_A55 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A55)
++#define MIDR_CORTEX_A76 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76)
+ #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
+ #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
+ #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 1bdeca8918a6..ea423db39364 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -444,6 +444,8 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
+ return __pmd_to_phys(pmd);
+ }
+
++static inline void pte_unmap(pte_t *pte) { }
++
+ /* Find an entry in the third-level page table. */
+ #define pte_index(addr) (((addr) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1))
+
+@@ -452,7 +454,6 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
+
+ #define pte_offset_map(dir,addr) pte_offset_kernel((dir), (addr))
+ #define pte_offset_map_nested(dir,addr) pte_offset_kernel((dir), (addr))
+-#define pte_unmap(pte) do { } while (0)
+ #define pte_unmap_nested(pte) do { } while (0)
+
+ #define pte_set_fixmap(addr) ((pte_t *)set_fixmap_offset(FIX_PTE, addr))
+diff --git a/arch/arm64/include/asm/vdso_datapage.h b/arch/arm64/include/asm/vdso_datapage.h
+index 2b9a63771eda..f89263c8e11a 100644
+--- a/arch/arm64/include/asm/vdso_datapage.h
++++ b/arch/arm64/include/asm/vdso_datapage.h
+@@ -38,6 +38,7 @@ struct vdso_data {
+ __u32 tz_minuteswest; /* Whacky timezone stuff */
+ __u32 tz_dsttime;
+ __u32 use_syscall;
++ __u32 hrtimer_res;
+ };
+
+ #endif /* !__ASSEMBLY__ */
+diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c
+index 323aeb5f2fe6..92fba851ce53 100644
+--- a/arch/arm64/kernel/asm-offsets.c
++++ b/arch/arm64/kernel/asm-offsets.c
+@@ -99,7 +99,7 @@ int main(void)
+ DEFINE(CLOCK_REALTIME, CLOCK_REALTIME);
+ DEFINE(CLOCK_MONOTONIC, CLOCK_MONOTONIC);
+ DEFINE(CLOCK_MONOTONIC_RAW, CLOCK_MONOTONIC_RAW);
+- DEFINE(CLOCK_REALTIME_RES, MONOTONIC_RES_NSEC);
++ DEFINE(CLOCK_REALTIME_RES, offsetof(struct vdso_data, hrtimer_res));
+ DEFINE(CLOCK_REALTIME_COARSE, CLOCK_REALTIME_COARSE);
+ DEFINE(CLOCK_MONOTONIC_COARSE,CLOCK_MONOTONIC_COARSE);
+ DEFINE(CLOCK_COARSE_RES, LOW_RES_NSEC);
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index dec10898d688..dc6c535cbd13 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -411,6 +411,22 @@ static bool has_ssbd_mitigation(const struct arm64_cpu_capabilities *entry,
+ }
+ #endif /* CONFIG_ARM64_SSBD */
+
++#ifdef CONFIG_ARM64_ERRATUM_1463225
++DEFINE_PER_CPU(int, __in_cortex_a76_erratum_1463225_wa);
++
++static bool
++has_cortex_a76_erratum_1463225(const struct arm64_cpu_capabilities *entry,
++ int scope)
++{
++ u32 midr = read_cpuid_id();
++ /* Cortex-A76 r0p0 - r3p1 */
++ struct midr_range range = MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 1);
++
++ WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible());
++ return is_midr_in_range(midr, &range) && is_kernel_in_hyp_mode();
++}
++#endif
++
+ #define CAP_MIDR_RANGE(model, v_min, r_min, v_max, r_max) \
+ .matches = is_affected_midr_range, \
+ .midr_range = MIDR_RANGE(model, v_min, r_min, v_max, r_max)
+@@ -679,6 +695,14 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+ .matches = has_ssbd_mitigation,
+ },
++#endif
++#ifdef CONFIG_ARM64_ERRATUM_1463225
++ {
++ .desc = "ARM erratum 1463225",
++ .capability = ARM64_WORKAROUND_1463225,
++ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
++ .matches = has_cortex_a76_erratum_1463225,
++ },
+ #endif
+ {
+ }
+diff --git a/arch/arm64/kernel/cpu_ops.c b/arch/arm64/kernel/cpu_ops.c
+index ea001241bdd4..00f8b8612b69 100644
+--- a/arch/arm64/kernel/cpu_ops.c
++++ b/arch/arm64/kernel/cpu_ops.c
+@@ -85,6 +85,7 @@ static const char *__init cpu_read_enable_method(int cpu)
+ pr_err("%pOF: missing enable-method property\n",
+ dn);
+ }
++ of_node_put(dn);
+ } else {
+ enable_method = acpi_get_enable_method(cpu);
+ if (!enable_method) {
+diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
+index b09b6f75f759..06941c1fe418 100644
+--- a/arch/arm64/kernel/kaslr.c
++++ b/arch/arm64/kernel/kaslr.c
+@@ -145,15 +145,15 @@ u64 __init kaslr_early_init(u64 dt_phys)
+
+ if (IS_ENABLED(CONFIG_RANDOMIZE_MODULE_REGION_FULL)) {
+ /*
+- * Randomize the module region over a 4 GB window covering the
++ * Randomize the module region over a 2 GB window covering the
+ * kernel. This reduces the risk of modules leaking information
+ * about the address of the kernel itself, but results in
+ * branches between modules and the core kernel that are
+ * resolved via PLTs. (Branches between modules will be
+ * resolved normally.)
+ */
+- module_range = SZ_4G - (u64)(_end - _stext);
+- module_alloc_base = max((u64)_end + offset - SZ_4G,
++ module_range = SZ_2G - (u64)(_end - _stext);
++ module_alloc_base = max((u64)_end + offset - SZ_2G,
+ (u64)MODULES_VADDR);
+ } else {
+ /*
+diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
+index f0f27aeefb73..0b368ceccee4 100644
+--- a/arch/arm64/kernel/module.c
++++ b/arch/arm64/kernel/module.c
+@@ -56,7 +56,7 @@ void *module_alloc(unsigned long size)
+ * can simply omit this fallback in that case.
+ */
+ p = __vmalloc_node_range(size, MODULE_ALIGN, module_alloc_base,
+- module_alloc_base + SZ_4G, GFP_KERNEL,
++ module_alloc_base + SZ_2G, GFP_KERNEL,
+ PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
+ __builtin_return_address(0));
+
+diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
+index 5610ac01c1ec..871c739f060a 100644
+--- a/arch/arm64/kernel/syscall.c
++++ b/arch/arm64/kernel/syscall.c
+@@ -8,6 +8,7 @@
+ #include <linux/syscalls.h>
+
+ #include <asm/daifflags.h>
++#include <asm/debug-monitors.h>
+ #include <asm/fpsimd.h>
+ #include <asm/syscall.h>
+ #include <asm/thread_info.h>
+@@ -60,6 +61,35 @@ static inline bool has_syscall_work(unsigned long flags)
+ int syscall_trace_enter(struct pt_regs *regs);
+ void syscall_trace_exit(struct pt_regs *regs);
+
++#ifdef CONFIG_ARM64_ERRATUM_1463225
++DECLARE_PER_CPU(int, __in_cortex_a76_erratum_1463225_wa);
++
++static void cortex_a76_erratum_1463225_svc_handler(void)
++{
++ u32 reg, val;
++
++ if (!unlikely(test_thread_flag(TIF_SINGLESTEP)))
++ return;
++
++ if (!unlikely(this_cpu_has_cap(ARM64_WORKAROUND_1463225)))
++ return;
++
++ __this_cpu_write(__in_cortex_a76_erratum_1463225_wa, 1);
++ reg = read_sysreg(mdscr_el1);
++ val = reg | DBG_MDSCR_SS | DBG_MDSCR_KDE;
++ write_sysreg(val, mdscr_el1);
++ asm volatile("msr daifclr, #8");
++ isb();
++
++ /* We will have taken a single-step exception by this point */
++
++ write_sysreg(reg, mdscr_el1);
++ __this_cpu_write(__in_cortex_a76_erratum_1463225_wa, 0);
++}
++#else
++static void cortex_a76_erratum_1463225_svc_handler(void) { }
++#endif /* CONFIG_ARM64_ERRATUM_1463225 */
++
+ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
+ const syscall_fn_t syscall_table[])
+ {
+@@ -68,6 +98,7 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
+ regs->orig_x0 = regs->regs[0];
+ regs->syscallno = scno;
+
++ cortex_a76_erratum_1463225_svc_handler();
+ local_daif_restore(DAIF_PROCCTX);
+ user_exit();
+
+diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
+index 2d419006ad43..ec0bb588d755 100644
+--- a/arch/arm64/kernel/vdso.c
++++ b/arch/arm64/kernel/vdso.c
+@@ -232,6 +232,9 @@ void update_vsyscall(struct timekeeper *tk)
+ vdso_data->wtm_clock_sec = tk->wall_to_monotonic.tv_sec;
+ vdso_data->wtm_clock_nsec = tk->wall_to_monotonic.tv_nsec;
+
++ /* Read without the seqlock held by clock_getres() */
++ WRITE_ONCE(vdso_data->hrtimer_res, hrtimer_resolution);
++
+ if (!use_syscall) {
+ /* tkr_mono.cycle_last == tkr_raw.cycle_last */
+ vdso_data->cs_cycle_last = tk->tkr_mono.cycle_last;
+diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S
+index e8f60112818f..856fee6d3512 100644
+--- a/arch/arm64/kernel/vdso/gettimeofday.S
++++ b/arch/arm64/kernel/vdso/gettimeofday.S
+@@ -308,13 +308,14 @@ ENTRY(__kernel_clock_getres)
+ ccmp w0, #CLOCK_MONOTONIC_RAW, #0x4, ne
+ b.ne 1f
+
+- ldr x2, 5f
++ adr vdso_data, _vdso_data
++ ldr w2, [vdso_data, #CLOCK_REALTIME_RES]
+ b 2f
+ 1:
+ cmp w0, #CLOCK_REALTIME_COARSE
+ ccmp w0, #CLOCK_MONOTONIC_COARSE, #0x4, ne
+ b.ne 4f
+- ldr x2, 6f
++ ldr x2, 5f
+ 2:
+ cbz x1, 3f
+ stp xzr, x2, [x1]
+@@ -328,8 +329,6 @@ ENTRY(__kernel_clock_getres)
+ svc #0
+ ret
+ 5:
+- .quad CLOCK_REALTIME_RES
+-6:
+ .quad CLOCK_COARSE_RES
+ .cfi_endproc
+ ENDPROC(__kernel_clock_getres)
+diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
+index c389f2bef938..d3a5bb16f0b2 100644
+--- a/arch/arm64/mm/dma-mapping.c
++++ b/arch/arm64/mm/dma-mapping.c
+@@ -664,6 +664,11 @@ static int __iommu_mmap_attrs(struct device *dev, struct vm_area_struct *vma,
+ if (dma_mmap_from_dev_coherent(dev, vma, cpu_addr, size, &ret))
+ return ret;
+
++ if (!is_vmalloc_addr(cpu_addr)) {
++ unsigned long pfn = page_to_pfn(virt_to_page(cpu_addr));
++ return __swiotlb_mmap_pfn(vma, pfn, size);
++ }
++
+ if (attrs & DMA_ATTR_FORCE_CONTIGUOUS) {
+ /*
+ * DMA_ATTR_FORCE_CONTIGUOUS allocations are always remapped,
+@@ -687,6 +692,11 @@ static int __iommu_get_sgtable(struct device *dev, struct sg_table *sgt,
+ unsigned int count = PAGE_ALIGN(size) >> PAGE_SHIFT;
+ struct vm_struct *area = find_vm_area(cpu_addr);
+
++ if (!is_vmalloc_addr(cpu_addr)) {
++ struct page *page = virt_to_page(cpu_addr);
++ return __swiotlb_get_sgtable_page(sgt, page, size);
++ }
++
+ if (attrs & DMA_ATTR_FORCE_CONTIGUOUS) {
+ /*
+ * DMA_ATTR_FORCE_CONTIGUOUS allocations are always remapped,
+diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
+index a4c134677285..88cf0a0cb616 100644
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -827,14 +827,47 @@ void __init hook_debug_fault_code(int nr,
+ debug_fault_info[nr].name = name;
+ }
+
++#ifdef CONFIG_ARM64_ERRATUM_1463225
++DECLARE_PER_CPU(int, __in_cortex_a76_erratum_1463225_wa);
++
++static int __exception
++cortex_a76_erratum_1463225_debug_handler(struct pt_regs *regs)
++{
++ if (user_mode(regs))
++ return 0;
++
++ if (!__this_cpu_read(__in_cortex_a76_erratum_1463225_wa))
++ return 0;
++
++ /*
++ * We've taken a dummy step exception from the kernel to ensure
++ * that interrupts are re-enabled on the syscall path. Return back
++ * to cortex_a76_erratum_1463225_svc_handler() with debug exceptions
++ * masked so that we can safely restore the mdscr and get on with
++ * handling the syscall.
++ */
++ regs->pstate |= PSR_D_BIT;
++ return 1;
++}
++#else
++static int __exception
++cortex_a76_erratum_1463225_debug_handler(struct pt_regs *regs)
++{
++ return 0;
++}
++#endif /* CONFIG_ARM64_ERRATUM_1463225 */
++
+ asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint,
+- unsigned int esr,
+- struct pt_regs *regs)
++ unsigned int esr,
++ struct pt_regs *regs)
+ {
+ const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr);
+ unsigned long pc = instruction_pointer(regs);
+ int rv;
+
++ if (cortex_a76_erratum_1463225_debug_handler(regs))
++ return 0;
++
+ /*
+ * Tell lockdep we disabled irqs in entry.S. Do nothing if they were
+ * already disabled to preserve the last enabled/disabled addresses.
+diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c
+index 9d9f6f334d3c..3da3e2b1b51b 100644
+--- a/arch/powerpc/boot/addnote.c
++++ b/arch/powerpc/boot/addnote.c
+@@ -223,7 +223,11 @@ main(int ac, char **av)
+ PUT_16(E_PHNUM, np + 2);
+
+ /* write back */
+- lseek(fd, (long) 0, SEEK_SET);
++ i = lseek(fd, (long) 0, SEEK_SET);
++ if (i < 0) {
++ perror("lseek");
++ exit(1);
++ }
+ i = write(fd, buf, n);
+ if (i < 0) {
+ perror("write");
+diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
+index 4898e9491a1c..9168a247e24f 100644
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -970,7 +970,9 @@ start_here_multiplatform:
+
+ /* Restore parameters passed from prom_init/kexec */
+ mr r3,r31
+- bl early_setup /* also sets r13 and SPRG_PACA */
++ LOAD_REG_ADDR(r12, DOTSYM(early_setup))
++ mtctr r12
++ bctrl /* also sets r13 and SPRG_PACA */
+
+ LOAD_REG_ADDR(r3, start_here_common)
+ ld r4,PACAKMSR(r13)
+diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c
+index 3c6ab22a0c4e..af3c15a1d41e 100644
+--- a/arch/powerpc/kernel/watchdog.c
++++ b/arch/powerpc/kernel/watchdog.c
+@@ -77,7 +77,7 @@ static u64 wd_smp_panic_timeout_tb __read_mostly; /* panic other CPUs */
+
+ static u64 wd_timer_period_ms __read_mostly; /* interval between heartbeat */
+
+-static DEFINE_PER_CPU(struct timer_list, wd_timer);
++static DEFINE_PER_CPU(struct hrtimer, wd_hrtimer);
+ static DEFINE_PER_CPU(u64, wd_timer_tb);
+
+ /* SMP checker bits */
+@@ -293,21 +293,21 @@ out:
+ nmi_exit();
+ }
+
+-static void wd_timer_reset(unsigned int cpu, struct timer_list *t)
+-{
+- t->expires = jiffies + msecs_to_jiffies(wd_timer_period_ms);
+- if (wd_timer_period_ms > 1000)
+- t->expires = __round_jiffies_up(t->expires, cpu);
+- add_timer_on(t, cpu);
+-}
+-
+-static void wd_timer_fn(struct timer_list *t)
++static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
+ {
+ int cpu = smp_processor_id();
+
++ if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
++ return HRTIMER_NORESTART;
++
++ if (!cpumask_test_cpu(cpu, &watchdog_cpumask))
++ return HRTIMER_NORESTART;
++
+ watchdog_timer_interrupt(cpu);
+
+- wd_timer_reset(cpu, t);
++ hrtimer_forward_now(hrtimer, ms_to_ktime(wd_timer_period_ms));
++
++ return HRTIMER_RESTART;
+ }
+
+ void arch_touch_nmi_watchdog(void)
+@@ -323,37 +323,22 @@ void arch_touch_nmi_watchdog(void)
+ }
+ EXPORT_SYMBOL(arch_touch_nmi_watchdog);
+
+-static void start_watchdog_timer_on(unsigned int cpu)
+-{
+- struct timer_list *t = per_cpu_ptr(&wd_timer, cpu);
+-
+- per_cpu(wd_timer_tb, cpu) = get_tb();
+-
+- timer_setup(t, wd_timer_fn, TIMER_PINNED);
+- wd_timer_reset(cpu, t);
+-}
+-
+-static void stop_watchdog_timer_on(unsigned int cpu)
+-{
+- struct timer_list *t = per_cpu_ptr(&wd_timer, cpu);
+-
+- del_timer_sync(t);
+-}
+-
+-static int start_wd_on_cpu(unsigned int cpu)
++static void start_watchdog(void *arg)
+ {
++ struct hrtimer *hrtimer = this_cpu_ptr(&wd_hrtimer);
++ int cpu = smp_processor_id();
+ unsigned long flags;
+
+ if (cpumask_test_cpu(cpu, &wd_cpus_enabled)) {
+ WARN_ON(1);
+- return 0;
++ return;
+ }
+
+ if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
+- return 0;
++ return;
+
+ if (!cpumask_test_cpu(cpu, &watchdog_cpumask))
+- return 0;
++ return;
+
+ wd_smp_lock(&flags);
+ cpumask_set_cpu(cpu, &wd_cpus_enabled);
+@@ -363,27 +348,40 @@ static int start_wd_on_cpu(unsigned int cpu)
+ }
+ wd_smp_unlock(&flags);
+
+- start_watchdog_timer_on(cpu);
++ *this_cpu_ptr(&wd_timer_tb) = get_tb();
+
+- return 0;
++ hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++ hrtimer->function = watchdog_timer_fn;
++ hrtimer_start(hrtimer, ms_to_ktime(wd_timer_period_ms),
++ HRTIMER_MODE_REL_PINNED);
+ }
+
+-static int stop_wd_on_cpu(unsigned int cpu)
++static int start_watchdog_on_cpu(unsigned int cpu)
+ {
++ return smp_call_function_single(cpu, start_watchdog, NULL, true);
++}
++
++static void stop_watchdog(void *arg)
++{
++ struct hrtimer *hrtimer = this_cpu_ptr(&wd_hrtimer);
++ int cpu = smp_processor_id();
+ unsigned long flags;
+
+ if (!cpumask_test_cpu(cpu, &wd_cpus_enabled))
+- return 0; /* Can happen in CPU unplug case */
++ return; /* Can happen in CPU unplug case */
+
+- stop_watchdog_timer_on(cpu);
++ hrtimer_cancel(hrtimer);
+
+ wd_smp_lock(&flags);
+ cpumask_clear_cpu(cpu, &wd_cpus_enabled);
+ wd_smp_unlock(&flags);
+
+ wd_smp_clear_cpu_pending(cpu, get_tb());
++}
+
+- return 0;
++static int stop_watchdog_on_cpu(unsigned int cpu)
++{
++ return smp_call_function_single(cpu, stop_watchdog, NULL, true);
+ }
+
+ static void watchdog_calc_timeouts(void)
+@@ -402,7 +400,7 @@ void watchdog_nmi_stop(void)
+ int cpu;
+
+ for_each_cpu(cpu, &wd_cpus_enabled)
+- stop_wd_on_cpu(cpu);
++ stop_watchdog_on_cpu(cpu);
+ }
+
+ void watchdog_nmi_start(void)
+@@ -411,7 +409,7 @@ void watchdog_nmi_start(void)
+
+ watchdog_calc_timeouts();
+ for_each_cpu_and(cpu, cpu_online_mask, &watchdog_cpumask)
+- start_wd_on_cpu(cpu);
++ start_watchdog_on_cpu(cpu);
+ }
+
+ /*
+@@ -423,7 +421,8 @@ int __init watchdog_nmi_probe(void)
+
+ err = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN,
+ "powerpc/watchdog:online",
+- start_wd_on_cpu, stop_wd_on_cpu);
++ start_watchdog_on_cpu,
++ stop_watchdog_on_cpu);
+ if (err < 0) {
+ pr_warn("could not be initialized");
+ return err;
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 10fb43efef50..f473c05e9649 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -1495,6 +1495,9 @@ int start_topology_update(void)
+ {
+ int rc = 0;
+
++ if (!topology_updates_enabled)
++ return 0;
++
+ if (firmware_has_feature(FW_FEATURE_PRRN)) {
+ if (!prrn_enabled) {
+ prrn_enabled = 1;
+@@ -1524,6 +1527,9 @@ int stop_topology_update(void)
+ {
+ int rc = 0;
+
++ if (!topology_updates_enabled)
++ return 0;
++
+ if (prrn_enabled) {
+ prrn_enabled = 0;
+ #ifdef CONFIG_SMP
+@@ -1579,11 +1585,13 @@ static ssize_t topology_write(struct file *file, const char __user *buf,
+
+ kbuf[read_len] = '\0';
+
+- if (!strncmp(kbuf, "on", 2))
++ if (!strncmp(kbuf, "on", 2)) {
++ topology_updates_enabled = true;
+ start_topology_update();
+- else if (!strncmp(kbuf, "off", 3))
++ } else if (!strncmp(kbuf, "off", 3)) {
+ stop_topology_update();
+- else
++ topology_updates_enabled = false;
++ } else
+ return -EINVAL;
+
+ return count;
+@@ -1598,9 +1606,7 @@ static const struct file_operations topology_ops = {
+
+ static int topology_update_init(void)
+ {
+- /* Do not poll for changes if disabled at boot */
+- if (topology_updates_enabled)
+- start_topology_update();
++ start_topology_update();
+
+ if (vphn_enabled)
+ topology_schedule_update();
+diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
+index 1fafc32b12a0..555322677074 100644
+--- a/arch/powerpc/perf/imc-pmu.c
++++ b/arch/powerpc/perf/imc-pmu.c
+@@ -496,6 +496,11 @@ static int nest_imc_event_init(struct perf_event *event)
+ * Get the base memory addresss for this cpu.
+ */
+ chip_id = cpu_to_chip_id(event->cpu);
++
++ /* Return, if chip_id is not valid */
++ if (chip_id < 0)
++ return -ENODEV;
++
+ pcni = pmu->mem_info;
+ do {
+ if (pcni->id == chip_id) {
+@@ -503,7 +508,7 @@ static int nest_imc_event_init(struct perf_event *event)
+ break;
+ }
+ pcni++;
+- } while (pcni);
++ } while (pcni->vbase != 0);
+
+ if (!flag)
+ return -ENODEV;
+diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c
+index 58a07948c76e..3d27f02695e4 100644
+--- a/arch/powerpc/platforms/powernv/opal-imc.c
++++ b/arch/powerpc/platforms/powernv/opal-imc.c
+@@ -127,7 +127,7 @@ static int imc_get_mem_addr_nest(struct device_node *node,
+ nr_chips))
+ goto error;
+
+- pmu_ptr->mem_info = kcalloc(nr_chips, sizeof(*pmu_ptr->mem_info),
++ pmu_ptr->mem_info = kcalloc(nr_chips + 1, sizeof(*pmu_ptr->mem_info),
+ GFP_KERNEL);
+ if (!pmu_ptr->mem_info)
+ goto error;
+diff --git a/arch/s390/kernel/kexec_elf.c b/arch/s390/kernel/kexec_elf.c
+index 5a286b012043..602e7cc26d11 100644
+--- a/arch/s390/kernel/kexec_elf.c
++++ b/arch/s390/kernel/kexec_elf.c
+@@ -19,10 +19,15 @@ static int kexec_file_add_elf_kernel(struct kimage *image,
+ struct kexec_buf buf;
+ const Elf_Ehdr *ehdr;
+ const Elf_Phdr *phdr;
++ Elf_Addr entry;
+ int i, ret;
+
+ ehdr = (Elf_Ehdr *)kernel;
+ buf.image = image;
++ if (image->type == KEXEC_TYPE_CRASH)
++ entry = STARTUP_KDUMP_OFFSET;
++ else
++ entry = ehdr->e_entry;
+
+ phdr = (void *)ehdr + ehdr->e_phoff;
+ for (i = 0; i < ehdr->e_phnum; i++, phdr++) {
+@@ -35,7 +40,7 @@ static int kexec_file_add_elf_kernel(struct kimage *image,
+ buf.mem = ALIGN(phdr->p_paddr, phdr->p_align);
+ buf.memsz = phdr->p_memsz;
+
+- if (phdr->p_paddr == 0) {
++ if (entry - phdr->p_paddr < phdr->p_memsz) {
+ data->kernel_buf = buf.buffer;
+ data->memsz += STARTUP_NORMAL_OFFSET;
+
+diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
+index f2cc7da473e4..ae894ac83fd6 100644
+--- a/arch/s390/mm/pgtable.c
++++ b/arch/s390/mm/pgtable.c
+@@ -410,6 +410,7 @@ static inline pmd_t pmdp_flush_lazy(struct mm_struct *mm,
+ return old;
+ }
+
++#ifdef CONFIG_PGSTE
+ static pmd_t *pmd_alloc_map(struct mm_struct *mm, unsigned long addr)
+ {
+ pgd_t *pgd;
+@@ -427,6 +428,7 @@ static pmd_t *pmd_alloc_map(struct mm_struct *mm, unsigned long addr)
+ pmd = pmd_alloc(mm, pud, addr);
+ return pmd;
+ }
++#endif
+
+ pmd_t pmdp_xchg_direct(struct mm_struct *mm, unsigned long addr,
+ pmd_t *pmdp, pmd_t new)
+diff --git a/arch/sh/include/cpu-sh4/cpu/sh7786.h b/arch/sh/include/cpu-sh4/cpu/sh7786.h
+index 96b8cb1f754a..029bbadaf7ab 100644
+--- a/arch/sh/include/cpu-sh4/cpu/sh7786.h
++++ b/arch/sh/include/cpu-sh4/cpu/sh7786.h
+@@ -135,7 +135,7 @@ enum {
+
+ static inline u32 sh7786_mm_sel(void)
+ {
+- return __raw_readl(0xFC400020) & 0x7;
++ return __raw_readl((const volatile void __iomem *)0xFC400020) & 0x7;
+ }
+
+ #endif /* __CPU_SH7786_H__ */
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index ffc823a8312f..ab2071e40efe 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -47,7 +47,7 @@ export REALMODE_CFLAGS
+ export BITS
+
+ ifdef CONFIG_X86_NEED_RELOCS
+- LDFLAGS_vmlinux := --emit-relocs
++ LDFLAGS_vmlinux := --emit-relocs --discard-none
+ endif
+
+ #
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index 56194c571299..4a650eb3d94a 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -584,6 +584,8 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
+ X86_CSTATES_MODEL(INTEL_FAM6_ATOM_GOLDMONT_X, glm_cstates),
+
+ X86_CSTATES_MODEL(INTEL_FAM6_ATOM_GOLDMONT_PLUS, glm_cstates),
++
++ X86_CSTATES_MODEL(INTEL_FAM6_ICELAKE_MOBILE, snb_cstates),
+ { },
+ };
+ MODULE_DEVICE_TABLE(x86cpu, intel_cstates_match);
+diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
+index 91039ffed633..2413169ce362 100644
+--- a/arch/x86/events/intel/rapl.c
++++ b/arch/x86/events/intel/rapl.c
+@@ -780,6 +780,8 @@ static const struct x86_cpu_id rapl_cpu_match[] __initconst = {
+ X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_GOLDMONT_X, hsw_rapl_init),
+
+ X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_GOLDMONT_PLUS, hsw_rapl_init),
++
++ X86_RAPL_MODEL_MATCH(INTEL_FAM6_ICELAKE_MOBILE, skl_rapl_init),
+ {},
+ };
+
+diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c
+index 1b9f85abf9bc..ace6c1e752fb 100644
+--- a/arch/x86/events/msr.c
++++ b/arch/x86/events/msr.c
+@@ -89,6 +89,7 @@ static bool test_intel(int idx)
+ case INTEL_FAM6_SKYLAKE_X:
+ case INTEL_FAM6_KABYLAKE_MOBILE:
+ case INTEL_FAM6_KABYLAKE_DESKTOP:
++ case INTEL_FAM6_ICELAKE_MOBILE:
+ if (idx == PERF_MSR_SMI || idx == PERF_MSR_PPERF)
+ return true;
+ break;
+diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
+index 86b1341cba9a..513ba49c204f 100644
+--- a/arch/x86/ia32/ia32_signal.c
++++ b/arch/x86/ia32/ia32_signal.c
+@@ -61,9 +61,8 @@
+ } while (0)
+
+ #define RELOAD_SEG(seg) { \
+- unsigned int pre = GET_SEG(seg); \
++ unsigned int pre = (seg) | 3; \
+ unsigned int cur = get_user_seg(seg); \
+- pre |= 3; \
+ if (pre != cur) \
+ set_user_seg(seg, pre); \
+ }
+@@ -72,6 +71,7 @@ static int ia32_restore_sigcontext(struct pt_regs *regs,
+ struct sigcontext_32 __user *sc)
+ {
+ unsigned int tmpflags, err = 0;
++ u16 gs, fs, es, ds;
+ void __user *buf;
+ u32 tmp;
+
+@@ -79,16 +79,10 @@ static int ia32_restore_sigcontext(struct pt_regs *regs,
+ current->restart_block.fn = do_no_restart_syscall;
+
+ get_user_try {
+- /*
+- * Reload fs and gs if they have changed in the signal
+- * handler. This does not handle long fs/gs base changes in
+- * the handler, but does not clobber them at least in the
+- * normal case.
+- */
+- RELOAD_SEG(gs);
+- RELOAD_SEG(fs);
+- RELOAD_SEG(ds);
+- RELOAD_SEG(es);
++ gs = GET_SEG(gs);
++ fs = GET_SEG(fs);
++ ds = GET_SEG(ds);
++ es = GET_SEG(es);
+
+ COPY(di); COPY(si); COPY(bp); COPY(sp); COPY(bx);
+ COPY(dx); COPY(cx); COPY(ip); COPY(ax);
+@@ -106,6 +100,17 @@ static int ia32_restore_sigcontext(struct pt_regs *regs,
+ buf = compat_ptr(tmp);
+ } get_user_catch(err);
+
++ /*
++ * Reload fs and gs if they have changed in the signal
++ * handler. This does not handle long fs/gs base changes in
++ * the handler, but does not clobber them at least in the
++ * normal case.
++ */
++ RELOAD_SEG(gs);
++ RELOAD_SEG(fs);
++ RELOAD_SEG(ds);
++ RELOAD_SEG(es);
++
+ err |= fpu__restore_sig(buf, 1);
+
+ force_iret();
+diff --git a/arch/x86/include/asm/text-patching.h b/arch/x86/include/asm/text-patching.h
+index 05861cc08787..0bbb07eaed6b 100644
+--- a/arch/x86/include/asm/text-patching.h
++++ b/arch/x86/include/asm/text-patching.h
+@@ -39,6 +39,7 @@ extern int poke_int3_handler(struct pt_regs *regs);
+ extern void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler);
+ extern int after_bootmem;
+
++#ifndef CONFIG_UML_X86
+ static inline void int3_emulate_jmp(struct pt_regs *regs, unsigned long ip)
+ {
+ regs->ip = ip;
+@@ -65,6 +66,7 @@ static inline void int3_emulate_call(struct pt_regs *regs, unsigned long func)
+ int3_emulate_push(regs, regs->ip - INT3_INSN_SIZE + CALL_INSN_SIZE);
+ int3_emulate_jmp(regs, func);
+ }
+-#endif
++#endif /* CONFIG_X86_64 */
++#endif /* !CONFIG_UML_X86 */
+
+ #endif /* _ASM_X86_TEXT_PATCHING_H */
+diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
+index b9d5e7c9ef43..918a23704c0c 100644
+--- a/arch/x86/kernel/alternative.c
++++ b/arch/x86/kernel/alternative.c
+@@ -662,15 +662,29 @@ void __init alternative_instructions(void)
+ * handlers seeing an inconsistent instruction while you patch.
+ */
+ void *__init_or_module text_poke_early(void *addr, const void *opcode,
+- size_t len)
++ size_t len)
+ {
+ unsigned long flags;
+- local_irq_save(flags);
+- memcpy(addr, opcode, len);
+- local_irq_restore(flags);
+- sync_core();
+- /* Could also do a CLFLUSH here to speed up CPU recovery; but
+- that causes hangs on some VIA CPUs. */
++
++ if (boot_cpu_has(X86_FEATURE_NX) &&
++ is_module_text_address((unsigned long)addr)) {
++ /*
++ * Modules text is marked initially as non-executable, so the
++ * code cannot be running and speculative code-fetches are
++ * prevented. Just change the code.
++ */
++ memcpy(addr, opcode, len);
++ } else {
++ local_irq_save(flags);
++ memcpy(addr, opcode, len);
++ local_irq_restore(flags);
++ sync_core();
++
++ /*
++ * Could also do a CLFLUSH here to speed up CPU recovery; but
++ * that causes hangs on some VIA CPUs.
++ */
++ }
+ return addr;
+ }
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+index c805a06e14c3..ff1c00b695ae 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+@@ -46,8 +46,6 @@
+ static struct mce i_mce;
+ static struct dentry *dfs_inj;
+
+-static u8 n_banks;
+-
+ #define MAX_FLAG_OPT_SIZE 4
+ #define NBCFG 0x44
+
+@@ -567,9 +565,15 @@ err:
+ static int inj_bank_set(void *data, u64 val)
+ {
+ struct mce *m = (struct mce *)data;
++ u8 n_banks;
++ u64 cap;
++
++ /* Get bank count on target CPU so we can handle non-uniform values. */
++ rdmsrl_on_cpu(m->extcpu, MSR_IA32_MCG_CAP, &cap);
++ n_banks = cap & MCG_BANKCNT_MASK;
+
+ if (val >= n_banks) {
+- pr_err("Non-existent MCE bank: %llu\n", val);
++ pr_err("MCA bank %llu non-existent on CPU%d\n", val, m->extcpu);
+ return -EINVAL;
+ }
+
+@@ -659,10 +663,6 @@ static struct dfs_node {
+ static int __init debugfs_init(void)
+ {
+ unsigned int i;
+- u64 cap;
+-
+- rdmsrl(MSR_IA32_MCG_CAP, cap);
+- n_banks = cap & MCG_BANKCNT_MASK;
+
+ dfs_inj = debugfs_create_dir("mce-inject", NULL);
+ if (!dfs_inj)
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index f9e7096b1804..fee118b3b69f 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -711,19 +711,49 @@ bool machine_check_poll(enum mcp_flags flags, mce_banks_t *b)
+
+ barrier();
+ m.status = mce_rdmsrl(msr_ops.status(i));
++
++ /* If this entry is not valid, ignore it */
+ if (!(m.status & MCI_STATUS_VAL))
+ continue;
+
+ /*
+- * Uncorrected or signalled events are handled by the exception
+- * handler when it is enabled, so don't process those here.
+- *
+- * TBD do the same check for MCI_STATUS_EN here?
++ * If we are logging everything (at CPU online) or this
++ * is a corrected error, then we must log it.
+ */
+- if (!(flags & MCP_UC) &&
+- (m.status & (mca_cfg.ser ? MCI_STATUS_S : MCI_STATUS_UC)))
+- continue;
++ if ((flags & MCP_UC) || !(m.status & MCI_STATUS_UC))
++ goto log_it;
++
++ /*
++ * Newer Intel systems that support software error
++ * recovery need to make additional checks. Other
++ * CPUs should skip over uncorrected errors, but log
++ * everything else.
++ */
++ if (!mca_cfg.ser) {
++ if (m.status & MCI_STATUS_UC)
++ continue;
++ goto log_it;
++ }
++
++ /* Log "not enabled" (speculative) errors */
++ if (!(m.status & MCI_STATUS_EN))
++ goto log_it;
++
++ /*
++ * Log UCNA (SDM: 15.6.3 "UCR Error Classification")
++ * UC == 1 && PCC == 0 && S == 0
++ */
++ if (!(m.status & MCI_STATUS_PCC) && !(m.status & MCI_STATUS_S))
++ goto log_it;
++
++ /*
++ * Skip anything else. Presumption is that our read of this
++ * bank is racing with a machine check. Leave the log alone
++ * for do_machine_check() to deal with it.
++ */
++ continue;
+
++log_it:
+ error_seen = true;
+
+ mce_read_aux(&m, i);
+@@ -1450,13 +1480,12 @@ EXPORT_SYMBOL_GPL(mce_notify_irq);
+ static int __mcheck_cpu_mce_banks_init(void)
+ {
+ int i;
+- u8 num_banks = mca_cfg.banks;
+
+- mce_banks = kcalloc(num_banks, sizeof(struct mce_bank), GFP_KERNEL);
++ mce_banks = kcalloc(MAX_NR_BANKS, sizeof(struct mce_bank), GFP_KERNEL);
+ if (!mce_banks)
+ return -ENOMEM;
+
+- for (i = 0; i < num_banks; i++) {
++ for (i = 0; i < MAX_NR_BANKS; i++) {
+ struct mce_bank *b = &mce_banks[i];
+
+ b->ctl = -1ULL;
+@@ -1470,28 +1499,19 @@ static int __mcheck_cpu_mce_banks_init(void)
+ */
+ static int __mcheck_cpu_cap_init(void)
+ {
+- unsigned b;
+ u64 cap;
++ u8 b;
+
+ rdmsrl(MSR_IA32_MCG_CAP, cap);
+
+ b = cap & MCG_BANKCNT_MASK;
+- if (!mca_cfg.banks)
+- pr_info("CPU supports %d MCE banks\n", b);
+-
+- if (b > MAX_NR_BANKS) {
+- pr_warn("Using only %u machine check banks out of %u\n",
+- MAX_NR_BANKS, b);
++ if (WARN_ON_ONCE(b > MAX_NR_BANKS))
+ b = MAX_NR_BANKS;
+- }
+
+- /* Don't support asymmetric configurations today */
+- WARN_ON(mca_cfg.banks != 0 && b != mca_cfg.banks);
+- mca_cfg.banks = b;
++ mca_cfg.banks = max(mca_cfg.banks, b);
+
+ if (!mce_banks) {
+ int err = __mcheck_cpu_mce_banks_init();
+-
+ if (err)
+ return err;
+ }
+@@ -2473,6 +2493,8 @@ EXPORT_SYMBOL_GPL(mcsafe_key);
+
+ static int __init mcheck_late_init(void)
+ {
++ pr_info("Using %d MCE banks\n", mca_cfg.banks);
++
+ if (mca_cfg.recovery)
+ static_branch_inc(&mcsafe_key);
+
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index b9bc8a1a584e..b43ddefd77f4 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -418,8 +418,9 @@ static int do_microcode_update(const void __user *buf, size_t size)
+ if (ustate == UCODE_ERROR) {
+ error = -1;
+ break;
+- } else if (ustate == UCODE_OK)
++ } else if (ustate == UCODE_NEW) {
+ apply_microcode_on_target(cpu);
++ }
+ }
+
+ return error;
+diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c
+index 0469cd078db1..b50ac9c7397b 100644
+--- a/arch/x86/kernel/irq_64.c
++++ b/arch/x86/kernel/irq_64.c
+@@ -26,9 +26,18 @@ int sysctl_panic_on_stackoverflow;
+ /*
+ * Probabilistic stack overflow check:
+ *
+- * Only check the stack in process context, because everything else
+- * runs on the big interrupt stacks. Checking reliably is too expensive,
+- * so we just check from interrupts.
++ * Regular device interrupts can enter on the following stacks:
++ *
++ * - User stack
++ *
++ * - Kernel task stack
++ *
++ * - Interrupt stack if a device driver reenables interrupts
++ * which should only happen in really old drivers.
++ *
++ * - Debug IST stack
++ *
++ * All other contexts are invalid.
+ */
+ static inline void stack_overflow_check(struct pt_regs *regs)
+ {
+@@ -53,8 +62,8 @@ static inline void stack_overflow_check(struct pt_regs *regs)
+ return;
+
+ oist = this_cpu_ptr(&orig_ist);
+- estack_top = (u64)oist->ist[0] - EXCEPTION_STKSZ + STACK_TOP_MARGIN;
+- estack_bottom = (u64)oist->ist[N_EXCEPTION_STACKS - 1];
++ estack_bottom = (u64)oist->ist[DEBUG_STACK];
++ estack_top = estack_bottom - DEBUG_STKSZ + STACK_TOP_MARGIN;
+ if (regs->sp >= estack_top && regs->sp <= estack_bottom)
+ return;
+
+diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
+index f58336af095c..6645f123419c 100644
+--- a/arch/x86/kernel/module.c
++++ b/arch/x86/kernel/module.c
+@@ -87,7 +87,7 @@ void *module_alloc(unsigned long size)
+ p = __vmalloc_node_range(size, MODULE_ALIGN,
+ MODULES_VADDR + get_module_load_offset(),
+ MODULES_END, GFP_KERNEL,
+- PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
++ PAGE_KERNEL, 0, NUMA_NO_NODE,
+ __builtin_return_address(0));
+ if (p && (kasan_module_alloc(p, size) < 0)) {
+ vfree(p);
+diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
+index 92a3b312a53c..44e647a65de8 100644
+--- a/arch/x86/kernel/signal.c
++++ b/arch/x86/kernel/signal.c
+@@ -132,16 +132,6 @@ static int restore_sigcontext(struct pt_regs *regs,
+ COPY_SEG_CPL3(cs);
+ COPY_SEG_CPL3(ss);
+
+-#ifdef CONFIG_X86_64
+- /*
+- * Fix up SS if needed for the benefit of old DOSEMU and
+- * CRIU.
+- */
+- if (unlikely(!(uc_flags & UC_STRICT_RESTORE_SS) &&
+- user_64bit_mode(regs)))
+- force_valid_ss(regs);
+-#endif
+-
+ get_user_ex(tmpflags, &sc->flags);
+ regs->flags = (regs->flags & ~FIX_EFLAGS) | (tmpflags & FIX_EFLAGS);
+ regs->orig_ax = -1; /* disable syscall checks */
+@@ -150,6 +140,15 @@ static int restore_sigcontext(struct pt_regs *regs,
+ buf = (void __user *)buf_val;
+ } get_user_catch(err);
+
++#ifdef CONFIG_X86_64
++ /*
++ * Fix up SS if needed for the benefit of old DOSEMU and
++ * CRIU.
++ */
++ if (unlikely(!(uc_flags & UC_STRICT_RESTORE_SS) && user_64bit_mode(regs)))
++ force_valid_ss(regs);
++#endif
++
+ err |= fpu__restore_sig(buf, IS_ENABLED(CONFIG_X86_32));
+
+ force_iret();
+@@ -461,6 +460,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
+ {
+ struct rt_sigframe __user *frame;
+ void __user *fp = NULL;
++ unsigned long uc_flags;
+ int err = 0;
+
+ frame = get_sigframe(&ksig->ka, regs, sizeof(struct rt_sigframe), &fp);
+@@ -473,9 +473,11 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
+ return -EFAULT;
+ }
+
++ uc_flags = frame_uc_flags(regs);
++
+ put_user_try {
+ /* Create the ucontext. */
+- put_user_ex(frame_uc_flags(regs), &frame->uc.uc_flags);
++ put_user_ex(uc_flags, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+ save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+
+@@ -541,6 +543,7 @@ static int x32_setup_rt_frame(struct ksignal *ksig,
+ {
+ #ifdef CONFIG_X86_X32_ABI
+ struct rt_sigframe_x32 __user *frame;
++ unsigned long uc_flags;
+ void __user *restorer;
+ int err = 0;
+ void __user *fpstate = NULL;
+@@ -555,9 +558,11 @@ static int x32_setup_rt_frame(struct ksignal *ksig,
+ return -EFAULT;
+ }
+
++ uc_flags = frame_uc_flags(regs);
++
+ put_user_try {
+ /* Create the ucontext. */
+- put_user_ex(frame_uc_flags(regs), &frame->uc.uc_flags);
++ put_user_ex(uc_flags, &frame->uc.uc_flags);
+ put_user_ex(0, &frame->uc.uc_link);
+ compat_save_altstack_ex(&frame->uc.uc_stack, regs->sp);
+ put_user_ex(0, &frame->uc.uc__pad0);
+diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
+index 85e6d5620188..2fb152d813c1 100644
+--- a/arch/x86/kernel/vmlinux.lds.S
++++ b/arch/x86/kernel/vmlinux.lds.S
+@@ -151,11 +151,11 @@ SECTIONS
+ *(.text.__x86.indirect_thunk)
+ __indirect_thunk_end = .;
+ #endif
+-
+- /* End of text section */
+- _etext = .;
+ } :text = 0x9090
+
++ /* End of text section */
++ _etext = .;
++
+ NOTES :text :note
+
+ EXCEPTION_TABLE(16) :text = 0x9090
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 8dd9208ae4de..ea454d3f7763 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -2022,7 +2022,11 @@ static void avic_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+ if (!kvm_vcpu_apicv_active(vcpu))
+ return;
+
+- if (WARN_ON(h_physical_id >= AVIC_MAX_PHYSICAL_ID_COUNT))
++ /*
++ * Since the host physical APIC id is 8 bits,
++ * we can support host APIC ID upto 255.
++ */
++ if (WARN_ON(h_physical_id > AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK))
+ return;
+
+ entry = READ_ONCE(*(svm->avic_physical_id_cache));
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index d0eb37c069b8..be4ba0975a0f 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1188,7 +1188,7 @@ static int set_efer(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ u64 efer = msr_info->data;
+
+ if (efer & efer_reserved_bits)
+- return false;
++ return 1;
+
+ if (!msr_info->host_initiated) {
+ if (!__kvm_valid_efer(vcpu, efer))
+diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
+index 3b24dc05251c..9d05572370ed 100644
+--- a/arch/x86/lib/memcpy_64.S
++++ b/arch/x86/lib/memcpy_64.S
+@@ -257,6 +257,7 @@ ENTRY(__memcpy_mcsafe)
+ /* Copy successful. Return zero */
+ .L_done_memcpy_trap:
+ xorl %eax, %eax
++.L_done:
+ ret
+ ENDPROC(__memcpy_mcsafe)
+ EXPORT_SYMBOL_GPL(__memcpy_mcsafe)
+@@ -273,7 +274,7 @@ EXPORT_SYMBOL_GPL(__memcpy_mcsafe)
+ addl %edx, %ecx
+ .E_trailing_bytes:
+ mov %ecx, %eax
+- ret
++ jmp .L_done
+
+ /*
+ * For write fault handling, given the destination is unaligned,
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 47bebfe6efa7..9d9765e4d1ef 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -427,8 +427,6 @@ static noinline int vmalloc_fault(unsigned long address)
+ if (!(address >= VMALLOC_START && address < VMALLOC_END))
+ return -1;
+
+- WARN_ON_ONCE(in_nmi());
+-
+ /*
+ * Copy kernel mappings over when needed. This can also
+ * happen within a race in page table update. In the later
+diff --git a/block/genhd.c b/block/genhd.c
+index be5bab20b2ab..2b2a936cf848 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -518,6 +518,18 @@ void blk_free_devt(dev_t devt)
+ }
+ }
+
++/**
++ * We invalidate devt by assigning NULL pointer for devt in idr.
++ */
++void blk_invalidate_devt(dev_t devt)
++{
++ if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
++ spin_lock_bh(&ext_devt_lock);
++ idr_replace(&ext_devt_idr, NULL, blk_mangle_minor(MINOR(devt)));
++ spin_unlock_bh(&ext_devt_lock);
++ }
++}
++
+ static char *bdevt_str(dev_t devt, char *buf)
+ {
+ if (MAJOR(devt) <= 0xff && MINOR(devt) <= 0xff) {
+@@ -769,6 +781,13 @@ void del_gendisk(struct gendisk *disk)
+
+ if (!(disk->flags & GENHD_FL_HIDDEN))
+ blk_unregister_region(disk_devt(disk), disk->minors);
++ /*
++ * Remove gendisk pointer from idr so that it cannot be looked up
++ * while RCU period before freeing gendisk is running to prevent
++ * use-after-free issues. Note that the device number stays
++ * "in-use" until we really free the gendisk.
++ */
++ blk_invalidate_devt(disk_devt(disk));
+
+ kobject_put(disk->part0.holder_dir);
+ kobject_put(disk->slave_dir);
+diff --git a/block/partition-generic.c b/block/partition-generic.c
+index 5f8db5c5140f..98d60a59b843 100644
+--- a/block/partition-generic.c
++++ b/block/partition-generic.c
+@@ -289,6 +289,13 @@ void delete_partition(struct gendisk *disk, int partno)
+ kobject_put(part->holder_dir);
+ device_del(part_to_dev(part));
+
++ /*
++ * Remove gendisk pointer from idr so that it cannot be looked up
++ * while RCU period before freeing gendisk is running to prevent
++ * use-after-free issues. Note that the device number stays
++ * "in-use" until we really free the gendisk.
++ */
++ blk_invalidate_devt(part_devt(part));
+ hd_struct_kill(part);
+ }
+
+diff --git a/block/sed-opal.c b/block/sed-opal.c
+index e0de4dd448b3..119640897293 100644
+--- a/block/sed-opal.c
++++ b/block/sed-opal.c
+@@ -2095,13 +2095,16 @@ static int opal_erase_locking_range(struct opal_dev *dev,
+ static int opal_enable_disable_shadow_mbr(struct opal_dev *dev,
+ struct opal_mbr_data *opal_mbr)
+ {
++ u8 enable_disable = opal_mbr->enable_disable == OPAL_MBR_ENABLE ?
++ OPAL_TRUE : OPAL_FALSE;
++
+ const struct opal_step mbr_steps[] = {
+ { opal_discovery0, },
+ { start_admin1LSP_opal_session, &opal_mbr->key },
+- { set_mbr_done, &opal_mbr->enable_disable },
++ { set_mbr_done, &enable_disable },
+ { end_opal_session, },
+ { start_admin1LSP_opal_session, &opal_mbr->key },
+- { set_mbr_enable_disable, &opal_mbr->enable_disable },
++ { set_mbr_enable_disable, &enable_disable },
+ { end_opal_session, },
+ { NULL, }
+ };
+@@ -2221,7 +2224,7 @@ static int __opal_lock_unlock(struct opal_dev *dev,
+
+ static int __opal_set_mbr_done(struct opal_dev *dev, struct opal_key *key)
+ {
+- u8 mbr_done_tf = 1;
++ u8 mbr_done_tf = OPAL_TRUE;
+ const struct opal_step mbrdone_step [] = {
+ { opal_discovery0, },
+ { start_admin1LSP_opal_session, key },
+diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
+index e48eebc27b81..43c2615434b4 100644
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -1231,18 +1231,24 @@ static bool __init arm_smmu_v3_is_coherent(struct acpi_iort_node *node)
+ /*
+ * set numa proximity domain for smmuv3 device
+ */
+-static void __init arm_smmu_v3_set_proximity(struct device *dev,
++static int __init arm_smmu_v3_set_proximity(struct device *dev,
+ struct acpi_iort_node *node)
+ {
+ struct acpi_iort_smmu_v3 *smmu;
+
+ smmu = (struct acpi_iort_smmu_v3 *)node->node_data;
+ if (smmu->flags & ACPI_IORT_SMMU_V3_PXM_VALID) {
+- set_dev_node(dev, acpi_map_pxm_to_node(smmu->pxm));
++ int node = acpi_map_pxm_to_node(smmu->pxm);
++
++ if (node != NUMA_NO_NODE && !node_online(node))
++ return -EINVAL;
++
++ set_dev_node(dev, node);
+ pr_info("SMMU-v3[%llx] Mapped to Proximity domain %d\n",
+ smmu->base_address,
+ smmu->pxm);
+ }
++ return 0;
+ }
+ #else
+ #define arm_smmu_v3_set_proximity NULL
+@@ -1317,7 +1323,7 @@ struct iort_dev_config {
+ int (*dev_count_resources)(struct acpi_iort_node *node);
+ void (*dev_init_resources)(struct resource *res,
+ struct acpi_iort_node *node);
+- void (*dev_set_proximity)(struct device *dev,
++ int (*dev_set_proximity)(struct device *dev,
+ struct acpi_iort_node *node);
+ };
+
+@@ -1368,8 +1374,11 @@ static int __init iort_add_platform_device(struct acpi_iort_node *node,
+ if (!pdev)
+ return -ENOMEM;
+
+- if (ops->dev_set_proximity)
+- ops->dev_set_proximity(&pdev->dev, node);
++ if (ops->dev_set_proximity) {
++ ret = ops->dev_set_proximity(&pdev->dev, node);
++ if (ret)
++ goto dev_put;
++ }
+
+ count = ops->dev_count_resources(node);
+
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index 693cf05b0cc4..288673cff85e 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -975,6 +975,14 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
+ const struct acpi_data_node *data = to_acpi_data_node(fwnode);
+ struct acpi_data_node *dn;
+
++ /*
++ * We can have a combination of device and data nodes, e.g. with
++ * hierarchical _DSD properties. Make sure the adev pointer is
++ * restored before going through data nodes, otherwise we will
++ * be looking for data_nodes below the last device found instead
++ * of the common fwnode shared by device_nodes and data_nodes.
++ */
++ adev = to_acpi_device_node(fwnode);
+ if (adev)
+ head = &adev->data.subnodes;
+ else if (data)
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index a690fd400260..4abd7c6531d9 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -1736,6 +1736,10 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
+ if (dev->power.syscore)
+ goto Complete;
+
++ /* Avoid direct_complete to let wakeup_path propagate. */
++ if (device_may_wakeup(dev) || dev->power.wakeup_path)
++ dev->power.direct_complete = false;
++
+ if (dev->power.direct_complete) {
+ if (pm_runtime_status_suspended(dev)) {
+ pm_runtime_disable(dev);
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index f0d593c3fa72..77004c29da08 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -504,6 +504,8 @@ static int qca_open(struct hci_uart *hu)
+ qcadev = serdev_device_get_drvdata(hu->serdev);
+ if (qcadev->btsoc_type != QCA_WCN3990) {
+ gpiod_set_value_cansleep(qcadev->bt_en, 1);
++ /* Controller needs time to bootup. */
++ msleep(150);
+ } else {
+ hu->init_speed = qcadev->init_speed;
+ hu->oper_speed = qcadev->oper_speed;
+diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
+index b65ff6962899..e9b6ac61fb7f 100644
+--- a/drivers/char/hw_random/omap-rng.c
++++ b/drivers/char/hw_random/omap-rng.c
+@@ -443,6 +443,7 @@ static int omap_rng_probe(struct platform_device *pdev)
+ priv->rng.read = omap_rng_do_read;
+ priv->rng.init = omap_rng_init;
+ priv->rng.cleanup = omap_rng_cleanup;
++ priv->rng.quality = 900;
+
+ priv->rng.priv = (unsigned long)priv;
+ platform_set_drvdata(pdev, priv);
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index c75b6cdf0053..0a84b7f468ad 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -778,6 +778,7 @@ static struct crng_state **crng_node_pool __read_mostly;
+ #endif
+
+ static void invalidate_batched_entropy(void);
++static void numa_crng_init(void);
+
+ static bool trust_cpu __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU);
+ static int __init parse_trust_cpu(char *arg)
+@@ -806,7 +807,9 @@ static void crng_initialize(struct crng_state *crng)
+ }
+ crng->state[i] ^= rv;
+ }
+- if (trust_cpu && arch_init) {
++ if (trust_cpu && arch_init && crng == &primary_crng) {
++ invalidate_batched_entropy();
++ numa_crng_init();
+ crng_init = 2;
+ pr_notice("random: crng done (trusting CPU's manufacturer)\n");
+ }
+@@ -2212,8 +2215,8 @@ struct batched_entropy {
+ u32 entropy_u32[CHACHA20_BLOCK_SIZE / sizeof(u32)];
+ };
+ unsigned int position;
++ spinlock_t batch_lock;
+ };
+-static rwlock_t batched_entropy_reset_lock = __RW_LOCK_UNLOCKED(batched_entropy_reset_lock);
+
+ /*
+ * Get a random word for internal kernel use only. The quality of the random
+@@ -2223,12 +2226,14 @@ static rwlock_t batched_entropy_reset_lock = __RW_LOCK_UNLOCKED(batched_entropy_
+ * wait_for_random_bytes() should be called and return 0 at least once
+ * at any point prior.
+ */
+-static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64);
++static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64) = {
++ .batch_lock = __SPIN_LOCK_UNLOCKED(batched_entropy_u64.lock),
++};
++
+ u64 get_random_u64(void)
+ {
+ u64 ret;
+- bool use_lock;
+- unsigned long flags = 0;
++ unsigned long flags;
+ struct batched_entropy *batch;
+ static void *previous;
+
+@@ -2243,28 +2248,25 @@ u64 get_random_u64(void)
+
+ warn_unseeded_randomness(&previous);
+
+- use_lock = READ_ONCE(crng_init) < 2;
+- batch = &get_cpu_var(batched_entropy_u64);
+- if (use_lock)
+- read_lock_irqsave(&batched_entropy_reset_lock, flags);
++ batch = raw_cpu_ptr(&batched_entropy_u64);
++ spin_lock_irqsave(&batch->batch_lock, flags);
+ if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
+ extract_crng((__u32 *)batch->entropy_u64);
+ batch->position = 0;
+ }
+ ret = batch->entropy_u64[batch->position++];
+- if (use_lock)
+- read_unlock_irqrestore(&batched_entropy_reset_lock, flags);
+- put_cpu_var(batched_entropy_u64);
++ spin_unlock_irqrestore(&batch->batch_lock, flags);
+ return ret;
+ }
+ EXPORT_SYMBOL(get_random_u64);
+
+-static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32);
++static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32) = {
++ .batch_lock = __SPIN_LOCK_UNLOCKED(batched_entropy_u32.lock),
++};
+ u32 get_random_u32(void)
+ {
+ u32 ret;
+- bool use_lock;
+- unsigned long flags = 0;
++ unsigned long flags;
+ struct batched_entropy *batch;
+ static void *previous;
+
+@@ -2273,18 +2275,14 @@ u32 get_random_u32(void)
+
+ warn_unseeded_randomness(&previous);
+
+- use_lock = READ_ONCE(crng_init) < 2;
+- batch = &get_cpu_var(batched_entropy_u32);
+- if (use_lock)
+- read_lock_irqsave(&batched_entropy_reset_lock, flags);
++ batch = raw_cpu_ptr(&batched_entropy_u32);
++ spin_lock_irqsave(&batch->batch_lock, flags);
+ if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
+ extract_crng(batch->entropy_u32);
+ batch->position = 0;
+ }
+ ret = batch->entropy_u32[batch->position++];
+- if (use_lock)
+- read_unlock_irqrestore(&batched_entropy_reset_lock, flags);
+- put_cpu_var(batched_entropy_u32);
++ spin_unlock_irqrestore(&batch->batch_lock, flags);
+ return ret;
+ }
+ EXPORT_SYMBOL(get_random_u32);
+@@ -2298,12 +2296,19 @@ static void invalidate_batched_entropy(void)
+ int cpu;
+ unsigned long flags;
+
+- write_lock_irqsave(&batched_entropy_reset_lock, flags);
+ for_each_possible_cpu (cpu) {
+- per_cpu_ptr(&batched_entropy_u32, cpu)->position = 0;
+- per_cpu_ptr(&batched_entropy_u64, cpu)->position = 0;
++ struct batched_entropy *batched_entropy;
++
++ batched_entropy = per_cpu_ptr(&batched_entropy_u32, cpu);
++ spin_lock_irqsave(&batched_entropy->batch_lock, flags);
++ batched_entropy->position = 0;
++ spin_unlock(&batched_entropy->batch_lock);
++
++ batched_entropy = per_cpu_ptr(&batched_entropy_u64, cpu);
++ spin_lock(&batched_entropy->batch_lock);
++ batched_entropy->position = 0;
++ spin_unlock_irqrestore(&batched_entropy->batch_lock, flags);
+ }
+- write_unlock_irqrestore(&batched_entropy_reset_lock, flags);
+ }
+
+ /**
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index 5b5b5d72eab7..c55f6aeb4227 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -75,7 +75,7 @@ struct ports_driver_data {
+ /* All the console devices handled by this driver */
+ struct list_head consoles;
+ };
+-static struct ports_driver_data pdrvdata;
++static struct ports_driver_data pdrvdata = { .next_vtermno = 1};
+
+ static DEFINE_SPINLOCK(pdrvdata_lock);
+ static DECLARE_COMPLETION(early_console_added);
+@@ -1405,6 +1405,7 @@ static int add_port(struct ports_device *portdev, u32 id)
+ port->async_queue = NULL;
+
+ port->cons.ws.ws_row = port->cons.ws.ws_col = 0;
++ port->cons.vtermno = 0;
+
+ port->host_connected = port->guest_connected = false;
+ port->stats = (struct port_stats) { 0 };
+diff --git a/drivers/clk/rockchip/clk-rk3288.c b/drivers/clk/rockchip/clk-rk3288.c
+index 450de24a1b42..64191694ff6e 100644
+--- a/drivers/clk/rockchip/clk-rk3288.c
++++ b/drivers/clk/rockchip/clk-rk3288.c
+@@ -198,7 +198,7 @@ PNAME(mux_hsadcout_p) = { "hsadc_src", "ext_hsadc" };
+ PNAME(mux_edp_24m_p) = { "ext_edp_24m", "xin24m" };
+ PNAME(mux_tspout_p) = { "cpll", "gpll", "npll", "xin27m" };
+
+-PNAME(mux_aclk_vcodec_pre_p) = { "aclk_vepu", "aclk_vdpu" };
++PNAME(mux_aclk_vcodec_pre_p) = { "aclk_vdpu", "aclk_vepu" };
+ PNAME(mux_usbphy480m_p) = { "sclk_otgphy1_480m", "sclk_otgphy2_480m",
+ "sclk_otgphy0_480m" };
+ PNAME(mux_hsicphy480m_p) = { "cpll", "gpll", "usbphy480m_src" };
+@@ -292,13 +292,13 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = {
+ COMPOSITE_NOMUX(0, "aclk_core_mp", "armclk", CLK_IGNORE_UNUSED,
+ RK3288_CLKSEL_CON(0), 4, 4, DFLAGS | CLK_DIVIDER_READ_ONLY,
+ RK3288_CLKGATE_CON(12), 6, GFLAGS),
+- COMPOSITE_NOMUX(0, "atclk", "armclk", CLK_IGNORE_UNUSED,
++ COMPOSITE_NOMUX(0, "atclk", "armclk", 0,
+ RK3288_CLKSEL_CON(37), 4, 5, DFLAGS | CLK_DIVIDER_READ_ONLY,
+ RK3288_CLKGATE_CON(12), 7, GFLAGS),
+ COMPOSITE_NOMUX(0, "pclk_dbg_pre", "armclk", CLK_IGNORE_UNUSED,
+ RK3288_CLKSEL_CON(37), 9, 5, DFLAGS | CLK_DIVIDER_READ_ONLY,
+ RK3288_CLKGATE_CON(12), 8, GFLAGS),
+- GATE(0, "pclk_dbg", "pclk_dbg_pre", CLK_IGNORE_UNUSED,
++ GATE(0, "pclk_dbg", "pclk_dbg_pre", 0,
+ RK3288_CLKGATE_CON(12), 9, GFLAGS),
+ GATE(0, "cs_dbg", "pclk_dbg_pre", CLK_IGNORE_UNUSED,
+ RK3288_CLKGATE_CON(12), 10, GFLAGS),
+@@ -399,7 +399,7 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = {
+ COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_usb480m_p, 0,
+ RK3288_CLKSEL_CON(32), 14, 2, MFLAGS, 8, 5, DFLAGS,
+ RK3288_CLKGATE_CON(3), 11, GFLAGS),
+- MUXGRF(0, "aclk_vcodec_pre", mux_aclk_vcodec_pre_p, 0,
++ MUXGRF(0, "aclk_vcodec_pre", mux_aclk_vcodec_pre_p, CLK_SET_RATE_PARENT,
+ RK3288_GRF_SOC_CON(0), 7, 1, MFLAGS),
+ GATE(ACLK_VCODEC, "aclk_vcodec", "aclk_vcodec_pre", 0,
+ RK3288_CLKGATE_CON(9), 0, GFLAGS),
+@@ -626,7 +626,7 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = {
+ INVERTER(SCLK_HSADC, "sclk_hsadc", "sclk_hsadc_out",
+ RK3288_CLKSEL_CON(22), 7, IFLAGS),
+
+- GATE(0, "jtag", "ext_jtag", CLK_IGNORE_UNUSED,
++ GATE(0, "jtag", "ext_jtag", 0,
+ RK3288_CLKGATE_CON(4), 14, GFLAGS),
+
+ COMPOSITE_NODIV(SCLK_USBPHY480M_SRC, "usbphy480m_src", mux_usbphy480m_p, 0,
+@@ -635,7 +635,7 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = {
+ COMPOSITE_NODIV(SCLK_HSICPHY480M, "sclk_hsicphy480m", mux_hsicphy480m_p, 0,
+ RK3288_CLKSEL_CON(29), 0, 2, MFLAGS,
+ RK3288_CLKGATE_CON(3), 6, GFLAGS),
+- GATE(0, "hsicphy12m_xin12m", "xin12m", CLK_IGNORE_UNUSED,
++ GATE(0, "hsicphy12m_xin12m", "xin12m", 0,
+ RK3288_CLKGATE_CON(13), 9, GFLAGS),
+ DIV(0, "hsicphy12m_usbphy", "sclk_hsicphy480m", 0,
+ RK3288_CLKSEL_CON(11), 8, 6, DFLAGS),
+@@ -676,7 +676,7 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = {
+ GATE(PCLK_TZPC, "pclk_tzpc", "pclk_cpu", 0, RK3288_CLKGATE_CON(11), 3, GFLAGS),
+ GATE(PCLK_UART2, "pclk_uart2", "pclk_cpu", 0, RK3288_CLKGATE_CON(11), 9, GFLAGS),
+ GATE(PCLK_EFUSE256, "pclk_efuse_256", "pclk_cpu", 0, RK3288_CLKGATE_CON(11), 10, GFLAGS),
+- GATE(PCLK_RKPWM, "pclk_rkpwm", "pclk_cpu", CLK_IGNORE_UNUSED, RK3288_CLKGATE_CON(11), 11, GFLAGS),
++ GATE(PCLK_RKPWM, "pclk_rkpwm", "pclk_cpu", 0, RK3288_CLKGATE_CON(11), 11, GFLAGS),
+
+ /* ddrctrl [DDR Controller PHY clock] gates */
+ GATE(0, "nclk_ddrupctl0", "ddrphy", CLK_IGNORE_UNUSED, RK3288_CLKGATE_CON(11), 4, GFLAGS),
+@@ -816,12 +816,9 @@ static const char *const rk3288_critical_clocks[] __initconst = {
+ "pclk_alive_niu",
+ "pclk_pd_pmu",
+ "pclk_pmu_niu",
+- "pclk_core_niu",
+- "pclk_ddrupctl0",
+- "pclk_publ0",
+- "pclk_ddrupctl1",
+- "pclk_publ1",
+ "pmu_hclk_otg0",
++ /* pwm-regulators on some boards, so handoff-critical later */
++ "pclk_rkpwm",
+ };
+
+ static void __iomem *rk3288_cru_base;
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 505c9a55d555..d3213594d1a7 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1103,6 +1103,7 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
+ cpufreq_global_kobject, "policy%u", cpu);
+ if (ret) {
+ pr_err("%s: failed to init policy->kobj: %d\n", __func__, ret);
++ kobject_put(&policy->kobj);
+ goto err_free_real_cpus;
+ }
+
+diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
+index 6d53f7d9fc7a..69fc5cf4782f 100644
+--- a/drivers/cpufreq/cpufreq_governor.c
++++ b/drivers/cpufreq/cpufreq_governor.c
+@@ -459,6 +459,8 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy)
+ /* Failure, so roll back. */
+ pr_err("initialization failed (dbs_data kobject init error %d)\n", ret);
+
++ kobject_put(&dbs_data->attr_set.kobj);
++
+ policy->governor_data = NULL;
+
+ if (!have_governor_per_policy())
+diff --git a/drivers/cpufreq/kirkwood-cpufreq.c b/drivers/cpufreq/kirkwood-cpufreq.c
+index c2dd43f3f5d8..8d63a6dc8383 100644
+--- a/drivers/cpufreq/kirkwood-cpufreq.c
++++ b/drivers/cpufreq/kirkwood-cpufreq.c
+@@ -124,13 +124,14 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
+ priv.cpu_clk = of_clk_get_by_name(np, "cpu_clk");
+ if (IS_ERR(priv.cpu_clk)) {
+ dev_err(priv.dev, "Unable to get cpuclk\n");
+- return PTR_ERR(priv.cpu_clk);
++ err = PTR_ERR(priv.cpu_clk);
++ goto out_node;
+ }
+
+ err = clk_prepare_enable(priv.cpu_clk);
+ if (err) {
+ dev_err(priv.dev, "Unable to prepare cpuclk\n");
+- return err;
++ goto out_node;
+ }
+
+ kirkwood_freq_table[0].frequency = clk_get_rate(priv.cpu_clk) / 1000;
+@@ -161,20 +162,22 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
+ goto out_ddr;
+ }
+
+- of_node_put(np);
+- np = NULL;
+-
+ err = cpufreq_register_driver(&kirkwood_cpufreq_driver);
+- if (!err)
+- return 0;
++ if (err) {
++ dev_err(priv.dev, "Failed to register cpufreq driver\n");
++ goto out_powersave;
++ }
+
+- dev_err(priv.dev, "Failed to register cpufreq driver\n");
++ of_node_put(np);
++ return 0;
+
++out_powersave:
+ clk_disable_unprepare(priv.powersave_clk);
+ out_ddr:
+ clk_disable_unprepare(priv.ddr_clk);
+ out_cpu:
+ clk_disable_unprepare(priv.cpu_clk);
++out_node:
+ of_node_put(np);
+
+ return err;
+diff --git a/drivers/cpufreq/pasemi-cpufreq.c b/drivers/cpufreq/pasemi-cpufreq.c
+index 75dfbd2a58ea..c7710c149de8 100644
+--- a/drivers/cpufreq/pasemi-cpufreq.c
++++ b/drivers/cpufreq/pasemi-cpufreq.c
+@@ -146,6 +146,7 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
+
+ cpu = of_get_cpu_node(policy->cpu, NULL);
+
++ of_node_put(cpu);
+ if (!cpu)
+ goto out;
+
+diff --git a/drivers/cpufreq/pmac32-cpufreq.c b/drivers/cpufreq/pmac32-cpufreq.c
+index 61ae06ca008e..e225edb5c359 100644
+--- a/drivers/cpufreq/pmac32-cpufreq.c
++++ b/drivers/cpufreq/pmac32-cpufreq.c
+@@ -552,6 +552,7 @@ static int pmac_cpufreq_init_7447A(struct device_node *cpunode)
+ volt_gpio_np = of_find_node_by_name(NULL, "cpu-vcore-select");
+ if (volt_gpio_np)
+ voltage_gpio = read_gpio(volt_gpio_np);
++ of_node_put(volt_gpio_np);
+ if (!voltage_gpio){
+ pr_err("missing cpu-vcore-select gpio\n");
+ return 1;
+@@ -588,6 +589,7 @@ static int pmac_cpufreq_init_750FX(struct device_node *cpunode)
+ if (volt_gpio_np)
+ voltage_gpio = read_gpio(volt_gpio_np);
+
++ of_node_put(volt_gpio_np);
+ pvr = mfspr(SPRN_PVR);
+ has_cpu_l2lve = !((pvr & 0xf00) == 0x100);
+
+diff --git a/drivers/cpufreq/ppc_cbe_cpufreq.c b/drivers/cpufreq/ppc_cbe_cpufreq.c
+index 41a0f0be3f9f..8414c3a4ea08 100644
+--- a/drivers/cpufreq/ppc_cbe_cpufreq.c
++++ b/drivers/cpufreq/ppc_cbe_cpufreq.c
+@@ -86,6 +86,7 @@ static int cbe_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ if (!cbe_get_cpu_pmd_regs(policy->cpu) ||
+ !cbe_get_cpu_mic_tm_regs(policy->cpu)) {
+ pr_info("invalid CBE regs pointers for cpufreq\n");
++ of_node_put(cpu);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
+index a4b5ff2b72f8..f6936bb3b7be 100644
+--- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
++++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
+@@ -240,7 +240,10 @@ static int sun4i_hash(struct ahash_request *areq)
+ }
+ } else {
+ /* Since we have the flag final, we can go up to modulo 4 */
+- end = ((areq->nbytes + op->len) / 4) * 4 - op->len;
++ if (areq->nbytes < 4)
++ end = 0;
++ else
++ end = ((areq->nbytes + op->len) / 4) * 4 - op->len;
+ }
+
+ /* TODO if SGlen % 4 and !op->len then DMA */
+diff --git a/drivers/crypto/vmx/aesp8-ppc.pl b/drivers/crypto/vmx/aesp8-ppc.pl
+index de78282b8f44..9c6b5c1d6a1a 100644
+--- a/drivers/crypto/vmx/aesp8-ppc.pl
++++ b/drivers/crypto/vmx/aesp8-ppc.pl
+@@ -1357,7 +1357,7 @@ Loop_ctr32_enc:
+ addi $idx,$idx,16
+ bdnz Loop_ctr32_enc
+
+- vadduwm $ivec,$ivec,$one
++ vadduqm $ivec,$ivec,$one
+ vmr $dat,$inptail
+ lvx $inptail,0,$inp
+ addi $inp,$inp,16
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index a75b95fac3bd..db5b8fe1dd4a 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -1606,7 +1606,11 @@ static void at_xdmac_tasklet(unsigned long data)
+ struct at_xdmac_desc,
+ xfer_node);
+ dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc);
+- BUG_ON(!desc->active_xfer);
++ if (!desc->active_xfer) {
++ dev_err(chan2dev(&atchan->chan), "Xfer not active: exiting");
++ spin_unlock_bh(&atchan->lock);
++ return;
++ }
+
+ txd = &desc->tx_dma_desc;
+
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 88750a34e859..bc8050c025b7 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -961,6 +961,7 @@ static void _stop(struct pl330_thread *thrd)
+ {
+ void __iomem *regs = thrd->dmac->base;
+ u8 insn[6] = {0, 0, 0, 0, 0, 0};
++ u32 inten = readl(regs + INTEN);
+
+ if (_state(thrd) == PL330_STATE_FAULT_COMPLETING)
+ UNTIL(thrd, PL330_STATE_FAULTING | PL330_STATE_KILLING);
+@@ -973,10 +974,13 @@ static void _stop(struct pl330_thread *thrd)
+
+ _emit_KILL(0, insn);
+
+- /* Stop generating interrupts for SEV */
+- writel(readl(regs + INTEN) & ~(1 << thrd->ev), regs + INTEN);
+-
+ _execute_DBGINSN(thrd, insn, is_manager(thrd));
++
++ /* clear the event */
++ if (inten & (1 << thrd->ev))
++ writel(1 << thrd->ev, regs + INTCLR);
++ /* Stop generating interrupts for SEV */
++ writel(inten & ~(1 << thrd->ev), regs + INTEN);
+ }
+
+ /* Start doing req 'idx' of thread 'thrd' */
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index b26256f23d67..09b6756366c3 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -22,7 +22,6 @@
+ #include <linux/of_device.h>
+ #include <linux/of_dma.h>
+ #include <linux/of_irq.h>
+-#include <linux/pm_clock.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/slab.h>
+
+@@ -141,6 +140,7 @@ struct tegra_adma {
+ struct dma_device dma_dev;
+ struct device *dev;
+ void __iomem *base_addr;
++ struct clk *ahub_clk;
+ unsigned int nr_channels;
+ unsigned long rx_requests_reserved;
+ unsigned long tx_requests_reserved;
+@@ -637,8 +637,9 @@ static int tegra_adma_runtime_suspend(struct device *dev)
+ struct tegra_adma *tdma = dev_get_drvdata(dev);
+
+ tdma->global_cmd = tdma_read(tdma, ADMA_GLOBAL_CMD);
++ clk_disable_unprepare(tdma->ahub_clk);
+
+- return pm_clk_suspend(dev);
++ return 0;
+ }
+
+ static int tegra_adma_runtime_resume(struct device *dev)
+@@ -646,10 +647,11 @@ static int tegra_adma_runtime_resume(struct device *dev)
+ struct tegra_adma *tdma = dev_get_drvdata(dev);
+ int ret;
+
+- ret = pm_clk_resume(dev);
+- if (ret)
++ ret = clk_prepare_enable(tdma->ahub_clk);
++ if (ret) {
++ dev_err(dev, "ahub clk_enable failed: %d\n", ret);
+ return ret;
+-
++ }
+ tdma_write(tdma, ADMA_GLOBAL_CMD, tdma->global_cmd);
+
+ return 0;
+@@ -692,13 +694,11 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ if (IS_ERR(tdma->base_addr))
+ return PTR_ERR(tdma->base_addr);
+
+- ret = pm_clk_create(&pdev->dev);
+- if (ret)
+- return ret;
+-
+- ret = of_pm_clk_add_clk(&pdev->dev, "d_audio");
+- if (ret)
+- goto clk_destroy;
++ tdma->ahub_clk = devm_clk_get(&pdev->dev, "d_audio");
++ if (IS_ERR(tdma->ahub_clk)) {
++ dev_err(&pdev->dev, "Error: Missing ahub controller clock\n");
++ return PTR_ERR(tdma->ahub_clk);
++ }
+
+ pm_runtime_enable(&pdev->dev);
+
+@@ -775,8 +775,6 @@ rpm_put:
+ pm_runtime_put_sync(&pdev->dev);
+ rpm_disable:
+ pm_runtime_disable(&pdev->dev);
+-clk_destroy:
+- pm_clk_destroy(&pdev->dev);
+
+ return ret;
+ }
+@@ -786,6 +784,7 @@ static int tegra_adma_remove(struct platform_device *pdev)
+ struct tegra_adma *tdma = platform_get_drvdata(pdev);
+ int i;
+
++ of_dma_controller_free(pdev->dev.of_node);
+ dma_async_device_unregister(&tdma->dma_dev);
+
+ for (i = 0; i < tdma->nr_channels; ++i)
+@@ -793,7 +792,6 @@ static int tegra_adma_remove(struct platform_device *pdev)
+
+ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- pm_clk_destroy(&pdev->dev);
+
+ return 0;
+ }
+diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c
+index da0e9bc4262f..9327479c719c 100644
+--- a/drivers/extcon/extcon-arizona.c
++++ b/drivers/extcon/extcon-arizona.c
+@@ -1726,6 +1726,16 @@ static int arizona_extcon_remove(struct platform_device *pdev)
+ struct arizona_extcon_info *info = platform_get_drvdata(pdev);
+ struct arizona *arizona = info->arizona;
+ int jack_irq_rise, jack_irq_fall;
++ bool change;
++
++ regmap_update_bits_check(arizona->regmap, ARIZONA_MIC_DETECT_1,
++ ARIZONA_MICD_ENA, 0,
++ &change);
++
++ if (change) {
++ regulator_disable(info->micvdd);
++ pm_runtime_put(info->dev);
++ }
+
+ gpiod_put(info->micd_pol_gpio);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+index 7056925eb386..869ff624b108 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+@@ -136,8 +136,9 @@ int amdgpu_fence_emit(struct amdgpu_ring *ring, struct dma_fence **f,
+ {
+ struct amdgpu_device *adev = ring->adev;
+ struct amdgpu_fence *fence;
+- struct dma_fence *old, **ptr;
++ struct dma_fence __rcu **ptr;
+ uint32_t seq;
++ int r;
+
+ fence = kmem_cache_alloc(amdgpu_fence_slab, GFP_KERNEL);
+ if (fence == NULL)
+@@ -153,15 +154,24 @@ int amdgpu_fence_emit(struct amdgpu_ring *ring, struct dma_fence **f,
+ seq, flags | AMDGPU_FENCE_FLAG_INT);
+
+ ptr = &ring->fence_drv.fences[seq & ring->fence_drv.num_fences_mask];
++ if (unlikely(rcu_dereference_protected(*ptr, 1))) {
++ struct dma_fence *old;
++
++ rcu_read_lock();
++ old = dma_fence_get_rcu_safe(ptr);
++ rcu_read_unlock();
++
++ if (old) {
++ r = dma_fence_wait(old, false);
++ dma_fence_put(old);
++ if (r)
++ return r;
++ }
++ }
++
+ /* This function can't be called concurrently anyway, otherwise
+ * emitting the fence would mess up the hardware ring buffer.
+ */
+- old = rcu_dereference_protected(*ptr, 1);
+- if (old && !dma_fence_is_signaled(old)) {
+- DRM_INFO("rcu slot is busy\n");
+- dma_fence_wait(old, false);
+- }
+-
+ rcu_assign_pointer(*ptr, dma_fence_get(&fence->base));
+
+ *f = &fence->base;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 76ee2de43ea6..dac7978f5ee1 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4369,8 +4369,7 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state,
+ static void amdgpu_dm_crtc_copy_transient_flags(struct drm_crtc_state *crtc_state,
+ struct dc_stream_state *stream_state)
+ {
+- stream_state->mode_changed =
+- crtc_state->mode_changed || crtc_state->active_changed;
++ stream_state->mode_changed = drm_atomic_crtc_needs_modeset(crtc_state);
+ }
+
+ static int amdgpu_dm_atomic_commit(struct drm_device *dev,
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index 87bf422f16be..e0a96abb3c46 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -1401,10 +1401,12 @@ bool dc_remove_plane_from_context(
+ * For head pipe detach surfaces from pipe for tail
+ * pipe just zero it out
+ */
+- if (!pipe_ctx->top_pipe) {
++ if (!pipe_ctx->top_pipe ||
++ (!pipe_ctx->top_pipe->top_pipe &&
++ pipe_ctx->top_pipe->stream_res.opp != pipe_ctx->stream_res.opp)) {
+ pipe_ctx->plane_state = NULL;
+ pipe_ctx->bottom_pipe = NULL;
+- } else {
++ } else {
+ memset(pipe_ctx, 0, sizeof(*pipe_ctx));
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
+index 4a863a5dab41..321af9af95e8 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
+@@ -406,15 +406,25 @@ void dpp1_dscl_calc_lb_num_partitions(
+ int *num_part_y,
+ int *num_part_c)
+ {
++ int lb_memory_size, lb_memory_size_c, lb_memory_size_a, num_partitions_a,
++ lb_bpc, memory_line_size_y, memory_line_size_c, memory_line_size_a;
++
+ int line_size = scl_data->viewport.width < scl_data->recout.width ?
+ scl_data->viewport.width : scl_data->recout.width;
+ int line_size_c = scl_data->viewport_c.width < scl_data->recout.width ?
+ scl_data->viewport_c.width : scl_data->recout.width;
+- int lb_bpc = dpp1_dscl_get_lb_depth_bpc(scl_data->lb_params.depth);
+- int memory_line_size_y = (line_size * lb_bpc + 71) / 72; /* +71 to ceil */
+- int memory_line_size_c = (line_size_c * lb_bpc + 71) / 72; /* +71 to ceil */
+- int memory_line_size_a = (line_size + 5) / 6; /* +5 to ceil */
+- int lb_memory_size, lb_memory_size_c, lb_memory_size_a, num_partitions_a;
++
++ if (line_size == 0)
++ line_size = 1;
++
++ if (line_size_c == 0)
++ line_size_c = 1;
++
++
++ lb_bpc = dpp1_dscl_get_lb_depth_bpc(scl_data->lb_params.depth);
++ memory_line_size_y = (line_size * lb_bpc + 71) / 72; /* +71 to ceil */
++ memory_line_size_c = (line_size_c * lb_bpc + 71) / 72; /* +71 to ceil */
++ memory_line_size_a = (line_size + 5) / 6; /* +5 to ceil */
+
+ if (lb_config == LB_MEMORY_CONFIG_1) {
+ lb_memory_size = 816;
+diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
+index 0201ccb22f4c..d8ae4ca129c7 100644
+--- a/drivers/gpu/drm/drm_drv.c
++++ b/drivers/gpu/drm/drm_drv.c
+@@ -499,7 +499,7 @@ int drm_dev_init(struct drm_device *dev,
+ }
+
+ kref_init(&dev->ref);
+- dev->dev = parent;
++ dev->dev = get_device(parent);
+ dev->driver = driver;
+
+ INIT_LIST_HEAD(&dev->filelist);
+@@ -568,6 +568,7 @@ err_minors:
+ drm_minor_free(dev, DRM_MINOR_RENDER);
+ drm_fs_inode_free(dev->anon_inode);
+ err_free:
++ put_device(dev->dev);
+ mutex_destroy(&dev->master_mutex);
+ mutex_destroy(&dev->ctxlist_mutex);
+ mutex_destroy(&dev->clientlist_mutex);
+@@ -603,6 +604,8 @@ void drm_dev_fini(struct drm_device *dev)
+ drm_minor_free(dev, DRM_MINOR_PRIMARY);
+ drm_minor_free(dev, DRM_MINOR_RENDER);
+
++ put_device(dev->dev);
++
+ mutex_destroy(&dev->master_mutex);
+ mutex_destroy(&dev->ctxlist_mutex);
+ mutex_destroy(&dev->clientlist_mutex);
+diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
+index e4ccb52c67ea..334addaca9c5 100644
+--- a/drivers/gpu/drm/drm_file.c
++++ b/drivers/gpu/drm/drm_file.c
+@@ -567,6 +567,7 @@ put_back_event:
+ file_priv->event_space -= length;
+ list_add(&e->link, &file_priv->event_list);
+ spin_unlock_irq(&dev->event_lock);
++ wake_up_interruptible(&file_priv->event_wait);
+ break;
+ }
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
+index 83c1f46670bf..00675fcbffa2 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
+@@ -527,6 +527,9 @@ static int etnaviv_bind(struct device *dev)
+ }
+ drm->dev_private = priv;
+
++ dev->dma_parms = &priv->dma_parms;
++ dma_set_max_seg_size(dev, SZ_2G);
++
+ mutex_init(&priv->gem_lock);
+ INIT_LIST_HEAD(&priv->gem_list);
+ priv->num_gpus = 0;
+@@ -564,6 +567,8 @@ static void etnaviv_unbind(struct device *dev)
+
+ component_unbind_all(dev, drm);
+
++ dev->dma_parms = NULL;
++
+ drm->dev_private = NULL;
+ kfree(priv);
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.h b/drivers/gpu/drm/etnaviv/etnaviv_drv.h
+index 8d02d1b7dcf5..b2930d1fe97c 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_drv.h
++++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.h
+@@ -43,6 +43,7 @@ struct etnaviv_file_private {
+
+ struct etnaviv_drm_private {
+ int num_gpus;
++ struct device_dma_parameters dma_parms;
+ struct etnaviv_gpu *gpu[ETNA_MAX_PIPES];
+
+ /* list of GEM objects: */
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index ab1d9308c311..ba6f3c14495c 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -35,7 +35,7 @@ static int zap_shader_load_mdt(struct msm_gpu *gpu, const char *fwname)
+ {
+ struct device *dev = &gpu->pdev->dev;
+ const struct firmware *fw;
+- struct device_node *np;
++ struct device_node *np, *mem_np;
+ struct resource r;
+ phys_addr_t mem_phys;
+ ssize_t mem_size;
+@@ -49,11 +49,13 @@ static int zap_shader_load_mdt(struct msm_gpu *gpu, const char *fwname)
+ if (!np)
+ return -ENODEV;
+
+- np = of_parse_phandle(np, "memory-region", 0);
+- if (!np)
++ mem_np = of_parse_phandle(np, "memory-region", 0);
++ of_node_put(np);
++ if (!mem_np)
+ return -EINVAL;
+
+- ret = of_address_to_resource(np, 0, &r);
++ ret = of_address_to_resource(mem_np, 0, &r);
++ of_node_put(mem_np);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c
+index 157b076a1272..38c9c086754b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c
+@@ -109,7 +109,7 @@ nv50_bar_oneinit(struct nvkm_bar *base)
+ struct nvkm_device *device = bar->base.subdev.device;
+ static struct lock_class_key bar1_lock;
+ static struct lock_class_key bar2_lock;
+- u64 start, limit;
++ u64 start, limit, size;
+ int ret;
+
+ ret = nvkm_gpuobj_new(device, 0x20000, 0, false, NULL, &bar->mem);
+@@ -127,7 +127,10 @@ nv50_bar_oneinit(struct nvkm_bar *base)
+
+ /* BAR2 */
+ start = 0x0100000000ULL;
+- limit = start + device->func->resource_size(device, 3);
++ size = device->func->resource_size(device, 3);
++ if (!size)
++ return -ENOMEM;
++ limit = start + size;
+
+ ret = nvkm_vmm_new(device, start, limit-- - start, NULL, 0,
+ &bar2_lock, "bar2", &bar->bar2_vmm);
+@@ -164,7 +167,10 @@ nv50_bar_oneinit(struct nvkm_bar *base)
+
+ /* BAR1 */
+ start = 0x0000000000ULL;
+- limit = start + device->func->resource_size(device, 1);
++ size = device->func->resource_size(device, 1);
++ if (!size)
++ return -ENOMEM;
++ limit = start + size;
+
+ ret = nvkm_vmm_new(device, start, limit-- - start, NULL, 0,
+ &bar1_lock, "bar1", &bar->bar1_vmm);
+diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
+index 74467b308721..8160954ebc25 100644
+--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
++++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
+@@ -1386,12 +1386,9 @@ static int dsi_pll_enable(struct dss_pll *pll)
+ */
+ dsi_enable_scp_clk(dsi);
+
+- if (!dsi->vdds_dsi_enabled) {
+- r = regulator_enable(dsi->vdds_dsi_reg);
+- if (r)
+- goto err0;
+- dsi->vdds_dsi_enabled = true;
+- }
++ r = regulator_enable(dsi->vdds_dsi_reg);
++ if (r)
++ goto err0;
+
+ /* XXX PLL does not come out of reset without this... */
+ dispc_pck_free_enable(dsi->dss->dispc, 1);
+@@ -1416,36 +1413,25 @@ static int dsi_pll_enable(struct dss_pll *pll)
+
+ return 0;
+ err1:
+- if (dsi->vdds_dsi_enabled) {
+- regulator_disable(dsi->vdds_dsi_reg);
+- dsi->vdds_dsi_enabled = false;
+- }
++ regulator_disable(dsi->vdds_dsi_reg);
+ err0:
+ dsi_disable_scp_clk(dsi);
+ dsi_runtime_put(dsi);
+ return r;
+ }
+
+-static void dsi_pll_uninit(struct dsi_data *dsi, bool disconnect_lanes)
++static void dsi_pll_disable(struct dss_pll *pll)
+ {
++ struct dsi_data *dsi = container_of(pll, struct dsi_data, pll);
++
+ dsi_pll_power(dsi, DSI_PLL_POWER_OFF);
+- if (disconnect_lanes) {
+- WARN_ON(!dsi->vdds_dsi_enabled);
+- regulator_disable(dsi->vdds_dsi_reg);
+- dsi->vdds_dsi_enabled = false;
+- }
++
++ regulator_disable(dsi->vdds_dsi_reg);
+
+ dsi_disable_scp_clk(dsi);
+ dsi_runtime_put(dsi);
+
+- DSSDBG("PLL uninit done\n");
+-}
+-
+-static void dsi_pll_disable(struct dss_pll *pll)
+-{
+- struct dsi_data *dsi = container_of(pll, struct dsi_data, pll);
+-
+- dsi_pll_uninit(dsi, true);
++ DSSDBG("PLL disable done\n");
+ }
+
+ static void dsi_dump_dsi_clocks(struct dsi_data *dsi, struct seq_file *s)
+@@ -4195,11 +4181,11 @@ static int dsi_display_init_dsi(struct dsi_data *dsi)
+
+ r = dss_pll_enable(&dsi->pll);
+ if (r)
+- goto err0;
++ return r;
+
+ r = dsi_configure_dsi_clocks(dsi);
+ if (r)
+- goto err1;
++ goto err0;
+
+ dss_select_dsi_clk_source(dsi->dss, dsi->module_id,
+ dsi->module_id == 0 ?
+@@ -4207,6 +4193,14 @@ static int dsi_display_init_dsi(struct dsi_data *dsi)
+
+ DSSDBG("PLL OK\n");
+
++ if (!dsi->vdds_dsi_enabled) {
++ r = regulator_enable(dsi->vdds_dsi_reg);
++ if (r)
++ goto err1;
++
++ dsi->vdds_dsi_enabled = true;
++ }
++
+ r = dsi_cio_init(dsi);
+ if (r)
+ goto err2;
+@@ -4235,10 +4229,13 @@ static int dsi_display_init_dsi(struct dsi_data *dsi)
+ err3:
+ dsi_cio_uninit(dsi);
+ err2:
+- dss_select_dsi_clk_source(dsi->dss, dsi->module_id, DSS_CLK_SRC_FCK);
++ regulator_disable(dsi->vdds_dsi_reg);
++ dsi->vdds_dsi_enabled = false;
+ err1:
+- dss_pll_disable(&dsi->pll);
++ dss_select_dsi_clk_source(dsi->dss, dsi->module_id, DSS_CLK_SRC_FCK);
+ err0:
++ dss_pll_disable(&dsi->pll);
++
+ return r;
+ }
+
+@@ -4257,7 +4254,12 @@ static void dsi_display_uninit_dsi(struct dsi_data *dsi, bool disconnect_lanes,
+
+ dss_select_dsi_clk_source(dsi->dss, dsi->module_id, DSS_CLK_SRC_FCK);
+ dsi_cio_uninit(dsi);
+- dsi_pll_uninit(dsi, disconnect_lanes);
++ dss_pll_disable(&dsi->pll);
++
++ if (disconnect_lanes) {
++ regulator_disable(dsi->vdds_dsi_reg);
++ dsi->vdds_dsi_enabled = false;
++ }
+ }
+
+ static int dsi_display_enable(struct omap_dss_device *dssdev)
+diff --git a/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c b/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
+index 87fa316e1d7b..58ccf648b70f 100644
+--- a/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
++++ b/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
+@@ -248,6 +248,9 @@ static int otm8009a_init_sequence(struct otm8009a *ctx)
+ /* Send Command GRAM memory write (no parameters) */
+ dcs_write_seq(ctx, MIPI_DCS_WRITE_MEMORY_START);
+
++ /* Wait a short while to let the panel be ready before the 1st frame */
++ mdelay(10);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/pl111/pl111_versatile.c b/drivers/gpu/drm/pl111/pl111_versatile.c
+index b9baefdba38a..1c318ad32a8c 100644
+--- a/drivers/gpu/drm/pl111/pl111_versatile.c
++++ b/drivers/gpu/drm/pl111/pl111_versatile.c
+@@ -330,6 +330,7 @@ int pl111_versatile_init(struct device *dev, struct pl111_drm_dev_private *priv)
+ ret = vexpress_muxfpga_init();
+ if (ret) {
+ dev_err(dev, "unable to initialize muxfpga driver\n");
++ of_node_put(np);
+ return ret;
+ }
+
+@@ -337,17 +338,20 @@ int pl111_versatile_init(struct device *dev, struct pl111_drm_dev_private *priv)
+ pdev = of_find_device_by_node(np);
+ if (!pdev) {
+ dev_err(dev, "can't find the sysreg device, deferring\n");
++ of_node_put(np);
+ return -EPROBE_DEFER;
+ }
+ map = dev_get_drvdata(&pdev->dev);
+ if (!map) {
+ dev_err(dev, "sysreg has not yet probed\n");
+ platform_device_put(pdev);
++ of_node_put(np);
+ return -EPROBE_DEFER;
+ }
+ } else {
+ map = syscon_node_to_regmap(np);
+ }
++ of_node_put(np);
+
+ if (IS_ERR(map)) {
+ dev_err(dev, "no Versatile syscon regmap\n");
+diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+index e3b34a345546..97a0573cc514 100644
+--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+@@ -357,7 +357,13 @@ static void sun6i_dsi_inst_init(struct sun6i_dsi *dsi,
+ static u16 sun6i_dsi_get_video_start_delay(struct sun6i_dsi *dsi,
+ struct drm_display_mode *mode)
+ {
+- return mode->vtotal - (mode->vsync_end - mode->vdisplay) + 1;
++ u16 start = clamp(mode->vtotal - mode->vdisplay - 10, 8, 100);
++ u16 delay = mode->vtotal - (mode->vsync_end - mode->vdisplay) + start;
++
++ if (delay > mode->vtotal)
++ delay = delay % mode->vtotal;
++
++ return max_t(u16, delay, 1);
+ }
+
+ static void sun6i_dsi_setup_burst(struct sun6i_dsi *dsi,
+diff --git a/drivers/gpu/drm/tinydrm/ili9225.c b/drivers/gpu/drm/tinydrm/ili9225.c
+index 455fefe012f5..6044a01069ce 100644
+--- a/drivers/gpu/drm/tinydrm/ili9225.c
++++ b/drivers/gpu/drm/tinydrm/ili9225.c
+@@ -278,7 +278,7 @@ static void ili9225_pipe_disable(struct drm_simple_display_pipe *pipe)
+ mipi->enabled = false;
+ }
+
+-static int ili9225_dbi_command(struct mipi_dbi *mipi, u8 cmd, u8 *par,
++static int ili9225_dbi_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par,
+ size_t num)
+ {
+ struct spi_device *spi = mipi->spi;
+@@ -288,11 +288,11 @@ static int ili9225_dbi_command(struct mipi_dbi *mipi, u8 cmd, u8 *par,
+
+ gpiod_set_value_cansleep(mipi->dc, 0);
+ speed_hz = mipi_dbi_spi_cmd_max_speed(spi, 1);
+- ret = tinydrm_spi_transfer(spi, speed_hz, NULL, 8, &cmd, 1);
++ ret = tinydrm_spi_transfer(spi, speed_hz, NULL, 8, cmd, 1);
+ if (ret || !num)
+ return ret;
+
+- if (cmd == ILI9225_WRITE_DATA_TO_GRAM && !mipi->swap_bytes)
++ if (*cmd == ILI9225_WRITE_DATA_TO_GRAM && !mipi->swap_bytes)
+ bpw = 16;
+
+ gpiod_set_value_cansleep(mipi->dc, 1);
+diff --git a/drivers/gpu/drm/tinydrm/mipi-dbi.c b/drivers/gpu/drm/tinydrm/mipi-dbi.c
+index cb3441e51d5f..e772a8a9da80 100644
+--- a/drivers/gpu/drm/tinydrm/mipi-dbi.c
++++ b/drivers/gpu/drm/tinydrm/mipi-dbi.c
+@@ -144,16 +144,42 @@ EXPORT_SYMBOL(mipi_dbi_command_read);
+ */
+ int mipi_dbi_command_buf(struct mipi_dbi *mipi, u8 cmd, u8 *data, size_t len)
+ {
++ u8 *cmdbuf;
+ int ret;
+
++ /* SPI requires dma-safe buffers */
++ cmdbuf = kmemdup(&cmd, 1, GFP_KERNEL);
++ if (!cmdbuf)
++ return -ENOMEM;
++
+ mutex_lock(&mipi->cmdlock);
+- ret = mipi->command(mipi, cmd, data, len);
++ ret = mipi->command(mipi, cmdbuf, data, len);
+ mutex_unlock(&mipi->cmdlock);
+
++ kfree(cmdbuf);
++
+ return ret;
+ }
+ EXPORT_SYMBOL(mipi_dbi_command_buf);
+
++/* This should only be used by mipi_dbi_command() */
++int mipi_dbi_command_stackbuf(struct mipi_dbi *mipi, u8 cmd, u8 *data, size_t len)
++{
++ u8 *buf;
++ int ret;
++
++ buf = kmemdup(data, len, GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
++
++ ret = mipi_dbi_command_buf(mipi, cmd, buf, len);
++
++ kfree(buf);
++
++ return ret;
++}
++EXPORT_SYMBOL(mipi_dbi_command_stackbuf);
++
+ /**
+ * mipi_dbi_buf_copy - Copy a framebuffer, transforming it if necessary
+ * @dst: The destination buffer
+@@ -741,18 +767,18 @@ static int mipi_dbi_spi1_transfer(struct mipi_dbi *mipi, int dc,
+ return 0;
+ }
+
+-static int mipi_dbi_typec1_command(struct mipi_dbi *mipi, u8 cmd,
++static int mipi_dbi_typec1_command(struct mipi_dbi *mipi, u8 *cmd,
+ u8 *parameters, size_t num)
+ {
+- unsigned int bpw = (cmd == MIPI_DCS_WRITE_MEMORY_START) ? 16 : 8;
++ unsigned int bpw = (*cmd == MIPI_DCS_WRITE_MEMORY_START) ? 16 : 8;
+ int ret;
+
+- if (mipi_dbi_command_is_read(mipi, cmd))
++ if (mipi_dbi_command_is_read(mipi, *cmd))
+ return -ENOTSUPP;
+
+- MIPI_DBI_DEBUG_COMMAND(cmd, parameters, num);
++ MIPI_DBI_DEBUG_COMMAND(*cmd, parameters, num);
+
+- ret = mipi_dbi_spi1_transfer(mipi, 0, &cmd, 1, 8);
++ ret = mipi_dbi_spi1_transfer(mipi, 0, cmd, 1, 8);
+ if (ret || !num)
+ return ret;
+
+@@ -761,7 +787,7 @@ static int mipi_dbi_typec1_command(struct mipi_dbi *mipi, u8 cmd,
+
+ /* MIPI DBI Type C Option 3 */
+
+-static int mipi_dbi_typec3_command_read(struct mipi_dbi *mipi, u8 cmd,
++static int mipi_dbi_typec3_command_read(struct mipi_dbi *mipi, u8 *cmd,
+ u8 *data, size_t len)
+ {
+ struct spi_device *spi = mipi->spi;
+@@ -770,7 +796,7 @@ static int mipi_dbi_typec3_command_read(struct mipi_dbi *mipi, u8 cmd,
+ struct spi_transfer tr[2] = {
+ {
+ .speed_hz = speed_hz,
+- .tx_buf = &cmd,
++ .tx_buf = cmd,
+ .len = 1,
+ }, {
+ .speed_hz = speed_hz,
+@@ -788,8 +814,8 @@ static int mipi_dbi_typec3_command_read(struct mipi_dbi *mipi, u8 cmd,
+ * Support non-standard 24-bit and 32-bit Nokia read commands which
+ * start with a dummy clock, so we need to read an extra byte.
+ */
+- if (cmd == MIPI_DCS_GET_DISPLAY_ID ||
+- cmd == MIPI_DCS_GET_DISPLAY_STATUS) {
++ if (*cmd == MIPI_DCS_GET_DISPLAY_ID ||
++ *cmd == MIPI_DCS_GET_DISPLAY_STATUS) {
+ if (!(len == 3 || len == 4))
+ return -EINVAL;
+
+@@ -819,7 +845,7 @@ static int mipi_dbi_typec3_command_read(struct mipi_dbi *mipi, u8 cmd,
+ data[i] = (buf[i] << 1) | !!(buf[i + 1] & BIT(7));
+ }
+
+- MIPI_DBI_DEBUG_COMMAND(cmd, data, len);
++ MIPI_DBI_DEBUG_COMMAND(*cmd, data, len);
+
+ err_free:
+ kfree(buf);
+@@ -827,7 +853,7 @@ err_free:
+ return ret;
+ }
+
+-static int mipi_dbi_typec3_command(struct mipi_dbi *mipi, u8 cmd,
++static int mipi_dbi_typec3_command(struct mipi_dbi *mipi, u8 *cmd,
+ u8 *par, size_t num)
+ {
+ struct spi_device *spi = mipi->spi;
+@@ -835,18 +861,18 @@ static int mipi_dbi_typec3_command(struct mipi_dbi *mipi, u8 cmd,
+ u32 speed_hz;
+ int ret;
+
+- if (mipi_dbi_command_is_read(mipi, cmd))
++ if (mipi_dbi_command_is_read(mipi, *cmd))
+ return mipi_dbi_typec3_command_read(mipi, cmd, par, num);
+
+- MIPI_DBI_DEBUG_COMMAND(cmd, par, num);
++ MIPI_DBI_DEBUG_COMMAND(*cmd, par, num);
+
+ gpiod_set_value_cansleep(mipi->dc, 0);
+ speed_hz = mipi_dbi_spi_cmd_max_speed(spi, 1);
+- ret = tinydrm_spi_transfer(spi, speed_hz, NULL, 8, &cmd, 1);
++ ret = tinydrm_spi_transfer(spi, speed_hz, NULL, 8, cmd, 1);
+ if (ret || !num)
+ return ret;
+
+- if (cmd == MIPI_DCS_WRITE_MEMORY_START && !mipi->swap_bytes)
++ if (*cmd == MIPI_DCS_WRITE_MEMORY_START && !mipi->swap_bytes)
+ bpw = 16;
+
+ gpiod_set_value_cansleep(mipi->dc, 1);
+diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
+index 2a85fa68ffea..2a4c6187e675 100644
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -305,14 +305,18 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
+ if (ret)
+ goto dev_destroy;
+
+- v3d_irq_init(v3d);
++ ret = v3d_irq_init(v3d);
++ if (ret)
++ goto gem_destroy;
+
+ ret = drm_dev_register(drm, 0);
+ if (ret)
+- goto gem_destroy;
++ goto irq_disable;
+
+ return 0;
+
++irq_disable:
++ v3d_irq_disable(v3d);
+ gem_destroy:
+ v3d_gem_destroy(drm);
+ dev_destroy:
+diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h
+index e6fed696ad86..0ad73f4b7509 100644
+--- a/drivers/gpu/drm/v3d/v3d_drv.h
++++ b/drivers/gpu/drm/v3d/v3d_drv.h
+@@ -284,7 +284,7 @@ void v3d_invalidate_caches(struct v3d_dev *v3d);
+ void v3d_flush_caches(struct v3d_dev *v3d);
+
+ /* v3d_irq.c */
+-void v3d_irq_init(struct v3d_dev *v3d);
++int v3d_irq_init(struct v3d_dev *v3d);
+ void v3d_irq_enable(struct v3d_dev *v3d);
+ void v3d_irq_disable(struct v3d_dev *v3d);
+ void v3d_irq_reset(struct v3d_dev *v3d);
+diff --git a/drivers/gpu/drm/v3d/v3d_irq.c b/drivers/gpu/drm/v3d/v3d_irq.c
+index e07514eb11b5..22be0f2dff99 100644
+--- a/drivers/gpu/drm/v3d/v3d_irq.c
++++ b/drivers/gpu/drm/v3d/v3d_irq.c
+@@ -137,7 +137,7 @@ v3d_hub_irq(int irq, void *arg)
+ return status;
+ }
+
+-void
++int
+ v3d_irq_init(struct v3d_dev *v3d)
+ {
+ int ret, core;
+@@ -154,13 +154,22 @@ v3d_irq_init(struct v3d_dev *v3d)
+ ret = devm_request_irq(v3d->dev, platform_get_irq(v3d->pdev, 0),
+ v3d_hub_irq, IRQF_SHARED,
+ "v3d_hub", v3d);
++ if (ret)
++ goto fail;
++
+ ret = devm_request_irq(v3d->dev, platform_get_irq(v3d->pdev, 1),
+ v3d_irq, IRQF_SHARED,
+ "v3d_core0", v3d);
+ if (ret)
+- dev_err(v3d->dev, "IRQ setup failed: %d\n", ret);
++ goto fail;
+
+ v3d_irq_enable(v3d);
++ return 0;
++
++fail:
++ if (ret != -EPROBE_DEFER)
++ dev_err(v3d->dev, "IRQ setup failed: %d\n", ret);
++ return ret;
+ }
+
+ void
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 44564f61e9cc..861375561156 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -215,13 +215,14 @@ static unsigned hid_lookup_collection(struct hid_parser *parser, unsigned type)
+ * Add a usage to the temporary parser table.
+ */
+
+-static int hid_add_usage(struct hid_parser *parser, unsigned usage)
++static int hid_add_usage(struct hid_parser *parser, unsigned usage, u8 size)
+ {
+ if (parser->local.usage_index >= HID_MAX_USAGES) {
+ hid_err(parser->device, "usage index exceeded\n");
+ return -1;
+ }
+ parser->local.usage[parser->local.usage_index] = usage;
++ parser->local.usage_size[parser->local.usage_index] = size;
+ parser->local.collection_index[parser->local.usage_index] =
+ parser->collection_stack_ptr ?
+ parser->collection_stack[parser->collection_stack_ptr - 1] : 0;
+@@ -482,10 +483,7 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item)
+ return 0;
+ }
+
+- if (item->size <= 2)
+- data = (parser->global.usage_page << 16) + data;
+-
+- return hid_add_usage(parser, data);
++ return hid_add_usage(parser, data, item->size);
+
+ case HID_LOCAL_ITEM_TAG_USAGE_MINIMUM:
+
+@@ -494,9 +492,6 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item)
+ return 0;
+ }
+
+- if (item->size <= 2)
+- data = (parser->global.usage_page << 16) + data;
+-
+ parser->local.usage_minimum = data;
+ return 0;
+
+@@ -507,9 +502,6 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item)
+ return 0;
+ }
+
+- if (item->size <= 2)
+- data = (parser->global.usage_page << 16) + data;
+-
+ count = data - parser->local.usage_minimum;
+ if (count + parser->local.usage_index >= HID_MAX_USAGES) {
+ /*
+@@ -529,7 +521,7 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item)
+ }
+
+ for (n = parser->local.usage_minimum; n <= data; n++)
+- if (hid_add_usage(parser, n)) {
++ if (hid_add_usage(parser, n, item->size)) {
+ dbg_hid("hid_add_usage failed\n");
+ return -1;
+ }
+@@ -543,6 +535,22 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item)
+ return 0;
+ }
+
++/*
++ * Concatenate Usage Pages into Usages where relevant:
++ * As per specification, 6.2.2.8: "When the parser encounters a main item it
++ * concatenates the last declared Usage Page with a Usage to form a complete
++ * usage value."
++ */
++
++static void hid_concatenate_usage_page(struct hid_parser *parser)
++{
++ int i;
++
++ for (i = 0; i < parser->local.usage_index; i++)
++ if (parser->local.usage_size[i] <= 2)
++ parser->local.usage[i] += parser->global.usage_page << 16;
++}
++
+ /*
+ * Process a main item.
+ */
+@@ -552,6 +560,8 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item)
+ __u32 data;
+ int ret;
+
++ hid_concatenate_usage_page(parser);
++
+ data = item_udata(item);
+
+ switch (item->tag) {
+@@ -761,6 +771,8 @@ static int hid_scan_main(struct hid_parser *parser, struct hid_item *item)
+ __u32 data;
+ int i;
+
++ hid_concatenate_usage_page(parser);
++
+ data = item_udata(item);
+
+ switch (item->tag) {
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 8425d3548a41..e642cfaf303b 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -725,13 +725,16 @@ static int hidpp_root_get_feature(struct hidpp_device *hidpp, u16 feature,
+
+ static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp)
+ {
++ const u8 ping_byte = 0x5a;
++ u8 ping_data[3] = { 0, 0, ping_byte };
+ struct hidpp_report response;
+ int ret;
+
+- ret = hidpp_send_fap_command_sync(hidpp,
++ ret = hidpp_send_rap_command_sync(hidpp,
++ REPORT_ID_HIDPP_SHORT,
+ HIDPP_PAGE_ROOT_IDX,
+ CMD_ROOT_GET_PROTOCOL_VERSION,
+- NULL, 0, &response);
++ ping_data, sizeof(ping_data), &response);
+
+ if (ret == HIDPP_ERROR_INVALID_SUBID) {
+ hidpp->protocol_major = 1;
+@@ -751,8 +754,14 @@ static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp)
+ if (ret)
+ return ret;
+
+- hidpp->protocol_major = response.fap.params[0];
+- hidpp->protocol_minor = response.fap.params[1];
++ if (response.rap.params[2] != ping_byte) {
++ hid_err(hidpp->hid_dev, "%s: ping mismatch 0x%02x != 0x%02x\n",
++ __func__, response.rap.params[2], ping_byte);
++ return -EPROTO;
++ }
++
++ hidpp->protocol_major = response.rap.params[0];
++ hidpp->protocol_minor = response.rap.params[1];
+
+ return ret;
+ }
+@@ -901,7 +910,11 @@ static int hidpp_map_battery_level(int capacity)
+ {
+ if (capacity < 11)
+ return POWER_SUPPLY_CAPACITY_LEVEL_CRITICAL;
+- else if (capacity < 31)
++ /*
++ * The spec says this should be < 31 but some devices report 30
++ * with brand new batteries and Windows reports 30 as "Good".
++ */
++ else if (capacity < 30)
+ return POWER_SUPPLY_CAPACITY_LEVEL_LOW;
+ else if (capacity < 81)
+ return POWER_SUPPLY_CAPACITY_LEVEL_NORMAL;
+diff --git a/drivers/hwmon/f71805f.c b/drivers/hwmon/f71805f.c
+index 73c681162653..623736d2a7c1 100644
+--- a/drivers/hwmon/f71805f.c
++++ b/drivers/hwmon/f71805f.c
+@@ -96,17 +96,23 @@ superio_select(int base, int ld)
+ outb(ld, base + 1);
+ }
+
+-static inline void
++static inline int
+ superio_enter(int base)
+ {
++ if (!request_muxed_region(base, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x87, base);
+ outb(0x87, base);
++
++ return 0;
+ }
+
+ static inline void
+ superio_exit(int base)
+ {
+ outb(0xaa, base);
++ release_region(base, 2);
+ }
+
+ /*
+@@ -1561,7 +1567,7 @@ exit:
+ static int __init f71805f_find(int sioaddr, unsigned short *address,
+ struct f71805f_sio_data *sio_data)
+ {
+- int err = -ENODEV;
++ int err;
+ u16 devid;
+
+ static const char * const names[] = {
+@@ -1569,8 +1575,11 @@ static int __init f71805f_find(int sioaddr, unsigned short *address,
+ "F71872F/FG or F71806F/FG",
+ };
+
+- superio_enter(sioaddr);
++ err = superio_enter(sioaddr);
++ if (err)
++ return err;
+
++ err = -ENODEV;
+ devid = superio_inw(sioaddr, SIO_REG_MANID);
+ if (devid != SIO_FINTEK_ID)
+ goto exit;
+diff --git a/drivers/hwmon/pc87427.c b/drivers/hwmon/pc87427.c
+index dc5a9d5ada51..81a05cd1a512 100644
+--- a/drivers/hwmon/pc87427.c
++++ b/drivers/hwmon/pc87427.c
+@@ -106,6 +106,13 @@ static const char *logdev_str[2] = { DRVNAME " FMC", DRVNAME " HMC" };
+ #define LD_IN 1
+ #define LD_TEMP 1
+
++static inline int superio_enter(int sioaddr)
++{
++ if (!request_muxed_region(sioaddr, 2, DRVNAME))
++ return -EBUSY;
++ return 0;
++}
++
+ static inline void superio_outb(int sioaddr, int reg, int val)
+ {
+ outb(reg, sioaddr);
+@@ -122,6 +129,7 @@ static inline void superio_exit(int sioaddr)
+ {
+ outb(0x02, sioaddr);
+ outb(0x02, sioaddr + 1);
++ release_region(sioaddr, 2);
+ }
+
+ /*
+@@ -1220,7 +1228,11 @@ static int __init pc87427_find(int sioaddr, struct pc87427_sio_data *sio_data)
+ {
+ u16 val;
+ u8 cfg, cfg_b;
+- int i, err = 0;
++ int i, err;
++
++ err = superio_enter(sioaddr);
++ if (err)
++ return err;
+
+ /* Identify device */
+ val = force_id ? force_id : superio_inb(sioaddr, SIOREG_DEVID);
+diff --git a/drivers/hwmon/smsc47b397.c b/drivers/hwmon/smsc47b397.c
+index 6bd200756560..cbdb5c4991ae 100644
+--- a/drivers/hwmon/smsc47b397.c
++++ b/drivers/hwmon/smsc47b397.c
+@@ -72,14 +72,19 @@ static inline void superio_select(int ld)
+ superio_outb(0x07, ld);
+ }
+
+-static inline void superio_enter(void)
++static inline int superio_enter(void)
+ {
++ if (!request_muxed_region(REG, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x55, REG);
++ return 0;
+ }
+
+ static inline void superio_exit(void)
+ {
+ outb(0xAA, REG);
++ release_region(REG, 2);
+ }
+
+ #define SUPERIO_REG_DEVID 0x20
+@@ -300,8 +305,12 @@ static int __init smsc47b397_find(void)
+ u8 id, rev;
+ char *name;
+ unsigned short addr;
++ int err;
++
++ err = superio_enter();
++ if (err)
++ return err;
+
+- superio_enter();
+ id = force_id ? force_id : superio_inb(SUPERIO_REG_DEVID);
+
+ switch (id) {
+diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
+index c7b6a425e2c0..5eeac9853d0a 100644
+--- a/drivers/hwmon/smsc47m1.c
++++ b/drivers/hwmon/smsc47m1.c
+@@ -73,16 +73,21 @@ superio_inb(int reg)
+ /* logical device for fans is 0x0A */
+ #define superio_select() superio_outb(0x07, 0x0A)
+
+-static inline void
++static inline int
+ superio_enter(void)
+ {
++ if (!request_muxed_region(REG, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x55, REG);
++ return 0;
+ }
+
+ static inline void
+ superio_exit(void)
+ {
+ outb(0xAA, REG);
++ release_region(REG, 2);
+ }
+
+ #define SUPERIO_REG_ACT 0x30
+@@ -531,8 +536,12 @@ static int __init smsc47m1_find(struct smsc47m1_sio_data *sio_data)
+ {
+ u8 val;
+ unsigned short addr;
++ int err;
++
++ err = superio_enter();
++ if (err)
++ return err;
+
+- superio_enter();
+ val = force_id ? force_id : superio_inb(SUPERIO_REG_DEVID);
+
+ /*
+@@ -608,13 +617,14 @@ static int __init smsc47m1_find(struct smsc47m1_sio_data *sio_data)
+ static void smsc47m1_restore(const struct smsc47m1_sio_data *sio_data)
+ {
+ if ((sio_data->activate & 0x01) == 0) {
+- superio_enter();
+- superio_select();
+-
+- pr_info("Disabling device\n");
+- superio_outb(SUPERIO_REG_ACT, sio_data->activate);
+-
+- superio_exit();
++ if (!superio_enter()) {
++ superio_select();
++ pr_info("Disabling device\n");
++ superio_outb(SUPERIO_REG_ACT, sio_data->activate);
++ superio_exit();
++ } else {
++ pr_warn("Failed to disable device\n");
++ }
+ }
+ }
+
+diff --git a/drivers/hwmon/vt1211.c b/drivers/hwmon/vt1211.c
+index 3a6bfa51cb94..95d5e8ec8b7f 100644
+--- a/drivers/hwmon/vt1211.c
++++ b/drivers/hwmon/vt1211.c
+@@ -226,15 +226,21 @@ static inline void superio_select(int sio_cip, int ldn)
+ outb(ldn, sio_cip + 1);
+ }
+
+-static inline void superio_enter(int sio_cip)
++static inline int superio_enter(int sio_cip)
+ {
++ if (!request_muxed_region(sio_cip, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x87, sio_cip);
+ outb(0x87, sio_cip);
++
++ return 0;
+ }
+
+ static inline void superio_exit(int sio_cip)
+ {
+ outb(0xaa, sio_cip);
++ release_region(sio_cip, 2);
+ }
+
+ /* ---------------------------------------------------------------------
+@@ -1282,11 +1288,14 @@ EXIT:
+
+ static int __init vt1211_find(int sio_cip, unsigned short *address)
+ {
+- int err = -ENODEV;
++ int err;
+ int devid;
+
+- superio_enter(sio_cip);
++ err = superio_enter(sio_cip);
++ if (err)
++ return err;
+
++ err = -ENODEV;
+ devid = force_id ? force_id : superio_inb(sio_cip, SIO_VT1211_DEVID);
+ if (devid != SIO_VT1211_ID)
+ goto EXIT;
+diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
+index 4a754921fb6f..9421c1ec86f7 100644
+--- a/drivers/iio/adc/Kconfig
++++ b/drivers/iio/adc/Kconfig
+@@ -696,6 +696,7 @@ config STM32_DFSDM_ADC
+ depends on (ARCH_STM32 && OF) || COMPILE_TEST
+ select STM32_DFSDM_CORE
+ select REGMAP_MMIO
++ select IIO_BUFFER
+ select IIO_BUFFER_HW_CONSUMER
+ help
+ Select this option to support ADCSigma delta modulator for
+diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
+index ae2a5097f449..25af4c76b57f 100644
+--- a/drivers/iio/adc/ad_sigma_delta.c
++++ b/drivers/iio/adc/ad_sigma_delta.c
+@@ -62,7 +62,7 @@ int ad_sd_write_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg,
+ struct spi_transfer t = {
+ .tx_buf = data,
+ .len = size + 1,
+- .cs_change = sigma_delta->bus_locked,
++ .cs_change = sigma_delta->keep_cs_asserted,
+ };
+ struct spi_message m;
+ int ret;
+@@ -218,6 +218,7 @@ static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta,
+
+ spi_bus_lock(sigma_delta->spi->master);
+ sigma_delta->bus_locked = true;
++ sigma_delta->keep_cs_asserted = true;
+ reinit_completion(&sigma_delta->completion);
+
+ ret = ad_sigma_delta_set_mode(sigma_delta, mode);
+@@ -235,9 +236,10 @@ static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta,
+ ret = 0;
+ }
+ out:
++ sigma_delta->keep_cs_asserted = false;
++ ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE);
+ sigma_delta->bus_locked = false;
+ spi_bus_unlock(sigma_delta->spi->master);
+- ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE);
+
+ return ret;
+ }
+@@ -289,6 +291,7 @@ int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev,
+
+ spi_bus_lock(sigma_delta->spi->master);
+ sigma_delta->bus_locked = true;
++ sigma_delta->keep_cs_asserted = true;
+ reinit_completion(&sigma_delta->completion);
+
+ ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_SINGLE);
+@@ -298,9 +301,6 @@ int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev,
+ ret = wait_for_completion_interruptible_timeout(
+ &sigma_delta->completion, HZ);
+
+- sigma_delta->bus_locked = false;
+- spi_bus_unlock(sigma_delta->spi->master);
+-
+ if (ret == 0)
+ ret = -EIO;
+ if (ret < 0)
+@@ -316,7 +316,10 @@ out:
+ sigma_delta->irq_dis = true;
+ }
+
++ sigma_delta->keep_cs_asserted = false;
+ ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE);
++ sigma_delta->bus_locked = false;
++ spi_bus_unlock(sigma_delta->spi->master);
+ mutex_unlock(&indio_dev->mlock);
+
+ if (ret)
+@@ -353,6 +356,8 @@ static int ad_sd_buffer_postenable(struct iio_dev *indio_dev)
+
+ spi_bus_lock(sigma_delta->spi->master);
+ sigma_delta->bus_locked = true;
++ sigma_delta->keep_cs_asserted = true;
++
+ ret = ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_CONTINUOUS);
+ if (ret)
+ goto err_unlock;
+@@ -381,6 +386,7 @@ static int ad_sd_buffer_postdisable(struct iio_dev *indio_dev)
+ sigma_delta->irq_dis = true;
+ }
+
++ sigma_delta->keep_cs_asserted = false;
+ ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE);
+
+ sigma_delta->bus_locked = false;
+diff --git a/drivers/iio/adc/ti-ads7950.c b/drivers/iio/adc/ti-ads7950.c
+index a5bd5944bc66..c9cd7e5c1b61 100644
+--- a/drivers/iio/adc/ti-ads7950.c
++++ b/drivers/iio/adc/ti-ads7950.c
+@@ -56,6 +56,9 @@ struct ti_ads7950_state {
+ struct spi_message ring_msg;
+ struct spi_message scan_single_msg;
+
++ /* Lock to protect the spi xfer buffers */
++ struct mutex slock;
++
+ struct regulator *reg;
+ unsigned int vref_mv;
+
+@@ -277,6 +280,7 @@ static irqreturn_t ti_ads7950_trigger_handler(int irq, void *p)
+ struct ti_ads7950_state *st = iio_priv(indio_dev);
+ int ret;
+
++ mutex_lock(&st->slock);
+ ret = spi_sync(st->spi, &st->ring_msg);
+ if (ret < 0)
+ goto out;
+@@ -285,6 +289,7 @@ static irqreturn_t ti_ads7950_trigger_handler(int irq, void *p)
+ iio_get_time_ns(indio_dev));
+
+ out:
++ mutex_unlock(&st->slock);
+ iio_trigger_notify_done(indio_dev->trig);
+
+ return IRQ_HANDLED;
+@@ -295,7 +300,7 @@ static int ti_ads7950_scan_direct(struct iio_dev *indio_dev, unsigned int ch)
+ struct ti_ads7950_state *st = iio_priv(indio_dev);
+ int ret, cmd;
+
+- mutex_lock(&indio_dev->mlock);
++ mutex_lock(&st->slock);
+
+ cmd = TI_ADS7950_CR_WRITE | TI_ADS7950_CR_CHAN(ch) | st->settings;
+ st->single_tx = cpu_to_be16(cmd);
+@@ -307,7 +312,7 @@ static int ti_ads7950_scan_direct(struct iio_dev *indio_dev, unsigned int ch)
+ ret = be16_to_cpu(st->single_rx);
+
+ out:
+- mutex_unlock(&indio_dev->mlock);
++ mutex_unlock(&st->slock);
+
+ return ret;
+ }
+@@ -423,16 +428,19 @@ static int ti_ads7950_probe(struct spi_device *spi)
+ if (ACPI_COMPANION(&spi->dev))
+ st->vref_mv = TI_ADS7950_VA_MV_ACPI_DEFAULT;
+
++ mutex_init(&st->slock);
++
+ st->reg = devm_regulator_get(&spi->dev, "vref");
+ if (IS_ERR(st->reg)) {
+ dev_err(&spi->dev, "Failed get get regulator \"vref\"\n");
+- return PTR_ERR(st->reg);
++ ret = PTR_ERR(st->reg);
++ goto error_destroy_mutex;
+ }
+
+ ret = regulator_enable(st->reg);
+ if (ret) {
+ dev_err(&spi->dev, "Failed to enable regulator \"vref\"\n");
+- return ret;
++ goto error_destroy_mutex;
+ }
+
+ ret = iio_triggered_buffer_setup(indio_dev, NULL,
+@@ -454,6 +462,8 @@ error_cleanup_ring:
+ iio_triggered_buffer_cleanup(indio_dev);
+ error_disable_reg:
+ regulator_disable(st->reg);
++error_destroy_mutex:
++ mutex_destroy(&st->slock);
+
+ return ret;
+ }
+@@ -466,6 +476,7 @@ static int ti_ads7950_remove(struct spi_device *spi)
+ iio_device_unregister(indio_dev);
+ iio_triggered_buffer_cleanup(indio_dev);
+ regulator_disable(st->reg);
++ mutex_destroy(&st->slock);
+
+ return 0;
+ }
+diff --git a/drivers/iio/common/ssp_sensors/ssp_iio.c b/drivers/iio/common/ssp_sensors/ssp_iio.c
+index 645f2e3975db..e38f704d88b7 100644
+--- a/drivers/iio/common/ssp_sensors/ssp_iio.c
++++ b/drivers/iio/common/ssp_sensors/ssp_iio.c
+@@ -81,7 +81,7 @@ int ssp_common_process_data(struct iio_dev *indio_dev, void *buf,
+ unsigned int len, int64_t timestamp)
+ {
+ __le32 time;
+- int64_t calculated_time;
++ int64_t calculated_time = 0;
+ struct ssp_sensor_data *spd = iio_priv(indio_dev);
+
+ if (indio_dev->scan_bytes == 0)
+diff --git a/drivers/iio/magnetometer/hmc5843_i2c.c b/drivers/iio/magnetometer/hmc5843_i2c.c
+index 3de7f4426ac4..86abba5827a2 100644
+--- a/drivers/iio/magnetometer/hmc5843_i2c.c
++++ b/drivers/iio/magnetometer/hmc5843_i2c.c
+@@ -58,8 +58,13 @@ static const struct regmap_config hmc5843_i2c_regmap_config = {
+ static int hmc5843_i2c_probe(struct i2c_client *cli,
+ const struct i2c_device_id *id)
+ {
++ struct regmap *regmap = devm_regmap_init_i2c(cli,
++ &hmc5843_i2c_regmap_config);
++ if (IS_ERR(regmap))
++ return PTR_ERR(regmap);
++
+ return hmc5843_common_probe(&cli->dev,
+- devm_regmap_init_i2c(cli, &hmc5843_i2c_regmap_config),
++ regmap,
+ id->driver_data, id->name);
+ }
+
+diff --git a/drivers/iio/magnetometer/hmc5843_spi.c b/drivers/iio/magnetometer/hmc5843_spi.c
+index 535f03a70d63..79b2b707f90e 100644
+--- a/drivers/iio/magnetometer/hmc5843_spi.c
++++ b/drivers/iio/magnetometer/hmc5843_spi.c
+@@ -58,6 +58,7 @@ static const struct regmap_config hmc5843_spi_regmap_config = {
+ static int hmc5843_spi_probe(struct spi_device *spi)
+ {
+ int ret;
++ struct regmap *regmap;
+ const struct spi_device_id *id = spi_get_device_id(spi);
+
+ spi->mode = SPI_MODE_3;
+@@ -67,8 +68,12 @@ static int hmc5843_spi_probe(struct spi_device *spi)
+ if (ret)
+ return ret;
+
++ regmap = devm_regmap_init_spi(spi, &hmc5843_spi_regmap_config);
++ if (IS_ERR(regmap))
++ return PTR_ERR(regmap);
++
+ return hmc5843_common_probe(&spi->dev,
+- devm_regmap_init_spi(spi, &hmc5843_spi_regmap_config),
++ regmap,
+ id->driver_data, id->name);
+ }
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 6f5be7802476..39dc7be56884 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -1078,18 +1078,31 @@ static inline bool cma_any_addr(const struct sockaddr *addr)
+ return cma_zero_addr(addr) || cma_loopback_addr(addr);
+ }
+
+-static int cma_addr_cmp(struct sockaddr *src, struct sockaddr *dst)
++static int cma_addr_cmp(const struct sockaddr *src, const struct sockaddr *dst)
+ {
+ if (src->sa_family != dst->sa_family)
+ return -1;
+
+ switch (src->sa_family) {
+ case AF_INET:
+- return ((struct sockaddr_in *) src)->sin_addr.s_addr !=
+- ((struct sockaddr_in *) dst)->sin_addr.s_addr;
+- case AF_INET6:
+- return ipv6_addr_cmp(&((struct sockaddr_in6 *) src)->sin6_addr,
+- &((struct sockaddr_in6 *) dst)->sin6_addr);
++ return ((struct sockaddr_in *)src)->sin_addr.s_addr !=
++ ((struct sockaddr_in *)dst)->sin_addr.s_addr;
++ case AF_INET6: {
++ struct sockaddr_in6 *src_addr6 = (struct sockaddr_in6 *)src;
++ struct sockaddr_in6 *dst_addr6 = (struct sockaddr_in6 *)dst;
++ bool link_local;
++
++ if (ipv6_addr_cmp(&src_addr6->sin6_addr,
++ &dst_addr6->sin6_addr))
++ return 1;
++ link_local = ipv6_addr_type(&dst_addr6->sin6_addr) &
++ IPV6_ADDR_LINKLOCAL;
++ /* Link local must match their scope_ids */
++ return link_local ? (src_addr6->sin6_scope_id !=
++ dst_addr6->sin6_scope_id) :
++ 0;
++ }
++
+ default:
+ return ib_addr_cmp(&((struct sockaddr_ib *) src)->sib_addr,
+ &((struct sockaddr_ib *) dst)->sib_addr);
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index a68569ec86bf..3be6405d9855 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -458,6 +458,8 @@ static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp)
+ skb_reset_transport_header(skb);
+ } else {
+ skb = alloc_skb(len, gfp);
++ if (!skb)
++ return NULL;
+ }
+ t4_set_arp_err_handler(skb, NULL, NULL);
+ return skb;
+diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
+index da786eb18558..368f4f08b686 100644
+--- a/drivers/infiniband/hw/hfi1/init.c
++++ b/drivers/infiniband/hw/hfi1/init.c
+@@ -798,7 +798,8 @@ static int create_workqueues(struct hfi1_devdata *dd)
+ ppd->hfi1_wq =
+ alloc_workqueue(
+ "hfi%d_%d",
+- WQ_SYSFS | WQ_HIGHPRI | WQ_CPU_INTENSIVE,
++ WQ_SYSFS | WQ_HIGHPRI | WQ_CPU_INTENSIVE |
++ WQ_MEM_RECLAIM,
+ HFI1_MAX_ACTIVE_WORKQUEUE_ENTRIES,
+ dd->unit, pidx);
+ if (!ppd->hfi1_wq)
+diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
+index 0d96c5bb38cd..d2d4ab9ab071 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
++++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
+@@ -66,7 +66,7 @@ struct ib_ah *hns_roce_create_ah(struct ib_pd *ibpd,
+ HNS_ROCE_VLAN_SL_BIT_MASK) <<
+ HNS_ROCE_VLAN_SL_SHIFT;
+
+- ah->av.port_pd = cpu_to_be32(to_hr_pd(ibpd)->pdn |
++ ah->av.port_pd = cpu_to_le32(to_hr_pd(ibpd)->pdn |
+ (rdma_ah_get_port_num(ah_attr) <<
+ HNS_ROCE_PORT_NUM_SHIFT));
+ ah->av.gid_index = grh->sgid_index;
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index 7a28232d868b..de85b3af3b39 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -327,10 +327,11 @@ static int bch_allocator_thread(void *arg)
+ * possibly issue discards to them, then we add the bucket to
+ * the free list:
+ */
+- while (!fifo_empty(&ca->free_inc)) {
++ while (1) {
+ long bucket;
+
+- fifo_pop(&ca->free_inc, bucket);
++ if (!fifo_pop(&ca->free_inc, bucket))
++ break;
+
+ if (ca->discard) {
+ mutex_unlock(&ca->set->bucket_lock);
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 772258ee1f51..f880e5eba8dd 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -317,6 +317,18 @@ void bch_journal_mark(struct cache_set *c, struct list_head *list)
+ }
+ }
+
++bool is_discard_enabled(struct cache_set *s)
++{
++ struct cache *ca;
++ unsigned int i;
++
++ for_each_cache(ca, s, i)
++ if (ca->discard)
++ return true;
++
++ return false;
++}
++
+ int bch_journal_replay(struct cache_set *s, struct list_head *list)
+ {
+ int ret = 0, keys = 0, entries = 0;
+@@ -330,9 +342,17 @@ int bch_journal_replay(struct cache_set *s, struct list_head *list)
+ list_for_each_entry(i, list, list) {
+ BUG_ON(i->pin && atomic_read(i->pin) != 1);
+
+- cache_set_err_on(n != i->j.seq, s,
+-"bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)",
+- n, i->j.seq - 1, start, end);
++ if (n != i->j.seq) {
++ if (n == start && is_discard_enabled(s))
++ pr_info("bcache: journal entries %llu-%llu may be discarded! (replaying %llu-%llu)",
++ n, i->j.seq - 1, start, end);
++ else {
++ pr_err("bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)",
++ n, i->j.seq - 1, start, end);
++ ret = -EIO;
++ goto err;
++ }
++ }
+
+ for (k = i->j.start;
+ k < bset_bkey_last(&i->j);
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 2c0d35c882ed..2409507d7bff 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1770,13 +1770,15 @@ err:
+ return NULL;
+ }
+
+-static void run_cache_set(struct cache_set *c)
++static int run_cache_set(struct cache_set *c)
+ {
+ const char *err = "cannot allocate memory";
+ struct cached_dev *dc, *t;
+ struct cache *ca;
+ struct closure cl;
+ unsigned int i;
++ LIST_HEAD(journal);
++ struct journal_replay *l;
+
+ closure_init_stack(&cl);
+
+@@ -1864,7 +1866,9 @@ static void run_cache_set(struct cache_set *c)
+ if (j->version < BCACHE_JSET_VERSION_UUID)
+ __uuid_write(c);
+
+- bch_journal_replay(c, &journal);
++ err = "bcache: replay journal failed";
++ if (bch_journal_replay(c, &journal))
++ goto err;
+ } else {
+ pr_notice("invalidating existing data");
+
+@@ -1932,11 +1936,19 @@ static void run_cache_set(struct cache_set *c)
+ flash_devs_run(c);
+
+ set_bit(CACHE_SET_RUNNING, &c->flags);
+- return;
++ return 0;
+ err:
++ while (!list_empty(&journal)) {
++ l = list_first_entry(&journal, struct journal_replay, list);
++ list_del(&l->list);
++ kfree(l);
++ }
++
+ closure_sync(&cl);
+ /* XXX: test this, it's broken */
+ bch_cache_set_error(c, "%s", err);
++
++ return -EIO;
+ }
+
+ static bool can_attach_cache(struct cache *ca, struct cache_set *c)
+@@ -2000,8 +2012,11 @@ found:
+ ca->set->cache[ca->sb.nr_this_dev] = ca;
+ c->cache_by_alloc[c->caches_loaded++] = ca;
+
+- if (c->caches_loaded == c->sb.nr_in_set)
+- run_cache_set(c);
++ if (c->caches_loaded == c->sb.nr_in_set) {
++ err = "failed to run cache set";
++ if (run_cache_set(c) < 0)
++ goto err;
++ }
+
+ return NULL;
+ err:
+diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
+index 6889c25c62cb..9226dca44e90 100644
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -668,6 +668,11 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
+ return -EBUSY;
+ }
+
++ if (q->waiting_in_dqbuf && *count) {
++ dprintk(1, "another dup()ped fd is waiting for a buffer\n");
++ return -EBUSY;
++ }
++
+ if (*count == 0 || q->num_buffers != 0 ||
+ (q->memory != VB2_MEMORY_UNKNOWN && q->memory != memory)) {
+ /*
+@@ -797,6 +802,10 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
+ }
+
+ if (!q->num_buffers) {
++ if (q->waiting_in_dqbuf && *count) {
++ dprintk(1, "another dup()ped fd is waiting for a buffer\n");
++ return -EBUSY;
++ }
+ memset(q->alloc_devs, 0, sizeof(q->alloc_devs));
+ q->memory = memory;
+ q->waiting_for_buffers = !q->is_output;
+@@ -1466,6 +1475,11 @@ static int __vb2_wait_for_done_vb(struct vb2_queue *q, int nonblocking)
+ for (;;) {
+ int ret;
+
++ if (q->waiting_in_dqbuf) {
++ dprintk(1, "another dup()ped fd is waiting for a buffer\n");
++ return -EBUSY;
++ }
++
+ if (!q->streaming) {
+ dprintk(1, "streaming off, will not wait for buffers\n");
+ return -EINVAL;
+@@ -1493,6 +1507,7 @@ static int __vb2_wait_for_done_vb(struct vb2_queue *q, int nonblocking)
+ return -EAGAIN;
+ }
+
++ q->waiting_in_dqbuf = 1;
+ /*
+ * We are streaming and blocking, wait for another buffer to
+ * become ready or for streamoff. Driver's lock is released to
+@@ -1513,6 +1528,7 @@ static int __vb2_wait_for_done_vb(struct vb2_queue *q, int nonblocking)
+ * the locks or return an error if one occurred.
+ */
+ call_void_qop(q, wait_finish, q);
++ q->waiting_in_dqbuf = 0;
+ if (ret) {
+ dprintk(1, "sleep was interrupted\n");
+ return ret;
+@@ -2361,6 +2377,12 @@ static size_t __vb2_perform_fileio(struct vb2_queue *q, char __user *data, size_
+ if (!data)
+ return -EINVAL;
+
++ if (q->waiting_in_dqbuf) {
++ dprintk(3, "another dup()ped fd is %s\n",
++ read ? "reading" : "writing");
++ return -EBUSY;
++ }
++
+ /*
+ * Initialize emulator on first call.
+ */
+diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c
+index dffd2d4bf1c8..c25c92797408 100644
+--- a/drivers/media/dvb-frontends/m88ds3103.c
++++ b/drivers/media/dvb-frontends/m88ds3103.c
+@@ -309,6 +309,9 @@ static int m88ds3103_set_frontend(struct dvb_frontend *fe)
+ u16 u16tmp;
+ u32 tuner_frequency_khz, target_mclk;
+ s32 s32tmp;
++ static const struct reg_sequence reset_buf[] = {
++ {0x07, 0x80}, {0x07, 0x00}
++ };
+
+ dev_dbg(&client->dev,
+ "delivery_system=%d modulation=%d frequency=%u symbol_rate=%d inversion=%d pilot=%d rolloff=%d\n",
+@@ -321,11 +324,7 @@ static int m88ds3103_set_frontend(struct dvb_frontend *fe)
+ }
+
+ /* reset */
+- ret = regmap_write(dev->regmap, 0x07, 0x80);
+- if (ret)
+- goto err;
+-
+- ret = regmap_write(dev->regmap, 0x07, 0x00);
++ ret = regmap_multi_reg_write(dev->regmap, reset_buf, 2);
+ if (ret)
+ goto err;
+
+diff --git a/drivers/media/dvb-frontends/si2165.c b/drivers/media/dvb-frontends/si2165.c
+index feacd8da421d..d55d8f169dca 100644
+--- a/drivers/media/dvb-frontends/si2165.c
++++ b/drivers/media/dvb-frontends/si2165.c
+@@ -275,18 +275,20 @@ static u32 si2165_get_fe_clk(struct si2165_state *state)
+
+ static int si2165_wait_init_done(struct si2165_state *state)
+ {
+- int ret = -EINVAL;
++ int ret;
+ u8 val = 0;
+ int i;
+
+ for (i = 0; i < 3; ++i) {
+- si2165_readreg8(state, REG_INIT_DONE, &val);
++ ret = si2165_readreg8(state, REG_INIT_DONE, &val);
++ if (ret < 0)
++ return ret;
+ if (val == 0x01)
+ return 0;
+ usleep_range(1000, 50000);
+ }
+ dev_err(&state->client->dev, "init_done was not set\n");
+- return ret;
++ return -EINVAL;
+ }
+
+ static int si2165_upload_firmware_block(struct si2165_state *state,
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index 4715edc8ca33..e6a8b5669b9c 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -1117,8 +1117,10 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
+ if (ov2659_formats[index].code == mf->code)
+ break;
+
+- if (index < 0)
+- return -EINVAL;
++ if (index < 0) {
++ index = 0;
++ mf->code = ov2659_formats[index].code;
++ }
+
+ mf->colorspace = V4L2_COLORSPACE_SRGB;
+ mf->field = V4L2_FIELD_NONE;
+diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
+index a9264d515e54..edded869d792 100644
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -811,9 +811,16 @@ static int ov6650_video_probe(struct i2c_client *client)
+ u8 pidh, pidl, midh, midl;
+ int ret;
+
++ priv->clk = v4l2_clk_get(&client->dev, NULL);
++ if (IS_ERR(priv->clk)) {
++ ret = PTR_ERR(priv->clk);
++ dev_err(&client->dev, "v4l2_clk request err: %d\n", ret);
++ return ret;
++ }
++
+ ret = ov6650_s_power(&priv->subdev, 1);
+ if (ret < 0)
+- return ret;
++ goto eclkput;
+
+ msleep(20);
+
+@@ -850,6 +857,11 @@ static int ov6650_video_probe(struct i2c_client *client)
+
+ done:
+ ov6650_s_power(&priv->subdev, 0);
++ if (!ret)
++ return 0;
++eclkput:
++ v4l2_clk_put(priv->clk);
++
+ return ret;
+ }
+
+@@ -992,18 +1004,9 @@ static int ov6650_probe(struct i2c_client *client,
+ priv->code = MEDIA_BUS_FMT_YUYV8_2X8;
+ priv->colorspace = V4L2_COLORSPACE_JPEG;
+
+- priv->clk = v4l2_clk_get(&client->dev, NULL);
+- if (IS_ERR(priv->clk)) {
+- ret = PTR_ERR(priv->clk);
+- goto eclkget;
+- }
+-
+ ret = ov6650_video_probe(client);
+- if (ret) {
+- v4l2_clk_put(priv->clk);
+-eclkget:
++ if (ret)
+ v4l2_ctrl_handler_free(&priv->hdl);
+- }
+
+ return ret;
+ }
+diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c
+index 5817d9cde4d0..6d8e4afe9673 100644
+--- a/drivers/media/pci/saa7146/hexium_gemini.c
++++ b/drivers/media/pci/saa7146/hexium_gemini.c
+@@ -270,9 +270,8 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d
+ /* enable i2c-port pins */
+ saa7146_write(dev, MC1, (MASK_08 | MASK_24 | MASK_10 | MASK_26));
+
+- hexium->i2c_adapter = (struct i2c_adapter) {
+- .name = "hexium gemini",
+- };
++ strscpy(hexium->i2c_adapter.name, "hexium gemini",
++ sizeof(hexium->i2c_adapter.name));
+ saa7146_i2c_adapter_prepare(dev, &hexium->i2c_adapter, SAA7146_I2C_BUS_BIT_RATE_480);
+ if (i2c_add_adapter(&hexium->i2c_adapter) < 0) {
+ DEB_S("cannot register i2c-device. skipping.\n");
+diff --git a/drivers/media/pci/saa7146/hexium_orion.c b/drivers/media/pci/saa7146/hexium_orion.c
+index 0a05176c18ab..a794f9e5f990 100644
+--- a/drivers/media/pci/saa7146/hexium_orion.c
++++ b/drivers/media/pci/saa7146/hexium_orion.c
+@@ -231,9 +231,8 @@ static int hexium_probe(struct saa7146_dev *dev)
+ saa7146_write(dev, DD1_STREAM_B, 0x00000000);
+ saa7146_write(dev, MC2, (MASK_09 | MASK_25 | MASK_10 | MASK_26));
+
+- hexium->i2c_adapter = (struct i2c_adapter) {
+- .name = "hexium orion",
+- };
++ strscpy(hexium->i2c_adapter.name, "hexium orion",
++ sizeof(hexium->i2c_adapter.name));
+ saa7146_i2c_adapter_prepare(dev, &hexium->i2c_adapter, SAA7146_I2C_BUS_BIT_RATE_480);
+ if (i2c_add_adapter(&hexium->i2c_adapter) < 0) {
+ DEB_S("cannot register i2c-device. skipping.\n");
+diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
+index d20d3df5778b..a3cfefdbee12 100644
+--- a/drivers/media/platform/coda/coda-bit.c
++++ b/drivers/media/platform/coda/coda-bit.c
+@@ -1999,6 +1999,9 @@ static int coda_prepare_decode(struct coda_ctx *ctx)
+ /* Clear decode success flag */
+ coda_write(dev, 0, CODA_RET_DEC_PIC_SUCCESS);
+
++ /* Clear error return value */
++ coda_write(dev, 0, CODA_RET_DEC_PIC_ERR_MB);
++
+ trace_coda_dec_pic_run(ctx, meta);
+
+ coda_command_async(ctx, CODA_COMMAND_PIC_RUN);
+diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c
+index 721564176d8c..d38682265892 100644
+--- a/drivers/media/platform/stm32/stm32-dcmi.c
++++ b/drivers/media/platform/stm32/stm32-dcmi.c
+@@ -808,6 +808,9 @@ static int dcmi_try_fmt(struct stm32_dcmi *dcmi, struct v4l2_format *f,
+
+ sd_fmt = find_format_by_fourcc(dcmi, pix->pixelformat);
+ if (!sd_fmt) {
++ if (!dcmi->num_of_sd_formats)
++ return -ENODATA;
++
+ sd_fmt = dcmi->sd_formats[dcmi->num_of_sd_formats - 1];
+ pix->pixelformat = sd_fmt->fourcc;
+ }
+@@ -986,6 +989,9 @@ static int dcmi_set_sensor_format(struct stm32_dcmi *dcmi,
+
+ sd_fmt = find_format_by_fourcc(dcmi, pix->pixelformat);
+ if (!sd_fmt) {
++ if (!dcmi->num_of_sd_formats)
++ return -ENODATA;
++
+ sd_fmt = dcmi->sd_formats[dcmi->num_of_sd_formats - 1];
+ pix->pixelformat = sd_fmt->fourcc;
+ }
+@@ -1645,7 +1651,7 @@ static int dcmi_probe(struct platform_device *pdev)
+ dcmi->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+ if (IS_ERR(dcmi->rstc)) {
+ dev_err(&pdev->dev, "Could not get reset control\n");
+- return -ENODEV;
++ return PTR_ERR(dcmi->rstc);
+ }
+
+ /* Get bus characteristics from devicetree */
+@@ -1660,7 +1666,7 @@ static int dcmi_probe(struct platform_device *pdev)
+ of_node_put(np);
+ if (ret) {
+ dev_err(&pdev->dev, "Could not parse the endpoint\n");
+- return -ENODEV;
++ return ret;
+ }
+
+ if (ep.bus_type == V4L2_MBUS_CSI2) {
+@@ -1673,8 +1679,9 @@ static int dcmi_probe(struct platform_device *pdev)
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq <= 0) {
+- dev_err(&pdev->dev, "Could not get irq\n");
+- return -ENODEV;
++ if (irq != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "Could not get irq\n");
++ return irq;
+ }
+
+ dcmi->res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+@@ -1694,12 +1701,13 @@ static int dcmi_probe(struct platform_device *pdev)
+ dev_name(&pdev->dev), dcmi);
+ if (ret) {
+ dev_err(&pdev->dev, "Unable to request irq %d\n", irq);
+- return -ENODEV;
++ return ret;
+ }
+
+ mclk = devm_clk_get(&pdev->dev, "mclk");
+ if (IS_ERR(mclk)) {
+- dev_err(&pdev->dev, "Unable to get mclk\n");
++ if (PTR_ERR(mclk) != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "Unable to get mclk\n");
+ return PTR_ERR(mclk);
+ }
+
+diff --git a/drivers/media/platform/video-mux.c b/drivers/media/platform/video-mux.c
+index c01e1592ad0a..c8ffe7bff77f 100644
+--- a/drivers/media/platform/video-mux.c
++++ b/drivers/media/platform/video-mux.c
+@@ -365,9 +365,14 @@ static int video_mux_probe(struct platform_device *pdev)
+ vmux->active = -1;
+ vmux->pads = devm_kcalloc(dev, num_pads, sizeof(*vmux->pads),
+ GFP_KERNEL);
++ if (!vmux->pads)
++ return -ENOMEM;
++
+ vmux->format_mbus = devm_kcalloc(dev, num_pads,
+ sizeof(*vmux->format_mbus),
+ GFP_KERNEL);
++ if (!vmux->format_mbus)
++ return -ENOMEM;
+
+ for (i = 0; i < num_pads; i++) {
+ vmux->pads[i].flags = (i < num_pads - 1) ? MEDIA_PAD_FL_SINK
+diff --git a/drivers/media/platform/vimc/vimc-core.c b/drivers/media/platform/vimc/vimc-core.c
+index 9246f265de31..27db8835c241 100644
+--- a/drivers/media/platform/vimc/vimc-core.c
++++ b/drivers/media/platform/vimc/vimc-core.c
+@@ -303,6 +303,8 @@ static int vimc_probe(struct platform_device *pdev)
+
+ dev_dbg(&pdev->dev, "probe");
+
++ memset(&vimc->mdev, 0, sizeof(vimc->mdev));
++
+ /* Create platform_device for each entity in the topology*/
+ vimc->subdevs = devm_kcalloc(&vimc->pdev.dev, vimc->pipe_cfg->num_ents,
+ sizeof(*vimc->subdevs), GFP_KERNEL);
+diff --git a/drivers/media/platform/vimc/vimc-streamer.c b/drivers/media/platform/vimc/vimc-streamer.c
+index fcc897fb247b..392754c18046 100644
+--- a/drivers/media/platform/vimc/vimc-streamer.c
++++ b/drivers/media/platform/vimc/vimc-streamer.c
+@@ -120,7 +120,6 @@ static int vimc_streamer_thread(void *data)
+ int i;
+
+ set_freezable();
+- set_current_state(TASK_UNINTERRUPTIBLE);
+
+ for (;;) {
+ try_to_freeze();
+@@ -137,6 +136,7 @@ static int vimc_streamer_thread(void *data)
+ break;
+ }
+ //wait for 60hz
++ set_current_state(TASK_UNINTERRUPTIBLE);
+ schedule_timeout(HZ / 60);
+ }
+
+diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
+index baa7c83ee6e0..3b09ffceefd5 100644
+--- a/drivers/media/platform/vivid/vivid-vid-cap.c
++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
+@@ -992,7 +992,7 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection
+ v4l2_rect_map_inside(&s->r, &dev->fmt_cap_rect);
+ if (dev->bitmap_cap && (compose->width != s->r.width ||
+ compose->height != s->r.height)) {
+- kfree(dev->bitmap_cap);
++ vfree(dev->bitmap_cap);
+ dev->bitmap_cap = NULL;
+ }
+ *compose = s->r;
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index 800d69c3f80b..1cf4019689a5 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -489,7 +489,8 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload,
+ return -EIO;
+ }
+ /* Send response data to caller */
+- if (response != NULL && response_len != NULL && evt_hdr->dlen) {
++ if (response != NULL && response_len != NULL && evt_hdr->dlen &&
++ evt_hdr->dlen <= payload_len) {
+ /* Skip header info and copy only response data */
+ skb_pull(skb, sizeof(struct fm_event_msg_hdr));
+ memcpy(response, skb->data, evt_hdr->dlen);
+@@ -583,6 +584,8 @@ static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev)
+ return;
+
+ fm_evt_hdr = (void *)skb->data;
++ if (fm_evt_hdr->dlen > sizeof(fmdev->irq_info.flag))
++ return;
+
+ /* Skip header info and copy only response data */
+ skb_pull(skb, sizeof(struct fm_event_msg_hdr));
+@@ -1308,7 +1311,7 @@ static int load_default_rx_configuration(struct fmdev *fmdev)
+ static int fm_power_up(struct fmdev *fmdev, u8 mode)
+ {
+ u16 payload;
+- __be16 asic_id, asic_ver;
++ __be16 asic_id = 0, asic_ver = 0;
+ int resp_len, ret;
+ u8 fw_name[50];
+
+diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
+index 8bf5637b3a69..e613c0175591 100644
+--- a/drivers/media/rc/serial_ir.c
++++ b/drivers/media/rc/serial_ir.c
+@@ -773,8 +773,6 @@ static void serial_ir_exit(void)
+
+ static int __init serial_ir_init_module(void)
+ {
+- int result;
+-
+ switch (type) {
+ case IR_HOMEBREW:
+ case IR_IRDEO:
+@@ -802,12 +800,7 @@ static int __init serial_ir_init_module(void)
+ if (sense != -1)
+ sense = !!sense;
+
+- result = serial_ir_init();
+- if (!result)
+- return 0;
+-
+- serial_ir_exit();
+- return result;
++ return serial_ir_init();
+ }
+
+ static void __exit serial_ir_exit_module(void)
+diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c
+index 62b45062b1e6..3e111f7f56df 100644
+--- a/drivers/media/usb/au0828/au0828-video.c
++++ b/drivers/media/usb/au0828/au0828-video.c
+@@ -758,6 +758,9 @@ static int au0828_analog_stream_enable(struct au0828_dev *d)
+
+ dprintk(1, "au0828_analog_stream_enable called\n");
+
++ if (test_bit(DEV_DISCONNECTED, &d->dev_state))
++ return -ENODEV;
++
+ iface = usb_ifnum_to_if(d->usbdev, 0);
+ if (iface && iface->cur_altsetting->desc.bAlternateSetting != 5) {
+ dprintk(1, "Changing intf#0 to alt 5\n");
+@@ -839,9 +842,9 @@ int au0828_start_analog_streaming(struct vb2_queue *vq, unsigned int count)
+ return rc;
+ }
+
++ v4l2_device_call_all(&dev->v4l2_dev, 0, video, s_stream, 1);
++
+ if (vq->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
+- v4l2_device_call_all(&dev->v4l2_dev, 0, video,
+- s_stream, 1);
+ dev->vid_timeout_running = 1;
+ mod_timer(&dev->vid_timeout, jiffies + (HZ / 10));
+ } else if (vq->type == V4L2_BUF_TYPE_VBI_CAPTURE) {
+@@ -861,10 +864,11 @@ static void au0828_stop_streaming(struct vb2_queue *vq)
+
+ dprintk(1, "au0828_stop_streaming called %d\n", dev->streaming_users);
+
+- if (dev->streaming_users-- == 1)
++ if (dev->streaming_users-- == 1) {
+ au0828_uninit_isoc(dev);
++ v4l2_device_call_all(&dev->v4l2_dev, 0, video, s_stream, 0);
++ }
+
+- v4l2_device_call_all(&dev->v4l2_dev, 0, video, s_stream, 0);
+ dev->vid_timeout_running = 0;
+ del_timer_sync(&dev->vid_timeout);
+
+@@ -893,8 +897,10 @@ void au0828_stop_vbi_streaming(struct vb2_queue *vq)
+ dprintk(1, "au0828_stop_vbi_streaming called %d\n",
+ dev->streaming_users);
+
+- if (dev->streaming_users-- == 1)
++ if (dev->streaming_users-- == 1) {
+ au0828_uninit_isoc(dev);
++ v4l2_device_call_all(&dev->v4l2_dev, 0, video, s_stream, 0);
++ }
+
+ spin_lock_irqsave(&dev->slock, flags);
+ if (dev->isoc_ctl.vbi_buf != NULL) {
+diff --git a/drivers/media/usb/cpia2/cpia2_v4l.c b/drivers/media/usb/cpia2/cpia2_v4l.c
+index 99f106b13280..d47318958fe5 100644
+--- a/drivers/media/usb/cpia2/cpia2_v4l.c
++++ b/drivers/media/usb/cpia2/cpia2_v4l.c
+@@ -1244,8 +1244,7 @@ static int __init cpia2_init(void)
+ LOG("%s v%s\n",
+ ABOUT, CPIA_VERSION);
+ check_parameters();
+- cpia2_usb_init();
+- return 0;
++ return cpia2_usb_init();
+ }
+
+
+diff --git a/drivers/media/usb/dvb-usb-v2/dvbsky.c b/drivers/media/usb/dvb-usb-v2/dvbsky.c
+index e28bd8836751..ae0814dd202a 100644
+--- a/drivers/media/usb/dvb-usb-v2/dvbsky.c
++++ b/drivers/media/usb/dvb-usb-v2/dvbsky.c
+@@ -615,16 +615,18 @@ static int dvbsky_init(struct dvb_usb_device *d)
+ return 0;
+ }
+
+-static void dvbsky_exit(struct dvb_usb_device *d)
++static int dvbsky_frontend_detach(struct dvb_usb_adapter *adap)
+ {
++ struct dvb_usb_device *d = adap_to_d(adap);
+ struct dvbsky_state *state = d_to_priv(d);
+- struct dvb_usb_adapter *adap = &d->adapter[0];
++
++ dev_dbg(&d->udev->dev, "%s: adap=%d\n", __func__, adap->id);
+
+ dvb_module_release(state->i2c_client_tuner);
+ dvb_module_release(state->i2c_client_demod);
+ dvb_module_release(state->i2c_client_ci);
+
+- adap->fe[0] = NULL;
++ return 0;
+ }
+
+ /* DVB USB Driver stuff */
+@@ -640,11 +642,11 @@ static struct dvb_usb_device_properties dvbsky_s960_props = {
+
+ .i2c_algo = &dvbsky_i2c_algo,
+ .frontend_attach = dvbsky_s960_attach,
++ .frontend_detach = dvbsky_frontend_detach,
+ .init = dvbsky_init,
+ .get_rc_config = dvbsky_get_rc_config,
+ .streaming_ctrl = dvbsky_streaming_ctrl,
+ .identify_state = dvbsky_identify_state,
+- .exit = dvbsky_exit,
+ .read_mac_address = dvbsky_read_mac_addr,
+
+ .num_adapters = 1,
+@@ -667,11 +669,11 @@ static struct dvb_usb_device_properties dvbsky_s960c_props = {
+
+ .i2c_algo = &dvbsky_i2c_algo,
+ .frontend_attach = dvbsky_s960c_attach,
++ .frontend_detach = dvbsky_frontend_detach,
+ .init = dvbsky_init,
+ .get_rc_config = dvbsky_get_rc_config,
+ .streaming_ctrl = dvbsky_streaming_ctrl,
+ .identify_state = dvbsky_identify_state,
+- .exit = dvbsky_exit,
+ .read_mac_address = dvbsky_read_mac_addr,
+
+ .num_adapters = 1,
+@@ -694,11 +696,11 @@ static struct dvb_usb_device_properties dvbsky_t680c_props = {
+
+ .i2c_algo = &dvbsky_i2c_algo,
+ .frontend_attach = dvbsky_t680c_attach,
++ .frontend_detach = dvbsky_frontend_detach,
+ .init = dvbsky_init,
+ .get_rc_config = dvbsky_get_rc_config,
+ .streaming_ctrl = dvbsky_streaming_ctrl,
+ .identify_state = dvbsky_identify_state,
+- .exit = dvbsky_exit,
+ .read_mac_address = dvbsky_read_mac_addr,
+
+ .num_adapters = 1,
+@@ -721,11 +723,11 @@ static struct dvb_usb_device_properties dvbsky_t330_props = {
+
+ .i2c_algo = &dvbsky_i2c_algo,
+ .frontend_attach = dvbsky_t330_attach,
++ .frontend_detach = dvbsky_frontend_detach,
+ .init = dvbsky_init,
+ .get_rc_config = dvbsky_get_rc_config,
+ .streaming_ctrl = dvbsky_streaming_ctrl,
+ .identify_state = dvbsky_identify_state,
+- .exit = dvbsky_exit,
+ .read_mac_address = dvbsky_read_mac_addr,
+
+ .num_adapters = 1,
+@@ -748,11 +750,11 @@ static struct dvb_usb_device_properties mygica_t230c_props = {
+
+ .i2c_algo = &dvbsky_i2c_algo,
+ .frontend_attach = dvbsky_mygica_t230c_attach,
++ .frontend_detach = dvbsky_frontend_detach,
+ .init = dvbsky_init,
+ .get_rc_config = dvbsky_get_rc_config,
+ .streaming_ctrl = dvbsky_streaming_ctrl,
+ .identify_state = dvbsky_identify_state,
+- .exit = dvbsky_exit,
+
+ .num_adapters = 1,
+ .adapter = {
+diff --git a/drivers/media/usb/go7007/go7007-fw.c b/drivers/media/usb/go7007/go7007-fw.c
+index 24f5b615dc7a..dfa9f899d0c2 100644
+--- a/drivers/media/usb/go7007/go7007-fw.c
++++ b/drivers/media/usb/go7007/go7007-fw.c
+@@ -1499,8 +1499,8 @@ static int modet_to_package(struct go7007 *go, __le16 *code, int space)
+ return cnt;
+ }
+
+-static int do_special(struct go7007 *go, u16 type, __le16 *code, int space,
+- int *framelen)
++static noinline_for_stack int do_special(struct go7007 *go, u16 type,
++ __le16 *code, int space, int *framelen)
+ {
+ switch (type) {
+ case SPECIAL_FRM_HEAD:
+diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
+index 405a6a76d820..b12356c533a6 100644
+--- a/drivers/media/usb/gspca/gspca.c
++++ b/drivers/media/usb/gspca/gspca.c
+@@ -294,7 +294,7 @@ static void fill_frame(struct gspca_dev *gspca_dev,
+ /* check the packet status and length */
+ st = urb->iso_frame_desc[i].status;
+ if (st) {
+- pr_err("ISOC data error: [%d] len=%d, status=%d\n",
++ gspca_dbg(gspca_dev, D_PACK, "ISOC data error: [%d] len=%d, status=%d\n",
+ i, len, st);
+ gspca_dev->last_packet_type = DISCARD_PACKET;
+ continue;
+@@ -314,6 +314,8 @@ static void fill_frame(struct gspca_dev *gspca_dev,
+ }
+
+ resubmit:
++ if (!gspca_dev->streaming)
++ return;
+ /* resubmit the URB */
+ st = usb_submit_urb(urb, GFP_ATOMIC);
+ if (st < 0)
+@@ -330,7 +332,7 @@ static void isoc_irq(struct urb *urb)
+ struct gspca_dev *gspca_dev = (struct gspca_dev *) urb->context;
+
+ gspca_dbg(gspca_dev, D_PACK, "isoc irq\n");
+- if (!vb2_start_streaming_called(&gspca_dev->queue))
++ if (!gspca_dev->streaming)
+ return;
+ fill_frame(gspca_dev, urb);
+ }
+@@ -344,7 +346,7 @@ static void bulk_irq(struct urb *urb)
+ int st;
+
+ gspca_dbg(gspca_dev, D_PACK, "bulk irq\n");
+- if (!vb2_start_streaming_called(&gspca_dev->queue))
++ if (!gspca_dev->streaming)
+ return;
+ switch (urb->status) {
+ case 0:
+@@ -367,6 +369,8 @@ static void bulk_irq(struct urb *urb)
+ urb->actual_length);
+
+ resubmit:
++ if (!gspca_dev->streaming)
++ return;
+ /* resubmit the URB */
+ if (gspca_dev->cam.bulk_nurbs != 0) {
+ st = usb_submit_urb(urb, GFP_ATOMIC);
+@@ -1630,6 +1634,8 @@ void gspca_disconnect(struct usb_interface *intf)
+
+ mutex_lock(&gspca_dev->usb_lock);
+ gspca_dev->present = false;
++ destroy_urbs(gspca_dev);
++ gspca_input_destroy_urb(gspca_dev);
+
+ vb2_queue_error(&gspca_dev->queue);
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index a8519da0020b..673fdca8d2da 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -666,6 +666,8 @@ static int ctrl_get_input(struct pvr2_ctrl *cptr,int *vp)
+
+ static int ctrl_check_input(struct pvr2_ctrl *cptr,int v)
+ {
++ if (v < 0 || v > PVR2_CVAL_INPUT_MAX)
++ return 0;
+ return ((1 << v) & cptr->hdw->input_allowed_mask) != 0;
+ }
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.h b/drivers/media/usb/pvrusb2/pvrusb2-hdw.h
+index 25648add77e5..bd2b7a67b732 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.h
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.h
+@@ -50,6 +50,7 @@
+ #define PVR2_CVAL_INPUT_COMPOSITE 2
+ #define PVR2_CVAL_INPUT_SVIDEO 3
+ #define PVR2_CVAL_INPUT_RADIO 4
++#define PVR2_CVAL_INPUT_MAX PVR2_CVAL_INPUT_RADIO
+
+ enum pvr2_config {
+ pvr2_config_empty, /* No configuration */
+diff --git a/drivers/mmc/core/pwrseq_emmc.c b/drivers/mmc/core/pwrseq_emmc.c
+index efb8a7965dd4..154f4204d58c 100644
+--- a/drivers/mmc/core/pwrseq_emmc.c
++++ b/drivers/mmc/core/pwrseq_emmc.c
+@@ -30,19 +30,14 @@ struct mmc_pwrseq_emmc {
+
+ #define to_pwrseq_emmc(p) container_of(p, struct mmc_pwrseq_emmc, pwrseq)
+
+-static void __mmc_pwrseq_emmc_reset(struct mmc_pwrseq_emmc *pwrseq)
+-{
+- gpiod_set_value(pwrseq->reset_gpio, 1);
+- udelay(1);
+- gpiod_set_value(pwrseq->reset_gpio, 0);
+- udelay(200);
+-}
+-
+ static void mmc_pwrseq_emmc_reset(struct mmc_host *host)
+ {
+ struct mmc_pwrseq_emmc *pwrseq = to_pwrseq_emmc(host->pwrseq);
+
+- __mmc_pwrseq_emmc_reset(pwrseq);
++ gpiod_set_value_cansleep(pwrseq->reset_gpio, 1);
++ udelay(1);
++ gpiod_set_value_cansleep(pwrseq->reset_gpio, 0);
++ udelay(200);
+ }
+
+ static int mmc_pwrseq_emmc_reset_nb(struct notifier_block *this,
+@@ -50,8 +45,11 @@ static int mmc_pwrseq_emmc_reset_nb(struct notifier_block *this,
+ {
+ struct mmc_pwrseq_emmc *pwrseq = container_of(this,
+ struct mmc_pwrseq_emmc, reset_nb);
++ gpiod_set_value(pwrseq->reset_gpio, 1);
++ udelay(1);
++ gpiod_set_value(pwrseq->reset_gpio, 0);
++ udelay(200);
+
+- __mmc_pwrseq_emmc_reset(pwrseq);
+ return NOTIFY_DONE;
+ }
+
+@@ -72,14 +70,18 @@ static int mmc_pwrseq_emmc_probe(struct platform_device *pdev)
+ if (IS_ERR(pwrseq->reset_gpio))
+ return PTR_ERR(pwrseq->reset_gpio);
+
+- /*
+- * register reset handler to ensure emmc reset also from
+- * emergency_reboot(), priority 255 is the highest priority
+- * so it will be executed before any system reboot handler.
+- */
+- pwrseq->reset_nb.notifier_call = mmc_pwrseq_emmc_reset_nb;
+- pwrseq->reset_nb.priority = 255;
+- register_restart_handler(&pwrseq->reset_nb);
++ if (!gpiod_cansleep(pwrseq->reset_gpio)) {
++ /*
++ * register reset handler to ensure emmc reset also from
++ * emergency_reboot(), priority 255 is the highest priority
++ * so it will be executed before any system reboot handler.
++ */
++ pwrseq->reset_nb.notifier_call = mmc_pwrseq_emmc_reset_nb;
++ pwrseq->reset_nb.priority = 255;
++ register_restart_handler(&pwrseq->reset_nb);
++ } else {
++ dev_notice(dev, "EMMC reset pin tied to a sleepy GPIO driver; reset on emergency-reboot disabled\n");
++ }
+
+ pwrseq->pwrseq.ops = &mmc_pwrseq_emmc_ops;
+ pwrseq->pwrseq.dev = dev;
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index d0d9f90e7cdf..cfb8ee24eaba 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -216,6 +216,14 @@ static int mmc_decode_scr(struct mmc_card *card)
+
+ if (scr->sda_spec3)
+ scr->cmds = UNSTUFF_BITS(resp, 32, 2);
++
++ /* SD Spec says: any SD Card shall set at least bits 0 and 2 */
++ if (!(scr->bus_widths & SD_SCR_BUS_WIDTH_1) ||
++ !(scr->bus_widths & SD_SCR_BUS_WIDTH_4)) {
++ pr_err("%s: invalid bus width\n", mmc_hostname(card->host));
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
+index 67f6bd24a9d0..ea254d00541f 100644
+--- a/drivers/mmc/host/mmc_spi.c
++++ b/drivers/mmc/host/mmc_spi.c
+@@ -819,6 +819,10 @@ mmc_spi_readblock(struct mmc_spi_host *host, struct spi_transfer *t,
+ }
+
+ status = spi_sync_locked(spi, &host->m);
++ if (status < 0) {
++ dev_dbg(&spi->dev, "read error %d\n", status);
++ return status;
++ }
+
+ if (host->dma_dev) {
+ dma_sync_single_for_cpu(host->dma_dev,
+diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
+index 94eeed2a1b53..f903ab96aa21 100644
+--- a/drivers/mmc/host/sdhci-iproc.c
++++ b/drivers/mmc/host/sdhci-iproc.c
+@@ -185,7 +185,8 @@ static const struct sdhci_ops sdhci_iproc_32only_ops = {
+ };
+
+ static const struct sdhci_pltfm_data sdhci_iproc_cygnus_pltfm_data = {
+- .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK,
++ .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
++ SDHCI_QUIRK_NO_HISPD_BIT,
+ .quirks2 = SDHCI_QUIRK2_ACMD23_BROKEN | SDHCI_QUIRK2_HOST_OFF_CARD_ON,
+ .ops = &sdhci_iproc_32only_ops,
+ };
+@@ -208,7 +209,8 @@ static const struct sdhci_iproc_data iproc_cygnus_data = {
+
+ static const struct sdhci_pltfm_data sdhci_iproc_pltfm_data = {
+ .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
+- SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12,
++ SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 |
++ SDHCI_QUIRK_NO_HISPD_BIT,
+ .quirks2 = SDHCI_QUIRK2_ACMD23_BROKEN,
+ .ops = &sdhci_iproc_ops,
+ };
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index a7bf8515116f..e5c598ae5f24 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -643,6 +643,9 @@ static void esdhc_reset(struct sdhci_host *host, u8 mask)
+ sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
+ sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
+
++ if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc"))
++ mdelay(5);
++
+ if (mask & SDHCI_RESET_ALL) {
+ val = sdhci_readl(host, ESDHC_TBCTL);
+ val &= ~ESDHC_TB_EN;
+@@ -917,6 +920,11 @@ static int sdhci_esdhc_probe(struct platform_device *pdev)
+ if (esdhc->vendor_ver > VENDOR_V_22)
+ host->quirks &= ~SDHCI_QUIRK_NO_BUSY_IRQ;
+
++ if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) {
++ host->quirks2 |= SDHCI_QUIRK_RESET_AFTER_REQUEST;
++ host->quirks2 |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
++ }
++
+ if (of_device_is_compatible(np, "fsl,p5040-esdhc") ||
+ of_device_is_compatible(np, "fsl,p5020-esdhc") ||
+ of_device_is_compatible(np, "fsl,p4080-esdhc") ||
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 1b5f591cf0a2..b5d72815776c 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2223,7 +2223,7 @@ static void ena_config_host_info(struct ena_com_dev *ena_dev)
+
+ host_info->os_type = ENA_ADMIN_OS_LINUX;
+ host_info->kernel_ver = LINUX_VERSION_CODE;
+- strncpy(host_info->kernel_ver_str, utsname()->version,
++ strlcpy(host_info->kernel_ver_str, utsname()->version,
+ sizeof(host_info->kernel_ver_str) - 1);
+ host_info->os_dist = 0;
+ strncpy(host_info->os_dist_str, utsname()->release,
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/l2t.h b/drivers/net/ethernet/chelsio/cxgb3/l2t.h
+index c2fd323c4078..ea75f275023f 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/l2t.h
++++ b/drivers/net/ethernet/chelsio/cxgb3/l2t.h
+@@ -75,8 +75,8 @@ struct l2t_data {
+ struct l2t_entry *rover; /* starting point for next allocation */
+ atomic_t nfree; /* number of free entries */
+ rwlock_t lock;
+- struct l2t_entry l2tab[0];
+ struct rcu_head rcu_head; /* to handle rcu cleanup */
++ struct l2t_entry l2tab[];
+ };
+
+ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+index 961e3087d1d3..bb04c695ab9f 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -6010,15 +6010,24 @@ static int __init cxgb4_init_module(void)
+
+ ret = pci_register_driver(&cxgb4_driver);
+ if (ret < 0)
+- debugfs_remove(cxgb4_debugfs_root);
++ goto err_pci;
+
+ #if IS_ENABLED(CONFIG_IPV6)
+ if (!inet6addr_registered) {
+- register_inet6addr_notifier(&cxgb4_inet6addr_notifier);
+- inet6addr_registered = true;
++ ret = register_inet6addr_notifier(&cxgb4_inet6addr_notifier);
++ if (ret)
++ pci_unregister_driver(&cxgb4_driver);
++ else
++ inet6addr_registered = true;
+ }
+ #endif
+
++ if (ret == 0)
++ return ret;
++
++err_pci:
++ debugfs_remove(cxgb4_debugfs_root);
++
+ return ret;
+ }
+
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 8b11682ebba2..8cd339c92c1a 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -7329,7 +7329,7 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ dev_pm_set_driver_flags(&pdev->dev, DPM_FLAG_NEVER_SKIP);
+
+- if (pci_dev_run_wake(pdev))
++ if (pci_dev_run_wake(pdev) && hw->mac.type < e1000_pch_cnp)
+ pm_runtime_put_noidle(&pdev->dev);
+
+ return 0;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index f81ad0aa8b09..df8808cd7e11 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -2654,6 +2654,10 @@ void i40e_vlan_stripping_enable(struct i40e_vsi *vsi)
+ struct i40e_vsi_context ctxt;
+ i40e_status ret;
+
++ /* Don't modify stripping options if a port VLAN is active */
++ if (vsi->info.pvid)
++ return;
++
+ if ((vsi->info.valid_sections &
+ cpu_to_le16(I40E_AQ_VSI_PROP_VLAN_VALID)) &&
+ ((vsi->info.port_vlan_flags & I40E_AQ_VSI_PVLAN_MODE_MASK) == 0))
+@@ -2684,6 +2688,10 @@ void i40e_vlan_stripping_disable(struct i40e_vsi *vsi)
+ struct i40e_vsi_context ctxt;
+ i40e_status ret;
+
++ /* Don't modify stripping options if a port VLAN is active */
++ if (vsi->info.pvid)
++ return;
++
+ if ((vsi->info.valid_sections &
+ cpu_to_le16(I40E_AQ_VSI_PROP_VLAN_VALID)) &&
+ ((vsi->info.port_vlan_flags & I40E_AQ_VSI_PVLAN_EMOD_MASK) ==
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index c6d24eaede18..d86f3fa7aa6a 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2399,8 +2399,10 @@ error_param:
+ (u8 *)&stats, sizeof(stats));
+ }
+
+-/* If the VF is not trusted restrict the number of MAC/VLAN it can program */
+-#define I40E_VC_MAX_MAC_ADDR_PER_VF 12
++/* If the VF is not trusted restrict the number of MAC/VLAN it can program
++ * MAC filters: 16 for multicast, 1 for MAC, 1 for broadcast
++ */
++#define I40E_VC_MAX_MAC_ADDR_PER_VF (16 + 1 + 1)
+ #define I40E_VC_MAX_VLAN_PER_VF 8
+
+ /**
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index aa39a068858e..5aa083d9a6c9 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -3468,6 +3468,9 @@ static int igb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ break;
+ }
+ }
++
++ dev_pm_set_driver_flags(&pdev->dev, DPM_FLAG_NEVER_SKIP);
++
+ pm_runtime_put_noidle(&pdev->dev);
+ return 0;
+
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index fb12b63439c6..35413041dcf8 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -872,12 +872,6 @@ static inline int netvsc_send_pkt(
+ } else if (ret == -EAGAIN) {
+ netif_tx_stop_queue(txq);
+ ndev_ctx->eth_stats.stop_queue++;
+- if (atomic_read(&nvchan->queue_sends) < 1 &&
+- !net_device->tx_disable) {
+- netif_tx_wake_queue(txq);
+- ndev_ctx->eth_stats.wake_queue++;
+- ret = -ENOSPC;
+- }
+ } else {
+ netdev_err(ndev,
+ "Unable to send packet pages %u len %u, ret %d\n",
+@@ -885,6 +879,15 @@ static inline int netvsc_send_pkt(
+ ret);
+ }
+
++ if (netif_tx_queue_stopped(txq) &&
++ atomic_read(&nvchan->queue_sends) < 1 &&
++ !net_device->tx_disable) {
++ netif_tx_wake_queue(txq);
++ ndev_ctx->eth_stats.wake_queue++;
++ if (ret == -EAGAIN)
++ ret = -ENOSPC;
++ }
++
+ return ret;
+ }
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 366217263d70..d9a6699abe59 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -63,6 +63,7 @@ enum qmi_wwan_flags {
+
+ enum qmi_wwan_quirks {
+ QMI_WWAN_QUIRK_DTR = 1 << 0, /* needs "set DTR" request */
++ QMI_WWAN_QUIRK_QUECTEL_DYNCFG = 1 << 1, /* check num. endpoints */
+ };
+
+ struct qmimux_hdr {
+@@ -845,6 +846,16 @@ static const struct driver_info qmi_wwan_info_quirk_dtr = {
+ .data = QMI_WWAN_QUIRK_DTR,
+ };
+
++static const struct driver_info qmi_wwan_info_quirk_quectel_dyncfg = {
++ .description = "WWAN/QMI device",
++ .flags = FLAG_WWAN | FLAG_SEND_ZLP,
++ .bind = qmi_wwan_bind,
++ .unbind = qmi_wwan_unbind,
++ .manage_power = qmi_wwan_manage_power,
++ .rx_fixup = qmi_wwan_rx_fixup,
++ .data = QMI_WWAN_QUIRK_DTR | QMI_WWAN_QUIRK_QUECTEL_DYNCFG,
++};
++
+ #define HUAWEI_VENDOR_ID 0x12D1
+
+ /* map QMI/wwan function by a fixed interface number */
+@@ -865,6 +876,15 @@ static const struct driver_info qmi_wwan_info_quirk_dtr = {
+ #define QMI_GOBI_DEVICE(vend, prod) \
+ QMI_FIXED_INTF(vend, prod, 0)
+
++/* Quectel does not use fixed interface numbers on at least some of their
++ * devices. We need to check the number of endpoints to ensure that we bind to
++ * the correct interface.
++ */
++#define QMI_QUIRK_QUECTEL_DYNCFG(vend, prod) \
++ USB_DEVICE_AND_INTERFACE_INFO(vend, prod, USB_CLASS_VENDOR_SPEC, \
++ USB_SUBCLASS_VENDOR_SPEC, 0xff), \
++ .driver_info = (unsigned long)&qmi_wwan_info_quirk_quectel_dyncfg
++
+ static const struct usb_device_id products[] = {
+ /* 1. CDC ECM like devices match on the control interface */
+ { /* Huawei E392, E398 and possibly others sharing both device id and more... */
+@@ -969,20 +989,9 @@ static const struct usb_device_id products[] = {
+ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7),
+ .driver_info = (unsigned long)&qmi_wwan_info,
+ },
+- { /* Quectel EP06/EG06/EM06 */
+- USB_DEVICE_AND_INTERFACE_INFO(0x2c7c, 0x0306,
+- USB_CLASS_VENDOR_SPEC,
+- USB_SUBCLASS_VENDOR_SPEC,
+- 0xff),
+- .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr,
+- },
+- { /* Quectel EG12/EM12 */
+- USB_DEVICE_AND_INTERFACE_INFO(0x2c7c, 0x0512,
+- USB_CLASS_VENDOR_SPEC,
+- USB_SUBCLASS_VENDOR_SPEC,
+- 0xff),
+- .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr,
+- },
++ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
++ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */
++ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
+
+ /* 3. Combined interface devices matching on interface number */
+ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
+@@ -1283,7 +1292,6 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */
+ {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */
+ {QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */
+- {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
+ {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */
+@@ -1363,27 +1371,12 @@ static bool quectel_ec20_detected(struct usb_interface *intf)
+ return false;
+ }
+
+-static bool quectel_diag_detected(struct usb_interface *intf)
+-{
+- struct usb_device *dev = interface_to_usbdev(intf);
+- struct usb_interface_descriptor intf_desc = intf->cur_altsetting->desc;
+- u16 id_vendor = le16_to_cpu(dev->descriptor.idVendor);
+- u16 id_product = le16_to_cpu(dev->descriptor.idProduct);
+-
+- if (id_vendor != 0x2c7c || intf_desc.bNumEndpoints != 2)
+- return false;
+-
+- if (id_product == 0x0306 || id_product == 0x0512)
+- return true;
+- else
+- return false;
+-}
+-
+ static int qmi_wwan_probe(struct usb_interface *intf,
+ const struct usb_device_id *prod)
+ {
+ struct usb_device_id *id = (struct usb_device_id *)prod;
+ struct usb_interface_descriptor *desc = &intf->cur_altsetting->desc;
++ const struct driver_info *info;
+
+ /* Workaround to enable dynamic IDs. This disables usbnet
+ * blacklisting functionality. Which, if required, can be
+@@ -1417,10 +1410,14 @@ static int qmi_wwan_probe(struct usb_interface *intf,
+ * we need to match on class/subclass/protocol. These values are
+ * identical for the diagnostic- and QMI-interface, but bNumEndpoints is
+ * different. Ignore the current interface if the number of endpoints
+- * the number for the diag interface (two).
++ * equals the number for the diag interface (two).
+ */
+- if (quectel_diag_detected(intf))
+- return -ENODEV;
++ info = (void *)&id->driver_info;
++
++ if (info->data & QMI_WWAN_QUIRK_QUECTEL_DYNCFG) {
++ if (desc->bNumEndpoints == 2)
++ return -ENODEV;
++ }
+
+ return usbnet_probe(intf, id);
+ }
+diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
+index 2daf33342b23..1fc2bf66845c 100644
+--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
++++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
+@@ -1131,7 +1131,12 @@ int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
+ params->wait);
+
+ out:
++ /* when the sent packet was not acked by receiver(ACK=0), rc will
++ * be -EAGAIN. In this case this function needs to return success,
++ * the ACK=0 will be reflected in tx_status.
++ */
+ tx_status = (rc == 0);
++ rc = (rc == -EAGAIN) ? 0 : rc;
+ cfg80211_mgmt_tx_status(wdev, cookie ? *cookie : 0, buf, len,
+ tx_status, GFP_KERNEL);
+
+diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
+index 42c02a20ec97..6e3b3031f29b 100644
+--- a/drivers/net/wireless/ath/wil6210/wmi.c
++++ b/drivers/net/wireless/ath/wil6210/wmi.c
+@@ -3107,8 +3107,9 @@ int wmi_mgmt_tx(struct wil6210_vif *vif, const u8 *buf, size_t len)
+ rc = wmi_call(wil, WMI_SW_TX_REQ_CMDID, vif->mid, cmd, total,
+ WMI_SW_TX_COMPLETE_EVENTID, &evt, sizeof(evt), 2000);
+ if (!rc && evt.evt.status != WMI_FW_STATUS_SUCCESS) {
+- wil_err(wil, "mgmt_tx failed with status %d\n", evt.evt.status);
+- rc = -EINVAL;
++ wil_dbg_wmi(wil, "mgmt_tx failed with status %d\n",
++ evt.evt.status);
++ rc = -EAGAIN;
+ }
+
+ kfree(cmd);
+@@ -3160,9 +3161,9 @@ int wmi_mgmt_tx_ext(struct wil6210_vif *vif, const u8 *buf, size_t len,
+ rc = wmi_call(wil, WMI_SW_TX_REQ_EXT_CMDID, vif->mid, cmd, total,
+ WMI_SW_TX_COMPLETE_EVENTID, &evt, sizeof(evt), 2000);
+ if (!rc && evt.evt.status != WMI_FW_STATUS_SUCCESS) {
+- wil_err(wil, "mgmt_tx_ext failed with status %d\n",
+- evt.evt.status);
+- rc = -EINVAL;
++ wil_dbg_wmi(wil, "mgmt_tx_ext failed with status %d\n",
++ evt.evt.status);
++ rc = -EAGAIN;
+ }
+
+ kfree(cmd);
+diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c
+index e99e766a3028..1cabae424839 100644
+--- a/drivers/net/wireless/atmel/at76c50x-usb.c
++++ b/drivers/net/wireless/atmel/at76c50x-usb.c
+@@ -2585,8 +2585,8 @@ static int __init at76_mod_init(void)
+ if (result < 0)
+ printk(KERN_ERR DRIVER_NAME
+ ": usb_register failed (status %d)\n", result);
+-
+- led_trigger_register_simple("at76_usb-tx", &ledtrig_tx);
++ else
++ led_trigger_register_simple("at76_usb-tx", &ledtrig_tx);
+ return result;
+ }
+
+diff --git a/drivers/net/wireless/broadcom/b43/phy_lp.c b/drivers/net/wireless/broadcom/b43/phy_lp.c
+index 6922cbb99a04..5a0699fb4b9a 100644
+--- a/drivers/net/wireless/broadcom/b43/phy_lp.c
++++ b/drivers/net/wireless/broadcom/b43/phy_lp.c
+@@ -1834,7 +1834,7 @@ static void lpphy_papd_cal(struct b43_wldev *dev, struct lpphy_tx_gains gains,
+ static void lpphy_papd_cal_txpwr(struct b43_wldev *dev)
+ {
+ struct b43_phy_lp *lpphy = dev->phy.lp;
+- struct lpphy_tx_gains gains, oldgains;
++ struct lpphy_tx_gains oldgains;
+ int old_txpctl, old_afe_ovr, old_rf, old_bbmult;
+
+ lpphy_read_tx_pctl_mode_from_hardware(dev);
+@@ -1848,9 +1848,9 @@ static void lpphy_papd_cal_txpwr(struct b43_wldev *dev)
+ lpphy_set_tx_power_control(dev, B43_LPPHY_TXPCTL_OFF);
+
+ if (dev->dev->chip_id == 0x4325 && dev->dev->chip_rev == 0)
+- lpphy_papd_cal(dev, gains, 0, 1, 30);
++ lpphy_papd_cal(dev, oldgains, 0, 1, 30);
+ else
+- lpphy_papd_cal(dev, gains, 0, 1, 65);
++ lpphy_papd_cal(dev, oldgains, 0, 1, 65);
+
+ if (old_afe_ovr)
+ lpphy_set_tx_gains(dev, oldgains);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index 6f3faaf1b1cb..c7c520f327f2 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3466,6 +3466,8 @@ brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
+ }
+
+ netinfo = brcmf_get_netinfo_array(pfn_result);
++ if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
++ netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
+ memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
+ cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
+ cfg->wowl.nd->n_channels = 1;
+@@ -5366,6 +5368,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
+ conn_info->req_ie =
+ kmemdup(cfg->extra_buf, conn_info->req_ie_len,
+ GFP_KERNEL);
++ if (!conn_info->req_ie)
++ conn_info->req_ie_len = 0;
+ } else {
+ conn_info->req_ie_len = 0;
+ conn_info->req_ie = NULL;
+@@ -5382,6 +5386,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
+ conn_info->resp_ie =
+ kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
+ GFP_KERNEL);
++ if (!conn_info->resp_ie)
++ conn_info->resp_ie_len = 0;
+ } else {
+ conn_info->resp_ie_len = 0;
+ conn_info->resp_ie = NULL;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+index 860a4372cb56..36a04c1144e5 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -464,7 +464,8 @@ void brcmf_rx_frame(struct device *dev, struct sk_buff *skb, bool handle_event)
+ } else {
+ /* Process special event packets */
+ if (handle_event)
+- brcmf_fweh_process_skb(ifp->drvr, skb);
++ brcmf_fweh_process_skb(ifp->drvr, skb,
++ BCMILCP_SUBTYPE_VENDOR_LONG);
+
+ brcmf_netif_rx(ifp, skb);
+ }
+@@ -481,7 +482,7 @@ void brcmf_rx_event(struct device *dev, struct sk_buff *skb)
+ if (brcmf_rx_hdrpull(drvr, skb, &ifp))
+ return;
+
+- brcmf_fweh_process_skb(ifp->drvr, skb);
++ brcmf_fweh_process_skb(ifp->drvr, skb, 0);
+ brcmu_pkt_buf_free_skb(skb);
+ }
+
+@@ -783,17 +784,17 @@ static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx,
+ bool rtnl_locked)
+ {
+ struct brcmf_if *ifp;
++ int ifidx;
+
+ ifp = drvr->iflist[bsscfgidx];
+- drvr->iflist[bsscfgidx] = NULL;
+ if (!ifp) {
+ brcmf_err("Null interface, bsscfgidx=%d\n", bsscfgidx);
+ return;
+ }
+ brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", bsscfgidx,
+ ifp->ifidx);
+- if (drvr->if2bss[ifp->ifidx] == bsscfgidx)
+- drvr->if2bss[ifp->ifidx] = BRCMF_BSSIDX_INVALID;
++ ifidx = ifp->ifidx;
++
+ if (ifp->ndev) {
+ if (bsscfgidx == 0) {
+ if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
+@@ -821,6 +822,10 @@ static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx,
+ brcmf_p2p_ifp_removed(ifp, rtnl_locked);
+ kfree(ifp);
+ }
++
++ drvr->iflist[bsscfgidx] = NULL;
++ if (drvr->if2bss[ifidx] == bsscfgidx)
++ drvr->if2bss[ifidx] = BRCMF_BSSIDX_INVALID;
+ }
+
+ void brcmf_remove_interface(struct brcmf_if *ifp, bool rtnl_locked)
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
+index 816f80ea925b..ebd66fe0d949 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
+@@ -211,7 +211,7 @@ enum brcmf_fweh_event_code {
+ */
+ #define BRCM_OUI "\x00\x10\x18"
+ #define BCMILCP_BCM_SUBTYPE_EVENT 1
+-
++#define BCMILCP_SUBTYPE_VENDOR_LONG 32769
+
+ /**
+ * struct brcm_ethhdr - broadcom specific ether header.
+@@ -334,10 +334,10 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr,
+ void brcmf_fweh_p2pdev_setup(struct brcmf_if *ifp, bool ongoing);
+
+ static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr,
+- struct sk_buff *skb)
++ struct sk_buff *skb, u16 stype)
+ {
+ struct brcmf_event *event_packet;
+- u16 usr_stype;
++ u16 subtype, usr_stype;
+
+ /* only process events when protocol matches */
+ if (skb->protocol != cpu_to_be16(ETH_P_LINK_CTL))
+@@ -346,8 +346,16 @@ static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr,
+ if ((skb->len + ETH_HLEN) < sizeof(*event_packet))
+ return;
+
+- /* check for BRCM oui match */
+ event_packet = (struct brcmf_event *)skb_mac_header(skb);
++
++ /* check subtype if needed */
++ if (unlikely(stype)) {
++ subtype = get_unaligned_be16(&event_packet->hdr.subtype);
++ if (subtype != stype)
++ return;
++ }
++
++ /* check for BRCM oui match */
+ if (memcmp(BRCM_OUI, &event_packet->hdr.oui[0],
+ sizeof(event_packet->hdr.oui)))
+ return;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+index f3cbf78c8899..5a0a29c4cdea 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -579,24 +579,6 @@ static bool brcmf_fws_ifidx_match(struct sk_buff *skb, void *arg)
+ return ifidx == *(int *)arg;
+ }
+
+-static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
+- int ifidx)
+-{
+- bool (*matchfn)(struct sk_buff *, void *) = NULL;
+- struct sk_buff *skb;
+- int prec;
+-
+- if (ifidx != -1)
+- matchfn = brcmf_fws_ifidx_match;
+- for (prec = 0; prec < q->num_prec; prec++) {
+- skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+- while (skb) {
+- brcmu_pkt_buf_free_skb(skb);
+- skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+- }
+- }
+-}
+-
+ static void brcmf_fws_hanger_init(struct brcmf_fws_hanger *hanger)
+ {
+ int i;
+@@ -668,6 +650,28 @@ static inline int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
+ return 0;
+ }
+
++static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
++ int ifidx)
++{
++ bool (*matchfn)(struct sk_buff *, void *) = NULL;
++ struct sk_buff *skb;
++ int prec;
++ u32 hslot;
++
++ if (ifidx != -1)
++ matchfn = brcmf_fws_ifidx_match;
++ for (prec = 0; prec < q->num_prec; prec++) {
++ skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
++ while (skb) {
++ hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
++ brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
++ true);
++ brcmu_pkt_buf_free_skb(skb);
++ skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
++ }
++ }
++}
++
+ static int brcmf_fws_hanger_mark_suppressed(struct brcmf_fws_hanger *h,
+ u32 slot_id)
+ {
+@@ -2168,6 +2172,8 @@ void brcmf_fws_del_interface(struct brcmf_if *ifp)
+ brcmf_fws_lock(fws);
+ ifp->fws_desc = NULL;
+ brcmf_dbg(TRACE, "deleting %s\n", entry->name);
++ brcmf_fws_macdesc_cleanup(fws, &fws->desc.iface[ifp->ifidx],
++ ifp->ifidx);
+ brcmf_fws_macdesc_deinit(entry);
+ brcmf_fws_cleanup(fws, ifp->ifidx);
+ brcmf_fws_unlock(fws);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+index 4e8397a0cbc8..ee922b052561 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -1116,7 +1116,7 @@ static void brcmf_msgbuf_process_event(struct brcmf_msgbuf *msgbuf, void *buf)
+
+ skb->protocol = eth_type_trans(skb, ifp->ndev);
+
+- brcmf_fweh_process_skb(ifp->drvr, skb);
++ brcmf_fweh_process_skb(ifp->drvr, skb, 0);
+
+ exit:
+ brcmu_pkt_buf_free_skb(skb);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+index a4308c6e72d7..44ead0fea7c6 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -160,7 +160,7 @@ struct brcmf_usbdev_info {
+
+ struct usb_device *usbdev;
+ struct device *dev;
+- struct mutex dev_init_lock;
++ struct completion dev_init_done;
+
+ int ctl_in_pipe, ctl_out_pipe;
+ struct urb *ctl_urb; /* URB for control endpoint */
+@@ -684,12 +684,18 @@ static int brcmf_usb_up(struct device *dev)
+
+ static void brcmf_cancel_all_urbs(struct brcmf_usbdev_info *devinfo)
+ {
++ int i;
++
+ if (devinfo->ctl_urb)
+ usb_kill_urb(devinfo->ctl_urb);
+ if (devinfo->bulk_urb)
+ usb_kill_urb(devinfo->bulk_urb);
+- brcmf_usb_free_q(&devinfo->tx_postq, true);
+- brcmf_usb_free_q(&devinfo->rx_postq, true);
++ if (devinfo->tx_reqs)
++ for (i = 0; i < devinfo->bus_pub.ntxq; i++)
++ usb_kill_urb(devinfo->tx_reqs[i].urb);
++ if (devinfo->rx_reqs)
++ for (i = 0; i < devinfo->bus_pub.nrxq; i++)
++ usb_kill_urb(devinfo->rx_reqs[i].urb);
+ }
+
+ static void brcmf_usb_down(struct device *dev)
+@@ -1195,11 +1201,11 @@ static void brcmf_usb_probe_phase2(struct device *dev, int ret,
+ if (ret)
+ goto error;
+
+- mutex_unlock(&devinfo->dev_init_lock);
++ complete(&devinfo->dev_init_done);
+ return;
+ error:
+ brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), ret);
+- mutex_unlock(&devinfo->dev_init_lock);
++ complete(&devinfo->dev_init_done);
+ device_release_driver(dev);
+ }
+
+@@ -1267,7 +1273,7 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
+ if (ret)
+ goto fail;
+ /* we are done */
+- mutex_unlock(&devinfo->dev_init_lock);
++ complete(&devinfo->dev_init_done);
+ return 0;
+ }
+ bus->chip = bus_pub->devid;
+@@ -1327,11 +1333,10 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
+
+ devinfo->usbdev = usb;
+ devinfo->dev = &usb->dev;
+- /* Take an init lock, to protect for disconnect while still loading.
++ /* Init completion, to protect for disconnect while still loading.
+ * Necessary because of the asynchronous firmware load construction
+ */
+- mutex_init(&devinfo->dev_init_lock);
+- mutex_lock(&devinfo->dev_init_lock);
++ init_completion(&devinfo->dev_init_done);
+
+ usb_set_intfdata(intf, devinfo);
+
+@@ -1409,7 +1414,7 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ return 0;
+
+ fail:
+- mutex_unlock(&devinfo->dev_init_lock);
++ complete(&devinfo->dev_init_done);
+ kfree(devinfo);
+ usb_set_intfdata(intf, NULL);
+ return ret;
+@@ -1424,7 +1429,7 @@ brcmf_usb_disconnect(struct usb_interface *intf)
+ devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
+
+ if (devinfo) {
+- mutex_lock(&devinfo->dev_init_lock);
++ wait_for_completion(&devinfo->dev_init_done);
+ /* Make sure that devinfo still exists. Firmware probe routines
+ * may have released the device and cleared the intfdata.
+ */
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
+index 8eff2753abad..d493021f6031 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
+@@ -35,9 +35,10 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
+ struct brcmf_if *ifp;
+ const struct brcmf_vndr_dcmd_hdr *cmdhdr = data;
+ struct sk_buff *reply;
+- int ret, payload, ret_len;
++ unsigned int payload, ret_len;
+ void *dcmd_buf = NULL, *wr_pointer;
+ u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
++ int ret;
+
+ if (len < sizeof(*cmdhdr)) {
+ brcmf_err("vendor command too short: %d\n", len);
+@@ -65,7 +66,7 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
+ brcmf_err("oversize return buffer %d\n", ret_len);
+ ret_len = BRCMF_DCMD_MAXLEN;
+ }
+- payload = max(ret_len, len) + 1;
++ payload = max_t(unsigned int, ret_len, len) + 1;
+ dcmd_buf = vzalloc(payload);
+ if (NULL == dcmd_buf)
+ return -ENOMEM;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index b2905f01b7df..6dcd5374d9b4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1388,10 +1388,15 @@ out_err:
+ static void iwl_pcie_rx_handle(struct iwl_trans *trans, int queue)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+- struct iwl_rxq *rxq = &trans_pcie->rxq[queue];
++ struct iwl_rxq *rxq;
+ u32 r, i, count = 0;
+ bool emergency = false;
+
++ if (WARN_ON_ONCE(!trans_pcie->rxq || !trans_pcie->rxq[queue].bd))
++ return;
++
++ rxq = &trans_pcie->rxq[queue];
++
+ restart:
+ spin_lock(&rxq->lock);
+ /* uCode's read index (stored in shared DRAM) indicates the last Rx
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 2d87ebbfa4da..47ec5293c045 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -4045,16 +4045,20 @@ static int mwifiex_tm_cmd(struct wiphy *wiphy, struct wireless_dev *wdev,
+
+ if (mwifiex_send_cmd(priv, 0, 0, 0, hostcmd, true)) {
+ dev_err(priv->adapter->dev, "Failed to process hostcmd\n");
++ kfree(hostcmd);
+ return -EFAULT;
+ }
+
+ /* process hostcmd response*/
+ skb = cfg80211_testmode_alloc_reply_skb(wiphy, hostcmd->len);
+- if (!skb)
++ if (!skb) {
++ kfree(hostcmd);
+ return -ENOMEM;
++ }
+ err = nla_put(skb, MWIFIEX_TM_ATTR_DATA,
+ hostcmd->len, hostcmd->cmd);
+ if (err) {
++ kfree(hostcmd);
+ kfree_skb(skb);
+ return -EMSGSIZE;
+ }
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfp.c b/drivers/net/wireless/marvell/mwifiex/cfp.c
+index bfe84e55df77..f1522fb1c1e8 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfp.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfp.c
+@@ -531,5 +531,8 @@ u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv,
+ rate_index = (rx_rate > MWIFIEX_RATE_INDEX_OFDM0) ?
+ rx_rate - 1 : rx_rate;
+
++ if (rate_index >= MWIFIEX_MAX_AC_RX_RATES)
++ rate_index = MWIFIEX_MAX_AC_RX_RATES - 1;
++
+ return rate_index;
+ }
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index ef9b502ce576..a3189294ecb8 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -469,6 +469,11 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
+ /* <2> work queue */
+ rtlpriv->works.hw = hw;
+ rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
++ if (unlikely(!rtlpriv->works.rtl_wq)) {
++ pr_err("Failed to allocate work queue\n");
++ return;
++ }
++
+ INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
+ (void *)rtl_watchdog_wq_callback);
+ INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/fw.c
+index 63874512598b..b5f91c994c79 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/fw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/fw.c
+@@ -622,6 +622,8 @@ void rtl88e_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+ u1rsvdpageloc, 3);
+
+ skb = dev_alloc_skb(totalpacketlen);
++ if (!skb)
++ return;
+ skb_put_data(skb, &reserved_page_packet, totalpacketlen);
+
+ rtstatus = rtl_cmd_send_packet(hw, skb);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/fw_common.c
+index f3bff66e85d0..81ec0e6e07c1 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/fw_common.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/fw_common.c
+@@ -646,6 +646,8 @@ void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
+
+
+ skb = dev_alloc_skb(totalpacketlen);
++ if (!skb)
++ return;
+ skb_put_data(skb, &reserved_page_packet, totalpacketlen);
+
+ if (cmd_send_packet)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c
+index 84a0d0eb72e1..a933490928ba 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c
+@@ -766,6 +766,8 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+ u1rsvdpageloc, 3);
+
+ skb = dev_alloc_skb(totalpacketlen);
++ if (!skb)
++ return;
+ skb_put_data(skb, &reserved_page_packet, totalpacketlen);
+
+ rtstatus = rtl_cmd_send_packet(hw, skb);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/fw.c
+index bf9859f74b6f..52f108744e96 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/fw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/fw.c
+@@ -470,6 +470,8 @@ void rtl8723e_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+ u1rsvdpageloc, 3);
+
+ skb = dev_alloc_skb(totalpacketlen);
++ if (!skb)
++ return;
+ skb_put_data(skb, &reserved_page_packet, totalpacketlen);
+
+ rtstatus = rtl_cmd_send_packet(hw, skb);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/fw.c
+index f2441fbb92f1..307c2bd77f06 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/fw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/fw.c
+@@ -584,6 +584,8 @@ void rtl8723be_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
+ u1rsvdpageloc, sizeof(u1rsvdpageloc));
+
+ skb = dev_alloc_skb(totalpacketlen);
++ if (!skb)
++ return;
+ skb_put_data(skb, &reserved_page_packet, totalpacketlen);
+
+ rtstatus = rtl_cmd_send_packet(hw, skb);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c
+index d868a034659f..d7235f6165fd 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.c
+@@ -1645,6 +1645,8 @@ out:
+ &reserved_page_packet_8812[0], totalpacketlen);
+
+ skb = dev_alloc_skb(totalpacketlen);
++ if (!skb)
++ return;
+ skb_put_data(skb, &reserved_page_packet_8812, totalpacketlen);
+
+ rtstatus = rtl_cmd_send_packet(hw, skb);
+@@ -1781,6 +1783,8 @@ out:
+ &reserved_page_packet_8821[0], totalpacketlen);
+
+ skb = dev_alloc_skb(totalpacketlen);
++ if (!skb)
++ return;
+ skb_put_data(skb, &reserved_page_packet_8821, totalpacketlen);
+
+ rtstatus = rtl_cmd_send_packet(hw, skb);
+diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+index 4e510cbe0a89..be59d66585d6 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -188,27 +188,27 @@ bool rsi_is_cipher_wep(struct rsi_common *common)
+ * @adapter: Pointer to the adapter structure.
+ * @band: Operating band to be set.
+ *
+- * Return: None.
++ * Return: int - 0 on success, negative error on failure.
+ */
+-static void rsi_register_rates_channels(struct rsi_hw *adapter, int band)
++static int rsi_register_rates_channels(struct rsi_hw *adapter, int band)
+ {
+ struct ieee80211_supported_band *sbands = &adapter->sbands[band];
+ void *channels = NULL;
+
+ if (band == NL80211_BAND_2GHZ) {
+- channels = kmalloc(sizeof(rsi_2ghz_channels), GFP_KERNEL);
+- memcpy(channels,
+- rsi_2ghz_channels,
+- sizeof(rsi_2ghz_channels));
++ channels = kmemdup(rsi_2ghz_channels, sizeof(rsi_2ghz_channels),
++ GFP_KERNEL);
++ if (!channels)
++ return -ENOMEM;
+ sbands->band = NL80211_BAND_2GHZ;
+ sbands->n_channels = ARRAY_SIZE(rsi_2ghz_channels);
+ sbands->bitrates = rsi_rates;
+ sbands->n_bitrates = ARRAY_SIZE(rsi_rates);
+ } else {
+- channels = kmalloc(sizeof(rsi_5ghz_channels), GFP_KERNEL);
+- memcpy(channels,
+- rsi_5ghz_channels,
+- sizeof(rsi_5ghz_channels));
++ channels = kmemdup(rsi_5ghz_channels, sizeof(rsi_5ghz_channels),
++ GFP_KERNEL);
++ if (!channels)
++ return -ENOMEM;
+ sbands->band = NL80211_BAND_5GHZ;
+ sbands->n_channels = ARRAY_SIZE(rsi_5ghz_channels);
+ sbands->bitrates = &rsi_rates[4];
+@@ -227,6 +227,7 @@ static void rsi_register_rates_channels(struct rsi_hw *adapter, int band)
+ sbands->ht_cap.mcs.rx_mask[0] = 0xff;
+ sbands->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+ /* sbands->ht_cap.mcs.rx_highest = 0x82; */
++ return 0;
+ }
+
+ /**
+@@ -1985,11 +1986,16 @@ int rsi_mac80211_attach(struct rsi_common *common)
+ wiphy->available_antennas_rx = 1;
+ wiphy->available_antennas_tx = 1;
+
+- rsi_register_rates_channels(adapter, NL80211_BAND_2GHZ);
++ status = rsi_register_rates_channels(adapter, NL80211_BAND_2GHZ);
++ if (status)
++ return status;
+ wiphy->bands[NL80211_BAND_2GHZ] =
+ &adapter->sbands[NL80211_BAND_2GHZ];
+ if (common->num_supp_bands > 1) {
+- rsi_register_rates_channels(adapter, NL80211_BAND_5GHZ);
++ status = rsi_register_rates_channels(adapter,
++ NL80211_BAND_5GHZ);
++ if (status)
++ return status;
+ wiphy->bands[NL80211_BAND_5GHZ] =
+ &adapter->sbands[NL80211_BAND_5GHZ];
+ }
+diff --git a/drivers/net/wireless/st/cw1200/main.c b/drivers/net/wireless/st/cw1200/main.c
+index 90dc979f260b..c1608f0bf6d0 100644
+--- a/drivers/net/wireless/st/cw1200/main.c
++++ b/drivers/net/wireless/st/cw1200/main.c
+@@ -345,6 +345,11 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
+ mutex_init(&priv->wsm_cmd_mux);
+ mutex_init(&priv->conf_mutex);
+ priv->workqueue = create_singlethread_workqueue("cw1200_wq");
++ if (!priv->workqueue) {
++ ieee80211_free_hw(hw);
++ return NULL;
++ }
++
+ sema_init(&priv->scan.lock, 1);
+ INIT_WORK(&priv->scan.work, cw1200_scan_work);
+ INIT_DELAYED_WORK(&priv->scan.probe_work, cw1200_probe_work);
+diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
+index cff027fc2676..a7ce2f1761a2 100644
+--- a/drivers/nvdimm/pmem.c
++++ b/drivers/nvdimm/pmem.c
+@@ -281,16 +281,22 @@ static long pmem_dax_direct_access(struct dax_device *dax_dev,
+ return __pmem_direct_access(pmem, pgoff, nr_pages, kaddr, pfn);
+ }
+
++/*
++ * Use the 'no check' versions of copy_from_iter_flushcache() and
++ * copy_to_iter_mcsafe() to bypass HARDENED_USERCOPY overhead. Bounds
++ * checking, both file offset and device offset, is handled by
++ * dax_iomap_actor()
++ */
+ static size_t pmem_copy_from_iter(struct dax_device *dax_dev, pgoff_t pgoff,
+ void *addr, size_t bytes, struct iov_iter *i)
+ {
+- return copy_from_iter_flushcache(addr, bytes, i);
++ return _copy_from_iter_flushcache(addr, bytes, i);
+ }
+
+ static size_t pmem_copy_to_iter(struct dax_device *dax_dev, pgoff_t pgoff,
+ void *addr, size_t bytes, struct iov_iter *i)
+ {
+- return copy_to_iter_mcsafe(addr, bytes, i);
++ return _copy_to_iter_mcsafe(addr, bytes, i);
+ }
+
+ static const struct dax_operations pmem_dax_ops = {
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 2cdb3032ca0f..abfb46378cc1 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1480,6 +1480,10 @@ static void nvme_update_disk_info(struct gendisk *disk,
+ sector_t capacity = le64_to_cpup(&id->nsze) << (ns->lba_shift - 9);
+ unsigned short bs = 1 << ns->lba_shift;
+
++ if (ns->lba_shift > PAGE_SHIFT) {
++ /* unsupported block size, set capacity to 0 later */
++ bs = (1 << 9);
++ }
+ blk_mq_freeze_queue(disk->queue);
+ blk_integrity_unregister(disk);
+
+@@ -1490,7 +1494,8 @@ static void nvme_update_disk_info(struct gendisk *disk,
+ if (ns->ms && !ns->ext &&
+ (ns->ctrl->ops->flags & NVME_F_METADATA_SUPPORTED))
+ nvme_init_integrity(disk, ns->ms, ns->pi_type);
+- if (ns->ms && !nvme_ns_has_pi(ns) && !blk_get_integrity(disk))
++ if ((ns->ms && !nvme_ns_has_pi(ns) && !blk_get_integrity(disk)) ||
++ ns->lba_shift > PAGE_SHIFT)
+ capacity = 0;
+
+ set_capacity(disk, capacity);
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 0939a4e178fb..e4f167e35353 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -880,8 +880,9 @@ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ {
+ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_stop_queue(&ctrl->queues[0]);
+- blk_mq_tagset_busy_iter(&ctrl->admin_tag_set, nvme_cancel_request,
+- &ctrl->ctrl);
++ if (ctrl->ctrl.admin_tagset)
++ blk_mq_tagset_busy_iter(ctrl->ctrl.admin_tagset,
++ nvme_cancel_request, &ctrl->ctrl);
+ blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_destroy_admin_queue(ctrl, remove);
+ }
+@@ -892,8 +893,9 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ if (ctrl->ctrl.queue_count > 1) {
+ nvme_stop_queues(&ctrl->ctrl);
+ nvme_rdma_stop_io_queues(ctrl);
+- blk_mq_tagset_busy_iter(&ctrl->tag_set, nvme_cancel_request,
+- &ctrl->ctrl);
++ if (ctrl->ctrl.tagset)
++ blk_mq_tagset_busy_iter(ctrl->ctrl.tagset,
++ nvme_cancel_request, &ctrl->ctrl);
+ if (remove)
+ nvme_start_queues(&ctrl->ctrl);
+ nvme_rdma_destroy_io_queues(ctrl, remove);
+diff --git a/drivers/perf/arm-cci.c b/drivers/perf/arm-cci.c
+index 1bfeb160c5b1..14a541c453e5 100644
+--- a/drivers/perf/arm-cci.c
++++ b/drivers/perf/arm-cci.c
+@@ -1692,21 +1692,24 @@ static int cci_pmu_probe(struct platform_device *pdev)
+ raw_spin_lock_init(&cci_pmu->hw_events.pmu_lock);
+ mutex_init(&cci_pmu->reserve_mutex);
+ atomic_set(&cci_pmu->active_events, 0);
+- cci_pmu->cpu = get_cpu();
+-
+- ret = cci_pmu_init(cci_pmu, pdev);
+- if (ret) {
+- put_cpu();
+- return ret;
+- }
+
++ cci_pmu->cpu = raw_smp_processor_id();
++ g_cci_pmu = cci_pmu;
+ cpuhp_setup_state_nocalls(CPUHP_AP_PERF_ARM_CCI_ONLINE,
+ "perf/arm/cci:online", NULL,
+ cci_pmu_offline_cpu);
+- put_cpu();
+- g_cci_pmu = cci_pmu;
++
++ ret = cci_pmu_init(cci_pmu, pdev);
++ if (ret)
++ goto error_pmu_init;
++
+ pr_info("ARM %s PMU driver probed", cci_pmu->model->name);
+ return 0;
++
++error_pmu_init:
++ cpuhp_remove_state(CPUHP_AP_PERF_ARM_CCI_ONLINE);
++ g_cci_pmu = NULL;
++ return ret;
+ }
+
+ static int cci_pmu_remove(struct platform_device *pdev)
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index 15c8fc2abf01..1f8809bab002 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -550,6 +550,7 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
+ struct sun4i_usb_phy_data *data =
+ container_of(work, struct sun4i_usb_phy_data, detect.work);
+ struct phy *phy0 = data->phys[0].phy;
++ struct sun4i_usb_phy *phy = phy_get_drvdata(phy0);
+ bool force_session_end, id_notify = false, vbus_notify = false;
+ int id_det, vbus_det;
+
+@@ -606,6 +607,9 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
+ mutex_unlock(&phy0->mutex);
+ }
+
++ /* Enable PHY0 passby for host mode only. */
++ sun4i_usb_phy_passby(phy, !id_det);
++
+ /* Re-route PHY0 if necessary */
+ if (data->cfg->phy0_dual_route)
+ sun4i_usb_phy0_reroute(data, id_det);
+diff --git a/drivers/phy/motorola/Kconfig b/drivers/phy/motorola/Kconfig
+index 82651524ffb9..718f8729701d 100644
+--- a/drivers/phy/motorola/Kconfig
++++ b/drivers/phy/motorola/Kconfig
+@@ -13,7 +13,7 @@ config PHY_CPCAP_USB
+
+ config PHY_MAPPHONE_MDM6600
+ tristate "Motorola Mapphone MDM6600 modem USB PHY driver"
+- depends on OF && USB_SUPPORT
++ depends on OF && USB_SUPPORT && GPIOLIB
+ select GENERIC_PHY
+ help
+ Enable this for MDM6600 USB modem to work on Motorola phones
+diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
+index 302190d1558d..0d7d379e9bb8 100644
+--- a/drivers/pinctrl/pinctrl-pistachio.c
++++ b/drivers/pinctrl/pinctrl-pistachio.c
+@@ -1368,6 +1368,7 @@ static int pistachio_gpio_register(struct pistachio_pinctrl *pctl)
+ if (!of_find_property(child, "gpio-controller", NULL)) {
+ dev_err(pctl->dev,
+ "No gpio-controller property for bank %u\n", i);
++ of_node_put(child);
+ ret = -ENODEV;
+ goto err;
+ }
+@@ -1375,6 +1376,7 @@ static int pistachio_gpio_register(struct pistachio_pinctrl *pctl)
+ irq = irq_of_parse_and_map(child, 0);
+ if (irq < 0) {
+ dev_err(pctl->dev, "No IRQ for bank %u: %d\n", i, irq);
++ of_node_put(child);
+ ret = irq;
+ goto err;
+ }
+diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
+index 44c6b753f692..85ddf49a5188 100644
+--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c
+@@ -71,6 +71,7 @@ s5pv210_retention_init(struct samsung_pinctrl_drv_data *drvdata,
+ }
+
+ clk_base = of_iomap(np, 0);
++ of_node_put(np);
+ if (!clk_base) {
+ pr_err("%s: failed to map clock registers\n", __func__);
+ return ERR_PTR(-EINVAL);
+diff --git a/drivers/pinctrl/zte/pinctrl-zx.c b/drivers/pinctrl/zte/pinctrl-zx.c
+index caa44dd2880a..3cb69309912b 100644
+--- a/drivers/pinctrl/zte/pinctrl-zx.c
++++ b/drivers/pinctrl/zte/pinctrl-zx.c
+@@ -411,6 +411,7 @@ int zx_pinctrl_init(struct platform_device *pdev,
+ }
+
+ zpctl->aux_base = of_iomap(np, 0);
++ of_node_put(np);
+ if (!zpctl->aux_base)
+ return -ENOMEM;
+
+diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
+index 01ffc0ef8033..fbcf13bbbd8d 100644
+--- a/drivers/rtc/rtc-88pm860x.c
++++ b/drivers/rtc/rtc-88pm860x.c
+@@ -414,7 +414,7 @@ static int pm860x_rtc_remove(struct platform_device *pdev)
+ struct pm860x_rtc_info *info = platform_get_drvdata(pdev);
+
+ #ifdef VRTC_CALIBRATION
+- flush_scheduled_work();
++ cancel_delayed_work_sync(&info->calib_work);
+ /* disable measurement */
+ pm860x_set_bits(info->i2c, PM8607_MEAS_EN2, MEAS2_VRTC, 0);
+ #endif /* VRTC_CALIBRATION */
+diff --git a/drivers/rtc/rtc-stm32.c b/drivers/rtc/rtc-stm32.c
+index c5908cfea234..8e6c9b3bcc29 100644
+--- a/drivers/rtc/rtc-stm32.c
++++ b/drivers/rtc/rtc-stm32.c
+@@ -788,11 +788,14 @@ static int stm32_rtc_probe(struct platform_device *pdev)
+ ret = device_init_wakeup(&pdev->dev, true);
+ if (rtc->data->has_wakeirq) {
+ rtc->wakeirq_alarm = platform_get_irq(pdev, 1);
+- if (rtc->wakeirq_alarm <= 0)
+- ret = rtc->wakeirq_alarm;
+- else
++ if (rtc->wakeirq_alarm > 0) {
+ ret = dev_pm_set_dedicated_wake_irq(&pdev->dev,
+ rtc->wakeirq_alarm);
++ } else {
++ ret = rtc->wakeirq_alarm;
++ if (rtc->wakeirq_alarm == -EPROBE_DEFER)
++ goto err;
++ }
+ }
+ if (ret)
+ dev_warn(&pdev->dev, "alarm can't wake up the system: %d", ret);
+diff --git a/drivers/rtc/rtc-xgene.c b/drivers/rtc/rtc-xgene.c
+index 153820876a82..2f741f455c30 100644
+--- a/drivers/rtc/rtc-xgene.c
++++ b/drivers/rtc/rtc-xgene.c
+@@ -168,6 +168,10 @@ static int xgene_rtc_probe(struct platform_device *pdev)
+ if (IS_ERR(pdata->csr_base))
+ return PTR_ERR(pdata->csr_base);
+
++ pdata->rtc = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(pdata->rtc))
++ return PTR_ERR(pdata->rtc);
++
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0) {
+ dev_err(&pdev->dev, "No IRQ resource\n");
+@@ -198,15 +202,15 @@ static int xgene_rtc_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- pdata->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
+- &xgene_rtc_ops, THIS_MODULE);
+- if (IS_ERR(pdata->rtc)) {
+- clk_disable_unprepare(pdata->clk);
+- return PTR_ERR(pdata->rtc);
+- }
+-
+ /* HW does not support update faster than 1 seconds */
+ pdata->rtc->uie_unsupported = 1;
++ pdata->rtc->ops = &xgene_rtc_ops;
++
++ ret = rtc_register_device(pdata->rtc);
++ if (ret) {
++ clk_disable_unprepare(pdata->clk);
++ return ret;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/s390/cio/cio.h b/drivers/s390/cio/cio.h
+index 9811fd8a0c73..92eabbb5f18d 100644
+--- a/drivers/s390/cio/cio.h
++++ b/drivers/s390/cio/cio.h
+@@ -115,7 +115,7 @@ struct subchannel {
+ struct schib_config config;
+ } __attribute__ ((aligned(8)));
+
+-DECLARE_PER_CPU(struct irb, cio_irb);
++DECLARE_PER_CPU_ALIGNED(struct irb, cio_irb);
+
+ #define to_subchannel(n) container_of(n, struct subchannel, dev)
+
+diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
+index fabd9798e4c4..7a06cdff6572 100644
+--- a/drivers/s390/cio/vfio_ccw_drv.c
++++ b/drivers/s390/cio/vfio_ccw_drv.c
+@@ -40,26 +40,30 @@ int vfio_ccw_sch_quiesce(struct subchannel *sch)
+ if (ret != -EBUSY)
+ goto out_unlock;
+
++ iretry = 255;
+ do {
+- iretry = 255;
+
+ ret = cio_cancel_halt_clear(sch, &iretry);
+- while (ret == -EBUSY) {
+- /*
+- * Flush all I/O and wait for
+- * cancel/halt/clear completion.
+- */
+- private->completion = &completion;
+- spin_unlock_irq(sch->lock);
+
+- wait_for_completion_timeout(&completion, 3*HZ);
++ if (ret == -EIO) {
++ pr_err("vfio_ccw: could not quiesce subchannel 0.%x.%04x!\n",
++ sch->schid.ssid, sch->schid.sch_no);
++ break;
++ }
++
++ /*
++ * Flush all I/O and wait for
++ * cancel/halt/clear completion.
++ */
++ private->completion = &completion;
++ spin_unlock_irq(sch->lock);
+
+- spin_lock_irq(sch->lock);
+- private->completion = NULL;
+- flush_workqueue(vfio_ccw_work_q);
+- ret = cio_cancel_halt_clear(sch, &iretry);
+- };
++ if (ret == -EBUSY)
++ wait_for_completion_timeout(&completion, 3*HZ);
+
++ private->completion = NULL;
++ flush_workqueue(vfio_ccw_work_q);
++ spin_lock_irq(sch->lock);
+ ret = cio_disable_subchannel(sch);
+ } while (ret == -EBUSY);
+ out_unlock:
+diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c
+index f673e106c041..dc5ff47de3fe 100644
+--- a/drivers/s390/cio/vfio_ccw_ops.c
++++ b/drivers/s390/cio/vfio_ccw_ops.c
+@@ -130,11 +130,12 @@ static int vfio_ccw_mdev_remove(struct mdev_device *mdev)
+
+ if ((private->state != VFIO_CCW_STATE_NOT_OPER) &&
+ (private->state != VFIO_CCW_STATE_STANDBY)) {
+- if (!vfio_ccw_mdev_reset(mdev))
++ if (!vfio_ccw_sch_quiesce(private->sch))
+ private->state = VFIO_CCW_STATE_STANDBY;
+ /* The state will be NOT_OPER on error. */
+ }
+
++ cp_free(&private->cp);
+ private->mdev = NULL;
+ atomic_inc(&private->avail);
+
+@@ -158,6 +159,14 @@ static void vfio_ccw_mdev_release(struct mdev_device *mdev)
+ struct vfio_ccw_private *private =
+ dev_get_drvdata(mdev_parent_dev(mdev));
+
++ if ((private->state != VFIO_CCW_STATE_NOT_OPER) &&
++ (private->state != VFIO_CCW_STATE_STANDBY)) {
++ if (!vfio_ccw_mdev_reset(mdev))
++ private->state = VFIO_CCW_STATE_STANDBY;
++ /* The state will be NOT_OPER on error. */
++ }
++
++ cp_free(&private->cp);
+ vfio_unregister_notifier(mdev_dev(mdev), VFIO_IOMMU_NOTIFY,
+ &private->nb);
+ }
+diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
+index e6854127b434..b2737bfeb8bb 100644
+--- a/drivers/s390/crypto/zcrypt_api.c
++++ b/drivers/s390/crypto/zcrypt_api.c
+@@ -224,6 +224,7 @@ static long zcrypt_rsa_modexpo(struct ica_rsa_modexpo *mex)
+ trace_s390_zcrypt_req(mex, TP_ICARSAMODEXPO);
+
+ if (mex->outputdatalength < mex->inputdatalength) {
++ func_code = 0;
+ rc = -EINVAL;
+ goto out;
+ }
+@@ -298,6 +299,7 @@ static long zcrypt_rsa_crt(struct ica_rsa_modexpo_crt *crt)
+ trace_s390_zcrypt_req(crt, TP_ICARSACRT);
+
+ if (crt->outputdatalength < crt->inputdatalength) {
++ func_code = 0;
+ rc = -EINVAL;
+ goto out;
+ }
+@@ -483,6 +485,7 @@ static long zcrypt_send_ep11_cprb(struct ep11_urb *xcrb)
+
+ targets = kcalloc(target_num, sizeof(*targets), GFP_KERNEL);
+ if (!targets) {
++ func_code = 0;
+ rc = -ENOMEM;
+ goto out;
+ }
+@@ -490,6 +493,7 @@ static long zcrypt_send_ep11_cprb(struct ep11_urb *xcrb)
+ uptr = (struct ep11_target_dev __force __user *) xcrb->targets;
+ if (copy_from_user(targets, uptr,
+ target_num * sizeof(*targets))) {
++ func_code = 0;
+ rc = -EFAULT;
+ goto out_free;
+ }
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index 2d1f6a583641..b2657582cfcf 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -201,6 +201,12 @@ struct qeth_vnicc_info {
+ bool rx_bcast_enabled;
+ };
+
++static inline int qeth_is_adp_supported(struct qeth_ipa_info *ipa,
++ enum qeth_ipa_setadp_cmd func)
++{
++ return (ipa->supported_funcs & func);
++}
++
+ static inline int qeth_is_ipa_supported(struct qeth_ipa_info *ipa,
+ enum qeth_ipa_funcs func)
+ {
+@@ -214,9 +220,7 @@ static inline int qeth_is_ipa_enabled(struct qeth_ipa_info *ipa,
+ }
+
+ #define qeth_adp_supported(c, f) \
+- qeth_is_ipa_supported(&c->options.adp, f)
+-#define qeth_adp_enabled(c, f) \
+- qeth_is_ipa_enabled(&c->options.adp, f)
++ qeth_is_adp_supported(&c->options.adp, f)
+ #define qeth_is_supported(c, f) \
+ qeth_is_ipa_supported(&c->options.ipa4, f)
+ #define qeth_is_enabled(c, f) \
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 56aacf32f71b..461afc276db7 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -1370,7 +1370,7 @@ static void qeth_set_multiple_write_queues(struct qeth_card *card)
+ card->qdio.no_out_queues = 4;
+ }
+
+-static void qeth_update_from_chp_desc(struct qeth_card *card)
++static int qeth_update_from_chp_desc(struct qeth_card *card)
+ {
+ struct ccw_device *ccwdev;
+ struct channel_path_desc_fmt0 *chp_dsc;
+@@ -1380,7 +1380,7 @@ static void qeth_update_from_chp_desc(struct qeth_card *card)
+ ccwdev = card->data.ccwdev;
+ chp_dsc = ccw_device_get_chp_desc(ccwdev, 0);
+ if (!chp_dsc)
+- goto out;
++ return -ENOMEM;
+
+ card->info.func_level = 0x4100 + chp_dsc->desc;
+ if (card->info.type == QETH_CARD_TYPE_IQD)
+@@ -1395,6 +1395,7 @@ out:
+ kfree(chp_dsc);
+ QETH_DBF_TEXT_(SETUP, 2, "nr:%x", card->qdio.no_out_queues);
+ QETH_DBF_TEXT_(SETUP, 2, "lvl:%02x", card->info.func_level);
++ return 0;
+ }
+
+ static void qeth_init_qdio_info(struct qeth_card *card)
+@@ -5090,7 +5091,9 @@ int qeth_core_hardsetup_card(struct qeth_card *card)
+
+ QETH_DBF_TEXT(SETUP, 2, "hrdsetup");
+ atomic_set(&card->force_alloc_skb, 0);
+- qeth_update_from_chp_desc(card);
++ rc = qeth_update_from_chp_desc(card);
++ if (rc)
++ return rc;
+ retry:
+ if (retries < 3)
+ QETH_DBF_MESSAGE(2, "%s Retrying to do IDX activates.\n",
+@@ -5768,7 +5771,9 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev)
+ gdev->cdev[2]->handler = qeth_irq;
+
+ qeth_setup_card(card);
+- qeth_update_from_chp_desc(card);
++ rc = qeth_update_from_chp_desc(card);
++ if (rc)
++ goto err_chp_desc;
+
+ card->dev = qeth_alloc_netdev(card);
+ if (!card->dev) {
+@@ -5806,6 +5811,7 @@ err_disc:
+ qeth_core_free_discipline(card);
+ err_load:
+ free_netdev(card->dev);
++err_chp_desc:
+ err_card:
+ qeth_core_free_card(card);
+ err_dev:
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index e9ecc667e3fb..231eb79efa32 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -2040,6 +2040,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last)
+ if ((SAS_ADDR(sas_addr) == 0) || (res == -ECOMM)) {
+ phy->phy_state = PHY_EMPTY;
+ sas_unregister_devs_sas_addr(dev, phy_id, last);
++ /*
++ * Even though the PHY is empty, for convenience we discover
++ * the PHY to update the PHY info, like negotiated linkrate.
++ */
++ sas_ex_phy_discover(dev, phy_id);
+ return res;
+ } else if (SAS_ADDR(sas_addr) == SAS_ADDR(phy->attached_sas_addr) &&
+ dev_type_flutter(type, phy->attached_dev_type)) {
+diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
+index 1a964e71582f..d909d90035bb 100644
+--- a/drivers/scsi/lpfc/lpfc_ct.c
++++ b/drivers/scsi/lpfc/lpfc_ct.c
+@@ -1762,6 +1762,9 @@ lpfc_fdmi_hba_attr_manufacturer(struct lpfc_vport *vport,
+ ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+ memset(ae, 0, 256);
+
++ /* This string MUST be consistent with other FC platforms
++ * supported by Broadcom.
++ */
+ strncpy(ae->un.AttrString,
+ "Emulex Corporation",
+ sizeof(ae->un.AttrString));
+@@ -2117,10 +2120,11 @@ lpfc_fdmi_port_attr_fc4type(struct lpfc_vport *vport,
+ ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+ memset(ae, 0, 32);
+
+- ae->un.AttrTypes[3] = 0x02; /* Type 1 - ELS */
+- ae->un.AttrTypes[2] = 0x01; /* Type 8 - FCP */
+- ae->un.AttrTypes[6] = 0x01; /* Type 40 - NVME */
+- ae->un.AttrTypes[7] = 0x01; /* Type 32 - CT */
++ ae->un.AttrTypes[3] = 0x02; /* Type 0x1 - ELS */
++ ae->un.AttrTypes[2] = 0x01; /* Type 0x8 - FCP */
++ if (vport->nvmei_support || vport->phba->nvmet_support)
++ ae->un.AttrTypes[6] = 0x01; /* Type 0x28 - NVME */
++ ae->un.AttrTypes[7] = 0x01; /* Type 0x20 - CT */
+ size = FOURBYTES + 32;
+ ad->AttrLen = cpu_to_be16(size);
+ ad->AttrType = cpu_to_be16(RPRT_SUPPORTED_FC4_TYPES);
+@@ -2425,9 +2429,11 @@ lpfc_fdmi_port_attr_active_fc4type(struct lpfc_vport *vport,
+ ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+ memset(ae, 0, 32);
+
+- ae->un.AttrTypes[3] = 0x02; /* Type 1 - ELS */
+- ae->un.AttrTypes[2] = 0x01; /* Type 8 - FCP */
+- ae->un.AttrTypes[7] = 0x01; /* Type 32 - CT */
++ ae->un.AttrTypes[3] = 0x02; /* Type 0x1 - ELS */
++ ae->un.AttrTypes[2] = 0x01; /* Type 0x8 - FCP */
++ if (vport->phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME)
++ ae->un.AttrTypes[6] = 0x1; /* Type 0x28 - NVME */
++ ae->un.AttrTypes[7] = 0x01; /* Type 0x20 - CT */
+ size = FOURBYTES + 32;
+ ad->AttrLen = cpu_to_be16(size);
+ ad->AttrType = cpu_to_be16(RPRT_ACTIVE_FC4_TYPES);
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index eb71877f12f8..ccdd82b1123f 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -921,7 +921,11 @@ lpfc_linkdown(struct lpfc_hba *phba)
+ }
+ }
+ lpfc_destroy_vport_work_array(phba, vports);
+- /* Clean up any firmware default rpi's */
++
++ /* Clean up any SLI3 firmware default rpi's */
++ if (phba->sli_rev > LPFC_SLI_REV3)
++ goto skip_unreg_did;
++
+ mb = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
+ if (mb) {
+ lpfc_unreg_did(phba, 0xffff, LPFC_UNREG_ALL_DFLT_RPIS, mb);
+@@ -933,6 +937,7 @@ lpfc_linkdown(struct lpfc_hba *phba)
+ }
+ }
+
++ skip_unreg_did:
+ /* Setup myDID for link up if we are in pt2pt mode */
+ if (phba->pport->fc_flag & FC_PT2PT) {
+ mb = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
+@@ -4855,6 +4860,10 @@ lpfc_unreg_default_rpis(struct lpfc_vport *vport)
+ LPFC_MBOXQ_t *mbox;
+ int rc;
+
++ /* Unreg DID is an SLI3 operation. */
++ if (phba->sli_rev > LPFC_SLI_REV3)
++ return;
++
+ mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
+ if (mbox) {
+ lpfc_unreg_did(phba, vport->vpi, LPFC_UNREG_ALL_DFLT_RPIS,
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index ca62117a2d13..099f70798fdd 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -2482,15 +2482,15 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
+ if (!cstat)
+ return -ENOMEM;
+
++ if (!IS_ENABLED(CONFIG_NVME_FC))
++ return ret;
++
+ /* localport is allocated from the stack, but the registration
+ * call allocates heap memory as well as the private area.
+ */
+-#if (IS_ENABLED(CONFIG_NVME_FC))
++
+ ret = nvme_fc_register_localport(&nfcp_info, &lpfc_nvme_template,
+ &vport->phba->pcidev->dev, &localport);
+-#else
+- ret = -ENOMEM;
+-#endif
+ if (!ret) {
+ lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME | LOG_NVME_DISC,
+ "6005 Successfully registered local "
+diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c
+index 6bbc38b1b465..a17c13846d1e 100644
+--- a/drivers/scsi/qedf/qedf_io.c
++++ b/drivers/scsi/qedf/qedf_io.c
+@@ -902,6 +902,7 @@ int qedf_post_io_req(struct qedf_rport *fcport, struct qedf_ioreq *io_req)
+ if (!test_bit(QEDF_RPORT_SESSION_READY, &fcport->flags)) {
+ QEDF_ERR(&(qedf->dbg_ctx), "Session not offloaded yet.\n");
+ kref_put(&io_req->refcount, qedf_release_cmd);
++ return -EINVAL;
+ }
+
+ /* Obtain free SQE */
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index d4821b9dea45..4130b9117055 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -1001,6 +1001,9 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
+ qedi_ep = ep->dd_data;
+ qedi = qedi_ep->qedi;
+
++ if (qedi_ep->state == EP_STATE_OFLDCONN_START)
++ goto ep_exit_recover;
++
+ flush_work(&qedi_ep->offload_work);
+
+ if (qedi_ep->conn) {
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 36cbb29c84f6..88d8acf86a2a 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -3449,7 +3449,7 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
+ ql_log(ql_log_fatal, vha, 0x00c8,
+ "Failed to allocate memory for ha->msix_entries.\n");
+ ret = -ENOMEM;
+- goto msix_out;
++ goto free_irqs;
+ }
+ ha->flags.msix_enabled = 1;
+
+@@ -3532,6 +3532,10 @@ msix_register_fail:
+
+ msix_out:
+ return ret;
++
++free_irqs:
++ pci_free_irq_vectors(ha->pdev);
++ goto msix_out;
+ }
+
+ int
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index a8c67cd17625..9d7feb005acf 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -684,7 +684,6 @@ done:
+ void qla24xx_do_nack_work(struct scsi_qla_host *vha, struct qla_work_evt *e)
+ {
+ fc_port_t *t;
+- unsigned long flags;
+
+ switch (e->u.nack.type) {
+ case SRB_NACK_PRLI:
+@@ -694,10 +693,8 @@ void qla24xx_do_nack_work(struct scsi_qla_host *vha, struct qla_work_evt *e)
+ if (t) {
+ ql_log(ql_log_info, vha, 0xd034,
+ "%s create sess success %p", __func__, t);
+- spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+ /* create sess has an extra kref */
+ vha->hw->tgt.tgt_ops->put_sess(e->u.nack.fcport);
+- spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+ }
+ break;
+ }
+@@ -709,9 +706,6 @@ void qla24xx_delete_sess_fn(struct work_struct *work)
+ {
+ fc_port_t *fcport = container_of(work, struct fc_port, del_work);
+ struct qla_hw_data *ha = fcport->vha->hw;
+- unsigned long flags;
+-
+- spin_lock_irqsave(&ha->tgt.sess_lock, flags);
+
+ if (fcport->se_sess) {
+ ha->tgt.tgt_ops->shutdown_sess(fcport);
+@@ -719,7 +713,6 @@ void qla24xx_delete_sess_fn(struct work_struct *work)
+ } else {
+ qlt_unreg_sess(fcport);
+ }
+- spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+ }
+
+ /*
+@@ -788,8 +781,9 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
+ fcport->port_name, sess->loop_id);
+ sess->local = 0;
+ }
+- ha->tgt.tgt_ops->put_sess(sess);
+ spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
++
++ ha->tgt.tgt_ops->put_sess(sess);
+ }
+
+ /*
+@@ -4135,9 +4129,7 @@ static void __qlt_do_work(struct qla_tgt_cmd *cmd)
+ /*
+ * Drop extra session reference from qla_tgt_handle_cmd_for_atio*(
+ */
+- spin_lock_irqsave(&ha->tgt.sess_lock, flags);
+ ha->tgt.tgt_ops->put_sess(sess);
+- spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+ return;
+
+ out_term:
+@@ -4154,9 +4146,7 @@ out_term:
+ target_free_tag(sess->se_sess, &cmd->se_cmd);
+ spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+
+- spin_lock_irqsave(&ha->tgt.sess_lock, flags);
+ ha->tgt.tgt_ops->put_sess(sess);
+- spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+ }
+
+ static void qlt_do_work(struct work_struct *work)
+@@ -4365,9 +4355,7 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
+ if (!cmd) {
+ ql_dbg(ql_dbg_io, vha, 0x3062,
+ "qla_target(%d): Allocation of cmd failed\n", vha->vp_idx);
+- spin_lock_irqsave(&ha->tgt.sess_lock, flags);
+ ha->tgt.tgt_ops->put_sess(sess);
+- spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+ return -EBUSY;
+ }
+
+@@ -6105,17 +6093,19 @@ static void qlt_abort_work(struct qla_tgt *tgt,
+ }
+
+ rc = __qlt_24xx_handle_abts(vha, &prm->abts, sess);
+- ha->tgt.tgt_ops->put_sess(sess);
+ spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
+
++ ha->tgt.tgt_ops->put_sess(sess);
++
+ if (rc != 0)
+ goto out_term;
+ return;
+
+ out_term2:
++ spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
++
+ if (sess)
+ ha->tgt.tgt_ops->put_sess(sess);
+- spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
+
+ out_term:
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+@@ -6175,9 +6165,10 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
+ scsilun_to_int((struct scsi_lun *)&a->u.isp24.fcp_cmnd.lun);
+
+ rc = qlt_issue_task_mgmt(sess, unpacked_lun, fn, iocb, 0);
+- ha->tgt.tgt_ops->put_sess(sess);
+ spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+
++ ha->tgt.tgt_ops->put_sess(sess);
++
+ if (rc != 0)
+ goto out_term;
+ return;
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 64e2d859f633..b8c1a739dfbd 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -350,7 +350,6 @@ static void tcm_qla2xxx_put_sess(struct fc_port *sess)
+ if (!sess)
+ return;
+
+- assert_spin_locked(&sess->vha->hw->tgt.sess_lock);
+ kref_put(&sess->sess_kref, tcm_qla2xxx_release_session);
+ }
+
+@@ -365,8 +364,9 @@ static void tcm_qla2xxx_close_session(struct se_session *se_sess)
+
+ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+ target_sess_cmd_list_set_waiting(se_sess);
+- tcm_qla2xxx_put_sess(sess);
+ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
++
++ tcm_qla2xxx_put_sess(sess);
+ }
+
+ static u32 tcm_qla2xxx_sess_get_index(struct se_session *se_sess)
+@@ -390,6 +390,8 @@ static int tcm_qla2xxx_write_pending(struct se_cmd *se_cmd)
+ cmd->se_cmd.transport_state,
+ cmd->se_cmd.t_state,
+ cmd->se_cmd.se_cmd_flags);
++ transport_generic_request_failure(&cmd->se_cmd,
++ TCM_CHECK_CONDITION_ABORT_CMD);
+ return 0;
+ }
+ cmd->trc_flags |= TRC_XFR_RDY;
+@@ -829,7 +831,6 @@ static void tcm_qla2xxx_clear_nacl_from_fcport_map(struct fc_port *sess)
+
+ static void tcm_qla2xxx_shutdown_sess(struct fc_port *sess)
+ {
+- assert_spin_locked(&sess->vha->hw->tgt.sess_lock);
+ target_sess_cmd_list_set_waiting(sess->se_sess);
+ }
+
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index 5dd3e4e01b10..25c8ce54a976 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -5935,7 +5935,7 @@ static int get_fw_boot_info(struct scsi_qla_host *ha, uint16_t ddb_index[])
+ val = rd_nvram_byte(ha, sec_addr);
+ if (val & BIT_7)
+ ddb_index[1] = (val & 0x7f);
+-
++ goto exit_boot_info;
+ } else if (is_qla80XX(ha)) {
+ buf = dma_alloc_coherent(&ha->pdev->dev, size,
+ &buf_dma, GFP_KERNEL);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index e925eda93191..77cb45ef55fc 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2605,7 +2605,6 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer)
+ int res;
+ struct scsi_device *sdp = sdkp->device;
+ struct scsi_mode_data data;
+- int disk_ro = get_disk_ro(sdkp->disk);
+ int old_wp = sdkp->write_prot;
+
+ set_disk_ro(sdkp->disk, 0);
+@@ -2646,7 +2645,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer)
+ "Test WP failed, assume Write Enabled\n");
+ } else {
+ sdkp->write_prot = ((data.device_specific & 0x80) != 0);
+- set_disk_ro(sdkp->disk, sdkp->write_prot || disk_ro);
++ set_disk_ro(sdkp->disk, sdkp->write_prot);
+ if (sdkp->first_scan || old_wp != sdkp->write_prot) {
+ sd_printk(KERN_NOTICE, sdkp, "Write Protect is %s\n",
+ sdkp->write_prot ? "on" : "off");
+diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c
+index 452e19f8fb47..c2cee73a8560 100644
+--- a/drivers/scsi/ufs/ufs-hisi.c
++++ b/drivers/scsi/ufs/ufs-hisi.c
+@@ -544,6 +544,10 @@ static int ufs_hisi_init_common(struct ufs_hba *hba)
+ ufshcd_set_variant(hba, host);
+
+ host->rst = devm_reset_control_get(dev, "rst");
++ if (IS_ERR(host->rst)) {
++ dev_err(dev, "%s: failed to get reset control\n", __func__);
++ return PTR_ERR(host->rst);
++ }
+
+ ufs_hisi_set_pm_lvl(hba);
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 6e80dfe4fa97..3183fa8c5857 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -6130,19 +6130,19 @@ static u32 ufshcd_find_max_sup_active_icc_level(struct ufs_hba *hba,
+ goto out;
+ }
+
+- if (hba->vreg_info.vcc)
++ if (hba->vreg_info.vcc && hba->vreg_info.vcc->max_uA)
+ icc_level = ufshcd_get_max_icc_level(
+ hba->vreg_info.vcc->max_uA,
+ POWER_DESC_MAX_ACTV_ICC_LVLS - 1,
+ &desc_buf[PWR_DESC_ACTIVE_LVLS_VCC_0]);
+
+- if (hba->vreg_info.vccq)
++ if (hba->vreg_info.vccq && hba->vreg_info.vccq->max_uA)
+ icc_level = ufshcd_get_max_icc_level(
+ hba->vreg_info.vccq->max_uA,
+ icc_level,
+ &desc_buf[PWR_DESC_ACTIVE_LVLS_VCCQ_0]);
+
+- if (hba->vreg_info.vccq2)
++ if (hba->vreg_info.vccq2 && hba->vreg_info.vccq2->max_uA)
+ icc_level = ufshcd_get_max_icc_level(
+ hba->vreg_info.vccq2->max_uA,
+ icc_level,
+@@ -6767,6 +6767,15 @@ static int ufshcd_config_vreg_load(struct device *dev, struct ufs_vreg *vreg,
+ if (!vreg)
+ return 0;
+
++ /*
++ * "set_load" operation shall be required on those regulators
++ * which specifically configured current limitation. Otherwise
++ * zero max_uA may cause unexpected behavior when regulator is
++ * enabled or set as high power mode.
++ */
++ if (!vreg->max_uA)
++ return 0;
++
+ ret = regulator_set_load(vreg->reg, ua);
+ if (ret < 0) {
+ dev_err(dev, "%s: %s set load (ua=%d) failed, err=%d\n",
+@@ -6813,12 +6822,15 @@ static int ufshcd_config_vreg(struct device *dev,
+ name = vreg->name;
+
+ if (regulator_count_voltages(reg) > 0) {
+- min_uV = on ? vreg->min_uV : 0;
+- ret = regulator_set_voltage(reg, min_uV, vreg->max_uV);
+- if (ret) {
+- dev_err(dev, "%s: %s set voltage failed, err=%d\n",
++ if (vreg->min_uV && vreg->max_uV) {
++ min_uV = on ? vreg->min_uV : 0;
++ ret = regulator_set_voltage(reg, min_uV, vreg->max_uV);
++ if (ret) {
++ dev_err(dev,
++ "%s: %s set voltage failed, err=%d\n",
+ __func__, name, ret);
+- goto out;
++ goto out;
++ }
+ }
+
+ uA_load = on ? vreg->max_uA : 0;
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 14a9d18306cb..f63d1b8a0933 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1331,6 +1331,10 @@ static int of_qcom_slim_ngd_register(struct device *parent,
+ return -ENOMEM;
+
+ ngd->pdev = platform_device_alloc(QCOM_SLIM_NGD_DRV_NAME, id);
++ if (!ngd->pdev) {
++ kfree(ngd);
++ return -ENOMEM;
++ }
+ ngd->id = id;
+ ngd->pdev->dev.parent = parent;
+ ngd->pdev->driver_override = QCOM_SLIM_NGD_DRV_NAME;
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 08dd3a31a3e5..5b6f3655c366 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -1427,7 +1427,7 @@ static int spi_imx_transfer(struct spi_device *spi,
+
+ /* flush rxfifo before transfer */
+ while (spi_imx->devtype_data->rx_available(spi_imx))
+- spi_imx->rx(spi_imx);
++ readl(spi_imx->base + MXC_CSPIRXDATA);
+
+ if (spi_imx->slave_mode)
+ return spi_imx_pio_transfer_slave(spi, transfer);
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index b624f6fb04ce..729be74621e3 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -876,10 +876,14 @@ static unsigned int ssp_get_clk_div(struct driver_data *drv_data, int rate)
+
+ rate = min_t(int, ssp_clk, rate);
+
++ /*
++ * Calculate the divisor for the SCR (Serial Clock Rate), avoiding
++ * that the SSP transmission rate can be greater than the device rate
++ */
+ if (ssp->type == PXA25x_SSP || ssp->type == CE4100_SSP)
+- return (ssp_clk / (2 * rate) - 1) & 0xff;
++ return (DIV_ROUND_UP(ssp_clk, 2 * rate) - 1) & 0xff;
+ else
+- return (ssp_clk / rate - 1) & 0xfff;
++ return (DIV_ROUND_UP(ssp_clk, rate) - 1) & 0xfff;
+ }
+
+ static unsigned int pxa2xx_ssp_get_clk_div(struct driver_data *drv_data,
+diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
+index b37de1d991d6..d61120822f02 100644
+--- a/drivers/spi/spi-rspi.c
++++ b/drivers/spi/spi-rspi.c
+@@ -279,7 +279,8 @@ static int rspi_set_config_register(struct rspi_data *rspi, int access_size)
+ /* Sets parity, interrupt mask */
+ rspi_write8(rspi, 0x00, RSPI_SPCR2);
+
+- /* Sets SPCMD */
++ /* Resets sequencer */
++ rspi_write8(rspi, 0, RSPI_SPSCR);
+ rspi->spcmd |= SPCMD_SPB_8_TO_16(access_size);
+ rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0);
+
+@@ -323,7 +324,8 @@ static int rspi_rz_set_config_register(struct rspi_data *rspi, int access_size)
+ rspi_write8(rspi, 0x00, RSPI_SSLND);
+ rspi_write8(rspi, 0x00, RSPI_SPND);
+
+- /* Sets SPCMD */
++ /* Resets sequencer */
++ rspi_write8(rspi, 0, RSPI_SPSCR);
+ rspi->spcmd |= SPCMD_SPB_8_TO_16(access_size);
+ rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0);
+
+@@ -374,7 +376,8 @@ static int qspi_set_config_register(struct rspi_data *rspi, int access_size)
+ /* Sets buffer to allow normal operation */
+ rspi_write8(rspi, 0x00, QSPI_SPBFCR);
+
+- /* Sets SPCMD */
++ /* Resets sequencer */
++ rspi_write8(rspi, 0, RSPI_SPSCR);
+ rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0);
+
+ /* Sets RSPI mode */
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index a76acedd7e2f..a1888dc6a938 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -1067,27 +1067,19 @@ static int tegra_spi_probe(struct platform_device *pdev)
+
+ spi_irq = platform_get_irq(pdev, 0);
+ tspi->irq = spi_irq;
+- ret = request_threaded_irq(tspi->irq, tegra_spi_isr,
+- tegra_spi_isr_thread, IRQF_ONESHOT,
+- dev_name(&pdev->dev), tspi);
+- if (ret < 0) {
+- dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n",
+- tspi->irq);
+- goto exit_free_master;
+- }
+
+ tspi->clk = devm_clk_get(&pdev->dev, "spi");
+ if (IS_ERR(tspi->clk)) {
+ dev_err(&pdev->dev, "can not get clock\n");
+ ret = PTR_ERR(tspi->clk);
+- goto exit_free_irq;
++ goto exit_free_master;
+ }
+
+ tspi->rst = devm_reset_control_get_exclusive(&pdev->dev, "spi");
+ if (IS_ERR(tspi->rst)) {
+ dev_err(&pdev->dev, "can not get reset\n");
+ ret = PTR_ERR(tspi->rst);
+- goto exit_free_irq;
++ goto exit_free_master;
+ }
+
+ tspi->max_buf_size = SPI_FIFO_DEPTH << 2;
+@@ -1095,7 +1087,7 @@ static int tegra_spi_probe(struct platform_device *pdev)
+
+ ret = tegra_spi_init_dma_param(tspi, true);
+ if (ret < 0)
+- goto exit_free_irq;
++ goto exit_free_master;
+ ret = tegra_spi_init_dma_param(tspi, false);
+ if (ret < 0)
+ goto exit_rx_dma_free;
+@@ -1117,18 +1109,32 @@ static int tegra_spi_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "pm runtime get failed, e = %d\n", ret);
+ goto exit_pm_disable;
+ }
++
++ reset_control_assert(tspi->rst);
++ udelay(2);
++ reset_control_deassert(tspi->rst);
+ tspi->def_command1_reg = SPI_M_S;
+ tegra_spi_writel(tspi, tspi->def_command1_reg, SPI_COMMAND1);
+ pm_runtime_put(&pdev->dev);
++ ret = request_threaded_irq(tspi->irq, tegra_spi_isr,
++ tegra_spi_isr_thread, IRQF_ONESHOT,
++ dev_name(&pdev->dev), tspi);
++ if (ret < 0) {
++ dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n",
++ tspi->irq);
++ goto exit_pm_disable;
++ }
+
+ master->dev.of_node = pdev->dev.of_node;
+ ret = devm_spi_register_master(&pdev->dev, master);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "can not register to master err %d\n", ret);
+- goto exit_pm_disable;
++ goto exit_free_irq;
+ }
+ return ret;
+
++exit_free_irq:
++ free_irq(spi_irq, tspi);
+ exit_pm_disable:
+ pm_runtime_disable(&pdev->dev);
+ if (!pm_runtime_status_suspended(&pdev->dev))
+@@ -1136,8 +1142,6 @@ exit_pm_disable:
+ tegra_spi_deinit_dma_param(tspi, false);
+ exit_rx_dma_free:
+ tegra_spi_deinit_dma_param(tspi, true);
+-exit_free_irq:
+- free_irq(spi_irq, tspi);
+ exit_free_master:
+ spi_master_put(master);
+ return ret;
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index 97d137591b18..4389ab80c23e 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -1294,18 +1294,27 @@ static void pch_free_dma_buf(struct pch_spi_board_data *board_dat,
+ dma->rx_buf_virt, dma->rx_buf_dma);
+ }
+
+-static void pch_alloc_dma_buf(struct pch_spi_board_data *board_dat,
++static int pch_alloc_dma_buf(struct pch_spi_board_data *board_dat,
+ struct pch_spi_data *data)
+ {
+ struct pch_spi_dma_ctrl *dma;
++ int ret;
+
+ dma = &data->dma;
++ ret = 0;
+ /* Get Consistent memory for Tx DMA */
+ dma->tx_buf_virt = dma_alloc_coherent(&board_dat->pdev->dev,
+ PCH_BUF_SIZE, &dma->tx_buf_dma, GFP_KERNEL);
++ if (!dma->tx_buf_virt)
++ ret = -ENOMEM;
++
+ /* Get Consistent memory for Rx DMA */
+ dma->rx_buf_virt = dma_alloc_coherent(&board_dat->pdev->dev,
+ PCH_BUF_SIZE, &dma->rx_buf_dma, GFP_KERNEL);
++ if (!dma->rx_buf_virt)
++ ret = -ENOMEM;
++
++ return ret;
+ }
+
+ static int pch_spi_pd_probe(struct platform_device *plat_dev)
+@@ -1382,7 +1391,9 @@ static int pch_spi_pd_probe(struct platform_device *plat_dev)
+
+ if (use_dma) {
+ dev_info(&plat_dev->dev, "Use DMA for data transfers\n");
+- pch_alloc_dma_buf(board_dat, data);
++ ret = pch_alloc_dma_buf(board_dat, data);
++ if (ret)
++ goto err_spi_register_master;
+ }
+
+ ret = spi_register_master(master);
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 9da0bc5a036c..88a8a8edd44b 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -982,6 +982,8 @@ static int spi_map_msg(struct spi_controller *ctlr, struct spi_message *msg)
+ if (max_tx || max_rx) {
+ list_for_each_entry(xfer, &msg->transfers,
+ transfer_list) {
++ if (!xfer->len)
++ continue;
+ if (!xfer->tx_buf)
+ xfer->tx_buf = ctlr->dummy_tx;
+ if (!xfer->rx_buf)
+diff --git a/drivers/ssb/bridge_pcmcia_80211.c b/drivers/ssb/bridge_pcmcia_80211.c
+index f51f150307df..ffa379efff83 100644
+--- a/drivers/ssb/bridge_pcmcia_80211.c
++++ b/drivers/ssb/bridge_pcmcia_80211.c
+@@ -113,16 +113,21 @@ static struct pcmcia_driver ssb_host_pcmcia_driver = {
+ .resume = ssb_host_pcmcia_resume,
+ };
+
++static int pcmcia_init_failed;
++
+ /*
+ * These are not module init/exit functions!
+ * The module_pcmcia_driver() helper cannot be used here.
+ */
+ int ssb_host_pcmcia_init(void)
+ {
+- return pcmcia_register_driver(&ssb_host_pcmcia_driver);
++ pcmcia_init_failed = pcmcia_register_driver(&ssb_host_pcmcia_driver);
++
++ return pcmcia_init_failed;
+ }
+
+ void ssb_host_pcmcia_exit(void)
+ {
+- pcmcia_unregister_driver(&ssb_host_pcmcia_driver);
++ if (!pcmcia_init_failed)
++ pcmcia_unregister_driver(&ssb_host_pcmcia_driver);
+ }
+diff --git a/drivers/staging/media/davinci_vpfe/Kconfig b/drivers/staging/media/davinci_vpfe/Kconfig
+index aea449a8dbf8..76818cc48ddc 100644
+--- a/drivers/staging/media/davinci_vpfe/Kconfig
++++ b/drivers/staging/media/davinci_vpfe/Kconfig
+@@ -1,7 +1,7 @@
+ config VIDEO_DM365_VPFE
+ tristate "DM365 VPFE Media Controller Capture Driver"
+ depends on VIDEO_V4L2
+- depends on (ARCH_DAVINCI_DM365 && !VIDEO_DM365_ISIF) || COMPILE_TEST
++ depends on (ARCH_DAVINCI_DM365 && !VIDEO_DM365_ISIF) || (COMPILE_TEST && !ARCH_OMAP1)
+ depends on VIDEO_V4L2_SUBDEV_API
+ depends on VIDEO_DAVINCI_VPBE_DISPLAY
+ select VIDEOBUF2_DMA_CONTIG
+diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+index e76720903064..c7c8ef67b67f 100644
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+@@ -208,6 +208,9 @@ vchiq_platform_init_state(VCHIQ_STATE_T *state)
+ struct vchiq_2835_state *platform_state;
+
+ state->platform_state = kzalloc(sizeof(*platform_state), GFP_KERNEL);
++ if (!state->platform_state)
++ return VCHIQ_ERROR;
++
+ platform_state = (struct vchiq_2835_state *)state->platform_state;
+
+ platform_state->inited = 1;
+diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
+index 7642ced31436..63ce567eb6b7 100644
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c
+@@ -2537,6 +2537,8 @@ vchiq_init_state(VCHIQ_STATE_T *state, VCHIQ_SLOT_ZERO_T *slot_zero,
+ local->debug[DEBUG_ENTRIES] = DEBUG_MAX;
+
+ status = vchiq_platform_init_state(state);
++ if (status != VCHIQ_SUCCESS)
++ return VCHIQ_ERROR;
+
+ /*
+ bring up slot handler thread
+diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
+index 28fc4ce75edb..8490a1b6b615 100644
+--- a/drivers/thunderbolt/icm.c
++++ b/drivers/thunderbolt/icm.c
+@@ -476,6 +476,11 @@ static void add_switch(struct tb_switch *parent_sw, u64 route,
+ goto out;
+
+ sw->uuid = kmemdup(uuid, sizeof(*uuid), GFP_KERNEL);
++ if (!sw->uuid) {
++ tb_sw_warn(sw, "cannot allocate memory for switch\n");
++ tb_switch_put(sw);
++ goto out;
++ }
+ sw->connection_id = connection_id;
+ sw->connection_key = connection_key;
+ sw->link = link;
+diff --git a/drivers/thunderbolt/property.c b/drivers/thunderbolt/property.c
+index 8fe913a95b4a..be3f8b592b05 100644
+--- a/drivers/thunderbolt/property.c
++++ b/drivers/thunderbolt/property.c
+@@ -551,6 +551,11 @@ int tb_property_add_data(struct tb_property_dir *parent, const char *key,
+
+ property->length = size / 4;
+ property->value.data = kzalloc(size, GFP_KERNEL);
++ if (!property->value.data) {
++ kfree(property);
++ return -ENOMEM;
++ }
++
+ memcpy(property->value.data, buf, buflen);
+
+ list_add_tail(&property->list, &parent->properties);
+@@ -581,7 +586,12 @@ int tb_property_add_text(struct tb_property_dir *parent, const char *key,
+ return -ENOMEM;
+
+ property->length = size / 4;
+- property->value.data = kzalloc(size, GFP_KERNEL);
++ property->value.text = kzalloc(size, GFP_KERNEL);
++ if (!property->value.text) {
++ kfree(property);
++ return -ENOMEM;
++ }
++
+ strcpy(property->value.text, text);
+
+ list_add_tail(&property->list, &parent->properties);
+diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
+index dd9ae6f5d19c..bc7efa6e515d 100644
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -9,15 +9,13 @@
+ #include <linux/idr.h>
+ #include <linux/nvmem-provider.h>
+ #include <linux/pm_runtime.h>
++#include <linux/sched/signal.h>
+ #include <linux/sizes.h>
+ #include <linux/slab.h>
+ #include <linux/vmalloc.h>
+
+ #include "tb.h"
+
+-/* Switch authorization from userspace is serialized by this lock */
+-static DEFINE_MUTEX(switch_lock);
+-
+ /* Switch NVM support */
+
+ #define NVM_DEVID 0x05
+@@ -253,8 +251,8 @@ static int tb_switch_nvm_write(void *priv, unsigned int offset, void *val,
+ struct tb_switch *sw = priv;
+ int ret = 0;
+
+- if (mutex_lock_interruptible(&switch_lock))
+- return -ERESTARTSYS;
++ if (!mutex_trylock(&sw->tb->lock))
++ return restart_syscall();
+
+ /*
+ * Since writing the NVM image might require some special steps,
+@@ -274,7 +272,7 @@ static int tb_switch_nvm_write(void *priv, unsigned int offset, void *val,
+ memcpy(sw->nvm->buf + offset, val, bytes);
+
+ unlock:
+- mutex_unlock(&switch_lock);
++ mutex_unlock(&sw->tb->lock);
+
+ return ret;
+ }
+@@ -363,10 +361,7 @@ static int tb_switch_nvm_add(struct tb_switch *sw)
+ }
+ nvm->non_active = nvm_dev;
+
+- mutex_lock(&switch_lock);
+ sw->nvm = nvm;
+- mutex_unlock(&switch_lock);
+-
+ return 0;
+
+ err_nvm_active:
+@@ -383,10 +378,8 @@ static void tb_switch_nvm_remove(struct tb_switch *sw)
+ {
+ struct tb_switch_nvm *nvm;
+
+- mutex_lock(&switch_lock);
+ nvm = sw->nvm;
+ sw->nvm = NULL;
+- mutex_unlock(&switch_lock);
+
+ if (!nvm)
+ return;
+@@ -717,8 +710,8 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val)
+ {
+ int ret = -EINVAL;
+
+- if (mutex_lock_interruptible(&switch_lock))
+- return -ERESTARTSYS;
++ if (!mutex_trylock(&sw->tb->lock))
++ return restart_syscall();
+
+ if (sw->authorized)
+ goto unlock;
+@@ -761,7 +754,7 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val)
+ }
+
+ unlock:
+- mutex_unlock(&switch_lock);
++ mutex_unlock(&sw->tb->lock);
+ return ret;
+ }
+
+@@ -818,15 +811,15 @@ static ssize_t key_show(struct device *dev, struct device_attribute *attr,
+ struct tb_switch *sw = tb_to_switch(dev);
+ ssize_t ret;
+
+- if (mutex_lock_interruptible(&switch_lock))
+- return -ERESTARTSYS;
++ if (!mutex_trylock(&sw->tb->lock))
++ return restart_syscall();
+
+ if (sw->key)
+ ret = sprintf(buf, "%*phN\n", TB_SWITCH_KEY_SIZE, sw->key);
+ else
+ ret = sprintf(buf, "\n");
+
+- mutex_unlock(&switch_lock);
++ mutex_unlock(&sw->tb->lock);
+ return ret;
+ }
+
+@@ -843,8 +836,8 @@ static ssize_t key_store(struct device *dev, struct device_attribute *attr,
+ else if (hex2bin(key, buf, sizeof(key)))
+ return -EINVAL;
+
+- if (mutex_lock_interruptible(&switch_lock))
+- return -ERESTARTSYS;
++ if (!mutex_trylock(&sw->tb->lock))
++ return restart_syscall();
+
+ if (sw->authorized) {
+ ret = -EBUSY;
+@@ -859,7 +852,7 @@ static ssize_t key_store(struct device *dev, struct device_attribute *attr,
+ }
+ }
+
+- mutex_unlock(&switch_lock);
++ mutex_unlock(&sw->tb->lock);
+ return ret;
+ }
+ static DEVICE_ATTR(key, 0600, key_show, key_store);
+@@ -905,8 +898,8 @@ static ssize_t nvm_authenticate_store(struct device *dev,
+ bool val;
+ int ret;
+
+- if (mutex_lock_interruptible(&switch_lock))
+- return -ERESTARTSYS;
++ if (!mutex_trylock(&sw->tb->lock))
++ return restart_syscall();
+
+ /* If NVMem devices are not yet added */
+ if (!sw->nvm) {
+@@ -954,7 +947,7 @@ static ssize_t nvm_authenticate_store(struct device *dev,
+ }
+
+ exit_unlock:
+- mutex_unlock(&switch_lock);
++ mutex_unlock(&sw->tb->lock);
+
+ if (ret)
+ return ret;
+@@ -968,8 +961,8 @@ static ssize_t nvm_version_show(struct device *dev,
+ struct tb_switch *sw = tb_to_switch(dev);
+ int ret;
+
+- if (mutex_lock_interruptible(&switch_lock))
+- return -ERESTARTSYS;
++ if (!mutex_trylock(&sw->tb->lock))
++ return restart_syscall();
+
+ if (sw->safe_mode)
+ ret = -ENODATA;
+@@ -978,7 +971,7 @@ static ssize_t nvm_version_show(struct device *dev,
+ else
+ ret = sprintf(buf, "%x.%x\n", sw->nvm->major, sw->nvm->minor);
+
+- mutex_unlock(&switch_lock);
++ mutex_unlock(&sw->tb->lock);
+
+ return ret;
+ }
+@@ -1296,13 +1289,14 @@ int tb_switch_configure(struct tb_switch *sw)
+ return tb_plug_events_active(sw, true);
+ }
+
+-static void tb_switch_set_uuid(struct tb_switch *sw)
++static int tb_switch_set_uuid(struct tb_switch *sw)
+ {
+ u32 uuid[4];
+- int cap;
++ int cap, ret;
+
++ ret = 0;
+ if (sw->uuid)
+- return;
++ return ret;
+
+ /*
+ * The newer controllers include fused UUID as part of link
+@@ -1310,7 +1304,9 @@ static void tb_switch_set_uuid(struct tb_switch *sw)
+ */
+ cap = tb_switch_find_vse_cap(sw, TB_VSE_CAP_LINK_CONTROLLER);
+ if (cap > 0) {
+- tb_sw_read(sw, uuid, TB_CFG_SWITCH, cap + 3, 4);
++ ret = tb_sw_read(sw, uuid, TB_CFG_SWITCH, cap + 3, 4);
++ if (ret)
++ return ret;
+ } else {
+ /*
+ * ICM generates UUID based on UID and fills the upper
+@@ -1325,6 +1321,9 @@ static void tb_switch_set_uuid(struct tb_switch *sw)
+ }
+
+ sw->uuid = kmemdup(uuid, sizeof(uuid), GFP_KERNEL);
++ if (!sw->uuid)
++ ret = -ENOMEM;
++ return ret;
+ }
+
+ static int tb_switch_add_dma_port(struct tb_switch *sw)
+@@ -1374,7 +1373,9 @@ static int tb_switch_add_dma_port(struct tb_switch *sw)
+
+ if (status) {
+ tb_sw_info(sw, "switch flash authentication failed\n");
+- tb_switch_set_uuid(sw);
++ ret = tb_switch_set_uuid(sw);
++ if (ret)
++ return ret;
+ nvm_set_auth_status(sw, status);
+ }
+
+@@ -1424,7 +1425,9 @@ int tb_switch_add(struct tb_switch *sw)
+ }
+ tb_sw_info(sw, "uid: %#llx\n", sw->uid);
+
+- tb_switch_set_uuid(sw);
++ ret = tb_switch_set_uuid(sw);
++ if (ret)
++ return ret;
+
+ for (i = 0; i <= sw->config.max_port_number; i++) {
+ if (sw->ports[i].disabled) {
+diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h
+index 5067d69d0501..7a0ee9836a8a 100644
+--- a/drivers/thunderbolt/tb.h
++++ b/drivers/thunderbolt/tb.h
+@@ -79,8 +79,7 @@ struct tb_switch_nvm {
+ * @depth: Depth in the chain this switch is connected (ICM only)
+ *
+ * When the switch is being added or removed to the domain (other
+- * switches) you need to have domain lock held. For switch authorization
+- * internal switch_lock is enough.
++ * switches) you need to have domain lock held.
+ */
+ struct tb_switch {
+ struct device dev;
+diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c
+index db8bece63327..befe75490697 100644
+--- a/drivers/thunderbolt/xdomain.c
++++ b/drivers/thunderbolt/xdomain.c
+@@ -743,6 +743,7 @@ static void enumerate_services(struct tb_xdomain *xd)
+ struct tb_service *svc;
+ struct tb_property *p;
+ struct device *dev;
++ int id;
+
+ /*
+ * First remove all services that are not available anymore in
+@@ -771,7 +772,12 @@ static void enumerate_services(struct tb_xdomain *xd)
+ break;
+ }
+
+- svc->id = ida_simple_get(&xd->service_ids, 0, 0, GFP_KERNEL);
++ id = ida_simple_get(&xd->service_ids, 0, 0, GFP_KERNEL);
++ if (id < 0) {
++ kfree(svc);
++ break;
++ }
++ svc->id = id;
+ svc->dev.bus = &tb_bus_type;
+ svc->dev.type = &tb_service_type;
+ svc->dev.parent = &xd->dev;
+diff --git a/drivers/tty/ipwireless/main.c b/drivers/tty/ipwireless/main.c
+index 3475e841ef5c..4c18bbfe1a92 100644
+--- a/drivers/tty/ipwireless/main.c
++++ b/drivers/tty/ipwireless/main.c
+@@ -114,6 +114,10 @@ static int ipwireless_probe(struct pcmcia_device *p_dev, void *priv_data)
+
+ ipw->common_memory = ioremap(p_dev->resource[2]->start,
+ resource_size(p_dev->resource[2]));
++ if (!ipw->common_memory) {
++ ret = -ENOMEM;
++ goto exit1;
++ }
+ if (!request_mem_region(p_dev->resource[2]->start,
+ resource_size(p_dev->resource[2]),
+ IPWIRELESS_PCCARD_NAME)) {
+@@ -134,6 +138,10 @@ static int ipwireless_probe(struct pcmcia_device *p_dev, void *priv_data)
+
+ ipw->attr_memory = ioremap(p_dev->resource[3]->start,
+ resource_size(p_dev->resource[3]));
++ if (!ipw->attr_memory) {
++ ret = -ENOMEM;
++ goto exit3;
++ }
+ if (!request_mem_region(p_dev->resource[3]->start,
+ resource_size(p_dev->resource[3]),
+ IPWIRELESS_PCCARD_NAME)) {
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 1c21955fe7c0..b82a7d787add 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -3017,6 +3017,9 @@ usb_hcd_platform_shutdown(struct platform_device *dev)
+ {
+ struct usb_hcd *hcd = platform_get_drvdata(dev);
+
++ /* No need for pm_runtime_put(), we're shutting down */
++ pm_runtime_get_sync(&dev->dev);
++
+ if (hcd->driver->shutdown)
+ hcd->driver->shutdown(hcd);
+ }
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index bbcfa63d0233..eb24ec0e160d 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5823,7 +5823,10 @@ int usb_reset_device(struct usb_device *udev)
+ cintf->needs_binding = 1;
+ }
+ }
+- usb_unbind_and_rebind_marked_interfaces(udev);
++
++ /* If the reset failed, hub_wq will unbind drivers later */
++ if (ret == 0)
++ usb_unbind_and_rebind_marked_interfaces(udev);
+ }
+
+ usb_autosuspend_device(udev);
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 220c0f9b89b0..03614ef64ca4 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -675,13 +675,11 @@ static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep)
+ unsigned int maxsize;
+
+ if (is_isoc)
+- maxsize = hs_ep->dir_in ? DEV_DMA_ISOC_TX_NBYTES_LIMIT :
+- DEV_DMA_ISOC_RX_NBYTES_LIMIT;
++ maxsize = (hs_ep->dir_in ? DEV_DMA_ISOC_TX_NBYTES_LIMIT :
++ DEV_DMA_ISOC_RX_NBYTES_LIMIT) *
++ MAX_DMA_DESC_NUM_HS_ISOC;
+ else
+- maxsize = DEV_DMA_NBYTES_LIMIT;
+-
+- /* Above size of one descriptor was chosen, multiple it */
+- maxsize *= MAX_DMA_DESC_NUM_GENERIC;
++ maxsize = DEV_DMA_NBYTES_LIMIT * MAX_DMA_DESC_NUM_GENERIC;
+
+ return maxsize;
+ }
+@@ -864,7 +862,7 @@ static int dwc2_gadget_fill_isoc_desc(struct dwc2_hsotg_ep *hs_ep,
+
+ /* Update index of last configured entry in the chain */
+ hs_ep->next_desc++;
+- if (hs_ep->next_desc >= MAX_DMA_DESC_NUM_GENERIC)
++ if (hs_ep->next_desc >= MAX_DMA_DESC_NUM_HS_ISOC)
+ hs_ep->next_desc = 0;
+
+ return 0;
+@@ -896,7 +894,7 @@ static void dwc2_gadget_start_isoc_ddma(struct dwc2_hsotg_ep *hs_ep)
+ }
+
+ /* Initialize descriptor chain by Host Busy status */
+- for (i = 0; i < MAX_DMA_DESC_NUM_GENERIC; i++) {
++ for (i = 0; i < MAX_DMA_DESC_NUM_HS_ISOC; i++) {
+ desc = &hs_ep->desc_list[i];
+ desc->status = 0;
+ desc->status |= (DEV_DMA_BUFF_STS_HBUSY
+@@ -2083,7 +2081,7 @@ static void dwc2_gadget_complete_isoc_request_ddma(struct dwc2_hsotg_ep *hs_ep)
+ dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, 0);
+
+ hs_ep->compl_desc++;
+- if (hs_ep->compl_desc > (MAX_DMA_DESC_NUM_GENERIC - 1))
++ if (hs_ep->compl_desc > (MAX_DMA_DESC_NUM_HS_ISOC - 1))
+ hs_ep->compl_desc = 0;
+ desc_sts = hs_ep->desc_list[hs_ep->compl_desc].status;
+ }
+@@ -3779,6 +3777,7 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,
+ unsigned int i, val, size;
+ int ret = 0;
+ unsigned char ep_type;
++ int desc_num;
+
+ dev_dbg(hsotg->dev,
+ "%s: ep %s: a 0x%02x, attr 0x%02x, mps 0x%04x, intr %d\n",
+@@ -3825,11 +3824,15 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,
+ dev_dbg(hsotg->dev, "%s: read DxEPCTL=0x%08x from 0x%08x\n",
+ __func__, epctrl, epctrl_reg);
+
++ if (using_desc_dma(hsotg) && ep_type == USB_ENDPOINT_XFER_ISOC)
++ desc_num = MAX_DMA_DESC_NUM_HS_ISOC;
++ else
++ desc_num = MAX_DMA_DESC_NUM_GENERIC;
++
+ /* Allocate DMA descriptor chain for non-ctrl endpoints */
+ if (using_desc_dma(hsotg) && !hs_ep->desc_list) {
+ hs_ep->desc_list = dmam_alloc_coherent(hsotg->dev,
+- MAX_DMA_DESC_NUM_GENERIC *
+- sizeof(struct dwc2_dma_desc),
++ desc_num * sizeof(struct dwc2_dma_desc),
+ &hs_ep->desc_list_dma, GFP_ATOMIC);
+ if (!hs_ep->desc_list) {
+ ret = -ENOMEM;
+@@ -3971,7 +3974,7 @@ error1:
+
+ error2:
+ if (ret && using_desc_dma(hsotg) && hs_ep->desc_list) {
+- dmam_free_coherent(hsotg->dev, MAX_DMA_DESC_NUM_GENERIC *
++ dmam_free_coherent(hsotg->dev, desc_num *
+ sizeof(struct dwc2_dma_desc),
+ hs_ep->desc_list, hs_ep->desc_list_dma);
+ hs_ep->desc_list = NULL;
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 4d5c7dda8f54..05b9ccff7447 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1591,6 +1591,7 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
+ spin_lock_irqsave(&dwc->lock, flags);
+ dwc3_gadget_suspend(dwc);
+ spin_unlock_irqrestore(&dwc->lock, flags);
++ synchronize_irq(dwc->irq_gadget);
+ dwc3_core_exit(dwc);
+ break;
+ case DWC3_GCTL_PRTCAP_HOST:
+@@ -1623,6 +1624,7 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
+ spin_lock_irqsave(&dwc->lock, flags);
+ dwc3_gadget_suspend(dwc);
+ spin_unlock_irqrestore(&dwc->lock, flags);
++ synchronize_irq(dwc->irq_gadget);
+ }
+
+ dwc3_otg_exit(dwc);
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 524104eed8a7..65ba1038b111 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3277,8 +3277,6 @@ int dwc3_gadget_suspend(struct dwc3 *dwc)
+ dwc3_disconnect_gadget(dwc);
+ __dwc3_gadget_stop(dwc);
+
+- synchronize_irq(dwc->irq_gadget);
+-
+ return 0;
+ }
+
+diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c
+index 68a113594808..2811c4afde01 100644
+--- a/drivers/video/fbdev/core/fbcmap.c
++++ b/drivers/video/fbdev/core/fbcmap.c
+@@ -94,6 +94,8 @@ int fb_alloc_cmap_gfp(struct fb_cmap *cmap, int len, int transp, gfp_t flags)
+ int size = len * sizeof(u16);
+ int ret = -ENOMEM;
+
++ flags |= __GFP_NOWARN;
++
+ if (cmap->len != len) {
+ fb_dealloc_cmap(cmap);
+ if (!len)
+diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c
+index 283d9307df21..ac049871704d 100644
+--- a/drivers/video/fbdev/core/modedb.c
++++ b/drivers/video/fbdev/core/modedb.c
+@@ -935,6 +935,9 @@ void fb_var_to_videomode(struct fb_videomode *mode,
+ if (var->vmode & FB_VMODE_DOUBLE)
+ vtotal *= 2;
+
++ if (!htotal || !vtotal)
++ return;
++
+ hfreq = pixclock/htotal;
+ mode->refresh = hfreq/vtotal;
+ }
+diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
+index fd02e8a4841d..9f39f0c360e0 100644
+--- a/drivers/video/fbdev/efifb.c
++++ b/drivers/video/fbdev/efifb.c
+@@ -464,7 +464,8 @@ static int efifb_probe(struct platform_device *dev)
+ info->apertures->ranges[0].base = efifb_fix.smem_start;
+ info->apertures->ranges[0].size = size_remap;
+
+- if (!efi_mem_desc_lookup(efifb_fix.smem_start, &md)) {
++ if (efi_enabled(EFI_BOOT) &&
++ !efi_mem_desc_lookup(efifb_fix.smem_start, &md)) {
+ if ((efifb_fix.smem_start + efifb_fix.smem_len) >
+ (md.phys_addr + (md.num_pages << EFI_PAGE_SHIFT))) {
+ pr_err("efifb: video memory @ 0x%lx spans multiple EFI memory regions\n",
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index 2001910fd241..5a0d6fb02bbc 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -1659,7 +1659,7 @@ static int dlfb_usb_probe(struct usb_interface *intf,
+ dlfb = kzalloc(sizeof(*dlfb), GFP_KERNEL);
+ if (!dlfb) {
+ dev_err(&intf->dev, "%s: failed to allocate dlfb\n", __func__);
+- goto error;
++ return -ENOMEM;
+ }
+
+ INIT_LIST_HEAD(&dlfb->deferred_free);
+@@ -1769,7 +1769,7 @@ static int dlfb_usb_probe(struct usb_interface *intf,
+ error:
+ if (dlfb->info) {
+ dlfb_ops_destroy(dlfb->info);
+- } else if (dlfb) {
++ } else {
+ usb_put_dev(dlfb->udev);
+ kfree(dlfb);
+ }
+@@ -1796,12 +1796,10 @@ static void dlfb_usb_disconnect(struct usb_interface *intf)
+ /* this function will wait for all in-flight urbs to complete */
+ dlfb_free_urb_list(dlfb);
+
+- if (info) {
+- /* remove udlfb's sysfs interfaces */
+- for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++)
+- device_remove_file(info->dev, &fb_device_attrs[i]);
+- device_remove_bin_file(info->dev, &edid_attr);
+- }
++ /* remove udlfb's sysfs interfaces */
++ for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++)
++ device_remove_file(info->dev, &fb_device_attrs[i]);
++ device_remove_bin_file(info->dev, &edid_attr);
+
+ unregister_framebuffer(info);
+ }
+diff --git a/drivers/w1/w1_io.c b/drivers/w1/w1_io.c
+index 0364d3329c52..3516ce6718d9 100644
+--- a/drivers/w1/w1_io.c
++++ b/drivers/w1/w1_io.c
+@@ -432,8 +432,7 @@ int w1_reset_resume_command(struct w1_master *dev)
+ if (w1_reset_bus(dev))
+ return -1;
+
+- /* This will make only the last matched slave perform a skip ROM. */
+- w1_write_8(dev, W1_RESUME_CMD);
++ w1_write_8(dev, dev->slave_count > 1 ? W1_RESUME_CMD : W1_SKIP_ROM);
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(w1_reset_resume_command);
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 2a4f52c7be22..ac6c383d6314 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -710,7 +710,7 @@ out:
+ * read tree blocks and add keys where required.
+ */
+ static int add_missing_keys(struct btrfs_fs_info *fs_info,
+- struct preftrees *preftrees)
++ struct preftrees *preftrees, bool lock)
+ {
+ struct prelim_ref *ref;
+ struct extent_buffer *eb;
+@@ -735,12 +735,14 @@ static int add_missing_keys(struct btrfs_fs_info *fs_info,
+ free_extent_buffer(eb);
+ return -EIO;
+ }
+- btrfs_tree_read_lock(eb);
++ if (lock)
++ btrfs_tree_read_lock(eb);
+ if (btrfs_header_level(eb) == 0)
+ btrfs_item_key_to_cpu(eb, &ref->key_for_search, 0);
+ else
+ btrfs_node_key_to_cpu(eb, &ref->key_for_search, 0);
+- btrfs_tree_read_unlock(eb);
++ if (lock)
++ btrfs_tree_read_unlock(eb);
+ free_extent_buffer(eb);
+ prelim_ref_insert(fs_info, &preftrees->indirect, ref, NULL);
+ cond_resched();
+@@ -1225,7 +1227,7 @@ again:
+
+ btrfs_release_path(path);
+
+- ret = add_missing_keys(fs_info, &preftrees);
++ ret = add_missing_keys(fs_info, &preftrees, path->skip_locking == 0);
+ if (ret)
+ goto out;
+
+@@ -1286,11 +1288,14 @@ again:
+ ret = -EIO;
+ goto out;
+ }
+- btrfs_tree_read_lock(eb);
+- btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
++ if (!path->skip_locking) {
++ btrfs_tree_read_lock(eb);
++ btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
++ }
+ ret = find_extent_in_eb(eb, bytenr,
+ *extent_item_pos, &eie, ignore_offset);
+- btrfs_tree_read_unlock_blocking(eb);
++ if (!path->skip_locking)
++ btrfs_tree_read_unlock_blocking(eb);
+ free_extent_buffer(eb);
+ if (ret < 0)
+ goto out;
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 809c2c307c64..0cc800d22a08 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -3911,8 +3911,7 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags)
+ info->space_info_kobj, "%s",
+ alloc_name(space_info->flags));
+ if (ret) {
+- percpu_counter_destroy(&space_info->total_bytes_pinned);
+- kfree(space_info);
++ kobject_put(&space_info->kobj);
+ return ret;
+ }
+
+@@ -10789,9 +10788,9 @@ int btrfs_error_unpin_extent_range(struct btrfs_fs_info *fs_info,
+ * held back allocations.
+ */
+ static int btrfs_trim_free_extents(struct btrfs_device *device,
+- struct fstrim_range *range, u64 *trimmed)
++ u64 minlen, u64 *trimmed)
+ {
+- u64 start = range->start, len = 0;
++ u64 start = 0, len = 0;
+ int ret;
+
+ *trimmed = 0;
+@@ -10834,8 +10833,8 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ if (!trans)
+ up_read(&fs_info->commit_root_sem);
+
+- ret = find_free_dev_extent_start(trans, device, range->minlen,
+- start, &start, &len);
++ ret = find_free_dev_extent_start(trans, device, minlen, start,
++ &start, &len);
+ if (trans) {
+ up_read(&fs_info->commit_root_sem);
+ btrfs_put_transaction(trans);
+@@ -10848,16 +10847,6 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ break;
+ }
+
+- /* If we are out of the passed range break */
+- if (start > range->start + range->len - 1) {
+- mutex_unlock(&fs_info->chunk_mutex);
+- ret = 0;
+- break;
+- }
+-
+- start = max(range->start, start);
+- len = min(range->len, len);
+-
+ ret = btrfs_issue_discard(device->bdev, start, len, &bytes);
+ mutex_unlock(&fs_info->chunk_mutex);
+
+@@ -10867,10 +10856,6 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ start += len;
+ *trimmed += bytes;
+
+- /* We've trimmed enough */
+- if (*trimmed >= range->len)
+- break;
+-
+ if (fatal_signal_pending(current)) {
+ ret = -ERESTARTSYS;
+ break;
+@@ -10954,7 +10939,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+ devices = &fs_info->fs_devices->devices;
+ list_for_each_entry(device, devices, dev_list) {
+- ret = btrfs_trim_free_extents(device, range, &group_trimmed);
++ ret = btrfs_trim_free_extents(device, range->minlen,
++ &group_trimmed);
+ if (ret) {
+ dev_failed++;
+ dev_ret = ret;
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index ca4902c66dc4..e24c0a69ff5d 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -2058,6 +2058,18 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ int ret = 0, err;
+ u64 len;
+
++ /*
++ * If the inode needs a full sync, make sure we use a full range to
++ * avoid log tree corruption, due to hole detection racing with ordered
++ * extent completion for adjacent ranges, and assertion failures during
++ * hole detection.
++ */
++ if (test_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
++ &BTRFS_I(inode)->runtime_flags)) {
++ start = 0;
++ end = LLONG_MAX;
++ }
++
+ /*
+ * The range length can be represented by u64, we have to do the typecasts
+ * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync()
+@@ -2565,10 +2577,8 @@ static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
+
+ ret = btrfs_punch_hole_lock_range(inode, lockstart, lockend,
+ &cached_state);
+- if (ret) {
+- inode_unlock(inode);
++ if (ret)
+ goto out_only_mutex;
+- }
+
+ path = btrfs_alloc_path();
+ if (!path) {
+@@ -3151,6 +3161,7 @@ static long btrfs_fallocate(struct file *file, int mode,
+ ret = btrfs_qgroup_reserve_data(inode, &data_reserved,
+ cur_offset, last_byte - cur_offset);
+ if (ret < 0) {
++ cur_offset = last_byte;
+ free_extent_map(em);
+ break;
+ }
+@@ -3200,7 +3211,7 @@ out:
+ /* Let go of our reservation. */
+ if (ret != 0 && !(mode & FALLOC_FL_ZERO_RANGE))
+ btrfs_free_reserved_data_space(inode, data_reserved,
+- alloc_start, alloc_end - cur_offset);
++ cur_offset, alloc_end - cur_offset);
+ extent_changeset_free(data_reserved);
+ return ret;
+ }
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 0526b6c473c7..5d57ed629345 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -4289,27 +4289,36 @@ int btrfs_relocate_block_group(struct btrfs_fs_info *fs_info, u64 group_start)
+ mutex_lock(&fs_info->cleaner_mutex);
+ ret = relocate_block_group(rc);
+ mutex_unlock(&fs_info->cleaner_mutex);
+- if (ret < 0) {
++ if (ret < 0)
+ err = ret;
+- goto out;
+- }
+-
+- if (rc->extents_found == 0)
+- break;
+-
+- btrfs_info(fs_info, "found %llu extents", rc->extents_found);
+
++ /*
++ * We may have gotten ENOSPC after we already dirtied some
++ * extents. If writeout happens while we're relocating a
++ * different block group we could end up hitting the
++ * BUG_ON(rc->stage == UPDATE_DATA_PTRS) in
++ * btrfs_reloc_cow_block. Make sure we write everything out
++ * properly so we don't trip over this problem, and then break
++ * out of the loop if we hit an error.
++ */
+ if (rc->stage == MOVE_DATA_EXTENTS && rc->found_file_extent) {
+ ret = btrfs_wait_ordered_range(rc->data_inode, 0,
+ (u64)-1);
+- if (ret) {
++ if (ret)
+ err = ret;
+- goto out;
+- }
+ invalidate_mapping_pages(rc->data_inode->i_mapping,
+ 0, -1);
+ rc->stage = UPDATE_DATA_PTRS;
+ }
++
++ if (err < 0)
++ goto out;
++
++ if (rc->extents_found == 0)
++ break;
++
++ btrfs_info(fs_info, "found %llu extents", rc->extents_found);
++
+ }
+
+ WARN_ON(rc->block_group->pinned > 0);
+diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
+index 65bda0682928..3228d3b3084a 100644
+--- a/fs/btrfs/root-tree.c
++++ b/fs/btrfs/root-tree.c
+@@ -132,16 +132,17 @@ int btrfs_update_root(struct btrfs_trans_handle *trans, struct btrfs_root
+ return -ENOMEM;
+
+ ret = btrfs_search_slot(trans, root, key, path, 0, 1);
+- if (ret < 0) {
+- btrfs_abort_transaction(trans, ret);
++ if (ret < 0)
+ goto out;
+- }
+
+- if (ret != 0) {
+- btrfs_print_leaf(path->nodes[0]);
+- btrfs_crit(fs_info, "unable to update root key %llu %u %llu",
+- key->objectid, key->type, key->offset);
+- BUG_ON(1);
++ if (ret > 0) {
++ btrfs_crit(fs_info,
++ "unable to find root key (%llu %u %llu) in tree %llu",
++ key->objectid, key->type, key->offset,
++ root->root_key.objectid);
++ ret = -EUCLEAN;
++ btrfs_abort_transaction(trans, ret);
++ goto out;
+ }
+
+ l = path->nodes[0];
+diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
+index 3717c864ba23..aefb0169d46d 100644
+--- a/fs/btrfs/sysfs.c
++++ b/fs/btrfs/sysfs.c
+@@ -811,7 +811,12 @@ int btrfs_sysfs_add_fsid(struct btrfs_fs_devices *fs_devs,
+ fs_devs->fsid_kobj.kset = btrfs_kset;
+ error = kobject_init_and_add(&fs_devs->fsid_kobj,
+ &btrfs_ktype, parent, "%pU", fs_devs->fsid);
+- return error;
++ if (error) {
++ kobject_put(&fs_devs->fsid_kobj);
++ return error;
++ }
++
++ return 0;
+ }
+
+ int btrfs_sysfs_add_mounted(struct btrfs_fs_info *fs_info)
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 2f4f0958e5f2..75051d36dc1a 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -4121,6 +4121,7 @@ fill_holes:
+ *last_extent, 0,
+ 0, len, 0, len,
+ 0, 0, 0);
++ *last_extent += len;
+ }
+ }
+ }
+diff --git a/fs/char_dev.c b/fs/char_dev.c
+index a279c58fe360..8a63cfa29005 100644
+--- a/fs/char_dev.c
++++ b/fs/char_dev.c
+@@ -159,6 +159,12 @@ __register_chrdev_region(unsigned int major, unsigned int baseminor,
+ ret = -EBUSY;
+ goto out;
+ }
++
++ if (new_min < old_min && new_max > old_max) {
++ ret = -EBUSY;
++ goto out;
++ }
++
+ }
+
+ cd->next = *cp;
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 67e8aa35197e..05dc5a4ba481 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5596,25 +5596,22 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ up_write(&EXT4_I(inode)->i_data_sem);
+ ext4_journal_stop(handle);
+ if (error) {
+- if (orphan)
++ if (orphan && inode->i_nlink)
+ ext4_orphan_del(NULL, inode);
+ goto err_out;
+ }
+ }
+- if (!shrink)
++ if (!shrink) {
+ pagecache_isize_extended(inode, oldsize, inode->i_size);
+-
+- /*
+- * Blocks are going to be removed from the inode. Wait
+- * for dio in flight. Temporarily disable
+- * dioread_nolock to prevent livelock.
+- */
+- if (orphan) {
+- if (!ext4_should_journal_data(inode)) {
+- inode_dio_wait(inode);
+- } else
+- ext4_wait_for_tail_page_commit(inode);
++ } else {
++ /*
++ * Blocks are going to be removed from the inode. Wait
++ * for dio in flight.
++ */
++ inode_dio_wait(inode);
+ }
++ if (orphan && ext4_should_journal_data(inode))
++ ext4_wait_for_tail_page_commit(inode);
+ down_write(&EXT4_I(inode)->i_mmap_sem);
+
+ rc = ext4_break_layouts(inode);
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 08314fb42652..4d02e76b648a 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -197,12 +197,14 @@ struct block_device *f2fs_target_device(struct f2fs_sb_info *sbi,
+ struct block_device *bdev = sbi->sb->s_bdev;
+ int i;
+
+- for (i = 0; i < sbi->s_ndevs; i++) {
+- if (FDEV(i).start_blk <= blk_addr &&
+- FDEV(i).end_blk >= blk_addr) {
+- blk_addr -= FDEV(i).start_blk;
+- bdev = FDEV(i).bdev;
+- break;
++ if (f2fs_is_multi_device(sbi)) {
++ for (i = 0; i < sbi->s_ndevs; i++) {
++ if (FDEV(i).start_blk <= blk_addr &&
++ FDEV(i).end_blk >= blk_addr) {
++ blk_addr -= FDEV(i).start_blk;
++ bdev = FDEV(i).bdev;
++ break;
++ }
+ }
+ }
+ if (bio) {
+@@ -216,6 +218,9 @@ int f2fs_target_device_index(struct f2fs_sb_info *sbi, block_t blkaddr)
+ {
+ int i;
+
++ if (!f2fs_is_multi_device(sbi))
++ return 0;
++
+ for (i = 0; i < sbi->s_ndevs; i++)
+ if (FDEV(i).start_blk <= blkaddr && FDEV(i).end_blk >= blkaddr)
+ return i;
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 1f5d5f62bb77..a4b6eacf22ea 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -1336,6 +1336,17 @@ static inline bool time_to_inject(struct f2fs_sb_info *sbi, int type)
+ }
+ #endif
+
++/*
++ * Test if the mounted volume is a multi-device volume.
++ * - For a single regular disk volume, sbi->s_ndevs is 0.
++ * - For a single zoned disk volume, sbi->s_ndevs is 1.
++ * - For a multi-device volume, sbi->s_ndevs is always 2 or more.
++ */
++static inline bool f2fs_is_multi_device(struct f2fs_sb_info *sbi)
++{
++ return sbi->s_ndevs > 1;
++}
++
+ /* For write statistics. Suppose sector size is 512 bytes,
+ * and the return value is in kbytes. s is of struct f2fs_sb_info.
+ */
+@@ -3455,7 +3466,7 @@ static inline bool f2fs_force_buffered_io(struct inode *inode, int rw)
+ {
+ return (f2fs_post_read_required(inode) ||
+ (rw == WRITE && test_opt(F2FS_I_SB(inode), LFS)) ||
+- F2FS_I_SB(inode)->s_ndevs);
++ f2fs_is_multi_device(F2FS_I_SB(inode)));
+ }
+
+ #ifdef CONFIG_F2FS_FAULT_INJECTION
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index b3f46e3bec17..8d1eb8dec605 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2539,7 +2539,7 @@ static int f2fs_ioc_flush_device(struct file *filp, unsigned long arg)
+ sizeof(range)))
+ return -EFAULT;
+
+- if (sbi->s_ndevs <= 1 || sbi->s_ndevs - 1 <= range.dev_num ||
++ if (!f2fs_is_multi_device(sbi) || sbi->s_ndevs - 1 <= range.dev_num ||
+ sbi->segs_per_sec != 1) {
+ f2fs_msg(sbi->sb, KERN_WARNING,
+ "Can't flush %u in %d for segs_per_sec %u != 1\n",
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 5c8d00422237..d44b57a363ff 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -1256,7 +1256,7 @@ void f2fs_build_gc_manager(struct f2fs_sb_info *sbi)
+ sbi->gc_pin_file_threshold = DEF_GC_FAILED_PINNED_FILES;
+
+ /* give warm/cold data area from slower device */
+- if (sbi->s_ndevs && sbi->segs_per_sec == 1)
++ if (f2fs_is_multi_device(sbi) && sbi->segs_per_sec == 1)
+ SIT_I(sbi)->last_victim[ALLOC_NEXT] =
+ GET_SEGNO(sbi, FDEV(0).end_blk) + 1;
+ }
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index ac038563273d..03fa2c4d3d79 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -574,7 +574,7 @@ static int submit_flush_wait(struct f2fs_sb_info *sbi, nid_t ino)
+ int ret = 0;
+ int i;
+
+- if (!sbi->s_ndevs)
++ if (!f2fs_is_multi_device(sbi))
+ return __submit_flush_wait(sbi, sbi->sb->s_bdev);
+
+ for (i = 0; i < sbi->s_ndevs; i++) {
+@@ -640,7 +640,8 @@ int f2fs_issue_flush(struct f2fs_sb_info *sbi, nid_t ino)
+ return ret;
+ }
+
+- if (atomic_inc_return(&fcc->issing_flush) == 1 || sbi->s_ndevs > 1) {
++ if (atomic_inc_return(&fcc->issing_flush) == 1 ||
++ f2fs_is_multi_device(sbi)) {
+ ret = submit_flush_wait(sbi, ino);
+ atomic_dec(&fcc->issing_flush);
+
+@@ -746,7 +747,7 @@ int f2fs_flush_device_cache(struct f2fs_sb_info *sbi)
+ {
+ int ret = 0, i;
+
+- if (!sbi->s_ndevs)
++ if (!f2fs_is_multi_device(sbi))
+ return 0;
+
+ for (i = 1; i < sbi->s_ndevs; i++) {
+@@ -1289,7 +1290,7 @@ static int __queue_discard_cmd(struct f2fs_sb_info *sbi,
+
+ trace_f2fs_queue_discard(bdev, blkstart, blklen);
+
+- if (sbi->s_ndevs) {
++ if (f2fs_is_multi_device(sbi)) {
+ int devi = f2fs_target_device_index(sbi, blkstart);
+
+ blkstart -= FDEV(devi).start_blk;
+@@ -1638,7 +1639,7 @@ static int __f2fs_issue_discard_zone(struct f2fs_sb_info *sbi,
+ block_t lblkstart = blkstart;
+ int devi = 0;
+
+- if (sbi->s_ndevs) {
++ if (f2fs_is_multi_device(sbi)) {
+ devi = f2fs_target_device_index(sbi, blkstart);
+ blkstart -= FDEV(devi).start_blk;
+ }
+@@ -2971,7 +2972,7 @@ static void update_device_state(struct f2fs_io_info *fio)
+ struct f2fs_sb_info *sbi = fio->sbi;
+ unsigned int devidx;
+
+- if (!sbi->s_ndevs)
++ if (!f2fs_is_multi_device(sbi))
+ return;
+
+ devidx = f2fs_target_device_index(sbi, fio->new_blkaddr);
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 9d566e62684c..ccdd8c821abd 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -140,6 +140,7 @@ void gfs2_glock_free(struct gfs2_glock *gl)
+ {
+ struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+
++ BUG_ON(atomic_read(&gl->gl_revokes));
+ rhashtable_remove_fast(&gl_hash_table, &gl->gl_node, ht_parms);
+ smp_mb();
+ wake_up_glock(gl);
+@@ -183,15 +184,19 @@ static int demote_ok(const struct gfs2_glock *gl)
+
+ void gfs2_glock_add_to_lru(struct gfs2_glock *gl)
+ {
++ if (!(gl->gl_ops->go_flags & GLOF_LRU))
++ return;
++
+ spin_lock(&lru_lock);
+
+- if (!list_empty(&gl->gl_lru))
+- list_del_init(&gl->gl_lru);
+- else
++ list_del(&gl->gl_lru);
++ list_add_tail(&gl->gl_lru, &lru_list);
++
++ if (!test_bit(GLF_LRU, &gl->gl_flags)) {
++ set_bit(GLF_LRU, &gl->gl_flags);
+ atomic_inc(&lru_count);
++ }
+
+- list_add_tail(&gl->gl_lru, &lru_list);
+- set_bit(GLF_LRU, &gl->gl_flags);
+ spin_unlock(&lru_lock);
+ }
+
+@@ -201,7 +206,7 @@ static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
+ return;
+
+ spin_lock(&lru_lock);
+- if (!list_empty(&gl->gl_lru)) {
++ if (test_bit(GLF_LRU, &gl->gl_flags)) {
+ list_del_init(&gl->gl_lru);
+ atomic_dec(&lru_count);
+ clear_bit(GLF_LRU, &gl->gl_flags);
+@@ -1158,8 +1163,7 @@ void gfs2_glock_dq(struct gfs2_holder *gh)
+ !test_bit(GLF_DEMOTE, &gl->gl_flags))
+ fast_path = 1;
+ }
+- if (!test_bit(GLF_LFLUSH, &gl->gl_flags) && demote_ok(gl) &&
+- (glops->go_flags & GLOF_LRU))
++ if (!test_bit(GLF_LFLUSH, &gl->gl_flags) && demote_ok(gl))
+ gfs2_glock_add_to_lru(gl);
+
+ trace_gfs2_glock_queue(gh, 0);
+@@ -1455,6 +1459,7 @@ __acquires(&lru_lock)
+ if (!spin_trylock(&gl->gl_lockref.lock)) {
+ add_back_to_lru:
+ list_add(&gl->gl_lru, &lru_list);
++ set_bit(GLF_LRU, &gl->gl_flags);
+ atomic_inc(&lru_count);
+ continue;
+ }
+@@ -1462,7 +1467,6 @@ add_back_to_lru:
+ spin_unlock(&gl->gl_lockref.lock);
+ goto add_back_to_lru;
+ }
+- clear_bit(GLF_LRU, &gl->gl_flags);
+ gl->gl_lockref.count++;
+ if (demote_ok(gl))
+ handle_callback(gl, LM_ST_UNLOCKED, 0, false);
+@@ -1497,6 +1501,7 @@ static long gfs2_scan_glock_lru(int nr)
+ if (!test_bit(GLF_LOCK, &gl->gl_flags)) {
+ list_move(&gl->gl_lru, &dispose);
+ atomic_dec(&lru_count);
++ clear_bit(GLF_LRU, &gl->gl_flags);
+ freed++;
+ continue;
+ }
+diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
+index ac7caa267ed6..62edf8f5615f 100644
+--- a/fs/gfs2/lock_dlm.c
++++ b/fs/gfs2/lock_dlm.c
+@@ -31,9 +31,10 @@
+ * @delta is the difference between the current rtt sample and the
+ * running average srtt. We add 1/8 of that to the srtt in order to
+ * update the current srtt estimate. The variance estimate is a bit
+- * more complicated. We subtract the abs value of the @delta from
+- * the current variance estimate and add 1/4 of that to the running
+- * total.
++ * more complicated. We subtract the current variance estimate from
++ * the abs value of the @delta and add 1/4 of that to the running
++ * total. That's equivalent to 3/4 of the current variance
++ * estimate plus 1/4 of the abs of @delta.
+ *
+ * Note that the index points at the array entry containing the smoothed
+ * mean value, and the variance is always in the following entry
+@@ -49,7 +50,7 @@ static inline void gfs2_update_stats(struct gfs2_lkstats *s, unsigned index,
+ s64 delta = sample - s->stats[index];
+ s->stats[index] += (delta >> 3);
+ index++;
+- s->stats[index] += ((abs(delta) - s->stats[index]) >> 2);
++ s->stats[index] += (s64)(abs(delta) - s->stats[index]) >> 2;
+ }
+
+ /**
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index ee20ea42e7b5..cd85092723de 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -604,7 +604,8 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
+ bd->bd_bh = NULL;
+ bd->bd_ops = &gfs2_revoke_lops;
+ sdp->sd_log_num_revoke++;
+- atomic_inc(&gl->gl_revokes);
++ if (atomic_inc_return(&gl->gl_revokes) == 1)
++ gfs2_glock_hold(gl);
+ set_bit(GLF_LFLUSH, &gl->gl_flags);
+ list_add(&bd->bd_list, &sdp->sd_log_le_revoke);
+ }
+diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
+index f2567f958d00..8f99b395d7bf 100644
+--- a/fs/gfs2/lops.c
++++ b/fs/gfs2/lops.c
+@@ -662,8 +662,10 @@ static void revoke_lo_after_commit(struct gfs2_sbd *sdp, struct gfs2_trans *tr)
+ bd = list_entry(head->next, struct gfs2_bufdata, bd_list);
+ list_del_init(&bd->bd_list);
+ gl = bd->bd_gl;
+- atomic_dec(&gl->gl_revokes);
+- clear_bit(GLF_LFLUSH, &gl->gl_flags);
++ if (atomic_dec_return(&gl->gl_revokes) == 0) {
++ clear_bit(GLF_LFLUSH, &gl->gl_flags);
++ gfs2_glock_queue_put(gl);
++ }
+ kmem_cache_free(gfs2_bufdata_cachep, bd);
+ }
+ }
+diff --git a/fs/internal.h b/fs/internal.h
+index d410186bc369..d109665b9e50 100644
+--- a/fs/internal.h
++++ b/fs/internal.h
+@@ -80,9 +80,7 @@ extern int sb_prepare_remount_readonly(struct super_block *);
+
+ extern void __init mnt_init(void);
+
+-extern int __mnt_want_write(struct vfsmount *);
+ extern int __mnt_want_write_file(struct file *);
+-extern void __mnt_drop_write(struct vfsmount *);
+ extern void __mnt_drop_write_file(struct file *);
+
+ /*
+diff --git a/fs/nfs/client.c b/fs/nfs/client.c
+index 751ca65da8a3..c092661147b3 100644
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -290,6 +290,7 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *dat
+ struct nfs_client *clp;
+ const struct sockaddr *sap = data->addr;
+ struct nfs_net *nn = net_generic(data->net, nfs_net_id);
++ int error;
+
+ again:
+ list_for_each_entry(clp, &nn->nfs_client_list, cl_share_link) {
+@@ -302,9 +303,11 @@ again:
+ if (clp->cl_cons_state > NFS_CS_READY) {
+ refcount_inc(&clp->cl_count);
+ spin_unlock(&nn->nfs_client_lock);
+- nfs_wait_client_init_complete(clp);
++ error = nfs_wait_client_init_complete(clp);
+ nfs_put_client(clp);
+ spin_lock(&nn->nfs_client_lock);
++ if (error < 0)
++ return ERR_PTR(error);
+ goto again;
+ }
+
+@@ -413,6 +416,8 @@ struct nfs_client *nfs_get_client(const struct nfs_client_initdata *cl_init)
+ clp = nfs_match_client(cl_init);
+ if (clp) {
+ spin_unlock(&nn->nfs_client_lock);
++ if (IS_ERR(clp))
++ return clp;
+ if (new)
+ new->rpc_ops->free_client(new);
+ return nfs_found_client(cl_init, clp);
+diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
+index fed06fd9998d..94f98e190e63 100644
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -329,9 +329,6 @@ ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src,
+ };
+ ssize_t err, err2;
+
+- if (!nfs_server_capable(file_inode(dst), NFS_CAP_COPY))
+- return -EOPNOTSUPP;
+-
+ src_lock = nfs_get_lock_context(nfs_file_open_context(src));
+ if (IS_ERR(src_lock))
+ return PTR_ERR(src_lock);
+diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
+index 4288a6ecaf75..134858507268 100644
+--- a/fs/nfs/nfs4file.c
++++ b/fs/nfs/nfs4file.c
+@@ -133,15 +133,11 @@ static ssize_t nfs4_copy_file_range(struct file *file_in, loff_t pos_in,
+ struct file *file_out, loff_t pos_out,
+ size_t count, unsigned int flags)
+ {
+- ssize_t ret;
+-
++ if (!nfs_server_capable(file_inode(file_out), NFS_CAP_COPY))
++ return -EOPNOTSUPP;
+ if (file_inode(file_in) == file_inode(file_out))
+- return -EINVAL;
+-retry:
+- ret = nfs42_proc_copy(file_in, pos_in, file_out, pos_out, count);
+- if (ret == -EAGAIN)
+- goto retry;
+- return ret;
++ return -EOPNOTSUPP;
++ return nfs42_proc_copy(file_in, pos_in, file_out, pos_out, count);
+ }
+
+ static loff_t nfs4_file_llseek(struct file *filep, loff_t offset, int whence)
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index b2aadd3e1fec..336f04da80ed 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -260,7 +260,7 @@ static int ovl_instantiate(struct dentry *dentry, struct inode *inode,
+ * hashed directory inode aliases.
+ */
+ inode = ovl_get_inode(dentry->d_sb, &oip);
+- if (WARN_ON(IS_ERR(inode)))
++ if (IS_ERR(inode))
+ return PTR_ERR(inode);
+ } else {
+ WARN_ON(ovl_inode_real(inode) != d_inode(newdentry));
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index 3b7ed5d2279c..b48273e846ad 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -832,7 +832,7 @@ struct inode *ovl_get_inode(struct super_block *sb,
+ int fsid = bylower ? oip->lowerpath->layer->fsid : 0;
+ bool is_dir, metacopy = false;
+ unsigned long ino = 0;
+- int err = -ENOMEM;
++ int err = oip->newinode ? -EEXIST : -ENOMEM;
+
+ if (!realinode)
+ realinode = d_inode(lowerdentry);
+@@ -917,6 +917,7 @@ out:
+ return inode;
+
+ out_err:
++ pr_warn_ratelimited("overlayfs: failed to get inode (%i)\n", err);
+ inode = ERR_PTR(err);
+ goto out;
+ }
+diff --git a/include/drm/tinydrm/mipi-dbi.h b/include/drm/tinydrm/mipi-dbi.h
+index b8ba58861986..bcc98bd447f7 100644
+--- a/include/drm/tinydrm/mipi-dbi.h
++++ b/include/drm/tinydrm/mipi-dbi.h
+@@ -42,7 +42,7 @@ struct mipi_dbi {
+ struct spi_device *spi;
+ bool enabled;
+ struct mutex cmdlock;
+- int (*command)(struct mipi_dbi *mipi, u8 cmd, u8 *param, size_t num);
++ int (*command)(struct mipi_dbi *mipi, u8 *cmd, u8 *param, size_t num);
+ const u8 *read_commands;
+ struct gpio_desc *dc;
+ u16 *tx_buf;
+@@ -79,6 +79,7 @@ u32 mipi_dbi_spi_cmd_max_speed(struct spi_device *spi, size_t len);
+
+ int mipi_dbi_command_read(struct mipi_dbi *mipi, u8 cmd, u8 *val);
+ int mipi_dbi_command_buf(struct mipi_dbi *mipi, u8 cmd, u8 *data, size_t len);
++int mipi_dbi_command_stackbuf(struct mipi_dbi *mipi, u8 cmd, u8 *data, size_t len);
+ int mipi_dbi_buf_copy(void *dst, struct drm_framebuffer *fb,
+ struct drm_clip_rect *clip, bool swap);
+ /**
+@@ -96,7 +97,7 @@ int mipi_dbi_buf_copy(void *dst, struct drm_framebuffer *fb,
+ #define mipi_dbi_command(mipi, cmd, seq...) \
+ ({ \
+ u8 d[] = { seq }; \
+- mipi_dbi_command_buf(mipi, cmd, d, ARRAY_SIZE(d)); \
++ mipi_dbi_command_stackbuf(mipi, cmd, d, ARRAY_SIZE(d)); \
+ })
+
+ #ifdef CONFIG_DEBUG_FS
+diff --git a/include/linux/bio.h b/include/linux/bio.h
+index 51371740d2a8..c7433a201171 100644
+--- a/include/linux/bio.h
++++ b/include/linux/bio.h
+@@ -257,7 +257,7 @@ static inline void bio_cnt_set(struct bio *bio, unsigned int count)
+ {
+ if (count != 1) {
+ bio->bi_flags |= (1 << BIO_REFFED);
+- smp_mb__before_atomic();
++ smp_mb();
+ }
+ atomic_set(&bio->__bi_cnt, count);
+ }
+diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
+index 6002275937f5..a6090154b2ab 100644
+--- a/include/linux/cgroup-defs.h
++++ b/include/linux/cgroup-defs.h
+@@ -346,6 +346,11 @@ struct cgroup {
+ * Dying cgroups are cgroups which were deleted by a user,
+ * but are still existing because someone else is holding a reference.
+ * max_descendants is a maximum allowed number of descent cgroups.
++ *
++ * nr_descendants and nr_dying_descendants are protected
++ * by cgroup_mutex and css_set_lock. It's fine to read them holding
++ * any of cgroup_mutex and css_set_lock; for writing both locks
++ * should be held.
+ */
+ int nr_descendants;
+ int nr_dying_descendants;
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 037610845892..d52a7484aeb2 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -684,6 +684,7 @@ static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
+ static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
+ {
+ set_memory_ro((unsigned long)hdr, hdr->pages);
++ set_memory_x((unsigned long)hdr, hdr->pages);
+ }
+
+ static inline void bpf_jit_binary_unlock_ro(struct bpf_binary_header *hdr)
+@@ -836,6 +837,7 @@ bpf_run_sk_reuseport(struct sock_reuseport *reuse, struct sock *sk,
+ extern int bpf_jit_enable;
+ extern int bpf_jit_harden;
+ extern int bpf_jit_kallsyms;
++extern int bpf_jit_limit;
+
+ typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
+
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index f767293b00e6..f13272d84332 100644
+--- a/include/linux/genhd.h
++++ b/include/linux/genhd.h
+@@ -596,6 +596,7 @@ struct unixware_disklabel {
+
+ extern int blk_alloc_devt(struct hd_struct *part, dev_t *devt);
+ extern void blk_free_devt(dev_t devt);
++extern void blk_invalidate_devt(dev_t devt);
+ extern dev_t blk_lookup_devt(const char *name, int partno);
+ extern char *disk_name (struct gendisk *hd, int partno, char *buf);
+
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index d44a78362942..8b3e5e8a72fb 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -414,6 +414,7 @@ struct hid_global {
+
+ struct hid_local {
+ unsigned usage[HID_MAX_USAGES]; /* usage array */
++ u8 usage_size[HID_MAX_USAGES]; /* usage size array */
+ unsigned collection_index[HID_MAX_USAGES]; /* collection index array */
+ unsigned usage_index;
+ unsigned usage_minimum;
+diff --git a/include/linux/iio/adc/ad_sigma_delta.h b/include/linux/iio/adc/ad_sigma_delta.h
+index 730ead1a46df..57c122ae5452 100644
+--- a/include/linux/iio/adc/ad_sigma_delta.h
++++ b/include/linux/iio/adc/ad_sigma_delta.h
+@@ -66,6 +66,7 @@ struct ad_sigma_delta {
+ bool irq_dis;
+
+ bool bus_locked;
++ bool keep_cs_asserted;
+
+ uint8_t comm;
+
+diff --git a/include/linux/mount.h b/include/linux/mount.h
+index 45b1f56c6c2f..4b0db4418954 100644
+--- a/include/linux/mount.h
++++ b/include/linux/mount.h
+@@ -86,6 +86,8 @@ extern bool mnt_may_suid(struct vfsmount *mnt);
+
+ struct path;
+ extern struct vfsmount *clone_private_mount(const struct path *path);
++extern int __mnt_want_write(struct vfsmount *);
++extern void __mnt_drop_write(struct vfsmount *);
+
+ struct file_system_type;
+ extern struct vfsmount *vfs_kern_mount(struct file_system_type *type,
+diff --git a/include/linux/overflow.h b/include/linux/overflow.h
+index 40b48e2133cb..15eb85de9226 100644
+--- a/include/linux/overflow.h
++++ b/include/linux/overflow.h
+@@ -36,6 +36,12 @@
+ #define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T)))
+ #define type_min(T) ((T)((T)-type_max(T)-(T)1))
+
++/*
++ * Avoids triggering -Wtype-limits compilation warning,
++ * while using unsigned data types to check a < 0.
++ */
++#define is_non_negative(a) ((a) > 0 || (a) == 0)
++#define is_negative(a) (!(is_non_negative(a)))
+
+ #ifdef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW
+ /*
+@@ -227,10 +233,10 @@
+ typeof(d) _d = d; \
+ u64 _a_full = _a; \
+ unsigned int _to_shift = \
+- _s >= 0 && _s < 8 * sizeof(*d) ? _s : 0; \
++ is_non_negative(_s) && _s < 8 * sizeof(*d) ? _s : 0; \
+ *_d = (_a_full << _to_shift); \
+- (_to_shift != _s || *_d < 0 || _a < 0 || \
+- (*_d >> _to_shift) != _a); \
++ (_to_shift != _s || is_negative(*_d) || is_negative(_a) || \
++ (*_d >> _to_shift) != _a); \
+ })
+
+ /**
+diff --git a/include/linux/smpboot.h b/include/linux/smpboot.h
+index d0884b525001..9d1bc65d226c 100644
+--- a/include/linux/smpboot.h
++++ b/include/linux/smpboot.h
+@@ -29,7 +29,7 @@ struct smpboot_thread_data;
+ * @thread_comm: The base name of the thread
+ */
+ struct smp_hotplug_thread {
+- struct task_struct __percpu **store;
++ struct task_struct * __percpu *store;
+ struct list_head list;
+ int (*thread_should_run)(unsigned int cpu);
+ void (*thread_fn)(unsigned int cpu);
+diff --git a/include/linux/time64.h b/include/linux/time64.h
+index 05634afba0db..4a45aea0f96e 100644
+--- a/include/linux/time64.h
++++ b/include/linux/time64.h
+@@ -41,6 +41,17 @@ struct itimerspec64 {
+ #define KTIME_MAX ((s64)~((u64)1 << 63))
+ #define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)
+
++/*
++ * Limits for settimeofday():
++ *
++ * To prevent setting the time close to the wraparound point time setting
++ * is limited so a reasonable uptime can be accomodated. Uptime of 30 years
++ * should be really sufficient, which means the cutoff is 2232. At that
++ * point the cutoff is just a small part of the larger problem.
++ */
++#define TIME_UPTIME_SEC_MAX (30LL * 365 * 24 *3600)
++#define TIME_SETTOD_SEC_MAX (KTIME_SEC_MAX - TIME_UPTIME_SEC_MAX)
++
+ static inline int timespec64_equal(const struct timespec64 *a,
+ const struct timespec64 *b)
+ {
+@@ -108,6 +119,16 @@ static inline bool timespec64_valid_strict(const struct timespec64 *ts)
+ return true;
+ }
+
++static inline bool timespec64_valid_settod(const struct timespec64 *ts)
++{
++ if (!timespec64_valid(ts))
++ return false;
++ /* Disallow values which cause overflow issues vs. CLOCK_REALTIME */
++ if ((unsigned long long)ts->tv_sec >= TIME_SETTOD_SEC_MAX)
++ return false;
++ return true;
++}
++
+ /**
+ * timespec64_to_ns - Convert timespec64 to nanoseconds
+ * @ts: pointer to the timespec64 variable to be converted
+diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h
+index f6818f732f34..bddd86c11f5f 100644
+--- a/include/media/videobuf2-core.h
++++ b/include/media/videobuf2-core.h
+@@ -551,6 +551,7 @@ struct vb2_queue {
+ unsigned int start_streaming_called:1;
+ unsigned int error:1;
+ unsigned int waiting_for_buffers:1;
++ unsigned int waiting_in_dqbuf:1;
+ unsigned int is_multiplanar:1;
+ unsigned int is_output:1;
+ unsigned int copy_timestamp:1;
+diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
+index cdd9f1fe7cfa..845d947dbae8 100644
+--- a/include/net/bluetooth/hci.h
++++ b/include/net/bluetooth/hci.h
+@@ -270,6 +270,7 @@ enum {
+ HCI_FORCE_BREDR_SMP,
+ HCI_FORCE_STATIC_ADDR,
+ HCI_LL_RPA_RESOLUTION,
++ HCI_CMD_PENDING,
+
+ __HCI_NUM_FLAGS,
+ };
+diff --git a/kernel/acct.c b/kernel/acct.c
+index addf7732fb56..81f9831a7859 100644
+--- a/kernel/acct.c
++++ b/kernel/acct.c
+@@ -227,7 +227,7 @@ static int acct_on(struct filename *pathname)
+ filp_close(file, NULL);
+ return PTR_ERR(internal);
+ }
+- err = mnt_want_write(internal);
++ err = __mnt_want_write(internal);
+ if (err) {
+ mntput(internal);
+ kfree(acct);
+@@ -252,7 +252,7 @@ static int acct_on(struct filename *pathname)
+ old = xchg(&ns->bacct, &acct->pin);
+ mutex_unlock(&acct->lock);
+ pin_kill(old);
+- mnt_drop_write(mnt);
++ __mnt_drop_write(mnt);
+ mntput(mnt);
+ return 0;
+ }
+diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
+index bf309f2592c4..425c67e4f568 100644
+--- a/kernel/auditfilter.c
++++ b/kernel/auditfilter.c
+@@ -1114,22 +1114,24 @@ int audit_rule_change(int type, int seq, void *data, size_t datasz)
+ int err = 0;
+ struct audit_entry *entry;
+
+- entry = audit_data_to_entry(data, datasz);
+- if (IS_ERR(entry))
+- return PTR_ERR(entry);
+-
+ switch (type) {
+ case AUDIT_ADD_RULE:
++ entry = audit_data_to_entry(data, datasz);
++ if (IS_ERR(entry))
++ return PTR_ERR(entry);
+ err = audit_add_rule(entry);
+ audit_log_rule_change("add_rule", &entry->rule, !err);
+ break;
+ case AUDIT_DEL_RULE:
++ entry = audit_data_to_entry(data, datasz);
++ if (IS_ERR(entry))
++ return PTR_ERR(entry);
+ err = audit_del_rule(entry);
+ audit_log_rule_change("remove_rule", &entry->rule, !err);
+ break;
+ default:
+- err = -EINVAL;
+ WARN_ON(1);
++ return -EINVAL;
+ }
+
+ if (err || type == AUDIT_DEL_RULE) {
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 474525e3a9db..bad9985b8a08 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -366,10 +366,13 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
+ }
+
+ #ifdef CONFIG_BPF_JIT
++# define BPF_JIT_LIMIT_DEFAULT (PAGE_SIZE * 40000)
++
+ /* All BPF JIT sysctl knobs here. */
+ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON);
+ int bpf_jit_harden __read_mostly;
+ int bpf_jit_kallsyms __read_mostly;
++int bpf_jit_limit __read_mostly = BPF_JIT_LIMIT_DEFAULT;
+
+ static __always_inline void
+ bpf_get_prog_addr_region(const struct bpf_prog *prog,
+@@ -578,27 +581,64 @@ int bpf_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
+ return ret;
+ }
+
++static atomic_long_t bpf_jit_current;
++
++#if defined(MODULES_VADDR)
++static int __init bpf_jit_charge_init(void)
++{
++ /* Only used as heuristic here to derive limit. */
++ bpf_jit_limit = min_t(u64, round_up((MODULES_END - MODULES_VADDR) >> 2,
++ PAGE_SIZE), INT_MAX);
++ return 0;
++}
++pure_initcall(bpf_jit_charge_init);
++#endif
++
++static int bpf_jit_charge_modmem(u32 pages)
++{
++ if (atomic_long_add_return(pages, &bpf_jit_current) >
++ (bpf_jit_limit >> PAGE_SHIFT)) {
++ if (!capable(CAP_SYS_ADMIN)) {
++ atomic_long_sub(pages, &bpf_jit_current);
++ return -EPERM;
++ }
++ }
++
++ return 0;
++}
++
++static void bpf_jit_uncharge_modmem(u32 pages)
++{
++ atomic_long_sub(pages, &bpf_jit_current);
++}
++
+ struct bpf_binary_header *
+ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
+ unsigned int alignment,
+ bpf_jit_fill_hole_t bpf_fill_ill_insns)
+ {
+ struct bpf_binary_header *hdr;
+- unsigned int size, hole, start;
++ u32 size, hole, start, pages;
+
+ /* Most of BPF filters are really small, but if some of them
+ * fill a page, allow at least 128 extra bytes to insert a
+ * random section of illegal instructions.
+ */
+ size = round_up(proglen + sizeof(*hdr) + 128, PAGE_SIZE);
++ pages = size / PAGE_SIZE;
++
++ if (bpf_jit_charge_modmem(pages))
++ return NULL;
+ hdr = module_alloc(size);
+- if (hdr == NULL)
++ if (!hdr) {
++ bpf_jit_uncharge_modmem(pages);
+ return NULL;
++ }
+
+ /* Fill space with illegal/arch-dep instructions. */
+ bpf_fill_ill_insns(hdr, size);
+
+- hdr->pages = size / PAGE_SIZE;
++ hdr->pages = pages;
+ hole = min_t(unsigned int, size - (proglen + sizeof(*hdr)),
+ PAGE_SIZE - sizeof(*hdr));
+ start = (get_random_int() % hole) & ~(alignment - 1);
+@@ -611,7 +651,10 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
+
+ void bpf_jit_binary_free(struct bpf_binary_header *hdr)
+ {
++ u32 pages = hdr->pages;
++
+ module_memfree(hdr);
++ bpf_jit_uncharge_modmem(pages);
+ }
+
+ /* This symbol is only overridden by archs that have different
+diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
+index 141710b82a6c..2faad033715f 100644
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -164,6 +164,9 @@ static void dev_map_free(struct bpf_map *map)
+ bpf_clear_redirect_map(map);
+ synchronize_rcu();
+
++ /* Make sure prior __dev_map_entry_free() have completed. */
++ rcu_barrier();
++
+ /* To ensure all pending flush operations have completed wait for flush
+ * bitmap to indicate all flush_needed bits to be zero on _all_ cpus.
+ * Because the above synchronize_rcu() ensures the map is disconnected
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 63dae7e0ccae..81441117f611 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -4659,9 +4659,11 @@ static void css_release_work_fn(struct work_struct *work)
+ if (cgroup_on_dfl(cgrp))
+ cgroup_rstat_flush(cgrp);
+
++ spin_lock_irq(&css_set_lock);
+ for (tcgrp = cgroup_parent(cgrp); tcgrp;
+ tcgrp = cgroup_parent(tcgrp))
+ tcgrp->nr_dying_descendants--;
++ spin_unlock_irq(&css_set_lock);
+
+ cgroup_idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
+ cgrp->id = -1;
+@@ -4874,12 +4876,14 @@ static struct cgroup *cgroup_create(struct cgroup *parent)
+ if (ret)
+ goto out_idr_free;
+
++ spin_lock_irq(&css_set_lock);
+ for (tcgrp = cgrp; tcgrp; tcgrp = cgroup_parent(tcgrp)) {
+ cgrp->ancestor_ids[tcgrp->level] = tcgrp->id;
+
+ if (tcgrp != cgrp)
+ tcgrp->nr_descendants++;
+ }
++ spin_unlock_irq(&css_set_lock);
+
+ if (notify_on_release(parent))
+ set_bit(CGRP_NOTIFY_ON_RELEASE, &cgrp->flags);
+@@ -5162,10 +5166,12 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
+ if (parent && cgroup_is_threaded(cgrp))
+ parent->nr_threaded_children--;
+
++ spin_lock_irq(&css_set_lock);
+ for (tcgrp = cgroup_parent(cgrp); tcgrp; tcgrp = cgroup_parent(tcgrp)) {
+ tcgrp->nr_descendants--;
+ tcgrp->nr_dying_descendants++;
+ }
++ spin_unlock_irq(&css_set_lock);
+
+ cgroup1_check_for_release(parent);
+
+diff --git a/kernel/irq_work.c b/kernel/irq_work.c
+index 6b7cdf17ccf8..73288914ed5e 100644
+--- a/kernel/irq_work.c
++++ b/kernel/irq_work.c
+@@ -56,61 +56,70 @@ void __weak arch_irq_work_raise(void)
+ */
+ }
+
+-/*
+- * Enqueue the irq_work @work on @cpu unless it's already pending
+- * somewhere.
+- *
+- * Can be re-enqueued while the callback is still in progress.
+- */
+-bool irq_work_queue_on(struct irq_work *work, int cpu)
++/* Enqueue on current CPU, work must already be claimed and preempt disabled */
++static void __irq_work_queue_local(struct irq_work *work)
+ {
+- /* All work should have been flushed before going offline */
+- WARN_ON_ONCE(cpu_is_offline(cpu));
+-
+-#ifdef CONFIG_SMP
+-
+- /* Arch remote IPI send/receive backend aren't NMI safe */
+- WARN_ON_ONCE(in_nmi());
++ /* If the work is "lazy", handle it from next tick if any */
++ if (work->flags & IRQ_WORK_LAZY) {
++ if (llist_add(&work->llnode, this_cpu_ptr(&lazy_list)) &&
++ tick_nohz_tick_stopped())
++ arch_irq_work_raise();
++ } else {
++ if (llist_add(&work->llnode, this_cpu_ptr(&raised_list)))
++ arch_irq_work_raise();
++ }
++}
+
++/* Enqueue the irq work @work on the current CPU */
++bool irq_work_queue(struct irq_work *work)
++{
+ /* Only queue if not already pending */
+ if (!irq_work_claim(work))
+ return false;
+
+- if (llist_add(&work->llnode, &per_cpu(raised_list, cpu)))
+- arch_send_call_function_single_ipi(cpu);
+-
+-#else /* #ifdef CONFIG_SMP */
+- irq_work_queue(work);
+-#endif /* #else #ifdef CONFIG_SMP */
++ /* Queue the entry and raise the IPI if needed. */
++ preempt_disable();
++ __irq_work_queue_local(work);
++ preempt_enable();
+
+ return true;
+ }
++EXPORT_SYMBOL_GPL(irq_work_queue);
+
+-/* Enqueue the irq work @work on the current CPU */
+-bool irq_work_queue(struct irq_work *work)
++/*
++ * Enqueue the irq_work @work on @cpu unless it's already pending
++ * somewhere.
++ *
++ * Can be re-enqueued while the callback is still in progress.
++ */
++bool irq_work_queue_on(struct irq_work *work, int cpu)
+ {
++#ifndef CONFIG_SMP
++ return irq_work_queue(work);
++
++#else /* CONFIG_SMP: */
++ /* All work should have been flushed before going offline */
++ WARN_ON_ONCE(cpu_is_offline(cpu));
++
+ /* Only queue if not already pending */
+ if (!irq_work_claim(work))
+ return false;
+
+- /* Queue the entry and raise the IPI if needed. */
+ preempt_disable();
+-
+- /* If the work is "lazy", handle it from next tick if any */
+- if (work->flags & IRQ_WORK_LAZY) {
+- if (llist_add(&work->llnode, this_cpu_ptr(&lazy_list)) &&
+- tick_nohz_tick_stopped())
+- arch_irq_work_raise();
++ if (cpu != smp_processor_id()) {
++ /* Arch remote IPI send/receive backend aren't NMI safe */
++ WARN_ON_ONCE(in_nmi());
++ if (llist_add(&work->llnode, &per_cpu(raised_list, cpu)))
++ arch_send_call_function_single_ipi(cpu);
+ } else {
+- if (llist_add(&work->llnode, this_cpu_ptr(&raised_list)))
+- arch_irq_work_raise();
++ __irq_work_queue_local(work);
+ }
+-
+ preempt_enable();
+
+ return true;
++#endif /* CONFIG_SMP */
+ }
+-EXPORT_SYMBOL_GPL(irq_work_queue);
++
+
+ bool irq_work_needs_cpu(void)
+ {
+diff --git a/kernel/module.c b/kernel/module.c
+index 38bf28b5cc20..f797c6ace712 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1949,8 +1949,13 @@ void module_enable_ro(const struct module *mod, bool after_init)
+ return;
+
+ frob_text(&mod->core_layout, set_memory_ro);
++ frob_text(&mod->core_layout, set_memory_x);
++
+ frob_rodata(&mod->core_layout, set_memory_ro);
++
+ frob_text(&mod->init_layout, set_memory_ro);
++ frob_text(&mod->init_layout, set_memory_x);
++
+ frob_rodata(&mod->init_layout, set_memory_ro);
+
+ if (after_init)
+diff --git a/kernel/rcu/rcuperf.c b/kernel/rcu/rcuperf.c
+index 34244523550e..19249b86fb33 100644
+--- a/kernel/rcu/rcuperf.c
++++ b/kernel/rcu/rcuperf.c
+@@ -561,6 +561,10 @@ rcu_perf_cleanup(void)
+
+ if (torture_cleanup_begin())
+ return;
++ if (!cur_ops) {
++ torture_cleanup_end();
++ return;
++ }
+
+ if (reader_tasks) {
+ for (i = 0; i < nrealreaders; i++)
+@@ -681,6 +685,7 @@ rcu_perf_init(void)
+ pr_cont(" %s", perf_ops[i]->name);
+ pr_cont("\n");
+ firsterr = -EINVAL;
++ cur_ops = NULL;
+ goto unwind;
+ }
+ if (cur_ops->init)
+diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
+index c596c6f1e457..0b7af7e2bcbb 100644
+--- a/kernel/rcu/rcutorture.c
++++ b/kernel/rcu/rcutorture.c
+@@ -1826,6 +1826,10 @@ rcu_torture_cleanup(void)
+ cur_ops->cb_barrier();
+ return;
+ }
++ if (!cur_ops) {
++ torture_cleanup_end();
++ return;
++ }
+
+ rcu_torture_barrier_cleanup();
+ torture_stop_kthread(rcu_torture_stall, stall_task);
+@@ -1964,6 +1968,7 @@ rcu_torture_init(void)
+ pr_cont(" %s", torture_ops[i]->name);
+ pr_cont("\n");
+ firsterr = -EINVAL;
++ cur_ops = NULL;
+ goto unwind;
+ }
+ if (cur_ops->fqs == NULL && fqs_duration != 0) {
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index d7f409866cdf..6138754e5030 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -6491,6 +6491,8 @@ static void cpu_cgroup_attach(struct cgroup_taskset *tset)
+ static int cpu_shares_write_u64(struct cgroup_subsys_state *css,
+ struct cftype *cftype, u64 shareval)
+ {
++ if (shareval > scale_load_down(ULONG_MAX))
++ shareval = MAX_SHARES;
+ return sched_group_set_shares(css_tg(css), scale_load(shareval));
+ }
+
+@@ -6593,8 +6595,10 @@ int tg_set_cfs_quota(struct task_group *tg, long cfs_quota_us)
+ period = ktime_to_ns(tg->cfs_bandwidth.period);
+ if (cfs_quota_us < 0)
+ quota = RUNTIME_INF;
+- else
++ else if ((u64)cfs_quota_us <= U64_MAX / NSEC_PER_USEC)
+ quota = (u64)cfs_quota_us * NSEC_PER_USEC;
++ else
++ return -EINVAL;
+
+ return tg_set_cfs_bandwidth(tg, period, quota);
+ }
+@@ -6616,6 +6620,9 @@ int tg_set_cfs_period(struct task_group *tg, long cfs_period_us)
+ {
+ u64 quota, period;
+
++ if ((u64)cfs_period_us > U64_MAX / NSEC_PER_USEC)
++ return -EINVAL;
++
+ period = (u64)cfs_period_us * NSEC_PER_USEC;
+ quota = tg->cfs_bandwidth.quota;
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index d31916366d39..7a1e9db617f7 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9083,22 +9083,26 @@ static inline int on_null_domain(struct rq *rq)
+ * - When one of the busy CPUs notice that there may be an idle rebalancing
+ * needed, they will kick the idle load balancer, which then does idle
+ * load balancing for all the idle CPUs.
++ * - HK_FLAG_MISC CPUs are used for this task, because HK_FLAG_SCHED not set
++ * anywhere yet.
+ */
+
+ static inline int find_new_ilb(void)
+ {
+- int ilb = cpumask_first(nohz.idle_cpus_mask);
++ int ilb;
+
+- if (ilb < nr_cpu_ids && idle_cpu(ilb))
+- return ilb;
++ for_each_cpu_and(ilb, nohz.idle_cpus_mask,
++ housekeeping_cpumask(HK_FLAG_MISC)) {
++ if (idle_cpu(ilb))
++ return ilb;
++ }
+
+ return nr_cpu_ids;
+ }
+
+ /*
+- * Kick a CPU to do the nohz balancing, if it is time for it. We pick the
+- * nohz_load_balancer CPU (if there is one) otherwise fallback to any idle
+- * CPU (if there is one).
++ * Kick a CPU to do the nohz balancing, if it is time for it. We pick any
++ * idle CPU in the HK_FLAG_MISC housekeeping set (if there is one).
+ */
+ static void kick_ilb(unsigned int flags)
+ {
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index 2e2955a8cf8f..b980cc96604f 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -2559,6 +2559,8 @@ int sched_group_set_rt_runtime(struct task_group *tg, long rt_runtime_us)
+ rt_runtime = (u64)rt_runtime_us * NSEC_PER_USEC;
+ if (rt_runtime_us < 0)
+ rt_runtime = RUNTIME_INF;
++ else if ((u64)rt_runtime_us > U64_MAX / NSEC_PER_USEC)
++ return -EINVAL;
+
+ return tg_set_rt_bandwidth(tg, rt_period, rt_runtime);
+ }
+@@ -2579,6 +2581,9 @@ int sched_group_set_rt_period(struct task_group *tg, u64 rt_period_us)
+ {
+ u64 rt_runtime, rt_period;
+
++ if (rt_period_us > U64_MAX / NSEC_PER_USEC)
++ return -EINVAL;
++
+ rt_period = rt_period_us * NSEC_PER_USEC;
+ rt_runtime = tg->rt_bandwidth.rt_runtime;
+
+diff --git a/kernel/time/time.c b/kernel/time/time.c
+index ccdb351277ee..be057d6579f1 100644
+--- a/kernel/time/time.c
++++ b/kernel/time/time.c
+@@ -172,7 +172,7 @@ int do_sys_settimeofday64(const struct timespec64 *tv, const struct timezone *tz
+ static int firsttime = 1;
+ int error = 0;
+
+- if (tv && !timespec64_valid(tv))
++ if (tv && !timespec64_valid_settod(tv))
+ return -EINVAL;
+
+ error = security_settime64(tv, tz);
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 7846ce24ecc0..9a6bfcd22dc6 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1242,7 +1242,7 @@ int do_settimeofday64(const struct timespec64 *ts)
+ unsigned long flags;
+ int ret = 0;
+
+- if (!timespec64_valid_strict(ts))
++ if (!timespec64_valid_settod(ts))
+ return -EINVAL;
+
+ raw_spin_lock_irqsave(&timekeeper_lock, flags);
+@@ -1299,7 +1299,7 @@ static int timekeeping_inject_offset(const struct timespec64 *ts)
+ /* Make sure the proposed value is valid */
+ tmp = timespec64_add(tk_xtime(tk), *ts);
+ if (timespec64_compare(&tk->wall_to_monotonic, ts) > 0 ||
+- !timespec64_valid_strict(&tmp)) {
++ !timespec64_valid_settod(&tmp)) {
+ ret = -EINVAL;
+ goto error;
+ }
+@@ -1556,7 +1556,7 @@ void __init timekeeping_init(void)
+ unsigned long flags;
+
+ read_persistent_wall_and_boot_offset(&wall_time, &boot_offset);
+- if (timespec64_valid_strict(&wall_time) &&
++ if (timespec64_valid_settod(&wall_time) &&
+ timespec64_to_ns(&wall_time) > 0) {
+ persistent_clock_exists = true;
+ } else if (timespec64_to_ns(&wall_time) != 0) {
+diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
+index 4ad967453b6f..3ea65cdff30d 100644
+--- a/kernel/trace/trace_branch.c
++++ b/kernel/trace/trace_branch.c
+@@ -205,6 +205,8 @@ void trace_likely_condition(struct ftrace_likely_data *f, int val, int expect)
+ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ int expect, int is_constant)
+ {
++ unsigned long flags = user_access_save();
++
+ /* A constant is always correct */
+ if (is_constant) {
+ f->constant++;
+@@ -223,6 +225,8 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ f->data.correct++;
+ else
+ f->data.incorrect++;
++
++ user_access_restore(flags);
+ }
+ EXPORT_SYMBOL(ftrace_likely_update);
+
+diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
+index 63d0816ab23b..7761f3294339 100644
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -464,6 +464,13 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
+ int i = 0;
+ int retval = 0;
+
++ /*
++ * Mark "remove" event done regardless of result, for some subsystems
++ * do not want to re-trigger "remove" event via automatic cleanup.
++ */
++ if (action == KOBJ_REMOVE)
++ kobj->state_remove_uevent_sent = 1;
++
+ pr_debug("kobject: '%s' (%p): %s\n",
+ kobject_name(kobj), kobj, __func__);
+
+@@ -565,10 +572,6 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
+ kobj->state_add_uevent_sent = 1;
+ break;
+
+- case KOBJ_REMOVE:
+- kobj->state_remove_uevent_sent = 1;
+- break;
+-
+ case KOBJ_UNBIND:
+ zap_modalias_env(env);
+ break;
+diff --git a/lib/sbitmap.c b/lib/sbitmap.c
+index fdd1b8aa8ac6..0572ac340325 100644
+--- a/lib/sbitmap.c
++++ b/lib/sbitmap.c
+@@ -356,7 +356,7 @@ static void sbitmap_queue_update_wake_batch(struct sbitmap_queue *sbq,
+ * to ensure that the batch size is updated before the wait
+ * counts.
+ */
+- smp_mb__before_atomic();
++ smp_mb();
+ for (i = 0; i < SBQ_WAIT_QUEUES; i++)
+ atomic_set(&sbq->ws[i].wait_cnt, 1);
+ }
+diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
+index b53e1b5d80f4..e304b54c9c7d 100644
+--- a/lib/strncpy_from_user.c
++++ b/lib/strncpy_from_user.c
+@@ -23,10 +23,11 @@
+ * hit it), 'max' is the address space maximum (and we return
+ * -EFAULT if we hit it).
+ */
+-static inline long do_strncpy_from_user(char *dst, const char __user *src, long count, unsigned long max)
++static inline long do_strncpy_from_user(char *dst, const char __user *src,
++ unsigned long count, unsigned long max)
+ {
+ const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
+- long res = 0;
++ unsigned long res = 0;
+
+ /*
+ * Truncate 'max' to the user-specified limit, so that
+diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c
+index 60d0bbda8f5e..184f80f7bacf 100644
+--- a/lib/strnlen_user.c
++++ b/lib/strnlen_user.c
+@@ -28,7 +28,7 @@
+ static inline long do_strnlen_user(const char __user *src, unsigned long count, unsigned long max)
+ {
+ const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
+- long align, res = 0;
++ unsigned long align, res = 0;
+ unsigned long c;
+
+ /*
+@@ -42,7 +42,7 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
+ * Do everything aligned. But that means that we
+ * need to also expand the maximum..
+ */
+- align = (sizeof(long) - 1) & (unsigned long)src;
++ align = (sizeof(unsigned long) - 1) & (unsigned long)src;
+ src -= align;
+ max += align;
+
+diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
+index a60bacf7120b..2895e3b26e93 100644
+--- a/net/batman-adv/distributed-arp-table.c
++++ b/net/batman-adv/distributed-arp-table.c
+@@ -1394,7 +1394,6 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
+ hw_src, &ip_src, hw_dst, &ip_dst,
+ dat_entry->mac_addr, &dat_entry->ip);
+ dropped = true;
+- goto out;
+ }
+
+ /* Update our internal cache with both the IP addresses the node got
+@@ -1403,6 +1402,9 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
+ batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);
+ batadv_dat_entry_add(bat_priv, ip_dst, hw_dst, vid);
+
++ if (dropped)
++ goto out;
++
+ /* If BLA is enabled, only forward ARP replies if we have claimed the
+ * source of the ARP reply or if no one else of the same backbone has
+ * already claimed that client. This prevents that different gateways
+diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
+index 69c0d85bceb3..79b8a2d8793e 100644
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -160,6 +160,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
+ spin_lock_init(&bat_priv->tt.commit_lock);
+ spin_lock_init(&bat_priv->gw.list_lock);
+ #ifdef CONFIG_BATMAN_ADV_MCAST
++ spin_lock_init(&bat_priv->mcast.mla_lock);
+ spin_lock_init(&bat_priv->mcast.want_lists_lock);
+ #endif
+ spin_lock_init(&bat_priv->tvlv.container_list_lock);
+diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
+index 86725d792e15..b90fe25d6b0b 100644
+--- a/net/batman-adv/multicast.c
++++ b/net/batman-adv/multicast.c
+@@ -325,8 +325,6 @@ static void batadv_mcast_mla_list_free(struct hlist_head *mcast_list)
+ * translation table except the ones listed in the given mcast_list.
+ *
+ * If mcast_list is NULL then all are retracted.
+- *
+- * Do not call outside of the mcast worker! (or cancel mcast worker first)
+ */
+ static void batadv_mcast_mla_tt_retract(struct batadv_priv *bat_priv,
+ struct hlist_head *mcast_list)
+@@ -334,8 +332,6 @@ static void batadv_mcast_mla_tt_retract(struct batadv_priv *bat_priv,
+ struct batadv_hw_addr *mcast_entry;
+ struct hlist_node *tmp;
+
+- WARN_ON(delayed_work_pending(&bat_priv->mcast.work));
+-
+ hlist_for_each_entry_safe(mcast_entry, tmp, &bat_priv->mcast.mla_list,
+ list) {
+ if (mcast_list &&
+@@ -359,8 +355,6 @@ static void batadv_mcast_mla_tt_retract(struct batadv_priv *bat_priv,
+ *
+ * Adds multicast listener announcements from the given mcast_list to the
+ * translation table if they have not been added yet.
+- *
+- * Do not call outside of the mcast worker! (or cancel mcast worker first)
+ */
+ static void batadv_mcast_mla_tt_add(struct batadv_priv *bat_priv,
+ struct hlist_head *mcast_list)
+@@ -368,8 +362,6 @@ static void batadv_mcast_mla_tt_add(struct batadv_priv *bat_priv,
+ struct batadv_hw_addr *mcast_entry;
+ struct hlist_node *tmp;
+
+- WARN_ON(delayed_work_pending(&bat_priv->mcast.work));
+-
+ if (!mcast_list)
+ return;
+
+@@ -658,7 +650,10 @@ static void batadv_mcast_mla_update(struct work_struct *work)
+ priv_mcast = container_of(delayed_work, struct batadv_priv_mcast, work);
+ bat_priv = container_of(priv_mcast, struct batadv_priv, mcast);
+
++ spin_lock(&bat_priv->mcast.mla_lock);
+ __batadv_mcast_mla_update(bat_priv);
++ spin_unlock(&bat_priv->mcast.mla_lock);
++
+ batadv_mcast_start_timer(bat_priv);
+ }
+
+diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
+index 343d304851a5..eeee3e61c625 100644
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -1215,6 +1215,11 @@ struct batadv_priv_mcast {
+ /** @bridged: whether the soft interface has a bridge on top */
+ unsigned char bridged:1;
+
++ /**
++ * @mla_lock: a lock protecting mla_list and mla_flags
++ */
++ spinlock_t mla_lock;
++
+ /**
+ * @num_want_all_unsnoopables: number of nodes wanting unsnoopable IP
+ * traffic
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index a06f03047717..5afd67ef797a 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -4274,6 +4274,9 @@ void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
+ return;
+ }
+
++ /* If we reach this point this event matches the last command sent */
++ hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
++
+ /* If the command succeeded and there's still more commands in
+ * this request the request is not yet complete.
+ */
+@@ -4384,6 +4387,8 @@ static void hci_cmd_work(struct work_struct *work)
+
+ hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
+ if (hdev->sent_cmd) {
++ if (hci_req_status_pend(hdev))
++ hci_dev_set_flag(hdev, HCI_CMD_PENDING);
+ atomic_dec(&hdev->cmd_cnt);
+ hci_send_frame(hdev, skb);
+ if (test_bit(HCI_RESET, &hdev->flags))
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 7f800c3480f7..3e7badb3ac2d 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3357,6 +3357,12 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
+ hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
+ req_complete_skb);
+
++ if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
++ bt_dev_err(hdev,
++ "unexpected event for opcode 0x%4.4x", *opcode);
++ return;
++ }
++
+ if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
+ queue_work(hdev->workqueue, &hdev->cmd_work);
+ }
+@@ -3464,6 +3470,12 @@ static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
+ hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
+ req_complete_skb);
+
++ if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
++ bt_dev_err(hdev,
++ "unexpected event for opcode 0x%4.4x", *opcode);
++ return;
++ }
++
+ if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
+ queue_work(hdev->workqueue, &hdev->cmd_work);
+ }
+diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
+index e8c9ef1e1922..9448ebd3780a 100644
+--- a/net/bluetooth/hci_request.c
++++ b/net/bluetooth/hci_request.c
+@@ -46,6 +46,11 @@ void hci_req_purge(struct hci_request *req)
+ skb_queue_purge(&req->cmd_q);
+ }
+
++bool hci_req_status_pend(struct hci_dev *hdev)
++{
++ return hdev->req_status == HCI_REQ_PEND;
++}
++
+ static int req_run(struct hci_request *req, hci_req_complete_t complete,
+ hci_req_complete_skb_t complete_skb)
+ {
+diff --git a/net/bluetooth/hci_request.h b/net/bluetooth/hci_request.h
+index 692cc8b13368..55b2050cc9ff 100644
+--- a/net/bluetooth/hci_request.h
++++ b/net/bluetooth/hci_request.h
+@@ -37,6 +37,7 @@ struct hci_request {
+
+ void hci_req_init(struct hci_request *req, struct hci_dev *hdev);
+ void hci_req_purge(struct hci_request *req);
++bool hci_req_status_pend(struct hci_dev *hdev);
+ int hci_req_run(struct hci_request *req, hci_req_complete_t complete);
+ int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete);
+ void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index b1a2c5e38530..37b4667128a3 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -279,7 +279,6 @@ static int proc_dointvec_minmax_bpf_enable(struct ctl_table *table, int write,
+ return ret;
+ }
+
+-# ifdef CONFIG_HAVE_EBPF_JIT
+ static int
+ proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp,
+@@ -290,7 +289,6 @@ proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write,
+
+ return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+ }
+-# endif
+ #endif
+
+ static struct ctl_table net_core_table[] = {
+@@ -397,6 +395,14 @@ static struct ctl_table net_core_table[] = {
+ .extra2 = &one,
+ },
+ # endif
++ {
++ .procname = "bpf_jit_limit",
++ .data = &bpf_jit_limit,
++ .maxlen = sizeof(int),
++ .mode = 0600,
++ .proc_handler = proc_dointvec_minmax_bpf_restricted,
++ .extra1 = &one,
++ },
+ #endif
+ {
+ .procname = "netdev_tstamp_prequeue",
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 3dbecae4be73..2ac749c4a6b2 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1156,9 +1156,6 @@ static void ieee80211_chswitch_work(struct work_struct *work)
+ goto out;
+ }
+
+- /* XXX: shouldn't really modify cfg80211-owned data! */
+- ifmgd->associated->channel = sdata->csa_chandef.chan;
+-
+ ifmgd->csa_waiting_bcn = true;
+
+ ieee80211_sta_reset_beacon_monitor(sdata);
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 048e004ed0ee..c6711ead5e59 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -15441,6 +15441,11 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
+
+ wdev->chandef = *chandef;
+ wdev->preset_chandef = *chandef;
++
++ if (wdev->iftype == NL80211_IFTYPE_STATION &&
++ !WARN_ON(!wdev->current_bss))
++ wdev->current_bss->pub.channel = chandef->chan;
++
+ nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
+ NL80211_CMD_CH_SWITCH_NOTIFY, 0);
+ }
+diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
+index 186e727b737b..6fd9954e1c08 100644
+--- a/security/selinux/netlabel.c
++++ b/security/selinux/netlabel.c
+@@ -288,11 +288,8 @@ int selinux_netlbl_sctp_assoc_request(struct sctp_endpoint *ep,
+ int rc;
+ struct netlbl_lsm_secattr secattr;
+ struct sk_security_struct *sksec = ep->base.sk->sk_security;
+- struct sockaddr *addr;
+ struct sockaddr_in addr4;
+-#if IS_ENABLED(CONFIG_IPV6)
+ struct sockaddr_in6 addr6;
+-#endif
+
+ if (ep->base.sk->sk_family != PF_INET &&
+ ep->base.sk->sk_family != PF_INET6)
+@@ -310,16 +307,15 @@ int selinux_netlbl_sctp_assoc_request(struct sctp_endpoint *ep,
+ if (ip_hdr(skb)->version == 4) {
+ addr4.sin_family = AF_INET;
+ addr4.sin_addr.s_addr = ip_hdr(skb)->saddr;
+- addr = (struct sockaddr *)&addr4;
+-#if IS_ENABLED(CONFIG_IPV6)
+- } else {
++ rc = netlbl_conn_setattr(ep->base.sk, (void *)&addr4, &secattr);
++ } else if (IS_ENABLED(CONFIG_IPV6) && ip_hdr(skb)->version == 6) {
+ addr6.sin6_family = AF_INET6;
+ addr6.sin6_addr = ipv6_hdr(skb)->saddr;
+- addr = (struct sockaddr *)&addr6;
+-#endif
++ rc = netlbl_conn_setattr(ep->base.sk, (void *)&addr6, &secattr);
++ } else {
++ rc = -EAFNOSUPPORT;
+ }
+
+- rc = netlbl_conn_setattr(ep->base.sk, addr, &secattr);
+ if (rc == 0)
+ sksec->nlbl_state = NLBL_LABELED;
+
+diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
+index d5f73c837281..7994e8ddc7d2 100644
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -439,8 +439,12 @@ static int hdmi_codec_startup(struct snd_pcm_substream *substream,
+ if (!ret) {
+ ret = snd_pcm_hw_constraint_eld(substream->runtime,
+ hcp->eld);
+- if (ret)
++ if (ret) {
++ mutex_lock(&hcp->current_stream_lock);
++ hcp->current_stream = NULL;
++ mutex_unlock(&hcp->current_stream_lock);
+ return ret;
++ }
+ }
+ /* Select chmap supported */
+ hdmi_codec_eld_chmap(hcp);
+diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
+index f70db8412c7c..160b2764b2ad 100644
+--- a/sound/soc/davinci/davinci-mcasp.c
++++ b/sound/soc/davinci/davinci-mcasp.c
+@@ -43,6 +43,7 @@
+
+ #define MCASP_MAX_AFIFO_DEPTH 64
+
++#ifdef CONFIG_PM
+ static u32 context_regs[] = {
+ DAVINCI_MCASP_TXFMCTL_REG,
+ DAVINCI_MCASP_RXFMCTL_REG,
+@@ -65,6 +66,7 @@ struct davinci_mcasp_context {
+ u32 *xrsr_regs; /* for serializer configuration */
+ bool pm_state;
+ };
++#endif
+
+ struct davinci_mcasp_ruledata {
+ struct davinci_mcasp *mcasp;
+diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig
+index 2e75b5bc5f1d..f721cd4e3f97 100644
+--- a/sound/soc/fsl/Kconfig
++++ b/sound/soc/fsl/Kconfig
+@@ -173,16 +173,17 @@ config SND_MPC52xx_SOC_EFIKA
+
+ endif # SND_POWERPC_SOC
+
++config SND_SOC_IMX_PCM_FIQ
++ tristate
++ default y if SND_SOC_IMX_SSI=y && (SND_SOC_FSL_SSI=m || SND_SOC_FSL_SPDIF=m) && (MXC_TZIC || MXC_AVIC)
++ select FIQ
++
+ if SND_IMX_SOC
+
+ config SND_SOC_IMX_SSI
+ tristate
+ select SND_SOC_FSL_UTILS
+
+-config SND_SOC_IMX_PCM_FIQ
+- tristate
+- select FIQ
+-
+ comment "SoC Audio support for Freescale i.MX boards:"
+
+ config SND_MXC_SOC_WM1133_EV1
+diff --git a/sound/soc/fsl/eukrea-tlv320.c b/sound/soc/fsl/eukrea-tlv320.c
+index 191426a6d9ad..30a3d68b5c03 100644
+--- a/sound/soc/fsl/eukrea-tlv320.c
++++ b/sound/soc/fsl/eukrea-tlv320.c
+@@ -118,13 +118,13 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(&pdev->dev,
+ "fsl,mux-int-port node missing or invalid.\n");
+- return ret;
++ goto err;
+ }
+ ret = of_property_read_u32(np, "fsl,mux-ext-port", &ext_port);
+ if (ret) {
+ dev_err(&pdev->dev,
+ "fsl,mux-ext-port node missing or invalid.\n");
+- return ret;
++ goto err;
+ }
+
+ /*
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index 4163f2cfc06f..bfc5b21d0c3f 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -268,12 +268,14 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai,
+ case SND_SOC_DAIFMT_CBS_CFS:
+ val_cr2 |= FSL_SAI_CR2_BCD_MSTR;
+ val_cr4 |= FSL_SAI_CR4_FSD_MSTR;
++ sai->is_slave_mode = false;
+ break;
+ case SND_SOC_DAIFMT_CBM_CFM:
+ sai->is_slave_mode = true;
+ break;
+ case SND_SOC_DAIFMT_CBS_CFM:
+ val_cr2 |= FSL_SAI_CR2_BCD_MSTR;
++ sai->is_slave_mode = false;
+ break;
+ case SND_SOC_DAIFMT_CBM_CFS:
+ val_cr4 |= FSL_SAI_CR4_FSD_MSTR;
+diff --git a/sound/soc/fsl/fsl_utils.c b/sound/soc/fsl/fsl_utils.c
+index 7f0fa4b52223..cca33ab7020a 100644
+--- a/sound/soc/fsl/fsl_utils.c
++++ b/sound/soc/fsl/fsl_utils.c
+@@ -71,6 +71,7 @@ int fsl_asoc_get_dma_channel(struct device_node *ssi_np,
+ iprop = of_get_property(dma_np, "cell-index", NULL);
+ if (!iprop) {
+ of_node_put(dma_np);
++ of_node_put(dma_channel_np);
+ return -EINVAL;
+ }
+ *dma_id = be32_to_cpup(iprop);
+diff --git a/sound/soc/intel/boards/kbl_da7219_max98357a.c b/sound/soc/intel/boards/kbl_da7219_max98357a.c
+index 38f6ab74709d..07491a0f8fb8 100644
+--- a/sound/soc/intel/boards/kbl_da7219_max98357a.c
++++ b/sound/soc/intel/boards/kbl_da7219_max98357a.c
+@@ -188,7 +188,7 @@ static int kabylake_da7219_codec_init(struct snd_soc_pcm_runtime *rtd)
+
+ jack = &ctx->kabylake_headset;
+
+- snd_jack_set_key(jack->jack, SND_JACK_BTN_0, KEY_MEDIA);
++ snd_jack_set_key(jack->jack, SND_JACK_BTN_0, KEY_PLAYPAUSE);
+ snd_jack_set_key(jack->jack, SND_JACK_BTN_1, KEY_VOLUMEUP);
+ snd_jack_set_key(jack->jack, SND_JACK_BTN_2, KEY_VOLUMEDOWN);
+ snd_jack_set_key(jack->jack, SND_JACK_BTN_3, KEY_VOICECOMMAND);
+diff --git a/tools/bpf/bpftool/.gitignore b/tools/bpf/bpftool/.gitignore
+index 67167e44b726..8248b8dd89d4 100644
+--- a/tools/bpf/bpftool/.gitignore
++++ b/tools/bpf/bpftool/.gitignore
+@@ -1,5 +1,5 @@
+ *.d
+-bpftool
++/bpftool
+ bpftool*.8
+ bpf-helpers.*
+ FEATURE-DUMP.bpftool
+diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
+index 7a0014794bff..dd0b68d1f4be 100644
+--- a/tools/lib/bpf/bpf.c
++++ b/tools/lib/bpf/bpf.c
+@@ -53,6 +53,8 @@
+ # define __NR_bpf 349
+ # elif defined(__s390__)
+ # define __NR_bpf 351
++# elif defined(__arc__)
++# define __NR_bpf 280
+ # else
+ # error __NR_bpf not defined. libbpf does not support your arch.
+ # endif
+diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
+index 6f38164b2618..c3145ab3bdca 100644
+--- a/tools/lib/bpf/bpf.h
++++ b/tools/lib/bpf/bpf.h
+@@ -26,6 +26,7 @@
+ #include <linux/bpf.h>
+ #include <stdbool.h>
+ #include <stddef.h>
++#include <stdint.h>
+
+ struct bpf_create_map_attr {
+ const char *name;
+diff --git a/tools/testing/selftests/bpf/test_libbpf_open.c b/tools/testing/selftests/bpf/test_libbpf_open.c
+index 8fcd1c076add..cbd55f5f8d59 100644
+--- a/tools/testing/selftests/bpf/test_libbpf_open.c
++++ b/tools/testing/selftests/bpf/test_libbpf_open.c
+@@ -11,6 +11,8 @@ static const char *__doc__ =
+ #include <bpf/libbpf.h>
+ #include <getopt.h>
+
++#include "bpf_rlimit.h"
++
+ static const struct option long_options[] = {
+ {"help", no_argument, NULL, 'h' },
+ {"debug", no_argument, NULL, 'D' },
+diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
+index cabe2a3a3b30..cf156b353679 100644
+--- a/tools/testing/selftests/bpf/trace_helpers.c
++++ b/tools/testing/selftests/bpf/trace_helpers.c
+@@ -51,6 +51,10 @@ struct ksym *ksym_search(long key)
+ int start = 0, end = sym_cnt;
+ int result;
+
++ /* kallsyms not loaded. return NULL */
++ if (sym_cnt <= 0)
++ return NULL;
++
+ while (start < end) {
+ size_t mid = start + (end - start) / 2;
+
+diff --git a/tools/testing/selftests/cgroup/test_memcontrol.c b/tools/testing/selftests/cgroup/test_memcontrol.c
+index 28d321ba311b..6f339882a6ca 100644
+--- a/tools/testing/selftests/cgroup/test_memcontrol.c
++++ b/tools/testing/selftests/cgroup/test_memcontrol.c
+@@ -26,7 +26,7 @@
+ */
+ static int test_memcg_subtree_control(const char *root)
+ {
+- char *parent, *child, *parent2, *child2;
++ char *parent, *child, *parent2 = NULL, *child2 = NULL;
+ int ret = KSFT_FAIL;
+ char buf[PAGE_SIZE];
+
+@@ -34,50 +34,54 @@ static int test_memcg_subtree_control(const char *root)
+ parent = cg_name(root, "memcg_test_0");
+ child = cg_name(root, "memcg_test_0/memcg_test_1");
+ if (!parent || !child)
+- goto cleanup;
++ goto cleanup_free;
+
+ if (cg_create(parent))
+- goto cleanup;
++ goto cleanup_free;
+
+ if (cg_write(parent, "cgroup.subtree_control", "+memory"))
+- goto cleanup;
++ goto cleanup_parent;
+
+ if (cg_create(child))
+- goto cleanup;
++ goto cleanup_parent;
+
+ if (cg_read_strstr(child, "cgroup.controllers", "memory"))
+- goto cleanup;
++ goto cleanup_child;
+
+ /* Create two nested cgroups without enabling memory controller */
+ parent2 = cg_name(root, "memcg_test_1");
+ child2 = cg_name(root, "memcg_test_1/memcg_test_1");
+ if (!parent2 || !child2)
+- goto cleanup;
++ goto cleanup_free2;
+
+ if (cg_create(parent2))
+- goto cleanup;
++ goto cleanup_free2;
+
+ if (cg_create(child2))
+- goto cleanup;
++ goto cleanup_parent2;
+
+ if (cg_read(child2, "cgroup.controllers", buf, sizeof(buf)))
+- goto cleanup;
++ goto cleanup_all;
+
+ if (!cg_read_strstr(child2, "cgroup.controllers", "memory"))
+- goto cleanup;
++ goto cleanup_all;
+
+ ret = KSFT_PASS;
+
+-cleanup:
+- cg_destroy(child);
+- cg_destroy(parent);
+- free(parent);
+- free(child);
+-
++cleanup_all:
+ cg_destroy(child2);
++cleanup_parent2:
+ cg_destroy(parent2);
++cleanup_free2:
+ free(parent2);
+ free(child2);
++cleanup_child:
++ cg_destroy(child);
++cleanup_parent:
++ cg_destroy(parent);
++cleanup_free:
++ free(parent);
++ free(child);
+
+ return ret;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-06-04 11:11 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-06-04 11:11 UTC (permalink / raw
To: gentoo-commits
commit: 1f5bd0eab3b265afe827baee5f0992f7acfb80a7
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 4 11:11:36 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jun 4 11:11:36 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=1f5bd0ea
Linux patch 4.19.48
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1047_linux-4.19.48.patch | 2086 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2090 insertions(+)
diff --git a/0000_README b/0000_README
index 0c0cd1a..7740baf 100644
--- a/0000_README
+++ b/0000_README
@@ -231,6 +231,10 @@ Patch: 1046_linux-4.19.47.patch
From: http://www.kernel.org
Desc: Linux 4.19.47
+Patch: 1047_linux-4.19.48.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.48
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1047_linux-4.19.48.patch b/1047_linux-4.19.48.patch
new file mode 100644
index 0000000..ad12e2e
--- /dev/null
+++ b/1047_linux-4.19.48.patch
@@ -0,0 +1,2086 @@
+diff --git a/Makefile b/Makefile
+index b3ba28ff73d5..42529a87f3b4 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 47
++SUBLEVEL = 48
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -508,13 +508,6 @@ export RETPOLINE_VDSO_CFLAGS
+ KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
+ KBUILD_AFLAGS += $(call cc-option,-fno-PIE)
+
+-# check for 'asm goto'
+-ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
+- CC_HAVE_ASM_GOTO := 1
+- KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
+- KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
+-endif
+-
+ # The expansion should be delayed until arch/$(SRCARCH)/Makefile is included.
+ # Some architectures define CROSS_COMPILE in arch/$(SRCARCH)/Makefile.
+ # CC_VERSION_TEXT is referenced from Kconfig (so it needs export),
+diff --git a/arch/Kconfig b/arch/Kconfig
+index 6801123932a5..a336548487e6 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -71,6 +71,7 @@ config KPROBES
+ config JUMP_LABEL
+ bool "Optimize very unlikely/likely branches"
+ depends on HAVE_ARCH_JUMP_LABEL
++ depends on CC_HAS_ASM_GOTO
+ help
+ This option enables a transparent branch optimization that
+ makes certain almost-always-true or almost-always-false branch
+diff --git a/arch/arm/kernel/jump_label.c b/arch/arm/kernel/jump_label.c
+index 90bce3d9928e..303b3ab87f7e 100644
+--- a/arch/arm/kernel/jump_label.c
++++ b/arch/arm/kernel/jump_label.c
+@@ -4,8 +4,6 @@
+ #include <asm/patch.h>
+ #include <asm/insn.h>
+
+-#ifdef HAVE_JUMP_LABEL
+-
+ static void __arch_jump_label_transform(struct jump_entry *entry,
+ enum jump_label_type type,
+ bool is_static)
+@@ -35,5 +33,3 @@ void arch_jump_label_transform_static(struct jump_entry *entry,
+ {
+ __arch_jump_label_transform(entry, type, true);
+ }
+-
+-#endif
+diff --git a/arch/arm64/kernel/jump_label.c b/arch/arm64/kernel/jump_label.c
+index e0756416e567..b90754aebd12 100644
+--- a/arch/arm64/kernel/jump_label.c
++++ b/arch/arm64/kernel/jump_label.c
+@@ -20,8 +20,6 @@
+ #include <linux/jump_label.h>
+ #include <asm/insn.h>
+
+-#ifdef HAVE_JUMP_LABEL
+-
+ void arch_jump_label_transform(struct jump_entry *entry,
+ enum jump_label_type type)
+ {
+@@ -49,5 +47,3 @@ void arch_jump_label_transform_static(struct jump_entry *entry,
+ * NOP needs to be replaced by a branch.
+ */
+ }
+-
+-#endif /* HAVE_JUMP_LABEL */
+diff --git a/arch/mips/kernel/jump_label.c b/arch/mips/kernel/jump_label.c
+index 32e3168316cd..ab943927f97a 100644
+--- a/arch/mips/kernel/jump_label.c
++++ b/arch/mips/kernel/jump_label.c
+@@ -16,8 +16,6 @@
+ #include <asm/cacheflush.h>
+ #include <asm/inst.h>
+
+-#ifdef HAVE_JUMP_LABEL
+-
+ /*
+ * Define parameters for the standard MIPS and the microMIPS jump
+ * instruction encoding respectively:
+@@ -70,5 +68,3 @@ void arch_jump_label_transform(struct jump_entry *e,
+
+ mutex_unlock(&text_mutex);
+ }
+-
+-#endif /* HAVE_JUMP_LABEL */
+diff --git a/arch/powerpc/include/asm/asm-prototypes.h b/arch/powerpc/include/asm/asm-prototypes.h
+index 1f4691ce4126..e398173ae67d 100644
+--- a/arch/powerpc/include/asm/asm-prototypes.h
++++ b/arch/powerpc/include/asm/asm-prototypes.h
+@@ -38,7 +38,7 @@ extern struct static_key hcall_tracepoint_key;
+ void __trace_hcall_entry(unsigned long opcode, unsigned long *args);
+ void __trace_hcall_exit(long opcode, long retval, unsigned long *retbuf);
+ /* OPAL tracing */
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ extern struct static_key opal_tracepoint_key;
+ #endif
+
+diff --git a/arch/powerpc/kernel/jump_label.c b/arch/powerpc/kernel/jump_label.c
+index 6472472093d0..0080c5fbd225 100644
+--- a/arch/powerpc/kernel/jump_label.c
++++ b/arch/powerpc/kernel/jump_label.c
+@@ -11,7 +11,6 @@
+ #include <linux/jump_label.h>
+ #include <asm/code-patching.h>
+
+-#ifdef HAVE_JUMP_LABEL
+ void arch_jump_label_transform(struct jump_entry *entry,
+ enum jump_label_type type)
+ {
+@@ -22,4 +21,3 @@ void arch_jump_label_transform(struct jump_entry *entry,
+ else
+ patch_instruction(addr, PPC_INST_NOP);
+ }
+-#endif
+diff --git a/arch/powerpc/platforms/powernv/opal-tracepoints.c b/arch/powerpc/platforms/powernv/opal-tracepoints.c
+index 1ab7d26c0a2c..f16a43540e30 100644
+--- a/arch/powerpc/platforms/powernv/opal-tracepoints.c
++++ b/arch/powerpc/platforms/powernv/opal-tracepoints.c
+@@ -4,7 +4,7 @@
+ #include <asm/trace.h>
+ #include <asm/asm-prototypes.h>
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ struct static_key opal_tracepoint_key = STATIC_KEY_INIT;
+
+ int opal_tracepoint_regfunc(void)
+diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
+index 251528231a9e..f4875fe3f8ff 100644
+--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
++++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
+@@ -20,7 +20,7 @@
+ .section ".text"
+
+ #ifdef CONFIG_TRACEPOINTS
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ #define OPAL_BRANCH(LABEL) \
+ ARCH_STATIC_BRANCH(LABEL, opal_tracepoint_key)
+ #else
+diff --git a/arch/powerpc/platforms/pseries/hvCall.S b/arch/powerpc/platforms/pseries/hvCall.S
+index d91412c591ef..50dc9426d0be 100644
+--- a/arch/powerpc/platforms/pseries/hvCall.S
++++ b/arch/powerpc/platforms/pseries/hvCall.S
+@@ -19,7 +19,7 @@
+
+ #ifdef CONFIG_TRACEPOINTS
+
+-#ifndef HAVE_JUMP_LABEL
++#ifndef CONFIG_JUMP_LABEL
+ .section ".toc","aw"
+
+ .globl hcall_tracepoint_refcount
+@@ -79,7 +79,7 @@ hcall_tracepoint_refcount:
+ mr r5,BUFREG; \
+ __HCALL_INST_POSTCALL
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ #define HCALL_BRANCH(LABEL) \
+ ARCH_STATIC_BRANCH(LABEL, hcall_tracepoint_key)
+ #else
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index d3992ced0782..9e52b686a8fa 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -828,7 +828,7 @@ EXPORT_SYMBOL(arch_free_page);
+ #endif /* CONFIG_PPC_BOOK3S_64 */
+
+ #ifdef CONFIG_TRACEPOINTS
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ struct static_key hcall_tracepoint_key = STATIC_KEY_INIT;
+
+ int hcall_tracepoint_regfunc(void)
+diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
+index dbfd1730e631..b205c0ff0b22 100644
+--- a/arch/s390/kernel/Makefile
++++ b/arch/s390/kernel/Makefile
+@@ -44,7 +44,7 @@ CFLAGS_ptrace.o += -DUTS_MACHINE='"$(UTS_MACHINE)"'
+ obj-y := traps.o time.o process.o base.o early.o setup.o idle.o vtime.o
+ obj-y += processor.o sys_s390.o ptrace.o signal.o cpcmd.o ebcdic.o nmi.o
+ obj-y += debug.o irq.o ipl.o dis.o diag.o vdso.o early_nobss.o
+-obj-y += sysinfo.o jump_label.o lgr.o os_info.o machine_kexec.o pgm_check.o
++obj-y += sysinfo.o lgr.o os_info.o machine_kexec.o pgm_check.o
+ obj-y += runtime_instr.o cache.o fpu.o dumpstack.o guarded_storage.o sthyi.o
+ obj-y += entry.o reipl.o relocate_kernel.o kdebugfs.o alternative.o
+ obj-y += nospec-branch.o
+@@ -68,6 +68,7 @@ obj-$(CONFIG_KPROBES) += kprobes.o
+ obj-$(CONFIG_FUNCTION_TRACER) += mcount.o ftrace.o
+ obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
+ obj-$(CONFIG_UPROBES) += uprobes.o
++obj-$(CONFIG_JUMP_LABEL) += jump_label.o
+
+ obj-$(CONFIG_KEXEC_FILE) += machine_kexec_file.o kexec_image.o
+ obj-$(CONFIG_KEXEC_FILE) += kexec_elf.o
+diff --git a/arch/s390/kernel/jump_label.c b/arch/s390/kernel/jump_label.c
+index 43f8430fb67d..68f415e334a5 100644
+--- a/arch/s390/kernel/jump_label.c
++++ b/arch/s390/kernel/jump_label.c
+@@ -10,8 +10,6 @@
+ #include <linux/jump_label.h>
+ #include <asm/ipl.h>
+
+-#ifdef HAVE_JUMP_LABEL
+-
+ struct insn {
+ u16 opcode;
+ s32 offset;
+@@ -102,5 +100,3 @@ void arch_jump_label_transform_static(struct jump_entry *entry,
+ {
+ __jump_label_transform(entry, type, 1);
+ }
+-
+-#endif
+diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
+index cf8640841b7a..97c0e19263d1 100644
+--- a/arch/sparc/kernel/Makefile
++++ b/arch/sparc/kernel/Makefile
+@@ -118,4 +118,4 @@ pc--$(CONFIG_PERF_EVENTS) := perf_event.o
+ obj-$(CONFIG_SPARC64) += $(pc--y)
+
+ obj-$(CONFIG_UPROBES) += uprobes.o
+-obj-$(CONFIG_SPARC64) += jump_label.o
++obj-$(CONFIG_JUMP_LABEL) += jump_label.o
+diff --git a/arch/sparc/kernel/jump_label.c b/arch/sparc/kernel/jump_label.c
+index 7f8eac51df33..a4cfaeecaf5e 100644
+--- a/arch/sparc/kernel/jump_label.c
++++ b/arch/sparc/kernel/jump_label.c
+@@ -9,8 +9,6 @@
+
+ #include <asm/cacheflush.h>
+
+-#ifdef HAVE_JUMP_LABEL
+-
+ void arch_jump_label_transform(struct jump_entry *entry,
+ enum jump_label_type type)
+ {
+@@ -47,5 +45,3 @@ void arch_jump_label_transform(struct jump_entry *entry,
+ flushi(insn);
+ mutex_unlock(&text_mutex);
+ }
+-
+-#endif
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index ab2071e40efe..ce0d0424a53d 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -305,7 +305,7 @@ vdso_install:
+
+ archprepare: checkbin
+ checkbin:
+-ifndef CC_HAVE_ASM_GOTO
++ifndef CONFIG_CC_HAS_ASM_GOTO
+ @echo Compiler lacks asm-goto support.
+ @exit 1
+ endif
+diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
+index 352e70cd33e8..e699b2041665 100644
+--- a/arch/x86/entry/calling.h
++++ b/arch/x86/entry/calling.h
+@@ -337,7 +337,7 @@ For 32-bit we have the following conventions - kernel is built with
+ */
+ .macro CALL_enter_from_user_mode
+ #ifdef CONFIG_CONTEXT_TRACKING
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ STATIC_JUMP_IF_FALSE .Lafter_call_\@, context_tracking_enabled, def=0
+ #endif
+ call enter_from_user_mode
+diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
+index aced6c9290d6..ce95b8cbd229 100644
+--- a/arch/x86/include/asm/cpufeature.h
++++ b/arch/x86/include/asm/cpufeature.h
+@@ -140,7 +140,7 @@ extern void clear_cpu_cap(struct cpuinfo_x86 *c, unsigned int bit);
+
+ #define setup_force_cpu_bug(bit) setup_force_cpu_cap(bit)
+
+-#if defined(__clang__) && !defined(CC_HAVE_ASM_GOTO)
++#if defined(__clang__) && !defined(CONFIG_CC_HAS_ASM_GOTO)
+
+ /*
+ * Workaround for the sake of BPF compilation which utilizes kernel
+diff --git a/arch/x86/include/asm/jump_label.h b/arch/x86/include/asm/jump_label.h
+index 8c0de4282659..7010e1c594c4 100644
+--- a/arch/x86/include/asm/jump_label.h
++++ b/arch/x86/include/asm/jump_label.h
+@@ -2,19 +2,6 @@
+ #ifndef _ASM_X86_JUMP_LABEL_H
+ #define _ASM_X86_JUMP_LABEL_H
+
+-#ifndef HAVE_JUMP_LABEL
+-/*
+- * For better or for worse, if jump labels (the gcc extension) are missing,
+- * then the entire static branch patching infrastructure is compiled out.
+- * If that happens, the code in here will malfunction. Raise a compiler
+- * error instead.
+- *
+- * In theory, jump labels and the static branch patching infrastructure
+- * could be decoupled to fix this.
+- */
+-#error asm/jump_label.h included on a non-jump-label kernel
+-#endif
+-
+ #define JUMP_LABEL_NOP_SIZE 5
+
+ #ifdef CONFIG_X86_64
+diff --git a/arch/x86/include/asm/rmwcc.h b/arch/x86/include/asm/rmwcc.h
+index 4914a3e7c803..033dc7ca49e9 100644
+--- a/arch/x86/include/asm/rmwcc.h
++++ b/arch/x86/include/asm/rmwcc.h
+@@ -4,7 +4,7 @@
+
+ #define __CLOBBERS_MEM(clb...) "memory", ## clb
+
+-#if !defined(__GCC_ASM_FLAG_OUTPUTS__) && defined(CC_HAVE_ASM_GOTO)
++#if !defined(__GCC_ASM_FLAG_OUTPUTS__) && defined(CONFIG_CC_HAS_ASM_GOTO)
+
+ /* Use asm goto */
+
+@@ -21,7 +21,7 @@ cc_label: \
+ #define __BINARY_RMWcc_ARG " %1, "
+
+
+-#else /* defined(__GCC_ASM_FLAG_OUTPUTS__) || !defined(CC_HAVE_ASM_GOTO) */
++#else /* defined(__GCC_ASM_FLAG_OUTPUTS__) || !defined(CONFIG_CC_HAS_ASM_GOTO) */
+
+ /* Use flags output or a set instruction */
+
+@@ -36,7 +36,7 @@ do { \
+
+ #define __BINARY_RMWcc_ARG " %2, "
+
+-#endif /* defined(__GCC_ASM_FLAG_OUTPUTS__) || !defined(CC_HAVE_ASM_GOTO) */
++#endif /* defined(__GCC_ASM_FLAG_OUTPUTS__) || !defined(CONFIG_CC_HAS_ASM_GOTO) */
+
+ #define GEN_UNARY_RMWcc(op, var, arg0, cc) \
+ __GEN_RMWcc(op " " arg0, var, cc, __CLOBBERS_MEM())
+diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
+index 8824d01c0c35..da0b6bc090f3 100644
+--- a/arch/x86/kernel/Makefile
++++ b/arch/x86/kernel/Makefile
+@@ -49,7 +49,8 @@ obj-$(CONFIG_COMPAT) += signal_compat.o
+ obj-y += traps.o idt.o irq.o irq_$(BITS).o dumpstack_$(BITS).o
+ obj-y += time.o ioport.o dumpstack.o nmi.o
+ obj-$(CONFIG_MODIFY_LDT_SYSCALL) += ldt.o
+-obj-y += setup.o x86_init.o i8259.o irqinit.o jump_label.o
++obj-y += setup.o x86_init.o i8259.o irqinit.o
++obj-$(CONFIG_JUMP_LABEL) += jump_label.o
+ obj-$(CONFIG_IRQ_WORK) += irq_work.o
+ obj-y += probe_roms.o
+ obj-$(CONFIG_X86_64) += sys_x86_64.o
+diff --git a/arch/x86/kernel/jump_label.c b/arch/x86/kernel/jump_label.c
+index eeea935e9bb5..4c3d9a3d45b2 100644
+--- a/arch/x86/kernel/jump_label.c
++++ b/arch/x86/kernel/jump_label.c
+@@ -16,8 +16,6 @@
+ #include <asm/alternative.h>
+ #include <asm/text-patching.h>
+
+-#ifdef HAVE_JUMP_LABEL
+-
+ union jump_code_union {
+ char code[JUMP_LABEL_NOP_SIZE];
+ struct {
+@@ -142,5 +140,3 @@ __init_or_module void arch_jump_label_transform_static(struct jump_entry *entry,
+ if (jlstate == JL_STATE_UPDATE)
+ __jump_label_transform(entry, type, text_poke_early, 1);
+ }
+-
+-#endif
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 860bd271619d..4a688ef9e448 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -456,7 +456,7 @@ FOP_END;
+
+ /*
+ * XXX: inoutclob user must know where the argument is being expanded.
+- * Relying on CC_HAVE_ASM_GOTO would allow us to remove _fault.
++ * Relying on CONFIG_CC_HAS_ASM_GOTO would allow us to remove _fault.
+ */
+ #define asm_safe(insn, inoutclob...) \
+ ({ \
+diff --git a/drivers/crypto/vmx/ghash.c b/drivers/crypto/vmx/ghash.c
+index dd8b8716467a..2d1a8cd35509 100644
+--- a/drivers/crypto/vmx/ghash.c
++++ b/drivers/crypto/vmx/ghash.c
+@@ -1,22 +1,14 @@
++// SPDX-License-Identifier: GPL-2.0
+ /**
+ * GHASH routines supporting VMX instructions on the Power 8
+ *
+- * Copyright (C) 2015 International Business Machines Inc.
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; version 2 only.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- * GNU General Public License for more details.
+- *
+- * You should have received a copy of the GNU General Public License
+- * along with this program; if not, write to the Free Software
+- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
++ * Copyright (C) 2015, 2019 International Business Machines Inc.
+ *
+ * Author: Marcelo Henrique Cerri <mhcerri@br.ibm.com>
++ *
++ * Extended by Daniel Axtens <dja@axtens.net> to replace the fallback
++ * mechanism. The new approach is based on arm64 code, which is:
++ * Copyright (C) 2014 - 2018 Linaro Ltd. <ard.biesheuvel@linaro.org>
+ */
+
+ #include <linux/types.h>
+@@ -39,71 +31,25 @@ void gcm_ghash_p8(u64 Xi[2], const u128 htable[16],
+ const u8 *in, size_t len);
+
+ struct p8_ghash_ctx {
++ /* key used by vector asm */
+ u128 htable[16];
+- struct crypto_shash *fallback;
++ /* key used by software fallback */
++ be128 key;
+ };
+
+ struct p8_ghash_desc_ctx {
+ u64 shash[2];
+ u8 buffer[GHASH_DIGEST_SIZE];
+ int bytes;
+- struct shash_desc fallback_desc;
+ };
+
+-static int p8_ghash_init_tfm(struct crypto_tfm *tfm)
+-{
+- const char *alg = "ghash-generic";
+- struct crypto_shash *fallback;
+- struct crypto_shash *shash_tfm = __crypto_shash_cast(tfm);
+- struct p8_ghash_ctx *ctx = crypto_tfm_ctx(tfm);
+-
+- fallback = crypto_alloc_shash(alg, 0, CRYPTO_ALG_NEED_FALLBACK);
+- if (IS_ERR(fallback)) {
+- printk(KERN_ERR
+- "Failed to allocate transformation for '%s': %ld\n",
+- alg, PTR_ERR(fallback));
+- return PTR_ERR(fallback);
+- }
+-
+- crypto_shash_set_flags(fallback,
+- crypto_shash_get_flags((struct crypto_shash
+- *) tfm));
+-
+- /* Check if the descsize defined in the algorithm is still enough. */
+- if (shash_tfm->descsize < sizeof(struct p8_ghash_desc_ctx)
+- + crypto_shash_descsize(fallback)) {
+- printk(KERN_ERR
+- "Desc size of the fallback implementation (%s) does not match the expected value: %lu vs %u\n",
+- alg,
+- shash_tfm->descsize - sizeof(struct p8_ghash_desc_ctx),
+- crypto_shash_descsize(fallback));
+- return -EINVAL;
+- }
+- ctx->fallback = fallback;
+-
+- return 0;
+-}
+-
+-static void p8_ghash_exit_tfm(struct crypto_tfm *tfm)
+-{
+- struct p8_ghash_ctx *ctx = crypto_tfm_ctx(tfm);
+-
+- if (ctx->fallback) {
+- crypto_free_shash(ctx->fallback);
+- ctx->fallback = NULL;
+- }
+-}
+-
+ static int p8_ghash_init(struct shash_desc *desc)
+ {
+- struct p8_ghash_ctx *ctx = crypto_tfm_ctx(crypto_shash_tfm(desc->tfm));
+ struct p8_ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+
+ dctx->bytes = 0;
+ memset(dctx->shash, 0, GHASH_DIGEST_SIZE);
+- dctx->fallback_desc.tfm = ctx->fallback;
+- dctx->fallback_desc.flags = desc->flags;
+- return crypto_shash_init(&dctx->fallback_desc);
++ return 0;
+ }
+
+ static int p8_ghash_setkey(struct crypto_shash *tfm, const u8 *key,
+@@ -121,7 +67,51 @@ static int p8_ghash_setkey(struct crypto_shash *tfm, const u8 *key,
+ disable_kernel_vsx();
+ pagefault_enable();
+ preempt_enable();
+- return crypto_shash_setkey(ctx->fallback, key, keylen);
++
++ memcpy(&ctx->key, key, GHASH_BLOCK_SIZE);
++
++ return 0;
++}
++
++static inline void __ghash_block(struct p8_ghash_ctx *ctx,
++ struct p8_ghash_desc_ctx *dctx)
++{
++ if (!IN_INTERRUPT) {
++ preempt_disable();
++ pagefault_disable();
++ enable_kernel_vsx();
++ gcm_ghash_p8(dctx->shash, ctx->htable,
++ dctx->buffer, GHASH_DIGEST_SIZE);
++ disable_kernel_vsx();
++ pagefault_enable();
++ preempt_enable();
++ } else {
++ crypto_xor((u8 *)dctx->shash, dctx->buffer, GHASH_BLOCK_SIZE);
++ gf128mul_lle((be128 *)dctx->shash, &ctx->key);
++ }
++}
++
++static inline void __ghash_blocks(struct p8_ghash_ctx *ctx,
++ struct p8_ghash_desc_ctx *dctx,
++ const u8 *src, unsigned int srclen)
++{
++ if (!IN_INTERRUPT) {
++ preempt_disable();
++ pagefault_disable();
++ enable_kernel_vsx();
++ gcm_ghash_p8(dctx->shash, ctx->htable,
++ src, srclen);
++ disable_kernel_vsx();
++ pagefault_enable();
++ preempt_enable();
++ } else {
++ while (srclen >= GHASH_BLOCK_SIZE) {
++ crypto_xor((u8 *)dctx->shash, src, GHASH_BLOCK_SIZE);
++ gf128mul_lle((be128 *)dctx->shash, &ctx->key);
++ srclen -= GHASH_BLOCK_SIZE;
++ src += GHASH_BLOCK_SIZE;
++ }
++ }
+ }
+
+ static int p8_ghash_update(struct shash_desc *desc,
+@@ -131,49 +121,33 @@ static int p8_ghash_update(struct shash_desc *desc,
+ struct p8_ghash_ctx *ctx = crypto_tfm_ctx(crypto_shash_tfm(desc->tfm));
+ struct p8_ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+
+- if (IN_INTERRUPT) {
+- return crypto_shash_update(&dctx->fallback_desc, src,
+- srclen);
+- } else {
+- if (dctx->bytes) {
+- if (dctx->bytes + srclen < GHASH_DIGEST_SIZE) {
+- memcpy(dctx->buffer + dctx->bytes, src,
+- srclen);
+- dctx->bytes += srclen;
+- return 0;
+- }
++ if (dctx->bytes) {
++ if (dctx->bytes + srclen < GHASH_DIGEST_SIZE) {
+ memcpy(dctx->buffer + dctx->bytes, src,
+- GHASH_DIGEST_SIZE - dctx->bytes);
+- preempt_disable();
+- pagefault_disable();
+- enable_kernel_vsx();
+- gcm_ghash_p8(dctx->shash, ctx->htable,
+- dctx->buffer, GHASH_DIGEST_SIZE);
+- disable_kernel_vsx();
+- pagefault_enable();
+- preempt_enable();
+- src += GHASH_DIGEST_SIZE - dctx->bytes;
+- srclen -= GHASH_DIGEST_SIZE - dctx->bytes;
+- dctx->bytes = 0;
+- }
+- len = srclen & ~(GHASH_DIGEST_SIZE - 1);
+- if (len) {
+- preempt_disable();
+- pagefault_disable();
+- enable_kernel_vsx();
+- gcm_ghash_p8(dctx->shash, ctx->htable, src, len);
+- disable_kernel_vsx();
+- pagefault_enable();
+- preempt_enable();
+- src += len;
+- srclen -= len;
+- }
+- if (srclen) {
+- memcpy(dctx->buffer, src, srclen);
+- dctx->bytes = srclen;
++ srclen);
++ dctx->bytes += srclen;
++ return 0;
+ }
+- return 0;
++ memcpy(dctx->buffer + dctx->bytes, src,
++ GHASH_DIGEST_SIZE - dctx->bytes);
++
++ __ghash_block(ctx, dctx);
++
++ src += GHASH_DIGEST_SIZE - dctx->bytes;
++ srclen -= GHASH_DIGEST_SIZE - dctx->bytes;
++ dctx->bytes = 0;
++ }
++ len = srclen & ~(GHASH_DIGEST_SIZE - 1);
++ if (len) {
++ __ghash_blocks(ctx, dctx, src, len);
++ src += len;
++ srclen -= len;
+ }
++ if (srclen) {
++ memcpy(dctx->buffer, src, srclen);
++ dctx->bytes = srclen;
++ }
++ return 0;
+ }
+
+ static int p8_ghash_final(struct shash_desc *desc, u8 *out)
+@@ -182,25 +156,14 @@ static int p8_ghash_final(struct shash_desc *desc, u8 *out)
+ struct p8_ghash_ctx *ctx = crypto_tfm_ctx(crypto_shash_tfm(desc->tfm));
+ struct p8_ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+
+- if (IN_INTERRUPT) {
+- return crypto_shash_final(&dctx->fallback_desc, out);
+- } else {
+- if (dctx->bytes) {
+- for (i = dctx->bytes; i < GHASH_DIGEST_SIZE; i++)
+- dctx->buffer[i] = 0;
+- preempt_disable();
+- pagefault_disable();
+- enable_kernel_vsx();
+- gcm_ghash_p8(dctx->shash, ctx->htable,
+- dctx->buffer, GHASH_DIGEST_SIZE);
+- disable_kernel_vsx();
+- pagefault_enable();
+- preempt_enable();
+- dctx->bytes = 0;
+- }
+- memcpy(out, dctx->shash, GHASH_DIGEST_SIZE);
+- return 0;
++ if (dctx->bytes) {
++ for (i = dctx->bytes; i < GHASH_DIGEST_SIZE; i++)
++ dctx->buffer[i] = 0;
++ __ghash_block(ctx, dctx);
++ dctx->bytes = 0;
+ }
++ memcpy(out, dctx->shash, GHASH_DIGEST_SIZE);
++ return 0;
+ }
+
+ struct shash_alg p8_ghash_alg = {
+@@ -215,11 +178,8 @@ struct shash_alg p8_ghash_alg = {
+ .cra_name = "ghash",
+ .cra_driver_name = "p8_ghash",
+ .cra_priority = 1000,
+- .cra_flags = CRYPTO_ALG_NEED_FALLBACK,
+ .cra_blocksize = GHASH_BLOCK_SIZE,
+ .cra_ctxsize = sizeof(struct p8_ghash_ctx),
+ .cra_module = THIS_MODULE,
+- .cra_init = p8_ghash_init_tfm,
+- .cra_exit = p8_ghash_exit_tfm,
+ },
+ };
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 091b454e83fc..039beb5e0fa2 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3107,13 +3107,18 @@ static int bond_slave_netdev_event(unsigned long event,
+ case NETDEV_CHANGE:
+ /* For 802.3ad mode only:
+ * Getting invalid Speed/Duplex values here will put slave
+- * in weird state. So mark it as link-fail for the time
+- * being and let link-monitoring (miimon) set it right when
+- * correct speeds/duplex are available.
++ * in weird state. Mark it as link-fail if the link was
++ * previously up or link-down if it hasn't yet come up, and
++ * let link-monitoring (miimon) set it right when correct
++ * speeds/duplex are available.
+ */
+ if (bond_update_speed_duplex(slave) &&
+- BOND_MODE(bond) == BOND_MODE_8023AD)
+- slave->link = BOND_LINK_FAIL;
++ BOND_MODE(bond) == BOND_MODE_8023AD) {
++ if (slave->last_link_up)
++ slave->link = BOND_LINK_FAIL;
++ else
++ slave->link = BOND_LINK_DOWN;
++ }
+
+ if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ bond_3ad_adapter_speed_duplex_changed(slave);
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 2caa5c0c2bc4..dfaad1c2c2b8 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -877,7 +877,7 @@ static uint64_t _mv88e6xxx_get_ethtool_stat(struct mv88e6xxx_chip *chip,
+ err = mv88e6xxx_port_read(chip, port, s->reg + 1, ®);
+ if (err)
+ return U64_MAX;
+- high = reg;
++ low |= ((u32)reg) << 16;
+ }
+ break;
+ case STATS_TYPE_BANK1:
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index de46331aefc1..c54a74de7b08 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1599,6 +1599,8 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons,
+ skb = bnxt_copy_skb(bnapi, data_ptr, len, dma_addr);
+ bnxt_reuse_rx_data(rxr, cons, data);
+ if (!skb) {
++ if (agg_bufs)
++ bnxt_reuse_rx_agg_bufs(bnapi, cp_cons, agg_bufs);
+ rc = -ENOMEM;
+ goto next_rx;
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+index c116f96956fe..f2aba5b160c2 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+@@ -228,6 +228,9 @@ static void cxgb4_process_flow_match(struct net_device *dev,
+ fs->val.ivlan = vlan_tci;
+ fs->mask.ivlan = vlan_tci_mask;
+
++ fs->val.ivlan_vld = 1;
++ fs->mask.ivlan_vld = 1;
++
+ /* Chelsio adapters use ivlan_vld bit to match vlan packets
+ * as 802.1Q. Also, when vlan tag is present in packets,
+ * ethtype match is used then to match on ethtype of inner
+@@ -238,8 +241,6 @@ static void cxgb4_process_flow_match(struct net_device *dev,
+ * ethtype value with ethtype of inner header.
+ */
+ if (fs->val.ethtype == ETH_P_8021Q) {
+- fs->val.ivlan_vld = 1;
+- fs->mask.ivlan_vld = 1;
+ fs->val.ethtype = 0;
+ fs->mask.ethtype = 0;
+ }
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index ad41ace0a27a..bf715a367273 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3571,7 +3571,7 @@ failed_init:
+ if (fep->reg_phy)
+ regulator_disable(fep->reg_phy);
+ failed_reset:
+- pm_runtime_put(&pdev->dev);
++ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ failed_regulator:
+ clk_disable_unprepare(fep->clk_ahb);
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 2ba0d89aaf3c..28762314353f 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -4611,7 +4611,7 @@ static int mvneta_probe(struct platform_device *pdev)
+ err = register_netdev(dev);
+ if (err < 0) {
+ dev_err(&pdev->dev, "failed to register\n");
+- goto err_free_stats;
++ goto err_netdev;
+ }
+
+ netdev_info(dev, "Using %s mac address %pM\n", mac_from,
+@@ -4622,14 +4622,12 @@ static int mvneta_probe(struct platform_device *pdev)
+ return 0;
+
+ err_netdev:
+- unregister_netdev(dev);
+ if (pp->bm_priv) {
+ mvneta_bm_pool_destroy(pp->bm_priv, pp->pool_long, 1 << pp->id);
+ mvneta_bm_pool_destroy(pp->bm_priv, pp->pool_short,
+ 1 << pp->id);
+ mvneta_bm_put(pp->bm_priv);
+ }
+-err_free_stats:
+ free_percpu(pp->stats);
+ err_free_ports:
+ free_percpu(pp->ports);
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 9b10abb604cb..59212d3d9587 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -1404,7 +1404,7 @@ static inline void mvpp2_xlg_max_rx_size_set(struct mvpp2_port *port)
+ /* Set defaults to the MVPP2 port */
+ static void mvpp2_defaults_set(struct mvpp2_port *port)
+ {
+- int tx_port_num, val, queue, ptxq, lrxq;
++ int tx_port_num, val, queue, lrxq;
+
+ if (port->priv->hw_version == MVPP21) {
+ /* Update TX FIFO MIN Threshold */
+@@ -1422,11 +1422,9 @@ static void mvpp2_defaults_set(struct mvpp2_port *port)
+ mvpp2_write(port->priv, MVPP2_TXP_SCHED_CMD_1_REG, 0);
+
+ /* Close bandwidth for all queues */
+- for (queue = 0; queue < MVPP2_MAX_TXQ; queue++) {
+- ptxq = mvpp2_txq_phys(port->id, queue);
++ for (queue = 0; queue < MVPP2_MAX_TXQ; queue++)
+ mvpp2_write(port->priv,
+- MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(ptxq), 0);
+- }
++ MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(queue), 0);
+
+ /* Set refill period to 1 usec, refill tokens
+ * and bucket size to maximum
+@@ -2271,7 +2269,7 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port,
+ txq->descs_dma = 0;
+
+ /* Set minimum bandwidth for disabled TXQs */
+- mvpp2_write(port->priv, MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(txq->id), 0);
++ mvpp2_write(port->priv, MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(txq->log_id), 0);
+
+ /* Set Tx descriptors queue starting address and size */
+ cpu = get_cpu();
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index b190c447aeb0..0f1c296c3ce4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3734,6 +3734,12 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev,
+ netdev_warn(netdev, "Disabling LRO, not supported in legacy RQ\n");
+ }
+
++ if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS)) {
++ features &= ~NETIF_F_RXHASH;
++ if (netdev->features & NETIF_F_RXHASH)
++ netdev_warn(netdev, "Disabling rxhash, not supported when CQE compress is active\n");
++ }
++
+ mutex_unlock(&priv->state_lock);
+
+ return features;
+@@ -3860,6 +3866,9 @@ int mlx5e_hwstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr)
+ memcpy(&priv->tstamp, &config, sizeof(config));
+ mutex_unlock(&priv->state_lock);
+
++ /* might need to fix some features */
++ netdev_update_features(priv->netdev);
++
+ return copy_to_user(ifr->ifr_data, &config,
+ sizeof(config)) ? -EFAULT : 0;
+ }
+@@ -4702,6 +4711,10 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
+ if (!priv->channels.params.scatter_fcs_en)
+ netdev->features &= ~NETIF_F_RXFCS;
+
++ /* prefere CQE compression over rxhash */
++ if (MLX5E_GET_PFLAG(&priv->channels.params, MLX5E_PFLAG_RX_CQE_COMPRESS))
++ netdev->features &= ~NETIF_F_RXHASH;
++
+ #define FT_CAP(f) MLX5_CAP_FLOWTABLE(mdev, flow_table_properties_nic_receive.f)
+ if (FT_CAP(flow_modify_en) &&
+ FT_CAP(modify_root) &&
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index d181645fd968..c079f85593d6 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -2220,7 +2220,7 @@ static struct mlx5_flow_root_namespace
+ cmds = mlx5_fs_cmd_get_default_ipsec_fpga_cmds(table_type);
+
+ /* Create the root namespace */
+- root_ns = kvzalloc(sizeof(*root_ns), GFP_KERNEL);
++ root_ns = kzalloc(sizeof(*root_ns), GFP_KERNEL);
+ if (!root_ns)
+ return NULL;
+
+@@ -2363,6 +2363,7 @@ static void cleanup_egress_acls_root_ns(struct mlx5_core_dev *dev)
+ cleanup_root_ns(steering->esw_egress_root_ns[i]);
+
+ kfree(steering->esw_egress_root_ns);
++ steering->esw_egress_root_ns = NULL;
+ }
+
+ static void cleanup_ingress_acls_root_ns(struct mlx5_core_dev *dev)
+@@ -2377,6 +2378,7 @@ static void cleanup_ingress_acls_root_ns(struct mlx5_core_dev *dev)
+ cleanup_root_ns(steering->esw_ingress_root_ns[i]);
+
+ kfree(steering->esw_ingress_root_ns);
++ steering->esw_ingress_root_ns = NULL;
+ }
+
+ void mlx5_cleanup_fs(struct mlx5_core_dev *dev)
+@@ -2505,6 +2507,7 @@ cleanup_root_ns:
+ for (i--; i >= 0; i--)
+ cleanup_root_ns(steering->esw_egress_root_ns[i]);
+ kfree(steering->esw_egress_root_ns);
++ steering->esw_egress_root_ns = NULL;
+ return err;
+ }
+
+@@ -2532,6 +2535,7 @@ cleanup_root_ns:
+ for (i--; i >= 0; i--)
+ cleanup_root_ns(steering->esw_ingress_root_ns[i]);
+ kfree(steering->esw_ingress_root_ns);
++ steering->esw_ingress_root_ns = NULL;
+ return err;
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 5debe93ea4eb..50c00822b2d8 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -2195,6 +2195,10 @@ static int stmmac_init_dma_engine(struct stmmac_priv *priv)
+ if (priv->plat->axi)
+ stmmac_axi(priv, priv->ioaddr, priv->plat->axi);
+
++ /* DMA CSR Channel configuration */
++ for (chan = 0; chan < dma_csr_ch; chan++)
++ stmmac_init_chan(priv, priv->ioaddr, priv->plat->dma_cfg, chan);
++
+ /* DMA RX Channel Configuration */
+ for (chan = 0; chan < rx_channels_count; chan++) {
+ rx_q = &priv->rx_queue[chan];
+@@ -2220,10 +2224,6 @@ static int stmmac_init_dma_engine(struct stmmac_priv *priv)
+ tx_q->tx_tail_addr, chan);
+ }
+
+- /* DMA CSR Channel configuration */
+- for (chan = 0; chan < dma_csr_ch; chan++)
+- stmmac_init_chan(priv, priv->ioaddr, priv->plat->dma_cfg, chan);
+-
+ return ret;
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+index bdd351597b55..093a223fe408 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+@@ -267,7 +267,8 @@ int stmmac_mdio_reset(struct mii_bus *bus)
+ of_property_read_u32_array(np,
+ "snps,reset-delays-us", data->delays, 3);
+
+- if (gpio_request(data->reset_gpio, "mdio-reset"))
++ if (devm_gpio_request(priv->device, data->reset_gpio,
++ "mdio-reset"))
+ return 0;
+ }
+
+diff --git a/drivers/net/phy/marvell10g.c b/drivers/net/phy/marvell10g.c
+index f77a2d9e7f9d..456a1f882b09 100644
+--- a/drivers/net/phy/marvell10g.c
++++ b/drivers/net/phy/marvell10g.c
+@@ -27,6 +27,9 @@
+ #include <linux/phy.h>
+
+ enum {
++ MV_PMA_BOOT = 0xc050,
++ MV_PMA_BOOT_FATAL = BIT(0),
++
+ MV_PCS_BASE_T = 0x0000,
+ MV_PCS_BASE_R = 0x1000,
+ MV_PCS_1000BASEX = 0x2000,
+@@ -226,6 +229,16 @@ static int mv3310_probe(struct phy_device *phydev)
+ (phydev->c45_ids.devices_in_package & mmd_mask) != mmd_mask)
+ return -ENODEV;
+
++ ret = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MV_PMA_BOOT);
++ if (ret < 0)
++ return ret;
++
++ if (ret & MV_PMA_BOOT_FATAL) {
++ dev_warn(&phydev->mdio.dev,
++ "PHY failed to boot firmware, status=%04x\n", ret);
++ return -ENODEV;
++ }
++
+ priv = devm_kzalloc(&phydev->mdio.dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 770aa624147f..10854977c55f 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -506,6 +506,7 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
+
+ if (netif_running (dev->net) &&
+ netif_device_present (dev->net) &&
++ test_bit(EVENT_DEV_OPEN, &dev->flags) &&
+ !test_bit (EVENT_RX_HALT, &dev->flags) &&
+ !test_bit (EVENT_DEV_ASLEEP, &dev->flags)) {
+ switch (retval = usb_submit_urb (urb, GFP_ATOMIC)) {
+@@ -1431,6 +1432,11 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
+ spin_unlock_irqrestore(&dev->txq.lock, flags);
+ goto drop;
+ }
++ if (netif_queue_stopped(net)) {
++ usb_autopm_put_interface_async(dev->intf);
++ spin_unlock_irqrestore(&dev->txq.lock, flags);
++ goto drop;
++ }
+
+ #ifdef CONFIG_PM
+ /* if this triggers the device is still a sleep */
+diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
+index ea4a08b83fa0..787966f44589 100644
+--- a/drivers/xen/xen-pciback/pciback_ops.c
++++ b/drivers/xen/xen-pciback/pciback_ops.c
+@@ -127,8 +127,6 @@ void xen_pcibk_reset_device(struct pci_dev *dev)
+ if (pci_is_enabled(dev))
+ pci_disable_device(dev);
+
+- pci_write_config_word(dev, PCI_COMMAND, 0);
+-
+ dev->is_busmaster = 0;
+ } else {
+ pci_read_config_word(dev, PCI_COMMAND, &cmd);
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 81c2238b884c..bb22908c79e8 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -319,29 +319,14 @@ static inline void *offset_to_ptr(const int *off)
+ #endif
+ #ifndef __compiletime_error
+ # define __compiletime_error(message)
+-/*
+- * Sparse complains of variable sized arrays due to the temporary variable in
+- * __compiletime_assert. Unfortunately we can't just expand it out to make
+- * sparse see a constant array size without breaking compiletime_assert on old
+- * versions of GCC (e.g. 4.2.4), so hide the array from sparse altogether.
+- */
+-# ifndef __CHECKER__
+-# define __compiletime_error_fallback(condition) \
+- do { ((void)sizeof(char[1 - 2 * condition])); } while (0)
+-# endif
+-#endif
+-#ifndef __compiletime_error_fallback
+-# define __compiletime_error_fallback(condition) do { } while (0)
+ #endif
+
+ #ifdef __OPTIMIZE__
+ # define __compiletime_assert(condition, msg, prefix, suffix) \
+ do { \
+- int __cond = !(condition); \
+ extern void prefix ## suffix(void) __compiletime_error(msg); \
+- if (__cond) \
++ if (!(condition)) \
+ prefix ## suffix(); \
+- __compiletime_error_fallback(__cond); \
+ } while (0)
+ #else
+ # define __compiletime_assert(condition, msg, prefix, suffix) do { } while (0)
+diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
+index db192becfec4..c2ded31a4cec 100644
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -151,6 +151,10 @@ struct ftrace_likely_data {
+ #define __assume_aligned(a, ...)
+ #endif
+
++#ifndef asm_volatile_goto
++#define asm_volatile_goto(x...) asm goto(x)
++#endif
++
+ /* Are two types/vars the same type (ignoring qualifiers)? */
+ #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
+
+diff --git a/include/linux/dynamic_debug.h b/include/linux/dynamic_debug.h
+index 2fd8006153c3..b3419da1a776 100644
+--- a/include/linux/dynamic_debug.h
++++ b/include/linux/dynamic_debug.h
+@@ -2,7 +2,7 @@
+ #ifndef _DYNAMIC_DEBUG_H
+ #define _DYNAMIC_DEBUG_H
+
+-#if defined(CC_HAVE_ASM_GOTO) && defined(CONFIG_JUMP_LABEL)
++#if defined(CONFIG_JUMP_LABEL)
+ #include <linux/jump_label.h>
+ #endif
+
+@@ -38,7 +38,7 @@ struct _ddebug {
+ #define _DPRINTK_FLAGS_DEFAULT 0
+ #endif
+ unsigned int flags:8;
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ union {
+ struct static_key_true dd_key_true;
+ struct static_key_false dd_key_false;
+@@ -83,7 +83,7 @@ void __dynamic_netdev_dbg(struct _ddebug *descriptor,
+ dd_key_init(key, init) \
+ }
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+
+ #define dd_key_init(key, init) key = (init)
+
+diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
+index 1a0b6f17a5d6..4c3e77687d4e 100644
+--- a/include/linux/jump_label.h
++++ b/include/linux/jump_label.h
+@@ -71,10 +71,6 @@
+ * Additional babbling in: Documentation/static-keys.txt
+ */
+
+-#if defined(CC_HAVE_ASM_GOTO) && defined(CONFIG_JUMP_LABEL)
+-# define HAVE_JUMP_LABEL
+-#endif
+-
+ #ifndef __ASSEMBLY__
+
+ #include <linux/types.h>
+@@ -86,7 +82,7 @@ extern bool static_key_initialized;
+ "%s(): static key '%pS' used before call to jump_label_init()", \
+ __func__, (key))
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+
+ struct static_key {
+ atomic_t enabled;
+@@ -114,10 +110,10 @@ struct static_key {
+ struct static_key {
+ atomic_t enabled;
+ };
+-#endif /* HAVE_JUMP_LABEL */
++#endif /* CONFIG_JUMP_LABEL */
+ #endif /* __ASSEMBLY__ */
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ #include <asm/jump_label.h>
+ #endif
+
+@@ -130,7 +126,7 @@ enum jump_label_type {
+
+ struct module;
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+
+ #define JUMP_TYPE_FALSE 0UL
+ #define JUMP_TYPE_TRUE 1UL
+@@ -184,7 +180,7 @@ extern void static_key_disable_cpuslocked(struct static_key *key);
+ { .enabled = { 0 }, \
+ { .entries = (void *)JUMP_TYPE_FALSE } }
+
+-#else /* !HAVE_JUMP_LABEL */
++#else /* !CONFIG_JUMP_LABEL */
+
+ #include <linux/atomic.h>
+ #include <linux/bug.h>
+@@ -271,7 +267,7 @@ static inline void static_key_disable(struct static_key *key)
+ #define STATIC_KEY_INIT_TRUE { .enabled = ATOMIC_INIT(1) }
+ #define STATIC_KEY_INIT_FALSE { .enabled = ATOMIC_INIT(0) }
+
+-#endif /* HAVE_JUMP_LABEL */
++#endif /* CONFIG_JUMP_LABEL */
+
+ #define STATIC_KEY_INIT STATIC_KEY_INIT_FALSE
+ #define jump_label_enabled static_key_enabled
+@@ -335,7 +331,7 @@ extern bool ____wrong_branch_error(void);
+ static_key_count((struct static_key *)x) > 0; \
+ })
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+
+ /*
+ * Combine the right initial value (type) with the right branch order
+@@ -417,12 +413,12 @@ extern bool ____wrong_branch_error(void);
+ unlikely(branch); \
+ })
+
+-#else /* !HAVE_JUMP_LABEL */
++#else /* !CONFIG_JUMP_LABEL */
+
+ #define static_branch_likely(x) likely(static_key_enabled(&(x)->key))
+ #define static_branch_unlikely(x) unlikely(static_key_enabled(&(x)->key))
+
+-#endif /* HAVE_JUMP_LABEL */
++#endif /* CONFIG_JUMP_LABEL */
+
+ /*
+ * Advanced usage; refcount, branch is enabled when: count != 0
+diff --git a/include/linux/jump_label_ratelimit.h b/include/linux/jump_label_ratelimit.h
+index baa8eabbaa56..a49f2b45b3f0 100644
+--- a/include/linux/jump_label_ratelimit.h
++++ b/include/linux/jump_label_ratelimit.h
+@@ -5,21 +5,19 @@
+ #include <linux/jump_label.h>
+ #include <linux/workqueue.h>
+
+-#if defined(CC_HAVE_ASM_GOTO) && defined(CONFIG_JUMP_LABEL)
++#if defined(CONFIG_JUMP_LABEL)
+ struct static_key_deferred {
+ struct static_key key;
+ unsigned long timeout;
+ struct delayed_work work;
+ };
+-#endif
+
+-#ifdef HAVE_JUMP_LABEL
+ extern void static_key_slow_dec_deferred(struct static_key_deferred *key);
+ extern void static_key_deferred_flush(struct static_key_deferred *key);
+ extern void
+ jump_label_rate_limit(struct static_key_deferred *key, unsigned long rl);
+
+-#else /* !HAVE_JUMP_LABEL */
++#else /* !CONFIG_JUMP_LABEL */
+ struct static_key_deferred {
+ struct static_key key;
+ };
+@@ -38,5 +36,5 @@ jump_label_rate_limit(struct static_key_deferred *key,
+ {
+ STATIC_KEY_CHECK_USE(key);
+ }
+-#endif /* HAVE_JUMP_LABEL */
++#endif /* CONFIG_JUMP_LABEL */
+ #endif /* _LINUX_JUMP_LABEL_RATELIMIT_H */
+diff --git a/include/linux/module.h b/include/linux/module.h
+index 904f94628132..c71044644979 100644
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -433,7 +433,7 @@ struct module {
+ unsigned int num_tracepoints;
+ tracepoint_ptr_t *tracepoints_ptrs;
+ #endif
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ struct jump_entry *jump_entries;
+ unsigned int num_jump_entries;
+ #endif
+diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
+index bbe99d2b28b4..72cb19c3db6a 100644
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -176,7 +176,7 @@ void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
+ int nf_register_sockopt(struct nf_sockopt_ops *reg);
+ void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
+ #endif
+
+@@ -198,7 +198,7 @@ static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
+ struct nf_hook_entries *hook_head = NULL;
+ int ret = 1;
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ if (__builtin_constant_p(pf) &&
+ __builtin_constant_p(hook) &&
+ !static_key_false(&nf_hooks_needed[pf][hook]))
+diff --git a/include/linux/netfilter_ingress.h b/include/linux/netfilter_ingress.h
+index 554c920691dd..a13774be2eb5 100644
+--- a/include/linux/netfilter_ingress.h
++++ b/include/linux/netfilter_ingress.h
+@@ -8,7 +8,7 @@
+ #ifdef CONFIG_NETFILTER_INGRESS
+ static inline bool nf_hook_ingress_active(const struct sk_buff *skb)
+ {
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][NF_NETDEV_INGRESS]))
+ return false;
+ #endif
+diff --git a/include/linux/siphash.h b/include/linux/siphash.h
+index fa7a6b9cedbf..bf21591a9e5e 100644
+--- a/include/linux/siphash.h
++++ b/include/linux/siphash.h
+@@ -21,6 +21,11 @@ typedef struct {
+ u64 key[2];
+ } siphash_key_t;
+
++static inline bool siphash_key_is_zero(const siphash_key_t *key)
++{
++ return !(key->key[0] | key->key[1]);
++}
++
+ u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key);
+ #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key);
+diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
+index e47503b4e4d1..622db6bc2f02 100644
+--- a/include/net/netns/ipv4.h
++++ b/include/net/netns/ipv4.h
+@@ -9,6 +9,7 @@
+ #include <linux/uidgid.h>
+ #include <net/inet_frag.h>
+ #include <linux/rcupdate.h>
++#include <linux/siphash.h>
+
+ struct tcpm_hash_bucket;
+ struct ctl_table_header;
+@@ -214,5 +215,6 @@ struct netns_ipv4 {
+ unsigned int ipmr_seq; /* protected by rtnl_mutex */
+
+ atomic_t rt_genid;
++ siphash_key_t ip_id_key;
+ };
+ #endif
+diff --git a/include/uapi/linux/tipc_config.h b/include/uapi/linux/tipc_config.h
+index 4b2c93b1934c..4955e1a9f1bc 100644
+--- a/include/uapi/linux/tipc_config.h
++++ b/include/uapi/linux/tipc_config.h
+@@ -307,8 +307,10 @@ static inline int TLV_SET(void *tlv, __u16 type, void *data, __u16 len)
+ tlv_ptr = (struct tlv_desc *)tlv;
+ tlv_ptr->tlv_type = htons(type);
+ tlv_ptr->tlv_len = htons(tlv_len);
+- if (len && data)
+- memcpy(TLV_DATA(tlv_ptr), data, tlv_len);
++ if (len && data) {
++ memcpy(TLV_DATA(tlv_ptr), data, len);
++ memset(TLV_DATA(tlv_ptr) + len, 0, TLV_SPACE(len) - tlv_len);
++ }
+ return TLV_SPACE(len);
+ }
+
+@@ -405,8 +407,10 @@ static inline int TCM_SET(void *msg, __u16 cmd, __u16 flags,
+ tcm_hdr->tcm_len = htonl(msg_len);
+ tcm_hdr->tcm_type = htons(cmd);
+ tcm_hdr->tcm_flags = htons(flags);
+- if (data_len && data)
++ if (data_len && data) {
+ memcpy(TCM_DATA(msg), data, data_len);
++ memset(TCM_DATA(msg) + data_len, 0, TCM_SPACE(data_len) - msg_len);
++ }
+ return TCM_SPACE(data_len);
+ }
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 864af10bb1b9..47035b5a46f6 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -23,6 +23,9 @@ config CLANG_VERSION
+ int
+ default $(shell,$(srctree)/scripts/clang-version.sh $(CC))
+
++config CC_HAS_ASM_GOTO
++ def_bool $(success,$(srctree)/scripts/gcc-goto.sh $(CC))
++
+ config CONSTRUCTORS
+ bool
+ depends on !UML
+diff --git a/kernel/jump_label.c b/kernel/jump_label.c
+index 2e62503bea0d..7c8262635b29 100644
+--- a/kernel/jump_label.c
++++ b/kernel/jump_label.c
+@@ -18,8 +18,6 @@
+ #include <linux/cpu.h>
+ #include <asm/sections.h>
+
+-#ifdef HAVE_JUMP_LABEL
+-
+ /* mutex to protect coming/going of the the jump_label table */
+ static DEFINE_MUTEX(jump_label_mutex);
+
+@@ -60,13 +58,13 @@ jump_label_sort_entries(struct jump_entry *start, struct jump_entry *stop)
+ static void jump_label_update(struct static_key *key);
+
+ /*
+- * There are similar definitions for the !HAVE_JUMP_LABEL case in jump_label.h.
++ * There are similar definitions for the !CONFIG_JUMP_LABEL case in jump_label.h.
+ * The use of 'atomic_read()' requires atomic.h and its problematic for some
+ * kernel headers such as kernel.h and others. Since static_key_count() is not
+- * used in the branch statements as it is for the !HAVE_JUMP_LABEL case its ok
++ * used in the branch statements as it is for the !CONFIG_JUMP_LABEL case its ok
+ * to have it be a function here. Similarly, for 'static_key_enable()' and
+ * 'static_key_disable()', which require bug.h. This should allow jump_label.h
+- * to be included from most/all places for HAVE_JUMP_LABEL.
++ * to be included from most/all places for CONFIG_JUMP_LABEL.
+ */
+ int static_key_count(struct static_key *key)
+ {
+@@ -796,5 +794,3 @@ static __init int jump_label_test(void)
+ }
+ early_initcall(jump_label_test);
+ #endif /* STATIC_KEYS_SELFTEST */
+-
+-#endif /* HAVE_JUMP_LABEL */
+diff --git a/kernel/module.c b/kernel/module.c
+index f797c6ace712..b8f37376856b 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -3100,7 +3100,7 @@ static int find_module_sections(struct module *mod, struct load_info *info)
+ sizeof(*mod->tracepoints_ptrs),
+ &mod->num_tracepoints);
+ #endif
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ mod->jump_entries = section_objs(info, "__jump_table",
+ sizeof(*mod->jump_entries),
+ &mod->num_jump_entries);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 6138754e5030..6859ea1d5c04 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -24,7 +24,7 @@
+
+ DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues);
+
+-#if defined(CONFIG_SCHED_DEBUG) && defined(HAVE_JUMP_LABEL)
++#if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_JUMP_LABEL)
+ /*
+ * Debugging: various feature bits
+ *
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index 141ea9ff210e..78fadf0438ea 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -73,7 +73,7 @@ static int sched_feat_show(struct seq_file *m, void *v)
+ return 0;
+ }
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+
+ #define jump_label_key__true STATIC_KEY_INIT_TRUE
+ #define jump_label_key__false STATIC_KEY_INIT_FALSE
+@@ -99,7 +99,7 @@ static void sched_feat_enable(int i)
+ #else
+ static void sched_feat_disable(int i) { };
+ static void sched_feat_enable(int i) { };
+-#endif /* HAVE_JUMP_LABEL */
++#endif /* CONFIG_JUMP_LABEL */
+
+ static int sched_feat_set(char *cmp)
+ {
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 7a1e9db617f7..4a433608ba74 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4209,7 +4209,7 @@ entity_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr, int queued)
+
+ #ifdef CONFIG_CFS_BANDWIDTH
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ static struct static_key __cfs_bandwidth_used;
+
+ static inline bool cfs_bandwidth_used(void)
+@@ -4226,7 +4226,7 @@ void cfs_bandwidth_usage_dec(void)
+ {
+ static_key_slow_dec_cpuslocked(&__cfs_bandwidth_used);
+ }
+-#else /* HAVE_JUMP_LABEL */
++#else /* CONFIG_JUMP_LABEL */
+ static bool cfs_bandwidth_used(void)
+ {
+ return true;
+@@ -4234,7 +4234,7 @@ static bool cfs_bandwidth_used(void)
+
+ void cfs_bandwidth_usage_inc(void) {}
+ void cfs_bandwidth_usage_dec(void) {}
+-#endif /* HAVE_JUMP_LABEL */
++#endif /* CONFIG_JUMP_LABEL */
+
+ /*
+ * default period for cfs group bandwidth.
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 4c7a837d7c14..9a7c3d08b39f 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -1359,7 +1359,7 @@ enum {
+
+ #undef SCHED_FEAT
+
+-#if defined(CONFIG_SCHED_DEBUG) && defined(HAVE_JUMP_LABEL)
++#if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_JUMP_LABEL)
+
+ /*
+ * To support run-time toggling of sched features, all the translation units
+@@ -1379,7 +1379,7 @@ static __always_inline bool static_branch_##name(struct static_key *key) \
+ extern struct static_key sched_feat_keys[__SCHED_FEAT_NR];
+ #define sched_feat(x) (static_branch_##x(&sched_feat_keys[__SCHED_FEAT_##x]))
+
+-#else /* !(SCHED_DEBUG && HAVE_JUMP_LABEL) */
++#else /* !(SCHED_DEBUG && CONFIG_JUMP_LABEL) */
+
+ /*
+ * Each translation unit has its own copy of sysctl_sched_features to allow
+@@ -1395,7 +1395,7 @@ static const_debug __maybe_unused unsigned int sysctl_sched_features =
+
+ #define sched_feat(x) (sysctl_sched_features & (1UL << __SCHED_FEAT_##x))
+
+-#endif /* SCHED_DEBUG && HAVE_JUMP_LABEL */
++#endif /* SCHED_DEBUG && CONFIG_JUMP_LABEL */
+
+ extern struct static_key_false sched_numa_balancing;
+ extern struct static_key_false sched_schedstats;
+diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
+index c7c96bc7654a..dbf2b457e47e 100644
+--- a/lib/dynamic_debug.c
++++ b/lib/dynamic_debug.c
+@@ -188,7 +188,7 @@ static int ddebug_change(const struct ddebug_query *query,
+ newflags = (dp->flags & mask) | flags;
+ if (newflags == dp->flags)
+ continue;
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ if (dp->flags & _DPRINTK_FLAGS_PRINT) {
+ if (!(flags & _DPRINTK_FLAGS_PRINT))
+ static_branch_disable(&dp->key.dd_key_true);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 13a82744a00a..138951d28643 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1821,7 +1821,7 @@ EXPORT_SYMBOL_GPL(net_dec_egress_queue);
+ #endif
+
+ static DEFINE_STATIC_KEY_FALSE(netstamp_needed_key);
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ static atomic_t netstamp_needed_deferred;
+ static atomic_t netstamp_wanted;
+ static void netstamp_clear(struct work_struct *work)
+@@ -1840,7 +1840,7 @@ static DECLARE_WORK(netstamp_work, netstamp_clear);
+
+ void net_enable_timestamp(void)
+ {
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ int wanted;
+
+ while (1) {
+@@ -1860,7 +1860,7 @@ EXPORT_SYMBOL(net_enable_timestamp);
+
+ void net_disable_timestamp(void)
+ {
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ int wanted;
+
+ while (1) {
+@@ -5725,7 +5725,6 @@ static struct sk_buff *napi_frags_skb(struct napi_struct *napi)
+ skb_reset_mac_header(skb);
+ skb_gro_reset_offset(skb);
+
+- eth = skb_gro_header_fast(skb, 0);
+ if (unlikely(skb_gro_header_hard(skb, hlen))) {
+ eth = skb_gro_header_slow(skb, hlen, 0);
+ if (unlikely(!eth)) {
+@@ -5735,6 +5734,7 @@ static struct sk_buff *napi_frags_skb(struct napi_struct *napi)
+ return NULL;
+ }
+ } else {
++ eth = (const struct ethhdr *)skb->data;
+ gro_pull_from_frag0(skb, hlen);
+ NAPI_GRO_CB(skb)->frag0 += hlen;
+ NAPI_GRO_CB(skb)->frag0_len -= hlen;
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index 4da39446da2d..d187ee8156a1 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -190,6 +190,17 @@ static void ip_ma_put(struct ip_mc_list *im)
+ pmc != NULL; \
+ pmc = rtnl_dereference(pmc->next_rcu))
+
++static void ip_sf_list_clear_all(struct ip_sf_list *psf)
++{
++ struct ip_sf_list *next;
++
++ while (psf) {
++ next = psf->sf_next;
++ kfree(psf);
++ psf = next;
++ }
++}
++
+ #ifdef CONFIG_IP_MULTICAST
+
+ /*
+@@ -635,6 +646,13 @@ static void igmpv3_clear_zeros(struct ip_sf_list **ppsf)
+ }
+ }
+
++static void kfree_pmc(struct ip_mc_list *pmc)
++{
++ ip_sf_list_clear_all(pmc->sources);
++ ip_sf_list_clear_all(pmc->tomb);
++ kfree(pmc);
++}
++
+ static void igmpv3_send_cr(struct in_device *in_dev)
+ {
+ struct ip_mc_list *pmc, *pmc_prev, *pmc_next;
+@@ -671,7 +689,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
+ else
+ in_dev->mc_tomb = pmc_next;
+ in_dev_put(pmc->interface);
+- kfree(pmc);
++ kfree_pmc(pmc);
+ } else
+ pmc_prev = pmc;
+ }
+@@ -1201,14 +1219,18 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
+ im->interface = pmc->interface;
+ if (im->sfmode == MCAST_INCLUDE) {
+ im->tomb = pmc->tomb;
++ pmc->tomb = NULL;
++
+ im->sources = pmc->sources;
++ pmc->sources = NULL;
++
+ for (psf = im->sources; psf; psf = psf->sf_next)
+ psf->sf_crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
+ } else {
+ im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
+ }
+ in_dev_put(pmc->interface);
+- kfree(pmc);
++ kfree_pmc(pmc);
+ }
+ spin_unlock_bh(&im->lock);
+ }
+@@ -1229,21 +1251,18 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
+ nextpmc = pmc->next;
+ ip_mc_clear_src(pmc);
+ in_dev_put(pmc->interface);
+- kfree(pmc);
++ kfree_pmc(pmc);
+ }
+ /* clear dead sources, too */
+ rcu_read_lock();
+ for_each_pmc_rcu(in_dev, pmc) {
+- struct ip_sf_list *psf, *psf_next;
++ struct ip_sf_list *psf;
+
+ spin_lock_bh(&pmc->lock);
+ psf = pmc->tomb;
+ pmc->tomb = NULL;
+ spin_unlock_bh(&pmc->lock);
+- for (; psf; psf = psf_next) {
+- psf_next = psf->sf_next;
+- kfree(psf);
+- }
++ ip_sf_list_clear_all(psf);
+ }
+ rcu_read_unlock();
+ }
+@@ -2114,7 +2133,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
+
+ static void ip_mc_clear_src(struct ip_mc_list *pmc)
+ {
+- struct ip_sf_list *psf, *nextpsf, *tomb, *sources;
++ struct ip_sf_list *tomb, *sources;
+
+ spin_lock_bh(&pmc->lock);
+ tomb = pmc->tomb;
+@@ -2126,14 +2145,8 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc)
+ pmc->sfcount[MCAST_EXCLUDE] = 1;
+ spin_unlock_bh(&pmc->lock);
+
+- for (psf = tomb; psf; psf = nextpsf) {
+- nextpsf = psf->sf_next;
+- kfree(psf);
+- }
+- for (psf = sources; psf; psf = nextpsf) {
+- nextpsf = psf->sf_next;
+- kfree(psf);
+- }
++ ip_sf_list_clear_all(tomb);
++ ip_sf_list_clear_all(sources);
+ }
+
+ /* Join a multicast group
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 8bacbcd2db90..40bf19f7ae1a 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -500,15 +500,17 @@ EXPORT_SYMBOL(ip_idents_reserve);
+
+ void __ip_select_ident(struct net *net, struct iphdr *iph, int segs)
+ {
+- static u32 ip_idents_hashrnd __read_mostly;
+ u32 hash, id;
+
+- net_get_random_once(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
++ /* Note the following code is not safe, but this is okay. */
++ if (unlikely(siphash_key_is_zero(&net->ipv4.ip_id_key)))
++ get_random_bytes(&net->ipv4.ip_id_key,
++ sizeof(net->ipv4.ip_id_key));
+
+- hash = jhash_3words((__force u32)iph->daddr,
++ hash = siphash_3u32((__force u32)iph->daddr,
+ (__force u32)iph->saddr,
+- iph->protocol ^ net_hash_mix(net),
+- ip_idents_hashrnd);
++ iph->protocol,
++ &net->ipv4.ip_id_key);
+ id = ip_idents_reserve(hash, segs);
+ iph->id = htons(id);
+ }
+diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
+index 4fe7c90962dd..868ae23dbae1 100644
+--- a/net/ipv6/output_core.c
++++ b/net/ipv6/output_core.c
+@@ -10,15 +10,25 @@
+ #include <net/secure_seq.h>
+ #include <linux/netfilter.h>
+
+-static u32 __ipv6_select_ident(struct net *net, u32 hashrnd,
++static u32 __ipv6_select_ident(struct net *net,
+ const struct in6_addr *dst,
+ const struct in6_addr *src)
+ {
++ const struct {
++ struct in6_addr dst;
++ struct in6_addr src;
++ } __aligned(SIPHASH_ALIGNMENT) combined = {
++ .dst = *dst,
++ .src = *src,
++ };
+ u32 hash, id;
+
+- hash = __ipv6_addr_jhash(dst, hashrnd);
+- hash = __ipv6_addr_jhash(src, hash);
+- hash ^= net_hash_mix(net);
++ /* Note the following code is not safe, but this is okay. */
++ if (unlikely(siphash_key_is_zero(&net->ipv4.ip_id_key)))
++ get_random_bytes(&net->ipv4.ip_id_key,
++ sizeof(net->ipv4.ip_id_key));
++
++ hash = siphash(&combined, sizeof(combined), &net->ipv4.ip_id_key);
+
+ /* Treat id of 0 as unset and if we get 0 back from ip_idents_reserve,
+ * set the hight order instead thus minimizing possible future
+@@ -41,7 +51,6 @@ static u32 __ipv6_select_ident(struct net *net, u32 hashrnd,
+ */
+ __be32 ipv6_proxy_select_ident(struct net *net, struct sk_buff *skb)
+ {
+- static u32 ip6_proxy_idents_hashrnd __read_mostly;
+ struct in6_addr buf[2];
+ struct in6_addr *addrs;
+ u32 id;
+@@ -53,11 +62,7 @@ __be32 ipv6_proxy_select_ident(struct net *net, struct sk_buff *skb)
+ if (!addrs)
+ return 0;
+
+- net_get_random_once(&ip6_proxy_idents_hashrnd,
+- sizeof(ip6_proxy_idents_hashrnd));
+-
+- id = __ipv6_select_ident(net, ip6_proxy_idents_hashrnd,
+- &addrs[1], &addrs[0]);
++ id = __ipv6_select_ident(net, &addrs[1], &addrs[0]);
+ return htonl(id);
+ }
+ EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident);
+@@ -66,12 +71,9 @@ __be32 ipv6_select_ident(struct net *net,
+ const struct in6_addr *daddr,
+ const struct in6_addr *saddr)
+ {
+- static u32 ip6_idents_hashrnd __read_mostly;
+ u32 id;
+
+- net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
+-
+- id = __ipv6_select_ident(net, ip6_idents_hashrnd, daddr, saddr);
++ id = __ipv6_select_ident(net, daddr, saddr);
+ return htonl(id);
+ }
+ EXPORT_SYMBOL(ipv6_select_ident);
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 5e0efd3954e9..5833d4af7311 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -288,7 +288,9 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ /* Binding to link-local address requires an interface */
+ if (!sk->sk_bound_dev_if)
+ goto out_unlock;
++ }
+
++ if (sk->sk_bound_dev_if) {
+ err = -ENODEV;
+ dev = dev_get_by_index_rcu(sock_net(sk),
+ sk->sk_bound_dev_if);
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index bf0940c42810..24f7b2cf504b 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2480,6 +2480,12 @@ static struct rt6_info *__ip6_route_redirect(struct net *net,
+ struct fib6_info *rt;
+ struct fib6_node *fn;
+
++ /* l3mdev_update_flow overrides oif if the device is enslaved; in
++ * this case we must match on the real ingress device, so reset it
++ */
++ if (fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF)
++ fl6->flowi6_oif = skb->dev->ifindex;
++
+ /* Get the "current" route for this destination and
+ * check if the redirect has come from appropriate router.
+ *
+diff --git a/net/llc/llc_output.c b/net/llc/llc_output.c
+index 94425e421213..9e4b6bcf6920 100644
+--- a/net/llc/llc_output.c
++++ b/net/llc/llc_output.c
+@@ -72,6 +72,8 @@ int llc_build_and_send_ui_pkt(struct llc_sap *sap, struct sk_buff *skb,
+ rc = llc_mac_hdr_init(skb, skb->dev->dev_addr, dmac);
+ if (likely(!rc))
+ rc = dev_queue_xmit(skb);
++ else
++ kfree_skb(skb);
+ return rc;
+ }
+
+diff --git a/net/netfilter/core.c b/net/netfilter/core.c
+index dc240cb47ddf..93aaec3a54ec 100644
+--- a/net/netfilter/core.c
++++ b/net/netfilter/core.c
+@@ -33,7 +33,7 @@ EXPORT_SYMBOL_GPL(nf_ipv6_ops);
+ DEFINE_PER_CPU(bool, nf_skb_duplicated);
+ EXPORT_SYMBOL_GPL(nf_skb_duplicated);
+
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
+ EXPORT_SYMBOL(nf_hooks_needed);
+ #endif
+@@ -347,7 +347,7 @@ static int __nf_register_net_hook(struct net *net, int pf,
+ if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
+ net_inc_ingress_queue();
+ #endif
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ static_key_slow_inc(&nf_hooks_needed[pf][reg->hooknum]);
+ #endif
+ BUG_ON(p == new_hooks);
+@@ -405,7 +405,7 @@ static void __nf_unregister_net_hook(struct net *net, int pf,
+ if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
+ net_dec_ingress_queue();
+ #endif
+-#ifdef HAVE_JUMP_LABEL
++#ifdef CONFIG_JUMP_LABEL
+ static_key_slow_dec(&nf_hooks_needed[pf][reg->hooknum]);
+ #endif
+ } else {
+diff --git a/net/sched/act_api.c b/net/sched/act_api.c
+index e12f8ef7baa4..7c4a4b874248 100644
+--- a/net/sched/act_api.c
++++ b/net/sched/act_api.c
+@@ -744,7 +744,7 @@ int tcf_action_dump(struct sk_buff *skb, struct tc_action *actions[],
+
+ for (i = 0; i < TCA_ACT_MAX_PRIO && actions[i]; i++) {
+ a = actions[i];
+- nest = nla_nest_start(skb, a->order);
++ nest = nla_nest_start(skb, i + 1);
+ if (nest == NULL)
+ goto nla_put_failure;
+ err = tcf_action_dump_1(skb, a, bind, ref);
+@@ -1257,7 +1257,6 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
+ ret = PTR_ERR(act);
+ goto err;
+ }
+- act->order = i;
+ attr_size += tcf_action_fill_size(act);
+ actions[i - 1] = act;
+ }
+diff --git a/net/tipc/core.c b/net/tipc/core.c
+index d7b0688c98dd..3ecca3b88bf8 100644
+--- a/net/tipc/core.c
++++ b/net/tipc/core.c
+@@ -66,10 +66,6 @@ static int __net_init tipc_init_net(struct net *net)
+ INIT_LIST_HEAD(&tn->node_list);
+ spin_lock_init(&tn->node_list_lock);
+
+- err = tipc_socket_init();
+- if (err)
+- goto out_socket;
+-
+ err = tipc_sk_rht_init(net);
+ if (err)
+ goto out_sk_rht;
+@@ -79,9 +75,6 @@ static int __net_init tipc_init_net(struct net *net)
+ goto out_nametbl;
+
+ INIT_LIST_HEAD(&tn->dist_queue);
+- err = tipc_topsrv_start(net);
+- if (err)
+- goto out_subscr;
+
+ err = tipc_bcast_init(net);
+ if (err)
+@@ -90,25 +83,19 @@ static int __net_init tipc_init_net(struct net *net)
+ return 0;
+
+ out_bclink:
+- tipc_bcast_stop(net);
+-out_subscr:
+ tipc_nametbl_stop(net);
+ out_nametbl:
+ tipc_sk_rht_destroy(net);
+ out_sk_rht:
+- tipc_socket_stop();
+-out_socket:
+ return err;
+ }
+
+ static void __net_exit tipc_exit_net(struct net *net)
+ {
+- tipc_topsrv_stop(net);
+ tipc_net_stop(net);
+ tipc_bcast_stop(net);
+ tipc_nametbl_stop(net);
+ tipc_sk_rht_destroy(net);
+- tipc_socket_stop();
+ }
+
+ static struct pernet_operations tipc_net_ops = {
+@@ -118,6 +105,11 @@ static struct pernet_operations tipc_net_ops = {
+ .size = sizeof(struct tipc_net),
+ };
+
++static struct pernet_operations tipc_topsrv_net_ops = {
++ .init = tipc_topsrv_init_net,
++ .exit = tipc_topsrv_exit_net,
++};
++
+ static int __init tipc_init(void)
+ {
+ int err;
+@@ -144,6 +136,14 @@ static int __init tipc_init(void)
+ if (err)
+ goto out_pernet;
+
++ err = tipc_socket_init();
++ if (err)
++ goto out_socket;
++
++ err = register_pernet_subsys(&tipc_topsrv_net_ops);
++ if (err)
++ goto out_pernet_topsrv;
++
+ err = tipc_bearer_setup();
+ if (err)
+ goto out_bearer;
+@@ -151,6 +151,10 @@ static int __init tipc_init(void)
+ pr_info("Started in single node mode\n");
+ return 0;
+ out_bearer:
++ unregister_pernet_subsys(&tipc_topsrv_net_ops);
++out_pernet_topsrv:
++ tipc_socket_stop();
++out_socket:
+ unregister_pernet_subsys(&tipc_net_ops);
+ out_pernet:
+ tipc_unregister_sysctl();
+@@ -166,6 +170,8 @@ out_netlink:
+ static void __exit tipc_exit(void)
+ {
+ tipc_bearer_cleanup();
++ unregister_pernet_subsys(&tipc_topsrv_net_ops);
++ tipc_socket_stop();
+ unregister_pernet_subsys(&tipc_net_ops);
+ tipc_netlink_stop();
+ tipc_netlink_compat_stop();
+diff --git a/net/tipc/subscr.h b/net/tipc/subscr.h
+index d793b4343885..aa015c233898 100644
+--- a/net/tipc/subscr.h
++++ b/net/tipc/subscr.h
+@@ -77,8 +77,9 @@ void tipc_sub_report_overlap(struct tipc_subscription *sub,
+ u32 found_lower, u32 found_upper,
+ u32 event, u32 port, u32 node,
+ u32 scope, int must);
+-int tipc_topsrv_start(struct net *net);
+-void tipc_topsrv_stop(struct net *net);
++
++int __net_init tipc_topsrv_init_net(struct net *net);
++void __net_exit tipc_topsrv_exit_net(struct net *net);
+
+ void tipc_sub_put(struct tipc_subscription *subscription);
+ void tipc_sub_get(struct tipc_subscription *subscription);
+diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
+index 2301b09df234..35558656fe02 100644
+--- a/net/tipc/topsrv.c
++++ b/net/tipc/topsrv.c
+@@ -643,7 +643,7 @@ static void tipc_topsrv_work_stop(struct tipc_topsrv *s)
+ destroy_workqueue(s->send_wq);
+ }
+
+-int tipc_topsrv_start(struct net *net)
++static int tipc_topsrv_start(struct net *net)
+ {
+ struct tipc_net *tn = tipc_net(net);
+ const char name[] = "topology_server";
+@@ -677,7 +677,7 @@ int tipc_topsrv_start(struct net *net)
+ return ret;
+ }
+
+-void tipc_topsrv_stop(struct net *net)
++static void tipc_topsrv_stop(struct net *net)
+ {
+ struct tipc_topsrv *srv = tipc_topsrv(net);
+ struct socket *lsock = srv->listener;
+@@ -702,3 +702,13 @@ void tipc_topsrv_stop(struct net *net)
+ idr_destroy(&srv->conn_idr);
+ kfree(srv);
+ }
++
++int __net_init tipc_topsrv_init_net(struct net *net)
++{
++ return tipc_topsrv_start(net);
++}
++
++void __net_exit tipc_topsrv_exit_net(struct net *net)
++{
++ tipc_topsrv_stop(net);
++}
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index fdf22cb0b3e6..8035bf495eb2 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -916,12 +916,6 @@ void tls_device_offload_cleanup_rx(struct sock *sk)
+ if (!netdev)
+ goto out;
+
+- if (!(netdev->features & NETIF_F_HW_TLS_RX)) {
+- pr_err_ratelimited("%s: device is missing NETIF_F_HW_TLS_RX cap\n",
+- __func__);
+- goto out;
+- }
+-
+ netdev->tlsdev_ops->tls_dev_del(netdev, tls_ctx,
+ TLS_OFFLOAD_CTX_DIR_RX);
+
+@@ -980,7 +974,8 @@ static int tls_dev_event(struct notifier_block *this, unsigned long event,
+ {
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+
+- if (!(dev->features & (NETIF_F_HW_TLS_RX | NETIF_F_HW_TLS_TX)))
++ if (!dev->tlsdev_ops &&
++ !(dev->features & (NETIF_F_HW_TLS_RX | NETIF_F_HW_TLS_TX)))
+ return NOTIFY_DONE;
+
+ switch (event) {
+diff --git a/scripts/gcc-goto.sh b/scripts/gcc-goto.sh
+index 083c526073ef..8b980fb2270a 100755
+--- a/scripts/gcc-goto.sh
++++ b/scripts/gcc-goto.sh
+@@ -3,7 +3,7 @@
+ # Test for gcc 'asm goto' support
+ # Copyright (C) 2010, Jason Baron <jbaron@redhat.com>
+
+-cat << "END" | $@ -x c - -c -o /dev/null >/dev/null 2>&1 && echo "y"
++cat << "END" | $@ -x c - -fno-PIE -c -o /dev/null
+ int main(void)
+ {
+ #if defined(__arm__) || defined(__aarch64__)
+diff --git a/tools/arch/x86/include/asm/rmwcc.h b/tools/arch/x86/include/asm/rmwcc.h
+index dc90c0c2fae3..fee7983a90b4 100644
+--- a/tools/arch/x86/include/asm/rmwcc.h
++++ b/tools/arch/x86/include/asm/rmwcc.h
+@@ -2,7 +2,7 @@
+ #ifndef _TOOLS_LINUX_ASM_X86_RMWcc
+ #define _TOOLS_LINUX_ASM_X86_RMWcc
+
+-#ifdef CC_HAVE_ASM_GOTO
++#ifdef CONFIG_CC_HAS_ASM_GOTO
+
+ #define __GEN_RMWcc(fullop, var, cc, ...) \
+ do { \
+@@ -20,7 +20,7 @@ cc_label: \
+ #define GEN_BINARY_RMWcc(op, var, vcon, val, arg0, cc) \
+ __GEN_RMWcc(op " %1, " arg0, var, cc, vcon (val))
+
+-#else /* !CC_HAVE_ASM_GOTO */
++#else /* !CONFIG_CC_HAS_ASM_GOTO */
+
+ #define __GEN_RMWcc(fullop, var, cc, ...) \
+ do { \
+@@ -37,6 +37,6 @@ do { \
+ #define GEN_BINARY_RMWcc(op, var, vcon, val, arg0, cc) \
+ __GEN_RMWcc(op " %2, " arg0, var, cc, vcon (val))
+
+-#endif /* CC_HAVE_ASM_GOTO */
++#endif /* CONFIG_CC_HAS_ASM_GOTO */
+
+ #endif /* _TOOLS_LINUX_ASM_X86_RMWcc */
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-06-09 16:19 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-06-09 16:19 UTC (permalink / raw
To: gentoo-commits
commit: 9d13fe3ac136f1b72c463528070917e55e241232
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jun 9 16:18:41 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jun 9 16:18:41 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9d13fe3a
Linux patch 4.19.49
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1048_linux-4.19.49.patch | 3152 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3156 insertions(+)
diff --git a/0000_README b/0000_README
index 7740baf..3161071 100644
--- a/0000_README
+++ b/0000_README
@@ -235,6 +235,10 @@ Patch: 1047_linux-4.19.48.patch
From: http://www.kernel.org
Desc: Linux 4.19.48
+Patch: 1048_linux-4.19.49.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.49
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1048_linux-4.19.49.patch b/1048_linux-4.19.49.patch
new file mode 100644
index 0000000..9287f9d
--- /dev/null
+++ b/1048_linux-4.19.49.patch
@@ -0,0 +1,3152 @@
+diff --git a/Documentation/conf.py b/Documentation/conf.py
+index b691af4831fa..22c1a6d96f9e 100644
+--- a/Documentation/conf.py
++++ b/Documentation/conf.py
+@@ -37,7 +37,7 @@ needs_sphinx = '1.3'
+ extensions = ['kerneldoc', 'rstFlatTable', 'kernel_include', 'cdomain', 'kfigure', 'sphinx.ext.ifconfig']
+
+ # The name of the math extension changed on Sphinx 1.4
+-if major == 1 and minor > 3:
++if (major == 1 and minor > 3) or (major > 1):
+ extensions.append("sphinx.ext.imgmath")
+ else:
+ extensions.append("sphinx.ext.pngmath")
+diff --git a/Documentation/sphinx/kerneldoc.py b/Documentation/sphinx/kerneldoc.py
+index 9d0a7f08f93b..1159405cb920 100644
+--- a/Documentation/sphinx/kerneldoc.py
++++ b/Documentation/sphinx/kerneldoc.py
+@@ -37,7 +37,19 @@ import glob
+ from docutils import nodes, statemachine
+ from docutils.statemachine import ViewList
+ from docutils.parsers.rst import directives, Directive
+-from sphinx.ext.autodoc import AutodocReporter
++
++#
++# AutodocReporter is only good up to Sphinx 1.7
++#
++import sphinx
++
++Use_SSI = sphinx.__version__[:3] >= '1.7'
++if Use_SSI:
++ from sphinx.util.docutils import switch_source_input
++else:
++ from sphinx.ext.autodoc import AutodocReporter
++
++import kernellog
+
+ __version__ = '1.0'
+
+@@ -90,7 +102,8 @@ class KernelDocDirective(Directive):
+ cmd += [filename]
+
+ try:
+- env.app.verbose('calling kernel-doc \'%s\'' % (" ".join(cmd)))
++ kernellog.verbose(env.app,
++ 'calling kernel-doc \'%s\'' % (" ".join(cmd)))
+
+ p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+ out, err = p.communicate()
+@@ -100,7 +113,8 @@ class KernelDocDirective(Directive):
+ if p.returncode != 0:
+ sys.stderr.write(err)
+
+- env.app.warn('kernel-doc \'%s\' failed with return code %d' % (" ".join(cmd), p.returncode))
++ kernellog.warn(env.app,
++ 'kernel-doc \'%s\' failed with return code %d' % (" ".join(cmd), p.returncode))
+ return [nodes.error(None, nodes.paragraph(text = "kernel-doc missing"))]
+ elif env.config.kerneldoc_verbosity > 0:
+ sys.stderr.write(err)
+@@ -121,20 +135,28 @@ class KernelDocDirective(Directive):
+ lineoffset += 1
+
+ node = nodes.section()
+- buf = self.state.memo.title_styles, self.state.memo.section_level, self.state.memo.reporter
++ self.do_parse(result, node)
++
++ return node.children
++
++ except Exception as e: # pylint: disable=W0703
++ kernellog.warn(env.app, 'kernel-doc \'%s\' processing failed with: %s' %
++ (" ".join(cmd), str(e)))
++ return [nodes.error(None, nodes.paragraph(text = "kernel-doc missing"))]
++
++ def do_parse(self, result, node):
++ if Use_SSI:
++ with switch_source_input(self.state, result):
++ self.state.nested_parse(result, 0, node, match_titles=1)
++ else:
++ save = self.state.memo.title_styles, self.state.memo.section_level, self.state.memo.reporter
+ self.state.memo.reporter = AutodocReporter(result, self.state.memo.reporter)
+ self.state.memo.title_styles, self.state.memo.section_level = [], 0
+ try:
+ self.state.nested_parse(result, 0, node, match_titles=1)
+ finally:
+- self.state.memo.title_styles, self.state.memo.section_level, self.state.memo.reporter = buf
++ self.state.memo.title_styles, self.state.memo.section_level, self.state.memo.reporter = save
+
+- return node.children
+-
+- except Exception as e: # pylint: disable=W0703
+- env.app.warn('kernel-doc \'%s\' processing failed with: %s' %
+- (" ".join(cmd), str(e)))
+- return [nodes.error(None, nodes.paragraph(text = "kernel-doc missing"))]
+
+ def setup(app):
+ app.add_config_value('kerneldoc_bin', None, 'env')
+diff --git a/Documentation/sphinx/kernellog.py b/Documentation/sphinx/kernellog.py
+new file mode 100644
+index 000000000000..af924f51a7dc
+--- /dev/null
++++ b/Documentation/sphinx/kernellog.py
+@@ -0,0 +1,28 @@
++# SPDX-License-Identifier: GPL-2.0
++#
++# Sphinx has deprecated its older logging interface, but the replacement
++# only goes back to 1.6. So here's a wrapper layer to keep around for
++# as long as we support 1.4.
++#
++import sphinx
++
++if sphinx.__version__[:3] >= '1.6':
++ UseLogging = True
++ from sphinx.util import logging
++ logger = logging.getLogger('kerneldoc')
++else:
++ UseLogging = False
++
++def warn(app, message):
++ if UseLogging:
++ logger.warning(message)
++ else:
++ app.warn(message)
++
++def verbose(app, message):
++ if UseLogging:
++ logger.verbose(message)
++ else:
++ app.verbose(message)
++
++
+diff --git a/Documentation/sphinx/kfigure.py b/Documentation/sphinx/kfigure.py
+index b97228d2cc0e..fbfe6693bb60 100644
+--- a/Documentation/sphinx/kfigure.py
++++ b/Documentation/sphinx/kfigure.py
+@@ -60,6 +60,8 @@ import sphinx
+ from sphinx.util.nodes import clean_astext
+ from six import iteritems
+
++import kernellog
++
+ PY3 = sys.version_info[0] == 3
+
+ if PY3:
+@@ -171,20 +173,20 @@ def setupTools(app):
+ This function is called once, when the builder is initiated.
+ """
+ global dot_cmd, convert_cmd # pylint: disable=W0603
+- app.verbose("kfigure: check installed tools ...")
++ kernellog.verbose(app, "kfigure: check installed tools ...")
+
+ dot_cmd = which('dot')
+ convert_cmd = which('convert')
+
+ if dot_cmd:
+- app.verbose("use dot(1) from: " + dot_cmd)
++ kernellog.verbose(app, "use dot(1) from: " + dot_cmd)
+ else:
+- app.warn("dot(1) not found, for better output quality install "
+- "graphviz from http://www.graphviz.org")
++ kernellog.warn(app, "dot(1) not found, for better output quality install "
++ "graphviz from http://www.graphviz.org")
+ if convert_cmd:
+- app.verbose("use convert(1) from: " + convert_cmd)
++ kernellog.verbose(app, "use convert(1) from: " + convert_cmd)
+ else:
+- app.warn(
++ kernellog.warn(app,
+ "convert(1) not found, for SVG to PDF conversion install "
+ "ImageMagick (https://www.imagemagick.org)")
+
+@@ -220,12 +222,13 @@ def convert_image(img_node, translator, src_fname=None):
+
+ # in kernel builds, use 'make SPHINXOPTS=-v' to see verbose messages
+
+- app.verbose('assert best format for: ' + img_node['uri'])
++ kernellog.verbose(app, 'assert best format for: ' + img_node['uri'])
+
+ if in_ext == '.dot':
+
+ if not dot_cmd:
+- app.verbose("dot from graphviz not available / include DOT raw.")
++ kernellog.verbose(app,
++ "dot from graphviz not available / include DOT raw.")
+ img_node.replace_self(file2literal(src_fname))
+
+ elif translator.builder.format == 'latex':
+@@ -252,7 +255,8 @@ def convert_image(img_node, translator, src_fname=None):
+
+ if translator.builder.format == 'latex':
+ if convert_cmd is None:
+- app.verbose("no SVG to PDF conversion available / include SVG raw.")
++ kernellog.verbose(app,
++ "no SVG to PDF conversion available / include SVG raw.")
+ img_node.replace_self(file2literal(src_fname))
+ else:
+ dst_fname = path.join(translator.builder.outdir, fname + '.pdf')
+@@ -265,18 +269,19 @@ def convert_image(img_node, translator, src_fname=None):
+ _name = dst_fname[len(translator.builder.outdir) + 1:]
+
+ if isNewer(dst_fname, src_fname):
+- app.verbose("convert: {out}/%s already exists and is newer" % _name)
++ kernellog.verbose(app,
++ "convert: {out}/%s already exists and is newer" % _name)
+
+ else:
+ ok = False
+ mkdir(path.dirname(dst_fname))
+
+ if in_ext == '.dot':
+- app.verbose('convert DOT to: {out}/' + _name)
++ kernellog.verbose(app, 'convert DOT to: {out}/' + _name)
+ ok = dot2format(app, src_fname, dst_fname)
+
+ elif in_ext == '.svg':
+- app.verbose('convert SVG to: {out}/' + _name)
++ kernellog.verbose(app, 'convert SVG to: {out}/' + _name)
+ ok = svg2pdf(app, src_fname, dst_fname)
+
+ if not ok:
+@@ -305,7 +310,8 @@ def dot2format(app, dot_fname, out_fname):
+ with open(out_fname, "w") as out:
+ exit_code = subprocess.call(cmd, stdout = out)
+ if exit_code != 0:
+- app.warn("Error #%d when calling: %s" % (exit_code, " ".join(cmd)))
++ kernellog.warn(app,
++ "Error #%d when calling: %s" % (exit_code, " ".join(cmd)))
+ return bool(exit_code == 0)
+
+ def svg2pdf(app, svg_fname, pdf_fname):
+@@ -322,7 +328,7 @@ def svg2pdf(app, svg_fname, pdf_fname):
+ # use stdout and stderr from parent
+ exit_code = subprocess.call(cmd)
+ if exit_code != 0:
+- app.warn("Error #%d when calling: %s" % (exit_code, " ".join(cmd)))
++ kernellog.warn(app, "Error #%d when calling: %s" % (exit_code, " ".join(cmd)))
+ return bool(exit_code == 0)
+
+
+@@ -415,15 +421,15 @@ def visit_kernel_render(self, node):
+ app = self.builder.app
+ srclang = node.get('srclang')
+
+- app.verbose('visit kernel-render node lang: "%s"' % (srclang))
++ kernellog.verbose(app, 'visit kernel-render node lang: "%s"' % (srclang))
+
+ tmp_ext = RENDER_MARKUP_EXT.get(srclang, None)
+ if tmp_ext is None:
+- app.warn('kernel-render: "%s" unknown / include raw.' % (srclang))
++ kernellog.warn(app, 'kernel-render: "%s" unknown / include raw.' % (srclang))
+ return
+
+ if not dot_cmd and tmp_ext == '.dot':
+- app.verbose("dot from graphviz not available / include raw.")
++ kernellog.verbose(app, "dot from graphviz not available / include raw.")
+ return
+
+ literal_block = node[0]
+diff --git a/Makefile b/Makefile
+index 42529a87f3b4..e84966c49117 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 48
++SUBLEVEL = 49
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/kernel/sys.c b/arch/arm64/kernel/sys.c
+index 6f91e8116514..162a95ed0881 100644
+--- a/arch/arm64/kernel/sys.c
++++ b/arch/arm64/kernel/sys.c
+@@ -50,7 +50,7 @@ SYSCALL_DEFINE1(arm64_personality, unsigned int, personality)
+ /*
+ * Wrappers to pass the pt_regs argument.
+ */
+-#define sys_personality sys_arm64_personality
++#define __arm64_sys_personality __arm64_sys_arm64_personality
+
+ asmlinkage long sys_ni_syscall(const struct pt_regs *);
+ #define __arm64_sys_ni_syscall sys_ni_syscall
+diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
+index f7ea8e21656b..e7f5ef6bed0f 100644
+--- a/arch/mips/kvm/mips.c
++++ b/arch/mips/kvm/mips.c
+@@ -1099,6 +1099,9 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
+ case KVM_CAP_MAX_VCPUS:
+ r = KVM_MAX_VCPUS;
+ break;
++ case KVM_CAP_MAX_VCPU_ID:
++ r = KVM_MAX_VCPU_ID;
++ break;
+ case KVM_CAP_MIPS_FPU:
+ /* We don't handle systems with inconsistent cpu_has_fpu */
+ r = !!raw_cpu_has_fpu;
+diff --git a/arch/powerpc/kvm/book3s_xive.c b/arch/powerpc/kvm/book3s_xive.c
+index 30c2eb766954..aae34f218ab4 100644
+--- a/arch/powerpc/kvm/book3s_xive.c
++++ b/arch/powerpc/kvm/book3s_xive.c
+@@ -1723,7 +1723,6 @@ static void kvmppc_xive_cleanup_irq(u32 hw_num, struct xive_irq_data *xd)
+ {
+ xive_vm_esb_load(xd, XIVE_ESB_SET_PQ_01);
+ xive_native_configure_irq(hw_num, 0, MASKED, 0);
+- xive_cleanup_irq_data(xd);
+ }
+
+ static void kvmppc_xive_free_sources(struct kvmppc_xive_src_block *sb)
+@@ -1737,9 +1736,10 @@ static void kvmppc_xive_free_sources(struct kvmppc_xive_src_block *sb)
+ continue;
+
+ kvmppc_xive_cleanup_irq(state->ipi_number, &state->ipi_data);
++ xive_cleanup_irq_data(&state->ipi_data);
+ xive_native_free_irq(state->ipi_number);
+
+- /* Pass-through, cleanup too */
++ /* Pass-through, cleanup too but keep IRQ hw data */
+ if (state->pt_number)
+ kvmppc_xive_cleanup_irq(state->pt_number, state->pt_data);
+
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index 79b79408d92e..578174a33d22 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -632,6 +632,9 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
+ case KVM_CAP_MAX_VCPUS:
+ r = KVM_MAX_VCPUS;
+ break;
++ case KVM_CAP_MAX_VCPU_ID:
++ r = KVM_MAX_VCPU_ID;
++ break;
+ #ifdef CONFIG_PPC_BOOK3S_64
+ case KVM_CAP_PPC_GET_SMMU_INFO:
+ r = 1;
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index 81f8a0c838ae..4004dbdab9c7 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -1827,6 +1827,7 @@ static int power_pmu_event_init(struct perf_event *event)
+ int n;
+ int err;
+ struct cpu_hw_events *cpuhw;
++ u64 bhrb_filter;
+
+ if (!ppmu)
+ return -ENOENT;
+@@ -1932,13 +1933,14 @@ static int power_pmu_event_init(struct perf_event *event)
+ err = power_check_constraints(cpuhw, events, cflags, n + 1);
+
+ if (has_branch_stack(event)) {
+- cpuhw->bhrb_filter = ppmu->bhrb_filter_map(
++ bhrb_filter = ppmu->bhrb_filter_map(
+ event->attr.branch_sample_type);
+
+- if (cpuhw->bhrb_filter == -1) {
++ if (bhrb_filter == -1) {
+ put_cpu_var(cpu_hw_events);
+ return -EOPNOTSUPP;
+ }
++ cpuhw->bhrb_filter = bhrb_filter;
+ }
+
+ put_cpu_var(cpu_hw_events);
+diff --git a/arch/powerpc/perf/power8-pmu.c b/arch/powerpc/perf/power8-pmu.c
+index d12a2db26353..d10feef93b6b 100644
+--- a/arch/powerpc/perf/power8-pmu.c
++++ b/arch/powerpc/perf/power8-pmu.c
+@@ -29,6 +29,7 @@ enum {
+ #define POWER8_MMCRA_IFM1 0x0000000040000000UL
+ #define POWER8_MMCRA_IFM2 0x0000000080000000UL
+ #define POWER8_MMCRA_IFM3 0x00000000C0000000UL
++#define POWER8_MMCRA_BHRB_MASK 0x00000000C0000000UL
+
+ /*
+ * Raw event encoding for PowerISA v2.07 (Power8):
+@@ -243,6 +244,8 @@ static u64 power8_bhrb_filter_map(u64 branch_sample_type)
+
+ static void power8_config_bhrb(u64 pmu_bhrb_filter)
+ {
++ pmu_bhrb_filter &= POWER8_MMCRA_BHRB_MASK;
++
+ /* Enable BHRB filter in PMU */
+ mtspr(SPRN_MMCRA, (mfspr(SPRN_MMCRA) | pmu_bhrb_filter));
+ }
+diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
+index e012b1030a5b..c07b1615ee39 100644
+--- a/arch/powerpc/perf/power9-pmu.c
++++ b/arch/powerpc/perf/power9-pmu.c
+@@ -100,6 +100,7 @@ enum {
+ #define POWER9_MMCRA_IFM1 0x0000000040000000UL
+ #define POWER9_MMCRA_IFM2 0x0000000080000000UL
+ #define POWER9_MMCRA_IFM3 0x00000000C0000000UL
++#define POWER9_MMCRA_BHRB_MASK 0x00000000C0000000UL
+
+ /* Nasty Power9 specific hack */
+ #define PVR_POWER9_CUMULUS 0x00002000
+@@ -308,6 +309,8 @@ static u64 power9_bhrb_filter_map(u64 branch_sample_type)
+
+ static void power9_config_bhrb(u64 pmu_bhrb_filter)
+ {
++ pmu_bhrb_filter &= POWER9_MMCRA_BHRB_MASK;
++
+ /* Enable BHRB filter in PMU */
+ mtspr(SPRN_MMCRA, (mfspr(SPRN_MMCRA) | pmu_bhrb_filter));
+ }
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index c54cb26eb7f5..8ff7cb3da1cb 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -27,14 +27,14 @@
+ #include <linux/module.h>
+ #include <linux/cpufeature.h>
+ #include <linux/init.h>
+-#include <linux/spinlock.h>
++#include <linux/mutex.h>
+ #include <linux/fips.h>
+ #include <linux/string.h>
+ #include <crypto/xts.h>
+ #include <asm/cpacf.h>
+
+ static u8 *ctrblk;
+-static DEFINE_SPINLOCK(ctrblk_lock);
++static DEFINE_MUTEX(ctrblk_lock);
+
+ static cpacf_mask_t km_functions, kmc_functions, kmctr_functions,
+ kma_functions;
+@@ -698,7 +698,7 @@ static int ctr_aes_crypt(struct blkcipher_desc *desc, unsigned long modifier,
+ unsigned int n, nbytes;
+ int ret, locked;
+
+- locked = spin_trylock(&ctrblk_lock);
++ locked = mutex_trylock(&ctrblk_lock);
+
+ ret = blkcipher_walk_virt_block(desc, walk, AES_BLOCK_SIZE);
+ while ((nbytes = walk->nbytes) >= AES_BLOCK_SIZE) {
+@@ -716,7 +716,7 @@ static int ctr_aes_crypt(struct blkcipher_desc *desc, unsigned long modifier,
+ ret = blkcipher_walk_done(desc, walk, nbytes - n);
+ }
+ if (locked)
+- spin_unlock(&ctrblk_lock);
++ mutex_unlock(&ctrblk_lock);
+ /*
+ * final block may be < AES_BLOCK_SIZE, copy only nbytes
+ */
+@@ -826,19 +826,45 @@ static int gcm_aes_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
+ return 0;
+ }
+
+-static void gcm_sg_walk_start(struct gcm_sg_walk *gw, struct scatterlist *sg,
+- unsigned int len)
++static void gcm_walk_start(struct gcm_sg_walk *gw, struct scatterlist *sg,
++ unsigned int len)
+ {
+ memset(gw, 0, sizeof(*gw));
+ gw->walk_bytes_remain = len;
+ scatterwalk_start(&gw->walk, sg);
+ }
+
+-static int gcm_sg_walk_go(struct gcm_sg_walk *gw, unsigned int minbytesneeded)
++static inline unsigned int _gcm_sg_clamp_and_map(struct gcm_sg_walk *gw)
++{
++ struct scatterlist *nextsg;
++
++ gw->walk_bytes = scatterwalk_clamp(&gw->walk, gw->walk_bytes_remain);
++ while (!gw->walk_bytes) {
++ nextsg = sg_next(gw->walk.sg);
++ if (!nextsg)
++ return 0;
++ scatterwalk_start(&gw->walk, nextsg);
++ gw->walk_bytes = scatterwalk_clamp(&gw->walk,
++ gw->walk_bytes_remain);
++ }
++ gw->walk_ptr = scatterwalk_map(&gw->walk);
++ return gw->walk_bytes;
++}
++
++static inline void _gcm_sg_unmap_and_advance(struct gcm_sg_walk *gw,
++ unsigned int nbytes)
++{
++ gw->walk_bytes_remain -= nbytes;
++ scatterwalk_unmap(&gw->walk);
++ scatterwalk_advance(&gw->walk, nbytes);
++ scatterwalk_done(&gw->walk, 0, gw->walk_bytes_remain);
++ gw->walk_ptr = NULL;
++}
++
++static int gcm_in_walk_go(struct gcm_sg_walk *gw, unsigned int minbytesneeded)
+ {
+ int n;
+
+- /* minbytesneeded <= AES_BLOCK_SIZE */
+ if (gw->buf_bytes && gw->buf_bytes >= minbytesneeded) {
+ gw->ptr = gw->buf;
+ gw->nbytes = gw->buf_bytes;
+@@ -851,13 +877,11 @@ static int gcm_sg_walk_go(struct gcm_sg_walk *gw, unsigned int minbytesneeded)
+ goto out;
+ }
+
+- gw->walk_bytes = scatterwalk_clamp(&gw->walk, gw->walk_bytes_remain);
+- if (!gw->walk_bytes) {
+- scatterwalk_start(&gw->walk, sg_next(gw->walk.sg));
+- gw->walk_bytes = scatterwalk_clamp(&gw->walk,
+- gw->walk_bytes_remain);
++ if (!_gcm_sg_clamp_and_map(gw)) {
++ gw->ptr = NULL;
++ gw->nbytes = 0;
++ goto out;
+ }
+- gw->walk_ptr = scatterwalk_map(&gw->walk);
+
+ if (!gw->buf_bytes && gw->walk_bytes >= minbytesneeded) {
+ gw->ptr = gw->walk_ptr;
+@@ -869,51 +893,90 @@ static int gcm_sg_walk_go(struct gcm_sg_walk *gw, unsigned int minbytesneeded)
+ n = min(gw->walk_bytes, AES_BLOCK_SIZE - gw->buf_bytes);
+ memcpy(gw->buf + gw->buf_bytes, gw->walk_ptr, n);
+ gw->buf_bytes += n;
+- gw->walk_bytes_remain -= n;
+- scatterwalk_unmap(&gw->walk);
+- scatterwalk_advance(&gw->walk, n);
+- scatterwalk_done(&gw->walk, 0, gw->walk_bytes_remain);
+-
++ _gcm_sg_unmap_and_advance(gw, n);
+ if (gw->buf_bytes >= minbytesneeded) {
+ gw->ptr = gw->buf;
+ gw->nbytes = gw->buf_bytes;
+ goto out;
+ }
+-
+- gw->walk_bytes = scatterwalk_clamp(&gw->walk,
+- gw->walk_bytes_remain);
+- if (!gw->walk_bytes) {
+- scatterwalk_start(&gw->walk, sg_next(gw->walk.sg));
+- gw->walk_bytes = scatterwalk_clamp(&gw->walk,
+- gw->walk_bytes_remain);
++ if (!_gcm_sg_clamp_and_map(gw)) {
++ gw->ptr = NULL;
++ gw->nbytes = 0;
++ goto out;
+ }
+- gw->walk_ptr = scatterwalk_map(&gw->walk);
+ }
+
+ out:
+ return gw->nbytes;
+ }
+
+-static void gcm_sg_walk_done(struct gcm_sg_walk *gw, unsigned int bytesdone)
++static int gcm_out_walk_go(struct gcm_sg_walk *gw, unsigned int minbytesneeded)
+ {
+- int n;
++ if (gw->walk_bytes_remain == 0) {
++ gw->ptr = NULL;
++ gw->nbytes = 0;
++ goto out;
++ }
+
++ if (!_gcm_sg_clamp_and_map(gw)) {
++ gw->ptr = NULL;
++ gw->nbytes = 0;
++ goto out;
++ }
++
++ if (gw->walk_bytes >= minbytesneeded) {
++ gw->ptr = gw->walk_ptr;
++ gw->nbytes = gw->walk_bytes;
++ goto out;
++ }
++
++ scatterwalk_unmap(&gw->walk);
++ gw->walk_ptr = NULL;
++
++ gw->ptr = gw->buf;
++ gw->nbytes = sizeof(gw->buf);
++
++out:
++ return gw->nbytes;
++}
++
++static int gcm_in_walk_done(struct gcm_sg_walk *gw, unsigned int bytesdone)
++{
+ if (gw->ptr == NULL)
+- return;
++ return 0;
+
+ if (gw->ptr == gw->buf) {
+- n = gw->buf_bytes - bytesdone;
++ int n = gw->buf_bytes - bytesdone;
+ if (n > 0) {
+ memmove(gw->buf, gw->buf + bytesdone, n);
+- gw->buf_bytes -= n;
++ gw->buf_bytes = n;
+ } else
+ gw->buf_bytes = 0;
+- } else {
+- gw->walk_bytes_remain -= bytesdone;
+- scatterwalk_unmap(&gw->walk);
+- scatterwalk_advance(&gw->walk, bytesdone);
+- scatterwalk_done(&gw->walk, 0, gw->walk_bytes_remain);
+- }
++ } else
++ _gcm_sg_unmap_and_advance(gw, bytesdone);
++
++ return bytesdone;
++}
++
++static int gcm_out_walk_done(struct gcm_sg_walk *gw, unsigned int bytesdone)
++{
++ int i, n;
++
++ if (gw->ptr == NULL)
++ return 0;
++
++ if (gw->ptr == gw->buf) {
++ for (i = 0; i < bytesdone; i += n) {
++ if (!_gcm_sg_clamp_and_map(gw))
++ return i;
++ n = min(gw->walk_bytes, bytesdone - i);
++ memcpy(gw->walk_ptr, gw->buf + i, n);
++ _gcm_sg_unmap_and_advance(gw, n);
++ }
++ } else
++ _gcm_sg_unmap_and_advance(gw, bytesdone);
++
++ return bytesdone;
+ }
+
+ static int gcm_aes_crypt(struct aead_request *req, unsigned int flags)
+@@ -926,7 +989,7 @@ static int gcm_aes_crypt(struct aead_request *req, unsigned int flags)
+ unsigned int pclen = req->cryptlen;
+ int ret = 0;
+
+- unsigned int len, in_bytes, out_bytes,
++ unsigned int n, len, in_bytes, out_bytes,
+ min_bytes, bytes, aad_bytes, pc_bytes;
+ struct gcm_sg_walk gw_in, gw_out;
+ u8 tag[GHASH_DIGEST_SIZE];
+@@ -963,14 +1026,14 @@ static int gcm_aes_crypt(struct aead_request *req, unsigned int flags)
+ *(u32 *)(param.j0 + ivsize) = 1;
+ memcpy(param.k, ctx->key, ctx->key_len);
+
+- gcm_sg_walk_start(&gw_in, req->src, len);
+- gcm_sg_walk_start(&gw_out, req->dst, len);
++ gcm_walk_start(&gw_in, req->src, len);
++ gcm_walk_start(&gw_out, req->dst, len);
+
+ do {
+ min_bytes = min_t(unsigned int,
+ aadlen > 0 ? aadlen : pclen, AES_BLOCK_SIZE);
+- in_bytes = gcm_sg_walk_go(&gw_in, min_bytes);
+- out_bytes = gcm_sg_walk_go(&gw_out, min_bytes);
++ in_bytes = gcm_in_walk_go(&gw_in, min_bytes);
++ out_bytes = gcm_out_walk_go(&gw_out, min_bytes);
+ bytes = min(in_bytes, out_bytes);
+
+ if (aadlen + pclen <= bytes) {
+@@ -997,8 +1060,11 @@ static int gcm_aes_crypt(struct aead_request *req, unsigned int flags)
+ gw_in.ptr + aad_bytes, pc_bytes,
+ gw_in.ptr, aad_bytes);
+
+- gcm_sg_walk_done(&gw_in, aad_bytes + pc_bytes);
+- gcm_sg_walk_done(&gw_out, aad_bytes + pc_bytes);
++ n = aad_bytes + pc_bytes;
++ if (gcm_in_walk_done(&gw_in, n) != n)
++ return -ENOMEM;
++ if (gcm_out_walk_done(&gw_out, n) != n)
++ return -ENOMEM;
+ aadlen -= aad_bytes;
+ pclen -= pc_bytes;
+ } while (aadlen + pclen > 0);
+diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c
+index 5346b5a80bb6..65bda1178963 100644
+--- a/arch/s390/crypto/des_s390.c
++++ b/arch/s390/crypto/des_s390.c
+@@ -14,6 +14,7 @@
+ #include <linux/cpufeature.h>
+ #include <linux/crypto.h>
+ #include <linux/fips.h>
++#include <linux/mutex.h>
+ #include <crypto/algapi.h>
+ #include <crypto/des.h>
+ #include <asm/cpacf.h>
+@@ -21,7 +22,7 @@
+ #define DES3_KEY_SIZE (3 * DES_KEY_SIZE)
+
+ static u8 *ctrblk;
+-static DEFINE_SPINLOCK(ctrblk_lock);
++static DEFINE_MUTEX(ctrblk_lock);
+
+ static cpacf_mask_t km_functions, kmc_functions, kmctr_functions;
+
+@@ -387,7 +388,7 @@ static int ctr_desall_crypt(struct blkcipher_desc *desc, unsigned long fc,
+ unsigned int n, nbytes;
+ int ret, locked;
+
+- locked = spin_trylock(&ctrblk_lock);
++ locked = mutex_trylock(&ctrblk_lock);
+
+ ret = blkcipher_walk_virt_block(desc, walk, DES_BLOCK_SIZE);
+ while ((nbytes = walk->nbytes) >= DES_BLOCK_SIZE) {
+@@ -404,7 +405,7 @@ static int ctr_desall_crypt(struct blkcipher_desc *desc, unsigned long fc,
+ ret = blkcipher_walk_done(desc, walk, nbytes - n);
+ }
+ if (locked)
+- spin_unlock(&ctrblk_lock);
++ mutex_unlock(&ctrblk_lock);
+ /* final block may be < DES_BLOCK_SIZE, copy only nbytes */
+ if (nbytes) {
+ cpacf_kmctr(fc, ctx->key, buf, walk->src.virt.addr,
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index ac5da6b0b862..f538e3fac7ad 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -489,6 +489,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
+ break;
+ case KVM_CAP_NR_VCPUS:
+ case KVM_CAP_MAX_VCPUS:
++ case KVM_CAP_MAX_VCPU_ID:
+ r = KVM_S390_BSCA_CPU_SLOTS;
+ if (!kvm_s390_use_sca_entries())
+ r = KVM_MAX_VCPUS;
+diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
+index d245f89d1395..d220b6848746 100644
+--- a/arch/sparc/mm/ultra.S
++++ b/arch/sparc/mm/ultra.S
+@@ -587,7 +587,7 @@ xcall_flush_tlb_kernel_range: /* 44 insns */
+ sub %g7, %g1, %g3
+ srlx %g3, 18, %g2
+ brnz,pn %g2, 2f
+- add %g2, 1, %g2
++ sethi %hi(PAGE_SIZE), %g2
+ sub %g3, %g2, %g3
+ or %g1, 0x20, %g1 ! Nucleus
+ 1: stxa %g0, [%g1 + %g3] ASI_DMMU_DEMAP
+@@ -751,7 +751,7 @@ __cheetah_xcall_flush_tlb_kernel_range: /* 44 insns */
+ sub %g7, %g1, %g3
+ srlx %g3, 18, %g2
+ brnz,pn %g2, 2f
+- add %g2, 1, %g2
++ sethi %hi(PAGE_SIZE), %g2
+ sub %g3, %g2, %g3
+ or %g1, 0x20, %g1 ! Nucleus
+ 1: stxa %g0, [%g1 + %g3] ASI_DMMU_DEMAP
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index 4d2a401c178b..9f033dfd2766 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -752,18 +752,21 @@ union ftrace_op_code_union {
+ } __attribute__((packed));
+ };
+
++#define RET_SIZE 1
++
+ static unsigned long
+ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
+ {
+- unsigned const char *jmp;
+ unsigned long start_offset;
+ unsigned long end_offset;
+ unsigned long op_offset;
+ unsigned long offset;
++ unsigned long npages;
+ unsigned long size;
+- unsigned long ip;
++ unsigned long retq;
+ unsigned long *ptr;
+ void *trampoline;
++ void *ip;
+ /* 48 8b 15 <offset> is movq <offset>(%rip), %rdx */
+ unsigned const char op_ref[] = { 0x48, 0x8b, 0x15 };
+ union ftrace_op_code_union op_ptr;
+@@ -783,27 +786,28 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
+
+ /*
+ * Allocate enough size to store the ftrace_caller code,
+- * the jmp to ftrace_epilogue, as well as the address of
+- * the ftrace_ops this trampoline is used for.
++ * the iret , as well as the address of the ftrace_ops this
++ * trampoline is used for.
+ */
+- trampoline = alloc_tramp(size + MCOUNT_INSN_SIZE + sizeof(void *));
++ trampoline = alloc_tramp(size + RET_SIZE + sizeof(void *));
+ if (!trampoline)
+ return 0;
+
+- *tramp_size = size + MCOUNT_INSN_SIZE + sizeof(void *);
++ *tramp_size = size + RET_SIZE + sizeof(void *);
++ npages = DIV_ROUND_UP(*tramp_size, PAGE_SIZE);
+
+ /* Copy ftrace_caller onto the trampoline memory */
+ ret = probe_kernel_read(trampoline, (void *)start_offset, size);
+- if (WARN_ON(ret < 0)) {
+- tramp_free(trampoline, *tramp_size);
+- return 0;
+- }
++ if (WARN_ON(ret < 0))
++ goto fail;
+
+- ip = (unsigned long)trampoline + size;
++ ip = trampoline + size;
+
+- /* The trampoline ends with a jmp to ftrace_epilogue */
+- jmp = ftrace_jmp_replace(ip, (unsigned long)ftrace_epilogue);
+- memcpy(trampoline + size, jmp, MCOUNT_INSN_SIZE);
++ /* The trampoline ends with ret(q) */
++ retq = (unsigned long)ftrace_stub;
++ ret = probe_kernel_read(ip, (void *)retq, RET_SIZE);
++ if (WARN_ON(ret < 0))
++ goto fail;
+
+ /*
+ * The address of the ftrace_ops that is used for this trampoline
+@@ -813,17 +817,15 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
+ * the global function_trace_op variable.
+ */
+
+- ptr = (unsigned long *)(trampoline + size + MCOUNT_INSN_SIZE);
++ ptr = (unsigned long *)(trampoline + size + RET_SIZE);
+ *ptr = (unsigned long)ops;
+
+ op_offset -= start_offset;
+ memcpy(&op_ptr, trampoline + op_offset, OP_REF_SIZE);
+
+ /* Are we pointing to the reference? */
+- if (WARN_ON(memcmp(op_ptr.op, op_ref, 3) != 0)) {
+- tramp_free(trampoline, *tramp_size);
+- return 0;
+- }
++ if (WARN_ON(memcmp(op_ptr.op, op_ref, 3) != 0))
++ goto fail;
+
+ /* Load the contents of ptr into the callback parameter */
+ offset = (unsigned long)ptr;
+@@ -837,7 +839,16 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
+ /* ALLOC_TRAMP flags lets us know we created it */
+ ops->flags |= FTRACE_OPS_FL_ALLOC_TRAMP;
+
++ /*
++ * Module allocation needs to be completed by making the page
++ * executable. The page is still writable, which is a security hazard,
++ * but anyhow ftrace breaks W^X completely.
++ */
++ set_memory_x((unsigned long)trampoline, npages);
+ return (unsigned long)trampoline;
++fail:
++ tramp_free(trampoline, *tramp_size);
++ return 0;
+ }
+
+ static unsigned long calc_trampoline_call_offset(bool save_regs)
+diff --git a/arch/x86/kernel/ftrace_64.S b/arch/x86/kernel/ftrace_64.S
+index 91b2cff4b79a..75f2b36b41a6 100644
+--- a/arch/x86/kernel/ftrace_64.S
++++ b/arch/x86/kernel/ftrace_64.S
+@@ -171,9 +171,6 @@ GLOBAL(ftrace_call)
+ restore_mcount_regs
+
+ /*
+- * The copied trampoline must call ftrace_epilogue as it
+- * still may need to call the function graph tracer.
+- *
+ * The code up to this label is copied into trampolines so
+ * think twice before adding any new code or changing the
+ * layout here.
+@@ -185,7 +182,10 @@ GLOBAL(ftrace_graph_call)
+ jmp ftrace_stub
+ #endif
+
+-/* This is weak to keep gas from relaxing the jumps */
++/*
++ * This is weak to keep gas from relaxing the jumps.
++ * It is also used to copy the retq for trampolines.
++ */
+ WEAK(ftrace_stub)
+ retq
+ ENDPROC(ftrace_caller)
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 544bc2dfe408..e83a057564d1 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -431,8 +431,20 @@ void *alloc_insn_page(void)
+ void *page;
+
+ page = module_alloc(PAGE_SIZE);
+- if (page)
+- set_memory_ro((unsigned long)page & PAGE_MASK, 1);
++ if (!page)
++ return NULL;
++
++ /*
++ * First make the page read-only, and only then make it executable to
++ * prevent it from being W+X in between.
++ */
++ set_memory_ro((unsigned long)page, 1);
++
++ /*
++ * TODO: Once additional kernel code protection mechanisms are set, ensure
++ * that the page was not maliciously altered and it is still zeroed.
++ */
++ set_memory_x((unsigned long)page, 1);
+
+ return page;
+ }
+@@ -440,8 +452,12 @@ void *alloc_insn_page(void)
+ /* Recover page to RW mode before releasing it */
+ void free_insn_page(void *page)
+ {
+- set_memory_nx((unsigned long)page & PAGE_MASK, 1);
+- set_memory_rw((unsigned long)page & PAGE_MASK, 1);
++ /*
++ * First make the page non-executable, and only then make it writable to
++ * prevent it from being W+X in between.
++ */
++ set_memory_nx((unsigned long)page, 1);
++ set_memory_rw((unsigned long)page, 1);
+ module_memfree(page);
+ }
+
+diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
+index 2fb152d813c1..85e6d5620188 100644
+--- a/arch/x86/kernel/vmlinux.lds.S
++++ b/arch/x86/kernel/vmlinux.lds.S
+@@ -151,10 +151,10 @@ SECTIONS
+ *(.text.__x86.indirect_thunk)
+ __indirect_thunk_end = .;
+ #endif
+- } :text = 0x9090
+
+- /* End of text section */
+- _etext = .;
++ /* End of text section */
++ _etext = .;
++ } :text = 0x9090
+
+ NOTES :text :note
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index be4ba0975a0f..7fed1d6dd1a1 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2987,6 +2987,9 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
+ case KVM_CAP_MAX_VCPUS:
+ r = KVM_MAX_VCPUS;
+ break;
++ case KVM_CAP_MAX_VCPU_ID:
++ r = KVM_MAX_VCPU_ID;
++ break;
+ case KVM_CAP_NR_MEMSLOTS:
+ r = KVM_USER_MEM_SLOTS;
+ break;
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index 9cbe8f5c9aca..6e241a3c31ee 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -595,6 +595,10 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
+
+ plane = crtc->primary;
+
++ /* allow disabling with the primary plane leased */
++ if (crtc_req->mode_valid && !drm_lease_held(file_priv, plane->base.id))
++ return -EACCES;
++
+ mutex_lock(&crtc->dev->mode_config.mutex);
+ drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);
+ retry:
+diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
+index d36b1be632d9..2411b6de055e 100644
+--- a/drivers/gpu/drm/drm_plane.c
++++ b/drivers/gpu/drm/drm_plane.c
+@@ -940,6 +940,11 @@ retry:
+ if (ret)
+ goto out;
+
++ if (!drm_lease_held(file_priv, crtc->cursor->base.id)) {
++ ret = -EACCES;
++ goto out;
++ }
++
+ ret = drm_mode_cursor_universal(crtc, req, file_priv, &ctx);
+ goto out;
+ }
+@@ -1042,6 +1047,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
+
+ plane = crtc->primary;
+
++ if (!drm_lease_held(file_priv, plane->base.id))
++ return -EACCES;
++
+ if (crtc->funcs->page_flip_target) {
+ u32 current_vblank;
+ int r;
+diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h
+index eef54e9b5d77..7957eafa5f0e 100644
+--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h
++++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h
+@@ -38,6 +38,7 @@ struct nvkm_i2c_bus {
+ struct mutex mutex;
+ struct list_head head;
+ struct i2c_adapter i2c;
++ u8 enabled;
+ };
+
+ int nvkm_i2c_bus_acquire(struct nvkm_i2c_bus *);
+@@ -57,6 +58,7 @@ struct nvkm_i2c_aux {
+ struct mutex mutex;
+ struct list_head head;
+ struct i2c_adapter i2c;
++ u8 enabled;
+
+ u32 intr;
+ };
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+index 4c1f547da463..b4e7404fe660 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+@@ -105,9 +105,15 @@ nvkm_i2c_aux_acquire(struct nvkm_i2c_aux *aux)
+ {
+ struct nvkm_i2c_pad *pad = aux->pad;
+ int ret;
++
+ AUX_TRACE(aux, "acquire");
+ mutex_lock(&aux->mutex);
+- ret = nvkm_i2c_pad_acquire(pad, NVKM_I2C_PAD_AUX);
++
++ if (aux->enabled)
++ ret = nvkm_i2c_pad_acquire(pad, NVKM_I2C_PAD_AUX);
++ else
++ ret = -EIO;
++
+ if (ret)
+ mutex_unlock(&aux->mutex);
+ return ret;
+@@ -145,6 +151,24 @@ nvkm_i2c_aux_del(struct nvkm_i2c_aux **paux)
+ }
+ }
+
++void
++nvkm_i2c_aux_init(struct nvkm_i2c_aux *aux)
++{
++ AUX_TRACE(aux, "init");
++ mutex_lock(&aux->mutex);
++ aux->enabled = true;
++ mutex_unlock(&aux->mutex);
++}
++
++void
++nvkm_i2c_aux_fini(struct nvkm_i2c_aux *aux)
++{
++ AUX_TRACE(aux, "fini");
++ mutex_lock(&aux->mutex);
++ aux->enabled = false;
++ mutex_unlock(&aux->mutex);
++}
++
+ int
+ nvkm_i2c_aux_ctor(const struct nvkm_i2c_aux_func *func,
+ struct nvkm_i2c_pad *pad, int id,
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h
+index 7d56c4ba693c..08f6b2ee64ab 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.h
+@@ -16,6 +16,8 @@ int nvkm_i2c_aux_ctor(const struct nvkm_i2c_aux_func *, struct nvkm_i2c_pad *,
+ int nvkm_i2c_aux_new_(const struct nvkm_i2c_aux_func *, struct nvkm_i2c_pad *,
+ int id, struct nvkm_i2c_aux **);
+ void nvkm_i2c_aux_del(struct nvkm_i2c_aux **);
++void nvkm_i2c_aux_init(struct nvkm_i2c_aux *);
++void nvkm_i2c_aux_fini(struct nvkm_i2c_aux *);
+ int nvkm_i2c_aux_xfer(struct nvkm_i2c_aux *, bool retry, u8 type,
+ u32 addr, u8 *data, u8 *size);
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
+index 4f197b15acf6..ecacb22834d7 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
+@@ -160,8 +160,18 @@ nvkm_i2c_fini(struct nvkm_subdev *subdev, bool suspend)
+ {
+ struct nvkm_i2c *i2c = nvkm_i2c(subdev);
+ struct nvkm_i2c_pad *pad;
++ struct nvkm_i2c_bus *bus;
++ struct nvkm_i2c_aux *aux;
+ u32 mask;
+
++ list_for_each_entry(aux, &i2c->aux, head) {
++ nvkm_i2c_aux_fini(aux);
++ }
++
++ list_for_each_entry(bus, &i2c->bus, head) {
++ nvkm_i2c_bus_fini(bus);
++ }
++
+ if ((mask = (1 << i2c->func->aux) - 1), i2c->func->aux_stat) {
+ i2c->func->aux_mask(i2c, NVKM_I2C_ANY, mask, 0);
+ i2c->func->aux_stat(i2c, &mask, &mask, &mask, &mask);
+@@ -180,6 +190,7 @@ nvkm_i2c_init(struct nvkm_subdev *subdev)
+ struct nvkm_i2c *i2c = nvkm_i2c(subdev);
+ struct nvkm_i2c_bus *bus;
+ struct nvkm_i2c_pad *pad;
++ struct nvkm_i2c_aux *aux;
+
+ list_for_each_entry(pad, &i2c->pad, head) {
+ nvkm_i2c_pad_init(pad);
+@@ -189,6 +200,10 @@ nvkm_i2c_init(struct nvkm_subdev *subdev)
+ nvkm_i2c_bus_init(bus);
+ }
+
++ list_for_each_entry(aux, &i2c->aux, head) {
++ nvkm_i2c_aux_init(aux);
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.c
+index 807a2b67bd64..ed50cc3736b9 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.c
+@@ -110,6 +110,19 @@ nvkm_i2c_bus_init(struct nvkm_i2c_bus *bus)
+ BUS_TRACE(bus, "init");
+ if (bus->func->init)
+ bus->func->init(bus);
++
++ mutex_lock(&bus->mutex);
++ bus->enabled = true;
++ mutex_unlock(&bus->mutex);
++}
++
++void
++nvkm_i2c_bus_fini(struct nvkm_i2c_bus *bus)
++{
++ BUS_TRACE(bus, "fini");
++ mutex_lock(&bus->mutex);
++ bus->enabled = false;
++ mutex_unlock(&bus->mutex);
+ }
+
+ void
+@@ -126,9 +139,15 @@ nvkm_i2c_bus_acquire(struct nvkm_i2c_bus *bus)
+ {
+ struct nvkm_i2c_pad *pad = bus->pad;
+ int ret;
++
+ BUS_TRACE(bus, "acquire");
+ mutex_lock(&bus->mutex);
+- ret = nvkm_i2c_pad_acquire(pad, NVKM_I2C_PAD_I2C);
++
++ if (bus->enabled)
++ ret = nvkm_i2c_pad_acquire(pad, NVKM_I2C_PAD_I2C);
++ else
++ ret = -EIO;
++
+ if (ret)
+ mutex_unlock(&bus->mutex);
+ return ret;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.h b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.h
+index bea0dd33961e..465464bba58b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.h
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.h
+@@ -18,6 +18,7 @@ int nvkm_i2c_bus_new_(const struct nvkm_i2c_bus_func *, struct nvkm_i2c_pad *,
+ int id, struct nvkm_i2c_bus **);
+ void nvkm_i2c_bus_del(struct nvkm_i2c_bus **);
+ void nvkm_i2c_bus_init(struct nvkm_i2c_bus *);
++void nvkm_i2c_bus_fini(struct nvkm_i2c_bus *);
+
+ int nvkm_i2c_bit_xfer(struct nvkm_i2c_bus *, struct i2c_msg *, int);
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+index f814d37b1db2..00a06768edb2 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+@@ -442,6 +442,14 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static void rockchip_drm_platform_shutdown(struct platform_device *pdev)
++{
++ struct drm_device *drm = platform_get_drvdata(pdev);
++
++ if (drm)
++ drm_atomic_helper_shutdown(drm);
++}
++
+ static const struct of_device_id rockchip_drm_dt_ids[] = {
+ { .compatible = "rockchip,display-subsystem", },
+ { /* sentinel */ },
+@@ -451,6 +459,7 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids);
+ static struct platform_driver rockchip_drm_platform_driver = {
+ .probe = rockchip_drm_platform_probe,
+ .remove = rockchip_drm_platform_remove,
++ .shutdown = rockchip_drm_platform_shutdown,
+ .driver = {
+ .name = "rockchip-drm",
+ .of_match_table = rockchip_drm_dt_ids,
+diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+index a564b5dfe082..dc9b1398adb9 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
++++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+@@ -177,7 +177,8 @@ static int sun8i_hdmi_phy_config_h3(struct dw_hdmi *hdmi,
+ SUN8I_HDMI_PHY_ANA_CFG2_REG_BIGSW |
+ SUN8I_HDMI_PHY_ANA_CFG2_REG_SLV(4);
+ ana_cfg3_init |= SUN8I_HDMI_PHY_ANA_CFG3_REG_AMPCK(9) |
+- SUN8I_HDMI_PHY_ANA_CFG3_REG_AMP(13);
++ SUN8I_HDMI_PHY_ANA_CFG3_REG_AMP(13) |
++ SUN8I_HDMI_PHY_ANA_CFG3_REG_EMP(3);
+ }
+
+ regmap_update_bits(phy->regs, SUN8I_HDMI_PHY_ANA_CFG1_REG,
+@@ -501,22 +502,13 @@ int sun8i_hdmi_phy_probe(struct sun8i_dw_hdmi *hdmi, struct device_node *node)
+ goto err_put_clk_pll0;
+ }
+ }
+-
+- ret = sun8i_phy_clk_create(phy, dev,
+- phy->variant->has_second_pll);
+- if (ret) {
+- dev_err(dev, "Couldn't create the PHY clock\n");
+- goto err_put_clk_pll1;
+- }
+-
+- clk_prepare_enable(phy->clk_phy);
+ }
+
+ phy->rst_phy = of_reset_control_get_shared(node, "phy");
+ if (IS_ERR(phy->rst_phy)) {
+ dev_err(dev, "Could not get phy reset control\n");
+ ret = PTR_ERR(phy->rst_phy);
+- goto err_disable_clk_phy;
++ goto err_put_clk_pll1;
+ }
+
+ ret = reset_control_deassert(phy->rst_phy);
+@@ -537,18 +529,29 @@ int sun8i_hdmi_phy_probe(struct sun8i_dw_hdmi *hdmi, struct device_node *node)
+ goto err_disable_clk_bus;
+ }
+
++ if (phy->variant->has_phy_clk) {
++ ret = sun8i_phy_clk_create(phy, dev,
++ phy->variant->has_second_pll);
++ if (ret) {
++ dev_err(dev, "Couldn't create the PHY clock\n");
++ goto err_disable_clk_mod;
++ }
++
++ clk_prepare_enable(phy->clk_phy);
++ }
++
+ hdmi->phy = phy;
+
+ return 0;
+
++err_disable_clk_mod:
++ clk_disable_unprepare(phy->clk_mod);
+ err_disable_clk_bus:
+ clk_disable_unprepare(phy->clk_bus);
+ err_deassert_rst_phy:
+ reset_control_assert(phy->rst_phy);
+ err_put_rst_phy:
+ reset_control_put(phy->rst_phy);
+-err_disable_clk_phy:
+- clk_disable_unprepare(phy->clk_phy);
+ err_put_clk_pll1:
+ clk_put(phy->clk_pll1);
+ err_put_clk_pll0:
+diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
+index 4f80100ff5f3..4cce11fd8836 100644
+--- a/drivers/gpu/drm/tegra/gem.c
++++ b/drivers/gpu/drm/tegra/gem.c
+@@ -204,7 +204,7 @@ static void tegra_bo_free(struct drm_device *drm, struct tegra_bo *bo)
+ {
+ if (bo->pages) {
+ dma_unmap_sg(drm->dev, bo->sgt->sgl, bo->sgt->nents,
+- DMA_BIDIRECTIONAL);
++ DMA_FROM_DEVICE);
+ drm_gem_put_pages(&bo->gem, bo->pages, true, true);
+ sg_free_table(bo->sgt);
+ kfree(bo->sgt);
+@@ -230,7 +230,7 @@ static int tegra_bo_get_pages(struct drm_device *drm, struct tegra_bo *bo)
+ }
+
+ err = dma_map_sg(drm->dev, bo->sgt->sgl, bo->sgt->nents,
+- DMA_BIDIRECTIONAL);
++ DMA_FROM_DEVICE);
+ if (err == 0) {
+ err = -EFAULT;
+ goto free_sgt;
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index c72b942f2bdf..82ae68716696 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -1291,7 +1291,13 @@ static int vmw_master_set(struct drm_device *dev,
+ }
+
+ dev_priv->active_master = vmaster;
+- drm_sysfs_hotplug_event(dev);
++
++ /*
++ * Inform a new master that the layout may have changed while
++ * it was gone.
++ */
++ if (!from_open)
++ drm_sysfs_hotplug_event(dev);
+
+ return 0;
+ }
+diff --git a/drivers/i2c/busses/i2c-mlxcpld.c b/drivers/i2c/busses/i2c-mlxcpld.c
+index 745ed43a22d6..2fd717d8dd30 100644
+--- a/drivers/i2c/busses/i2c-mlxcpld.c
++++ b/drivers/i2c/busses/i2c-mlxcpld.c
+@@ -503,6 +503,7 @@ static int mlxcpld_i2c_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, priv);
+
+ priv->dev = &pdev->dev;
++ priv->base_addr = MLXPLAT_CPLD_LPC_I2C_BASE_ADDR;
+
+ /* Register with i2c layer */
+ mlxcpld_i2c_adapter.timeout = usecs_to_jiffies(MLXCPLD_I2C_XFER_TO);
+@@ -518,7 +519,6 @@ static int mlxcpld_i2c_probe(struct platform_device *pdev)
+ mlxcpld_i2c_adapter.nr = pdev->id;
+ priv->adap = mlxcpld_i2c_adapter;
+ priv->adap.dev.parent = &pdev->dev;
+- priv->base_addr = MLXPLAT_CPLD_LPC_I2C_BASE_ADDR;
+ i2c_set_adapdata(&priv->adap, priv);
+
+ err = i2c_add_numbered_adapter(&priv->adap);
+diff --git a/drivers/i2c/busses/i2c-synquacer.c b/drivers/i2c/busses/i2c-synquacer.c
+index e6c554e6ba58..e47380b96b1d 100644
+--- a/drivers/i2c/busses/i2c-synquacer.c
++++ b/drivers/i2c/busses/i2c-synquacer.c
+@@ -356,7 +356,7 @@ static int synquacer_i2c_doxfer(struct synquacer_i2c *i2c,
+ /* wait 2 clock periods to ensure the stop has been through the bus */
+ udelay(DIV_ROUND_UP(2 * 1000, i2c->speed_khz));
+
+- return 0;
++ return ret;
+ }
+
+ static irqreturn_t synquacer_i2c_isr(int irq, void *dev_id)
+diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c
+index 8b4568edd5cb..7f16c77b99fb 100644
+--- a/drivers/iio/adc/ti-ads8688.c
++++ b/drivers/iio/adc/ti-ads8688.c
+@@ -397,7 +397,7 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p)
+ }
+
+ iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+- pf->timestamp);
++ iio_get_time_ns(indio_dev));
+
+ iio_trigger_notify_done(indio_dev->trig);
+
+diff --git a/drivers/iio/dac/ds4424.c b/drivers/iio/dac/ds4424.c
+index 883a47562055..714a97f91319 100644
+--- a/drivers/iio/dac/ds4424.c
++++ b/drivers/iio/dac/ds4424.c
+@@ -166,7 +166,7 @@ static int ds4424_verify_chip(struct iio_dev *indio_dev)
+ {
+ int ret, val;
+
+- ret = ds4424_get_value(indio_dev, &val, DS4424_DAC_ADDR(0));
++ ret = ds4424_get_value(indio_dev, &val, 0);
+ if (ret < 0)
+ dev_err(&indio_dev->dev,
+ "%s failed. ret: %d\n", __func__, ret);
+diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
+index be3634407f1f..3071d9bc77f4 100644
+--- a/drivers/media/usb/siano/smsusb.c
++++ b/drivers/media/usb/siano/smsusb.c
+@@ -401,6 +401,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
+ struct smsusb_device_t *dev;
+ void *mdev;
+ int i, rc;
++ int align = 0;
+
+ /* create device object */
+ dev = kzalloc(sizeof(struct smsusb_device_t), GFP_KERNEL);
+@@ -412,6 +413,24 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
+ dev->udev = interface_to_usbdev(intf);
+ dev->state = SMSUSB_DISCONNECTED;
+
++ for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
++ struct usb_endpoint_descriptor *desc =
++ &intf->cur_altsetting->endpoint[i].desc;
++
++ if (desc->bEndpointAddress & USB_DIR_IN) {
++ dev->in_ep = desc->bEndpointAddress;
++ align = usb_endpoint_maxp(desc) - sizeof(struct sms_msg_hdr);
++ } else {
++ dev->out_ep = desc->bEndpointAddress;
++ }
++ }
++
++ pr_debug("in_ep = %02x, out_ep = %02x\n", dev->in_ep, dev->out_ep);
++ if (!dev->in_ep || !dev->out_ep || align < 0) { /* Missing endpoints? */
++ smsusb_term_device(intf);
++ return -ENODEV;
++ }
++
+ params.device_type = sms_get_board(board_id)->type;
+
+ switch (params.device_type) {
+@@ -426,24 +445,12 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
+ /* fall-thru */
+ default:
+ dev->buffer_size = USB2_BUFFER_SIZE;
+- dev->response_alignment =
+- le16_to_cpu(dev->udev->ep_in[1]->desc.wMaxPacketSize) -
+- sizeof(struct sms_msg_hdr);
++ dev->response_alignment = align;
+
+ params.flags |= SMS_DEVICE_FAMILY2;
+ break;
+ }
+
+- for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
+- if (intf->cur_altsetting->endpoint[i].desc. bEndpointAddress & USB_DIR_IN)
+- dev->in_ep = intf->cur_altsetting->endpoint[i].desc.bEndpointAddress;
+- else
+- dev->out_ep = intf->cur_altsetting->endpoint[i].desc.bEndpointAddress;
+- }
+-
+- pr_debug("in_ep = %02x, out_ep = %02x\n",
+- dev->in_ep, dev->out_ep);
+-
+ params.device = &dev->udev->dev;
+ params.usb_device = dev->udev;
+ params.buffer_size = dev->buffer_size;
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 6f1fd40fce10..c3ddbf6c202a 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -914,7 +914,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
+ unsigned int size;
+ unsigned int i;
+
+- extra_size = ALIGN(extra_size, sizeof(*entity->pads));
++ extra_size = roundup(extra_size, sizeof(*entity->pads));
+ num_inputs = (type & UVC_TERM_OUTPUT) ? num_pads : num_pads - 1;
+ size = sizeof(*entity) + extra_size + sizeof(*entity->pads) * num_pads
+ + num_inputs;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+index 1068a2a4494c..144e0b83b24b 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -490,11 +490,18 @@ fail:
+ return -ENOMEM;
+ }
+
+-void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
++void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr)
++{
++ struct brcmf_bcdc *bcdc = drvr->proto->pd;
++
++ brcmf_fws_detach_pre_delif(bcdc->fws);
++}
++
++void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr)
+ {
+ struct brcmf_bcdc *bcdc = drvr->proto->pd;
+
+ drvr->proto->pd = NULL;
+- brcmf_fws_detach(bcdc->fws);
++ brcmf_fws_detach_post_delif(bcdc->fws);
+ kfree(bcdc);
+ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
+index 3b0e9eff21b5..4bc52240ccea 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
+@@ -18,14 +18,16 @@
+
+ #ifdef CONFIG_BRCMFMAC_PROTO_BCDC
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
+-void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
++void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr);
++void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr);
+ void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
+ void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
+ bool success);
+ struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr);
+ #else
+ static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
+-static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
++static void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr) {};
++static inline void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr) {}
+ #endif
+
+ #endif /* BRCMFMAC_BCDC_H */
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+index 36a04c1144e5..0f56be13c7ad 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1244,6 +1244,8 @@ void brcmf_detach(struct device *dev)
+
+ brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
+
++ brcmf_proto_detach_pre_delif(drvr);
++
+ /* make sure primary interface removed last */
+ for (i = BRCMF_MAX_IFS-1; i > -1; i--)
+ brcmf_remove_interface(drvr->iflist[i], false);
+@@ -1253,7 +1255,7 @@ void brcmf_detach(struct device *dev)
+
+ brcmf_bus_stop(drvr->bus_if);
+
+- brcmf_proto_detach(drvr);
++ brcmf_proto_detach_post_delif(drvr);
+
+ bus_if->drvr = NULL;
+ wiphy_free(drvr->wiphy);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+index 5a0a29c4cdea..1de8497d92b8 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -2410,17 +2410,25 @@ struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr)
+ return fws;
+
+ fail:
+- brcmf_fws_detach(fws);
++ brcmf_fws_detach_pre_delif(fws);
++ brcmf_fws_detach_post_delif(fws);
+ return ERR_PTR(rc);
+ }
+
+-void brcmf_fws_detach(struct brcmf_fws_info *fws)
++void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws)
+ {
+ if (!fws)
+ return;
+-
+- if (fws->fws_wq)
++ if (fws->fws_wq) {
+ destroy_workqueue(fws->fws_wq);
++ fws->fws_wq = NULL;
++ }
++}
++
++void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws)
++{
++ if (!fws)
++ return;
+
+ /* cleanup */
+ brcmf_fws_lock(fws);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
+index 4e6835766d5d..749c06dcdc17 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
+@@ -19,7 +19,8 @@
+ #define FWSIGNAL_H_
+
+ struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
+-void brcmf_fws_detach(struct brcmf_fws_info *fws);
++void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws);
++void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws);
+ void brcmf_fws_debugfs_create(struct brcmf_pub *drvr);
+ bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
+ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
+index c5ff551ec659..74e6fdbd3a2b 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
+@@ -67,16 +67,22 @@ fail:
+ return -ENOMEM;
+ }
+
+-void brcmf_proto_detach(struct brcmf_pub *drvr)
++void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr)
+ {
+ brcmf_dbg(TRACE, "Enter\n");
+
+ if (drvr->proto) {
+ if (drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
+- brcmf_proto_bcdc_detach(drvr);
++ brcmf_proto_bcdc_detach_post_delif(drvr);
+ else if (drvr->bus_if->proto_type == BRCMF_PROTO_MSGBUF)
+ brcmf_proto_msgbuf_detach(drvr);
+ kfree(drvr->proto);
+ drvr->proto = NULL;
+ }
+ }
++
++void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr)
++{
++ if (drvr->proto && drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
++ brcmf_proto_bcdc_detach_pre_delif(drvr);
++}
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+index d3c3b9a815ad..72355aea9028 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -54,7 +54,8 @@ struct brcmf_proto {
+
+
+ int brcmf_proto_attach(struct brcmf_pub *drvr);
+-void brcmf_proto_detach(struct brcmf_pub *drvr);
++void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr);
++void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr);
+
+ static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
+ struct sk_buff *skb,
+diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
+index 45c0b1f4cb69..a09c1c3cf831 100644
+--- a/drivers/of/dynamic.c
++++ b/drivers/of/dynamic.c
+@@ -205,15 +205,24 @@ static void __of_attach_node(struct device_node *np)
+ const __be32 *phandle;
+ int sz;
+
+- np->name = __of_get_property(np, "name", NULL) ? : "<NULL>";
+- np->type = __of_get_property(np, "device_type", NULL) ? : "<NULL>";
+-
+- phandle = __of_get_property(np, "phandle", &sz);
+- if (!phandle)
+- phandle = __of_get_property(np, "linux,phandle", &sz);
+- if (IS_ENABLED(CONFIG_PPC_PSERIES) && !phandle)
+- phandle = __of_get_property(np, "ibm,phandle", &sz);
+- np->phandle = (phandle && (sz >= 4)) ? be32_to_cpup(phandle) : 0;
++ if (!of_node_check_flag(np, OF_OVERLAY)) {
++ np->name = __of_get_property(np, "name", NULL);
++ np->type = __of_get_property(np, "device_type", NULL);
++ if (!np->name)
++ np->name = "<NULL>";
++ if (!np->type)
++ np->type = "<NULL>";
++
++ phandle = __of_get_property(np, "phandle", &sz);
++ if (!phandle)
++ phandle = __of_get_property(np, "linux,phandle", &sz);
++ if (IS_ENABLED(CONFIG_PPC_PSERIES) && !phandle)
++ phandle = __of_get_property(np, "ibm,phandle", &sz);
++ if (phandle && (sz >= 4))
++ np->phandle = be32_to_cpup(phandle);
++ else
++ np->phandle = 0;
++ }
+
+ np->child = NULL;
+ np->sibling = np->parent->child;
+diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
+index 9808aae4621a..2edb59039b5f 100644
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -287,7 +287,12 @@ err_free_target_path:
+ * @target may be either in the live devicetree or in a new subtree that
+ * is contained in the changeset.
+ *
+- * Some special properties are not updated (no error returned).
++ * Some special properties are not added or updated (no error returned):
++ * "name", "phandle", "linux,phandle".
++ *
++ * Properties "#address-cells" and "#size-cells" are not updated if they
++ * are already in the live tree, but if present in the live tree, the values
++ * in the overlay must match the values in the live tree.
+ *
+ * Update of property in symbols node is not allowed.
+ *
+@@ -300,11 +305,13 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
+ {
+ struct property *new_prop = NULL, *prop;
+ int ret = 0;
++ bool check_for_non_overlay_node = false;
+
+- if (!of_prop_cmp(overlay_prop->name, "name") ||
+- !of_prop_cmp(overlay_prop->name, "phandle") ||
+- !of_prop_cmp(overlay_prop->name, "linux,phandle"))
+- return 0;
++ if (target->in_livetree)
++ if (!of_prop_cmp(overlay_prop->name, "name") ||
++ !of_prop_cmp(overlay_prop->name, "phandle") ||
++ !of_prop_cmp(overlay_prop->name, "linux,phandle"))
++ return 0;
+
+ if (target->in_livetree)
+ prop = of_find_property(target->np, overlay_prop->name, NULL);
+@@ -322,12 +329,36 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
+ if (!new_prop)
+ return -ENOMEM;
+
+- if (!prop)
++ if (!prop) {
++ check_for_non_overlay_node = true;
++ if (!target->in_livetree) {
++ new_prop->next = target->np->deadprops;
++ target->np->deadprops = new_prop;
++ }
+ ret = of_changeset_add_property(&ovcs->cset, target->np,
+ new_prop);
+- else
++ } else if (!of_prop_cmp(prop->name, "#address-cells")) {
++ if (!of_prop_val_eq(prop, new_prop)) {
++ pr_err("ERROR: changing value of #address-cells is not allowed in %pOF\n",
++ target->np);
++ ret = -EINVAL;
++ }
++ } else if (!of_prop_cmp(prop->name, "#size-cells")) {
++ if (!of_prop_val_eq(prop, new_prop)) {
++ pr_err("ERROR: changing value of #size-cells is not allowed in %pOF\n",
++ target->np);
++ ret = -EINVAL;
++ }
++ } else {
++ check_for_non_overlay_node = true;
+ ret = of_changeset_update_property(&ovcs->cset, target->np,
+ new_prop);
++ }
++
++ if (check_for_non_overlay_node &&
++ !of_node_check_flag(target->np, OF_OVERLAY))
++ pr_err("WARNING: memory leak will occur if overlay removed, property: %pOF/%s\n",
++ target->np, new_prop->name);
+
+ if (ret) {
+ kfree(new_prop->name);
+@@ -382,9 +413,10 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
+ struct target *target, struct device_node *node)
+ {
+ const char *node_kbasename;
++ const __be32 *phandle;
+ struct device_node *tchild;
+ struct target target_child;
+- int ret = 0;
++ int ret = 0, size;
+
+ node_kbasename = kbasename(node->full_name);
+
+@@ -398,6 +430,19 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
+ return -ENOMEM;
+
+ tchild->parent = target->np;
++ tchild->name = __of_get_property(node, "name", NULL);
++ tchild->type = __of_get_property(node, "device_type", NULL);
++
++ if (!tchild->name)
++ tchild->name = "<NULL>";
++ if (!tchild->type)
++ tchild->type = "<NULL>";
++
++ /* ignore obsolete "linux,phandle" */
++ phandle = __of_get_property(node, "phandle", &size);
++ if (phandle && (size == 4))
++ tchild->phandle = be32_to_cpup(phandle);
++
+ of_node_set_flag(tchild, OF_OVERLAY);
+
+ ret = of_changeset_attach_node(&ovcs->cset, tchild);
+diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
+index 1b4d6a3afb8f..3d971ffbd4bc 100644
+--- a/drivers/s390/scsi/zfcp_ext.h
++++ b/drivers/s390/scsi/zfcp_ext.h
+@@ -164,6 +164,7 @@ extern const struct attribute_group *zfcp_port_attr_groups[];
+ extern struct mutex zfcp_sysfs_port_units_mutex;
+ extern struct device_attribute *zfcp_sysfs_sdev_attrs[];
+ extern struct device_attribute *zfcp_sysfs_shost_attrs[];
++bool zfcp_sysfs_port_is_removing(const struct zfcp_port *const port);
+
+ /* zfcp_unit.c */
+ extern int zfcp_unit_add(struct zfcp_port *, u64);
+diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
+index a4bbfa4ef653..588bf5ac6fb9 100644
+--- a/drivers/s390/scsi/zfcp_scsi.c
++++ b/drivers/s390/scsi/zfcp_scsi.c
+@@ -125,6 +125,15 @@ static int zfcp_scsi_slave_alloc(struct scsi_device *sdev)
+
+ zfcp_sdev->erp_action.port = port;
+
++ mutex_lock(&zfcp_sysfs_port_units_mutex);
++ if (zfcp_sysfs_port_is_removing(port)) {
++ /* port is already gone */
++ mutex_unlock(&zfcp_sysfs_port_units_mutex);
++ put_device(&port->dev); /* undo zfcp_get_port_by_wwpn() */
++ return -ENXIO;
++ }
++ mutex_unlock(&zfcp_sysfs_port_units_mutex);
++
+ unit = zfcp_unit_find(port, zfcp_scsi_dev_lun(sdev));
+ if (unit)
+ put_device(&unit->dev);
+diff --git a/drivers/s390/scsi/zfcp_sysfs.c b/drivers/s390/scsi/zfcp_sysfs.c
+index b277be6f7611..af197e2b3e69 100644
+--- a/drivers/s390/scsi/zfcp_sysfs.c
++++ b/drivers/s390/scsi/zfcp_sysfs.c
+@@ -235,6 +235,53 @@ static ZFCP_DEV_ATTR(adapter, port_rescan, S_IWUSR, NULL,
+
+ DEFINE_MUTEX(zfcp_sysfs_port_units_mutex);
+
++static void zfcp_sysfs_port_set_removing(struct zfcp_port *const port)
++{
++ lockdep_assert_held(&zfcp_sysfs_port_units_mutex);
++ atomic_set(&port->units, -1);
++}
++
++bool zfcp_sysfs_port_is_removing(const struct zfcp_port *const port)
++{
++ lockdep_assert_held(&zfcp_sysfs_port_units_mutex);
++ return atomic_read(&port->units) == -1;
++}
++
++static bool zfcp_sysfs_port_in_use(struct zfcp_port *const port)
++{
++ struct zfcp_adapter *const adapter = port->adapter;
++ unsigned long flags;
++ struct scsi_device *sdev;
++ bool in_use = true;
++
++ mutex_lock(&zfcp_sysfs_port_units_mutex);
++ if (atomic_read(&port->units) > 0)
++ goto unlock_port_units_mutex; /* zfcp_unit(s) under port */
++
++ spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
++ __shost_for_each_device(sdev, adapter->scsi_host) {
++ const struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
++
++ if (sdev->sdev_state == SDEV_DEL ||
++ sdev->sdev_state == SDEV_CANCEL)
++ continue;
++ if (zsdev->port != port)
++ continue;
++ /* alive scsi_device under port of interest */
++ goto unlock_host_lock;
++ }
++
++ /* port is about to be removed, so no more unit_add or slave_alloc */
++ zfcp_sysfs_port_set_removing(port);
++ in_use = false;
++
++unlock_host_lock:
++ spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
++unlock_port_units_mutex:
++ mutex_unlock(&zfcp_sysfs_port_units_mutex);
++ return in_use;
++}
++
+ static ssize_t zfcp_sysfs_port_remove_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t count)
+@@ -257,15 +304,11 @@ static ssize_t zfcp_sysfs_port_remove_store(struct device *dev,
+ else
+ retval = 0;
+
+- mutex_lock(&zfcp_sysfs_port_units_mutex);
+- if (atomic_read(&port->units) > 0) {
++ if (zfcp_sysfs_port_in_use(port)) {
+ retval = -EBUSY;
+- mutex_unlock(&zfcp_sysfs_port_units_mutex);
++ put_device(&port->dev); /* undo zfcp_get_port_by_wwpn() */
+ goto out;
+ }
+- /* port is about to be removed, so no more unit_add */
+- atomic_set(&port->units, -1);
+- mutex_unlock(&zfcp_sysfs_port_units_mutex);
+
+ write_lock_irq(&adapter->port_list_lock);
+ list_del(&port->list);
+diff --git a/drivers/s390/scsi/zfcp_unit.c b/drivers/s390/scsi/zfcp_unit.c
+index 1bf0a0984a09..e67bf7388cae 100644
+--- a/drivers/s390/scsi/zfcp_unit.c
++++ b/drivers/s390/scsi/zfcp_unit.c
+@@ -124,7 +124,7 @@ int zfcp_unit_add(struct zfcp_port *port, u64 fcp_lun)
+ int retval = 0;
+
+ mutex_lock(&zfcp_sysfs_port_units_mutex);
+- if (atomic_read(&port->units) == -1) {
++ if (zfcp_sysfs_port_is_removing(port)) {
+ /* port is already gone */
+ retval = -ENODEV;
+ goto out;
+@@ -168,8 +168,14 @@ int zfcp_unit_add(struct zfcp_port *port, u64 fcp_lun)
+ write_lock_irq(&port->unit_list_lock);
+ list_add_tail(&unit->list, &port->unit_list);
+ write_unlock_irq(&port->unit_list_lock);
++ /*
++ * lock order: shost->scan_mutex before zfcp_sysfs_port_units_mutex
++ * due to zfcp_unit_scsi_scan() => zfcp_scsi_slave_alloc()
++ */
++ mutex_unlock(&zfcp_sysfs_port_units_mutex);
+
+ zfcp_unit_scsi_scan(unit);
++ return retval;
+
+ out:
+ mutex_unlock(&zfcp_sysfs_port_units_mutex);
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index 099f70798fdd..645ffb5332b4 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -2477,14 +2477,14 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
+ lpfc_nvme_template.max_sgl_segments = phba->cfg_nvme_seg_cnt + 1;
+ lpfc_nvme_template.max_hw_queues = phba->cfg_nvme_io_channel;
+
++ if (!IS_ENABLED(CONFIG_NVME_FC))
++ return ret;
++
+ cstat = kmalloc((sizeof(struct lpfc_nvme_ctrl_stat) *
+ phba->cfg_nvme_io_channel), GFP_KERNEL);
+ if (!cstat)
+ return -ENOMEM;
+
+- if (!IS_ENABLED(CONFIG_NVME_FC))
+- return ret;
+-
+ /* localport is allocated from the stack, but the registration
+ * call allocates heap memory as well as the private area.
+ */
+diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+index c7c8ef67b67f..3bece6b86831 100644
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+@@ -410,9 +410,18 @@ create_pagelist(char __user *buf, size_t count, unsigned short type)
+ int dma_buffers;
+ dma_addr_t dma_addr;
+
++ if (count >= INT_MAX - PAGE_SIZE)
++ return NULL;
++
+ offset = ((unsigned int)(unsigned long)buf & (PAGE_SIZE - 1));
+ num_pages = DIV_ROUND_UP(count + offset, PAGE_SIZE);
+
++ if (num_pages > (SIZE_MAX - sizeof(PAGELIST_T) -
++ sizeof(struct vchiq_pagelist_info)) /
++ (sizeof(u32) + sizeof(pages[0]) +
++ sizeof(struct scatterlist)))
++ return NULL;
++
+ pagelist_size = sizeof(PAGELIST_T) +
+ (num_pages * sizeof(u32)) +
+ (num_pages * sizeof(pages[0]) +
+diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
+index 16f7dd266e3b..767ec8184adf 100644
+--- a/drivers/staging/wlan-ng/hfa384x_usb.c
++++ b/drivers/staging/wlan-ng/hfa384x_usb.c
+@@ -3119,7 +3119,9 @@ static void hfa384x_usbin_callback(struct urb *urb)
+ break;
+ }
+
++ /* Save values from the RX URB before reposting overwrites it. */
+ urb_status = urb->status;
++ usbin = (union hfa384x_usbin *)urb->transfer_buffer;
+
+ if (action != ABORT) {
+ /* Repost the RX URB */
+@@ -3136,7 +3138,6 @@ static void hfa384x_usbin_callback(struct urb *urb)
+ /* Note: the check of the sw_support field, the type field doesn't
+ * have bit 12 set like the docs suggest.
+ */
+- usbin = (union hfa384x_usbin *)urb->transfer_buffer;
+ type = le16_to_cpu(usbin->type);
+ if (HFA384x_USB_ISRXFRM(type)) {
+ if (action == HANDLE) {
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 4c4070a202fb..38c48a02b920 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -576,7 +576,7 @@ static int max310x_set_ref_clk(struct device *dev, struct max310x_port *s,
+ }
+
+ /* Configure clock source */
+- clksrc = xtal ? MAX310X_CLKSRC_CRYST_BIT : MAX310X_CLKSRC_EXTCLK_BIT;
++ clksrc = MAX310X_CLKSRC_EXTCLK_BIT | (xtal ? MAX310X_CLKSRC_CRYST_BIT : 0);
+
+ /* Configure PLL */
+ if (pllcfg) {
+diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
+index 736b74fd6623..0f41b936da03 100644
+--- a/drivers/tty/serial/msm_serial.c
++++ b/drivers/tty/serial/msm_serial.c
+@@ -860,6 +860,7 @@ static void msm_handle_tx(struct uart_port *port)
+ struct circ_buf *xmit = &msm_port->uart.state->xmit;
+ struct msm_dma *dma = &msm_port->tx_dma;
+ unsigned int pio_count, dma_count, dma_min;
++ char buf[4] = { 0 };
+ void __iomem *tf;
+ int err = 0;
+
+@@ -869,10 +870,12 @@ static void msm_handle_tx(struct uart_port *port)
+ else
+ tf = port->membase + UART_TF;
+
++ buf[0] = port->x_char;
++
+ if (msm_port->is_uartdm)
+ msm_reset_dm_count(port, 1);
+
+- iowrite8_rep(tf, &port->x_char, 1);
++ iowrite32_rep(tf, buf, 1);
+ port->icount.tx++;
+ port->x_char = 0;
+ return;
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 03fe3fb4bff6..040832635a64 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1542,6 +1542,13 @@ static void sci_request_dma(struct uart_port *port)
+
+ dev_dbg(port->dev, "%s: port %d\n", __func__, port->line);
+
++ /*
++ * DMA on console may interfere with Kernel log messages which use
++ * plain putchar(). So, simply don't use it with a console.
++ */
++ if (uart_console(port))
++ return;
++
+ if (!port->dev->of_node)
+ return;
+
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index f93b948acfa5..d673e3592662 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1059,6 +1059,13 @@ static void visual_init(struct vc_data *vc, int num, int init)
+ vc->vc_screenbuf_size = vc->vc_rows * vc->vc_size_row;
+ }
+
++
++static void visual_deinit(struct vc_data *vc)
++{
++ vc->vc_sw->con_deinit(vc);
++ module_put(vc->vc_sw->owner);
++}
++
+ int vc_allocate(unsigned int currcons) /* return 0 on success */
+ {
+ struct vt_notifier_param param;
+@@ -1106,6 +1113,7 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */
+
+ return 0;
+ err_free:
++ visual_deinit(vc);
+ kfree(vc);
+ vc_cons[currcons].d = NULL;
+ return -ENOMEM;
+@@ -1334,9 +1342,8 @@ struct vc_data *vc_deallocate(unsigned int currcons)
+ param.vc = vc = vc_cons[currcons].d;
+ atomic_notifier_call_chain(&vt_notifier_list, VT_DEALLOCATE, ¶m);
+ vcs_remove_sysfs(currcons);
+- vc->vc_sw->con_deinit(vc);
++ visual_deinit(vc);
+ put_pid(vc->vt_pid);
+- module_put(vc->vc_sw->owner);
+ vc_uniscr_set(vc, NULL);
+ kfree(vc->vc_screenbuf);
+ vc_cons[currcons].d = NULL;
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 7b5cb28ffb35..e723ddd79bcf 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -936,8 +936,8 @@ int usb_get_bos_descriptor(struct usb_device *dev)
+
+ /* Get BOS descriptor */
+ ret = usb_get_descriptor(dev, USB_DT_BOS, 0, bos, USB_DT_BOS_SIZE);
+- if (ret < USB_DT_BOS_SIZE) {
+- dev_err(ddev, "unable to get BOS descriptor\n");
++ if (ret < USB_DT_BOS_SIZE || bos->bLength < USB_DT_BOS_SIZE) {
++ dev_err(ddev, "unable to get BOS descriptor or descriptor too short\n");
+ if (ret >= 0)
+ ret = -ENOMSG;
+ kfree(bos);
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 8bc35d53408b..6082b008969b 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -209,6 +209,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Microsoft LifeCam-VX700 v2.0 */
+ { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Microsoft Surface Dock Ethernet (RTL8153 GigE) */
++ { USB_DEVICE(0x045e, 0x07c6), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
+ { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index f054464347c9..b62953ee0fc6 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -656,6 +656,7 @@ static void xhci_unmap_td_bounce_buffer(struct xhci_hcd *xhci,
+ struct device *dev = xhci_to_hcd(xhci)->self.controller;
+ struct xhci_segment *seg = td->bounce_seg;
+ struct urb *urb = td->urb;
++ size_t len;
+
+ if (!ring || !seg || !urb)
+ return;
+@@ -666,11 +667,14 @@ static void xhci_unmap_td_bounce_buffer(struct xhci_hcd *xhci,
+ return;
+ }
+
+- /* for in tranfers we need to copy the data from bounce to sg */
+- sg_pcopy_from_buffer(urb->sg, urb->num_mapped_sgs, seg->bounce_buf,
+- seg->bounce_len, seg->bounce_offs);
+ dma_unmap_single(dev, seg->bounce_dma, ring->bounce_buf_len,
+ DMA_FROM_DEVICE);
++ /* for in tranfers we need to copy the data from bounce to sg */
++ len = sg_pcopy_from_buffer(urb->sg, urb->num_sgs, seg->bounce_buf,
++ seg->bounce_len, seg->bounce_offs);
++ if (len != seg->bounce_len)
++ xhci_warn(xhci, "WARN Wrong bounce buffer read length: %zu != %d\n",
++ len, seg->bounce_len);
+ seg->bounce_len = 0;
+ seg->bounce_offs = 0;
+ }
+@@ -3104,6 +3108,7 @@ static int xhci_align_td(struct xhci_hcd *xhci, struct urb *urb, u32 enqd_len,
+ unsigned int unalign;
+ unsigned int max_pkt;
+ u32 new_buff_len;
++ size_t len;
+
+ max_pkt = usb_endpoint_maxp(&urb->ep->desc);
+ unalign = (enqd_len + *trb_buff_len) % max_pkt;
+@@ -3134,8 +3139,12 @@ static int xhci_align_td(struct xhci_hcd *xhci, struct urb *urb, u32 enqd_len,
+
+ /* create a max max_pkt sized bounce buffer pointed to by last trb */
+ if (usb_urb_dir_out(urb)) {
+- sg_pcopy_to_buffer(urb->sg, urb->num_mapped_sgs,
++ len = sg_pcopy_to_buffer(urb->sg, urb->num_sgs,
+ seg->bounce_buf, new_buff_len, enqd_len);
++ if (len != seg->bounce_len)
++ xhci_warn(xhci,
++ "WARN Wrong bounce buffer write length: %zu != %d\n",
++ len, seg->bounce_len);
+ seg->bounce_dma = dma_map_single(dev, seg->bounce_buf,
+ max_pkt, DMA_TO_DEVICE);
+ } else {
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index dae3be1b9c8f..f30b065095fa 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -9,6 +9,7 @@
+ */
+
+ #include <linux/pci.h>
++#include <linux/iopoll.h>
+ #include <linux/irq.h>
+ #include <linux/log2.h>
+ #include <linux/module.h>
+@@ -52,7 +53,6 @@ static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring)
+ return false;
+ }
+
+-/* TODO: copied from ehci-hcd.c - can this be refactored? */
+ /*
+ * xhci_handshake - spin reading hc until handshake completes or fails
+ * @ptr: address of hc register to be read
+@@ -69,18 +69,16 @@ static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring)
+ int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec)
+ {
+ u32 result;
++ int ret;
+
+- do {
+- result = readl(ptr);
+- if (result == ~(u32)0) /* card removed */
+- return -ENODEV;
+- result &= mask;
+- if (result == done)
+- return 0;
+- udelay(1);
+- usec--;
+- } while (usec > 0);
+- return -ETIMEDOUT;
++ ret = readl_poll_timeout_atomic(ptr, result,
++ (result & mask) == done ||
++ result == U32_MAX,
++ 1, usec);
++ if (result == U32_MAX) /* card removed */
++ return -ENODEV;
++
++ return ret;
+ }
+
+ /*
+@@ -4289,7 +4287,6 @@ static int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
+ pm_addr = ports[port_num]->addr + PORTPMSC;
+ pm_val = readl(pm_addr);
+ hlpm_addr = ports[port_num]->addr + PORTHLPMC;
+- field = le32_to_cpu(udev->bos->ext_cap->bmAttributes);
+
+ xhci_dbg(xhci, "%s port %d USB2 hardware LPM\n",
+ enable ? "enable" : "disable", port_num + 1);
+@@ -4301,6 +4298,7 @@ static int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
+ * default one which works with mixed HIRD and BESL
+ * systems. See XHCI_DEFAULT_BESL definition in xhci.h
+ */
++ field = le32_to_cpu(udev->bos->ext_cap->bmAttributes);
+ if ((field & USB_BESL_SUPPORT) &&
+ (field & USB_BESL_BASELINE_VALID))
+ hird = USB_GET_BESL_BASELINE(field);
+diff --git a/drivers/usb/misc/rio500.c b/drivers/usb/misc/rio500.c
+index 7b9adeb3e7aa..a32d61a79ab8 100644
+--- a/drivers/usb/misc/rio500.c
++++ b/drivers/usb/misc/rio500.c
+@@ -86,9 +86,22 @@ static int close_rio(struct inode *inode, struct file *file)
+ {
+ struct rio_usb_data *rio = &rio_instance;
+
+- rio->isopen = 0;
++ /* against disconnect() */
++ mutex_lock(&rio500_mutex);
++ mutex_lock(&(rio->lock));
+
+- dev_info(&rio->rio_dev->dev, "Rio closed.\n");
++ rio->isopen = 0;
++ if (!rio->present) {
++ /* cleanup has been delayed */
++ kfree(rio->ibuf);
++ kfree(rio->obuf);
++ rio->ibuf = NULL;
++ rio->obuf = NULL;
++ } else {
++ dev_info(&rio->rio_dev->dev, "Rio closed.\n");
++ }
++ mutex_unlock(&(rio->lock));
++ mutex_unlock(&rio500_mutex);
+ return 0;
+ }
+
+@@ -447,15 +460,23 @@ static int probe_rio(struct usb_interface *intf,
+ {
+ struct usb_device *dev = interface_to_usbdev(intf);
+ struct rio_usb_data *rio = &rio_instance;
+- int retval;
++ int retval = 0;
+
+- dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum);
++ mutex_lock(&rio500_mutex);
++ if (rio->present) {
++ dev_info(&intf->dev, "Second USB Rio at address %d refused\n", dev->devnum);
++ retval = -EBUSY;
++ goto bail_out;
++ } else {
++ dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum);
++ }
+
+ retval = usb_register_dev(intf, &usb_rio_class);
+ if (retval) {
+ dev_err(&dev->dev,
+ "Not able to get a minor for this device.\n");
+- return -ENOMEM;
++ retval = -ENOMEM;
++ goto bail_out;
+ }
+
+ rio->rio_dev = dev;
+@@ -464,7 +485,8 @@ static int probe_rio(struct usb_interface *intf,
+ dev_err(&dev->dev,
+ "probe_rio: Not enough memory for the output buffer\n");
+ usb_deregister_dev(intf, &usb_rio_class);
+- return -ENOMEM;
++ retval = -ENOMEM;
++ goto bail_out;
+ }
+ dev_dbg(&intf->dev, "obuf address:%p\n", rio->obuf);
+
+@@ -473,7 +495,8 @@ static int probe_rio(struct usb_interface *intf,
+ "probe_rio: Not enough memory for the input buffer\n");
+ usb_deregister_dev(intf, &usb_rio_class);
+ kfree(rio->obuf);
+- return -ENOMEM;
++ retval = -ENOMEM;
++ goto bail_out;
+ }
+ dev_dbg(&intf->dev, "ibuf address:%p\n", rio->ibuf);
+
+@@ -481,8 +504,10 @@ static int probe_rio(struct usb_interface *intf,
+
+ usb_set_intfdata (intf, rio);
+ rio->present = 1;
++bail_out:
++ mutex_unlock(&rio500_mutex);
+
+- return 0;
++ return retval;
+ }
+
+ static void disconnect_rio(struct usb_interface *intf)
+diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
+index 3198d0477cf8..c4f6ac5f035e 100644
+--- a/drivers/usb/misc/sisusbvga/sisusb.c
++++ b/drivers/usb/misc/sisusbvga/sisusb.c
+@@ -3029,6 +3029,13 @@ static int sisusb_probe(struct usb_interface *intf,
+
+ mutex_init(&(sisusb->lock));
+
++ sisusb->sisusb_dev = dev;
++ sisusb->vrambase = SISUSB_PCI_MEMBASE;
++ sisusb->mmiobase = SISUSB_PCI_MMIOBASE;
++ sisusb->mmiosize = SISUSB_PCI_MMIOSIZE;
++ sisusb->ioportbase = SISUSB_PCI_IOPORTBASE;
++ /* Everything else is zero */
++
+ /* Register device */
+ retval = usb_register_dev(intf, &usb_sisusb_class);
+ if (retval) {
+@@ -3039,13 +3046,7 @@ static int sisusb_probe(struct usb_interface *intf,
+ goto error_1;
+ }
+
+- sisusb->sisusb_dev = dev;
+- sisusb->minor = intf->minor;
+- sisusb->vrambase = SISUSB_PCI_MEMBASE;
+- sisusb->mmiobase = SISUSB_PCI_MMIOBASE;
+- sisusb->mmiosize = SISUSB_PCI_MMIOSIZE;
+- sisusb->ioportbase = SISUSB_PCI_IOPORTBASE;
+- /* Everything else is zero */
++ sisusb->minor = intf->minor;
+
+ /* Allocate buffers */
+ sisusb->ibufsize = SISUSB_IBUF_SIZE;
+diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
+index c0d6ff1baa72..7931e6cecc70 100644
+--- a/drivers/usb/usbip/stub_dev.c
++++ b/drivers/usb/usbip/stub_dev.c
+@@ -301,9 +301,17 @@ static int stub_probe(struct usb_device *udev)
+ const char *udev_busid = dev_name(&udev->dev);
+ struct bus_id_priv *busid_priv;
+ int rc = 0;
++ char save_status;
+
+ dev_dbg(&udev->dev, "Enter probe\n");
+
++ /* Not sure if this is our device. Allocate here to avoid
++ * calling alloc while holding busid_table lock.
++ */
++ sdev = stub_device_alloc(udev);
++ if (!sdev)
++ return -ENOMEM;
++
+ /* check we should claim or not by busid_table */
+ busid_priv = get_busid_priv(udev_busid);
+ if (!busid_priv || (busid_priv->status == STUB_BUSID_REMOV) ||
+@@ -318,6 +326,9 @@ static int stub_probe(struct usb_device *udev)
+ * See driver_probe_device() in driver/base/dd.c
+ */
+ rc = -ENODEV;
++ if (!busid_priv)
++ goto sdev_free;
++
+ goto call_put_busid_priv;
+ }
+
+@@ -337,12 +348,6 @@ static int stub_probe(struct usb_device *udev)
+ goto call_put_busid_priv;
+ }
+
+- /* ok, this is my device */
+- sdev = stub_device_alloc(udev);
+- if (!sdev) {
+- rc = -ENOMEM;
+- goto call_put_busid_priv;
+- }
+
+ dev_info(&udev->dev,
+ "usbip-host: register new device (bus %u dev %u)\n",
+@@ -352,9 +357,16 @@ static int stub_probe(struct usb_device *udev)
+
+ /* set private data to usb_device */
+ dev_set_drvdata(&udev->dev, sdev);
++
+ busid_priv->sdev = sdev;
+ busid_priv->udev = udev;
+
++ save_status = busid_priv->status;
++ busid_priv->status = STUB_BUSID_ALLOC;
++
++ /* release the busid_lock */
++ put_busid_priv(busid_priv);
++
+ /*
+ * Claim this hub port.
+ * It doesn't matter what value we pass as owner
+@@ -372,10 +384,8 @@ static int stub_probe(struct usb_device *udev)
+ dev_err(&udev->dev, "stub_add_files for %s\n", udev_busid);
+ goto err_files;
+ }
+- busid_priv->status = STUB_BUSID_ALLOC;
+
+- rc = 0;
+- goto call_put_busid_priv;
++ return 0;
+
+ err_files:
+ usb_hub_release_port(udev->parent, udev->portnum,
+@@ -384,23 +394,30 @@ err_port:
+ dev_set_drvdata(&udev->dev, NULL);
+ usb_put_dev(udev);
+
++ /* we already have busid_priv, just lock busid_lock */
++ spin_lock(&busid_priv->busid_lock);
+ busid_priv->sdev = NULL;
+- stub_device_free(sdev);
++ busid_priv->status = save_status;
++ spin_unlock(&busid_priv->busid_lock);
++ /* lock is released - go to free */
++ goto sdev_free;
+
+ call_put_busid_priv:
++ /* release the busid_lock */
+ put_busid_priv(busid_priv);
++
++sdev_free:
++ stub_device_free(sdev);
++
+ return rc;
+ }
+
+ static void shutdown_busid(struct bus_id_priv *busid_priv)
+ {
+- if (busid_priv->sdev && !busid_priv->shutdown_busid) {
+- busid_priv->shutdown_busid = 1;
+- usbip_event_add(&busid_priv->sdev->ud, SDEV_EVENT_REMOVED);
++ usbip_event_add(&busid_priv->sdev->ud, SDEV_EVENT_REMOVED);
+
+- /* wait for the stop of the event handler */
+- usbip_stop_eh(&busid_priv->sdev->ud);
+- }
++ /* wait for the stop of the event handler */
++ usbip_stop_eh(&busid_priv->sdev->ud);
+ }
+
+ /*
+@@ -427,11 +444,16 @@ static void stub_disconnect(struct usb_device *udev)
+ /* get stub_device */
+ if (!sdev) {
+ dev_err(&udev->dev, "could not get device");
+- goto call_put_busid_priv;
++ /* release busid_lock */
++ put_busid_priv(busid_priv);
++ return;
+ }
+
+ dev_set_drvdata(&udev->dev, NULL);
+
++ /* release busid_lock before call to remove device files */
++ put_busid_priv(busid_priv);
++
+ /*
+ * NOTE: rx/tx threads are invoked for each usb_device.
+ */
+@@ -442,27 +464,36 @@ static void stub_disconnect(struct usb_device *udev)
+ (struct usb_dev_state *) udev);
+ if (rc) {
+ dev_dbg(&udev->dev, "unable to release port\n");
+- goto call_put_busid_priv;
++ return;
+ }
+
+ /* If usb reset is called from event handler */
+ if (usbip_in_eh(current))
+- goto call_put_busid_priv;
++ return;
++
++ /* we already have busid_priv, just lock busid_lock */
++ spin_lock(&busid_priv->busid_lock);
++ if (!busid_priv->shutdown_busid)
++ busid_priv->shutdown_busid = 1;
++ /* release busid_lock */
++ spin_unlock(&busid_priv->busid_lock);
+
+ /* shutdown the current connection */
+ shutdown_busid(busid_priv);
+
+ usb_put_dev(sdev->udev);
+
++ /* we already have busid_priv, just lock busid_lock */
++ spin_lock(&busid_priv->busid_lock);
+ /* free sdev */
+ busid_priv->sdev = NULL;
+ stub_device_free(sdev);
+
+ if (busid_priv->status == STUB_BUSID_ALLOC)
+ busid_priv->status = STUB_BUSID_ADDED;
+-
+-call_put_busid_priv:
+- put_busid_priv(busid_priv);
++ /* release busid_lock */
++ spin_unlock(&busid_priv->busid_lock);
++ return;
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 5d961e3ac66e..b96d4e779333 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -1237,7 +1237,7 @@ finished:
+ if (free_font)
+ vc->vc_font.data = NULL;
+
+- if (vc->vc_hi_font_mask)
++ if (vc->vc_hi_font_mask && vc->vc_screenbuf)
+ set_vc_hi_font(vc, false);
+
+ if (!con_is_bound(&fb_con))
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 59f361f7d0c1..c1cd3fe2b295 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -6426,8 +6426,18 @@ int btrfs_add_link(struct btrfs_trans_handle *trans,
+ btrfs_i_size_write(parent_inode, parent_inode->vfs_inode.i_size +
+ name_len * 2);
+ inode_inc_iversion(&parent_inode->vfs_inode);
+- parent_inode->vfs_inode.i_mtime = parent_inode->vfs_inode.i_ctime =
+- current_time(&parent_inode->vfs_inode);
++ /*
++ * If we are replaying a log tree, we do not want to update the mtime
++ * and ctime of the parent directory with the current time, since the
++ * log replay procedure is responsible for setting them to their correct
++ * values (the ones it had when the fsync was done).
++ */
++ if (!test_bit(BTRFS_FS_LOG_RECOVERING, &root->fs_info->flags)) {
++ struct timespec64 now = current_time(&parent_inode->vfs_inode);
++
++ parent_inode->vfs_inode.i_mtime = now;
++ parent_inode->vfs_inode.i_ctime = now;
++ }
+ ret = btrfs_update_inode(trans, root, &parent_inode->vfs_inode);
+ if (ret)
+ btrfs_abort_transaction(trans, ret);
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 635e419f2a2d..258392b75048 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -5021,6 +5021,12 @@ static int send_hole(struct send_ctx *sctx, u64 end)
+ if (offset >= sctx->cur_inode_size)
+ return 0;
+
++ /*
++ * Don't go beyond the inode's i_size due to prealloc extents that start
++ * after the i_size.
++ */
++ end = min_t(u64, end, sctx->cur_inode_size);
++
+ if (sctx->flags & BTRFS_SEND_FLAG_NO_FILE_DATA)
+ return send_update_extent(sctx, offset, end - offset);
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 75051d36dc1a..0d5840d20efc 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3037,6 +3037,12 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
+ root->log_transid++;
+ log->log_transid = root->log_transid;
+ root->log_start_pid = 0;
++ /*
++ * Update or create log root item under the root's log_mutex to prevent
++ * races with concurrent log syncs that can lead to failure to update
++ * log root item because it was not created yet.
++ */
++ ret = update_log_root(trans, log);
+ /*
+ * IO has been started, blocks of the log tree have WRITTEN flag set
+ * in their headers. new modifications of the log will be written to
+@@ -3056,8 +3062,6 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
+
+ mutex_unlock(&log_root_tree->log_mutex);
+
+- ret = update_log_root(trans, log);
+-
+ mutex_lock(&log_root_tree->log_mutex);
+ if (atomic_dec_and_test(&log_root_tree->log_writers)) {
+ /* atomic_dec_and_test implies a barrier */
+@@ -5308,7 +5312,6 @@ static noinline int check_parent_dirs_for_sync(struct btrfs_trans_handle *trans,
+ {
+ int ret = 0;
+ struct dentry *old_parent = NULL;
+- struct btrfs_inode *orig_inode = inode;
+
+ /*
+ * for regular files, if its inode is already on disk, we don't
+@@ -5328,16 +5331,6 @@ static noinline int check_parent_dirs_for_sync(struct btrfs_trans_handle *trans,
+ }
+
+ while (1) {
+- /*
+- * If we are logging a directory then we start with our inode,
+- * not our parent's inode, so we need to skip setting the
+- * logged_trans so that further down in the log code we don't
+- * think this inode has already been logged.
+- */
+- if (inode != orig_inode)
+- inode->logged_trans = trans->transid;
+- smp_mb();
+-
+ if (btrfs_must_commit_transaction(trans, inode)) {
+ ret = 1;
+ break;
+@@ -6066,7 +6059,6 @@ void btrfs_record_unlink_dir(struct btrfs_trans_handle *trans,
+ * if this directory was already logged any new
+ * names for this file/dir will get recorded
+ */
+- smp_mb();
+ if (dir->logged_trans == trans->transid)
+ return;
+
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index d6b45682833b..23cee91ed442 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -2988,7 +2988,9 @@ cifs_read_allocate_pages(struct cifs_readdata *rdata, unsigned int nr_pages)
+ }
+
+ if (rc) {
+- for (i = 0; i < nr_pages; i++) {
++ unsigned int nr_page_failed = i;
++
++ for (i = 0; i < nr_page_failed; i++) {
+ put_page(rdata->pages[i]);
+ rdata->pages[i] = NULL;
+ }
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 33afb637e6f8..c181f1621e1a 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -887,7 +887,8 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
+ * not supported error. Client should accept it.
+ */
+ cifs_dbg(VFS, "Server does not support validate negotiate\n");
+- return 0;
++ rc = 0;
++ goto out_free_inbuf;
+ } else if (rc != 0) {
+ cifs_dbg(VFS, "validate protocol negotiate failed: %d\n", rc);
+ rc = -EIO;
+diff --git a/fs/lockd/xdr.c b/fs/lockd/xdr.c
+index 9846f7e95282..7147e4aebecc 100644
+--- a/fs/lockd/xdr.c
++++ b/fs/lockd/xdr.c
+@@ -127,7 +127,7 @@ nlm_decode_lock(__be32 *p, struct nlm_lock *lock)
+
+ locks_init_lock(fl);
+ fl->fl_owner = current->files;
+- fl->fl_pid = current->tgid;
++ fl->fl_pid = (pid_t)lock->svid;
+ fl->fl_flags = FL_POSIX;
+ fl->fl_type = F_RDLCK; /* as good as anything else */
+ start = ntohl(*p++);
+@@ -269,7 +269,7 @@ nlmsvc_decode_shareargs(struct svc_rqst *rqstp, __be32 *p)
+ memset(lock, 0, sizeof(*lock));
+ locks_init_lock(&lock->fl);
+ lock->svid = ~(u32) 0;
+- lock->fl.fl_pid = current->tgid;
++ lock->fl.fl_pid = (pid_t)lock->svid;
+
+ if (!(p = nlm_decode_cookie(p, &argp->cookie))
+ || !(p = xdr_decode_string_inplace(p, &lock->caller,
+diff --git a/fs/lockd/xdr4.c b/fs/lockd/xdr4.c
+index 70154f376695..7ed9edf9aed4 100644
+--- a/fs/lockd/xdr4.c
++++ b/fs/lockd/xdr4.c
+@@ -119,7 +119,7 @@ nlm4_decode_lock(__be32 *p, struct nlm_lock *lock)
+
+ locks_init_lock(fl);
+ fl->fl_owner = current->files;
+- fl->fl_pid = current->tgid;
++ fl->fl_pid = (pid_t)lock->svid;
+ fl->fl_flags = FL_POSIX;
+ fl->fl_type = F_RDLCK; /* as good as anything else */
+ p = xdr_decode_hyper(p, &start);
+@@ -266,7 +266,7 @@ nlm4svc_decode_shareargs(struct svc_rqst *rqstp, __be32 *p)
+ memset(lock, 0, sizeof(*lock));
+ locks_init_lock(&lock->fl);
+ lock->svid = ~(u32) 0;
+- lock->fl.fl_pid = current->tgid;
++ lock->fl.fl_pid = (pid_t)lock->svid;
+
+ if (!(p = nlm4_decode_cookie(p, &argp->cookie))
+ || !(p = xdr_decode_string_inplace(p, &lock->caller,
+diff --git a/include/linux/bitops.h b/include/linux/bitops.h
+index 7ddb1349394d..7ac2e46112b7 100644
+--- a/include/linux/bitops.h
++++ b/include/linux/bitops.h
+@@ -60,7 +60,7 @@ static __always_inline unsigned long hweight_long(unsigned long w)
+ */
+ static inline __u64 rol64(__u64 word, unsigned int shift)
+ {
+- return (word << shift) | (word >> (64 - shift));
++ return (word << (shift & 63)) | (word >> ((-shift) & 63));
+ }
+
+ /**
+@@ -70,7 +70,7 @@ static inline __u64 rol64(__u64 word, unsigned int shift)
+ */
+ static inline __u64 ror64(__u64 word, unsigned int shift)
+ {
+- return (word >> shift) | (word << (64 - shift));
++ return (word >> (shift & 63)) | (word << ((-shift) & 63));
+ }
+
+ /**
+@@ -80,7 +80,7 @@ static inline __u64 ror64(__u64 word, unsigned int shift)
+ */
+ static inline __u32 rol32(__u32 word, unsigned int shift)
+ {
+- return (word << shift) | (word >> ((-shift) & 31));
++ return (word << (shift & 31)) | (word >> ((-shift) & 31));
+ }
+
+ /**
+@@ -90,7 +90,7 @@ static inline __u32 rol32(__u32 word, unsigned int shift)
+ */
+ static inline __u32 ror32(__u32 word, unsigned int shift)
+ {
+- return (word >> shift) | (word << (32 - shift));
++ return (word >> (shift & 31)) | (word << ((-shift) & 31));
+ }
+
+ /**
+@@ -100,7 +100,7 @@ static inline __u32 ror32(__u32 word, unsigned int shift)
+ */
+ static inline __u16 rol16(__u16 word, unsigned int shift)
+ {
+- return (word << shift) | (word >> (16 - shift));
++ return (word << (shift & 15)) | (word >> ((-shift) & 15));
+ }
+
+ /**
+@@ -110,7 +110,7 @@ static inline __u16 rol16(__u16 word, unsigned int shift)
+ */
+ static inline __u16 ror16(__u16 word, unsigned int shift)
+ {
+- return (word >> shift) | (word << (16 - shift));
++ return (word >> (shift & 15)) | (word << ((-shift) & 15));
+ }
+
+ /**
+@@ -120,7 +120,7 @@ static inline __u16 ror16(__u16 word, unsigned int shift)
+ */
+ static inline __u8 rol8(__u8 word, unsigned int shift)
+ {
+- return (word << shift) | (word >> (8 - shift));
++ return (word << (shift & 7)) | (word >> ((-shift) & 7));
+ }
+
+ /**
+@@ -130,7 +130,7 @@ static inline __u8 rol8(__u8 word, unsigned int shift)
+ */
+ static inline __u8 ror8(__u8 word, unsigned int shift)
+ {
+- return (word >> shift) | (word << (8 - shift));
++ return (word >> (shift & 7)) | (word << ((-shift) & 7));
+ }
+
+ /**
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index a8ff0ca0c321..3ebee1ce6f98 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -201,6 +201,10 @@
+ #define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1
+ #endif
+
++#if GCC_VERSION >= 90100
++#define __copy(symbol) __attribute__((__copy__(symbol)))
++#endif
++
+ #if !defined(__noclone)
+ #define __noclone /* not needed */
+ #endif
+diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
+index c2ded31a4cec..2b8ed70c4c77 100644
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -180,6 +180,10 @@ struct ftrace_likely_data {
+ #define __diag_GCC(version, severity, string)
+ #endif
+
++#ifndef __copy
++# define __copy(symbol)
++#endif
++
+ #define __diag_push() __diag(push)
+ #define __diag_pop() __diag(pop)
+
+diff --git a/include/linux/list_lru.h b/include/linux/list_lru.h
+index aa5efd9351eb..d5ceb2839a2d 100644
+--- a/include/linux/list_lru.h
++++ b/include/linux/list_lru.h
+@@ -54,6 +54,7 @@ struct list_lru {
+ #ifdef CONFIG_MEMCG_KMEM
+ struct list_head list;
+ int shrinker_id;
++ bool memcg_aware;
+ #endif
+ };
+
+diff --git a/include/linux/module.h b/include/linux/module.h
+index c71044644979..9915397715fc 100644
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -130,13 +130,13 @@ extern void cleanup_module(void);
+ #define module_init(initfn) \
+ static inline initcall_t __maybe_unused __inittest(void) \
+ { return initfn; } \
+- int init_module(void) __attribute__((alias(#initfn)));
++ int init_module(void) __copy(initfn) __attribute__((alias(#initfn)));
+
+ /* This is only required if you want to be unloadable. */
+ #define module_exit(exitfn) \
+ static inline exitcall_t __maybe_unused __exittest(void) \
+ { return exitfn; } \
+- void cleanup_module(void) __attribute__((alias(#exitfn)));
++ void cleanup_module(void) __copy(exitfn) __attribute__((alias(#exitfn)));
+
+ #endif
+
+diff --git a/include/linux/of.h b/include/linux/of.h
+index f2c80cc4641d..d5a863c1ee39 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -968,6 +968,12 @@ static inline int of_cpu_node_to_id(struct device_node *np)
+ #define of_node_cmp(s1, s2) strcasecmp((s1), (s2))
+ #endif
+
++static inline int of_prop_val_eq(struct property *p1, struct property *p2)
++{
++ return p1->length == p2->length &&
++ !memcmp(p1->value, p2->value, (size_t)p1->length);
++}
++
+ #if defined(CONFIG_OF) && defined(CONFIG_NUMA)
+ extern int of_node_to_nid(struct device_node *np);
+ #else
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 9102d60fc5c6..0e6bc3049427 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -2436,6 +2436,8 @@ relock:
+ if (signal_group_exit(signal)) {
+ ksig->info.si_signo = signr = SIGKILL;
+ sigdelset(¤t->pending.signal, SIGKILL);
++ trace_signal_deliver(SIGKILL, SEND_SIG_NOINFO,
++ &sighand->action[SIGKILL - 1]);
+ recalc_sigpending();
+ goto fatal;
+ }
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 5a1c64a26e81..2fb78467582b 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -427,7 +427,7 @@ predicate_parse(const char *str, int nr_parens, int nr_preds,
+ op_stack = kmalloc_array(nr_parens, sizeof(*op_stack), GFP_KERNEL);
+ if (!op_stack)
+ return ERR_PTR(-ENOMEM);
+- prog_stack = kmalloc_array(nr_preds, sizeof(*prog_stack), GFP_KERNEL);
++ prog_stack = kcalloc(nr_preds, sizeof(*prog_stack), GFP_KERNEL);
+ if (!prog_stack) {
+ parse_error(pe, -ENOMEM, 0);
+ goto out_free;
+@@ -576,7 +576,11 @@ predicate_parse(const char *str, int nr_parens, int nr_preds,
+ out_free:
+ kfree(op_stack);
+ kfree(inverts);
+- kfree(prog_stack);
++ if (prog_stack) {
++ for (i = 0; prog_stack[i].pred; i++)
++ kfree(prog_stack[i].pred);
++ kfree(prog_stack);
++ }
+ return ERR_PTR(ret);
+ }
+
+diff --git a/mm/list_lru.c b/mm/list_lru.c
+index 5b30625fd365..f0a15d32b959 100644
+--- a/mm/list_lru.c
++++ b/mm/list_lru.c
+@@ -37,11 +37,7 @@ static int lru_shrinker_id(struct list_lru *lru)
+
+ static inline bool list_lru_memcg_aware(struct list_lru *lru)
+ {
+- /*
+- * This needs node 0 to be always present, even
+- * in the systems supporting sparse numa ids.
+- */
+- return !!lru->node[0].memcg_lrus;
++ return lru->memcg_aware;
+ }
+
+ static inline struct list_lru_one *
+@@ -451,6 +447,8 @@ static int memcg_init_list_lru(struct list_lru *lru, bool memcg_aware)
+ {
+ int i;
+
++ lru->memcg_aware = memcg_aware;
++
+ if (!memcg_aware)
+ return 0;
+
+diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h
+index 552d5efd7cb7..17f06079a712 100644
+--- a/scripts/gcc-plugins/gcc-common.h
++++ b/scripts/gcc-plugins/gcc-common.h
+@@ -150,8 +150,12 @@ void print_gimple_expr(FILE *, gimple, int, int);
+ void dump_gimple_stmt(pretty_printer *, gimple, int, int);
+ #endif
+
++#ifndef __unused
+ #define __unused __attribute__((__unused__))
++#endif
++#ifndef __visible
+ #define __visible __attribute__((visibility("default")))
++#endif
+
+ #define DECL_NAME_POINTER(node) IDENTIFIER_POINTER(DECL_NAME(node))
+ #define DECL_NAME_LENGTH(node) IDENTIFIER_LENGTH(DECL_NAME(node))
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index 8a3905bb02c7..6a314fb0d480 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -89,6 +89,9 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
+ tfm = &hmac_tfm;
+ algo = evm_hmac;
+ } else {
++ if (hash_algo >= HASH_ALGO__LAST)
++ return ERR_PTR(-EINVAL);
++
+ tfm = &evm_tfm[hash_algo];
+ algo = hash_algo_name[hash_algo];
+ }
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 8c9499867c91..93babb60b05a 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -1059,10 +1059,10 @@ enum {
+ };
+
+ static const char *const mask_tokens[] = {
+- "MAY_EXEC",
+- "MAY_WRITE",
+- "MAY_READ",
+- "MAY_APPEND"
++ "^MAY_EXEC",
++ "^MAY_WRITE",
++ "^MAY_READ",
++ "^MAY_APPEND"
+ };
+
+ #define __ima_hook_stringify(str) (#str),
+@@ -1122,6 +1122,7 @@ int ima_policy_show(struct seq_file *m, void *v)
+ struct ima_rule_entry *entry = v;
+ int i;
+ char tbuf[64] = {0,};
++ int offset = 0;
+
+ rcu_read_lock();
+
+@@ -1145,15 +1146,17 @@ int ima_policy_show(struct seq_file *m, void *v)
+ if (entry->flags & IMA_FUNC)
+ policy_func_show(m, entry->func);
+
+- if (entry->flags & IMA_MASK) {
++ if ((entry->flags & IMA_MASK) || (entry->flags & IMA_INMASK)) {
++ if (entry->flags & IMA_MASK)
++ offset = 1;
+ if (entry->mask & MAY_EXEC)
+- seq_printf(m, pt(Opt_mask), mt(mask_exec));
++ seq_printf(m, pt(Opt_mask), mt(mask_exec) + offset);
+ if (entry->mask & MAY_WRITE)
+- seq_printf(m, pt(Opt_mask), mt(mask_write));
++ seq_printf(m, pt(Opt_mask), mt(mask_write) + offset);
+ if (entry->mask & MAY_READ)
+- seq_printf(m, pt(Opt_mask), mt(mask_read));
++ seq_printf(m, pt(Opt_mask), mt(mask_read) + offset);
+ if (entry->mask & MAY_APPEND)
+- seq_printf(m, pt(Opt_mask), mt(mask_append));
++ seq_printf(m, pt(Opt_mask), mt(mask_append) + offset);
+ seq_puts(m, " ");
+ }
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index adce5b60d5b4..5e6cb625db83 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6084,13 +6084,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chain_id = ALC269_FIXUP_THINKPAD_ACPI,
+ },
+ [ALC255_FIXUP_ACER_MIC_NO_PRESENCE] = {
+- .type = HDA_FIXUP_PINS,
+- .v.pins = (const struct hda_pintbl[]) {
+- { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+- { }
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* Enable the Mic */
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x45 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x5089 },
++ {}
+ },
+ .chained = true,
+- .chain_id = ALC255_FIXUP_HEADSET_MODE
++ .chain_id = ALC269_FIXUP_LIFEBOOK_EXTMIC
+ },
+ [ALC255_FIXUP_ASUS_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+@@ -7121,6 +7123,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x18, 0x02a11030},
+ {0x19, 0x0181303F},
+ {0x21, 0x0221102f}),
++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1025, "Acer", ALC255_FIXUP_ACER_MIC_NO_PRESENCE,
++ {0x12, 0x90a60140},
++ {0x14, 0x90170120},
++ {0x21, 0x02211030}),
+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1025, "Acer", ALC255_FIXUP_ACER_MIC_NO_PRESENCE,
+ {0x12, 0x90a601c0},
+ {0x14, 0x90171120},
+@@ -7558,7 +7564,7 @@ static int patch_alc269(struct hda_codec *codec)
+
+ spec = codec->spec;
+ spec->gen.shared_mic_vref_pin = 0x18;
+- codec->power_save_node = 1;
++ codec->power_save_node = 0;
+
+ #ifdef CONFIG_PM
+ codec->patch_ops.suspend = alc269_suspend;
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index aa28510d23ad..bbcb0d4d83ae 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -720,6 +720,15 @@ static int line6_init_cap_control(struct usb_line6 *line6)
+ return 0;
+ }
+
++static void line6_startup_work(struct work_struct *work)
++{
++ struct usb_line6 *line6 =
++ container_of(work, struct usb_line6, startup_work.work);
++
++ if (line6->startup)
++ line6->startup(line6);
++}
++
+ /*
+ Probe USB device.
+ */
+@@ -755,6 +764,7 @@ int line6_probe(struct usb_interface *interface,
+ line6->properties = properties;
+ line6->usbdev = usbdev;
+ line6->ifcdev = &interface->dev;
++ INIT_DELAYED_WORK(&line6->startup_work, line6_startup_work);
+
+ strcpy(card->id, properties->id);
+ strcpy(card->driver, driver_name);
+@@ -825,6 +835,8 @@ void line6_disconnect(struct usb_interface *interface)
+ if (WARN_ON(usbdev != line6->usbdev))
+ return;
+
++ cancel_delayed_work(&line6->startup_work);
++
+ if (line6->urb_listen != NULL)
+ line6_stop_listen(line6);
+
+diff --git a/sound/usb/line6/driver.h b/sound/usb/line6/driver.h
+index 61425597eb61..650d909c9c4f 100644
+--- a/sound/usb/line6/driver.h
++++ b/sound/usb/line6/driver.h
+@@ -178,11 +178,15 @@ struct usb_line6 {
+ fifo;
+ } messages;
+
++ /* Work for delayed PCM startup */
++ struct delayed_work startup_work;
++
+ /* If MIDI is supported, buffer_message contains the pre-processed data;
+ * otherwise the data is only in urb_listen (buffer_incoming).
+ */
+ void (*process_message)(struct usb_line6 *);
+ void (*disconnect)(struct usb_line6 *line6);
++ void (*startup)(struct usb_line6 *line6);
+ };
+
+ extern char *line6_alloc_sysex_buffer(struct usb_line6 *line6, int code1,
+diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c
+index 325b07b98b3c..7e39083f8f76 100644
+--- a/sound/usb/line6/toneport.c
++++ b/sound/usb/line6/toneport.c
+@@ -54,9 +54,6 @@ struct usb_line6_toneport {
+ /* Firmware version (x 100) */
+ u8 firmware_version;
+
+- /* Work for delayed PCM startup */
+- struct delayed_work pcm_work;
+-
+ /* Device type */
+ enum line6_device_type type;
+
+@@ -241,12 +238,8 @@ static int snd_toneport_source_put(struct snd_kcontrol *kcontrol,
+ return 1;
+ }
+
+-static void toneport_start_pcm(struct work_struct *work)
++static void toneport_startup(struct usb_line6 *line6)
+ {
+- struct usb_line6_toneport *toneport =
+- container_of(work, struct usb_line6_toneport, pcm_work.work);
+- struct usb_line6 *line6 = &toneport->line6;
+-
+ line6_pcm_acquire(line6->line6pcm, LINE6_STREAM_MONITOR, true);
+ }
+
+@@ -394,7 +387,7 @@ static int toneport_setup(struct usb_line6_toneport *toneport)
+ if (toneport_has_led(toneport))
+ toneport_update_led(toneport);
+
+- schedule_delayed_work(&toneport->pcm_work,
++ schedule_delayed_work(&toneport->line6.startup_work,
+ msecs_to_jiffies(TONEPORT_PCM_DELAY * 1000));
+ return 0;
+ }
+@@ -407,8 +400,6 @@ static void line6_toneport_disconnect(struct usb_line6 *line6)
+ struct usb_line6_toneport *toneport =
+ (struct usb_line6_toneport *)line6;
+
+- cancel_delayed_work_sync(&toneport->pcm_work);
+-
+ if (toneport_has_led(toneport))
+ toneport_remove_leds(toneport);
+ }
+@@ -424,9 +415,9 @@ static int toneport_init(struct usb_line6 *line6,
+ struct usb_line6_toneport *toneport = (struct usb_line6_toneport *) line6;
+
+ toneport->type = id->driver_info;
+- INIT_DELAYED_WORK(&toneport->pcm_work, toneport_start_pcm);
+
+ line6->disconnect = line6_toneport_disconnect;
++ line6->startup = toneport_startup;
+
+ /* initialize PCM subsystem: */
+ err = line6_init_pcm(line6, &toneport_pcm_properties);
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index fef3527af3bd..02bac8abd206 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -223,6 +223,9 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
+ case KVM_CAP_MAX_VCPUS:
+ r = KVM_MAX_VCPUS;
+ break;
++ case KVM_CAP_MAX_VCPU_ID:
++ r = KVM_MAX_VCPU_ID;
++ break;
+ case KVM_CAP_NR_MEMSLOTS:
+ r = KVM_USER_MEM_SLOTS;
+ break;
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index e909d9907b50..2b36a51afb57 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2965,8 +2965,6 @@ static long kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
+ case KVM_CAP_MULTI_ADDRESS_SPACE:
+ return KVM_ADDRESS_SPACE_NUM;
+ #endif
+- case KVM_CAP_MAX_VCPU_ID:
+- return KVM_MAX_VCPU_ID;
+ default:
+ break;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-06-10 19:43 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-06-10 19:43 UTC (permalink / raw
To: gentoo-commits
commit: 7918237fb06dafdefd25924598ff1ea91f6dc34a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Jun 10 19:41:47 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Jun 10 19:41:47 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7918237f
Bluetooth: Check key sizes only when Secure Simple Pairing is enabled.
See bug #686758.
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +++
...zes-only-if-Secure-Simple-Pairing-enabled.patch | 37 ++++++++++++++++++++++
2 files changed, 41 insertions(+)
diff --git a/0000_README b/0000_README
index 3161071..513d8bc 100644
--- a/0000_README
+++ b/0000_README
@@ -247,6 +247,10 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default.
+Patch: 2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
+From: https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-marcel@holtmann.org/raw
+Desc: Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758
+
Patch: 2500_usb-storage-Disable-UAS-on-JMicron-SATA-enclosure.patch
From: https://bugzilla.redhat.com/show_bug.cgi?id=1260207#c5
Desc: Add UAS disable quirk. See bug #640082.
diff --git a/2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch b/2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
new file mode 100644
index 0000000..394ad48
--- /dev/null
+++ b/2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
@@ -0,0 +1,37 @@
+The encryption is only mandatory to be enforced when both sides are using
+Secure Simple Pairing and this means the key size check makes only sense
+in that case.
+
+On legacy Bluetooth 2.0 and earlier devices like mice the encryption was
+optional and thus causing an issue if the key size check is not bound to
+using Secure Simple Pairing.
+
+Fixes: d5bb334a8e17 ("Bluetooth: Align minimum encryption key size for LE and BR/EDR connections")
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Cc: stable@vger.kernel.org
+---
+ net/bluetooth/hci_conn.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 3cf0764d5793..7516cdde3373 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1272,8 +1272,13 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
+ return 0;
+ }
+
+- if (hci_conn_ssp_enabled(conn) &&
+- !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
++ /* If Secure Simple Pairing is not enabled, then legacy connection
++ * setup is used and no encryption or key sizes can be enforced.
++ */
++ if (!hci_conn_ssp_enabled(conn))
++ return 1;
++
++ if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ return 0;
+
+ /* The minimum encryption key size needs to be enforced by the
+--
+2.20.1
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-06-11 12:42 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-06-11 12:42 UTC (permalink / raw
To: gentoo-commits
commit: 9ef5edec2b39b51cb07bbe8c1b877c8fafdf0f25
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 11 12:41:47 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jun 11 12:41:47 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9ef5edec
Linux patch 4.19.50
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1049_linux-4.19.50.patch | 2070 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2074 insertions(+)
diff --git a/0000_README b/0000_README
index 513d8bc..9cf9325 100644
--- a/0000_README
+++ b/0000_README
@@ -239,6 +239,10 @@ Patch: 1048_linux-4.19.49.patch
From: http://www.kernel.org
Desc: Linux 4.19.49
+Patch: 1049_linux-4.19.50.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.50
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1049_linux-4.19.50.patch b/1049_linux-4.19.50.patch
new file mode 100644
index 0000000..b3b5343
--- /dev/null
+++ b/1049_linux-4.19.50.patch
@@ -0,0 +1,2070 @@
+diff --git a/Makefile b/Makefile
+index e84966c49117..f7e7e365e2ff 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 49
++SUBLEVEL = 50
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
+index 7c0b2e6cdfbd..4c7a93f4039a 100644
+--- a/arch/mips/ath79/setup.c
++++ b/arch/mips/ath79/setup.c
+@@ -211,6 +211,12 @@ const char *get_system_type(void)
+ return ath79_sys_type;
+ }
+
++int get_c0_perfcount_int(void)
++{
++ return ATH79_MISC_IRQ(5);
++}
++EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
++
+ unsigned int get_c0_compare_int(void)
+ {
+ return CP0_LEGACY_COMPARE_IRQ;
+diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
+index 2f616ebeb7e0..7755a1fad05a 100644
+--- a/arch/mips/mm/mmap.c
++++ b/arch/mips/mm/mmap.c
+@@ -203,6 +203,11 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
+
+ int __virt_addr_valid(const volatile void *kaddr)
+ {
++ unsigned long vaddr = (unsigned long)vaddr;
++
++ if ((vaddr < PAGE_OFFSET) || (vaddr >= MAP_BASE))
++ return 0;
++
+ return pfn_valid(PFN_DOWN(virt_to_phys(kaddr)));
+ }
+ EXPORT_SYMBOL_GPL(__virt_addr_valid);
+diff --git a/arch/mips/pistachio/Platform b/arch/mips/pistachio/Platform
+index d80cd612df1f..c3592b374ad2 100644
+--- a/arch/mips/pistachio/Platform
++++ b/arch/mips/pistachio/Platform
+@@ -6,3 +6,4 @@ cflags-$(CONFIG_MACH_PISTACHIO) += \
+ -I$(srctree)/arch/mips/include/asm/mach-pistachio
+ load-$(CONFIG_MACH_PISTACHIO) += 0xffffffff80400000
+ zload-$(CONFIG_MACH_PISTACHIO) += 0xffffffff81000000
++all-$(CONFIG_MACH_PISTACHIO) := uImage.gz
+diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
+index 22e9d281324d..e7d4ce6964ae 100644
+--- a/arch/powerpc/kernel/nvram_64.c
++++ b/arch/powerpc/kernel/nvram_64.c
+@@ -563,8 +563,6 @@ static int nvram_pstore_init(void)
+ nvram_pstore_info.buf = oops_data;
+ nvram_pstore_info.bufsize = oops_data_sz;
+
+- spin_lock_init(&nvram_pstore_info.buf_lock);
+-
+ rc = pstore_register(&nvram_pstore_info);
+ if (rc && (rc != -EPERM))
+ /* Print error only when pstore.backend == nvram */
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index 72af23bacbb5..a6e3c7022245 100644
+--- a/arch/s390/mm/fault.c
++++ b/arch/s390/mm/fault.c
+@@ -107,7 +107,6 @@ void bust_spinlocks(int yes)
+
+ /*
+ * Find out which address space caused the exception.
+- * Access register mode is impossible, ignore space == 3.
+ */
+ static inline enum fault_type get_fault_type(struct pt_regs *regs)
+ {
+@@ -132,6 +131,10 @@ static inline enum fault_type get_fault_type(struct pt_regs *regs)
+ }
+ return VDSO_FAULT;
+ }
++ if (trans_exc_code == 1) {
++ /* access register mode, not used in the kernel */
++ return USER_FAULT;
++ }
+ /* home space exception -> access via kernel ASCE */
+ return KERNEL_FAULT;
+ }
+diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
+index 9119d8e41f1f..87dcba101e56 100644
+--- a/arch/x86/lib/insn-eval.c
++++ b/arch/x86/lib/insn-eval.c
+@@ -555,7 +555,8 @@ static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,
+ }
+
+ /**
+- * get_desc() - Obtain pointer to a segment descriptor
++ * get_desc() - Obtain contents of a segment descriptor
++ * @out: Segment descriptor contents on success
+ * @sel: Segment selector
+ *
+ * Given a segment selector, obtain a pointer to the segment descriptor.
+@@ -563,18 +564,18 @@ static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs,
+ *
+ * Returns:
+ *
+- * Pointer to segment descriptor on success.
++ * True on success, false on failure.
+ *
+ * NULL on error.
+ */
+-static struct desc_struct *get_desc(unsigned short sel)
++static bool get_desc(struct desc_struct *out, unsigned short sel)
+ {
+ struct desc_ptr gdt_desc = {0, 0};
+ unsigned long desc_base;
+
+ #ifdef CONFIG_MODIFY_LDT_SYSCALL
+ if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) {
+- struct desc_struct *desc = NULL;
++ bool success = false;
+ struct ldt_struct *ldt;
+
+ /* Bits [15:3] contain the index of the desired entry. */
+@@ -582,12 +583,14 @@ static struct desc_struct *get_desc(unsigned short sel)
+
+ mutex_lock(¤t->active_mm->context.lock);
+ ldt = current->active_mm->context.ldt;
+- if (ldt && sel < ldt->nr_entries)
+- desc = &ldt->entries[sel];
++ if (ldt && sel < ldt->nr_entries) {
++ *out = ldt->entries[sel];
++ success = true;
++ }
+
+ mutex_unlock(¤t->active_mm->context.lock);
+
+- return desc;
++ return success;
+ }
+ #endif
+ native_store_gdt(&gdt_desc);
+@@ -602,9 +605,10 @@ static struct desc_struct *get_desc(unsigned short sel)
+ desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK);
+
+ if (desc_base > gdt_desc.size)
+- return NULL;
++ return false;
+
+- return (struct desc_struct *)(gdt_desc.address + desc_base);
++ *out = *(struct desc_struct *)(gdt_desc.address + desc_base);
++ return true;
+ }
+
+ /**
+@@ -626,7 +630,7 @@ static struct desc_struct *get_desc(unsigned short sel)
+ */
+ unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
+ {
+- struct desc_struct *desc;
++ struct desc_struct desc;
+ short sel;
+
+ sel = get_segment_selector(regs, seg_reg_idx);
+@@ -664,11 +668,10 @@ unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
+ if (!sel)
+ return -1L;
+
+- desc = get_desc(sel);
+- if (!desc)
++ if (!get_desc(&desc, sel))
+ return -1L;
+
+- return get_desc_base(desc);
++ return get_desc_base(&desc);
+ }
+
+ /**
+@@ -690,7 +693,7 @@ unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx)
+ */
+ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
+ {
+- struct desc_struct *desc;
++ struct desc_struct desc;
+ unsigned long limit;
+ short sel;
+
+@@ -704,8 +707,7 @@ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
+ if (!sel)
+ return 0;
+
+- desc = get_desc(sel);
+- if (!desc)
++ if (!get_desc(&desc, sel))
+ return 0;
+
+ /*
+@@ -714,8 +716,8 @@ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
+ * not tested when checking the segment limits. In practice,
+ * this means that the segment ends in (limit << 12) + 0xfff.
+ */
+- limit = get_desc_limit(desc);
+- if (desc->g)
++ limit = get_desc_limit(&desc);
++ if (desc.g)
+ limit = (limit << 12) + 0xfff;
+
+ return limit;
+@@ -739,7 +741,7 @@ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx)
+ */
+ int insn_get_code_seg_params(struct pt_regs *regs)
+ {
+- struct desc_struct *desc;
++ struct desc_struct desc;
+ short sel;
+
+ if (v8086_mode(regs))
+@@ -750,8 +752,7 @@ int insn_get_code_seg_params(struct pt_regs *regs)
+ if (sel < 0)
+ return sel;
+
+- desc = get_desc(sel);
+- if (!desc)
++ if (!get_desc(&desc, sel))
+ return -EINVAL;
+
+ /*
+@@ -759,10 +760,10 @@ int insn_get_code_seg_params(struct pt_regs *regs)
+ * determines whether a segment contains data or code. If this is a data
+ * segment, return error.
+ */
+- if (!(desc->type & BIT(3)))
++ if (!(desc.type & BIT(3)))
+ return -EINVAL;
+
+- switch ((desc->l << 1) | desc->d) {
++ switch ((desc.l << 1) | desc.d) {
+ case 0: /*
+ * Legacy mode. CS.L=0, CS.D=0. Address and operand size are
+ * both 16-bit.
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index a7d966964c6f..513ce09e9950 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -299,7 +299,17 @@ int hibernate_resume_nonboot_cpu_disable(void)
+ * address in its instruction pointer may not be possible to resolve
+ * any more at that point (the page tables used by it previously may
+ * have been overwritten by hibernate image data).
++ *
++ * First, make sure that we wake up all the potentially disabled SMT
++ * threads which have been initially brought up and then put into
++ * mwait/cpuidle sleep.
++ * Those will be put to proper (not interfering with hibernation
++ * resume) sleep afterwards, and the resumed kernel will decide itself
++ * what to do with them.
+ */
++ ret = cpuhp_smt_enable();
++ if (ret)
++ return ret;
+ smp_ops.play_dead = resume_play_dead;
+ ret = disable_nonboot_cpus();
+ smp_ops.play_dead = play_dead;
+diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
+index f8e3b668d20b..c9986041a5e1 100644
+--- a/arch/x86/power/hibernate_64.c
++++ b/arch/x86/power/hibernate_64.c
+@@ -13,6 +13,7 @@
+ #include <linux/suspend.h>
+ #include <linux/scatterlist.h>
+ #include <linux/kdebug.h>
++#include <linux/cpu.h>
+
+ #include <crypto/hash.h>
+
+@@ -363,3 +364,35 @@ int arch_hibernation_header_restore(void *addr)
+
+ return 0;
+ }
++
++int arch_resume_nosmt(void)
++{
++ int ret = 0;
++ /*
++ * We reached this while coming out of hibernation. This means
++ * that SMT siblings are sleeping in hlt, as mwait is not safe
++ * against control transition during resume (see comment in
++ * hibernate_resume_nonboot_cpu_disable()).
++ *
++ * If the resumed kernel has SMT disabled, we have to take all the
++ * SMT siblings out of hlt, and offline them again so that they
++ * end up in mwait proper.
++ *
++ * Called with hotplug disabled.
++ */
++ cpu_hotplug_enable();
++ if (cpu_smt_control == CPU_SMT_DISABLED ||
++ cpu_smt_control == CPU_SMT_FORCE_DISABLED) {
++ enum cpuhp_smt_control old = cpu_smt_control;
++
++ ret = cpuhp_smt_enable();
++ if (ret)
++ goto out;
++ ret = cpuhp_smt_disable(old);
++ if (ret)
++ goto out;
++ }
++out:
++ cpu_hotplug_disable();
++ return ret;
++}
+diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
+index 3c5ea7cb693e..ab8faa6d6616 100644
+--- a/drivers/acpi/apei/erst.c
++++ b/drivers/acpi/apei/erst.c
+@@ -1176,7 +1176,6 @@ static int __init erst_init(void)
+ "Error Record Serialization Table (ERST) support is initialized.\n");
+
+ buf = kmalloc(erst_erange.size, GFP_KERNEL);
+- spin_lock_init(&erst_info.buf_lock);
+ if (buf) {
+ erst_info.buf = buf + sizeof(struct cper_pstore_record);
+ erst_info.bufsize = erst_erange.size -
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 3e905da33bcb..5830d9417886 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1310,11 +1310,11 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo)
+ }
+
+ free_shadow:
+- kfree(rinfo->shadow[i].grants_used);
++ kvfree(rinfo->shadow[i].grants_used);
+ rinfo->shadow[i].grants_used = NULL;
+- kfree(rinfo->shadow[i].indirect_grants);
++ kvfree(rinfo->shadow[i].indirect_grants);
+ rinfo->shadow[i].indirect_grants = NULL;
+- kfree(rinfo->shadow[i].sg);
++ kvfree(rinfo->shadow[i].sg);
+ rinfo->shadow[i].sg = NULL;
+ }
+
+@@ -1353,7 +1353,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
+ for (i = 0; i < info->nr_rings; i++)
+ blkif_free_ring(&info->rinfo[i]);
+
+- kfree(info->rinfo);
++ kvfree(info->rinfo);
+ info->rinfo = NULL;
+ info->nr_rings = 0;
+ }
+@@ -1914,9 +1914,9 @@ static int negotiate_mq(struct blkfront_info *info)
+ if (!info->nr_rings)
+ info->nr_rings = 1;
+
+- info->rinfo = kcalloc(info->nr_rings,
+- sizeof(struct blkfront_ring_info),
+- GFP_KERNEL);
++ info->rinfo = kvcalloc(info->nr_rings,
++ sizeof(struct blkfront_ring_info),
++ GFP_KERNEL);
+ if (!info->rinfo) {
+ xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
+ info->nr_rings = 0;
+@@ -2232,17 +2232,17 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo)
+
+ for (i = 0; i < BLK_RING_SIZE(info); i++) {
+ rinfo->shadow[i].grants_used =
+- kcalloc(grants,
+- sizeof(rinfo->shadow[i].grants_used[0]),
+- GFP_NOIO);
+- rinfo->shadow[i].sg = kcalloc(psegs,
+- sizeof(rinfo->shadow[i].sg[0]),
+- GFP_NOIO);
++ kvcalloc(grants,
++ sizeof(rinfo->shadow[i].grants_used[0]),
++ GFP_NOIO);
++ rinfo->shadow[i].sg = kvcalloc(psegs,
++ sizeof(rinfo->shadow[i].sg[0]),
++ GFP_NOIO);
+ if (info->max_indirect_segments)
+ rinfo->shadow[i].indirect_grants =
+- kcalloc(INDIRECT_GREFS(grants),
+- sizeof(rinfo->shadow[i].indirect_grants[0]),
+- GFP_NOIO);
++ kvcalloc(INDIRECT_GREFS(grants),
++ sizeof(rinfo->shadow[i].indirect_grants[0]),
++ GFP_NOIO);
+ if ((rinfo->shadow[i].grants_used == NULL) ||
+ (rinfo->shadow[i].sg == NULL) ||
+ (info->max_indirect_segments &&
+@@ -2256,11 +2256,11 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo)
+
+ out_of_memory:
+ for (i = 0; i < BLK_RING_SIZE(info); i++) {
+- kfree(rinfo->shadow[i].grants_used);
++ kvfree(rinfo->shadow[i].grants_used);
+ rinfo->shadow[i].grants_used = NULL;
+- kfree(rinfo->shadow[i].sg);
++ kvfree(rinfo->shadow[i].sg);
+ rinfo->shadow[i].sg = NULL;
+- kfree(rinfo->shadow[i].indirect_grants);
++ kvfree(rinfo->shadow[i].indirect_grants);
+ rinfo->shadow[i].indirect_grants = NULL;
+ }
+ if (!list_empty(&rinfo->indirect_pages)) {
+diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
+index cfe87b465819..0f7d97917197 100644
+--- a/drivers/firmware/efi/efi-pstore.c
++++ b/drivers/firmware/efi/efi-pstore.c
+@@ -259,8 +259,7 @@ static int efi_pstore_write(struct pstore_record *record)
+ efi_name[i] = name[i];
+
+ ret = efivar_entry_set_safe(efi_name, vendor, PSTORE_EFI_ATTRIBUTES,
+- !pstore_cannot_block_path(record->reason),
+- record->size, record->psi->buf);
++ preemptible(), record->size, record->psi->buf);
+
+ if (record->reason == KMSG_DUMP_OOPS)
+ efivar_run_worker();
+@@ -369,7 +368,6 @@ static __init int efivars_pstore_init(void)
+ return -ENOMEM;
+
+ efi_pstore_info.bufsize = 1024;
+- spin_lock_init(&efi_pstore_info.buf_lock);
+
+ if (pstore_register(&efi_pstore_info)) {
+ kfree(efi_pstore_info.buf);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+index f008804f0b97..bbd927e800af 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+@@ -416,8 +416,7 @@ static int amdgpu_atif_handler(struct amdgpu_device *adev,
+ }
+ }
+ if (req.pending & ATIF_DGPU_DISPLAY_EVENT) {
+- if ((adev->flags & AMD_IS_PX) &&
+- amdgpu_atpx_dgpu_req_power_for_displays()) {
++ if (adev->flags & AMD_IS_PX) {
+ pm_runtime_get_sync(adev->ddev->dev);
+ /* Just fire off a uevent and let userspace tell us what to do */
+ drm_helper_hpd_irq_event(adev->ddev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 5b39d1399630..5be82e4fd1da 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -37,18 +37,10 @@ static void psp_set_funcs(struct amdgpu_device *adev);
+ static int psp_early_init(void *handle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
++ struct psp_context *psp = &adev->psp;
+
+ psp_set_funcs(adev);
+
+- return 0;
+-}
+-
+-static int psp_sw_init(void *handle)
+-{
+- struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+- struct psp_context *psp = &adev->psp;
+- int ret;
+-
+ switch (adev->asic_type) {
+ case CHIP_VEGA10:
+ case CHIP_VEGA12:
+@@ -67,6 +59,15 @@ static int psp_sw_init(void *handle)
+ if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP)
+ return 0;
+
++ return 0;
++}
++
++static int psp_sw_init(void *handle)
++{
++ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
++ struct psp_context *psp = &adev->psp;
++ int ret;
++
+ ret = psp_init_microcode(psp);
+ if (ret) {
+ DRM_ERROR("Failed to load psp firmware!\n");
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index 94f5c3646cb7..c22062cc9992 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -1573,15 +1573,6 @@ int drm_atomic_helper_async_check(struct drm_device *dev,
+ if (old_plane_state->fb != new_plane_state->fb)
+ return -EINVAL;
+
+- /*
+- * FIXME: Since prepare_fb and cleanup_fb are always called on
+- * the new_plane_state for async updates we need to block framebuffer
+- * changes. This prevents use of a fb that's been cleaned up and
+- * double cleanups from occuring.
+- */
+- if (old_plane_state->fb != new_plane_state->fb)
+- return -EINVAL;
+-
+ funcs = plane->helper_private;
+ if (!funcs->atomic_async_update)
+ return -EINVAL;
+@@ -1612,6 +1603,8 @@ EXPORT_SYMBOL(drm_atomic_helper_async_check);
+ * drm_atomic_async_check() succeeds. Async commits are not supposed to swap
+ * the states like normal sync commits, but just do in-place changes on the
+ * current state.
++ *
++ * TODO: Implement full swap instead of doing in-place changes.
+ */
+ void drm_atomic_helper_async_commit(struct drm_device *dev,
+ struct drm_atomic_state *state)
+@@ -1622,6 +1615,9 @@ void drm_atomic_helper_async_commit(struct drm_device *dev,
+ int i;
+
+ for_each_new_plane_in_state(state, plane, plane_state, i) {
++ struct drm_framebuffer *new_fb = plane_state->fb;
++ struct drm_framebuffer *old_fb = plane->state->fb;
++
+ funcs = plane->helper_private;
+ funcs->atomic_async_update(plane, plane_state);
+
+@@ -1630,11 +1626,17 @@ void drm_atomic_helper_async_commit(struct drm_device *dev,
+ * plane->state in-place, make sure at least common
+ * properties have been properly updated.
+ */
+- WARN_ON_ONCE(plane->state->fb != plane_state->fb);
++ WARN_ON_ONCE(plane->state->fb != new_fb);
+ WARN_ON_ONCE(plane->state->crtc_x != plane_state->crtc_x);
+ WARN_ON_ONCE(plane->state->crtc_y != plane_state->crtc_y);
+ WARN_ON_ONCE(plane->state->src_x != plane_state->src_x);
+ WARN_ON_ONCE(plane->state->src_y != plane_state->src_y);
++
++ /*
++ * Make sure the FBs have been swapped so that cleanups in the
++ * new_state performs a cleanup in the old FB.
++ */
++ WARN_ON_ONCE(plane_state->fb != old_fb);
+ }
+ }
+ EXPORT_SYMBOL(drm_atomic_helper_async_commit);
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index b506e3622b08..7c581f4c2b94 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -172,6 +172,25 @@ static const struct edid_quirk {
+ /* Rotel RSX-1058 forwards sink's EDID but only does HDMI 1.1*/
+ { "ETR", 13896, EDID_QUIRK_FORCE_8BPC },
+
++ /* Valve Index Headset */
++ { "VLV", 0x91a8, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91b0, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91b1, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91b2, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91b3, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91b4, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91b5, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91b6, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91b7, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91b8, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91b9, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91ba, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91bb, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91bc, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91bd, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91be, EDID_QUIRK_NON_DESKTOP },
++ { "VLV", 0x91bf, EDID_QUIRK_NON_DESKTOP },
++
+ /* HTC Vive and Vive Pro VR Headsets */
+ { "HVR", 0xaa01, EDID_QUIRK_NON_DESKTOP },
+ { "HVR", 0xaa02, EDID_QUIRK_NON_DESKTOP },
+@@ -193,6 +212,12 @@ static const struct edid_quirk {
+
+ /* Sony PlayStation VR Headset */
+ { "SNY", 0x0704, EDID_QUIRK_NON_DESKTOP },
++
++ /* Sensics VR Headsets */
++ { "SEN", 0x1019, EDID_QUIRK_NON_DESKTOP },
++
++ /* OSVR HDK and HDK2 VR Headsets */
++ { "SVR", 0x1019, EDID_QUIRK_NON_DESKTOP },
+ };
+
+ /*
+diff --git a/drivers/gpu/drm/gma500/cdv_intel_lvds.c b/drivers/gpu/drm/gma500/cdv_intel_lvds.c
+index de9531caaca0..9c8446184b17 100644
+--- a/drivers/gpu/drm/gma500/cdv_intel_lvds.c
++++ b/drivers/gpu/drm/gma500/cdv_intel_lvds.c
+@@ -594,6 +594,9 @@ void cdv_intel_lvds_init(struct drm_device *dev,
+ int pipe;
+ u8 pin;
+
++ if (!dev_priv->lvds_enabled_in_vbt)
++ return;
++
+ pin = GMBUS_PORT_PANEL;
+ if (!lvds_is_present_in_vbt(dev, &pin)) {
+ DRM_DEBUG_KMS("LVDS is not present in VBT\n");
+diff --git a/drivers/gpu/drm/gma500/intel_bios.c b/drivers/gpu/drm/gma500/intel_bios.c
+index 63bde4e86c6a..e019ea271ffc 100644
+--- a/drivers/gpu/drm/gma500/intel_bios.c
++++ b/drivers/gpu/drm/gma500/intel_bios.c
+@@ -436,6 +436,9 @@ parse_driver_features(struct drm_psb_private *dev_priv,
+ if (driver->lvds_config == BDB_DRIVER_FEATURE_EDP)
+ dev_priv->edp.support = 1;
+
++ dev_priv->lvds_enabled_in_vbt = driver->lvds_config != 0;
++ DRM_DEBUG_KMS("LVDS VBT config bits: 0x%x\n", driver->lvds_config);
++
+ /* This bit means to use 96Mhz for DPLL_A or not */
+ if (driver->primary_lfp_id)
+ dev_priv->dplla_96mhz = true;
+diff --git a/drivers/gpu/drm/gma500/psb_drv.h b/drivers/gpu/drm/gma500/psb_drv.h
+index 93d2f4000d2f..be3cf9b348bd 100644
+--- a/drivers/gpu/drm/gma500/psb_drv.h
++++ b/drivers/gpu/drm/gma500/psb_drv.h
+@@ -538,6 +538,7 @@ struct drm_psb_private {
+ int lvds_ssc_freq;
+ bool is_lvds_on;
+ bool is_mipi_on;
++ bool lvds_enabled_in_vbt;
+ u32 mipi_ctrl_display;
+
+ unsigned int core_freq;
+diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
+index 542f31ce108f..40b32b4d1d98 100644
+--- a/drivers/gpu/drm/i915/gvt/gtt.c
++++ b/drivers/gpu/drm/i915/gvt/gtt.c
+@@ -2161,7 +2161,8 @@ static int emulate_ggtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
+ struct intel_gvt_gtt_pte_ops *ops = gvt->gtt.pte_ops;
+ unsigned long g_gtt_index = off >> info->gtt_entry_size_shift;
+ unsigned long gma, gfn;
+- struct intel_gvt_gtt_entry e, m;
++ struct intel_gvt_gtt_entry e = {.val64 = 0, .type = GTT_TYPE_GGTT_PTE};
++ struct intel_gvt_gtt_entry m = {.val64 = 0, .type = GTT_TYPE_GGTT_PTE};
+ dma_addr_t dma_addr;
+ int ret;
+
+@@ -2237,7 +2238,8 @@ static int emulate_ggtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
+
+ if (ops->test_present(&e)) {
+ gfn = ops->get_pfn(&e);
+- m = e;
++ m.val64 = e.val64;
++ m.type = e.type;
+
+ /* one PTE update may be issued in multiple writes and the
+ * first write may not construct a valid gfn
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 5b544cb38148..16f5d2d93801 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -32,7 +32,7 @@
+ * macros. Do **not** mass change existing definitions just to update the style.
+ *
+ * Layout
+- * ''''''
++ * ~~~~~~
+ *
+ * Keep helper macros near the top. For example, _PIPE() and friends.
+ *
+@@ -78,7 +78,7 @@
+ * style. Use lower case in hexadecimal values.
+ *
+ * Naming
+- * ''''''
++ * ~~~~~~
+ *
+ * Try to name registers according to the specs. If the register name changes in
+ * the specs from platform to another, stick to the original name.
+@@ -96,7 +96,7 @@
+ * suffix to the name. For example, ``_SKL`` or ``_GEN8``.
+ *
+ * Examples
+- * ''''''''
++ * ~~~~~~~~
+ *
+ * (Note that the values in the example are indented using spaces instead of
+ * TABs to avoid misalignment in generated documentation. Use TABs in the
+diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
+index 01d1d2088f04..728a20e1f638 100644
+--- a/drivers/gpu/drm/i915/intel_fbc.c
++++ b/drivers/gpu/drm/i915/intel_fbc.c
+@@ -1267,6 +1267,10 @@ static int intel_sanitize_fbc_option(struct drm_i915_private *dev_priv)
+ if (!HAS_FBC(dev_priv))
+ return 0;
+
++ /* https://bugs.freedesktop.org/show_bug.cgi?id=108085 */
++ if (IS_GEMINILAKE(dev_priv))
++ return 0;
++
+ if (IS_BROADWELL(dev_priv) || INTEL_GEN(dev_priv) >= 9)
+ return 1;
+
+diff --git a/drivers/gpu/drm/i915/intel_workarounds.c b/drivers/gpu/drm/i915/intel_workarounds.c
+index 4bcdeaf8d98f..c44bb37e434c 100644
+--- a/drivers/gpu/drm/i915/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/intel_workarounds.c
+@@ -37,7 +37,7 @@
+ * costly and simplifies things. We can revisit this in the future.
+ *
+ * Layout
+- * ''''''
++ * ~~~~~~
+ *
+ * Keep things in this file ordered by WA type, as per the above (context, GT,
+ * display, register whitelist, batchbuffer). Then, inside each type, keep the
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+index 273cbbe27c2e..1ddf07514de6 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+@@ -503,6 +503,8 @@ static int mdp5_plane_atomic_async_check(struct drm_plane *plane,
+ static void mdp5_plane_atomic_async_update(struct drm_plane *plane,
+ struct drm_plane_state *new_state)
+ {
++ struct drm_framebuffer *old_fb = plane->state->fb;
++
+ plane->state->src_x = new_state->src_x;
+ plane->state->src_y = new_state->src_y;
+ plane->state->crtc_x = new_state->crtc_x;
+@@ -525,6 +527,8 @@ static void mdp5_plane_atomic_async_update(struct drm_plane *plane,
+
+ *to_mdp5_plane_state(plane->state) =
+ *to_mdp5_plane_state(new_state);
++
++ new_state->fb = old_fb;
+ }
+
+ static const struct drm_plane_helper_funcs mdp5_plane_helper_funcs = {
+diff --git a/drivers/gpu/drm/nouveau/Kconfig b/drivers/gpu/drm/nouveau/Kconfig
+index 4b75ad40dd80..00d9d77f583a 100644
+--- a/drivers/gpu/drm/nouveau/Kconfig
++++ b/drivers/gpu/drm/nouveau/Kconfig
+@@ -16,10 +16,21 @@ config DRM_NOUVEAU
+ select INPUT if ACPI && X86
+ select THERMAL if ACPI && X86
+ select ACPI_VIDEO if ACPI && X86
+- select DRM_VM
+ help
+ Choose this option for open-source NVIDIA support.
+
++config NOUVEAU_LEGACY_CTX_SUPPORT
++ bool "Nouveau legacy context support"
++ depends on DRM_NOUVEAU
++ select DRM_VM
++ default y
++ help
++ There was a version of the nouveau DDX that relied on legacy
++ ctx ioctls not erroring out. But that was back in time a long
++ ways, so offer a way to disable it now. For uapi compat with
++ old nouveau ddx this should be on by default, but modern distros
++ should consider turning it off.
++
+ config NOUVEAU_PLATFORM_DRIVER
+ bool "Nouveau (NVIDIA) SoC GPUs"
+ depends on DRM_NOUVEAU && ARCH_TEGRA
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index 74d2283f2c28..2b7a54cc3c9e 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -1015,8 +1015,11 @@ nouveau_driver_fops = {
+ static struct drm_driver
+ driver_stub = {
+ .driver_features =
+- DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_RENDER |
+- DRIVER_KMS_LEGACY_CONTEXT,
++ DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_RENDER
++#if defined(CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT)
++ | DRIVER_KMS_LEGACY_CONTEXT
++#endif
++ ,
+
+ .load = nouveau_drm_load,
+ .unload = nouveau_drm_unload,
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 9d3ac8b981da..d8e2d7b3b836 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -921,12 +921,12 @@ static void avivo_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div,
+ ref_div_max = max(min(100 / post_div, ref_div_max), 1u);
+
+ /* get matching reference and feedback divider */
+- *ref_div = min(max(DIV_ROUND_CLOSEST(den, post_div), 1u), ref_div_max);
++ *ref_div = min(max(den/post_div, 1u), ref_div_max);
+ *fb_div = DIV_ROUND_CLOSEST(nom * *ref_div * post_div, den);
+
+ /* limit fb divider to its maximum */
+ if (*fb_div > fb_div_max) {
+- *ref_div = DIV_ROUND_CLOSEST(*ref_div * fb_div_max, *fb_div);
++ *ref_div = (*ref_div * fb_div_max)/(*fb_div);
+ *fb_div = fb_div_max;
+ }
+ }
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 0c51c0ffdda9..8d6b6eeef71c 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -718,11 +718,16 @@ static const struct i2c_algorithm xiic_algorithm = {
+ .functionality = xiic_func,
+ };
+
++static const struct i2c_adapter_quirks xiic_quirks = {
++ .max_read_len = 255,
++};
++
+ static const struct i2c_adapter xiic_adapter = {
+ .owner = THIS_MODULE,
+ .name = DRIVER_NAME,
+ .class = I2C_CLASS_DEPRECATED,
+ .algo = &xiic_algorithm,
++ .quirks = &xiic_quirks,
+ };
+
+
+diff --git a/drivers/irqchip/irq-ath79-misc.c b/drivers/irqchip/irq-ath79-misc.c
+index 0390603170b4..aa7290784636 100644
+--- a/drivers/irqchip/irq-ath79-misc.c
++++ b/drivers/irqchip/irq-ath79-misc.c
+@@ -22,15 +22,6 @@
+ #define AR71XX_RESET_REG_MISC_INT_ENABLE 4
+
+ #define ATH79_MISC_IRQ_COUNT 32
+-#define ATH79_MISC_PERF_IRQ 5
+-
+-static int ath79_perfcount_irq;
+-
+-int get_c0_perfcount_int(void)
+-{
+- return ath79_perfcount_irq;
+-}
+-EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
+
+ static void ath79_misc_irq_handler(struct irq_desc *desc)
+ {
+@@ -122,8 +113,6 @@ static void __init ath79_misc_intc_domain_init(
+ {
+ void __iomem *base = domain->host_data;
+
+- ath79_perfcount_irq = irq_create_mapping(domain, ATH79_MISC_PERF_IRQ);
+-
+ /* Disable and clear all interrupts */
+ __raw_writel(0, base + AR71XX_RESET_REG_MISC_INT_ENABLE);
+ __raw_writel(0, base + AR71XX_RESET_REG_MISC_INT_STATUS);
+diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c
+index 8c1b63a4337b..d2098b4d2945 100644
+--- a/drivers/misc/genwqe/card_dev.c
++++ b/drivers/misc/genwqe/card_dev.c
+@@ -780,6 +780,8 @@ static int genwqe_pin_mem(struct genwqe_file *cfile, struct genwqe_mem *m)
+
+ if ((m->addr == 0x0) || (m->size == 0))
+ return -EINVAL;
++ if (m->size > ULONG_MAX - PAGE_SIZE - (m->addr & ~PAGE_MASK))
++ return -EINVAL;
+
+ map_addr = (m->addr & PAGE_MASK);
+ map_size = round_up(m->size + (m->addr & ~PAGE_MASK), PAGE_SIZE);
+diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
+index f4f8ab602442..f68435df76d4 100644
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -587,6 +587,10 @@ int genwqe_user_vmap(struct genwqe_dev *cd, struct dma_mapping *m, void *uaddr,
+ /* determine space needed for page_list. */
+ data = (unsigned long)uaddr;
+ offs = offset_in_page(data);
++ if (size > ULONG_MAX - PAGE_SIZE - offs) {
++ m->size = 0; /* mark unused and not added */
++ return -EINVAL;
++ }
+ m->nr_pages = DIV_ROUND_UP(offs + size, PAGE_SIZE);
+
+ m->page_list = kcalloc(m->nr_pages,
+diff --git a/drivers/mtd/nand/spi/macronix.c b/drivers/mtd/nand/spi/macronix.c
+index 98f6b9c4b684..d16b57081c95 100644
+--- a/drivers/mtd/nand/spi/macronix.c
++++ b/drivers/mtd/nand/spi/macronix.c
+@@ -10,6 +10,7 @@
+ #include <linux/mtd/spinand.h>
+
+ #define SPINAND_MFR_MACRONIX 0xC2
++#define MACRONIX_ECCSR_MASK 0x0F
+
+ static SPINAND_OP_VARIANTS(read_cache_variants,
+ SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0),
+@@ -55,7 +56,12 @@ static int mx35lf1ge4ab_get_eccsr(struct spinand_device *spinand, u8 *eccsr)
+ SPI_MEM_OP_DUMMY(1, 1),
+ SPI_MEM_OP_DATA_IN(1, eccsr, 1));
+
+- return spi_mem_exec_op(spinand->spimem, &op);
++ int ret = spi_mem_exec_op(spinand->spimem, &op);
++ if (ret)
++ return ret;
++
++ *eccsr &= MACRONIX_ECCSR_MASK;
++ return 0;
+ }
+
+ static int mx35lf1ge4ab_ecc_get_status(struct spinand_device *spinand,
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 59212d3d9587..df5b74f289e1 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -1310,8 +1310,8 @@ static void mvpp2_ethtool_get_strings(struct net_device *netdev, u32 sset,
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(mvpp2_ethtool_regs); i++)
+- memcpy(data + i * ETH_GSTRING_LEN,
+- &mvpp2_ethtool_regs[i].string, ETH_GSTRING_LEN);
++ strscpy(data + i * ETH_GSTRING_LEN,
++ mvpp2_ethtool_regs[i].string, ETH_GSTRING_LEN);
+ }
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+index d290f0787dfb..94c59939a8cf 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -2010,6 +2010,8 @@ static int mlx4_en_set_tunable(struct net_device *dev,
+ return ret;
+ }
+
++#define MLX4_EEPROM_PAGE_LEN 256
++
+ static int mlx4_en_get_module_info(struct net_device *dev,
+ struct ethtool_modinfo *modinfo)
+ {
+@@ -2044,7 +2046,7 @@ static int mlx4_en_get_module_info(struct net_device *dev,
+ break;
+ case MLX4_MODULE_ID_SFP:
+ modinfo->type = ETH_MODULE_SFF_8472;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
++ modinfo->eeprom_len = MLX4_EEPROM_PAGE_LEN;
+ break;
+ default:
+ return -EINVAL;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
+index 10fcc22f4590..ba6ac31a339d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/port.c
++++ b/drivers/net/ethernet/mellanox/mlx4/port.c
+@@ -2077,11 +2077,6 @@ int mlx4_get_module_info(struct mlx4_dev *dev, u8 port,
+ size -= offset + size - I2C_PAGE_SIZE;
+
+ i2c_addr = I2C_ADDR_LOW;
+- if (offset >= I2C_PAGE_SIZE) {
+- /* Reset offset to high page */
+- i2c_addr = I2C_ADDR_HIGH;
+- offset -= I2C_PAGE_SIZE;
+- }
+
+ cable_info = (struct mlx4_cable_info *)inmad->data;
+ cable_info->dev_mem_address = cpu_to_be16(offset);
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index 832bce07c385..1afed85550c0 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -2978,7 +2978,7 @@ static void cpsw_get_ringparam(struct net_device *ndev,
+ struct cpsw_common *cpsw = priv->cpsw;
+
+ /* not supported */
+- ering->tx_max_pending = 0;
++ ering->tx_max_pending = descs_pool_size - CPSW_MAX_QUEUES;
+ ering->tx_pending = cpdma_get_num_tx_descs(cpsw->dma);
+ ering->rx_max_pending = descs_pool_size - CPSW_MAX_QUEUES;
+ ering->rx_pending = cpdma_get_num_rx_descs(cpsw->dma);
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 68c8fbf099f8..8807a806cc47 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -280,6 +280,7 @@ static int sfp_i2c_read(struct sfp *sfp, bool a2, u8 dev_addr, void *buf,
+ {
+ struct i2c_msg msgs[2];
+ u8 bus_addr = a2 ? 0x51 : 0x50;
++ size_t this_len;
+ int ret;
+
+ msgs[0].addr = bus_addr;
+@@ -291,11 +292,26 @@ static int sfp_i2c_read(struct sfp *sfp, bool a2, u8 dev_addr, void *buf,
+ msgs[1].len = len;
+ msgs[1].buf = buf;
+
+- ret = i2c_transfer(sfp->i2c, msgs, ARRAY_SIZE(msgs));
+- if (ret < 0)
+- return ret;
++ while (len) {
++ this_len = len;
++ if (this_len > 16)
++ this_len = 16;
+
+- return ret == ARRAY_SIZE(msgs) ? len : 0;
++ msgs[1].len = this_len;
++
++ ret = i2c_transfer(sfp->i2c, msgs, ARRAY_SIZE(msgs));
++ if (ret < 0)
++ return ret;
++
++ if (ret != ARRAY_SIZE(msgs))
++ break;
++
++ msgs[1].buf += this_len;
++ dev_addr += this_len;
++ len -= this_len;
++ }
++
++ return msgs[1].buf - (u8 *)buf;
+ }
+
+ static int sfp_i2c_write(struct sfp *sfp, bool a2, u8 dev_addr, void *buf,
+diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
+index 614823617b8b..b7b2e811d547 100644
+--- a/drivers/parisc/ccio-dma.c
++++ b/drivers/parisc/ccio-dma.c
+@@ -565,8 +565,6 @@ ccio_io_pdir_entry(u64 *pdir_ptr, space_t sid, unsigned long vba,
+ /* We currently only support kernel addresses */
+ BUG_ON(sid != KERNEL_SPACE);
+
+- mtsp(sid,1);
+-
+ /*
+ ** WORD 1 - low order word
+ ** "hints" parm includes the VALID bit!
+@@ -597,7 +595,7 @@ ccio_io_pdir_entry(u64 *pdir_ptr, space_t sid, unsigned long vba,
+ ** Grab virtual index [0:11]
+ ** Deposit virt_idx bits into I/O PDIR word
+ */
+- asm volatile ("lci %%r0(%%sr1, %1), %0" : "=r" (ci) : "r" (vba));
++ asm volatile ("lci %%r0(%1), %0" : "=r" (ci) : "r" (vba));
+ asm volatile ("extru %1,19,12,%0" : "+r" (ci) : "r" (ci));
+ asm volatile ("depw %1,15,12,%0" : "+r" (pa) : "r" (ci));
+
+diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
+index 11de0eccf968..6dd1780a5885 100644
+--- a/drivers/parisc/sba_iommu.c
++++ b/drivers/parisc/sba_iommu.c
+@@ -575,8 +575,7 @@ sba_io_pdir_entry(u64 *pdir_ptr, space_t sid, unsigned long vba,
+ pa = virt_to_phys(vba);
+ pa &= IOVP_MASK;
+
+- mtsp(sid,1);
+- asm("lci 0(%%sr1, %1), %0" : "=r" (ci) : "r" (vba));
++ asm("lci 0(%1), %0" : "=r" (ci) : "r" (vba));
+ pa |= (ci >> PAGE_SHIFT) & 0xff; /* move CI (8 bits) into lowest byte */
+
+ pa |= SBA_PDIR_VALID_BIT; /* set "valid" bit */
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index f0b354b65a0e..8dbeb14a1e3a 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -130,9 +130,6 @@ static void uart_start(struct tty_struct *tty)
+ struct uart_port *port;
+ unsigned long flags;
+
+- if (!state)
+- return;
+-
+ port = uart_port_lock(state, flags);
+ __uart_start(tty);
+ uart_port_unlock(port, flags);
+@@ -730,9 +727,6 @@ static void uart_unthrottle(struct tty_struct *tty)
+ upstat_t mask = UPSTAT_SYNC_FIFO;
+ struct uart_port *port;
+
+- if (!state)
+- return;
+-
+ port = uart_port_ref(state);
+ if (!port)
+ return;
+@@ -1708,6 +1702,16 @@ static void uart_dtr_rts(struct tty_port *port, int raise)
+ uart_port_deref(uport);
+ }
+
++static int uart_install(struct tty_driver *driver, struct tty_struct *tty)
++{
++ struct uart_driver *drv = driver->driver_state;
++ struct uart_state *state = drv->state + tty->index;
++
++ tty->driver_data = state;
++
++ return tty_standard_install(driver, tty);
++}
++
+ /*
+ * Calls to uart_open are serialised by the tty_lock in
+ * drivers/tty/tty_io.c:tty_open()
+@@ -1720,11 +1724,8 @@ static void uart_dtr_rts(struct tty_port *port, int raise)
+ */
+ static int uart_open(struct tty_struct *tty, struct file *filp)
+ {
+- struct uart_driver *drv = tty->driver->driver_state;
+- int retval, line = tty->index;
+- struct uart_state *state = drv->state + line;
+-
+- tty->driver_data = state;
++ struct uart_state *state = tty->driver_data;
++ int retval;
+
+ retval = tty_port_open(&state->port, tty, filp);
+ if (retval > 0)
+@@ -2409,6 +2410,7 @@ static void uart_poll_put_char(struct tty_driver *driver, int line, char ch)
+ #endif
+
+ static const struct tty_operations uart_ops = {
++ .install = uart_install,
+ .open = uart_open,
+ .close = uart_close,
+ .write = uart_write,
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 59e8bb72dc14..9a22aa580fe7 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -2981,7 +2981,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
+ offset + length > i_size_read(inode)) {
+ err = inode_newsize_ok(inode, offset + length);
+ if (err)
+- return err;
++ goto out;
+ }
+
+ if (!(mode & FALLOC_FL_KEEP_SIZE))
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 580e37bc3fe2..53cf8599a46e 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -6850,7 +6850,6 @@ struct nfs4_lock_waiter {
+ struct task_struct *task;
+ struct inode *inode;
+ struct nfs_lowner *owner;
+- bool notified;
+ };
+
+ static int
+@@ -6872,13 +6871,13 @@ nfs4_wake_lock_waiter(wait_queue_entry_t *wait, unsigned int mode, int flags, vo
+ /* Make sure it's for the right inode */
+ if (nfs_compare_fh(NFS_FH(waiter->inode), &cbnl->cbnl_fh))
+ return 0;
+-
+- waiter->notified = true;
+ }
+
+ /* override "private" so we can use default_wake_function */
+ wait->private = waiter->task;
+- ret = autoremove_wake_function(wait, mode, flags, key);
++ ret = woken_wake_function(wait, mode, flags, key);
++ if (ret)
++ list_del_init(&wait->entry);
+ wait->private = waiter;
+ return ret;
+ }
+@@ -6887,7 +6886,6 @@ static int
+ nfs4_retry_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
+ {
+ int status = -ERESTARTSYS;
+- unsigned long flags;
+ struct nfs4_lock_state *lsp = request->fl_u.nfs4_fl.owner;
+ struct nfs_server *server = NFS_SERVER(state->inode);
+ struct nfs_client *clp = server->nfs_client;
+@@ -6897,8 +6895,7 @@ nfs4_retry_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
+ .s_dev = server->s_dev };
+ struct nfs4_lock_waiter waiter = { .task = current,
+ .inode = state->inode,
+- .owner = &owner,
+- .notified = false };
++ .owner = &owner};
+ wait_queue_entry_t wait;
+
+ /* Don't bother with waitqueue if we don't expect a callback */
+@@ -6908,27 +6905,22 @@ nfs4_retry_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
+ init_wait(&wait);
+ wait.private = &waiter;
+ wait.func = nfs4_wake_lock_waiter;
+- add_wait_queue(q, &wait);
+
+ while(!signalled()) {
+- waiter.notified = false;
++ add_wait_queue(q, &wait);
+ status = nfs4_proc_setlk(state, cmd, request);
+- if ((status != -EAGAIN) || IS_SETLK(cmd))
++ if ((status != -EAGAIN) || IS_SETLK(cmd)) {
++ finish_wait(q, &wait);
+ break;
+-
+- status = -ERESTARTSYS;
+- spin_lock_irqsave(&q->lock, flags);
+- if (waiter.notified) {
+- spin_unlock_irqrestore(&q->lock, flags);
+- continue;
+ }
+- set_current_state(TASK_INTERRUPTIBLE);
+- spin_unlock_irqrestore(&q->lock, flags);
+
+- freezable_schedule_timeout(NFS4_LOCK_MAXTIMEOUT);
++ status = -ERESTARTSYS;
++ freezer_do_not_count();
++ wait_woken(&wait, TASK_INTERRUPTIBLE, NFS4_LOCK_MAXTIMEOUT);
++ freezer_count();
++ finish_wait(q, &wait);
+ }
+
+- finish_wait(q, &wait);
+ return status;
+ }
+ #else /* !CONFIG_NFS_V4_1 */
+diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
+index b821054ca3ed..4bae3f4fe829 100644
+--- a/fs/pstore/platform.c
++++ b/fs/pstore/platform.c
+@@ -124,26 +124,27 @@ static const char *get_reason_str(enum kmsg_dump_reason reason)
+ }
+ }
+
+-bool pstore_cannot_block_path(enum kmsg_dump_reason reason)
++/*
++ * Should pstore_dump() wait for a concurrent pstore_dump()? If
++ * not, the current pstore_dump() will report a failure to dump
++ * and return.
++ */
++static bool pstore_cannot_wait(enum kmsg_dump_reason reason)
+ {
+- /*
+- * In case of NMI path, pstore shouldn't be blocked
+- * regardless of reason.
+- */
++ /* In NMI path, pstore shouldn't block regardless of reason. */
+ if (in_nmi())
+ return true;
+
+ switch (reason) {
+ /* In panic case, other cpus are stopped by smp_send_stop(). */
+ case KMSG_DUMP_PANIC:
+- /* Emergency restart shouldn't be blocked by spin lock. */
++ /* Emergency restart shouldn't be blocked. */
+ case KMSG_DUMP_EMERG:
+ return true;
+ default:
+ return false;
+ }
+ }
+-EXPORT_SYMBOL_GPL(pstore_cannot_block_path);
+
+ #if IS_ENABLED(CONFIG_PSTORE_DEFLATE_COMPRESS)
+ static int zbufsize_deflate(size_t size)
+@@ -323,8 +324,10 @@ static void allocate_buf_for_compression(void)
+
+ static void free_buf_for_compression(void)
+ {
+- if (IS_ENABLED(CONFIG_PSTORE_COMPRESS) && tfm)
++ if (IS_ENABLED(CONFIG_PSTORE_COMPRESS) && tfm) {
+ crypto_free_comp(tfm);
++ tfm = NULL;
++ }
+ kfree(big_oops_buf);
+ big_oops_buf = NULL;
+ big_oops_buf_sz = 0;
+@@ -378,23 +381,23 @@ static void pstore_dump(struct kmsg_dumper *dumper,
+ unsigned long total = 0;
+ const char *why;
+ unsigned int part = 1;
+- unsigned long flags = 0;
+- int is_locked;
+ int ret;
+
+ why = get_reason_str(reason);
+
+- if (pstore_cannot_block_path(reason)) {
+- is_locked = spin_trylock_irqsave(&psinfo->buf_lock, flags);
+- if (!is_locked) {
+- pr_err("pstore dump routine blocked in %s path, may corrupt error record\n"
+- , in_nmi() ? "NMI" : why);
++ if (down_trylock(&psinfo->buf_lock)) {
++ /* Failed to acquire lock: give up if we cannot wait. */
++ if (pstore_cannot_wait(reason)) {
++ pr_err("dump skipped in %s path: may corrupt error record\n",
++ in_nmi() ? "NMI" : why);
++ return;
++ }
++ if (down_interruptible(&psinfo->buf_lock)) {
++ pr_err("could not grab semaphore?!\n");
+ return;
+ }
+- } else {
+- spin_lock_irqsave(&psinfo->buf_lock, flags);
+- is_locked = 1;
+ }
++
+ oopscount++;
+ while (total < kmsg_bytes) {
+ char *dst;
+@@ -411,7 +414,7 @@ static void pstore_dump(struct kmsg_dumper *dumper,
+ record.part = part;
+ record.buf = psinfo->buf;
+
+- if (big_oops_buf && is_locked) {
++ if (big_oops_buf) {
+ dst = big_oops_buf;
+ dst_size = big_oops_buf_sz;
+ } else {
+@@ -429,7 +432,7 @@ static void pstore_dump(struct kmsg_dumper *dumper,
+ dst_size, &dump_size))
+ break;
+
+- if (big_oops_buf && is_locked) {
++ if (big_oops_buf) {
+ zipped_len = pstore_compress(dst, psinfo->buf,
+ header_size + dump_size,
+ psinfo->bufsize);
+@@ -452,8 +455,8 @@ static void pstore_dump(struct kmsg_dumper *dumper,
+ total += record.size;
+ part++;
+ }
+- if (is_locked)
+- spin_unlock_irqrestore(&psinfo->buf_lock, flags);
++
++ up(&psinfo->buf_lock);
+ }
+
+ static struct kmsg_dumper pstore_dumper = {
+@@ -476,31 +479,14 @@ static void pstore_unregister_kmsg(void)
+ #ifdef CONFIG_PSTORE_CONSOLE
+ static void pstore_console_write(struct console *con, const char *s, unsigned c)
+ {
+- const char *e = s + c;
++ struct pstore_record record;
+
+- while (s < e) {
+- struct pstore_record record;
+- unsigned long flags;
+-
+- pstore_record_init(&record, psinfo);
+- record.type = PSTORE_TYPE_CONSOLE;
++ pstore_record_init(&record, psinfo);
++ record.type = PSTORE_TYPE_CONSOLE;
+
+- if (c > psinfo->bufsize)
+- c = psinfo->bufsize;
+-
+- if (oops_in_progress) {
+- if (!spin_trylock_irqsave(&psinfo->buf_lock, flags))
+- break;
+- } else {
+- spin_lock_irqsave(&psinfo->buf_lock, flags);
+- }
+- record.buf = (char *)s;
+- record.size = c;
+- psinfo->write(&record);
+- spin_unlock_irqrestore(&psinfo->buf_lock, flags);
+- s += c;
+- c = e - s;
+- }
++ record.buf = (char *)s;
++ record.size = c;
++ psinfo->write(&record);
+ }
+
+ static struct console pstore_console = {
+@@ -589,6 +575,7 @@ int pstore_register(struct pstore_info *psi)
+ psi->write_user = pstore_write_user_compat;
+ psinfo = psi;
+ mutex_init(&psinfo->read_mutex);
++ sema_init(&psinfo->buf_lock, 1);
+ spin_unlock(&pstore_lock);
+
+ if (owner && !try_module_get(owner)) {
+@@ -596,7 +583,8 @@ int pstore_register(struct pstore_info *psi)
+ return -EINVAL;
+ }
+
+- allocate_buf_for_compression();
++ if (psi->flags & PSTORE_FLAGS_DMESG)
++ allocate_buf_for_compression();
+
+ if (pstore_is_mounted())
+ pstore_get_records(0);
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 44ed6b193d2e..316c16463b20 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -803,27 +803,36 @@ static int ramoops_probe(struct platform_device *pdev)
+
+ cxt->pstore.data = cxt;
+ /*
+- * Since bufsize is only used for dmesg crash dumps, it
+- * must match the size of the dprz record (after PRZ header
+- * and ECC bytes have been accounted for).
++ * Prepare frontend flags based on which areas are initialized.
++ * For ramoops_init_przs() cases, the "max count" variable tells
++ * if there are regions present. For ramoops_init_prz() cases,
++ * the single region size is how to check.
+ */
+- cxt->pstore.bufsize = cxt->dprzs[0]->buffer_size;
+- cxt->pstore.buf = kzalloc(cxt->pstore.bufsize, GFP_KERNEL);
+- if (!cxt->pstore.buf) {
+- pr_err("cannot allocate pstore crash dump buffer\n");
+- err = -ENOMEM;
+- goto fail_clear;
+- }
+- spin_lock_init(&cxt->pstore.buf_lock);
+-
+- cxt->pstore.flags = PSTORE_FLAGS_DMESG;
++ cxt->pstore.flags = 0;
++ if (cxt->max_dump_cnt)
++ cxt->pstore.flags |= PSTORE_FLAGS_DMESG;
+ if (cxt->console_size)
+ cxt->pstore.flags |= PSTORE_FLAGS_CONSOLE;
+- if (cxt->ftrace_size)
++ if (cxt->max_ftrace_cnt)
+ cxt->pstore.flags |= PSTORE_FLAGS_FTRACE;
+ if (cxt->pmsg_size)
+ cxt->pstore.flags |= PSTORE_FLAGS_PMSG;
+
++ /*
++ * Since bufsize is only used for dmesg crash dumps, it
++ * must match the size of the dprz record (after PRZ header
++ * and ECC bytes have been accounted for).
++ */
++ if (cxt->pstore.flags & PSTORE_FLAGS_DMESG) {
++ cxt->pstore.bufsize = cxt->dprzs[0]->buffer_size;
++ cxt->pstore.buf = kzalloc(cxt->pstore.bufsize, GFP_KERNEL);
++ if (!cxt->pstore.buf) {
++ pr_err("cannot allocate pstore crash dump buffer\n");
++ err = -ENOMEM;
++ goto fail_clear;
++ }
++ }
++
+ err = pstore_register(&cxt->pstore);
+ if (err) {
+ pr_err("registering with pstore failed\n");
+diff --git a/include/drm/drm_modeset_helper_vtables.h b/include/drm/drm_modeset_helper_vtables.h
+index 61142aa0ab23..0eb3372d0311 100644
+--- a/include/drm/drm_modeset_helper_vtables.h
++++ b/include/drm/drm_modeset_helper_vtables.h
+@@ -1174,6 +1174,14 @@ struct drm_plane_helper_funcs {
+ * current one with the new plane configurations in the new
+ * plane_state.
+ *
++ * Drivers should also swap the framebuffers between current plane
++ * state (&drm_plane.state) and new_state.
++ * This is required since cleanup for async commits is performed on
++ * the new state, rather than old state like for traditional commits.
++ * Since we want to give up the reference on the current (old) fb
++ * instead of our brand new one, swap them in the driver during the
++ * async commit.
++ *
+ * FIXME:
+ * - It only works for single plane updates
+ * - Async Pageflips are not supported yet
+diff --git a/include/linux/cpu.h b/include/linux/cpu.h
+index 57ae83c4d5f4..006f69f9277b 100644
+--- a/include/linux/cpu.h
++++ b/include/linux/cpu.h
+@@ -183,10 +183,14 @@ enum cpuhp_smt_control {
+ extern enum cpuhp_smt_control cpu_smt_control;
+ extern void cpu_smt_disable(bool force);
+ extern void cpu_smt_check_topology(void);
++extern int cpuhp_smt_enable(void);
++extern int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval);
+ #else
+ # define cpu_smt_control (CPU_SMT_ENABLED)
+ static inline void cpu_smt_disable(bool force) { }
+ static inline void cpu_smt_check_topology(void) { }
++static inline int cpuhp_smt_enable(void) { return 0; }
++static inline int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval) { return 0; }
+ #endif
+
+ /*
+diff --git a/include/linux/pstore.h b/include/linux/pstore.h
+index 30fcec375a3a..de9093d6e660 100644
+--- a/include/linux/pstore.h
++++ b/include/linux/pstore.h
+@@ -26,7 +26,7 @@
+ #include <linux/errno.h>
+ #include <linux/kmsg_dump.h>
+ #include <linux/mutex.h>
+-#include <linux/spinlock.h>
++#include <linux/semaphore.h>
+ #include <linux/time.h>
+ #include <linux/types.h>
+
+@@ -88,7 +88,7 @@ struct pstore_record {
+ * @owner: module which is repsonsible for this backend driver
+ * @name: name of the backend driver
+ *
+- * @buf_lock: spinlock to serialize access to @buf
++ * @buf_lock: semaphore to serialize access to @buf
+ * @buf: preallocated crash dump buffer
+ * @bufsize: size of @buf available for crash dump bytes (must match
+ * smallest number of bytes available for writing to a
+@@ -173,7 +173,7 @@ struct pstore_info {
+ struct module *owner;
+ char *name;
+
+- spinlock_t buf_lock;
++ struct semaphore buf_lock;
+ char *buf;
+ size_t bufsize;
+
+@@ -199,7 +199,6 @@ struct pstore_info {
+
+ extern int pstore_register(struct pstore_info *);
+ extern void pstore_unregister(struct pstore_info *);
+-extern bool pstore_cannot_block_path(enum kmsg_dump_reason reason);
+
+ struct pstore_ftrace_record {
+ unsigned long ip;
+diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
+index 75e5b393cf44..e102c5bccbb9 100644
+--- a/include/linux/rcupdate.h
++++ b/include/linux/rcupdate.h
+@@ -78,14 +78,12 @@ void synchronize_rcu(void);
+
+ static inline void __rcu_read_lock(void)
+ {
+- if (IS_ENABLED(CONFIG_PREEMPT_COUNT))
+- preempt_disable();
++ preempt_disable();
+ }
+
+ static inline void __rcu_read_unlock(void)
+ {
+- if (IS_ENABLED(CONFIG_PREEMPT_COUNT))
+- preempt_enable();
++ preempt_enable();
+ }
+
+ static inline void synchronize_rcu(void)
+diff --git a/include/net/arp.h b/include/net/arp.h
+index 977aabfcdc03..c8f580a0e6b1 100644
+--- a/include/net/arp.h
++++ b/include/net/arp.h
+@@ -18,6 +18,7 @@ static inline u32 arp_hashfn(const void *pkey, const struct net_device *dev, u32
+ return val * hash_rnd[0];
+ }
+
++#ifdef CONFIG_INET
+ static inline struct neighbour *__ipv4_neigh_lookup_noref(struct net_device *dev, u32 key)
+ {
+ if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
+@@ -25,6 +26,13 @@ static inline struct neighbour *__ipv4_neigh_lookup_noref(struct net_device *dev
+
+ return ___neigh_lookup_noref(&arp_tbl, neigh_key_eq32, arp_hashfn, &key, dev);
+ }
++#else
++static inline
++struct neighbour *__ipv4_neigh_lookup_noref(struct net_device *dev, u32 key)
++{
++ return NULL;
++}
++#endif
+
+ static inline struct neighbour *__ipv4_neigh_lookup(struct net_device *dev, u32 key)
+ {
+diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
+index 983f7a1a3f1d..62c936230cc8 100644
+--- a/include/net/ip6_fib.h
++++ b/include/net/ip6_fib.h
+@@ -260,8 +260,7 @@ static inline u32 rt6_get_cookie(const struct rt6_info *rt)
+ rcu_read_lock();
+
+ from = rcu_dereference(rt->from);
+- if (from && (rt->rt6i_flags & RTF_PCPU ||
+- unlikely(!list_empty(&rt->rt6i_uncached))))
++ if (from)
+ fib6_get_cookie_safe(from, &cookie);
+
+ rcu_read_unlock();
+diff --git a/include/net/tls.h b/include/net/tls.h
+index c423b7d0b6ab..954110575891 100644
+--- a/include/net/tls.h
++++ b/include/net/tls.h
+@@ -161,6 +161,10 @@ enum {
+ TLS_PENDING_CLOSED_RECORD
+ };
+
++enum tls_context_flags {
++ TLS_RX_SYNC_RUNNING = 0,
++};
++
+ struct cipher_context {
+ u16 prepend_size;
+ u16 tag_size;
+diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h
+index 7f5634ce8e88..4671c9150d4d 100644
+--- a/include/uapi/drm/i915_drm.h
++++ b/include/uapi/drm/i915_drm.h
+@@ -942,7 +942,7 @@ struct drm_i915_gem_execbuffer2 {
+ * struct drm_i915_gem_exec_fence *fences.
+ */
+ __u64 cliprects_ptr;
+-#define I915_EXEC_RING_MASK (7<<0)
++#define I915_EXEC_RING_MASK (0x3f)
+ #define I915_EXEC_DEFAULT (0<<0)
+ #define I915_EXEC_RENDER (1<<0)
+ #define I915_EXEC_BSD (2<<0)
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index bc6c880a093f..5d65eae893bd 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2035,7 +2035,7 @@ static void cpuhp_online_cpu_device(unsigned int cpu)
+ kobject_uevent(&dev->kobj, KOBJ_ONLINE);
+ }
+
+-static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
++int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ {
+ int cpu, ret = 0;
+
+@@ -2069,7 +2069,7 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ return ret;
+ }
+
+-static int cpuhp_smt_enable(void)
++int cpuhp_smt_enable(void)
+ {
+ int cpu, ret = 0;
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index abef759de7c8..f5ce9f7ec132 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -258,6 +258,11 @@ void swsusp_show_speed(ktime_t start, ktime_t stop,
+ (kps % 1000) / 10);
+ }
+
++__weak int arch_resume_nosmt(void)
++{
++ return 0;
++}
++
+ /**
+ * create_image - Create a hibernation image.
+ * @platform_mode: Whether or not to use the platform driver.
+@@ -325,6 +330,10 @@ static int create_image(int platform_mode)
+ Enable_cpus:
+ enable_nonboot_cpus();
+
++ /* Allow architectures to do nosmt-specific post-resume dances */
++ if (!in_suspend)
++ error = arch_resume_nosmt();
++
+ Platform_finish:
+ platform_finish(platform_mode);
+
+diff --git a/lib/test_firmware.c b/lib/test_firmware.c
+index 7cab9a9869ac..fd48a15a0710 100644
+--- a/lib/test_firmware.c
++++ b/lib/test_firmware.c
+@@ -223,30 +223,30 @@ static ssize_t config_show(struct device *dev,
+
+ mutex_lock(&test_fw_mutex);
+
+- len += snprintf(buf, PAGE_SIZE,
++ len += scnprintf(buf, PAGE_SIZE - len,
+ "Custom trigger configuration for: %s\n",
+ dev_name(dev));
+
+ if (test_fw_config->name)
+- len += snprintf(buf+len, PAGE_SIZE,
++ len += scnprintf(buf+len, PAGE_SIZE - len,
+ "name:\t%s\n",
+ test_fw_config->name);
+ else
+- len += snprintf(buf+len, PAGE_SIZE,
++ len += scnprintf(buf+len, PAGE_SIZE - len,
+ "name:\tEMTPY\n");
+
+- len += snprintf(buf+len, PAGE_SIZE,
++ len += scnprintf(buf+len, PAGE_SIZE - len,
+ "num_requests:\t%u\n", test_fw_config->num_requests);
+
+- len += snprintf(buf+len, PAGE_SIZE,
++ len += scnprintf(buf+len, PAGE_SIZE - len,
+ "send_uevent:\t\t%s\n",
+ test_fw_config->send_uevent ?
+ "FW_ACTION_HOTPLUG" :
+ "FW_ACTION_NOHOTPLUG");
+- len += snprintf(buf+len, PAGE_SIZE,
++ len += scnprintf(buf+len, PAGE_SIZE - len,
+ "sync_direct:\t\t%s\n",
+ test_fw_config->sync_direct ? "true" : "false");
+- len += snprintf(buf+len, PAGE_SIZE,
++ len += scnprintf(buf+len, PAGE_SIZE - len,
+ "read_fw_idx:\t%u\n", test_fw_config->read_fw_idx);
+
+ mutex_unlock(&test_fw_mutex);
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 7cc97f43f138..996813f345d5 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -880,8 +880,13 @@ static noinline_for_stack int ethtool_get_drvinfo(struct net_device *dev,
+ if (rc >= 0)
+ info.n_priv_flags = rc;
+ }
+- if (ops->get_regs_len)
+- info.regdump_len = ops->get_regs_len(dev);
++ if (ops->get_regs_len) {
++ int ret = ops->get_regs_len(dev);
++
++ if (ret > 0)
++ info.regdump_len = ret;
++ }
++
+ if (ops->get_eeprom_len)
+ info.eedump_len = ops->get_eeprom_len(dev);
+
+@@ -1424,6 +1429,9 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
+ return -EFAULT;
+
+ reglen = ops->get_regs_len(dev);
++ if (reglen <= 0)
++ return reglen;
++
+ if (regs.len > reglen)
+ regs.len = reglen;
+
+@@ -1434,13 +1442,16 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
+ return -ENOMEM;
+ }
+
++ if (regs.len < reglen)
++ reglen = regs.len;
++
+ ops->get_regs(dev, ®s, regbuf);
+
+ ret = -EFAULT;
+ if (copy_to_user(useraddr, ®s, sizeof(regs)))
+ goto out;
+ useraddr += offsetof(struct ethtool_regs, data);
+- if (regbuf && copy_to_user(useraddr, regbuf, regs.len))
++ if (copy_to_user(useraddr, regbuf, reglen))
+ goto out;
+ ret = 0;
+
+diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
+index 338147b14d0e..0ff3953f64aa 100644
+--- a/net/core/fib_rules.c
++++ b/net/core/fib_rules.c
+@@ -756,9 +756,9 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (err)
+ goto errout;
+
+- if (rule_exists(ops, frh, tb, rule)) {
+- if (nlh->nlmsg_flags & NLM_F_EXCL)
+- err = -EEXIST;
++ if ((nlh->nlmsg_flags & NLM_F_EXCL) &&
++ rule_exists(ops, frh, tb, rule)) {
++ err = -EEXIST;
+ goto errout_free;
+ }
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 4e07824eec5e..4e4ac77c6816 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -30,6 +30,7 @@
+ #include <linux/times.h>
+ #include <net/net_namespace.h>
+ #include <net/neighbour.h>
++#include <net/arp.h>
+ #include <net/dst.h>
+ #include <net/sock.h>
+ #include <net/netevent.h>
+@@ -2536,7 +2537,13 @@ int neigh_xmit(int index, struct net_device *dev,
+ if (!tbl)
+ goto out;
+ rcu_read_lock_bh();
+- neigh = __neigh_lookup_noref(tbl, addr, dev);
++ if (index == NEIGH_ARP_TABLE) {
++ u32 key = *((u32 *)addr);
++
++ neigh = __ipv4_neigh_lookup_noref(dev, key);
++ } else {
++ neigh = __neigh_lookup_noref(tbl, addr, dev);
++ }
+ if (!neigh)
+ neigh = __neigh_create(tbl, addr, dev, false);
+ err = PTR_ERR(neigh);
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 7f6938405fa1..092fa3d75b32 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -3065,7 +3065,13 @@ static int pktgen_wait_thread_run(struct pktgen_thread *t)
+ {
+ while (thread_is_running(t)) {
+
++ /* note: 't' will still be around even after the unlock/lock
++ * cycle because pktgen_thread threads are only cleared at
++ * net exit
++ */
++ mutex_unlock(&pktgen_thread_lock);
+ msleep_interruptible(100);
++ mutex_lock(&pktgen_thread_lock);
+
+ if (signal_pending(current))
+ goto signal;
+@@ -3080,6 +3086,10 @@ static int pktgen_wait_all_threads_run(struct pktgen_net *pn)
+ struct pktgen_thread *t;
+ int sig = 1;
+
++ /* prevent from racing with rmmod */
++ if (!try_module_get(THIS_MODULE))
++ return sig;
++
+ mutex_lock(&pktgen_thread_lock);
+
+ list_for_each_entry(t, &pn->pktgen_threads, th_list) {
+@@ -3093,6 +3103,7 @@ static int pktgen_wait_all_threads_run(struct pktgen_net *pn)
+ t->control |= (T_STOP);
+
+ mutex_unlock(&pktgen_thread_lock);
++ module_put(THIS_MODULE);
+ return sig;
+ }
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 40bf19f7ae1a..232581c140a0 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1960,7 +1960,7 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ u32 itag = 0;
+ struct rtable *rth;
+ struct flowi4 fl4;
+- bool do_cache;
++ bool do_cache = true;
+
+ /* IP on this device is disabled. */
+
+@@ -2037,6 +2037,9 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ if (res->type == RTN_BROADCAST) {
+ if (IN_DEV_BFORWARD(in_dev))
+ goto make_route;
++ /* not do cache if bc_forwarding is enabled */
++ if (IPV4_DEVCONF_ALL(net, BC_FORWARDING))
++ do_cache = false;
+ goto brd_input;
+ }
+
+@@ -2074,16 +2077,13 @@ brd_input:
+ RT_CACHE_STAT_INC(in_brd);
+
+ local_input:
+- do_cache = false;
+- if (res->fi) {
+- if (!itag) {
+- rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
+- if (rt_cache_valid(rth)) {
+- skb_dst_set_noref(skb, &rth->dst);
+- err = 0;
+- goto out;
+- }
+- do_cache = true;
++ do_cache &= res->fi && !itag;
++ if (do_cache) {
++ rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
++ if (rt_cache_valid(rth)) {
++ skb_dst_set_noref(skb, &rth->dst);
++ err = 0;
++ goto out;
+ }
+ }
+
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 5833d4af7311..4856d9320b28 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -782,6 +782,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ struct flowi6 fl6;
+ struct ipcm6_cookie ipc6;
+ int addr_len = msg->msg_namelen;
++ int hdrincl;
+ u16 proto;
+ int err;
+
+@@ -795,6 +796,13 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ if (msg->msg_flags & MSG_OOB)
+ return -EOPNOTSUPP;
+
++ /* hdrincl should be READ_ONCE(inet->hdrincl)
++ * but READ_ONCE() doesn't work with bit fields.
++ * Doing this indirectly yields the same result.
++ */
++ hdrincl = inet->hdrincl;
++ hdrincl = READ_ONCE(hdrincl);
++
+ /*
+ * Get and verify the address.
+ */
+@@ -886,11 +894,14 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ opt = ipv6_fixup_options(&opt_space, opt);
+
+ fl6.flowi6_proto = proto;
+- rfv.msg = msg;
+- rfv.hlen = 0;
+- err = rawv6_probe_proto_opt(&rfv, &fl6);
+- if (err)
+- goto out;
++
++ if (!hdrincl) {
++ rfv.msg = msg;
++ rfv.hlen = 0;
++ err = rawv6_probe_proto_opt(&rfv, &fl6);
++ if (err)
++ goto out;
++ }
+
+ if (!ipv6_addr_any(daddr))
+ fl6.daddr = *daddr;
+@@ -907,7 +918,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ fl6.flowi6_oif = np->ucast_oif;
+ security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+
+- if (inet->hdrincl)
++ if (hdrincl)
+ fl6.flowi6_flags |= FLOWI_FLAG_KNOWN_NH;
+
+ if (ipc6.tclass < 0)
+@@ -930,7 +941,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ goto do_confirm;
+
+ back_from_confirm:
+- if (inet->hdrincl)
++ if (hdrincl)
+ err = rawv6_send_hdrinc(sk, msg, len, &fl6, &dst,
+ msg->msg_flags, &ipc6.sockc);
+ else {
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 18df3bce73da..d98fcf926166 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3017,8 +3017,8 @@ static int packet_release(struct socket *sock)
+
+ synchronize_net();
+
++ kfree(po->rollover);
+ if (f) {
+- kfree(po->rollover);
+ fanout_release_data(f);
+ kfree(f);
+ }
+diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
+index d664e9ade74d..0b347f46b2f4 100644
+--- a/net/rds/ib_rdma.c
++++ b/net/rds/ib_rdma.c
+@@ -428,12 +428,14 @@ int rds_ib_flush_mr_pool(struct rds_ib_mr_pool *pool,
+ wait_clean_list_grace();
+
+ list_to_llist_nodes(pool, &unmap_list, &clean_nodes, &clean_tail);
+- if (ibmr_ret)
++ if (ibmr_ret) {
+ *ibmr_ret = llist_entry(clean_nodes, struct rds_ib_mr, llnode);
+-
++ clean_nodes = clean_nodes->next;
++ }
+ /* more than one entry in llist nodes */
+- if (clean_nodes->next)
+- llist_add_batch(clean_nodes->next, clean_tail, &pool->clean_list);
++ if (clean_nodes)
++ llist_add_batch(clean_nodes, clean_tail,
++ &pool->clean_list);
+
+ }
+
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index d05c57664e36..ae65a1cfa596 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -2329,7 +2329,6 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
+ union sctp_addr addr;
+ struct sctp_af *af;
+ int src_match = 0;
+- char *cookie;
+
+ /* We must include the address that the INIT packet came from.
+ * This is the only address that matters for an INIT packet.
+@@ -2433,14 +2432,6 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
+ /* Peer Rwnd : Current calculated value of the peer's rwnd. */
+ asoc->peer.rwnd = asoc->peer.i.a_rwnd;
+
+- /* Copy cookie in case we need to resend COOKIE-ECHO. */
+- cookie = asoc->peer.cookie;
+- if (cookie) {
+- asoc->peer.cookie = kmemdup(cookie, asoc->peer.cookie_len, gfp);
+- if (!asoc->peer.cookie)
+- goto clean_up;
+- }
+-
+ /* RFC 2960 7.2.1 The initial value of ssthresh MAY be arbitrarily
+ * high (for example, implementations MAY use the size of the receiver
+ * advertised window).
+@@ -2609,7 +2600,9 @@ do_addr_param:
+ case SCTP_PARAM_STATE_COOKIE:
+ asoc->peer.cookie_len =
+ ntohs(param.p->length) - sizeof(struct sctp_paramhdr);
+- asoc->peer.cookie = param.cookie->body;
++ asoc->peer.cookie = kmemdup(param.cookie->body, asoc->peer.cookie_len, gfp);
++ if (!asoc->peer.cookie)
++ retval = 0;
+ break;
+
+ case SCTP_PARAM_HEARTBEAT_INFO:
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 48fe8f01265f..3131b4154c74 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -898,6 +898,11 @@ static void sctp_cmd_new_state(struct sctp_cmd_seq *cmds,
+ asoc->rto_initial;
+ }
+
++ if (sctp_state(asoc, ESTABLISHED)) {
++ kfree(asoc->peer.cookie);
++ asoc->peer.cookie = NULL;
++ }
++
+ if (sctp_state(asoc, ESTABLISHED) ||
+ sctp_state(asoc, CLOSED) ||
+ sctp_state(asoc, SHUTDOWN_RECEIVED)) {
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index 8035bf495eb2..ead29c2aefa7 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -545,10 +545,22 @@ static int tls_device_push_pending_record(struct sock *sk, int flags)
+ return tls_push_data(sk, &msg_iter, 0, flags, TLS_RECORD_TYPE_DATA);
+ }
+
++static void tls_device_resync_rx(struct tls_context *tls_ctx,
++ struct sock *sk, u32 seq, u64 rcd_sn)
++{
++ struct net_device *netdev;
++
++ if (WARN_ON(test_and_set_bit(TLS_RX_SYNC_RUNNING, &tls_ctx->flags)))
++ return;
++ netdev = READ_ONCE(tls_ctx->netdev);
++ if (netdev)
++ netdev->tlsdev_ops->tls_dev_resync_rx(netdev, sk, seq, rcd_sn);
++ clear_bit_unlock(TLS_RX_SYNC_RUNNING, &tls_ctx->flags);
++}
++
+ void handle_device_resync(struct sock *sk, u32 seq, u64 rcd_sn)
+ {
+ struct tls_context *tls_ctx = tls_get_ctx(sk);
+- struct net_device *netdev = tls_ctx->netdev;
+ struct tls_offload_context_rx *rx_ctx;
+ u32 is_req_pending;
+ s64 resync_req;
+@@ -563,10 +575,10 @@ void handle_device_resync(struct sock *sk, u32 seq, u64 rcd_sn)
+ is_req_pending = resync_req;
+
+ if (unlikely(is_req_pending) && req_seq == seq &&
+- atomic64_try_cmpxchg(&rx_ctx->resync_req, &resync_req, 0))
+- netdev->tlsdev_ops->tls_dev_resync_rx(netdev, sk,
+- seq + TLS_HEADER_SIZE - 1,
+- rcd_sn);
++ atomic64_try_cmpxchg(&rx_ctx->resync_req, &resync_req, 0)) {
++ seq += TLS_HEADER_SIZE - 1;
++ tls_device_resync_rx(tls_ctx, sk, seq, rcd_sn);
++ }
+ }
+
+ static int tls_device_reencrypt(struct sock *sk, struct sk_buff *skb)
+@@ -954,7 +966,10 @@ static int tls_device_down(struct net_device *netdev)
+ if (ctx->rx_conf == TLS_HW)
+ netdev->tlsdev_ops->tls_dev_del(netdev, ctx,
+ TLS_OFFLOAD_CTX_DIR_RX);
+- ctx->netdev = NULL;
++ WRITE_ONCE(ctx->netdev, NULL);
++ smp_mb__before_atomic(); /* pairs with test_and_set_bit() */
++ while (test_bit(TLS_RX_SYNC_RUNNING, &ctx->flags))
++ usleep_range(10, 200);
+ dev_put(netdev);
+ list_del_init(&ctx->list);
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-06-15 15:07 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-06-15 15:07 UTC (permalink / raw
To: gentoo-commits
commit: 868863fa3b01b3d0e5bc4bd44d8bbf00ed6a5e95
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Jun 15 15:06:56 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Jun 15 15:06:56 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=868863fa
Linux patch 4.19.51
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1050_linux-4.19.51.patch | 3093 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3097 insertions(+)
diff --git a/0000_README b/0000_README
index 9cf9325..5b58ca2 100644
--- a/0000_README
+++ b/0000_README
@@ -243,6 +243,10 @@ Patch: 1049_linux-4.19.50.patch
From: http://www.kernel.org
Desc: Linux 4.19.50
+Patch: 1050_linux-4.19.51.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.51
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1050_linux-4.19.51.patch b/1050_linux-4.19.51.patch
new file mode 100644
index 0000000..f589a82
--- /dev/null
+++ b/1050_linux-4.19.51.patch
@@ -0,0 +1,3093 @@
+diff --git a/Makefile b/Makefile
+index f7e7e365e2ff..dd4be2f32b88 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 50
++SUBLEVEL = 51
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+index cdda614e417e..a370857beac0 100644
+--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts
++++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+@@ -106,6 +106,7 @@
+ regulator-name = "PVDD_APIO_1V8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ };
+
+ ldo3_reg: LDO3 {
+@@ -144,6 +145,7 @@
+ regulator-name = "PVDD_ABB_1V8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ };
+
+ ldo9_reg: LDO9 {
+diff --git a/arch/arm/boot/dts/imx50.dtsi b/arch/arm/boot/dts/imx50.dtsi
+index 7fae2ffb76fe..ab522c2da6df 100644
+--- a/arch/arm/boot/dts/imx50.dtsi
++++ b/arch/arm/boot/dts/imx50.dtsi
+@@ -420,7 +420,7 @@
+ reg = <0x63fb0000 0x4000>;
+ interrupts = <6>;
+ clocks = <&clks IMX5_CLK_SDMA_GATE>,
+- <&clks IMX5_CLK_SDMA_GATE>;
++ <&clks IMX5_CLK_AHB>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+ fsl,sdma-ram-script-name = "imx/sdma/sdma-imx50.bin";
+diff --git a/arch/arm/boot/dts/imx51.dtsi b/arch/arm/boot/dts/imx51.dtsi
+index 5c4ba91e43ba..ef2abc097843 100644
+--- a/arch/arm/boot/dts/imx51.dtsi
++++ b/arch/arm/boot/dts/imx51.dtsi
+@@ -481,7 +481,7 @@
+ reg = <0x83fb0000 0x4000>;
+ interrupts = <6>;
+ clocks = <&clks IMX5_CLK_SDMA_GATE>,
+- <&clks IMX5_CLK_SDMA_GATE>;
++ <&clks IMX5_CLK_AHB>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+ fsl,sdma-ram-script-name = "imx/sdma/sdma-imx51.bin";
+diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
+index 6386185ae234..b6b0818343c4 100644
+--- a/arch/arm/boot/dts/imx53.dtsi
++++ b/arch/arm/boot/dts/imx53.dtsi
+@@ -701,7 +701,7 @@
+ reg = <0x63fb0000 0x4000>;
+ interrupts = <6>;
+ clocks = <&clks IMX5_CLK_SDMA_GATE>,
+- <&clks IMX5_CLK_SDMA_GATE>;
++ <&clks IMX5_CLK_AHB>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+ fsl,sdma-ram-script-name = "imx/sdma/sdma-imx53.bin";
+diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
+index 61d2d26afbf4..00d44a60972f 100644
+--- a/arch/arm/boot/dts/imx6qdl.dtsi
++++ b/arch/arm/boot/dts/imx6qdl.dtsi
+@@ -905,7 +905,7 @@
+ compatible = "fsl,imx6q-sdma", "fsl,imx35-sdma";
+ reg = <0x020ec000 0x4000>;
+ interrupts = <0 2 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX6QDL_CLK_SDMA>,
++ clocks = <&clks IMX6QDL_CLK_IPG>,
+ <&clks IMX6QDL_CLK_SDMA>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
+index 7a4f5dace902..2fa88c6f1882 100644
+--- a/arch/arm/boot/dts/imx6sl.dtsi
++++ b/arch/arm/boot/dts/imx6sl.dtsi
+@@ -739,7 +739,7 @@
+ reg = <0x020ec000 0x4000>;
+ interrupts = <0 2 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX6SL_CLK_SDMA>,
+- <&clks IMX6SL_CLK_SDMA>;
++ <&clks IMX6SL_CLK_AHB>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+ /* imx6sl reuses imx6q sdma firmware */
+diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi
+index 3e6ffaf5f104..7c7d5c47578e 100644
+--- a/arch/arm/boot/dts/imx6sll.dtsi
++++ b/arch/arm/boot/dts/imx6sll.dtsi
+@@ -591,7 +591,7 @@
+ compatible = "fsl,imx6sll-sdma", "fsl,imx35-sdma";
+ reg = <0x020ec000 0x4000>;
+ interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX6SLL_CLK_SDMA>,
++ clocks = <&clks IMX6SLL_CLK_IPG>,
+ <&clks IMX6SLL_CLK_SDMA>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
+index 50083cecc6c9..7b62e6fb47eb 100644
+--- a/arch/arm/boot/dts/imx6sx.dtsi
++++ b/arch/arm/boot/dts/imx6sx.dtsi
+@@ -803,7 +803,7 @@
+ compatible = "fsl,imx6sx-sdma", "fsl,imx6q-sdma";
+ reg = <0x020ec000 0x4000>;
+ interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX6SX_CLK_SDMA>,
++ clocks = <&clks IMX6SX_CLK_IPG>,
+ <&clks IMX6SX_CLK_SDMA>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
+index 6dc0b569acdf..2366f093cc76 100644
+--- a/arch/arm/boot/dts/imx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul.dtsi
+@@ -707,7 +707,7 @@
+ "fsl,imx35-sdma";
+ reg = <0x020ec000 0x4000>;
+ interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX6UL_CLK_SDMA>,
++ clocks = <&clks IMX6UL_CLK_IPG>,
+ <&clks IMX6UL_CLK_SDMA>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index a052198f6e96..a7f697b0290f 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -1050,8 +1050,8 @@
+ compatible = "fsl,imx7d-sdma", "fsl,imx35-sdma";
+ reg = <0x30bd0000 0x10000>;
+ interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX7D_SDMA_CORE_CLK>,
+- <&clks IMX7D_AHB_CHANNEL_ROOT_CLK>;
++ clocks = <&clks IMX7D_IPG_ROOT_CLK>,
++ <&clks IMX7D_SDMA_CORE_CLK>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+ fsl,sdma-ram-script-name = "imx/sdma/sdma-imx7d.bin";
+diff --git a/arch/arm/include/asm/hardirq.h b/arch/arm/include/asm/hardirq.h
+index cba23eaa6072..7a88f160b1fb 100644
+--- a/arch/arm/include/asm/hardirq.h
++++ b/arch/arm/include/asm/hardirq.h
+@@ -6,6 +6,7 @@
+ #include <linux/threads.h>
+ #include <asm/irq.h>
+
++/* number of IPIS _not_ including IPI_CPU_BACKTRACE */
+ #define NR_IPI 7
+
+ typedef struct {
+diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
+index a3ce7c5365fa..bada66ef4419 100644
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -76,6 +76,10 @@ enum ipi_msg_type {
+ IPI_CPU_STOP,
+ IPI_IRQ_WORK,
+ IPI_COMPLETION,
++ /*
++ * CPU_BACKTRACE is special and not included in NR_IPI
++ * or tracable with trace_ipi_*
++ */
+ IPI_CPU_BACKTRACE,
+ /*
+ * SGI8-15 can be reserved by secure firmware, and thus may
+@@ -803,7 +807,7 @@ core_initcall(register_cpufreq_notifier);
+
+ static void raise_nmi(cpumask_t *mask)
+ {
+- smp_cross_call(mask, IPI_CPU_BACKTRACE);
++ __smp_cross_call(mask, IPI_CPU_BACKTRACE);
+ }
+
+ void arch_trigger_cpumask_backtrace(const cpumask_t *mask, bool exclude_self)
+diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
+index b1fe53e8b460..088c34e99b02 100644
+--- a/arch/arm/mach-exynos/suspend.c
++++ b/arch/arm/mach-exynos/suspend.c
+@@ -434,8 +434,27 @@ early_wakeup:
+
+ static void exynos5420_prepare_pm_resume(void)
+ {
++ unsigned int mpidr, cluster;
++
++ mpidr = read_cpuid_mpidr();
++ cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
++
+ if (IS_ENABLED(CONFIG_EXYNOS5420_MCPM))
+ WARN_ON(mcpm_cpu_powered_up());
++
++ if (IS_ENABLED(CONFIG_HW_PERF_EVENTS) && cluster != 0) {
++ /*
++ * When system is resumed on the LITTLE/KFC core (cluster 1),
++ * the DSCR is not properly updated until the power is turned
++ * on also for the cluster 0. Enable it for a while to
++ * propagate the SPNIDEN and SPIDEN signals from Secure JTAG
++ * block and avoid undefined instruction issue on CP14 reset.
++ */
++ pmu_raw_writel(S5P_CORE_LOCAL_PWR_EN,
++ EXYNOS_COMMON_CONFIGURATION(0));
++ pmu_raw_writel(0,
++ EXYNOS_COMMON_CONFIGURATION(0));
++ }
+ }
+
+ static void exynos5420_pm_resume(void)
+diff --git a/arch/arm/mach-omap2/pm33xx-core.c b/arch/arm/mach-omap2/pm33xx-core.c
+index f4971e4a86b2..ca7026958d42 100644
+--- a/arch/arm/mach-omap2/pm33xx-core.c
++++ b/arch/arm/mach-omap2/pm33xx-core.c
+@@ -51,10 +51,12 @@ static int amx3_common_init(void)
+
+ /* CEFUSE domain can be turned off post bootup */
+ cefuse_pwrdm = pwrdm_lookup("cefuse_pwrdm");
+- if (cefuse_pwrdm)
+- omap_set_pwrdm_state(cefuse_pwrdm, PWRDM_POWER_OFF);
+- else
++ if (!cefuse_pwrdm)
+ pr_err("PM: Failed to get cefuse_pwrdm\n");
++ else if (omap_type() != OMAP2_DEVICE_TYPE_GP)
++ pr_info("PM: Leaving EFUSE power domain active\n");
++ else
++ omap_set_pwrdm_state(cefuse_pwrdm, PWRDM_POWER_OFF);
+
+ return 0;
+ }
+diff --git a/arch/mips/kernel/prom.c b/arch/mips/kernel/prom.c
+index 89950b7bf536..bdaf3536241a 100644
+--- a/arch/mips/kernel/prom.c
++++ b/arch/mips/kernel/prom.c
+@@ -41,7 +41,19 @@ char *mips_get_machine_name(void)
+ #ifdef CONFIG_USE_OF
+ void __init early_init_dt_add_memory_arch(u64 base, u64 size)
+ {
+- return add_memory_region(base, size, BOOT_MEM_RAM);
++ if (base >= PHYS_ADDR_MAX) {
++ pr_warn("Trying to add an invalid memory region, skipped\n");
++ return;
++ }
++
++ /* Truncate the passed memory region instead of type casting */
++ if (base + size - 1 >= PHYS_ADDR_MAX || base + size < base) {
++ pr_warn("Truncate memory region %llx @ %llx to size %llx\n",
++ size, base, PHYS_ADDR_MAX - base);
++ size = PHYS_ADDR_MAX - base;
++ }
++
++ add_memory_region(base, size, BOOT_MEM_RAM);
+ }
+
+ int __init early_init_dt_reserve_memory_arch(phys_addr_t base,
+diff --git a/arch/um/kernel/time.c b/arch/um/kernel/time.c
+index 052de4c8acb2..0c572a48158e 100644
+--- a/arch/um/kernel/time.c
++++ b/arch/um/kernel/time.c
+@@ -56,7 +56,7 @@ static int itimer_one_shot(struct clock_event_device *evt)
+ static struct clock_event_device timer_clockevent = {
+ .name = "posix-timer",
+ .rating = 250,
+- .cpumask = cpu_all_mask,
++ .cpumask = cpu_possible_mask,
+ .features = CLOCK_EVT_FEAT_PERIODIC |
+ CLOCK_EVT_FEAT_ONESHOT,
+ .set_state_shutdown = itimer_shutdown,
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 09c53bcbd497..c8b0bf2b0d5e 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3072,7 +3072,7 @@ static int intel_pmu_hw_config(struct perf_event *event)
+ return ret;
+
+ if (event->attr.precise_ip) {
+- if (!(event->attr.freq || event->attr.wakeup_events)) {
++ if (!(event->attr.freq || (event->attr.wakeup_events && !event->attr.watermark))) {
+ event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD;
+ if (!(event->attr.sample_type &
+ ~intel_pmu_large_pebs_flags(event)))
+diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
+index 52e55108404e..d3a73f9335e1 100644
+--- a/arch/x86/pci/irq.c
++++ b/arch/x86/pci/irq.c
+@@ -1119,6 +1119,8 @@ static const struct dmi_system_id pciirq_dmi_table[] __initconst = {
+
+ void __init pcibios_irq_init(void)
+ {
++ struct irq_routing_table *rtable = NULL;
++
+ DBG(KERN_DEBUG "PCI: IRQ init\n");
+
+ if (raw_pci_ops == NULL)
+@@ -1129,8 +1131,10 @@ void __init pcibios_irq_init(void)
+ pirq_table = pirq_find_routing_table();
+
+ #ifdef CONFIG_PCI_BIOS
+- if (!pirq_table && (pci_probe & PCI_BIOS_IRQ_SCAN))
++ if (!pirq_table && (pci_probe & PCI_BIOS_IRQ_SCAN)) {
+ pirq_table = pcibios_get_irq_routing_table();
++ rtable = pirq_table;
++ }
+ #endif
+ if (pirq_table) {
+ pirq_peer_trick();
+@@ -1145,8 +1149,10 @@ void __init pcibios_irq_init(void)
+ * If we're using the I/O APIC, avoid using the PCI IRQ
+ * routing table
+ */
+- if (io_apic_assign_pci_irqs)
++ if (io_apic_assign_pci_irqs) {
++ kfree(rtable);
+ pirq_table = NULL;
++ }
+ }
+
+ x86_init.pci.fixup_irqs();
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 15e8c9955b79..6bb397995610 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2509,6 +2509,8 @@ static void bfq_arm_slice_timer(struct bfq_data *bfqd)
+ if (BFQQ_SEEKY(bfqq) && bfqq->wr_coeff == 1 &&
+ bfq_symmetric_scenario(bfqd))
+ sl = min_t(u64, sl, BFQ_MIN_TT);
++ else if (bfqq->wr_coeff > 1)
++ sl = max_t(u32, sl, 20ULL * NSEC_PER_MSEC);
+
+ bfqd->last_idling_start = ktime_get();
+ hrtimer_start(&bfqd->idle_slice_timer, ns_to_ktime(sl),
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 33488b1426b7..6eed5d84c2ef 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -411,7 +411,6 @@ void blk_sync_queue(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ int i;
+
+- cancel_delayed_work_sync(&q->requeue_work);
+ queue_for_each_hw_ctx(q, hctx, i)
+ cancel_delayed_work_sync(&hctx->run_work);
+ } else {
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 4e563ee462cb..70d839b9c3b0 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2465,6 +2465,8 @@ void blk_mq_release(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ unsigned int i;
+
++ cancel_delayed_work_sync(&q->requeue_work);
++
+ /* hctx kobj stays in hctx */
+ queue_for_each_hw_ctx(q, hctx, i) {
+ if (!hctx)
+diff --git a/drivers/clk/rockchip/clk-rk3288.c b/drivers/clk/rockchip/clk-rk3288.c
+index 64191694ff6e..9cfdbea493bb 100644
+--- a/drivers/clk/rockchip/clk-rk3288.c
++++ b/drivers/clk/rockchip/clk-rk3288.c
+@@ -835,6 +835,9 @@ static const int rk3288_saved_cru_reg_ids[] = {
+ RK3288_CLKSEL_CON(10),
+ RK3288_CLKSEL_CON(33),
+ RK3288_CLKSEL_CON(37),
++
++ /* We turn aclk_dmac1 on for suspend; this will restore it */
++ RK3288_CLKGATE_CON(10),
+ };
+
+ static u32 rk3288_saved_cru_regs[ARRAY_SIZE(rk3288_saved_cru_reg_ids)];
+@@ -850,6 +853,14 @@ static int rk3288_clk_suspend(void)
+ readl_relaxed(rk3288_cru_base + reg_id);
+ }
+
++ /*
++ * Going into deep sleep (specifically setting PMU_CLR_DMA in
++ * RK3288_PMU_PWRMODE_CON1) appears to fail unless
++ * "aclk_dmac1" is on.
++ */
++ writel_relaxed(1 << (12 + 16),
++ rk3288_cru_base + RK3288_CLKGATE_CON(10));
++
+ /*
+ * Switch PLLs other than DPLL (for SDRAM) to slow mode to
+ * avoid crashes on resume. The Mask ROM on the system will
+diff --git a/drivers/dma/idma64.c b/drivers/dma/idma64.c
+index 1fbf9cb9b742..89c5e5b46068 100644
+--- a/drivers/dma/idma64.c
++++ b/drivers/dma/idma64.c
+@@ -597,7 +597,7 @@ static int idma64_probe(struct idma64_chip *chip)
+ idma64->dma.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+ idma64->dma.residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
+
+- idma64->dma.dev = chip->dev;
++ idma64->dma.dev = chip->sysdev;
+
+ dma_set_max_seg_size(idma64->dma.dev, IDMA64C_CTLH_BLOCK_TS_MASK);
+
+@@ -637,6 +637,7 @@ static int idma64_platform_probe(struct platform_device *pdev)
+ {
+ struct idma64_chip *chip;
+ struct device *dev = &pdev->dev;
++ struct device *sysdev = dev->parent;
+ struct resource *mem;
+ int ret;
+
+@@ -653,11 +654,12 @@ static int idma64_platform_probe(struct platform_device *pdev)
+ if (IS_ERR(chip->regs))
+ return PTR_ERR(chip->regs);
+
+- ret = dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
++ ret = dma_coerce_mask_and_coherent(sysdev, DMA_BIT_MASK(64));
+ if (ret)
+ return ret;
+
+ chip->dev = dev;
++ chip->sysdev = sysdev;
+
+ ret = idma64_probe(chip);
+ if (ret)
+diff --git a/drivers/dma/idma64.h b/drivers/dma/idma64.h
+index 6b816878e5e7..baa32e1425de 100644
+--- a/drivers/dma/idma64.h
++++ b/drivers/dma/idma64.h
+@@ -216,12 +216,14 @@ static inline void idma64_writel(struct idma64 *idma64, int offset, u32 value)
+ /**
+ * struct idma64_chip - representation of iDMA 64-bit controller hardware
+ * @dev: struct device of the DMA controller
++ * @sysdev: struct device of the physical device that does DMA
+ * @irq: irq line
+ * @regs: memory mapped I/O space
+ * @idma64: struct idma64 that is filed by idma64_probe()
+ */
+ struct idma64_chip {
+ struct device *dev;
++ struct device *sysdev;
+ int irq;
+ void __iomem *regs;
+ struct idma64 *idma64;
+diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
+index 57304b2e989f..b00cc03ad6b6 100644
+--- a/drivers/edac/Kconfig
++++ b/drivers/edac/Kconfig
+@@ -250,8 +250,8 @@ config EDAC_PND2
+ micro-server but may appear on others in the future.
+
+ config EDAC_MPC85XX
+- tristate "Freescale MPC83xx / MPC85xx"
+- depends on FSL_SOC
++ bool "Freescale MPC83xx / MPC85xx"
++ depends on FSL_SOC && EDAC=y
+ help
+ Support for error detection and correction on the Freescale
+ MPC8349, MPC8560, MPC8540, MPC8548, T4240
+diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
+index 6c1acf642c8e..6fa430d98517 100644
+--- a/drivers/gpio/gpio-omap.c
++++ b/drivers/gpio/gpio-omap.c
+@@ -343,6 +343,22 @@ static void omap_clear_gpio_debounce(struct gpio_bank *bank, unsigned offset)
+ }
+ }
+
++/*
++ * Off mode wake-up capable GPIOs in bank(s) that are in the wakeup domain.
++ * See TRM section for GPIO for "Wake-Up Generation" for the list of GPIOs
++ * in wakeup domain. If bank->non_wakeup_gpios is not configured, assume none
++ * are capable waking up the system from off mode.
++ */
++static bool omap_gpio_is_off_wakeup_capable(struct gpio_bank *bank, u32 gpio_mask)
++{
++ u32 no_wake = bank->non_wakeup_gpios;
++
++ if (no_wake)
++ return !!(~no_wake & gpio_mask);
++
++ return false;
++}
++
+ static inline void omap_set_gpio_trigger(struct gpio_bank *bank, int gpio,
+ unsigned trigger)
+ {
+@@ -374,13 +390,7 @@ static inline void omap_set_gpio_trigger(struct gpio_bank *bank, int gpio,
+ }
+
+ /* This part needs to be executed always for OMAP{34xx, 44xx} */
+- if (!bank->regs->irqctrl) {
+- /* On omap24xx proceed only when valid GPIO bit is set */
+- if (bank->non_wakeup_gpios) {
+- if (!(bank->non_wakeup_gpios & gpio_bit))
+- goto exit;
+- }
+-
++ if (!bank->regs->irqctrl && !omap_gpio_is_off_wakeup_capable(bank, gpio)) {
+ /*
+ * Log the edge gpio and manually trigger the IRQ
+ * after resume if the input level changes
+@@ -393,7 +403,6 @@ static inline void omap_set_gpio_trigger(struct gpio_bank *bank, int gpio,
+ bank->enabled_non_wakeup_gpios &= ~gpio_bit;
+ }
+
+-exit:
+ bank->level_mask =
+ readl_relaxed(bank->base + bank->regs->leveldetect0) |
+ readl_relaxed(bank->base + bank->regs->leveldetect1);
+diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
+index 7e09ce75ffb2..a9cb5571de54 100644
+--- a/drivers/gpio/gpio-vf610.c
++++ b/drivers/gpio/gpio-vf610.c
+@@ -37,6 +37,7 @@ struct fsl_gpio_soc_data {
+
+ struct vf610_gpio_port {
+ struct gpio_chip gc;
++ struct irq_chip ic;
+ void __iomem *base;
+ void __iomem *gpio_base;
+ const struct fsl_gpio_soc_data *sdata;
+@@ -66,8 +67,6 @@ struct vf610_gpio_port {
+ #define PORT_INT_EITHER_EDGE 0xb
+ #define PORT_INT_LOGIC_ONE 0xc
+
+-static struct irq_chip vf610_gpio_irq_chip;
+-
+ static const struct fsl_gpio_soc_data imx_data = {
+ .have_paddr = true,
+ };
+@@ -243,15 +242,6 @@ static int vf610_gpio_irq_set_wake(struct irq_data *d, u32 enable)
+ return 0;
+ }
+
+-static struct irq_chip vf610_gpio_irq_chip = {
+- .name = "gpio-vf610",
+- .irq_ack = vf610_gpio_irq_ack,
+- .irq_mask = vf610_gpio_irq_mask,
+- .irq_unmask = vf610_gpio_irq_unmask,
+- .irq_set_type = vf610_gpio_irq_set_type,
+- .irq_set_wake = vf610_gpio_irq_set_wake,
+-};
+-
+ static int vf610_gpio_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -259,6 +249,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
+ struct vf610_gpio_port *port;
+ struct resource *iores;
+ struct gpio_chip *gc;
++ struct irq_chip *ic;
+ int i;
+ int ret;
+
+@@ -295,6 +286,14 @@ static int vf610_gpio_probe(struct platform_device *pdev)
+ gc->direction_output = vf610_gpio_direction_output;
+ gc->set = vf610_gpio_set;
+
++ ic = &port->ic;
++ ic->name = "gpio-vf610";
++ ic->irq_ack = vf610_gpio_irq_ack;
++ ic->irq_mask = vf610_gpio_irq_mask;
++ ic->irq_unmask = vf610_gpio_irq_unmask;
++ ic->irq_set_type = vf610_gpio_irq_set_type;
++ ic->irq_set_wake = vf610_gpio_irq_set_wake;
++
+ ret = gpiochip_add_data(gc, port);
+ if (ret < 0)
+ return ret;
+@@ -306,14 +305,13 @@ static int vf610_gpio_probe(struct platform_device *pdev)
+ /* Clear the interrupt status register for all GPIO's */
+ vf610_gpio_writel(~0, port->base + PORT_ISFR);
+
+- ret = gpiochip_irqchip_add(gc, &vf610_gpio_irq_chip, 0,
+- handle_edge_irq, IRQ_TYPE_NONE);
++ ret = gpiochip_irqchip_add(gc, ic, 0, handle_edge_irq, IRQ_TYPE_NONE);
+ if (ret) {
+ dev_err(dev, "failed to add irqchip\n");
+ gpiochip_remove(gc);
+ return ret;
+ }
+- gpiochip_set_chained_irqchip(gc, &vf610_gpio_irq_chip, port->irq,
++ gpiochip_set_chained_irqchip(gc, ic, port->irq,
+ vf610_gpio_irq_handler);
+
+ return 0;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
+index bf8b68f8db4f..bce5741f2952 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
+@@ -388,6 +388,10 @@ void dpp1_cnv_setup (
+ default:
+ break;
+ }
++
++ /* Set default color space based on format if none is given. */
++ color_space = input_color_space ? input_color_space : color_space;
++
+ REG_SET(CNVC_SURFACE_PIXEL_FORMAT, 0,
+ CNVC_SURFACE_PIXEL_FORMAT, pixel_format);
+ REG_UPDATE(FORMAT_CONTROL, FORMAT_CONTROL__ALPHA_EN, alpha_en);
+@@ -399,7 +403,7 @@ void dpp1_cnv_setup (
+ for (i = 0; i < 12; i++)
+ tbl_entry.regval[i] = input_csc_color_matrix.matrix[i];
+
+- tbl_entry.color_space = input_color_space;
++ tbl_entry.color_space = color_space;
+
+ if (color_space >= COLOR_SPACE_YCBCR601)
+ select = INPUT_CSC_SELECT_ICSC;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+index a0355709abd1..7736ef123e9b 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+@@ -1890,7 +1890,7 @@ static void update_dpp(struct dpp *dpp, struct dc_plane_state *plane_state)
+ plane_state->format,
+ EXPANSION_MODE_ZERO,
+ plane_state->input_csc_color_matrix,
+- COLOR_SPACE_YCBCR601_LIMITED);
++ plane_state->color_space);
+
+ //set scale and bias registers
+ build_prescale_params(&bns_params, plane_state);
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 85c2d407a52e..e7ddd3e3db92 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -747,11 +747,11 @@ static void adv7511_mode_set(struct adv7511 *adv7511,
+ vsync_polarity = 1;
+ }
+
+- if (mode->vrefresh <= 24000)
++ if (drm_mode_vrefresh(mode) <= 24)
+ low_refresh_rate = ADV7511_LOW_REFRESH_RATE_24HZ;
+- else if (mode->vrefresh <= 25000)
++ else if (drm_mode_vrefresh(mode) <= 25)
+ low_refresh_rate = ADV7511_LOW_REFRESH_RATE_25HZ;
+- else if (mode->vrefresh <= 30000)
++ else if (drm_mode_vrefresh(mode) <= 30)
+ low_refresh_rate = ADV7511_LOW_REFRESH_RATE_30HZ;
+ else
+ low_refresh_rate = ADV7511_LOW_REFRESH_RATE_NONE;
+diff --git a/drivers/gpu/drm/nouveau/Kconfig b/drivers/gpu/drm/nouveau/Kconfig
+index 00d9d77f583a..4b75ad40dd80 100644
+--- a/drivers/gpu/drm/nouveau/Kconfig
++++ b/drivers/gpu/drm/nouveau/Kconfig
+@@ -16,20 +16,9 @@ config DRM_NOUVEAU
+ select INPUT if ACPI && X86
+ select THERMAL if ACPI && X86
+ select ACPI_VIDEO if ACPI && X86
+- help
+- Choose this option for open-source NVIDIA support.
+-
+-config NOUVEAU_LEGACY_CTX_SUPPORT
+- bool "Nouveau legacy context support"
+- depends on DRM_NOUVEAU
+ select DRM_VM
+- default y
+ help
+- There was a version of the nouveau DDX that relied on legacy
+- ctx ioctls not erroring out. But that was back in time a long
+- ways, so offer a way to disable it now. For uapi compat with
+- old nouveau ddx this should be on by default, but modern distros
+- should consider turning it off.
++ Choose this option for open-source NVIDIA support.
+
+ config NOUVEAU_PLATFORM_DRIVER
+ bool "Nouveau (NVIDIA) SoC GPUs"
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.h b/drivers/gpu/drm/nouveau/dispnv50/disp.h
+index e48c5eb35b49..66c125a6b0b3 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.h
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.h
+@@ -41,6 +41,7 @@ struct nv50_disp_interlock {
+ NV50_DISP_INTERLOCK__SIZE
+ } type;
+ u32 data;
++ u32 wimm;
+ };
+
+ void corec37d_ntfy_init(struct nouveau_bo *, u32);
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/head.c b/drivers/gpu/drm/nouveau/dispnv50/head.c
+index 4f57e5379796..d81a99bb2ac3 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/head.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/head.c
+@@ -306,7 +306,7 @@ nv50_head_atomic_check(struct drm_crtc *crtc, struct drm_crtc_state *state)
+ asyh->set.or = head->func->or != NULL;
+ }
+
+- if (asyh->state.mode_changed)
++ if (asyh->state.mode_changed || asyh->state.connectors_changed)
+ nv50_head_atomic_check_mode(head, asyh);
+
+ if (asyh->state.color_mgmt_changed ||
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c b/drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c
+index 9103b8494279..f7dbd965e4e7 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c
+@@ -75,6 +75,7 @@ wimmc37b_init_(const struct nv50_wimm_func *func, struct nouveau_drm *drm,
+ return ret;
+ }
+
++ wndw->interlock.wimm = wndw->interlock.data;
+ wndw->immd = func;
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/wndw.c b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+index 2187922e8dc2..b3db4553098d 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+@@ -151,7 +151,7 @@ nv50_wndw_flush_set(struct nv50_wndw *wndw, u32 *interlock,
+ if (asyw->set.point) {
+ if (asyw->set.point = false, asyw->set.mask)
+ interlock[wndw->interlock.type] |= wndw->interlock.data;
+- interlock[NV50_DISP_INTERLOCK_WIMM] |= wndw->interlock.data;
++ interlock[NV50_DISP_INTERLOCK_WIMM] |= wndw->interlock.wimm;
+
+ wndw->immd->point(wndw, asyw);
+ wndw->immd->update(wndw, interlock);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index 2b7a54cc3c9e..74d2283f2c28 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -1015,11 +1015,8 @@ nouveau_driver_fops = {
+ static struct drm_driver
+ driver_stub = {
+ .driver_features =
+- DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_RENDER
+-#if defined(CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT)
+- | DRIVER_KMS_LEGACY_CONTEXT
+-#endif
+- ,
++ DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_RENDER |
++ DRIVER_KMS_LEGACY_CONTEXT,
+
+ .load = nouveau_drm_load,
+ .unload = nouveau_drm_unload,
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+index 5f301e632599..818d21bd28d3 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+@@ -365,8 +365,15 @@ nvkm_dp_train(struct nvkm_dp *dp, u32 dataKBps)
+ * and it's better to have a failed modeset than that.
+ */
+ for (cfg = nvkm_dp_rates; cfg->rate; cfg++) {
+- if (cfg->nr <= outp_nr && cfg->nr <= outp_bw)
+- failsafe = cfg;
++ if (cfg->nr <= outp_nr && cfg->nr <= outp_bw) {
++ /* Try to respect sink limits too when selecting
++ * lowest link configuration.
++ */
++ if (!failsafe ||
++ (cfg->nr <= sink_nr && cfg->bw <= sink_bw))
++ failsafe = cfg;
++ }
++
+ if (failsafe && cfg[1].rate < dataKBps)
+ break;
+ }
+diff --git a/drivers/gpu/drm/pl111/pl111_display.c b/drivers/gpu/drm/pl111/pl111_display.c
+index 754f6b25f265..6d9f78612dee 100644
+--- a/drivers/gpu/drm/pl111/pl111_display.c
++++ b/drivers/gpu/drm/pl111/pl111_display.c
+@@ -531,14 +531,15 @@ pl111_init_clock_divider(struct drm_device *drm)
+ dev_err(drm->dev, "CLCD: unable to get clcdclk.\n");
+ return PTR_ERR(parent);
+ }
++
++ spin_lock_init(&priv->tim2_lock);
++
+ /* If the clock divider is broken, use the parent directly */
+ if (priv->variant->broken_clockdivider) {
+ priv->clk = parent;
+ return 0;
+ }
+ parent_name = __clk_get_name(parent);
+-
+- spin_lock_init(&priv->tim2_lock);
+ div->init = &init;
+
+ ret = devm_clk_hw_register(drm->dev, div);
+diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
+index ab39315c9078..39e608271263 100644
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -818,6 +818,7 @@ static void vc4_plane_atomic_async_update(struct drm_plane *plane,
+ drm_atomic_set_fb_for_plane(plane->state, state->fb);
+ }
+
++ swap(plane->state->fb, state->fb);
+ /* Set the cursor's position on the screen. This is the
+ * expected change from the drm_mode_cursor_universal()
+ * helper.
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index 9ae3678844eb..40fbf20d69e5 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -2414,13 +2414,9 @@ static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool bypass)
+ /* Clear CR0 and sync (disables SMMU and queue processing) */
+ reg = readl_relaxed(smmu->base + ARM_SMMU_CR0);
+ if (reg & CR0_SMMUEN) {
+- if (is_kdump_kernel()) {
+- arm_smmu_update_gbpa(smmu, GBPA_ABORT, 0);
+- arm_smmu_device_disable(smmu);
+- return -EBUSY;
+- }
+-
+ dev_warn(smmu->dev, "SMMU currently enabled! Resetting...\n");
++ WARN_ON(is_kdump_kernel() && !disable_bypass);
++ arm_smmu_update_gbpa(smmu, GBPA_ABORT, 0);
+ }
+
+ ret = arm_smmu_device_disable(smmu);
+@@ -2513,6 +2509,8 @@ static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool bypass)
+ return ret;
+ }
+
++ if (is_kdump_kernel())
++ enables &= ~(CR0_EVTQEN | CR0_PRIQEN);
+
+ /* Enable the SMMU interface, or ensure bypass */
+ if (!bypass || disable_bypass) {
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 603bf5233a99..c1439019dd12 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -4033,9 +4033,7 @@ static void __init init_no_remapping_devices(void)
+
+ /* This IOMMU has *only* gfx devices. Either bypass it or
+ set the gfx_mapped flag, as appropriate */
+- if (dmar_map_gfx) {
+- intel_iommu_gfx_mapped = 1;
+- } else {
++ if (!dmar_map_gfx) {
+ drhd->ignored = 1;
+ for_each_active_dev_scope(drhd->devices,
+ drhd->devices_cnt, i, dev)
+@@ -4831,6 +4829,9 @@ int __init intel_iommu_init(void)
+ goto out_free_reserved_range;
+ }
+
++ if (dmar_map_gfx)
++ intel_iommu_gfx_mapped = 1;
++
+ init_no_remapping_devices();
+
+ ret = init_dmars();
+diff --git a/drivers/mailbox/stm32-ipcc.c b/drivers/mailbox/stm32-ipcc.c
+index 533b0da5235d..ca1f993c0de3 100644
+--- a/drivers/mailbox/stm32-ipcc.c
++++ b/drivers/mailbox/stm32-ipcc.c
+@@ -8,9 +8,9 @@
+ #include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/interrupt.h>
++#include <linux/io.h>
+ #include <linux/mailbox_controller.h>
+ #include <linux/module.h>
+-#include <linux/of_irq.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_wakeirq.h>
+
+@@ -240,9 +240,11 @@ static int stm32_ipcc_probe(struct platform_device *pdev)
+
+ /* irq */
+ for (i = 0; i < IPCC_IRQ_NUM; i++) {
+- ipcc->irqs[i] = of_irq_get_byname(dev->of_node, irq_name[i]);
++ ipcc->irqs[i] = platform_get_irq_byname(pdev, irq_name[i]);
+ if (ipcc->irqs[i] < 0) {
+- dev_err(dev, "no IRQ specified %s\n", irq_name[i]);
++ if (ipcc->irqs[i] != -EPROBE_DEFER)
++ dev_err(dev, "no IRQ specified %s\n",
++ irq_name[i]);
+ ret = ipcc->irqs[i];
+ goto err_clk;
+ }
+@@ -263,9 +265,10 @@ static int stm32_ipcc_probe(struct platform_device *pdev)
+
+ /* wakeup */
+ if (of_property_read_bool(np, "wakeup-source")) {
+- ipcc->wkp = of_irq_get_byname(dev->of_node, "wakeup");
++ ipcc->wkp = platform_get_irq_byname(pdev, "wakeup");
+ if (ipcc->wkp < 0) {
+- dev_err(dev, "could not get wakeup IRQ\n");
++ if (ipcc->wkp != -EPROBE_DEFER)
++ dev_err(dev, "could not get wakeup IRQ\n");
+ ret = ipcc->wkp;
+ goto err_clk;
+ }
+diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
+index 50bffc3382d7..ff3fba16e735 100644
+--- a/drivers/mfd/intel-lpss.c
++++ b/drivers/mfd/intel-lpss.c
+@@ -273,6 +273,9 @@ static void intel_lpss_init_dev(const struct intel_lpss *lpss)
+ {
+ u32 value = LPSS_PRIV_SSP_REG_DIS_DMA_FIN;
+
++ /* Set the device in reset state */
++ writel(0, lpss->priv + LPSS_PRIV_RESETS);
++
+ intel_lpss_deassert_reset(lpss);
+
+ intel_lpss_set_remap_addr(lpss);
+diff --git a/drivers/mfd/tps65912-spi.c b/drivers/mfd/tps65912-spi.c
+index 3bd75061f777..f78be039e463 100644
+--- a/drivers/mfd/tps65912-spi.c
++++ b/drivers/mfd/tps65912-spi.c
+@@ -27,6 +27,7 @@ static const struct of_device_id tps65912_spi_of_match_table[] = {
+ { .compatible = "ti,tps65912", },
+ { /* sentinel */ }
+ };
++MODULE_DEVICE_TABLE(of, tps65912_spi_of_match_table);
+
+ static int tps65912_spi_probe(struct spi_device *spi)
+ {
+diff --git a/drivers/mfd/twl6040.c b/drivers/mfd/twl6040.c
+index dd19f17a1b63..2b8c479dbfa6 100644
+--- a/drivers/mfd/twl6040.c
++++ b/drivers/mfd/twl6040.c
+@@ -322,8 +322,19 @@ int twl6040_power(struct twl6040 *twl6040, int on)
+ }
+ }
+
++ /*
++ * Register access can produce errors after power-up unless we
++ * wait at least 8ms based on measurements on duovero.
++ */
++ usleep_range(10000, 12000);
++
+ /* Sync with the HW */
+- regcache_sync(twl6040->regmap);
++ ret = regcache_sync(twl6040->regmap);
++ if (ret) {
++ dev_err(twl6040->dev, "Failed to sync with the HW: %i\n",
++ ret);
++ goto out;
++ }
+
+ /* Default PLL configuration after power up */
+ twl6040->pll = TWL6040_SYSCLK_SEL_LPPLL;
+diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
+index 896e2df9400f..fd33a3b9c66f 100644
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -662,6 +662,7 @@ static int pci_endpoint_test_probe(struct pci_dev *pdev,
+ data = (struct pci_endpoint_test_data *)ent->driver_data;
+ if (data) {
+ test_reg_bar = data->test_reg_bar;
++ test->test_reg_bar = test_reg_bar;
+ test->alignment = data->alignment;
+ irq_type = data->irq_type;
+ }
+diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
+index 1841d250e9e2..eb1a65cb878f 100644
+--- a/drivers/mmc/host/mmci.c
++++ b/drivers/mmc/host/mmci.c
+@@ -1295,9 +1295,10 @@ static irqreturn_t mmci_irq(int irq, void *dev_id)
+ }
+
+ /*
+- * Don't poll for busy completion in irq context.
++ * Busy detection has been handled by mmci_cmd_irq() above.
++ * Clear the status bit to prevent polling in IRQ context.
+ */
+- if (host->variant->busy_detect && host->busy_status)
++ if (host->variant->busy_detect_flag)
+ status &= ~host->variant->busy_detect_flag;
+
+ ret = 1;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 340baf6a470c..4648c6a9d9e8 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -4300,8 +4300,11 @@ int hclge_add_uc_addr_common(struct hclge_vport *vport,
+ return hclge_add_mac_vlan_tbl(vport, &req, NULL);
+
+ /* check if we just hit the duplicate */
+- if (!ret)
+- ret = -EINVAL;
++ if (!ret) {
++ dev_warn(&hdev->pdev->dev, "VF %d mac(%pM) exists\n",
++ vport->vport_id, addr);
++ return 0;
++ }
+
+ dev_err(&hdev->pdev->dev,
+ "PF failed to add unicast entry(%pM) in the MAC table\n",
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index df8808cd7e11..4e04985fb430 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -6758,10 +6758,12 @@ static int i40e_setup_tc(struct net_device *netdev, void *type_data)
+ struct i40e_pf *pf = vsi->back;
+ u8 enabled_tc = 0, num_tc, hw;
+ bool need_reset = false;
++ int old_queue_pairs;
+ int ret = -EINVAL;
+ u16 mode;
+ int i;
+
++ old_queue_pairs = vsi->num_queue_pairs;
+ num_tc = mqprio_qopt->qopt.num_tc;
+ hw = mqprio_qopt->qopt.hw;
+ mode = mqprio_qopt->mode;
+@@ -6862,6 +6864,7 @@ config_tc:
+ }
+ ret = i40e_configure_queue_channels(vsi);
+ if (ret) {
++ vsi->num_queue_pairs = old_queue_pairs;
+ netdev_info(netdev,
+ "Failed configuring queue channels\n");
+ need_reset = true;
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index db1543bca701..875f97aba6e0 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -652,6 +652,9 @@ void ice_print_link_msg(struct ice_vsi *vsi, bool isup)
+ case ICE_FC_RX_PAUSE:
+ fc = "RX";
+ break;
++ case ICE_FC_NONE:
++ fc = "None";
++ break;
+ default:
+ fc = "Unknown";
+ break;
+diff --git a/drivers/net/thunderbolt.c b/drivers/net/thunderbolt.c
+index e0d6760f3219..4b5af2413970 100644
+--- a/drivers/net/thunderbolt.c
++++ b/drivers/net/thunderbolt.c
+@@ -1285,6 +1285,7 @@ static int __maybe_unused tbnet_suspend(struct device *dev)
+ tbnet_tear_down(net, true);
+ }
+
++ tb_unregister_protocol_handler(&net->handler);
+ return 0;
+ }
+
+@@ -1293,6 +1294,8 @@ static int __maybe_unused tbnet_resume(struct device *dev)
+ struct tb_service *svc = tb_to_service(dev);
+ struct tbnet *net = tb_service_get_drvdata(svc);
+
++ tb_register_protocol_handler(&net->handler);
++
+ netif_carrier_off(net->dev);
+ if (netif_running(net->dev)) {
+ netif_device_attach(net->dev);
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 7b9ef8e734e7..c8eeecc58115 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1132,6 +1132,7 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
+ struct nvme_dev *dev = nvmeq->dev;
+ struct request *abort_req;
+ struct nvme_command cmd;
++ bool shutdown = false;
+ u32 csts = readl(dev->bar + NVME_REG_CSTS);
+
+ /* If PCI error recovery process is happening, we cannot reset or
+@@ -1168,12 +1169,14 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
+ * shutdown, so we return BLK_EH_DONE.
+ */
+ switch (dev->ctrl.state) {
++ case NVME_CTRL_DELETING:
++ shutdown = true;
+ case NVME_CTRL_CONNECTING:
+ case NVME_CTRL_RESETTING:
+ dev_warn_ratelimited(dev->ctrl.device,
+ "I/O %d QID %d timeout, disable controller\n",
+ req->tag, nvmeq->qid);
+- nvme_dev_disable(dev, false);
++ nvme_dev_disable(dev, shutdown);
+ nvme_req(req)->flags |= NVME_REQ_CANCELLED;
+ return BLK_EH_DONE;
+ default:
+@@ -2187,8 +2190,11 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
+ * must flush all entered requests to their failed completion to avoid
+ * deadlocking blk-mq hot-cpu notifier.
+ */
+- if (shutdown)
++ if (shutdown) {
+ nvme_start_queues(&dev->ctrl);
++ if (dev->ctrl.admin_q && !blk_queue_dying(dev->ctrl.admin_q))
++ blk_mq_unquiesce_queue(dev->ctrl.admin_q);
++ }
+ mutex_unlock(&dev->shutdown_lock);
+ }
+
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index 7c530c88b3fb..99de51e87f7f 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -1028,7 +1028,7 @@ EXPORT_SYMBOL_GPL(nvmem_cell_put);
+ static void nvmem_shift_read_buffer_in_place(struct nvmem_cell *cell, void *buf)
+ {
+ u8 *p, *b;
+- int i, bit_offset = cell->bit_offset;
++ int i, extra, bit_offset = cell->bit_offset;
+
+ p = b = buf;
+ if (bit_offset) {
+@@ -1043,11 +1043,16 @@ static void nvmem_shift_read_buffer_in_place(struct nvmem_cell *cell, void *buf)
+ p = b;
+ *b++ >>= bit_offset;
+ }
+-
+- /* result fits in less bytes */
+- if (cell->bytes != DIV_ROUND_UP(cell->nbits, BITS_PER_BYTE))
+- *p-- = 0;
++ } else {
++ /* point to the msb */
++ p += cell->bytes - 1;
+ }
++
++ /* result fits in less bytes */
++ extra = cell->bytes - DIV_ROUND_UP(cell->nbits, BITS_PER_BYTE);
++ while (--extra >= 0)
++ *p-- = 0;
++
+ /* clear msb bits if any leftover in the last byte */
+ *p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0);
+ }
+diff --git a/drivers/nvmem/sunxi_sid.c b/drivers/nvmem/sunxi_sid.c
+index d020f89248fd..69f8e972e29c 100644
+--- a/drivers/nvmem/sunxi_sid.c
++++ b/drivers/nvmem/sunxi_sid.c
+@@ -235,8 +235,10 @@ static const struct sunxi_sid_cfg sun50i_a64_cfg = {
+ static const struct of_device_id sunxi_sid_of_match[] = {
+ { .compatible = "allwinner,sun4i-a10-sid", .data = &sun4i_a10_cfg },
+ { .compatible = "allwinner,sun7i-a20-sid", .data = &sun7i_a20_cfg },
++ { .compatible = "allwinner,sun8i-a83t-sid", .data = &sun50i_a64_cfg },
+ { .compatible = "allwinner,sun8i-h3-sid", .data = &sun8i_h3_cfg },
+ { .compatible = "allwinner,sun50i-a64-sid", .data = &sun50i_a64_cfg },
++ { .compatible = "allwinner,sun50i-h5-sid", .data = &sun50i_a64_cfg },
+ {/* sentinel */},
+ };
+ MODULE_DEVICE_TABLE(of, sunxi_sid_of_match);
+diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
+index e88bd221fffe..5e199e7d2d4f 100644
+--- a/drivers/pci/controller/dwc/pci-keystone.c
++++ b/drivers/pci/controller/dwc/pci-keystone.c
+@@ -237,6 +237,7 @@ static void ks_pcie_setup_interrupts(struct keystone_pcie *ks_pcie)
+ ks_dw_pcie_enable_error_irq(ks_pcie);
+ }
+
++#ifdef CONFIG_ARM
+ /*
+ * When a PCI device does not exist during config cycles, keystone host gets a
+ * bus error instead of returning 0xffffffff. This handler always returns 0
+@@ -256,6 +257,7 @@ static int keystone_pcie_fault(unsigned long addr, unsigned int fsr,
+
+ return 0;
+ }
++#endif
+
+ static int __init ks_pcie_host_init(struct pcie_port *pp)
+ {
+@@ -279,12 +281,14 @@ static int __init ks_pcie_host_init(struct pcie_port *pp)
+ val |= BIT(12);
+ writel(val, pci->dbi_base + PCIE_CAP_BASE + PCI_EXP_DEVCTL);
+
++#ifdef CONFIG_ARM
+ /*
+ * PCIe access errors that result into OCP errors are caught by ARM as
+ * "External aborts"
+ */
+ hook_fault_code(17, keystone_pcie_fault, SIGBUS, 0,
+ "Asynchronous external abort");
++#endif
+
+ return 0;
+ }
+diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
+index de8635af4cde..739d97080d3b 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
++++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
+@@ -385,6 +385,7 @@ int dw_pcie_ep_raise_msi_irq(struct dw_pcie_ep *ep, u8 func_no,
+ {
+ struct dw_pcie *pci = to_dw_pcie_from_ep(ep);
+ struct pci_epc *epc = ep->epc;
++ unsigned int aligned_offset;
+ u16 msg_ctrl, msg_data;
+ u32 msg_addr_lower, msg_addr_upper, reg;
+ u64 msg_addr;
+@@ -410,13 +411,15 @@ int dw_pcie_ep_raise_msi_irq(struct dw_pcie_ep *ep, u8 func_no,
+ reg = ep->msi_cap + PCI_MSI_DATA_32;
+ msg_data = dw_pcie_readw_dbi(pci, reg);
+ }
+- msg_addr = ((u64) msg_addr_upper) << 32 | msg_addr_lower;
++ aligned_offset = msg_addr_lower & (epc->mem->page_size - 1);
++ msg_addr = ((u64)msg_addr_upper) << 32 |
++ (msg_addr_lower & ~aligned_offset);
+ ret = dw_pcie_ep_map_addr(epc, func_no, ep->msi_mem_phys, msg_addr,
+ epc->mem->page_size);
+ if (ret)
+ return ret;
+
+- writel(msg_data | (interrupt_num - 1), ep->msi_mem);
++ writel(msg_data | (interrupt_num - 1), ep->msi_mem + aligned_offset);
+
+ dw_pcie_ep_unmap_addr(epc, func_no, ep->msi_mem_phys);
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
+index b56e22262a77..acd50920c2ff 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -303,20 +303,24 @@ void dw_pcie_free_msi(struct pcie_port *pp)
+
+ irq_domain_remove(pp->msi_domain);
+ irq_domain_remove(pp->irq_domain);
++
++ if (pp->msi_page)
++ __free_page(pp->msi_page);
+ }
+
+ void dw_pcie_msi_init(struct pcie_port *pp)
+ {
+ struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
+ struct device *dev = pci->dev;
+- struct page *page;
+ u64 msi_target;
+
+- page = alloc_page(GFP_KERNEL);
+- pp->msi_data = dma_map_page(dev, page, 0, PAGE_SIZE, DMA_FROM_DEVICE);
++ pp->msi_page = alloc_page(GFP_KERNEL);
++ pp->msi_data = dma_map_page(dev, pp->msi_page, 0, PAGE_SIZE,
++ DMA_FROM_DEVICE);
+ if (dma_mapping_error(dev, pp->msi_data)) {
+ dev_err(dev, "Failed to map MSI data\n");
+- __free_page(page);
++ __free_page(pp->msi_page);
++ pp->msi_page = NULL;
+ return;
+ }
+ msi_target = (u64)pp->msi_data;
+@@ -439,7 +443,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ if (ret)
+ pci->num_viewport = 2;
+
+- if (IS_ENABLED(CONFIG_PCI_MSI) && pci_msi_enabled()) {
++ if (pci_msi_enabled()) {
+ /*
+ * If a specific SoC driver needs to change the
+ * default number of vectors, it needs to implement
+@@ -477,7 +481,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ if (pp->ops->host_init) {
+ ret = pp->ops->host_init(pp);
+ if (ret)
+- goto error;
++ goto err_free_msi;
+ }
+
+ pp->root_bus_nr = pp->busn->start;
+@@ -491,7 +495,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+
+ ret = pci_scan_root_bus_bridge(bridge);
+ if (ret)
+- goto error;
++ goto err_free_msi;
+
+ bus = bridge->bus;
+
+@@ -507,6 +511,9 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ pci_bus_add_devices(bus);
+ return 0;
+
++err_free_msi:
++ if (pci_msi_enabled() && !pp->ops->msi_host_init)
++ dw_pcie_free_msi(pp);
+ error:
+ pci_free_host_bridge(bridge);
+ return ret;
+diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
+index 9f1a5e399b70..14dcf6646699 100644
+--- a/drivers/pci/controller/dwc/pcie-designware.h
++++ b/drivers/pci/controller/dwc/pcie-designware.h
+@@ -164,6 +164,7 @@ struct pcie_port {
+ struct irq_domain *irq_domain;
+ struct irq_domain *msi_domain;
+ dma_addr_t msi_data;
++ struct page *msi_page;
+ u32 num_vectors;
+ u32 irq_status[MAX_MSI_CTRLS];
+ raw_spinlock_t lock;
+diff --git a/drivers/pci/controller/pcie-rcar.c b/drivers/pci/controller/pcie-rcar.c
+index 6a4e435bd35f..9b9c677ad3a0 100644
+--- a/drivers/pci/controller/pcie-rcar.c
++++ b/drivers/pci/controller/pcie-rcar.c
+@@ -892,7 +892,7 @@ static int rcar_pcie_enable_msi(struct rcar_pcie *pcie)
+ {
+ struct device *dev = pcie->dev;
+ struct rcar_msi *msi = &pcie->msi;
+- unsigned long base;
++ phys_addr_t base;
+ int err, i;
+
+ mutex_init(&msi->lock);
+@@ -931,10 +931,14 @@ static int rcar_pcie_enable_msi(struct rcar_pcie *pcie)
+
+ /* setup MSI data target */
+ msi->pages = __get_free_pages(GFP_KERNEL, 0);
++ if (!msi->pages) {
++ err = -ENOMEM;
++ goto err;
++ }
+ base = virt_to_phys((void *)msi->pages);
+
+- rcar_pci_write_reg(pcie, base | MSIFE, PCIEMSIALR);
+- rcar_pci_write_reg(pcie, 0, PCIEMSIAUR);
++ rcar_pci_write_reg(pcie, lower_32_bits(base) | MSIFE, PCIEMSIALR);
++ rcar_pci_write_reg(pcie, upper_32_bits(base), PCIEMSIAUR);
+
+ /* enable all MSI interrupts */
+ rcar_pci_write_reg(pcie, 0xffffffff, PCIEMSIIER);
+diff --git a/drivers/pci/controller/pcie-xilinx.c b/drivers/pci/controller/pcie-xilinx.c
+index 7b1389d8e2a5..ea48cba5480b 100644
+--- a/drivers/pci/controller/pcie-xilinx.c
++++ b/drivers/pci/controller/pcie-xilinx.c
+@@ -336,14 +336,19 @@ static const struct irq_domain_ops msi_domain_ops = {
+ * xilinx_pcie_enable_msi - Enable MSI support
+ * @port: PCIe port information
+ */
+-static void xilinx_pcie_enable_msi(struct xilinx_pcie_port *port)
++static int xilinx_pcie_enable_msi(struct xilinx_pcie_port *port)
+ {
+ phys_addr_t msg_addr;
+
+ port->msi_pages = __get_free_pages(GFP_KERNEL, 0);
++ if (!port->msi_pages)
++ return -ENOMEM;
++
+ msg_addr = virt_to_phys((void *)port->msi_pages);
+ pcie_write(port, 0x0, XILINX_PCIE_REG_MSIBASE1);
+ pcie_write(port, msg_addr, XILINX_PCIE_REG_MSIBASE2);
++
++ return 0;
+ }
+
+ /* INTx Functions */
+@@ -498,6 +503,7 @@ static int xilinx_pcie_init_irq_domain(struct xilinx_pcie_port *port)
+ struct device *dev = port->dev;
+ struct device_node *node = dev->of_node;
+ struct device_node *pcie_intc_node;
++ int ret;
+
+ /* Setup INTx */
+ pcie_intc_node = of_get_next_child(node, NULL);
+@@ -526,7 +532,9 @@ static int xilinx_pcie_init_irq_domain(struct xilinx_pcie_port *port)
+ return -ENODEV;
+ }
+
+- xilinx_pcie_enable_msi(port);
++ ret = xilinx_pcie_enable_msi(port);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+diff --git a/drivers/pci/hotplug/rpadlpar_core.c b/drivers/pci/hotplug/rpadlpar_core.c
+index e2356a9c7088..182f9e3443ee 100644
+--- a/drivers/pci/hotplug/rpadlpar_core.c
++++ b/drivers/pci/hotplug/rpadlpar_core.c
+@@ -51,6 +51,7 @@ static struct device_node *find_vio_slot_node(char *drc_name)
+ if (rc == 0)
+ break;
+ }
++ of_node_put(parent);
+
+ return dn;
+ }
+@@ -71,6 +72,7 @@ static struct device_node *find_php_slot_pci_node(char *drc_name,
+ return np;
+ }
+
++/* Returns a device_node with its reference count incremented */
+ static struct device_node *find_dlpar_node(char *drc_name, int *node_type)
+ {
+ struct device_node *dn;
+@@ -306,6 +308,7 @@ int dlpar_add_slot(char *drc_name)
+ rc = dlpar_add_phb(drc_name, dn);
+ break;
+ }
++ of_node_put(dn);
+
+ printk(KERN_INFO "%s: slot %s added\n", DLPAR_MODULE_NAME, drc_name);
+ exit:
+@@ -439,6 +442,7 @@ int dlpar_remove_slot(char *drc_name)
+ rc = dlpar_remove_pci_slot(drc_name, dn);
+ break;
+ }
++ of_node_put(dn);
+ vm_unmap_aliases();
+
+ printk(KERN_INFO "%s: slot %s removed\n", DLPAR_MODULE_NAME, drc_name);
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index 37d0c15c9eeb..72db2e0ebced 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -1116,7 +1116,8 @@ static int mask_event(struct switchtec_dev *stdev, int eid, int idx)
+ if (!(hdr & SWITCHTEC_EVENT_OCCURRED && hdr & SWITCHTEC_EVENT_EN_IRQ))
+ return 0;
+
+- if (eid == SWITCHTEC_IOCTL_EVENT_LINK_STATE)
++ if (eid == SWITCHTEC_IOCTL_EVENT_LINK_STATE ||
++ eid == SWITCHTEC_IOCTL_EVENT_MRPC_COMP)
+ return 0;
+
+ dev_dbg(&stdev->dev, "%s: %d %d %x\n", __func__, eid, idx, hdr);
+diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
+index e5d5b1adb5a9..ac784ac66ac3 100644
+--- a/drivers/platform/chrome/cros_ec_proto.c
++++ b/drivers/platform/chrome/cros_ec_proto.c
+@@ -67,6 +67,17 @@ static int send_command(struct cros_ec_device *ec_dev,
+ else
+ xfer_fxn = ec_dev->cmd_xfer;
+
++ if (!xfer_fxn) {
++ /*
++ * This error can happen if a communication error happened and
++ * the EC is trying to use protocol v2, on an underlying
++ * communication mechanism that does not support v2.
++ */
++ dev_err_once(ec_dev->dev,
++ "missing EC transfer API, cannot send command\n");
++ return -EIO;
++ }
++
+ ret = (*xfer_fxn)(ec_dev, msg);
+ if (msg->result == EC_RES_IN_PROGRESS) {
+ int i;
+diff --git a/drivers/platform/x86/intel_pmc_ipc.c b/drivers/platform/x86/intel_pmc_ipc.c
+index e7edc8c63936..4ad9d127f2f5 100644
+--- a/drivers/platform/x86/intel_pmc_ipc.c
++++ b/drivers/platform/x86/intel_pmc_ipc.c
+@@ -776,13 +776,17 @@ static int ipc_create_pmc_devices(void)
+ if (ret) {
+ dev_err(ipcdev.dev, "Failed to add punit platform device\n");
+ platform_device_unregister(ipcdev.tco_dev);
++ return ret;
+ }
+
+ if (!ipcdev.telem_res_inval) {
+ ret = ipc_create_telemetry_device();
+- if (ret)
++ if (ret) {
+ dev_warn(ipcdev.dev,
+ "Failed to add telemetry platform device\n");
++ platform_device_unregister(ipcdev.punit_dev);
++ platform_device_unregister(ipcdev.tco_dev);
++ }
+ }
+
+ return ret;
+diff --git a/drivers/power/supply/max14656_charger_detector.c b/drivers/power/supply/max14656_charger_detector.c
+index b91b1d2999dc..d19307f791c6 100644
+--- a/drivers/power/supply/max14656_charger_detector.c
++++ b/drivers/power/supply/max14656_charger_detector.c
+@@ -280,6 +280,13 @@ static int max14656_probe(struct i2c_client *client,
+
+ INIT_DELAYED_WORK(&chip->irq_work, max14656_irq_worker);
+
++ chip->detect_psy = devm_power_supply_register(dev,
++ &chip->psy_desc, &psy_cfg);
++ if (IS_ERR(chip->detect_psy)) {
++ dev_err(dev, "power_supply_register failed\n");
++ return -EINVAL;
++ }
++
+ ret = devm_request_irq(dev, chip->irq, max14656_irq,
+ IRQF_TRIGGER_FALLING,
+ MAX14656_NAME, chip);
+@@ -289,13 +296,6 @@ static int max14656_probe(struct i2c_client *client,
+ }
+ enable_irq_wake(chip->irq);
+
+- chip->detect_psy = devm_power_supply_register(dev,
+- &chip->psy_desc, &psy_cfg);
+- if (IS_ERR(chip->detect_psy)) {
+- dev_err(dev, "power_supply_register failed\n");
+- return -EINVAL;
+- }
+-
+ schedule_delayed_work(&chip->irq_work, msecs_to_jiffies(2000));
+
+ return 0;
+diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
+index 1581f6ab1b1f..c45e5719ba17 100644
+--- a/drivers/pwm/core.c
++++ b/drivers/pwm/core.c
+@@ -311,10 +311,12 @@ int pwmchip_add_with_polarity(struct pwm_chip *chip,
+ if (IS_ENABLED(CONFIG_OF))
+ of_pwmchip_add(chip);
+
+- pwmchip_sysfs_export(chip);
+-
+ out:
+ mutex_unlock(&pwm_lock);
++
++ if (!ret)
++ pwmchip_sysfs_export(chip);
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(pwmchip_add_with_polarity);
+@@ -348,7 +350,7 @@ int pwmchip_remove(struct pwm_chip *chip)
+ unsigned int i;
+ int ret = 0;
+
+- pwmchip_sysfs_unexport_children(chip);
++ pwmchip_sysfs_unexport(chip);
+
+ mutex_lock(&pwm_lock);
+
+@@ -368,8 +370,6 @@ int pwmchip_remove(struct pwm_chip *chip)
+
+ free_pwms(chip);
+
+- pwmchip_sysfs_unexport(chip);
+-
+ out:
+ mutex_unlock(&pwm_lock);
+ return ret;
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index c1ed641b3e26..f6e738ad7bd9 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -111,6 +111,10 @@ struct meson_pwm {
+ const struct meson_pwm_data *data;
+ void __iomem *base;
+ u8 inverter_mask;
++ /*
++ * Protects register (write) access to the REG_MISC_AB register
++ * that is shared between the two PWMs.
++ */
+ spinlock_t lock;
+ };
+
+@@ -235,6 +239,7 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ {
+ u32 value, clk_shift, clk_enable, enable;
+ unsigned int offset;
++ unsigned long flags;
+
+ switch (id) {
+ case 0:
+@@ -255,6 +260,8 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ return;
+ }
+
++ spin_lock_irqsave(&meson->lock, flags);
++
+ value = readl(meson->base + REG_MISC_AB);
+ value &= ~(MISC_CLK_DIV_MASK << clk_shift);
+ value |= channel->pre_div << clk_shift;
+@@ -267,11 +274,14 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ value = readl(meson->base + REG_MISC_AB);
+ value |= enable;
+ writel(value, meson->base + REG_MISC_AB);
++
++ spin_unlock_irqrestore(&meson->lock, flags);
+ }
+
+ static void meson_pwm_disable(struct meson_pwm *meson, unsigned int id)
+ {
+ u32 value, enable;
++ unsigned long flags;
+
+ switch (id) {
+ case 0:
+@@ -286,9 +296,13 @@ static void meson_pwm_disable(struct meson_pwm *meson, unsigned int id)
+ return;
+ }
+
++ spin_lock_irqsave(&meson->lock, flags);
++
+ value = readl(meson->base + REG_MISC_AB);
+ value &= ~enable;
+ writel(value, meson->base + REG_MISC_AB);
++
++ spin_unlock_irqrestore(&meson->lock, flags);
+ }
+
+ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+@@ -296,19 +310,16 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ {
+ struct meson_pwm_channel *channel = pwm_get_chip_data(pwm);
+ struct meson_pwm *meson = to_meson_pwm(chip);
+- unsigned long flags;
+ int err = 0;
+
+ if (!state)
+ return -EINVAL;
+
+- spin_lock_irqsave(&meson->lock, flags);
+-
+ if (!state->enabled) {
+ meson_pwm_disable(meson, pwm->hwpwm);
+ channel->state.enabled = false;
+
+- goto unlock;
++ return 0;
+ }
+
+ if (state->period != channel->state.period ||
+@@ -329,7 +340,7 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ err = meson_pwm_calc(meson, channel, pwm->hwpwm,
+ state->duty_cycle, state->period);
+ if (err < 0)
+- goto unlock;
++ return err;
+
+ channel->state.polarity = state->polarity;
+ channel->state.period = state->period;
+@@ -341,9 +352,7 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ channel->state.enabled = true;
+ }
+
+-unlock:
+- spin_unlock_irqrestore(&meson->lock, flags);
+- return err;
++ return 0;
+ }
+
+ static void meson_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index f7b8a86fa5c5..ad4a40c0f27c 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -382,6 +382,8 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ }
+
+ /* Update shadow register first before modifying active register */
++ ehrpwm_modify(pc->mmio_base, AQSFRC, AQSFRC_RLDCSF_MASK,
++ AQSFRC_RLDCSF_ZRO);
+ ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
+ /*
+ * Changes to immediate action on Action Qualifier. This puts
+diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
+index 7c71cdb8a9d8..1c64fd8e9234 100644
+--- a/drivers/pwm/sysfs.c
++++ b/drivers/pwm/sysfs.c
+@@ -399,19 +399,6 @@ void pwmchip_sysfs_export(struct pwm_chip *chip)
+ }
+
+ void pwmchip_sysfs_unexport(struct pwm_chip *chip)
+-{
+- struct device *parent;
+-
+- parent = class_find_device(&pwm_class, NULL, chip,
+- pwmchip_sysfs_match);
+- if (parent) {
+- /* for class_find_device() */
+- put_device(parent);
+- device_unregister(parent);
+- }
+-}
+-
+-void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+ {
+ struct device *parent;
+ unsigned int i;
+@@ -429,6 +416,7 @@ void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+ }
+
+ put_device(parent);
++ device_unregister(parent);
+ }
+
+ static int __init pwm_sysfs_init(void)
+diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
+index bad0e0ea4f30..ef989a15aefc 100644
+--- a/drivers/rapidio/rio_cm.c
++++ b/drivers/rapidio/rio_cm.c
+@@ -2145,6 +2145,14 @@ static int riocm_add_mport(struct device *dev,
+ mutex_init(&cm->rx_lock);
+ riocm_rx_fill(cm, RIOCM_RX_RING_SIZE);
+ cm->rx_wq = create_workqueue(DRV_NAME "/rxq");
++ if (!cm->rx_wq) {
++ riocm_error("failed to allocate IBMBOX_%d on %s",
++ cmbox, mport->name);
++ rio_release_outb_mbox(mport, cmbox);
++ kfree(cm);
++ return -ENOMEM;
++ }
++
+ INIT_WORK(&cm->rx_work, rio_ibmsg_handler);
+
+ cm->tx_slot = 0;
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index de3f2a097451..1f1a05a90d3d 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3261,6 +3261,8 @@ static void qla24xx_async_gpsc_sp_done(void *s, int res)
+ "Async done-%s res %x, WWPN %8phC \n",
+ sp->name, res, fcport->port_name);
+
++ fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
++
+ if (res == QLA_FUNCTION_TIMEOUT)
+ return;
+
+@@ -4604,6 +4606,7 @@ int qla24xx_async_gnnid(scsi_qla_host_t *vha, fc_port_t *fcport)
+
+ done_free_sp:
+ sp->free(sp);
++ fcport->flags &= ~FCF_ASYNC_SENT;
+ done:
+ return rval;
+ }
+diff --git a/drivers/soc/mediatek/mtk-pmic-wrap.c b/drivers/soc/mediatek/mtk-pmic-wrap.c
+index 4e931fdf4d09..011a40b5fb49 100644
+--- a/drivers/soc/mediatek/mtk-pmic-wrap.c
++++ b/drivers/soc/mediatek/mtk-pmic-wrap.c
+@@ -1104,7 +1104,7 @@ static bool pwrap_is_pmic_cipher_ready(struct pmic_wrapper *wrp)
+ static int pwrap_init_cipher(struct pmic_wrapper *wrp)
+ {
+ int ret;
+- u32 rdata;
++ u32 rdata = 0;
+
+ pwrap_writel(wrp, 0x1, PWRAP_CIPHER_SWRST);
+ pwrap_writel(wrp, 0x0, PWRAP_CIPHER_SWRST);
+diff --git a/drivers/soc/renesas/renesas-soc.c b/drivers/soc/renesas/renesas-soc.c
+index d44d0e687ab8..2a43d6e99962 100644
+--- a/drivers/soc/renesas/renesas-soc.c
++++ b/drivers/soc/renesas/renesas-soc.c
+@@ -285,6 +285,9 @@ static int __init renesas_soc_init(void)
+ /* R-Car M3-W ES1.1 incorrectly identifies as ES2.0 */
+ if ((product & 0x7fff) == 0x5210)
+ product ^= 0x11;
++ /* R-Car M3-W ES1.3 incorrectly identifies as ES2.1 */
++ if ((product & 0x7fff) == 0x5211)
++ product ^= 0x12;
+ if (soc->id && ((product >> 8) & 0xff) != soc->id) {
+ pr_warn("SoC mismatch (product = 0x%x)\n", product);
+ return -ENODEV;
+diff --git a/drivers/soc/rockchip/grf.c b/drivers/soc/rockchip/grf.c
+index 96882ffde67e..3b81e1d75a97 100644
+--- a/drivers/soc/rockchip/grf.c
++++ b/drivers/soc/rockchip/grf.c
+@@ -66,9 +66,11 @@ static const struct rockchip_grf_info rk3228_grf __initconst = {
+ };
+
+ #define RK3288_GRF_SOC_CON0 0x244
++#define RK3288_GRF_SOC_CON2 0x24c
+
+ static const struct rockchip_grf_value rk3288_defaults[] __initconst = {
+ { "jtag switching", RK3288_GRF_SOC_CON0, HIWORD_UPDATE(0, 1, 12) },
++ { "pwm select", RK3288_GRF_SOC_CON2, HIWORD_UPDATE(1, 1, 0) },
+ };
+
+ static const struct rockchip_grf_info rk3288_grf __initconst = {
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index 729be74621e3..f41333817c50 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1416,12 +1416,7 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = {
+
+ static bool pxa2xx_spi_idma_filter(struct dma_chan *chan, void *param)
+ {
+- struct device *dev = param;
+-
+- if (dev != chan->device->dev->parent)
+- return false;
+-
+- return true;
++ return param == chan->device->dev;
+ }
+
+ static struct pxa2xx_spi_master *
+diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c
+index a2c9bfae3d86..b139713289a4 100644
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -171,7 +171,8 @@ static int tsens_probe(struct platform_device *pdev)
+ if (tmdev->ops->calibrate) {
+ ret = tmdev->ops->calibrate(tmdev);
+ if (ret < 0) {
+- dev_err(dev, "tsens calibration failed\n");
++ if (ret != -EPROBE_DEFER)
++ dev_err(dev, "tsens calibration failed\n");
+ return ret;
+ }
+ }
+diff --git a/drivers/thermal/rcar_gen3_thermal.c b/drivers/thermal/rcar_gen3_thermal.c
+index 7aed5337bdd3..704c8ad045bb 100644
+--- a/drivers/thermal/rcar_gen3_thermal.c
++++ b/drivers/thermal/rcar_gen3_thermal.c
+@@ -328,6 +328,9 @@ MODULE_DEVICE_TABLE(of, rcar_gen3_thermal_dt_ids);
+ static int rcar_gen3_thermal_remove(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
++ struct rcar_gen3_thermal_priv *priv = dev_get_drvdata(dev);
++
++ rcar_thermal_irq_set(priv, false);
+
+ pm_runtime_put(dev);
+ pm_runtime_disable(dev);
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index d31b975dd3fd..284e8d052fc3 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -365,7 +365,7 @@ static bool dw8250_fallback_dma_filter(struct dma_chan *chan, void *param)
+
+ static bool dw8250_idma_filter(struct dma_chan *chan, void *param)
+ {
+- return param == chan->device->dev->parent;
++ return param == chan->device->dev;
+ }
+
+ /*
+@@ -434,7 +434,7 @@ static void dw8250_quirks(struct uart_port *p, struct dw8250_data *data)
+ data->uart_16550_compatible = true;
+ }
+
+- /* Platforms with iDMA */
++ /* Platforms with iDMA 64-bit */
+ if (platform_get_resource_byname(to_platform_device(p->dev),
+ IORESOURCE_MEM, "lpss_priv")) {
+ data->dma.rx_param = p->dev->parent;
+diff --git a/drivers/usb/typec/fusb302/fusb302.c b/drivers/usb/typec/fusb302/fusb302.c
+index 82bed9810be6..62a0060d39d8 100644
+--- a/drivers/usb/typec/fusb302/fusb302.c
++++ b/drivers/usb/typec/fusb302/fusb302.c
+@@ -641,6 +641,8 @@ static int fusb302_set_toggling(struct fusb302_chip *chip,
+ return ret;
+ chip->intr_togdone = false;
+ } else {
++ /* Datasheet says vconn MUST be off when toggling */
++ WARN(chip->vconn_on, "Vconn is on during toggle start");
+ /* unmask TOGDONE interrupt */
+ ret = fusb302_i2c_clear_bits(chip, FUSB_REG_MASKA,
+ FUSB_REG_MASKA_TOGDONE);
+diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
+index 64833879f75d..7a386fb30bf1 100644
+--- a/drivers/vfio/vfio.c
++++ b/drivers/vfio/vfio.c
+@@ -34,6 +34,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/vfio.h>
+ #include <linux/wait.h>
++#include <linux/sched/signal.h>
+
+ #define DRIVER_VERSION "0.3"
+ #define DRIVER_AUTHOR "Alex Williamson <alex.williamson@redhat.com>"
+@@ -904,30 +905,17 @@ void *vfio_device_data(struct vfio_device *device)
+ }
+ EXPORT_SYMBOL_GPL(vfio_device_data);
+
+-/* Given a referenced group, check if it contains the device */
+-static bool vfio_dev_present(struct vfio_group *group, struct device *dev)
+-{
+- struct vfio_device *device;
+-
+- device = vfio_group_get_device(group, dev);
+- if (!device)
+- return false;
+-
+- vfio_device_put(device);
+- return true;
+-}
+-
+ /*
+ * Decrement the device reference count and wait for the device to be
+ * removed. Open file descriptors for the device... */
+ void *vfio_del_group_dev(struct device *dev)
+ {
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ struct vfio_device *device = dev_get_drvdata(dev);
+ struct vfio_group *group = device->group;
+ void *device_data = device->device_data;
+ struct vfio_unbound_dev *unbound;
+ unsigned int i = 0;
+- long ret;
+ bool interrupted = false;
+
+ /*
+@@ -964,6 +952,8 @@ void *vfio_del_group_dev(struct device *dev)
+ * interval with counter to allow the driver to take escalating
+ * measures to release the device if it has the ability to do so.
+ */
++ add_wait_queue(&vfio.release_q, &wait);
++
+ do {
+ device = vfio_group_get_device(group, dev);
+ if (!device)
+@@ -975,12 +965,10 @@ void *vfio_del_group_dev(struct device *dev)
+ vfio_device_put(device);
+
+ if (interrupted) {
+- ret = wait_event_timeout(vfio.release_q,
+- !vfio_dev_present(group, dev), HZ * 10);
++ wait_woken(&wait, TASK_UNINTERRUPTIBLE, HZ * 10);
+ } else {
+- ret = wait_event_interruptible_timeout(vfio.release_q,
+- !vfio_dev_present(group, dev), HZ * 10);
+- if (ret == -ERESTARTSYS) {
++ wait_woken(&wait, TASK_INTERRUPTIBLE, HZ * 10);
++ if (signal_pending(current)) {
+ interrupted = true;
+ dev_warn(dev,
+ "Device is currently in use, task"
+@@ -989,8 +977,10 @@ void *vfio_del_group_dev(struct device *dev)
+ current->comm, task_pid_nr(current));
+ }
+ }
+- } while (ret <= 0);
+
++ } while (1);
++
++ remove_wait_queue(&vfio.release_q, &wait);
+ /*
+ * In order to support multiple devices per group, devices can be
+ * plucked from the group while other devices in the group are still
+diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c
+index 463028543173..59e1cae57948 100644
+--- a/drivers/video/fbdev/hgafb.c
++++ b/drivers/video/fbdev/hgafb.c
+@@ -285,6 +285,8 @@ static int hga_card_detect(void)
+ hga_vram_len = 0x08000;
+
+ hga_vram = ioremap(0xb0000, hga_vram_len);
++ if (!hga_vram)
++ goto error;
+
+ if (request_region(0x3b0, 12, "hgafb"))
+ release_io_ports = 1;
+diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
+index ecdcf358ad5e..ffcf553719a3 100644
+--- a/drivers/video/fbdev/imsttfb.c
++++ b/drivers/video/fbdev/imsttfb.c
+@@ -1516,6 +1516,11 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ info->fix.smem_start = addr;
+ info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ?
+ 0x400000 : 0x800000);
++ if (!info->screen_base) {
++ release_mem_region(addr, size);
++ framebuffer_release(info);
++ return -ENOMEM;
++ }
+ info->fix.mmio_start = addr + 0x800000;
+ par->dc_regs = ioremap(addr + 0x800000, 0x1000);
+ par->cmap_regs_phys = addr + 0x840000;
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index 5ea8909a41f9..b165c46aca74 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -1967,6 +1967,7 @@ comment "Watchdog Pretimeout Governors"
+
+ config WATCHDOG_PRETIMEOUT_GOV
+ bool "Enable watchdog pretimeout governors"
++ depends on WATCHDOG_CORE
+ help
+ The option allows to select watchdog pretimeout governors.
+
+diff --git a/drivers/watchdog/imx2_wdt.c b/drivers/watchdog/imx2_wdt.c
+index 2b52514eaa86..7e7bdcbbc741 100644
+--- a/drivers/watchdog/imx2_wdt.c
++++ b/drivers/watchdog/imx2_wdt.c
+@@ -178,8 +178,10 @@ static void __imx2_wdt_set_timeout(struct watchdog_device *wdog,
+ static int imx2_wdt_set_timeout(struct watchdog_device *wdog,
+ unsigned int new_timeout)
+ {
+- __imx2_wdt_set_timeout(wdog, new_timeout);
++ unsigned int actual;
+
++ actual = min(new_timeout, wdog->max_hw_heartbeat_ms * 1000);
++ __imx2_wdt_set_timeout(wdog, actual);
+ wdog->timeout = new_timeout;
+ return 0;
+ }
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index 39843fa7e11b..920d350df37b 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -1755,12 +1755,19 @@ int configfs_register_group(struct config_group *parent_group,
+
+ inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+ ret = create_default_group(parent_group, group);
+- if (!ret) {
+- spin_lock(&configfs_dirent_lock);
+- configfs_dir_set_ready(group->cg_item.ci_dentry->d_fsdata);
+- spin_unlock(&configfs_dirent_lock);
+- }
++ if (ret)
++ goto err_out;
++
++ spin_lock(&configfs_dirent_lock);
++ configfs_dir_set_ready(group->cg_item.ci_dentry->d_fsdata);
++ spin_unlock(&configfs_dirent_lock);
++ inode_unlock(d_inode(parent));
++ return 0;
++err_out:
+ inode_unlock(d_inode(parent));
++ mutex_lock(&subsys->su_mutex);
++ unlink_group(group);
++ mutex_unlock(&subsys->su_mutex);
+ return ret;
+ }
+ EXPORT_SYMBOL(configfs_register_group);
+diff --git a/fs/dax.c b/fs/dax.c
+index 004c8ac1117c..75a289c31c7e 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -908,7 +908,7 @@ static void dax_mapping_entry_mkclean(struct address_space *mapping,
+ goto unlock_pmd;
+
+ flush_cache_page(vma, address, pfn);
+- pmd = pmdp_huge_clear_flush(vma, address, pmdp);
++ pmd = pmdp_invalidate(vma, address, pmdp);
+ pmd = pmd_wrprotect(pmd);
+ pmd = pmd_mkclean(pmd);
+ set_pmd_at(vma->vm_mm, address, pmdp, pmd);
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index a4b6eacf22ea..44ea7ac69ef4 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -1744,6 +1744,7 @@ enospc:
+ return -ENOSPC;
+ }
+
++void f2fs_msg(struct super_block *sb, const char *level, const char *fmt, ...);
+ static inline void dec_valid_block_count(struct f2fs_sb_info *sbi,
+ struct inode *inode,
+ block_t count)
+@@ -1752,13 +1753,21 @@ static inline void dec_valid_block_count(struct f2fs_sb_info *sbi,
+
+ spin_lock(&sbi->stat_lock);
+ f2fs_bug_on(sbi, sbi->total_valid_block_count < (block_t) count);
+- f2fs_bug_on(sbi, inode->i_blocks < sectors);
+ sbi->total_valid_block_count -= (block_t)count;
+ if (sbi->reserved_blocks &&
+ sbi->current_reserved_blocks < sbi->reserved_blocks)
+ sbi->current_reserved_blocks = min(sbi->reserved_blocks,
+ sbi->current_reserved_blocks + count);
+ spin_unlock(&sbi->stat_lock);
++ if (unlikely(inode->i_blocks < sectors)) {
++ f2fs_msg(sbi->sb, KERN_WARNING,
++ "Inconsistent i_blocks, ino:%lu, iblocks:%llu, sectors:%llu",
++ inode->i_ino,
++ (unsigned long long)inode->i_blocks,
++ (unsigned long long)sectors);
++ set_sbi_flag(sbi, SBI_NEED_FSCK);
++ return;
++ }
+ f2fs_i_blocks_write(inode, count, false, true);
+ }
+
+@@ -2488,7 +2497,9 @@ static inline void *inline_xattr_addr(struct inode *inode, struct page *page)
+
+ static inline int inline_xattr_size(struct inode *inode)
+ {
+- return get_inline_xattr_addrs(inode) * sizeof(__le32);
++ if (f2fs_has_inline_xattr(inode))
++ return get_inline_xattr_addrs(inode) * sizeof(__le32);
++ return 0;
+ }
+
+ static inline int f2fs_has_inline_data(struct inode *inode)
+@@ -2727,7 +2738,6 @@ static inline void f2fs_update_iostat(struct f2fs_sb_info *sbi,
+
+ bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi,
+ block_t blkaddr, int type);
+-void f2fs_msg(struct super_block *sb, const char *level, const char *fmt, ...);
+ static inline void verify_blkaddr(struct f2fs_sb_info *sbi,
+ block_t blkaddr, int type)
+ {
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index dd608b819a3c..0f31df01e36c 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -179,8 +179,8 @@ bool f2fs_inode_chksum_verify(struct f2fs_sb_info *sbi, struct page *page)
+
+ if (provided != calculated)
+ f2fs_msg(sbi->sb, KERN_WARNING,
+- "checksum invalid, ino = %x, %x vs. %x",
+- ino_of_node(page), provided, calculated);
++ "checksum invalid, nid = %lu, ino_of_node = %x, %x vs. %x",
++ page->index, ino_of_node(page), provided, calculated);
+
+ return provided == calculated;
+ }
+@@ -476,6 +476,7 @@ make_now:
+ return inode;
+
+ bad_inode:
++ f2fs_inode_synced(inode);
+ iget_failed(inode);
+ trace_f2fs_iget_exit(inode, ret);
+ return ERR_PTR(ret);
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 19a0d83aae65..e2d9edad758c 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1180,8 +1180,14 @@ int f2fs_remove_inode_page(struct inode *inode)
+ f2fs_put_dnode(&dn);
+ return -EIO;
+ }
+- f2fs_bug_on(F2FS_I_SB(inode),
+- inode->i_blocks != 0 && inode->i_blocks != 8);
++
++ if (unlikely(inode->i_blocks != 0 && inode->i_blocks != 8)) {
++ f2fs_msg(F2FS_I_SB(inode)->sb, KERN_WARNING,
++ "Inconsistent i_blocks, ino:%lu, iblocks:%llu",
++ inode->i_ino,
++ (unsigned long long)inode->i_blocks);
++ set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
++ }
+
+ /* will put inode & node pages */
+ err = truncate_node(&dn);
+@@ -1276,9 +1282,10 @@ static int read_node_page(struct page *page, int op_flags)
+ int err;
+
+ if (PageUptodate(page)) {
+-#ifdef CONFIG_F2FS_CHECK_FS
+- f2fs_bug_on(sbi, !f2fs_inode_chksum_verify(sbi, page));
+-#endif
++ if (!f2fs_inode_chksum_verify(sbi, page)) {
++ ClearPageUptodate(page);
++ return -EBADMSG;
++ }
+ return LOCKED_PAGE;
+ }
+
+@@ -2073,6 +2080,9 @@ static bool add_free_nid(struct f2fs_sb_info *sbi,
+ if (unlikely(nid == 0))
+ return false;
+
++ if (unlikely(f2fs_check_nid_range(sbi, nid)))
++ return false;
++
+ i = f2fs_kmem_cache_alloc(free_nid_slab, GFP_NOFS);
+ i->nid = nid;
+ i->state = FREE_NID;
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index ae0e5f2e67b4..bf5c5f4fa77e 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -485,7 +485,15 @@ retry_dn:
+ goto err;
+
+ f2fs_bug_on(sbi, ni.ino != ino_of_node(page));
+- f2fs_bug_on(sbi, ofs_of_node(dn.node_page) != ofs_of_node(page));
++
++ if (ofs_of_node(dn.node_page) != ofs_of_node(page)) {
++ f2fs_msg(sbi->sb, KERN_WARNING,
++ "Inconsistent ofs_of_node, ino:%lu, ofs:%u, %u",
++ inode->i_ino, ofs_of_node(dn.node_page),
++ ofs_of_node(page));
++ err = -EFAULT;
++ goto err;
++ }
+
+ for (; start < end; start++, dn.ofs_in_node++) {
+ block_t src, dest;
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 03fa2c4d3d79..8fc3edb6760c 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -3069,13 +3069,18 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
+ {
+ int err;
+ struct f2fs_sb_info *sbi = fio->sbi;
++ unsigned int segno;
+
+ fio->new_blkaddr = fio->old_blkaddr;
+ /* i/o temperature is needed for passing down write hints */
+ __get_segment_type(fio);
+
+- f2fs_bug_on(sbi, !IS_DATASEG(get_seg_entry(sbi,
+- GET_SEGNO(sbi, fio->new_blkaddr))->type));
++ segno = GET_SEGNO(sbi, fio->new_blkaddr);
++
++ if (!IS_DATASEG(get_seg_entry(sbi, segno)->type)) {
++ set_sbi_flag(sbi, SBI_NEED_FSCK);
++ return -EFAULT;
++ }
+
+ stat_inc_inplace_blocks(fio->sbi);
+
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index b3d9e317ff0c..5079532cb176 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -660,7 +660,6 @@ static inline void verify_block_addr(struct f2fs_io_info *fio, block_t blk_addr)
+ static inline int check_block_count(struct f2fs_sb_info *sbi,
+ int segno, struct f2fs_sit_entry *raw_sit)
+ {
+-#ifdef CONFIG_F2FS_CHECK_FS
+ bool is_valid = test_bit_le(0, raw_sit->valid_map) ? true : false;
+ int valid_blocks = 0;
+ int cur_pos = 0, next_pos;
+@@ -687,7 +686,7 @@ static inline int check_block_count(struct f2fs_sb_info *sbi,
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ return -EINVAL;
+ }
+-#endif
++
+ /* check segment usage, and check boundary of a given segment number */
+ if (unlikely(GET_SIT_VBLOCKS(raw_sit) > sbi->blocks_per_seg
+ || segno > TOTAL_SEGS(sbi) - 1)) {
+diff --git a/fs/fat/file.c b/fs/fat/file.c
+index 4f3d72fb1e60..f86ea08bd6ce 100644
+--- a/fs/fat/file.c
++++ b/fs/fat/file.c
+@@ -193,12 +193,17 @@ static int fat_file_release(struct inode *inode, struct file *filp)
+ int fat_file_fsync(struct file *filp, loff_t start, loff_t end, int datasync)
+ {
+ struct inode *inode = filp->f_mapping->host;
+- int res, err;
++ int err;
++
++ err = __generic_file_fsync(filp, start, end, datasync);
++ if (err)
++ return err;
+
+- res = generic_file_fsync(filp, start, end, datasync);
+ err = sync_mapping_buffers(MSDOS_SB(inode->i_sb)->fat_inode->i_mapping);
++ if (err)
++ return err;
+
+- return res ? res : err;
++ return blkdev_issue_flush(inode->i_sb->s_bdev, GFP_KERNEL, NULL);
+ }
+
+
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 249de20f752a..6ee471b72a34 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -1681,7 +1681,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
+ offset = outarg->offset & ~PAGE_MASK;
+ file_size = i_size_read(inode);
+
+- num = outarg->size;
++ num = min(outarg->size, fc->max_write);
+ if (outarg->offset > file_size)
+ num = 0;
+ else if (outarg->offset + num > file_size)
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 418fa9c78186..db0beefe65ec 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -2413,8 +2413,10 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
+ __be32 status;
+ int err;
+ struct nfs4_acl *acl = NULL;
++#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+ void *context = NULL;
+ int contextlen;
++#endif
+ bool contextsupport = false;
+ struct nfsd4_compoundres *resp = rqstp->rq_resp;
+ u32 minorversion = resp->cstate.minorversion;
+@@ -2899,12 +2901,14 @@ out_acl:
+ *p++ = cpu_to_be32(NFS4_CHANGE_TYPE_IS_TIME_METADATA);
+ }
+
++#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
+ if (bmval2 & FATTR4_WORD2_SECURITY_LABEL) {
+ status = nfsd4_encode_security_label(xdr, rqstp, context,
+ contextlen);
+ if (status)
+ goto out;
+ }
++#endif
+
+ attrlen = htonl(xdr->buf->len - attrlen_offset - 4);
+ write_bytes_to_xdr_buf(xdr->buf, attrlen_offset, &attrlen, 4);
+diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h
+index a7e107309f76..db351247892d 100644
+--- a/fs/nfsd/vfs.h
++++ b/fs/nfsd/vfs.h
+@@ -120,8 +120,11 @@ void nfsd_put_raparams(struct file *file, struct raparms *ra);
+
+ static inline int fh_want_write(struct svc_fh *fh)
+ {
+- int ret = mnt_want_write(fh->fh_export->ex_path.mnt);
++ int ret;
+
++ if (fh->fh_want_write)
++ return 0;
++ ret = mnt_want_write(fh->fh_export->ex_path.mnt);
+ if (!ret)
+ fh->fh_want_write = true;
+ return ret;
+diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
+index 0c810f20f778..00338b828f76 100644
+--- a/fs/overlayfs/file.c
++++ b/fs/overlayfs/file.c
+@@ -11,6 +11,7 @@
+ #include <linux/mount.h>
+ #include <linux/xattr.h>
+ #include <linux/uio.h>
++#include <linux/uaccess.h>
+ #include "overlayfs.h"
+
+ static char ovl_whatisit(struct inode *inode, struct inode *realinode)
+@@ -29,10 +30,11 @@ static struct file *ovl_open_realfile(const struct file *file,
+ struct inode *inode = file_inode(file);
+ struct file *realfile;
+ const struct cred *old_cred;
++ int flags = file->f_flags | O_NOATIME | FMODE_NONOTIFY;
+
+ old_cred = ovl_override_creds(inode->i_sb);
+- realfile = open_with_fake_path(&file->f_path, file->f_flags | O_NOATIME,
+- realinode, current_cred());
++ realfile = open_with_fake_path(&file->f_path, flags, realinode,
++ current_cred());
+ revert_creds(old_cred);
+
+ pr_debug("open(%p[%pD2/%c], 0%o) -> (%p, 0%o)\n",
+@@ -50,7 +52,7 @@ static int ovl_change_flags(struct file *file, unsigned int flags)
+ int err;
+
+ /* No atime modificaton on underlying */
+- flags |= O_NOATIME;
++ flags |= O_NOATIME | FMODE_NONOTIFY;
+
+ /* If some flag changed that cannot be changed then something's amiss */
+ if (WARN_ON((file->f_flags ^ flags) & ~OVL_SETFL_MASK))
+@@ -144,11 +146,47 @@ static int ovl_release(struct inode *inode, struct file *file)
+
+ static loff_t ovl_llseek(struct file *file, loff_t offset, int whence)
+ {
+- struct inode *realinode = ovl_inode_real(file_inode(file));
++ struct inode *inode = file_inode(file);
++ struct fd real;
++ const struct cred *old_cred;
++ ssize_t ret;
++
++ /*
++ * The two special cases below do not need to involve real fs,
++ * so we can optimizing concurrent callers.
++ */
++ if (offset == 0) {
++ if (whence == SEEK_CUR)
++ return file->f_pos;
++
++ if (whence == SEEK_SET)
++ return vfs_setpos(file, 0, 0);
++ }
++
++ ret = ovl_real_fdget(file, &real);
++ if (ret)
++ return ret;
++
++ /*
++ * Overlay file f_pos is the master copy that is preserved
++ * through copy up and modified on read/write, but only real
++ * fs knows how to SEEK_HOLE/SEEK_DATA and real fs may impose
++ * limitations that are more strict than ->s_maxbytes for specific
++ * files, so we use the real file to perform seeks.
++ */
++ inode_lock(inode);
++ real.file->f_pos = file->f_pos;
++
++ old_cred = ovl_override_creds(inode->i_sb);
++ ret = vfs_llseek(real.file, offset, whence);
++ revert_creds(old_cred);
++
++ file->f_pos = real.file->f_pos;
++ inode_unlock(inode);
++
++ fdput(real);
+
+- return generic_file_llseek_size(file, offset, whence,
+- realinode->i_sb->s_maxbytes,
+- i_size_read(realinode));
++ return ret;
+ }
+
+ static void ovl_file_accessed(struct file *file)
+@@ -371,10 +409,68 @@ static long ovl_real_ioctl(struct file *file, unsigned int cmd,
+ return ret;
+ }
+
+-static long ovl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++static unsigned int ovl_get_inode_flags(struct inode *inode)
++{
++ unsigned int flags = READ_ONCE(inode->i_flags);
++ unsigned int ovl_iflags = 0;
++
++ if (flags & S_SYNC)
++ ovl_iflags |= FS_SYNC_FL;
++ if (flags & S_APPEND)
++ ovl_iflags |= FS_APPEND_FL;
++ if (flags & S_IMMUTABLE)
++ ovl_iflags |= FS_IMMUTABLE_FL;
++ if (flags & S_NOATIME)
++ ovl_iflags |= FS_NOATIME_FL;
++
++ return ovl_iflags;
++}
++
++static long ovl_ioctl_set_flags(struct file *file, unsigned long arg)
+ {
+ long ret;
+ struct inode *inode = file_inode(file);
++ unsigned int flags;
++ unsigned int old_flags;
++
++ if (!inode_owner_or_capable(inode))
++ return -EACCES;
++
++ if (get_user(flags, (int __user *) arg))
++ return -EFAULT;
++
++ ret = mnt_want_write_file(file);
++ if (ret)
++ return ret;
++
++ inode_lock(inode);
++
++ /* Check the capability before cred override */
++ ret = -EPERM;
++ old_flags = ovl_get_inode_flags(inode);
++ if (((flags ^ old_flags) & (FS_APPEND_FL | FS_IMMUTABLE_FL)) &&
++ !capable(CAP_LINUX_IMMUTABLE))
++ goto unlock;
++
++ ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY);
++ if (ret)
++ goto unlock;
++
++ ret = ovl_real_ioctl(file, FS_IOC_SETFLAGS, arg);
++
++ ovl_copyflags(ovl_inode_real(inode), inode);
++unlock:
++ inode_unlock(inode);
++
++ mnt_drop_write_file(file);
++
++ return ret;
++
++}
++
++static long ovl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++ long ret;
+
+ switch (cmd) {
+ case FS_IOC_GETFLAGS:
+@@ -382,23 +478,7 @@ static long ovl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ break;
+
+ case FS_IOC_SETFLAGS:
+- if (!inode_owner_or_capable(inode))
+- return -EACCES;
+-
+- ret = mnt_want_write_file(file);
+- if (ret)
+- return ret;
+-
+- ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY);
+- if (!ret) {
+- ret = ovl_real_ioctl(file, cmd, arg);
+-
+- inode_lock(inode);
+- ovl_copyflags(ovl_inode_real(inode), inode);
+- inode_unlock(inode);
+- }
+-
+- mnt_drop_write_file(file);
++ ret = ovl_ioctl_set_flags(file, arg);
+ break;
+
+ default:
+diff --git a/include/linux/pwm.h b/include/linux/pwm.h
+index 56518adc31dd..bd7d611d63e9 100644
+--- a/include/linux/pwm.h
++++ b/include/linux/pwm.h
+@@ -639,7 +639,6 @@ static inline void pwm_remove_table(struct pwm_lookup *table, size_t num)
+ #ifdef CONFIG_PWM_SYSFS
+ void pwmchip_sysfs_export(struct pwm_chip *chip);
+ void pwmchip_sysfs_unexport(struct pwm_chip *chip);
+-void pwmchip_sysfs_unexport_children(struct pwm_chip *chip);
+ #else
+ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
+ {
+@@ -648,10 +647,6 @@ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
+ static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip)
+ {
+ }
+-
+-static inline void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+-{
+-}
+ #endif /* CONFIG_PWM_SYSFS */
+
+ #endif /* __LINUX_PWM_H */
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index cc2d0c3b475b..1dfb75057580 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -182,9 +182,6 @@ struct adv_info {
+
+ #define HCI_MAX_SHORT_NAME_LENGTH 10
+
+-/* Min encryption key size to match with SMP */
+-#define HCI_MIN_ENC_KEY_SIZE 7
+-
+ /* Default LE RPA expiry time, 15 minutes */
+ #define HCI_DEFAULT_RPA_TIMEOUT (15 * 60)
+
+diff --git a/init/initramfs.c b/init/initramfs.c
+index f6f4a1e4cd54..cd5fb00fcb54 100644
+--- a/init/initramfs.c
++++ b/init/initramfs.c
+@@ -612,13 +612,12 @@ static int __init populate_rootfs(void)
+ printk(KERN_INFO "Trying to unpack rootfs image as initramfs...\n");
+ err = unpack_to_rootfs((char *)initrd_start,
+ initrd_end - initrd_start);
+- if (!err) {
+- free_initrd();
++ if (!err)
+ goto done;
+- } else {
+- clean_rootfs();
+- unpack_to_rootfs(__initramfs_start, __initramfs_size);
+- }
++
++ clean_rootfs();
++ unpack_to_rootfs(__initramfs_start, __initramfs_size);
++
+ printk(KERN_INFO "rootfs image is not initramfs (%s)"
+ "; looks like an initrd\n", err);
+ fd = ksys_open("/initrd.image",
+@@ -632,7 +631,6 @@ static int __init populate_rootfs(void)
+ written, initrd_end - initrd_start);
+
+ ksys_close(fd);
+- free_initrd();
+ }
+ done:
+ /* empty statement */;
+@@ -642,9 +640,9 @@ static int __init populate_rootfs(void)
+ initrd_end - initrd_start);
+ if (err)
+ printk(KERN_EMERG "Initramfs unpacking failed: %s\n", err);
+- free_initrd();
+ #endif
+ }
++ free_initrd();
+ flush_delayed_fput();
+ /*
+ * Try loading default modules from initramfs. This gives
+diff --git a/ipc/mqueue.c b/ipc/mqueue.c
+index c0d58f390c3b..bce7af1546d9 100644
+--- a/ipc/mqueue.c
++++ b/ipc/mqueue.c
+@@ -391,7 +391,8 @@ static void mqueue_evict_inode(struct inode *inode)
+ struct user_struct *user;
+ unsigned long mq_bytes, mq_treesize;
+ struct ipc_namespace *ipc_ns;
+- struct msg_msg *msg;
++ struct msg_msg *msg, *nmsg;
++ LIST_HEAD(tmp_msg);
+
+ clear_inode(inode);
+
+@@ -402,10 +403,15 @@ static void mqueue_evict_inode(struct inode *inode)
+ info = MQUEUE_I(inode);
+ spin_lock(&info->lock);
+ while ((msg = msg_get(info)) != NULL)
+- free_msg(msg);
++ list_add_tail(&msg->m_list, &tmp_msg);
+ kfree(info->node_cache);
+ spin_unlock(&info->lock);
+
++ list_for_each_entry_safe(msg, nmsg, &tmp_msg, m_list) {
++ list_del(&msg->m_list);
++ free_msg(msg);
++ }
++
+ /* Total amount of bytes accounted for the mqueue */
+ mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +
+ min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *
+diff --git a/ipc/msgutil.c b/ipc/msgutil.c
+index 84598025a6ad..e65593742e2b 100644
+--- a/ipc/msgutil.c
++++ b/ipc/msgutil.c
+@@ -18,6 +18,7 @@
+ #include <linux/utsname.h>
+ #include <linux/proc_ns.h>
+ #include <linux/uaccess.h>
++#include <linux/sched.h>
+
+ #include "util.h"
+
+@@ -64,6 +65,9 @@ static struct msg_msg *alloc_msg(size_t len)
+ pseg = &msg->next;
+ while (len > 0) {
+ struct msg_msgseg *seg;
++
++ cond_resched();
++
+ alen = min(len, DATALEN_SEG);
+ seg = kmalloc(sizeof(*seg) + alen, GFP_KERNEL_ACCOUNT);
+ if (seg == NULL)
+@@ -176,6 +180,8 @@ void free_msg(struct msg_msg *msg)
+ kfree(msg);
+ while (seg != NULL) {
+ struct msg_msgseg *tmp = seg->next;
++
++ cond_resched();
+ kfree(seg);
+ seg = tmp;
+ }
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index acc2305ad895..d3580a68dbef 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -5743,7 +5743,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
+ insn->dst_reg,
+ shift);
+ insn_buf[cnt++] = BPF_ALU64_IMM(BPF_AND, insn->dst_reg,
+- (1 << size * 8) - 1);
++ (1ULL << size * 8) - 1);
+ }
+ }
+
+diff --git a/kernel/sys.c b/kernel/sys.c
+index 123bd73046ec..096932a45046 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1919,7 +1919,7 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map)
+ ((unsigned long)prctl_map->__m1 __op \
+ (unsigned long)prctl_map->__m2) ? 0 : -EINVAL
+ error = __prctl_check_order(start_code, <, end_code);
+- error |= __prctl_check_order(start_data, <, end_data);
++ error |= __prctl_check_order(start_data,<=, end_data);
+ error |= __prctl_check_order(start_brk, <=, brk);
+ error |= __prctl_check_order(arg_start, <=, arg_end);
+ error |= __prctl_check_order(env_start, <=, env_end);
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 9a85c7ae7362..f8576509c7be 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2791,8 +2791,10 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
+ if (neg)
+ continue;
+ val = convmul * val / convdiv;
+- if ((min && val < *min) || (max && val > *max))
+- continue;
++ if ((min && val < *min) || (max && val > *max)) {
++ err = -EINVAL;
++ break;
++ }
+ *i = val;
+ } else {
+ val = convdiv * (*i) / convmul;
+diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
+index c5e0cba3b39c..6b23cd584295 100644
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -698,7 +698,7 @@ static inline void process_adjtimex_modes(const struct timex *txc, s32 *time_tai
+ time_constant = max(time_constant, 0l);
+ }
+
+- if (txc->modes & ADJ_TAI && txc->constant > 0)
++ if (txc->modes & ADJ_TAI && txc->constant >= 0)
+ *time_tai = txc->constant;
+
+ if (txc->modes & ADJ_OFFSET)
+diff --git a/mm/Kconfig b/mm/Kconfig
+index de64ea658716..b457e94ae618 100644
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -700,12 +700,12 @@ config DEV_PAGEMAP_OPS
+
+ config HMM
+ bool
++ select MMU_NOTIFIER
+ select MIGRATE_VMA_HELPER
+
+ config HMM_MIRROR
+ bool "HMM mirror CPU page table into a device page table"
+ depends on ARCH_HAS_HMM
+- select MMU_NOTIFIER
+ select HMM
+ help
+ Select HMM_MIRROR if you want to mirror range of the CPU page table of a
+diff --git a/mm/cma.c b/mm/cma.c
+index bfe9f5397165..476dfe13a701 100644
+--- a/mm/cma.c
++++ b/mm/cma.c
+@@ -106,8 +106,10 @@ static int __init cma_activate_area(struct cma *cma)
+
+ cma->bitmap = kzalloc(bitmap_size, GFP_KERNEL);
+
+- if (!cma->bitmap)
++ if (!cma->bitmap) {
++ cma->count = 0;
+ return -ENOMEM;
++ }
+
+ WARN_ON_ONCE(!pfn_valid(pfn));
+ zone = page_zone(pfn_to_page(pfn));
+@@ -369,23 +371,26 @@ err:
+ #ifdef CONFIG_CMA_DEBUG
+ static void cma_debug_show_areas(struct cma *cma)
+ {
+- unsigned long next_zero_bit, next_set_bit;
++ unsigned long next_zero_bit, next_set_bit, nr_zero;
+ unsigned long start = 0;
+- unsigned int nr_zero, nr_total = 0;
++ unsigned long nr_part, nr_total = 0;
++ unsigned long nbits = cma_bitmap_maxno(cma);
+
+ mutex_lock(&cma->lock);
+ pr_info("number of available pages: ");
+ for (;;) {
+- next_zero_bit = find_next_zero_bit(cma->bitmap, cma->count, start);
+- if (next_zero_bit >= cma->count)
++ next_zero_bit = find_next_zero_bit(cma->bitmap, nbits, start);
++ if (next_zero_bit >= nbits)
+ break;
+- next_set_bit = find_next_bit(cma->bitmap, cma->count, next_zero_bit);
++ next_set_bit = find_next_bit(cma->bitmap, nbits, next_zero_bit);
+ nr_zero = next_set_bit - next_zero_bit;
+- pr_cont("%s%u@%lu", nr_total ? "+" : "", nr_zero, next_zero_bit);
+- nr_total += nr_zero;
++ nr_part = nr_zero << cma->order_per_bit;
++ pr_cont("%s%lu@%lu", nr_total ? "+" : "", nr_part,
++ next_zero_bit);
++ nr_total += nr_part;
+ start = next_zero_bit + nr_zero;
+ }
+- pr_cont("=> %u free of %lu total pages\n", nr_total, cma->count);
++ pr_cont("=> %lu free of %lu total pages\n", nr_total, cma->count);
+ mutex_unlock(&cma->lock);
+ }
+ #else
+diff --git a/mm/cma_debug.c b/mm/cma_debug.c
+index ad6723e9d110..3e0415076cc9 100644
+--- a/mm/cma_debug.c
++++ b/mm/cma_debug.c
+@@ -58,7 +58,7 @@ static int cma_maxchunk_get(void *data, u64 *val)
+ mutex_lock(&cma->lock);
+ for (;;) {
+ start = find_next_zero_bit(cma->bitmap, bitmap_maxno, end);
+- if (start >= cma->count)
++ if (start >= bitmap_maxno)
+ break;
+ end = find_next_bit(cma->bitmap, bitmap_maxno, start);
+ maxchunk = max(end - start, maxchunk);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 0bbb033d7d8c..65179513c2b2 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1256,12 +1256,23 @@ void free_huge_page(struct page *page)
+ ClearPagePrivate(page);
+
+ /*
+- * A return code of zero implies that the subpool will be under its
+- * minimum size if the reservation is not restored after page is free.
+- * Therefore, force restore_reserve operation.
++ * If PagePrivate() was set on page, page allocation consumed a
++ * reservation. If the page was associated with a subpool, there
++ * would have been a page reserved in the subpool before allocation
++ * via hugepage_subpool_get_pages(). Since we are 'restoring' the
++ * reservtion, do not call hugepage_subpool_put_pages() as this will
++ * remove the reserved page from the subpool.
+ */
+- if (hugepage_subpool_put_pages(spool, 1) == 0)
+- restore_reserve = true;
++ if (!restore_reserve) {
++ /*
++ * A return code of zero implies that the subpool will be
++ * under its minimum size if the reservation is not restored
++ * after page is free. Therefore, force restore_reserve
++ * operation.
++ */
++ if (hugepage_subpool_put_pages(spool, 1) == 0)
++ restore_reserve = true;
++ }
+
+ spin_lock(&hugetlb_lock);
+ clear_page_huge_active(page);
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 8e6932a140b8..2d04bd2e1ced 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5937,13 +5937,15 @@ static unsigned long __meminit zone_spanned_pages_in_node(int nid,
+ unsigned long *zone_end_pfn,
+ unsigned long *ignored)
+ {
++ unsigned long zone_low = arch_zone_lowest_possible_pfn[zone_type];
++ unsigned long zone_high = arch_zone_highest_possible_pfn[zone_type];
+ /* When hotadd a new node from cpu_up(), the node should be empty */
+ if (!node_start_pfn && !node_end_pfn)
+ return 0;
+
+ /* Get the start and end of the zone */
+- *zone_start_pfn = arch_zone_lowest_possible_pfn[zone_type];
+- *zone_end_pfn = arch_zone_highest_possible_pfn[zone_type];
++ *zone_start_pfn = clamp(node_start_pfn, zone_low, zone_high);
++ *zone_end_pfn = clamp(node_end_pfn, zone_low, zone_high);
+ adjust_zone_range_for_zone_movable(nid, zone_type,
+ node_start_pfn, node_end_pfn,
+ zone_start_pfn, zone_end_pfn);
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 41e58f3d8fbf..ff76fa0b7528 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -988,7 +988,8 @@ static int pcpu_alloc_area(struct pcpu_chunk *chunk, int alloc_bits,
+ /*
+ * Search to find a fit.
+ */
+- end = start + alloc_bits + PCPU_BITMAP_BLOCK_BITS;
++ end = min_t(int, start + alloc_bits + PCPU_BITMAP_BLOCK_BITS,
++ pcpu_chunk_map_bits(chunk));
+ bit_off = bitmap_find_next_zero_area(chunk->alloc_map, end, start,
+ alloc_bits, align_mask);
+ if (bit_off >= end)
+@@ -1721,6 +1722,7 @@ void free_percpu(void __percpu *ptr)
+ struct pcpu_chunk *chunk;
+ unsigned long flags;
+ int off;
++ bool need_balance = false;
+
+ if (!ptr)
+ return;
+@@ -1742,7 +1744,7 @@ void free_percpu(void __percpu *ptr)
+
+ list_for_each_entry(pos, &pcpu_slot[pcpu_nr_slots - 1], list)
+ if (pos != chunk) {
+- pcpu_schedule_balance_work();
++ need_balance = true;
+ break;
+ }
+ }
+@@ -1750,6 +1752,9 @@ void free_percpu(void __percpu *ptr)
+ trace_percpu_free_percpu(chunk->base_addr, off, ptr);
+
+ spin_unlock_irqrestore(&pcpu_lock, flags);
++
++ if (need_balance)
++ pcpu_schedule_balance_work();
+ }
+ EXPORT_SYMBOL_GPL(free_percpu);
+
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 85b7f9423352..f048c2651954 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -926,7 +926,7 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
+ continue;
+
+ flush_cache_page(vma, address, page_to_pfn(page));
+- entry = pmdp_huge_clear_flush(vma, address, pmd);
++ entry = pmdp_invalidate(vma, address, pmd);
+ entry = pmd_wrprotect(entry);
+ entry = pmd_mkclean(entry);
+ set_pmd_at(vma->vm_mm, address, pmd, entry);
+diff --git a/mm/slab.c b/mm/slab.c
+index 018d32496e8d..46f21e73db2f 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -4326,8 +4326,12 @@ static int leaks_show(struct seq_file *m, void *p)
+ * whole processing.
+ */
+ do {
+- set_store_user_clean(cachep);
+ drain_cpu_caches(cachep);
++ /*
++ * drain_cpu_caches() could make kmemleak_object and
++ * debug_objects_cache dirty, so reset afterwards.
++ */
++ set_store_user_clean(cachep);
+
+ x[1] = 0;
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 3cf0764d5793..bd4978ce8c45 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1276,14 +1276,6 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
+ !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ return 0;
+
+- /* The minimum encryption key size needs to be enforced by the
+- * host stack before establishing any L2CAP connections. The
+- * specification in theory allows a minimum of 1, but to align
+- * BR/EDR and LE transports, a minimum of 7 is chosen.
+- */
+- if (conn->enc_key_size < HCI_MIN_ENC_KEY_SIZE)
+- return 0;
+-
+ return 1;
+ }
+
+diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
+index 1601275efe2d..4c2ef42e189c 100644
+--- a/net/netfilter/nf_conntrack_h323_asn1.c
++++ b/net/netfilter/nf_conntrack_h323_asn1.c
+@@ -172,7 +172,7 @@ static int nf_h323_error_boundary(struct bitstr *bs, size_t bytes, size_t bits)
+ if (bits % BITS_PER_BYTE > 0)
+ bytes++;
+
+- if (*bs->cur + bytes > *bs->end)
++ if (bs->cur + bytes > bs->end)
+ return 1;
+
+ return 0;
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index e1537ace2b90..5df7486bb416 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -185,14 +185,25 @@ static const struct rhashtable_params nf_flow_offload_rhash_params = {
+
+ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
+ {
+- flow->timeout = (u32)jiffies;
++ int err;
+
+- rhashtable_insert_fast(&flow_table->rhashtable,
+- &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
+- nf_flow_offload_rhash_params);
+- rhashtable_insert_fast(&flow_table->rhashtable,
+- &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
+- nf_flow_offload_rhash_params);
++ err = rhashtable_insert_fast(&flow_table->rhashtable,
++ &flow->tuplehash[0].node,
++ nf_flow_offload_rhash_params);
++ if (err < 0)
++ return err;
++
++ err = rhashtable_insert_fast(&flow_table->rhashtable,
++ &flow->tuplehash[1].node,
++ nf_flow_offload_rhash_params);
++ if (err < 0) {
++ rhashtable_remove_fast(&flow_table->rhashtable,
++ &flow->tuplehash[0].node,
++ nf_flow_offload_rhash_params);
++ return err;
++ }
++
++ flow->timeout = (u32)jiffies;
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(flow_offload_add);
+diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
+index 15ed91309992..129e9ec99ec9 100644
+--- a/net/netfilter/nf_flow_table_ip.c
++++ b/net/netfilter/nf_flow_table_ip.c
+@@ -181,6 +181,9 @@ static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
+ iph->protocol != IPPROTO_UDP)
+ return -1;
+
++ if (iph->ttl <= 1)
++ return -1;
++
+ thoff = iph->ihl * 4;
+ if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
+ return -1;
+@@ -412,6 +415,9 @@ static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
+ ip6h->nexthdr != IPPROTO_UDP)
+ return -1;
+
++ if (ip6h->hop_limit <= 1)
++ return -1;
++
+ thoff = sizeof(*ip6h);
+ if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
+ return -1;
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index ebfcfe1dcbdb..29ff59dd99ac 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1142,6 +1142,9 @@ static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
+ u64 pkts, bytes;
+ int cpu;
+
++ if (!stats)
++ return 0;
++
+ memset(&total, 0, sizeof(total));
+ for_each_possible_cpu(cpu) {
+ cpu_stats = per_cpu_ptr(stats, cpu);
+@@ -1199,6 +1202,7 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
+ if (nft_is_base_chain(chain)) {
+ const struct nft_base_chain *basechain = nft_base_chain(chain);
+ const struct nf_hook_ops *ops = &basechain->ops;
++ struct nft_stats __percpu *stats;
+ struct nlattr *nest;
+
+ nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
+@@ -1220,8 +1224,9 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
+ if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
+ goto nla_put_failure;
+
+- if (rcu_access_pointer(basechain->stats) &&
+- nft_dump_stats(skb, rcu_dereference(basechain->stats)))
++ stats = rcu_dereference_check(basechain->stats,
++ lockdep_commit_lock_is_held(net));
++ if (nft_dump_stats(skb, stats))
+ goto nla_put_failure;
+ }
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 436cc14cfc59..7f85af4c40ff 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -113,6 +113,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ if (ret < 0)
+ goto err_flow_add;
+
++ dst_release(route.tuple[!dir].dst);
+ return;
+
+ err_flow_add:
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index 24d90abfc64d..da31aa8e216e 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -550,10 +550,10 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
+ list_del_init(list);
+ grp->exclusive = 0;
+ write_unlock_irq(&grp->list_lock);
+- up_write(&grp->list_mutex);
+
+ if (!empty)
+ unsubscribe_port(client, port, grp, &subs->info, ack);
++ up_write(&grp->list_mutex);
+ }
+
+ /* connect two ports */
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 9bc8a7cb40ea..45bf89ed31de 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1883,9 +1883,6 @@ static int azx_first_init(struct azx *chip)
+ chip->msi = 0;
+ }
+
+- if (azx_acquire_irq(chip, 0) < 0)
+- return -EBUSY;
+-
+ pci_set_master(pci);
+ synchronize_irq(bus->irq);
+
+@@ -2000,6 +1997,9 @@ static int azx_first_init(struct azx *chip)
+ return -ENODEV;
+ }
+
++ if (azx_acquire_irq(chip, 0) < 0)
++ return -EBUSY;
++
+ strcpy(card->driver, "HDA-Intel");
+ strlcpy(card->shortname, driver_short_names[chip->driver_type],
+ sizeof(card->shortname));
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 46be34576620..02a47e365e52 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -28,6 +28,8 @@
+ #include <linux/hashtable.h>
+ #include <linux/kernel.h>
+
++#define FAKE_JUMP_OFFSET -1
++
+ struct alternative {
+ struct list_head list;
+ struct instruction *insn;
+@@ -501,7 +503,7 @@ static int add_jump_destinations(struct objtool_file *file)
+ insn->type != INSN_JUMP_UNCONDITIONAL)
+ continue;
+
+- if (insn->ignore)
++ if (insn->ignore || insn->offset == FAKE_JUMP_OFFSET)
+ continue;
+
+ rela = find_rela_by_dest_range(insn->sec, insn->offset,
+@@ -670,10 +672,10 @@ static int handle_group_alt(struct objtool_file *file,
+ clear_insn_state(&fake_jump->state);
+
+ fake_jump->sec = special_alt->new_sec;
+- fake_jump->offset = -1;
++ fake_jump->offset = FAKE_JUMP_OFFSET;
+ fake_jump->type = INSN_JUMP_UNCONDITIONAL;
+ fake_jump->jump_dest = list_next_entry(last_orig_insn, list);
+- fake_jump->ignore = true;
++ fake_jump->func = orig_insn->func;
+ }
+
+ if (!special_alt->new_len) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-06-17 19:22 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-06-17 19:22 UTC (permalink / raw
To: gentoo-commits
commit: 9db3a118db892aac5c24e1f13dbc2b74eaa998bb
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Jun 17 19:21:58 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Jun 17 19:21:58 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9db3a118
Linux patch 4.19.52
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1051_linux-4.19.52.patch | 253 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 257 insertions(+)
diff --git a/0000_README b/0000_README
index 5b58ca2..9c779f7 100644
--- a/0000_README
+++ b/0000_README
@@ -247,6 +247,10 @@ Patch: 1050_linux-4.19.51.patch
From: http://www.kernel.org
Desc: Linux 4.19.51
+Patch: 1051_linux-4.19.52.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.52
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1051_linux-4.19.52.patch b/1051_linux-4.19.52.patch
new file mode 100644
index 0000000..06d34b6
--- /dev/null
+++ b/1051_linux-4.19.52.patch
@@ -0,0 +1,253 @@
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index 2c31208528d5..7eb9366422f5 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -250,6 +250,14 @@ tcp_base_mss - INTEGER
+ Path MTU discovery (MTU probing). If MTU probing is enabled,
+ this is the initial MSS used by the connection.
+
++tcp_min_snd_mss - INTEGER
++ TCP SYN and SYNACK messages usually advertise an ADVMSS option,
++ as described in RFC 1122 and RFC 6691.
++ If this ADVMSS option is smaller than tcp_min_snd_mss,
++ it is silently capped to tcp_min_snd_mss.
++
++ Default : 48 (at least 8 bytes of payload per segment)
++
+ tcp_congestion_control - STRING
+ Set the congestion control algorithm to be used for new
+ connections. The algorithm "reno" is always available, but
+diff --git a/Makefile b/Makefile
+index dd4be2f32b88..c82ee02ad9be 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 51
++SUBLEVEL = 52
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/include/linux/tcp.h b/include/linux/tcp.h
+index d2c8f280e48f..4374196b98ea 100644
+--- a/include/linux/tcp.h
++++ b/include/linux/tcp.h
+@@ -485,4 +485,8 @@ static inline u16 tcp_mss_clamp(const struct tcp_sock *tp, u16 mss)
+
+ return (user_mss && user_mss < mss) ? user_mss : mss;
+ }
++
++int tcp_skb_shift(struct sk_buff *to, struct sk_buff *from, int pcount,
++ int shiftlen);
++
+ #endif /* _LINUX_TCP_H */
+diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
+index 622db6bc2f02..366e2a60010e 100644
+--- a/include/net/netns/ipv4.h
++++ b/include/net/netns/ipv4.h
+@@ -114,6 +114,7 @@ struct netns_ipv4 {
+ #endif
+ int sysctl_tcp_mtu_probing;
+ int sysctl_tcp_base_mss;
++ int sysctl_tcp_min_snd_mss;
+ int sysctl_tcp_probe_threshold;
+ u32 sysctl_tcp_probe_interval;
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 770917d0caa7..e75661f92daa 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -55,6 +55,8 @@ void tcp_time_wait(struct sock *sk, int state, int timeo);
+
+ #define MAX_TCP_HEADER (128 + MAX_HEADER)
+ #define MAX_TCP_OPTION_SPACE 40
++#define TCP_MIN_SND_MSS 48
++#define TCP_MIN_GSO_SIZE (TCP_MIN_SND_MSS - MAX_TCP_OPTION_SPACE)
+
+ /*
+ * Never offer a window over 32767 without using window scaling. Some
+diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
+index f80135e5feaa..abae27c3001c 100644
+--- a/include/uapi/linux/snmp.h
++++ b/include/uapi/linux/snmp.h
+@@ -282,6 +282,7 @@ enum
+ LINUX_MIB_TCPACKCOMPRESSED, /* TCPAckCompressed */
+ LINUX_MIB_TCPZEROWINDOWDROP, /* TCPZeroWindowDrop */
+ LINUX_MIB_TCPRCVQDROP, /* TCPRcvQDrop */
++ LINUX_MIB_TCPWQUEUETOOBIG, /* TCPWqueueTooBig */
+ __LINUX_MIB_MAX
+ };
+
+diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
+index 70289682a670..eab5c02da8ae 100644
+--- a/net/ipv4/proc.c
++++ b/net/ipv4/proc.c
+@@ -290,6 +290,7 @@ static const struct snmp_mib snmp4_net_list[] = {
+ SNMP_MIB_ITEM("TCPAckCompressed", LINUX_MIB_TCPACKCOMPRESSED),
+ SNMP_MIB_ITEM("TCPZeroWindowDrop", LINUX_MIB_TCPZEROWINDOWDROP),
+ SNMP_MIB_ITEM("TCPRcvQDrop", LINUX_MIB_TCPRCVQDROP),
++ SNMP_MIB_ITEM("TCPWqueueTooBig", LINUX_MIB_TCPWQUEUETOOBIG),
+ SNMP_MIB_SENTINEL
+ };
+
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index ce64453d337d..ad132b6e8cfa 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -39,6 +39,8 @@ static int ip_local_port_range_min[] = { 1, 1 };
+ static int ip_local_port_range_max[] = { 65535, 65535 };
+ static int tcp_adv_win_scale_min = -31;
+ static int tcp_adv_win_scale_max = 31;
++static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS;
++static int tcp_min_snd_mss_max = 65535;
+ static int ip_privileged_port_min;
+ static int ip_privileged_port_max = 65535;
+ static int ip_ttl_min = 1;
+@@ -737,6 +739,15 @@ static struct ctl_table ipv4_net_table[] = {
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
++ {
++ .procname = "tcp_min_snd_mss",
++ .data = &init_net.ipv4.sysctl_tcp_min_snd_mss,
++ .maxlen = sizeof(int),
++ .mode = 0644,
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &tcp_min_snd_mss_min,
++ .extra2 = &tcp_min_snd_mss_max,
++ },
+ {
+ .procname = "tcp_probe_threshold",
+ .data = &init_net.ipv4.sysctl_tcp_probe_threshold,
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 30c6e94b06c4..364e6fdaa38f 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3829,6 +3829,7 @@ void __init tcp_init(void)
+ unsigned long limit;
+ unsigned int i;
+
++ BUILD_BUG_ON(TCP_MIN_SND_MSS <= MAX_TCP_OPTION_SPACE);
+ BUILD_BUG_ON(sizeof(struct tcp_skb_cb) >
+ FIELD_SIZEOF(struct sk_buff, cb));
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index cfdd70e32755..4a8869d39662 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -1315,7 +1315,7 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *prev,
+ TCP_SKB_CB(skb)->seq += shifted;
+
+ tcp_skb_pcount_add(prev, pcount);
+- BUG_ON(tcp_skb_pcount(skb) < pcount);
++ WARN_ON_ONCE(tcp_skb_pcount(skb) < pcount);
+ tcp_skb_pcount_add(skb, -pcount);
+
+ /* When we're adding to gso_segs == 1, gso_size will be zero,
+@@ -1381,6 +1381,21 @@ static int skb_can_shift(const struct sk_buff *skb)
+ return !skb_headlen(skb) && skb_is_nonlinear(skb);
+ }
+
++int tcp_skb_shift(struct sk_buff *to, struct sk_buff *from,
++ int pcount, int shiftlen)
++{
++ /* TCP min gso_size is 8 bytes (TCP_MIN_GSO_SIZE)
++ * Since TCP_SKB_CB(skb)->tcp_gso_segs is 16 bits, we need
++ * to make sure not storing more than 65535 * 8 bytes per skb,
++ * even if current MSS is bigger.
++ */
++ if (unlikely(to->len + shiftlen >= 65535 * TCP_MIN_GSO_SIZE))
++ return 0;
++ if (unlikely(tcp_skb_pcount(to) + pcount > 65535))
++ return 0;
++ return skb_shift(to, from, shiftlen);
++}
++
+ /* Try collapsing SACK blocks spanning across multiple skbs to a single
+ * skb.
+ */
+@@ -1486,7 +1501,7 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
+ if (!after(TCP_SKB_CB(skb)->seq + len, tp->snd_una))
+ goto fallback;
+
+- if (!skb_shift(prev, skb, len))
++ if (!tcp_skb_shift(prev, skb, pcount, len))
+ goto fallback;
+ if (!tcp_shifted_skb(sk, prev, skb, state, pcount, len, mss, dup_sack))
+ goto out;
+@@ -1504,11 +1519,10 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
+ goto out;
+
+ len = skb->len;
+- if (skb_shift(prev, skb, len)) {
+- pcount += tcp_skb_pcount(skb);
+- tcp_shifted_skb(sk, prev, skb, state, tcp_skb_pcount(skb),
++ pcount = tcp_skb_pcount(skb);
++ if (tcp_skb_shift(prev, skb, pcount, len))
++ tcp_shifted_skb(sk, prev, skb, state, pcount,
+ len, mss, 0);
+- }
+
+ out:
+ return prev;
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 11101cf8693b..b76cf96d5cfe 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -2527,6 +2527,7 @@ static int __net_init tcp_sk_init(struct net *net)
+ net->ipv4.sysctl_tcp_ecn_fallback = 1;
+
+ net->ipv4.sysctl_tcp_base_mss = TCP_BASE_MSS;
++ net->ipv4.sysctl_tcp_min_snd_mss = TCP_MIN_SND_MSS;
+ net->ipv4.sysctl_tcp_probe_threshold = TCP_PROBE_THRESHOLD;
+ net->ipv4.sysctl_tcp_probe_interval = TCP_PROBE_INTERVAL;
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index bd134e3a0473..147ed82b73d3 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1299,6 +1299,11 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
+ if (nsize < 0)
+ nsize = 0;
+
++ if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf)) {
++ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG);
++ return -ENOMEM;
++ }
++
+ if (skb_unclone(skb, gfp))
+ return -ENOMEM;
+
+@@ -1457,8 +1462,7 @@ static inline int __tcp_mtu_to_mss(struct sock *sk, int pmtu)
+ mss_now -= icsk->icsk_ext_hdr_len;
+
+ /* Then reserve room for full set of TCP options and 8 bytes of data */
+- if (mss_now < 48)
+- mss_now = 48;
++ mss_now = max(mss_now, sock_net(sk)->ipv4.sysctl_tcp_min_snd_mss);
+ return mss_now;
+ }
+
+@@ -2727,7 +2731,7 @@ static bool tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
+ if (next_skb_size <= skb_availroom(skb))
+ skb_copy_bits(next_skb, 0, skb_put(skb, next_skb_size),
+ next_skb_size);
+- else if (!skb_shift(skb, next_skb, next_skb_size))
++ else if (!tcp_skb_shift(skb, next_skb, 1, next_skb_size))
+ return false;
+ }
+ tcp_highest_sack_replace(sk, next_skb, skb);
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index b1b5a648def6..17335a370e64 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -166,6 +166,7 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
+ mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1;
+ mss = min(net->ipv4.sysctl_tcp_base_mss, mss);
+ mss = max(mss, 68 - tcp_sk(sk)->tcp_header_len);
++ mss = max(mss, net->ipv4.sysctl_tcp_min_snd_mss);
+ icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss);
+ }
+ tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-06-19 17:17 Thomas Deutschmann
0 siblings, 0 replies; 332+ messages in thread
From: Thomas Deutschmann @ 2019-06-19 17:17 UTC (permalink / raw
To: gentoo-commits
commit: 09d431ec38d30ec1e633879ef570e9e4bbe75aa5
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 19 17:16:55 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Jun 19 17:16:55 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=09d431ec
Linux patch 4.19.53
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
0000_README | 108 +-
1052_linux-4.19.53.patch | 3116 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3172 insertions(+), 52 deletions(-)
diff --git a/0000_README b/0000_README
index 9c779f7..76bab6e 100644
--- a/0000_README
+++ b/0000_README
@@ -44,213 +44,217 @@ Individual Patch Descriptions:
--------------------------------------------------------------------------
Patch: 1000_linux-4.19.1.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.1
Patch: 1001_linux-4.19.2.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.2
Patch: 1002_linux-4.19.3.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.3
Patch: 1003_linux-4.19.4.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.4
Patch: 1004_linux-4.19.5.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.5
Patch: 1005_linux-4.19.6.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.6
Patch: 1006_linux-4.19.7.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.7
Patch: 1007_linux-4.19.8.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.8
Patch: 1008_linux-4.19.9.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.9
Patch: 1009_linux-4.19.10.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.10
Patch: 1010_linux-4.19.11.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.11
Patch: 1011_linux-4.19.12.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.12
Patch: 1012_linux-4.19.13.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.13
Patch: 1013_linux-4.19.14.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.14
Patch: 1014_linux-4.19.15.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.15
Patch: 1015_linux-4.19.16.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.16
Patch: 1016_linux-4.19.17.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.17
Patch: 1017_linux-4.19.18.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.18
Patch: 1018_linux-4.19.19.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.19
Patch: 1019_linux-4.19.20.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.20
Patch: 1020_linux-4.19.21.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.21
Patch: 1021_linux-4.19.22.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.22
Patch: 1022_linux-4.19.23.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.23
Patch: 1023_linux-4.19.24.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.24
Patch: 1024_linux-4.19.25.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.25
Patch: 1025_linux-4.19.26.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.26
Patch: 1026_linux-4.19.27.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.27
Patch: 1027_linux-4.19.28.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.28
Patch: 1028_linux-4.19.29.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.29
Patch: 1029_linux-4.19.30.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.30
Patch: 1030_linux-4.19.31.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.31
Patch: 1031_linux-4.19.32.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.32
Patch: 1032_linux-4.19.33.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.33
Patch: 1033_linux-4.19.34.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.34
Patch: 1034_linux-4.19.35.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.35
Patch: 1035_linux-4.19.36.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.36
Patch: 1036_linux-4.19.37.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.37
Patch: 1037_linux-4.19.38.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.38
Patch: 1038_linux-4.19.39.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.39
Patch: 1039_linux-4.19.40.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.40
Patch: 1040_linux-4.19.41.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.41
Patch: 1041_linux-4.19.42.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.42
Patch: 1042_linux-4.19.43.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.43
Patch: 1043_linux-4.19.44.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.44
Patch: 1044_linux-4.19.45.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.45
Patch: 1045_linux-4.19.46.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.46
Patch: 1046_linux-4.19.47.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.47
Patch: 1047_linux-4.19.48.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.48
Patch: 1048_linux-4.19.49.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.49
Patch: 1049_linux-4.19.50.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.50
Patch: 1050_linux-4.19.51.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.51
Patch: 1051_linux-4.19.52.patch
-From: http://www.kernel.org
+From: https://www.kernel.org
Desc: Linux 4.19.52
+Patch: 1052_linux-4.19.53.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.53
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1052_linux-4.19.53.patch b/1052_linux-4.19.53.patch
new file mode 100644
index 0000000..7039ecd
--- /dev/null
+++ b/1052_linux-4.19.53.patch
@@ -0,0 +1,3116 @@
+diff --git a/Makefile b/Makefile
+index c82ee02ad9be..bedcb121dc3d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 52
++SUBLEVEL = 53
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/kvm/hyp/Makefile b/arch/arm/kvm/hyp/Makefile
+index d2b5ec9c4b92..ba88b1eca93c 100644
+--- a/arch/arm/kvm/hyp/Makefile
++++ b/arch/arm/kvm/hyp/Makefile
+@@ -11,6 +11,7 @@ CFLAGS_ARMV7VE :=$(call cc-option, -march=armv7ve)
+
+ obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v3-sr.o
+ obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/timer-sr.o
++obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/aarch32.o
+
+ obj-$(CONFIG_KVM_ARM_HOST) += tlb.o
+ obj-$(CONFIG_KVM_ARM_HOST) += cp15-sr.o
+diff --git a/arch/arm64/kvm/hyp/Makefile b/arch/arm64/kvm/hyp/Makefile
+index 2fabc2dc1966..feef06fc7c5a 100644
+--- a/arch/arm64/kvm/hyp/Makefile
++++ b/arch/arm64/kvm/hyp/Makefile
+@@ -10,6 +10,7 @@ KVM=../../../../virt/kvm
+
+ obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v3-sr.o
+ obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/timer-sr.o
++obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/aarch32.o
+
+ obj-$(CONFIG_KVM_ARM_HOST) += vgic-v2-cpuif-proxy.o
+ obj-$(CONFIG_KVM_ARM_HOST) += sysreg-sr.o
+diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
+index 8080c9f489c3..0fa558176fb1 100644
+--- a/arch/arm64/mm/mmu.c
++++ b/arch/arm64/mm/mmu.c
+@@ -921,13 +921,18 @@ void *__init fixmap_remap_fdt(phys_addr_t dt_phys)
+
+ int __init arch_ioremap_pud_supported(void)
+ {
+- /* only 4k granule supports level 1 block mappings */
+- return IS_ENABLED(CONFIG_ARM64_4K_PAGES);
++ /*
++ * Only 4k granule supports level 1 block mappings.
++ * SW table walks can't handle removal of intermediate entries.
++ */
++ return IS_ENABLED(CONFIG_ARM64_4K_PAGES) &&
++ !IS_ENABLED(CONFIG_ARM64_PTDUMP_DEBUGFS);
+ }
+
+ int __init arch_ioremap_pmd_supported(void)
+ {
+- return 1;
++ /* See arch_ioremap_pud_supported() */
++ return !IS_ENABLED(CONFIG_ARM64_PTDUMP_DEBUGFS);
+ }
+
+ int pud_set_huge(pud_t *pudp, phys_addr_t phys, pgprot_t prot)
+diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
+index ad6b91013a05..5332f628c1ed 100644
+--- a/arch/s390/include/asm/uaccess.h
++++ b/arch/s390/include/asm/uaccess.h
+@@ -56,8 +56,10 @@ raw_copy_from_user(void *to, const void __user *from, unsigned long n);
+ unsigned long __must_check
+ raw_copy_to_user(void __user *to, const void *from, unsigned long n);
+
++#ifndef CONFIG_KASAN
+ #define INLINE_COPY_FROM_USER
+ #define INLINE_COPY_TO_USER
++#endif
+
+ #ifdef CONFIG_HAVE_MARCH_Z10_FEATURES
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index f538e3fac7ad..fc7de27960e7 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -4156,21 +4156,28 @@ void kvm_arch_commit_memory_region(struct kvm *kvm,
+ const struct kvm_memory_slot *new,
+ enum kvm_mr_change change)
+ {
+- int rc;
+-
+- /* If the basics of the memslot do not change, we do not want
+- * to update the gmap. Every update causes several unnecessary
+- * segment translation exceptions. This is usually handled just
+- * fine by the normal fault handler + gmap, but it will also
+- * cause faults on the prefix page of running guest CPUs.
+- */
+- if (old->userspace_addr == mem->userspace_addr &&
+- old->base_gfn * PAGE_SIZE == mem->guest_phys_addr &&
+- old->npages * PAGE_SIZE == mem->memory_size)
+- return;
++ int rc = 0;
+
+- rc = gmap_map_segment(kvm->arch.gmap, mem->userspace_addr,
+- mem->guest_phys_addr, mem->memory_size);
++ switch (change) {
++ case KVM_MR_DELETE:
++ rc = gmap_unmap_segment(kvm->arch.gmap, old->base_gfn * PAGE_SIZE,
++ old->npages * PAGE_SIZE);
++ break;
++ case KVM_MR_MOVE:
++ rc = gmap_unmap_segment(kvm->arch.gmap, old->base_gfn * PAGE_SIZE,
++ old->npages * PAGE_SIZE);
++ if (rc)
++ break;
++ /* FALLTHROUGH */
++ case KVM_MR_CREATE:
++ rc = gmap_map_segment(kvm->arch.gmap, mem->userspace_addr,
++ mem->guest_phys_addr, mem->memory_size);
++ break;
++ case KVM_MR_FLAGS_ONLY:
++ break;
++ default:
++ WARN(1, "Unknown KVM MR CHANGE: %d\n", change);
++ }
+ if (rc)
+ pr_warn("failed to commit memory region\n");
+ return;
+diff --git a/arch/x86/kernel/cpu/intel_rdt_monitor.c b/arch/x86/kernel/cpu/intel_rdt_monitor.c
+index b0f3aed76b75..3d4ec80a6bb9 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_monitor.c
++++ b/arch/x86/kernel/cpu/intel_rdt_monitor.c
+@@ -371,6 +371,9 @@ static void update_mba_bw(struct rdtgroup *rgrp, struct rdt_domain *dom_mbm)
+ struct list_head *head;
+ struct rdtgroup *entry;
+
++ if (!is_mbm_local_enabled())
++ return;
++
+ r_mba = &rdt_resources_all[RDT_RESOURCE_MBA];
+ closid = rgrp->closid;
+ rmid = rgrp->mon.rmid;
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index b43ddefd77f4..b7027e667604 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -873,7 +873,7 @@ int __init microcode_init(void)
+ goto out_ucode_group;
+
+ register_syscore_ops(&mc_syscore_ops);
+- cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, "x86/microcode:online",
++ cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:online",
+ mc_cpu_online, mc_cpu_down_prep);
+
+ pr_info("Microcode Update Driver: v%s.", DRIVER_VERSION);
+diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
+index 58ead7db71a3..952aebd0a8a3 100644
+--- a/arch/x86/kvm/pmu.c
++++ b/arch/x86/kvm/pmu.c
+@@ -282,20 +282,16 @@ int kvm_pmu_rdpmc(struct kvm_vcpu *vcpu, unsigned idx, u64 *data)
+ {
+ bool fast_mode = idx & (1u << 31);
+ struct kvm_pmc *pmc;
+- u64 ctr_val;
++ u64 mask = fast_mode ? ~0u : ~0ull;
+
+ if (is_vmware_backdoor_pmc(idx))
+ return kvm_pmu_rdpmc_vmware(vcpu, idx, data);
+
+- pmc = kvm_x86_ops->pmu_ops->msr_idx_to_pmc(vcpu, idx);
++ pmc = kvm_x86_ops->pmu_ops->msr_idx_to_pmc(vcpu, idx, &mask);
+ if (!pmc)
+ return 1;
+
+- ctr_val = pmc_read_counter(pmc);
+- if (fast_mode)
+- ctr_val = (u32)ctr_val;
+-
+- *data = ctr_val;
++ *data = pmc_read_counter(pmc) & mask;
+ return 0;
+ }
+
+diff --git a/arch/x86/kvm/pmu.h b/arch/x86/kvm/pmu.h
+index ba8898e1a854..22dff661145a 100644
+--- a/arch/x86/kvm/pmu.h
++++ b/arch/x86/kvm/pmu.h
+@@ -25,7 +25,8 @@ struct kvm_pmu_ops {
+ unsigned (*find_fixed_event)(int idx);
+ bool (*pmc_is_enabled)(struct kvm_pmc *pmc);
+ struct kvm_pmc *(*pmc_idx_to_pmc)(struct kvm_pmu *pmu, int pmc_idx);
+- struct kvm_pmc *(*msr_idx_to_pmc)(struct kvm_vcpu *vcpu, unsigned idx);
++ struct kvm_pmc *(*msr_idx_to_pmc)(struct kvm_vcpu *vcpu, unsigned idx,
++ u64 *mask);
+ int (*is_valid_msr_idx)(struct kvm_vcpu *vcpu, unsigned idx);
+ bool (*is_valid_msr)(struct kvm_vcpu *vcpu, u32 msr);
+ int (*get_msr)(struct kvm_vcpu *vcpu, u32 msr, u64 *data);
+diff --git a/arch/x86/kvm/pmu_amd.c b/arch/x86/kvm/pmu_amd.c
+index 1495a735b38e..41dff881e0f0 100644
+--- a/arch/x86/kvm/pmu_amd.c
++++ b/arch/x86/kvm/pmu_amd.c
+@@ -186,7 +186,7 @@ static int amd_is_valid_msr_idx(struct kvm_vcpu *vcpu, unsigned idx)
+ }
+
+ /* idx is the ECX register of RDPMC instruction */
+-static struct kvm_pmc *amd_msr_idx_to_pmc(struct kvm_vcpu *vcpu, unsigned idx)
++static struct kvm_pmc *amd_msr_idx_to_pmc(struct kvm_vcpu *vcpu, unsigned idx, u64 *mask)
+ {
+ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+ struct kvm_pmc *counters;
+diff --git a/arch/x86/kvm/pmu_intel.c b/arch/x86/kvm/pmu_intel.c
+index 5ab4a364348e..c3f103e2b08e 100644
+--- a/arch/x86/kvm/pmu_intel.c
++++ b/arch/x86/kvm/pmu_intel.c
+@@ -126,7 +126,7 @@ static int intel_is_valid_msr_idx(struct kvm_vcpu *vcpu, unsigned idx)
+ }
+
+ static struct kvm_pmc *intel_msr_idx_to_pmc(struct kvm_vcpu *vcpu,
+- unsigned idx)
++ unsigned idx, u64 *mask)
+ {
+ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+ bool fixed = idx & (1u << 30);
+@@ -138,6 +138,7 @@ static struct kvm_pmc *intel_msr_idx_to_pmc(struct kvm_vcpu *vcpu,
+ if (fixed && idx >= pmu->nr_arch_fixed_counters)
+ return NULL;
+ counters = fixed ? pmu->fixed_counters : pmu->gp_counters;
++ *mask &= pmu->counter_bitmask[fixed ? KVM_PMC_FIXED : KVM_PMC_GP];
+
+ return &counters[idx];
+ }
+@@ -183,9 +184,13 @@ static int intel_pmu_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *data)
+ *data = pmu->global_ovf_ctrl;
+ return 0;
+ default:
+- if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0)) ||
+- (pmc = get_fixed_pmc(pmu, msr))) {
+- *data = pmc_read_counter(pmc);
++ if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0))) {
++ u64 val = pmc_read_counter(pmc);
++ *data = val & pmu->counter_bitmask[KVM_PMC_GP];
++ return 0;
++ } else if ((pmc = get_fixed_pmc(pmu, msr))) {
++ u64 val = pmc_read_counter(pmc);
++ *data = val & pmu->counter_bitmask[KVM_PMC_FIXED];
+ return 0;
+ } else if ((pmc = get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0))) {
+ *data = pmc->eventsel;
+@@ -235,11 +240,14 @@ static int intel_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ }
+ break;
+ default:
+- if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0)) ||
+- (pmc = get_fixed_pmc(pmu, msr))) {
+- if (!msr_info->host_initiated)
+- data = (s64)(s32)data;
+- pmc->counter += data - pmc_read_counter(pmc);
++ if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0))) {
++ if (msr_info->host_initiated)
++ pmc->counter = data;
++ else
++ pmc->counter = (s32)data;
++ return 0;
++ } else if ((pmc = get_fixed_pmc(pmu, msr))) {
++ pmc->counter = data;
+ return 0;
+ } else if ((pmc = get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0))) {
+ if (data == pmc->eventsel)
+diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
+index e3e77527f8df..4bfd14d5da8e 100644
+--- a/arch/x86/mm/kasan_init_64.c
++++ b/arch/x86/mm/kasan_init_64.c
+@@ -198,7 +198,7 @@ static inline p4d_t *early_p4d_offset(pgd_t *pgd, unsigned long addr)
+ if (!pgtable_l5_enabled())
+ return (p4d_t *)pgd;
+
+- p4d = __pa_nodebug(pgd_val(*pgd)) & PTE_PFN_MASK;
++ p4d = pgd_val(*pgd) & PTE_PFN_MASK;
+ p4d += __START_KERNEL_map - phys_base;
+ return (p4d_t *)p4d + p4d_index(addr);
+ }
+diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c
+index 0988971069c9..bfe769209eae 100644
+--- a/arch/x86/mm/kaslr.c
++++ b/arch/x86/mm/kaslr.c
+@@ -51,7 +51,7 @@ static __initdata struct kaslr_memory_region {
+ } kaslr_regions[] = {
+ { &page_offset_base, 0 },
+ { &vmalloc_base, 0 },
+- { &vmemmap_base, 1 },
++ { &vmemmap_base, 0 },
+ };
+
+ /* Get size in bytes used by the memory region */
+@@ -77,6 +77,7 @@ void __init kernel_randomize_memory(void)
+ unsigned long rand, memory_tb;
+ struct rnd_state rand_state;
+ unsigned long remain_entropy;
++ unsigned long vmemmap_size;
+
+ vaddr_start = pgtable_l5_enabled() ? __PAGE_OFFSET_BASE_L5 : __PAGE_OFFSET_BASE_L4;
+ vaddr = vaddr_start;
+@@ -108,6 +109,14 @@ void __init kernel_randomize_memory(void)
+ if (memory_tb < kaslr_regions[0].size_tb)
+ kaslr_regions[0].size_tb = memory_tb;
+
++ /*
++ * Calculate the vmemmap region size in TBs, aligned to a TB
++ * boundary.
++ */
++ vmemmap_size = (kaslr_regions[0].size_tb << (TB_SHIFT - PAGE_SHIFT)) *
++ sizeof(struct page);
++ kaslr_regions[2].size_tb = DIV_ROUND_UP(vmemmap_size, 1UL << TB_SHIFT);
++
+ /* Calculate entropy available between regions */
+ remain_entropy = vaddr_end - vaddr_start;
+ for (i = 0; i < ARRAY_SIZE(kaslr_regions); i++)
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index adf28788cab5..133fed8e4a8b 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4476,9 +4476,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ |
+ ATA_HORKAGE_FIRMWARE_WARN },
+
+- /* drives which fail FPDMA_AA activation (some may freeze afterwards) */
+- { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+- { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
++ /* drives which fail FPDMA_AA activation (some may freeze afterwards)
++ the ST disks also have LPM issues */
++ { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA |
++ ATA_HORKAGE_NOLPM, },
++ { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA |
++ ATA_HORKAGE_NOLPM, },
+ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA },
+
+ /* Blacklist entries taken from Silicon Image 3124/3132
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 7c581f4c2b94..5965f6383ada 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -1580,6 +1580,50 @@ static void connector_bad_edid(struct drm_connector *connector,
+ }
+ }
+
++/* Get override or firmware EDID */
++static struct edid *drm_get_override_edid(struct drm_connector *connector)
++{
++ struct edid *override = NULL;
++
++ if (connector->override_edid)
++ override = drm_edid_duplicate(connector->edid_blob_ptr->data);
++
++ if (!override)
++ override = drm_load_edid_firmware(connector);
++
++ return IS_ERR(override) ? NULL : override;
++}
++
++/**
++ * drm_add_override_edid_modes - add modes from override/firmware EDID
++ * @connector: connector we're probing
++ *
++ * Add modes from the override/firmware EDID, if available. Only to be used from
++ * drm_helper_probe_single_connector_modes() as a fallback for when DDC probe
++ * failed during drm_get_edid() and caused the override/firmware EDID to be
++ * skipped.
++ *
++ * Return: The number of modes added or 0 if we couldn't find any.
++ */
++int drm_add_override_edid_modes(struct drm_connector *connector)
++{
++ struct edid *override;
++ int num_modes = 0;
++
++ override = drm_get_override_edid(connector);
++ if (override) {
++ drm_connector_update_edid_property(connector, override);
++ num_modes = drm_add_edid_modes(connector, override);
++ kfree(override);
++
++ DRM_DEBUG_KMS("[CONNECTOR:%d:%s] adding %d modes via fallback override/firmware EDID\n",
++ connector->base.id, connector->name, num_modes);
++ }
++
++ return num_modes;
++}
++EXPORT_SYMBOL(drm_add_override_edid_modes);
++
+ /**
+ * drm_do_get_edid - get EDID data using a custom EDID block read function
+ * @connector: connector we're probing
+@@ -1607,15 +1651,10 @@ struct edid *drm_do_get_edid(struct drm_connector *connector,
+ {
+ int i, j = 0, valid_extensions = 0;
+ u8 *edid, *new;
+- struct edid *override = NULL;
+-
+- if (connector->override_edid)
+- override = drm_edid_duplicate(connector->edid_blob_ptr->data);
+-
+- if (!override)
+- override = drm_load_edid_firmware(connector);
++ struct edid *override;
+
+- if (!IS_ERR_OR_NULL(override))
++ override = drm_get_override_edid(connector);
++ if (override)
+ return override;
+
+ if ((edid = kmalloc(EDID_LENGTH, GFP_KERNEL)) == NULL)
+diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
+index a1bb157bfdfa..d18b7e27ef64 100644
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -479,6 +479,13 @@ retry:
+
+ count = (*connector_funcs->get_modes)(connector);
+
++ /*
++ * Fallback for when DDC probe failed in drm_get_edid() and thus skipped
++ * override/firmware EDID.
++ */
++ if (count == 0 && connector->status == connector_status_connected)
++ count = drm_add_override_edid_modes(connector);
++
+ if (count == 0 && connector->status == connector_status_connected)
+ count = drm_add_modes_noedid(connector, 1024, 768);
+ count += drm_helper_probe_add_cmdline_mode(connector);
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index 812fe7b06f87..1817a5c0c80f 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -925,6 +925,13 @@ static bool intel_sdvo_set_colorimetry(struct intel_sdvo *intel_sdvo,
+ return intel_sdvo_set_value(intel_sdvo, SDVO_CMD_SET_COLORIMETRY, &mode, 1);
+ }
+
++static bool intel_sdvo_set_audio_state(struct intel_sdvo *intel_sdvo,
++ u8 audio_state)
++{
++ return intel_sdvo_set_value(intel_sdvo, SDVO_CMD_SET_AUDIO_STAT,
++ &audio_state, 1);
++}
++
+ #if 0
+ static void intel_sdvo_dump_hdmi_buf(struct intel_sdvo *intel_sdvo)
+ {
+@@ -1371,11 +1378,6 @@ static void intel_sdvo_pre_enable(struct intel_encoder *intel_encoder,
+ else
+ sdvox |= SDVO_PIPE_SEL(crtc->pipe);
+
+- if (crtc_state->has_audio) {
+- WARN_ON_ONCE(INTEL_GEN(dev_priv) < 4);
+- sdvox |= SDVO_AUDIO_ENABLE;
+- }
+-
+ if (INTEL_GEN(dev_priv) >= 4) {
+ /* done in crtc_mode_set as the dpll_md reg must be written early */
+ } else if (IS_I945G(dev_priv) || IS_I945GM(dev_priv) ||
+@@ -1515,8 +1517,13 @@ static void intel_sdvo_get_config(struct intel_encoder *encoder,
+ if (sdvox & HDMI_COLOR_RANGE_16_235)
+ pipe_config->limited_color_range = true;
+
+- if (sdvox & SDVO_AUDIO_ENABLE)
+- pipe_config->has_audio = true;
++ if (intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_AUDIO_STAT,
++ &val, 1)) {
++ u8 mask = SDVO_AUDIO_ELD_VALID | SDVO_AUDIO_PRESENCE_DETECT;
++
++ if ((val & mask) == mask)
++ pipe_config->has_audio = true;
++ }
+
+ if (intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ENCODE,
+ &val, 1)) {
+@@ -1529,6 +1536,32 @@ static void intel_sdvo_get_config(struct intel_encoder *encoder,
+ pipe_config->pixel_multiplier, encoder_pixel_multiplier);
+ }
+
++static void intel_sdvo_disable_audio(struct intel_sdvo *intel_sdvo)
++{
++ intel_sdvo_set_audio_state(intel_sdvo, 0);
++}
++
++static void intel_sdvo_enable_audio(struct intel_sdvo *intel_sdvo,
++ const struct intel_crtc_state *crtc_state,
++ const struct drm_connector_state *conn_state)
++{
++ const struct drm_display_mode *adjusted_mode =
++ &crtc_state->base.adjusted_mode;
++ struct drm_connector *connector = conn_state->connector;
++ u8 *eld = connector->eld;
++
++ eld[6] = drm_av_sync_delay(connector, adjusted_mode) / 2;
++
++ intel_sdvo_set_audio_state(intel_sdvo, 0);
++
++ intel_sdvo_write_infoframe(intel_sdvo, SDVO_HBUF_INDEX_ELD,
++ SDVO_HBUF_TX_DISABLED,
++ eld, drm_eld_size(eld));
++
++ intel_sdvo_set_audio_state(intel_sdvo, SDVO_AUDIO_ELD_VALID |
++ SDVO_AUDIO_PRESENCE_DETECT);
++}
++
+ static void intel_disable_sdvo(struct intel_encoder *encoder,
+ const struct intel_crtc_state *old_crtc_state,
+ const struct drm_connector_state *conn_state)
+@@ -1538,6 +1571,9 @@ static void intel_disable_sdvo(struct intel_encoder *encoder,
+ struct intel_crtc *crtc = to_intel_crtc(old_crtc_state->base.crtc);
+ u32 temp;
+
++ if (old_crtc_state->has_audio)
++ intel_sdvo_disable_audio(intel_sdvo);
++
+ intel_sdvo_set_active_outputs(intel_sdvo, 0);
+ if (0)
+ intel_sdvo_set_encoder_power_state(intel_sdvo,
+@@ -1623,6 +1659,9 @@ static void intel_enable_sdvo(struct intel_encoder *encoder,
+ intel_sdvo_set_encoder_power_state(intel_sdvo,
+ DRM_MODE_DPMS_ON);
+ intel_sdvo_set_active_outputs(intel_sdvo, intel_sdvo->attached_output);
++
++ if (pipe_config->has_audio)
++ intel_sdvo_enable_audio(intel_sdvo, pipe_config, conn_state);
+ }
+
+ static enum drm_mode_status
+@@ -2514,7 +2553,6 @@ static bool
+ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
+ {
+ struct drm_encoder *encoder = &intel_sdvo->base.base;
+- struct drm_i915_private *dev_priv = to_i915(encoder->dev);
+ struct drm_connector *connector;
+ struct intel_encoder *intel_encoder = to_intel_encoder(encoder);
+ struct intel_connector *intel_connector;
+@@ -2551,9 +2589,7 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
+ encoder->encoder_type = DRM_MODE_ENCODER_TMDS;
+ connector->connector_type = DRM_MODE_CONNECTOR_DVID;
+
+- /* gen3 doesn't do the hdmi bits in the SDVO register */
+- if (INTEL_GEN(dev_priv) >= 4 &&
+- intel_sdvo_is_hdmi_connector(intel_sdvo, device)) {
++ if (intel_sdvo_is_hdmi_connector(intel_sdvo, device)) {
+ connector->connector_type = DRM_MODE_CONNECTOR_HDMIA;
+ intel_sdvo->is_hdmi = true;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_sdvo_regs.h b/drivers/gpu/drm/i915/intel_sdvo_regs.h
+index db0ed499268a..e9ba3b047f93 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo_regs.h
++++ b/drivers/gpu/drm/i915/intel_sdvo_regs.h
+@@ -707,6 +707,9 @@ struct intel_sdvo_enhancements_arg {
+ #define SDVO_CMD_GET_AUDIO_ENCRYPT_PREFER 0x90
+ #define SDVO_CMD_SET_AUDIO_STAT 0x91
+ #define SDVO_CMD_GET_AUDIO_STAT 0x92
++ #define SDVO_AUDIO_ELD_VALID (1 << 0)
++ #define SDVO_AUDIO_PRESENCE_DETECT (1 << 1)
++ #define SDVO_AUDIO_CP_READY (1 << 2)
+ #define SDVO_CMD_SET_HBUF_INDEX 0x93
+ #define SDVO_HBUF_INDEX_ELD 0
+ #define SDVO_HBUF_INDEX_AVI_IF 1
+diff --git a/drivers/gpu/drm/nouveau/Kconfig b/drivers/gpu/drm/nouveau/Kconfig
+index 4b75ad40dd80..00d9d77f583a 100644
+--- a/drivers/gpu/drm/nouveau/Kconfig
++++ b/drivers/gpu/drm/nouveau/Kconfig
+@@ -16,10 +16,21 @@ config DRM_NOUVEAU
+ select INPUT if ACPI && X86
+ select THERMAL if ACPI && X86
+ select ACPI_VIDEO if ACPI && X86
+- select DRM_VM
+ help
+ Choose this option for open-source NVIDIA support.
+
++config NOUVEAU_LEGACY_CTX_SUPPORT
++ bool "Nouveau legacy context support"
++ depends on DRM_NOUVEAU
++ select DRM_VM
++ default y
++ help
++ There was a version of the nouveau DDX that relied on legacy
++ ctx ioctls not erroring out. But that was back in time a long
++ ways, so offer a way to disable it now. For uapi compat with
++ old nouveau ddx this should be on by default, but modern distros
++ should consider turning it off.
++
+ config NOUVEAU_PLATFORM_DRIVER
+ bool "Nouveau (NVIDIA) SoC GPUs"
+ depends on DRM_NOUVEAU && ARCH_TEGRA
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index 74d2283f2c28..2b7a54cc3c9e 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -1015,8 +1015,11 @@ nouveau_driver_fops = {
+ static struct drm_driver
+ driver_stub = {
+ .driver_features =
+- DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_RENDER |
+- DRIVER_KMS_LEGACY_CONTEXT,
++ DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_RENDER
++#if defined(CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT)
++ | DRIVER_KMS_LEGACY_CONTEXT
++#endif
++ ,
+
+ .load = nouveau_drm_load,
+ .unload = nouveau_drm_unload,
+diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+index 8edb9f2a4269..e4b977cc8452 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+@@ -169,7 +169,11 @@ nouveau_ttm_mmap(struct file *filp, struct vm_area_struct *vma)
+ struct nouveau_drm *drm = nouveau_drm(file_priv->minor->dev);
+
+ if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET))
++#if defined(CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT)
+ return drm_legacy_mmap(filp, vma);
++#else
++ return -EINVAL;
++#endif
+
+ return ttm_bo_mmap(filp, vma, &drm->ttm.bdev);
+ }
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index c3e2022bda5d..3834aa71c9c4 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -2493,7 +2493,8 @@ static int vmw_cmd_dx_set_shader(struct vmw_private *dev_priv,
+
+ cmd = container_of(header, typeof(*cmd), header);
+
+- if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX) {
++ if (cmd->body.type >= SVGA3D_SHADERTYPE_DX10_MAX ||
++ cmd->body.type < SVGA3D_SHADERTYPE_MIN) {
+ DRM_ERROR("Illegal shader type %u.\n",
+ (unsigned) cmd->body.type);
+ return -EINVAL;
+@@ -2732,6 +2733,10 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv,
+ if (view_type == vmw_view_max)
+ return -EINVAL;
+ cmd = container_of(header, typeof(*cmd), header);
++ if (unlikely(cmd->sid == SVGA3D_INVALID_ID)) {
++ DRM_ERROR("Invalid surface id.\n");
++ return -EINVAL;
++ }
+ ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
+ user_surface_converter,
+ &cmd->sid, &srf_node);
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 2faf5421fdd0..184e49036e1d 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -641,6 +641,13 @@ static void mt_store_field(struct hid_device *hdev,
+ if (*target != DEFAULT_TRUE &&
+ *target != DEFAULT_FALSE &&
+ *target != DEFAULT_ZERO) {
++ if (usage->contactid == DEFAULT_ZERO ||
++ usage->x == DEFAULT_ZERO ||
++ usage->y == DEFAULT_ZERO) {
++ hid_dbg(hdev,
++ "ignoring duplicate usage on incomplete");
++ return;
++ }
+ usage = mt_allocate_usage(hdev, application);
+ if (!usage)
+ return;
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 5dd3a8245f0f..d7c3f4ac2c04 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -1234,13 +1234,13 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
+ /* Add back in missing bits of ID for non-USI pens */
+ wacom->id[0] |= (wacom->serial[0] >> 32) & 0xFFFFF;
+ }
+- wacom->tool[0] = wacom_intuos_get_tool_type(wacom_intuos_id_mangle(wacom->id[0]));
+
+ for (i = 0; i < pen_frames; i++) {
+ unsigned char *frame = &data[i*pen_frame_len + 1];
+ bool valid = frame[0] & 0x80;
+ bool prox = frame[0] & 0x40;
+ bool range = frame[0] & 0x20;
++ bool invert = frame[0] & 0x10;
+
+ if (!valid)
+ continue;
+@@ -1249,9 +1249,24 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
+ wacom->shared->stylus_in_proximity = false;
+ wacom_exit_report(wacom);
+ input_sync(pen_input);
++
++ wacom->tool[0] = 0;
++ wacom->id[0] = 0;
++ wacom->serial[0] = 0;
+ return;
+ }
++
+ if (range) {
++ if (!wacom->tool[0]) { /* first in range */
++ /* Going into range select tool */
++ if (invert)
++ wacom->tool[0] = BTN_TOOL_RUBBER;
++ else if (wacom->id[0])
++ wacom->tool[0] = wacom_intuos_get_tool_type(wacom->id[0]);
++ else
++ wacom->tool[0] = BTN_TOOL_PEN;
++ }
++
+ input_report_abs(pen_input, ABS_X, get_unaligned_le16(&frame[1]));
+ input_report_abs(pen_input, ABS_Y, get_unaligned_le16(&frame[3]));
+
+@@ -1273,23 +1288,26 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
+ get_unaligned_le16(&frame[11]));
+ }
+ }
+- input_report_abs(pen_input, ABS_PRESSURE, get_unaligned_le16(&frame[5]));
+- if (wacom->features.type == INTUOSP2_BT) {
+- input_report_abs(pen_input, ABS_DISTANCE,
+- range ? frame[13] : wacom->features.distance_max);
+- } else {
+- input_report_abs(pen_input, ABS_DISTANCE,
+- range ? frame[7] : wacom->features.distance_max);
+- }
+
+- input_report_key(pen_input, BTN_TOUCH, frame[0] & 0x01);
+- input_report_key(pen_input, BTN_STYLUS, frame[0] & 0x02);
+- input_report_key(pen_input, BTN_STYLUS2, frame[0] & 0x04);
++ if (wacom->tool[0]) {
++ input_report_abs(pen_input, ABS_PRESSURE, get_unaligned_le16(&frame[5]));
++ if (wacom->features.type == INTUOSP2_BT) {
++ input_report_abs(pen_input, ABS_DISTANCE,
++ range ? frame[13] : wacom->features.distance_max);
++ } else {
++ input_report_abs(pen_input, ABS_DISTANCE,
++ range ? frame[7] : wacom->features.distance_max);
++ }
+
+- input_report_key(pen_input, wacom->tool[0], prox);
+- input_event(pen_input, EV_MSC, MSC_SERIAL, wacom->serial[0]);
+- input_report_abs(pen_input, ABS_MISC,
+- wacom_intuos_id_mangle(wacom->id[0])); /* report tool id */
++ input_report_key(pen_input, BTN_TOUCH, frame[0] & 0x09);
++ input_report_key(pen_input, BTN_STYLUS, frame[0] & 0x02);
++ input_report_key(pen_input, BTN_STYLUS2, frame[0] & 0x04);
++
++ input_report_key(pen_input, wacom->tool[0], prox);
++ input_event(pen_input, EV_MSC, MSC_SERIAL, wacom->serial[0]);
++ input_report_abs(pen_input, ABS_MISC,
++ wacom_intuos_id_mangle(wacom->id[0])); /* report tool id */
++ }
+
+ wacom->shared->stylus_in_proximity = prox;
+
+@@ -1351,11 +1369,17 @@ static void wacom_intuos_pro2_bt_touch(struct wacom_wac *wacom)
+ if (wacom->num_contacts_left <= 0) {
+ wacom->num_contacts_left = 0;
+ wacom->shared->touch_down = wacom_wac_finger_count_touches(wacom);
++ input_sync(touch_input);
+ }
+ }
+
+- input_report_switch(touch_input, SW_MUTE_DEVICE, !(data[281] >> 7));
+- input_sync(touch_input);
++ if (wacom->num_contacts_left == 0) {
++ // Be careful that we don't accidentally call input_sync with
++ // only a partial set of fingers of processed
++ input_report_switch(touch_input, SW_MUTE_DEVICE, !(data[281] >> 7));
++ input_sync(touch_input);
++ }
++
+ }
+
+ static void wacom_intuos_pro2_bt_pad(struct wacom_wac *wacom)
+@@ -1363,7 +1387,7 @@ static void wacom_intuos_pro2_bt_pad(struct wacom_wac *wacom)
+ struct input_dev *pad_input = wacom->pad_input;
+ unsigned char *data = wacom->data;
+
+- int buttons = (data[282] << 1) | ((data[281] >> 6) & 0x01);
++ int buttons = data[282] | ((data[281] & 0x40) << 2);
+ int ring = data[285] & 0x7F;
+ bool ringstatus = data[285] & 0x80;
+ bool prox = buttons || ringstatus;
+@@ -3832,7 +3856,7 @@ static void wacom_24hd_update_leds(struct wacom *wacom, int mask, int group)
+ static bool wacom_is_led_toggled(struct wacom *wacom, int button_count,
+ int mask, int group)
+ {
+- int button_per_group;
++ int group_button;
+
+ /*
+ * 21UX2 has LED group 1 to the left and LED group 0
+@@ -3842,9 +3866,12 @@ static bool wacom_is_led_toggled(struct wacom *wacom, int button_count,
+ if (wacom->wacom_wac.features.type == WACOM_21UX2)
+ group = 1 - group;
+
+- button_per_group = button_count/wacom->led.count;
++ group_button = group * (button_count/wacom->led.count);
++
++ if (wacom->wacom_wac.features.type == INTUOSP2_BT)
++ group_button = 8;
+
+- return mask & (1 << (group * button_per_group));
++ return mask & (1 << group_button);
+ }
+
+ static void wacom_update_led(struct wacom *wacom, int button_count, int mask,
+diff --git a/drivers/i2c/busses/i2c-acorn.c b/drivers/i2c/busses/i2c-acorn.c
+index f4a5ae69bf6a..fa3763e4b3ee 100644
+--- a/drivers/i2c/busses/i2c-acorn.c
++++ b/drivers/i2c/busses/i2c-acorn.c
+@@ -81,6 +81,7 @@ static struct i2c_algo_bit_data ioc_data = {
+
+ static struct i2c_adapter ioc_ops = {
+ .nr = 0,
++ .name = "ioc",
+ .algo_data = &ioc_data,
+ };
+
+diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
+index ce119cb279c3..0c3b8f1c7225 100644
+--- a/drivers/iommu/arm-smmu.c
++++ b/drivers/iommu/arm-smmu.c
+@@ -56,6 +56,15 @@
+ #include "io-pgtable.h"
+ #include "arm-smmu-regs.h"
+
++/*
++ * Apparently, some Qualcomm arm64 platforms which appear to expose their SMMU
++ * global register space are still, in fact, using a hypervisor to mediate it
++ * by trapping and emulating register accesses. Sadly, some deployed versions
++ * of said trapping code have bugs wherein they go horribly wrong for stores
++ * using r31 (i.e. XZR/WZR) as the source register.
++ */
++#define QCOM_DUMMY_VAL -1
++
+ #define ARM_MMU500_ACTLR_CPRE (1 << 1)
+
+ #define ARM_MMU500_ACR_CACHE_LOCK (1 << 26)
+@@ -398,7 +407,7 @@ static void __arm_smmu_tlb_sync(struct arm_smmu_device *smmu,
+ {
+ unsigned int spin_cnt, delay;
+
+- writel_relaxed(0, sync);
++ writel_relaxed(QCOM_DUMMY_VAL, sync);
+ for (delay = 1; delay < TLB_LOOP_TIMEOUT; delay *= 2) {
+ for (spin_cnt = TLB_SPIN_COUNT; spin_cnt > 0; spin_cnt--) {
+ if (!(readl_relaxed(status) & sTLBGSTATUS_GSACTIVE))
+@@ -1637,8 +1646,8 @@ static void arm_smmu_device_reset(struct arm_smmu_device *smmu)
+ }
+
+ /* Invalidate the TLB, just in case */
+- writel_relaxed(0, gr0_base + ARM_SMMU_GR0_TLBIALLH);
+- writel_relaxed(0, gr0_base + ARM_SMMU_GR0_TLBIALLNSNH);
++ writel_relaxed(QCOM_DUMMY_VAL, gr0_base + ARM_SMMU_GR0_TLBIALLH);
++ writel_relaxed(QCOM_DUMMY_VAL, gr0_base + ARM_SMMU_GR0_TLBIALLNSNH);
+
+ reg = readl_relaxed(ARM_SMMU_GR0_NS(smmu) + ARM_SMMU_GR0_sCR0);
+
+diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
+index 8f07fa6e1739..268f1b685084 100644
+--- a/drivers/md/bcache/bset.c
++++ b/drivers/md/bcache/bset.c
+@@ -887,12 +887,22 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k,
+ struct bset *i = bset_tree_last(b)->data;
+ struct bkey *m, *prev = NULL;
+ struct btree_iter iter;
++ struct bkey preceding_key_on_stack = ZERO_KEY;
++ struct bkey *preceding_key_p = &preceding_key_on_stack;
+
+ BUG_ON(b->ops->is_extents && !KEY_SIZE(k));
+
+- m = bch_btree_iter_init(b, &iter, b->ops->is_extents
+- ? PRECEDING_KEY(&START_KEY(k))
+- : PRECEDING_KEY(k));
++ /*
++ * If k has preceding key, preceding_key_p will be set to address
++ * of k's preceding key; otherwise preceding_key_p will be set
++ * to NULL inside preceding_key().
++ */
++ if (b->ops->is_extents)
++ preceding_key(&START_KEY(k), &preceding_key_p);
++ else
++ preceding_key(k, &preceding_key_p);
++
++ m = bch_btree_iter_init(b, &iter, preceding_key_p);
+
+ if (b->ops->insert_fixup(b, k, &iter, replace_key))
+ return status;
+diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h
+index bac76aabca6d..c71365e7c1fa 100644
+--- a/drivers/md/bcache/bset.h
++++ b/drivers/md/bcache/bset.h
+@@ -434,20 +434,26 @@ static inline bool bch_cut_back(const struct bkey *where, struct bkey *k)
+ return __bch_cut_back(where, k);
+ }
+
+-#define PRECEDING_KEY(_k) \
+-({ \
+- struct bkey *_ret = NULL; \
+- \
+- if (KEY_INODE(_k) || KEY_OFFSET(_k)) { \
+- _ret = &KEY(KEY_INODE(_k), KEY_OFFSET(_k), 0); \
+- \
+- if (!_ret->low) \
+- _ret->high--; \
+- _ret->low--; \
+- } \
+- \
+- _ret; \
+-})
++/*
++ * Pointer '*preceding_key_p' points to a memory object to store preceding
++ * key of k. If the preceding key does not exist, set '*preceding_key_p' to
++ * NULL. So the caller of preceding_key() needs to take care of memory
++ * which '*preceding_key_p' pointed to before calling preceding_key().
++ * Currently the only caller of preceding_key() is bch_btree_insert_key(),
++ * and it points to an on-stack variable, so the memory release is handled
++ * by stackframe itself.
++ */
++static inline void preceding_key(struct bkey *k, struct bkey **preceding_key_p)
++{
++ if (KEY_INODE(k) || KEY_OFFSET(k)) {
++ (**preceding_key_p) = KEY(KEY_INODE(k), KEY_OFFSET(k), 0);
++ if (!(*preceding_key_p)->low)
++ (*preceding_key_p)->high--;
++ (*preceding_key_p)->low--;
++ } else {
++ (*preceding_key_p) = NULL;
++ }
++}
+
+ static inline bool bch_ptr_invalid(struct btree_keys *b, const struct bkey *k)
+ {
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index d9481640b3e1..541454b4f479 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -393,8 +393,13 @@ STORE(bch_cached_dev)
+ if (attr == &sysfs_writeback_running)
+ bch_writeback_queue(dc);
+
++ /*
++ * Only set BCACHE_DEV_WB_RUNNING when cached device attached to
++ * a cache set, otherwise it doesn't make sense.
++ */
+ if (attr == &sysfs_writeback_percent)
+- if (!test_and_set_bit(BCACHE_DEV_WB_RUNNING, &dc->disk.flags))
++ if ((dc->disk.c != NULL) &&
++ (!test_and_set_bit(BCACHE_DEV_WB_RUNNING, &dc->disk.flags)))
+ schedule_delayed_work(&dc->writeback_rate_update,
+ dc->writeback_rate_update_seconds * HZ);
+
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index 6193270e7b3d..eb4d90b7d99e 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -1139,7 +1139,7 @@ static void kgdbts_put_char(u8 chr)
+ static int param_set_kgdbts_var(const char *kmessage,
+ const struct kernel_param *kp)
+ {
+- int len = strlen(kmessage);
++ size_t len = strlen(kmessage);
+
+ if (len >= MAX_CONFIG_LEN) {
+ printk(KERN_ERR "kgdbts: config string too long\n");
+@@ -1159,7 +1159,7 @@ static int param_set_kgdbts_var(const char *kmessage,
+
+ strcpy(config, kmessage);
+ /* Chop out \n char as a result of echo */
+- if (config[len - 1] == '\n')
++ if (len && config[len - 1] == '\n')
+ config[len - 1] = '\0';
+
+ /* Go and configure with the new params. */
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index 3d8a70d3ea9b..3d71f1716390 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -437,17 +437,18 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+ dev);
+ dev->tx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
++ netif_stop_queue(net);
+ retval = usb_submit_urb(dev->tx_urb, GFP_ATOMIC);
+ if (retval) {
+ dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n",
+ __func__, retval);
+ dev->net->stats.tx_errors++;
+ dev_kfree_skb_any(skb);
++ netif_wake_queue(net);
+ } else {
+ dev->net->stats.tx_packets++;
+ dev->net->stats.tx_bytes += skb->len;
+ dev_consume_skb_any(skb);
+- netif_stop_queue(net);
+ }
+
+ return NETDEV_TX_OK;
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 9148015ed803..a3132a9eb91c 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -612,7 +612,7 @@ static struct attribute *nd_device_attributes[] = {
+ NULL,
+ };
+
+-/**
++/*
+ * nd_device_attribute_group - generic attributes for all devices on an nd bus
+ */
+ struct attribute_group nd_device_attribute_group = {
+@@ -641,7 +641,7 @@ static umode_t nd_numa_attr_visible(struct kobject *kobj, struct attribute *a,
+ return a->mode;
+ }
+
+-/**
++/*
+ * nd_numa_attribute_group - NUMA attributes for all devices on an nd bus
+ */
+ struct attribute_group nd_numa_attribute_group = {
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index 452ad379ed70..9f1b7e3153f9 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -25,6 +25,8 @@ static guid_t nvdimm_btt2_guid;
+ static guid_t nvdimm_pfn_guid;
+ static guid_t nvdimm_dax_guid;
+
++static const char NSINDEX_SIGNATURE[] = "NAMESPACE_INDEX\0";
++
+ static u32 best_seq(u32 a, u32 b)
+ {
+ a &= NSINDEX_SEQ_MASK;
+diff --git a/drivers/nvdimm/label.h b/drivers/nvdimm/label.h
+index 18bbe183b3a9..52f9fcada00a 100644
+--- a/drivers/nvdimm/label.h
++++ b/drivers/nvdimm/label.h
+@@ -38,8 +38,6 @@ enum {
+ ND_NSINDEX_INIT = 0x1,
+ };
+
+-static const char NSINDEX_SIGNATURE[] = "NAMESPACE_INDEX\0";
+-
+ /**
+ * struct nd_namespace_index - label set superblock
+ * @sig: NAMESPACE_INDEX\0
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index abfb46378cc1..a867a139bb35 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1277,9 +1277,14 @@ static struct nvme_ns *nvme_get_ns_from_disk(struct gendisk *disk,
+ {
+ #ifdef CONFIG_NVME_MULTIPATH
+ if (disk->fops == &nvme_ns_head_ops) {
++ struct nvme_ns *ns;
++
+ *head = disk->private_data;
+ *srcu_idx = srcu_read_lock(&(*head)->srcu);
+- return nvme_find_path(*head);
++ ns = nvme_find_path(*head);
++ if (!ns)
++ srcu_read_unlock(&(*head)->srcu, *srcu_idx);
++ return ns;
+ }
+ #endif
+ *head = NULL;
+@@ -1293,42 +1298,56 @@ static void nvme_put_ns_from_disk(struct nvme_ns_head *head, int idx)
+ srcu_read_unlock(&head->srcu, idx);
+ }
+
+-static int nvme_ns_ioctl(struct nvme_ns *ns, unsigned cmd, unsigned long arg)
++static int nvme_ioctl(struct block_device *bdev, fmode_t mode,
++ unsigned int cmd, unsigned long arg)
+ {
++ struct nvme_ns_head *head = NULL;
++ void __user *argp = (void __user *)arg;
++ struct nvme_ns *ns;
++ int srcu_idx, ret;
++
++ ns = nvme_get_ns_from_disk(bdev->bd_disk, &head, &srcu_idx);
++ if (unlikely(!ns))
++ return -EWOULDBLOCK;
++
++ /*
++ * Handle ioctls that apply to the controller instead of the namespace
++ * seperately and drop the ns SRCU reference early. This avoids a
++ * deadlock when deleting namespaces using the passthrough interface.
++ */
++ if (cmd == NVME_IOCTL_ADMIN_CMD || is_sed_ioctl(cmd)) {
++ struct nvme_ctrl *ctrl = ns->ctrl;
++
++ nvme_get_ctrl(ns->ctrl);
++ nvme_put_ns_from_disk(head, srcu_idx);
++
++ if (cmd == NVME_IOCTL_ADMIN_CMD)
++ ret = nvme_user_cmd(ctrl, NULL, argp);
++ else
++ ret = sed_ioctl(ctrl->opal_dev, cmd, argp);
++
++ nvme_put_ctrl(ctrl);
++ return ret;
++ }
++
+ switch (cmd) {
+ case NVME_IOCTL_ID:
+ force_successful_syscall_return();
+- return ns->head->ns_id;
+- case NVME_IOCTL_ADMIN_CMD:
+- return nvme_user_cmd(ns->ctrl, NULL, (void __user *)arg);
++ ret = ns->head->ns_id;
++ break;
+ case NVME_IOCTL_IO_CMD:
+- return nvme_user_cmd(ns->ctrl, ns, (void __user *)arg);
++ ret = nvme_user_cmd(ns->ctrl, ns, argp);
++ break;
+ case NVME_IOCTL_SUBMIT_IO:
+- return nvme_submit_io(ns, (void __user *)arg);
++ ret = nvme_submit_io(ns, argp);
++ break;
+ default:
+-#ifdef CONFIG_NVM
+ if (ns->ndev)
+- return nvme_nvm_ioctl(ns, cmd, arg);
+-#endif
+- if (is_sed_ioctl(cmd))
+- return sed_ioctl(ns->ctrl->opal_dev, cmd,
+- (void __user *) arg);
+- return -ENOTTY;
++ ret = nvme_nvm_ioctl(ns, cmd, arg);
++ else
++ ret = -ENOTTY;
+ }
+-}
+-
+-static int nvme_ioctl(struct block_device *bdev, fmode_t mode,
+- unsigned int cmd, unsigned long arg)
+-{
+- struct nvme_ns_head *head = NULL;
+- struct nvme_ns *ns;
+- int srcu_idx, ret;
+
+- ns = nvme_get_ns_from_disk(bdev->bd_disk, &head, &srcu_idx);
+- if (unlikely(!ns))
+- ret = -EWOULDBLOCK;
+- else
+- ret = nvme_ns_ioctl(ns, cmd, arg);
+ nvme_put_ns_from_disk(head, srcu_idx);
+ return ret;
+ }
+@@ -3506,6 +3525,7 @@ EXPORT_SYMBOL_GPL(nvme_start_ctrl);
+
+ void nvme_uninit_ctrl(struct nvme_ctrl *ctrl)
+ {
++ dev_pm_qos_hide_latency_tolerance(ctrl->device);
+ cdev_device_del(&ctrl->cdev, ctrl->device);
+ }
+ EXPORT_SYMBOL_GPL(nvme_uninit_ctrl);
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index c7039f52ad51..b1d804376237 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -398,12 +398,45 @@ static int pmc_dbgfs_register(struct pmc_dev *pmc)
+ */
+ static const struct dmi_system_id critclk_systems[] = {
+ {
++ /* pmc_plt_clk0 is used for an external HSIC USB HUB */
+ .ident = "MPL CEC1x",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "MPL AG"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "CEC10 Family"),
+ },
+ },
++ {
++ /* pmc_plt_clk0 - 3 are used for the 4 ethernet controllers */
++ .ident = "Lex 3I380D",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Lex BayTrail"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "3I380D"),
++ },
++ },
++ {
++ /* pmc_plt_clk* - are used for ethernet controllers */
++ .ident = "Beckhoff CB3163",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
++ DMI_MATCH(DMI_BOARD_NAME, "CB3163"),
++ },
++ },
++ {
++ /* pmc_plt_clk* - are used for ethernet controllers */
++ .ident = "Beckhoff CB6263",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
++ DMI_MATCH(DMI_BOARD_NAME, "CB6263"),
++ },
++ },
++ {
++ /* pmc_plt_clk* - are used for ethernet controllers */
++ .ident = "Beckhoff CB6363",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
++ DMI_MATCH(DMI_BOARD_NAME, "CB6363"),
++ },
++ },
+ { /*sentinel*/ }
+ };
+
+diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c
+index 2d9ec378a8bc..f85d6b7a1984 100644
+--- a/drivers/ras/cec.c
++++ b/drivers/ras/cec.c
+@@ -2,6 +2,7 @@
+ #include <linux/mm.h>
+ #include <linux/gfp.h>
+ #include <linux/kernel.h>
++#include <linux/workqueue.h>
+
+ #include <asm/mce.h>
+
+@@ -123,16 +124,12 @@ static u64 dfs_pfn;
+ /* Amount of errors after which we offline */
+ static unsigned int count_threshold = COUNT_MASK;
+
+-/*
+- * The timer "decays" element count each timer_interval which is 24hrs by
+- * default.
+- */
+-
+-#define CEC_TIMER_DEFAULT_INTERVAL 24 * 60 * 60 /* 24 hrs */
+-#define CEC_TIMER_MIN_INTERVAL 1 * 60 * 60 /* 1h */
+-#define CEC_TIMER_MAX_INTERVAL 30 * 24 * 60 * 60 /* one month */
+-static struct timer_list cec_timer;
+-static u64 timer_interval = CEC_TIMER_DEFAULT_INTERVAL;
++/* Each element "decays" each decay_interval which is 24hrs by default. */
++#define CEC_DECAY_DEFAULT_INTERVAL 24 * 60 * 60 /* 24 hrs */
++#define CEC_DECAY_MIN_INTERVAL 1 * 60 * 60 /* 1h */
++#define CEC_DECAY_MAX_INTERVAL 30 * 24 * 60 * 60 /* one month */
++static struct delayed_work cec_work;
++static u64 decay_interval = CEC_DECAY_DEFAULT_INTERVAL;
+
+ /*
+ * Decrement decay value. We're using DECAY_BITS bits to denote decay of an
+@@ -160,20 +157,21 @@ static void do_spring_cleaning(struct ce_array *ca)
+ /*
+ * @interval in seconds
+ */
+-static void cec_mod_timer(struct timer_list *t, unsigned long interval)
++static void cec_mod_work(unsigned long interval)
+ {
+ unsigned long iv;
+
+- iv = interval * HZ + jiffies;
+-
+- mod_timer(t, round_jiffies(iv));
++ iv = interval * HZ;
++ mod_delayed_work(system_wq, &cec_work, round_jiffies(iv));
+ }
+
+-static void cec_timer_fn(struct timer_list *unused)
++static void cec_work_fn(struct work_struct *work)
+ {
++ mutex_lock(&ce_mutex);
+ do_spring_cleaning(&ce_arr);
++ mutex_unlock(&ce_mutex);
+
+- cec_mod_timer(&cec_timer, timer_interval);
++ cec_mod_work(decay_interval);
+ }
+
+ /*
+@@ -183,32 +181,38 @@ static void cec_timer_fn(struct timer_list *unused)
+ */
+ static int __find_elem(struct ce_array *ca, u64 pfn, unsigned int *to)
+ {
++ int min = 0, max = ca->n - 1;
+ u64 this_pfn;
+- int min = 0, max = ca->n;
+
+- while (min < max) {
+- int tmp = (max + min) >> 1;
++ while (min <= max) {
++ int i = (min + max) >> 1;
+
+- this_pfn = PFN(ca->array[tmp]);
++ this_pfn = PFN(ca->array[i]);
+
+ if (this_pfn < pfn)
+- min = tmp + 1;
++ min = i + 1;
+ else if (this_pfn > pfn)
+- max = tmp;
+- else {
+- min = tmp;
+- break;
++ max = i - 1;
++ else if (this_pfn == pfn) {
++ if (to)
++ *to = i;
++
++ return i;
+ }
+ }
+
++ /*
++ * When the loop terminates without finding @pfn, min has the index of
++ * the element slot where the new @pfn should be inserted. The loop
++ * terminates when min > max, which means the min index points to the
++ * bigger element while the max index to the smaller element, in-between
++ * which the new @pfn belongs to.
++ *
++ * For more details, see exercise 1, Section 6.2.1 in TAOCP, vol. 3.
++ */
+ if (to)
+ *to = min;
+
+- this_pfn = PFN(ca->array[min]);
+-
+- if (this_pfn == pfn)
+- return min;
+-
+ return -ENOKEY;
+ }
+
+@@ -374,15 +378,15 @@ static int decay_interval_set(void *data, u64 val)
+ {
+ *(u64 *)data = val;
+
+- if (val < CEC_TIMER_MIN_INTERVAL)
++ if (val < CEC_DECAY_MIN_INTERVAL)
+ return -EINVAL;
+
+- if (val > CEC_TIMER_MAX_INTERVAL)
++ if (val > CEC_DECAY_MAX_INTERVAL)
+ return -EINVAL;
+
+- timer_interval = val;
++ decay_interval = val;
+
+- cec_mod_timer(&cec_timer, timer_interval);
++ cec_mod_work(decay_interval);
+ return 0;
+ }
+ DEFINE_DEBUGFS_ATTRIBUTE(decay_interval_ops, u64_get, decay_interval_set, "%lld\n");
+@@ -426,7 +430,7 @@ static int array_dump(struct seq_file *m, void *v)
+
+ seq_printf(m, "Flags: 0x%x\n", ca->flags);
+
+- seq_printf(m, "Timer interval: %lld seconds\n", timer_interval);
++ seq_printf(m, "Decay interval: %lld seconds\n", decay_interval);
+ seq_printf(m, "Decays: %lld\n", ca->decays_done);
+
+ seq_printf(m, "Action threshold: %d\n", count_threshold);
+@@ -472,7 +476,7 @@ static int __init create_debugfs_nodes(void)
+ }
+
+ decay = debugfs_create_file("decay_interval", S_IRUSR | S_IWUSR, d,
+- &timer_interval, &decay_interval_ops);
++ &decay_interval, &decay_interval_ops);
+ if (!decay) {
+ pr_warn("Error creating decay_interval debugfs node!\n");
+ goto err;
+@@ -508,8 +512,8 @@ void __init cec_init(void)
+ if (create_debugfs_nodes())
+ return;
+
+- timer_setup(&cec_timer, cec_timer_fn, 0);
+- cec_mod_timer(&cec_timer, CEC_TIMER_DEFAULT_INTERVAL);
++ INIT_DELAYED_WORK(&cec_work, cec_work_fn);
++ schedule_delayed_work(&cec_work, CEC_DECAY_DEFAULT_INTERVAL);
+
+ pr_info("Correctable Errors collector initialized.\n");
+ }
+diff --git a/drivers/rtc/rtc-pcf8523.c b/drivers/rtc/rtc-pcf8523.c
+index 453615f8ac9a..3fcd2cbafc84 100644
+--- a/drivers/rtc/rtc-pcf8523.c
++++ b/drivers/rtc/rtc-pcf8523.c
+@@ -85,6 +85,18 @@ static int pcf8523_write(struct i2c_client *client, u8 reg, u8 value)
+ return 0;
+ }
+
++static int pcf8523_voltage_low(struct i2c_client *client)
++{
++ u8 value;
++ int err;
++
++ err = pcf8523_read(client, REG_CONTROL3, &value);
++ if (err < 0)
++ return err;
++
++ return !!(value & REG_CONTROL3_BLF);
++}
++
+ static int pcf8523_select_capacitance(struct i2c_client *client, bool high)
+ {
+ u8 value;
+@@ -167,6 +179,14 @@ static int pcf8523_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ struct i2c_msg msgs[2];
+ int err;
+
++ err = pcf8523_voltage_low(client);
++ if (err < 0) {
++ return err;
++ } else if (err > 0) {
++ dev_err(dev, "low voltage detected, time is unreliable\n");
++ return -EINVAL;
++ }
++
+ msgs[0].addr = client->addr;
+ msgs[0].flags = 0;
+ msgs[0].len = 1;
+@@ -251,17 +271,13 @@ static int pcf8523_rtc_ioctl(struct device *dev, unsigned int cmd,
+ unsigned long arg)
+ {
+ struct i2c_client *client = to_i2c_client(dev);
+- u8 value;
+- int ret = 0, err;
++ int ret;
+
+ switch (cmd) {
+ case RTC_VL_READ:
+- err = pcf8523_read(client, REG_CONTROL3, &value);
+- if (err < 0)
+- return err;
+-
+- if (value & REG_CONTROL3_BLF)
+- ret = 1;
++ ret = pcf8523_voltage_low(client);
++ if (ret < 0)
++ return ret;
+
+ if (copy_to_user((void __user *)arg, &ret, sizeof(int)))
+ return -EFAULT;
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_hwi.c b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
+index e8ae4d671d23..097305949a95 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_hwi.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
+@@ -830,7 +830,7 @@ ret_err_rqe:
+ ((u64)err_entry->data.err_warn_bitmap_hi << 32) |
+ (u64)err_entry->data.err_warn_bitmap_lo;
+ for (i = 0; i < BNX2FC_NUM_ERR_BITS; i++) {
+- if (err_warn_bit_map & (u64) (1 << i)) {
++ if (err_warn_bit_map & ((u64)1 << i)) {
+ err_warn = i;
+ break;
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
+index cb19b12e7211..55cd96e2469c 100644
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -341,7 +341,7 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
+ phba->sli4_hba.scsi_xri_max,
+ lpfc_sli4_get_els_iocb_cnt(phba));
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+
+ /* Port state is only one of two values for now. */
+ if (localport->port_id)
+@@ -357,7 +357,7 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
+ wwn_to_u64(vport->fc_nodename.u.wwn),
+ localport->port_id, statep);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+
+ list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp) {
+ nrport = NULL;
+@@ -384,39 +384,39 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
+
+ /* Tab in to show lport ownership. */
+ if (strlcat(buf, "NVME RPORT ", PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+ if (phba->brd_no >= 10) {
+ if (strlcat(buf, " ", PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+ }
+
+ scnprintf(tmp, sizeof(tmp), "WWPN x%llx ",
+ nrport->port_name);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+
+ scnprintf(tmp, sizeof(tmp), "WWNN x%llx ",
+ nrport->node_name);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+
+ scnprintf(tmp, sizeof(tmp), "DID x%06x ",
+ nrport->port_id);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+
+ /* An NVME rport can have multiple roles. */
+ if (nrport->port_role & FC_PORT_ROLE_NVME_INITIATOR) {
+ if (strlcat(buf, "INITIATOR ", PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+ }
+ if (nrport->port_role & FC_PORT_ROLE_NVME_TARGET) {
+ if (strlcat(buf, "TARGET ", PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+ }
+ if (nrport->port_role & FC_PORT_ROLE_NVME_DISCOVERY) {
+ if (strlcat(buf, "DISCSRVC ", PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+ }
+ if (nrport->port_role & ~(FC_PORT_ROLE_NVME_INITIATOR |
+ FC_PORT_ROLE_NVME_TARGET |
+@@ -424,12 +424,12 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
+ scnprintf(tmp, sizeof(tmp), "UNKNOWN ROLE x%x",
+ nrport->port_role);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+ }
+
+ scnprintf(tmp, sizeof(tmp), "%s\n", statep);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto buffer_done;
++ goto rcu_unlock_buf_done;
+ }
+ rcu_read_unlock();
+
+@@ -491,7 +491,13 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
+ atomic_read(&lport->cmpl_fcp_err));
+ strlcat(buf, tmp, PAGE_SIZE);
+
+-buffer_done:
++ /* RCU is already unlocked. */
++ goto buffer_done;
++
++ rcu_unlock_buf_done:
++ rcu_read_unlock();
++
++ buffer_done:
+ len = strnlen(buf, PAGE_SIZE);
+
+ if (unlikely(len >= (PAGE_SIZE - 1))) {
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 0d214e6b8e9a..f3c6801c0b31 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -7094,7 +7094,10 @@ int
+ lpfc_send_rrq(struct lpfc_hba *phba, struct lpfc_node_rrq *rrq)
+ {
+ struct lpfc_nodelist *ndlp = lpfc_findnode_did(rrq->vport,
+- rrq->nlp_DID);
++ rrq->nlp_DID);
++ if (!ndlp)
++ return 1;
++
+ if (lpfc_test_rrq_active(phba, ndlp, rrq->xritag))
+ return lpfc_issue_els_rrq(rrq->vport, ndlp,
+ rrq->nlp_DID, rrq);
+diff --git a/drivers/scsi/qedi/qedi_dbg.c b/drivers/scsi/qedi/qedi_dbg.c
+index 8fd28b056f73..3383314a3882 100644
+--- a/drivers/scsi/qedi/qedi_dbg.c
++++ b/drivers/scsi/qedi/qedi_dbg.c
+@@ -16,10 +16,6 @@ qedi_dbg_err(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+ {
+ va_list va;
+ struct va_format vaf;
+- char nfunc[32];
+-
+- memset(nfunc, 0, sizeof(nfunc));
+- memcpy(nfunc, func, sizeof(nfunc) - 1);
+
+ va_start(va, fmt);
+
+@@ -28,9 +24,9 @@ qedi_dbg_err(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+
+ if (likely(qedi) && likely(qedi->pdev))
+ pr_err("[%s]:[%s:%d]:%d: %pV", dev_name(&qedi->pdev->dev),
+- nfunc, line, qedi->host_no, &vaf);
++ func, line, qedi->host_no, &vaf);
+ else
+- pr_err("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf);
++ pr_err("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf);
+
+ va_end(va);
+ }
+@@ -41,10 +37,6 @@ qedi_dbg_warn(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+ {
+ va_list va;
+ struct va_format vaf;
+- char nfunc[32];
+-
+- memset(nfunc, 0, sizeof(nfunc));
+- memcpy(nfunc, func, sizeof(nfunc) - 1);
+
+ va_start(va, fmt);
+
+@@ -56,9 +48,9 @@ qedi_dbg_warn(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+
+ if (likely(qedi) && likely(qedi->pdev))
+ pr_warn("[%s]:[%s:%d]:%d: %pV", dev_name(&qedi->pdev->dev),
+- nfunc, line, qedi->host_no, &vaf);
++ func, line, qedi->host_no, &vaf);
+ else
+- pr_warn("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf);
++ pr_warn("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf);
+
+ ret:
+ va_end(va);
+@@ -70,10 +62,6 @@ qedi_dbg_notice(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+ {
+ va_list va;
+ struct va_format vaf;
+- char nfunc[32];
+-
+- memset(nfunc, 0, sizeof(nfunc));
+- memcpy(nfunc, func, sizeof(nfunc) - 1);
+
+ va_start(va, fmt);
+
+@@ -85,10 +73,10 @@ qedi_dbg_notice(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+
+ if (likely(qedi) && likely(qedi->pdev))
+ pr_notice("[%s]:[%s:%d]:%d: %pV",
+- dev_name(&qedi->pdev->dev), nfunc, line,
++ dev_name(&qedi->pdev->dev), func, line,
+ qedi->host_no, &vaf);
+ else
+- pr_notice("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf);
++ pr_notice("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf);
+
+ ret:
+ va_end(va);
+@@ -100,10 +88,6 @@ qedi_dbg_info(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+ {
+ va_list va;
+ struct va_format vaf;
+- char nfunc[32];
+-
+- memset(nfunc, 0, sizeof(nfunc));
+- memcpy(nfunc, func, sizeof(nfunc) - 1);
+
+ va_start(va, fmt);
+
+@@ -115,9 +99,9 @@ qedi_dbg_info(struct qedi_dbg_ctx *qedi, const char *func, u32 line,
+
+ if (likely(qedi) && likely(qedi->pdev))
+ pr_info("[%s]:[%s:%d]:%d: %pV", dev_name(&qedi->pdev->dev),
+- nfunc, line, qedi->host_no, &vaf);
++ func, line, qedi->host_no, &vaf);
+ else
+- pr_info("[0000:00:00.0]:[%s:%d]: %pV", nfunc, line, &vaf);
++ pr_info("[0000:00:00.0]:[%s:%d]: %pV", func, line, &vaf);
+
+ ret:
+ va_end(va);
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index 4130b9117055..1b7049dce169 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -810,8 +810,6 @@ qedi_ep_connect(struct Scsi_Host *shost, struct sockaddr *dst_addr,
+ struct qedi_endpoint *qedi_ep;
+ struct sockaddr_in *addr;
+ struct sockaddr_in6 *addr6;
+- struct qed_dev *cdev = NULL;
+- struct qedi_uio_dev *udev = NULL;
+ struct iscsi_path path_req;
+ u32 msg_type = ISCSI_KEVENT_IF_DOWN;
+ u32 iscsi_cid = QEDI_CID_RESERVED;
+@@ -831,8 +829,6 @@ qedi_ep_connect(struct Scsi_Host *shost, struct sockaddr *dst_addr,
+ }
+
+ qedi = iscsi_host_priv(shost);
+- cdev = qedi->cdev;
+- udev = qedi->udev;
+
+ if (test_bit(QEDI_IN_OFFLINE, &qedi->flags) ||
+ test_bit(QEDI_IN_RECOVERY, &qedi->flags)) {
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 6082b008969b..6b6413073584 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -215,6 +215,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
+ { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Logitech HD Webcam C270 */
++ { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
+ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 260010abf9d8..aad7edc29bdd 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -2673,8 +2673,10 @@ static void dwc2_free_dma_aligned_buffer(struct urb *urb)
+ return;
+
+ /* Restore urb->transfer_buffer from the end of the allocated area */
+- memcpy(&stored_xfer_buffer, urb->transfer_buffer +
+- urb->transfer_buffer_length, sizeof(urb->transfer_buffer));
++ memcpy(&stored_xfer_buffer,
++ PTR_ALIGN(urb->transfer_buffer + urb->transfer_buffer_length,
++ dma_get_cache_alignment()),
++ sizeof(urb->transfer_buffer));
+
+ if (usb_urb_dir_in(urb)) {
+ if (usb_pipeisoc(urb->pipe))
+@@ -2706,6 +2708,7 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
+ * DMA
+ */
+ kmalloc_size = urb->transfer_buffer_length +
++ (dma_get_cache_alignment() - 1) +
+ sizeof(urb->transfer_buffer);
+
+ kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
+@@ -2716,7 +2719,8 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
+ * Position value of original urb->transfer_buffer pointer to the end
+ * of allocation for later referencing
+ */
+- memcpy(kmalloc_ptr + urb->transfer_buffer_length,
++ memcpy(PTR_ALIGN(kmalloc_ptr + urb->transfer_buffer_length,
++ dma_get_cache_alignment()),
+ &urb->transfer_buffer, sizeof(urb->transfer_buffer));
+
+ if (usb_urb_dir_out(urb))
+@@ -2801,7 +2805,7 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
+ chan->dev_addr = dwc2_hcd_get_dev_addr(&urb->pipe_info);
+ chan->ep_num = dwc2_hcd_get_ep_num(&urb->pipe_info);
+ chan->speed = qh->dev_speed;
+- chan->max_packet = dwc2_max_packet(qh->maxp);
++ chan->max_packet = qh->maxp;
+
+ chan->xfer_started = 0;
+ chan->halt_status = DWC2_HC_XFER_NO_HALT_STATUS;
+@@ -2879,7 +2883,7 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh)
+ * This value may be modified when the transfer is started
+ * to reflect the actual transfer length
+ */
+- chan->multi_count = dwc2_hb_mult(qh->maxp);
++ chan->multi_count = qh->maxp_mult;
+
+ if (hsotg->params.dma_desc_enable) {
+ chan->desc_list_addr = qh->desc_list_dma;
+@@ -3991,19 +3995,21 @@ static struct dwc2_hcd_urb *dwc2_hcd_urb_alloc(struct dwc2_hsotg *hsotg,
+
+ static void dwc2_hcd_urb_set_pipeinfo(struct dwc2_hsotg *hsotg,
+ struct dwc2_hcd_urb *urb, u8 dev_addr,
+- u8 ep_num, u8 ep_type, u8 ep_dir, u16 mps)
++ u8 ep_num, u8 ep_type, u8 ep_dir,
++ u16 maxp, u16 maxp_mult)
+ {
+ if (dbg_perio() ||
+ ep_type == USB_ENDPOINT_XFER_BULK ||
+ ep_type == USB_ENDPOINT_XFER_CONTROL)
+ dev_vdbg(hsotg->dev,
+- "addr=%d, ep_num=%d, ep_dir=%1x, ep_type=%1x, mps=%d\n",
+- dev_addr, ep_num, ep_dir, ep_type, mps);
++ "addr=%d, ep_num=%d, ep_dir=%1x, ep_type=%1x, maxp=%d (%d mult)\n",
++ dev_addr, ep_num, ep_dir, ep_type, maxp, maxp_mult);
+ urb->pipe_info.dev_addr = dev_addr;
+ urb->pipe_info.ep_num = ep_num;
+ urb->pipe_info.pipe_type = ep_type;
+ urb->pipe_info.pipe_dir = ep_dir;
+- urb->pipe_info.mps = mps;
++ urb->pipe_info.maxp = maxp;
++ urb->pipe_info.maxp_mult = maxp_mult;
+ }
+
+ /*
+@@ -4094,8 +4100,9 @@ void dwc2_hcd_dump_state(struct dwc2_hsotg *hsotg)
+ dwc2_hcd_is_pipe_in(&urb->pipe_info) ?
+ "IN" : "OUT");
+ dev_dbg(hsotg->dev,
+- " Max packet size: %d\n",
+- dwc2_hcd_get_mps(&urb->pipe_info));
++ " Max packet size: %d (%d mult)\n",
++ dwc2_hcd_get_maxp(&urb->pipe_info),
++ dwc2_hcd_get_maxp_mult(&urb->pipe_info));
+ dev_dbg(hsotg->dev,
+ " transfer_buffer: %p\n",
+ urb->buf);
+@@ -4653,8 +4660,10 @@ static void dwc2_dump_urb_info(struct usb_hcd *hcd, struct urb *urb,
+ }
+
+ dev_vdbg(hsotg->dev, " Speed: %s\n", speed);
+- dev_vdbg(hsotg->dev, " Max packet size: %d\n",
+- usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe)));
++ dev_vdbg(hsotg->dev, " Max packet size: %d (%d mult)\n",
++ usb_endpoint_maxp(&urb->ep->desc),
++ usb_endpoint_maxp_mult(&urb->ep->desc));
++
+ dev_vdbg(hsotg->dev, " Data buffer length: %d\n",
+ urb->transfer_buffer_length);
+ dev_vdbg(hsotg->dev, " Transfer buffer: %p, Transfer DMA: %08lx\n",
+@@ -4737,8 +4746,8 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
+ dwc2_hcd_urb_set_pipeinfo(hsotg, dwc2_urb, usb_pipedevice(urb->pipe),
+ usb_pipeendpoint(urb->pipe), ep_type,
+ usb_pipein(urb->pipe),
+- usb_maxpacket(urb->dev, urb->pipe,
+- !(usb_pipein(urb->pipe))));
++ usb_endpoint_maxp(&ep->desc),
++ usb_endpoint_maxp_mult(&ep->desc));
+
+ buf = urb->transfer_buffer;
+
+diff --git a/drivers/usb/dwc2/hcd.h b/drivers/usb/dwc2/hcd.h
+index c089ffa1f0a8..ce6445a06588 100644
+--- a/drivers/usb/dwc2/hcd.h
++++ b/drivers/usb/dwc2/hcd.h
+@@ -171,7 +171,8 @@ struct dwc2_hcd_pipe_info {
+ u8 ep_num;
+ u8 pipe_type;
+ u8 pipe_dir;
+- u16 mps;
++ u16 maxp;
++ u16 maxp_mult;
+ };
+
+ struct dwc2_hcd_iso_packet_desc {
+@@ -264,6 +265,7 @@ struct dwc2_hs_transfer_time {
+ * - USB_ENDPOINT_XFER_ISOC
+ * @ep_is_in: Endpoint direction
+ * @maxp: Value from wMaxPacketSize field of Endpoint Descriptor
++ * @maxp_mult: Multiplier for maxp
+ * @dev_speed: Device speed. One of the following values:
+ * - USB_SPEED_LOW
+ * - USB_SPEED_FULL
+@@ -340,6 +342,7 @@ struct dwc2_qh {
+ u8 ep_type;
+ u8 ep_is_in;
+ u16 maxp;
++ u16 maxp_mult;
+ u8 dev_speed;
+ u8 data_toggle;
+ u8 ping_state;
+@@ -503,9 +506,14 @@ static inline u8 dwc2_hcd_get_pipe_type(struct dwc2_hcd_pipe_info *pipe)
+ return pipe->pipe_type;
+ }
+
+-static inline u16 dwc2_hcd_get_mps(struct dwc2_hcd_pipe_info *pipe)
++static inline u16 dwc2_hcd_get_maxp(struct dwc2_hcd_pipe_info *pipe)
++{
++ return pipe->maxp;
++}
++
++static inline u16 dwc2_hcd_get_maxp_mult(struct dwc2_hcd_pipe_info *pipe)
+ {
+- return pipe->mps;
++ return pipe->maxp_mult;
+ }
+
+ static inline u8 dwc2_hcd_get_dev_addr(struct dwc2_hcd_pipe_info *pipe)
+@@ -620,12 +628,6 @@ static inline bool dbg_urb(struct urb *urb)
+ static inline bool dbg_perio(void) { return false; }
+ #endif
+
+-/* High bandwidth multiplier as encoded in highspeed endpoint descriptors */
+-#define dwc2_hb_mult(wmaxpacketsize) (1 + (((wmaxpacketsize) >> 11) & 0x03))
+-
+-/* Packet size for any kind of endpoint descriptor */
+-#define dwc2_max_packet(wmaxpacketsize) ((wmaxpacketsize) & 0x07ff)
+-
+ /*
+ * Returns true if frame1 index is greater than frame2 index. The comparison
+ * is done modulo FRLISTEN_64_SIZE. This accounts for the rollover of the
+diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
+index 88b5dcf3aefc..a052d39b4375 100644
+--- a/drivers/usb/dwc2/hcd_intr.c
++++ b/drivers/usb/dwc2/hcd_intr.c
+@@ -1617,8 +1617,9 @@ static void dwc2_hc_ahberr_intr(struct dwc2_hsotg *hsotg,
+
+ dev_err(hsotg->dev, " Speed: %s\n", speed);
+
+- dev_err(hsotg->dev, " Max packet size: %d\n",
+- dwc2_hcd_get_mps(&urb->pipe_info));
++ dev_err(hsotg->dev, " Max packet size: %d (mult %d)\n",
++ dwc2_hcd_get_maxp(&urb->pipe_info),
++ dwc2_hcd_get_maxp_mult(&urb->pipe_info));
+ dev_err(hsotg->dev, " Data buffer length: %d\n", urb->length);
+ dev_err(hsotg->dev, " Transfer buffer: %p, Transfer DMA: %08lx\n",
+ urb->buf, (unsigned long)urb->dma);
+diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c
+index ea3aa640c15c..68bbac64b753 100644
+--- a/drivers/usb/dwc2/hcd_queue.c
++++ b/drivers/usb/dwc2/hcd_queue.c
+@@ -708,7 +708,7 @@ static void dwc2_hs_pmap_unschedule(struct dwc2_hsotg *hsotg,
+ static int dwc2_uframe_schedule_split(struct dwc2_hsotg *hsotg,
+ struct dwc2_qh *qh)
+ {
+- int bytecount = dwc2_hb_mult(qh->maxp) * dwc2_max_packet(qh->maxp);
++ int bytecount = qh->maxp_mult * qh->maxp;
+ int ls_search_slice;
+ int err = 0;
+ int host_interval_in_sched;
+@@ -1332,7 +1332,7 @@ static int dwc2_check_max_xfer_size(struct dwc2_hsotg *hsotg,
+ u32 max_channel_xfer_size;
+ int status = 0;
+
+- max_xfer_size = dwc2_max_packet(qh->maxp) * dwc2_hb_mult(qh->maxp);
++ max_xfer_size = qh->maxp * qh->maxp_mult;
+ max_channel_xfer_size = hsotg->params.max_transfer_size;
+
+ if (max_xfer_size > max_channel_xfer_size) {
+@@ -1517,8 +1517,9 @@ static void dwc2_qh_init(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh,
+ u32 prtspd = (hprt & HPRT0_SPD_MASK) >> HPRT0_SPD_SHIFT;
+ bool do_split = (prtspd == HPRT0_SPD_HIGH_SPEED &&
+ dev_speed != USB_SPEED_HIGH);
+- int maxp = dwc2_hcd_get_mps(&urb->pipe_info);
+- int bytecount = dwc2_hb_mult(maxp) * dwc2_max_packet(maxp);
++ int maxp = dwc2_hcd_get_maxp(&urb->pipe_info);
++ int maxp_mult = dwc2_hcd_get_maxp_mult(&urb->pipe_info);
++ int bytecount = maxp_mult * maxp;
+ char *speed, *type;
+
+ /* Initialize QH */
+@@ -1531,6 +1532,7 @@ static void dwc2_qh_init(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh,
+
+ qh->data_toggle = DWC2_HC_PID_DATA0;
+ qh->maxp = maxp;
++ qh->maxp_mult = maxp_mult;
+ INIT_LIST_HEAD(&qh->qtd_list);
+ INIT_LIST_HEAD(&qh->qh_list_entry);
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index d8c474b386a8..ea891195bbdf 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1171,6 +1171,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260),
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1900), /* Telit LN940 (QMI) */
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
+@@ -1772,6 +1776,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
+ .driver_info = RSVD(5) | RSVD(6) },
+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */
++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */
++ .driver_info = RSVD(7) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 5a6df6e9ad57..5d7b21ea6238 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -106,6 +106,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
+ { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
+ { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
++ { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 559941ca884d..b0175f17d1a2 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -155,3 +155,6 @@
+ #define SMART_VENDOR_ID 0x0b8c
+ #define SMART_PRODUCT_ID 0x2303
+
++/* Allied Telesis VT-Kit3 */
++#define AT_VENDOR_ID 0x0caa
++#define AT_VTKIT3_PRODUCT_ID 0x3001
+diff --git a/drivers/usb/storage/unusual_realtek.h b/drivers/usb/storage/unusual_realtek.h
+index 6b2140f966ef..7e14c2d7cf73 100644
+--- a/drivers/usb/storage/unusual_realtek.h
++++ b/drivers/usb/storage/unusual_realtek.h
+@@ -17,6 +17,11 @@ UNUSUAL_DEV(0x0bda, 0x0138, 0x0000, 0x9999,
+ "USB Card Reader",
+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+
++UNUSUAL_DEV(0x0bda, 0x0153, 0x0000, 0x9999,
++ "Realtek",
++ "USB Card Reader",
++ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
++
+ UNUSUAL_DEV(0x0bda, 0x0158, 0x0000, 0x9999,
+ "Realtek",
+ "USB Card Reader",
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 409a637f7a92..88e30f7cf9e1 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -205,12 +205,17 @@ static inline const struct xattr_handler *f2fs_xattr_handler(int index)
+ return handler;
+ }
+
+-static struct f2fs_xattr_entry *__find_xattr(void *base_addr, int index,
+- size_t len, const char *name)
++static struct f2fs_xattr_entry *__find_xattr(void *base_addr,
++ void *last_base_addr, int index,
++ size_t len, const char *name)
+ {
+ struct f2fs_xattr_entry *entry;
+
+ list_for_each_xattr(entry, base_addr) {
++ if ((void *)(entry) + sizeof(__u32) > last_base_addr ||
++ (void *)XATTR_NEXT_ENTRY(entry) > last_base_addr)
++ return NULL;
++
+ if (entry->e_name_index != index)
+ continue;
+ if (entry->e_name_len != len)
+@@ -300,20 +305,22 @@ static int lookup_all_xattrs(struct inode *inode, struct page *ipage,
+ const char *name, struct f2fs_xattr_entry **xe,
+ void **base_addr, int *base_size)
+ {
+- void *cur_addr, *txattr_addr, *last_addr = NULL;
++ void *cur_addr, *txattr_addr, *last_txattr_addr;
++ void *last_addr = NULL;
+ nid_t xnid = F2FS_I(inode)->i_xattr_nid;
+- unsigned int size = xnid ? VALID_XATTR_BLOCK_SIZE : 0;
+ unsigned int inline_size = inline_xattr_size(inode);
+ int err = 0;
+
+- if (!size && !inline_size)
++ if (!xnid && !inline_size)
+ return -ENODATA;
+
+- *base_size = inline_size + size + XATTR_PADDING_SIZE;
++ *base_size = XATTR_SIZE(xnid, inode) + XATTR_PADDING_SIZE;
+ txattr_addr = f2fs_kzalloc(F2FS_I_SB(inode), *base_size, GFP_NOFS);
+ if (!txattr_addr)
+ return -ENOMEM;
+
++ last_txattr_addr = (void *)txattr_addr + XATTR_SIZE(xnid, inode);
++
+ /* read from inline xattr */
+ if (inline_size) {
+ err = read_inline_xattr(inode, ipage, txattr_addr);
+@@ -340,7 +347,11 @@ static int lookup_all_xattrs(struct inode *inode, struct page *ipage,
+ else
+ cur_addr = txattr_addr;
+
+- *xe = __find_xattr(cur_addr, index, len, name);
++ *xe = __find_xattr(cur_addr, last_txattr_addr, index, len, name);
++ if (!*xe) {
++ err = -EFAULT;
++ goto out;
++ }
+ check:
+ if (IS_XATTR_LAST_ENTRY(*xe)) {
+ err = -ENODATA;
+@@ -584,7 +595,8 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ struct page *ipage, int flags)
+ {
+ struct f2fs_xattr_entry *here, *last;
+- void *base_addr;
++ void *base_addr, *last_base_addr;
++ nid_t xnid = F2FS_I(inode)->i_xattr_nid;
+ int found, newsize;
+ size_t len;
+ __u32 new_hsize;
+@@ -608,8 +620,14 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ if (error)
+ return error;
+
++ last_base_addr = (void *)base_addr + XATTR_SIZE(xnid, inode);
++
+ /* find entry with wanted name. */
+- here = __find_xattr(base_addr, index, len, name);
++ here = __find_xattr(base_addr, last_base_addr, index, len, name);
++ if (!here) {
++ error = -EFAULT;
++ goto exit;
++ }
+
+ found = IS_XATTR_LAST_ENTRY(here) ? 0 : 1;
+
+diff --git a/fs/f2fs/xattr.h b/fs/f2fs/xattr.h
+index dbcd1d16e669..2a4ecaf338ea 100644
+--- a/fs/f2fs/xattr.h
++++ b/fs/f2fs/xattr.h
+@@ -74,6 +74,8 @@ struct f2fs_xattr_entry {
+ entry = XATTR_NEXT_ENTRY(entry))
+ #define VALID_XATTR_BLOCK_SIZE (PAGE_SIZE - sizeof(struct node_footer))
+ #define XATTR_PADDING_SIZE (sizeof(__u32))
++#define XATTR_SIZE(x,i) (((x) ? VALID_XATTR_BLOCK_SIZE : 0) + \
++ (inline_xattr_size(i)))
+ #define MIN_OFFSET(i) XATTR_ALIGN(inline_xattr_size(i) + \
+ VALID_XATTR_BLOCK_SIZE)
+
+diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
+index 290373024d9d..e8ace3b54e9c 100644
+--- a/fs/ocfs2/dcache.c
++++ b/fs/ocfs2/dcache.c
+@@ -310,6 +310,18 @@ int ocfs2_dentry_attach_lock(struct dentry *dentry,
+
+ out_attach:
+ spin_lock(&dentry_attach_lock);
++ if (unlikely(dentry->d_fsdata && !alias)) {
++ /* d_fsdata is set by a racing thread which is doing
++ * the same thing as this thread is doing. Leave the racing
++ * thread going ahead and we return here.
++ */
++ spin_unlock(&dentry_attach_lock);
++ iput(dl->dl_inode);
++ ocfs2_lock_res_free(&dl->dl_lockres);
++ kfree(dl);
++ return 0;
++ }
++
+ dentry->d_fsdata = dl;
+ dl->dl_count++;
+ spin_unlock(&dentry_attach_lock);
+diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h
+index e3c404833115..53be104aab5c 100644
+--- a/include/drm/drm_edid.h
++++ b/include/drm/drm_edid.h
+@@ -466,6 +466,7 @@ struct edid *drm_get_edid_switcheroo(struct drm_connector *connector,
+ struct i2c_adapter *adapter);
+ struct edid *drm_edid_duplicate(const struct edid *edid);
+ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid);
++int drm_add_override_edid_modes(struct drm_connector *connector);
+
+ u8 drm_match_cea_mode(const struct drm_display_mode *to_match);
+ enum hdmi_picture_aspect drm_get_cea_aspect_ratio(const u8 video_code);
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index ca51b2c15bcc..8937d48a5389 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -485,7 +485,7 @@ static inline struct cgroup_subsys_state *task_css(struct task_struct *task,
+ *
+ * Find the css for the (@task, @subsys_id) combination, increment a
+ * reference on and return it. This function is guaranteed to return a
+- * valid css.
++ * valid css. The returned css may already have been offlined.
+ */
+ static inline struct cgroup_subsys_state *
+ task_get_css(struct task_struct *task, int subsys_id)
+@@ -495,7 +495,13 @@ task_get_css(struct task_struct *task, int subsys_id)
+ rcu_read_lock();
+ while (true) {
+ css = task_css(task, subsys_id);
+- if (likely(css_tryget_online(css)))
++ /*
++ * Can't use css_tryget_online() here. A task which has
++ * PF_EXITING set may stay associated with an offline css.
++ * If such task calls this function, css_tryget_online()
++ * will keep failing.
++ */
++ if (likely(css_tryget(css)))
+ break;
+ cpu_relax();
+ }
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index caf40ad0bbc6..d64d8c2bbdab 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -101,6 +101,7 @@ enum cpuhp_state {
+ CPUHP_AP_IRQ_BCM2836_STARTING,
+ CPUHP_AP_IRQ_MIPS_GIC_STARTING,
+ CPUHP_AP_ARM_MVEBU_COHERENCY,
++ CPUHP_AP_MICROCODE_LOADER,
+ CPUHP_AP_PERF_X86_AMD_UNCORE_STARTING,
+ CPUHP_AP_PERF_X86_STARTING,
+ CPUHP_AP_PERF_X86_AMD_IBS_STARTING,
+diff --git a/kernel/Makefile b/kernel/Makefile
+index 7a63d567fdb5..df5e3ca30acd 100644
+--- a/kernel/Makefile
++++ b/kernel/Makefile
+@@ -30,6 +30,7 @@ KCOV_INSTRUMENT_extable.o := n
+ # Don't self-instrument.
+ KCOV_INSTRUMENT_kcov.o := n
+ KASAN_SANITIZE_kcov.o := n
++CFLAGS_kcov.o := $(call cc-option, -fno-conserve-stack -fno-stack-protector)
+
+ # cond_syscall is currently not LTO compatible
+ CFLAGS_sys_ni.o = $(DISABLE_LTO)
+diff --git a/kernel/cred.c b/kernel/cred.c
+index ecf03657e71c..efd04b2ec84c 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -448,6 +448,15 @@ int commit_creds(struct cred *new)
+ if (task->mm)
+ set_dumpable(task->mm, suid_dumpable);
+ task->pdeath_signal = 0;
++ /*
++ * If a task drops privileges and becomes nondumpable,
++ * the dumpability change must become visible before
++ * the credential change; otherwise, a __ptrace_may_access()
++ * racing with this change may be able to attach to a task it
++ * shouldn't be able to attach to (as if the task had dropped
++ * privileges without becoming nondumpable).
++ * Pairs with a read barrier in __ptrace_may_access().
++ */
+ smp_wmb();
+ }
+
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index fc0d667f5792..5d0838c2349e 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -323,6 +323,16 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ return -EPERM;
+ ok:
+ rcu_read_unlock();
++ /*
++ * If a task drops privileges and becomes nondumpable (through a syscall
++ * like setresuid()) while we are trying to access it, we must ensure
++ * that the dumpability is read after the credentials; otherwise,
++ * we may be able to attach to a task that we shouldn't be able to
++ * attach to (as if the task had dropped privileges without becoming
++ * nondumpable).
++ * Pairs with a write barrier in commit_creds().
++ */
++ smp_rmb();
+ mm = task->mm;
+ if (mm &&
+ ((get_dumpable(mm) != SUID_DUMP_USER) &&
+@@ -704,6 +714,10 @@ static int ptrace_peek_siginfo(struct task_struct *child,
+ if (arg.nr < 0)
+ return -EINVAL;
+
++ /* Ensure arg.off fits in an unsigned long */
++ if (arg.off > ULONG_MAX)
++ return 0;
++
+ if (arg.flags & PTRACE_PEEKSIGINFO_SHARED)
+ pending = &child->signal->shared_pending;
+ else
+@@ -711,18 +725,20 @@ static int ptrace_peek_siginfo(struct task_struct *child,
+
+ for (i = 0; i < arg.nr; ) {
+ siginfo_t info;
+- s32 off = arg.off + i;
++ unsigned long off = arg.off + i;
++ bool found = false;
+
+ spin_lock_irq(&child->sighand->siglock);
+ list_for_each_entry(q, &pending->list, list) {
+ if (!off--) {
++ found = true;
+ copy_siginfo(&info, &q->info);
+ break;
+ }
+ }
+ spin_unlock_irq(&child->sighand->siglock);
+
+- if (off >= 0) /* beyond the end of the list */
++ if (!found) /* beyond the end of the list */
+ break;
+
+ #ifdef CONFIG_COMPAT
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 9a6bfcd22dc6..443edcddac8a 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -812,17 +812,18 @@ ktime_t ktime_get_coarse_with_offset(enum tk_offsets offs)
+ struct timekeeper *tk = &tk_core.timekeeper;
+ unsigned int seq;
+ ktime_t base, *offset = offsets[offs];
++ u64 nsecs;
+
+ WARN_ON(timekeeping_suspended);
+
+ do {
+ seq = read_seqcount_begin(&tk_core.seq);
+ base = ktime_add(tk->tkr_mono.base, *offset);
++ nsecs = tk->tkr_mono.xtime_nsec >> tk->tkr_mono.shift;
+
+ } while (read_seqcount_retry(&tk_core.seq, seq));
+
+- return base;
+-
++ return base + nsecs;
+ }
+ EXPORT_SYMBOL_GPL(ktime_get_coarse_with_offset);
+
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 11853e90b649..3f34cfb66a85 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -1632,6 +1632,9 @@ static u64 hist_field_var_ref(struct hist_field *hist_field,
+ struct hist_elt_data *elt_data;
+ u64 var_val = 0;
+
++ if (WARN_ON_ONCE(!elt))
++ return var_val;
++
+ elt_data = elt->private_data;
+ var_val = elt_data->var_ref_vals[hist_field->var_ref_idx];
+
+diff --git a/mm/list_lru.c b/mm/list_lru.c
+index f0a15d32b959..758653dd1443 100644
+--- a/mm/list_lru.c
++++ b/mm/list_lru.c
+@@ -353,7 +353,7 @@ static int __memcg_init_list_lru_node(struct list_lru_memcg *memcg_lrus,
+ }
+ return 0;
+ fail:
+- __memcg_destroy_list_lru_node(memcg_lrus, begin, i - 1);
++ __memcg_destroy_list_lru_node(memcg_lrus, begin, i);
+ return -ENOMEM;
+ }
+
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index ee545d1e9894..dec88fcf8876 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1510,7 +1510,7 @@ unsigned long reclaim_clean_pages_from_list(struct zone *zone,
+
+ list_for_each_entry_safe(page, next, page_list, lru) {
+ if (page_is_file_cache(page) && !PageDirty(page) &&
+- !__PageMovable(page)) {
++ !__PageMovable(page) && !PageUnevictable(page)) {
+ ClearPageActive(page);
+ list_move(&page->lru, &clean_pages);
+ }
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index b55cb96d1fed..f59e13c1d84a 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1900,20 +1900,14 @@ static int snd_seq_ioctl_get_subscription(struct snd_seq_client *client,
+ int result;
+ struct snd_seq_client *sender = NULL;
+ struct snd_seq_client_port *sport = NULL;
+- struct snd_seq_subscribers *p;
+
+ result = -EINVAL;
+ if ((sender = snd_seq_client_use_ptr(subs->sender.client)) == NULL)
+ goto __end;
+ if ((sport = snd_seq_port_use_ptr(sender, subs->sender.port)) == NULL)
+ goto __end;
+- p = snd_seq_port_get_subscription(&sport->c_src, &subs->dest);
+- if (p) {
+- result = 0;
+- *subs = p->info;
+- } else
+- result = -ENOENT;
+-
++ result = snd_seq_port_get_subscription(&sport->c_src, &subs->dest,
++ subs);
+ __end:
+ if (sport)
+ snd_seq_port_unlock(sport);
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index da31aa8e216e..16289aefb443 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -635,20 +635,23 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector,
+
+
+ /* get matched subscriber */
+-struct snd_seq_subscribers *snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
+- struct snd_seq_addr *dest_addr)
++int snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
++ struct snd_seq_addr *dest_addr,
++ struct snd_seq_port_subscribe *subs)
+ {
+- struct snd_seq_subscribers *s, *found = NULL;
++ struct snd_seq_subscribers *s;
++ int err = -ENOENT;
+
+ down_read(&src_grp->list_mutex);
+ list_for_each_entry(s, &src_grp->list_head, src_list) {
+ if (addr_match(dest_addr, &s->info.dest)) {
+- found = s;
++ *subs = s->info;
++ err = 0;
+ break;
+ }
+ }
+ up_read(&src_grp->list_mutex);
+- return found;
++ return err;
+ }
+
+ /*
+diff --git a/sound/core/seq/seq_ports.h b/sound/core/seq/seq_ports.h
+index 26bd71f36c41..06003b36652e 100644
+--- a/sound/core/seq/seq_ports.h
++++ b/sound/core/seq/seq_ports.h
+@@ -135,7 +135,8 @@ int snd_seq_port_subscribe(struct snd_seq_client_port *port,
+ struct snd_seq_port_subscribe *info);
+
+ /* get matched subscriber */
+-struct snd_seq_subscribers *snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
+- struct snd_seq_addr *dest_addr);
++int snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
++ struct snd_seq_addr *dest_addr,
++ struct snd_seq_port_subscribe *subs);
+
+ #endif
+diff --git a/sound/firewire/motu/motu-stream.c b/sound/firewire/motu/motu-stream.c
+index 73e7a5e527fc..483a8771d502 100644
+--- a/sound/firewire/motu/motu-stream.c
++++ b/sound/firewire/motu/motu-stream.c
+@@ -345,7 +345,7 @@ static void destroy_stream(struct snd_motu *motu,
+ }
+
+ amdtp_stream_destroy(stream);
+- fw_iso_resources_free(resources);
++ fw_iso_resources_destroy(resources);
+ }
+
+ int snd_motu_stream_init_duplex(struct snd_motu *motu)
+diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
+index 5f82a375725a..4ecaf69569dc 100644
+--- a/sound/firewire/oxfw/oxfw.c
++++ b/sound/firewire/oxfw/oxfw.c
+@@ -170,9 +170,6 @@ static int detect_quirks(struct snd_oxfw *oxfw)
+ oxfw->midi_input_ports = 0;
+ oxfw->midi_output_ports = 0;
+
+- /* Output stream exists but no data channels are useful. */
+- oxfw->has_output = false;
+-
+ return snd_oxfw_scs1x_add(oxfw);
+ }
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 5e6cb625db83..e154506a66cb 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4082,18 +4082,19 @@ static struct coef_fw alc225_pre_hsmode[] = {
+ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ {
+ static struct coef_fw coef0255[] = {
++ WRITE_COEF(0x1b, 0x0c0b), /* LDO and MISC control */
+ WRITE_COEF(0x45, 0xd089), /* UAJ function set to menual mode */
+ UPDATE_COEFEX(0x57, 0x05, 1<<14, 0), /* Direct Drive HP Amp control(Set to verb control)*/
+ WRITE_COEF(0x06, 0x6104), /* Set MIC2 Vref gate with HP */
+ WRITE_COEFEX(0x57, 0x03, 0x8aa6), /* Direct Drive HP Amp control */
+ {}
+ };
+- static struct coef_fw coef0255_1[] = {
+- WRITE_COEF(0x1b, 0x0c0b), /* LDO and MISC control */
+- {}
+- };
+ static struct coef_fw coef0256[] = {
+ WRITE_COEF(0x1b, 0x0c4b), /* LDO and MISC control */
++ WRITE_COEF(0x45, 0xd089), /* UAJ function set to menual mode */
++ WRITE_COEF(0x06, 0x6104), /* Set MIC2 Vref gate with HP */
++ WRITE_COEFEX(0x57, 0x03, 0x09a3), /* Direct Drive HP Amp control */
++ UPDATE_COEFEX(0x57, 0x05, 1<<14, 0), /* Direct Drive HP Amp control(Set to verb control)*/
+ {}
+ };
+ static struct coef_fw coef0233[] = {
+@@ -4156,13 +4157,11 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+
+ switch (codec->core.vendor_id) {
+ case 0x10ec0255:
+- alc_process_coef_fw(codec, coef0255_1);
+ alc_process_coef_fw(codec, coef0255);
+ break;
+ case 0x10ec0236:
+ case 0x10ec0256:
+ alc_process_coef_fw(codec, coef0256);
+- alc_process_coef_fw(codec, coef0255);
+ break;
+ case 0x10ec0234:
+ case 0x10ec0274:
+@@ -4215,6 +4214,12 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ WRITE_COEF(0x06, 0x6100), /* Set MIC2 Vref gate to normal */
+ {}
+ };
++ static struct coef_fw coef0256[] = {
++ UPDATE_COEFEX(0x57, 0x05, 1<<14, 1<<14), /* Direct Drive HP Amp control(Set to verb control)*/
++ WRITE_COEFEX(0x57, 0x03, 0x09a3),
++ WRITE_COEF(0x06, 0x6100), /* Set MIC2 Vref gate to normal */
++ {}
++ };
+ static struct coef_fw coef0233[] = {
+ UPDATE_COEF(0x35, 0, 1<<14),
+ WRITE_COEF(0x06, 0x2100),
+@@ -4262,14 +4267,19 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ };
+
+ switch (codec->core.vendor_id) {
+- case 0x10ec0236:
+ case 0x10ec0255:
+- case 0x10ec0256:
+ alc_write_coef_idx(codec, 0x45, 0xc489);
+ snd_hda_set_pin_ctl_cache(codec, hp_pin, 0);
+ alc_process_coef_fw(codec, coef0255);
+ snd_hda_set_pin_ctl_cache(codec, mic_pin, PIN_VREF50);
+ break;
++ case 0x10ec0236:
++ case 0x10ec0256:
++ alc_write_coef_idx(codec, 0x45, 0xc489);
++ snd_hda_set_pin_ctl_cache(codec, hp_pin, 0);
++ alc_process_coef_fw(codec, coef0256);
++ snd_hda_set_pin_ctl_cache(codec, mic_pin, PIN_VREF50);
++ break;
+ case 0x10ec0234:
+ case 0x10ec0274:
+ case 0x10ec0294:
+@@ -4351,6 +4361,14 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ WRITE_COEF(0x49, 0x0049),
+ {}
+ };
++ static struct coef_fw coef0256[] = {
++ WRITE_COEF(0x45, 0xc489),
++ WRITE_COEFEX(0x57, 0x03, 0x0da3),
++ WRITE_COEF(0x49, 0x0049),
++ UPDATE_COEFEX(0x57, 0x05, 1<<14, 0), /* Direct Drive HP Amp control(Set to verb control)*/
++ WRITE_COEF(0x06, 0x6100),
++ {}
++ };
+ static struct coef_fw coef0233[] = {
+ WRITE_COEF(0x06, 0x2100),
+ WRITE_COEF(0x32, 0x4ea3),
+@@ -4401,11 +4419,16 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ alc_process_coef_fw(codec, alc225_pre_hsmode);
+ alc_process_coef_fw(codec, coef0225);
+ break;
+- case 0x10ec0236:
+ case 0x10ec0255:
+- case 0x10ec0256:
+ alc_process_coef_fw(codec, coef0255);
+ break;
++ case 0x10ec0236:
++ case 0x10ec0256:
++ alc_write_coef_idx(codec, 0x1b, 0x0e4b);
++ alc_write_coef_idx(codec, 0x45, 0xc089);
++ msleep(50);
++ alc_process_coef_fw(codec, coef0256);
++ break;
+ case 0x10ec0234:
+ case 0x10ec0274:
+ case 0x10ec0294:
+@@ -4449,8 +4472,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
+ };
+ static struct coef_fw coef0256[] = {
+ WRITE_COEF(0x45, 0xd489), /* Set to CTIA type */
+- WRITE_COEF(0x1b, 0x0c6b),
+- WRITE_COEFEX(0x57, 0x03, 0x8ea6),
++ WRITE_COEF(0x1b, 0x0e6b),
+ {}
+ };
+ static struct coef_fw coef0233[] = {
+@@ -4568,8 +4590,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)
+ };
+ static struct coef_fw coef0256[] = {
+ WRITE_COEF(0x45, 0xe489), /* Set to OMTP Type */
+- WRITE_COEF(0x1b, 0x0c6b),
+- WRITE_COEFEX(0x57, 0x03, 0x8ea6),
++ WRITE_COEF(0x1b, 0x0e6b),
+ {}
+ };
+ static struct coef_fw coef0233[] = {
+@@ -4701,13 +4722,37 @@ static void alc_determine_headset_type(struct hda_codec *codec)
+ };
+
+ switch (codec->core.vendor_id) {
+- case 0x10ec0236:
+ case 0x10ec0255:
++ alc_process_coef_fw(codec, coef0255);
++ msleep(300);
++ val = alc_read_coef_idx(codec, 0x46);
++ is_ctia = (val & 0x0070) == 0x0070;
++ break;
++ case 0x10ec0236:
+ case 0x10ec0256:
++ alc_write_coef_idx(codec, 0x1b, 0x0e4b);
++ alc_write_coef_idx(codec, 0x06, 0x6104);
++ alc_write_coefex_idx(codec, 0x57, 0x3, 0x09a3);
++
++ snd_hda_codec_write(codec, 0x21, 0,
++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
++ msleep(80);
++ snd_hda_codec_write(codec, 0x21, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++
+ alc_process_coef_fw(codec, coef0255);
+ msleep(300);
+ val = alc_read_coef_idx(codec, 0x46);
+ is_ctia = (val & 0x0070) == 0x0070;
++
++ alc_write_coefex_idx(codec, 0x57, 0x3, 0x0da3);
++ alc_update_coefex_idx(codec, 0x57, 0x5, 1<<14, 0);
++
++ snd_hda_codec_write(codec, 0x21, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
++ msleep(80);
++ snd_hda_codec_write(codec, 0x21, 0,
++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
+ break;
+ case 0x10ec0234:
+ case 0x10ec0274:
+@@ -6084,15 +6129,13 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chain_id = ALC269_FIXUP_THINKPAD_ACPI,
+ },
+ [ALC255_FIXUP_ACER_MIC_NO_PRESENCE] = {
+- .type = HDA_FIXUP_VERBS,
+- .v.verbs = (const struct hda_verb[]) {
+- /* Enable the Mic */
+- { 0x20, AC_VERB_SET_COEF_INDEX, 0x45 },
+- { 0x20, AC_VERB_SET_PROC_COEF, 0x5089 },
+- {}
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ { }
+ },
+ .chained = true,
+- .chain_id = ALC269_FIXUP_LIFEBOOK_EXTMIC
++ .chain_id = ALC255_FIXUP_HEADSET_MODE
+ },
+ [ALC255_FIXUP_ASUS_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+@@ -7123,10 +7166,6 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x18, 0x02a11030},
+ {0x19, 0x0181303F},
+ {0x21, 0x0221102f}),
+- SND_HDA_PIN_QUIRK(0x10ec0255, 0x1025, "Acer", ALC255_FIXUP_ACER_MIC_NO_PRESENCE,
+- {0x12, 0x90a60140},
+- {0x14, 0x90170120},
+- {0x21, 0x02211030}),
+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1025, "Acer", ALC255_FIXUP_ACER_MIC_NO_PRESENCE,
+ {0x12, 0x90a601c0},
+ {0x14, 0x90171120},
+diff --git a/sound/soc/codecs/cs42xx8.c b/sound/soc/codecs/cs42xx8.c
+index ebb9e0cf8364..28a4ac36c4f8 100644
+--- a/sound/soc/codecs/cs42xx8.c
++++ b/sound/soc/codecs/cs42xx8.c
+@@ -558,6 +558,7 @@ static int cs42xx8_runtime_resume(struct device *dev)
+ msleep(5);
+
+ regcache_cache_only(cs42xx8->regmap, false);
++ regcache_mark_dirty(cs42xx8->regmap);
+
+ ret = regcache_sync(cs42xx8->regmap);
+ if (ret) {
+diff --git a/sound/soc/fsl/fsl_asrc.c b/sound/soc/fsl/fsl_asrc.c
+index 528e8b108422..09e03b884a82 100644
+--- a/sound/soc/fsl/fsl_asrc.c
++++ b/sound/soc/fsl/fsl_asrc.c
+@@ -282,8 +282,8 @@ static int fsl_asrc_config_pair(struct fsl_asrc_pair *pair)
+ return -EINVAL;
+ }
+
+- if ((outrate > 8000 && outrate < 30000) &&
+- (outrate/inrate > 24 || inrate/outrate > 8)) {
++ if ((outrate >= 8000 && outrate <= 30000) &&
++ (outrate > 24 * inrate || inrate > 8 * outrate)) {
+ pair_err("exceed supported ratio range [1/24, 8] for \
+ inrate/outrate: %d/%d\n", inrate, outrate);
+ return -EINVAL;
+diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
+index 195ba486640f..ba7ee74ee533 100755
+--- a/tools/kvm/kvm_stat/kvm_stat
++++ b/tools/kvm/kvm_stat/kvm_stat
+@@ -575,8 +575,12 @@ class TracepointProvider(Provider):
+ def update_fields(self, fields_filter):
+ """Refresh fields, applying fields_filter"""
+ self.fields = [field for field in self._get_available_fields()
+- if self.is_field_wanted(fields_filter, field) or
+- ARCH.tracepoint_is_child(field)]
++ if self.is_field_wanted(fields_filter, field)]
++ # add parents for child fields - otherwise we won't see any output!
++ for field in self._fields:
++ parent = ARCH.tracepoint_is_child(field)
++ if (parent and parent not in self._fields):
++ self.fields.append(parent)
+
+ @staticmethod
+ def _get_online_cpus():
+@@ -735,8 +739,12 @@ class DebugfsProvider(Provider):
+ def update_fields(self, fields_filter):
+ """Refresh fields, applying fields_filter"""
+ self._fields = [field for field in self._get_available_fields()
+- if self.is_field_wanted(fields_filter, field) or
+- ARCH.debugfs_is_child(field)]
++ if self.is_field_wanted(fields_filter, field)]
++ # add parents for child fields - otherwise we won't see any output!
++ for field in self._fields:
++ parent = ARCH.debugfs_is_child(field)
++ if (parent and parent not in self._fields):
++ self.fields.append(parent)
+
+ @property
+ def fields(self):
+diff --git a/tools/kvm/kvm_stat/kvm_stat.txt b/tools/kvm/kvm_stat/kvm_stat.txt
+index 0811d860fe75..c057ba52364e 100644
+--- a/tools/kvm/kvm_stat/kvm_stat.txt
++++ b/tools/kvm/kvm_stat/kvm_stat.txt
+@@ -34,6 +34,8 @@ INTERACTIVE COMMANDS
+ *c*:: clear filter
+
+ *f*:: filter by regular expression
++ :: *Note*: Child events pull in their parents, and parents' stats summarize
++ all child events, not just the filtered ones
+
+ *g*:: filter by guest name/PID
+
+diff --git a/tools/testing/selftests/net/fib_rule_tests.sh b/tools/testing/selftests/net/fib_rule_tests.sh
+index d84193bdc307..dbd90ca73e44 100755
+--- a/tools/testing/selftests/net/fib_rule_tests.sh
++++ b/tools/testing/selftests/net/fib_rule_tests.sh
+@@ -55,7 +55,7 @@ setup()
+
+ $IP link add dummy0 type dummy
+ $IP link set dev dummy0 up
+- $IP address add 198.51.100.1/24 dev dummy0
++ $IP address add 192.51.100.1/24 dev dummy0
+ $IP -6 address add 2001:db8:1::1/64 dev dummy0
+
+ set +e
+diff --git a/tools/testing/selftests/timers/adjtick.c b/tools/testing/selftests/timers/adjtick.c
+index 0caca3a06bd2..54d8d87f36b3 100644
+--- a/tools/testing/selftests/timers/adjtick.c
++++ b/tools/testing/selftests/timers/adjtick.c
+@@ -136,6 +136,7 @@ int check_tick_adj(long tickval)
+
+ eppm = get_ppm_drift();
+ printf("%lld usec, %lld ppm", systick + (systick * eppm / MILLION), eppm);
++ fflush(stdout);
+
+ tx1.modes = 0;
+ adjtimex(&tx1);
+diff --git a/tools/testing/selftests/timers/leapcrash.c b/tools/testing/selftests/timers/leapcrash.c
+index 830c462f605d..dc80728ed191 100644
+--- a/tools/testing/selftests/timers/leapcrash.c
++++ b/tools/testing/selftests/timers/leapcrash.c
+@@ -101,6 +101,7 @@ int main(void)
+ }
+ clear_time_state();
+ printf(".");
++ fflush(stdout);
+ }
+ printf("[OK]\n");
+ return ksft_exit_pass();
+diff --git a/tools/testing/selftests/timers/mqueue-lat.c b/tools/testing/selftests/timers/mqueue-lat.c
+index 1867db5d6f5e..7916cf5cc6ff 100644
+--- a/tools/testing/selftests/timers/mqueue-lat.c
++++ b/tools/testing/selftests/timers/mqueue-lat.c
+@@ -102,6 +102,7 @@ int main(int argc, char **argv)
+ int ret;
+
+ printf("Mqueue latency : ");
++ fflush(stdout);
+
+ ret = mqueue_lat_test();
+ if (ret < 0) {
+diff --git a/tools/testing/selftests/timers/nanosleep.c b/tools/testing/selftests/timers/nanosleep.c
+index 8adb0bb51d4d..71b5441c2fd9 100644
+--- a/tools/testing/selftests/timers/nanosleep.c
++++ b/tools/testing/selftests/timers/nanosleep.c
+@@ -142,6 +142,7 @@ int main(int argc, char **argv)
+ continue;
+
+ printf("Nanosleep %-31s ", clockstring(clockid));
++ fflush(stdout);
+
+ length = 10;
+ while (length <= (NSEC_PER_SEC * 10)) {
+diff --git a/tools/testing/selftests/timers/nsleep-lat.c b/tools/testing/selftests/timers/nsleep-lat.c
+index c3c3dc10db17..eb3e79ed7b4a 100644
+--- a/tools/testing/selftests/timers/nsleep-lat.c
++++ b/tools/testing/selftests/timers/nsleep-lat.c
+@@ -155,6 +155,7 @@ int main(int argc, char **argv)
+ continue;
+
+ printf("nsleep latency %-26s ", clockstring(clockid));
++ fflush(stdout);
+
+ length = 10;
+ while (length <= (NSEC_PER_SEC * 10)) {
+diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c
+index dcf73c5dab6e..b41d8dd0c40c 100644
+--- a/tools/testing/selftests/timers/raw_skew.c
++++ b/tools/testing/selftests/timers/raw_skew.c
+@@ -112,6 +112,7 @@ int main(int argv, char **argc)
+ printf("WARNING: ADJ_OFFSET in progress, this will cause inaccurate results\n");
+
+ printf("Estimating clock drift: ");
++ fflush(stdout);
+ sleep(120);
+
+ get_monotonic_and_raw(&mon, &raw);
+diff --git a/tools/testing/selftests/timers/set-tai.c b/tools/testing/selftests/timers/set-tai.c
+index 70fed27d8fd3..8c4179ee2ca2 100644
+--- a/tools/testing/selftests/timers/set-tai.c
++++ b/tools/testing/selftests/timers/set-tai.c
+@@ -55,6 +55,7 @@ int main(int argc, char **argv)
+ printf("tai offset started at %i\n", ret);
+
+ printf("Checking tai offsets can be properly set: ");
++ fflush(stdout);
+ for (i = 1; i <= 60; i++) {
+ ret = set_tai(i);
+ ret = get_tai();
+diff --git a/tools/testing/selftests/timers/set-tz.c b/tools/testing/selftests/timers/set-tz.c
+index 877fd5532fee..62bd33eb16f0 100644
+--- a/tools/testing/selftests/timers/set-tz.c
++++ b/tools/testing/selftests/timers/set-tz.c
+@@ -65,6 +65,7 @@ int main(int argc, char **argv)
+ printf("tz_minuteswest started at %i, dst at %i\n", min, dst);
+
+ printf("Checking tz_minuteswest can be properly set: ");
++ fflush(stdout);
+ for (i = -15*60; i < 15*60; i += 30) {
+ ret = set_tz(i, dst);
+ ret = get_tz_min();
+@@ -76,6 +77,7 @@ int main(int argc, char **argv)
+ printf("[OK]\n");
+
+ printf("Checking invalid tz_minuteswest values are caught: ");
++ fflush(stdout);
+
+ if (!set_tz(-15*60-1, dst)) {
+ printf("[FAILED] %i didn't return failure!\n", -15*60-1);
+diff --git a/tools/testing/selftests/timers/threadtest.c b/tools/testing/selftests/timers/threadtest.c
+index 759c9c06f1a0..cf3e48919874 100644
+--- a/tools/testing/selftests/timers/threadtest.c
++++ b/tools/testing/selftests/timers/threadtest.c
+@@ -163,6 +163,7 @@ int main(int argc, char **argv)
+ strftime(buf, 255, "%a, %d %b %Y %T %z", localtime(&start));
+ printf("%s\n", buf);
+ printf("Testing consistency with %i threads for %ld seconds: ", thread_count, runtime);
++ fflush(stdout);
+
+ /* spawn */
+ for (i = 0; i < thread_count; i++)
+diff --git a/tools/testing/selftests/timers/valid-adjtimex.c b/tools/testing/selftests/timers/valid-adjtimex.c
+index d9d3ab93b31a..5397de708d3c 100644
+--- a/tools/testing/selftests/timers/valid-adjtimex.c
++++ b/tools/testing/selftests/timers/valid-adjtimex.c
+@@ -123,6 +123,7 @@ int validate_freq(void)
+ /* Set the leap second insert flag */
+
+ printf("Testing ADJ_FREQ... ");
++ fflush(stdout);
+ for (i = 0; i < NUM_FREQ_VALID; i++) {
+ tx.modes = ADJ_FREQUENCY;
+ tx.freq = valid_freq[i];
+@@ -250,6 +251,7 @@ int set_bad_offset(long sec, long usec, int use_nano)
+ int validate_set_offset(void)
+ {
+ printf("Testing ADJ_SETOFFSET... ");
++ fflush(stdout);
+
+ /* Test valid values */
+ if (set_offset(NSEC_PER_SEC - 1, 1))
+diff --git a/virt/kvm/arm/aarch32.c b/virt/kvm/arm/aarch32.c
+index 5abbe9b3c652..6880236974b8 100644
+--- a/virt/kvm/arm/aarch32.c
++++ b/virt/kvm/arm/aarch32.c
+@@ -25,127 +25,6 @@
+ #include <asm/kvm_emulate.h>
+ #include <asm/kvm_hyp.h>
+
+-/*
+- * stolen from arch/arm/kernel/opcodes.c
+- *
+- * condition code lookup table
+- * index into the table is test code: EQ, NE, ... LT, GT, AL, NV
+- *
+- * bit position in short is condition code: NZCV
+- */
+-static const unsigned short cc_map[16] = {
+- 0xF0F0, /* EQ == Z set */
+- 0x0F0F, /* NE */
+- 0xCCCC, /* CS == C set */
+- 0x3333, /* CC */
+- 0xFF00, /* MI == N set */
+- 0x00FF, /* PL */
+- 0xAAAA, /* VS == V set */
+- 0x5555, /* VC */
+- 0x0C0C, /* HI == C set && Z clear */
+- 0xF3F3, /* LS == C clear || Z set */
+- 0xAA55, /* GE == (N==V) */
+- 0x55AA, /* LT == (N!=V) */
+- 0x0A05, /* GT == (!Z && (N==V)) */
+- 0xF5FA, /* LE == (Z || (N!=V)) */
+- 0xFFFF, /* AL always */
+- 0 /* NV */
+-};
+-
+-/*
+- * Check if a trapped instruction should have been executed or not.
+- */
+-bool __hyp_text kvm_condition_valid32(const struct kvm_vcpu *vcpu)
+-{
+- unsigned long cpsr;
+- u32 cpsr_cond;
+- int cond;
+-
+- /* Top two bits non-zero? Unconditional. */
+- if (kvm_vcpu_get_hsr(vcpu) >> 30)
+- return true;
+-
+- /* Is condition field valid? */
+- cond = kvm_vcpu_get_condition(vcpu);
+- if (cond == 0xE)
+- return true;
+-
+- cpsr = *vcpu_cpsr(vcpu);
+-
+- if (cond < 0) {
+- /* This can happen in Thumb mode: examine IT state. */
+- unsigned long it;
+-
+- it = ((cpsr >> 8) & 0xFC) | ((cpsr >> 25) & 0x3);
+-
+- /* it == 0 => unconditional. */
+- if (it == 0)
+- return true;
+-
+- /* The cond for this insn works out as the top 4 bits. */
+- cond = (it >> 4);
+- }
+-
+- cpsr_cond = cpsr >> 28;
+-
+- if (!((cc_map[cond] >> cpsr_cond) & 1))
+- return false;
+-
+- return true;
+-}
+-
+-/**
+- * adjust_itstate - adjust ITSTATE when emulating instructions in IT-block
+- * @vcpu: The VCPU pointer
+- *
+- * When exceptions occur while instructions are executed in Thumb IF-THEN
+- * blocks, the ITSTATE field of the CPSR is not advanced (updated), so we have
+- * to do this little bit of work manually. The fields map like this:
+- *
+- * IT[7:0] -> CPSR[26:25],CPSR[15:10]
+- */
+-static void __hyp_text kvm_adjust_itstate(struct kvm_vcpu *vcpu)
+-{
+- unsigned long itbits, cond;
+- unsigned long cpsr = *vcpu_cpsr(vcpu);
+- bool is_arm = !(cpsr & PSR_AA32_T_BIT);
+-
+- if (is_arm || !(cpsr & PSR_AA32_IT_MASK))
+- return;
+-
+- cond = (cpsr & 0xe000) >> 13;
+- itbits = (cpsr & 0x1c00) >> (10 - 2);
+- itbits |= (cpsr & (0x3 << 25)) >> 25;
+-
+- /* Perform ITAdvance (see page A2-52 in ARM DDI 0406C) */
+- if ((itbits & 0x7) == 0)
+- itbits = cond = 0;
+- else
+- itbits = (itbits << 1) & 0x1f;
+-
+- cpsr &= ~PSR_AA32_IT_MASK;
+- cpsr |= cond << 13;
+- cpsr |= (itbits & 0x1c) << (10 - 2);
+- cpsr |= (itbits & 0x3) << 25;
+- *vcpu_cpsr(vcpu) = cpsr;
+-}
+-
+-/**
+- * kvm_skip_instr - skip a trapped instruction and proceed to the next
+- * @vcpu: The vcpu pointer
+- */
+-void __hyp_text kvm_skip_instr32(struct kvm_vcpu *vcpu, bool is_wide_instr)
+-{
+- bool is_thumb;
+-
+- is_thumb = !!(*vcpu_cpsr(vcpu) & PSR_AA32_T_BIT);
+- if (is_thumb && !is_wide_instr)
+- *vcpu_pc(vcpu) += 2;
+- else
+- *vcpu_pc(vcpu) += 4;
+- kvm_adjust_itstate(vcpu);
+-}
+-
+ /*
+ * Table taken from ARMv8 ARM DDI0487B-B, table G1-10.
+ */
+diff --git a/virt/kvm/arm/hyp/aarch32.c b/virt/kvm/arm/hyp/aarch32.c
+new file mode 100644
+index 000000000000..d31f267961e7
+--- /dev/null
++++ b/virt/kvm/arm/hyp/aarch32.c
+@@ -0,0 +1,136 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Hyp portion of the (not much of an) Emulation layer for 32bit guests.
++ *
++ * Copyright (C) 2012,2013 - ARM Ltd
++ * Author: Marc Zyngier <marc.zyngier@arm.com>
++ *
++ * based on arch/arm/kvm/emulate.c
++ * Copyright (C) 2012 - Virtual Open Systems and Columbia University
++ * Author: Christoffer Dall <c.dall@virtualopensystems.com>
++ */
++
++#include <linux/kvm_host.h>
++#include <asm/kvm_emulate.h>
++#include <asm/kvm_hyp.h>
++
++/*
++ * stolen from arch/arm/kernel/opcodes.c
++ *
++ * condition code lookup table
++ * index into the table is test code: EQ, NE, ... LT, GT, AL, NV
++ *
++ * bit position in short is condition code: NZCV
++ */
++static const unsigned short cc_map[16] = {
++ 0xF0F0, /* EQ == Z set */
++ 0x0F0F, /* NE */
++ 0xCCCC, /* CS == C set */
++ 0x3333, /* CC */
++ 0xFF00, /* MI == N set */
++ 0x00FF, /* PL */
++ 0xAAAA, /* VS == V set */
++ 0x5555, /* VC */
++ 0x0C0C, /* HI == C set && Z clear */
++ 0xF3F3, /* LS == C clear || Z set */
++ 0xAA55, /* GE == (N==V) */
++ 0x55AA, /* LT == (N!=V) */
++ 0x0A05, /* GT == (!Z && (N==V)) */
++ 0xF5FA, /* LE == (Z || (N!=V)) */
++ 0xFFFF, /* AL always */
++ 0 /* NV */
++};
++
++/*
++ * Check if a trapped instruction should have been executed or not.
++ */
++bool __hyp_text kvm_condition_valid32(const struct kvm_vcpu *vcpu)
++{
++ unsigned long cpsr;
++ u32 cpsr_cond;
++ int cond;
++
++ /* Top two bits non-zero? Unconditional. */
++ if (kvm_vcpu_get_hsr(vcpu) >> 30)
++ return true;
++
++ /* Is condition field valid? */
++ cond = kvm_vcpu_get_condition(vcpu);
++ if (cond == 0xE)
++ return true;
++
++ cpsr = *vcpu_cpsr(vcpu);
++
++ if (cond < 0) {
++ /* This can happen in Thumb mode: examine IT state. */
++ unsigned long it;
++
++ it = ((cpsr >> 8) & 0xFC) | ((cpsr >> 25) & 0x3);
++
++ /* it == 0 => unconditional. */
++ if (it == 0)
++ return true;
++
++ /* The cond for this insn works out as the top 4 bits. */
++ cond = (it >> 4);
++ }
++
++ cpsr_cond = cpsr >> 28;
++
++ if (!((cc_map[cond] >> cpsr_cond) & 1))
++ return false;
++
++ return true;
++}
++
++/**
++ * adjust_itstate - adjust ITSTATE when emulating instructions in IT-block
++ * @vcpu: The VCPU pointer
++ *
++ * When exceptions occur while instructions are executed in Thumb IF-THEN
++ * blocks, the ITSTATE field of the CPSR is not advanced (updated), so we have
++ * to do this little bit of work manually. The fields map like this:
++ *
++ * IT[7:0] -> CPSR[26:25],CPSR[15:10]
++ */
++static void __hyp_text kvm_adjust_itstate(struct kvm_vcpu *vcpu)
++{
++ unsigned long itbits, cond;
++ unsigned long cpsr = *vcpu_cpsr(vcpu);
++ bool is_arm = !(cpsr & PSR_AA32_T_BIT);
++
++ if (is_arm || !(cpsr & PSR_AA32_IT_MASK))
++ return;
++
++ cond = (cpsr & 0xe000) >> 13;
++ itbits = (cpsr & 0x1c00) >> (10 - 2);
++ itbits |= (cpsr & (0x3 << 25)) >> 25;
++
++ /* Perform ITAdvance (see page A2-52 in ARM DDI 0406C) */
++ if ((itbits & 0x7) == 0)
++ itbits = cond = 0;
++ else
++ itbits = (itbits << 1) & 0x1f;
++
++ cpsr &= ~PSR_AA32_IT_MASK;
++ cpsr |= cond << 13;
++ cpsr |= (itbits & 0x1c) << (10 - 2);
++ cpsr |= (itbits & 0x3) << 25;
++ *vcpu_cpsr(vcpu) = cpsr;
++}
++
++/**
++ * kvm_skip_instr - skip a trapped instruction and proceed to the next
++ * @vcpu: The vcpu pointer
++ */
++void __hyp_text kvm_skip_instr32(struct kvm_vcpu *vcpu, bool is_wide_instr)
++{
++ bool is_thumb;
++
++ is_thumb = !!(*vcpu_cpsr(vcpu) & PSR_AA32_T_BIT);
++ if (is_thumb && !is_wide_instr)
++ *vcpu_pc(vcpu) += 2;
++ else
++ *vcpu_pc(vcpu) += 4;
++ kvm_adjust_itstate(vcpu);
++}
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-06-22 19:06 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-06-22 19:06 UTC (permalink / raw
To: gentoo-commits
commit: 62a38b9ab69d2607601ef3a8fcdfaec29c1a5053
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Jun 22 19:06:28 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Jun 22 19:06:28 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=62a38b9a
Linux patches 4.19.54 and 4.19.55
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 8 +
1053_linux-4.19.54.patch | 1700 ++++++++++++++++++++++++++++++++++++++++++++++
1054_linux-4.19.55.patch | 27 +
3 files changed, 1735 insertions(+)
diff --git a/0000_README b/0000_README
index 76bab6e..545a5dd 100644
--- a/0000_README
+++ b/0000_README
@@ -255,6 +255,14 @@ Patch: 1052_linux-4.19.53.patch
From: https://www.kernel.org
Desc: Linux 4.19.53
+Patch: 1053_linux-4.19.54.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.54
+
+Patch: 1054_linux-4.19.55.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.55
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1053_linux-4.19.54.patch b/1053_linux-4.19.54.patch
new file mode 100644
index 0000000..e75cc51
--- /dev/null
+++ b/1053_linux-4.19.54.patch
@@ -0,0 +1,1700 @@
+diff --git a/Makefile b/Makefile
+index bedcb121dc3d..b234837e4d07 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 53
++SUBLEVEL = 54
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h
+index ad8be16a39c9..58102652bf9e 100644
+--- a/arch/arm64/include/asm/syscall.h
++++ b/arch/arm64/include/asm/syscall.h
+@@ -20,7 +20,7 @@
+ #include <linux/compat.h>
+ #include <linux/err.h>
+
+-typedef long (*syscall_fn_t)(struct pt_regs *regs);
++typedef long (*syscall_fn_t)(const struct pt_regs *regs);
+
+ extern const syscall_fn_t sys_call_table[];
+
+diff --git a/arch/arm64/include/asm/syscall_wrapper.h b/arch/arm64/include/asm/syscall_wrapper.h
+index a4477e515b79..507d0ee6bc69 100644
+--- a/arch/arm64/include/asm/syscall_wrapper.h
++++ b/arch/arm64/include/asm/syscall_wrapper.h
+@@ -30,10 +30,10 @@
+ } \
+ static inline long __do_compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))
+
+-#define COMPAT_SYSCALL_DEFINE0(sname) \
+- asmlinkage long __arm64_compat_sys_##sname(void); \
+- ALLOW_ERROR_INJECTION(__arm64_compat_sys_##sname, ERRNO); \
+- asmlinkage long __arm64_compat_sys_##sname(void)
++#define COMPAT_SYSCALL_DEFINE0(sname) \
++ asmlinkage long __arm64_compat_sys_##sname(const struct pt_regs *__unused); \
++ ALLOW_ERROR_INJECTION(__arm64_compat_sys_##sname, ERRNO); \
++ asmlinkage long __arm64_compat_sys_##sname(const struct pt_regs *__unused)
+
+ #define COND_SYSCALL_COMPAT(name) \
+ cond_syscall(__arm64_compat_sys_##name);
+@@ -62,11 +62,11 @@
+ static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))
+
+ #ifndef SYSCALL_DEFINE0
+-#define SYSCALL_DEFINE0(sname) \
+- SYSCALL_METADATA(_##sname, 0); \
+- asmlinkage long __arm64_sys_##sname(void); \
+- ALLOW_ERROR_INJECTION(__arm64_sys_##sname, ERRNO); \
+- asmlinkage long __arm64_sys_##sname(void)
++#define SYSCALL_DEFINE0(sname) \
++ SYSCALL_METADATA(_##sname, 0); \
++ asmlinkage long __arm64_sys_##sname(const struct pt_regs *__unused); \
++ ALLOW_ERROR_INJECTION(__arm64_sys_##sname, ERRNO); \
++ asmlinkage long __arm64_sys_##sname(const struct pt_regs *__unused)
+ #endif
+
+ #ifndef COND_SYSCALL
+diff --git a/arch/arm64/kernel/sys.c b/arch/arm64/kernel/sys.c
+index 162a95ed0881..fe20c461582a 100644
+--- a/arch/arm64/kernel/sys.c
++++ b/arch/arm64/kernel/sys.c
+@@ -47,22 +47,26 @@ SYSCALL_DEFINE1(arm64_personality, unsigned int, personality)
+ return ksys_personality(personality);
+ }
+
++asmlinkage long sys_ni_syscall(void);
++
++asmlinkage long __arm64_sys_ni_syscall(const struct pt_regs *__unused)
++{
++ return sys_ni_syscall();
++}
++
+ /*
+ * Wrappers to pass the pt_regs argument.
+ */
+ #define __arm64_sys_personality __arm64_sys_arm64_personality
+
+-asmlinkage long sys_ni_syscall(const struct pt_regs *);
+-#define __arm64_sys_ni_syscall sys_ni_syscall
+-
+ #undef __SYSCALL
+ #define __SYSCALL(nr, sym) asmlinkage long __arm64_##sym(const struct pt_regs *);
+ #include <asm/unistd.h>
+
+ #undef __SYSCALL
+-#define __SYSCALL(nr, sym) [nr] = (syscall_fn_t)__arm64_##sym,
++#define __SYSCALL(nr, sym) [nr] = __arm64_##sym,
+
+ const syscall_fn_t sys_call_table[__NR_syscalls] = {
+- [0 ... __NR_syscalls - 1] = (syscall_fn_t)sys_ni_syscall,
++ [0 ... __NR_syscalls - 1] = __arm64_sys_ni_syscall,
+ #include <asm/unistd.h>
+ };
+diff --git a/arch/arm64/kernel/sys32.c b/arch/arm64/kernel/sys32.c
+index 0f8bcb7de700..3c80a40c1c9d 100644
+--- a/arch/arm64/kernel/sys32.c
++++ b/arch/arm64/kernel/sys32.c
+@@ -133,17 +133,14 @@ COMPAT_SYSCALL_DEFINE6(aarch32_fallocate, int, fd, int, mode,
+ return ksys_fallocate(fd, mode, arg_u64(offset), arg_u64(len));
+ }
+
+-asmlinkage long sys_ni_syscall(const struct pt_regs *);
+-#define __arm64_sys_ni_syscall sys_ni_syscall
+-
+ #undef __SYSCALL
+ #define __SYSCALL(nr, sym) asmlinkage long __arm64_##sym(const struct pt_regs *);
+ #include <asm/unistd32.h>
+
+ #undef __SYSCALL
+-#define __SYSCALL(nr, sym) [nr] = (syscall_fn_t)__arm64_##sym,
++#define __SYSCALL(nr, sym) [nr] = __arm64_##sym,
+
+ const syscall_fn_t compat_sys_call_table[__NR_compat_syscalls] = {
+- [0 ... __NR_compat_syscalls - 1] = (syscall_fn_t)sys_ni_syscall,
++ [0 ... __NR_compat_syscalls - 1] = __arm64_sys_ni_syscall,
+ #include <asm/unistd32.h>
+ };
+diff --git a/arch/ia64/mm/numa.c b/arch/ia64/mm/numa.c
+index aa19b7ac8222..476c7b4be378 100644
+--- a/arch/ia64/mm/numa.c
++++ b/arch/ia64/mm/numa.c
+@@ -49,6 +49,7 @@ paddr_to_nid(unsigned long paddr)
+
+ return (i < num_node_memblks) ? node_memblk[i].nid : (num_node_memblks ? -1 : 0);
+ }
++EXPORT_SYMBOL(paddr_to_nid);
+
+ #if defined(CONFIG_SPARSEMEM) && defined(CONFIG_NUMA)
+ /*
+diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
+index bccc5051249e..2b6049e83970 100644
+--- a/arch/powerpc/include/asm/kvm_host.h
++++ b/arch/powerpc/include/asm/kvm_host.h
+@@ -299,6 +299,7 @@ struct kvm_arch {
+ #ifdef CONFIG_PPC_BOOK3S_64
+ struct list_head spapr_tce_tables;
+ struct list_head rtas_tokens;
++ struct mutex rtas_token_lock;
+ DECLARE_BITMAP(enabled_hcalls, MAX_HCALL_OPCODE/4 + 1);
+ #endif
+ #ifdef CONFIG_KVM_MPIC
+diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c
+index 87348e498c89..281f074581a3 100644
+--- a/arch/powerpc/kvm/book3s.c
++++ b/arch/powerpc/kvm/book3s.c
+@@ -840,6 +840,7 @@ int kvmppc_core_init_vm(struct kvm *kvm)
+ #ifdef CONFIG_PPC64
+ INIT_LIST_HEAD_RCU(&kvm->arch.spapr_tce_tables);
+ INIT_LIST_HEAD(&kvm->arch.rtas_tokens);
++ mutex_init(&kvm->arch.rtas_token_lock);
+ #endif
+
+ return kvm->arch.kvm_ops->init_vm(kvm);
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 3e3a71594e63..083dcedba11c 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -426,12 +426,7 @@ static void kvmppc_dump_regs(struct kvm_vcpu *vcpu)
+
+ static struct kvm_vcpu *kvmppc_find_vcpu(struct kvm *kvm, int id)
+ {
+- struct kvm_vcpu *ret;
+-
+- mutex_lock(&kvm->lock);
+- ret = kvm_get_vcpu_by_id(kvm, id);
+- mutex_unlock(&kvm->lock);
+- return ret;
++ return kvm_get_vcpu_by_id(kvm, id);
+ }
+
+ static void init_vpa(struct kvm_vcpu *vcpu, struct lppaca *vpa)
+@@ -1309,7 +1304,6 @@ static void kvmppc_set_lpcr(struct kvm_vcpu *vcpu, u64 new_lpcr,
+ struct kvmppc_vcore *vc = vcpu->arch.vcore;
+ u64 mask;
+
+- mutex_lock(&kvm->lock);
+ spin_lock(&vc->lock);
+ /*
+ * If ILE (interrupt little-endian) has changed, update the
+@@ -1349,7 +1343,6 @@ static void kvmppc_set_lpcr(struct kvm_vcpu *vcpu, u64 new_lpcr,
+ mask &= 0xFFFFFFFF;
+ vc->lpcr = (vc->lpcr & ~mask) | (new_lpcr & mask);
+ spin_unlock(&vc->lock);
+- mutex_unlock(&kvm->lock);
+ }
+
+ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
+diff --git a/arch/powerpc/kvm/book3s_rtas.c b/arch/powerpc/kvm/book3s_rtas.c
+index 2d3b2b1cc272..8f2355138f80 100644
+--- a/arch/powerpc/kvm/book3s_rtas.c
++++ b/arch/powerpc/kvm/book3s_rtas.c
+@@ -146,7 +146,7 @@ static int rtas_token_undefine(struct kvm *kvm, char *name)
+ {
+ struct rtas_token_definition *d, *tmp;
+
+- lockdep_assert_held(&kvm->lock);
++ lockdep_assert_held(&kvm->arch.rtas_token_lock);
+
+ list_for_each_entry_safe(d, tmp, &kvm->arch.rtas_tokens, list) {
+ if (rtas_name_matches(d->handler->name, name)) {
+@@ -167,7 +167,7 @@ static int rtas_token_define(struct kvm *kvm, char *name, u64 token)
+ bool found;
+ int i;
+
+- lockdep_assert_held(&kvm->lock);
++ lockdep_assert_held(&kvm->arch.rtas_token_lock);
+
+ list_for_each_entry(d, &kvm->arch.rtas_tokens, list) {
+ if (d->token == token)
+@@ -206,14 +206,14 @@ int kvm_vm_ioctl_rtas_define_token(struct kvm *kvm, void __user *argp)
+ if (copy_from_user(&args, argp, sizeof(args)))
+ return -EFAULT;
+
+- mutex_lock(&kvm->lock);
++ mutex_lock(&kvm->arch.rtas_token_lock);
+
+ if (args.token)
+ rc = rtas_token_define(kvm, args.name, args.token);
+ else
+ rc = rtas_token_undefine(kvm, args.name);
+
+- mutex_unlock(&kvm->lock);
++ mutex_unlock(&kvm->arch.rtas_token_lock);
+
+ return rc;
+ }
+@@ -245,7 +245,7 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
+ orig_rets = args.rets;
+ args.rets = &args.args[be32_to_cpu(args.nargs)];
+
+- mutex_lock(&vcpu->kvm->lock);
++ mutex_lock(&vcpu->kvm->arch.rtas_token_lock);
+
+ rc = -ENOENT;
+ list_for_each_entry(d, &vcpu->kvm->arch.rtas_tokens, list) {
+@@ -256,7 +256,7 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
+ }
+ }
+
+- mutex_unlock(&vcpu->kvm->lock);
++ mutex_unlock(&vcpu->kvm->arch.rtas_token_lock);
+
+ if (rc == 0) {
+ args.rets = orig_rets;
+@@ -282,8 +282,6 @@ void kvmppc_rtas_tokens_free(struct kvm *kvm)
+ {
+ struct rtas_token_definition *d, *tmp;
+
+- lockdep_assert_held(&kvm->lock);
+-
+ list_for_each_entry_safe(d, tmp, &kvm->arch.rtas_tokens, list) {
+ list_del(&d->list);
+ kfree(d);
+diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c
+index 3d27f02695e4..828f6656f8f7 100644
+--- a/arch/powerpc/platforms/powernv/opal-imc.c
++++ b/arch/powerpc/platforms/powernv/opal-imc.c
+@@ -161,6 +161,10 @@ static int imc_pmu_create(struct device_node *parent, int pmu_index, int domain)
+ struct imc_pmu *pmu_ptr;
+ u32 offset;
+
++ /* Return for unknown domain */
++ if (domain < 0)
++ return -EINVAL;
++
+ /* memory for pmu */
+ pmu_ptr = kzalloc(sizeof(*pmu_ptr), GFP_KERNEL);
+ if (!pmu_ptr)
+diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
+index b7b01d762d32..e91814d1a27f 100644
+--- a/arch/x86/events/intel/ds.c
++++ b/arch/x86/events/intel/ds.c
+@@ -684,7 +684,7 @@ struct event_constraint intel_core2_pebs_event_constraints[] = {
+ INTEL_FLAGS_UEVENT_CONSTRAINT(0x1fc7, 0x1), /* SIMD_INST_RETURED.ANY */
+ INTEL_FLAGS_EVENT_CONSTRAINT(0xcb, 0x1), /* MEM_LOAD_RETIRED.* */
+ /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x01),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x01),
+ EVENT_CONSTRAINT_END
+ };
+
+@@ -693,7 +693,7 @@ struct event_constraint intel_atom_pebs_event_constraints[] = {
+ INTEL_FLAGS_UEVENT_CONSTRAINT(0x00c5, 0x1), /* MISPREDICTED_BRANCH_RETIRED */
+ INTEL_FLAGS_EVENT_CONSTRAINT(0xcb, 0x1), /* MEM_LOAD_RETIRED.* */
+ /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x01),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x01),
+ /* Allow all events as PEBS with no flags */
+ INTEL_ALL_EVENT_CONSTRAINT(0, 0x1),
+ EVENT_CONSTRAINT_END
+@@ -701,7 +701,7 @@ struct event_constraint intel_atom_pebs_event_constraints[] = {
+
+ struct event_constraint intel_slm_pebs_event_constraints[] = {
+ /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x1),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x1),
+ /* Allow all events as PEBS with no flags */
+ INTEL_ALL_EVENT_CONSTRAINT(0, 0x1),
+ EVENT_CONSTRAINT_END
+@@ -726,7 +726,7 @@ struct event_constraint intel_nehalem_pebs_event_constraints[] = {
+ INTEL_FLAGS_EVENT_CONSTRAINT(0xcb, 0xf), /* MEM_LOAD_RETIRED.* */
+ INTEL_FLAGS_EVENT_CONSTRAINT(0xf7, 0xf), /* FP_ASSIST.* */
+ /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x0f),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x0f),
+ EVENT_CONSTRAINT_END
+ };
+
+@@ -743,7 +743,7 @@ struct event_constraint intel_westmere_pebs_event_constraints[] = {
+ INTEL_FLAGS_EVENT_CONSTRAINT(0xcb, 0xf), /* MEM_LOAD_RETIRED.* */
+ INTEL_FLAGS_EVENT_CONSTRAINT(0xf7, 0xf), /* FP_ASSIST.* */
+ /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x0f),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x0f),
+ EVENT_CONSTRAINT_END
+ };
+
+@@ -752,7 +752,7 @@ struct event_constraint intel_snb_pebs_event_constraints[] = {
+ INTEL_PLD_CONSTRAINT(0x01cd, 0x8), /* MEM_TRANS_RETIRED.LAT_ABOVE_THR */
+ INTEL_PST_CONSTRAINT(0x02cd, 0x8), /* MEM_TRANS_RETIRED.PRECISE_STORES */
+ /* UOPS_RETIRED.ALL, inv=1, cmask=16 (cycles:p). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c2, 0xf),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c2, 0xf),
+ INTEL_EXCLEVT_CONSTRAINT(0xd0, 0xf), /* MEM_UOP_RETIRED.* */
+ INTEL_EXCLEVT_CONSTRAINT(0xd1, 0xf), /* MEM_LOAD_UOPS_RETIRED.* */
+ INTEL_EXCLEVT_CONSTRAINT(0xd2, 0xf), /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
+@@ -767,9 +767,9 @@ struct event_constraint intel_ivb_pebs_event_constraints[] = {
+ INTEL_PLD_CONSTRAINT(0x01cd, 0x8), /* MEM_TRANS_RETIRED.LAT_ABOVE_THR */
+ INTEL_PST_CONSTRAINT(0x02cd, 0x8), /* MEM_TRANS_RETIRED.PRECISE_STORES */
+ /* UOPS_RETIRED.ALL, inv=1, cmask=16 (cycles:p). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c2, 0xf),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c2, 0xf),
+ /* INST_RETIRED.PREC_DIST, inv=1, cmask=16 (cycles:ppp). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c0, 0x2),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c0, 0x2),
+ INTEL_EXCLEVT_CONSTRAINT(0xd0, 0xf), /* MEM_UOP_RETIRED.* */
+ INTEL_EXCLEVT_CONSTRAINT(0xd1, 0xf), /* MEM_LOAD_UOPS_RETIRED.* */
+ INTEL_EXCLEVT_CONSTRAINT(0xd2, 0xf), /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
+@@ -783,9 +783,9 @@ struct event_constraint intel_hsw_pebs_event_constraints[] = {
+ INTEL_FLAGS_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PRECDIST */
+ INTEL_PLD_CONSTRAINT(0x01cd, 0xf), /* MEM_TRANS_RETIRED.* */
+ /* UOPS_RETIRED.ALL, inv=1, cmask=16 (cycles:p). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c2, 0xf),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c2, 0xf),
+ /* INST_RETIRED.PREC_DIST, inv=1, cmask=16 (cycles:ppp). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c0, 0x2),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c0, 0x2),
+ INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_NA(0x01c2, 0xf), /* UOPS_RETIRED.ALL */
+ INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_XLD(0x11d0, 0xf), /* MEM_UOPS_RETIRED.STLB_MISS_LOADS */
+ INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_XLD(0x21d0, 0xf), /* MEM_UOPS_RETIRED.LOCK_LOADS */
+@@ -806,9 +806,9 @@ struct event_constraint intel_bdw_pebs_event_constraints[] = {
+ INTEL_FLAGS_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PRECDIST */
+ INTEL_PLD_CONSTRAINT(0x01cd, 0xf), /* MEM_TRANS_RETIRED.* */
+ /* UOPS_RETIRED.ALL, inv=1, cmask=16 (cycles:p). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c2, 0xf),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c2, 0xf),
+ /* INST_RETIRED.PREC_DIST, inv=1, cmask=16 (cycles:ppp). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c0, 0x2),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c0, 0x2),
+ INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_NA(0x01c2, 0xf), /* UOPS_RETIRED.ALL */
+ INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x11d0, 0xf), /* MEM_UOPS_RETIRED.STLB_MISS_LOADS */
+ INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x21d0, 0xf), /* MEM_UOPS_RETIRED.LOCK_LOADS */
+@@ -829,9 +829,9 @@ struct event_constraint intel_bdw_pebs_event_constraints[] = {
+ struct event_constraint intel_skl_pebs_event_constraints[] = {
+ INTEL_FLAGS_UEVENT_CONSTRAINT(0x1c0, 0x2), /* INST_RETIRED.PREC_DIST */
+ /* INST_RETIRED.PREC_DIST, inv=1, cmask=16 (cycles:ppp). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c0, 0x2),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c0, 0x2),
+ /* INST_RETIRED.TOTAL_CYCLES_PS (inv=1, cmask=16) (cycles:p). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x0f),
++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x0f),
+ INTEL_PLD_CONSTRAINT(0x1cd, 0xf), /* MEM_TRANS_RETIRED.* */
+ INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x11d0, 0xf), /* MEM_INST_RETIRED.STLB_MISS_LOADS */
+ INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_ST(0x12d0, 0xf), /* MEM_INST_RETIRED.STLB_MISS_STORES */
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 6a25278e0092..da1f5e78363e 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -819,8 +819,11 @@ static void init_amd_zn(struct cpuinfo_x86 *c)
+ {
+ set_cpu_cap(c, X86_FEATURE_ZEN);
+
+- /* Fix erratum 1076: CPB feature bit not being set in CPUID. */
+- if (!cpu_has(c, X86_FEATURE_CPB))
++ /*
++ * Fix erratum 1076: CPB feature bit not being set in CPUID.
++ * Always set it, except when running under a hypervisor.
++ */
++ if (!cpu_has(c, X86_FEATURE_HYPERVISOR) && !cpu_has(c, X86_FEATURE_CPB))
+ set_cpu_cap(c, X86_FEATURE_CPB);
+ }
+
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index a7c2673ffd36..1806260938e8 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -948,8 +948,8 @@ static bool acpi_dev_needs_resume(struct device *dev, struct acpi_device *adev)
+ u32 sys_target = acpi_target_system_state();
+ int ret, state;
+
+- if (!pm_runtime_suspended(dev) || !adev ||
+- device_may_wakeup(dev) != !!adev->wakeup.prepare_count)
++ if (!pm_runtime_suspended(dev) || !adev || (adev->wakeup.flags.valid &&
++ device_may_wakeup(dev) != !!adev->wakeup.prepare_count))
+ return true;
+
+ if (sys_target == ACPI_STATE_S0)
+diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
+index 421b05392220..ca3218337fd7 100644
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -137,9 +137,6 @@ static int _omap4_clkctrl_clk_enable(struct clk_hw *hw)
+ int ret;
+ union omap4_timeout timeout = { 0 };
+
+- if (!clk->enable_bit)
+- return 0;
+-
+ if (clk->clkdm) {
+ ret = ti_clk_ll_ops->clkdm_clk_enable(clk->clkdm, hw->clk);
+ if (ret) {
+@@ -151,6 +148,9 @@ static int _omap4_clkctrl_clk_enable(struct clk_hw *hw)
+ }
+ }
+
++ if (!clk->enable_bit)
++ return 0;
++
+ val = ti_clk_ll_ops->clk_readl(&clk->enable_reg);
+
+ val &= ~OMAP4_MODULEMODE_MASK;
+@@ -179,7 +179,7 @@ static void _omap4_clkctrl_clk_disable(struct clk_hw *hw)
+ union omap4_timeout timeout = { 0 };
+
+ if (!clk->enable_bit)
+- return;
++ goto exit;
+
+ val = ti_clk_ll_ops->clk_readl(&clk->enable_reg);
+
+diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
+index 4f52c3a8ec99..ed51221621a5 100644
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -784,6 +784,7 @@ config GPIO_ADP5588
+ config GPIO_ADP5588_IRQ
+ bool "Interrupt controller support for ADP5588"
+ depends on GPIO_ADP5588=y
++ select GPIOLIB_IRQCHIP
+ help
+ Say yes here to enable the adp5588 to be used as an interrupt
+ controller. It requires the driver to be built in the kernel.
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+index 9146e30e24a6..468dff2f7904 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+@@ -124,6 +124,8 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
+ return;
+ etnaviv_dump_core = false;
+
++ mutex_lock(&gpu->mmu->lock);
++
+ mmu_size = etnaviv_iommu_dump_size(gpu->mmu);
+
+ /* We always dump registers, mmu, ring and end marker */
+@@ -166,6 +168,7 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
+ iter.start = __vmalloc(file_size, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY,
+ PAGE_KERNEL);
+ if (!iter.start) {
++ mutex_unlock(&gpu->mmu->lock);
+ dev_warn(gpu->dev, "failed to allocate devcoredump file\n");
+ return;
+ }
+@@ -233,6 +236,8 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
+ obj->base.size);
+ }
+
++ mutex_unlock(&gpu->mmu->lock);
++
+ etnaviv_core_dump_header(&iter, ETDUMP_BUF_END, iter.data);
+
+ dev_coredumpv(gpu->dev, iter.start, iter.data - iter.start, GFP_KERNEL);
+diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
+index ccd76c71af09..cb07651f4b46 100644
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -283,6 +283,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,
+ msgs[i].len < 1 || msgs[i].buf[0] < 1 ||
+ msgs[i].len < msgs[i].buf[0] +
+ I2C_SMBUS_BLOCK_MAX) {
++ i++;
+ res = -EINVAL;
+ break;
+ }
+diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
+index b2abc44fa5cb..a73337b74f41 100644
+--- a/drivers/isdn/mISDN/socket.c
++++ b/drivers/isdn/mISDN/socket.c
+@@ -394,7 +394,7 @@ data_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ memcpy(di.channelmap, dev->channelmap,
+ sizeof(di.channelmap));
+ di.nrbchan = dev->nrbchan;
+- strcpy(di.name, dev_name(&dev->dev));
++ strscpy(di.name, dev_name(&dev->dev), sizeof(di.name));
+ if (copy_to_user((void __user *)arg, &di, sizeof(di)))
+ err = -EFAULT;
+ } else
+@@ -677,7 +677,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ memcpy(di.channelmap, dev->channelmap,
+ sizeof(di.channelmap));
+ di.nrbchan = dev->nrbchan;
+- strcpy(di.name, dev_name(&dev->dev));
++ strscpy(di.name, dev_name(&dev->dev), sizeof(di.name));
+ if (copy_to_user((void __user *)arg, &di, sizeof(di)))
+ err = -EFAULT;
+ } else
+@@ -691,6 +691,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ err = -EFAULT;
+ break;
+ }
++ dn.name[sizeof(dn.name) - 1] = '\0';
+ dev = get_mdevice(dn.id);
+ if (dev)
+ err = device_rename(&dev->dev, dn.name);
+diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c
+index 6dedd43442cc..35b767baf21f 100644
+--- a/drivers/net/dsa/rtl8366.c
++++ b/drivers/net/dsa/rtl8366.c
+@@ -307,7 +307,8 @@ int rtl8366_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering)
+ struct rtl8366_vlan_4k vlan4k;
+ int ret;
+
+- if (!smi->ops->is_vlan_valid(smi, port))
++ /* Use VLAN nr port + 1 since VLAN0 is not valid */
++ if (!smi->ops->is_vlan_valid(smi, port + 1))
+ return -EINVAL;
+
+ dev_info(smi->dev, "%s filtering on port %d\n",
+@@ -318,12 +319,12 @@ int rtl8366_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering)
+ * The hardware support filter ID (FID) 0..7, I have no clue how to
+ * support this in the driver when the callback only says on/off.
+ */
+- ret = smi->ops->get_vlan_4k(smi, port, &vlan4k);
++ ret = smi->ops->get_vlan_4k(smi, port + 1, &vlan4k);
+ if (ret)
+ return ret;
+
+ /* Just set the filter to FID 1 for now then */
+- ret = rtl8366_set_vlan(smi, port,
++ ret = rtl8366_set_vlan(smi, port + 1,
+ vlan4k.member,
+ vlan4k.untag,
+ 1);
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index 6f3312350cac..b3c7994d73eb 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -139,10 +139,10 @@ void aq_ring_queue_stop(struct aq_ring_s *ring)
+ bool aq_ring_tx_clean(struct aq_ring_s *self)
+ {
+ struct device *dev = aq_nic_get_dev(self->aq_nic);
+- unsigned int budget = AQ_CFG_TX_CLEAN_BUDGET;
++ unsigned int budget;
+
+- for (; self->sw_head != self->hw_head && budget--;
+- self->sw_head = aq_ring_next_dx(self, self->sw_head)) {
++ for (budget = AQ_CFG_TX_CLEAN_BUDGET;
++ budget && self->sw_head != self->hw_head; budget--) {
+ struct aq_ring_buff_s *buff = &self->buff_ring[self->sw_head];
+
+ if (likely(buff->is_mapped)) {
+@@ -167,6 +167,7 @@ bool aq_ring_tx_clean(struct aq_ring_s *self)
+
+ buff->pa = 0U;
+ buff->eop_index = 0xffffU;
++ self->sw_head = aq_ring_next_dx(self, self->sw_head);
+ }
+
+ return !!budget;
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 56363ff5c891..51cd1f98bcf0 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -695,38 +695,41 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self,
+ if ((rx_stat & BIT(0)) || rxd_wb->type & 0x1000U) {
+ /* MAC error or DMA error */
+ buff->is_error = 1U;
+- } else {
+- if (self->aq_nic_cfg->is_rss) {
+- /* last 4 byte */
+- u16 rss_type = rxd_wb->type & 0xFU;
+-
+- if (rss_type && rss_type < 0x8U) {
+- buff->is_hash_l4 = (rss_type == 0x4 ||
+- rss_type == 0x5);
+- buff->rss_hash = rxd_wb->rss_hash;
+- }
++ }
++ if (self->aq_nic_cfg->is_rss) {
++ /* last 4 byte */
++ u16 rss_type = rxd_wb->type & 0xFU;
++
++ if (rss_type && rss_type < 0x8U) {
++ buff->is_hash_l4 = (rss_type == 0x4 ||
++ rss_type == 0x5);
++ buff->rss_hash = rxd_wb->rss_hash;
+ }
++ }
+
+- if (HW_ATL_B0_RXD_WB_STAT2_EOP & rxd_wb->status) {
+- buff->len = rxd_wb->pkt_len %
+- AQ_CFG_RX_FRAME_MAX;
+- buff->len = buff->len ?
+- buff->len : AQ_CFG_RX_FRAME_MAX;
+- buff->next = 0U;
+- buff->is_eop = 1U;
++ if (HW_ATL_B0_RXD_WB_STAT2_EOP & rxd_wb->status) {
++ buff->len = rxd_wb->pkt_len %
++ AQ_CFG_RX_FRAME_MAX;
++ buff->len = buff->len ?
++ buff->len : AQ_CFG_RX_FRAME_MAX;
++ buff->next = 0U;
++ buff->is_eop = 1U;
++ } else {
++ buff->len =
++ rxd_wb->pkt_len > AQ_CFG_RX_FRAME_MAX ?
++ AQ_CFG_RX_FRAME_MAX : rxd_wb->pkt_len;
++
++ if (HW_ATL_B0_RXD_WB_STAT2_RSCCNT &
++ rxd_wb->status) {
++ /* LRO */
++ buff->next = rxd_wb->next_desc_ptr;
++ ++ring->stats.rx.lro_packets;
+ } else {
+- if (HW_ATL_B0_RXD_WB_STAT2_RSCCNT &
+- rxd_wb->status) {
+- /* LRO */
+- buff->next = rxd_wb->next_desc_ptr;
+- ++ring->stats.rx.lro_packets;
+- } else {
+- /* jumbo */
+- buff->next =
+- aq_ring_next_dx(ring,
+- ring->hw_head);
+- ++ring->stats.rx.jumbo_packets;
+- }
++ /* jumbo */
++ buff->next =
++ aq_ring_next_dx(ring,
++ ring->hw_head);
++ ++ring->stats.rx.jumbo_packets;
+ }
+ }
+ }
+diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
+index 66535d1653f6..f16853c3c851 100644
+--- a/drivers/net/ethernet/dec/tulip/de4x5.c
++++ b/drivers/net/ethernet/dec/tulip/de4x5.c
+@@ -2107,7 +2107,6 @@ static struct eisa_driver de4x5_eisa_driver = {
+ .remove = de4x5_eisa_remove,
+ }
+ };
+-MODULE_DEVICE_TABLE(eisa, de4x5_eisa_ids);
+ #endif
+
+ #ifdef CONFIG_PCI
+diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c
+index 3f6749fc889f..bfb16a474490 100644
+--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c
++++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c
+@@ -1105,7 +1105,7 @@ static int be_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd,
+ cmd->data = be_get_rss_hash_opts(adapter, cmd->flow_type);
+ break;
+ case ETHTOOL_GRXRINGS:
+- cmd->data = adapter->num_rx_qs - 1;
++ cmd->data = adapter->num_rx_qs;
+ break;
+ default:
+ return -EINVAL;
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+index 392fd895f278..ae2240074d8e 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -1905,8 +1905,7 @@ static int mvpp2_prs_ip6_init(struct mvpp2 *priv)
+ }
+
+ /* Find tcam entry with matched pair <vid,port> */
+-static int mvpp2_prs_vid_range_find(struct mvpp2 *priv, int pmap, u16 vid,
+- u16 mask)
++static int mvpp2_prs_vid_range_find(struct mvpp2_port *port, u16 vid, u16 mask)
+ {
+ unsigned char byte[2], enable[2];
+ struct mvpp2_prs_entry pe;
+@@ -1914,13 +1913,13 @@ static int mvpp2_prs_vid_range_find(struct mvpp2 *priv, int pmap, u16 vid,
+ int tid;
+
+ /* Go through the all entries with MVPP2_PRS_LU_VID */
+- for (tid = MVPP2_PE_VID_FILT_RANGE_START;
+- tid <= MVPP2_PE_VID_FILT_RANGE_END; tid++) {
+- if (!priv->prs_shadow[tid].valid ||
+- priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VID)
++ for (tid = MVPP2_PRS_VID_PORT_FIRST(port->id);
++ tid <= MVPP2_PRS_VID_PORT_LAST(port->id); tid++) {
++ if (!port->priv->prs_shadow[tid].valid ||
++ port->priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VID)
+ continue;
+
+- mvpp2_prs_init_from_hw(priv, &pe, tid);
++ mvpp2_prs_init_from_hw(port->priv, &pe, tid);
+
+ mvpp2_prs_tcam_data_byte_get(&pe, 2, &byte[0], &enable[0]);
+ mvpp2_prs_tcam_data_byte_get(&pe, 3, &byte[1], &enable[1]);
+@@ -1950,7 +1949,7 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ memset(&pe, 0, sizeof(pe));
+
+ /* Scan TCAM and see if entry with this <vid,port> already exist */
+- tid = mvpp2_prs_vid_range_find(priv, (1 << port->id), vid, mask);
++ tid = mvpp2_prs_vid_range_find(port, vid, mask);
+
+ reg_val = mvpp2_read(priv, MVPP2_MH_REG(port->id));
+ if (reg_val & MVPP2_DSA_EXTENDED)
+@@ -2008,7 +2007,7 @@ void mvpp2_prs_vid_entry_remove(struct mvpp2_port *port, u16 vid)
+ int tid;
+
+ /* Scan TCAM and see if entry with this <vid,port> already exist */
+- tid = mvpp2_prs_vid_range_find(priv, (1 << port->id), vid, 0xfff);
++ tid = mvpp2_prs_vid_range_find(port, vid, 0xfff);
+
+ /* No such entry */
+ if (tid < 0)
+@@ -2026,8 +2025,10 @@ void mvpp2_prs_vid_remove_all(struct mvpp2_port *port)
+
+ for (tid = MVPP2_PRS_VID_PORT_FIRST(port->id);
+ tid <= MVPP2_PRS_VID_PORT_LAST(port->id); tid++) {
+- if (priv->prs_shadow[tid].valid)
+- mvpp2_prs_vid_entry_remove(port, tid);
++ if (priv->prs_shadow[tid].valid) {
++ mvpp2_prs_hw_inv(priv, tid);
++ priv->prs_shadow[tid].valid = false;
++ }
+ }
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+index 37ba7c78859d..1c225be9c7db 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+@@ -342,11 +342,32 @@ void mlx5_unregister_interface(struct mlx5_interface *intf)
+ }
+ EXPORT_SYMBOL(mlx5_unregister_interface);
+
++/* Must be called with intf_mutex held */
++static bool mlx5_has_added_dev_by_protocol(struct mlx5_core_dev *mdev, int protocol)
++{
++ struct mlx5_device_context *dev_ctx;
++ struct mlx5_interface *intf;
++ bool found = false;
++
++ list_for_each_entry(intf, &intf_list, list) {
++ if (intf->protocol == protocol) {
++ dev_ctx = mlx5_get_device(intf, &mdev->priv);
++ if (dev_ctx && test_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state))
++ found = true;
++ break;
++ }
++ }
++
++ return found;
++}
++
+ void mlx5_reload_interface(struct mlx5_core_dev *mdev, int protocol)
+ {
+ mutex_lock(&mlx5_intf_mutex);
+- mlx5_remove_dev_by_protocol(mdev, protocol);
+- mlx5_add_dev_by_protocol(mdev, protocol);
++ if (mlx5_has_added_dev_by_protocol(mdev, protocol)) {
++ mlx5_remove_dev_by_protocol(mdev, protocol);
++ mlx5_add_dev_by_protocol(mdev, protocol);
++ }
+ mutex_unlock(&mlx5_intf_mutex);
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index c5b82e283d13..ff2f6b8e2fab 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -2488,6 +2488,10 @@ mlxsw_sp_port_set_link_ksettings(struct net_device *dev,
+ mlxsw_reg_ptys_eth_unpack(ptys_pl, ð_proto_cap, NULL, NULL);
+
+ autoneg = cmd->base.autoneg == AUTONEG_ENABLE;
++ if (!autoneg && cmd->base.speed == SPEED_56000) {
++ netdev_err(dev, "56G not supported with autoneg off\n");
++ return -EINVAL;
++ }
+ eth_proto_new = autoneg ?
+ mlxsw_sp_to_ptys_advert_link(cmd) :
+ mlxsw_sp_to_ptys_speed(cmd->base.speed);
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index f27a0dc8c563..5e3e6e262ba3 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -1588,6 +1588,10 @@ static void sh_eth_dev_exit(struct net_device *ndev)
+ sh_eth_get_stats(ndev);
+ mdp->cd->soft_reset(ndev);
+
++ /* Set the RMII mode again if required */
++ if (mdp->cd->rmiimode)
++ sh_eth_write(ndev, 0x1, RMIIMODE);
++
+ /* Set MAC address again */
+ update_mac_address(ndev);
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 50c00822b2d8..45e64d71a93f 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3319,6 +3319,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue)
+ entry = STMMAC_GET_ENTRY(entry, DMA_RX_SIZE);
+ }
+ rx_q->dirty_rx = entry;
++ stmmac_set_rx_tail_ptr(priv, priv->ioaddr, rx_q->rx_tail_addr, queue);
+ }
+
+ /**
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 9d699bd5f715..cf6b9b1771f1 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -2405,7 +2405,7 @@ static struct hv_driver netvsc_drv = {
+ .probe = netvsc_probe,
+ .remove = netvsc_remove,
+ .driver = {
+- .probe_type = PROBE_PREFER_ASYNCHRONOUS,
++ .probe_type = PROBE_FORCE_SYNCHRONOUS,
+ },
+ };
+
+diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
+index b3935778b19f..e4bf9e7d7583 100644
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -260,10 +260,8 @@ static int dp83867_config_init(struct phy_device *phydev)
+ ret = phy_write(phydev, MII_DP83867_PHYCTRL, val);
+ if (ret)
+ return ret;
+- }
+
+- if ((phydev->interface >= PHY_INTERFACE_MODE_RGMII_ID) &&
+- (phydev->interface <= PHY_INTERFACE_MODE_RGMII_RXID)) {
++ /* Set up RGMII delays */
+ val = phy_read_mmd(phydev, DP83867_DEVADDR, DP83867_RGMIICTL);
+
+ if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index f6e70f2dfd12..e029c7977a56 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -54,6 +54,10 @@ struct phylink {
+
+ /* The link configuration settings */
+ struct phylink_link_state link_config;
++
++ /* The current settings */
++ phy_interface_t cur_interface;
++
+ struct gpio_desc *link_gpio;
+ struct timer_list link_poll;
+ void (*get_fixed_state)(struct net_device *dev,
+@@ -477,12 +481,12 @@ static void phylink_resolve(struct work_struct *w)
+ if (!link_state.link) {
+ netif_carrier_off(ndev);
+ pl->ops->mac_link_down(ndev, pl->link_an_mode,
+- pl->phy_state.interface);
++ pl->cur_interface);
+ netdev_info(ndev, "Link is Down\n");
+ } else {
++ pl->cur_interface = link_state.interface;
+ pl->ops->mac_link_up(ndev, pl->link_an_mode,
+- pl->phy_state.interface,
+- pl->phydev);
++ pl->cur_interface, pl->phydev);
+
+ netif_carrier_on(ndev);
+
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index f8436d1c4d45..f7218c1673ce 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -625,7 +625,8 @@ static bool acpi_pci_need_resume(struct pci_dev *dev)
+ if (!adev || !acpi_device_power_manageable(adev))
+ return false;
+
+- if (device_may_wakeup(&dev->dev) != !!adev->wakeup.prepare_count)
++ if (adev->wakeup.flags.valid &&
++ device_may_wakeup(&dev->dev) != !!adev->wakeup.prepare_count)
+ return true;
+
+ if (acpi_target_system_state() == ACPI_STATE_S0)
+diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
+index f2c561ca731a..cd2c247d6d0c 100644
+--- a/drivers/scsi/cxgbi/libcxgbi.c
++++ b/drivers/scsi/cxgbi/libcxgbi.c
+@@ -641,6 +641,10 @@ cxgbi_check_route(struct sockaddr *dst_addr, int ifindex)
+
+ if (ndev->flags & IFF_LOOPBACK) {
+ ndev = ip_dev_find(&init_net, daddr->sin_addr.s_addr);
++ if (!ndev) {
++ err = -ENETUNREACH;
++ goto rel_neigh;
++ }
+ mtu = ndev->mtu;
+ pr_info("rt dev %s, loopback -> %s, mtu %u.\n",
+ n->dev->name, ndev->name, mtu);
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index 12dc7100bb4c..d1154baa9436 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -1173,10 +1173,8 @@ static int __init alua_init(void)
+ int r;
+
+ kaluad_wq = alloc_workqueue("kaluad", WQ_MEM_RECLAIM, 0);
+- if (!kaluad_wq) {
+- /* Temporary failure, bypass */
+- return SCSI_DH_DEV_TEMP_BUSY;
+- }
++ if (!kaluad_wq)
++ return -ENOMEM;
+
+ r = scsi_register_device_handler(&alua_dh);
+ if (r != 0) {
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 231eb79efa32..b141d1061f38 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -989,6 +989,8 @@ static struct domain_device *sas_ex_discover_expander(
+ list_del(&child->dev_list_node);
+ spin_unlock_irq(&parent->port->dev_list_lock);
+ sas_put_device(child);
++ sas_port_delete(phy->port);
++ phy->port = NULL;
+ return NULL;
+ }
+ list_add_tail(&child->siblings, &parent->ex_dev.children);
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index 3781e8109dd7..411d656f2530 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -6378,7 +6378,7 @@ static int pqi_pci_init(struct pqi_ctrl_info *ctrl_info)
+ else
+ mask = DMA_BIT_MASK(32);
+
+- rc = dma_set_mask(&ctrl_info->pci_dev->dev, mask);
++ rc = dma_set_mask_and_coherent(&ctrl_info->pci_dev->dev, mask);
+ if (rc) {
+ dev_err(&ctrl_info->pci_dev->dev, "failed to set DMA mask\n");
+ goto disable_device;
+diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c
+index cff7b1e07153..b688ebc01740 100644
+--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c
+@@ -576,7 +576,7 @@ exit:
+ dev->colourfx.enable ? "true" : "false",
+ dev->colourfx.u, dev->colourfx.v,
+ ret, (ret == 0 ? 0 : -EINVAL));
+- return (ret == 0 ? 0 : EINVAL);
++ return (ret == 0 ? 0 : -EINVAL);
+ }
+
+ static int ctrl_set_colfx(struct bm2835_mmal_dev *dev,
+@@ -600,7 +600,7 @@ static int ctrl_set_colfx(struct bm2835_mmal_dev *dev,
+ "%s: After: mmal_ctrl:%p ctrl id:0x%x ctrl val:%d ret %d(%d)\n",
+ __func__, mmal_ctrl, ctrl->id, ctrl->val, ret,
+ (ret == 0 ? 0 : -EINVAL));
+- return (ret == 0 ? 0 : EINVAL);
++ return (ret == 0 ? 0 : -EINVAL);
+ }
+
+ static int ctrl_set_bitrate(struct bm2835_mmal_dev *dev,
+diff --git a/drivers/tty/serial/sunhv.c b/drivers/tty/serial/sunhv.c
+index 63e34d868de8..f8503f8fc44e 100644
+--- a/drivers/tty/serial/sunhv.c
++++ b/drivers/tty/serial/sunhv.c
+@@ -397,7 +397,7 @@ static const struct uart_ops sunhv_pops = {
+ static struct uart_driver sunhv_reg = {
+ .owner = THIS_MODULE,
+ .driver_name = "sunhv",
+- .dev_name = "ttyS",
++ .dev_name = "ttyHV",
+ .major = TTY_MAJOR,
+ };
+
+diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
+index cadc01336bf8..7ba6afc7ef23 100644
+--- a/drivers/usb/host/xhci-debugfs.c
++++ b/drivers/usb/host/xhci-debugfs.c
+@@ -440,6 +440,9 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
+ struct xhci_ep_priv *epriv;
+ struct xhci_slot_priv *spriv = dev->debugfs_private;
+
++ if (!spriv)
++ return;
++
+ if (spriv->eps[ep_index])
+ return;
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 91da7e44d5d4..3a144eecb6a7 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -538,7 +538,6 @@ out:
+ int pvcalls_front_sendmsg(struct socket *sock, struct msghdr *msg,
+ size_t len)
+ {
+- struct pvcalls_bedata *bedata;
+ struct sock_mapping *map;
+ int sent, tot_sent = 0;
+ int count = 0, flags;
+@@ -550,7 +549,6 @@ int pvcalls_front_sendmsg(struct socket *sock, struct msghdr *msg,
+ map = pvcalls_enter_sock(sock);
+ if (IS_ERR(map))
+ return PTR_ERR(map);
+- bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
+
+ mutex_lock(&map->active.out_mutex);
+ if ((flags & MSG_DONTWAIT) && !pvcalls_front_write_todo(map)) {
+@@ -633,7 +631,6 @@ out:
+ int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ int flags)
+ {
+- struct pvcalls_bedata *bedata;
+ int ret;
+ struct sock_mapping *map;
+
+@@ -643,7 +640,6 @@ int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ map = pvcalls_enter_sock(sock);
+ if (IS_ERR(map))
+ return PTR_ERR(map);
+- bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
+
+ mutex_lock(&map->active.in_mutex);
+ if (len > XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER))
+diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h
+index 092981171df1..d75a2385b37c 100644
+--- a/drivers/xen/xenbus/xenbus.h
++++ b/drivers/xen/xenbus/xenbus.h
+@@ -83,6 +83,7 @@ struct xb_req_data {
+ int num_vecs;
+ int err;
+ enum xb_req_state state;
++ bool user_req;
+ void (*cb)(struct xb_req_data *);
+ void *par;
+ };
+@@ -133,4 +134,6 @@ void xenbus_ring_ops_init(void);
+ int xenbus_dev_request_and_reply(struct xsd_sockmsg *msg, void *par);
+ void xenbus_dev_queue_reply(struct xb_req_data *req);
+
++extern unsigned int xb_dev_generation_id;
++
+ #endif
+diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
+index 0782ff3c2273..39c63152a358 100644
+--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
+@@ -62,6 +62,8 @@
+
+ #include "xenbus.h"
+
++unsigned int xb_dev_generation_id;
++
+ /*
+ * An element of a list of outstanding transactions, for which we're
+ * still waiting a reply.
+@@ -69,6 +71,7 @@
+ struct xenbus_transaction_holder {
+ struct list_head list;
+ struct xenbus_transaction handle;
++ unsigned int generation_id;
+ };
+
+ /*
+@@ -441,6 +444,7 @@ static int xenbus_write_transaction(unsigned msg_type,
+ rc = -ENOMEM;
+ goto out;
+ }
++ trans->generation_id = xb_dev_generation_id;
+ list_add(&trans->list, &u->transactions);
+ } else if (msg->hdr.tx_id != 0 &&
+ !xenbus_get_transaction(u, msg->hdr.tx_id))
+@@ -449,6 +453,20 @@ static int xenbus_write_transaction(unsigned msg_type,
+ !(msg->hdr.len == 2 &&
+ (!strcmp(msg->body, "T") || !strcmp(msg->body, "F"))))
+ return xenbus_command_reply(u, XS_ERROR, "EINVAL");
++ else if (msg_type == XS_TRANSACTION_END) {
++ trans = xenbus_get_transaction(u, msg->hdr.tx_id);
++ if (trans && trans->generation_id != xb_dev_generation_id) {
++ list_del(&trans->list);
++ kfree(trans);
++ if (!strcmp(msg->body, "T"))
++ return xenbus_command_reply(u, XS_ERROR,
++ "EAGAIN");
++ else
++ return xenbus_command_reply(u,
++ XS_TRANSACTION_END,
++ "OK");
++ }
++ }
+
+ rc = xenbus_dev_request_and_reply(&msg->hdr, u);
+ if (rc && trans) {
+diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
+index 49a3874ae6bb..ddc18da61834 100644
+--- a/drivers/xen/xenbus/xenbus_xs.c
++++ b/drivers/xen/xenbus/xenbus_xs.c
+@@ -105,6 +105,7 @@ static void xs_suspend_enter(void)
+
+ static void xs_suspend_exit(void)
+ {
++ xb_dev_generation_id++;
+ spin_lock(&xs_state_lock);
+ xs_suspend_active--;
+ spin_unlock(&xs_state_lock);
+@@ -125,7 +126,7 @@ static uint32_t xs_request_enter(struct xb_req_data *req)
+ spin_lock(&xs_state_lock);
+ }
+
+- if (req->type == XS_TRANSACTION_START)
++ if (req->type == XS_TRANSACTION_START && !req->user_req)
+ xs_state_users++;
+ xs_state_users++;
+ rq_id = xs_request_id++;
+@@ -140,7 +141,7 @@ void xs_request_exit(struct xb_req_data *req)
+ spin_lock(&xs_state_lock);
+ xs_state_users--;
+ if ((req->type == XS_TRANSACTION_START && req->msg.type == XS_ERROR) ||
+- (req->type == XS_TRANSACTION_END &&
++ (req->type == XS_TRANSACTION_END && !req->user_req &&
+ !WARN_ON_ONCE(req->msg.type == XS_ERROR &&
+ !strcmp(req->body, "ENOENT"))))
+ xs_state_users--;
+@@ -286,6 +287,7 @@ int xenbus_dev_request_and_reply(struct xsd_sockmsg *msg, void *par)
+ req->num_vecs = 1;
+ req->cb = xenbus_dev_queue_reply;
+ req->par = par;
++ req->user_req = true;
+
+ xs_send(req, msg);
+
+@@ -313,6 +315,7 @@ static void *xs_talkv(struct xenbus_transaction t,
+ req->vec = iovec;
+ req->num_vecs = num_vecs;
+ req->cb = xs_wake_up;
++ req->user_req = false;
+
+ msg.req_id = 0;
+ msg.tx_id = t.id;
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index 920d350df37b..809c1edffbaf 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -58,15 +58,13 @@ static void configfs_d_iput(struct dentry * dentry,
+ if (sd) {
+ /* Coordinate with configfs_readdir */
+ spin_lock(&configfs_dirent_lock);
+- /* Coordinate with configfs_attach_attr where will increase
+- * sd->s_count and update sd->s_dentry to new allocated one.
+- * Only set sd->dentry to null when this dentry is the only
+- * sd owner.
+- * If not do so, configfs_d_iput may run just after
+- * configfs_attach_attr and set sd->s_dentry to null
+- * even it's still in use.
++ /*
++ * Set sd->s_dentry to null only when this dentry is the one
++ * that is going to be killed. Otherwise configfs_d_iput may
++ * run just after configfs_attach_attr and set sd->s_dentry to
++ * NULL even it's still in use.
+ */
+- if (atomic_read(&sd->s_count) <= 2)
++ if (sd->s_dentry == dentry)
+ sd->s_dentry = NULL;
+
+ spin_unlock(&configfs_dirent_lock);
+diff --git a/fs/inode.c b/fs/inode.c
+index 42f6d25f32a5..5c63693326bb 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -1817,8 +1817,13 @@ int file_remove_privs(struct file *file)
+ int kill;
+ int error = 0;
+
+- /* Fast path for nothing security related */
+- if (IS_NOSEC(inode))
++ /*
++ * Fast path for nothing security related.
++ * As well for non-regular files, e.g. blkdev inodes.
++ * For example, blkdev_write_iter() might get here
++ * trying to remove privs which it is not allowed to.
++ */
++ if (IS_NOSEC(inode) || !S_ISREG(inode->i_mode))
+ return 0;
+
+ kill = dentry_needs_remove_privs(dentry);
+diff --git a/fs/ocfs2/filecheck.c b/fs/ocfs2/filecheck.c
+index f65f2b2f594d..1906cc962c4d 100644
+--- a/fs/ocfs2/filecheck.c
++++ b/fs/ocfs2/filecheck.c
+@@ -193,6 +193,7 @@ int ocfs2_filecheck_create_sysfs(struct ocfs2_super *osb)
+ ret = kobject_init_and_add(&entry->fs_kobj, &ocfs2_ktype_filecheck,
+ NULL, "filecheck");
+ if (ret) {
++ kobject_put(&entry->fs_kobj);
+ kfree(fcheck);
+ return ret;
+ }
+diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
+index cebb79fe2c72..0d10b7ce0da7 100644
+--- a/include/linux/sched/mm.h
++++ b/include/linux/sched/mm.h
+@@ -54,6 +54,10 @@ static inline void mmdrop(struct mm_struct *mm)
+ * followed by taking the mmap_sem for writing before modifying the
+ * vmas or anything the coredump pretends not to change from under it.
+ *
++ * It also has to be called when mmgrab() is used in the context of
++ * the process, but then the mm_count refcount is transferred outside
++ * the context of the process to run down_write() on that pinned mm.
++ *
+ * NOTE: find_extend_vma() called from GUP context is the only place
+ * that can modify the "mm" (notably the vm_start/end) under mmap_sem
+ * for reading and outside the context of the process, so it is also
+diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
+index 99c7f199f2d4..12f351b253bb 100644
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -49,14 +49,30 @@ static void perf_output_put_handle(struct perf_output_handle *handle)
+ unsigned long head;
+
+ again:
++ /*
++ * In order to avoid publishing a head value that goes backwards,
++ * we must ensure the load of @rb->head happens after we've
++ * incremented @rb->nest.
++ *
++ * Otherwise we can observe a @rb->head value before one published
++ * by an IRQ/NMI happening between the load and the increment.
++ */
++ barrier();
+ head = local_read(&rb->head);
+
+ /*
+- * IRQ/NMI can happen here, which means we can miss a head update.
++ * IRQ/NMI can happen here and advance @rb->head, causing our
++ * load above to be stale.
+ */
+
+- if (!local_dec_and_test(&rb->nest))
++ /*
++ * If this isn't the outermost nesting, we don't have to update
++ * @rb->user_page->data_head.
++ */
++ if (local_read(&rb->nest) > 1) {
++ local_dec(&rb->nest);
+ goto out;
++ }
+
+ /*
+ * Since the mmap() consumer (userspace) can run on a different CPU:
+@@ -85,12 +101,21 @@ again:
+ * See perf_output_begin().
+ */
+ smp_wmb(); /* B, matches C */
+- rb->user_page->data_head = head;
++ WRITE_ONCE(rb->user_page->data_head, head);
++
++ /*
++ * We must publish the head before decrementing the nest count,
++ * otherwise an IRQ/NMI can publish a more recent head value and our
++ * write will (temporarily) publish a stale value.
++ */
++ barrier();
++ local_set(&rb->nest, 0);
+
+ /*
+- * Now check if we missed an update -- rely on previous implied
+- * compiler barriers to force a re-read.
++ * Ensure we decrement @rb->nest before we validate the @rb->head.
++ * Otherwise we cannot be sure we caught the 'last' nested update.
+ */
++ barrier();
+ if (unlikely(head != local_read(&rb->head))) {
+ local_inc(&rb->nest);
+ goto again;
+@@ -465,7 +490,7 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size)
+ handle->aux_flags);
+ }
+
+- rb->user_page->aux_head = rb->aux_head;
++ WRITE_ONCE(rb->user_page->aux_head, rb->aux_head);
+ if (rb_need_aux_wakeup(rb))
+ wakeup = true;
+
+@@ -497,7 +522,7 @@ int perf_aux_output_skip(struct perf_output_handle *handle, unsigned long size)
+
+ rb->aux_head += size;
+
+- rb->user_page->aux_head = rb->aux_head;
++ WRITE_ONCE(rb->user_page->aux_head, rb->aux_head);
+ if (rb_need_aux_wakeup(rb)) {
+ perf_output_wakeup(handle);
+ handle->wakeup = rb->aux_wakeup + rb->aux_watermark;
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index fde5820be24d..ecefdba4b0dd 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1005,6 +1005,9 @@ static void collapse_huge_page(struct mm_struct *mm,
+ * handled by the anon_vma lock + PG_lock.
+ */
+ down_write(&mm->mmap_sem);
++ result = SCAN_ANY_PROCESS;
++ if (!mmget_still_valid(mm))
++ goto out;
+ result = hugepage_vma_revalidate(mm, address, &vma);
+ if (result)
+ goto out;
+diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
+index 66f74c85cf6b..66d54fc11831 100644
+--- a/net/ax25/ax25_route.c
++++ b/net/ax25/ax25_route.c
+@@ -429,9 +429,11 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
+ }
+
+ if (ax25->sk != NULL) {
++ local_bh_disable();
+ bh_lock_sock(ax25->sk);
+ sock_reset_flag(ax25->sk, SOCK_ZAPPED);
+ bh_unlock_sock(ax25->sk);
++ local_bh_enable();
+ }
+
+ put:
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 4e4ac77c6816..cd9e991f21d7 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -2751,6 +2751,7 @@ static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
+ }
+
+ void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
++ __acquires(tbl->lock)
+ __acquires(rcu_bh)
+ {
+ struct neigh_seq_state *state = seq->private;
+@@ -2761,6 +2762,7 @@ void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl
+
+ rcu_read_lock_bh();
+ state->nht = rcu_dereference_bh(tbl->nht);
++ read_lock(&tbl->lock);
+
+ return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
+ }
+@@ -2794,8 +2796,13 @@ out:
+ EXPORT_SYMBOL(neigh_seq_next);
+
+ void neigh_seq_stop(struct seq_file *seq, void *v)
++ __releases(tbl->lock)
+ __releases(rcu_bh)
+ {
++ struct neigh_seq_state *state = seq->private;
++ struct neigh_table *tbl = state->tbl;
++
++ read_unlock(&tbl->lock);
+ rcu_read_unlock_bh();
+ }
+ EXPORT_SYMBOL(neigh_seq_stop);
+diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
+index be5f3d7ceb96..f994f50e1516 100644
+--- a/net/ipv6/ip6_flowlabel.c
++++ b/net/ipv6/ip6_flowlabel.c
+@@ -254,9 +254,9 @@ struct ip6_flowlabel *fl6_sock_lookup(struct sock *sk, __be32 label)
+ rcu_read_lock_bh();
+ for_each_sk_fl_rcu(np, sfl) {
+ struct ip6_flowlabel *fl = sfl->fl;
+- if (fl->label == label) {
++
++ if (fl->label == label && atomic_inc_not_zero(&fl->users)) {
+ fl->lastuse = jiffies;
+- atomic_inc(&fl->users);
+ rcu_read_unlock_bh();
+ return fl;
+ }
+@@ -622,7 +622,8 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
+ goto done;
+ }
+ fl1 = sfl->fl;
+- atomic_inc(&fl1->users);
++ if (!atomic_inc_not_zero(&fl1->users))
++ fl1 = NULL;
+ break;
+ }
+ }
+diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
+index db6e0afe3a20..1740f852002e 100644
+--- a/net/lapb/lapb_iface.c
++++ b/net/lapb/lapb_iface.c
+@@ -182,6 +182,7 @@ int lapb_unregister(struct net_device *dev)
+ lapb = __lapb_devtostruct(dev);
+ if (!lapb)
+ goto out;
++ lapb_put(lapb);
+
+ lapb_stop_t1timer(lapb);
+ lapb_stop_t2timer(lapb);
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index a42c1bc7c698..62c0e80dcd71 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -2280,7 +2280,6 @@ static void __net_exit __ip_vs_cleanup(struct net *net)
+ {
+ struct netns_ipvs *ipvs = net_ipvs(net);
+
+- nf_unregister_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+ ip_vs_service_net_cleanup(ipvs); /* ip_vs_flush() with locks */
+ ip_vs_conn_net_cleanup(ipvs);
+ ip_vs_app_net_cleanup(ipvs);
+@@ -2295,6 +2294,7 @@ static void __net_exit __ip_vs_dev_cleanup(struct net *net)
+ {
+ struct netns_ipvs *ipvs = net_ipvs(net);
+ EnterFunction(2);
++ nf_unregister_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+ ipvs->enable = 0; /* Disable packet reception */
+ smp_wmb();
+ ip_vs_sync_net_cleanup(ipvs);
+diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
+index d67a96a25a68..7569ba00e732 100644
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -238,6 +238,7 @@ static unsigned int nf_iterate(struct sk_buff *skb,
+ repeat:
+ verdict = nf_hook_entry_hookfn(hook, skb, state);
+ if (verdict != NF_ACCEPT) {
++ *index = i;
+ if (verdict != NF_REPEAT)
+ return verdict;
+ goto repeat;
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index 376181cc1def..9f2875efb4ac 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -922,7 +922,8 @@ static int nfc_genl_deactivate_target(struct sk_buff *skb,
+ u32 device_idx, target_idx;
+ int rc;
+
+- if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
++ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
++ !info->attrs[NFC_ATTR_TARGET_INDEX])
+ return -EINVAL;
+
+ device_idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
+diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
+index bb95c43aae76..5a304cfc8423 100644
+--- a/net/openvswitch/vport-internal_dev.c
++++ b/net/openvswitch/vport-internal_dev.c
+@@ -169,7 +169,9 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
+ {
+ struct vport *vport;
+ struct internal_dev *internal_dev;
++ struct net_device *dev;
+ int err;
++ bool free_vport = true;
+
+ vport = ovs_vport_alloc(0, &ovs_internal_vport_ops, parms);
+ if (IS_ERR(vport)) {
+@@ -177,8 +179,9 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
+ goto error;
+ }
+
+- vport->dev = alloc_netdev(sizeof(struct internal_dev),
+- parms->name, NET_NAME_USER, do_setup);
++ dev = alloc_netdev(sizeof(struct internal_dev),
++ parms->name, NET_NAME_USER, do_setup);
++ vport->dev = dev;
+ if (!vport->dev) {
+ err = -ENOMEM;
+ goto error_free_vport;
+@@ -199,8 +202,10 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
+
+ rtnl_lock();
+ err = register_netdevice(vport->dev);
+- if (err)
++ if (err) {
++ free_vport = false;
+ goto error_unlock;
++ }
+
+ dev_set_promiscuity(vport->dev, 1);
+ rtnl_unlock();
+@@ -210,11 +215,12 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
+
+ error_unlock:
+ rtnl_unlock();
+- free_percpu(vport->dev->tstats);
++ free_percpu(dev->tstats);
+ error_free_netdev:
+- free_netdev(vport->dev);
++ free_netdev(dev);
+ error_free_vport:
+- ovs_vport_free(vport);
++ if (free_vport)
++ ovs_vport_free(vport);
+ error:
+ return ERR_PTR(err);
+ }
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index ae65a1cfa596..fb546b2d67ca 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -2600,6 +2600,8 @@ do_addr_param:
+ case SCTP_PARAM_STATE_COOKIE:
+ asoc->peer.cookie_len =
+ ntohs(param.p->length) - sizeof(struct sctp_paramhdr);
++ if (asoc->peer.cookie)
++ kfree(asoc->peer.cookie);
+ asoc->peer.cookie = kmemdup(param.cookie->body, asoc->peer.cookie_len, gfp);
+ if (!asoc->peer.cookie)
+ retval = 0;
+@@ -2664,6 +2666,8 @@ do_addr_param:
+ goto fall_through;
+
+ /* Save peer's random parameter */
++ if (asoc->peer.peer_random)
++ kfree(asoc->peer.peer_random);
+ asoc->peer.peer_random = kmemdup(param.p,
+ ntohs(param.p->length), gfp);
+ if (!asoc->peer.peer_random) {
+@@ -2677,6 +2681,8 @@ do_addr_param:
+ goto fall_through;
+
+ /* Save peer's HMAC list */
++ if (asoc->peer.peer_hmacs)
++ kfree(asoc->peer.peer_hmacs);
+ asoc->peer.peer_hmacs = kmemdup(param.p,
+ ntohs(param.p->length), gfp);
+ if (!asoc->peer.peer_hmacs) {
+@@ -2692,6 +2698,8 @@ do_addr_param:
+ if (!ep->auth_enable)
+ goto fall_through;
+
++ if (asoc->peer.peer_chunks)
++ kfree(asoc->peer.peer_chunks);
+ asoc->peer.peer_chunks = kmemdup(param.p,
+ ntohs(param.p->length), gfp);
+ if (!asoc->peer.peer_chunks)
+diff --git a/net/tipc/group.c b/net/tipc/group.c
+index 06fee142f09f..3ee93b5c19b6 100644
+--- a/net/tipc/group.c
++++ b/net/tipc/group.c
+@@ -218,6 +218,7 @@ void tipc_group_delete(struct net *net, struct tipc_group *grp)
+
+ rbtree_postorder_for_each_entry_safe(m, tmp, tree, tree_node) {
+ tipc_group_proto_xmit(grp, m, GRP_LEAVE_MSG, &xmitq);
++ __skb_queue_purge(&m->deferredq);
+ list_del(&m->list);
+ kfree(m);
+ }
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index f3f3d06cb6d8..e30f53728725 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -871,8 +871,10 @@ virtio_transport_recv_connected(struct sock *sk,
+ if (le32_to_cpu(pkt->hdr.flags) & VIRTIO_VSOCK_SHUTDOWN_SEND)
+ vsk->peer_shutdown |= SEND_SHUTDOWN;
+ if (vsk->peer_shutdown == SHUTDOWN_MASK &&
+- vsock_stream_has_data(vsk) <= 0)
++ vsock_stream_has_data(vsk) <= 0) {
++ sock_set_flag(sk, SOCK_DONE);
+ sk->sk_state = TCP_CLOSING;
++ }
+ if (le32_to_cpu(pkt->hdr.flags))
+ sk->sk_state_change(sk);
+ break;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 45bf89ed31de..308ce76149cc 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -378,6 +378,7 @@ enum {
+
+ #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
+ #define IS_CFL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa348)
++#define IS_CNL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9dc8)
+
+ static char *driver_short_names[] = {
+ [AZX_DRIVER_ICH] = "HDA Intel",
+@@ -1795,8 +1796,8 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
+ else
+ chip->bdl_pos_adj = bdl_pos_adj[dev];
+
+- /* Workaround for a communication error on CFL (bko#199007) */
+- if (IS_CFL(pci))
++ /* Workaround for a communication error on CFL (bko#199007) and CNL */
++ if (IS_CFL(pci) || IS_CNL(pci))
+ chip->polling_mode = 1;
+
+ err = azx_bus_init(chip, model[dev], &pci_hda_io_ops);
+diff --git a/tools/perf/arch/s390/util/machine.c b/tools/perf/arch/s390/util/machine.c
+index 0b2054007314..a19690a17291 100644
+--- a/tools/perf/arch/s390/util/machine.c
++++ b/tools/perf/arch/s390/util/machine.c
+@@ -5,16 +5,19 @@
+ #include "util.h"
+ #include "machine.h"
+ #include "api/fs/fs.h"
++#include "debug.h"
+
+ int arch__fix_module_text_start(u64 *start, const char *name)
+ {
++ u64 m_start = *start;
+ char path[PATH_MAX];
+
+ snprintf(path, PATH_MAX, "module/%.*s/sections/.text",
+ (int)strlen(name) - 2, name + 1);
+-
+- if (sysfs__read_ull(path, (unsigned long long *)start) < 0)
+- return -1;
++ if (sysfs__read_ull(path, (unsigned long long *)start) < 0) {
++ pr_debug2("Using module %s start:%#lx\n", path, m_start);
++ *start = m_start;
++ }
+
+ return 0;
+ }
+diff --git a/tools/perf/util/data-convert-bt.c b/tools/perf/util/data-convert-bt.c
+index abd38abf1d91..24f2a87cf91d 100644
+--- a/tools/perf/util/data-convert-bt.c
++++ b/tools/perf/util/data-convert-bt.c
+@@ -271,7 +271,7 @@ static int string_set_value(struct bt_ctf_field *field, const char *string)
+ if (i > 0)
+ strncpy(buffer, string, i);
+ }
+- strncat(buffer + p, numstr, 4);
++ memcpy(buffer + p, numstr, 4);
+ p += 3;
+ }
+ }
+diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
+index 2048d393ece6..56007a7e0b4d 100644
+--- a/tools/perf/util/thread.c
++++ b/tools/perf/util/thread.c
+@@ -128,7 +128,7 @@ void thread__put(struct thread *thread)
+ }
+ }
+
+-struct namespaces *thread__namespaces(const struct thread *thread)
++static struct namespaces *__thread__namespaces(const struct thread *thread)
+ {
+ if (list_empty(&thread->namespaces_list))
+ return NULL;
+@@ -136,10 +136,21 @@ struct namespaces *thread__namespaces(const struct thread *thread)
+ return list_first_entry(&thread->namespaces_list, struct namespaces, list);
+ }
+
++struct namespaces *thread__namespaces(const struct thread *thread)
++{
++ struct namespaces *ns;
++
++ down_read((struct rw_semaphore *)&thread->namespaces_lock);
++ ns = __thread__namespaces(thread);
++ up_read((struct rw_semaphore *)&thread->namespaces_lock);
++
++ return ns;
++}
++
+ static int __thread__set_namespaces(struct thread *thread, u64 timestamp,
+ struct namespaces_event *event)
+ {
+- struct namespaces *new, *curr = thread__namespaces(thread);
++ struct namespaces *new, *curr = __thread__namespaces(thread);
+
+ new = namespaces__new(event);
+ if (!new)
+diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
+index 8ec76681605c..f25f72a75cf3 100755
+--- a/tools/testing/selftests/netfilter/nft_nat.sh
++++ b/tools/testing/selftests/netfilter/nft_nat.sh
+@@ -23,7 +23,11 @@ ip netns add ns0
+ ip netns add ns1
+ ip netns add ns2
+
+-ip link add veth0 netns ns0 type veth peer name eth0 netns ns1
++ip link add veth0 netns ns0 type veth peer name eth0 netns ns1 > /dev/null 2>&1
++if [ $? -ne 0 ];then
++ echo "SKIP: No virtual ethernet pair device support in kernel"
++ exit $ksft_skip
++fi
+ ip link add veth1 netns ns0 type veth peer name eth0 netns ns2
+
+ ip -net ns0 link set lo up
diff --git a/1054_linux-4.19.55.patch b/1054_linux-4.19.55.patch
new file mode 100644
index 0000000..ee0b997
--- /dev/null
+++ b/1054_linux-4.19.55.patch
@@ -0,0 +1,27 @@
+diff --git a/Makefile b/Makefile
+index b234837e4d07..3addd4c286fa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 54
++SUBLEVEL = 55
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 147ed82b73d3..221d9b72423b 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1299,7 +1299,8 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
+ if (nsize < 0)
+ nsize = 0;
+
+- if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf)) {
++ if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf &&
++ tcp_queue != TCP_FRAG_IN_WRITE_QUEUE)) {
+ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG);
+ return -ENOMEM;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-06-25 10:53 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-06-25 10:53 UTC (permalink / raw
To: gentoo-commits
commit: f23442a5eb74f5ba43653768abc231a8070ddaee
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 25 10:52:58 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jun 25 10:52:58 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f23442a5
Linux patch 4.19.56
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1055_linux-4.19.56.patch | 3375 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3379 insertions(+)
diff --git a/0000_README b/0000_README
index 545a5dd..9ed63b1 100644
--- a/0000_README
+++ b/0000_README
@@ -263,6 +263,10 @@ Patch: 1054_linux-4.19.55.patch
From: https://www.kernel.org
Desc: Linux 4.19.55
+Patch: 1055_linux-4.19.56.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.56
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1055_linux-4.19.56.patch b/1055_linux-4.19.56.patch
new file mode 100644
index 0000000..fbc387c
--- /dev/null
+++ b/1055_linux-4.19.56.patch
@@ -0,0 +1,3375 @@
+diff --git a/Makefile b/Makefile
+index 3addd4c286fa..a76c61f77bcd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 55
++SUBLEVEL = 56
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -652,6 +652,7 @@ KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,)
+ KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation)
+ KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow)
+ KBUILD_CFLAGS += $(call cc-disable-warning, int-in-bool-context)
++KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member)
+
+ ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+ KBUILD_CFLAGS += -Os $(call cc-disable-warning,maybe-uninitialized,)
+@@ -696,7 +697,6 @@ ifeq ($(cc-name),clang)
+ KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,)
+ KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier)
+ KBUILD_CFLAGS += $(call cc-disable-warning, gnu)
+-KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member)
+ # Quiet clang warning: comparison of unsigned expression < 0 is always false
+ KBUILD_CFLAGS += $(call cc-disable-warning, tautological-compare)
+ # CLANG uses a _MergedGlobals as optimization, but this breaks modpost, as the
+diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
+index ef149f59929a..d131c54acd3e 100644
+--- a/arch/arc/boot/dts/hsdk.dts
++++ b/arch/arc/boot/dts/hsdk.dts
+@@ -175,6 +175,7 @@
+ interrupt-names = "macirq";
+ phy-mode = "rgmii";
+ snps,pbl = <32>;
++ snps,multicast-filter-bins = <256>;
+ clocks = <&gmacclk>;
+ clock-names = "stmmaceth";
+ phy-handle = <&phy0>;
+@@ -183,6 +184,9 @@
+ mac-address = [00 00 00 00 00 00]; /* Filled in by U-Boot */
+ dma-coherent;
+
++ tx-fifo-depth = <4096>;
++ rx-fifo-depth = <4096>;
++
+ mdio {
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
+index d819de1c5d10..3ea4112c8302 100644
+--- a/arch/arc/include/asm/cmpxchg.h
++++ b/arch/arc/include/asm/cmpxchg.h
+@@ -92,8 +92,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
+
+ #endif /* CONFIG_ARC_HAS_LLSC */
+
+-#define cmpxchg(ptr, o, n) ((typeof(*(ptr)))__cmpxchg((ptr), \
+- (unsigned long)(o), (unsigned long)(n)))
++#define cmpxchg(ptr, o, n) ({ \
++ (typeof(*(ptr)))__cmpxchg((ptr), \
++ (unsigned long)(o), \
++ (unsigned long)(n)); \
++})
+
+ /*
+ * atomic_cmpxchg is same as cmpxchg
+@@ -198,8 +201,11 @@ static inline unsigned long __xchg(unsigned long val, volatile void *ptr,
+ return __xchg_bad_pointer();
+ }
+
+-#define xchg(ptr, with) ((typeof(*(ptr)))__xchg((unsigned long)(with), (ptr), \
+- sizeof(*(ptr))))
++#define xchg(ptr, with) ({ \
++ (typeof(*(ptr)))__xchg((unsigned long)(with), \
++ (ptr), \
++ sizeof(*(ptr))); \
++})
+
+ #endif /* CONFIG_ARC_PLAT_EZNPS */
+
+diff --git a/arch/arc/mm/tlb.c b/arch/arc/mm/tlb.c
+index 4097764fea23..fa18c00b0cfd 100644
+--- a/arch/arc/mm/tlb.c
++++ b/arch/arc/mm/tlb.c
+@@ -911,9 +911,11 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address,
+ struct pt_regs *regs)
+ {
+ struct cpuinfo_arc_mmu *mmu = &cpuinfo_arc700[smp_processor_id()].mmu;
+- unsigned int pd0[mmu->ways];
+ unsigned long flags;
+- int set;
++ int set, n_ways = mmu->ways;
++
++ n_ways = min(n_ways, 4);
++ BUG_ON(mmu->ways > 4);
+
+ local_irq_save(flags);
+
+@@ -921,9 +923,10 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address,
+ for (set = 0; set < mmu->sets; set++) {
+
+ int is_valid, way;
++ unsigned int pd0[4];
+
+ /* read out all the ways of current set */
+- for (way = 0, is_valid = 0; way < mmu->ways; way++) {
++ for (way = 0, is_valid = 0; way < n_ways; way++) {
+ write_aux_reg(ARC_REG_TLBINDEX,
+ SET_WAY_TO_IDX(mmu, set, way));
+ write_aux_reg(ARC_REG_TLBCOMMAND, TLBRead);
+@@ -937,14 +940,14 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address,
+ continue;
+
+ /* Scan the set for duplicate ways: needs a nested loop */
+- for (way = 0; way < mmu->ways - 1; way++) {
++ for (way = 0; way < n_ways - 1; way++) {
+
+ int n;
+
+ if (!pd0[way])
+ continue;
+
+- for (n = way + 1; n < mmu->ways; n++) {
++ for (n = way + 1; n < n_ways; n++) {
+ if (pd0[way] != pd0[n])
+ continue;
+
+diff --git a/arch/arm/boot/dts/am57xx-idk-common.dtsi b/arch/arm/boot/dts/am57xx-idk-common.dtsi
+index c9063ffca524..3fd9a1676d88 100644
+--- a/arch/arm/boot/dts/am57xx-idk-common.dtsi
++++ b/arch/arm/boot/dts/am57xx-idk-common.dtsi
+@@ -410,6 +410,7 @@
+ vqmmc-supply = <&ldo1_reg>;
+ bus-width = <4>;
+ cd-gpios = <&gpio6 27 GPIO_ACTIVE_LOW>; /* gpio 219 */
++ no-1-8-v;
+ };
+
+ &mmc2 {
+diff --git a/arch/arm/boot/dts/dra76x-mmc-iodelay.dtsi b/arch/arm/boot/dts/dra76x-mmc-iodelay.dtsi
+index baba7b00eca7..fdca48186916 100644
+--- a/arch/arm/boot/dts/dra76x-mmc-iodelay.dtsi
++++ b/arch/arm/boot/dts/dra76x-mmc-iodelay.dtsi
+@@ -22,7 +22,7 @@
+ *
+ * Datamanual Revisions:
+ *
+- * DRA76x Silicon Revision 1.0: SPRS993A, Revised July 2017
++ * DRA76x Silicon Revision 1.0: SPRS993E, Revised December 2018
+ *
+ */
+
+@@ -169,25 +169,25 @@
+ /* Corresponds to MMC2_HS200_MANUAL1 in datamanual */
+ mmc2_iodelay_hs200_conf: mmc2_iodelay_hs200_conf {
+ pinctrl-pin-array = <
+- 0x190 A_DELAY_PS(384) G_DELAY_PS(0) /* CFG_GPMC_A19_OEN */
+- 0x194 A_DELAY_PS(0) G_DELAY_PS(174) /* CFG_GPMC_A19_OUT */
+- 0x1a8 A_DELAY_PS(410) G_DELAY_PS(0) /* CFG_GPMC_A20_OEN */
+- 0x1ac A_DELAY_PS(85) G_DELAY_PS(0) /* CFG_GPMC_A20_OUT */
+- 0x1b4 A_DELAY_PS(468) G_DELAY_PS(0) /* CFG_GPMC_A21_OEN */
+- 0x1b8 A_DELAY_PS(139) G_DELAY_PS(0) /* CFG_GPMC_A21_OUT */
+- 0x1c0 A_DELAY_PS(676) G_DELAY_PS(0) /* CFG_GPMC_A22_OEN */
+- 0x1c4 A_DELAY_PS(69) G_DELAY_PS(0) /* CFG_GPMC_A22_OUT */
+- 0x1d0 A_DELAY_PS(1062) G_DELAY_PS(154) /* CFG_GPMC_A23_OUT */
+- 0x1d8 A_DELAY_PS(640) G_DELAY_PS(0) /* CFG_GPMC_A24_OEN */
+- 0x1dc A_DELAY_PS(0) G_DELAY_PS(0) /* CFG_GPMC_A24_OUT */
+- 0x1e4 A_DELAY_PS(356) G_DELAY_PS(0) /* CFG_GPMC_A25_OEN */
+- 0x1e8 A_DELAY_PS(0) G_DELAY_PS(0) /* CFG_GPMC_A25_OUT */
+- 0x1f0 A_DELAY_PS(579) G_DELAY_PS(0) /* CFG_GPMC_A26_OEN */
+- 0x1f4 A_DELAY_PS(0) G_DELAY_PS(0) /* CFG_GPMC_A26_OUT */
+- 0x1fc A_DELAY_PS(435) G_DELAY_PS(0) /* CFG_GPMC_A27_OEN */
+- 0x200 A_DELAY_PS(36) G_DELAY_PS(0) /* CFG_GPMC_A27_OUT */
+- 0x364 A_DELAY_PS(759) G_DELAY_PS(0) /* CFG_GPMC_CS1_OEN */
+- 0x368 A_DELAY_PS(72) G_DELAY_PS(0) /* CFG_GPMC_CS1_OUT */
++ 0x190 A_DELAY_PS(384) G_DELAY_PS(0) /* CFG_GPMC_A19_OEN */
++ 0x194 A_DELAY_PS(350) G_DELAY_PS(174) /* CFG_GPMC_A19_OUT */
++ 0x1a8 A_DELAY_PS(410) G_DELAY_PS(0) /* CFG_GPMC_A20_OEN */
++ 0x1ac A_DELAY_PS(335) G_DELAY_PS(0) /* CFG_GPMC_A20_OUT */
++ 0x1b4 A_DELAY_PS(468) G_DELAY_PS(0) /* CFG_GPMC_A21_OEN */
++ 0x1b8 A_DELAY_PS(339) G_DELAY_PS(0) /* CFG_GPMC_A21_OUT */
++ 0x1c0 A_DELAY_PS(676) G_DELAY_PS(0) /* CFG_GPMC_A22_OEN */
++ 0x1c4 A_DELAY_PS(219) G_DELAY_PS(0) /* CFG_GPMC_A22_OUT */
++ 0x1d0 A_DELAY_PS(1062) G_DELAY_PS(154) /* CFG_GPMC_A23_OUT */
++ 0x1d8 A_DELAY_PS(640) G_DELAY_PS(0) /* CFG_GPMC_A24_OEN */
++ 0x1dc A_DELAY_PS(150) G_DELAY_PS(0) /* CFG_GPMC_A24_OUT */
++ 0x1e4 A_DELAY_PS(356) G_DELAY_PS(0) /* CFG_GPMC_A25_OEN */
++ 0x1e8 A_DELAY_PS(150) G_DELAY_PS(0) /* CFG_GPMC_A25_OUT */
++ 0x1f0 A_DELAY_PS(579) G_DELAY_PS(0) /* CFG_GPMC_A26_OEN */
++ 0x1f4 A_DELAY_PS(200) G_DELAY_PS(0) /* CFG_GPMC_A26_OUT */
++ 0x1fc A_DELAY_PS(435) G_DELAY_PS(0) /* CFG_GPMC_A27_OEN */
++ 0x200 A_DELAY_PS(236) G_DELAY_PS(0) /* CFG_GPMC_A27_OUT */
++ 0x364 A_DELAY_PS(759) G_DELAY_PS(0) /* CFG_GPMC_CS1_OEN */
++ 0x368 A_DELAY_PS(372) G_DELAY_PS(0) /* CFG_GPMC_CS1_OUT */
+ >;
+ };
+
+diff --git a/arch/arm/mach-imx/cpuidle-imx6sx.c b/arch/arm/mach-imx/cpuidle-imx6sx.c
+index fd0053e47a15..3708a71f30e6 100644
+--- a/arch/arm/mach-imx/cpuidle-imx6sx.c
++++ b/arch/arm/mach-imx/cpuidle-imx6sx.c
+@@ -15,6 +15,7 @@
+
+ #include "common.h"
+ #include "cpuidle.h"
++#include "hardware.h"
+
+ static int imx6sx_idle_finish(unsigned long val)
+ {
+@@ -110,7 +111,7 @@ int __init imx6sx_cpuidle_init(void)
+ * except for power up sw2iso which need to be
+ * larger than LDO ramp up time.
+ */
+- imx_gpc_set_arm_power_up_timing(0xf, 1);
++ imx_gpc_set_arm_power_up_timing(cpu_is_imx6sx() ? 0xf : 0x2, 1);
+ imx_gpc_set_arm_power_down_timing(1, 1);
+
+ return cpuidle_register(&imx6sx_cpuidle_driver, NULL);
+diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
+index 35649ee8ad56..c12ff63265a9 100644
+--- a/arch/arm64/Makefile
++++ b/arch/arm64/Makefile
+@@ -51,6 +51,7 @@ endif
+
+ KBUILD_CFLAGS += -mgeneral-regs-only $(lseinstr) $(brokengasinst)
+ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
++KBUILD_CFLAGS += -Wno-psabi
+ KBUILD_AFLAGS += $(lseinstr) $(brokengasinst)
+
+ KBUILD_CFLAGS += $(call cc-option,-mabi=lp64)
+diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h
+index ad64d2c92ef5..5dff8eccd17d 100644
+--- a/arch/arm64/include/uapi/asm/ptrace.h
++++ b/arch/arm64/include/uapi/asm/ptrace.h
+@@ -64,8 +64,6 @@
+
+ #ifndef __ASSEMBLY__
+
+-#include <linux/prctl.h>
+-
+ /*
+ * User structures for general purpose, floating point and debug registers.
+ */
+@@ -112,10 +110,10 @@ struct user_sve_header {
+
+ /*
+ * Common SVE_PT_* flags:
+- * These must be kept in sync with prctl interface in <linux/ptrace.h>
++ * These must be kept in sync with prctl interface in <linux/prctl.h>
+ */
+-#define SVE_PT_VL_INHERIT (PR_SVE_VL_INHERIT >> 16)
+-#define SVE_PT_VL_ONEXEC (PR_SVE_SET_VL_ONEXEC >> 16)
++#define SVE_PT_VL_INHERIT ((1 << 17) /* PR_SVE_VL_INHERIT */ >> 16)
++#define SVE_PT_VL_ONEXEC ((1 << 18) /* PR_SVE_SET_VL_ONEXEC */ >> 16)
+
+
+ /*
+diff --git a/arch/arm64/kernel/ssbd.c b/arch/arm64/kernel/ssbd.c
+index 3432e5ef9f41..388f8fc13080 100644
+--- a/arch/arm64/kernel/ssbd.c
++++ b/arch/arm64/kernel/ssbd.c
+@@ -4,6 +4,7 @@
+ */
+
+ #include <linux/errno.h>
++#include <linux/prctl.h>
+ #include <linux/sched.h>
+ #include <linux/thread_info.h>
+
+diff --git a/arch/mips/kernel/uprobes.c b/arch/mips/kernel/uprobes.c
+index 4aaff3b3175c..6dbe4eab0a0e 100644
+--- a/arch/mips/kernel/uprobes.c
++++ b/arch/mips/kernel/uprobes.c
+@@ -112,9 +112,6 @@ int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
+ */
+ aup->resume_epc = regs->cp0_epc + 4;
+ if (insn_has_delay_slot((union mips_instruction) aup->insn[0])) {
+- unsigned long epc;
+-
+- epc = regs->cp0_epc;
+ __compute_return_epc_for_insn(regs,
+ (union mips_instruction) aup->insn[0]);
+ aup->resume_epc = regs->cp0_epc;
+diff --git a/arch/parisc/math-emu/cnv_float.h b/arch/parisc/math-emu/cnv_float.h
+index 933423fa5144..b0db61188a61 100644
+--- a/arch/parisc/math-emu/cnv_float.h
++++ b/arch/parisc/math-emu/cnv_float.h
+@@ -60,19 +60,19 @@
+ ((exponent < (SGL_P - 1)) ? \
+ (Sall(sgl_value) << (SGL_EXP_LENGTH + 1 + exponent)) : FALSE)
+
+-#define Int_isinexact_to_sgl(int_value) (int_value << 33 - SGL_EXP_LENGTH)
++#define Int_isinexact_to_sgl(int_value) ((int_value << 33 - SGL_EXP_LENGTH) != 0)
+
+ #define Sgl_roundnearest_from_int(int_value,sgl_value) \
+ if (int_value & 1<<(SGL_EXP_LENGTH - 2)) /* round bit */ \
+- if ((int_value << 34 - SGL_EXP_LENGTH) || Slow(sgl_value)) \
++ if (((int_value << 34 - SGL_EXP_LENGTH) != 0) || Slow(sgl_value)) \
+ Sall(sgl_value)++
+
+ #define Dint_isinexact_to_sgl(dint_valueA,dint_valueB) \
+- ((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) || Dintp2(dint_valueB))
++ (((Dintp1(dint_valueA) << 33 - SGL_EXP_LENGTH) != 0) || Dintp2(dint_valueB))
+
+ #define Sgl_roundnearest_from_dint(dint_valueA,dint_valueB,sgl_value) \
+ if (Dintp1(dint_valueA) & 1<<(SGL_EXP_LENGTH - 2)) \
+- if ((Dintp1(dint_valueA) << 34 - SGL_EXP_LENGTH) || \
++ if (((Dintp1(dint_valueA) << 34 - SGL_EXP_LENGTH) != 0) || \
+ Dintp2(dint_valueB) || Slow(sgl_value)) Sall(sgl_value)++
+
+ #define Dint_isinexact_to_dbl(dint_value) \
+diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
+index 2b7135391231..d9d5391b2af6 100644
+--- a/arch/powerpc/include/asm/ppc-opcode.h
++++ b/arch/powerpc/include/asm/ppc-opcode.h
+@@ -336,6 +336,7 @@
+ #define PPC_INST_MULLI 0x1c000000
+ #define PPC_INST_DIVWU 0x7c000396
+ #define PPC_INST_DIVD 0x7c0003d2
++#define PPC_INST_DIVDU 0x7c000392
+ #define PPC_INST_RLWINM 0x54000000
+ #define PPC_INST_RLWIMI 0x50000000
+ #define PPC_INST_RLDICL 0x78000000
+diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
+index dbd8f762140b..68984d85ad6b 100644
+--- a/arch/powerpc/mm/mmu_context_book3s64.c
++++ b/arch/powerpc/mm/mmu_context_book3s64.c
+@@ -53,14 +53,48 @@ int hash__alloc_context_id(void)
+ }
+ EXPORT_SYMBOL_GPL(hash__alloc_context_id);
+
++static int realloc_context_ids(mm_context_t *ctx)
++{
++ int i, id;
++
++ /*
++ * id 0 (aka. ctx->id) is special, we always allocate a new one, even if
++ * there wasn't one allocated previously (which happens in the exec
++ * case where ctx is newly allocated).
++ *
++ * We have to be a bit careful here. We must keep the existing ids in
++ * the array, so that we can test if they're non-zero to decide if we
++ * need to allocate a new one. However in case of error we must free the
++ * ids we've allocated but *not* any of the existing ones (or risk a
++ * UAF). That's why we decrement i at the start of the error handling
++ * loop, to skip the id that we just tested but couldn't reallocate.
++ */
++ for (i = 0; i < ARRAY_SIZE(ctx->extended_id); i++) {
++ if (i == 0 || ctx->extended_id[i]) {
++ id = hash__alloc_context_id();
++ if (id < 0)
++ goto error;
++
++ ctx->extended_id[i] = id;
++ }
++ }
++
++ /* The caller expects us to return id */
++ return ctx->id;
++
++error:
++ for (i--; i >= 0; i--) {
++ if (ctx->extended_id[i])
++ ida_free(&mmu_context_ida, ctx->extended_id[i]);
++ }
++
++ return id;
++}
++
+ static int hash__init_new_context(struct mm_struct *mm)
+ {
+ int index;
+
+- index = hash__alloc_context_id();
+- if (index < 0)
+- return index;
+-
+ /*
+ * The old code would re-promote on fork, we don't do that when using
+ * slices as it could cause problem promoting slices that have been
+@@ -78,6 +112,10 @@ static int hash__init_new_context(struct mm_struct *mm)
+ if (mm->context.id == 0)
+ slice_init_new_context_exec(mm);
+
++ index = realloc_context_ids(&mm->context);
++ if (index < 0)
++ return index;
++
+ subpage_prot_init_new_context(mm);
+
+ pkey_mm_init(mm);
+diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
+index 68dece206048..e5c1d30ee968 100644
+--- a/arch/powerpc/net/bpf_jit.h
++++ b/arch/powerpc/net/bpf_jit.h
+@@ -116,7 +116,7 @@
+ ___PPC_RA(a) | IMM_L(i))
+ #define PPC_DIVWU(d, a, b) EMIT(PPC_INST_DIVWU | ___PPC_RT(d) | \
+ ___PPC_RA(a) | ___PPC_RB(b))
+-#define PPC_DIVD(d, a, b) EMIT(PPC_INST_DIVD | ___PPC_RT(d) | \
++#define PPC_DIVDU(d, a, b) EMIT(PPC_INST_DIVDU | ___PPC_RT(d) | \
+ ___PPC_RA(a) | ___PPC_RB(b))
+ #define PPC_AND(d, a, b) EMIT(PPC_INST_AND | ___PPC_RA(d) | \
+ ___PPC_RS(a) | ___PPC_RB(b))
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index 226eec62d125..279a51bf94d0 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -372,12 +372,12 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
+ case BPF_ALU64 | BPF_DIV | BPF_X: /* dst /= src */
+ case BPF_ALU64 | BPF_MOD | BPF_X: /* dst %= src */
+ if (BPF_OP(code) == BPF_MOD) {
+- PPC_DIVD(b2p[TMP_REG_1], dst_reg, src_reg);
++ PPC_DIVDU(b2p[TMP_REG_1], dst_reg, src_reg);
+ PPC_MULD(b2p[TMP_REG_1], src_reg,
+ b2p[TMP_REG_1]);
+ PPC_SUB(dst_reg, dst_reg, b2p[TMP_REG_1]);
+ } else
+- PPC_DIVD(dst_reg, dst_reg, src_reg);
++ PPC_DIVDU(dst_reg, dst_reg, src_reg);
+ break;
+ case BPF_ALU | BPF_MOD | BPF_K: /* (u32) dst %= (u32) imm */
+ case BPF_ALU | BPF_DIV | BPF_K: /* (u32) dst /= (u32) imm */
+@@ -405,7 +405,7 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
+ break;
+ case BPF_ALU64:
+ if (BPF_OP(code) == BPF_MOD) {
+- PPC_DIVD(b2p[TMP_REG_2], dst_reg,
++ PPC_DIVDU(b2p[TMP_REG_2], dst_reg,
+ b2p[TMP_REG_1]);
+ PPC_MULD(b2p[TMP_REG_1],
+ b2p[TMP_REG_1],
+@@ -413,7 +413,7 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
+ PPC_SUB(dst_reg, dst_reg,
+ b2p[TMP_REG_1]);
+ } else
+- PPC_DIVD(dst_reg, dst_reg,
++ PPC_DIVDU(dst_reg, dst_reg,
+ b2p[TMP_REG_1]);
+ break;
+ }
+diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c
+index 88401d5125bc..523dbfbac03d 100644
+--- a/arch/riscv/mm/fault.c
++++ b/arch/riscv/mm/fault.c
+@@ -29,6 +29,7 @@
+
+ #include <asm/pgalloc.h>
+ #include <asm/ptrace.h>
++#include <asm/tlbflush.h>
+
+ /*
+ * This routine handles page faults. It determines the address and the
+@@ -281,6 +282,18 @@ vmalloc_fault:
+ pte_k = pte_offset_kernel(pmd_k, addr);
+ if (!pte_present(*pte_k))
+ goto no_context;
++
++ /*
++ * The kernel assumes that TLBs don't cache invalid
++ * entries, but in RISC-V, SFENCE.VMA specifies an
++ * ordering constraint, not a cache flush; it is
++ * necessary even after writing invalid entries.
++ * Relying on flush_tlb_fix_spurious_fault would
++ * suffice, but the extra traps reduce
++ * performance. So, eagerly SFENCE.VMA.
++ */
++ local_flush_tlb_page(addr);
++
+ return;
+ }
+ }
+diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h
+index 8c00fd509c45..1a6a7092d942 100644
+--- a/arch/s390/include/asm/ap.h
++++ b/arch/s390/include/asm/ap.h
+@@ -221,16 +221,22 @@ static inline struct ap_queue_status ap_aqic(ap_qid_t qid,
+ void *ind)
+ {
+ register unsigned long reg0 asm ("0") = qid | (3UL << 24);
+- register struct ap_qirq_ctrl reg1_in asm ("1") = qirqctrl;
+- register struct ap_queue_status reg1_out asm ("1");
++ register union {
++ unsigned long value;
++ struct ap_qirq_ctrl qirqctrl;
++ struct ap_queue_status status;
++ } reg1 asm ("1");
+ register void *reg2 asm ("2") = ind;
+
++ reg1.qirqctrl = qirqctrl;
++
+ asm volatile(
+ ".long 0xb2af0000" /* PQAP(AQIC) */
+- : "=d" (reg1_out)
+- : "d" (reg0), "d" (reg1_in), "d" (reg2)
++ : "+d" (reg1)
++ : "d" (reg0), "d" (reg2)
+ : "cc");
+- return reg1_out;
++
++ return reg1.status;
+ }
+
+ /*
+@@ -264,17 +270,21 @@ static inline struct ap_queue_status ap_qact(ap_qid_t qid, int ifbit,
+ {
+ register unsigned long reg0 asm ("0") = qid | (5UL << 24)
+ | ((ifbit & 0x01) << 22);
+- register unsigned long reg1_in asm ("1") = apinfo->val;
+- register struct ap_queue_status reg1_out asm ("1");
++ register union {
++ unsigned long value;
++ struct ap_queue_status status;
++ } reg1 asm ("1");
+ register unsigned long reg2 asm ("2");
+
++ reg1.value = apinfo->val;
++
+ asm volatile(
+ ".long 0xb2af0000" /* PQAP(QACT) */
+- : "+d" (reg1_in), "=d" (reg1_out), "=d" (reg2)
++ : "+d" (reg1), "=d" (reg2)
+ : "d" (reg0)
+ : "cc");
+ apinfo->val = reg2;
+- return reg1_out;
++ return reg1.status;
+ }
+
+ /**
+diff --git a/arch/s390/include/asm/jump_label.h b/arch/s390/include/asm/jump_label.h
+index 40f651292aa7..9c7dc970e966 100644
+--- a/arch/s390/include/asm/jump_label.h
++++ b/arch/s390/include/asm/jump_label.h
+@@ -10,6 +10,12 @@
+ #define JUMP_LABEL_NOP_SIZE 6
+ #define JUMP_LABEL_NOP_OFFSET 2
+
++#if __GNUC__ < 9
++#define JUMP_LABEL_STATIC_KEY_CONSTRAINT "X"
++#else
++#define JUMP_LABEL_STATIC_KEY_CONSTRAINT "jdd"
++#endif
++
+ /*
+ * We use a brcl 0,2 instruction for jump labels at compile time so it
+ * can be easily distinguished from a hotpatch generated instruction.
+@@ -19,9 +25,9 @@ static __always_inline bool arch_static_branch(struct static_key *key, bool bran
+ asm_volatile_goto("0: brcl 0,"__stringify(JUMP_LABEL_NOP_OFFSET)"\n"
+ ".pushsection __jump_table, \"aw\"\n"
+ ".balign 8\n"
+- ".quad 0b, %l[label], %0\n"
++ ".quad 0b, %l[label], %0+%1\n"
+ ".popsection\n"
+- : : "X" (&((char *)key)[branch]) : : label);
++ : : JUMP_LABEL_STATIC_KEY_CONSTRAINT (key), "i" (branch) : : label);
+
+ return false;
+ label:
+@@ -33,9 +39,9 @@ static __always_inline bool arch_static_branch_jump(struct static_key *key, bool
+ asm_volatile_goto("0: brcl 15, %l[label]\n"
+ ".pushsection __jump_table, \"aw\"\n"
+ ".balign 8\n"
+- ".quad 0b, %l[label], %0\n"
++ ".quad 0b, %l[label], %0+%1\n"
+ ".popsection\n"
+- : : "X" (&((char *)key)[branch]) : : label);
++ : : JUMP_LABEL_STATIC_KEY_CONSTRAINT (key), "i" (branch) : : label);
+
+ return false;
+ label:
+diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c
+index 39a2503fa3e1..51028abe5e90 100644
+--- a/arch/sparc/kernel/mdesc.c
++++ b/arch/sparc/kernel/mdesc.c
+@@ -357,6 +357,8 @@ static int get_vdev_port_node_info(struct mdesc_handle *md, u64 node,
+
+ node_info->vdev_port.id = *idp;
+ node_info->vdev_port.name = kstrdup_const(name, GFP_KERNEL);
++ if (!node_info->vdev_port.name)
++ return -1;
+ node_info->vdev_port.parent_cfg_hdl = *parent_cfg_hdlp;
+
+ return 0;
+diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
+index 67b3e6b3ce5d..1ad5911f62b4 100644
+--- a/arch/sparc/kernel/perf_event.c
++++ b/arch/sparc/kernel/perf_event.c
+@@ -891,6 +891,10 @@ static int sparc_perf_event_set_period(struct perf_event *event,
+ s64 period = hwc->sample_period;
+ int ret = 0;
+
++ /* The period may have been changed by PERF_EVENT_IOC_PERIOD */
++ if (unlikely(period != hwc->last_period))
++ left = period - (hwc->last_period - left);
++
+ if (unlikely(left <= -period)) {
+ left = period;
+ local64_set(&hwc->period_left, left);
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index 643670fb8943..274d220d0a83 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -2379,7 +2379,7 @@ static int rdtgroup_init_alloc(struct rdtgroup *rdtgrp)
+ if (closid_allocated(i) && i != closid) {
+ mode = rdtgroup_mode_by_closid(i);
+ if (mode == RDT_MODE_PSEUDO_LOCKSETUP)
+- break;
++ continue;
+ used_b |= *ctrl;
+ if (mode == RDT_MODE_SHAREABLE)
+ d->new_ctrl |= *ctrl;
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index 351283b60df6..a285fbd0fd9b 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -310,7 +310,8 @@ extern char _SecondaryResetVector_text_start;
+ extern char _SecondaryResetVector_text_end;
+ #endif
+
+-static inline int mem_reserve(unsigned long start, unsigned long end)
++static inline int __init_memblock mem_reserve(unsigned long start,
++ unsigned long end)
+ {
+ return memblock_reserve(start, end - start);
+ }
+diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+index c4eb55e3011c..c05ef7f1d7b6 100644
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -512,7 +512,8 @@ dma_chan_prep_dma_memcpy(struct dma_chan *dchan, dma_addr_t dst_adr,
+ return vchan_tx_prep(&chan->vc, &first->vd, flags);
+
+ err_desc_get:
+- axi_desc_put(first);
++ if (first)
++ axi_desc_put(first);
+ return NULL;
+ }
+
+diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
+index 55df0d41355b..1ed1c7efa288 100644
+--- a/drivers/dma/sprd-dma.c
++++ b/drivers/dma/sprd-dma.c
+@@ -663,7 +663,7 @@ static int sprd_dma_fill_desc(struct dma_chan *chan,
+ temp |= slave_cfg->src_maxburst & SPRD_DMA_FRG_LEN_MASK;
+ hw->frg_len = temp;
+
+- hw->blk_len = len & SPRD_DMA_BLK_LEN_MASK;
++ hw->blk_len = slave_cfg->src_maxburst & SPRD_DMA_BLK_LEN_MASK;
+ hw->trsc_len = len & SPRD_DMA_TRSC_LEN_MASK;
+
+ temp = (dst_step & SPRD_DMA_TRSF_STEP_MASK) << SPRD_DMA_DEST_TRSF_STEP_OFFSET;
+diff --git a/drivers/fpga/dfl-afu-dma-region.c b/drivers/fpga/dfl-afu-dma-region.c
+index 0e81d33af856..c9a613dc9eb7 100644
+--- a/drivers/fpga/dfl-afu-dma-region.c
++++ b/drivers/fpga/dfl-afu-dma-region.c
+@@ -399,7 +399,7 @@ int afu_dma_map_region(struct dfl_feature_platform_data *pdata,
+ region->pages[0], 0,
+ region->length,
+ DMA_BIDIRECTIONAL);
+- if (dma_mapping_error(&pdata->dev->dev, region->iova)) {
++ if (dma_mapping_error(dfl_fpga_pdata_to_parent(pdata), region->iova)) {
+ dev_err(&pdata->dev->dev, "failed to map for dma\n");
+ ret = -EFAULT;
+ goto unpin_pages;
+diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c
+index a9b521bccb06..ab361ec78df4 100644
+--- a/drivers/fpga/dfl.c
++++ b/drivers/fpga/dfl.c
+@@ -40,6 +40,13 @@ enum dfl_fpga_devt_type {
+ DFL_FPGA_DEVT_MAX,
+ };
+
++static struct lock_class_key dfl_pdata_keys[DFL_ID_MAX];
++
++static const char *dfl_pdata_key_strings[DFL_ID_MAX] = {
++ "dfl-fme-pdata",
++ "dfl-port-pdata",
++};
++
+ /**
+ * dfl_dev_info - dfl feature device information.
+ * @name: name string of the feature platform device.
+@@ -443,11 +450,16 @@ static int build_info_commit_dev(struct build_feature_devs_info *binfo)
+ struct platform_device *fdev = binfo->feature_dev;
+ struct dfl_feature_platform_data *pdata;
+ struct dfl_feature_info *finfo, *p;
++ enum dfl_id_type type;
+ int ret, index = 0;
+
+ if (!fdev)
+ return 0;
+
++ type = feature_dev_id_type(fdev);
++ if (WARN_ON_ONCE(type >= DFL_ID_MAX))
++ return -EINVAL;
++
+ /*
+ * we do not need to care for the memory which is associated with
+ * the platform device. After calling platform_device_unregister(),
+@@ -463,6 +475,8 @@ static int build_info_commit_dev(struct build_feature_devs_info *binfo)
+ pdata->num = binfo->feature_num;
+ pdata->dfl_cdev = binfo->cdev;
+ mutex_init(&pdata->lock);
++ lockdep_set_class_and_name(&pdata->lock, &dfl_pdata_keys[type],
++ dfl_pdata_key_strings[type]);
+
+ /*
+ * the count should be initialized to 0 to make sure
+@@ -497,7 +511,7 @@ static int build_info_commit_dev(struct build_feature_devs_info *binfo)
+
+ ret = platform_device_add(binfo->feature_dev);
+ if (!ret) {
+- if (feature_dev_id_type(binfo->feature_dev) == PORT_ID)
++ if (type == PORT_ID)
+ dfl_fpga_cdev_add_port_dev(binfo->cdev,
+ binfo->feature_dev);
+ else
+diff --git a/drivers/gpu/drm/arm/hdlcd_crtc.c b/drivers/gpu/drm/arm/hdlcd_crtc.c
+index e4d67b70244d..e69d996eabad 100644
+--- a/drivers/gpu/drm/arm/hdlcd_crtc.c
++++ b/drivers/gpu/drm/arm/hdlcd_crtc.c
+@@ -186,20 +186,20 @@ static void hdlcd_crtc_atomic_disable(struct drm_crtc *crtc,
+ clk_disable_unprepare(hdlcd->clk);
+ }
+
+-static int hdlcd_crtc_atomic_check(struct drm_crtc *crtc,
+- struct drm_crtc_state *state)
++static enum drm_mode_status hdlcd_crtc_mode_valid(struct drm_crtc *crtc,
++ const struct drm_display_mode *mode)
+ {
+ struct hdlcd_drm_private *hdlcd = crtc_to_hdlcd_priv(crtc);
+- struct drm_display_mode *mode = &state->adjusted_mode;
+ long rate, clk_rate = mode->clock * 1000;
+
+ rate = clk_round_rate(hdlcd->clk, clk_rate);
+- if (rate != clk_rate) {
++ /* 0.1% seems a close enough tolerance for the TDA19988 on Juno */
++ if (abs(rate - clk_rate) * 1000 > clk_rate) {
+ /* clock required by mode not supported by hardware */
+- return -EINVAL;
++ return MODE_NOCLOCK;
+ }
+
+- return 0;
++ return MODE_OK;
+ }
+
+ static void hdlcd_crtc_atomic_begin(struct drm_crtc *crtc,
+@@ -220,7 +220,7 @@ static void hdlcd_crtc_atomic_begin(struct drm_crtc *crtc,
+ }
+
+ static const struct drm_crtc_helper_funcs hdlcd_crtc_helper_funcs = {
+- .atomic_check = hdlcd_crtc_atomic_check,
++ .mode_valid = hdlcd_crtc_mode_valid,
+ .atomic_begin = hdlcd_crtc_atomic_begin,
+ .atomic_enable = hdlcd_crtc_atomic_enable,
+ .atomic_disable = hdlcd_crtc_atomic_disable,
+diff --git a/drivers/gpu/drm/arm/malidp_drv.c b/drivers/gpu/drm/arm/malidp_drv.c
+index 94d6dabec2dc..1ab511e33243 100644
+--- a/drivers/gpu/drm/arm/malidp_drv.c
++++ b/drivers/gpu/drm/arm/malidp_drv.c
+@@ -190,6 +190,7 @@ static void malidp_atomic_commit_hw_done(struct drm_atomic_state *state)
+ {
+ struct drm_device *drm = state->dev;
+ struct malidp_drm *malidp = drm->dev_private;
++ int loop = 5;
+
+ malidp->event = malidp->crtc.state->event;
+ malidp->crtc.state->event = NULL;
+@@ -204,8 +205,18 @@ static void malidp_atomic_commit_hw_done(struct drm_atomic_state *state)
+ drm_crtc_vblank_get(&malidp->crtc);
+
+ /* only set config_valid if the CRTC is enabled */
+- if (malidp_set_and_wait_config_valid(drm) < 0)
++ if (malidp_set_and_wait_config_valid(drm) < 0) {
++ /*
++ * make a loop around the second CVAL setting and
++ * try 5 times before giving up.
++ */
++ while (loop--) {
++ if (!malidp_set_and_wait_config_valid(drm))
++ break;
++ }
+ DRM_DEBUG_DRIVER("timed out waiting for updated configuration\n");
++ }
++
+ } else if (malidp->event) {
+ /* CRTC inactive means vblank IRQ is disabled, send event directly */
+ spin_lock_irq(&drm->event_lock);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+index 8b9270f31409..e4e09d47c5c0 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+@@ -136,6 +136,114 @@ static int vmw_close_channel(struct rpc_channel *channel)
+ return 0;
+ }
+
++/**
++ * vmw_port_hb_out - Send the message payload either through the
++ * high-bandwidth port if available, or through the backdoor otherwise.
++ * @channel: The rpc channel.
++ * @msg: NULL-terminated message.
++ * @hb: Whether the high-bandwidth port is available.
++ *
++ * Return: The port status.
++ */
++static unsigned long vmw_port_hb_out(struct rpc_channel *channel,
++ const char *msg, bool hb)
++{
++ unsigned long si, di, eax, ebx, ecx, edx;
++ unsigned long msg_len = strlen(msg);
++
++ if (hb) {
++ unsigned long bp = channel->cookie_high;
++
++ si = (uintptr_t) msg;
++ di = channel->cookie_low;
++
++ VMW_PORT_HB_OUT(
++ (MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
++ msg_len, si, di,
++ VMW_HYPERVISOR_HB_PORT | (channel->channel_id << 16),
++ VMW_HYPERVISOR_MAGIC, bp,
++ eax, ebx, ecx, edx, si, di);
++
++ return ebx;
++ }
++
++ /* HB port not available. Send the message 4 bytes at a time. */
++ ecx = MESSAGE_STATUS_SUCCESS << 16;
++ while (msg_len && (HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS)) {
++ unsigned int bytes = min_t(size_t, msg_len, 4);
++ unsigned long word = 0;
++
++ memcpy(&word, msg, bytes);
++ msg_len -= bytes;
++ msg += bytes;
++ si = channel->cookie_high;
++ di = channel->cookie_low;
++
++ VMW_PORT(VMW_PORT_CMD_MSG | (MSG_TYPE_SENDPAYLOAD << 16),
++ word, si, di,
++ VMW_HYPERVISOR_PORT | (channel->channel_id << 16),
++ VMW_HYPERVISOR_MAGIC,
++ eax, ebx, ecx, edx, si, di);
++ }
++
++ return ecx;
++}
++
++/**
++ * vmw_port_hb_in - Receive the message payload either through the
++ * high-bandwidth port if available, or through the backdoor otherwise.
++ * @channel: The rpc channel.
++ * @reply: Pointer to buffer holding reply.
++ * @reply_len: Length of the reply.
++ * @hb: Whether the high-bandwidth port is available.
++ *
++ * Return: The port status.
++ */
++static unsigned long vmw_port_hb_in(struct rpc_channel *channel, char *reply,
++ unsigned long reply_len, bool hb)
++{
++ unsigned long si, di, eax, ebx, ecx, edx;
++
++ if (hb) {
++ unsigned long bp = channel->cookie_low;
++
++ si = channel->cookie_high;
++ di = (uintptr_t) reply;
++
++ VMW_PORT_HB_IN(
++ (MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
++ reply_len, si, di,
++ VMW_HYPERVISOR_HB_PORT | (channel->channel_id << 16),
++ VMW_HYPERVISOR_MAGIC, bp,
++ eax, ebx, ecx, edx, si, di);
++
++ return ebx;
++ }
++
++ /* HB port not available. Retrieve the message 4 bytes at a time. */
++ ecx = MESSAGE_STATUS_SUCCESS << 16;
++ while (reply_len) {
++ unsigned int bytes = min_t(unsigned long, reply_len, 4);
++
++ si = channel->cookie_high;
++ di = channel->cookie_low;
++
++ VMW_PORT(VMW_PORT_CMD_MSG | (MSG_TYPE_RECVPAYLOAD << 16),
++ MESSAGE_STATUS_SUCCESS, si, di,
++ VMW_HYPERVISOR_PORT | (channel->channel_id << 16),
++ VMW_HYPERVISOR_MAGIC,
++ eax, ebx, ecx, edx, si, di);
++
++ if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0)
++ break;
++
++ memcpy(reply, &ebx, bytes);
++ reply_len -= bytes;
++ reply += bytes;
++ }
++
++ return ecx;
++}
+
+
+ /**
+@@ -148,11 +256,10 @@ static int vmw_close_channel(struct rpc_channel *channel)
+ */
+ static int vmw_send_msg(struct rpc_channel *channel, const char *msg)
+ {
+- unsigned long eax, ebx, ecx, edx, si, di, bp;
++ unsigned long eax, ebx, ecx, edx, si, di;
+ size_t msg_len = strlen(msg);
+ int retries = 0;
+
+-
+ while (retries < RETRIES) {
+ retries++;
+
+@@ -166,23 +273,14 @@ static int vmw_send_msg(struct rpc_channel *channel, const char *msg)
+ VMW_HYPERVISOR_MAGIC,
+ eax, ebx, ecx, edx, si, di);
+
+- if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0 ||
+- (HIGH_WORD(ecx) & MESSAGE_STATUS_HB) == 0) {
+- /* Expected success + high-bandwidth. Give up. */
++ if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
++ /* Expected success. Give up. */
+ return -EINVAL;
+ }
+
+ /* Send msg */
+- si = (uintptr_t) msg;
+- di = channel->cookie_low;
+- bp = channel->cookie_high;
+-
+- VMW_PORT_HB_OUT(
+- (MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
+- msg_len, si, di,
+- VMW_HYPERVISOR_HB_PORT | (channel->channel_id << 16),
+- VMW_HYPERVISOR_MAGIC, bp,
+- eax, ebx, ecx, edx, si, di);
++ ebx = vmw_port_hb_out(channel, msg,
++ !!(HIGH_WORD(ecx) & MESSAGE_STATUS_HB));
+
+ if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) != 0) {
+ return 0;
+@@ -211,7 +309,7 @@ STACK_FRAME_NON_STANDARD(vmw_send_msg);
+ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+ size_t *msg_len)
+ {
+- unsigned long eax, ebx, ecx, edx, si, di, bp;
++ unsigned long eax, ebx, ecx, edx, si, di;
+ char *reply;
+ size_t reply_len;
+ int retries = 0;
+@@ -233,8 +331,7 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+ VMW_HYPERVISOR_MAGIC,
+ eax, ebx, ecx, edx, si, di);
+
+- if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0 ||
+- (HIGH_WORD(ecx) & MESSAGE_STATUS_HB) == 0) {
++ if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
+ DRM_ERROR("Failed to get reply size for host message.\n");
+ return -EINVAL;
+ }
+@@ -252,17 +349,8 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+
+
+ /* Receive buffer */
+- si = channel->cookie_high;
+- di = (uintptr_t) reply;
+- bp = channel->cookie_low;
+-
+- VMW_PORT_HB_IN(
+- (MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
+- reply_len, si, di,
+- VMW_HYPERVISOR_HB_PORT | (channel->channel_id << 16),
+- VMW_HYPERVISOR_MAGIC, bp,
+- eax, ebx, ecx, edx, si, di);
+-
++ ebx = vmw_port_hb_in(channel, reply, reply_len,
++ !!(HIGH_WORD(ecx) & MESSAGE_STATUS_HB));
+ if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) == 0) {
+ kfree(reply);
+
+diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
+index fcdbac4a56e3..6b3559f58b67 100644
+--- a/drivers/hwmon/hwmon.c
++++ b/drivers/hwmon/hwmon.c
+@@ -619,7 +619,7 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
+ if (err)
+ goto free_hwmon;
+
+- if (dev && chip && chip->ops->read &&
++ if (dev && dev->of_node && chip && chip->ops->read &&
+ chip->info[0]->type == hwmon_chip &&
+ (chip->info[0]->config[0] & HWMON_C_REGISTER_TZ)) {
+ const struct hwmon_channel_info **info = chip->info;
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index 2e2b5851139c..cd24b375df1e 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -1230,7 +1230,8 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client,
+ const struct pmbus_driver_info *info,
+ const char *name,
+ int index, int page,
+- const struct pmbus_sensor_attr *attr)
++ const struct pmbus_sensor_attr *attr,
++ bool paged)
+ {
+ struct pmbus_sensor *base;
+ bool upper = !!(attr->gbit & 0xff00); /* need to check STATUS_WORD */
+@@ -1238,7 +1239,7 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client,
+
+ if (attr->label) {
+ ret = pmbus_add_label(data, name, index, attr->label,
+- attr->paged ? page + 1 : 0);
++ paged ? page + 1 : 0);
+ if (ret)
+ return ret;
+ }
+@@ -1271,6 +1272,30 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client,
+ return 0;
+ }
+
++static bool pmbus_sensor_is_paged(const struct pmbus_driver_info *info,
++ const struct pmbus_sensor_attr *attr)
++{
++ int p;
++
++ if (attr->paged)
++ return true;
++
++ /*
++ * Some attributes may be present on more than one page despite
++ * not being marked with the paged attribute. If that is the case,
++ * then treat the sensor as being paged and add the page suffix to the
++ * attribute name.
++ * We don't just add the paged attribute to all such attributes, in
++ * order to maintain the un-suffixed labels in the case where the
++ * attribute is only on page 0.
++ */
++ for (p = 1; p < info->pages; p++) {
++ if (info->func[p] & attr->func)
++ return true;
++ }
++ return false;
++}
++
+ static int pmbus_add_sensor_attrs(struct i2c_client *client,
+ struct pmbus_data *data,
+ const char *name,
+@@ -1284,14 +1309,15 @@ static int pmbus_add_sensor_attrs(struct i2c_client *client,
+ index = 1;
+ for (i = 0; i < nattrs; i++) {
+ int page, pages;
++ bool paged = pmbus_sensor_is_paged(info, attrs);
+
+- pages = attrs->paged ? info->pages : 1;
++ pages = paged ? info->pages : 1;
+ for (page = 0; page < pages; page++) {
+ if (!(info->func[page] & attrs->func))
+ continue;
+ ret = pmbus_add_sensor_attrs_one(client, data, info,
+ name, index, page,
+- attrs);
++ attrs, paged);
+ if (ret)
+ return ret;
+ index++;
+diff --git a/drivers/iio/temperature/mlx90632.c b/drivers/iio/temperature/mlx90632.c
+index 9851311aa3fd..2d54d9cac61d 100644
+--- a/drivers/iio/temperature/mlx90632.c
++++ b/drivers/iio/temperature/mlx90632.c
+@@ -81,6 +81,8 @@
+ /* Magic constants */
+ #define MLX90632_ID_MEDICAL 0x0105 /* EEPROM DSPv5 Medical device id */
+ #define MLX90632_ID_CONSUMER 0x0205 /* EEPROM DSPv5 Consumer device id */
++#define MLX90632_DSP_VERSION 5 /* DSP version */
++#define MLX90632_DSP_MASK GENMASK(7, 0) /* DSP version in EE_VERSION */
+ #define MLX90632_RESET_CMD 0x0006 /* Reset sensor (address or global) */
+ #define MLX90632_REF_12 12LL /**< ResCtrlRef value of Ch 1 or Ch 2 */
+ #define MLX90632_REF_3 12LL /**< ResCtrlRef value of Channel 3 */
+@@ -666,10 +668,13 @@ static int mlx90632_probe(struct i2c_client *client,
+ } else if (read == MLX90632_ID_CONSUMER) {
+ dev_dbg(&client->dev,
+ "Detected Consumer EEPROM calibration %x\n", read);
++ } else if ((read & MLX90632_DSP_MASK) == MLX90632_DSP_VERSION) {
++ dev_dbg(&client->dev,
++ "Detected Unknown EEPROM calibration %x\n", read);
+ } else {
+ dev_err(&client->dev,
+- "EEPROM version mismatch %x (expected %x or %x)\n",
+- read, MLX90632_ID_CONSUMER, MLX90632_ID_MEDICAL);
++ "Wrong DSP version %x (expected %x)\n",
++ read, MLX90632_DSP_VERSION);
+ return -EPROTONOSUPPORT;
+ }
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index b12c8ff8ed66..d8eb4dc04d69 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -9849,6 +9849,7 @@ void hfi1_quiet_serdes(struct hfi1_pportdata *ppd)
+
+ /* disable the port */
+ clear_rcvctrl(dd, RCV_CTRL_RCV_PORT_ENABLE_SMASK);
++ cancel_work_sync(&ppd->freeze_work);
+ }
+
+ static inline int init_cpu_counters(struct hfi1_devdata *dd)
+diff --git a/drivers/infiniband/hw/hfi1/fault.c b/drivers/infiniband/hw/hfi1/fault.c
+index e2290f32c8d9..7eaff4dcbfd7 100644
+--- a/drivers/infiniband/hw/hfi1/fault.c
++++ b/drivers/infiniband/hw/hfi1/fault.c
+@@ -153,6 +153,7 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf,
+ char *dash;
+ unsigned long range_start, range_end, i;
+ bool remove = false;
++ unsigned long bound = 1U << BITS_PER_BYTE;
+
+ end = strchr(ptr, ',');
+ if (end)
+@@ -178,6 +179,10 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf,
+ BITS_PER_BYTE);
+ break;
+ }
++ /* Check the inputs */
++ if (range_start >= bound || range_end >= bound)
++ break;
++
+ for (i = range_start; i <= range_end; i++) {
+ if (remove)
+ clear_bit(i, fault->opcodes);
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+index dbe7d14a5c76..4e986ca4dd35 100644
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+@@ -324,6 +324,9 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,
+ u32 *tidlist = NULL;
+ struct tid_user_buf *tidbuf;
+
++ if (!PAGE_ALIGNED(tinfo->vaddr))
++ return -EINVAL;
++
+ tidbuf = kzalloc(sizeof(*tidbuf), GFP_KERNEL);
+ if (!tidbuf)
+ return -ENOMEM;
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index 48692adbe811..27d9c4cefdc7 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -1418,8 +1418,6 @@ static void hfi1_fill_device_attr(struct hfi1_devdata *dd)
+ rdi->dparms.props.max_cq = hfi1_max_cqs;
+ rdi->dparms.props.max_ah = hfi1_max_ahs;
+ rdi->dparms.props.max_cqe = hfi1_max_cqes;
+- rdi->dparms.props.max_mr = rdi->lkey_table.max;
+- rdi->dparms.props.max_fmr = rdi->lkey_table.max;
+ rdi->dparms.props.max_map_per_fmr = 32767;
+ rdi->dparms.props.max_pd = hfi1_max_pds;
+ rdi->dparms.props.max_qp_rd_atom = HFI1_MAX_RDMA_ATOMIC;
+diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.c b/drivers/infiniband/hw/hfi1/verbs_txreq.c
+index c4ab2d5b4502..8f766dd3f61c 100644
+--- a/drivers/infiniband/hw/hfi1/verbs_txreq.c
++++ b/drivers/infiniband/hw/hfi1/verbs_txreq.c
+@@ -100,7 +100,7 @@ struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev,
+ if (ib_rvt_state_ops[qp->state] & RVT_PROCESS_RECV_OK) {
+ struct hfi1_qp_priv *priv;
+
+- tx = kmem_cache_alloc(dev->verbs_txreq_cache, GFP_ATOMIC);
++ tx = kmem_cache_alloc(dev->verbs_txreq_cache, VERBS_TXREQ_GFP);
+ if (tx)
+ goto out;
+ priv = qp->priv;
+diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.h b/drivers/infiniband/hw/hfi1/verbs_txreq.h
+index 1c19bbc764b2..b1a78985b4ec 100644
+--- a/drivers/infiniband/hw/hfi1/verbs_txreq.h
++++ b/drivers/infiniband/hw/hfi1/verbs_txreq.h
+@@ -72,6 +72,7 @@ struct hfi1_ibdev;
+ struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev,
+ struct rvt_qp *qp);
+
++#define VERBS_TXREQ_GFP (GFP_ATOMIC | __GFP_NOWARN)
+ static inline struct verbs_txreq *get_txreq(struct hfi1_ibdev *dev,
+ struct rvt_qp *qp)
+ __must_hold(&qp->slock)
+@@ -79,7 +80,7 @@ static inline struct verbs_txreq *get_txreq(struct hfi1_ibdev *dev,
+ struct verbs_txreq *tx;
+ struct hfi1_qp_priv *priv = qp->priv;
+
+- tx = kmem_cache_alloc(dev->verbs_txreq_cache, GFP_ATOMIC);
++ tx = kmem_cache_alloc(dev->verbs_txreq_cache, VERBS_TXREQ_GFP);
+ if (unlikely(!tx)) {
+ /* call slow path to get the lock */
+ tx = __get_txreq(dev, qp);
+diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c
+index 41babbc0db58..803c3544c75b 100644
+--- a/drivers/infiniband/hw/qib/qib_verbs.c
++++ b/drivers/infiniband/hw/qib/qib_verbs.c
+@@ -1495,8 +1495,6 @@ static void qib_fill_device_attr(struct qib_devdata *dd)
+ rdi->dparms.props.max_cq = ib_qib_max_cqs;
+ rdi->dparms.props.max_cqe = ib_qib_max_cqes;
+ rdi->dparms.props.max_ah = ib_qib_max_ahs;
+- rdi->dparms.props.max_mr = rdi->lkey_table.max;
+- rdi->dparms.props.max_fmr = rdi->lkey_table.max;
+ rdi->dparms.props.max_map_per_fmr = 32767;
+ rdi->dparms.props.max_qp_rd_atom = QIB_MAX_RDMA_ATOMIC;
+ rdi->dparms.props.max_qp_init_rd_atom = 255;
+diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
+index 5819c9d6ffdc..39d101df229d 100644
+--- a/drivers/infiniband/sw/rdmavt/mr.c
++++ b/drivers/infiniband/sw/rdmavt/mr.c
+@@ -96,6 +96,8 @@ int rvt_driver_mr_init(struct rvt_dev_info *rdi)
+ for (i = 0; i < rdi->lkey_table.max; i++)
+ RCU_INIT_POINTER(rdi->lkey_table.table[i], NULL);
+
++ rdi->dparms.props.max_mr = rdi->lkey_table.max;
++ rdi->dparms.props.max_fmr = rdi->lkey_table.max;
+ return 0;
+ }
+
+diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
+index 5ce403c6cddb..7d03680afd91 100644
+--- a/drivers/infiniband/sw/rdmavt/qp.c
++++ b/drivers/infiniband/sw/rdmavt/qp.c
+@@ -412,7 +412,8 @@ static int alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
+ offset = qpt->incr | ((offset & 1) ^ 1);
+ }
+ /* there can be no set bits in low-order QoS bits */
+- WARN_ON(offset & (BIT(rdi->dparms.qos_shift) - 1));
++ WARN_ON(rdi->dparms.qos_shift > 1 &&
++ offset & ((BIT(rdi->dparms.qos_shift - 1) - 1) << 1));
+ qpn = mk_qpn(qpt, map, offset);
+ }
+
+diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
+index 26ec603fe220..83d1499fe021 100644
+--- a/drivers/input/misc/uinput.c
++++ b/drivers/input/misc/uinput.c
+@@ -1051,13 +1051,31 @@ static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+
+ #ifdef CONFIG_COMPAT
+
+-#define UI_SET_PHYS_COMPAT _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t)
++/*
++ * These IOCTLs change their size and thus their numbers between
++ * 32 and 64 bits.
++ */
++#define UI_SET_PHYS_COMPAT \
++ _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t)
++#define UI_BEGIN_FF_UPLOAD_COMPAT \
++ _IOWR(UINPUT_IOCTL_BASE, 200, struct uinput_ff_upload_compat)
++#define UI_END_FF_UPLOAD_COMPAT \
++ _IOW(UINPUT_IOCTL_BASE, 201, struct uinput_ff_upload_compat)
+
+ static long uinput_compat_ioctl(struct file *file,
+ unsigned int cmd, unsigned long arg)
+ {
+- if (cmd == UI_SET_PHYS_COMPAT)
++ switch (cmd) {
++ case UI_SET_PHYS_COMPAT:
+ cmd = UI_SET_PHYS;
++ break;
++ case UI_BEGIN_FF_UPLOAD_COMPAT:
++ cmd = UI_BEGIN_FF_UPLOAD;
++ break;
++ case UI_END_FF_UPLOAD_COMPAT:
++ cmd = UI_END_FF_UPLOAD;
++ break;
++ }
+
+ return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg));
+ }
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index b6da0c1267e3..8e6077d8e434 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -179,6 +179,8 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN200f", /* T450s */
++ "LEN2054", /* E480 */
++ "LEN2055", /* E580 */
+ "SYN3052", /* HP EliteBook 840 G4 */
+ "SYN3221", /* HP 15-ay000 */
+ NULL
+diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
+index d196ac3d8b8c..e5c3b066bd2a 100644
+--- a/drivers/input/touchscreen/silead.c
++++ b/drivers/input/touchscreen/silead.c
+@@ -604,6 +604,7 @@ static const struct acpi_device_id silead_ts_acpi_match[] = {
+ { "MSSL1680", 0 },
+ { "MSSL0001", 0 },
+ { "MSSL0002", 0 },
++ { "MSSL0017", 0 },
+ { }
+ };
+ MODULE_DEVICE_TABLE(acpi, silead_ts_acpi_match);
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 6600b3466dfb..0a74785e575b 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -144,8 +144,9 @@ void mmc_request_done(struct mmc_host *host, struct mmc_request *mrq)
+ int err = cmd->error;
+
+ /* Flag re-tuning needed on CRC errors */
+- if ((cmd->opcode != MMC_SEND_TUNING_BLOCK &&
+- cmd->opcode != MMC_SEND_TUNING_BLOCK_HS200) &&
++ if (cmd->opcode != MMC_SEND_TUNING_BLOCK &&
++ cmd->opcode != MMC_SEND_TUNING_BLOCK_HS200 &&
++ !host->retune_crc_disable &&
+ (err == -EILSEQ || (mrq->sbc && mrq->sbc->error == -EILSEQ) ||
+ (mrq->data && mrq->data->error == -EILSEQ) ||
+ (mrq->stop && mrq->stop->error == -EILSEQ)))
+diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
+index d8e17ea6126d..0aa99694b937 100644
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -934,6 +934,10 @@ static int mmc_sdio_pre_suspend(struct mmc_host *host)
+ */
+ static int mmc_sdio_suspend(struct mmc_host *host)
+ {
++ /* Prevent processing of SDIO IRQs in suspended state. */
++ mmc_card_set_suspended(host->card);
++ cancel_delayed_work_sync(&host->sdio_irq_work);
++
+ mmc_claim_host(host);
+
+ if (mmc_card_keep_power(host) && mmc_card_wake_sdio_irq(host))
+@@ -982,13 +986,20 @@ static int mmc_sdio_resume(struct mmc_host *host)
+ err = sdio_enable_4bit_bus(host->card);
+ }
+
+- if (!err && host->sdio_irqs) {
++ if (err)
++ goto out;
++
++ /* Allow SDIO IRQs to be processed again. */
++ mmc_card_clr_suspended(host->card);
++
++ if (host->sdio_irqs) {
+ if (!(host->caps2 & MMC_CAP2_SDIO_IRQ_NOTHREAD))
+ wake_up_process(host->sdio_irq_thread);
+ else if (host->caps & MMC_CAP_SDIO_IRQ)
+ host->ops->enable_sdio_irq(host, 1);
+ }
+
++out:
+ mmc_release_host(host);
+
+ host->pm_flags &= ~MMC_PM_KEEP_POWER;
+diff --git a/drivers/mmc/core/sdio_io.c b/drivers/mmc/core/sdio_io.c
+index d40744bbafa9..ed2d8c48ea17 100644
+--- a/drivers/mmc/core/sdio_io.c
++++ b/drivers/mmc/core/sdio_io.c
+@@ -18,6 +18,7 @@
+ #include "sdio_ops.h"
+ #include "core.h"
+ #include "card.h"
++#include "host.h"
+
+ /**
+ * sdio_claim_host - exclusively claim a bus for a certain SDIO function
+@@ -725,3 +726,79 @@ int sdio_set_host_pm_flags(struct sdio_func *func, mmc_pm_flag_t flags)
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(sdio_set_host_pm_flags);
++
++/**
++ * sdio_retune_crc_disable - temporarily disable retuning on CRC errors
++ * @func: SDIO function attached to host
++ *
++ * If the SDIO card is known to be in a state where it might produce
++ * CRC errors on the bus in response to commands (like if we know it is
++ * transitioning between power states), an SDIO function driver can
++ * call this function to temporarily disable the SD/MMC core behavior of
++ * triggering an automatic retuning.
++ *
++ * This function should be called while the host is claimed and the host
++ * should remain claimed until sdio_retune_crc_enable() is called.
++ * Specifically, the expected sequence of calls is:
++ * - sdio_claim_host()
++ * - sdio_retune_crc_disable()
++ * - some number of calls like sdio_writeb() and sdio_readb()
++ * - sdio_retune_crc_enable()
++ * - sdio_release_host()
++ */
++void sdio_retune_crc_disable(struct sdio_func *func)
++{
++ func->card->host->retune_crc_disable = true;
++}
++EXPORT_SYMBOL_GPL(sdio_retune_crc_disable);
++
++/**
++ * sdio_retune_crc_enable - re-enable retuning on CRC errors
++ * @func: SDIO function attached to host
++ *
++ * This is the compement to sdio_retune_crc_disable().
++ */
++void sdio_retune_crc_enable(struct sdio_func *func)
++{
++ func->card->host->retune_crc_disable = false;
++}
++EXPORT_SYMBOL_GPL(sdio_retune_crc_enable);
++
++/**
++ * sdio_retune_hold_now - start deferring retuning requests till release
++ * @func: SDIO function attached to host
++ *
++ * This function can be called if it's currently a bad time to do
++ * a retune of the SDIO card. Retune requests made during this time
++ * will be held and we'll actually do the retune sometime after the
++ * release.
++ *
++ * This function could be useful if an SDIO card is in a power state
++ * where it can respond to a small subset of commands that doesn't
++ * include the retuning command. Care should be taken when using
++ * this function since (presumably) the retuning request we might be
++ * deferring was made for a good reason.
++ *
++ * This function should be called while the host is claimed.
++ */
++void sdio_retune_hold_now(struct sdio_func *func)
++{
++ mmc_retune_hold_now(func->card->host);
++}
++EXPORT_SYMBOL_GPL(sdio_retune_hold_now);
++
++/**
++ * sdio_retune_release - signal that it's OK to retune now
++ * @func: SDIO function attached to host
++ *
++ * This is the complement to sdio_retune_hold_now(). Calling this
++ * function won't make a retune happen right away but will allow
++ * them to be scheduled normally.
++ *
++ * This function should be called while the host is claimed.
++ */
++void sdio_retune_release(struct sdio_func *func)
++{
++ mmc_retune_release(func->card->host);
++}
++EXPORT_SYMBOL_GPL(sdio_retune_release);
+diff --git a/drivers/mmc/core/sdio_irq.c b/drivers/mmc/core/sdio_irq.c
+index 7ca7b99413f0..b299a24d33f9 100644
+--- a/drivers/mmc/core/sdio_irq.c
++++ b/drivers/mmc/core/sdio_irq.c
+@@ -38,6 +38,10 @@ static int process_sdio_pending_irqs(struct mmc_host *host)
+ unsigned char pending;
+ struct sdio_func *func;
+
++ /* Don't process SDIO IRQs if the card is suspended. */
++ if (mmc_card_suspended(card))
++ return 0;
++
+ /*
+ * Optimization, if there is only 1 function interrupt registered
+ * and we know an IRQ was signaled then call irq handler directly.
+diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c
+index cc3ffeffd7a2..fa8d9da2ab7f 100644
+--- a/drivers/mmc/host/sdhci-pci-o2micro.c
++++ b/drivers/mmc/host/sdhci-pci-o2micro.c
+@@ -117,6 +117,7 @@ static int sdhci_o2_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ */
+ if (mmc->ios.bus_width == MMC_BUS_WIDTH_8) {
+ current_bus_width = mmc->ios.bus_width;
++ mmc->ios.bus_width = MMC_BUS_WIDTH_4;
+ sdhci_set_bus_width(host, MMC_BUS_WIDTH_4);
+ }
+
+@@ -128,8 +129,10 @@ static int sdhci_o2_execute_tuning(struct mmc_host *mmc, u32 opcode)
+
+ sdhci_end_tuning(host);
+
+- if (current_bus_width == MMC_BUS_WIDTH_8)
++ if (current_bus_width == MMC_BUS_WIDTH_8) {
++ mmc->ios.bus_width = MMC_BUS_WIDTH_8;
+ sdhci_set_bus_width(host, current_bus_width);
++ }
+
+ host->flags &= ~SDHCI_HS400_TUNING;
+ return 0;
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 2646faffd36e..6f265d2e647b 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -165,7 +165,7 @@
+ #define FLEXCAN_MB_CNT_LENGTH(x) (((x) & 0xf) << 16)
+ #define FLEXCAN_MB_CNT_TIMESTAMP(x) ((x) & 0xffff)
+
+-#define FLEXCAN_TIMEOUT_US (50)
++#define FLEXCAN_TIMEOUT_US (250)
+
+ /* FLEXCAN hardware feature flags
+ *
+diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
+index 045f0845e665..3df23487487f 100644
+--- a/drivers/net/can/xilinx_can.c
++++ b/drivers/net/can/xilinx_can.c
+@@ -1424,7 +1424,7 @@ static const struct xcan_devtype_data xcan_canfd_data = {
+ XCAN_FLAG_RXMNF |
+ XCAN_FLAG_TX_MAILBOXES |
+ XCAN_FLAG_RX_FIFO_MULTI,
+- .bittiming_const = &xcan_bittiming_const,
++ .bittiming_const = &xcan_bittiming_const_canfd,
+ .btr_ts2_shift = XCAN_BTR_TS2_SHIFT_CANFD,
+ .btr_sjw_shift = XCAN_BTR_SJW_SHIFT_CANFD,
+ .bus_clk_name = "s_axi_aclk",
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index dfaad1c2c2b8..411cfb806459 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -1484,7 +1484,7 @@ static int mv88e6xxx_vtu_get(struct mv88e6xxx_chip *chip, u16 vid,
+ int err;
+
+ if (!vid)
+- return -EINVAL;
++ return -EOPNOTSUPP;
+
+ entry->vid = vid - 1;
+ entry->valid = false;
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+index e2710ff48fb0..1fa0cd527ead 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+@@ -339,6 +339,7 @@ static int __lb_setup(struct net_device *ndev,
+ static int __lb_up(struct net_device *ndev,
+ enum hnae_loop loop_mode)
+ {
++#define NIC_LB_TEST_WAIT_PHY_LINK_TIME 300
+ struct hns_nic_priv *priv = netdev_priv(ndev);
+ struct hnae_handle *h = priv->ae_handle;
+ int speed, duplex;
+@@ -365,6 +366,9 @@ static int __lb_up(struct net_device *ndev,
+
+ h->dev->ops->adjust_link(h, speed, duplex);
+
++ /* wait adjust link done and phy ready */
++ msleep(NIC_LB_TEST_WAIT_PHY_LINK_TIME);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 6e6abdc399de..1d55f014725e 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1784,6 +1784,7 @@ static void mtk_poll_controller(struct net_device *dev)
+
+ static int mtk_start_dma(struct mtk_eth *eth)
+ {
++ u32 rx_2b_offset = (NET_IP_ALIGN == 2) ? MTK_RX_2B_OFFSET : 0;
+ int err;
+
+ err = mtk_dma_init(eth);
+@@ -1800,7 +1801,7 @@ static int mtk_start_dma(struct mtk_eth *eth)
+ MTK_QDMA_GLO_CFG);
+
+ mtk_w32(eth,
+- MTK_RX_DMA_EN | MTK_RX_2B_OFFSET |
++ MTK_RX_DMA_EN | rx_2b_offset |
+ MTK_RX_BT_32DWORDS | MTK_MULTI_EN,
+ MTK_PDMA_GLO_CFG);
+
+@@ -2304,13 +2305,13 @@ static int mtk_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+
+ switch (cmd->cmd) {
+ case ETHTOOL_GRXRINGS:
+- if (dev->features & NETIF_F_LRO) {
++ if (dev->hw_features & NETIF_F_LRO) {
+ cmd->data = MTK_MAX_RX_RING_NUM;
+ ret = 0;
+ }
+ break;
+ case ETHTOOL_GRXCLSRLCNT:
+- if (dev->features & NETIF_F_LRO) {
++ if (dev->hw_features & NETIF_F_LRO) {
+ struct mtk_mac *mac = netdev_priv(dev);
+
+ cmd->rule_cnt = mac->hwlro_ip_cnt;
+@@ -2318,11 +2319,11 @@ static int mtk_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+ }
+ break;
+ case ETHTOOL_GRXCLSRULE:
+- if (dev->features & NETIF_F_LRO)
++ if (dev->hw_features & NETIF_F_LRO)
+ ret = mtk_hwlro_get_fdir_entry(dev, cmd);
+ break;
+ case ETHTOOL_GRXCLSRLALL:
+- if (dev->features & NETIF_F_LRO)
++ if (dev->hw_features & NETIF_F_LRO)
+ ret = mtk_hwlro_get_fdir_all(dev, cmd,
+ rule_locs);
+ break;
+@@ -2339,11 +2340,11 @@ static int mtk_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd)
+
+ switch (cmd->cmd) {
+ case ETHTOOL_SRXCLSRLINS:
+- if (dev->features & NETIF_F_LRO)
++ if (dev->hw_features & NETIF_F_LRO)
+ ret = mtk_hwlro_add_ipaddr(dev, cmd);
+ break;
+ case ETHTOOL_SRXCLSRLDEL:
+- if (dev->features & NETIF_F_LRO)
++ if (dev->hw_features & NETIF_F_LRO)
+ ret = mtk_hwlro_del_ipaddr(dev, cmd);
+ break;
+ default:
+diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
+index 68b8007da82b..0115a2868933 100644
+--- a/drivers/net/ipvlan/ipvlan_main.c
++++ b/drivers/net/ipvlan/ipvlan_main.c
+@@ -178,7 +178,7 @@ static void ipvlan_port_destroy(struct net_device *dev)
+ }
+
+ #define IPVLAN_FEATURES \
+- (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
++ (NETIF_F_SG | NETIF_F_CSUM_MASK | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
+ NETIF_F_GSO | NETIF_F_TSO | NETIF_F_GSO_ROBUST | \
+ NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \
+ NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER)
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index a907d7b065fa..53e4962ceb8a 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -667,6 +667,12 @@ brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
+
+ brcmf_dbg(TRACE, "Enter: on=%d\n", on);
+
++ sdio_retune_crc_disable(bus->sdiodev->func1);
++
++ /* Cannot re-tune if device is asleep; defer till we're awake */
++ if (on)
++ sdio_retune_hold_now(bus->sdiodev->func1);
++
+ wr_val = (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+ /* 1st KSO write goes to AOS wake up core if device is asleep */
+ brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
+@@ -719,6 +725,11 @@ brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
+ if (try_cnt > MAX_KSO_ATTEMPTS)
+ brcmf_err("max tries: rd_val=0x%x err=%d\n", rd_val, err);
+
++ if (on)
++ sdio_retune_release(bus->sdiodev->func1);
++
++ sdio_retune_crc_enable(bus->sdiodev->func1);
++
+ return err;
+ }
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index a867a139bb35..d8869d978c34 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3228,7 +3228,8 @@ static int nvme_scan_ns_list(struct nvme_ctrl *ctrl, unsigned nn)
+ {
+ struct nvme_ns *ns;
+ __le32 *ns_list;
+- unsigned i, j, nsid, prev = 0, num_lists = DIV_ROUND_UP(nn, 1024);
++ unsigned i, j, nsid, prev = 0;
++ unsigned num_lists = DIV_ROUND_UP_ULL((u64)nn, 1024);
+ int ret = 0;
+
+ ns_list = kzalloc(NVME_IDENTIFY_DATA_SIZE, GFP_KERNEL);
+diff --git a/drivers/nvme/target/io-cmd-bdev.c b/drivers/nvme/target/io-cmd-bdev.c
+index 7bc9f6240432..1096dd01ca22 100644
+--- a/drivers/nvme/target/io-cmd-bdev.c
++++ b/drivers/nvme/target/io-cmd-bdev.c
+@@ -239,6 +239,7 @@ u16 nvmet_bdev_parse_io_cmd(struct nvmet_req *req)
+ return 0;
+ case nvme_cmd_write_zeroes:
+ req->execute = nvmet_bdev_execute_write_zeroes;
++ req->data_len = 0;
+ return 0;
+ default:
+ pr_err("unhandled cmd %d on qid %d\n", cmd->common.opcode,
+diff --git a/drivers/parport/share.c b/drivers/parport/share.c
+index 5dc53d420ca8..7b4ee33c1935 100644
+--- a/drivers/parport/share.c
++++ b/drivers/parport/share.c
+@@ -895,6 +895,7 @@ parport_register_dev_model(struct parport *port, const char *name,
+ par_dev->devmodel = true;
+ ret = device_register(&par_dev->dev);
+ if (ret) {
++ kfree(par_dev->state);
+ put_device(&par_dev->dev);
+ goto err_put_port;
+ }
+@@ -912,6 +913,7 @@ parport_register_dev_model(struct parport *port, const char *name,
+ spin_unlock(&port->physport->pardevice_lock);
+ pr_debug("%s: cannot grant exclusive access for device %s\n",
+ port->name, name);
++ kfree(par_dev->state);
+ device_unregister(&par_dev->dev);
+ goto err_put_port;
+ }
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index b7513c5848cf..c1c35eccd5b6 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -1901,7 +1901,7 @@ static void qeth_bridgeport_an_set_cb(void *priv,
+
+ l2entry = (struct qdio_brinfo_entry_l2 *)entry;
+ code = IPA_ADDR_CHANGE_CODE_MACADDR;
+- if (l2entry->addr_lnid.lnid)
++ if (l2entry->addr_lnid.lnid < VLAN_N_VID)
+ code |= IPA_ADDR_CHANGE_CODE_VLANID;
+ qeth_bridge_emit_host_event(card, anev_reg_unreg, code,
+ (struct net_if_token *)&l2entry->nit,
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index 411d656f2530..98f2d076f938 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -3697,8 +3697,10 @@ static int pqi_submit_raid_request_synchronous(struct pqi_ctrl_info *ctrl_info,
+ return -ETIMEDOUT;
+ msecs_blocked =
+ jiffies_to_msecs(jiffies - start_jiffies);
+- if (msecs_blocked >= timeout_msecs)
+- return -ETIMEDOUT;
++ if (msecs_blocked >= timeout_msecs) {
++ rc = -ETIMEDOUT;
++ goto out;
++ }
+ timeout_msecs -= msecs_blocked;
+ }
+ }
+diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
+index 895a9b5ac989..30c22e16b1e3 100644
+--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
++++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
+@@ -340,24 +340,21 @@ int ufshcd_pltfrm_init(struct platform_device *pdev,
+ goto dealloc_host;
+ }
+
+- pm_runtime_set_active(&pdev->dev);
+- pm_runtime_enable(&pdev->dev);
+-
+ ufshcd_init_lanes_per_dir(hba);
+
+ err = ufshcd_init(hba, mmio_base, irq);
+ if (err) {
+ dev_err(dev, "Initialization failed\n");
+- goto out_disable_rpm;
++ goto dealloc_host;
+ }
+
+ platform_set_drvdata(pdev, hba);
+
++ pm_runtime_set_active(&pdev->dev);
++ pm_runtime_enable(&pdev->dev);
++
+ return 0;
+
+-out_disable_rpm:
+- pm_runtime_disable(&pdev->dev);
+- pm_runtime_set_suspended(&pdev->dev);
+ dealloc_host:
+ ufshcd_dealloc_host(hba);
+ out:
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 3183fa8c5857..b8b59cfeacd1 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1914,7 +1914,8 @@ int ufshcd_copy_query_response(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
+ memcpy(&query_res->upiu_res, &lrbp->ucd_rsp_ptr->qr, QUERY_OSF_SIZE);
+
+ /* Get the descriptor */
+- if (lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) {
++ if (hba->dev_cmd.query.descriptor &&
++ lrbp->ucd_rsp_ptr->qr.opcode == UPIU_QUERY_OPCODE_READ_DESC) {
+ u8 *descp = (u8 *)lrbp->ucd_rsp_ptr +
+ GENERAL_UPIU_REQUEST_SIZE;
+ u16 resp_len;
+diff --git a/drivers/staging/erofs/erofs_fs.h b/drivers/staging/erofs/erofs_fs.h
+index 2f8e2bf70941..7677da889f12 100644
+--- a/drivers/staging/erofs/erofs_fs.h
++++ b/drivers/staging/erofs/erofs_fs.h
+@@ -17,10 +17,16 @@
+ #define EROFS_SUPER_MAGIC_V1 0xE0F5E1E2
+ #define EROFS_SUPER_OFFSET 1024
+
++/*
++ * Any bits that aren't in EROFS_ALL_REQUIREMENTS should be
++ * incompatible with this kernel version.
++ */
++#define EROFS_ALL_REQUIREMENTS 0
++
+ struct erofs_super_block {
+ /* 0 */__le32 magic; /* in the little endian */
+ /* 4 */__le32 checksum; /* crc32c(super_block) */
+-/* 8 */__le32 features;
++/* 8 */__le32 features; /* (aka. feature_compat) */
+ /* 12 */__u8 blkszbits; /* support block_size == PAGE_SIZE only */
+ /* 13 */__u8 reserved;
+
+@@ -34,9 +40,10 @@ struct erofs_super_block {
+ /* 44 */__le32 xattr_blkaddr;
+ /* 48 */__u8 uuid[16]; /* 128-bit uuid for volume */
+ /* 64 */__u8 volume_name[16]; /* volume name */
++/* 80 */__le32 requirements; /* (aka. feature_incompat) */
+
+-/* 80 */__u8 reserved2[48]; /* 128 bytes */
+-} __packed;
++/* 84 */__u8 reserved2[44];
++} __packed; /* 128 bytes */
+
+ #define __EROFS_BIT(_prefix, _cur, _pre) enum { \
+ _prefix ## _cur ## _BIT = _prefix ## _pre ## _BIT + \
+diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h
+index 58d8cbc3f921..8ce37091db20 100644
+--- a/drivers/staging/erofs/internal.h
++++ b/drivers/staging/erofs/internal.h
+@@ -111,6 +111,8 @@ struct erofs_sb_info {
+
+ u8 uuid[16]; /* 128-bit uuid for volume */
+ u8 volume_name[16]; /* volume name */
++ u32 requirements;
++
+ char *dev_name;
+
+ unsigned int mount_opt;
+diff --git a/drivers/staging/erofs/super.c b/drivers/staging/erofs/super.c
+index b0583cdb079a..b49ebdf6ebda 100644
+--- a/drivers/staging/erofs/super.c
++++ b/drivers/staging/erofs/super.c
+@@ -75,6 +75,22 @@ static void destroy_inode(struct inode *inode)
+ call_rcu(&inode->i_rcu, i_callback);
+ }
+
++static bool check_layout_compatibility(struct super_block *sb,
++ struct erofs_super_block *layout)
++{
++ const unsigned int requirements = le32_to_cpu(layout->requirements);
++
++ EROFS_SB(sb)->requirements = requirements;
++
++ /* check if current kernel meets all mandatory requirements */
++ if (requirements & (~EROFS_ALL_REQUIREMENTS)) {
++ errln("unidentified requirements %x, please upgrade kernel version",
++ requirements & ~EROFS_ALL_REQUIREMENTS);
++ return false;
++ }
++ return true;
++}
++
+ static int superblock_read(struct super_block *sb)
+ {
+ struct erofs_sb_info *sbi;
+@@ -108,6 +124,9 @@ static int superblock_read(struct super_block *sb)
+ goto out;
+ }
+
++ if (!check_layout_compatibility(sb, layout))
++ goto out;
++
+ sbi->blocks = le32_to_cpu(layout->blocks);
+ sbi->meta_blkaddr = le32_to_cpu(layout->meta_blkaddr);
+ #ifdef CONFIG_EROFS_FS_XATTR
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index 9852ec5e6e01..cc7c856126df 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -1621,6 +1621,25 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on)
+ static int ci_udc_start(struct usb_gadget *gadget,
+ struct usb_gadget_driver *driver);
+ static int ci_udc_stop(struct usb_gadget *gadget);
++
++/* Match ISOC IN from the highest endpoint */
++static struct usb_ep *ci_udc_match_ep(struct usb_gadget *gadget,
++ struct usb_endpoint_descriptor *desc,
++ struct usb_ss_ep_comp_descriptor *comp_desc)
++{
++ struct ci_hdrc *ci = container_of(gadget, struct ci_hdrc, gadget);
++ struct usb_ep *ep;
++
++ if (usb_endpoint_xfer_isoc(desc) && usb_endpoint_dir_in(desc)) {
++ list_for_each_entry_reverse(ep, &ci->gadget.ep_list, ep_list) {
++ if (ep->caps.dir_in && !ep->claimed)
++ return ep;
++ }
++ }
++
++ return NULL;
++}
++
+ /**
+ * Device operations part of the API to the USB controller hardware,
+ * which don't involve endpoints (or i/o)
+@@ -1634,6 +1653,7 @@ static const struct usb_gadget_ops usb_gadget_ops = {
+ .vbus_draw = ci_udc_vbus_draw,
+ .udc_start = ci_udc_start,
+ .udc_stop = ci_udc_stop,
++ .match_ep = ci_udc_match_ep,
+ };
+
+ static int init_eps(struct ci_hdrc *ci)
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index b62953ee0fc6..f896a00662ef 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1604,8 +1604,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ usb_hcd_resume_root_hub(hcd);
+ }
+
+- if (hcd->speed >= HCD_USB3 && (portsc & PORT_PLS_MASK) == XDEV_INACTIVE)
++ if (hcd->speed >= HCD_USB3 &&
++ (portsc & PORT_PLS_MASK) == XDEV_INACTIVE) {
++ slot_id = xhci_find_slot_id_by_port(hcd, xhci, hcd_portnum + 1);
++ if (slot_id && xhci->devs[slot_id])
++ xhci->devs[slot_id]->flags |= VDEV_PORT_ERROR;
+ bus_state->port_remote_wakeup &= ~(1 << hcd_portnum);
++ }
+
+ if ((portsc & PORT_PLC) && (portsc & PORT_PLS_MASK) == XDEV_RESUME) {
+ xhci_dbg(xhci, "port resume event for port %d\n", port_id);
+@@ -1793,6 +1798,14 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
+ {
+ struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
+ struct xhci_command *command;
++
++ /*
++ * Avoid resetting endpoint if link is inactive. Can cause host hang.
++ * Device will be reset soon to recover the link so don't do anything
++ */
++ if (xhci->devs[slot_id]->flags & VDEV_PORT_ERROR)
++ return;
++
+ command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
+ if (!command)
+ return;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index f30b065095fa..4ffadca2c71a 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1441,6 +1441,10 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ xhci_dbg(xhci, "urb submitted during PCI suspend\n");
+ return -ESHUTDOWN;
+ }
++ if (xhci->devs[slot_id]->flags & VDEV_PORT_ERROR) {
++ xhci_dbg(xhci, "Can't queue urb, port error, link inactive\n");
++ return -ENODEV;
++ }
+
+ if (usb_endpoint_xfer_isoc(&urb->ep->desc))
+ num_tds = urb->number_of_packets;
+@@ -3724,6 +3728,7 @@ static int xhci_discover_or_reset_device(struct usb_hcd *hcd,
+ }
+ /* If necessary, update the number of active TTs on this root port */
+ xhci_update_tt_active_eps(xhci, virt_dev, old_active_eps);
++ virt_dev->flags = 0;
+ ret = 0;
+
+ command_cleanup:
+@@ -5030,16 +5035,26 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ } else {
+ /*
+ * Some 3.1 hosts return sbrn 0x30, use xhci supported protocol
+- * minor revision instead of sbrn
++ * minor revision instead of sbrn. Minor revision is a two digit
++ * BCD containing minor and sub-minor numbers, only show minor.
+ */
+- minor_rev = xhci->usb3_rhub.min_rev;
+- if (minor_rev) {
++ minor_rev = xhci->usb3_rhub.min_rev / 0x10;
++
++ switch (minor_rev) {
++ case 2:
++ hcd->speed = HCD_USB32;
++ hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;
++ hcd->self.root_hub->rx_lanes = 2;
++ hcd->self.root_hub->tx_lanes = 2;
++ break;
++ case 1:
+ hcd->speed = HCD_USB31;
+ hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS;
++ break;
+ }
+- xhci_info(xhci, "Host supports USB 3.%x %s SuperSpeed\n",
++ xhci_info(xhci, "Host supports USB 3.%x %sSuperSpeed\n",
+ minor_rev,
+- minor_rev ? "Enhanced" : "");
++ minor_rev ? "Enhanced " : "");
+
+ xhci->usb3_rhub.hcd = hcd;
+ /* xHCI private pointer was set in xhci_pci_probe for the second
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index dc00f59c8e69..761b341d27b0 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1010,6 +1010,15 @@ struct xhci_virt_device {
+ u8 real_port;
+ struct xhci_interval_bw_table *bw_table;
+ struct xhci_tt_bw_info *tt_info;
++ /*
++ * flags for state tracking based on events and issued commands.
++ * Software can not rely on states from output contexts because of
++ * latency between events and xHC updating output context values.
++ * See xhci 1.1 section 4.8.3 for more details
++ */
++ unsigned long flags;
++#define VDEV_PORT_ERROR BIT(0) /* Port error, link inactive */
++
+ /* The current max exit latency for the enabled USB3 link states. */
+ u16 current_mel;
+ /* Used for the debugfs interfaces. */
+diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
+index dec14b739b10..859274e38417 100644
+--- a/fs/btrfs/reada.c
++++ b/fs/btrfs/reada.c
+@@ -745,6 +745,7 @@ static void __reada_start_machine(struct btrfs_fs_info *fs_info)
+ u64 total = 0;
+ int i;
+
++again:
+ do {
+ enqueued = 0;
+ mutex_lock(&fs_devices->device_list_mutex);
+@@ -756,6 +757,10 @@ static void __reada_start_machine(struct btrfs_fs_info *fs_info)
+ mutex_unlock(&fs_devices->device_list_mutex);
+ total += enqueued;
+ } while (enqueued && total < 10000);
++ if (fs_devices->seed) {
++ fs_devices = fs_devices->seed;
++ goto again;
++ }
+
+ if (enqueued == 0)
+ return;
+diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c
+index 18814f1d67d9..3c0bad577859 100644
+--- a/fs/cifs/smb2maperror.c
++++ b/fs/cifs/smb2maperror.c
+@@ -457,7 +457,7 @@ static const struct status_to_posix_error smb2_error_map_table[] = {
+ {STATUS_FILE_INVALID, -EIO, "STATUS_FILE_INVALID"},
+ {STATUS_ALLOTTED_SPACE_EXCEEDED, -EIO,
+ "STATUS_ALLOTTED_SPACE_EXCEEDED"},
+- {STATUS_INSUFFICIENT_RESOURCES, -EREMOTEIO,
++ {STATUS_INSUFFICIENT_RESOURCES, -EAGAIN,
+ "STATUS_INSUFFICIENT_RESOURCES"},
+ {STATUS_DFS_EXIT_PATH_FOUND, -EIO, "STATUS_DFS_EXIT_PATH_FOUND"},
+ {STATUS_DEVICE_DATA_ERROR, -EIO, "STATUS_DEVICE_DATA_ERROR"},
+diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
+index 00338b828f76..0bd276e4ccbe 100644
+--- a/fs/overlayfs/file.c
++++ b/fs/overlayfs/file.c
+@@ -409,36 +409,16 @@ static long ovl_real_ioctl(struct file *file, unsigned int cmd,
+ return ret;
+ }
+
+-static unsigned int ovl_get_inode_flags(struct inode *inode)
+-{
+- unsigned int flags = READ_ONCE(inode->i_flags);
+- unsigned int ovl_iflags = 0;
+-
+- if (flags & S_SYNC)
+- ovl_iflags |= FS_SYNC_FL;
+- if (flags & S_APPEND)
+- ovl_iflags |= FS_APPEND_FL;
+- if (flags & S_IMMUTABLE)
+- ovl_iflags |= FS_IMMUTABLE_FL;
+- if (flags & S_NOATIME)
+- ovl_iflags |= FS_NOATIME_FL;
+-
+- return ovl_iflags;
+-}
+-
+-static long ovl_ioctl_set_flags(struct file *file, unsigned long arg)
++static long ovl_ioctl_set_flags(struct file *file, unsigned int cmd,
++ unsigned long arg, unsigned int iflags)
+ {
+ long ret;
+ struct inode *inode = file_inode(file);
+- unsigned int flags;
+- unsigned int old_flags;
++ unsigned int old_iflags;
+
+ if (!inode_owner_or_capable(inode))
+ return -EACCES;
+
+- if (get_user(flags, (int __user *) arg))
+- return -EFAULT;
+-
+ ret = mnt_want_write_file(file);
+ if (ret)
+ return ret;
+@@ -447,8 +427,8 @@ static long ovl_ioctl_set_flags(struct file *file, unsigned long arg)
+
+ /* Check the capability before cred override */
+ ret = -EPERM;
+- old_flags = ovl_get_inode_flags(inode);
+- if (((flags ^ old_flags) & (FS_APPEND_FL | FS_IMMUTABLE_FL)) &&
++ old_iflags = READ_ONCE(inode->i_flags);
++ if (((iflags ^ old_iflags) & (S_APPEND | S_IMMUTABLE)) &&
+ !capable(CAP_LINUX_IMMUTABLE))
+ goto unlock;
+
+@@ -456,7 +436,7 @@ static long ovl_ioctl_set_flags(struct file *file, unsigned long arg)
+ if (ret)
+ goto unlock;
+
+- ret = ovl_real_ioctl(file, FS_IOC_SETFLAGS, arg);
++ ret = ovl_real_ioctl(file, cmd, arg);
+
+ ovl_copyflags(ovl_inode_real(inode), inode);
+ unlock:
+@@ -468,17 +448,79 @@ unlock:
+
+ }
+
++static unsigned int ovl_fsflags_to_iflags(unsigned int flags)
++{
++ unsigned int iflags = 0;
++
++ if (flags & FS_SYNC_FL)
++ iflags |= S_SYNC;
++ if (flags & FS_APPEND_FL)
++ iflags |= S_APPEND;
++ if (flags & FS_IMMUTABLE_FL)
++ iflags |= S_IMMUTABLE;
++ if (flags & FS_NOATIME_FL)
++ iflags |= S_NOATIME;
++
++ return iflags;
++}
++
++static long ovl_ioctl_set_fsflags(struct file *file, unsigned int cmd,
++ unsigned long arg)
++{
++ unsigned int flags;
++
++ if (get_user(flags, (int __user *) arg))
++ return -EFAULT;
++
++ return ovl_ioctl_set_flags(file, cmd, arg,
++ ovl_fsflags_to_iflags(flags));
++}
++
++static unsigned int ovl_fsxflags_to_iflags(unsigned int xflags)
++{
++ unsigned int iflags = 0;
++
++ if (xflags & FS_XFLAG_SYNC)
++ iflags |= S_SYNC;
++ if (xflags & FS_XFLAG_APPEND)
++ iflags |= S_APPEND;
++ if (xflags & FS_XFLAG_IMMUTABLE)
++ iflags |= S_IMMUTABLE;
++ if (xflags & FS_XFLAG_NOATIME)
++ iflags |= S_NOATIME;
++
++ return iflags;
++}
++
++static long ovl_ioctl_set_fsxflags(struct file *file, unsigned int cmd,
++ unsigned long arg)
++{
++ struct fsxattr fa;
++
++ memset(&fa, 0, sizeof(fa));
++ if (copy_from_user(&fa, (void __user *) arg, sizeof(fa)))
++ return -EFAULT;
++
++ return ovl_ioctl_set_flags(file, cmd, arg,
++ ovl_fsxflags_to_iflags(fa.fsx_xflags));
++}
++
+ static long ovl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ {
+ long ret;
+
+ switch (cmd) {
+ case FS_IOC_GETFLAGS:
++ case FS_IOC_FSGETXATTR:
+ ret = ovl_real_ioctl(file, cmd, arg);
+ break;
+
+ case FS_IOC_SETFLAGS:
+- ret = ovl_ioctl_set_flags(file, arg);
++ ret = ovl_ioctl_set_fsflags(file, cmd, arg);
++ break;
++
++ case FS_IOC_FSSETXATTR:
++ ret = ovl_ioctl_set_fsxflags(file, cmd, arg);
+ break;
+
+ default:
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index b48273e846ad..f0389849fd80 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -553,15 +553,15 @@ static void ovl_fill_inode(struct inode *inode, umode_t mode, dev_t rdev,
+ int xinobits = ovl_xino_bits(inode->i_sb);
+
+ /*
+- * When NFS export is enabled and d_ino is consistent with st_ino
+- * (samefs or i_ino has enough bits to encode layer), set the same
+- * value used for d_ino to i_ino, because nfsd readdirplus compares
+- * d_ino values to i_ino values of child entries. When called from
++ * When d_ino is consistent with st_ino (samefs or i_ino has enough
++ * bits to encode layer), set the same value used for st_ino to i_ino,
++ * so inode number exposed via /proc/locks and a like will be
++ * consistent with d_ino and st_ino values. An i_ino value inconsistent
++ * with d_ino also causes nfsd readdirplus to fail. When called from
+ * ovl_new_inode(), ino arg is 0, so i_ino will be updated to real
+ * upper inode i_ino on ovl_inode_init() or ovl_inode_update().
+ */
+- if (inode->i_sb->s_export_op &&
+- (ovl_same_sb(inode->i_sb) || xinobits)) {
++ if (ovl_same_sb(inode->i_sb) || xinobits) {
+ inode->i_ino = ino;
+ if (xinobits && fsid && !(ino >> (64 - xinobits)))
+ inode->i_ino |= (unsigned long)fsid << (64 - xinobits);
+@@ -777,6 +777,54 @@ struct inode *ovl_lookup_inode(struct super_block *sb, struct dentry *real,
+ return inode;
+ }
+
++bool ovl_lookup_trap_inode(struct super_block *sb, struct dentry *dir)
++{
++ struct inode *key = d_inode(dir);
++ struct inode *trap;
++ bool res;
++
++ trap = ilookup5(sb, (unsigned long) key, ovl_inode_test, key);
++ if (!trap)
++ return false;
++
++ res = IS_DEADDIR(trap) && !ovl_inode_upper(trap) &&
++ !ovl_inode_lower(trap);
++
++ iput(trap);
++ return res;
++}
++
++/*
++ * Create an inode cache entry for layer root dir, that will intentionally
++ * fail ovl_verify_inode(), so any lookup that will find some layer root
++ * will fail.
++ */
++struct inode *ovl_get_trap_inode(struct super_block *sb, struct dentry *dir)
++{
++ struct inode *key = d_inode(dir);
++ struct inode *trap;
++
++ if (!d_is_dir(dir))
++ return ERR_PTR(-ENOTDIR);
++
++ trap = iget5_locked(sb, (unsigned long) key, ovl_inode_test,
++ ovl_inode_set, key);
++ if (!trap)
++ return ERR_PTR(-ENOMEM);
++
++ if (!(trap->i_state & I_NEW)) {
++ /* Conflicting layer roots? */
++ iput(trap);
++ return ERR_PTR(-ELOOP);
++ }
++
++ trap->i_mode = S_IFDIR;
++ trap->i_flags = S_DEAD;
++ unlock_new_inode(trap);
++
++ return trap;
++}
++
+ /*
+ * Does overlay inode need to be hashed by lower inode?
+ */
+diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
+index efd372312ef1..badf039267a2 100644
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -18,6 +18,7 @@
+ #include "overlayfs.h"
+
+ struct ovl_lookup_data {
++ struct super_block *sb;
+ struct qstr name;
+ bool is_dir;
+ bool opaque;
+@@ -244,6 +245,12 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
+ if (!d->metacopy || d->last)
+ goto out;
+ } else {
++ if (ovl_lookup_trap_inode(d->sb, this)) {
++ /* Caught in a trap of overlapping layers */
++ err = -ELOOP;
++ goto out_err;
++ }
++
+ if (last_element)
+ d->is_dir = true;
+ if (d->last)
+@@ -819,6 +826,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
+ int err;
+ bool metacopy = false;
+ struct ovl_lookup_data d = {
++ .sb = dentry->d_sb,
+ .name = dentry->d_name,
+ .is_dir = false,
+ .opaque = false,
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index 80fb66426760..265bf9cfde08 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -270,6 +270,7 @@ void ovl_clear_flag(unsigned long flag, struct inode *inode);
+ bool ovl_test_flag(unsigned long flag, struct inode *inode);
+ bool ovl_inuse_trylock(struct dentry *dentry);
+ void ovl_inuse_unlock(struct dentry *dentry);
++bool ovl_is_inuse(struct dentry *dentry);
+ bool ovl_need_index(struct dentry *dentry);
+ int ovl_nlink_start(struct dentry *dentry, bool *locked);
+ void ovl_nlink_end(struct dentry *dentry, bool locked);
+@@ -366,6 +367,8 @@ struct ovl_inode_params {
+ struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, dev_t rdev);
+ struct inode *ovl_lookup_inode(struct super_block *sb, struct dentry *real,
+ bool is_upper);
++bool ovl_lookup_trap_inode(struct super_block *sb, struct dentry *dir);
++struct inode *ovl_get_trap_inode(struct super_block *sb, struct dentry *dir);
+ struct inode *ovl_get_inode(struct super_block *sb,
+ struct ovl_inode_params *oip);
+ static inline void ovl_copyattr(struct inode *from, struct inode *to)
+diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
+index ec237035333a..6ed1ace8f8b3 100644
+--- a/fs/overlayfs/ovl_entry.h
++++ b/fs/overlayfs/ovl_entry.h
+@@ -29,6 +29,8 @@ struct ovl_sb {
+
+ struct ovl_layer {
+ struct vfsmount *mnt;
++ /* Trap in ovl inode cache */
++ struct inode *trap;
+ struct ovl_sb *fs;
+ /* Index of this layer in fs root (upper idx == 0) */
+ int idx;
+@@ -65,6 +67,10 @@ struct ovl_fs {
+ /* Did we take the inuse lock? */
+ bool upperdir_locked;
+ bool workdir_locked;
++ /* Traps in ovl inode cache */
++ struct inode *upperdir_trap;
++ struct inode *workdir_trap;
++ struct inode *indexdir_trap;
+ /* Inode numbers in all layers do not use the high xino_bits */
+ unsigned int xino_bits;
+ };
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 0fb0a59a5e5c..2d028c02621f 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -217,6 +217,9 @@ static void ovl_free_fs(struct ovl_fs *ofs)
+ {
+ unsigned i;
+
++ iput(ofs->indexdir_trap);
++ iput(ofs->workdir_trap);
++ iput(ofs->upperdir_trap);
+ dput(ofs->indexdir);
+ dput(ofs->workdir);
+ if (ofs->workdir_locked)
+@@ -225,8 +228,10 @@ static void ovl_free_fs(struct ovl_fs *ofs)
+ if (ofs->upperdir_locked)
+ ovl_inuse_unlock(ofs->upper_mnt->mnt_root);
+ mntput(ofs->upper_mnt);
+- for (i = 0; i < ofs->numlower; i++)
++ for (i = 0; i < ofs->numlower; i++) {
++ iput(ofs->lower_layers[i].trap);
+ mntput(ofs->lower_layers[i].mnt);
++ }
+ for (i = 0; i < ofs->numlowerfs; i++)
+ free_anon_bdev(ofs->lower_fs[i].pseudo_dev);
+ kfree(ofs->lower_layers);
+@@ -984,7 +989,26 @@ static const struct xattr_handler *ovl_xattr_handlers[] = {
+ NULL
+ };
+
+-static int ovl_get_upper(struct ovl_fs *ofs, struct path *upperpath)
++static int ovl_setup_trap(struct super_block *sb, struct dentry *dir,
++ struct inode **ptrap, const char *name)
++{
++ struct inode *trap;
++ int err;
++
++ trap = ovl_get_trap_inode(sb, dir);
++ err = PTR_ERR_OR_ZERO(trap);
++ if (err) {
++ if (err == -ELOOP)
++ pr_err("overlayfs: conflicting %s path\n", name);
++ return err;
++ }
++
++ *ptrap = trap;
++ return 0;
++}
++
++static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs,
++ struct path *upperpath)
+ {
+ struct vfsmount *upper_mnt;
+ int err;
+@@ -1004,6 +1028,11 @@ static int ovl_get_upper(struct ovl_fs *ofs, struct path *upperpath)
+ if (err)
+ goto out;
+
++ err = ovl_setup_trap(sb, upperpath->dentry, &ofs->upperdir_trap,
++ "upperdir");
++ if (err)
++ goto out;
++
+ upper_mnt = clone_private_mount(upperpath);
+ err = PTR_ERR(upper_mnt);
+ if (IS_ERR(upper_mnt)) {
+@@ -1030,7 +1059,8 @@ out:
+ return err;
+ }
+
+-static int ovl_make_workdir(struct ovl_fs *ofs, struct path *workpath)
++static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs,
++ struct path *workpath)
+ {
+ struct vfsmount *mnt = ofs->upper_mnt;
+ struct dentry *temp;
+@@ -1045,6 +1075,10 @@ static int ovl_make_workdir(struct ovl_fs *ofs, struct path *workpath)
+ if (!ofs->workdir)
+ goto out;
+
++ err = ovl_setup_trap(sb, ofs->workdir, &ofs->workdir_trap, "workdir");
++ if (err)
++ goto out;
++
+ /*
+ * Upper should support d_type, else whiteouts are visible. Given
+ * workdir and upper are on same fs, we can do iterate_dir() on
+@@ -1105,7 +1139,8 @@ out:
+ return err;
+ }
+
+-static int ovl_get_workdir(struct ovl_fs *ofs, struct path *upperpath)
++static int ovl_get_workdir(struct super_block *sb, struct ovl_fs *ofs,
++ struct path *upperpath)
+ {
+ int err;
+ struct path workpath = { };
+@@ -1136,19 +1171,16 @@ static int ovl_get_workdir(struct ovl_fs *ofs, struct path *upperpath)
+ pr_warn("overlayfs: workdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
+ }
+
+- err = ovl_make_workdir(ofs, &workpath);
+- if (err)
+- goto out;
++ err = ovl_make_workdir(sb, ofs, &workpath);
+
+- err = 0;
+ out:
+ path_put(&workpath);
+
+ return err;
+ }
+
+-static int ovl_get_indexdir(struct ovl_fs *ofs, struct ovl_entry *oe,
+- struct path *upperpath)
++static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs,
++ struct ovl_entry *oe, struct path *upperpath)
+ {
+ struct vfsmount *mnt = ofs->upper_mnt;
+ int err;
+@@ -1167,6 +1199,11 @@ static int ovl_get_indexdir(struct ovl_fs *ofs, struct ovl_entry *oe,
+
+ ofs->indexdir = ovl_workdir_create(ofs, OVL_INDEXDIR_NAME, true);
+ if (ofs->indexdir) {
++ err = ovl_setup_trap(sb, ofs->indexdir, &ofs->indexdir_trap,
++ "indexdir");
++ if (err)
++ goto out;
++
+ /*
+ * Verify upper root is exclusively associated with index dir.
+ * Older kernels stored upper fh in "trusted.overlay.origin"
+@@ -1226,8 +1263,8 @@ static int ovl_get_fsid(struct ovl_fs *ofs, struct super_block *sb)
+ return ofs->numlowerfs;
+ }
+
+-static int ovl_get_lower_layers(struct ovl_fs *ofs, struct path *stack,
+- unsigned int numlower)
++static int ovl_get_lower_layers(struct super_block *sb, struct ovl_fs *ofs,
++ struct path *stack, unsigned int numlower)
+ {
+ int err;
+ unsigned int i;
+@@ -1245,16 +1282,28 @@ static int ovl_get_lower_layers(struct ovl_fs *ofs, struct path *stack,
+
+ for (i = 0; i < numlower; i++) {
+ struct vfsmount *mnt;
++ struct inode *trap;
+ int fsid;
+
+ err = fsid = ovl_get_fsid(ofs, stack[i].mnt->mnt_sb);
+ if (err < 0)
+ goto out;
+
++ err = -EBUSY;
++ if (ovl_is_inuse(stack[i].dentry)) {
++ pr_err("overlayfs: lowerdir is in-use as upperdir/workdir\n");
++ goto out;
++ }
++
++ err = ovl_setup_trap(sb, stack[i].dentry, &trap, "lowerdir");
++ if (err)
++ goto out;
++
+ mnt = clone_private_mount(&stack[i]);
+ err = PTR_ERR(mnt);
+ if (IS_ERR(mnt)) {
+ pr_err("overlayfs: failed to clone lowerpath\n");
++ iput(trap);
+ goto out;
+ }
+
+@@ -1264,6 +1313,7 @@ static int ovl_get_lower_layers(struct ovl_fs *ofs, struct path *stack,
+ */
+ mnt->mnt_flags |= MNT_READONLY | MNT_NOATIME;
+
++ ofs->lower_layers[ofs->numlower].trap = trap;
+ ofs->lower_layers[ofs->numlower].mnt = mnt;
+ ofs->lower_layers[ofs->numlower].idx = i + 1;
+ ofs->lower_layers[ofs->numlower].fsid = fsid;
+@@ -1358,7 +1408,7 @@ static struct ovl_entry *ovl_get_lowerstack(struct super_block *sb,
+ goto out_err;
+ }
+
+- err = ovl_get_lower_layers(ofs, stack, numlower);
++ err = ovl_get_lower_layers(sb, ofs, stack, numlower);
+ if (err)
+ goto out_err;
+
+@@ -1390,6 +1440,77 @@ out_err:
+ goto out;
+ }
+
++/*
++ * Check if this layer root is a descendant of:
++ * - another layer of this overlayfs instance
++ * - upper/work dir of any overlayfs instance
++ */
++static int ovl_check_layer(struct super_block *sb, struct dentry *dentry,
++ const char *name)
++{
++ struct dentry *next = dentry, *parent;
++ int err = 0;
++
++ if (!dentry)
++ return 0;
++
++ parent = dget_parent(next);
++
++ /* Walk back ancestors to root (inclusive) looking for traps */
++ while (!err && parent != next) {
++ if (ovl_is_inuse(parent)) {
++ err = -EBUSY;
++ pr_err("overlayfs: %s path overlapping in-use upperdir/workdir\n",
++ name);
++ } else if (ovl_lookup_trap_inode(sb, parent)) {
++ err = -ELOOP;
++ pr_err("overlayfs: overlapping %s path\n", name);
++ }
++ next = parent;
++ parent = dget_parent(next);
++ dput(next);
++ }
++
++ dput(parent);
++
++ return err;
++}
++
++/*
++ * Check if any of the layers or work dirs overlap.
++ */
++static int ovl_check_overlapping_layers(struct super_block *sb,
++ struct ovl_fs *ofs)
++{
++ int i, err;
++
++ if (ofs->upper_mnt) {
++ err = ovl_check_layer(sb, ofs->upper_mnt->mnt_root, "upperdir");
++ if (err)
++ return err;
++
++ /*
++ * Checking workbasedir avoids hitting ovl_is_inuse(parent) of
++ * this instance and covers overlapping work and index dirs,
++ * unless work or index dir have been moved since created inside
++ * workbasedir. In that case, we already have their traps in
++ * inode cache and we will catch that case on lookup.
++ */
++ err = ovl_check_layer(sb, ofs->workbasedir, "workdir");
++ if (err)
++ return err;
++ }
++
++ for (i = 0; i < ofs->numlower; i++) {
++ err = ovl_check_layer(sb, ofs->lower_layers[i].mnt->mnt_root,
++ "lowerdir");
++ if (err)
++ return err;
++ }
++
++ return 0;
++}
++
+ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ {
+ struct path upperpath = { };
+@@ -1429,17 +1550,20 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ if (ofs->config.xino != OVL_XINO_OFF)
+ ofs->xino_bits = BITS_PER_LONG - 32;
+
++ /* alloc/destroy_inode needed for setting up traps in inode cache */
++ sb->s_op = &ovl_super_operations;
++
+ if (ofs->config.upperdir) {
+ if (!ofs->config.workdir) {
+ pr_err("overlayfs: missing 'workdir'\n");
+ goto out_err;
+ }
+
+- err = ovl_get_upper(ofs, &upperpath);
++ err = ovl_get_upper(sb, ofs, &upperpath);
+ if (err)
+ goto out_err;
+
+- err = ovl_get_workdir(ofs, &upperpath);
++ err = ovl_get_workdir(sb, ofs, &upperpath);
+ if (err)
+ goto out_err;
+
+@@ -1460,7 +1584,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ sb->s_flags |= SB_RDONLY;
+
+ if (!(ovl_force_readonly(ofs)) && ofs->config.index) {
+- err = ovl_get_indexdir(ofs, oe, &upperpath);
++ err = ovl_get_indexdir(sb, ofs, oe, &upperpath);
+ if (err)
+ goto out_free_oe;
+
+@@ -1473,6 +1597,10 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+
+ }
+
++ err = ovl_check_overlapping_layers(sb, ofs);
++ if (err)
++ goto out_free_oe;
++
+ /* Show index=off in /proc/mounts for forced r/o mount */
+ if (!ofs->indexdir) {
+ ofs->config.index = false;
+@@ -1494,7 +1622,6 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ cap_lower(cred->cap_effective, CAP_SYS_RESOURCE);
+
+ sb->s_magic = OVERLAYFS_SUPER_MAGIC;
+- sb->s_op = &ovl_super_operations;
+ sb->s_xattr = ovl_xattr_handlers;
+ sb->s_fs_info = ofs;
+ sb->s_flags |= SB_POSIXACL;
+diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
+index c9a2e3c6d537..db8bdb29b320 100644
+--- a/fs/overlayfs/util.c
++++ b/fs/overlayfs/util.c
+@@ -653,6 +653,18 @@ void ovl_inuse_unlock(struct dentry *dentry)
+ }
+ }
+
++bool ovl_is_inuse(struct dentry *dentry)
++{
++ struct inode *inode = d_inode(dentry);
++ bool inuse;
++
++ spin_lock(&inode->i_lock);
++ inuse = (inode->i_state & I_OVL_INUSE);
++ spin_unlock(&inode->i_lock);
++
++ return inuse;
++}
++
+ /*
+ * Does this overlay dentry need to be indexed on copy up?
+ */
+diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
+index beed7121c781..2ff52de1c2b8 100644
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -395,6 +395,7 @@ struct mmc_host {
+ unsigned int retune_now:1; /* do re-tuning at next req */
+ unsigned int retune_paused:1; /* re-tuning is temporarily disabled */
+ unsigned int use_blk_mq:1; /* use blk-mq */
++ unsigned int retune_crc_disable:1; /* don't trigger retune upon crc */
+
+ int rescan_disable; /* disable card detection */
+ int rescan_entered; /* used with nonremovable devices */
+diff --git a/include/linux/mmc/sdio_func.h b/include/linux/mmc/sdio_func.h
+index 97ca105347a6..6905f3f641cc 100644
+--- a/include/linux/mmc/sdio_func.h
++++ b/include/linux/mmc/sdio_func.h
+@@ -159,4 +159,10 @@ extern void sdio_f0_writeb(struct sdio_func *func, unsigned char b,
+ extern mmc_pm_flag_t sdio_get_host_pm_caps(struct sdio_func *func);
+ extern int sdio_set_host_pm_flags(struct sdio_func *func, mmc_pm_flag_t flags);
+
++extern void sdio_retune_crc_disable(struct sdio_func *func);
++extern void sdio_retune_crc_enable(struct sdio_func *func);
++
++extern void sdio_retune_hold_now(struct sdio_func *func);
++extern void sdio_retune_release(struct sdio_func *func);
++
+ #endif /* LINUX_MMC_SDIO_FUNC_H */
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 1dfb75057580..cc2d0c3b475b 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -182,6 +182,9 @@ struct adv_info {
+
+ #define HCI_MAX_SHORT_NAME_LENGTH 10
+
++/* Min encryption key size to match with SMP */
++#define HCI_MIN_ENC_KEY_SIZE 7
++
+ /* Default LE RPA expiry time, 15 minutes */
+ #define HCI_DEFAULT_RPA_TIMEOUT (15 * 60)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 4de121e24ce5..67e0a990144a 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -3448,7 +3448,8 @@ struct cfg80211_ops {
+ * on wiphy_new(), but can be changed by the driver if it has a good
+ * reason to override the default
+ * @WIPHY_FLAG_4ADDR_AP: supports 4addr mode even on AP (with a single station
+- * on a VLAN interface)
++ * on a VLAN interface). This flag also serves an extra purpose of
++ * supporting 4ADDR AP mode on devices which do not support AP/VLAN iftype.
+ * @WIPHY_FLAG_4ADDR_STATION: supports 4addr mode even as a station
+ * @WIPHY_FLAG_CONTROL_PORT_PROTOCOL: This device supports setting the
+ * control port protocol ethertype. The device also honours the
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 1bd7a758583b..181dba75a203 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -8351,12 +8351,8 @@ void ftrace_dump(enum ftrace_dump_mode oops_dump_mode)
+
+ cnt++;
+
+- /* reset all but tr, trace, and overruns */
+- memset(&iter.seq, 0,
+- sizeof(struct trace_iterator) -
+- offsetof(struct trace_iterator, seq));
++ trace_iterator_reset(&iter);
+ iter.iter_flags |= TRACE_FILE_LAT_FMT;
+- iter.pos = -1;
+
+ if (trace_find_next_entry_inc(&iter) != NULL) {
+ int ret;
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 447bd96ee658..d11d7bfc3fa5 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -1895,4 +1895,22 @@ static inline void tracer_hardirqs_off(unsigned long a0, unsigned long a1) { }
+
+ extern struct trace_iterator *tracepoint_print_iter;
+
++/*
++ * Reset the state of the trace_iterator so that it can read consumed data.
++ * Normally, the trace_iterator is used for reading the data when it is not
++ * consumed, and must retain state.
++ */
++static __always_inline void trace_iterator_reset(struct trace_iterator *iter)
++{
++ const size_t offset = offsetof(struct trace_iterator, seq);
++
++ /*
++ * Keep gcc from complaining about overwriting more than just one
++ * member in the structure.
++ */
++ memset((char *)iter + offset, 0, sizeof(struct trace_iterator) - offset);
++
++ iter->pos = -1;
++}
++
+ #endif /* _LINUX_KERNEL_TRACE_H */
+diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c
+index 810d78a8d14c..2905a3dd94c1 100644
+--- a/kernel/trace/trace_kdb.c
++++ b/kernel/trace/trace_kdb.c
+@@ -41,12 +41,8 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file)
+
+ kdb_printf("Dumping ftrace buffer:\n");
+
+- /* reset all but tr, trace, and overruns */
+- memset(&iter.seq, 0,
+- sizeof(struct trace_iterator) -
+- offsetof(struct trace_iterator, seq));
++ trace_iterator_reset(&iter);
+ iter.iter_flags |= TRACE_FILE_LAT_FMT;
+- iter.pos = -1;
+
+ if (cpu_file == RING_BUFFER_ALL_CPUS) {
+ for_each_tracing_cpu(cpu) {
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index bd4978ce8c45..15d1cb5aee18 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1392,8 +1392,16 @@ auth:
+ return 0;
+
+ encrypt:
+- if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
++ if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
++ /* Ensure that the encryption key size has been read,
++ * otherwise stall the upper layer responses.
++ */
++ if (!conn->enc_key_size)
++ return 0;
++
++ /* Nothing else needed, all requirements are met */
+ return 1;
++ }
+
+ hci_conn_encrypt(conn);
+ return 0;
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 2c6eabf294b3..69e3be51a2c3 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -1340,6 +1340,21 @@ static void l2cap_request_info(struct l2cap_conn *conn)
+ sizeof(req), &req);
+ }
+
++static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
++{
++ /* The minimum encryption key size needs to be enforced by the
++ * host stack before establishing any L2CAP connections. The
++ * specification in theory allows a minimum of 1, but to align
++ * BR/EDR and LE transports, a minimum of 7 is chosen.
++ *
++ * This check might also be called for unencrypted connections
++ * that have no key size requirements. Ensure that the link is
++ * actually encrypted before enforcing a key size.
++ */
++ return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
++ hcon->enc_key_size > HCI_MIN_ENC_KEY_SIZE);
++}
++
+ static void l2cap_do_start(struct l2cap_chan *chan)
+ {
+ struct l2cap_conn *conn = chan->conn;
+@@ -1357,9 +1372,14 @@ static void l2cap_do_start(struct l2cap_chan *chan)
+ if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
+ return;
+
+- if (l2cap_chan_check_security(chan, true) &&
+- __l2cap_no_conn_pending(chan))
++ if (!l2cap_chan_check_security(chan, true) ||
++ !__l2cap_no_conn_pending(chan))
++ return;
++
++ if (l2cap_check_enc_key_size(conn->hcon))
+ l2cap_start_connection(chan);
++ else
++ __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
+ }
+
+ static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
+@@ -1438,7 +1458,10 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
+ continue;
+ }
+
+- l2cap_start_connection(chan);
++ if (l2cap_check_enc_key_size(conn->hcon))
++ l2cap_start_connection(chan);
++ else
++ l2cap_chan_close(chan, ECONNREFUSED);
+
+ } else if (chan->state == BT_CONNECT2) {
+ struct l2cap_conn_rsp rsp;
+@@ -7455,7 +7478,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
+ }
+
+ if (chan->state == BT_CONNECT) {
+- if (!status)
++ if (!status && l2cap_check_enc_key_size(hcon))
+ l2cap_start_connection(chan);
+ else
+ __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
+@@ -7464,7 +7487,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
+ struct l2cap_conn_rsp rsp;
+ __u16 res, stat;
+
+- if (!status) {
++ if (!status && l2cap_check_enc_key_size(hcon)) {
+ if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
+ res = L2CAP_CR_PEND;
+ stat = L2CAP_CS_AUTHOR_PEND;
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 1684ba5b51eb..e386d654116d 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -105,6 +105,7 @@ EXPORT_SYMBOL(can_ioctl);
+ static void can_sock_destruct(struct sock *sk)
+ {
+ skb_queue_purge(&sk->sk_receive_queue);
++ skb_queue_purge(&sk->sk_error_queue);
+ }
+
+ static const struct can_proto *can_get_proto(int protocol)
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 172aeae21ae9..35c6dfa13fa8 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -2183,6 +2183,9 @@ void ieee80211_tdls_cancel_channel_switch(struct wiphy *wiphy,
+ const u8 *addr);
+ void ieee80211_teardown_tdls_peers(struct ieee80211_sub_if_data *sdata);
+ void ieee80211_tdls_chsw_work(struct work_struct *wk);
++void ieee80211_tdls_handle_disconnect(struct ieee80211_sub_if_data *sdata,
++ const u8 *peer, u16 reason);
++const char *ieee80211_get_reason_code_string(u16 reason_code);
+
+ extern const struct ethtool_ops ieee80211_ethtool_ops;
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 2ac749c4a6b2..1aaa73fa308e 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2868,7 +2868,7 @@ static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
+ #define case_WLAN(type) \
+ case WLAN_REASON_##type: return #type
+
+-static const char *ieee80211_get_reason_code_string(u16 reason_code)
++const char *ieee80211_get_reason_code_string(u16 reason_code)
+ {
+ switch (reason_code) {
+ case_WLAN(UNSPECIFIED);
+@@ -2933,6 +2933,11 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
+ if (len < 24 + 2)
+ return;
+
++ if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
++ ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
++ return;
++ }
++
+ if (ifmgd->associated &&
+ ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid)) {
+ const u8 *bssid = ifmgd->associated->bssid;
+@@ -2982,6 +2987,11 @@ static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
+
+ reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
+
++ if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
++ ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
++ return;
++ }
++
+ sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
+ mgmt->sa, reason_code,
+ ieee80211_get_reason_code_string(reason_code));
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index e946ee4f335b..7523d995ea8a 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3752,6 +3752,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
+ case NL80211_IFTYPE_STATION:
+ if (!bssid && !sdata->u.mgd.use_4addr)
+ return false;
++ if (ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
++ return false;
+ if (multicast)
+ return true;
+ return ether_addr_equal(sdata->vif.addr, hdr->addr1);
+diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
+index 6c647f425e05..67745d1d4c5d 100644
+--- a/net/mac80211/tdls.c
++++ b/net/mac80211/tdls.c
+@@ -1992,3 +1992,26 @@ void ieee80211_tdls_chsw_work(struct work_struct *wk)
+ }
+ rtnl_unlock();
+ }
++
++void ieee80211_tdls_handle_disconnect(struct ieee80211_sub_if_data *sdata,
++ const u8 *peer, u16 reason)
++{
++ struct ieee80211_sta *sta;
++
++ rcu_read_lock();
++ sta = ieee80211_find_sta(&sdata->vif, peer);
++ if (!sta || !sta->tdls) {
++ rcu_read_unlock();
++ return;
++ }
++ rcu_read_unlock();
++
++ tdls_dbg(sdata, "disconnected from TDLS peer %pM (Reason: %u=%s)\n",
++ peer, reason,
++ ieee80211_get_reason_code_string(reason));
++
++ ieee80211_tdls_oper_request(&sdata->vif, peer,
++ NL80211_TDLS_TEARDOWN,
++ WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE,
++ GFP_ATOMIC);
++}
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 3deaa01ebee4..2558a34c9df1 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -3523,7 +3523,9 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+ }
+
+ /* Always allow software iftypes */
+- if (local->hw.wiphy->software_iftypes & BIT(iftype)) {
++ if (local->hw.wiphy->software_iftypes & BIT(iftype) ||
++ (iftype == NL80211_IFTYPE_AP_VLAN &&
++ local->hw.wiphy->flags & WIPHY_FLAG_4ADDR_AP)) {
+ if (radar_detect)
+ return -EINVAL;
+ return 0;
+diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
+index 58d0b258b684..5dd48f0a4b1b 100644
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -1175,7 +1175,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ struct ieee80211_key *key = rx->key;
+ struct ieee80211_mmie_16 *mmie;
+- u8 aad[GMAC_AAD_LEN], mic[GMAC_MIC_LEN], ipn[6], nonce[GMAC_NONCE_LEN];
++ u8 aad[GMAC_AAD_LEN], *mic, ipn[6], nonce[GMAC_NONCE_LEN];
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+
+ if (!ieee80211_is_mgmt(hdr->frame_control))
+@@ -1206,13 +1206,18 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
+ memcpy(nonce, hdr->addr2, ETH_ALEN);
+ memcpy(nonce + ETH_ALEN, ipn, 6);
+
++ mic = kmalloc(GMAC_MIC_LEN, GFP_ATOMIC);
++ if (!mic)
++ return RX_DROP_UNUSABLE;
+ if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
+ skb->data + 24, skb->len - 24,
+ mic) < 0 ||
+ crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
+ key->u.aes_gmac.icverrors++;
++ kfree(mic);
+ return RX_DROP_UNUSABLE;
+ }
++ kfree(mic);
+ }
+
+ memcpy(key->u.aes_gmac.rx_pn, ipn, 6);
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index a88551f3bc43..2a46ec3cb72c 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -498,7 +498,7 @@ use_default_name:
+ &rdev->rfkill_ops, rdev);
+
+ if (!rdev->rfkill) {
+- kfree(rdev);
++ wiphy_free(&rdev->wiphy);
+ return NULL;
+ }
+
+@@ -1335,8 +1335,12 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
+ }
+ break;
+ case NETDEV_PRE_UP:
+- if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
++ if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)) &&
++ !(wdev->iftype == NL80211_IFTYPE_AP_VLAN &&
++ rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP &&
++ wdev->use_4addr))
+ return notifier_from_errno(-EOPNOTSUPP);
++
+ if (rfkill_blocked(rdev->rfkill))
+ return notifier_from_errno(-ERFKILL);
+ break;
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index c6711ead5e59..8e2f03ab4cc9 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3191,8 +3191,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
+ return -EINVAL;
+ }
+
+- if (!rdev->ops->add_virtual_intf ||
+- !(rdev->wiphy.interface_modes & (1 << type)))
++ if (!rdev->ops->add_virtual_intf)
+ return -EOPNOTSUPP;
+
+ if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
+@@ -3211,6 +3210,11 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
+ return err;
+ }
+
++ if (!(rdev->wiphy.interface_modes & (1 << type)) &&
++ !(type == NL80211_IFTYPE_AP_VLAN && params.use_4addr &&
++ rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP))
++ return -EOPNOTSUPP;
++
+ err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
+ if (err < 0)
+ return err;
+@@ -4607,8 +4611,10 @@ static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
+ struct nlattr *sinfoattr, *bss_param;
+
+ hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
+- if (!hdr)
++ if (!hdr) {
++ cfg80211_sinfo_release_content(sinfo);
+ return -1;
++ }
+
+ if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+ nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
+diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl
+index 34414c6efad6..a2c9e7f98e06 100755
+--- a/scripts/checkstack.pl
++++ b/scripts/checkstack.pl
+@@ -46,7 +46,7 @@ my (@stack, $re, $dre, $x, $xs, $funcre);
+ $x = "[0-9a-f]"; # hex character
+ $xs = "[0-9a-f ]"; # hex character or space
+ $funcre = qr/^$x* <(.*)>:$/;
+- if ($arch eq 'aarch64') {
++ if ($arch =~ '^(aarch|arm)64$') {
+ #ffffffc0006325cc: a9bb7bfd stp x29, x30, [sp, #-80]!
+ $re = qr/^.*stp.*sp, \#-([0-9]{1,8})\]\!/o;
+ } elsif ($arch eq 'arm') {
+diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
+index ab64c6b5db5a..28c098fb6208 100644
+--- a/security/apparmor/include/policy.h
++++ b/security/apparmor/include/policy.h
+@@ -214,7 +214,16 @@ static inline struct aa_profile *aa_get_newest_profile(struct aa_profile *p)
+ return labels_profile(aa_get_newest_label(&p->label));
+ }
+
+-#define PROFILE_MEDIATES(P, T) ((P)->policy.start[(unsigned char) (T)])
++static inline unsigned int PROFILE_MEDIATES(struct aa_profile *profile,
++ unsigned char class)
++{
++ if (class <= AA_CLASS_LAST)
++ return profile->policy.start[class];
++ else
++ return aa_dfa_match_len(profile->policy.dfa,
++ profile->policy.start[0], &class, 1);
++}
++
+ static inline unsigned int PROFILE_MEDIATES_AF(struct aa_profile *profile,
+ u16 AF) {
+ unsigned int state = PROFILE_MEDIATES(profile, AA_CLASS_NET);
+diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
+index 21cb384d712a..088ea2ac8570 100644
+--- a/security/apparmor/policy_unpack.c
++++ b/security/apparmor/policy_unpack.c
+@@ -276,7 +276,7 @@ static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
+ char *tag = NULL;
+ size_t size = unpack_u16_chunk(e, &tag);
+ /* if a name is specified it must match. otherwise skip tag */
+- if (name && (!size || strcmp(name, tag)))
++ if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag)))
+ goto fail;
+ } else if (name) {
+ /* if a name is specified and there is no name tag fail */
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 02a47e365e52..ecf5fc77f50b 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -839,7 +839,7 @@ static int add_switch_table(struct objtool_file *file, struct instruction *insn,
+ struct symbol *pfunc = insn->func->pfunc;
+ unsigned int prev_offset = 0;
+
+- list_for_each_entry_from(rela, &file->rodata->rela->rela_list, list) {
++ list_for_each_entry_from(rela, &table->rela_sec->rela_list, list) {
+ if (rela == next_table)
+ break;
+
+@@ -929,6 +929,7 @@ static struct rela *find_switch_table(struct objtool_file *file,
+ {
+ struct rela *text_rela, *rodata_rela;
+ struct instruction *orig_insn = insn;
++ struct section *rodata_sec;
+ unsigned long table_offset;
+
+ /*
+@@ -956,10 +957,13 @@ static struct rela *find_switch_table(struct objtool_file *file,
+ /* look for a relocation which references .rodata */
+ text_rela = find_rela_by_dest_range(insn->sec, insn->offset,
+ insn->len);
+- if (!text_rela || text_rela->sym != file->rodata->sym)
++ if (!text_rela || text_rela->sym->type != STT_SECTION ||
++ !text_rela->sym->sec->rodata)
+ continue;
+
+ table_offset = text_rela->addend;
++ rodata_sec = text_rela->sym->sec;
++
+ if (text_rela->type == R_X86_64_PC32)
+ table_offset += 4;
+
+@@ -967,10 +971,10 @@ static struct rela *find_switch_table(struct objtool_file *file,
+ * Make sure the .rodata address isn't associated with a
+ * symbol. gcc jump tables are anonymous data.
+ */
+- if (find_symbol_containing(file->rodata, table_offset))
++ if (find_symbol_containing(rodata_sec, table_offset))
+ continue;
+
+- rodata_rela = find_rela_by_dest(file->rodata, table_offset);
++ rodata_rela = find_rela_by_dest(rodata_sec, table_offset);
+ if (rodata_rela) {
+ /*
+ * Use of RIP-relative switch jumps is quite rare, and
+@@ -1055,7 +1059,7 @@ static int add_switch_table_alts(struct objtool_file *file)
+ struct symbol *func;
+ int ret;
+
+- if (!file->rodata || !file->rodata->rela)
++ if (!file->rodata)
+ return 0;
+
+ for_each_sec(file, sec) {
+@@ -1201,10 +1205,33 @@ static int read_retpoline_hints(struct objtool_file *file)
+ return 0;
+ }
+
++static void mark_rodata(struct objtool_file *file)
++{
++ struct section *sec;
++ bool found = false;
++
++ /*
++ * This searches for the .rodata section or multiple .rodata.func_name
++ * sections if -fdata-sections is being used. The .str.1.1 and .str.1.8
++ * rodata sections are ignored as they don't contain jump tables.
++ */
++ for_each_sec(file, sec) {
++ if (!strncmp(sec->name, ".rodata", 7) &&
++ !strstr(sec->name, ".str1.")) {
++ sec->rodata = true;
++ found = true;
++ }
++ }
++
++ file->rodata = found;
++}
++
+ static int decode_sections(struct objtool_file *file)
+ {
+ int ret;
+
++ mark_rodata(file);
++
+ ret = decode_instructions(file);
+ if (ret)
+ return ret;
+@@ -2176,7 +2203,6 @@ int check(const char *_objname, bool orc)
+ INIT_LIST_HEAD(&file.insn_list);
+ hash_init(file.insn_hash);
+ file.whitelist = find_section_by_name(file.elf, ".discard.func_stack_frame_non_standard");
+- file.rodata = find_section_by_name(file.elf, ".rodata");
+ file.c_file = find_section_by_name(file.elf, ".comment");
+ file.ignore_unreachables = no_unreachable;
+ file.hints = false;
+diff --git a/tools/objtool/check.h b/tools/objtool/check.h
+index 95700a2bcb7c..e6e8a655b556 100644
+--- a/tools/objtool/check.h
++++ b/tools/objtool/check.h
+@@ -60,8 +60,8 @@ struct objtool_file {
+ struct elf *elf;
+ struct list_head insn_list;
+ DECLARE_HASHTABLE(insn_hash, 16);
+- struct section *rodata, *whitelist;
+- bool ignore_unreachables, c_file, hints;
++ struct section *whitelist;
++ bool ignore_unreachables, c_file, hints, rodata;
+ };
+
+ int check(const char *objname, bool orc);
+diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
+index b75d004f6482..abed594a9653 100644
+--- a/tools/objtool/elf.c
++++ b/tools/objtool/elf.c
+@@ -390,6 +390,7 @@ static int read_relas(struct elf *elf)
+ rela->offset = rela->rela.r_offset;
+ symndx = GELF_R_SYM(rela->rela.r_info);
+ rela->sym = find_symbol_by_index(elf, symndx);
++ rela->rela_sec = sec;
+ if (!rela->sym) {
+ WARN("can't find rela entry symbol %d for %s",
+ symndx, sec->name);
+diff --git a/tools/objtool/elf.h b/tools/objtool/elf.h
+index de5cd2ddded9..bc97ed86b9cd 100644
+--- a/tools/objtool/elf.h
++++ b/tools/objtool/elf.h
+@@ -48,7 +48,7 @@ struct section {
+ char *name;
+ int idx;
+ unsigned int len;
+- bool changed, text;
++ bool changed, text, rodata;
+ };
+
+ struct symbol {
+@@ -68,6 +68,7 @@ struct rela {
+ struct list_head list;
+ struct hlist_node hash;
+ GElf_Rela rela;
++ struct section *rela_sec;
+ struct symbol *sym;
+ unsigned int type;
+ unsigned long offset;
+diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c
+index be59f9c34ea2..79053a4f4783 100644
+--- a/tools/testing/selftests/cgroup/test_core.c
++++ b/tools/testing/selftests/cgroup/test_core.c
+@@ -198,7 +198,7 @@ static int test_cgcore_no_internal_process_constraint_on_threads(const char *roo
+ char *parent = NULL, *child = NULL;
+
+ if (cg_read_strstr(root, "cgroup.controllers", "cpu") ||
+- cg_read_strstr(root, "cgroup.subtree_control", "cpu")) {
++ cg_write(root, "cgroup.subtree_control", "+cpu")) {
+ ret = KSFT_SKIP;
+ goto cleanup;
+ }
+@@ -376,6 +376,11 @@ int main(int argc, char *argv[])
+
+ if (cg_find_unified_root(root, sizeof(root)))
+ ksft_exit_skip("cgroup v2 isn't mounted\n");
++
++ if (cg_read_strstr(root, "cgroup.subtree_control", "memory"))
++ if (cg_write(root, "cgroup.subtree_control", "+memory"))
++ ksft_exit_skip("Failed to set memory controller\n");
++
+ for (i = 0; i < ARRAY_SIZE(tests); i++) {
+ switch (tests[i].fn(root)) {
+ case KSFT_PASS:
+diff --git a/tools/testing/selftests/cgroup/test_memcontrol.c b/tools/testing/selftests/cgroup/test_memcontrol.c
+index 6f339882a6ca..c19a97dd02d4 100644
+--- a/tools/testing/selftests/cgroup/test_memcontrol.c
++++ b/tools/testing/selftests/cgroup/test_memcontrol.c
+@@ -1205,6 +1205,10 @@ int main(int argc, char **argv)
+ if (cg_read_strstr(root, "cgroup.controllers", "memory"))
+ ksft_exit_skip("memory controller isn't available\n");
+
++ if (cg_read_strstr(root, "cgroup.subtree_control", "memory"))
++ if (cg_write(root, "cgroup.subtree_control", "+memory"))
++ ksft_exit_skip("Failed to set memory controller\n");
++
+ for (i = 0; i < ARRAY_SIZE(tests); i++) {
+ switch (tests[i].fn(root)) {
+ case KSFT_PASS:
+diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
+index dc68340a6a96..2cf3dc49bd03 100644
+--- a/tools/testing/selftests/vm/Makefile
++++ b/tools/testing/selftests/vm/Makefile
+@@ -24,6 +24,8 @@ TEST_GEN_FILES += virtual_address_range
+
+ TEST_PROGS := run_vmtests
+
++TEST_FILES := test_vmalloc.sh
++
+ KSFT_KHDR_INSTALL := 1
+ include ../lib.mk
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-07-03 11:34 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-07-03 11:34 UTC (permalink / raw
To: gentoo-commits
commit: e44e80b9d1be4c727178c01526c2117350e3f347
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 3 11:34:05 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 3 11:34:05 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e44e80b9
Linux patch 4.19.57
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1056_linux-4.19.57.patch | 4354 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4358 insertions(+)
diff --git a/0000_README b/0000_README
index 9ed63b1..82a9cde 100644
--- a/0000_README
+++ b/0000_README
@@ -267,6 +267,10 @@ Patch: 1055_linux-4.19.56.patch
From: https://www.kernel.org
Desc: Linux 4.19.56
+Patch: 1056_linux-4.19.57.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.57
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1056_linux-4.19.57.patch b/1056_linux-4.19.57.patch
new file mode 100644
index 0000000..f0cee7d
--- /dev/null
+++ b/1056_linux-4.19.57.patch
@@ -0,0 +1,4354 @@
+diff --git a/Documentation/robust-futexes.txt b/Documentation/robust-futexes.txt
+index 6c42c75103eb..6361fb01c9c1 100644
+--- a/Documentation/robust-futexes.txt
++++ b/Documentation/robust-futexes.txt
+@@ -218,5 +218,4 @@ All other architectures should build just fine too - but they won't have
+ the new syscalls yet.
+
+ Architectures need to implement the new futex_atomic_cmpxchg_inatomic()
+-inline function before writing up the syscalls (that function returns
+--ENOSYS right now).
++inline function before writing up the syscalls.
+diff --git a/Makefile b/Makefile
+index a76c61f77bcd..5412d556b561 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 56
++SUBLEVEL = 57
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
+index c12ff63265a9..5d8787f0ca5f 100644
+--- a/arch/arm64/Makefile
++++ b/arch/arm64/Makefile
+@@ -51,7 +51,7 @@ endif
+
+ KBUILD_CFLAGS += -mgeneral-regs-only $(lseinstr) $(brokengasinst)
+ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
+-KBUILD_CFLAGS += -Wno-psabi
++KBUILD_CFLAGS += $(call cc-disable-warning, psabi)
+ KBUILD_AFLAGS += $(lseinstr) $(brokengasinst)
+
+ KBUILD_CFLAGS += $(call cc-option,-mabi=lp64)
+diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
+index c7e30a6ed56e..232917e9c1d9 100644
+--- a/arch/arm64/include/asm/futex.h
++++ b/arch/arm64/include/asm/futex.h
+@@ -134,7 +134,9 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *_uaddr,
+ : "memory");
+ uaccess_disable();
+
+- *uval = val;
++ if (!ret)
++ *uval = val;
++
+ return ret;
+ }
+
+diff --git a/arch/arm64/include/asm/insn.h b/arch/arm64/include/asm/insn.h
+index c6802dea6cab..310e47d54d81 100644
+--- a/arch/arm64/include/asm/insn.h
++++ b/arch/arm64/include/asm/insn.h
+@@ -272,6 +272,7 @@ __AARCH64_INSN_FUNCS(adrp, 0x9F000000, 0x90000000)
+ __AARCH64_INSN_FUNCS(prfm, 0x3FC00000, 0x39800000)
+ __AARCH64_INSN_FUNCS(prfm_lit, 0xFF000000, 0xD8000000)
+ __AARCH64_INSN_FUNCS(str_reg, 0x3FE0EC00, 0x38206800)
++__AARCH64_INSN_FUNCS(ldadd, 0x3F20FC00, 0x38200000)
+ __AARCH64_INSN_FUNCS(ldr_reg, 0x3FE0EC00, 0x38606800)
+ __AARCH64_INSN_FUNCS(ldr_lit, 0xBF000000, 0x18000000)
+ __AARCH64_INSN_FUNCS(ldrsw_lit, 0xFF000000, 0x98000000)
+@@ -389,6 +390,13 @@ u32 aarch64_insn_gen_load_store_ex(enum aarch64_insn_register reg,
+ enum aarch64_insn_register state,
+ enum aarch64_insn_size_type size,
+ enum aarch64_insn_ldst_type type);
++u32 aarch64_insn_gen_ldadd(enum aarch64_insn_register result,
++ enum aarch64_insn_register address,
++ enum aarch64_insn_register value,
++ enum aarch64_insn_size_type size);
++u32 aarch64_insn_gen_stadd(enum aarch64_insn_register address,
++ enum aarch64_insn_register value,
++ enum aarch64_insn_size_type size);
+ u32 aarch64_insn_gen_add_sub_imm(enum aarch64_insn_register dst,
+ enum aarch64_insn_register src,
+ int imm, enum aarch64_insn_variant variant,
+diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
+index 2b3413549734..3e6229e30109 100644
+--- a/arch/arm64/kernel/insn.c
++++ b/arch/arm64/kernel/insn.c
+@@ -734,6 +734,46 @@ u32 aarch64_insn_gen_load_store_ex(enum aarch64_insn_register reg,
+ state);
+ }
+
++u32 aarch64_insn_gen_ldadd(enum aarch64_insn_register result,
++ enum aarch64_insn_register address,
++ enum aarch64_insn_register value,
++ enum aarch64_insn_size_type size)
++{
++ u32 insn = aarch64_insn_get_ldadd_value();
++
++ switch (size) {
++ case AARCH64_INSN_SIZE_32:
++ case AARCH64_INSN_SIZE_64:
++ break;
++ default:
++ pr_err("%s: unimplemented size encoding %d\n", __func__, size);
++ return AARCH64_BREAK_FAULT;
++ }
++
++ insn = aarch64_insn_encode_ldst_size(size, insn);
++
++ insn = aarch64_insn_encode_register(AARCH64_INSN_REGTYPE_RT, insn,
++ result);
++
++ insn = aarch64_insn_encode_register(AARCH64_INSN_REGTYPE_RN, insn,
++ address);
++
++ return aarch64_insn_encode_register(AARCH64_INSN_REGTYPE_RS, insn,
++ value);
++}
++
++u32 aarch64_insn_gen_stadd(enum aarch64_insn_register address,
++ enum aarch64_insn_register value,
++ enum aarch64_insn_size_type size)
++{
++ /*
++ * STADD is simply encoded as an alias for LDADD with XZR as
++ * the destination register.
++ */
++ return aarch64_insn_gen_ldadd(AARCH64_INSN_REG_ZR, address,
++ value, size);
++}
++
+ static u32 aarch64_insn_encode_prfm_imm(enum aarch64_insn_prfm_type type,
+ enum aarch64_insn_prfm_target target,
+ enum aarch64_insn_prfm_policy policy,
+diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h
+index 6c881659ee8a..76606e87233f 100644
+--- a/arch/arm64/net/bpf_jit.h
++++ b/arch/arm64/net/bpf_jit.h
+@@ -100,6 +100,10 @@
+ #define A64_STXR(sf, Rt, Rn, Rs) \
+ A64_LSX(sf, Rt, Rn, Rs, STORE_EX)
+
++/* LSE atomics */
++#define A64_STADD(sf, Rn, Rs) \
++ aarch64_insn_gen_stadd(Rn, Rs, A64_SIZE(sf))
++
+ /* Add/subtract (immediate) */
+ #define A64_ADDSUB_IMM(sf, Rd, Rn, imm12, type) \
+ aarch64_insn_gen_add_sub_imm(Rd, Rn, imm12, \
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 2eef156b38bb..7f0258ed1f5f 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -364,7 +364,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const int i = insn - ctx->prog->insnsi;
+ const bool is64 = BPF_CLASS(code) == BPF_ALU64;
+ const bool isdw = BPF_SIZE(code) == BPF_DW;
+- u8 jmp_cond;
++ u8 jmp_cond, reg;
+ s32 jmp_offset;
+
+ #define check_imm(bits, imm) do { \
+@@ -730,18 +730,28 @@ emit_cond_jmp:
+ break;
+ }
+ break;
++
+ /* STX XADD: lock *(u32 *)(dst + off) += src */
+ case BPF_STX | BPF_XADD | BPF_W:
+ /* STX XADD: lock *(u64 *)(dst + off) += src */
+ case BPF_STX | BPF_XADD | BPF_DW:
+- emit_a64_mov_i(1, tmp, off, ctx);
+- emit(A64_ADD(1, tmp, tmp, dst), ctx);
+- emit(A64_LDXR(isdw, tmp2, tmp), ctx);
+- emit(A64_ADD(isdw, tmp2, tmp2, src), ctx);
+- emit(A64_STXR(isdw, tmp2, tmp, tmp3), ctx);
+- jmp_offset = -3;
+- check_imm19(jmp_offset);
+- emit(A64_CBNZ(0, tmp3, jmp_offset), ctx);
++ if (!off) {
++ reg = dst;
++ } else {
++ emit_a64_mov_i(1, tmp, off, ctx);
++ emit(A64_ADD(1, tmp, tmp, dst), ctx);
++ reg = tmp;
++ }
++ if (cpus_have_cap(ARM64_HAS_LSE_ATOMICS)) {
++ emit(A64_STADD(isdw, reg, src), ctx);
++ } else {
++ emit(A64_LDXR(isdw, tmp2, reg), ctx);
++ emit(A64_ADD(isdw, tmp2, tmp2, src), ctx);
++ emit(A64_STXR(isdw, tmp2, reg, tmp3), ctx);
++ jmp_offset = -3;
++ check_imm19(jmp_offset);
++ emit(A64_CBNZ(0, tmp3, jmp_offset), ctx);
++ }
+ break;
+
+ default:
+diff --git a/arch/mips/include/asm/mips-gic.h b/arch/mips/include/asm/mips-gic.h
+index 558059a8f218..0277b56157af 100644
+--- a/arch/mips/include/asm/mips-gic.h
++++ b/arch/mips/include/asm/mips-gic.h
+@@ -314,6 +314,36 @@ static inline bool mips_gic_present(void)
+ return IS_ENABLED(CONFIG_MIPS_GIC) && mips_gic_base;
+ }
+
++/**
++ * mips_gic_vx_map_reg() - Return GIC_Vx_<intr>_MAP register offset
++ * @intr: A GIC local interrupt
++ *
++ * Determine the index of the GIC_VL_<intr>_MAP or GIC_VO_<intr>_MAP register
++ * within the block of GIC map registers. This is almost the same as the order
++ * of interrupts in the pending & mask registers, as used by enum
++ * mips_gic_local_interrupt, but moves the FDC interrupt & thus offsets the
++ * interrupts after it...
++ *
++ * Return: The map register index corresponding to @intr.
++ *
++ * The return value is suitable for use with the (read|write)_gic_v[lo]_map
++ * accessor functions.
++ */
++static inline unsigned int
++mips_gic_vx_map_reg(enum mips_gic_local_interrupt intr)
++{
++ /* WD, Compare & Timer are 1:1 */
++ if (intr <= GIC_LOCAL_INT_TIMER)
++ return intr;
++
++ /* FDC moves to after Timer... */
++ if (intr == GIC_LOCAL_INT_FDC)
++ return GIC_LOCAL_INT_TIMER + 1;
++
++ /* As a result everything else is offset by 1 */
++ return intr + 1;
++}
++
+ /**
+ * gic_get_c0_compare_int() - Return cp0 count/compare interrupt virq
+ *
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 9b096f26d1c8..a5cde748cf76 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -820,6 +820,16 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void)
+ break;
+ }
+
++ /*
++ * If SSBD is controlled by the SPEC_CTRL MSR, then set the proper
++ * bit in the mask to allow guests to use the mitigation even in the
++ * case where the host does not enable it.
++ */
++ if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
++ static_cpu_has(X86_FEATURE_AMD_SSBD)) {
++ x86_spec_ctrl_mask |= SPEC_CTRL_SSBD;
++ }
++
+ /*
+ * We have three CPU feature flags that are in play here:
+ * - X86_BUG_SPEC_STORE_BYPASS - CPU is susceptible.
+@@ -837,7 +847,6 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void)
+ x86_amd_ssb_disable();
+ } else {
+ x86_spec_ctrl_base |= SPEC_CTRL_SSBD;
+- x86_spec_ctrl_mask |= SPEC_CTRL_SSBD;
+ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+ }
+ }
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index 274d220d0a83..2013699a5c54 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -792,8 +792,12 @@ static int rdt_bit_usage_show(struct kernfs_open_file *of,
+ struct seq_file *seq, void *v)
+ {
+ struct rdt_resource *r = of->kn->parent->priv;
+- u32 sw_shareable = 0, hw_shareable = 0;
+- u32 exclusive = 0, pseudo_locked = 0;
++ /*
++ * Use unsigned long even though only 32 bits are used to ensure
++ * test_bit() is used safely.
++ */
++ unsigned long sw_shareable = 0, hw_shareable = 0;
++ unsigned long exclusive = 0, pseudo_locked = 0;
+ struct rdt_domain *dom;
+ int i, hwb, swb, excl, psl;
+ enum rdtgrp_mode mode;
+@@ -838,10 +842,10 @@ static int rdt_bit_usage_show(struct kernfs_open_file *of,
+ }
+ for (i = r->cache.cbm_len - 1; i >= 0; i--) {
+ pseudo_locked = dom->plr ? dom->plr->cbm : 0;
+- hwb = test_bit(i, (unsigned long *)&hw_shareable);
+- swb = test_bit(i, (unsigned long *)&sw_shareable);
+- excl = test_bit(i, (unsigned long *)&exclusive);
+- psl = test_bit(i, (unsigned long *)&pseudo_locked);
++ hwb = test_bit(i, &hw_shareable);
++ swb = test_bit(i, &sw_shareable);
++ excl = test_bit(i, &exclusive);
++ psl = test_bit(i, &pseudo_locked);
+ if (hwb && swb)
+ seq_putc(seq, 'X');
+ else if (hwb && !swb)
+@@ -2320,26 +2324,19 @@ out_destroy:
+ */
+ static void cbm_ensure_valid(u32 *_val, struct rdt_resource *r)
+ {
+- /*
+- * Convert the u32 _val to an unsigned long required by all the bit
+- * operations within this function. No more than 32 bits of this
+- * converted value can be accessed because all bit operations are
+- * additionally provided with cbm_len that is initialized during
+- * hardware enumeration using five bits from the EAX register and
+- * thus never can exceed 32 bits.
+- */
+- unsigned long *val = (unsigned long *)_val;
++ unsigned long val = *_val;
+ unsigned int cbm_len = r->cache.cbm_len;
+ unsigned long first_bit, zero_bit;
+
+- if (*val == 0)
++ if (val == 0)
+ return;
+
+- first_bit = find_first_bit(val, cbm_len);
+- zero_bit = find_next_zero_bit(val, cbm_len, first_bit);
++ first_bit = find_first_bit(&val, cbm_len);
++ zero_bit = find_next_zero_bit(&val, cbm_len, first_bit);
+
+ /* Clear any remaining bits to ensure contiguous region */
+- bitmap_clear(val, zero_bit, cbm_len - zero_bit);
++ bitmap_clear(&val, zero_bit, cbm_len - zero_bit);
++ *_val = (u32)val;
+ }
+
+ /**
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index b7027e667604..a96091d44a45 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -790,13 +790,16 @@ static struct syscore_ops mc_syscore_ops = {
+ .resume = mc_bp_resume,
+ };
+
+-static int mc_cpu_online(unsigned int cpu)
++static int mc_cpu_starting(unsigned int cpu)
+ {
+- struct device *dev;
+-
+- dev = get_cpu_device(cpu);
+ microcode_update_cpu(cpu);
+ pr_debug("CPU%d added\n", cpu);
++ return 0;
++}
++
++static int mc_cpu_online(unsigned int cpu)
++{
++ struct device *dev = get_cpu_device(cpu);
+
+ if (sysfs_create_group(&dev->kobj, &mc_attr_group))
+ pr_err("Failed to create group for CPU%d\n", cpu);
+@@ -873,7 +876,9 @@ int __init microcode_init(void)
+ goto out_ucode_group;
+
+ register_syscore_ops(&mc_syscore_ops);
+- cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:online",
++ cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:starting",
++ mc_cpu_starting, NULL);
++ cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, "x86/microcode:online",
+ mc_cpu_online, mc_cpu_down_prep);
+
+ pr_info("Microcode Update Driver: v%s.", DRIVER_VERSION);
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 779ed52047d1..e0f982e35c96 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -5386,7 +5386,16 @@ static int alloc_mmu_pages(struct kvm_vcpu *vcpu)
+ struct page *page;
+ int i;
+
+- if (tdp_enabled)
++ /*
++ * When using PAE paging, the four PDPTEs are treated as 'root' pages,
++ * while the PDP table is a per-vCPU construct that's allocated at MMU
++ * creation. When emulating 32-bit mode, cr3 is only 32 bits even on
++ * x86_64. Therefore we need to allocate the PDP table in the first
++ * 4GB of memory, which happens to fit the DMA32 zone. Except for
++ * SVM's 32-bit NPT support, TDP paging doesn't use PAE paging and can
++ * skip allocating the PDP table.
++ */
++ if (tdp_enabled && kvm_x86_ops->get_tdp_level(vcpu) > PT32E_ROOT_LEVEL)
+ return 0;
+
+ /*
+diff --git a/drivers/clk/socfpga/clk-s10.c b/drivers/clk/socfpga/clk-s10.c
+index 8281dfbf38c2..5bed36e12951 100644
+--- a/drivers/clk/socfpga/clk-s10.c
++++ b/drivers/clk/socfpga/clk-s10.c
+@@ -103,9 +103,9 @@ static const struct stratix10_perip_cnt_clock s10_main_perip_cnt_clks[] = {
+ { STRATIX10_NOC_CLK, "noc_clk", NULL, noc_mux, ARRAY_SIZE(noc_mux),
+ 0, 0, 0, 0x3C, 1},
+ { STRATIX10_EMAC_A_FREE_CLK, "emaca_free_clk", NULL, emaca_free_mux, ARRAY_SIZE(emaca_free_mux),
+- 0, 0, 4, 0xB0, 0},
++ 0, 0, 2, 0xB0, 0},
+ { STRATIX10_EMAC_B_FREE_CLK, "emacb_free_clk", NULL, emacb_free_mux, ARRAY_SIZE(emacb_free_mux),
+- 0, 0, 4, 0xB0, 1},
++ 0, 0, 2, 0xB0, 1},
+ { STRATIX10_EMAC_PTP_FREE_CLK, "emac_ptp_free_clk", NULL, emac_ptp_free_mux,
+ ARRAY_SIZE(emac_ptp_free_mux), 0, 0, 4, 0xB0, 2},
+ { STRATIX10_GPIO_DB_FREE_CLK, "gpio_db_free_clk", NULL, gpio_db_free_mux,
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index 46b855a42884..9e5f70e7122a 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -716,22 +716,22 @@ int rdma_addr_find_l2_eth_by_grh(const union ib_gid *sgid,
+ struct rdma_dev_addr dev_addr;
+ struct resolve_cb_context ctx;
+ union {
+- struct sockaddr _sockaddr;
+ struct sockaddr_in _sockaddr_in;
+ struct sockaddr_in6 _sockaddr_in6;
+ } sgid_addr, dgid_addr;
+ int ret;
+
+- rdma_gid2ip(&sgid_addr._sockaddr, sgid);
+- rdma_gid2ip(&dgid_addr._sockaddr, dgid);
++ rdma_gid2ip((struct sockaddr *)&sgid_addr, sgid);
++ rdma_gid2ip((struct sockaddr *)&dgid_addr, dgid);
+
+ memset(&dev_addr, 0, sizeof(dev_addr));
+ dev_addr.bound_dev_if = ndev->ifindex;
+ dev_addr.net = &init_net;
+
+ init_completion(&ctx.comp);
+- ret = rdma_resolve_ip(&sgid_addr._sockaddr, &dgid_addr._sockaddr,
+- &dev_addr, 1000, resolve_cb, &ctx);
++ ret = rdma_resolve_ip((struct sockaddr *)&sgid_addr,
++ (struct sockaddr *)&dgid_addr, &dev_addr, 1000,
++ resolve_cb, &ctx);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index 51831bfbf90f..cbff746d9e9d 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -132,25 +132,22 @@ static int defer_packet_queue(
+ struct hfi1_user_sdma_pkt_q *pq =
+ container_of(wait, struct hfi1_user_sdma_pkt_q, busy);
+ struct hfi1_ibdev *dev = &pq->dd->verbs_dev;
+- struct user_sdma_txreq *tx =
+- container_of(txreq, struct user_sdma_txreq, txreq);
+
+- if (sdma_progress(sde, seq, txreq)) {
+- if (tx->busycount++ < MAX_DEFER_RETRY_COUNT)
+- goto eagain;
+- }
++ write_seqlock(&dev->iowait_lock);
++ if (sdma_progress(sde, seq, txreq))
++ goto eagain;
+ /*
+ * We are assuming that if the list is enqueued somewhere, it
+ * is to the dmawait list since that is the only place where
+ * it is supposed to be enqueued.
+ */
+ xchg(&pq->state, SDMA_PKT_Q_DEFERRED);
+- write_seqlock(&dev->iowait_lock);
+ if (list_empty(&pq->busy.list))
+ iowait_queue(pkts_sent, &pq->busy, &sde->dmawait);
+ write_sequnlock(&dev->iowait_lock);
+ return -EBUSY;
+ eagain:
++ write_sequnlock(&dev->iowait_lock);
+ return -EAGAIN;
+ }
+
+@@ -803,7 +800,6 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, unsigned maxpkts)
+
+ tx->flags = 0;
+ tx->req = req;
+- tx->busycount = 0;
+ INIT_LIST_HEAD(&tx->list);
+
+ /*
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h
+index 91c343f91776..2c056702d975 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.h
++++ b/drivers/infiniband/hw/hfi1/user_sdma.h
+@@ -245,7 +245,6 @@ struct user_sdma_txreq {
+ struct list_head list;
+ struct user_sdma_request *req;
+ u16 flags;
+- unsigned int busycount;
+ u64 seqnum;
+ };
+
+diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
+index 58188fe5aed2..32aaa4ef481c 100644
+--- a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
++++ b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
+@@ -83,7 +83,6 @@ static inline int set_av_attr(struct ocrdma_dev *dev, struct ocrdma_ah *ah,
+ struct iphdr ipv4;
+ const struct ib_global_route *ib_grh;
+ union {
+- struct sockaddr _sockaddr;
+ struct sockaddr_in _sockaddr_in;
+ struct sockaddr_in6 _sockaddr_in6;
+ } sgid_addr, dgid_addr;
+@@ -133,9 +132,9 @@ static inline int set_av_attr(struct ocrdma_dev *dev, struct ocrdma_ah *ah,
+ ipv4.tot_len = htons(0);
+ ipv4.ttl = ib_grh->hop_limit;
+ ipv4.protocol = nxthdr;
+- rdma_gid2ip(&sgid_addr._sockaddr, sgid);
++ rdma_gid2ip((struct sockaddr *)&sgid_addr, sgid);
+ ipv4.saddr = sgid_addr._sockaddr_in.sin_addr.s_addr;
+- rdma_gid2ip(&dgid_addr._sockaddr, &ib_grh->dgid);
++ rdma_gid2ip((struct sockaddr*)&dgid_addr, &ib_grh->dgid);
+ ipv4.daddr = dgid_addr._sockaddr_in.sin_addr.s_addr;
+ memcpy((u8 *)ah->av + eth_sz, &ipv4, sizeof(struct iphdr));
+ } else {
+diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+index e578281471af..28181f01734c 100644
+--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
++++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+@@ -2499,7 +2499,6 @@ static int ocrdma_set_av_params(struct ocrdma_qp *qp,
+ u32 vlan_id = 0xFFFF;
+ u8 mac_addr[6], hdr_type;
+ union {
+- struct sockaddr _sockaddr;
+ struct sockaddr_in _sockaddr_in;
+ struct sockaddr_in6 _sockaddr_in6;
+ } sgid_addr, dgid_addr;
+@@ -2541,8 +2540,8 @@ static int ocrdma_set_av_params(struct ocrdma_qp *qp,
+
+ hdr_type = rdma_gid_attr_network_type(sgid_attr);
+ if (hdr_type == RDMA_NETWORK_IPV4) {
+- rdma_gid2ip(&sgid_addr._sockaddr, &sgid_attr->gid);
+- rdma_gid2ip(&dgid_addr._sockaddr, &grh->dgid);
++ rdma_gid2ip((struct sockaddr *)&sgid_addr, &sgid_attr->gid);
++ rdma_gid2ip((struct sockaddr *)&dgid_addr, &grh->dgid);
+ memcpy(&cmd->params.dgid[0],
+ &dgid_addr._sockaddr_in.sin_addr.s_addr, 4);
+ memcpy(&cmd->params.sgid[0],
+diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
+index d32268cc1174..f3985469c221 100644
+--- a/drivers/irqchip/irq-mips-gic.c
++++ b/drivers/irqchip/irq-mips-gic.c
+@@ -388,7 +388,7 @@ static void gic_all_vpes_irq_cpu_online(struct irq_data *d)
+ intr = GIC_HWIRQ_TO_LOCAL(d->hwirq);
+ cd = irq_data_get_irq_chip_data(d);
+
+- write_gic_vl_map(intr, cd->map);
++ write_gic_vl_map(mips_gic_vx_map_reg(intr), cd->map);
+ if (cd->mask)
+ write_gic_vl_smask(BIT(intr));
+ }
+@@ -517,7 +517,7 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
+ spin_lock_irqsave(&gic_lock, flags);
+ for_each_online_cpu(cpu) {
+ write_gic_vl_other(mips_cm_vp_id(cpu));
+- write_gic_vo_map(intr, map);
++ write_gic_vo_map(mips_gic_vx_map_reg(intr), map);
+ }
+ spin_unlock_irqrestore(&gic_lock, flags);
+
+diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c
+index 9ea2b0291f20..e549392e0ea5 100644
+--- a/drivers/md/dm-log-writes.c
++++ b/drivers/md/dm-log-writes.c
+@@ -60,6 +60,7 @@
+
+ #define WRITE_LOG_VERSION 1ULL
+ #define WRITE_LOG_MAGIC 0x6a736677736872ULL
++#define WRITE_LOG_SUPER_SECTOR 0
+
+ /*
+ * The disk format for this is braindead simple.
+@@ -115,6 +116,7 @@ struct log_writes_c {
+ struct list_head logging_blocks;
+ wait_queue_head_t wait;
+ struct task_struct *log_kthread;
++ struct completion super_done;
+ };
+
+ struct pending_block {
+@@ -180,6 +182,14 @@ static void log_end_io(struct bio *bio)
+ bio_put(bio);
+ }
+
++static void log_end_super(struct bio *bio)
++{
++ struct log_writes_c *lc = bio->bi_private;
++
++ complete(&lc->super_done);
++ log_end_io(bio);
++}
++
+ /*
+ * Meant to be called if there is an error, it will free all the pages
+ * associated with the block.
+@@ -215,7 +225,8 @@ static int write_metadata(struct log_writes_c *lc, void *entry,
+ bio->bi_iter.bi_size = 0;
+ bio->bi_iter.bi_sector = sector;
+ bio_set_dev(bio, lc->logdev->bdev);
+- bio->bi_end_io = log_end_io;
++ bio->bi_end_io = (sector == WRITE_LOG_SUPER_SECTOR) ?
++ log_end_super : log_end_io;
+ bio->bi_private = lc;
+ bio_set_op_attrs(bio, REQ_OP_WRITE, 0);
+
+@@ -418,11 +429,18 @@ static int log_super(struct log_writes_c *lc)
+ super.nr_entries = cpu_to_le64(lc->logged_entries);
+ super.sectorsize = cpu_to_le32(lc->sectorsize);
+
+- if (write_metadata(lc, &super, sizeof(super), NULL, 0, 0)) {
++ if (write_metadata(lc, &super, sizeof(super), NULL, 0,
++ WRITE_LOG_SUPER_SECTOR)) {
+ DMERR("Couldn't write super");
+ return -1;
+ }
+
++ /*
++ * Super sector should be writen in-order, otherwise the
++ * nr_entries could be rewritten incorrectly by an old bio.
++ */
++ wait_for_completion_io(&lc->super_done);
++
+ return 0;
+ }
+
+@@ -531,6 +549,7 @@ static int log_writes_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ INIT_LIST_HEAD(&lc->unflushed_blocks);
+ INIT_LIST_HEAD(&lc->logging_blocks);
+ init_waitqueue_head(&lc->wait);
++ init_completion(&lc->super_done);
+ atomic_set(&lc->io_blocks, 0);
+ atomic_set(&lc->pending_blocks, 0);
+
+diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
+index 94836fcbe721..ddfcf4ade7bf 100644
+--- a/drivers/misc/eeprom/at24.c
++++ b/drivers/misc/eeprom/at24.c
+@@ -106,23 +106,6 @@ static unsigned int at24_write_timeout = 25;
+ module_param_named(write_timeout, at24_write_timeout, uint, 0);
+ MODULE_PARM_DESC(at24_write_timeout, "Time (in ms) to try writes (default 25)");
+
+-/*
+- * Both reads and writes fail if the previous write didn't complete yet. This
+- * macro loops a few times waiting at least long enough for one entire page
+- * write to work while making sure that at least one iteration is run before
+- * checking the break condition.
+- *
+- * It takes two parameters: a variable in which the future timeout in jiffies
+- * will be stored and a temporary variable holding the time of the last
+- * iteration of processing the request. Both should be unsigned integers
+- * holding at least 32 bits.
+- */
+-#define at24_loop_until_timeout(tout, op_time) \
+- for (tout = jiffies + msecs_to_jiffies(at24_write_timeout), \
+- op_time = 0; \
+- op_time ? time_before(op_time, tout) : true; \
+- usleep_range(1000, 1500), op_time = jiffies)
+-
+ struct at24_chip_data {
+ /*
+ * these fields mirror their equivalents in
+@@ -311,13 +294,22 @@ static ssize_t at24_regmap_read(struct at24_data *at24, char *buf,
+ /* adjust offset for mac and serial read ops */
+ offset += at24->offset_adj;
+
+- at24_loop_until_timeout(timeout, read_time) {
++ timeout = jiffies + msecs_to_jiffies(at24_write_timeout);
++ do {
++ /*
++ * The timestamp shall be taken before the actual operation
++ * to avoid a premature timeout in case of high CPU load.
++ */
++ read_time = jiffies;
++
+ ret = regmap_bulk_read(regmap, offset, buf, count);
+ dev_dbg(&client->dev, "read %zu@%d --> %d (%ld)\n",
+ count, offset, ret, jiffies);
+ if (!ret)
+ return count;
+- }
++
++ usleep_range(1000, 1500);
++ } while (time_before(read_time, timeout));
+
+ return -ETIMEDOUT;
+ }
+@@ -361,14 +353,23 @@ static ssize_t at24_regmap_write(struct at24_data *at24, const char *buf,
+ regmap = at24_client->regmap;
+ client = at24_client->client;
+ count = at24_adjust_write_count(at24, offset, count);
++ timeout = jiffies + msecs_to_jiffies(at24_write_timeout);
++
++ do {
++ /*
++ * The timestamp shall be taken before the actual operation
++ * to avoid a premature timeout in case of high CPU load.
++ */
++ write_time = jiffies;
+
+- at24_loop_until_timeout(timeout, write_time) {
+ ret = regmap_bulk_write(regmap, offset, buf, count);
+ dev_dbg(&client->dev, "write %zu@%d --> %d (%ld)\n",
+ count, offset, ret, jiffies);
+ if (!ret)
+ return count;
+- }
++
++ usleep_range(1000, 1500);
++ } while (time_before(write_time, timeout));
+
+ return -ETIMEDOUT;
+ }
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 039beb5e0fa2..7e162fff01ab 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4307,12 +4307,12 @@ void bond_setup(struct net_device *bond_dev)
+ bond_dev->features |= NETIF_F_NETNS_LOCAL;
+
+ bond_dev->hw_features = BOND_VLAN_FEATURES |
+- NETIF_F_HW_VLAN_CTAG_TX |
+ NETIF_F_HW_VLAN_CTAG_RX |
+ NETIF_F_HW_VLAN_CTAG_FILTER;
+
+ bond_dev->hw_features |= NETIF_F_GSO_ENCAP_ALL | NETIF_F_GSO_UDP_L4;
+ bond_dev->features |= bond_dev->hw_features;
++ bond_dev->features |= NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX;
+ }
+
+ /* Destroy a bonding device.
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+index 8d9cc2157afd..7423262ce590 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+@@ -122,7 +122,7 @@ static int adjust_systime(void __iomem *ioaddr, u32 sec, u32 nsec,
+ * programmed with (2^32 – <new_sec_value>)
+ */
+ if (gmac4)
+- sec = (100000000ULL - sec);
++ sec = -sec;
+
+ value = readl(ioaddr + PTP_TCR);
+ if (value & PTP_TCR_TSCTRLSSR)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 45e64d71a93f..5c18874614ba 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -2938,12 +2938,15 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ /* Manage tx mitigation */
+ tx_q->tx_count_frames += nfrags + 1;
+- if (priv->tx_coal_frames <= tx_q->tx_count_frames) {
++ if (likely(priv->tx_coal_frames > tx_q->tx_count_frames) &&
++ !(priv->synopsys_id >= DWMAC_CORE_4_00 &&
++ (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
++ priv->hwts_tx_en)) {
++ stmmac_tx_timer_arm(priv, queue);
++ } else {
++ tx_q->tx_count_frames = 0;
+ stmmac_set_tx_ic(priv, desc);
+ priv->xstats.tx_set_ic_bit++;
+- tx_q->tx_count_frames = 0;
+- } else {
+- stmmac_tx_timer_arm(priv, queue);
+ }
+
+ skb_tx_timestamp(skb);
+@@ -3157,12 +3160,15 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
+ * element in case of no SG.
+ */
+ tx_q->tx_count_frames += nfrags + 1;
+- if (priv->tx_coal_frames <= tx_q->tx_count_frames) {
++ if (likely(priv->tx_coal_frames > tx_q->tx_count_frames) &&
++ !(priv->synopsys_id >= DWMAC_CORE_4_00 &&
++ (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
++ priv->hwts_tx_en)) {
++ stmmac_tx_timer_arm(priv, queue);
++ } else {
++ tx_q->tx_count_frames = 0;
+ stmmac_set_tx_ic(priv, desc);
+ priv->xstats.tx_set_ic_bit++;
+- tx_q->tx_count_frames = 0;
+- } else {
+- stmmac_tx_timer_arm(priv, queue);
+ }
+
+ skb_tx_timestamp(skb);
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 6c6230b44bcd..dc30f11f4766 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -2139,12 +2139,12 @@ static void team_setup(struct net_device *dev)
+ dev->features |= NETIF_F_NETNS_LOCAL;
+
+ dev->hw_features = TEAM_VLAN_FEATURES |
+- NETIF_F_HW_VLAN_CTAG_TX |
+ NETIF_F_HW_VLAN_CTAG_RX |
+ NETIF_F_HW_VLAN_CTAG_FILTER;
+
+ dev->hw_features |= NETIF_F_GSO_ENCAP_ALL | NETIF_F_GSO_UDP_L4;
+ dev->features |= dev->hw_features;
++ dev->features |= NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX;
+ }
+
+ static int team_newlink(struct net *src_net, struct net_device *dev,
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 78d34e0306e0..b67fee56ec81 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1024,18 +1024,8 @@ static void tun_net_uninit(struct net_device *dev)
+ /* Net device open. */
+ static int tun_net_open(struct net_device *dev)
+ {
+- struct tun_struct *tun = netdev_priv(dev);
+- int i;
+-
+ netif_tx_start_all_queues(dev);
+
+- for (i = 0; i < tun->numqueues; i++) {
+- struct tun_file *tfile;
+-
+- tfile = rtnl_dereference(tun->tfiles[i]);
+- tfile->socket.sk->sk_write_space(tfile->socket.sk);
+- }
+-
+ return 0;
+ }
+
+@@ -3443,6 +3433,7 @@ static int tun_device_event(struct notifier_block *unused,
+ {
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+ struct tun_struct *tun = netdev_priv(dev);
++ int i;
+
+ if (dev->rtnl_link_ops != &tun_link_ops)
+ return NOTIFY_DONE;
+@@ -3452,6 +3443,14 @@ static int tun_device_event(struct notifier_block *unused,
+ if (tun_queue_resize(tun))
+ return NOTIFY_BAD;
+ break;
++ case NETDEV_UP:
++ for (i = 0; i < tun->numqueues; i++) {
++ struct tun_file *tfile;
++
++ tfile = rtnl_dereference(tun->tfiles[i]);
++ tfile->socket.sk->sk_write_space(tfile->socket.sk);
++ }
++ break;
+ default:
+ break;
+ }
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index d9a6699abe59..e657d8947125 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1412,7 +1412,7 @@ static int qmi_wwan_probe(struct usb_interface *intf,
+ * different. Ignore the current interface if the number of endpoints
+ * equals the number for the diag interface (two).
+ */
+- info = (void *)&id->driver_info;
++ info = (void *)id->driver_info;
+
+ if (info->data & QMI_WWAN_QUIRK_QUECTEL_DYNCFG) {
+ if (desc->bNumEndpoints == 2)
+diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
+index 890b8aaf95e1..64eb8ffb2ddf 100644
+--- a/drivers/scsi/vmw_pvscsi.c
++++ b/drivers/scsi/vmw_pvscsi.c
+@@ -763,6 +763,7 @@ static int pvscsi_queue_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd
+ struct pvscsi_adapter *adapter = shost_priv(host);
+ struct pvscsi_ctx *ctx;
+ unsigned long flags;
++ unsigned char op;
+
+ spin_lock_irqsave(&adapter->hw_lock, flags);
+
+@@ -775,13 +776,14 @@ static int pvscsi_queue_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd
+ }
+
+ cmd->scsi_done = done;
++ op = cmd->cmnd[0];
+
+ dev_dbg(&cmd->device->sdev_gendev,
+- "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]);
++ "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, op);
+
+ spin_unlock_irqrestore(&adapter->hw_lock, flags);
+
+- pvscsi_kick_io(adapter, cmd->cmnd[0]);
++ pvscsi_kick_io(adapter, op);
+
+ return 0;
+ }
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index 5bfb62533e0f..131028501752 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -636,9 +636,9 @@ struct dwc3_event_buffer {
+ /**
+ * struct dwc3_ep - device side endpoint representation
+ * @endpoint: usb endpoint
++ * @cancelled_list: list of cancelled requests for this endpoint
+ * @pending_list: list of pending requests for this endpoint
+ * @started_list: list of started requests on this endpoint
+- * @wait_end_transfer: wait_queue_head_t for waiting on End Transfer complete
+ * @lock: spinlock for endpoint request queue traversal
+ * @regs: pointer to first endpoint register
+ * @trb_pool: array of transaction buffers
+@@ -659,11 +659,10 @@ struct dwc3_event_buffer {
+ */
+ struct dwc3_ep {
+ struct usb_ep endpoint;
++ struct list_head cancelled_list;
+ struct list_head pending_list;
+ struct list_head started_list;
+
+- wait_queue_head_t wait_end_transfer;
+-
+ spinlock_t lock;
+ void __iomem *regs;
+
+@@ -847,11 +846,12 @@ struct dwc3_hwparams {
+ * @epnum: endpoint number to which this request refers
+ * @trb: pointer to struct dwc3_trb
+ * @trb_dma: DMA address of @trb
+- * @unaligned: true for OUT endpoints with length not divisible by maxp
++ * @num_trbs: number of TRBs used by this request
++ * @needs_extra_trb: true when request needs one extra TRB (either due to ZLP
++ * or unaligned OUT)
+ * @direction: IN or OUT direction flag
+ * @mapped: true when request has been dma-mapped
+ * @started: request is started
+- * @zero: wants a ZLP
+ */
+ struct dwc3_request {
+ struct usb_request request;
+@@ -867,11 +867,12 @@ struct dwc3_request {
+ struct dwc3_trb *trb;
+ dma_addr_t trb_dma;
+
+- unsigned unaligned:1;
++ unsigned num_trbs;
++
++ unsigned needs_extra_trb:1;
+ unsigned direction:1;
+ unsigned mapped:1;
+ unsigned started:1;
+- unsigned zero:1;
+ };
+
+ /*
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 65ba1038b111..e7461c995116 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -177,8 +177,7 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
+ req->started = false;
+ list_del(&req->list);
+ req->remaining = 0;
+- req->unaligned = false;
+- req->zero = false;
++ req->needs_extra_trb = false;
+
+ if (req->request.status == -EINPROGRESS)
+ req->request.status = status;
+@@ -640,8 +639,6 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, unsigned int action)
+ reg |= DWC3_DALEPENA_EP(dep->number);
+ dwc3_writel(dwc->regs, DWC3_DALEPENA, reg);
+
+- init_waitqueue_head(&dep->wait_end_transfer);
+-
+ if (usb_endpoint_xfer_control(desc))
+ goto out;
+
+@@ -1043,6 +1040,8 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
+ req->trb_dma = dwc3_trb_dma_offset(dep, trb);
+ }
+
++ req->num_trbs++;
++
+ __dwc3_prepare_one_trb(dep, trb, dma, length, chain, node,
+ stream_id, short_not_ok, no_interrupt);
+ }
+@@ -1070,13 +1069,14 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ struct dwc3 *dwc = dep->dwc;
+ struct dwc3_trb *trb;
+
+- req->unaligned = true;
++ req->needs_extra_trb = true;
+
+ /* prepare normal TRB */
+ dwc3_prepare_one_trb(dep, req, true, i);
+
+ /* Now prepare one extra TRB to align transfer size */
+ trb = &dep->trb_pool[dep->trb_enqueue];
++ req->num_trbs++;
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr,
+ maxp - rem, false, 1,
+ req->request.stream_id,
+@@ -1114,13 +1114,14 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
+ struct dwc3 *dwc = dep->dwc;
+ struct dwc3_trb *trb;
+
+- req->unaligned = true;
++ req->needs_extra_trb = true;
+
+ /* prepare normal TRB */
+ dwc3_prepare_one_trb(dep, req, true, 0);
+
+ /* Now prepare one extra TRB to align transfer size */
+ trb = &dep->trb_pool[dep->trb_enqueue];
++ req->num_trbs++;
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp - rem,
+ false, 1, req->request.stream_id,
+ req->request.short_not_ok,
+@@ -1130,13 +1131,14 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
+ struct dwc3 *dwc = dep->dwc;
+ struct dwc3_trb *trb;
+
+- req->zero = true;
++ req->needs_extra_trb = true;
+
+ /* prepare normal TRB */
+ dwc3_prepare_one_trb(dep, req, true, 0);
+
+ /* Now prepare one extra TRB to handle ZLP */
+ trb = &dep->trb_pool[dep->trb_enqueue];
++ req->num_trbs++;
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
+ false, 1, req->request.stream_id,
+ req->request.short_not_ok,
+@@ -1338,6 +1340,42 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
+ return ret;
+ }
+
++static void dwc3_gadget_ep_skip_trbs(struct dwc3_ep *dep, struct dwc3_request *req)
++{
++ int i;
++
++ /*
++ * If request was already started, this means we had to
++ * stop the transfer. With that we also need to ignore
++ * all TRBs used by the request, however TRBs can only
++ * be modified after completion of END_TRANSFER
++ * command. So what we do here is that we wait for
++ * END_TRANSFER completion and only after that, we jump
++ * over TRBs by clearing HWO and incrementing dequeue
++ * pointer.
++ */
++ for (i = 0; i < req->num_trbs; i++) {
++ struct dwc3_trb *trb;
++
++ trb = req->trb + i;
++ trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
++ dwc3_ep_inc_deq(dep);
++ }
++
++ req->num_trbs = 0;
++}
++
++static void dwc3_gadget_ep_cleanup_cancelled_requests(struct dwc3_ep *dep)
++{
++ struct dwc3_request *req;
++ struct dwc3_request *tmp;
++
++ list_for_each_entry_safe(req, tmp, &dep->cancelled_list, list) {
++ dwc3_gadget_ep_skip_trbs(dep, req);
++ dwc3_gadget_giveback(dep, req, -ECONNRESET);
++ }
++}
++
+ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
+ struct usb_request *request)
+ {
+@@ -1368,68 +1406,11 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
+ /* wait until it is processed */
+ dwc3_stop_active_transfer(dep, true);
+
+- /*
+- * If request was already started, this means we had to
+- * stop the transfer. With that we also need to ignore
+- * all TRBs used by the request, however TRBs can only
+- * be modified after completion of END_TRANSFER
+- * command. So what we do here is that we wait for
+- * END_TRANSFER completion and only after that, we jump
+- * over TRBs by clearing HWO and incrementing dequeue
+- * pointer.
+- *
+- * Note that we have 2 possible types of transfers here:
+- *
+- * i) Linear buffer request
+- * ii) SG-list based request
+- *
+- * SG-list based requests will have r->num_pending_sgs
+- * set to a valid number (> 0). Linear requests,
+- * normally use a single TRB.
+- *
+- * For each of these two cases, if r->unaligned flag is
+- * set, one extra TRB has been used to align transfer
+- * size to wMaxPacketSize.
+- *
+- * All of these cases need to be taken into
+- * consideration so we don't mess up our TRB ring
+- * pointers.
+- */
+- wait_event_lock_irq(dep->wait_end_transfer,
+- !(dep->flags & DWC3_EP_END_TRANSFER_PENDING),
+- dwc->lock);
+-
+ if (!r->trb)
+ goto out0;
+
+- if (r->num_pending_sgs) {
+- struct dwc3_trb *trb;
+- int i = 0;
+-
+- for (i = 0; i < r->num_pending_sgs; i++) {
+- trb = r->trb + i;
+- trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+- dwc3_ep_inc_deq(dep);
+- }
+-
+- if (r->unaligned || r->zero) {
+- trb = r->trb + r->num_pending_sgs + 1;
+- trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+- dwc3_ep_inc_deq(dep);
+- }
+- } else {
+- struct dwc3_trb *trb = r->trb;
+-
+- trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+- dwc3_ep_inc_deq(dep);
+-
+- if (r->unaligned || r->zero) {
+- trb = r->trb + 1;
+- trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+- dwc3_ep_inc_deq(dep);
+- }
+- }
+- goto out1;
++ dwc3_gadget_move_cancelled_request(req);
++ goto out0;
+ }
+ dev_err(dwc->dev, "request %pK was not queued to %s\n",
+ request, ep->name);
+@@ -1437,9 +1418,6 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
+ goto out0;
+ }
+
+-out1:
+- /* giveback the request */
+-
+ dwc3_gadget_giveback(dep, req, -ECONNRESET);
+
+ out0:
+@@ -1932,8 +1910,6 @@ static int dwc3_gadget_stop(struct usb_gadget *g)
+ {
+ struct dwc3 *dwc = gadget_to_dwc(g);
+ unsigned long flags;
+- int epnum;
+- u32 tmo_eps = 0;
+
+ spin_lock_irqsave(&dwc->lock, flags);
+
+@@ -1942,36 +1918,6 @@ static int dwc3_gadget_stop(struct usb_gadget *g)
+
+ __dwc3_gadget_stop(dwc);
+
+- for (epnum = 2; epnum < DWC3_ENDPOINTS_NUM; epnum++) {
+- struct dwc3_ep *dep = dwc->eps[epnum];
+- int ret;
+-
+- if (!dep)
+- continue;
+-
+- if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING))
+- continue;
+-
+- ret = wait_event_interruptible_lock_irq_timeout(dep->wait_end_transfer,
+- !(dep->flags & DWC3_EP_END_TRANSFER_PENDING),
+- dwc->lock, msecs_to_jiffies(5));
+-
+- if (ret <= 0) {
+- /* Timed out or interrupted! There's nothing much
+- * we can do so we just log here and print which
+- * endpoints timed out at the end.
+- */
+- tmo_eps |= 1 << epnum;
+- dep->flags &= DWC3_EP_END_TRANSFER_PENDING;
+- }
+- }
+-
+- if (tmo_eps) {
+- dev_err(dwc->dev,
+- "end transfer timed out on endpoints 0x%x [bitmap]\n",
+- tmo_eps);
+- }
+-
+ out:
+ dwc->gadget_driver = NULL;
+ spin_unlock_irqrestore(&dwc->lock, flags);
+@@ -2174,6 +2120,7 @@ static int dwc3_gadget_init_endpoint(struct dwc3 *dwc, u8 epnum)
+
+ INIT_LIST_HEAD(&dep->pending_list);
+ INIT_LIST_HEAD(&dep->started_list);
++ INIT_LIST_HEAD(&dep->cancelled_list);
+
+ return 0;
+ }
+@@ -2233,6 +2180,7 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
+ dwc3_ep_inc_deq(dep);
+
+ trace_dwc3_complete_trb(dep, trb);
++ req->num_trbs--;
+
+ /*
+ * If we're in the middle of series of chained TRBs and we
+@@ -2252,7 +2200,8 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
+ * with one TRB pending in the ring. We need to manually clear HWO bit
+ * from that TRB.
+ */
+- if ((req->zero || req->unaligned) && !(trb->ctrl & DWC3_TRB_CTRL_CHN)) {
++
++ if (req->needs_extra_trb && !(trb->ctrl & DWC3_TRB_CTRL_CHN)) {
+ trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+ return 1;
+ }
+@@ -2329,11 +2278,10 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+ ret = dwc3_gadget_ep_reclaim_trb_linear(dep, req, event,
+ status);
+
+- if (req->unaligned || req->zero) {
++ if (req->needs_extra_trb) {
+ ret = dwc3_gadget_ep_reclaim_trb_linear(dep, req, event,
+ status);
+- req->unaligned = false;
+- req->zero = false;
++ req->needs_extra_trb = false;
+ }
+
+ req->request.actual = req->request.length - req->remaining;
+@@ -2466,7 +2414,7 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc,
+
+ if (cmd == DWC3_DEPCMD_ENDTRANSFER) {
+ dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
+- wake_up(&dep->wait_end_transfer);
++ dwc3_gadget_ep_cleanup_cancelled_requests(dep);
+ }
+ break;
+ case DWC3_DEPEVT_STREAMEVT:
+diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
+index 2aacd1afd9ff..023a473648eb 100644
+--- a/drivers/usb/dwc3/gadget.h
++++ b/drivers/usb/dwc3/gadget.h
+@@ -79,6 +79,21 @@ static inline void dwc3_gadget_move_started_request(struct dwc3_request *req)
+ list_move_tail(&req->list, &dep->started_list);
+ }
+
++/**
++ * dwc3_gadget_move_cancelled_request - move @req to the cancelled_list
++ * @req: the request to be moved
++ *
++ * Caller should take care of locking. This function will move @req from its
++ * current list to the endpoint's cancelled_list.
++ */
++static inline void dwc3_gadget_move_cancelled_request(struct dwc3_request *req)
++{
++ struct dwc3_ep *dep = req->dep;
++
++ req->started = false;
++ list_move_tail(&req->list, &dep->cancelled_list);
++}
++
+ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
+ int status);
+
+diff --git a/fs/9p/acl.c b/fs/9p/acl.c
+index 082d227fa56b..6261719f6f2a 100644
+--- a/fs/9p/acl.c
++++ b/fs/9p/acl.c
+@@ -276,7 +276,7 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler,
+ switch (handler->flags) {
+ case ACL_TYPE_ACCESS:
+ if (acl) {
+- struct iattr iattr;
++ struct iattr iattr = { 0 };
+ struct posix_acl *old_acl = acl;
+
+ retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl);
+diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
+index 82a48e830018..e4b59e76afb0 100644
+--- a/fs/binfmt_flat.c
++++ b/fs/binfmt_flat.c
+@@ -856,9 +856,14 @@ err:
+
+ static int load_flat_shared_library(int id, struct lib_info *libs)
+ {
++ /*
++ * This is a fake bprm struct; only the members "buf", "file" and
++ * "filename" are actually used.
++ */
+ struct linux_binprm bprm;
+ int res;
+ char buf[16];
++ loff_t pos = 0;
+
+ memset(&bprm, 0, sizeof(bprm));
+
+@@ -872,25 +877,11 @@ static int load_flat_shared_library(int id, struct lib_info *libs)
+ if (IS_ERR(bprm.file))
+ return res;
+
+- bprm.cred = prepare_exec_creds();
+- res = -ENOMEM;
+- if (!bprm.cred)
+- goto out;
+-
+- /* We don't really care about recalculating credentials at this point
+- * as we're past the point of no return and are dealing with shared
+- * libraries.
+- */
+- bprm.called_set_creds = 1;
++ res = kernel_read(bprm.file, bprm.buf, BINPRM_BUF_SIZE, &pos);
+
+- res = prepare_binprm(&bprm);
+-
+- if (!res)
++ if (res >= 0)
+ res = load_flat_file(&bprm, libs, id, NULL);
+
+- abort_creds(bprm.cred);
+-
+-out:
+ allow_write_access(bprm.file);
+ fput(bprm.file);
+
+diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+index a8df2f496898..364028c710a8 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+@@ -18,7 +18,7 @@
+
+ #define NFSDBG_FACILITY NFSDBG_PNFS_LD
+
+-static unsigned int dataserver_timeo = NFS_DEF_TCP_RETRANS;
++static unsigned int dataserver_timeo = NFS_DEF_TCP_TIMEO;
+ static unsigned int dataserver_retrans;
+
+ static bool ff_layout_has_available_ds(struct pnfs_layout_segment *lseg);
+diff --git a/fs/proc/array.c b/fs/proc/array.c
+index 0ceb3b6b37e7..9eb99a43f849 100644
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -452,7 +452,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+ * a program is not able to use ptrace(2) in that case. It is
+ * safe because the task has stopped executing permanently.
+ */
+- if (permitted && (task->flags & PF_DUMPCORE)) {
++ if (permitted && (task->flags & (PF_EXITING|PF_DUMPCORE))) {
+ if (try_get_task_stack(task)) {
+ eip = KSTK_EIP(task);
+ esp = KSTK_ESP(task);
+diff --git a/include/asm-generic/futex.h b/include/asm-generic/futex.h
+index fcb61b4659b3..8666fe7f35d7 100644
+--- a/include/asm-generic/futex.h
++++ b/include/asm-generic/futex.h
+@@ -23,7 +23,9 @@
+ *
+ * Return:
+ * 0 - On success
+- * <0 - On error
++ * -EFAULT - User access resulted in a page fault
++ * -EAGAIN - Atomic operation was unable to complete due to contention
++ * -ENOSYS - Operation not supported
+ */
+ static inline int
+ arch_futex_atomic_op_inuser(int op, u32 oparg, int *oval, u32 __user *uaddr)
+@@ -85,7 +87,9 @@ out_pagefault_enable:
+ *
+ * Return:
+ * 0 - On success
+- * <0 - On error
++ * -EFAULT - User access resulted in a page fault
++ * -EAGAIN - Atomic operation was unable to complete due to contention
++ * -ENOSYS - Function not implemented (only if !HAVE_FUTEX_CMPXCHG)
+ */
+ static inline int
+ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h
+index f91b0f8ff3a9..ad6b30137ac2 100644
+--- a/include/linux/bpf-cgroup.h
++++ b/include/linux/bpf-cgroup.h
+@@ -210,6 +210,12 @@ void bpf_cgroup_storage_release(struct bpf_prog *prog, struct bpf_map *map);
+ #define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) \
+ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_SENDMSG, t_ctx)
+
++#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) \
++ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_RECVMSG, NULL)
++
++#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) \
++ BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_RECVMSG, NULL)
++
+ #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) \
+ ({ \
+ int __ret = 0; \
+@@ -290,6 +296,8 @@ static inline void bpf_cgroup_storage_free(
+ #define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
+ #define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
+ #define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
++#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; })
++#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; })
+ #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
+ #define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; })
+
+diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
+index f30bf500888d..e7bbd82908b1 100644
+--- a/include/linux/sunrpc/xprt.h
++++ b/include/linux/sunrpc/xprt.h
+@@ -325,7 +325,6 @@ struct xprt_class {
+ struct rpc_xprt *xprt_create_transport(struct xprt_create *args);
+ void xprt_connect(struct rpc_task *task);
+ void xprt_reserve(struct rpc_task *task);
+-void xprt_request_init(struct rpc_task *task);
+ void xprt_retry_reserve(struct rpc_task *task);
+ int xprt_reserve_xprt(struct rpc_xprt *xprt, struct rpc_task *task);
+ int xprt_reserve_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task);
+diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
+index b8eb51a661e5..4ab293f574e0 100644
+--- a/include/net/9p/9p.h
++++ b/include/net/9p/9p.h
+@@ -336,6 +336,9 @@ enum p9_qid_t {
+ #define P9_NOFID (u32)(~0)
+ #define P9_MAXWELEM 16
+
++/* Minimal header size: size[4] type[1] tag[2] */
++#define P9_HDRSZ 7
++
+ /* ample room for Twrite/Rread header */
+ #define P9_IOHDRSZ 24
+
+@@ -558,6 +561,7 @@ struct p9_fcall {
+ size_t offset;
+ size_t capacity;
+
++ struct kmem_cache *cache;
+ u8 *sdata;
+ };
+
+diff --git a/include/net/9p/client.h b/include/net/9p/client.h
+index 0fa0fbab33b0..947a570307a6 100644
+--- a/include/net/9p/client.h
++++ b/include/net/9p/client.h
+@@ -64,22 +64,15 @@ enum p9_trans_status {
+
+ /**
+ * enum p9_req_status_t - status of a request
+- * @REQ_STATUS_IDLE: request slot unused
+ * @REQ_STATUS_ALLOC: request has been allocated but not sent
+ * @REQ_STATUS_UNSENT: request waiting to be sent
+ * @REQ_STATUS_SENT: request sent to server
+ * @REQ_STATUS_RCVD: response received from server
+ * @REQ_STATUS_FLSHD: request has been flushed
+ * @REQ_STATUS_ERROR: request encountered an error on the client side
+- *
+- * The @REQ_STATUS_IDLE state is used to mark a request slot as unused
+- * but use is actually tracked by the idpool structure which handles tag
+- * id allocation.
+- *
+ */
+
+ enum p9_req_status_t {
+- REQ_STATUS_IDLE,
+ REQ_STATUS_ALLOC,
+ REQ_STATUS_UNSENT,
+ REQ_STATUS_SENT,
+@@ -92,70 +85,46 @@ enum p9_req_status_t {
+ * struct p9_req_t - request slots
+ * @status: status of this request slot
+ * @t_err: transport error
+- * @flush_tag: tag of request being flushed (for flush requests)
+ * @wq: wait_queue for the client to block on for this request
+ * @tc: the request fcall structure
+ * @rc: the response fcall structure
+ * @aux: transport specific data (provided for trans_fd migration)
+ * @req_list: link for higher level objects to chain requests
+- *
+- * Transport use an array to track outstanding requests
+- * instead of a list. While this may incurr overhead during initial
+- * allocation or expansion, it makes request lookup much easier as the
+- * tag id is a index into an array. (We use tag+1 so that we can accommodate
+- * the -1 tag for the T_VERSION request).
+- * This also has the nice effect of only having to allocate wait_queues
+- * once, instead of constantly allocating and freeing them. Its possible
+- * other resources could benefit from this scheme as well.
+- *
+ */
+-
+ struct p9_req_t {
+ int status;
+ int t_err;
++ struct kref refcount;
+ wait_queue_head_t wq;
+- struct p9_fcall *tc;
+- struct p9_fcall *rc;
++ struct p9_fcall tc;
++ struct p9_fcall rc;
+ void *aux;
+-
+ struct list_head req_list;
+ };
+
+ /**
+ * struct p9_client - per client instance state
+- * @lock: protect @fidlist
++ * @lock: protect @fids and @reqs
+ * @msize: maximum data size negotiated by protocol
+- * @dotu: extension flags negotiated by protocol
+ * @proto_version: 9P protocol version to use
+ * @trans_mod: module API instantiated with this client
++ * @status: connection state
+ * @trans: tranport instance state and API
+ * @fids: All active FID handles
+- * @tagpool - transaction id accounting for session
+- * @reqs - 2D array of requests
+- * @max_tag - current maximum tag id allocated
+- * @name - node name used as client id
++ * @reqs: All active requests.
++ * @name: node name used as client id
+ *
+ * The client structure is used to keep track of various per-client
+ * state that has been instantiated.
+- * In order to minimize per-transaction overhead we use a
+- * simple array to lookup requests instead of a hash table
+- * or linked list. In order to support larger number of
+- * transactions, we make this a 2D array, allocating new rows
+- * when we need to grow the total number of the transactions.
+- *
+- * Each row is 256 requests and we'll support up to 256 rows for
+- * a total of 64k concurrent requests per session.
+- *
+- * Bugs: duplicated data and potentially unnecessary elements.
+ */
+-
+ struct p9_client {
+- spinlock_t lock; /* protect client structure */
++ spinlock_t lock;
+ unsigned int msize;
+ unsigned char proto_version;
+ struct p9_trans_module *trans_mod;
+ enum p9_trans_status status;
+ void *trans;
++ struct kmem_cache *fcall_cache;
+
+ union {
+ struct {
+@@ -170,10 +139,7 @@ struct p9_client {
+ } trans_opts;
+
+ struct idr fids;
+-
+- struct p9_idpool *tagpool;
+- struct p9_req_t *reqs[P9_ROW_MAXTAG];
+- int max_tag;
++ struct idr reqs;
+
+ char name[__NEW_UTS_LEN + 1];
+ };
+@@ -266,7 +232,21 @@ int p9_client_mkdir_dotl(struct p9_fid *fid, const char *name, int mode,
+ kgid_t gid, struct p9_qid *);
+ int p9_client_lock_dotl(struct p9_fid *fid, struct p9_flock *flock, u8 *status);
+ int p9_client_getlock_dotl(struct p9_fid *fid, struct p9_getlock *fl);
++void p9_fcall_fini(struct p9_fcall *fc);
+ struct p9_req_t *p9_tag_lookup(struct p9_client *, u16);
++
++static inline void p9_req_get(struct p9_req_t *r)
++{
++ kref_get(&r->refcount);
++}
++
++static inline int p9_req_try_get(struct p9_req_t *r)
++{
++ return kref_get_unless_zero(&r->refcount);
++}
++
++int p9_req_put(struct p9_req_t *r);
++
+ void p9_client_cb(struct p9_client *c, struct p9_req_t *req, int status);
+
+ int p9_parse_header(struct p9_fcall *, int32_t *, int8_t *, int16_t *, int);
+@@ -279,4 +259,7 @@ struct p9_fid *p9_client_xattrwalk(struct p9_fid *, const char *, u64 *);
+ int p9_client_xattrcreate(struct p9_fid *, const char *, u64, int);
+ int p9_client_readlink(struct p9_fid *fid, char **target);
+
++int p9_client_init(void);
++void p9_client_exit(void);
++
+ #endif /* NET_9P_CLIENT_H */
+diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
+index 66917a4eba27..2932600ce271 100644
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -172,6 +172,8 @@ enum bpf_attach_type {
+ BPF_CGROUP_UDP4_SENDMSG,
+ BPF_CGROUP_UDP6_SENDMSG,
+ BPF_LIRC_MODE2,
++ BPF_CGROUP_UDP4_RECVMSG = 19,
++ BPF_CGROUP_UDP6_RECVMSG,
+ __MAX_BPF_ATTACH_TYPE
+ };
+
+@@ -2705,8 +2707,8 @@ struct bpf_raw_tracepoint_args {
+ /* DIRECT: Skip the FIB rules and go to FIB table associated with device
+ * OUTPUT: Do lookup from egress perspective; default is ingress
+ */
+-#define BPF_FIB_LOOKUP_DIRECT BIT(0)
+-#define BPF_FIB_LOOKUP_OUTPUT BIT(1)
++#define BPF_FIB_LOOKUP_DIRECT (1U << 0)
++#define BPF_FIB_LOOKUP_OUTPUT (1U << 1)
+
+ enum {
+ BPF_FIB_LKUP_RET_SUCCESS, /* lookup successful */
+diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
+index 4f3138e6ecb2..1a8b208f6c55 100644
+--- a/kernel/bpf/lpm_trie.c
++++ b/kernel/bpf/lpm_trie.c
+@@ -676,9 +676,14 @@ find_leftmost:
+ * have exact two children, so this function will never return NULL.
+ */
+ for (node = search_root; node;) {
+- if (!(node->flags & LPM_TREE_NODE_FLAG_IM))
++ if (node->flags & LPM_TREE_NODE_FLAG_IM) {
++ node = rcu_dereference(node->child[0]);
++ } else {
+ next_node = node;
+- node = rcu_dereference(node->child[0]);
++ node = rcu_dereference(node->child[0]);
++ if (!node)
++ node = rcu_dereference(next_node->child[1]);
++ }
+ }
+ do_copy:
+ next_key->prefixlen = next_node->prefixlen;
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index ede82382dd32..118e3a8fc764 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1342,6 +1342,8 @@ bpf_prog_load_check_attach_type(enum bpf_prog_type prog_type,
+ case BPF_CGROUP_INET6_CONNECT:
+ case BPF_CGROUP_UDP4_SENDMSG:
+ case BPF_CGROUP_UDP6_SENDMSG:
++ case BPF_CGROUP_UDP4_RECVMSG:
++ case BPF_CGROUP_UDP6_RECVMSG:
+ return 0;
+ default:
+ return -EINVAL;
+@@ -1622,6 +1624,8 @@ static int bpf_prog_attach(const union bpf_attr *attr)
+ case BPF_CGROUP_INET6_CONNECT:
+ case BPF_CGROUP_UDP4_SENDMSG:
+ case BPF_CGROUP_UDP6_SENDMSG:
++ case BPF_CGROUP_UDP4_RECVMSG:
++ case BPF_CGROUP_UDP6_RECVMSG:
+ ptype = BPF_PROG_TYPE_CGROUP_SOCK_ADDR;
+ break;
+ case BPF_CGROUP_SOCK_OPS:
+@@ -1698,6 +1702,8 @@ static int bpf_prog_detach(const union bpf_attr *attr)
+ case BPF_CGROUP_INET6_CONNECT:
+ case BPF_CGROUP_UDP4_SENDMSG:
+ case BPF_CGROUP_UDP6_SENDMSG:
++ case BPF_CGROUP_UDP4_RECVMSG:
++ case BPF_CGROUP_UDP6_RECVMSG:
+ ptype = BPF_PROG_TYPE_CGROUP_SOCK_ADDR;
+ break;
+ case BPF_CGROUP_SOCK_OPS:
+@@ -1744,6 +1750,8 @@ static int bpf_prog_query(const union bpf_attr *attr,
+ case BPF_CGROUP_INET6_CONNECT:
+ case BPF_CGROUP_UDP4_SENDMSG:
+ case BPF_CGROUP_UDP6_SENDMSG:
++ case BPF_CGROUP_UDP4_RECVMSG:
++ case BPF_CGROUP_UDP6_RECVMSG:
+ case BPF_CGROUP_SOCK_OPS:
+ case BPF_CGROUP_DEVICE:
+ break;
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index d3580a68dbef..1dff5f7323cc 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -4342,9 +4342,12 @@ static int check_return_code(struct bpf_verifier_env *env)
+ struct tnum range = tnum_range(0, 1);
+
+ switch (env->prog->type) {
++ case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
++ if (env->prog->expected_attach_type == BPF_CGROUP_UDP4_RECVMSG ||
++ env->prog->expected_attach_type == BPF_CGROUP_UDP6_RECVMSG)
++ range = tnum_range(1, 1);
+ case BPF_PROG_TYPE_CGROUP_SKB:
+ case BPF_PROG_TYPE_CGROUP_SOCK:
+- case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
+ case BPF_PROG_TYPE_SOCK_OPS:
+ case BPF_PROG_TYPE_CGROUP_DEVICE:
+ break;
+@@ -4360,16 +4363,17 @@ static int check_return_code(struct bpf_verifier_env *env)
+ }
+
+ if (!tnum_in(range, reg->var_off)) {
++ char tn_buf[48];
++
+ verbose(env, "At program exit the register R0 ");
+ if (!tnum_is_unknown(reg->var_off)) {
+- char tn_buf[48];
+-
+ tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
+ verbose(env, "has value %s", tn_buf);
+ } else {
+ verbose(env, "has unknown scalar value");
+ }
+- verbose(env, " should have been 0 or 1\n");
++ tnum_strn(tn_buf, sizeof(tn_buf), range);
++ verbose(env, " should have been in %s\n", tn_buf);
+ return -EINVAL;
+ }
+ return 0;
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 5d65eae893bd..46aefe5c0e35 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2289,6 +2289,9 @@ static int __init mitigations_parse_cmdline(char *arg)
+ cpu_mitigations = CPU_MITIGATIONS_AUTO;
+ else if (!strcmp(arg, "auto,nosmt"))
+ cpu_mitigations = CPU_MITIGATIONS_AUTO_NOSMT;
++ else
++ pr_crit("Unsupported mitigations=%s, system may still be vulnerable\n",
++ arg);
+
+ return 0;
+ }
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 6c28d519447d..83c4e76f513a 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -365,8 +365,6 @@ static const struct bpf_func_proto bpf_perf_event_read_value_proto = {
+ .arg4_type = ARG_CONST_SIZE,
+ };
+
+-static DEFINE_PER_CPU(struct perf_sample_data, bpf_trace_sd);
+-
+ static __always_inline u64
+ __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map,
+ u64 flags, struct perf_sample_data *sd)
+@@ -398,24 +396,50 @@ __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map,
+ return 0;
+ }
+
++/*
++ * Support executing tracepoints in normal, irq, and nmi context that each call
++ * bpf_perf_event_output
++ */
++struct bpf_trace_sample_data {
++ struct perf_sample_data sds[3];
++};
++
++static DEFINE_PER_CPU(struct bpf_trace_sample_data, bpf_trace_sds);
++static DEFINE_PER_CPU(int, bpf_trace_nest_level);
+ BPF_CALL_5(bpf_perf_event_output, struct pt_regs *, regs, struct bpf_map *, map,
+ u64, flags, void *, data, u64, size)
+ {
+- struct perf_sample_data *sd = this_cpu_ptr(&bpf_trace_sd);
++ struct bpf_trace_sample_data *sds = this_cpu_ptr(&bpf_trace_sds);
++ int nest_level = this_cpu_inc_return(bpf_trace_nest_level);
+ struct perf_raw_record raw = {
+ .frag = {
+ .size = size,
+ .data = data,
+ },
+ };
++ struct perf_sample_data *sd;
++ int err;
+
+- if (unlikely(flags & ~(BPF_F_INDEX_MASK)))
+- return -EINVAL;
++ if (WARN_ON_ONCE(nest_level > ARRAY_SIZE(sds->sds))) {
++ err = -EBUSY;
++ goto out;
++ }
++
++ sd = &sds->sds[nest_level - 1];
++
++ if (unlikely(flags & ~(BPF_F_INDEX_MASK))) {
++ err = -EINVAL;
++ goto out;
++ }
+
+ perf_sample_data_init(sd, 0, 0);
+ sd->raw = &raw;
+
+- return __bpf_perf_event_output(regs, map, flags, sd);
++ err = __bpf_perf_event_output(regs, map, flags, sd);
++
++out:
++ this_cpu_dec(bpf_trace_nest_level);
++ return err;
+ }
+
+ static const struct bpf_func_proto bpf_perf_event_output_proto = {
+@@ -772,16 +796,48 @@ pe_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
+ /*
+ * bpf_raw_tp_regs are separate from bpf_pt_regs used from skb/xdp
+ * to avoid potential recursive reuse issue when/if tracepoints are added
+- * inside bpf_*_event_output, bpf_get_stackid and/or bpf_get_stack
++ * inside bpf_*_event_output, bpf_get_stackid and/or bpf_get_stack.
++ *
++ * Since raw tracepoints run despite bpf_prog_active, support concurrent usage
++ * in normal, irq, and nmi context.
+ */
+-static DEFINE_PER_CPU(struct pt_regs, bpf_raw_tp_regs);
++struct bpf_raw_tp_regs {
++ struct pt_regs regs[3];
++};
++static DEFINE_PER_CPU(struct bpf_raw_tp_regs, bpf_raw_tp_regs);
++static DEFINE_PER_CPU(int, bpf_raw_tp_nest_level);
++static struct pt_regs *get_bpf_raw_tp_regs(void)
++{
++ struct bpf_raw_tp_regs *tp_regs = this_cpu_ptr(&bpf_raw_tp_regs);
++ int nest_level = this_cpu_inc_return(bpf_raw_tp_nest_level);
++
++ if (WARN_ON_ONCE(nest_level > ARRAY_SIZE(tp_regs->regs))) {
++ this_cpu_dec(bpf_raw_tp_nest_level);
++ return ERR_PTR(-EBUSY);
++ }
++
++ return &tp_regs->regs[nest_level - 1];
++}
++
++static void put_bpf_raw_tp_regs(void)
++{
++ this_cpu_dec(bpf_raw_tp_nest_level);
++}
++
+ BPF_CALL_5(bpf_perf_event_output_raw_tp, struct bpf_raw_tracepoint_args *, args,
+ struct bpf_map *, map, u64, flags, void *, data, u64, size)
+ {
+- struct pt_regs *regs = this_cpu_ptr(&bpf_raw_tp_regs);
++ struct pt_regs *regs = get_bpf_raw_tp_regs();
++ int ret;
++
++ if (IS_ERR(regs))
++ return PTR_ERR(regs);
+
+ perf_fetch_caller_regs(regs);
+- return ____bpf_perf_event_output(regs, map, flags, data, size);
++ ret = ____bpf_perf_event_output(regs, map, flags, data, size);
++
++ put_bpf_raw_tp_regs();
++ return ret;
+ }
+
+ static const struct bpf_func_proto bpf_perf_event_output_proto_raw_tp = {
+@@ -798,12 +854,18 @@ static const struct bpf_func_proto bpf_perf_event_output_proto_raw_tp = {
+ BPF_CALL_3(bpf_get_stackid_raw_tp, struct bpf_raw_tracepoint_args *, args,
+ struct bpf_map *, map, u64, flags)
+ {
+- struct pt_regs *regs = this_cpu_ptr(&bpf_raw_tp_regs);
++ struct pt_regs *regs = get_bpf_raw_tp_regs();
++ int ret;
++
++ if (IS_ERR(regs))
++ return PTR_ERR(regs);
+
+ perf_fetch_caller_regs(regs);
+ /* similar to bpf_perf_event_output_tp, but pt_regs fetched differently */
+- return bpf_get_stackid((unsigned long) regs, (unsigned long) map,
+- flags, 0, 0);
++ ret = bpf_get_stackid((unsigned long) regs, (unsigned long) map,
++ flags, 0, 0);
++ put_bpf_raw_tp_regs();
++ return ret;
+ }
+
+ static const struct bpf_func_proto bpf_get_stackid_proto_raw_tp = {
+@@ -818,11 +880,17 @@ static const struct bpf_func_proto bpf_get_stackid_proto_raw_tp = {
+ BPF_CALL_4(bpf_get_stack_raw_tp, struct bpf_raw_tracepoint_args *, args,
+ void *, buf, u32, size, u64, flags)
+ {
+- struct pt_regs *regs = this_cpu_ptr(&bpf_raw_tp_regs);
++ struct pt_regs *regs = get_bpf_raw_tp_regs();
++ int ret;
++
++ if (IS_ERR(regs))
++ return PTR_ERR(regs);
+
+ perf_fetch_caller_regs(regs);
+- return bpf_get_stack((unsigned long) regs, (unsigned long) buf,
+- (unsigned long) size, flags, 0);
++ ret = bpf_get_stack((unsigned long) regs, (unsigned long) buf,
++ (unsigned long) size, flags, 0);
++ put_bpf_raw_tp_regs();
++ return ret;
+ }
+
+ static const struct bpf_func_proto bpf_get_stack_proto_raw_tp = {
+diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
+index 3ea65cdff30d..4ad967453b6f 100644
+--- a/kernel/trace/trace_branch.c
++++ b/kernel/trace/trace_branch.c
+@@ -205,8 +205,6 @@ void trace_likely_condition(struct ftrace_likely_data *f, int val, int expect)
+ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ int expect, int is_constant)
+ {
+- unsigned long flags = user_access_save();
+-
+ /* A constant is always correct */
+ if (is_constant) {
+ f->constant++;
+@@ -225,8 +223,6 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ f->data.correct++;
+ else
+ f->data.incorrect++;
+-
+- user_access_restore(flags);
+ }
+ EXPORT_SYMBOL(ftrace_likely_update);
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 65179513c2b2..57053affaad2 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1489,16 +1489,29 @@ static int free_pool_huge_page(struct hstate *h, nodemask_t *nodes_allowed,
+
+ /*
+ * Dissolve a given free hugepage into free buddy pages. This function does
+- * nothing for in-use (including surplus) hugepages. Returns -EBUSY if the
+- * dissolution fails because a give page is not a free hugepage, or because
+- * free hugepages are fully reserved.
++ * nothing for in-use hugepages and non-hugepages.
++ * This function returns values like below:
++ *
++ * -EBUSY: failed to dissolved free hugepages or the hugepage is in-use
++ * (allocated or reserved.)
++ * 0: successfully dissolved free hugepages or the page is not a
++ * hugepage (considered as already dissolved)
+ */
+ int dissolve_free_huge_page(struct page *page)
+ {
+ int rc = -EBUSY;
+
++ /* Not to disrupt normal path by vainly holding hugetlb_lock */
++ if (!PageHuge(page))
++ return 0;
++
+ spin_lock(&hugetlb_lock);
+- if (PageHuge(page) && !page_count(page)) {
++ if (!PageHuge(page)) {
++ rc = 0;
++ goto out;
++ }
++
++ if (!page_count(page)) {
+ struct page *head = compound_head(page);
+ struct hstate *h = page_hstate(head);
+ int nid = page_to_nid(head);
+@@ -1543,11 +1556,9 @@ int dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
+
+ for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order) {
+ page = pfn_to_page(pfn);
+- if (PageHuge(page) && !page_count(page)) {
+- rc = dissolve_free_huge_page(page);
+- if (rc)
+- break;
+- }
++ rc = dissolve_free_huge_page(page);
++ if (rc)
++ break;
+ }
+
+ return rc;
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 6edc6db5ec1b..2994ceb2e7b0 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1731,6 +1731,8 @@ static int soft_offline_huge_page(struct page *page, int flags)
+ if (!ret) {
+ if (set_hwpoison_free_buddy_page(page))
+ num_poisoned_pages_inc();
++ else
++ ret = -EBUSY;
+ }
+ }
+ return ret;
+@@ -1855,11 +1857,8 @@ static int soft_offline_in_use_page(struct page *page, int flags)
+
+ static int soft_offline_free_page(struct page *page)
+ {
+- int rc = 0;
+- struct page *head = compound_head(page);
++ int rc = dissolve_free_huge_page(page);
+
+- if (PageHuge(head))
+- rc = dissolve_free_huge_page(page);
+ if (!rc) {
+ if (set_hwpoison_free_buddy_page(page))
+ num_poisoned_pages_inc();
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 360b24bc69e5..62f945ea3e36 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -306,7 +306,7 @@ static void mpol_rebind_nodemask(struct mempolicy *pol, const nodemask_t *nodes)
+ else {
+ nodes_remap(tmp, pol->v.nodes,pol->w.cpuset_mems_allowed,
+ *nodes);
+- pol->w.cpuset_mems_allowed = tmp;
++ pol->w.cpuset_mems_allowed = *nodes;
+ }
+
+ if (nodes_empty(tmp))
+diff --git a/mm/page_idle.c b/mm/page_idle.c
+index 6302bc62c27d..52ed59bbc275 100644
+--- a/mm/page_idle.c
++++ b/mm/page_idle.c
+@@ -136,7 +136,7 @@ static ssize_t page_idle_bitmap_read(struct file *file, struct kobject *kobj,
+
+ end_pfn = pfn + count * BITS_PER_BYTE;
+ if (end_pfn > max_pfn)
+- end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS);
++ end_pfn = max_pfn;
+
+ for (; pfn < end_pfn; pfn++) {
+ bit = pfn % BITMAP_CHUNK_BITS;
+@@ -181,7 +181,7 @@ static ssize_t page_idle_bitmap_write(struct file *file, struct kobject *kobj,
+
+ end_pfn = pfn + count * BITS_PER_BYTE;
+ if (end_pfn > max_pfn)
+- end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS);
++ end_pfn = max_pfn;
+
+ for (; pfn < end_pfn; pfn++) {
+ bit = pfn % BITMAP_CHUNK_BITS;
+diff --git a/net/9p/client.c b/net/9p/client.c
+index 23ec6187dc07..b615aae5a0f8 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -237,144 +237,170 @@ free_and_return:
+ return ret;
+ }
+
+-static struct p9_fcall *p9_fcall_alloc(int alloc_msize)
++static int p9_fcall_init(struct p9_client *c, struct p9_fcall *fc,
++ int alloc_msize)
+ {
+- struct p9_fcall *fc;
+- fc = kmalloc(sizeof(struct p9_fcall) + alloc_msize, GFP_NOFS);
+- if (!fc)
+- return NULL;
++ if (likely(c->fcall_cache) && alloc_msize == c->msize) {
++ fc->sdata = kmem_cache_alloc(c->fcall_cache, GFP_NOFS);
++ fc->cache = c->fcall_cache;
++ } else {
++ fc->sdata = kmalloc(alloc_msize, GFP_NOFS);
++ fc->cache = NULL;
++ }
++ if (!fc->sdata)
++ return -ENOMEM;
+ fc->capacity = alloc_msize;
+- fc->sdata = (char *) fc + sizeof(struct p9_fcall);
+- return fc;
++ return 0;
++}
++
++void p9_fcall_fini(struct p9_fcall *fc)
++{
++ /* sdata can be NULL for interrupted requests in trans_rdma,
++ * and kmem_cache_free does not do NULL-check for us
++ */
++ if (unlikely(!fc->sdata))
++ return;
++
++ if (fc->cache)
++ kmem_cache_free(fc->cache, fc->sdata);
++ else
++ kfree(fc->sdata);
+ }
++EXPORT_SYMBOL(p9_fcall_fini);
++
++static struct kmem_cache *p9_req_cache;
+
+ /**
+- * p9_tag_alloc - lookup/allocate a request by tag
+- * @c: client session to lookup tag within
+- * @tag: numeric id for transaction
+- *
+- * this is a simple array lookup, but will grow the
+- * request_slots as necessary to accommodate transaction
+- * ids which did not previously have a slot.
+- *
+- * this code relies on the client spinlock to manage locks, its
+- * possible we should switch to something else, but I'd rather
+- * stick with something low-overhead for the common case.
++ * p9_req_alloc - Allocate a new request.
++ * @c: Client session.
++ * @type: Transaction type.
++ * @max_size: Maximum packet size for this request.
+ *
++ * Context: Process context.
++ * Return: Pointer to new request.
+ */
+-
+ static struct p9_req_t *
+-p9_tag_alloc(struct p9_client *c, u16 tag, unsigned int max_size)
++p9_tag_alloc(struct p9_client *c, int8_t type, unsigned int max_size)
+ {
+- unsigned long flags;
+- int row, col;
+- struct p9_req_t *req;
++ struct p9_req_t *req = kmem_cache_alloc(p9_req_cache, GFP_NOFS);
+ int alloc_msize = min(c->msize, max_size);
++ int tag;
+
+- /* This looks up the original request by tag so we know which
+- * buffer to read the data into */
+- tag++;
+-
+- if (tag >= c->max_tag) {
+- spin_lock_irqsave(&c->lock, flags);
+- /* check again since original check was outside of lock */
+- while (tag >= c->max_tag) {
+- row = (tag / P9_ROW_MAXTAG);
+- c->reqs[row] = kcalloc(P9_ROW_MAXTAG,
+- sizeof(struct p9_req_t), GFP_ATOMIC);
+-
+- if (!c->reqs[row]) {
+- pr_err("Couldn't grow tag array\n");
+- spin_unlock_irqrestore(&c->lock, flags);
+- return ERR_PTR(-ENOMEM);
+- }
+- for (col = 0; col < P9_ROW_MAXTAG; col++) {
+- req = &c->reqs[row][col];
+- req->status = REQ_STATUS_IDLE;
+- init_waitqueue_head(&req->wq);
+- }
+- c->max_tag += P9_ROW_MAXTAG;
+- }
+- spin_unlock_irqrestore(&c->lock, flags);
+- }
+- row = tag / P9_ROW_MAXTAG;
+- col = tag % P9_ROW_MAXTAG;
+-
+- req = &c->reqs[row][col];
+- if (!req->tc)
+- req->tc = p9_fcall_alloc(alloc_msize);
+- if (!req->rc)
+- req->rc = p9_fcall_alloc(alloc_msize);
+- if (!req->tc || !req->rc)
+- goto grow_failed;
++ if (!req)
++ return ERR_PTR(-ENOMEM);
+
+- p9pdu_reset(req->tc);
+- p9pdu_reset(req->rc);
++ if (p9_fcall_init(c, &req->tc, alloc_msize))
++ goto free_req;
++ if (p9_fcall_init(c, &req->rc, alloc_msize))
++ goto free;
+
+- req->tc->tag = tag-1;
++ p9pdu_reset(&req->tc);
++ p9pdu_reset(&req->rc);
+ req->status = REQ_STATUS_ALLOC;
++ init_waitqueue_head(&req->wq);
++ INIT_LIST_HEAD(&req->req_list);
++
++ idr_preload(GFP_NOFS);
++ spin_lock_irq(&c->lock);
++ if (type == P9_TVERSION)
++ tag = idr_alloc(&c->reqs, req, P9_NOTAG, P9_NOTAG + 1,
++ GFP_NOWAIT);
++ else
++ tag = idr_alloc(&c->reqs, req, 0, P9_NOTAG, GFP_NOWAIT);
++ req->tc.tag = tag;
++ spin_unlock_irq(&c->lock);
++ idr_preload_end();
++ if (tag < 0)
++ goto free;
++
++ /* Init ref to two because in the general case there is one ref
++ * that is put asynchronously by a writer thread, one ref
++ * temporarily given by p9_tag_lookup and put by p9_client_cb
++ * in the recv thread, and one ref put by p9_tag_remove in the
++ * main thread. The only exception is virtio that does not use
++ * p9_tag_lookup but does not have a writer thread either
++ * (the write happens synchronously in the request/zc_request
++ * callback), so p9_client_cb eats the second ref there
++ * as the pointer is duplicated directly by virtqueue_add_sgs()
++ */
++ refcount_set(&req->refcount.refcount, 2);
+
+ return req;
+
+-grow_failed:
+- pr_err("Couldn't grow tag array\n");
+- kfree(req->tc);
+- kfree(req->rc);
+- req->tc = req->rc = NULL;
++free:
++ p9_fcall_fini(&req->tc);
++ p9_fcall_fini(&req->rc);
++free_req:
++ kmem_cache_free(p9_req_cache, req);
+ return ERR_PTR(-ENOMEM);
+ }
+
+ /**
+- * p9_tag_lookup - lookup a request by tag
+- * @c: client session to lookup tag within
+- * @tag: numeric id for transaction
++ * p9_tag_lookup - Look up a request by tag.
++ * @c: Client session.
++ * @tag: Transaction ID.
+ *
++ * Context: Any context.
++ * Return: A request, or %NULL if there is no request with that tag.
+ */
+-
+ struct p9_req_t *p9_tag_lookup(struct p9_client *c, u16 tag)
+ {
+- int row, col;
+-
+- /* This looks up the original request by tag so we know which
+- * buffer to read the data into */
+- tag++;
+-
+- if (tag >= c->max_tag)
+- return NULL;
++ struct p9_req_t *req;
+
+- row = tag / P9_ROW_MAXTAG;
+- col = tag % P9_ROW_MAXTAG;
++ rcu_read_lock();
++again:
++ req = idr_find(&c->reqs, tag);
++ if (req) {
++ /* We have to be careful with the req found under rcu_read_lock
++ * Thanks to SLAB_TYPESAFE_BY_RCU we can safely try to get the
++ * ref again without corrupting other data, then check again
++ * that the tag matches once we have the ref
++ */
++ if (!p9_req_try_get(req))
++ goto again;
++ if (req->tc.tag != tag) {
++ p9_req_put(req);
++ goto again;
++ }
++ }
++ rcu_read_unlock();
+
+- return &c->reqs[row][col];
++ return req;
+ }
+ EXPORT_SYMBOL(p9_tag_lookup);
+
+ /**
+- * p9_tag_init - setup tags structure and contents
+- * @c: v9fs client struct
+- *
+- * This initializes the tags structure for each client instance.
++ * p9_tag_remove - Remove a tag.
++ * @c: Client session.
++ * @r: Request of reference.
+ *
++ * Context: Any context.
+ */
++static int p9_tag_remove(struct p9_client *c, struct p9_req_t *r)
++{
++ unsigned long flags;
++ u16 tag = r->tc.tag;
++
++ p9_debug(P9_DEBUG_MUX, "clnt %p req %p tag: %d\n", c, r, tag);
++ spin_lock_irqsave(&c->lock, flags);
++ idr_remove(&c->reqs, tag);
++ spin_unlock_irqrestore(&c->lock, flags);
++ return p9_req_put(r);
++}
+
+-static int p9_tag_init(struct p9_client *c)
++static void p9_req_free(struct kref *ref)
+ {
+- int err = 0;
++ struct p9_req_t *r = container_of(ref, struct p9_req_t, refcount);
++ p9_fcall_fini(&r->tc);
++ p9_fcall_fini(&r->rc);
++ kmem_cache_free(p9_req_cache, r);
++}
+
+- c->tagpool = p9_idpool_create();
+- if (IS_ERR(c->tagpool)) {
+- err = PTR_ERR(c->tagpool);
+- goto error;
+- }
+- err = p9_idpool_get(c->tagpool); /* reserve tag 0 */
+- if (err < 0) {
+- p9_idpool_destroy(c->tagpool);
+- goto error;
+- }
+- c->max_tag = 0;
+-error:
+- return err;
++int p9_req_put(struct p9_req_t *r)
++{
++ return kref_put(&r->refcount, p9_req_free);
+ }
++EXPORT_SYMBOL(p9_req_put);
+
+ /**
+ * p9_tag_cleanup - cleans up tags structure and reclaims resources
+@@ -385,52 +411,17 @@ error:
+ */
+ static void p9_tag_cleanup(struct p9_client *c)
+ {
+- int row, col;
+-
+- /* check to insure all requests are idle */
+- for (row = 0; row < (c->max_tag/P9_ROW_MAXTAG); row++) {
+- for (col = 0; col < P9_ROW_MAXTAG; col++) {
+- if (c->reqs[row][col].status != REQ_STATUS_IDLE) {
+- p9_debug(P9_DEBUG_MUX,
+- "Attempting to cleanup non-free tag %d,%d\n",
+- row, col);
+- /* TODO: delay execution of cleanup */
+- return;
+- }
+- }
+- }
+-
+- if (c->tagpool) {
+- p9_idpool_put(0, c->tagpool); /* free reserved tag 0 */
+- p9_idpool_destroy(c->tagpool);
+- }
++ struct p9_req_t *req;
++ int id;
+
+- /* free requests associated with tags */
+- for (row = 0; row < (c->max_tag/P9_ROW_MAXTAG); row++) {
+- for (col = 0; col < P9_ROW_MAXTAG; col++) {
+- kfree(c->reqs[row][col].tc);
+- kfree(c->reqs[row][col].rc);
+- }
+- kfree(c->reqs[row]);
++ rcu_read_lock();
++ idr_for_each_entry(&c->reqs, req, id) {
++ pr_info("Tag %d still in use\n", id);
++ if (p9_tag_remove(c, req) == 0)
++ pr_warn("Packet with tag %d has still references",
++ req->tc.tag);
+ }
+- c->max_tag = 0;
+-}
+-
+-/**
+- * p9_free_req - free a request and clean-up as necessary
+- * c: client state
+- * r: request to release
+- *
+- */
+-
+-static void p9_free_req(struct p9_client *c, struct p9_req_t *r)
+-{
+- int tag = r->tc->tag;
+- p9_debug(P9_DEBUG_MUX, "clnt %p req %p tag: %d\n", c, r, tag);
+-
+- r->status = REQ_STATUS_IDLE;
+- if (tag != P9_NOTAG && p9_idpool_check(tag, c->tagpool))
+- p9_idpool_put(tag, c->tagpool);
++ rcu_read_unlock();
+ }
+
+ /**
+@@ -441,7 +432,7 @@ static void p9_free_req(struct p9_client *c, struct p9_req_t *r)
+ */
+ void p9_client_cb(struct p9_client *c, struct p9_req_t *req, int status)
+ {
+- p9_debug(P9_DEBUG_MUX, " tag %d\n", req->tc->tag);
++ p9_debug(P9_DEBUG_MUX, " tag %d\n", req->tc.tag);
+
+ /*
+ * This barrier is needed to make sure any change made to req before
+@@ -451,7 +442,8 @@ void p9_client_cb(struct p9_client *c, struct p9_req_t *req, int status)
+ req->status = status;
+
+ wake_up(&req->wq);
+- p9_debug(P9_DEBUG_MUX, "wakeup: %d\n", req->tc->tag);
++ p9_debug(P9_DEBUG_MUX, "wakeup: %d\n", req->tc.tag);
++ p9_req_put(req);
+ }
+ EXPORT_SYMBOL(p9_client_cb);
+
+@@ -522,18 +514,18 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
+ int err;
+ int ecode;
+
+- err = p9_parse_header(req->rc, NULL, &type, NULL, 0);
+- if (req->rc->size >= c->msize) {
++ err = p9_parse_header(&req->rc, NULL, &type, NULL, 0);
++ if (req->rc.size >= c->msize) {
+ p9_debug(P9_DEBUG_ERROR,
+ "requested packet size too big: %d\n",
+- req->rc->size);
++ req->rc.size);
+ return -EIO;
+ }
+ /*
+ * dump the response from server
+ * This should be after check errors which poplulate pdu_fcall.
+ */
+- trace_9p_protocol_dump(c, req->rc);
++ trace_9p_protocol_dump(c, &req->rc);
+ if (err) {
+ p9_debug(P9_DEBUG_ERROR, "couldn't parse header %d\n", err);
+ return err;
+@@ -543,7 +535,7 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
+
+ if (!p9_is_proto_dotl(c)) {
+ char *ename;
+- err = p9pdu_readf(req->rc, c->proto_version, "s?d",
++ err = p9pdu_readf(&req->rc, c->proto_version, "s?d",
+ &ename, &ecode);
+ if (err)
+ goto out_err;
+@@ -559,7 +551,7 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
+ }
+ kfree(ename);
+ } else {
+- err = p9pdu_readf(req->rc, c->proto_version, "d", &ecode);
++ err = p9pdu_readf(&req->rc, c->proto_version, "d", &ecode);
+ err = -ecode;
+
+ p9_debug(P9_DEBUG_9P, "<<< RLERROR (%d)\n", -ecode);
+@@ -593,12 +585,12 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
+ int8_t type;
+ char *ename = NULL;
+
+- err = p9_parse_header(req->rc, NULL, &type, NULL, 0);
++ err = p9_parse_header(&req->rc, NULL, &type, NULL, 0);
+ /*
+ * dump the response from server
+ * This should be after parse_header which poplulate pdu_fcall.
+ */
+- trace_9p_protocol_dump(c, req->rc);
++ trace_9p_protocol_dump(c, &req->rc);
+ if (err) {
+ p9_debug(P9_DEBUG_ERROR, "couldn't parse header %d\n", err);
+ return err;
+@@ -613,13 +605,13 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
+ /* 7 = header size for RERROR; */
+ int inline_len = in_hdrlen - 7;
+
+- len = req->rc->size - req->rc->offset;
++ len = req->rc.size - req->rc.offset;
+ if (len > (P9_ZC_HDR_SZ - 7)) {
+ err = -EFAULT;
+ goto out_err;
+ }
+
+- ename = &req->rc->sdata[req->rc->offset];
++ ename = &req->rc.sdata[req->rc.offset];
+ if (len > inline_len) {
+ /* We have error in external buffer */
+ if (!copy_from_iter_full(ename + inline_len,
+@@ -629,7 +621,7 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
+ }
+ }
+ ename = NULL;
+- err = p9pdu_readf(req->rc, c->proto_version, "s?d",
++ err = p9pdu_readf(&req->rc, c->proto_version, "s?d",
+ &ename, &ecode);
+ if (err)
+ goto out_err;
+@@ -645,7 +637,7 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
+ }
+ kfree(ename);
+ } else {
+- err = p9pdu_readf(req->rc, c->proto_version, "d", &ecode);
++ err = p9pdu_readf(&req->rc, c->proto_version, "d", &ecode);
+ err = -ecode;
+
+ p9_debug(P9_DEBUG_9P, "<<< RLERROR (%d)\n", -ecode);
+@@ -678,7 +670,7 @@ static int p9_client_flush(struct p9_client *c, struct p9_req_t *oldreq)
+ int16_t oldtag;
+ int err;
+
+- err = p9_parse_header(oldreq->tc, NULL, NULL, &oldtag, 1);
++ err = p9_parse_header(&oldreq->tc, NULL, NULL, &oldtag, 1);
+ if (err)
+ return err;
+
+@@ -692,11 +684,12 @@ static int p9_client_flush(struct p9_client *c, struct p9_req_t *oldreq)
+ * if we haven't received a response for oldreq,
+ * remove it from the list
+ */
+- if (oldreq->status == REQ_STATUS_SENT)
++ if (oldreq->status == REQ_STATUS_SENT) {
+ if (c->trans_mod->cancelled)
+ c->trans_mod->cancelled(c, oldreq);
++ }
+
+- p9_free_req(c, req);
++ p9_tag_remove(c, req);
+ return 0;
+ }
+
+@@ -704,7 +697,7 @@ static struct p9_req_t *p9_client_prepare_req(struct p9_client *c,
+ int8_t type, int req_size,
+ const char *fmt, va_list ap)
+ {
+- int tag, err;
++ int err;
+ struct p9_req_t *req;
+
+ p9_debug(P9_DEBUG_MUX, "client %p op %d\n", c, type);
+@@ -717,27 +710,22 @@ static struct p9_req_t *p9_client_prepare_req(struct p9_client *c,
+ if ((c->status == BeginDisconnect) && (type != P9_TCLUNK))
+ return ERR_PTR(-EIO);
+
+- tag = P9_NOTAG;
+- if (type != P9_TVERSION) {
+- tag = p9_idpool_get(c->tagpool);
+- if (tag < 0)
+- return ERR_PTR(-ENOMEM);
+- }
+-
+- req = p9_tag_alloc(c, tag, req_size);
++ req = p9_tag_alloc(c, type, req_size);
+ if (IS_ERR(req))
+ return req;
+
+ /* marshall the data */
+- p9pdu_prepare(req->tc, tag, type);
+- err = p9pdu_vwritef(req->tc, c->proto_version, fmt, ap);
++ p9pdu_prepare(&req->tc, req->tc.tag, type);
++ err = p9pdu_vwritef(&req->tc, c->proto_version, fmt, ap);
+ if (err)
+ goto reterr;
+- p9pdu_finalize(c, req->tc);
+- trace_9p_client_req(c, type, tag);
++ p9pdu_finalize(c, &req->tc);
++ trace_9p_client_req(c, type, req->tc.tag);
+ return req;
+ reterr:
+- p9_free_req(c, req);
++ p9_tag_remove(c, req);
++ /* We have to put also the 2nd reference as it won't be used */
++ p9_req_put(req);
+ return ERR_PTR(err);
+ }
+
+@@ -747,7 +735,7 @@ reterr:
+ * @type: type of request
+ * @fmt: protocol format string (see protocol.c)
+ *
+- * Returns request structure (which client must free using p9_free_req)
++ * Returns request structure (which client must free using p9_tag_remove)
+ */
+
+ static struct p9_req_t *
+@@ -772,6 +760,8 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
+
+ err = c->trans_mod->request(c, req);
+ if (err < 0) {
++ /* write won't happen */
++ p9_req_put(req);
+ if (err != -ERESTARTSYS && err != -EFAULT)
+ c->status = Disconnected;
+ goto recalc_sigpending;
+@@ -819,11 +809,11 @@ recalc_sigpending:
+ goto reterr;
+
+ err = p9_check_errors(c, req);
+- trace_9p_client_res(c, type, req->rc->tag, err);
++ trace_9p_client_res(c, type, req->rc.tag, err);
+ if (!err)
+ return req;
+ reterr:
+- p9_free_req(c, req);
++ p9_tag_remove(c, req);
+ return ERR_PTR(safe_errno(err));
+ }
+
+@@ -838,7 +828,7 @@ reterr:
+ * @hdrlen: reader header size, This is the size of response protocol data
+ * @fmt: protocol format string (see protocol.c)
+ *
+- * Returns request structure (which client must free using p9_free_req)
++ * Returns request structure (which client must free using p9_tag_remove)
+ */
+ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
+ struct iov_iter *uidata,
+@@ -901,11 +891,11 @@ recalc_sigpending:
+ goto reterr;
+
+ err = p9_check_zc_errors(c, req, uidata, in_hdrlen);
+- trace_9p_client_res(c, type, req->rc->tag, err);
++ trace_9p_client_res(c, type, req->rc.tag, err);
+ if (!err)
+ return req;
+ reterr:
+- p9_free_req(c, req);
++ p9_tag_remove(c, req);
+ return ERR_PTR(safe_errno(err));
+ }
+
+@@ -984,10 +974,10 @@ static int p9_client_version(struct p9_client *c)
+ if (IS_ERR(req))
+ return PTR_ERR(req);
+
+- err = p9pdu_readf(req->rc, c->proto_version, "ds", &msize, &version);
++ err = p9pdu_readf(&req->rc, c->proto_version, "ds", &msize, &version);
+ if (err) {
+ p9_debug(P9_DEBUG_9P, "version error %d\n", err);
+- trace_9p_protocol_dump(c, req->rc);
++ trace_9p_protocol_dump(c, &req->rc);
+ goto error;
+ }
+
+@@ -1016,7 +1006,7 @@ static int p9_client_version(struct p9_client *c)
+
+ error:
+ kfree(version);
+- p9_free_req(c, req);
++ p9_tag_remove(c, req);
+
+ return err;
+ }
+@@ -1034,20 +1024,18 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
+
+ clnt->trans_mod = NULL;
+ clnt->trans = NULL;
++ clnt->fcall_cache = NULL;
+
+ client_id = utsname()->nodename;
+ memcpy(clnt->name, client_id, strlen(client_id) + 1);
+
+ spin_lock_init(&clnt->lock);
+ idr_init(&clnt->fids);
+-
+- err = p9_tag_init(clnt);
+- if (err < 0)
+- goto free_client;
++ idr_init(&clnt->reqs);
+
+ err = parse_opts(options, clnt);
+ if (err < 0)
+- goto destroy_tagpool;
++ goto free_client;
+
+ if (!clnt->trans_mod)
+ clnt->trans_mod = v9fs_get_default_trans();
+@@ -1056,7 +1044,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
+ err = -EPROTONOSUPPORT;
+ p9_debug(P9_DEBUG_ERROR,
+ "No transport defined or default transport\n");
+- goto destroy_tagpool;
++ goto free_client;
+ }
+
+ p9_debug(P9_DEBUG_MUX, "clnt %p trans %p msize %d protocol %d\n",
+@@ -1080,14 +1068,21 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
+ if (err)
+ goto close_trans;
+
++ /* P9_HDRSZ + 4 is the smallest packet header we can have that is
++ * followed by data accessed from userspace by read
++ */
++ clnt->fcall_cache =
++ kmem_cache_create_usercopy("9p-fcall-cache", clnt->msize,
++ 0, 0, P9_HDRSZ + 4,
++ clnt->msize - (P9_HDRSZ + 4),
++ NULL);
++
+ return clnt;
+
+ close_trans:
+ clnt->trans_mod->close(clnt);
+ put_trans:
+ v9fs_put_trans(clnt->trans_mod);
+-destroy_tagpool:
+- p9_idpool_destroy(clnt->tagpool);
+ free_client:
+ kfree(clnt);
+ return ERR_PTR(err);
+@@ -1113,6 +1108,7 @@ void p9_client_destroy(struct p9_client *clnt)
+
+ p9_tag_cleanup(clnt);
+
++ kmem_cache_destroy(clnt->fcall_cache);
+ kfree(clnt);
+ }
+ EXPORT_SYMBOL(p9_client_destroy);
+@@ -1156,10 +1152,10 @@ struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
+ goto error;
+ }
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "Q", &qid);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "Q", &qid);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
+- p9_free_req(clnt, req);
++ trace_9p_protocol_dump(clnt, &req->rc);
++ p9_tag_remove(clnt, req);
+ goto error;
+ }
+
+@@ -1168,7 +1164,7 @@ struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
+
+ memmove(&fid->qid, &qid, sizeof(struct p9_qid));
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ return fid;
+
+ error:
+@@ -1213,13 +1209,13 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
+ goto error;
+ }
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "R", &nwqids, &wqids);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "R", &nwqids, &wqids);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
+- p9_free_req(clnt, req);
++ trace_9p_protocol_dump(clnt, &req->rc);
++ p9_tag_remove(clnt, req);
+ goto clunk_fid;
+ }
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+
+ p9_debug(P9_DEBUG_9P, "<<< RWALK nwqid %d:\n", nwqids);
+
+@@ -1280,9 +1276,9 @@ int p9_client_open(struct p9_fid *fid, int mode)
+ goto error;
+ }
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "Qd", &qid, &iounit);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "Qd", &qid, &iounit);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
++ trace_9p_protocol_dump(clnt, &req->rc);
+ goto free_and_error;
+ }
+
+@@ -1294,7 +1290,7 @@ int p9_client_open(struct p9_fid *fid, int mode)
+ fid->iounit = iounit;
+
+ free_and_error:
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -1324,9 +1320,9 @@ int p9_client_create_dotl(struct p9_fid *ofid, const char *name, u32 flags, u32
+ goto error;
+ }
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "Qd", qid, &iounit);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "Qd", qid, &iounit);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
++ trace_9p_protocol_dump(clnt, &req->rc);
+ goto free_and_error;
+ }
+
+@@ -1339,7 +1335,7 @@ int p9_client_create_dotl(struct p9_fid *ofid, const char *name, u32 flags, u32
+ ofid->iounit = iounit;
+
+ free_and_error:
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -1369,9 +1365,9 @@ int p9_client_fcreate(struct p9_fid *fid, const char *name, u32 perm, int mode,
+ goto error;
+ }
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "Qd", &qid, &iounit);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "Qd", &qid, &iounit);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
++ trace_9p_protocol_dump(clnt, &req->rc);
+ goto free_and_error;
+ }
+
+@@ -1384,7 +1380,7 @@ int p9_client_fcreate(struct p9_fid *fid, const char *name, u32 perm, int mode,
+ fid->iounit = iounit;
+
+ free_and_error:
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -1408,9 +1404,9 @@ int p9_client_symlink(struct p9_fid *dfid, const char *name,
+ goto error;
+ }
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "Q", qid);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "Q", qid);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
++ trace_9p_protocol_dump(clnt, &req->rc);
+ goto free_and_error;
+ }
+
+@@ -1418,7 +1414,7 @@ int p9_client_symlink(struct p9_fid *dfid, const char *name,
+ qid->type, (unsigned long long)qid->path, qid->version);
+
+ free_and_error:
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -1438,7 +1434,7 @@ int p9_client_link(struct p9_fid *dfid, struct p9_fid *oldfid, const char *newna
+ return PTR_ERR(req);
+
+ p9_debug(P9_DEBUG_9P, "<<< RLINK\n");
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ return 0;
+ }
+ EXPORT_SYMBOL(p9_client_link);
+@@ -1462,7 +1458,7 @@ int p9_client_fsync(struct p9_fid *fid, int datasync)
+
+ p9_debug(P9_DEBUG_9P, "<<< RFSYNC fid %d\n", fid->fid);
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+
+ error:
+ return err;
+@@ -1497,7 +1493,7 @@ again:
+
+ p9_debug(P9_DEBUG_9P, "<<< RCLUNK fid %d\n", fid->fid);
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ /*
+ * Fid is not valid even after a failed clunk
+@@ -1531,7 +1527,7 @@ int p9_client_remove(struct p9_fid *fid)
+
+ p9_debug(P9_DEBUG_9P, "<<< RREMOVE fid %d\n", fid->fid);
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ if (err == -ERESTARTSYS)
+ p9_client_clunk(fid);
+@@ -1558,7 +1554,7 @@ int p9_client_unlinkat(struct p9_fid *dfid, const char *name, int flags)
+ }
+ p9_debug(P9_DEBUG_9P, "<<< RUNLINKAT fid %d %s\n", dfid->fid, name);
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -1606,11 +1602,11 @@ p9_client_read(struct p9_fid *fid, u64 offset, struct iov_iter *to, int *err)
+ break;
+ }
+
+- *err = p9pdu_readf(req->rc, clnt->proto_version,
++ *err = p9pdu_readf(&req->rc, clnt->proto_version,
+ "D", &count, &dataptr);
+ if (*err) {
+- trace_9p_protocol_dump(clnt, req->rc);
+- p9_free_req(clnt, req);
++ trace_9p_protocol_dump(clnt, &req->rc);
++ p9_tag_remove(clnt, req);
+ break;
+ }
+ if (rsize < count) {
+@@ -1620,7 +1616,7 @@ p9_client_read(struct p9_fid *fid, u64 offset, struct iov_iter *to, int *err)
+
+ p9_debug(P9_DEBUG_9P, "<<< RREAD count %d\n", count);
+ if (!count) {
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ break;
+ }
+
+@@ -1630,7 +1626,7 @@ p9_client_read(struct p9_fid *fid, u64 offset, struct iov_iter *to, int *err)
+ offset += n;
+ if (n != count) {
+ *err = -EFAULT;
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ break;
+ }
+ } else {
+@@ -1638,7 +1634,7 @@ p9_client_read(struct p9_fid *fid, u64 offset, struct iov_iter *to, int *err)
+ total += count;
+ offset += count;
+ }
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ }
+ return total;
+ }
+@@ -1679,10 +1675,10 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err)
+ break;
+ }
+
+- *err = p9pdu_readf(req->rc, clnt->proto_version, "d", &count);
++ *err = p9pdu_readf(&req->rc, clnt->proto_version, "d", &count);
+ if (*err) {
+- trace_9p_protocol_dump(clnt, req->rc);
+- p9_free_req(clnt, req);
++ trace_9p_protocol_dump(clnt, &req->rc);
++ p9_tag_remove(clnt, req);
+ break;
+ }
+ if (rsize < count) {
+@@ -1692,7 +1688,7 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err)
+
+ p9_debug(P9_DEBUG_9P, "<<< RWRITE count %d\n", count);
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ iov_iter_advance(from, count);
+ total += count;
+ offset += count;
+@@ -1723,10 +1719,10 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
+ goto error;
+ }
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "wS", &ignored, ret);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "wS", &ignored, ret);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
+- p9_free_req(clnt, req);
++ trace_9p_protocol_dump(clnt, &req->rc);
++ p9_tag_remove(clnt, req);
+ goto error;
+ }
+
+@@ -1743,7 +1739,7 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
+ from_kgid(&init_user_ns, ret->n_gid),
+ from_kuid(&init_user_ns, ret->n_muid));
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ return ret;
+
+ error:
+@@ -1776,10 +1772,10 @@ struct p9_stat_dotl *p9_client_getattr_dotl(struct p9_fid *fid,
+ goto error;
+ }
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "A", ret);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "A", ret);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
+- p9_free_req(clnt, req);
++ trace_9p_protocol_dump(clnt, &req->rc);
++ p9_tag_remove(clnt, req);
+ goto error;
+ }
+
+@@ -1804,7 +1800,7 @@ struct p9_stat_dotl *p9_client_getattr_dotl(struct p9_fid *fid,
+ ret->st_ctime_nsec, ret->st_btime_sec, ret->st_btime_nsec,
+ ret->st_gen, ret->st_data_version);
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ return ret;
+
+ error:
+@@ -1873,7 +1869,7 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
+
+ p9_debug(P9_DEBUG_9P, "<<< RWSTAT fid %d\n", fid->fid);
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -1905,7 +1901,7 @@ int p9_client_setattr(struct p9_fid *fid, struct p9_iattr_dotl *p9attr)
+ goto error;
+ }
+ p9_debug(P9_DEBUG_9P, "<<< RSETATTR fid %d\n", fid->fid);
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -1928,12 +1924,12 @@ int p9_client_statfs(struct p9_fid *fid, struct p9_rstatfs *sb)
+ goto error;
+ }
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "ddqqqqqqd", &sb->type,
+- &sb->bsize, &sb->blocks, &sb->bfree, &sb->bavail,
+- &sb->files, &sb->ffree, &sb->fsid, &sb->namelen);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "ddqqqqqqd", &sb->type,
++ &sb->bsize, &sb->blocks, &sb->bfree, &sb->bavail,
++ &sb->files, &sb->ffree, &sb->fsid, &sb->namelen);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
+- p9_free_req(clnt, req);
++ trace_9p_protocol_dump(clnt, &req->rc);
++ p9_tag_remove(clnt, req);
+ goto error;
+ }
+
+@@ -1944,7 +1940,7 @@ int p9_client_statfs(struct p9_fid *fid, struct p9_rstatfs *sb)
+ sb->blocks, sb->bfree, sb->bavail, sb->files, sb->ffree,
+ sb->fsid, (long int)sb->namelen);
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -1972,7 +1968,7 @@ int p9_client_rename(struct p9_fid *fid,
+
+ p9_debug(P9_DEBUG_9P, "<<< RRENAME fid %d\n", fid->fid);
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -2002,7 +1998,7 @@ int p9_client_renameat(struct p9_fid *olddirfid, const char *old_name,
+ p9_debug(P9_DEBUG_9P, "<<< RRENAMEAT newdirfid %d new name %s\n",
+ newdirfid->fid, new_name);
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -2036,13 +2032,13 @@ struct p9_fid *p9_client_xattrwalk(struct p9_fid *file_fid,
+ err = PTR_ERR(req);
+ goto error;
+ }
+- err = p9pdu_readf(req->rc, clnt->proto_version, "q", attr_size);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "q", attr_size);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
+- p9_free_req(clnt, req);
++ trace_9p_protocol_dump(clnt, &req->rc);
++ p9_tag_remove(clnt, req);
+ goto clunk_fid;
+ }
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ p9_debug(P9_DEBUG_9P, "<<< RXATTRWALK fid %d size %llu\n",
+ attr_fid->fid, *attr_size);
+ return attr_fid;
+@@ -2076,7 +2072,7 @@ int p9_client_xattrcreate(struct p9_fid *fid, const char *name,
+ goto error;
+ }
+ p9_debug(P9_DEBUG_9P, "<<< RXATTRCREATE fid %d\n", fid->fid);
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -2124,9 +2120,9 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset)
+ goto error;
+ }
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "D", &count, &dataptr);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "D", &count, &dataptr);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
++ trace_9p_protocol_dump(clnt, &req->rc);
+ goto free_and_error;
+ }
+ if (rsize < count) {
+@@ -2139,11 +2135,11 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset)
+ if (non_zc)
+ memmove(data, dataptr, count);
+
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ return count;
+
+ free_and_error:
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ error:
+ return err;
+ }
+@@ -2165,16 +2161,16 @@ int p9_client_mknod_dotl(struct p9_fid *fid, const char *name, int mode,
+ if (IS_ERR(req))
+ return PTR_ERR(req);
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "Q", qid);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "Q", qid);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
++ trace_9p_protocol_dump(clnt, &req->rc);
+ goto error;
+ }
+ p9_debug(P9_DEBUG_9P, "<<< RMKNOD qid %x.%llx.%x\n", qid->type,
+ (unsigned long long)qid->path, qid->version);
+
+ error:
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ return err;
+
+ }
+@@ -2196,16 +2192,16 @@ int p9_client_mkdir_dotl(struct p9_fid *fid, const char *name, int mode,
+ if (IS_ERR(req))
+ return PTR_ERR(req);
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "Q", qid);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "Q", qid);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
++ trace_9p_protocol_dump(clnt, &req->rc);
+ goto error;
+ }
+ p9_debug(P9_DEBUG_9P, "<<< RMKDIR qid %x.%llx.%x\n", qid->type,
+ (unsigned long long)qid->path, qid->version);
+
+ error:
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ return err;
+
+ }
+@@ -2231,14 +2227,14 @@ int p9_client_lock_dotl(struct p9_fid *fid, struct p9_flock *flock, u8 *status)
+ if (IS_ERR(req))
+ return PTR_ERR(req);
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "b", status);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "b", status);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
++ trace_9p_protocol_dump(clnt, &req->rc);
+ goto error;
+ }
+ p9_debug(P9_DEBUG_9P, "<<< RLOCK status %i\n", *status);
+ error:
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ return err;
+
+ }
+@@ -2262,18 +2258,18 @@ int p9_client_getlock_dotl(struct p9_fid *fid, struct p9_getlock *glock)
+ if (IS_ERR(req))
+ return PTR_ERR(req);
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "bqqds", &glock->type,
+- &glock->start, &glock->length, &glock->proc_id,
+- &glock->client_id);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "bqqds", &glock->type,
++ &glock->start, &glock->length, &glock->proc_id,
++ &glock->client_id);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
++ trace_9p_protocol_dump(clnt, &req->rc);
+ goto error;
+ }
+ p9_debug(P9_DEBUG_9P, "<<< RGETLOCK type %i start %lld length %lld "
+ "proc_id %d client_id %s\n", glock->type, glock->start,
+ glock->length, glock->proc_id, glock->client_id);
+ error:
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ return err;
+ }
+ EXPORT_SYMBOL(p9_client_getlock_dotl);
+@@ -2292,14 +2288,25 @@ int p9_client_readlink(struct p9_fid *fid, char **target)
+ if (IS_ERR(req))
+ return PTR_ERR(req);
+
+- err = p9pdu_readf(req->rc, clnt->proto_version, "s", target);
++ err = p9pdu_readf(&req->rc, clnt->proto_version, "s", target);
+ if (err) {
+- trace_9p_protocol_dump(clnt, req->rc);
++ trace_9p_protocol_dump(clnt, &req->rc);
+ goto error;
+ }
+ p9_debug(P9_DEBUG_9P, "<<< RREADLINK target %s\n", *target);
+ error:
+- p9_free_req(clnt, req);
++ p9_tag_remove(clnt, req);
+ return err;
+ }
+ EXPORT_SYMBOL(p9_client_readlink);
++
++int __init p9_client_init(void)
++{
++ p9_req_cache = KMEM_CACHE(p9_req_t, SLAB_TYPESAFE_BY_RCU);
++ return p9_req_cache ? 0 : -ENOMEM;
++}
++
++void __exit p9_client_exit(void)
++{
++ kmem_cache_destroy(p9_req_cache);
++}
+diff --git a/net/9p/mod.c b/net/9p/mod.c
+index 253ba824a325..0da56d6af73b 100644
+--- a/net/9p/mod.c
++++ b/net/9p/mod.c
+@@ -171,11 +171,17 @@ void v9fs_put_trans(struct p9_trans_module *m)
+ */
+ static int __init init_p9(void)
+ {
++ int ret;
++
++ ret = p9_client_init();
++ if (ret)
++ return ret;
++
+ p9_error_init();
+ pr_info("Installing 9P2000 support\n");
+ p9_trans_fd_init();
+
+- return 0;
++ return ret;
+ }
+
+ /**
+@@ -188,6 +194,7 @@ static void __exit exit_p9(void)
+ pr_info("Unloading 9P2000 support\n");
+
+ p9_trans_fd_exit();
++ p9_client_exit();
+ }
+
+ module_init(init_p9)
+diff --git a/net/9p/protocol.c b/net/9p/protocol.c
+index b4d80c533f89..462ba144cb39 100644
+--- a/net/9p/protocol.c
++++ b/net/9p/protocol.c
+@@ -623,13 +623,19 @@ int p9dirent_read(struct p9_client *clnt, char *buf, int len,
+ if (ret) {
+ p9_debug(P9_DEBUG_9P, "<<< p9dirent_read failed: %d\n", ret);
+ trace_9p_protocol_dump(clnt, &fake_pdu);
+- goto out;
++ return ret;
+ }
+
+- strcpy(dirent->d_name, nameptr);
++ ret = strscpy(dirent->d_name, nameptr, sizeof(dirent->d_name));
++ if (ret < 0) {
++ p9_debug(P9_DEBUG_ERROR,
++ "On the wire dirent name too long: %s\n",
++ nameptr);
++ kfree(nameptr);
++ return ret;
++ }
+ kfree(nameptr);
+
+-out:
+ return fake_pdu.offset;
+ }
+ EXPORT_SYMBOL(p9dirent_read);
+diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c
+index b718db2085b2..3dff68f05fb9 100644
+--- a/net/9p/trans_common.c
++++ b/net/9p/trans_common.c
+@@ -14,6 +14,7 @@
+
+ #include <linux/mm.h>
+ #include <linux/module.h>
++#include "trans_common.h"
+
+ /**
+ * p9_release_pages - Release pages after the transaction.
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index e2ef3c782c53..f868cf6fba79 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -131,7 +131,8 @@ struct p9_conn {
+ int err;
+ struct list_head req_list;
+ struct list_head unsent_req_list;
+- struct p9_req_t *req;
++ struct p9_req_t *rreq;
++ struct p9_req_t *wreq;
+ char tmp_buf[7];
+ struct p9_fcall rc;
+ int wpos;
+@@ -291,7 +292,6 @@ static void p9_read_work(struct work_struct *work)
+ __poll_t n;
+ int err;
+ struct p9_conn *m;
+- int status = REQ_STATUS_ERROR;
+
+ m = container_of(work, struct p9_conn, rq);
+
+@@ -322,7 +322,7 @@ static void p9_read_work(struct work_struct *work)
+ m->rc.offset += err;
+
+ /* header read in */
+- if ((!m->req) && (m->rc.offset == m->rc.capacity)) {
++ if ((!m->rreq) && (m->rc.offset == m->rc.capacity)) {
+ p9_debug(P9_DEBUG_TRANS, "got new header\n");
+
+ /* Header size */
+@@ -346,23 +346,23 @@ static void p9_read_work(struct work_struct *work)
+ "mux %p pkt: size: %d bytes tag: %d\n",
+ m, m->rc.size, m->rc.tag);
+
+- m->req = p9_tag_lookup(m->client, m->rc.tag);
+- if (!m->req || (m->req->status != REQ_STATUS_SENT)) {
++ m->rreq = p9_tag_lookup(m->client, m->rc.tag);
++ if (!m->rreq || (m->rreq->status != REQ_STATUS_SENT)) {
+ p9_debug(P9_DEBUG_ERROR, "Unexpected packet tag %d\n",
+ m->rc.tag);
+ err = -EIO;
+ goto error;
+ }
+
+- if (m->req->rc == NULL) {
++ if (!m->rreq->rc.sdata) {
+ p9_debug(P9_DEBUG_ERROR,
+ "No recv fcall for tag %d (req %p), disconnecting!\n",
+- m->rc.tag, m->req);
+- m->req = NULL;
++ m->rc.tag, m->rreq);
++ m->rreq = NULL;
+ err = -EIO;
+ goto error;
+ }
+- m->rc.sdata = (char *)m->req->rc + sizeof(struct p9_fcall);
++ m->rc.sdata = m->rreq->rc.sdata;
+ memcpy(m->rc.sdata, m->tmp_buf, m->rc.capacity);
+ m->rc.capacity = m->rc.size;
+ }
+@@ -370,20 +370,27 @@ static void p9_read_work(struct work_struct *work)
+ /* packet is read in
+ * not an else because some packets (like clunk) have no payload
+ */
+- if ((m->req) && (m->rc.offset == m->rc.capacity)) {
++ if ((m->rreq) && (m->rc.offset == m->rc.capacity)) {
+ p9_debug(P9_DEBUG_TRANS, "got new packet\n");
+- m->req->rc->size = m->rc.offset;
++ m->rreq->rc.size = m->rc.offset;
+ spin_lock(&m->client->lock);
+- if (m->req->status != REQ_STATUS_ERROR)
+- status = REQ_STATUS_RCVD;
+- list_del(&m->req->req_list);
+- /* update req->status while holding client->lock */
+- p9_client_cb(m->client, m->req, status);
++ if (m->rreq->status == REQ_STATUS_SENT) {
++ list_del(&m->rreq->req_list);
++ p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);
++ } else {
++ spin_unlock(&m->client->lock);
++ p9_debug(P9_DEBUG_ERROR,
++ "Request tag %d errored out while we were reading the reply\n",
++ m->rc.tag);
++ err = -EIO;
++ goto error;
++ }
+ spin_unlock(&m->client->lock);
+ m->rc.sdata = NULL;
+ m->rc.offset = 0;
+ m->rc.capacity = 0;
+- m->req = NULL;
++ p9_req_put(m->rreq);
++ m->rreq = NULL;
+ }
+
+ end_clear:
+@@ -469,9 +476,11 @@ static void p9_write_work(struct work_struct *work)
+ p9_debug(P9_DEBUG_TRANS, "move req %p\n", req);
+ list_move_tail(&req->req_list, &m->req_list);
+
+- m->wbuf = req->tc->sdata;
+- m->wsize = req->tc->size;
++ m->wbuf = req->tc.sdata;
++ m->wsize = req->tc.size;
+ m->wpos = 0;
++ p9_req_get(req);
++ m->wreq = req;
+ spin_unlock(&m->client->lock);
+ }
+
+@@ -492,8 +501,11 @@ static void p9_write_work(struct work_struct *work)
+ }
+
+ m->wpos += err;
+- if (m->wpos == m->wsize)
++ if (m->wpos == m->wsize) {
+ m->wpos = m->wsize = 0;
++ p9_req_put(m->wreq);
++ m->wreq = NULL;
++ }
+
+ end_clear:
+ clear_bit(Wworksched, &m->wsched);
+@@ -663,7 +675,7 @@ static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
+ struct p9_conn *m = &ts->conn;
+
+ p9_debug(P9_DEBUG_TRANS, "mux %p task %p tcall %p id %d\n",
+- m, current, req->tc, req->tc->id);
++ m, current, &req->tc, req->tc.id);
+ if (m->err < 0)
+ return m->err;
+
+@@ -694,6 +706,7 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req)
+ if (req->status == REQ_STATUS_UNSENT) {
+ list_del(&req->req_list);
+ req->status = REQ_STATUS_FLSHD;
++ p9_req_put(req);
+ ret = 0;
+ }
+ spin_unlock(&client->lock);
+@@ -711,6 +724,7 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req)
+ spin_lock(&client->lock);
+ list_del(&req->req_list);
+ spin_unlock(&client->lock);
++ p9_req_put(req);
+
+ return 0;
+ }
+@@ -862,7 +876,15 @@ static void p9_conn_destroy(struct p9_conn *m)
+
+ p9_mux_poll_stop(m);
+ cancel_work_sync(&m->rq);
++ if (m->rreq) {
++ p9_req_put(m->rreq);
++ m->rreq = NULL;
++ }
+ cancel_work_sync(&m->wq);
++ if (m->wreq) {
++ p9_req_put(m->wreq);
++ m->wreq = NULL;
++ }
+
+ p9_conn_cancel(m, -ECONNRESET);
+
+diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
+index b513cffeeb3c..119103bfa82e 100644
+--- a/net/9p/trans_rdma.c
++++ b/net/9p/trans_rdma.c
+@@ -122,7 +122,7 @@ struct p9_rdma_context {
+ dma_addr_t busa;
+ union {
+ struct p9_req_t *req;
+- struct p9_fcall *rc;
++ struct p9_fcall rc;
+ };
+ };
+
+@@ -274,8 +274,7 @@ p9_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event)
+ case RDMA_CM_EVENT_DISCONNECTED:
+ if (rdma)
+ rdma->state = P9_RDMA_CLOSED;
+- if (c)
+- c->status = Disconnected;
++ c->status = Disconnected;
+ break;
+
+ case RDMA_CM_EVENT_TIMEWAIT_EXIT:
+@@ -320,8 +319,8 @@ recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ if (wc->status != IB_WC_SUCCESS)
+ goto err_out;
+
+- c->rc->size = wc->byte_len;
+- err = p9_parse_header(c->rc, NULL, NULL, &tag, 1);
++ c->rc.size = wc->byte_len;
++ err = p9_parse_header(&c->rc, NULL, NULL, &tag, 1);
+ if (err)
+ goto err_out;
+
+@@ -331,12 +330,13 @@ recv_done(struct ib_cq *cq, struct ib_wc *wc)
+
+ /* Check that we have not yet received a reply for this request.
+ */
+- if (unlikely(req->rc)) {
++ if (unlikely(req->rc.sdata)) {
+ pr_err("Duplicate reply for request %d", tag);
+ goto err_out;
+ }
+
+- req->rc = c->rc;
++ req->rc.size = c->rc.size;
++ req->rc.sdata = c->rc.sdata;
+ p9_client_cb(client, req, REQ_STATUS_RCVD);
+
+ out:
+@@ -361,9 +361,10 @@ send_done(struct ib_cq *cq, struct ib_wc *wc)
+ container_of(wc->wr_cqe, struct p9_rdma_context, cqe);
+
+ ib_dma_unmap_single(rdma->cm_id->device,
+- c->busa, c->req->tc->size,
++ c->busa, c->req->tc.size,
+ DMA_TO_DEVICE);
+ up(&rdma->sq_sem);
++ p9_req_put(c->req);
+ kfree(c);
+ }
+
+@@ -401,7 +402,7 @@ post_recv(struct p9_client *client, struct p9_rdma_context *c)
+ struct ib_sge sge;
+
+ c->busa = ib_dma_map_single(rdma->cm_id->device,
+- c->rc->sdata, client->msize,
++ c->rc.sdata, client->msize,
+ DMA_FROM_DEVICE);
+ if (ib_dma_mapping_error(rdma->cm_id->device, c->busa))
+ goto error;
+@@ -443,9 +444,9 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
+ **/
+ if (unlikely(atomic_read(&rdma->excess_rc) > 0)) {
+ if ((atomic_sub_return(1, &rdma->excess_rc) >= 0)) {
+- /* Got one ! */
+- kfree(req->rc);
+- req->rc = NULL;
++ /* Got one! */
++ p9_fcall_fini(&req->rc);
++ req->rc.sdata = NULL;
+ goto dont_need_post_recv;
+ } else {
+ /* We raced and lost. */
+@@ -459,7 +460,7 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
+ err = -ENOMEM;
+ goto recv_error;
+ }
+- rpl_context->rc = req->rc;
++ rpl_context->rc.sdata = req->rc.sdata;
+
+ /*
+ * Post a receive buffer for this request. We need to ensure
+@@ -475,11 +476,11 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
+
+ err = post_recv(client, rpl_context);
+ if (err) {
+- p9_debug(P9_DEBUG_FCALL, "POST RECV failed\n");
++ p9_debug(P9_DEBUG_ERROR, "POST RECV failed: %d\n", err);
+ goto recv_error;
+ }
+ /* remove posted receive buffer from request structure */
+- req->rc = NULL;
++ req->rc.sdata = NULL;
+
+ dont_need_post_recv:
+ /* Post the request */
+@@ -491,7 +492,7 @@ dont_need_post_recv:
+ c->req = req;
+
+ c->busa = ib_dma_map_single(rdma->cm_id->device,
+- c->req->tc->sdata, c->req->tc->size,
++ c->req->tc.sdata, c->req->tc.size,
+ DMA_TO_DEVICE);
+ if (ib_dma_mapping_error(rdma->cm_id->device, c->busa)) {
+ err = -EIO;
+@@ -501,7 +502,7 @@ dont_need_post_recv:
+ c->cqe.done = send_done;
+
+ sge.addr = c->busa;
+- sge.length = c->req->tc->size;
++ sge.length = c->req->tc.size;
+ sge.lkey = rdma->pd->local_dma_lkey;
+
+ wr.next = NULL;
+@@ -544,7 +545,7 @@ dont_need_post_recv:
+ recv_error:
+ kfree(rpl_context);
+ spin_lock_irqsave(&rdma->req_lock, flags);
+- if (rdma->state < P9_RDMA_CLOSING) {
++ if (err != -EINTR && rdma->state < P9_RDMA_CLOSING) {
+ rdma->state = P9_RDMA_CLOSING;
+ spin_unlock_irqrestore(&rdma->req_lock, flags);
+ rdma_disconnect(rdma->cm_id);
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index 7728b0acde09..eb596c2ed546 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -155,7 +155,7 @@ static void req_done(struct virtqueue *vq)
+ }
+
+ if (len) {
+- req->rc->size = len;
++ req->rc.size = len;
+ p9_client_cb(chan->client, req, REQ_STATUS_RCVD);
+ }
+ }
+@@ -207,6 +207,13 @@ static int p9_virtio_cancel(struct p9_client *client, struct p9_req_t *req)
+ return 1;
+ }
+
++/* Reply won't come, so drop req ref */
++static int p9_virtio_cancelled(struct p9_client *client, struct p9_req_t *req)
++{
++ p9_req_put(req);
++ return 0;
++}
++
+ /**
+ * pack_sg_list_p - Just like pack_sg_list. Instead of taking a buffer,
+ * this takes a list of pages.
+@@ -273,12 +280,12 @@ req_retry:
+ out_sgs = in_sgs = 0;
+ /* Handle out VirtIO ring buffers */
+ out = pack_sg_list(chan->sg, 0,
+- VIRTQUEUE_NUM, req->tc->sdata, req->tc->size);
++ VIRTQUEUE_NUM, req->tc.sdata, req->tc.size);
+ if (out)
+ sgs[out_sgs++] = chan->sg;
+
+ in = pack_sg_list(chan->sg, out,
+- VIRTQUEUE_NUM, req->rc->sdata, req->rc->capacity);
++ VIRTQUEUE_NUM, req->rc.sdata, req->rc.capacity);
+ if (in)
+ sgs[out_sgs + in_sgs++] = chan->sg + out;
+
+@@ -404,6 +411,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
+ struct scatterlist *sgs[4];
+ size_t offs;
+ int need_drop = 0;
++ int kicked = 0;
+
+ p9_debug(P9_DEBUG_TRANS, "virtio request\n");
+
+@@ -411,29 +419,33 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
+ __le32 sz;
+ int n = p9_get_mapped_pages(chan, &out_pages, uodata,
+ outlen, &offs, &need_drop);
+- if (n < 0)
+- return n;
++ if (n < 0) {
++ err = n;
++ goto err_out;
++ }
+ out_nr_pages = DIV_ROUND_UP(n + offs, PAGE_SIZE);
+ if (n != outlen) {
+ __le32 v = cpu_to_le32(n);
+- memcpy(&req->tc->sdata[req->tc->size - 4], &v, 4);
++ memcpy(&req->tc.sdata[req->tc.size - 4], &v, 4);
+ outlen = n;
+ }
+ /* The size field of the message must include the length of the
+ * header and the length of the data. We didn't actually know
+ * the length of the data until this point so add it in now.
+ */
+- sz = cpu_to_le32(req->tc->size + outlen);
+- memcpy(&req->tc->sdata[0], &sz, sizeof(sz));
++ sz = cpu_to_le32(req->tc.size + outlen);
++ memcpy(&req->tc.sdata[0], &sz, sizeof(sz));
+ } else if (uidata) {
+ int n = p9_get_mapped_pages(chan, &in_pages, uidata,
+ inlen, &offs, &need_drop);
+- if (n < 0)
+- return n;
++ if (n < 0) {
++ err = n;
++ goto err_out;
++ }
+ in_nr_pages = DIV_ROUND_UP(n + offs, PAGE_SIZE);
+ if (n != inlen) {
+ __le32 v = cpu_to_le32(n);
+- memcpy(&req->tc->sdata[req->tc->size - 4], &v, 4);
++ memcpy(&req->tc.sdata[req->tc.size - 4], &v, 4);
+ inlen = n;
+ }
+ }
+@@ -445,7 +457,7 @@ req_retry_pinned:
+
+ /* out data */
+ out = pack_sg_list(chan->sg, 0,
+- VIRTQUEUE_NUM, req->tc->sdata, req->tc->size);
++ VIRTQUEUE_NUM, req->tc.sdata, req->tc.size);
+
+ if (out)
+ sgs[out_sgs++] = chan->sg;
+@@ -464,7 +476,7 @@ req_retry_pinned:
+ * alloced memory and payload onto the user buffer.
+ */
+ in = pack_sg_list(chan->sg, out,
+- VIRTQUEUE_NUM, req->rc->sdata, in_hdr_len);
++ VIRTQUEUE_NUM, req->rc.sdata, in_hdr_len);
+ if (in)
+ sgs[out_sgs + in_sgs++] = chan->sg + out;
+
+@@ -498,6 +510,7 @@ req_retry_pinned:
+ }
+ virtqueue_kick(chan->vq);
+ spin_unlock_irqrestore(&chan->lock, flags);
++ kicked = 1;
+ p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n");
+ err = wait_event_killable(req->wq, req->status >= REQ_STATUS_RCVD);
+ /*
+@@ -518,6 +531,10 @@ err_out:
+ }
+ kvfree(in_pages);
+ kvfree(out_pages);
++ if (!kicked) {
++ /* reply won't come */
++ p9_req_put(req);
++ }
+ return err;
+ }
+
+@@ -750,6 +767,7 @@ static struct p9_trans_module p9_virtio_trans = {
+ .request = p9_virtio_request,
+ .zc_request = p9_virtio_zc_request,
+ .cancel = p9_virtio_cancel,
++ .cancelled = p9_virtio_cancelled,
+ /*
+ * We leave one entry for input and one entry for response
+ * headers. We also skip one more entry to accomodate, address
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index c2d54ac76bfd..e2fbf3677b9b 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -141,7 +141,7 @@ static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
+ struct xen_9pfs_front_priv *priv = NULL;
+ RING_IDX cons, prod, masked_cons, masked_prod;
+ unsigned long flags;
+- u32 size = p9_req->tc->size;
++ u32 size = p9_req->tc.size;
+ struct xen_9pfs_dataring *ring;
+ int num;
+
+@@ -154,7 +154,7 @@ static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
+ if (!priv || priv->client != client)
+ return -EINVAL;
+
+- num = p9_req->tc->tag % priv->num_rings;
++ num = p9_req->tc.tag % priv->num_rings;
+ ring = &priv->rings[num];
+
+ again:
+@@ -176,7 +176,7 @@ again:
+ masked_prod = xen_9pfs_mask(prod, XEN_9PFS_RING_SIZE);
+ masked_cons = xen_9pfs_mask(cons, XEN_9PFS_RING_SIZE);
+
+- xen_9pfs_write_packet(ring->data.out, p9_req->tc->sdata, size,
++ xen_9pfs_write_packet(ring->data.out, p9_req->tc.sdata, size,
+ &masked_prod, masked_cons, XEN_9PFS_RING_SIZE);
+
+ p9_req->status = REQ_STATUS_SENT;
+@@ -185,6 +185,7 @@ again:
+ ring->intf->out_prod = prod;
+ spin_unlock_irqrestore(&ring->lock, flags);
+ notify_remote_via_irq(ring->irq);
++ p9_req_put(p9_req);
+
+ return 0;
+ }
+@@ -229,12 +230,12 @@ static void p9_xen_response(struct work_struct *work)
+ continue;
+ }
+
+- memcpy(req->rc, &h, sizeof(h));
+- req->rc->offset = 0;
++ memcpy(&req->rc, &h, sizeof(h));
++ req->rc.offset = 0;
+
+ masked_cons = xen_9pfs_mask(cons, XEN_9PFS_RING_SIZE);
+ /* Then, read the whole packet (including the header) */
+- xen_9pfs_read_packet(req->rc->sdata, ring->data.in, h.size,
++ xen_9pfs_read_packet(req->rc.sdata, ring->data.in, h.size,
+ masked_prod, &masked_cons,
+ XEN_9PFS_RING_SIZE);
+
+@@ -391,8 +392,8 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev,
+ unsigned int max_rings, max_ring_order, len = 0;
+
+ versions = xenbus_read(XBT_NIL, dev->otherend, "versions", &len);
+- if (!len)
+- return -EINVAL;
++ if (IS_ERR(versions))
++ return PTR_ERR(versions);
+ if (strcmp(versions, "1")) {
+ kfree(versions);
+ return -EINVAL;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index eb81e9db4093..34ec9324737b 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -5558,6 +5558,7 @@ static bool sock_addr_is_valid_access(int off, int size,
+ case BPF_CGROUP_INET4_BIND:
+ case BPF_CGROUP_INET4_CONNECT:
+ case BPF_CGROUP_UDP4_SENDMSG:
++ case BPF_CGROUP_UDP4_RECVMSG:
+ break;
+ default:
+ return false;
+@@ -5568,6 +5569,7 @@ static bool sock_addr_is_valid_access(int off, int size,
+ case BPF_CGROUP_INET6_BIND:
+ case BPF_CGROUP_INET6_CONNECT:
+ case BPF_CGROUP_UDP6_SENDMSG:
++ case BPF_CGROUP_UDP6_RECVMSG:
+ break;
+ default:
+ return false;
+diff --git a/net/core/sock.c b/net/core/sock.c
+index c9668dcb5eb9..9c32e8eb64da 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1348,9 +1348,6 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+ {
+ u32 meminfo[SK_MEMINFO_VARS];
+
+- if (get_user(len, optlen))
+- return -EFAULT;
+-
+ sk_get_meminfo(sk, meminfo);
+
+ len = min_t(unsigned int, len, sizeof(meminfo));
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index 711a5c75bd4b..21800979ed62 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -202,7 +202,7 @@ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash)
+ }
+ sk = __raw_v4_lookup(net, sk_next(sk), iph->protocol,
+ iph->saddr, iph->daddr,
+- skb->dev->ifindex, sdif);
++ dif, sdif);
+ }
+ out:
+ read_unlock(&raw_v4_hashinfo.lock);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index e45a5e19e509..6ab68b06fa39 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -542,7 +542,11 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,
+ struct sock *udp4_lib_lookup_skb(struct sk_buff *skb,
+ __be16 sport, __be16 dport)
+ {
+- return __udp4_lib_lookup_skb(skb, sport, dport, &udp_table);
++ const struct iphdr *iph = ip_hdr(skb);
++
++ return __udp4_lib_lookup(dev_net(skb->dev), iph->saddr, sport,
++ iph->daddr, dport, inet_iif(skb),
++ inet_sdif(skb), &udp_table, NULL);
+ }
+ EXPORT_SYMBOL_GPL(udp4_lib_lookup_skb);
+
+@@ -1720,6 +1724,10 @@ try_again:
+ sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
+ memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+ *addr_len = sizeof(*sin);
++
++ if (cgroup_bpf_enabled)
++ BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk,
++ (struct sockaddr *)sin);
+ }
+ if (inet->cmsg_flags)
+ ip_cmsg_recv_offset(msg, sk, skb, sizeof(struct udphdr), off);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index cab8b2b647f9..164f1d01273c 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -282,7 +282,7 @@ struct sock *udp6_lib_lookup_skb(struct sk_buff *skb,
+
+ return __udp6_lib_lookup(dev_net(skb->dev), &iph->saddr, sport,
+ &iph->daddr, dport, inet6_iif(skb),
+- inet6_sdif(skb), &udp_table, skb);
++ inet6_sdif(skb), &udp_table, NULL);
+ }
+ EXPORT_SYMBOL_GPL(udp6_lib_lookup_skb);
+
+@@ -419,6 +419,10 @@ try_again:
+ inet6_iif(skb));
+ }
+ *addr_len = sizeof(*sin6);
++
++ if (cgroup_bpf_enabled)
++ BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk,
++ (struct sockaddr *)sin6);
+ }
+
+ if (np->rxopt.all)
+@@ -478,7 +482,7 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ struct net *net = dev_net(skb->dev);
+
+ sk = __udp6_lib_lookup(net, daddr, uh->dest, saddr, uh->source,
+- inet6_iif(skb), 0, udptable, skb);
++ inet6_iif(skb), 0, udptable, NULL);
+ if (!sk) {
+ __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
+ ICMP6_MIB_INERRORS);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index d98fcf926166..93b5a4200585 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2399,6 +2399,9 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
+
+ ts = __packet_set_timestamp(po, ph, skb);
+ __packet_set_status(po, ph, TP_STATUS_AVAILABLE | ts);
++
++ if (!packet_read_pending(&po->tx_ring))
++ complete(&po->skb_completion);
+ }
+
+ sock_wfree(skb);
+@@ -2594,7 +2597,7 @@ static int tpacket_parse_header(struct packet_sock *po, void *frame,
+
+ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ {
+- struct sk_buff *skb;
++ struct sk_buff *skb = NULL;
+ struct net_device *dev;
+ struct virtio_net_hdr *vnet_hdr = NULL;
+ struct sockcm_cookie sockc;
+@@ -2609,6 +2612,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ int len_sum = 0;
+ int status = TP_STATUS_AVAILABLE;
+ int hlen, tlen, copylen = 0;
++ long timeo = 0;
+
+ mutex_lock(&po->pg_vec_lock);
+
+@@ -2655,12 +2659,21 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ if ((size_max > dev->mtu + reserve + VLAN_HLEN) && !po->has_vnet_hdr)
+ size_max = dev->mtu + reserve + VLAN_HLEN;
+
++ reinit_completion(&po->skb_completion);
++
+ do {
+ ph = packet_current_frame(po, &po->tx_ring,
+ TP_STATUS_SEND_REQUEST);
+ if (unlikely(ph == NULL)) {
+- if (need_wait && need_resched())
+- schedule();
++ if (need_wait && skb) {
++ timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT);
++ timeo = wait_for_completion_interruptible_timeout(&po->skb_completion, timeo);
++ if (timeo <= 0) {
++ err = !timeo ? -ETIMEDOUT : -ERESTARTSYS;
++ goto out_put;
++ }
++ }
++ /* check for additional frames */
+ continue;
+ }
+
+@@ -3216,6 +3229,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
+ sock_init_data(sock, sk);
+
+ po = pkt_sk(sk);
++ init_completion(&po->skb_completion);
+ sk->sk_family = PF_PACKET;
+ po->num = proto;
+ po->xmit = dev_queue_xmit;
+@@ -4302,7 +4316,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ req3->tp_sizeof_priv ||
+ req3->tp_feature_req_word) {
+ err = -EINVAL;
+- goto out;
++ goto out_free_pg_vec;
+ }
+ }
+ break;
+@@ -4366,6 +4380,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ prb_shutdown_retire_blk_timer(po, rb_queue);
+ }
+
++out_free_pg_vec:
+ if (pg_vec)
+ free_pg_vec(pg_vec, order, req->tp_block_nr);
+ out:
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index 3bb7c5fb3bff..c70a2794456f 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -128,6 +128,7 @@ struct packet_sock {
+ unsigned int tp_hdrlen;
+ unsigned int tp_reserve;
+ unsigned int tp_tstamp;
++ struct completion skb_completion;
+ struct net_device __rcu *cached_dev;
+ int (*xmit)(struct sk_buff *skb);
+ struct packet_type prot_hook ____cacheline_aligned_in_smp;
+diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
+index 40c7eb941bc9..c99114eaf42e 100644
+--- a/net/sctp/endpointola.c
++++ b/net/sctp/endpointola.c
+@@ -126,10 +126,6 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
+ /* Initialize the bind addr area */
+ sctp_bind_addr_init(&ep->base.bind_addr, 0);
+
+- /* Remember who we are attached to. */
+- ep->base.sk = sk;
+- sock_hold(ep->base.sk);
+-
+ /* Create the lists of associations. */
+ INIT_LIST_HEAD(&ep->asocs);
+
+@@ -167,6 +163,10 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
+ ep->prsctp_enable = net->sctp.prsctp_enable;
+ ep->reconf_enable = net->sctp.reconf_enable;
+
++ /* Remember who we are attached to. */
++ ep->base.sk = sk;
++ sock_hold(ep->base.sk);
++
+ return ep;
+
+ nomem_hmacs:
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 1fc812ba9871..7e4553dbc3c7 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1558,7 +1558,6 @@ call_reserveresult(struct rpc_task *task)
+ task->tk_status = 0;
+ if (status >= 0) {
+ if (task->tk_rqstp) {
+- xprt_request_init(task);
+ task->tk_action = call_refresh;
+ return;
+ }
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index d066aae3cb6d..3581168e6b99 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -1257,6 +1257,55 @@ void xprt_free(struct rpc_xprt *xprt)
+ }
+ EXPORT_SYMBOL_GPL(xprt_free);
+
++static __be32
++xprt_alloc_xid(struct rpc_xprt *xprt)
++{
++ __be32 xid;
++
++ spin_lock(&xprt->reserve_lock);
++ xid = (__force __be32)xprt->xid++;
++ spin_unlock(&xprt->reserve_lock);
++ return xid;
++}
++
++static void
++xprt_init_xid(struct rpc_xprt *xprt)
++{
++ xprt->xid = prandom_u32();
++}
++
++static void
++xprt_request_init(struct rpc_task *task)
++{
++ struct rpc_xprt *xprt = task->tk_xprt;
++ struct rpc_rqst *req = task->tk_rqstp;
++
++ INIT_LIST_HEAD(&req->rq_list);
++ req->rq_timeout = task->tk_client->cl_timeout->to_initval;
++ req->rq_task = task;
++ req->rq_xprt = xprt;
++ req->rq_buffer = NULL;
++ req->rq_xid = xprt_alloc_xid(xprt);
++ req->rq_connect_cookie = xprt->connect_cookie - 1;
++ req->rq_bytes_sent = 0;
++ req->rq_snd_buf.len = 0;
++ req->rq_snd_buf.buflen = 0;
++ req->rq_rcv_buf.len = 0;
++ req->rq_rcv_buf.buflen = 0;
++ req->rq_release_snd_buf = NULL;
++ xprt_reset_majortimeo(req);
++ dprintk("RPC: %5u reserved req %p xid %08x\n", task->tk_pid,
++ req, ntohl(req->rq_xid));
++}
++
++static void
++xprt_do_reserve(struct rpc_xprt *xprt, struct rpc_task *task)
++{
++ xprt->ops->alloc_slot(xprt, task);
++ if (task->tk_rqstp != NULL)
++ xprt_request_init(task);
++}
++
+ /**
+ * xprt_reserve - allocate an RPC request slot
+ * @task: RPC task requesting a slot allocation
+@@ -1276,7 +1325,7 @@ void xprt_reserve(struct rpc_task *task)
+ task->tk_timeout = 0;
+ task->tk_status = -EAGAIN;
+ if (!xprt_throttle_congested(xprt, task))
+- xprt->ops->alloc_slot(xprt, task);
++ xprt_do_reserve(xprt, task);
+ }
+
+ /**
+@@ -1298,45 +1347,7 @@ void xprt_retry_reserve(struct rpc_task *task)
+
+ task->tk_timeout = 0;
+ task->tk_status = -EAGAIN;
+- xprt->ops->alloc_slot(xprt, task);
+-}
+-
+-static inline __be32 xprt_alloc_xid(struct rpc_xprt *xprt)
+-{
+- __be32 xid;
+-
+- spin_lock(&xprt->reserve_lock);
+- xid = (__force __be32)xprt->xid++;
+- spin_unlock(&xprt->reserve_lock);
+- return xid;
+-}
+-
+-static inline void xprt_init_xid(struct rpc_xprt *xprt)
+-{
+- xprt->xid = prandom_u32();
+-}
+-
+-void xprt_request_init(struct rpc_task *task)
+-{
+- struct rpc_xprt *xprt = task->tk_xprt;
+- struct rpc_rqst *req = task->tk_rqstp;
+-
+- INIT_LIST_HEAD(&req->rq_list);
+- req->rq_timeout = task->tk_client->cl_timeout->to_initval;
+- req->rq_task = task;
+- req->rq_xprt = xprt;
+- req->rq_buffer = NULL;
+- req->rq_xid = xprt_alloc_xid(xprt);
+- req->rq_connect_cookie = xprt->connect_cookie - 1;
+- req->rq_bytes_sent = 0;
+- req->rq_snd_buf.len = 0;
+- req->rq_snd_buf.buflen = 0;
+- req->rq_rcv_buf.len = 0;
+- req->rq_rcv_buf.buflen = 0;
+- req->rq_release_snd_buf = NULL;
+- xprt_reset_majortimeo(req);
+- dprintk("RPC: %5u reserved req %p xid %08x\n", task->tk_pid,
+- req, ntohl(req->rq_xid));
++ xprt_do_reserve(xprt, task);
+ }
+
+ /**
+diff --git a/net/tipc/core.c b/net/tipc/core.c
+index 3ecca3b88bf8..eb0f701f9bf1 100644
+--- a/net/tipc/core.c
++++ b/net/tipc/core.c
+@@ -132,7 +132,7 @@ static int __init tipc_init(void)
+ if (err)
+ goto out_sysctl;
+
+- err = register_pernet_subsys(&tipc_net_ops);
++ err = register_pernet_device(&tipc_net_ops);
+ if (err)
+ goto out_pernet;
+
+@@ -140,7 +140,7 @@ static int __init tipc_init(void)
+ if (err)
+ goto out_socket;
+
+- err = register_pernet_subsys(&tipc_topsrv_net_ops);
++ err = register_pernet_device(&tipc_topsrv_net_ops);
+ if (err)
+ goto out_pernet_topsrv;
+
+@@ -151,11 +151,11 @@ static int __init tipc_init(void)
+ pr_info("Started in single node mode\n");
+ return 0;
+ out_bearer:
+- unregister_pernet_subsys(&tipc_topsrv_net_ops);
++ unregister_pernet_device(&tipc_topsrv_net_ops);
+ out_pernet_topsrv:
+ tipc_socket_stop();
+ out_socket:
+- unregister_pernet_subsys(&tipc_net_ops);
++ unregister_pernet_device(&tipc_net_ops);
+ out_pernet:
+ tipc_unregister_sysctl();
+ out_sysctl:
+@@ -170,9 +170,9 @@ out_netlink:
+ static void __exit tipc_exit(void)
+ {
+ tipc_bearer_cleanup();
+- unregister_pernet_subsys(&tipc_topsrv_net_ops);
++ unregister_pernet_device(&tipc_topsrv_net_ops);
+ tipc_socket_stop();
+- unregister_pernet_subsys(&tipc_net_ops);
++ unregister_pernet_device(&tipc_net_ops);
+ tipc_netlink_stop();
+ tipc_netlink_compat_stop();
+ tipc_unregister_sysctl();
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 588d5aa14c41..85ebb675600c 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -445,7 +445,11 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd,
+ if (!bearer)
+ return -EMSGSIZE;
+
+- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
++ len = TLV_GET_DATA_LEN(msg->req);
++ if (len <= 0)
++ return -EINVAL;
++
++ len = min_t(int, len, TIPC_MAX_BEARER_NAME);
+ if (!string_is_valid(name, len))
+ return -EINVAL;
+
+@@ -537,7 +541,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
+
+ name = (char *)TLV_DATA(msg->req);
+
+- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
++ len = TLV_GET_DATA_LEN(msg->req);
++ if (len <= 0)
++ return -EINVAL;
++
++ len = min_t(int, len, TIPC_MAX_BEARER_NAME);
+ if (!string_is_valid(name, len))
+ return -EINVAL;
+
+@@ -815,7 +823,11 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
+ if (!link)
+ return -EMSGSIZE;
+
+- len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
++ len = TLV_GET_DATA_LEN(msg->req);
++ if (len <= 0)
++ return -EINVAL;
++
++ len = min_t(int, len, TIPC_MAX_BEARER_NAME);
+ if (!string_is_valid(name, len))
+ return -EINVAL;
+
+diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
+index da2d311476ab..382c84d9339d 100644
+--- a/net/tipc/udp_media.c
++++ b/net/tipc/udp_media.c
+@@ -176,7 +176,6 @@ static int tipc_udp_xmit(struct net *net, struct sk_buff *skb,
+ goto tx_error;
+ }
+
+- skb->dev = rt->dst.dev;
+ ttl = ip4_dst_hoplimit(&rt->dst);
+ udp_tunnel_xmit_skb(rt, ub->ubsock->sk, skb, src->ipv4.s_addr,
+ dst->ipv4.s_addr, 0, ttl, 0, src->port,
+@@ -195,10 +194,9 @@ static int tipc_udp_xmit(struct net *net, struct sk_buff *skb,
+ if (err)
+ goto tx_error;
+ ttl = ip6_dst_hoplimit(ndst);
+- err = udp_tunnel6_xmit_skb(ndst, ub->ubsock->sk, skb,
+- ndst->dev, &src->ipv6,
+- &dst->ipv6, 0, ttl, 0, src->port,
+- dst->port, false);
++ err = udp_tunnel6_xmit_skb(ndst, ub->ubsock->sk, skb, NULL,
++ &src->ipv6, &dst->ipv6, 0, ttl, 0,
++ src->port, dst->port, false);
+ #endif
+ }
+ return err;
+diff --git a/tools/perf/builtin-help.c b/tools/perf/builtin-help.c
+index 1c41b4eaf73c..3d29d0524a89 100644
+--- a/tools/perf/builtin-help.c
++++ b/tools/perf/builtin-help.c
+@@ -189,7 +189,7 @@ static void add_man_viewer(const char *name)
+ while (*p)
+ p = &((*p)->next);
+ *p = zalloc(sizeof(**p) + len + 1);
+- strncpy((*p)->name, name, len);
++ strcpy((*p)->name, name);
+ }
+
+ static int supported_man_viewer(const char *name, size_t len)
+diff --git a/tools/perf/ui/tui/helpline.c b/tools/perf/ui/tui/helpline.c
+index 4ca799aadb4e..93d6b7240285 100644
+--- a/tools/perf/ui/tui/helpline.c
++++ b/tools/perf/ui/tui/helpline.c
+@@ -24,7 +24,7 @@ static void tui_helpline__push(const char *msg)
+ SLsmg_set_color(0);
+ SLsmg_write_nstring((char *)msg, SLtt_Screen_Cols);
+ SLsmg_refresh();
+- strncpy(ui_helpline__current, msg, sz)[sz - 1] = '\0';
++ strlcpy(ui_helpline__current, msg, sz);
+ }
+
+ static int tui_helpline__show(const char *format, va_list ap)
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index bd9226bc5945..b9a82598e2ac 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -3562,7 +3562,7 @@ perf_event__synthesize_event_update_name(struct perf_tool *tool,
+ if (ev == NULL)
+ return -ENOMEM;
+
+- strncpy(ev->data, evsel->name, len);
++ strlcpy(ev->data, evsel->name, len + 1);
+ err = process(tool, (union perf_event*) ev, NULL, NULL);
+ free(ev);
+ return err;
+diff --git a/tools/testing/selftests/bpf/test_lpm_map.c b/tools/testing/selftests/bpf/test_lpm_map.c
+index 02d7c871862a..006be3963977 100644
+--- a/tools/testing/selftests/bpf/test_lpm_map.c
++++ b/tools/testing/selftests/bpf/test_lpm_map.c
+@@ -573,13 +573,13 @@ static void test_lpm_get_next_key(void)
+
+ /* add one more element (total two) */
+ key_p->prefixlen = 24;
+- inet_pton(AF_INET, "192.168.0.0", key_p->data);
++ inet_pton(AF_INET, "192.168.128.0", key_p->data);
+ assert(bpf_map_update_elem(map_fd, key_p, &value, 0) == 0);
+
+ memset(key_p, 0, key_size);
+ assert(bpf_map_get_next_key(map_fd, NULL, key_p) == 0);
+ assert(key_p->prefixlen == 24 && key_p->data[0] == 192 &&
+- key_p->data[1] == 168 && key_p->data[2] == 0);
++ key_p->data[1] == 168 && key_p->data[2] == 128);
+
+ memset(next_key_p, 0, key_size);
+ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
+@@ -592,7 +592,7 @@ static void test_lpm_get_next_key(void)
+
+ /* Add one more element (total three) */
+ key_p->prefixlen = 24;
+- inet_pton(AF_INET, "192.168.128.0", key_p->data);
++ inet_pton(AF_INET, "192.168.0.0", key_p->data);
+ assert(bpf_map_update_elem(map_fd, key_p, &value, 0) == 0);
+
+ memset(key_p, 0, key_size);
+@@ -643,6 +643,41 @@ static void test_lpm_get_next_key(void)
+ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == -1 &&
+ errno == ENOENT);
+
++ /* Add one more element (total five) */
++ key_p->prefixlen = 28;
++ inet_pton(AF_INET, "192.168.1.128", key_p->data);
++ assert(bpf_map_update_elem(map_fd, key_p, &value, 0) == 0);
++
++ memset(key_p, 0, key_size);
++ assert(bpf_map_get_next_key(map_fd, NULL, key_p) == 0);
++ assert(key_p->prefixlen == 24 && key_p->data[0] == 192 &&
++ key_p->data[1] == 168 && key_p->data[2] == 0);
++
++ memset(next_key_p, 0, key_size);
++ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
++ assert(next_key_p->prefixlen == 28 && next_key_p->data[0] == 192 &&
++ next_key_p->data[1] == 168 && next_key_p->data[2] == 1 &&
++ next_key_p->data[3] == 128);
++
++ memcpy(key_p, next_key_p, key_size);
++ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
++ assert(next_key_p->prefixlen == 24 && next_key_p->data[0] == 192 &&
++ next_key_p->data[1] == 168 && next_key_p->data[2] == 1);
++
++ memcpy(key_p, next_key_p, key_size);
++ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
++ assert(next_key_p->prefixlen == 24 && next_key_p->data[0] == 192 &&
++ next_key_p->data[1] == 168 && next_key_p->data[2] == 128);
++
++ memcpy(key_p, next_key_p, key_size);
++ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
++ assert(next_key_p->prefixlen == 16 && next_key_p->data[0] == 192 &&
++ next_key_p->data[1] == 168);
++
++ memcpy(key_p, next_key_p, key_size);
++ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == -1 &&
++ errno == ENOENT);
++
+ /* no exact matching key should return the first one in post order */
+ key_p->prefixlen = 22;
+ inet_pton(AF_INET, "192.168.1.0", key_p->data);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-07-10 11:05 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-07-10 11:05 UTC (permalink / raw
To: gentoo-commits
commit: 25100e2d5df6fea87a66b939447171dd8e2206f0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 10 11:05:37 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 10 11:05:37 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=25100e2d
Linux patch 4.19.58
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1057_linux-4.19.58.patch | 2341 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2345 insertions(+)
diff --git a/0000_README b/0000_README
index 82a9cde..9cbece9 100644
--- a/0000_README
+++ b/0000_README
@@ -271,6 +271,10 @@ Patch: 1056_linux-4.19.57.patch
From: https://www.kernel.org
Desc: Linux 4.19.57
+Patch: 1057_linux-4.19.58.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.58
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1057_linux-4.19.58.patch b/1057_linux-4.19.58.patch
new file mode 100644
index 0000000..72f042d
--- /dev/null
+++ b/1057_linux-4.19.58.patch
@@ -0,0 +1,2341 @@
+diff --git a/Makefile b/Makefile
+index 5412d556b561..5dcd01cd1bf6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 57
++SUBLEVEL = 58
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+index 8d708cc22495..3e7d093d7a9a 100644
+--- a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
++++ b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+@@ -336,3 +336,11 @@
+ status = "disabled";
+ };
+
++&uart0 {
++ compatible = "marvell,armada-38x-uart";
++};
++
++&uart1 {
++ compatible = "marvell,armada-38x-uart";
++};
++
+diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
+index 0b368ceccee4..8644f154ea7a 100644
+--- a/arch/arm64/kernel/module.c
++++ b/arch/arm64/kernel/module.c
+@@ -32,6 +32,7 @@
+
+ void *module_alloc(unsigned long size)
+ {
++ u64 module_alloc_end = module_alloc_base + MODULES_VSIZE;
+ gfp_t gfp_mask = GFP_KERNEL;
+ void *p;
+
+@@ -39,9 +40,12 @@ void *module_alloc(unsigned long size)
+ if (IS_ENABLED(CONFIG_ARM64_MODULE_PLTS))
+ gfp_mask |= __GFP_NOWARN;
+
++ if (IS_ENABLED(CONFIG_KASAN))
++ /* don't exceed the static module region - see below */
++ module_alloc_end = MODULES_END;
++
+ p = __vmalloc_node_range(size, MODULE_ALIGN, module_alloc_base,
+- module_alloc_base + MODULES_VSIZE,
+- gfp_mask, PAGE_KERNEL_EXEC, 0,
++ module_alloc_end, gfp_mask, PAGE_KERNEL_EXEC, 0,
+ NUMA_NO_NODE, __builtin_return_address(0));
+
+ if (!p && IS_ENABLED(CONFIG_ARM64_MODULE_PLTS) &&
+diff --git a/arch/mips/Makefile b/arch/mips/Makefile
+index d74b3742fa5d..ad0a92f95af1 100644
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -16,6 +16,7 @@ archscripts: scripts_basic
+ $(Q)$(MAKE) $(build)=arch/mips/boot/tools relocs
+
+ KBUILD_DEFCONFIG := 32r2el_defconfig
++KBUILD_DTBS := dtbs
+
+ #
+ # Select the object file format to substitute into the linker script.
+@@ -385,7 +386,7 @@ quiet_cmd_64 = OBJCOPY $@
+ vmlinux.64: vmlinux
+ $(call cmd,64)
+
+-all: $(all-y)
++all: $(all-y) $(KBUILD_DTBS)
+
+ # boot
+ $(boot-y): $(vmlinux-32) FORCE
+diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
+index 7755a1fad05a..1b705fb2f10c 100644
+--- a/arch/mips/mm/mmap.c
++++ b/arch/mips/mm/mmap.c
+@@ -203,7 +203,7 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
+
+ int __virt_addr_valid(const volatile void *kaddr)
+ {
+- unsigned long vaddr = (unsigned long)vaddr;
++ unsigned long vaddr = (unsigned long)kaddr;
+
+ if ((vaddr < PAGE_OFFSET) || (vaddr >= MAP_BASE))
+ return 0;
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index 067714291643..8c4fda52b91d 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -391,6 +391,7 @@ static struct work_registers build_get_work_registers(u32 **p)
+ static void build_restore_work_registers(u32 **p)
+ {
+ if (scratch_reg >= 0) {
++ uasm_i_ehb(p);
+ UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
+ return;
+ }
+@@ -667,10 +668,12 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r,
+ uasm_i_mtc0(p, 0, C0_PAGEMASK);
+ uasm_il_b(p, r, lid);
+ }
+- if (scratch_reg >= 0)
++ if (scratch_reg >= 0) {
++ uasm_i_ehb(p);
+ UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
+- else
++ } else {
+ UASM_i_LW(p, 1, scratchpad_offset(0), 0);
++ }
+ } else {
+ /* Reset default page size */
+ if (PM_DEFAULT_MASK >> 16) {
+@@ -935,10 +938,12 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
+ uasm_i_jr(p, ptr);
+
+ if (mode == refill_scratch) {
+- if (scratch_reg >= 0)
++ if (scratch_reg >= 0) {
++ uasm_i_ehb(p);
+ UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
+- else
++ } else {
+ UASM_i_LW(p, 1, scratchpad_offset(0), 0);
++ }
+ } else {
+ uasm_i_nop(p);
+ }
+@@ -1255,6 +1260,7 @@ build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l,
+ UASM_i_MTC0(p, odd, C0_ENTRYLO1); /* load it */
+
+ if (c0_scratch_reg >= 0) {
++ uasm_i_ehb(p);
+ UASM_i_MFC0(p, scratch, c0_kscratch(), c0_scratch_reg);
+ build_tlb_write_entry(p, l, r, tlb_random);
+ uasm_l_leave(l, *p);
+@@ -1600,15 +1606,17 @@ static void build_setup_pgd(void)
+ uasm_i_dinsm(&p, a0, 0, 29, 64 - 29);
+ uasm_l_tlbl_goaround1(&l, p);
+ UASM_i_SLL(&p, a0, a0, 11);
+- uasm_i_jr(&p, 31);
+ UASM_i_MTC0(&p, a0, C0_CONTEXT);
++ uasm_i_jr(&p, 31);
++ uasm_i_ehb(&p);
+ } else {
+ /* PGD in c0_KScratch */
+- uasm_i_jr(&p, 31);
+ if (cpu_has_ldpte)
+ UASM_i_MTC0(&p, a0, C0_PWBASE);
+ else
+ UASM_i_MTC0(&p, a0, c0_kscratch(), pgd_reg);
++ uasm_i_jr(&p, 31);
++ uasm_i_ehb(&p);
+ }
+ #else
+ #ifdef CONFIG_SMP
+@@ -1622,13 +1630,16 @@ static void build_setup_pgd(void)
+ UASM_i_LA_mostly(&p, a2, pgdc);
+ UASM_i_SW(&p, a0, uasm_rel_lo(pgdc), a2);
+ #endif /* SMP */
+- uasm_i_jr(&p, 31);
+
+ /* if pgd_reg is allocated, save PGD also to scratch register */
+- if (pgd_reg != -1)
++ if (pgd_reg != -1) {
+ UASM_i_MTC0(&p, a0, c0_kscratch(), pgd_reg);
+- else
++ uasm_i_jr(&p, 31);
++ uasm_i_ehb(&p);
++ } else {
++ uasm_i_jr(&p, 31);
+ uasm_i_nop(&p);
++ }
+ #endif
+ if (p >= (u32 *)tlbmiss_handler_setup_pgd_end)
+ panic("tlbmiss_handler_setup_pgd space exceeded");
+diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
+index f105ae8651c9..f62e347862cc 100644
+--- a/arch/x86/boot/compressed/head_64.S
++++ b/arch/x86/boot/compressed/head_64.S
+@@ -602,10 +602,12 @@ ENTRY(trampoline_32bit_src)
+ 3:
+ /* Set EFER.LME=1 as a precaution in case hypervsior pulls the rug */
+ pushl %ecx
++ pushl %edx
+ movl $MSR_EFER, %ecx
+ rdmsr
+ btsl $_EFER_LME, %eax
+ wrmsr
++ popl %edx
+ popl %ecx
+
+ /* Enable PAE and LA57 (if required) paging modes */
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 058b1a1994c4..2e38fb82b91d 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -52,6 +52,9 @@
+
+ #define INTEL_FAM6_CANNONLAKE_MOBILE 0x66
+
++#define INTEL_FAM6_ICELAKE_X 0x6A
++#define INTEL_FAM6_ICELAKE_XEON_D 0x6C
++#define INTEL_FAM6_ICELAKE_DESKTOP 0x7D
+ #define INTEL_FAM6_ICELAKE_MOBILE 0x7E
+
+ /* "Small Core" Processors (Atom) */
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index 9f033dfd2766..50d309662d78 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -22,6 +22,7 @@
+ #include <linux/init.h>
+ #include <linux/list.h>
+ #include <linux/module.h>
++#include <linux/memory.h>
+
+ #include <trace/syscall.h>
+
+@@ -35,6 +36,7 @@
+
+ int ftrace_arch_code_modify_prepare(void)
+ {
++ mutex_lock(&text_mutex);
+ set_kernel_text_rw();
+ set_all_modules_text_rw();
+ return 0;
+@@ -44,6 +46,7 @@ int ftrace_arch_code_modify_post_process(void)
+ {
+ set_all_modules_text_ro();
+ set_kernel_text_ro();
++ mutex_unlock(&text_mutex);
+ return 0;
+ }
+
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index cba414db14cb..031bd7f91f98 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2275,7 +2275,7 @@ int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu)
+ struct kvm_lapic *apic = vcpu->arch.apic;
+ u32 ppr;
+
+- if (!apic_enabled(apic))
++ if (!kvm_apic_hw_enabled(apic))
+ return -1;
+
+ __apic_update_ppr(apic, &ppr);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 7fed1d6dd1a1..cea6568667c4 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1447,7 +1447,7 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale)
+ vcpu->arch.tsc_always_catchup = 1;
+ return 0;
+ } else {
+- WARN(1, "user requested TSC rate below hardware speed\n");
++ pr_warn_ratelimited("user requested TSC rate below hardware speed\n");
+ return -1;
+ }
+ }
+@@ -1457,8 +1457,8 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale)
+ user_tsc_khz, tsc_khz);
+
+ if (ratio == 0 || ratio >= kvm_max_tsc_scaling_ratio) {
+- WARN_ONCE(1, "Invalid TSC scaling ratio - virtual-tsc-khz=%u\n",
+- user_tsc_khz);
++ pr_warn_ratelimited("Invalid TSC scaling ratio - virtual-tsc-khz=%u\n",
++ user_tsc_khz);
+ return -1;
+ }
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 6eed5d84c2ef..682bc561b77b 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -2445,10 +2445,8 @@ blk_qc_t generic_make_request(struct bio *bio)
+ flags = 0;
+ if (bio->bi_opf & REQ_NOWAIT)
+ flags = BLK_MQ_REQ_NOWAIT;
+- if (blk_queue_enter(q, flags) < 0) {
++ if (blk_queue_enter(q, flags) < 0)
+ enter_succeeded = false;
+- q = NULL;
+- }
+ }
+
+ if (enter_succeeded) {
+@@ -2479,6 +2477,7 @@ blk_qc_t generic_make_request(struct bio *bio)
+ bio_wouldblock_error(bio);
+ else
+ bio_io_error(bio);
++ q = NULL;
+ }
+ bio = bio_list_pop(&bio_list_on_stack[0]);
+ } while (bio);
+diff --git a/crypto/cryptd.c b/crypto/cryptd.c
+index addca7bae33f..e0c8e907b086 100644
+--- a/crypto/cryptd.c
++++ b/crypto/cryptd.c
+@@ -586,6 +586,7 @@ static void cryptd_skcipher_free(struct skcipher_instance *inst)
+ struct skcipherd_instance_ctx *ctx = skcipher_instance_ctx(inst);
+
+ crypto_drop_skcipher(&ctx->spawn);
++ kfree(inst);
+ }
+
+ static int cryptd_create_skcipher(struct crypto_template *tmpl,
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index ceeb2eaf28cf..3cca814348a2 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -55,6 +55,9 @@ static struct crypto_alg *crypto_alg_match(struct crypto_user_alg *p, int exact)
+ list_for_each_entry(q, &crypto_alg_list, cra_list) {
+ int match = 0;
+
++ if (crypto_is_larval(q))
++ continue;
++
+ if ((q->cra_flags ^ p->cru_type) & p->cru_mask)
+ continue;
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index cb1b44d78a1f..1c658ec3cbf4 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -681,7 +681,7 @@ static int sdma_load_script(struct sdma_engine *sdma, void *buf, int size,
+ spin_lock_irqsave(&sdma->channel_0_lock, flags);
+
+ bd0->mode.command = C0_SETPM;
+- bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD;
++ bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD;
+ bd0->mode.count = size / 2;
+ bd0->buffer_addr = buf_phys;
+ bd0->ext_buffer_addr = address;
+@@ -1000,7 +1000,7 @@ static int sdma_load_context(struct sdma_channel *sdmac)
+ context->gReg[7] = sdmac->watermark_level;
+
+ bd0->mode.command = C0_SETDM;
+- bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD;
++ bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD;
+ bd0->mode.count = sizeof(*context) / 4;
+ bd0->buffer_addr = sdma->context_phys;
+ bd0->ext_buffer_addr = 2048 + (sizeof(*context) / 4) * channel;
+diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c
+index 1617715aa6e0..489c8fa4d2e2 100644
+--- a/drivers/dma/qcom/bam_dma.c
++++ b/drivers/dma/qcom/bam_dma.c
+@@ -808,6 +808,9 @@ static u32 process_channel_irqs(struct bam_device *bdev)
+ /* Number of bytes available to read */
+ avail = CIRC_CNT(offset, bchan->head, MAX_DESCRIPTORS + 1);
+
++ if (offset < bchan->head)
++ avail--;
++
+ list_for_each_entry_safe(async_desc, tmp,
+ &bchan->desc_list, desc_node) {
+ /* Not enough data to read */
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 325e2213cac5..46568497ef18 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -1801,25 +1801,6 @@ static void gfx_v9_0_gpu_init(struct amdgpu_device *adev)
+ mutex_unlock(&adev->srbm_mutex);
+
+ gfx_v9_0_init_compute_vmid(adev);
+-
+- mutex_lock(&adev->grbm_idx_mutex);
+- /*
+- * making sure that the following register writes will be broadcasted
+- * to all the shaders
+- */
+- gfx_v9_0_select_se_sh(adev, 0xffffffff, 0xffffffff, 0xffffffff);
+-
+- WREG32_SOC15(GC, 0, mmPA_SC_FIFO_SIZE,
+- (adev->gfx.config.sc_prim_fifo_size_frontend <<
+- PA_SC_FIFO_SIZE__SC_FRONTEND_PRIM_FIFO_SIZE__SHIFT) |
+- (adev->gfx.config.sc_prim_fifo_size_backend <<
+- PA_SC_FIFO_SIZE__SC_BACKEND_PRIM_FIFO_SIZE__SHIFT) |
+- (adev->gfx.config.sc_hiz_tile_fifo_size <<
+- PA_SC_FIFO_SIZE__SC_HIZ_TILE_FIFO_SIZE__SHIFT) |
+- (adev->gfx.config.sc_earlyz_tile_fifo_size <<
+- PA_SC_FIFO_SIZE__SC_EARLYZ_TILE_FIFO_SIZE__SHIFT));
+- mutex_unlock(&adev->grbm_idx_mutex);
+-
+ }
+
+ static void gfx_v9_0_wait_for_rlc_serdes(struct amdgpu_device *adev)
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c b/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
+index 4e1fd5393845..fbbd5a4877e9 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
+@@ -916,8 +916,10 @@ static int init_thermal_controller(
+ PHM_PlatformCaps_ThermalController
+ );
+
+- if (0 == powerplay_table->usFanTableOffset)
++ if (0 == powerplay_table->usFanTableOffset) {
++ hwmgr->thermal_controller.use_hw_fan_control = 1;
+ return 0;
++ }
+
+ fan_table = (const PPTable_Generic_SubTable_Header *)
+ (((unsigned long)powerplay_table) +
+diff --git a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
+index d3d96260f440..6ee864455a12 100644
+--- a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
++++ b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
+@@ -677,6 +677,7 @@ struct pp_thermal_controller_info {
+ uint8_t ucType;
+ uint8_t ucI2cLine;
+ uint8_t ucI2cAddress;
++ uint8_t use_hw_fan_control;
+ struct pp_fan_info fanInfo;
+ struct pp_advance_fan_control_parameters advanceFanControlParameters;
+ };
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
+index 45629f26dbc2..0dbca3865851 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
+@@ -2038,6 +2038,10 @@ static int polaris10_thermal_setup_fan_table(struct pp_hwmgr *hwmgr)
+ return 0;
+ }
+
++ /* use hardware fan control */
++ if (hwmgr->thermal_controller.use_hw_fan_control)
++ return 0;
++
+ tmp64 = hwmgr->thermal_controller.advanceFanControlParameters.
+ usPWMMin * duty100;
+ do_div(tmp64, 10000);
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index a0663f44e218..8b546fde139d 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -2957,7 +2957,8 @@ static int drm_fbdev_fb_open(struct fb_info *info, int user)
+ {
+ struct drm_fb_helper *fb_helper = info->par;
+
+- if (!try_module_get(fb_helper->dev->driver->fops->owner))
++ /* No need to take a ref for fbcon because it unbinds on unregister */
++ if (user && !try_module_get(fb_helper->dev->driver->fops->owner))
+ return -ENODEV;
+
+ return 0;
+@@ -2967,7 +2968,8 @@ static int drm_fbdev_fb_release(struct fb_info *info, int user)
+ {
+ struct drm_fb_helper *fb_helper = info->par;
+
+- module_put(fb_helper->dev->driver->fops->owner);
++ if (user)
++ module_put(fb_helper->dev->driver->fops->owner);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index ee4a5e1221f1..b44bed554211 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -42,6 +42,14 @@ static const struct drm_dmi_panel_orientation_data asus_t100ha = {
+ .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP,
+ };
+
++static const struct drm_dmi_panel_orientation_data gpd_micropc = {
++ .width = 720,
++ .height = 1280,
++ .bios_dates = (const char * const []){ "04/26/2019",
++ NULL },
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data gpd_pocket = {
+ .width = 1200,
+ .height = 1920,
+@@ -50,6 +58,14 @@ static const struct drm_dmi_panel_orientation_data gpd_pocket = {
+ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+ };
+
++static const struct drm_dmi_panel_orientation_data gpd_pocket2 = {
++ .width = 1200,
++ .height = 1920,
++ .bios_dates = (const char * const []){ "06/28/2018", "08/28/2018",
++ "12/07/2018", NULL },
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data gpd_win = {
+ .width = 720,
+ .height = 1280,
+@@ -85,6 +101,14 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"),
+ },
+ .driver_data = (void *)&asus_t100ha,
++ }, { /* GPD MicroPC (generic strings, also match on bios date) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
++ },
++ .driver_data = (void *)&gpd_micropc,
+ }, { /*
+ * GPD Pocket, note that the the DMI data is less generic then
+ * it seems, devices with a board-vendor of "AMI Corporation"
+@@ -98,6 +122,14 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
+ },
+ .driver_data = (void *)&gpd_pocket,
++ }, { /* GPD Pocket 2 (generic strings, also match on bios date) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
++ },
++ .driver_data = (void *)&gpd_pocket2,
+ }, { /* GPD Win (same note on DMI match as GPD Pocket) */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+index f225fbc6edd2..6a859e077ea0 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+@@ -760,7 +760,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+ if (IS_ERR(gpu->cmdbuf_suballoc)) {
+ dev_err(gpu->dev, "Failed to create cmdbuf suballocator\n");
+ ret = PTR_ERR(gpu->cmdbuf_suballoc);
+- goto fail;
++ goto destroy_iommu;
+ }
+
+ /* Create buffer: */
+@@ -768,7 +768,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+ PAGE_SIZE);
+ if (ret) {
+ dev_err(gpu->dev, "could not create command buffer\n");
+- goto destroy_iommu;
++ goto destroy_suballoc;
+ }
+
+ if (gpu->mmu->version == ETNAVIV_IOMMU_V1 &&
+@@ -800,6 +800,9 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+ free_buffer:
+ etnaviv_cmdbuf_free(&gpu->buffer);
+ gpu->buffer.suballoc = NULL;
++destroy_suballoc:
++ etnaviv_cmdbuf_suballoc_destroy(gpu->cmdbuf_suballoc);
++ gpu->cmdbuf_suballoc = NULL;
+ destroy_iommu:
+ etnaviv_iommu_destroy(gpu->mmu);
+ gpu->mmu = NULL;
+diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
+index cf9b600cca79..ca1a578d790d 100644
+--- a/drivers/gpu/drm/i915/intel_csr.c
++++ b/drivers/gpu/drm/i915/intel_csr.c
+@@ -282,10 +282,17 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv,
+ uint32_t i;
+ uint32_t *dmc_payload;
+ uint32_t required_version;
++ size_t fsize;
+
+ if (!fw)
+ return NULL;
+
++ fsize = sizeof(struct intel_css_header) +
++ sizeof(struct intel_package_header) +
++ sizeof(struct intel_dmc_header);
++ if (fsize > fw->size)
++ goto error_truncated;
++
+ /* Extract CSS Header information*/
+ css_header = (struct intel_css_header *)fw->data;
+ if (sizeof(struct intel_css_header) !=
+@@ -360,6 +367,9 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv,
+ return NULL;
+ }
+ readcount += dmc_offset;
++ fsize += dmc_offset;
++ if (fsize > fw->size)
++ goto error_truncated;
+
+ /* Extract dmc_header information. */
+ dmc_header = (struct intel_dmc_header *)&fw->data[readcount];
+@@ -391,6 +401,10 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv,
+
+ /* fw_size is in dwords, so multiplied by 4 to convert into bytes. */
+ nbytes = dmc_header->fw_size * 4;
++ fsize += nbytes;
++ if (fsize > fw->size)
++ goto error_truncated;
++
+ if (nbytes > CSR_MAX_FW_SIZE) {
+ DRM_ERROR("DMC firmware too big (%u bytes)\n", nbytes);
+ return NULL;
+@@ -404,6 +418,10 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv,
+ }
+
+ return memcpy(dmc_payload, &fw->data[readcount], nbytes);
++
++error_truncated:
++ DRM_ERROR("Truncated DMC firmware, rejecting.\n");
++ return NULL;
+ }
+
+ static void csr_load_work_fn(struct work_struct *work)
+diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
+index 11e2dcdd6b18..ff34f9bb55a1 100644
+--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
+@@ -98,14 +98,14 @@ static void ipu_crtc_atomic_disable(struct drm_crtc *crtc,
+ ipu_dc_disable(ipu);
+ ipu_prg_disable(ipu);
+
++ drm_crtc_vblank_off(crtc);
++
+ spin_lock_irq(&crtc->dev->event_lock);
+- if (crtc->state->event) {
++ if (crtc->state->event && !crtc->state->active) {
+ drm_crtc_send_vblank_event(crtc, crtc->state->event);
+ crtc->state->event = NULL;
+ }
+ spin_unlock_irq(&crtc->dev->event_lock);
+-
+- drm_crtc_vblank_off(crtc);
+ }
+
+ static void imx_drm_crtc_reset(struct drm_crtc *crtc)
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+index 47ec604289b7..fd83046d8376 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -310,6 +310,7 @@ err_config_cleanup:
+ static void mtk_drm_kms_deinit(struct drm_device *drm)
+ {
+ drm_kms_helper_poll_fini(drm);
++ drm_atomic_helper_shutdown(drm);
+
+ component_unbind_all(drm->dev, drm);
+ drm_mode_config_cleanup(drm);
+@@ -390,7 +391,9 @@ static void mtk_drm_unbind(struct device *dev)
+ struct mtk_drm_private *private = dev_get_drvdata(dev);
+
+ drm_dev_unregister(private->drm);
++ mtk_drm_kms_deinit(private->drm);
+ drm_dev_put(private->drm);
++ private->num_pipes = 0;
+ private->drm = NULL;
+ }
+
+@@ -559,13 +562,8 @@ err_node:
+ static int mtk_drm_remove(struct platform_device *pdev)
+ {
+ struct mtk_drm_private *private = platform_get_drvdata(pdev);
+- struct drm_device *drm = private->drm;
+ int i;
+
+- drm_dev_unregister(drm);
+- mtk_drm_kms_deinit(drm);
+- drm_dev_put(drm);
+-
+ component_master_del(&pdev->dev, &mtk_drm_ops);
+ pm_runtime_disable(&pdev->dev);
+ of_node_put(private->mutex_node);
+diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
+index 66df1b177959..0dd317ac5fe5 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
+@@ -630,6 +630,15 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi)
+ if (--dsi->refcount != 0)
+ return;
+
++ /*
++ * mtk_dsi_stop() and mtk_dsi_start() is asymmetric, since
++ * mtk_dsi_stop() should be called after mtk_drm_crtc_atomic_disable(),
++ * which needs irq for vblank, and mtk_dsi_stop() will disable irq.
++ * mtk_dsi_start() needs to be called in mtk_output_dsi_enable(),
++ * after dsi is fully set.
++ */
++ mtk_dsi_stop(dsi);
++
+ if (!mtk_dsi_switch_to_cmd_mode(dsi, VM_DONE_INT_FLAG, 500)) {
+ if (dsi->panel) {
+ if (drm_panel_unprepare(dsi->panel)) {
+@@ -696,7 +705,6 @@ static void mtk_output_dsi_disable(struct mtk_dsi *dsi)
+ }
+ }
+
+- mtk_dsi_stop(dsi);
+ mtk_dsi_poweroff(dsi);
+
+ dsi->enabled = false;
+@@ -841,6 +849,8 @@ static void mtk_dsi_destroy_conn_enc(struct mtk_dsi *dsi)
+ /* Skip connector cleanup if creation was delegated to the bridge */
+ if (dsi->conn.dev)
+ drm_connector_cleanup(&dsi->conn);
++ if (dsi->panel)
++ drm_panel_detach(dsi->panel);
+ }
+
+ static void mtk_dsi_ddp_start(struct mtk_ddp_comp *comp)
+diff --git a/drivers/i2c/busses/i2c-pca-platform.c b/drivers/i2c/busses/i2c-pca-platform.c
+index de3fe6e828cb..f50afa8e3cba 100644
+--- a/drivers/i2c/busses/i2c-pca-platform.c
++++ b/drivers/i2c/busses/i2c-pca-platform.c
+@@ -21,7 +21,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/i2c-algo-pca.h>
+ #include <linux/platform_data/i2c-pca-platform.h>
+-#include <linux/gpio.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/io.h>
+ #include <linux/of.h>
+@@ -173,7 +172,7 @@ static int i2c_pca_pf_probe(struct platform_device *pdev)
+ i2c->adap.dev.parent = &pdev->dev;
+ i2c->adap.dev.of_node = np;
+
+- i2c->gpio = devm_gpiod_get_optional(&pdev->dev, "reset-gpios", GPIOD_OUT_LOW);
++ i2c->gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_OUT_LOW);
+ if (IS_ERR(i2c->gpio))
+ return PTR_ERR(i2c->gpio);
+
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index ac1cffd2a09b..f4daa56d204d 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -547,6 +547,7 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio)
+ trace_block_bio_remap(bdev_get_queue(rdev->bdev),
+ discard_bio, disk_devt(mddev->gendisk),
+ bio->bi_iter.bi_sector);
++ bio_clear_flag(bio, BIO_QUEUE_ENTERED);
+ generic_make_request(discard_bio);
+ }
+ bio_endio(bio);
+@@ -602,6 +603,7 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio)
+ disk_devt(mddev->gendisk), bio_sector);
+ mddev_check_writesame(mddev, bio);
+ mddev_check_write_zeroes(mddev, bio);
++ bio_clear_flag(bio, BIO_QUEUE_ENTERED);
+ generic_make_request(bio);
+ return true;
+ }
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+index 927a1235408d..ca11f8a7569d 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+@@ -1089,7 +1089,6 @@ static struct device *s5p_mfc_alloc_memdev(struct device *dev,
+ device_initialize(child);
+ dev_set_name(child, "%s:%s", dev_name(dev), name);
+ child->parent = dev;
+- child->bus = dev->bus;
+ child->coherent_dma_mask = dev->coherent_dma_mask;
+ child->dma_mask = dev->dma_mask;
+ child->release = s5p_mfc_memdev_release;
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+index fdff5526d2e8..f2b0b587a1be 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+@@ -2777,7 +2777,7 @@ static void set_promisc_tcam_enable(struct dsaf_device *dsaf_dev, u32 port)
+ struct hns_mac_cb *mac_cb;
+ u8 addr[ETH_ALEN] = {0};
+ u8 port_num;
+- u16 mskid;
++ int mskid;
+
+ /* promisc use vague table match with vlanid = 0 & macaddr = 0 */
+ hns_dsaf_set_mac_key(dsaf_dev, &mac_key, 0x00, port, addr);
+@@ -3149,6 +3149,9 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
+ dsaf_set_bit(credit, DSAF_SBM_ROCEE_CFG_CRD_EN_B, 1);
+ dsaf_write_dev(dsaf_dev, DSAF_SBM_ROCEE_CFG_REG_REG, credit);
+ }
++
++ put_device(&pdev->dev);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(hns_dsaf_roce_reset);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index ff2f6b8e2fab..0cab06046e5d 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -4681,6 +4681,16 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
+ } else if (netif_is_macvlan(upper_dev)) {
+ if (!info->linking)
+ mlxsw_sp_rif_macvlan_del(mlxsw_sp, upper_dev);
++ } else if (is_vlan_dev(upper_dev)) {
++ struct net_device *br_dev;
++
++ if (!netif_is_bridge_port(upper_dev))
++ break;
++ if (info->linking)
++ break;
++ br_dev = netdev_master_upper_dev_get(upper_dev);
++ mlxsw_sp_port_bridge_leave(mlxsw_sp_port, upper_dev,
++ br_dev);
+ }
+ break;
+ }
+diff --git a/drivers/platform/mellanox/mlxreg-hotplug.c b/drivers/platform/mellanox/mlxreg-hotplug.c
+index eca16d00e310..d52c821b8584 100644
+--- a/drivers/platform/mellanox/mlxreg-hotplug.c
++++ b/drivers/platform/mellanox/mlxreg-hotplug.c
+@@ -673,6 +673,7 @@ static int mlxreg_hotplug_remove(struct platform_device *pdev)
+
+ /* Clean interrupts setup. */
+ mlxreg_hotplug_unset_irq(priv);
++ devm_free_irq(&pdev->dev, priv->irq, priv);
+
+ return 0;
+ }
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index b6f2ff95c3ed..59f3a37a44d7 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -78,10 +78,12 @@ static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str,
+
+ static struct quirk_entry quirk_asus_unknown = {
+ .wapf = 0,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_q500a = {
+ .i8042_filter = asus_q500a_i8042_filter,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ /*
+@@ -92,26 +94,32 @@ static struct quirk_entry quirk_asus_q500a = {
+ static struct quirk_entry quirk_asus_x55u = {
+ .wapf = 4,
+ .wmi_backlight_power = true,
++ .wmi_backlight_set_devstate = true,
+ .no_display_toggle = true,
+ };
+
+ static struct quirk_entry quirk_asus_wapf4 = {
+ .wapf = 4,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_x200ca = {
+ .wapf = 2,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_ux303ub = {
+ .wmi_backlight_native = true,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_x550lb = {
++ .wmi_backlight_set_devstate = true,
+ .xusb2pr = 0x01D9,
+ };
+
+ static struct quirk_entry quirk_asus_forceals = {
++ .wmi_backlight_set_devstate = true,
+ .wmi_force_als_set = true,
+ };
+
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index db3556dc90d1..22eac449d3a3 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -2231,7 +2231,7 @@ static int asus_wmi_add(struct platform_device *pdev)
+ err = asus_wmi_backlight_init(asus);
+ if (err && err != -ENODEV)
+ goto fail_backlight;
+- } else
++ } else if (asus->driver->quirks->wmi_backlight_set_devstate)
+ err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL);
+
+ status = wmi_install_notify_handler(asus->driver->event_guid,
+diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
+index 6c1311f4b04d..57a79bddb286 100644
+--- a/drivers/platform/x86/asus-wmi.h
++++ b/drivers/platform/x86/asus-wmi.h
+@@ -44,6 +44,7 @@ struct quirk_entry {
+ bool store_backlight_power;
+ bool wmi_backlight_power;
+ bool wmi_backlight_native;
++ bool wmi_backlight_set_devstate;
+ bool wmi_force_als_set;
+ int wapf;
+ /*
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index 06cd7e818ed5..a0d0cecff55f 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -76,12 +76,24 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)
+ struct platform_device *device = context;
+ struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev);
+ unsigned int val = !(event & 1); /* Even=press, Odd=release */
+- const struct key_entry *ke_rel;
++ const struct key_entry *ke, *ke_rel;
+ bool autorelease;
+
+ if (priv->wakeup_mode) {
+- if (sparse_keymap_entry_from_scancode(priv->input_dev, event)) {
++ ke = sparse_keymap_entry_from_scancode(priv->input_dev, event);
++ if (ke) {
+ pm_wakeup_hard_event(&device->dev);
++
++ /*
++ * Switch events like tablet mode will wake the device
++ * and report the new switch position to the input
++ * subsystem.
++ */
++ if (ke->type == KE_SW)
++ sparse_keymap_report_event(priv->input_dev,
++ event,
++ val,
++ 0);
+ return;
+ }
+ goto out_unknown;
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 78b4aa4410fb..742a0c217925 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -1626,7 +1626,7 @@ static int __init mlxplat_init(void)
+
+ for (i = 0; i < ARRAY_SIZE(mlxplat_mux_data); i++) {
+ priv->pdev_mux[i] = platform_device_register_resndata(
+- &mlxplat_dev->dev,
++ &priv->pdev_i2c->dev,
+ "i2c-mux-reg", i, NULL,
+ 0, &mlxplat_mux_data[i],
+ sizeof(mlxplat_mux_data[i]));
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index c120929d4ffe..c43eccdea65d 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -4923,7 +4923,7 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h,
+ curr_sg->reserved[0] = 0;
+ curr_sg->reserved[1] = 0;
+ curr_sg->reserved[2] = 0;
+- curr_sg->chain_indicator = 0x80;
++ curr_sg->chain_indicator = IOACCEL2_CHAIN;
+
+ curr_sg = h->ioaccel2_cmd_sg_list[c->cmdindex];
+ }
+@@ -4940,6 +4940,11 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h,
+ curr_sg++;
+ }
+
++ /*
++ * Set the last s/g element bit
++ */
++ (curr_sg - 1)->chain_indicator = IOACCEL2_LAST_SG;
++
+ switch (cmd->sc_data_direction) {
+ case DMA_TO_DEVICE:
+ cp->direction &= ~IOACCEL2_DIRECTION_MASK;
+diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h
+index 21a726e2eec6..f6afca4b2319 100644
+--- a/drivers/scsi/hpsa_cmd.h
++++ b/drivers/scsi/hpsa_cmd.h
+@@ -517,6 +517,7 @@ struct ioaccel2_sg_element {
+ u8 reserved[3];
+ u8 chain_indicator;
+ #define IOACCEL2_CHAIN 0x80
++#define IOACCEL2_LAST_SG 0x40
+ };
+
+ /*
+diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
+index f29176000b8d..06cf9388e74f 100644
+--- a/drivers/spi/spi-bitbang.c
++++ b/drivers/spi/spi-bitbang.c
+@@ -416,7 +416,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang)
+ if (ret)
+ spi_master_put(master);
+
+- return 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(spi_bitbang_start);
+
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index ac7620120491..c46efa47d68a 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -1317,12 +1317,13 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
+ * target_complete_cmd will translate this to LUN COMM FAILURE
+ */
+ scsi_status = SAM_STAT_CHECK_CONDITION;
++ list_del_init(&cmd->queue_entry);
+ } else {
++ list_del_init(&cmd->queue_entry);
+ idr_remove(&udev->commands, id);
+ tcmu_free_cmd(cmd);
+ scsi_status = SAM_STAT_TASK_SET_FULL;
+ }
+- list_del_init(&cmd->queue_entry);
+
+ pr_debug("Timing out cmd %u on dev %s that is %s.\n",
+ id, udev->name, is_running ? "inflight" : "queued");
+diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c
+index b121d8f8f3d7..27aeca30eeae 100644
+--- a/drivers/tty/rocket.c
++++ b/drivers/tty/rocket.c
+@@ -266,7 +266,7 @@ MODULE_PARM_DESC(pc104_3, "set interface types for ISA(PC104) board #3 (e.g. pc1
+ module_param_array(pc104_4, ulong, NULL, 0);
+ MODULE_PARM_DESC(pc104_4, "set interface types for ISA(PC104) board #4 (e.g. pc104_4=232,232,485,485,...");
+
+-static int rp_init(void);
++static int __init rp_init(void);
+ static void rp_cleanup_module(void);
+
+ module_init(rp_init);
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index 55b178c1bd65..372cc7ff228f 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1494,10 +1494,12 @@ static int __init sc16is7xx_init(void)
+ #endif
+ return ret;
+
++#ifdef CONFIG_SERIAL_SC16IS7XX_SPI
+ err_spi:
+ #ifdef CONFIG_SERIAL_SC16IS7XX_I2C
+ i2c_del_driver(&sc16is7xx_i2c_uart_driver);
+ #endif
++#endif
+ err_i2c:
+ uart_unregister_driver(&sc16is7xx_uart);
+ return ret;
+diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c
+index 263804d154a7..00e3f66836a9 100644
+--- a/drivers/usb/gadget/udc/fusb300_udc.c
++++ b/drivers/usb/gadget/udc/fusb300_udc.c
+@@ -1342,12 +1342,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = {
+ static int fusb300_remove(struct platform_device *pdev)
+ {
+ struct fusb300 *fusb300 = platform_get_drvdata(pdev);
++ int i;
+
+ usb_del_gadget_udc(&fusb300->gadget);
+ iounmap(fusb300->reg);
+ free_irq(platform_get_irq(pdev, 0), fusb300);
+
+ fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req);
++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
++ kfree(fusb300->ep[i]);
+ kfree(fusb300);
+
+ return 0;
+@@ -1491,6 +1494,8 @@ clean_up:
+ if (fusb300->ep0_req)
+ fusb300_free_request(&fusb300->ep[0]->ep,
+ fusb300->ep0_req);
++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
++ kfree(fusb300->ep[i]);
+ kfree(fusb300);
+ }
+ if (reg)
+diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
+index b0781771704e..eafc2a00c96a 100644
+--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
+@@ -922,8 +922,7 @@ static struct lpc32xx_usbd_dd_gad *udc_dd_alloc(struct lpc32xx_udc *udc)
+ dma_addr_t dma;
+ struct lpc32xx_usbd_dd_gad *dd;
+
+- dd = (struct lpc32xx_usbd_dd_gad *) dma_pool_alloc(
+- udc->dd_cache, (GFP_KERNEL | GFP_DMA), &dma);
++ dd = dma_pool_alloc(udc->dd_cache, GFP_ATOMIC | GFP_DMA, &dma);
+ if (dd)
+ dd->this_dma = dma;
+
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index 8fed470bb7e1..23b13fbecdc2 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -599,17 +599,25 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
+ }
+ btrfs_wait_ordered_roots(fs_info, U64_MAX, 0, (u64)-1);
+
+- trans = btrfs_start_transaction(root, 0);
+- if (IS_ERR(trans)) {
+- mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
+- return PTR_ERR(trans);
++ while (1) {
++ trans = btrfs_start_transaction(root, 0);
++ if (IS_ERR(trans)) {
++ mutex_unlock(&dev_replace->lock_finishing_cancel_unmount);
++ return PTR_ERR(trans);
++ }
++ ret = btrfs_commit_transaction(trans);
++ WARN_ON(ret);
++ /* keep away write_all_supers() during the finishing procedure */
++ mutex_lock(&fs_info->fs_devices->device_list_mutex);
++ mutex_lock(&fs_info->chunk_mutex);
++ if (src_device->has_pending_chunks) {
++ mutex_unlock(&root->fs_info->chunk_mutex);
++ mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
++ } else {
++ break;
++ }
+ }
+- ret = btrfs_commit_transaction(trans);
+- WARN_ON(ret);
+
+- /* keep away write_all_supers() during the finishing procedure */
+- mutex_lock(&fs_info->fs_devices->device_list_mutex);
+- mutex_lock(&fs_info->chunk_mutex);
+ btrfs_dev_replace_write_lock(dev_replace);
+ dev_replace->replace_state =
+ scrub_ret ? BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 207f4e87445d..2fd000308be7 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4873,6 +4873,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
+ for (i = 0; i < map->num_stripes; i++) {
+ num_bytes = map->stripes[i].dev->bytes_used + stripe_size;
+ btrfs_device_set_bytes_used(map->stripes[i].dev, num_bytes);
++ map->stripes[i].dev->has_pending_chunks = true;
+ }
+
+ atomic64_sub(stripe_size * map->num_stripes, &info->free_chunk_space);
+@@ -7348,6 +7349,7 @@ void btrfs_update_commit_device_bytes_used(struct btrfs_transaction *trans)
+ for (i = 0; i < map->num_stripes; i++) {
+ dev = map->stripes[i].dev;
+ dev->commit_bytes_used = dev->bytes_used;
++ dev->has_pending_chunks = false;
+ }
+ }
+ mutex_unlock(&fs_info->chunk_mutex);
+diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
+index 23e9285d88de..c0e3015b1bac 100644
+--- a/fs/btrfs/volumes.h
++++ b/fs/btrfs/volumes.h
+@@ -54,6 +54,11 @@ struct btrfs_device {
+
+ spinlock_t io_lock ____cacheline_aligned;
+ int running_pending;
++ /* When true means this device has pending chunk alloc in
++ * current transaction. Protected by chunk_mutex.
++ */
++ bool has_pending_chunks;
++
+ /* regular prio bios */
+ struct btrfs_pending_bios pending_bios;
+ /* sync bios */
+diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
+index ebe649d9793c..bbe155465ca0 100644
+--- a/fs/f2fs/debug.c
++++ b/fs/f2fs/debug.c
+@@ -94,8 +94,10 @@ static void update_general_status(struct f2fs_sb_info *sbi)
+ si->free_secs = free_sections(sbi);
+ si->prefree_count = prefree_segments(sbi);
+ si->dirty_count = dirty_segments(sbi);
+- si->node_pages = NODE_MAPPING(sbi)->nrpages;
+- si->meta_pages = META_MAPPING(sbi)->nrpages;
++ if (sbi->node_inode)
++ si->node_pages = NODE_MAPPING(sbi)->nrpages;
++ if (sbi->meta_inode)
++ si->meta_pages = META_MAPPING(sbi)->nrpages;
+ si->nats = NM_I(sbi)->nat_cnt;
+ si->dirty_nats = NM_I(sbi)->dirty_nat_cnt;
+ si->sits = MAIN_SEGS(sbi);
+@@ -168,7 +170,6 @@ static void update_sit_info(struct f2fs_sb_info *sbi)
+ static void update_mem_info(struct f2fs_sb_info *sbi)
+ {
+ struct f2fs_stat_info *si = F2FS_STAT(sbi);
+- unsigned npages;
+ int i;
+
+ if (si->base_mem)
+@@ -251,10 +252,14 @@ get_cache:
+ sizeof(struct extent_node);
+
+ si->page_mem = 0;
+- npages = NODE_MAPPING(sbi)->nrpages;
+- si->page_mem += (unsigned long long)npages << PAGE_SHIFT;
+- npages = META_MAPPING(sbi)->nrpages;
+- si->page_mem += (unsigned long long)npages << PAGE_SHIFT;
++ if (sbi->node_inode) {
++ unsigned npages = NODE_MAPPING(sbi)->nrpages;
++ si->page_mem += (unsigned long long)npages << PAGE_SHIFT;
++ }
++ if (sbi->meta_inode) {
++ unsigned npages = META_MAPPING(sbi)->nrpages;
++ si->page_mem += (unsigned long long)npages << PAGE_SHIFT;
++ }
+ }
+
+ static int stat_show(struct seq_file *s, void *v)
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 2264f27fd26d..1871031e2d5e 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1050,7 +1050,10 @@ static void f2fs_put_super(struct super_block *sb)
+ f2fs_bug_on(sbi, sbi->fsync_node_num);
+
+ iput(sbi->node_inode);
++ sbi->node_inode = NULL;
++
+ iput(sbi->meta_inode);
++ sbi->meta_inode = NULL;
+
+ /*
+ * iput() can update stat information, if f2fs_write_checkpoint()
+@@ -3166,6 +3169,7 @@ free_node_inode:
+ f2fs_release_ino_entry(sbi, true);
+ truncate_inode_pages_final(NODE_MAPPING(sbi));
+ iput(sbi->node_inode);
++ sbi->node_inode = NULL;
+ free_stats:
+ f2fs_destroy_stats(sbi);
+ free_nm:
+@@ -3178,6 +3182,7 @@ free_devices:
+ free_meta_inode:
+ make_bad_inode(sbi->meta_inode);
+ iput(sbi->meta_inode);
++ sbi->meta_inode = NULL;
+ free_io_dummy:
+ mempool_destroy(sbi->write_io_dummy);
+ free_percpu:
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index bec75600e692..5f62007140cf 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -1523,7 +1523,7 @@ static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
+ * Never use more than a third of the remaining memory,
+ * unless it's the only way to give this client a slot:
+ */
+- avail = clamp_t(int, avail, slotsize, total_avail/3);
++ avail = clamp_t(unsigned long, avail, slotsize, total_avail/3);
+ num = min_t(int, num, avail / slotsize);
+ nfsd_drc_mem_used += num * slotsize;
+ spin_unlock(&nfsd_drc_lock);
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index aaca81b5e119..e1ebdbe40032 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -40,6 +40,16 @@ enum userfaultfd_state {
+ /*
+ * Start with fault_pending_wqh and fault_wqh so they're more likely
+ * to be in the same cacheline.
++ *
++ * Locking order:
++ * fd_wqh.lock
++ * fault_pending_wqh.lock
++ * fault_wqh.lock
++ * event_wqh.lock
++ *
++ * To avoid deadlocks, IRQs must be disabled when taking any of the above locks,
++ * since fd_wqh.lock is taken by aio_poll() while it's holding a lock that's
++ * also taken in IRQ context.
+ */
+ struct userfaultfd_ctx {
+ /* waitqueue head for the pending (i.e. not read) userfaults */
+@@ -459,7 +469,7 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason)
+ blocking_state = return_to_userland ? TASK_INTERRUPTIBLE :
+ TASK_KILLABLE;
+
+- spin_lock(&ctx->fault_pending_wqh.lock);
++ spin_lock_irq(&ctx->fault_pending_wqh.lock);
+ /*
+ * After the __add_wait_queue the uwq is visible to userland
+ * through poll/read().
+@@ -471,7 +481,7 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason)
+ * __add_wait_queue.
+ */
+ set_current_state(blocking_state);
+- spin_unlock(&ctx->fault_pending_wqh.lock);
++ spin_unlock_irq(&ctx->fault_pending_wqh.lock);
+
+ if (!is_vm_hugetlb_page(vmf->vma))
+ must_wait = userfaultfd_must_wait(ctx, vmf->address, vmf->flags,
+@@ -553,13 +563,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason)
+ * kernel stack can be released after the list_del_init.
+ */
+ if (!list_empty_careful(&uwq.wq.entry)) {
+- spin_lock(&ctx->fault_pending_wqh.lock);
++ spin_lock_irq(&ctx->fault_pending_wqh.lock);
+ /*
+ * No need of list_del_init(), the uwq on the stack
+ * will be freed shortly anyway.
+ */
+ list_del(&uwq.wq.entry);
+- spin_unlock(&ctx->fault_pending_wqh.lock);
++ spin_unlock_irq(&ctx->fault_pending_wqh.lock);
+ }
+
+ /*
+@@ -584,7 +594,7 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
+ init_waitqueue_entry(&ewq->wq, current);
+ release_new_ctx = NULL;
+
+- spin_lock(&ctx->event_wqh.lock);
++ spin_lock_irq(&ctx->event_wqh.lock);
+ /*
+ * After the __add_wait_queue the uwq is visible to userland
+ * through poll/read().
+@@ -614,15 +624,15 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
+ break;
+ }
+
+- spin_unlock(&ctx->event_wqh.lock);
++ spin_unlock_irq(&ctx->event_wqh.lock);
+
+ wake_up_poll(&ctx->fd_wqh, EPOLLIN);
+ schedule();
+
+- spin_lock(&ctx->event_wqh.lock);
++ spin_lock_irq(&ctx->event_wqh.lock);
+ }
+ __set_current_state(TASK_RUNNING);
+- spin_unlock(&ctx->event_wqh.lock);
++ spin_unlock_irq(&ctx->event_wqh.lock);
+
+ if (release_new_ctx) {
+ struct vm_area_struct *vma;
+@@ -919,10 +929,10 @@ wakeup:
+ * the last page faults that may have been already waiting on
+ * the fault_*wqh.
+ */
+- spin_lock(&ctx->fault_pending_wqh.lock);
++ spin_lock_irq(&ctx->fault_pending_wqh.lock);
+ __wake_up_locked_key(&ctx->fault_pending_wqh, TASK_NORMAL, &range);
+ __wake_up(&ctx->fault_wqh, TASK_NORMAL, 1, &range);
+- spin_unlock(&ctx->fault_pending_wqh.lock);
++ spin_unlock_irq(&ctx->fault_pending_wqh.lock);
+
+ /* Flush pending events that may still wait on event_wqh */
+ wake_up_all(&ctx->event_wqh);
+@@ -1135,7 +1145,7 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
+
+ if (!ret && msg->event == UFFD_EVENT_FORK) {
+ ret = resolve_userfault_fork(ctx, fork_nctx, msg);
+- spin_lock(&ctx->event_wqh.lock);
++ spin_lock_irq(&ctx->event_wqh.lock);
+ if (!list_empty(&fork_event)) {
+ /*
+ * The fork thread didn't abort, so we can
+@@ -1181,7 +1191,7 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
+ if (ret)
+ userfaultfd_ctx_put(fork_nctx);
+ }
+- spin_unlock(&ctx->event_wqh.lock);
++ spin_unlock_irq(&ctx->event_wqh.lock);
+ }
+
+ return ret;
+@@ -1220,14 +1230,14 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf,
+ static void __wake_userfault(struct userfaultfd_ctx *ctx,
+ struct userfaultfd_wake_range *range)
+ {
+- spin_lock(&ctx->fault_pending_wqh.lock);
++ spin_lock_irq(&ctx->fault_pending_wqh.lock);
+ /* wake all in the range and autoremove */
+ if (waitqueue_active(&ctx->fault_pending_wqh))
+ __wake_up_locked_key(&ctx->fault_pending_wqh, TASK_NORMAL,
+ range);
+ if (waitqueue_active(&ctx->fault_wqh))
+ __wake_up(&ctx->fault_wqh, TASK_NORMAL, 1, range);
+- spin_unlock(&ctx->fault_pending_wqh.lock);
++ spin_unlock_irq(&ctx->fault_pending_wqh.lock);
+ }
+
+ static __always_inline void wake_userfault(struct userfaultfd_ctx *ctx,
+@@ -1882,7 +1892,7 @@ static void userfaultfd_show_fdinfo(struct seq_file *m, struct file *f)
+ wait_queue_entry_t *wq;
+ unsigned long pending = 0, total = 0;
+
+- spin_lock(&ctx->fault_pending_wqh.lock);
++ spin_lock_irq(&ctx->fault_pending_wqh.lock);
+ list_for_each_entry(wq, &ctx->fault_pending_wqh.head, entry) {
+ pending++;
+ total++;
+@@ -1890,7 +1900,7 @@ static void userfaultfd_show_fdinfo(struct seq_file *m, struct file *f)
+ list_for_each_entry(wq, &ctx->fault_wqh.head, entry) {
+ total++;
+ }
+- spin_unlock(&ctx->fault_pending_wqh.lock);
++ spin_unlock_irq(&ctx->fault_pending_wqh.lock);
+
+ /*
+ * If more protocols will be added, there will be all shown
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index d52a7484aeb2..3705c6f10b17 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -837,7 +837,7 @@ bpf_run_sk_reuseport(struct sock_reuseport *reuse, struct sock *sk,
+ extern int bpf_jit_enable;
+ extern int bpf_jit_harden;
+ extern int bpf_jit_kallsyms;
+-extern int bpf_jit_limit;
++extern long bpf_jit_limit;
+
+ typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
+
+diff --git a/include/net/ipv6_frag.h b/include/net/ipv6_frag.h
+index 28aa9b30aece..1f77fb4dc79d 100644
+--- a/include/net/ipv6_frag.h
++++ b/include/net/ipv6_frag.h
+@@ -94,7 +94,6 @@ ip6frag_expire_frag_queue(struct net *net, struct frag_queue *fq)
+ goto out;
+
+ head->dev = dev;
+- skb_get(head);
+ spin_unlock(&fq->q.lock);
+
+ icmpv6_send(head, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0);
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index bad9985b8a08..36be400c3e65 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -366,13 +366,11 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
+ }
+
+ #ifdef CONFIG_BPF_JIT
+-# define BPF_JIT_LIMIT_DEFAULT (PAGE_SIZE * 40000)
+-
+ /* All BPF JIT sysctl knobs here. */
+ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON);
+ int bpf_jit_harden __read_mostly;
+ int bpf_jit_kallsyms __read_mostly;
+-int bpf_jit_limit __read_mostly = BPF_JIT_LIMIT_DEFAULT;
++long bpf_jit_limit __read_mostly;
+
+ static __always_inline void
+ bpf_get_prog_addr_region(const struct bpf_prog *prog,
+@@ -583,16 +581,27 @@ int bpf_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
+
+ static atomic_long_t bpf_jit_current;
+
++/* Can be overridden by an arch's JIT compiler if it has a custom,
++ * dedicated BPF backend memory area, or if neither of the two
++ * below apply.
++ */
++u64 __weak bpf_jit_alloc_exec_limit(void)
++{
+ #if defined(MODULES_VADDR)
++ return MODULES_END - MODULES_VADDR;
++#else
++ return VMALLOC_END - VMALLOC_START;
++#endif
++}
++
+ static int __init bpf_jit_charge_init(void)
+ {
+ /* Only used as heuristic here to derive limit. */
+- bpf_jit_limit = min_t(u64, round_up((MODULES_END - MODULES_VADDR) >> 2,
+- PAGE_SIZE), INT_MAX);
++ bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2,
++ PAGE_SIZE), LONG_MAX);
+ return 0;
+ }
+ pure_initcall(bpf_jit_charge_init);
+-#endif
+
+ static int bpf_jit_charge_modmem(u32 pages)
+ {
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index 266f10cb7222..ff956ccbb6df 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -2432,10 +2432,23 @@ void cpuset_cpus_allowed(struct task_struct *tsk, struct cpumask *pmask)
+ spin_unlock_irqrestore(&callback_lock, flags);
+ }
+
++/**
++ * cpuset_cpus_allowed_fallback - final fallback before complete catastrophe.
++ * @tsk: pointer to task_struct with which the scheduler is struggling
++ *
++ * Description: In the case that the scheduler cannot find an allowed cpu in
++ * tsk->cpus_allowed, we fall back to task_cs(tsk)->cpus_allowed. In legacy
++ * mode however, this value is the same as task_cs(tsk)->effective_cpus,
++ * which will not contain a sane cpumask during cases such as cpu hotplugging.
++ * This is the absolute last resort for the scheduler and it is only used if
++ * _every_ other avenue has been traveled.
++ **/
++
+ void cpuset_cpus_allowed_fallback(struct task_struct *tsk)
+ {
+ rcu_read_lock();
+- do_set_cpus_allowed(tsk, task_cs(tsk)->effective_cpus);
++ do_set_cpus_allowed(tsk, is_in_v2_mode() ?
++ task_cs(tsk)->cpus_allowed : cpu_possible_mask);
+ rcu_read_unlock();
+
+ /*
+diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
+index 5b77a7314e01..722c27c40e5b 100644
+--- a/kernel/livepatch/core.c
++++ b/kernel/livepatch/core.c
+@@ -30,6 +30,7 @@
+ #include <linux/elf.h>
+ #include <linux/moduleloader.h>
+ #include <linux/completion.h>
++#include <linux/memory.h>
+ #include <asm/cacheflush.h>
+ #include "core.h"
+ #include "patch.h"
+@@ -708,16 +709,21 @@ static int klp_init_object_loaded(struct klp_patch *patch,
+ struct klp_func *func;
+ int ret;
+
++ mutex_lock(&text_mutex);
++
+ module_disable_ro(patch->mod);
+ ret = klp_write_object_relocations(patch->mod, obj);
+ if (ret) {
+ module_enable_ro(patch->mod, true);
++ mutex_unlock(&text_mutex);
+ return ret;
+ }
+
+ arch_klp_init_object_loaded(patch, obj);
+ module_enable_ro(patch->mod, true);
+
++ mutex_unlock(&text_mutex);
++
+ klp_for_each_func(obj, func) {
+ ret = klp_find_object_symbol(obj->name, func->old_name,
+ func->old_sympos,
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index 5d0838c2349e..fed682a01a75 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -78,9 +78,7 @@ void __ptrace_link(struct task_struct *child, struct task_struct *new_parent,
+ */
+ static void ptrace_link(struct task_struct *child, struct task_struct *new_parent)
+ {
+- rcu_read_lock();
+- __ptrace_link(child, new_parent, __task_cred(new_parent));
+- rcu_read_unlock();
++ __ptrace_link(child, new_parent, current_cred());
+ }
+
+ /**
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 1688782f3dfb..118ecce14386 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2952,14 +2952,13 @@ static int ftrace_update_code(struct module *mod, struct ftrace_page *new_pgs)
+ p = &pg->records[i];
+ p->flags = rec_flags;
+
+-#ifndef CC_USING_NOP_MCOUNT
+ /*
+ * Do the initial record conversion from mcount jump
+ * to the NOP instructions.
+ */
+- if (!ftrace_code_disable(mod, p))
++ if (!__is_defined(CC_USING_NOP_MCOUNT) &&
++ !ftrace_code_disable(mod, p))
+ break;
+-#endif
+
+ update_cnt++;
+ }
+@@ -4208,10 +4207,13 @@ void free_ftrace_func_mapper(struct ftrace_func_mapper *mapper,
+ struct ftrace_func_entry *entry;
+ struct ftrace_func_map *map;
+ struct hlist_head *hhd;
+- int size = 1 << mapper->hash.size_bits;
+- int i;
++ int size, i;
++
++ if (!mapper)
++ return;
+
+ if (free_func && mapper->hash.count) {
++ size = 1 << mapper->hash.size_bits;
+ for (i = 0; i < size; i++) {
+ hhd = &mapper->hash.buckets[i];
+ hlist_for_each_entry(entry, hhd, hlist) {
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 181dba75a203..3b0de19b9ed7 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -6471,11 +6471,13 @@ tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt,
+ break;
+ }
+ #endif
+- if (!tr->allocated_snapshot) {
++ if (tr->allocated_snapshot)
++ ret = resize_buffer_duplicate_size(&tr->max_buffer,
++ &tr->trace_buffer, iter->cpu_file);
++ else
+ ret = tracing_alloc_snapshot_instance(tr);
+- if (ret < 0)
+- break;
+- }
++ if (ret < 0)
++ break;
+ local_irq_disable();
+ /* Now, we're going to swap */
+ if (iter->cpu_file == RING_BUFFER_ALL_CPUS)
+diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c
+index a5c921e6d667..d3ca55093fa5 100644
+--- a/lib/mpi/mpi-pow.c
++++ b/lib/mpi/mpi-pow.c
+@@ -37,6 +37,7 @@
+ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
+ {
+ mpi_ptr_t mp_marker = NULL, bp_marker = NULL, ep_marker = NULL;
++ struct karatsuba_ctx karactx = {};
+ mpi_ptr_t xp_marker = NULL;
+ mpi_ptr_t tspace = NULL;
+ mpi_ptr_t rp, ep, mp, bp;
+@@ -163,13 +164,11 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
+ int c;
+ mpi_limb_t e;
+ mpi_limb_t carry_limb;
+- struct karatsuba_ctx karactx;
+
+ xp = xp_marker = mpi_alloc_limb_space(2 * (msize + 1));
+ if (!xp)
+ goto enomem;
+
+- memset(&karactx, 0, sizeof karactx);
+ negative_result = (ep[0] & 1) && base->sign;
+
+ i = esize - 1;
+@@ -294,8 +293,6 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
+ if (mod_shift_cnt)
+ mpihelp_rshift(rp, rp, rsize, mod_shift_cnt);
+ MPN_NORMALIZE(rp, rsize);
+-
+- mpihelp_release_karatsuba_ctx(&karactx);
+ }
+
+ if (negative_result && rsize) {
+@@ -312,6 +309,7 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
+ leave:
+ rc = 0;
+ enomem:
++ mpihelp_release_karatsuba_ctx(&karactx);
+ if (assign_rp)
+ mpi_assign_limb_space(res, rp, size);
+ if (mp_marker)
+diff --git a/mm/mlock.c b/mm/mlock.c
+index 41cc47e28ad6..0ab8250af1f8 100644
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -636,11 +636,11 @@ static int apply_vma_lock_flags(unsigned long start, size_t len,
+ * is also counted.
+ * Return value: previously mlocked page counts
+ */
+-static int count_mm_mlocked_page_nr(struct mm_struct *mm,
++static unsigned long count_mm_mlocked_page_nr(struct mm_struct *mm,
+ unsigned long start, size_t len)
+ {
+ struct vm_area_struct *vma;
+- int count = 0;
++ unsigned long count = 0;
+
+ if (mm == NULL)
+ mm = current->mm;
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index dec88fcf8876..e42f44cf7b43 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3599,19 +3599,18 @@ out:
+ }
+
+ /*
+- * pgdat->kswapd_classzone_idx is the highest zone index that a recent
+- * allocation request woke kswapd for. When kswapd has not woken recently,
+- * the value is MAX_NR_ZONES which is not a valid index. This compares a
+- * given classzone and returns it or the highest classzone index kswapd
+- * was recently woke for.
++ * The pgdat->kswapd_classzone_idx is used to pass the highest zone index to be
++ * reclaimed by kswapd from the waker. If the value is MAX_NR_ZONES which is not
++ * a valid index then either kswapd runs for first time or kswapd couldn't sleep
++ * after previous reclaim attempt (node is still unbalanced). In that case
++ * return the zone index of the previous kswapd reclaim cycle.
+ */
+ static enum zone_type kswapd_classzone_idx(pg_data_t *pgdat,
+- enum zone_type classzone_idx)
++ enum zone_type prev_classzone_idx)
+ {
+ if (pgdat->kswapd_classzone_idx == MAX_NR_ZONES)
+- return classzone_idx;
+-
+- return max(pgdat->kswapd_classzone_idx, classzone_idx);
++ return prev_classzone_idx;
++ return pgdat->kswapd_classzone_idx;
+ }
+
+ static void kswapd_try_to_sleep(pg_data_t *pgdat, int alloc_order, int reclaim_order,
+@@ -3752,7 +3751,7 @@ kswapd_try_sleep:
+
+ /* Read the new order and classzone_idx */
+ alloc_order = reclaim_order = pgdat->kswapd_order;
+- classzone_idx = kswapd_classzone_idx(pgdat, 0);
++ classzone_idx = kswapd_classzone_idx(pgdat, classzone_idx);
+ pgdat->kswapd_order = 0;
+ pgdat->kswapd_classzone_idx = MAX_NR_ZONES;
+
+@@ -3806,8 +3805,12 @@ void wakeup_kswapd(struct zone *zone, gfp_t gfp_flags, int order,
+ if (!cpuset_zone_allowed(zone, gfp_flags))
+ return;
+ pgdat = zone->zone_pgdat;
+- pgdat->kswapd_classzone_idx = kswapd_classzone_idx(pgdat,
+- classzone_idx);
++
++ if (pgdat->kswapd_classzone_idx == MAX_NR_ZONES)
++ pgdat->kswapd_classzone_idx = classzone_idx;
++ else
++ pgdat->kswapd_classzone_idx = max(pgdat->kswapd_classzone_idx,
++ classzone_idx);
+ pgdat->kswapd_order = max(pgdat->kswapd_order, order);
+ if (!waitqueue_active(&pgdat->kswapd_wait))
+ return;
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 69e3be51a2c3..879d5432bf77 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -1352,7 +1352,7 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
+ * actually encrypted before enforcing a key size.
+ */
+ return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
+- hcon->enc_key_size > HCI_MIN_ENC_KEY_SIZE);
++ hcon->enc_key_size >= HCI_MIN_ENC_KEY_SIZE);
+ }
+
+ static void l2cap_do_start(struct l2cap_chan *chan)
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index 37b4667128a3..d67ec17f2cc8 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -28,6 +28,8 @@ static int two __maybe_unused = 2;
+ static int min_sndbuf = SOCK_MIN_SNDBUF;
+ static int min_rcvbuf = SOCK_MIN_RCVBUF;
+ static int max_skb_frags = MAX_SKB_FRAGS;
++static long long_one __maybe_unused = 1;
++static long long_max __maybe_unused = LONG_MAX;
+
+ static int net_msg_warn; /* Unused, but still a sysctl */
+
+@@ -289,6 +291,17 @@ proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write,
+
+ return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+ }
++
++static int
++proc_dolongvec_minmax_bpf_restricted(struct ctl_table *table, int write,
++ void __user *buffer, size_t *lenp,
++ loff_t *ppos)
++{
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
++ return proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
++}
+ #endif
+
+ static struct ctl_table net_core_table[] = {
+@@ -398,10 +411,11 @@ static struct ctl_table net_core_table[] = {
+ {
+ .procname = "bpf_jit_limit",
+ .data = &bpf_jit_limit,
+- .maxlen = sizeof(int),
++ .maxlen = sizeof(long),
+ .mode = 0600,
+- .proc_handler = proc_dointvec_minmax_bpf_restricted,
+- .extra1 = &one,
++ .proc_handler = proc_dolongvec_minmax_bpf_restricted,
++ .extra1 = &long_one,
++ .extra2 = &long_max,
+ },
+ #endif
+ {
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index cb1b4772dac0..35d5a76867d0 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -265,8 +265,14 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
+
+ prev = fq->q.fragments_tail;
+ err = inet_frag_queue_insert(&fq->q, skb, offset, end);
+- if (err)
++ if (err) {
++ if (err == IPFRAG_DUP) {
++ /* No error for duplicates, pretend they got queued. */
++ kfree_skb(skb);
++ return -EINPROGRESS;
++ }
+ goto insert_error;
++ }
+
+ if (dev)
+ fq->iif = dev->ifindex;
+@@ -293,15 +299,17 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
+ skb->_skb_refdst = 0UL;
+ err = nf_ct_frag6_reasm(fq, skb, prev, dev);
+ skb->_skb_refdst = orefdst;
+- return err;
++
++ /* After queue has assumed skb ownership, only 0 or
++ * -EINPROGRESS must be returned.
++ */
++ return err ? -EINPROGRESS : 0;
+ }
+
+ skb_dst_drop(skb);
+ return -EINPROGRESS;
+
+ insert_error:
+- if (err == IPFRAG_DUP)
+- goto err;
+ inet_frag_kill(&fq->q);
+ err:
+ skb_dst_drop(skb);
+@@ -481,12 +489,6 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
+ ret = 0;
+ }
+
+- /* after queue has assumed skb ownership, only 0 or -EINPROGRESS
+- * must be returned.
+- */
+- if (ret)
+- ret = -EINPROGRESS;
+-
+ spin_unlock_bh(&fq->q.lock);
+ inet_frag_put(&fq->q);
+ return ret;
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index 49a90217622b..ac1f5db52994 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -627,7 +627,7 @@ static int table_path_del(struct mesh_table *tbl,
+ spin_lock_bh(&tbl->walk_lock);
+ mpath = rhashtable_lookup_fast(&tbl->rhead, addr, mesh_rht_params);
+ if (!mpath) {
+- rcu_read_unlock();
++ spin_unlock_bh(&tbl->walk_lock);
+ return -ENXIO;
+ }
+
+diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
+index 129e9ec99ec9..a8c9ea12c3f5 100644
+--- a/net/netfilter/nf_flow_table_ip.c
++++ b/net/netfilter/nf_flow_table_ip.c
+@@ -246,8 +246,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
+ flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
+ rt = (struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
+
+- if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)) &&
+- (ip_hdr(skb)->frag_off & htons(IP_DF)) != 0)
++ if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
+ return NF_ACCEPT;
+
+ if (skb_try_make_writable(skb, sizeof(*iph)))
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 7f85af4c40ff..6e0c26025ab1 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -12,7 +12,6 @@
+ #include <net/netfilter/nf_conntrack_core.h>
+ #include <linux/netfilter/nf_conntrack_common.h>
+ #include <net/netfilter/nf_flow_table.h>
+-#include <net/netfilter/nf_conntrack_helper.h>
+
+ struct nft_flow_offload {
+ struct nft_flowtable *flowtable;
+@@ -49,15 +48,20 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
+ return 0;
+ }
+
+-static bool nft_flow_offload_skip(struct sk_buff *skb)
++static bool nft_flow_offload_skip(struct sk_buff *skb, int family)
+ {
+- struct ip_options *opt = &(IPCB(skb)->opt);
+-
+- if (unlikely(opt->optlen))
+- return true;
+ if (skb_sec_path(skb))
+ return true;
+
++ if (family == NFPROTO_IPV4) {
++ const struct ip_options *opt;
++
++ opt = &(IPCB(skb)->opt);
++
++ if (unlikely(opt->optlen))
++ return true;
++ }
++
+ return false;
+ }
+
+@@ -67,15 +71,15 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ {
+ struct nft_flow_offload *priv = nft_expr_priv(expr);
+ struct nf_flowtable *flowtable = &priv->flowtable->data;
+- const struct nf_conn_help *help;
+ enum ip_conntrack_info ctinfo;
+ struct nf_flow_route route;
+ struct flow_offload *flow;
+ enum ip_conntrack_dir dir;
++ bool is_tcp = false;
+ struct nf_conn *ct;
+ int ret;
+
+- if (nft_flow_offload_skip(pkt->skb))
++ if (nft_flow_offload_skip(pkt->skb, nft_pf(pkt)))
+ goto out;
+
+ ct = nf_ct_get(pkt->skb, &ctinfo);
+@@ -84,14 +88,16 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+
+ switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
+ case IPPROTO_TCP:
++ is_tcp = true;
++ break;
+ case IPPROTO_UDP:
+ break;
+ default:
+ goto out;
+ }
+
+- help = nfct_help(ct);
+- if (help)
++ if (nf_ct_ext_exist(ct, NF_CT_EXT_HELPER) ||
++ ct->status & IPS_SEQ_ADJUST)
+ goto out;
+
+ if (ctinfo == IP_CT_NEW ||
+@@ -109,6 +115,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ if (!flow)
+ goto err_flow_alloc;
+
++ if (is_tcp) {
++ ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
++ ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
++ }
++
+ ret = flow_offload_add(flowtable, flow);
+ if (ret < 0)
+ goto err_flow_add;
+diff --git a/net/rds/send.c b/net/rds/send.c
+index ec2267cbf85f..26e2c2305f7a 100644
+--- a/net/rds/send.c
++++ b/net/rds/send.c
+@@ -1106,9 +1106,11 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
+ sock_flag(rds_rs_to_sk(rs), SOCK_ZEROCOPY));
+ int num_sgs = ceil(payload_len, PAGE_SIZE);
+ int namelen;
+- struct rds_iov_vector_arr vct = {0};
++ struct rds_iov_vector_arr vct;
+ int ind;
+
++ memset(&vct, 0, sizeof(vct));
++
+ /* expect 1 RDMA CMSG per rds_sendmsg. can still grow if more needed. */
+ vct.incr = 1;
+
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index e6e506b2db99..9bbab6ba2dab 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -848,11 +848,11 @@ static int smc_clcsock_accept(struct smc_sock *lsmc, struct smc_sock **new_smc)
+ if (rc < 0)
+ lsk->sk_err = -rc;
+ if (rc < 0 || lsk->sk_state == SMC_CLOSED) {
++ new_sk->sk_prot->unhash(new_sk);
+ if (new_clcsock)
+ sock_release(new_clcsock);
+ new_sk->sk_state = SMC_CLOSED;
+ sock_set_flag(new_sk, SOCK_DEAD);
+- new_sk->sk_prot->unhash(new_sk);
+ sock_put(new_sk); /* final */
+ *new_smc = NULL;
+ goto out;
+@@ -903,11 +903,11 @@ struct sock *smc_accept_dequeue(struct sock *parent,
+
+ smc_accept_unlink(new_sk);
+ if (new_sk->sk_state == SMC_CLOSED) {
++ new_sk->sk_prot->unhash(new_sk);
+ if (isk->clcsock) {
+ sock_release(isk->clcsock);
+ isk->clcsock = NULL;
+ }
+- new_sk->sk_prot->unhash(new_sk);
+ sock_put(new_sk); /* final */
+ continue;
+ }
+@@ -932,6 +932,7 @@ void smc_close_non_accepted(struct sock *sk)
+ sock_set_flag(sk, SOCK_DEAD);
+ sk->sk_shutdown |= SHUTDOWN_MASK;
+ }
++ sk->sk_prot->unhash(sk);
+ if (smc->clcsock) {
+ struct socket *tcp;
+
+@@ -947,7 +948,6 @@ void smc_close_non_accepted(struct sock *sk)
+ smc_conn_free(&smc->conn);
+ }
+ release_sock(sk);
+- sk->sk_prot->unhash(sk);
+ sock_put(sk); /* final sock_put */
+ }
+
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+index ce5c610b49c7..7308992b7a18 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+@@ -270,9 +270,14 @@ static void handle_connect_req(struct rdma_cm_id *new_cma_id,
+ /* Save client advertised inbound read limit for use later in accept. */
+ newxprt->sc_ord = param->initiator_depth;
+
+- /* Set the local and remote addresses in the transport */
+ sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.dst_addr;
+ svc_xprt_set_remote(&newxprt->sc_xprt, sa, svc_addr_len(sa));
++ /* The remote port is arbitrary and not under the control of the
++ * client ULP. Set it to a fixed value so that the DRC continues
++ * to be effective after a reconnect.
++ */
++ rpc_set_port((struct sockaddr *)&newxprt->sc_xprt.xpt_remote, 0);
++
+ sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.src_addr;
+ svc_xprt_set_local(&newxprt->sc_xprt, sa, svc_addr_len(sa));
+
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index 98a7d63a723e..c4a9ddb174bc 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -66,7 +66,7 @@ parse_symbol() {
+ if [[ "${cache[$module,$address]+isset}" == "isset" ]]; then
+ local code=${cache[$module,$address]}
+ else
+- local code=$(addr2line -i -e "$objfile" "$address")
++ local code=$(${CROSS_COMPILE}addr2line -i -e "$objfile" "$address")
+ cache[$module,$address]=$code
+ fi
+
+diff --git a/sound/core/seq/oss/seq_oss_ioctl.c b/sound/core/seq/oss/seq_oss_ioctl.c
+index 5b8520177b0e..7d72e3d48ad5 100644
+--- a/sound/core/seq/oss/seq_oss_ioctl.c
++++ b/sound/core/seq/oss/seq_oss_ioctl.c
+@@ -62,7 +62,7 @@ static int snd_seq_oss_oob_user(struct seq_oss_devinfo *dp, void __user *arg)
+ if (copy_from_user(ev, arg, 8))
+ return -EFAULT;
+ memset(&tmpev, 0, sizeof(tmpev));
+- snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.port, dp->addr.client);
++ snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.client, dp->addr.port);
+ tmpev.time.tick = 0;
+ if (! snd_seq_oss_process_event(dp, (union evrec *)ev, &tmpev)) {
+ snd_seq_oss_dispatch(dp, &tmpev, 0, 0);
+diff --git a/sound/core/seq/oss/seq_oss_rw.c b/sound/core/seq/oss/seq_oss_rw.c
+index 30886f5fb100..05fbb564beb3 100644
+--- a/sound/core/seq/oss/seq_oss_rw.c
++++ b/sound/core/seq/oss/seq_oss_rw.c
+@@ -174,7 +174,7 @@ insert_queue(struct seq_oss_devinfo *dp, union evrec *rec, struct file *opt)
+ memset(&event, 0, sizeof(event));
+ /* set dummy -- to be sure */
+ event.type = SNDRV_SEQ_EVENT_NOTEOFF;
+- snd_seq_oss_fill_addr(dp, &event, dp->addr.port, dp->addr.client);
++ snd_seq_oss_fill_addr(dp, &event, dp->addr.client, dp->addr.port);
+
+ if (snd_seq_oss_process_event(dp, rec, &event))
+ return 0; /* invalid event - no need to insert queue */
+diff --git a/sound/firewire/amdtp-am824.c b/sound/firewire/amdtp-am824.c
+index 4210e5c6262e..d09da9dbf235 100644
+--- a/sound/firewire/amdtp-am824.c
++++ b/sound/firewire/amdtp-am824.c
+@@ -321,7 +321,7 @@ static void read_midi_messages(struct amdtp_stream *s,
+ u8 *b;
+
+ for (f = 0; f < frames; f++) {
+- port = (s->data_block_counter + f) % 8;
++ port = (8 - s->tx_first_dbc + s->data_block_counter + f) % 8;
+ b = (u8 *)&buffer[p->midi_position];
+
+ len = b[0] - 0x80;
+diff --git a/sound/hda/ext/hdac_ext_bus.c b/sound/hda/ext/hdac_ext_bus.c
+index 9c37d9af3023..08cc0ce3b924 100644
+--- a/sound/hda/ext/hdac_ext_bus.c
++++ b/sound/hda/ext/hdac_ext_bus.c
+@@ -173,7 +173,6 @@ EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_device_init);
+ void snd_hdac_ext_bus_device_exit(struct hdac_device *hdev)
+ {
+ snd_hdac_device_exit(hdev);
+- kfree(hdev);
+ }
+ EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_device_exit);
+
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 21de8145f1a6..a6233775e779 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -971,6 +971,7 @@ int snd_hda_codec_device_new(struct hda_bus *bus, struct snd_card *card,
+
+ /* power-up all before initialization */
+ hda_set_power_state(codec, AC_PWRST_D0);
++ codec->core.dev.power.power_state = PMSG_ON;
+
+ snd_hda_codec_proc_new(codec);
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index e154506a66cb..6453370abacc 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2443,9 +2443,10 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
+- SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x65d1, "Tuxedo Book XC1509", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x96e1, "Clevo P960[ER][CDFN]-K", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x97e1, "Clevo P970[ER][CDFN]", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
+@@ -6938,6 +6939,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
++ SND_PCI_QUIRK(0x17aa, 0x3111, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c
+index 299ada4dfaa0..3bd57c02e6fd 100644
+--- a/sound/soc/codecs/ak4458.c
++++ b/sound/soc/codecs/ak4458.c
+@@ -272,7 +272,10 @@ static int ak4458_rstn_control(struct snd_soc_component *component, int bit)
+ AK4458_00_CONTROL1,
+ AK4458_RSTN_MASK,
+ 0x0);
+- return ret;
++ if (ret < 0)
++ return ret;
++
++ return 0;
+ }
+
+ static int ak4458_hw_params(struct snd_pcm_substream *substream,
+@@ -492,9 +495,10 @@ static void ak4458_power_on(struct ak4458_priv *ak4458)
+ }
+ }
+
+-static void ak4458_init(struct snd_soc_component *component)
++static int ak4458_init(struct snd_soc_component *component)
+ {
+ struct ak4458_priv *ak4458 = snd_soc_component_get_drvdata(component);
++ int ret;
+
+ /* External Mute ON */
+ if (ak4458->mute_gpiod)
+@@ -502,21 +506,21 @@ static void ak4458_init(struct snd_soc_component *component)
+
+ ak4458_power_on(ak4458);
+
+- snd_soc_component_update_bits(component, AK4458_00_CONTROL1,
++ ret = snd_soc_component_update_bits(component, AK4458_00_CONTROL1,
+ 0x80, 0x80); /* ACKS bit = 1; 10000000 */
++ if (ret < 0)
++ return ret;
+
+- ak4458_rstn_control(component, 1);
++ return ak4458_rstn_control(component, 1);
+ }
+
+ static int ak4458_probe(struct snd_soc_component *component)
+ {
+ struct ak4458_priv *ak4458 = snd_soc_component_get_drvdata(component);
+
+- ak4458_init(component);
+-
+ ak4458->fs = 48000;
+
+- return 0;
++ return ak4458_init(component);
+ }
+
+ static void ak4458_remove(struct snd_soc_component *component)
+diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
+index 407554175282..68d18aca397d 100644
+--- a/sound/soc/codecs/cs4265.c
++++ b/sound/soc/codecs/cs4265.c
+@@ -60,7 +60,7 @@ static const struct reg_default cs4265_reg_defaults[] = {
+ static bool cs4265_readable_register(struct device *dev, unsigned int reg)
+ {
+ switch (reg) {
+- case CS4265_CHIP_ID ... CS4265_SPDIF_CTL2:
++ case CS4265_CHIP_ID ... CS4265_MAX_REGISTER:
+ return true;
+ default:
+ return false;
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index f06ae43650a3..c3b28b2f4b10 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1924,6 +1924,21 @@ static int max98090_configure_dmic(struct max98090_priv *max98090,
+ return 0;
+ }
+
++static int max98090_dai_startup(struct snd_pcm_substream *substream,
++ struct snd_soc_dai *dai)
++{
++ struct snd_soc_component *component = dai->component;
++ struct max98090_priv *max98090 = snd_soc_component_get_drvdata(component);
++ unsigned int fmt = max98090->dai_fmt;
++
++ /* Remove 24-bit format support if it is not in right justified mode. */
++ if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_RIGHT_J) {
++ substream->runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
++ snd_pcm_hw_constraint_msbits(substream->runtime, 0, 16, 16);
++ }
++ return 0;
++}
++
+ static int max98090_dai_hw_params(struct snd_pcm_substream *substream,
+ struct snd_pcm_hw_params *params,
+ struct snd_soc_dai *dai)
+@@ -2331,6 +2346,7 @@ EXPORT_SYMBOL_GPL(max98090_mic_detect);
+ #define MAX98090_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE)
+
+ static const struct snd_soc_dai_ops max98090_dai_ops = {
++ .startup = max98090_dai_startup,
+ .set_sysclk = max98090_dai_set_sysclk,
+ .set_fmt = max98090_dai_set_fmt,
+ .set_tdm_slot = max98090_set_tdm_slot,
+diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c
+index 18a931c25ca5..f09f2d87ac60 100644
+--- a/sound/soc/codecs/rt274.c
++++ b/sound/soc/codecs/rt274.c
+@@ -398,6 +398,8 @@ static int rt274_mic_detect(struct snd_soc_component *component,
+ {
+ struct rt274_priv *rt274 = snd_soc_component_get_drvdata(component);
+
++ rt274->jack = jack;
++
+ if (jack == NULL) {
+ /* Disable jack detection */
+ regmap_update_bits(rt274->regmap, RT274_EAPD_GPIO_IRQ_CTRL,
+@@ -405,7 +407,6 @@ static int rt274_mic_detect(struct snd_soc_component *component,
+
+ return 0;
+ }
+- rt274->jack = jack;
+
+ regmap_update_bits(rt274->regmap, RT274_EAPD_GPIO_IRQ_CTRL,
+ RT274_IRQ_EN, RT274_IRQ_EN);
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 33060af18b5a..6566c8831a96 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2451,7 +2451,8 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream)
+
+ if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) &&
+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) &&
+- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND))
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND) &&
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED))
+ continue;
+
+ dev_dbg(be->dev, "ASoC: prepare BE %s\n",
+diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
+index a4aa931ebfae..6173dd86c62c 100644
+--- a/sound/soc/sunxi/sun4i-i2s.c
++++ b/sound/soc/sunxi/sun4i-i2s.c
+@@ -110,7 +110,7 @@
+
+ #define SUN8I_I2S_TX_CHAN_MAP_REG 0x44
+ #define SUN8I_I2S_TX_CHAN_SEL_REG 0x34
+-#define SUN8I_I2S_TX_CHAN_OFFSET_MASK GENMASK(13, 11)
++#define SUN8I_I2S_TX_CHAN_OFFSET_MASK GENMASK(13, 12)
+ #define SUN8I_I2S_TX_CHAN_OFFSET(offset) (offset << 12)
+ #define SUN8I_I2S_TX_CHAN_EN_MASK GENMASK(11, 4)
+ #define SUN8I_I2S_TX_CHAN_EN(num_chan) (((1 << num_chan) - 1) << 4)
+@@ -460,6 +460,10 @@ static int sun4i_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ regmap_update_bits(i2s->regmap, SUN8I_I2S_TX_CHAN_SEL_REG,
+ SUN8I_I2S_TX_CHAN_OFFSET_MASK,
+ SUN8I_I2S_TX_CHAN_OFFSET(offset));
++
++ regmap_update_bits(i2s->regmap, SUN8I_I2S_RX_CHAN_SEL_REG,
++ SUN8I_I2S_TX_CHAN_OFFSET_MASK,
++ SUN8I_I2S_TX_CHAN_OFFSET(offset));
+ }
+
+ regmap_field_write(i2s->field_fmt_mode, val);
+diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
+index 72c6f8e82a7e..78c2d6cab3b5 100644
+--- a/sound/usb/line6/pcm.c
++++ b/sound/usb/line6/pcm.c
+@@ -560,6 +560,11 @@ int line6_init_pcm(struct usb_line6 *line6,
+ line6pcm->max_packet_size_out =
+ usb_maxpacket(line6->usbdev,
+ usb_sndisocpipe(line6->usbdev, ep_write), 1);
++ if (!line6pcm->max_packet_size_in || !line6pcm->max_packet_size_out) {
++ dev_err(line6pcm->line6->ifcdev,
++ "cannot get proper max packet size\n");
++ return -EINVAL;
++ }
+
+ spin_lock_init(&line6pcm->out.lock);
+ spin_lock_init(&line6pcm->in.lock);
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index cbfb48bdea51..5b342fe30c75 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -753,7 +753,7 @@ static int snd_ni_control_init_val(struct usb_mixer_interface *mixer,
+ return err;
+ }
+
+- kctl->private_value |= (value << 24);
++ kctl->private_value |= ((unsigned int)value << 24);
+ return 0;
+ }
+
+@@ -914,7 +914,7 @@ static int snd_ftu_eff_switch_init(struct usb_mixer_interface *mixer,
+ if (err < 0)
+ return err;
+
+- kctl->private_value |= value[0] << 24;
++ kctl->private_value |= (unsigned int)value[0] << 24;
+ return 0;
+ }
+
+diff --git a/tools/testing/selftests/net/fib_rule_tests.sh b/tools/testing/selftests/net/fib_rule_tests.sh
+index dbd90ca73e44..1ba069967fa2 100755
+--- a/tools/testing/selftests/net/fib_rule_tests.sh
++++ b/tools/testing/selftests/net/fib_rule_tests.sh
+@@ -148,8 +148,8 @@ fib_rule6_test()
+
+ fib_check_iproute_support "ipproto" "ipproto"
+ if [ $? -eq 0 ]; then
+- match="ipproto icmp"
+- fib_rule6_test_match_n_redirect "$match" "$match" "ipproto icmp match"
++ match="ipproto ipv6-icmp"
++ fib_rule6_test_match_n_redirect "$match" "$match" "ipproto ipv6-icmp match"
+ fi
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-07-14 15:44 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-07-14 15:44 UTC (permalink / raw
To: gentoo-commits
commit: 1ef22f135a36d059936f5137213f56461a3582f3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jul 14 15:43:42 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jul 14 15:43:42 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=1ef22f13
Linux patch 4.19.59
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1058_linux-4.19.59.patch | 4271 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4275 insertions(+)
diff --git a/0000_README b/0000_README
index 9cbece9..8871e40 100644
--- a/0000_README
+++ b/0000_README
@@ -275,6 +275,10 @@ Patch: 1057_linux-4.19.58.patch
From: https://www.kernel.org
Desc: Linux 4.19.58
+Patch: 1058_linux-4.19.59.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.59
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1058_linux-4.19.59.patch b/1058_linux-4.19.59.patch
new file mode 100644
index 0000000..2c2de1c
--- /dev/null
+++ b/1058_linux-4.19.59.patch
@@ -0,0 +1,4271 @@
+diff --git a/Documentation/ABI/testing/sysfs-class-net-qmi b/Documentation/ABI/testing/sysfs-class-net-qmi
+index 7122d6264c49..c310db4ccbc2 100644
+--- a/Documentation/ABI/testing/sysfs-class-net-qmi
++++ b/Documentation/ABI/testing/sysfs-class-net-qmi
+@@ -29,7 +29,7 @@ Contact: Bjørn Mork <bjorn@mork.no>
+ Description:
+ Unsigned integer.
+
+- Write a number ranging from 1 to 127 to add a qmap mux
++ Write a number ranging from 1 to 254 to add a qmap mux
+ based network device, supported by recent Qualcomm based
+ modems.
+
+@@ -46,5 +46,5 @@ Contact: Bjørn Mork <bjorn@mork.no>
+ Description:
+ Unsigned integer.
+
+- Write a number ranging from 1 to 127 to delete a previously
++ Write a number ranging from 1 to 254 to delete a previously
+ created qmap mux based network device.
+diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst
+index ffc064c1ec68..49311f3da6f2 100644
+--- a/Documentation/admin-guide/hw-vuln/index.rst
++++ b/Documentation/admin-guide/hw-vuln/index.rst
+@@ -9,5 +9,6 @@ are configurable at compile, boot or run time.
+ .. toctree::
+ :maxdepth: 1
+
++ spectre
+ l1tf
+ mds
+diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
+new file mode 100644
+index 000000000000..25f3b2532198
+--- /dev/null
++++ b/Documentation/admin-guide/hw-vuln/spectre.rst
+@@ -0,0 +1,697 @@
++.. SPDX-License-Identifier: GPL-2.0
++
++Spectre Side Channels
++=====================
++
++Spectre is a class of side channel attacks that exploit branch prediction
++and speculative execution on modern CPUs to read memory, possibly
++bypassing access controls. Speculative execution side channel exploits
++do not modify memory but attempt to infer privileged data in the memory.
++
++This document covers Spectre variant 1 and Spectre variant 2.
++
++Affected processors
++-------------------
++
++Speculative execution side channel methods affect a wide range of modern
++high performance processors, since most modern high speed processors
++use branch prediction and speculative execution.
++
++The following CPUs are vulnerable:
++
++ - Intel Core, Atom, Pentium, and Xeon processors
++
++ - AMD Phenom, EPYC, and Zen processors
++
++ - IBM POWER and zSeries processors
++
++ - Higher end ARM processors
++
++ - Apple CPUs
++
++ - Higher end MIPS CPUs
++
++ - Likely most other high performance CPUs. Contact your CPU vendor for details.
++
++Whether a processor is affected or not can be read out from the Spectre
++vulnerability files in sysfs. See :ref:`spectre_sys_info`.
++
++Related CVEs
++------------
++
++The following CVE entries describe Spectre variants:
++
++ ============= ======================= =================
++ CVE-2017-5753 Bounds check bypass Spectre variant 1
++ CVE-2017-5715 Branch target injection Spectre variant 2
++ ============= ======================= =================
++
++Problem
++-------
++
++CPUs use speculative operations to improve performance. That may leave
++traces of memory accesses or computations in the processor's caches,
++buffers, and branch predictors. Malicious software may be able to
++influence the speculative execution paths, and then use the side effects
++of the speculative execution in the CPUs' caches and buffers to infer
++privileged data touched during the speculative execution.
++
++Spectre variant 1 attacks take advantage of speculative execution of
++conditional branches, while Spectre variant 2 attacks use speculative
++execution of indirect branches to leak privileged memory.
++See :ref:`[1] <spec_ref1>` :ref:`[5] <spec_ref5>` :ref:`[7] <spec_ref7>`
++:ref:`[10] <spec_ref10>` :ref:`[11] <spec_ref11>`.
++
++Spectre variant 1 (Bounds Check Bypass)
++---------------------------------------
++
++The bounds check bypass attack :ref:`[2] <spec_ref2>` takes advantage
++of speculative execution that bypasses conditional branch instructions
++used for memory access bounds check (e.g. checking if the index of an
++array results in memory access within a valid range). This results in
++memory accesses to invalid memory (with out-of-bound index) that are
++done speculatively before validation checks resolve. Such speculative
++memory accesses can leave side effects, creating side channels which
++leak information to the attacker.
++
++There are some extensions of Spectre variant 1 attacks for reading data
++over the network, see :ref:`[12] <spec_ref12>`. However such attacks
++are difficult, low bandwidth, fragile, and are considered low risk.
++
++Spectre variant 2 (Branch Target Injection)
++-------------------------------------------
++
++The branch target injection attack takes advantage of speculative
++execution of indirect branches :ref:`[3] <spec_ref3>`. The indirect
++branch predictors inside the processor used to guess the target of
++indirect branches can be influenced by an attacker, causing gadget code
++to be speculatively executed, thus exposing sensitive data touched by
++the victim. The side effects left in the CPU's caches during speculative
++execution can be measured to infer data values.
++
++.. _poison_btb:
++
++In Spectre variant 2 attacks, the attacker can steer speculative indirect
++branches in the victim to gadget code by poisoning the branch target
++buffer of a CPU used for predicting indirect branch addresses. Such
++poisoning could be done by indirect branching into existing code,
++with the address offset of the indirect branch under the attacker's
++control. Since the branch prediction on impacted hardware does not
++fully disambiguate branch address and uses the offset for prediction,
++this could cause privileged code's indirect branch to jump to a gadget
++code with the same offset.
++
++The most useful gadgets take an attacker-controlled input parameter (such
++as a register value) so that the memory read can be controlled. Gadgets
++without input parameters might be possible, but the attacker would have
++very little control over what memory can be read, reducing the risk of
++the attack revealing useful data.
++
++One other variant 2 attack vector is for the attacker to poison the
++return stack buffer (RSB) :ref:`[13] <spec_ref13>` to cause speculative
++subroutine return instruction execution to go to a gadget. An attacker's
++imbalanced subroutine call instructions might "poison" entries in the
++return stack buffer which are later consumed by a victim's subroutine
++return instructions. This attack can be mitigated by flushing the return
++stack buffer on context switch, or virtual machine (VM) exit.
++
++On systems with simultaneous multi-threading (SMT), attacks are possible
++from the sibling thread, as level 1 cache and branch target buffer
++(BTB) may be shared between hardware threads in a CPU core. A malicious
++program running on the sibling thread may influence its peer's BTB to
++steer its indirect branch speculations to gadget code, and measure the
++speculative execution's side effects left in level 1 cache to infer the
++victim's data.
++
++Attack scenarios
++----------------
++
++The following list of attack scenarios have been anticipated, but may
++not cover all possible attack vectors.
++
++1. A user process attacking the kernel
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ The attacker passes a parameter to the kernel via a register or
++ via a known address in memory during a syscall. Such parameter may
++ be used later by the kernel as an index to an array or to derive
++ a pointer for a Spectre variant 1 attack. The index or pointer
++ is invalid, but bound checks are bypassed in the code branch taken
++ for speculative execution. This could cause privileged memory to be
++ accessed and leaked.
++
++ For kernel code that has been identified where data pointers could
++ potentially be influenced for Spectre attacks, new "nospec" accessor
++ macros are used to prevent speculative loading of data.
++
++ Spectre variant 2 attacker can :ref:`poison <poison_btb>` the branch
++ target buffer (BTB) before issuing syscall to launch an attack.
++ After entering the kernel, the kernel could use the poisoned branch
++ target buffer on indirect jump and jump to gadget code in speculative
++ execution.
++
++ If an attacker tries to control the memory addresses leaked during
++ speculative execution, he would also need to pass a parameter to the
++ gadget, either through a register or a known address in memory. After
++ the gadget has executed, he can measure the side effect.
++
++ The kernel can protect itself against consuming poisoned branch
++ target buffer entries by using return trampolines (also known as
++ "retpoline") :ref:`[3] <spec_ref3>` :ref:`[9] <spec_ref9>` for all
++ indirect branches. Return trampolines trap speculative execution paths
++ to prevent jumping to gadget code during speculative execution.
++ x86 CPUs with Enhanced Indirect Branch Restricted Speculation
++ (Enhanced IBRS) available in hardware should use the feature to
++ mitigate Spectre variant 2 instead of retpoline. Enhanced IBRS is
++ more efficient than retpoline.
++
++ There may be gadget code in firmware which could be exploited with
++ Spectre variant 2 attack by a rogue user process. To mitigate such
++ attacks on x86, Indirect Branch Restricted Speculation (IBRS) feature
++ is turned on before the kernel invokes any firmware code.
++
++2. A user process attacking another user process
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ A malicious user process can try to attack another user process,
++ either via a context switch on the same hardware thread, or from the
++ sibling hyperthread sharing a physical processor core on simultaneous
++ multi-threading (SMT) system.
++
++ Spectre variant 1 attacks generally require passing parameters
++ between the processes, which needs a data passing relationship, such
++ as remote procedure calls (RPC). Those parameters are used in gadget
++ code to derive invalid data pointers accessing privileged memory in
++ the attacked process.
++
++ Spectre variant 2 attacks can be launched from a rogue process by
++ :ref:`poisoning <poison_btb>` the branch target buffer. This can
++ influence the indirect branch targets for a victim process that either
++ runs later on the same hardware thread, or running concurrently on
++ a sibling hardware thread sharing the same physical core.
++
++ A user process can protect itself against Spectre variant 2 attacks
++ by using the prctl() syscall to disable indirect branch speculation
++ for itself. An administrator can also cordon off an unsafe process
++ from polluting the branch target buffer by disabling the process's
++ indirect branch speculation. This comes with a performance cost
++ from not using indirect branch speculation and clearing the branch
++ target buffer. When SMT is enabled on x86, for a process that has
++ indirect branch speculation disabled, Single Threaded Indirect Branch
++ Predictors (STIBP) :ref:`[4] <spec_ref4>` are turned on to prevent the
++ sibling thread from controlling branch target buffer. In addition,
++ the Indirect Branch Prediction Barrier (IBPB) is issued to clear the
++ branch target buffer when context switching to and from such process.
++
++ On x86, the return stack buffer is stuffed on context switch.
++ This prevents the branch target buffer from being used for branch
++ prediction when the return stack buffer underflows while switching to
++ a deeper call stack. Any poisoned entries in the return stack buffer
++ left by the previous process will also be cleared.
++
++ User programs should use address space randomization to make attacks
++ more difficult (Set /proc/sys/kernel/randomize_va_space = 1 or 2).
++
++3. A virtualized guest attacking the host
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ The attack mechanism is similar to how user processes attack the
++ kernel. The kernel is entered via hyper-calls or other virtualization
++ exit paths.
++
++ For Spectre variant 1 attacks, rogue guests can pass parameters
++ (e.g. in registers) via hyper-calls to derive invalid pointers to
++ speculate into privileged memory after entering the kernel. For places
++ where such kernel code has been identified, nospec accessor macros
++ are used to stop speculative memory access.
++
++ For Spectre variant 2 attacks, rogue guests can :ref:`poison
++ <poison_btb>` the branch target buffer or return stack buffer, causing
++ the kernel to jump to gadget code in the speculative execution paths.
++
++ To mitigate variant 2, the host kernel can use return trampolines
++ for indirect branches to bypass the poisoned branch target buffer,
++ and flushing the return stack buffer on VM exit. This prevents rogue
++ guests from affecting indirect branching in the host kernel.
++
++ To protect host processes from rogue guests, host processes can have
++ indirect branch speculation disabled via prctl(). The branch target
++ buffer is cleared before context switching to such processes.
++
++4. A virtualized guest attacking other guest
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ A rogue guest may attack another guest to get data accessible by the
++ other guest.
++
++ Spectre variant 1 attacks are possible if parameters can be passed
++ between guests. This may be done via mechanisms such as shared memory
++ or message passing. Such parameters could be used to derive data
++ pointers to privileged data in guest. The privileged data could be
++ accessed by gadget code in the victim's speculation paths.
++
++ Spectre variant 2 attacks can be launched from a rogue guest by
++ :ref:`poisoning <poison_btb>` the branch target buffer or the return
++ stack buffer. Such poisoned entries could be used to influence
++ speculation execution paths in the victim guest.
++
++ Linux kernel mitigates attacks to other guests running in the same
++ CPU hardware thread by flushing the return stack buffer on VM exit,
++ and clearing the branch target buffer before switching to a new guest.
++
++ If SMT is used, Spectre variant 2 attacks from an untrusted guest
++ in the sibling hyperthread can be mitigated by the administrator,
++ by turning off the unsafe guest's indirect branch speculation via
++ prctl(). A guest can also protect itself by turning on microcode
++ based mitigations (such as IBPB or STIBP on x86) within the guest.
++
++.. _spectre_sys_info:
++
++Spectre system information
++--------------------------
++
++The Linux kernel provides a sysfs interface to enumerate the current
++mitigation status of the system for Spectre: whether the system is
++vulnerable, and which mitigations are active.
++
++The sysfs file showing Spectre variant 1 mitigation status is:
++
++ /sys/devices/system/cpu/vulnerabilities/spectre_v1
++
++The possible values in this file are:
++
++ ======================================= =================================
++ 'Mitigation: __user pointer sanitation' Protection in kernel on a case by
++ case base with explicit pointer
++ sanitation.
++ ======================================= =================================
++
++However, the protections are put in place on a case by case basis,
++and there is no guarantee that all possible attack vectors for Spectre
++variant 1 are covered.
++
++The spectre_v2 kernel file reports if the kernel has been compiled with
++retpoline mitigation or if the CPU has hardware mitigation, and if the
++CPU has support for additional process-specific mitigation.
++
++This file also reports CPU features enabled by microcode to mitigate
++attack between user processes:
++
++1. Indirect Branch Prediction Barrier (IBPB) to add additional
++ isolation between processes of different users.
++2. Single Thread Indirect Branch Predictors (STIBP) to add additional
++ isolation between CPU threads running on the same core.
++
++These CPU features may impact performance when used and can be enabled
++per process on a case-by-case base.
++
++The sysfs file showing Spectre variant 2 mitigation status is:
++
++ /sys/devices/system/cpu/vulnerabilities/spectre_v2
++
++The possible values in this file are:
++
++ - Kernel status:
++
++ ==================================== =================================
++ 'Not affected' The processor is not vulnerable
++ 'Vulnerable' Vulnerable, no mitigation
++ 'Mitigation: Full generic retpoline' Software-focused mitigation
++ 'Mitigation: Full AMD retpoline' AMD-specific software mitigation
++ 'Mitigation: Enhanced IBRS' Hardware-focused mitigation
++ ==================================== =================================
++
++ - Firmware status: Show if Indirect Branch Restricted Speculation (IBRS) is
++ used to protect against Spectre variant 2 attacks when calling firmware (x86 only).
++
++ ========== =============================================================
++ 'IBRS_FW' Protection against user program attacks when calling firmware
++ ========== =============================================================
++
++ - Indirect branch prediction barrier (IBPB) status for protection between
++ processes of different users. This feature can be controlled through
++ prctl() per process, or through kernel command line options. This is
++ an x86 only feature. For more details see below.
++
++ =================== ========================================================
++ 'IBPB: disabled' IBPB unused
++ 'IBPB: always-on' Use IBPB on all tasks
++ 'IBPB: conditional' Use IBPB on SECCOMP or indirect branch restricted tasks
++ =================== ========================================================
++
++ - Single threaded indirect branch prediction (STIBP) status for protection
++ between different hyper threads. This feature can be controlled through
++ prctl per process, or through kernel command line options. This is x86
++ only feature. For more details see below.
++
++ ==================== ========================================================
++ 'STIBP: disabled' STIBP unused
++ 'STIBP: forced' Use STIBP on all tasks
++ 'STIBP: conditional' Use STIBP on SECCOMP or indirect branch restricted tasks
++ ==================== ========================================================
++
++ - Return stack buffer (RSB) protection status:
++
++ ============= ===========================================
++ 'RSB filling' Protection of RSB on context switch enabled
++ ============= ===========================================
++
++Full mitigation might require a microcode update from the CPU
++vendor. When the necessary microcode is not available, the kernel will
++report vulnerability.
++
++Turning on mitigation for Spectre variant 1 and Spectre variant 2
++-----------------------------------------------------------------
++
++1. Kernel mitigation
++^^^^^^^^^^^^^^^^^^^^
++
++ For the Spectre variant 1, vulnerable kernel code (as determined
++ by code audit or scanning tools) is annotated on a case by case
++ basis to use nospec accessor macros for bounds clipping :ref:`[2]
++ <spec_ref2>` to avoid any usable disclosure gadgets. However, it may
++ not cover all attack vectors for Spectre variant 1.
++
++ For Spectre variant 2 mitigation, the compiler turns indirect calls or
++ jumps in the kernel into equivalent return trampolines (retpolines)
++ :ref:`[3] <spec_ref3>` :ref:`[9] <spec_ref9>` to go to the target
++ addresses. Speculative execution paths under retpolines are trapped
++ in an infinite loop to prevent any speculative execution jumping to
++ a gadget.
++
++ To turn on retpoline mitigation on a vulnerable CPU, the kernel
++ needs to be compiled with a gcc compiler that supports the
++ -mindirect-branch=thunk-extern -mindirect-branch-register options.
++ If the kernel is compiled with a Clang compiler, the compiler needs
++ to support -mretpoline-external-thunk option. The kernel config
++ CONFIG_RETPOLINE needs to be turned on, and the CPU needs to run with
++ the latest updated microcode.
++
++ On Intel Skylake-era systems the mitigation covers most, but not all,
++ cases. See :ref:`[3] <spec_ref3>` for more details.
++
++ On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced
++ IBRS on x86), retpoline is automatically disabled at run time.
++
++ The retpoline mitigation is turned on by default on vulnerable
++ CPUs. It can be forced on or off by the administrator
++ via the kernel command line and sysfs control files. See
++ :ref:`spectre_mitigation_control_command_line`.
++
++ On x86, indirect branch restricted speculation is turned on by default
++ before invoking any firmware code to prevent Spectre variant 2 exploits
++ using the firmware.
++
++ Using kernel address space randomization (CONFIG_RANDOMIZE_SLAB=y
++ and CONFIG_SLAB_FREELIST_RANDOM=y in the kernel configuration) makes
++ attacks on the kernel generally more difficult.
++
++2. User program mitigation
++^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ User programs can mitigate Spectre variant 1 using LFENCE or "bounds
++ clipping". For more details see :ref:`[2] <spec_ref2>`.
++
++ For Spectre variant 2 mitigation, individual user programs
++ can be compiled with return trampolines for indirect branches.
++ This protects them from consuming poisoned entries in the branch
++ target buffer left by malicious software. Alternatively, the
++ programs can disable their indirect branch speculation via prctl()
++ (See :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
++ On x86, this will turn on STIBP to guard against attacks from the
++ sibling thread when the user program is running, and use IBPB to
++ flush the branch target buffer when switching to/from the program.
++
++ Restricting indirect branch speculation on a user program will
++ also prevent the program from launching a variant 2 attack
++ on x86. All sand-boxed SECCOMP programs have indirect branch
++ speculation restricted by default. Administrators can change
++ that behavior via the kernel command line and sysfs control files.
++ See :ref:`spectre_mitigation_control_command_line`.
++
++ Programs that disable their indirect branch speculation will have
++ more overhead and run slower.
++
++ User programs should use address space randomization
++ (/proc/sys/kernel/randomize_va_space = 1 or 2) to make attacks more
++ difficult.
++
++3. VM mitigation
++^^^^^^^^^^^^^^^^
++
++ Within the kernel, Spectre variant 1 attacks from rogue guests are
++ mitigated on a case by case basis in VM exit paths. Vulnerable code
++ uses nospec accessor macros for "bounds clipping", to avoid any
++ usable disclosure gadgets. However, this may not cover all variant
++ 1 attack vectors.
++
++ For Spectre variant 2 attacks from rogue guests to the kernel, the
++ Linux kernel uses retpoline or Enhanced IBRS to prevent consumption of
++ poisoned entries in branch target buffer left by rogue guests. It also
++ flushes the return stack buffer on every VM exit to prevent a return
++ stack buffer underflow so poisoned branch target buffer could be used,
++ or attacker guests leaving poisoned entries in the return stack buffer.
++
++ To mitigate guest-to-guest attacks in the same CPU hardware thread,
++ the branch target buffer is sanitized by flushing before switching
++ to a new guest on a CPU.
++
++ The above mitigations are turned on by default on vulnerable CPUs.
++
++ To mitigate guest-to-guest attacks from sibling thread when SMT is
++ in use, an untrusted guest running in the sibling thread can have
++ its indirect branch speculation disabled by administrator via prctl().
++
++ The kernel also allows guests to use any microcode based mitigation
++ they choose to use (such as IBPB or STIBP on x86) to protect themselves.
++
++.. _spectre_mitigation_control_command_line:
++
++Mitigation control on the kernel command line
++---------------------------------------------
++
++Spectre variant 2 mitigation can be disabled or force enabled at the
++kernel command line.
++
++ nospectre_v2
++
++ [X86] Disable all mitigations for the Spectre variant 2
++ (indirect branch prediction) vulnerability. System may
++ allow data leaks with this option, which is equivalent
++ to spectre_v2=off.
++
++
++ spectre_v2=
++
++ [X86] Control mitigation of Spectre variant 2
++ (indirect branch speculation) vulnerability.
++ The default operation protects the kernel from
++ user space attacks.
++
++ on
++ unconditionally enable, implies
++ spectre_v2_user=on
++ off
++ unconditionally disable, implies
++ spectre_v2_user=off
++ auto
++ kernel detects whether your CPU model is
++ vulnerable
++
++ Selecting 'on' will, and 'auto' may, choose a
++ mitigation method at run time according to the
++ CPU, the available microcode, the setting of the
++ CONFIG_RETPOLINE configuration option, and the
++ compiler with which the kernel was built.
++
++ Selecting 'on' will also enable the mitigation
++ against user space to user space task attacks.
++
++ Selecting 'off' will disable both the kernel and
++ the user space protections.
++
++ Specific mitigations can also be selected manually:
++
++ retpoline
++ replace indirect branches
++ retpoline,generic
++ google's original retpoline
++ retpoline,amd
++ AMD-specific minimal thunk
++
++ Not specifying this option is equivalent to
++ spectre_v2=auto.
++
++For user space mitigation:
++
++ spectre_v2_user=
++
++ [X86] Control mitigation of Spectre variant 2
++ (indirect branch speculation) vulnerability between
++ user space tasks
++
++ on
++ Unconditionally enable mitigations. Is
++ enforced by spectre_v2=on
++
++ off
++ Unconditionally disable mitigations. Is
++ enforced by spectre_v2=off
++
++ prctl
++ Indirect branch speculation is enabled,
++ but mitigation can be enabled via prctl
++ per thread. The mitigation control state
++ is inherited on fork.
++
++ prctl,ibpb
++ Like "prctl" above, but only STIBP is
++ controlled per thread. IBPB is issued
++ always when switching between different user
++ space processes.
++
++ seccomp
++ Same as "prctl" above, but all seccomp
++ threads will enable the mitigation unless
++ they explicitly opt out.
++
++ seccomp,ibpb
++ Like "seccomp" above, but only STIBP is
++ controlled per thread. IBPB is issued
++ always when switching between different
++ user space processes.
++
++ auto
++ Kernel selects the mitigation depending on
++ the available CPU features and vulnerability.
++
++ Default mitigation:
++ If CONFIG_SECCOMP=y then "seccomp", otherwise "prctl"
++
++ Not specifying this option is equivalent to
++ spectre_v2_user=auto.
++
++ In general the kernel by default selects
++ reasonable mitigations for the current CPU. To
++ disable Spectre variant 2 mitigations, boot with
++ spectre_v2=off. Spectre variant 1 mitigations
++ cannot be disabled.
++
++Mitigation selection guide
++--------------------------
++
++1. Trusted userspace
++^^^^^^^^^^^^^^^^^^^^
++
++ If all userspace applications are from trusted sources and do not
++ execute externally supplied untrusted code, then the mitigations can
++ be disabled.
++
++2. Protect sensitive programs
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ For security-sensitive programs that have secrets (e.g. crypto
++ keys), protection against Spectre variant 2 can be put in place by
++ disabling indirect branch speculation when the program is running
++ (See :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
++
++3. Sandbox untrusted programs
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ Untrusted programs that could be a source of attacks can be cordoned
++ off by disabling their indirect branch speculation when they are run
++ (See :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
++ This prevents untrusted programs from polluting the branch target
++ buffer. All programs running in SECCOMP sandboxes have indirect
++ branch speculation restricted by default. This behavior can be
++ changed via the kernel command line and sysfs control files. See
++ :ref:`spectre_mitigation_control_command_line`.
++
++3. High security mode
++^^^^^^^^^^^^^^^^^^^^^
++
++ All Spectre variant 2 mitigations can be forced on
++ at boot time for all programs (See the "on" option in
++ :ref:`spectre_mitigation_control_command_line`). This will add
++ overhead as indirect branch speculations for all programs will be
++ restricted.
++
++ On x86, branch target buffer will be flushed with IBPB when switching
++ to a new program. STIBP is left on all the time to protect programs
++ against variant 2 attacks originating from programs running on
++ sibling threads.
++
++ Alternatively, STIBP can be used only when running programs
++ whose indirect branch speculation is explicitly disabled,
++ while IBPB is still used all the time when switching to a new
++ program to clear the branch target buffer (See "ibpb" option in
++ :ref:`spectre_mitigation_control_command_line`). This "ibpb" option
++ has less performance cost than the "on" option, which leaves STIBP
++ on all the time.
++
++References on Spectre
++---------------------
++
++Intel white papers:
++
++.. _spec_ref1:
++
++[1] `Intel analysis of speculative execution side channels <https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf>`_.
++
++.. _spec_ref2:
++
++[2] `Bounds check bypass <https://software.intel.com/security-software-guidance/software-guidance/bounds-check-bypass>`_.
++
++.. _spec_ref3:
++
++[3] `Deep dive: Retpoline: A branch target injection mitigation <https://software.intel.com/security-software-guidance/insights/deep-dive-retpoline-branch-target-injection-mitigation>`_.
++
++.. _spec_ref4:
++
++[4] `Deep Dive: Single Thread Indirect Branch Predictors <https://software.intel.com/security-software-guidance/insights/deep-dive-single-thread-indirect-branch-predictors>`_.
++
++AMD white papers:
++
++.. _spec_ref5:
++
++[5] `AMD64 technology indirect branch control extension <https://developer.amd.com/wp-content/resources/Architecture_Guidelines_Update_Indirect_Branch_Control.pdf>`_.
++
++.. _spec_ref6:
++
++[6] `Software techniques for managing speculation on AMD processors <https://developer.amd.com/wp-content/resources/90343-B_SoftwareTechniquesforManagingSpeculation_WP_7-18Update_FNL.pdf>`_.
++
++ARM white papers:
++
++.. _spec_ref7:
++
++[7] `Cache speculation side-channels <https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/download-the-whitepaper>`_.
++
++.. _spec_ref8:
++
++[8] `Cache speculation issues update <https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/latest-updates/cache-speculation-issues-update>`_.
++
++Google white paper:
++
++.. _spec_ref9:
++
++[9] `Retpoline: a software construct for preventing branch-target-injection <https://support.google.com/faqs/answer/7625886>`_.
++
++MIPS white paper:
++
++.. _spec_ref10:
++
++[10] `MIPS: response on speculative execution and side channel vulnerabilities <https://www.mips.com/blog/mips-response-on-speculative-execution-and-side-channel-vulnerabilities/>`_.
++
++Academic papers:
++
++.. _spec_ref11:
++
++[11] `Spectre Attacks: Exploiting Speculative Execution <https://spectreattack.com/spectre.pdf>`_.
++
++.. _spec_ref12:
++
++[12] `NetSpectre: Read Arbitrary Memory over Network <https://arxiv.org/abs/1807.10535>`_.
++
++.. _spec_ref13:
++
++[13] `Spectre Returns! Speculation Attacks using the Return Stack Buffer <https://www.usenix.org/system/files/conference/woot18/woot18-paper-koruyeh.pdf>`_.
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index a29301d6e6c6..1cee1174cde6 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -4976,12 +4976,6 @@
+ emulate [default] Vsyscalls turn into traps and are
+ emulated reasonably safely.
+
+- native Vsyscalls are native syscall instructions.
+- This is a little bit faster than trapping
+- and makes a few dynamic recompilers work
+- better than they would in emulation mode.
+- It also makes exploits much easier to write.
+-
+ none Vsyscalls don't work at all. This makes
+ them quite hard to use for exploits but
+ might break your system.
+diff --git a/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt b/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt
+index 188c8bd4eb67..5a0111d4de58 100644
+--- a/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt
++++ b/Documentation/devicetree/bindings/net/can/microchip,mcp251x.txt
+@@ -4,6 +4,7 @@ Required properties:
+ - compatible: Should be one of the following:
+ - "microchip,mcp2510" for MCP2510.
+ - "microchip,mcp2515" for MCP2515.
++ - "microchip,mcp25625" for MCP25625.
+ - reg: SPI chip select.
+ - clocks: The clock feeding the CAN controller.
+ - interrupts: Should contain IRQ line for the CAN controller.
+diff --git a/Documentation/userspace-api/spec_ctrl.rst b/Documentation/userspace-api/spec_ctrl.rst
+index c4dbe6f7cdae..0fda8f614110 100644
+--- a/Documentation/userspace-api/spec_ctrl.rst
++++ b/Documentation/userspace-api/spec_ctrl.rst
+@@ -47,6 +47,8 @@ If PR_SPEC_PRCTL is set, then the per-task control of the mitigation is
+ available. If not set, prctl(PR_SET_SPECULATION_CTRL) for the speculation
+ misfeature will fail.
+
++.. _set_spec_ctrl:
++
+ PR_SET_SPECULATION_CTRL
+ -----------------------
+
+diff --git a/Makefile b/Makefile
+index 5dcd01cd1bf6..38f2150457fd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 58
++SUBLEVEL = 59
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am335x-pcm-953.dtsi b/arch/arm/boot/dts/am335x-pcm-953.dtsi
+index 1ec8e0d80191..572fbd254690 100644
+--- a/arch/arm/boot/dts/am335x-pcm-953.dtsi
++++ b/arch/arm/boot/dts/am335x-pcm-953.dtsi
+@@ -197,7 +197,7 @@
+ bus-width = <4>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc1_pins>;
+- cd-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
++ cd-gpios = <&gpio0 6 GPIO_ACTIVE_LOW>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/am335x-wega.dtsi b/arch/arm/boot/dts/am335x-wega.dtsi
+index 8ce541739b24..83e4fe595e37 100644
+--- a/arch/arm/boot/dts/am335x-wega.dtsi
++++ b/arch/arm/boot/dts/am335x-wega.dtsi
+@@ -157,7 +157,7 @@
+ bus-width = <4>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc1_pins>;
+- cd-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
++ cd-gpios = <&gpio0 6 GPIO_ACTIVE_LOW>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c
+index e1a949b47306..774a3e535ad0 100644
+--- a/arch/arm/mach-davinci/board-da850-evm.c
++++ b/arch/arm/mach-davinci/board-da850-evm.c
+@@ -1472,6 +1472,8 @@ static __init void da850_evm_init(void)
+ if (ret)
+ pr_warn("%s: dsp/rproc registration failed: %d\n",
+ __func__, ret);
++
++ regulator_has_full_constraints();
+ }
+
+ #ifdef CONFIG_SERIAL_8250_CONSOLE
+diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c
+index 1fd3619f6a09..3c42bf9fa061 100644
+--- a/arch/arm/mach-davinci/devices-da8xx.c
++++ b/arch/arm/mach-davinci/devices-da8xx.c
+@@ -685,6 +685,9 @@ static struct platform_device da8xx_lcdc_device = {
+ .id = 0,
+ .num_resources = ARRAY_SIZE(da8xx_lcdc_resources),
+ .resource = da8xx_lcdc_resources,
++ .dev = {
++ .coherent_dma_mask = DMA_BIT_MASK(32),
++ }
+ };
+
+ int __init da8xx_register_lcdc(struct da8xx_lcdc_platform_data *pdata)
+diff --git a/arch/mips/include/uapi/asm/sgidefs.h b/arch/mips/include/uapi/asm/sgidefs.h
+index 26143e3b7c26..69c3de90c536 100644
+--- a/arch/mips/include/uapi/asm/sgidefs.h
++++ b/arch/mips/include/uapi/asm/sgidefs.h
+@@ -11,14 +11,6 @@
+ #ifndef __ASM_SGIDEFS_H
+ #define __ASM_SGIDEFS_H
+
+-/*
+- * Using a Linux compiler for building Linux seems logic but not to
+- * everybody.
+- */
+-#ifndef __linux__
+-#error Use a Linux compiler or give up.
+-#endif
+-
+ /*
+ * Definitions for the ISA levels
+ *
+diff --git a/arch/riscv/lib/delay.c b/arch/riscv/lib/delay.c
+index dce8ae24c6d3..ee6853c1e341 100644
+--- a/arch/riscv/lib/delay.c
++++ b/arch/riscv/lib/delay.c
+@@ -88,7 +88,7 @@ EXPORT_SYMBOL(__delay);
+
+ void udelay(unsigned long usecs)
+ {
+- unsigned long ucycles = usecs * lpj_fine * UDELAY_MULT;
++ u64 ucycles = (u64)usecs * lpj_fine * UDELAY_MULT;
+
+ if (unlikely(usecs > MAX_UDELAY_US)) {
+ __delay((u64)usecs * riscv_timebase / 1000000ULL);
+diff --git a/arch/s390/Makefile b/arch/s390/Makefile
+index ee65185bbc80..e6c2e8925fef 100644
+--- a/arch/s390/Makefile
++++ b/arch/s390/Makefile
+@@ -24,6 +24,7 @@ KBUILD_CFLAGS_DECOMPRESSOR += -DDISABLE_BRANCH_PROFILING -D__NO_FORTIFY
+ KBUILD_CFLAGS_DECOMPRESSOR += -fno-delete-null-pointer-checks -msoft-float
+ KBUILD_CFLAGS_DECOMPRESSOR += -fno-asynchronous-unwind-tables
+ KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-option,-ffreestanding)
++KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, address-of-packed-member)
+ KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO),-g)
+ KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO_DWARF4), $(call cc-option, -gdwarf-4,))
+ UTS_MACHINE := s390x
+diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
+index e2ee403865eb..aeba77881d85 100644
+--- a/arch/x86/kernel/ptrace.c
++++ b/arch/x86/kernel/ptrace.c
+@@ -24,6 +24,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/export.h>
+ #include <linux/context_tracking.h>
++#include <linux/nospec.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/pgtable.h>
+@@ -651,9 +652,11 @@ static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n)
+ {
+ struct thread_struct *thread = &tsk->thread;
+ unsigned long val = 0;
++ int index = n;
+
+ if (n < HBP_NUM) {
+- struct perf_event *bp = thread->ptrace_bps[n];
++ struct perf_event *bp = thread->ptrace_bps[index];
++ index = array_index_nospec(index, HBP_NUM);
+
+ if (bp)
+ val = bp->hw.info.address;
+diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
+index a5b802a12212..71d3fef1edc9 100644
+--- a/arch/x86/kernel/tls.c
++++ b/arch/x86/kernel/tls.c
+@@ -5,6 +5,7 @@
+ #include <linux/user.h>
+ #include <linux/regset.h>
+ #include <linux/syscalls.h>
++#include <linux/nospec.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/desc.h>
+@@ -220,6 +221,7 @@ int do_get_thread_area(struct task_struct *p, int idx,
+ struct user_desc __user *u_info)
+ {
+ struct user_desc info;
++ int index;
+
+ if (idx == -1 && get_user(idx, &u_info->entry_number))
+ return -EFAULT;
+@@ -227,8 +229,11 @@ int do_get_thread_area(struct task_struct *p, int idx,
+ if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
+ return -EINVAL;
+
+- fill_user_desc(&info, idx,
+- &p->thread.tls_array[idx - GDT_ENTRY_TLS_MIN]);
++ index = idx - GDT_ENTRY_TLS_MIN;
++ index = array_index_nospec(index,
++ GDT_ENTRY_TLS_MAX - GDT_ENTRY_TLS_MIN + 1);
++
++ fill_user_desc(&info, idx, &p->thread.tls_array[index]);
+
+ if (copy_to_user(u_info, &info, sizeof(info)))
+ return -EFAULT;
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 2580cd2e98b1..a32fc3d99407 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -190,9 +190,7 @@ struct jit_context {
+ #define BPF_MAX_INSN_SIZE 128
+ #define BPF_INSN_SAFETY 64
+
+-#define AUX_STACK_SPACE 40 /* Space for RBX, R13, R14, R15, tailcnt */
+-
+-#define PROLOGUE_SIZE 37
++#define PROLOGUE_SIZE 20
+
+ /*
+ * Emit x86-64 prologue code for BPF program and check its size.
+@@ -203,44 +201,19 @@ static void emit_prologue(u8 **pprog, u32 stack_depth, bool ebpf_from_cbpf)
+ u8 *prog = *pprog;
+ int cnt = 0;
+
+- /* push rbp */
+- EMIT1(0x55);
+-
+- /* mov rbp,rsp */
+- EMIT3(0x48, 0x89, 0xE5);
+-
+- /* sub rsp, rounded_stack_depth + AUX_STACK_SPACE */
+- EMIT3_off32(0x48, 0x81, 0xEC,
+- round_up(stack_depth, 8) + AUX_STACK_SPACE);
+-
+- /* sub rbp, AUX_STACK_SPACE */
+- EMIT4(0x48, 0x83, 0xED, AUX_STACK_SPACE);
+-
+- /* mov qword ptr [rbp+0],rbx */
+- EMIT4(0x48, 0x89, 0x5D, 0);
+- /* mov qword ptr [rbp+8],r13 */
+- EMIT4(0x4C, 0x89, 0x6D, 8);
+- /* mov qword ptr [rbp+16],r14 */
+- EMIT4(0x4C, 0x89, 0x75, 16);
+- /* mov qword ptr [rbp+24],r15 */
+- EMIT4(0x4C, 0x89, 0x7D, 24);
+-
++ EMIT1(0x55); /* push rbp */
++ EMIT3(0x48, 0x89, 0xE5); /* mov rbp, rsp */
++ /* sub rsp, rounded_stack_depth */
++ EMIT3_off32(0x48, 0x81, 0xEC, round_up(stack_depth, 8));
++ EMIT1(0x53); /* push rbx */
++ EMIT2(0x41, 0x55); /* push r13 */
++ EMIT2(0x41, 0x56); /* push r14 */
++ EMIT2(0x41, 0x57); /* push r15 */
+ if (!ebpf_from_cbpf) {
+- /*
+- * Clear the tail call counter (tail_call_cnt): for eBPF tail
+- * calls we need to reset the counter to 0. It's done in two
+- * instructions, resetting RAX register to 0, and moving it
+- * to the counter location.
+- */
+-
+- /* xor eax, eax */
+- EMIT2(0x31, 0xc0);
+- /* mov qword ptr [rbp+32], rax */
+- EMIT4(0x48, 0x89, 0x45, 32);
+-
++ /* zero init tail_call_cnt */
++ EMIT2(0x6a, 0x00);
+ BUILD_BUG_ON(cnt != PROLOGUE_SIZE);
+ }
+-
+ *pprog = prog;
+ }
+
+@@ -285,13 +258,13 @@ static void emit_bpf_tail_call(u8 **pprog)
+ * if (tail_call_cnt > MAX_TAIL_CALL_CNT)
+ * goto out;
+ */
+- EMIT2_off32(0x8B, 0x85, 36); /* mov eax, dword ptr [rbp + 36] */
++ EMIT2_off32(0x8B, 0x85, -36 - MAX_BPF_STACK); /* mov eax, dword ptr [rbp - 548] */
+ EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT); /* cmp eax, MAX_TAIL_CALL_CNT */
+ #define OFFSET2 (30 + RETPOLINE_RAX_BPF_JIT_SIZE)
+ EMIT2(X86_JA, OFFSET2); /* ja out */
+ label2 = cnt;
+ EMIT3(0x83, 0xC0, 0x01); /* add eax, 1 */
+- EMIT2_off32(0x89, 0x85, 36); /* mov dword ptr [rbp + 36], eax */
++ EMIT2_off32(0x89, 0x85, -36 - MAX_BPF_STACK); /* mov dword ptr [rbp -548], eax */
+
+ /* prog = array->ptrs[index]; */
+ EMIT4_off32(0x48, 0x8B, 0x84, 0xD6, /* mov rax, [rsi + rdx * 8 + offsetof(...)] */
+@@ -1006,19 +979,14 @@ emit_jmp:
+ seen_exit = true;
+ /* Update cleanup_addr */
+ ctx->cleanup_addr = proglen;
+- /* mov rbx, qword ptr [rbp+0] */
+- EMIT4(0x48, 0x8B, 0x5D, 0);
+- /* mov r13, qword ptr [rbp+8] */
+- EMIT4(0x4C, 0x8B, 0x6D, 8);
+- /* mov r14, qword ptr [rbp+16] */
+- EMIT4(0x4C, 0x8B, 0x75, 16);
+- /* mov r15, qword ptr [rbp+24] */
+- EMIT4(0x4C, 0x8B, 0x7D, 24);
+-
+- /* add rbp, AUX_STACK_SPACE */
+- EMIT4(0x48, 0x83, 0xC5, AUX_STACK_SPACE);
+- EMIT1(0xC9); /* leave */
+- EMIT1(0xC3); /* ret */
++ if (!bpf_prog_was_classic(bpf_prog))
++ EMIT1(0x5B); /* get rid of tail_call_cnt */
++ EMIT2(0x41, 0x5F); /* pop r15 */
++ EMIT2(0x41, 0x5E); /* pop r14 */
++ EMIT2(0x41, 0x5D); /* pop r13 */
++ EMIT1(0x5B); /* pop rbx */
++ EMIT1(0xC9); /* leave */
++ EMIT1(0xC3); /* ret */
+ break;
+
+ default:
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 6bb397995610..becd793a258c 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -4116,6 +4116,7 @@ static void bfq_exit_icq_bfqq(struct bfq_io_cq *bic, bool is_sync)
+ unsigned long flags;
+
+ spin_lock_irqsave(&bfqd->lock, flags);
++ bfqq->bic = NULL;
+ bfq_exit_bfqq(bfqd, bfqq);
+ bic_set_bfqq(bic, NULL, is_sync);
+ spin_unlock_irqrestore(&bfqd->lock, flags);
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index ce0e4d317d24..5d67f5fec6c1 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -3936,6 +3936,8 @@ retry:
+ case BINDER_WORK_TRANSACTION_COMPLETE: {
+ binder_inner_proc_unlock(proc);
+ cmd = BR_TRANSACTION_COMPLETE;
++ kfree(w);
++ binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
+ if (put_user(cmd, (uint32_t __user *)ptr))
+ return -EFAULT;
+ ptr += sizeof(uint32_t);
+@@ -3944,8 +3946,6 @@ retry:
+ binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE,
+ "%d:%d BR_TRANSACTION_COMPLETE\n",
+ proc->pid, thread->pid);
+- kfree(w);
+- binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
+ } break;
+ case BINDER_WORK_NODE: {
+ struct binder_node *node = container_of(w, struct binder_node, work);
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index f4f3e9a5851e..c5859d3cb825 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -2286,7 +2286,7 @@ static struct talitos_alg_template driver_algs[] = {
+ .base = {
+ .cra_name = "authenc(hmac(sha1),cbc(aes))",
+ .cra_driver_name = "authenc-hmac-sha1-"
+- "cbc-aes-talitos",
++ "cbc-aes-talitos-hsna",
+ .cra_blocksize = AES_BLOCK_SIZE,
+ .cra_flags = CRYPTO_ALG_ASYNC,
+ },
+@@ -2330,7 +2330,7 @@ static struct talitos_alg_template driver_algs[] = {
+ .cra_name = "authenc(hmac(sha1),"
+ "cbc(des3_ede))",
+ .cra_driver_name = "authenc-hmac-sha1-"
+- "cbc-3des-talitos",
++ "cbc-3des-talitos-hsna",
+ .cra_blocksize = DES3_EDE_BLOCK_SIZE,
+ .cra_flags = CRYPTO_ALG_ASYNC,
+ },
+@@ -2372,7 +2372,7 @@ static struct talitos_alg_template driver_algs[] = {
+ .base = {
+ .cra_name = "authenc(hmac(sha224),cbc(aes))",
+ .cra_driver_name = "authenc-hmac-sha224-"
+- "cbc-aes-talitos",
++ "cbc-aes-talitos-hsna",
+ .cra_blocksize = AES_BLOCK_SIZE,
+ .cra_flags = CRYPTO_ALG_ASYNC,
+ },
+@@ -2416,7 +2416,7 @@ static struct talitos_alg_template driver_algs[] = {
+ .cra_name = "authenc(hmac(sha224),"
+ "cbc(des3_ede))",
+ .cra_driver_name = "authenc-hmac-sha224-"
+- "cbc-3des-talitos",
++ "cbc-3des-talitos-hsna",
+ .cra_blocksize = DES3_EDE_BLOCK_SIZE,
+ .cra_flags = CRYPTO_ALG_ASYNC,
+ },
+@@ -2458,7 +2458,7 @@ static struct talitos_alg_template driver_algs[] = {
+ .base = {
+ .cra_name = "authenc(hmac(sha256),cbc(aes))",
+ .cra_driver_name = "authenc-hmac-sha256-"
+- "cbc-aes-talitos",
++ "cbc-aes-talitos-hsna",
+ .cra_blocksize = AES_BLOCK_SIZE,
+ .cra_flags = CRYPTO_ALG_ASYNC,
+ },
+@@ -2502,7 +2502,7 @@ static struct talitos_alg_template driver_algs[] = {
+ .cra_name = "authenc(hmac(sha256),"
+ "cbc(des3_ede))",
+ .cra_driver_name = "authenc-hmac-sha256-"
+- "cbc-3des-talitos",
++ "cbc-3des-talitos-hsna",
+ .cra_blocksize = DES3_EDE_BLOCK_SIZE,
+ .cra_flags = CRYPTO_ALG_ASYNC,
+ },
+@@ -2628,7 +2628,7 @@ static struct talitos_alg_template driver_algs[] = {
+ .base = {
+ .cra_name = "authenc(hmac(md5),cbc(aes))",
+ .cra_driver_name = "authenc-hmac-md5-"
+- "cbc-aes-talitos",
++ "cbc-aes-talitos-hsna",
+ .cra_blocksize = AES_BLOCK_SIZE,
+ .cra_flags = CRYPTO_ALG_ASYNC,
+ },
+@@ -2670,7 +2670,7 @@ static struct talitos_alg_template driver_algs[] = {
+ .base = {
+ .cra_name = "authenc(hmac(md5),cbc(des3_ede))",
+ .cra_driver_name = "authenc-hmac-md5-"
+- "cbc-3des-talitos",
++ "cbc-3des-talitos-hsna",
+ .cra_blocksize = DES3_EDE_BLOCK_SIZE,
+ .cra_flags = CRYPTO_ALG_ASYNC,
+ },
+diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
+index e2f775d1c112..21bec4548092 100644
+--- a/drivers/gpu/drm/drm_bufs.c
++++ b/drivers/gpu/drm/drm_bufs.c
+@@ -1321,7 +1321,10 @@ static int copy_one_buf(void *data, int count, struct drm_buf_entry *from)
+ .size = from->buf_size,
+ .low_mark = from->low_mark,
+ .high_mark = from->high_mark};
+- return copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags));
++
++ if (copy_to_user(to, &v, offsetof(struct drm_buf_desc, flags)))
++ return -EFAULT;
++ return 0;
+ }
+
+ int drm_legacy_infobufs(struct drm_device *dev, void *data,
+diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
+index 67b1fca39aa6..138680b37c70 100644
+--- a/drivers/gpu/drm/drm_ioc32.c
++++ b/drivers/gpu/drm/drm_ioc32.c
+@@ -372,7 +372,10 @@ static int copy_one_buf32(void *data, int count, struct drm_buf_entry *from)
+ .size = from->buf_size,
+ .low_mark = from->low_mark,
+ .high_mark = from->high_mark};
+- return copy_to_user(to + count, &v, offsetof(drm_buf_desc32_t, flags));
++
++ if (copy_to_user(to + count, &v, offsetof(drm_buf_desc32_t, flags)))
++ return -EFAULT;
++ return 0;
+ }
+
+ static int drm_legacy_infobufs32(struct drm_device *dev, void *data,
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index 82ae68716696..05a800807c26 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -789,6 +789,9 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+ if (unlikely(ret != 0))
+ goto out_err0;
+
++ dma_set_max_seg_size(dev->dev, min_t(unsigned int, U32_MAX & PAGE_MASK,
++ SCATTERLIST_MAX_SEGMENT));
++
+ if (dev_priv->capabilities & SVGA_CAP_GMR2) {
+ DRM_INFO("Max GMR ids is %u\n",
+ (unsigned)dev_priv->max_gmr_ids);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c
+index 31786b200afc..f388ad51e72b 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_buffer.c
+@@ -448,11 +448,11 @@ static int vmw_ttm_map_dma(struct vmw_ttm_tt *vmw_tt)
+ if (unlikely(ret != 0))
+ return ret;
+
+- ret = sg_alloc_table_from_pages(&vmw_tt->sgt, vsgt->pages,
+- vsgt->num_pages, 0,
+- (unsigned long)
+- vsgt->num_pages << PAGE_SHIFT,
+- GFP_KERNEL);
++ ret = __sg_alloc_table_from_pages
++ (&vmw_tt->sgt, vsgt->pages, vsgt->num_pages, 0,
++ (unsigned long) vsgt->num_pages << PAGE_SHIFT,
++ dma_get_max_seg_size(dev_priv->dev->dev),
++ GFP_KERNEL);
+ if (unlikely(ret != 0))
+ goto out_sg_alloc_fail;
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 97d33b8ed36c..92452992b368 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1212,6 +1212,7 @@
+ #define USB_DEVICE_ID_PRIMAX_KEYBOARD 0x4e05
+ #define USB_DEVICE_ID_PRIMAX_REZEL 0x4e72
+ #define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F 0x4d0f
++#define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D65 0x4d65
+ #define USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22 0x4e22
+
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index e24790c988c0..5892f1bd037e 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -131,6 +131,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_MOUSE_4D22), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D0F), HID_QUIRK_ALWAYS_POLL },
++ { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4D65), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_PIXART_MOUSE_4E22), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001), HID_QUIRK_NOGET },
+diff --git a/drivers/input/keyboard/imx_keypad.c b/drivers/input/keyboard/imx_keypad.c
+index 539cb670de41..ae9c51cc85f9 100644
+--- a/drivers/input/keyboard/imx_keypad.c
++++ b/drivers/input/keyboard/imx_keypad.c
+@@ -526,11 +526,12 @@ static int imx_keypad_probe(struct platform_device *pdev)
+ return 0;
+ }
+
+-static int __maybe_unused imx_kbd_suspend(struct device *dev)
++static int __maybe_unused imx_kbd_noirq_suspend(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct imx_keypad *kbd = platform_get_drvdata(pdev);
+ struct input_dev *input_dev = kbd->input_dev;
++ unsigned short reg_val = readw(kbd->mmio_base + KPSR);
+
+ /* imx kbd can wake up system even clock is disabled */
+ mutex_lock(&input_dev->mutex);
+@@ -540,13 +541,20 @@ static int __maybe_unused imx_kbd_suspend(struct device *dev)
+
+ mutex_unlock(&input_dev->mutex);
+
+- if (device_may_wakeup(&pdev->dev))
++ if (device_may_wakeup(&pdev->dev)) {
++ if (reg_val & KBD_STAT_KPKD)
++ reg_val |= KBD_STAT_KRIE;
++ if (reg_val & KBD_STAT_KPKR)
++ reg_val |= KBD_STAT_KDIE;
++ writew(reg_val, kbd->mmio_base + KPSR);
++
+ enable_irq_wake(kbd->irq);
++ }
+
+ return 0;
+ }
+
+-static int __maybe_unused imx_kbd_resume(struct device *dev)
++static int __maybe_unused imx_kbd_noirq_resume(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct imx_keypad *kbd = platform_get_drvdata(pdev);
+@@ -570,7 +578,9 @@ err_clk:
+ return ret;
+ }
+
+-static SIMPLE_DEV_PM_OPS(imx_kbd_pm_ops, imx_kbd_suspend, imx_kbd_resume);
++static const struct dev_pm_ops imx_kbd_pm_ops = {
++ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(imx_kbd_noirq_suspend, imx_kbd_noirq_resume)
++};
+
+ static struct platform_driver imx_keypad_driver = {
+ .driver = {
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index a7f8b1614559..530142b5a115 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1189,6 +1189,8 @@ static const char * const middle_button_pnp_ids[] = {
+ "LEN2132", /* ThinkPad P52 */
+ "LEN2133", /* ThinkPad P72 w/ NFC */
+ "LEN2134", /* ThinkPad P72 */
++ "LEN0407",
++ "LEN0408",
+ NULL
+ };
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index b924f62e2cd5..fb5d702e43b5 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7625,9 +7625,9 @@ static void status_unused(struct seq_file *seq)
+ static int status_resync(struct seq_file *seq, struct mddev *mddev)
+ {
+ sector_t max_sectors, resync, res;
+- unsigned long dt, db;
+- sector_t rt;
+- int scale;
++ unsigned long dt, db = 0;
++ sector_t rt, curr_mark_cnt, resync_mark_cnt;
++ int scale, recovery_active;
+ unsigned int per_milli;
+
+ if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery) ||
+@@ -7716,22 +7716,30 @@ static int status_resync(struct seq_file *seq, struct mddev *mddev)
+ * db: blocks written from mark until now
+ * rt: remaining time
+ *
+- * rt is a sector_t, so could be 32bit or 64bit.
+- * So we divide before multiply in case it is 32bit and close
+- * to the limit.
+- * We scale the divisor (db) by 32 to avoid losing precision
+- * near the end of resync when the number of remaining sectors
+- * is close to 'db'.
+- * We then divide rt by 32 after multiplying by db to compensate.
+- * The '+1' avoids division by zero if db is very small.
++ * rt is a sector_t, which is always 64bit now. We are keeping
++ * the original algorithm, but it is not really necessary.
++ *
++ * Original algorithm:
++ * So we divide before multiply in case it is 32bit and close
++ * to the limit.
++ * We scale the divisor (db) by 32 to avoid losing precision
++ * near the end of resync when the number of remaining sectors
++ * is close to 'db'.
++ * We then divide rt by 32 after multiplying by db to compensate.
++ * The '+1' avoids division by zero if db is very small.
+ */
+ dt = ((jiffies - mddev->resync_mark) / HZ);
+ if (!dt) dt++;
+- db = (mddev->curr_mark_cnt - atomic_read(&mddev->recovery_active))
+- - mddev->resync_mark_cnt;
++
++ curr_mark_cnt = mddev->curr_mark_cnt;
++ recovery_active = atomic_read(&mddev->recovery_active);
++ resync_mark_cnt = mddev->resync_mark_cnt;
++
++ if (curr_mark_cnt >= (recovery_active + resync_mark_cnt))
++ db = curr_mark_cnt - (recovery_active + resync_mark_cnt);
+
+ rt = max_sectors - resync; /* number of remaining sectors */
+- sector_div(rt, db/32+1);
++ rt = div64_u64(rt, db/32+1);
+ rt *= dt;
+ rt >>= 5;
+
+diff --git a/drivers/media/dvb-frontends/stv0297.c b/drivers/media/dvb-frontends/stv0297.c
+index 9a9915f71483..3ef31a3a27ff 100644
+--- a/drivers/media/dvb-frontends/stv0297.c
++++ b/drivers/media/dvb-frontends/stv0297.c
+@@ -694,7 +694,7 @@ static const struct dvb_frontend_ops stv0297_ops = {
+ .delsys = { SYS_DVBC_ANNEX_A },
+ .info = {
+ .name = "ST STV0297 DVB-C",
+- .frequency_min_hz = 470 * MHz,
++ .frequency_min_hz = 47 * MHz,
+ .frequency_max_hz = 862 * MHz,
+ .frequency_stepsize_hz = 62500,
+ .symbol_rate_min = 870000,
+diff --git a/drivers/misc/lkdtm/Makefile b/drivers/misc/lkdtm/Makefile
+index 3370a4138e94..cce47a15a79f 100644
+--- a/drivers/misc/lkdtm/Makefile
++++ b/drivers/misc/lkdtm/Makefile
+@@ -13,8 +13,7 @@ KCOV_INSTRUMENT_rodata.o := n
+
+ OBJCOPYFLAGS :=
+ OBJCOPYFLAGS_rodata_objcopy.o := \
+- --set-section-flags .text=alloc,readonly \
+- --rename-section .text=.rodata
++ --rename-section .text=.rodata,alloc,readonly,load
+ targets += rodata.o rodata_objcopy.o
+ $(obj)/rodata_objcopy.o: $(obj)/rodata.o FORCE
+ $(call if_changed,objcopy)
+diff --git a/drivers/misc/vmw_vmci/vmci_context.c b/drivers/misc/vmw_vmci/vmci_context.c
+index 21d0fa592145..bc089e634a75 100644
+--- a/drivers/misc/vmw_vmci/vmci_context.c
++++ b/drivers/misc/vmw_vmci/vmci_context.c
+@@ -29,6 +29,9 @@
+ #include "vmci_driver.h"
+ #include "vmci_event.h"
+
++/* Use a wide upper bound for the maximum contexts. */
++#define VMCI_MAX_CONTEXTS 2000
++
+ /*
+ * List of current VMCI contexts. Contexts can be added by
+ * vmci_ctx_create() and removed via vmci_ctx_destroy().
+@@ -125,19 +128,22 @@ struct vmci_ctx *vmci_ctx_create(u32 cid, u32 priv_flags,
+ /* Initialize host-specific VMCI context. */
+ init_waitqueue_head(&context->host_context.wait_queue);
+
+- context->queue_pair_array = vmci_handle_arr_create(0);
++ context->queue_pair_array =
++ vmci_handle_arr_create(0, VMCI_MAX_GUEST_QP_COUNT);
+ if (!context->queue_pair_array) {
+ error = -ENOMEM;
+ goto err_free_ctx;
+ }
+
+- context->doorbell_array = vmci_handle_arr_create(0);
++ context->doorbell_array =
++ vmci_handle_arr_create(0, VMCI_MAX_GUEST_DOORBELL_COUNT);
+ if (!context->doorbell_array) {
+ error = -ENOMEM;
+ goto err_free_qp_array;
+ }
+
+- context->pending_doorbell_array = vmci_handle_arr_create(0);
++ context->pending_doorbell_array =
++ vmci_handle_arr_create(0, VMCI_MAX_GUEST_DOORBELL_COUNT);
+ if (!context->pending_doorbell_array) {
+ error = -ENOMEM;
+ goto err_free_db_array;
+@@ -212,7 +218,7 @@ static int ctx_fire_notification(u32 context_id, u32 priv_flags)
+ * We create an array to hold the subscribers we find when
+ * scanning through all contexts.
+ */
+- subscriber_array = vmci_handle_arr_create(0);
++ subscriber_array = vmci_handle_arr_create(0, VMCI_MAX_CONTEXTS);
+ if (subscriber_array == NULL)
+ return VMCI_ERROR_NO_MEM;
+
+@@ -631,20 +637,26 @@ int vmci_ctx_add_notification(u32 context_id, u32 remote_cid)
+
+ spin_lock(&context->lock);
+
+- list_for_each_entry(n, &context->notifier_list, node) {
+- if (vmci_handle_is_equal(n->handle, notifier->handle)) {
+- exists = true;
+- break;
++ if (context->n_notifiers < VMCI_MAX_CONTEXTS) {
++ list_for_each_entry(n, &context->notifier_list, node) {
++ if (vmci_handle_is_equal(n->handle, notifier->handle)) {
++ exists = true;
++ break;
++ }
+ }
+- }
+
+- if (exists) {
+- kfree(notifier);
+- result = VMCI_ERROR_ALREADY_EXISTS;
++ if (exists) {
++ kfree(notifier);
++ result = VMCI_ERROR_ALREADY_EXISTS;
++ } else {
++ list_add_tail_rcu(¬ifier->node,
++ &context->notifier_list);
++ context->n_notifiers++;
++ result = VMCI_SUCCESS;
++ }
+ } else {
+- list_add_tail_rcu(¬ifier->node, &context->notifier_list);
+- context->n_notifiers++;
+- result = VMCI_SUCCESS;
++ kfree(notifier);
++ result = VMCI_ERROR_NO_MEM;
+ }
+
+ spin_unlock(&context->lock);
+@@ -729,8 +741,7 @@ static int vmci_ctx_get_chkpt_doorbells(struct vmci_ctx *context,
+ u32 *buf_size, void **pbuf)
+ {
+ struct dbell_cpt_state *dbells;
+- size_t n_doorbells;
+- int i;
++ u32 i, n_doorbells;
+
+ n_doorbells = vmci_handle_arr_get_size(context->doorbell_array);
+ if (n_doorbells > 0) {
+@@ -868,7 +879,8 @@ int vmci_ctx_rcv_notifications_get(u32 context_id,
+ spin_lock(&context->lock);
+
+ *db_handle_array = context->pending_doorbell_array;
+- context->pending_doorbell_array = vmci_handle_arr_create(0);
++ context->pending_doorbell_array =
++ vmci_handle_arr_create(0, VMCI_MAX_GUEST_DOORBELL_COUNT);
+ if (!context->pending_doorbell_array) {
+ context->pending_doorbell_array = *db_handle_array;
+ *db_handle_array = NULL;
+@@ -950,12 +962,11 @@ int vmci_ctx_dbell_create(u32 context_id, struct vmci_handle handle)
+ return VMCI_ERROR_NOT_FOUND;
+
+ spin_lock(&context->lock);
+- if (!vmci_handle_arr_has_entry(context->doorbell_array, handle)) {
+- vmci_handle_arr_append_entry(&context->doorbell_array, handle);
+- result = VMCI_SUCCESS;
+- } else {
++ if (!vmci_handle_arr_has_entry(context->doorbell_array, handle))
++ result = vmci_handle_arr_append_entry(&context->doorbell_array,
++ handle);
++ else
+ result = VMCI_ERROR_DUPLICATE_ENTRY;
+- }
+
+ spin_unlock(&context->lock);
+ vmci_ctx_put(context);
+@@ -1091,15 +1102,16 @@ int vmci_ctx_notify_dbell(u32 src_cid,
+ if (!vmci_handle_arr_has_entry(
+ dst_context->pending_doorbell_array,
+ handle)) {
+- vmci_handle_arr_append_entry(
++ result = vmci_handle_arr_append_entry(
+ &dst_context->pending_doorbell_array,
+ handle);
+-
+- ctx_signal_notify(dst_context);
+- wake_up(&dst_context->host_context.wait_queue);
+-
++ if (result == VMCI_SUCCESS) {
++ ctx_signal_notify(dst_context);
++ wake_up(&dst_context->host_context.wait_queue);
++ }
++ } else {
++ result = VMCI_SUCCESS;
+ }
+- result = VMCI_SUCCESS;
+ }
+ spin_unlock(&dst_context->lock);
+ }
+@@ -1126,13 +1138,11 @@ int vmci_ctx_qp_create(struct vmci_ctx *context, struct vmci_handle handle)
+ if (context == NULL || vmci_handle_is_invalid(handle))
+ return VMCI_ERROR_INVALID_ARGS;
+
+- if (!vmci_handle_arr_has_entry(context->queue_pair_array, handle)) {
+- vmci_handle_arr_append_entry(&context->queue_pair_array,
+- handle);
+- result = VMCI_SUCCESS;
+- } else {
++ if (!vmci_handle_arr_has_entry(context->queue_pair_array, handle))
++ result = vmci_handle_arr_append_entry(
++ &context->queue_pair_array, handle);
++ else
+ result = VMCI_ERROR_DUPLICATE_ENTRY;
+- }
+
+ return result;
+ }
+diff --git a/drivers/misc/vmw_vmci/vmci_handle_array.c b/drivers/misc/vmw_vmci/vmci_handle_array.c
+index 344973a0fb0a..917e18a8af95 100644
+--- a/drivers/misc/vmw_vmci/vmci_handle_array.c
++++ b/drivers/misc/vmw_vmci/vmci_handle_array.c
+@@ -16,24 +16,29 @@
+ #include <linux/slab.h>
+ #include "vmci_handle_array.h"
+
+-static size_t handle_arr_calc_size(size_t capacity)
++static size_t handle_arr_calc_size(u32 capacity)
+ {
+- return sizeof(struct vmci_handle_arr) +
++ return VMCI_HANDLE_ARRAY_HEADER_SIZE +
+ capacity * sizeof(struct vmci_handle);
+ }
+
+-struct vmci_handle_arr *vmci_handle_arr_create(size_t capacity)
++struct vmci_handle_arr *vmci_handle_arr_create(u32 capacity, u32 max_capacity)
+ {
+ struct vmci_handle_arr *array;
+
++ if (max_capacity == 0 || capacity > max_capacity)
++ return NULL;
++
+ if (capacity == 0)
+- capacity = VMCI_HANDLE_ARRAY_DEFAULT_SIZE;
++ capacity = min((u32)VMCI_HANDLE_ARRAY_DEFAULT_CAPACITY,
++ max_capacity);
+
+ array = kmalloc(handle_arr_calc_size(capacity), GFP_ATOMIC);
+ if (!array)
+ return NULL;
+
+ array->capacity = capacity;
++ array->max_capacity = max_capacity;
+ array->size = 0;
+
+ return array;
+@@ -44,27 +49,34 @@ void vmci_handle_arr_destroy(struct vmci_handle_arr *array)
+ kfree(array);
+ }
+
+-void vmci_handle_arr_append_entry(struct vmci_handle_arr **array_ptr,
+- struct vmci_handle handle)
++int vmci_handle_arr_append_entry(struct vmci_handle_arr **array_ptr,
++ struct vmci_handle handle)
+ {
+ struct vmci_handle_arr *array = *array_ptr;
+
+ if (unlikely(array->size >= array->capacity)) {
+ /* reallocate. */
+ struct vmci_handle_arr *new_array;
+- size_t new_capacity = array->capacity * VMCI_ARR_CAP_MULT;
+- size_t new_size = handle_arr_calc_size(new_capacity);
++ u32 capacity_bump = min(array->max_capacity - array->capacity,
++ array->capacity);
++ size_t new_size = handle_arr_calc_size(array->capacity +
++ capacity_bump);
++
++ if (array->size >= array->max_capacity)
++ return VMCI_ERROR_NO_MEM;
+
+ new_array = krealloc(array, new_size, GFP_ATOMIC);
+ if (!new_array)
+- return;
++ return VMCI_ERROR_NO_MEM;
+
+- new_array->capacity = new_capacity;
++ new_array->capacity += capacity_bump;
+ *array_ptr = array = new_array;
+ }
+
+ array->entries[array->size] = handle;
+ array->size++;
++
++ return VMCI_SUCCESS;
+ }
+
+ /*
+@@ -74,7 +86,7 @@ struct vmci_handle vmci_handle_arr_remove_entry(struct vmci_handle_arr *array,
+ struct vmci_handle entry_handle)
+ {
+ struct vmci_handle handle = VMCI_INVALID_HANDLE;
+- size_t i;
++ u32 i;
+
+ for (i = 0; i < array->size; i++) {
+ if (vmci_handle_is_equal(array->entries[i], entry_handle)) {
+@@ -109,7 +121,7 @@ struct vmci_handle vmci_handle_arr_remove_tail(struct vmci_handle_arr *array)
+ * Handle at given index, VMCI_INVALID_HANDLE if invalid index.
+ */
+ struct vmci_handle
+-vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, size_t index)
++vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, u32 index)
+ {
+ if (unlikely(index >= array->size))
+ return VMCI_INVALID_HANDLE;
+@@ -120,7 +132,7 @@ vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, size_t index)
+ bool vmci_handle_arr_has_entry(const struct vmci_handle_arr *array,
+ struct vmci_handle entry_handle)
+ {
+- size_t i;
++ u32 i;
+
+ for (i = 0; i < array->size; i++)
+ if (vmci_handle_is_equal(array->entries[i], entry_handle))
+diff --git a/drivers/misc/vmw_vmci/vmci_handle_array.h b/drivers/misc/vmw_vmci/vmci_handle_array.h
+index b5f3a7f98cf1..0fc58597820e 100644
+--- a/drivers/misc/vmw_vmci/vmci_handle_array.h
++++ b/drivers/misc/vmw_vmci/vmci_handle_array.h
+@@ -17,32 +17,41 @@
+ #define _VMCI_HANDLE_ARRAY_H_
+
+ #include <linux/vmw_vmci_defs.h>
++#include <linux/limits.h>
+ #include <linux/types.h>
+
+-#define VMCI_HANDLE_ARRAY_DEFAULT_SIZE 4
+-#define VMCI_ARR_CAP_MULT 2 /* Array capacity multiplier */
+-
+ struct vmci_handle_arr {
+- size_t capacity;
+- size_t size;
++ u32 capacity;
++ u32 max_capacity;
++ u32 size;
++ u32 pad;
+ struct vmci_handle entries[];
+ };
+
+-struct vmci_handle_arr *vmci_handle_arr_create(size_t capacity);
++#define VMCI_HANDLE_ARRAY_HEADER_SIZE \
++ offsetof(struct vmci_handle_arr, entries)
++/* Select a default capacity that results in a 64 byte sized array */
++#define VMCI_HANDLE_ARRAY_DEFAULT_CAPACITY 6
++/* Make sure that the max array size can be expressed by a u32 */
++#define VMCI_HANDLE_ARRAY_MAX_CAPACITY \
++ ((U32_MAX - VMCI_HANDLE_ARRAY_HEADER_SIZE - 1) / \
++ sizeof(struct vmci_handle))
++
++struct vmci_handle_arr *vmci_handle_arr_create(u32 capacity, u32 max_capacity);
+ void vmci_handle_arr_destroy(struct vmci_handle_arr *array);
+-void vmci_handle_arr_append_entry(struct vmci_handle_arr **array_ptr,
+- struct vmci_handle handle);
++int vmci_handle_arr_append_entry(struct vmci_handle_arr **array_ptr,
++ struct vmci_handle handle);
+ struct vmci_handle vmci_handle_arr_remove_entry(struct vmci_handle_arr *array,
+ struct vmci_handle
+ entry_handle);
+ struct vmci_handle vmci_handle_arr_remove_tail(struct vmci_handle_arr *array);
+ struct vmci_handle
+-vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, size_t index);
++vmci_handle_arr_get_entry(const struct vmci_handle_arr *array, u32 index);
+ bool vmci_handle_arr_has_entry(const struct vmci_handle_arr *array,
+ struct vmci_handle entry_handle);
+ struct vmci_handle *vmci_handle_arr_get_handles(struct vmci_handle_arr *array);
+
+-static inline size_t vmci_handle_arr_get_size(
++static inline u32 vmci_handle_arr_get_size(
+ const struct vmci_handle_arr *array)
+ {
+ return array->size;
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index 55997cf84b39..f1fe446eee66 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1209,13 +1209,13 @@ static int mmc_select_hs400(struct mmc_card *card)
+ mmc_set_timing(host, MMC_TIMING_MMC_HS400);
+ mmc_set_bus_speed(card);
+
++ if (host->ops->hs400_complete)
++ host->ops->hs400_complete(host);
++
+ err = mmc_switch_status(card);
+ if (err)
+ goto out_err;
+
+- if (host->ops->hs400_complete)
+- host->ops->hs400_complete(host);
+-
+ return 0;
+
+ out_err:
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 9b449400376b..deb274a19ba0 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -822,6 +822,27 @@ static int m_can_poll(struct napi_struct *napi, int quota)
+ if (!irqstatus)
+ goto end;
+
++ /* Errata workaround for issue "Needless activation of MRAF irq"
++ * During frame reception while the MCAN is in Error Passive state
++ * and the Receive Error Counter has the value MCAN_ECR.REC = 127,
++ * it may happen that MCAN_IR.MRAF is set although there was no
++ * Message RAM access failure.
++ * If MCAN_IR.MRAF is enabled, an interrupt to the Host CPU is generated
++ * The Message RAM Access Failure interrupt routine needs to check
++ * whether MCAN_ECR.RP = ’1’ and MCAN_ECR.REC = 127.
++ * In this case, reset MCAN_IR.MRAF. No further action is required.
++ */
++ if ((priv->version <= 31) && (irqstatus & IR_MRAF) &&
++ (m_can_read(priv, M_CAN_ECR) & ECR_RP)) {
++ struct can_berr_counter bec;
++
++ __m_can_get_berr_counter(dev, &bec);
++ if (bec.rxerr == 127) {
++ m_can_write(priv, M_CAN_IR, IR_MRAF);
++ irqstatus &= ~IR_MRAF;
++ }
++ }
++
+ psr = m_can_read(priv, M_CAN_PSR);
+ if (irqstatus & IR_ERR_STATE)
+ work_done += m_can_handle_state_errors(dev, psr);
+diff --git a/drivers/net/can/spi/Kconfig b/drivers/net/can/spi/Kconfig
+index 8f2e0dd7b756..792e9c6c4a2f 100644
+--- a/drivers/net/can/spi/Kconfig
++++ b/drivers/net/can/spi/Kconfig
+@@ -8,9 +8,10 @@ config CAN_HI311X
+ Driver for the Holt HI311x SPI CAN controllers.
+
+ config CAN_MCP251X
+- tristate "Microchip MCP251x SPI CAN controllers"
++ tristate "Microchip MCP251x and MCP25625 SPI CAN controllers"
+ depends on HAS_DMA
+ ---help---
+- Driver for the Microchip MCP251x SPI CAN controllers.
++ Driver for the Microchip MCP251x and MCP25625 SPI CAN
++ controllers.
+
+ endmenu
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index e90817608645..da64e71a62ee 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -1,5 +1,5 @@
+ /*
+- * CAN bus driver for Microchip 251x CAN Controller with SPI Interface
++ * CAN bus driver for Microchip 251x/25625 CAN Controller with SPI Interface
+ *
+ * MCP2510 support and bug fixes by Christian Pellegrin
+ * <chripell@evolware.org>
+@@ -41,7 +41,7 @@
+ * static struct spi_board_info spi_board_info[] = {
+ * {
+ * .modalias = "mcp2510",
+- * // or "mcp2515" depending on your controller
++ * // "mcp2515" or "mcp25625" depending on your controller
+ * .platform_data = &mcp251x_info,
+ * .irq = IRQ_EINT13,
+ * .max_speed_hz = 2*1000*1000,
+@@ -238,6 +238,7 @@ static const struct can_bittiming_const mcp251x_bittiming_const = {
+ enum mcp251x_model {
+ CAN_MCP251X_MCP2510 = 0x2510,
+ CAN_MCP251X_MCP2515 = 0x2515,
++ CAN_MCP251X_MCP25625 = 0x25625,
+ };
+
+ struct mcp251x_priv {
+@@ -280,7 +281,6 @@ static inline int mcp251x_is_##_model(struct spi_device *spi) \
+ }
+
+ MCP251X_IS(2510);
+-MCP251X_IS(2515);
+
+ static void mcp251x_clean(struct net_device *net)
+ {
+@@ -639,7 +639,7 @@ static int mcp251x_hw_reset(struct spi_device *spi)
+
+ /* Wait for oscillator startup timer after reset */
+ mdelay(MCP251X_OST_DELAY_MS);
+-
++
+ reg = mcp251x_read_reg(spi, CANSTAT);
+ if ((reg & CANCTRL_REQOP_MASK) != CANCTRL_REQOP_CONF)
+ return -ENODEV;
+@@ -820,9 +820,8 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id)
+ /* receive buffer 0 */
+ if (intf & CANINTF_RX0IF) {
+ mcp251x_hw_rx(spi, 0);
+- /*
+- * Free one buffer ASAP
+- * (The MCP2515 does this automatically.)
++ /* Free one buffer ASAP
++ * (The MCP2515/25625 does this automatically.)
+ */
+ if (mcp251x_is_2510(spi))
+ mcp251x_write_bits(spi, CANINTF, CANINTF_RX0IF, 0x00);
+@@ -831,7 +830,7 @@ static irqreturn_t mcp251x_can_ist(int irq, void *dev_id)
+ /* receive buffer 1 */
+ if (intf & CANINTF_RX1IF) {
+ mcp251x_hw_rx(spi, 1);
+- /* the MCP2515 does this automatically */
++ /* The MCP2515/25625 does this automatically. */
+ if (mcp251x_is_2510(spi))
+ clear_intf |= CANINTF_RX1IF;
+ }
+@@ -1006,6 +1005,10 @@ static const struct of_device_id mcp251x_of_match[] = {
+ .compatible = "microchip,mcp2515",
+ .data = (void *)CAN_MCP251X_MCP2515,
+ },
++ {
++ .compatible = "microchip,mcp25625",
++ .data = (void *)CAN_MCP251X_MCP25625,
++ },
+ { }
+ };
+ MODULE_DEVICE_TABLE(of, mcp251x_of_match);
+@@ -1019,6 +1022,10 @@ static const struct spi_device_id mcp251x_id_table[] = {
+ .name = "mcp2515",
+ .driver_data = (kernel_ulong_t)CAN_MCP251X_MCP2515,
+ },
++ {
++ .name = "mcp25625",
++ .driver_data = (kernel_ulong_t)CAN_MCP251X_MCP25625,
++ },
+ { }
+ };
+ MODULE_DEVICE_TABLE(spi, mcp251x_id_table);
+@@ -1259,5 +1266,5 @@ module_spi_driver(mcp251x_can_driver);
+
+ MODULE_AUTHOR("Chris Elston <celston@katalix.com>, "
+ "Christian Pellegrin <chripell@evolware.org>");
+-MODULE_DESCRIPTION("Microchip 251x CAN driver");
++MODULE_DESCRIPTION("Microchip 251x/25625 CAN driver");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/net/dsa/mv88e6xxx/global1_vtu.c b/drivers/net/dsa/mv88e6xxx/global1_vtu.c
+index 058326924f3e..7a6667e0b9f9 100644
+--- a/drivers/net/dsa/mv88e6xxx/global1_vtu.c
++++ b/drivers/net/dsa/mv88e6xxx/global1_vtu.c
+@@ -419,7 +419,7 @@ int mv88e6185_g1_vtu_loadpurge(struct mv88e6xxx_chip *chip,
+ * VTU DBNum[7:4] are located in VTU Operation 11:8
+ */
+ op |= entry->fid & 0x000f;
+- op |= (entry->fid & 0x00f0) << 8;
++ op |= (entry->fid & 0x00f0) << 4;
+ }
+
+ return mv88e6xxx_g1_vtu_op(chip, op);
+diff --git a/drivers/net/ethernet/8390/Kconfig b/drivers/net/ethernet/8390/Kconfig
+index f2f0264c58ba..443b34e2725f 100644
+--- a/drivers/net/ethernet/8390/Kconfig
++++ b/drivers/net/ethernet/8390/Kconfig
+@@ -49,7 +49,7 @@ config XSURF100
+ tristate "Amiga XSurf 100 AX88796/NE2000 clone support"
+ depends on ZORRO
+ select AX88796
+- select ASIX_PHY
++ select AX88796B_PHY
+ help
+ This driver is for the Individual Computers X-Surf 100 Ethernet
+ card (based on the Asix AX88796 chip). If you have such a card,
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+index a4a90b6cdb46..c428b0655c26 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+@@ -1581,7 +1581,8 @@ static int bnx2x_get_module_info(struct net_device *dev,
+ }
+
+ if (!sff8472_comp ||
+- (diag_type & SFP_EEPROM_DIAG_ADDR_CHANGE_REQ)) {
++ (diag_type & SFP_EEPROM_DIAG_ADDR_CHANGE_REQ) ||
++ !(diag_type & SFP_EEPROM_DDM_IMPLEMENTED)) {
+ modinfo->type = ETH_MODULE_SFF_8079;
+ modinfo->eeprom_len = ETH_MODULE_SFF_8079_LEN;
+ } else {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
+index b7d251108c19..7115f5025664 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
+@@ -62,6 +62,7 @@
+ #define SFP_EEPROM_DIAG_TYPE_ADDR 0x5c
+ #define SFP_EEPROM_DIAG_TYPE_SIZE 1
+ #define SFP_EEPROM_DIAG_ADDR_CHANGE_REQ (1<<2)
++#define SFP_EEPROM_DDM_IMPLEMENTED (1<<6)
+ #define SFP_EEPROM_SFF_8472_COMP_ADDR 0x5e
+ #define SFP_EEPROM_SFF_8472_COMP_SIZE 1
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/lio_core.c b/drivers/net/ethernet/cavium/liquidio/lio_core.c
+index 8093c5eafea2..781814835a4f 100644
+--- a/drivers/net/ethernet/cavium/liquidio/lio_core.c
++++ b/drivers/net/ethernet/cavium/liquidio/lio_core.c
+@@ -985,7 +985,7 @@ static void liquidio_schedule_droq_pkt_handlers(struct octeon_device *oct)
+
+ if (droq->ops.poll_mode) {
+ droq->ops.napi_fn(droq);
+- oct_priv->napi_mask |= (1 << oq_no);
++ oct_priv->napi_mask |= BIT_ULL(oq_no);
+ } else {
+ tasklet_schedule(&oct_priv->droq_tasklet);
+ }
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 426789e2c23d..0ae43d27cdcf 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -438,9 +438,10 @@ static int reset_rx_pools(struct ibmvnic_adapter *adapter)
+ if (rx_pool->buff_size != be64_to_cpu(size_array[i])) {
+ free_long_term_buff(adapter, &rx_pool->long_term_buff);
+ rx_pool->buff_size = be64_to_cpu(size_array[i]);
+- alloc_long_term_buff(adapter, &rx_pool->long_term_buff,
+- rx_pool->size *
+- rx_pool->buff_size);
++ rc = alloc_long_term_buff(adapter,
++ &rx_pool->long_term_buff,
++ rx_pool->size *
++ rx_pool->buff_size);
+ } else {
+ rc = reset_long_term_buff(adapter,
+ &rx_pool->long_term_buff);
+@@ -706,9 +707,9 @@ static int init_tx_pools(struct net_device *netdev)
+ return rc;
+ }
+
+- init_one_tx_pool(netdev, &adapter->tso_pool[i],
+- IBMVNIC_TSO_BUFS,
+- IBMVNIC_TSO_BUF_SZ);
++ rc = init_one_tx_pool(netdev, &adapter->tso_pool[i],
++ IBMVNIC_TSO_BUFS,
++ IBMVNIC_TSO_BUF_SZ);
+ if (rc) {
+ release_tx_pools(adapter);
+ return rc;
+@@ -1754,7 +1755,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+
+ ibmvnic_cleanup(netdev);
+
+- if (adapter->reset_reason != VNIC_RESET_MOBILITY &&
++ if (reset_state == VNIC_OPEN &&
++ adapter->reset_reason != VNIC_RESET_MOBILITY &&
+ adapter->reset_reason != VNIC_RESET_FAILOVER) {
+ rc = __ibmvnic_close(netdev);
+ if (rc)
+@@ -1853,6 +1855,9 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ return 0;
+ }
+
++ /* refresh device's multicast list */
++ ibmvnic_set_multi(netdev);
++
+ /* kick napi */
+ for (i = 0; i < adapter->req_rx_queues; i++)
+ napi_schedule(&adapter->napi[i]);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+index 6e8b619b769b..aee58b3892f2 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+@@ -877,7 +877,7 @@ static inline void mlxsw_reg_spaft_pack(char *payload, u8 local_port,
+ MLXSW_REG_ZERO(spaft, payload);
+ mlxsw_reg_spaft_local_port_set(payload, local_port);
+ mlxsw_reg_spaft_allow_untagged_set(payload, allow_untagged);
+- mlxsw_reg_spaft_allow_prio_tagged_set(payload, true);
++ mlxsw_reg_spaft_allow_prio_tagged_set(payload, allow_untagged);
+ mlxsw_reg_spaft_allow_tagged_set(payload, true);
+ }
+
+diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
+index 82070792edbb..1f5fd24cd749 100644
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -227,7 +227,7 @@ config AQUANTIA_PHY
+ ---help---
+ Currently supports the Aquantia AQ1202, AQ2104, AQR105, AQR405
+
+-config ASIX_PHY
++config AX88796B_PHY
+ tristate "Asix PHYs"
+ help
+ Currently supports the Asix Electronics PHY found in the X-Surf 100
+diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
+index 5805c0b7d60e..f21cda9d865e 100644
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -46,7 +46,7 @@ obj-y += $(sfp-obj-y) $(sfp-obj-m)
+
+ obj-$(CONFIG_AMD_PHY) += amd.o
+ obj-$(CONFIG_AQUANTIA_PHY) += aquantia.o
+-obj-$(CONFIG_ASIX_PHY) += asix.o
++obj-$(CONFIG_AX88796B_PHY) += ax88796b.o
+ obj-$(CONFIG_AT803X_PHY) += at803x.o
+ obj-$(CONFIG_BCM63XX_PHY) += bcm63xx.o
+ obj-$(CONFIG_BCM7XXX_PHY) += bcm7xxx.o
+diff --git a/drivers/net/phy/asix.c b/drivers/net/phy/asix.c
+deleted file mode 100644
+index 8ebe7f5484ae..000000000000
+--- a/drivers/net/phy/asix.c
++++ /dev/null
+@@ -1,63 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/* Driver for Asix PHYs
+- *
+- * Author: Michael Schmitz <schmitzmic@gmail.com>
+- *
+- * This program is free software; you can redistribute it and/or modify it
+- * under the terms of the GNU General Public License as published by the
+- * Free Software Foundation; either version 2 of the License, or (at your
+- * option) any later version.
+- *
+- */
+-#include <linux/kernel.h>
+-#include <linux/errno.h>
+-#include <linux/init.h>
+-#include <linux/module.h>
+-#include <linux/mii.h>
+-#include <linux/phy.h>
+-
+-#define PHY_ID_ASIX_AX88796B 0x003b1841
+-
+-MODULE_DESCRIPTION("Asix PHY driver");
+-MODULE_AUTHOR("Michael Schmitz <schmitzmic@gmail.com>");
+-MODULE_LICENSE("GPL");
+-
+-/**
+- * asix_soft_reset - software reset the PHY via BMCR_RESET bit
+- * @phydev: target phy_device struct
+- *
+- * Description: Perform a software PHY reset using the standard
+- * BMCR_RESET bit and poll for the reset bit to be cleared.
+- * Toggle BMCR_RESET bit off to accommodate broken AX8796B PHY implementation
+- * such as used on the Individual Computers' X-Surf 100 Zorro card.
+- *
+- * Returns: 0 on success, < 0 on failure
+- */
+-static int asix_soft_reset(struct phy_device *phydev)
+-{
+- int ret;
+-
+- /* Asix PHY won't reset unless reset bit toggles */
+- ret = phy_write(phydev, MII_BMCR, 0);
+- if (ret < 0)
+- return ret;
+-
+- return genphy_soft_reset(phydev);
+-}
+-
+-static struct phy_driver asix_driver[] = { {
+- .phy_id = PHY_ID_ASIX_AX88796B,
+- .name = "Asix Electronics AX88796B",
+- .phy_id_mask = 0xfffffff0,
+- .features = PHY_BASIC_FEATURES,
+- .soft_reset = asix_soft_reset,
+-} };
+-
+-module_phy_driver(asix_driver);
+-
+-static struct mdio_device_id __maybe_unused asix_tbl[] = {
+- { PHY_ID_ASIX_AX88796B, 0xfffffff0 },
+- { }
+-};
+-
+-MODULE_DEVICE_TABLE(mdio, asix_tbl);
+diff --git a/drivers/net/phy/ax88796b.c b/drivers/net/phy/ax88796b.c
+new file mode 100644
+index 000000000000..8ebe7f5484ae
+--- /dev/null
++++ b/drivers/net/phy/ax88796b.c
+@@ -0,0 +1,63 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Driver for Asix PHYs
++ *
++ * Author: Michael Schmitz <schmitzmic@gmail.com>
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ *
++ */
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/mii.h>
++#include <linux/phy.h>
++
++#define PHY_ID_ASIX_AX88796B 0x003b1841
++
++MODULE_DESCRIPTION("Asix PHY driver");
++MODULE_AUTHOR("Michael Schmitz <schmitzmic@gmail.com>");
++MODULE_LICENSE("GPL");
++
++/**
++ * asix_soft_reset - software reset the PHY via BMCR_RESET bit
++ * @phydev: target phy_device struct
++ *
++ * Description: Perform a software PHY reset using the standard
++ * BMCR_RESET bit and poll for the reset bit to be cleared.
++ * Toggle BMCR_RESET bit off to accommodate broken AX8796B PHY implementation
++ * such as used on the Individual Computers' X-Surf 100 Zorro card.
++ *
++ * Returns: 0 on success, < 0 on failure
++ */
++static int asix_soft_reset(struct phy_device *phydev)
++{
++ int ret;
++
++ /* Asix PHY won't reset unless reset bit toggles */
++ ret = phy_write(phydev, MII_BMCR, 0);
++ if (ret < 0)
++ return ret;
++
++ return genphy_soft_reset(phydev);
++}
++
++static struct phy_driver asix_driver[] = { {
++ .phy_id = PHY_ID_ASIX_AX88796B,
++ .name = "Asix Electronics AX88796B",
++ .phy_id_mask = 0xfffffff0,
++ .features = PHY_BASIC_FEATURES,
++ .soft_reset = asix_soft_reset,
++} };
++
++module_phy_driver(asix_driver);
++
++static struct mdio_device_id __maybe_unused asix_tbl[] = {
++ { PHY_ID_ASIX_AX88796B, 0xfffffff0 },
++ { }
++};
++
++MODULE_DEVICE_TABLE(mdio, asix_tbl);
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index e657d8947125..128c8a327d8e 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -153,7 +153,7 @@ static bool qmimux_has_slaves(struct usbnet *dev)
+
+ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ {
+- unsigned int len, offset = 0;
++ unsigned int len, offset = 0, pad_len, pkt_len;
+ struct qmimux_hdr *hdr;
+ struct net_device *net;
+ struct sk_buff *skbn;
+@@ -171,10 +171,16 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ if (hdr->pad & 0x80)
+ goto skip;
+
++ /* extract padding length and check for valid length info */
++ pad_len = hdr->pad & 0x3f;
++ if (len == 0 || pad_len >= len)
++ goto skip;
++ pkt_len = len - pad_len;
++
+ net = qmimux_find_dev(dev, hdr->mux_id);
+ if (!net)
+ goto skip;
+- skbn = netdev_alloc_skb(net, len);
++ skbn = netdev_alloc_skb(net, pkt_len);
+ if (!skbn)
+ return 0;
+ skbn->dev = net;
+@@ -191,7 +197,7 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ goto skip;
+ }
+
+- skb_put_data(skbn, skb->data + offset + qmimux_hdr_sz, len);
++ skb_put_data(skbn, skb->data + offset + qmimux_hdr_sz, pkt_len);
+ if (netif_rx(skbn) != NET_RX_SUCCESS)
+ return 0;
+
+@@ -241,13 +247,14 @@ out_free_newdev:
+ return err;
+ }
+
+-static void qmimux_unregister_device(struct net_device *dev)
++static void qmimux_unregister_device(struct net_device *dev,
++ struct list_head *head)
+ {
+ struct qmimux_priv *priv = netdev_priv(dev);
+ struct net_device *real_dev = priv->real_dev;
+
+ netdev_upper_dev_unlink(real_dev, dev);
+- unregister_netdevice(dev);
++ unregister_netdevice_queue(dev, head);
+
+ /* Get rid of the reference to real_dev */
+ dev_put(real_dev);
+@@ -356,8 +363,8 @@ static ssize_t add_mux_store(struct device *d, struct device_attribute *attr, c
+ if (kstrtou8(buf, 0, &mux_id))
+ return -EINVAL;
+
+- /* mux_id [1 - 0x7f] range empirically found */
+- if (mux_id < 1 || mux_id > 0x7f)
++ /* mux_id [1 - 254] for compatibility with ip(8) and the rmnet driver */
++ if (mux_id < 1 || mux_id > 254)
+ return -EINVAL;
+
+ if (!rtnl_trylock())
+@@ -418,7 +425,7 @@ static ssize_t del_mux_store(struct device *d, struct device_attribute *attr, c
+ ret = -EINVAL;
+ goto err;
+ }
+- qmimux_unregister_device(del_dev);
++ qmimux_unregister_device(del_dev, NULL);
+
+ if (!qmimux_has_slaves(dev))
+ info->flags &= ~QMI_WWAN_FLAG_MUX;
+@@ -1428,6 +1435,7 @@ static void qmi_wwan_disconnect(struct usb_interface *intf)
+ struct qmi_wwan_state *info;
+ struct list_head *iter;
+ struct net_device *ldev;
++ LIST_HEAD(list);
+
+ /* called twice if separate control and data intf */
+ if (!dev)
+@@ -1440,8 +1448,9 @@ static void qmi_wwan_disconnect(struct usb_interface *intf)
+ }
+ rcu_read_lock();
+ netdev_for_each_upper_dev_rcu(dev->net, ldev, iter)
+- qmimux_unregister_device(ldev);
++ qmimux_unregister_device(ldev, &list);
+ rcu_read_unlock();
++ unregister_netdevice_many(&list);
+ rtnl_unlock();
+ info->flags &= ~QMI_WWAN_FLAG_MUX;
+ }
+diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
+index e7c3f3b8457d..99f1897a775d 100644
+--- a/drivers/net/wireless/ath/carl9170/usb.c
++++ b/drivers/net/wireless/ath/carl9170/usb.c
+@@ -128,6 +128,8 @@ static const struct usb_device_id carl9170_usb_ids[] = {
+ };
+ MODULE_DEVICE_TABLE(usb, carl9170_usb_ids);
+
++static struct usb_driver carl9170_driver;
++
+ static void carl9170_usb_submit_data_urb(struct ar9170 *ar)
+ {
+ struct urb *urb;
+@@ -966,32 +968,28 @@ err_out:
+
+ static void carl9170_usb_firmware_failed(struct ar9170 *ar)
+ {
+- struct device *parent = ar->udev->dev.parent;
+- struct usb_device *udev;
+-
+- /*
+- * Store a copy of the usb_device pointer locally.
+- * This is because device_release_driver initiates
+- * carl9170_usb_disconnect, which in turn frees our
+- * driver context (ar).
++ /* Store a copies of the usb_interface and usb_device pointer locally.
++ * This is because release_driver initiates carl9170_usb_disconnect,
++ * which in turn frees our driver context (ar).
+ */
+- udev = ar->udev;
++ struct usb_interface *intf = ar->intf;
++ struct usb_device *udev = ar->udev;
+
+ complete(&ar->fw_load_wait);
++ /* at this point 'ar' could be already freed. Don't use it anymore */
++ ar = NULL;
+
+ /* unbind anything failed */
+- if (parent)
+- device_lock(parent);
+-
+- device_release_driver(&udev->dev);
+- if (parent)
+- device_unlock(parent);
++ usb_lock_device(udev);
++ usb_driver_release_interface(&carl9170_driver, intf);
++ usb_unlock_device(udev);
+
+- usb_put_dev(udev);
++ usb_put_intf(intf);
+ }
+
+ static void carl9170_usb_firmware_finish(struct ar9170 *ar)
+ {
++ struct usb_interface *intf = ar->intf;
+ int err;
+
+ err = carl9170_parse_firmware(ar);
+@@ -1009,7 +1007,7 @@ static void carl9170_usb_firmware_finish(struct ar9170 *ar)
+ goto err_unrx;
+
+ complete(&ar->fw_load_wait);
+- usb_put_dev(ar->udev);
++ usb_put_intf(intf);
+ return;
+
+ err_unrx:
+@@ -1052,7 +1050,6 @@ static int carl9170_usb_probe(struct usb_interface *intf,
+ return PTR_ERR(ar);
+
+ udev = interface_to_usbdev(intf);
+- usb_get_dev(udev);
+ ar->udev = udev;
+ ar->intf = intf;
+ ar->features = id->driver_info;
+@@ -1094,15 +1091,14 @@ static int carl9170_usb_probe(struct usb_interface *intf,
+ atomic_set(&ar->rx_anch_urbs, 0);
+ atomic_set(&ar->rx_pool_urbs, 0);
+
+- usb_get_dev(ar->udev);
++ usb_get_intf(intf);
+
+ carl9170_set_state(ar, CARL9170_STOPPED);
+
+ err = request_firmware_nowait(THIS_MODULE, 1, CARL9170FW_NAME,
+ &ar->udev->dev, GFP_KERNEL, ar, carl9170_usb_firmware_step2);
+ if (err) {
+- usb_put_dev(udev);
+- usb_put_dev(udev);
++ usb_put_intf(intf);
+ carl9170_free(ar);
+ }
+ return err;
+@@ -1131,7 +1127,6 @@ static void carl9170_usb_disconnect(struct usb_interface *intf)
+
+ carl9170_release_firmware(ar);
+ carl9170_free(ar);
+- usb_put_dev(udev);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+index c0631255aee7..db6628d390a2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+@@ -1547,7 +1547,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
+ goto free;
+
+ out_free_fw:
+- iwl_dealloc_ucode(drv);
+ release_firmware(ucode_raw);
+ out_unbind:
+ complete(&drv->request_firmware_complete);
+diff --git a/drivers/net/wireless/intersil/p54/p54usb.c b/drivers/net/wireless/intersil/p54/p54usb.c
+index b0b86f701061..15661da6eedc 100644
+--- a/drivers/net/wireless/intersil/p54/p54usb.c
++++ b/drivers/net/wireless/intersil/p54/p54usb.c
+@@ -33,6 +33,8 @@ MODULE_ALIAS("prism54usb");
+ MODULE_FIRMWARE("isl3886usb");
+ MODULE_FIRMWARE("isl3887usb");
+
++static struct usb_driver p54u_driver;
++
+ /*
+ * Note:
+ *
+@@ -921,9 +923,9 @@ static void p54u_load_firmware_cb(const struct firmware *firmware,
+ {
+ struct p54u_priv *priv = context;
+ struct usb_device *udev = priv->udev;
++ struct usb_interface *intf = priv->intf;
+ int err;
+
+- complete(&priv->fw_wait_load);
+ if (firmware) {
+ priv->fw = firmware;
+ err = p54u_start_ops(priv);
+@@ -932,26 +934,22 @@ static void p54u_load_firmware_cb(const struct firmware *firmware,
+ dev_err(&udev->dev, "Firmware not found.\n");
+ }
+
+- if (err) {
+- struct device *parent = priv->udev->dev.parent;
+-
+- dev_err(&udev->dev, "failed to initialize device (%d)\n", err);
+-
+- if (parent)
+- device_lock(parent);
++ complete(&priv->fw_wait_load);
++ /*
++ * At this point p54u_disconnect may have already freed
++ * the "priv" context. Do not use it anymore!
++ */
++ priv = NULL;
+
+- device_release_driver(&udev->dev);
+- /*
+- * At this point p54u_disconnect has already freed
+- * the "priv" context. Do not use it anymore!
+- */
+- priv = NULL;
++ if (err) {
++ dev_err(&intf->dev, "failed to initialize device (%d)\n", err);
+
+- if (parent)
+- device_unlock(parent);
++ usb_lock_device(udev);
++ usb_driver_release_interface(&p54u_driver, intf);
++ usb_unlock_device(udev);
+ }
+
+- usb_put_dev(udev);
++ usb_put_intf(intf);
+ }
+
+ static int p54u_load_firmware(struct ieee80211_hw *dev,
+@@ -972,14 +970,14 @@ static int p54u_load_firmware(struct ieee80211_hw *dev,
+ dev_info(&priv->udev->dev, "Loading firmware file %s\n",
+ p54u_fwlist[i].fw);
+
+- usb_get_dev(udev);
++ usb_get_intf(intf);
+ err = request_firmware_nowait(THIS_MODULE, 1, p54u_fwlist[i].fw,
+ device, GFP_KERNEL, priv,
+ p54u_load_firmware_cb);
+ if (err) {
+ dev_err(&priv->udev->dev, "(p54usb) cannot load firmware %s "
+ "(%d)!\n", p54u_fwlist[i].fw, err);
+- usb_put_dev(udev);
++ usb_put_intf(intf);
+ }
+
+ return err;
+@@ -1011,8 +1009,6 @@ static int p54u_probe(struct usb_interface *intf,
+ skb_queue_head_init(&priv->rx_queue);
+ init_usb_anchor(&priv->submitted);
+
+- usb_get_dev(udev);
+-
+ /* really lazy and simple way of figuring out if we're a 3887 */
+ /* TODO: should just stick the identification in the device table */
+ i = intf->altsetting->desc.bNumEndpoints;
+@@ -1053,10 +1049,8 @@ static int p54u_probe(struct usb_interface *intf,
+ priv->upload_fw = p54u_upload_firmware_net2280;
+ }
+ err = p54u_load_firmware(dev, intf);
+- if (err) {
+- usb_put_dev(udev);
++ if (err)
+ p54_free_common(dev);
+- }
+ return err;
+ }
+
+@@ -1072,7 +1066,6 @@ static void p54u_disconnect(struct usb_interface *intf)
+ wait_for_completion(&priv->fw_wait_load);
+ p54_unregister_common(dev);
+
+- usb_put_dev(interface_to_usbdev(intf));
+ release_firmware(priv->fw);
+ p54_free_common(dev);
+ }
+diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
+index b73f99dc5a72..1fb76d2f5d3f 100644
+--- a/drivers/net/wireless/marvell/mwifiex/fw.h
++++ b/drivers/net/wireless/marvell/mwifiex/fw.h
+@@ -1759,9 +1759,10 @@ struct mwifiex_ie_types_wmm_queue_status {
+ struct ieee_types_vendor_header {
+ u8 element_id;
+ u8 len;
+- u8 oui[4]; /* 0~2: oui, 3: oui_type */
+- u8 oui_subtype;
+- u8 version;
++ struct {
++ u8 oui[3];
++ u8 oui_type;
++ } __packed oui;
+ } __packed;
+
+ struct ieee_types_wmm_parameter {
+@@ -1775,6 +1776,9 @@ struct ieee_types_wmm_parameter {
+ * Version [1]
+ */
+ struct ieee_types_vendor_header vend_hdr;
++ u8 oui_subtype;
++ u8 version;
++
+ u8 qos_info_bitmap;
+ u8 reserved;
+ struct ieee_types_wmm_ac_parameters ac_params[IEEE80211_NUM_ACS];
+@@ -1792,6 +1796,8 @@ struct ieee_types_wmm_info {
+ * Version [1]
+ */
+ struct ieee_types_vendor_header vend_hdr;
++ u8 oui_subtype;
++ u8 version;
+
+ u8 qos_info_bitmap;
+ } __packed;
+diff --git a/drivers/net/wireless/marvell/mwifiex/ie.c b/drivers/net/wireless/marvell/mwifiex/ie.c
+index 75cbd609d606..801a2d7b020a 100644
+--- a/drivers/net/wireless/marvell/mwifiex/ie.c
++++ b/drivers/net/wireless/marvell/mwifiex/ie.c
+@@ -329,6 +329,8 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
+ struct ieee80211_vendor_ie *vendorhdr;
+ u16 gen_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0;
+ int left_len, parsed_len = 0;
++ unsigned int token_len;
++ int err = 0;
+
+ if (!info->tail || !info->tail_len)
+ return 0;
+@@ -344,6 +346,12 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
+ */
+ while (left_len > sizeof(struct ieee_types_header)) {
+ hdr = (void *)(info->tail + parsed_len);
++ token_len = hdr->len + sizeof(struct ieee_types_header);
++ if (token_len > left_len) {
++ err = -EINVAL;
++ goto out;
++ }
++
+ switch (hdr->element_id) {
+ case WLAN_EID_SSID:
+ case WLAN_EID_SUPP_RATES:
+@@ -361,16 +369,19 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
+ if (cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
+ WLAN_OUI_TYPE_MICROSOFT_WMM,
+ (const u8 *)hdr,
+- hdr->len + sizeof(struct ieee_types_header)))
++ token_len))
+ break;
+ default:
+- memcpy(gen_ie->ie_buffer + ie_len, hdr,
+- hdr->len + sizeof(struct ieee_types_header));
+- ie_len += hdr->len + sizeof(struct ieee_types_header);
++ if (ie_len + token_len > IEEE_MAX_IE_SIZE) {
++ err = -EINVAL;
++ goto out;
++ }
++ memcpy(gen_ie->ie_buffer + ie_len, hdr, token_len);
++ ie_len += token_len;
+ break;
+ }
+- left_len -= hdr->len + sizeof(struct ieee_types_header);
+- parsed_len += hdr->len + sizeof(struct ieee_types_header);
++ left_len -= token_len;
++ parsed_len += token_len;
+ }
+
+ /* parse only WPA vendor IE from tail, WMM IE is configured by
+@@ -380,15 +391,17 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
+ WLAN_OUI_TYPE_MICROSOFT_WPA,
+ info->tail, info->tail_len);
+ if (vendorhdr) {
+- memcpy(gen_ie->ie_buffer + ie_len, vendorhdr,
+- vendorhdr->len + sizeof(struct ieee_types_header));
+- ie_len += vendorhdr->len + sizeof(struct ieee_types_header);
++ token_len = vendorhdr->len + sizeof(struct ieee_types_header);
++ if (ie_len + token_len > IEEE_MAX_IE_SIZE) {
++ err = -EINVAL;
++ goto out;
++ }
++ memcpy(gen_ie->ie_buffer + ie_len, vendorhdr, token_len);
++ ie_len += token_len;
+ }
+
+- if (!ie_len) {
+- kfree(gen_ie);
+- return 0;
+- }
++ if (!ie_len)
++ goto out;
+
+ gen_ie->ie_index = cpu_to_le16(gen_idx);
+ gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON |
+@@ -398,13 +411,15 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
+
+ if (mwifiex_update_uap_custom_ie(priv, gen_ie, &gen_idx, NULL, NULL,
+ NULL, NULL)) {
+- kfree(gen_ie);
+- return -1;
++ err = -EINVAL;
++ goto out;
+ }
+
+ priv->gen_idx = gen_idx;
++
++ out:
+ kfree(gen_ie);
+- return 0;
++ return err;
+ }
+
+ /* This function parses different IEs-head & tail IEs, beacon IEs,
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index 8e483b0bc3b1..6dd771ce68a3 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -1247,6 +1247,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
+ }
+ switch (element_id) {
+ case WLAN_EID_SSID:
++ if (element_len > IEEE80211_MAX_SSID_LEN)
++ return -EINVAL;
+ bss_entry->ssid.ssid_len = element_len;
+ memcpy(bss_entry->ssid.ssid, (current_ptr + 2),
+ element_len);
+@@ -1256,6 +1258,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
+ break;
+
+ case WLAN_EID_SUPP_RATES:
++ if (element_len > MWIFIEX_SUPPORTED_RATES)
++ return -EINVAL;
+ memcpy(bss_entry->data_rates, current_ptr + 2,
+ element_len);
+ memcpy(bss_entry->supported_rates, current_ptr + 2,
+@@ -1265,6 +1269,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
+ break;
+
+ case WLAN_EID_FH_PARAMS:
++ if (element_len + 2 < sizeof(*fh_param_set))
++ return -EINVAL;
+ fh_param_set =
+ (struct ieee_types_fh_param_set *) current_ptr;
+ memcpy(&bss_entry->phy_param_set.fh_param_set,
+@@ -1273,6 +1279,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
+ break;
+
+ case WLAN_EID_DS_PARAMS:
++ if (element_len + 2 < sizeof(*ds_param_set))
++ return -EINVAL;
+ ds_param_set =
+ (struct ieee_types_ds_param_set *) current_ptr;
+
+@@ -1284,6 +1292,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
+ break;
+
+ case WLAN_EID_CF_PARAMS:
++ if (element_len + 2 < sizeof(*cf_param_set))
++ return -EINVAL;
+ cf_param_set =
+ (struct ieee_types_cf_param_set *) current_ptr;
+ memcpy(&bss_entry->ss_param_set.cf_param_set,
+@@ -1292,6 +1302,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
+ break;
+
+ case WLAN_EID_IBSS_PARAMS:
++ if (element_len + 2 < sizeof(*ibss_param_set))
++ return -EINVAL;
+ ibss_param_set =
+ (struct ieee_types_ibss_param_set *)
+ current_ptr;
+@@ -1301,10 +1313,14 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
+ break;
+
+ case WLAN_EID_ERP_INFO:
++ if (!element_len)
++ return -EINVAL;
+ bss_entry->erp_flags = *(current_ptr + 2);
+ break;
+
+ case WLAN_EID_PWR_CONSTRAINT:
++ if (!element_len)
++ return -EINVAL;
+ bss_entry->local_constraint = *(current_ptr + 2);
+ bss_entry->sensed_11h = true;
+ break;
+@@ -1348,15 +1364,22 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter,
+ vendor_ie = (struct ieee_types_vendor_specific *)
+ current_ptr;
+
+- if (!memcmp
+- (vendor_ie->vend_hdr.oui, wpa_oui,
+- sizeof(wpa_oui))) {
++ /* 802.11 requires at least 3-byte OUI. */
++ if (element_len < sizeof(vendor_ie->vend_hdr.oui.oui))
++ return -EINVAL;
++
++ /* Not long enough for a match? Skip it. */
++ if (element_len < sizeof(wpa_oui))
++ break;
++
++ if (!memcmp(&vendor_ie->vend_hdr.oui, wpa_oui,
++ sizeof(wpa_oui))) {
+ bss_entry->bcn_wpa_ie =
+ (struct ieee_types_vendor_specific *)
+ current_ptr;
+ bss_entry->wpa_offset = (u16)
+ (current_ptr - bss_entry->beacon_buf);
+- } else if (!memcmp(vendor_ie->vend_hdr.oui, wmm_oui,
++ } else if (!memcmp(&vendor_ie->vend_hdr.oui, wmm_oui,
+ sizeof(wmm_oui))) {
+ if (total_ie_len ==
+ sizeof(struct ieee_types_wmm_parameter) ||
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+index b454b5f85503..843d65bba181 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+@@ -1348,7 +1348,7 @@ mwifiex_set_gen_ie_helper(struct mwifiex_private *priv, u8 *ie_data_ptr,
+ /* Test to see if it is a WPA IE, if not, then
+ * it is a gen IE
+ */
+- if (!memcmp(pvendor_ie->oui, wpa_oui,
++ if (!memcmp(&pvendor_ie->oui, wpa_oui,
+ sizeof(wpa_oui))) {
+ /* IE is a WPA/WPA2 IE so call set_wpa function
+ */
+@@ -1358,7 +1358,7 @@ mwifiex_set_gen_ie_helper(struct mwifiex_private *priv, u8 *ie_data_ptr,
+ goto next_ie;
+ }
+
+- if (!memcmp(pvendor_ie->oui, wps_oui,
++ if (!memcmp(&pvendor_ie->oui, wps_oui,
+ sizeof(wps_oui))) {
+ /* Test to see if it is a WPS IE,
+ * if so, enable wps session flag
+diff --git a/drivers/net/wireless/marvell/mwifiex/wmm.c b/drivers/net/wireless/marvell/mwifiex/wmm.c
+index 407b9932ca4d..64916ba15df5 100644
+--- a/drivers/net/wireless/marvell/mwifiex/wmm.c
++++ b/drivers/net/wireless/marvell/mwifiex/wmm.c
+@@ -240,7 +240,7 @@ mwifiex_wmm_setup_queue_priorities(struct mwifiex_private *priv,
+ mwifiex_dbg(priv->adapter, INFO,
+ "info: WMM Parameter IE: version=%d,\t"
+ "qos_info Parameter Set Count=%d, Reserved=%#x\n",
+- wmm_ie->vend_hdr.version, wmm_ie->qos_info_bitmap &
++ wmm_ie->version, wmm_ie->qos_info_bitmap &
+ IEEE80211_WMM_IE_AP_QOSINFO_PARAM_SET_CNT_MASK,
+ wmm_ie->reserved);
+
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index 4de740da547b..763c7628356b 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -955,6 +955,9 @@ static int qedi_find_boot_info(struct qedi_ctx *qedi,
+ if (!iscsi_is_session_online(cls_sess))
+ continue;
+
++ if (!sess->targetname)
++ continue;
++
+ if (pri_ctrl_flags) {
+ if (!strcmp(pri_tgt->iscsi_name, sess->targetname) &&
+ !strcmp(pri_tgt->ip_addr, ep_ip_addr)) {
+diff --git a/drivers/soc/bcm/brcmstb/biuctrl.c b/drivers/soc/bcm/brcmstb/biuctrl.c
+index 6d89ebf13b8a..20b63bee5b09 100644
+--- a/drivers/soc/bcm/brcmstb/biuctrl.c
++++ b/drivers/soc/bcm/brcmstb/biuctrl.c
+@@ -56,7 +56,7 @@ static inline void cbc_writel(u32 val, int reg)
+ if (offset == -1)
+ return;
+
+- writel_relaxed(val, cpubiuctrl_base + offset);
++ writel(val, cpubiuctrl_base + offset);
+ }
+
+ enum cpubiuctrl_regs {
+@@ -246,7 +246,9 @@ static int __init brcmstb_biuctrl_init(void)
+ if (!np)
+ return 0;
+
+- setup_hifcpubiuctrl_regs(np);
++ ret = setup_hifcpubiuctrl_regs(np);
++ if (ret)
++ return ret;
+
+ ret = mcp_write_pairing_set();
+ if (ret) {
+diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
+index 0a8990e758f9..a6e2581ada70 100644
+--- a/drivers/soundwire/intel.c
++++ b/drivers/soundwire/intel.c
+@@ -651,8 +651,8 @@ static int intel_create_dai(struct sdw_cdns *cdns,
+ return -ENOMEM;
+ }
+
+- dais[i].playback.channels_min = 1;
+- dais[i].playback.channels_max = max_ch;
++ dais[i].capture.channels_min = 1;
++ dais[i].capture.channels_max = max_ch;
+ dais[i].capture.rates = SNDRV_PCM_RATE_48000;
+ dais[i].capture.formats = SNDRV_PCM_FMTBIT_S16_LE;
+ }
+diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
+index e5c7e1ef6318..907a548645b7 100644
+--- a/drivers/soundwire/stream.c
++++ b/drivers/soundwire/stream.c
+@@ -1236,9 +1236,7 @@ struct sdw_dpn_prop *sdw_get_slave_dpn_prop(struct sdw_slave *slave,
+ }
+
+ for (i = 0; i < num_ports; i++) {
+- dpn_prop = &dpn_prop[i];
+-
+- if (dpn_prop->num == port_num)
++ if (dpn_prop[i].num == port_num)
+ return &dpn_prop[i];
+ }
+
+diff --git a/drivers/staging/comedi/drivers/amplc_pci230.c b/drivers/staging/comedi/drivers/amplc_pci230.c
+index 08ffe26c5d43..0f16e85911f2 100644
+--- a/drivers/staging/comedi/drivers/amplc_pci230.c
++++ b/drivers/staging/comedi/drivers/amplc_pci230.c
+@@ -2330,7 +2330,8 @@ static irqreturn_t pci230_interrupt(int irq, void *d)
+ devpriv->intr_running = false;
+ spin_unlock_irqrestore(&devpriv->isr_spinlock, irqflags);
+
+- comedi_handle_events(dev, s_ao);
++ if (s_ao)
++ comedi_handle_events(dev, s_ao);
+ comedi_handle_events(dev, s_ai);
+
+ return IRQ_HANDLED;
+diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
+index 3be927f1d3a9..e15e33ed94ae 100644
+--- a/drivers/staging/comedi/drivers/dt282x.c
++++ b/drivers/staging/comedi/drivers/dt282x.c
+@@ -557,7 +557,8 @@ static irqreturn_t dt282x_interrupt(int irq, void *d)
+ }
+ #endif
+ comedi_handle_events(dev, s);
+- comedi_handle_events(dev, s_ao);
++ if (s_ao)
++ comedi_handle_events(dev, s_ao);
+
+ return IRQ_RETVAL(handled);
+ }
+diff --git a/drivers/staging/fsl-dpaa2/ethsw/ethsw.c b/drivers/staging/fsl-dpaa2/ethsw/ethsw.c
+index ecdd3d84f956..8549e809363e 100644
+--- a/drivers/staging/fsl-dpaa2/ethsw/ethsw.c
++++ b/drivers/staging/fsl-dpaa2/ethsw/ethsw.c
+@@ -1073,6 +1073,7 @@ static int port_switchdev_event(struct notifier_block *unused,
+ dev_hold(dev);
+ break;
+ default:
++ kfree(switchdev_work);
+ return NOTIFY_DONE;
+ }
+
+diff --git a/drivers/staging/iio/cdc/ad7150.c b/drivers/staging/iio/cdc/ad7150.c
+index d16084d7068c..a354ce6b2b7b 100644
+--- a/drivers/staging/iio/cdc/ad7150.c
++++ b/drivers/staging/iio/cdc/ad7150.c
+@@ -6,6 +6,7 @@
+ * Licensed under the GPL-2 or later.
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/interrupt.h>
+ #include <linux/device.h>
+ #include <linux/kernel.h>
+@@ -130,7 +131,7 @@ static int ad7150_read_event_config(struct iio_dev *indio_dev,
+ {
+ int ret;
+ u8 threshtype;
+- bool adaptive;
++ bool thrfixed;
+ struct ad7150_chip_info *chip = iio_priv(indio_dev);
+
+ ret = i2c_smbus_read_byte_data(chip->client, AD7150_CFG);
+@@ -138,21 +139,23 @@ static int ad7150_read_event_config(struct iio_dev *indio_dev,
+ return ret;
+
+ threshtype = (ret >> 5) & 0x03;
+- adaptive = !!(ret & 0x80);
++
++ /*check if threshold mode is fixed or adaptive*/
++ thrfixed = FIELD_GET(AD7150_CFG_FIX, ret);
+
+ switch (type) {
+ case IIO_EV_TYPE_MAG_ADAPTIVE:
+ if (dir == IIO_EV_DIR_RISING)
+- return adaptive && (threshtype == 0x1);
+- return adaptive && (threshtype == 0x0);
++ return !thrfixed && (threshtype == 0x1);
++ return !thrfixed && (threshtype == 0x0);
+ case IIO_EV_TYPE_THRESH_ADAPTIVE:
+ if (dir == IIO_EV_DIR_RISING)
+- return adaptive && (threshtype == 0x3);
+- return adaptive && (threshtype == 0x2);
++ return !thrfixed && (threshtype == 0x3);
++ return !thrfixed && (threshtype == 0x2);
+ case IIO_EV_TYPE_THRESH:
+ if (dir == IIO_EV_DIR_RISING)
+- return !adaptive && (threshtype == 0x1);
+- return !adaptive && (threshtype == 0x0);
++ return thrfixed && (threshtype == 0x1);
++ return thrfixed && (threshtype == 0x0);
+ default:
+ break;
+ }
+diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+index c3ff7c3e6681..2f490a4bf60a 100644
+--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
++++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+@@ -141,10 +141,91 @@ static inline void handle_group_key(struct ieee_param *param,
+ }
+ }
+
+-static noinline_for_stack char *translate_scan(struct _adapter *padapter,
+- struct iw_request_info *info,
+- struct wlan_network *pnetwork,
+- char *start, char *stop)
++static noinline_for_stack char *translate_scan_wpa(struct iw_request_info *info,
++ struct wlan_network *pnetwork,
++ struct iw_event *iwe,
++ char *start, char *stop)
++{
++ /* parsing WPA/WPA2 IE */
++ u8 buf[MAX_WPA_IE_LEN];
++ u8 wpa_ie[255], rsn_ie[255];
++ u16 wpa_len = 0, rsn_len = 0;
++ int n, i;
++
++ r8712_get_sec_ie(pnetwork->network.IEs,
++ pnetwork->network.IELength, rsn_ie, &rsn_len,
++ wpa_ie, &wpa_len);
++ if (wpa_len > 0) {
++ memset(buf, 0, MAX_WPA_IE_LEN);
++ n = sprintf(buf, "wpa_ie=");
++ for (i = 0; i < wpa_len; i++) {
++ n += snprintf(buf + n, MAX_WPA_IE_LEN - n,
++ "%02x", wpa_ie[i]);
++ if (n >= MAX_WPA_IE_LEN)
++ break;
++ }
++ memset(iwe, 0, sizeof(*iwe));
++ iwe->cmd = IWEVCUSTOM;
++ iwe->u.data.length = (u16)strlen(buf);
++ start = iwe_stream_add_point(info, start, stop,
++ iwe, buf);
++ memset(iwe, 0, sizeof(*iwe));
++ iwe->cmd = IWEVGENIE;
++ iwe->u.data.length = (u16)wpa_len;
++ start = iwe_stream_add_point(info, start, stop,
++ iwe, wpa_ie);
++ }
++ if (rsn_len > 0) {
++ memset(buf, 0, MAX_WPA_IE_LEN);
++ n = sprintf(buf, "rsn_ie=");
++ for (i = 0; i < rsn_len; i++) {
++ n += snprintf(buf + n, MAX_WPA_IE_LEN - n,
++ "%02x", rsn_ie[i]);
++ if (n >= MAX_WPA_IE_LEN)
++ break;
++ }
++ memset(iwe, 0, sizeof(*iwe));
++ iwe->cmd = IWEVCUSTOM;
++ iwe->u.data.length = strlen(buf);
++ start = iwe_stream_add_point(info, start, stop,
++ iwe, buf);
++ memset(iwe, 0, sizeof(*iwe));
++ iwe->cmd = IWEVGENIE;
++ iwe->u.data.length = rsn_len;
++ start = iwe_stream_add_point(info, start, stop, iwe,
++ rsn_ie);
++ }
++
++ return start;
++}
++
++static noinline_for_stack char *translate_scan_wps(struct iw_request_info *info,
++ struct wlan_network *pnetwork,
++ struct iw_event *iwe,
++ char *start, char *stop)
++{
++ /* parsing WPS IE */
++ u8 wps_ie[512];
++ uint wps_ielen;
++
++ if (r8712_get_wps_ie(pnetwork->network.IEs,
++ pnetwork->network.IELength,
++ wps_ie, &wps_ielen)) {
++ if (wps_ielen > 2) {
++ iwe->cmd = IWEVGENIE;
++ iwe->u.data.length = (u16)wps_ielen;
++ start = iwe_stream_add_point(info, start, stop,
++ iwe, wps_ie);
++ }
++ }
++
++ return start;
++}
++
++static char *translate_scan(struct _adapter *padapter,
++ struct iw_request_info *info,
++ struct wlan_network *pnetwork,
++ char *start, char *stop)
+ {
+ struct iw_event iwe;
+ struct ieee80211_ht_cap *pht_capie;
+@@ -257,73 +338,11 @@ static noinline_for_stack char *translate_scan(struct _adapter *padapter,
+ /* Check if we added any event */
+ if ((current_val - start) > iwe_stream_lcp_len(info))
+ start = current_val;
+- /* parsing WPA/WPA2 IE */
+- {
+- u8 buf[MAX_WPA_IE_LEN];
+- u8 wpa_ie[255], rsn_ie[255];
+- u16 wpa_len = 0, rsn_len = 0;
+- int n;
+-
+- r8712_get_sec_ie(pnetwork->network.IEs,
+- pnetwork->network.IELength, rsn_ie, &rsn_len,
+- wpa_ie, &wpa_len);
+- if (wpa_len > 0) {
+- memset(buf, 0, MAX_WPA_IE_LEN);
+- n = sprintf(buf, "wpa_ie=");
+- for (i = 0; i < wpa_len; i++) {
+- n += snprintf(buf + n, MAX_WPA_IE_LEN - n,
+- "%02x", wpa_ie[i]);
+- if (n >= MAX_WPA_IE_LEN)
+- break;
+- }
+- memset(&iwe, 0, sizeof(iwe));
+- iwe.cmd = IWEVCUSTOM;
+- iwe.u.data.length = (u16)strlen(buf);
+- start = iwe_stream_add_point(info, start, stop,
+- &iwe, buf);
+- memset(&iwe, 0, sizeof(iwe));
+- iwe.cmd = IWEVGENIE;
+- iwe.u.data.length = (u16)wpa_len;
+- start = iwe_stream_add_point(info, start, stop,
+- &iwe, wpa_ie);
+- }
+- if (rsn_len > 0) {
+- memset(buf, 0, MAX_WPA_IE_LEN);
+- n = sprintf(buf, "rsn_ie=");
+- for (i = 0; i < rsn_len; i++) {
+- n += snprintf(buf + n, MAX_WPA_IE_LEN - n,
+- "%02x", rsn_ie[i]);
+- if (n >= MAX_WPA_IE_LEN)
+- break;
+- }
+- memset(&iwe, 0, sizeof(iwe));
+- iwe.cmd = IWEVCUSTOM;
+- iwe.u.data.length = strlen(buf);
+- start = iwe_stream_add_point(info, start, stop,
+- &iwe, buf);
+- memset(&iwe, 0, sizeof(iwe));
+- iwe.cmd = IWEVGENIE;
+- iwe.u.data.length = rsn_len;
+- start = iwe_stream_add_point(info, start, stop, &iwe,
+- rsn_ie);
+- }
+- }
+
+- { /* parsing WPS IE */
+- u8 wps_ie[512];
+- uint wps_ielen;
++ start = translate_scan_wpa(info, pnetwork, &iwe, start, stop);
++
++ start = translate_scan_wps(info, pnetwork, &iwe, start, stop);
+
+- if (r8712_get_wps_ie(pnetwork->network.IEs,
+- pnetwork->network.IELength,
+- wps_ie, &wps_ielen)) {
+- if (wps_ielen > 2) {
+- iwe.cmd = IWEVGENIE;
+- iwe.u.data.length = (u16)wps_ielen;
+- start = iwe_stream_add_point(info, start, stop,
+- &iwe, wps_ie);
+- }
+- }
+- }
+ /* Add quality statistics */
+ iwe.cmd = IWEVQUAL;
+ rssi = r8712_signal_scale_mapping(pnetwork->network.Rssi);
+diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+index c04bdf070c87..455082867246 100644
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -342,16 +342,13 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
+ return;
+ } else if (length == 0) {
+ /* stream ended */
+- if (buf) {
+- /* this should only ever happen if the port is
+- * disabled and there are buffers still queued
++ if (dev->capture.frame_count) {
++ /* empty buffer whilst capturing - expected to be an
++ * EOS, so grab another frame
+ */
+- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
+- pr_debug("Empty buffer");
+- } else if (dev->capture.frame_count) {
+- /* grab another frame */
+ if (is_capturing(dev)) {
+- pr_debug("Grab another frame");
++ v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
++ "Grab another frame");
+ vchiq_mmal_port_parameter_set(
+ instance,
+ dev->capture.camera_port,
+@@ -359,8 +356,14 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
+ &dev->capture.frame_count,
+ sizeof(dev->capture.frame_count));
+ }
++ if (vchiq_mmal_submit_buffer(instance, port, buf))
++ v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
++ "Failed to return EOS buffer");
+ } else {
+- /* signal frame completion */
++ /* stopping streaming.
++ * return buffer, and signal frame completion
++ */
++ vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
+ complete(&dev->capture.frame_cmplt);
+ }
+ } else {
+@@ -582,6 +585,7 @@ static void stop_streaming(struct vb2_queue *vq)
+ int ret;
+ unsigned long timeout;
+ struct bm2835_mmal_dev *dev = vb2_get_drv_priv(vq);
++ struct vchiq_mmal_port *port = dev->capture.port;
+
+ v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev, "%s: dev:%p\n",
+ __func__, dev);
+@@ -605,12 +609,6 @@ static void stop_streaming(struct vb2_queue *vq)
+ &dev->capture.frame_count,
+ sizeof(dev->capture.frame_count));
+
+- /* wait for last frame to complete */
+- timeout = wait_for_completion_timeout(&dev->capture.frame_cmplt, HZ);
+- if (timeout == 0)
+- v4l2_err(&dev->v4l2_dev,
+- "timed out waiting for frame completion\n");
+-
+ v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+ "disabling connection\n");
+
+@@ -625,6 +623,21 @@ static void stop_streaming(struct vb2_queue *vq)
+ ret);
+ }
+
++ /* wait for all buffers to be returned */
++ while (atomic_read(&port->buffers_with_vpu)) {
++ v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
++ "%s: Waiting for buffers to be returned - %d outstanding\n",
++ __func__, atomic_read(&port->buffers_with_vpu));
++ timeout = wait_for_completion_timeout(&dev->capture.frame_cmplt,
++ HZ);
++ if (timeout == 0) {
++ v4l2_err(&dev->v4l2_dev, "%s: Timeout waiting for buffers to be returned - %d outstanding\n",
++ __func__,
++ atomic_read(&port->buffers_with_vpu));
++ break;
++ }
++ }
++
+ if (disable_camera(dev) < 0)
+ v4l2_err(&dev->v4l2_dev, "Failed to disable camera\n");
+ }
+diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+index 51e5b04ff0f5..daa2b9656552 100644
+--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+@@ -162,7 +162,8 @@ struct vchiq_mmal_instance {
+ void *bulk_scratch;
+
+ struct idr context_map;
+- spinlock_t context_map_lock;
++ /* protect accesses to context_map */
++ struct mutex context_map_lock;
+
+ /* component to use next */
+ int component_idx;
+@@ -185,10 +186,10 @@ get_msg_context(struct vchiq_mmal_instance *instance)
+ * that when we service the VCHI reply, we can look up what
+ * message is being replied to.
+ */
+- spin_lock(&instance->context_map_lock);
++ mutex_lock(&instance->context_map_lock);
+ handle = idr_alloc(&instance->context_map, msg_context,
+ 0, 0, GFP_KERNEL);
+- spin_unlock(&instance->context_map_lock);
++ mutex_unlock(&instance->context_map_lock);
+
+ if (handle < 0) {
+ kfree(msg_context);
+@@ -212,9 +213,9 @@ release_msg_context(struct mmal_msg_context *msg_context)
+ {
+ struct vchiq_mmal_instance *instance = msg_context->instance;
+
+- spin_lock(&instance->context_map_lock);
++ mutex_lock(&instance->context_map_lock);
+ idr_remove(&instance->context_map, msg_context->handle);
+- spin_unlock(&instance->context_map_lock);
++ mutex_unlock(&instance->context_map_lock);
+ kfree(msg_context);
+ }
+
+@@ -240,6 +241,8 @@ static void buffer_work_cb(struct work_struct *work)
+ struct mmal_msg_context *msg_context =
+ container_of(work, struct mmal_msg_context, u.bulk.work);
+
++ atomic_dec(&msg_context->u.bulk.port->buffers_with_vpu);
++
+ msg_context->u.bulk.port->buffer_cb(msg_context->u.bulk.instance,
+ msg_context->u.bulk.port,
+ msg_context->u.bulk.status,
+@@ -288,8 +291,6 @@ static int bulk_receive(struct vchiq_mmal_instance *instance,
+
+ /* store length */
+ msg_context->u.bulk.buffer_used = rd_len;
+- msg_context->u.bulk.mmal_flags =
+- msg->u.buffer_from_host.buffer_header.flags;
+ msg_context->u.bulk.dts = msg->u.buffer_from_host.buffer_header.dts;
+ msg_context->u.bulk.pts = msg->u.buffer_from_host.buffer_header.pts;
+
+@@ -380,6 +381,8 @@ buffer_from_host(struct vchiq_mmal_instance *instance,
+ /* initialise work structure ready to schedule callback */
+ INIT_WORK(&msg_context->u.bulk.work, buffer_work_cb);
+
++ atomic_inc(&port->buffers_with_vpu);
++
+ /* prep the buffer from host message */
+ memset(&m, 0xbc, sizeof(m)); /* just to make debug clearer */
+
+@@ -448,6 +451,9 @@ static void buffer_to_host_cb(struct vchiq_mmal_instance *instance,
+ return;
+ }
+
++ msg_context->u.bulk.mmal_flags =
++ msg->u.buffer_from_host.buffer_header.flags;
++
+ if (msg->h.status != MMAL_MSG_STATUS_SUCCESS) {
+ /* message reception had an error */
+ pr_warn("error %d in reply\n", msg->h.status);
+@@ -1324,16 +1330,6 @@ static int port_enable(struct vchiq_mmal_instance *instance,
+ if (port->enabled)
+ return 0;
+
+- /* ensure there are enough buffers queued to cover the buffer headers */
+- if (port->buffer_cb) {
+- hdr_count = 0;
+- list_for_each(buf_head, &port->buffers) {
+- hdr_count++;
+- }
+- if (hdr_count < port->current_buffer.num)
+- return -ENOSPC;
+- }
+-
+ ret = port_action_port(instance, port,
+ MMAL_MSG_PORT_ACTION_TYPE_ENABLE);
+ if (ret)
+@@ -1854,7 +1850,7 @@ int vchiq_mmal_init(struct vchiq_mmal_instance **out_instance)
+
+ instance->bulk_scratch = vmalloc(PAGE_SIZE);
+
+- spin_lock_init(&instance->context_map_lock);
++ mutex_init(&instance->context_map_lock);
+ idr_init_base(&instance->context_map, 1);
+
+ params.callback_param = instance;
+diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
+index 22b839ecd5f0..b0ee1716525b 100644
+--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
++++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.h
+@@ -71,6 +71,9 @@ struct vchiq_mmal_port {
+ struct list_head buffers;
+ /* lock to serialise adding and removing buffers from list */
+ spinlock_t slock;
++
++ /* Count of buffers the VPU has yet to return */
++ atomic_t buffers_with_vpu;
+ /* callback on buffer completion */
+ vchiq_mmal_buffer_cb buffer_cb;
+ /* callback context */
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 3f779d25ec0c..e26d87b6ffc5 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1869,8 +1869,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+
+ status = serial_port_in(port, UART_LSR);
+
+- if (status & (UART_LSR_DR | UART_LSR_BI) &&
+- iir & UART_IIR_RDI) {
++ if (status & (UART_LSR_DR | UART_LSR_BI)) {
+ if (!up->dma || handle_rx_dma(up, iir))
+ status = serial8250_rx_chars(up, status);
+ }
+diff --git a/drivers/usb/dwc2/core.c b/drivers/usb/dwc2/core.c
+index 55d5ae2a7ec7..51d83f77dc04 100644
+--- a/drivers/usb/dwc2/core.c
++++ b/drivers/usb/dwc2/core.c
+@@ -531,7 +531,7 @@ int dwc2_core_reset(struct dwc2_hsotg *hsotg, bool skip_wait)
+ }
+
+ /* Wait for AHB master IDLE state */
+- if (dwc2_hsotg_wait_bit_set(hsotg, GRSTCTL, GRSTCTL_AHBIDLE, 50)) {
++ if (dwc2_hsotg_wait_bit_set(hsotg, GRSTCTL, GRSTCTL_AHBIDLE, 10000)) {
+ dev_warn(hsotg->dev, "%s: HANG! AHB Idle timeout GRSTCTL GRSTCTL_AHBIDLE\n",
+ __func__);
+ return -EBUSY;
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 0f026d445e31..0ef00315ec73 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -186,11 +186,12 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
+ out = dev->port_usb->out_ep;
+ else
+ out = NULL;
+- spin_unlock_irqrestore(&dev->lock, flags);
+
+ if (!out)
++ {
++ spin_unlock_irqrestore(&dev->lock, flags);
+ return -ENOTCONN;
+-
++ }
+
+ /* Padding up to RX_EXTRA handles minor disagreements with host.
+ * Normally we use the USB "terminate on short read" convention;
+@@ -214,6 +215,7 @@ rx_submit(struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
+
+ if (dev->port_usb->is_fixed)
+ size = max_t(size_t, size, dev->port_usb->fixed_out_len);
++ spin_unlock_irqrestore(&dev->lock, flags);
+
+ skb = __netdev_alloc_skb(dev->net, size + NET_IP_ALIGN, gfp_flags);
+ if (skb == NULL) {
+diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
+index 39fa2fc1b8b7..6036cbae8c78 100644
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -802,9 +802,8 @@ static int __usbhsf_dma_map_ctrl(struct usbhs_pkt *pkt, int map)
+ }
+
+ static void usbhsf_dma_complete(void *arg);
+-static void xfer_work(struct work_struct *work)
++static void usbhsf_dma_xfer_preparing(struct usbhs_pkt *pkt)
+ {
+- struct usbhs_pkt *pkt = container_of(work, struct usbhs_pkt, work);
+ struct usbhs_pipe *pipe = pkt->pipe;
+ struct usbhs_fifo *fifo;
+ struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
+@@ -812,12 +811,10 @@ static void xfer_work(struct work_struct *work)
+ struct dma_chan *chan;
+ struct device *dev = usbhs_priv_to_dev(priv);
+ enum dma_transfer_direction dir;
+- unsigned long flags;
+
+- usbhs_lock(priv, flags);
+ fifo = usbhs_pipe_to_fifo(pipe);
+ if (!fifo)
+- goto xfer_work_end;
++ return;
+
+ chan = usbhsf_dma_chan_get(fifo, pkt);
+ dir = usbhs_pipe_is_dir_in(pipe) ? DMA_DEV_TO_MEM : DMA_MEM_TO_DEV;
+@@ -826,7 +823,7 @@ static void xfer_work(struct work_struct *work)
+ pkt->trans, dir,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc)
+- goto xfer_work_end;
++ return;
+
+ desc->callback = usbhsf_dma_complete;
+ desc->callback_param = pipe;
+@@ -834,7 +831,7 @@ static void xfer_work(struct work_struct *work)
+ pkt->cookie = dmaengine_submit(desc);
+ if (pkt->cookie < 0) {
+ dev_err(dev, "Failed to submit dma descriptor\n");
+- goto xfer_work_end;
++ return;
+ }
+
+ dev_dbg(dev, " %s %d (%d/ %d)\n",
+@@ -845,8 +842,17 @@ static void xfer_work(struct work_struct *work)
+ dma_async_issue_pending(chan);
+ usbhsf_dma_start(pipe, fifo);
+ usbhs_pipe_enable(pipe);
++}
++
++static void xfer_work(struct work_struct *work)
++{
++ struct usbhs_pkt *pkt = container_of(work, struct usbhs_pkt, work);
++ struct usbhs_pipe *pipe = pkt->pipe;
++ struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
++ unsigned long flags;
+
+-xfer_work_end:
++ usbhs_lock(priv, flags);
++ usbhsf_dma_xfer_preparing(pkt);
+ usbhs_unlock(priv, flags);
+ }
+
+@@ -899,8 +905,13 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
+ pkt->trans = len;
+
+ usbhsf_tx_irq_ctrl(pipe, 0);
+- INIT_WORK(&pkt->work, xfer_work);
+- schedule_work(&pkt->work);
++ /* FIXME: Workaound for usb dmac that driver can be used in atomic */
++ if (usbhs_get_dparam(priv, has_usb_dmac)) {
++ usbhsf_dma_xfer_preparing(pkt);
++ } else {
++ INIT_WORK(&pkt->work, xfer_work);
++ schedule_work(&pkt->work);
++ }
+
+ return 0;
+
+@@ -1006,8 +1017,7 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt,
+
+ pkt->trans = pkt->length;
+
+- INIT_WORK(&pkt->work, xfer_work);
+- schedule_work(&pkt->work);
++ usbhsf_dma_xfer_preparing(pkt);
+
+ return 0;
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index c0dc4bc776db..e18735e00463 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1019,6 +1019,7 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) },
+ /* EZPrototypes devices */
+ { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) },
++ { USB_DEVICE_INTERFACE_NUMBER(UNJO_VID, UNJO_ISODEBUG_V1_PID, 1) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 5755f0df0025..f12d806220b4 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1543,3 +1543,9 @@
+ #define CHETCO_SEASMART_DISPLAY_PID 0xA5AD /* SeaSmart NMEA2000 Display */
+ #define CHETCO_SEASMART_LITE_PID 0xA5AE /* SeaSmart Lite USB Adapter */
+ #define CHETCO_SEASMART_ANALOG_PID 0xA5AF /* SeaSmart Analog Adapter */
++
++/*
++ * Unjo AB
++ */
++#define UNJO_VID 0x22B7
++#define UNJO_ISODEBUG_V1_PID 0x150D
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index ea891195bbdf..e0a4749ba565 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1343,6 +1343,7 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0601, 0xff) }, /* GosunCn ZTE WeLink ME3630 (RNDIS mode) */
+ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0602, 0xff) }, /* GosunCn ZTE WeLink ME3630 (MBIM mode) */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(4) },
+diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c
+index eb8046f87a54..987b8fcfb2aa 100644
+--- a/drivers/usb/typec/tps6598x.c
++++ b/drivers/usb/typec/tps6598x.c
+@@ -39,7 +39,7 @@
+ #define TPS_STATUS_VCONN(s) (!!((s) & BIT(7)))
+
+ /* TPS_REG_SYSTEM_CONF bits */
+-#define TPS_SYSCONF_PORTINFO(c) ((c) & 3)
++#define TPS_SYSCONF_PORTINFO(c) ((c) & 7)
+
+ enum {
+ TPS_PORTINFO_SINK,
+@@ -111,7 +111,7 @@ tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len)
+ }
+
+ static int tps6598x_block_write(struct tps6598x *tps, u8 reg,
+- void *val, size_t len)
++ const void *val, size_t len)
+ {
+ u8 data[TPS_MAX_LEN + 1];
+
+@@ -157,7 +157,7 @@ static inline int tps6598x_write64(struct tps6598x *tps, u8 reg, u64 val)
+ static inline int
+ tps6598x_write_4cc(struct tps6598x *tps, u8 reg, const char *val)
+ {
+- return tps6598x_block_write(tps, reg, &val, sizeof(u32));
++ return tps6598x_block_write(tps, reg, val, 4);
+ }
+
+ static int tps6598x_read_partner_identity(struct tps6598x *tps)
+diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
+index c6d431a5cce9..4288839501e9 100644
+--- a/fs/crypto/policy.c
++++ b/fs/crypto/policy.c
+@@ -81,6 +81,8 @@ int fscrypt_ioctl_set_policy(struct file *filp, const void __user *arg)
+ if (ret == -ENODATA) {
+ if (!S_ISDIR(inode->i_mode))
+ ret = -ENOTDIR;
++ else if (IS_DEADDIR(inode))
++ ret = -ENOENT;
+ else if (!inode->i_sb->s_cop->empty_dir(inode))
+ ret = -ENOTEMPTY;
+ else
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 53cf8599a46e..1de855e0ae61 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1243,10 +1243,20 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
+ atomic_inc(&sp->so_count);
+ p->o_arg.open_flags = flags;
+ p->o_arg.fmode = fmode & (FMODE_READ|FMODE_WRITE);
+- p->o_arg.umask = current_umask();
+ p->o_arg.claim = nfs4_map_atomic_open_claim(server, claim);
+ p->o_arg.share_access = nfs4_map_atomic_open_share(server,
+ fmode, flags);
++ if (flags & O_CREAT) {
++ p->o_arg.umask = current_umask();
++ p->o_arg.label = nfs4_label_copy(p->a_label, label);
++ if (c->sattr != NULL && c->sattr->ia_valid != 0) {
++ p->o_arg.u.attrs = &p->attrs;
++ memcpy(&p->attrs, c->sattr, sizeof(p->attrs));
++
++ memcpy(p->o_arg.u.verifier.data, c->verf,
++ sizeof(p->o_arg.u.verifier.data));
++ }
++ }
+ /* don't put an ACCESS op in OPEN compound if O_EXCL, because ACCESS
+ * will return permission denied for all bits until close */
+ if (!(flags & O_EXCL)) {
+@@ -1270,7 +1280,6 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
+ p->o_arg.server = server;
+ p->o_arg.bitmask = nfs4_bitmask(server, label);
+ p->o_arg.open_bitmap = &nfs4_fattr_bitmap[0];
+- p->o_arg.label = nfs4_label_copy(p->a_label, label);
+ switch (p->o_arg.claim) {
+ case NFS4_OPEN_CLAIM_NULL:
+ case NFS4_OPEN_CLAIM_DELEGATE_CUR:
+@@ -1283,13 +1292,6 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
+ case NFS4_OPEN_CLAIM_DELEG_PREV_FH:
+ p->o_arg.fh = NFS_FH(d_inode(dentry));
+ }
+- if (c != NULL && c->sattr != NULL && c->sattr->ia_valid != 0) {
+- p->o_arg.u.attrs = &p->attrs;
+- memcpy(&p->attrs, c->sattr, sizeof(p->attrs));
+-
+- memcpy(p->o_arg.u.verifier.data, c->verf,
+- sizeof(p->o_arg.u.verifier.data));
+- }
+ p->c_arg.fh = &p->o_res.fh;
+ p->c_arg.stateid = &p->o_res.stateid;
+ p->c_arg.seqid = p->o_arg.seqid;
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index fc20e06c56ba..dd1783ea7003 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -1993,8 +1993,8 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ &warn_to[cnt]);
+ if (ret)
+ goto over_quota;
+- ret = dquot_add_space(transfer_to[cnt], cur_space, rsv_space, 0,
+- &warn_to[cnt]);
++ ret = dquot_add_space(transfer_to[cnt], cur_space, rsv_space,
++ DQUOT_SPACE_WARN, &warn_to[cnt]);
+ if (ret) {
+ spin_lock(&transfer_to[cnt]->dq_dqb_lock);
+ dquot_decr_inodes(transfer_to[cnt], inode_usage);
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index ae796e10f68b..4c46ebf0e773 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -470,13 +470,15 @@ static struct buffer_head *udf_getblk(struct inode *inode, udf_pblk_t block,
+ return NULL;
+ }
+
+-/* Extend the file by 'blocks' blocks, return the number of extents added */
++/* Extend the file with new blocks totaling 'new_block_bytes',
++ * return the number of extents added
++ */
+ static int udf_do_extend_file(struct inode *inode,
+ struct extent_position *last_pos,
+ struct kernel_long_ad *last_ext,
+- sector_t blocks)
++ loff_t new_block_bytes)
+ {
+- sector_t add;
++ uint32_t add;
+ int count = 0, fake = !(last_ext->extLength & UDF_EXTENT_LENGTH_MASK);
+ struct super_block *sb = inode->i_sb;
+ struct kernel_lb_addr prealloc_loc = {};
+@@ -486,7 +488,7 @@ static int udf_do_extend_file(struct inode *inode,
+
+ /* The previous extent is fake and we should not extend by anything
+ * - there's nothing to do... */
+- if (!blocks && fake)
++ if (!new_block_bytes && fake)
+ return 0;
+
+ iinfo = UDF_I(inode);
+@@ -517,13 +519,12 @@ static int udf_do_extend_file(struct inode *inode,
+ /* Can we merge with the previous extent? */
+ if ((last_ext->extLength & UDF_EXTENT_FLAG_MASK) ==
+ EXT_NOT_RECORDED_NOT_ALLOCATED) {
+- add = ((1 << 30) - sb->s_blocksize -
+- (last_ext->extLength & UDF_EXTENT_LENGTH_MASK)) >>
+- sb->s_blocksize_bits;
+- if (add > blocks)
+- add = blocks;
+- blocks -= add;
+- last_ext->extLength += add << sb->s_blocksize_bits;
++ add = (1 << 30) - sb->s_blocksize -
++ (last_ext->extLength & UDF_EXTENT_LENGTH_MASK);
++ if (add > new_block_bytes)
++ add = new_block_bytes;
++ new_block_bytes -= add;
++ last_ext->extLength += add;
+ }
+
+ if (fake) {
+@@ -544,28 +545,27 @@ static int udf_do_extend_file(struct inode *inode,
+ }
+
+ /* Managed to do everything necessary? */
+- if (!blocks)
++ if (!new_block_bytes)
+ goto out;
+
+ /* All further extents will be NOT_RECORDED_NOT_ALLOCATED */
+ last_ext->extLocation.logicalBlockNum = 0;
+ last_ext->extLocation.partitionReferenceNum = 0;
+- add = (1 << (30-sb->s_blocksize_bits)) - 1;
+- last_ext->extLength = EXT_NOT_RECORDED_NOT_ALLOCATED |
+- (add << sb->s_blocksize_bits);
++ add = (1 << 30) - sb->s_blocksize;
++ last_ext->extLength = EXT_NOT_RECORDED_NOT_ALLOCATED | add;
+
+ /* Create enough extents to cover the whole hole */
+- while (blocks > add) {
+- blocks -= add;
++ while (new_block_bytes > add) {
++ new_block_bytes -= add;
+ err = udf_add_aext(inode, last_pos, &last_ext->extLocation,
+ last_ext->extLength, 1);
+ if (err)
+ return err;
+ count++;
+ }
+- if (blocks) {
++ if (new_block_bytes) {
+ last_ext->extLength = EXT_NOT_RECORDED_NOT_ALLOCATED |
+- (blocks << sb->s_blocksize_bits);
++ new_block_bytes;
+ err = udf_add_aext(inode, last_pos, &last_ext->extLocation,
+ last_ext->extLength, 1);
+ if (err)
+@@ -596,6 +596,24 @@ out:
+ return count;
+ }
+
++/* Extend the final block of the file to final_block_len bytes */
++static void udf_do_extend_final_block(struct inode *inode,
++ struct extent_position *last_pos,
++ struct kernel_long_ad *last_ext,
++ uint32_t final_block_len)
++{
++ struct super_block *sb = inode->i_sb;
++ uint32_t added_bytes;
++
++ added_bytes = final_block_len -
++ (last_ext->extLength & (sb->s_blocksize - 1));
++ last_ext->extLength += added_bytes;
++ UDF_I(inode)->i_lenExtents += added_bytes;
++
++ udf_write_aext(inode, last_pos, &last_ext->extLocation,
++ last_ext->extLength, 1);
++}
++
+ static int udf_extend_file(struct inode *inode, loff_t newsize)
+ {
+
+@@ -605,10 +623,12 @@ static int udf_extend_file(struct inode *inode, loff_t newsize)
+ int8_t etype;
+ struct super_block *sb = inode->i_sb;
+ sector_t first_block = newsize >> sb->s_blocksize_bits, offset;
++ unsigned long partial_final_block;
+ int adsize;
+ struct udf_inode_info *iinfo = UDF_I(inode);
+ struct kernel_long_ad extent;
+- int err;
++ int err = 0;
++ int within_final_block;
+
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
+ adsize = sizeof(struct short_ad);
+@@ -618,18 +638,8 @@ static int udf_extend_file(struct inode *inode, loff_t newsize)
+ BUG();
+
+ etype = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset);
++ within_final_block = (etype != -1);
+
+- /* File has extent covering the new size (could happen when extending
+- * inside a block)? */
+- if (etype != -1)
+- return 0;
+- if (newsize & (sb->s_blocksize - 1))
+- offset++;
+- /* Extended file just to the boundary of the last file block? */
+- if (offset == 0)
+- return 0;
+-
+- /* Truncate is extending the file by 'offset' blocks */
+ if ((!epos.bh && epos.offset == udf_file_entry_alloc_offset(inode)) ||
+ (epos.bh && epos.offset == sizeof(struct allocExtDesc))) {
+ /* File has no extents at all or has empty last
+@@ -643,7 +653,22 @@ static int udf_extend_file(struct inode *inode, loff_t newsize)
+ &extent.extLength, 0);
+ extent.extLength |= etype << 30;
+ }
+- err = udf_do_extend_file(inode, &epos, &extent, offset);
++
++ partial_final_block = newsize & (sb->s_blocksize - 1);
++
++ /* File has extent covering the new size (could happen when extending
++ * inside a block)?
++ */
++ if (within_final_block) {
++ /* Extending file within the last file block */
++ udf_do_extend_final_block(inode, &epos, &extent,
++ partial_final_block);
++ } else {
++ loff_t add = ((loff_t)offset << sb->s_blocksize_bits) |
++ partial_final_block;
++ err = udf_do_extend_file(inode, &epos, &extent, add);
++ }
++
+ if (err < 0)
+ goto out;
+ err = 0;
+@@ -745,6 +770,7 @@ static sector_t inode_getblk(struct inode *inode, sector_t block,
+ /* Are we beyond EOF? */
+ if (etype == -1) {
+ int ret;
++ loff_t hole_len;
+ isBeyondEOF = true;
+ if (count) {
+ if (c)
+@@ -760,7 +786,8 @@ static sector_t inode_getblk(struct inode *inode, sector_t block,
+ startnum = (offset > 0);
+ }
+ /* Create extents for the hole between EOF and offset */
+- ret = udf_do_extend_file(inode, &prev_epos, laarr, offset);
++ hole_len = (loff_t)offset << inode->i_blkbits;
++ ret = udf_do_extend_file(inode, &prev_epos, laarr, hole_len);
+ if (ret < 0) {
+ *err = ret;
+ newblock = 0;
+diff --git a/include/linux/vmw_vmci_defs.h b/include/linux/vmw_vmci_defs.h
+index b724ef7005de..53c5e40a2a8f 100644
+--- a/include/linux/vmw_vmci_defs.h
++++ b/include/linux/vmw_vmci_defs.h
+@@ -68,9 +68,18 @@ enum {
+
+ /*
+ * A single VMCI device has an upper limit of 128MB on the amount of
+- * memory that can be used for queue pairs.
++ * memory that can be used for queue pairs. Since each queue pair
++ * consists of at least two pages, the memory limit also dictates the
++ * number of queue pairs a guest can create.
+ */
+ #define VMCI_MAX_GUEST_QP_MEMORY (128 * 1024 * 1024)
++#define VMCI_MAX_GUEST_QP_COUNT (VMCI_MAX_GUEST_QP_MEMORY / PAGE_SIZE / 2)
++
++/*
++ * There can be at most PAGE_SIZE doorbells since there is one doorbell
++ * per byte in the doorbell bitmap page.
++ */
++#define VMCI_MAX_GUEST_DOORBELL_COUNT PAGE_SIZE
+
+ /*
+ * Queues with pre-mapped data pages must be small, so that we don't pin
+diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
+index 236e40ba06bf..f594eb71c274 100644
+--- a/include/net/ip6_tunnel.h
++++ b/include/net/ip6_tunnel.h
+@@ -156,9 +156,12 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb,
+ memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
+ pkt_len = skb->len - skb_inner_network_offset(skb);
+ err = ip6_local_out(dev_net(skb_dst(skb)->dev), sk, skb);
+- if (unlikely(net_xmit_eval(err)))
+- pkt_len = -1;
+- iptunnel_xmit_stats(dev, pkt_len);
++
++ if (dev) {
++ if (unlikely(net_xmit_eval(err)))
++ pkt_len = -1;
++ iptunnel_xmit_stats(dev, pkt_len);
++ }
+ }
+ #endif
+ #endif
+diff --git a/include/uapi/linux/usb/audio.h b/include/uapi/linux/usb/audio.h
+index ddc5396800aa..76b7c3f6cd0d 100644
+--- a/include/uapi/linux/usb/audio.h
++++ b/include/uapi/linux/usb/audio.h
+@@ -450,6 +450,43 @@ static inline __u8 *uac_processing_unit_specific(struct uac_processing_unit_desc
+ }
+ }
+
++/*
++ * Extension Unit (XU) has almost compatible layout with Processing Unit, but
++ * on UAC2, it has a different bmControls size (bControlSize); it's 1 byte for
++ * XU while 2 bytes for PU. The last iExtension field is a one-byte index as
++ * well as iProcessing field of PU.
++ */
++static inline __u8 uac_extension_unit_bControlSize(struct uac_processing_unit_descriptor *desc,
++ int protocol)
++{
++ switch (protocol) {
++ case UAC_VERSION_1:
++ return desc->baSourceID[desc->bNrInPins + 4];
++ case UAC_VERSION_2:
++ return 1; /* in UAC2, this value is constant */
++ case UAC_VERSION_3:
++ return 4; /* in UAC3, this value is constant */
++ default:
++ return 1;
++ }
++}
++
++static inline __u8 uac_extension_unit_iExtension(struct uac_processing_unit_descriptor *desc,
++ int protocol)
++{
++ __u8 control_size = uac_extension_unit_bControlSize(desc, protocol);
++
++ switch (protocol) {
++ case UAC_VERSION_1:
++ case UAC_VERSION_2:
++ default:
++ return *(uac_processing_unit_bmControls(desc, protocol)
++ + control_size);
++ case UAC_VERSION_3:
++ return 0; /* UAC3 does not have this field */
++ }
++}
++
+ /* 4.5.2 Class-Specific AS Interface Descriptor */
+ struct uac1_as_header_descriptor {
+ __u8 bLength; /* in bytes: 7 */
+diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
+index 2faad033715f..fc500ca464d0 100644
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -186,6 +186,7 @@ static void dev_map_free(struct bpf_map *map)
+ if (!dev)
+ continue;
+
++ free_percpu(dev->bulkq);
+ dev_put(dev->dev);
+ kfree(dev);
+ }
+@@ -281,6 +282,7 @@ void __dev_map_flush(struct bpf_map *map)
+ unsigned long *bitmap = this_cpu_ptr(dtab->flush_needed);
+ u32 bit;
+
++ rcu_read_lock();
+ for_each_set_bit(bit, bitmap, map->max_entries) {
+ struct bpf_dtab_netdev *dev = READ_ONCE(dtab->netdev_map[bit]);
+ struct xdp_bulk_queue *bq;
+@@ -291,11 +293,12 @@ void __dev_map_flush(struct bpf_map *map)
+ if (unlikely(!dev))
+ continue;
+
+- __clear_bit(bit, bitmap);
+-
+ bq = this_cpu_ptr(dev->bulkq);
+ bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, true);
++
++ __clear_bit(bit, bitmap);
+ }
++ rcu_read_unlock();
+ }
+
+ /* rcu_read_lock (from syscall and BPF contexts) ensures that if a delete and/or
+@@ -388,6 +391,7 @@ static void dev_map_flush_old(struct bpf_dtab_netdev *dev)
+
+ int cpu;
+
++ rcu_read_lock();
+ for_each_online_cpu(cpu) {
+ bitmap = per_cpu_ptr(dev->dtab->flush_needed, cpu);
+ __clear_bit(dev->bit, bitmap);
+@@ -395,6 +399,7 @@ static void dev_map_flush_old(struct bpf_dtab_netdev *dev)
+ bq = per_cpu_ptr(dev->bulkq, cpu);
+ bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, false);
+ }
++ rcu_read_unlock();
+ }
+ }
+
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index e386d654116d..04132b0b5d36 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -959,6 +959,8 @@ static struct pernet_operations can_pernet_ops __read_mostly = {
+
+ static __init int can_init(void)
+ {
++ int err;
++
+ /* check for correct padding to be able to use the structs similarly */
+ BUILD_BUG_ON(offsetof(struct can_frame, can_dlc) !=
+ offsetof(struct canfd_frame, len) ||
+@@ -972,15 +974,31 @@ static __init int can_init(void)
+ if (!rcv_cache)
+ return -ENOMEM;
+
+- register_pernet_subsys(&can_pernet_ops);
++ err = register_pernet_subsys(&can_pernet_ops);
++ if (err)
++ goto out_pernet;
+
+ /* protocol register */
+- sock_register(&can_family_ops);
+- register_netdevice_notifier(&can_netdev_notifier);
++ err = sock_register(&can_family_ops);
++ if (err)
++ goto out_sock;
++ err = register_netdevice_notifier(&can_netdev_notifier);
++ if (err)
++ goto out_notifier;
++
+ dev_add_pack(&can_packet);
+ dev_add_pack(&canfd_packet);
+
+ return 0;
++
++out_notifier:
++ sock_unregister(PF_CAN);
++out_sock:
++ unregister_pernet_subsys(&can_pernet_ops);
++out_pernet:
++ kmem_cache_destroy(rcv_cache);
++
++ return err;
+ }
+
+ static __exit void can_exit(void)
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 8b5768113acd..9b9f696281a9 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2302,6 +2302,7 @@ do_frag_list:
+ kv.iov_base = skb->data + offset;
+ kv.iov_len = slen;
+ memset(&msg, 0, sizeof(msg));
++ msg.msg_flags = MSG_DONTWAIT;
+
+ ret = kernel_sendmsg_locked(sk, &msg, &kv, 1, slen);
+ if (ret <= 0)
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 35c6dfa13fa8..cfd30671ccdf 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1410,7 +1410,7 @@ ieee80211_get_sband(struct ieee80211_sub_if_data *sdata)
+ rcu_read_lock();
+ chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+
+- if (WARN_ON(!chanctx_conf)) {
++ if (WARN_ON_ONCE(!chanctx_conf)) {
+ rcu_read_unlock();
+ return NULL;
+ }
+@@ -1998,6 +1998,13 @@ void __ieee80211_flush_queues(struct ieee80211_local *local,
+
+ static inline bool ieee80211_can_run_worker(struct ieee80211_local *local)
+ {
++ /*
++ * It's unsafe to try to do any work during reconfigure flow.
++ * When the flow ends the work will be requeued.
++ */
++ if (local->in_reconfig)
++ return false;
++
+ /*
+ * If quiescing is set, we are racing with __ieee80211_suspend.
+ * __ieee80211_suspend flushes the workers after setting quiescing,
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index d51da26e9c18..3162f955f3ae 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -923,6 +923,7 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
+
+ /* flush STAs and mpaths on this iface */
+ sta_info_flush(sdata);
++ ieee80211_free_keys(sdata, true);
+ mesh_path_flush_by_iface(sdata);
+
+ /* stop the beacon */
+@@ -1212,7 +1213,8 @@ int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata)
+ ifmsh->chsw_ttl = 0;
+
+ /* Remove the CSA and MCSP elements from the beacon */
+- tmp_csa_settings = rcu_dereference(ifmsh->csa);
++ tmp_csa_settings = rcu_dereference_protected(ifmsh->csa,
++ lockdep_is_held(&sdata->wdev.mtx));
+ RCU_INIT_POINTER(ifmsh->csa, NULL);
+ if (tmp_csa_settings)
+ kfree_rcu(tmp_csa_settings, rcu_head);
+@@ -1234,6 +1236,8 @@ int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
+ struct mesh_csa_settings *tmp_csa_settings;
+ int ret = 0;
+
++ lockdep_assert_held(&sdata->wdev.mtx);
++
+ tmp_csa_settings = kmalloc(sizeof(*tmp_csa_settings),
+ GFP_ATOMIC);
+ if (!tmp_csa_settings)
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 2558a34c9df1..c59638574cf8 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -2224,6 +2224,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
+ mutex_lock(&local->mtx);
+ ieee80211_start_next_roc(local);
+ mutex_unlock(&local->mtx);
++
++ /* Requeue all works */
++ list_for_each_entry(sdata, &local->interfaces, list)
++ ieee80211_queue_work(&local->hw, &sdata->work);
+ }
+
+ ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 7e4553dbc3c7..0d7d149b1b1b 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -2713,6 +2713,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *clnt,
+ xprt = xprt_iter_xprt(&clnt->cl_xpi);
+ if (xps == NULL || xprt == NULL) {
+ rcu_read_unlock();
++ xprt_switch_put(xps);
+ return -EAGAIN;
+ }
+ resvport = xprt->resvport;
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index aad1c8e858e5..d57e2f679a3e 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1219,7 +1219,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)
+ if (rate->he_dcm)
+ result /= 2;
+
+- return result;
++ return result / 10000;
+ }
+
+ u32 cfg80211_calculate_bitrate(struct rate_info *rate)
+diff --git a/samples/bpf/bpf_load.c b/samples/bpf/bpf_load.c
+index cf40a8284a38..5061a2ec4564 100644
+--- a/samples/bpf/bpf_load.c
++++ b/samples/bpf/bpf_load.c
+@@ -677,7 +677,7 @@ void read_trace_pipe(void)
+ static char buf[4096];
+ ssize_t sz;
+
+- sz = read(trace_fd, buf, sizeof(buf));
++ sz = read(trace_fd, buf, sizeof(buf) - 1);
+ if (sz > 0) {
+ buf[sz] = 0;
+ puts(buf);
+diff --git a/samples/bpf/task_fd_query_user.c b/samples/bpf/task_fd_query_user.c
+index 8381d792f138..06957f0fbe83 100644
+--- a/samples/bpf/task_fd_query_user.c
++++ b/samples/bpf/task_fd_query_user.c
+@@ -216,7 +216,7 @@ static int test_debug_fs_uprobe(char *binary_path, long offset, bool is_return)
+ {
+ const char *event_type = "uprobe";
+ struct perf_event_attr attr = {};
+- char buf[256], event_alias[256];
++ char buf[256], event_alias[sizeof("test_1234567890")];
+ __u64 probe_offset, probe_addr;
+ __u32 len, prog_id, fd_type;
+ int err, res, kfd, efd;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 6453370abacc..98cfdcfce5b3 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3236,6 +3236,7 @@ static void alc256_init(struct hda_codec *codec)
+ alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
+ alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 1 << 15); /* Clear bit */
+ alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 0 << 15);
++ alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/
+ }
+
+ static void alc256_shutup(struct hda_codec *codec)
+@@ -7686,7 +7687,6 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->shutup = alc256_shutup;
+ spec->init_hook = alc256_init;
+ spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */
+- alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/
+ break;
+ case 0x10ec0257:
+ spec->codec_variant = ALC269_TYPE_ALC257;
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 5a10b1b7f6b9..7e1c6c2dc99e 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2322,7 +2322,7 @@ static struct procunit_info extunits[] = {
+ */
+ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ void *raw_desc, struct procunit_info *list,
+- char *name)
++ bool extension_unit)
+ {
+ struct uac_processing_unit_descriptor *desc = raw_desc;
+ int num_ins;
+@@ -2339,6 +2339,8 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ static struct procunit_info default_info = {
+ 0, NULL, default_value_info
+ };
++ const char *name = extension_unit ?
++ "Extension Unit" : "Processing Unit";
+
+ if (desc->bLength < 13) {
+ usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid);
+@@ -2452,7 +2454,10 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ } else if (info->name) {
+ strlcpy(kctl->id.name, info->name, sizeof(kctl->id.name));
+ } else {
+- nameid = uac_processing_unit_iProcessing(desc, state->mixer->protocol);
++ if (extension_unit)
++ nameid = uac_extension_unit_iExtension(desc, state->mixer->protocol);
++ else
++ nameid = uac_processing_unit_iProcessing(desc, state->mixer->protocol);
+ len = 0;
+ if (nameid)
+ len = snd_usb_copy_string_desc(state->chip,
+@@ -2485,10 +2490,10 @@ static int parse_audio_processing_unit(struct mixer_build *state, int unitid,
+ case UAC_VERSION_2:
+ default:
+ return build_audio_procunit(state, unitid, raw_desc,
+- procunits, "Processing Unit");
++ procunits, false);
+ case UAC_VERSION_3:
+ return build_audio_procunit(state, unitid, raw_desc,
+- uac3_procunits, "Processing Unit");
++ uac3_procunits, false);
+ }
+ }
+
+@@ -2499,8 +2504,7 @@ static int parse_audio_extension_unit(struct mixer_build *state, int unitid,
+ * Note that we parse extension units with processing unit descriptors.
+ * That's ok as the layout is the same.
+ */
+- return build_audio_procunit(state, unitid, raw_desc,
+- extunits, "Extension Unit");
++ return build_audio_procunit(state, unitid, raw_desc, extunits, true);
+ }
+
+ /*
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index 36cfc64c3824..c1acf04c9f7a 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -750,9 +750,7 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
+ {
+ int i;
+ struct pmu_events_map *map;
+- struct pmu_event *pe;
+ const char *name = pmu->name;
+- const char *pname;
+
+ map = perf_pmu__find_map(pmu);
+ if (!map)
+@@ -763,28 +761,26 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
+ */
+ i = 0;
+ while (1) {
++ const char *cpu_name = is_arm_pmu_core(name) ? name : "cpu";
++ struct pmu_event *pe = &map->table[i++];
++ const char *pname = pe->pmu ? pe->pmu : cpu_name;
+
+- pe = &map->table[i++];
+ if (!pe->name) {
+ if (pe->metric_group || pe->metric_name)
+ continue;
+ break;
+ }
+
+- if (!is_arm_pmu_core(name)) {
+- pname = pe->pmu ? pe->pmu : "cpu";
+-
+- /*
+- * uncore alias may be from different PMU
+- * with common prefix
+- */
+- if (pmu_is_uncore(name) &&
+- !strncmp(pname, name, strlen(pname)))
+- goto new_alias;
++ /*
++ * uncore alias may be from different PMU
++ * with common prefix
++ */
++ if (pmu_is_uncore(name) &&
++ !strncmp(pname, name, strlen(pname)))
++ goto new_alias;
+
+- if (strcmp(pname, name))
+- continue;
+- }
++ if (strcmp(pname, name))
++ continue;
+
+ new_alias:
+ /* need type casts to override 'const' */
+diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
+index 621bb004067e..0dbe332eb343 100644
+--- a/virt/kvm/arm/vgic/vgic-its.c
++++ b/virt/kvm/arm/vgic/vgic-its.c
+@@ -1750,6 +1750,7 @@ static void vgic_its_destroy(struct kvm_device *kvm_dev)
+
+ mutex_unlock(&its->its_lock);
+ kfree(its);
++ kfree(kvm_dev);/* alloc by kvm_ioctl_create_device, free by .destroy */
+ }
+
+ int vgic_its_has_attr_regs(struct kvm_device *dev,
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-07-21 14:41 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-07-21 14:41 UTC (permalink / raw
To: gentoo-commits
commit: b287bab56fa2f6c19d0c239ab1b69de5ad38de2a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jul 21 14:41:20 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jul 21 14:41:20 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b287bab5
Linux patch 4.19.60
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1059_linux-4.19.60.patch | 2122 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2126 insertions(+)
diff --git a/0000_README b/0000_README
index 8871e40..5333820 100644
--- a/0000_README
+++ b/0000_README
@@ -279,6 +279,10 @@ Patch: 1058_linux-4.19.59.patch
From: https://www.kernel.org
Desc: Linux 4.19.59
+Patch: 1059_linux-4.19.60.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.60
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1059_linux-4.19.60.patch b/1059_linux-4.19.60.patch
new file mode 100644
index 0000000..b1791d5
--- /dev/null
+++ b/1059_linux-4.19.60.patch
@@ -0,0 +1,2122 @@
+diff --git a/Makefile b/Makefile
+index 38f2150457fd..5fb79d493012 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 59
++SUBLEVEL = 60
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
+index 183391d4d33a..9cf2ee8b4349 100644
+--- a/arch/arc/kernel/unwind.c
++++ b/arch/arc/kernel/unwind.c
+@@ -185,11 +185,6 @@ static void *__init unw_hdr_alloc_early(unsigned long sz)
+ MAX_DMA_ADDRESS);
+ }
+
+-static void *unw_hdr_alloc(unsigned long sz)
+-{
+- return kmalloc(sz, GFP_KERNEL);
+-}
+-
+ static void init_unwind_table(struct unwind_table *table, const char *name,
+ const void *core_start, unsigned long core_size,
+ const void *init_start, unsigned long init_size,
+@@ -370,6 +365,10 @@ ret_err:
+ }
+
+ #ifdef CONFIG_MODULES
++static void *unw_hdr_alloc(unsigned long sz)
++{
++ return kmalloc(sz, GFP_KERNEL);
++}
+
+ static struct unwind_table *last_table;
+
+diff --git a/arch/arm/boot/dts/gemini-dlink-dns-313.dts b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
+index d1329322b968..361dccd6c7ee 100644
+--- a/arch/arm/boot/dts/gemini-dlink-dns-313.dts
++++ b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
+@@ -11,7 +11,7 @@
+
+ / {
+ model = "D-Link DNS-313 1-Bay Network Storage Enclosure";
+- compatible = "dlink,dir-313", "cortina,gemini";
++ compatible = "dlink,dns-313", "cortina,gemini";
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
+index 2366f093cc76..336cdead3da5 100644
+--- a/arch/arm/boot/dts/imx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul.dtsi
+@@ -359,7 +359,7 @@
+ pwm1: pwm@2080000 {
+ compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
+ reg = <0x02080000 0x4000>;
+- interrupts = <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX6UL_CLK_PWM1>,
+ <&clks IMX6UL_CLK_PWM1>;
+ clock-names = "ipg", "per";
+@@ -370,7 +370,7 @@
+ pwm2: pwm@2084000 {
+ compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
+ reg = <0x02084000 0x4000>;
+- interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 84 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX6UL_CLK_PWM2>,
+ <&clks IMX6UL_CLK_PWM2>;
+ clock-names = "ipg", "per";
+@@ -381,7 +381,7 @@
+ pwm3: pwm@2088000 {
+ compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
+ reg = <0x02088000 0x4000>;
+- interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX6UL_CLK_PWM3>,
+ <&clks IMX6UL_CLK_PWM3>;
+ clock-names = "ipg", "per";
+@@ -392,7 +392,7 @@
+ pwm4: pwm@208c000 {
+ compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
+ reg = <0x0208c000 0x4000>;
+- interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX6UL_CLK_PWM4>,
+ <&clks IMX6UL_CLK_PWM4>;
+ clock-names = "ipg", "per";
+diff --git a/arch/arm/mach-omap2/prm3xxx.c b/arch/arm/mach-omap2/prm3xxx.c
+index 05858f966f7d..dfa65fc2c82b 100644
+--- a/arch/arm/mach-omap2/prm3xxx.c
++++ b/arch/arm/mach-omap2/prm3xxx.c
+@@ -433,7 +433,7 @@ static void omap3_prm_reconfigure_io_chain(void)
+ * registers, and omap3xxx_prm_reconfigure_io_chain() must be called.
+ * No return value.
+ */
+-static void __init omap3xxx_prm_enable_io_wakeup(void)
++static void omap3xxx_prm_enable_io_wakeup(void)
+ {
+ if (prm_features & PRM_HAS_IO_WAKEUP)
+ omap2_prm_set_mod_reg_bits(OMAP3430_EN_IO_MASK, WKUP_MOD,
+diff --git a/arch/s390/include/asm/facility.h b/arch/s390/include/asm/facility.h
+index 99c8ce30b3cd..7ffbc5d7ccf3 100644
+--- a/arch/s390/include/asm/facility.h
++++ b/arch/s390/include/asm/facility.h
+@@ -59,6 +59,18 @@ static inline int test_facility(unsigned long nr)
+ return __test_facility(nr, &S390_lowcore.stfle_fac_list);
+ }
+
++static inline unsigned long __stfle_asm(u64 *stfle_fac_list, int size)
++{
++ register unsigned long reg0 asm("0") = size - 1;
++
++ asm volatile(
++ ".insn s,0xb2b00000,0(%1)" /* stfle */
++ : "+d" (reg0)
++ : "a" (stfle_fac_list)
++ : "memory", "cc");
++ return reg0;
++}
++
+ /**
+ * stfle - Store facility list extended
+ * @stfle_fac_list: array where facility list can be stored
+@@ -76,13 +88,8 @@ static inline void stfle(u64 *stfle_fac_list, int size)
+ memcpy(stfle_fac_list, &S390_lowcore.stfl_fac_list, 4);
+ if (S390_lowcore.stfl_fac_list & 0x01000000) {
+ /* More facility bits available with stfle */
+- register unsigned long reg0 asm("0") = size - 1;
+-
+- asm volatile(".insn s,0xb2b00000,0(%1)" /* stfle */
+- : "+d" (reg0)
+- : "a" (stfle_fac_list)
+- : "memory", "cc");
+- nr = (reg0 + 1) * 8; /* # bytes stored by stfle */
++ nr = __stfle_asm(stfle_fac_list, size);
++ nr = min_t(unsigned long, (nr + 1) * 8, size * 8);
+ }
+ memset((char *) stfle_fac_list + nr, 0, size * 8 - nr);
+ preempt_enable();
+diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
+index b5c2b1091b18..8059d4fd915c 100644
+--- a/arch/x86/entry/entry_32.S
++++ b/arch/x86/entry/entry_32.S
+@@ -1098,6 +1098,30 @@ ENTRY(irq_entries_start)
+ .endr
+ END(irq_entries_start)
+
++#ifdef CONFIG_X86_LOCAL_APIC
++ .align 8
++ENTRY(spurious_entries_start)
++ vector=FIRST_SYSTEM_VECTOR
++ .rept (NR_VECTORS - FIRST_SYSTEM_VECTOR)
++ pushl $(~vector+0x80) /* Note: always in signed byte range */
++ vector=vector+1
++ jmp common_spurious
++ .align 8
++ .endr
++END(spurious_entries_start)
++
++common_spurious:
++ ASM_CLAC
++ addl $-0x80, (%esp) /* Adjust vector into the [-256, -1] range */
++ SAVE_ALL switch_stacks=1
++ ENCODE_FRAME_POINTER
++ TRACE_IRQS_OFF
++ movl %esp, %eax
++ call smp_spurious_interrupt
++ jmp ret_from_intr
++ENDPROC(common_spurious)
++#endif
++
+ /*
+ * the CPU automatically disables interrupts when executing an IRQ vector,
+ * so IRQ-flags tracing has to follow that:
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index c90e00db5c13..206df099950e 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -438,6 +438,18 @@ ENTRY(irq_entries_start)
+ .endr
+ END(irq_entries_start)
+
++ .align 8
++ENTRY(spurious_entries_start)
++ vector=FIRST_SYSTEM_VECTOR
++ .rept (NR_VECTORS - FIRST_SYSTEM_VECTOR)
++ UNWIND_HINT_IRET_REGS
++ pushq $(~vector+0x80) /* Note: always in signed byte range */
++ jmp common_spurious
++ .align 8
++ vector=vector+1
++ .endr
++END(spurious_entries_start)
++
+ .macro DEBUG_ENTRY_ASSERT_IRQS_OFF
+ #ifdef CONFIG_DEBUG_ENTRY
+ pushq %rax
+@@ -634,10 +646,20 @@ _ASM_NOKPROBE(interrupt_entry)
+
+ /* Interrupt entry/exit. */
+
+- /*
+- * The interrupt stubs push (~vector+0x80) onto the stack and
+- * then jump to common_interrupt.
+- */
++/*
++ * The interrupt stubs push (~vector+0x80) onto the stack and
++ * then jump to common_spurious/interrupt.
++ */
++common_spurious:
++ addq $-0x80, (%rsp) /* Adjust vector to [-256, -1] range */
++ call interrupt_entry
++ UNWIND_HINT_REGS indirect=1
++ call smp_spurious_interrupt /* rdi points to pt_regs */
++ jmp ret_from_intr
++END(common_spurious)
++_ASM_NOKPROBE(common_spurious)
++
++/* common_interrupt is a hotpath. Align it */
+ .p2align CONFIG_X86_L1_CACHE_SHIFT
+ common_interrupt:
+ addq $-0x80, (%rsp) /* Adjust vector to [-256, -1] range */
+diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
+index 32e666e1231e..cbd97e22d2f3 100644
+--- a/arch/x86/include/asm/hw_irq.h
++++ b/arch/x86/include/asm/hw_irq.h
+@@ -150,8 +150,11 @@ extern char irq_entries_start[];
+ #define trace_irq_entries_start irq_entries_start
+ #endif
+
++extern char spurious_entries_start[];
++
+ #define VECTOR_UNUSED NULL
+-#define VECTOR_RETRIGGERED ((void *)~0UL)
++#define VECTOR_SHUTDOWN ((void *)~0UL)
++#define VECTOR_RETRIGGERED ((void *)~1UL)
+
+ typedef struct irq_desc* vector_irq_t[NR_VECTORS];
+ DECLARE_PER_CPU(vector_irq_t, vector_irq);
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 84132eddb5a8..02020f2e0080 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1452,7 +1452,8 @@ static void apic_pending_intr_clear(void)
+ if (queued) {
+ if (boot_cpu_has(X86_FEATURE_TSC) && cpu_khz) {
+ ntsc = rdtsc();
+- max_loops = (cpu_khz << 10) - (ntsc - tsc);
++ max_loops = (long long)cpu_khz << 10;
++ max_loops -= ntsc - tsc;
+ } else {
+ max_loops--;
+ }
+@@ -2026,21 +2027,32 @@ __visible void __irq_entry smp_spurious_interrupt(struct pt_regs *regs)
+ entering_irq();
+ trace_spurious_apic_entry(vector);
+
++ inc_irq_stat(irq_spurious_count);
++
++ /*
++ * If this is a spurious interrupt then do not acknowledge
++ */
++ if (vector == SPURIOUS_APIC_VECTOR) {
++ /* See SDM vol 3 */
++ pr_info("Spurious APIC interrupt (vector 0xFF) on CPU#%d, should never happen.\n",
++ smp_processor_id());
++ goto out;
++ }
++
+ /*
+- * Check if this really is a spurious interrupt and ACK it
+- * if it is a vectored one. Just in case...
+- * Spurious interrupts should not be ACKed.
++ * If it is a vectored one, verify it's set in the ISR. If set,
++ * acknowledge it.
+ */
+ v = apic_read(APIC_ISR + ((vector & ~0x1f) >> 1));
+- if (v & (1 << (vector & 0x1f)))
++ if (v & (1 << (vector & 0x1f))) {
++ pr_info("Spurious interrupt (vector 0x%02x) on CPU#%d. Acked\n",
++ vector, smp_processor_id());
+ ack_APIC_irq();
+-
+- inc_irq_stat(irq_spurious_count);
+-
+- /* see sw-dev-man vol 3, chapter 7.4.13.5 */
+- pr_info("spurious APIC interrupt through vector %02x on CPU#%d, "
+- "should never happen.\n", vector, smp_processor_id());
+-
++ } else {
++ pr_info("Spurious interrupt (vector 0x%02x) on CPU#%d. Not pending!\n",
++ vector, smp_processor_id());
++ }
++out:
+ trace_spurious_apic_exit(vector);
+ exiting_irq();
+ }
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index ff0d14cd9e82..4077e309e5c4 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -1891,6 +1891,50 @@ static int ioapic_set_affinity(struct irq_data *irq_data,
+ return ret;
+ }
+
++/*
++ * Interrupt shutdown masks the ioapic pin, but the interrupt might already
++ * be in flight, but not yet serviced by the target CPU. That means
++ * __synchronize_hardirq() would return and claim that everything is calmed
++ * down. So free_irq() would proceed and deactivate the interrupt and free
++ * resources.
++ *
++ * Once the target CPU comes around to service it it will find a cleared
++ * vector and complain. While the spurious interrupt is harmless, the full
++ * release of resources might prevent the interrupt from being acknowledged
++ * which keeps the hardware in a weird state.
++ *
++ * Verify that the corresponding Remote-IRR bits are clear.
++ */
++static int ioapic_irq_get_chip_state(struct irq_data *irqd,
++ enum irqchip_irq_state which,
++ bool *state)
++{
++ struct mp_chip_data *mcd = irqd->chip_data;
++ struct IO_APIC_route_entry rentry;
++ struct irq_pin_list *p;
++
++ if (which != IRQCHIP_STATE_ACTIVE)
++ return -EINVAL;
++
++ *state = false;
++ raw_spin_lock(&ioapic_lock);
++ for_each_irq_pin(p, mcd->irq_2_pin) {
++ rentry = __ioapic_read_entry(p->apic, p->pin);
++ /*
++ * The remote IRR is only valid in level trigger mode. It's
++ * meaning is undefined for edge triggered interrupts and
++ * irrelevant because the IO-APIC treats them as fire and
++ * forget.
++ */
++ if (rentry.irr && rentry.trigger) {
++ *state = true;
++ break;
++ }
++ }
++ raw_spin_unlock(&ioapic_lock);
++ return 0;
++}
++
+ static struct irq_chip ioapic_chip __read_mostly = {
+ .name = "IO-APIC",
+ .irq_startup = startup_ioapic_irq,
+@@ -1900,6 +1944,7 @@ static struct irq_chip ioapic_chip __read_mostly = {
+ .irq_eoi = ioapic_ack_level,
+ .irq_set_affinity = ioapic_set_affinity,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
++ .irq_get_irqchip_state = ioapic_irq_get_chip_state,
+ .flags = IRQCHIP_SKIP_SET_WAKE,
+ };
+
+@@ -1912,6 +1957,7 @@ static struct irq_chip ioapic_ir_chip __read_mostly = {
+ .irq_eoi = ioapic_ir_ack_level,
+ .irq_set_affinity = ioapic_set_affinity,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
++ .irq_get_irqchip_state = ioapic_irq_get_chip_state,
+ .flags = IRQCHIP_SKIP_SET_WAKE,
+ };
+
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index 652e7ffa9b9d..10e1d17aa060 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -342,7 +342,7 @@ static void clear_irq_vector(struct irq_data *irqd)
+ trace_vector_clear(irqd->irq, vector, apicd->cpu, apicd->prev_vector,
+ apicd->prev_cpu);
+
+- per_cpu(vector_irq, apicd->cpu)[vector] = VECTOR_UNUSED;
++ per_cpu(vector_irq, apicd->cpu)[vector] = VECTOR_SHUTDOWN;
+ irq_matrix_free(vector_matrix, apicd->cpu, vector, managed);
+ apicd->vector = 0;
+
+@@ -351,7 +351,7 @@ static void clear_irq_vector(struct irq_data *irqd)
+ if (!vector)
+ return;
+
+- per_cpu(vector_irq, apicd->prev_cpu)[vector] = VECTOR_UNUSED;
++ per_cpu(vector_irq, apicd->prev_cpu)[vector] = VECTOR_SHUTDOWN;
+ irq_matrix_free(vector_matrix, apicd->prev_cpu, vector, managed);
+ apicd->prev_vector = 0;
+ apicd->move_in_progress = 0;
+diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
+index ddee1f0870c4..250cfa85b633 100644
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -184,24 +184,25 @@ unsigned long __head __startup_64(unsigned long physaddr,
+ pgtable_flags = _KERNPG_TABLE_NOENC + sme_get_me_mask();
+
+ if (la57) {
+- p4d = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
++ p4d = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++],
++ physaddr);
+
+ i = (physaddr >> PGDIR_SHIFT) % PTRS_PER_PGD;
+ pgd[i + 0] = (pgdval_t)p4d + pgtable_flags;
+ pgd[i + 1] = (pgdval_t)p4d + pgtable_flags;
+
+- i = (physaddr >> P4D_SHIFT) % PTRS_PER_P4D;
+- p4d[i + 0] = (pgdval_t)pud + pgtable_flags;
+- p4d[i + 1] = (pgdval_t)pud + pgtable_flags;
++ i = physaddr >> P4D_SHIFT;
++ p4d[(i + 0) % PTRS_PER_P4D] = (pgdval_t)pud + pgtable_flags;
++ p4d[(i + 1) % PTRS_PER_P4D] = (pgdval_t)pud + pgtable_flags;
+ } else {
+ i = (physaddr >> PGDIR_SHIFT) % PTRS_PER_PGD;
+ pgd[i + 0] = (pgdval_t)pud + pgtable_flags;
+ pgd[i + 1] = (pgdval_t)pud + pgtable_flags;
+ }
+
+- i = (physaddr >> PUD_SHIFT) % PTRS_PER_PUD;
+- pud[i + 0] = (pudval_t)pmd + pgtable_flags;
+- pud[i + 1] = (pudval_t)pmd + pgtable_flags;
++ i = physaddr >> PUD_SHIFT;
++ pud[(i + 0) % PTRS_PER_PUD] = (pudval_t)pmd + pgtable_flags;
++ pud[(i + 1) % PTRS_PER_PUD] = (pudval_t)pmd + pgtable_flags;
+
+ pmd_entry = __PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL;
+ /* Filter out unsupported __PAGE_KERNEL_* bits: */
+@@ -211,8 +212,9 @@ unsigned long __head __startup_64(unsigned long physaddr,
+ pmd_entry += physaddr;
+
+ for (i = 0; i < DIV_ROUND_UP(_end - _text, PMD_SIZE); i++) {
+- int idx = i + (physaddr >> PMD_SHIFT) % PTRS_PER_PMD;
+- pmd[idx] = pmd_entry + i * PMD_SIZE;
++ int idx = i + (physaddr >> PMD_SHIFT);
++
++ pmd[idx % PTRS_PER_PMD] = pmd_entry + i * PMD_SIZE;
+ }
+
+ /*
+diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c
+index 01adea278a71..a7e0e975043f 100644
+--- a/arch/x86/kernel/idt.c
++++ b/arch/x86/kernel/idt.c
+@@ -321,7 +321,8 @@ void __init idt_setup_apic_and_irq_gates(void)
+ #ifdef CONFIG_X86_LOCAL_APIC
+ for_each_clear_bit_from(i, system_vectors, NR_VECTORS) {
+ set_bit(i, system_vectors);
+- set_intr_gate(i, spurious_interrupt);
++ entry = spurious_entries_start + 8 * (i - FIRST_SYSTEM_VECTOR);
++ set_intr_gate(i, entry);
+ }
+ #endif
+ }
+diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
+index 59b5f2ea7c2f..a975246074b5 100644
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -246,7 +246,7 @@ __visible unsigned int __irq_entry do_IRQ(struct pt_regs *regs)
+ if (!handle_irq(desc, regs)) {
+ ack_APIC_irq();
+
+- if (desc != VECTOR_RETRIGGERED) {
++ if (desc != VECTOR_RETRIGGERED && desc != VECTOR_SHUTDOWN) {
+ pr_emerg_ratelimited("%s: %d.%d No irq handler for vector\n",
+ __func__, smp_processor_id(),
+ vector);
+diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
+index dd6a6850cb45..ce015ce2977c 100644
+--- a/drivers/base/cacheinfo.c
++++ b/drivers/base/cacheinfo.c
+@@ -653,7 +653,8 @@ static int cacheinfo_cpu_pre_down(unsigned int cpu)
+
+ static int __init cacheinfo_sysfs_init(void)
+ {
+- return cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "base/cacheinfo:online",
++ return cpuhp_setup_state(CPUHP_AP_BASE_CACHEINFO_ONLINE,
++ "base/cacheinfo:online",
+ cacheinfo_cpu_online, cacheinfo_cpu_pre_down);
+ }
+ device_initcall(cacheinfo_sysfs_init);
+diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
+index b5c865fe263b..818d8c37d70a 100644
+--- a/drivers/base/firmware_loader/fallback.c
++++ b/drivers/base/firmware_loader/fallback.c
+@@ -659,7 +659,7 @@ static bool fw_run_sysfs_fallback(enum fw_opt opt_flags)
+ /* Also permit LSMs and IMA to fail firmware sysfs fallback */
+ ret = security_kernel_load_data(LOADING_FIRMWARE);
+ if (ret < 0)
+- return ret;
++ return false;
+
+ return fw_force_sysfs_fallback(opt_flags);
+ }
+diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
+index 429ca8ed7e51..982c7ac311b8 100644
+--- a/drivers/base/regmap/regmap-irq.c
++++ b/drivers/base/regmap/regmap-irq.c
+@@ -91,6 +91,9 @@ static void regmap_irq_sync_unlock(struct irq_data *data)
+ * suppress pointless writes.
+ */
+ for (i = 0; i < d->chip->num_regs; i++) {
++ if (!d->chip->mask_base)
++ continue;
++
+ reg = d->chip->mask_base +
+ (i * map->reg_stride * d->irq_reg_stride);
+ if (d->chip->mask_invert) {
+@@ -526,6 +529,9 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
+ /* Mask all the interrupts by default */
+ for (i = 0; i < chip->num_regs; i++) {
+ d->mask_buf[i] = d->mask_buf_def[i];
++ if (!chip->mask_base)
++ continue;
++
+ reg = chip->mask_base +
+ (i * map->reg_stride * d->irq_reg_stride);
+ if (chip->mask_invert)
+diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
+index ca3218337fd7..dfaa5aad0692 100644
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -229,6 +229,7 @@ static struct clk_hw *_ti_omap4_clkctrl_xlate(struct of_phandle_args *clkspec,
+ {
+ struct omap_clkctrl_provider *provider = data;
+ struct omap_clkctrl_clk *entry;
++ bool found = false;
+
+ if (clkspec->args_count != 2)
+ return ERR_PTR(-EINVAL);
+@@ -238,11 +239,13 @@ static struct clk_hw *_ti_omap4_clkctrl_xlate(struct of_phandle_args *clkspec,
+
+ list_for_each_entry(entry, &provider->clocks, node) {
+ if (entry->reg_offset == clkspec->args[0] &&
+- entry->bit_offset == clkspec->args[1])
++ entry->bit_offset == clkspec->args[1]) {
++ found = true;
+ break;
++ }
+ }
+
+- if (!entry)
++ if (!found)
+ return ERR_PTR(-EINVAL);
+
+ return entry->clk;
+diff --git a/drivers/crypto/nx/nx-842-powernv.c b/drivers/crypto/nx/nx-842-powernv.c
+index c68df7e8bee1..7ce2467c771e 100644
+--- a/drivers/crypto/nx/nx-842-powernv.c
++++ b/drivers/crypto/nx/nx-842-powernv.c
+@@ -36,8 +36,6 @@ MODULE_ALIAS_CRYPTO("842-nx");
+ #define WORKMEM_ALIGN (CRB_ALIGN)
+ #define CSB_WAIT_MAX (5000) /* ms */
+ #define VAS_RETRIES (10)
+-/* # of requests allowed per RxFIFO at a time. 0 for unlimited */
+-#define MAX_CREDITS_PER_RXFIFO (1024)
+
+ struct nx842_workmem {
+ /* Below fields must be properly aligned */
+@@ -821,7 +819,11 @@ static int __init vas_cfg_coproc_info(struct device_node *dn, int chip_id,
+ rxattr.lnotify_lpid = lpid;
+ rxattr.lnotify_pid = pid;
+ rxattr.lnotify_tid = tid;
+- rxattr.wcreds_max = MAX_CREDITS_PER_RXFIFO;
++ /*
++ * Maximum RX window credits can not be more than #CRBs in
++ * RxFIFO. Otherwise, can get checkstop if RxFIFO overruns.
++ */
++ rxattr.wcreds_max = fifo_size / CRB_SIZE;
+
+ /*
+ * Open a VAS receice window which is used to configure RxFIFO
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index c5859d3cb825..5849075d54c7 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -334,6 +334,21 @@ int talitos_submit(struct device *dev, int ch, struct talitos_desc *desc,
+ }
+ EXPORT_SYMBOL(talitos_submit);
+
++static __be32 get_request_hdr(struct talitos_request *request, bool is_sec1)
++{
++ struct talitos_edesc *edesc;
++
++ if (!is_sec1)
++ return request->desc->hdr;
++
++ if (!request->desc->next_desc)
++ return request->desc->hdr1;
++
++ edesc = container_of(request->desc, struct talitos_edesc, desc);
++
++ return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))->hdr1;
++}
++
+ /*
+ * process what was done, notify callback of error if not
+ */
+@@ -355,12 +370,7 @@ static void flush_channel(struct device *dev, int ch, int error, int reset_ch)
+
+ /* descriptors with their done bits set don't get the error */
+ rmb();
+- if (!is_sec1)
+- hdr = request->desc->hdr;
+- else if (request->desc->next_desc)
+- hdr = (request->desc + 1)->hdr1;
+- else
+- hdr = request->desc->hdr1;
++ hdr = get_request_hdr(request, is_sec1);
+
+ if ((hdr & DESC_HDR_DONE) == DESC_HDR_DONE)
+ status = 0;
+@@ -490,8 +500,14 @@ static u32 current_desc_hdr(struct device *dev, int ch)
+ }
+ }
+
+- if (priv->chan[ch].fifo[iter].desc->next_desc == cur_desc)
+- return (priv->chan[ch].fifo[iter].desc + 1)->hdr;
++ if (priv->chan[ch].fifo[iter].desc->next_desc == cur_desc) {
++ struct talitos_edesc *edesc;
++
++ edesc = container_of(priv->chan[ch].fifo[iter].desc,
++ struct talitos_edesc, desc);
++ return ((struct talitos_desc *)
++ (edesc->buf + edesc->dma_len))->hdr;
++ }
+
+ return priv->chan[ch].fifo[iter].desc->hdr;
+ }
+@@ -913,36 +929,6 @@ badkey:
+ return -EINVAL;
+ }
+
+-/*
+- * talitos_edesc - s/w-extended descriptor
+- * @src_nents: number of segments in input scatterlist
+- * @dst_nents: number of segments in output scatterlist
+- * @icv_ool: whether ICV is out-of-line
+- * @iv_dma: dma address of iv for checking continuity and link table
+- * @dma_len: length of dma mapped link_tbl space
+- * @dma_link_tbl: bus physical address of link_tbl/buf
+- * @desc: h/w descriptor
+- * @link_tbl: input and output h/w link tables (if {src,dst}_nents > 1) (SEC2)
+- * @buf: input and output buffeur (if {src,dst}_nents > 1) (SEC1)
+- *
+- * if decrypting (with authcheck), or either one of src_nents or dst_nents
+- * is greater than 1, an integrity check value is concatenated to the end
+- * of link_tbl data
+- */
+-struct talitos_edesc {
+- int src_nents;
+- int dst_nents;
+- bool icv_ool;
+- dma_addr_t iv_dma;
+- int dma_len;
+- dma_addr_t dma_link_tbl;
+- struct talitos_desc desc;
+- union {
+- struct talitos_ptr link_tbl[0];
+- u8 buf[0];
+- };
+-};
+-
+ static void talitos_sg_unmap(struct device *dev,
+ struct talitos_edesc *edesc,
+ struct scatterlist *src,
+@@ -1431,15 +1417,11 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
+ edesc->dst_nents = dst_nents;
+ edesc->iv_dma = iv_dma;
+ edesc->dma_len = dma_len;
+- if (dma_len) {
+- void *addr = &edesc->link_tbl[0];
+-
+- if (is_sec1 && !dst)
+- addr += sizeof(struct talitos_desc);
+- edesc->dma_link_tbl = dma_map_single(dev, addr,
++ if (dma_len)
++ edesc->dma_link_tbl = dma_map_single(dev, &edesc->link_tbl[0],
+ edesc->dma_len,
+ DMA_BIDIRECTIONAL);
+- }
++
+ return edesc;
+ }
+
+@@ -1706,14 +1688,16 @@ static void common_nonsnoop_hash_unmap(struct device *dev,
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
+ struct talitos_desc *desc = &edesc->desc;
+- struct talitos_desc *desc2 = desc + 1;
++ struct talitos_desc *desc2 = (struct talitos_desc *)
++ (edesc->buf + edesc->dma_len);
+
+ unmap_single_talitos_ptr(dev, &edesc->desc.ptr[5], DMA_FROM_DEVICE);
+ if (desc->next_desc &&
+ desc->ptr[5].ptr != desc2->ptr[5].ptr)
+ unmap_single_talitos_ptr(dev, &desc2->ptr[5], DMA_FROM_DEVICE);
+
+- talitos_sg_unmap(dev, edesc, req_ctx->psrc, NULL, 0, 0);
++ if (req_ctx->psrc)
++ talitos_sg_unmap(dev, edesc, req_ctx->psrc, NULL, 0, 0);
+
+ /* When using hashctx-in, must unmap it. */
+ if (from_talitos_ptr_len(&edesc->desc.ptr[1], is_sec1))
+@@ -1780,7 +1764,6 @@ static void talitos_handle_buggy_hash(struct talitos_ctx *ctx,
+
+ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
+ struct ahash_request *areq, unsigned int length,
+- unsigned int offset,
+ void (*callback) (struct device *dev,
+ struct talitos_desc *desc,
+ void *context, int error))
+@@ -1819,9 +1802,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
+
+ sg_count = edesc->src_nents ?: 1;
+ if (is_sec1 && sg_count > 1)
+- sg_pcopy_to_buffer(req_ctx->psrc, sg_count,
+- edesc->buf + sizeof(struct talitos_desc),
+- length, req_ctx->nbuf);
++ sg_copy_to_buffer(req_ctx->psrc, sg_count, edesc->buf, length);
+ else if (length)
+ sg_count = dma_map_sg(dev, req_ctx->psrc, sg_count,
+ DMA_TO_DEVICE);
+@@ -1834,7 +1815,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
+ DMA_TO_DEVICE);
+ } else {
+ sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc,
+- &desc->ptr[3], sg_count, offset, 0);
++ &desc->ptr[3], sg_count, 0, 0);
+ if (sg_count > 1)
+ sync_needed = true;
+ }
+@@ -1858,7 +1839,8 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
+ talitos_handle_buggy_hash(ctx, edesc, &desc->ptr[3]);
+
+ if (is_sec1 && req_ctx->nbuf && length) {
+- struct talitos_desc *desc2 = desc + 1;
++ struct talitos_desc *desc2 = (struct talitos_desc *)
++ (edesc->buf + edesc->dma_len);
+ dma_addr_t next_desc;
+
+ memset(desc2, 0, sizeof(*desc2));
+@@ -1879,7 +1861,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
+ DMA_TO_DEVICE);
+ copy_talitos_ptr(&desc2->ptr[2], &desc->ptr[2], is_sec1);
+ sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc,
+- &desc2->ptr[3], sg_count, offset, 0);
++ &desc2->ptr[3], sg_count, 0, 0);
+ if (sg_count > 1)
+ sync_needed = true;
+ copy_talitos_ptr(&desc2->ptr[5], &desc->ptr[5], is_sec1);
+@@ -1990,7 +1972,6 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
+ struct device *dev = ctx->dev;
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
+- int offset = 0;
+ u8 *ctx_buf = req_ctx->buf[req_ctx->buf_idx];
+
+ if (!req_ctx->last && (nbytes + req_ctx->nbuf <= blocksize)) {
+@@ -2030,6 +2011,8 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
+ sg_chain(req_ctx->bufsl, 2, areq->src);
+ req_ctx->psrc = req_ctx->bufsl;
+ } else if (is_sec1 && req_ctx->nbuf && req_ctx->nbuf < blocksize) {
++ int offset;
++
+ if (nbytes_to_hash > blocksize)
+ offset = blocksize - req_ctx->nbuf;
+ else
+@@ -2042,7 +2025,8 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
+ sg_copy_to_buffer(areq->src, nents,
+ ctx_buf + req_ctx->nbuf, offset);
+ req_ctx->nbuf += offset;
+- req_ctx->psrc = areq->src;
++ req_ctx->psrc = scatterwalk_ffwd(req_ctx->bufsl, areq->src,
++ offset);
+ } else
+ req_ctx->psrc = areq->src;
+
+@@ -2082,8 +2066,7 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
+ if (ctx->keylen && (req_ctx->first || req_ctx->last))
+ edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_HMAC;
+
+- return common_nonsnoop_hash(edesc, areq, nbytes_to_hash, offset,
+- ahash_done);
++ return common_nonsnoop_hash(edesc, areq, nbytes_to_hash, ahash_done);
+ }
+
+ static int ahash_update(struct ahash_request *areq)
+diff --git a/drivers/crypto/talitos.h b/drivers/crypto/talitos.h
+index a65a63e0d6c1..979f6a61e545 100644
+--- a/drivers/crypto/talitos.h
++++ b/drivers/crypto/talitos.h
+@@ -65,6 +65,36 @@ struct talitos_desc {
+
+ #define TALITOS_DESC_SIZE (sizeof(struct talitos_desc) - sizeof(__be32))
+
++/*
++ * talitos_edesc - s/w-extended descriptor
++ * @src_nents: number of segments in input scatterlist
++ * @dst_nents: number of segments in output scatterlist
++ * @icv_ool: whether ICV is out-of-line
++ * @iv_dma: dma address of iv for checking continuity and link table
++ * @dma_len: length of dma mapped link_tbl space
++ * @dma_link_tbl: bus physical address of link_tbl/buf
++ * @desc: h/w descriptor
++ * @link_tbl: input and output h/w link tables (if {src,dst}_nents > 1) (SEC2)
++ * @buf: input and output buffeur (if {src,dst}_nents > 1) (SEC1)
++ *
++ * if decrypting (with authcheck), or either one of src_nents or dst_nents
++ * is greater than 1, an integrity check value is concatenated to the end
++ * of link_tbl data
++ */
++struct talitos_edesc {
++ int src_nents;
++ int dst_nents;
++ bool icv_ool;
++ dma_addr_t iv_dma;
++ int dma_len;
++ dma_addr_t dma_link_tbl;
++ struct talitos_desc desc;
++ union {
++ struct talitos_ptr link_tbl[0];
++ u8 buf[0];
++ };
++};
++
+ /**
+ * talitos_request - descriptor submission request
+ * @desc: descriptor pointer (kernel virtual)
+diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c
+index b22ccfb0c991..2bf4d31f4967 100644
+--- a/drivers/firmware/efi/efi-bgrt.c
++++ b/drivers/firmware/efi/efi-bgrt.c
+@@ -50,11 +50,6 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
+ bgrt->version);
+ goto out;
+ }
+- if (bgrt->status & 0xfe) {
+- pr_notice("Ignoring BGRT: reserved status bits are non-zero %u\n",
+- bgrt->status);
+- goto out;
+- }
+ if (bgrt->image_type != 0) {
+ pr_notice("Ignoring BGRT: invalid image type %u (expected 0)\n",
+ bgrt->image_type);
+diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
+index 54e767bd5ddb..f28703db8dbd 100644
+--- a/drivers/gpu/drm/udl/udl_drv.c
++++ b/drivers/gpu/drm/udl/udl_drv.c
+@@ -47,10 +47,16 @@ static const struct file_operations udl_driver_fops = {
+ .llseek = noop_llseek,
+ };
+
++static void udl_driver_release(struct drm_device *dev)
++{
++ udl_fini(dev);
++ udl_modeset_cleanup(dev);
++ drm_dev_fini(dev);
++ kfree(dev);
++}
++
+ static struct drm_driver driver = {
+ .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME,
+- .load = udl_driver_load,
+- .unload = udl_driver_unload,
+ .release = udl_driver_release,
+
+ /* gem hooks */
+@@ -74,28 +80,56 @@ static struct drm_driver driver = {
+ .patchlevel = DRIVER_PATCHLEVEL,
+ };
+
++static struct udl_device *udl_driver_create(struct usb_interface *interface)
++{
++ struct usb_device *udev = interface_to_usbdev(interface);
++ struct udl_device *udl;
++ int r;
++
++ udl = kzalloc(sizeof(*udl), GFP_KERNEL);
++ if (!udl)
++ return ERR_PTR(-ENOMEM);
++
++ r = drm_dev_init(&udl->drm, &driver, &interface->dev);
++ if (r) {
++ kfree(udl);
++ return ERR_PTR(r);
++ }
++
++ udl->udev = udev;
++ udl->drm.dev_private = udl;
++
++ r = udl_init(udl);
++ if (r) {
++ drm_dev_fini(&udl->drm);
++ kfree(udl);
++ return ERR_PTR(r);
++ }
++
++ usb_set_intfdata(interface, udl);
++ return udl;
++}
++
+ static int udl_usb_probe(struct usb_interface *interface,
+ const struct usb_device_id *id)
+ {
+- struct usb_device *udev = interface_to_usbdev(interface);
+- struct drm_device *dev;
+ int r;
++ struct udl_device *udl;
+
+- dev = drm_dev_alloc(&driver, &interface->dev);
+- if (IS_ERR(dev))
+- return PTR_ERR(dev);
++ udl = udl_driver_create(interface);
++ if (IS_ERR(udl))
++ return PTR_ERR(udl);
+
+- r = drm_dev_register(dev, (unsigned long)udev);
++ r = drm_dev_register(&udl->drm, 0);
+ if (r)
+ goto err_free;
+
+- usb_set_intfdata(interface, dev);
+- DRM_INFO("Initialized udl on minor %d\n", dev->primary->index);
++ DRM_INFO("Initialized udl on minor %d\n", udl->drm.primary->index);
+
+ return 0;
+
+ err_free:
+- drm_dev_unref(dev);
++ drm_dev_put(&udl->drm);
+ return r;
+ }
+
+diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
+index 4ae67d882eae..35c1f33fbc1a 100644
+--- a/drivers/gpu/drm/udl/udl_drv.h
++++ b/drivers/gpu/drm/udl/udl_drv.h
+@@ -50,8 +50,8 @@ struct urb_list {
+ struct udl_fbdev;
+
+ struct udl_device {
++ struct drm_device drm;
+ struct device *dev;
+- struct drm_device *ddev;
+ struct usb_device *udev;
+ struct drm_crtc *crtc;
+
+@@ -71,6 +71,8 @@ struct udl_device {
+ atomic_t cpu_kcycles_used; /* transpired during pixel processing */
+ };
+
++#define to_udl(x) container_of(x, struct udl_device, drm)
++
+ struct udl_gem_object {
+ struct drm_gem_object base;
+ struct page **pages;
+@@ -102,9 +104,8 @@ struct urb *udl_get_urb(struct drm_device *dev);
+ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len);
+ void udl_urb_completion(struct urb *urb);
+
+-int udl_driver_load(struct drm_device *dev, unsigned long flags);
+-void udl_driver_unload(struct drm_device *dev);
+-void udl_driver_release(struct drm_device *dev);
++int udl_init(struct udl_device *udl);
++void udl_fini(struct drm_device *dev);
+
+ int udl_fbdev_init(struct drm_device *dev);
+ void udl_fbdev_cleanup(struct drm_device *dev);
+diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
+index dd9ffded223b..4ab101bf1df0 100644
+--- a/drivers/gpu/drm/udl/udl_fb.c
++++ b/drivers/gpu/drm/udl/udl_fb.c
+@@ -82,7 +82,7 @@ int udl_handle_damage(struct udl_framebuffer *fb, int x, int y,
+ int width, int height)
+ {
+ struct drm_device *dev = fb->base.dev;
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+ int i, ret;
+ char *cmd;
+ cycles_t start_cycles, end_cycles;
+@@ -210,10 +210,10 @@ static int udl_fb_open(struct fb_info *info, int user)
+ {
+ struct udl_fbdev *ufbdev = info->par;
+ struct drm_device *dev = ufbdev->ufb.base.dev;
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+
+ /* If the USB device is gone, we don't accept new opens */
+- if (drm_dev_is_unplugged(udl->ddev))
++ if (drm_dev_is_unplugged(&udl->drm))
+ return -ENODEV;
+
+ ufbdev->fb_count++;
+@@ -441,7 +441,7 @@ static void udl_fbdev_destroy(struct drm_device *dev,
+
+ int udl_fbdev_init(struct drm_device *dev)
+ {
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+ int bpp_sel = fb_bpp;
+ struct udl_fbdev *ufbdev;
+ int ret;
+@@ -480,7 +480,7 @@ free:
+
+ void udl_fbdev_cleanup(struct drm_device *dev)
+ {
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+ if (!udl->fbdev)
+ return;
+
+@@ -491,7 +491,7 @@ void udl_fbdev_cleanup(struct drm_device *dev)
+
+ void udl_fbdev_unplug(struct drm_device *dev)
+ {
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+ struct udl_fbdev *ufbdev;
+ if (!udl->fbdev)
+ return;
+diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
+index bb7b58407039..3b3e17652bb2 100644
+--- a/drivers/gpu/drm/udl/udl_gem.c
++++ b/drivers/gpu/drm/udl/udl_gem.c
+@@ -203,7 +203,7 @@ int udl_gem_mmap(struct drm_file *file, struct drm_device *dev,
+ {
+ struct udl_gem_object *gobj;
+ struct drm_gem_object *obj;
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+ int ret = 0;
+
+ mutex_lock(&udl->gem_lock);
+diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
+index 19055dda3140..8d22b6cd5241 100644
+--- a/drivers/gpu/drm/udl/udl_main.c
++++ b/drivers/gpu/drm/udl/udl_main.c
+@@ -29,7 +29,7 @@
+ static int udl_parse_vendor_descriptor(struct drm_device *dev,
+ struct usb_device *usbdev)
+ {
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+ char *desc;
+ char *buf;
+ char *desc_end;
+@@ -165,7 +165,7 @@ void udl_urb_completion(struct urb *urb)
+
+ static void udl_free_urb_list(struct drm_device *dev)
+ {
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+ int count = udl->urbs.count;
+ struct list_head *node;
+ struct urb_node *unode;
+@@ -198,7 +198,7 @@ static void udl_free_urb_list(struct drm_device *dev)
+
+ static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size)
+ {
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+ struct urb *urb;
+ struct urb_node *unode;
+ char *buf;
+@@ -262,7 +262,7 @@ retry:
+
+ struct urb *udl_get_urb(struct drm_device *dev)
+ {
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+ int ret = 0;
+ struct list_head *entry;
+ struct urb_node *unode;
+@@ -295,7 +295,7 @@ error:
+
+ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
+ {
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+ int ret;
+
+ BUG_ON(len > udl->urbs.size);
+@@ -310,20 +310,12 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
+ return ret;
+ }
+
+-int udl_driver_load(struct drm_device *dev, unsigned long flags)
++int udl_init(struct udl_device *udl)
+ {
+- struct usb_device *udev = (void*)flags;
+- struct udl_device *udl;
++ struct drm_device *dev = &udl->drm;
+ int ret = -ENOMEM;
+
+ DRM_DEBUG("\n");
+- udl = kzalloc(sizeof(struct udl_device), GFP_KERNEL);
+- if (!udl)
+- return -ENOMEM;
+-
+- udl->udev = udev;
+- udl->ddev = dev;
+- dev->dev_private = udl;
+
+ mutex_init(&udl->gem_lock);
+
+@@ -357,7 +349,6 @@ int udl_driver_load(struct drm_device *dev, unsigned long flags)
+ err:
+ if (udl->urbs.count)
+ udl_free_urb_list(dev);
+- kfree(udl);
+ DRM_ERROR("%d\n", ret);
+ return ret;
+ }
+@@ -368,9 +359,9 @@ int udl_drop_usb(struct drm_device *dev)
+ return 0;
+ }
+
+-void udl_driver_unload(struct drm_device *dev)
++void udl_fini(struct drm_device *dev)
+ {
+- struct udl_device *udl = dev->dev_private;
++ struct udl_device *udl = to_udl(dev);
+
+ drm_kms_helper_poll_fini(dev);
+
+@@ -378,12 +369,4 @@ void udl_driver_unload(struct drm_device *dev)
+ udl_free_urb_list(dev);
+
+ udl_fbdev_cleanup(dev);
+- kfree(udl);
+-}
+-
+-void udl_driver_release(struct drm_device *dev)
+-{
+- udl_modeset_cleanup(dev);
+- drm_dev_fini(dev);
+- kfree(dev);
+ }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 92452992b368..50b3c0d89c9c 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -82,6 +82,7 @@
+ #define HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP 0x1220
+ #define HID_DEVICE_ID_ALPS_U1 0x1215
+ #define HID_DEVICE_ID_ALPS_T4_BTNLESS 0x120C
++#define HID_DEVICE_ID_ALPS_1222 0x1222
+
+
+ #define USB_VENDOR_ID_AMI 0x046b
+@@ -265,6 +266,7 @@
+ #define USB_DEVICE_ID_CHICONY_MULTI_TOUCH 0xb19d
+ #define USB_DEVICE_ID_CHICONY_WIRELESS 0x0618
+ #define USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE 0x1053
++#define USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2 0x0939
+ #define USB_DEVICE_ID_CHICONY_WIRELESS2 0x1123
+ #define USB_DEVICE_ID_ASUS_AK1D 0x1125
+ #define USB_DEVICE_ID_CHICONY_ACER_SWITCH12 0x1421
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 184e49036e1d..f9167d0e095c 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1788,6 +1788,10 @@ static const struct hid_device_id mt_devices[] = {
+ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+ USB_VENDOR_ID_ALPS_JP,
+ HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP) },
++ { .driver_data = MT_CLS_WIN_8_DUAL,
++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
++ USB_VENDOR_ID_ALPS_JP,
++ HID_DEVICE_ID_ALPS_1222) },
+
+ /* Lenovo X1 TAB Gen 2 */
+ { .driver_data = MT_CLS_WIN_8_DUAL,
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 5892f1bd037e..91e86af44a04 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -45,6 +45,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CHIC, USB_DEVICE_ID_CHIC_GAMEPAD), HID_QUIRK_BADPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK), HID_QUIRK_NOGET },
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 8e6077d8e434..68fd8232d44c 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -176,6 +176,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN0073", /* X1 Carbon G5 (Elantech) */
+ "LEN0092", /* X1 Carbon 6 */
++ "LEN0093", /* T480 */
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN200f", /* T450s */
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 65ab2c80529c..ee30e8965d1b 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -740,32 +740,43 @@ static void its_flush_cmd(struct its_node *its, struct its_cmd_block *cmd)
+ }
+
+ static int its_wait_for_range_completion(struct its_node *its,
+- struct its_cmd_block *from,
++ u64 prev_idx,
+ struct its_cmd_block *to)
+ {
+- u64 rd_idx, from_idx, to_idx;
++ u64 rd_idx, to_idx, linear_idx;
+ u32 count = 1000000; /* 1s! */
+
+- from_idx = its_cmd_ptr_to_offset(its, from);
++ /* Linearize to_idx if the command set has wrapped around */
+ to_idx = its_cmd_ptr_to_offset(its, to);
++ if (to_idx < prev_idx)
++ to_idx += ITS_CMD_QUEUE_SZ;
++
++ linear_idx = prev_idx;
+
+ while (1) {
++ s64 delta;
++
+ rd_idx = readl_relaxed(its->base + GITS_CREADR);
+
+- /* Direct case */
+- if (from_idx < to_idx && rd_idx >= to_idx)
+- break;
++ /*
++ * Compute the read pointer progress, taking the
++ * potential wrap-around into account.
++ */
++ delta = rd_idx - prev_idx;
++ if (rd_idx < prev_idx)
++ delta += ITS_CMD_QUEUE_SZ;
+
+- /* Wrapped case */
+- if (from_idx >= to_idx && rd_idx >= to_idx && rd_idx < from_idx)
++ linear_idx += delta;
++ if (linear_idx >= to_idx)
+ break;
+
+ count--;
+ if (!count) {
+- pr_err_ratelimited("ITS queue timeout (%llu %llu %llu)\n",
+- from_idx, to_idx, rd_idx);
++ pr_err_ratelimited("ITS queue timeout (%llu %llu)\n",
++ to_idx, linear_idx);
+ return -1;
+ }
++ prev_idx = rd_idx;
+ cpu_relax();
+ udelay(1);
+ }
+@@ -782,6 +793,7 @@ void name(struct its_node *its, \
+ struct its_cmd_block *cmd, *sync_cmd, *next_cmd; \
+ synctype *sync_obj; \
+ unsigned long flags; \
++ u64 rd_idx; \
+ \
+ raw_spin_lock_irqsave(&its->lock, flags); \
+ \
+@@ -803,10 +815,11 @@ void name(struct its_node *its, \
+ } \
+ \
+ post: \
++ rd_idx = readl_relaxed(its->base + GITS_CREADR); \
+ next_cmd = its_post_commands(its); \
+ raw_spin_unlock_irqrestore(&its->lock, flags); \
+ \
+- if (its_wait_for_range_completion(its, cmd, next_cmd)) \
++ if (its_wait_for_range_completion(its, rd_idx, next_cmd)) \
+ pr_err_ratelimited("ITS cmd %ps failed\n", builder); \
+ }
+
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index c7fe4789c40e..34ab30dd5de9 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -562,7 +562,7 @@ static char **realloc_argv(unsigned *size, char **old_argv)
+ gfp = GFP_NOIO;
+ }
+ argv = kmalloc_array(new_size, sizeof(*argv), gfp);
+- if (argv) {
++ if (argv && old_argv) {
+ memcpy(argv, old_argv, *size * sizeof(*argv));
+ *size = new_size;
+ }
+diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
+index fc65f0dedf7f..e3599b43f9eb 100644
+--- a/drivers/md/dm-verity-target.c
++++ b/drivers/md/dm-verity-target.c
+@@ -236,8 +236,8 @@ static int verity_handle_err(struct dm_verity *v, enum verity_block_type type,
+ BUG();
+ }
+
+- DMERR("%s: %s block %llu is corrupted", v->data_dev->name, type_str,
+- block);
++ DMERR_LIMIT("%s: %s block %llu is corrupted", v->data_dev->name,
++ type_str, block);
+
+ if (v->corrupted_errs == DM_VERITY_MAX_CORRUPTED_ERRS)
+ DMERR("%s: reached maximum errors", v->data_dev->name);
+diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c
+index bfb16a474490..d1905d50c26c 100644
+--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c
++++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c
+@@ -895,7 +895,7 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test,
+ u64 *data)
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+- int status;
++ int status, cnt;
+ u8 link_status = 0;
+
+ if (adapter->function_caps & BE_FUNCTION_CAPS_SUPER_NIC) {
+@@ -906,6 +906,9 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test,
+
+ memset(data, 0, sizeof(u64) * ETHTOOL_TESTS_NUM);
+
++ /* check link status before offline tests */
++ link_status = netif_carrier_ok(netdev);
++
+ if (test->flags & ETH_TEST_FL_OFFLINE) {
+ if (be_loopback_test(adapter, BE_MAC_LOOPBACK, &data[0]) != 0)
+ test->flags |= ETH_TEST_FL_FAILED;
+@@ -926,13 +929,26 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test,
+ test->flags |= ETH_TEST_FL_FAILED;
+ }
+
+- status = be_cmd_link_status_query(adapter, NULL, &link_status, 0);
+- if (status) {
+- test->flags |= ETH_TEST_FL_FAILED;
+- data[4] = -1;
+- } else if (!link_status) {
++ /* link status was down prior to test */
++ if (!link_status) {
+ test->flags |= ETH_TEST_FL_FAILED;
+ data[4] = 1;
++ return;
++ }
++
++ for (cnt = 10; cnt; cnt--) {
++ status = be_cmd_link_status_query(adapter, NULL, &link_status,
++ 0);
++ if (status) {
++ test->flags |= ETH_TEST_FL_FAILED;
++ data[4] = -1;
++ break;
++ }
++
++ if (link_status)
++ break;
++
++ msleep_interruptible(500);
+ }
+ }
+
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 8cd339c92c1a..a7b5a47ab83d 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -4208,7 +4208,7 @@ void e1000e_up(struct e1000_adapter *adapter)
+ e1000_configure_msix(adapter);
+ e1000_irq_enable(adapter);
+
+- netif_start_queue(adapter->netdev);
++ /* Tx queue started by watchdog timer when link is up */
+
+ e1000e_trigger_lsc(adapter);
+ }
+@@ -4584,6 +4584,7 @@ int e1000e_open(struct net_device *netdev)
+ pm_runtime_get_sync(&pdev->dev);
+
+ netif_carrier_off(netdev);
++ netif_stop_queue(netdev);
+
+ /* allocate transmit descriptors */
+ err = e1000e_setup_tx_resources(adapter->tx_ring);
+@@ -4644,7 +4645,6 @@ int e1000e_open(struct net_device *netdev)
+ e1000_irq_enable(adapter);
+
+ adapter->tx_hang_recheck = false;
+- netif_start_queue(netdev);
+
+ hw->mac.get_link_status = true;
+ pm_runtime_put(&pdev->dev);
+@@ -5266,6 +5266,7 @@ static void e1000_watchdog_task(struct work_struct *work)
+ if (phy->ops.cfg_on_link_up)
+ phy->ops.cfg_on_link_up(hw);
+
++ netif_wake_queue(netdev);
+ netif_carrier_on(netdev);
+
+ if (!test_bit(__E1000_DOWN, &adapter->state))
+@@ -5279,6 +5280,7 @@ static void e1000_watchdog_task(struct work_struct *work)
+ /* Link status message must follow this format */
+ pr_info("%s NIC Link is Down\n", adapter->netdev->name);
+ netif_carrier_off(netdev);
++ netif_stop_queue(netdev);
+ if (!test_bit(__E1000_DOWN, &adapter->state))
+ mod_timer(&adapter->phy_info_timer,
+ round_jiffies(jiffies + 2 * HZ));
+@@ -5286,13 +5288,8 @@ static void e1000_watchdog_task(struct work_struct *work)
+ /* 8000ES2LAN requires a Rx packet buffer work-around
+ * on link down event; reset the controller to flush
+ * the Rx packet buffer.
+- *
+- * If the link is lost the controller stops DMA, but
+- * if there is queued Tx work it cannot be done. So
+- * reset the controller to flush the Tx packet buffers.
+ */
+- if ((adapter->flags & FLAG_RX_NEEDS_RESTART) ||
+- e1000_desc_unused(tx_ring) + 1 < tx_ring->count)
++ if (adapter->flags & FLAG_RX_NEEDS_RESTART)
+ adapter->flags |= FLAG_RESTART_NOW;
+ else
+ pm_schedule_suspend(netdev->dev.parent,
+@@ -5315,6 +5312,14 @@ link_up:
+ adapter->gotc_old = adapter->stats.gotc;
+ spin_unlock(&adapter->stats64_lock);
+
++ /* If the link is lost the controller stops DMA, but
++ * if there is queued Tx work it cannot be done. So
++ * reset the controller to flush the Tx packet buffers.
++ */
++ if (!netif_carrier_ok(netdev) &&
++ (e1000_desc_unused(tx_ring) + 1 < tx_ring->count))
++ adapter->flags |= FLAG_RESTART_NOW;
++
+ /* If reset is necessary, do it outside of interrupt context. */
+ if (adapter->flags & FLAG_RESTART_NOW) {
+ schedule_work(&adapter->reset_task);
+diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c
+index 4bb89f74742c..d5bcbc40a55f 100644
+--- a/drivers/net/ethernet/sis/sis900.c
++++ b/drivers/net/ethernet/sis/sis900.c
+@@ -1057,7 +1057,7 @@ sis900_open(struct net_device *net_dev)
+ sis900_set_mode(sis_priv, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED);
+
+ /* Enable all known interrupts by setting the interrupt mask. */
+- sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
++ sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
+ sw32(cr, RxENA | sr32(cr));
+ sw32(ier, IE);
+
+@@ -1578,7 +1578,7 @@ static void sis900_tx_timeout(struct net_device *net_dev)
+ sw32(txdp, sis_priv->tx_ring_dma);
+
+ /* Enable all known interrupts by setting the interrupt mask. */
+- sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
++ sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
+ }
+
+ /**
+@@ -1618,7 +1618,7 @@ sis900_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ spin_unlock_irqrestore(&sis_priv->lock, flags);
+ return NETDEV_TX_OK;
+ }
+- sis_priv->tx_ring[entry].cmdsts = (OWN | skb->len);
++ sis_priv->tx_ring[entry].cmdsts = (OWN | INTR | skb->len);
+ sw32(cr, TxENA | sr32(cr));
+
+ sis_priv->cur_tx ++;
+@@ -1674,7 +1674,7 @@ static irqreturn_t sis900_interrupt(int irq, void *dev_instance)
+ do {
+ status = sr32(isr);
+
+- if ((status & (HIBERR|TxURN|TxERR|TxIDLE|RxORN|RxERR|RxOK)) == 0)
++ if ((status & (HIBERR|TxURN|TxERR|TxIDLE|TxDESC|RxORN|RxERR|RxOK)) == 0)
+ /* nothing intresting happened */
+ break;
+ handled = 1;
+@@ -1684,7 +1684,7 @@ static irqreturn_t sis900_interrupt(int irq, void *dev_instance)
+ /* Rx interrupt */
+ sis900_rx(net_dev);
+
+- if (status & (TxURN | TxERR | TxIDLE))
++ if (status & (TxURN | TxERR | TxIDLE | TxDESC))
+ /* Tx interrupt */
+ sis900_finish_xmit(net_dev);
+
+@@ -1896,8 +1896,8 @@ static void sis900_finish_xmit (struct net_device *net_dev)
+
+ if (tx_status & OWN) {
+ /* The packet is not transmitted yet (owned by hardware) !
+- * Note: the interrupt is generated only when Tx Machine
+- * is idle, so this is an almost impossible case */
++ * Note: this is an almost impossible condition
++ * in case of TxDESC ('descriptor interrupt') */
+ break;
+ }
+
+@@ -2473,7 +2473,7 @@ static int sis900_resume(struct pci_dev *pci_dev)
+ sis900_set_mode(sis_priv, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED);
+
+ /* Enable all known interrupts by setting the interrupt mask. */
+- sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
++ sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
+ sw32(cr, RxENA | sr32(cr));
+ sw32(ier, IE);
+
+diff --git a/drivers/net/ppp/ppp_mppe.c b/drivers/net/ppp/ppp_mppe.c
+index a205750b431b..8609c1a0777b 100644
+--- a/drivers/net/ppp/ppp_mppe.c
++++ b/drivers/net/ppp/ppp_mppe.c
+@@ -63,6 +63,7 @@ MODULE_AUTHOR("Frank Cusack <fcusack@fcusack.com>");
+ MODULE_DESCRIPTION("Point-to-Point Protocol Microsoft Point-to-Point Encryption support");
+ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_ALIAS("ppp-compress-" __stringify(CI_MPPE));
++MODULE_SOFTDEP("pre: arc4");
+ MODULE_VERSION("1.0.2");
+
+ static unsigned int
+diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
+index a613e546717a..564cfaee129d 100644
+--- a/drivers/pinctrl/mediatek/mtk-eint.c
++++ b/drivers/pinctrl/mediatek/mtk-eint.c
+@@ -113,6 +113,8 @@ static void mtk_eint_mask(struct irq_data *d)
+ void __iomem *reg = mtk_eint_get_offset(eint, d->hwirq,
+ eint->regs->mask_set);
+
++ eint->cur_mask[d->hwirq >> 5] &= ~mask;
++
+ writel(mask, reg);
+ }
+
+@@ -123,6 +125,8 @@ static void mtk_eint_unmask(struct irq_data *d)
+ void __iomem *reg = mtk_eint_get_offset(eint, d->hwirq,
+ eint->regs->mask_clr);
+
++ eint->cur_mask[d->hwirq >> 5] |= mask;
++
+ writel(mask, reg);
+
+ if (eint->dual_edge[d->hwirq])
+@@ -217,19 +221,6 @@ static void mtk_eint_chip_write_mask(const struct mtk_eint *eint,
+ }
+ }
+
+-static void mtk_eint_chip_read_mask(const struct mtk_eint *eint,
+- void __iomem *base, u32 *buf)
+-{
+- int port;
+- void __iomem *reg;
+-
+- for (port = 0; port < eint->hw->ports; port++) {
+- reg = base + eint->regs->mask + (port << 2);
+- buf[port] = ~readl_relaxed(reg);
+- /* Mask is 0 when irq is enabled, and 1 when disabled. */
+- }
+-}
+-
+ static int mtk_eint_irq_request_resources(struct irq_data *d)
+ {
+ struct mtk_eint *eint = irq_data_get_irq_chip_data(d);
+@@ -318,7 +309,7 @@ static void mtk_eint_irq_handler(struct irq_desc *desc)
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+ struct mtk_eint *eint = irq_desc_get_handler_data(desc);
+ unsigned int status, eint_num;
+- int offset, index, virq;
++ int offset, mask_offset, index, virq;
+ void __iomem *reg = mtk_eint_get_offset(eint, 0, eint->regs->stat);
+ int dual_edge, start_level, curr_level;
+
+@@ -328,10 +319,24 @@ static void mtk_eint_irq_handler(struct irq_desc *desc)
+ status = readl(reg);
+ while (status) {
+ offset = __ffs(status);
++ mask_offset = eint_num >> 5;
+ index = eint_num + offset;
+ virq = irq_find_mapping(eint->domain, index);
+ status &= ~BIT(offset);
+
++ /*
++ * If we get an interrupt on pin that was only required
++ * for wake (but no real interrupt requested), mask the
++ * interrupt (as would mtk_eint_resume do anyway later
++ * in the resume sequence).
++ */
++ if (eint->wake_mask[mask_offset] & BIT(offset) &&
++ !(eint->cur_mask[mask_offset] & BIT(offset))) {
++ writel_relaxed(BIT(offset), reg -
++ eint->regs->stat +
++ eint->regs->mask_set);
++ }
++
+ dual_edge = eint->dual_edge[index];
+ if (dual_edge) {
+ /*
+@@ -370,7 +375,6 @@ static void mtk_eint_irq_handler(struct irq_desc *desc)
+
+ int mtk_eint_do_suspend(struct mtk_eint *eint)
+ {
+- mtk_eint_chip_read_mask(eint, eint->base, eint->cur_mask);
+ mtk_eint_chip_write_mask(eint, eint->base, eint->wake_mask);
+
+ return 0;
+diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
+index cecbce21d01f..33c3eca0ece9 100644
+--- a/drivers/pinctrl/pinctrl-mcp23s08.c
++++ b/drivers/pinctrl/pinctrl-mcp23s08.c
+@@ -889,6 +889,10 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
+ if (ret < 0)
+ goto fail;
+
++ ret = devm_gpiochip_add_data(dev, &mcp->chip, mcp);
++ if (ret < 0)
++ goto fail;
++
+ mcp->irq_controller =
+ device_property_read_bool(dev, "interrupt-controller");
+ if (mcp->irq && mcp->irq_controller) {
+@@ -930,10 +934,6 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
+ goto fail;
+ }
+
+- ret = devm_gpiochip_add_data(dev, &mcp->chip, mcp);
+- if (ret < 0)
+- goto fail;
+-
+ if (one_regmap_config) {
+ mcp->pinctrl_desc.name = devm_kasprintf(dev, GFP_KERNEL,
+ "mcp23xxx-pinctrl.%d", raw_chip_address);
+diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
+index 78f1be41b05e..034528a5453e 100644
+--- a/drivers/s390/cio/qdio_setup.c
++++ b/drivers/s390/cio/qdio_setup.c
+@@ -151,6 +151,7 @@ static int __qdio_allocate_qs(struct qdio_q **irq_ptr_qs, int nr_queues)
+ return -ENOMEM;
+ }
+ irq_ptr_qs[i] = q;
++ INIT_LIST_HEAD(&q->entry);
+ }
+ return 0;
+ }
+@@ -179,6 +180,7 @@ static void setup_queues_misc(struct qdio_q *q, struct qdio_irq *irq_ptr,
+ q->mask = 1 << (31 - i);
+ q->nr = i;
+ q->handler = handler;
++ INIT_LIST_HEAD(&q->entry);
+ }
+
+ static void setup_storage_lists(struct qdio_q *q, struct qdio_irq *irq_ptr,
+diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
+index 07dea602205b..6628e0c9e70e 100644
+--- a/drivers/s390/cio/qdio_thinint.c
++++ b/drivers/s390/cio/qdio_thinint.c
+@@ -79,7 +79,6 @@ void tiqdio_add_input_queues(struct qdio_irq *irq_ptr)
+ mutex_lock(&tiq_list_lock);
+ list_add_rcu(&irq_ptr->input_qs[0]->entry, &tiq_list);
+ mutex_unlock(&tiq_list_lock);
+- xchg(irq_ptr->dsci, 1 << 7);
+ }
+
+ void tiqdio_remove_input_queues(struct qdio_irq *irq_ptr)
+@@ -87,14 +86,14 @@ void tiqdio_remove_input_queues(struct qdio_irq *irq_ptr)
+ struct qdio_q *q;
+
+ q = irq_ptr->input_qs[0];
+- /* if establish triggered an error */
+- if (!q || !q->entry.prev || !q->entry.next)
++ if (!q)
+ return;
+
+ mutex_lock(&tiq_list_lock);
+ list_del_rcu(&q->entry);
+ mutex_unlock(&tiq_list_lock);
+ synchronize_rcu();
++ INIT_LIST_HEAD(&q->entry);
+ }
+
+ static inline int has_multiple_inq_on_dsci(struct qdio_irq *irq_ptr)
+diff --git a/fs/afs/callback.c b/fs/afs/callback.c
+index 5f261fbf2182..4ad701250299 100644
+--- a/fs/afs/callback.c
++++ b/fs/afs/callback.c
+@@ -276,9 +276,9 @@ static void afs_break_one_callback(struct afs_server *server,
+ struct afs_super_info *as = AFS_FS_S(cbi->sb);
+ struct afs_volume *volume = as->volume;
+
+- write_lock(&volume->cb_break_lock);
++ write_lock(&volume->cb_v_break_lock);
+ volume->cb_v_break++;
+- write_unlock(&volume->cb_break_lock);
++ write_unlock(&volume->cb_v_break_lock);
+ } else {
+ data.volume = NULL;
+ data.fid = *fid;
+diff --git a/fs/afs/internal.h b/fs/afs/internal.h
+index 34c02fdcc25f..aea19614c082 100644
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -477,7 +477,7 @@ struct afs_volume {
+ unsigned int servers_seq; /* Incremented each time ->servers changes */
+
+ unsigned cb_v_break; /* Break-everything counter. */
+- rwlock_t cb_break_lock;
++ rwlock_t cb_v_break_lock;
+
+ afs_voltype_t type; /* type of volume */
+ short error;
+diff --git a/fs/afs/volume.c b/fs/afs/volume.c
+index 3037bd01f617..5ec186ec5651 100644
+--- a/fs/afs/volume.c
++++ b/fs/afs/volume.c
+@@ -47,6 +47,7 @@ static struct afs_volume *afs_alloc_volume(struct afs_mount_params *params,
+ atomic_set(&volume->usage, 1);
+ INIT_LIST_HEAD(&volume->proc_link);
+ rwlock_init(&volume->servers_lock);
++ rwlock_init(&volume->cb_v_break_lock);
+ memcpy(volume->name, vldb->name, vldb->name_len + 1);
+
+ slist = afs_alloc_server_list(params->cell, params->key, vldb, type_mask);
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index d64d8c2bbdab..dec0372efe2e 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -170,6 +170,7 @@ enum cpuhp_state {
+ CPUHP_AP_WATCHDOG_ONLINE,
+ CPUHP_AP_WORKQUEUE_ONLINE,
+ CPUHP_AP_RCUTREE_ONLINE,
++ CPUHP_AP_BASE_CACHEINFO_ONLINE,
+ CPUHP_AP_ONLINE_DYN,
+ CPUHP_AP_ONLINE_DYN_END = CPUHP_AP_ONLINE_DYN + 30,
+ CPUHP_AP_X86_HPET_ONLINE,
+diff --git a/include/linux/kernel.h b/include/linux/kernel.h
+index 3d83ebb302cf..f6f94e54ab96 100644
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -118,7 +118,8 @@
+ #define DIV_ROUND_DOWN_ULL(ll, d) \
+ ({ unsigned long long _tmp = (ll); do_div(_tmp, d); _tmp; })
+
+-#define DIV_ROUND_UP_ULL(ll, d) DIV_ROUND_DOWN_ULL((ll) + (d) - 1, (d))
++#define DIV_ROUND_UP_ULL(ll, d) \
++ DIV_ROUND_DOWN_ULL((unsigned long long)(ll) + (d) - 1, (d))
+
+ #if BITS_PER_LONG == 32
+ # define DIV_ROUND_UP_SECTOR_T(ll,d) DIV_ROUND_UP_ULL(ll, d)
+diff --git a/include/uapi/linux/nilfs2_ondisk.h b/include/uapi/linux/nilfs2_ondisk.h
+index a7e66ab11d1d..c23f91ae5fe8 100644
+--- a/include/uapi/linux/nilfs2_ondisk.h
++++ b/include/uapi/linux/nilfs2_ondisk.h
+@@ -29,7 +29,7 @@
+
+ #include <linux/types.h>
+ #include <linux/magic.h>
+-
++#include <asm/byteorder.h>
+
+ #define NILFS_INODE_BMAP_SIZE 7
+
+@@ -533,19 +533,19 @@ enum {
+ static inline void \
+ nilfs_checkpoint_set_##name(struct nilfs_checkpoint *cp) \
+ { \
+- cp->cp_flags = cpu_to_le32(le32_to_cpu(cp->cp_flags) | \
+- (1UL << NILFS_CHECKPOINT_##flag)); \
++ cp->cp_flags = __cpu_to_le32(__le32_to_cpu(cp->cp_flags) | \
++ (1UL << NILFS_CHECKPOINT_##flag)); \
+ } \
+ static inline void \
+ nilfs_checkpoint_clear_##name(struct nilfs_checkpoint *cp) \
+ { \
+- cp->cp_flags = cpu_to_le32(le32_to_cpu(cp->cp_flags) & \
++ cp->cp_flags = __cpu_to_le32(__le32_to_cpu(cp->cp_flags) & \
+ ~(1UL << NILFS_CHECKPOINT_##flag)); \
+ } \
+ static inline int \
+ nilfs_checkpoint_##name(const struct nilfs_checkpoint *cp) \
+ { \
+- return !!(le32_to_cpu(cp->cp_flags) & \
++ return !!(__le32_to_cpu(cp->cp_flags) & \
+ (1UL << NILFS_CHECKPOINT_##flag)); \
+ }
+
+@@ -595,20 +595,20 @@ enum {
+ static inline void \
+ nilfs_segment_usage_set_##name(struct nilfs_segment_usage *su) \
+ { \
+- su->su_flags = cpu_to_le32(le32_to_cpu(su->su_flags) | \
++ su->su_flags = __cpu_to_le32(__le32_to_cpu(su->su_flags) | \
+ (1UL << NILFS_SEGMENT_USAGE_##flag));\
+ } \
+ static inline void \
+ nilfs_segment_usage_clear_##name(struct nilfs_segment_usage *su) \
+ { \
+ su->su_flags = \
+- cpu_to_le32(le32_to_cpu(su->su_flags) & \
++ __cpu_to_le32(__le32_to_cpu(su->su_flags) & \
+ ~(1UL << NILFS_SEGMENT_USAGE_##flag)); \
+ } \
+ static inline int \
+ nilfs_segment_usage_##name(const struct nilfs_segment_usage *su) \
+ { \
+- return !!(le32_to_cpu(su->su_flags) & \
++ return !!(__le32_to_cpu(su->su_flags) & \
+ (1UL << NILFS_SEGMENT_USAGE_##flag)); \
+ }
+
+@@ -619,15 +619,15 @@ NILFS_SEGMENT_USAGE_FNS(ERROR, error)
+ static inline void
+ nilfs_segment_usage_set_clean(struct nilfs_segment_usage *su)
+ {
+- su->su_lastmod = cpu_to_le64(0);
+- su->su_nblocks = cpu_to_le32(0);
+- su->su_flags = cpu_to_le32(0);
++ su->su_lastmod = __cpu_to_le64(0);
++ su->su_nblocks = __cpu_to_le32(0);
++ su->su_flags = __cpu_to_le32(0);
+ }
+
+ static inline int
+ nilfs_segment_usage_clean(const struct nilfs_segment_usage *su)
+ {
+- return !le32_to_cpu(su->su_flags);
++ return !__le32_to_cpu(su->su_flags);
+ }
+
+ /**
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 46aefe5c0e35..d9f855cb9f6f 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -1925,6 +1925,9 @@ static ssize_t write_cpuhp_fail(struct device *dev,
+ if (ret)
+ return ret;
+
++ if (fail < CPUHP_OFFLINE || fail > CPUHP_ONLINE)
++ return -EINVAL;
++
+ /*
+ * Cannot fail STARTING/DYING callbacks.
+ */
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 171b83ebed4a..3b61ff40bfe2 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5906,7 +5906,7 @@ static void perf_sample_regs_user(struct perf_regs *regs_user,
+ if (user_mode(regs)) {
+ regs_user->abi = perf_reg_abi(current);
+ regs_user->regs = regs;
+- } else if (current->mm) {
++ } else if (!(current->flags & PF_KTHREAD)) {
+ perf_get_regs_user(regs_user, regs, regs_user_copy);
+ } else {
+ regs_user->abi = PERF_SAMPLE_REGS_ABI_NONE;
+diff --git a/kernel/irq/autoprobe.c b/kernel/irq/autoprobe.c
+index 16cbf6beb276..ae60cae24e9a 100644
+--- a/kernel/irq/autoprobe.c
++++ b/kernel/irq/autoprobe.c
+@@ -90,7 +90,7 @@ unsigned long probe_irq_on(void)
+ /* It triggered already - consider it spurious. */
+ if (!(desc->istate & IRQS_WAITING)) {
+ desc->istate &= ~IRQS_AUTODETECT;
+- irq_shutdown(desc);
++ irq_shutdown_and_deactivate(desc);
+ } else
+ if (i < 32)
+ mask |= 1 << i;
+@@ -127,7 +127,7 @@ unsigned int probe_irq_mask(unsigned long val)
+ mask |= 1 << i;
+
+ desc->istate &= ~IRQS_AUTODETECT;
+- irq_shutdown(desc);
++ irq_shutdown_and_deactivate(desc);
+ }
+ raw_spin_unlock_irq(&desc->lock);
+ }
+@@ -169,7 +169,7 @@ int probe_irq_off(unsigned long val)
+ nr_of_irqs++;
+ }
+ desc->istate &= ~IRQS_AUTODETECT;
+- irq_shutdown(desc);
++ irq_shutdown_and_deactivate(desc);
+ }
+ raw_spin_unlock_irq(&desc->lock);
+ }
+diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
+index 379e89c706c9..09d914e486a2 100644
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -314,6 +314,12 @@ void irq_shutdown(struct irq_desc *desc)
+ }
+ irq_state_clr_started(desc);
+ }
++}
++
++
++void irq_shutdown_and_deactivate(struct irq_desc *desc)
++{
++ irq_shutdown(desc);
+ /*
+ * This must be called even if the interrupt was never started up,
+ * because the activation can happen before the interrupt is
+diff --git a/kernel/irq/cpuhotplug.c b/kernel/irq/cpuhotplug.c
+index 5b1072e394b2..6c7ca2e983a5 100644
+--- a/kernel/irq/cpuhotplug.c
++++ b/kernel/irq/cpuhotplug.c
+@@ -116,7 +116,7 @@ static bool migrate_one_irq(struct irq_desc *desc)
+ */
+ if (irqd_affinity_is_managed(d)) {
+ irqd_set_managed_shutdown(d);
+- irq_shutdown(desc);
++ irq_shutdown_and_deactivate(desc);
+ return false;
+ }
+ affinity = cpu_online_mask;
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index e74e7eea76cf..ea57f3d397fe 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -80,6 +80,7 @@ extern int irq_activate_and_startup(struct irq_desc *desc, bool resend);
+ extern int irq_startup(struct irq_desc *desc, bool resend, bool force);
+
+ extern void irq_shutdown(struct irq_desc *desc);
++extern void irq_shutdown_and_deactivate(struct irq_desc *desc);
+ extern void irq_enable(struct irq_desc *desc);
+ extern void irq_disable(struct irq_desc *desc);
+ extern void irq_percpu_enable(struct irq_desc *desc, unsigned int cpu);
+@@ -94,6 +95,10 @@ static inline void irq_mark_irq(unsigned int irq) { }
+ extern void irq_mark_irq(unsigned int irq);
+ #endif
+
++extern int __irq_get_irqchip_state(struct irq_data *data,
++ enum irqchip_irq_state which,
++ bool *state);
++
+ extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
+
+ irqreturn_t __handle_irq_event_percpu(struct irq_desc *desc, unsigned int *flags);
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index cd4f9f3e8345..23bcfa71077f 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -13,6 +13,7 @@
+ #include <linux/module.h>
+ #include <linux/random.h>
+ #include <linux/interrupt.h>
++#include <linux/irqdomain.h>
+ #include <linux/slab.h>
+ #include <linux/sched.h>
+ #include <linux/sched/rt.h>
+@@ -34,8 +35,9 @@ static int __init setup_forced_irqthreads(char *arg)
+ early_param("threadirqs", setup_forced_irqthreads);
+ #endif
+
+-static void __synchronize_hardirq(struct irq_desc *desc)
++static void __synchronize_hardirq(struct irq_desc *desc, bool sync_chip)
+ {
++ struct irq_data *irqd = irq_desc_get_irq_data(desc);
+ bool inprogress;
+
+ do {
+@@ -51,6 +53,20 @@ static void __synchronize_hardirq(struct irq_desc *desc)
+ /* Ok, that indicated we're done: double-check carefully. */
+ raw_spin_lock_irqsave(&desc->lock, flags);
+ inprogress = irqd_irq_inprogress(&desc->irq_data);
++
++ /*
++ * If requested and supported, check at the chip whether it
++ * is in flight at the hardware level, i.e. already pending
++ * in a CPU and waiting for service and acknowledge.
++ */
++ if (!inprogress && sync_chip) {
++ /*
++ * Ignore the return code. inprogress is only updated
++ * when the chip supports it.
++ */
++ __irq_get_irqchip_state(irqd, IRQCHIP_STATE_ACTIVE,
++ &inprogress);
++ }
+ raw_spin_unlock_irqrestore(&desc->lock, flags);
+
+ /* Oops, that failed? */
+@@ -73,13 +89,18 @@ static void __synchronize_hardirq(struct irq_desc *desc)
+ * Returns: false if a threaded handler is active.
+ *
+ * This function may be called - with care - from IRQ context.
++ *
++ * It does not check whether there is an interrupt in flight at the
++ * hardware level, but not serviced yet, as this might deadlock when
++ * called with interrupts disabled and the target CPU of the interrupt
++ * is the current CPU.
+ */
+ bool synchronize_hardirq(unsigned int irq)
+ {
+ struct irq_desc *desc = irq_to_desc(irq);
+
+ if (desc) {
+- __synchronize_hardirq(desc);
++ __synchronize_hardirq(desc, false);
+ return !atomic_read(&desc->threads_active);
+ }
+
+@@ -95,14 +116,19 @@ EXPORT_SYMBOL(synchronize_hardirq);
+ * to complete before returning. If you use this function while
+ * holding a resource the IRQ handler may need you will deadlock.
+ *
+- * This function may be called - with care - from IRQ context.
++ * Can only be called from preemptible code as it might sleep when
++ * an interrupt thread is associated to @irq.
++ *
++ * It optionally makes sure (when the irq chip supports that method)
++ * that the interrupt is not pending in any CPU and waiting for
++ * service.
+ */
+ void synchronize_irq(unsigned int irq)
+ {
+ struct irq_desc *desc = irq_to_desc(irq);
+
+ if (desc) {
+- __synchronize_hardirq(desc);
++ __synchronize_hardirq(desc, true);
+ /*
+ * We made sure that no hardirq handler is
+ * running. Now verify that no threaded handlers are
+@@ -1619,6 +1645,7 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
+ /* If this was the last handler, shut down the IRQ line: */
+ if (!desc->action) {
+ irq_settings_clr_disable_unlazy(desc);
++ /* Only shutdown. Deactivate after synchronize_hardirq() */
+ irq_shutdown(desc);
+ }
+
+@@ -1647,8 +1674,12 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
+
+ unregister_handler_proc(irq, action);
+
+- /* Make sure it's not being used on another CPU: */
+- synchronize_hardirq(irq);
++ /*
++ * Make sure it's not being used on another CPU and if the chip
++ * supports it also make sure that there is no (not yet serviced)
++ * interrupt in flight at the hardware level.
++ */
++ __synchronize_hardirq(desc, true);
+
+ #ifdef CONFIG_DEBUG_SHIRQ
+ /*
+@@ -1688,6 +1719,14 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
+ * require it to deallocate resources over the slow bus.
+ */
+ chip_bus_lock(desc);
++ /*
++ * There is no interrupt on the fly anymore. Deactivate it
++ * completely.
++ */
++ raw_spin_lock_irqsave(&desc->lock, flags);
++ irq_domain_deactivate_irq(&desc->irq_data);
++ raw_spin_unlock_irqrestore(&desc->lock, flags);
++
+ irq_release_resources(desc);
+ chip_bus_sync_unlock(desc);
+ irq_remove_timings(desc);
+@@ -2173,6 +2212,28 @@ int __request_percpu_irq(unsigned int irq, irq_handler_t handler,
+ }
+ EXPORT_SYMBOL_GPL(__request_percpu_irq);
+
++int __irq_get_irqchip_state(struct irq_data *data, enum irqchip_irq_state which,
++ bool *state)
++{
++ struct irq_chip *chip;
++ int err = -EINVAL;
++
++ do {
++ chip = irq_data_get_irq_chip(data);
++ if (chip->irq_get_irqchip_state)
++ break;
++#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY
++ data = data->parent_data;
++#else
++ data = NULL;
++#endif
++ } while (data);
++
++ if (data)
++ err = chip->irq_get_irqchip_state(data, which, state);
++ return err;
++}
++
+ /**
+ * irq_get_irqchip_state - returns the irqchip state of a interrupt.
+ * @irq: Interrupt line that is forwarded to a VM
+@@ -2191,7 +2252,6 @@ int irq_get_irqchip_state(unsigned int irq, enum irqchip_irq_state which,
+ {
+ struct irq_desc *desc;
+ struct irq_data *data;
+- struct irq_chip *chip;
+ unsigned long flags;
+ int err = -EINVAL;
+
+@@ -2201,19 +2261,7 @@ int irq_get_irqchip_state(unsigned int irq, enum irqchip_irq_state which,
+
+ data = irq_desc_get_irq_data(desc);
+
+- do {
+- chip = irq_data_get_irq_chip(data);
+- if (chip->irq_get_irqchip_state)
+- break;
+-#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY
+- data = data->parent_data;
+-#else
+- data = NULL;
+-#endif
+- } while (data);
+-
+- if (data)
+- err = chip->irq_get_irqchip_state(data, which, state);
++ err = __irq_get_irqchip_state(data, which, state);
+
+ irq_put_desc_busunlock(desc, flags);
+ return err;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-07-26 11:35 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-07-26 11:35 UTC (permalink / raw
To: gentoo-commits
commit: f5cd317d2f252380859bd6dd8a01b3dc807e1ea2
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jul 26 11:35:22 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jul 26 11:35:22 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f5cd317d
Linux patch 4.19.61
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1060_linux-4.19.61.patch | 13172 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 13176 insertions(+)
diff --git a/0000_README b/0000_README
index 5333820..301b6bf 100644
--- a/0000_README
+++ b/0000_README
@@ -283,6 +283,10 @@ Patch: 1059_linux-4.19.60.patch
From: https://www.kernel.org
Desc: Linux 4.19.60
+Patch: 1060-4.19.61.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.61
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1060_linux-4.19.61.patch b/1060_linux-4.19.61.patch
new file mode 100644
index 0000000..42656b7
--- /dev/null
+++ b/1060_linux-4.19.61.patch
@@ -0,0 +1,13172 @@
+diff --git a/Documentation/atomic_t.txt b/Documentation/atomic_t.txt
+index 913396ac5824..ed0d814df7e0 100644
+--- a/Documentation/atomic_t.txt
++++ b/Documentation/atomic_t.txt
+@@ -177,6 +177,9 @@ These helper barriers exist because architectures have varying implicit
+ ordering on their SMP atomic primitives. For example our TSO architectures
+ provide full ordered atomics and these barriers are no-ops.
+
++NOTE: when the atomic RmW ops are fully ordered, they should also imply a
++compiler barrier.
++
+ Thus:
+
+ atomic_fetch_add();
+diff --git a/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt b/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
+index 42cd81090a2c..3f3cfc1d8d4d 100644
+--- a/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
++++ b/Documentation/devicetree/bindings/net/marvell-orion-mdio.txt
+@@ -16,7 +16,7 @@ Required properties:
+
+ Optional properties:
+ - interrupts: interrupt line number for the SMI error/done interrupt
+-- clocks: phandle for up to three required clocks for the MDIO instance
++- clocks: phandle for up to four required clocks for the MDIO instance
+
+ The child nodes of the MDIO driver are the individual PHY devices
+ connected to this MDIO bus. They must have a "reg" property given the
+diff --git a/Documentation/scheduler/sched-pelt.c b/Documentation/scheduler/sched-pelt.c
+index e4219139386a..7238b355919c 100644
+--- a/Documentation/scheduler/sched-pelt.c
++++ b/Documentation/scheduler/sched-pelt.c
+@@ -20,7 +20,8 @@ void calc_runnable_avg_yN_inv(void)
+ int i;
+ unsigned int x;
+
+- printf("static const u32 runnable_avg_yN_inv[] = {");
++ /* To silence -Wunused-but-set-variable warnings. */
++ printf("static const u32 runnable_avg_yN_inv[] __maybe_unused = {");
+ for (i = 0; i < HALFLIFE; i++) {
+ x = ((1UL<<32)-1)*pow(y, i);
+
+diff --git a/Makefile b/Makefile
+index 5fb79d493012..b16485c580d7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 60
++SUBLEVEL = 61
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 8790a29d0af4..e3ebece79617 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -251,7 +251,8 @@ config GENERIC_CALIBRATE_DELAY
+ def_bool y
+
+ config ZONE_DMA32
+- def_bool y
++ bool "Support DMA32 zone" if EXPERT
++ default y
+
+ config HAVE_GENERIC_GUP
+ def_bool y
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+index 212e6634c9ba..7398ae8856dc 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+@@ -330,7 +330,8 @@
+ regulator-max-microvolt = <1320000>;
+ enable-gpios = <&pmic 6 GPIO_ACTIVE_HIGH>;
+ regulator-ramp-delay = <80>;
+- regulator-enable-ramp-delay = <1000>;
++ regulator-enable-ramp-delay = <2000>;
++ regulator-settling-time-us = <160>;
+ };
+ };
+ };
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210.dtsi b/arch/arm64/boot/dts/nvidia/tegra210.dtsi
+index 3be920efee82..6597c0894137 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210.dtsi
+@@ -1119,7 +1119,7 @@
+ compatible = "nvidia,tegra210-agic";
+ #interrupt-cells = <3>;
+ interrupt-controller;
+- reg = <0x702f9000 0x2000>,
++ reg = <0x702f9000 0x1000>,
+ <0x702fa000 0x2000>;
+ interrupts = <GIC_SPI 102 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+ clocks = <&tegra_car TEGRA210_CLK_APE>;
+diff --git a/arch/arm64/crypto/sha1-ce-glue.c b/arch/arm64/crypto/sha1-ce-glue.c
+index 17fac2889f56..d8c521c757e8 100644
+--- a/arch/arm64/crypto/sha1-ce-glue.c
++++ b/arch/arm64/crypto/sha1-ce-glue.c
+@@ -54,7 +54,7 @@ static int sha1_ce_finup(struct shash_desc *desc, const u8 *data,
+ unsigned int len, u8 *out)
+ {
+ struct sha1_ce_state *sctx = shash_desc_ctx(desc);
+- bool finalize = !sctx->sst.count && !(len % SHA1_BLOCK_SIZE);
++ bool finalize = !sctx->sst.count && !(len % SHA1_BLOCK_SIZE) && len;
+
+ if (!may_use_simd())
+ return crypto_sha1_finup(desc, data, len, out);
+diff --git a/arch/arm64/crypto/sha2-ce-glue.c b/arch/arm64/crypto/sha2-ce-glue.c
+index 261f5195cab7..c47d1a28ff6b 100644
+--- a/arch/arm64/crypto/sha2-ce-glue.c
++++ b/arch/arm64/crypto/sha2-ce-glue.c
+@@ -59,7 +59,7 @@ static int sha256_ce_finup(struct shash_desc *desc, const u8 *data,
+ unsigned int len, u8 *out)
+ {
+ struct sha256_ce_state *sctx = shash_desc_ctx(desc);
+- bool finalize = !sctx->sst.count && !(len % SHA256_BLOCK_SIZE);
++ bool finalize = !sctx->sst.count && !(len % SHA256_BLOCK_SIZE) && len;
+
+ if (!may_use_simd()) {
+ if (len)
+diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c
+index ed46dc188b22..970f15c76bac 100644
+--- a/arch/arm64/kernel/acpi.c
++++ b/arch/arm64/kernel/acpi.c
+@@ -154,10 +154,14 @@ static int __init acpi_fadt_sanity_check(void)
+ */
+ if (table->revision < 5 ||
+ (table->revision == 5 && fadt->minor_revision < 1)) {
+- pr_err("Unsupported FADT revision %d.%d, should be 5.1+\n",
++ pr_err(FW_BUG "Unsupported FADT revision %d.%d, should be 5.1+\n",
+ table->revision, fadt->minor_revision);
+- ret = -EINVAL;
+- goto out;
++
++ if (!fadt->arm_boot_flags) {
++ ret = -EINVAL;
++ goto out;
++ }
++ pr_err("FADT has ARM boot flags set, assuming 5.1\n");
+ }
+
+ if (!(fadt->flags & ACPI_FADT_HW_REDUCED)) {
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 8556876c9109..5f800384cb9a 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -824,7 +824,7 @@ el0_dbg:
+ mov x1, x25
+ mov x2, sp
+ bl do_debug_exception
+- enable_daif
++ enable_da_f
+ ct_user_exit
+ b ret_to_user
+ el0_inv:
+@@ -876,7 +876,7 @@ el0_error_naked:
+ enable_dbg
+ mov x0, sp
+ bl do_serror
+- enable_daif
++ enable_da_f
+ ct_user_exit
+ b ret_to_user
+ ENDPROC(el0_error)
+diff --git a/arch/arm64/kernel/image.h b/arch/arm64/kernel/image.h
+index 8da289dc843a..eff6a564ab80 100644
+--- a/arch/arm64/kernel/image.h
++++ b/arch/arm64/kernel/image.h
+@@ -73,7 +73,11 @@
+
+ #ifdef CONFIG_EFI
+
+-__efistub_stext_offset = stext - _text;
++/*
++ * Use ABSOLUTE() to avoid ld.lld treating this as a relative symbol:
++ * https://github.com/ClangBuiltLinux/linux/issues/561
++ */
++__efistub_stext_offset = ABSOLUTE(stext - _text);
+
+ /*
+ * The EFI stub has its own symbol namespace prefixed by __efistub_, to
+diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
+index 774c3e17c798..29d2f425806e 100644
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -233,8 +233,9 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max)
+ {
+ unsigned long max_zone_pfns[MAX_NR_ZONES] = {0};
+
+- if (IS_ENABLED(CONFIG_ZONE_DMA32))
+- max_zone_pfns[ZONE_DMA32] = PFN_DOWN(max_zone_dma_phys());
++#ifdef CONFIG_ZONE_DMA32
++ max_zone_pfns[ZONE_DMA32] = PFN_DOWN(max_zone_dma_phys());
++#endif
+ max_zone_pfns[ZONE_NORMAL] = max;
+
+ free_area_init_nodes(max_zone_pfns);
+diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
+index 3c453a1f1ff1..172801ed35b8 100644
+--- a/arch/mips/boot/compressed/Makefile
++++ b/arch/mips/boot/compressed/Makefile
+@@ -78,6 +78,8 @@ OBJCOPYFLAGS_piggy.o := --add-section=.image=$(obj)/vmlinux.bin.z \
+ $(obj)/piggy.o: $(obj)/dummy.o $(obj)/vmlinux.bin.z FORCE
+ $(call if_changed,objcopy)
+
++HOSTCFLAGS_calc_vmlinuz_load_addr.o += $(LINUXINCLUDE)
++
+ # Calculate the load address of the compressed kernel image
+ hostprogs-y := calc_vmlinuz_load_addr
+
+diff --git a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
+index 542c3ede9722..d14f75ec8273 100644
+--- a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
++++ b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
+@@ -13,7 +13,7 @@
+ #include <stdint.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+-#include "../../../../include/linux/sizes.h"
++#include <linux/sizes.h>
+
+ int main(int argc, char *argv[])
+ {
+diff --git a/arch/mips/include/asm/mach-ath79/ar933x_uart.h b/arch/mips/include/asm/mach-ath79/ar933x_uart.h
+index c2917b39966b..bba2c8837951 100644
+--- a/arch/mips/include/asm/mach-ath79/ar933x_uart.h
++++ b/arch/mips/include/asm/mach-ath79/ar933x_uart.h
+@@ -27,8 +27,8 @@
+ #define AR933X_UART_CS_PARITY_S 0
+ #define AR933X_UART_CS_PARITY_M 0x3
+ #define AR933X_UART_CS_PARITY_NONE 0
+-#define AR933X_UART_CS_PARITY_ODD 1
+-#define AR933X_UART_CS_PARITY_EVEN 2
++#define AR933X_UART_CS_PARITY_ODD 2
++#define AR933X_UART_CS_PARITY_EVEN 3
+ #define AR933X_UART_CS_IF_MODE_S 2
+ #define AR933X_UART_CS_IF_MODE_M 0x3
+ #define AR933X_UART_CS_IF_MODE_NONE 0
+diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
+index 0964c236e3e5..de2998cb189e 100644
+--- a/arch/parisc/kernel/ptrace.c
++++ b/arch/parisc/kernel/ptrace.c
+@@ -167,6 +167,9 @@ long arch_ptrace(struct task_struct *child, long request,
+ if ((addr & (sizeof(unsigned long)-1)) ||
+ addr >= sizeof(struct pt_regs))
+ break;
++ if (addr == PT_IAOQ0 || addr == PT_IAOQ1) {
++ data |= 3; /* ensure userspace privilege */
++ }
+ if ((addr >= PT_GR1 && addr <= PT_GR31) ||
+ addr == PT_IAOQ0 || addr == PT_IAOQ1 ||
+ (addr >= PT_FR0 && addr <= PT_FR31 + 4) ||
+@@ -228,16 +231,18 @@ long arch_ptrace(struct task_struct *child, long request,
+
+ static compat_ulong_t translate_usr_offset(compat_ulong_t offset)
+ {
+- if (offset < 0)
+- return sizeof(struct pt_regs);
+- else if (offset <= 32*4) /* gr[0..31] */
+- return offset * 2 + 4;
+- else if (offset <= 32*4+32*8) /* gr[0..31] + fr[0..31] */
+- return offset + 32*4;
+- else if (offset < sizeof(struct pt_regs)/2 + 32*4)
+- return offset * 2 + 4 - 32*8;
++ compat_ulong_t pos;
++
++ if (offset < 32*4) /* gr[0..31] */
++ pos = offset * 2 + 4;
++ else if (offset < 32*4+32*8) /* fr[0] ... fr[31] */
++ pos = (offset - 32*4) + PT_FR0;
++ else if (offset < sizeof(struct pt_regs)/2 + 32*4) /* sr[0] ... ipsw */
++ pos = (offset - 32*4 - 32*8) * 2 + PT_SR0 + 4;
+ else
+- return sizeof(struct pt_regs);
++ pos = sizeof(struct pt_regs);
++
++ return pos;
+ }
+
+ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+@@ -281,9 +286,12 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+ addr = translate_usr_offset(addr);
+ if (addr >= sizeof(struct pt_regs))
+ break;
++ if (addr == PT_IAOQ0+4 || addr == PT_IAOQ1+4) {
++ data |= 3; /* ensure userspace privilege */
++ }
+ if (addr >= PT_FR0 && addr <= PT_FR31 + 4) {
+ /* Special case, fp regs are 64 bits anyway */
+- *(__u64 *) ((char *) task_regs(child) + addr) = data;
++ *(__u32 *) ((char *) task_regs(child) + addr) = data;
+ ret = 0;
+ }
+ else if ((addr >= PT_GR1+4 && addr <= PT_GR31+4) ||
+@@ -496,7 +504,8 @@ static void set_reg(struct pt_regs *regs, int num, unsigned long val)
+ return;
+ case RI(iaoq[0]):
+ case RI(iaoq[1]):
+- regs->iaoq[num - RI(iaoq[0])] = val;
++ /* set 2 lowest bits to ensure userspace privilege: */
++ regs->iaoq[num - RI(iaoq[0])] = val | 3;
+ return;
+ case RI(sar): regs->sar = val;
+ return;
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 2d8fc8c9da7a..06cc77813dbb 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1745,7 +1745,7 @@ handle_page_fault:
+ addi r3,r1,STACK_FRAME_OVERHEAD
+ bl do_page_fault
+ cmpdi r3,0
+- beq+ 12f
++ beq+ ret_from_except_lite
+ bl save_nvgprs
+ mr r5,r3
+ addi r3,r1,STACK_FRAME_OVERHEAD
+@@ -1760,7 +1760,12 @@ handle_dabr_fault:
+ ld r5,_DSISR(r1)
+ addi r3,r1,STACK_FRAME_OVERHEAD
+ bl do_break
+-12: b ret_from_except_lite
++ /*
++ * do_break() may have changed the NV GPRS while handling a breakpoint.
++ * If so, we need to restore them with their updated values. Don't use
++ * ret_from_except_lite here.
++ */
++ b ret_from_except
+
+
+ #ifdef CONFIG_PPC_BOOK3S_64
+diff --git a/arch/powerpc/kernel/swsusp_32.S b/arch/powerpc/kernel/swsusp_32.S
+index 7a919e9a3400..cbdf86228eaa 100644
+--- a/arch/powerpc/kernel/swsusp_32.S
++++ b/arch/powerpc/kernel/swsusp_32.S
+@@ -25,11 +25,19 @@
+ #define SL_IBAT2 0x48
+ #define SL_DBAT3 0x50
+ #define SL_IBAT3 0x58
+-#define SL_TB 0x60
+-#define SL_R2 0x68
+-#define SL_CR 0x6c
+-#define SL_LR 0x70
+-#define SL_R12 0x74 /* r12 to r31 */
++#define SL_DBAT4 0x60
++#define SL_IBAT4 0x68
++#define SL_DBAT5 0x70
++#define SL_IBAT5 0x78
++#define SL_DBAT6 0x80
++#define SL_IBAT6 0x88
++#define SL_DBAT7 0x90
++#define SL_IBAT7 0x98
++#define SL_TB 0xa0
++#define SL_R2 0xa8
++#define SL_CR 0xac
++#define SL_LR 0xb0
++#define SL_R12 0xb4 /* r12 to r31 */
+ #define SL_SIZE (SL_R12 + 80)
+
+ .section .data
+@@ -114,6 +122,41 @@ _GLOBAL(swsusp_arch_suspend)
+ mfibatl r4,3
+ stw r4,SL_IBAT3+4(r11)
+
++BEGIN_MMU_FTR_SECTION
++ mfspr r4,SPRN_DBAT4U
++ stw r4,SL_DBAT4(r11)
++ mfspr r4,SPRN_DBAT4L
++ stw r4,SL_DBAT4+4(r11)
++ mfspr r4,SPRN_DBAT5U
++ stw r4,SL_DBAT5(r11)
++ mfspr r4,SPRN_DBAT5L
++ stw r4,SL_DBAT5+4(r11)
++ mfspr r4,SPRN_DBAT6U
++ stw r4,SL_DBAT6(r11)
++ mfspr r4,SPRN_DBAT6L
++ stw r4,SL_DBAT6+4(r11)
++ mfspr r4,SPRN_DBAT7U
++ stw r4,SL_DBAT7(r11)
++ mfspr r4,SPRN_DBAT7L
++ stw r4,SL_DBAT7+4(r11)
++ mfspr r4,SPRN_IBAT4U
++ stw r4,SL_IBAT4(r11)
++ mfspr r4,SPRN_IBAT4L
++ stw r4,SL_IBAT4+4(r11)
++ mfspr r4,SPRN_IBAT5U
++ stw r4,SL_IBAT5(r11)
++ mfspr r4,SPRN_IBAT5L
++ stw r4,SL_IBAT5+4(r11)
++ mfspr r4,SPRN_IBAT6U
++ stw r4,SL_IBAT6(r11)
++ mfspr r4,SPRN_IBAT6L
++ stw r4,SL_IBAT6+4(r11)
++ mfspr r4,SPRN_IBAT7U
++ stw r4,SL_IBAT7(r11)
++ mfspr r4,SPRN_IBAT7L
++ stw r4,SL_IBAT7+4(r11)
++END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
++
+ #if 0
+ /* Backup various CPU config stuffs */
+ bl __save_cpu_setup
+@@ -279,27 +322,41 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
+ mtibatu 3,r4
+ lwz r4,SL_IBAT3+4(r11)
+ mtibatl 3,r4
+-#endif
+-
+ BEGIN_MMU_FTR_SECTION
+- li r4,0
++ lwz r4,SL_DBAT4(r11)
+ mtspr SPRN_DBAT4U,r4
++ lwz r4,SL_DBAT4+4(r11)
+ mtspr SPRN_DBAT4L,r4
++ lwz r4,SL_DBAT5(r11)
+ mtspr SPRN_DBAT5U,r4
++ lwz r4,SL_DBAT5+4(r11)
+ mtspr SPRN_DBAT5L,r4
++ lwz r4,SL_DBAT6(r11)
+ mtspr SPRN_DBAT6U,r4
++ lwz r4,SL_DBAT6+4(r11)
+ mtspr SPRN_DBAT6L,r4
++ lwz r4,SL_DBAT7(r11)
+ mtspr SPRN_DBAT7U,r4
++ lwz r4,SL_DBAT7+4(r11)
+ mtspr SPRN_DBAT7L,r4
++ lwz r4,SL_IBAT4(r11)
+ mtspr SPRN_IBAT4U,r4
++ lwz r4,SL_IBAT4+4(r11)
+ mtspr SPRN_IBAT4L,r4
++ lwz r4,SL_IBAT5(r11)
+ mtspr SPRN_IBAT5U,r4
++ lwz r4,SL_IBAT5+4(r11)
+ mtspr SPRN_IBAT5L,r4
++ lwz r4,SL_IBAT6(r11)
+ mtspr SPRN_IBAT6U,r4
++ lwz r4,SL_IBAT6+4(r11)
+ mtspr SPRN_IBAT6L,r4
++ lwz r4,SL_IBAT7(r11)
+ mtspr SPRN_IBAT7U,r4
++ lwz r4,SL_IBAT7+4(r11)
+ mtspr SPRN_IBAT7L,r4
+ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
++#endif
+
+ /* Flush all TLBs */
+ lis r4,0x1000
+diff --git a/arch/powerpc/platforms/powermac/sleep.S b/arch/powerpc/platforms/powermac/sleep.S
+index f89808b9713d..b0660ef69177 100644
+--- a/arch/powerpc/platforms/powermac/sleep.S
++++ b/arch/powerpc/platforms/powermac/sleep.S
+@@ -38,10 +38,18 @@
+ #define SL_IBAT2 0x48
+ #define SL_DBAT3 0x50
+ #define SL_IBAT3 0x58
+-#define SL_TB 0x60
+-#define SL_R2 0x68
+-#define SL_CR 0x6c
+-#define SL_R12 0x70 /* r12 to r31 */
++#define SL_DBAT4 0x60
++#define SL_IBAT4 0x68
++#define SL_DBAT5 0x70
++#define SL_IBAT5 0x78
++#define SL_DBAT6 0x80
++#define SL_IBAT6 0x88
++#define SL_DBAT7 0x90
++#define SL_IBAT7 0x98
++#define SL_TB 0xa0
++#define SL_R2 0xa8
++#define SL_CR 0xac
++#define SL_R12 0xb0 /* r12 to r31 */
+ #define SL_SIZE (SL_R12 + 80)
+
+ .section .text
+@@ -126,6 +134,41 @@ _GLOBAL(low_sleep_handler)
+ mfibatl r4,3
+ stw r4,SL_IBAT3+4(r1)
+
++BEGIN_MMU_FTR_SECTION
++ mfspr r4,SPRN_DBAT4U
++ stw r4,SL_DBAT4(r1)
++ mfspr r4,SPRN_DBAT4L
++ stw r4,SL_DBAT4+4(r1)
++ mfspr r4,SPRN_DBAT5U
++ stw r4,SL_DBAT5(r1)
++ mfspr r4,SPRN_DBAT5L
++ stw r4,SL_DBAT5+4(r1)
++ mfspr r4,SPRN_DBAT6U
++ stw r4,SL_DBAT6(r1)
++ mfspr r4,SPRN_DBAT6L
++ stw r4,SL_DBAT6+4(r1)
++ mfspr r4,SPRN_DBAT7U
++ stw r4,SL_DBAT7(r1)
++ mfspr r4,SPRN_DBAT7L
++ stw r4,SL_DBAT7+4(r1)
++ mfspr r4,SPRN_IBAT4U
++ stw r4,SL_IBAT4(r1)
++ mfspr r4,SPRN_IBAT4L
++ stw r4,SL_IBAT4+4(r1)
++ mfspr r4,SPRN_IBAT5U
++ stw r4,SL_IBAT5(r1)
++ mfspr r4,SPRN_IBAT5L
++ stw r4,SL_IBAT5+4(r1)
++ mfspr r4,SPRN_IBAT6U
++ stw r4,SL_IBAT6(r1)
++ mfspr r4,SPRN_IBAT6L
++ stw r4,SL_IBAT6+4(r1)
++ mfspr r4,SPRN_IBAT7U
++ stw r4,SL_IBAT7(r1)
++ mfspr r4,SPRN_IBAT7L
++ stw r4,SL_IBAT7+4(r1)
++END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
++
+ /* Backup various CPU config stuffs */
+ bl __save_cpu_setup
+
+@@ -326,22 +369,37 @@ grackle_wake_up:
+ mtibatl 3,r4
+
+ BEGIN_MMU_FTR_SECTION
+- li r4,0
++ lwz r4,SL_DBAT4(r1)
+ mtspr SPRN_DBAT4U,r4
++ lwz r4,SL_DBAT4+4(r1)
+ mtspr SPRN_DBAT4L,r4
++ lwz r4,SL_DBAT5(r1)
+ mtspr SPRN_DBAT5U,r4
++ lwz r4,SL_DBAT5+4(r1)
+ mtspr SPRN_DBAT5L,r4
++ lwz r4,SL_DBAT6(r1)
+ mtspr SPRN_DBAT6U,r4
++ lwz r4,SL_DBAT6+4(r1)
+ mtspr SPRN_DBAT6L,r4
++ lwz r4,SL_DBAT7(r1)
+ mtspr SPRN_DBAT7U,r4
++ lwz r4,SL_DBAT7+4(r1)
+ mtspr SPRN_DBAT7L,r4
++ lwz r4,SL_IBAT4(r1)
+ mtspr SPRN_IBAT4U,r4
++ lwz r4,SL_IBAT4+4(r1)
+ mtspr SPRN_IBAT4L,r4
++ lwz r4,SL_IBAT5(r1)
+ mtspr SPRN_IBAT5U,r4
++ lwz r4,SL_IBAT5+4(r1)
+ mtspr SPRN_IBAT5L,r4
++ lwz r4,SL_IBAT6(r1)
+ mtspr SPRN_IBAT6U,r4
++ lwz r4,SL_IBAT6+4(r1)
+ mtspr SPRN_IBAT6L,r4
++ lwz r4,SL_IBAT7(r1)
+ mtspr SPRN_IBAT7U,r4
++ lwz r4,SL_IBAT7+4(r1)
+ mtspr SPRN_IBAT7L,r4
+ END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
+
+diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
+index 8006c54a91e3..fd8166ffbffa 100644
+--- a/arch/powerpc/platforms/powernv/npu-dma.c
++++ b/arch/powerpc/platforms/powernv/npu-dma.c
+@@ -56,9 +56,22 @@ static struct dentry *atsd_threshold_dentry;
+ static struct pci_dev *get_pci_dev(struct device_node *dn)
+ {
+ struct pci_dn *pdn = PCI_DN(dn);
++ struct pci_dev *pdev;
+
+- return pci_get_domain_bus_and_slot(pci_domain_nr(pdn->phb->bus),
++ pdev = pci_get_domain_bus_and_slot(pci_domain_nr(pdn->phb->bus),
+ pdn->busno, pdn->devfn);
++
++ /*
++ * pci_get_domain_bus_and_slot() increased the reference count of
++ * the PCI device, but callers don't need that actually as the PE
++ * already holds a reference to the device. Since callers aren't
++ * aware of the reference count change, call pci_dev_put() now to
++ * avoid leaks.
++ */
++ if (pdev)
++ pci_dev_put(pdev);
++
++ return pdev;
+ }
+
+ /* Given a NPU device get the associated PCI device. */
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index e4c658cda3a7..f99cd31b6fd1 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -1012,6 +1012,9 @@ static int pseries_update_drconf_memory(struct of_reconfig_data *pr)
+ if (!memblock_size)
+ return -EINVAL;
+
++ if (!pr->old_prop)
++ return 0;
++
+ p = (__be32 *) pr->old_prop->value;
+ if (!p)
+ return -EINVAL;
+diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
+index 8671de126eac..baa7e36073f9 100644
+--- a/arch/x86/events/amd/uncore.c
++++ b/arch/x86/events/amd/uncore.c
+@@ -210,15 +210,22 @@ static int amd_uncore_event_init(struct perf_event *event)
+ hwc->config = event->attr.config & AMD64_RAW_EVENT_MASK_NB;
+ hwc->idx = -1;
+
++ if (event->cpu < 0)
++ return -EINVAL;
++
+ /*
+ * SliceMask and ThreadMask need to be set for certain L3 events in
+ * Family 17h. For other events, the two fields do not affect the count.
+ */
+- if (l3_mask)
+- hwc->config |= (AMD64_L3_SLICE_MASK | AMD64_L3_THREAD_MASK);
++ if (l3_mask && is_llc_event(event)) {
++ int thread = 2 * (cpu_data(event->cpu).cpu_core_id % 4);
+
+- if (event->cpu < 0)
+- return -EINVAL;
++ if (smp_num_siblings > 1)
++ thread += cpu_data(event->cpu).apicid & 1;
++
++ hwc->config |= (1ULL << (AMD64_L3_THREAD_SHIFT + thread) &
++ AMD64_L3_THREAD_MASK) | AMD64_L3_SLICE_MASK;
++ }
+
+ uncore = event_to_amd_uncore(event);
+ if (!uncore)
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index c8b0bf2b0d5e..db5a2ba61753 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -2074,12 +2074,10 @@ static void intel_pmu_disable_event(struct perf_event *event)
+ cpuc->intel_ctrl_host_mask &= ~(1ull << hwc->idx);
+ cpuc->intel_cp_status &= ~(1ull << hwc->idx);
+
+- if (unlikely(hwc->config_base == MSR_ARCH_PERFMON_FIXED_CTR_CTRL)) {
++ if (unlikely(hwc->config_base == MSR_ARCH_PERFMON_FIXED_CTR_CTRL))
+ intel_pmu_disable_fixed(hwc);
+- return;
+- }
+-
+- x86_pmu_disable_event(event);
++ else
++ x86_pmu_disable_event(event);
+
+ /*
+ * Needs to be called after x86_pmu_disable_event,
+diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
+index cc6dd4f78158..42fa3974c421 100644
+--- a/arch/x86/events/intel/uncore.h
++++ b/arch/x86/events/intel/uncore.h
+@@ -402,6 +402,16 @@ static inline bool is_freerunning_event(struct perf_event *event)
+ (((cfg >> 8) & 0xff) >= UNCORE_FREERUNNING_UMASK_START);
+ }
+
++/* Check and reject invalid config */
++static inline int uncore_freerunning_hw_config(struct intel_uncore_box *box,
++ struct perf_event *event)
++{
++ if (is_freerunning_event(event))
++ return 0;
++
++ return -EINVAL;
++}
++
+ static inline void uncore_disable_box(struct intel_uncore_box *box)
+ {
+ if (box->pmu->type->ops->disable_box)
+diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
+index b10e04387f38..8e4e8e423839 100644
+--- a/arch/x86/events/intel/uncore_snbep.c
++++ b/arch/x86/events/intel/uncore_snbep.c
+@@ -3585,6 +3585,7 @@ static struct uncore_event_desc skx_uncore_iio_freerunning_events[] = {
+
+ static struct intel_uncore_ops skx_uncore_iio_freerunning_ops = {
+ .read_counter = uncore_msr_read_counter,
++ .hw_config = uncore_freerunning_hw_config,
+ };
+
+ static struct attribute *skx_uncore_iio_freerunning_formats_attr[] = {
+diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
+index ce84388e540c..d266a4066289 100644
+--- a/arch/x86/include/asm/atomic.h
++++ b/arch/x86/include/asm/atomic.h
+@@ -54,7 +54,7 @@ static __always_inline void arch_atomic_add(int i, atomic_t *v)
+ {
+ asm volatile(LOCK_PREFIX "addl %1,%0"
+ : "+m" (v->counter)
+- : "ir" (i));
++ : "ir" (i) : "memory");
+ }
+
+ /**
+@@ -68,7 +68,7 @@ static __always_inline void arch_atomic_sub(int i, atomic_t *v)
+ {
+ asm volatile(LOCK_PREFIX "subl %1,%0"
+ : "+m" (v->counter)
+- : "ir" (i));
++ : "ir" (i) : "memory");
+ }
+
+ /**
+@@ -95,7 +95,7 @@ static __always_inline bool arch_atomic_sub_and_test(int i, atomic_t *v)
+ static __always_inline void arch_atomic_inc(atomic_t *v)
+ {
+ asm volatile(LOCK_PREFIX "incl %0"
+- : "+m" (v->counter));
++ : "+m" (v->counter) :: "memory");
+ }
+ #define arch_atomic_inc arch_atomic_inc
+
+@@ -108,7 +108,7 @@ static __always_inline void arch_atomic_inc(atomic_t *v)
+ static __always_inline void arch_atomic_dec(atomic_t *v)
+ {
+ asm volatile(LOCK_PREFIX "decl %0"
+- : "+m" (v->counter));
++ : "+m" (v->counter) :: "memory");
+ }
+ #define arch_atomic_dec arch_atomic_dec
+
+diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
+index 5f851d92eecd..55ca027f8c1c 100644
+--- a/arch/x86/include/asm/atomic64_64.h
++++ b/arch/x86/include/asm/atomic64_64.h
+@@ -45,7 +45,7 @@ static __always_inline void arch_atomic64_add(long i, atomic64_t *v)
+ {
+ asm volatile(LOCK_PREFIX "addq %1,%0"
+ : "=m" (v->counter)
+- : "er" (i), "m" (v->counter));
++ : "er" (i), "m" (v->counter) : "memory");
+ }
+
+ /**
+@@ -59,7 +59,7 @@ static inline void arch_atomic64_sub(long i, atomic64_t *v)
+ {
+ asm volatile(LOCK_PREFIX "subq %1,%0"
+ : "=m" (v->counter)
+- : "er" (i), "m" (v->counter));
++ : "er" (i), "m" (v->counter) : "memory");
+ }
+
+ /**
+@@ -87,7 +87,7 @@ static __always_inline void arch_atomic64_inc(atomic64_t *v)
+ {
+ asm volatile(LOCK_PREFIX "incq %0"
+ : "=m" (v->counter)
+- : "m" (v->counter));
++ : "m" (v->counter) : "memory");
+ }
+ #define arch_atomic64_inc arch_atomic64_inc
+
+@@ -101,7 +101,7 @@ static __always_inline void arch_atomic64_dec(atomic64_t *v)
+ {
+ asm volatile(LOCK_PREFIX "decq %0"
+ : "=m" (v->counter)
+- : "m" (v->counter));
++ : "m" (v->counter) : "memory");
+ }
+ #define arch_atomic64_dec arch_atomic64_dec
+
+diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
+index 14de0432d288..84f848c2541a 100644
+--- a/arch/x86/include/asm/barrier.h
++++ b/arch/x86/include/asm/barrier.h
+@@ -80,8 +80,8 @@ do { \
+ })
+
+ /* Atomic operations are already serializing on x86 */
+-#define __smp_mb__before_atomic() barrier()
+-#define __smp_mb__after_atomic() barrier()
++#define __smp_mb__before_atomic() do { } while (0)
++#define __smp_mb__after_atomic() do { } while (0)
+
+ #include <asm-generic/barrier.h>
+
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 69037da75ea0..0cf704933f23 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -239,12 +239,14 @@
+ #define X86_FEATURE_BMI1 ( 9*32+ 3) /* 1st group bit manipulation extensions */
+ #define X86_FEATURE_HLE ( 9*32+ 4) /* Hardware Lock Elision */
+ #define X86_FEATURE_AVX2 ( 9*32+ 5) /* AVX2 instructions */
++#define X86_FEATURE_FDP_EXCPTN_ONLY ( 9*32+ 6) /* "" FPU data pointer updated only on x87 exceptions */
+ #define X86_FEATURE_SMEP ( 9*32+ 7) /* Supervisor Mode Execution Protection */
+ #define X86_FEATURE_BMI2 ( 9*32+ 8) /* 2nd group bit manipulation extensions */
+ #define X86_FEATURE_ERMS ( 9*32+ 9) /* Enhanced REP MOVSB/STOSB instructions */
+ #define X86_FEATURE_INVPCID ( 9*32+10) /* Invalidate Processor Context ID */
+ #define X86_FEATURE_RTM ( 9*32+11) /* Restricted Transactional Memory */
+ #define X86_FEATURE_CQM ( 9*32+12) /* Cache QoS Monitoring */
++#define X86_FEATURE_ZERO_FCS_FDS ( 9*32+13) /* "" Zero out FPU CS and FPU DS */
+ #define X86_FEATURE_MPX ( 9*32+14) /* Memory Protection Extension */
+ #define X86_FEATURE_RDT_A ( 9*32+15) /* Resource Director Technology Allocation */
+ #define X86_FEATURE_AVX512F ( 9*32+16) /* AVX-512 Foundation */
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 2e38fb82b91d..aebedbaf5260 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -56,6 +56,7 @@
+ #define INTEL_FAM6_ICELAKE_XEON_D 0x6C
+ #define INTEL_FAM6_ICELAKE_DESKTOP 0x7D
+ #define INTEL_FAM6_ICELAKE_MOBILE 0x7E
++#define INTEL_FAM6_ICELAKE_NNPI 0x9D
+
+ /* "Small Core" Processors (Atom) */
+
+diff --git a/arch/x86/kernel/cpu/cacheinfo.c b/arch/x86/kernel/cpu/cacheinfo.c
+index 0c5fcbd998cf..9d863e8f9b3f 100644
+--- a/arch/x86/kernel/cpu/cacheinfo.c
++++ b/arch/x86/kernel/cpu/cacheinfo.c
+@@ -651,8 +651,7 @@ void cacheinfo_amd_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id)
+ if (c->x86 < 0x17) {
+ /* LLC is at the node level. */
+ per_cpu(cpu_llc_id, cpu) = node_id;
+- } else if (c->x86 == 0x17 &&
+- c->x86_model >= 0 && c->x86_model <= 0x1F) {
++ } else if (c->x86 == 0x17 && c->x86_model <= 0x1F) {
+ /*
+ * LLC is at the core complex level.
+ * Core complex ID is ApicId[3] for these processors.
+diff --git a/arch/x86/kernel/cpu/mkcapflags.sh b/arch/x86/kernel/cpu/mkcapflags.sh
+index d0dfb892c72f..aed45b8895d5 100644
+--- a/arch/x86/kernel/cpu/mkcapflags.sh
++++ b/arch/x86/kernel/cpu/mkcapflags.sh
+@@ -4,6 +4,8 @@
+ # Generate the x86_cap/bug_flags[] arrays from include/asm/cpufeatures.h
+ #
+
++set -e
++
+ IN=$1
+ OUT=$2
+
+diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
+index ddb1ca6923b1..5b4c32799094 100644
+--- a/arch/x86/kernel/mpparse.c
++++ b/arch/x86/kernel/mpparse.c
+@@ -547,17 +547,15 @@ void __init default_get_smp_config(unsigned int early)
+ * local APIC has default address
+ */
+ mp_lapic_addr = APIC_DEFAULT_PHYS_BASE;
+- return;
++ goto out;
+ }
+
+ pr_info("Default MP configuration #%d\n", mpf->feature1);
+ construct_default_ISA_mptable(mpf->feature1);
+
+ } else if (mpf->physptr) {
+- if (check_physptr(mpf, early)) {
+- early_memunmap(mpf, sizeof(*mpf));
+- return;
+- }
++ if (check_physptr(mpf, early))
++ goto out;
+ } else
+ BUG();
+
+@@ -566,7 +564,7 @@ void __init default_get_smp_config(unsigned int early)
+ /*
+ * Only use the first configuration found.
+ */
+-
++out:
+ early_memunmap(mpf, sizeof(*mpf));
+ }
+
+diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
+index 952aebd0a8a3..acc8d217f656 100644
+--- a/arch/x86/kvm/pmu.c
++++ b/arch/x86/kvm/pmu.c
+@@ -131,8 +131,8 @@ static void pmc_reprogram_counter(struct kvm_pmc *pmc, u32 type,
+ intr ? kvm_perf_overflow_intr :
+ kvm_perf_overflow, pmc);
+ if (IS_ERR(event)) {
+- printk_once("kvm_pmu: event creation failed %ld\n",
+- PTR_ERR(event));
++ pr_debug_ratelimited("kvm_pmu: event creation failed %ld for pmc->idx = %d\n",
++ PTR_ERR(event), pmc->idx);
+ return;
+ }
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index c630e02836a8..527524134693 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -1016,8 +1016,12 @@ static int blkcg_print_stat(struct seq_file *sf, void *v)
+ }
+ next:
+ if (has_stats) {
+- off += scnprintf(buf+off, size-off, "\n");
+- seq_commit(sf, off);
++ if (off < size - 1) {
++ off += scnprintf(buf+off, size-off, "\n");
++ seq_commit(sf, off);
++ } else {
++ seq_commit(sf, -1);
++ }
+ }
+ }
+
+diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
+index 6b8396ccb5c4..f4f7c73fb828 100644
+--- a/block/blk-iolatency.c
++++ b/block/blk-iolatency.c
+@@ -565,6 +565,10 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+ if (!blkg)
+ return;
+
++ /* We didn't actually submit this bio, don't account it. */
++ if (bio->bi_status == BLK_STS_AGAIN)
++ return;
++
+ iolat = blkg_to_lat(bio->bi_blkg);
+ if (!iolat)
+ return;
+@@ -742,8 +746,10 @@ static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val)
+
+ if (!oldval && val)
+ return 1;
+- if (oldval && !val)
++ if (oldval && !val) {
++ blkcg_clear_delay(blkg);
+ return -1;
++ }
+ return 0;
+ }
+
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index 01d0620a4e4a..caee658609d7 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -892,13 +892,10 @@ static bool tg_with_in_iops_limit(struct throtl_grp *tg, struct bio *bio,
+ unsigned long jiffy_elapsed, jiffy_wait, jiffy_elapsed_rnd;
+ u64 tmp;
+
+- jiffy_elapsed = jiffy_elapsed_rnd = jiffies - tg->slice_start[rw];
+-
+- /* Slice has just started. Consider one slice interval */
+- if (!jiffy_elapsed)
+- jiffy_elapsed_rnd = tg->td->throtl_slice;
++ jiffy_elapsed = jiffies - tg->slice_start[rw];
+
+- jiffy_elapsed_rnd = roundup(jiffy_elapsed_rnd, tg->td->throtl_slice);
++ /* Round up to the next throttle slice, wait time must be nonzero */
++ jiffy_elapsed_rnd = roundup(jiffy_elapsed + 1, tg->td->throtl_slice);
+
+ /*
+ * jiffy_elapsed_rnd should not be a big value as minimum iops can be
+diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
+index f3702e533ff4..d8a73d94bb30 100644
+--- a/crypto/asymmetric_keys/Kconfig
++++ b/crypto/asymmetric_keys/Kconfig
+@@ -15,6 +15,7 @@ config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
+ select MPILIB
+ select CRYPTO_HASH_INFO
+ select CRYPTO_AKCIPHER
++ select CRYPTO_HASH
+ help
+ This option provides support for asymmetric public key type handling.
+ If signature generation and/or verification are to be used,
+@@ -34,6 +35,7 @@ config X509_CERTIFICATE_PARSER
+ config PKCS7_MESSAGE_PARSER
+ tristate "PKCS#7 message parser"
+ depends on X509_CERTIFICATE_PARSER
++ select CRYPTO_HASH
+ select ASN1
+ select OID_REGISTRY
+ help
+@@ -56,6 +58,7 @@ config SIGNED_PE_FILE_VERIFICATION
+ bool "Support for PE file signature verification"
+ depends on PKCS7_MESSAGE_PARSER=y
+ depends on SYSTEM_DATA_VERIFICATION
++ select CRYPTO_HASH
+ select ASN1
+ select OID_REGISTRY
+ help
+diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c
+index 4d6f51bcdfab..af8afe5c06ea 100644
+--- a/crypto/chacha20poly1305.c
++++ b/crypto/chacha20poly1305.c
+@@ -67,6 +67,8 @@ struct chachapoly_req_ctx {
+ unsigned int cryptlen;
+ /* Actual AD, excluding IV */
+ unsigned int assoclen;
++ /* request flags, with MAY_SLEEP cleared if needed */
++ u32 flags;
+ union {
+ struct poly_req poly;
+ struct chacha_req chacha;
+@@ -76,8 +78,12 @@ struct chachapoly_req_ctx {
+ static inline void async_done_continue(struct aead_request *req, int err,
+ int (*cont)(struct aead_request *))
+ {
+- if (!err)
++ if (!err) {
++ struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
++
++ rctx->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+ err = cont(req);
++ }
+
+ if (err != -EINPROGRESS && err != -EBUSY)
+ aead_request_complete(req, err);
+@@ -144,7 +150,7 @@ static int chacha_decrypt(struct aead_request *req)
+ dst = scatterwalk_ffwd(rctx->dst, req->dst, req->assoclen);
+ }
+
+- skcipher_request_set_callback(&creq->req, aead_request_flags(req),
++ skcipher_request_set_callback(&creq->req, rctx->flags,
+ chacha_decrypt_done, req);
+ skcipher_request_set_tfm(&creq->req, ctx->chacha);
+ skcipher_request_set_crypt(&creq->req, src, dst,
+@@ -188,7 +194,7 @@ static int poly_tail(struct aead_request *req)
+ memcpy(&preq->tail.cryptlen, &len, sizeof(len));
+ sg_set_buf(preq->src, &preq->tail, sizeof(preq->tail));
+
+- ahash_request_set_callback(&preq->req, aead_request_flags(req),
++ ahash_request_set_callback(&preq->req, rctx->flags,
+ poly_tail_done, req);
+ ahash_request_set_tfm(&preq->req, ctx->poly);
+ ahash_request_set_crypt(&preq->req, preq->src,
+@@ -219,7 +225,7 @@ static int poly_cipherpad(struct aead_request *req)
+ sg_init_table(preq->src, 1);
+ sg_set_buf(preq->src, &preq->pad, padlen);
+
+- ahash_request_set_callback(&preq->req, aead_request_flags(req),
++ ahash_request_set_callback(&preq->req, rctx->flags,
+ poly_cipherpad_done, req);
+ ahash_request_set_tfm(&preq->req, ctx->poly);
+ ahash_request_set_crypt(&preq->req, preq->src, NULL, padlen);
+@@ -250,7 +256,7 @@ static int poly_cipher(struct aead_request *req)
+ sg_init_table(rctx->src, 2);
+ crypt = scatterwalk_ffwd(rctx->src, crypt, req->assoclen);
+
+- ahash_request_set_callback(&preq->req, aead_request_flags(req),
++ ahash_request_set_callback(&preq->req, rctx->flags,
+ poly_cipher_done, req);
+ ahash_request_set_tfm(&preq->req, ctx->poly);
+ ahash_request_set_crypt(&preq->req, crypt, NULL, rctx->cryptlen);
+@@ -280,7 +286,7 @@ static int poly_adpad(struct aead_request *req)
+ sg_init_table(preq->src, 1);
+ sg_set_buf(preq->src, preq->pad, padlen);
+
+- ahash_request_set_callback(&preq->req, aead_request_flags(req),
++ ahash_request_set_callback(&preq->req, rctx->flags,
+ poly_adpad_done, req);
+ ahash_request_set_tfm(&preq->req, ctx->poly);
+ ahash_request_set_crypt(&preq->req, preq->src, NULL, padlen);
+@@ -304,7 +310,7 @@ static int poly_ad(struct aead_request *req)
+ struct poly_req *preq = &rctx->u.poly;
+ int err;
+
+- ahash_request_set_callback(&preq->req, aead_request_flags(req),
++ ahash_request_set_callback(&preq->req, rctx->flags,
+ poly_ad_done, req);
+ ahash_request_set_tfm(&preq->req, ctx->poly);
+ ahash_request_set_crypt(&preq->req, req->src, NULL, rctx->assoclen);
+@@ -331,7 +337,7 @@ static int poly_setkey(struct aead_request *req)
+ sg_init_table(preq->src, 1);
+ sg_set_buf(preq->src, rctx->key, sizeof(rctx->key));
+
+- ahash_request_set_callback(&preq->req, aead_request_flags(req),
++ ahash_request_set_callback(&preq->req, rctx->flags,
+ poly_setkey_done, req);
+ ahash_request_set_tfm(&preq->req, ctx->poly);
+ ahash_request_set_crypt(&preq->req, preq->src, NULL, sizeof(rctx->key));
+@@ -355,7 +361,7 @@ static int poly_init(struct aead_request *req)
+ struct poly_req *preq = &rctx->u.poly;
+ int err;
+
+- ahash_request_set_callback(&preq->req, aead_request_flags(req),
++ ahash_request_set_callback(&preq->req, rctx->flags,
+ poly_init_done, req);
+ ahash_request_set_tfm(&preq->req, ctx->poly);
+
+@@ -393,7 +399,7 @@ static int poly_genkey(struct aead_request *req)
+
+ chacha_iv(creq->iv, req, 0);
+
+- skcipher_request_set_callback(&creq->req, aead_request_flags(req),
++ skcipher_request_set_callback(&creq->req, rctx->flags,
+ poly_genkey_done, req);
+ skcipher_request_set_tfm(&creq->req, ctx->chacha);
+ skcipher_request_set_crypt(&creq->req, creq->src, creq->src,
+@@ -433,7 +439,7 @@ static int chacha_encrypt(struct aead_request *req)
+ dst = scatterwalk_ffwd(rctx->dst, req->dst, req->assoclen);
+ }
+
+- skcipher_request_set_callback(&creq->req, aead_request_flags(req),
++ skcipher_request_set_callback(&creq->req, rctx->flags,
+ chacha_encrypt_done, req);
+ skcipher_request_set_tfm(&creq->req, ctx->chacha);
+ skcipher_request_set_crypt(&creq->req, src, dst,
+@@ -451,6 +457,7 @@ static int chachapoly_encrypt(struct aead_request *req)
+ struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
+
+ rctx->cryptlen = req->cryptlen;
++ rctx->flags = aead_request_flags(req);
+
+ /* encrypt call chain:
+ * - chacha_encrypt/done()
+@@ -472,6 +479,7 @@ static int chachapoly_decrypt(struct aead_request *req)
+ struct chachapoly_req_ctx *rctx = aead_request_ctx(req);
+
+ rctx->cryptlen = req->cryptlen - POLY1305_DIGEST_SIZE;
++ rctx->flags = aead_request_flags(req);
+
+ /* decrypt call chain:
+ * - poly_genkey/done()
+diff --git a/crypto/ghash-generic.c b/crypto/ghash-generic.c
+index d9f192b953b2..591b52d3bdca 100644
+--- a/crypto/ghash-generic.c
++++ b/crypto/ghash-generic.c
+@@ -34,6 +34,7 @@ static int ghash_setkey(struct crypto_shash *tfm,
+ const u8 *key, unsigned int keylen)
+ {
+ struct ghash_ctx *ctx = crypto_shash_ctx(tfm);
++ be128 k;
+
+ if (keylen != GHASH_BLOCK_SIZE) {
+ crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
+@@ -42,7 +43,12 @@ static int ghash_setkey(struct crypto_shash *tfm,
+
+ if (ctx->gf128)
+ gf128mul_free_4k(ctx->gf128);
+- ctx->gf128 = gf128mul_init_4k_lle((be128 *)key);
++
++ BUILD_BUG_ON(sizeof(k) != GHASH_BLOCK_SIZE);
++ memcpy(&k, key, GHASH_BLOCK_SIZE); /* avoid violating alignment rules */
++ ctx->gf128 = gf128mul_init_4k_lle(&k);
++ memzero_explicit(&k, GHASH_BLOCK_SIZE);
++
+ if (!ctx->gf128)
+ return -ENOMEM;
+
+diff --git a/crypto/serpent_generic.c b/crypto/serpent_generic.c
+index 7c3382facc82..600bd288881d 100644
+--- a/crypto/serpent_generic.c
++++ b/crypto/serpent_generic.c
+@@ -229,7 +229,13 @@
+ x4 ^= x2; \
+ })
+
+-static void __serpent_setkey_sbox(u32 r0, u32 r1, u32 r2, u32 r3, u32 r4, u32 *k)
++/*
++ * both gcc and clang have misoptimized this function in the past,
++ * producing horrible object code from spilling temporary variables
++ * on the stack. Forcing this part out of line avoids that.
++ */
++static noinline void __serpent_setkey_sbox(u32 r0, u32 r1, u32 r2,
++ u32 r3, u32 r4, u32 *k)
+ {
+ k += 100;
+ S3(r3, r4, r0, r1, r2); store_and_load_keys(r1, r2, r4, r3, 28, 24);
+diff --git a/drivers/acpi/acpica/acevents.h b/drivers/acpi/acpica/acevents.h
+index 704bebbd35b0..298180bf7e3c 100644
+--- a/drivers/acpi/acpica/acevents.h
++++ b/drivers/acpi/acpica/acevents.h
+@@ -69,7 +69,8 @@ acpi_status
+ acpi_ev_mask_gpe(struct acpi_gpe_event_info *gpe_event_info, u8 is_masked);
+
+ acpi_status
+-acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info);
++acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info,
++ u8 clear_on_enable);
+
+ acpi_status
+ acpi_ev_remove_gpe_reference(struct acpi_gpe_event_info *gpe_event_info);
+diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
+index e10fec99a182..4b5d3b4c627a 100644
+--- a/drivers/acpi/acpica/evgpe.c
++++ b/drivers/acpi/acpica/evgpe.c
+@@ -146,6 +146,7 @@ acpi_ev_mask_gpe(struct acpi_gpe_event_info *gpe_event_info, u8 is_masked)
+ * FUNCTION: acpi_ev_add_gpe_reference
+ *
+ * PARAMETERS: gpe_event_info - Add a reference to this GPE
++ * clear_on_enable - Clear GPE status before enabling it
+ *
+ * RETURN: Status
+ *
+@@ -155,7 +156,8 @@ acpi_ev_mask_gpe(struct acpi_gpe_event_info *gpe_event_info, u8 is_masked)
+ ******************************************************************************/
+
+ acpi_status
+-acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info)
++acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info,
++ u8 clear_on_enable)
+ {
+ acpi_status status = AE_OK;
+
+@@ -170,6 +172,10 @@ acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info)
+
+ /* Enable on first reference */
+
++ if (clear_on_enable) {
++ (void)acpi_hw_clear_gpe(gpe_event_info);
++ }
++
+ status = acpi_ev_update_gpe_enable_mask(gpe_event_info);
+ if (ACPI_SUCCESS(status)) {
+ status = acpi_ev_enable_gpe(gpe_event_info);
+diff --git a/drivers/acpi/acpica/evgpeblk.c b/drivers/acpi/acpica/evgpeblk.c
+index b253063b09d3..8d96270ed8c7 100644
+--- a/drivers/acpi/acpica/evgpeblk.c
++++ b/drivers/acpi/acpica/evgpeblk.c
+@@ -453,7 +453,7 @@ acpi_ev_initialize_gpe_block(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
+ continue;
+ }
+
+- status = acpi_ev_add_gpe_reference(gpe_event_info);
++ status = acpi_ev_add_gpe_reference(gpe_event_info, FALSE);
+ if (ACPI_FAILURE(status)) {
+ ACPI_EXCEPTION((AE_INFO, status,
+ "Could not enable GPE 0x%02X",
+diff --git a/drivers/acpi/acpica/evxface.c b/drivers/acpi/acpica/evxface.c
+index febc332b00ac..841557bda641 100644
+--- a/drivers/acpi/acpica/evxface.c
++++ b/drivers/acpi/acpica/evxface.c
+@@ -971,7 +971,7 @@ acpi_remove_gpe_handler(acpi_handle gpe_device,
+ ACPI_GPE_DISPATCH_METHOD) ||
+ (ACPI_GPE_DISPATCH_TYPE(handler->original_flags) ==
+ ACPI_GPE_DISPATCH_NOTIFY)) && handler->originally_enabled) {
+- (void)acpi_ev_add_gpe_reference(gpe_event_info);
++ (void)acpi_ev_add_gpe_reference(gpe_event_info, FALSE);
+ if (ACPI_GPE_IS_POLLING_NEEDED(gpe_event_info)) {
+
+ /* Poll edge triggered GPEs to handle existing events */
+diff --git a/drivers/acpi/acpica/evxfgpe.c b/drivers/acpi/acpica/evxfgpe.c
+index b2d5f66cc1b0..4188731e7c40 100644
+--- a/drivers/acpi/acpica/evxfgpe.c
++++ b/drivers/acpi/acpica/evxfgpe.c
+@@ -108,7 +108,7 @@ acpi_status acpi_enable_gpe(acpi_handle gpe_device, u32 gpe_number)
+ if (gpe_event_info) {
+ if (ACPI_GPE_DISPATCH_TYPE(gpe_event_info->flags) !=
+ ACPI_GPE_DISPATCH_NONE) {
+- status = acpi_ev_add_gpe_reference(gpe_event_info);
++ status = acpi_ev_add_gpe_reference(gpe_event_info, TRUE);
+ if (ACPI_SUCCESS(status) &&
+ ACPI_GPE_IS_POLLING_NEEDED(gpe_event_info)) {
+
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 01306c018398..ccc80ff57eb2 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -1490,7 +1490,7 @@ static int ata_eh_read_log_10h(struct ata_device *dev,
+ tf->hob_lbah = buf[10];
+ tf->nsect = buf[12];
+ tf->hob_nsect = buf[13];
+- if (ata_id_has_ncq_autosense(dev->id))
++ if (dev->class == ATA_DEV_ZAC && ata_id_has_ncq_autosense(dev->id))
+ tf->auxiliary = buf[14] << 16 | buf[15] << 8 | buf[16];
+
+ return 0;
+@@ -1737,7 +1737,8 @@ void ata_eh_analyze_ncq_error(struct ata_link *link)
+ memcpy(&qc->result_tf, &tf, sizeof(tf));
+ qc->result_tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_LBA | ATA_TFLAG_LBA48;
+ qc->err_mask |= AC_ERR_DEV | AC_ERR_NCQ;
+- if ((qc->result_tf.command & ATA_SENSE) || qc->result_tf.auxiliary) {
++ if (dev->class == ATA_DEV_ZAC &&
++ ((qc->result_tf.command & ATA_SENSE) || qc->result_tf.auxiliary)) {
+ char sense_key, asc, ascq;
+
+ sense_key = (qc->result_tf.auxiliary >> 16) & 0xff;
+@@ -1791,10 +1792,11 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc,
+ }
+
+ switch (qc->dev->class) {
+- case ATA_DEV_ATA:
+ case ATA_DEV_ZAC:
+ if (stat & ATA_SENSE)
+ ata_eh_request_sense(qc, qc->scsicmd);
++ /* fall through */
++ case ATA_DEV_ATA:
+ if (err & ATA_ICRC)
+ qc->err_mask |= AC_ERR_ATA_BUS;
+ if (err & (ATA_UNC | ATA_AMNF))
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index 87b562e49a43..c9687c8b2347 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -575,6 +575,8 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
+ }
+
+ if (!strcmp(name, "dummy")) {
++ kfree(map->debugfs_name);
++
+ map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d",
+ dummy_index);
+ name = map->debugfs_name;
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 0360a90ad6b6..6c9f6988bc09 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1618,6 +1618,8 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg,
+ map->format.reg_bytes +
+ map->format.pad_bytes,
+ val, val_len);
++ else
++ ret = -ENOTSUPP;
+
+ /* If that didn't work fall back on linearising by hand. */
+ if (ret == -ENOTSUPP) {
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index a8de56f1936d..4a9a4d12721a 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -2119,6 +2119,9 @@ static void setup_format_params(int track)
+ raw_cmd->kernel_data = floppy_track_buffer;
+ raw_cmd->length = 4 * F_SECT_PER_TRACK;
+
++ if (!F_SECT_PER_TRACK)
++ return;
++
+ /* allow for about 30ms for data transport per track */
+ head_shift = (F_SECT_PER_TRACK + 5) / 6;
+
+@@ -3241,8 +3244,12 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
+ int cnt;
+
+ /* sanity checking for parameters. */
+- if (g->sect <= 0 ||
+- g->head <= 0 ||
++ if ((int)g->sect <= 0 ||
++ (int)g->head <= 0 ||
++ /* check for overflow in max_sector */
++ (int)(g->sect * g->head) <= 0 ||
++ /* check for zero in F_SECT_PER_TRACK */
++ (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
+ g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
+ /* check if reserved bits are set */
+ (g->stretch & ~(FD_STRETCH | FD_SWAPSIDES | FD_SECTBASEMASK)) != 0)
+@@ -3386,6 +3393,24 @@ static int fd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+ return 0;
+ }
+
++static bool valid_floppy_drive_params(const short autodetect[8],
++ int native_format)
++{
++ size_t floppy_type_size = ARRAY_SIZE(floppy_type);
++ size_t i = 0;
++
++ for (i = 0; i < 8; ++i) {
++ if (autodetect[i] < 0 ||
++ autodetect[i] >= floppy_type_size)
++ return false;
++ }
++
++ if (native_format < 0 || native_format >= floppy_type_size)
++ return false;
++
++ return true;
++}
++
+ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,
+ unsigned long param)
+ {
+@@ -3512,6 +3537,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
+ SUPBOUND(size, strlen((const char *)outparam) + 1);
+ break;
+ case FDSETDRVPRM:
++ if (!valid_floppy_drive_params(inparam.dp.autodetect,
++ inparam.dp.native_format))
++ return -EINVAL;
+ *UDP = inparam.dp;
+ break;
+ case FDGETDRVPRM:
+@@ -3709,6 +3737,8 @@ static int compat_setdrvprm(int drive,
+ return -EPERM;
+ if (copy_from_user(&v, arg, sizeof(struct compat_floppy_drive_params)))
+ return -EFAULT;
++ if (!valid_floppy_drive_params(v.autodetect, v.native_format))
++ return -EINVAL;
+ mutex_lock(&floppy_mutex);
+ UDP->cmos = v.cmos;
+ UDP->max_dtr = v.max_dtr;
+diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
+index 093b614d6524..c5c0b7c89481 100644
+--- a/drivers/block/null_blk_main.c
++++ b/drivers/block/null_blk_main.c
+@@ -321,11 +321,12 @@ static ssize_t nullb_device_power_store(struct config_item *item,
+ set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
+ dev->power = newp;
+ } else if (dev->power && !newp) {
+- mutex_lock(&lock);
+- dev->power = newp;
+- null_del_dev(dev->nullb);
+- mutex_unlock(&lock);
+- clear_bit(NULLB_DEV_FL_UP, &dev->flags);
++ if (test_and_clear_bit(NULLB_DEV_FL_UP, &dev->flags)) {
++ mutex_lock(&lock);
++ dev->power = newp;
++ null_del_dev(dev->nullb);
++ mutex_unlock(&lock);
++ }
+ clear_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
+ }
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 40a4f95f6178..75cf605f54e5 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -277,7 +277,9 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME },
+ { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME },
+ { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME },
++ { USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME },
+ { USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME },
++ { USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME },
+
+ /* Broadcom BCM2035 */
+ { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
+diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
+index 1a7f0c82fb36..66fe1e6dc631 100644
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -759,6 +759,11 @@ static int bcsp_close(struct hci_uart *hu)
+ skb_queue_purge(&bcsp->rel);
+ skb_queue_purge(&bcsp->unrel);
+
++ if (bcsp->rx_skb) {
++ kfree_skb(bcsp->rx_skb);
++ bcsp->rx_skb = NULL;
++ }
++
+ kfree(bcsp);
+ return 0;
+ }
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index d55c30f6981d..aaf5bfa9bd9c 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -211,7 +211,7 @@ static void exynos4_frc_resume(struct clocksource *cs)
+
+ static struct clocksource mct_frc = {
+ .name = "mct-frc",
+- .rating = 400,
++ .rating = 450, /* use value higher than ARM arch timer */
+ .read = exynos4_frc_read,
+ .mask = CLOCKSOURCE_MASK(32),
+ .flags = CLOCK_SOURCE_IS_CONTINUOUS,
+@@ -466,7 +466,7 @@ static int exynos4_mct_starting_cpu(unsigned int cpu)
+ evt->set_state_oneshot_stopped = set_state_shutdown;
+ evt->tick_resume = set_state_shutdown;
+ evt->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
+- evt->rating = 450;
++ evt->rating = 500; /* use value higher than ARM arch timer */
+
+ exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
+
+diff --git a/drivers/crypto/amcc/crypto4xx_alg.c b/drivers/crypto/amcc/crypto4xx_alg.c
+index 0c85a5123f85..1d87deca32ed 100644
+--- a/drivers/crypto/amcc/crypto4xx_alg.c
++++ b/drivers/crypto/amcc/crypto4xx_alg.c
+@@ -76,12 +76,16 @@ static void set_dynamic_sa_command_1(struct dynamic_sa_ctl *sa, u32 cm,
+ }
+
+ static inline int crypto4xx_crypt(struct skcipher_request *req,
+- const unsigned int ivlen, bool decrypt)
++ const unsigned int ivlen, bool decrypt,
++ bool check_blocksize)
+ {
+ struct crypto_skcipher *cipher = crypto_skcipher_reqtfm(req);
+ struct crypto4xx_ctx *ctx = crypto_skcipher_ctx(cipher);
+ __le32 iv[AES_IV_SIZE];
+
++ if (check_blocksize && !IS_ALIGNED(req->cryptlen, AES_BLOCK_SIZE))
++ return -EINVAL;
++
+ if (ivlen)
+ crypto4xx_memcpy_to_le32(iv, req->iv, ivlen);
+
+@@ -90,24 +94,34 @@ static inline int crypto4xx_crypt(struct skcipher_request *req,
+ ctx->sa_len, 0, NULL);
+ }
+
+-int crypto4xx_encrypt_noiv(struct skcipher_request *req)
++int crypto4xx_encrypt_noiv_block(struct skcipher_request *req)
++{
++ return crypto4xx_crypt(req, 0, false, true);
++}
++
++int crypto4xx_encrypt_iv_stream(struct skcipher_request *req)
++{
++ return crypto4xx_crypt(req, AES_IV_SIZE, false, false);
++}
++
++int crypto4xx_decrypt_noiv_block(struct skcipher_request *req)
+ {
+- return crypto4xx_crypt(req, 0, false);
++ return crypto4xx_crypt(req, 0, true, true);
+ }
+
+-int crypto4xx_encrypt_iv(struct skcipher_request *req)
++int crypto4xx_decrypt_iv_stream(struct skcipher_request *req)
+ {
+- return crypto4xx_crypt(req, AES_IV_SIZE, false);
++ return crypto4xx_crypt(req, AES_IV_SIZE, true, false);
+ }
+
+-int crypto4xx_decrypt_noiv(struct skcipher_request *req)
++int crypto4xx_encrypt_iv_block(struct skcipher_request *req)
+ {
+- return crypto4xx_crypt(req, 0, true);
++ return crypto4xx_crypt(req, AES_IV_SIZE, false, true);
+ }
+
+-int crypto4xx_decrypt_iv(struct skcipher_request *req)
++int crypto4xx_decrypt_iv_block(struct skcipher_request *req)
+ {
+- return crypto4xx_crypt(req, AES_IV_SIZE, true);
++ return crypto4xx_crypt(req, AES_IV_SIZE, true, true);
+ }
+
+ /**
+@@ -278,8 +292,8 @@ crypto4xx_ctr_crypt(struct skcipher_request *req, bool encrypt)
+ return ret;
+ }
+
+- return encrypt ? crypto4xx_encrypt_iv(req)
+- : crypto4xx_decrypt_iv(req);
++ return encrypt ? crypto4xx_encrypt_iv_stream(req)
++ : crypto4xx_decrypt_iv_stream(req);
+ }
+
+ static int crypto4xx_sk_setup_fallback(struct crypto4xx_ctx *ctx,
+diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
+index d2ec9fd1b8bb..6386e1784fe4 100644
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -1153,8 +1153,8 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
+ .max_keysize = AES_MAX_KEY_SIZE,
+ .ivsize = AES_IV_SIZE,
+ .setkey = crypto4xx_setkey_aes_cbc,
+- .encrypt = crypto4xx_encrypt_iv,
+- .decrypt = crypto4xx_decrypt_iv,
++ .encrypt = crypto4xx_encrypt_iv_block,
++ .decrypt = crypto4xx_decrypt_iv_block,
+ .init = crypto4xx_sk_init,
+ .exit = crypto4xx_sk_exit,
+ } },
+@@ -1173,8 +1173,8 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
+ .max_keysize = AES_MAX_KEY_SIZE,
+ .ivsize = AES_IV_SIZE,
+ .setkey = crypto4xx_setkey_aes_cfb,
+- .encrypt = crypto4xx_encrypt_iv,
+- .decrypt = crypto4xx_decrypt_iv,
++ .encrypt = crypto4xx_encrypt_iv_stream,
++ .decrypt = crypto4xx_decrypt_iv_stream,
+ .init = crypto4xx_sk_init,
+ .exit = crypto4xx_sk_exit,
+ } },
+@@ -1186,7 +1186,7 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
+ .cra_flags = CRYPTO_ALG_NEED_FALLBACK |
+ CRYPTO_ALG_ASYNC |
+ CRYPTO_ALG_KERN_DRIVER_ONLY,
+- .cra_blocksize = AES_BLOCK_SIZE,
++ .cra_blocksize = 1,
+ .cra_ctxsize = sizeof(struct crypto4xx_ctx),
+ .cra_module = THIS_MODULE,
+ },
+@@ -1206,7 +1206,7 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
+ .cra_priority = CRYPTO4XX_CRYPTO_PRIORITY,
+ .cra_flags = CRYPTO_ALG_ASYNC |
+ CRYPTO_ALG_KERN_DRIVER_ONLY,
+- .cra_blocksize = AES_BLOCK_SIZE,
++ .cra_blocksize = 1,
+ .cra_ctxsize = sizeof(struct crypto4xx_ctx),
+ .cra_module = THIS_MODULE,
+ },
+@@ -1226,15 +1226,15 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
+ .cra_priority = CRYPTO4XX_CRYPTO_PRIORITY,
+ .cra_flags = CRYPTO_ALG_ASYNC |
+ CRYPTO_ALG_KERN_DRIVER_ONLY,
+- .cra_blocksize = AES_BLOCK_SIZE,
++ .cra_blocksize = 1,
+ .cra_ctxsize = sizeof(struct crypto4xx_ctx),
+ .cra_module = THIS_MODULE,
+ },
+ .min_keysize = AES_MIN_KEY_SIZE,
+ .max_keysize = AES_MAX_KEY_SIZE,
+ .setkey = crypto4xx_setkey_aes_ecb,
+- .encrypt = crypto4xx_encrypt_noiv,
+- .decrypt = crypto4xx_decrypt_noiv,
++ .encrypt = crypto4xx_encrypt_noiv_block,
++ .decrypt = crypto4xx_decrypt_noiv_block,
+ .init = crypto4xx_sk_init,
+ .exit = crypto4xx_sk_exit,
+ } },
+@@ -1245,7 +1245,7 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
+ .cra_priority = CRYPTO4XX_CRYPTO_PRIORITY,
+ .cra_flags = CRYPTO_ALG_ASYNC |
+ CRYPTO_ALG_KERN_DRIVER_ONLY,
+- .cra_blocksize = AES_BLOCK_SIZE,
++ .cra_blocksize = 1,
+ .cra_ctxsize = sizeof(struct crypto4xx_ctx),
+ .cra_module = THIS_MODULE,
+ },
+@@ -1253,8 +1253,8 @@ static struct crypto4xx_alg_common crypto4xx_alg[] = {
+ .max_keysize = AES_MAX_KEY_SIZE,
+ .ivsize = AES_IV_SIZE,
+ .setkey = crypto4xx_setkey_aes_ofb,
+- .encrypt = crypto4xx_encrypt_iv,
+- .decrypt = crypto4xx_decrypt_iv,
++ .encrypt = crypto4xx_encrypt_iv_stream,
++ .decrypt = crypto4xx_decrypt_iv_stream,
+ .init = crypto4xx_sk_init,
+ .exit = crypto4xx_sk_exit,
+ } },
+diff --git a/drivers/crypto/amcc/crypto4xx_core.h b/drivers/crypto/amcc/crypto4xx_core.h
+index e2ca56722f07..21a6bbcedc55 100644
+--- a/drivers/crypto/amcc/crypto4xx_core.h
++++ b/drivers/crypto/amcc/crypto4xx_core.h
+@@ -179,10 +179,12 @@ int crypto4xx_setkey_rfc3686(struct crypto_skcipher *cipher,
+ const u8 *key, unsigned int keylen);
+ int crypto4xx_encrypt_ctr(struct skcipher_request *req);
+ int crypto4xx_decrypt_ctr(struct skcipher_request *req);
+-int crypto4xx_encrypt_iv(struct skcipher_request *req);
+-int crypto4xx_decrypt_iv(struct skcipher_request *req);
+-int crypto4xx_encrypt_noiv(struct skcipher_request *req);
+-int crypto4xx_decrypt_noiv(struct skcipher_request *req);
++int crypto4xx_encrypt_iv_stream(struct skcipher_request *req);
++int crypto4xx_decrypt_iv_stream(struct skcipher_request *req);
++int crypto4xx_encrypt_iv_block(struct skcipher_request *req);
++int crypto4xx_decrypt_iv_block(struct skcipher_request *req);
++int crypto4xx_encrypt_noiv_block(struct skcipher_request *req);
++int crypto4xx_decrypt_noiv_block(struct skcipher_request *req);
+ int crypto4xx_rfc3686_encrypt(struct skcipher_request *req);
+ int crypto4xx_rfc3686_decrypt(struct skcipher_request *req);
+ int crypto4xx_sha1_alg_init(struct crypto_tfm *tfm);
+diff --git a/drivers/crypto/amcc/crypto4xx_trng.c b/drivers/crypto/amcc/crypto4xx_trng.c
+index 53ab1f140a26..8a3ed4031206 100644
+--- a/drivers/crypto/amcc/crypto4xx_trng.c
++++ b/drivers/crypto/amcc/crypto4xx_trng.c
+@@ -111,7 +111,6 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev)
+ return;
+
+ err_out:
+- of_node_put(trng);
+ iounmap(dev->trng_base);
+ kfree(rng);
+ dev->trng_base = NULL;
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index 9bc54c3c2cb9..1907945f82b7 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -887,6 +887,7 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err,
+ struct ablkcipher_request *req = context;
+ struct ablkcipher_edesc *edesc;
+ struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
++ struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher);
+ int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
+
+ #ifdef DEBUG
+@@ -911,10 +912,11 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err,
+
+ /*
+ * The crypto API expects us to set the IV (req->info) to the last
+- * ciphertext block. This is used e.g. by the CTS mode.
++ * ciphertext block when running in CBC mode.
+ */
+- scatterwalk_map_and_copy(req->info, req->dst, req->nbytes - ivsize,
+- ivsize, 0);
++ if ((ctx->cdata.algtype & OP_ALG_AAI_MASK) == OP_ALG_AAI_CBC)
++ scatterwalk_map_and_copy(req->info, req->dst, req->nbytes -
++ ivsize, ivsize, 0);
+
+ /* In case initial IV was generated, copy it in GIVCIPHER request */
+ if (edesc->iv_dir == DMA_FROM_DEVICE) {
+@@ -1651,10 +1653,11 @@ static int ablkcipher_decrypt(struct ablkcipher_request *req)
+
+ /*
+ * The crypto API expects us to set the IV (req->info) to the last
+- * ciphertext block.
++ * ciphertext block when running in CBC mode.
+ */
+- scatterwalk_map_and_copy(req->info, req->src, req->nbytes - ivsize,
+- ivsize, 0);
++ if ((ctx->cdata.algtype & OP_ALG_AAI_MASK) == OP_ALG_AAI_CBC)
++ scatterwalk_map_and_copy(req->info, req->src, req->nbytes -
++ ivsize, ivsize, 0);
+
+ /* Create and submit job descriptor*/
+ init_ablkcipher_job(ctx->sh_desc_dec, ctx->sh_desc_dec_dma, edesc, req);
+diff --git a/drivers/crypto/ccp/ccp-dev.c b/drivers/crypto/ccp/ccp-dev.c
+index 1b5035d56288..9b6d8972a565 100644
+--- a/drivers/crypto/ccp/ccp-dev.c
++++ b/drivers/crypto/ccp/ccp-dev.c
+@@ -35,56 +35,62 @@ struct ccp_tasklet_data {
+ };
+
+ /* Human-readable error strings */
++#define CCP_MAX_ERROR_CODE 64
+ static char *ccp_error_codes[] = {
+ "",
+- "ERR 01: ILLEGAL_ENGINE",
+- "ERR 02: ILLEGAL_KEY_ID",
+- "ERR 03: ILLEGAL_FUNCTION_TYPE",
+- "ERR 04: ILLEGAL_FUNCTION_MODE",
+- "ERR 05: ILLEGAL_FUNCTION_ENCRYPT",
+- "ERR 06: ILLEGAL_FUNCTION_SIZE",
+- "ERR 07: Zlib_MISSING_INIT_EOM",
+- "ERR 08: ILLEGAL_FUNCTION_RSVD",
+- "ERR 09: ILLEGAL_BUFFER_LENGTH",
+- "ERR 10: VLSB_FAULT",
+- "ERR 11: ILLEGAL_MEM_ADDR",
+- "ERR 12: ILLEGAL_MEM_SEL",
+- "ERR 13: ILLEGAL_CONTEXT_ID",
+- "ERR 14: ILLEGAL_KEY_ADDR",
+- "ERR 15: 0xF Reserved",
+- "ERR 16: Zlib_ILLEGAL_MULTI_QUEUE",
+- "ERR 17: Zlib_ILLEGAL_JOBID_CHANGE",
+- "ERR 18: CMD_TIMEOUT",
+- "ERR 19: IDMA0_AXI_SLVERR",
+- "ERR 20: IDMA0_AXI_DECERR",
+- "ERR 21: 0x15 Reserved",
+- "ERR 22: IDMA1_AXI_SLAVE_FAULT",
+- "ERR 23: IDMA1_AIXI_DECERR",
+- "ERR 24: 0x18 Reserved",
+- "ERR 25: ZLIBVHB_AXI_SLVERR",
+- "ERR 26: ZLIBVHB_AXI_DECERR",
+- "ERR 27: 0x1B Reserved",
+- "ERR 27: ZLIB_UNEXPECTED_EOM",
+- "ERR 27: ZLIB_EXTRA_DATA",
+- "ERR 30: ZLIB_BTYPE",
+- "ERR 31: ZLIB_UNDEFINED_SYMBOL",
+- "ERR 32: ZLIB_UNDEFINED_DISTANCE_S",
+- "ERR 33: ZLIB_CODE_LENGTH_SYMBOL",
+- "ERR 34: ZLIB _VHB_ILLEGAL_FETCH",
+- "ERR 35: ZLIB_UNCOMPRESSED_LEN",
+- "ERR 36: ZLIB_LIMIT_REACHED",
+- "ERR 37: ZLIB_CHECKSUM_MISMATCH0",
+- "ERR 38: ODMA0_AXI_SLVERR",
+- "ERR 39: ODMA0_AXI_DECERR",
+- "ERR 40: 0x28 Reserved",
+- "ERR 41: ODMA1_AXI_SLVERR",
+- "ERR 42: ODMA1_AXI_DECERR",
+- "ERR 43: LSB_PARITY_ERR",
++ "ILLEGAL_ENGINE",
++ "ILLEGAL_KEY_ID",
++ "ILLEGAL_FUNCTION_TYPE",
++ "ILLEGAL_FUNCTION_MODE",
++ "ILLEGAL_FUNCTION_ENCRYPT",
++ "ILLEGAL_FUNCTION_SIZE",
++ "Zlib_MISSING_INIT_EOM",
++ "ILLEGAL_FUNCTION_RSVD",
++ "ILLEGAL_BUFFER_LENGTH",
++ "VLSB_FAULT",
++ "ILLEGAL_MEM_ADDR",
++ "ILLEGAL_MEM_SEL",
++ "ILLEGAL_CONTEXT_ID",
++ "ILLEGAL_KEY_ADDR",
++ "0xF Reserved",
++ "Zlib_ILLEGAL_MULTI_QUEUE",
++ "Zlib_ILLEGAL_JOBID_CHANGE",
++ "CMD_TIMEOUT",
++ "IDMA0_AXI_SLVERR",
++ "IDMA0_AXI_DECERR",
++ "0x15 Reserved",
++ "IDMA1_AXI_SLAVE_FAULT",
++ "IDMA1_AIXI_DECERR",
++ "0x18 Reserved",
++ "ZLIBVHB_AXI_SLVERR",
++ "ZLIBVHB_AXI_DECERR",
++ "0x1B Reserved",
++ "ZLIB_UNEXPECTED_EOM",
++ "ZLIB_EXTRA_DATA",
++ "ZLIB_BTYPE",
++ "ZLIB_UNDEFINED_SYMBOL",
++ "ZLIB_UNDEFINED_DISTANCE_S",
++ "ZLIB_CODE_LENGTH_SYMBOL",
++ "ZLIB _VHB_ILLEGAL_FETCH",
++ "ZLIB_UNCOMPRESSED_LEN",
++ "ZLIB_LIMIT_REACHED",
++ "ZLIB_CHECKSUM_MISMATCH0",
++ "ODMA0_AXI_SLVERR",
++ "ODMA0_AXI_DECERR",
++ "0x28 Reserved",
++ "ODMA1_AXI_SLVERR",
++ "ODMA1_AXI_DECERR",
+ };
+
+-void ccp_log_error(struct ccp_device *d, int e)
++void ccp_log_error(struct ccp_device *d, unsigned int e)
+ {
+- dev_err(d->dev, "CCP error: %s (0x%x)\n", ccp_error_codes[e], e);
++ if (WARN_ON(e >= CCP_MAX_ERROR_CODE))
++ return;
++
++ if (e < ARRAY_SIZE(ccp_error_codes))
++ dev_err(d->dev, "CCP error %d: %s\n", e, ccp_error_codes[e]);
++ else
++ dev_err(d->dev, "CCP error %d: Unknown Error\n", e);
+ }
+
+ /* List of CCPs, CCP count, read-write access lock, and access functions
+diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
+index 6810b65c1939..7442b0422f8a 100644
+--- a/drivers/crypto/ccp/ccp-dev.h
++++ b/drivers/crypto/ccp/ccp-dev.h
+@@ -632,7 +632,7 @@ struct ccp5_desc {
+ void ccp_add_device(struct ccp_device *ccp);
+ void ccp_del_device(struct ccp_device *ccp);
+
+-extern void ccp_log_error(struct ccp_device *, int);
++extern void ccp_log_error(struct ccp_device *, unsigned int);
+
+ struct ccp_device *ccp_alloc_struct(struct sp_device *sp);
+ bool ccp_queues_suspended(struct ccp_device *ccp);
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 0ea43cdeb05f..e212badd39fa 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -625,6 +625,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+
+ unsigned long long *final;
+ unsigned int dm_offset;
++ unsigned int jobid;
+ unsigned int ilen;
+ bool in_place = true; /* Default value */
+ int ret;
+@@ -663,9 +664,11 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ p_tag = scatterwalk_ffwd(sg_tag, p_inp, ilen);
+ }
+
++ jobid = CCP_NEW_JOBID(cmd_q->ccp);
++
+ memset(&op, 0, sizeof(op));
+ op.cmd_q = cmd_q;
+- op.jobid = CCP_NEW_JOBID(cmd_q->ccp);
++ op.jobid = jobid;
+ op.sb_key = cmd_q->sb_key; /* Pre-allocated */
+ op.sb_ctx = cmd_q->sb_ctx; /* Pre-allocated */
+ op.init = 1;
+@@ -816,6 +819,13 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ final[0] = cpu_to_be64(aes->aad_len * 8);
+ final[1] = cpu_to_be64(ilen * 8);
+
++ memset(&op, 0, sizeof(op));
++ op.cmd_q = cmd_q;
++ op.jobid = jobid;
++ op.sb_key = cmd_q->sb_key; /* Pre-allocated */
++ op.sb_ctx = cmd_q->sb_ctx; /* Pre-allocated */
++ op.init = 1;
++ op.u.aes.type = aes->type;
+ op.u.aes.mode = CCP_AES_MODE_GHASH;
+ op.u.aes.action = CCP_AES_GHASHFINAL;
+ op.src.type = CCP_MEMTYPE_SYSTEM;
+@@ -843,7 +853,8 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ if (ret)
+ goto e_tag;
+
+- ret = memcmp(tag.address, final_wa.address, AES_BLOCK_SIZE);
++ ret = crypto_memneq(tag.address, final_wa.address,
++ AES_BLOCK_SIZE) ? -EBADMSG : 0;
+ ccp_dm_free(&tag);
+ }
+
+diff --git a/drivers/crypto/inside-secure/safexcel_cipher.c b/drivers/crypto/inside-secure/safexcel_cipher.c
+index 3aef1d43e435..42a3830fbd19 100644
+--- a/drivers/crypto/inside-secure/safexcel_cipher.c
++++ b/drivers/crypto/inside-secure/safexcel_cipher.c
+@@ -51,6 +51,8 @@ struct safexcel_cipher_ctx {
+
+ struct safexcel_cipher_req {
+ enum safexcel_cipher_direction direction;
++ /* Number of result descriptors associated to the request */
++ unsigned int rdescs;
+ bool needs_inv;
+ };
+
+@@ -333,7 +335,10 @@ static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, int rin
+
+ *ret = 0;
+
+- do {
++ if (unlikely(!sreq->rdescs))
++ return 0;
++
++ while (sreq->rdescs--) {
+ rdesc = safexcel_ring_next_rptr(priv, &priv->ring[ring].rdr);
+ if (IS_ERR(rdesc)) {
+ dev_err(priv->dev,
+@@ -346,7 +351,7 @@ static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, int rin
+ *ret = safexcel_rdesc_check_errors(priv, rdesc);
+
+ ndesc++;
+- } while (!rdesc->last_seg);
++ }
+
+ safexcel_complete(priv, ring);
+
+@@ -501,6 +506,7 @@ cdesc_rollback:
+ static int safexcel_handle_inv_result(struct safexcel_crypto_priv *priv,
+ int ring,
+ struct crypto_async_request *base,
++ struct safexcel_cipher_req *sreq,
+ bool *should_complete, int *ret)
+ {
+ struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(base->tfm);
+@@ -509,7 +515,10 @@ static int safexcel_handle_inv_result(struct safexcel_crypto_priv *priv,
+
+ *ret = 0;
+
+- do {
++ if (unlikely(!sreq->rdescs))
++ return 0;
++
++ while (sreq->rdescs--) {
+ rdesc = safexcel_ring_next_rptr(priv, &priv->ring[ring].rdr);
+ if (IS_ERR(rdesc)) {
+ dev_err(priv->dev,
+@@ -522,7 +531,7 @@ static int safexcel_handle_inv_result(struct safexcel_crypto_priv *priv,
+ *ret = safexcel_rdesc_check_errors(priv, rdesc);
+
+ ndesc++;
+- } while (!rdesc->last_seg);
++ }
+
+ safexcel_complete(priv, ring);
+
+@@ -564,7 +573,7 @@ static int safexcel_skcipher_handle_result(struct safexcel_crypto_priv *priv,
+
+ if (sreq->needs_inv) {
+ sreq->needs_inv = false;
+- err = safexcel_handle_inv_result(priv, ring, async,
++ err = safexcel_handle_inv_result(priv, ring, async, sreq,
+ should_complete, ret);
+ } else {
+ err = safexcel_handle_req_result(priv, ring, async, req->src,
+@@ -587,7 +596,7 @@ static int safexcel_aead_handle_result(struct safexcel_crypto_priv *priv,
+
+ if (sreq->needs_inv) {
+ sreq->needs_inv = false;
+- err = safexcel_handle_inv_result(priv, ring, async,
++ err = safexcel_handle_inv_result(priv, ring, async, sreq,
+ should_complete, ret);
+ } else {
+ err = safexcel_handle_req_result(priv, ring, async, req->src,
+@@ -633,6 +642,8 @@ static int safexcel_skcipher_send(struct crypto_async_request *async, int ring,
+ ret = safexcel_send_req(async, ring, sreq, req->src,
+ req->dst, req->cryptlen, 0, 0, req->iv,
+ commands, results);
++
++ sreq->rdescs = *results;
+ return ret;
+ }
+
+@@ -655,6 +666,7 @@ static int safexcel_aead_send(struct crypto_async_request *async, int ring,
+ req->cryptlen, req->assoclen,
+ crypto_aead_authsize(tfm), req->iv,
+ commands, results);
++ sreq->rdescs = *results;
+ return ret;
+ }
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 5849075d54c7..41b288bdcdbf 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -1001,7 +1001,6 @@ static void ipsec_esp_encrypt_done(struct device *dev,
+ unsigned int authsize = crypto_aead_authsize(authenc);
+ unsigned int ivsize = crypto_aead_ivsize(authenc);
+ struct talitos_edesc *edesc;
+- struct scatterlist *sg;
+ void *icvdata;
+
+ edesc = container_of(desc, struct talitos_edesc, desc);
+@@ -1015,9 +1014,8 @@ static void ipsec_esp_encrypt_done(struct device *dev,
+ else
+ icvdata = &edesc->link_tbl[edesc->src_nents +
+ edesc->dst_nents + 2];
+- sg = sg_last(areq->dst, edesc->dst_nents);
+- memcpy((char *)sg_virt(sg) + sg->length - authsize,
+- icvdata, authsize);
++ sg_pcopy_from_buffer(areq->dst, edesc->dst_nents ? : 1, icvdata,
++ authsize, areq->assoclen + areq->cryptlen);
+ }
+
+ dma_unmap_single(dev, edesc->iv_dma, ivsize, DMA_TO_DEVICE);
+@@ -1035,7 +1033,6 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
+ struct crypto_aead *authenc = crypto_aead_reqtfm(req);
+ unsigned int authsize = crypto_aead_authsize(authenc);
+ struct talitos_edesc *edesc;
+- struct scatterlist *sg;
+ char *oicv, *icv;
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
+@@ -1045,9 +1042,18 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
+ ipsec_esp_unmap(dev, edesc, req);
+
+ if (!err) {
++ char icvdata[SHA512_DIGEST_SIZE];
++ int nents = edesc->dst_nents ? : 1;
++ unsigned int len = req->assoclen + req->cryptlen;
++
+ /* auth check */
+- sg = sg_last(req->dst, edesc->dst_nents ? : 1);
+- icv = (char *)sg_virt(sg) + sg->length - authsize;
++ if (nents > 1) {
++ sg_pcopy_to_buffer(req->dst, nents, icvdata, authsize,
++ len - authsize);
++ icv = icvdata;
++ } else {
++ icv = (char *)sg_virt(req->dst) + len - authsize;
++ }
+
+ if (edesc->dma_len) {
+ if (is_sec1)
+@@ -1463,7 +1469,6 @@ static int aead_decrypt(struct aead_request *req)
+ struct talitos_ctx *ctx = crypto_aead_ctx(authenc);
+ struct talitos_private *priv = dev_get_drvdata(ctx->dev);
+ struct talitos_edesc *edesc;
+- struct scatterlist *sg;
+ void *icvdata;
+
+ req->cryptlen -= authsize;
+@@ -1497,9 +1502,8 @@ static int aead_decrypt(struct aead_request *req)
+ else
+ icvdata = &edesc->link_tbl[0];
+
+- sg = sg_last(req->src, edesc->src_nents ? : 1);
+-
+- memcpy(icvdata, (char *)sg_virt(sg) + sg->length - authsize, authsize);
++ sg_pcopy_to_buffer(req->src, edesc->src_nents ? : 1, icvdata, authsize,
++ req->assoclen + req->cryptlen - authsize);
+
+ return ipsec_esp(edesc, req, ipsec_esp_decrypt_swauth_done);
+ }
+@@ -1553,11 +1557,15 @@ static void ablkcipher_done(struct device *dev,
+ int err)
+ {
+ struct ablkcipher_request *areq = context;
++ struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq);
++ struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher);
++ unsigned int ivsize = crypto_ablkcipher_ivsize(cipher);
+ struct talitos_edesc *edesc;
+
+ edesc = container_of(desc, struct talitos_edesc, desc);
+
+ common_nonsnoop_unmap(dev, edesc, areq);
++ memcpy(areq->info, ctx->iv, ivsize);
+
+ kfree(edesc);
+
+@@ -3185,7 +3193,10 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
+ alg->cra_priority = t_alg->algt.priority;
+ else
+ alg->cra_priority = TALITOS_CRA_PRIORITY;
+- alg->cra_alignmask = 0;
++ if (has_ftr_sec1(priv))
++ alg->cra_alignmask = 3;
++ else
++ alg->cra_alignmask = 0;
+ alg->cra_ctxsize = sizeof(struct talitos_ctx);
+ alg->cra_flags |= CRYPTO_ALG_KERN_DRIVER_ONLY;
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index 1c658ec3cbf4..3f5a01cb4ab4 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -2039,27 +2039,6 @@ static int sdma_probe(struct platform_device *pdev)
+ if (pdata && pdata->script_addrs)
+ sdma_add_scripts(sdma, pdata->script_addrs);
+
+- if (pdata) {
+- ret = sdma_get_firmware(sdma, pdata->fw_name);
+- if (ret)
+- dev_warn(&pdev->dev, "failed to get firmware from platform data\n");
+- } else {
+- /*
+- * Because that device tree does not encode ROM script address,
+- * the RAM script in firmware is mandatory for device tree
+- * probe, otherwise it fails.
+- */
+- ret = of_property_read_string(np, "fsl,sdma-ram-script-name",
+- &fw_name);
+- if (ret)
+- dev_warn(&pdev->dev, "failed to get firmware name\n");
+- else {
+- ret = sdma_get_firmware(sdma, fw_name);
+- if (ret)
+- dev_warn(&pdev->dev, "failed to get firmware from device tree\n");
+- }
+- }
+-
+ sdma->dma_device.dev = &pdev->dev;
+
+ sdma->dma_device.device_alloc_chan_resources = sdma_alloc_chan_resources;
+@@ -2103,6 +2082,33 @@ static int sdma_probe(struct platform_device *pdev)
+ of_node_put(spba_bus);
+ }
+
++ /*
++ * Kick off firmware loading as the very last step:
++ * attempt to load firmware only if we're not on the error path, because
++ * the firmware callback requires a fully functional and allocated sdma
++ * instance.
++ */
++ if (pdata) {
++ ret = sdma_get_firmware(sdma, pdata->fw_name);
++ if (ret)
++ dev_warn(&pdev->dev, "failed to get firmware from platform data\n");
++ } else {
++ /*
++ * Because that device tree does not encode ROM script address,
++ * the RAM script in firmware is mandatory for device tree
++ * probe, otherwise it fails.
++ */
++ ret = of_property_read_string(np, "fsl,sdma-ram-script-name",
++ &fw_name);
++ if (ret) {
++ dev_warn(&pdev->dev, "failed to get firmware name\n");
++ } else {
++ ret = sdma_get_firmware(sdma, fw_name);
++ if (ret)
++ dev_warn(&pdev->dev, "failed to get firmware from device tree\n");
++ }
++ }
++
+ return 0;
+
+ err_register:
+diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
+index 20374b8248f0..d4545a9222a0 100644
+--- a/drivers/edac/edac_mc_sysfs.c
++++ b/drivers/edac/edac_mc_sysfs.c
+@@ -26,7 +26,7 @@
+ static int edac_mc_log_ue = 1;
+ static int edac_mc_log_ce = 1;
+ static int edac_mc_panic_on_ue;
+-static int edac_mc_poll_msec = 1000;
++static unsigned int edac_mc_poll_msec = 1000;
+
+ /* Getter functions for above */
+ int edac_mc_get_log_ue(void)
+@@ -45,30 +45,30 @@ int edac_mc_get_panic_on_ue(void)
+ }
+
+ /* this is temporary */
+-int edac_mc_get_poll_msec(void)
++unsigned int edac_mc_get_poll_msec(void)
+ {
+ return edac_mc_poll_msec;
+ }
+
+ static int edac_set_poll_msec(const char *val, const struct kernel_param *kp)
+ {
+- unsigned long l;
++ unsigned int i;
+ int ret;
+
+ if (!val)
+ return -EINVAL;
+
+- ret = kstrtoul(val, 0, &l);
++ ret = kstrtouint(val, 0, &i);
+ if (ret)
+ return ret;
+
+- if (l < 1000)
++ if (i < 1000)
+ return -EINVAL;
+
+- *((unsigned long *)kp->arg) = l;
++ *((unsigned int *)kp->arg) = i;
+
+ /* notify edac_mc engine to reset the poll period */
+- edac_mc_reset_delay_period(l);
++ edac_mc_reset_delay_period(i);
+
+ return 0;
+ }
+@@ -82,7 +82,7 @@ MODULE_PARM_DESC(edac_mc_log_ue,
+ module_param(edac_mc_log_ce, int, 0644);
+ MODULE_PARM_DESC(edac_mc_log_ce,
+ "Log correctable error to console: 0=off 1=on");
+-module_param_call(edac_mc_poll_msec, edac_set_poll_msec, param_get_int,
++module_param_call(edac_mc_poll_msec, edac_set_poll_msec, param_get_uint,
+ &edac_mc_poll_msec, 0644);
+ MODULE_PARM_DESC(edac_mc_poll_msec, "Polling period in milliseconds");
+
+@@ -404,6 +404,8 @@ static inline int nr_pages_per_csrow(struct csrow_info *csrow)
+ static int edac_create_csrow_object(struct mem_ctl_info *mci,
+ struct csrow_info *csrow, int index)
+ {
++ int err;
++
+ csrow->dev.type = &csrow_attr_type;
+ csrow->dev.bus = mci->bus;
+ csrow->dev.groups = csrow_dev_groups;
+@@ -416,7 +418,11 @@ static int edac_create_csrow_object(struct mem_ctl_info *mci,
+ edac_dbg(0, "creating (virtual) csrow node %s\n",
+ dev_name(&csrow->dev));
+
+- return device_add(&csrow->dev);
++ err = device_add(&csrow->dev);
++ if (err)
++ put_device(&csrow->dev);
++
++ return err;
+ }
+
+ /* Create a CSROW object under specifed edac_mc_device */
+diff --git a/drivers/edac/edac_module.h b/drivers/edac/edac_module.h
+index dec88dcea036..c9f0e73872a6 100644
+--- a/drivers/edac/edac_module.h
++++ b/drivers/edac/edac_module.h
+@@ -36,7 +36,7 @@ extern int edac_mc_get_log_ue(void);
+ extern int edac_mc_get_log_ce(void);
+ extern int edac_mc_get_panic_on_ue(void);
+ extern int edac_get_poll_msec(void);
+-extern int edac_mc_get_poll_msec(void);
++extern unsigned int edac_mc_get_poll_msec(void);
+
+ unsigned edac_dimm_info_location(struct dimm_info *dimm, char *buf,
+ unsigned len);
+diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
+index 6fa430d98517..feabac40743e 100644
+--- a/drivers/gpio/gpio-omap.c
++++ b/drivers/gpio/gpio-omap.c
+@@ -837,9 +837,9 @@ static void omap_gpio_irq_shutdown(struct irq_data *d)
+
+ raw_spin_lock_irqsave(&bank->lock, flags);
+ bank->irq_usage &= ~(BIT(offset));
+- omap_set_gpio_irqenable(bank, offset, 0);
+- omap_clear_gpio_irqstatus(bank, offset);
+ omap_set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
++ omap_clear_gpio_irqstatus(bank, offset);
++ omap_set_gpio_irqenable(bank, offset, 0);
+ if (!LINE_USED(bank->mod_usage, offset))
+ omap_clear_gpio_debounce(bank, offset);
+ omap_disable_gpio_module(bank, offset);
+@@ -881,8 +881,8 @@ static void omap_gpio_mask_irq(struct irq_data *d)
+ unsigned long flags;
+
+ raw_spin_lock_irqsave(&bank->lock, flags);
+- omap_set_gpio_irqenable(bank, offset, 0);
+ omap_set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
++ omap_set_gpio_irqenable(bank, offset, 0);
+ raw_spin_unlock_irqrestore(&bank->lock, flags);
+ }
+
+@@ -894,9 +894,6 @@ static void omap_gpio_unmask_irq(struct irq_data *d)
+ unsigned long flags;
+
+ raw_spin_lock_irqsave(&bank->lock, flags);
+- if (trigger)
+- omap_set_gpio_triggering(bank, offset, trigger);
+-
+ omap_set_gpio_irqenable(bank, offset, 1);
+
+ /*
+@@ -904,9 +901,13 @@ static void omap_gpio_unmask_irq(struct irq_data *d)
+ * is cleared, thus after the handler has run. OMAP4 needs this done
+ * after enabing the interrupt to clear the wakeup status.
+ */
+- if (bank->level_mask & BIT(offset))
++ if (bank->regs->leveldetect0 && bank->regs->wkup_en &&
++ trigger & (IRQ_TYPE_LEVEL_HIGH | IRQ_TYPE_LEVEL_LOW))
+ omap_clear_gpio_irqstatus(bank, offset);
+
++ if (trigger)
++ omap_set_gpio_triggering(bank, offset, trigger);
++
+ raw_spin_unlock_irqrestore(&bank->lock, flags);
+ }
+
+@@ -1687,6 +1688,8 @@ static struct omap_gpio_reg_offs omap4_gpio_regs = {
+ .clr_dataout = OMAP4_GPIO_CLEARDATAOUT,
+ .irqstatus = OMAP4_GPIO_IRQSTATUS0,
+ .irqstatus2 = OMAP4_GPIO_IRQSTATUS1,
++ .irqstatus_raw0 = OMAP4_GPIO_IRQSTATUSRAW0,
++ .irqstatus_raw1 = OMAP4_GPIO_IRQSTATUSRAW1,
+ .irqenable = OMAP4_GPIO_IRQSTATUSSET0,
+ .irqenable2 = OMAP4_GPIO_IRQSTATUSSET1,
+ .set_irqenable = OMAP4_GPIO_IRQSTATUSSET0,
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index fd713326dcfc..4a48c7c47709 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2877,7 +2877,7 @@ int gpiod_get_array_value_complex(bool raw, bool can_sleep,
+ int gpiod_get_raw_value(const struct gpio_desc *desc)
+ {
+ VALIDATE_DESC(desc);
+- /* Should be using gpio_get_value_cansleep() */
++ /* Should be using gpiod_get_raw_value_cansleep() */
+ WARN_ON(desc->gdev->chip->can_sleep);
+ return gpiod_get_raw_value_commit(desc);
+ }
+@@ -2898,7 +2898,7 @@ int gpiod_get_value(const struct gpio_desc *desc)
+ int value;
+
+ VALIDATE_DESC(desc);
+- /* Should be using gpio_get_value_cansleep() */
++ /* Should be using gpiod_get_value_cansleep() */
+ WARN_ON(desc->gdev->chip->can_sleep);
+
+ value = gpiod_get_raw_value_commit(desc);
+@@ -3123,7 +3123,7 @@ int gpiod_set_array_value_complex(bool raw, bool can_sleep,
+ void gpiod_set_raw_value(struct gpio_desc *desc, int value)
+ {
+ VALIDATE_DESC_VOID(desc);
+- /* Should be using gpiod_set_value_cansleep() */
++ /* Should be using gpiod_set_raw_value_cansleep() */
+ WARN_ON(desc->gdev->chip->can_sleep);
+ gpiod_set_raw_value_commit(desc, value);
+ }
+@@ -3164,6 +3164,7 @@ static void gpiod_set_value_nocheck(struct gpio_desc *desc, int value)
+ void gpiod_set_value(struct gpio_desc *desc, int value)
+ {
+ VALIDATE_DESC_VOID(desc);
++ /* Should be using gpiod_set_value_cansleep() */
+ WARN_ON(desc->gdev->chip->can_sleep);
+ gpiod_set_value_nocheck(desc, value);
+ }
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 5965f6383ada..e5e7e65934da 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -1349,6 +1349,7 @@ MODULE_PARM_DESC(edid_fixup,
+
+ static void drm_get_displayid(struct drm_connector *connector,
+ struct edid *edid);
++static int validate_displayid(u8 *displayid, int length, int idx);
+
+ static int drm_edid_block_checksum(const u8 *raw_edid)
+ {
+@@ -2932,16 +2933,46 @@ static u8 *drm_find_edid_extension(const struct edid *edid, int ext_id)
+ return edid_ext;
+ }
+
+-static u8 *drm_find_cea_extension(const struct edid *edid)
+-{
+- return drm_find_edid_extension(edid, CEA_EXT);
+-}
+
+ static u8 *drm_find_displayid_extension(const struct edid *edid)
+ {
+ return drm_find_edid_extension(edid, DISPLAYID_EXT);
+ }
+
++static u8 *drm_find_cea_extension(const struct edid *edid)
++{
++ int ret;
++ int idx = 1;
++ int length = EDID_LENGTH;
++ struct displayid_block *block;
++ u8 *cea;
++ u8 *displayid;
++
++ /* Look for a top level CEA extension block */
++ cea = drm_find_edid_extension(edid, CEA_EXT);
++ if (cea)
++ return cea;
++
++ /* CEA blocks can also be found embedded in a DisplayID block */
++ displayid = drm_find_displayid_extension(edid);
++ if (!displayid)
++ return NULL;
++
++ ret = validate_displayid(displayid, length, idx);
++ if (ret)
++ return NULL;
++
++ idx += sizeof(struct displayid_hdr);
++ for_each_displayid_db(displayid, block, idx, length) {
++ if (block->tag == DATA_BLOCK_CTA) {
++ cea = (u8 *)block;
++ break;
++ }
++ }
++
++ return cea;
++}
++
+ /*
+ * Calculate the alternate clock for the CEA mode
+ * (60Hz vs. 59.94Hz etc.)
+@@ -3665,13 +3696,38 @@ cea_revision(const u8 *cea)
+ static int
+ cea_db_offsets(const u8 *cea, int *start, int *end)
+ {
+- /* Data block offset in CEA extension block */
+- *start = 4;
+- *end = cea[2];
+- if (*end == 0)
+- *end = 127;
+- if (*end < 4 || *end > 127)
+- return -ERANGE;
++ /* DisplayID CTA extension blocks and top-level CEA EDID
++ * block header definitions differ in the following bytes:
++ * 1) Byte 2 of the header specifies length differently,
++ * 2) Byte 3 is only present in the CEA top level block.
++ *
++ * The different definitions for byte 2 follow.
++ *
++ * DisplayID CTA extension block defines byte 2 as:
++ * Number of payload bytes
++ *
++ * CEA EDID block defines byte 2 as:
++ * Byte number (decimal) within this block where the 18-byte
++ * DTDs begin. If no non-DTD data is present in this extension
++ * block, the value should be set to 04h (the byte after next).
++ * If set to 00h, there are no DTDs present in this block and
++ * no non-DTD data.
++ */
++ if (cea[0] == DATA_BLOCK_CTA) {
++ *start = 3;
++ *end = *start + cea[2];
++ } else if (cea[0] == CEA_EXT) {
++ /* Data block offset in CEA extension block */
++ *start = 4;
++ *end = cea[2];
++ if (*end == 0)
++ *end = 127;
++ if (*end < 4 || *end > 127)
++ return -ERANGE;
++ } else {
++ return -ENOTSUPP;
++ }
++
+ return 0;
+ }
+
+@@ -5218,6 +5274,9 @@ static int drm_parse_display_id(struct drm_connector *connector,
+ case DATA_BLOCK_TYPE_1_DETAILED_TIMING:
+ /* handled in mode gathering code. */
+ break;
++ case DATA_BLOCK_CTA:
++ /* handled in the cea parser code. */
++ break;
+ default:
+ DRM_DEBUG_KMS("found DisplayID tag 0x%x, unhandled\n", block->tag);
+ break;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
+index ecacb22834d7..719345074711 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c
+@@ -184,6 +184,25 @@ nvkm_i2c_fini(struct nvkm_subdev *subdev, bool suspend)
+ return 0;
+ }
+
++static int
++nvkm_i2c_preinit(struct nvkm_subdev *subdev)
++{
++ struct nvkm_i2c *i2c = nvkm_i2c(subdev);
++ struct nvkm_i2c_bus *bus;
++ struct nvkm_i2c_pad *pad;
++
++ /*
++ * We init our i2c busses as early as possible, since they may be
++ * needed by the vbios init scripts on some cards
++ */
++ list_for_each_entry(pad, &i2c->pad, head)
++ nvkm_i2c_pad_init(pad);
++ list_for_each_entry(bus, &i2c->bus, head)
++ nvkm_i2c_bus_init(bus);
++
++ return 0;
++}
++
+ static int
+ nvkm_i2c_init(struct nvkm_subdev *subdev)
+ {
+@@ -238,6 +257,7 @@ nvkm_i2c_dtor(struct nvkm_subdev *subdev)
+ static const struct nvkm_subdev_func
+ nvkm_i2c = {
+ .dtor = nvkm_i2c_dtor,
++ .preinit = nvkm_i2c_preinit,
+ .init = nvkm_i2c_init,
+ .fini = nvkm_i2c_fini,
+ .intr = nvkm_i2c_intr,
+diff --git a/drivers/gpu/ipu-v3/ipu-ic.c b/drivers/gpu/ipu-v3/ipu-ic.c
+index 67cc820253a9..fb79e118f26c 100644
+--- a/drivers/gpu/ipu-v3/ipu-ic.c
++++ b/drivers/gpu/ipu-v3/ipu-ic.c
+@@ -257,7 +257,7 @@ static int init_csc(struct ipu_ic *ic,
+ writel(param, base++);
+
+ param = ((a[0] & 0x1fe0) >> 5) | (params->scale << 8) |
+- (params->sat << 9);
++ (params->sat << 10);
+ writel(param, base++);
+
+ param = ((a[1] & 0x1f) << 27) | ((c[0][1] & 0x1ff) << 18) |
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 0bdd85d486fe..9cd4705b74bd 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -275,6 +275,9 @@ static void wacom_feature_mapping(struct hid_device *hdev,
+ wacom_hid_usage_quirk(hdev, field, usage);
+
+ switch (equivalent_usage) {
++ case WACOM_HID_WD_TOUCH_RING_SETTING:
++ wacom->generic_has_leds = true;
++ break;
+ case HID_DG_CONTACTMAX:
+ /* leave touch_max as is if predefined */
+ if (!features->touch_max) {
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index d7c3f4ac2c04..0ae848369474 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -1928,8 +1928,6 @@ static void wacom_wac_pad_usage_mapping(struct hid_device *hdev,
+ features->device_type |= WACOM_DEVICETYPE_PAD;
+ break;
+ case WACOM_HID_WD_BUTTONCENTER:
+- wacom->generic_has_leds = true;
+- /* fall through */
+ case WACOM_HID_WD_BUTTONHOME:
+ case WACOM_HID_WD_BUTTONUP:
+ case WACOM_HID_WD_BUTTONDOWN:
+@@ -2121,14 +2119,12 @@ static void wacom_wac_pad_report(struct hid_device *hdev,
+ bool active = wacom_wac->hid_data.inrange_state != 0;
+
+ /* report prox for expresskey events */
+- if ((wacom_equivalent_usage(field->physical) == HID_DG_TABLETFUNCTIONKEY) &&
+- wacom_wac->hid_data.pad_input_event_flag) {
++ if (wacom_wac->hid_data.pad_input_event_flag) {
+ input_event(input, EV_ABS, ABS_MISC, active ? PAD_DEVICE_ID : 0);
+ input_sync(input);
+ if (!active)
+ wacom_wac->hid_data.pad_input_event_flag = false;
+ }
+-
+ }
+
+ static void wacom_wac_pen_usage_mapping(struct hid_device *hdev,
+@@ -2725,9 +2721,7 @@ static int wacom_wac_collection(struct hid_device *hdev, struct hid_report *repo
+ if (report->type != HID_INPUT_REPORT)
+ return -1;
+
+- if (WACOM_PAD_FIELD(field) && wacom->wacom_wac.pad_input)
+- wacom_wac_pad_report(hdev, report, field);
+- else if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input)
++ if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input)
+ wacom_wac_pen_report(hdev, report);
+ else if (WACOM_FINGER_FIELD(field) && wacom->wacom_wac.touch_input)
+ wacom_wac_finger_report(hdev, report);
+@@ -2741,7 +2735,7 @@ void wacom_wac_report(struct hid_device *hdev, struct hid_report *report)
+ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+ struct hid_field *field;
+ bool pad_in_hid_field = false, pen_in_hid_field = false,
+- finger_in_hid_field = false;
++ finger_in_hid_field = false, true_pad = false;
+ int r;
+ int prev_collection = -1;
+
+@@ -2757,6 +2751,8 @@ void wacom_wac_report(struct hid_device *hdev, struct hid_report *report)
+ pen_in_hid_field = true;
+ if (WACOM_FINGER_FIELD(field))
+ finger_in_hid_field = true;
++ if (wacom_equivalent_usage(field->physical) == HID_DG_TABLETFUNCTIONKEY)
++ true_pad = true;
+ }
+
+ wacom_wac_battery_pre_report(hdev, report);
+@@ -2780,6 +2776,9 @@ void wacom_wac_report(struct hid_device *hdev, struct hid_report *report)
+ }
+
+ wacom_wac_battery_report(hdev, report);
++
++ if (true_pad && wacom->wacom_wac.pad_input)
++ wacom_wac_pad_report(hdev, report, field);
+ }
+
+ static int wacom_bpt_touch(struct wacom_wac *wacom)
+@@ -3735,7 +3734,7 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
+ 0, 5920, 4, 0);
+ }
+ input_abs_set_res(input_dev, ABS_MT_POSITION_X, 40);
+- input_abs_set_res(input_dev, ABS_MT_POSITION_X, 40);
++ input_abs_set_res(input_dev, ABS_MT_POSITION_Y, 40);
+
+ /* fall through */
+
+diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
+index 295fd3718caa..f67d871841c0 100644
+--- a/drivers/hid/wacom_wac.h
++++ b/drivers/hid/wacom_wac.h
+@@ -145,6 +145,7 @@
+ #define WACOM_HID_WD_OFFSETBOTTOM (WACOM_HID_UP_WACOMDIGITIZER | 0x0d33)
+ #define WACOM_HID_WD_DATAMODE (WACOM_HID_UP_WACOMDIGITIZER | 0x1002)
+ #define WACOM_HID_WD_DIGITIZERINFO (WACOM_HID_UP_WACOMDIGITIZER | 0x1013)
++#define WACOM_HID_WD_TOUCH_RING_SETTING (WACOM_HID_UP_WACOMDIGITIZER | 0x1032)
+ #define WACOM_HID_UP_G9 0xff090000
+ #define WACOM_HID_G9_PEN (WACOM_HID_UP_G9 | 0x02)
+ #define WACOM_HID_G9_TOUCHSCREEN (WACOM_HID_UP_G9 | 0x11)
+diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
+index 8ff326c0c406..3cdf85b1ce4f 100644
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -632,7 +632,7 @@ static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size)
+ goto err_out;
+
+ ret = -ENOMEM;
+- page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
++ page = alloc_pages(GFP_KERNEL | __GFP_ZERO | GFP_DMA32, order);
+ if (!page)
+ goto err_free_sgt;
+
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 70f2cb90adc5..e759ac0d48be 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -170,6 +170,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x02a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Ice Lake NNPI */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ { 0 },
+ };
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 8cc4da62f050..53eccc0da8fd 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -939,15 +939,19 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ }
+
+ if (MLX5_CAP_GEN(mdev, tag_matching)) {
+- props->tm_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
+ props->tm_caps.max_num_tags =
+ (1 << MLX5_CAP_GEN(mdev, log_tag_matching_list_sz)) - 1;
+- props->tm_caps.flags = IB_TM_CAP_RC;
+ props->tm_caps.max_ops =
+ 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
+ props->tm_caps.max_sge = MLX5_TM_MAX_SGE;
+ }
+
++ if (MLX5_CAP_GEN(mdev, tag_matching) &&
++ MLX5_CAP_GEN(mdev, rndv_offload_rc)) {
++ props->tm_caps.flags = IB_TM_CAP_RNDV_RC;
++ props->tm_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
++ }
++
+ if (MLX5_CAP_GEN(dev->mdev, cq_moderation)) {
+ props->cq_caps.max_cq_moderation_count =
+ MLX5_MAX_CQ_COUNT;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 30f840f874b3..009615499b37 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1997,6 +1997,7 @@ static int ipoib_get_vf_config(struct net_device *dev, int vf,
+ return err;
+
+ ivf->vf = vf;
++ memcpy(ivf->mac, dev->dev_addr, dev->addr_len);
+
+ return 0;
+ }
+diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
+index 0a6f7ca883e7..dd80ff6cc427 100644
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -24,6 +24,7 @@
+
+ #include "psmouse.h"
+ #include "alps.h"
++#include "trackpoint.h"
+
+ /*
+ * Definitions for ALPS version 3 and 4 command mode protocol
+@@ -2864,6 +2865,23 @@ static const struct alps_protocol_info *alps_match_table(unsigned char *e7,
+ return NULL;
+ }
+
++static bool alps_is_cs19_trackpoint(struct psmouse *psmouse)
++{
++ u8 param[2] = { 0 };
++
++ if (ps2_command(&psmouse->ps2dev,
++ param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
++ return false;
++
++ /*
++ * param[0] contains the trackpoint device variant_id while
++ * param[1] contains the firmware_id. So far all alps
++ * trackpoint-only devices have their variant_ids equal
++ * TP_VARIANT_ALPS and their firmware_ids are in 0x20~0x2f range.
++ */
++ return param[0] == TP_VARIANT_ALPS && ((param[1] & 0xf0) == 0x20);
++}
++
+ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
+ {
+ const struct alps_protocol_info *protocol;
+@@ -3164,6 +3182,20 @@ int alps_detect(struct psmouse *psmouse, bool set_properties)
+ if (error)
+ return error;
+
++ /*
++ * ALPS cs19 is a trackpoint-only device, and uses different
++ * protocol than DualPoint ones, so we return -EINVAL here and let
++ * trackpoint.c drive this device. If the trackpoint driver is not
++ * enabled, the device will fall back to a bare PS/2 mouse.
++ * If ps2_command() fails here, we depend on the immediately
++ * followed psmouse_reset() to reset the device to normal state.
++ */
++ if (alps_is_cs19_trackpoint(psmouse)) {
++ psmouse_dbg(psmouse,
++ "ALPS CS19 trackpoint-only device detected, ignoring\n");
++ return -EINVAL;
++ }
++
+ /*
+ * Reset the device to make sure it is fully operational:
+ * on some laptops, like certain Dell Latitudes, we may
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 68fd8232d44c..af7d48431b85 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -179,6 +179,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0093", /* T480 */
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
++ "LEN009b", /* T580 */
+ "LEN200f", /* T450s */
+ "LEN2054", /* E480 */
+ "LEN2055", /* E580 */
+diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
+index 4b8b9d7aa75e..35031228a6d0 100644
+--- a/drivers/input/tablet/gtco.c
++++ b/drivers/input/tablet/gtco.c
+@@ -78,6 +78,7 @@ Scott Hill shill@gtcocalcomp.com
+
+ /* Max size of a single report */
+ #define REPORT_MAX_SIZE 10
++#define MAX_COLLECTION_LEVELS 10
+
+
+ /* Bitmask whether pen is in range */
+@@ -223,8 +224,7 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
+ char maintype = 'x';
+ char globtype[12];
+ int indent = 0;
+- char indentstr[10] = "";
+-
++ char indentstr[MAX_COLLECTION_LEVELS + 1] = { 0 };
+
+ dev_dbg(ddev, "======>>>>>>PARSE<<<<<<======\n");
+
+@@ -350,6 +350,13 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
+ case TAG_MAIN_COL_START:
+ maintype = 'S';
+
++ if (indent == MAX_COLLECTION_LEVELS) {
++ dev_err(ddev, "Collection level %d would exceed limit of %d\n",
++ indent + 1,
++ MAX_COLLECTION_LEVELS);
++ break;
++ }
++
+ if (data == 0) {
+ dev_dbg(ddev, "======>>>>>> Physical\n");
+ strcpy(globtype, "Physical");
+@@ -369,8 +376,15 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
+ break;
+
+ case TAG_MAIN_COL_END:
+- dev_dbg(ddev, "<<<<<<======\n");
+ maintype = 'E';
++
++ if (indent == 0) {
++ dev_err(ddev, "Collection level already at zero\n");
++ break;
++ }
++
++ dev_dbg(ddev, "<<<<<<======\n");
++
+ indent--;
+ for (x = 0; x < indent; x++)
+ indentstr[x] = '-';
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 8c15c5980299..bc14825edc9c 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -211,18 +211,21 @@ static int iommu_insert_resv_region(struct iommu_resv_region *new,
+ pos = pos->next;
+ } else if ((start >= a) && (end <= b)) {
+ if (new->type == type)
+- goto done;
++ return 0;
+ else
+ pos = pos->next;
+ } else {
+ if (new->type == type) {
+ phys_addr_t new_start = min(a, start);
+ phys_addr_t new_end = max(b, end);
++ int ret;
+
+ list_del(&entry->list);
+ entry->start = new_start;
+ entry->length = new_end - new_start + 1;
+- iommu_insert_resv_region(entry, regions);
++ ret = iommu_insert_resv_region(entry, regions);
++ kfree(entry);
++ return ret;
+ } else {
+ pos = pos->next;
+ }
+@@ -235,7 +238,6 @@ insert:
+ return -ENOMEM;
+
+ list_add_tail(®ion->list, pos);
+-done:
+ return 0;
+ }
+
+diff --git a/drivers/irqchip/irq-meson-gpio.c b/drivers/irqchip/irq-meson-gpio.c
+index 7b531fd075b8..7599b10ecf09 100644
+--- a/drivers/irqchip/irq-meson-gpio.c
++++ b/drivers/irqchip/irq-meson-gpio.c
+@@ -73,6 +73,7 @@ static const struct of_device_id meson_irq_gpio_matches[] = {
+ { .compatible = "amlogic,meson-gxbb-gpio-intc", .data = &gxbb_params },
+ { .compatible = "amlogic,meson-gxl-gpio-intc", .data = &gxl_params },
+ { .compatible = "amlogic,meson-axg-gpio-intc", .data = &axg_params },
++ { .compatible = "amlogic,meson-g12a-gpio-intc", .data = &axg_params },
+ { }
+ };
+
+diff --git a/drivers/lightnvm/pblk-core.c b/drivers/lightnvm/pblk-core.c
+index 95be6e36c7dd..80710c62ac29 100644
+--- a/drivers/lightnvm/pblk-core.c
++++ b/drivers/lightnvm/pblk-core.c
+@@ -288,14 +288,16 @@ void pblk_free_rqd(struct pblk *pblk, struct nvm_rq *rqd, int type)
+ void pblk_bio_free_pages(struct pblk *pblk, struct bio *bio, int off,
+ int nr_pages)
+ {
+- struct bio_vec bv;
+- int i;
+-
+- WARN_ON(off + nr_pages != bio->bi_vcnt);
+-
+- for (i = off; i < nr_pages + off; i++) {
+- bv = bio->bi_io_vec[i];
+- mempool_free(bv.bv_page, &pblk->page_bio_pool);
++ struct bio_vec *bv;
++ struct page *page;
++ int i, e, nbv = 0;
++
++ for (i = 0; i < bio->bi_vcnt; i++) {
++ bv = &bio->bi_io_vec[i];
++ page = bv->bv_page;
++ for (e = 0; e < bv->bv_len; e += PBLK_EXPOSED_PAGE_SIZE, nbv++)
++ if (nbv >= off)
++ mempool_free(page++, &pblk->page_bio_pool);
+ }
+ }
+
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index de85b3af3b39..9c3beb1e382b 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -393,6 +393,11 @@ long bch_bucket_alloc(struct cache *ca, unsigned int reserve, bool wait)
+ struct bucket *b;
+ long r;
+
++
++ /* No allocation if CACHE_SET_IO_DISABLE bit is set */
++ if (unlikely(test_bit(CACHE_SET_IO_DISABLE, &ca->set->flags)))
++ return -1;
++
+ /* fastpath */
+ if (fifo_pop(&ca->free[RESERVE_NONE], r) ||
+ fifo_pop(&ca->free[reserve], r))
+@@ -484,6 +489,10 @@ int __bch_bucket_alloc_set(struct cache_set *c, unsigned int reserve,
+ {
+ int i;
+
++ /* No allocation if CACHE_SET_IO_DISABLE bit is set */
++ if (unlikely(test_bit(CACHE_SET_IO_DISABLE, &c->flags)))
++ return -1;
++
+ lockdep_assert_held(&c->bucket_lock);
+ BUG_ON(!n || n > c->caches_loaded || n > 8);
+
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index 954dad29e6e8..83f0b91aeb90 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -708,8 +708,6 @@ struct cache_set {
+
+ #define BUCKET_HASH_BITS 12
+ struct hlist_head bucket_hash[1 << BUCKET_HASH_BITS];
+-
+- DECLARE_HEAP(struct btree *, flush_btree);
+ };
+
+ struct bbio {
+diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
+index c25097968319..4d93f07f63e5 100644
+--- a/drivers/md/bcache/io.c
++++ b/drivers/md/bcache/io.c
+@@ -58,6 +58,18 @@ void bch_count_backing_io_errors(struct cached_dev *dc, struct bio *bio)
+
+ WARN_ONCE(!dc, "NULL pointer of struct cached_dev");
+
++ /*
++ * Read-ahead requests on a degrading and recovering md raid
++ * (e.g. raid6) device might be failured immediately by md
++ * raid code, which is not a real hardware media failure. So
++ * we shouldn't count failed REQ_RAHEAD bio to dc->io_errors.
++ */
++ if (bio->bi_opf & REQ_RAHEAD) {
++ pr_warn_ratelimited("%s: Read-ahead I/O failed on backing device, ignore",
++ dc->backing_dev_name);
++ return;
++ }
++
+ errors = atomic_add_return(1, &dc->io_errors);
+ if (errors < dc->error_limit)
+ pr_err("%s: IO error on backing device, unrecoverable",
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index f880e5eba8dd..ec1e35a62934 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -390,12 +390,6 @@ err:
+ }
+
+ /* Journalling */
+-#define journal_max_cmp(l, r) \
+- (fifo_idx(&c->journal.pin, btree_current_write(l)->journal) < \
+- fifo_idx(&(c)->journal.pin, btree_current_write(r)->journal))
+-#define journal_min_cmp(l, r) \
+- (fifo_idx(&c->journal.pin, btree_current_write(l)->journal) > \
+- fifo_idx(&(c)->journal.pin, btree_current_write(r)->journal))
+
+ static void btree_flush_write(struct cache_set *c)
+ {
+@@ -403,35 +397,25 @@ static void btree_flush_write(struct cache_set *c)
+ * Try to find the btree node with that references the oldest journal
+ * entry, best is our current candidate and is locked if non NULL:
+ */
+- struct btree *b;
+- int i;
++ struct btree *b, *best;
++ unsigned int i;
+
+ atomic_long_inc(&c->flush_write);
+-
+ retry:
+- spin_lock(&c->journal.lock);
+- if (heap_empty(&c->flush_btree)) {
+- for_each_cached_btree(b, c, i)
+- if (btree_current_write(b)->journal) {
+- if (!heap_full(&c->flush_btree))
+- heap_add(&c->flush_btree, b,
+- journal_max_cmp);
+- else if (journal_max_cmp(b,
+- heap_peek(&c->flush_btree))) {
+- c->flush_btree.data[0] = b;
+- heap_sift(&c->flush_btree, 0,
+- journal_max_cmp);
+- }
++ best = NULL;
++
++ for_each_cached_btree(b, c, i)
++ if (btree_current_write(b)->journal) {
++ if (!best)
++ best = b;
++ else if (journal_pin_cmp(c,
++ btree_current_write(best)->journal,
++ btree_current_write(b)->journal)) {
++ best = b;
+ }
++ }
+
+- for (i = c->flush_btree.used / 2 - 1; i >= 0; --i)
+- heap_sift(&c->flush_btree, i, journal_min_cmp);
+- }
+-
+- b = NULL;
+- heap_pop(&c->flush_btree, b, journal_min_cmp);
+- spin_unlock(&c->journal.lock);
+-
++ b = best;
+ if (b) {
+ mutex_lock(&b->write_lock);
+ if (!btree_current_write(b)->journal) {
+@@ -810,6 +794,10 @@ atomic_t *bch_journal(struct cache_set *c,
+ struct journal_write *w;
+ atomic_t *ret;
+
++ /* No journaling if CACHE_SET_IO_DISABLE set already */
++ if (unlikely(test_bit(CACHE_SET_IO_DISABLE, &c->flags)))
++ return NULL;
++
+ if (!CACHE_SYNC(&c->sb))
+ return NULL;
+
+@@ -854,7 +842,6 @@ void bch_journal_free(struct cache_set *c)
+ free_pages((unsigned long) c->journal.w[1].data, JSET_BITS);
+ free_pages((unsigned long) c->journal.w[0].data, JSET_BITS);
+ free_fifo(&c->journal.pin);
+- free_heap(&c->flush_btree);
+ }
+
+ int bch_journal_alloc(struct cache_set *c)
+@@ -869,8 +856,7 @@ int bch_journal_alloc(struct cache_set *c)
+ j->w[0].c = c;
+ j->w[1].c = c;
+
+- if (!(init_heap(&c->flush_btree, 128, GFP_KERNEL)) ||
+- !(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) ||
++ if (!(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) ||
+ !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)) ||
+ !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)))
+ return -ENOMEM;
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 2409507d7bff..e6c7a84bb1df 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1180,18 +1180,16 @@ static void cached_dev_free(struct closure *cl)
+ {
+ struct cached_dev *dc = container_of(cl, struct cached_dev, disk.cl);
+
+- mutex_lock(&bch_register_lock);
+-
+ if (test_and_clear_bit(BCACHE_DEV_WB_RUNNING, &dc->disk.flags))
+ cancel_writeback_rate_update_dwork(dc);
+
+ if (!IS_ERR_OR_NULL(dc->writeback_thread))
+ kthread_stop(dc->writeback_thread);
+- if (dc->writeback_write_wq)
+- destroy_workqueue(dc->writeback_write_wq);
+ if (!IS_ERR_OR_NULL(dc->status_update_thread))
+ kthread_stop(dc->status_update_thread);
+
++ mutex_lock(&bch_register_lock);
++
+ if (atomic_read(&dc->running))
+ bd_unlink_disk_holder(dc->bdev, dc->disk.disk);
+ bcache_device_free(&dc->disk);
+@@ -1425,8 +1423,6 @@ int bch_flash_dev_create(struct cache_set *c, uint64_t size)
+
+ bool bch_cached_dev_error(struct cached_dev *dc)
+ {
+- struct cache_set *c;
+-
+ if (!dc || test_bit(BCACHE_DEV_CLOSING, &dc->disk.flags))
+ return false;
+
+@@ -1437,21 +1433,6 @@ bool bch_cached_dev_error(struct cached_dev *dc)
+ pr_err("stop %s: too many IO errors on backing device %s\n",
+ dc->disk.disk->disk_name, dc->backing_dev_name);
+
+- /*
+- * If the cached device is still attached to a cache set,
+- * even dc->io_disable is true and no more I/O requests
+- * accepted, cache device internal I/O (writeback scan or
+- * garbage collection) may still prevent bcache device from
+- * being stopped. So here CACHE_SET_IO_DISABLE should be
+- * set to c->flags too, to make the internal I/O to cache
+- * device rejected and stopped immediately.
+- * If c is NULL, that means the bcache device is not attached
+- * to any cache set, then no CACHE_SET_IO_DISABLE bit to set.
+- */
+- c = dc->disk.c;
+- if (c && test_and_set_bit(CACHE_SET_IO_DISABLE, &c->flags))
+- pr_info("CACHE_SET_IO_DISABLE already set");
+-
+ bcache_device_stop(&dc->disk);
+ return true;
+ }
+@@ -1552,7 +1533,7 @@ static void cache_set_flush(struct closure *cl)
+ kobject_put(&c->internal);
+ kobject_del(&c->kobj);
+
+- if (c->gc_thread)
++ if (!IS_ERR_OR_NULL(c->gc_thread))
+ kthread_stop(c->gc_thread);
+
+ if (!IS_ERR_OR_NULL(c->root))
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index 541454b4f479..5bb81e564ce8 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -175,7 +175,7 @@ SHOW(__bch_cached_dev)
+ var_print(writeback_percent);
+ sysfs_hprint(writeback_rate,
+ wb ? atomic_long_read(&dc->writeback_rate.rate) << 9 : 0);
+- sysfs_hprint(io_errors, atomic_read(&dc->io_errors));
++ sysfs_printf(io_errors, "%i", atomic_read(&dc->io_errors));
+ sysfs_printf(io_error_limit, "%i", dc->error_limit);
+ sysfs_printf(io_disable, "%i", dc->io_disable);
+ var_print(writeback_rate_update_seconds);
+@@ -426,7 +426,7 @@ static struct attribute *bch_cached_dev_files[] = {
+ &sysfs_writeback_rate_p_term_inverse,
+ &sysfs_writeback_rate_minimum,
+ &sysfs_writeback_rate_debug,
+- &sysfs_errors,
++ &sysfs_io_errors,
+ &sysfs_io_error_limit,
+ &sysfs_io_disable,
+ &sysfs_dirty_data,
+diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
+index 00aab6abcfe4..b1f5b7aea872 100644
+--- a/drivers/md/bcache/util.h
++++ b/drivers/md/bcache/util.h
+@@ -113,8 +113,6 @@ do { \
+
+ #define heap_full(h) ((h)->used == (h)->size)
+
+-#define heap_empty(h) ((h)->used == 0)
+-
+ #define DECLARE_FIFO(type, name) \
+ struct { \
+ size_t front, back, size, mask; \
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index 08c3a9f9676c..ba5395fd386d 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -708,6 +708,10 @@ static int bch_writeback_thread(void *arg)
+ }
+ }
+
++ if (dc->writeback_write_wq) {
++ flush_workqueue(dc->writeback_write_wq);
++ destroy_workqueue(dc->writeback_write_wq);
++ }
+ cached_dev_put(dc);
+ wait_for_kthread_stop();
+
+@@ -803,6 +807,7 @@ int bch_cached_dev_writeback_start(struct cached_dev *dc)
+ "bcache_writeback");
+ if (IS_ERR(dc->writeback_thread)) {
+ cached_dev_put(dc);
++ destroy_workqueue(dc->writeback_write_wq);
+ return PTR_ERR(dc->writeback_thread);
+ }
+
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index dc385b70e4c3..b1d0ae2dbd3d 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1602,9 +1602,7 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ unsigned long freed;
+
+ c = container_of(shrink, struct dm_bufio_client, shrinker);
+- if (sc->gfp_mask & __GFP_FS)
+- dm_bufio_lock(c);
+- else if (!dm_bufio_trylock(c))
++ if (!dm_bufio_trylock(c))
+ return SHRINK_STOP;
+
+ freed = __scan(c, sc->nr_to_scan, sc->gfp_mask);
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index d8334cd45d7c..4cdde7a02e94 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -1593,30 +1593,6 @@ struct dm_zone *dmz_get_zone_for_reclaim(struct dmz_metadata *zmd)
+ return zone;
+ }
+
+-/*
+- * Activate a zone (increment its reference count).
+- */
+-void dmz_activate_zone(struct dm_zone *zone)
+-{
+- set_bit(DMZ_ACTIVE, &zone->flags);
+- atomic_inc(&zone->refcount);
+-}
+-
+-/*
+- * Deactivate a zone. This decrement the zone reference counter
+- * and clears the active state of the zone once the count reaches 0,
+- * indicating that all BIOs to the zone have completed. Returns
+- * true if the zone was deactivated.
+- */
+-void dmz_deactivate_zone(struct dm_zone *zone)
+-{
+- if (atomic_dec_and_test(&zone->refcount)) {
+- WARN_ON(!test_bit(DMZ_ACTIVE, &zone->flags));
+- clear_bit_unlock(DMZ_ACTIVE, &zone->flags);
+- smp_mb__after_atomic();
+- }
+-}
+-
+ /*
+ * Get the zone mapping a chunk, if the chunk is mapped already.
+ * If no mapping exist and the operation is WRITE, a zone is
+diff --git a/drivers/md/dm-zoned.h b/drivers/md/dm-zoned.h
+index 12419f0bfe78..ed8de49c9a08 100644
+--- a/drivers/md/dm-zoned.h
++++ b/drivers/md/dm-zoned.h
+@@ -115,7 +115,6 @@ enum {
+ DMZ_BUF,
+
+ /* Zone internal state */
+- DMZ_ACTIVE,
+ DMZ_RECLAIM,
+ DMZ_SEQ_WRITE_ERR,
+ };
+@@ -128,7 +127,6 @@ enum {
+ #define dmz_is_empty(z) ((z)->wp_block == 0)
+ #define dmz_is_offline(z) test_bit(DMZ_OFFLINE, &(z)->flags)
+ #define dmz_is_readonly(z) test_bit(DMZ_READ_ONLY, &(z)->flags)
+-#define dmz_is_active(z) test_bit(DMZ_ACTIVE, &(z)->flags)
+ #define dmz_in_reclaim(z) test_bit(DMZ_RECLAIM, &(z)->flags)
+ #define dmz_seq_write_err(z) test_bit(DMZ_SEQ_WRITE_ERR, &(z)->flags)
+
+@@ -188,8 +186,30 @@ void dmz_unmap_zone(struct dmz_metadata *zmd, struct dm_zone *zone);
+ unsigned int dmz_nr_rnd_zones(struct dmz_metadata *zmd);
+ unsigned int dmz_nr_unmap_rnd_zones(struct dmz_metadata *zmd);
+
+-void dmz_activate_zone(struct dm_zone *zone);
+-void dmz_deactivate_zone(struct dm_zone *zone);
++/*
++ * Activate a zone (increment its reference count).
++ */
++static inline void dmz_activate_zone(struct dm_zone *zone)
++{
++ atomic_inc(&zone->refcount);
++}
++
++/*
++ * Deactivate a zone. This decrement the zone reference counter
++ * indicating that all BIOs to the zone have completed when the count is 0.
++ */
++static inline void dmz_deactivate_zone(struct dm_zone *zone)
++{
++ atomic_dec(&zone->refcount);
++}
++
++/*
++ * Test if a zone is active, that is, has a refcount > 0.
++ */
++static inline bool dmz_is_active(struct dm_zone *zone)
++{
++ return atomic_read(&zone->refcount);
++}
+
+ int dmz_lock_zone_reclaim(struct dm_zone *zone);
+ void dmz_unlock_zone_reclaim(struct dm_zone *zone);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index f237d6f30752..a147619498df 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -7670,7 +7670,7 @@ abort:
+ static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ {
+ struct r5conf *conf = mddev->private;
+- int err = -EEXIST;
++ int ret, err = -EEXIST;
+ int disk;
+ struct disk_info *p;
+ int first = 0;
+@@ -7685,7 +7685,14 @@ static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ * The array is in readonly mode if journal is missing, so no
+ * write requests running. We should be safe
+ */
+- log_init(conf, rdev, false);
++ ret = log_init(conf, rdev, false);
++ if (ret)
++ return ret;
++
++ ret = r5l_start(conf->log);
++ if (ret)
++ return ret;
++
+ return 0;
+ }
+ if (mddev->recovery_disabled == conf->recovery_disabled)
+diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
+index 9226dca44e90..93d250db0b6f 100644
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -207,6 +207,10 @@ static int __vb2_buf_mem_alloc(struct vb2_buffer *vb)
+ for (plane = 0; plane < vb->num_planes; ++plane) {
+ unsigned long size = PAGE_ALIGN(vb->planes[plane].length);
+
++ /* Did it wrap around? */
++ if (size < vb->planes[plane].length)
++ goto free;
++
+ mem_priv = call_ptr_memop(vb, alloc,
+ q->alloc_devs[plane] ? : q->dev,
+ q->dma_attrs, size, q->dma_dir, q->gfp_flags);
+diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
+index 015e737095cd..e9bfea986cc4 100644
+--- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
++++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
+@@ -59,7 +59,7 @@ static int vb2_dma_sg_alloc_compacted(struct vb2_dma_sg_buf *buf,
+ gfp_t gfp_flags)
+ {
+ unsigned int last_page = 0;
+- int size = buf->size;
++ unsigned long size = buf->size;
+
+ while (size > 0) {
+ struct page *pages;
+diff --git a/drivers/media/dvb-frontends/tua6100.c b/drivers/media/dvb-frontends/tua6100.c
+index b233b7be0b84..e6aaf4973aef 100644
+--- a/drivers/media/dvb-frontends/tua6100.c
++++ b/drivers/media/dvb-frontends/tua6100.c
+@@ -75,8 +75,8 @@ static int tua6100_set_params(struct dvb_frontend *fe)
+ struct i2c_msg msg1 = { .addr = priv->i2c_address, .flags = 0, .buf = reg1, .len = 4 };
+ struct i2c_msg msg2 = { .addr = priv->i2c_address, .flags = 0, .buf = reg2, .len = 3 };
+
+-#define _R 4
+-#define _P 32
++#define _R_VAL 4
++#define _P_VAL 32
+ #define _ri 4000000
+
+ // setup register 0
+@@ -91,14 +91,14 @@ static int tua6100_set_params(struct dvb_frontend *fe)
+ else
+ reg1[1] = 0x0c;
+
+- if (_P == 64)
++ if (_P_VAL == 64)
+ reg1[1] |= 0x40;
+ if (c->frequency >= 1525000)
+ reg1[1] |= 0x80;
+
+ // register 2
+- reg2[1] = (_R >> 8) & 0x03;
+- reg2[2] = _R;
++ reg2[1] = (_R_VAL >> 8) & 0x03;
++ reg2[2] = _R_VAL;
+ if (c->frequency < 1455000)
+ reg2[1] |= 0x1c;
+ else if (c->frequency < 1630000)
+@@ -110,18 +110,18 @@ static int tua6100_set_params(struct dvb_frontend *fe)
+ * The N divisor ratio (note: c->frequency is in kHz, but we
+ * need it in Hz)
+ */
+- prediv = (c->frequency * _R) / (_ri / 1000);
+- div = prediv / _P;
++ prediv = (c->frequency * _R_VAL) / (_ri / 1000);
++ div = prediv / _P_VAL;
+ reg1[1] |= (div >> 9) & 0x03;
+ reg1[2] = div >> 1;
+ reg1[3] = (div << 7);
+- priv->frequency = ((div * _P) * (_ri / 1000)) / _R;
++ priv->frequency = ((div * _P_VAL) * (_ri / 1000)) / _R_VAL;
+
+ // Finally, calculate and store the value for A
+- reg1[3] |= (prediv - (div*_P)) & 0x7f;
++ reg1[3] |= (prediv - (div*_P_VAL)) & 0x7f;
+
+-#undef _R
+-#undef _P
++#undef _R_VAL
++#undef _P_VAL
+ #undef _ri
+
+ if (fe->ops.i2c_gate_ctrl)
+diff --git a/drivers/media/i2c/Makefile b/drivers/media/i2c/Makefile
+index a94eb03d10d4..520b3c3bf48c 100644
+--- a/drivers/media/i2c/Makefile
++++ b/drivers/media/i2c/Makefile
+@@ -36,7 +36,7 @@ obj-$(CONFIG_VIDEO_ADV748X) += adv748x/
+ obj-$(CONFIG_VIDEO_ADV7604) += adv7604.o
+ obj-$(CONFIG_VIDEO_ADV7842) += adv7842.o
+ obj-$(CONFIG_VIDEO_AD9389B) += ad9389b.o
+-obj-$(CONFIG_VIDEO_ADV7511) += adv7511.o
++obj-$(CONFIG_VIDEO_ADV7511) += adv7511-v4l2.o
+ obj-$(CONFIG_VIDEO_VPX3220) += vpx3220.o
+ obj-$(CONFIG_VIDEO_VS6624) += vs6624.o
+ obj-$(CONFIG_VIDEO_BT819) += bt819.o
+diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c
+new file mode 100644
+index 000000000000..6869bb593a68
+--- /dev/null
++++ b/drivers/media/i2c/adv7511-v4l2.c
+@@ -0,0 +1,1997 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Analog Devices ADV7511 HDMI Transmitter Device Driver
++ *
++ * Copyright 2013 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
++ */
++
++/*
++ * This file is named adv7511-v4l2.c so it doesn't conflict with the Analog
++ * Device ADV7511 (config fragment CONFIG_DRM_I2C_ADV7511).
++ */
++
++
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++#include <linux/i2c.h>
++#include <linux/delay.h>
++#include <linux/videodev2.h>
++#include <linux/gpio.h>
++#include <linux/workqueue.h>
++#include <linux/hdmi.h>
++#include <linux/v4l2-dv-timings.h>
++#include <media/v4l2-device.h>
++#include <media/v4l2-common.h>
++#include <media/v4l2-ctrls.h>
++#include <media/v4l2-dv-timings.h>
++#include <media/i2c/adv7511.h>
++#include <media/cec.h>
++
++static int debug;
++module_param(debug, int, 0644);
++MODULE_PARM_DESC(debug, "debug level (0-2)");
++
++MODULE_DESCRIPTION("Analog Devices ADV7511 HDMI Transmitter Device Driver");
++MODULE_AUTHOR("Hans Verkuil");
++MODULE_LICENSE("GPL v2");
++
++#define MASK_ADV7511_EDID_RDY_INT 0x04
++#define MASK_ADV7511_MSEN_INT 0x40
++#define MASK_ADV7511_HPD_INT 0x80
++
++#define MASK_ADV7511_HPD_DETECT 0x40
++#define MASK_ADV7511_MSEN_DETECT 0x20
++#define MASK_ADV7511_EDID_RDY 0x10
++
++#define EDID_MAX_RETRIES (8)
++#define EDID_DELAY 250
++#define EDID_MAX_SEGM 8
++
++#define ADV7511_MAX_WIDTH 1920
++#define ADV7511_MAX_HEIGHT 1200
++#define ADV7511_MIN_PIXELCLOCK 20000000
++#define ADV7511_MAX_PIXELCLOCK 225000000
++
++#define ADV7511_MAX_ADDRS (3)
++
++/*
++**********************************************************************
++*
++* Arrays with configuration parameters for the ADV7511
++*
++**********************************************************************
++*/
++
++struct i2c_reg_value {
++ unsigned char reg;
++ unsigned char value;
++};
++
++struct adv7511_state_edid {
++ /* total number of blocks */
++ u32 blocks;
++ /* Number of segments read */
++ u32 segments;
++ u8 data[EDID_MAX_SEGM * 256];
++ /* Number of EDID read retries left */
++ unsigned read_retries;
++ bool complete;
++};
++
++struct adv7511_state {
++ struct adv7511_platform_data pdata;
++ struct v4l2_subdev sd;
++ struct media_pad pad;
++ struct v4l2_ctrl_handler hdl;
++ int chip_revision;
++ u8 i2c_edid_addr;
++ u8 i2c_pktmem_addr;
++ u8 i2c_cec_addr;
++
++ struct i2c_client *i2c_cec;
++ struct cec_adapter *cec_adap;
++ u8 cec_addr[ADV7511_MAX_ADDRS];
++ u8 cec_valid_addrs;
++ bool cec_enabled_adap;
++
++ /* Is the adv7511 powered on? */
++ bool power_on;
++ /* Did we receive hotplug and rx-sense signals? */
++ bool have_monitor;
++ bool enabled_irq;
++ /* timings from s_dv_timings */
++ struct v4l2_dv_timings dv_timings;
++ u32 fmt_code;
++ u32 colorspace;
++ u32 ycbcr_enc;
++ u32 quantization;
++ u32 xfer_func;
++ u32 content_type;
++ /* controls */
++ struct v4l2_ctrl *hdmi_mode_ctrl;
++ struct v4l2_ctrl *hotplug_ctrl;
++ struct v4l2_ctrl *rx_sense_ctrl;
++ struct v4l2_ctrl *have_edid0_ctrl;
++ struct v4l2_ctrl *rgb_quantization_range_ctrl;
++ struct v4l2_ctrl *content_type_ctrl;
++ struct i2c_client *i2c_edid;
++ struct i2c_client *i2c_pktmem;
++ struct adv7511_state_edid edid;
++ /* Running counter of the number of detected EDIDs (for debugging) */
++ unsigned edid_detect_counter;
++ struct workqueue_struct *work_queue;
++ struct delayed_work edid_handler; /* work entry */
++};
++
++static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd);
++static bool adv7511_check_edid_status(struct v4l2_subdev *sd);
++static void adv7511_setup(struct v4l2_subdev *sd);
++static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq);
++static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq);
++
++
++static const struct v4l2_dv_timings_cap adv7511_timings_cap = {
++ .type = V4L2_DV_BT_656_1120,
++ /* keep this initialization for compatibility with GCC < 4.4.6 */
++ .reserved = { 0 },
++ V4L2_INIT_BT_TIMINGS(640, ADV7511_MAX_WIDTH, 350, ADV7511_MAX_HEIGHT,
++ ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK,
++ V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
++ V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
++ V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
++ V4L2_DV_BT_CAP_CUSTOM)
++};
++
++static inline struct adv7511_state *get_adv7511_state(struct v4l2_subdev *sd)
++{
++ return container_of(sd, struct adv7511_state, sd);
++}
++
++static inline struct v4l2_subdev *to_sd(struct v4l2_ctrl *ctrl)
++{
++ return &container_of(ctrl->handler, struct adv7511_state, hdl)->sd;
++}
++
++/* ------------------------ I2C ----------------------------------------------- */
++
++static s32 adv_smbus_read_byte_data_check(struct i2c_client *client,
++ u8 command, bool check)
++{
++ union i2c_smbus_data data;
++
++ if (!i2c_smbus_xfer(client->adapter, client->addr, client->flags,
++ I2C_SMBUS_READ, command,
++ I2C_SMBUS_BYTE_DATA, &data))
++ return data.byte;
++ if (check)
++ v4l_err(client, "error reading %02x, %02x\n",
++ client->addr, command);
++ return -1;
++}
++
++static s32 adv_smbus_read_byte_data(struct i2c_client *client, u8 command)
++{
++ int i;
++ for (i = 0; i < 3; i++) {
++ int ret = adv_smbus_read_byte_data_check(client, command, true);
++ if (ret >= 0) {
++ if (i)
++ v4l_err(client, "read ok after %d retries\n", i);
++ return ret;
++ }
++ }
++ v4l_err(client, "read failed\n");
++ return -1;
++}
++
++static int adv7511_rd(struct v4l2_subdev *sd, u8 reg)
++{
++ struct i2c_client *client = v4l2_get_subdevdata(sd);
++
++ return adv_smbus_read_byte_data(client, reg);
++}
++
++static int adv7511_wr(struct v4l2_subdev *sd, u8 reg, u8 val)
++{
++ struct i2c_client *client = v4l2_get_subdevdata(sd);
++ int ret;
++ int i;
++
++ for (i = 0; i < 3; i++) {
++ ret = i2c_smbus_write_byte_data(client, reg, val);
++ if (ret == 0)
++ return 0;
++ }
++ v4l2_err(sd, "%s: i2c write error\n", __func__);
++ return ret;
++}
++
++/* To set specific bits in the register, a clear-mask is given (to be AND-ed),
++ and then the value-mask (to be OR-ed). */
++static inline void adv7511_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask)
++{
++ adv7511_wr(sd, reg, (adv7511_rd(sd, reg) & clr_mask) | val_mask);
++}
++
++static int adv_smbus_read_i2c_block_data(struct i2c_client *client,
++ u8 command, unsigned length, u8 *values)
++{
++ union i2c_smbus_data data;
++ int ret;
++
++ if (length > I2C_SMBUS_BLOCK_MAX)
++ length = I2C_SMBUS_BLOCK_MAX;
++ data.block[0] = length;
++
++ ret = i2c_smbus_xfer(client->adapter, client->addr, client->flags,
++ I2C_SMBUS_READ, command,
++ I2C_SMBUS_I2C_BLOCK_DATA, &data);
++ memcpy(values, data.block + 1, length);
++ return ret;
++}
++
++static void adv7511_edid_rd(struct v4l2_subdev *sd, uint16_t len, uint8_t *buf)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ int i;
++ int err = 0;
++
++ v4l2_dbg(1, debug, sd, "%s:\n", __func__);
++
++ for (i = 0; !err && i < len; i += I2C_SMBUS_BLOCK_MAX)
++ err = adv_smbus_read_i2c_block_data(state->i2c_edid, i,
++ I2C_SMBUS_BLOCK_MAX, buf + i);
++ if (err)
++ v4l2_err(sd, "%s: i2c read error\n", __func__);
++}
++
++static inline int adv7511_cec_read(struct v4l2_subdev *sd, u8 reg)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ return i2c_smbus_read_byte_data(state->i2c_cec, reg);
++}
++
++static int adv7511_cec_write(struct v4l2_subdev *sd, u8 reg, u8 val)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ int ret;
++ int i;
++
++ for (i = 0; i < 3; i++) {
++ ret = i2c_smbus_write_byte_data(state->i2c_cec, reg, val);
++ if (ret == 0)
++ return 0;
++ }
++ v4l2_err(sd, "%s: I2C Write Problem\n", __func__);
++ return ret;
++}
++
++static inline int adv7511_cec_write_and_or(struct v4l2_subdev *sd, u8 reg, u8 mask,
++ u8 val)
++{
++ return adv7511_cec_write(sd, reg, (adv7511_cec_read(sd, reg) & mask) | val);
++}
++
++static int adv7511_pktmem_rd(struct v4l2_subdev *sd, u8 reg)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ return adv_smbus_read_byte_data(state->i2c_pktmem, reg);
++}
++
++static int adv7511_pktmem_wr(struct v4l2_subdev *sd, u8 reg, u8 val)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ int ret;
++ int i;
++
++ for (i = 0; i < 3; i++) {
++ ret = i2c_smbus_write_byte_data(state->i2c_pktmem, reg, val);
++ if (ret == 0)
++ return 0;
++ }
++ v4l2_err(sd, "%s: i2c write error\n", __func__);
++ return ret;
++}
++
++/* To set specific bits in the register, a clear-mask is given (to be AND-ed),
++ and then the value-mask (to be OR-ed). */
++static inline void adv7511_pktmem_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask)
++{
++ adv7511_pktmem_wr(sd, reg, (adv7511_pktmem_rd(sd, reg) & clr_mask) | val_mask);
++}
++
++static inline bool adv7511_have_hotplug(struct v4l2_subdev *sd)
++{
++ return adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT;
++}
++
++static inline bool adv7511_have_rx_sense(struct v4l2_subdev *sd)
++{
++ return adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT;
++}
++
++static void adv7511_csc_conversion_mode(struct v4l2_subdev *sd, u8 mode)
++{
++ adv7511_wr_and_or(sd, 0x18, 0x9f, (mode & 0x3)<<5);
++}
++
++static void adv7511_csc_coeff(struct v4l2_subdev *sd,
++ u16 A1, u16 A2, u16 A3, u16 A4,
++ u16 B1, u16 B2, u16 B3, u16 B4,
++ u16 C1, u16 C2, u16 C3, u16 C4)
++{
++ /* A */
++ adv7511_wr_and_or(sd, 0x18, 0xe0, A1>>8);
++ adv7511_wr(sd, 0x19, A1);
++ adv7511_wr_and_or(sd, 0x1A, 0xe0, A2>>8);
++ adv7511_wr(sd, 0x1B, A2);
++ adv7511_wr_and_or(sd, 0x1c, 0xe0, A3>>8);
++ adv7511_wr(sd, 0x1d, A3);
++ adv7511_wr_and_or(sd, 0x1e, 0xe0, A4>>8);
++ adv7511_wr(sd, 0x1f, A4);
++
++ /* B */
++ adv7511_wr_and_or(sd, 0x20, 0xe0, B1>>8);
++ adv7511_wr(sd, 0x21, B1);
++ adv7511_wr_and_or(sd, 0x22, 0xe0, B2>>8);
++ adv7511_wr(sd, 0x23, B2);
++ adv7511_wr_and_or(sd, 0x24, 0xe0, B3>>8);
++ adv7511_wr(sd, 0x25, B3);
++ adv7511_wr_and_or(sd, 0x26, 0xe0, B4>>8);
++ adv7511_wr(sd, 0x27, B4);
++
++ /* C */
++ adv7511_wr_and_or(sd, 0x28, 0xe0, C1>>8);
++ adv7511_wr(sd, 0x29, C1);
++ adv7511_wr_and_or(sd, 0x2A, 0xe0, C2>>8);
++ adv7511_wr(sd, 0x2B, C2);
++ adv7511_wr_and_or(sd, 0x2C, 0xe0, C3>>8);
++ adv7511_wr(sd, 0x2D, C3);
++ adv7511_wr_and_or(sd, 0x2E, 0xe0, C4>>8);
++ adv7511_wr(sd, 0x2F, C4);
++}
++
++static void adv7511_csc_rgb_full2limit(struct v4l2_subdev *sd, bool enable)
++{
++ if (enable) {
++ u8 csc_mode = 0;
++ adv7511_csc_conversion_mode(sd, csc_mode);
++ adv7511_csc_coeff(sd,
++ 4096-564, 0, 0, 256,
++ 0, 4096-564, 0, 256,
++ 0, 0, 4096-564, 256);
++ /* enable CSC */
++ adv7511_wr_and_or(sd, 0x18, 0x7f, 0x80);
++ /* AVI infoframe: Limited range RGB (16-235) */
++ adv7511_wr_and_or(sd, 0x57, 0xf3, 0x04);
++ } else {
++ /* disable CSC */
++ adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0);
++ /* AVI infoframe: Full range RGB (0-255) */
++ adv7511_wr_and_or(sd, 0x57, 0xf3, 0x08);
++ }
++}
++
++static void adv7511_set_rgb_quantization_mode(struct v4l2_subdev *sd, struct v4l2_ctrl *ctrl)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ /* Only makes sense for RGB formats */
++ if (state->fmt_code != MEDIA_BUS_FMT_RGB888_1X24) {
++ /* so just keep quantization */
++ adv7511_csc_rgb_full2limit(sd, false);
++ return;
++ }
++
++ switch (ctrl->val) {
++ case V4L2_DV_RGB_RANGE_AUTO:
++ /* automatic */
++ if (state->dv_timings.bt.flags & V4L2_DV_FL_IS_CE_VIDEO) {
++ /* CE format, RGB limited range (16-235) */
++ adv7511_csc_rgb_full2limit(sd, true);
++ } else {
++ /* not CE format, RGB full range (0-255) */
++ adv7511_csc_rgb_full2limit(sd, false);
++ }
++ break;
++ case V4L2_DV_RGB_RANGE_LIMITED:
++ /* RGB limited range (16-235) */
++ adv7511_csc_rgb_full2limit(sd, true);
++ break;
++ case V4L2_DV_RGB_RANGE_FULL:
++ /* RGB full range (0-255) */
++ adv7511_csc_rgb_full2limit(sd, false);
++ break;
++ }
++}
++
++/* ------------------------------ CTRL OPS ------------------------------ */
++
++static int adv7511_s_ctrl(struct v4l2_ctrl *ctrl)
++{
++ struct v4l2_subdev *sd = to_sd(ctrl);
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ v4l2_dbg(1, debug, sd, "%s: ctrl id: %d, ctrl->val %d\n", __func__, ctrl->id, ctrl->val);
++
++ if (state->hdmi_mode_ctrl == ctrl) {
++ /* Set HDMI or DVI-D */
++ adv7511_wr_and_or(sd, 0xaf, 0xfd, ctrl->val == V4L2_DV_TX_MODE_HDMI ? 0x02 : 0x00);
++ return 0;
++ }
++ if (state->rgb_quantization_range_ctrl == ctrl) {
++ adv7511_set_rgb_quantization_mode(sd, ctrl);
++ return 0;
++ }
++ if (state->content_type_ctrl == ctrl) {
++ u8 itc, cn;
++
++ state->content_type = ctrl->val;
++ itc = state->content_type != V4L2_DV_IT_CONTENT_TYPE_NO_ITC;
++ cn = itc ? state->content_type : V4L2_DV_IT_CONTENT_TYPE_GRAPHICS;
++ adv7511_wr_and_or(sd, 0x57, 0x7f, itc << 7);
++ adv7511_wr_and_or(sd, 0x59, 0xcf, cn << 4);
++ return 0;
++ }
++
++ return -EINVAL;
++}
++
++static const struct v4l2_ctrl_ops adv7511_ctrl_ops = {
++ .s_ctrl = adv7511_s_ctrl,
++};
++
++/* ---------------------------- CORE OPS ------------------------------------------- */
++
++#ifdef CONFIG_VIDEO_ADV_DEBUG
++static void adv7511_inv_register(struct v4l2_subdev *sd)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ v4l2_info(sd, "0x000-0x0ff: Main Map\n");
++ if (state->i2c_cec)
++ v4l2_info(sd, "0x100-0x1ff: CEC Map\n");
++}
++
++static int adv7511_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ reg->size = 1;
++ switch (reg->reg >> 8) {
++ case 0:
++ reg->val = adv7511_rd(sd, reg->reg & 0xff);
++ break;
++ case 1:
++ if (state->i2c_cec) {
++ reg->val = adv7511_cec_read(sd, reg->reg & 0xff);
++ break;
++ }
++ /* fall through */
++ default:
++ v4l2_info(sd, "Register %03llx not supported\n", reg->reg);
++ adv7511_inv_register(sd);
++ break;
++ }
++ return 0;
++}
++
++static int adv7511_s_register(struct v4l2_subdev *sd, const struct v4l2_dbg_register *reg)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ switch (reg->reg >> 8) {
++ case 0:
++ adv7511_wr(sd, reg->reg & 0xff, reg->val & 0xff);
++ break;
++ case 1:
++ if (state->i2c_cec) {
++ adv7511_cec_write(sd, reg->reg & 0xff, reg->val & 0xff);
++ break;
++ }
++ /* fall through */
++ default:
++ v4l2_info(sd, "Register %03llx not supported\n", reg->reg);
++ adv7511_inv_register(sd);
++ break;
++ }
++ return 0;
++}
++#endif
++
++struct adv7511_cfg_read_infoframe {
++ const char *desc;
++ u8 present_reg;
++ u8 present_mask;
++ u8 header[3];
++ u16 payload_addr;
++};
++
++static u8 hdmi_infoframe_checksum(u8 *ptr, size_t size)
++{
++ u8 csum = 0;
++ size_t i;
++
++ /* compute checksum */
++ for (i = 0; i < size; i++)
++ csum += ptr[i];
++
++ return 256 - csum;
++}
++
++static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_infoframe *cri)
++{
++ struct i2c_client *client = v4l2_get_subdevdata(sd);
++ struct device *dev = &client->dev;
++ union hdmi_infoframe frame;
++ u8 buffer[32];
++ u8 len;
++ int i;
++
++ if (!(adv7511_rd(sd, cri->present_reg) & cri->present_mask)) {
++ v4l2_info(sd, "%s infoframe not transmitted\n", cri->desc);
++ return;
++ }
++
++ memcpy(buffer, cri->header, sizeof(cri->header));
++
++ len = buffer[2];
++
++ if (len + 4 > sizeof(buffer)) {
++ v4l2_err(sd, "%s: invalid %s infoframe length %d\n", __func__, cri->desc, len);
++ return;
++ }
++
++ if (cri->payload_addr >= 0x100) {
++ for (i = 0; i < len; i++)
++ buffer[i + 4] = adv7511_pktmem_rd(sd, cri->payload_addr + i - 0x100);
++ } else {
++ for (i = 0; i < len; i++)
++ buffer[i + 4] = adv7511_rd(sd, cri->payload_addr + i);
++ }
++ buffer[3] = 0;
++ buffer[3] = hdmi_infoframe_checksum(buffer, len + 4);
++
++ if (hdmi_infoframe_unpack(&frame, buffer) < 0) {
++ v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
++ return;
++ }
++
++ hdmi_infoframe_log(KERN_INFO, dev, &frame);
++}
++
++static void adv7511_log_infoframes(struct v4l2_subdev *sd)
++{
++ static const struct adv7511_cfg_read_infoframe cri[] = {
++ { "AVI", 0x44, 0x10, { 0x82, 2, 13 }, 0x55 },
++ { "Audio", 0x44, 0x08, { 0x84, 1, 10 }, 0x73 },
++ { "SDP", 0x40, 0x40, { 0x83, 1, 25 }, 0x103 },
++ };
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(cri); i++)
++ log_infoframe(sd, &cri[i]);
++}
++
++static int adv7511_log_status(struct v4l2_subdev *sd)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ struct adv7511_state_edid *edid = &state->edid;
++ int i;
++
++ static const char * const states[] = {
++ "in reset",
++ "reading EDID",
++ "idle",
++ "initializing HDCP",
++ "HDCP enabled",
++ "initializing HDCP repeater",
++ "6", "7", "8", "9", "A", "B", "C", "D", "E", "F"
++ };
++ static const char * const errors[] = {
++ "no error",
++ "bad receiver BKSV",
++ "Ri mismatch",
++ "Pj mismatch",
++ "i2c error",
++ "timed out",
++ "max repeater cascade exceeded",
++ "hash check failed",
++ "too many devices",
++ "9", "A", "B", "C", "D", "E", "F"
++ };
++
++ v4l2_info(sd, "power %s\n", state->power_on ? "on" : "off");
++ v4l2_info(sd, "%s hotplug, %s Rx Sense, %s EDID (%d block(s))\n",
++ (adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT) ? "detected" : "no",
++ (adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT) ? "detected" : "no",
++ edid->segments ? "found" : "no",
++ edid->blocks);
++ v4l2_info(sd, "%s output %s\n",
++ (adv7511_rd(sd, 0xaf) & 0x02) ?
++ "HDMI" : "DVI-D",
++ (adv7511_rd(sd, 0xa1) & 0x3c) ?
++ "disabled" : "enabled");
++ v4l2_info(sd, "state: %s, error: %s, detect count: %u, msk/irq: %02x/%02x\n",
++ states[adv7511_rd(sd, 0xc8) & 0xf],
++ errors[adv7511_rd(sd, 0xc8) >> 4], state->edid_detect_counter,
++ adv7511_rd(sd, 0x94), adv7511_rd(sd, 0x96));
++ v4l2_info(sd, "RGB quantization: %s range\n", adv7511_rd(sd, 0x18) & 0x80 ? "limited" : "full");
++ if (adv7511_rd(sd, 0xaf) & 0x02) {
++ /* HDMI only */
++ u8 manual_cts = adv7511_rd(sd, 0x0a) & 0x80;
++ u32 N = (adv7511_rd(sd, 0x01) & 0xf) << 16 |
++ adv7511_rd(sd, 0x02) << 8 |
++ adv7511_rd(sd, 0x03);
++ u8 vic_detect = adv7511_rd(sd, 0x3e) >> 2;
++ u8 vic_sent = adv7511_rd(sd, 0x3d) & 0x3f;
++ u32 CTS;
++
++ if (manual_cts)
++ CTS = (adv7511_rd(sd, 0x07) & 0xf) << 16 |
++ adv7511_rd(sd, 0x08) << 8 |
++ adv7511_rd(sd, 0x09);
++ else
++ CTS = (adv7511_rd(sd, 0x04) & 0xf) << 16 |
++ adv7511_rd(sd, 0x05) << 8 |
++ adv7511_rd(sd, 0x06);
++ v4l2_info(sd, "CTS %s mode: N %d, CTS %d\n",
++ manual_cts ? "manual" : "automatic", N, CTS);
++ v4l2_info(sd, "VIC: detected %d, sent %d\n",
++ vic_detect, vic_sent);
++ adv7511_log_infoframes(sd);
++ }
++ if (state->dv_timings.type == V4L2_DV_BT_656_1120)
++ v4l2_print_dv_timings(sd->name, "timings: ",
++ &state->dv_timings, false);
++ else
++ v4l2_info(sd, "no timings set\n");
++ v4l2_info(sd, "i2c edid addr: 0x%x\n", state->i2c_edid_addr);
++
++ if (state->i2c_cec == NULL)
++ return 0;
++
++ v4l2_info(sd, "i2c cec addr: 0x%x\n", state->i2c_cec_addr);
++
++ v4l2_info(sd, "CEC: %s\n", state->cec_enabled_adap ?
++ "enabled" : "disabled");
++ if (state->cec_enabled_adap) {
++ for (i = 0; i < ADV7511_MAX_ADDRS; i++) {
++ bool is_valid = state->cec_valid_addrs & (1 << i);
++
++ if (is_valid)
++ v4l2_info(sd, "CEC Logical Address: 0x%x\n",
++ state->cec_addr[i]);
++ }
++ }
++ v4l2_info(sd, "i2c pktmem addr: 0x%x\n", state->i2c_pktmem_addr);
++ return 0;
++}
++
++/* Power up/down adv7511 */
++static int adv7511_s_power(struct v4l2_subdev *sd, int on)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ const int retries = 20;
++ int i;
++
++ v4l2_dbg(1, debug, sd, "%s: power %s\n", __func__, on ? "on" : "off");
++
++ state->power_on = on;
++
++ if (!on) {
++ /* Power down */
++ adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40);
++ return true;
++ }
++
++ /* Power up */
++ /* The adv7511 does not always come up immediately.
++ Retry multiple times. */
++ for (i = 0; i < retries; i++) {
++ adv7511_wr_and_or(sd, 0x41, 0xbf, 0x0);
++ if ((adv7511_rd(sd, 0x41) & 0x40) == 0)
++ break;
++ adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40);
++ msleep(10);
++ }
++ if (i == retries) {
++ v4l2_dbg(1, debug, sd, "%s: failed to powerup the adv7511!\n", __func__);
++ adv7511_s_power(sd, 0);
++ return false;
++ }
++ if (i > 1)
++ v4l2_dbg(1, debug, sd, "%s: needed %d retries to powerup the adv7511\n", __func__, i);
++
++ /* Reserved registers that must be set */
++ adv7511_wr(sd, 0x98, 0x03);
++ adv7511_wr_and_or(sd, 0x9a, 0xfe, 0x70);
++ adv7511_wr(sd, 0x9c, 0x30);
++ adv7511_wr_and_or(sd, 0x9d, 0xfc, 0x01);
++ adv7511_wr(sd, 0xa2, 0xa4);
++ adv7511_wr(sd, 0xa3, 0xa4);
++ adv7511_wr(sd, 0xe0, 0xd0);
++ adv7511_wr(sd, 0xf9, 0x00);
++
++ adv7511_wr(sd, 0x43, state->i2c_edid_addr);
++ adv7511_wr(sd, 0x45, state->i2c_pktmem_addr);
++
++ /* Set number of attempts to read the EDID */
++ adv7511_wr(sd, 0xc9, 0xf);
++ return true;
++}
++
++#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
++static int adv7511_cec_adap_enable(struct cec_adapter *adap, bool enable)
++{
++ struct adv7511_state *state = cec_get_drvdata(adap);
++ struct v4l2_subdev *sd = &state->sd;
++
++ if (state->i2c_cec == NULL)
++ return -EIO;
++
++ if (!state->cec_enabled_adap && enable) {
++ /* power up cec section */
++ adv7511_cec_write_and_or(sd, 0x4e, 0xfc, 0x01);
++ /* legacy mode and clear all rx buffers */
++ adv7511_cec_write(sd, 0x4a, 0x00);
++ adv7511_cec_write(sd, 0x4a, 0x07);
++ adv7511_cec_write_and_or(sd, 0x11, 0xfe, 0); /* initially disable tx */
++ /* enabled irqs: */
++ /* tx: ready */
++ /* tx: arbitration lost */
++ /* tx: retry timeout */
++ /* rx: ready 1 */
++ if (state->enabled_irq)
++ adv7511_wr_and_or(sd, 0x95, 0xc0, 0x39);
++ } else if (state->cec_enabled_adap && !enable) {
++ if (state->enabled_irq)
++ adv7511_wr_and_or(sd, 0x95, 0xc0, 0x00);
++ /* disable address mask 1-3 */
++ adv7511_cec_write_and_or(sd, 0x4b, 0x8f, 0x00);
++ /* power down cec section */
++ adv7511_cec_write_and_or(sd, 0x4e, 0xfc, 0x00);
++ state->cec_valid_addrs = 0;
++ }
++ state->cec_enabled_adap = enable;
++ return 0;
++}
++
++static int adv7511_cec_adap_log_addr(struct cec_adapter *adap, u8 addr)
++{
++ struct adv7511_state *state = cec_get_drvdata(adap);
++ struct v4l2_subdev *sd = &state->sd;
++ unsigned int i, free_idx = ADV7511_MAX_ADDRS;
++
++ if (!state->cec_enabled_adap)
++ return addr == CEC_LOG_ADDR_INVALID ? 0 : -EIO;
++
++ if (addr == CEC_LOG_ADDR_INVALID) {
++ adv7511_cec_write_and_or(sd, 0x4b, 0x8f, 0);
++ state->cec_valid_addrs = 0;
++ return 0;
++ }
++
++ for (i = 0; i < ADV7511_MAX_ADDRS; i++) {
++ bool is_valid = state->cec_valid_addrs & (1 << i);
++
++ if (free_idx == ADV7511_MAX_ADDRS && !is_valid)
++ free_idx = i;
++ if (is_valid && state->cec_addr[i] == addr)
++ return 0;
++ }
++ if (i == ADV7511_MAX_ADDRS) {
++ i = free_idx;
++ if (i == ADV7511_MAX_ADDRS)
++ return -ENXIO;
++ }
++ state->cec_addr[i] = addr;
++ state->cec_valid_addrs |= 1 << i;
++
++ switch (i) {
++ case 0:
++ /* enable address mask 0 */
++ adv7511_cec_write_and_or(sd, 0x4b, 0xef, 0x10);
++ /* set address for mask 0 */
++ adv7511_cec_write_and_or(sd, 0x4c, 0xf0, addr);
++ break;
++ case 1:
++ /* enable address mask 1 */
++ adv7511_cec_write_and_or(sd, 0x4b, 0xdf, 0x20);
++ /* set address for mask 1 */
++ adv7511_cec_write_and_or(sd, 0x4c, 0x0f, addr << 4);
++ break;
++ case 2:
++ /* enable address mask 2 */
++ adv7511_cec_write_and_or(sd, 0x4b, 0xbf, 0x40);
++ /* set address for mask 1 */
++ adv7511_cec_write_and_or(sd, 0x4d, 0xf0, addr);
++ break;
++ }
++ return 0;
++}
++
++static int adv7511_cec_adap_transmit(struct cec_adapter *adap, u8 attempts,
++ u32 signal_free_time, struct cec_msg *msg)
++{
++ struct adv7511_state *state = cec_get_drvdata(adap);
++ struct v4l2_subdev *sd = &state->sd;
++ u8 len = msg->len;
++ unsigned int i;
++
++ v4l2_dbg(1, debug, sd, "%s: len %d\n", __func__, len);
++
++ if (len > 16) {
++ v4l2_err(sd, "%s: len exceeded 16 (%d)\n", __func__, len);
++ return -EINVAL;
++ }
++
++ /*
++ * The number of retries is the number of attempts - 1, but retry
++ * at least once. It's not clear if a value of 0 is allowed, so
++ * let's do at least one retry.
++ */
++ adv7511_cec_write_and_or(sd, 0x12, ~0x70, max(1, attempts - 1) << 4);
++
++ /* clear cec tx irq status */
++ adv7511_wr(sd, 0x97, 0x38);
++
++ /* write data */
++ for (i = 0; i < len; i++)
++ adv7511_cec_write(sd, i, msg->msg[i]);
++
++ /* set length (data + header) */
++ adv7511_cec_write(sd, 0x10, len);
++ /* start transmit, enable tx */
++ adv7511_cec_write(sd, 0x11, 0x01);
++ return 0;
++}
++
++static void adv_cec_tx_raw_status(struct v4l2_subdev *sd, u8 tx_raw_status)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ if ((adv7511_cec_read(sd, 0x11) & 0x01) == 0) {
++ v4l2_dbg(1, debug, sd, "%s: tx raw: tx disabled\n", __func__);
++ return;
++ }
++
++ if (tx_raw_status & 0x10) {
++ v4l2_dbg(1, debug, sd,
++ "%s: tx raw: arbitration lost\n", __func__);
++ cec_transmit_done(state->cec_adap, CEC_TX_STATUS_ARB_LOST,
++ 1, 0, 0, 0);
++ return;
++ }
++ if (tx_raw_status & 0x08) {
++ u8 status;
++ u8 nack_cnt;
++ u8 low_drive_cnt;
++
++ v4l2_dbg(1, debug, sd, "%s: tx raw: retry failed\n", __func__);
++ /*
++ * We set this status bit since this hardware performs
++ * retransmissions.
++ */
++ status = CEC_TX_STATUS_MAX_RETRIES;
++ nack_cnt = adv7511_cec_read(sd, 0x14) & 0xf;
++ if (nack_cnt)
++ status |= CEC_TX_STATUS_NACK;
++ low_drive_cnt = adv7511_cec_read(sd, 0x14) >> 4;
++ if (low_drive_cnt)
++ status |= CEC_TX_STATUS_LOW_DRIVE;
++ cec_transmit_done(state->cec_adap, status,
++ 0, nack_cnt, low_drive_cnt, 0);
++ return;
++ }
++ if (tx_raw_status & 0x20) {
++ v4l2_dbg(1, debug, sd, "%s: tx raw: ready ok\n", __func__);
++ cec_transmit_done(state->cec_adap, CEC_TX_STATUS_OK, 0, 0, 0, 0);
++ return;
++ }
++}
++
++static const struct cec_adap_ops adv7511_cec_adap_ops = {
++ .adap_enable = adv7511_cec_adap_enable,
++ .adap_log_addr = adv7511_cec_adap_log_addr,
++ .adap_transmit = adv7511_cec_adap_transmit,
++};
++#endif
++
++/* Enable interrupts */
++static void adv7511_set_isr(struct v4l2_subdev *sd, bool enable)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ u8 irqs = MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT;
++ u8 irqs_rd;
++ int retries = 100;
++
++ v4l2_dbg(2, debug, sd, "%s: %s\n", __func__, enable ? "enable" : "disable");
++
++ if (state->enabled_irq == enable)
++ return;
++ state->enabled_irq = enable;
++
++ /* The datasheet says that the EDID ready interrupt should be
++ disabled if there is no hotplug. */
++ if (!enable)
++ irqs = 0;
++ else if (adv7511_have_hotplug(sd))
++ irqs |= MASK_ADV7511_EDID_RDY_INT;
++
++ /*
++ * This i2c write can fail (approx. 1 in 1000 writes). But it
++ * is essential that this register is correct, so retry it
++ * multiple times.
++ *
++ * Note that the i2c write does not report an error, but the readback
++ * clearly shows the wrong value.
++ */
++ do {
++ adv7511_wr(sd, 0x94, irqs);
++ irqs_rd = adv7511_rd(sd, 0x94);
++ } while (retries-- && irqs_rd != irqs);
++
++ if (irqs_rd != irqs)
++ v4l2_err(sd, "Could not set interrupts: hw failure?\n");
++
++ adv7511_wr_and_or(sd, 0x95, 0xc0,
++ (state->cec_enabled_adap && enable) ? 0x39 : 0x00);
++}
++
++/* Interrupt handler */
++static int adv7511_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
++{
++ u8 irq_status;
++ u8 cec_irq;
++
++ /* disable interrupts to prevent a race condition */
++ adv7511_set_isr(sd, false);
++ irq_status = adv7511_rd(sd, 0x96);
++ cec_irq = adv7511_rd(sd, 0x97);
++ /* clear detected interrupts */
++ adv7511_wr(sd, 0x96, irq_status);
++ adv7511_wr(sd, 0x97, cec_irq);
++
++ v4l2_dbg(1, debug, sd, "%s: irq 0x%x, cec-irq 0x%x\n", __func__,
++ irq_status, cec_irq);
++
++ if (irq_status & (MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT))
++ adv7511_check_monitor_present_status(sd);
++ if (irq_status & MASK_ADV7511_EDID_RDY_INT)
++ adv7511_check_edid_status(sd);
++
++#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
++ if (cec_irq & 0x38)
++ adv_cec_tx_raw_status(sd, cec_irq);
++
++ if (cec_irq & 1) {
++ struct adv7511_state *state = get_adv7511_state(sd);
++ struct cec_msg msg;
++
++ msg.len = adv7511_cec_read(sd, 0x25) & 0x1f;
++
++ v4l2_dbg(1, debug, sd, "%s: cec msg len %d\n", __func__,
++ msg.len);
++
++ if (msg.len > 16)
++ msg.len = 16;
++
++ if (msg.len) {
++ u8 i;
++
++ for (i = 0; i < msg.len; i++)
++ msg.msg[i] = adv7511_cec_read(sd, i + 0x15);
++
++ adv7511_cec_write(sd, 0x4a, 0); /* toggle to re-enable rx 1 */
++ adv7511_cec_write(sd, 0x4a, 1);
++ cec_received_msg(state->cec_adap, &msg);
++ }
++ }
++#endif
++
++ /* enable interrupts */
++ adv7511_set_isr(sd, true);
++
++ if (handled)
++ *handled = true;
++ return 0;
++}
++
++static const struct v4l2_subdev_core_ops adv7511_core_ops = {
++ .log_status = adv7511_log_status,
++#ifdef CONFIG_VIDEO_ADV_DEBUG
++ .g_register = adv7511_g_register,
++ .s_register = adv7511_s_register,
++#endif
++ .s_power = adv7511_s_power,
++ .interrupt_service_routine = adv7511_isr,
++};
++
++/* ------------------------------ VIDEO OPS ------------------------------ */
++
++/* Enable/disable adv7511 output */
++static int adv7511_s_stream(struct v4l2_subdev *sd, int enable)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis"));
++ adv7511_wr_and_or(sd, 0xa1, ~0x3c, (enable ? 0 : 0x3c));
++ if (enable) {
++ adv7511_check_monitor_present_status(sd);
++ } else {
++ adv7511_s_power(sd, 0);
++ state->have_monitor = false;
++ }
++ return 0;
++}
++
++static int adv7511_s_dv_timings(struct v4l2_subdev *sd,
++ struct v4l2_dv_timings *timings)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ struct v4l2_bt_timings *bt = &timings->bt;
++ u32 fps;
++
++ v4l2_dbg(1, debug, sd, "%s:\n", __func__);
++
++ /* quick sanity check */
++ if (!v4l2_valid_dv_timings(timings, &adv7511_timings_cap, NULL, NULL))
++ return -EINVAL;
++
++ /* Fill the optional fields .standards and .flags in struct v4l2_dv_timings
++ if the format is one of the CEA or DMT timings. */
++ v4l2_find_dv_timings_cap(timings, &adv7511_timings_cap, 0, NULL, NULL);
++
++ /* save timings */
++ state->dv_timings = *timings;
++
++ /* set h/vsync polarities */
++ adv7511_wr_and_or(sd, 0x17, 0x9f,
++ ((bt->polarities & V4L2_DV_VSYNC_POS_POL) ? 0 : 0x40) |
++ ((bt->polarities & V4L2_DV_HSYNC_POS_POL) ? 0 : 0x20));
++
++ fps = (u32)bt->pixelclock / (V4L2_DV_BT_FRAME_WIDTH(bt) * V4L2_DV_BT_FRAME_HEIGHT(bt));
++ switch (fps) {
++ case 24:
++ adv7511_wr_and_or(sd, 0xfb, 0xf9, 1 << 1);
++ break;
++ case 25:
++ adv7511_wr_and_or(sd, 0xfb, 0xf9, 2 << 1);
++ break;
++ case 30:
++ adv7511_wr_and_or(sd, 0xfb, 0xf9, 3 << 1);
++ break;
++ default:
++ adv7511_wr_and_or(sd, 0xfb, 0xf9, 0);
++ break;
++ }
++
++ /* update quantization range based on new dv_timings */
++ adv7511_set_rgb_quantization_mode(sd, state->rgb_quantization_range_ctrl);
++
++ return 0;
++}
++
++static int adv7511_g_dv_timings(struct v4l2_subdev *sd,
++ struct v4l2_dv_timings *timings)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ v4l2_dbg(1, debug, sd, "%s:\n", __func__);
++
++ if (!timings)
++ return -EINVAL;
++
++ *timings = state->dv_timings;
++
++ return 0;
++}
++
++static int adv7511_enum_dv_timings(struct v4l2_subdev *sd,
++ struct v4l2_enum_dv_timings *timings)
++{
++ if (timings->pad != 0)
++ return -EINVAL;
++
++ return v4l2_enum_dv_timings_cap(timings, &adv7511_timings_cap, NULL, NULL);
++}
++
++static int adv7511_dv_timings_cap(struct v4l2_subdev *sd,
++ struct v4l2_dv_timings_cap *cap)
++{
++ if (cap->pad != 0)
++ return -EINVAL;
++
++ *cap = adv7511_timings_cap;
++ return 0;
++}
++
++static const struct v4l2_subdev_video_ops adv7511_video_ops = {
++ .s_stream = adv7511_s_stream,
++ .s_dv_timings = adv7511_s_dv_timings,
++ .g_dv_timings = adv7511_g_dv_timings,
++};
++
++/* ------------------------------ AUDIO OPS ------------------------------ */
++static int adv7511_s_audio_stream(struct v4l2_subdev *sd, int enable)
++{
++ v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis"));
++
++ if (enable)
++ adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x80);
++ else
++ adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x40);
++
++ return 0;
++}
++
++static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq)
++{
++ u32 N;
++
++ switch (freq) {
++ case 32000: N = 4096; break;
++ case 44100: N = 6272; break;
++ case 48000: N = 6144; break;
++ case 88200: N = 12544; break;
++ case 96000: N = 12288; break;
++ case 176400: N = 25088; break;
++ case 192000: N = 24576; break;
++ default:
++ return -EINVAL;
++ }
++
++ /* Set N (used with CTS to regenerate the audio clock) */
++ adv7511_wr(sd, 0x01, (N >> 16) & 0xf);
++ adv7511_wr(sd, 0x02, (N >> 8) & 0xff);
++ adv7511_wr(sd, 0x03, N & 0xff);
++
++ return 0;
++}
++
++static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq)
++{
++ u32 i2s_sf;
++
++ switch (freq) {
++ case 32000: i2s_sf = 0x30; break;
++ case 44100: i2s_sf = 0x00; break;
++ case 48000: i2s_sf = 0x20; break;
++ case 88200: i2s_sf = 0x80; break;
++ case 96000: i2s_sf = 0xa0; break;
++ case 176400: i2s_sf = 0xc0; break;
++ case 192000: i2s_sf = 0xe0; break;
++ default:
++ return -EINVAL;
++ }
++
++ /* Set sampling frequency for I2S audio to 48 kHz */
++ adv7511_wr_and_or(sd, 0x15, 0xf, i2s_sf);
++
++ return 0;
++}
++
++static int adv7511_s_routing(struct v4l2_subdev *sd, u32 input, u32 output, u32 config)
++{
++ /* Only 2 channels in use for application */
++ adv7511_wr_and_or(sd, 0x73, 0xf8, 0x1);
++ /* Speaker mapping */
++ adv7511_wr(sd, 0x76, 0x00);
++
++ /* 16 bit audio word length */
++ adv7511_wr_and_or(sd, 0x14, 0xf0, 0x02);
++
++ return 0;
++}
++
++static const struct v4l2_subdev_audio_ops adv7511_audio_ops = {
++ .s_stream = adv7511_s_audio_stream,
++ .s_clock_freq = adv7511_s_clock_freq,
++ .s_i2s_clock_freq = adv7511_s_i2s_clock_freq,
++ .s_routing = adv7511_s_routing,
++};
++
++/* ---------------------------- PAD OPS ------------------------------------- */
++
++static int adv7511_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ memset(edid->reserved, 0, sizeof(edid->reserved));
++
++ if (edid->pad != 0)
++ return -EINVAL;
++
++ if (edid->start_block == 0 && edid->blocks == 0) {
++ edid->blocks = state->edid.segments * 2;
++ return 0;
++ }
++
++ if (state->edid.segments == 0)
++ return -ENODATA;
++
++ if (edid->start_block >= state->edid.segments * 2)
++ return -EINVAL;
++
++ if (edid->start_block + edid->blocks > state->edid.segments * 2)
++ edid->blocks = state->edid.segments * 2 - edid->start_block;
++
++ memcpy(edid->edid, &state->edid.data[edid->start_block * 128],
++ 128 * edid->blocks);
++
++ return 0;
++}
++
++static int adv7511_enum_mbus_code(struct v4l2_subdev *sd,
++ struct v4l2_subdev_pad_config *cfg,
++ struct v4l2_subdev_mbus_code_enum *code)
++{
++ if (code->pad != 0)
++ return -EINVAL;
++
++ switch (code->index) {
++ case 0:
++ code->code = MEDIA_BUS_FMT_RGB888_1X24;
++ break;
++ case 1:
++ code->code = MEDIA_BUS_FMT_YUYV8_1X16;
++ break;
++ case 2:
++ code->code = MEDIA_BUS_FMT_UYVY8_1X16;
++ break;
++ default:
++ return -EINVAL;
++ }
++ return 0;
++}
++
++static void adv7511_fill_format(struct adv7511_state *state,
++ struct v4l2_mbus_framefmt *format)
++{
++ format->width = state->dv_timings.bt.width;
++ format->height = state->dv_timings.bt.height;
++ format->field = V4L2_FIELD_NONE;
++}
++
++static int adv7511_get_fmt(struct v4l2_subdev *sd,
++ struct v4l2_subdev_pad_config *cfg,
++ struct v4l2_subdev_format *format)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ if (format->pad != 0)
++ return -EINVAL;
++
++ memset(&format->format, 0, sizeof(format->format));
++ adv7511_fill_format(state, &format->format);
++
++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++ struct v4l2_mbus_framefmt *fmt;
++
++ fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad);
++ format->format.code = fmt->code;
++ format->format.colorspace = fmt->colorspace;
++ format->format.ycbcr_enc = fmt->ycbcr_enc;
++ format->format.quantization = fmt->quantization;
++ format->format.xfer_func = fmt->xfer_func;
++ } else {
++ format->format.code = state->fmt_code;
++ format->format.colorspace = state->colorspace;
++ format->format.ycbcr_enc = state->ycbcr_enc;
++ format->format.quantization = state->quantization;
++ format->format.xfer_func = state->xfer_func;
++ }
++
++ return 0;
++}
++
++static int adv7511_set_fmt(struct v4l2_subdev *sd,
++ struct v4l2_subdev_pad_config *cfg,
++ struct v4l2_subdev_format *format)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ /*
++ * Bitfield namings come the CEA-861-F standard, table 8 "Auxiliary
++ * Video Information (AVI) InfoFrame Format"
++ *
++ * c = Colorimetry
++ * ec = Extended Colorimetry
++ * y = RGB or YCbCr
++ * q = RGB Quantization Range
++ * yq = YCC Quantization Range
++ */
++ u8 c = HDMI_COLORIMETRY_NONE;
++ u8 ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
++ u8 y = HDMI_COLORSPACE_RGB;
++ u8 q = HDMI_QUANTIZATION_RANGE_DEFAULT;
++ u8 yq = HDMI_YCC_QUANTIZATION_RANGE_LIMITED;
++ u8 itc = state->content_type != V4L2_DV_IT_CONTENT_TYPE_NO_ITC;
++ u8 cn = itc ? state->content_type : V4L2_DV_IT_CONTENT_TYPE_GRAPHICS;
++
++ if (format->pad != 0)
++ return -EINVAL;
++ switch (format->format.code) {
++ case MEDIA_BUS_FMT_UYVY8_1X16:
++ case MEDIA_BUS_FMT_YUYV8_1X16:
++ case MEDIA_BUS_FMT_RGB888_1X24:
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ adv7511_fill_format(state, &format->format);
++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++ struct v4l2_mbus_framefmt *fmt;
++
++ fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad);
++ fmt->code = format->format.code;
++ fmt->colorspace = format->format.colorspace;
++ fmt->ycbcr_enc = format->format.ycbcr_enc;
++ fmt->quantization = format->format.quantization;
++ fmt->xfer_func = format->format.xfer_func;
++ return 0;
++ }
++
++ switch (format->format.code) {
++ case MEDIA_BUS_FMT_UYVY8_1X16:
++ adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01);
++ adv7511_wr_and_or(sd, 0x16, 0x03, 0xb8);
++ y = HDMI_COLORSPACE_YUV422;
++ break;
++ case MEDIA_BUS_FMT_YUYV8_1X16:
++ adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01);
++ adv7511_wr_and_or(sd, 0x16, 0x03, 0xbc);
++ y = HDMI_COLORSPACE_YUV422;
++ break;
++ case MEDIA_BUS_FMT_RGB888_1X24:
++ default:
++ adv7511_wr_and_or(sd, 0x15, 0xf0, 0x00);
++ adv7511_wr_and_or(sd, 0x16, 0x03, 0x00);
++ break;
++ }
++ state->fmt_code = format->format.code;
++ state->colorspace = format->format.colorspace;
++ state->ycbcr_enc = format->format.ycbcr_enc;
++ state->quantization = format->format.quantization;
++ state->xfer_func = format->format.xfer_func;
++
++ switch (format->format.colorspace) {
++ case V4L2_COLORSPACE_OPRGB:
++ c = HDMI_COLORIMETRY_EXTENDED;
++ ec = y ? HDMI_EXTENDED_COLORIMETRY_OPYCC_601 :
++ HDMI_EXTENDED_COLORIMETRY_OPRGB;
++ break;
++ case V4L2_COLORSPACE_SMPTE170M:
++ c = y ? HDMI_COLORIMETRY_ITU_601 : HDMI_COLORIMETRY_NONE;
++ if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV601) {
++ c = HDMI_COLORIMETRY_EXTENDED;
++ ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
++ }
++ break;
++ case V4L2_COLORSPACE_REC709:
++ c = y ? HDMI_COLORIMETRY_ITU_709 : HDMI_COLORIMETRY_NONE;
++ if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV709) {
++ c = HDMI_COLORIMETRY_EXTENDED;
++ ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_709;
++ }
++ break;
++ case V4L2_COLORSPACE_SRGB:
++ c = y ? HDMI_COLORIMETRY_EXTENDED : HDMI_COLORIMETRY_NONE;
++ ec = y ? HDMI_EXTENDED_COLORIMETRY_S_YCC_601 :
++ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
++ break;
++ case V4L2_COLORSPACE_BT2020:
++ c = HDMI_COLORIMETRY_EXTENDED;
++ if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_BT2020_CONST_LUM)
++ ec = 5; /* Not yet available in hdmi.h */
++ else
++ ec = 6; /* Not yet available in hdmi.h */
++ break;
++ default:
++ break;
++ }
++
++ /*
++ * CEA-861-F says that for RGB formats the YCC range must match the
++ * RGB range, although sources should ignore the YCC range.
++ *
++ * The RGB quantization range shouldn't be non-zero if the EDID doesn't
++ * have the Q bit set in the Video Capabilities Data Block, however this
++ * isn't checked at the moment. The assumption is that the application
++ * knows the EDID and can detect this.
++ *
++ * The same is true for the YCC quantization range: non-standard YCC
++ * quantization ranges should only be sent if the EDID has the YQ bit
++ * set in the Video Capabilities Data Block.
++ */
++ switch (format->format.quantization) {
++ case V4L2_QUANTIZATION_FULL_RANGE:
++ q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT :
++ HDMI_QUANTIZATION_RANGE_FULL;
++ yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_FULL;
++ break;
++ case V4L2_QUANTIZATION_LIM_RANGE:
++ q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT :
++ HDMI_QUANTIZATION_RANGE_LIMITED;
++ yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_LIMITED;
++ break;
++ }
++
++ adv7511_wr_and_or(sd, 0x4a, 0xbf, 0);
++ adv7511_wr_and_or(sd, 0x55, 0x9f, y << 5);
++ adv7511_wr_and_or(sd, 0x56, 0x3f, c << 6);
++ adv7511_wr_and_or(sd, 0x57, 0x83, (ec << 4) | (q << 2) | (itc << 7));
++ adv7511_wr_and_or(sd, 0x59, 0x0f, (yq << 6) | (cn << 4));
++ adv7511_wr_and_or(sd, 0x4a, 0xff, 1);
++ adv7511_set_rgb_quantization_mode(sd, state->rgb_quantization_range_ctrl);
++
++ return 0;
++}
++
++static const struct v4l2_subdev_pad_ops adv7511_pad_ops = {
++ .get_edid = adv7511_get_edid,
++ .enum_mbus_code = adv7511_enum_mbus_code,
++ .get_fmt = adv7511_get_fmt,
++ .set_fmt = adv7511_set_fmt,
++ .enum_dv_timings = adv7511_enum_dv_timings,
++ .dv_timings_cap = adv7511_dv_timings_cap,
++};
++
++/* --------------------- SUBDEV OPS --------------------------------------- */
++
++static const struct v4l2_subdev_ops adv7511_ops = {
++ .core = &adv7511_core_ops,
++ .pad = &adv7511_pad_ops,
++ .video = &adv7511_video_ops,
++ .audio = &adv7511_audio_ops,
++};
++
++/* ----------------------------------------------------------------------- */
++static void adv7511_dbg_dump_edid(int lvl, int debug, struct v4l2_subdev *sd, int segment, u8 *buf)
++{
++ if (debug >= lvl) {
++ int i, j;
++ v4l2_dbg(lvl, debug, sd, "edid segment %d\n", segment);
++ for (i = 0; i < 256; i += 16) {
++ u8 b[128];
++ u8 *bp = b;
++ if (i == 128)
++ v4l2_dbg(lvl, debug, sd, "\n");
++ for (j = i; j < i + 16; j++) {
++ sprintf(bp, "0x%02x, ", buf[j]);
++ bp += 6;
++ }
++ bp[0] = '\0';
++ v4l2_dbg(lvl, debug, sd, "%s\n", b);
++ }
++ }
++}
++
++static void adv7511_notify_no_edid(struct v4l2_subdev *sd)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ struct adv7511_edid_detect ed;
++
++ /* We failed to read the EDID, so send an event for this. */
++ ed.present = false;
++ ed.segment = adv7511_rd(sd, 0xc4);
++ ed.phys_addr = CEC_PHYS_ADDR_INVALID;
++ cec_s_phys_addr(state->cec_adap, ed.phys_addr, false);
++ v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
++ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0);
++}
++
++static void adv7511_edid_handler(struct work_struct *work)
++{
++ struct delayed_work *dwork = to_delayed_work(work);
++ struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler);
++ struct v4l2_subdev *sd = &state->sd;
++
++ v4l2_dbg(1, debug, sd, "%s:\n", __func__);
++
++ if (adv7511_check_edid_status(sd)) {
++ /* Return if we received the EDID. */
++ return;
++ }
++
++ if (adv7511_have_hotplug(sd)) {
++ /* We must retry reading the EDID several times, it is possible
++ * that initially the EDID couldn't be read due to i2c errors
++ * (DVI connectors are particularly prone to this problem). */
++ if (state->edid.read_retries) {
++ state->edid.read_retries--;
++ v4l2_dbg(1, debug, sd, "%s: edid read failed\n", __func__);
++ state->have_monitor = false;
++ adv7511_s_power(sd, false);
++ adv7511_s_power(sd, true);
++ queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
++ return;
++ }
++ }
++
++ /* We failed to read the EDID, so send an event for this. */
++ adv7511_notify_no_edid(sd);
++ v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__);
++}
++
++static void adv7511_audio_setup(struct v4l2_subdev *sd)
++{
++ v4l2_dbg(1, debug, sd, "%s\n", __func__);
++
++ adv7511_s_i2s_clock_freq(sd, 48000);
++ adv7511_s_clock_freq(sd, 48000);
++ adv7511_s_routing(sd, 0, 0, 0);
++}
++
++/* Configure hdmi transmitter. */
++static void adv7511_setup(struct v4l2_subdev *sd)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ v4l2_dbg(1, debug, sd, "%s\n", __func__);
++
++ /* Input format: RGB 4:4:4 */
++ adv7511_wr_and_or(sd, 0x15, 0xf0, 0x0);
++ /* Output format: RGB 4:4:4 */
++ adv7511_wr_and_or(sd, 0x16, 0x7f, 0x0);
++ /* 1st order interpolation 4:2:2 -> 4:4:4 up conversion, Aspect ratio: 16:9 */
++ adv7511_wr_and_or(sd, 0x17, 0xf9, 0x06);
++ /* Disable pixel repetition */
++ adv7511_wr_and_or(sd, 0x3b, 0x9f, 0x0);
++ /* Disable CSC */
++ adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0);
++ /* Output format: RGB 4:4:4, Active Format Information is valid,
++ * underscanned */
++ adv7511_wr_and_or(sd, 0x55, 0x9c, 0x12);
++ /* AVI Info frame packet enable, Audio Info frame disable */
++ adv7511_wr_and_or(sd, 0x44, 0xe7, 0x10);
++ /* Colorimetry, Active format aspect ratio: same as picure. */
++ adv7511_wr(sd, 0x56, 0xa8);
++ /* No encryption */
++ adv7511_wr_and_or(sd, 0xaf, 0xed, 0x0);
++
++ /* Positive clk edge capture for input video clock */
++ adv7511_wr_and_or(sd, 0xba, 0x1f, 0x60);
++
++ adv7511_audio_setup(sd);
++
++ v4l2_ctrl_handler_setup(&state->hdl);
++}
++
++static void adv7511_notify_monitor_detect(struct v4l2_subdev *sd)
++{
++ struct adv7511_monitor_detect mdt;
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ mdt.present = state->have_monitor;
++ v4l2_subdev_notify(sd, ADV7511_MONITOR_DETECT, (void *)&mdt);
++}
++
++static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ /* read hotplug and rx-sense state */
++ u8 status = adv7511_rd(sd, 0x42);
++
++ v4l2_dbg(1, debug, sd, "%s: status: 0x%x%s%s\n",
++ __func__,
++ status,
++ status & MASK_ADV7511_HPD_DETECT ? ", hotplug" : "",
++ status & MASK_ADV7511_MSEN_DETECT ? ", rx-sense" : "");
++
++ /* update read only ctrls */
++ v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0);
++ v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0);
++
++ if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) {
++ v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__);
++ if (!state->have_monitor) {
++ v4l2_dbg(1, debug, sd, "%s: monitor detected\n", __func__);
++ state->have_monitor = true;
++ adv7511_set_isr(sd, true);
++ if (!adv7511_s_power(sd, true)) {
++ v4l2_dbg(1, debug, sd, "%s: monitor detected, powerup failed\n", __func__);
++ return;
++ }
++ adv7511_setup(sd);
++ adv7511_notify_monitor_detect(sd);
++ state->edid.read_retries = EDID_MAX_RETRIES;
++ queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
++ }
++ } else if (status & MASK_ADV7511_HPD_DETECT) {
++ v4l2_dbg(1, debug, sd, "%s: hotplug detected\n", __func__);
++ state->edid.read_retries = EDID_MAX_RETRIES;
++ queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
++ } else if (!(status & MASK_ADV7511_HPD_DETECT)) {
++ v4l2_dbg(1, debug, sd, "%s: hotplug not detected\n", __func__);
++ if (state->have_monitor) {
++ v4l2_dbg(1, debug, sd, "%s: monitor not detected\n", __func__);
++ state->have_monitor = false;
++ adv7511_notify_monitor_detect(sd);
++ }
++ adv7511_s_power(sd, false);
++ memset(&state->edid, 0, sizeof(struct adv7511_state_edid));
++ adv7511_notify_no_edid(sd);
++ }
++}
++
++static bool edid_block_verify_crc(u8 *edid_block)
++{
++ u8 sum = 0;
++ int i;
++
++ for (i = 0; i < 128; i++)
++ sum += edid_block[i];
++ return sum == 0;
++}
++
++static bool edid_verify_crc(struct v4l2_subdev *sd, u32 segment)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ u32 blocks = state->edid.blocks;
++ u8 *data = state->edid.data;
++
++ if (!edid_block_verify_crc(&data[segment * 256]))
++ return false;
++ if ((segment + 1) * 2 <= blocks)
++ return edid_block_verify_crc(&data[segment * 256 + 128]);
++ return true;
++}
++
++static bool edid_verify_header(struct v4l2_subdev *sd, u32 segment)
++{
++ static const u8 hdmi_header[] = {
++ 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00
++ };
++ struct adv7511_state *state = get_adv7511_state(sd);
++ u8 *data = state->edid.data;
++
++ if (segment != 0)
++ return true;
++ return !memcmp(data, hdmi_header, sizeof(hdmi_header));
++}
++
++static bool adv7511_check_edid_status(struct v4l2_subdev *sd)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ u8 edidRdy = adv7511_rd(sd, 0xc5);
++
++ v4l2_dbg(1, debug, sd, "%s: edid ready (retries: %d)\n",
++ __func__, EDID_MAX_RETRIES - state->edid.read_retries);
++
++ if (state->edid.complete)
++ return true;
++
++ if (edidRdy & MASK_ADV7511_EDID_RDY) {
++ int segment = adv7511_rd(sd, 0xc4);
++ struct adv7511_edid_detect ed;
++
++ if (segment >= EDID_MAX_SEGM) {
++ v4l2_err(sd, "edid segment number too big\n");
++ return false;
++ }
++ v4l2_dbg(1, debug, sd, "%s: got segment %d\n", __func__, segment);
++ adv7511_edid_rd(sd, 256, &state->edid.data[segment * 256]);
++ adv7511_dbg_dump_edid(2, debug, sd, segment, &state->edid.data[segment * 256]);
++ if (segment == 0) {
++ state->edid.blocks = state->edid.data[0x7e] + 1;
++ v4l2_dbg(1, debug, sd, "%s: %d blocks in total\n", __func__, state->edid.blocks);
++ }
++ if (!edid_verify_crc(sd, segment) ||
++ !edid_verify_header(sd, segment)) {
++ /* edid crc error, force reread of edid segment */
++ v4l2_err(sd, "%s: edid crc or header error\n", __func__);
++ state->have_monitor = false;
++ adv7511_s_power(sd, false);
++ adv7511_s_power(sd, true);
++ return false;
++ }
++ /* one more segment read ok */
++ state->edid.segments = segment + 1;
++ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1);
++ if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) {
++ /* Request next EDID segment */
++ v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments);
++ adv7511_wr(sd, 0xc9, 0xf);
++ adv7511_wr(sd, 0xc4, state->edid.segments);
++ state->edid.read_retries = EDID_MAX_RETRIES;
++ queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
++ return false;
++ }
++
++ v4l2_dbg(1, debug, sd, "%s: edid complete with %d segment(s)\n", __func__, state->edid.segments);
++ state->edid.complete = true;
++ ed.phys_addr = cec_get_edid_phys_addr(state->edid.data,
++ state->edid.segments * 256,
++ NULL);
++ /* report when we have all segments
++ but report only for segment 0
++ */
++ ed.present = true;
++ ed.segment = 0;
++ state->edid_detect_counter++;
++ cec_s_phys_addr(state->cec_adap, ed.phys_addr, false);
++ v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
++ return ed.present;
++ }
++
++ return false;
++}
++
++static int adv7511_registered(struct v4l2_subdev *sd)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ struct i2c_client *client = v4l2_get_subdevdata(sd);
++ int err;
++
++ err = cec_register_adapter(state->cec_adap, &client->dev);
++ if (err)
++ cec_delete_adapter(state->cec_adap);
++ return err;
++}
++
++static void adv7511_unregistered(struct v4l2_subdev *sd)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ cec_unregister_adapter(state->cec_adap);
++}
++
++static const struct v4l2_subdev_internal_ops adv7511_int_ops = {
++ .registered = adv7511_registered,
++ .unregistered = adv7511_unregistered,
++};
++
++/* ----------------------------------------------------------------------- */
++/* Setup ADV7511 */
++static void adv7511_init_setup(struct v4l2_subdev *sd)
++{
++ struct adv7511_state *state = get_adv7511_state(sd);
++ struct adv7511_state_edid *edid = &state->edid;
++ u32 cec_clk = state->pdata.cec_clk;
++ u8 ratio;
++
++ v4l2_dbg(1, debug, sd, "%s\n", __func__);
++
++ /* clear all interrupts */
++ adv7511_wr(sd, 0x96, 0xff);
++ adv7511_wr(sd, 0x97, 0xff);
++ /*
++ * Stop HPD from resetting a lot of registers.
++ * It might leave the chip in a partly un-initialized state,
++ * in particular with regards to hotplug bounces.
++ */
++ adv7511_wr_and_or(sd, 0xd6, 0x3f, 0xc0);
++ memset(edid, 0, sizeof(struct adv7511_state_edid));
++ state->have_monitor = false;
++ adv7511_set_isr(sd, false);
++ adv7511_s_stream(sd, false);
++ adv7511_s_audio_stream(sd, false);
++
++ if (state->i2c_cec == NULL)
++ return;
++
++ v4l2_dbg(1, debug, sd, "%s: cec_clk %d\n", __func__, cec_clk);
++
++ /* cec soft reset */
++ adv7511_cec_write(sd, 0x50, 0x01);
++ adv7511_cec_write(sd, 0x50, 0x00);
++
++ /* legacy mode */
++ adv7511_cec_write(sd, 0x4a, 0x00);
++ adv7511_cec_write(sd, 0x4a, 0x07);
++
++ if (cec_clk % 750000 != 0)
++ v4l2_err(sd, "%s: cec_clk %d, not multiple of 750 Khz\n",
++ __func__, cec_clk);
++
++ ratio = (cec_clk / 750000) - 1;
++ adv7511_cec_write(sd, 0x4e, ratio << 2);
++}
++
++static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *id)
++{
++ struct adv7511_state *state;
++ struct adv7511_platform_data *pdata = client->dev.platform_data;
++ struct v4l2_ctrl_handler *hdl;
++ struct v4l2_subdev *sd;
++ u8 chip_id[2];
++ int err = -EIO;
++
++ /* Check if the adapter supports the needed features */
++ if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
++ return -EIO;
++
++ state = devm_kzalloc(&client->dev, sizeof(struct adv7511_state), GFP_KERNEL);
++ if (!state)
++ return -ENOMEM;
++
++ /* Platform data */
++ if (!pdata) {
++ v4l_err(client, "No platform data!\n");
++ return -ENODEV;
++ }
++ memcpy(&state->pdata, pdata, sizeof(state->pdata));
++ state->fmt_code = MEDIA_BUS_FMT_RGB888_1X24;
++ state->colorspace = V4L2_COLORSPACE_SRGB;
++
++ sd = &state->sd;
++
++ v4l2_dbg(1, debug, sd, "detecting adv7511 client on address 0x%x\n",
++ client->addr << 1);
++
++ v4l2_i2c_subdev_init(sd, client, &adv7511_ops);
++ sd->internal_ops = &adv7511_int_ops;
++
++ hdl = &state->hdl;
++ v4l2_ctrl_handler_init(hdl, 10);
++ /* add in ascending ID order */
++ state->hdmi_mode_ctrl = v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
++ V4L2_CID_DV_TX_MODE, V4L2_DV_TX_MODE_HDMI,
++ 0, V4L2_DV_TX_MODE_DVI_D);
++ state->hotplug_ctrl = v4l2_ctrl_new_std(hdl, NULL,
++ V4L2_CID_DV_TX_HOTPLUG, 0, 1, 0, 0);
++ state->rx_sense_ctrl = v4l2_ctrl_new_std(hdl, NULL,
++ V4L2_CID_DV_TX_RXSENSE, 0, 1, 0, 0);
++ state->have_edid0_ctrl = v4l2_ctrl_new_std(hdl, NULL,
++ V4L2_CID_DV_TX_EDID_PRESENT, 0, 1, 0, 0);
++ state->rgb_quantization_range_ctrl =
++ v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
++ V4L2_CID_DV_TX_RGB_RANGE, V4L2_DV_RGB_RANGE_FULL,
++ 0, V4L2_DV_RGB_RANGE_AUTO);
++ state->content_type_ctrl =
++ v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
++ V4L2_CID_DV_TX_IT_CONTENT_TYPE, V4L2_DV_IT_CONTENT_TYPE_NO_ITC,
++ 0, V4L2_DV_IT_CONTENT_TYPE_NO_ITC);
++ sd->ctrl_handler = hdl;
++ if (hdl->error) {
++ err = hdl->error;
++ goto err_hdl;
++ }
++ state->pad.flags = MEDIA_PAD_FL_SINK;
++ sd->entity.function = MEDIA_ENT_F_DV_ENCODER;
++ err = media_entity_pads_init(&sd->entity, 1, &state->pad);
++ if (err)
++ goto err_hdl;
++
++ /* EDID and CEC i2c addr */
++ state->i2c_edid_addr = state->pdata.i2c_edid << 1;
++ state->i2c_cec_addr = state->pdata.i2c_cec << 1;
++ state->i2c_pktmem_addr = state->pdata.i2c_pktmem << 1;
++
++ state->chip_revision = adv7511_rd(sd, 0x0);
++ chip_id[0] = adv7511_rd(sd, 0xf5);
++ chip_id[1] = adv7511_rd(sd, 0xf6);
++ if (chip_id[0] != 0x75 || chip_id[1] != 0x11) {
++ v4l2_err(sd, "chip_id != 0x7511, read 0x%02x%02x\n", chip_id[0],
++ chip_id[1]);
++ err = -EIO;
++ goto err_entity;
++ }
++
++ state->i2c_edid = i2c_new_dummy(client->adapter,
++ state->i2c_edid_addr >> 1);
++ if (state->i2c_edid == NULL) {
++ v4l2_err(sd, "failed to register edid i2c client\n");
++ err = -ENOMEM;
++ goto err_entity;
++ }
++
++ adv7511_wr(sd, 0xe1, state->i2c_cec_addr);
++ if (state->pdata.cec_clk < 3000000 ||
++ state->pdata.cec_clk > 100000000) {
++ v4l2_err(sd, "%s: cec_clk %u outside range, disabling cec\n",
++ __func__, state->pdata.cec_clk);
++ state->pdata.cec_clk = 0;
++ }
++
++ if (state->pdata.cec_clk) {
++ state->i2c_cec = i2c_new_dummy(client->adapter,
++ state->i2c_cec_addr >> 1);
++ if (state->i2c_cec == NULL) {
++ v4l2_err(sd, "failed to register cec i2c client\n");
++ err = -ENOMEM;
++ goto err_unreg_edid;
++ }
++ adv7511_wr(sd, 0xe2, 0x00); /* power up cec section */
++ } else {
++ adv7511_wr(sd, 0xe2, 0x01); /* power down cec section */
++ }
++
++ state->i2c_pktmem = i2c_new_dummy(client->adapter, state->i2c_pktmem_addr >> 1);
++ if (state->i2c_pktmem == NULL) {
++ v4l2_err(sd, "failed to register pktmem i2c client\n");
++ err = -ENOMEM;
++ goto err_unreg_cec;
++ }
++
++ state->work_queue = create_singlethread_workqueue(sd->name);
++ if (state->work_queue == NULL) {
++ v4l2_err(sd, "could not create workqueue\n");
++ err = -ENOMEM;
++ goto err_unreg_pktmem;
++ }
++
++ INIT_DELAYED_WORK(&state->edid_handler, adv7511_edid_handler);
++
++ adv7511_init_setup(sd);
++
++#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
++ state->cec_adap = cec_allocate_adapter(&adv7511_cec_adap_ops,
++ state, dev_name(&client->dev), CEC_CAP_DEFAULTS,
++ ADV7511_MAX_ADDRS);
++ err = PTR_ERR_OR_ZERO(state->cec_adap);
++ if (err) {
++ destroy_workqueue(state->work_queue);
++ goto err_unreg_pktmem;
++ }
++#endif
++
++ adv7511_set_isr(sd, true);
++ adv7511_check_monitor_present_status(sd);
++
++ v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name,
++ client->addr << 1, client->adapter->name);
++ return 0;
++
++err_unreg_pktmem:
++ i2c_unregister_device(state->i2c_pktmem);
++err_unreg_cec:
++ if (state->i2c_cec)
++ i2c_unregister_device(state->i2c_cec);
++err_unreg_edid:
++ i2c_unregister_device(state->i2c_edid);
++err_entity:
++ media_entity_cleanup(&sd->entity);
++err_hdl:
++ v4l2_ctrl_handler_free(&state->hdl);
++ return err;
++}
++
++/* ----------------------------------------------------------------------- */
++
++static int adv7511_remove(struct i2c_client *client)
++{
++ struct v4l2_subdev *sd = i2c_get_clientdata(client);
++ struct adv7511_state *state = get_adv7511_state(sd);
++
++ state->chip_revision = -1;
++
++ v4l2_dbg(1, debug, sd, "%s removed @ 0x%x (%s)\n", client->name,
++ client->addr << 1, client->adapter->name);
++
++ adv7511_set_isr(sd, false);
++ adv7511_init_setup(sd);
++ cancel_delayed_work(&state->edid_handler);
++ i2c_unregister_device(state->i2c_edid);
++ if (state->i2c_cec)
++ i2c_unregister_device(state->i2c_cec);
++ i2c_unregister_device(state->i2c_pktmem);
++ destroy_workqueue(state->work_queue);
++ v4l2_device_unregister_subdev(sd);
++ media_entity_cleanup(&sd->entity);
++ v4l2_ctrl_handler_free(sd->ctrl_handler);
++ return 0;
++}
++
++/* ----------------------------------------------------------------------- */
++
++static const struct i2c_device_id adv7511_id[] = {
++ { "adv7511", 0 },
++ { }
++};
++MODULE_DEVICE_TABLE(i2c, adv7511_id);
++
++static struct i2c_driver adv7511_driver = {
++ .driver = {
++ .name = "adv7511",
++ },
++ .probe = adv7511_probe,
++ .remove = adv7511_remove,
++ .id_table = adv7511_id,
++};
++
++module_i2c_driver(adv7511_driver);
+diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
+deleted file mode 100644
+index 88349b5053cc..000000000000
+--- a/drivers/media/i2c/adv7511.c
++++ /dev/null
+@@ -1,1992 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0-only
+-/*
+- * Analog Devices ADV7511 HDMI Transmitter Device Driver
+- *
+- * Copyright 2013 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
+- */
+-
+-
+-#include <linux/kernel.h>
+-#include <linux/module.h>
+-#include <linux/slab.h>
+-#include <linux/i2c.h>
+-#include <linux/delay.h>
+-#include <linux/videodev2.h>
+-#include <linux/gpio.h>
+-#include <linux/workqueue.h>
+-#include <linux/hdmi.h>
+-#include <linux/v4l2-dv-timings.h>
+-#include <media/v4l2-device.h>
+-#include <media/v4l2-common.h>
+-#include <media/v4l2-ctrls.h>
+-#include <media/v4l2-dv-timings.h>
+-#include <media/i2c/adv7511.h>
+-#include <media/cec.h>
+-
+-static int debug;
+-module_param(debug, int, 0644);
+-MODULE_PARM_DESC(debug, "debug level (0-2)");
+-
+-MODULE_DESCRIPTION("Analog Devices ADV7511 HDMI Transmitter Device Driver");
+-MODULE_AUTHOR("Hans Verkuil");
+-MODULE_LICENSE("GPL v2");
+-
+-#define MASK_ADV7511_EDID_RDY_INT 0x04
+-#define MASK_ADV7511_MSEN_INT 0x40
+-#define MASK_ADV7511_HPD_INT 0x80
+-
+-#define MASK_ADV7511_HPD_DETECT 0x40
+-#define MASK_ADV7511_MSEN_DETECT 0x20
+-#define MASK_ADV7511_EDID_RDY 0x10
+-
+-#define EDID_MAX_RETRIES (8)
+-#define EDID_DELAY 250
+-#define EDID_MAX_SEGM 8
+-
+-#define ADV7511_MAX_WIDTH 1920
+-#define ADV7511_MAX_HEIGHT 1200
+-#define ADV7511_MIN_PIXELCLOCK 20000000
+-#define ADV7511_MAX_PIXELCLOCK 225000000
+-
+-#define ADV7511_MAX_ADDRS (3)
+-
+-/*
+-**********************************************************************
+-*
+-* Arrays with configuration parameters for the ADV7511
+-*
+-**********************************************************************
+-*/
+-
+-struct i2c_reg_value {
+- unsigned char reg;
+- unsigned char value;
+-};
+-
+-struct adv7511_state_edid {
+- /* total number of blocks */
+- u32 blocks;
+- /* Number of segments read */
+- u32 segments;
+- u8 data[EDID_MAX_SEGM * 256];
+- /* Number of EDID read retries left */
+- unsigned read_retries;
+- bool complete;
+-};
+-
+-struct adv7511_state {
+- struct adv7511_platform_data pdata;
+- struct v4l2_subdev sd;
+- struct media_pad pad;
+- struct v4l2_ctrl_handler hdl;
+- int chip_revision;
+- u8 i2c_edid_addr;
+- u8 i2c_pktmem_addr;
+- u8 i2c_cec_addr;
+-
+- struct i2c_client *i2c_cec;
+- struct cec_adapter *cec_adap;
+- u8 cec_addr[ADV7511_MAX_ADDRS];
+- u8 cec_valid_addrs;
+- bool cec_enabled_adap;
+-
+- /* Is the adv7511 powered on? */
+- bool power_on;
+- /* Did we receive hotplug and rx-sense signals? */
+- bool have_monitor;
+- bool enabled_irq;
+- /* timings from s_dv_timings */
+- struct v4l2_dv_timings dv_timings;
+- u32 fmt_code;
+- u32 colorspace;
+- u32 ycbcr_enc;
+- u32 quantization;
+- u32 xfer_func;
+- u32 content_type;
+- /* controls */
+- struct v4l2_ctrl *hdmi_mode_ctrl;
+- struct v4l2_ctrl *hotplug_ctrl;
+- struct v4l2_ctrl *rx_sense_ctrl;
+- struct v4l2_ctrl *have_edid0_ctrl;
+- struct v4l2_ctrl *rgb_quantization_range_ctrl;
+- struct v4l2_ctrl *content_type_ctrl;
+- struct i2c_client *i2c_edid;
+- struct i2c_client *i2c_pktmem;
+- struct adv7511_state_edid edid;
+- /* Running counter of the number of detected EDIDs (for debugging) */
+- unsigned edid_detect_counter;
+- struct workqueue_struct *work_queue;
+- struct delayed_work edid_handler; /* work entry */
+-};
+-
+-static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd);
+-static bool adv7511_check_edid_status(struct v4l2_subdev *sd);
+-static void adv7511_setup(struct v4l2_subdev *sd);
+-static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq);
+-static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq);
+-
+-
+-static const struct v4l2_dv_timings_cap adv7511_timings_cap = {
+- .type = V4L2_DV_BT_656_1120,
+- /* keep this initialization for compatibility with GCC < 4.4.6 */
+- .reserved = { 0 },
+- V4L2_INIT_BT_TIMINGS(640, ADV7511_MAX_WIDTH, 350, ADV7511_MAX_HEIGHT,
+- ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK,
+- V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+- V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
+- V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
+- V4L2_DV_BT_CAP_CUSTOM)
+-};
+-
+-static inline struct adv7511_state *get_adv7511_state(struct v4l2_subdev *sd)
+-{
+- return container_of(sd, struct adv7511_state, sd);
+-}
+-
+-static inline struct v4l2_subdev *to_sd(struct v4l2_ctrl *ctrl)
+-{
+- return &container_of(ctrl->handler, struct adv7511_state, hdl)->sd;
+-}
+-
+-/* ------------------------ I2C ----------------------------------------------- */
+-
+-static s32 adv_smbus_read_byte_data_check(struct i2c_client *client,
+- u8 command, bool check)
+-{
+- union i2c_smbus_data data;
+-
+- if (!i2c_smbus_xfer(client->adapter, client->addr, client->flags,
+- I2C_SMBUS_READ, command,
+- I2C_SMBUS_BYTE_DATA, &data))
+- return data.byte;
+- if (check)
+- v4l_err(client, "error reading %02x, %02x\n",
+- client->addr, command);
+- return -1;
+-}
+-
+-static s32 adv_smbus_read_byte_data(struct i2c_client *client, u8 command)
+-{
+- int i;
+- for (i = 0; i < 3; i++) {
+- int ret = adv_smbus_read_byte_data_check(client, command, true);
+- if (ret >= 0) {
+- if (i)
+- v4l_err(client, "read ok after %d retries\n", i);
+- return ret;
+- }
+- }
+- v4l_err(client, "read failed\n");
+- return -1;
+-}
+-
+-static int adv7511_rd(struct v4l2_subdev *sd, u8 reg)
+-{
+- struct i2c_client *client = v4l2_get_subdevdata(sd);
+-
+- return adv_smbus_read_byte_data(client, reg);
+-}
+-
+-static int adv7511_wr(struct v4l2_subdev *sd, u8 reg, u8 val)
+-{
+- struct i2c_client *client = v4l2_get_subdevdata(sd);
+- int ret;
+- int i;
+-
+- for (i = 0; i < 3; i++) {
+- ret = i2c_smbus_write_byte_data(client, reg, val);
+- if (ret == 0)
+- return 0;
+- }
+- v4l2_err(sd, "%s: i2c write error\n", __func__);
+- return ret;
+-}
+-
+-/* To set specific bits in the register, a clear-mask is given (to be AND-ed),
+- and then the value-mask (to be OR-ed). */
+-static inline void adv7511_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask)
+-{
+- adv7511_wr(sd, reg, (adv7511_rd(sd, reg) & clr_mask) | val_mask);
+-}
+-
+-static int adv_smbus_read_i2c_block_data(struct i2c_client *client,
+- u8 command, unsigned length, u8 *values)
+-{
+- union i2c_smbus_data data;
+- int ret;
+-
+- if (length > I2C_SMBUS_BLOCK_MAX)
+- length = I2C_SMBUS_BLOCK_MAX;
+- data.block[0] = length;
+-
+- ret = i2c_smbus_xfer(client->adapter, client->addr, client->flags,
+- I2C_SMBUS_READ, command,
+- I2C_SMBUS_I2C_BLOCK_DATA, &data);
+- memcpy(values, data.block + 1, length);
+- return ret;
+-}
+-
+-static void adv7511_edid_rd(struct v4l2_subdev *sd, uint16_t len, uint8_t *buf)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- int i;
+- int err = 0;
+-
+- v4l2_dbg(1, debug, sd, "%s:\n", __func__);
+-
+- for (i = 0; !err && i < len; i += I2C_SMBUS_BLOCK_MAX)
+- err = adv_smbus_read_i2c_block_data(state->i2c_edid, i,
+- I2C_SMBUS_BLOCK_MAX, buf + i);
+- if (err)
+- v4l2_err(sd, "%s: i2c read error\n", __func__);
+-}
+-
+-static inline int adv7511_cec_read(struct v4l2_subdev *sd, u8 reg)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- return i2c_smbus_read_byte_data(state->i2c_cec, reg);
+-}
+-
+-static int adv7511_cec_write(struct v4l2_subdev *sd, u8 reg, u8 val)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- int ret;
+- int i;
+-
+- for (i = 0; i < 3; i++) {
+- ret = i2c_smbus_write_byte_data(state->i2c_cec, reg, val);
+- if (ret == 0)
+- return 0;
+- }
+- v4l2_err(sd, "%s: I2C Write Problem\n", __func__);
+- return ret;
+-}
+-
+-static inline int adv7511_cec_write_and_or(struct v4l2_subdev *sd, u8 reg, u8 mask,
+- u8 val)
+-{
+- return adv7511_cec_write(sd, reg, (adv7511_cec_read(sd, reg) & mask) | val);
+-}
+-
+-static int adv7511_pktmem_rd(struct v4l2_subdev *sd, u8 reg)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- return adv_smbus_read_byte_data(state->i2c_pktmem, reg);
+-}
+-
+-static int adv7511_pktmem_wr(struct v4l2_subdev *sd, u8 reg, u8 val)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- int ret;
+- int i;
+-
+- for (i = 0; i < 3; i++) {
+- ret = i2c_smbus_write_byte_data(state->i2c_pktmem, reg, val);
+- if (ret == 0)
+- return 0;
+- }
+- v4l2_err(sd, "%s: i2c write error\n", __func__);
+- return ret;
+-}
+-
+-/* To set specific bits in the register, a clear-mask is given (to be AND-ed),
+- and then the value-mask (to be OR-ed). */
+-static inline void adv7511_pktmem_wr_and_or(struct v4l2_subdev *sd, u8 reg, u8 clr_mask, u8 val_mask)
+-{
+- adv7511_pktmem_wr(sd, reg, (adv7511_pktmem_rd(sd, reg) & clr_mask) | val_mask);
+-}
+-
+-static inline bool adv7511_have_hotplug(struct v4l2_subdev *sd)
+-{
+- return adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT;
+-}
+-
+-static inline bool adv7511_have_rx_sense(struct v4l2_subdev *sd)
+-{
+- return adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT;
+-}
+-
+-static void adv7511_csc_conversion_mode(struct v4l2_subdev *sd, u8 mode)
+-{
+- adv7511_wr_and_or(sd, 0x18, 0x9f, (mode & 0x3)<<5);
+-}
+-
+-static void adv7511_csc_coeff(struct v4l2_subdev *sd,
+- u16 A1, u16 A2, u16 A3, u16 A4,
+- u16 B1, u16 B2, u16 B3, u16 B4,
+- u16 C1, u16 C2, u16 C3, u16 C4)
+-{
+- /* A */
+- adv7511_wr_and_or(sd, 0x18, 0xe0, A1>>8);
+- adv7511_wr(sd, 0x19, A1);
+- adv7511_wr_and_or(sd, 0x1A, 0xe0, A2>>8);
+- adv7511_wr(sd, 0x1B, A2);
+- adv7511_wr_and_or(sd, 0x1c, 0xe0, A3>>8);
+- adv7511_wr(sd, 0x1d, A3);
+- adv7511_wr_and_or(sd, 0x1e, 0xe0, A4>>8);
+- adv7511_wr(sd, 0x1f, A4);
+-
+- /* B */
+- adv7511_wr_and_or(sd, 0x20, 0xe0, B1>>8);
+- adv7511_wr(sd, 0x21, B1);
+- adv7511_wr_and_or(sd, 0x22, 0xe0, B2>>8);
+- adv7511_wr(sd, 0x23, B2);
+- adv7511_wr_and_or(sd, 0x24, 0xe0, B3>>8);
+- adv7511_wr(sd, 0x25, B3);
+- adv7511_wr_and_or(sd, 0x26, 0xe0, B4>>8);
+- adv7511_wr(sd, 0x27, B4);
+-
+- /* C */
+- adv7511_wr_and_or(sd, 0x28, 0xe0, C1>>8);
+- adv7511_wr(sd, 0x29, C1);
+- adv7511_wr_and_or(sd, 0x2A, 0xe0, C2>>8);
+- adv7511_wr(sd, 0x2B, C2);
+- adv7511_wr_and_or(sd, 0x2C, 0xe0, C3>>8);
+- adv7511_wr(sd, 0x2D, C3);
+- adv7511_wr_and_or(sd, 0x2E, 0xe0, C4>>8);
+- adv7511_wr(sd, 0x2F, C4);
+-}
+-
+-static void adv7511_csc_rgb_full2limit(struct v4l2_subdev *sd, bool enable)
+-{
+- if (enable) {
+- u8 csc_mode = 0;
+- adv7511_csc_conversion_mode(sd, csc_mode);
+- adv7511_csc_coeff(sd,
+- 4096-564, 0, 0, 256,
+- 0, 4096-564, 0, 256,
+- 0, 0, 4096-564, 256);
+- /* enable CSC */
+- adv7511_wr_and_or(sd, 0x18, 0x7f, 0x80);
+- /* AVI infoframe: Limited range RGB (16-235) */
+- adv7511_wr_and_or(sd, 0x57, 0xf3, 0x04);
+- } else {
+- /* disable CSC */
+- adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0);
+- /* AVI infoframe: Full range RGB (0-255) */
+- adv7511_wr_and_or(sd, 0x57, 0xf3, 0x08);
+- }
+-}
+-
+-static void adv7511_set_rgb_quantization_mode(struct v4l2_subdev *sd, struct v4l2_ctrl *ctrl)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- /* Only makes sense for RGB formats */
+- if (state->fmt_code != MEDIA_BUS_FMT_RGB888_1X24) {
+- /* so just keep quantization */
+- adv7511_csc_rgb_full2limit(sd, false);
+- return;
+- }
+-
+- switch (ctrl->val) {
+- case V4L2_DV_RGB_RANGE_AUTO:
+- /* automatic */
+- if (state->dv_timings.bt.flags & V4L2_DV_FL_IS_CE_VIDEO) {
+- /* CE format, RGB limited range (16-235) */
+- adv7511_csc_rgb_full2limit(sd, true);
+- } else {
+- /* not CE format, RGB full range (0-255) */
+- adv7511_csc_rgb_full2limit(sd, false);
+- }
+- break;
+- case V4L2_DV_RGB_RANGE_LIMITED:
+- /* RGB limited range (16-235) */
+- adv7511_csc_rgb_full2limit(sd, true);
+- break;
+- case V4L2_DV_RGB_RANGE_FULL:
+- /* RGB full range (0-255) */
+- adv7511_csc_rgb_full2limit(sd, false);
+- break;
+- }
+-}
+-
+-/* ------------------------------ CTRL OPS ------------------------------ */
+-
+-static int adv7511_s_ctrl(struct v4l2_ctrl *ctrl)
+-{
+- struct v4l2_subdev *sd = to_sd(ctrl);
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- v4l2_dbg(1, debug, sd, "%s: ctrl id: %d, ctrl->val %d\n", __func__, ctrl->id, ctrl->val);
+-
+- if (state->hdmi_mode_ctrl == ctrl) {
+- /* Set HDMI or DVI-D */
+- adv7511_wr_and_or(sd, 0xaf, 0xfd, ctrl->val == V4L2_DV_TX_MODE_HDMI ? 0x02 : 0x00);
+- return 0;
+- }
+- if (state->rgb_quantization_range_ctrl == ctrl) {
+- adv7511_set_rgb_quantization_mode(sd, ctrl);
+- return 0;
+- }
+- if (state->content_type_ctrl == ctrl) {
+- u8 itc, cn;
+-
+- state->content_type = ctrl->val;
+- itc = state->content_type != V4L2_DV_IT_CONTENT_TYPE_NO_ITC;
+- cn = itc ? state->content_type : V4L2_DV_IT_CONTENT_TYPE_GRAPHICS;
+- adv7511_wr_and_or(sd, 0x57, 0x7f, itc << 7);
+- adv7511_wr_and_or(sd, 0x59, 0xcf, cn << 4);
+- return 0;
+- }
+-
+- return -EINVAL;
+-}
+-
+-static const struct v4l2_ctrl_ops adv7511_ctrl_ops = {
+- .s_ctrl = adv7511_s_ctrl,
+-};
+-
+-/* ---------------------------- CORE OPS ------------------------------------------- */
+-
+-#ifdef CONFIG_VIDEO_ADV_DEBUG
+-static void adv7511_inv_register(struct v4l2_subdev *sd)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- v4l2_info(sd, "0x000-0x0ff: Main Map\n");
+- if (state->i2c_cec)
+- v4l2_info(sd, "0x100-0x1ff: CEC Map\n");
+-}
+-
+-static int adv7511_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- reg->size = 1;
+- switch (reg->reg >> 8) {
+- case 0:
+- reg->val = adv7511_rd(sd, reg->reg & 0xff);
+- break;
+- case 1:
+- if (state->i2c_cec) {
+- reg->val = adv7511_cec_read(sd, reg->reg & 0xff);
+- break;
+- }
+- /* fall through */
+- default:
+- v4l2_info(sd, "Register %03llx not supported\n", reg->reg);
+- adv7511_inv_register(sd);
+- break;
+- }
+- return 0;
+-}
+-
+-static int adv7511_s_register(struct v4l2_subdev *sd, const struct v4l2_dbg_register *reg)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- switch (reg->reg >> 8) {
+- case 0:
+- adv7511_wr(sd, reg->reg & 0xff, reg->val & 0xff);
+- break;
+- case 1:
+- if (state->i2c_cec) {
+- adv7511_cec_write(sd, reg->reg & 0xff, reg->val & 0xff);
+- break;
+- }
+- /* fall through */
+- default:
+- v4l2_info(sd, "Register %03llx not supported\n", reg->reg);
+- adv7511_inv_register(sd);
+- break;
+- }
+- return 0;
+-}
+-#endif
+-
+-struct adv7511_cfg_read_infoframe {
+- const char *desc;
+- u8 present_reg;
+- u8 present_mask;
+- u8 header[3];
+- u16 payload_addr;
+-};
+-
+-static u8 hdmi_infoframe_checksum(u8 *ptr, size_t size)
+-{
+- u8 csum = 0;
+- size_t i;
+-
+- /* compute checksum */
+- for (i = 0; i < size; i++)
+- csum += ptr[i];
+-
+- return 256 - csum;
+-}
+-
+-static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_infoframe *cri)
+-{
+- struct i2c_client *client = v4l2_get_subdevdata(sd);
+- struct device *dev = &client->dev;
+- union hdmi_infoframe frame;
+- u8 buffer[32];
+- u8 len;
+- int i;
+-
+- if (!(adv7511_rd(sd, cri->present_reg) & cri->present_mask)) {
+- v4l2_info(sd, "%s infoframe not transmitted\n", cri->desc);
+- return;
+- }
+-
+- memcpy(buffer, cri->header, sizeof(cri->header));
+-
+- len = buffer[2];
+-
+- if (len + 4 > sizeof(buffer)) {
+- v4l2_err(sd, "%s: invalid %s infoframe length %d\n", __func__, cri->desc, len);
+- return;
+- }
+-
+- if (cri->payload_addr >= 0x100) {
+- for (i = 0; i < len; i++)
+- buffer[i + 4] = adv7511_pktmem_rd(sd, cri->payload_addr + i - 0x100);
+- } else {
+- for (i = 0; i < len; i++)
+- buffer[i + 4] = adv7511_rd(sd, cri->payload_addr + i);
+- }
+- buffer[3] = 0;
+- buffer[3] = hdmi_infoframe_checksum(buffer, len + 4);
+-
+- if (hdmi_infoframe_unpack(&frame, buffer) < 0) {
+- v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
+- return;
+- }
+-
+- hdmi_infoframe_log(KERN_INFO, dev, &frame);
+-}
+-
+-static void adv7511_log_infoframes(struct v4l2_subdev *sd)
+-{
+- static const struct adv7511_cfg_read_infoframe cri[] = {
+- { "AVI", 0x44, 0x10, { 0x82, 2, 13 }, 0x55 },
+- { "Audio", 0x44, 0x08, { 0x84, 1, 10 }, 0x73 },
+- { "SDP", 0x40, 0x40, { 0x83, 1, 25 }, 0x103 },
+- };
+- int i;
+-
+- for (i = 0; i < ARRAY_SIZE(cri); i++)
+- log_infoframe(sd, &cri[i]);
+-}
+-
+-static int adv7511_log_status(struct v4l2_subdev *sd)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- struct adv7511_state_edid *edid = &state->edid;
+- int i;
+-
+- static const char * const states[] = {
+- "in reset",
+- "reading EDID",
+- "idle",
+- "initializing HDCP",
+- "HDCP enabled",
+- "initializing HDCP repeater",
+- "6", "7", "8", "9", "A", "B", "C", "D", "E", "F"
+- };
+- static const char * const errors[] = {
+- "no error",
+- "bad receiver BKSV",
+- "Ri mismatch",
+- "Pj mismatch",
+- "i2c error",
+- "timed out",
+- "max repeater cascade exceeded",
+- "hash check failed",
+- "too many devices",
+- "9", "A", "B", "C", "D", "E", "F"
+- };
+-
+- v4l2_info(sd, "power %s\n", state->power_on ? "on" : "off");
+- v4l2_info(sd, "%s hotplug, %s Rx Sense, %s EDID (%d block(s))\n",
+- (adv7511_rd(sd, 0x42) & MASK_ADV7511_HPD_DETECT) ? "detected" : "no",
+- (adv7511_rd(sd, 0x42) & MASK_ADV7511_MSEN_DETECT) ? "detected" : "no",
+- edid->segments ? "found" : "no",
+- edid->blocks);
+- v4l2_info(sd, "%s output %s\n",
+- (adv7511_rd(sd, 0xaf) & 0x02) ?
+- "HDMI" : "DVI-D",
+- (adv7511_rd(sd, 0xa1) & 0x3c) ?
+- "disabled" : "enabled");
+- v4l2_info(sd, "state: %s, error: %s, detect count: %u, msk/irq: %02x/%02x\n",
+- states[adv7511_rd(sd, 0xc8) & 0xf],
+- errors[adv7511_rd(sd, 0xc8) >> 4], state->edid_detect_counter,
+- adv7511_rd(sd, 0x94), adv7511_rd(sd, 0x96));
+- v4l2_info(sd, "RGB quantization: %s range\n", adv7511_rd(sd, 0x18) & 0x80 ? "limited" : "full");
+- if (adv7511_rd(sd, 0xaf) & 0x02) {
+- /* HDMI only */
+- u8 manual_cts = adv7511_rd(sd, 0x0a) & 0x80;
+- u32 N = (adv7511_rd(sd, 0x01) & 0xf) << 16 |
+- adv7511_rd(sd, 0x02) << 8 |
+- adv7511_rd(sd, 0x03);
+- u8 vic_detect = adv7511_rd(sd, 0x3e) >> 2;
+- u8 vic_sent = adv7511_rd(sd, 0x3d) & 0x3f;
+- u32 CTS;
+-
+- if (manual_cts)
+- CTS = (adv7511_rd(sd, 0x07) & 0xf) << 16 |
+- adv7511_rd(sd, 0x08) << 8 |
+- adv7511_rd(sd, 0x09);
+- else
+- CTS = (adv7511_rd(sd, 0x04) & 0xf) << 16 |
+- adv7511_rd(sd, 0x05) << 8 |
+- adv7511_rd(sd, 0x06);
+- v4l2_info(sd, "CTS %s mode: N %d, CTS %d\n",
+- manual_cts ? "manual" : "automatic", N, CTS);
+- v4l2_info(sd, "VIC: detected %d, sent %d\n",
+- vic_detect, vic_sent);
+- adv7511_log_infoframes(sd);
+- }
+- if (state->dv_timings.type == V4L2_DV_BT_656_1120)
+- v4l2_print_dv_timings(sd->name, "timings: ",
+- &state->dv_timings, false);
+- else
+- v4l2_info(sd, "no timings set\n");
+- v4l2_info(sd, "i2c edid addr: 0x%x\n", state->i2c_edid_addr);
+-
+- if (state->i2c_cec == NULL)
+- return 0;
+-
+- v4l2_info(sd, "i2c cec addr: 0x%x\n", state->i2c_cec_addr);
+-
+- v4l2_info(sd, "CEC: %s\n", state->cec_enabled_adap ?
+- "enabled" : "disabled");
+- if (state->cec_enabled_adap) {
+- for (i = 0; i < ADV7511_MAX_ADDRS; i++) {
+- bool is_valid = state->cec_valid_addrs & (1 << i);
+-
+- if (is_valid)
+- v4l2_info(sd, "CEC Logical Address: 0x%x\n",
+- state->cec_addr[i]);
+- }
+- }
+- v4l2_info(sd, "i2c pktmem addr: 0x%x\n", state->i2c_pktmem_addr);
+- return 0;
+-}
+-
+-/* Power up/down adv7511 */
+-static int adv7511_s_power(struct v4l2_subdev *sd, int on)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- const int retries = 20;
+- int i;
+-
+- v4l2_dbg(1, debug, sd, "%s: power %s\n", __func__, on ? "on" : "off");
+-
+- state->power_on = on;
+-
+- if (!on) {
+- /* Power down */
+- adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40);
+- return true;
+- }
+-
+- /* Power up */
+- /* The adv7511 does not always come up immediately.
+- Retry multiple times. */
+- for (i = 0; i < retries; i++) {
+- adv7511_wr_and_or(sd, 0x41, 0xbf, 0x0);
+- if ((adv7511_rd(sd, 0x41) & 0x40) == 0)
+- break;
+- adv7511_wr_and_or(sd, 0x41, 0xbf, 0x40);
+- msleep(10);
+- }
+- if (i == retries) {
+- v4l2_dbg(1, debug, sd, "%s: failed to powerup the adv7511!\n", __func__);
+- adv7511_s_power(sd, 0);
+- return false;
+- }
+- if (i > 1)
+- v4l2_dbg(1, debug, sd, "%s: needed %d retries to powerup the adv7511\n", __func__, i);
+-
+- /* Reserved registers that must be set */
+- adv7511_wr(sd, 0x98, 0x03);
+- adv7511_wr_and_or(sd, 0x9a, 0xfe, 0x70);
+- adv7511_wr(sd, 0x9c, 0x30);
+- adv7511_wr_and_or(sd, 0x9d, 0xfc, 0x01);
+- adv7511_wr(sd, 0xa2, 0xa4);
+- adv7511_wr(sd, 0xa3, 0xa4);
+- adv7511_wr(sd, 0xe0, 0xd0);
+- adv7511_wr(sd, 0xf9, 0x00);
+-
+- adv7511_wr(sd, 0x43, state->i2c_edid_addr);
+- adv7511_wr(sd, 0x45, state->i2c_pktmem_addr);
+-
+- /* Set number of attempts to read the EDID */
+- adv7511_wr(sd, 0xc9, 0xf);
+- return true;
+-}
+-
+-#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
+-static int adv7511_cec_adap_enable(struct cec_adapter *adap, bool enable)
+-{
+- struct adv7511_state *state = cec_get_drvdata(adap);
+- struct v4l2_subdev *sd = &state->sd;
+-
+- if (state->i2c_cec == NULL)
+- return -EIO;
+-
+- if (!state->cec_enabled_adap && enable) {
+- /* power up cec section */
+- adv7511_cec_write_and_or(sd, 0x4e, 0xfc, 0x01);
+- /* legacy mode and clear all rx buffers */
+- adv7511_cec_write(sd, 0x4a, 0x00);
+- adv7511_cec_write(sd, 0x4a, 0x07);
+- adv7511_cec_write_and_or(sd, 0x11, 0xfe, 0); /* initially disable tx */
+- /* enabled irqs: */
+- /* tx: ready */
+- /* tx: arbitration lost */
+- /* tx: retry timeout */
+- /* rx: ready 1 */
+- if (state->enabled_irq)
+- adv7511_wr_and_or(sd, 0x95, 0xc0, 0x39);
+- } else if (state->cec_enabled_adap && !enable) {
+- if (state->enabled_irq)
+- adv7511_wr_and_or(sd, 0x95, 0xc0, 0x00);
+- /* disable address mask 1-3 */
+- adv7511_cec_write_and_or(sd, 0x4b, 0x8f, 0x00);
+- /* power down cec section */
+- adv7511_cec_write_and_or(sd, 0x4e, 0xfc, 0x00);
+- state->cec_valid_addrs = 0;
+- }
+- state->cec_enabled_adap = enable;
+- return 0;
+-}
+-
+-static int adv7511_cec_adap_log_addr(struct cec_adapter *adap, u8 addr)
+-{
+- struct adv7511_state *state = cec_get_drvdata(adap);
+- struct v4l2_subdev *sd = &state->sd;
+- unsigned int i, free_idx = ADV7511_MAX_ADDRS;
+-
+- if (!state->cec_enabled_adap)
+- return addr == CEC_LOG_ADDR_INVALID ? 0 : -EIO;
+-
+- if (addr == CEC_LOG_ADDR_INVALID) {
+- adv7511_cec_write_and_or(sd, 0x4b, 0x8f, 0);
+- state->cec_valid_addrs = 0;
+- return 0;
+- }
+-
+- for (i = 0; i < ADV7511_MAX_ADDRS; i++) {
+- bool is_valid = state->cec_valid_addrs & (1 << i);
+-
+- if (free_idx == ADV7511_MAX_ADDRS && !is_valid)
+- free_idx = i;
+- if (is_valid && state->cec_addr[i] == addr)
+- return 0;
+- }
+- if (i == ADV7511_MAX_ADDRS) {
+- i = free_idx;
+- if (i == ADV7511_MAX_ADDRS)
+- return -ENXIO;
+- }
+- state->cec_addr[i] = addr;
+- state->cec_valid_addrs |= 1 << i;
+-
+- switch (i) {
+- case 0:
+- /* enable address mask 0 */
+- adv7511_cec_write_and_or(sd, 0x4b, 0xef, 0x10);
+- /* set address for mask 0 */
+- adv7511_cec_write_and_or(sd, 0x4c, 0xf0, addr);
+- break;
+- case 1:
+- /* enable address mask 1 */
+- adv7511_cec_write_and_or(sd, 0x4b, 0xdf, 0x20);
+- /* set address for mask 1 */
+- adv7511_cec_write_and_or(sd, 0x4c, 0x0f, addr << 4);
+- break;
+- case 2:
+- /* enable address mask 2 */
+- adv7511_cec_write_and_or(sd, 0x4b, 0xbf, 0x40);
+- /* set address for mask 1 */
+- adv7511_cec_write_and_or(sd, 0x4d, 0xf0, addr);
+- break;
+- }
+- return 0;
+-}
+-
+-static int adv7511_cec_adap_transmit(struct cec_adapter *adap, u8 attempts,
+- u32 signal_free_time, struct cec_msg *msg)
+-{
+- struct adv7511_state *state = cec_get_drvdata(adap);
+- struct v4l2_subdev *sd = &state->sd;
+- u8 len = msg->len;
+- unsigned int i;
+-
+- v4l2_dbg(1, debug, sd, "%s: len %d\n", __func__, len);
+-
+- if (len > 16) {
+- v4l2_err(sd, "%s: len exceeded 16 (%d)\n", __func__, len);
+- return -EINVAL;
+- }
+-
+- /*
+- * The number of retries is the number of attempts - 1, but retry
+- * at least once. It's not clear if a value of 0 is allowed, so
+- * let's do at least one retry.
+- */
+- adv7511_cec_write_and_or(sd, 0x12, ~0x70, max(1, attempts - 1) << 4);
+-
+- /* clear cec tx irq status */
+- adv7511_wr(sd, 0x97, 0x38);
+-
+- /* write data */
+- for (i = 0; i < len; i++)
+- adv7511_cec_write(sd, i, msg->msg[i]);
+-
+- /* set length (data + header) */
+- adv7511_cec_write(sd, 0x10, len);
+- /* start transmit, enable tx */
+- adv7511_cec_write(sd, 0x11, 0x01);
+- return 0;
+-}
+-
+-static void adv_cec_tx_raw_status(struct v4l2_subdev *sd, u8 tx_raw_status)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- if ((adv7511_cec_read(sd, 0x11) & 0x01) == 0) {
+- v4l2_dbg(1, debug, sd, "%s: tx raw: tx disabled\n", __func__);
+- return;
+- }
+-
+- if (tx_raw_status & 0x10) {
+- v4l2_dbg(1, debug, sd,
+- "%s: tx raw: arbitration lost\n", __func__);
+- cec_transmit_done(state->cec_adap, CEC_TX_STATUS_ARB_LOST,
+- 1, 0, 0, 0);
+- return;
+- }
+- if (tx_raw_status & 0x08) {
+- u8 status;
+- u8 nack_cnt;
+- u8 low_drive_cnt;
+-
+- v4l2_dbg(1, debug, sd, "%s: tx raw: retry failed\n", __func__);
+- /*
+- * We set this status bit since this hardware performs
+- * retransmissions.
+- */
+- status = CEC_TX_STATUS_MAX_RETRIES;
+- nack_cnt = adv7511_cec_read(sd, 0x14) & 0xf;
+- if (nack_cnt)
+- status |= CEC_TX_STATUS_NACK;
+- low_drive_cnt = adv7511_cec_read(sd, 0x14) >> 4;
+- if (low_drive_cnt)
+- status |= CEC_TX_STATUS_LOW_DRIVE;
+- cec_transmit_done(state->cec_adap, status,
+- 0, nack_cnt, low_drive_cnt, 0);
+- return;
+- }
+- if (tx_raw_status & 0x20) {
+- v4l2_dbg(1, debug, sd, "%s: tx raw: ready ok\n", __func__);
+- cec_transmit_done(state->cec_adap, CEC_TX_STATUS_OK, 0, 0, 0, 0);
+- return;
+- }
+-}
+-
+-static const struct cec_adap_ops adv7511_cec_adap_ops = {
+- .adap_enable = adv7511_cec_adap_enable,
+- .adap_log_addr = adv7511_cec_adap_log_addr,
+- .adap_transmit = adv7511_cec_adap_transmit,
+-};
+-#endif
+-
+-/* Enable interrupts */
+-static void adv7511_set_isr(struct v4l2_subdev *sd, bool enable)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- u8 irqs = MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT;
+- u8 irqs_rd;
+- int retries = 100;
+-
+- v4l2_dbg(2, debug, sd, "%s: %s\n", __func__, enable ? "enable" : "disable");
+-
+- if (state->enabled_irq == enable)
+- return;
+- state->enabled_irq = enable;
+-
+- /* The datasheet says that the EDID ready interrupt should be
+- disabled if there is no hotplug. */
+- if (!enable)
+- irqs = 0;
+- else if (adv7511_have_hotplug(sd))
+- irqs |= MASK_ADV7511_EDID_RDY_INT;
+-
+- /*
+- * This i2c write can fail (approx. 1 in 1000 writes). But it
+- * is essential that this register is correct, so retry it
+- * multiple times.
+- *
+- * Note that the i2c write does not report an error, but the readback
+- * clearly shows the wrong value.
+- */
+- do {
+- adv7511_wr(sd, 0x94, irqs);
+- irqs_rd = adv7511_rd(sd, 0x94);
+- } while (retries-- && irqs_rd != irqs);
+-
+- if (irqs_rd != irqs)
+- v4l2_err(sd, "Could not set interrupts: hw failure?\n");
+-
+- adv7511_wr_and_or(sd, 0x95, 0xc0,
+- (state->cec_enabled_adap && enable) ? 0x39 : 0x00);
+-}
+-
+-/* Interrupt handler */
+-static int adv7511_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
+-{
+- u8 irq_status;
+- u8 cec_irq;
+-
+- /* disable interrupts to prevent a race condition */
+- adv7511_set_isr(sd, false);
+- irq_status = adv7511_rd(sd, 0x96);
+- cec_irq = adv7511_rd(sd, 0x97);
+- /* clear detected interrupts */
+- adv7511_wr(sd, 0x96, irq_status);
+- adv7511_wr(sd, 0x97, cec_irq);
+-
+- v4l2_dbg(1, debug, sd, "%s: irq 0x%x, cec-irq 0x%x\n", __func__,
+- irq_status, cec_irq);
+-
+- if (irq_status & (MASK_ADV7511_HPD_INT | MASK_ADV7511_MSEN_INT))
+- adv7511_check_monitor_present_status(sd);
+- if (irq_status & MASK_ADV7511_EDID_RDY_INT)
+- adv7511_check_edid_status(sd);
+-
+-#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
+- if (cec_irq & 0x38)
+- adv_cec_tx_raw_status(sd, cec_irq);
+-
+- if (cec_irq & 1) {
+- struct adv7511_state *state = get_adv7511_state(sd);
+- struct cec_msg msg;
+-
+- msg.len = adv7511_cec_read(sd, 0x25) & 0x1f;
+-
+- v4l2_dbg(1, debug, sd, "%s: cec msg len %d\n", __func__,
+- msg.len);
+-
+- if (msg.len > 16)
+- msg.len = 16;
+-
+- if (msg.len) {
+- u8 i;
+-
+- for (i = 0; i < msg.len; i++)
+- msg.msg[i] = adv7511_cec_read(sd, i + 0x15);
+-
+- adv7511_cec_write(sd, 0x4a, 0); /* toggle to re-enable rx 1 */
+- adv7511_cec_write(sd, 0x4a, 1);
+- cec_received_msg(state->cec_adap, &msg);
+- }
+- }
+-#endif
+-
+- /* enable interrupts */
+- adv7511_set_isr(sd, true);
+-
+- if (handled)
+- *handled = true;
+- return 0;
+-}
+-
+-static const struct v4l2_subdev_core_ops adv7511_core_ops = {
+- .log_status = adv7511_log_status,
+-#ifdef CONFIG_VIDEO_ADV_DEBUG
+- .g_register = adv7511_g_register,
+- .s_register = adv7511_s_register,
+-#endif
+- .s_power = adv7511_s_power,
+- .interrupt_service_routine = adv7511_isr,
+-};
+-
+-/* ------------------------------ VIDEO OPS ------------------------------ */
+-
+-/* Enable/disable adv7511 output */
+-static int adv7511_s_stream(struct v4l2_subdev *sd, int enable)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis"));
+- adv7511_wr_and_or(sd, 0xa1, ~0x3c, (enable ? 0 : 0x3c));
+- if (enable) {
+- adv7511_check_monitor_present_status(sd);
+- } else {
+- adv7511_s_power(sd, 0);
+- state->have_monitor = false;
+- }
+- return 0;
+-}
+-
+-static int adv7511_s_dv_timings(struct v4l2_subdev *sd,
+- struct v4l2_dv_timings *timings)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- struct v4l2_bt_timings *bt = &timings->bt;
+- u32 fps;
+-
+- v4l2_dbg(1, debug, sd, "%s:\n", __func__);
+-
+- /* quick sanity check */
+- if (!v4l2_valid_dv_timings(timings, &adv7511_timings_cap, NULL, NULL))
+- return -EINVAL;
+-
+- /* Fill the optional fields .standards and .flags in struct v4l2_dv_timings
+- if the format is one of the CEA or DMT timings. */
+- v4l2_find_dv_timings_cap(timings, &adv7511_timings_cap, 0, NULL, NULL);
+-
+- /* save timings */
+- state->dv_timings = *timings;
+-
+- /* set h/vsync polarities */
+- adv7511_wr_and_or(sd, 0x17, 0x9f,
+- ((bt->polarities & V4L2_DV_VSYNC_POS_POL) ? 0 : 0x40) |
+- ((bt->polarities & V4L2_DV_HSYNC_POS_POL) ? 0 : 0x20));
+-
+- fps = (u32)bt->pixelclock / (V4L2_DV_BT_FRAME_WIDTH(bt) * V4L2_DV_BT_FRAME_HEIGHT(bt));
+- switch (fps) {
+- case 24:
+- adv7511_wr_and_or(sd, 0xfb, 0xf9, 1 << 1);
+- break;
+- case 25:
+- adv7511_wr_and_or(sd, 0xfb, 0xf9, 2 << 1);
+- break;
+- case 30:
+- adv7511_wr_and_or(sd, 0xfb, 0xf9, 3 << 1);
+- break;
+- default:
+- adv7511_wr_and_or(sd, 0xfb, 0xf9, 0);
+- break;
+- }
+-
+- /* update quantization range based on new dv_timings */
+- adv7511_set_rgb_quantization_mode(sd, state->rgb_quantization_range_ctrl);
+-
+- return 0;
+-}
+-
+-static int adv7511_g_dv_timings(struct v4l2_subdev *sd,
+- struct v4l2_dv_timings *timings)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- v4l2_dbg(1, debug, sd, "%s:\n", __func__);
+-
+- if (!timings)
+- return -EINVAL;
+-
+- *timings = state->dv_timings;
+-
+- return 0;
+-}
+-
+-static int adv7511_enum_dv_timings(struct v4l2_subdev *sd,
+- struct v4l2_enum_dv_timings *timings)
+-{
+- if (timings->pad != 0)
+- return -EINVAL;
+-
+- return v4l2_enum_dv_timings_cap(timings, &adv7511_timings_cap, NULL, NULL);
+-}
+-
+-static int adv7511_dv_timings_cap(struct v4l2_subdev *sd,
+- struct v4l2_dv_timings_cap *cap)
+-{
+- if (cap->pad != 0)
+- return -EINVAL;
+-
+- *cap = adv7511_timings_cap;
+- return 0;
+-}
+-
+-static const struct v4l2_subdev_video_ops adv7511_video_ops = {
+- .s_stream = adv7511_s_stream,
+- .s_dv_timings = adv7511_s_dv_timings,
+- .g_dv_timings = adv7511_g_dv_timings,
+-};
+-
+-/* ------------------------------ AUDIO OPS ------------------------------ */
+-static int adv7511_s_audio_stream(struct v4l2_subdev *sd, int enable)
+-{
+- v4l2_dbg(1, debug, sd, "%s: %sable\n", __func__, (enable ? "en" : "dis"));
+-
+- if (enable)
+- adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x80);
+- else
+- adv7511_wr_and_or(sd, 0x4b, 0x3f, 0x40);
+-
+- return 0;
+-}
+-
+-static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq)
+-{
+- u32 N;
+-
+- switch (freq) {
+- case 32000: N = 4096; break;
+- case 44100: N = 6272; break;
+- case 48000: N = 6144; break;
+- case 88200: N = 12544; break;
+- case 96000: N = 12288; break;
+- case 176400: N = 25088; break;
+- case 192000: N = 24576; break;
+- default:
+- return -EINVAL;
+- }
+-
+- /* Set N (used with CTS to regenerate the audio clock) */
+- adv7511_wr(sd, 0x01, (N >> 16) & 0xf);
+- adv7511_wr(sd, 0x02, (N >> 8) & 0xff);
+- adv7511_wr(sd, 0x03, N & 0xff);
+-
+- return 0;
+-}
+-
+-static int adv7511_s_i2s_clock_freq(struct v4l2_subdev *sd, u32 freq)
+-{
+- u32 i2s_sf;
+-
+- switch (freq) {
+- case 32000: i2s_sf = 0x30; break;
+- case 44100: i2s_sf = 0x00; break;
+- case 48000: i2s_sf = 0x20; break;
+- case 88200: i2s_sf = 0x80; break;
+- case 96000: i2s_sf = 0xa0; break;
+- case 176400: i2s_sf = 0xc0; break;
+- case 192000: i2s_sf = 0xe0; break;
+- default:
+- return -EINVAL;
+- }
+-
+- /* Set sampling frequency for I2S audio to 48 kHz */
+- adv7511_wr_and_or(sd, 0x15, 0xf, i2s_sf);
+-
+- return 0;
+-}
+-
+-static int adv7511_s_routing(struct v4l2_subdev *sd, u32 input, u32 output, u32 config)
+-{
+- /* Only 2 channels in use for application */
+- adv7511_wr_and_or(sd, 0x73, 0xf8, 0x1);
+- /* Speaker mapping */
+- adv7511_wr(sd, 0x76, 0x00);
+-
+- /* 16 bit audio word length */
+- adv7511_wr_and_or(sd, 0x14, 0xf0, 0x02);
+-
+- return 0;
+-}
+-
+-static const struct v4l2_subdev_audio_ops adv7511_audio_ops = {
+- .s_stream = adv7511_s_audio_stream,
+- .s_clock_freq = adv7511_s_clock_freq,
+- .s_i2s_clock_freq = adv7511_s_i2s_clock_freq,
+- .s_routing = adv7511_s_routing,
+-};
+-
+-/* ---------------------------- PAD OPS ------------------------------------- */
+-
+-static int adv7511_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- memset(edid->reserved, 0, sizeof(edid->reserved));
+-
+- if (edid->pad != 0)
+- return -EINVAL;
+-
+- if (edid->start_block == 0 && edid->blocks == 0) {
+- edid->blocks = state->edid.segments * 2;
+- return 0;
+- }
+-
+- if (state->edid.segments == 0)
+- return -ENODATA;
+-
+- if (edid->start_block >= state->edid.segments * 2)
+- return -EINVAL;
+-
+- if (edid->start_block + edid->blocks > state->edid.segments * 2)
+- edid->blocks = state->edid.segments * 2 - edid->start_block;
+-
+- memcpy(edid->edid, &state->edid.data[edid->start_block * 128],
+- 128 * edid->blocks);
+-
+- return 0;
+-}
+-
+-static int adv7511_enum_mbus_code(struct v4l2_subdev *sd,
+- struct v4l2_subdev_pad_config *cfg,
+- struct v4l2_subdev_mbus_code_enum *code)
+-{
+- if (code->pad != 0)
+- return -EINVAL;
+-
+- switch (code->index) {
+- case 0:
+- code->code = MEDIA_BUS_FMT_RGB888_1X24;
+- break;
+- case 1:
+- code->code = MEDIA_BUS_FMT_YUYV8_1X16;
+- break;
+- case 2:
+- code->code = MEDIA_BUS_FMT_UYVY8_1X16;
+- break;
+- default:
+- return -EINVAL;
+- }
+- return 0;
+-}
+-
+-static void adv7511_fill_format(struct adv7511_state *state,
+- struct v4l2_mbus_framefmt *format)
+-{
+- format->width = state->dv_timings.bt.width;
+- format->height = state->dv_timings.bt.height;
+- format->field = V4L2_FIELD_NONE;
+-}
+-
+-static int adv7511_get_fmt(struct v4l2_subdev *sd,
+- struct v4l2_subdev_pad_config *cfg,
+- struct v4l2_subdev_format *format)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- if (format->pad != 0)
+- return -EINVAL;
+-
+- memset(&format->format, 0, sizeof(format->format));
+- adv7511_fill_format(state, &format->format);
+-
+- if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
+- struct v4l2_mbus_framefmt *fmt;
+-
+- fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad);
+- format->format.code = fmt->code;
+- format->format.colorspace = fmt->colorspace;
+- format->format.ycbcr_enc = fmt->ycbcr_enc;
+- format->format.quantization = fmt->quantization;
+- format->format.xfer_func = fmt->xfer_func;
+- } else {
+- format->format.code = state->fmt_code;
+- format->format.colorspace = state->colorspace;
+- format->format.ycbcr_enc = state->ycbcr_enc;
+- format->format.quantization = state->quantization;
+- format->format.xfer_func = state->xfer_func;
+- }
+-
+- return 0;
+-}
+-
+-static int adv7511_set_fmt(struct v4l2_subdev *sd,
+- struct v4l2_subdev_pad_config *cfg,
+- struct v4l2_subdev_format *format)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- /*
+- * Bitfield namings come the CEA-861-F standard, table 8 "Auxiliary
+- * Video Information (AVI) InfoFrame Format"
+- *
+- * c = Colorimetry
+- * ec = Extended Colorimetry
+- * y = RGB or YCbCr
+- * q = RGB Quantization Range
+- * yq = YCC Quantization Range
+- */
+- u8 c = HDMI_COLORIMETRY_NONE;
+- u8 ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+- u8 y = HDMI_COLORSPACE_RGB;
+- u8 q = HDMI_QUANTIZATION_RANGE_DEFAULT;
+- u8 yq = HDMI_YCC_QUANTIZATION_RANGE_LIMITED;
+- u8 itc = state->content_type != V4L2_DV_IT_CONTENT_TYPE_NO_ITC;
+- u8 cn = itc ? state->content_type : V4L2_DV_IT_CONTENT_TYPE_GRAPHICS;
+-
+- if (format->pad != 0)
+- return -EINVAL;
+- switch (format->format.code) {
+- case MEDIA_BUS_FMT_UYVY8_1X16:
+- case MEDIA_BUS_FMT_YUYV8_1X16:
+- case MEDIA_BUS_FMT_RGB888_1X24:
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- adv7511_fill_format(state, &format->format);
+- if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
+- struct v4l2_mbus_framefmt *fmt;
+-
+- fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad);
+- fmt->code = format->format.code;
+- fmt->colorspace = format->format.colorspace;
+- fmt->ycbcr_enc = format->format.ycbcr_enc;
+- fmt->quantization = format->format.quantization;
+- fmt->xfer_func = format->format.xfer_func;
+- return 0;
+- }
+-
+- switch (format->format.code) {
+- case MEDIA_BUS_FMT_UYVY8_1X16:
+- adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01);
+- adv7511_wr_and_or(sd, 0x16, 0x03, 0xb8);
+- y = HDMI_COLORSPACE_YUV422;
+- break;
+- case MEDIA_BUS_FMT_YUYV8_1X16:
+- adv7511_wr_and_or(sd, 0x15, 0xf0, 0x01);
+- adv7511_wr_and_or(sd, 0x16, 0x03, 0xbc);
+- y = HDMI_COLORSPACE_YUV422;
+- break;
+- case MEDIA_BUS_FMT_RGB888_1X24:
+- default:
+- adv7511_wr_and_or(sd, 0x15, 0xf0, 0x00);
+- adv7511_wr_and_or(sd, 0x16, 0x03, 0x00);
+- break;
+- }
+- state->fmt_code = format->format.code;
+- state->colorspace = format->format.colorspace;
+- state->ycbcr_enc = format->format.ycbcr_enc;
+- state->quantization = format->format.quantization;
+- state->xfer_func = format->format.xfer_func;
+-
+- switch (format->format.colorspace) {
+- case V4L2_COLORSPACE_OPRGB:
+- c = HDMI_COLORIMETRY_EXTENDED;
+- ec = y ? HDMI_EXTENDED_COLORIMETRY_OPYCC_601 :
+- HDMI_EXTENDED_COLORIMETRY_OPRGB;
+- break;
+- case V4L2_COLORSPACE_SMPTE170M:
+- c = y ? HDMI_COLORIMETRY_ITU_601 : HDMI_COLORIMETRY_NONE;
+- if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV601) {
+- c = HDMI_COLORIMETRY_EXTENDED;
+- ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+- }
+- break;
+- case V4L2_COLORSPACE_REC709:
+- c = y ? HDMI_COLORIMETRY_ITU_709 : HDMI_COLORIMETRY_NONE;
+- if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_XV709) {
+- c = HDMI_COLORIMETRY_EXTENDED;
+- ec = HDMI_EXTENDED_COLORIMETRY_XV_YCC_709;
+- }
+- break;
+- case V4L2_COLORSPACE_SRGB:
+- c = y ? HDMI_COLORIMETRY_EXTENDED : HDMI_COLORIMETRY_NONE;
+- ec = y ? HDMI_EXTENDED_COLORIMETRY_S_YCC_601 :
+- HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+- break;
+- case V4L2_COLORSPACE_BT2020:
+- c = HDMI_COLORIMETRY_EXTENDED;
+- if (y && format->format.ycbcr_enc == V4L2_YCBCR_ENC_BT2020_CONST_LUM)
+- ec = 5; /* Not yet available in hdmi.h */
+- else
+- ec = 6; /* Not yet available in hdmi.h */
+- break;
+- default:
+- break;
+- }
+-
+- /*
+- * CEA-861-F says that for RGB formats the YCC range must match the
+- * RGB range, although sources should ignore the YCC range.
+- *
+- * The RGB quantization range shouldn't be non-zero if the EDID doesn't
+- * have the Q bit set in the Video Capabilities Data Block, however this
+- * isn't checked at the moment. The assumption is that the application
+- * knows the EDID and can detect this.
+- *
+- * The same is true for the YCC quantization range: non-standard YCC
+- * quantization ranges should only be sent if the EDID has the YQ bit
+- * set in the Video Capabilities Data Block.
+- */
+- switch (format->format.quantization) {
+- case V4L2_QUANTIZATION_FULL_RANGE:
+- q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT :
+- HDMI_QUANTIZATION_RANGE_FULL;
+- yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_FULL;
+- break;
+- case V4L2_QUANTIZATION_LIM_RANGE:
+- q = y ? HDMI_QUANTIZATION_RANGE_DEFAULT :
+- HDMI_QUANTIZATION_RANGE_LIMITED;
+- yq = q ? q - 1 : HDMI_YCC_QUANTIZATION_RANGE_LIMITED;
+- break;
+- }
+-
+- adv7511_wr_and_or(sd, 0x4a, 0xbf, 0);
+- adv7511_wr_and_or(sd, 0x55, 0x9f, y << 5);
+- adv7511_wr_and_or(sd, 0x56, 0x3f, c << 6);
+- adv7511_wr_and_or(sd, 0x57, 0x83, (ec << 4) | (q << 2) | (itc << 7));
+- adv7511_wr_and_or(sd, 0x59, 0x0f, (yq << 6) | (cn << 4));
+- adv7511_wr_and_or(sd, 0x4a, 0xff, 1);
+- adv7511_set_rgb_quantization_mode(sd, state->rgb_quantization_range_ctrl);
+-
+- return 0;
+-}
+-
+-static const struct v4l2_subdev_pad_ops adv7511_pad_ops = {
+- .get_edid = adv7511_get_edid,
+- .enum_mbus_code = adv7511_enum_mbus_code,
+- .get_fmt = adv7511_get_fmt,
+- .set_fmt = adv7511_set_fmt,
+- .enum_dv_timings = adv7511_enum_dv_timings,
+- .dv_timings_cap = adv7511_dv_timings_cap,
+-};
+-
+-/* --------------------- SUBDEV OPS --------------------------------------- */
+-
+-static const struct v4l2_subdev_ops adv7511_ops = {
+- .core = &adv7511_core_ops,
+- .pad = &adv7511_pad_ops,
+- .video = &adv7511_video_ops,
+- .audio = &adv7511_audio_ops,
+-};
+-
+-/* ----------------------------------------------------------------------- */
+-static void adv7511_dbg_dump_edid(int lvl, int debug, struct v4l2_subdev *sd, int segment, u8 *buf)
+-{
+- if (debug >= lvl) {
+- int i, j;
+- v4l2_dbg(lvl, debug, sd, "edid segment %d\n", segment);
+- for (i = 0; i < 256; i += 16) {
+- u8 b[128];
+- u8 *bp = b;
+- if (i == 128)
+- v4l2_dbg(lvl, debug, sd, "\n");
+- for (j = i; j < i + 16; j++) {
+- sprintf(bp, "0x%02x, ", buf[j]);
+- bp += 6;
+- }
+- bp[0] = '\0';
+- v4l2_dbg(lvl, debug, sd, "%s\n", b);
+- }
+- }
+-}
+-
+-static void adv7511_notify_no_edid(struct v4l2_subdev *sd)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- struct adv7511_edid_detect ed;
+-
+- /* We failed to read the EDID, so send an event for this. */
+- ed.present = false;
+- ed.segment = adv7511_rd(sd, 0xc4);
+- ed.phys_addr = CEC_PHYS_ADDR_INVALID;
+- cec_s_phys_addr(state->cec_adap, ed.phys_addr, false);
+- v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
+- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0);
+-}
+-
+-static void adv7511_edid_handler(struct work_struct *work)
+-{
+- struct delayed_work *dwork = to_delayed_work(work);
+- struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler);
+- struct v4l2_subdev *sd = &state->sd;
+-
+- v4l2_dbg(1, debug, sd, "%s:\n", __func__);
+-
+- if (adv7511_check_edid_status(sd)) {
+- /* Return if we received the EDID. */
+- return;
+- }
+-
+- if (adv7511_have_hotplug(sd)) {
+- /* We must retry reading the EDID several times, it is possible
+- * that initially the EDID couldn't be read due to i2c errors
+- * (DVI connectors are particularly prone to this problem). */
+- if (state->edid.read_retries) {
+- state->edid.read_retries--;
+- v4l2_dbg(1, debug, sd, "%s: edid read failed\n", __func__);
+- state->have_monitor = false;
+- adv7511_s_power(sd, false);
+- adv7511_s_power(sd, true);
+- queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
+- return;
+- }
+- }
+-
+- /* We failed to read the EDID, so send an event for this. */
+- adv7511_notify_no_edid(sd);
+- v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__);
+-}
+-
+-static void adv7511_audio_setup(struct v4l2_subdev *sd)
+-{
+- v4l2_dbg(1, debug, sd, "%s\n", __func__);
+-
+- adv7511_s_i2s_clock_freq(sd, 48000);
+- adv7511_s_clock_freq(sd, 48000);
+- adv7511_s_routing(sd, 0, 0, 0);
+-}
+-
+-/* Configure hdmi transmitter. */
+-static void adv7511_setup(struct v4l2_subdev *sd)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- v4l2_dbg(1, debug, sd, "%s\n", __func__);
+-
+- /* Input format: RGB 4:4:4 */
+- adv7511_wr_and_or(sd, 0x15, 0xf0, 0x0);
+- /* Output format: RGB 4:4:4 */
+- adv7511_wr_and_or(sd, 0x16, 0x7f, 0x0);
+- /* 1st order interpolation 4:2:2 -> 4:4:4 up conversion, Aspect ratio: 16:9 */
+- adv7511_wr_and_or(sd, 0x17, 0xf9, 0x06);
+- /* Disable pixel repetition */
+- adv7511_wr_and_or(sd, 0x3b, 0x9f, 0x0);
+- /* Disable CSC */
+- adv7511_wr_and_or(sd, 0x18, 0x7f, 0x0);
+- /* Output format: RGB 4:4:4, Active Format Information is valid,
+- * underscanned */
+- adv7511_wr_and_or(sd, 0x55, 0x9c, 0x12);
+- /* AVI Info frame packet enable, Audio Info frame disable */
+- adv7511_wr_and_or(sd, 0x44, 0xe7, 0x10);
+- /* Colorimetry, Active format aspect ratio: same as picure. */
+- adv7511_wr(sd, 0x56, 0xa8);
+- /* No encryption */
+- adv7511_wr_and_or(sd, 0xaf, 0xed, 0x0);
+-
+- /* Positive clk edge capture for input video clock */
+- adv7511_wr_and_or(sd, 0xba, 0x1f, 0x60);
+-
+- adv7511_audio_setup(sd);
+-
+- v4l2_ctrl_handler_setup(&state->hdl);
+-}
+-
+-static void adv7511_notify_monitor_detect(struct v4l2_subdev *sd)
+-{
+- struct adv7511_monitor_detect mdt;
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- mdt.present = state->have_monitor;
+- v4l2_subdev_notify(sd, ADV7511_MONITOR_DETECT, (void *)&mdt);
+-}
+-
+-static void adv7511_check_monitor_present_status(struct v4l2_subdev *sd)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- /* read hotplug and rx-sense state */
+- u8 status = adv7511_rd(sd, 0x42);
+-
+- v4l2_dbg(1, debug, sd, "%s: status: 0x%x%s%s\n",
+- __func__,
+- status,
+- status & MASK_ADV7511_HPD_DETECT ? ", hotplug" : "",
+- status & MASK_ADV7511_MSEN_DETECT ? ", rx-sense" : "");
+-
+- /* update read only ctrls */
+- v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0);
+- v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0);
+-
+- if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) {
+- v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__);
+- if (!state->have_monitor) {
+- v4l2_dbg(1, debug, sd, "%s: monitor detected\n", __func__);
+- state->have_monitor = true;
+- adv7511_set_isr(sd, true);
+- if (!adv7511_s_power(sd, true)) {
+- v4l2_dbg(1, debug, sd, "%s: monitor detected, powerup failed\n", __func__);
+- return;
+- }
+- adv7511_setup(sd);
+- adv7511_notify_monitor_detect(sd);
+- state->edid.read_retries = EDID_MAX_RETRIES;
+- queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
+- }
+- } else if (status & MASK_ADV7511_HPD_DETECT) {
+- v4l2_dbg(1, debug, sd, "%s: hotplug detected\n", __func__);
+- state->edid.read_retries = EDID_MAX_RETRIES;
+- queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
+- } else if (!(status & MASK_ADV7511_HPD_DETECT)) {
+- v4l2_dbg(1, debug, sd, "%s: hotplug not detected\n", __func__);
+- if (state->have_monitor) {
+- v4l2_dbg(1, debug, sd, "%s: monitor not detected\n", __func__);
+- state->have_monitor = false;
+- adv7511_notify_monitor_detect(sd);
+- }
+- adv7511_s_power(sd, false);
+- memset(&state->edid, 0, sizeof(struct adv7511_state_edid));
+- adv7511_notify_no_edid(sd);
+- }
+-}
+-
+-static bool edid_block_verify_crc(u8 *edid_block)
+-{
+- u8 sum = 0;
+- int i;
+-
+- for (i = 0; i < 128; i++)
+- sum += edid_block[i];
+- return sum == 0;
+-}
+-
+-static bool edid_verify_crc(struct v4l2_subdev *sd, u32 segment)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- u32 blocks = state->edid.blocks;
+- u8 *data = state->edid.data;
+-
+- if (!edid_block_verify_crc(&data[segment * 256]))
+- return false;
+- if ((segment + 1) * 2 <= blocks)
+- return edid_block_verify_crc(&data[segment * 256 + 128]);
+- return true;
+-}
+-
+-static bool edid_verify_header(struct v4l2_subdev *sd, u32 segment)
+-{
+- static const u8 hdmi_header[] = {
+- 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00
+- };
+- struct adv7511_state *state = get_adv7511_state(sd);
+- u8 *data = state->edid.data;
+-
+- if (segment != 0)
+- return true;
+- return !memcmp(data, hdmi_header, sizeof(hdmi_header));
+-}
+-
+-static bool adv7511_check_edid_status(struct v4l2_subdev *sd)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- u8 edidRdy = adv7511_rd(sd, 0xc5);
+-
+- v4l2_dbg(1, debug, sd, "%s: edid ready (retries: %d)\n",
+- __func__, EDID_MAX_RETRIES - state->edid.read_retries);
+-
+- if (state->edid.complete)
+- return true;
+-
+- if (edidRdy & MASK_ADV7511_EDID_RDY) {
+- int segment = adv7511_rd(sd, 0xc4);
+- struct adv7511_edid_detect ed;
+-
+- if (segment >= EDID_MAX_SEGM) {
+- v4l2_err(sd, "edid segment number too big\n");
+- return false;
+- }
+- v4l2_dbg(1, debug, sd, "%s: got segment %d\n", __func__, segment);
+- adv7511_edid_rd(sd, 256, &state->edid.data[segment * 256]);
+- adv7511_dbg_dump_edid(2, debug, sd, segment, &state->edid.data[segment * 256]);
+- if (segment == 0) {
+- state->edid.blocks = state->edid.data[0x7e] + 1;
+- v4l2_dbg(1, debug, sd, "%s: %d blocks in total\n", __func__, state->edid.blocks);
+- }
+- if (!edid_verify_crc(sd, segment) ||
+- !edid_verify_header(sd, segment)) {
+- /* edid crc error, force reread of edid segment */
+- v4l2_err(sd, "%s: edid crc or header error\n", __func__);
+- state->have_monitor = false;
+- adv7511_s_power(sd, false);
+- adv7511_s_power(sd, true);
+- return false;
+- }
+- /* one more segment read ok */
+- state->edid.segments = segment + 1;
+- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1);
+- if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) {
+- /* Request next EDID segment */
+- v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments);
+- adv7511_wr(sd, 0xc9, 0xf);
+- adv7511_wr(sd, 0xc4, state->edid.segments);
+- state->edid.read_retries = EDID_MAX_RETRIES;
+- queue_delayed_work(state->work_queue, &state->edid_handler, EDID_DELAY);
+- return false;
+- }
+-
+- v4l2_dbg(1, debug, sd, "%s: edid complete with %d segment(s)\n", __func__, state->edid.segments);
+- state->edid.complete = true;
+- ed.phys_addr = cec_get_edid_phys_addr(state->edid.data,
+- state->edid.segments * 256,
+- NULL);
+- /* report when we have all segments
+- but report only for segment 0
+- */
+- ed.present = true;
+- ed.segment = 0;
+- state->edid_detect_counter++;
+- cec_s_phys_addr(state->cec_adap, ed.phys_addr, false);
+- v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed);
+- return ed.present;
+- }
+-
+- return false;
+-}
+-
+-static int adv7511_registered(struct v4l2_subdev *sd)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- struct i2c_client *client = v4l2_get_subdevdata(sd);
+- int err;
+-
+- err = cec_register_adapter(state->cec_adap, &client->dev);
+- if (err)
+- cec_delete_adapter(state->cec_adap);
+- return err;
+-}
+-
+-static void adv7511_unregistered(struct v4l2_subdev *sd)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- cec_unregister_adapter(state->cec_adap);
+-}
+-
+-static const struct v4l2_subdev_internal_ops adv7511_int_ops = {
+- .registered = adv7511_registered,
+- .unregistered = adv7511_unregistered,
+-};
+-
+-/* ----------------------------------------------------------------------- */
+-/* Setup ADV7511 */
+-static void adv7511_init_setup(struct v4l2_subdev *sd)
+-{
+- struct adv7511_state *state = get_adv7511_state(sd);
+- struct adv7511_state_edid *edid = &state->edid;
+- u32 cec_clk = state->pdata.cec_clk;
+- u8 ratio;
+-
+- v4l2_dbg(1, debug, sd, "%s\n", __func__);
+-
+- /* clear all interrupts */
+- adv7511_wr(sd, 0x96, 0xff);
+- adv7511_wr(sd, 0x97, 0xff);
+- /*
+- * Stop HPD from resetting a lot of registers.
+- * It might leave the chip in a partly un-initialized state,
+- * in particular with regards to hotplug bounces.
+- */
+- adv7511_wr_and_or(sd, 0xd6, 0x3f, 0xc0);
+- memset(edid, 0, sizeof(struct adv7511_state_edid));
+- state->have_monitor = false;
+- adv7511_set_isr(sd, false);
+- adv7511_s_stream(sd, false);
+- adv7511_s_audio_stream(sd, false);
+-
+- if (state->i2c_cec == NULL)
+- return;
+-
+- v4l2_dbg(1, debug, sd, "%s: cec_clk %d\n", __func__, cec_clk);
+-
+- /* cec soft reset */
+- adv7511_cec_write(sd, 0x50, 0x01);
+- adv7511_cec_write(sd, 0x50, 0x00);
+-
+- /* legacy mode */
+- adv7511_cec_write(sd, 0x4a, 0x00);
+- adv7511_cec_write(sd, 0x4a, 0x07);
+-
+- if (cec_clk % 750000 != 0)
+- v4l2_err(sd, "%s: cec_clk %d, not multiple of 750 Khz\n",
+- __func__, cec_clk);
+-
+- ratio = (cec_clk / 750000) - 1;
+- adv7511_cec_write(sd, 0x4e, ratio << 2);
+-}
+-
+-static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *id)
+-{
+- struct adv7511_state *state;
+- struct adv7511_platform_data *pdata = client->dev.platform_data;
+- struct v4l2_ctrl_handler *hdl;
+- struct v4l2_subdev *sd;
+- u8 chip_id[2];
+- int err = -EIO;
+-
+- /* Check if the adapter supports the needed features */
+- if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+- return -EIO;
+-
+- state = devm_kzalloc(&client->dev, sizeof(struct adv7511_state), GFP_KERNEL);
+- if (!state)
+- return -ENOMEM;
+-
+- /* Platform data */
+- if (!pdata) {
+- v4l_err(client, "No platform data!\n");
+- return -ENODEV;
+- }
+- memcpy(&state->pdata, pdata, sizeof(state->pdata));
+- state->fmt_code = MEDIA_BUS_FMT_RGB888_1X24;
+- state->colorspace = V4L2_COLORSPACE_SRGB;
+-
+- sd = &state->sd;
+-
+- v4l2_dbg(1, debug, sd, "detecting adv7511 client on address 0x%x\n",
+- client->addr << 1);
+-
+- v4l2_i2c_subdev_init(sd, client, &adv7511_ops);
+- sd->internal_ops = &adv7511_int_ops;
+-
+- hdl = &state->hdl;
+- v4l2_ctrl_handler_init(hdl, 10);
+- /* add in ascending ID order */
+- state->hdmi_mode_ctrl = v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
+- V4L2_CID_DV_TX_MODE, V4L2_DV_TX_MODE_HDMI,
+- 0, V4L2_DV_TX_MODE_DVI_D);
+- state->hotplug_ctrl = v4l2_ctrl_new_std(hdl, NULL,
+- V4L2_CID_DV_TX_HOTPLUG, 0, 1, 0, 0);
+- state->rx_sense_ctrl = v4l2_ctrl_new_std(hdl, NULL,
+- V4L2_CID_DV_TX_RXSENSE, 0, 1, 0, 0);
+- state->have_edid0_ctrl = v4l2_ctrl_new_std(hdl, NULL,
+- V4L2_CID_DV_TX_EDID_PRESENT, 0, 1, 0, 0);
+- state->rgb_quantization_range_ctrl =
+- v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
+- V4L2_CID_DV_TX_RGB_RANGE, V4L2_DV_RGB_RANGE_FULL,
+- 0, V4L2_DV_RGB_RANGE_AUTO);
+- state->content_type_ctrl =
+- v4l2_ctrl_new_std_menu(hdl, &adv7511_ctrl_ops,
+- V4L2_CID_DV_TX_IT_CONTENT_TYPE, V4L2_DV_IT_CONTENT_TYPE_NO_ITC,
+- 0, V4L2_DV_IT_CONTENT_TYPE_NO_ITC);
+- sd->ctrl_handler = hdl;
+- if (hdl->error) {
+- err = hdl->error;
+- goto err_hdl;
+- }
+- state->pad.flags = MEDIA_PAD_FL_SINK;
+- sd->entity.function = MEDIA_ENT_F_DV_ENCODER;
+- err = media_entity_pads_init(&sd->entity, 1, &state->pad);
+- if (err)
+- goto err_hdl;
+-
+- /* EDID and CEC i2c addr */
+- state->i2c_edid_addr = state->pdata.i2c_edid << 1;
+- state->i2c_cec_addr = state->pdata.i2c_cec << 1;
+- state->i2c_pktmem_addr = state->pdata.i2c_pktmem << 1;
+-
+- state->chip_revision = adv7511_rd(sd, 0x0);
+- chip_id[0] = adv7511_rd(sd, 0xf5);
+- chip_id[1] = adv7511_rd(sd, 0xf6);
+- if (chip_id[0] != 0x75 || chip_id[1] != 0x11) {
+- v4l2_err(sd, "chip_id != 0x7511, read 0x%02x%02x\n", chip_id[0],
+- chip_id[1]);
+- err = -EIO;
+- goto err_entity;
+- }
+-
+- state->i2c_edid = i2c_new_dummy(client->adapter,
+- state->i2c_edid_addr >> 1);
+- if (state->i2c_edid == NULL) {
+- v4l2_err(sd, "failed to register edid i2c client\n");
+- err = -ENOMEM;
+- goto err_entity;
+- }
+-
+- adv7511_wr(sd, 0xe1, state->i2c_cec_addr);
+- if (state->pdata.cec_clk < 3000000 ||
+- state->pdata.cec_clk > 100000000) {
+- v4l2_err(sd, "%s: cec_clk %u outside range, disabling cec\n",
+- __func__, state->pdata.cec_clk);
+- state->pdata.cec_clk = 0;
+- }
+-
+- if (state->pdata.cec_clk) {
+- state->i2c_cec = i2c_new_dummy(client->adapter,
+- state->i2c_cec_addr >> 1);
+- if (state->i2c_cec == NULL) {
+- v4l2_err(sd, "failed to register cec i2c client\n");
+- err = -ENOMEM;
+- goto err_unreg_edid;
+- }
+- adv7511_wr(sd, 0xe2, 0x00); /* power up cec section */
+- } else {
+- adv7511_wr(sd, 0xe2, 0x01); /* power down cec section */
+- }
+-
+- state->i2c_pktmem = i2c_new_dummy(client->adapter, state->i2c_pktmem_addr >> 1);
+- if (state->i2c_pktmem == NULL) {
+- v4l2_err(sd, "failed to register pktmem i2c client\n");
+- err = -ENOMEM;
+- goto err_unreg_cec;
+- }
+-
+- state->work_queue = create_singlethread_workqueue(sd->name);
+- if (state->work_queue == NULL) {
+- v4l2_err(sd, "could not create workqueue\n");
+- err = -ENOMEM;
+- goto err_unreg_pktmem;
+- }
+-
+- INIT_DELAYED_WORK(&state->edid_handler, adv7511_edid_handler);
+-
+- adv7511_init_setup(sd);
+-
+-#if IS_ENABLED(CONFIG_VIDEO_ADV7511_CEC)
+- state->cec_adap = cec_allocate_adapter(&adv7511_cec_adap_ops,
+- state, dev_name(&client->dev), CEC_CAP_DEFAULTS,
+- ADV7511_MAX_ADDRS);
+- err = PTR_ERR_OR_ZERO(state->cec_adap);
+- if (err) {
+- destroy_workqueue(state->work_queue);
+- goto err_unreg_pktmem;
+- }
+-#endif
+-
+- adv7511_set_isr(sd, true);
+- adv7511_check_monitor_present_status(sd);
+-
+- v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name,
+- client->addr << 1, client->adapter->name);
+- return 0;
+-
+-err_unreg_pktmem:
+- i2c_unregister_device(state->i2c_pktmem);
+-err_unreg_cec:
+- if (state->i2c_cec)
+- i2c_unregister_device(state->i2c_cec);
+-err_unreg_edid:
+- i2c_unregister_device(state->i2c_edid);
+-err_entity:
+- media_entity_cleanup(&sd->entity);
+-err_hdl:
+- v4l2_ctrl_handler_free(&state->hdl);
+- return err;
+-}
+-
+-/* ----------------------------------------------------------------------- */
+-
+-static int adv7511_remove(struct i2c_client *client)
+-{
+- struct v4l2_subdev *sd = i2c_get_clientdata(client);
+- struct adv7511_state *state = get_adv7511_state(sd);
+-
+- state->chip_revision = -1;
+-
+- v4l2_dbg(1, debug, sd, "%s removed @ 0x%x (%s)\n", client->name,
+- client->addr << 1, client->adapter->name);
+-
+- adv7511_set_isr(sd, false);
+- adv7511_init_setup(sd);
+- cancel_delayed_work(&state->edid_handler);
+- i2c_unregister_device(state->i2c_edid);
+- if (state->i2c_cec)
+- i2c_unregister_device(state->i2c_cec);
+- i2c_unregister_device(state->i2c_pktmem);
+- destroy_workqueue(state->work_queue);
+- v4l2_device_unregister_subdev(sd);
+- media_entity_cleanup(&sd->entity);
+- v4l2_ctrl_handler_free(sd->ctrl_handler);
+- return 0;
+-}
+-
+-/* ----------------------------------------------------------------------- */
+-
+-static const struct i2c_device_id adv7511_id[] = {
+- { "adv7511", 0 },
+- { }
+-};
+-MODULE_DEVICE_TABLE(i2c, adv7511_id);
+-
+-static struct i2c_driver adv7511_driver = {
+- .driver = {
+- .name = "adv7511",
+- },
+- .probe = adv7511_probe,
+- .remove = adv7511_remove,
+- .id_table = adv7511_id,
+-};
+-
+-module_i2c_driver(adv7511_driver);
+diff --git a/drivers/media/i2c/ov7740.c b/drivers/media/i2c/ov7740.c
+index f5a1ee90a6c5..8a6a7a5929aa 100644
+--- a/drivers/media/i2c/ov7740.c
++++ b/drivers/media/i2c/ov7740.c
+@@ -761,7 +761,11 @@ static int ov7740_try_fmt_internal(struct v4l2_subdev *sd,
+
+ fsize++;
+ }
+-
++ if (i >= ARRAY_SIZE(ov7740_framesizes)) {
++ fsize = &ov7740_framesizes[0];
++ fmt->width = fsize->width;
++ fmt->height = fsize->height;
++ }
+ if (ret_frmsize != NULL)
+ *ret_frmsize = fsize;
+
+diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
+index 3bae24b15eaa..ed518b1f82e4 100644
+--- a/drivers/media/media-device.c
++++ b/drivers/media/media-device.c
+@@ -487,6 +487,7 @@ static long media_device_enum_links32(struct media_device *mdev,
+ {
+ struct media_links_enum links;
+ compat_uptr_t pads_ptr, links_ptr;
++ int ret;
+
+ memset(&links, 0, sizeof(links));
+
+@@ -498,7 +499,14 @@ static long media_device_enum_links32(struct media_device *mdev,
+ links.pads = compat_ptr(pads_ptr);
+ links.links = compat_ptr(links_ptr);
+
+- return media_device_enum_links(mdev, &links);
++ ret = media_device_enum_links(mdev, &links);
++ if (ret)
++ return ret;
++
++ if (copy_to_user(ulinks->reserved, links.reserved,
++ sizeof(ulinks->reserved)))
++ return -EFAULT;
++ return 0;
+ }
+
+ #define MEDIA_IOC_ENUM_LINKS32 _IOWR('|', 0x02, struct media_links_enum32)
+diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
+index d697e1ad929c..5102519df108 100644
+--- a/drivers/media/pci/saa7164/saa7164-core.c
++++ b/drivers/media/pci/saa7164/saa7164-core.c
+@@ -1122,16 +1122,25 @@ static int saa7164_proc_show(struct seq_file *m, void *v)
+ return 0;
+ }
+
++static struct proc_dir_entry *saa7164_pe;
++
+ static int saa7164_proc_create(void)
+ {
+- struct proc_dir_entry *pe;
+-
+- pe = proc_create_single("saa7164", S_IRUGO, NULL, saa7164_proc_show);
+- if (!pe)
++ saa7164_pe = proc_create_single("saa7164", 0444, NULL, saa7164_proc_show);
++ if (!saa7164_pe)
+ return -ENOMEM;
+
+ return 0;
+ }
++
++static void saa7164_proc_destroy(void)
++{
++ if (saa7164_pe)
++ remove_proc_entry("saa7164", NULL);
++}
++#else
++static int saa7164_proc_create(void) { return 0; }
++static void saa7164_proc_destroy(void) {}
+ #endif
+
+ static int saa7164_thread_function(void *data)
+@@ -1503,19 +1512,21 @@ static struct pci_driver saa7164_pci_driver = {
+
+ static int __init saa7164_init(void)
+ {
+- printk(KERN_INFO "saa7164 driver loaded\n");
++ int ret = pci_register_driver(&saa7164_pci_driver);
++
++ if (ret)
++ return ret;
+
+-#ifdef CONFIG_PROC_FS
+ saa7164_proc_create();
+-#endif
+- return pci_register_driver(&saa7164_pci_driver);
++
++ pr_info("saa7164 driver loaded\n");
++
++ return 0;
+ }
+
+ static void __exit saa7164_fini(void)
+ {
+-#ifdef CONFIG_PROC_FS
+- remove_proc_entry("saa7164", NULL);
+-#endif
++ saa7164_proc_destroy();
+ pci_unregister_driver(&saa7164_pci_driver);
+ }
+
+diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
+index a3cfefdbee12..c3eaddced721 100644
+--- a/drivers/media/platform/coda/coda-bit.c
++++ b/drivers/media/platform/coda/coda-bit.c
+@@ -1728,6 +1728,7 @@ static int __coda_start_decoding(struct coda_ctx *ctx)
+ v4l2_err(&dev->v4l2_dev, "CODA_COMMAND_SEQ_INIT timeout\n");
+ return ret;
+ }
++ ctx->sequence_offset = ~0U;
+ ctx->initialized = 1;
+
+ /* Update kfifo out pointer from coda bitstream read pointer */
+@@ -2142,12 +2143,17 @@ static void coda_finish_decode(struct coda_ctx *ctx)
+ else if (ctx->display_idx < 0)
+ ctx->hold = true;
+ } else if (decoded_idx == -2) {
++ if (ctx->display_idx >= 0 &&
++ ctx->display_idx < ctx->num_internal_frames)
++ ctx->sequence_offset++;
+ /* no frame was decoded, we still return remaining buffers */
+ } else if (decoded_idx < 0 || decoded_idx >= ctx->num_internal_frames) {
+ v4l2_err(&dev->v4l2_dev,
+ "decoded frame index out of range: %d\n", decoded_idx);
+ } else {
+- val = coda_read(dev, CODA_RET_DEC_PIC_FRAME_NUM) - 1;
++ val = coda_read(dev, CODA_RET_DEC_PIC_FRAME_NUM);
++ if (ctx->sequence_offset == -1)
++ ctx->sequence_offset = val;
+ val -= ctx->sequence_offset;
+ spin_lock_irqsave(&ctx->buffer_meta_lock, flags);
+ if (!list_empty(&ctx->buffer_meta_list)) {
+@@ -2303,7 +2309,6 @@ irqreturn_t coda_irq_handler(int irq, void *data)
+ if (ctx == NULL) {
+ v4l2_err(&dev->v4l2_dev,
+ "Instance released before the end of transaction\n");
+- mutex_unlock(&dev->coda_mutex);
+ return IRQ_HANDLED;
+ }
+
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index 19d92edcc981..4b0220f40b42 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -997,6 +997,8 @@ static int coda_encoder_cmd(struct file *file, void *fh,
+ /* Set the stream-end flag on this context */
+ ctx->bit_stream_param |= CODA_BIT_STREAM_END_FLAG;
+
++ flush_work(&ctx->pic_run_work);
++
+ /* If there is no buffer in flight, wake up */
+ if (!ctx->streamon_out || ctx->qsequence == ctx->osequence) {
+ dst_vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx,
+diff --git a/drivers/media/platform/davinci/vpss.c b/drivers/media/platform/davinci/vpss.c
+index 19cf6853411e..89a86c19579b 100644
+--- a/drivers/media/platform/davinci/vpss.c
++++ b/drivers/media/platform/davinci/vpss.c
+@@ -518,6 +518,11 @@ static int __init vpss_init(void)
+ return -EBUSY;
+
+ oper_cfg.vpss_regs_base2 = ioremap(VPSS_CLK_CTRL, 4);
++ if (unlikely(!oper_cfg.vpss_regs_base2)) {
++ release_mem_region(VPSS_CLK_CTRL, 4);
++ return -ENOMEM;
++ }
++
+ writel(VPSS_CLK_CTRL_VENCCLKEN |
+ VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2);
+
+diff --git a/drivers/media/platform/marvell-ccic/mcam-core.c b/drivers/media/platform/marvell-ccic/mcam-core.c
+index dfdbd4354b74..eeee15ff007d 100644
+--- a/drivers/media/platform/marvell-ccic/mcam-core.c
++++ b/drivers/media/platform/marvell-ccic/mcam-core.c
+@@ -200,7 +200,6 @@ struct mcam_vb_buffer {
+ struct list_head queue;
+ struct mcam_dma_desc *dma_desc; /* Descriptor virtual address */
+ dma_addr_t dma_desc_pa; /* Descriptor physical address */
+- int dma_desc_nent; /* Number of mapped descriptors */
+ };
+
+ static inline struct mcam_vb_buffer *vb_to_mvb(struct vb2_v4l2_buffer *vb)
+@@ -608,9 +607,11 @@ static void mcam_dma_contig_done(struct mcam_camera *cam, int frame)
+ static void mcam_sg_next_buffer(struct mcam_camera *cam)
+ {
+ struct mcam_vb_buffer *buf;
++ struct sg_table *sg_table;
+
+ buf = list_first_entry(&cam->buffers, struct mcam_vb_buffer, queue);
+ list_del_init(&buf->queue);
++ sg_table = vb2_dma_sg_plane_desc(&buf->vb_buf.vb2_buf, 0);
+ /*
+ * Very Bad Not Good Things happen if you don't clear
+ * C1_DESC_ENA before making any descriptor changes.
+@@ -618,7 +619,7 @@ static void mcam_sg_next_buffer(struct mcam_camera *cam)
+ mcam_reg_clear_bit(cam, REG_CTRL1, C1_DESC_ENA);
+ mcam_reg_write(cam, REG_DMA_DESC_Y, buf->dma_desc_pa);
+ mcam_reg_write(cam, REG_DESC_LEN_Y,
+- buf->dma_desc_nent*sizeof(struct mcam_dma_desc));
++ sg_table->nents * sizeof(struct mcam_dma_desc));
+ mcam_reg_write(cam, REG_DESC_LEN_U, 0);
+ mcam_reg_write(cam, REG_DESC_LEN_V, 0);
+ mcam_reg_set_bit(cam, REG_CTRL1, C1_DESC_ENA);
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 2a15b7cca338..0d1467028811 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -257,6 +257,8 @@ MODULE_PARM_DESC(debug, "activate debug info");
+ #define FD1_IP_H3_ES1 0x02010101
+ #define FD1_IP_M3W 0x02010202
+ #define FD1_IP_H3 0x02010203
++#define FD1_IP_M3N 0x02010204
++#define FD1_IP_E3 0x02010205
+
+ /* LUTs */
+ #define FD1_LUT_DIF_ADJ 0x1000
+@@ -2365,6 +2367,12 @@ static int fdp1_probe(struct platform_device *pdev)
+ case FD1_IP_H3:
+ dprintk(fdp1, "FDP1 Version R-Car H3\n");
+ break;
++ case FD1_IP_M3N:
++ dprintk(fdp1, "FDP1 Version R-Car M3N\n");
++ break;
++ case FD1_IP_E3:
++ dprintk(fdp1, "FDP1 Version R-Car E3\n");
++ break;
+ default:
+ dev_err(fdp1->dev, "FDP1 Unidentifiable (0x%08x)\n",
+ hw_version);
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+index ca11f8a7569d..4b8516c35bc2 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+@@ -527,7 +527,8 @@ static void s5p_mfc_handle_seq_done(struct s5p_mfc_ctx *ctx,
+ dev);
+ ctx->mv_count = s5p_mfc_hw_call(dev->mfc_ops, get_mv_count,
+ dev);
+- ctx->scratch_buf_size = s5p_mfc_hw_call(dev->mfc_ops,
++ if (FW_HAS_E_MIN_SCRATCH_BUF(dev))
++ ctx->scratch_buf_size = s5p_mfc_hw_call(dev->mfc_ops,
+ get_min_scratch_buf_size, dev);
+ if (ctx->img_width == 0 || ctx->img_height == 0)
+ ctx->state = MFCINST_ERROR;
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+index eb85cedc5ef3..5e080f32b0e8 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+@@ -38,6 +38,11 @@ int s5p_mfc_init_pm(struct s5p_mfc_dev *dev)
+ for (i = 0; i < pm->num_clocks; i++) {
+ pm->clocks[i] = devm_clk_get(pm->device, pm->clk_names[i]);
+ if (IS_ERR(pm->clocks[i])) {
++ /* additional clocks are optional */
++ if (i && PTR_ERR(pm->clocks[i]) == -ENOENT) {
++ pm->clocks[i] = NULL;
++ continue;
++ }
+ mfc_err("Failed to get clock: %s\n",
+ pm->clk_names[i]);
+ return PTR_ERR(pm->clocks[i]);
+diff --git a/drivers/media/platform/vimc/vimc-capture.c b/drivers/media/platform/vimc/vimc-capture.c
+index 65d657daf66f..8e014cc485f0 100644
+--- a/drivers/media/platform/vimc/vimc-capture.c
++++ b/drivers/media/platform/vimc/vimc-capture.c
+@@ -132,12 +132,15 @@ static int vimc_cap_s_fmt_vid_cap(struct file *file, void *priv,
+ struct v4l2_format *f)
+ {
+ struct vimc_cap_device *vcap = video_drvdata(file);
++ int ret;
+
+ /* Do not change the format while stream is on */
+ if (vb2_is_busy(&vcap->queue))
+ return -EBUSY;
+
+- vimc_cap_try_fmt_vid_cap(file, priv, f);
++ ret = vimc_cap_try_fmt_vid_cap(file, priv, f);
++ if (ret)
++ return ret;
+
+ dev_dbg(vcap->dev, "%s: format update: "
+ "old:%dx%d (0x%x, %d, %d, %d, %d) "
+diff --git a/drivers/media/radio/wl128x/fmdrv_v4l2.c b/drivers/media/radio/wl128x/fmdrv_v4l2.c
+index dccdf6558e6a..33abc8616ecb 100644
+--- a/drivers/media/radio/wl128x/fmdrv_v4l2.c
++++ b/drivers/media/radio/wl128x/fmdrv_v4l2.c
+@@ -549,6 +549,7 @@ int fm_v4l2_init_video_device(struct fmdev *fmdev, int radio_nr)
+
+ /* Register with V4L2 subsystem as RADIO device */
+ if (video_register_device(&gradio_dev, VFL_TYPE_RADIO, radio_nr)) {
++ v4l2_device_unregister(&fmdev->v4l2_dev);
+ fmerr("Could not register video device\n");
+ return -ENOMEM;
+ }
+@@ -562,6 +563,8 @@ int fm_v4l2_init_video_device(struct fmdev *fmdev, int radio_nr)
+ if (ret < 0) {
+ fmerr("(fmdev): Can't init ctrl handler\n");
+ v4l2_ctrl_handler_free(&fmdev->ctrl_handler);
++ video_unregister_device(fmdev->radio_dev);
++ v4l2_device_unregister(&fmdev->v4l2_dev);
+ return -EBUSY;
+ }
+
+diff --git a/drivers/media/rc/ir-spi.c b/drivers/media/rc/ir-spi.c
+index 66334e8d63ba..c58f2d38a458 100644
+--- a/drivers/media/rc/ir-spi.c
++++ b/drivers/media/rc/ir-spi.c
+@@ -161,6 +161,7 @@ static const struct of_device_id ir_spi_of_match[] = {
+ { .compatible = "ir-spi-led" },
+ {},
+ };
++MODULE_DEVICE_TABLE(of, ir_spi_of_match);
+
+ static struct spi_driver ir_spi_driver = {
+ .probe = ir_spi_probe,
+diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
+index 40ca4eafb137..39ac22486bcd 100644
+--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
+@@ -287,12 +287,15 @@ EXPORT_SYMBOL(dvb_usb_device_init);
+ void dvb_usb_device_exit(struct usb_interface *intf)
+ {
+ struct dvb_usb_device *d = usb_get_intfdata(intf);
+- const char *name = "generic DVB-USB module";
++ const char *default_name = "generic DVB-USB module";
++ char name[40];
+
+ usb_set_intfdata(intf, NULL);
+ if (d != NULL && d->desc != NULL) {
+- name = d->desc->name;
++ strscpy(name, d->desc->name, sizeof(name));
+ dvb_usb_exit(d);
++ } else {
++ strscpy(name, default_name, sizeof(name));
+ }
+ info("%s successfully deinitialized and disconnected.", name);
+
+diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
+index 1b89c77bad66..0615996572e4 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-video.c
++++ b/drivers/media/usb/hdpvr/hdpvr-video.c
+@@ -439,7 +439,7 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count,
+ /* wait for the first buffer */
+ if (!(file->f_flags & O_NONBLOCK)) {
+ if (wait_event_interruptible(dev->wait_data,
+- hdpvr_get_next_buffer(dev)))
++ !list_empty_careful(&dev->rec_buff_list)))
+ return -ERESTARTSYS;
+ }
+
+@@ -465,10 +465,17 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count,
+ goto err;
+ }
+ if (!err) {
+- v4l2_dbg(MSG_INFO, hdpvr_debug, &dev->v4l2_dev,
+- "timeout: restart streaming\n");
++ v4l2_info(&dev->v4l2_dev,
++ "timeout: restart streaming\n");
++ mutex_lock(&dev->io_mutex);
+ hdpvr_stop_streaming(dev);
+- msecs_to_jiffies(4000);
++ mutex_unlock(&dev->io_mutex);
++ /*
++ * The FW needs about 4 seconds after streaming
++ * stopped before it is ready to restart
++ * streaming.
++ */
++ msleep(4000);
+ err = hdpvr_start_streaming(dev);
+ if (err) {
+ ret = err;
+@@ -1133,9 +1140,7 @@ static void hdpvr_device_release(struct video_device *vdev)
+ struct hdpvr_device *dev = video_get_drvdata(vdev);
+
+ hdpvr_delete(dev);
+- mutex_lock(&dev->io_mutex);
+ flush_work(&dev->worker);
+- mutex_unlock(&dev->io_mutex);
+
+ v4l2_device_unregister(&dev->v4l2_dev);
+ v4l2_ctrl_handler_free(&dev->hdl);
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
+index 467b1ddaf4e7..f2854337cdca 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -2350,7 +2350,9 @@ void uvc_ctrl_cleanup_device(struct uvc_device *dev)
+ struct uvc_entity *entity;
+ unsigned int i;
+
+- cancel_work_sync(&dev->async_ctrl.work);
++ /* Can be uninitialized if we are aborting on probe error. */
++ if (dev->async_ctrl.work.func)
++ cancel_work_sync(&dev->async_ctrl.work);
+
+ /* Free controls and control mappings for all entities. */
+ list_for_each_entry(entity, &dev->entities, list) {
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
+index 6ac5f5d42615..0986572bbe88 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -2249,16 +2249,15 @@ struct v4l2_ctrl *v4l2_ctrl_new_custom(struct v4l2_ctrl_handler *hdl,
+ v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step,
+ &def, &flags);
+
+- is_menu = (cfg->type == V4L2_CTRL_TYPE_MENU ||
+- cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU);
++ is_menu = (type == V4L2_CTRL_TYPE_MENU ||
++ type == V4L2_CTRL_TYPE_INTEGER_MENU);
+ if (is_menu)
+ WARN_ON(step);
+ else
+ WARN_ON(cfg->menu_skip_mask);
+- if (cfg->type == V4L2_CTRL_TYPE_MENU && qmenu == NULL)
++ if (type == V4L2_CTRL_TYPE_MENU && !qmenu) {
+ qmenu = v4l2_ctrl_get_menu(cfg->id);
+- else if (cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU &&
+- qmenu_int == NULL) {
++ } else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) {
+ handler_set_err(hdl, -EINVAL);
+ return NULL;
+ }
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 8594659cb592..ad0275191d91 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -582,11 +582,14 @@ static int msm_init_cm_dll(struct sdhci_host *host)
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
+ int wait_cnt = 50;
+- unsigned long flags;
++ unsigned long flags, xo_clk = 0;
+ u32 config;
+ const struct sdhci_msm_offset *msm_offset =
+ msm_host->offset;
+
++ if (msm_host->use_14lpp_dll_reset && !IS_ERR_OR_NULL(msm_host->xo_clk))
++ xo_clk = clk_get_rate(msm_host->xo_clk);
++
+ spin_lock_irqsave(&host->lock, flags);
+
+ /*
+@@ -634,10 +637,10 @@ static int msm_init_cm_dll(struct sdhci_host *host)
+ config &= CORE_FLL_CYCLE_CNT;
+ if (config)
+ mclk_freq = DIV_ROUND_CLOSEST_ULL((host->clock * 8),
+- clk_get_rate(msm_host->xo_clk));
++ xo_clk);
+ else
+ mclk_freq = DIV_ROUND_CLOSEST_ULL((host->clock * 4),
+- clk_get_rate(msm_host->xo_clk));
++ xo_clk);
+
+ config = readl_relaxed(host->ioaddr +
+ msm_offset->core_dll_config_2);
+diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
+index 57b5ed1699e3..dce5b7e44e7a 100644
+--- a/drivers/mtd/nand/raw/mtk_nand.c
++++ b/drivers/mtd/nand/raw/mtk_nand.c
+@@ -509,7 +509,8 @@ static int mtk_nfc_setup_data_interface(struct mtd_info *mtd, int csline,
+ {
+ struct mtk_nfc *nfc = nand_get_controller_data(mtd_to_nand(mtd));
+ const struct nand_sdr_timings *timings;
+- u32 rate, tpoecs, tprecs, tc2r, tw2r, twh, twst, trlt;
++ u32 rate, tpoecs, tprecs, tc2r, tw2r, twh, twst = 0, trlt = 0;
++ u32 thold;
+
+ timings = nand_get_sdr_timings(conf);
+ if (IS_ERR(timings))
+@@ -545,11 +546,28 @@ static int mtk_nfc_setup_data_interface(struct mtd_info *mtd, int csline,
+ twh = DIV_ROUND_UP(twh * rate, 1000000) - 1;
+ twh &= 0xf;
+
+- twst = timings->tWP_min / 1000;
++ /* Calculate real WE#/RE# hold time in nanosecond */
++ thold = (twh + 1) * 1000000 / rate;
++ /* nanosecond to picosecond */
++ thold *= 1000;
++
++ /*
++ * WE# low level time should be expaned to meet WE# pulse time
++ * and WE# cycle time at the same time.
++ */
++ if (thold < timings->tWC_min)
++ twst = timings->tWC_min - thold;
++ twst = max(timings->tWP_min, twst) / 1000;
+ twst = DIV_ROUND_UP(twst * rate, 1000000) - 1;
+ twst &= 0xf;
+
+- trlt = max(timings->tREA_max, timings->tRP_min) / 1000;
++ /*
++ * RE# low level time should be expaned to meet RE# pulse time,
++ * RE# access time and RE# cycle time at the same time.
++ */
++ if (thold < timings->tRC_min)
++ trlt = timings->tRC_min - thold;
++ trlt = max3(trlt, timings->tREA_max, timings->tRP_min) / 1000;
+ trlt = DIV_ROUND_UP(trlt * rate, 1000000) - 1;
+ trlt &= 0xf;
+
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index 8c7bf91ce4e1..48b3ab26b124 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -572,12 +572,12 @@ static int spinand_mtd_read(struct mtd_info *mtd, loff_t from,
+ if (ret == -EBADMSG) {
+ ecc_failed = true;
+ mtd->ecc_stats.failed++;
+- ret = 0;
+ } else {
+ mtd->ecc_stats.corrected += ret;
+ max_bitflips = max_t(unsigned int, max_bitflips, ret);
+ }
+
++ ret = 0;
+ ops->retlen += iter.req.datalen;
+ ops->oobretlen += iter.req.ooblen;
+ }
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 7e162fff01ab..be0b785becd0 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3852,8 +3852,8 @@ static netdev_tx_t bond_xmit_roundrobin(struct sk_buff *skb,
+ struct net_device *bond_dev)
+ {
+ struct bonding *bond = netdev_priv(bond_dev);
+- struct iphdr *iph = ip_hdr(skb);
+ struct slave *slave;
++ int slave_cnt;
+ u32 slave_id;
+
+ /* Start with the curr_active_slave that joined the bond as the
+@@ -3862,23 +3862,32 @@ static netdev_tx_t bond_xmit_roundrobin(struct sk_buff *skb,
+ * send the join/membership reports. The curr_active_slave found
+ * will send all of this type of traffic.
+ */
+- if (iph->protocol == IPPROTO_IGMP && skb->protocol == htons(ETH_P_IP)) {
+- slave = rcu_dereference(bond->curr_active_slave);
+- if (slave)
+- bond_dev_queue_xmit(bond, skb, slave->dev);
+- else
+- bond_xmit_slave_id(bond, skb, 0);
+- } else {
+- int slave_cnt = READ_ONCE(bond->slave_cnt);
++ if (skb->protocol == htons(ETH_P_IP)) {
++ int noff = skb_network_offset(skb);
++ struct iphdr *iph;
+
+- if (likely(slave_cnt)) {
+- slave_id = bond_rr_gen_slave_id(bond);
+- bond_xmit_slave_id(bond, skb, slave_id % slave_cnt);
+- } else {
+- bond_tx_drop(bond_dev, skb);
++ if (unlikely(!pskb_may_pull(skb, noff + sizeof(*iph))))
++ goto non_igmp;
++
++ iph = ip_hdr(skb);
++ if (iph->protocol == IPPROTO_IGMP) {
++ slave = rcu_dereference(bond->curr_active_slave);
++ if (slave)
++ bond_dev_queue_xmit(bond, skb, slave->dev);
++ else
++ bond_xmit_slave_id(bond, skb, 0);
++ return NETDEV_TX_OK;
+ }
+ }
+
++non_igmp:
++ slave_cnt = READ_ONCE(bond->slave_cnt);
++ if (likely(slave_cnt)) {
++ slave_id = bond_rr_gen_slave_id(bond);
++ bond_xmit_slave_id(bond, skb, slave_id % slave_cnt);
++ } else {
++ bond_tx_drop(bond_dev, skb);
++ }
+ return NETDEV_TX_OK;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 5a727d4729da..e3ce29951c5e 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -3858,9 +3858,12 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)) {
+ if (!(bp->flags & TX_TIMESTAMPING_EN)) {
++ bp->eth_stats.ptp_skip_tx_ts++;
+ BNX2X_ERR("Tx timestamping was not enabled, this packet will not be timestamped\n");
+ } else if (bp->ptp_tx_skb) {
+- BNX2X_ERR("The device supports only a single outstanding packet to timestamp, this packet will not be timestamped\n");
++ bp->eth_stats.ptp_skip_tx_ts++;
++ netdev_err_once(bp->dev,
++ "Device supports only a single outstanding packet to timestamp, this packet won't be timestamped\n");
+ } else {
+ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+ /* schedule check for Tx timestamp */
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+index c428b0655c26..00f9ed93360c 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+@@ -182,7 +182,9 @@ static const struct {
+ { STATS_OFFSET32(driver_filtered_tx_pkt),
+ 4, false, "driver_filtered_tx_pkt" },
+ { STATS_OFFSET32(eee_tx_lpi),
+- 4, true, "Tx LPI entry count"}
++ 4, true, "Tx LPI entry count"},
++ { STATS_OFFSET32(ptp_skip_tx_ts),
++ 4, false, "ptp_skipped_tx_tstamp" },
+ };
+
+ #define BNX2X_NUM_STATS ARRAY_SIZE(bnx2x_stats_arr)
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index a585f1025a58..2c9af0f420e5 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -15244,11 +15244,24 @@ static void bnx2x_ptp_task(struct work_struct *work)
+ u32 val_seq;
+ u64 timestamp, ns;
+ struct skb_shared_hwtstamps shhwtstamps;
++ bool bail = true;
++ int i;
++
++ /* FW may take a while to complete timestamping; try a bit and if it's
++ * still not complete, may indicate an error state - bail out then.
++ */
++ for (i = 0; i < 10; i++) {
++ /* Read Tx timestamp registers */
++ val_seq = REG_RD(bp, port ? NIG_REG_P1_TLLH_PTP_BUF_SEQID :
++ NIG_REG_P0_TLLH_PTP_BUF_SEQID);
++ if (val_seq & 0x10000) {
++ bail = false;
++ break;
++ }
++ msleep(1 << i);
++ }
+
+- /* Read Tx timestamp registers */
+- val_seq = REG_RD(bp, port ? NIG_REG_P1_TLLH_PTP_BUF_SEQID :
+- NIG_REG_P0_TLLH_PTP_BUF_SEQID);
+- if (val_seq & 0x10000) {
++ if (!bail) {
+ /* There is a valid timestamp value */
+ timestamp = REG_RD(bp, port ? NIG_REG_P1_TLLH_PTP_BUF_TS_MSB :
+ NIG_REG_P0_TLLH_PTP_BUF_TS_MSB);
+@@ -15263,16 +15276,18 @@ static void bnx2x_ptp_task(struct work_struct *work)
+ memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+ shhwtstamps.hwtstamp = ns_to_ktime(ns);
+ skb_tstamp_tx(bp->ptp_tx_skb, &shhwtstamps);
+- dev_kfree_skb_any(bp->ptp_tx_skb);
+- bp->ptp_tx_skb = NULL;
+
+ DP(BNX2X_MSG_PTP, "Tx timestamp, timestamp cycles = %llu, ns = %llu\n",
+ timestamp, ns);
+ } else {
+- DP(BNX2X_MSG_PTP, "There is no valid Tx timestamp yet\n");
+- /* Reschedule to keep checking for a valid timestamp value */
+- schedule_work(&bp->ptp_task);
++ DP(BNX2X_MSG_PTP,
++ "Tx timestamp is not recorded (register read=%u)\n",
++ val_seq);
++ bp->eth_stats.ptp_skip_tx_ts++;
+ }
++
++ dev_kfree_skb_any(bp->ptp_tx_skb);
++ bp->ptp_tx_skb = NULL;
+ }
+
+ void bnx2x_set_rx_ts(struct bnx2x *bp, struct sk_buff *skb)
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+index b2644ed13d06..d55e63692cf3 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+@@ -207,6 +207,9 @@ struct bnx2x_eth_stats {
+ u32 driver_filtered_tx_pkt;
+ /* src: Clear-on-Read register; Will not survive PMF Migration */
+ u32 eee_tx_lpi;
++
++ /* PTP */
++ u32 ptp_skip_tx_ts;
+ };
+
+ struct bnx2x_eth_q_stats {
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index bf715a367273..4cf80de4c471 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -1689,10 +1689,10 @@ static void fec_get_mac(struct net_device *ndev)
+ */
+ if (!is_valid_ether_addr(iap)) {
+ /* Report it and use a random ethernet address instead */
+- netdev_err(ndev, "Invalid MAC address: %pM\n", iap);
++ dev_err(&fep->pdev->dev, "Invalid MAC address: %pM\n", iap);
+ eth_hw_addr_random(ndev);
+- netdev_info(ndev, "Using random MAC address: %pM\n",
+- ndev->dev_addr);
++ dev_info(&fep->pdev->dev, "Using random MAC address: %pM\n",
++ ndev->dev_addr);
+ return;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+index fff5be8078ac..0594a6c3dccd 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+@@ -229,6 +229,7 @@ void hnae3_unregister_ae_algo(struct hnae3_ae_algo *ae_algo)
+
+ ae_algo->ops->uninit_ae_dev(ae_dev);
+ hnae3_set_bit(ae_dev->flag, HNAE3_DEV_INITED_B, 0);
++ ae_dev->ops = NULL;
+ }
+
+ list_del(&ae_algo->node);
+@@ -316,6 +317,7 @@ void hnae3_unregister_ae_dev(struct hnae3_ae_dev *ae_dev)
+
+ ae_algo->ops->uninit_ae_dev(ae_dev);
+ hnae3_set_bit(ae_dev->flag, HNAE3_DEV_INITED_B, 0);
++ ae_dev->ops = NULL;
+ }
+
+ list_del(&ae_dev->node);
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+index 9684ad015c42..6a3c6b02a77c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+@@ -245,11 +245,13 @@ static int hns3_lp_run_test(struct net_device *ndev, enum hnae3_loop mode)
+
+ skb_get(skb);
+ tx_ret = hns3_nic_net_xmit(skb, ndev);
+- if (tx_ret == NETDEV_TX_OK)
++ if (tx_ret == NETDEV_TX_OK) {
+ good_cnt++;
+- else
++ } else {
++ kfree_skb(skb);
+ netdev_err(ndev, "hns3_lb_run_test xmit failed: %d\n",
+ tx_ret);
++ }
+ }
+ if (good_cnt != HNS3_NIC_LB_TEST_PKT_NUM) {
+ ret_val = HNS3_NIC_LB_TEST_TX_CNT_ERR;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 4648c6a9d9e8..89ca69fa2b97 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -663,8 +663,7 @@ static u8 *hclge_comm_get_strings(u32 stringset,
+ return buff;
+
+ for (i = 0; i < size; i++) {
+- snprintf(buff, ETH_GSTRING_LEN,
+- strs[i].desc);
++ snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc);
+ buff = buff + ETH_GSTRING_LEN;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 48235dc2dd56..11e9259ca040 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -54,7 +54,8 @@ static int hclge_shaper_para_calc(u32 ir, u8 shaper_level,
+ u32 tick;
+
+ /* Calc tick */
+- if (shaper_level >= HCLGE_SHAPER_LVL_CNT)
++ if (shaper_level >= HCLGE_SHAPER_LVL_CNT ||
++ ir > HCLGE_ETHER_MAX_RATE)
+ return -EINVAL;
+
+ tick = tick_array[shaper_level];
+@@ -1057,6 +1058,9 @@ static int hclge_tm_schd_mode_vnet_base_cfg(struct hclge_vport *vport)
+ int ret;
+ u8 i;
+
++ if (vport->vport_id >= HNAE3_MAX_TC)
++ return -EINVAL;
++
+ ret = hclge_tm_pri_schd_mode_cfg(hdev, vport->vport_id);
+ if (ret)
+ return ret;
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+index a9730711e257..b56d22b530a7 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+@@ -1291,7 +1291,7 @@ static struct sk_buff *i40e_construct_skb(struct i40e_ring *rx_ring,
+ struct i40e_rx_buffer *rx_buffer,
+ unsigned int size)
+ {
+- void *va = page_address(rx_buffer->page) + rx_buffer->page_offset;
++ void *va;
+ #if (PAGE_SIZE < 8192)
+ unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
+ #else
+@@ -1301,6 +1301,7 @@ static struct sk_buff *i40e_construct_skb(struct i40e_ring *rx_ring,
+ struct sk_buff *skb;
+
+ /* prefetch first cache line of first page */
++ va = page_address(rx_buffer->page) + rx_buffer->page_offset;
+ prefetch(va);
+ #if L1_CACHE_BYTES < 128
+ prefetch(va + L1_CACHE_BYTES);
+@@ -1355,7 +1356,7 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
+ struct i40e_rx_buffer *rx_buffer,
+ unsigned int size)
+ {
+- void *va = page_address(rx_buffer->page) + rx_buffer->page_offset;
++ void *va;
+ #if (PAGE_SIZE < 8192)
+ unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
+ #else
+@@ -1365,6 +1366,7 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
+ struct sk_buff *skb;
+
+ /* prefetch first cache line of first page */
++ va = page_address(rx_buffer->page) + rx_buffer->page_offset;
+ prefetch(va);
+ #if L1_CACHE_BYTES < 128
+ prefetch(va + L1_CACHE_BYTES);
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 5aa083d9a6c9..ab76a5f77cd0 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -5703,6 +5703,7 @@ static void igb_tx_ctxtdesc(struct igb_ring *tx_ring,
+ */
+ if (tx_ring->launchtime_enable) {
+ ts = ns_to_timespec64(first->skb->tstamp);
++ first->skb->tstamp = 0;
+ context_desc->seqnum_seed = cpu_to_le32(ts.tv_nsec / 32);
+ } else {
+ context_desc->seqnum_seed = 0;
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+index e5a8461fe6a9..8829bd95d0d3 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+@@ -3223,7 +3223,8 @@ static int ixgbe_get_module_info(struct net_device *dev,
+ page_swap = true;
+ }
+
+- if (sff8472_rev == IXGBE_SFF_SFF_8472_UNSUP || page_swap) {
++ if (sff8472_rev == IXGBE_SFF_SFF_8472_UNSUP || page_swap ||
++ !(addr_mode & IXGBE_SFF_DDM_IMPLEMENTED)) {
+ /* We have a SFP, but it does not support SFF-8472 */
+ modinfo->type = ETH_MODULE_SFF_8079;
+ modinfo->eeprom_len = ETH_MODULE_SFF_8079_LEN;
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+index 64e44e01c973..c56baad04ee6 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+@@ -45,6 +45,7 @@
+ #define IXGBE_SFF_SOFT_RS_SELECT_10G 0x8
+ #define IXGBE_SFF_SOFT_RS_SELECT_1G 0x0
+ #define IXGBE_SFF_ADDRESSING_MODE 0x4
++#define IXGBE_SFF_DDM_IMPLEMENTED 0x40
+ #define IXGBE_SFF_QSFP_DA_ACTIVE_CABLE 0x1
+ #define IXGBE_SFF_QSFP_DA_PASSIVE_CABLE 0x8
+ #define IXGBE_SFF_QSFP_CONNECTOR_NOT_SEPARABLE 0x23
+diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
+index c5dac6bd2be4..ee7857298361 100644
+--- a/drivers/net/ethernet/marvell/mvmdio.c
++++ b/drivers/net/ethernet/marvell/mvmdio.c
+@@ -64,7 +64,7 @@
+
+ struct orion_mdio_dev {
+ void __iomem *regs;
+- struct clk *clk[3];
++ struct clk *clk[4];
+ /*
+ * If we have access to the error interrupt pin (which is
+ * somewhat misnamed as it not only reflects internal errors
+@@ -321,6 +321,10 @@ static int orion_mdio_probe(struct platform_device *pdev)
+
+ for (i = 0; i < ARRAY_SIZE(dev->clk); i++) {
+ dev->clk[i] = of_clk_get(pdev->dev.of_node, i);
++ if (PTR_ERR(dev->clk[i]) == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto out_clk;
++ }
+ if (IS_ERR(dev->clk[i]))
+ break;
+ clk_prepare_enable(dev->clk[i]);
+@@ -362,6 +366,7 @@ out_mdio:
+ if (dev->err_interrupt > 0)
+ writel(0, dev->regs + MVMDIO_ERR_INT_MASK);
+
++out_clk:
+ for (i = 0; i < ARRAY_SIZE(dev->clk); i++) {
+ if (IS_ERR(dev->clk[i]))
+ break;
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+index ae2240074d8e..5692c6087bbb 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -312,7 +312,8 @@ static void mvpp2_prs_sram_shift_set(struct mvpp2_prs_entry *pe, int shift,
+ }
+
+ /* Set value */
+- pe->sram[MVPP2_BIT_TO_WORD(MVPP2_PRS_SRAM_SHIFT_OFFS)] = shift & MVPP2_PRS_SRAM_SHIFT_MASK;
++ pe->sram[MVPP2_BIT_TO_WORD(MVPP2_PRS_SRAM_SHIFT_OFFS)] |=
++ shift & MVPP2_PRS_SRAM_SHIFT_MASK;
+
+ /* Reset and set operation */
+ mvpp2_prs_sram_bits_clear(pe, MVPP2_PRS_SRAM_OP_SEL_SHIFT_OFFS,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+index 4dd82a1612aa..a6a9688db307 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -3096,6 +3096,7 @@ static void qed_nvm_info_free(struct qed_hwfn *p_hwfn)
+ static int qed_hw_prepare_single(struct qed_hwfn *p_hwfn,
+ void __iomem *p_regview,
+ void __iomem *p_doorbells,
++ u64 db_phys_addr,
+ enum qed_pci_personality personality)
+ {
+ int rc = 0;
+@@ -3103,6 +3104,7 @@ static int qed_hw_prepare_single(struct qed_hwfn *p_hwfn,
+ /* Split PCI bars evenly between hwfns */
+ p_hwfn->regview = p_regview;
+ p_hwfn->doorbells = p_doorbells;
++ p_hwfn->db_phys_addr = db_phys_addr;
+
+ if (IS_VF(p_hwfn->cdev))
+ return qed_vf_hw_prepare(p_hwfn);
+@@ -3198,7 +3200,9 @@ int qed_hw_prepare(struct qed_dev *cdev,
+ /* Initialize the first hwfn - will learn number of hwfns */
+ rc = qed_hw_prepare_single(p_hwfn,
+ cdev->regview,
+- cdev->doorbells, personality);
++ cdev->doorbells,
++ cdev->db_phys_addr,
++ personality);
+ if (rc)
+ return rc;
+
+@@ -3207,22 +3211,25 @@ int qed_hw_prepare(struct qed_dev *cdev,
+ /* Initialize the rest of the hwfns */
+ if (cdev->num_hwfns > 1) {
+ void __iomem *p_regview, *p_doorbell;
+- u8 __iomem *addr;
++ u64 db_phys_addr;
++ u32 offset;
+
+ /* adjust bar offset for second engine */
+- addr = cdev->regview +
+- qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
+- BAR_ID_0) / 2;
+- p_regview = addr;
++ offset = qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
++ BAR_ID_0) / 2;
++ p_regview = cdev->regview + offset;
+
+- addr = cdev->doorbells +
+- qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
+- BAR_ID_1) / 2;
+- p_doorbell = addr;
++ offset = qed_hw_bar_size(p_hwfn, p_hwfn->p_main_ptt,
++ BAR_ID_1) / 2;
++
++ p_doorbell = cdev->doorbells + offset;
++
++ db_phys_addr = cdev->db_phys_addr + offset;
+
+ /* prepare second hw function */
+ rc = qed_hw_prepare_single(&cdev->hwfns[1], p_regview,
+- p_doorbell, personality);
++ p_doorbell, db_phys_addr,
++ personality);
+
+ /* in case of error, need to free the previously
+ * initiliazed hwfn 0.
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+index b7471e48db7b..7002a660b6b4 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -2709,6 +2709,8 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
+ data.input.rx_num_desc = n_ooo_bufs * 2;
+ data.input.tx_num_desc = data.input.rx_num_desc;
+ data.input.tx_max_bds_per_packet = QED_IWARP_MAX_BDS_PER_FPDU;
++ data.input.tx_tc = PKT_LB_TC;
++ data.input.tx_dest = QED_LL2_TX_DEST_LB;
+ data.p_connection_handle = &iwarp_info->ll2_mpa_handle;
+ data.input.secondary_queue = true;
+ data.cbs = &cbs;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index 7873d6dfd91f..13802b825d65 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -803,7 +803,7 @@ static int qed_rdma_add_user(void *rdma_cxt,
+ dpi_start_offset +
+ ((out_params->dpi) * p_hwfn->dpi_size));
+
+- out_params->dpi_phys_addr = p_hwfn->cdev->db_phys_addr +
++ out_params->dpi_phys_addr = p_hwfn->db_phys_addr +
+ dpi_start_offset +
+ ((out_params->dpi) * p_hwfn->dpi_size);
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
+index 272b9ca66314..b069b3a2453b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -261,7 +261,7 @@ struct stmmac_safety_stats {
+ #define STMMAC_COAL_TX_TIMER 1000
+ #define STMMAC_MAX_COAL_TX_TICK 100000
+ #define STMMAC_TX_MAX_FRAMES 256
+-#define STMMAC_TX_FRAMES 25
++#define STMMAC_TX_FRAMES 1
+
+ /* Packets types */
+ enum packets_types {
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index 49a896a16391..79c91526f3ec 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -893,6 +893,11 @@ static int sun8i_dwmac_set_syscon(struct stmmac_priv *priv)
+ * address. No need to mask it again.
+ */
+ reg |= 1 << H3_EPHY_ADDR_SHIFT;
++ } else {
++ /* For SoCs without internal PHY the PHY selection bit should be
++ * set to 0 (external PHY).
++ */
++ reg &= ~H3_EPHY_SELECT;
+ }
+
+ if (!of_property_read_u32(node, "allwinner,tx-delay-ps", &val)) {
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+index 0877bde6e860..21d131347e2e 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+@@ -216,6 +216,12 @@ static void dwmac1000_set_filter(struct mac_device_info *hw,
+ GMAC_ADDR_LOW(reg));
+ reg++;
+ }
++
++ while (reg <= perfect_addr_number) {
++ writel(0, ioaddr + GMAC_ADDR_HIGH(reg));
++ writel(0, ioaddr + GMAC_ADDR_LOW(reg));
++ reg++;
++ }
+ }
+
+ #ifdef FRAME_FILTER_DEBUG
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index 7e5d5db0d516..d0e6e1503581 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -444,14 +444,20 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ * are required
+ */
+ value |= GMAC_PACKET_FILTER_PR;
+- } else if (!netdev_uc_empty(dev)) {
+- int reg = 1;
++ } else {
+ struct netdev_hw_addr *ha;
++ int reg = 1;
+
+ netdev_for_each_uc_addr(ha, dev) {
+ dwmac4_set_umac_addr(hw, ha->addr, reg);
+ reg++;
+ }
++
++ while (reg <= GMAC_MAX_PERFECT_ADDRESSES) {
++ writel(0, ioaddr + GMAC_ADDR_HIGH(reg));
++ writel(0, ioaddr + GMAC_ADDR_LOW(reg));
++ reg++;
++ }
+ }
+
+ writel(value, ioaddr + GMAC_PACKET_FILTER);
+@@ -469,8 +475,9 @@ static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex,
+ if (fc & FLOW_RX) {
+ pr_debug("\tReceive Flow-Control ON\n");
+ flow |= GMAC_RX_FLOW_CTRL_RFE;
+- writel(flow, ioaddr + GMAC_RX_FLOW_CTRL);
+ }
++ writel(flow, ioaddr + GMAC_RX_FLOW_CTRL);
++
+ if (fc & FLOW_TX) {
+ pr_debug("\tTransmit Flow-Control ON\n");
+
+@@ -478,7 +485,7 @@ static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex,
+ pr_debug("\tduplex mode: PAUSE %d\n", pause_time);
+
+ for (queue = 0; queue < tx_cnt; queue++) {
+- flow |= GMAC_TX_FLOW_CTRL_TFE;
++ flow = GMAC_TX_FLOW_CTRL_TFE;
+
+ if (duplex)
+ flow |=
+@@ -486,6 +493,9 @@ static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex,
+
+ writel(flow, ioaddr + GMAC_QX_TX_FLOW_CTRL(queue));
+ }
++ } else {
++ for (queue = 0; queue < tx_cnt; queue++)
++ writel(0, ioaddr + GMAC_QX_TX_FLOW_CTRL(queue));
+ }
+ }
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index 7cfd7ff38e86..66b30ebd45ee 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -614,6 +614,10 @@ static void axienet_start_xmit_done(struct net_device *ndev)
+
+ ndev->stats.tx_packets += packets;
+ ndev->stats.tx_bytes += size;
++
++ /* Matches barrier in axienet_start_xmit */
++ smp_mb();
++
+ netif_wake_queue(ndev);
+ }
+
+@@ -668,9 +672,19 @@ static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ cur_p = &lp->tx_bd_v[lp->tx_bd_tail];
+
+ if (axienet_check_tx_bd_space(lp, num_frag)) {
+- if (!netif_queue_stopped(ndev))
+- netif_stop_queue(ndev);
+- return NETDEV_TX_BUSY;
++ if (netif_queue_stopped(ndev))
++ return NETDEV_TX_BUSY;
++
++ netif_stop_queue(ndev);
++
++ /* Matches barrier in axienet_start_xmit_done */
++ smp_mb();
++
++ /* Space might have just been freed - check again */
++ if (axienet_check_tx_bd_space(lp, num_frag))
++ return NETDEV_TX_BUSY;
++
++ netif_wake_queue(ndev);
+ }
+
+ if (skb->ip_summed == CHECKSUM_PARTIAL) {
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index 7a145172d503..d178d5bad7e4 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -289,16 +289,29 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
+ return gtp_rx(pctx, skb, hdrlen, gtp->role);
+ }
+
+-static void gtp_encap_destroy(struct sock *sk)
++static void __gtp_encap_destroy(struct sock *sk)
+ {
+ struct gtp_dev *gtp;
+
+- gtp = rcu_dereference_sk_user_data(sk);
++ lock_sock(sk);
++ gtp = sk->sk_user_data;
+ if (gtp) {
++ if (gtp->sk0 == sk)
++ gtp->sk0 = NULL;
++ else
++ gtp->sk1u = NULL;
+ udp_sk(sk)->encap_type = 0;
+ rcu_assign_sk_user_data(sk, NULL);
+ sock_put(sk);
+ }
++ release_sock(sk);
++}
++
++static void gtp_encap_destroy(struct sock *sk)
++{
++ rtnl_lock();
++ __gtp_encap_destroy(sk);
++ rtnl_unlock();
+ }
+
+ static void gtp_encap_disable_sock(struct sock *sk)
+@@ -306,7 +319,7 @@ static void gtp_encap_disable_sock(struct sock *sk)
+ if (!sk)
+ return;
+
+- gtp_encap_destroy(sk);
++ __gtp_encap_destroy(sk);
+ }
+
+ static void gtp_encap_disable(struct gtp_dev *gtp)
+@@ -800,7 +813,8 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
+ goto out_sock;
+ }
+
+- if (rcu_dereference_sk_user_data(sock->sk)) {
++ lock_sock(sock->sk);
++ if (sock->sk->sk_user_data) {
+ sk = ERR_PTR(-EBUSY);
+ goto out_sock;
+ }
+@@ -816,6 +830,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
+ setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg);
+
+ out_sock:
++ release_sock(sock->sk);
+ sockfd_put(sock);
+ return sk;
+ }
+@@ -847,8 +862,13 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[])
+
+ if (data[IFLA_GTP_ROLE]) {
+ role = nla_get_u32(data[IFLA_GTP_ROLE]);
+- if (role > GTP_ROLE_SGSN)
++ if (role > GTP_ROLE_SGSN) {
++ if (sk0)
++ gtp_encap_disable_sock(sk0);
++ if (sk1u)
++ gtp_encap_disable_sock(sk1u);
+ return -EINVAL;
++ }
+ }
+
+ gtp->sk0 = sk0;
+@@ -949,7 +969,7 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk,
+
+ }
+
+- pctx = kmalloc(sizeof(struct pdp_ctx), GFP_KERNEL);
++ pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC);
+ if (pctx == NULL)
+ return -ENOMEM;
+
+@@ -1038,6 +1058,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
+ return -EINVAL;
+ }
+
++ rtnl_lock();
+ rcu_read_lock();
+
+ gtp = gtp_find_dev(sock_net(skb->sk), info->attrs);
+@@ -1062,6 +1083,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
+
+ out_unlock:
+ rcu_read_unlock();
++ rtnl_unlock();
+ return err;
+ }
+
+@@ -1363,9 +1385,9 @@ late_initcall(gtp_init);
+
+ static void __exit gtp_fini(void)
+ {
+- unregister_pernet_subsys(>p_net_ops);
+ genl_unregister_family(>p_genl_family);
+ rtnl_link_unregister(>p_link_ops);
++ unregister_pernet_subsys(>p_net_ops);
+
+ pr_info("GTP module unloaded\n");
+ }
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 8a96d985a52f..6144146aec29 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -757,6 +757,9 @@ int phy_connect_direct(struct net_device *dev, struct phy_device *phydev,
+ {
+ int rc;
+
++ if (!dev)
++ return -EINVAL;
++
+ rc = phy_attach_direct(dev, phydev, phydev->dev_flags, interface);
+ if (rc)
+ return rc;
+@@ -1098,6 +1101,9 @@ struct phy_device *phy_attach(struct net_device *dev, const char *bus_id,
+ struct device *d;
+ int rc;
+
++ if (!dev)
++ return ERR_PTR(-EINVAL);
++
+ /* Search the list of PHY devices on the mdio bus for the
+ * PHY with the requested name
+ */
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 8807a806cc47..418522aa2f71 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -185,10 +185,11 @@ struct sfp {
+ struct gpio_desc *gpio[GPIO_MAX];
+
+ bool attached;
++ struct mutex st_mutex; /* Protects state */
+ unsigned int state;
+ struct delayed_work poll;
+ struct delayed_work timeout;
+- struct mutex sm_mutex;
++ struct mutex sm_mutex; /* Protects state machine */
+ unsigned char sm_mod_state;
+ unsigned char sm_dev_state;
+ unsigned short sm_state;
+@@ -1718,6 +1719,7 @@ static void sfp_check_state(struct sfp *sfp)
+ {
+ unsigned int state, i, changed;
+
++ mutex_lock(&sfp->st_mutex);
+ state = sfp_get_state(sfp);
+ changed = state ^ sfp->state;
+ changed &= SFP_F_PRESENT | SFP_F_LOS | SFP_F_TX_FAULT;
+@@ -1743,6 +1745,7 @@ static void sfp_check_state(struct sfp *sfp)
+ sfp_sm_event(sfp, state & SFP_F_LOS ?
+ SFP_E_LOS_HIGH : SFP_E_LOS_LOW);
+ rtnl_unlock();
++ mutex_unlock(&sfp->st_mutex);
+ }
+
+ static irqreturn_t sfp_irq(int irq, void *data)
+@@ -1773,6 +1776,7 @@ static struct sfp *sfp_alloc(struct device *dev)
+ sfp->dev = dev;
+
+ mutex_init(&sfp->sm_mutex);
++ mutex_init(&sfp->st_mutex);
+ INIT_DELAYED_WORK(&sfp->poll, sfp_poll);
+ INIT_DELAYED_WORK(&sfp->timeout, sfp_timeout);
+
+diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
+index 3d93993e74da..2eca4168af2f 100644
+--- a/drivers/net/usb/asix_devices.c
++++ b/drivers/net/usb/asix_devices.c
+@@ -238,7 +238,7 @@ static void asix_phy_reset(struct usbnet *dev, unsigned int reset_bits)
+ static int ax88172_bind(struct usbnet *dev, struct usb_interface *intf)
+ {
+ int ret = 0;
+- u8 buf[ETH_ALEN];
++ u8 buf[ETH_ALEN] = {0};
+ int i;
+ unsigned long gpio_bits = dev->driver_info->data;
+
+@@ -689,7 +689,7 @@ static int asix_resume(struct usb_interface *intf)
+ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
+ {
+ int ret, i;
+- u8 buf[ETH_ALEN], chipcode = 0;
++ u8 buf[ETH_ALEN] = {0}, chipcode = 0;
+ u32 phyid;
+ struct asix_common_private *priv;
+
+@@ -1073,7 +1073,7 @@ static const struct net_device_ops ax88178_netdev_ops = {
+ static int ax88178_bind(struct usbnet *dev, struct usb_interface *intf)
+ {
+ int ret;
+- u8 buf[ETH_ALEN];
++ u8 buf[ETH_ALEN] = {0};
+
+ usbnet_get_endpoints(dev,intf);
+
+diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
+index 677535b3d207..476e0535f06f 100644
+--- a/drivers/net/wireless/ath/ath10k/hw.c
++++ b/drivers/net/wireless/ath/ath10k/hw.c
+@@ -168,7 +168,7 @@ const struct ath10k_hw_values qca6174_values = {
+ };
+
+ const struct ath10k_hw_values qca99x0_values = {
+- .rtc_state_val_on = 5,
++ .rtc_state_val_on = 7,
+ .ce_count = 12,
+ .msi_assign_ce_max = 12,
+ .num_target_ce_config_wlan = 10,
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index f3b1cfacfe9d..1419f9d1505f 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -1624,6 +1624,10 @@ static int ath10k_mac_setup_prb_tmpl(struct ath10k_vif *arvif)
+ if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+ return 0;
+
++ /* For mesh, probe response and beacon share the same template */
++ if (ieee80211_vif_is_mesh(vif))
++ return 0;
++
+ prb = ieee80211_proberesp_get(hw, vif);
+ if (!prb) {
+ ath10k_warn(ar, "failed to get probe resp template from mac80211\n");
+diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
+index 7f61591ce0de..686759b5613f 100644
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -613,6 +613,10 @@ static int ath10k_sdio_mbox_rx_alloc(struct ath10k *ar,
+ full_len,
+ last_in_bundle,
+ last_in_bundle);
++ if (ret) {
++ ath10k_warn(ar, "alloc_rx_pkt error %d\n", ret);
++ goto err;
++ }
+ }
+
+ ar_sdio->n_rx_pkts = i;
+@@ -2069,6 +2073,9 @@ static void ath10k_sdio_remove(struct sdio_func *func)
+ cancel_work_sync(&ar_sdio->wr_async_work);
+ ath10k_core_unregister(ar);
+ ath10k_core_destroy(ar);
++
++ flush_workqueue(ar_sdio->workqueue);
++ destroy_workqueue(ar_sdio->workqueue);
+ }
+
+ static const struct sdio_device_id ath10k_sdio_devices[] = {
+diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
+index cda164f6e9f6..6f62ddc0494c 100644
+--- a/drivers/net/wireless/ath/ath10k/txrx.c
++++ b/drivers/net/wireless/ath/ath10k/txrx.c
+@@ -156,6 +156,9 @@ struct ath10k_peer *ath10k_peer_find_by_id(struct ath10k *ar, int peer_id)
+ {
+ struct ath10k_peer *peer;
+
++ if (peer_id >= BITS_PER_TYPE(peer->peer_ids))
++ return NULL;
++
+ lockdep_assert_held(&ar->data_lock);
+
+ list_for_each_entry(peer, &ar->peers, list)
+diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
+index 777acc564ac9..bc7916f2add0 100644
+--- a/drivers/net/wireless/ath/ath6kl/wmi.c
++++ b/drivers/net/wireless/ath/ath6kl/wmi.c
+@@ -1178,6 +1178,10 @@ static int ath6kl_wmi_pstream_timeout_event_rx(struct wmi *wmi, u8 *datap,
+ return -EINVAL;
+
+ ev = (struct wmi_pstream_timeout_event *) datap;
++ if (ev->traffic_class >= WMM_NUM_AC) {
++ ath6kl_err("invalid traffic class: %d\n", ev->traffic_class);
++ return -EINVAL;
++ }
+
+ /*
+ * When the pstream (fat pipe == AC) timesout, it means there were
+@@ -1519,6 +1523,10 @@ static int ath6kl_wmi_cac_event_rx(struct wmi *wmi, u8 *datap, int len,
+ return -EINVAL;
+
+ reply = (struct wmi_cac_event *) datap;
++ if (reply->ac >= WMM_NUM_AC) {
++ ath6kl_err("invalid AC: %d\n", reply->ac);
++ return -EINVAL;
++ }
+
+ if ((reply->cac_indication == CAC_INDICATION_ADMISSION_RESP) &&
+ (reply->status_code != IEEE80211_TSPEC_STATUS_ADMISS_ACCEPTED)) {
+@@ -2635,7 +2643,7 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class,
+ u16 active_tsids = 0;
+ int ret;
+
+- if (traffic_class > 3) {
++ if (traffic_class >= WMM_NUM_AC) {
+ ath6kl_err("invalid traffic class: %d\n", traffic_class);
+ return -EINVAL;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index bb319f22761f..b4f7ee423d40 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -252,8 +252,9 @@ void ath9k_hw_get_channel_centers(struct ath_hw *ah,
+ /* Chip Revisions */
+ /******************/
+
+-static void ath9k_hw_read_revisions(struct ath_hw *ah)
++static bool ath9k_hw_read_revisions(struct ath_hw *ah)
+ {
++ u32 srev;
+ u32 val;
+
+ if (ah->get_mac_revision)
+@@ -269,25 +270,33 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
+ val = REG_READ(ah, AR_SREV);
+ ah->hw_version.macRev = MS(val, AR_SREV_REVISION2);
+ }
+- return;
++ return true;
+ case AR9300_DEVID_AR9340:
+ ah->hw_version.macVersion = AR_SREV_VERSION_9340;
+- return;
++ return true;
+ case AR9300_DEVID_QCA955X:
+ ah->hw_version.macVersion = AR_SREV_VERSION_9550;
+- return;
++ return true;
+ case AR9300_DEVID_AR953X:
+ ah->hw_version.macVersion = AR_SREV_VERSION_9531;
+- return;
++ return true;
+ case AR9300_DEVID_QCA956X:
+ ah->hw_version.macVersion = AR_SREV_VERSION_9561;
+- return;
++ return true;
+ }
+
+- val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
++ srev = REG_READ(ah, AR_SREV);
++
++ if (srev == -EIO) {
++ ath_err(ath9k_hw_common(ah),
++ "Failed to read SREV register");
++ return false;
++ }
++
++ val = srev & AR_SREV_ID;
+
+ if (val == 0xFF) {
+- val = REG_READ(ah, AR_SREV);
++ val = srev;
+ ah->hw_version.macVersion =
+ (val & AR_SREV_VERSION2) >> AR_SREV_TYPE2_S;
+ ah->hw_version.macRev = MS(val, AR_SREV_REVISION2);
+@@ -306,6 +315,8 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
+ if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCIE)
+ ah->is_pciexpress = true;
+ }
++
++ return true;
+ }
+
+ /************************************/
+@@ -559,7 +570,10 @@ static int __ath9k_hw_init(struct ath_hw *ah)
+ struct ath_common *common = ath9k_hw_common(ah);
+ int r = 0;
+
+- ath9k_hw_read_revisions(ah);
++ if (!ath9k_hw_read_revisions(ah)) {
++ ath_err(common, "Could not read hardware revisions");
++ return -EOPNOTSUPP;
++ }
+
+ switch (ah->hw_version.macVersion) {
+ case AR_SREV_VERSION_5416_PCI:
+diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
+index d52b31b45df7..a274eb0d1968 100644
+--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
++++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
+@@ -111,7 +111,7 @@ static const struct radar_detector_specs jp_radar_ref_types[] = {
+ JP_PATTERN(0, 0, 1, 1428, 1428, 1, 18, 29, false),
+ JP_PATTERN(1, 2, 3, 3846, 3846, 1, 18, 29, false),
+ JP_PATTERN(2, 0, 1, 1388, 1388, 1, 18, 50, false),
+- JP_PATTERN(3, 1, 2, 4000, 4000, 1, 18, 50, false),
++ JP_PATTERN(3, 0, 4, 4000, 4000, 1, 18, 50, false),
+ JP_PATTERN(4, 0, 5, 150, 230, 1, 23, 50, false),
+ JP_PATTERN(5, 6, 10, 200, 500, 1, 16, 50, false),
+ JP_PATTERN(6, 11, 20, 200, 500, 1, 12, 50, false),
+diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
+index 5d287a8e1b45..0655cd884514 100644
+--- a/drivers/net/wireless/ath/wil6210/interrupt.c
++++ b/drivers/net/wireless/ath/wil6210/interrupt.c
+@@ -296,21 +296,24 @@ void wil_configure_interrupt_moderation(struct wil6210_priv *wil)
+ static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
+ {
+ struct wil6210_priv *wil = cookie;
+- u32 isr = wil_ioread32_and_clear(wil->csr +
+- HOSTADDR(RGF_DMA_EP_RX_ICR) +
+- offsetof(struct RGF_ICR, ICR));
++ u32 isr;
+ bool need_unmask = true;
+
++ wil6210_mask_irq_rx(wil);
++
++ isr = wil_ioread32_and_clear(wil->csr +
++ HOSTADDR(RGF_DMA_EP_RX_ICR) +
++ offsetof(struct RGF_ICR, ICR));
++
+ trace_wil6210_irq_rx(isr);
+ wil_dbg_irq(wil, "ISR RX 0x%08x\n", isr);
+
+ if (unlikely(!isr)) {
+ wil_err_ratelimited(wil, "spurious IRQ: RX\n");
++ wil6210_unmask_irq_rx(wil);
+ return IRQ_NONE;
+ }
+
+- wil6210_mask_irq_rx(wil);
+-
+ /* RX_DONE and RX_HTRSH interrupts are the same if interrupt
+ * moderation is not used. Interrupt moderation may cause RX
+ * buffer overflow while RX_DONE is delayed. The required
+@@ -355,21 +358,24 @@ static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
+ static irqreturn_t wil6210_irq_rx_edma(int irq, void *cookie)
+ {
+ struct wil6210_priv *wil = cookie;
+- u32 isr = wil_ioread32_and_clear(wil->csr +
+- HOSTADDR(RGF_INT_GEN_RX_ICR) +
+- offsetof(struct RGF_ICR, ICR));
++ u32 isr;
+ bool need_unmask = true;
+
++ wil6210_mask_irq_rx_edma(wil);
++
++ isr = wil_ioread32_and_clear(wil->csr +
++ HOSTADDR(RGF_INT_GEN_RX_ICR) +
++ offsetof(struct RGF_ICR, ICR));
++
+ trace_wil6210_irq_rx(isr);
+ wil_dbg_irq(wil, "ISR RX 0x%08x\n", isr);
+
+ if (unlikely(!isr)) {
+ wil_err(wil, "spurious IRQ: RX\n");
++ wil6210_unmask_irq_rx_edma(wil);
+ return IRQ_NONE;
+ }
+
+- wil6210_mask_irq_rx_edma(wil);
+-
+ if (likely(isr & BIT_RX_STATUS_IRQ)) {
+ wil_dbg_irq(wil, "RX status ring\n");
+ isr &= ~BIT_RX_STATUS_IRQ;
+@@ -403,21 +409,24 @@ static irqreturn_t wil6210_irq_rx_edma(int irq, void *cookie)
+ static irqreturn_t wil6210_irq_tx_edma(int irq, void *cookie)
+ {
+ struct wil6210_priv *wil = cookie;
+- u32 isr = wil_ioread32_and_clear(wil->csr +
+- HOSTADDR(RGF_INT_GEN_TX_ICR) +
+- offsetof(struct RGF_ICR, ICR));
++ u32 isr;
+ bool need_unmask = true;
+
++ wil6210_mask_irq_tx_edma(wil);
++
++ isr = wil_ioread32_and_clear(wil->csr +
++ HOSTADDR(RGF_INT_GEN_TX_ICR) +
++ offsetof(struct RGF_ICR, ICR));
++
+ trace_wil6210_irq_tx(isr);
+ wil_dbg_irq(wil, "ISR TX 0x%08x\n", isr);
+
+ if (unlikely(!isr)) {
+ wil_err(wil, "spurious IRQ: TX\n");
++ wil6210_unmask_irq_tx_edma(wil);
+ return IRQ_NONE;
+ }
+
+- wil6210_mask_irq_tx_edma(wil);
+-
+ if (likely(isr & BIT_TX_STATUS_IRQ)) {
+ wil_dbg_irq(wil, "TX status ring\n");
+ isr &= ~BIT_TX_STATUS_IRQ;
+@@ -446,21 +455,24 @@ static irqreturn_t wil6210_irq_tx_edma(int irq, void *cookie)
+ static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
+ {
+ struct wil6210_priv *wil = cookie;
+- u32 isr = wil_ioread32_and_clear(wil->csr +
+- HOSTADDR(RGF_DMA_EP_TX_ICR) +
+- offsetof(struct RGF_ICR, ICR));
++ u32 isr;
+ bool need_unmask = true;
+
++ wil6210_mask_irq_tx(wil);
++
++ isr = wil_ioread32_and_clear(wil->csr +
++ HOSTADDR(RGF_DMA_EP_TX_ICR) +
++ offsetof(struct RGF_ICR, ICR));
++
+ trace_wil6210_irq_tx(isr);
+ wil_dbg_irq(wil, "ISR TX 0x%08x\n", isr);
+
+ if (unlikely(!isr)) {
+ wil_err_ratelimited(wil, "spurious IRQ: TX\n");
++ wil6210_unmask_irq_tx(wil);
+ return IRQ_NONE;
+ }
+
+- wil6210_mask_irq_tx(wil);
+-
+ if (likely(isr & BIT_DMA_EP_TX_ICR_TX_DONE)) {
+ wil_dbg_irq(wil, "TX done\n");
+ isr &= ~BIT_DMA_EP_TX_ICR_TX_DONE;
+@@ -532,20 +544,23 @@ static bool wil_validate_mbox_regs(struct wil6210_priv *wil)
+ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
+ {
+ struct wil6210_priv *wil = cookie;
+- u32 isr = wil_ioread32_and_clear(wil->csr +
+- HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+- offsetof(struct RGF_ICR, ICR));
++ u32 isr;
++
++ wil6210_mask_irq_misc(wil, false);
++
++ isr = wil_ioread32_and_clear(wil->csr +
++ HOSTADDR(RGF_DMA_EP_MISC_ICR) +
++ offsetof(struct RGF_ICR, ICR));
+
+ trace_wil6210_irq_misc(isr);
+ wil_dbg_irq(wil, "ISR MISC 0x%08x\n", isr);
+
+ if (!isr) {
+ wil_err(wil, "spurious IRQ: MISC\n");
++ wil6210_unmask_irq_misc(wil, false);
+ return IRQ_NONE;
+ }
+
+- wil6210_mask_irq_misc(wil, false);
+-
+ if (isr & ISR_MISC_FW_ERROR) {
+ u32 fw_assert_code = wil_r(wil, wil->rgf_fw_assert_code_addr);
+ u32 ucode_assert_code =
+diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
+index 75c8aa297107..1b1b58e0129a 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx.c
++++ b/drivers/net/wireless/ath/wil6210/txrx.c
+@@ -736,6 +736,7 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
+ [GRO_HELD] = "GRO_HELD",
+ [GRO_NORMAL] = "GRO_NORMAL",
+ [GRO_DROP] = "GRO_DROP",
++ [GRO_CONSUMED] = "GRO_CONSUMED",
+ };
+
+ wil->txrx_ops.get_netif_rx_params(skb, &cid, &security);
+diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
+index 6e3b3031f29b..2010f771478d 100644
+--- a/drivers/net/wireless/ath/wil6210/wmi.c
++++ b/drivers/net/wireless/ath/wil6210/wmi.c
+@@ -2816,7 +2816,18 @@ static void wmi_event_handle(struct wil6210_priv *wil,
+ /* check if someone waits for this event */
+ if (wil->reply_id && wil->reply_id == id &&
+ wil->reply_mid == mid) {
+- WARN_ON(wil->reply_buf);
++ if (wil->reply_buf) {
++ /* event received while wmi_call is waiting
++ * with a buffer. Such event should be handled
++ * in wmi_recv_cmd function. Handling the event
++ * here means a previous wmi_call was timeout.
++ * Drop the event and do not handle it.
++ */
++ wil_err(wil,
++ "Old event (%d, %s) while wmi_call is waiting. Drop it and Continue waiting\n",
++ id, eventid2name(id));
++ return;
++ }
+
+ wmi_evt_call_handler(vif, id, evt_data,
+ len - sizeof(*wmi));
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/smem.c b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
+index ff85d69c2a8c..557ee47bffd8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
+@@ -8,7 +8,7 @@
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -31,7 +31,7 @@
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -134,6 +134,7 @@ void iwl_get_shared_mem_conf(struct iwl_fw_runtime *fwrt)
+ .len = { 0, },
+ };
+ struct iwl_rx_packet *pkt;
++ int ret;
+
+ if (fw_has_capa(&fwrt->fw->ucode_capa,
+ IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG))
+@@ -141,8 +142,13 @@ void iwl_get_shared_mem_conf(struct iwl_fw_runtime *fwrt)
+ else
+ cmd.id = SHARED_MEM_CFG;
+
+- if (WARN_ON(iwl_trans_send_cmd(fwrt->trans, &cmd)))
++ ret = iwl_trans_send_cmd(fwrt->trans, &cmd);
++
++ if (ret) {
++ WARN(ret != -ERFKILL,
++ "Could not send the SMEM command: %d\n", ret);
+ return;
++ }
+
+ pkt = cmd.resp_pkt;
+ if (fwrt->trans->cfg->device_family >= IWL_DEVICE_FAMILY_22000)
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 2d21f0a1fa00..ffae299c3492 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -641,6 +641,9 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
+
+ memcpy(&info, skb->cb, sizeof(info));
+
++ if (WARN_ON_ONCE(skb->len > IEEE80211_MAX_DATA_LEN + hdrlen))
++ return -1;
++
+ if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU))
+ return -1;
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+index 2146fda8da2f..64d976d872b8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+@@ -164,7 +164,7 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+
+ memcpy(iml_img, trans->iml, trans->iml_len);
+
+- iwl_enable_interrupts(trans);
++ iwl_enable_fw_load_int_ctx_info(trans);
+
+ /* kick FW self load */
+ iwl_write64(trans, CSR_CTXT_INFO_ADDR,
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
+index b2cd7ef5fc3a..6f25fd1bbd8f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
+@@ -206,7 +206,7 @@ int iwl_pcie_ctxt_info_init(struct iwl_trans *trans,
+
+ trans_pcie->ctxt_info = ctxt_info;
+
+- iwl_enable_interrupts(trans);
++ iwl_enable_fw_load_int_ctx_info(trans);
+
+ /* Configure debug, if exists */
+ if (trans->dbg_dest_tlv)
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+index b63d44b7cd7c..00f9566bcc21 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+@@ -896,6 +896,33 @@ static inline void iwl_enable_fw_load_int(struct iwl_trans *trans)
+ }
+ }
+
++static inline void iwl_enable_fw_load_int_ctx_info(struct iwl_trans *trans)
++{
++ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++
++ IWL_DEBUG_ISR(trans, "Enabling ALIVE interrupt only\n");
++
++ if (!trans_pcie->msix_enabled) {
++ /*
++ * When we'll receive the ALIVE interrupt, the ISR will call
++ * iwl_enable_fw_load_int_ctx_info again to set the ALIVE
++ * interrupt (which is not really needed anymore) but also the
++ * RX interrupt which will allow us to receive the ALIVE
++ * notification (which is Rx) and continue the flow.
++ */
++ trans_pcie->inta_mask = CSR_INT_BIT_ALIVE | CSR_INT_BIT_FH_RX;
++ iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
++ } else {
++ iwl_enable_hw_int_msk_msix(trans,
++ MSIX_HW_INT_CAUSES_REG_ALIVE);
++ /*
++ * Leave all the FH causes enabled to get the ALIVE
++ * notification.
++ */
++ iwl_enable_fh_int_msk_msix(trans, trans_pcie->fh_init_mask);
++ }
++}
++
+ static inline u16 iwl_pcie_get_cmd_index(const struct iwl_txq *q, u32 index)
+ {
+ return index & (q->n_window - 1);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index 6dcd5374d9b4..1d144985ea58 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1778,26 +1778,26 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
+ goto out;
+ }
+
+- if (iwl_have_debug_level(IWL_DL_ISR)) {
+- /* NIC fires this, but we don't use it, redundant with WAKEUP */
+- if (inta & CSR_INT_BIT_SCD) {
+- IWL_DEBUG_ISR(trans,
+- "Scheduler finished to transmit the frame/frames.\n");
+- isr_stats->sch++;
+- }
++ /* NIC fires this, but we don't use it, redundant with WAKEUP */
++ if (inta & CSR_INT_BIT_SCD) {
++ IWL_DEBUG_ISR(trans,
++ "Scheduler finished to transmit the frame/frames.\n");
++ isr_stats->sch++;
++ }
+
+- /* Alive notification via Rx interrupt will do the real work */
+- if (inta & CSR_INT_BIT_ALIVE) {
+- IWL_DEBUG_ISR(trans, "Alive interrupt\n");
+- isr_stats->alive++;
+- if (trans->cfg->gen2) {
+- /*
+- * We can restock, since firmware configured
+- * the RFH
+- */
+- iwl_pcie_rxmq_restock(trans, trans_pcie->rxq);
+- }
++ /* Alive notification via Rx interrupt will do the real work */
++ if (inta & CSR_INT_BIT_ALIVE) {
++ IWL_DEBUG_ISR(trans, "Alive interrupt\n");
++ isr_stats->alive++;
++ if (trans->cfg->gen2) {
++ /*
++ * We can restock, since firmware configured
++ * the RFH
++ */
++ iwl_pcie_rxmq_restock(trans, trans_pcie->rxq);
+ }
++
++ handled |= CSR_INT_BIT_ALIVE;
+ }
+
+ /* Safely ignore these bits for debug checks below */
+@@ -1916,6 +1916,9 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
+ /* Re-enable RF_KILL if it occurred */
+ else if (handled & CSR_INT_BIT_RF_KILL)
+ iwl_enable_rfkill_int(trans);
++ /* Re-enable the ALIVE / Rx interrupt if it occurred */
++ else if (handled & (CSR_INT_BIT_ALIVE | CSR_INT_BIT_FH_RX))
++ iwl_enable_fw_load_int_ctx_info(trans);
+ spin_unlock(&trans_pcie->irq_lock);
+
+ out:
+@@ -2060,10 +2063,18 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
+ return IRQ_NONE;
+ }
+
+- if (iwl_have_debug_level(IWL_DL_ISR))
+- IWL_DEBUG_ISR(trans, "ISR inta_fh 0x%08x, enabled 0x%08x\n",
+- inta_fh,
++ if (iwl_have_debug_level(IWL_DL_ISR)) {
++ IWL_DEBUG_ISR(trans,
++ "ISR inta_fh 0x%08x, enabled (sw) 0x%08x (hw) 0x%08x\n",
++ inta_fh, trans_pcie->fh_mask,
+ iwl_read32(trans, CSR_MSIX_FH_INT_MASK_AD));
++ if (inta_fh & ~trans_pcie->fh_mask)
++ IWL_DEBUG_ISR(trans,
++ "We got a masked interrupt (0x%08x)\n",
++ inta_fh & ~trans_pcie->fh_mask);
++ }
++
++ inta_fh &= trans_pcie->fh_mask;
+
+ if ((trans_pcie->shared_vec_mask & IWL_SHARED_IRQ_NON_RX) &&
+ inta_fh & MSIX_FH_INT_CAUSES_Q0) {
+@@ -2103,11 +2114,18 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
+ }
+
+ /* After checking FH register check HW register */
+- if (iwl_have_debug_level(IWL_DL_ISR))
++ if (iwl_have_debug_level(IWL_DL_ISR)) {
+ IWL_DEBUG_ISR(trans,
+- "ISR inta_hw 0x%08x, enabled 0x%08x\n",
+- inta_hw,
++ "ISR inta_hw 0x%08x, enabled (sw) 0x%08x (hw) 0x%08x\n",
++ inta_hw, trans_pcie->hw_mask,
+ iwl_read32(trans, CSR_MSIX_HW_INT_MASK_AD));
++ if (inta_hw & ~trans_pcie->hw_mask)
++ IWL_DEBUG_ISR(trans,
++ "We got a masked interrupt 0x%08x\n",
++ inta_hw & ~trans_pcie->hw_mask);
++ }
++
++ inta_hw &= trans_pcie->hw_mask;
+
+ /* Alive notification via Rx interrupt will do the real work */
+ if (inta_hw & MSIX_HW_INT_CAUSES_REG_ALIVE) {
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+index 2bc67219ed3e..31e72e1ff1e2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+@@ -289,6 +289,15 @@ void iwl_trans_pcie_gen2_fw_alive(struct iwl_trans *trans, u32 scd_addr)
+ * paging memory cannot be freed included since FW will still use it
+ */
+ iwl_pcie_ctxt_info_free(trans);
++
++ /*
++ * Re-enable all the interrupts, including the RF-Kill one, now that
++ * the firmware is alive.
++ */
++ iwl_enable_interrupts(trans);
++ mutex_lock(&trans_pcie->mutex);
++ iwl_pcie_check_hw_rf_kill(trans);
++ mutex_unlock(&trans_pcie->mutex);
+ }
+
+ int iwl_trans_pcie_gen2_start_fw(struct iwl_trans *trans,
+diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
+index 7f3e3983b781..47cebb2ec05c 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
++++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
+@@ -193,10 +193,23 @@ static void mt7601u_complete_rx(struct urb *urb)
+ struct mt7601u_rx_queue *q = &dev->rx_q;
+ unsigned long flags;
+
+- spin_lock_irqsave(&dev->rx_lock, flags);
++ /* do no schedule rx tasklet if urb has been unlinked
++ * or the device has been removed
++ */
++ switch (urb->status) {
++ case -ECONNRESET:
++ case -ESHUTDOWN:
++ case -ENOENT:
++ return;
++ default:
++ dev_err_ratelimited(dev->dev, "rx urb failed: %d\n",
++ urb->status);
++ /* fall through */
++ case 0:
++ break;
++ }
+
+- if (mt7601u_urb_has_error(urb))
+- dev_err(dev->dev, "Error: RX urb failed:%d\n", urb->status);
++ spin_lock_irqsave(&dev->rx_lock, flags);
+ if (WARN_ONCE(q->e[q->end].urb != urb, "RX urb mismatch"))
+ goto out;
+
+@@ -228,14 +241,25 @@ static void mt7601u_complete_tx(struct urb *urb)
+ struct sk_buff *skb;
+ unsigned long flags;
+
+- spin_lock_irqsave(&dev->tx_lock, flags);
++ switch (urb->status) {
++ case -ECONNRESET:
++ case -ESHUTDOWN:
++ case -ENOENT:
++ return;
++ default:
++ dev_err_ratelimited(dev->dev, "tx urb failed: %d\n",
++ urb->status);
++ /* fall through */
++ case 0:
++ break;
++ }
+
+- if (mt7601u_urb_has_error(urb))
+- dev_err(dev->dev, "Error: TX urb failed:%d\n", urb->status);
++ spin_lock_irqsave(&dev->tx_lock, flags);
+ if (WARN_ONCE(q->e[q->start].urb != urb, "TX urb mismatch"))
+ goto out;
+
+ skb = q->e[q->start].skb;
++ q->e[q->start].skb = NULL;
+ trace_mt_tx_dma_done(dev, skb);
+
+ __skb_queue_tail(&dev->tx_skb_done, skb);
+@@ -363,19 +387,9 @@ int mt7601u_dma_enqueue_tx(struct mt7601u_dev *dev, struct sk_buff *skb,
+ static void mt7601u_kill_rx(struct mt7601u_dev *dev)
+ {
+ int i;
+- unsigned long flags;
+-
+- spin_lock_irqsave(&dev->rx_lock, flags);
+-
+- for (i = 0; i < dev->rx_q.entries; i++) {
+- int next = dev->rx_q.end;
+
+- spin_unlock_irqrestore(&dev->rx_lock, flags);
+- usb_poison_urb(dev->rx_q.e[next].urb);
+- spin_lock_irqsave(&dev->rx_lock, flags);
+- }
+-
+- spin_unlock_irqrestore(&dev->rx_lock, flags);
++ for (i = 0; i < dev->rx_q.entries; i++)
++ usb_poison_urb(dev->rx_q.e[i].urb);
+ }
+
+ static int mt7601u_submit_rx_buf(struct mt7601u_dev *dev,
+@@ -445,10 +459,10 @@ static void mt7601u_free_tx_queue(struct mt7601u_tx_queue *q)
+ {
+ int i;
+
+- WARN_ON(q->used);
+-
+ for (i = 0; i < q->entries; i++) {
+ usb_poison_urb(q->e[i].urb);
++ if (q->e[i].skb)
++ mt7601u_tx_status(q->dev, q->e[i].skb);
+ usb_free_urb(q->e[i].urb);
+ }
+ }
+diff --git a/drivers/net/wireless/mediatek/mt7601u/tx.c b/drivers/net/wireless/mediatek/mt7601u/tx.c
+index 3600e911a63e..4d81c45722fb 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/tx.c
++++ b/drivers/net/wireless/mediatek/mt7601u/tx.c
+@@ -117,9 +117,9 @@ void mt7601u_tx_status(struct mt7601u_dev *dev, struct sk_buff *skb)
+ info->status.rates[0].idx = -1;
+ info->flags |= IEEE80211_TX_STAT_ACK;
+
+- spin_lock(&dev->mac_lock);
++ spin_lock_bh(&dev->mac_lock);
+ ieee80211_tx_status(dev->hw, skb);
+- spin_unlock(&dev->mac_lock);
++ spin_unlock_bh(&dev->mac_lock);
+ }
+
+ static int mt7601u_skb_rooms(struct mt7601u_dev *dev, struct sk_buff *skb)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 2ac5004d7a40..5adb939afee8 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1081,13 +1081,13 @@ int rtl_usb_probe(struct usb_interface *intf,
+ rtlpriv->cfg->ops->read_eeprom_info(hw);
+ err = _rtl_usb_init(hw);
+ if (err)
+- goto error_out;
++ goto error_out2;
+ rtl_usb_init_sw(hw);
+ /* Init mac80211 sw */
+ err = rtl_init_core(hw);
+ if (err) {
+ pr_err("Can't allocate sw for mac80211\n");
+- goto error_out;
++ goto error_out2;
+ }
+ if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+ pr_err("Can't init_sw_vars\n");
+@@ -1108,6 +1108,7 @@ int rtl_usb_probe(struct usb_interface *intf,
+
+ error_out:
+ rtl_deinit_core(hw);
++error_out2:
+ _rtl_usb_io_handler_release(hw);
+ usb_put_dev(udev);
+ complete(&rtlpriv->firmware_loading_complete);
+diff --git a/drivers/nvdimm/dax_devs.c b/drivers/nvdimm/dax_devs.c
+index 0453f49dc708..326f02ffca81 100644
+--- a/drivers/nvdimm/dax_devs.c
++++ b/drivers/nvdimm/dax_devs.c
+@@ -126,7 +126,7 @@ int nd_dax_probe(struct device *dev, struct nd_namespace_common *ndns)
+ nvdimm_bus_unlock(&ndns->dev);
+ if (!dax_dev)
+ return -ENOMEM;
+- pfn_sb = devm_kzalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
++ pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
+ nd_pfn->pfn_sb = pfn_sb;
+ rc = nd_pfn_validate(nd_pfn, DAX_SIG);
+ dev_dbg(dev, "dax: %s\n", rc == 0 ? dev_name(dax_dev) : "<none>");
+diff --git a/drivers/nvdimm/pfn.h b/drivers/nvdimm/pfn.h
+index dde9853453d3..e901e3a3b04c 100644
+--- a/drivers/nvdimm/pfn.h
++++ b/drivers/nvdimm/pfn.h
+@@ -36,6 +36,7 @@ struct nd_pfn_sb {
+ __le32 end_trunc;
+ /* minor-version-2 record the base alignment of the mapping */
+ __le32 align;
++ /* minor-version-3 guarantee the padding and flags are zero */
+ u8 padding[4000];
+ __le64 checksum;
+ };
+diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
+index 3ee995a3bfc9..86ed09b2a192 100644
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -361,6 +361,15 @@ struct device *nd_pfn_create(struct nd_region *nd_region)
+ return dev;
+ }
+
++/**
++ * nd_pfn_validate - read and validate info-block
++ * @nd_pfn: fsdax namespace runtime state / properties
++ * @sig: 'devdax' or 'fsdax' signature
++ *
++ * Upon return the info-block buffer contents (->pfn_sb) are
++ * indeterminate when validation fails, and a coherent info-block
++ * otherwise.
++ */
+ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
+ {
+ u64 checksum, offset;
+@@ -506,7 +515,7 @@ int nd_pfn_probe(struct device *dev, struct nd_namespace_common *ndns)
+ nvdimm_bus_unlock(&ndns->dev);
+ if (!pfn_dev)
+ return -ENOMEM;
+- pfn_sb = devm_kzalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
++ pfn_sb = devm_kmalloc(dev, sizeof(*pfn_sb), GFP_KERNEL);
+ nd_pfn = to_nd_pfn(pfn_dev);
+ nd_pfn->pfn_sb = pfn_sb;
+ rc = nd_pfn_validate(nd_pfn, PFN_SIG);
+@@ -638,7 +647,7 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+ u64 checksum;
+ int rc;
+
+- pfn_sb = devm_kzalloc(&nd_pfn->dev, sizeof(*pfn_sb), GFP_KERNEL);
++ pfn_sb = devm_kmalloc(&nd_pfn->dev, sizeof(*pfn_sb), GFP_KERNEL);
+ if (!pfn_sb)
+ return -ENOMEM;
+
+@@ -647,11 +656,14 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+ sig = DAX_SIG;
+ else
+ sig = PFN_SIG;
++
+ rc = nd_pfn_validate(nd_pfn, sig);
+ if (rc != -ENODEV)
+ return rc;
+
+ /* no info block, do init */;
++ memset(pfn_sb, 0, sizeof(*pfn_sb));
++
+ nd_region = to_nd_region(nd_pfn->dev.parent);
+ if (nd_region->ro) {
+ dev_info(&nd_pfn->dev,
+@@ -705,7 +717,7 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+ memcpy(pfn_sb->uuid, nd_pfn->uuid, 16);
+ memcpy(pfn_sb->parent_uuid, nd_dev_to_uuid(&ndns->dev), 16);
+ pfn_sb->version_major = cpu_to_le16(1);
+- pfn_sb->version_minor = cpu_to_le16(2);
++ pfn_sb->version_minor = cpu_to_le16(3);
+ pfn_sb->start_pad = cpu_to_le32(start_pad);
+ pfn_sb->end_trunc = cpu_to_le32(end_trunc);
+ pfn_sb->align = cpu_to_le32(nd_pfn->align);
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index d8869d978c34..e26d1191c5ad 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3168,6 +3168,14 @@ static void nvme_ns_remove(struct nvme_ns *ns)
+ return;
+
+ nvme_fault_inject_fini(ns);
++
++ mutex_lock(&ns->ctrl->subsys->lock);
++ list_del_rcu(&ns->siblings);
++ mutex_unlock(&ns->ctrl->subsys->lock);
++ synchronize_rcu(); /* guarantee not available in head->list */
++ nvme_mpath_clear_current_path(ns);
++ synchronize_srcu(&ns->head->srcu); /* wait for concurrent submissions */
++
+ if (ns->disk && ns->disk->flags & GENHD_FL_UP) {
+ sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
+ &nvme_ns_id_attr_group);
+@@ -3179,16 +3187,10 @@ static void nvme_ns_remove(struct nvme_ns *ns)
+ blk_integrity_unregister(ns->disk);
+ }
+
+- mutex_lock(&ns->ctrl->subsys->lock);
+- list_del_rcu(&ns->siblings);
+- nvme_mpath_clear_current_path(ns);
+- mutex_unlock(&ns->ctrl->subsys->lock);
+-
+ down_write(&ns->ctrl->namespaces_rwsem);
+ list_del_init(&ns->list);
+ up_write(&ns->ctrl->namespaces_rwsem);
+
+- synchronize_srcu(&ns->head->srcu);
+ nvme_mpath_check_last_path(ns);
+ nvme_put_ns(ns);
+ }
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index c8eeecc58115..0a5d064f82ca 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2253,11 +2253,13 @@ static void nvme_reset_work(struct work_struct *work)
+ struct nvme_dev *dev =
+ container_of(work, struct nvme_dev, ctrl.reset_work);
+ bool was_suspend = !!(dev->ctrl.ctrl_config & NVME_CC_SHN_NORMAL);
+- int result = -ENODEV;
++ int result;
+ enum nvme_ctrl_state new_state = NVME_CTRL_LIVE;
+
+- if (WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING))
++ if (WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING)) {
++ result = -ENODEV;
+ goto out;
++ }
+
+ /*
+ * If we're called to reset a live controller first shut it down before
+@@ -2294,6 +2296,7 @@ static void nvme_reset_work(struct work_struct *work)
+ if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
+ dev_warn(dev->ctrl.device,
+ "failed to mark controller CONNECTING\n");
++ result = -EBUSY;
+ goto out;
+ }
+
+@@ -2354,6 +2357,7 @@ static void nvme_reset_work(struct work_struct *work)
+ if (!nvme_change_ctrl_state(&dev->ctrl, new_state)) {
+ dev_warn(dev->ctrl.device,
+ "failed to mark controller state %d\n", new_state);
++ result = -ENODEV;
+ goto out;
+ }
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 4352c1cb926d..87a8887fd4d3 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -178,6 +178,8 @@ static void qcom_ep_reset_assert(struct qcom_pcie *pcie)
+
+ static void qcom_ep_reset_deassert(struct qcom_pcie *pcie)
+ {
++ /* Ensure that PERST has been asserted for at least 100 ms */
++ msleep(100);
+ gpiod_set_value_cansleep(pcie->reset, 0);
+ usleep_range(PERST_DELAY_US, PERST_DELAY_US + 500);
+ }
+diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
+index 808a182830e5..5dadc964ad3b 100644
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -1880,6 +1880,7 @@ static void hv_pci_devices_present(struct hv_pcibus_device *hbus,
+ static void hv_eject_device_work(struct work_struct *work)
+ {
+ struct pci_eject_response *ejct_pkt;
++ struct hv_pcibus_device *hbus;
+ struct hv_pci_dev *hpdev;
+ struct pci_dev *pdev;
+ unsigned long flags;
+@@ -1890,6 +1891,7 @@ static void hv_eject_device_work(struct work_struct *work)
+ } ctxt;
+
+ hpdev = container_of(work, struct hv_pci_dev, wrk);
++ hbus = hpdev->hbus;
+
+ WARN_ON(hpdev->state != hv_pcichild_ejecting);
+
+@@ -1900,8 +1902,7 @@ static void hv_eject_device_work(struct work_struct *work)
+ * because hbus->pci_bus may not exist yet.
+ */
+ wslot = wslot_to_devfn(hpdev->desc.win_slot.slot);
+- pdev = pci_get_domain_bus_and_slot(hpdev->hbus->sysdata.domain, 0,
+- wslot);
++ pdev = pci_get_domain_bus_and_slot(hbus->sysdata.domain, 0, wslot);
+ if (pdev) {
+ pci_lock_rescan_remove();
+ pci_stop_and_remove_bus_device(pdev);
+@@ -1909,9 +1910,9 @@ static void hv_eject_device_work(struct work_struct *work)
+ pci_unlock_rescan_remove();
+ }
+
+- spin_lock_irqsave(&hpdev->hbus->device_list_lock, flags);
++ spin_lock_irqsave(&hbus->device_list_lock, flags);
+ list_del(&hpdev->list_entry);
+- spin_unlock_irqrestore(&hpdev->hbus->device_list_lock, flags);
++ spin_unlock_irqrestore(&hbus->device_list_lock, flags);
+
+ if (hpdev->pci_slot)
+ pci_destroy_slot(hpdev->pci_slot);
+@@ -1920,7 +1921,7 @@ static void hv_eject_device_work(struct work_struct *work)
+ ejct_pkt = (struct pci_eject_response *)&ctxt.pkt.message;
+ ejct_pkt->message_type.type = PCI_EJECTION_COMPLETE;
+ ejct_pkt->wslot.slot = hpdev->desc.win_slot.slot;
+- vmbus_sendpacket(hpdev->hbus->hdev->channel, ejct_pkt,
++ vmbus_sendpacket(hbus->hdev->channel, ejct_pkt,
+ sizeof(*ejct_pkt), (unsigned long)&ctxt.pkt,
+ VM_PKT_DATA_INBAND, 0);
+
+@@ -1929,7 +1930,9 @@ static void hv_eject_device_work(struct work_struct *work)
+ /* For the two refs got in new_pcichild_device() */
+ put_pcichild(hpdev);
+ put_pcichild(hpdev);
+- put_hvpcibus(hpdev->hbus);
++ /* hpdev has been freed. Do not use it any more. */
++
++ put_hvpcibus(hbus);
+ }
+
+ /**
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 61f2ef28ea1c..c65465385d8c 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2004,6 +2004,13 @@ static void pci_pme_list_scan(struct work_struct *work)
+ */
+ if (bridge && bridge->current_state != PCI_D0)
+ continue;
++ /*
++ * If the device is in D3cold it should not be
++ * polled either.
++ */
++ if (pme_dev->dev->current_state == PCI_D3cold)
++ continue;
++
+ pci_pme_wakeup(pme_dev->dev, NULL);
+ } else {
+ list_del(&pme_dev->list);
+diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c
+index f85d6b7a1984..5d2b2c02cbbe 100644
+--- a/drivers/ras/cec.c
++++ b/drivers/ras/cec.c
+@@ -369,7 +369,9 @@ static int pfn_set(void *data, u64 val)
+ {
+ *(u64 *)data = val;
+
+- return cec_add_elem(val);
++ cec_add_elem(val);
++
++ return 0;
+ }
+
+ DEFINE_DEBUGFS_ATTRIBUTE(pfn_ops, u64_get, pfn_set, "0x%llx\n");
+diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
+index c584bd1ffa9c..7c598c156d9e 100644
+--- a/drivers/regulator/s2mps11.c
++++ b/drivers/regulator/s2mps11.c
+@@ -373,8 +373,8 @@ static const struct regulator_desc s2mps11_regulators[] = {
+ regulator_desc_s2mps11_buck1_4(4),
+ regulator_desc_s2mps11_buck5,
+ regulator_desc_s2mps11_buck67810(6, MIN_600_MV, STEP_6_25_MV),
+- regulator_desc_s2mps11_buck67810(7, MIN_600_MV, STEP_12_5_MV),
+- regulator_desc_s2mps11_buck67810(8, MIN_600_MV, STEP_12_5_MV),
++ regulator_desc_s2mps11_buck67810(7, MIN_750_MV, STEP_12_5_MV),
++ regulator_desc_s2mps11_buck67810(8, MIN_750_MV, STEP_12_5_MV),
+ regulator_desc_s2mps11_buck9,
+ regulator_desc_s2mps11_buck67810(10, MIN_750_MV, STEP_12_5_MV),
+ };
+diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
+index 9c7d9da42ba0..4ac4a73037f5 100644
+--- a/drivers/s390/cio/qdio_main.c
++++ b/drivers/s390/cio/qdio_main.c
+@@ -749,6 +749,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q)
+
+ switch (state) {
+ case SLSB_P_OUTPUT_EMPTY:
++ case SLSB_P_OUTPUT_PENDING:
+ /* the adapter got it */
+ DBF_DEV_EVENT(DBF_INFO, q->irq_ptr,
+ "out empty:%1d %02x", q->nr, count);
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 90ea0f5d9bdb..5160d6214a36 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -710,6 +710,8 @@ static void NCR5380_main(struct work_struct *work)
+ NCR5380_information_transfer(instance);
+ done = 0;
+ }
++ if (!hostdata->connected)
++ NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+ spin_unlock_irq(&hostdata->lock);
+ if (!done)
+ cond_resched();
+@@ -984,7 +986,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ if (!hostdata->selecting) {
+ /* Command was aborted */
+ NCR5380_write(MODE_REG, MR_BASE);
+- goto out;
++ return NULL;
+ }
+ if (err < 0) {
+ NCR5380_write(MODE_REG, MR_BASE);
+@@ -1033,7 +1035,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ if (!hostdata->selecting) {
+ NCR5380_write(MODE_REG, MR_BASE);
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+- goto out;
++ return NULL;
+ }
+
+ dsprintk(NDEBUG_ARBITRATION, instance, "won arbitration\n");
+@@ -1106,8 +1108,6 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ spin_lock_irq(&hostdata->lock);
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+ NCR5380_reselect(instance);
+- if (!hostdata->connected)
+- NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+ shost_printk(KERN_ERR, instance, "reselection after won arbitration?\n");
+ goto out;
+ }
+@@ -1115,14 +1115,16 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ if (err < 0) {
+ spin_lock_irq(&hostdata->lock);
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+- NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
++
+ /* Can't touch cmd if it has been reclaimed by the scsi ML */
+- if (hostdata->selecting) {
+- cmd->result = DID_BAD_TARGET << 16;
+- complete_cmd(instance, cmd);
+- dsprintk(NDEBUG_SELECTION, instance, "target did not respond within 250ms\n");
+- cmd = NULL;
+- }
++ if (!hostdata->selecting)
++ return NULL;
++
++ cmd->result = DID_BAD_TARGET << 16;
++ complete_cmd(instance, cmd);
++ dsprintk(NDEBUG_SELECTION, instance,
++ "target did not respond within 250ms\n");
++ cmd = NULL;
+ goto out;
+ }
+
+@@ -1150,12 +1152,11 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ if (err < 0) {
+ shost_printk(KERN_ERR, instance, "select: REQ timeout\n");
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+- NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+ goto out;
+ }
+ if (!hostdata->selecting) {
+ do_abort(instance);
+- goto out;
++ return NULL;
+ }
+
+ dsprintk(NDEBUG_SELECTION, instance, "target %d selected, going into MESSAGE OUT phase.\n",
+@@ -1817,9 +1818,6 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ */
+ NCR5380_write(TARGET_COMMAND_REG, 0);
+
+- /* Enable reselect interrupts */
+- NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+-
+ maybe_release_dma_irq(instance);
+ return;
+ case MESSAGE_REJECT:
+@@ -1851,8 +1849,6 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ */
+ NCR5380_write(TARGET_COMMAND_REG, 0);
+
+- /* Enable reselect interrupts */
+- NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+ #ifdef SUN3_SCSI_VME
+ dregs->csr |= CSR_DMA_ENABLE;
+ #endif
+@@ -1954,7 +1950,6 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ maybe_release_dma_irq(instance);
+- NCR5380_write(SELECT_ENABLE_REG, hostdata->id_mask);
+ return;
+ }
+ msgout = NOP;
+diff --git a/drivers/scsi/NCR5380.h b/drivers/scsi/NCR5380.h
+index 31096a0b0fdd..8a6d002e6789 100644
+--- a/drivers/scsi/NCR5380.h
++++ b/drivers/scsi/NCR5380.h
+@@ -235,7 +235,7 @@ struct NCR5380_cmd {
+ #define NCR5380_PIO_CHUNK_SIZE 256
+
+ /* Time limit (ms) to poll registers when IRQs are disabled, e.g. during PDMA */
+-#define NCR5380_REG_POLL_TIME 15
++#define NCR5380_REG_POLL_TIME 10
+
+ static inline struct scsi_cmnd *NCR5380_to_scmd(struct NCR5380_cmd *ncmd_ptr)
+ {
+diff --git a/drivers/scsi/mac_scsi.c b/drivers/scsi/mac_scsi.c
+index dd6057359d7c..643321fc152d 100644
+--- a/drivers/scsi/mac_scsi.c
++++ b/drivers/scsi/mac_scsi.c
+@@ -3,6 +3,8 @@
+ *
+ * Copyright 1998, Michael Schmitz <mschmitz@lbl.gov>
+ *
++ * Copyright 2019 Finn Thain
++ *
+ * derived in part from:
+ */
+ /*
+@@ -11,6 +13,7 @@
+ * Copyright 1995, Russell King
+ */
+
++#include <linux/delay.h>
+ #include <linux/types.h>
+ #include <linux/module.h>
+ #include <linux/ioport.h>
+@@ -52,7 +55,7 @@ static int setup_cmd_per_lun = -1;
+ module_param(setup_cmd_per_lun, int, 0);
+ static int setup_sg_tablesize = -1;
+ module_param(setup_sg_tablesize, int, 0);
+-static int setup_use_pdma = -1;
++static int setup_use_pdma = 512;
+ module_param(setup_use_pdma, int, 0);
+ static int setup_hostid = -1;
+ module_param(setup_hostid, int, 0);
+@@ -89,101 +92,217 @@ static int __init mac_scsi_setup(char *str)
+ __setup("mac5380=", mac_scsi_setup);
+ #endif /* !MODULE */
+
+-/* Pseudo DMA asm originally by Ove Edlund */
+-
+-#define CP_IO_TO_MEM(s,d,n) \
+-__asm__ __volatile__ \
+- (" cmp.w #4,%2\n" \
+- " bls 8f\n" \
+- " move.w %1,%%d0\n" \
+- " neg.b %%d0\n" \
+- " and.w #3,%%d0\n" \
+- " sub.w %%d0,%2\n" \
+- " bra 2f\n" \
+- " 1: move.b (%0),(%1)+\n" \
+- " 2: dbf %%d0,1b\n" \
+- " move.w %2,%%d0\n" \
+- " lsr.w #5,%%d0\n" \
+- " bra 4f\n" \
+- " 3: move.l (%0),(%1)+\n" \
+- "31: move.l (%0),(%1)+\n" \
+- "32: move.l (%0),(%1)+\n" \
+- "33: move.l (%0),(%1)+\n" \
+- "34: move.l (%0),(%1)+\n" \
+- "35: move.l (%0),(%1)+\n" \
+- "36: move.l (%0),(%1)+\n" \
+- "37: move.l (%0),(%1)+\n" \
+- " 4: dbf %%d0,3b\n" \
+- " move.w %2,%%d0\n" \
+- " lsr.w #2,%%d0\n" \
+- " and.w #7,%%d0\n" \
+- " bra 6f\n" \
+- " 5: move.l (%0),(%1)+\n" \
+- " 6: dbf %%d0,5b\n" \
+- " and.w #3,%2\n" \
+- " bra 8f\n" \
+- " 7: move.b (%0),(%1)+\n" \
+- " 8: dbf %2,7b\n" \
+- " moveq.l #0, %2\n" \
+- " 9: \n" \
+- ".section .fixup,\"ax\"\n" \
+- " .even\n" \
+- "91: moveq.l #1, %2\n" \
+- " jra 9b\n" \
+- "94: moveq.l #4, %2\n" \
+- " jra 9b\n" \
+- ".previous\n" \
+- ".section __ex_table,\"a\"\n" \
+- " .align 4\n" \
+- " .long 1b,91b\n" \
+- " .long 3b,94b\n" \
+- " .long 31b,94b\n" \
+- " .long 32b,94b\n" \
+- " .long 33b,94b\n" \
+- " .long 34b,94b\n" \
+- " .long 35b,94b\n" \
+- " .long 36b,94b\n" \
+- " .long 37b,94b\n" \
+- " .long 5b,94b\n" \
+- " .long 7b,91b\n" \
+- ".previous" \
+- : "=a"(s), "=a"(d), "=d"(n) \
+- : "0"(s), "1"(d), "2"(n) \
+- : "d0")
++/*
++ * According to "Inside Macintosh: Devices", Mac OS requires disk drivers to
++ * specify the number of bytes between the delays expected from a SCSI target.
++ * This allows the operating system to "prevent bus errors when a target fails
++ * to deliver the next byte within the processor bus error timeout period."
++ * Linux SCSI drivers lack knowledge of the timing behaviour of SCSI targets
++ * so bus errors are unavoidable.
++ *
++ * If a MOVE.B instruction faults, we assume that zero bytes were transferred
++ * and simply retry. That assumption probably depends on target behaviour but
++ * seems to hold up okay. The NOP provides synchronization: without it the
++ * fault can sometimes occur after the program counter has moved past the
++ * offending instruction. Post-increment addressing can't be used.
++ */
++
++#define MOVE_BYTE(operands) \
++ asm volatile ( \
++ "1: moveb " operands " \n" \
++ "11: nop \n" \
++ " addq #1,%0 \n" \
++ " subq #1,%1 \n" \
++ "40: \n" \
++ " \n" \
++ ".section .fixup,\"ax\" \n" \
++ ".even \n" \
++ "90: movel #1, %2 \n" \
++ " jra 40b \n" \
++ ".previous \n" \
++ " \n" \
++ ".section __ex_table,\"a\" \n" \
++ ".align 4 \n" \
++ ".long 1b,90b \n" \
++ ".long 11b,90b \n" \
++ ".previous \n" \
++ : "+a" (addr), "+r" (n), "+r" (result) : "a" (io))
++
++/*
++ * If a MOVE.W (or MOVE.L) instruction faults, it cannot be retried because
++ * the residual byte count would be uncertain. In that situation the MOVE_WORD
++ * macro clears n in the fixup section to abort the transfer.
++ */
++
++#define MOVE_WORD(operands) \
++ asm volatile ( \
++ "1: movew " operands " \n" \
++ "11: nop \n" \
++ " subq #2,%1 \n" \
++ "40: \n" \
++ " \n" \
++ ".section .fixup,\"ax\" \n" \
++ ".even \n" \
++ "90: movel #0, %1 \n" \
++ " movel #2, %2 \n" \
++ " jra 40b \n" \
++ ".previous \n" \
++ " \n" \
++ ".section __ex_table,\"a\" \n" \
++ ".align 4 \n" \
++ ".long 1b,90b \n" \
++ ".long 11b,90b \n" \
++ ".previous \n" \
++ : "+a" (addr), "+r" (n), "+r" (result) : "a" (io))
++
++#define MOVE_16_WORDS(operands) \
++ asm volatile ( \
++ "1: movew " operands " \n" \
++ "2: movew " operands " \n" \
++ "3: movew " operands " \n" \
++ "4: movew " operands " \n" \
++ "5: movew " operands " \n" \
++ "6: movew " operands " \n" \
++ "7: movew " operands " \n" \
++ "8: movew " operands " \n" \
++ "9: movew " operands " \n" \
++ "10: movew " operands " \n" \
++ "11: movew " operands " \n" \
++ "12: movew " operands " \n" \
++ "13: movew " operands " \n" \
++ "14: movew " operands " \n" \
++ "15: movew " operands " \n" \
++ "16: movew " operands " \n" \
++ "17: nop \n" \
++ " subl #32,%1 \n" \
++ "40: \n" \
++ " \n" \
++ ".section .fixup,\"ax\" \n" \
++ ".even \n" \
++ "90: movel #0, %1 \n" \
++ " movel #2, %2 \n" \
++ " jra 40b \n" \
++ ".previous \n" \
++ " \n" \
++ ".section __ex_table,\"a\" \n" \
++ ".align 4 \n" \
++ ".long 1b,90b \n" \
++ ".long 2b,90b \n" \
++ ".long 3b,90b \n" \
++ ".long 4b,90b \n" \
++ ".long 5b,90b \n" \
++ ".long 6b,90b \n" \
++ ".long 7b,90b \n" \
++ ".long 8b,90b \n" \
++ ".long 9b,90b \n" \
++ ".long 10b,90b \n" \
++ ".long 11b,90b \n" \
++ ".long 12b,90b \n" \
++ ".long 13b,90b \n" \
++ ".long 14b,90b \n" \
++ ".long 15b,90b \n" \
++ ".long 16b,90b \n" \
++ ".long 17b,90b \n" \
++ ".previous \n" \
++ : "+a" (addr), "+r" (n), "+r" (result) : "a" (io))
++
++#define MAC_PDMA_DELAY 32
++
++static inline int mac_pdma_recv(void __iomem *io, unsigned char *start, int n)
++{
++ unsigned char *addr = start;
++ int result = 0;
++
++ if (n >= 1) {
++ MOVE_BYTE("%3@,%0@");
++ if (result)
++ goto out;
++ }
++ if (n >= 1 && ((unsigned long)addr & 1)) {
++ MOVE_BYTE("%3@,%0@");
++ if (result)
++ goto out;
++ }
++ while (n >= 32)
++ MOVE_16_WORDS("%3@,%0@+");
++ while (n >= 2)
++ MOVE_WORD("%3@,%0@+");
++ if (result)
++ return start - addr; /* Negated to indicate uncertain length */
++ if (n == 1)
++ MOVE_BYTE("%3@,%0@");
++out:
++ return addr - start;
++}
++
++static inline int mac_pdma_send(unsigned char *start, void __iomem *io, int n)
++{
++ unsigned char *addr = start;
++ int result = 0;
++
++ if (n >= 1) {
++ MOVE_BYTE("%0@,%3@");
++ if (result)
++ goto out;
++ }
++ if (n >= 1 && ((unsigned long)addr & 1)) {
++ MOVE_BYTE("%0@,%3@");
++ if (result)
++ goto out;
++ }
++ while (n >= 32)
++ MOVE_16_WORDS("%0@+,%3@");
++ while (n >= 2)
++ MOVE_WORD("%0@+,%3@");
++ if (result)
++ return start - addr; /* Negated to indicate uncertain length */
++ if (n == 1)
++ MOVE_BYTE("%0@,%3@");
++out:
++ return addr - start;
++}
+
+ static inline int macscsi_pread(struct NCR5380_hostdata *hostdata,
+ unsigned char *dst, int len)
+ {
+ u8 __iomem *s = hostdata->pdma_io + (INPUT_DATA_REG << 4);
+ unsigned char *d = dst;
+- int n = len;
+- int transferred;
++
++ hostdata->pdma_residual = len;
+
+ while (!NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
+ BASR_DRQ | BASR_PHASE_MATCH,
+ BASR_DRQ | BASR_PHASE_MATCH, HZ / 64)) {
+- CP_IO_TO_MEM(s, d, n);
++ int bytes;
+
+- transferred = d - dst - n;
+- hostdata->pdma_residual = len - transferred;
++ bytes = mac_pdma_recv(s, d, min(hostdata->pdma_residual, 512));
+
+- /* No bus error. */
+- if (n == 0)
++ if (bytes > 0) {
++ d += bytes;
++ hostdata->pdma_residual -= bytes;
++ }
++
++ if (hostdata->pdma_residual == 0)
+ return 0;
+
+- /* Target changed phase early? */
+ if (NCR5380_poll_politely2(hostdata, STATUS_REG, SR_REQ, SR_REQ,
+- BUS_AND_STATUS_REG, BASR_ACK, BASR_ACK, HZ / 64) < 0)
+- scmd_printk(KERN_ERR, hostdata->connected,
++ BUS_AND_STATUS_REG, BASR_ACK,
++ BASR_ACK, HZ / 64) < 0)
++ scmd_printk(KERN_DEBUG, hostdata->connected,
+ "%s: !REQ and !ACK\n", __func__);
+ if (!(NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH))
+ return 0;
+
++ if (bytes == 0)
++ udelay(MAC_PDMA_DELAY);
++
++ if (bytes >= 0)
++ continue;
++
+ dsprintk(NDEBUG_PSEUDO_DMA, hostdata->host,
+- "%s: bus error (%d/%d)\n", __func__, transferred, len);
++ "%s: bus error (%d/%d)\n", __func__, d - dst, len);
+ NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
+- d = dst + transferred;
+- n = len - transferred;
++ return -1;
+ }
+
+ scmd_printk(KERN_ERR, hostdata->connected,
+@@ -192,93 +311,27 @@ static inline int macscsi_pread(struct NCR5380_hostdata *hostdata,
+ return -1;
+ }
+
+-
+-#define CP_MEM_TO_IO(s,d,n) \
+-__asm__ __volatile__ \
+- (" cmp.w #4,%2\n" \
+- " bls 8f\n" \
+- " move.w %0,%%d0\n" \
+- " neg.b %%d0\n" \
+- " and.w #3,%%d0\n" \
+- " sub.w %%d0,%2\n" \
+- " bra 2f\n" \
+- " 1: move.b (%0)+,(%1)\n" \
+- " 2: dbf %%d0,1b\n" \
+- " move.w %2,%%d0\n" \
+- " lsr.w #5,%%d0\n" \
+- " bra 4f\n" \
+- " 3: move.l (%0)+,(%1)\n" \
+- "31: move.l (%0)+,(%1)\n" \
+- "32: move.l (%0)+,(%1)\n" \
+- "33: move.l (%0)+,(%1)\n" \
+- "34: move.l (%0)+,(%1)\n" \
+- "35: move.l (%0)+,(%1)\n" \
+- "36: move.l (%0)+,(%1)\n" \
+- "37: move.l (%0)+,(%1)\n" \
+- " 4: dbf %%d0,3b\n" \
+- " move.w %2,%%d0\n" \
+- " lsr.w #2,%%d0\n" \
+- " and.w #7,%%d0\n" \
+- " bra 6f\n" \
+- " 5: move.l (%0)+,(%1)\n" \
+- " 6: dbf %%d0,5b\n" \
+- " and.w #3,%2\n" \
+- " bra 8f\n" \
+- " 7: move.b (%0)+,(%1)\n" \
+- " 8: dbf %2,7b\n" \
+- " moveq.l #0, %2\n" \
+- " 9: \n" \
+- ".section .fixup,\"ax\"\n" \
+- " .even\n" \
+- "91: moveq.l #1, %2\n" \
+- " jra 9b\n" \
+- "94: moveq.l #4, %2\n" \
+- " jra 9b\n" \
+- ".previous\n" \
+- ".section __ex_table,\"a\"\n" \
+- " .align 4\n" \
+- " .long 1b,91b\n" \
+- " .long 3b,94b\n" \
+- " .long 31b,94b\n" \
+- " .long 32b,94b\n" \
+- " .long 33b,94b\n" \
+- " .long 34b,94b\n" \
+- " .long 35b,94b\n" \
+- " .long 36b,94b\n" \
+- " .long 37b,94b\n" \
+- " .long 5b,94b\n" \
+- " .long 7b,91b\n" \
+- ".previous" \
+- : "=a"(s), "=a"(d), "=d"(n) \
+- : "0"(s), "1"(d), "2"(n) \
+- : "d0")
+-
+ static inline int macscsi_pwrite(struct NCR5380_hostdata *hostdata,
+ unsigned char *src, int len)
+ {
+ unsigned char *s = src;
+ u8 __iomem *d = hostdata->pdma_io + (OUTPUT_DATA_REG << 4);
+- int n = len;
+- int transferred;
++
++ hostdata->pdma_residual = len;
+
+ while (!NCR5380_poll_politely(hostdata, BUS_AND_STATUS_REG,
+ BASR_DRQ | BASR_PHASE_MATCH,
+ BASR_DRQ | BASR_PHASE_MATCH, HZ / 64)) {
+- CP_MEM_TO_IO(s, d, n);
++ int bytes;
+
+- transferred = s - src - n;
+- hostdata->pdma_residual = len - transferred;
++ bytes = mac_pdma_send(s, d, min(hostdata->pdma_residual, 512));
+
+- /* Target changed phase early? */
+- if (NCR5380_poll_politely2(hostdata, STATUS_REG, SR_REQ, SR_REQ,
+- BUS_AND_STATUS_REG, BASR_ACK, BASR_ACK, HZ / 64) < 0)
+- scmd_printk(KERN_ERR, hostdata->connected,
+- "%s: !REQ and !ACK\n", __func__);
+- if (!(NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH))
+- return 0;
++ if (bytes > 0) {
++ s += bytes;
++ hostdata->pdma_residual -= bytes;
++ }
+
+- /* No bus error. */
+- if (n == 0) {
++ if (hostdata->pdma_residual == 0) {
+ if (NCR5380_poll_politely(hostdata, TARGET_COMMAND_REG,
+ TCR_LAST_BYTE_SENT,
+ TCR_LAST_BYTE_SENT, HZ / 64) < 0)
+@@ -287,17 +340,29 @@ static inline int macscsi_pwrite(struct NCR5380_hostdata *hostdata,
+ return 0;
+ }
+
++ if (NCR5380_poll_politely2(hostdata, STATUS_REG, SR_REQ, SR_REQ,
++ BUS_AND_STATUS_REG, BASR_ACK,
++ BASR_ACK, HZ / 64) < 0)
++ scmd_printk(KERN_DEBUG, hostdata->connected,
++ "%s: !REQ and !ACK\n", __func__);
++ if (!(NCR5380_read(BUS_AND_STATUS_REG) & BASR_PHASE_MATCH))
++ return 0;
++
++ if (bytes == 0)
++ udelay(MAC_PDMA_DELAY);
++
++ if (bytes >= 0)
++ continue;
++
+ dsprintk(NDEBUG_PSEUDO_DMA, hostdata->host,
+- "%s: bus error (%d/%d)\n", __func__, transferred, len);
++ "%s: bus error (%d/%d)\n", __func__, s - src, len);
+ NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
+- s = src + transferred;
+- n = len - transferred;
++ return -1;
+ }
+
+ scmd_printk(KERN_ERR, hostdata->connected,
+ "%s: phase mismatch or !DRQ\n", __func__);
+ NCR5380_dprint(NDEBUG_PSEUDO_DMA, hostdata->host);
+-
+ return -1;
+ }
+
+@@ -305,7 +370,7 @@ static int macscsi_dma_xfer_len(struct NCR5380_hostdata *hostdata,
+ struct scsi_cmnd *cmd)
+ {
+ if (hostdata->flags & FLAG_NO_PSEUDO_DMA ||
+- cmd->SCp.this_residual < 16)
++ cmd->SCp.this_residual < setup_use_pdma)
+ return 0;
+
+ return cmd->SCp.this_residual;
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index acb503ea8f0c..e0c87228438d 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -5862,7 +5862,8 @@ megasas_get_target_prop(struct megasas_instance *instance,
+ int ret;
+ struct megasas_cmd *cmd;
+ struct megasas_dcmd_frame *dcmd;
+- u16 targetId = (sdev->channel % 2) + sdev->id;
++ u16 targetId = ((sdev->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) +
++ sdev->id;
+
+ cmd = megasas_get_cmd(instance);
+
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 1fc832751a4f..32652b2c5e7c 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -71,11 +71,11 @@ int scsi_init_sense_cache(struct Scsi_Host *shost)
+ struct kmem_cache *cache;
+ int ret = 0;
+
++ mutex_lock(&scsi_sense_cache_mutex);
+ cache = scsi_select_sense_cache(shost->unchecked_isa_dma);
+ if (cache)
+- return 0;
++ goto exit;
+
+- mutex_lock(&scsi_sense_cache_mutex);
+ if (shost->unchecked_isa_dma) {
+ scsi_sense_isadma_cache =
+ kmem_cache_create("scsi_sense_cache(DMA)",
+@@ -91,7 +91,7 @@ int scsi_init_sense_cache(struct Scsi_Host *shost)
+ if (!scsi_sense_cache)
+ ret = -ENOMEM;
+ }
+-
++ exit:
+ mutex_unlock(&scsi_sense_cache_mutex);
+ return ret;
+ }
+diff --git a/drivers/staging/media/davinci_vpfe/vpfe_video.c b/drivers/staging/media/davinci_vpfe/vpfe_video.c
+index 1269a983455e..13b890b9ef18 100644
+--- a/drivers/staging/media/davinci_vpfe/vpfe_video.c
++++ b/drivers/staging/media/davinci_vpfe/vpfe_video.c
+@@ -422,6 +422,9 @@ static int vpfe_open(struct file *file)
+ /* If decoder is not initialized. initialize it */
+ if (!video->initialized && vpfe_update_pipe_state(video)) {
+ mutex_unlock(&video->lock);
++ v4l2_fh_del(&handle->vfh);
++ v4l2_fh_exit(&handle->vfh);
++ kfree(handle);
+ return -ENODEV;
+ }
+ /* Increment device users counter */
+diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
+index 4e680d753941..e2fa3a3bc81d 100644
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -89,6 +89,12 @@ out:
+ return CHAP_DIGEST_UNKNOWN;
+ }
+
++static void chap_close(struct iscsi_conn *conn)
++{
++ kfree(conn->auth_protocol);
++ conn->auth_protocol = NULL;
++}
++
+ static struct iscsi_chap *chap_server_open(
+ struct iscsi_conn *conn,
+ struct iscsi_node_auth *auth,
+@@ -126,7 +132,7 @@ static struct iscsi_chap *chap_server_open(
+ case CHAP_DIGEST_UNKNOWN:
+ default:
+ pr_err("Unsupported CHAP_A value\n");
+- kfree(conn->auth_protocol);
++ chap_close(conn);
+ return NULL;
+ }
+
+@@ -141,19 +147,13 @@ static struct iscsi_chap *chap_server_open(
+ * Generate Challenge.
+ */
+ if (chap_gen_challenge(conn, 1, aic_str, aic_len) < 0) {
+- kfree(conn->auth_protocol);
++ chap_close(conn);
+ return NULL;
+ }
+
+ return chap;
+ }
+
+-static void chap_close(struct iscsi_conn *conn)
+-{
+- kfree(conn->auth_protocol);
+- conn->auth_protocol = NULL;
+-}
+-
+ static int chap_server_compute_md5(
+ struct iscsi_conn *conn,
+ struct iscsi_node_auth *auth,
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index eb24ec0e160d..f4e8e869649a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3575,6 +3575,7 @@ static int hub_handle_remote_wakeup(struct usb_hub *hub, unsigned int port,
+ struct usb_device *hdev;
+ struct usb_device *udev;
+ int connect_change = 0;
++ u16 link_state;
+ int ret;
+
+ hdev = hub->hdev;
+@@ -3584,9 +3585,11 @@ static int hub_handle_remote_wakeup(struct usb_hub *hub, unsigned int port,
+ return 0;
+ usb_clear_port_feature(hdev, port, USB_PORT_FEAT_C_SUSPEND);
+ } else {
++ link_state = portstatus & USB_PORT_STAT_LINK_STATE;
+ if (!udev || udev->state != USB_STATE_SUSPENDED ||
+- (portstatus & USB_PORT_STAT_LINK_STATE) !=
+- USB_SS_PORT_LS_U0)
++ (link_state != USB_SS_PORT_LS_U0 &&
++ link_state != USB_SS_PORT_LS_U1 &&
++ link_state != USB_SS_PORT_LS_U2))
+ return 0;
+ }
+
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index 39155d7cc894..ae704658b528 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -36,7 +36,7 @@
+
+ #include "vhost.h"
+
+-static int experimental_zcopytx = 1;
++static int experimental_zcopytx = 0;
+ module_param(experimental_zcopytx, int, 0444);
+ MODULE_PARM_DESC(experimental_zcopytx, "Enable Zero Copy TX;"
+ " 1 -Enable; 0 - Disable");
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index 7ab6caef599c..d4e8b717ce2b 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -527,8 +527,15 @@ static void balloon_process(struct work_struct *work)
+ state = reserve_additional_memory();
+ }
+
+- if (credit < 0)
+- state = decrease_reservation(-credit, GFP_BALLOON);
++ if (credit < 0) {
++ long n_pages;
++
++ n_pages = min(-credit, si_mem_available());
++ state = decrease_reservation(n_pages, GFP_BALLOON);
++ if (state == BP_DONE && n_pages != -credit &&
++ n_pages < totalreserve_pages)
++ state = BP_EAGAIN;
++ }
+
+ state = update_schedule(state);
+
+@@ -567,6 +574,9 @@ static int add_ballooned_pages(int nr_pages)
+ }
+ }
+
++ if (si_mem_available() < nr_pages)
++ return -ENOMEM;
++
+ st = decrease_reservation(nr_pages, GFP_USER);
+ if (st != BP_DONE)
+ return -ENOMEM;
+@@ -696,7 +706,7 @@ static int __init balloon_init(void)
+ balloon_stats.schedule_delay = 1;
+ balloon_stats.max_schedule_delay = 32;
+ balloon_stats.retry_count = 1;
+- balloon_stats.max_retry_count = RETRY_UNLIMITED;
++ balloon_stats.max_retry_count = 4;
+
+ #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+ set_online_page_callback(&xen_online_page);
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index fe1f16351f94..8d49b91d92cd 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1293,7 +1293,7 @@ void rebind_evtchn_irq(int evtchn, int irq)
+ }
+
+ /* Rebind an evtchn so that it gets delivered to a specific cpu */
+-int xen_rebind_evtchn_to_cpu(int evtchn, unsigned tcpu)
++static int xen_rebind_evtchn_to_cpu(int evtchn, unsigned int tcpu)
+ {
+ struct evtchn_bind_vcpu bind_vcpu;
+ int masked;
+@@ -1327,7 +1327,6 @@ int xen_rebind_evtchn_to_cpu(int evtchn, unsigned tcpu)
+
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(xen_rebind_evtchn_to_cpu);
+
+ static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest,
+ bool force)
+@@ -1341,6 +1340,15 @@ static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest,
+ return ret;
+ }
+
++/* To be called with desc->lock held. */
++int xen_set_affinity_evtchn(struct irq_desc *desc, unsigned int tcpu)
++{
++ struct irq_data *d = irq_desc_get_irq_data(desc);
++
++ return set_affinity_irq(d, cpumask_of(tcpu), false);
++}
++EXPORT_SYMBOL_GPL(xen_set_affinity_evtchn);
++
+ static void enable_dynirq(struct irq_data *data)
+ {
+ int evtchn = evtchn_from_irq(data->irq);
+diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
+index 6d1a5e58968f..47c70b826a6a 100644
+--- a/drivers/xen/evtchn.c
++++ b/drivers/xen/evtchn.c
+@@ -447,7 +447,7 @@ static void evtchn_bind_interdom_next_vcpu(int evtchn)
+ this_cpu_write(bind_last_selected_cpu, selected_cpu);
+
+ /* unmask expects irqs to be disabled */
+- xen_rebind_evtchn_to_cpu(evtchn, selected_cpu);
++ xen_set_affinity_evtchn(desc, selected_cpu);
+ raw_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index e24c0a69ff5d..c84186563c31 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -2732,6 +2732,11 @@ out_only_mutex:
+ * for detecting, at fsync time, if the inode isn't yet in the
+ * log tree or it's there but not up to date.
+ */
++ struct timespec64 now = current_time(inode);
++
++ inode_inc_iversion(inode);
++ inode->i_mtime = now;
++ inode->i_ctime = now;
+ trans = btrfs_start_transaction(root, 1);
+ if (IS_ERR(trans)) {
+ err = PTR_ERR(trans);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 0d5840d20efc..08c5afa06aee 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3262,6 +3262,30 @@ int btrfs_free_log_root_tree(struct btrfs_trans_handle *trans,
+ return 0;
+ }
+
++/*
++ * Check if an inode was logged in the current transaction. We can't always rely
++ * on an inode's logged_trans value, because it's an in-memory only field and
++ * therefore not persisted. This means that its value is lost if the inode gets
++ * evicted and loaded again from disk (in which case it has a value of 0, and
++ * certainly it is smaller then any possible transaction ID), when that happens
++ * the full_sync flag is set in the inode's runtime flags, so on that case we
++ * assume eviction happened and ignore the logged_trans value, assuming the
++ * worst case, that the inode was logged before in the current transaction.
++ */
++static bool inode_logged(struct btrfs_trans_handle *trans,
++ struct btrfs_inode *inode)
++{
++ if (inode->logged_trans == trans->transid)
++ return true;
++
++ if (inode->last_trans == trans->transid &&
++ test_bit(BTRFS_INODE_NEEDS_FULL_SYNC, &inode->runtime_flags) &&
++ !test_bit(BTRFS_FS_LOG_RECOVERING, &trans->fs_info->flags))
++ return true;
++
++ return false;
++}
++
+ /*
+ * If both a file and directory are logged, and unlinks or renames are
+ * mixed in, we have a few interesting corners:
+@@ -3296,7 +3320,7 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
+ int bytes_del = 0;
+ u64 dir_ino = btrfs_ino(dir);
+
+- if (dir->logged_trans < trans->transid)
++ if (!inode_logged(trans, dir))
+ return 0;
+
+ ret = join_running_log_trans(root);
+@@ -3401,7 +3425,7 @@ int btrfs_del_inode_ref_in_log(struct btrfs_trans_handle *trans,
+ u64 index;
+ int ret;
+
+- if (inode->logged_trans < trans->transid)
++ if (!inode_logged(trans, inode))
+ return 0;
+
+ ret = join_running_log_trans(root);
+@@ -5250,9 +5274,19 @@ log_extents:
+ }
+ }
+
++ /*
++ * Don't update last_log_commit if we logged that an inode exists after
++ * it was loaded to memory (full_sync bit set).
++ * This is to prevent data loss when we do a write to the inode, then
++ * the inode gets evicted after all delalloc was flushed, then we log
++ * it exists (due to a rename for example) and then fsync it. This last
++ * fsync would do nothing (not logging the extents previously written).
++ */
+ spin_lock(&inode->lock);
+ inode->logged_trans = trans->transid;
+- inode->last_log_commit = inode->last_sub_trans;
++ if (inode_only != LOG_INODE_EXISTS ||
++ !test_bit(BTRFS_INODE_NEEDS_FULL_SYNC, &inode->runtime_flags))
++ inode->last_log_commit = inode->last_sub_trans;
+ spin_unlock(&inode->lock);
+ out_unlock:
+ mutex_unlock(&inode->log_mutex);
+diff --git a/fs/coda/file.c b/fs/coda/file.c
+index 1cbc1f2298ee..43d371551d2b 100644
+--- a/fs/coda/file.c
++++ b/fs/coda/file.c
+@@ -27,6 +27,13 @@
+ #include "coda_linux.h"
+ #include "coda_int.h"
+
++struct coda_vm_ops {
++ atomic_t refcnt;
++ struct file *coda_file;
++ const struct vm_operations_struct *host_vm_ops;
++ struct vm_operations_struct vm_ops;
++};
++
+ static ssize_t
+ coda_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ {
+@@ -61,6 +68,34 @@ coda_file_write_iter(struct kiocb *iocb, struct iov_iter *to)
+ return ret;
+ }
+
++static void
++coda_vm_open(struct vm_area_struct *vma)
++{
++ struct coda_vm_ops *cvm_ops =
++ container_of(vma->vm_ops, struct coda_vm_ops, vm_ops);
++
++ atomic_inc(&cvm_ops->refcnt);
++
++ if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->open)
++ cvm_ops->host_vm_ops->open(vma);
++}
++
++static void
++coda_vm_close(struct vm_area_struct *vma)
++{
++ struct coda_vm_ops *cvm_ops =
++ container_of(vma->vm_ops, struct coda_vm_ops, vm_ops);
++
++ if (cvm_ops->host_vm_ops && cvm_ops->host_vm_ops->close)
++ cvm_ops->host_vm_ops->close(vma);
++
++ if (atomic_dec_and_test(&cvm_ops->refcnt)) {
++ vma->vm_ops = cvm_ops->host_vm_ops;
++ fput(cvm_ops->coda_file);
++ kfree(cvm_ops);
++ }
++}
++
+ static int
+ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
+ {
+@@ -68,6 +103,8 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
+ struct coda_inode_info *cii;
+ struct file *host_file;
+ struct inode *coda_inode, *host_inode;
++ struct coda_vm_ops *cvm_ops;
++ int ret;
+
+ cfi = CODA_FTOC(coda_file);
+ BUG_ON(!cfi || cfi->cfi_magic != CODA_MAGIC);
+@@ -76,6 +113,13 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
+ if (!host_file->f_op->mmap)
+ return -ENODEV;
+
++ if (WARN_ON(coda_file != vma->vm_file))
++ return -EIO;
++
++ cvm_ops = kmalloc(sizeof(struct coda_vm_ops), GFP_KERNEL);
++ if (!cvm_ops)
++ return -ENOMEM;
++
+ coda_inode = file_inode(coda_file);
+ host_inode = file_inode(host_file);
+
+@@ -89,6 +133,7 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
+ * the container file on us! */
+ else if (coda_inode->i_mapping != host_inode->i_mapping) {
+ spin_unlock(&cii->c_lock);
++ kfree(cvm_ops);
+ return -EBUSY;
+ }
+
+@@ -97,7 +142,29 @@ coda_file_mmap(struct file *coda_file, struct vm_area_struct *vma)
+ cfi->cfi_mapcount++;
+ spin_unlock(&cii->c_lock);
+
+- return call_mmap(host_file, vma);
++ vma->vm_file = get_file(host_file);
++ ret = call_mmap(vma->vm_file, vma);
++
++ if (ret) {
++ /* if call_mmap fails, our caller will put coda_file so we
++ * should drop the reference to the host_file that we got.
++ */
++ fput(host_file);
++ kfree(cvm_ops);
++ } else {
++ /* here we add redirects for the open/close vm_operations */
++ cvm_ops->host_vm_ops = vma->vm_ops;
++ if (vma->vm_ops)
++ cvm_ops->vm_ops = *vma->vm_ops;
++
++ cvm_ops->vm_ops.open = coda_vm_open;
++ cvm_ops->vm_ops.close = coda_vm_close;
++ cvm_ops->coda_file = coda_file;
++ atomic_set(&cvm_ops->refcnt, 1);
++
++ vma->vm_ops = &cvm_ops->vm_ops;
++ }
++ return ret;
+ }
+
+ int coda_open(struct inode *coda_inode, struct file *coda_file)
+@@ -207,4 +274,3 @@ const struct file_operations coda_file_operations = {
+ .fsync = coda_fsync,
+ .splice_read = generic_file_splice_read,
+ };
+-
+diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
+index 0f46cf550907..c83ddff3ff4a 100644
+--- a/fs/crypto/crypto.c
++++ b/fs/crypto/crypto.c
+@@ -149,7 +149,10 @@ int fscrypt_do_page_crypto(const struct inode *inode, fscrypt_direction_t rw,
+ struct crypto_skcipher *tfm = ci->ci_ctfm;
+ int res = 0;
+
+- BUG_ON(len == 0);
++ if (WARN_ON_ONCE(len <= 0))
++ return -EINVAL;
++ if (WARN_ON_ONCE(len % FS_CRYPTO_BLOCK_SIZE != 0))
++ return -EINVAL;
+
+ BUILD_BUG_ON(sizeof(iv) != FS_IV_SIZE);
+ BUILD_BUG_ON(AES_BLOCK_SIZE != FS_IV_SIZE);
+@@ -241,8 +244,6 @@ struct page *fscrypt_encrypt_page(const struct inode *inode,
+ struct page *ciphertext_page = page;
+ int err;
+
+- BUG_ON(len % FS_CRYPTO_BLOCK_SIZE != 0);
+-
+ if (inode->i_sb->s_cop->flags & FS_CFLG_OWN_PAGES) {
+ /* with inplace-encryption we just encrypt the page */
+ err = fscrypt_do_page_crypto(inode, FS_ENCRYPT, lblk_num, page,
+@@ -254,7 +255,8 @@ struct page *fscrypt_encrypt_page(const struct inode *inode,
+ return ciphertext_page;
+ }
+
+- BUG_ON(!PageLocked(page));
++ if (WARN_ON_ONCE(!PageLocked(page)))
++ return ERR_PTR(-EINVAL);
+
+ ctx = fscrypt_get_ctx(inode, gfp_flags);
+ if (IS_ERR(ctx))
+@@ -302,8 +304,9 @@ EXPORT_SYMBOL(fscrypt_encrypt_page);
+ int fscrypt_decrypt_page(const struct inode *inode, struct page *page,
+ unsigned int len, unsigned int offs, u64 lblk_num)
+ {
+- if (!(inode->i_sb->s_cop->flags & FS_CFLG_OWN_PAGES))
+- BUG_ON(!PageLocked(page));
++ if (WARN_ON_ONCE(!PageLocked(page) &&
++ !(inode->i_sb->s_cop->flags & FS_CFLG_OWN_PAGES)))
++ return -EINVAL;
+
+ return fscrypt_do_page_crypto(inode, FS_DECRYPT, lblk_num, page, page,
+ len, offs, GFP_NOFS);
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 4dd842f72846..708f931c36f1 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -1018,8 +1018,10 @@ int ecryptfs_read_and_validate_header_region(struct inode *inode)
+
+ rc = ecryptfs_read_lower(file_size, 0, ECRYPTFS_SIZE_AND_MARKER_BYTES,
+ inode);
+- if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
+- return rc >= 0 ? -EINVAL : rc;
++ if (rc < 0)
++ return rc;
++ else if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
++ return -EINVAL;
+ rc = ecryptfs_validate_marker(marker);
+ if (!rc)
+ ecryptfs_i_size_init(file_size, inode);
+@@ -1381,8 +1383,10 @@ int ecryptfs_read_and_validate_xattr_region(struct dentry *dentry,
+ ecryptfs_inode_to_lower(inode),
+ ECRYPTFS_XATTR_NAME, file_size,
+ ECRYPTFS_SIZE_AND_MARKER_BYTES);
+- if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
+- return rc >= 0 ? -EINVAL : rc;
++ if (rc < 0)
++ return rc;
++ else if (rc < ECRYPTFS_SIZE_AND_MARKER_BYTES)
++ return -EINVAL;
+ rc = ecryptfs_validate_marker(marker);
+ if (!rc)
+ ecryptfs_i_size_init(file_size, inode);
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 9544e2f8b79f..7ee86d8f313d 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -721,6 +721,7 @@ void wbc_detach_inode(struct writeback_control *wbc)
+ void wbc_account_io(struct writeback_control *wbc, struct page *page,
+ size_t bytes)
+ {
++ struct cgroup_subsys_state *css;
+ int id;
+
+ /*
+@@ -732,7 +733,12 @@ void wbc_account_io(struct writeback_control *wbc, struct page *page,
+ if (!wbc->wb)
+ return;
+
+- id = mem_cgroup_css_from_page(page)->id;
++ css = mem_cgroup_css_from_page(page);
++ /* dead cgroups shouldn't contribute to inode ownership arbitration */
++ if (!(css->flags & CSS_ONLINE))
++ return;
++
++ id = css->id;
+
+ if (id == wbc->wb_id) {
+ wbc->wb_bytes += bytes;
+diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+index 364028c710a8..8da239b6cc16 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+@@ -307,7 +307,7 @@ int ff_layout_track_ds_error(struct nfs4_flexfile_layout *flo,
+ if (status == 0)
+ return 0;
+
+- if (mirror->mirror_ds == NULL)
++ if (IS_ERR_OR_NULL(mirror->mirror_ds))
+ return -EINVAL;
+
+ dserr = kmalloc(sizeof(*dserr), gfp_flags);
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index b65aee481d13..e4cd3a2fe698 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1100,6 +1100,7 @@ int nfs_open(struct inode *inode, struct file *filp)
+ nfs_fscache_open_file(inode, filp);
+ return 0;
+ }
++EXPORT_SYMBOL_GPL(nfs_open);
+
+ /*
+ * This function is called whenever some part of NFS notices that
+diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
+index 134858507268..61abbb087ed1 100644
+--- a/fs/nfs/nfs4file.c
++++ b/fs/nfs/nfs4file.c
+@@ -49,7 +49,7 @@ nfs4_file_open(struct inode *inode, struct file *filp)
+ return err;
+
+ if ((openflags & O_ACCMODE) == 3)
+- openflags--;
++ return nfs_open(inode, filp);
+
+ /* We can't create new files here */
+ openflags &= ~(O_CREAT|O_EXCL);
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 7d9a51e6b847..4931c3a75f03 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1866,8 +1866,8 @@ lookup_again:
+ atomic_read(&lo->plh_outstanding) != 0) {
+ spin_unlock(&ino->i_lock);
+ lseg = ERR_PTR(wait_var_event_killable(&lo->plh_outstanding,
+- atomic_read(&lo->plh_outstanding)));
+- if (IS_ERR(lseg) || !list_empty(&lo->plh_segs))
++ !atomic_read(&lo->plh_outstanding)));
++ if (IS_ERR(lseg))
+ goto out_put_layout_hdr;
+ pnfs_put_layout_hdr(lo);
+ goto lookup_again;
+diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
+index 7325baa8f9d4..c95f32b83a94 100644
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -498,6 +498,10 @@ static struct inode *proc_sys_make_inode(struct super_block *sb,
+
+ if (root->set_ownership)
+ root->set_ownership(head, table, &inode->i_uid, &inode->i_gid);
++ else {
++ inode->i_uid = GLOBAL_ROOT_UID;
++ inode->i_gid = GLOBAL_ROOT_GID;
++ }
+
+ return inode;
+ }
+diff --git a/fs/xfs/libxfs/xfs_ag_resv.c b/fs/xfs/libxfs/xfs_ag_resv.c
+index e701ebc36c06..e2ba2a3b63b2 100644
+--- a/fs/xfs/libxfs/xfs_ag_resv.c
++++ b/fs/xfs/libxfs/xfs_ag_resv.c
+@@ -281,7 +281,7 @@ xfs_ag_resv_init(
+ */
+ ask = used = 0;
+
+- mp->m_inotbt_nores = true;
++ mp->m_finobt_nores = true;
+
+ error = xfs_refcountbt_calc_reserves(mp, tp, agno, &ask,
+ &used);
+diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c
+index 86c50208a143..adb2f6df5a11 100644
+--- a/fs/xfs/libxfs/xfs_ialloc_btree.c
++++ b/fs/xfs/libxfs/xfs_ialloc_btree.c
+@@ -124,7 +124,7 @@ xfs_finobt_alloc_block(
+ union xfs_btree_ptr *new,
+ int *stat)
+ {
+- if (cur->bc_mp->m_inotbt_nores)
++ if (cur->bc_mp->m_finobt_nores)
+ return xfs_inobt_alloc_block(cur, start, new, stat);
+ return __xfs_inobt_alloc_block(cur, start, new, stat,
+ XFS_AG_RESV_METADATA);
+@@ -157,7 +157,7 @@ xfs_finobt_free_block(
+ struct xfs_btree_cur *cur,
+ struct xfs_buf *bp)
+ {
+- if (cur->bc_mp->m_inotbt_nores)
++ if (cur->bc_mp->m_finobt_nores)
+ return xfs_inobt_free_block(cur, bp);
+ return __xfs_inobt_free_block(cur, bp, XFS_AG_RESV_METADATA);
+ }
+diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c
+index a58034049995..3d213a7394c5 100644
+--- a/fs/xfs/xfs_attr_list.c
++++ b/fs/xfs/xfs_attr_list.c
+@@ -555,6 +555,7 @@ xfs_attr_put_listent(
+ attrlist_ent_t *aep;
+ int arraytop;
+
++ ASSERT(!context->seen_enough);
+ ASSERT(!(context->flags & ATTR_KERNOVAL));
+ ASSERT(context->count >= 0);
+ ASSERT(context->count < (ATTR_MAX_VALUELEN/8));
+diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
+index 211b06e4702e..41ad9eaab6ce 100644
+--- a/fs/xfs/xfs_bmap_util.c
++++ b/fs/xfs/xfs_bmap_util.c
+@@ -1080,7 +1080,7 @@ xfs_adjust_extent_unmap_boundaries(
+ return 0;
+ }
+
+-static int
++int
+ xfs_flush_unmap_range(
+ struct xfs_inode *ip,
+ xfs_off_t offset,
+diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h
+index 87363d136bb6..9c73d012f56a 100644
+--- a/fs/xfs/xfs_bmap_util.h
++++ b/fs/xfs/xfs_bmap_util.h
+@@ -76,6 +76,8 @@ int xfs_swap_extents(struct xfs_inode *ip, struct xfs_inode *tip,
+ xfs_daddr_t xfs_fsb_to_db(struct xfs_inode *ip, xfs_fsblock_t fsb);
+
+ xfs_extnum_t xfs_bmap_count_leaves(struct xfs_ifork *ifp, xfs_filblks_t *count);
++int xfs_flush_unmap_range(struct xfs_inode *ip, xfs_off_t offset,
++ xfs_off_t len);
+ int xfs_bmap_count_blocks(struct xfs_trans *tp, struct xfs_inode *ip,
+ int whichfork, xfs_extnum_t *nextents,
+ xfs_filblks_t *count);
+diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
+index 61a5ad2600e8..259549698ba7 100644
+--- a/fs/xfs/xfs_file.c
++++ b/fs/xfs/xfs_file.c
+@@ -517,6 +517,9 @@ xfs_file_dio_aio_write(
+ }
+
+ if (iocb->ki_flags & IOCB_NOWAIT) {
++ /* unaligned dio always waits, bail */
++ if (unaligned_io)
++ return -EAGAIN;
+ if (!xfs_ilock_nowait(ip, iolock))
+ return -EAGAIN;
+ } else {
+@@ -529,18 +532,14 @@ xfs_file_dio_aio_write(
+ count = iov_iter_count(from);
+
+ /*
+- * If we are doing unaligned IO, wait for all other IO to drain,
+- * otherwise demote the lock if we had to take the exclusive lock
+- * for other reasons in xfs_file_aio_write_checks.
++ * If we are doing unaligned IO, we can't allow any other overlapping IO
++ * in-flight at the same time or we risk data corruption. Wait for all
++ * other IO to drain before we submit. If the IO is aligned, demote the
++ * iolock if we had to take the exclusive lock in
++ * xfs_file_aio_write_checks() for other reasons.
+ */
+ if (unaligned_io) {
+- /* If we are going to wait for other DIO to finish, bail */
+- if (iocb->ki_flags & IOCB_NOWAIT) {
+- if (atomic_read(&inode->i_dio_count))
+- return -EAGAIN;
+- } else {
+- inode_dio_wait(inode);
+- }
++ inode_dio_wait(inode);
+ } else if (iolock == XFS_IOLOCK_EXCL) {
+ xfs_ilock_demote(ip, XFS_IOLOCK_EXCL);
+ iolock = XFS_IOLOCK_SHARED;
+@@ -548,6 +547,14 @@ xfs_file_dio_aio_write(
+
+ trace_xfs_file_direct_write(ip, count, iocb->ki_pos);
+ ret = iomap_dio_rw(iocb, from, &xfs_iomap_ops, xfs_dio_write_end_io);
++
++ /*
++ * If unaligned, this is the only IO in-flight. If it has not yet
++ * completed, wait on it before we release the iolock to prevent
++ * subsequent overlapping IO.
++ */
++ if (ret == -EIOCBQUEUED && unaligned_io)
++ inode_dio_wait(inode);
+ out:
+ xfs_iunlock(ip, iolock);
+
+diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
+index 7c00b8bedfe3..09fd602507ef 100644
+--- a/fs/xfs/xfs_fsops.c
++++ b/fs/xfs/xfs_fsops.c
+@@ -534,6 +534,7 @@ xfs_fs_reserve_ag_blocks(
+ int error = 0;
+ int err2;
+
++ mp->m_finobt_nores = false;
+ for (agno = 0; agno < mp->m_sb.sb_agcount; agno++) {
+ pag = xfs_perag_get(mp, agno);
+ err2 = xfs_ag_resv_init(pag, NULL);
+diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
+index 05db9540e459..5ed84d6c7059 100644
+--- a/fs/xfs/xfs_inode.c
++++ b/fs/xfs/xfs_inode.c
+@@ -1332,7 +1332,7 @@ xfs_create_tmpfile(
+ if (error)
+ goto out_trans_cancel;
+
+- error = xfs_dir_ialloc(&tp, dp, mode, 1, 0, prid, &ip);
++ error = xfs_dir_ialloc(&tp, dp, mode, 0, 0, prid, &ip);
+ if (error)
+ goto out_trans_cancel;
+
+@@ -1754,7 +1754,7 @@ xfs_inactive_ifree(
+ * now remains allocated and sits on the unlinked list until the fs is
+ * repaired.
+ */
+- if (unlikely(mp->m_inotbt_nores)) {
++ if (unlikely(mp->m_finobt_nores)) {
+ error = xfs_trans_alloc(mp, &M_RES(mp)->tr_ifree,
+ XFS_IFREE_SPACE_RES(mp), 0, XFS_TRANS_RESERVE,
+ &tp);
+@@ -1907,11 +1907,8 @@ xfs_inactive(
+ }
+
+ /*
+- * This is called when the inode's link count goes to 0 or we are creating a
+- * tmpfile via O_TMPFILE. In the case of a tmpfile, @ignore_linkcount will be
+- * set to true as the link count is dropped to zero by the VFS after we've
+- * created the file successfully, so we have to add it to the unlinked list
+- * while the link count is non-zero.
++ * This is called when the inode's link count has gone to 0 or we are creating
++ * a tmpfile via O_TMPFILE. The inode @ip must have nlink == 0.
+ *
+ * We place the on-disk inode on a list in the AGI. It will be pulled from this
+ * list when the inode is freed.
+@@ -1931,6 +1928,7 @@ xfs_iunlink(
+ int offset;
+ int error;
+
++ ASSERT(VFS_I(ip)->i_nlink == 0);
+ ASSERT(VFS_I(ip)->i_mode != 0);
+
+ /*
+@@ -2837,11 +2835,9 @@ xfs_rename_alloc_whiteout(
+
+ /*
+ * Prepare the tmpfile inode as if it were created through the VFS.
+- * Otherwise, the link increment paths will complain about nlink 0->1.
+- * Drop the link count as done by d_tmpfile(), complete the inode setup
+- * and flag it as linkable.
++ * Complete the inode setup and flag it as linkable. nlink is already
++ * zero, so we can skip the drop_nlink.
+ */
+- drop_nlink(VFS_I(tmpfile));
+ xfs_setup_iops(tmpfile);
+ xfs_finish_inode_setup(tmpfile);
+ VFS_I(tmpfile)->i_state |= I_LINKABLE;
+diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
+index f48ffd7a8d3e..74047bd0c1ae 100644
+--- a/fs/xfs/xfs_iops.c
++++ b/fs/xfs/xfs_iops.c
+@@ -191,9 +191,18 @@ xfs_generic_create(
+
+ xfs_setup_iops(ip);
+
+- if (tmpfile)
++ if (tmpfile) {
++ /*
++ * The VFS requires that any inode fed to d_tmpfile must have
++ * nlink == 1 so that it can decrement the nlink in d_tmpfile.
++ * However, we created the temp file with nlink == 0 because
++ * we're not allowed to put an inode with nlink > 0 on the
++ * unlinked list. Therefore we have to set nlink to 1 so that
++ * d_tmpfile can immediately set it back to zero.
++ */
++ set_nlink(inode, 1);
+ d_tmpfile(dentry, inode);
+- else
++ } else
+ d_instantiate(dentry, inode);
+
+ xfs_finish_inode_setup(ip);
+@@ -522,6 +531,10 @@ xfs_vn_getattr(
+ }
+ }
+
++ /*
++ * Note: If you add another clause to set an attribute flag, please
++ * update attributes_mask below.
++ */
+ if (ip->i_d.di_flags & XFS_DIFLAG_IMMUTABLE)
+ stat->attributes |= STATX_ATTR_IMMUTABLE;
+ if (ip->i_d.di_flags & XFS_DIFLAG_APPEND)
+@@ -529,6 +542,10 @@ xfs_vn_getattr(
+ if (ip->i_d.di_flags & XFS_DIFLAG_NODUMP)
+ stat->attributes |= STATX_ATTR_NODUMP;
+
++ stat->attributes_mask |= (STATX_ATTR_IMMUTABLE |
++ STATX_ATTR_APPEND |
++ STATX_ATTR_NODUMP);
++
+ switch (inode->i_mode & S_IFMT) {
+ case S_IFBLK:
+ case S_IFCHR:
+diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
+index 7964513c3128..7e0bf952e087 100644
+--- a/fs/xfs/xfs_mount.h
++++ b/fs/xfs/xfs_mount.h
+@@ -127,7 +127,7 @@ typedef struct xfs_mount {
+ struct mutex m_growlock; /* growfs mutex */
+ int m_fixedfsid[2]; /* unchanged for life of FS */
+ uint64_t m_flags; /* global mount flags */
+- bool m_inotbt_nores; /* no per-AG finobt resv. */
++ bool m_finobt_nores; /* no per-AG finobt resv. */
+ int m_ialloc_inos; /* inodes in inode allocation */
+ int m_ialloc_blks; /* blocks in inode allocation */
+ int m_ialloc_min_blks;/* min blocks in sparse inode
+diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
+index 7088f44c0c59..f3c393f309e1 100644
+--- a/fs/xfs/xfs_reflink.c
++++ b/fs/xfs/xfs_reflink.c
+@@ -1368,9 +1368,19 @@ xfs_reflink_remap_prep(
+ if (ret)
+ goto out_unlock;
+
+- /* Zap any page cache for the destination file's range. */
+- truncate_inode_pages_range(&inode_out->i_data, pos_out,
+- PAGE_ALIGN(pos_out + *len) - 1);
++ /*
++ * If pos_out > EOF, we may have dirtied blocks between EOF and
++ * pos_out. In that case, we need to extend the flush and unmap to cover
++ * from EOF to the end of the copy length.
++ */
++ if (pos_out > XFS_ISIZE(dest)) {
++ loff_t flen = *len + (pos_out - XFS_ISIZE(dest));
++ ret = xfs_flush_unmap_range(dest, XFS_ISIZE(dest), flen);
++ } else {
++ ret = xfs_flush_unmap_range(dest, pos_out, *len);
++ }
++ if (ret)
++ goto out_unlock;
+
+ /* If we're altering the file contents... */
+ if (!is_dedupe) {
+diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
+index 207ee302b1bb..dce8114e3198 100644
+--- a/fs/xfs/xfs_super.c
++++ b/fs/xfs/xfs_super.c
+@@ -1561,6 +1561,13 @@ xfs_mount_alloc(
+ INIT_DELAYED_WORK(&mp->m_eofblocks_work, xfs_eofblocks_worker);
+ INIT_DELAYED_WORK(&mp->m_cowblocks_work, xfs_cowblocks_worker);
+ mp->m_kobj.kobject.kset = xfs_kset;
++ /*
++ * We don't create the finobt per-ag space reservation until after log
++ * recovery, so we must set this to true so that an ifree transaction
++ * started during log recovery will not depend on space reservations
++ * for finobt expansion.
++ */
++ mp->m_finobt_nores = true;
+ return mp;
+ }
+
+diff --git a/fs/xfs/xfs_xattr.c b/fs/xfs/xfs_xattr.c
+index 63ee1d5bf1d7..9a63016009a1 100644
+--- a/fs/xfs/xfs_xattr.c
++++ b/fs/xfs/xfs_xattr.c
+@@ -129,6 +129,9 @@ __xfs_xattr_put_listent(
+ char *offset;
+ int arraytop;
+
++ if (context->count < 0 || context->seen_enough)
++ return;
++
+ if (!context->alist)
+ goto compute_size;
+
+diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
+index 20561a60db9c..d4fb510a4fbe 100644
+--- a/include/asm-generic/bug.h
++++ b/include/asm-generic/bug.h
+@@ -104,8 +104,10 @@ extern void warn_slowpath_null(const char *file, const int line);
+ warn_slowpath_fmt_taint(__FILE__, __LINE__, taint, arg)
+ #else
+ extern __printf(1, 2) void __warn_printk(const char *fmt, ...);
+-#define __WARN() __WARN_TAINT(TAINT_WARN)
+-#define __WARN_printf(arg...) do { __warn_printk(arg); __WARN(); } while (0)
++#define __WARN() do { \
++ printk(KERN_WARNING CUT_HERE); __WARN_TAINT(TAINT_WARN); \
++} while (0)
++#define __WARN_printf(arg...) __WARN_printf_taint(TAINT_WARN, arg)
+ #define __WARN_printf_taint(taint, arg...) \
+ do { __warn_printk(arg); __WARN_TAINT(taint); } while (0)
+ #endif
+diff --git a/include/drm/drm_displayid.h b/include/drm/drm_displayid.h
+index c0d4df6a606f..9d3b745c3107 100644
+--- a/include/drm/drm_displayid.h
++++ b/include/drm/drm_displayid.h
+@@ -40,6 +40,7 @@
+ #define DATA_BLOCK_DISPLAY_INTERFACE 0x0f
+ #define DATA_BLOCK_STEREO_DISPLAY_INTERFACE 0x10
+ #define DATA_BLOCK_TILED_DISPLAY 0x12
++#define DATA_BLOCK_CTA 0x81
+
+ #define DATA_BLOCK_VENDOR_SPECIFIC 0x7f
+
+@@ -90,4 +91,13 @@ struct displayid_detailed_timing_block {
+ struct displayid_block base;
+ struct displayid_detailed_timings_1 timings[0];
+ };
++
++#define for_each_displayid_db(displayid, block, idx, length) \
++ for ((block) = (struct displayid_block *)&(displayid)[idx]; \
++ (idx) + sizeof(struct displayid_block) <= (length) && \
++ (idx) + sizeof(struct displayid_block) + (block)->num_bytes <= (length) && \
++ (block)->num_bytes > 0; \
++ (idx) += (block)->num_bytes + sizeof(struct displayid_block), \
++ (block) = (struct displayid_block *)&(displayid)[idx])
++
+ #endif
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index dec0372efe2e..d67c0035165c 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -116,10 +116,10 @@ enum cpuhp_state {
+ CPUHP_AP_PERF_ARM_ACPI_STARTING,
+ CPUHP_AP_PERF_ARM_STARTING,
+ CPUHP_AP_ARM_L2X0_STARTING,
++ CPUHP_AP_EXYNOS4_MCT_TIMER_STARTING,
+ CPUHP_AP_ARM_ARCH_TIMER_STARTING,
+ CPUHP_AP_ARM_GLOBAL_TIMER_STARTING,
+ CPUHP_AP_JCORE_TIMER_STARTING,
+- CPUHP_AP_EXYNOS4_MCT_TIMER_STARTING,
+ CPUHP_AP_ARM_TWD_STARTING,
+ CPUHP_AP_QCOM_TIMER_STARTING,
+ CPUHP_AP_ARMADA_TIMER_STARTING,
+diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
+index e102c5bccbb9..68cbe111420b 100644
+--- a/include/linux/rcupdate.h
++++ b/include/linux/rcupdate.h
+@@ -620,7 +620,7 @@ static inline void rcu_preempt_sleep_check(void) { }
+ * read-side critical sections may be preempted and they may also block, but
+ * only when acquiring spinlocks that are subject to priority inheritance.
+ */
+-static inline void rcu_read_lock(void)
++static __always_inline void rcu_read_lock(void)
+ {
+ __rcu_read_lock();
+ __acquire(RCU);
+diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
+index a0d2e0bb9a94..0e3c0d83bd99 100644
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -806,11 +806,12 @@ struct ipvs_master_sync_state {
+ struct ip_vs_sync_buff *sync_buff;
+ unsigned long sync_queue_len;
+ unsigned int sync_queue_delay;
+- struct task_struct *master_thread;
+ struct delayed_work master_wakeup_work;
+ struct netns_ipvs *ipvs;
+ };
+
++struct ip_vs_sync_thread_data;
++
+ /* How much time to keep dests in trash */
+ #define IP_VS_DEST_TRASH_PERIOD (120 * HZ)
+
+@@ -941,7 +942,8 @@ struct netns_ipvs {
+ spinlock_t sync_lock;
+ struct ipvs_master_sync_state *ms;
+ spinlock_t sync_buff_lock;
+- struct task_struct **backup_threads;
++ struct ip_vs_sync_thread_data *master_tinfo;
++ struct ip_vs_sync_thread_data *backup_tinfo;
+ int threads_mask;
+ volatile int sync_state;
+ struct mutex sync_mutex;
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index ec299fcf55f7..412c2820626d 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -290,8 +290,8 @@ struct ib_rss_caps {
+ };
+
+ enum ib_tm_cap_flags {
+- /* Support tag matching on RC transport */
+- IB_TM_CAP_RC = 1 << 0,
++ /* Support tag matching with rendezvous offload for RC transport */
++ IB_TM_CAP_RNDV_RC = 1 << 0,
+ };
+
+ struct ib_tm_caps {
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index 6d182746afab..147546e0c11b 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -1381,7 +1381,7 @@ TRACE_EVENT(rxrpc_rx_eproto,
+ ),
+
+ TP_fast_assign(
+- __entry->call = call->debug_id;
++ __entry->call = call ? call->debug_id : 0;
+ __entry->serial = serial;
+ __entry->why = why;
+ ),
+diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
+index 2932600ce271..d143e277cdaf 100644
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -2486,6 +2486,7 @@ struct bpf_prog_info {
+ char name[BPF_OBJ_NAME_LEN];
+ __u32 ifindex;
+ __u32 gpl_compatible:1;
++ __u32 :31; /* alignment pad */
+ __u64 netns_dev;
+ __u64 netns_ino;
+ __u32 nr_jited_ksyms;
+diff --git a/include/xen/events.h b/include/xen/events.h
+index c3e6bc643a7b..1650d39decae 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -3,6 +3,7 @@
+ #define _XEN_EVENTS_H
+
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
+ #ifdef CONFIG_PCI_MSI
+ #include <linux/msi.h>
+ #endif
+@@ -59,7 +60,7 @@ void evtchn_put(unsigned int evtchn);
+
+ void xen_send_IPI_one(unsigned int cpu, enum ipi_vector vector);
+ void rebind_evtchn_irq(int evtchn, int irq);
+-int xen_rebind_evtchn_to_cpu(int evtchn, unsigned tcpu);
++int xen_set_affinity_evtchn(struct irq_desc *desc, unsigned int tcpu);
+
+ static inline void notify_remote_via_evtchn(int port)
+ {
+diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile
+index 0488b8258321..ffc39a7e028d 100644
+--- a/kernel/bpf/Makefile
++++ b/kernel/bpf/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-y := core.o
++CFLAGS_core.o += $(call cc-disable-warning, override-init)
+
+ obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o
+ obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 26b57e24476f..e810e8cb17e1 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -3326,17 +3326,17 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
+ if (depth) {
+ hlock = curr->held_locks + depth - 1;
+ if (hlock->class_idx == class_idx && nest_lock) {
+- if (hlock->references) {
+- /*
+- * Check: unsigned int references:12, overflow.
+- */
+- if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 << 12)-1))
+- return 0;
++ if (!references)
++ references++;
+
++ if (!hlock->references)
+ hlock->references++;
+- } else {
+- hlock->references = 2;
+- }
++
++ hlock->references += references;
++
++ /* Overflow */
++ if (DEBUG_LOCKS_WARN_ON(hlock->references < references))
++ return 0;
+
+ return 1;
+ }
+diff --git a/kernel/padata.c b/kernel/padata.c
+index d568cc56405f..6c06b3039fae 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -267,7 +267,12 @@ static void padata_reorder(struct parallel_data *pd)
+ * The next object that needs serialization might have arrived to
+ * the reorder queues in the meantime, we will be called again
+ * from the timer function if no one else cares for it.
++ *
++ * Ensure reorder_objects is read after pd->lock is dropped so we see
++ * an increment from another task in padata_do_serial. Pairs with
++ * smp_mb__after_atomic in padata_do_serial.
+ */
++ smp_mb();
+ if (atomic_read(&pd->reorder_objects)
+ && !(pinst->flags & PADATA_RESET))
+ mod_timer(&pd->timer, jiffies + HZ);
+@@ -387,6 +392,13 @@ void padata_do_serial(struct padata_priv *padata)
+ list_add_tail(&padata->list, &pqueue->reorder.list);
+ spin_unlock(&pqueue->reorder.lock);
+
++ /*
++ * Ensure the atomic_inc of reorder_objects above is ordered correctly
++ * with the trylock of pd->lock in padata_reorder. Pairs with smp_mb
++ * in padata_reorder.
++ */
++ smp_mb__after_atomic();
++
+ put_cpu();
+
+ /* If we're running on the wrong CPU, call padata_reorder() via a
+diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
+index 2a2ac53d8b8b..95271f180687 100644
+--- a/kernel/pid_namespace.c
++++ b/kernel/pid_namespace.c
+@@ -325,7 +325,7 @@ int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd)
+ }
+
+ read_lock(&tasklist_lock);
+- force_sig(SIGKILL, pid_ns->child_reaper);
++ send_sig(SIGKILL, pid_ns->child_reaper, 1);
+ read_unlock(&tasklist_lock);
+
+ do_exit(0);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 6859ea1d5c04..795c63ca44a9 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5133,7 +5133,7 @@ long __sched io_schedule_timeout(long timeout)
+ }
+ EXPORT_SYMBOL(io_schedule_timeout);
+
+-void io_schedule(void)
++void __sched io_schedule(void)
+ {
+ int token;
+
+diff --git a/kernel/sched/sched-pelt.h b/kernel/sched/sched-pelt.h
+index a26473674fb7..c529706bed11 100644
+--- a/kernel/sched/sched-pelt.h
++++ b/kernel/sched/sched-pelt.h
+@@ -1,7 +1,7 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+ /* Generated by Documentation/scheduler/sched-pelt; do not modify. */
+
+-static const u32 runnable_avg_yN_inv[] = {
++static const u32 runnable_avg_yN_inv[] __maybe_unused = {
+ 0xffffffff, 0xfa83b2da, 0xf5257d14, 0xefe4b99a, 0xeac0c6e6, 0xe5b906e6,
+ 0xe0ccdeeb, 0xdbfbb796, 0xd744fcc9, 0xd2a81d91, 0xce248c14, 0xc9b9bd85,
+ 0xc5672a10, 0xc12c4cc9, 0xbd08a39e, 0xb8fbaf46, 0xb504f333, 0xb123f581,
+diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
+index 6b23cd584295..e1110a7bd3e6 100644
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -43,6 +43,7 @@ static u64 tick_length_base;
+ #define MAX_TICKADJ 500LL /* usecs */
+ #define MAX_TICKADJ_SCALED \
+ (((MAX_TICKADJ * NSEC_PER_USEC) << NTP_SCALE_SHIFT) / NTP_INTERVAL_FREQ)
++#define MAX_TAI_OFFSET 100000
+
+ /*
+ * phase-lock loop variables
+@@ -698,7 +699,8 @@ static inline void process_adjtimex_modes(const struct timex *txc, s32 *time_tai
+ time_constant = max(time_constant, 0l);
+ }
+
+- if (txc->modes & ADJ_TAI && txc->constant >= 0)
++ if (txc->modes & ADJ_TAI &&
++ txc->constant >= 0 && txc->constant <= MAX_TAI_OFFSET)
+ *time_tai = txc->constant;
+
+ if (txc->modes & ADJ_OFFSET)
+diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
+index d647dabdac97..07afcfe2a61b 100644
+--- a/kernel/time/timer_list.c
++++ b/kernel/time/timer_list.c
+@@ -287,23 +287,6 @@ static inline void timer_list_header(struct seq_file *m, u64 now)
+ SEQ_printf(m, "\n");
+ }
+
+-static int timer_list_show(struct seq_file *m, void *v)
+-{
+- struct timer_list_iter *iter = v;
+-
+- if (iter->cpu == -1 && !iter->second_pass)
+- timer_list_header(m, iter->now);
+- else if (!iter->second_pass)
+- print_cpu(m, iter->cpu, iter->now);
+-#ifdef CONFIG_GENERIC_CLOCKEVENTS
+- else if (iter->cpu == -1 && iter->second_pass)
+- timer_list_show_tickdevices_header(m);
+- else
+- print_tickdevice(m, tick_get_device(iter->cpu), iter->cpu);
+-#endif
+- return 0;
+-}
+-
+ void sysrq_timer_list_show(void)
+ {
+ u64 now = ktime_to_ns(ktime_get());
+@@ -322,6 +305,24 @@ void sysrq_timer_list_show(void)
+ return;
+ }
+
++#ifdef CONFIG_PROC_FS
++static int timer_list_show(struct seq_file *m, void *v)
++{
++ struct timer_list_iter *iter = v;
++
++ if (iter->cpu == -1 && !iter->second_pass)
++ timer_list_header(m, iter->now);
++ else if (!iter->second_pass)
++ print_cpu(m, iter->cpu, iter->now);
++#ifdef CONFIG_GENERIC_CLOCKEVENTS
++ else if (iter->cpu == -1 && iter->second_pass)
++ timer_list_show_tickdevices_header(m);
++ else
++ print_tickdevice(m, tick_get_device(iter->cpu), iter->cpu);
++#endif
++ return 0;
++}
++
+ static void *move_iter(struct timer_list_iter *iter, loff_t offset)
+ {
+ for (; offset; offset--) {
+@@ -381,3 +382,4 @@ static int __init init_timer_list_procfs(void)
+ return 0;
+ }
+ __initcall(init_timer_list_procfs);
++#endif
+diff --git a/lib/reed_solomon/decode_rs.c b/lib/reed_solomon/decode_rs.c
+index 1db74eb098d0..121beb2f0930 100644
+--- a/lib/reed_solomon/decode_rs.c
++++ b/lib/reed_solomon/decode_rs.c
+@@ -42,8 +42,18 @@
+ BUG_ON(pad < 0 || pad >= nn);
+
+ /* Does the caller provide the syndrome ? */
+- if (s != NULL)
+- goto decode;
++ if (s != NULL) {
++ for (i = 0; i < nroots; i++) {
++ /* The syndrome is in index form,
++ * so nn represents zero
++ */
++ if (s[i] != nn)
++ goto decode;
++ }
++
++ /* syndrome is zero, no errors to correct */
++ return 0;
++ }
+
+ /* form the syndromes; i.e., evaluate data(x) at roots of
+ * g(x) */
+@@ -99,9 +109,9 @@
+ if (no_eras > 0) {
+ /* Init lambda to be the erasure locator polynomial */
+ lambda[1] = alpha_to[rs_modnn(rs,
+- prim * (nn - 1 - eras_pos[0]))];
++ prim * (nn - 1 - (eras_pos[0] + pad)))];
+ for (i = 1; i < no_eras; i++) {
+- u = rs_modnn(rs, prim * (nn - 1 - eras_pos[i]));
++ u = rs_modnn(rs, prim * (nn - 1 - (eras_pos[i] + pad)));
+ for (j = i + 1; j > 0; j--) {
+ tmp = index_of[lambda[j - 1]];
+ if (tmp != nn) {
+diff --git a/lib/scatterlist.c b/lib/scatterlist.c
+index 7c6096a71704..8c3036c37ba0 100644
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -652,17 +652,18 @@ static bool sg_miter_get_next_page(struct sg_mapping_iter *miter)
+ {
+ if (!miter->__remaining) {
+ struct scatterlist *sg;
+- unsigned long pgoffset;
+
+ if (!__sg_page_iter_next(&miter->piter))
+ return false;
+
+ sg = miter->piter.sg;
+- pgoffset = miter->piter.sg_pgoffset;
+
+- miter->__offset = pgoffset ? 0 : sg->offset;
++ miter->__offset = miter->piter.sg_pgoffset ? 0 : sg->offset;
++ miter->piter.sg_pgoffset += miter->__offset >> PAGE_SHIFT;
++ miter->__offset &= PAGE_SIZE - 1;
+ miter->__remaining = sg->offset + sg->length -
+- (pgoffset << PAGE_SHIFT) - miter->__offset;
++ (miter->piter.sg_pgoffset << PAGE_SHIFT) -
++ miter->__offset;
+ miter->__remaining = min_t(unsigned long, miter->__remaining,
+ PAGE_SIZE - miter->__offset);
+ }
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index eb596c2ed546..849336211c79 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -782,10 +782,16 @@ static struct p9_trans_module p9_virtio_trans = {
+ /* The standard init function */
+ static int __init p9_virtio_init(void)
+ {
++ int rc;
++
+ INIT_LIST_HEAD(&virtio_chan_list);
+
+ v9fs_register_trans(&p9_virtio_trans);
+- return register_virtio_driver(&p9_virtio_drv);
++ rc = register_virtio_driver(&p9_virtio_drv);
++ if (rc)
++ v9fs_unregister_trans(&p9_virtio_trans);
++
++ return rc;
+ }
+
+ static void __exit p9_virtio_cleanup(void)
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index e2fbf3677b9b..9daab0dd833b 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -530,13 +530,19 @@ static struct xenbus_driver xen_9pfs_front_driver = {
+
+ static int p9_trans_xen_init(void)
+ {
++ int rc;
++
+ if (!xen_domain())
+ return -ENODEV;
+
+ pr_info("Initialising Xen transport for 9pfs\n");
+
+ v9fs_register_trans(&p9_xen_trans);
+- return xenbus_register_frontend(&xen_9pfs_front_driver);
++ rc = xenbus_register_frontend(&xen_9pfs_front_driver);
++ if (rc)
++ v9fs_unregister_trans(&p9_xen_trans);
++
++ return rc;
+ }
+ module_init(p9_trans_xen_init);
+
+diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
+index 73bf6a93a3cf..0b7b36fa0d5c 100644
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -2485,7 +2485,7 @@ batadv_iv_ogm_neigh_is_sob(struct batadv_neigh_node *neigh1,
+ return ret;
+ }
+
+-static void batadv_iv_iface_activate(struct batadv_hard_iface *hard_iface)
++static void batadv_iv_iface_enabled(struct batadv_hard_iface *hard_iface)
+ {
+ /* begin scheduling originator messages on that interface */
+ batadv_iv_ogm_schedule(hard_iface);
+@@ -2825,8 +2825,8 @@ unlock:
+ static struct batadv_algo_ops batadv_batman_iv __read_mostly = {
+ .name = "BATMAN_IV",
+ .iface = {
+- .activate = batadv_iv_iface_activate,
+ .enable = batadv_iv_ogm_iface_enable,
++ .enabled = batadv_iv_iface_enabled,
+ .disable = batadv_iv_ogm_iface_disable,
+ .update_mac = batadv_iv_ogm_iface_update_mac,
+ .primary_set = batadv_iv_ogm_primary_iface_set,
+diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
+index 08690d06b7be..36f0962040d1 100644
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -821,6 +821,9 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface,
+
+ batadv_hardif_recalc_extra_skbroom(soft_iface);
+
++ if (bat_priv->algo_ops->iface.enabled)
++ bat_priv->algo_ops->iface.enabled(hard_iface);
++
+ out:
+ return 0;
+
+diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
+index 359ec1a6e822..9fa5389ea244 100644
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -3821,6 +3821,8 @@ static void batadv_tt_purge(struct work_struct *work)
+ */
+ void batadv_tt_free(struct batadv_priv *bat_priv)
+ {
++ batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_ROAM, 1);
++
+ batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_TT, 1);
+ batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_TT, 1);
+
+diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
+index eeee3e61c625..fdba8a144d73 100644
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -2130,6 +2130,9 @@ struct batadv_algo_iface_ops {
+ /** @enable: init routing info when hard-interface is enabled */
+ int (*enable)(struct batadv_hard_iface *hard_iface);
+
++ /** @enabled: notification when hard-interface was enabled (optional) */
++ void (*enabled)(struct batadv_hard_iface *hard_iface);
++
+ /** @disable: de-init routing info when hard-interface is disabled */
+ void (*disable)(struct batadv_hard_iface *hard_iface);
+
+diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
+index 4e2576fc0c59..357475cceec6 100644
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -187,10 +187,16 @@ static inline struct lowpan_peer *peer_lookup_dst(struct lowpan_btle_dev *dev,
+ }
+
+ if (!rt) {
+- nexthop = &lowpan_cb(skb)->gw;
+-
+- if (ipv6_addr_any(nexthop))
+- return NULL;
++ if (ipv6_addr_any(&lowpan_cb(skb)->gw)) {
++ /* There is neither route nor gateway,
++ * probably the destination is a direct peer.
++ */
++ nexthop = daddr;
++ } else {
++ /* There is a known gateway
++ */
++ nexthop = &lowpan_cb(skb)->gw;
++ }
+ } else {
+ nexthop = rt6_nexthop(rt, daddr);
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 3e7badb3ac2d..0adcddb211fa 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -5545,6 +5545,11 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
+ return send_conn_param_neg_reply(hdev, handle,
+ HCI_ERROR_UNKNOWN_CONN_ID);
+
++ if (min < hcon->le_conn_min_interval ||
++ max > hcon->le_conn_max_interval)
++ return send_conn_param_neg_reply(hdev, handle,
++ HCI_ERROR_INVALID_LL_PARAMS);
++
+ if (hci_check_conn_params(min, max, latency, timeout))
+ return send_conn_param_neg_reply(hdev, handle,
+ HCI_ERROR_INVALID_LL_PARAMS);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 879d5432bf77..a54dadf4a6ca 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -4384,6 +4384,12 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
+
+ l2cap_chan_lock(chan);
+
++ if (chan->state != BT_DISCONN) {
++ l2cap_chan_unlock(chan);
++ mutex_unlock(&conn->chan_lock);
++ return 0;
++ }
++
+ l2cap_chan_hold(chan);
+ l2cap_chan_del(chan, 0);
+
+@@ -5281,7 +5287,14 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
+
+ memset(&rsp, 0, sizeof(rsp));
+
+- err = hci_check_conn_params(min, max, latency, to_multiplier);
++ if (min < hcon->le_conn_min_interval ||
++ max > hcon->le_conn_max_interval) {
++ BT_DBG("requested connection interval exceeds current bounds.");
++ err = -EINVAL;
++ } else {
++ err = hci_check_conn_params(min, max, latency, to_multiplier);
++ }
++
+ if (err)
+ rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
+ else
+diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
+index a1c1b7e8a45c..cc2f7ca91ccd 100644
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -2580,6 +2580,19 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
+ goto distribute;
+ }
+
++ /* Drop IRK if peer is using identity address during pairing but is
++ * providing different address as identity information.
++ *
++ * Microsoft Surface Precision Mouse is known to have this bug.
++ */
++ if (hci_is_identity_address(&hcon->dst, hcon->dst_type) &&
++ (bacmp(&info->bdaddr, &hcon->dst) ||
++ info->addr_type != hcon->dst_type)) {
++ bt_dev_err(hcon->hdev,
++ "ignoring IRK with invalid identity address");
++ goto distribute;
++ }
++
+ bacpy(&smp->id_addr, &info->bdaddr);
+ smp->id_addr_type = info->addr_type;
+
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 0b79c9aa8eb1..1982f9f31deb 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2442,8 +2442,10 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
+ goto out;
+ }
+ err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
+- if (err < 0)
++ if (err < 0) {
++ kfree_skb(out_skb);
+ goto out;
++ }
+
+ out_hdr = (struct sadb_msg *) out_skb->data;
+ out_hdr->sadb_msg_version = hdr->sadb_msg_version;
+@@ -2694,8 +2696,10 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
+ return PTR_ERR(out_skb);
+
+ err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
+- if (err < 0)
++ if (err < 0) {
++ kfree_skb(out_skb);
+ return err;
++ }
+
+ out_hdr = (struct sadb_msg *) out_skb->data;
+ out_hdr->sadb_msg_version = pfk->dump.msg_version;
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index 8a33dac4e805..ddfe06d7530b 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -625,7 +625,7 @@ retry:
+ goto cleanup;
+ }
+ m->size = AHASH_INIT_SIZE;
+- extsize = ext_size(AHASH_INIT_SIZE, dsize);
++ extsize += ext_size(AHASH_INIT_SIZE, dsize);
+ RCU_INIT_POINTER(hbucket(t, key), m);
+ } else if (m->pos >= m->size) {
+ struct hbucket *ht;
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index 62c0e80dcd71..a71f777d1353 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -2218,7 +2218,6 @@ static const struct nf_hook_ops ip_vs_ops[] = {
+ static int __net_init __ip_vs_init(struct net *net)
+ {
+ struct netns_ipvs *ipvs;
+- int ret;
+
+ ipvs = net_generic(net, ip_vs_net_id);
+ if (ipvs == NULL)
+@@ -2250,17 +2249,11 @@ static int __net_init __ip_vs_init(struct net *net)
+ if (ip_vs_sync_net_init(ipvs) < 0)
+ goto sync_fail;
+
+- ret = nf_register_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+- if (ret < 0)
+- goto hook_fail;
+-
+ return 0;
+ /*
+ * Error handling
+ */
+
+-hook_fail:
+- ip_vs_sync_net_cleanup(ipvs);
+ sync_fail:
+ ip_vs_conn_net_cleanup(ipvs);
+ conn_fail:
+@@ -2290,6 +2283,19 @@ static void __net_exit __ip_vs_cleanup(struct net *net)
+ net->ipvs = NULL;
+ }
+
++static int __net_init __ip_vs_dev_init(struct net *net)
++{
++ int ret;
++
++ ret = nf_register_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
++ if (ret < 0)
++ goto hook_fail;
++ return 0;
++
++hook_fail:
++ return ret;
++}
++
+ static void __net_exit __ip_vs_dev_cleanup(struct net *net)
+ {
+ struct netns_ipvs *ipvs = net_ipvs(net);
+@@ -2309,6 +2315,7 @@ static struct pernet_operations ipvs_core_ops = {
+ };
+
+ static struct pernet_operations ipvs_core_dev_ops = {
++ .init = __ip_vs_dev_init,
+ .exit = __ip_vs_dev_cleanup,
+ };
+
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 2d4e048762f6..3df94a499126 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -2382,9 +2382,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+ cfg.syncid = dm->syncid;
+ ret = start_sync_thread(ipvs, &cfg, dm->state);
+ } else {
+- mutex_lock(&ipvs->sync_mutex);
+ ret = stop_sync_thread(ipvs, dm->state);
+- mutex_unlock(&ipvs->sync_mutex);
+ }
+ goto out_dec;
+ }
+@@ -3492,10 +3490,8 @@ static int ip_vs_genl_del_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs)
+ if (!attrs[IPVS_DAEMON_ATTR_STATE])
+ return -EINVAL;
+
+- mutex_lock(&ipvs->sync_mutex);
+ ret = stop_sync_thread(ipvs,
+ nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
+- mutex_unlock(&ipvs->sync_mutex);
+ return ret;
+ }
+
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index d4020c5e831d..ecb71062fcb3 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -195,6 +195,7 @@ union ip_vs_sync_conn {
+ #define IPVS_OPT_F_PARAM (1 << (IPVS_OPT_PARAM-1))
+
+ struct ip_vs_sync_thread_data {
++ struct task_struct *task;
+ struct netns_ipvs *ipvs;
+ struct socket *sock;
+ char *buf;
+@@ -374,8 +375,11 @@ static inline void sb_queue_tail(struct netns_ipvs *ipvs,
+ max(IPVS_SYNC_SEND_DELAY, 1));
+ ms->sync_queue_len++;
+ list_add_tail(&sb->list, &ms->sync_queue);
+- if ((++ms->sync_queue_delay) == IPVS_SYNC_WAKEUP_RATE)
+- wake_up_process(ms->master_thread);
++ if ((++ms->sync_queue_delay) == IPVS_SYNC_WAKEUP_RATE) {
++ int id = (int)(ms - ipvs->ms);
++
++ wake_up_process(ipvs->master_tinfo[id].task);
++ }
+ } else
+ ip_vs_sync_buff_release(sb);
+ spin_unlock(&ipvs->sync_lock);
+@@ -1636,8 +1640,10 @@ static void master_wakeup_work_handler(struct work_struct *work)
+ spin_lock_bh(&ipvs->sync_lock);
+ if (ms->sync_queue_len &&
+ ms->sync_queue_delay < IPVS_SYNC_WAKEUP_RATE) {
++ int id = (int)(ms - ipvs->ms);
++
+ ms->sync_queue_delay = IPVS_SYNC_WAKEUP_RATE;
+- wake_up_process(ms->master_thread);
++ wake_up_process(ipvs->master_tinfo[id].task);
+ }
+ spin_unlock_bh(&ipvs->sync_lock);
+ }
+@@ -1703,10 +1709,6 @@ done:
+ if (sb)
+ ip_vs_sync_buff_release(sb);
+
+- /* release the sending multicast socket */
+- sock_release(tinfo->sock);
+- kfree(tinfo);
+-
+ return 0;
+ }
+
+@@ -1740,11 +1742,6 @@ static int sync_thread_backup(void *data)
+ }
+ }
+
+- /* release the sending multicast socket */
+- sock_release(tinfo->sock);
+- kfree(tinfo->buf);
+- kfree(tinfo);
+-
+ return 0;
+ }
+
+@@ -1752,8 +1749,8 @@ static int sync_thread_backup(void *data)
+ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+ int state)
+ {
+- struct ip_vs_sync_thread_data *tinfo = NULL;
+- struct task_struct **array = NULL, *task;
++ struct ip_vs_sync_thread_data *ti = NULL, *tinfo;
++ struct task_struct *task;
+ struct net_device *dev;
+ char *name;
+ int (*threadfn)(void *data);
+@@ -1822,7 +1819,7 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+ threadfn = sync_thread_master;
+ } else if (state == IP_VS_STATE_BACKUP) {
+ result = -EEXIST;
+- if (ipvs->backup_threads)
++ if (ipvs->backup_tinfo)
+ goto out_early;
+
+ ipvs->bcfg = *c;
+@@ -1849,28 +1846,22 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+ master_wakeup_work_handler);
+ ms->ipvs = ipvs;
+ }
+- } else {
+- array = kcalloc(count, sizeof(struct task_struct *),
+- GFP_KERNEL);
+- result = -ENOMEM;
+- if (!array)
+- goto out;
+ }
++ result = -ENOMEM;
++ ti = kcalloc(count, sizeof(struct ip_vs_sync_thread_data),
++ GFP_KERNEL);
++ if (!ti)
++ goto out;
+
+ for (id = 0; id < count; id++) {
+- result = -ENOMEM;
+- tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL);
+- if (!tinfo)
+- goto out;
++ tinfo = &ti[id];
+ tinfo->ipvs = ipvs;
+- tinfo->sock = NULL;
+ if (state == IP_VS_STATE_BACKUP) {
++ result = -ENOMEM;
+ tinfo->buf = kmalloc(ipvs->bcfg.sync_maxlen,
+ GFP_KERNEL);
+ if (!tinfo->buf)
+ goto out;
+- } else {
+- tinfo->buf = NULL;
+ }
+ tinfo->id = id;
+ if (state == IP_VS_STATE_MASTER)
+@@ -1885,17 +1876,15 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+ result = PTR_ERR(task);
+ goto out;
+ }
+- tinfo = NULL;
+- if (state == IP_VS_STATE_MASTER)
+- ipvs->ms[id].master_thread = task;
+- else
+- array[id] = task;
++ tinfo->task = task;
+ }
+
+ /* mark as active */
+
+- if (state == IP_VS_STATE_BACKUP)
+- ipvs->backup_threads = array;
++ if (state == IP_VS_STATE_MASTER)
++ ipvs->master_tinfo = ti;
++ else
++ ipvs->backup_tinfo = ti;
+ spin_lock_bh(&ipvs->sync_buff_lock);
+ ipvs->sync_state |= state;
+ spin_unlock_bh(&ipvs->sync_buff_lock);
+@@ -1910,29 +1899,31 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+
+ out:
+ /* We do not need RTNL lock anymore, release it here so that
+- * sock_release below and in the kthreads can use rtnl_lock
+- * to leave the mcast group.
++ * sock_release below can use rtnl_lock to leave the mcast group.
+ */
+ rtnl_unlock();
+- count = id;
+- while (count-- > 0) {
+- if (state == IP_VS_STATE_MASTER)
+- kthread_stop(ipvs->ms[count].master_thread);
+- else
+- kthread_stop(array[count]);
++ id = min(id, count - 1);
++ if (ti) {
++ for (tinfo = ti + id; tinfo >= ti; tinfo--) {
++ if (tinfo->task)
++ kthread_stop(tinfo->task);
++ }
+ }
+ if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) {
+ kfree(ipvs->ms);
+ ipvs->ms = NULL;
+ }
+ mutex_unlock(&ipvs->sync_mutex);
+- if (tinfo) {
+- if (tinfo->sock)
+- sock_release(tinfo->sock);
+- kfree(tinfo->buf);
+- kfree(tinfo);
++
++ /* No more mutexes, release socks */
++ if (ti) {
++ for (tinfo = ti + id; tinfo >= ti; tinfo--) {
++ if (tinfo->sock)
++ sock_release(tinfo->sock);
++ kfree(tinfo->buf);
++ }
++ kfree(ti);
+ }
+- kfree(array);
+ return result;
+
+ out_early:
+@@ -1944,15 +1935,18 @@ out_early:
+
+ int stop_sync_thread(struct netns_ipvs *ipvs, int state)
+ {
+- struct task_struct **array;
++ struct ip_vs_sync_thread_data *ti, *tinfo;
+ int id;
+ int retc = -EINVAL;
+
+ IP_VS_DBG(7, "%s(): pid %d\n", __func__, task_pid_nr(current));
+
++ mutex_lock(&ipvs->sync_mutex);
+ if (state == IP_VS_STATE_MASTER) {
++ retc = -ESRCH;
+ if (!ipvs->ms)
+- return -ESRCH;
++ goto err;
++ ti = ipvs->master_tinfo;
+
+ /*
+ * The lock synchronizes with sb_queue_tail(), so that we don't
+@@ -1971,38 +1965,56 @@ int stop_sync_thread(struct netns_ipvs *ipvs, int state)
+ struct ipvs_master_sync_state *ms = &ipvs->ms[id];
+ int ret;
+
++ tinfo = &ti[id];
+ pr_info("stopping master sync thread %d ...\n",
+- task_pid_nr(ms->master_thread));
++ task_pid_nr(tinfo->task));
+ cancel_delayed_work_sync(&ms->master_wakeup_work);
+- ret = kthread_stop(ms->master_thread);
++ ret = kthread_stop(tinfo->task);
+ if (retc >= 0)
+ retc = ret;
+ }
+ kfree(ipvs->ms);
+ ipvs->ms = NULL;
++ ipvs->master_tinfo = NULL;
+ } else if (state == IP_VS_STATE_BACKUP) {
+- if (!ipvs->backup_threads)
+- return -ESRCH;
++ retc = -ESRCH;
++ if (!ipvs->backup_tinfo)
++ goto err;
++ ti = ipvs->backup_tinfo;
+
+ ipvs->sync_state &= ~IP_VS_STATE_BACKUP;
+- array = ipvs->backup_threads;
+ retc = 0;
+ for (id = ipvs->threads_mask; id >= 0; id--) {
+ int ret;
+
++ tinfo = &ti[id];
+ pr_info("stopping backup sync thread %d ...\n",
+- task_pid_nr(array[id]));
+- ret = kthread_stop(array[id]);
++ task_pid_nr(tinfo->task));
++ ret = kthread_stop(tinfo->task);
+ if (retc >= 0)
+ retc = ret;
+ }
+- kfree(array);
+- ipvs->backup_threads = NULL;
++ ipvs->backup_tinfo = NULL;
++ } else {
++ goto err;
+ }
++ id = ipvs->threads_mask;
++ mutex_unlock(&ipvs->sync_mutex);
++
++ /* No more mutexes, release socks */
++ for (tinfo = ti + id; tinfo >= ti; tinfo--) {
++ if (tinfo->sock)
++ sock_release(tinfo->sock);
++ kfree(tinfo->buf);
++ }
++ kfree(ti);
+
+ /* decrease the module use count */
+ ip_vs_use_count_dec();
++ return retc;
+
++err:
++ mutex_unlock(&ipvs->sync_mutex);
+ return retc;
+ }
+
+@@ -2021,7 +2033,6 @@ void ip_vs_sync_net_cleanup(struct netns_ipvs *ipvs)
+ {
+ int retc;
+
+- mutex_lock(&ipvs->sync_mutex);
+ retc = stop_sync_thread(ipvs, IP_VS_STATE_MASTER);
+ if (retc && retc != -ESRCH)
+ pr_err("Failed to stop Master Daemon\n");
+@@ -2029,5 +2040,4 @@ void ip_vs_sync_net_cleanup(struct netns_ipvs *ipvs)
+ retc = stop_sync_thread(ipvs, IP_VS_STATE_BACKUP);
+ if (retc && retc != -ESRCH)
+ pr_err("Failed to stop Backup Daemon\n");
+- mutex_unlock(&ipvs->sync_mutex);
+ }
+diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
+index 8a64b150be54..fe96c0d039f2 100644
+--- a/net/xdp/xsk_queue.h
++++ b/net/xdp/xsk_queue.h
+@@ -239,7 +239,7 @@ static inline void xskq_produce_flush_desc(struct xsk_queue *q)
+ /* Order producer and data */
+ smp_wmb();
+
+- q->prod_tail = q->prod_head,
++ q->prod_tail = q->prod_head;
+ WRITE_ONCE(q->ring->producer, q->prod_tail);
+ }
+
+diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
+index 4a9ee2d83158..372c91faa283 100644
+--- a/net/xfrm/Kconfig
++++ b/net/xfrm/Kconfig
+@@ -14,6 +14,8 @@ config XFRM_ALGO
+ tristate
+ select XFRM
+ select CRYPTO
++ select CRYPTO_HASH
++ select CRYPTO_BLKCIPHER
+
+ config XFRM_USER
+ tristate "Transformation user configuration interface"
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 2122f89f6155..1484bc99a537 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -150,6 +150,25 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
+
+ err = -EINVAL;
+ switch (p->family) {
++ case AF_INET:
++ break;
++
++ case AF_INET6:
++#if IS_ENABLED(CONFIG_IPV6)
++ break;
++#else
++ err = -EAFNOSUPPORT;
++ goto out;
++#endif
++
++ default:
++ goto out;
++ }
++
++ switch (p->sel.family) {
++ case AF_UNSPEC:
++ break;
++
+ case AF_INET:
+ if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+ goto out;
+diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
+index 91d0a5c014ac..fd99ae90a618 100644
+--- a/scripts/kconfig/confdata.c
++++ b/scripts/kconfig/confdata.c
+@@ -834,11 +834,12 @@ int conf_write(const char *name)
+ "#\n"
+ "# %s\n"
+ "#\n", str);
+- } else if (!(sym->flags & SYMBOL_CHOICE)) {
++ } else if (!(sym->flags & SYMBOL_CHOICE) &&
++ !(sym->flags & SYMBOL_WRITTEN)) {
+ sym_calc_value(sym);
+ if (!(sym->flags & SYMBOL_WRITE))
+ goto next;
+- sym->flags &= ~SYMBOL_WRITE;
++ sym->flags |= SYMBOL_WRITTEN;
+
+ conf_write_symbol(out, sym, &kconfig_printer_cb, NULL);
+ }
+@@ -1024,8 +1025,6 @@ int conf_write_autoconf(int overwrite)
+ if (!overwrite && is_present(autoconf_name))
+ return 0;
+
+- sym_clear_all_valid();
+-
+ conf_write_dep("include/config/auto.conf.cmd");
+
+ if (conf_split_config())
+diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h
+index 7c329e179007..43a87f8ea738 100644
+--- a/scripts/kconfig/expr.h
++++ b/scripts/kconfig/expr.h
+@@ -141,6 +141,7 @@ struct symbol {
+ #define SYMBOL_OPTIONAL 0x0100 /* choice is optional - values can be 'n' */
+ #define SYMBOL_WRITE 0x0200 /* write symbol to file (KCONFIG_CONFIG) */
+ #define SYMBOL_CHANGED 0x0400 /* ? */
++#define SYMBOL_WRITTEN 0x0800 /* track info to avoid double-write to .config */
+ #define SYMBOL_NO_WRITE 0x1000 /* Symbol for internal use only; it will not be written */
+ #define SYMBOL_CHECKED 0x2000 /* used during dependency checking */
+ #define SYMBOL_WARNED 0x8000 /* warning has been issued */
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 70bad15ed7a0..109ab510bdb1 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -6550,11 +6550,12 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
+ } else if (!strcmp(name, "fscreate")) {
+ tsec->create_sid = sid;
+ } else if (!strcmp(name, "keycreate")) {
+- error = avc_has_perm(&selinux_state,
+- mysid, sid, SECCLASS_KEY, KEY__CREATE,
+- NULL);
+- if (error)
+- goto abort_change;
++ if (sid) {
++ error = avc_has_perm(&selinux_state, mysid, sid,
++ SECCLASS_KEY, KEY__CREATE, NULL);
++ if (error)
++ goto abort_change;
++ }
+ tsec->keycreate_sid = sid;
+ } else if (!strcmp(name, "sockcreate")) {
+ tsec->sockcreate_sid = sid;
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index f59e13c1d84a..bbf91a5a938b 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1004,7 +1004,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ {
+ struct snd_seq_client *client = file->private_data;
+ int written = 0, len;
+- int err;
++ int err, handled;
+ struct snd_seq_event event;
+
+ if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
+@@ -1017,6 +1017,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ if (!client->accept_output || client->pool == NULL)
+ return -ENXIO;
+
++ repeat:
++ handled = 0;
+ /* allocate the pool now if the pool is not allocated yet */
+ mutex_lock(&client->ioctl_mutex);
+ if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
+@@ -1076,12 +1078,19 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ 0, 0, &client->ioctl_mutex);
+ if (err < 0)
+ break;
++ handled++;
+
+ __skip_event:
+ /* Update pointers and counts */
+ count -= len;
+ buf += len;
+ written += len;
++
++ /* let's have a coffee break if too many events are queued */
++ if (++handled >= 200) {
++ mutex_unlock(&client->ioctl_mutex);
++ goto repeat;
++ }
+ }
+
+ out:
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 98cfdcfce5b3..dc1989686f09 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7518,9 +7518,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60130},
+ {0x17, 0x90170110},
+ {0x21, 0x03211020}),
+- SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
++ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
+ {0x14, 0x90170110},
+ {0x21, 0x04211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
++ {0x14, 0x90170110},
++ {0x21, 0x04211030}),
+ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC295_STANDARD_PINS,
+ {0x17, 0x21014020},
+@@ -8654,6 +8657,11 @@ static const struct snd_hda_pin_quirk alc662_pin_fixup_tbl[] = {
+ {0x18, 0x01a19030},
+ {0x1a, 0x01813040},
+ {0x21, 0x01014020}),
++ SND_HDA_PIN_QUIRK(0x10ec0867, 0x1028, "Dell", ALC891_FIXUP_DELL_MIC_NO_PRESENCE,
++ {0x16, 0x01813030},
++ {0x17, 0x02211010},
++ {0x18, 0x01a19040},
++ {0x21, 0x01014020}),
+ SND_HDA_PIN_QUIRK(0x10ec0662, 0x1028, "Dell", ALC662_FIXUP_DELL_MIC_NO_PRESENCE,
+ {0x14, 0x01014010},
+ {0x18, 0x01a19020},
+diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
+index 63487240b61e..098196610542 100644
+--- a/sound/soc/codecs/hdac_hdmi.c
++++ b/sound/soc/codecs/hdac_hdmi.c
+@@ -1854,6 +1854,12 @@ static void hdmi_codec_remove(struct snd_soc_component *component)
+ {
+ struct hdac_hdmi_priv *hdmi = snd_soc_component_get_drvdata(component);
+ struct hdac_device *hdev = hdmi->hdev;
++ int ret;
++
++ ret = snd_hdac_acomp_register_notifier(hdev->bus, NULL);
++ if (ret < 0)
++ dev_err(&hdev->dev, "notifier unregister failed: err: %d\n",
++ ret);
+
+ pm_runtime_disable(&hdev->dev);
+ }
+diff --git a/sound/soc/meson/axg-tdm.h b/sound/soc/meson/axg-tdm.h
+index e578b6f40a07..5774ce0916d4 100644
+--- a/sound/soc/meson/axg-tdm.h
++++ b/sound/soc/meson/axg-tdm.h
+@@ -40,7 +40,7 @@ struct axg_tdm_iface {
+
+ static inline bool axg_tdm_lrclk_invert(unsigned int fmt)
+ {
+- return (fmt & SND_SOC_DAIFMT_I2S) ^
++ return ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) == SND_SOC_DAIFMT_I2S) ^
+ !!(fmt & (SND_SOC_DAIFMT_IB_IF | SND_SOC_DAIFMT_NB_IF));
+ }
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 2257b1b0151c..3bfc788372f3 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2139,23 +2139,25 @@ void snd_soc_dapm_debugfs_init(struct snd_soc_dapm_context *dapm,
+ {
+ struct dentry *d;
+
+- if (!parent)
++ if (!parent || IS_ERR(parent))
+ return;
+
+ dapm->debugfs_dapm = debugfs_create_dir("dapm", parent);
+
+- if (!dapm->debugfs_dapm) {
++ if (IS_ERR(dapm->debugfs_dapm)) {
+ dev_warn(dapm->dev,
+- "ASoC: Failed to create DAPM debugfs directory\n");
++ "ASoC: Failed to create DAPM debugfs directory %ld\n",
++ PTR_ERR(dapm->debugfs_dapm));
+ return;
+ }
+
+ d = debugfs_create_file("bias_level", 0444,
+ dapm->debugfs_dapm, dapm,
+ &dapm_bias_fops);
+- if (!d)
++ if (IS_ERR(d))
+ dev_warn(dapm->dev,
+- "ASoC: Failed to create bias level debugfs file\n");
++ "ASoC: Failed to create bias level debugfs file: %ld\n",
++ PTR_ERR(d));
+ }
+
+ static void dapm_debugfs_add_widget(struct snd_soc_dapm_widget *w)
+@@ -2169,10 +2171,10 @@ static void dapm_debugfs_add_widget(struct snd_soc_dapm_widget *w)
+ d = debugfs_create_file(w->name, 0444,
+ dapm->debugfs_dapm, w,
+ &dapm_widget_power_fops);
+- if (!d)
++ if (IS_ERR(d))
+ dev_warn(w->dapm->dev,
+- "ASoC: Failed to create %s debugfs file\n",
+- w->name);
++ "ASoC: Failed to create %s debugfs file: %ld\n",
++ w->name, PTR_ERR(d));
+ }
+
+ static void dapm_debugfs_cleanup(struct snd_soc_dapm_context *dapm)
+diff --git a/tools/bpf/bpftool/jit_disasm.c b/tools/bpf/bpftool/jit_disasm.c
+index 87439320ef70..73d7252729fa 100644
+--- a/tools/bpf/bpftool/jit_disasm.c
++++ b/tools/bpf/bpftool/jit_disasm.c
+@@ -10,6 +10,8 @@
+ * Licensed under the GNU General Public License, version 2.0 (GPLv2)
+ */
+
++#define _GNU_SOURCE
++#include <stdio.h>
+ #include <stdarg.h>
+ #include <stdint.h>
+ #include <stdio.h>
+@@ -51,11 +53,13 @@ static int fprintf_json(void *out, const char *fmt, ...)
+ char *s;
+
+ va_start(ap, fmt);
++ if (vasprintf(&s, fmt, ap) < 0)
++ return -1;
++ va_end(ap);
++
+ if (!oper_count) {
+ int i;
+
+- s = va_arg(ap, char *);
+-
+ /* Strip trailing spaces */
+ i = strlen(s) - 1;
+ while (s[i] == ' ')
+@@ -68,11 +72,10 @@ static int fprintf_json(void *out, const char *fmt, ...)
+ } else if (!strcmp(fmt, ",")) {
+ /* Skip */
+ } else {
+- s = va_arg(ap, char *);
+ jsonw_string(json_wtr, s);
+ oper_count++;
+ }
+- va_end(ap);
++ free(s);
+ return 0;
+ }
+
+diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
+index 66917a4eba27..bf4cd924aed5 100644
+--- a/tools/include/uapi/linux/bpf.h
++++ b/tools/include/uapi/linux/bpf.h
+@@ -2484,6 +2484,7 @@ struct bpf_prog_info {
+ char name[BPF_OBJ_NAME_LEN];
+ __u32 ifindex;
+ __u32 gpl_compatible:1;
++ __u32 :31; /* alignment pad */
+ __u64 netns_dev;
+ __u64 netns_ino;
+ __u32 nr_jited_ksyms;
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index bdb94939fd60..a350f97e3a1a 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -2293,10 +2293,7 @@ int bpf_prog_load(const char *file, enum bpf_prog_type type,
+ int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr,
+ struct bpf_object **pobj, int *prog_fd)
+ {
+- struct bpf_object_open_attr open_attr = {
+- .file = attr->file,
+- .prog_type = attr->prog_type,
+- };
++ struct bpf_object_open_attr open_attr = {};
+ struct bpf_program *prog, *first_prog = NULL;
+ enum bpf_attach_type expected_attach_type;
+ enum bpf_prog_type prog_type;
+@@ -2309,6 +2306,9 @@ int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr,
+ if (!attr->file)
+ return -EINVAL;
+
++ open_attr.file = attr->file;
++ open_attr.prog_type = attr->prog_type;
++
+ obj = bpf_object__open_xattr(&open_attr);
+ if (IS_ERR_OR_NULL(obj))
+ return -ENOENT;
+diff --git a/tools/perf/arch/arm/util/cs-etm.c b/tools/perf/arch/arm/util/cs-etm.c
+index 2f595cd73da6..16af6c3b1365 100644
+--- a/tools/perf/arch/arm/util/cs-etm.c
++++ b/tools/perf/arch/arm/util/cs-etm.c
+@@ -32,6 +32,8 @@ struct cs_etm_recording {
+ struct auxtrace_record itr;
+ struct perf_pmu *cs_etm_pmu;
+ struct perf_evlist *evlist;
++ int wrapped_cnt;
++ bool *wrapped;
+ bool snapshot_mode;
+ size_t snapshot_size;
+ };
+@@ -495,16 +497,131 @@ static int cs_etm_info_fill(struct auxtrace_record *itr,
+ return 0;
+ }
+
+-static int cs_etm_find_snapshot(struct auxtrace_record *itr __maybe_unused,
++static int cs_etm_alloc_wrapped_array(struct cs_etm_recording *ptr, int idx)
++{
++ bool *wrapped;
++ int cnt = ptr->wrapped_cnt;
++
++ /* Make @ptr->wrapped as big as @idx */
++ while (cnt <= idx)
++ cnt++;
++
++ /*
++ * Free'ed in cs_etm_recording_free(). Using realloc() to avoid
++ * cross compilation problems where the host's system supports
++ * reallocarray() but not the target.
++ */
++ wrapped = realloc(ptr->wrapped, cnt * sizeof(bool));
++ if (!wrapped)
++ return -ENOMEM;
++
++ wrapped[cnt - 1] = false;
++ ptr->wrapped_cnt = cnt;
++ ptr->wrapped = wrapped;
++
++ return 0;
++}
++
++static bool cs_etm_buffer_has_wrapped(unsigned char *buffer,
++ size_t buffer_size, u64 head)
++{
++ u64 i, watermark;
++ u64 *buf = (u64 *)buffer;
++ size_t buf_size = buffer_size;
++
++ /*
++ * We want to look the very last 512 byte (chosen arbitrarily) in
++ * the ring buffer.
++ */
++ watermark = buf_size - 512;
++
++ /*
++ * @head is continuously increasing - if its value is equal or greater
++ * than the size of the ring buffer, it has wrapped around.
++ */
++ if (head >= buffer_size)
++ return true;
++
++ /*
++ * The value of @head is somewhere within the size of the ring buffer.
++ * This can be that there hasn't been enough data to fill the ring
++ * buffer yet or the trace time was so long that @head has numerically
++ * wrapped around. To find we need to check if we have data at the very
++ * end of the ring buffer. We can reliably do this because mmap'ed
++ * pages are zeroed out and there is a fresh mapping with every new
++ * session.
++ */
++
++ /* @head is less than 512 byte from the end of the ring buffer */
++ if (head > watermark)
++ watermark = head;
++
++ /*
++ * Speed things up by using 64 bit transactions (see "u64 *buf" above)
++ */
++ watermark >>= 3;
++ buf_size >>= 3;
++
++ /*
++ * If we find trace data at the end of the ring buffer, @head has
++ * been there and has numerically wrapped around at least once.
++ */
++ for (i = watermark; i < buf_size; i++)
++ if (buf[i])
++ return true;
++
++ return false;
++}
++
++static int cs_etm_find_snapshot(struct auxtrace_record *itr,
+ int idx, struct auxtrace_mmap *mm,
+- unsigned char *data __maybe_unused,
++ unsigned char *data,
+ u64 *head, u64 *old)
+ {
++ int err;
++ bool wrapped;
++ struct cs_etm_recording *ptr =
++ container_of(itr, struct cs_etm_recording, itr);
++
++ /*
++ * Allocate memory to keep track of wrapping if this is the first
++ * time we deal with this *mm.
++ */
++ if (idx >= ptr->wrapped_cnt) {
++ err = cs_etm_alloc_wrapped_array(ptr, idx);
++ if (err)
++ return err;
++ }
++
++ /*
++ * Check to see if *head has wrapped around. If it hasn't only the
++ * amount of data between *head and *old is snapshot'ed to avoid
++ * bloating the perf.data file with zeros. But as soon as *head has
++ * wrapped around the entire size of the AUX ring buffer it taken.
++ */
++ wrapped = ptr->wrapped[idx];
++ if (!wrapped && cs_etm_buffer_has_wrapped(data, mm->len, *head)) {
++ wrapped = true;
++ ptr->wrapped[idx] = true;
++ }
++
+ pr_debug3("%s: mmap index %d old head %zu new head %zu size %zu\n",
+ __func__, idx, (size_t)*old, (size_t)*head, mm->len);
+
+- *old = *head;
+- *head += mm->len;
++ /* No wrap has occurred, we can just use *head and *old. */
++ if (!wrapped)
++ return 0;
++
++ /*
++ * *head has wrapped around - adjust *head and *old to pickup the
++ * entire content of the AUX buffer.
++ */
++ if (*head >= mm->len) {
++ *old = *head - mm->len;
++ } else {
++ *head += mm->len;
++ *old = *head - mm->len;
++ }
+
+ return 0;
+ }
+@@ -545,6 +662,8 @@ static void cs_etm_recording_free(struct auxtrace_record *itr)
+ {
+ struct cs_etm_recording *ptr =
+ container_of(itr, struct cs_etm_recording, itr);
++
++ zfree(&ptr->wrapped);
+ free(ptr);
+ }
+
+diff --git a/tools/perf/jvmti/libjvmti.c b/tools/perf/jvmti/libjvmti.c
+index 6add3e982614..3361d98a4edd 100644
+--- a/tools/perf/jvmti/libjvmti.c
++++ b/tools/perf/jvmti/libjvmti.c
+@@ -1,5 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include <linux/compiler.h>
++#include <linux/string.h>
+ #include <sys/types.h>
+ #include <stdio.h>
+ #include <string.h>
+@@ -150,8 +151,7 @@ copy_class_filename(const char * class_sign, const char * file_name, char * resu
+ result[i] = '\0';
+ } else {
+ /* fallback case */
+- size_t file_name_len = strlen(file_name);
+- strncpy(result, file_name, file_name_len < max_length ? file_name_len : max_length);
++ strlcpy(result, file_name, max_length);
+ }
+ }
+
+diff --git a/tools/perf/perf.h b/tools/perf/perf.h
+index 21bf7f5a3cf5..19d435a9623b 100644
+--- a/tools/perf/perf.h
++++ b/tools/perf/perf.h
+@@ -26,7 +26,7 @@ static inline unsigned long long rdclock(void)
+ }
+
+ #ifndef MAX_NR_CPUS
+-#define MAX_NR_CPUS 1024
++#define MAX_NR_CPUS 2048
+ #endif
+
+ extern const char *input_name;
+diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c
+index 3b97ac018d5a..532c95e8fa6b 100644
+--- a/tools/perf/tests/parse-events.c
++++ b/tools/perf/tests/parse-events.c
+@@ -18,6 +18,32 @@
+ #define PERF_TP_SAMPLE_TYPE (PERF_SAMPLE_RAW | PERF_SAMPLE_TIME | \
+ PERF_SAMPLE_CPU | PERF_SAMPLE_PERIOD)
+
++#if defined(__s390x__)
++/* Return true if kvm module is available and loaded. Test this
++ * and retun success when trace point kvm_s390_create_vm
++ * exists. Otherwise this test always fails.
++ */
++static bool kvm_s390_create_vm_valid(void)
++{
++ char *eventfile;
++ bool rc = false;
++
++ eventfile = get_events_file("kvm-s390");
++
++ if (eventfile) {
++ DIR *mydir = opendir(eventfile);
++
++ if (mydir) {
++ rc = true;
++ closedir(mydir);
++ }
++ put_events_file(eventfile);
++ }
++
++ return rc;
++}
++#endif
++
+ static int test__checkevent_tracepoint(struct perf_evlist *evlist)
+ {
+ struct perf_evsel *evsel = perf_evlist__first(evlist);
+@@ -1622,6 +1648,7 @@ static struct evlist_test test__events[] = {
+ {
+ .name = "kvm-s390:kvm_s390_create_vm",
+ .check = test__checkevent_tracepoint,
++ .valid = kvm_s390_create_vm_valid,
+ .id = 100,
+ },
+ #endif
+diff --git a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+index cab7b0aea6ea..f5837f28f3af 100755
+--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
++++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+@@ -43,7 +43,7 @@ trace_libc_inet_pton_backtrace() {
+ eventattr='max-stack=4'
+ echo "gaih_inet.*\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
+ echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
+- echo ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected
++ echo ".*(\+0x[[:xdigit:]]+|\[unknown\])[[:space:]]\(.*/bin/ping.*\)$" >> $expected
+ ;;
+ *)
+ eventattr='max-stack=3'
+diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
+index 1d00e5ec7906..a3c255228d62 100644
+--- a/tools/perf/ui/browsers/annotate.c
++++ b/tools/perf/ui/browsers/annotate.c
+@@ -96,11 +96,12 @@ static void annotate_browser__write(struct ui_browser *browser, void *entry, int
+ struct annotate_browser *ab = container_of(browser, struct annotate_browser, b);
+ struct annotation *notes = browser__annotation(browser);
+ struct annotation_line *al = list_entry(entry, struct annotation_line, node);
++ const bool is_current_entry = ui_browser__is_current_entry(browser, row);
+ struct annotation_write_ops ops = {
+ .first_line = row == 0,
+- .current_entry = ui_browser__is_current_entry(browser, row),
++ .current_entry = is_current_entry,
+ .change_color = (!notes->options->hide_src_code &&
+- (!ops.current_entry ||
++ (!is_current_entry ||
+ (browser->use_navkeypressed &&
+ !browser->navkeypressed))),
+ .width = browser->width,
+diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
+index dfee110b3a58..c357051dd2b6 100644
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -911,9 +911,8 @@ static int symbol__inc_addr_samples(struct symbol *sym, struct map *map,
+ if (sym == NULL)
+ return 0;
+ src = symbol__hists(sym, evsel->evlist->nr_entries);
+- if (src == NULL)
+- return -ENOMEM;
+- return __symbol__inc_addr_samples(sym, map, src, evsel->idx, addr, sample);
++ return (src) ? __symbol__inc_addr_samples(sym, map, src, evsel->idx,
++ addr, sample) : 0;
+ }
+
+ static int symbol__account_cycles(u64 addr, u64 start,
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index b65ad5a273eb..4fad92213609 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -590,6 +590,9 @@ const char *perf_evsel__name(struct perf_evsel *evsel)
+ {
+ char bf[128];
+
++ if (!evsel)
++ goto out_unknown;
++
+ if (evsel->name)
+ return evsel->name;
+
+@@ -626,7 +629,10 @@ const char *perf_evsel__name(struct perf_evsel *evsel)
+
+ evsel->name = strdup(bf);
+
+- return evsel->name ?: "unknown";
++ if (evsel->name)
++ return evsel->name;
++out_unknown:
++ return "unknown";
+ }
+
+ const char *perf_evsel__group_name(struct perf_evsel *evsel)
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index b9a82598e2ac..7f2e3b1c746c 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -1173,7 +1173,7 @@ static int build_caches(struct cpu_cache_level caches[], u32 size, u32 *cntp)
+ return 0;
+ }
+
+-#define MAX_CACHES 2000
++#define MAX_CACHES (MAX_NR_CPUS * 4)
+
+ static int write_cache(struct feat_fd *ff,
+ struct perf_evlist *evlist __maybe_unused)
+diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c
+index a28f9b5cc4ff..8b3dafe3fac3 100644
+--- a/tools/perf/util/metricgroup.c
++++ b/tools/perf/util/metricgroup.c
+@@ -94,26 +94,49 @@ struct egroup {
+ const char *metric_expr;
+ };
+
+-static struct perf_evsel *find_evsel(struct perf_evlist *perf_evlist,
+- const char **ids,
+- int idnum,
+- struct perf_evsel **metric_events)
++static bool record_evsel(int *ind, struct perf_evsel **start,
++ int idnum,
++ struct perf_evsel **metric_events,
++ struct perf_evsel *ev)
++{
++ metric_events[*ind] = ev;
++ if (*ind == 0)
++ *start = ev;
++ if (++*ind == idnum) {
++ metric_events[*ind] = NULL;
++ return true;
++ }
++ return false;
++}
++
++static struct perf_evsel *find_evsel_group(struct perf_evlist *perf_evlist,
++ const char **ids,
++ int idnum,
++ struct perf_evsel **metric_events)
+ {
+ struct perf_evsel *ev, *start = NULL;
+ int ind = 0;
+
+ evlist__for_each_entry (perf_evlist, ev) {
++ if (ev->collect_stat)
++ continue;
+ if (!strcmp(ev->name, ids[ind])) {
+- metric_events[ind] = ev;
+- if (ind == 0)
+- start = ev;
+- if (++ind == idnum) {
+- metric_events[ind] = NULL;
++ if (record_evsel(&ind, &start, idnum,
++ metric_events, ev))
+ return start;
+- }
+ } else {
++ /*
++ * We saw some other event that is not
++ * in our list of events. Discard
++ * the whole match and start again.
++ */
+ ind = 0;
+ start = NULL;
++ if (!strcmp(ev->name, ids[ind])) {
++ if (record_evsel(&ind, &start, idnum,
++ metric_events, ev))
++ return start;
++ }
+ }
+ }
+ /*
+@@ -143,8 +166,8 @@ static int metricgroup__setup_events(struct list_head *groups,
+ ret = -ENOMEM;
+ break;
+ }
+- evsel = find_evsel(perf_evlist, eg->ids, eg->idnum,
+- metric_events);
++ evsel = find_evsel_group(perf_evlist, eg->ids, eg->idnum,
++ metric_events);
+ if (!evsel) {
+ pr_debug("Cannot resolve %s: %s\n",
+ eg->metric_name, eg->metric_expr);
+diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c
+index 99990f5f2512..bbb0e042d8e5 100644
+--- a/tools/perf/util/stat-shadow.c
++++ b/tools/perf/util/stat-shadow.c
+@@ -303,7 +303,7 @@ static struct perf_evsel *perf_stat__find_event(struct perf_evlist *evsel_list,
+ struct perf_evsel *c2;
+
+ evlist__for_each_entry (evsel_list, c2) {
+- if (!strcasecmp(c2->name, name))
++ if (!strcasecmp(c2->name, name) && !c2->collect_stat)
+ return c2;
+ }
+ return NULL;
+@@ -342,7 +342,8 @@ void perf_stat__collect_metric_expr(struct perf_evlist *evsel_list)
+ if (leader) {
+ /* Search in group */
+ for_each_group_member (oc, leader) {
+- if (!strcasecmp(oc->name, metric_names[i])) {
++ if (!strcasecmp(oc->name, metric_names[i]) &&
++ !oc->collect_stat) {
+ found = true;
+ break;
+ }
+diff --git a/tools/power/cpupower/utils/cpufreq-set.c b/tools/power/cpupower/utils/cpufreq-set.c
+index 1eef0aed6423..08a405593a79 100644
+--- a/tools/power/cpupower/utils/cpufreq-set.c
++++ b/tools/power/cpupower/utils/cpufreq-set.c
+@@ -306,6 +306,8 @@ int cmd_freq_set(int argc, char **argv)
+ bitmask_setbit(cpus_chosen, cpus->cpu);
+ cpus = cpus->next;
+ }
++ /* Set the last cpu in related cpus list */
++ bitmask_setbit(cpus_chosen, cpus->cpu);
+ cpufreq_put_related_cpus(cpus);
+ }
+ }
+diff --git a/tools/testing/selftests/bpf/test_lwt_seg6local.c b/tools/testing/selftests/bpf/test_lwt_seg6local.c
+index 0575751bc1bc..e2f6ed0a583d 100644
+--- a/tools/testing/selftests/bpf/test_lwt_seg6local.c
++++ b/tools/testing/selftests/bpf/test_lwt_seg6local.c
+@@ -61,7 +61,7 @@ struct sr6_tlv_t {
+ unsigned char value[0];
+ } BPF_PACKET_HEADER;
+
+-__attribute__((always_inline)) struct ip6_srh_t *get_srh(struct __sk_buff *skb)
++static __always_inline struct ip6_srh_t *get_srh(struct __sk_buff *skb)
+ {
+ void *cursor, *data_end;
+ struct ip6_srh_t *srh;
+@@ -95,7 +95,7 @@ __attribute__((always_inline)) struct ip6_srh_t *get_srh(struct __sk_buff *skb)
+ return srh;
+ }
+
+-__attribute__((always_inline))
++static __always_inline
+ int update_tlv_pad(struct __sk_buff *skb, uint32_t new_pad,
+ uint32_t old_pad, uint32_t pad_off)
+ {
+@@ -125,7 +125,7 @@ int update_tlv_pad(struct __sk_buff *skb, uint32_t new_pad,
+ return 0;
+ }
+
+-__attribute__((always_inline))
++static __always_inline
+ int is_valid_tlv_boundary(struct __sk_buff *skb, struct ip6_srh_t *srh,
+ uint32_t *tlv_off, uint32_t *pad_size,
+ uint32_t *pad_off)
+@@ -184,7 +184,7 @@ int is_valid_tlv_boundary(struct __sk_buff *skb, struct ip6_srh_t *srh,
+ return 0;
+ }
+
+-__attribute__((always_inline))
++static __always_inline
+ int add_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh, uint32_t tlv_off,
+ struct sr6_tlv_t *itlv, uint8_t tlv_size)
+ {
+@@ -228,7 +228,7 @@ int add_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh, uint32_t tlv_off,
+ return update_tlv_pad(skb, new_pad, pad_size, pad_off);
+ }
+
+-__attribute__((always_inline))
++static __always_inline
+ int delete_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh,
+ uint32_t tlv_off)
+ {
+@@ -266,7 +266,7 @@ int delete_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh,
+ return update_tlv_pad(skb, new_pad, pad_size, pad_off);
+ }
+
+-__attribute__((always_inline))
++static __always_inline
+ int has_egr_tlv(struct __sk_buff *skb, struct ip6_srh_t *srh)
+ {
+ int tlv_offset = sizeof(struct ip6_t) + sizeof(struct ip6_srh_t) +
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-07-28 16:27 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-07-28 16:27 UTC (permalink / raw
To: gentoo-commits
commit: cb9be97dad62162639ad341e50c3dcd6b5691545
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jul 28 16:27:15 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jul 28 16:27:15 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=cb9be97d
Linux patch 4.19.62
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1061_linux-4.19.62.patch | 2185 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2189 insertions(+)
diff --git a/0000_README b/0000_README
index 301b6bf..6ff7ffd 100644
--- a/0000_README
+++ b/0000_README
@@ -287,6 +287,10 @@ Patch: 1060-4.19.61.patch
From: https://www.kernel.org
Desc: Linux 4.19.61
+Patch: 1061-4.19.62.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.62
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1061_linux-4.19.62.patch b/1061_linux-4.19.62.patch
new file mode 100644
index 0000000..b41f9ba
--- /dev/null
+++ b/1061_linux-4.19.62.patch
@@ -0,0 +1,2185 @@
+diff --git a/Makefile b/Makefile
+index b16485c580d7..a4463d880ae2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 61
++SUBLEVEL = 62
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/jz4740/board-qi_lb60.c b/arch/mips/jz4740/board-qi_lb60.c
+index 705593d40d12..05c60fa4fa06 100644
+--- a/arch/mips/jz4740/board-qi_lb60.c
++++ b/arch/mips/jz4740/board-qi_lb60.c
+@@ -471,27 +471,27 @@ static unsigned long pin_cfg_bias_disable[] = {
+ static struct pinctrl_map pin_map[] __initdata = {
+ /* NAND pin configuration */
+ PIN_MAP_MUX_GROUP_DEFAULT("jz4740-nand",
+- "10010000.jz4740-pinctrl", "nand", "nand-cs1"),
++ "10010000.pin-controller", "nand-cs1", "nand"),
+
+ /* fbdev pin configuration */
+ PIN_MAP_MUX_GROUP("jz4740-fb", PINCTRL_STATE_DEFAULT,
+- "10010000.jz4740-pinctrl", "lcd", "lcd-8bit"),
++ "10010000.pin-controller", "lcd-8bit", "lcd"),
+ PIN_MAP_MUX_GROUP("jz4740-fb", PINCTRL_STATE_SLEEP,
+- "10010000.jz4740-pinctrl", "lcd", "lcd-no-pins"),
++ "10010000.pin-controller", "lcd-no-pins", "lcd"),
+
+ /* MMC pin configuration */
+ PIN_MAP_MUX_GROUP_DEFAULT("jz4740-mmc.0",
+- "10010000.jz4740-pinctrl", "mmc", "mmc-1bit"),
++ "10010000.pin-controller", "mmc-1bit", "mmc"),
+ PIN_MAP_MUX_GROUP_DEFAULT("jz4740-mmc.0",
+- "10010000.jz4740-pinctrl", "mmc", "mmc-4bit"),
++ "10010000.pin-controller", "mmc-4bit", "mmc"),
+ PIN_MAP_CONFIGS_PIN_DEFAULT("jz4740-mmc.0",
+- "10010000.jz4740-pinctrl", "PD0", pin_cfg_bias_disable),
++ "10010000.pin-controller", "PD0", pin_cfg_bias_disable),
+ PIN_MAP_CONFIGS_PIN_DEFAULT("jz4740-mmc.0",
+- "10010000.jz4740-pinctrl", "PD2", pin_cfg_bias_disable),
++ "10010000.pin-controller", "PD2", pin_cfg_bias_disable),
+
+ /* PWM pin configuration */
+ PIN_MAP_MUX_GROUP_DEFAULT("jz4740-pwm",
+- "10010000.jz4740-pinctrl", "pwm4", "pwm4"),
++ "10010000.pin-controller", "pwm4", "pwm4"),
+ };
+
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 73d6d585dd66..4cf16378dffe 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -8457,6 +8457,7 @@ static void vmx_disable_shadow_vmcs(struct vcpu_vmx *vmx)
+ {
+ vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL, SECONDARY_EXEC_SHADOW_VMCS);
+ vmcs_write64(VMCS_LINK_POINTER, -1ull);
++ vmx->nested.sync_shadow_vmcs = false;
+ }
+
+ static inline void nested_release_vmcs12(struct vcpu_vmx *vmx)
+@@ -8468,7 +8469,6 @@ static inline void nested_release_vmcs12(struct vcpu_vmx *vmx)
+ /* copy to memory all shadowed fields in case
+ they were modified */
+ copy_shadow_to_vmcs12(vmx);
+- vmx->nested.sync_shadow_vmcs = false;
+ vmx_disable_shadow_vmcs(vmx);
+ }
+ vmx->nested.posted_intr_nv = -1;
+@@ -8490,6 +8490,8 @@ static void free_nested(struct vcpu_vmx *vmx)
+ if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
+ return;
+
++ kvm_clear_request(KVM_REQ_GET_VMCS12_PAGES, &vmx->vcpu);
++
+ hrtimer_cancel(&vmx->nested.preemption_timer);
+ vmx->nested.vmxon = false;
+ vmx->nested.smm.vmxon = false;
+@@ -8668,6 +8670,9 @@ static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
+ u64 field_value;
+ struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
+
++ if (WARN_ON(!shadow_vmcs))
++ return;
++
+ preempt_disable();
+
+ vmcs_load(shadow_vmcs);
+@@ -8706,6 +8711,9 @@ static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
+ u64 field_value = 0;
+ struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
+
++ if (WARN_ON(!shadow_vmcs))
++ return;
++
+ vmcs_load(shadow_vmcs);
+
+ for (q = 0; q < ARRAY_SIZE(fields); q++) {
+diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
+index 13884474d158..69842145c223 100644
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -1069,6 +1069,7 @@ static int dma_buf_debug_show(struct seq_file *s, void *unused)
+ fence->ops->get_driver_name(fence),
+ fence->ops->get_timeline_name(fence),
+ dma_fence_is_signaled(fence) ? "" : "un");
++ dma_fence_put(fence);
+ }
+ rcu_read_unlock();
+
+diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
+index 6c95f61a32e7..49ab09468ba1 100644
+--- a/drivers/dma-buf/reservation.c
++++ b/drivers/dma-buf/reservation.c
+@@ -416,6 +416,10 @@ int reservation_object_get_fences_rcu(struct reservation_object *obj,
+ GFP_NOWAIT | __GFP_NOWARN);
+ if (!nshared) {
+ rcu_read_unlock();
++
++ dma_fence_put(fence_excl);
++ fence_excl = NULL;
++
+ nshared = krealloc(shared, sz, GFP_KERNEL);
+ if (nshared) {
+ shared = nshared;
+diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
+index a5ece8ea79bc..abb332d15a13 100644
+--- a/drivers/gpio/gpio-davinci.c
++++ b/drivers/gpio/gpio-davinci.c
+@@ -222,8 +222,9 @@ static int davinci_gpio_probe(struct platform_device *pdev)
+ for (i = 0; i < nirq; i++) {
+ chips->irqs[i] = platform_get_irq(pdev, i);
+ if (chips->irqs[i] < 0) {
+- dev_info(dev, "IRQ not populated, err = %d\n",
+- chips->irqs[i]);
++ if (chips->irqs[i] != -EPROBE_DEFER)
++ dev_info(dev, "IRQ not populated, err = %d\n",
++ chips->irqs[i]);
+ return chips->irqs[i];
+ }
+ }
+diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
+index 433a14b9f731..253a1bbe37e8 100644
+--- a/drivers/net/caif/caif_hsi.c
++++ b/drivers/net/caif/caif_hsi.c
+@@ -1455,7 +1455,7 @@ static void __exit cfhsi_exit_module(void)
+ rtnl_lock();
+ list_for_each_safe(list_node, n, &cfhsi_list) {
+ cfhsi = list_entry(list_node, struct cfhsi, list);
+- unregister_netdev(cfhsi->ndev);
++ unregister_netdevice(cfhsi->ndev);
+ }
+ rtnl_unlock();
+ }
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 411cfb806459..703e6bdaf0e1 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -4816,6 +4816,8 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev)
+ err = PTR_ERR(chip->reset);
+ goto out;
+ }
++ if (chip->reset)
++ usleep_range(1000, 2000);
+
+ err = mv88e6xxx_detect(chip);
+ if (err)
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index e3ce29951c5e..3edb81a4f075 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -286,6 +286,9 @@ int bnx2x_tx_int(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata)
+ hw_cons = le16_to_cpu(*txdata->tx_cons_sb);
+ sw_cons = txdata->tx_pkt_cons;
+
++ /* Ensure subsequent loads occur after hw_cons */
++ smp_rmb();
++
+ while (sw_cons != hw_cons) {
+ u16 pkt_cons;
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 2d6f090bf644..fd587bed32eb 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -3086,39 +3086,42 @@ static void bcmgenet_timeout(struct net_device *dev)
+ netif_tx_wake_all_queues(dev);
+ }
+
+-#define MAX_MC_COUNT 16
++#define MAX_MDF_FILTER 17
+
+ static inline void bcmgenet_set_mdf_addr(struct bcmgenet_priv *priv,
+ unsigned char *addr,
+- int *i,
+- int *mc)
++ int *i)
+ {
+- u32 reg;
+-
+ bcmgenet_umac_writel(priv, addr[0] << 8 | addr[1],
+ UMAC_MDF_ADDR + (*i * 4));
+ bcmgenet_umac_writel(priv, addr[2] << 24 | addr[3] << 16 |
+ addr[4] << 8 | addr[5],
+ UMAC_MDF_ADDR + ((*i + 1) * 4));
+- reg = bcmgenet_umac_readl(priv, UMAC_MDF_CTRL);
+- reg |= (1 << (MAX_MC_COUNT - *mc));
+- bcmgenet_umac_writel(priv, reg, UMAC_MDF_CTRL);
+ *i += 2;
+- (*mc)++;
+ }
+
+ static void bcmgenet_set_rx_mode(struct net_device *dev)
+ {
+ struct bcmgenet_priv *priv = netdev_priv(dev);
+ struct netdev_hw_addr *ha;
+- int i, mc;
++ int i, nfilter;
+ u32 reg;
+
+ netif_dbg(priv, hw, dev, "%s: %08X\n", __func__, dev->flags);
+
+- /* Promiscuous mode */
++ /* Number of filters needed */
++ nfilter = netdev_uc_count(dev) + netdev_mc_count(dev) + 2;
++
++ /*
++ * Turn on promicuous mode for three scenarios
++ * 1. IFF_PROMISC flag is set
++ * 2. IFF_ALLMULTI flag is set
++ * 3. The number of filters needed exceeds the number filters
++ * supported by the hardware.
++ */
+ reg = bcmgenet_umac_readl(priv, UMAC_CMD);
+- if (dev->flags & IFF_PROMISC) {
++ if ((dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) ||
++ (nfilter > MAX_MDF_FILTER)) {
+ reg |= CMD_PROMISC;
+ bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+ bcmgenet_umac_writel(priv, 0, UMAC_MDF_CTRL);
+@@ -3128,32 +3131,24 @@ static void bcmgenet_set_rx_mode(struct net_device *dev)
+ bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+ }
+
+- /* UniMac doesn't support ALLMULTI */
+- if (dev->flags & IFF_ALLMULTI) {
+- netdev_warn(dev, "ALLMULTI is not supported\n");
+- return;
+- }
+-
+ /* update MDF filter */
+ i = 0;
+- mc = 0;
+ /* Broadcast */
+- bcmgenet_set_mdf_addr(priv, dev->broadcast, &i, &mc);
++ bcmgenet_set_mdf_addr(priv, dev->broadcast, &i);
+ /* my own address.*/
+- bcmgenet_set_mdf_addr(priv, dev->dev_addr, &i, &mc);
+- /* Unicast list*/
+- if (netdev_uc_count(dev) > (MAX_MC_COUNT - mc))
+- return;
++ bcmgenet_set_mdf_addr(priv, dev->dev_addr, &i);
+
+- if (!netdev_uc_empty(dev))
+- netdev_for_each_uc_addr(ha, dev)
+- bcmgenet_set_mdf_addr(priv, ha->addr, &i, &mc);
+- /* Multicast */
+- if (netdev_mc_empty(dev) || netdev_mc_count(dev) >= (MAX_MC_COUNT - mc))
+- return;
++ /* Unicast */
++ netdev_for_each_uc_addr(ha, dev)
++ bcmgenet_set_mdf_addr(priv, ha->addr, &i);
+
++ /* Multicast */
+ netdev_for_each_mc_addr(ha, dev)
+- bcmgenet_set_mdf_addr(priv, ha->addr, &i, &mc);
++ bcmgenet_set_mdf_addr(priv, ha->addr, &i);
++
++ /* Enable filters */
++ reg = GENMASK(MAX_MDF_FILTER - 1, MAX_MDF_FILTER - nfilter);
++ bcmgenet_umac_writel(priv, reg, UMAC_MDF_CTRL);
+ }
+
+ /* Set the hardware MAC address. */
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index 1485f66cf7b0..4ade864c8d53 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -4947,6 +4947,13 @@ static const struct dmi_system_id msi_blacklist[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P-79"),
+ },
+ },
++ {
++ .ident = "ASUS P6T",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "P6T"),
++ },
++ },
+ {}
+ };
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+index 5b7fe8264144..db6aafcced0d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+@@ -662,7 +662,9 @@ struct net_device *mlx5_rdma_netdev_alloc(struct mlx5_core_dev *mdev,
+
+ profile->init(mdev, netdev, profile, ipriv);
+
+- mlx5e_attach_netdev(epriv);
++ err = mlx5e_attach_netdev(epriv);
++ if (err)
++ goto detach;
+ netif_carrier_off(netdev);
+
+ /* set rdma_netdev func pointers */
+@@ -678,6 +680,11 @@ struct net_device *mlx5_rdma_netdev_alloc(struct mlx5_core_dev *mdev,
+
+ return netdev;
+
++detach:
++ profile->cleanup(epriv);
++ if (ipriv->sub_interface)
++ return NULL;
++ mlx5e_destroy_mdev_resources(mdev);
+ destroy_ht:
+ mlx5i_pkey_qpn_ht_cleanup(netdev);
+ destroy_wq:
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 7a50b911b180..a6992c4c7313 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -5202,6 +5202,143 @@ static void rtl_hw_start_8411_2(struct rtl8169_private *tp)
+ /* disable aspm and clock request before access ephy */
+ rtl_hw_aspm_clkreq_enable(tp, false);
+ rtl_ephy_init(tp, e_info_8411_2, ARRAY_SIZE(e_info_8411_2));
++
++ /* The following Realtek-provided magic fixes an issue with the RX unit
++ * getting confused after the PHY having been powered-down.
++ */
++ r8168_mac_ocp_write(tp, 0xFC28, 0x0000);
++ r8168_mac_ocp_write(tp, 0xFC2A, 0x0000);
++ r8168_mac_ocp_write(tp, 0xFC2C, 0x0000);
++ r8168_mac_ocp_write(tp, 0xFC2E, 0x0000);
++ r8168_mac_ocp_write(tp, 0xFC30, 0x0000);
++ r8168_mac_ocp_write(tp, 0xFC32, 0x0000);
++ r8168_mac_ocp_write(tp, 0xFC34, 0x0000);
++ r8168_mac_ocp_write(tp, 0xFC36, 0x0000);
++ mdelay(3);
++ r8168_mac_ocp_write(tp, 0xFC26, 0x0000);
++
++ r8168_mac_ocp_write(tp, 0xF800, 0xE008);
++ r8168_mac_ocp_write(tp, 0xF802, 0xE00A);
++ r8168_mac_ocp_write(tp, 0xF804, 0xE00C);
++ r8168_mac_ocp_write(tp, 0xF806, 0xE00E);
++ r8168_mac_ocp_write(tp, 0xF808, 0xE027);
++ r8168_mac_ocp_write(tp, 0xF80A, 0xE04F);
++ r8168_mac_ocp_write(tp, 0xF80C, 0xE05E);
++ r8168_mac_ocp_write(tp, 0xF80E, 0xE065);
++ r8168_mac_ocp_write(tp, 0xF810, 0xC602);
++ r8168_mac_ocp_write(tp, 0xF812, 0xBE00);
++ r8168_mac_ocp_write(tp, 0xF814, 0x0000);
++ r8168_mac_ocp_write(tp, 0xF816, 0xC502);
++ r8168_mac_ocp_write(tp, 0xF818, 0xBD00);
++ r8168_mac_ocp_write(tp, 0xF81A, 0x074C);
++ r8168_mac_ocp_write(tp, 0xF81C, 0xC302);
++ r8168_mac_ocp_write(tp, 0xF81E, 0xBB00);
++ r8168_mac_ocp_write(tp, 0xF820, 0x080A);
++ r8168_mac_ocp_write(tp, 0xF822, 0x6420);
++ r8168_mac_ocp_write(tp, 0xF824, 0x48C2);
++ r8168_mac_ocp_write(tp, 0xF826, 0x8C20);
++ r8168_mac_ocp_write(tp, 0xF828, 0xC516);
++ r8168_mac_ocp_write(tp, 0xF82A, 0x64A4);
++ r8168_mac_ocp_write(tp, 0xF82C, 0x49C0);
++ r8168_mac_ocp_write(tp, 0xF82E, 0xF009);
++ r8168_mac_ocp_write(tp, 0xF830, 0x74A2);
++ r8168_mac_ocp_write(tp, 0xF832, 0x8CA5);
++ r8168_mac_ocp_write(tp, 0xF834, 0x74A0);
++ r8168_mac_ocp_write(tp, 0xF836, 0xC50E);
++ r8168_mac_ocp_write(tp, 0xF838, 0x9CA2);
++ r8168_mac_ocp_write(tp, 0xF83A, 0x1C11);
++ r8168_mac_ocp_write(tp, 0xF83C, 0x9CA0);
++ r8168_mac_ocp_write(tp, 0xF83E, 0xE006);
++ r8168_mac_ocp_write(tp, 0xF840, 0x74F8);
++ r8168_mac_ocp_write(tp, 0xF842, 0x48C4);
++ r8168_mac_ocp_write(tp, 0xF844, 0x8CF8);
++ r8168_mac_ocp_write(tp, 0xF846, 0xC404);
++ r8168_mac_ocp_write(tp, 0xF848, 0xBC00);
++ r8168_mac_ocp_write(tp, 0xF84A, 0xC403);
++ r8168_mac_ocp_write(tp, 0xF84C, 0xBC00);
++ r8168_mac_ocp_write(tp, 0xF84E, 0x0BF2);
++ r8168_mac_ocp_write(tp, 0xF850, 0x0C0A);
++ r8168_mac_ocp_write(tp, 0xF852, 0xE434);
++ r8168_mac_ocp_write(tp, 0xF854, 0xD3C0);
++ r8168_mac_ocp_write(tp, 0xF856, 0x49D9);
++ r8168_mac_ocp_write(tp, 0xF858, 0xF01F);
++ r8168_mac_ocp_write(tp, 0xF85A, 0xC526);
++ r8168_mac_ocp_write(tp, 0xF85C, 0x64A5);
++ r8168_mac_ocp_write(tp, 0xF85E, 0x1400);
++ r8168_mac_ocp_write(tp, 0xF860, 0xF007);
++ r8168_mac_ocp_write(tp, 0xF862, 0x0C01);
++ r8168_mac_ocp_write(tp, 0xF864, 0x8CA5);
++ r8168_mac_ocp_write(tp, 0xF866, 0x1C15);
++ r8168_mac_ocp_write(tp, 0xF868, 0xC51B);
++ r8168_mac_ocp_write(tp, 0xF86A, 0x9CA0);
++ r8168_mac_ocp_write(tp, 0xF86C, 0xE013);
++ r8168_mac_ocp_write(tp, 0xF86E, 0xC519);
++ r8168_mac_ocp_write(tp, 0xF870, 0x74A0);
++ r8168_mac_ocp_write(tp, 0xF872, 0x48C4);
++ r8168_mac_ocp_write(tp, 0xF874, 0x8CA0);
++ r8168_mac_ocp_write(tp, 0xF876, 0xC516);
++ r8168_mac_ocp_write(tp, 0xF878, 0x74A4);
++ r8168_mac_ocp_write(tp, 0xF87A, 0x48C8);
++ r8168_mac_ocp_write(tp, 0xF87C, 0x48CA);
++ r8168_mac_ocp_write(tp, 0xF87E, 0x9CA4);
++ r8168_mac_ocp_write(tp, 0xF880, 0xC512);
++ r8168_mac_ocp_write(tp, 0xF882, 0x1B00);
++ r8168_mac_ocp_write(tp, 0xF884, 0x9BA0);
++ r8168_mac_ocp_write(tp, 0xF886, 0x1B1C);
++ r8168_mac_ocp_write(tp, 0xF888, 0x483F);
++ r8168_mac_ocp_write(tp, 0xF88A, 0x9BA2);
++ r8168_mac_ocp_write(tp, 0xF88C, 0x1B04);
++ r8168_mac_ocp_write(tp, 0xF88E, 0xC508);
++ r8168_mac_ocp_write(tp, 0xF890, 0x9BA0);
++ r8168_mac_ocp_write(tp, 0xF892, 0xC505);
++ r8168_mac_ocp_write(tp, 0xF894, 0xBD00);
++ r8168_mac_ocp_write(tp, 0xF896, 0xC502);
++ r8168_mac_ocp_write(tp, 0xF898, 0xBD00);
++ r8168_mac_ocp_write(tp, 0xF89A, 0x0300);
++ r8168_mac_ocp_write(tp, 0xF89C, 0x051E);
++ r8168_mac_ocp_write(tp, 0xF89E, 0xE434);
++ r8168_mac_ocp_write(tp, 0xF8A0, 0xE018);
++ r8168_mac_ocp_write(tp, 0xF8A2, 0xE092);
++ r8168_mac_ocp_write(tp, 0xF8A4, 0xDE20);
++ r8168_mac_ocp_write(tp, 0xF8A6, 0xD3C0);
++ r8168_mac_ocp_write(tp, 0xF8A8, 0xC50F);
++ r8168_mac_ocp_write(tp, 0xF8AA, 0x76A4);
++ r8168_mac_ocp_write(tp, 0xF8AC, 0x49E3);
++ r8168_mac_ocp_write(tp, 0xF8AE, 0xF007);
++ r8168_mac_ocp_write(tp, 0xF8B0, 0x49C0);
++ r8168_mac_ocp_write(tp, 0xF8B2, 0xF103);
++ r8168_mac_ocp_write(tp, 0xF8B4, 0xC607);
++ r8168_mac_ocp_write(tp, 0xF8B6, 0xBE00);
++ r8168_mac_ocp_write(tp, 0xF8B8, 0xC606);
++ r8168_mac_ocp_write(tp, 0xF8BA, 0xBE00);
++ r8168_mac_ocp_write(tp, 0xF8BC, 0xC602);
++ r8168_mac_ocp_write(tp, 0xF8BE, 0xBE00);
++ r8168_mac_ocp_write(tp, 0xF8C0, 0x0C4C);
++ r8168_mac_ocp_write(tp, 0xF8C2, 0x0C28);
++ r8168_mac_ocp_write(tp, 0xF8C4, 0x0C2C);
++ r8168_mac_ocp_write(tp, 0xF8C6, 0xDC00);
++ r8168_mac_ocp_write(tp, 0xF8C8, 0xC707);
++ r8168_mac_ocp_write(tp, 0xF8CA, 0x1D00);
++ r8168_mac_ocp_write(tp, 0xF8CC, 0x8DE2);
++ r8168_mac_ocp_write(tp, 0xF8CE, 0x48C1);
++ r8168_mac_ocp_write(tp, 0xF8D0, 0xC502);
++ r8168_mac_ocp_write(tp, 0xF8D2, 0xBD00);
++ r8168_mac_ocp_write(tp, 0xF8D4, 0x00AA);
++ r8168_mac_ocp_write(tp, 0xF8D6, 0xE0C0);
++ r8168_mac_ocp_write(tp, 0xF8D8, 0xC502);
++ r8168_mac_ocp_write(tp, 0xF8DA, 0xBD00);
++ r8168_mac_ocp_write(tp, 0xF8DC, 0x0132);
++
++ r8168_mac_ocp_write(tp, 0xFC26, 0x8000);
++
++ r8168_mac_ocp_write(tp, 0xFC2A, 0x0743);
++ r8168_mac_ocp_write(tp, 0xFC2C, 0x0801);
++ r8168_mac_ocp_write(tp, 0xFC2E, 0x0BE9);
++ r8168_mac_ocp_write(tp, 0xFC30, 0x02FD);
++ r8168_mac_ocp_write(tp, 0xFC32, 0x0C25);
++ r8168_mac_ocp_write(tp, 0xFC34, 0x00A9);
++ r8168_mac_ocp_write(tp, 0xFC36, 0x012D);
++
+ rtl_hw_aspm_clkreq_enable(tp, true);
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 5c18874614ba..0101ebaecf02 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3036,17 +3036,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ /* Manage oversized TCP frames for GMAC4 device */
+ if (skb_is_gso(skb) && priv->tso) {
+- if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
+- /*
+- * There is no way to determine the number of TSO
+- * capable Queues. Let's use always the Queue 0
+- * because if TSO is supported then at least this
+- * one will be capable.
+- */
+- skb_set_queue_mapping(skb, 0);
+-
++ if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))
+ return stmmac_tso_xmit(skb, dev);
+- }
+ }
+
+ if (unlikely(stmmac_tx_avail(priv, queue) < nfrags + 1)) {
+@@ -3855,6 +3846,23 @@ static int stmmac_setup_tc(struct net_device *ndev, enum tc_setup_type type,
+ }
+ }
+
++static u16 stmmac_select_queue(struct net_device *dev, struct sk_buff *skb,
++ struct net_device *sb_dev,
++ select_queue_fallback_t fallback)
++{
++ if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
++ /*
++ * There is no way to determine the number of TSO
++ * capable Queues. Let's use always the Queue 0
++ * because if TSO is supported then at least this
++ * one will be capable.
++ */
++ return 0;
++ }
++
++ return fallback(dev, skb, NULL) % dev->real_num_tx_queues;
++}
++
+ static int stmmac_set_mac_address(struct net_device *ndev, void *addr)
+ {
+ struct stmmac_priv *priv = netdev_priv(ndev);
+@@ -4097,6 +4105,7 @@ static const struct net_device_ops stmmac_netdev_ops = {
+ .ndo_tx_timeout = stmmac_tx_timeout,
+ .ndo_do_ioctl = stmmac_ioctl,
+ .ndo_setup_tc = stmmac_setup_tc,
++ .ndo_select_queue = stmmac_select_queue,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ .ndo_poll_controller = stmmac_poll_controller,
+ #endif
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index cf6b9b1771f1..cc60ef9634db 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -847,7 +847,6 @@ int netvsc_recv_callback(struct net_device *net,
+ csum_info, vlan, data, len);
+ if (unlikely(!skb)) {
+ ++net_device_ctx->eth_stats.rx_no_memory;
+- rcu_read_unlock();
+ return NVSP_STAT_FAIL;
+ }
+
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 7de88b33d5b9..2c971357e66c 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -869,6 +869,7 @@ static void macsec_reset_skb(struct sk_buff *skb, struct net_device *dev)
+
+ static void macsec_finalize_skb(struct sk_buff *skb, u8 icv_len, u8 hdr_len)
+ {
++ skb->ip_summed = CHECKSUM_NONE;
+ memmove(skb->data + hdr_len, skb->data, 2 * ETH_ALEN);
+ skb_pull(skb, hdr_len);
+ pskb_trim_unique(skb, skb->len - icv_len);
+@@ -1103,10 +1104,9 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
+ }
+
+ skb = skb_unshare(skb, GFP_ATOMIC);
+- if (!skb) {
+- *pskb = NULL;
++ *pskb = skb;
++ if (!skb)
+ return RX_HANDLER_CONSUMED;
+- }
+
+ pulled_sci = pskb_may_pull(skb, macsec_extra_len(true));
+ if (!pulled_sci) {
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 418522aa2f71..998d08ae7431 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -514,7 +514,7 @@ static int sfp_hwmon_read_sensor(struct sfp *sfp, int reg, long *value)
+
+ static void sfp_hwmon_to_rx_power(long *value)
+ {
+- *value = DIV_ROUND_CLOSEST(*value, 100);
++ *value = DIV_ROUND_CLOSEST(*value, 10);
+ }
+
+ static void sfp_hwmon_calibrate(struct sfp *sfp, unsigned int slope, int offset,
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index 449fc52f9a89..9f895083bc0a 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -169,23 +169,29 @@ static int vrf_ip6_local_out(struct net *net, struct sock *sk,
+ static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
+ struct net_device *dev)
+ {
+- const struct ipv6hdr *iph = ipv6_hdr(skb);
++ const struct ipv6hdr *iph;
+ struct net *net = dev_net(skb->dev);
+- struct flowi6 fl6 = {
+- /* needed to match OIF rule */
+- .flowi6_oif = dev->ifindex,
+- .flowi6_iif = LOOPBACK_IFINDEX,
+- .daddr = iph->daddr,
+- .saddr = iph->saddr,
+- .flowlabel = ip6_flowinfo(iph),
+- .flowi6_mark = skb->mark,
+- .flowi6_proto = iph->nexthdr,
+- .flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF,
+- };
++ struct flowi6 fl6;
+ int ret = NET_XMIT_DROP;
+ struct dst_entry *dst;
+ struct dst_entry *dst_null = &net->ipv6.ip6_null_entry->dst;
+
++ if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct ipv6hdr)))
++ goto err;
++
++ iph = ipv6_hdr(skb);
++
++ memset(&fl6, 0, sizeof(fl6));
++ /* needed to match OIF rule */
++ fl6.flowi6_oif = dev->ifindex;
++ fl6.flowi6_iif = LOOPBACK_IFINDEX;
++ fl6.daddr = iph->daddr;
++ fl6.saddr = iph->saddr;
++ fl6.flowlabel = ip6_flowinfo(iph);
++ fl6.flowi6_mark = skb->mark;
++ fl6.flowi6_proto = iph->nexthdr;
++ fl6.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF;
++
+ dst = ip6_route_output(net, NULL, &fl6);
+ if (dst == dst_null)
+ goto err;
+@@ -241,21 +247,27 @@ static int vrf_ip_local_out(struct net *net, struct sock *sk,
+ static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
+ struct net_device *vrf_dev)
+ {
+- struct iphdr *ip4h = ip_hdr(skb);
++ struct iphdr *ip4h;
+ int ret = NET_XMIT_DROP;
+- struct flowi4 fl4 = {
+- /* needed to match OIF rule */
+- .flowi4_oif = vrf_dev->ifindex,
+- .flowi4_iif = LOOPBACK_IFINDEX,
+- .flowi4_tos = RT_TOS(ip4h->tos),
+- .flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_SKIP_NH_OIF,
+- .flowi4_proto = ip4h->protocol,
+- .daddr = ip4h->daddr,
+- .saddr = ip4h->saddr,
+- };
++ struct flowi4 fl4;
+ struct net *net = dev_net(vrf_dev);
+ struct rtable *rt;
+
++ if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr)))
++ goto err;
++
++ ip4h = ip_hdr(skb);
++
++ memset(&fl4, 0, sizeof(fl4));
++ /* needed to match OIF rule */
++ fl4.flowi4_oif = vrf_dev->ifindex;
++ fl4.flowi4_iif = LOOPBACK_IFINDEX;
++ fl4.flowi4_tos = RT_TOS(ip4h->tos);
++ fl4.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_SKIP_NH_OIF;
++ fl4.flowi4_proto = ip4h->protocol;
++ fl4.daddr = ip4h->daddr;
++ fl4.saddr = ip4h->saddr;
++
+ rt = ip_route_output_flow(net, &fl4, NULL);
+ if (IS_ERR(rt))
+ goto err;
+diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
+index f93f9881ec18..46d5c40f2835 100644
+--- a/fs/ext4/dir.c
++++ b/fs/ext4/dir.c
+@@ -108,7 +108,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
+ struct inode *inode = file_inode(file);
+ struct super_block *sb = inode->i_sb;
+ struct buffer_head *bh = NULL;
+- int dir_has_error = 0;
+ struct fscrypt_str fstr = FSTR_INIT(NULL, 0);
+
+ if (ext4_encrypted_inode(inode)) {
+@@ -144,8 +143,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
+ return err;
+ }
+
+- offset = ctx->pos & (sb->s_blocksize - 1);
+-
+ while (ctx->pos < inode->i_size) {
+ struct ext4_map_blocks map;
+
+@@ -154,9 +151,18 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
+ goto errout;
+ }
+ cond_resched();
++ offset = ctx->pos & (sb->s_blocksize - 1);
+ map.m_lblk = ctx->pos >> EXT4_BLOCK_SIZE_BITS(sb);
+ map.m_len = 1;
+ err = ext4_map_blocks(NULL, inode, &map, 0);
++ if (err == 0) {
++ /* m_len should never be zero but let's avoid
++ * an infinite loop if it somehow is */
++ if (map.m_len == 0)
++ map.m_len = 1;
++ ctx->pos += map.m_len * sb->s_blocksize;
++ continue;
++ }
+ if (err > 0) {
+ pgoff_t index = map.m_pblk >>
+ (PAGE_SHIFT - inode->i_blkbits);
+@@ -175,13 +181,6 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
+ }
+
+ if (!bh) {
+- if (!dir_has_error) {
+- EXT4_ERROR_FILE(file, 0,
+- "directory contains a "
+- "hole at offset %llu",
+- (unsigned long long) ctx->pos);
+- dir_has_error = 1;
+- }
+ /* corrupt size? Maybe no more blocks to read */
+ if (ctx->pos > inode->i_blocks << 9)
+ break;
+diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
+index df908ef79cce..402dc366117e 100644
+--- a/fs/ext4/ext4_jbd2.h
++++ b/fs/ext4/ext4_jbd2.h
+@@ -361,20 +361,20 @@ static inline int ext4_journal_force_commit(journal_t *journal)
+ }
+
+ static inline int ext4_jbd2_inode_add_write(handle_t *handle,
+- struct inode *inode)
++ struct inode *inode, loff_t start_byte, loff_t length)
+ {
+ if (ext4_handle_valid(handle))
+- return jbd2_journal_inode_add_write(handle,
+- EXT4_I(inode)->jinode);
++ return jbd2_journal_inode_ranged_write(handle,
++ EXT4_I(inode)->jinode, start_byte, length);
+ return 0;
+ }
+
+ static inline int ext4_jbd2_inode_add_wait(handle_t *handle,
+- struct inode *inode)
++ struct inode *inode, loff_t start_byte, loff_t length)
+ {
+ if (ext4_handle_valid(handle))
+- return jbd2_journal_inode_add_wait(handle,
+- EXT4_I(inode)->jinode);
++ return jbd2_journal_inode_ranged_wait(handle,
++ EXT4_I(inode)->jinode, start_byte, length);
+ return 0;
+ }
+
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 2c5baa5e8291..f4a24a46245e 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -165,6 +165,10 @@ static ssize_t ext4_write_checks(struct kiocb *iocb, struct iov_iter *from)
+ ret = generic_write_checks(iocb, from);
+ if (ret <= 0)
+ return ret;
++
++ if (unlikely(IS_IMMUTABLE(inode)))
++ return -EPERM;
++
+ /*
+ * If we have encountered a bitmap-format file, the size limit
+ * is smaller than s_maxbytes, which is for extent-mapped files.
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 05dc5a4ba481..e65559bf7728 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -729,10 +729,16 @@ out_sem:
+ !(flags & EXT4_GET_BLOCKS_ZERO) &&
+ !ext4_is_quota_file(inode) &&
+ ext4_should_order_data(inode)) {
++ loff_t start_byte =
++ (loff_t)map->m_lblk << inode->i_blkbits;
++ loff_t length = (loff_t)map->m_len << inode->i_blkbits;
++
+ if (flags & EXT4_GET_BLOCKS_IO_SUBMIT)
+- ret = ext4_jbd2_inode_add_wait(handle, inode);
++ ret = ext4_jbd2_inode_add_wait(handle, inode,
++ start_byte, length);
+ else
+- ret = ext4_jbd2_inode_add_write(handle, inode);
++ ret = ext4_jbd2_inode_add_write(handle, inode,
++ start_byte, length);
+ if (ret)
+ return ret;
+ }
+@@ -4058,7 +4064,8 @@ static int __ext4_block_zero_page_range(handle_t *handle,
+ err = 0;
+ mark_buffer_dirty(bh);
+ if (ext4_should_order_data(inode))
+- err = ext4_jbd2_inode_add_write(handle, inode);
++ err = ext4_jbd2_inode_add_write(handle, inode, from,
++ length);
+ }
+
+ unlock:
+@@ -5491,6 +5498,14 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
+ return -EIO;
+
++ if (unlikely(IS_IMMUTABLE(inode)))
++ return -EPERM;
++
++ if (unlikely(IS_APPEND(inode) &&
++ (ia_valid & (ATTR_MODE | ATTR_UID |
++ ATTR_GID | ATTR_TIMES_SET))))
++ return -EPERM;
++
+ error = setattr_prepare(dentry, attr);
+ if (error)
+ return error;
+@@ -6190,6 +6205,9 @@ int ext4_page_mkwrite(struct vm_fault *vmf)
+ get_block_t *get_block;
+ int retries = 0;
+
++ if (unlikely(IS_IMMUTABLE(inode)))
++ return VM_FAULT_SIGBUS;
++
+ sb_start_pagefault(inode->i_sb);
+ file_update_time(vma->vm_file);
+
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 53d57cdf3c4d..abb6fcff0a1d 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -268,6 +268,29 @@ static int uuid_is_zero(__u8 u[16])
+ }
+ #endif
+
++/*
++ * If immutable is set and we are not clearing it, we're not allowed to change
++ * anything else in the inode. Don't error out if we're only trying to set
++ * immutable on an immutable file.
++ */
++static int ext4_ioctl_check_immutable(struct inode *inode, __u32 new_projid,
++ unsigned int flags)
++{
++ struct ext4_inode_info *ei = EXT4_I(inode);
++ unsigned int oldflags = ei->i_flags;
++
++ if (!(oldflags & EXT4_IMMUTABLE_FL) || !(flags & EXT4_IMMUTABLE_FL))
++ return 0;
++
++ if ((oldflags & ~EXT4_IMMUTABLE_FL) != (flags & ~EXT4_IMMUTABLE_FL))
++ return -EPERM;
++ if (ext4_has_feature_project(inode->i_sb) &&
++ __kprojid_val(ei->i_projid) != new_projid)
++ return -EPERM;
++
++ return 0;
++}
++
+ static int ext4_ioctl_setflags(struct inode *inode,
+ unsigned int flags)
+ {
+@@ -321,6 +344,20 @@ static int ext4_ioctl_setflags(struct inode *inode,
+ goto flags_out;
+ }
+
++ /*
++ * Wait for all pending directio and then flush all the dirty pages
++ * for this file. The flush marks all the pages readonly, so any
++ * subsequent attempt to write to the file (particularly mmap pages)
++ * will come through the filesystem and fail.
++ */
++ if (S_ISREG(inode->i_mode) && !IS_IMMUTABLE(inode) &&
++ (flags & EXT4_IMMUTABLE_FL)) {
++ inode_dio_wait(inode);
++ err = filemap_write_and_wait(inode->i_mapping);
++ if (err)
++ goto flags_out;
++ }
++
+ handle = ext4_journal_start(inode, EXT4_HT_INODE, 1);
+ if (IS_ERR(handle)) {
+ err = PTR_ERR(handle);
+@@ -750,7 +787,11 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ return err;
+
+ inode_lock(inode);
+- err = ext4_ioctl_setflags(inode, flags);
++ err = ext4_ioctl_check_immutable(inode,
++ from_kprojid(&init_user_ns, ei->i_projid),
++ flags);
++ if (!err)
++ err = ext4_ioctl_setflags(inode, flags);
+ inode_unlock(inode);
+ mnt_drop_write_file(filp);
+ return err;
+@@ -1120,6 +1161,9 @@ resizefs_out:
+ goto out;
+ flags = (ei->i_flags & ~EXT4_FL_XFLAG_VISIBLE) |
+ (flags & EXT4_FL_XFLAG_VISIBLE);
++ err = ext4_ioctl_check_immutable(inode, fa.fsx_projid, flags);
++ if (err)
++ goto out;
+ err = ext4_ioctl_setflags(inode, flags);
+ if (err)
+ goto out;
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index 2f5be02fc6f6..287631bb09e7 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -390,7 +390,8 @@ data_copy:
+
+ /* Even in case of data=writeback it is reasonable to pin
+ * inode to transaction, to prevent unexpected data loss */
+- *err = ext4_jbd2_inode_add_write(handle, orig_inode);
++ *err = ext4_jbd2_inode_add_write(handle, orig_inode,
++ (loff_t)orig_page_offset << PAGE_SHIFT, replaced_size);
+
+ unlock_pages:
+ unlock_page(pagep[0]);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 4c5aa5df6573..61dc1b0e4465 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -81,8 +81,18 @@ static struct buffer_head *ext4_append(handle_t *handle,
+ static int ext4_dx_csum_verify(struct inode *inode,
+ struct ext4_dir_entry *dirent);
+
++/*
++ * Hints to ext4_read_dirblock regarding whether we expect a directory
++ * block being read to be an index block, or a block containing
++ * directory entries (and if the latter, whether it was found via a
++ * logical block in an htree index block). This is used to control
++ * what sort of sanity checkinig ext4_read_dirblock() will do on the
++ * directory block read from the storage device. EITHER will means
++ * the caller doesn't know what kind of directory block will be read,
++ * so no specific verification will be done.
++ */
+ typedef enum {
+- EITHER, INDEX, DIRENT
++ EITHER, INDEX, DIRENT, DIRENT_HTREE
+ } dirblock_type_t;
+
+ #define ext4_read_dirblock(inode, block, type) \
+@@ -108,11 +118,14 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode,
+
+ return bh;
+ }
+- if (!bh) {
++ if (!bh && (type == INDEX || type == DIRENT_HTREE)) {
+ ext4_error_inode(inode, func, line, block,
+- "Directory hole found");
++ "Directory hole found for htree %s block",
++ (type == INDEX) ? "index" : "leaf");
+ return ERR_PTR(-EFSCORRUPTED);
+ }
++ if (!bh)
++ return NULL;
+ dirent = (struct ext4_dir_entry *) bh->b_data;
+ /* Determine whether or not we have an index block */
+ if (is_dx(inode)) {
+@@ -979,7 +992,7 @@ static int htree_dirblock_to_tree(struct file *dir_file,
+
+ dxtrace(printk(KERN_INFO "In htree dirblock_to_tree: block %lu\n",
+ (unsigned long)block));
+- bh = ext4_read_dirblock(dir, block, DIRENT);
++ bh = ext4_read_dirblock(dir, block, DIRENT_HTREE);
+ if (IS_ERR(bh))
+ return PTR_ERR(bh);
+
+@@ -1509,7 +1522,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
+ return (struct buffer_head *) frame;
+ do {
+ block = dx_get_block(frame->at);
+- bh = ext4_read_dirblock(dir, block, DIRENT);
++ bh = ext4_read_dirblock(dir, block, DIRENT_HTREE);
+ if (IS_ERR(bh))
+ goto errout;
+
+@@ -2079,6 +2092,11 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ blocks = dir->i_size >> sb->s_blocksize_bits;
+ for (block = 0; block < blocks; block++) {
+ bh = ext4_read_dirblock(dir, block, DIRENT);
++ if (bh == NULL) {
++ bh = ext4_bread(handle, dir, block,
++ EXT4_GET_BLOCKS_CREATE);
++ goto add_to_new_block;
++ }
+ if (IS_ERR(bh)) {
+ retval = PTR_ERR(bh);
+ bh = NULL;
+@@ -2099,6 +2117,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ brelse(bh);
+ }
+ bh = ext4_append(handle, dir, &block);
++add_to_new_block:
+ if (IS_ERR(bh)) {
+ retval = PTR_ERR(bh);
+ bh = NULL;
+@@ -2143,7 +2162,7 @@ again:
+ return PTR_ERR(frame);
+ entries = frame->entries;
+ at = frame->at;
+- bh = ext4_read_dirblock(dir, dx_get_block(frame->at), DIRENT);
++ bh = ext4_read_dirblock(dir, dx_get_block(frame->at), DIRENT_HTREE);
+ if (IS_ERR(bh)) {
+ err = PTR_ERR(bh);
+ bh = NULL;
+@@ -2691,7 +2710,10 @@ bool ext4_empty_dir(struct inode *inode)
+ EXT4_ERROR_INODE(inode, "invalid size");
+ return true;
+ }
+- bh = ext4_read_dirblock(inode, 0, EITHER);
++ /* The first directory block must not be a hole,
++ * so treat it as DIRENT_HTREE
++ */
++ bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE);
+ if (IS_ERR(bh))
+ return true;
+
+@@ -2713,6 +2735,10 @@ bool ext4_empty_dir(struct inode *inode)
+ brelse(bh);
+ lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb);
+ bh = ext4_read_dirblock(inode, lblock, EITHER);
++ if (bh == NULL) {
++ offset += sb->s_blocksize;
++ continue;
++ }
+ if (IS_ERR(bh))
+ return true;
+ de = (struct ext4_dir_entry_2 *) bh->b_data;
+@@ -3256,7 +3282,10 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle,
+ struct buffer_head *bh;
+
+ if (!ext4_has_inline_data(inode)) {
+- bh = ext4_read_dirblock(inode, 0, EITHER);
++ /* The first directory block must not be a hole, so
++ * treat it as DIRENT_HTREE
++ */
++ bh = ext4_read_dirblock(inode, 0, DIRENT_HTREE);
+ if (IS_ERR(bh)) {
+ *retval = PTR_ERR(bh);
+ return NULL;
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 65ea0355a4f6..24f86ffe11d7 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -187,14 +187,15 @@ static int journal_wait_on_commit_record(journal_t *journal,
+ * use writepages() because with dealyed allocation we may be doing
+ * block allocation in writepages().
+ */
+-static int journal_submit_inode_data_buffers(struct address_space *mapping)
++static int journal_submit_inode_data_buffers(struct address_space *mapping,
++ loff_t dirty_start, loff_t dirty_end)
+ {
+ int ret;
+ struct writeback_control wbc = {
+ .sync_mode = WB_SYNC_ALL,
+ .nr_to_write = mapping->nrpages * 2,
+- .range_start = 0,
+- .range_end = i_size_read(mapping->host),
++ .range_start = dirty_start,
++ .range_end = dirty_end,
+ };
+
+ ret = generic_writepages(mapping, &wbc);
+@@ -218,6 +219,9 @@ static int journal_submit_data_buffers(journal_t *journal,
+
+ spin_lock(&journal->j_list_lock);
+ list_for_each_entry(jinode, &commit_transaction->t_inode_list, i_list) {
++ loff_t dirty_start = jinode->i_dirty_start;
++ loff_t dirty_end = jinode->i_dirty_end;
++
+ if (!(jinode->i_flags & JI_WRITE_DATA))
+ continue;
+ mapping = jinode->i_vfs_inode->i_mapping;
+@@ -230,7 +234,8 @@ static int journal_submit_data_buffers(journal_t *journal,
+ * only allocated blocks here.
+ */
+ trace_jbd2_submit_inode_data(jinode->i_vfs_inode);
+- err = journal_submit_inode_data_buffers(mapping);
++ err = journal_submit_inode_data_buffers(mapping, dirty_start,
++ dirty_end);
+ if (!ret)
+ ret = err;
+ spin_lock(&journal->j_list_lock);
+@@ -257,12 +262,16 @@ static int journal_finish_inode_data_buffers(journal_t *journal,
+ /* For locking, see the comment in journal_submit_data_buffers() */
+ spin_lock(&journal->j_list_lock);
+ list_for_each_entry(jinode, &commit_transaction->t_inode_list, i_list) {
++ loff_t dirty_start = jinode->i_dirty_start;
++ loff_t dirty_end = jinode->i_dirty_end;
++
+ if (!(jinode->i_flags & JI_WAIT_DATA))
+ continue;
+ jinode->i_flags |= JI_COMMIT_RUNNING;
+ spin_unlock(&journal->j_list_lock);
+- err = filemap_fdatawait_keep_errors(
+- jinode->i_vfs_inode->i_mapping);
++ err = filemap_fdatawait_range_keep_errors(
++ jinode->i_vfs_inode->i_mapping, dirty_start,
++ dirty_end);
+ if (!ret)
+ ret = err;
+ spin_lock(&journal->j_list_lock);
+@@ -282,6 +291,8 @@ static int journal_finish_inode_data_buffers(journal_t *journal,
+ &jinode->i_transaction->t_inode_list);
+ } else {
+ jinode->i_transaction = NULL;
++ jinode->i_dirty_start = 0;
++ jinode->i_dirty_end = 0;
+ }
+ }
+ spin_unlock(&journal->j_list_lock);
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index e9cf88f0bc29..df390a69c49a 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -94,6 +94,8 @@ EXPORT_SYMBOL(jbd2_journal_try_to_free_buffers);
+ EXPORT_SYMBOL(jbd2_journal_force_commit);
+ EXPORT_SYMBOL(jbd2_journal_inode_add_write);
+ EXPORT_SYMBOL(jbd2_journal_inode_add_wait);
++EXPORT_SYMBOL(jbd2_journal_inode_ranged_write);
++EXPORT_SYMBOL(jbd2_journal_inode_ranged_wait);
+ EXPORT_SYMBOL(jbd2_journal_init_jbd_inode);
+ EXPORT_SYMBOL(jbd2_journal_release_jbd_inode);
+ EXPORT_SYMBOL(jbd2_journal_begin_ordered_truncate);
+@@ -2588,6 +2590,8 @@ void jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode)
+ jinode->i_next_transaction = NULL;
+ jinode->i_vfs_inode = inode;
+ jinode->i_flags = 0;
++ jinode->i_dirty_start = 0;
++ jinode->i_dirty_end = 0;
+ INIT_LIST_HEAD(&jinode->i_list);
+ }
+
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index e20a6703531f..911ff18249b7 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -2500,7 +2500,7 @@ void jbd2_journal_refile_buffer(journal_t *journal, struct journal_head *jh)
+ * File inode in the inode list of the handle's transaction
+ */
+ static int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode,
+- unsigned long flags)
++ unsigned long flags, loff_t start_byte, loff_t end_byte)
+ {
+ transaction_t *transaction = handle->h_transaction;
+ journal_t *journal;
+@@ -2512,26 +2512,17 @@ static int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode,
+ jbd_debug(4, "Adding inode %lu, tid:%d\n", jinode->i_vfs_inode->i_ino,
+ transaction->t_tid);
+
+- /*
+- * First check whether inode isn't already on the transaction's
+- * lists without taking the lock. Note that this check is safe
+- * without the lock as we cannot race with somebody removing inode
+- * from the transaction. The reason is that we remove inode from the
+- * transaction only in journal_release_jbd_inode() and when we commit
+- * the transaction. We are guarded from the first case by holding
+- * a reference to the inode. We are safe against the second case
+- * because if jinode->i_transaction == transaction, commit code
+- * cannot touch the transaction because we hold reference to it,
+- * and if jinode->i_next_transaction == transaction, commit code
+- * will only file the inode where we want it.
+- */
+- if ((jinode->i_transaction == transaction ||
+- jinode->i_next_transaction == transaction) &&
+- (jinode->i_flags & flags) == flags)
+- return 0;
+-
+ spin_lock(&journal->j_list_lock);
+ jinode->i_flags |= flags;
++
++ if (jinode->i_dirty_end) {
++ jinode->i_dirty_start = min(jinode->i_dirty_start, start_byte);
++ jinode->i_dirty_end = max(jinode->i_dirty_end, end_byte);
++ } else {
++ jinode->i_dirty_start = start_byte;
++ jinode->i_dirty_end = end_byte;
++ }
++
+ /* Is inode already attached where we need it? */
+ if (jinode->i_transaction == transaction ||
+ jinode->i_next_transaction == transaction)
+@@ -2566,12 +2557,28 @@ done:
+ int jbd2_journal_inode_add_write(handle_t *handle, struct jbd2_inode *jinode)
+ {
+ return jbd2_journal_file_inode(handle, jinode,
+- JI_WRITE_DATA | JI_WAIT_DATA);
++ JI_WRITE_DATA | JI_WAIT_DATA, 0, LLONG_MAX);
+ }
+
+ int jbd2_journal_inode_add_wait(handle_t *handle, struct jbd2_inode *jinode)
+ {
+- return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA);
++ return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA, 0,
++ LLONG_MAX);
++}
++
++int jbd2_journal_inode_ranged_write(handle_t *handle,
++ struct jbd2_inode *jinode, loff_t start_byte, loff_t length)
++{
++ return jbd2_journal_file_inode(handle, jinode,
++ JI_WRITE_DATA | JI_WAIT_DATA, start_byte,
++ start_byte + length - 1);
++}
++
++int jbd2_journal_inode_ranged_wait(handle_t *handle, struct jbd2_inode *jinode,
++ loff_t start_byte, loff_t length)
++{
++ return jbd2_journal_file_inode(handle, jinode, JI_WAIT_DATA,
++ start_byte, start_byte + length - 1);
+ }
+
+ /*
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index d4e1b43a53c3..92420009b9bc 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2651,6 +2651,8 @@ extern int filemap_flush(struct address_space *);
+ extern int filemap_fdatawait_keep_errors(struct address_space *mapping);
+ extern int filemap_fdatawait_range(struct address_space *, loff_t lstart,
+ loff_t lend);
++extern int filemap_fdatawait_range_keep_errors(struct address_space *mapping,
++ loff_t start_byte, loff_t end_byte);
+
+ static inline int filemap_fdatawait(struct address_space *mapping)
+ {
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index 583b82b5a1e9..1cf1b9b8e975 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -454,6 +454,22 @@ struct jbd2_inode {
+ * @i_flags: Flags of inode [j_list_lock]
+ */
+ unsigned long i_flags;
++
++ /**
++ * @i_dirty_start:
++ *
++ * Offset in bytes where the dirty range for this inode starts.
++ * [j_list_lock]
++ */
++ loff_t i_dirty_start;
++
++ /**
++ * @i_dirty_end:
++ *
++ * Inclusive offset in bytes where the dirty range for this inode
++ * ends. [j_list_lock]
++ */
++ loff_t i_dirty_end;
+ };
+
+ struct jbd2_revoke_table_s;
+@@ -1399,6 +1415,12 @@ extern int jbd2_journal_force_commit(journal_t *);
+ extern int jbd2_journal_force_commit_nested(journal_t *);
+ extern int jbd2_journal_inode_add_write(handle_t *handle, struct jbd2_inode *inode);
+ extern int jbd2_journal_inode_add_wait(handle_t *handle, struct jbd2_inode *inode);
++extern int jbd2_journal_inode_ranged_write(handle_t *handle,
++ struct jbd2_inode *inode, loff_t start_byte,
++ loff_t length);
++extern int jbd2_journal_inode_ranged_wait(handle_t *handle,
++ struct jbd2_inode *inode, loff_t start_byte,
++ loff_t length);
+ extern int jbd2_journal_begin_ordered_truncate(journal_t *journal,
+ struct jbd2_inode *inode, loff_t new_size);
+ extern void jbd2_journal_init_jbd_inode(struct jbd2_inode *jinode, struct inode *inode);
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index 42fc852bf512..b22bc81f3669 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -1030,6 +1030,11 @@ static inline int in_software_context(struct perf_event *event)
+ return event->ctx->pmu->task_ctx_nr == perf_sw_context;
+ }
+
++static inline int is_exclusive_pmu(struct pmu *pmu)
++{
++ return pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE;
++}
++
+ extern struct static_key perf_swevent_enabled[PERF_COUNT_SW_MAX];
+
+ extern void ___perf_sw_event(u32, u64, struct pt_regs *, u64);
+diff --git a/include/net/dst.h b/include/net/dst.h
+index 6cf0870414c7..ffc8ee0ea5e5 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -313,8 +313,9 @@ static inline bool dst_hold_safe(struct dst_entry *dst)
+ * @skb: buffer
+ *
+ * If dst is not yet refcounted and not destroyed, grab a ref on it.
++ * Returns true if dst is refcounted.
+ */
+-static inline void skb_dst_force(struct sk_buff *skb)
++static inline bool skb_dst_force(struct sk_buff *skb)
+ {
+ if (skb_dst_is_noref(skb)) {
+ struct dst_entry *dst = skb_dst(skb);
+@@ -325,6 +326,8 @@ static inline void skb_dst_force(struct sk_buff *skb)
+
+ skb->_skb_refdst = (unsigned long)dst;
+ }
++
++ return skb->_skb_refdst != 0UL;
+ }
+
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index e75661f92daa..abcf53a6db04 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1054,7 +1054,8 @@ void tcp_get_default_congestion_control(struct net *net, char *name);
+ void tcp_get_available_congestion_control(char *buf, size_t len);
+ void tcp_get_allowed_congestion_control(char *buf, size_t len);
+ int tcp_set_allowed_congestion_control(char *allowed);
+-int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit);
++int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,
++ bool reinit, bool cap_net_admin);
+ u32 tcp_slow_start(struct tcp_sock *tp, u32 acked);
+ void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked);
+
+@@ -1646,6 +1647,11 @@ static inline struct sk_buff *tcp_rtx_queue_head(const struct sock *sk)
+ return skb_rb_first(&sk->tcp_rtx_queue);
+ }
+
++static inline struct sk_buff *tcp_rtx_queue_tail(const struct sock *sk)
++{
++ return skb_rb_last(&sk->tcp_rtx_queue);
++}
++
+ static inline struct sk_buff *tcp_write_queue_head(const struct sock *sk)
+ {
+ return skb_peek(&sk->sk_write_queue);
+diff --git a/include/net/tls.h b/include/net/tls.h
+index 954110575891..98f5ad0319a2 100644
+--- a/include/net/tls.h
++++ b/include/net/tls.h
+@@ -234,6 +234,7 @@ struct tls_offload_context_rx {
+ (ALIGN(sizeof(struct tls_offload_context_rx), sizeof(void *)) + \
+ TLS_DRIVER_STATE_SIZE)
+
++void tls_ctx_free(struct tls_context *ctx);
+ int wait_on_pending_writer(struct sock *sk, long *timeo);
+ int tls_sk_query(struct sock *sk, int optname, char __user *optval,
+ int __user *optlen);
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 3b61ff40bfe2..e8979c72514b 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -2541,6 +2541,9 @@ unlock:
+ return ret;
+ }
+
++static bool exclusive_event_installable(struct perf_event *event,
++ struct perf_event_context *ctx);
++
+ /*
+ * Attach a performance event to a context.
+ *
+@@ -2555,6 +2558,8 @@ perf_install_in_context(struct perf_event_context *ctx,
+
+ lockdep_assert_held(&ctx->mutex);
+
++ WARN_ON_ONCE(!exclusive_event_installable(event, ctx));
++
+ if (event->cpu != -1)
+ event->cpu = cpu;
+
+@@ -4341,7 +4346,7 @@ static int exclusive_event_init(struct perf_event *event)
+ {
+ struct pmu *pmu = event->pmu;
+
+- if (!(pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE))
++ if (!is_exclusive_pmu(pmu))
+ return 0;
+
+ /*
+@@ -4372,7 +4377,7 @@ static void exclusive_event_destroy(struct perf_event *event)
+ {
+ struct pmu *pmu = event->pmu;
+
+- if (!(pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE))
++ if (!is_exclusive_pmu(pmu))
+ return;
+
+ /* see comment in exclusive_event_init() */
+@@ -4392,14 +4397,15 @@ static bool exclusive_event_match(struct perf_event *e1, struct perf_event *e2)
+ return false;
+ }
+
+-/* Called under the same ctx::mutex as perf_install_in_context() */
+ static bool exclusive_event_installable(struct perf_event *event,
+ struct perf_event_context *ctx)
+ {
+ struct perf_event *iter_event;
+ struct pmu *pmu = event->pmu;
+
+- if (!(pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE))
++ lockdep_assert_held(&ctx->mutex);
++
++ if (!is_exclusive_pmu(pmu))
+ return true;
+
+ list_for_each_entry(iter_event, &ctx->event_list, event_entry) {
+@@ -4446,12 +4452,20 @@ static void _free_event(struct perf_event *event)
+ if (event->destroy)
+ event->destroy(event);
+
+- if (event->ctx)
+- put_ctx(event->ctx);
+-
++ /*
++ * Must be after ->destroy(), due to uprobe_perf_close() using
++ * hw.target.
++ */
+ if (event->hw.target)
+ put_task_struct(event->hw.target);
+
++ /*
++ * perf_event_free_task() relies on put_ctx() being 'last', in particular
++ * all task references must be cleaned up.
++ */
++ if (event->ctx)
++ put_ctx(event->ctx);
++
+ exclusive_event_destroy(event);
+ module_put(event->pmu->module);
+
+@@ -4631,8 +4645,17 @@ again:
+ mutex_unlock(&event->child_mutex);
+
+ list_for_each_entry_safe(child, tmp, &free_list, child_list) {
++ void *var = &child->ctx->refcount;
++
+ list_del(&child->child_list);
+ free_event(child);
++
++ /*
++ * Wake any perf_event_free_task() waiting for this event to be
++ * freed.
++ */
++ smp_mb(); /* pairs with wait_var_event() */
++ wake_up_var(var);
+ }
+
+ no_ctx:
+@@ -10613,11 +10636,6 @@ SYSCALL_DEFINE5(perf_event_open,
+ goto err_alloc;
+ }
+
+- if ((pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE) && group_leader) {
+- err = -EBUSY;
+- goto err_context;
+- }
+-
+ /*
+ * Look up the group leader (we will attach this event to it):
+ */
+@@ -10705,6 +10723,18 @@ SYSCALL_DEFINE5(perf_event_open,
+ move_group = 0;
+ }
+ }
++
++ /*
++ * Failure to create exclusive events returns -EBUSY.
++ */
++ err = -EBUSY;
++ if (!exclusive_event_installable(group_leader, ctx))
++ goto err_locked;
++
++ for_each_sibling_event(sibling, group_leader) {
++ if (!exclusive_event_installable(sibling, ctx))
++ goto err_locked;
++ }
+ } else {
+ mutex_lock(&ctx->mutex);
+ }
+@@ -10741,9 +10771,6 @@ SYSCALL_DEFINE5(perf_event_open,
+ * because we need to serialize with concurrent event creation.
+ */
+ if (!exclusive_event_installable(event, ctx)) {
+- /* exclusive and group stuff are assumed mutually exclusive */
+- WARN_ON_ONCE(move_group);
+-
+ err = -EBUSY;
+ goto err_locked;
+ }
+@@ -11210,11 +11237,11 @@ static void perf_free_event(struct perf_event *event,
+ }
+
+ /*
+- * Free an unexposed, unused context as created by inheritance by
+- * perf_event_init_task below, used by fork() in case of fail.
++ * Free a context as created by inheritance by perf_event_init_task() below,
++ * used by fork() in case of fail.
+ *
+- * Not all locks are strictly required, but take them anyway to be nice and
+- * help out with the lockdep assertions.
++ * Even though the task has never lived, the context and events have been
++ * exposed through the child_list, so we must take care tearing it all down.
+ */
+ void perf_event_free_task(struct task_struct *task)
+ {
+@@ -11244,7 +11271,23 @@ void perf_event_free_task(struct task_struct *task)
+ perf_free_event(event, ctx);
+
+ mutex_unlock(&ctx->mutex);
+- put_ctx(ctx);
++
++ /*
++ * perf_event_release_kernel() could've stolen some of our
++ * child events and still have them on its free_list. In that
++ * case we must wait for these events to have been freed (in
++ * particular all their references to this task must've been
++ * dropped).
++ *
++ * Without this copy_process() will unconditionally free this
++ * task (irrespective of its reference count) and
++ * _free_event()'s put_task_struct(event->hw.target) will be a
++ * use-after-free.
++ *
++ * Wait for all events to drop their context reference.
++ */
++ wait_var_event(&ctx->refcount, atomic_read(&ctx->refcount) == 1);
++ put_ctx(ctx); /* must be last */
+ }
+ }
+
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 52517f28e6f4..287f3fa02e5e 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -561,6 +561,28 @@ int filemap_fdatawait_range(struct address_space *mapping, loff_t start_byte,
+ }
+ EXPORT_SYMBOL(filemap_fdatawait_range);
+
++/**
++ * filemap_fdatawait_range_keep_errors - wait for writeback to complete
++ * @mapping: address space structure to wait for
++ * @start_byte: offset in bytes where the range starts
++ * @end_byte: offset in bytes where the range ends (inclusive)
++ *
++ * Walk the list of under-writeback pages of the given address space in the
++ * given range and wait for all of them. Unlike filemap_fdatawait_range(),
++ * this function does not clear error status of the address space.
++ *
++ * Use this function if callers don't handle errors themselves. Expected
++ * call sites are system-wide / filesystem-wide data flushers: e.g. sync(2),
++ * fsfreeze(8)
++ */
++int filemap_fdatawait_range_keep_errors(struct address_space *mapping,
++ loff_t start_byte, loff_t end_byte)
++{
++ __filemap_fdatawait_range(mapping, start_byte, end_byte);
++ return filemap_check_and_keep_errors(mapping);
++}
++EXPORT_SYMBOL(filemap_fdatawait_range_keep_errors);
++
+ /**
+ * file_fdatawait_range - wait for writeback to complete
+ * @file: file pointing to address space structure to wait for
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index e42f44cf7b43..576379e87421 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2190,7 +2190,7 @@ static void shrink_active_list(unsigned long nr_to_scan,
+ * 10TB 320 32GB
+ */
+ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
+- struct scan_control *sc, bool actual_reclaim)
++ struct scan_control *sc, bool trace)
+ {
+ enum lru_list active_lru = file * LRU_FILE + LRU_ACTIVE;
+ struct pglist_data *pgdat = lruvec_pgdat(lruvec);
+@@ -2216,7 +2216,7 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
+ * rid of the stale workingset quickly.
+ */
+ refaults = lruvec_page_state(lruvec, WORKINGSET_ACTIVATE);
+- if (file && actual_reclaim && lruvec->refaults != refaults) {
++ if (file && lruvec->refaults != refaults) {
+ inactive_ratio = 0;
+ } else {
+ gb = (inactive + active) >> (30 - PAGE_SHIFT);
+@@ -2226,7 +2226,7 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
+ inactive_ratio = 1;
+ }
+
+- if (actual_reclaim)
++ if (trace)
+ trace_mm_vmscan_inactive_list_is_low(pgdat->node_id, sc->reclaim_idx,
+ lruvec_lru_size(lruvec, inactive_lru, MAX_NR_ZONES), inactive,
+ lruvec_lru_size(lruvec, active_lru, MAX_NR_ZONES), active,
+diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
+index fed0ff446abb..2532c1a19645 100644
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -79,7 +79,6 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
+ struct net_bridge_fdb_entry *dst = NULL;
+ struct net_bridge_mdb_entry *mdst;
+ bool local_rcv, mcast_hit = false;
+- const unsigned char *dest;
+ struct net_bridge *br;
+ u16 vid = 0;
+
+@@ -97,10 +96,9 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
+ br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false);
+
+ local_rcv = !!(br->dev->flags & IFF_PROMISC);
+- dest = eth_hdr(skb)->h_dest;
+- if (is_multicast_ether_addr(dest)) {
++ if (is_multicast_ether_addr(eth_hdr(skb)->h_dest)) {
+ /* by definition the broadcast is also a multicast address */
+- if (is_broadcast_ether_addr(dest)) {
++ if (is_broadcast_ether_addr(eth_hdr(skb)->h_dest)) {
+ pkt_type = BR_PKT_BROADCAST;
+ local_rcv = true;
+ } else {
+@@ -150,7 +148,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
+ }
+ break;
+ case BR_PKT_UNICAST:
+- dst = br_fdb_find_rcu(br, dest, vid);
++ dst = br_fdb_find_rcu(br, eth_hdr(skb)->h_dest, vid);
+ default:
+ break;
+ }
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 75901c4641b1..fb54d32321ec 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1147,6 +1147,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
+ int type;
+ int err = 0;
+ __be32 group;
++ u16 nsrcs;
+
+ ih = igmpv3_report_hdr(skb);
+ num = ntohs(ih->ngrec);
+@@ -1160,8 +1161,9 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
+ grec = (void *)(skb->data + len - sizeof(*grec));
+ group = grec->grec_mca;
+ type = grec->grec_type;
++ nsrcs = ntohs(grec->grec_nsrcs);
+
+- len += ntohs(grec->grec_nsrcs) * 4;
++ len += nsrcs * 4;
+ if (!pskb_may_pull(skb, len))
+ return -EINVAL;
+
+@@ -1182,7 +1184,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
+ src = eth_hdr(skb)->h_source;
+ if ((type == IGMPV3_CHANGE_TO_INCLUDE ||
+ type == IGMPV3_MODE_IS_INCLUDE) &&
+- ntohs(grec->grec_nsrcs) == 0) {
++ nsrcs == 0) {
+ br_ip4_multicast_leave_group(br, port, group, vid, src);
+ } else {
+ err = br_ip4_multicast_add_group(br, port, group, vid,
+@@ -1217,23 +1219,26 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
+ len = skb_transport_offset(skb) + sizeof(*icmp6h);
+
+ for (i = 0; i < num; i++) {
+- __be16 *nsrcs, _nsrcs;
+-
+- nsrcs = skb_header_pointer(skb,
+- len + offsetof(struct mld2_grec,
+- grec_nsrcs),
+- sizeof(_nsrcs), &_nsrcs);
+- if (!nsrcs)
++ __be16 *_nsrcs, __nsrcs;
++ u16 nsrcs;
++
++ _nsrcs = skb_header_pointer(skb,
++ len + offsetof(struct mld2_grec,
++ grec_nsrcs),
++ sizeof(__nsrcs), &__nsrcs);
++ if (!_nsrcs)
+ return -EINVAL;
+
++ nsrcs = ntohs(*_nsrcs);
++
+ if (!pskb_may_pull(skb,
+ len + sizeof(*grec) +
+- sizeof(struct in6_addr) * ntohs(*nsrcs)))
++ sizeof(struct in6_addr) * nsrcs))
+ return -EINVAL;
+
+ grec = (struct mld2_grec *)(skb->data + len);
+ len += sizeof(*grec) +
+- sizeof(struct in6_addr) * ntohs(*nsrcs);
++ sizeof(struct in6_addr) * nsrcs;
+
+ /* We treat these as MLDv1 reports for now. */
+ switch (grec->grec_type) {
+@@ -1252,7 +1257,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
+ src = eth_hdr(skb)->h_source;
+ if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE ||
+ grec->grec_type == MLD2_MODE_IS_INCLUDE) &&
+- ntohs(*nsrcs) == 0) {
++ nsrcs == 0) {
+ br_ip6_multicast_leave_group(br, port, &grec->grec_mca,
+ vid, src);
+ } else {
+@@ -1505,7 +1510,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
+ struct sk_buff *skb,
+ u16 vid)
+ {
+- const struct ipv6hdr *ip6h = ipv6_hdr(skb);
+ struct mld_msg *mld;
+ struct net_bridge_mdb_entry *mp;
+ struct mld2_query *mld2q;
+@@ -1549,7 +1553,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
+
+ if (is_general_query) {
+ saddr.proto = htons(ETH_P_IPV6);
+- saddr.u.ip6 = ip6h->saddr;
++ saddr.u.ip6 = ipv6_hdr(skb)->saddr;
+
+ br_multicast_query_received(br, port, &br->ip6_other_query,
+ &saddr, max_delay);
+diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
+index 1b75d6bf12bd..37ddcea3fc96 100644
+--- a/net/bridge/br_stp_bpdu.c
++++ b/net/bridge/br_stp_bpdu.c
+@@ -147,7 +147,6 @@ void br_send_tcn_bpdu(struct net_bridge_port *p)
+ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
+ struct net_device *dev)
+ {
+- const unsigned char *dest = eth_hdr(skb)->h_dest;
+ struct net_bridge_port *p;
+ struct net_bridge *br;
+ const unsigned char *buf;
+@@ -176,7 +175,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
+ if (p->state == BR_STATE_DISABLED)
+ goto out;
+
+- if (!ether_addr_equal(dest, br->group_addr))
++ if (!ether_addr_equal(eth_hdr(skb)->h_dest, br->group_addr))
+ goto out;
+
+ if (p->flags & BR_BPDU_GUARD) {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 34ec9324737b..c996380f2959 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3991,7 +3991,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ TCP_CA_NAME_MAX-1));
+ name[TCP_CA_NAME_MAX-1] = 0;
+ ret = tcp_set_congestion_control(sk, name, false,
+- reinit);
++ reinit, true);
+ } else {
+ struct tcp_sock *tp = tcp_sk(sk);
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index cd9e991f21d7..c52d6e6b341c 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1021,6 +1021,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+
+ atomic_set(&neigh->probes,
+ NEIGH_VAR(neigh->parms, UCAST_PROBES));
++ neigh_del_timer(neigh);
+ neigh->nud_state = NUD_INCOMPLETE;
+ neigh->updated = now;
+ next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
+@@ -1037,6 +1038,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+ }
+ } else if (neigh->nud_state & NUD_STALE) {
+ neigh_dbg(2, "neigh %p is delayed\n", neigh);
++ neigh_del_timer(neigh);
+ neigh->nud_state = NUD_DELAY;
+ neigh->updated = jiffies;
+ neigh_add_timer(neigh, jiffies +
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index ea4bd8a52422..d23746143cd2 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -66,6 +66,11 @@
+ #include <net/net_namespace.h>
+ #include <net/addrconf.h>
+
++#define IPV6ONLY_FLAGS \
++ (IFA_F_NODAD | IFA_F_OPTIMISTIC | IFA_F_DADFAILED | \
++ IFA_F_HOMEADDRESS | IFA_F_TENTATIVE | \
++ IFA_F_MANAGETEMPADDR | IFA_F_STABLE_PRIVACY)
++
+ static struct ipv4_devconf ipv4_devconf = {
+ .data = {
+ [IPV4_DEVCONF_ACCEPT_REDIRECTS - 1] = 1,
+@@ -462,6 +467,9 @@ static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh,
+ ifa->ifa_flags &= ~IFA_F_SECONDARY;
+ last_primary = &in_dev->ifa_list;
+
++ /* Don't set IPv6 only flags to IPv4 addresses */
++ ifa->ifa_flags &= ~IPV6ONLY_FLAGS;
++
+ for (ifap = &in_dev->ifa_list; (ifa1 = *ifap) != NULL;
+ ifap = &ifa1->ifa_next) {
+ if (!(ifa1->ifa_flags & IFA_F_SECONDARY) &&
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index d187ee8156a1..b2240b7f225d 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -1218,12 +1218,8 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
+ if (pmc) {
+ im->interface = pmc->interface;
+ if (im->sfmode == MCAST_INCLUDE) {
+- im->tomb = pmc->tomb;
+- pmc->tomb = NULL;
+-
+- im->sources = pmc->sources;
+- pmc->sources = NULL;
+-
++ swap(im->tomb, pmc->tomb);
++ swap(im->sources, pmc->sources);
+ for (psf = im->sources; psf; psf = psf->sf_next)
+ psf->sf_crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
+ } else {
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 364e6fdaa38f..b7ef367fe6a1 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2594,6 +2594,8 @@ int tcp_disconnect(struct sock *sk, int flags)
+ tcp_saved_syn_free(tp);
+ tp->compressed_ack = 0;
+ tp->bytes_sent = 0;
++ tp->bytes_acked = 0;
++ tp->bytes_received = 0;
+ tp->bytes_retrans = 0;
+ tp->dsack_dups = 0;
+ tp->reord_seen = 0;
+@@ -2729,7 +2731,9 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ name[val] = 0;
+
+ lock_sock(sk);
+- err = tcp_set_congestion_control(sk, name, true, true);
++ err = tcp_set_congestion_control(sk, name, true, true,
++ ns_capable(sock_net(sk)->user_ns,
++ CAP_NET_ADMIN));
+ release_sock(sk);
+ return err;
+ }
+diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
+index bc6c02f16243..48f79db446a0 100644
+--- a/net/ipv4/tcp_cong.c
++++ b/net/ipv4/tcp_cong.c
+@@ -332,7 +332,8 @@ out:
+ * tcp_reinit_congestion_control (if the current congestion control was
+ * already initialized.
+ */
+-int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit)
++int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,
++ bool reinit, bool cap_net_admin)
+ {
+ struct inet_connection_sock *icsk = inet_csk(sk);
+ const struct tcp_congestion_ops *ca;
+@@ -368,8 +369,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, boo
+ } else {
+ err = -EBUSY;
+ }
+- } else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) ||
+- ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))) {
++ } else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) || cap_net_admin)) {
+ err = -EPERM;
+ } else if (!try_module_get(ca->owner)) {
+ err = -EBUSY;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 221d9b72423b..88c7e821fd11 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1289,6 +1289,7 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct sk_buff *buff;
+ int nsize, old_factor;
++ long limit;
+ int nlen;
+ u8 flags;
+
+@@ -1299,8 +1300,16 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
+ if (nsize < 0)
+ nsize = 0;
+
+- if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf &&
+- tcp_queue != TCP_FRAG_IN_WRITE_QUEUE)) {
++ /* tcp_sendmsg() can overshoot sk_wmem_queued by one full size skb.
++ * We need some allowance to not penalize applications setting small
++ * SO_SNDBUF values.
++ * Also allow first and last skb in retransmit queue to be split.
++ */
++ limit = sk->sk_sndbuf + 2 * SKB_TRUESIZE(GSO_MAX_SIZE);
++ if (unlikely((sk->sk_wmem_queued >> 1) > limit &&
++ tcp_queue != TCP_FRAG_IN_WRITE_QUEUE &&
++ skb != tcp_rtx_queue_head(sk) &&
++ skb != tcp_rtx_queue_tail(sk))) {
+ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG);
+ return -ENOMEM;
+ }
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index a6c0479c1d55..bbb5ffb3397d 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -1081,8 +1081,24 @@ add:
+ err = call_fib6_entry_notifiers(info->nl_net,
+ FIB_EVENT_ENTRY_ADD,
+ rt, extack);
+- if (err)
++ if (err) {
++ struct fib6_info *sibling, *next_sibling;
++
++ /* If the route has siblings, then it first
++ * needs to be unlinked from them.
++ */
++ if (!rt->fib6_nsiblings)
++ return err;
++
++ list_for_each_entry_safe(sibling, next_sibling,
++ &rt->fib6_siblings,
++ fib6_siblings)
++ sibling->fib6_nsiblings--;
++ rt->fib6_nsiblings = 0;
++ list_del_init(&rt->fib6_siblings);
++ rt6_multipath_rebalance(next_sibling);
+ return err;
++ }
+
+ rcu_assign_pointer(rt->fib6_next, iter);
+ atomic_inc(&rt->fib6_ref);
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 24f7b2cf504b..81220077d62f 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2214,7 +2214,7 @@ static struct dst_entry *rt6_check(struct rt6_info *rt,
+ {
+ u32 rt_cookie = 0;
+
+- if ((from && !fib6_get_cookie_safe(from, &rt_cookie)) ||
++ if (!from || !fib6_get_cookie_safe(from, &rt_cookie) ||
+ rt_cookie != cookie)
+ return NULL;
+
+diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
+index 7569ba00e732..a96a8c16baf9 100644
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -174,6 +174,11 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
+ goto err;
+ }
+
++ if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) {
++ status = -ENETDOWN;
++ goto err;
++ }
++
+ *entry = (struct nf_queue_entry) {
+ .skb = skb,
+ .state = *state,
+@@ -182,7 +187,6 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
+ };
+
+ nf_queue_entry_get_refs(entry);
+- skb_dst_force(skb);
+
+ switch (entry->state.pf) {
+ case AF_INET:
+diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
+index 71ffd1a6dc7c..43910e50752c 100644
+--- a/net/netrom/af_netrom.c
++++ b/net/netrom/af_netrom.c
+@@ -872,7 +872,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+ unsigned short frametype, flags, window, timeout;
+ int ret;
+
+- skb->sk = NULL; /* Initially we don't know who it's for */
++ skb_orphan(skb);
+
+ /*
+ * skb->data points to the netrom frame start
+@@ -970,7 +970,9 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
+
+ window = skb->data[20];
+
++ sock_hold(make);
+ skb->sk = make;
++ skb->destructor = sock_efree;
+ make->sk_state = TCP_ESTABLISHED;
+
+ /* Fill in his circuit details */
+diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
+index 908f25e3773e..5405d073804c 100644
+--- a/net/nfc/nci/data.c
++++ b/net/nfc/nci/data.c
+@@ -119,7 +119,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev,
+ conn_info = nci_get_conn_info_by_conn_id(ndev, conn_id);
+ if (!conn_info) {
+ rc = -EPROTO;
+- goto free_exit;
++ goto exit;
+ }
+
+ __skb_queue_head_init(&frags_q);
+diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
+index 85ae53d8fd09..8211e8e97c96 100644
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -175,8 +175,7 @@ static void update_ethertype(struct sk_buff *skb, struct ethhdr *hdr,
+ if (skb->ip_summed == CHECKSUM_COMPLETE) {
+ __be16 diff[] = { ~(hdr->h_proto), ethertype };
+
+- skb->csum = ~csum_partial((char *)diff, sizeof(diff),
+- ~skb->csum);
++ skb->csum = csum_partial((char *)diff, sizeof(diff), skb->csum);
+ }
+
+ hdr->h_proto = ethertype;
+@@ -268,8 +267,7 @@ static int set_mpls(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ if (skb->ip_summed == CHECKSUM_COMPLETE) {
+ __be32 diff[] = { ~(stack->label_stack_entry), lse };
+
+- skb->csum = ~csum_partial((char *)diff, sizeof(diff),
+- ~skb->csum);
++ skb->csum = csum_partial((char *)diff, sizeof(diff), skb->csum);
+ }
+
+ stack->label_stack_entry = lse;
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index 3c39b8805d01..d76e5e58905d 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -552,6 +552,7 @@ static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len)
+
+ switch (rx->sk.sk_state) {
+ case RXRPC_UNBOUND:
++ case RXRPC_CLIENT_UNBOUND:
+ rx->srx.srx_family = AF_RXRPC;
+ rx->srx.srx_service = 0;
+ rx->srx.transport_type = SOCK_DGRAM;
+@@ -576,10 +577,9 @@ static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len)
+ }
+
+ rx->local = local;
+- rx->sk.sk_state = RXRPC_CLIENT_UNBOUND;
++ rx->sk.sk_state = RXRPC_CLIENT_BOUND;
+ /* Fall through */
+
+- case RXRPC_CLIENT_UNBOUND:
+ case RXRPC_CLIENT_BOUND:
+ if (!m->msg_name &&
+ test_bit(RXRPC_SOCK_CONNECTED, &rx->flags)) {
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 2167c6ca55e3..4159bcb479c6 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -1325,6 +1325,9 @@ replay:
+ tcf_chain_tp_insert(chain, &chain_info, tp);
+ tfilter_notify(net, skb, n, tp, block, q, parent, fh,
+ RTM_NEWTFILTER, false);
++ /* q pointer is NULL for shared blocks */
++ if (q)
++ q->flags &= ~TCQ_F_CAN_BYPASS;
+ } else {
+ if (tp_created)
+ tcf_proto_destroy(tp, NULL);
+diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
+index 6c0a9d5dbf94..137692cb8b4f 100644
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -600,8 +600,6 @@ static unsigned long fq_codel_find(struct Qdisc *sch, u32 classid)
+ static unsigned long fq_codel_bind(struct Qdisc *sch, unsigned long parent,
+ u32 classid)
+ {
+- /* we cannot bypass queue discipline anymore */
+- sch->flags &= ~TCQ_F_CAN_BYPASS;
+ return 0;
+ }
+
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index 2f2678197760..650f21463853 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -828,8 +828,6 @@ static unsigned long sfq_find(struct Qdisc *sch, u32 classid)
+ static unsigned long sfq_bind(struct Qdisc *sch, unsigned long parent,
+ u32 classid)
+ {
+- /* we cannot bypass queue discipline anymore */
+- sch->flags &= ~TCQ_F_CAN_BYPASS;
+ return 0;
+ }
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 8c00a7ef1bcd..9f5b4e547b63 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4507,34 +4507,18 @@ out_nounlock:
+ static int sctp_connect(struct sock *sk, struct sockaddr *addr,
+ int addr_len, int flags)
+ {
+- struct inet_sock *inet = inet_sk(sk);
+ struct sctp_af *af;
+- int err = 0;
++ int err = -EINVAL;
+
+ lock_sock(sk);
+
+ pr_debug("%s: sk:%p, sockaddr:%p, addr_len:%d\n", __func__, sk,
+ addr, addr_len);
+
+- /* We may need to bind the socket. */
+- if (!inet->inet_num) {
+- if (sk->sk_prot->get_port(sk, 0)) {
+- release_sock(sk);
+- return -EAGAIN;
+- }
+- inet->inet_sport = htons(inet->inet_num);
+- }
+-
+ /* Validate addr_len before calling common connect/connectx routine. */
+ af = sctp_get_af_specific(addr->sa_family);
+- if (!af || addr_len < af->sockaddr_len) {
+- err = -EINVAL;
+- } else {
+- /* Pass correct addr len to common routine (so it knows there
+- * is only one address being passed.
+- */
++ if (af && addr_len >= af->sockaddr_len)
+ err = __sctp_connect(sk, addr, af->sockaddr_len, flags, NULL);
+- }
+
+ release_sock(sk);
+ return err;
+diff --git a/net/sctp/stream.c b/net/sctp/stream.c
+index 3b47457862cc..0da57938a6c5 100644
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -253,13 +253,20 @@ out:
+ int sctp_stream_init_ext(struct sctp_stream *stream, __u16 sid)
+ {
+ struct sctp_stream_out_ext *soute;
++ int ret;
+
+ soute = kzalloc(sizeof(*soute), GFP_KERNEL);
+ if (!soute)
+ return -ENOMEM;
+ SCTP_SO(stream, sid)->ext = soute;
+
+- return sctp_sched_init_sid(stream, sid, GFP_KERNEL);
++ ret = sctp_sched_init_sid(stream, sid, GFP_KERNEL);
++ if (ret) {
++ kfree(SCTP_SO(stream, sid)->ext);
++ SCTP_SO(stream, sid)->ext = NULL;
++ }
++
++ return ret;
+ }
+
+ void sctp_stream_free(struct sctp_stream *stream)
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index ead29c2aefa7..0a613e0ef3bf 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -61,7 +61,7 @@ static void tls_device_free_ctx(struct tls_context *ctx)
+ if (ctx->rx_conf == TLS_HW)
+ kfree(tls_offload_ctx_rx(ctx));
+
+- kfree(ctx);
++ tls_ctx_free(ctx);
+ }
+
+ static void tls_device_gc_task(struct work_struct *work)
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index 25b3fb585777..4c0ac79f82d4 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -241,7 +241,7 @@ static void tls_write_space(struct sock *sk)
+ ctx->sk_write_space(sk);
+ }
+
+-static void tls_ctx_free(struct tls_context *ctx)
++void tls_ctx_free(struct tls_context *ctx)
+ {
+ if (!ctx)
+ return;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-07-31 10:22 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-07-31 10:22 UTC (permalink / raw
To: gentoo-commits
commit: bba20b5be2b932524ed1365df0c4f25c29ac4a74
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 31 10:12:54 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 31 10:12:54 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bba20b5b
Linux patch 4.19.63
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 8 +-
1062_linux-4.19.63.patch | 3299 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3305 insertions(+), 2 deletions(-)
diff --git a/0000_README b/0000_README
index 6ff7ffd..2e505ed 100644
--- a/0000_README
+++ b/0000_README
@@ -283,14 +283,18 @@ Patch: 1059_linux-4.19.60.patch
From: https://www.kernel.org
Desc: Linux 4.19.60
-Patch: 1060-4.19.61.patch
+Patch: 1060_linux-4.19.61.patch
From: https://www.kernel.org
Desc: Linux 4.19.61
-Patch: 1061-4.19.62.patch
+Patch: 1061_linux-4.19.62.patch
From: https://www.kernel.org
Desc: Linux 4.19.62
+Patch: 1062_linux-4.19.63.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.63
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1062_linux-4.19.63.patch b/1062_linux-4.19.63.patch
new file mode 100644
index 0000000..b523869
--- /dev/null
+++ b/1062_linux-4.19.63.patch
@@ -0,0 +1,3299 @@
+diff --git a/Makefile b/Makefile
+index a4463d880ae2..8ad77a93de30 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 62
++SUBLEVEL = 63
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -491,6 +491,7 @@ ifneq ($(GCC_TOOLCHAIN),)
+ CLANG_FLAGS += --gcc-toolchain=$(GCC_TOOLCHAIN)
+ endif
+ CLANG_FLAGS += -no-integrated-as
++CLANG_FLAGS += -Werror=unknown-warning-option
+ KBUILD_CFLAGS += $(CLANG_FLAGS)
+ KBUILD_AFLAGS += $(CLANG_FLAGS)
+ export CLANG_FLAGS
+diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
+index f90f5d83b228..5a97ac853168 100644
+--- a/arch/arm64/include/asm/assembler.h
++++ b/arch/arm64/include/asm/assembler.h
+@@ -112,7 +112,11 @@
+ * RAS Error Synchronization barrier
+ */
+ .macro esb
++#ifdef CONFIG_ARM64_RAS_EXTN
+ hint #16
++#else
++ nop
++#endif
+ .endm
+
+ /*
+diff --git a/arch/powerpc/boot/xz_config.h b/arch/powerpc/boot/xz_config.h
+index e22e5b3770dd..ebfadd39e192 100644
+--- a/arch/powerpc/boot/xz_config.h
++++ b/arch/powerpc/boot/xz_config.h
+@@ -20,10 +20,30 @@ static inline uint32_t swab32p(void *p)
+
+ #ifdef __LITTLE_ENDIAN__
+ #define get_le32(p) (*((uint32_t *) (p)))
++#define cpu_to_be32(x) swab32(x)
++static inline u32 be32_to_cpup(const u32 *p)
++{
++ return swab32p((u32 *)p);
++}
+ #else
+ #define get_le32(p) swab32p(p)
++#define cpu_to_be32(x) (x)
++static inline u32 be32_to_cpup(const u32 *p)
++{
++ return *p;
++}
+ #endif
+
++static inline uint32_t get_unaligned_be32(const void *p)
++{
++ return be32_to_cpup(p);
++}
++
++static inline void put_unaligned_be32(u32 val, void *p)
++{
++ *((u32 *)p) = cpu_to_be32(val);
++}
++
+ #define memeq(a, b, size) (memcmp(a, b, size) == 0)
+ #define memzero(buf, size) memset(buf, 0, size)
+
+diff --git a/arch/powerpc/include/asm/cacheflush.h b/arch/powerpc/include/asm/cacheflush.h
+index d5a8d7bf0759..b189f7aee222 100644
+--- a/arch/powerpc/include/asm/cacheflush.h
++++ b/arch/powerpc/include/asm/cacheflush.h
+@@ -32,9 +32,12 @@
+ * not expect this type of fault. flush_cache_vmap is not exactly the right
+ * place to put this, but it seems to work well enough.
+ */
+-#define flush_cache_vmap(start, end) do { asm volatile("ptesync" ::: "memory"); } while (0)
++static inline void flush_cache_vmap(unsigned long start, unsigned long end)
++{
++ asm volatile("ptesync" ::: "memory");
++}
+ #else
+-#define flush_cache_vmap(start, end) do { } while (0)
++static inline void flush_cache_vmap(unsigned long start, unsigned long end) { }
+ #endif
+
+ #define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 1
+diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
+index c72767a5327a..fe3c6f3bd3b6 100644
+--- a/arch/powerpc/kernel/eeh.c
++++ b/arch/powerpc/kernel/eeh.c
+@@ -360,10 +360,19 @@ static inline unsigned long eeh_token_to_phys(unsigned long token)
+ ptep = find_init_mm_pte(token, &hugepage_shift);
+ if (!ptep)
+ return token;
+- WARN_ON(hugepage_shift);
+- pa = pte_pfn(*ptep) << PAGE_SHIFT;
+
+- return pa | (token & (PAGE_SIZE-1));
++ pa = pte_pfn(*ptep);
++
++ /* On radix we can do hugepage mappings for io, so handle that */
++ if (hugepage_shift) {
++ pa <<= hugepage_shift;
++ pa |= token & ((1ul << hugepage_shift) - 1);
++ } else {
++ pa <<= PAGE_SHIFT;
++ pa |= token & (PAGE_SIZE - 1);
++ }
++
++ return pa;
+ }
+
+ /*
+diff --git a/arch/powerpc/kernel/pci_of_scan.c b/arch/powerpc/kernel/pci_of_scan.c
+index 98f04725def7..c101b321dece 100644
+--- a/arch/powerpc/kernel/pci_of_scan.c
++++ b/arch/powerpc/kernel/pci_of_scan.c
+@@ -45,6 +45,8 @@ unsigned int pci_parse_of_flags(u32 addr0, int bridge)
+ if (addr0 & 0x02000000) {
+ flags = IORESOURCE_MEM | PCI_BASE_ADDRESS_SPACE_MEMORY;
+ flags |= (addr0 >> 22) & PCI_BASE_ADDRESS_MEM_TYPE_64;
++ if (flags & PCI_BASE_ADDRESS_MEM_TYPE_64)
++ flags |= IORESOURCE_MEM_64;
+ flags |= (addr0 >> 28) & PCI_BASE_ADDRESS_MEM_TYPE_1M;
+ if (addr0 & 0x40000000)
+ flags |= IORESOURCE_PREFETCH
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index fd59fef9931b..906b05c2adae 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -1202,6 +1202,9 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ goto bad;
+
+ if (MSR_TM_ACTIVE(msr_hi<<32)) {
++ /* Trying to start TM on non TM system */
++ if (!cpu_has_feature(CPU_FTR_TM))
++ goto bad;
+ /* We only recheckpoint on return if we're
+ * transaction.
+ */
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
+index 14b0f5b6a373..b5933d7219db 100644
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -750,6 +750,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ if (MSR_TM_ACTIVE(msr)) {
+ /* We recheckpoint on return. */
+ struct ucontext __user *uc_transact;
++
++ /* Trying to start TM on non TM system */
++ if (!cpu_has_feature(CPU_FTR_TM))
++ goto badframe;
++
+ if (__get_user(uc_transact, &uc->uc_link))
+ goto badframe;
+ if (restore_tm_sigcontexts(current, &uc->uc_mcontext,
+diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
+index 7296a42eb62e..cef0b7ee1024 100644
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -150,6 +150,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz
+ } else {
+ pdshift = PUD_SHIFT;
+ pu = pud_alloc(mm, pg, addr);
++ if (!pu)
++ return NULL;
+ if (pshift == PUD_SHIFT)
+ return (pte_t *)pu;
+ else if (pshift > PMD_SHIFT) {
+@@ -158,6 +160,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz
+ } else {
+ pdshift = PMD_SHIFT;
+ pm = pmd_alloc(mm, pu, addr);
++ if (!pm)
++ return NULL;
+ if (pshift == PMD_SHIFT)
+ /* 16MB hugepage */
+ return (pte_t *)pm;
+@@ -174,12 +178,16 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz
+ } else {
+ pdshift = PUD_SHIFT;
+ pu = pud_alloc(mm, pg, addr);
++ if (!pu)
++ return NULL;
+ if (pshift >= PUD_SHIFT) {
+ ptl = pud_lockptr(mm, pu);
+ hpdp = (hugepd_t *)pu;
+ } else {
+ pdshift = PMD_SHIFT;
+ pm = pmd_alloc(mm, pu, addr);
++ if (!pm)
++ return NULL;
+ ptl = pmd_lockptr(mm, pm);
+ hpdp = (hugepd_t *)pm;
+ }
+diff --git a/arch/powerpc/platforms/4xx/uic.c b/arch/powerpc/platforms/4xx/uic.c
+index 8b4dd0da0839..9e27cfe27026 100644
+--- a/arch/powerpc/platforms/4xx/uic.c
++++ b/arch/powerpc/platforms/4xx/uic.c
+@@ -158,6 +158,7 @@ static int uic_set_irq_type(struct irq_data *d, unsigned int flow_type)
+
+ mtdcr(uic->dcrbase + UIC_PR, pr);
+ mtdcr(uic->dcrbase + UIC_TR, tr);
++ mtdcr(uic->dcrbase + UIC_SR, ~mask);
+
+ raw_spin_unlock_irqrestore(&uic->lock, flags);
+
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index f0e30dc94988..7b60fcf04dc4 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -9,6 +9,7 @@
+ * 2 as published by the Free Software Foundation.
+ */
+
++#include <linux/cpu.h>
+ #include <linux/kernel.h>
+ #include <linux/kobject.h>
+ #include <linux/smp.h>
+@@ -344,11 +345,19 @@ void post_mobility_fixup(void)
+ if (rc)
+ printk(KERN_ERR "Post-mobility activate-fw failed: %d\n", rc);
+
++ /*
++ * We don't want CPUs to go online/offline while the device
++ * tree is being updated.
++ */
++ cpus_read_lock();
++
+ rc = pseries_devicetree_update(MIGRATION_SCOPE);
+ if (rc)
+ printk(KERN_ERR "Post-mobility device tree update "
+ "failed: %d\n", rc);
+
++ cpus_read_unlock();
++
+ /* Possibly switch to a new RFI flush type */
+ pseries_setup_rfi_flush();
+
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index 959a2a62f233..0b24b1031221 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -483,7 +483,7 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
+ * Now go through the entire mask until we find a valid
+ * target.
+ */
+- for (;;) {
++ do {
+ /*
+ * We re-check online as the fallback case passes us
+ * an untested affinity mask
+@@ -491,12 +491,11 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
+ if (cpu_online(cpu) && xive_try_pick_target(cpu))
+ return cpu;
+ cpu = cpumask_next(cpu, mask);
+- if (cpu == first)
+- break;
+ /* Wrap around */
+ if (cpu >= nr_cpu_ids)
+ cpu = cpumask_first(mask);
+- }
++ } while (cpu != first);
++
+ return -1;
+ }
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index dd6badc31f45..74cfc1be04d6 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -466,8 +466,10 @@ static int xmon_core(struct pt_regs *regs, int fromipi)
+ local_irq_save(flags);
+ hard_irq_disable();
+
+- tracing_enabled = tracing_is_on();
+- tracing_off();
++ if (!fromipi) {
++ tracing_enabled = tracing_is_on();
++ tracing_off();
++ }
+
+ bp = in_breakpoint_table(regs->nip, &offset);
+ if (bp != NULL) {
+diff --git a/arch/sh/include/asm/io.h b/arch/sh/include/asm/io.h
+index 98cb8c802b1a..0ae60d680000 100644
+--- a/arch/sh/include/asm/io.h
++++ b/arch/sh/include/asm/io.h
+@@ -371,7 +371,11 @@ static inline int iounmap_fixed(void __iomem *addr) { return -EINVAL; }
+
+ #define ioremap_nocache ioremap
+ #define ioremap_uc ioremap
+-#define iounmap __iounmap
++
++static inline void iounmap(void __iomem *addr)
++{
++ __iounmap(addr);
++}
+
+ /*
+ * Convert a physical pointer to a virtual kernel pointer for /dev/mem
+diff --git a/arch/um/include/asm/mmu_context.h b/arch/um/include/asm/mmu_context.h
+index fca34b2177e2..129fb1d1f1c5 100644
+--- a/arch/um/include/asm/mmu_context.h
++++ b/arch/um/include/asm/mmu_context.h
+@@ -53,7 +53,7 @@ static inline void activate_mm(struct mm_struct *old, struct mm_struct *new)
+ * when the new ->mm is used for the first time.
+ */
+ __switch_mm(&new->context.id);
+- down_write(&new->mmap_sem);
++ down_write_nested(&new->mmap_sem, 1);
+ uml_setup_stubs(new);
+ up_write(&new->mmap_sem);
+ }
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index a5cde748cf76..c5690440fbd4 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -1196,7 +1196,7 @@ static ssize_t l1tf_show_state(char *buf)
+
+ static ssize_t mds_show_state(char *buf)
+ {
+- if (!hypervisor_is_type(X86_HYPER_NATIVE)) {
++ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
+ return sprintf(buf, "%s; SMT Host state unknown\n",
+ mds_strings[mds_mitigation]);
+ }
+diff --git a/arch/x86/kernel/sysfb_efi.c b/arch/x86/kernel/sysfb_efi.c
+index 623965e86b65..897da526e40e 100644
+--- a/arch/x86/kernel/sysfb_efi.c
++++ b/arch/x86/kernel/sysfb_efi.c
+@@ -231,9 +231,55 @@ static const struct dmi_system_id efifb_dmi_system_table[] __initconst = {
+ {},
+ };
+
++/*
++ * Some devices have a portrait LCD but advertise a landscape resolution (and
++ * pitch). We simply swap width and height for these devices so that we can
++ * correctly deal with some of them coming with multiple resolutions.
++ */
++static const struct dmi_system_id efifb_dmi_swap_width_height[] __initconst = {
++ {
++ /*
++ * Lenovo MIIX310-10ICR, only some batches have the troublesome
++ * 800x1280 portrait screen. Luckily the portrait version has
++ * its own BIOS version, so we match on that.
++ */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "MIIX 310-10ICR"),
++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1HCN44WW"),
++ },
++ },
++ {
++ /* Lenovo MIIX 320-10ICR with 800x1280 portrait screen */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
++ "Lenovo MIIX 320-10ICR"),
++ },
++ },
++ {
++ /* Lenovo D330 with 800x1280 or 1200x1920 portrait screen */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
++ "Lenovo ideapad D330-10IGM"),
++ },
++ },
++ {},
++};
++
+ __init void sysfb_apply_efi_quirks(void)
+ {
+ if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI ||
+ !(screen_info.capabilities & VIDEO_CAPABILITY_SKIP_QUIRKS))
+ dmi_check_system(efifb_dmi_system_table);
++
++ if (screen_info.orig_video_isVGA == VIDEO_TYPE_EFI &&
++ dmi_check_system(efifb_dmi_swap_width_height)) {
++ u16 temp = screen_info.lfb_width;
++
++ screen_info.lfb_width = screen_info.lfb_height;
++ screen_info.lfb_height = temp;
++ screen_info.lfb_linelength = 4 * screen_info.lfb_width;
++ }
+ }
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index 67b5fb861a51..5bd90cd4b51e 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -291,8 +291,12 @@ bool bio_integrity_prep(struct bio *bio)
+ ret = bio_integrity_add_page(bio, virt_to_page(buf),
+ bytes, offset);
+
+- if (ret == 0)
+- return false;
++ if (ret == 0) {
++ printk(KERN_ERR "could not attach integrity payload\n");
++ kfree(buf);
++ status = BLK_STS_RESOURCE;
++ goto err_end_io;
++ }
+
+ if (ret < bytes)
+ break;
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 682bc561b77b..9ca703bcfe3b 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -198,6 +198,7 @@ void blk_rq_init(struct request_queue *q, struct request *rq)
+ rq->internal_tag = -1;
+ rq->start_time_ns = ktime_get_ns();
+ rq->part = NULL;
++ refcount_set(&rq->ref, 1);
+ }
+ EXPORT_SYMBOL(blk_rq_init);
+
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 5d67f5fec6c1..1e0e438f079f 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -2838,7 +2838,7 @@ static void binder_transaction(struct binder_proc *proc,
+ else
+ return_error = BR_DEAD_REPLY;
+ mutex_unlock(&context->context_mgr_node_lock);
+- if (target_node && target_proc == proc) {
++ if (target_node && target_proc->pid == proc->pid) {
+ binder_user_error("%d:%d got transaction to context manager from process owning it\n",
+ proc->pid, thread->pid);
+ return_error = BR_FAILED_REPLY;
+diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
+index 9bffcd37cc7b..c0732f032248 100644
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -570,8 +570,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
+ unsigned long long m;
+
+ m = hpets->hp_tick_freq + (dis >> 1);
+- do_div(m, dis);
+- return (unsigned long)m;
++ return div64_ul(m, dis);
+ }
+
+ static int
+diff --git a/drivers/fpga/Kconfig b/drivers/fpga/Kconfig
+index 1ebcef4bab5b..87337fcfbc0d 100644
+--- a/drivers/fpga/Kconfig
++++ b/drivers/fpga/Kconfig
+@@ -39,6 +39,7 @@ config ALTERA_PR_IP_CORE_PLAT
+ config FPGA_MGR_ALTERA_PS_SPI
+ tristate "Altera FPGA Passive Serial over SPI"
+ depends on SPI
++ select BITREVERSE
+ help
+ FPGA manager driver support for Altera Arria/Cyclone/Stratix
+ using the passive serial interface over SPI.
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+index 72f8018fa2a8..ede27dab675f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+@@ -1037,6 +1037,9 @@ static int gmc_v9_0_gart_enable(struct amdgpu_device *adev)
+ tmp = RREG32_SOC15(HDP, 0, mmHDP_HOST_PATH_CNTL);
+ WREG32_SOC15(HDP, 0, mmHDP_HOST_PATH_CNTL, tmp);
+
++ WREG32_SOC15(HDP, 0, mmHDP_NONSURFACE_BASE, (adev->gmc.vram_start >> 8));
++ WREG32_SOC15(HDP, 0, mmHDP_NONSURFACE_BASE_HI, (adev->gmc.vram_start >> 40));
++
+ /* After HDP is initialized, flush HDP.*/
+ adev->nbio_funcs->hdp_flush(adev, NULL);
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+index 4f22e745df51..189212cb3547 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -1268,12 +1268,17 @@ int amdkfd_fence_wait_timeout(unsigned int *fence_addr,
+ return 0;
+ }
+
+-static int unmap_sdma_queues(struct device_queue_manager *dqm,
+- unsigned int sdma_engine)
++static int unmap_sdma_queues(struct device_queue_manager *dqm)
+ {
+- return pm_send_unmap_queue(&dqm->packets, KFD_QUEUE_TYPE_SDMA,
+- KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0, false,
+- sdma_engine);
++ int i, retval = 0;
++
++ for (i = 0; i < dqm->dev->device_info->num_sdma_engines; i++) {
++ retval = pm_send_unmap_queue(&dqm->packets, KFD_QUEUE_TYPE_SDMA,
++ KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0, false, i);
++ if (retval)
++ return retval;
++ }
++ return retval;
+ }
+
+ /* dqm->lock mutex has to be locked before calling this function */
+@@ -1312,10 +1317,8 @@ static int unmap_queues_cpsch(struct device_queue_manager *dqm,
+ pr_debug("Before destroying queues, sdma queue count is : %u\n",
+ dqm->sdma_queue_count);
+
+- if (dqm->sdma_queue_count > 0) {
+- unmap_sdma_queues(dqm, 0);
+- unmap_sdma_queues(dqm, 1);
+- }
++ if (dqm->sdma_queue_count > 0)
++ unmap_sdma_queues(dqm);
+
+ retval = pm_send_unmap_queue(&dqm->packets, KFD_QUEUE_TYPE_COMPUTE,
+ filter, filter_param, false, 0);
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+index 0cedb37cf513..985bebde5a34 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+@@ -75,6 +75,7 @@ static int init_mqd(struct mqd_manager *mm, void **mqd,
+ struct v9_mqd *m;
+ struct kfd_dev *kfd = mm->dev;
+
++ *mqd_mem_obj = NULL;
+ /* From V9, for CWSR, the control stack is located on the next page
+ * boundary after the mqd, we will use the gtt allocation function
+ * instead of sub-allocation function.
+@@ -92,8 +93,10 @@ static int init_mqd(struct mqd_manager *mm, void **mqd,
+ } else
+ retval = kfd_gtt_sa_allocate(mm->dev, sizeof(struct v9_mqd),
+ mqd_mem_obj);
+- if (retval != 0)
++ if (retval) {
++ kfree(*mqd_mem_obj);
+ return -ENOMEM;
++ }
+
+ m = (struct v9_mqd *) (*mqd_mem_obj)->cpu_ptr;
+ addr = (*mqd_mem_obj)->gpu_addr;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index dac7978f5ee1..221de241535a 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3644,6 +3644,13 @@ void amdgpu_dm_connector_init_helper(struct amdgpu_display_manager *dm,
+ {
+ struct amdgpu_device *adev = dm->ddev->dev_private;
+
++ /*
++ * Some of the properties below require access to state, like bpc.
++ * Allocate some default initial connector state with our reset helper.
++ */
++ if (aconnector->base.funcs->reset)
++ aconnector->base.funcs->reset(&aconnector->base);
++
+ aconnector->connector_id = link_index;
+ aconnector->dc_link = link;
+ aconnector->base.interlace_allowed = false;
+@@ -3811,9 +3818,6 @@ static int amdgpu_dm_connector_init(struct amdgpu_display_manager *dm,
+ &aconnector->base,
+ &amdgpu_dm_connector_helper_funcs);
+
+- if (aconnector->base.funcs->reset)
+- aconnector->base.funcs->reset(&aconnector->base);
+-
+ amdgpu_dm_connector_init_helper(
+ dm,
+ aconnector,
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
+index 29294db1a96b..070ab56a8aca 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
+@@ -474,6 +474,8 @@ void dce_abm_destroy(struct abm **abm)
+ {
+ struct dce_abm *abm_dce = TO_DCE_ABM(*abm);
+
++ abm_dce->base.funcs->set_abm_immediate_disable(*abm);
++
+ kfree(abm_dce);
+ *abm = NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index 53ccacf99eca..c3ad2bbec1a5 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -242,6 +242,9 @@ static void build_prescale_params(struct ipp_prescale_params *prescale_params,
+ prescale_params->mode = IPP_PRESCALE_MODE_FIXED_UNSIGNED;
+
+ switch (plane_state->format) {
++ case SURFACE_PIXEL_FORMAT_GRPH_RGB565:
++ prescale_params->scale = 0x2082;
++ break;
+ case SURFACE_PIXEL_FORMAT_GRPH_ARGB8888:
+ case SURFACE_PIXEL_FORMAT_GRPH_ABGR8888:
+ prescale_params->scale = 0x2020;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+index 7736ef123e9b..ead221ccb93e 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+@@ -23,6 +23,7 @@
+ *
+ */
+
++#include <linux/delay.h>
+ #include "dm_services.h"
+ #include "core_types.h"
+ #include "resource.h"
+diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c
+index e59a13542333..0cc6dbbcddcf 100644
+--- a/drivers/gpu/drm/bridge/sii902x.c
++++ b/drivers/gpu/drm/bridge/sii902x.c
+@@ -261,10 +261,11 @@ static void sii902x_bridge_mode_set(struct drm_bridge *bridge,
+ struct regmap *regmap = sii902x->regmap;
+ u8 buf[HDMI_INFOFRAME_SIZE(AVI)];
+ struct hdmi_avi_infoframe frame;
++ u16 pixel_clock_10kHz = adj->clock / 10;
+ int ret;
+
+- buf[0] = adj->clock;
+- buf[1] = adj->clock >> 8;
++ buf[0] = pixel_clock_10kHz & 0xff;
++ buf[1] = pixel_clock_10kHz >> 8;
+ buf[2] = adj->vrefresh;
+ buf[3] = 0x00;
+ buf[4] = adj->hdisplay;
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index 391547358756..aaca5248da07 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -1149,6 +1149,13 @@ static int tc_connector_get_modes(struct drm_connector *connector)
+ struct tc_data *tc = connector_to_tc(connector);
+ struct edid *edid;
+ unsigned int count;
++ int ret;
++
++ ret = tc_get_display_props(tc);
++ if (ret < 0) {
++ dev_err(tc->dev, "failed to read display props: %d\n", ret);
++ return 0;
++ }
+
+ if (tc->panel && tc->panel->funcs && tc->panel->funcs->get_modes) {
+ count = tc->panel->funcs->get_modes(tc->panel);
+diff --git a/drivers/gpu/drm/drm_debugfs_crc.c b/drivers/gpu/drm/drm_debugfs_crc.c
+index 99961192bf03..c88e5ff41add 100644
+--- a/drivers/gpu/drm/drm_debugfs_crc.c
++++ b/drivers/gpu/drm/drm_debugfs_crc.c
+@@ -379,12 +379,13 @@ int drm_crtc_add_crc_entry(struct drm_crtc *crtc, bool has_frame,
+ struct drm_crtc_crc *crc = &crtc->crc;
+ struct drm_crtc_crc_entry *entry;
+ int head, tail;
++ unsigned long flags;
+
+- spin_lock(&crc->lock);
++ spin_lock_irqsave(&crc->lock, flags);
+
+ /* Caller may not have noticed yet that userspace has stopped reading */
+ if (!crc->entries) {
+- spin_unlock(&crc->lock);
++ spin_unlock_irqrestore(&crc->lock, flags);
+ return -EINVAL;
+ }
+
+@@ -395,7 +396,7 @@ int drm_crtc_add_crc_entry(struct drm_crtc *crtc, bool has_frame,
+ bool was_overflow = crc->overflow;
+
+ crc->overflow = true;
+- spin_unlock(&crc->lock);
++ spin_unlock_irqrestore(&crc->lock, flags);
+
+ if (!was_overflow)
+ DRM_ERROR("Overflow of CRC buffer, userspace reads too slow.\n");
+@@ -411,7 +412,7 @@ int drm_crtc_add_crc_entry(struct drm_crtc *crtc, bool has_frame,
+ head = (head + 1) & (DRM_CRC_ENTRIES_NR - 1);
+ crc->head = head;
+
+- spin_unlock(&crc->lock);
++ spin_unlock_irqrestore(&crc->lock, flags);
+
+ wake_up_interruptible(&crc->wq);
+
+diff --git a/drivers/gpu/drm/drm_edid_load.c b/drivers/gpu/drm/drm_edid_load.c
+index a4915099aaa9..a0e107abc40d 100644
+--- a/drivers/gpu/drm/drm_edid_load.c
++++ b/drivers/gpu/drm/drm_edid_load.c
+@@ -290,6 +290,8 @@ struct edid *drm_load_edid_firmware(struct drm_connector *connector)
+ * the last one found one as a fallback.
+ */
+ fwstr = kstrdup(edid_firmware, GFP_KERNEL);
++ if (!fwstr)
++ return ERR_PTR(-ENOMEM);
+ edidstr = fwstr;
+
+ while ((edidname = strsep(&edidstr, ","))) {
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index c1abad8a8612..ed9a3a1e50ef 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -1321,16 +1321,24 @@ static int msm_pdev_probe(struct platform_device *pdev)
+
+ ret = add_gpu_components(&pdev->dev, &match);
+ if (ret)
+- return ret;
++ goto fail;
+
+ /* on all devices that I am aware of, iommu's which can map
+ * any address the cpu can see are used:
+ */
+ ret = dma_set_mask_and_coherent(&pdev->dev, ~0);
+ if (ret)
+- return ret;
++ goto fail;
++
++ ret = component_master_add_with_match(&pdev->dev, &msm_drm_ops, match);
++ if (ret)
++ goto fail;
+
+- return component_master_add_with_match(&pdev->dev, &msm_drm_ops, match);
++ return 0;
++
++fail:
++ of_platform_depopulate(&pdev->dev);
++ return ret;
+ }
+
+ static int msm_pdev_remove(struct platform_device *pdev)
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 97964f7f2ace..b1d41c4921dd 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -2803,7 +2803,14 @@ static int panel_simple_dsi_probe(struct mipi_dsi_device *dsi)
+ dsi->format = desc->format;
+ dsi->lanes = desc->lanes;
+
+- return mipi_dsi_attach(dsi);
++ err = mipi_dsi_attach(dsi);
++ if (err) {
++ struct panel_simple *panel = dev_get_drvdata(&dsi->dev);
++
++ drm_panel_remove(&panel->base);
++ }
++
++ return err;
+ }
+
+ static int panel_simple_dsi_remove(struct mipi_dsi_device *dsi)
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+index f8f9ae6622eb..873624a11ce8 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -880,7 +880,8 @@ static bool vop_crtc_mode_fixup(struct drm_crtc *crtc,
+ struct vop *vop = to_vop(crtc);
+
+ adjusted_mode->clock =
+- clk_round_rate(vop->dclk, mode->clock * 1000) / 1000;
++ DIV_ROUND_UP(clk_round_rate(vop->dclk, mode->clock * 1000),
++ 1000);
+
+ return true;
+ }
+diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+index 7bdf6f0e58a5..8d2f5ded86d6 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+@@ -528,6 +528,9 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
+ if (!ret)
+ return -EBUSY;
+
++ /* is_valid check must proceed before copy of the cache entry. */
++ smp_rmb();
++
+ ptr = cache_ent->caps_cache;
+
+ copy_exit:
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index 020070d483d3..c8a581b1f4c4 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -588,6 +588,8 @@ static void virtio_gpu_cmd_capset_cb(struct virtio_gpu_device *vgdev,
+ cache_ent->id == le32_to_cpu(cmd->capset_id)) {
+ memcpy(cache_ent->caps_cache, resp->capset_data,
+ cache_ent->size);
++ /* Copy must occur before is_valid is signalled. */
++ smp_wmb();
+ atomic_set(&cache_ent->is_valid, 1);
+ break;
+ }
+diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
+index 815bdb42e3f0..0121fe7a4548 100644
+--- a/drivers/gpu/host1x/bus.c
++++ b/drivers/gpu/host1x/bus.c
+@@ -423,6 +423,9 @@ static int host1x_device_add(struct host1x *host1x,
+
+ of_dma_configure(&device->dev, host1x->dev->of_node, true);
+
++ device->dev.dma_parms = &device->dma_parms;
++ dma_set_max_seg_size(&device->dev, SZ_4M);
++
+ err = host1x_device_parse_dt(device, driver);
+ if (err < 0) {
+ kfree(device);
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index a492da9fd0d3..ac9c9486b834 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -24,7 +24,6 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_address.h>
+-#include <linux/of_irq.h>
+ #include <linux/of_platform.h>
+ #include <linux/platform_device.h>
+ #include <linux/reset.h>
+@@ -1782,15 +1781,14 @@ static struct i2c_algorithm stm32f7_i2c_algo = {
+
+ static int stm32f7_i2c_probe(struct platform_device *pdev)
+ {
+- struct device_node *np = pdev->dev.of_node;
+ struct stm32f7_i2c_dev *i2c_dev;
+ const struct stm32f7_i2c_setup *setup;
+ struct resource *res;
+- u32 irq_error, irq_event, clk_rate, rise_time, fall_time;
++ u32 clk_rate, rise_time, fall_time;
+ struct i2c_adapter *adap;
+ struct reset_control *rst;
+ dma_addr_t phy_addr;
+- int ret;
++ int irq_error, irq_event, ret;
+
+ i2c_dev = devm_kzalloc(&pdev->dev, sizeof(*i2c_dev), GFP_KERNEL);
+ if (!i2c_dev)
+@@ -1802,16 +1800,20 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
+ return PTR_ERR(i2c_dev->base);
+ phy_addr = (dma_addr_t)res->start;
+
+- irq_event = irq_of_parse_and_map(np, 0);
+- if (!irq_event) {
+- dev_err(&pdev->dev, "IRQ event missing or invalid\n");
+- return -EINVAL;
++ irq_event = platform_get_irq(pdev, 0);
++ if (irq_event <= 0) {
++ if (irq_event != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "Failed to get IRQ event: %d\n",
++ irq_event);
++ return irq_event ? : -ENOENT;
+ }
+
+- irq_error = irq_of_parse_and_map(np, 1);
+- if (!irq_error) {
+- dev_err(&pdev->dev, "IRQ error missing or invalid\n");
+- return -EINVAL;
++ irq_error = platform_get_irq(pdev, 1);
++ if (irq_error <= 0) {
++ if (irq_error != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "Failed to get IRQ error: %d\n",
++ irq_error);
++ return irq_error ? : -ENOENT;
+ }
+
+ i2c_dev->clk = devm_clk_get(&pdev->dev, NULL);
+diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
+index fcd4a1c00ca0..15a115210108 100644
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -1144,6 +1144,12 @@ static int stm32_dfsdm_adc_probe(struct platform_device *pdev)
+ * So IRQ associated to filter instance 0 is dedicated to the Filter 0.
+ */
+ irq = platform_get_irq(pdev, 0);
++ if (irq < 0) {
++ if (irq != -EPROBE_DEFER)
++ dev_err(dev, "Failed to get IRQ: %d\n", irq);
++ return irq;
++ }
++
+ ret = devm_request_irq(dev, irq, stm32_dfsdm_irq,
+ 0, pdev->name, adc);
+ if (ret < 0) {
+diff --git a/drivers/iio/adc/stm32-dfsdm-core.c b/drivers/iio/adc/stm32-dfsdm-core.c
+index bf089f5d6225..941630615e88 100644
+--- a/drivers/iio/adc/stm32-dfsdm-core.c
++++ b/drivers/iio/adc/stm32-dfsdm-core.c
+@@ -213,6 +213,8 @@ static int stm32_dfsdm_parse_of(struct platform_device *pdev,
+ }
+ priv->dfsdm.phys_base = res->start;
+ priv->dfsdm.base = devm_ioremap_resource(&pdev->dev, res);
++ if (IS_ERR(priv->dfsdm.base))
++ return PTR_ERR(priv->dfsdm.base);
+
+ /*
+ * "dfsdm" clock is mandatory for DFSDM peripheral clocking.
+@@ -222,8 +224,10 @@ static int stm32_dfsdm_parse_of(struct platform_device *pdev,
+ */
+ priv->clk = devm_clk_get(&pdev->dev, "dfsdm");
+ if (IS_ERR(priv->clk)) {
+- dev_err(&pdev->dev, "No stm32_dfsdm_clk clock found\n");
+- return -EINVAL;
++ ret = PTR_ERR(priv->clk);
++ if (ret != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "Failed to get clock (%d)\n", ret);
++ return ret;
+ }
+
+ priv->aclk = devm_clk_get(&pdev->dev, "audio");
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+index e2e6c74a7452..a5e3349b8a7c 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+@@ -806,6 +806,8 @@ static int i40iw_query_qp(struct ib_qp *ibqp,
+ struct i40iw_qp *iwqp = to_iwqp(ibqp);
+ struct i40iw_sc_qp *qp = &iwqp->sc_qp;
+
++ attr->qp_state = iwqp->ibqp_state;
++ attr->cur_qp_state = attr->qp_state;
+ attr->qp_access_flags = 0;
+ attr->cap.max_send_wr = qp->qp_uk.sq_size;
+ attr->cap.max_recv_wr = qp->qp_uk.rq_size;
+diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/mad.c
+index 32a9e9228b13..cdf6e26ebc87 100644
+--- a/drivers/infiniband/hw/mlx5/mad.c
++++ b/drivers/infiniband/hw/mlx5/mad.c
+@@ -197,19 +197,33 @@ static void pma_cnt_assign(struct ib_pma_portcounters *pma_cnt,
+ vl_15_dropped);
+ }
+
+-static int process_pma_cmd(struct mlx5_core_dev *mdev, u8 port_num,
++static int process_pma_cmd(struct mlx5_ib_dev *dev, u8 port_num,
+ const struct ib_mad *in_mad, struct ib_mad *out_mad)
+ {
+- int err;
++ struct mlx5_core_dev *mdev;
++ bool native_port = true;
++ u8 mdev_port_num;
+ void *out_cnt;
++ int err;
+
++ mdev = mlx5_ib_get_native_port_mdev(dev, port_num, &mdev_port_num);
++ if (!mdev) {
++ /* Fail to get the native port, likely due to 2nd port is still
++ * unaffiliated. In such case default to 1st port and attached
++ * PF device.
++ */
++ native_port = false;
++ mdev = dev->mdev;
++ mdev_port_num = 1;
++ }
+ /* Declaring support of extended counters */
+ if (in_mad->mad_hdr.attr_id == IB_PMA_CLASS_PORT_INFO) {
+ struct ib_class_port_info cpi = {};
+
+ cpi.capability_mask = IB_PMA_CLASS_CAP_EXT_WIDTH;
+ memcpy((out_mad->data + 40), &cpi, sizeof(cpi));
+- return IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
++ err = IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
++ goto done;
+ }
+
+ if (in_mad->mad_hdr.attr_id == IB_PMA_PORT_COUNTERS_EXT) {
+@@ -218,11 +232,13 @@ static int process_pma_cmd(struct mlx5_core_dev *mdev, u8 port_num,
+ int sz = MLX5_ST_SZ_BYTES(query_vport_counter_out);
+
+ out_cnt = kvzalloc(sz, GFP_KERNEL);
+- if (!out_cnt)
+- return IB_MAD_RESULT_FAILURE;
++ if (!out_cnt) {
++ err = IB_MAD_RESULT_FAILURE;
++ goto done;
++ }
+
+ err = mlx5_core_query_vport_counter(mdev, 0, 0,
+- port_num, out_cnt, sz);
++ mdev_port_num, out_cnt, sz);
+ if (!err)
+ pma_cnt_ext_assign(pma_cnt_ext, out_cnt);
+ } else {
+@@ -231,20 +247,23 @@ static int process_pma_cmd(struct mlx5_core_dev *mdev, u8 port_num,
+ int sz = MLX5_ST_SZ_BYTES(ppcnt_reg);
+
+ out_cnt = kvzalloc(sz, GFP_KERNEL);
+- if (!out_cnt)
+- return IB_MAD_RESULT_FAILURE;
++ if (!out_cnt) {
++ err = IB_MAD_RESULT_FAILURE;
++ goto done;
++ }
+
+- err = mlx5_core_query_ib_ppcnt(mdev, port_num,
++ err = mlx5_core_query_ib_ppcnt(mdev, mdev_port_num,
+ out_cnt, sz);
+ if (!err)
+ pma_cnt_assign(pma_cnt, out_cnt);
+- }
+-
++ }
+ kvfree(out_cnt);
+- if (err)
+- return IB_MAD_RESULT_FAILURE;
+-
+- return IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
++ err = err ? IB_MAD_RESULT_FAILURE :
++ IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
++done:
++ if (native_port)
++ mlx5_ib_put_native_port_mdev(dev, port_num);
++ return err;
+ }
+
+ int mlx5_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
+@@ -256,8 +275,6 @@ int mlx5_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
+ struct mlx5_ib_dev *dev = to_mdev(ibdev);
+ const struct ib_mad *in_mad = (const struct ib_mad *)in;
+ struct ib_mad *out_mad = (struct ib_mad *)out;
+- struct mlx5_core_dev *mdev;
+- u8 mdev_port_num;
+ int ret;
+
+ if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
+@@ -266,19 +283,14 @@ int mlx5_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
+
+ memset(out_mad->data, 0, sizeof(out_mad->data));
+
+- mdev = mlx5_ib_get_native_port_mdev(dev, port_num, &mdev_port_num);
+- if (!mdev)
+- return IB_MAD_RESULT_FAILURE;
+-
+- if (MLX5_CAP_GEN(mdev, vport_counters) &&
++ if (MLX5_CAP_GEN(dev->mdev, vport_counters) &&
+ in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_PERF_MGMT &&
+ in_mad->mad_hdr.method == IB_MGMT_METHOD_GET) {
+- ret = process_pma_cmd(mdev, mdev_port_num, in_mad, out_mad);
++ ret = process_pma_cmd(dev, port_num, in_mad, out_mad);
+ } else {
+ ret = process_mad(ibdev, mad_flags, port_num, in_wc, in_grh,
+ in_mad, out_mad);
+ }
+- mlx5_ib_put_native_port_mdev(dev, port_num);
+ return ret;
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 4111b798fd3c..681d8e0913d0 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -435,6 +435,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
+ qp->resp.va = reth_va(pkt);
+ qp->resp.rkey = reth_rkey(pkt);
+ qp->resp.resid = reth_len(pkt);
++ qp->resp.length = reth_len(pkt);
+ }
+ access = (pkt->mask & RXE_READ_MASK) ? IB_ACCESS_REMOTE_READ
+ : IB_ACCESS_REMOTE_WRITE;
+@@ -859,7 +860,9 @@ static enum resp_states do_complete(struct rxe_qp *qp,
+ pkt->mask & RXE_WRITE_MASK) ?
+ IB_WC_RECV_RDMA_WITH_IMM : IB_WC_RECV;
+ wc->vendor_err = 0;
+- wc->byte_len = wqe->dma.length - wqe->dma.resid;
++ wc->byte_len = (pkt->mask & RXE_IMMDT_MASK &&
++ pkt->mask & RXE_WRITE_MASK) ?
++ qp->resp.length : wqe->dma.length - wqe->dma.resid;
+
+ /* fields after byte_len are different between kernel and user
+ * space
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index 332a16dad2a7..3b731c7682e5 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -212,6 +212,7 @@ struct rxe_resp_info {
+ struct rxe_mem *mr;
+ u32 resid;
+ u32 rkey;
++ u32 length;
+ u64 atomic_orig;
+
+ /* SRQ only */
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 009615499b37..78dd36daac00 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1892,12 +1892,6 @@ static void ipoib_child_init(struct net_device *ndev)
+ struct ipoib_dev_priv *priv = ipoib_priv(ndev);
+ struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
+
+- dev_hold(priv->parent);
+-
+- down_write(&ppriv->vlan_rwsem);
+- list_add_tail(&priv->list, &ppriv->child_intfs);
+- up_write(&ppriv->vlan_rwsem);
+-
+ priv->max_ib_mtu = ppriv->max_ib_mtu;
+ set_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags);
+ memcpy(priv->dev->dev_addr, ppriv->dev->dev_addr, INFINIBAND_ALEN);
+@@ -1940,6 +1934,17 @@ static int ipoib_ndo_init(struct net_device *ndev)
+ if (rc) {
+ pr_warn("%s: failed to initialize device: %s port %d (ret = %d)\n",
+ priv->ca->name, priv->dev->name, priv->port, rc);
++ return rc;
++ }
++
++ if (priv->parent) {
++ struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
++
++ dev_hold(priv->parent);
++
++ down_write(&ppriv->vlan_rwsem);
++ list_add_tail(&priv->list, &ppriv->child_intfs);
++ up_write(&ppriv->vlan_rwsem);
+ }
+
+ return 0;
+@@ -1957,6 +1962,14 @@ static void ipoib_ndo_uninit(struct net_device *dev)
+ */
+ WARN_ON(!list_empty(&priv->child_intfs));
+
++ if (priv->parent) {
++ struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
++
++ down_write(&ppriv->vlan_rwsem);
++ list_del(&priv->list);
++ up_write(&ppriv->vlan_rwsem);
++ }
++
+ ipoib_neigh_hash_uninit(dev);
+
+ ipoib_ib_dev_cleanup(dev);
+@@ -1968,15 +1981,8 @@ static void ipoib_ndo_uninit(struct net_device *dev)
+ priv->wq = NULL;
+ }
+
+- if (priv->parent) {
+- struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
+-
+- down_write(&ppriv->vlan_rwsem);
+- list_del(&priv->list);
+- up_write(&ppriv->vlan_rwsem);
+-
++ if (priv->parent)
+ dev_put(priv->parent);
+- }
+ }
+
+ static int ipoib_set_vf_link_state(struct net_device *dev, int vf, int link_state)
+diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
+index 674b35f402f5..055c90b8253c 100644
+--- a/drivers/mailbox/mailbox.c
++++ b/drivers/mailbox/mailbox.c
+@@ -391,11 +391,13 @@ struct mbox_chan *mbox_request_channel_byname(struct mbox_client *cl,
+
+ of_property_for_each_string(np, "mbox-names", prop, mbox_name) {
+ if (!strncmp(name, mbox_name, strlen(name)))
+- break;
++ return mbox_request_channel(cl, index);
+ index++;
+ }
+
+- return mbox_request_channel(cl, index);
++ dev_err(cl->dev, "%s() could not locate channel named \"%s\"\n",
++ __func__, name);
++ return ERR_PTR(-EINVAL);
+ }
+ EXPORT_SYMBOL_GPL(mbox_request_channel_byname);
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index 1246d69ba187..b1564cacd19e 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -629,13 +629,18 @@ static int __init memstick_init(void)
+ return -ENOMEM;
+
+ rc = bus_register(&memstick_bus_type);
+- if (!rc)
+- rc = class_register(&memstick_host_class);
++ if (rc)
++ goto error_destroy_workqueue;
+
+- if (!rc)
+- return 0;
++ rc = class_register(&memstick_host_class);
++ if (rc)
++ goto error_bus_unregister;
++
++ return 0;
+
++error_bus_unregister:
+ bus_unregister(&memstick_bus_type);
++error_destroy_workqueue:
+ destroy_workqueue(workqueue);
+
+ return rc;
+diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
+index 5f1e37d23943..47d6d40f41cd 100644
+--- a/drivers/mfd/arizona-core.c
++++ b/drivers/mfd/arizona-core.c
+@@ -996,7 +996,7 @@ int arizona_dev_init(struct arizona *arizona)
+ unsigned int reg, val;
+ int (*apply_patch)(struct arizona *) = NULL;
+ const struct mfd_cell *subdevs = NULL;
+- int n_subdevs, ret, i;
++ int n_subdevs = 0, ret, i;
+
+ dev_set_drvdata(arizona->dev, arizona);
+ mutex_init(&arizona->clk_lock);
+diff --git a/drivers/mfd/hi655x-pmic.c b/drivers/mfd/hi655x-pmic.c
+index 96c07fa1802a..6693f74aa6ab 100644
+--- a/drivers/mfd/hi655x-pmic.c
++++ b/drivers/mfd/hi655x-pmic.c
+@@ -112,6 +112,8 @@ static int hi655x_pmic_probe(struct platform_device *pdev)
+
+ pmic->regmap = devm_regmap_init_mmio_clk(dev, NULL, base,
+ &hi655x_regmap_config);
++ if (IS_ERR(pmic->regmap))
++ return PTR_ERR(pmic->regmap);
+
+ regmap_read(pmic->regmap, HI655X_BUS_ADDR(HI655X_VER_REG), &pmic->ver);
+ if ((pmic->ver < PMU_VER_START) || (pmic->ver > PMU_VER_END)) {
+diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
+index 8cfea969b060..45c7d8b97349 100644
+--- a/drivers/mfd/madera-core.c
++++ b/drivers/mfd/madera-core.c
+@@ -278,6 +278,7 @@ const struct of_device_id madera_of_match[] = {
+ { .compatible = "cirrus,wm1840", .data = (void *)WM1840 },
+ {}
+ };
++MODULE_DEVICE_TABLE(of, madera_of_match);
+ EXPORT_SYMBOL_GPL(madera_of_match);
+
+ static int madera_get_reset_gpio(struct madera *madera)
+diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
+index 94e3f32ce935..182973df1aed 100644
+--- a/drivers/mfd/mfd-core.c
++++ b/drivers/mfd/mfd-core.c
+@@ -179,6 +179,7 @@ static int mfd_add_device(struct device *parent, int id,
+ for_each_child_of_node(parent->of_node, np) {
+ if (of_device_is_compatible(np, cell->of_compatible)) {
+ pdev->dev.of_node = np;
++ pdev->dev.fwnode = &np->fwnode;
+ break;
+ }
+ }
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index bb1ee9834a02..225373e4a9ef 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -141,6 +141,9 @@
+
+ #define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
+
++#define MEI_DEV_ID_MCC 0x4B70 /* Mule Creek Canyon (EHL) */
++#define MEI_DEV_ID_MCC_4 0x4B75 /* Mule Creek Canyon 4 (EHL) */
++
+ /*
+ * MEI HW Section
+ */
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index 4299658d48d6..a66ebceea408 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -107,6 +107,9 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_MCC, MEI_ME_PCH12_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_MCC_4, MEI_ME_PCH8_CFG)},
++
+ /* required last entry */
+ {0, }
+ };
+diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c
+index fa8d9da2ab7f..e248d7945c06 100644
+--- a/drivers/mmc/host/sdhci-pci-o2micro.c
++++ b/drivers/mmc/host/sdhci-pci-o2micro.c
+@@ -290,11 +290,21 @@ int sdhci_pci_o2_probe_slot(struct sdhci_pci_slot *slot)
+ {
+ struct sdhci_pci_chip *chip;
+ struct sdhci_host *host;
+- u32 reg;
++ u32 reg, caps;
+ int ret;
+
+ chip = slot->chip;
+ host = slot->host;
++
++ caps = sdhci_readl(host, SDHCI_CAPABILITIES);
++
++ /*
++ * mmc_select_bus_width() will test the bus to determine the actual bus
++ * width.
++ */
++ if (caps & SDHCI_CAN_DO_8BIT)
++ host->mmc->caps |= MMC_CAP_8_BIT_DATA;
++
+ switch (chip->pdev->device) {
+ case PCI_DEVICE_ID_O2_SDS0:
+ case PCI_DEVICE_ID_O2_SEABIRD0:
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+index d97e0d7e541a..b766362031c3 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+@@ -1065,14 +1065,12 @@ static void cudbg_t4_fwcache(struct cudbg_init *pdbg_init,
+ }
+ }
+
+-static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init,
+- struct cudbg_buffer *dbg_buff,
+- struct cudbg_error *cudbg_err,
+- u8 mem_type)
++static unsigned long cudbg_mem_region_size(struct cudbg_init *pdbg_init,
++ struct cudbg_error *cudbg_err,
++ u8 mem_type)
+ {
+ struct adapter *padap = pdbg_init->adap;
+ struct cudbg_meminfo mem_info;
+- unsigned long size;
+ u8 mc_idx;
+ int rc;
+
+@@ -1086,7 +1084,16 @@ static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init,
+ if (rc)
+ return rc;
+
+- size = mem_info.avail[mc_idx].limit - mem_info.avail[mc_idx].base;
++ return mem_info.avail[mc_idx].limit - mem_info.avail[mc_idx].base;
++}
++
++static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init,
++ struct cudbg_buffer *dbg_buff,
++ struct cudbg_error *cudbg_err,
++ u8 mem_type)
++{
++ unsigned long size = cudbg_mem_region_size(pdbg_init, cudbg_err, mem_type);
++
+ return cudbg_read_fw_mem(pdbg_init, dbg_buff, mem_type, size,
+ cudbg_err);
+ }
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index a3132a9eb91c..ee39e2c1644a 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -86,7 +86,7 @@ static void nvdimm_bus_probe_end(struct nvdimm_bus *nvdimm_bus)
+ {
+ nvdimm_bus_lock(&nvdimm_bus->dev);
+ if (--nvdimm_bus->probe_active == 0)
+- wake_up(&nvdimm_bus->probe_wait);
++ wake_up(&nvdimm_bus->wait);
+ nvdimm_bus_unlock(&nvdimm_bus->dev);
+ }
+
+@@ -348,7 +348,7 @@ struct nvdimm_bus *nvdimm_bus_register(struct device *parent,
+ return NULL;
+ INIT_LIST_HEAD(&nvdimm_bus->list);
+ INIT_LIST_HEAD(&nvdimm_bus->mapping_list);
+- init_waitqueue_head(&nvdimm_bus->probe_wait);
++ init_waitqueue_head(&nvdimm_bus->wait);
+ nvdimm_bus->id = ida_simple_get(&nd_ida, 0, 0, GFP_KERNEL);
+ mutex_init(&nvdimm_bus->reconfig_mutex);
+ badrange_init(&nvdimm_bus->badrange);
+@@ -418,6 +418,9 @@ static int nd_bus_remove(struct device *dev)
+ list_del_init(&nvdimm_bus->list);
+ mutex_unlock(&nvdimm_bus_list_mutex);
+
++ wait_event(nvdimm_bus->wait,
++ atomic_read(&nvdimm_bus->ioctl_active) == 0);
++
+ nd_synchronize();
+ device_for_each_child(&nvdimm_bus->dev, NULL, child_unregister);
+
+@@ -838,7 +841,7 @@ void wait_nvdimm_bus_probe_idle(struct device *dev)
+ if (nvdimm_bus->probe_active == 0)
+ break;
+ nvdimm_bus_unlock(&nvdimm_bus->dev);
+- wait_event(nvdimm_bus->probe_wait,
++ wait_event(nvdimm_bus->wait,
+ nvdimm_bus->probe_active == 0);
+ nvdimm_bus_lock(&nvdimm_bus->dev);
+ } while (true);
+@@ -1068,24 +1071,10 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ return rc;
+ }
+
+-static long nd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+-{
+- long id = (long) file->private_data;
+- int rc = -ENXIO, ro;
+- struct nvdimm_bus *nvdimm_bus;
+-
+- ro = ((file->f_flags & O_ACCMODE) == O_RDONLY);
+- mutex_lock(&nvdimm_bus_list_mutex);
+- list_for_each_entry(nvdimm_bus, &nvdimm_bus_list, list) {
+- if (nvdimm_bus->id == id) {
+- rc = __nd_ioctl(nvdimm_bus, NULL, ro, cmd, arg);
+- break;
+- }
+- }
+- mutex_unlock(&nvdimm_bus_list_mutex);
+-
+- return rc;
+-}
++enum nd_ioctl_mode {
++ BUS_IOCTL,
++ DIMM_IOCTL,
++};
+
+ static int match_dimm(struct device *dev, void *data)
+ {
+@@ -1100,31 +1089,62 @@ static int match_dimm(struct device *dev, void *data)
+ return 0;
+ }
+
+-static long nvdimm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++static long nd_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
++ enum nd_ioctl_mode mode)
++
+ {
+- int rc = -ENXIO, ro;
+- struct nvdimm_bus *nvdimm_bus;
++ struct nvdimm_bus *nvdimm_bus, *found = NULL;
++ long id = (long) file->private_data;
++ struct nvdimm *nvdimm = NULL;
++ int rc, ro;
+
+ ro = ((file->f_flags & O_ACCMODE) == O_RDONLY);
+ mutex_lock(&nvdimm_bus_list_mutex);
+ list_for_each_entry(nvdimm_bus, &nvdimm_bus_list, list) {
+- struct device *dev = device_find_child(&nvdimm_bus->dev,
+- file->private_data, match_dimm);
+- struct nvdimm *nvdimm;
+-
+- if (!dev)
+- continue;
++ if (mode == DIMM_IOCTL) {
++ struct device *dev;
++
++ dev = device_find_child(&nvdimm_bus->dev,
++ file->private_data, match_dimm);
++ if (!dev)
++ continue;
++ nvdimm = to_nvdimm(dev);
++ found = nvdimm_bus;
++ } else if (nvdimm_bus->id == id) {
++ found = nvdimm_bus;
++ }
+
+- nvdimm = to_nvdimm(dev);
+- rc = __nd_ioctl(nvdimm_bus, nvdimm, ro, cmd, arg);
+- put_device(dev);
+- break;
++ if (found) {
++ atomic_inc(&nvdimm_bus->ioctl_active);
++ break;
++ }
+ }
+ mutex_unlock(&nvdimm_bus_list_mutex);
+
++ if (!found)
++ return -ENXIO;
++
++ nvdimm_bus = found;
++ rc = __nd_ioctl(nvdimm_bus, nvdimm, ro, cmd, arg);
++
++ if (nvdimm)
++ put_device(&nvdimm->dev);
++ if (atomic_dec_and_test(&nvdimm_bus->ioctl_active))
++ wake_up(&nvdimm_bus->wait);
++
+ return rc;
+ }
+
++static long bus_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++ return nd_ioctl(file, cmd, arg, BUS_IOCTL);
++}
++
++static long dimm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++ return nd_ioctl(file, cmd, arg, DIMM_IOCTL);
++}
++
+ static int nd_open(struct inode *inode, struct file *file)
+ {
+ long minor = iminor(inode);
+@@ -1136,16 +1156,16 @@ static int nd_open(struct inode *inode, struct file *file)
+ static const struct file_operations nvdimm_bus_fops = {
+ .owner = THIS_MODULE,
+ .open = nd_open,
+- .unlocked_ioctl = nd_ioctl,
+- .compat_ioctl = nd_ioctl,
++ .unlocked_ioctl = bus_ioctl,
++ .compat_ioctl = bus_ioctl,
+ .llseek = noop_llseek,
+ };
+
+ static const struct file_operations nvdimm_fops = {
+ .owner = THIS_MODULE,
+ .open = nd_open,
+- .unlocked_ioctl = nvdimm_ioctl,
+- .compat_ioctl = nvdimm_ioctl,
++ .unlocked_ioctl = dimm_ioctl,
++ .compat_ioctl = dimm_ioctl,
+ .llseek = noop_llseek,
+ };
+
+diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h
+index 5ff254dc9b14..adf62a6c0fe2 100644
+--- a/drivers/nvdimm/nd-core.h
++++ b/drivers/nvdimm/nd-core.h
+@@ -25,10 +25,11 @@ extern int nvdimm_major;
+
+ struct nvdimm_bus {
+ struct nvdimm_bus_descriptor *nd_desc;
+- wait_queue_head_t probe_wait;
++ wait_queue_head_t wait;
+ struct list_head list;
+ struct device dev;
+ int id, probe_active;
++ atomic_t ioctl_active;
+ struct list_head mapping_list;
+ struct mutex reconfig_mutex;
+ struct badrange badrange;
+diff --git a/drivers/pci/controller/dwc/pci-dra7xx.c b/drivers/pci/controller/dwc/pci-dra7xx.c
+index a32d6dde7a57..412524aa1fde 100644
+--- a/drivers/pci/controller/dwc/pci-dra7xx.c
++++ b/drivers/pci/controller/dwc/pci-dra7xx.c
+@@ -26,6 +26,7 @@
+ #include <linux/types.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/regmap.h>
++#include <linux/gpio/consumer.h>
+
+ #include "../../pci.h"
+ #include "pcie-designware.h"
+diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
+index a939e8d31735..a2d1e89d4867 100644
+--- a/drivers/pci/controller/pcie-mobiveil.c
++++ b/drivers/pci/controller/pcie-mobiveil.c
+@@ -508,6 +508,12 @@ static int mobiveil_host_init(struct mobiveil_pcie *pcie)
+ return err;
+ }
+
++ /* setup bus numbers */
++ value = csr_readl(pcie, PCI_PRIMARY_BUS);
++ value &= 0xff000000;
++ value |= 0x00ff0100;
++ csr_writel(pcie, value, PCI_PRIMARY_BUS);
++
+ /*
+ * program Bus Master Enable Bit in Command Register in PAB Config
+ * Space
+@@ -547,7 +553,7 @@ static int mobiveil_host_init(struct mobiveil_pcie *pcie)
+ resource_size(pcie->ob_io_res));
+
+ /* memory inbound translation window */
+- program_ib_windows(pcie, WIN_NUM_1, 0, MEM_WINDOW_TYPE, IB_WIN_SIZE);
++ program_ib_windows(pcie, WIN_NUM_0, 0, MEM_WINDOW_TYPE, IB_WIN_SIZE);
+
+ /* Get the I/O and memory ranges from DT */
+ resource_list_for_each_entry_safe(win, tmp, &pcie->resources) {
+@@ -559,11 +565,18 @@ static int mobiveil_host_init(struct mobiveil_pcie *pcie)
+ if (type) {
+ /* configure outbound translation window */
+ program_ob_windows(pcie, pcie->ob_wins_configured,
+- win->res->start, 0, type,
+- resource_size(win->res));
++ win->res->start,
++ win->res->start - win->offset,
++ type, resource_size(win->res));
+ }
+ }
+
++ /* fixup for PCIe class register */
++ value = csr_readl(pcie, PAB_INTP_AXI_PIO_CLASS);
++ value &= 0xff;
++ value |= (PCI_CLASS_BRIDGE_PCI << 16);
++ csr_writel(pcie, value, PAB_INTP_AXI_PIO_CLASS);
++
+ /* setup MSI hardware registers */
+ mobiveil_pcie_enable_msi(pcie);
+
+@@ -804,9 +817,6 @@ static int mobiveil_pcie_probe(struct platform_device *pdev)
+ goto error;
+ }
+
+- /* fixup for PCIe class register */
+- csr_writel(pcie, 0x060402ab, PAB_INTP_AXI_PIO_CLASS);
+-
+ /* initialize the IRQ domains */
+ ret = mobiveil_pcie_init_irq_domain(pcie);
+ if (ret) {
+diff --git a/drivers/pci/controller/pcie-xilinx-nwl.c b/drivers/pci/controller/pcie-xilinx-nwl.c
+index fb32840ce8e6..4850a1b8eec1 100644
+--- a/drivers/pci/controller/pcie-xilinx-nwl.c
++++ b/drivers/pci/controller/pcie-xilinx-nwl.c
+@@ -483,15 +483,13 @@ static int nwl_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ int i;
+
+ mutex_lock(&msi->lock);
+- bit = bitmap_find_next_zero_area(msi->bitmap, INT_PCI_MSI_NR, 0,
+- nr_irqs, 0);
+- if (bit >= INT_PCI_MSI_NR) {
++ bit = bitmap_find_free_region(msi->bitmap, INT_PCI_MSI_NR,
++ get_count_order(nr_irqs));
++ if (bit < 0) {
+ mutex_unlock(&msi->lock);
+ return -ENOSPC;
+ }
+
+- bitmap_set(msi->bitmap, bit, nr_irqs);
+-
+ for (i = 0; i < nr_irqs; i++) {
+ irq_domain_set_info(domain, virq + i, bit + i, &nwl_irq_chip,
+ domain->host_data, handle_simple_irq,
+@@ -509,7 +507,8 @@ static void nwl_irq_domain_free(struct irq_domain *domain, unsigned int virq,
+ struct nwl_msi *msi = &pcie->msi;
+
+ mutex_lock(&msi->lock);
+- bitmap_clear(msi->bitmap, data->hwirq, nr_irqs);
++ bitmap_release_region(msi->bitmap, data->hwirq,
++ get_count_order(nr_irqs));
+ mutex_unlock(&msi->lock);
+ }
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 33f3f475e5c6..956ee7527d2c 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -414,6 +414,9 @@ static int pci_device_probe(struct device *dev)
+ struct pci_dev *pci_dev = to_pci_dev(dev);
+ struct pci_driver *drv = to_pci_driver(dev->driver);
+
++ if (!pci_device_can_probe(pci_dev))
++ return -ENODEV;
++
+ pci_assign_irq(pci_dev);
+
+ error = pcibios_alloc_irq(pci_dev);
+@@ -421,12 +424,10 @@ static int pci_device_probe(struct device *dev)
+ return error;
+
+ pci_dev_get(pci_dev);
+- if (pci_device_can_probe(pci_dev)) {
+- error = __pci_device_probe(drv, pci_dev);
+- if (error) {
+- pcibios_free_irq(pci_dev);
+- pci_dev_put(pci_dev);
+- }
++ error = __pci_device_probe(drv, pci_dev);
++ if (error) {
++ pcibios_free_irq(pci_dev);
++ pci_dev_put(pci_dev);
+ }
+
+ return error;
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index 9ecfe13157c0..1edf5a1836ea 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -478,7 +478,7 @@ static ssize_t remove_store(struct device *dev, struct device_attribute *attr,
+ pci_stop_and_remove_bus_device_locked(to_pci_dev(dev));
+ return count;
+ }
+-static struct device_attribute dev_remove_attr = __ATTR(remove,
++static struct device_attribute dev_remove_attr = __ATTR_IGNORE_LOCKDEP(remove,
+ (S_IWUSR|S_IWGRP),
+ NULL, remove_store);
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen2.c b/drivers/phy/renesas/phy-rcar-gen2.c
+index 97d4dd6ea924..aa02b19b7e0e 100644
+--- a/drivers/phy/renesas/phy-rcar-gen2.c
++++ b/drivers/phy/renesas/phy-rcar-gen2.c
+@@ -288,6 +288,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev)
+ error = of_property_read_u32(np, "reg", &channel_num);
+ if (error || channel_num > 2) {
+ dev_err(dev, "Invalid \"reg\" property\n");
++ of_node_put(np);
+ return error;
+ }
+ channel->select_mask = select_mask[channel_num];
+@@ -303,6 +304,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev)
+ &rcar_gen2_phy_ops);
+ if (IS_ERR(phy->phy)) {
+ dev_err(dev, "Failed to create PHY\n");
++ of_node_put(np);
+ return PTR_ERR(phy->phy);
+ }
+ phy_set_drvdata(phy->phy, phy);
+diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
+index f4a61429e06e..8d83817935da 100644
+--- a/drivers/pinctrl/pinctrl-rockchip.c
++++ b/drivers/pinctrl/pinctrl-rockchip.c
+@@ -3172,6 +3172,7 @@ static int rockchip_get_bank_data(struct rockchip_pin_bank *bank,
+ base,
+ &rockchip_regmap_config);
+ }
++ of_node_put(node);
+ }
+
+ bank->irq = irq_of_parse_and_map(bank->of_node, 0);
+diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
+index ccafcc2c87ac..70433f756d8e 100644
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -402,16 +402,19 @@ static void vnt_free_int_bufs(struct vnt_private *priv)
+ kfree(priv->int_buf.data_buf);
+ }
+
+-static bool vnt_alloc_bufs(struct vnt_private *priv)
++static int vnt_alloc_bufs(struct vnt_private *priv)
+ {
++ int ret = 0;
+ struct vnt_usb_send_context *tx_context;
+ struct vnt_rcb *rcb;
+ int ii;
+
+ for (ii = 0; ii < priv->num_tx_context; ii++) {
+ tx_context = kmalloc(sizeof(*tx_context), GFP_KERNEL);
+- if (!tx_context)
++ if (!tx_context) {
++ ret = -ENOMEM;
+ goto free_tx;
++ }
+
+ priv->tx_context[ii] = tx_context;
+ tx_context->priv = priv;
+@@ -419,16 +422,20 @@ static bool vnt_alloc_bufs(struct vnt_private *priv)
+
+ /* allocate URBs */
+ tx_context->urb = usb_alloc_urb(0, GFP_KERNEL);
+- if (!tx_context->urb)
++ if (!tx_context->urb) {
++ ret = -ENOMEM;
+ goto free_tx;
++ }
+
+ tx_context->in_use = false;
+ }
+
+ for (ii = 0; ii < priv->num_rcb; ii++) {
+ priv->rcb[ii] = kzalloc(sizeof(*priv->rcb[ii]), GFP_KERNEL);
+- if (!priv->rcb[ii])
++ if (!priv->rcb[ii]) {
++ ret = -ENOMEM;
+ goto free_rx_tx;
++ }
+
+ rcb = priv->rcb[ii];
+
+@@ -436,39 +443,46 @@ static bool vnt_alloc_bufs(struct vnt_private *priv)
+
+ /* allocate URBs */
+ rcb->urb = usb_alloc_urb(0, GFP_KERNEL);
+- if (!rcb->urb)
++ if (!rcb->urb) {
++ ret = -ENOMEM;
+ goto free_rx_tx;
++ }
+
+ rcb->skb = dev_alloc_skb(priv->rx_buf_sz);
+- if (!rcb->skb)
++ if (!rcb->skb) {
++ ret = -ENOMEM;
+ goto free_rx_tx;
++ }
+
+ rcb->in_use = false;
+
+ /* submit rx urb */
+- if (vnt_submit_rx_urb(priv, rcb))
++ ret = vnt_submit_rx_urb(priv, rcb);
++ if (ret)
+ goto free_rx_tx;
+ }
+
+ priv->interrupt_urb = usb_alloc_urb(0, GFP_KERNEL);
+- if (!priv->interrupt_urb)
++ if (!priv->interrupt_urb) {
++ ret = -ENOMEM;
+ goto free_rx_tx;
++ }
+
+ priv->int_buf.data_buf = kmalloc(MAX_INTERRUPT_SIZE, GFP_KERNEL);
+ if (!priv->int_buf.data_buf) {
+- usb_free_urb(priv->interrupt_urb);
+- goto free_rx_tx;
++ ret = -ENOMEM;
++ goto free_rx_tx_urb;
+ }
+
+- return true;
++ return 0;
+
++free_rx_tx_urb:
++ usb_free_urb(priv->interrupt_urb);
+ free_rx_tx:
+ vnt_free_rx_bufs(priv);
+-
+ free_tx:
+ vnt_free_tx_bufs(priv);
+-
+- return false;
++ return ret;
+ }
+
+ static void vnt_tx_80211(struct ieee80211_hw *hw,
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index e26d87b6ffc5..aa4de6907f77 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1874,7 +1874,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ status = serial8250_rx_chars(up, status);
+ }
+ serial8250_modem_status(up);
+- if ((!up->dma || up->dma->tx_err) && (status & UART_LSR_THRE))
++ if ((!up->dma || up->dma->tx_err) && (status & UART_LSR_THRE) &&
++ (up->ier & UART_IER_THRI))
+ serial8250_tx_chars(up);
+
+ spin_unlock_irqrestore(&port->lock, flags);
+diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+index e5389591bb4f..ad40c75bb58f 100644
+--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c
++++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+@@ -407,7 +407,16 @@ static int cpm_uart_startup(struct uart_port *port)
+ clrbits16(&pinfo->sccp->scc_sccm, UART_SCCM_RX);
+ }
+ cpm_uart_initbd(pinfo);
+- cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX);
++ if (IS_SMC(pinfo)) {
++ out_be32(&pinfo->smcup->smc_rstate, 0);
++ out_be32(&pinfo->smcup->smc_tstate, 0);
++ out_be16(&pinfo->smcup->smc_rbptr,
++ in_be16(&pinfo->smcup->smc_rbase));
++ out_be16(&pinfo->smcup->smc_tbptr,
++ in_be16(&pinfo->smcup->smc_tbase));
++ } else {
++ cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX);
++ }
+ }
+ /* Install interrupt handler. */
+ retval = request_irq(port->irq, cpm_uart_int, 0, "cpm_uart", port);
+@@ -861,16 +870,14 @@ static void cpm_uart_init_smc(struct uart_cpm_port *pinfo)
+ (u8 __iomem *)pinfo->tx_bd_base - DPRAM_BASE);
+
+ /*
+- * In case SMC1 is being relocated...
++ * In case SMC is being relocated...
+ */
+-#if defined (CONFIG_I2C_SPI_SMC1_UCODE_PATCH)
+ out_be16(&up->smc_rbptr, in_be16(&pinfo->smcup->smc_rbase));
+ out_be16(&up->smc_tbptr, in_be16(&pinfo->smcup->smc_tbase));
+ out_be32(&up->smc_rstate, 0);
+ out_be32(&up->smc_tstate, 0);
+ out_be16(&up->smc_brkcr, 1); /* number of break chars */
+ out_be16(&up->smc_brkec, 0);
+-#endif
+
+ /* Set up the uart parameters in the
+ * parameter ram.
+@@ -884,8 +891,6 @@ static void cpm_uart_init_smc(struct uart_cpm_port *pinfo)
+ out_be16(&up->smc_brkec, 0);
+ out_be16(&up->smc_brkcr, 1);
+
+- cpm_line_cr_cmd(pinfo, CPM_CR_INIT_TRX);
+-
+ /* Set UART mode, 8 bit, no parity, one stop.
+ * Enable receive and transmit.
+ */
+diff --git a/drivers/tty/serial/digicolor-usart.c b/drivers/tty/serial/digicolor-usart.c
+index f460cca139e2..13ac36e2da4f 100644
+--- a/drivers/tty/serial/digicolor-usart.c
++++ b/drivers/tty/serial/digicolor-usart.c
+@@ -541,7 +541,11 @@ static int __init digicolor_uart_init(void)
+ if (ret)
+ return ret;
+
+- return platform_driver_register(&digicolor_uart_platform);
++ ret = platform_driver_register(&digicolor_uart_platform);
++ if (ret)
++ uart_unregister_driver(&digicolor_uart);
++
++ return ret;
+ }
+ module_init(digicolor_uart_init);
+
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 0f67197a3783..105de92b0b3b 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -382,6 +382,7 @@ static void imx_uart_ucrs_restore(struct imx_port *sport,
+ }
+ #endif
+
++/* called with port.lock taken and irqs caller dependent */
+ static void imx_uart_rts_active(struct imx_port *sport, u32 *ucr2)
+ {
+ *ucr2 &= ~(UCR2_CTSC | UCR2_CTS);
+@@ -390,6 +391,7 @@ static void imx_uart_rts_active(struct imx_port *sport, u32 *ucr2)
+ mctrl_gpio_set(sport->gpios, sport->port.mctrl);
+ }
+
++/* called with port.lock taken and irqs caller dependent */
+ static void imx_uart_rts_inactive(struct imx_port *sport, u32 *ucr2)
+ {
+ *ucr2 &= ~UCR2_CTSC;
+@@ -399,6 +401,7 @@ static void imx_uart_rts_inactive(struct imx_port *sport, u32 *ucr2)
+ mctrl_gpio_set(sport->gpios, sport->port.mctrl);
+ }
+
++/* called with port.lock taken and irqs caller dependent */
+ static void imx_uart_rts_auto(struct imx_port *sport, u32 *ucr2)
+ {
+ *ucr2 |= UCR2_CTSC;
+@@ -1554,6 +1557,16 @@ imx_uart_set_termios(struct uart_port *port, struct ktermios *termios,
+ old_csize = CS8;
+ }
+
++ del_timer_sync(&sport->timer);
++
++ /*
++ * Ask the core to calculate the divisor for us.
++ */
++ baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16);
++ quot = uart_get_divisor(port, baud);
++
++ spin_lock_irqsave(&sport->port.lock, flags);
++
+ if ((termios->c_cflag & CSIZE) == CS8)
+ ucr2 = UCR2_WS | UCR2_SRST | UCR2_IRTS;
+ else
+@@ -1597,16 +1610,6 @@ imx_uart_set_termios(struct uart_port *port, struct ktermios *termios,
+ ucr2 |= UCR2_PROE;
+ }
+
+- del_timer_sync(&sport->timer);
+-
+- /*
+- * Ask the core to calculate the divisor for us.
+- */
+- baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16);
+- quot = uart_get_divisor(port, baud);
+-
+- spin_lock_irqsave(&sport->port.lock, flags);
+-
+ sport->port.read_status_mask = 0;
+ if (termios->c_iflag & INPCK)
+ sport->port.read_status_mask |= (URXD_FRMERR | URXD_PRERR);
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 38c48a02b920..bd3e6cf81af5 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -491,37 +491,48 @@ static bool max310x_reg_precious(struct device *dev, unsigned int reg)
+
+ static int max310x_set_baud(struct uart_port *port, int baud)
+ {
+- unsigned int mode = 0, clk = port->uartclk, div = clk / baud;
++ unsigned int mode = 0, div = 0, frac = 0, c = 0, F = 0;
+
+- /* Check for minimal value for divider */
+- if (div < 16)
+- div = 16;
+-
+- if (clk % baud && (div / 16) < 0x8000) {
++ /*
++ * Calculate the integer divisor first. Select a proper mode
++ * in case if the requested baud is too high for the pre-defined
++ * clocks frequency.
++ */
++ div = port->uartclk / baud;
++ if (div < 8) {
++ /* Mode x4 */
++ c = 4;
++ mode = MAX310X_BRGCFG_4XMODE_BIT;
++ } else if (div < 16) {
+ /* Mode x2 */
++ c = 8;
+ mode = MAX310X_BRGCFG_2XMODE_BIT;
+- clk = port->uartclk * 2;
+- div = clk / baud;
+-
+- if (clk % baud && (div / 16) < 0x8000) {
+- /* Mode x4 */
+- mode = MAX310X_BRGCFG_4XMODE_BIT;
+- clk = port->uartclk * 4;
+- div = clk / baud;
+- }
++ } else {
++ c = 16;
+ }
+
+- max310x_port_write(port, MAX310X_BRGDIVMSB_REG, (div / 16) >> 8);
+- max310x_port_write(port, MAX310X_BRGDIVLSB_REG, div / 16);
+- max310x_port_write(port, MAX310X_BRGCFG_REG, (div % 16) | mode);
++ /* Calculate the divisor in accordance with the fraction coefficient */
++ div /= c;
++ F = c*baud;
++
++ /* Calculate the baud rate fraction */
++ if (div > 0)
++ frac = (16*(port->uartclk % F)) / F;
++ else
++ div = 1;
++
++ max310x_port_write(port, MAX310X_BRGDIVMSB_REG, div >> 8);
++ max310x_port_write(port, MAX310X_BRGDIVLSB_REG, div);
++ max310x_port_write(port, MAX310X_BRGCFG_REG, frac | mode);
+
+- return DIV_ROUND_CLOSEST(clk, div);
++ /* Return the actual baud rate we just programmed */
++ return (16*port->uartclk) / (c*(16*div + frac));
+ }
+
+ static int max310x_update_best_err(unsigned long f, long *besterr)
+ {
+ /* Use baudrate 115200 for calculate error */
+- long err = f % (115200 * 16);
++ long err = f % (460800 * 16);
+
+ if ((*besterr < 0) || (*besterr > err)) {
+ *besterr = err;
+diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
+index 0f41b936da03..310bbae515b0 100644
+--- a/drivers/tty/serial/msm_serial.c
++++ b/drivers/tty/serial/msm_serial.c
+@@ -383,10 +383,14 @@ no_rx:
+
+ static inline void msm_wait_for_xmitr(struct uart_port *port)
+ {
++ unsigned int timeout = 500000;
++
+ while (!(msm_read(port, UART_SR) & UART_SR_TX_EMPTY)) {
+ if (msm_read(port, UART_ISR) & UART_ISR_TX_READY)
+ break;
+ udelay(1);
++ if (!timeout--)
++ break;
+ }
+ msm_write(port, UART_CR_CMD_RESET_TX_READY, UART_CR);
+ }
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 8dbeb14a1e3a..fe9261ffe3db 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1738,6 +1738,7 @@ static int uart_port_activate(struct tty_port *port, struct tty_struct *tty)
+ {
+ struct uart_state *state = container_of(port, struct uart_state, port);
+ struct uart_port *uport;
++ int ret;
+
+ uport = uart_port_check(state);
+ if (!uport || uport->flags & UPF_DEAD)
+@@ -1748,7 +1749,11 @@ static int uart_port_activate(struct tty_port *port, struct tty_struct *tty)
+ /*
+ * Start up the serial port.
+ */
+- return uart_startup(tty, state, 0);
++ ret = uart_startup(tty, state, 0);
++ if (ret > 0)
++ tty_port_set_active(port, 1);
++
++ return ret;
+ }
+
+ static const char *uart_type(struct uart_port *port)
+diff --git a/drivers/tty/serial/serial_mctrl_gpio.c b/drivers/tty/serial/serial_mctrl_gpio.c
+index 1c06325beaca..07f318603e74 100644
+--- a/drivers/tty/serial/serial_mctrl_gpio.c
++++ b/drivers/tty/serial/serial_mctrl_gpio.c
+@@ -12,6 +12,7 @@
+ #include <linux/termios.h>
+ #include <linux/serial_core.h>
+ #include <linux/module.h>
++#include <linux/property.h>
+
+ #include "serial_mctrl_gpio.h"
+
+@@ -115,6 +116,19 @@ struct mctrl_gpios *mctrl_gpio_init_noauto(struct device *dev, unsigned int idx)
+
+ for (i = 0; i < UART_GPIO_MAX; i++) {
+ enum gpiod_flags flags;
++ char *gpio_str;
++ bool present;
++
++ /* Check if GPIO property exists and continue if not */
++ gpio_str = kasprintf(GFP_KERNEL, "%s-gpios",
++ mctrl_gpios_desc[i].name);
++ if (!gpio_str)
++ continue;
++
++ present = device_property_present(dev, gpio_str);
++ kfree(gpio_str);
++ if (!present)
++ continue;
+
+ if (mctrl_gpios_desc[i].dir_out)
+ flags = GPIOD_OUT_LOW;
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 040832635a64..5550289e6678 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1376,6 +1376,7 @@ static void work_fn_tx(struct work_struct *work)
+ struct circ_buf *xmit = &port->state->xmit;
+ unsigned long flags;
+ dma_addr_t buf;
++ int head, tail;
+
+ /*
+ * DMA is idle now.
+@@ -1385,16 +1386,23 @@ static void work_fn_tx(struct work_struct *work)
+ * consistent xmit buffer state.
+ */
+ spin_lock_irq(&port->lock);
+- buf = s->tx_dma_addr + (xmit->tail & (UART_XMIT_SIZE - 1));
++ head = xmit->head;
++ tail = xmit->tail;
++ buf = s->tx_dma_addr + (tail & (UART_XMIT_SIZE - 1));
+ s->tx_dma_len = min_t(unsigned int,
+- CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE),
+- CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE));
+- spin_unlock_irq(&port->lock);
++ CIRC_CNT(head, tail, UART_XMIT_SIZE),
++ CIRC_CNT_TO_END(head, tail, UART_XMIT_SIZE));
++ if (!s->tx_dma_len) {
++ /* Transmit buffer has been flushed */
++ spin_unlock_irq(&port->lock);
++ return;
++ }
+
+ desc = dmaengine_prep_slave_single(chan, buf, s->tx_dma_len,
+ DMA_MEM_TO_DEV,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc) {
++ spin_unlock_irq(&port->lock);
+ dev_warn(port->dev, "Failed preparing Tx DMA descriptor\n");
+ goto switch_to_pio;
+ }
+@@ -1402,18 +1410,18 @@ static void work_fn_tx(struct work_struct *work)
+ dma_sync_single_for_device(chan->device->dev, buf, s->tx_dma_len,
+ DMA_TO_DEVICE);
+
+- spin_lock_irq(&port->lock);
+ desc->callback = sci_dma_tx_complete;
+ desc->callback_param = s;
+- spin_unlock_irq(&port->lock);
+ s->cookie_tx = dmaengine_submit(desc);
+ if (dma_submit_error(s->cookie_tx)) {
++ spin_unlock_irq(&port->lock);
+ dev_warn(port->dev, "Failed submitting Tx DMA descriptor\n");
+ goto switch_to_pio;
+ }
+
++ spin_unlock_irq(&port->lock);
+ dev_dbg(port->dev, "%s: %p: %d...%d, cookie %d\n",
+- __func__, xmit->buf, xmit->tail, xmit->head, s->cookie_tx);
++ __func__, xmit->buf, tail, head, s->cookie_tx);
+
+ dma_async_issue_pending(chan);
+ return;
+@@ -1633,11 +1641,18 @@ static void sci_free_dma(struct uart_port *port)
+
+ static void sci_flush_buffer(struct uart_port *port)
+ {
++ struct sci_port *s = to_sci_port(port);
++
+ /*
+ * In uart_flush_buffer(), the xmit circular buffer has just been
+- * cleared, so we have to reset tx_dma_len accordingly.
++ * cleared, so we have to reset tx_dma_len accordingly, and stop any
++ * pending transfers
+ */
+- to_sci_port(port)->tx_dma_len = 0;
++ s->tx_dma_len = 0;
++ if (s->chan_tx) {
++ dmaengine_terminate_async(s->chan_tx);
++ s->cookie_tx = -EINVAL;
++ }
+ }
+ #else /* !CONFIG_SERIAL_SH_SCI_DMA */
+ static inline void sci_request_dma(struct uart_port *port)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index f4e8e869649a..8018f813972e 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3961,6 +3961,9 @@ static int usb_set_lpm_timeout(struct usb_device *udev,
+ * control transfers to set the hub timeout or enable device-initiated U1/U2
+ * will be successful.
+ *
++ * If the control transfer to enable device-initiated U1/U2 entry fails, then
++ * hub-initiated U1/U2 will be disabled.
++ *
+ * If we cannot set the parent hub U1/U2 timeout, we attempt to let the xHCI
+ * driver know about it. If that call fails, it should be harmless, and just
+ * take up more slightly more bus bandwidth for unnecessary U1/U2 exit latency.
+@@ -4015,23 +4018,24 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev,
+ * host know that this link state won't be enabled.
+ */
+ hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state);
+- } else {
+- /* Only a configured device will accept the Set Feature
+- * U1/U2_ENABLE
+- */
+- if (udev->actconfig)
+- usb_set_device_initiated_lpm(udev, state, true);
++ return;
++ }
+
+- /* As soon as usb_set_lpm_timeout(timeout) returns 0, the
+- * hub-initiated LPM is enabled. Thus, LPM is enabled no
+- * matter the result of usb_set_device_initiated_lpm().
+- * The only difference is whether device is able to initiate
+- * LPM.
+- */
++ /* Only a configured device will accept the Set Feature
++ * U1/U2_ENABLE
++ */
++ if (udev->actconfig &&
++ usb_set_device_initiated_lpm(udev, state, true) == 0) {
+ if (state == USB3_LPM_U1)
+ udev->usb3_lpm_u1_enabled = 1;
+ else if (state == USB3_LPM_U2)
+ udev->usb3_lpm_u2_enabled = 1;
++ } else {
++ /* Don't request U1/U2 entry if the device
++ * cannot transition to U1/U2.
++ */
++ usb_set_lpm_timeout(udev, state, 0);
++ hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state);
+ }
+ }
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index aa15593a3ac4..2050993fb58b 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1101,11 +1101,12 @@ static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
+ ENTER();
+
+ if (!is_sync_kiocb(kiocb)) {
+- p = kmalloc(sizeof(io_data), GFP_KERNEL);
++ p = kzalloc(sizeof(io_data), GFP_KERNEL);
+ if (unlikely(!p))
+ return -ENOMEM;
+ p->aio = true;
+ } else {
++ memset(p, 0, sizeof(*p));
+ p->aio = false;
+ }
+
+@@ -1137,11 +1138,12 @@ static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
+ ENTER();
+
+ if (!is_sync_kiocb(kiocb)) {
+- p = kmalloc(sizeof(io_data), GFP_KERNEL);
++ p = kzalloc(sizeof(io_data), GFP_KERNEL);
+ if (unlikely(!p))
+ return -ENOMEM;
+ p->aio = true;
+ } else {
++ memset(p, 0, sizeof(*p));
+ p->aio = false;
+ }
+
+diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
+index 09a8ebd95588..6968b9f2b76b 100644
+--- a/drivers/usb/host/hwa-hc.c
++++ b/drivers/usb/host/hwa-hc.c
+@@ -159,7 +159,7 @@ out:
+ return result;
+
+ error_set_cluster_id:
+- wusb_cluster_id_put(wusbhc->cluster_id);
++ wusb_cluster_id_put(addr);
+ error_cluster_id_get:
+ goto out;
+
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 3625a5c1a41b..070c66f86e67 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -205,7 +205,7 @@ int usb_amd_find_chipset_info(void)
+ {
+ unsigned long flags;
+ struct amd_chipset_info info;
+- int ret;
++ int need_pll_quirk = 0;
+
+ spin_lock_irqsave(&amd_lock, flags);
+
+@@ -219,21 +219,28 @@ int usb_amd_find_chipset_info(void)
+ spin_unlock_irqrestore(&amd_lock, flags);
+
+ if (!amd_chipset_sb_type_init(&info)) {
+- ret = 0;
+ goto commit;
+ }
+
+- /* Below chipset generations needn't enable AMD PLL quirk */
+- if (info.sb_type.gen == AMD_CHIPSET_UNKNOWN ||
+- info.sb_type.gen == AMD_CHIPSET_SB600 ||
+- info.sb_type.gen == AMD_CHIPSET_YANGTZE ||
+- (info.sb_type.gen == AMD_CHIPSET_SB700 &&
+- info.sb_type.rev > 0x3b)) {
++ switch (info.sb_type.gen) {
++ case AMD_CHIPSET_SB700:
++ need_pll_quirk = info.sb_type.rev <= 0x3B;
++ break;
++ case AMD_CHIPSET_SB800:
++ case AMD_CHIPSET_HUDSON2:
++ case AMD_CHIPSET_BOLTON:
++ need_pll_quirk = 1;
++ break;
++ default:
++ need_pll_quirk = 0;
++ break;
++ }
++
++ if (!need_pll_quirk) {
+ if (info.smbus_dev) {
+ pci_dev_put(info.smbus_dev);
+ info.smbus_dev = NULL;
+ }
+- ret = 0;
+ goto commit;
+ }
+
+@@ -252,7 +259,7 @@ int usb_amd_find_chipset_info(void)
+ }
+ }
+
+- ret = info.probe_result = 1;
++ need_pll_quirk = info.probe_result = 1;
+ printk(KERN_DEBUG "QUIRK: Enable AMD PLL fix\n");
+
+ commit:
+@@ -263,7 +270,7 @@ commit:
+
+ /* Mark that we where here */
+ amd_chipset.probe_count++;
+- ret = amd_chipset.probe_result;
++ need_pll_quirk = amd_chipset.probe_result;
+
+ spin_unlock_irqrestore(&amd_lock, flags);
+
+@@ -277,7 +284,7 @@ commit:
+ spin_unlock_irqrestore(&amd_lock, flags);
+ }
+
+- return ret;
++ return need_pll_quirk;
+ }
+ EXPORT_SYMBOL_GPL(usb_amd_find_chipset_info);
+
+diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
+index e1cbdfdb7c68..197069303510 100644
+--- a/fs/9p/vfs_addr.c
++++ b/fs/9p/vfs_addr.c
+@@ -50,8 +50,9 @@
+ * @page: structure to page
+ *
+ */
+-static int v9fs_fid_readpage(struct p9_fid *fid, struct page *page)
++static int v9fs_fid_readpage(void *data, struct page *page)
+ {
++ struct p9_fid *fid = data;
+ struct inode *inode = page->mapping->host;
+ struct bio_vec bvec = {.bv_page = page, .bv_len = PAGE_SIZE};
+ struct iov_iter to;
+@@ -122,7 +123,8 @@ static int v9fs_vfs_readpages(struct file *filp, struct address_space *mapping,
+ if (ret == 0)
+ return ret;
+
+- ret = read_cache_pages(mapping, pages, (void *)v9fs_vfs_readpage, filp);
++ ret = read_cache_pages(mapping, pages, v9fs_fid_readpage,
++ filp->private_data);
+ p9_debug(P9_DEBUG_VFS, " = %d\n", ret);
+ return ret;
+ }
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index c1cd3fe2b295..355ff08e9d44 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -388,10 +388,31 @@ static noinline int add_async_extent(struct async_cow *cow,
+ return 0;
+ }
+
++/*
++ * Check if the inode has flags compatible with compression
++ */
++static inline bool inode_can_compress(struct inode *inode)
++{
++ if (BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW ||
++ BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM)
++ return false;
++ return true;
++}
++
++/*
++ * Check if the inode needs to be submitted to compression, based on mount
++ * options, defragmentation, properties or heuristics.
++ */
+ static inline int inode_need_compress(struct inode *inode, u64 start, u64 end)
+ {
+ struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+
++ if (!inode_can_compress(inode)) {
++ WARN(IS_ENABLED(CONFIG_BTRFS_DEBUG),
++ KERN_ERR "BTRFS: unexpected compression for ino %llu\n",
++ btrfs_ino(BTRFS_I(inode)));
++ return 0;
++ }
+ /* force compress */
+ if (btrfs_test_opt(fs_info, FORCE_COMPRESS))
+ return 1;
+@@ -1596,7 +1617,8 @@ static int run_delalloc_range(void *private_data, struct page *locked_page,
+ } else if (BTRFS_I(inode)->flags & BTRFS_INODE_PREALLOC && !force_cow) {
+ ret = run_delalloc_nocow(inode, locked_page, start, end,
+ page_started, 0, nr_written);
+- } else if (!inode_need_compress(inode, start, end)) {
++ } else if (!inode_can_compress(inode) ||
++ !inode_need_compress(inode, start, end)) {
+ ret = cow_file_range(inode, locked_page, start, end, end,
+ page_started, nr_written, 1, NULL);
+ } else {
+diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
+index a5e4a221435c..a93ebffe84b3 100644
+--- a/fs/dlm/lowcomms.c
++++ b/fs/dlm/lowcomms.c
+@@ -1630,8 +1630,10 @@ static void clean_writequeues(void)
+
+ static void work_stop(void)
+ {
+- destroy_workqueue(recv_workqueue);
+- destroy_workqueue(send_workqueue);
++ if (recv_workqueue)
++ destroy_workqueue(recv_workqueue);
++ if (send_workqueue)
++ destroy_workqueue(send_workqueue);
+ }
+
+ static int work_start(void)
+@@ -1691,13 +1693,17 @@ static void work_flush(void)
+ struct hlist_node *n;
+ struct connection *con;
+
+- flush_workqueue(recv_workqueue);
+- flush_workqueue(send_workqueue);
++ if (recv_workqueue)
++ flush_workqueue(recv_workqueue);
++ if (send_workqueue)
++ flush_workqueue(send_workqueue);
+ do {
+ ok = 1;
+ foreach_conn(stop_conn);
+- flush_workqueue(recv_workqueue);
+- flush_workqueue(send_workqueue);
++ if (recv_workqueue)
++ flush_workqueue(recv_workqueue);
++ if (send_workqueue)
++ flush_workqueue(send_workqueue);
+ for (i = 0; i < CONN_HASH_SIZE && ok; i++) {
+ hlist_for_each_entry_safe(con, n,
+ &connection_hash[i], list) {
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 8fc3edb6760c..92f72bb5aff4 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -3261,6 +3261,11 @@ static int read_compacted_summaries(struct f2fs_sb_info *sbi)
+ seg_i = CURSEG_I(sbi, i);
+ segno = le32_to_cpu(ckpt->cur_data_segno[i]);
+ blk_off = le16_to_cpu(ckpt->cur_data_blkoff[i]);
++ if (blk_off > ENTRIES_IN_SUM) {
++ f2fs_bug_on(sbi, 1);
++ f2fs_put_page(page, 1);
++ return -EFAULT;
++ }
+ seg_i->next_segno = segno;
+ reset_curseg(sbi, i, 0);
+ seg_i->alloc_type = ckpt->alloc_type[i];
+diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
+index 29dee9630eec..a18b8d7a3075 100644
+--- a/fs/notify/fanotify/fanotify.c
++++ b/fs/notify/fanotify/fanotify.c
+@@ -148,10 +148,13 @@ struct fanotify_event_info *fanotify_alloc_event(struct fsnotify_group *group,
+ /*
+ * For queues with unlimited length lost events are not expected and
+ * can possibly have security implications. Avoid losing events when
+- * memory is short.
++ * memory is short. For the limited size queues, avoid OOM killer in the
++ * target monitoring memcg as it may have security repercussion.
+ */
+ if (group->max_events == UINT_MAX)
+ gfp |= __GFP_NOFAIL;
++ else
++ gfp |= __GFP_RETRY_MAYFAIL;
+
+ /* Whoever is interested in the event, pays for the allocation. */
+ memalloc_use_memcg(group->memcg);
+diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
+index f4184b4f3815..16b8702af0e7 100644
+--- a/fs/notify/inotify/inotify_fsnotify.c
++++ b/fs/notify/inotify/inotify_fsnotify.c
+@@ -99,9 +99,13 @@ int inotify_handle_event(struct fsnotify_group *group,
+ i_mark = container_of(inode_mark, struct inotify_inode_mark,
+ fsn_mark);
+
+- /* Whoever is interested in the event, pays for the allocation. */
++ /*
++ * Whoever is interested in the event, pays for the allocation. Do not
++ * trigger OOM killer in the target monitoring memcg as it may have
++ * security repercussion.
++ */
+ memalloc_use_memcg(group->memcg);
+- event = kmalloc(alloc_len, GFP_KERNEL_ACCOUNT);
++ event = kmalloc(alloc_len, GFP_KERNEL_ACCOUNT | __GFP_RETRY_MAYFAIL);
+ memalloc_unuse_memcg();
+
+ if (unlikely(!event)) {
+diff --git a/fs/open.c b/fs/open.c
+index a00350018a47..878478745924 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -373,6 +373,25 @@ long do_faccessat(int dfd, const char __user *filename, int mode)
+ override_cred->cap_permitted;
+ }
+
++ /*
++ * The new set of credentials can *only* be used in
++ * task-synchronous circumstances, and does not need
++ * RCU freeing, unless somebody then takes a separate
++ * reference to it.
++ *
++ * NOTE! This is _only_ true because this credential
++ * is used purely for override_creds() that installs
++ * it as the subjective cred. Other threads will be
++ * accessing ->real_cred, not the subjective cred.
++ *
++ * If somebody _does_ make a copy of this (using the
++ * 'get_current_cred()' function), that will clear the
++ * non_rcu field, because now that other user may be
++ * expecting RCU freeing. But normal thread-synchronous
++ * cred accesses will keep things non-RCY.
++ */
++ override_cred->non_rcu = 1;
++
+ old_cred = override_creds(override_cred);
+ retry:
+ res = user_path_at(dfd, filename, lookup_flags, &path);
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index f999e8bd3771..a7fbda72afeb 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -1960,9 +1960,12 @@ static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags)
+ goto out;
+
+ if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) {
+- down_read(&mm->mmap_sem);
+- exact_vma_exists = !!find_exact_vma(mm, vm_start, vm_end);
+- up_read(&mm->mmap_sem);
++ status = down_read_killable(&mm->mmap_sem);
++ if (!status) {
++ exact_vma_exists = !!find_exact_vma(mm, vm_start,
++ vm_end);
++ up_read(&mm->mmap_sem);
++ }
+ }
+
+ mmput(mm);
+@@ -2008,8 +2011,11 @@ static int map_files_get_link(struct dentry *dentry, struct path *path)
+ if (rc)
+ goto out_mmput;
+
++ rc = down_read_killable(&mm->mmap_sem);
++ if (rc)
++ goto out_mmput;
++
+ rc = -ENOENT;
+- down_read(&mm->mmap_sem);
+ vma = find_exact_vma(mm, vm_start, vm_end);
+ if (vma && vma->vm_file) {
+ *path = vma->vm_file->f_path;
+@@ -2105,7 +2111,11 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
+ if (!mm)
+ goto out_put_task;
+
+- down_read(&mm->mmap_sem);
++ result = ERR_PTR(-EINTR);
++ if (down_read_killable(&mm->mmap_sem))
++ goto out_put_mm;
++
++ result = ERR_PTR(-ENOENT);
+ vma = find_exact_vma(mm, vm_start, vm_end);
+ if (!vma)
+ goto out_no_vma;
+@@ -2116,6 +2126,7 @@ static struct dentry *proc_map_files_lookup(struct inode *dir,
+
+ out_no_vma:
+ up_read(&mm->mmap_sem);
++out_put_mm:
+ mmput(mm);
+ out_put_task:
+ put_task_struct(task);
+@@ -2157,7 +2168,12 @@ proc_map_files_readdir(struct file *file, struct dir_context *ctx)
+ mm = get_task_mm(task);
+ if (!mm)
+ goto out_put_task;
+- down_read(&mm->mmap_sem);
++
++ ret = down_read_killable(&mm->mmap_sem);
++ if (ret) {
++ mmput(mm);
++ goto out_put_task;
++ }
+
+ nr_files = 0;
+
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index c5819baee35c..71aba44c4fa6 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -166,7 +166,11 @@ static void *m_start(struct seq_file *m, loff_t *ppos)
+ if (!mm || !mmget_not_zero(mm))
+ return NULL;
+
+- down_read(&mm->mmap_sem);
++ if (down_read_killable(&mm->mmap_sem)) {
++ mmput(mm);
++ return ERR_PTR(-EINTR);
++ }
++
+ hold_task_mempolicy(priv);
+ priv->tail_vma = get_gate_vma(mm);
+
+@@ -826,7 +830,10 @@ static int show_smaps_rollup(struct seq_file *m, void *v)
+
+ memset(&mss, 0, sizeof(mss));
+
+- down_read(&mm->mmap_sem);
++ ret = down_read_killable(&mm->mmap_sem);
++ if (ret)
++ goto out_put_mm;
++
+ hold_task_mempolicy(priv);
+
+ for (vma = priv->mm->mmap; vma; vma = vma->vm_next) {
+@@ -843,8 +850,9 @@ static int show_smaps_rollup(struct seq_file *m, void *v)
+
+ release_task_mempolicy(priv);
+ up_read(&mm->mmap_sem);
+- mmput(mm);
+
++out_put_mm:
++ mmput(mm);
+ out_put_task:
+ put_task_struct(priv->task);
+ priv->task = NULL;
+@@ -1127,7 +1135,10 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
+ goto out_mm;
+ }
+
+- down_read(&mm->mmap_sem);
++ if (down_read_killable(&mm->mmap_sem)) {
++ count = -EINTR;
++ goto out_mm;
++ }
+ tlb_gather_mmu(&tlb, mm, 0, -1);
+ if (type == CLEAR_REFS_SOFT_DIRTY) {
+ for (vma = mm->mmap; vma; vma = vma->vm_next) {
+@@ -1531,7 +1542,9 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
+ /* overflow ? */
+ if (end < start_vaddr || end > end_vaddr)
+ end = end_vaddr;
+- down_read(&mm->mmap_sem);
++ ret = down_read_killable(&mm->mmap_sem);
++ if (ret)
++ goto out_free;
+ ret = walk_page_range(start_vaddr, end, &pagemap_walk);
+ up_read(&mm->mmap_sem);
+ start_vaddr = end;
+diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
+index 0b63d68dedb2..5161894a6d62 100644
+--- a/fs/proc/task_nommu.c
++++ b/fs/proc/task_nommu.c
+@@ -211,7 +211,11 @@ static void *m_start(struct seq_file *m, loff_t *pos)
+ if (!mm || !mmget_not_zero(mm))
+ return NULL;
+
+- down_read(&mm->mmap_sem);
++ if (down_read_killable(&mm->mmap_sem)) {
++ mmput(mm);
++ return ERR_PTR(-EINTR);
++ }
++
+ /* start from the Nth VMA */
+ for (p = rb_first(&mm->mm_rb); p; p = rb_next(p))
+ if (n-- == 0)
+diff --git a/include/linux/cred.h b/include/linux/cred.h
+index 7eed6101c791..1dc351d8548b 100644
+--- a/include/linux/cred.h
++++ b/include/linux/cred.h
+@@ -150,7 +150,11 @@ struct cred {
+ struct user_struct *user; /* real user ID subscription */
+ struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
+ struct group_info *group_info; /* supplementary groups for euid/fsgid */
+- struct rcu_head rcu; /* RCU deletion hook */
++ /* RCU deletion */
++ union {
++ int non_rcu; /* Can we skip RCU deletion? */
++ struct rcu_head rcu; /* RCU deletion hook */
++ };
+ } __randomize_layout;
+
+ extern void __put_cred(struct cred *);
+@@ -248,6 +252,7 @@ static inline const struct cred *get_cred(const struct cred *cred)
+ {
+ struct cred *nonconst_cred = (struct cred *) cred;
+ validate_creds(cred);
++ nonconst_cred->non_rcu = 0;
+ return get_new_cred(nonconst_cred);
+ }
+
+diff --git a/include/linux/host1x.h b/include/linux/host1x.h
+index 89110d896d72..aef6e2f73802 100644
+--- a/include/linux/host1x.h
++++ b/include/linux/host1x.h
+@@ -310,6 +310,8 @@ struct host1x_device {
+ struct list_head clients;
+
+ bool registered;
++
++ struct device_dma_parameters dma_parms;
+ };
+
+ static inline struct host1x_device *to_host1x_device(struct device *dev)
+diff --git a/kernel/cred.c b/kernel/cred.c
+index efd04b2ec84c..5ab1f7ec946e 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -147,7 +147,10 @@ void __put_cred(struct cred *cred)
+ BUG_ON(cred == current->cred);
+ BUG_ON(cred == current->real_cred);
+
+- call_rcu(&cred->rcu, put_cred_rcu);
++ if (cred->non_rcu)
++ put_cred_rcu(&cred->rcu);
++ else
++ call_rcu(&cred->rcu, put_cred_rcu);
+ }
+ EXPORT_SYMBOL(__put_cred);
+
+@@ -258,6 +261,7 @@ struct cred *prepare_creds(void)
+ old = task->cred;
+ memcpy(new, old, sizeof(struct cred));
+
++ new->non_rcu = 0;
+ atomic_set(&new->usage, 1);
+ set_cred_subscribers(new, 0);
+ get_group_info(new->group_info);
+@@ -537,7 +541,19 @@ const struct cred *override_creds(const struct cred *new)
+
+ validate_creds(old);
+ validate_creds(new);
+- get_cred(new);
++
++ /*
++ * NOTE! This uses 'get_new_cred()' rather than 'get_cred()'.
++ *
++ * That means that we do not clear the 'non_rcu' flag, since
++ * we are only installing the cred into the thread-synchronous
++ * '->cred' pointer, not the '->real_cred' pointer that is
++ * visible to other threads under RCU.
++ *
++ * Also note that we did validate_creds() manually, not depending
++ * on the validation in 'get_cred()'.
++ */
++ get_new_cred((struct cred *)new);
+ alter_cred_subscribers(new, 1);
+ rcu_assign_pointer(current->cred, new);
+ alter_cred_subscribers(old, -1);
+@@ -620,6 +636,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
+ validate_creds(old);
+
+ *new = *old;
++ new->non_rcu = 0;
+ atomic_set(&new->usage, 1);
+ set_cred_subscribers(new, 0);
+ get_uid(new->user);
+diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
+index 3dd980dfba2d..6fcc4650f0c4 100644
+--- a/kernel/locking/lockdep_proc.c
++++ b/kernel/locking/lockdep_proc.c
+@@ -200,7 +200,6 @@ static void lockdep_stats_debug_show(struct seq_file *m)
+
+ static int lockdep_stats_show(struct seq_file *m, void *v)
+ {
+- struct lock_class *class;
+ unsigned long nr_unused = 0, nr_uncategorized = 0,
+ nr_irq_safe = 0, nr_irq_unsafe = 0,
+ nr_softirq_safe = 0, nr_softirq_unsafe = 0,
+@@ -210,6 +209,9 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
+ nr_hardirq_read_safe = 0, nr_hardirq_read_unsafe = 0,
+ sum_forward_deps = 0;
+
++#ifdef CONFIG_PROVE_LOCKING
++ struct lock_class *class;
++
+ list_for_each_entry(class, &all_lock_classes, lock_entry) {
+
+ if (class->usage_mask == 0)
+@@ -241,12 +243,12 @@ static int lockdep_stats_show(struct seq_file *m, void *v)
+ if (class->usage_mask & LOCKF_ENABLED_HARDIRQ_READ)
+ nr_hardirq_read_unsafe++;
+
+-#ifdef CONFIG_PROVE_LOCKING
+ sum_forward_deps += lockdep_count_forward_deps(class);
+-#endif
+ }
+ #ifdef CONFIG_DEBUG_LOCKDEP
+ DEBUG_LOCKS_WARN_ON(debug_atomic_read(nr_unused_locks) != nr_unused);
++#endif
++
+ #endif
+ seq_printf(m, " lock-classes: %11lu [max: %lu]\n",
+ nr_lock_classes, MAX_LOCKDEP_KEYS);
+diff --git a/mm/gup.c b/mm/gup.c
+index caadd31714a5..f3088d25bd92 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -458,11 +458,14 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
+ pgd = pgd_offset_k(address);
+ else
+ pgd = pgd_offset_gate(mm, address);
+- BUG_ON(pgd_none(*pgd));
++ if (pgd_none(*pgd))
++ return -EFAULT;
+ p4d = p4d_offset(pgd, address);
+- BUG_ON(p4d_none(*p4d));
++ if (p4d_none(*p4d))
++ return -EFAULT;
+ pud = pud_offset(p4d, address);
+- BUG_ON(pud_none(*pud));
++ if (pud_none(*pud))
++ return -EFAULT;
+ pmd = pmd_offset(pud, address);
+ if (!pmd_present(*pmd))
+ return -EFAULT;
+@@ -1367,7 +1370,8 @@ static inline pte_t gup_get_pte(pte_t *ptep)
+ }
+ #endif
+
+-static void undo_dev_pagemap(int *nr, int nr_start, struct page **pages)
++static void __maybe_unused undo_dev_pagemap(int *nr, int nr_start,
++ struct page **pages)
+ {
+ while ((*nr) - nr_start) {
+ struct page *page = pages[--(*nr)];
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index 72e3fb3bb037..6c94b6865ac2 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -576,7 +576,7 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
+ if (in_irq()) {
+ object->pid = 0;
+ strncpy(object->comm, "hardirq", sizeof(object->comm));
+- } else if (in_softirq()) {
++ } else if (in_serving_softirq()) {
+ object->pid = 0;
+ strncpy(object->comm, "softirq", sizeof(object->comm));
+ } else {
+diff --git a/mm/memory.c b/mm/memory.c
+index e0010cb870e0..fb5655b518c9 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -4491,7 +4491,9 @@ int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+ void *old_buf = buf;
+ int write = gup_flags & FOLL_WRITE;
+
+- down_read(&mm->mmap_sem);
++ if (down_read_killable(&mm->mmap_sem))
++ return 0;
++
+ /* ignore errors, just check how much was successfully transferred */
+ while (len) {
+ int bytes, ret, offset;
+diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
+index 82bb1a939c0e..06dedb175572 100644
+--- a/mm/mmu_notifier.c
++++ b/mm/mmu_notifier.c
+@@ -316,7 +316,7 @@ static int do_mmu_notifier_register(struct mmu_notifier *mn,
+ * thanks to mm_take_all_locks().
+ */
+ spin_lock(&mm->mmu_notifier_mm->lock);
+- hlist_add_head(&mn->hlist, &mm->mmu_notifier_mm->list);
++ hlist_add_head_rcu(&mn->hlist, &mm->mmu_notifier_mm->list);
+ spin_unlock(&mm->mmu_notifier_mm->lock);
+
+ mm_drop_all_locks(mm);
+diff --git a/mm/nommu.c b/mm/nommu.c
+index e4aac33216ae..1d63ecfc98c5 100644
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -1779,7 +1779,8 @@ int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+ struct vm_area_struct *vma;
+ int write = gup_flags & FOLL_WRITE;
+
+- down_read(&mm->mmap_sem);
++ if (down_read_killable(&mm->mmap_sem))
++ return 0;
+
+ /* the access must start within one of the target process's mappings */
+ vma = find_vma(mm, addr);
+diff --git a/mm/swap.c b/mm/swap.c
+index a3fc028e338e..45fdbfb6b2a6 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -740,15 +740,20 @@ void release_pages(struct page **pages, int nr)
+ if (is_huge_zero_page(page))
+ continue;
+
+- /* Device public page can not be huge page */
+- if (is_device_public_page(page)) {
++ if (is_zone_device_page(page)) {
+ if (locked_pgdat) {
+ spin_unlock_irqrestore(&locked_pgdat->lru_lock,
+ flags);
+ locked_pgdat = NULL;
+ }
+- put_devmap_managed_page(page);
+- continue;
++ /*
++ * ZONE_DEVICE pages that return 'false' from
++ * put_devmap_managed_page() do not require special
++ * processing, and instead, expect a call to
++ * put_page_testzero().
++ */
++ if (put_devmap_managed_page(page))
++ continue;
+ }
+
+ page = compound_head(page);
+diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
+index a827547aa102..b131561a9469 100644
+--- a/net/vmw_vsock/hyperv_transport.c
++++ b/net/vmw_vsock/hyperv_transport.c
+@@ -217,18 +217,6 @@ static void hvs_set_channel_pending_send_size(struct vmbus_channel *chan)
+ set_channel_pending_send_size(chan,
+ HVS_PKT_LEN(HVS_SEND_BUF_SIZE));
+
+- /* See hvs_stream_has_space(): we must make sure the host has seen
+- * the new pending send size, before we can re-check the writable
+- * bytes.
+- */
+- virt_mb();
+-}
+-
+-static void hvs_clear_channel_pending_send_size(struct vmbus_channel *chan)
+-{
+- set_channel_pending_send_size(chan, 0);
+-
+- /* Ditto */
+ virt_mb();
+ }
+
+@@ -298,9 +286,6 @@ static void hvs_channel_cb(void *ctx)
+ if (hvs_channel_readable(chan))
+ sk->sk_data_ready(sk);
+
+- /* See hvs_stream_has_space(): when we reach here, the writable bytes
+- * may be already less than HVS_PKT_LEN(HVS_SEND_BUF_SIZE).
+- */
+ if (hv_get_bytes_to_write(&chan->outbound) > 0)
+ sk->sk_write_space(sk);
+ }
+@@ -328,8 +313,9 @@ static void hvs_open_connection(struct vmbus_channel *chan)
+
+ struct sockaddr_vm addr;
+ struct sock *sk, *new = NULL;
+- struct vsock_sock *vnew;
+- struct hvsock *hvs, *hvs_new;
++ struct vsock_sock *vnew = NULL;
++ struct hvsock *hvs = NULL;
++ struct hvsock *hvs_new = NULL;
+ int ret;
+
+ if_type = &chan->offermsg.offer.if_type;
+@@ -388,6 +374,13 @@ static void hvs_open_connection(struct vmbus_channel *chan)
+ set_per_channel_state(chan, conn_from_host ? new : sk);
+ vmbus_set_chn_rescind_callback(chan, hvs_close_connection);
+
++ /* Set the pending send size to max packet size to always get
++ * notifications from the host when there is enough writable space.
++ * The host is optimized to send notifications only when the pending
++ * size boundary is crossed, and not always.
++ */
++ hvs_set_channel_pending_send_size(chan);
++
+ if (conn_from_host) {
+ new->sk_state = TCP_ESTABLISHED;
+ sk->sk_ack_backlog++;
+@@ -651,23 +644,8 @@ static s64 hvs_stream_has_data(struct vsock_sock *vsk)
+ static s64 hvs_stream_has_space(struct vsock_sock *vsk)
+ {
+ struct hvsock *hvs = vsk->trans;
+- struct vmbus_channel *chan = hvs->chan;
+- s64 ret;
+-
+- ret = hvs_channel_writable_bytes(chan);
+- if (ret > 0) {
+- hvs_clear_channel_pending_send_size(chan);
+- } else {
+- /* See hvs_channel_cb() */
+- hvs_set_channel_pending_send_size(chan);
+-
+- /* Re-check the writable bytes to avoid race */
+- ret = hvs_channel_writable_bytes(chan);
+- if (ret > 0)
+- hvs_clear_channel_pending_send_size(chan);
+- }
+
+- return ret;
++ return hvs_channel_writable_bytes(hvs->chan);
+ }
+
+ static u64 hvs_stream_rcvhiwat(struct vsock_sock *vsk)
+diff --git a/scripts/genksyms/keywords.c b/scripts/genksyms/keywords.c
+index 9f40bcd17d07..f6956aa41366 100644
+--- a/scripts/genksyms/keywords.c
++++ b/scripts/genksyms/keywords.c
+@@ -24,6 +24,10 @@ static struct resword {
+ { "__volatile__", VOLATILE_KEYW },
+ { "__builtin_va_list", VA_LIST_KEYW },
+
++ { "__int128", BUILTIN_INT_KEYW },
++ { "__int128_t", BUILTIN_INT_KEYW },
++ { "__uint128_t", BUILTIN_INT_KEYW },
++
+ // According to rth, c99 defines "_Bool", __restrict", __restrict__", "restrict". KAO
+ { "_Bool", BOOL_KEYW },
+ { "_restrict", RESTRICT_KEYW },
+diff --git a/scripts/genksyms/parse.y b/scripts/genksyms/parse.y
+index 00a6d7e54971..1ebcf52cd0f9 100644
+--- a/scripts/genksyms/parse.y
++++ b/scripts/genksyms/parse.y
+@@ -76,6 +76,7 @@ static void record_compound(struct string_list **keyw,
+ %token ATTRIBUTE_KEYW
+ %token AUTO_KEYW
+ %token BOOL_KEYW
++%token BUILTIN_INT_KEYW
+ %token CHAR_KEYW
+ %token CONST_KEYW
+ %token DOUBLE_KEYW
+@@ -263,6 +264,7 @@ simple_type_specifier:
+ | VOID_KEYW
+ | BOOL_KEYW
+ | VA_LIST_KEYW
++ | BUILTIN_INT_KEYW
+ | TYPE { (*$1)->tag = SYM_TYPEDEF; $$ = $1; }
+ ;
+
+diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
+index 0c9c54b57515..31ed7f3f0e15 100644
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -152,6 +152,9 @@ static int read_symbol(FILE *in, struct sym_entry *s)
+ /* exclude debugging symbols */
+ else if (stype == 'N' || stype == 'n')
+ return -1;
++ /* exclude s390 kasan local symbols */
++ else if (!strncmp(sym, ".LASANPC", 8))
++ return -1;
+
+ /* include the type field in the symbol name, so that it gets
+ * compressed together */
+diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
+index 2e7793735e14..ccfbfde61556 100644
+--- a/scripts/recordmcount.h
++++ b/scripts/recordmcount.h
+@@ -326,7 +326,8 @@ static uint_t *sift_rel_mcount(uint_t *mlocp,
+ if (!mcountsym)
+ mcountsym = get_mcountsym(sym0, relp, str0);
+
+- if (mcountsym == Elf_r_sym(relp) && !is_fake_mcount(relp)) {
++ if (mcountsym && mcountsym == Elf_r_sym(relp) &&
++ !is_fake_mcount(relp)) {
+ uint_t const addend =
+ _w(_w(relp->r_offset) - recval + mcount_adjust);
+ mrelp->r_offset = _w(offbase
+diff --git a/sound/ac97/bus.c b/sound/ac97/bus.c
+index 9cbf6927abe9..ca50ff444796 100644
+--- a/sound/ac97/bus.c
++++ b/sound/ac97/bus.c
+@@ -125,17 +125,12 @@ static int ac97_codec_add(struct ac97_controller *ac97_ctrl, int idx,
+ vendor_id);
+
+ ret = device_add(&codec->dev);
+- if (ret)
+- goto err_free_codec;
++ if (ret) {
++ put_device(&codec->dev);
++ return ret;
++ }
+
+ return 0;
+-err_free_codec:
+- of_node_put(codec->dev.of_node);
+- put_device(&codec->dev);
+- kfree(codec);
+- ac97_ctrl->codecs[idx] = NULL;
+-
+- return ret;
+ }
+
+ unsigned int snd_ac97_bus_scan_one(struct ac97_controller *adrv,
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 3cbd2119e148..b70fbfa80546 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1096,6 +1096,7 @@ static int patch_conexant_auto(struct hda_codec *codec)
+ */
+
+ static const struct hda_device_id snd_hda_id_conexant[] = {
++ HDA_CODEC_ENTRY(0x14f11f86, "CX8070", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f12008, "CX8200", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f15045, "CX20549 (Venice)", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f15047, "CX20551 (Waikiki)", patch_conexant_auto),
+diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
+index 5f3c87264e66..da627b015b32 100644
+--- a/sound/usb/line6/podhd.c
++++ b/sound/usb/line6/podhd.c
+@@ -417,7 +417,7 @@ static const struct line6_properties podhd_properties_table[] = {
+ .name = "POD HD500",
+ .capabilities = LINE6_CAP_PCM
+ | LINE6_CAP_HWMON,
+- .altsetting = 1,
++ .altsetting = 0,
+ .ep_ctrl_r = 0x81,
+ .ep_ctrl_w = 0x01,
+ .ep_audio_r = 0x86,
+diff --git a/tools/iio/iio_utils.c b/tools/iio/iio_utils.c
+index 7a6d61c6c012..55272fef3b50 100644
+--- a/tools/iio/iio_utils.c
++++ b/tools/iio/iio_utils.c
+@@ -159,9 +159,9 @@ int iioutils_get_type(unsigned *is_signed, unsigned *bytes, unsigned *bits_used,
+ *be = (endianchar == 'b');
+ *bytes = padint / 8;
+ if (*bits_used == 64)
+- *mask = ~0;
++ *mask = ~(0ULL);
+ else
+- *mask = (1ULL << *bits_used) - 1;
++ *mask = (1ULL << *bits_used) - 1ULL;
+
+ *is_signed = (signchar == 's');
+ if (fclose(sysfsfp)) {
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 40720150ccd8..789962565c9c 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -2497,8 +2497,8 @@ static int add_default_attributes(void)
+ fprintf(stderr,
+ "Cannot set up top down events %s: %d\n",
+ str, err);
+- free(str);
+ parse_events_print_error(&errinfo, str);
++ free(str);
+ return -1;
+ }
+ } else {
+diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
+index 33eefc33e0ea..d0733251a386 100644
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -99,7 +99,7 @@ static void perf_top__resize(struct perf_top *top)
+
+ static int perf_top__parse_source(struct perf_top *top, struct hist_entry *he)
+ {
+- struct perf_evsel *evsel = hists_to_evsel(he->hists);
++ struct perf_evsel *evsel;
+ struct symbol *sym;
+ struct annotation *notes;
+ struct map *map;
+@@ -108,6 +108,8 @@ static int perf_top__parse_source(struct perf_top *top, struct hist_entry *he)
+ if (!he || !he->ms.sym)
+ return -1;
+
++ evsel = hists_to_evsel(he->hists);
++
+ sym = he->ms.sym;
+ map = he->ms.map;
+
+@@ -224,7 +226,7 @@ static void perf_top__record_precise_ip(struct perf_top *top,
+ static void perf_top__show_details(struct perf_top *top)
+ {
+ struct hist_entry *he = top->sym_filter_entry;
+- struct perf_evsel *evsel = hists_to_evsel(he->hists);
++ struct perf_evsel *evsel;
+ struct annotation *notes;
+ struct symbol *symbol;
+ int more;
+@@ -232,6 +234,8 @@ static void perf_top__show_details(struct perf_top *top)
+ if (!he)
+ return;
+
++ evsel = hists_to_evsel(he->hists);
++
+ symbol = he->ms.sym;
+ notes = symbol__annotation(symbol);
+
+diff --git a/tools/perf/tests/mmap-thread-lookup.c b/tools/perf/tests/mmap-thread-lookup.c
+index b1af2499a3c9..7a9b123c7bfc 100644
+--- a/tools/perf/tests/mmap-thread-lookup.c
++++ b/tools/perf/tests/mmap-thread-lookup.c
+@@ -52,7 +52,7 @@ static void *thread_fn(void *arg)
+ {
+ struct thread_data *td = arg;
+ ssize_t ret;
+- int go;
++ int go = 0;
+
+ if (thread_init(td))
+ return NULL;
+diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
+index a96f62ca984a..692d2fa31c35 100644
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -633,7 +633,11 @@ int hist_browser__run(struct hist_browser *browser, const char *help,
+ switch (key) {
+ case K_TIMER: {
+ u64 nr_entries;
+- hbt->timer(hbt->arg);
++
++ WARN_ON_ONCE(!hbt);
++
++ if (hbt)
++ hbt->timer(hbt->arg);
+
+ if (hist_browser__has_filter(browser) ||
+ symbol_conf.report_hierarchy)
+@@ -2707,7 +2711,7 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
+ {
+ struct hists *hists = evsel__hists(evsel);
+ struct hist_browser *browser = perf_evsel_browser__new(evsel, hbt, env, annotation_opts);
+- struct branch_info *bi;
++ struct branch_info *bi = NULL;
+ #define MAX_OPTIONS 16
+ char *options[MAX_OPTIONS];
+ struct popup_action actions[MAX_OPTIONS];
+@@ -2973,7 +2977,9 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
+ goto skip_annotation;
+
+ if (sort__mode == SORT_MODE__BRANCH) {
+- bi = browser->he_selection->branch_info;
++
++ if (browser->he_selection)
++ bi = browser->he_selection->branch_info;
+
+ if (bi == NULL)
+ goto skip_annotation;
+@@ -3144,7 +3150,8 @@ static int perf_evsel_menu__run(struct perf_evsel_menu *menu,
+
+ switch (key) {
+ case K_TIMER:
+- hbt->timer(hbt->arg);
++ if (hbt)
++ hbt->timer(hbt->arg);
+
+ if (!menu->lost_events_warned &&
+ menu->lost_events &&
+diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
+index c357051dd2b6..daea1fdf7385 100644
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -1079,16 +1079,14 @@ static int disasm_line__parse(char *line, const char **namep, char **rawp)
+ *namep = strdup(name);
+
+ if (*namep == NULL)
+- goto out_free_name;
++ goto out;
+
+ (*rawp)[0] = tmp;
+ *rawp = ltrim(*rawp);
+
+ return 0;
+
+-out_free_name:
+- free((void *)namep);
+- *namep = NULL;
++out:
+ return -1;
+ }
+
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 11086097fc9f..f016d1b330e5 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1141,6 +1141,9 @@ static void dump_read(struct perf_evsel *evsel, union perf_event *event)
+ evsel ? perf_evsel__name(evsel) : "FAIL",
+ event->read.value);
+
++ if (!evsel)
++ return;
++
+ read_format = evsel->attr.read_format;
+
+ if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-07-31 15:09 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-07-31 15:09 UTC (permalink / raw
To: gentoo-commits
commit: bdbdcab2154fa53eb7929d82ef85240d56a9c306
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 31 15:09:40 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 31 15:09:40 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bdbdcab2
mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +++
1800_vmalloc-sync-unmappings-fix.patch | 58 ++++++++++++++++++++++++++++++++++
2 files changed, 62 insertions(+)
diff --git a/0000_README b/0000_README
index 2e505ed..4639dff 100644
--- a/0000_README
+++ b/0000_README
@@ -303,6 +303,10 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default.
+Patch: 1800_vmalloc-sync-unmappings-fix.patch
+From: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=3f8fd02b1bf1d7ba964485a56f2f4b53ae88c167
+Desc: mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
+
Patch: 2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
From: https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-marcel@holtmann.org/raw
Desc: Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758
diff --git a/1800_vmalloc-sync-unmappings-fix.patch b/1800_vmalloc-sync-unmappings-fix.patch
new file mode 100644
index 0000000..7e56e51
--- /dev/null
+++ b/1800_vmalloc-sync-unmappings-fix.patch
@@ -0,0 +1,58 @@
+From 3f8fd02b1bf1d7ba964485a56f2f4b53ae88c167 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <jroedel@suse.de>
+Date: Fri, 19 Jul 2019 20:46:52 +0200
+Subject: mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
+
+On x86-32 with PTI enabled, parts of the kernel page-tables are not shared
+between processes. This can cause mappings in the vmalloc/ioremap area to
+persist in some page-tables after the region is unmapped and released.
+
+When the region is re-used the processes with the old mappings do not fault
+in the new mappings but still access the old ones.
+
+This causes undefined behavior, in reality often data corruption, kernel
+oopses and panics and even spontaneous reboots.
+
+Fix this problem by activly syncing unmaps in the vmalloc/ioremap area to
+all page-tables in the system before the regions can be re-used.
+
+References: https://bugzilla.suse.com/show_bug.cgi?id=1118689
+Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capability I/F')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lkml.kernel.org/r/20190719184652.11391-4-joro@8bytes.org
+---
+ mm/vmalloc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 4fa8d84599b0..e0fc963acc41 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1258,6 +1258,12 @@ static bool __purge_vmap_area_lazy(unsigned long start, unsigned long end)
+ if (unlikely(valist == NULL))
+ return false;
+
++ /*
++ * First make sure the mappings are removed from all page-tables
++ * before they are freed.
++ */
++ vmalloc_sync_all();
++
+ /*
+ * TODO: to calculate a flush range without looping.
+ * The list can be up to lazy_max_pages() elements.
+@@ -3038,6 +3044,9 @@ EXPORT_SYMBOL(remap_vmalloc_range);
+ /*
+ * Implement a stub for vmalloc_sync_all() if the architecture chose not to
+ * have one.
++ *
++ * The purpose of this function is to make sure the vmalloc area
++ * mappings are identical in all page-tables in the system.
+ */
+ void __weak vmalloc_sync_all(void)
+ {
+--
+cgit 1.2-0.3.lf.el7
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-08-04 16:15 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-08-04 16:15 UTC (permalink / raw
To: gentoo-commits
commit: e10ac3fedcb0f948cc28973fbe7b54429f65d498
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Aug 4 16:14:44 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Aug 4 16:14:44 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e10ac3fe
Linux patch 4.19.64
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1063_linux-4.19.64.patch | 2473 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2477 insertions(+)
diff --git a/0000_README b/0000_README
index 4639dff..391cca5 100644
--- a/0000_README
+++ b/0000_README
@@ -295,6 +295,10 @@ Patch: 1062_linux-4.19.63.patch
From: https://www.kernel.org
Desc: Linux 4.19.63
+Patch: 1063_linux-4.19.64.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.64
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1063_linux-4.19.64.patch b/1063_linux-4.19.64.patch
new file mode 100644
index 0000000..7fb8fa6
--- /dev/null
+++ b/1063_linux-4.19.64.patch
@@ -0,0 +1,2473 @@
+diff --git a/Makefile b/Makefile
+index 8ad77a93de30..203d9e80a315 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 63
++SUBLEVEL = 64
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/include/asm/compat.h b/arch/arm64/include/asm/compat.h
+index 1a037b94eba1..cee28a05ee98 100644
+--- a/arch/arm64/include/asm/compat.h
++++ b/arch/arm64/include/asm/compat.h
+@@ -159,6 +159,7 @@ static inline compat_uptr_t ptr_to_compat(void __user *uptr)
+ }
+
+ #define compat_user_stack_pointer() (user_stack_pointer(task_pt_regs(current)))
++#define COMPAT_MINSIGSTKSZ 2048
+
+ static inline void __user *arch_compat_alloc_user_space(long len)
+ {
+diff --git a/arch/sh/boards/Kconfig b/arch/sh/boards/Kconfig
+index 6394b4f0a69b..f42feab25dcf 100644
+--- a/arch/sh/boards/Kconfig
++++ b/arch/sh/boards/Kconfig
+@@ -8,27 +8,19 @@ config SH_ALPHA_BOARD
+ bool
+
+ config SH_DEVICE_TREE
+- bool "Board Described by Device Tree"
++ bool
+ select OF
+ select OF_EARLY_FLATTREE
+ select TIMER_OF
+ select COMMON_CLK
+ select GENERIC_CALIBRATE_DELAY
+- help
+- Select Board Described by Device Tree to build a kernel that
+- does not hard-code any board-specific knowledge but instead uses
+- a device tree blob provided by the boot-loader. You must enable
+- drivers for any hardware you want to use separately. At this
+- time, only boards based on the open-hardware J-Core processors
+- have sufficient driver coverage to use this option; do not
+- select it if you are using original SuperH hardware.
+
+ config SH_JCORE_SOC
+ bool "J-Core SoC"
+- depends on SH_DEVICE_TREE && (CPU_SH2 || CPU_J2)
++ select SH_DEVICE_TREE
+ select CLKSRC_JCORE_PIT
+ select JCORE_AIC
+- default y if CPU_J2
++ depends on CPU_J2
+ help
+ Select this option to include drivers core components of the
+ J-Core SoC, including interrupt controllers and timers.
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 9ca703bcfe3b..4a3e1f417880 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -421,24 +421,25 @@ void blk_sync_queue(struct request_queue *q)
+ EXPORT_SYMBOL(blk_sync_queue);
+
+ /**
+- * blk_set_preempt_only - set QUEUE_FLAG_PREEMPT_ONLY
++ * blk_set_pm_only - increment pm_only counter
+ * @q: request queue pointer
+- *
+- * Returns the previous value of the PREEMPT_ONLY flag - 0 if the flag was not
+- * set and 1 if the flag was already set.
+ */
+-int blk_set_preempt_only(struct request_queue *q)
++void blk_set_pm_only(struct request_queue *q)
+ {
+- return blk_queue_flag_test_and_set(QUEUE_FLAG_PREEMPT_ONLY, q);
++ atomic_inc(&q->pm_only);
+ }
+-EXPORT_SYMBOL_GPL(blk_set_preempt_only);
++EXPORT_SYMBOL_GPL(blk_set_pm_only);
+
+-void blk_clear_preempt_only(struct request_queue *q)
++void blk_clear_pm_only(struct request_queue *q)
+ {
+- blk_queue_flag_clear(QUEUE_FLAG_PREEMPT_ONLY, q);
+- wake_up_all(&q->mq_freeze_wq);
++ int pm_only;
++
++ pm_only = atomic_dec_return(&q->pm_only);
++ WARN_ON_ONCE(pm_only < 0);
++ if (pm_only == 0)
++ wake_up_all(&q->mq_freeze_wq);
+ }
+-EXPORT_SYMBOL_GPL(blk_clear_preempt_only);
++EXPORT_SYMBOL_GPL(blk_clear_pm_only);
+
+ /**
+ * __blk_run_queue_uncond - run a queue whether or not it has been stopped
+@@ -916,7 +917,7 @@ EXPORT_SYMBOL(blk_alloc_queue);
+ */
+ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
+ {
+- const bool preempt = flags & BLK_MQ_REQ_PREEMPT;
++ const bool pm = flags & BLK_MQ_REQ_PREEMPT;
+
+ while (true) {
+ bool success = false;
+@@ -924,11 +925,11 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
+ rcu_read_lock();
+ if (percpu_ref_tryget_live(&q->q_usage_counter)) {
+ /*
+- * The code that sets the PREEMPT_ONLY flag is
+- * responsible for ensuring that that flag is globally
+- * visible before the queue is unfrozen.
++ * The code that increments the pm_only counter is
++ * responsible for ensuring that that counter is
++ * globally visible before the queue is unfrozen.
+ */
+- if (preempt || !blk_queue_preempt_only(q)) {
++ if (pm || !blk_queue_pm_only(q)) {
+ success = true;
+ } else {
+ percpu_ref_put(&q->q_usage_counter);
+@@ -953,7 +954,7 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
+
+ wait_event(q->mq_freeze_wq,
+ (atomic_read(&q->mq_freeze_depth) == 0 &&
+- (preempt || !blk_queue_preempt_only(q))) ||
++ (pm || !blk_queue_pm_only(q))) ||
+ blk_queue_dying(q));
+ if (blk_queue_dying(q))
+ return -ENODEV;
+diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
+index cb1e6cf7ac48..a5ea86835fcb 100644
+--- a/block/blk-mq-debugfs.c
++++ b/block/blk-mq-debugfs.c
+@@ -102,6 +102,14 @@ static int blk_flags_show(struct seq_file *m, const unsigned long flags,
+ return 0;
+ }
+
++static int queue_pm_only_show(void *data, struct seq_file *m)
++{
++ struct request_queue *q = data;
++
++ seq_printf(m, "%d\n", atomic_read(&q->pm_only));
++ return 0;
++}
++
+ #define QUEUE_FLAG_NAME(name) [QUEUE_FLAG_##name] = #name
+ static const char *const blk_queue_flag_name[] = {
+ QUEUE_FLAG_NAME(QUEUED),
+@@ -132,7 +140,6 @@ static const char *const blk_queue_flag_name[] = {
+ QUEUE_FLAG_NAME(REGISTERED),
+ QUEUE_FLAG_NAME(SCSI_PASSTHROUGH),
+ QUEUE_FLAG_NAME(QUIESCED),
+- QUEUE_FLAG_NAME(PREEMPT_ONLY),
+ };
+ #undef QUEUE_FLAG_NAME
+
+@@ -209,6 +216,7 @@ static ssize_t queue_write_hint_store(void *data, const char __user *buf,
+ static const struct blk_mq_debugfs_attr blk_mq_debugfs_queue_attrs[] = {
+ { "poll_stat", 0400, queue_poll_stat_show },
+ { "requeue_list", 0400, .seq_ops = &queue_requeue_list_seq_ops },
++ { "pm_only", 0600, queue_pm_only_show, NULL },
+ { "state", 0600, queue_state_show, queue_state_write },
+ { "write_hints", 0600, queue_write_hint_show, queue_write_hint_store },
+ { "zone_wlock", 0400, queue_zone_wlock_show, NULL },
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 1e0e438f079f..6e04e7a707a1 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -1960,8 +1960,18 @@ static struct binder_thread *binder_get_txn_from_and_acq_inner(
+
+ static void binder_free_transaction(struct binder_transaction *t)
+ {
+- if (t->buffer)
+- t->buffer->transaction = NULL;
++ struct binder_proc *target_proc = t->to_proc;
++
++ if (target_proc) {
++ binder_inner_proc_lock(target_proc);
++ if (t->buffer)
++ t->buffer->transaction = NULL;
++ binder_inner_proc_unlock(target_proc);
++ }
++ /*
++ * If the transaction has no target_proc, then
++ * t->buffer->transaction has already been cleared.
++ */
+ kfree(t);
+ binder_stats_deleted(BINDER_STAT_TRANSACTION);
+ }
+@@ -3484,10 +3494,12 @@ static int binder_thread_write(struct binder_proc *proc,
+ buffer->debug_id,
+ buffer->transaction ? "active" : "finished");
+
++ binder_inner_proc_lock(proc);
+ if (buffer->transaction) {
+ buffer->transaction->buffer = NULL;
+ buffer->transaction = NULL;
+ }
++ binder_inner_proc_unlock(proc);
+ if (buffer->async_transaction && buffer->target_node) {
+ struct binder_node *buf_node;
+ struct binder_work *w;
+diff --git a/drivers/bluetooth/hci_ath.c b/drivers/bluetooth/hci_ath.c
+index d568fbd94d6c..20235925344d 100644
+--- a/drivers/bluetooth/hci_ath.c
++++ b/drivers/bluetooth/hci_ath.c
+@@ -112,6 +112,9 @@ static int ath_open(struct hci_uart *hu)
+
+ BT_DBG("hu %p", hu);
+
++ if (!hci_uart_has_flow_control(hu))
++ return -EOPNOTSUPP;
++
+ ath = kzalloc(sizeof(*ath), GFP_KERNEL);
+ if (!ath)
+ return -ENOMEM;
+diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
+index 800132369134..aa6b7ed9fdf1 100644
+--- a/drivers/bluetooth/hci_bcm.c
++++ b/drivers/bluetooth/hci_bcm.c
+@@ -369,6 +369,9 @@ static int bcm_open(struct hci_uart *hu)
+
+ bt_dev_dbg(hu->hdev, "hu %p", hu);
+
++ if (!hci_uart_has_flow_control(hu))
++ return -EOPNOTSUPP;
++
+ bcm = kzalloc(sizeof(*bcm), GFP_KERNEL);
+ if (!bcm)
+ return -ENOMEM;
+diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c
+index 46ace321bf60..e9228520e4c7 100644
+--- a/drivers/bluetooth/hci_intel.c
++++ b/drivers/bluetooth/hci_intel.c
+@@ -406,6 +406,9 @@ static int intel_open(struct hci_uart *hu)
+
+ BT_DBG("hu %p", hu);
+
++ if (!hci_uart_has_flow_control(hu))
++ return -EOPNOTSUPP;
++
+ intel = kzalloc(sizeof(*intel), GFP_KERNEL);
+ if (!intel)
+ return -ENOMEM;
+diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
+index c915daf01a89..efeb8137ec67 100644
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -299,6 +299,19 @@ static int hci_uart_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
+ return 0;
+ }
+
++/* Check the underlying device or tty has flow control support */
++bool hci_uart_has_flow_control(struct hci_uart *hu)
++{
++ /* serdev nodes check if the needed operations are present */
++ if (hu->serdev)
++ return true;
++
++ if (hu->tty->driver->ops->tiocmget && hu->tty->driver->ops->tiocmset)
++ return true;
++
++ return false;
++}
++
+ /* Flow control or un-flow control the device */
+ void hci_uart_set_flow_control(struct hci_uart *hu, bool enable)
+ {
+diff --git a/drivers/bluetooth/hci_mrvl.c b/drivers/bluetooth/hci_mrvl.c
+index ffb00669346f..23791df081ba 100644
+--- a/drivers/bluetooth/hci_mrvl.c
++++ b/drivers/bluetooth/hci_mrvl.c
+@@ -66,6 +66,9 @@ static int mrvl_open(struct hci_uart *hu)
+
+ BT_DBG("hu %p", hu);
+
++ if (!hci_uart_has_flow_control(hu))
++ return -EOPNOTSUPP;
++
+ mrvl = kzalloc(sizeof(*mrvl), GFP_KERNEL);
+ if (!mrvl)
+ return -ENOMEM;
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 77004c29da08..f96e58de049b 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -450,6 +450,9 @@ static int qca_open(struct hci_uart *hu)
+
+ BT_DBG("hu %p qca_open", hu);
+
++ if (!hci_uart_has_flow_control(hu))
++ return -EOPNOTSUPP;
++
+ qca = kzalloc(sizeof(struct qca_data), GFP_KERNEL);
+ if (!qca)
+ return -ENOMEM;
+diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h
+index 00cab2fd7a1b..067a610f1372 100644
+--- a/drivers/bluetooth/hci_uart.h
++++ b/drivers/bluetooth/hci_uart.h
+@@ -118,6 +118,7 @@ int hci_uart_tx_wakeup(struct hci_uart *hu);
+ int hci_uart_init_ready(struct hci_uart *hu);
+ void hci_uart_init_work(struct work_struct *work);
+ void hci_uart_set_baudrate(struct hci_uart *hu, unsigned int speed);
++bool hci_uart_has_flow_control(struct hci_uart *hu);
+ void hci_uart_set_flow_control(struct hci_uart *hu, bool enable);
+ void hci_uart_set_speeds(struct hci_uart *hu, unsigned int init_speed,
+ unsigned int oper_speed);
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index c1439019dd12..b9af2419006f 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3721,7 +3721,7 @@ static void intel_unmap(struct device *dev, dma_addr_t dev_addr, size_t size)
+
+ freelist = domain_unmap(domain, start_pfn, last_pfn);
+
+- if (intel_iommu_strict) {
++ if (intel_iommu_strict || !has_iova_flush_queue(&domain->iovad)) {
+ iommu_flush_iotlb_psi(iommu, domain, start_pfn,
+ nrpages, !freelist, 0);
+ /* free iova */
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index 83fe2621effe..60348d707b99 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -65,9 +65,14 @@ init_iova_domain(struct iova_domain *iovad, unsigned long granule,
+ }
+ EXPORT_SYMBOL_GPL(init_iova_domain);
+
++bool has_iova_flush_queue(struct iova_domain *iovad)
++{
++ return !!iovad->fq;
++}
++
+ static void free_iova_flush_queue(struct iova_domain *iovad)
+ {
+- if (!iovad->fq)
++ if (!has_iova_flush_queue(iovad))
+ return;
+
+ if (timer_pending(&iovad->fq_timer))
+@@ -85,13 +90,14 @@ static void free_iova_flush_queue(struct iova_domain *iovad)
+ int init_iova_flush_queue(struct iova_domain *iovad,
+ iova_flush_cb flush_cb, iova_entry_dtor entry_dtor)
+ {
++ struct iova_fq __percpu *queue;
+ int cpu;
+
+ atomic64_set(&iovad->fq_flush_start_cnt, 0);
+ atomic64_set(&iovad->fq_flush_finish_cnt, 0);
+
+- iovad->fq = alloc_percpu(struct iova_fq);
+- if (!iovad->fq)
++ queue = alloc_percpu(struct iova_fq);
++ if (!queue)
+ return -ENOMEM;
+
+ iovad->flush_cb = flush_cb;
+@@ -100,13 +106,17 @@ int init_iova_flush_queue(struct iova_domain *iovad,
+ for_each_possible_cpu(cpu) {
+ struct iova_fq *fq;
+
+- fq = per_cpu_ptr(iovad->fq, cpu);
++ fq = per_cpu_ptr(queue, cpu);
+ fq->head = 0;
+ fq->tail = 0;
+
+ spin_lock_init(&fq->lock);
+ }
+
++ smp_wmb();
++
++ iovad->fq = queue;
++
+ timer_setup(&iovad->fq_timer, fq_flush_timeout, 0);
+ atomic_set(&iovad->fq_timer_on, 0);
+
+diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
+index 6d05946b445e..060dc7fd66c1 100644
+--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
+@@ -1967,6 +1967,9 @@ hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id)
+
+ /* get endpoint base */
+ idx = ((ep_addr & 0x7f) - 1) * 2;
++ if (idx > 15)
++ return -EIO;
++
+ if (ep_addr & 0x80)
+ idx++;
+ attr = ep->desc.bmAttributes;
+diff --git a/drivers/media/radio/radio-raremono.c b/drivers/media/radio/radio-raremono.c
+index 9a5079d64c4a..729600c4a056 100644
+--- a/drivers/media/radio/radio-raremono.c
++++ b/drivers/media/radio/radio-raremono.c
+@@ -271,6 +271,14 @@ static int vidioc_g_frequency(struct file *file, void *priv,
+ return 0;
+ }
+
++static void raremono_device_release(struct v4l2_device *v4l2_dev)
++{
++ struct raremono_device *radio = to_raremono_dev(v4l2_dev);
++
++ kfree(radio->buffer);
++ kfree(radio);
++}
++
+ /* File system interface */
+ static const struct v4l2_file_operations usb_raremono_fops = {
+ .owner = THIS_MODULE,
+@@ -295,12 +303,14 @@ static int usb_raremono_probe(struct usb_interface *intf,
+ struct raremono_device *radio;
+ int retval = 0;
+
+- radio = devm_kzalloc(&intf->dev, sizeof(struct raremono_device), GFP_KERNEL);
+- if (radio)
+- radio->buffer = devm_kmalloc(&intf->dev, BUFFER_LENGTH, GFP_KERNEL);
+-
+- if (!radio || !radio->buffer)
++ radio = kzalloc(sizeof(*radio), GFP_KERNEL);
++ if (!radio)
++ return -ENOMEM;
++ radio->buffer = kmalloc(BUFFER_LENGTH, GFP_KERNEL);
++ if (!radio->buffer) {
++ kfree(radio);
+ return -ENOMEM;
++ }
+
+ radio->usbdev = interface_to_usbdev(intf);
+ radio->intf = intf;
+@@ -324,7 +334,8 @@ static int usb_raremono_probe(struct usb_interface *intf,
+ if (retval != 3 ||
+ (get_unaligned_be16(&radio->buffer[1]) & 0xfff) == 0x0242) {
+ dev_info(&intf->dev, "this is not Thanko's Raremono.\n");
+- return -ENODEV;
++ retval = -ENODEV;
++ goto free_mem;
+ }
+
+ dev_info(&intf->dev, "Thanko's Raremono connected: (%04X:%04X)\n",
+@@ -333,7 +344,7 @@ static int usb_raremono_probe(struct usb_interface *intf,
+ retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev);
+ if (retval < 0) {
+ dev_err(&intf->dev, "couldn't register v4l2_device\n");
+- return retval;
++ goto free_mem;
+ }
+
+ mutex_init(&radio->lock);
+@@ -345,6 +356,7 @@ static int usb_raremono_probe(struct usb_interface *intf,
+ radio->vdev.ioctl_ops = &usb_raremono_ioctl_ops;
+ radio->vdev.lock = &radio->lock;
+ radio->vdev.release = video_device_release_empty;
++ radio->v4l2_dev.release = raremono_device_release;
+
+ usb_set_intfdata(intf, &radio->v4l2_dev);
+
+@@ -360,6 +372,10 @@ static int usb_raremono_probe(struct usb_interface *intf,
+ }
+ dev_err(&intf->dev, "could not register video device\n");
+ v4l2_device_unregister(&radio->v4l2_dev);
++
++free_mem:
++ kfree(radio->buffer);
++ kfree(radio);
+ return retval;
+ }
+
+diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
+index 257ae0d8cfe2..e3f63299f85c 100644
+--- a/drivers/media/usb/au0828/au0828-core.c
++++ b/drivers/media/usb/au0828/au0828-core.c
+@@ -623,6 +623,12 @@ static int au0828_usb_probe(struct usb_interface *interface,
+ /* Setup */
+ au0828_card_setup(dev);
+
++ /*
++ * Store the pointer to the au0828_dev so it can be accessed in
++ * au0828_usb_disconnect
++ */
++ usb_set_intfdata(interface, dev);
++
+ /* Analog TV */
+ retval = au0828_analog_register(dev, interface);
+ if (retval) {
+@@ -641,12 +647,6 @@ static int au0828_usb_probe(struct usb_interface *interface,
+ /* Remote controller */
+ au0828_rc_register(dev);
+
+- /*
+- * Store the pointer to the au0828_dev so it can be accessed in
+- * au0828_usb_disconnect
+- */
+- usb_set_intfdata(interface, dev);
+-
+ pr_info("Registered device AU0828 [%s]\n",
+ dev->board.name == NULL ? "Unset" : dev->board.name);
+
+diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
+index a771e0a52610..f5b04594e209 100644
+--- a/drivers/media/usb/cpia2/cpia2_usb.c
++++ b/drivers/media/usb/cpia2/cpia2_usb.c
+@@ -902,7 +902,6 @@ static void cpia2_usb_disconnect(struct usb_interface *intf)
+ cpia2_unregister_camera(cam);
+ v4l2_device_disconnect(&cam->v4l2_dev);
+ mutex_unlock(&cam->v4l2_lock);
+- v4l2_device_put(&cam->v4l2_dev);
+
+ if(cam->buffers) {
+ DBG("Wakeup waiting processes\n");
+@@ -911,6 +910,8 @@ static void cpia2_usb_disconnect(struct usb_interface *intf)
+ wake_up_interruptible(&cam->wq_stream);
+ }
+
++ v4l2_device_put(&cam->v4l2_dev);
++
+ LOG("CPiA2 camera disconnected.\n");
+ }
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index 673fdca8d2da..fcb201a40920 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -1680,7 +1680,7 @@ static int pvr2_decoder_enable(struct pvr2_hdw *hdw,int enablefl)
+ }
+ if (!hdw->flag_decoder_missed) {
+ pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+- "WARNING: No decoder present");
++ "***WARNING*** No decoder present");
+ hdw->flag_decoder_missed = !0;
+ trace_stbit("flag_decoder_missed",
+ hdw->flag_decoder_missed);
+@@ -2366,7 +2366,7 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
+ if (hdw_desc->flag_is_experimental) {
+ pvr2_trace(PVR2_TRACE_INFO, "**********");
+ pvr2_trace(PVR2_TRACE_INFO,
+- "WARNING: Support for this device (%s) is experimental.",
++ "***WARNING*** Support for this device (%s) is experimental.",
+ hdw_desc->description);
+ pvr2_trace(PVR2_TRACE_INFO,
+ "Important functionality might not be entirely working.");
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c b/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c
+index f3003ca05f4b..922c06279663 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c
+@@ -343,11 +343,11 @@ static int i2c_hack_cx25840(struct pvr2_hdw *hdw,
+
+ if ((ret != 0) || (*rdata == 0x04) || (*rdata == 0x0a)) {
+ pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+- "WARNING: Detected a wedged cx25840 chip; the device will not work.");
++ "***WARNING*** Detected a wedged cx25840 chip; the device will not work.");
+ pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+- "WARNING: Try power cycling the pvrusb2 device.");
++ "***WARNING*** Try power cycling the pvrusb2 device.");
+ pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+- "WARNING: Disabling further access to the device to prevent other foul-ups.");
++ "***WARNING*** Disabling further access to the device to prevent other foul-ups.");
+ // This blocks all further communication with the part.
+ hdw->i2c_func[0x44] = NULL;
+ pvr2_hdw_render_useless(hdw);
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-std.c b/drivers/media/usb/pvrusb2/pvrusb2-std.c
+index 6b651f8b54df..37dc299a1ca2 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-std.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-std.c
+@@ -353,7 +353,7 @@ struct v4l2_standard *pvr2_std_create_enum(unsigned int *countptr,
+ bcnt = pvr2_std_id_to_str(buf,sizeof(buf),fmsk);
+ pvr2_trace(
+ PVR2_TRACE_ERROR_LEGS,
+- "WARNING: Failed to classify the following standard(s): %.*s",
++ "***WARNING*** Failed to classify the following standard(s): %.*s",
+ bcnt,buf);
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
+index d4803ff5a78a..f09a4ad2e9de 100644
+--- a/drivers/net/wireless/ath/ath10k/usb.c
++++ b/drivers/net/wireless/ath/ath10k/usb.c
+@@ -1025,7 +1025,7 @@ static int ath10k_usb_probe(struct usb_interface *interface,
+ }
+
+ /* TODO: remove this once USB support is fully implemented */
+- ath10k_warn(ar, "WARNING: ath10k USB support is incomplete, don't expect anything to work!\n");
++ ath10k_warn(ar, "Warning: ath10k USB support is incomplete, don't expect anything to work!\n");
+
+ return 0;
+
+diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
+index 8febacb8fc54..0951564b6830 100644
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -166,6 +166,14 @@ static long pps_cdev_ioctl(struct file *file,
+ pps->params.mode |= PPS_CANWAIT;
+ pps->params.api_version = PPS_API_VERS;
+
++ /*
++ * Clear unused fields of pps_kparams to avoid leaking
++ * uninitialized data of the PPS_SETPARAMS caller via
++ * PPS_GETPARAMS
++ */
++ pps->params.assert_off_tu.flags = 0;
++ pps->params.clear_off_tu.flags = 0;
++
+ spin_unlock_irq(&pps->lock);
+
+ break;
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 32652b2c5e7c..75b926e70076 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -3059,11 +3059,14 @@ scsi_device_quiesce(struct scsi_device *sdev)
+ */
+ WARN_ON_ONCE(sdev->quiesced_by && sdev->quiesced_by != current);
+
+- blk_set_preempt_only(q);
++ if (sdev->quiesced_by == current)
++ return 0;
++
++ blk_set_pm_only(q);
+
+ blk_mq_freeze_queue(q);
+ /*
+- * Ensure that the effect of blk_set_preempt_only() will be visible
++ * Ensure that the effect of blk_set_pm_only() will be visible
+ * for percpu_ref_tryget() callers that occur after the queue
+ * unfreeze even if the queue was already frozen before this function
+ * was called. See also https://lwn.net/Articles/573497/.
+@@ -3076,7 +3079,7 @@ scsi_device_quiesce(struct scsi_device *sdev)
+ if (err == 0)
+ sdev->quiesced_by = current;
+ else
+- blk_clear_preempt_only(q);
++ blk_clear_pm_only(q);
+ mutex_unlock(&sdev->state_mutex);
+
+ return err;
+@@ -3099,8 +3102,10 @@ void scsi_device_resume(struct scsi_device *sdev)
+ * device deleted during suspend)
+ */
+ mutex_lock(&sdev->state_mutex);
+- sdev->quiesced_by = NULL;
+- blk_clear_preempt_only(sdev->request_queue);
++ if (sdev->quiesced_by) {
++ sdev->quiesced_by = NULL;
++ blk_clear_pm_only(sdev->request_queue);
++ }
+ if (sdev->sdev_state == SDEV_QUIESCE)
+ scsi_device_set_state(sdev, SDEV_RUNNING);
+ mutex_unlock(&sdev->state_mutex);
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 03614ef64ca4..3f68edde0f03 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -3125,6 +3125,7 @@ void dwc2_hsotg_disconnect(struct dwc2_hsotg *hsotg)
+ hsotg->connected = 0;
+ hsotg->test_mode = 0;
+
++ /* all endpoints should be shutdown */
+ for (ep = 0; ep < hsotg->num_of_eps; ep++) {
+ if (hsotg->eps_in[ep])
+ kill_all_requests(hsotg, hsotg->eps_in[ep],
+@@ -3175,6 +3176,7 @@ static void dwc2_hsotg_irq_fifoempty(struct dwc2_hsotg *hsotg, bool periodic)
+ GINTSTS_PTXFEMP | \
+ GINTSTS_RXFLVL)
+
++static int dwc2_hsotg_ep_disable(struct usb_ep *ep);
+ /**
+ * dwc2_hsotg_core_init - issue softreset to the core
+ * @hsotg: The device state
+@@ -3189,13 +3191,23 @@ void dwc2_hsotg_core_init_disconnected(struct dwc2_hsotg *hsotg,
+ u32 val;
+ u32 usbcfg;
+ u32 dcfg = 0;
++ int ep;
+
+ /* Kill any ep0 requests as controller will be reinitialized */
+ kill_all_requests(hsotg, hsotg->eps_out[0], -ECONNRESET);
+
+- if (!is_usb_reset)
++ if (!is_usb_reset) {
+ if (dwc2_core_reset(hsotg, true))
+ return;
++ } else {
++ /* all endpoints should be shutdown */
++ for (ep = 1; ep < hsotg->num_of_eps; ep++) {
++ if (hsotg->eps_in[ep])
++ dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
++ if (hsotg->eps_out[ep])
++ dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
++ }
++ }
+
+ /*
+ * we must now enable ep0 ready for host detection and then
+@@ -3993,7 +4005,6 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
+ struct dwc2_hsotg *hsotg = hs_ep->parent;
+ int dir_in = hs_ep->dir_in;
+ int index = hs_ep->index;
+- unsigned long flags;
+ u32 epctrl_reg;
+ u32 ctrl;
+
+@@ -4011,8 +4022,6 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
+
+ epctrl_reg = dir_in ? DIEPCTL(index) : DOEPCTL(index);
+
+- spin_lock_irqsave(&hsotg->lock, flags);
+-
+ ctrl = dwc2_readl(hsotg, epctrl_reg);
+
+ if (ctrl & DXEPCTL_EPENA)
+@@ -4035,10 +4044,22 @@ static int dwc2_hsotg_ep_disable(struct usb_ep *ep)
+ hs_ep->fifo_index = 0;
+ hs_ep->fifo_size = 0;
+
+- spin_unlock_irqrestore(&hsotg->lock, flags);
+ return 0;
+ }
+
++static int dwc2_hsotg_ep_disable_lock(struct usb_ep *ep)
++{
++ struct dwc2_hsotg_ep *hs_ep = our_ep(ep);
++ struct dwc2_hsotg *hsotg = hs_ep->parent;
++ unsigned long flags;
++ int ret;
++
++ spin_lock_irqsave(&hsotg->lock, flags);
++ ret = dwc2_hsotg_ep_disable(ep);
++ spin_unlock_irqrestore(&hsotg->lock, flags);
++ return ret;
++}
++
+ /**
+ * on_list - check request is on the given endpoint
+ * @ep: The endpoint to check.
+@@ -4186,7 +4207,7 @@ static int dwc2_hsotg_ep_sethalt_lock(struct usb_ep *ep, int value)
+
+ static const struct usb_ep_ops dwc2_hsotg_ep_ops = {
+ .enable = dwc2_hsotg_ep_enable,
+- .disable = dwc2_hsotg_ep_disable,
++ .disable = dwc2_hsotg_ep_disable_lock,
+ .alloc_request = dwc2_hsotg_ep_alloc_request,
+ .free_request = dwc2_hsotg_ep_free_request,
+ .queue = dwc2_hsotg_ep_queue_lock,
+@@ -4326,9 +4347,9 @@ static int dwc2_hsotg_udc_stop(struct usb_gadget *gadget)
+ /* all endpoints should be shutdown */
+ for (ep = 1; ep < hsotg->num_of_eps; ep++) {
+ if (hsotg->eps_in[ep])
+- dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
++ dwc2_hsotg_ep_disable_lock(&hsotg->eps_in[ep]->ep);
+ if (hsotg->eps_out[ep])
+- dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
++ dwc2_hsotg_ep_disable_lock(&hsotg->eps_out[ep]->ep);
+ }
+
+ spin_lock_irqsave(&hsotg->lock, flags);
+@@ -4776,9 +4797,9 @@ int dwc2_hsotg_suspend(struct dwc2_hsotg *hsotg)
+
+ for (ep = 0; ep < hsotg->num_of_eps; ep++) {
+ if (hsotg->eps_in[ep])
+- dwc2_hsotg_ep_disable(&hsotg->eps_in[ep]->ep);
++ dwc2_hsotg_ep_disable_lock(&hsotg->eps_in[ep]->ep);
+ if (hsotg->eps_out[ep])
+- dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
++ dwc2_hsotg_ep_disable_lock(&hsotg->eps_out[ep]->ep);
+ }
+ }
+
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index ae704658b528..124356dc39e1 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -497,12 +497,6 @@ static size_t init_iov_iter(struct vhost_virtqueue *vq, struct iov_iter *iter,
+ return iov_iter_count(iter);
+ }
+
+-static bool vhost_exceeds_weight(int pkts, int total_len)
+-{
+- return total_len >= VHOST_NET_WEIGHT ||
+- pkts >= VHOST_NET_PKT_WEIGHT;
+-}
+-
+ static int get_tx_bufs(struct vhost_net *net,
+ struct vhost_net_virtqueue *nvq,
+ struct msghdr *msg,
+@@ -557,7 +551,7 @@ static void handle_tx_copy(struct vhost_net *net, struct socket *sock)
+ int err;
+ int sent_pkts = 0;
+
+- for (;;) {
++ do {
+ bool busyloop_intr = false;
+
+ head = get_tx_bufs(net, nvq, &msg, &out, &in, &len,
+@@ -598,11 +592,7 @@ static void handle_tx_copy(struct vhost_net *net, struct socket *sock)
+ err, len);
+ if (++nvq->done_idx >= VHOST_NET_BATCH)
+ vhost_net_signal_used(nvq);
+- if (vhost_exceeds_weight(++sent_pkts, total_len)) {
+- vhost_poll_queue(&vq->poll);
+- break;
+- }
+- }
++ } while (likely(!vhost_exceeds_weight(vq, ++sent_pkts, total_len)));
+
+ vhost_net_signal_used(nvq);
+ }
+@@ -626,7 +616,7 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock)
+ bool zcopy_used;
+ int sent_pkts = 0;
+
+- for (;;) {
++ do {
+ bool busyloop_intr;
+
+ /* Release DMAs done buffers first */
+@@ -701,11 +691,7 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock)
+ else
+ vhost_zerocopy_signal_used(net, vq);
+ vhost_net_tx_packet(net);
+- if (unlikely(vhost_exceeds_weight(++sent_pkts, total_len))) {
+- vhost_poll_queue(&vq->poll);
+- break;
+- }
+- }
++ } while (likely(!vhost_exceeds_weight(vq, ++sent_pkts, total_len)));
+ }
+
+ /* Expects to be always run from workqueue - which acts as
+@@ -941,8 +927,11 @@ static void handle_rx(struct vhost_net *net)
+ vq->log : NULL;
+ mergeable = vhost_has_feature(vq, VIRTIO_NET_F_MRG_RXBUF);
+
+- while ((sock_len = vhost_net_rx_peek_head_len(net, sock->sk,
+- &busyloop_intr))) {
++ do {
++ sock_len = vhost_net_rx_peek_head_len(net, sock->sk,
++ &busyloop_intr);
++ if (!sock_len)
++ break;
+ sock_len += sock_hlen;
+ vhost_len = sock_len + vhost_hlen;
+ headcount = get_rx_bufs(vq, vq->heads + nvq->done_idx,
+@@ -1027,14 +1016,11 @@ static void handle_rx(struct vhost_net *net)
+ vhost_log_write(vq, vq_log, log, vhost_len,
+ vq->iov, in);
+ total_len += vhost_len;
+- if (unlikely(vhost_exceeds_weight(++recv_pkts, total_len))) {
+- vhost_poll_queue(&vq->poll);
+- goto out;
+- }
+- }
++ } while (likely(!vhost_exceeds_weight(vq, ++recv_pkts, total_len)));
++
+ if (unlikely(busyloop_intr))
+ vhost_poll_queue(&vq->poll);
+- else
++ else if (!sock_len)
+ vhost_net_enable_vq(net, vq);
+ out:
+ vhost_net_signal_used(nvq);
+@@ -1115,7 +1101,8 @@ static int vhost_net_open(struct inode *inode, struct file *f)
+ vhost_net_buf_init(&n->vqs[i].rxq);
+ }
+ vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX,
+- UIO_MAXIOV + VHOST_NET_BATCH);
++ UIO_MAXIOV + VHOST_NET_BATCH,
++ VHOST_NET_PKT_WEIGHT, VHOST_NET_WEIGHT);
+
+ vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, EPOLLOUT, dev);
+ vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, EPOLLIN, dev);
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index 0cfa925be4ec..5e298d9287f1 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -57,6 +57,12 @@
+ #define VHOST_SCSI_PREALLOC_UPAGES 2048
+ #define VHOST_SCSI_PREALLOC_PROT_SGLS 2048
+
++/* Max number of requests before requeueing the job.
++ * Using this limit prevents one virtqueue from starving others with
++ * request.
++ */
++#define VHOST_SCSI_WEIGHT 256
++
+ struct vhost_scsi_inflight {
+ /* Wait for the flush operation to finish */
+ struct completion comp;
+@@ -811,7 +817,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ u64 tag;
+ u32 exp_data_len, data_direction;
+ unsigned int out = 0, in = 0;
+- int head, ret, prot_bytes;
++ int head, ret, prot_bytes, c = 0;
+ size_t req_size, rsp_size = sizeof(struct virtio_scsi_cmd_resp);
+ size_t out_size, in_size;
+ u16 lun;
+@@ -830,7 +836,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+
+ vhost_disable_notify(&vs->dev, vq);
+
+- for (;;) {
++ do {
+ head = vhost_get_vq_desc(vq, vq->iov,
+ ARRAY_SIZE(vq->iov), &out, &in,
+ NULL, NULL);
+@@ -1045,7 +1051,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ */
+ INIT_WORK(&cmd->work, vhost_scsi_submission_work);
+ queue_work(vhost_scsi_workqueue, &cmd->work);
+- }
++ } while (likely(!vhost_exceeds_weight(vq, ++c, 0)));
+ out:
+ mutex_unlock(&vq->mutex);
+ }
+@@ -1398,7 +1404,8 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
+ vqs[i] = &vs->vqs[i].vq;
+ vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
+ }
+- vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV);
++ vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV,
++ VHOST_SCSI_WEIGHT, 0);
+
+ vhost_scsi_init_inflight(vs, NULL);
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index c163bc15976a..0752f8dc47b1 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -413,8 +413,24 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev)
+ vhost_vq_free_iovecs(dev->vqs[i]);
+ }
+
++bool vhost_exceeds_weight(struct vhost_virtqueue *vq,
++ int pkts, int total_len)
++{
++ struct vhost_dev *dev = vq->dev;
++
++ if ((dev->byte_weight && total_len >= dev->byte_weight) ||
++ pkts >= dev->weight) {
++ vhost_poll_queue(&vq->poll);
++ return true;
++ }
++
++ return false;
++}
++EXPORT_SYMBOL_GPL(vhost_exceeds_weight);
++
+ void vhost_dev_init(struct vhost_dev *dev,
+- struct vhost_virtqueue **vqs, int nvqs, int iov_limit)
++ struct vhost_virtqueue **vqs, int nvqs,
++ int iov_limit, int weight, int byte_weight)
+ {
+ struct vhost_virtqueue *vq;
+ int i;
+@@ -428,6 +444,8 @@ void vhost_dev_init(struct vhost_dev *dev,
+ dev->mm = NULL;
+ dev->worker = NULL;
+ dev->iov_limit = iov_limit;
++ dev->weight = weight;
++ dev->byte_weight = byte_weight;
+ init_llist_head(&dev->work_list);
+ init_waitqueue_head(&dev->wait);
+ INIT_LIST_HEAD(&dev->read_list);
+diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
+index 9490e7ddb340..27a78a9b8cc7 100644
+--- a/drivers/vhost/vhost.h
++++ b/drivers/vhost/vhost.h
+@@ -171,10 +171,13 @@ struct vhost_dev {
+ struct list_head pending_list;
+ wait_queue_head_t wait;
+ int iov_limit;
++ int weight;
++ int byte_weight;
+ };
+
++bool vhost_exceeds_weight(struct vhost_virtqueue *vq, int pkts, int total_len);
+ void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs,
+- int nvqs, int iov_limit);
++ int nvqs, int iov_limit, int weight, int byte_weight);
+ long vhost_dev_set_owner(struct vhost_dev *dev);
+ bool vhost_dev_has_owner(struct vhost_dev *dev);
+ long vhost_dev_check_owner(struct vhost_dev *);
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index e440f87ae1d6..bab495d73195 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -21,6 +21,14 @@
+ #include "vhost.h"
+
+ #define VHOST_VSOCK_DEFAULT_HOST_CID 2
++/* Max number of bytes transferred before requeueing the job.
++ * Using this limit prevents one virtqueue from starving others. */
++#define VHOST_VSOCK_WEIGHT 0x80000
++/* Max number of packets transferred before requeueing the job.
++ * Using this limit prevents one virtqueue from starving others with
++ * small pkts.
++ */
++#define VHOST_VSOCK_PKT_WEIGHT 256
+
+ enum {
+ VHOST_VSOCK_FEATURES = VHOST_FEATURES,
+@@ -78,6 +86,7 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
+ struct vhost_virtqueue *vq)
+ {
+ struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX];
++ int pkts = 0, total_len = 0;
+ bool added = false;
+ bool restart_tx = false;
+
+@@ -89,7 +98,7 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
+ /* Avoid further vmexits, we're already processing the virtqueue */
+ vhost_disable_notify(&vsock->dev, vq);
+
+- for (;;) {
++ do {
+ struct virtio_vsock_pkt *pkt;
+ struct iov_iter iov_iter;
+ unsigned out, in;
+@@ -174,8 +183,9 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
+ */
+ virtio_transport_deliver_tap_pkt(pkt);
+
++ total_len += pkt->len;
+ virtio_transport_free_pkt(pkt);
+- }
++ } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len)));
+ if (added)
+ vhost_signal(&vsock->dev, vq);
+
+@@ -350,7 +360,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
+ struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock,
+ dev);
+ struct virtio_vsock_pkt *pkt;
+- int head;
++ int head, pkts = 0, total_len = 0;
+ unsigned int out, in;
+ bool added = false;
+
+@@ -360,7 +370,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
+ goto out;
+
+ vhost_disable_notify(&vsock->dev, vq);
+- for (;;) {
++ do {
+ u32 len;
+
+ if (!vhost_vsock_more_replies(vsock)) {
+@@ -401,9 +411,11 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
+ else
+ virtio_transport_free_pkt(pkt);
+
+- vhost_add_used(vq, head, sizeof(pkt->hdr) + len);
++ len += sizeof(pkt->hdr);
++ vhost_add_used(vq, head, len);
++ total_len += len;
+ added = true;
+- }
++ } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len)));
+
+ no_more_replies:
+ if (added)
+@@ -531,7 +543,9 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
+ vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick;
+ vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick;
+
+- vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), UIO_MAXIOV);
++ vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs),
++ UIO_MAXIOV, VHOST_VSOCK_PKT_WEIGHT,
++ VHOST_VSOCK_WEIGHT);
+
+ file->private_data = vsock;
+ spin_lock_init(&vsock->send_pkt_list_lock);
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index c7542e8dd096..a11fa0b6b34d 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1237,20 +1237,23 @@ static int send_cap_msg(struct cap_msg_args *arg)
+ }
+
+ /*
+- * Queue cap releases when an inode is dropped from our cache. Since
+- * inode is about to be destroyed, there is no need for i_ceph_lock.
++ * Queue cap releases when an inode is dropped from our cache.
+ */
+ void ceph_queue_caps_release(struct inode *inode)
+ {
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ struct rb_node *p;
+
++ /* lock i_ceph_lock, because ceph_d_revalidate(..., LOOKUP_RCU)
++ * may call __ceph_caps_issued_mask() on a freeing inode. */
++ spin_lock(&ci->i_ceph_lock);
+ p = rb_first(&ci->i_caps);
+ while (p) {
+ struct ceph_cap *cap = rb_entry(p, struct ceph_cap, ci_node);
+ p = rb_next(p);
+ __ceph_remove_cap(cap, true);
+ }
++ spin_unlock(&ci->i_ceph_lock);
+ }
+
+ /*
+diff --git a/fs/exec.c b/fs/exec.c
+index 433b1257694a..561ea64829ec 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1826,7 +1826,7 @@ static int __do_execve_file(int fd, struct filename *filename,
+ membarrier_execve(current);
+ rseq_execve(current);
+ acct_update_integrals(current);
+- task_numa_free(current);
++ task_numa_free(current, false);
+ free_bprm(bprm);
+ kfree(pathbuf);
+ if (filename)
+diff --git a/fs/nfs/client.c b/fs/nfs/client.c
+index c092661147b3..0a2b59c1ecb3 100644
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -416,10 +416,10 @@ struct nfs_client *nfs_get_client(const struct nfs_client_initdata *cl_init)
+ clp = nfs_match_client(cl_init);
+ if (clp) {
+ spin_unlock(&nn->nfs_client_lock);
+- if (IS_ERR(clp))
+- return clp;
+ if (new)
+ new->rpc_ops->free_client(new);
++ if (IS_ERR(clp))
++ return clp;
+ return nfs_found_client(cl_init, clp);
+ }
+ if (new) {
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 8bfaa658b2c1..71b2e390becf 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -1072,6 +1072,100 @@ int nfs_neg_need_reval(struct inode *dir, struct dentry *dentry,
+ return !nfs_check_verifier(dir, dentry, flags & LOOKUP_RCU);
+ }
+
++static int
++nfs_lookup_revalidate_done(struct inode *dir, struct dentry *dentry,
++ struct inode *inode, int error)
++{
++ switch (error) {
++ case 1:
++ dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) is valid\n",
++ __func__, dentry);
++ return 1;
++ case 0:
++ nfs_mark_for_revalidate(dir);
++ if (inode && S_ISDIR(inode->i_mode)) {
++ /* Purge readdir caches. */
++ nfs_zap_caches(inode);
++ /*
++ * We can't d_drop the root of a disconnected tree:
++ * its d_hash is on the s_anon list and d_drop() would hide
++ * it from shrink_dcache_for_unmount(), leading to busy
++ * inodes on unmount and further oopses.
++ */
++ if (IS_ROOT(dentry))
++ return 1;
++ }
++ dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) is invalid\n",
++ __func__, dentry);
++ return 0;
++ }
++ dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) lookup returned error %d\n",
++ __func__, dentry, error);
++ return error;
++}
++
++static int
++nfs_lookup_revalidate_negative(struct inode *dir, struct dentry *dentry,
++ unsigned int flags)
++{
++ int ret = 1;
++ if (nfs_neg_need_reval(dir, dentry, flags)) {
++ if (flags & LOOKUP_RCU)
++ return -ECHILD;
++ ret = 0;
++ }
++ return nfs_lookup_revalidate_done(dir, dentry, NULL, ret);
++}
++
++static int
++nfs_lookup_revalidate_delegated(struct inode *dir, struct dentry *dentry,
++ struct inode *inode)
++{
++ nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
++ return nfs_lookup_revalidate_done(dir, dentry, inode, 1);
++}
++
++static int
++nfs_lookup_revalidate_dentry(struct inode *dir, struct dentry *dentry,
++ struct inode *inode)
++{
++ struct nfs_fh *fhandle;
++ struct nfs_fattr *fattr;
++ struct nfs4_label *label;
++ int ret;
++
++ ret = -ENOMEM;
++ fhandle = nfs_alloc_fhandle();
++ fattr = nfs_alloc_fattr();
++ label = nfs4_label_alloc(NFS_SERVER(inode), GFP_KERNEL);
++ if (fhandle == NULL || fattr == NULL || IS_ERR(label))
++ goto out;
++
++ ret = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr, label);
++ if (ret < 0) {
++ if (ret == -ESTALE || ret == -ENOENT)
++ ret = 0;
++ goto out;
++ }
++ ret = 0;
++ if (nfs_compare_fh(NFS_FH(inode), fhandle))
++ goto out;
++ if (nfs_refresh_inode(inode, fattr) < 0)
++ goto out;
++
++ nfs_setsecurity(inode, fattr, label);
++ nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
++
++ /* set a readdirplus hint that we had a cache miss */
++ nfs_force_use_readdirplus(dir);
++ ret = 1;
++out:
++ nfs_free_fattr(fattr);
++ nfs_free_fhandle(fhandle);
++ nfs4_label_free(label);
++ return nfs_lookup_revalidate_done(dir, dentry, inode, ret);
++}
++
+ /*
+ * This is called every time the dcache has a lookup hit,
+ * and we should check whether we can really trust that
+@@ -1083,58 +1177,36 @@ int nfs_neg_need_reval(struct inode *dir, struct dentry *dentry,
+ * If the parent directory is seen to have changed, we throw out the
+ * cached dentry and do a new lookup.
+ */
+-static int nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags)
++static int
++nfs_do_lookup_revalidate(struct inode *dir, struct dentry *dentry,
++ unsigned int flags)
+ {
+- struct inode *dir;
+ struct inode *inode;
+- struct dentry *parent;
+- struct nfs_fh *fhandle = NULL;
+- struct nfs_fattr *fattr = NULL;
+- struct nfs4_label *label = NULL;
+ int error;
+
+- if (flags & LOOKUP_RCU) {
+- parent = READ_ONCE(dentry->d_parent);
+- dir = d_inode_rcu(parent);
+- if (!dir)
+- return -ECHILD;
+- } else {
+- parent = dget_parent(dentry);
+- dir = d_inode(parent);
+- }
+ nfs_inc_stats(dir, NFSIOS_DENTRYREVALIDATE);
+ inode = d_inode(dentry);
+
+- if (!inode) {
+- if (nfs_neg_need_reval(dir, dentry, flags)) {
+- if (flags & LOOKUP_RCU)
+- return -ECHILD;
+- goto out_bad;
+- }
+- goto out_valid;
+- }
++ if (!inode)
++ return nfs_lookup_revalidate_negative(dir, dentry, flags);
+
+ if (is_bad_inode(inode)) {
+- if (flags & LOOKUP_RCU)
+- return -ECHILD;
+ dfprintk(LOOKUPCACHE, "%s: %pd2 has dud inode\n",
+ __func__, dentry);
+ goto out_bad;
+ }
+
+ if (NFS_PROTO(dir)->have_delegation(inode, FMODE_READ))
+- goto out_set_verifier;
++ return nfs_lookup_revalidate_delegated(dir, dentry, inode);
+
+ /* Force a full look up iff the parent directory has changed */
+ if (!(flags & (LOOKUP_EXCL | LOOKUP_REVAL)) &&
+ nfs_check_verifier(dir, dentry, flags & LOOKUP_RCU)) {
+ error = nfs_lookup_verify_inode(inode, flags);
+ if (error) {
+- if (flags & LOOKUP_RCU)
+- return -ECHILD;
+ if (error == -ESTALE)
+- goto out_zap_parent;
+- goto out_error;
++ nfs_zap_caches(dir);
++ goto out_bad;
+ }
+ nfs_advise_use_readdirplus(dir);
+ goto out_valid;
+@@ -1146,81 +1218,45 @@ static int nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags)
+ if (NFS_STALE(inode))
+ goto out_bad;
+
+- error = -ENOMEM;
+- fhandle = nfs_alloc_fhandle();
+- fattr = nfs_alloc_fattr();
+- if (fhandle == NULL || fattr == NULL)
+- goto out_error;
+-
+- label = nfs4_label_alloc(NFS_SERVER(inode), GFP_NOWAIT);
+- if (IS_ERR(label))
+- goto out_error;
+-
+ trace_nfs_lookup_revalidate_enter(dir, dentry, flags);
+- error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr, label);
++ error = nfs_lookup_revalidate_dentry(dir, dentry, inode);
+ trace_nfs_lookup_revalidate_exit(dir, dentry, flags, error);
+- if (error == -ESTALE || error == -ENOENT)
+- goto out_bad;
+- if (error)
+- goto out_error;
+- if (nfs_compare_fh(NFS_FH(inode), fhandle))
+- goto out_bad;
+- if ((error = nfs_refresh_inode(inode, fattr)) != 0)
+- goto out_bad;
+-
+- nfs_setsecurity(inode, fattr, label);
+-
+- nfs_free_fattr(fattr);
+- nfs_free_fhandle(fhandle);
+- nfs4_label_free(label);
++ return error;
++out_valid:
++ return nfs_lookup_revalidate_done(dir, dentry, inode, 1);
++out_bad:
++ if (flags & LOOKUP_RCU)
++ return -ECHILD;
++ return nfs_lookup_revalidate_done(dir, dentry, inode, 0);
++}
+
+- /* set a readdirplus hint that we had a cache miss */
+- nfs_force_use_readdirplus(dir);
++static int
++__nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags,
++ int (*reval)(struct inode *, struct dentry *, unsigned int))
++{
++ struct dentry *parent;
++ struct inode *dir;
++ int ret;
+
+-out_set_verifier:
+- nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
+- out_valid:
+ if (flags & LOOKUP_RCU) {
++ parent = READ_ONCE(dentry->d_parent);
++ dir = d_inode_rcu(parent);
++ if (!dir)
++ return -ECHILD;
++ ret = reval(dir, dentry, flags);
+ if (parent != READ_ONCE(dentry->d_parent))
+ return -ECHILD;
+- } else
++ } else {
++ parent = dget_parent(dentry);
++ ret = reval(d_inode(parent), dentry, flags);
+ dput(parent);
+- dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) is valid\n",
+- __func__, dentry);
+- return 1;
+-out_zap_parent:
+- nfs_zap_caches(dir);
+- out_bad:
+- WARN_ON(flags & LOOKUP_RCU);
+- nfs_free_fattr(fattr);
+- nfs_free_fhandle(fhandle);
+- nfs4_label_free(label);
+- nfs_mark_for_revalidate(dir);
+- if (inode && S_ISDIR(inode->i_mode)) {
+- /* Purge readdir caches. */
+- nfs_zap_caches(inode);
+- /*
+- * We can't d_drop the root of a disconnected tree:
+- * its d_hash is on the s_anon list and d_drop() would hide
+- * it from shrink_dcache_for_unmount(), leading to busy
+- * inodes on unmount and further oopses.
+- */
+- if (IS_ROOT(dentry))
+- goto out_valid;
+ }
+- dput(parent);
+- dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) is invalid\n",
+- __func__, dentry);
+- return 0;
+-out_error:
+- WARN_ON(flags & LOOKUP_RCU);
+- nfs_free_fattr(fattr);
+- nfs_free_fhandle(fhandle);
+- nfs4_label_free(label);
+- dput(parent);
+- dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) lookup returned error %d\n",
+- __func__, dentry, error);
+- return error;
++ return ret;
++}
++
++static int nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags)
++{
++ return __nfs_lookup_revalidate(dentry, flags, nfs_do_lookup_revalidate);
+ }
+
+ /*
+@@ -1579,62 +1615,55 @@ no_open:
+ }
+ EXPORT_SYMBOL_GPL(nfs_atomic_open);
+
+-static int nfs4_lookup_revalidate(struct dentry *dentry, unsigned int flags)
++static int
++nfs4_do_lookup_revalidate(struct inode *dir, struct dentry *dentry,
++ unsigned int flags)
+ {
+ struct inode *inode;
+- int ret = 0;
+
+ if (!(flags & LOOKUP_OPEN) || (flags & LOOKUP_DIRECTORY))
+- goto no_open;
++ goto full_reval;
+ if (d_mountpoint(dentry))
+- goto no_open;
+- if (NFS_SB(dentry->d_sb)->caps & NFS_CAP_ATOMIC_OPEN_V1)
+- goto no_open;
++ goto full_reval;
+
+ inode = d_inode(dentry);
+
+ /* We can't create new files in nfs_open_revalidate(), so we
+ * optimize away revalidation of negative dentries.
+ */
+- if (inode == NULL) {
+- struct dentry *parent;
+- struct inode *dir;
+-
+- if (flags & LOOKUP_RCU) {
+- parent = READ_ONCE(dentry->d_parent);
+- dir = d_inode_rcu(parent);
+- if (!dir)
+- return -ECHILD;
+- } else {
+- parent = dget_parent(dentry);
+- dir = d_inode(parent);
+- }
+- if (!nfs_neg_need_reval(dir, dentry, flags))
+- ret = 1;
+- else if (flags & LOOKUP_RCU)
+- ret = -ECHILD;
+- if (!(flags & LOOKUP_RCU))
+- dput(parent);
+- else if (parent != READ_ONCE(dentry->d_parent))
+- return -ECHILD;
+- goto out;
+- }
++ if (inode == NULL)
++ goto full_reval;
++
++ if (NFS_PROTO(dir)->have_delegation(inode, FMODE_READ))
++ return nfs_lookup_revalidate_delegated(dir, dentry, inode);
+
+ /* NFS only supports OPEN on regular files */
+ if (!S_ISREG(inode->i_mode))
+- goto no_open;
++ goto full_reval;
++
+ /* We cannot do exclusive creation on a positive dentry */
+- if (flags & LOOKUP_EXCL)
+- goto no_open;
++ if (flags & (LOOKUP_EXCL | LOOKUP_REVAL))
++ goto reval_dentry;
++
++ /* Check if the directory changed */
++ if (!nfs_check_verifier(dir, dentry, flags & LOOKUP_RCU))
++ goto reval_dentry;
+
+ /* Let f_op->open() actually open (and revalidate) the file */
+- ret = 1;
++ return 1;
++reval_dentry:
++ if (flags & LOOKUP_RCU)
++ return -ECHILD;
++ return nfs_lookup_revalidate_dentry(dir, dentry, inode);;
+
+-out:
+- return ret;
++full_reval:
++ return nfs_do_lookup_revalidate(dir, dentry, flags);
++}
+
+-no_open:
+- return nfs_lookup_revalidate(dentry, flags);
++static int nfs4_lookup_revalidate(struct dentry *dentry, unsigned int flags)
++{
++ return __nfs_lookup_revalidate(dentry, flags,
++ nfs4_do_lookup_revalidate);
+ }
+
+ #endif /* CONFIG_NFSV4 */
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 1de855e0ae61..904e08bbb289 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1355,12 +1355,20 @@ static bool nfs4_mode_match_open_stateid(struct nfs4_state *state,
+ return false;
+ }
+
+-static int can_open_cached(struct nfs4_state *state, fmode_t mode, int open_mode)
++static int can_open_cached(struct nfs4_state *state, fmode_t mode,
++ int open_mode, enum open_claim_type4 claim)
+ {
+ int ret = 0;
+
+ if (open_mode & (O_EXCL|O_TRUNC))
+ goto out;
++ switch (claim) {
++ case NFS4_OPEN_CLAIM_NULL:
++ case NFS4_OPEN_CLAIM_FH:
++ goto out;
++ default:
++ break;
++ }
+ switch (mode & (FMODE_READ|FMODE_WRITE)) {
+ case FMODE_READ:
+ ret |= test_bit(NFS_O_RDONLY_STATE, &state->flags) != 0
+@@ -1753,7 +1761,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
+
+ for (;;) {
+ spin_lock(&state->owner->so_lock);
+- if (can_open_cached(state, fmode, open_mode)) {
++ if (can_open_cached(state, fmode, open_mode, claim)) {
+ update_open_stateflags(state, fmode);
+ spin_unlock(&state->owner->so_lock);
+ goto out_return_state;
+@@ -2282,7 +2290,8 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata)
+ if (data->state != NULL) {
+ struct nfs_delegation *delegation;
+
+- if (can_open_cached(data->state, data->o_arg.fmode, data->o_arg.open_flags))
++ if (can_open_cached(data->state, data->o_arg.fmode,
++ data->o_arg.open_flags, claim))
+ goto out_no_action;
+ rcu_read_lock();
+ delegation = rcu_dereference(NFS_I(data->state->inode)->delegation);
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index a7fbda72afeb..3b9b726b1a6c 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -205,12 +205,53 @@ static int proc_root_link(struct dentry *dentry, struct path *path)
+ return result;
+ }
+
++/*
++ * If the user used setproctitle(), we just get the string from
++ * user space at arg_start, and limit it to a maximum of one page.
++ */
++static ssize_t get_mm_proctitle(struct mm_struct *mm, char __user *buf,
++ size_t count, unsigned long pos,
++ unsigned long arg_start)
++{
++ char *page;
++ int ret, got;
++
++ if (pos >= PAGE_SIZE)
++ return 0;
++
++ page = (char *)__get_free_page(GFP_KERNEL);
++ if (!page)
++ return -ENOMEM;
++
++ ret = 0;
++ got = access_remote_vm(mm, arg_start, page, PAGE_SIZE, FOLL_ANON);
++ if (got > 0) {
++ int len = strnlen(page, got);
++
++ /* Include the NUL character if it was found */
++ if (len < got)
++ len++;
++
++ if (len > pos) {
++ len -= pos;
++ if (len > count)
++ len = count;
++ len -= copy_to_user(buf, page+pos, len);
++ if (!len)
++ len = -EFAULT;
++ ret = len;
++ }
++ }
++ free_page((unsigned long)page);
++ return ret;
++}
++
+ static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
+ size_t count, loff_t *ppos)
+ {
+ unsigned long arg_start, arg_end, env_start, env_end;
+ unsigned long pos, len;
+- char *page;
++ char *page, c;
+
+ /* Check if process spawned far enough to have cmdline. */
+ if (!mm->env_end)
+@@ -227,28 +268,42 @@ static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
+ return 0;
+
+ /*
+- * We have traditionally allowed the user to re-write
+- * the argument strings and overflow the end result
+- * into the environment section. But only do that if
+- * the environment area is contiguous to the arguments.
++ * We allow setproctitle() to overwrite the argument
++ * strings, and overflow past the original end. But
++ * only when it overflows into the environment area.
+ */
+- if (env_start != arg_end || env_start >= env_end)
++ if (env_start != arg_end || env_end < env_start)
+ env_start = env_end = arg_end;
+-
+- /* .. and limit it to a maximum of one page of slop */
+- if (env_end >= arg_end + PAGE_SIZE)
+- env_end = arg_end + PAGE_SIZE - 1;
++ len = env_end - arg_start;
+
+ /* We're not going to care if "*ppos" has high bits set */
+- pos = arg_start + *ppos;
+-
+- /* .. but we do check the result is in the proper range */
+- if (pos < arg_start || pos >= env_end)
++ pos = *ppos;
++ if (pos >= len)
+ return 0;
++ if (count > len - pos)
++ count = len - pos;
++ if (!count)
++ return 0;
++
++ /*
++ * Magical special case: if the argv[] end byte is not
++ * zero, the user has overwritten it with setproctitle(3).
++ *
++ * Possible future enhancement: do this only once when
++ * pos is 0, and set a flag in the 'struct file'.
++ */
++ if (access_remote_vm(mm, arg_end-1, &c, 1, FOLL_ANON) == 1 && c)
++ return get_mm_proctitle(mm, buf, count, pos, arg_start);
+
+- /* .. and we never go past env_end */
+- if (env_end - pos < count)
+- count = env_end - pos;
++ /*
++ * For the non-setproctitle() case we limit things strictly
++ * to the [arg_start, arg_end[ range.
++ */
++ pos += arg_start;
++ if (pos < arg_start || pos >= arg_end)
++ return 0;
++ if (count > arg_end - pos)
++ count = arg_end - pos;
+
+ page = (char *)__get_free_page(GFP_KERNEL);
+ if (!page)
+@@ -258,48 +313,11 @@ static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
+ while (count) {
+ int got;
+ size_t size = min_t(size_t, PAGE_SIZE, count);
+- long offset;
+
+- /*
+- * Are we already starting past the official end?
+- * We always include the last byte that is *supposed*
+- * to be NUL
+- */
+- offset = (pos >= arg_end) ? pos - arg_end + 1 : 0;
+-
+- got = access_remote_vm(mm, pos - offset, page, size + offset, FOLL_ANON);
+- if (got <= offset)
++ got = access_remote_vm(mm, pos, page, size, FOLL_ANON);
++ if (got <= 0)
+ break;
+- got -= offset;
+-
+- /* Don't walk past a NUL character once you hit arg_end */
+- if (pos + got >= arg_end) {
+- int n = 0;
+-
+- /*
+- * If we started before 'arg_end' but ended up
+- * at or after it, we start the NUL character
+- * check at arg_end-1 (where we expect the normal
+- * EOF to be).
+- *
+- * NOTE! This is smaller than 'got', because
+- * pos + got >= arg_end
+- */
+- if (pos < arg_end)
+- n = arg_end - pos - 1;
+-
+- /* Cut off at first NUL after 'n' */
+- got = n + strnlen(page+n, offset+got-n);
+- if (got < offset)
+- break;
+- got -= offset;
+-
+- /* Include the NUL if it existed */
+- if (got < size)
+- got++;
+- }
+-
+- got -= copy_to_user(buf, page+offset, got);
++ got -= copy_to_user(buf, page, got);
+ if (unlikely(!got)) {
+ if (!len)
+ len = -EFAULT;
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 6980014357d4..d51e10f50e75 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -504,6 +504,12 @@ struct request_queue {
+ * various queue flags, see QUEUE_* below
+ */
+ unsigned long queue_flags;
++ /*
++ * Number of contexts that have called blk_set_pm_only(). If this
++ * counter is above zero then only RQF_PM and RQF_PREEMPT requests are
++ * processed.
++ */
++ atomic_t pm_only;
+
+ /*
+ * ida allocated id for this queue. Used to index queues from
+@@ -698,7 +704,6 @@ struct request_queue {
+ #define QUEUE_FLAG_REGISTERED 26 /* queue has been registered to a disk */
+ #define QUEUE_FLAG_SCSI_PASSTHROUGH 27 /* queue supports SCSI commands */
+ #define QUEUE_FLAG_QUIESCED 28 /* queue has been quiesced */
+-#define QUEUE_FLAG_PREEMPT_ONLY 29 /* only process REQ_PREEMPT requests */
+
+ #define QUEUE_FLAG_DEFAULT ((1 << QUEUE_FLAG_IO_STAT) | \
+ (1 << QUEUE_FLAG_SAME_COMP) | \
+@@ -736,12 +741,11 @@ bool blk_queue_flag_test_and_clear(unsigned int flag, struct request_queue *q);
+ ((rq)->cmd_flags & (REQ_FAILFAST_DEV|REQ_FAILFAST_TRANSPORT| \
+ REQ_FAILFAST_DRIVER))
+ #define blk_queue_quiesced(q) test_bit(QUEUE_FLAG_QUIESCED, &(q)->queue_flags)
+-#define blk_queue_preempt_only(q) \
+- test_bit(QUEUE_FLAG_PREEMPT_ONLY, &(q)->queue_flags)
++#define blk_queue_pm_only(q) atomic_read(&(q)->pm_only)
+ #define blk_queue_fua(q) test_bit(QUEUE_FLAG_FUA, &(q)->queue_flags)
+
+-extern int blk_set_preempt_only(struct request_queue *q);
+-extern void blk_clear_preempt_only(struct request_queue *q);
++extern void blk_set_pm_only(struct request_queue *q);
++extern void blk_clear_pm_only(struct request_queue *q);
+
+ static inline int queue_in_flight(struct request_queue *q)
+ {
+diff --git a/include/linux/iova.h b/include/linux/iova.h
+index 928442dda565..84fbe73d2ec0 100644
+--- a/include/linux/iova.h
++++ b/include/linux/iova.h
+@@ -156,6 +156,7 @@ struct iova *reserve_iova(struct iova_domain *iovad, unsigned long pfn_lo,
+ void copy_reserved_iova(struct iova_domain *from, struct iova_domain *to);
+ void init_iova_domain(struct iova_domain *iovad, unsigned long granule,
+ unsigned long start_pfn);
++bool has_iova_flush_queue(struct iova_domain *iovad);
+ int init_iova_flush_queue(struct iova_domain *iovad,
+ iova_flush_cb flush_cb, iova_entry_dtor entry_dtor);
+ struct iova *find_iova(struct iova_domain *iovad, unsigned long pfn);
+@@ -236,6 +237,11 @@ static inline void init_iova_domain(struct iova_domain *iovad,
+ {
+ }
+
++static inline bool has_iova_flush_queue(struct iova_domain *iovad)
++{
++ return false;
++}
++
+ static inline int init_iova_flush_queue(struct iova_domain *iovad,
+ iova_flush_cb flush_cb,
+ iova_entry_dtor entry_dtor)
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 5dc024e28397..20f5ba262cc0 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1023,7 +1023,15 @@ struct task_struct {
+ u64 last_sum_exec_runtime;
+ struct callback_head numa_work;
+
+- struct numa_group *numa_group;
++ /*
++ * This pointer is only modified for current in syscall and
++ * pagefault context (and for tasks being destroyed), so it can be read
++ * from any of the following contexts:
++ * - RCU read-side critical section
++ * - current->numa_group from everywhere
++ * - task's runqueue locked, task not running
++ */
++ struct numa_group __rcu *numa_group;
+
+ /*
+ * numa_faults is an array split into four regions:
+diff --git a/include/linux/sched/numa_balancing.h b/include/linux/sched/numa_balancing.h
+index e7dd04a84ba8..3988762efe15 100644
+--- a/include/linux/sched/numa_balancing.h
++++ b/include/linux/sched/numa_balancing.h
+@@ -19,7 +19,7 @@
+ extern void task_numa_fault(int last_node, int node, int pages, int flags);
+ extern pid_t task_numa_group_id(struct task_struct *p);
+ extern void set_numabalancing_state(bool enabled);
+-extern void task_numa_free(struct task_struct *p);
++extern void task_numa_free(struct task_struct *p, bool final);
+ extern bool should_numa_migrate_memory(struct task_struct *p, struct page *page,
+ int src_nid, int dst_cpu);
+ #else
+@@ -34,7 +34,7 @@ static inline pid_t task_numa_group_id(struct task_struct *p)
+ static inline void set_numabalancing_state(bool enabled)
+ {
+ }
+-static inline void task_numa_free(struct task_struct *p)
++static inline void task_numa_free(struct task_struct *p, bool final)
+ {
+ }
+ static inline bool should_numa_migrate_memory(struct task_struct *p,
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 69874db3fba8..e76ce81c9c75 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -679,7 +679,7 @@ void __put_task_struct(struct task_struct *tsk)
+ WARN_ON(tsk == current);
+
+ cgroup_free(tsk);
+- task_numa_free(tsk);
++ task_numa_free(tsk, true);
+ security_task_free(tsk);
+ exit_creds(tsk);
+ delayacct_tsk_free(tsk);
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 4a433608ba74..75f322603d44 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -1053,6 +1053,21 @@ struct numa_group {
+ unsigned long faults[0];
+ };
+
++/*
++ * For functions that can be called in multiple contexts that permit reading
++ * ->numa_group (see struct task_struct for locking rules).
++ */
++static struct numa_group *deref_task_numa_group(struct task_struct *p)
++{
++ return rcu_dereference_check(p->numa_group, p == current ||
++ (lockdep_is_held(&task_rq(p)->lock) && !READ_ONCE(p->on_cpu)));
++}
++
++static struct numa_group *deref_curr_numa_group(struct task_struct *p)
++{
++ return rcu_dereference_protected(p->numa_group, p == current);
++}
++
+ static inline unsigned long group_faults_priv(struct numa_group *ng);
+ static inline unsigned long group_faults_shared(struct numa_group *ng);
+
+@@ -1096,10 +1111,12 @@ static unsigned int task_scan_start(struct task_struct *p)
+ {
+ unsigned long smin = task_scan_min(p);
+ unsigned long period = smin;
++ struct numa_group *ng;
+
+ /* Scale the maximum scan period with the amount of shared memory. */
+- if (p->numa_group) {
+- struct numa_group *ng = p->numa_group;
++ rcu_read_lock();
++ ng = rcu_dereference(p->numa_group);
++ if (ng) {
+ unsigned long shared = group_faults_shared(ng);
+ unsigned long private = group_faults_priv(ng);
+
+@@ -1107,6 +1124,7 @@ static unsigned int task_scan_start(struct task_struct *p)
+ period *= shared + 1;
+ period /= private + shared + 1;
+ }
++ rcu_read_unlock();
+
+ return max(smin, period);
+ }
+@@ -1115,13 +1133,14 @@ static unsigned int task_scan_max(struct task_struct *p)
+ {
+ unsigned long smin = task_scan_min(p);
+ unsigned long smax;
++ struct numa_group *ng;
+
+ /* Watch for min being lower than max due to floor calculations */
+ smax = sysctl_numa_balancing_scan_period_max / task_nr_scan_windows(p);
+
+ /* Scale the maximum scan period with the amount of shared memory. */
+- if (p->numa_group) {
+- struct numa_group *ng = p->numa_group;
++ ng = deref_curr_numa_group(p);
++ if (ng) {
+ unsigned long shared = group_faults_shared(ng);
+ unsigned long private = group_faults_priv(ng);
+ unsigned long period = smax;
+@@ -1153,7 +1172,7 @@ void init_numa_balancing(unsigned long clone_flags, struct task_struct *p)
+ p->numa_scan_period = sysctl_numa_balancing_scan_delay;
+ p->numa_work.next = &p->numa_work;
+ p->numa_faults = NULL;
+- p->numa_group = NULL;
++ RCU_INIT_POINTER(p->numa_group, NULL);
+ p->last_task_numa_placement = 0;
+ p->last_sum_exec_runtime = 0;
+
+@@ -1200,7 +1219,16 @@ static void account_numa_dequeue(struct rq *rq, struct task_struct *p)
+
+ pid_t task_numa_group_id(struct task_struct *p)
+ {
+- return p->numa_group ? p->numa_group->gid : 0;
++ struct numa_group *ng;
++ pid_t gid = 0;
++
++ rcu_read_lock();
++ ng = rcu_dereference(p->numa_group);
++ if (ng)
++ gid = ng->gid;
++ rcu_read_unlock();
++
++ return gid;
+ }
+
+ /*
+@@ -1225,11 +1253,13 @@ static inline unsigned long task_faults(struct task_struct *p, int nid)
+
+ static inline unsigned long group_faults(struct task_struct *p, int nid)
+ {
+- if (!p->numa_group)
++ struct numa_group *ng = deref_task_numa_group(p);
++
++ if (!ng)
+ return 0;
+
+- return p->numa_group->faults[task_faults_idx(NUMA_MEM, nid, 0)] +
+- p->numa_group->faults[task_faults_idx(NUMA_MEM, nid, 1)];
++ return ng->faults[task_faults_idx(NUMA_MEM, nid, 0)] +
++ ng->faults[task_faults_idx(NUMA_MEM, nid, 1)];
+ }
+
+ static inline unsigned long group_faults_cpu(struct numa_group *group, int nid)
+@@ -1367,12 +1397,13 @@ static inline unsigned long task_weight(struct task_struct *p, int nid,
+ static inline unsigned long group_weight(struct task_struct *p, int nid,
+ int dist)
+ {
++ struct numa_group *ng = deref_task_numa_group(p);
+ unsigned long faults, total_faults;
+
+- if (!p->numa_group)
++ if (!ng)
+ return 0;
+
+- total_faults = p->numa_group->total_faults;
++ total_faults = ng->total_faults;
+
+ if (!total_faults)
+ return 0;
+@@ -1386,7 +1417,7 @@ static inline unsigned long group_weight(struct task_struct *p, int nid,
+ bool should_numa_migrate_memory(struct task_struct *p, struct page * page,
+ int src_nid, int dst_cpu)
+ {
+- struct numa_group *ng = p->numa_group;
++ struct numa_group *ng = deref_curr_numa_group(p);
+ int dst_nid = cpu_to_node(dst_cpu);
+ int last_cpupid, this_cpupid;
+
+@@ -1592,13 +1623,14 @@ static bool load_too_imbalanced(long src_load, long dst_load,
+ static void task_numa_compare(struct task_numa_env *env,
+ long taskimp, long groupimp, bool maymove)
+ {
++ struct numa_group *cur_ng, *p_ng = deref_curr_numa_group(env->p);
+ struct rq *dst_rq = cpu_rq(env->dst_cpu);
++ long imp = p_ng ? groupimp : taskimp;
+ struct task_struct *cur;
+ long src_load, dst_load;
+- long load;
+- long imp = env->p->numa_group ? groupimp : taskimp;
+- long moveimp = imp;
+ int dist = env->dist;
++ long moveimp = imp;
++ long load;
+
+ if (READ_ONCE(dst_rq->numa_migrate_on))
+ return;
+@@ -1637,21 +1669,22 @@ static void task_numa_compare(struct task_numa_env *env,
+ * If dst and source tasks are in the same NUMA group, or not
+ * in any group then look only at task weights.
+ */
+- if (cur->numa_group == env->p->numa_group) {
++ cur_ng = rcu_dereference(cur->numa_group);
++ if (cur_ng == p_ng) {
+ imp = taskimp + task_weight(cur, env->src_nid, dist) -
+ task_weight(cur, env->dst_nid, dist);
+ /*
+ * Add some hysteresis to prevent swapping the
+ * tasks within a group over tiny differences.
+ */
+- if (cur->numa_group)
++ if (cur_ng)
+ imp -= imp / 16;
+ } else {
+ /*
+ * Compare the group weights. If a task is all by itself
+ * (not part of a group), use the task weight instead.
+ */
+- if (cur->numa_group && env->p->numa_group)
++ if (cur_ng && p_ng)
+ imp += group_weight(cur, env->src_nid, dist) -
+ group_weight(cur, env->dst_nid, dist);
+ else
+@@ -1749,11 +1782,12 @@ static int task_numa_migrate(struct task_struct *p)
+ .best_imp = 0,
+ .best_cpu = -1,
+ };
++ unsigned long taskweight, groupweight;
+ struct sched_domain *sd;
++ long taskimp, groupimp;
++ struct numa_group *ng;
+ struct rq *best_rq;
+- unsigned long taskweight, groupweight;
+ int nid, ret, dist;
+- long taskimp, groupimp;
+
+ /*
+ * Pick the lowest SD_NUMA domain, as that would have the smallest
+@@ -1799,7 +1833,8 @@ static int task_numa_migrate(struct task_struct *p)
+ * multiple NUMA nodes; in order to better consolidate the group,
+ * we need to check other locations.
+ */
+- if (env.best_cpu == -1 || (p->numa_group && p->numa_group->active_nodes > 1)) {
++ ng = deref_curr_numa_group(p);
++ if (env.best_cpu == -1 || (ng && ng->active_nodes > 1)) {
+ for_each_online_node(nid) {
+ if (nid == env.src_nid || nid == p->numa_preferred_nid)
+ continue;
+@@ -1832,7 +1867,7 @@ static int task_numa_migrate(struct task_struct *p)
+ * A task that migrated to a second choice node will be better off
+ * trying for a better one later. Do not set the preferred node here.
+ */
+- if (p->numa_group) {
++ if (ng) {
+ if (env.best_cpu == -1)
+ nid = env.src_nid;
+ else
+@@ -2127,6 +2162,7 @@ static void task_numa_placement(struct task_struct *p)
+ unsigned long total_faults;
+ u64 runtime, period;
+ spinlock_t *group_lock = NULL;
++ struct numa_group *ng;
+
+ /*
+ * The p->mm->numa_scan_seq field gets updated without
+@@ -2144,8 +2180,9 @@ static void task_numa_placement(struct task_struct *p)
+ runtime = numa_get_avg_runtime(p, &period);
+
+ /* If the task is part of a group prevent parallel updates to group stats */
+- if (p->numa_group) {
+- group_lock = &p->numa_group->lock;
++ ng = deref_curr_numa_group(p);
++ if (ng) {
++ group_lock = &ng->lock;
+ spin_lock_irq(group_lock);
+ }
+
+@@ -2186,7 +2223,7 @@ static void task_numa_placement(struct task_struct *p)
+ p->numa_faults[cpu_idx] += f_diff;
+ faults += p->numa_faults[mem_idx];
+ p->total_numa_faults += diff;
+- if (p->numa_group) {
++ if (ng) {
+ /*
+ * safe because we can only change our own group
+ *
+@@ -2194,14 +2231,14 @@ static void task_numa_placement(struct task_struct *p)
+ * nid and priv in a specific region because it
+ * is at the beginning of the numa_faults array.
+ */
+- p->numa_group->faults[mem_idx] += diff;
+- p->numa_group->faults_cpu[mem_idx] += f_diff;
+- p->numa_group->total_faults += diff;
+- group_faults += p->numa_group->faults[mem_idx];
++ ng->faults[mem_idx] += diff;
++ ng->faults_cpu[mem_idx] += f_diff;
++ ng->total_faults += diff;
++ group_faults += ng->faults[mem_idx];
+ }
+ }
+
+- if (!p->numa_group) {
++ if (!ng) {
+ if (faults > max_faults) {
+ max_faults = faults;
+ max_nid = nid;
+@@ -2212,8 +2249,8 @@ static void task_numa_placement(struct task_struct *p)
+ }
+ }
+
+- if (p->numa_group) {
+- numa_group_count_active_nodes(p->numa_group);
++ if (ng) {
++ numa_group_count_active_nodes(ng);
+ spin_unlock_irq(group_lock);
+ max_nid = preferred_group_nid(p, max_nid);
+ }
+@@ -2247,7 +2284,7 @@ static void task_numa_group(struct task_struct *p, int cpupid, int flags,
+ int cpu = cpupid_to_cpu(cpupid);
+ int i;
+
+- if (unlikely(!p->numa_group)) {
++ if (unlikely(!deref_curr_numa_group(p))) {
+ unsigned int size = sizeof(struct numa_group) +
+ 4*nr_node_ids*sizeof(unsigned long);
+
+@@ -2283,7 +2320,7 @@ static void task_numa_group(struct task_struct *p, int cpupid, int flags,
+ if (!grp)
+ goto no_join;
+
+- my_grp = p->numa_group;
++ my_grp = deref_curr_numa_group(p);
+ if (grp == my_grp)
+ goto no_join;
+
+@@ -2345,13 +2382,24 @@ no_join:
+ return;
+ }
+
+-void task_numa_free(struct task_struct *p)
++/*
++ * Get rid of NUMA staticstics associated with a task (either current or dead).
++ * If @final is set, the task is dead and has reached refcount zero, so we can
++ * safely free all relevant data structures. Otherwise, there might be
++ * concurrent reads from places like load balancing and procfs, and we should
++ * reset the data back to default state without freeing ->numa_faults.
++ */
++void task_numa_free(struct task_struct *p, bool final)
+ {
+- struct numa_group *grp = p->numa_group;
+- void *numa_faults = p->numa_faults;
++ /* safe: p either is current or is being freed by current */
++ struct numa_group *grp = rcu_dereference_raw(p->numa_group);
++ unsigned long *numa_faults = p->numa_faults;
+ unsigned long flags;
+ int i;
+
++ if (!numa_faults)
++ return;
++
+ if (grp) {
+ spin_lock_irqsave(&grp->lock, flags);
+ for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++)
+@@ -2364,8 +2412,14 @@ void task_numa_free(struct task_struct *p)
+ put_numa_group(grp);
+ }
+
+- p->numa_faults = NULL;
+- kfree(numa_faults);
++ if (final) {
++ p->numa_faults = NULL;
++ kfree(numa_faults);
++ } else {
++ p->total_numa_faults = 0;
++ for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++)
++ numa_faults[i] = 0;
++ }
+ }
+
+ /*
+@@ -2418,7 +2472,7 @@ void task_numa_fault(int last_cpupid, int mem_node, int pages, int flags)
+ * actively using should be counted as local. This allows the
+ * scan rate to slow down when a workload has settled down.
+ */
+- ng = p->numa_group;
++ ng = deref_curr_numa_group(p);
+ if (!priv && !local && ng && ng->active_nodes > 1 &&
+ numa_is_active_node(cpu_node, ng) &&
+ numa_is_active_node(mem_node, ng))
+@@ -10218,18 +10272,22 @@ void show_numa_stats(struct task_struct *p, struct seq_file *m)
+ {
+ int node;
+ unsigned long tsf = 0, tpf = 0, gsf = 0, gpf = 0;
++ struct numa_group *ng;
+
++ rcu_read_lock();
++ ng = rcu_dereference(p->numa_group);
+ for_each_online_node(node) {
+ if (p->numa_faults) {
+ tsf = p->numa_faults[task_faults_idx(NUMA_MEM, node, 0)];
+ tpf = p->numa_faults[task_faults_idx(NUMA_MEM, node, 1)];
+ }
+- if (p->numa_group) {
+- gsf = p->numa_group->faults[task_faults_idx(NUMA_MEM, node, 0)],
+- gpf = p->numa_group->faults[task_faults_idx(NUMA_MEM, node, 1)];
++ if (ng) {
++ gsf = ng->faults[task_faults_idx(NUMA_MEM, node, 0)],
++ gpf = ng->faults[task_faults_idx(NUMA_MEM, node, 1)];
+ }
+ print_numa_stats(m, node, tsf, tpf, gsf, gpf);
+ }
++ rcu_read_unlock();
+ }
+ #endif /* CONFIG_NUMA_BALANCING */
+ #endif /* CONFIG_SCHED_DEBUG */
+diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
+index c248e0dccbe1..67ef9d853d90 100644
+--- a/net/ipv4/ip_tunnel_core.c
++++ b/net/ipv4/ip_tunnel_core.c
+@@ -89,9 +89,12 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
+ __ip_select_ident(net, iph, skb_shinfo(skb)->gso_segs ?: 1);
+
+ err = ip_local_out(net, sk, skb);
+- if (unlikely(net_xmit_eval(err)))
+- pkt_len = 0;
+- iptunnel_xmit_stats(dev, pkt_len);
++
++ if (dev) {
++ if (unlikely(net_xmit_eval(err)))
++ pkt_len = 0;
++ iptunnel_xmit_stats(dev, pkt_len);
++ }
+ }
+ EXPORT_SYMBOL_GPL(iptunnel_xmit);
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index ab27a2872935..2e30bf197583 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -281,7 +281,8 @@ EXPORT_SYMBOL_GPL(vsock_insert_connected);
+ void vsock_remove_bound(struct vsock_sock *vsk)
+ {
+ spin_lock_bh(&vsock_table_lock);
+- __vsock_remove_bound(vsk);
++ if (__vsock_in_bound_table(vsk))
++ __vsock_remove_bound(vsk);
+ spin_unlock_bh(&vsock_table_lock);
+ }
+ EXPORT_SYMBOL_GPL(vsock_remove_bound);
+@@ -289,7 +290,8 @@ EXPORT_SYMBOL_GPL(vsock_remove_bound);
+ void vsock_remove_connected(struct vsock_sock *vsk)
+ {
+ spin_lock_bh(&vsock_table_lock);
+- __vsock_remove_connected(vsk);
++ if (__vsock_in_connected_table(vsk))
++ __vsock_remove_connected(vsk);
+ spin_unlock_bh(&vsock_table_lock);
+ }
+ EXPORT_SYMBOL_GPL(vsock_remove_connected);
+@@ -325,35 +327,10 @@ struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,
+ }
+ EXPORT_SYMBOL_GPL(vsock_find_connected_socket);
+
+-static bool vsock_in_bound_table(struct vsock_sock *vsk)
+-{
+- bool ret;
+-
+- spin_lock_bh(&vsock_table_lock);
+- ret = __vsock_in_bound_table(vsk);
+- spin_unlock_bh(&vsock_table_lock);
+-
+- return ret;
+-}
+-
+-static bool vsock_in_connected_table(struct vsock_sock *vsk)
+-{
+- bool ret;
+-
+- spin_lock_bh(&vsock_table_lock);
+- ret = __vsock_in_connected_table(vsk);
+- spin_unlock_bh(&vsock_table_lock);
+-
+- return ret;
+-}
+-
+ void vsock_remove_sock(struct vsock_sock *vsk)
+ {
+- if (vsock_in_bound_table(vsk))
+- vsock_remove_bound(vsk);
+-
+- if (vsock_in_connected_table(vsk))
+- vsock_remove_connected(vsk);
++ vsock_remove_bound(vsk);
++ vsock_remove_connected(vsk);
+ }
+ EXPORT_SYMBOL_GPL(vsock_remove_sock);
+
+@@ -484,8 +461,7 @@ static void vsock_pending_work(struct work_struct *work)
+ * incoming packets can't find this socket, and to reduce the reference
+ * count.
+ */
+- if (vsock_in_connected_table(vsk))
+- vsock_remove_connected(vsk);
++ vsock_remove_connected(vsk);
+
+ sk->sk_state = TCP_CLOSE;
+
+diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
+index b131561a9469..9c7da811d130 100644
+--- a/net/vmw_vsock/hyperv_transport.c
++++ b/net/vmw_vsock/hyperv_transport.c
+@@ -35,6 +35,9 @@
+ /* The MTU is 16KB per the host side's design */
+ #define HVS_MTU_SIZE (1024 * 16)
+
++/* How long to wait for graceful shutdown of a connection */
++#define HVS_CLOSE_TIMEOUT (8 * HZ)
++
+ struct vmpipe_proto_header {
+ u32 pkt_type;
+ u32 data_size;
+@@ -290,19 +293,32 @@ static void hvs_channel_cb(void *ctx)
+ sk->sk_write_space(sk);
+ }
+
+-static void hvs_close_connection(struct vmbus_channel *chan)
++static void hvs_do_close_lock_held(struct vsock_sock *vsk,
++ bool cancel_timeout)
+ {
+- struct sock *sk = get_per_channel_state(chan);
+- struct vsock_sock *vsk = vsock_sk(sk);
+-
+- lock_sock(sk);
++ struct sock *sk = sk_vsock(vsk);
+
+- sk->sk_state = TCP_CLOSE;
+ sock_set_flag(sk, SOCK_DONE);
+- vsk->peer_shutdown |= SEND_SHUTDOWN | RCV_SHUTDOWN;
+-
++ vsk->peer_shutdown = SHUTDOWN_MASK;
++ if (vsock_stream_has_data(vsk) <= 0)
++ sk->sk_state = TCP_CLOSING;
+ sk->sk_state_change(sk);
++ if (vsk->close_work_scheduled &&
++ (!cancel_timeout || cancel_delayed_work(&vsk->close_work))) {
++ vsk->close_work_scheduled = false;
++ vsock_remove_sock(vsk);
+
++ /* Release the reference taken while scheduling the timeout */
++ sock_put(sk);
++ }
++}
++
++static void hvs_close_connection(struct vmbus_channel *chan)
++{
++ struct sock *sk = get_per_channel_state(chan);
++
++ lock_sock(sk);
++ hvs_do_close_lock_held(vsock_sk(sk), true);
+ release_sock(sk);
+ }
+
+@@ -445,50 +461,80 @@ static int hvs_connect(struct vsock_sock *vsk)
+ return vmbus_send_tl_connect_request(&h->vm_srv_id, &h->host_srv_id);
+ }
+
++static void hvs_shutdown_lock_held(struct hvsock *hvs, int mode)
++{
++ struct vmpipe_proto_header hdr;
++
++ if (hvs->fin_sent || !hvs->chan)
++ return;
++
++ /* It can't fail: see hvs_channel_writable_bytes(). */
++ (void)hvs_send_data(hvs->chan, (struct hvs_send_buf *)&hdr, 0);
++ hvs->fin_sent = true;
++}
++
+ static int hvs_shutdown(struct vsock_sock *vsk, int mode)
+ {
+ struct sock *sk = sk_vsock(vsk);
+- struct vmpipe_proto_header hdr;
+- struct hvs_send_buf *send_buf;
+- struct hvsock *hvs;
+
+ if (!(mode & SEND_SHUTDOWN))
+ return 0;
+
+ lock_sock(sk);
++ hvs_shutdown_lock_held(vsk->trans, mode);
++ release_sock(sk);
++ return 0;
++}
+
+- hvs = vsk->trans;
+- if (hvs->fin_sent)
+- goto out;
+-
+- send_buf = (struct hvs_send_buf *)&hdr;
++static void hvs_close_timeout(struct work_struct *work)
++{
++ struct vsock_sock *vsk =
++ container_of(work, struct vsock_sock, close_work.work);
++ struct sock *sk = sk_vsock(vsk);
+
+- /* It can't fail: see hvs_channel_writable_bytes(). */
+- (void)hvs_send_data(hvs->chan, send_buf, 0);
++ sock_hold(sk);
++ lock_sock(sk);
++ if (!sock_flag(sk, SOCK_DONE))
++ hvs_do_close_lock_held(vsk, false);
+
+- hvs->fin_sent = true;
+-out:
++ vsk->close_work_scheduled = false;
+ release_sock(sk);
+- return 0;
++ sock_put(sk);
+ }
+
+-static void hvs_release(struct vsock_sock *vsk)
++/* Returns true, if it is safe to remove socket; false otherwise */
++static bool hvs_close_lock_held(struct vsock_sock *vsk)
+ {
+ struct sock *sk = sk_vsock(vsk);
+- struct hvsock *hvs = vsk->trans;
+- struct vmbus_channel *chan;
+
+- lock_sock(sk);
++ if (!(sk->sk_state == TCP_ESTABLISHED ||
++ sk->sk_state == TCP_CLOSING))
++ return true;
+
+- sk->sk_state = TCP_CLOSING;
+- vsock_remove_sock(vsk);
++ if ((sk->sk_shutdown & SHUTDOWN_MASK) != SHUTDOWN_MASK)
++ hvs_shutdown_lock_held(vsk->trans, SHUTDOWN_MASK);
+
+- release_sock(sk);
++ if (sock_flag(sk, SOCK_DONE))
++ return true;
+
+- chan = hvs->chan;
+- if (chan)
+- hvs_shutdown(vsk, RCV_SHUTDOWN | SEND_SHUTDOWN);
++ /* This reference will be dropped by the delayed close routine */
++ sock_hold(sk);
++ INIT_DELAYED_WORK(&vsk->close_work, hvs_close_timeout);
++ vsk->close_work_scheduled = true;
++ schedule_delayed_work(&vsk->close_work, HVS_CLOSE_TIMEOUT);
++ return false;
++}
+
++static void hvs_release(struct vsock_sock *vsk)
++{
++ struct sock *sk = sk_vsock(vsk);
++ bool remove_sock;
++
++ lock_sock(sk);
++ remove_sock = hvs_close_lock_held(vsk);
++ release_sock(sk);
++ if (remove_sock)
++ vsock_remove_sock(vsk);
+ }
+
+ static void hvs_destruct(struct vsock_sock *vsk)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-08-06 19:19 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-08-06 19:19 UTC (permalink / raw
To: gentoo-commits
commit: 2e2555bafe4b4554306671d02ecf755f1702c612
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 6 19:18:49 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Aug 6 19:18:49 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2e2555ba
Linux patch 4.19.65
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1064_linux-4.19.65.patch | 2660 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2664 insertions(+)
diff --git a/0000_README b/0000_README
index 391cca5..2679f40 100644
--- a/0000_README
+++ b/0000_README
@@ -299,6 +299,10 @@ Patch: 1063_linux-4.19.64.patch
From: https://www.kernel.org
Desc: Linux 4.19.64
+Patch: 1064_linux-4.19.65.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.65
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1064_linux-4.19.65.patch b/1064_linux-4.19.65.patch
new file mode 100644
index 0000000..fac8063
--- /dev/null
+++ b/1064_linux-4.19.65.patch
@@ -0,0 +1,2660 @@
+diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
+index 25f3b2532198..e05e581af5cf 100644
+--- a/Documentation/admin-guide/hw-vuln/spectre.rst
++++ b/Documentation/admin-guide/hw-vuln/spectre.rst
+@@ -41,10 +41,11 @@ Related CVEs
+
+ The following CVE entries describe Spectre variants:
+
+- ============= ======================= =================
++ ============= ======================= ==========================
+ CVE-2017-5753 Bounds check bypass Spectre variant 1
+ CVE-2017-5715 Branch target injection Spectre variant 2
+- ============= ======================= =================
++ CVE-2019-1125 Spectre v1 swapgs Spectre variant 1 (swapgs)
++ ============= ======================= ==========================
+
+ Problem
+ -------
+@@ -78,6 +79,13 @@ There are some extensions of Spectre variant 1 attacks for reading data
+ over the network, see :ref:`[12] <spec_ref12>`. However such attacks
+ are difficult, low bandwidth, fragile, and are considered low risk.
+
++Note that, despite "Bounds Check Bypass" name, Spectre variant 1 is not
++only about user-controlled array bounds checks. It can affect any
++conditional checks. The kernel entry code interrupt, exception, and NMI
++handlers all have conditional swapgs checks. Those may be problematic
++in the context of Spectre v1, as kernel code can speculatively run with
++a user GS.
++
+ Spectre variant 2 (Branch Target Injection)
+ -------------------------------------------
+
+@@ -132,6 +140,9 @@ not cover all possible attack vectors.
+ 1. A user process attacking the kernel
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
++Spectre variant 1
++~~~~~~~~~~~~~~~~~
++
+ The attacker passes a parameter to the kernel via a register or
+ via a known address in memory during a syscall. Such parameter may
+ be used later by the kernel as an index to an array or to derive
+@@ -144,7 +155,40 @@ not cover all possible attack vectors.
+ potentially be influenced for Spectre attacks, new "nospec" accessor
+ macros are used to prevent speculative loading of data.
+
+- Spectre variant 2 attacker can :ref:`poison <poison_btb>` the branch
++Spectre variant 1 (swapgs)
++~~~~~~~~~~~~~~~~~~~~~~~~~~
++
++ An attacker can train the branch predictor to speculatively skip the
++ swapgs path for an interrupt or exception. If they initialize
++ the GS register to a user-space value, if the swapgs is speculatively
++ skipped, subsequent GS-related percpu accesses in the speculation
++ window will be done with the attacker-controlled GS value. This
++ could cause privileged memory to be accessed and leaked.
++
++ For example:
++
++ ::
++
++ if (coming from user space)
++ swapgs
++ mov %gs:<percpu_offset>, %reg
++ mov (%reg), %reg1
++
++ When coming from user space, the CPU can speculatively skip the
++ swapgs, and then do a speculative percpu load using the user GS
++ value. So the user can speculatively force a read of any kernel
++ value. If a gadget exists which uses the percpu value as an address
++ in another load/store, then the contents of the kernel value may
++ become visible via an L1 side channel attack.
++
++ A similar attack exists when coming from kernel space. The CPU can
++ speculatively do the swapgs, causing the user GS to get used for the
++ rest of the speculative window.
++
++Spectre variant 2
++~~~~~~~~~~~~~~~~~
++
++ A spectre variant 2 attacker can :ref:`poison <poison_btb>` the branch
+ target buffer (BTB) before issuing syscall to launch an attack.
+ After entering the kernel, the kernel could use the poisoned branch
+ target buffer on indirect jump and jump to gadget code in speculative
+@@ -280,11 +324,18 @@ The sysfs file showing Spectre variant 1 mitigation status is:
+
+ The possible values in this file are:
+
+- ======================================= =================================
+- 'Mitigation: __user pointer sanitation' Protection in kernel on a case by
+- case base with explicit pointer
+- sanitation.
+- ======================================= =================================
++ .. list-table::
++
++ * - 'Not affected'
++ - The processor is not vulnerable.
++ * - 'Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers'
++ - The swapgs protections are disabled; otherwise it has
++ protection in the kernel on a case by case base with explicit
++ pointer sanitation and usercopy LFENCE barriers.
++ * - 'Mitigation: usercopy/swapgs barriers and __user pointer sanitization'
++ - Protection in the kernel on a case by case base with explicit
++ pointer sanitation, usercopy LFENCE barriers, and swapgs LFENCE
++ barriers.
+
+ However, the protections are put in place on a case by case basis,
+ and there is no guarantee that all possible attack vectors for Spectre
+@@ -366,12 +417,27 @@ Turning on mitigation for Spectre variant 1 and Spectre variant 2
+ 1. Kernel mitigation
+ ^^^^^^^^^^^^^^^^^^^^
+
++Spectre variant 1
++~~~~~~~~~~~~~~~~~
++
+ For the Spectre variant 1, vulnerable kernel code (as determined
+ by code audit or scanning tools) is annotated on a case by case
+ basis to use nospec accessor macros for bounds clipping :ref:`[2]
+ <spec_ref2>` to avoid any usable disclosure gadgets. However, it may
+ not cover all attack vectors for Spectre variant 1.
+
++ Copy-from-user code has an LFENCE barrier to prevent the access_ok()
++ check from being mis-speculated. The barrier is done by the
++ barrier_nospec() macro.
++
++ For the swapgs variant of Spectre variant 1, LFENCE barriers are
++ added to interrupt, exception and NMI entry where needed. These
++ barriers are done by the FENCE_SWAPGS_KERNEL_ENTRY and
++ FENCE_SWAPGS_USER_ENTRY macros.
++
++Spectre variant 2
++~~~~~~~~~~~~~~~~~
++
+ For Spectre variant 2 mitigation, the compiler turns indirect calls or
+ jumps in the kernel into equivalent return trampolines (retpolines)
+ :ref:`[3] <spec_ref3>` :ref:`[9] <spec_ref9>` to go to the target
+@@ -473,6 +539,12 @@ Mitigation control on the kernel command line
+ Spectre variant 2 mitigation can be disabled or force enabled at the
+ kernel command line.
+
++ nospectre_v1
++
++ [X86,PPC] Disable mitigations for Spectre Variant 1
++ (bounds check bypass). With this option data leaks are
++ possible in the system.
++
+ nospectre_v2
+
+ [X86] Disable all mitigations for the Spectre variant 2
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 1cee1174cde6..c96a8e9ad5c2 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2515,6 +2515,7 @@
+ Equivalent to: nopti [X86,PPC]
+ nospectre_v1 [PPC]
+ nobp=0 [S390]
++ nospectre_v1 [X86]
+ nospectre_v2 [X86,PPC,S390]
+ spectre_v2_user=off [X86]
+ spec_store_bypass_disable=off [X86,PPC]
+@@ -2861,9 +2862,9 @@
+ nosmt=force: Force disable SMT, cannot be undone
+ via the sysfs control file.
+
+- nospectre_v1 [PPC] Disable mitigations for Spectre Variant 1 (bounds
+- check bypass). With this option data leaks are possible
+- in the system.
++ nospectre_v1 [X66, PPC] Disable mitigations for Spectre Variant 1
++ (bounds check bypass). With this option data leaks
++ are possible in the system.
+
+ nospectre_v2 [X86,PPC_FSL_BOOK3E] Disable all mitigations for the Spectre variant 2
+ (indirect branch prediction) vulnerability. System may
+diff --git a/Makefile b/Makefile
+index 203d9e80a315..41a565770431 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 64
++SUBLEVEL = 65
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -430,6 +430,7 @@ KBUILD_CFLAGS_MODULE := -DMODULE
+ KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds
+ KBUILD_LDFLAGS :=
+ GCC_PLUGINS_CFLAGS :=
++CLANG_FLAGS :=
+
+ export ARCH SRCARCH CONFIG_SHELL HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE AS LD CC
+ export CPP AR NM STRIP OBJCOPY OBJDUMP KBUILD_HOSTLDFLAGS KBUILD_HOSTLDLIBS
+@@ -482,7 +483,7 @@ endif
+
+ ifeq ($(cc-name),clang)
+ ifneq ($(CROSS_COMPILE),)
+-CLANG_FLAGS := --target=$(notdir $(CROSS_COMPILE:%-=%))
++CLANG_FLAGS += --target=$(notdir $(CROSS_COMPILE:%-=%))
+ GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit))
+ CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)
+ GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..)
+diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
+index 74953e76a57d..0cce54182cc5 100644
+--- a/arch/arc/Kconfig
++++ b/arch/arc/Kconfig
+@@ -199,7 +199,6 @@ config NR_CPUS
+
+ config ARC_SMP_HALT_ON_RESET
+ bool "Enable Halt-on-reset boot mode"
+- default y if ARC_UBOOT_SUPPORT
+ help
+ In SMP configuration cores can be configured as Halt-on-reset
+ or they could all start at same time. For Halt-on-reset, non
+@@ -539,18 +538,6 @@ config ARC_DBG_TLB_PARANOIA
+
+ endif
+
+-config ARC_UBOOT_SUPPORT
+- bool "Support uboot arg Handling"
+- default n
+- help
+- ARC Linux by default checks for uboot provided args as pointers to
+- external cmdline or DTB. This however breaks in absence of uboot,
+- when booting from Metaware debugger directly, as the registers are
+- not zeroed out on reset by mdb and/or ARCv2 based cores. The bogus
+- registers look like uboot args to kernel which then chokes.
+- So only enable the uboot arg checking/processing if users are sure
+- of uboot being in play.
+-
+ config ARC_BUILTIN_DTB_NAME
+ string "Built in DTB"
+ help
+diff --git a/arch/arc/configs/nps_defconfig b/arch/arc/configs/nps_defconfig
+index 6e84060e7c90..621f59407d76 100644
+--- a/arch/arc/configs/nps_defconfig
++++ b/arch/arc/configs/nps_defconfig
+@@ -31,7 +31,6 @@ CONFIG_ARC_CACHE_LINE_SHIFT=5
+ # CONFIG_ARC_HAS_LLSC is not set
+ CONFIG_ARC_KVADDR_SIZE=402
+ CONFIG_ARC_EMUL_UNALIGNED=y
+-CONFIG_ARC_UBOOT_SUPPORT=y
+ CONFIG_PREEMPT=y
+ CONFIG_NET=y
+ CONFIG_UNIX=y
+diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
+index 1e59a2e9c602..e447ace6fa1c 100644
+--- a/arch/arc/configs/vdk_hs38_defconfig
++++ b/arch/arc/configs/vdk_hs38_defconfig
+@@ -13,7 +13,6 @@ CONFIG_PARTITION_ADVANCED=y
+ CONFIG_ARC_PLAT_AXS10X=y
+ CONFIG_AXS103=y
+ CONFIG_ISA_ARCV2=y
+-CONFIG_ARC_UBOOT_SUPPORT=y
+ CONFIG_ARC_BUILTIN_DTB_NAME="vdk_hs38"
+ CONFIG_PREEMPT=y
+ CONFIG_NET=y
+diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
+index b5c3f6c54b03..c82cdb10aaf4 100644
+--- a/arch/arc/configs/vdk_hs38_smp_defconfig
++++ b/arch/arc/configs/vdk_hs38_smp_defconfig
+@@ -15,8 +15,6 @@ CONFIG_AXS103=y
+ CONFIG_ISA_ARCV2=y
+ CONFIG_SMP=y
+ # CONFIG_ARC_TIMERS_64BIT is not set
+-# CONFIG_ARC_SMP_HALT_ON_RESET is not set
+-CONFIG_ARC_UBOOT_SUPPORT=y
+ CONFIG_ARC_BUILTIN_DTB_NAME="vdk_hs38_smp"
+ CONFIG_PREEMPT=y
+ CONFIG_NET=y
+diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
+index 208bf2c9e7b0..a72bbda2f7aa 100644
+--- a/arch/arc/kernel/head.S
++++ b/arch/arc/kernel/head.S
+@@ -100,7 +100,6 @@ ENTRY(stext)
+ st.ab 0, [r5, 4]
+ 1:
+
+-#ifdef CONFIG_ARC_UBOOT_SUPPORT
+ ; Uboot - kernel ABI
+ ; r0 = [0] No uboot interaction, [1] cmdline in r2, [2] DTB in r2
+ ; r1 = magic number (always zero as of now)
+@@ -109,7 +108,6 @@ ENTRY(stext)
+ st r0, [@uboot_tag]
+ st r1, [@uboot_magic]
+ st r2, [@uboot_arg]
+-#endif
+
+ ; setup "current" tsk and optionally cache it in dedicated r25
+ mov r9, @init_task
+diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
+index a1218937abd6..89c97dcfa360 100644
+--- a/arch/arc/kernel/setup.c
++++ b/arch/arc/kernel/setup.c
+@@ -493,7 +493,6 @@ void __init handle_uboot_args(void)
+ bool use_embedded_dtb = true;
+ bool append_cmdline = false;
+
+-#ifdef CONFIG_ARC_UBOOT_SUPPORT
+ /* check that we know this tag */
+ if (uboot_tag != UBOOT_TAG_NONE &&
+ uboot_tag != UBOOT_TAG_CMDLINE &&
+@@ -525,7 +524,6 @@ void __init handle_uboot_args(void)
+ append_cmdline = true;
+
+ ignore_uboot_args:
+-#endif
+
+ if (use_embedded_dtb) {
+ machine_desc = setup_machine_fdt(__dtb_start);
+diff --git a/arch/arm/boot/dts/rk3288-veyron-mickey.dts b/arch/arm/boot/dts/rk3288-veyron-mickey.dts
+index 1e0158acf895..a593d0a998fc 100644
+--- a/arch/arm/boot/dts/rk3288-veyron-mickey.dts
++++ b/arch/arm/boot/dts/rk3288-veyron-mickey.dts
+@@ -124,10 +124,6 @@
+ };
+ };
+
+-&emmc {
+- /delete-property/mmc-hs200-1_8v;
+-};
+-
+ &i2c2 {
+ status = "disabled";
+ };
+diff --git a/arch/arm/boot/dts/rk3288-veyron-minnie.dts b/arch/arm/boot/dts/rk3288-veyron-minnie.dts
+index f95d0c5fcf71..6e8946052c78 100644
+--- a/arch/arm/boot/dts/rk3288-veyron-minnie.dts
++++ b/arch/arm/boot/dts/rk3288-veyron-minnie.dts
+@@ -90,10 +90,6 @@
+ pwm-off-delay-ms = <200>;
+ };
+
+-&emmc {
+- /delete-property/mmc-hs200-1_8v;
+-};
+-
+ &gpio_keys {
+ pinctrl-0 = <&pwr_key_l &ap_lid_int_l &volum_down_l &volum_up_l>;
+
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
+index c706adf4aed2..440d6783faca 100644
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -227,6 +227,7 @@
+ <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>,
+ <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+ clock-frequency = <24000000>;
++ arm,no-tick-in-suspend;
+ };
+
+ timer: timer@ff810000 {
+diff --git a/arch/arm/mach-rpc/dma.c b/arch/arm/mach-rpc/dma.c
+index fb48f3141fb4..c4c96661eb89 100644
+--- a/arch/arm/mach-rpc/dma.c
++++ b/arch/arm/mach-rpc/dma.c
+@@ -131,7 +131,7 @@ static irqreturn_t iomd_dma_handle(int irq, void *dev_id)
+ } while (1);
+
+ idma->state = ~DMA_ST_AB;
+- disable_irq(irq);
++ disable_irq_nosync(irq);
+
+ return IRQ_HANDLED;
+ }
+@@ -174,6 +174,9 @@ static void iomd_enable_dma(unsigned int chan, dma_t *dma)
+ DMA_FROM_DEVICE : DMA_TO_DEVICE);
+ }
+
++ idma->dma_addr = idma->dma.sg->dma_address;
++ idma->dma_len = idma->dma.sg->length;
++
+ iomd_writeb(DMA_CR_C, dma_base + CR);
+ idma->state = DMA_ST_AB;
+ }
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index df7e62d9a670..cea44a7c7cf9 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -1643,11 +1643,11 @@
+ reg = <0x0 0xff914000 0x0 0x100>, <0x0 0xff915000 0x0 0x100>;
+ interrupts = <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH 0>;
+ interrupt-names = "isp0_mmu";
+- clocks = <&cru ACLK_ISP0_NOC>, <&cru HCLK_ISP0_NOC>;
++ clocks = <&cru ACLK_ISP0_WRAPPER>, <&cru HCLK_ISP0_WRAPPER>;
+ clock-names = "aclk", "iface";
+ #iommu-cells = <0>;
++ power-domains = <&power RK3399_PD_ISP0>;
+ rockchip,disable-mmu-reset;
+- status = "disabled";
+ };
+
+ isp1_mmu: iommu@ff924000 {
+@@ -1655,11 +1655,11 @@
+ reg = <0x0 0xff924000 0x0 0x100>, <0x0 0xff925000 0x0 0x100>;
+ interrupts = <GIC_SPI 44 IRQ_TYPE_LEVEL_HIGH 0>;
+ interrupt-names = "isp1_mmu";
+- clocks = <&cru ACLK_ISP1_NOC>, <&cru HCLK_ISP1_NOC>;
++ clocks = <&cru ACLK_ISP1_WRAPPER>, <&cru HCLK_ISP1_WRAPPER>;
+ clock-names = "aclk", "iface";
+ #iommu-cells = <0>;
++ power-domains = <&power RK3399_PD_ISP1>;
+ rockchip,disable-mmu-reset;
+- status = "disabled";
+ };
+
+ hdmi_sound: hdmi-sound {
+diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
+index 1717ba1db35d..510f687d269a 100644
+--- a/arch/arm64/include/asm/cpufeature.h
++++ b/arch/arm64/include/asm/cpufeature.h
+@@ -45,9 +45,10 @@
+ */
+
+ enum ftr_type {
+- FTR_EXACT, /* Use a predefined safe value */
+- FTR_LOWER_SAFE, /* Smaller value is safe */
+- FTR_HIGHER_SAFE,/* Bigger value is safe */
++ FTR_EXACT, /* Use a predefined safe value */
++ FTR_LOWER_SAFE, /* Smaller value is safe */
++ FTR_HIGHER_SAFE, /* Bigger value is safe */
++ FTR_HIGHER_OR_ZERO_SAFE, /* Bigger value is safe, but 0 is biggest */
+ };
+
+ #define FTR_STRICT true /* SANITY check strict matching required */
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index 93f69d82225d..bce06083685d 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -206,8 +206,8 @@ static const struct arm64_ftr_bits ftr_ctr[] = {
+ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_EXACT, 31, 1, 1), /* RES1 */
+ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, CTR_DIC_SHIFT, 1, 1),
+ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, CTR_IDC_SHIFT, 1, 1),
+- ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, CTR_CWG_SHIFT, 4, 0),
+- ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, CTR_ERG_SHIFT, 4, 0),
++ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_OR_ZERO_SAFE, CTR_CWG_SHIFT, 4, 0),
++ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_OR_ZERO_SAFE, CTR_ERG_SHIFT, 4, 0),
+ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, CTR_DMINLINE_SHIFT, 4, 1),
+ /*
+ * Linux can handle differing I-cache policies. Userspace JITs will
+@@ -449,6 +449,10 @@ static s64 arm64_ftr_safe_value(const struct arm64_ftr_bits *ftrp, s64 new,
+ case FTR_LOWER_SAFE:
+ ret = new < cur ? new : cur;
+ break;
++ case FTR_HIGHER_OR_ZERO_SAFE:
++ if (!cur || !new)
++ break;
++ /* Fallthrough */
+ case FTR_HIGHER_SAFE:
+ ret = new > cur ? new : cur;
+ break;
+diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
+index 8c9644376326..7c0611f5d2ce 100644
+--- a/arch/arm64/kernel/hw_breakpoint.c
++++ b/arch/arm64/kernel/hw_breakpoint.c
+@@ -547,13 +547,14 @@ int hw_breakpoint_arch_parse(struct perf_event *bp,
+ /* Aligned */
+ break;
+ case 1:
+- /* Allow single byte watchpoint. */
+- if (hw->ctrl.len == ARM_BREAKPOINT_LEN_1)
+- break;
+ case 2:
+ /* Allow halfword watchpoints and breakpoints. */
+ if (hw->ctrl.len == ARM_BREAKPOINT_LEN_2)
+ break;
++ case 3:
++ /* Allow single byte watchpoint. */
++ if (hw->ctrl.len == ARM_BREAKPOINT_LEN_1)
++ break;
+ default:
+ return -EINVAL;
+ }
+diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
+index c4ef1c31e0c4..37caeadb2964 100644
+--- a/arch/mips/lantiq/irq.c
++++ b/arch/mips/lantiq/irq.c
+@@ -156,8 +156,9 @@ static int ltq_eiu_settype(struct irq_data *d, unsigned int type)
+ if (edge)
+ irq_set_handler(d->hwirq, handle_edge_irq);
+
+- ltq_eiu_w32(ltq_eiu_r32(LTQ_EIU_EXIN_C) |
+- (val << (i * 4)), LTQ_EIU_EXIN_C);
++ ltq_eiu_w32((ltq_eiu_r32(LTQ_EIU_EXIN_C) &
++ (~(7 << (i * 4)))) | (val << (i * 4)),
++ LTQ_EIU_EXIN_C);
+ }
+ }
+
+diff --git a/arch/parisc/boot/compressed/vmlinux.lds.S b/arch/parisc/boot/compressed/vmlinux.lds.S
+index 4ebd4e65524c..41ebe97fad10 100644
+--- a/arch/parisc/boot/compressed/vmlinux.lds.S
++++ b/arch/parisc/boot/compressed/vmlinux.lds.S
+@@ -42,8 +42,8 @@ SECTIONS
+ #endif
+ _startcode_end = .;
+
+- /* bootloader code and data starts behind area of extracted kernel */
+- . = (SZ_end - SZparisc_kernel_start + KERNEL_BINARY_TEXT_START);
++ /* bootloader code and data starts at least behind area of extracted kernel */
++ . = MAX(ABSOLUTE(.), (SZ_end - SZparisc_kernel_start + KERNEL_BINARY_TEXT_START));
+
+ /* align on next page boundary */
+ . = ALIGN(4096);
+diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
+index 8dd1d5ccae58..0387d7a96c84 100644
+--- a/arch/x86/boot/compressed/misc.c
++++ b/arch/x86/boot/compressed/misc.c
+@@ -17,6 +17,7 @@
+ #include "pgtable.h"
+ #include "../string.h"
+ #include "../voffset.h"
++#include <asm/bootparam_utils.h>
+
+ /*
+ * WARNING!!
+diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
+index a423bdb42686..47fd18db6b3b 100644
+--- a/arch/x86/boot/compressed/misc.h
++++ b/arch/x86/boot/compressed/misc.h
+@@ -22,7 +22,6 @@
+ #include <asm/page.h>
+ #include <asm/boot.h>
+ #include <asm/bootparam.h>
+-#include <asm/bootparam_utils.h>
+
+ #define BOOT_BOOT_H
+ #include "../ctype.h"
+diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
+index e699b2041665..578b5455334f 100644
+--- a/arch/x86/entry/calling.h
++++ b/arch/x86/entry/calling.h
+@@ -329,6 +329,23 @@ For 32-bit we have the following conventions - kernel is built with
+
+ #endif
+
++/*
++ * Mitigate Spectre v1 for conditional swapgs code paths.
++ *
++ * FENCE_SWAPGS_USER_ENTRY is used in the user entry swapgs code path, to
++ * prevent a speculative swapgs when coming from kernel space.
++ *
++ * FENCE_SWAPGS_KERNEL_ENTRY is used in the kernel entry non-swapgs code path,
++ * to prevent the swapgs from getting speculatively skipped when coming from
++ * user space.
++ */
++.macro FENCE_SWAPGS_USER_ENTRY
++ ALTERNATIVE "", "lfence", X86_FEATURE_FENCE_SWAPGS_USER
++.endm
++.macro FENCE_SWAPGS_KERNEL_ENTRY
++ ALTERNATIVE "", "lfence", X86_FEATURE_FENCE_SWAPGS_KERNEL
++.endm
++
+ #endif /* CONFIG_X86_64 */
+
+ /*
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index 206df099950e..ccb5e3486aee 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -582,7 +582,7 @@ ENTRY(interrupt_entry)
+ testb $3, CS-ORIG_RAX+8(%rsp)
+ jz 1f
+ SWAPGS
+-
++ FENCE_SWAPGS_USER_ENTRY
+ /*
+ * Switch to the thread stack. The IRET frame and orig_ax are
+ * on the stack, as well as the return address. RDI..R12 are
+@@ -612,8 +612,10 @@ ENTRY(interrupt_entry)
+ UNWIND_HINT_FUNC
+
+ movq (%rdi), %rdi
++ jmp 2f
+ 1:
+-
++ FENCE_SWAPGS_KERNEL_ENTRY
++2:
+ PUSH_AND_CLEAR_REGS save_ret=1
+ ENCODE_FRAME_POINTER 8
+
+@@ -1196,7 +1198,6 @@ idtentry stack_segment do_stack_segment has_error_code=1
+ #ifdef CONFIG_XEN
+ idtentry xennmi do_nmi has_error_code=0
+ idtentry xendebug do_debug has_error_code=0
+-idtentry xenint3 do_int3 has_error_code=0
+ #endif
+
+ idtentry general_protection do_general_protection has_error_code=1
+@@ -1241,6 +1242,13 @@ ENTRY(paranoid_entry)
+ */
+ SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg=%rax save_reg=%r14
+
++ /*
++ * The above SAVE_AND_SWITCH_TO_KERNEL_CR3 macro doesn't do an
++ * unconditional CR3 write, even in the PTI case. So do an lfence
++ * to prevent GS speculation, regardless of whether PTI is enabled.
++ */
++ FENCE_SWAPGS_KERNEL_ENTRY
++
+ ret
+ END(paranoid_entry)
+
+@@ -1291,6 +1299,7 @@ ENTRY(error_entry)
+ * from user mode due to an IRET fault.
+ */
+ SWAPGS
++ FENCE_SWAPGS_USER_ENTRY
+ /* We have user CR3. Change to kernel CR3. */
+ SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
+
+@@ -1312,6 +1321,8 @@ ENTRY(error_entry)
+ CALL_enter_from_user_mode
+ ret
+
++.Lerror_entry_done_lfence:
++ FENCE_SWAPGS_KERNEL_ENTRY
+ .Lerror_entry_done:
+ TRACE_IRQS_OFF
+ ret
+@@ -1330,7 +1341,7 @@ ENTRY(error_entry)
+ cmpq %rax, RIP+8(%rsp)
+ je .Lbstep_iret
+ cmpq $.Lgs_change, RIP+8(%rsp)
+- jne .Lerror_entry_done
++ jne .Lerror_entry_done_lfence
+
+ /*
+ * hack: .Lgs_change can fail with user gsbase. If this happens, fix up
+@@ -1338,6 +1349,7 @@ ENTRY(error_entry)
+ * .Lgs_change's error handler with kernel gsbase.
+ */
+ SWAPGS
++ FENCE_SWAPGS_USER_ENTRY
+ SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
+ jmp .Lerror_entry_done
+
+@@ -1352,6 +1364,7 @@ ENTRY(error_entry)
+ * gsbase and CR3. Switch to kernel gsbase and CR3:
+ */
+ SWAPGS
++ FENCE_SWAPGS_USER_ENTRY
+ SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
+
+ /*
+@@ -1443,6 +1456,7 @@ ENTRY(nmi)
+
+ swapgs
+ cld
++ FENCE_SWAPGS_USER_ENTRY
+ SWITCH_TO_KERNEL_CR3 scratch_reg=%rdx
+ movq %rsp, %rdx
+ movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+diff --git a/arch/x86/entry/vdso/vclock_gettime.c b/arch/x86/entry/vdso/vclock_gettime.c
+index e48ca3afa091..8a88e738f87d 100644
+--- a/arch/x86/entry/vdso/vclock_gettime.c
++++ b/arch/x86/entry/vdso/vclock_gettime.c
+@@ -29,12 +29,12 @@ extern int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz);
+ extern time_t __vdso_time(time_t *t);
+
+ #ifdef CONFIG_PARAVIRT_CLOCK
+-extern u8 pvclock_page
++extern u8 pvclock_page[PAGE_SIZE]
+ __attribute__((visibility("hidden")));
+ #endif
+
+ #ifdef CONFIG_HYPERV_TSCPAGE
+-extern u8 hvclock_page
++extern u8 hvclock_page[PAGE_SIZE]
+ __attribute__((visibility("hidden")));
+ #endif
+
+@@ -191,13 +191,24 @@ notrace static inline u64 vgetsns(int *mode)
+
+ if (gtod->vclock_mode == VCLOCK_TSC)
+ cycles = vread_tsc();
++
++ /*
++ * For any memory-mapped vclock type, we need to make sure that gcc
++ * doesn't cleverly hoist a load before the mode check. Otherwise we
++ * might end up touching the memory-mapped page even if the vclock in
++ * question isn't enabled, which will segfault. Hence the barriers.
++ */
+ #ifdef CONFIG_PARAVIRT_CLOCK
+- else if (gtod->vclock_mode == VCLOCK_PVCLOCK)
++ else if (gtod->vclock_mode == VCLOCK_PVCLOCK) {
++ barrier();
+ cycles = vread_pvclock(mode);
++ }
+ #endif
+ #ifdef CONFIG_HYPERV_TSCPAGE
+- else if (gtod->vclock_mode == VCLOCK_HVCLOCK)
++ else if (gtod->vclock_mode == VCLOCK_HVCLOCK) {
++ barrier();
+ cycles = vread_hvclock(mode);
++ }
+ #endif
+ else
+ return 0;
+diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
+index 130e81e10fc7..050368db9d35 100644
+--- a/arch/x86/include/asm/apic.h
++++ b/arch/x86/include/asm/apic.h
+@@ -48,7 +48,7 @@ static inline void generic_apic_probe(void)
+
+ #ifdef CONFIG_X86_LOCAL_APIC
+
+-extern unsigned int apic_verbosity;
++extern int apic_verbosity;
+ extern int local_apic_timer_c2_ok;
+
+ extern int disable_apic;
+diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
+index ce95b8cbd229..68889ace9c4c 100644
+--- a/arch/x86/include/asm/cpufeature.h
++++ b/arch/x86/include/asm/cpufeature.h
+@@ -22,8 +22,8 @@ enum cpuid_leafs
+ CPUID_LNX_3,
+ CPUID_7_0_EBX,
+ CPUID_D_1_EAX,
+- CPUID_F_0_EDX,
+- CPUID_F_1_EDX,
++ CPUID_LNX_4,
++ CPUID_DUMMY,
+ CPUID_8000_0008_EBX,
+ CPUID_6_EAX,
+ CPUID_8000_000A_EDX,
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 0cf704933f23..759f0a176612 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -271,13 +271,18 @@
+ #define X86_FEATURE_XGETBV1 (10*32+ 2) /* XGETBV with ECX = 1 instruction */
+ #define X86_FEATURE_XSAVES (10*32+ 3) /* XSAVES/XRSTORS instructions */
+
+-/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:0 (EDX), word 11 */
+-#define X86_FEATURE_CQM_LLC (11*32+ 1) /* LLC QoS if 1 */
+-
+-/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:1 (EDX), word 12 */
+-#define X86_FEATURE_CQM_OCCUP_LLC (12*32+ 0) /* LLC occupancy monitoring */
+-#define X86_FEATURE_CQM_MBM_TOTAL (12*32+ 1) /* LLC Total MBM monitoring */
+-#define X86_FEATURE_CQM_MBM_LOCAL (12*32+ 2) /* LLC Local MBM monitoring */
++/*
++ * Extended auxiliary flags: Linux defined - for features scattered in various
++ * CPUID levels like 0xf, etc.
++ *
++ * Reuse free bits when adding new feature flags!
++ */
++#define X86_FEATURE_CQM_LLC (11*32+ 0) /* LLC QoS if 1 */
++#define X86_FEATURE_CQM_OCCUP_LLC (11*32+ 1) /* LLC occupancy monitoring */
++#define X86_FEATURE_CQM_MBM_TOTAL (11*32+ 2) /* LLC Total MBM monitoring */
++#define X86_FEATURE_CQM_MBM_LOCAL (11*32+ 3) /* LLC Local MBM monitoring */
++#define X86_FEATURE_FENCE_SWAPGS_USER (11*32+ 4) /* "" LFENCE in user entry SWAPGS path */
++#define X86_FEATURE_FENCE_SWAPGS_KERNEL (11*32+ 5) /* "" LFENCE in kernel entry SWAPGS path */
+
+ /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */
+ #define X86_FEATURE_CLZERO (13*32+ 0) /* CLZERO instruction */
+@@ -383,5 +388,6 @@
+ #define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */
+ #define X86_BUG_MDS X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */
+ #define X86_BUG_MSBDS_ONLY X86_BUG(20) /* CPU is only affected by the MSDBS variant of BUG_MDS */
++#define X86_BUG_SWAPGS X86_BUG(21) /* CPU is affected by speculation through SWAPGS */
+
+ #endif /* _ASM_X86_CPUFEATURES_H */
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 7014dba23d20..2877e1fbadd8 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1427,25 +1427,29 @@ enum {
+ #define kvm_arch_vcpu_memslots_id(vcpu) ((vcpu)->arch.hflags & HF_SMM_MASK ? 1 : 0)
+ #define kvm_memslots_for_spte_role(kvm, role) __kvm_memslots(kvm, (role).smm)
+
++asmlinkage void __noreturn kvm_spurious_fault(void);
++
+ /*
+ * Hardware virtualization extension instructions may fault if a
+ * reboot turns off virtualization while processes are running.
+- * Trap the fault and ignore the instruction if that happens.
++ * Usually after catching the fault we just panic; during reboot
++ * instead the instruction is ignored.
+ */
+-asmlinkage void kvm_spurious_fault(void);
+-
+-#define ____kvm_handle_fault_on_reboot(insn, cleanup_insn) \
+- "666: " insn "\n\t" \
+- "668: \n\t" \
+- ".pushsection .fixup, \"ax\" \n" \
+- "667: \n\t" \
+- cleanup_insn "\n\t" \
+- "cmpb $0, kvm_rebooting \n\t" \
+- "jne 668b \n\t" \
+- __ASM_SIZE(push) " $666b \n\t" \
+- "jmp kvm_spurious_fault \n\t" \
+- ".popsection \n\t" \
+- _ASM_EXTABLE(666b, 667b)
++#define ____kvm_handle_fault_on_reboot(insn, cleanup_insn) \
++ "666: \n\t" \
++ insn "\n\t" \
++ "jmp 668f \n\t" \
++ "667: \n\t" \
++ "call kvm_spurious_fault \n\t" \
++ "668: \n\t" \
++ ".pushsection .fixup, \"ax\" \n\t" \
++ "700: \n\t" \
++ cleanup_insn "\n\t" \
++ "cmpb $0, kvm_rebooting\n\t" \
++ "je 667b \n\t" \
++ "jmp 668b \n\t" \
++ ".popsection \n\t" \
++ _ASM_EXTABLE(666b, 700b)
+
+ #define __kvm_handle_fault_on_reboot(insn) \
+ ____kvm_handle_fault_on_reboot(insn, "")
+diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
+index e375d4266b53..a04677038872 100644
+--- a/arch/x86/include/asm/paravirt.h
++++ b/arch/x86/include/asm/paravirt.h
+@@ -768,6 +768,7 @@ static __always_inline bool pv_vcpu_is_preempted(long cpu)
+ PV_RESTORE_ALL_CALLER_REGS \
+ FRAME_END \
+ "ret;" \
++ ".size " PV_THUNK_NAME(func) ", .-" PV_THUNK_NAME(func) ";" \
+ ".popsection")
+
+ /* Get a reference to a callee-save function */
+diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
+index afbc87206886..b771bb3d159b 100644
+--- a/arch/x86/include/asm/traps.h
++++ b/arch/x86/include/asm/traps.h
+@@ -40,7 +40,7 @@ asmlinkage void simd_coprocessor_error(void);
+ asmlinkage void xen_divide_error(void);
+ asmlinkage void xen_xennmi(void);
+ asmlinkage void xen_xendebug(void);
+-asmlinkage void xen_xenint3(void);
++asmlinkage void xen_int3(void);
+ asmlinkage void xen_overflow(void);
+ asmlinkage void xen_bounds(void);
+ asmlinkage void xen_invalid_op(void);
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 02020f2e0080..272a12865b2a 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -181,7 +181,7 @@ EXPORT_SYMBOL_GPL(local_apic_timer_c2_ok);
+ /*
+ * Debug level, exported for io_apic.c
+ */
+-unsigned int apic_verbosity;
++int apic_verbosity;
+
+ int pic_mode;
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index c5690440fbd4..ee7d17611ead 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -32,6 +32,7 @@
+ #include <asm/e820/api.h>
+ #include <asm/hypervisor.h>
+
++static void __init spectre_v1_select_mitigation(void);
+ static void __init spectre_v2_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
+@@ -96,17 +97,11 @@ void __init check_bugs(void)
+ if (boot_cpu_has(X86_FEATURE_STIBP))
+ x86_spec_ctrl_mask |= SPEC_CTRL_STIBP;
+
+- /* Select the proper spectre mitigation before patching alternatives */
++ /* Select the proper CPU mitigations before patching alternatives: */
++ spectre_v1_select_mitigation();
+ spectre_v2_select_mitigation();
+-
+- /*
+- * Select proper mitigation for any exposure to the Speculative Store
+- * Bypass vulnerability.
+- */
+ ssb_select_mitigation();
+-
+ l1tf_select_mitigation();
+-
+ mds_select_mitigation();
+
+ arch_smt_update();
+@@ -271,6 +266,98 @@ static int __init mds_cmdline(char *str)
+ }
+ early_param("mds", mds_cmdline);
+
++#undef pr_fmt
++#define pr_fmt(fmt) "Spectre V1 : " fmt
++
++enum spectre_v1_mitigation {
++ SPECTRE_V1_MITIGATION_NONE,
++ SPECTRE_V1_MITIGATION_AUTO,
++};
++
++static enum spectre_v1_mitigation spectre_v1_mitigation __ro_after_init =
++ SPECTRE_V1_MITIGATION_AUTO;
++
++static const char * const spectre_v1_strings[] = {
++ [SPECTRE_V1_MITIGATION_NONE] = "Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers",
++ [SPECTRE_V1_MITIGATION_AUTO] = "Mitigation: usercopy/swapgs barriers and __user pointer sanitization",
++};
++
++/*
++ * Does SMAP provide full mitigation against speculative kernel access to
++ * userspace?
++ */
++static bool smap_works_speculatively(void)
++{
++ if (!boot_cpu_has(X86_FEATURE_SMAP))
++ return false;
++
++ /*
++ * On CPUs which are vulnerable to Meltdown, SMAP does not
++ * prevent speculative access to user data in the L1 cache.
++ * Consider SMAP to be non-functional as a mitigation on these
++ * CPUs.
++ */
++ if (boot_cpu_has(X86_BUG_CPU_MELTDOWN))
++ return false;
++
++ return true;
++}
++
++static void __init spectre_v1_select_mitigation(void)
++{
++ if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1) || cpu_mitigations_off()) {
++ spectre_v1_mitigation = SPECTRE_V1_MITIGATION_NONE;
++ return;
++ }
++
++ if (spectre_v1_mitigation == SPECTRE_V1_MITIGATION_AUTO) {
++ /*
++ * With Spectre v1, a user can speculatively control either
++ * path of a conditional swapgs with a user-controlled GS
++ * value. The mitigation is to add lfences to both code paths.
++ *
++ * If FSGSBASE is enabled, the user can put a kernel address in
++ * GS, in which case SMAP provides no protection.
++ *
++ * [ NOTE: Don't check for X86_FEATURE_FSGSBASE until the
++ * FSGSBASE enablement patches have been merged. ]
++ *
++ * If FSGSBASE is disabled, the user can only put a user space
++ * address in GS. That makes an attack harder, but still
++ * possible if there's no SMAP protection.
++ */
++ if (!smap_works_speculatively()) {
++ /*
++ * Mitigation can be provided from SWAPGS itself or
++ * PTI as the CR3 write in the Meltdown mitigation
++ * is serializing.
++ *
++ * If neither is there, mitigate with an LFENCE to
++ * stop speculation through swapgs.
++ */
++ if (boot_cpu_has_bug(X86_BUG_SWAPGS) &&
++ !boot_cpu_has(X86_FEATURE_PTI))
++ setup_force_cpu_cap(X86_FEATURE_FENCE_SWAPGS_USER);
++
++ /*
++ * Enable lfences in the kernel entry (non-swapgs)
++ * paths, to prevent user entry from speculatively
++ * skipping swapgs.
++ */
++ setup_force_cpu_cap(X86_FEATURE_FENCE_SWAPGS_KERNEL);
++ }
++ }
++
++ pr_info("%s\n", spectre_v1_strings[spectre_v1_mitigation]);
++}
++
++static int __init nospectre_v1_cmdline(char *str)
++{
++ spectre_v1_mitigation = SPECTRE_V1_MITIGATION_NONE;
++ return 0;
++}
++early_param("nospectre_v1", nospectre_v1_cmdline);
++
+ #undef pr_fmt
+ #define pr_fmt(fmt) "Spectre V2 : " fmt
+
+@@ -1258,7 +1345,7 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ break;
+
+ case X86_BUG_SPECTRE_V1:
+- return sprintf(buf, "Mitigation: __user pointer sanitization\n");
++ return sprintf(buf, "%s\n", spectre_v1_strings[spectre_v1_mitigation]);
+
+ case X86_BUG_SPECTRE_V2:
+ return sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 1073118b9bf0..b33fdfa0ff49 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -808,6 +808,30 @@ static void init_speculation_control(struct cpuinfo_x86 *c)
+ }
+ }
+
++static void init_cqm(struct cpuinfo_x86 *c)
++{
++ if (!cpu_has(c, X86_FEATURE_CQM_LLC)) {
++ c->x86_cache_max_rmid = -1;
++ c->x86_cache_occ_scale = -1;
++ return;
++ }
++
++ /* will be overridden if occupancy monitoring exists */
++ c->x86_cache_max_rmid = cpuid_ebx(0xf);
++
++ if (cpu_has(c, X86_FEATURE_CQM_OCCUP_LLC) ||
++ cpu_has(c, X86_FEATURE_CQM_MBM_TOTAL) ||
++ cpu_has(c, X86_FEATURE_CQM_MBM_LOCAL)) {
++ u32 eax, ebx, ecx, edx;
++
++ /* QoS sub-leaf, EAX=0Fh, ECX=1 */
++ cpuid_count(0xf, 1, &eax, &ebx, &ecx, &edx);
++
++ c->x86_cache_max_rmid = ecx;
++ c->x86_cache_occ_scale = ebx;
++ }
++}
++
+ void get_cpu_cap(struct cpuinfo_x86 *c)
+ {
+ u32 eax, ebx, ecx, edx;
+@@ -839,33 +863,6 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
+ c->x86_capability[CPUID_D_1_EAX] = eax;
+ }
+
+- /* Additional Intel-defined flags: level 0x0000000F */
+- if (c->cpuid_level >= 0x0000000F) {
+-
+- /* QoS sub-leaf, EAX=0Fh, ECX=0 */
+- cpuid_count(0x0000000F, 0, &eax, &ebx, &ecx, &edx);
+- c->x86_capability[CPUID_F_0_EDX] = edx;
+-
+- if (cpu_has(c, X86_FEATURE_CQM_LLC)) {
+- /* will be overridden if occupancy monitoring exists */
+- c->x86_cache_max_rmid = ebx;
+-
+- /* QoS sub-leaf, EAX=0Fh, ECX=1 */
+- cpuid_count(0x0000000F, 1, &eax, &ebx, &ecx, &edx);
+- c->x86_capability[CPUID_F_1_EDX] = edx;
+-
+- if ((cpu_has(c, X86_FEATURE_CQM_OCCUP_LLC)) ||
+- ((cpu_has(c, X86_FEATURE_CQM_MBM_TOTAL)) ||
+- (cpu_has(c, X86_FEATURE_CQM_MBM_LOCAL)))) {
+- c->x86_cache_max_rmid = ecx;
+- c->x86_cache_occ_scale = ebx;
+- }
+- } else {
+- c->x86_cache_max_rmid = -1;
+- c->x86_cache_occ_scale = -1;
+- }
+- }
+-
+ /* AMD-defined flags: level 0x80000001 */
+ eax = cpuid_eax(0x80000000);
+ c->extended_cpuid_level = eax;
+@@ -896,6 +893,7 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
+
+ init_scattered_cpuid_features(c);
+ init_speculation_control(c);
++ init_cqm(c);
+
+ /*
+ * Clear/Set all flags overridden by options, after probe.
+@@ -954,6 +952,7 @@ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
+ #define NO_L1TF BIT(3)
+ #define NO_MDS BIT(4)
+ #define MSBDS_ONLY BIT(5)
++#define NO_SWAPGS BIT(6)
+
+ #define VULNWL(_vendor, _family, _model, _whitelist) \
+ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist }
+@@ -977,29 +976,37 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+ VULNWL_INTEL(ATOM_BONNELL, NO_SPECULATION),
+ VULNWL_INTEL(ATOM_BONNELL_MID, NO_SPECULATION),
+
+- VULNWL_INTEL(ATOM_SILVERMONT, NO_SSB | NO_L1TF | MSBDS_ONLY),
+- VULNWL_INTEL(ATOM_SILVERMONT_X, NO_SSB | NO_L1TF | MSBDS_ONLY),
+- VULNWL_INTEL(ATOM_SILVERMONT_MID, NO_SSB | NO_L1TF | MSBDS_ONLY),
+- VULNWL_INTEL(ATOM_AIRMONT, NO_SSB | NO_L1TF | MSBDS_ONLY),
+- VULNWL_INTEL(XEON_PHI_KNL, NO_SSB | NO_L1TF | MSBDS_ONLY),
+- VULNWL_INTEL(XEON_PHI_KNM, NO_SSB | NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(ATOM_SILVERMONT, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
++ VULNWL_INTEL(ATOM_SILVERMONT_X, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
++ VULNWL_INTEL(ATOM_SILVERMONT_MID, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
++ VULNWL_INTEL(ATOM_AIRMONT, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
++ VULNWL_INTEL(XEON_PHI_KNL, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
++ VULNWL_INTEL(XEON_PHI_KNM, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+
+ VULNWL_INTEL(CORE_YONAH, NO_SSB),
+
+- VULNWL_INTEL(ATOM_AIRMONT_MID, NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(ATOM_AIRMONT_MID, NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+
+- VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF),
+- VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF),
+- VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF),
++ VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF | NO_SWAPGS),
++ VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF | NO_SWAPGS),
++ VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS),
++
++ /*
++ * Technically, swapgs isn't serializing on AMD (despite it previously
++ * being documented as such in the APM). But according to AMD, %gs is
++ * updated non-speculatively, and the issuing of %gs-relative memory
++ * operands will be blocked until the %gs update completes, which is
++ * good enough for our purposes.
++ */
+
+ /* AMD Family 0xf - 0x12 */
+- VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
+- VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
+- VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
+- VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
++ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
++ VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
++ VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
++ VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
+
+ /* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */
+- VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS),
++ VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS),
+ {}
+ };
+
+@@ -1036,6 +1043,9 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ setup_force_cpu_bug(X86_BUG_MSBDS_ONLY);
+ }
+
++ if (!cpu_matches(NO_SWAPGS))
++ setup_force_cpu_bug(X86_BUG_SWAPGS);
++
+ if (cpu_matches(NO_MELTDOWN))
+ return;
+
+diff --git a/arch/x86/kernel/cpu/cpuid-deps.c b/arch/x86/kernel/cpu/cpuid-deps.c
+index 2c0bd38a44ab..fa07a224e7b9 100644
+--- a/arch/x86/kernel/cpu/cpuid-deps.c
++++ b/arch/x86/kernel/cpu/cpuid-deps.c
+@@ -59,6 +59,9 @@ static const struct cpuid_dep cpuid_deps[] = {
+ { X86_FEATURE_AVX512_4VNNIW, X86_FEATURE_AVX512F },
+ { X86_FEATURE_AVX512_4FMAPS, X86_FEATURE_AVX512F },
+ { X86_FEATURE_AVX512_VPOPCNTDQ, X86_FEATURE_AVX512F },
++ { X86_FEATURE_CQM_OCCUP_LLC, X86_FEATURE_CQM_LLC },
++ { X86_FEATURE_CQM_MBM_TOTAL, X86_FEATURE_CQM_LLC },
++ { X86_FEATURE_CQM_MBM_LOCAL, X86_FEATURE_CQM_LLC },
+ {}
+ };
+
+diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
+index 772c219b6889..5a52672e3f8b 100644
+--- a/arch/x86/kernel/cpu/scattered.c
++++ b/arch/x86/kernel/cpu/scattered.c
+@@ -21,6 +21,10 @@ struct cpuid_bit {
+ static const struct cpuid_bit cpuid_bits[] = {
+ { X86_FEATURE_APERFMPERF, CPUID_ECX, 0, 0x00000006, 0 },
+ { X86_FEATURE_EPB, CPUID_ECX, 3, 0x00000006, 0 },
++ { X86_FEATURE_CQM_LLC, CPUID_EDX, 1, 0x0000000f, 0 },
++ { X86_FEATURE_CQM_OCCUP_LLC, CPUID_EDX, 0, 0x0000000f, 1 },
++ { X86_FEATURE_CQM_MBM_TOTAL, CPUID_EDX, 1, 0x0000000f, 1 },
++ { X86_FEATURE_CQM_MBM_LOCAL, CPUID_EDX, 2, 0x0000000f, 1 },
+ { X86_FEATURE_CAT_L3, CPUID_EBX, 1, 0x00000010, 0 },
+ { X86_FEATURE_CAT_L2, CPUID_EBX, 2, 0x00000010, 0 },
+ { X86_FEATURE_CDP_L3, CPUID_ECX, 2, 0x00000010, 1 },
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index 7f89d609095a..cee45d46e67d 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -830,6 +830,7 @@ asm(
+ "cmpb $0, " __stringify(KVM_STEAL_TIME_preempted) "+steal_time(%rax);"
+ "setne %al;"
+ "ret;"
++".size __raw_callee_save___kvm_vcpu_is_preempted, .-__raw_callee_save___kvm_vcpu_is_preempted;"
+ ".popsection");
+
+ #endif
+diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
+index 9a327d5b6d1f..d78a61408243 100644
+--- a/arch/x86/kvm/cpuid.h
++++ b/arch/x86/kvm/cpuid.h
+@@ -47,8 +47,6 @@ static const struct cpuid_reg reverse_cpuid[] = {
+ [CPUID_8000_0001_ECX] = {0x80000001, 0, CPUID_ECX},
+ [CPUID_7_0_EBX] = { 7, 0, CPUID_EBX},
+ [CPUID_D_1_EAX] = { 0xd, 1, CPUID_EAX},
+- [CPUID_F_0_EDX] = { 0xf, 0, CPUID_EDX},
+- [CPUID_F_1_EDX] = { 0xf, 1, CPUID_EDX},
+ [CPUID_8000_0008_EBX] = {0x80000008, 0, CPUID_EBX},
+ [CPUID_6_EAX] = { 6, 0, CPUID_EAX},
+ [CPUID_8000_000A_EDX] = {0x8000000a, 0, CPUID_EDX},
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index e0f982e35c96..cdc0c460950f 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -4532,11 +4532,11 @@ static void update_permission_bitmask(struct kvm_vcpu *vcpu,
+ */
+
+ /* Faults from writes to non-writable pages */
+- u8 wf = (pfec & PFERR_WRITE_MASK) ? ~w : 0;
++ u8 wf = (pfec & PFERR_WRITE_MASK) ? (u8)~w : 0;
+ /* Faults from user mode accesses to supervisor pages */
+- u8 uf = (pfec & PFERR_USER_MASK) ? ~u : 0;
++ u8 uf = (pfec & PFERR_USER_MASK) ? (u8)~u : 0;
+ /* Faults from fetches of non-executable pages*/
+- u8 ff = (pfec & PFERR_FETCH_MASK) ? ~x : 0;
++ u8 ff = (pfec & PFERR_FETCH_MASK) ? (u8)~x : 0;
+ /* Faults from kernel mode fetches of user pages */
+ u8 smepf = 0;
+ /* Faults from kernel mode accesses of user pages */
+diff --git a/arch/x86/math-emu/fpu_emu.h b/arch/x86/math-emu/fpu_emu.h
+index a5a41ec58072..0c122226ca56 100644
+--- a/arch/x86/math-emu/fpu_emu.h
++++ b/arch/x86/math-emu/fpu_emu.h
+@@ -177,7 +177,7 @@ static inline void reg_copy(FPU_REG const *x, FPU_REG *y)
+ #define setexponentpos(x,y) { (*(short *)&((x)->exp)) = \
+ ((y) + EXTENDED_Ebias) & 0x7fff; }
+ #define exponent16(x) (*(short *)&((x)->exp))
+-#define setexponent16(x,y) { (*(short *)&((x)->exp)) = (y); }
++#define setexponent16(x,y) { (*(short *)&((x)->exp)) = (u16)(y); }
+ #define addexponent(x,y) { (*(short *)&((x)->exp)) += (y); }
+ #define stdexp(x) { (*(short *)&((x)->exp)) += EXTENDED_Ebias; }
+
+diff --git a/arch/x86/math-emu/reg_constant.c b/arch/x86/math-emu/reg_constant.c
+index 8dc9095bab22..742619e94bdf 100644
+--- a/arch/x86/math-emu/reg_constant.c
++++ b/arch/x86/math-emu/reg_constant.c
+@@ -18,7 +18,7 @@
+ #include "control_w.h"
+
+ #define MAKE_REG(s, e, l, h) { l, h, \
+- ((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) }
++ (u16)((EXTENDED_Ebias+(e)) | ((SIGN_##s != 0)*0x8000)) }
+
+ FPU_REG const CONST_1 = MAKE_REG(POS, 0, 0x00000000, 0x80000000);
+ #if 0
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 782f98b332f0..1730a26ff6ab 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -597,12 +597,12 @@ struct trap_array_entry {
+
+ static struct trap_array_entry trap_array[] = {
+ { debug, xen_xendebug, true },
+- { int3, xen_xenint3, true },
+ { double_fault, xen_double_fault, true },
+ #ifdef CONFIG_X86_MCE
+ { machine_check, xen_machine_check, true },
+ #endif
+ { nmi, xen_xennmi, true },
++ { int3, xen_int3, false },
+ { overflow, xen_overflow, false },
+ #ifdef CONFIG_IA32_EMULATION
+ { entry_INT80_compat, xen_entry_INT80_compat, false },
+diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
+index 417b339e5c8e..3a6feed76dfc 100644
+--- a/arch/x86/xen/xen-asm_64.S
++++ b/arch/x86/xen/xen-asm_64.S
+@@ -30,7 +30,6 @@ xen_pv_trap divide_error
+ xen_pv_trap debug
+ xen_pv_trap xendebug
+ xen_pv_trap int3
+-xen_pv_trap xenint3
+ xen_pv_trap xennmi
+ xen_pv_trap overflow
+ xen_pv_trap bounds
+diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
+index 995c4d8922b1..761f0c19a451 100644
+--- a/drivers/acpi/blacklist.c
++++ b/drivers/acpi/blacklist.c
+@@ -30,7 +30,9 @@
+
+ #include "internal.h"
+
++#ifdef CONFIG_DMI
+ static const struct dmi_system_id acpi_rev_dmi_table[] __initconst;
++#endif
+
+ /*
+ * POLICY: If *anything* doesn't work, put it on the blacklist.
+@@ -74,7 +76,9 @@ int __init acpi_blacklisted(void)
+ }
+
+ (void)early_acpi_osi_init();
++#ifdef CONFIG_DMI
+ dmi_check_system(acpi_rev_dmi_table);
++#endif
+
+ return blacklisted;
+ }
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index c13a6d1796a7..fa60f265ee50 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1218,7 +1218,7 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
+ struct block_device *bdev)
+ {
+ sock_shutdown(nbd);
+- kill_bdev(bdev);
++ __invalidate_device(bdev, true);
+ nbd_bdev_reset(bdev);
+ if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
+ &nbd->config->runtime_flags))
+diff --git a/drivers/clk/sprd/sc9860-clk.c b/drivers/clk/sprd/sc9860-clk.c
+index 9980ab55271b..f76305b4bc8d 100644
+--- a/drivers/clk/sprd/sc9860-clk.c
++++ b/drivers/clk/sprd/sc9860-clk.c
+@@ -2023,6 +2023,7 @@ static int sc9860_clk_probe(struct platform_device *pdev)
+ {
+ const struct of_device_id *match;
+ const struct sprd_clk_desc *desc;
++ int ret;
+
+ match = of_match_node(sprd_sc9860_clk_ids, pdev->dev.of_node);
+ if (!match) {
+@@ -2031,7 +2032,9 @@ static int sc9860_clk_probe(struct platform_device *pdev)
+ }
+
+ desc = match->data;
+- sprd_clk_regmap_init(pdev, desc);
++ ret = sprd_clk_regmap_init(pdev, desc);
++ if (ret)
++ return ret;
+
+ return sprd_clk_probe(&pdev->dev, desc->hw_clks);
+ }
+diff --git a/drivers/clk/tegra/clk-tegra210.c b/drivers/clk/tegra/clk-tegra210.c
+index 9eb1cb14fce1..4e1bc23c9865 100644
+--- a/drivers/clk/tegra/clk-tegra210.c
++++ b/drivers/clk/tegra/clk-tegra210.c
+@@ -2214,9 +2214,9 @@ static struct div_nmp pllu_nmp = {
+ };
+
+ static struct tegra_clk_pll_freq_table pll_u_freq_table[] = {
+- { 12000000, 480000000, 40, 1, 0, 0 },
+- { 13000000, 480000000, 36, 1, 0, 0 }, /* actual: 468.0 MHz */
+- { 38400000, 480000000, 25, 2, 0, 0 },
++ { 12000000, 480000000, 40, 1, 1, 0 },
++ { 13000000, 480000000, 36, 1, 1, 0 }, /* actual: 468.0 MHz */
++ { 38400000, 480000000, 25, 2, 1, 0 },
+ { 0, 0, 0, 0, 0, 0 },
+ };
+
+@@ -3343,6 +3343,7 @@ static struct tegra_clk_init_table init_table[] __initdata = {
+ { TEGRA210_CLK_DFLL_REF, TEGRA210_CLK_PLL_P, 51000000, 1 },
+ { TEGRA210_CLK_SBC4, TEGRA210_CLK_PLL_P, 12000000, 1 },
+ { TEGRA210_CLK_PLL_RE_VCO, TEGRA210_CLK_CLK_MAX, 672000000, 1 },
++ { TEGRA210_CLK_PLL_U_OUT1, TEGRA210_CLK_CLK_MAX, 48000000, 1 },
+ { TEGRA210_CLK_XUSB_GATE, TEGRA210_CLK_CLK_MAX, 0, 1 },
+ { TEGRA210_CLK_XUSB_SS_SRC, TEGRA210_CLK_PLL_U_480M, 120000000, 0 },
+ { TEGRA210_CLK_XUSB_FS_SRC, TEGRA210_CLK_PLL_U_48M, 48000000, 0 },
+@@ -3367,7 +3368,6 @@ static struct tegra_clk_init_table init_table[] __initdata = {
+ { TEGRA210_CLK_PLL_DP, TEGRA210_CLK_CLK_MAX, 270000000, 0 },
+ { TEGRA210_CLK_SOC_THERM, TEGRA210_CLK_PLL_P, 51000000, 0 },
+ { TEGRA210_CLK_CCLK_G, TEGRA210_CLK_CLK_MAX, 0, 1 },
+- { TEGRA210_CLK_PLL_U_OUT1, TEGRA210_CLK_CLK_MAX, 48000000, 1 },
+ { TEGRA210_CLK_PLL_U_OUT2, TEGRA210_CLK_CLK_MAX, 60000000, 1 },
+ /* This MUST be the last entry. */
+ { TEGRA210_CLK_CLK_MAX, TEGRA210_CLK_CLK_MAX, 0, 0 },
+diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
+index 0b05a1e08d21..041ce864097e 100644
+--- a/drivers/dma/sh/rcar-dmac.c
++++ b/drivers/dma/sh/rcar-dmac.c
+@@ -1164,7 +1164,7 @@ rcar_dmac_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
+ struct rcar_dmac_chan *rchan = to_rcar_dmac_chan(chan);
+
+ /* Someone calling slave DMA on a generic channel? */
+- if (rchan->mid_rid < 0 || !sg_len) {
++ if (rchan->mid_rid < 0 || !sg_len || !sg_dma_len(sgl)) {
+ dev_warn(chan->device->dev,
+ "%s: bad parameter: len=%d, id=%d\n",
+ __func__, sg_len, rchan->mid_rid);
+diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
+index 8219ab88a507..fb23993430d3 100644
+--- a/drivers/dma/tegra20-apb-dma.c
++++ b/drivers/dma/tegra20-apb-dma.c
+@@ -981,8 +981,12 @@ static struct dma_async_tx_descriptor *tegra_dma_prep_slave_sg(
+ csr |= tdc->slave_id << TEGRA_APBDMA_CSR_REQ_SEL_SHIFT;
+ }
+
+- if (flags & DMA_PREP_INTERRUPT)
++ if (flags & DMA_PREP_INTERRUPT) {
+ csr |= TEGRA_APBDMA_CSR_IE_EOC;
++ } else {
++ WARN_ON_ONCE(1);
++ return NULL;
++ }
+
+ apb_seq |= TEGRA_APBDMA_APBSEQ_WRAP_WORD_1;
+
+@@ -1124,8 +1128,12 @@ static struct dma_async_tx_descriptor *tegra_dma_prep_dma_cyclic(
+ csr |= tdc->slave_id << TEGRA_APBDMA_CSR_REQ_SEL_SHIFT;
+ }
+
+- if (flags & DMA_PREP_INTERRUPT)
++ if (flags & DMA_PREP_INTERRUPT) {
+ csr |= TEGRA_APBDMA_CSR_IE_EOC;
++ } else {
++ WARN_ON_ONCE(1);
++ return NULL;
++ }
+
+ apb_seq |= TEGRA_APBDMA_APBSEQ_WRAP_WORD_1;
+
+diff --git a/drivers/firmware/psci_checker.c b/drivers/firmware/psci_checker.c
+index 346943657962..cbd53cb1b2d4 100644
+--- a/drivers/firmware/psci_checker.c
++++ b/drivers/firmware/psci_checker.c
+@@ -366,16 +366,16 @@ static int suspend_test_thread(void *arg)
+ for (;;) {
+ /* Needs to be set first to avoid missing a wakeup. */
+ set_current_state(TASK_INTERRUPTIBLE);
+- if (kthread_should_stop()) {
+- __set_current_state(TASK_RUNNING);
++ if (kthread_should_park())
+ break;
+- }
+ schedule();
+ }
+
+ pr_info("CPU %d suspend test results: success %d, shallow states %d, errors %d\n",
+ cpu, nb_suspend, nb_shallow_sleep, nb_err);
+
++ kthread_parkme();
++
+ return nb_err;
+ }
+
+@@ -440,8 +440,10 @@ static int suspend_tests(void)
+
+
+ /* Stop and destroy all threads, get return status. */
+- for (i = 0; i < nb_threads; ++i)
++ for (i = 0; i < nb_threads; ++i) {
++ err += kthread_park(threads[i]);
+ err += kthread_stop(threads[i]);
++ }
+ out:
+ cpuidle_resume_and_unlock();
+ kfree(threads);
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 4a48c7c47709..b308ce92685d 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -946,9 +946,11 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
+ }
+
+ if (eflags & GPIOEVENT_REQUEST_RISING_EDGE)
+- irqflags |= IRQF_TRIGGER_RISING;
++ irqflags |= test_bit(FLAG_ACTIVE_LOW, &desc->flags) ?
++ IRQF_TRIGGER_FALLING : IRQF_TRIGGER_RISING;
+ if (eflags & GPIOEVENT_REQUEST_FALLING_EDGE)
+- irqflags |= IRQF_TRIGGER_FALLING;
++ irqflags |= test_bit(FLAG_ACTIVE_LOW, &desc->flags) ?
++ IRQF_TRIGGER_RISING : IRQF_TRIGGER_FALLING;
+ irqflags |= IRQF_ONESHOT;
+ irqflags |= IRQF_SHARED;
+
+diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
+index 12e4203c06db..66abe061f07b 100644
+--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
++++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
+@@ -1741,6 +1741,18 @@ int kvmgt_dma_map_guest_page(unsigned long handle, unsigned long gfn,
+
+ entry = __gvt_cache_find_gfn(info->vgpu, gfn);
+ if (!entry) {
++ ret = gvt_dma_map_page(vgpu, gfn, dma_addr, size);
++ if (ret)
++ goto err_unlock;
++
++ ret = __gvt_cache_add(info->vgpu, gfn, *dma_addr, size);
++ if (ret)
++ goto err_unmap;
++ } else if (entry->size != size) {
++ /* the same gfn with different size: unmap and re-map */
++ gvt_dma_unmap_page(vgpu, gfn, entry->dma_addr, entry->size);
++ __gvt_cache_remove_entry(vgpu, entry);
++
+ ret = gvt_dma_map_page(vgpu, gfn, dma_addr, size);
+ if (ret)
+ goto err_unlock;
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index 247f72cc4d10..fb0094fc5583 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -251,7 +251,7 @@ nouveau_conn_reset(struct drm_connector *connector)
+ return;
+
+ if (connector->state)
+- __drm_atomic_helper_connector_destroy_state(connector->state);
++ nouveau_conn_atomic_destroy_state(connector, connector->state);
+ __drm_atomic_helper_connector_reset(connector, &asyc->state);
+ asyc->dither.mode = DITHERING_MODE_AUTO;
+ asyc->dither.depth = DITHERING_DEPTH_AUTO;
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index d8eb4dc04d69..6aa5a8a242ff 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -14586,7 +14586,7 @@ void hfi1_deinit_vnic_rsm(struct hfi1_devdata *dd)
+ clear_rcvctrl(dd, RCV_CTRL_RCV_RSM_ENABLE_SMASK);
+ }
+
+-static void init_rxe(struct hfi1_devdata *dd)
++static int init_rxe(struct hfi1_devdata *dd)
+ {
+ struct rsm_map_table *rmt;
+ u64 val;
+@@ -14595,6 +14595,9 @@ static void init_rxe(struct hfi1_devdata *dd)
+ write_csr(dd, RCV_ERR_MASK, ~0ull);
+
+ rmt = alloc_rsm_map_table(dd);
++ if (!rmt)
++ return -ENOMEM;
++
+ /* set up QOS, including the QPN map table */
+ init_qos(dd, rmt);
+ init_user_fecn_handling(dd, rmt);
+@@ -14621,6 +14624,7 @@ static void init_rxe(struct hfi1_devdata *dd)
+ val |= ((4ull & RCV_BYPASS_HDR_SIZE_MASK) <<
+ RCV_BYPASS_HDR_SIZE_SHIFT);
+ write_csr(dd, RCV_BYPASS, val);
++ return 0;
+ }
+
+ static void init_other(struct hfi1_devdata *dd)
+@@ -15163,7 +15167,10 @@ struct hfi1_devdata *hfi1_init_dd(struct pci_dev *pdev,
+ goto bail_cleanup;
+
+ /* set initial RXE CSRs */
+- init_rxe(dd);
++ ret = init_rxe(dd);
++ if (ret)
++ goto bail_cleanup;
++
+ /* set initial TXE CSRs */
+ init_txe(dd);
+ /* set initial non-RXE, non-TXE CSRs */
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index 27d9c4cefdc7..1ad38c8c1ef9 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -54,6 +54,7 @@
+ #include <linux/mm.h>
+ #include <linux/vmalloc.h>
+ #include <rdma/opa_addr.h>
++#include <linux/nospec.h>
+
+ #include "hfi.h"
+ #include "common.h"
+@@ -1596,6 +1597,7 @@ static int hfi1_check_ah(struct ib_device *ibdev, struct rdma_ah_attr *ah_attr)
+ sl = rdma_ah_get_sl(ah_attr);
+ if (sl >= ARRAY_SIZE(ibp->sl_to_sc))
+ return -EINVAL;
++ sl = array_index_nospec(sl, ARRAY_SIZE(ibp->sl_to_sc));
+
+ sc5 = ibp->sl_to_sc[sl];
+ if (sc_to_vlt(dd, sc5) > num_vls && sc_to_vlt(dd, sc5) != 0xf)
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index 320d4dfe8c2f..941d1df54631 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -467,6 +467,7 @@ struct mlx5_umr_wr {
+ u64 length;
+ int access_flags;
+ u32 mkey;
++ u8 ignore_free_state:1;
+ };
+
+ static inline const struct mlx5_umr_wr *umr_wr(const struct ib_send_wr *wr)
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index 7df4a4fe4af4..9bab4fb65c68 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -548,13 +548,16 @@ void mlx5_mr_cache_free(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
+ return;
+
+ c = order2idx(dev, mr->order);
+- if (c < 0 || c >= MAX_MR_CACHE_ENTRIES) {
+- mlx5_ib_warn(dev, "order %d, cache index %d\n", mr->order, c);
+- return;
+- }
++ WARN_ON(c < 0 || c >= MAX_MR_CACHE_ENTRIES);
+
+- if (unreg_umr(dev, mr))
++ if (unreg_umr(dev, mr)) {
++ mr->allocated_from_cache = false;
++ destroy_mkey(dev, mr);
++ ent = &cache->ent[c];
++ if (ent->cur < ent->limit)
++ queue_work(cache->wq, &ent->work);
+ return;
++ }
+
+ ent = &cache->ent[c];
+ spin_lock_irq(&ent->lock);
+@@ -1408,9 +1411,11 @@ static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
+ return 0;
+
+ umrwr.wr.send_flags = MLX5_IB_SEND_UMR_DISABLE_MR |
+- MLX5_IB_SEND_UMR_FAIL_IF_FREE;
++ MLX5_IB_SEND_UMR_UPDATE_PD_ACCESS;
+ umrwr.wr.opcode = MLX5_IB_WR_UMR;
++ umrwr.pd = dev->umrc.pd;
+ umrwr.mkey = mr->mmkey.key;
++ umrwr.ignore_free_state = 1;
+
+ return mlx5_ib_post_send_wait(dev, &umrwr);
+ }
+@@ -1615,10 +1620,10 @@ static void clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
+ mr->sig = NULL;
+ }
+
+- mlx5_free_priv_descs(mr);
+-
+- if (!allocated_from_cache)
++ if (!allocated_from_cache) {
+ destroy_mkey(dev, mr);
++ mlx5_free_priv_descs(mr);
++ }
+ }
+
+ static void dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 183fe5c8ceb7..77b1f3fd086a 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -1501,7 +1501,6 @@ static int create_rss_raw_qp_tir(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
+ }
+
+ MLX5_SET(tirc, tirc, rx_hash_fn, MLX5_RX_HASH_FN_TOEPLITZ);
+- MLX5_SET(tirc, tirc, rx_hash_symmetric, 1);
+ memcpy(rss_key, ucmd.rx_hash_key, len);
+ break;
+ }
+@@ -3717,10 +3716,14 @@ static int set_reg_umr_segment(struct mlx5_ib_dev *dev,
+
+ memset(umr, 0, sizeof(*umr));
+
+- if (wr->send_flags & MLX5_IB_SEND_UMR_FAIL_IF_FREE)
+- umr->flags = MLX5_UMR_CHECK_FREE; /* fail if free */
+- else
+- umr->flags = MLX5_UMR_CHECK_NOT_FREE; /* fail if not free */
++ if (!umrwr->ignore_free_state) {
++ if (wr->send_flags & MLX5_IB_SEND_UMR_FAIL_IF_FREE)
++ /* fail if free */
++ umr->flags = MLX5_UMR_CHECK_FREE;
++ else
++ /* fail if not free */
++ umr->flags = MLX5_UMR_CHECK_NOT_FREE;
++ }
+
+ umr->xlt_octowords = cpu_to_be16(get_xlt_octo(umrwr->xlt_size));
+ if (wr->send_flags & MLX5_IB_SEND_UMR_UPDATE_XLT) {
+diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
+index ddfcf4ade7bf..dc3537651b80 100644
+--- a/drivers/misc/eeprom/at24.c
++++ b/drivers/misc/eeprom/at24.c
+@@ -724,7 +724,7 @@ static int at24_probe(struct i2c_client *client)
+ nvmem_config.name = dev_name(dev);
+ nvmem_config.dev = dev;
+ nvmem_config.read_only = !writable;
+- nvmem_config.root_only = true;
++ nvmem_config.root_only = !(pdata.flags & AT24_FLAG_IRUGO);
+ nvmem_config.owner = THIS_MODULE;
+ nvmem_config.compat = true;
+ nvmem_config.base_dev = dev;
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index 80dc2fd6576c..942da07c9eb8 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -2038,8 +2038,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
+ * delayed. Allowing the transfer to take place
+ * avoids races and keeps things simple.
+ */
+- if ((err != -ETIMEDOUT) &&
+- (cmd->opcode == MMC_SEND_TUNING_BLOCK)) {
++ if (err != -ETIMEDOUT) {
+ state = STATE_SENDING_DATA;
+ continue;
+ }
+diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c
+index 9841b447ccde..f6c76be2be0d 100644
+--- a/drivers/mmc/host/meson-mx-sdio.c
++++ b/drivers/mmc/host/meson-mx-sdio.c
+@@ -76,7 +76,7 @@
+ #define MESON_MX_SDIO_IRQC_IF_CONFIG_MASK GENMASK(7, 6)
+ #define MESON_MX_SDIO_IRQC_FORCE_DATA_CLK BIT(8)
+ #define MESON_MX_SDIO_IRQC_FORCE_DATA_CMD BIT(9)
+- #define MESON_MX_SDIO_IRQC_FORCE_DATA_DAT_MASK GENMASK(10, 13)
++ #define MESON_MX_SDIO_IRQC_FORCE_DATA_DAT_MASK GENMASK(13, 10)
+ #define MESON_MX_SDIO_IRQC_SOFT_RESET BIT(15)
+ #define MESON_MX_SDIO_IRQC_FORCE_HALT BIT(30)
+ #define MESON_MX_SDIO_IRQC_HALT_HOLE BIT(31)
+diff --git a/drivers/mtd/nand/raw/nand_micron.c b/drivers/mtd/nand/raw/nand_micron.c
+index f5dc0a7a2456..fb401c25732c 100644
+--- a/drivers/mtd/nand/raw/nand_micron.c
++++ b/drivers/mtd/nand/raw/nand_micron.c
+@@ -400,6 +400,14 @@ static int micron_supports_on_die_ecc(struct nand_chip *chip)
+ (chip->id.data[4] & MICRON_ID_INTERNAL_ECC_MASK) != 0x2)
+ return MICRON_ON_DIE_UNSUPPORTED;
+
++ /*
++ * It seems that there are devices which do not support ECC officially.
++ * At least the MT29F2G08ABAGA / MT29F2G08ABBGA devices supports
++ * enabling the ECC feature but don't reflect that to the READ_ID table.
++ * So we have to guarantee that we disable the ECC feature directly
++ * after we did the READ_ID table command. Later we can evaluate the
++ * ECC_ENABLE support.
++ */
+ ret = micron_nand_on_die_ecc_setup(chip, true);
+ if (ret)
+ return MICRON_ON_DIE_UNSUPPORTED;
+@@ -408,13 +416,13 @@ static int micron_supports_on_die_ecc(struct nand_chip *chip)
+ if (ret)
+ return MICRON_ON_DIE_UNSUPPORTED;
+
+- if (!(id[4] & MICRON_ID_ECC_ENABLED))
+- return MICRON_ON_DIE_UNSUPPORTED;
+-
+ ret = micron_nand_on_die_ecc_setup(chip, false);
+ if (ret)
+ return MICRON_ON_DIE_UNSUPPORTED;
+
++ if (!(id[4] & MICRON_ID_ECC_ENABLED))
++ return MICRON_ON_DIE_UNSUPPORTED;
++
+ ret = nand_readid_op(chip, 0, id, sizeof(id));
+ if (ret)
+ return MICRON_ON_DIE_UNSUPPORTED;
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index bff74752cef1..3fe6a28027fe 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -4700,8 +4700,12 @@ int be_update_queues(struct be_adapter *adapter)
+ struct net_device *netdev = adapter->netdev;
+ int status;
+
+- if (netif_running(netdev))
++ if (netif_running(netdev)) {
++ /* device cannot transmit now, avoid dev_watchdog timeouts */
++ netif_carrier_off(netdev);
++
+ be_close(netdev);
++ }
+
+ be_cancel_worker(adapter);
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
+index b25048c6c761..21296fa7f7fb 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
+@@ -408,14 +408,6 @@ static int mlxsw_sp_port_dcb_app_update(struct mlxsw_sp_port *mlxsw_sp_port)
+ have_dscp = mlxsw_sp_port_dcb_app_prio_dscp_map(mlxsw_sp_port,
+ &prio_map);
+
+- if (!have_dscp) {
+- err = mlxsw_sp_port_dcb_toggle_trust(mlxsw_sp_port,
+- MLXSW_REG_QPTS_TRUST_STATE_PCP);
+- if (err)
+- netdev_err(mlxsw_sp_port->dev, "Couldn't switch to trust L2\n");
+- return err;
+- }
+-
+ mlxsw_sp_port_dcb_app_dscp_prio_map(mlxsw_sp_port, default_prio,
+ &dscp_map);
+ err = mlxsw_sp_port_dcb_app_update_qpdpm(mlxsw_sp_port,
+@@ -432,6 +424,14 @@ static int mlxsw_sp_port_dcb_app_update(struct mlxsw_sp_port *mlxsw_sp_port)
+ return err;
+ }
+
++ if (!have_dscp) {
++ err = mlxsw_sp_port_dcb_toggle_trust(mlxsw_sp_port,
++ MLXSW_REG_QPTS_TRUST_STATE_PCP);
++ if (err)
++ netdev_err(mlxsw_sp_port->dev, "Couldn't switch to trust L2\n");
++ return err;
++ }
++
+ err = mlxsw_sp_port_dcb_toggle_trust(mlxsw_sp_port,
+ MLXSW_REG_QPTS_TRUST_STATE_DSCP);
+ if (err) {
+diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
+index d0b7dd8fb184..77995df7fe54 100644
+--- a/drivers/perf/arm_pmu.c
++++ b/drivers/perf/arm_pmu.c
+@@ -730,8 +730,8 @@ static int cpu_pm_pmu_notify(struct notifier_block *b, unsigned long cmd,
+ cpu_pm_pmu_setup(armpmu, cmd);
+ break;
+ case CPU_PM_EXIT:
+- cpu_pm_pmu_setup(armpmu, cmd);
+ case CPU_PM_ENTER_FAILED:
++ cpu_pm_pmu_setup(armpmu, cmd);
+ armpmu->start(armpmu);
+ break;
+ default:
+diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
+index cbe467ff1aba..fa0bbda4b3f2 100644
+--- a/drivers/rapidio/devices/rio_mport_cdev.c
++++ b/drivers/rapidio/devices/rio_mport_cdev.c
+@@ -1688,6 +1688,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
+
+ if (copy_from_user(&dev_info, arg, sizeof(dev_info)))
+ return -EFAULT;
++ dev_info.name[sizeof(dev_info.name) - 1] = '\0';
+
+ rmcd_debug(RDEV, "name:%s ct:0x%x did:0x%x hc:0x%x", dev_info.name,
+ dev_info.comptag, dev_info.destid, dev_info.hopcount);
+@@ -1819,6 +1820,7 @@ static int rio_mport_del_riodev(struct mport_cdev_priv *priv, void __user *arg)
+
+ if (copy_from_user(&dev_info, arg, sizeof(dev_info)))
+ return -EFAULT;
++ dev_info.name[sizeof(dev_info.name) - 1] = '\0';
+
+ mport = priv->md->mport;
+
+diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
+index b9ce93e9df89..99f86612f775 100644
+--- a/drivers/s390/block/dasd_alias.c
++++ b/drivers/s390/block/dasd_alias.c
+@@ -383,6 +383,20 @@ suborder_not_supported(struct dasd_ccw_req *cqr)
+ char msg_format;
+ char msg_no;
+
++ /*
++ * intrc values ENODEV, ENOLINK and EPERM
++ * will be optained from sleep_on to indicate that no
++ * IO operation can be started
++ */
++ if (cqr->intrc == -ENODEV)
++ return 1;
++
++ if (cqr->intrc == -ENOLINK)
++ return 1;
++
++ if (cqr->intrc == -EPERM)
++ return 1;
++
+ sense = dasd_get_sense(&cqr->irb);
+ if (!sense)
+ return 0;
+@@ -447,12 +461,8 @@ static int read_unit_address_configuration(struct dasd_device *device,
+ lcu->flags &= ~NEED_UAC_UPDATE;
+ spin_unlock_irqrestore(&lcu->lock, flags);
+
+- do {
+- rc = dasd_sleep_on(cqr);
+- if (rc && suborder_not_supported(cqr))
+- return -EOPNOTSUPP;
+- } while (rc && (cqr->retries > 0));
+- if (rc) {
++ rc = dasd_sleep_on(cqr);
++ if (rc && !suborder_not_supported(cqr)) {
+ spin_lock_irqsave(&lcu->lock, flags);
+ lcu->flags |= NEED_UAC_UPDATE;
+ spin_unlock_irqrestore(&lcu->lock, flags);
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index ebdbc457003f..332701db7379 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -11,6 +11,7 @@
+ #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
+ #include <linux/kthread.h>
++#include <linux/bug.h>
+ #include "zfcp_ext.h"
+ #include "zfcp_reqlist.h"
+
+@@ -238,6 +239,12 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status,
+ struct zfcp_erp_action *erp_action;
+ struct zfcp_scsi_dev *zfcp_sdev;
+
++ if (WARN_ON_ONCE(need != ZFCP_ERP_ACTION_REOPEN_LUN &&
++ need != ZFCP_ERP_ACTION_REOPEN_PORT &&
++ need != ZFCP_ERP_ACTION_REOPEN_PORT_FORCED &&
++ need != ZFCP_ERP_ACTION_REOPEN_ADAPTER))
++ return NULL;
++
+ switch (need) {
+ case ZFCP_ERP_ACTION_REOPEN_LUN:
+ zfcp_sdev = sdev_to_zfcp(sdev);
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 8776330175e3..d2ab52026014 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -2565,12 +2565,14 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev)
+ {
+ struct sysinfo s;
+ u64 consistent_dma_mask;
++ /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */
++ int dma_mask = (ioc->hba_mpi_version_belonged > MPI2_VERSION) ? 63 : 64;
+
+ if (ioc->is_mcpu_endpoint)
+ goto try_32bit;
+
+ if (ioc->dma_mask)
+- consistent_dma_mask = DMA_BIT_MASK(64);
++ consistent_dma_mask = DMA_BIT_MASK(dma_mask);
+ else
+ consistent_dma_mask = DMA_BIT_MASK(32);
+
+@@ -2578,11 +2580,11 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev)
+ const uint64_t required_mask =
+ dma_get_required_mask(&pdev->dev);
+ if ((required_mask > DMA_BIT_MASK(32)) &&
+- !pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) &&
++ !pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_mask)) &&
+ !pci_set_consistent_dma_mask(pdev, consistent_dma_mask)) {
+ ioc->base_add_sg_single = &_base_add_sg_single_64;
+ ioc->sge_size = sizeof(Mpi2SGESimple64_t);
+- ioc->dma_mask = 64;
++ ioc->dma_mask = dma_mask;
+ goto out;
+ }
+ }
+@@ -2609,7 +2611,7 @@ static int
+ _base_change_consistent_dma_mask(struct MPT3SAS_ADAPTER *ioc,
+ struct pci_dev *pdev)
+ {
+- if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
++ if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(ioc->dma_mask))) {
+ if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)))
+ return -ENODEV;
+ }
+@@ -4545,7 +4547,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc)
+ total_sz += sz;
+ } while (ioc->rdpq_array_enable && (++i < ioc->reply_queue_count));
+
+- if (ioc->dma_mask == 64) {
++ if (ioc->dma_mask > 32) {
+ if (_base_change_consistent_dma_mask(ioc, ioc->pdev) != 0) {
+ pr_warn(MPT3SAS_FMT
+ "no suitable consistent DMA mask for %s\n",
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index aa081f806728..3d9997595d90 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -357,8 +357,8 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
+ /* Convert the size to actually allocated. */
+ size = 1UL << (order + XEN_PAGE_SHIFT);
+
+- if (((dev_addr + size - 1 <= dma_mask)) ||
+- range_straddles_page_boundary(phys, size))
++ if (!WARN_ON((dev_addr + size - 1 > dma_mask) ||
++ range_straddles_page_boundary(phys, size)))
+ xen_destroy_contiguous_region(phys, order);
+
+ xen_free_coherent_pages(hwdev, size, vaddr, (dma_addr_t)phys, attrs);
+diff --git a/fs/adfs/super.c b/fs/adfs/super.c
+index 7e099a7a4eb1..4dc15b263489 100644
+--- a/fs/adfs/super.c
++++ b/fs/adfs/super.c
+@@ -369,6 +369,7 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent)
+ struct buffer_head *bh;
+ struct object_info root_obj;
+ unsigned char *b_data;
++ unsigned int blocksize;
+ struct adfs_sb_info *asb;
+ struct inode *root;
+ int ret = -EINVAL;
+@@ -420,8 +421,10 @@ static int adfs_fill_super(struct super_block *sb, void *data, int silent)
+ goto error_free_bh;
+ }
+
++ blocksize = 1 << dr->log2secsize;
+ brelse(bh);
+- if (sb_set_blocksize(sb, 1 << dr->log2secsize)) {
++
++ if (sb_set_blocksize(sb, blocksize)) {
+ bh = sb_bread(sb, ADFS_DISCRECORD / sb->s_blocksize);
+ if (!bh) {
+ adfs_error(sb, "couldn't read superblock on "
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index e46e83e87600..734866ab5194 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2249,6 +2249,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
+ int ret = 0;
+ int i;
+ u64 *i_qgroups;
++ bool committing = false;
+ struct btrfs_fs_info *fs_info = trans->fs_info;
+ struct btrfs_root *quota_root;
+ struct btrfs_qgroup *srcgroup;
+@@ -2256,7 +2257,25 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
+ u32 level_size = 0;
+ u64 nums;
+
+- mutex_lock(&fs_info->qgroup_ioctl_lock);
++ /*
++ * There are only two callers of this function.
++ *
++ * One in create_subvol() in the ioctl context, which needs to hold
++ * the qgroup_ioctl_lock.
++ *
++ * The other one in create_pending_snapshot() where no other qgroup
++ * code can modify the fs as they all need to either start a new trans
++ * or hold a trans handler, thus we don't need to hold
++ * qgroup_ioctl_lock.
++ * This would avoid long and complex lock chain and make lockdep happy.
++ */
++ spin_lock(&fs_info->trans_lock);
++ if (trans->transaction->state == TRANS_STATE_COMMIT_DOING)
++ committing = true;
++ spin_unlock(&fs_info->trans_lock);
++
++ if (!committing)
++ mutex_lock(&fs_info->qgroup_ioctl_lock);
+ if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
+ goto out;
+
+@@ -2420,7 +2439,8 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
+ unlock:
+ spin_unlock(&fs_info->qgroup_lock);
+ out:
+- mutex_unlock(&fs_info->qgroup_ioctl_lock);
++ if (!committing)
++ mutex_unlock(&fs_info->qgroup_ioctl_lock);
+ return ret;
+ }
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 258392b75048..48ddbc187e58 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -6272,68 +6272,21 @@ static int changed_extent(struct send_ctx *sctx,
+ {
+ int ret = 0;
+
+- if (sctx->cur_ino != sctx->cmp_key->objectid) {
+-
+- if (result == BTRFS_COMPARE_TREE_CHANGED) {
+- struct extent_buffer *leaf_l;
+- struct extent_buffer *leaf_r;
+- struct btrfs_file_extent_item *ei_l;
+- struct btrfs_file_extent_item *ei_r;
+-
+- leaf_l = sctx->left_path->nodes[0];
+- leaf_r = sctx->right_path->nodes[0];
+- ei_l = btrfs_item_ptr(leaf_l,
+- sctx->left_path->slots[0],
+- struct btrfs_file_extent_item);
+- ei_r = btrfs_item_ptr(leaf_r,
+- sctx->right_path->slots[0],
+- struct btrfs_file_extent_item);
+-
+- /*
+- * We may have found an extent item that has changed
+- * only its disk_bytenr field and the corresponding
+- * inode item was not updated. This case happens due to
+- * very specific timings during relocation when a leaf
+- * that contains file extent items is COWed while
+- * relocation is ongoing and its in the stage where it
+- * updates data pointers. So when this happens we can
+- * safely ignore it since we know it's the same extent,
+- * but just at different logical and physical locations
+- * (when an extent is fully replaced with a new one, we
+- * know the generation number must have changed too,
+- * since snapshot creation implies committing the current
+- * transaction, and the inode item must have been updated
+- * as well).
+- * This replacement of the disk_bytenr happens at
+- * relocation.c:replace_file_extents() through
+- * relocation.c:btrfs_reloc_cow_block().
+- */
+- if (btrfs_file_extent_generation(leaf_l, ei_l) ==
+- btrfs_file_extent_generation(leaf_r, ei_r) &&
+- btrfs_file_extent_ram_bytes(leaf_l, ei_l) ==
+- btrfs_file_extent_ram_bytes(leaf_r, ei_r) &&
+- btrfs_file_extent_compression(leaf_l, ei_l) ==
+- btrfs_file_extent_compression(leaf_r, ei_r) &&
+- btrfs_file_extent_encryption(leaf_l, ei_l) ==
+- btrfs_file_extent_encryption(leaf_r, ei_r) &&
+- btrfs_file_extent_other_encoding(leaf_l, ei_l) ==
+- btrfs_file_extent_other_encoding(leaf_r, ei_r) &&
+- btrfs_file_extent_type(leaf_l, ei_l) ==
+- btrfs_file_extent_type(leaf_r, ei_r) &&
+- btrfs_file_extent_disk_bytenr(leaf_l, ei_l) !=
+- btrfs_file_extent_disk_bytenr(leaf_r, ei_r) &&
+- btrfs_file_extent_disk_num_bytes(leaf_l, ei_l) ==
+- btrfs_file_extent_disk_num_bytes(leaf_r, ei_r) &&
+- btrfs_file_extent_offset(leaf_l, ei_l) ==
+- btrfs_file_extent_offset(leaf_r, ei_r) &&
+- btrfs_file_extent_num_bytes(leaf_l, ei_l) ==
+- btrfs_file_extent_num_bytes(leaf_r, ei_r))
+- return 0;
+- }
+-
+- inconsistent_snapshot_error(sctx, result, "extent");
+- return -EIO;
+- }
++ /*
++ * We have found an extent item that changed without the inode item
++ * having changed. This can happen either after relocation (where the
++ * disk_bytenr of an extent item is replaced at
++ * relocation.c:replace_file_extents()) or after deduplication into a
++ * file in both the parent and send snapshots (where an extent item can
++ * get modified or replaced with a new one). Note that deduplication
++ * updates the inode item, but it only changes the iversion (sequence
++ * field in the inode item) of the inode, so if a file is deduplicated
++ * the same amount of times in both the parent and send snapshots, its
++ * iversion becames the same in both snapshots, whence the inode item is
++ * the same on both snapshots.
++ */
++ if (sctx->cur_ino != sctx->cmp_key->objectid)
++ return 0;
+
+ if (!sctx->cur_inode_new_gen && !sctx->cur_inode_deleted) {
+ if (result != BTRFS_COMPARE_TREE_DELETED)
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index bb8f6c020d22..f1ca53a3ff0b 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -2027,6 +2027,16 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+ }
+ } else {
+ spin_unlock(&fs_info->trans_lock);
++ /*
++ * The previous transaction was aborted and was already removed
++ * from the list of transactions at fs_info->trans_list. So we
++ * abort to prevent writing a new superblock that reflects a
++ * corrupt state (pointing to trees with unwritten nodes/leafs).
++ */
++ if (test_bit(BTRFS_FS_STATE_TRANS_ABORTED, &fs_info->fs_state)) {
++ ret = -EROFS;
++ goto cleanup_transaction;
++ }
+ }
+
+ extwriter_counter_dec(cur_trans, trans->type);
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 2fd000308be7..6e008bd5c8cd 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -5040,8 +5040,7 @@ static inline int btrfs_chunk_max_errors(struct map_lookup *map)
+
+ if (map->type & (BTRFS_BLOCK_GROUP_RAID1 |
+ BTRFS_BLOCK_GROUP_RAID10 |
+- BTRFS_BLOCK_GROUP_RAID5 |
+- BTRFS_BLOCK_GROUP_DUP)) {
++ BTRFS_BLOCK_GROUP_RAID5)) {
+ max_errors = 1;
+ } else if (map->type & BTRFS_BLOCK_GROUP_RAID6) {
+ max_errors = 2;
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index 582e28fd1b7b..d8579a56e5dc 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -526,7 +526,12 @@ static inline void __ceph_dir_set_complete(struct ceph_inode_info *ci,
+ long long release_count,
+ long long ordered_count)
+ {
+- smp_mb__before_atomic();
++ /*
++ * Makes sure operations that setup readdir cache (update page
++ * cache and i_size) are strongly ordered w.r.t. the following
++ * atomic64_set() operations.
++ */
++ smp_mb();
+ atomic64_set(&ci->i_complete_seq[0], release_count);
+ atomic64_set(&ci->i_complete_seq[1], ordered_count);
+ }
+diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
+index 5cc8b94f8206..0a2d4898ee16 100644
+--- a/fs/ceph/xattr.c
++++ b/fs/ceph/xattr.c
+@@ -79,7 +79,7 @@ static size_t ceph_vxattrcb_layout(struct ceph_inode_info *ci, char *val,
+ const char *ns_field = " pool_namespace=";
+ char buf[128];
+ size_t len, total_len = 0;
+- int ret;
++ ssize_t ret;
+
+ pool_ns = ceph_try_get_string(ci->i_layout.pool_ns);
+
+@@ -103,11 +103,8 @@ static size_t ceph_vxattrcb_layout(struct ceph_inode_info *ci, char *val,
+ if (pool_ns)
+ total_len += strlen(ns_field) + pool_ns->len;
+
+- if (!size) {
+- ret = total_len;
+- } else if (total_len > size) {
+- ret = -ERANGE;
+- } else {
++ ret = total_len;
++ if (size >= total_len) {
+ memcpy(val, buf, len);
+ ret = len;
+ if (pool_name) {
+@@ -817,8 +814,11 @@ ssize_t __ceph_getxattr(struct inode *inode, const char *name, void *value,
+ if (err)
+ return err;
+ err = -ENODATA;
+- if (!(vxattr->exists_cb && !vxattr->exists_cb(ci)))
++ if (!(vxattr->exists_cb && !vxattr->exists_cb(ci))) {
+ err = vxattr->getxattr_cb(ci, value, size);
++ if (size && size < err)
++ err = -ERANGE;
++ }
+ return err;
+ }
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index f31339db45fd..c53a2e86ed54 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -563,10 +563,10 @@ static bool
+ server_unresponsive(struct TCP_Server_Info *server)
+ {
+ /*
+- * We need to wait 2 echo intervals to make sure we handle such
++ * We need to wait 3 echo intervals to make sure we handle such
+ * situations right:
+ * 1s client sends a normal SMB request
+- * 2s client gets a response
++ * 3s client gets a response
+ * 30s echo workqueue job pops, and decides we got a response recently
+ * and don't need to send another
+ * ...
+@@ -575,9 +575,9 @@ server_unresponsive(struct TCP_Server_Info *server)
+ */
+ if ((server->tcpStatus == CifsGood ||
+ server->tcpStatus == CifsNeedNegotiate) &&
+- time_after(jiffies, server->lstrp + 2 * server->echo_interval)) {
++ time_after(jiffies, server->lstrp + 3 * server->echo_interval)) {
+ cifs_dbg(VFS, "Server %s has not responded in %lu seconds. Reconnecting...\n",
+- server->hostname, (2 * server->echo_interval) / HZ);
++ server->hostname, (3 * server->echo_interval) / HZ);
+ cifs_reconnect(server);
+ wake_up(&server->response_q);
+ return true;
+diff --git a/fs/coda/psdev.c b/fs/coda/psdev.c
+index c5234c21b539..55824cba3245 100644
+--- a/fs/coda/psdev.c
++++ b/fs/coda/psdev.c
+@@ -187,8 +187,11 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf,
+ if (req->uc_opcode == CODA_OPEN_BY_FD) {
+ struct coda_open_by_fd_out *outp =
+ (struct coda_open_by_fd_out *)req->uc_data;
+- if (!outp->oh.result)
++ if (!outp->oh.result) {
+ outp->fh = fget(outp->fd);
++ if (!outp->fh)
++ return -EBADF;
++ }
+ }
+
+ wake_up(&req->uc_sleep);
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index de8d3d3fa651..b4d23b3a2ef2 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -326,7 +326,10 @@ void acpi_set_irq_model(enum acpi_irq_model_id model,
+ #ifdef CONFIG_X86_IO_APIC
+ extern int acpi_get_override_irq(u32 gsi, int *trigger, int *polarity);
+ #else
+-#define acpi_get_override_irq(gsi, trigger, polarity) (-1)
++static inline int acpi_get_override_irq(u32 gsi, int *trigger, int *polarity)
++{
++ return -1;
++}
+ #endif
+ /*
+ * This function undoes the effect of one call to acpi_register_gsi().
+diff --git a/include/linux/coda.h b/include/linux/coda.h
+index d30209b9cef8..0ca0c83fdb1c 100644
+--- a/include/linux/coda.h
++++ b/include/linux/coda.h
+@@ -58,8 +58,7 @@ Mellon the rights to redistribute these changes without encumbrance.
+ #ifndef _CODA_HEADER_
+ #define _CODA_HEADER_
+
+-#if defined(__linux__)
+ typedef unsigned long long u_quad_t;
+-#endif
++
+ #include <uapi/linux/coda.h>
+ #endif
+diff --git a/include/linux/coda_psdev.h b/include/linux/coda_psdev.h
+index 15170954aa2b..57d2b2faf6a3 100644
+--- a/include/linux/coda_psdev.h
++++ b/include/linux/coda_psdev.h
+@@ -19,6 +19,17 @@ struct venus_comm {
+ struct mutex vc_mutex;
+ };
+
++/* messages between coda filesystem in kernel and Venus */
++struct upc_req {
++ struct list_head uc_chain;
++ caddr_t uc_data;
++ u_short uc_flags;
++ u_short uc_inSize; /* Size is at most 5000 bytes */
++ u_short uc_outSize;
++ u_short uc_opcode; /* copied from data to save lookup */
++ int uc_unique;
++ wait_queue_head_t uc_sleep; /* process' wait queue */
++};
+
+ static inline struct venus_comm *coda_vcp(struct super_block *sb)
+ {
+diff --git a/include/uapi/linux/coda_psdev.h b/include/uapi/linux/coda_psdev.h
+index aa6623efd2dd..d50d51a57fe4 100644
+--- a/include/uapi/linux/coda_psdev.h
++++ b/include/uapi/linux/coda_psdev.h
+@@ -7,19 +7,6 @@
+ #define CODA_PSDEV_MAJOR 67
+ #define MAX_CODADEVS 5 /* how many do we allow */
+
+-
+-/* messages between coda filesystem in kernel and Venus */
+-struct upc_req {
+- struct list_head uc_chain;
+- caddr_t uc_data;
+- u_short uc_flags;
+- u_short uc_inSize; /* Size is at most 5000 bytes */
+- u_short uc_outSize;
+- u_short uc_opcode; /* copied from data to save lookup */
+- int uc_unique;
+- wait_queue_head_t uc_sleep; /* process' wait queue */
+-};
+-
+ #define CODA_REQ_ASYNC 0x1
+ #define CODA_REQ_READ 0x2
+ #define CODA_REQ_WRITE 0x4
+diff --git a/ipc/mqueue.c b/ipc/mqueue.c
+index bce7af1546d9..de4070d5472f 100644
+--- a/ipc/mqueue.c
++++ b/ipc/mqueue.c
+@@ -389,7 +389,6 @@ static void mqueue_evict_inode(struct inode *inode)
+ {
+ struct mqueue_inode_info *info;
+ struct user_struct *user;
+- unsigned long mq_bytes, mq_treesize;
+ struct ipc_namespace *ipc_ns;
+ struct msg_msg *msg, *nmsg;
+ LIST_HEAD(tmp_msg);
+@@ -412,16 +411,18 @@ static void mqueue_evict_inode(struct inode *inode)
+ free_msg(msg);
+ }
+
+- /* Total amount of bytes accounted for the mqueue */
+- mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +
+- min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *
+- sizeof(struct posix_msg_tree_node);
+-
+- mq_bytes = mq_treesize + (info->attr.mq_maxmsg *
+- info->attr.mq_msgsize);
+-
+ user = info->user;
+ if (user) {
++ unsigned long mq_bytes, mq_treesize;
++
++ /* Total amount of bytes accounted for the mqueue */
++ mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +
++ min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *
++ sizeof(struct posix_msg_tree_node);
++
++ mq_bytes = mq_treesize + (info->attr.mq_maxmsg *
++ info->attr.mq_msgsize);
++
+ spin_lock(&mq_lock);
+ user->mq_bytes -= mq_bytes;
+ /*
+diff --git a/kernel/module.c b/kernel/module.c
+index b8f37376856b..3fda10c549a2 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -3388,8 +3388,7 @@ static bool finished_loading(const char *name)
+ sched_annotate_sleep();
+ mutex_lock(&module_mutex);
+ mod = find_module_all(name, strlen(name), true);
+- ret = !mod || mod->state == MODULE_STATE_LIVE
+- || mod->state == MODULE_STATE_GOING;
++ ret = !mod || mod->state == MODULE_STATE_LIVE;
+ mutex_unlock(&module_mutex);
+
+ return ret;
+@@ -3559,8 +3558,7 @@ again:
+ mutex_lock(&module_mutex);
+ old = find_module_all(mod->name, strlen(mod->name), true);
+ if (old != NULL) {
+- if (old->state == MODULE_STATE_COMING
+- || old->state == MODULE_STATE_UNFORMED) {
++ if (old->state != MODULE_STATE_LIVE) {
+ /* Wait in case it fails to load. */
+ mutex_unlock(&module_mutex);
+ err = wait_event_interruptible(module_wq,
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 118ecce14386..d9dd709b3c12 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1647,6 +1647,11 @@ static bool test_rec_ops_needs_regs(struct dyn_ftrace *rec)
+ return keep_regs;
+ }
+
++static struct ftrace_ops *
++ftrace_find_tramp_ops_any(struct dyn_ftrace *rec);
++static struct ftrace_ops *
++ftrace_find_tramp_ops_next(struct dyn_ftrace *rec, struct ftrace_ops *ops);
++
+ static bool __ftrace_hash_rec_update(struct ftrace_ops *ops,
+ int filter_hash,
+ bool inc)
+@@ -1775,15 +1780,17 @@ static bool __ftrace_hash_rec_update(struct ftrace_ops *ops,
+ }
+
+ /*
+- * If the rec had TRAMP enabled, then it needs to
+- * be cleared. As TRAMP can only be enabled iff
+- * there is only a single ops attached to it.
+- * In otherwords, always disable it on decrementing.
+- * In the future, we may set it if rec count is
+- * decremented to one, and the ops that is left
+- * has a trampoline.
++ * The TRAMP needs to be set only if rec count
++ * is decremented to one, and the ops that is
++ * left has a trampoline. As TRAMP can only be
++ * enabled if there is only a single ops attached
++ * to it.
+ */
+- rec->flags &= ~FTRACE_FL_TRAMP;
++ if (ftrace_rec_count(rec) == 1 &&
++ ftrace_find_tramp_ops_any(rec))
++ rec->flags |= FTRACE_FL_TRAMP;
++ else
++ rec->flags &= ~FTRACE_FL_TRAMP;
+
+ /*
+ * flags will be cleared in ftrace_check_record()
+@@ -1976,11 +1983,6 @@ static void print_ip_ins(const char *fmt, const unsigned char *p)
+ printk(KERN_CONT "%s%02x", i ? ":" : "", p[i]);
+ }
+
+-static struct ftrace_ops *
+-ftrace_find_tramp_ops_any(struct dyn_ftrace *rec);
+-static struct ftrace_ops *
+-ftrace_find_tramp_ops_next(struct dyn_ftrace *rec, struct ftrace_ops *ops);
+-
+ enum ftrace_bug_type ftrace_bug_type;
+ const void *ftrace_expected;
+
+diff --git a/lib/test_overflow.c b/lib/test_overflow.c
+index fc680562d8b6..7a4b6f6c5473 100644
+--- a/lib/test_overflow.c
++++ b/lib/test_overflow.c
+@@ -486,16 +486,17 @@ static int __init test_overflow_shift(void)
+ * Deal with the various forms of allocator arguments. See comments above
+ * the DEFINE_TEST_ALLOC() instances for mapping of the "bits".
+ */
+-#define alloc010(alloc, arg, sz) alloc(sz, GFP_KERNEL)
+-#define alloc011(alloc, arg, sz) alloc(sz, GFP_KERNEL, NUMA_NO_NODE)
++#define alloc_GFP (GFP_KERNEL | __GFP_NOWARN)
++#define alloc010(alloc, arg, sz) alloc(sz, alloc_GFP)
++#define alloc011(alloc, arg, sz) alloc(sz, alloc_GFP, NUMA_NO_NODE)
+ #define alloc000(alloc, arg, sz) alloc(sz)
+ #define alloc001(alloc, arg, sz) alloc(sz, NUMA_NO_NODE)
+-#define alloc110(alloc, arg, sz) alloc(arg, sz, GFP_KERNEL)
++#define alloc110(alloc, arg, sz) alloc(arg, sz, alloc_GFP)
+ #define free0(free, arg, ptr) free(ptr)
+ #define free1(free, arg, ptr) free(arg, ptr)
+
+-/* Wrap around to 8K */
+-#define TEST_SIZE (9 << PAGE_SHIFT)
++/* Wrap around to 16K */
++#define TEST_SIZE (5 * 4096)
+
+ #define DEFINE_TEST_ALLOC(func, free_func, want_arg, want_gfp, want_node)\
+ static int __init test_ ## func (void *arg) \
+diff --git a/lib/test_string.c b/lib/test_string.c
+index 0fcdb82dca86..98a787e7a1fd 100644
+--- a/lib/test_string.c
++++ b/lib/test_string.c
+@@ -35,7 +35,7 @@ static __init int memset16_selftest(void)
+ fail:
+ kfree(p);
+ if (i < 256)
+- return (i << 24) | (j << 16) | k;
++ return (i << 24) | (j << 16) | k | 0x8000;
+ return 0;
+ }
+
+@@ -71,7 +71,7 @@ static __init int memset32_selftest(void)
+ fail:
+ kfree(p);
+ if (i < 256)
+- return (i << 24) | (j << 16) | k;
++ return (i << 24) | (j << 16) | k | 0x8000;
+ return 0;
+ }
+
+@@ -107,7 +107,7 @@ static __init int memset64_selftest(void)
+ fail:
+ kfree(p);
+ if (i < 256)
+- return (i << 24) | (j << 16) | k;
++ return (i << 24) | (j << 16) | k | 0x8000;
+ return 0;
+ }
+
+diff --git a/mm/cma.c b/mm/cma.c
+index 476dfe13a701..4c2864270a39 100644
+--- a/mm/cma.c
++++ b/mm/cma.c
+@@ -282,6 +282,12 @@ int __init cma_declare_contiguous(phys_addr_t base,
+ */
+ alignment = max(alignment, (phys_addr_t)PAGE_SIZE <<
+ max_t(unsigned long, MAX_ORDER - 1, pageblock_order));
++ if (fixed && base & (alignment - 1)) {
++ ret = -EINVAL;
++ pr_err("Region at %pa must be aligned to %pa bytes\n",
++ &base, &alignment);
++ goto err;
++ }
+ base = ALIGN(base, alignment);
+ size = ALIGN(size, alignment);
+ limit &= ~(alignment - 1);
+@@ -312,6 +318,13 @@ int __init cma_declare_contiguous(phys_addr_t base,
+ if (limit == 0 || limit > memblock_end)
+ limit = memblock_end;
+
++ if (base + size > limit) {
++ ret = -EINVAL;
++ pr_err("Size (%pa) of region at %pa exceeds limit (%pa)\n",
++ &size, &base, &limit);
++ goto err;
++ }
++
+ /* Reserve memory */
+ if (fixed) {
+ if (memblock_is_region_reserved(base, size) ||
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 576379e87421..b37610c0eac6 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -670,7 +670,14 @@ static unsigned long shrink_slab(gfp_t gfp_mask, int nid,
+ unsigned long ret, freed = 0;
+ struct shrinker *shrinker;
+
+- if (!mem_cgroup_is_root(memcg))
++ /*
++ * The root memcg might be allocated even though memcg is disabled
++ * via "cgroup_disable=memory" boot parameter. This could make
++ * mem_cgroup_is_root() return false, then just run memcg slab
++ * shrink, but skip global shrink. This may result in premature
++ * oom.
++ */
++ if (!mem_cgroup_disabled() && !mem_cgroup_is_root(memcg))
+ return shrink_slab_memcg(gfp_mask, nid, memcg, priority);
+
+ if (!down_read_trylock(&shrinker_rwsem))
+diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
+index fd99ae90a618..0dde19cf7486 100644
+--- a/scripts/kconfig/confdata.c
++++ b/scripts/kconfig/confdata.c
+@@ -784,6 +784,7 @@ int conf_write(const char *name)
+ const char *str;
+ char dirname[PATH_MAX+1], tmpname[PATH_MAX+22], newname[PATH_MAX+8];
+ char *env;
++ int i;
+
+ dirname[0] = 0;
+ if (name && name[0]) {
+@@ -860,6 +861,9 @@ next:
+ }
+ fclose(out);
+
++ for_all_symbols(i, sym)
++ sym->flags &= ~SYMBOL_WRITTEN;
++
+ if (*tmpname) {
+ strcat(dirname, basename);
+ strcat(dirname, ".old");
+diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
+index d31a52e56b9e..91d259c87d10 100644
+--- a/security/selinux/ss/policydb.c
++++ b/security/selinux/ss/policydb.c
+@@ -275,6 +275,8 @@ static int rangetr_cmp(struct hashtab *h, const void *k1, const void *k2)
+ return v;
+ }
+
++static int (*destroy_f[SYM_NUM]) (void *key, void *datum, void *datap);
++
+ /*
+ * Initialize a policy database structure.
+ */
+@@ -322,8 +324,10 @@ static int policydb_init(struct policydb *p)
+ out:
+ hashtab_destroy(p->filename_trans);
+ hashtab_destroy(p->range_tr);
+- for (i = 0; i < SYM_NUM; i++)
++ for (i = 0; i < SYM_NUM; i++) {
++ hashtab_map(p->symtab[i].table, destroy_f[i], NULL);
+ hashtab_destroy(p->symtab[i].table);
++ }
+ return rc;
+ }
+
+diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c
+index 27eb0270a711..3847fe841d33 100644
+--- a/sound/hda/hdac_i915.c
++++ b/sound/hda/hdac_i915.c
+@@ -143,10 +143,12 @@ int snd_hdac_i915_init(struct hdac_bus *bus)
+ if (!acomp)
+ return -ENODEV;
+ if (!acomp->ops) {
+- request_module("i915");
+- /* 60s timeout */
+- wait_for_completion_timeout(&bind_complete,
+- msecs_to_jiffies(60 * 1000));
++ if (!IS_ENABLED(CONFIG_MODULES) ||
++ !request_module("i915")) {
++ /* 60s timeout */
++ wait_for_completion_timeout(&bind_complete,
++ msecs_to_jiffies(60 * 1000));
++ }
+ }
+ if (!acomp->ops) {
+ dev_info(bus->dev, "couldn't bind with audio component\n");
+diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
+index abed594a9653..b8f3cca8e58b 100644
+--- a/tools/objtool/elf.c
++++ b/tools/objtool/elf.c
+@@ -305,7 +305,7 @@ static int read_symbols(struct elf *elf)
+ if (sym->type != STT_FUNC)
+ continue;
+ sym->pfunc = sym->cfunc = sym;
+- coldstr = strstr(sym->name, ".cold.");
++ coldstr = strstr(sym->name, ".cold");
+ if (!coldstr)
+ continue;
+
+diff --git a/tools/perf/builtin-version.c b/tools/perf/builtin-version.c
+index 50df168be326..b02c96104640 100644
+--- a/tools/perf/builtin-version.c
++++ b/tools/perf/builtin-version.c
+@@ -19,6 +19,7 @@ static struct version version;
+ static struct option version_options[] = {
+ OPT_BOOLEAN(0, "build-options", &version.build_options,
+ "display the build options"),
++ OPT_END(),
+ };
+
+ static const char * const version_usage[] = {
+diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c
+index 14c9fe284806..075cb0c73014 100644
+--- a/tools/testing/selftests/cgroup/cgroup_util.c
++++ b/tools/testing/selftests/cgroup/cgroup_util.c
+@@ -181,8 +181,7 @@ int cg_find_unified_root(char *root, size_t len)
+ strtok(NULL, delim);
+ strtok(NULL, delim);
+
+- if (strcmp(fs, "cgroup") == 0 &&
+- strcmp(type, "cgroup2") == 0) {
++ if (strcmp(type, "cgroup2") == 0) {
+ strncpy(root, mount, len);
+ return 0;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-08-09 17:45 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-08-09 17:45 UTC (permalink / raw
To: gentoo-commits
commit: dbcb182ad192aecf33b5bc1c3893fe60e22b3b67
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 9 17:45:37 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug 9 17:45:37 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dbcb182a
Linux patch 4.19.66
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1065_linux-4.19.66.patch | 2321 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2325 insertions(+)
diff --git a/0000_README b/0000_README
index 2679f40..6813edb 100644
--- a/0000_README
+++ b/0000_README
@@ -303,6 +303,10 @@ Patch: 1064_linux-4.19.65.patch
From: https://www.kernel.org
Desc: Linux 4.19.65
+Patch: 1065_linux-4.19.66.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.66
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1065_linux-4.19.66.patch b/1065_linux-4.19.66.patch
new file mode 100644
index 0000000..1b0d353
--- /dev/null
+++ b/1065_linux-4.19.66.patch
@@ -0,0 +1,2321 @@
+diff --git a/Makefile b/Makefile
+index 41a565770431..065e5b34dc02 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 65
++SUBLEVEL = 66
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
+index 82532c299bb5..008905d4152a 100644
+--- a/drivers/atm/iphase.c
++++ b/drivers/atm/iphase.c
+@@ -63,6 +63,7 @@
+ #include <asm/byteorder.h>
+ #include <linux/vmalloc.h>
+ #include <linux/jiffies.h>
++#include <linux/nospec.h>
+ #include "iphase.h"
+ #include "suni.h"
+ #define swap_byte_order(x) (((x & 0xff) << 8) | ((x & 0xff00) >> 8))
+@@ -2760,8 +2761,11 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
+ }
+ if (copy_from_user(&ia_cmds, arg, sizeof ia_cmds)) return -EFAULT;
+ board = ia_cmds.status;
+- if ((board < 0) || (board > iadev_count))
+- board = 0;
++
++ if ((board < 0) || (board > iadev_count))
++ board = 0;
++ board = array_index_nospec(board, iadev_count + 1);
++
+ iadev = ia_dev[board];
+ switch (ia_cmds.cmd) {
+ case MEMDUMP:
+diff --git a/drivers/base/base.h b/drivers/base/base.h
+index 7a419a7a6235..559b047de9f7 100644
+--- a/drivers/base/base.h
++++ b/drivers/base/base.h
+@@ -66,6 +66,9 @@ struct driver_private {
+ * probed first.
+ * @device - pointer back to the struct device that this structure is
+ * associated with.
++ * @dead - This device is currently either in the process of or has been
++ * removed from the system. Any asynchronous events scheduled for this
++ * device should exit without taking any action.
+ *
+ * Nothing outside of the driver core should ever touch these fields.
+ */
+@@ -76,6 +79,7 @@ struct device_private {
+ struct klist_node knode_bus;
+ struct list_head deferred_probe;
+ struct device *device;
++ u8 dead:1;
+ };
+ #define to_device_private_parent(obj) \
+ container_of(obj, struct device_private, knode_parent)
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 92e2c32c2227..e1a8d5c06f65 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -2031,6 +2031,24 @@ void put_device(struct device *dev)
+ }
+ EXPORT_SYMBOL_GPL(put_device);
+
++bool kill_device(struct device *dev)
++{
++ /*
++ * Require the device lock and set the "dead" flag to guarantee that
++ * the update behavior is consistent with the other bitfields near
++ * it and that we cannot have an asynchronous probe routine trying
++ * to run while we are tearing out the bus/class/sysfs from
++ * underneath the device.
++ */
++ lockdep_assert_held(&dev->mutex);
++
++ if (dev->p->dead)
++ return false;
++ dev->p->dead = true;
++ return true;
++}
++EXPORT_SYMBOL_GPL(kill_device);
++
+ /**
+ * device_del - delete device from system.
+ * @dev: device.
+@@ -2050,6 +2068,10 @@ void device_del(struct device *dev)
+ struct kobject *glue_dir = NULL;
+ struct class_interface *class_intf;
+
++ device_lock(dev);
++ kill_device(dev);
++ device_unlock(dev);
++
+ /* Notify clients of device removal. This call must come
+ * before dpm_sysfs_remove().
+ */
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index d48b310c4760..11d24a552ee4 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -725,15 +725,6 @@ static int __device_attach_driver(struct device_driver *drv, void *_data)
+ bool async_allowed;
+ int ret;
+
+- /*
+- * Check if device has already been claimed. This may
+- * happen with driver loading, device discovery/registration,
+- * and deferred probe processing happens all at once with
+- * multiple threads.
+- */
+- if (dev->driver)
+- return -EBUSY;
+-
+ ret = driver_match_device(drv, dev);
+ if (ret == 0) {
+ /* no match */
+@@ -768,6 +759,15 @@ static void __device_attach_async_helper(void *_dev, async_cookie_t cookie)
+
+ device_lock(dev);
+
++ /*
++ * Check if device has already been removed or claimed. This may
++ * happen with driver loading, device discovery/registration,
++ * and deferred probe processing happens all at once with
++ * multiple threads.
++ */
++ if (dev->p->dead || dev->driver)
++ goto out_unlock;
++
+ if (dev->parent)
+ pm_runtime_get_sync(dev->parent);
+
+@@ -778,7 +778,7 @@ static void __device_attach_async_helper(void *_dev, async_cookie_t cookie)
+
+ if (dev->parent)
+ pm_runtime_put(dev->parent);
+-
++out_unlock:
+ device_unlock(dev);
+
+ put_device(dev);
+@@ -891,7 +891,7 @@ static int __driver_attach(struct device *dev, void *data)
+ if (dev->parent && dev->bus->need_parent_lock)
+ device_lock(dev->parent);
+ device_lock(dev);
+- if (!dev->driver)
++ if (!dev->p->dead && !dev->driver)
+ driver_probe_device(drv, dev);
+ device_unlock(dev);
+ if (dev->parent && dev->bus->need_parent_lock)
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 50b3c0d89c9c..2898bb061945 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -559,6 +559,7 @@
+ #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A 0x094a
++#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641 0x0641
+
+ #define USB_VENDOR_ID_HUION 0x256c
+ #define USB_DEVICE_ID_HUION_TABLET 0x006e
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 91e86af44a04..d29c7c9cd185 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -94,6 +94,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL },
++ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X), HID_QUIRK_MULTI_INPUT },
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 0ae848369474..e56dc97fe4b6 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -537,14 +537,14 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
+ */
+ buttons = (data[4] << 1) | (data[3] & 0x01);
+ } else if (features->type == CINTIQ_COMPANION_2) {
+- /* d-pad right -> data[4] & 0x10
+- * d-pad up -> data[4] & 0x20
+- * d-pad left -> data[4] & 0x40
+- * d-pad down -> data[4] & 0x80
+- * d-pad center -> data[3] & 0x01
++ /* d-pad right -> data[2] & 0x10
++ * d-pad up -> data[2] & 0x20
++ * d-pad left -> data[2] & 0x40
++ * d-pad down -> data[2] & 0x80
++ * d-pad center -> data[1] & 0x01
+ */
+ buttons = ((data[2] >> 4) << 7) |
+- ((data[1] & 0x04) << 6) |
++ ((data[1] & 0x04) << 4) |
+ ((data[2] & 0x0F) << 2) |
+ (data[1] & 0x03);
+ } else if (features->type >= INTUOS5S && features->type <= INTUOSPL) {
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 5b0e1d9e5adc..1de10e5c70d7 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -185,7 +185,7 @@ static int i2c_generic_bus_free(struct i2c_adapter *adap)
+ int i2c_generic_scl_recovery(struct i2c_adapter *adap)
+ {
+ struct i2c_bus_recovery_info *bri = adap->bus_recovery_info;
+- int i = 0, scl = 1, ret;
++ int i = 0, scl = 1, ret = 0;
+
+ if (bri->prepare_recovery)
+ bri->prepare_recovery(adap);
+diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
+index 7b794a14d6e8..8be082edf986 100644
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -1232,7 +1232,6 @@ static int roce_resolve_route_from_path(struct sa_path_rec *rec,
+ {
+ struct rdma_dev_addr dev_addr = {};
+ union {
+- struct sockaddr _sockaddr;
+ struct sockaddr_in _sockaddr_in;
+ struct sockaddr_in6 _sockaddr_in6;
+ } sgid_addr, dgid_addr;
+@@ -1249,12 +1248,12 @@ static int roce_resolve_route_from_path(struct sa_path_rec *rec,
+ */
+ dev_addr.net = &init_net;
+
+- rdma_gid2ip(&sgid_addr._sockaddr, &rec->sgid);
+- rdma_gid2ip(&dgid_addr._sockaddr, &rec->dgid);
++ rdma_gid2ip((struct sockaddr *)&sgid_addr, &rec->sgid);
++ rdma_gid2ip((struct sockaddr *)&dgid_addr, &rec->dgid);
+
+ /* validate the route */
+- ret = rdma_resolve_ip_route(&sgid_addr._sockaddr,
+- &dgid_addr._sockaddr, &dev_addr);
++ ret = rdma_resolve_ip_route((struct sockaddr *)&sgid_addr,
++ (struct sockaddr *)&dgid_addr, &dev_addr);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 3edb81a4f075..33baa17fa9d5 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -1936,8 +1936,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
+ }
+
+ /* select a non-FCoE queue */
+- return fallback(dev, skb, NULL) %
+- (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos);
++ return fallback(dev, skb, NULL) % (BNX2X_NUM_ETH_QUEUES(bp));
+ }
+
+ void bnx2x_set_num_queues(struct bnx2x *bp)
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index df5b74f289e1..6455511457ca 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -3501,6 +3501,7 @@ static int mvpp2_set_mac_address(struct net_device *dev, void *p)
+ static int mvpp2_change_mtu(struct net_device *dev, int mtu)
+ {
+ struct mvpp2_port *port = netdev_priv(dev);
++ bool running = netif_running(dev);
+ int err;
+
+ if (!IS_ALIGNED(MVPP2_RX_PKT_SIZE(mtu), 8)) {
+@@ -3509,40 +3510,24 @@ static int mvpp2_change_mtu(struct net_device *dev, int mtu)
+ mtu = ALIGN(MVPP2_RX_PKT_SIZE(mtu), 8);
+ }
+
+- if (!netif_running(dev)) {
+- err = mvpp2_bm_update_mtu(dev, mtu);
+- if (!err) {
+- port->pkt_size = MVPP2_RX_PKT_SIZE(mtu);
+- return 0;
+- }
+-
+- /* Reconfigure BM to the original MTU */
+- err = mvpp2_bm_update_mtu(dev, dev->mtu);
+- if (err)
+- goto log_error;
+- }
+-
+- mvpp2_stop_dev(port);
++ if (running)
++ mvpp2_stop_dev(port);
+
+ err = mvpp2_bm_update_mtu(dev, mtu);
+- if (!err) {
++ if (err) {
++ netdev_err(dev, "failed to change MTU\n");
++ /* Reconfigure BM to the original MTU */
++ mvpp2_bm_update_mtu(dev, dev->mtu);
++ } else {
+ port->pkt_size = MVPP2_RX_PKT_SIZE(mtu);
+- goto out_start;
+ }
+
+- /* Reconfigure BM to the original MTU */
+- err = mvpp2_bm_update_mtu(dev, dev->mtu);
+- if (err)
+- goto log_error;
+-
+-out_start:
+- mvpp2_start_dev(port);
+- mvpp2_egress_enable(port);
+- mvpp2_ingress_enable(port);
++ if (running) {
++ mvpp2_start_dev(port);
++ mvpp2_egress_enable(port);
++ mvpp2_ingress_enable(port);
++ }
+
+- return 0;
+-log_error:
+- netdev_err(dev, "failed to change MTU\n");
+ return err;
+ }
+
+@@ -5358,9 +5343,6 @@ static int mvpp2_remove(struct platform_device *pdev)
+
+ mvpp2_dbgfs_cleanup(priv);
+
+- flush_workqueue(priv->stats_queue);
+- destroy_workqueue(priv->stats_queue);
+-
+ fwnode_for_each_available_child_node(fwnode, port_fwnode) {
+ if (priv->port_list[i]) {
+ mutex_destroy(&priv->port_list[i]->gather_stats_lock);
+@@ -5369,6 +5351,8 @@ static int mvpp2_remove(struct platform_device *pdev)
+ i++;
+ }
+
++ destroy_workqueue(priv->stats_queue);
++
+ for (i = 0; i < MVPP2_BM_POOLS_NUM; i++) {
+ struct mvpp2_bm_pool *bm_pool = &priv->bm_pools[i];
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+index 1c225be9c7db..3692d6a1cce8 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+@@ -307,7 +307,7 @@ void mlx5_unregister_device(struct mlx5_core_dev *dev)
+ struct mlx5_interface *intf;
+
+ mutex_lock(&mlx5_intf_mutex);
+- list_for_each_entry(intf, &intf_list, list)
++ list_for_each_entry_reverse(intf, &intf_list, list)
+ mlx5_remove_device(intf, priv);
+ list_del(&priv->dev_list);
+ mutex_unlock(&mlx5_intf_mutex);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 0f1c296c3ce4..83ab2c0e6b61 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -420,12 +420,11 @@ static inline u64 mlx5e_get_mpwqe_offset(struct mlx5e_rq *rq, u16 wqe_ix)
+
+ static void mlx5e_init_frags_partition(struct mlx5e_rq *rq)
+ {
+- struct mlx5e_wqe_frag_info next_frag, *prev;
++ struct mlx5e_wqe_frag_info next_frag = {};
++ struct mlx5e_wqe_frag_info *prev = NULL;
+ int i;
+
+ next_frag.di = &rq->wqe.di[0];
+- next_frag.offset = 0;
+- prev = NULL;
+
+ for (i = 0; i < mlx5_wq_cyc_get_size(&rq->wqe.wq); i++) {
+ struct mlx5e_rq_frag_info *frag_info = &rq->wqe.info.arr[0];
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index 9f7f8425f676..c8928ce69185 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -992,13 +992,13 @@ void mlx5e_tc_encap_flows_del(struct mlx5e_priv *priv,
+ void mlx5e_tc_update_neigh_used_value(struct mlx5e_neigh_hash_entry *nhe)
+ {
+ struct mlx5e_neigh *m_neigh = &nhe->m_neigh;
+- u64 bytes, packets, lastuse = 0;
+ struct mlx5e_tc_flow *flow;
+ struct mlx5e_encap_entry *e;
+ struct mlx5_fc *counter;
+ struct neigh_table *tbl;
+ bool neigh_used = false;
+ struct neighbour *n;
++ u64 lastuse;
+
+ if (m_neigh->family == AF_INET)
+ tbl = &arp_tbl;
+@@ -1015,7 +1015,7 @@ void mlx5e_tc_update_neigh_used_value(struct mlx5e_neigh_hash_entry *nhe)
+ list_for_each_entry(flow, &e->flows, encap) {
+ if (flow->flags & MLX5E_TC_FLOW_OFFLOADED) {
+ counter = mlx5_flow_rule_counter(flow->rule[0]);
+- mlx5_fc_query_cached(counter, &bytes, &packets, &lastuse);
++ lastuse = mlx5_fc_query_lastuse(counter);
+ if (time_after((unsigned long)lastuse, nhe->reported_lastuse)) {
+ neigh_used = true;
+ break;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
+index 58af6be13dfa..808ddd732e04 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
+@@ -321,6 +321,11 @@ int mlx5_fc_query(struct mlx5_core_dev *dev, struct mlx5_fc *counter,
+ }
+ EXPORT_SYMBOL(mlx5_fc_query);
+
++u64 mlx5_fc_query_lastuse(struct mlx5_fc *counter)
++{
++ return counter->cache.lastuse;
++}
++
+ void mlx5_fc_query_cached(struct mlx5_fc *counter,
+ u64 *bytes, u64 *packets, u64 *lastuse)
+ {
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index 0cab06046e5d..ee126bcf7c35 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -5032,7 +5032,7 @@ static int __init mlxsw_sp_module_init(void)
+ return 0;
+
+ err_sp2_pci_driver_register:
+- mlxsw_pci_driver_unregister(&mlxsw_sp2_pci_driver);
++ mlxsw_pci_driver_unregister(&mlxsw_sp1_pci_driver);
+ err_sp1_pci_driver_register:
+ mlxsw_core_driver_unregister(&mlxsw_sp2_driver);
+ err_sp2_core_driver_register:
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 10291198decd..732ba21d3369 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -1767,6 +1767,7 @@ EXPORT_SYMBOL(ocelot_init);
+
+ void ocelot_deinit(struct ocelot *ocelot)
+ {
++ cancel_delayed_work(&ocelot->stats_work);
+ destroy_workqueue(ocelot->stats_queue);
+ mutex_destroy(&ocelot->stats_lock);
+ }
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
+index 884f1f52dcc2..70879a3ab567 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
+@@ -59,7 +59,7 @@ struct rmnet_map_dl_csum_trailer {
+ struct rmnet_map_ul_csum_header {
+ __be16 csum_start_offset;
+ u16 csum_insert_offset:14;
+- u16 udp_ip4_ind:1;
++ u16 udp_ind:1;
+ u16 csum_enabled:1;
+ } __aligned(1);
+
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+index 57a9c314a665..b2090cedd2e9 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+@@ -215,9 +215,9 @@ rmnet_map_ipv4_ul_csum_header(void *iphdr,
+ ul_header->csum_insert_offset = skb->csum_offset;
+ ul_header->csum_enabled = 1;
+ if (ip4h->protocol == IPPROTO_UDP)
+- ul_header->udp_ip4_ind = 1;
++ ul_header->udp_ind = 1;
+ else
+- ul_header->udp_ip4_ind = 0;
++ ul_header->udp_ind = 0;
+
+ /* Changing remaining fields to network order */
+ hdr++;
+@@ -248,6 +248,7 @@ rmnet_map_ipv6_ul_csum_header(void *ip6hdr,
+ struct rmnet_map_ul_csum_header *ul_header,
+ struct sk_buff *skb)
+ {
++ struct ipv6hdr *ip6h = (struct ipv6hdr *)ip6hdr;
+ __be16 *hdr = (__be16 *)ul_header, offset;
+
+ offset = htons((__force u16)(skb_transport_header(skb) -
+@@ -255,7 +256,11 @@ rmnet_map_ipv6_ul_csum_header(void *ip6hdr,
+ ul_header->csum_start_offset = offset;
+ ul_header->csum_insert_offset = skb->csum_offset;
+ ul_header->csum_enabled = 1;
+- ul_header->udp_ip4_ind = 0;
++
++ if (ip6h->nexthdr == IPPROTO_UDP)
++ ul_header->udp_ind = 1;
++ else
++ ul_header->udp_ind = 0;
+
+ /* Changing remaining fields to network order */
+ hdr++;
+@@ -428,7 +433,7 @@ sw_csum:
+ ul_header->csum_start_offset = 0;
+ ul_header->csum_insert_offset = 0;
+ ul_header->csum_enabled = 0;
+- ul_header->udp_ip4_ind = 0;
++ ul_header->udp_ind = 0;
+
+ priv->stats.csum_sw++;
+ }
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index a6992c4c7313..0c8b7146637e 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -7239,13 +7239,18 @@ static int rtl_alloc_irq(struct rtl8169_private *tp)
+ {
+ unsigned int flags;
+
+- if (tp->mac_version <= RTL_GIGA_MAC_VER_06) {
++ switch (tp->mac_version) {
++ case RTL_GIGA_MAC_VER_02 ... RTL_GIGA_MAC_VER_06:
+ RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
+ RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~MSIEnable);
+ RTL_W8(tp, Cfg9346, Cfg9346_Lock);
++ /* fall through */
++ case RTL_GIGA_MAC_VER_07 ... RTL_GIGA_MAC_VER_24:
+ flags = PCI_IRQ_LEGACY;
+- } else {
++ break;
++ default:
+ flags = PCI_IRQ_ALL_TYPES;
++ break;
+ }
+
+ return pci_alloc_irq_vectors(tp->pci_dev, 1, 1, flags);
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index e029c7977a56..2e8056d48f4a 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -226,6 +226,8 @@ static int phylink_parse_fixedlink(struct phylink *pl,
+ __ETHTOOL_LINK_MODE_MASK_NBITS, true);
+ linkmode_zero(pl->supported);
+ phylink_set(pl->supported, MII);
++ phylink_set(pl->supported, Pause);
++ phylink_set(pl->supported, Asym_Pause);
+ if (s) {
+ __set_bit(s->bit, pl->supported);
+ } else {
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index f22639f0116a..c04f3dc17d76 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -1120,6 +1120,9 @@ static const struct proto_ops pppoe_ops = {
+ .recvmsg = pppoe_recvmsg,
+ .mmap = sock_no_mmap,
+ .ioctl = pppox_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = pppox_compat_ioctl,
++#endif
+ };
+
+ static const struct pppox_proto pppoe_proto = {
+diff --git a/drivers/net/ppp/pppox.c b/drivers/net/ppp/pppox.c
+index c0599b3b23c0..9128e42e33e7 100644
+--- a/drivers/net/ppp/pppox.c
++++ b/drivers/net/ppp/pppox.c
+@@ -22,6 +22,7 @@
+ #include <linux/string.h>
+ #include <linux/module.h>
+ #include <linux/kernel.h>
++#include <linux/compat.h>
+ #include <linux/errno.h>
+ #include <linux/netdevice.h>
+ #include <linux/net.h>
+@@ -103,6 +104,18 @@ int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+
+ EXPORT_SYMBOL(pppox_ioctl);
+
++#ifdef CONFIG_COMPAT
++int pppox_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
++{
++ if (cmd == PPPOEIOCSFWD32)
++ cmd = PPPOEIOCSFWD;
++
++ return pppox_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
++}
++
++EXPORT_SYMBOL(pppox_compat_ioctl);
++#endif
++
+ static int pppox_create(struct net *net, struct socket *sock, int protocol,
+ int kern)
+ {
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index 7321a4eca235..9ad3ff40a563 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -633,6 +633,9 @@ static const struct proto_ops pptp_ops = {
+ .recvmsg = sock_no_recvmsg,
+ .mmap = sock_no_mmap,
+ .ioctl = pppox_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = pppox_compat_ioctl,
++#endif
+ };
+
+ static const struct pppox_proto pppox_pptp_proto = {
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index b67fee56ec81..5fa7047ea361 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1682,6 +1682,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
+
+ skb_reserve(skb, pad - delta);
+ skb_put(skb, len);
++ skb_set_owner_w(skb, tfile->socket.sk);
+ get_page(alloc_frag->page);
+ alloc_frag->offset += buflen;
+
+diff --git a/drivers/nfc/nfcmrvl/main.c b/drivers/nfc/nfcmrvl/main.c
+index e65d027b91fa..529be35ac178 100644
+--- a/drivers/nfc/nfcmrvl/main.c
++++ b/drivers/nfc/nfcmrvl/main.c
+@@ -244,7 +244,7 @@ void nfcmrvl_chip_reset(struct nfcmrvl_private *priv)
+ /* Reset possible fault of previous session */
+ clear_bit(NFCMRVL_PHY_ERROR, &priv->flags);
+
+- if (priv->config.reset_n_io) {
++ if (gpio_is_valid(priv->config.reset_n_io)) {
+ nfc_info(priv->dev, "reset the chip\n");
+ gpio_set_value(priv->config.reset_n_io, 0);
+ usleep_range(5000, 10000);
+@@ -255,7 +255,7 @@ void nfcmrvl_chip_reset(struct nfcmrvl_private *priv)
+
+ void nfcmrvl_chip_halt(struct nfcmrvl_private *priv)
+ {
+- if (priv->config.reset_n_io)
++ if (gpio_is_valid(priv->config.reset_n_io))
+ gpio_set_value(priv->config.reset_n_io, 0);
+ }
+
+diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c
+index 9a22056e8d9e..e5a622ce4b95 100644
+--- a/drivers/nfc/nfcmrvl/uart.c
++++ b/drivers/nfc/nfcmrvl/uart.c
+@@ -26,7 +26,7 @@
+ static unsigned int hci_muxed;
+ static unsigned int flow_control;
+ static unsigned int break_control;
+-static unsigned int reset_n_io;
++static int reset_n_io = -EINVAL;
+
+ /*
+ ** NFCMRVL NCI OPS
+@@ -231,5 +231,5 @@ MODULE_PARM_DESC(break_control, "Tell if UART driver must drive break signal.");
+ module_param(hci_muxed, uint, 0);
+ MODULE_PARM_DESC(hci_muxed, "Tell if transport is muxed in HCI one.");
+
+-module_param(reset_n_io, uint, 0);
++module_param(reset_n_io, int, 0);
+ MODULE_PARM_DESC(reset_n_io, "GPIO that is wired to RESET_N signal.");
+diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
+index 945cc903d8f1..888e298f610b 100644
+--- a/drivers/nfc/nfcmrvl/usb.c
++++ b/drivers/nfc/nfcmrvl/usb.c
+@@ -305,6 +305,7 @@ static int nfcmrvl_probe(struct usb_interface *intf,
+
+ /* No configuration for USB */
+ memset(&config, 0, sizeof(config));
++ config.reset_n_io = -EINVAL;
+
+ nfc_info(&udev->dev, "intf %p id %p\n", intf, id);
+
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index ee39e2c1644a..2ba22cd1331b 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -528,13 +528,38 @@ EXPORT_SYMBOL(nd_device_register);
+
+ void nd_device_unregister(struct device *dev, enum nd_async_mode mode)
+ {
++ bool killed;
++
+ switch (mode) {
+ case ND_ASYNC:
++ /*
++ * In the async case this is being triggered with the
++ * device lock held and the unregistration work needs to
++ * be moved out of line iff this is thread has won the
++ * race to schedule the deletion.
++ */
++ if (!kill_device(dev))
++ return;
++
+ get_device(dev);
+ async_schedule_domain(nd_async_device_unregister, dev,
+ &nd_async_domain);
+ break;
+ case ND_SYNC:
++ /*
++ * In the sync case the device is being unregistered due
++ * to a state change of the parent. Claim the kill state
++ * to synchronize against other unregistration requests,
++ * or otherwise let the async path handle it if the
++ * unregistration was already queued.
++ */
++ device_lock(dev);
++ killed = kill_device(dev);
++ device_unlock(dev);
++
++ if (!killed)
++ return;
++
+ nd_synchronize();
+ device_unregister(dev);
+ break;
+@@ -840,10 +865,12 @@ void wait_nvdimm_bus_probe_idle(struct device *dev)
+ do {
+ if (nvdimm_bus->probe_active == 0)
+ break;
+- nvdimm_bus_unlock(&nvdimm_bus->dev);
++ nvdimm_bus_unlock(dev);
++ device_unlock(dev);
+ wait_event(nvdimm_bus->wait,
+ nvdimm_bus->probe_active == 0);
+- nvdimm_bus_lock(&nvdimm_bus->dev);
++ device_lock(dev);
++ nvdimm_bus_lock(dev);
+ } while (true);
+ }
+
+@@ -926,20 +953,19 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ int read_only, unsigned int ioctl_cmd, unsigned long arg)
+ {
+ struct nvdimm_bus_descriptor *nd_desc = nvdimm_bus->nd_desc;
+- static char out_env[ND_CMD_MAX_ENVELOPE];
+- static char in_env[ND_CMD_MAX_ENVELOPE];
+ const struct nd_cmd_desc *desc = NULL;
+ unsigned int cmd = _IOC_NR(ioctl_cmd);
+ struct device *dev = &nvdimm_bus->dev;
+ void __user *p = (void __user *) arg;
++ char *out_env = NULL, *in_env = NULL;
+ const char *cmd_name, *dimm_name;
+ u32 in_len = 0, out_len = 0;
+ unsigned int func = cmd;
+ unsigned long cmd_mask;
+ struct nd_cmd_pkg pkg;
+ int rc, i, cmd_rc;
++ void *buf = NULL;
+ u64 buf_len = 0;
+- void *buf;
+
+ if (nvdimm) {
+ desc = nd_cmd_dimm_desc(cmd);
+@@ -970,7 +996,7 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ case ND_CMD_ARS_START:
+ case ND_CMD_CLEAR_ERROR:
+ case ND_CMD_CALL:
+- dev_dbg(&nvdimm_bus->dev, "'%s' command while read-only.\n",
++ dev_dbg(dev, "'%s' command while read-only.\n",
+ nvdimm ? nvdimm_cmd_name(cmd)
+ : nvdimm_bus_cmd_name(cmd));
+ return -EPERM;
+@@ -979,6 +1005,9 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ }
+
+ /* process an input envelope */
++ in_env = kzalloc(ND_CMD_MAX_ENVELOPE, GFP_KERNEL);
++ if (!in_env)
++ return -ENOMEM;
+ for (i = 0; i < desc->in_num; i++) {
+ u32 in_size, copy;
+
+@@ -986,14 +1015,17 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ if (in_size == UINT_MAX) {
+ dev_err(dev, "%s:%s unknown input size cmd: %s field: %d\n",
+ __func__, dimm_name, cmd_name, i);
+- return -ENXIO;
++ rc = -ENXIO;
++ goto out;
+ }
+- if (in_len < sizeof(in_env))
+- copy = min_t(u32, sizeof(in_env) - in_len, in_size);
++ if (in_len < ND_CMD_MAX_ENVELOPE)
++ copy = min_t(u32, ND_CMD_MAX_ENVELOPE - in_len, in_size);
+ else
+ copy = 0;
+- if (copy && copy_from_user(&in_env[in_len], p + in_len, copy))
+- return -EFAULT;
++ if (copy && copy_from_user(&in_env[in_len], p + in_len, copy)) {
++ rc = -EFAULT;
++ goto out;
++ }
+ in_len += in_size;
+ }
+
+@@ -1005,6 +1037,12 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ }
+
+ /* process an output envelope */
++ out_env = kzalloc(ND_CMD_MAX_ENVELOPE, GFP_KERNEL);
++ if (!out_env) {
++ rc = -ENOMEM;
++ goto out;
++ }
++
+ for (i = 0; i < desc->out_num; i++) {
+ u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i,
+ (u32 *) in_env, (u32 *) out_env, 0);
+@@ -1013,15 +1051,18 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ if (out_size == UINT_MAX) {
+ dev_dbg(dev, "%s unknown output size cmd: %s field: %d\n",
+ dimm_name, cmd_name, i);
+- return -EFAULT;
++ rc = -EFAULT;
++ goto out;
+ }
+- if (out_len < sizeof(out_env))
+- copy = min_t(u32, sizeof(out_env) - out_len, out_size);
++ if (out_len < ND_CMD_MAX_ENVELOPE)
++ copy = min_t(u32, ND_CMD_MAX_ENVELOPE - out_len, out_size);
+ else
+ copy = 0;
+ if (copy && copy_from_user(&out_env[out_len],
+- p + in_len + out_len, copy))
+- return -EFAULT;
++ p + in_len + out_len, copy)) {
++ rc = -EFAULT;
++ goto out;
++ }
+ out_len += out_size;
+ }
+
+@@ -1029,19 +1070,23 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ if (buf_len > ND_IOCTL_MAX_BUFLEN) {
+ dev_dbg(dev, "%s cmd: %s buf_len: %llu > %d\n", dimm_name,
+ cmd_name, buf_len, ND_IOCTL_MAX_BUFLEN);
+- return -EINVAL;
++ rc = -EINVAL;
++ goto out;
+ }
+
+ buf = vmalloc(buf_len);
+- if (!buf)
+- return -ENOMEM;
++ if (!buf) {
++ rc = -ENOMEM;
++ goto out;
++ }
+
+ if (copy_from_user(buf, p, buf_len)) {
+ rc = -EFAULT;
+ goto out;
+ }
+
+- nvdimm_bus_lock(&nvdimm_bus->dev);
++ device_lock(dev);
++ nvdimm_bus_lock(dev);
+ rc = nd_cmd_clear_to_send(nvdimm_bus, nvdimm, func, buf);
+ if (rc)
+ goto out_unlock;
+@@ -1056,17 +1101,16 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ nvdimm_account_cleared_poison(nvdimm_bus, clear_err->address,
+ clear_err->cleared);
+ }
+- nvdimm_bus_unlock(&nvdimm_bus->dev);
+
+ if (copy_to_user(p, buf, buf_len))
+ rc = -EFAULT;
+
+- vfree(buf);
+- return rc;
+-
+- out_unlock:
+- nvdimm_bus_unlock(&nvdimm_bus->dev);
+- out:
++out_unlock:
++ nvdimm_bus_unlock(dev);
++ device_unlock(dev);
++out:
++ kfree(in_env);
++ kfree(out_env);
+ vfree(buf);
+ return rc;
+ }
+diff --git a/drivers/nvdimm/region.c b/drivers/nvdimm/region.c
+index b9ca0033cc99..f9130cc157e8 100644
+--- a/drivers/nvdimm/region.c
++++ b/drivers/nvdimm/region.c
+@@ -42,17 +42,6 @@ static int nd_region_probe(struct device *dev)
+ if (rc)
+ return rc;
+
+- rc = nd_region_register_namespaces(nd_region, &err);
+- if (rc < 0)
+- return rc;
+-
+- ndrd = dev_get_drvdata(dev);
+- ndrd->ns_active = rc;
+- ndrd->ns_count = rc + err;
+-
+- if (rc && err && rc == err)
+- return -ENODEV;
+-
+ if (is_nd_pmem(&nd_region->dev)) {
+ struct resource ndr_res;
+
+@@ -68,6 +57,17 @@ static int nd_region_probe(struct device *dev)
+ nvdimm_badblocks_populate(nd_region, &nd_region->bb, &ndr_res);
+ }
+
++ rc = nd_region_register_namespaces(nd_region, &err);
++ if (rc < 0)
++ return rc;
++
++ ndrd = dev_get_drvdata(dev);
++ ndrd->ns_active = rc;
++ ndrd->ns_count = rc + err;
++
++ if (rc && err && rc == err)
++ return -ENODEV;
++
+ nd_region->btt_seed = nd_btt_create(nd_region);
+ nd_region->pfn_seed = nd_pfn_create(nd_region);
+ nd_region->dax_seed = nd_dax_create(nd_region);
+diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
+index e7377f1028ef..0303296e6d5b 100644
+--- a/drivers/nvdimm/region_devs.c
++++ b/drivers/nvdimm/region_devs.c
+@@ -425,10 +425,12 @@ static ssize_t available_size_show(struct device *dev,
+ * memory nvdimm_bus_lock() is dropped, but that's userspace's
+ * problem to not race itself.
+ */
++ device_lock(dev);
+ nvdimm_bus_lock(dev);
+ wait_nvdimm_bus_probe_idle(dev);
+ available = nd_region_available_dpa(nd_region);
+ nvdimm_bus_unlock(dev);
++ device_unlock(dev);
+
+ return sprintf(buf, "%llu\n", available);
+ }
+@@ -440,10 +442,12 @@ static ssize_t max_available_extent_show(struct device *dev,
+ struct nd_region *nd_region = to_nd_region(dev);
+ unsigned long long available = 0;
+
++ device_lock(dev);
+ nvdimm_bus_lock(dev);
+ wait_nvdimm_bus_probe_idle(dev);
+ available = nd_region_allocatable_dpa(nd_region);
+ nvdimm_bus_unlock(dev);
++ device_unlock(dev);
+
+ return sprintf(buf, "%llu\n", available);
+ }
+diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
+index 7dc4ffa24430..24cbd0a2cc69 100644
+--- a/drivers/scsi/fcoe/fcoe_ctlr.c
++++ b/drivers/scsi/fcoe/fcoe_ctlr.c
+@@ -2017,7 +2017,7 @@ EXPORT_SYMBOL_GPL(fcoe_wwn_from_mac);
+ */
+ static inline struct fcoe_rport *fcoe_ctlr_rport(struct fc_rport_priv *rdata)
+ {
+- return (struct fcoe_rport *)(rdata + 1);
++ return container_of(rdata, struct fcoe_rport, rdata);
+ }
+
+ /**
+@@ -2281,7 +2281,7 @@ static void fcoe_ctlr_vn_start(struct fcoe_ctlr *fip)
+ */
+ static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip,
+ struct sk_buff *skb,
+- struct fc_rport_priv *rdata)
++ struct fcoe_rport *frport)
+ {
+ struct fip_header *fiph;
+ struct fip_desc *desc = NULL;
+@@ -2289,16 +2289,12 @@ static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip,
+ struct fip_wwn_desc *wwn = NULL;
+ struct fip_vn_desc *vn = NULL;
+ struct fip_size_desc *size = NULL;
+- struct fcoe_rport *frport;
+ size_t rlen;
+ size_t dlen;
+ u32 desc_mask = 0;
+ u32 dtype;
+ u8 sub;
+
+- memset(rdata, 0, sizeof(*rdata) + sizeof(*frport));
+- frport = fcoe_ctlr_rport(rdata);
+-
+ fiph = (struct fip_header *)skb->data;
+ frport->flags = ntohs(fiph->fip_flags);
+
+@@ -2361,15 +2357,17 @@ static int fcoe_ctlr_vn_parse(struct fcoe_ctlr *fip,
+ if (dlen != sizeof(struct fip_wwn_desc))
+ goto len_err;
+ wwn = (struct fip_wwn_desc *)desc;
+- rdata->ids.node_name = get_unaligned_be64(&wwn->fd_wwn);
++ frport->rdata.ids.node_name =
++ get_unaligned_be64(&wwn->fd_wwn);
+ break;
+ case FIP_DT_VN_ID:
+ if (dlen != sizeof(struct fip_vn_desc))
+ goto len_err;
+ vn = (struct fip_vn_desc *)desc;
+ memcpy(frport->vn_mac, vn->fd_mac, ETH_ALEN);
+- rdata->ids.port_id = ntoh24(vn->fd_fc_id);
+- rdata->ids.port_name = get_unaligned_be64(&vn->fd_wwpn);
++ frport->rdata.ids.port_id = ntoh24(vn->fd_fc_id);
++ frport->rdata.ids.port_name =
++ get_unaligned_be64(&vn->fd_wwpn);
+ break;
+ case FIP_DT_FC4F:
+ if (dlen != sizeof(struct fip_fc4_feat))
+@@ -2750,10 +2748,7 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
+ {
+ struct fip_header *fiph;
+ enum fip_vn2vn_subcode sub;
+- struct {
+- struct fc_rport_priv rdata;
+- struct fcoe_rport frport;
+- } buf;
++ struct fcoe_rport frport = { };
+ int rc, vlan_id = 0;
+
+ fiph = (struct fip_header *)skb->data;
+@@ -2769,7 +2764,7 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
+ goto drop;
+ }
+
+- rc = fcoe_ctlr_vn_parse(fip, skb, &buf.rdata);
++ rc = fcoe_ctlr_vn_parse(fip, skb, &frport);
+ if (rc) {
+ LIBFCOE_FIP_DBG(fip, "vn_recv vn_parse error %d\n", rc);
+ goto drop;
+@@ -2778,19 +2773,19 @@ static int fcoe_ctlr_vn_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
+ mutex_lock(&fip->ctlr_mutex);
+ switch (sub) {
+ case FIP_SC_VN_PROBE_REQ:
+- fcoe_ctlr_vn_probe_req(fip, &buf.rdata);
++ fcoe_ctlr_vn_probe_req(fip, &frport.rdata);
+ break;
+ case FIP_SC_VN_PROBE_REP:
+- fcoe_ctlr_vn_probe_reply(fip, &buf.rdata);
++ fcoe_ctlr_vn_probe_reply(fip, &frport.rdata);
+ break;
+ case FIP_SC_VN_CLAIM_NOTIFY:
+- fcoe_ctlr_vn_claim_notify(fip, &buf.rdata);
++ fcoe_ctlr_vn_claim_notify(fip, &frport.rdata);
+ break;
+ case FIP_SC_VN_CLAIM_REP:
+- fcoe_ctlr_vn_claim_resp(fip, &buf.rdata);
++ fcoe_ctlr_vn_claim_resp(fip, &frport.rdata);
+ break;
+ case FIP_SC_VN_BEACON:
+- fcoe_ctlr_vn_beacon(fip, &buf.rdata);
++ fcoe_ctlr_vn_beacon(fip, &frport.rdata);
+ break;
+ default:
+ LIBFCOE_FIP_DBG(fip, "vn_recv unknown subcode %d\n", sub);
+@@ -2814,22 +2809,18 @@ drop:
+ */
+ static int fcoe_ctlr_vlan_parse(struct fcoe_ctlr *fip,
+ struct sk_buff *skb,
+- struct fc_rport_priv *rdata)
++ struct fcoe_rport *frport)
+ {
+ struct fip_header *fiph;
+ struct fip_desc *desc = NULL;
+ struct fip_mac_desc *macd = NULL;
+ struct fip_wwn_desc *wwn = NULL;
+- struct fcoe_rport *frport;
+ size_t rlen;
+ size_t dlen;
+ u32 desc_mask = 0;
+ u32 dtype;
+ u8 sub;
+
+- memset(rdata, 0, sizeof(*rdata) + sizeof(*frport));
+- frport = fcoe_ctlr_rport(rdata);
+-
+ fiph = (struct fip_header *)skb->data;
+ frport->flags = ntohs(fiph->fip_flags);
+
+@@ -2883,7 +2874,8 @@ static int fcoe_ctlr_vlan_parse(struct fcoe_ctlr *fip,
+ if (dlen != sizeof(struct fip_wwn_desc))
+ goto len_err;
+ wwn = (struct fip_wwn_desc *)desc;
+- rdata->ids.node_name = get_unaligned_be64(&wwn->fd_wwn);
++ frport->rdata.ids.node_name =
++ get_unaligned_be64(&wwn->fd_wwn);
+ break;
+ default:
+ LIBFCOE_FIP_DBG(fip, "unexpected descriptor type %x "
+@@ -2994,22 +2986,19 @@ static int fcoe_ctlr_vlan_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
+ {
+ struct fip_header *fiph;
+ enum fip_vlan_subcode sub;
+- struct {
+- struct fc_rport_priv rdata;
+- struct fcoe_rport frport;
+- } buf;
++ struct fcoe_rport frport = { };
+ int rc;
+
+ fiph = (struct fip_header *)skb->data;
+ sub = fiph->fip_subcode;
+- rc = fcoe_ctlr_vlan_parse(fip, skb, &buf.rdata);
++ rc = fcoe_ctlr_vlan_parse(fip, skb, &frport);
+ if (rc) {
+ LIBFCOE_FIP_DBG(fip, "vlan_recv vlan_parse error %d\n", rc);
+ goto drop;
+ }
+ mutex_lock(&fip->ctlr_mutex);
+ if (sub == FIP_SC_VL_REQ)
+- fcoe_ctlr_vlan_disc_reply(fip, &buf.rdata);
++ fcoe_ctlr_vlan_disc_reply(fip, &frport.rdata);
+ mutex_unlock(&fip->ctlr_mutex);
+
+ drop:
+diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
+index 3d51a936f6d5..90a748551ede 100644
+--- a/drivers/scsi/libfc/fc_rport.c
++++ b/drivers/scsi/libfc/fc_rport.c
+@@ -140,6 +140,7 @@ EXPORT_SYMBOL(fc_rport_lookup);
+ struct fc_rport_priv *fc_rport_create(struct fc_lport *lport, u32 port_id)
+ {
+ struct fc_rport_priv *rdata;
++ size_t rport_priv_size = sizeof(*rdata);
+
+ lockdep_assert_held(&lport->disc.disc_mutex);
+
+@@ -147,7 +148,9 @@ struct fc_rport_priv *fc_rport_create(struct fc_lport *lport, u32 port_id)
+ if (rdata)
+ return rdata;
+
+- rdata = kzalloc(sizeof(*rdata) + lport->rport_priv_size, GFP_KERNEL);
++ if (lport->rport_priv_size > 0)
++ rport_priv_size = lport->rport_priv_size;
++ rdata = kzalloc(rport_priv_size, GFP_KERNEL);
+ if (!rdata)
+ return NULL;
+
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index 25abf2d1732a..eab27d41ba83 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -554,7 +554,8 @@ static int bcm2835_spi_transfer_one(struct spi_master *master,
+ bcm2835_wr(bs, BCM2835_SPI_CLK, cdiv);
+
+ /* handle all the 3-wire mode */
+- if ((spi->mode & SPI_3WIRE) && (tfr->rx_buf))
++ if (spi->mode & SPI_3WIRE && tfr->rx_buf &&
++ tfr->rx_buf != master->dummy_rx)
+ cs |= BCM2835_SPI_CS_REN;
+ else
+ cs &= ~BCM2835_SPI_CS_REN;
+diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
+index a9b00942e87d..8f08095ee54e 100644
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -894,9 +894,6 @@ COMPATIBLE_IOCTL(PPPIOCDISCONN)
+ COMPATIBLE_IOCTL(PPPIOCATTCHAN)
+ COMPATIBLE_IOCTL(PPPIOCGCHAN)
+ COMPATIBLE_IOCTL(PPPIOCGL2TPSTATS)
+-/* PPPOX */
+-COMPATIBLE_IOCTL(PPPOEIOCSFWD)
+-COMPATIBLE_IOCTL(PPPOEIOCDFWD)
+ /* Big A */
+ /* sparc only */
+ /* Big Q for sound/OSS */
+diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
+index a6090154b2ab..a01ebb630abc 100644
+--- a/include/linux/cgroup-defs.h
++++ b/include/linux/cgroup-defs.h
+@@ -207,6 +207,7 @@ struct css_set {
+ */
+ struct list_head tasks;
+ struct list_head mg_tasks;
++ struct list_head dying_tasks;
+
+ /* all css_task_iters currently walking this cset */
+ struct list_head task_iters;
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index 8937d48a5389..b4854b48a4f3 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -43,6 +43,9 @@
+ /* walk all threaded css_sets in the domain */
+ #define CSS_TASK_ITER_THREADED (1U << 1)
+
++/* internal flags */
++#define CSS_TASK_ITER_SKIPPED (1U << 16)
++
+ /* a css_task_iter should be treated as an opaque object */
+ struct css_task_iter {
+ struct cgroup_subsys *ss;
+@@ -57,6 +60,7 @@ struct css_task_iter {
+ struct list_head *task_pos;
+ struct list_head *tasks_head;
+ struct list_head *mg_tasks_head;
++ struct list_head *dying_tasks_head;
+
+ struct css_set *cur_cset;
+ struct css_set *cur_dcset;
+diff --git a/include/linux/device.h b/include/linux/device.h
+index 3f1066a9e1c3..19dd8852602c 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -1332,6 +1332,7 @@ extern int (*platform_notify_remove)(struct device *dev);
+ */
+ extern struct device *get_device(struct device *dev);
+ extern void put_device(struct device *dev);
++extern bool kill_device(struct device *dev);
+
+ #ifdef CONFIG_DEVTMPFS
+ extern int devtmpfs_create_node(struct device *dev);
+diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
+index ba7a9b0c7c57..24e9b360da65 100644
+--- a/include/linux/if_pppox.h
++++ b/include/linux/if_pppox.h
+@@ -84,6 +84,9 @@ extern int register_pppox_proto(int proto_num, const struct pppox_proto *pp);
+ extern void unregister_pppox_proto(int proto_num);
+ extern void pppox_unbind_sock(struct sock *sk);/* delete ppp-channel binding */
+ extern int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
++extern int pppox_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
++
++#define PPPOEIOCSFWD32 _IOW(0xB1 ,0, compat_size_t)
+
+ /* PPPoX socket states */
+ enum {
+diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h
+index 804516e4f483..3386399feadc 100644
+--- a/include/linux/mlx5/fs.h
++++ b/include/linux/mlx5/fs.h
+@@ -188,6 +188,7 @@ int mlx5_modify_rule_destination(struct mlx5_flow_handle *handler,
+ struct mlx5_fc *mlx5_flow_rule_counter(struct mlx5_flow_handle *handler);
+ struct mlx5_fc *mlx5_fc_create(struct mlx5_core_dev *dev, bool aging);
+ void mlx5_fc_destroy(struct mlx5_core_dev *dev, struct mlx5_fc *counter);
++u64 mlx5_fc_query_lastuse(struct mlx5_fc *counter);
+ void mlx5_fc_query_cached(struct mlx5_fc *counter,
+ u64 *bytes, u64 *packets, u64 *lastuse);
+ int mlx5_fc_query(struct mlx5_core_dev *dev, struct mlx5_fc *counter,
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index f043d65b9bac..177f11c96187 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -5623,7 +5623,12 @@ struct mlx5_ifc_modify_cq_in_bits {
+
+ struct mlx5_ifc_cqc_bits cq_context;
+
+- u8 reserved_at_280[0x600];
++ u8 reserved_at_280[0x60];
++
++ u8 cq_umem_valid[0x1];
++ u8 reserved_at_2e1[0x1f];
++
++ u8 reserved_at_300[0x580];
+
+ u8 pas[0][0x40];
+ };
+diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h
+index bb8092fa1e36..58507c7783cf 100644
+--- a/include/scsi/libfcoe.h
++++ b/include/scsi/libfcoe.h
+@@ -241,6 +241,7 @@ struct fcoe_fcf {
+ * @vn_mac: VN_Node assigned MAC address for data
+ */
+ struct fcoe_rport {
++ struct fc_rport_priv rdata;
+ unsigned long time;
+ u16 fcoe_len;
+ u16 flags;
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 81441117f611..78ef274b036e 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -212,7 +212,8 @@ static struct cftype cgroup_base_files[];
+
+ static int cgroup_apply_control(struct cgroup *cgrp);
+ static void cgroup_finalize_control(struct cgroup *cgrp, int ret);
+-static void css_task_iter_advance(struct css_task_iter *it);
++static void css_task_iter_skip(struct css_task_iter *it,
++ struct task_struct *task);
+ static int cgroup_destroy_locked(struct cgroup *cgrp);
+ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
+ struct cgroup_subsys *ss);
+@@ -672,6 +673,7 @@ struct css_set init_css_set = {
+ .dom_cset = &init_css_set,
+ .tasks = LIST_HEAD_INIT(init_css_set.tasks),
+ .mg_tasks = LIST_HEAD_INIT(init_css_set.mg_tasks),
++ .dying_tasks = LIST_HEAD_INIT(init_css_set.dying_tasks),
+ .task_iters = LIST_HEAD_INIT(init_css_set.task_iters),
+ .threaded_csets = LIST_HEAD_INIT(init_css_set.threaded_csets),
+ .cgrp_links = LIST_HEAD_INIT(init_css_set.cgrp_links),
+@@ -775,6 +777,21 @@ static void css_set_update_populated(struct css_set *cset, bool populated)
+ cgroup_update_populated(link->cgrp, populated);
+ }
+
++/*
++ * @task is leaving, advance task iterators which are pointing to it so
++ * that they can resume at the next position. Advancing an iterator might
++ * remove it from the list, use safe walk. See css_task_iter_skip() for
++ * details.
++ */
++static void css_set_skip_task_iters(struct css_set *cset,
++ struct task_struct *task)
++{
++ struct css_task_iter *it, *pos;
++
++ list_for_each_entry_safe(it, pos, &cset->task_iters, iters_node)
++ css_task_iter_skip(it, task);
++}
++
+ /**
+ * css_set_move_task - move a task from one css_set to another
+ * @task: task being moved
+@@ -800,22 +817,9 @@ static void css_set_move_task(struct task_struct *task,
+ css_set_update_populated(to_cset, true);
+
+ if (from_cset) {
+- struct css_task_iter *it, *pos;
+-
+ WARN_ON_ONCE(list_empty(&task->cg_list));
+
+- /*
+- * @task is leaving, advance task iterators which are
+- * pointing to it so that they can resume at the next
+- * position. Advancing an iterator might remove it from
+- * the list, use safe walk. See css_task_iter_advance*()
+- * for details.
+- */
+- list_for_each_entry_safe(it, pos, &from_cset->task_iters,
+- iters_node)
+- if (it->task_pos == &task->cg_list)
+- css_task_iter_advance(it);
+-
++ css_set_skip_task_iters(from_cset, task);
+ list_del_init(&task->cg_list);
+ if (!css_set_populated(from_cset))
+ css_set_update_populated(from_cset, false);
+@@ -1142,6 +1146,7 @@ static struct css_set *find_css_set(struct css_set *old_cset,
+ cset->dom_cset = cset;
+ INIT_LIST_HEAD(&cset->tasks);
+ INIT_LIST_HEAD(&cset->mg_tasks);
++ INIT_LIST_HEAD(&cset->dying_tasks);
+ INIT_LIST_HEAD(&cset->task_iters);
+ INIT_LIST_HEAD(&cset->threaded_csets);
+ INIT_HLIST_NODE(&cset->hlist);
+@@ -4149,15 +4154,18 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it)
+ it->task_pos = NULL;
+ return;
+ }
+- } while (!css_set_populated(cset));
++ } while (!css_set_populated(cset) && list_empty(&cset->dying_tasks));
+
+ if (!list_empty(&cset->tasks))
+ it->task_pos = cset->tasks.next;
+- else
++ else if (!list_empty(&cset->mg_tasks))
+ it->task_pos = cset->mg_tasks.next;
++ else
++ it->task_pos = cset->dying_tasks.next;
+
+ it->tasks_head = &cset->tasks;
+ it->mg_tasks_head = &cset->mg_tasks;
++ it->dying_tasks_head = &cset->dying_tasks;
+
+ /*
+ * We don't keep css_sets locked across iteration steps and thus
+@@ -4183,9 +4191,20 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it)
+ list_add(&it->iters_node, &cset->task_iters);
+ }
+
++static void css_task_iter_skip(struct css_task_iter *it,
++ struct task_struct *task)
++{
++ lockdep_assert_held(&css_set_lock);
++
++ if (it->task_pos == &task->cg_list) {
++ it->task_pos = it->task_pos->next;
++ it->flags |= CSS_TASK_ITER_SKIPPED;
++ }
++}
++
+ static void css_task_iter_advance(struct css_task_iter *it)
+ {
+- struct list_head *next;
++ struct task_struct *task;
+
+ lockdep_assert_held(&css_set_lock);
+ repeat:
+@@ -4195,25 +4214,40 @@ repeat:
+ * consumed first and then ->mg_tasks. After ->mg_tasks,
+ * we move onto the next cset.
+ */
+- next = it->task_pos->next;
+-
+- if (next == it->tasks_head)
+- next = it->mg_tasks_head->next;
++ if (it->flags & CSS_TASK_ITER_SKIPPED)
++ it->flags &= ~CSS_TASK_ITER_SKIPPED;
++ else
++ it->task_pos = it->task_pos->next;
+
+- if (next == it->mg_tasks_head)
++ if (it->task_pos == it->tasks_head)
++ it->task_pos = it->mg_tasks_head->next;
++ if (it->task_pos == it->mg_tasks_head)
++ it->task_pos = it->dying_tasks_head->next;
++ if (it->task_pos == it->dying_tasks_head)
+ css_task_iter_advance_css_set(it);
+- else
+- it->task_pos = next;
+ } else {
+ /* called from start, proceed to the first cset */
+ css_task_iter_advance_css_set(it);
+ }
+
+- /* if PROCS, skip over tasks which aren't group leaders */
+- if ((it->flags & CSS_TASK_ITER_PROCS) && it->task_pos &&
+- !thread_group_leader(list_entry(it->task_pos, struct task_struct,
+- cg_list)))
+- goto repeat;
++ if (!it->task_pos)
++ return;
++
++ task = list_entry(it->task_pos, struct task_struct, cg_list);
++
++ if (it->flags & CSS_TASK_ITER_PROCS) {
++ /* if PROCS, skip over tasks which aren't group leaders */
++ if (!thread_group_leader(task))
++ goto repeat;
++
++ /* and dying leaders w/o live member threads */
++ if (!atomic_read(&task->signal->live))
++ goto repeat;
++ } else {
++ /* skip all dying ones */
++ if (task->flags & PF_EXITING)
++ goto repeat;
++ }
+ }
+
+ /**
+@@ -4269,6 +4303,10 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
+
+ spin_lock_irq(&css_set_lock);
+
++ /* @it may be half-advanced by skips, finish advancing */
++ if (it->flags & CSS_TASK_ITER_SKIPPED)
++ css_task_iter_advance(it);
++
+ if (it->task_pos) {
+ it->cur_task = list_entry(it->task_pos, struct task_struct,
+ cg_list);
+@@ -5670,6 +5708,7 @@ void cgroup_exit(struct task_struct *tsk)
+ if (!list_empty(&tsk->cg_list)) {
+ spin_lock_irq(&css_set_lock);
+ css_set_move_task(tsk, cset, NULL, false);
++ list_add_tail(&tsk->cg_list, &cset->dying_tasks);
+ cset->nr_tasks--;
+ spin_unlock_irq(&css_set_lock);
+ } else {
+@@ -5690,6 +5729,13 @@ void cgroup_release(struct task_struct *task)
+ do_each_subsys_mask(ss, ssid, have_release_callback) {
+ ss->release(task);
+ } while_each_subsys_mask();
++
++ if (use_task_css_set_links) {
++ spin_lock_irq(&css_set_lock);
++ css_set_skip_task_iters(task_css_set(task), task);
++ list_del_init(&task->cg_list);
++ spin_unlock_irq(&css_set_lock);
++ }
+ }
+
+ void cgroup_free(struct task_struct *task)
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 5c0964dc805a..e10de9836dd7 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -194,6 +194,7 @@ repeat:
+ rcu_read_unlock();
+
+ proc_flush_task(p);
++ cgroup_release(p);
+
+ write_lock_irq(&tasklist_lock);
+ ptrace_release_task(p);
+@@ -219,7 +220,6 @@ repeat:
+ }
+
+ write_unlock_irq(&tasklist_lock);
+- cgroup_release(p);
+ release_thread(p);
+ call_rcu(&p->rcu, delayed_put_task_struct);
+
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index fb54d32321ec..6a362da211e1 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1621,6 +1621,9 @@ br_multicast_leave_group(struct net_bridge *br,
+ if (!br_port_group_equal(p, port, src))
+ continue;
+
++ if (p->flags & MDB_PG_FLAGS_PERMANENT)
++ break;
++
+ rcu_assign_pointer(*pp, p->next);
+ hlist_del_init(&p->mglist);
+ del_timer(&p->timer);
+diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
+index 7df269092103..5f3950f00f73 100644
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -677,6 +677,11 @@ void br_vlan_flush(struct net_bridge *br)
+
+ ASSERT_RTNL();
+
++ /* delete auto-added default pvid local fdb before flushing vlans
++ * otherwise it will be leaked on bridge device init failure
++ */
++ br_fdb_delete_by_port(br, NULL, 0, 1);
++
+ vg = br_vlan_group(br);
+ __vlan_flush(vg);
+ RCU_INIT_POINTER(br->vlgrp, NULL);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 138951d28643..e4b4cb40da00 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -9510,6 +9510,8 @@ static void __net_exit default_device_exit(struct net *net)
+
+ /* Push remaining network devices to init_net */
+ snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex);
++ if (__dev_get_by_name(&init_net, fb_name))
++ snprintf(fb_name, IFNAMSIZ, "dev%%d");
+ err = dev_change_net_namespace(dev, &init_net, fb_name);
+ if (err) {
+ pr_emerg("%s: failed to move %s to init_net: %d\n",
+diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
+index c891235b4966..4368282eb6f8 100644
+--- a/net/ipv4/ipip.c
++++ b/net/ipv4/ipip.c
+@@ -281,6 +281,9 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb,
+ const struct iphdr *tiph = &tunnel->parms.iph;
+ u8 ipproto;
+
++ if (!pskb_inet_may_pull(skb))
++ goto tx_error;
++
+ switch (skb->protocol) {
+ case htons(ETH_P_IP):
+ ipproto = IPPROTO_IPIP;
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 01ecd510014f..a53ef079a539 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -680,12 +680,13 @@ static int prepare_ip6gre_xmit_ipv6(struct sk_buff *skb,
+ struct flowi6 *fl6, __u8 *dsfield,
+ int *encap_limit)
+ {
+- struct ipv6hdr *ipv6h = ipv6_hdr(skb);
++ struct ipv6hdr *ipv6h;
+ struct ip6_tnl *t = netdev_priv(dev);
+ __u16 offset;
+
+ offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
+ /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
++ ipv6h = ipv6_hdr(skb);
+
+ if (offset > 0) {
+ struct ipv6_tlv_tnl_enc_lim *tel;
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index ade1390c6348..d0ad85b8650d 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1283,12 +1283,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
+ }
+
+ fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL);
++ dsfield = INET_ECN_encapsulate(dsfield, ipv4_get_dsfield(iph));
+
+ if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
+ return -1;
+
+- dsfield = INET_ECN_encapsulate(dsfield, ipv4_get_dsfield(iph));
+-
+ skb_set_inner_ipproto(skb, IPPROTO_IPIP);
+
+ err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
+@@ -1372,12 +1371,11 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
+ }
+
+ fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL);
++ dsfield = INET_ECN_encapsulate(dsfield, ipv6_get_dsfield(ipv6h));
+
+ if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
+ return -1;
+
+- dsfield = INET_ECN_encapsulate(dsfield, ipv6_get_dsfield(ipv6h));
+-
+ skb_set_inner_ipproto(skb, IPPROTO_IPV6);
+
+ err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 04d9946dcdba..c0956781665e 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -1686,6 +1686,9 @@ static const struct proto_ops pppol2tp_ops = {
+ .recvmsg = pppol2tp_recvmsg,
+ .mmap = sock_no_mmap,
+ .ioctl = pppox_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = pppox_compat_ioctl,
++#endif
+ };
+
+ static const struct pppox_proto pppol2tp_proto = {
+diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
+index 0c68bc9cf0b4..20fae5ca87fa 100644
+--- a/net/sched/act_bpf.c
++++ b/net/sched/act_bpf.c
+@@ -287,6 +287,7 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
+ struct tcf_bpf *prog;
+ bool is_bpf, is_ebpf;
+ int ret, res = 0;
++ u32 index;
+
+ if (!nla)
+ return -EINVAL;
+@@ -299,13 +300,13 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
+ return -EINVAL;
+
+ parm = nla_data(tb[TCA_ACT_BPF_PARMS]);
+-
+- ret = tcf_idr_check_alloc(tn, &parm->index, act, bind);
++ index = parm->index;
++ ret = tcf_idr_check_alloc(tn, &index, act, bind);
+ if (!ret) {
+- ret = tcf_idr_create(tn, parm->index, est, act,
++ ret = tcf_idr_create(tn, index, est, act,
+ &act_bpf_ops, bind, true);
+ if (ret < 0) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+
+diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
+index 6f0f273f1139..605436747978 100644
+--- a/net/sched/act_connmark.c
++++ b/net/sched/act_connmark.c
+@@ -104,6 +104,7 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
+ struct tcf_connmark_info *ci;
+ struct tc_connmark *parm;
+ int ret = 0;
++ u32 index;
+
+ if (!nla)
+ return -EINVAL;
+@@ -117,13 +118,13 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
+ return -EINVAL;
+
+ parm = nla_data(tb[TCA_CONNMARK_PARMS]);
+-
+- ret = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ ret = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (!ret) {
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_connmark_ops, bind, false);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+
+diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
+index b8a67ae3105a..40437197e053 100644
+--- a/net/sched/act_csum.c
++++ b/net/sched/act_csum.c
+@@ -55,6 +55,7 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla,
+ struct tc_csum *parm;
+ struct tcf_csum *p;
+ int ret = 0, err;
++ u32 index;
+
+ if (nla == NULL)
+ return -EINVAL;
+@@ -66,13 +67,13 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla,
+ if (tb[TCA_CSUM_PARMS] == NULL)
+ return -EINVAL;
+ parm = nla_data(tb[TCA_CSUM_PARMS]);
+-
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (!err) {
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_csum_ops, bind, true);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+ ret = ACT_P_CREATED;
+diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
+index cd1d9bd32ef9..72d3347bdd41 100644
+--- a/net/sched/act_gact.c
++++ b/net/sched/act_gact.c
+@@ -64,6 +64,7 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
+ struct tc_gact *parm;
+ struct tcf_gact *gact;
+ int ret = 0;
++ u32 index;
+ int err;
+ #ifdef CONFIG_GACT_PROB
+ struct tc_gact_p *p_parm = NULL;
+@@ -79,6 +80,7 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
+ if (tb[TCA_GACT_PARMS] == NULL)
+ return -EINVAL;
+ parm = nla_data(tb[TCA_GACT_PARMS]);
++ index = parm->index;
+
+ #ifndef CONFIG_GACT_PROB
+ if (tb[TCA_GACT_PROB] != NULL)
+@@ -91,12 +93,12 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
+ }
+ #endif
+
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (!err) {
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_gact_ops, bind, true);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+ ret = ACT_P_CREATED;
+diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
+index 06a3d4801878..24047e0e5db0 100644
+--- a/net/sched/act_ife.c
++++ b/net/sched/act_ife.c
+@@ -482,8 +482,14 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
+ u8 *saddr = NULL;
+ bool exists = false;
+ int ret = 0;
++ u32 index;
+ int err;
+
++ if (!nla) {
++ NL_SET_ERR_MSG_MOD(extack, "IFE requires attributes to be passed");
++ return -EINVAL;
++ }
++
+ err = nla_parse_nested(tb, TCA_IFE_MAX, nla, ife_policy, NULL);
+ if (err < 0)
+ return err;
+@@ -504,7 +510,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
+ if (!p)
+ return -ENOMEM;
+
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (err < 0) {
+ kfree(p);
+ return err;
+@@ -516,10 +523,10 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
+ }
+
+ if (!exists) {
+- ret = tcf_idr_create(tn, parm->index, est, a, &act_ife_ops,
++ ret = tcf_idr_create(tn, index, est, a, &act_ife_ops,
+ bind, true);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ kfree(p);
+ return ret;
+ }
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index f767e78e38c9..548614bd9366 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -104,6 +104,7 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
+ struct net_device *dev;
+ bool exists = false;
+ int ret, err;
++ u32 index;
+
+ if (!nla) {
+ NL_SET_ERR_MSG_MOD(extack, "Mirred requires attributes to be passed");
+@@ -117,8 +118,8 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
+ return -EINVAL;
+ }
+ parm = nla_data(tb[TCA_MIRRED_PARMS]);
+-
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (err < 0)
+ return err;
+ exists = err;
+@@ -135,21 +136,21 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
+ if (exists)
+ tcf_idr_release(*a, bind);
+ else
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ NL_SET_ERR_MSG_MOD(extack, "Unknown mirred option");
+ return -EINVAL;
+ }
+
+ if (!exists) {
+ if (!parm->ifindex) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ NL_SET_ERR_MSG_MOD(extack, "Specified device does not exist");
+ return -EINVAL;
+ }
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_mirred_ops, bind, true);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+ ret = ACT_P_CREATED;
+diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
+index 4313aa102440..619828920b97 100644
+--- a/net/sched/act_nat.c
++++ b/net/sched/act_nat.c
+@@ -45,6 +45,7 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
+ struct tc_nat *parm;
+ int ret = 0, err;
+ struct tcf_nat *p;
++ u32 index;
+
+ if (nla == NULL)
+ return -EINVAL;
+@@ -56,13 +57,13 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
+ if (tb[TCA_NAT_PARMS] == NULL)
+ return -EINVAL;
+ parm = nla_data(tb[TCA_NAT_PARMS]);
+-
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (!err) {
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_nat_ops, bind, false);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+ ret = ACT_P_CREATED;
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index ca535a8585bc..82d258b2a75a 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -149,6 +149,7 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
+ struct tcf_pedit *p;
+ int ret = 0, err;
+ int ksize;
++ u32 index;
+
+ if (!nla) {
+ NL_SET_ERR_MSG_MOD(extack, "Pedit requires attributes to be passed");
+@@ -178,18 +179,19 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
+ if (IS_ERR(keys_ex))
+ return PTR_ERR(keys_ex);
+
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (!err) {
+ if (!parm->nkeys) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ NL_SET_ERR_MSG_MOD(extack, "Pedit requires keys to be passed");
+ ret = -EINVAL;
+ goto out_free;
+ }
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_pedit_ops, bind, false);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ goto out_free;
+ }
+ ret = ACT_P_CREATED;
+diff --git a/net/sched/act_police.c b/net/sched/act_police.c
+index 5d8bfa878477..997c34db1491 100644
+--- a/net/sched/act_police.c
++++ b/net/sched/act_police.c
+@@ -85,6 +85,7 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
+ struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL;
+ struct tc_action_net *tn = net_generic(net, police_net_id);
+ bool exists = false;
++ u32 index;
+ int size;
+
+ if (nla == NULL)
+@@ -101,7 +102,8 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
+ return -EINVAL;
+
+ parm = nla_data(tb[TCA_POLICE_TBF]);
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (err < 0)
+ return err;
+ exists = err;
+@@ -109,10 +111,10 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
+ return 0;
+
+ if (!exists) {
+- ret = tcf_idr_create(tn, parm->index, NULL, a,
++ ret = tcf_idr_create(tn, index, NULL, a,
+ &act_police_ops, bind, false);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+ ret = ACT_P_CREATED;
+diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
+index c7f5d630d97c..ac37654ca292 100644
+--- a/net/sched/act_sample.c
++++ b/net/sched/act_sample.c
+@@ -43,7 +43,7 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
+ struct tc_action_net *tn = net_generic(net, sample_net_id);
+ struct nlattr *tb[TCA_SAMPLE_MAX + 1];
+ struct psample_group *psample_group;
+- u32 psample_group_num, rate;
++ u32 psample_group_num, rate, index;
+ struct tc_sample *parm;
+ struct tcf_sample *s;
+ bool exists = false;
+@@ -59,8 +59,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
+ return -EINVAL;
+
+ parm = nla_data(tb[TCA_SAMPLE_PARMS]);
+-
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (err < 0)
+ return err;
+ exists = err;
+@@ -68,10 +68,10 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
+ return 0;
+
+ if (!exists) {
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_sample_ops, bind, true);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+ ret = ACT_P_CREATED;
+diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
+index 52400d49f81f..658efae71a09 100644
+--- a/net/sched/act_simple.c
++++ b/net/sched/act_simple.c
+@@ -88,6 +88,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
+ struct tcf_defact *d;
+ bool exists = false;
+ int ret = 0, err;
++ u32 index;
+
+ if (nla == NULL)
+ return -EINVAL;
+@@ -100,7 +101,8 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
+ return -EINVAL;
+
+ parm = nla_data(tb[TCA_DEF_PARMS]);
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (err < 0)
+ return err;
+ exists = err;
+@@ -111,15 +113,15 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
+ if (exists)
+ tcf_idr_release(*a, bind);
+ else
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return -EINVAL;
+ }
+
+ if (!exists) {
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_simp_ops, bind, false);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+
+diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
+index 86d90fc5e97e..7709710a41f7 100644
+--- a/net/sched/act_skbedit.c
++++ b/net/sched/act_skbedit.c
+@@ -107,6 +107,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
+ u16 *queue_mapping = NULL, *ptype = NULL;
+ bool exists = false;
+ int ret = 0, err;
++ u32 index;
+
+ if (nla == NULL)
+ return -EINVAL;
+@@ -153,8 +154,8 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
+ }
+
+ parm = nla_data(tb[TCA_SKBEDIT_PARMS]);
+-
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (err < 0)
+ return err;
+ exists = err;
+@@ -165,15 +166,15 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
+ if (exists)
+ tcf_idr_release(*a, bind);
+ else
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return -EINVAL;
+ }
+
+ if (!exists) {
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_skbedit_ops, bind, true);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+
+diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
+index 588077fafd6c..3038493d18ca 100644
+--- a/net/sched/act_skbmod.c
++++ b/net/sched/act_skbmod.c
+@@ -88,12 +88,12 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
+ struct nlattr *tb[TCA_SKBMOD_MAX + 1];
+ struct tcf_skbmod_params *p, *p_old;
+ struct tc_skbmod *parm;
++ u32 lflags = 0, index;
+ struct tcf_skbmod *d;
+ bool exists = false;
+ u8 *daddr = NULL;
+ u8 *saddr = NULL;
+ u16 eth_type = 0;
+- u32 lflags = 0;
+ int ret = 0, err;
+
+ if (!nla)
+@@ -122,10 +122,11 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
+ }
+
+ parm = nla_data(tb[TCA_SKBMOD_PARMS]);
++ index = parm->index;
+ if (parm->flags & SKBMOD_F_SWAPMAC)
+ lflags = SKBMOD_F_SWAPMAC;
+
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (err < 0)
+ return err;
+ exists = err;
+@@ -136,15 +137,15 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
+ if (exists)
+ tcf_idr_release(*a, bind);
+ else
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return -EINVAL;
+ }
+
+ if (!exists) {
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_skbmod_ops, bind, true);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+
+diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
+index 72d9c432e8b4..66bfe57e74ae 100644
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -224,6 +224,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
+ __be16 flags;
+ u8 tos, ttl;
+ int ret = 0;
++ u32 index;
+ int err;
+
+ if (!nla) {
+@@ -244,7 +245,8 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
+ }
+
+ parm = nla_data(tb[TCA_TUNNEL_KEY_PARMS]);
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (err < 0)
+ return err;
+ exists = err;
+@@ -338,7 +340,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
+ }
+
+ if (!exists) {
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_tunnel_key_ops, bind, true);
+ if (ret) {
+ NL_SET_ERR_MSG(extack, "Cannot create TC IDR");
+@@ -384,7 +386,7 @@ err_out:
+ if (exists)
+ tcf_idr_release(*a, bind);
+ else
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+
+diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
+index 033d273afe50..da993edd2e40 100644
+--- a/net/sched/act_vlan.c
++++ b/net/sched/act_vlan.c
+@@ -118,6 +118,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
+ u8 push_prio = 0;
+ bool exists = false;
+ int ret = 0, err;
++ u32 index;
+
+ if (!nla)
+ return -EINVAL;
+@@ -129,7 +130,8 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
+ if (!tb[TCA_VLAN_PARMS])
+ return -EINVAL;
+ parm = nla_data(tb[TCA_VLAN_PARMS]);
+- err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
++ index = parm->index;
++ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (err < 0)
+ return err;
+ exists = err;
+@@ -145,7 +147,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
+ if (exists)
+ tcf_idr_release(*a, bind);
+ else
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return -EINVAL;
+ }
+ push_vid = nla_get_u16(tb[TCA_VLAN_PUSH_VLAN_ID]);
+@@ -153,7 +155,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
+ if (exists)
+ tcf_idr_release(*a, bind);
+ else
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return -ERANGE;
+ }
+
+@@ -167,7 +169,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
+ if (exists)
+ tcf_idr_release(*a, bind);
+ else
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return -EPROTONOSUPPORT;
+ }
+ } else {
+@@ -181,16 +183,16 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
+ if (exists)
+ tcf_idr_release(*a, bind);
+ else
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return -EINVAL;
+ }
+ action = parm->v_action;
+
+ if (!exists) {
+- ret = tcf_idr_create(tn, parm->index, est, a,
++ ret = tcf_idr_create(tn, index, est, a,
+ &act_vlan_ops, bind, true);
+ if (ret) {
+- tcf_idr_cleanup(tn, parm->index);
++ tcf_idr_cleanup(tn, index);
+ return ret;
+ }
+
+@@ -296,6 +298,14 @@ static int tcf_vlan_search(struct net *net, struct tc_action **a, u32 index,
+ return tcf_idr_search(tn, a, index);
+ }
+
++static size_t tcf_vlan_get_fill_size(const struct tc_action *act)
++{
++ return nla_total_size(sizeof(struct tc_vlan))
++ + nla_total_size(sizeof(u16)) /* TCA_VLAN_PUSH_VLAN_ID */
++ + nla_total_size(sizeof(u16)) /* TCA_VLAN_PUSH_VLAN_PROTOCOL */
++ + nla_total_size(sizeof(u8)); /* TCA_VLAN_PUSH_VLAN_PRIORITY */
++}
++
+ static struct tc_action_ops act_vlan_ops = {
+ .kind = "vlan",
+ .type = TCA_ACT_VLAN,
+@@ -305,6 +315,7 @@ static struct tc_action_ops act_vlan_ops = {
+ .init = tcf_vlan_init,
+ .cleanup = tcf_vlan_cleanup,
+ .walk = tcf_vlan_walker,
++ .get_fill_size = tcf_vlan_get_fill_size,
+ .lookup = tcf_vlan_search,
+ .size = sizeof(struct tcf_vlan),
+ };
+diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
+index 17cd81f84b5d..77fae0b7c6ee 100644
+--- a/net/sched/sch_codel.c
++++ b/net/sched/sch_codel.c
+@@ -71,10 +71,10 @@ static struct sk_buff *dequeue_func(struct codel_vars *vars, void *ctx)
+ struct Qdisc *sch = ctx;
+ struct sk_buff *skb = __qdisc_dequeue_head(&sch->q);
+
+- if (skb)
++ if (skb) {
+ sch->qstats.backlog -= qdisc_pkt_len(skb);
+-
+- prefetch(&skb->end); /* we'll need skb_shinfo() */
++ prefetch(&skb->end); /* we'll need skb_shinfo() */
++ }
+ return skb;
+ }
+
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 9bbab6ba2dab..26dcd02b2d0c 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1680,14 +1680,18 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
+ }
+ break;
+ case TCP_NODELAY:
+- if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
++ if (sk->sk_state != SMC_INIT &&
++ sk->sk_state != SMC_LISTEN &&
++ sk->sk_state != SMC_CLOSED) {
+ if (val && !smc->use_fallback)
+ mod_delayed_work(system_wq, &smc->conn.tx_work,
+ 0);
+ }
+ break;
+ case TCP_CORK:
+- if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
++ if (sk->sk_state != SMC_INIT &&
++ sk->sk_state != SMC_LISTEN &&
++ sk->sk_state != SMC_CLOSED) {
+ if (!val && !smc->use_fallback)
+ mod_delayed_work(system_wq, &smc->conn.tx_work,
+ 0);
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 85ebb675600c..318c541970ec 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -55,6 +55,7 @@ struct tipc_nl_compat_msg {
+ int rep_type;
+ int rep_size;
+ int req_type;
++ int req_size;
+ struct net *net;
+ struct sk_buff *rep;
+ struct tlv_desc *req;
+@@ -257,7 +258,8 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
+ int err;
+ struct sk_buff *arg;
+
+- if (msg->req_type && !TLV_CHECK_TYPE(msg->req, msg->req_type))
++ if (msg->req_type && (!msg->req_size ||
++ !TLV_CHECK_TYPE(msg->req, msg->req_type)))
+ return -EINVAL;
+
+ msg->rep = tipc_tlv_alloc(msg->rep_size);
+@@ -354,7 +356,8 @@ static int tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
+ {
+ int err;
+
+- if (msg->req_type && !TLV_CHECK_TYPE(msg->req, msg->req_type))
++ if (msg->req_type && (!msg->req_size ||
++ !TLV_CHECK_TYPE(msg->req, msg->req_type)))
+ return -EINVAL;
+
+ err = __tipc_nl_compat_doit(cmd, msg);
+@@ -1276,8 +1279,8 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info)
+ goto send;
+ }
+
+- len = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
+- if (!len || !TLV_OK(msg.req, len)) {
++ msg.req_size = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
++ if (msg.req_size && !TLV_OK(msg.req, msg.req_size)) {
+ msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_SUPPORTED);
+ err = -EOPNOTSUPP;
+ goto send;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-08-16 12:13 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-08-16 12:13 UTC (permalink / raw
To: gentoo-commits
commit: f739056a9cd88ac7ae209434eb265b1a1dcb903e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 16 12:12:47 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug 16 12:12:47 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f739056a
Linux patch 4.19.67
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1066_linux-4.19.67.patch | 2715 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2719 insertions(+)
diff --git a/0000_README b/0000_README
index 6813edb..142096b 100644
--- a/0000_README
+++ b/0000_README
@@ -307,6 +307,10 @@ Patch: 1065_linux-4.19.66.patch
From: https://www.kernel.org
Desc: Linux 4.19.66
+Patch: 1066_linux-4.19.67.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.67
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1066_linux-4.19.67.patch b/1066_linux-4.19.67.patch
new file mode 100644
index 0000000..9ac1ae3
--- /dev/null
+++ b/1066_linux-4.19.67.patch
@@ -0,0 +1,2715 @@
+diff --git a/Makefile b/Makefile
+index 065e5b34dc02..b6aa6e8d4411 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 66
++SUBLEVEL = 67
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/bcm47094-linksys-panamera.dts b/arch/arm/boot/dts/bcm47094-linksys-panamera.dts
+index 36efe410dcd7..9e33c41f5411 100644
+--- a/arch/arm/boot/dts/bcm47094-linksys-panamera.dts
++++ b/arch/arm/boot/dts/bcm47094-linksys-panamera.dts
+@@ -125,6 +125,9 @@
+ };
+
+ mdio-bus-mux {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
+ /* BIT(9) = 1 => external mdio */
+ mdio_ext: mdio@200 {
+ reg = <0x200>;
+diff --git a/arch/arm/mach-davinci/sleep.S b/arch/arm/mach-davinci/sleep.S
+index cd350dee4df3..efcd400b2abb 100644
+--- a/arch/arm/mach-davinci/sleep.S
++++ b/arch/arm/mach-davinci/sleep.S
+@@ -37,6 +37,7 @@
+ #define DEEPSLEEP_SLEEPENABLE_BIT BIT(31)
+
+ .text
++ .arch armv5te
+ /*
+ * Move DaVinci into deep sleep state
+ *
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index 578174a33d22..51cd66dc1bb0 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -61,6 +61,11 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *v)
+ return !!(v->arch.pending_exceptions) || kvm_request_pending(v);
+ }
+
++bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)
++{
++ return kvm_arch_vcpu_runnable(vcpu);
++}
++
+ bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
+ {
+ return false;
+diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
+index 41e3908b397f..0d753291c43c 100644
+--- a/arch/s390/include/asm/page.h
++++ b/arch/s390/include/asm/page.h
+@@ -176,6 +176,8 @@ static inline int devmem_is_allowed(unsigned long pfn)
+ #define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | \
+ VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+
++#define ARCH_ZONE_DMA_BITS 31
++
+ #include <asm-generic/memory_model.h>
+ #include <asm-generic/getorder.h>
+
+diff --git a/arch/x86/boot/string.c b/arch/x86/boot/string.c
+index c4428a176973..2622c0742c92 100644
+--- a/arch/x86/boot/string.c
++++ b/arch/x86/boot/string.c
+@@ -34,6 +34,14 @@ int memcmp(const void *s1, const void *s2, size_t len)
+ return diff;
+ }
+
++/*
++ * Clang may lower `memcmp == 0` to `bcmp == 0`.
++ */
++int bcmp(const void *s1, const void *s2, size_t len)
++{
++ return memcmp(s1, s2, len);
++}
++
+ int strcmp(const char *str1, const char *str2)
+ {
+ const unsigned char *s1 = (const unsigned char *)str1;
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 2877e1fbadd8..3245b95ad2d9 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1113,6 +1113,7 @@ struct kvm_x86_ops {
+ int (*update_pi_irte)(struct kvm *kvm, unsigned int host_irq,
+ uint32_t guest_irq, bool set);
+ void (*apicv_post_state_restore)(struct kvm_vcpu *vcpu);
++ bool (*dy_apicv_has_pending_interrupt)(struct kvm_vcpu *vcpu);
+
+ int (*set_hv_timer)(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc);
+ void (*cancel_hv_timer)(struct kvm_vcpu *vcpu);
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index ea454d3f7763..0f33f00aa4df 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -5146,6 +5146,11 @@ static void svm_deliver_avic_intr(struct kvm_vcpu *vcpu, int vec)
+ kvm_vcpu_wake_up(vcpu);
+ }
+
++static bool svm_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
++{
++ return false;
++}
++
+ static void svm_ir_list_del(struct vcpu_svm *svm, struct amd_iommu_pi_data *pi)
+ {
+ unsigned long flags;
+@@ -7203,6 +7208,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
+
+ .pmu_ops = &amd_pmu_ops,
+ .deliver_posted_interrupt = svm_deliver_avic_intr,
++ .dy_apicv_has_pending_interrupt = svm_dy_apicv_has_pending_interrupt,
+ .update_pi_irte = svm_update_pi_irte,
+ .setup_mce = svm_setup_mce,
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 4cf16378dffe..2e310ea62d60 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10411,6 +10411,11 @@ static u8 vmx_has_apicv_interrupt(struct kvm_vcpu *vcpu)
+ return ((rvi & 0xf0) > (vppr & 0xf0));
+ }
+
++static bool vmx_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
++{
++ return pi_test_on(vcpu_to_pi_desc(vcpu));
++}
++
+ static void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
+ {
+ if (!kvm_vcpu_apicv_active(vcpu))
+@@ -14387,6 +14392,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
+ .guest_apic_has_interrupt = vmx_guest_apic_has_interrupt,
+ .sync_pir_to_irr = vmx_sync_pir_to_irr,
+ .deliver_posted_interrupt = vmx_deliver_posted_interrupt,
++ .dy_apicv_has_pending_interrupt = vmx_dy_apicv_has_pending_interrupt,
+
+ .set_tss_addr = vmx_set_tss_addr,
+ .set_identity_map_addr = vmx_set_identity_map_addr,
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index cea6568667c4..e10a7a42449b 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -9336,6 +9336,22 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu)
+ return kvm_vcpu_running(vcpu) || kvm_vcpu_has_events(vcpu);
+ }
+
++bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)
++{
++ if (READ_ONCE(vcpu->arch.pv.pv_unhalted))
++ return true;
++
++ if (kvm_test_request(KVM_REQ_NMI, vcpu) ||
++ kvm_test_request(KVM_REQ_SMI, vcpu) ||
++ kvm_test_request(KVM_REQ_EVENT, vcpu))
++ return true;
++
++ if (vcpu->arch.apicv_active && kvm_x86_ops->dy_apicv_has_pending_interrupt(vcpu))
++ return true;
++
++ return false;
++}
++
+ bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
+ {
+ return vcpu->arch.preempted_in_kernel;
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 9d9765e4d1ef..1bcb7242ad79 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -261,13 +261,14 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address)
+
+ pmd = pmd_offset(pud, address);
+ pmd_k = pmd_offset(pud_k, address);
+- if (!pmd_present(*pmd_k))
+- return NULL;
+
+- if (!pmd_present(*pmd))
++ if (pmd_present(*pmd) != pmd_present(*pmd_k))
+ set_pmd(pmd, *pmd_k);
++
++ if (!pmd_present(*pmd_k))
++ return NULL;
+ else
+- BUG_ON(pmd_page(*pmd) != pmd_page(*pmd_k));
++ BUG_ON(pmd_pfn(*pmd) != pmd_pfn(*pmd_k));
+
+ return pmd_k;
+ }
+@@ -287,17 +288,13 @@ void vmalloc_sync_all(void)
+ spin_lock(&pgd_lock);
+ list_for_each_entry(page, &pgd_list, lru) {
+ spinlock_t *pgt_lock;
+- pmd_t *ret;
+
+ /* the pgt_lock only for Xen */
+ pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
+
+ spin_lock(pgt_lock);
+- ret = vmalloc_sync_one(page_address(page), address);
++ vmalloc_sync_one(page_address(page), address);
+ spin_unlock(pgt_lock);
+-
+- if (!ret)
+- break;
+ }
+ spin_unlock(&pgd_lock);
+ }
+diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
+index 3cf302b26332..8901a1f89cf5 100644
+--- a/arch/x86/purgatory/Makefile
++++ b/arch/x86/purgatory/Makefile
+@@ -6,6 +6,9 @@ purgatory-y := purgatory.o stack.o setup-x86_$(BITS).o sha256.o entry64.o string
+ targets += $(purgatory-y)
+ PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))
+
++$(obj)/string.o: $(srctree)/arch/x86/boot/compressed/string.c FORCE
++ $(call if_changed_rule,cc_o_c)
++
+ $(obj)/sha256.o: $(srctree)/lib/sha256.c FORCE
+ $(call if_changed_rule,cc_o_c)
+
+@@ -17,11 +20,34 @@ KCOV_INSTRUMENT := n
+
+ # Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
+ # in turn leaves some undefined symbols like __fentry__ in purgatory and not
+-# sure how to relocate those. Like kexec-tools, use custom flags.
+-
+-KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes -fno-zero-initialized-in-bss -fno-builtin -ffreestanding -c -Os -mcmodel=large
+-KBUILD_CFLAGS += -m$(BITS)
+-KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
++# sure how to relocate those.
++ifdef CONFIG_FUNCTION_TRACER
++CFLAGS_REMOVE_sha256.o += $(CC_FLAGS_FTRACE)
++CFLAGS_REMOVE_purgatory.o += $(CC_FLAGS_FTRACE)
++CFLAGS_REMOVE_string.o += $(CC_FLAGS_FTRACE)
++CFLAGS_REMOVE_kexec-purgatory.o += $(CC_FLAGS_FTRACE)
++endif
++
++ifdef CONFIG_STACKPROTECTOR
++CFLAGS_REMOVE_sha256.o += -fstack-protector
++CFLAGS_REMOVE_purgatory.o += -fstack-protector
++CFLAGS_REMOVE_string.o += -fstack-protector
++CFLAGS_REMOVE_kexec-purgatory.o += -fstack-protector
++endif
++
++ifdef CONFIG_STACKPROTECTOR_STRONG
++CFLAGS_REMOVE_sha256.o += -fstack-protector-strong
++CFLAGS_REMOVE_purgatory.o += -fstack-protector-strong
++CFLAGS_REMOVE_string.o += -fstack-protector-strong
++CFLAGS_REMOVE_kexec-purgatory.o += -fstack-protector-strong
++endif
++
++ifdef CONFIG_RETPOLINE
++CFLAGS_REMOVE_sha256.o += $(RETPOLINE_CFLAGS)
++CFLAGS_REMOVE_purgatory.o += $(RETPOLINE_CFLAGS)
++CFLAGS_REMOVE_string.o += $(RETPOLINE_CFLAGS)
++CFLAGS_REMOVE_kexec-purgatory.o += $(RETPOLINE_CFLAGS)
++endif
+
+ $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
+ $(call if_changed,ld)
+diff --git a/arch/x86/purgatory/purgatory.c b/arch/x86/purgatory/purgatory.c
+index 025c34ac0d84..7971f7a8af59 100644
+--- a/arch/x86/purgatory/purgatory.c
++++ b/arch/x86/purgatory/purgatory.c
+@@ -70,3 +70,9 @@ void purgatory(void)
+ }
+ copy_backup_region();
+ }
++
++/*
++ * Defined in order to reuse memcpy() and memset() from
++ * arch/x86/boot/compressed/string.c
++ */
++void warn(const char *msg) {}
+diff --git a/arch/x86/purgatory/string.c b/arch/x86/purgatory/string.c
+deleted file mode 100644
+index 795ca4f2cb3c..000000000000
+--- a/arch/x86/purgatory/string.c
++++ /dev/null
+@@ -1,25 +0,0 @@
+-/*
+- * Simple string functions.
+- *
+- * Copyright (C) 2014 Red Hat Inc.
+- *
+- * Author:
+- * Vivek Goyal <vgoyal@redhat.com>
+- *
+- * This source code is licensed under the GNU General Public License,
+- * Version 2. See the file COPYING for more details.
+- */
+-
+-#include <linux/types.h>
+-
+-#include "../boot/string.c"
+-
+-void *memcpy(void *dst, const void *src, size_t len)
+-{
+- return __builtin_memcpy(dst, src, len);
+-}
+-
+-void *memset(void *dst, int c, size_t len)
+-{
+- return __builtin_memset(dst, c, len);
+-}
+diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
+index 43c2615434b4..e11b5da6f828 100644
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -616,8 +616,8 @@ static int iort_dev_find_its_id(struct device *dev, u32 req_id,
+
+ /* Move to ITS specific data */
+ its = (struct acpi_iort_its_group *)node->node_data;
+- if (idx > its->its_count) {
+- dev_err(dev, "requested ITS ID index [%d] is greater than available [%d]\n",
++ if (idx >= its->its_count) {
++ dev_err(dev, "requested ITS ID index [%d] overruns ITS entries [%d]\n",
+ idx, its->its_count);
+ return -ENXIO;
+ }
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index cb919b964066..3cdadf75c82d 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -5240,7 +5240,7 @@ static int drbd_do_auth(struct drbd_connection *connection)
+ unsigned int key_len;
+ char secret[SHARED_SECRET_MAX]; /* 64 byte */
+ unsigned int resp_size;
+- SHASH_DESC_ON_STACK(desc, connection->cram_hmac_tfm);
++ struct shash_desc *desc;
+ struct packet_info pi;
+ struct net_conf *nc;
+ int err, rv;
+@@ -5253,6 +5253,13 @@ static int drbd_do_auth(struct drbd_connection *connection)
+ memcpy(secret, nc->shared_secret, key_len);
+ rcu_read_unlock();
+
++ desc = kmalloc(sizeof(struct shash_desc) +
++ crypto_shash_descsize(connection->cram_hmac_tfm),
++ GFP_KERNEL);
++ if (!desc) {
++ rv = -1;
++ goto fail;
++ }
+ desc->tfm = connection->cram_hmac_tfm;
+ desc->flags = 0;
+
+@@ -5395,7 +5402,10 @@ static int drbd_do_auth(struct drbd_connection *connection)
+ kfree(peers_ch);
+ kfree(response);
+ kfree(right_response);
+- shash_desc_zero(desc);
++ if (desc) {
++ shash_desc_zero(desc);
++ kfree(desc);
++ }
+
+ return rv;
+ }
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index f1e63eb7cbca..cef8e00c9d9d 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -886,7 +886,7 @@ static void loop_unprepare_queue(struct loop_device *lo)
+
+ static int loop_kthread_worker_fn(void *worker_ptr)
+ {
+- current->flags |= PF_LESS_THROTTLE;
++ current->flags |= PF_LESS_THROTTLE | PF_MEMALLOC_NOIO;
+ return kthread_worker_fn(worker_ptr);
+ }
+
+diff --git a/drivers/cpufreq/pasemi-cpufreq.c b/drivers/cpufreq/pasemi-cpufreq.c
+index c7710c149de8..a0620c9ec064 100644
+--- a/drivers/cpufreq/pasemi-cpufreq.c
++++ b/drivers/cpufreq/pasemi-cpufreq.c
+@@ -145,10 +145,18 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ int err = -ENODEV;
+
+ cpu = of_get_cpu_node(policy->cpu, NULL);
++ if (!cpu)
++ goto out;
+
++ max_freqp = of_get_property(cpu, "clock-frequency", NULL);
+ of_node_put(cpu);
+- if (!cpu)
++ if (!max_freqp) {
++ err = -EINVAL;
+ goto out;
++ }
++
++ /* we need the freq in kHz */
++ max_freq = *max_freqp / 1000;
+
+ dn = of_find_compatible_node(NULL, NULL, "1682m-sdc");
+ if (!dn)
+@@ -185,16 +193,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ }
+
+ pr_debug("init cpufreq on CPU %d\n", policy->cpu);
+-
+- max_freqp = of_get_property(cpu, "clock-frequency", NULL);
+- if (!max_freqp) {
+- err = -EINVAL;
+- goto out_unmap_sdcpwr;
+- }
+-
+- /* we need the freq in kHz */
+- max_freq = *max_freqp / 1000;
+-
+ pr_debug("max clock-frequency is at %u kHz\n", max_freq);
+ pr_debug("initializing frequency table\n");
+
+@@ -212,9 +210,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
+
+ return cpufreq_generic_init(policy, pas_freqs, get_gizmo_latency());
+
+-out_unmap_sdcpwr:
+- iounmap(sdcpwr_mapbase);
+-
+ out_unmap_sdcasr:
+ iounmap(sdcasr_mapbase);
+ out:
+diff --git a/drivers/crypto/ccp/ccp-crypto-aes-galois.c b/drivers/crypto/ccp/ccp-crypto-aes-galois.c
+index ca1f0d780b61..e5dcb29b687f 100644
+--- a/drivers/crypto/ccp/ccp-crypto-aes-galois.c
++++ b/drivers/crypto/ccp/ccp-crypto-aes-galois.c
+@@ -61,6 +61,19 @@ static int ccp_aes_gcm_setkey(struct crypto_aead *tfm, const u8 *key,
+ static int ccp_aes_gcm_setauthsize(struct crypto_aead *tfm,
+ unsigned int authsize)
+ {
++ switch (authsize) {
++ case 16:
++ case 15:
++ case 14:
++ case 13:
++ case 12:
++ case 8:
++ case 4:
++ break;
++ default:
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+
+@@ -107,6 +120,7 @@ static int ccp_aes_gcm_crypt(struct aead_request *req, bool encrypt)
+ memset(&rctx->cmd, 0, sizeof(rctx->cmd));
+ INIT_LIST_HEAD(&rctx->cmd.entry);
+ rctx->cmd.engine = CCP_ENGINE_AES;
++ rctx->cmd.u.aes.authsize = crypto_aead_authsize(tfm);
+ rctx->cmd.u.aes.type = ctx->u.aes.type;
+ rctx->cmd.u.aes.mode = ctx->u.aes.mode;
+ rctx->cmd.u.aes.action = encrypt;
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index e212badd39fa..1e2e42106dee 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -625,6 +625,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+
+ unsigned long long *final;
+ unsigned int dm_offset;
++ unsigned int authsize;
+ unsigned int jobid;
+ unsigned int ilen;
+ bool in_place = true; /* Default value */
+@@ -646,6 +647,21 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ if (!aes->key) /* Gotta have a key SGL */
+ return -EINVAL;
+
++ /* Zero defaults to 16 bytes, the maximum size */
++ authsize = aes->authsize ? aes->authsize : AES_BLOCK_SIZE;
++ switch (authsize) {
++ case 16:
++ case 15:
++ case 14:
++ case 13:
++ case 12:
++ case 8:
++ case 4:
++ break;
++ default:
++ return -EINVAL;
++ }
++
+ /* First, decompose the source buffer into AAD & PT,
+ * and the destination buffer into AAD, CT & tag, or
+ * the input into CT & tag.
+@@ -660,7 +676,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ p_tag = scatterwalk_ffwd(sg_tag, p_outp, ilen);
+ } else {
+ /* Input length for decryption includes tag */
+- ilen = aes->src_len - AES_BLOCK_SIZE;
++ ilen = aes->src_len - authsize;
+ p_tag = scatterwalk_ffwd(sg_tag, p_inp, ilen);
+ }
+
+@@ -769,8 +785,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ while (src.sg_wa.bytes_left) {
+ ccp_prepare_data(&src, &dst, &op, AES_BLOCK_SIZE, true);
+ if (!src.sg_wa.bytes_left) {
+- unsigned int nbytes = aes->src_len
+- % AES_BLOCK_SIZE;
++ unsigned int nbytes = ilen % AES_BLOCK_SIZE;
+
+ if (nbytes) {
+ op.eom = 1;
+@@ -842,19 +857,19 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+
+ if (aes->action == CCP_AES_ACTION_ENCRYPT) {
+ /* Put the ciphered tag after the ciphertext. */
+- ccp_get_dm_area(&final_wa, 0, p_tag, 0, AES_BLOCK_SIZE);
++ ccp_get_dm_area(&final_wa, 0, p_tag, 0, authsize);
+ } else {
+ /* Does this ciphered tag match the input? */
+- ret = ccp_init_dm_workarea(&tag, cmd_q, AES_BLOCK_SIZE,
++ ret = ccp_init_dm_workarea(&tag, cmd_q, authsize,
+ DMA_BIDIRECTIONAL);
+ if (ret)
+ goto e_tag;
+- ret = ccp_set_dm_area(&tag, 0, p_tag, 0, AES_BLOCK_SIZE);
++ ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize);
+ if (ret)
+ goto e_tag;
+
+ ret = crypto_memneq(tag.address, final_wa.address,
+- AES_BLOCK_SIZE) ? -EBADMSG : 0;
++ authsize) ? -EBADMSG : 0;
+ ccp_dm_free(&tag);
+ }
+
+@@ -862,11 +877,11 @@ e_tag:
+ ccp_dm_free(&final_wa);
+
+ e_dst:
+- if (aes->src_len && !in_place)
++ if (ilen > 0 && !in_place)
+ ccp_free_data(&dst, cmd_q);
+
+ e_src:
+- if (aes->src_len)
++ if (ilen > 0)
+ ccp_free_data(&src, cmd_q);
+
+ e_aad:
+diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
+index 6e83880046d7..ed212c8b4108 100644
+--- a/drivers/firmware/Kconfig
++++ b/drivers/firmware/Kconfig
+@@ -198,7 +198,7 @@ config DMI_SCAN_MACHINE_NON_EFI_FALLBACK
+
+ config ISCSI_IBFT_FIND
+ bool "iSCSI Boot Firmware Table Attributes"
+- depends on X86 && ACPI
++ depends on X86 && ISCSI_IBFT
+ default n
+ help
+ This option enables the kernel to find the region of memory
+@@ -209,7 +209,8 @@ config ISCSI_IBFT_FIND
+ config ISCSI_IBFT
+ tristate "iSCSI Boot Firmware Table Attributes module"
+ select ISCSI_BOOT_SYSFS
+- depends on ISCSI_IBFT_FIND && SCSI && SCSI_LOWLEVEL
++ select ISCSI_IBFT_FIND if X86
++ depends on ACPI && SCSI && SCSI_LOWLEVEL
+ default n
+ help
+ This option enables support for detection and exposing of iSCSI
+diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
+index c51462f5aa1e..966aef334c42 100644
+--- a/drivers/firmware/iscsi_ibft.c
++++ b/drivers/firmware/iscsi_ibft.c
+@@ -93,6 +93,10 @@ MODULE_DESCRIPTION("sysfs interface to BIOS iBFT information");
+ MODULE_LICENSE("GPL");
+ MODULE_VERSION(IBFT_ISCSI_VERSION);
+
++#ifndef CONFIG_ISCSI_IBFT_FIND
++struct acpi_table_ibft *ibft_addr;
++#endif
++
+ struct ibft_hdr {
+ u8 id;
+ u8 version;
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index e3f5e5d6f0c1..f4b89d1ea6f6 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -462,8 +462,10 @@ void dc_link_set_test_pattern(struct dc_link *link,
+
+ static void destruct(struct dc *dc)
+ {
+- dc_release_state(dc->current_state);
+- dc->current_state = NULL;
++ if (dc->current_state) {
++ dc_release_state(dc->current_state);
++ dc->current_state = NULL;
++ }
+
+ destroy_links(dc);
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index e0a96abb3c46..f0d68aa7c8fc 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -222,7 +222,7 @@ bool resource_construct(
+ * PORT_CONNECTIVITY == 1 (as instructed by HW team).
+ */
+ update_num_audio(&straps, &num_audio, &pool->audio_support);
+- for (i = 0; i < pool->pipe_count && i < num_audio; i++) {
++ for (i = 0; i < caps->num_audio; i++) {
+ struct audio *aud = create_funcs->create_audio(ctx, i);
+
+ if (aud == NULL) {
+@@ -1713,6 +1713,12 @@ static struct audio *find_first_free_audio(
+ return pool->audios[i];
+ }
+ }
++
++ /* use engine id to find free audio */
++ if ((id < pool->audio_count) && (res_ctx->is_audio_acquired[id] == false)) {
++ return pool->audios[id];
++ }
++
+ /*not found the matching one, first come first serve*/
+ for (i = 0; i < pool->audio_count; i++) {
+ if (res_ctx->is_audio_acquired[i] == false) {
+@@ -1866,6 +1872,7 @@ static int get_norm_pix_clk(const struct dc_crtc_timing *timing)
+ pix_clk /= 2;
+ if (timing->pixel_encoding != PIXEL_ENCODING_YCBCR422) {
+ switch (timing->display_color_depth) {
++ case COLOR_DEPTH_666:
+ case COLOR_DEPTH_888:
+ normalized_pix_clk = pix_clk;
+ break;
+@@ -1949,7 +1956,7 @@ enum dc_status resource_map_pool_resources(
+ /* TODO: Add check if ASIC support and EDID audio */
+ if (!stream->sink->converter_disable_audio &&
+ dc_is_audio_capable_signal(pipe_ctx->stream->signal) &&
+- stream->audio_info.mode_count) {
++ stream->audio_info.mode_count && stream->audio_info.flags.all) {
+ pipe_ctx->stream_res.audio = find_first_free_audio(
+ &context->res_ctx, pool, pipe_ctx->stream_res.stream_enc->id);
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
+index 070ab56a8aca..da8b198538e5 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
+@@ -242,6 +242,10 @@ static void dmcu_set_backlight_level(
+ s2 |= (level << ATOM_S2_CURRENT_BL_LEVEL_SHIFT);
+
+ REG_WRITE(BIOS_SCRATCH_2, s2);
++
++ /* waitDMCUReadyForCmd */
++ REG_WAIT(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT,
++ 0, 1, 80000);
+ }
+
+ static void dce_abm_init(struct abm *abm)
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_types.h b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
+index c0b9ca13393b..f4469fa5afb5 100644
+--- a/drivers/gpu/drm/amd/display/dc/inc/core_types.h
++++ b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
+@@ -159,7 +159,7 @@ struct resource_pool {
+ struct clock_source *clock_sources[MAX_CLOCK_SOURCES];
+ unsigned int clk_src_count;
+
+- struct audio *audios[MAX_PIPES];
++ struct audio *audios[MAX_AUDIOS];
+ unsigned int audio_count;
+ struct audio_support audio_support;
+
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h b/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h
+index cf7433ebf91a..71901743a938 100644
+--- a/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h
++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h
+@@ -34,6 +34,7 @@
+ * Data types shared between different Virtual HW blocks
+ ******************************************************************************/
+
++#define MAX_AUDIOS 7
+ #define MAX_PIPES 6
+
+ struct gamma_curve {
+diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
+index 781af1d42d76..b64a6ffc0aed 100644
+--- a/drivers/gpu/drm/drm_framebuffer.c
++++ b/drivers/gpu/drm/drm_framebuffer.c
+@@ -793,7 +793,7 @@ static int atomic_remove_fb(struct drm_framebuffer *fb)
+ struct drm_device *dev = fb->dev;
+ struct drm_atomic_state *state;
+ struct drm_plane *plane;
+- struct drm_connector *conn;
++ struct drm_connector *conn __maybe_unused;
+ struct drm_connector_state *conn_state;
+ int i, ret;
+ unsigned plane_mask;
+diff --git a/drivers/gpu/drm/i915/vlv_dsi_pll.c b/drivers/gpu/drm/i915/vlv_dsi_pll.c
+index a132a8037ecc..77df7903e071 100644
+--- a/drivers/gpu/drm/i915/vlv_dsi_pll.c
++++ b/drivers/gpu/drm/i915/vlv_dsi_pll.c
+@@ -413,8 +413,8 @@ static void glk_dsi_program_esc_clock(struct drm_device *dev,
+ else
+ txesc2_div = 10;
+
+- I915_WRITE(MIPIO_TXESC_CLK_DIV1, txesc1_div & GLK_TX_ESC_CLK_DIV1_MASK);
+- I915_WRITE(MIPIO_TXESC_CLK_DIV2, txesc2_div & GLK_TX_ESC_CLK_DIV2_MASK);
++ I915_WRITE(MIPIO_TXESC_CLK_DIV1, (1 << (txesc1_div - 1)) & GLK_TX_ESC_CLK_DIV1_MASK);
++ I915_WRITE(MIPIO_TXESC_CLK_DIV2, (1 << (txesc2_div - 1)) & GLK_TX_ESC_CLK_DIV2_MASK);
+ }
+
+ /* Program BXT Mipi clocks and dividers */
+diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
+index 9671a4bad643..31f1023214d3 100644
+--- a/drivers/hid/hid-sony.c
++++ b/drivers/hid/hid-sony.c
+@@ -587,10 +587,14 @@ static void sony_set_leds(struct sony_sc *sc);
+ static inline void sony_schedule_work(struct sony_sc *sc,
+ enum sony_worker which)
+ {
++ unsigned long flags;
++
+ switch (which) {
+ case SONY_WORKER_STATE:
+- if (!sc->defer_initialization)
++ spin_lock_irqsave(&sc->lock, flags);
++ if (!sc->defer_initialization && sc->state_worker_initialized)
+ schedule_work(&sc->state_worker);
++ spin_unlock_irqrestore(&sc->lock, flags);
+ break;
+ case SONY_WORKER_HOTPLUG:
+ if (sc->hotplug_worker_initialized)
+@@ -2553,13 +2557,18 @@ static inline void sony_init_output_report(struct sony_sc *sc,
+
+ static inline void sony_cancel_work_sync(struct sony_sc *sc)
+ {
++ unsigned long flags;
++
+ if (sc->hotplug_worker_initialized)
+ cancel_work_sync(&sc->hotplug_worker);
+- if (sc->state_worker_initialized)
++ if (sc->state_worker_initialized) {
++ spin_lock_irqsave(&sc->lock, flags);
++ sc->state_worker_initialized = 0;
++ spin_unlock_irqrestore(&sc->lock, flags);
+ cancel_work_sync(&sc->state_worker);
++ }
+ }
+
+-
+ static int sony_input_configured(struct hid_device *hdev,
+ struct hid_input *hidinput)
+ {
+diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
+index 78603b78cf41..eba692cddbde 100644
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -818,7 +818,7 @@ static const u16 NCT6106_REG_TARGET[] = { 0x111, 0x121, 0x131 };
+ static const u16 NCT6106_REG_WEIGHT_TEMP_SEL[] = { 0x168, 0x178, 0x188 };
+ static const u16 NCT6106_REG_WEIGHT_TEMP_STEP[] = { 0x169, 0x179, 0x189 };
+ static const u16 NCT6106_REG_WEIGHT_TEMP_STEP_TOL[] = { 0x16a, 0x17a, 0x18a };
+-static const u16 NCT6106_REG_WEIGHT_DUTY_STEP[] = { 0x16b, 0x17b, 0x17c };
++static const u16 NCT6106_REG_WEIGHT_DUTY_STEP[] = { 0x16b, 0x17b, 0x18b };
+ static const u16 NCT6106_REG_WEIGHT_TEMP_BASE[] = { 0x16c, 0x17c, 0x18c };
+ static const u16 NCT6106_REG_WEIGHT_DUTY_BASE[] = { 0x16d, 0x17d, 0x18d };
+
+@@ -3673,6 +3673,7 @@ static int nct6775_probe(struct platform_device *pdev)
+ data->REG_FAN_TIME[0] = NCT6106_REG_FAN_STOP_TIME;
+ data->REG_FAN_TIME[1] = NCT6106_REG_FAN_STEP_UP_TIME;
+ data->REG_FAN_TIME[2] = NCT6106_REG_FAN_STEP_DOWN_TIME;
++ data->REG_TOLERANCE_H = NCT6106_REG_TOLERANCE_H;
+ data->REG_PWM[0] = NCT6106_REG_PWM;
+ data->REG_PWM[1] = NCT6106_REG_FAN_START_OUTPUT;
+ data->REG_PWM[2] = NCT6106_REG_FAN_STOP_OUTPUT;
+diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
+index 2876c18ed841..38ffbdb0a85f 100644
+--- a/drivers/hwmon/nct7802.c
++++ b/drivers/hwmon/nct7802.c
+@@ -768,7 +768,7 @@ static struct attribute *nct7802_in_attrs[] = {
+ &sensor_dev_attr_in3_alarm.dev_attr.attr,
+ &sensor_dev_attr_in3_beep.dev_attr.attr,
+
+- &sensor_dev_attr_in4_input.dev_attr.attr, /* 17 */
++ &sensor_dev_attr_in4_input.dev_attr.attr, /* 16 */
+ &sensor_dev_attr_in4_min.dev_attr.attr,
+ &sensor_dev_attr_in4_max.dev_attr.attr,
+ &sensor_dev_attr_in4_alarm.dev_attr.attr,
+@@ -794,9 +794,9 @@ static umode_t nct7802_in_is_visible(struct kobject *kobj,
+
+ if (index >= 6 && index < 11 && (reg & 0x03) != 0x03) /* VSEN1 */
+ return 0;
+- if (index >= 11 && index < 17 && (reg & 0x0c) != 0x0c) /* VSEN2 */
++ if (index >= 11 && index < 16 && (reg & 0x0c) != 0x0c) /* VSEN2 */
+ return 0;
+- if (index >= 17 && (reg & 0x30) != 0x30) /* VSEN3 */
++ if (index >= 16 && (reg & 0x30) != 0x30) /* VSEN3 */
+ return 0;
+
+ return attr->mode;
+diff --git a/drivers/iio/accel/cros_ec_accel_legacy.c b/drivers/iio/accel/cros_ec_accel_legacy.c
+index 063e89eff791..c776a3509a71 100644
+--- a/drivers/iio/accel/cros_ec_accel_legacy.c
++++ b/drivers/iio/accel/cros_ec_accel_legacy.c
+@@ -328,7 +328,6 @@ static const struct iio_chan_spec_ext_info cros_ec_accel_legacy_ext_info[] = {
+ .modified = 1, \
+ .info_mask_separate = \
+ BIT(IIO_CHAN_INFO_RAW) | \
+- BIT(IIO_CHAN_INFO_SCALE) | \
+ BIT(IIO_CHAN_INFO_CALIBBIAS), \
+ .info_mask_shared_by_all = BIT(IIO_CHAN_INFO_SCALE), \
+ .ext_info = cros_ec_accel_legacy_ext_info, \
+diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
+index 0538ff8c4ac1..ce9af43fa2de 100644
+--- a/drivers/iio/adc/max9611.c
++++ b/drivers/iio/adc/max9611.c
+@@ -86,7 +86,7 @@
+ #define MAX9611_TEMP_MAX_POS 0x7f80
+ #define MAX9611_TEMP_MAX_NEG 0xff80
+ #define MAX9611_TEMP_MIN_NEG 0xd980
+-#define MAX9611_TEMP_MASK GENMASK(7, 15)
++#define MAX9611_TEMP_MASK GENMASK(15, 7)
+ #define MAX9611_TEMP_SHIFT 0x07
+ #define MAX9611_TEMP_RAW(_r) ((_r) >> MAX9611_TEMP_SHIFT)
+ #define MAX9611_TEMP_SCALE_NUM 1000000
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 530142b5a115..eb9b9de47fd1 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1810,6 +1810,30 @@ static int elantech_create_smbus(struct psmouse *psmouse,
+ leave_breadcrumbs);
+ }
+
++static bool elantech_use_host_notify(struct psmouse *psmouse,
++ struct elantech_device_info *info)
++{
++ if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
++ return true;
++
++ switch (info->bus) {
++ case ETP_BUS_PS2_ONLY:
++ /* expected case */
++ break;
++ case ETP_BUS_SMB_HST_NTFY_ONLY:
++ case ETP_BUS_PS2_SMB_HST_NTFY:
++ /* SMbus implementation is stable since 2018 */
++ if (dmi_get_bios_year() >= 2018)
++ return true;
++ default:
++ psmouse_dbg(psmouse,
++ "Ignoring SMBus bus provider %d\n", info->bus);
++ break;
++ }
++
++ return false;
++}
++
+ /**
+ * elantech_setup_smbus - called once the PS/2 devices are enumerated
+ * and decides to instantiate a SMBus InterTouch device.
+@@ -1829,7 +1853,7 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
+ * i2c_blacklist_pnp_ids.
+ * Old ICs are up to the user to decide.
+ */
+- if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) ||
++ if (!elantech_use_host_notify(psmouse, info) ||
+ psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids))
+ return -ENXIO;
+ }
+@@ -1849,34 +1873,6 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
+ return 0;
+ }
+
+-static bool elantech_use_host_notify(struct psmouse *psmouse,
+- struct elantech_device_info *info)
+-{
+- if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
+- return true;
+-
+- switch (info->bus) {
+- case ETP_BUS_PS2_ONLY:
+- /* expected case */
+- break;
+- case ETP_BUS_SMB_ALERT_ONLY:
+- /* fall-through */
+- case ETP_BUS_PS2_SMB_ALERT:
+- psmouse_dbg(psmouse, "Ignoring SMBus provider through alert protocol.\n");
+- break;
+- case ETP_BUS_SMB_HST_NTFY_ONLY:
+- /* fall-through */
+- case ETP_BUS_PS2_SMB_HST_NTFY:
+- return true;
+- default:
+- psmouse_dbg(psmouse,
+- "Ignoring SMBus bus provider %d.\n",
+- info->bus);
+- }
+-
+- return false;
+-}
+-
+ int elantech_init_smbus(struct psmouse *psmouse)
+ {
+ struct elantech_device_info info;
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index af7d48431b85..06cebde2422e 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -185,6 +185,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN2055", /* E580 */
+ "SYN3052", /* HP EliteBook 840 G4 */
+ "SYN3221", /* HP 15-ay000 */
++ "SYN323d", /* HP Spectre X360 13-w013dx */
+ NULL
+ };
+
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index d61570d64ee7..48304e26f988 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -1672,6 +1672,8 @@ static int usbtouch_probe(struct usb_interface *intf,
+ if (!usbtouch || !input_dev)
+ goto out_free;
+
++ mutex_init(&usbtouch->pm_mutex);
++
+ type = &usbtouch_dev_info[id->driver_info];
+ usbtouch->type = type;
+ if (!type->process_pkt)
+diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
+index ed5cefb83768..89deb451e0ac 100644
+--- a/drivers/mmc/host/cavium.c
++++ b/drivers/mmc/host/cavium.c
+@@ -374,6 +374,7 @@ static int finish_dma_single(struct cvm_mmc_host *host, struct mmc_data *data)
+ {
+ data->bytes_xfered = data->blocks * data->blksz;
+ data->error = 0;
++ dma_unmap_sg(host->dev, data->sg, data->sg_len, get_dma_dir(data));
+ return 1;
+ }
+
+@@ -1046,7 +1047,8 @@ int cvm_mmc_of_slot_probe(struct device *dev, struct cvm_mmc_host *host)
+ mmc->max_segs = 1;
+
+ /* DMA size field can address up to 8 MB */
+- mmc->max_seg_size = 8 * 1024 * 1024;
++ mmc->max_seg_size = min_t(unsigned int, 8 * 1024 * 1024,
++ dma_get_max_seg_size(host->dev));
+ mmc->max_req_size = mmc->max_seg_size;
+ /* External DMA is in 512 byte blocks */
+ mmc->max_blk_size = 512;
+diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
+index 602c19e23f05..786d852a70d5 100644
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -1512,10 +1512,11 @@ static int rcar_canfd_rx_poll(struct napi_struct *napi, int quota)
+
+ /* All packets processed */
+ if (num_pkts < quota) {
+- napi_complete_done(napi, num_pkts);
+- /* Enable Rx FIFO interrupts */
+- rcar_canfd_set_bit(priv->base, RCANFD_RFCC(ridx),
+- RCANFD_RFCC_RFIE);
++ if (napi_complete_done(napi, num_pkts)) {
++ /* Enable Rx FIFO interrupts */
++ rcar_canfd_set_bit(priv->base, RCANFD_RFCC(ridx),
++ RCANFD_RFCC_RFIE);
++ }
+ }
+ return num_pkts;
+ }
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index 611f9d31be5d..740ef47eab01 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -576,16 +576,16 @@ static int peak_usb_ndo_stop(struct net_device *netdev)
+ dev->state &= ~PCAN_USB_STATE_STARTED;
+ netif_stop_queue(netdev);
+
++ close_candev(netdev);
++
++ dev->can.state = CAN_STATE_STOPPED;
++
+ /* unlink all pending urbs and free used memory */
+ peak_usb_unlink_all_urbs(dev);
+
+ if (dev->adapter->dev_stop)
+ dev->adapter->dev_stop(dev);
+
+- close_candev(netdev);
+-
+- dev->can.state = CAN_STATE_STOPPED;
+-
+ /* can set bus off now */
+ if (dev->adapter->dev_set_bus) {
+ int err = dev->adapter->dev_set_bus(dev, 0);
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+index dd161c5eea8e..41988358f63c 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+@@ -849,7 +849,7 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev)
+ goto err_out;
+
+ /* allocate command buffer once for all for the interface */
+- pdev->cmd_buffer_addr = kmalloc(PCAN_UFD_CMD_BUFFER_SIZE,
++ pdev->cmd_buffer_addr = kzalloc(PCAN_UFD_CMD_BUFFER_SIZE,
+ GFP_KERNEL);
+ if (!pdev->cmd_buffer_addr)
+ goto err_out_1;
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+index d516def846ab..b304198f0b3a 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+@@ -502,7 +502,7 @@ static int pcan_usb_pro_drv_loaded(struct peak_usb_device *dev, int loaded)
+ u8 *buffer;
+ int err;
+
+- buffer = kmalloc(PCAN_USBPRO_FCT_DRVLD_REQ_LEN, GFP_KERNEL);
++ buffer = kzalloc(PCAN_USBPRO_FCT_DRVLD_REQ_LEN, GFP_KERNEL);
+ if (!buffer)
+ return -ENOMEM;
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+index f2aba5b160c2..d45c435a599d 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+@@ -67,7 +67,8 @@ static struct ch_tc_pedit_fields pedits[] = {
+ static struct ch_tc_flower_entry *allocate_flower_entry(void)
+ {
+ struct ch_tc_flower_entry *new = kzalloc(sizeof(*new), GFP_KERNEL);
+- spin_lock_init(&new->lock);
++ if (new)
++ spin_lock_init(&new->lock);
+ return new;
+ }
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 8b7d70e3a379..3fe7605a2cca 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -724,7 +724,7 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
+
+ for (i = 0; i < n_profiles; i++) {
+ /* the tables start at element 3 */
+- static int pos = 3;
++ int pos = 3;
+
+ /* The EWRD profiles officially go from 2 to 4, but we
+ * save them in sar_profiles[1-3] (because we don't
+@@ -836,6 +836,22 @@ int iwl_mvm_sar_select_profile(struct iwl_mvm *mvm, int prof_a, int prof_b)
+ return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, 0, len, &cmd);
+ }
+
++static bool iwl_mvm_sar_geo_support(struct iwl_mvm *mvm)
++{
++ /*
++ * The GEO_TX_POWER_LIMIT command is not supported on earlier
++ * firmware versions. Unfortunately, we don't have a TLV API
++ * flag to rely on, so rely on the major version which is in
++ * the first byte of ucode_ver. This was implemented
++ * initially on version 38 and then backported to 36, 29 and
++ * 17.
++ */
++ return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 38 ||
++ IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 36 ||
++ IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 ||
++ IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17;
++}
++
+ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
+ {
+ struct iwl_geo_tx_power_profiles_resp *resp;
+@@ -851,6 +867,9 @@ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
+ .data = { &geo_cmd },
+ };
+
++ if (!iwl_mvm_sar_geo_support(mvm))
++ return -EOPNOTSUPP;
++
+ ret = iwl_mvm_send_cmd(mvm, &cmd);
+ if (ret) {
+ IWL_ERR(mvm, "Failed to get geographic profile info %d\n", ret);
+@@ -876,13 +895,7 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
+ int ret, i, j;
+ u16 cmd_wide_id = WIDE_ID(PHY_OPS_GROUP, GEO_TX_POWER_LIMIT);
+
+- /*
+- * This command is not supported on earlier firmware versions.
+- * Unfortunately, we don't have a TLV API flag to rely on, so
+- * rely on the major version which is in the first byte of
+- * ucode_ver.
+- */
+- if (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) < 41)
++ if (!iwl_mvm_sar_geo_support(mvm))
+ return 0;
+
+ ret = iwl_mvm_sar_get_wgds_table(mvm);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index 93f0d387688a..42fdb7970cfd 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -403,6 +403,8 @@ static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
+ DMA_TO_DEVICE);
+ }
+
++ meta->tbs = 0;
++
+ if (trans->cfg->use_tfh) {
+ struct iwl_tfh_tfd *tfd_fh = (void *)tfd;
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/main.h b/drivers/net/wireless/marvell/mwifiex/main.h
+index b025ba164412..e39bb5c42c9a 100644
+--- a/drivers/net/wireless/marvell/mwifiex/main.h
++++ b/drivers/net/wireless/marvell/mwifiex/main.h
+@@ -124,6 +124,7 @@ enum {
+
+ #define MWIFIEX_MAX_TOTAL_SCAN_TIME (MWIFIEX_TIMER_10S - MWIFIEX_TIMER_1S)
+
++#define WPA_GTK_OUI_OFFSET 2
+ #define RSN_GTK_OUI_OFFSET 2
+
+ #define MWIFIEX_OUI_NOT_PRESENT 0
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index 6dd771ce68a3..ed27147efcb3 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -181,7 +181,8 @@ mwifiex_is_wpa_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher)
+ u8 ret = MWIFIEX_OUI_NOT_PRESENT;
+
+ if (has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC)) {
+- iebody = (struct ie_body *) bss_desc->bcn_wpa_ie->data;
++ iebody = (struct ie_body *)((u8 *)bss_desc->bcn_wpa_ie->data +
++ WPA_GTK_OUI_OFFSET);
+ oui = &mwifiex_wpa_oui[cipher][0];
+ ret = mwifiex_search_oui_in_ie(iebody, oui);
+ if (ret)
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 260248fbb8fe..a11e210d173e 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -20,11 +20,6 @@ module_param(multipath, bool, 0444);
+ MODULE_PARM_DESC(multipath,
+ "turn on native support for multiple controllers per subsystem");
+
+-inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
+-{
+- return multipath && ctrl->subsys && (ctrl->subsys->cmic & (1 << 3));
+-}
+-
+ /*
+ * If multipathing is enabled we need to always use the subsystem instance
+ * number for numbering our devices to avoid conflicts between subsystems that
+@@ -516,7 +511,8 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
+ {
+ int error;
+
+- if (!nvme_ctrl_use_ana(ctrl))
++ /* check if multipath is enabled and we have the capability */
++ if (!multipath || !ctrl->subsys || !(ctrl->subsys->cmic & (1 << 3)))
+ return 0;
+
+ ctrl->anacap = id->anacap;
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index e82cdaec81c9..d5e29b57eb34 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -464,7 +464,11 @@ extern const struct attribute_group nvme_ns_id_attr_group;
+ extern const struct block_device_operations nvme_ns_head_ops;
+
+ #ifdef CONFIG_NVME_MULTIPATH
+-bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl);
++static inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
++{
++ return ctrl->ana_log_buf != NULL;
++}
++
+ void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+ struct nvme_ctrl *ctrl, int *flags);
+ void nvme_failover_req(struct request *req);
+diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
+index 4ac4a73037f5..4b7cc8d425b1 100644
+--- a/drivers/s390/cio/qdio_main.c
++++ b/drivers/s390/cio/qdio_main.c
+@@ -1569,13 +1569,13 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags,
+ rc = qdio_kick_outbound_q(q, phys_aob);
+ } else if (need_siga_sync(q)) {
+ rc = qdio_siga_sync_q(q);
++ } else if (count < QDIO_MAX_BUFFERS_PER_Q &&
++ get_buf_state(q, prev_buf(bufnr), &state, 0) > 0 &&
++ state == SLSB_CU_OUTPUT_PRIMED) {
++ /* The previous buffer is not processed yet, tack on. */
++ qperf_inc(q, fast_requeue);
+ } else {
+- /* try to fast requeue buffers */
+- get_buf_state(q, prev_buf(bufnr), &state, 0);
+- if (state != SLSB_CU_OUTPUT_PRIMED)
+- rc = qdio_kick_outbound_q(q, 0);
+- else
+- qperf_inc(q, fast_requeue);
++ rc = qdio_kick_outbound_q(q, 0);
+ }
+
+ /* in case of SIGA errors we must process the error immediately */
+diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
+index 70a006ba4d05..4fe06ff7b2c8 100644
+--- a/drivers/s390/cio/vfio_ccw_cp.c
++++ b/drivers/s390/cio/vfio_ccw_cp.c
+@@ -89,8 +89,10 @@ static int pfn_array_alloc_pin(struct pfn_array *pa, struct device *mdev,
+ sizeof(*pa->pa_iova_pfn) +
+ sizeof(*pa->pa_pfn),
+ GFP_KERNEL);
+- if (unlikely(!pa->pa_iova_pfn))
++ if (unlikely(!pa->pa_iova_pfn)) {
++ pa->pa_nr = 0;
+ return -ENOMEM;
++ }
+ pa->pa_pfn = pa->pa_iova_pfn + pa->pa_nr;
+
+ pa->pa_iova_pfn[0] = pa->pa_iova >> PAGE_SHIFT;
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index d1154baa9436..9c21938ed67e 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -54,6 +54,7 @@
+ #define ALUA_FAILOVER_TIMEOUT 60
+ #define ALUA_FAILOVER_RETRIES 5
+ #define ALUA_RTPG_DELAY_MSECS 5
++#define ALUA_RTPG_RETRY_DELAY 2
+
+ /* device handler flags */
+ #define ALUA_OPTIMIZE_STPG 0x01
+@@ -696,7 +697,7 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ case SCSI_ACCESS_STATE_TRANSITIONING:
+ if (time_before(jiffies, pg->expiry)) {
+ /* State transition, retry */
+- pg->interval = 2;
++ pg->interval = ALUA_RTPG_RETRY_DELAY;
+ err = SCSI_DH_RETRY;
+ } else {
+ struct alua_dh_data *h;
+@@ -821,6 +822,8 @@ static void alua_rtpg_work(struct work_struct *work)
+ spin_lock_irqsave(&pg->lock, flags);
+ pg->flags &= ~ALUA_PG_RUNNING;
+ pg->flags |= ALUA_PG_RUN_RTPG;
++ if (!pg->interval)
++ pg->interval = ALUA_RTPG_RETRY_DELAY;
+ spin_unlock_irqrestore(&pg->lock, flags);
+ queue_delayed_work(kaluad_wq, &pg->rtpg_work,
+ pg->interval * HZ);
+@@ -832,6 +835,8 @@ static void alua_rtpg_work(struct work_struct *work)
+ spin_lock_irqsave(&pg->lock, flags);
+ if (err == SCSI_DH_RETRY || pg->flags & ALUA_PG_RUN_RTPG) {
+ pg->flags &= ~ALUA_PG_RUNNING;
++ if (!pg->interval && !(pg->flags & ALUA_PG_RUN_RTPG))
++ pg->interval = ALUA_RTPG_RETRY_DELAY;
+ pg->flags |= ALUA_PG_RUN_RTPG;
+ spin_unlock_irqrestore(&pg->lock, flags);
+ queue_delayed_work(kaluad_wq, &pg->rtpg_work,
+diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
+index b64ca977825d..71d53bb239e2 100644
+--- a/drivers/scsi/ibmvscsi/ibmvfc.c
++++ b/drivers/scsi/ibmvscsi/ibmvfc.c
+@@ -4874,8 +4874,8 @@ static int ibmvfc_remove(struct vio_dev *vdev)
+
+ spin_lock_irqsave(vhost->host->host_lock, flags);
+ ibmvfc_purge_requests(vhost, DID_ERROR);
+- ibmvfc_free_event_pool(vhost);
+ spin_unlock_irqrestore(vhost->host->host_lock, flags);
++ ibmvfc_free_event_pool(vhost);
+
+ ibmvfc_free_mem(vhost);
+ spin_lock(&ibmvfc_driver_lock);
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index e0c87228438d..806ceabcabc3 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3025,6 +3025,7 @@ megasas_fw_crash_buffer_show(struct device *cdev,
+ u32 size;
+ unsigned long buff_addr;
+ unsigned long dmachunk = CRASH_DMA_BUF_SIZE;
++ unsigned long chunk_left_bytes;
+ unsigned long src_addr;
+ unsigned long flags;
+ u32 buff_offset;
+@@ -3050,6 +3051,8 @@ megasas_fw_crash_buffer_show(struct device *cdev,
+ }
+
+ size = (instance->fw_crash_buffer_size * dmachunk) - buff_offset;
++ chunk_left_bytes = dmachunk - (buff_offset % dmachunk);
++ size = (size > chunk_left_bytes) ? chunk_left_bytes : size;
+ size = (size >= PAGE_SIZE) ? (PAGE_SIZE - 1) : size;
+
+ src_addr = (unsigned long)instance->crash_buf[buff_offset / dmachunk] +
+diff --git a/drivers/staging/android/ion/ion_page_pool.c b/drivers/staging/android/ion/ion_page_pool.c
+index 9bc56eb48d2a..890d264ac687 100644
+--- a/drivers/staging/android/ion/ion_page_pool.c
++++ b/drivers/staging/android/ion/ion_page_pool.c
+@@ -8,11 +8,14 @@
+ #include <linux/list.h>
+ #include <linux/slab.h>
+ #include <linux/swap.h>
++#include <linux/sched/signal.h>
+
+ #include "ion.h"
+
+ static inline struct page *ion_page_pool_alloc_pages(struct ion_page_pool *pool)
+ {
++ if (fatal_signal_pending(current))
++ return NULL;
+ return alloc_pages(pool->gfp_mask, pool->order);
+ }
+
+diff --git a/drivers/staging/gasket/apex_driver.c b/drivers/staging/gasket/apex_driver.c
+index c747e9ca4518..0cef1d6d2e2b 100644
+--- a/drivers/staging/gasket/apex_driver.c
++++ b/drivers/staging/gasket/apex_driver.c
+@@ -538,7 +538,7 @@ static ssize_t sysfs_show(struct device *device, struct device_attribute *attr,
+ break;
+ case ATTR_KERNEL_HIB_SIMPLE_PAGE_TABLE_SIZE:
+ ret = scnprintf(buf, PAGE_SIZE, "%u\n",
+- gasket_page_table_num_entries(
++ gasket_page_table_num_simple_entries(
+ gasket_dev->page_table[0]));
+ break;
+ case ATTR_KERNEL_HIB_NUM_ACTIVE_PAGES:
+diff --git a/drivers/tty/tty_ldsem.c b/drivers/tty/tty_ldsem.c
+index b989ca26fc78..2f0372976459 100644
+--- a/drivers/tty/tty_ldsem.c
++++ b/drivers/tty/tty_ldsem.c
+@@ -116,8 +116,7 @@ static void __ldsem_wake_readers(struct ld_semaphore *sem)
+
+ list_for_each_entry_safe(waiter, next, &sem->read_wait, list) {
+ tsk = waiter->task;
+- smp_mb();
+- waiter->task = NULL;
++ smp_store_release(&waiter->task, NULL);
+ wake_up_process(tsk);
+ put_task_struct(tsk);
+ }
+@@ -217,7 +216,7 @@ down_read_failed(struct ld_semaphore *sem, long count, long timeout)
+ for (;;) {
+ set_current_state(TASK_UNINTERRUPTIBLE);
+
+- if (!waiter.task)
++ if (!smp_load_acquire(&waiter.task))
+ break;
+ if (!timeout)
+ break;
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index ffccd40ea67d..29c6414f48f1 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1792,8 +1792,6 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ return 0;
+
+ error:
+- if (as && as->usbm)
+- dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count);
+ kfree(isopkt);
+ kfree(dr);
+ if (as)
+diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
+index 671bce18782c..8616c52849c6 100644
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -238,10 +238,15 @@ int xhci_rcar_init_quirk(struct usb_hcd *hcd)
+ * pointers. So, this driver clears the AC64 bit of xhci->hcc_params
+ * to call dma_set_coherent_mask(dev, DMA_BIT_MASK(32)) in
+ * xhci_gen_setup().
++ *
++ * And, since the firmware/internal CPU control the USBSTS.STS_HALT
++ * and the process speed is down when the roothub port enters U3,
++ * long delay for the handshake of STS_HALT is neeed in xhci_suspend().
+ */
+ if (xhci_rcar_is_gen2(hcd->self.controller) ||
+- xhci_rcar_is_gen3(hcd->self.controller))
+- xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
++ xhci_rcar_is_gen3(hcd->self.controller)) {
++ xhci->quirks |= XHCI_NO_64BIT_SUPPORT | XHCI_SLOW_SUSPEND;
++ }
+
+ if (!xhci_rcar_wait_for_pll_active(hcd))
+ return -ETIMEDOUT;
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index c2991b8a65ce..55db0fc87927 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -866,19 +866,20 @@ static void iowarrior_disconnect(struct usb_interface *interface)
+ dev = usb_get_intfdata(interface);
+ mutex_lock(&iowarrior_open_disc_lock);
+ usb_set_intfdata(interface, NULL);
++ /* prevent device read, write and ioctl */
++ dev->present = 0;
+
+ minor = dev->minor;
++ mutex_unlock(&iowarrior_open_disc_lock);
++ /* give back our minor - this will call close() locks need to be dropped at this point*/
+
+- /* give back our minor */
+ usb_deregister_dev(interface, &iowarrior_class);
+
+ mutex_lock(&dev->mutex);
+
+ /* prevent device read, write and ioctl */
+- dev->present = 0;
+
+ mutex_unlock(&dev->mutex);
+- mutex_unlock(&iowarrior_open_disc_lock);
+
+ if (dev->opened) {
+ /* There is a process that holds a filedescriptor to the device ,
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index 7b306aa22d25..6715a128e6c8 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -92,7 +92,6 @@ static void yurex_delete(struct kref *kref)
+
+ dev_dbg(&dev->interface->dev, "%s\n", __func__);
+
+- usb_put_dev(dev->udev);
+ if (dev->cntl_urb) {
+ usb_kill_urb(dev->cntl_urb);
+ kfree(dev->cntl_req);
+@@ -108,6 +107,7 @@ static void yurex_delete(struct kref *kref)
+ dev->int_buffer, dev->urb->transfer_dma);
+ usb_free_urb(dev->urb);
+ }
++ usb_put_dev(dev->udev);
+ kfree(dev);
+ }
+
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index 3457c1fdebd1..5f29ce8d6c3f 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -378,7 +378,8 @@ static enum tcpm_state tcpm_default_state(struct tcpm_port *port)
+ return SNK_UNATTACHED;
+ else if (port->try_role == TYPEC_SOURCE)
+ return SRC_UNATTACHED;
+- else if (port->tcpc->config->default_role == TYPEC_SINK)
++ else if (port->tcpc->config &&
++ port->tcpc->config->default_role == TYPEC_SINK)
+ return SNK_UNATTACHED;
+ /* Fall through to return SRC_UNATTACHED */
+ } else if (port->port_type == TYPEC_PORT_SNK) {
+@@ -585,7 +586,20 @@ static void tcpm_debugfs_init(struct tcpm_port *port)
+
+ static void tcpm_debugfs_exit(struct tcpm_port *port)
+ {
++ int i;
++
++ mutex_lock(&port->logbuffer_lock);
++ for (i = 0; i < LOG_BUFFER_ENTRIES; i++) {
++ kfree(port->logbuffer[i]);
++ port->logbuffer[i] = NULL;
++ }
++ mutex_unlock(&port->logbuffer_lock);
++
+ debugfs_remove(port->dentry);
++ if (list_empty(&rootdir->d_subdirs)) {
++ debugfs_remove(rootdir);
++ rootdir = NULL;
++ }
+ }
+
+ #else
+@@ -1094,7 +1108,8 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
+ break;
+ case CMD_ATTENTION:
+ /* Attention command does not have response */
+- typec_altmode_attention(adev, p[1]);
++ if (adev)
++ typec_altmode_attention(adev, p[1]);
+ return 0;
+ default:
+ break;
+@@ -1146,20 +1161,26 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
+ }
+ break;
+ case CMD_ENTER_MODE:
+- typec_altmode_update_active(pdev, true);
+-
+- if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) {
+- response[0] = VDO(adev->svid, 1, CMD_EXIT_MODE);
+- response[0] |= VDO_OPOS(adev->mode);
+- return 1;
++ if (adev && pdev) {
++ typec_altmode_update_active(pdev, true);
++
++ if (typec_altmode_vdm(adev, p[0], &p[1], cnt)) {
++ response[0] = VDO(adev->svid, 1,
++ CMD_EXIT_MODE);
++ response[0] |= VDO_OPOS(adev->mode);
++ return 1;
++ }
+ }
+ return 0;
+ case CMD_EXIT_MODE:
+- typec_altmode_update_active(pdev, false);
++ if (adev && pdev) {
++ typec_altmode_update_active(pdev, false);
+
+- /* Back to USB Operation */
+- WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
+- NULL));
++ /* Back to USB Operation */
++ WARN_ON(typec_altmode_notify(adev,
++ TYPEC_STATE_USB,
++ NULL));
++ }
+ break;
+ default:
+ break;
+@@ -1169,8 +1190,10 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
+ switch (cmd) {
+ case CMD_ENTER_MODE:
+ /* Back to USB Operation */
+- WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB,
+- NULL));
++ if (adev)
++ WARN_ON(typec_altmode_notify(adev,
++ TYPEC_STATE_USB,
++ NULL));
+ break;
+ default:
+ break;
+@@ -1181,7 +1204,8 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
+ }
+
+ /* Informing the alternate mode drivers about everything */
+- typec_altmode_vdm(adev, p[0], &p[1], cnt);
++ if (adev)
++ typec_altmode_vdm(adev, p[0], &p[1], cnt);
+
+ return rlen;
+ }
+@@ -4083,7 +4107,7 @@ static int tcpm_try_role(const struct typec_capability *cap, int role)
+ mutex_lock(&port->lock);
+ if (tcpc->try_role)
+ ret = tcpc->try_role(tcpc, role);
+- if (!ret && !tcpc->config->try_role_hw)
++ if (!ret && (!tcpc->config || !tcpc->config->try_role_hw))
+ port->try_role = role;
+ port->try_src_count = 0;
+ port->try_snk_count = 0;
+@@ -4730,7 +4754,7 @@ static int tcpm_copy_caps(struct tcpm_port *port,
+ port->typec_caps.prefer_role = tcfg->default_role;
+ port->typec_caps.type = tcfg->type;
+ port->typec_caps.data = tcfg->data;
+- port->self_powered = port->tcpc->config->self_powered;
++ port->self_powered = tcfg->self_powered;
+
+ return 0;
+ }
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index c181f1621e1a..2bc47eb6215e 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -168,7 +168,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon)
+ if (tcon == NULL)
+ return 0;
+
+- if (smb2_command == SMB2_TREE_CONNECT)
++ if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL)
+ return 0;
+
+ if (tcon->tidStatus == CifsExiting) {
+@@ -1006,7 +1006,12 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data)
+ else
+ req->SecurityMode = 0;
+
++#ifdef CONFIG_CIFS_DFS_UPCALL
++ req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS);
++#else
+ req->Capabilities = 0;
++#endif /* DFS_UPCALL */
++
+ req->Channel = 0; /* MBZ */
+
+ sess_data->iov[0].iov_base = (char *)req;
+diff --git a/fs/dax.c b/fs/dax.c
+index 75a289c31c7e..f0d932fa39c2 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -659,7 +659,7 @@ struct page *dax_layout_busy_page(struct address_space *mapping)
+ * guaranteed to either see new references or prevent new
+ * references from being established.
+ */
+- unmap_mapping_range(mapping, 0, 0, 1);
++ unmap_mapping_range(mapping, 0, 0, 0);
+
+ while (index < end && pagevec_lookup_entries(&pvec, mapping, index,
+ min(end - index, (pgoff_t)PAGEVEC_SIZE),
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 7f8bb0868c0f..d14d71d8d7ee 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -392,6 +392,19 @@ static int fillup_metapath(struct gfs2_inode *ip, struct metapath *mp, int h)
+ return mp->mp_aheight - x - 1;
+ }
+
++static sector_t metapath_to_block(struct gfs2_sbd *sdp, struct metapath *mp)
++{
++ sector_t factor = 1, block = 0;
++ int hgt;
++
++ for (hgt = mp->mp_fheight - 1; hgt >= 0; hgt--) {
++ if (hgt < mp->mp_aheight)
++ block += mp->mp_list[hgt] * factor;
++ factor *= sdp->sd_inptrs;
++ }
++ return block;
++}
++
+ static void release_metapath(struct metapath *mp)
+ {
+ int i;
+@@ -432,60 +445,84 @@ static inline unsigned int gfs2_extent_length(struct buffer_head *bh, __be64 *pt
+ return ptr - first;
+ }
+
+-typedef const __be64 *(*gfs2_metadata_walker)(
+- struct metapath *mp,
+- const __be64 *start, const __be64 *end,
+- u64 factor, void *data);
++enum walker_status { WALK_STOP, WALK_FOLLOW, WALK_CONTINUE };
+
+-#define WALK_STOP ((__be64 *)0)
+-#define WALK_NEXT ((__be64 *)1)
++/*
++ * gfs2_metadata_walker - walk an indirect block
++ * @mp: Metapath to indirect block
++ * @ptrs: Number of pointers to look at
++ *
++ * When returning WALK_FOLLOW, the walker must update @mp to point at the right
++ * indirect block to follow.
++ */
++typedef enum walker_status (*gfs2_metadata_walker)(struct metapath *mp,
++ unsigned int ptrs);
++
++/*
++ * gfs2_walk_metadata - walk a tree of indirect blocks
++ * @inode: The inode
++ * @mp: Starting point of walk
++ * @max_len: Maximum number of blocks to walk
++ * @walker: Called during the walk
++ *
++ * Returns 1 if the walk was stopped by @walker, 0 if we went past @max_len or
++ * past the end of metadata, and a negative error code otherwise.
++ */
+
+-static int gfs2_walk_metadata(struct inode *inode, sector_t lblock,
+- u64 len, struct metapath *mp, gfs2_metadata_walker walker,
+- void *data)
++static int gfs2_walk_metadata(struct inode *inode, struct metapath *mp,
++ u64 max_len, gfs2_metadata_walker walker)
+ {
+- struct metapath clone;
+ struct gfs2_inode *ip = GFS2_I(inode);
+ struct gfs2_sbd *sdp = GFS2_SB(inode);
+- const __be64 *start, *end, *ptr;
+ u64 factor = 1;
+ unsigned int hgt;
+- int ret = 0;
++ int ret;
+
+- for (hgt = ip->i_height - 1; hgt >= mp->mp_aheight; hgt--)
++ /*
++ * The walk starts in the lowest allocated indirect block, which may be
++ * before the position indicated by @mp. Adjust @max_len accordingly
++ * to avoid a short walk.
++ */
++ for (hgt = mp->mp_fheight - 1; hgt >= mp->mp_aheight; hgt--) {
++ max_len += mp->mp_list[hgt] * factor;
++ mp->mp_list[hgt] = 0;
+ factor *= sdp->sd_inptrs;
++ }
+
+ for (;;) {
+- u64 step;
++ u16 start = mp->mp_list[hgt];
++ enum walker_status status;
++ unsigned int ptrs;
++ u64 len;
+
+ /* Walk indirect block. */
+- start = metapointer(hgt, mp);
+- end = metaend(hgt, mp);
+-
+- step = (end - start) * factor;
+- if (step > len)
+- end = start + DIV_ROUND_UP_ULL(len, factor);
+-
+- ptr = walker(mp, start, end, factor, data);
+- if (ptr == WALK_STOP)
++ ptrs = (hgt >= 1 ? sdp->sd_inptrs : sdp->sd_diptrs) - start;
++ len = ptrs * factor;
++ if (len > max_len)
++ ptrs = DIV_ROUND_UP_ULL(max_len, factor);
++ status = walker(mp, ptrs);
++ switch (status) {
++ case WALK_STOP:
++ return 1;
++ case WALK_FOLLOW:
++ BUG_ON(mp->mp_aheight == mp->mp_fheight);
++ ptrs = mp->mp_list[hgt] - start;
++ len = ptrs * factor;
+ break;
+- if (step >= len)
++ case WALK_CONTINUE:
+ break;
+- len -= step;
+- if (ptr != WALK_NEXT) {
+- BUG_ON(!*ptr);
+- mp->mp_list[hgt] += ptr - start;
+- goto fill_up_metapath;
+ }
++ if (len >= max_len)
++ break;
++ max_len -= len;
++ if (status == WALK_FOLLOW)
++ goto fill_up_metapath;
+
+ lower_metapath:
+ /* Decrease height of metapath. */
+- if (mp != &clone) {
+- clone_metapath(&clone, mp);
+- mp = &clone;
+- }
+ brelse(mp->mp_bh[hgt]);
+ mp->mp_bh[hgt] = NULL;
++ mp->mp_list[hgt] = 0;
+ if (!hgt)
+ break;
+ hgt--;
+@@ -493,10 +530,7 @@ lower_metapath:
+
+ /* Advance in metadata tree. */
+ (mp->mp_list[hgt])++;
+- start = metapointer(hgt, mp);
+- end = metaend(hgt, mp);
+- if (start >= end) {
+- mp->mp_list[hgt] = 0;
++ if (mp->mp_list[hgt] >= sdp->sd_inptrs) {
+ if (!hgt)
+ break;
+ goto lower_metapath;
+@@ -504,44 +538,36 @@ lower_metapath:
+
+ fill_up_metapath:
+ /* Increase height of metapath. */
+- if (mp != &clone) {
+- clone_metapath(&clone, mp);
+- mp = &clone;
+- }
+ ret = fillup_metapath(ip, mp, ip->i_height - 1);
+ if (ret < 0)
+- break;
++ return ret;
+ hgt += ret;
+ for (; ret; ret--)
+ do_div(factor, sdp->sd_inptrs);
+ mp->mp_aheight = hgt + 1;
+ }
+- if (mp == &clone)
+- release_metapath(mp);
+- return ret;
++ return 0;
+ }
+
+-struct gfs2_hole_walker_args {
+- u64 blocks;
+-};
+-
+-static const __be64 *gfs2_hole_walker(struct metapath *mp,
+- const __be64 *start, const __be64 *end,
+- u64 factor, void *data)
++static enum walker_status gfs2_hole_walker(struct metapath *mp,
++ unsigned int ptrs)
+ {
+- struct gfs2_hole_walker_args *args = data;
+- const __be64 *ptr;
++ const __be64 *start, *ptr, *end;
++ unsigned int hgt;
++
++ hgt = mp->mp_aheight - 1;
++ start = metapointer(hgt, mp);
++ end = start + ptrs;
+
+ for (ptr = start; ptr < end; ptr++) {
+ if (*ptr) {
+- args->blocks += (ptr - start) * factor;
++ mp->mp_list[hgt] += ptr - start;
+ if (mp->mp_aheight == mp->mp_fheight)
+ return WALK_STOP;
+- return ptr; /* increase height */
++ return WALK_FOLLOW;
+ }
+ }
+- args->blocks += (end - start) * factor;
+- return WALK_NEXT;
++ return WALK_CONTINUE;
+ }
+
+ /**
+@@ -559,12 +585,24 @@ static const __be64 *gfs2_hole_walker(struct metapath *mp,
+ static int gfs2_hole_size(struct inode *inode, sector_t lblock, u64 len,
+ struct metapath *mp, struct iomap *iomap)
+ {
+- struct gfs2_hole_walker_args args = { };
+- int ret = 0;
++ struct metapath clone;
++ u64 hole_size;
++ int ret;
+
+- ret = gfs2_walk_metadata(inode, lblock, len, mp, gfs2_hole_walker, &args);
+- if (!ret)
+- iomap->length = args.blocks << inode->i_blkbits;
++ clone_metapath(&clone, mp);
++ ret = gfs2_walk_metadata(inode, &clone, len, gfs2_hole_walker);
++ if (ret < 0)
++ goto out;
++
++ if (ret == 1)
++ hole_size = metapath_to_block(GFS2_SB(inode), &clone) - lblock;
++ else
++ hole_size = len;
++ iomap->length = hole_size << inode->i_blkbits;
++ ret = 0;
++
++out:
++ release_metapath(&clone);
+ return ret;
+ }
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 904e08bbb289..31ae3bd5d9d2 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3133,7 +3133,7 @@ static int _nfs4_do_setattr(struct inode *inode,
+
+ if (nfs4_copy_delegation_stateid(inode, FMODE_WRITE, &arg->stateid, &delegation_cred)) {
+ /* Use that stateid */
+- } else if (ctx != NULL) {
++ } else if (ctx != NULL && ctx->state) {
+ struct nfs_lock_context *l_ctx;
+ if (!nfs4_valid_open_stateid(ctx->state))
+ return -EBADF;
+diff --git a/include/linux/ccp.h b/include/linux/ccp.h
+index 7e9c991c95e0..43ed9e77cf81 100644
+--- a/include/linux/ccp.h
++++ b/include/linux/ccp.h
+@@ -173,6 +173,8 @@ struct ccp_aes_engine {
+ enum ccp_aes_mode mode;
+ enum ccp_aes_action action;
+
++ u32 authsize;
++
+ struct scatterlist *key;
+ u32 key_len; /* In bytes */
+
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 30efb3663892..d42a36e4e6c2 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -818,6 +818,7 @@ void kvm_arch_check_processor_compat(void *rtn);
+ int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu);
+ bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu);
+ int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu);
++bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu);
+
+ #ifndef __KVM_HAVE_ARCH_VM_ALLOC
+ /*
+diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
+index e87f2d5b3cc6..127c2713b543 100644
+--- a/include/sound/compress_driver.h
++++ b/include/sound/compress_driver.h
+@@ -171,10 +171,7 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)
+ if (snd_BUG_ON(!stream))
+ return;
+
+- if (stream->direction == SND_COMPRESS_PLAYBACK)
+- stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+- else
+- stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
++ stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+
+ wake_up(&stream->runtime->sleep);
+ }
+diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
+index 7acc16f34942..fa43dd5a7b3d 100644
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2732,7 +2732,7 @@ enum nl80211_attrs {
+ #define NL80211_HT_CAPABILITY_LEN 26
+ #define NL80211_VHT_CAPABILITY_LEN 12
+ #define NL80211_HE_MIN_CAPABILITY_LEN 16
+-#define NL80211_HE_MAX_CAPABILITY_LEN 51
++#define NL80211_HE_MAX_CAPABILITY_LEN 54
+ #define NL80211_MAX_NR_CIPHER_SUITES 5
+ #define NL80211_MAX_NR_AKM_SUITES 2
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index e8979c72514b..7ca44b8523c8 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -10957,7 +10957,7 @@ perf_event_create_kernel_counter(struct perf_event_attr *attr, int cpu,
+ goto err_unlock;
+ }
+
+- perf_install_in_context(ctx, event, cpu);
++ perf_install_in_context(ctx, event, event->cpu);
+ perf_unpin_context(ctx);
+ mutex_unlock(&ctx->mutex);
+
+diff --git a/lib/test_firmware.c b/lib/test_firmware.c
+index fd48a15a0710..a74b1aae7461 100644
+--- a/lib/test_firmware.c
++++ b/lib/test_firmware.c
+@@ -894,8 +894,11 @@ static int __init test_firmware_init(void)
+ return -ENOMEM;
+
+ rc = __test_firmware_config_init();
+- if (rc)
++ if (rc) {
++ kfree(test_fw_config);
++ pr_err("could not init firmware test config: %d\n", rc);
+ return rc;
++ }
+
+ rc = misc_register(&test_fw_misc_device);
+ if (rc) {
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index a46ec261a44e..d8e877365f9f 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1751,6 +1751,12 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
+ if (!addr)
+ return NULL;
+
++ /*
++ * First make sure the mappings are removed from all page-tables
++ * before they are freed.
++ */
++ vmalloc_sync_all();
++
+ /*
+ * In this function, newly allocated vm_struct has VM_UNINITIALIZED
+ * flag. It means that vm_struct is not fully initialized.
+@@ -2296,6 +2302,9 @@ EXPORT_SYMBOL(remap_vmalloc_range);
+ /*
+ * Implement a stub for vmalloc_sync_all() if the architecture chose not to
+ * have one.
++ *
++ * The purpose of this function is to make sure the vmalloc area
++ * mappings are identical in all page-tables in the system.
+ */
+ void __weak vmalloc_sync_all(void)
+ {
+diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
+index 12843c9ef142..74b19a5c572e 100644
+--- a/net/ipv4/netfilter/ipt_rpfilter.c
++++ b/net/ipv4/netfilter/ipt_rpfilter.c
+@@ -96,6 +96,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
+ flow.flowi4_tos = RT_TOS(iph->tos);
+ flow.flowi4_scope = RT_SCOPE_UNIVERSE;
++ flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par));
+
+ return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert;
+ }
+diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
+index c3c6b09acdc4..0f3407f2851e 100644
+--- a/net/ipv6/netfilter/ip6t_rpfilter.c
++++ b/net/ipv6/netfilter/ip6t_rpfilter.c
+@@ -58,7 +58,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
+ if (rpfilter_addr_linklocal(&iph->saddr)) {
+ lookup_flags |= RT6_LOOKUP_F_IFACE;
+ fl6.flowi6_oif = dev->ifindex;
+- } else if ((flags & XT_RPFILTER_LOOSE) == 0)
++ /* Set flowi6_oif for vrf devices to lookup route in l3mdev domain. */
++ } else if (netif_is_l3_master(dev) || netif_is_l3_slave(dev) ||
++ (flags & XT_RPFILTER_LOOSE) == 0)
+ fl6.flowi6_oif = dev->ifindex;
+
+ rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags);
+@@ -73,7 +75,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
+ goto out;
+ }
+
+- if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
++ if (rt->rt6i_idev->dev == dev ||
++ l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == dev->ifindex ||
++ (flags & XT_RPFILTER_LOOSE))
+ ret = true;
+ out:
+ ip6_rt_put(rt);
+diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
+index bb886e7db47f..f783d1377d9a 100644
+--- a/net/mac80211/driver-ops.c
++++ b/net/mac80211/driver-ops.c
+@@ -169,11 +169,16 @@ int drv_conf_tx(struct ieee80211_local *local,
+ if (!check_sdata_in_driver(sdata))
+ return -EIO;
+
+- if (WARN_ONCE(params->cw_min == 0 ||
+- params->cw_min > params->cw_max,
+- "%s: invalid CW_min/CW_max: %d/%d\n",
+- sdata->name, params->cw_min, params->cw_max))
++ if (params->cw_min == 0 || params->cw_min > params->cw_max) {
++ /*
++ * If we can't configure hardware anyway, don't warn. We may
++ * never have initialized the CW parameters.
++ */
++ WARN_ONCE(local->ops->conf_tx,
++ "%s: invalid CW_min/CW_max: %d/%d\n",
++ sdata->name, params->cw_min, params->cw_max);
+ return -EINVAL;
++ }
+
+ trace_drv_conf_tx(local, sdata, ac, params);
+ if (local->ops->conf_tx)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 1aaa73fa308e..b5c06242a92e 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1967,6 +1967,16 @@ ieee80211_sta_wmm_params(struct ieee80211_local *local,
+ ieee80211_regulatory_limit_wmm_params(sdata, ¶ms[ac], ac);
+ }
+
++ /* WMM specification requires all 4 ACIs. */
++ for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
++ if (params[ac].cw_min == 0) {
++ sdata_info(sdata,
++ "AP has invalid WMM params (missing AC %d), using defaults\n",
++ ac);
++ return false;
++ }
++ }
++
+ for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+ mlme_dbg(sdata,
+ "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
+diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
+index 842f3f86fb2e..7011ab27c437 100644
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -480,6 +480,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
+ struct ip_ct_tcp_state *receiver = &state->seen[!dir];
+ const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
+ __u32 seq, ack, sack, end, win, swin;
++ u16 win_raw;
+ s32 receiver_offset;
+ bool res, in_recv_win;
+
+@@ -488,7 +489,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
+ */
+ seq = ntohl(tcph->seq);
+ ack = sack = ntohl(tcph->ack_seq);
+- win = ntohs(tcph->window);
++ win_raw = ntohs(tcph->window);
++ win = win_raw;
+ end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
+
+ if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
+@@ -663,14 +665,14 @@ static bool tcp_in_window(const struct nf_conn *ct,
+ && state->last_seq == seq
+ && state->last_ack == ack
+ && state->last_end == end
+- && state->last_win == win)
++ && state->last_win == win_raw)
+ state->retrans++;
+ else {
+ state->last_dir = dir;
+ state->last_seq = seq;
+ state->last_ack = ack;
+ state->last_end = end;
+- state->last_win = win;
++ state->last_win = win_raw;
+ state->retrans = 0;
+ }
+ }
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index 916913454624..7f2c1915763f 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -575,7 +575,7 @@ static int nfnetlink_bind(struct net *net, int group)
+ ss = nfnetlink_get_subsys(type << 8);
+ rcu_read_unlock();
+ if (!ss)
+- request_module("nfnetlink-subsys-%d", type);
++ request_module_nowait("nfnetlink-subsys-%d", type);
+ return 0;
+ }
+ #endif
+diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
+index c2d237144f74..b8f23f75aea6 100644
+--- a/net/netfilter/nft_hash.c
++++ b/net/netfilter/nft_hash.c
+@@ -196,7 +196,7 @@ static int nft_symhash_init(const struct nft_ctx *ctx,
+ priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
+
+ priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
+- if (priv->modulus <= 1)
++ if (priv->modulus < 1)
+ return -ERANGE;
+
+ if (priv->offset + priv->modulus - 1 < priv->offset)
+diff --git a/scripts/sphinx-pre-install b/scripts/sphinx-pre-install
+index 067459760a7b..3524dbc31316 100755
+--- a/scripts/sphinx-pre-install
++++ b/scripts/sphinx-pre-install
+@@ -301,7 +301,7 @@ sub give_redhat_hints()
+ #
+ # Checks valid for RHEL/CentOS version 7.x.
+ #
+- if (! $system_release =~ /Fedora/) {
++ if (!($system_release =~ /Fedora/)) {
+ $map{"virtualenv"} = "python-virtualenv";
+ }
+
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 8b78ddffa509..516ec3587325 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -575,10 +575,7 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
+ stream->metadata_set = false;
+ stream->next_track = false;
+
+- if (stream->direction == SND_COMPRESS_PLAYBACK)
+- stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+- else
+- stream->runtime->state = SNDRV_PCM_STATE_PREPARED;
++ stream->runtime->state = SNDRV_PCM_STATE_SETUP;
+ } else {
+ return -EPERM;
+ }
+@@ -694,8 +691,17 @@ static int snd_compr_start(struct snd_compr_stream *stream)
+ {
+ int retval;
+
+- if (stream->runtime->state != SNDRV_PCM_STATE_PREPARED)
++ switch (stream->runtime->state) {
++ case SNDRV_PCM_STATE_SETUP:
++ if (stream->direction != SND_COMPRESS_CAPTURE)
++ return -EPERM;
++ break;
++ case SNDRV_PCM_STATE_PREPARED:
++ break;
++ default:
+ return -EPERM;
++ }
++
+ retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_START);
+ if (!retval)
+ stream->runtime->state = SNDRV_PCM_STATE_RUNNING;
+@@ -706,9 +712,15 @@ static int snd_compr_stop(struct snd_compr_stream *stream)
+ {
+ int retval;
+
+- if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED ||
+- stream->runtime->state == SNDRV_PCM_STATE_SETUP)
++ switch (stream->runtime->state) {
++ case SNDRV_PCM_STATE_OPEN:
++ case SNDRV_PCM_STATE_SETUP:
++ case SNDRV_PCM_STATE_PREPARED:
+ return -EPERM;
++ default:
++ break;
++ }
++
+ retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP);
+ if (!retval) {
+ snd_compr_drain_notify(stream);
+@@ -796,9 +808,17 @@ static int snd_compr_drain(struct snd_compr_stream *stream)
+ {
+ int retval;
+
+- if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED ||
+- stream->runtime->state == SNDRV_PCM_STATE_SETUP)
++ switch (stream->runtime->state) {
++ case SNDRV_PCM_STATE_OPEN:
++ case SNDRV_PCM_STATE_SETUP:
++ case SNDRV_PCM_STATE_PREPARED:
++ case SNDRV_PCM_STATE_PAUSED:
+ return -EPERM;
++ case SNDRV_PCM_STATE_XRUN:
++ return -EPIPE;
++ default:
++ break;
++ }
+
+ retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_DRAIN);
+ if (retval) {
+@@ -818,6 +838,10 @@ static int snd_compr_next_track(struct snd_compr_stream *stream)
+ if (stream->runtime->state != SNDRV_PCM_STATE_RUNNING)
+ return -EPERM;
+
++ /* next track doesn't have any meaning for capture streams */
++ if (stream->direction == SND_COMPRESS_CAPTURE)
++ return -EPERM;
++
+ /* you can signal next track if this is intended to be a gapless stream
+ * and current track metadata is set
+ */
+@@ -835,9 +859,23 @@ static int snd_compr_next_track(struct snd_compr_stream *stream)
+ static int snd_compr_partial_drain(struct snd_compr_stream *stream)
+ {
+ int retval;
+- if (stream->runtime->state == SNDRV_PCM_STATE_PREPARED ||
+- stream->runtime->state == SNDRV_PCM_STATE_SETUP)
++
++ switch (stream->runtime->state) {
++ case SNDRV_PCM_STATE_OPEN:
++ case SNDRV_PCM_STATE_SETUP:
++ case SNDRV_PCM_STATE_PREPARED:
++ case SNDRV_PCM_STATE_PAUSED:
++ return -EPERM;
++ case SNDRV_PCM_STATE_XRUN:
++ return -EPIPE;
++ default:
++ break;
++ }
++
++ /* partial drain doesn't have any meaning for capture streams */
++ if (stream->direction == SND_COMPRESS_CAPTURE)
+ return -EPERM;
++
+ /* stream can be drained only when next track has been signalled */
+ if (stream->next_track == false)
+ return -EPERM;
+diff --git a/sound/firewire/packets-buffer.c b/sound/firewire/packets-buffer.c
+index 1ebf00c83409..715cd99f28de 100644
+--- a/sound/firewire/packets-buffer.c
++++ b/sound/firewire/packets-buffer.c
+@@ -37,7 +37,7 @@ int iso_packets_buffer_init(struct iso_packets_buffer *b, struct fw_unit *unit,
+ packets_per_page = PAGE_SIZE / packet_size;
+ if (WARN_ON(!packets_per_page)) {
+ err = -EINVAL;
+- goto error;
++ goto err_packets;
+ }
+ pages = DIV_ROUND_UP(count, packets_per_page);
+
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index a12e594d4e3b..a41c1bec7c88 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -609,11 +609,9 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
+ }
+ runtime->private_data = azx_dev;
+
+- if (chip->gts_present)
+- azx_pcm_hw.info = azx_pcm_hw.info |
+- SNDRV_PCM_INFO_HAS_LINK_SYNCHRONIZED_ATIME;
+-
+ runtime->hw = azx_pcm_hw;
++ if (chip->gts_present)
++ runtime->hw.info |= SNDRV_PCM_INFO_HAS_LINK_SYNCHRONIZED_ATIME;
+ runtime->hw.channels_min = hinfo->channels_min;
+ runtime->hw.channels_max = hinfo->channels_max;
+ runtime->hw.formats = hinfo->formats;
+@@ -626,6 +624,13 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
+ 20,
+ 178000000);
+
++ /* by some reason, the playback stream stalls on PulseAudio with
++ * tsched=1 when a capture stream triggers. Until we figure out the
++ * real cause, disable tsched mode by telling the PCM info flag.
++ */
++ if (chip->driver_caps & AZX_DCAPS_AMD_WORKAROUND)
++ runtime->hw.info |= SNDRV_PCM_INFO_BATCH;
++
+ if (chip->align_buffer_size)
+ /* constrain buffer sizes to be multiple of 128
+ bytes. This is more efficient in terms of memory
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index 53c3cd28bc99..8a9dd4767b1e 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -40,7 +40,7 @@
+ /* 14 unused */
+ #define AZX_DCAPS_CTX_WORKAROUND (1 << 15) /* X-Fi workaround */
+ #define AZX_DCAPS_POSFIX_LPIB (1 << 16) /* Use LPIB as default */
+-/* 17 unused */
++#define AZX_DCAPS_AMD_WORKAROUND (1 << 17) /* AMD-specific workaround */
+ #define AZX_DCAPS_NO_64BIT (1 << 18) /* No 64bit address */
+ #define AZX_DCAPS_SYNC_WRITE (1 << 19) /* sync each cmd write */
+ #define AZX_DCAPS_OLD_SSYNC (1 << 20) /* Old SSYNC reg for ICH */
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 308ce76149cc..81cea34aff1c 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -78,6 +78,7 @@ enum {
+ POS_FIX_VIACOMBO,
+ POS_FIX_COMBO,
+ POS_FIX_SKL,
++ POS_FIX_FIFO,
+ };
+
+ /* Defines for ATI HD Audio support in SB450 south bridge */
+@@ -149,7 +150,7 @@ module_param_array(model, charp, NULL, 0444);
+ MODULE_PARM_DESC(model, "Use the given board model.");
+ module_param_array(position_fix, int, NULL, 0444);
+ MODULE_PARM_DESC(position_fix, "DMA pointer read method."
+- "(-1 = system default, 0 = auto, 1 = LPIB, 2 = POSBUF, 3 = VIACOMBO, 4 = COMBO, 5 = SKL+).");
++ "(-1 = system default, 0 = auto, 1 = LPIB, 2 = POSBUF, 3 = VIACOMBO, 4 = COMBO, 5 = SKL+, 6 = FIFO).");
+ module_param_array(bdl_pos_adj, int, NULL, 0644);
+ MODULE_PARM_DESC(bdl_pos_adj, "BDL position adjustment offset.");
+ module_param_array(probe_mask, int, NULL, 0444);
+@@ -350,6 +351,11 @@ enum {
+ #define AZX_DCAPS_PRESET_ATI_HDMI_NS \
+ (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_SNOOP_OFF)
+
++/* quirks for AMD SB */
++#define AZX_DCAPS_PRESET_AMD_SB \
++ (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_AMD_WORKAROUND |\
++ AZX_DCAPS_SNOOP_TYPE(ATI) | AZX_DCAPS_PM_RUNTIME)
++
+ /* quirks for Nvidia */
+ #define AZX_DCAPS_PRESET_NVIDIA \
+ (AZX_DCAPS_NO_MSI | AZX_DCAPS_CORBRP_SELF_CLEAR |\
+@@ -920,6 +926,49 @@ static unsigned int azx_via_get_position(struct azx *chip,
+ return bound_pos + mod_dma_pos;
+ }
+
++#define AMD_FIFO_SIZE 32
++
++/* get the current DMA position with FIFO size correction */
++static unsigned int azx_get_pos_fifo(struct azx *chip, struct azx_dev *azx_dev)
++{
++ struct snd_pcm_substream *substream = azx_dev->core.substream;
++ struct snd_pcm_runtime *runtime = substream->runtime;
++ unsigned int pos, delay;
++
++ pos = snd_hdac_stream_get_pos_lpib(azx_stream(azx_dev));
++ if (!runtime)
++ return pos;
++
++ runtime->delay = AMD_FIFO_SIZE;
++ delay = frames_to_bytes(runtime, AMD_FIFO_SIZE);
++ if (azx_dev->insufficient) {
++ if (pos < delay) {
++ delay = pos;
++ runtime->delay = bytes_to_frames(runtime, pos);
++ } else {
++ azx_dev->insufficient = 0;
++ }
++ }
++
++ /* correct the DMA position for capture stream */
++ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) {
++ if (pos < delay)
++ pos += azx_dev->core.bufsize;
++ pos -= delay;
++ }
++
++ return pos;
++}
++
++static int azx_get_delay_from_fifo(struct azx *chip, struct azx_dev *azx_dev,
++ unsigned int pos)
++{
++ struct snd_pcm_substream *substream = azx_dev->core.substream;
++
++ /* just read back the calculated value in the above */
++ return substream->runtime->delay;
++}
++
+ static unsigned int azx_skl_get_dpib_pos(struct azx *chip,
+ struct azx_dev *azx_dev)
+ {
+@@ -1528,6 +1577,7 @@ static int check_position_fix(struct azx *chip, int fix)
+ case POS_FIX_VIACOMBO:
+ case POS_FIX_COMBO:
+ case POS_FIX_SKL:
++ case POS_FIX_FIFO:
+ return fix;
+ }
+
+@@ -1544,6 +1594,10 @@ static int check_position_fix(struct azx *chip, int fix)
+ dev_dbg(chip->card->dev, "Using VIACOMBO position fix\n");
+ return POS_FIX_VIACOMBO;
+ }
++ if (chip->driver_caps & AZX_DCAPS_AMD_WORKAROUND) {
++ dev_dbg(chip->card->dev, "Using FIFO position fix\n");
++ return POS_FIX_FIFO;
++ }
+ if (chip->driver_caps & AZX_DCAPS_POSFIX_LPIB) {
+ dev_dbg(chip->card->dev, "Using LPIB position fix\n");
+ return POS_FIX_LPIB;
+@@ -1564,6 +1618,7 @@ static void assign_position_fix(struct azx *chip, int fix)
+ [POS_FIX_VIACOMBO] = azx_via_get_position,
+ [POS_FIX_COMBO] = azx_get_pos_lpib,
+ [POS_FIX_SKL] = azx_get_pos_skl,
++ [POS_FIX_FIFO] = azx_get_pos_fifo,
+ };
+
+ chip->get_position[0] = chip->get_position[1] = callbacks[fix];
+@@ -1578,6 +1633,9 @@ static void assign_position_fix(struct azx *chip, int fix)
+ azx_get_delay_from_lpib;
+ }
+
++ if (fix == POS_FIX_FIFO)
++ chip->get_delay[0] = chip->get_delay[1] =
++ azx_get_delay_from_fifo;
+ }
+
+ /*
+@@ -2594,6 +2652,9 @@ static const struct pci_device_id azx_ids[] = {
+ /* AMD Hudson */
+ { PCI_DEVICE(0x1022, 0x780d),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
++ /* AMD, X370 & co */
++ { PCI_DEVICE(0x1022, 0x1457),
++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
+ /* AMD Stoney */
+ { PCI_DEVICE(0x1022, 0x157a),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
+diff --git a/sound/sound_core.c b/sound/sound_core.c
+index 40ad000c2e3c..dd64c4b19f23 100644
+--- a/sound/sound_core.c
++++ b/sound/sound_core.c
+@@ -280,7 +280,8 @@ retry:
+ goto retry;
+ }
+ spin_unlock(&sound_loader_lock);
+- return -EBUSY;
++ r = -EBUSY;
++ goto fail;
+ }
+ }
+
+diff --git a/sound/usb/hiface/pcm.c b/sound/usb/hiface/pcm.c
+index e1fbb9cc9ea7..a197fc3b9ab0 100644
+--- a/sound/usb/hiface/pcm.c
++++ b/sound/usb/hiface/pcm.c
+@@ -604,14 +604,13 @@ int hiface_pcm_init(struct hiface_chip *chip, u8 extra_freq)
+ ret = hiface_pcm_init_urb(&rt->out_urbs[i], chip, OUT_EP,
+ hiface_pcm_out_urb_handler);
+ if (ret < 0)
+- return ret;
++ goto error;
+ }
+
+ ret = snd_pcm_new(chip->card, "USB-SPDIF Audio", 0, 1, 0, &pcm);
+ if (ret < 0) {
+- kfree(rt);
+ dev_err(&chip->dev->dev, "Cannot create pcm instance\n");
+- return ret;
++ goto error;
+ }
+
+ pcm->private_data = rt;
+@@ -624,4 +623,10 @@ int hiface_pcm_init(struct hiface_chip *chip, u8 extra_freq)
+
+ chip->pcm = rt;
+ return 0;
++
++error:
++ for (i = 0; i < PCM_N_URBS; i++)
++ kfree(rt->out_urbs[i].buffer);
++ kfree(rt);
++ return ret;
+ }
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index d9e3de495c16..bc582202bd10 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -1053,6 +1053,7 @@ found_clock:
+
+ pd = kzalloc(sizeof(*pd), GFP_KERNEL);
+ if (!pd) {
++ kfree(fp->chmap);
+ kfree(fp->rate_table);
+ kfree(fp);
+ return NULL;
+diff --git a/tools/perf/arch/s390/util/machine.c b/tools/perf/arch/s390/util/machine.c
+index a19690a17291..c8c86a0c9b79 100644
+--- a/tools/perf/arch/s390/util/machine.c
++++ b/tools/perf/arch/s390/util/machine.c
+@@ -6,8 +6,9 @@
+ #include "machine.h"
+ #include "api/fs/fs.h"
+ #include "debug.h"
++#include "symbol.h"
+
+-int arch__fix_module_text_start(u64 *start, const char *name)
++int arch__fix_module_text_start(u64 *start, u64 *size, const char *name)
+ {
+ u64 m_start = *start;
+ char path[PATH_MAX];
+@@ -17,7 +18,35 @@ int arch__fix_module_text_start(u64 *start, const char *name)
+ if (sysfs__read_ull(path, (unsigned long long *)start) < 0) {
+ pr_debug2("Using module %s start:%#lx\n", path, m_start);
+ *start = m_start;
++ } else {
++ /* Successful read of the modules segment text start address.
++ * Calculate difference between module start address
++ * in memory and module text segment start address.
++ * For example module load address is 0x3ff8011b000
++ * (from /proc/modules) and module text segment start
++ * address is 0x3ff8011b870 (from file above).
++ *
++ * Adjust the module size and subtract the GOT table
++ * size located at the beginning of the module.
++ */
++ *size -= (*start - m_start);
+ }
+
+ return 0;
+ }
++
++/* On s390 kernel text segment start is located at very low memory addresses,
++ * for example 0x10000. Modules are located at very high memory addresses,
++ * for example 0x3ff xxxx xxxx. The gap between end of kernel text segment
++ * and beginning of first module's text segment is very big.
++ * Therefore do not fill this gap and do not assign it to the kernel dso map.
++ */
++void arch__symbols__fixup_end(struct symbol *p, struct symbol *c)
++{
++ if (strchr(p->name, '[') == NULL && strchr(c->name, '['))
++ /* Last kernel symbol mapped to end of page */
++ p->end = roundup(p->end, page_size);
++ else
++ p->end = c->start;
++ pr_debug4("%s sym:%s end:%#lx\n", __func__, p->name, p->end);
++}
+diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
+index 99de91698de1..0bdb34fee9d8 100644
+--- a/tools/perf/builtin-probe.c
++++ b/tools/perf/builtin-probe.c
+@@ -711,6 +711,16 @@ __cmd_probe(int argc, const char **argv)
+
+ ret = perf_add_probe_events(params.events, params.nevents);
+ if (ret < 0) {
++
++ /*
++ * When perf_add_probe_events() fails it calls
++ * cleanup_perf_probe_events(pevs, npevs), i.e.
++ * cleanup_perf_probe_events(params.events, params.nevents), which
++ * will call clear_perf_probe_event(), so set nevents to zero
++ * to avoid cleanup_params() to call clear_perf_probe_event() again
++ * on the same pevs.
++ */
++ params.nevents = 0;
+ pr_err_with_code(" Error: Failed to add events.", ret);
+ return ret;
+ }
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index 7f2e3b1c746c..a94bd6850a0b 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -3472,7 +3472,7 @@ int perf_event__process_feature(struct perf_tool *tool,
+ return 0;
+
+ ff.buf = (void *)fe->data;
+- ff.size = event->header.size - sizeof(event->header);
++ ff.size = event->header.size - sizeof(*fe);
+ ff.ph = &session->header;
+
+ if (feat_ops[feat].process(&ff, NULL))
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index 076718a7b3ea..003b70daf0bf 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -1295,6 +1295,7 @@ static int machine__set_modules_path(struct machine *machine)
+ return map_groups__set_modules_path_dir(&machine->kmaps, modules_path, 0);
+ }
+ int __weak arch__fix_module_text_start(u64 *start __maybe_unused,
++ u64 *size __maybe_unused,
+ const char *name __maybe_unused)
+ {
+ return 0;
+@@ -1306,7 +1307,7 @@ static int machine__create_module(void *arg, const char *name, u64 start,
+ struct machine *machine = arg;
+ struct map *map;
+
+- if (arch__fix_module_text_start(&start, name) < 0)
++ if (arch__fix_module_text_start(&start, &size, name) < 0)
+ return -1;
+
+ map = machine__findnew_module_map(machine, start, name);
+diff --git a/tools/perf/util/machine.h b/tools/perf/util/machine.h
+index ebde3ea70225..6f3767808bd9 100644
+--- a/tools/perf/util/machine.h
++++ b/tools/perf/util/machine.h
+@@ -219,7 +219,7 @@ struct symbol *machine__find_kernel_symbol_by_name(struct machine *machine,
+
+ struct map *machine__findnew_module_map(struct machine *machine, u64 start,
+ const char *filename);
+-int arch__fix_module_text_start(u64 *start, const char *name);
++int arch__fix_module_text_start(u64 *start, u64 *size, const char *name);
+
+ int machine__load_kallsyms(struct machine *machine, const char *filename);
+
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index 0715f972a275..91404bacc3df 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -86,6 +86,11 @@ static int prefix_underscores_count(const char *str)
+ return tail - str;
+ }
+
++void __weak arch__symbols__fixup_end(struct symbol *p, struct symbol *c)
++{
++ p->end = c->start;
++}
++
+ const char * __weak arch__normalize_symbol_name(const char *name)
+ {
+ return name;
+@@ -212,7 +217,7 @@ void symbols__fixup_end(struct rb_root *symbols)
+ curr = rb_entry(nd, struct symbol, rb_node);
+
+ if (prev->end == prev->start && prev->end != curr->start)
+- prev->end = curr->start;
++ arch__symbols__fixup_end(prev, curr);
+ }
+
+ /* Last entry */
+diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
+index f25fae4b5743..76ef2facd934 100644
+--- a/tools/perf/util/symbol.h
++++ b/tools/perf/util/symbol.h
+@@ -349,6 +349,7 @@ const char *arch__normalize_symbol_name(const char *name);
+ #define SYMBOL_A 0
+ #define SYMBOL_B 1
+
++void arch__symbols__fixup_end(struct symbol *p, struct symbol *c);
+ int arch__compare_symbol_names(const char *namea, const char *nameb);
+ int arch__compare_symbol_names_n(const char *namea, const char *nameb,
+ unsigned int n);
+diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
+index 56007a7e0b4d..2c146d0c217b 100644
+--- a/tools/perf/util/thread.c
++++ b/tools/perf/util/thread.c
+@@ -192,14 +192,24 @@ struct comm *thread__comm(const struct thread *thread)
+
+ struct comm *thread__exec_comm(const struct thread *thread)
+ {
+- struct comm *comm, *last = NULL;
++ struct comm *comm, *last = NULL, *second_last = NULL;
+
+ list_for_each_entry(comm, &thread->comm_list, list) {
+ if (comm->exec)
+ return comm;
++ second_last = last;
+ last = comm;
+ }
+
++ /*
++ * 'last' with no start time might be the parent's comm of a synthesized
++ * thread (created by processing a synthesized fork event). For a main
++ * thread, that is very probably wrong. Prefer a later comm to avoid
++ * that case.
++ */
++ if (second_last && !last->start && thread->pid_ == thread->tid)
++ return second_last;
++
+ return last;
+ }
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 2b36a51afb57..4a584a575221 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2317,6 +2317,29 @@ static bool kvm_vcpu_eligible_for_directed_yield(struct kvm_vcpu *vcpu)
+ #endif
+ }
+
++/*
++ * Unlike kvm_arch_vcpu_runnable, this function is called outside
++ * a vcpu_load/vcpu_put pair. However, for most architectures
++ * kvm_arch_vcpu_runnable does not require vcpu_load.
++ */
++bool __weak kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)
++{
++ return kvm_arch_vcpu_runnable(vcpu);
++}
++
++static bool vcpu_dy_runnable(struct kvm_vcpu *vcpu)
++{
++ if (kvm_arch_dy_runnable(vcpu))
++ return true;
++
++#ifdef CONFIG_KVM_ASYNC_PF
++ if (!list_empty_careful(&vcpu->async_pf.done))
++ return true;
++#endif
++
++ return false;
++}
++
+ void kvm_vcpu_on_spin(struct kvm_vcpu *me, bool yield_to_kernel_mode)
+ {
+ struct kvm *kvm = me->kvm;
+@@ -2346,7 +2369,7 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *me, bool yield_to_kernel_mode)
+ continue;
+ if (vcpu == me)
+ continue;
+- if (swait_active(&vcpu->wq) && !kvm_arch_vcpu_runnable(vcpu))
++ if (swait_active(&vcpu->wq) && !vcpu_dy_runnable(vcpu))
+ continue;
+ if (yield_to_kernel_mode && !kvm_arch_vcpu_in_kernel(vcpu))
+ continue;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-08-16 12:26 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-08-16 12:26 UTC (permalink / raw
To: gentoo-commits
commit: 80f421e5d9b1bc12165608319f3b2dd4e977a3a0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 16 12:26:09 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug 16 12:26:09 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=80f421e5
Removed redundant patch (vmalloc)
1800_vmalloc-sync-unmappings-fix.patch
mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 ---
1800_vmalloc-sync-unmappings-fix.patch | 58 ----------------------------------
2 files changed, 62 deletions(-)
diff --git a/0000_README b/0000_README
index 142096b..3ef7886 100644
--- a/0000_README
+++ b/0000_README
@@ -319,10 +319,6 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default.
-Patch: 1800_vmalloc-sync-unmappings-fix.patch
-From: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=3f8fd02b1bf1d7ba964485a56f2f4b53ae88c167
-Desc: mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
-
Patch: 2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
From: https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-marcel@holtmann.org/raw
Desc: Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758
diff --git a/1800_vmalloc-sync-unmappings-fix.patch b/1800_vmalloc-sync-unmappings-fix.patch
deleted file mode 100644
index 7e56e51..0000000
--- a/1800_vmalloc-sync-unmappings-fix.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 3f8fd02b1bf1d7ba964485a56f2f4b53ae88c167 Mon Sep 17 00:00:00 2001
-From: Joerg Roedel <jroedel@suse.de>
-Date: Fri, 19 Jul 2019 20:46:52 +0200
-Subject: mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
-
-On x86-32 with PTI enabled, parts of the kernel page-tables are not shared
-between processes. This can cause mappings in the vmalloc/ioremap area to
-persist in some page-tables after the region is unmapped and released.
-
-When the region is re-used the processes with the old mappings do not fault
-in the new mappings but still access the old ones.
-
-This causes undefined behavior, in reality often data corruption, kernel
-oopses and panics and even spontaneous reboots.
-
-Fix this problem by activly syncing unmaps in the vmalloc/ioremap area to
-all page-tables in the system before the regions can be re-used.
-
-References: https://bugzilla.suse.com/show_bug.cgi?id=1118689
-Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capability I/F')
-Signed-off-by: Joerg Roedel <jroedel@suse.de>
-Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
-Link: https://lkml.kernel.org/r/20190719184652.11391-4-joro@8bytes.org
----
- mm/vmalloc.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index 4fa8d84599b0..e0fc963acc41 100644
---- a/mm/vmalloc.c
-+++ b/mm/vmalloc.c
-@@ -1258,6 +1258,12 @@ static bool __purge_vmap_area_lazy(unsigned long start, unsigned long end)
- if (unlikely(valist == NULL))
- return false;
-
-+ /*
-+ * First make sure the mappings are removed from all page-tables
-+ * before they are freed.
-+ */
-+ vmalloc_sync_all();
-+
- /*
- * TODO: to calculate a flush range without looping.
- * The list can be up to lazy_max_pages() elements.
-@@ -3038,6 +3044,9 @@ EXPORT_SYMBOL(remap_vmalloc_range);
- /*
- * Implement a stub for vmalloc_sync_all() if the architecture chose not to
- * have one.
-+ *
-+ * The purpose of this function is to make sure the vmalloc area
-+ * mappings are identical in all page-tables in the system.
- */
- void __weak vmalloc_sync_all(void)
- {
---
-cgit 1.2-0.3.lf.el7
-
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-08-23 22:18 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-08-23 22:18 UTC (permalink / raw
To: gentoo-commits
commit: 9c7bcd4f585a2f17e664e071197a840c600dd56f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 23 22:17:22 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug 23 22:17:22 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9c7bcd4f
Add support for gcc 9.1 CPU optimization patch
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
5012_enable-cpu-optimizations-for-gcc91.patch | 632 ++++++++++++++++++++++++++
2 files changed, 636 insertions(+)
diff --git a/0000_README b/0000_README
index 3ef7886..75aee25 100644
--- a/0000_README
+++ b/0000_README
@@ -350,3 +350,7 @@ Desc: Kernel patch enables gcc >= v4.13 optimizations for additional CPUs.
Patch: 5011_enable-cpu-optimizations-for-gcc8.patch
From: https://github.com/graysky2/kernel_gcc_patch/
Desc: Kernel patch for >= gccv8 enables kernel >= v4.13 optimizations for additional CPUs.
+
+Patch: 5012_enable-cpu-optimizations-for-gcc91.patch
+From: https://github.com/graysky2/kernel_gcc_patch/
+Desc: Kernel patch enables gcc >= v9.1 optimizations for additional CPUs.
diff --git a/5012_enable-cpu-optimizations-for-gcc91.patch b/5012_enable-cpu-optimizations-for-gcc91.patch
new file mode 100644
index 0000000..dffd36d
--- /dev/null
+++ b/5012_enable-cpu-optimizations-for-gcc91.patch
@@ -0,0 +1,632 @@
+WARNING
+This patch works with gcc versions 9.1+ and with kernel version 4.13+ and should
+NOT be applied when compiling on older versions of gcc due to key name changes
+of the march flags introduced with the version 4.9 release of gcc.[1]
+
+Use the older version of this patch hosted on the same github for older
+versions of gcc.
+
+FEATURES
+This patch adds additional CPU options to the Linux kernel accessible under:
+ Processor type and features --->
+ Processor family --->
+
+The expanded microarchitectures include:
+* AMD Improved K8-family
+* AMD K10-family
+* AMD Family 10h (Barcelona)
+* AMD Family 14h (Bobcat)
+* AMD Family 16h (Jaguar)
+* AMD Family 15h (Bulldozer)
+* AMD Family 15h (Piledriver)
+* AMD Family 15h (Steamroller)
+* AMD Family 15h (Excavator)
+* AMD Family 17h (Zen)
+* AMD Family 17h (Zen 2)
+* Intel Silvermont low-power processors
+* Intel Goldmont low-power processors (Apollo Lake and Denverton)
+* Intel Goldmont Plus low-power processors (Gemini Lake)
+* Intel 1st Gen Core i3/i5/i7 (Nehalem)
+* Intel 1.5 Gen Core i3/i5/i7 (Westmere)
+* Intel 2nd Gen Core i3/i5/i7 (Sandybridge)
+* Intel 3rd Gen Core i3/i5/i7 (Ivybridge)
+* Intel 4th Gen Core i3/i5/i7 (Haswell)
+* Intel 5th Gen Core i3/i5/i7 (Broadwell)
+* Intel 6th Gen Core i3/i5/i7 (Skylake)
+* Intel 6th Gen Core i7/i9 (Skylake X)
+* Intel 8th Gen Core i3/i5/i7 (Cannon Lake)
+* Intel 10th Gen Core i7/i9 (Ice Lake)
+* Intel Xeon (Cascade Lake)
+
+It also offers to compile passing the 'native' option which, "selects the CPU
+to generate code for at compilation time by determining the processor type of
+the compiling machine. Using -march=native enables all instruction subsets
+supported by the local machine and will produce code optimized for the local
+machine under the constraints of the selected instruction set."[3]
+
+MINOR NOTES
+This patch also changes 'atom' to 'bonnell' in accordance with the gcc v4.9
+changes. Note that upstream is using the deprecated 'match=atom' flags when I
+believe it should use the newer 'march=bonnell' flag for atom processors.[2]
+
+It is not recommended to compile on Atom-CPUs with the 'native' option.[4] The
+recommendation is to use the 'atom' option instead.
+
+BENEFITS
+Small but real speed increases are measurable using a make endpoint comparing
+a generic kernel to one built with one of the respective microarchs.
+
+See the following experimental evidence supporting this statement:
+https://github.com/graysky2/kernel_gcc_patch
+
+REQUIREMENTS
+linux version >=4.13
+gcc version >=9.1
+
+ACKNOWLEDGMENTS
+This patch builds on the seminal work by Jeroen.[5]
+
+REFERENCES
+1. https://gcc.gnu.org/gcc-4.9/changes.html
+2. https://bugzilla.kernel.org/show_bug.cgi?id=77461
+3. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
+4. https://github.com/graysky2/kernel_gcc_patch/issues/15
+5. http://www.linuxforge.net/docs/linux/linux-gcc.php
+
+--- a/arch/x86/include/asm/module.h 2019-08-16 04:11:12.000000000 -0400
++++ b/arch/x86/include/asm/module.h 2019-08-22 15:56:23.988050322 -0400
+@@ -25,6 +25,36 @@ struct mod_arch_specific {
+ #define MODULE_PROC_FAMILY "586MMX "
+ #elif defined CONFIG_MCORE2
+ #define MODULE_PROC_FAMILY "CORE2 "
++#elif defined CONFIG_MNATIVE
++#define MODULE_PROC_FAMILY "NATIVE "
++#elif defined CONFIG_MNEHALEM
++#define MODULE_PROC_FAMILY "NEHALEM "
++#elif defined CONFIG_MWESTMERE
++#define MODULE_PROC_FAMILY "WESTMERE "
++#elif defined CONFIG_MSILVERMONT
++#define MODULE_PROC_FAMILY "SILVERMONT "
++#elif defined CONFIG_MGOLDMONT
++#define MODULE_PROC_FAMILY "GOLDMONT "
++#elif defined CONFIG_MGOLDMONTPLUS
++#define MODULE_PROC_FAMILY "GOLDMONTPLUS "
++#elif defined CONFIG_MSANDYBRIDGE
++#define MODULE_PROC_FAMILY "SANDYBRIDGE "
++#elif defined CONFIG_MIVYBRIDGE
++#define MODULE_PROC_FAMILY "IVYBRIDGE "
++#elif defined CONFIG_MHASWELL
++#define MODULE_PROC_FAMILY "HASWELL "
++#elif defined CONFIG_MBROADWELL
++#define MODULE_PROC_FAMILY "BROADWELL "
++#elif defined CONFIG_MSKYLAKE
++#define MODULE_PROC_FAMILY "SKYLAKE "
++#elif defined CONFIG_MSKYLAKEX
++#define MODULE_PROC_FAMILY "SKYLAKEX "
++#elif defined CONFIG_MCANNONLAKE
++#define MODULE_PROC_FAMILY "CANNONLAKE "
++#elif defined CONFIG_MICELAKE
++#define MODULE_PROC_FAMILY "ICELAKE "
++#elif defined CONFIG_MCASCADELAKE
++#define MODULE_PROC_FAMILY "CASCADELAKE "
+ #elif defined CONFIG_MATOM
+ #define MODULE_PROC_FAMILY "ATOM "
+ #elif defined CONFIG_M686
+@@ -43,6 +73,28 @@ struct mod_arch_specific {
+ #define MODULE_PROC_FAMILY "K7 "
+ #elif defined CONFIG_MK8
+ #define MODULE_PROC_FAMILY "K8 "
++#elif defined CONFIG_MK8SSE3
++#define MODULE_PROC_FAMILY "K8SSE3 "
++#elif defined CONFIG_MK10
++#define MODULE_PROC_FAMILY "K10 "
++#elif defined CONFIG_MBARCELONA
++#define MODULE_PROC_FAMILY "BARCELONA "
++#elif defined CONFIG_MBOBCAT
++#define MODULE_PROC_FAMILY "BOBCAT "
++#elif defined CONFIG_MBULLDOZER
++#define MODULE_PROC_FAMILY "BULLDOZER "
++#elif defined CONFIG_MPILEDRIVER
++#define MODULE_PROC_FAMILY "PILEDRIVER "
++#elif defined CONFIG_MSTEAMROLLER
++#define MODULE_PROC_FAMILY "STEAMROLLER "
++#elif defined CONFIG_MJAGUAR
++#define MODULE_PROC_FAMILY "JAGUAR "
++#elif defined CONFIG_MEXCAVATOR
++#define MODULE_PROC_FAMILY "EXCAVATOR "
++#elif defined CONFIG_MZEN
++#define MODULE_PROC_FAMILY "ZEN "
++#elif defined CONFIG_MZEN2
++#define MODULE_PROC_FAMILY "ZEN2 "
+ #elif defined CONFIG_MELAN
+ #define MODULE_PROC_FAMILY "ELAN "
+ #elif defined CONFIG_MCRUSOE
+--- a/arch/x86/Kconfig.cpu 2019-08-16 04:11:12.000000000 -0400
++++ b/arch/x86/Kconfig.cpu 2019-08-22 15:59:31.596946943 -0400
+@@ -116,6 +116,7 @@ config MPENTIUMM
+ config MPENTIUM4
+ bool "Pentium-4/Celeron(P4-based)/Pentium-4 M/older Xeon"
+ depends on X86_32
++ select X86_P6_NOP
+ ---help---
+ Select this for Intel Pentium 4 chips. This includes the
+ Pentium 4, Pentium D, P4-based Celeron and Xeon, and
+@@ -148,9 +149,8 @@ config MPENTIUM4
+ -Paxville
+ -Dempsey
+
+-
+ config MK6
+- bool "K6/K6-II/K6-III"
++ bool "AMD K6/K6-II/K6-III"
+ depends on X86_32
+ ---help---
+ Select this for an AMD K6-family processor. Enables use of
+@@ -158,7 +158,7 @@ config MK6
+ flags to GCC.
+
+ config MK7
+- bool "Athlon/Duron/K7"
++ bool "AMD Athlon/Duron/K7"
+ depends on X86_32
+ ---help---
+ Select this for an AMD Athlon K7-family processor. Enables use of
+@@ -166,12 +166,90 @@ config MK7
+ flags to GCC.
+
+ config MK8
+- bool "Opteron/Athlon64/Hammer/K8"
++ bool "AMD Opteron/Athlon64/Hammer/K8"
+ ---help---
+ Select this for an AMD Opteron or Athlon64 Hammer-family processor.
+ Enables use of some extended instructions, and passes appropriate
+ optimization flags to GCC.
+
++config MK8SSE3
++ bool "AMD Opteron/Athlon64/Hammer/K8 with SSE3"
++ ---help---
++ Select this for improved AMD Opteron or Athlon64 Hammer-family processors.
++ Enables use of some extended instructions, and passes appropriate
++ optimization flags to GCC.
++
++config MK10
++ bool "AMD 61xx/7x50/PhenomX3/X4/II/K10"
++ ---help---
++ Select this for an AMD 61xx Eight-Core Magny-Cours, Athlon X2 7x50,
++ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
++ Enables use of some extended instructions, and passes appropriate
++ optimization flags to GCC.
++
++config MBARCELONA
++ bool "AMD Barcelona"
++ ---help---
++ Select this for AMD Family 10h Barcelona processors.
++
++ Enables -march=barcelona
++
++config MBOBCAT
++ bool "AMD Bobcat"
++ ---help---
++ Select this for AMD Family 14h Bobcat processors.
++
++ Enables -march=btver1
++
++config MJAGUAR
++ bool "AMD Jaguar"
++ ---help---
++ Select this for AMD Family 16h Jaguar processors.
++
++ Enables -march=btver2
++
++config MBULLDOZER
++ bool "AMD Bulldozer"
++ ---help---
++ Select this for AMD Family 15h Bulldozer processors.
++
++ Enables -march=bdver1
++
++config MPILEDRIVER
++ bool "AMD Piledriver"
++ ---help---
++ Select this for AMD Family 15h Piledriver processors.
++
++ Enables -march=bdver2
++
++config MSTEAMROLLER
++ bool "AMD Steamroller"
++ ---help---
++ Select this for AMD Family 15h Steamroller processors.
++
++ Enables -march=bdver3
++
++config MEXCAVATOR
++ bool "AMD Excavator"
++ ---help---
++ Select this for AMD Family 15h Excavator processors.
++
++ Enables -march=bdver4
++
++config MZEN
++ bool "AMD Zen"
++ ---help---
++ Select this for AMD Family 17h Zen processors.
++
++ Enables -march=znver1
++
++config MZEN2
++ bool "AMD Zen 2"
++ ---help---
++ Select this for AMD Family 17h Zen 2 processors.
++
++ Enables -march=znver2
++
+ config MCRUSOE
+ bool "Crusoe"
+ depends on X86_32
+@@ -253,6 +331,7 @@ config MVIAC7
+
+ config MPSC
+ bool "Intel P4 / older Netburst based Xeon"
++ select X86_P6_NOP
+ depends on X86_64
+ ---help---
+ Optimize for Intel Pentium 4, Pentium D and older Nocona/Dempsey
+@@ -262,8 +341,19 @@ config MPSC
+ using the cpu family field
+ in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
+
++config MATOM
++ bool "Intel Atom"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Atom platform. Intel Atom CPUs have an
++ in-order pipelining architecture and thus can benefit from
++ accordingly optimized code. Use a recent GCC with specific Atom
++ support in order to fully benefit from selecting this option.
++
+ config MCORE2
+- bool "Core 2/newer Xeon"
++ bool "Intel Core 2"
++ select X86_P6_NOP
+ ---help---
+
+ Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
+@@ -271,14 +361,133 @@ config MCORE2
+ family in /proc/cpuinfo. Newer ones have 6 and older ones 15
+ (not a typo)
+
+-config MATOM
+- bool "Intel Atom"
++ Enables -march=core2
++
++config MNEHALEM
++ bool "Intel Nehalem"
++ select X86_P6_NOP
+ ---help---
+
+- Select this for the Intel Atom platform. Intel Atom CPUs have an
+- in-order pipelining architecture and thus can benefit from
+- accordingly optimized code. Use a recent GCC with specific Atom
+- support in order to fully benefit from selecting this option.
++ Select this for 1st Gen Core processors in the Nehalem family.
++
++ Enables -march=nehalem
++
++config MWESTMERE
++ bool "Intel Westmere"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Westmere formerly Nehalem-C family.
++
++ Enables -march=westmere
++
++config MSILVERMONT
++ bool "Intel Silvermont"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Silvermont platform.
++
++ Enables -march=silvermont
++
++config MGOLDMONT
++ bool "Intel Goldmont"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Goldmont platform including Apollo Lake and Denverton.
++
++ Enables -march=goldmont
++
++config MGOLDMONTPLUS
++ bool "Intel Goldmont Plus"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Goldmont Plus platform including Gemini Lake.
++
++ Enables -march=goldmont-plus
++
++config MSANDYBRIDGE
++ bool "Intel Sandy Bridge"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 2nd Gen Core processors in the Sandy Bridge family.
++
++ Enables -march=sandybridge
++
++config MIVYBRIDGE
++ bool "Intel Ivy Bridge"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 3rd Gen Core processors in the Ivy Bridge family.
++
++ Enables -march=ivybridge
++
++config MHASWELL
++ bool "Intel Haswell"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 4th Gen Core processors in the Haswell family.
++
++ Enables -march=haswell
++
++config MBROADWELL
++ bool "Intel Broadwell"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 5th Gen Core processors in the Broadwell family.
++
++ Enables -march=broadwell
++
++config MSKYLAKE
++ bool "Intel Skylake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 6th Gen Core processors in the Skylake family.
++
++ Enables -march=skylake
++
++config MSKYLAKEX
++ bool "Intel Skylake X"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 6th Gen Core processors in the Skylake X family.
++
++ Enables -march=skylake-avx512
++
++config MCANNONLAKE
++ bool "Intel Cannon Lake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 8th Gen Core processors
++
++ Enables -march=cannonlake
++
++config MICELAKE
++ bool "Intel Ice Lake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 10th Gen Core processors in the Ice Lake family.
++
++ Enables -march=icelake-client
++
++config MCASCADELAKE
++ bool "Intel Cascade Lake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for Xeon processors in the Cascade Lake family.
++
++ Enables -march=cascadelake
+
+ config GENERIC_CPU
+ bool "Generic-x86-64"
+@@ -287,6 +496,19 @@ config GENERIC_CPU
+ Generic x86-64 CPU.
+ Run equally well on all x86-64 CPUs.
+
++config MNATIVE
++ bool "Native optimizations autodetected by GCC"
++ ---help---
++
++ GCC 4.2 and above support -march=native, which automatically detects
++ the optimum settings to use based on your processor. -march=native
++ also detects and applies additional settings beyond -march specific
++ to your CPU, (eg. -msse4). Unless you have a specific reason not to
++ (e.g. distcc cross-compiling), you should probably be using
++ -march=native rather than anything listed below.
++
++ Enables -march=native
++
+ endchoice
+
+ config X86_GENERIC
+@@ -311,7 +533,7 @@ config X86_INTERNODE_CACHE_SHIFT
+ config X86_L1_CACHE_SHIFT
+ int
+ default "7" if MPENTIUM4 || MPSC
+- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
++ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
+ default "4" if MELAN || M486 || MGEODEGX1
+ default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
+
+@@ -329,35 +551,36 @@ config X86_ALIGNMENT_16
+
+ config X86_INTEL_USERCOPY
+ def_bool y
+- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
++ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE
+
+ config X86_USE_PPRO_CHECKSUM
+ def_bool y
+- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
++ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MATOM || MNATIVE
+
+ config X86_USE_3DNOW
+ def_bool y
+ depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
+
+-#
+-# P6_NOPs are a relatively minor optimization that require a family >=
+-# 6 processor, except that it is broken on certain VIA chips.
+-# Furthermore, AMD chips prefer a totally different sequence of NOPs
+-# (which work on all CPUs). In addition, it looks like Virtual PC
+-# does not understand them.
+-#
+-# As a result, disallow these if we're not compiling for X86_64 (these
+-# NOPs do work on all x86-64 capable chips); the list of processors in
+-# the right-hand clause are the cores that benefit from this optimization.
+-#
+ config X86_P6_NOP
+- def_bool y
+- depends on X86_64
+- depends on (MCORE2 || MPENTIUM4 || MPSC)
++ default n
++ bool "Support for P6_NOPs on Intel chips"
++ depends on (MCORE2 || MPENTIUM4 || MPSC || MATOM || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE)
++ ---help---
++ P6_NOPs are a relatively minor optimization that require a family >=
++ 6 processor, except that it is broken on certain VIA chips.
++ Furthermore, AMD chips prefer a totally different sequence of NOPs
++ (which work on all CPUs). In addition, it looks like Virtual PC
++ does not understand them.
++
++ As a result, disallow these if we're not compiling for X86_64 (these
++ NOPs do work on all x86-64 capable chips); the list of processors in
++ the right-hand clause are the cores that benefit from this optimization.
++
++ Say Y if you have Intel CPU newer than Pentium Pro, N otherwise.
+
+ config X86_TSC
+ def_bool y
+- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
++ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE || MATOM) || X86_64
+
+ config X86_CMPXCHG64
+ def_bool y
+@@ -367,7 +590,7 @@ config X86_CMPXCHG64
+ # generates cmov.
+ config X86_CMOV
+ def_bool y
+- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
++ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
+
+ config X86_MINIMUM_CPU_FAMILY
+ int
+--- a/arch/x86/Makefile 2019-08-16 04:11:12.000000000 -0400
++++ b/arch/x86/Makefile 2019-08-22 16:01:22.559789904 -0400
+@@ -118,13 +118,53 @@ else
+ KBUILD_CFLAGS += $(call cc-option,-mskip-rax-setup)
+
+ # FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
++ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
+ cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
++ cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-mtune=k8)
++ cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10)
++ cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona)
++ cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1)
++ cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2)
++ cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1)
++ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2)
++ cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3)
++ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4)
++ cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1)
++ cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2)
+ cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
+
+ cflags-$(CONFIG_MCORE2) += \
+- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
+- cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
+- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
++ $(call cc-option,-march=core2,$(call cc-option,-mtune=core2))
++ cflags-$(CONFIG_MNEHALEM) += \
++ $(call cc-option,-march=nehalem,$(call cc-option,-mtune=nehalem))
++ cflags-$(CONFIG_MWESTMERE) += \
++ $(call cc-option,-march=westmere,$(call cc-option,-mtune=westmere))
++ cflags-$(CONFIG_MSILVERMONT) += \
++ $(call cc-option,-march=silvermont,$(call cc-option,-mtune=silvermont))
++ cflags-$(CONFIG_MGOLDMONT) += \
++ $(call cc-option,-march=goldmont,$(call cc-option,-mtune=goldmont))
++ cflags-$(CONFIG_MGOLDMONTPLUS) += \
++ $(call cc-option,-march=goldmont-plus,$(call cc-option,-mtune=goldmont-plus))
++ cflags-$(CONFIG_MSANDYBRIDGE) += \
++ $(call cc-option,-march=sandybridge,$(call cc-option,-mtune=sandybridge))
++ cflags-$(CONFIG_MIVYBRIDGE) += \
++ $(call cc-option,-march=ivybridge,$(call cc-option,-mtune=ivybridge))
++ cflags-$(CONFIG_MHASWELL) += \
++ $(call cc-option,-march=haswell,$(call cc-option,-mtune=haswell))
++ cflags-$(CONFIG_MBROADWELL) += \
++ $(call cc-option,-march=broadwell,$(call cc-option,-mtune=broadwell))
++ cflags-$(CONFIG_MSKYLAKE) += \
++ $(call cc-option,-march=skylake,$(call cc-option,-mtune=skylake))
++ cflags-$(CONFIG_MSKYLAKEX) += \
++ $(call cc-option,-march=skylake-avx512,$(call cc-option,-mtune=skylake-avx512))
++ cflags-$(CONFIG_MCANNONLAKE) += \
++ $(call cc-option,-march=cannonlake,$(call cc-option,-mtune=cannonlake))
++ cflags-$(CONFIG_MICELAKE) += \
++ $(call cc-option,-march=icelake-client,$(call cc-option,-mtune=icelake-client))
++ cflags-$(CONFIG_MCASCADE) += \
++ $(call cc-option,-march=cascadelake,$(call cc-option,-mtune=cascadelake))
++ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell) \
++ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
+ cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
+ KBUILD_CFLAGS += $(cflags-y)
+
+--- a/arch/x86/Makefile_32.cpu 2019-08-16 04:11:12.000000000 -0400
++++ b/arch/x86/Makefile_32.cpu 2019-08-22 16:02:14.687701216 -0400
+@@ -23,7 +23,19 @@ cflags-$(CONFIG_MK6) += -march=k6
+ # Please note, that patches that add -march=athlon-xp and friends are pointless.
+ # They make zero difference whatsosever to performance at this time.
+ cflags-$(CONFIG_MK7) += -march=athlon
++cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
+ cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8,-march=athlon)
++cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-march=athlon)
++cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10,-march=athlon)
++cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona,-march=athlon)
++cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1,-march=athlon)
++cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2,-march=athlon)
++cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1,-march=athlon)
++cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2,-march=athlon)
++cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3,-march=athlon)
++cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4,-march=athlon)
++cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1,-march=athlon)
++cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2,-march=athlon)
+ cflags-$(CONFIG_MCRUSOE) += -march=i686 -falign-functions=0 -falign-jumps=0 -falign-loops=0
+ cflags-$(CONFIG_MEFFICEON) += -march=i686 $(call tune,pentium3) -falign-functions=0 -falign-jumps=0 -falign-loops=0
+ cflags-$(CONFIG_MWINCHIPC6) += $(call cc-option,-march=winchip-c6,-march=i586)
+@@ -32,8 +44,22 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
+ cflags-$(CONFIG_MVIAC3_2) += $(call cc-option,-march=c3-2,-march=i686)
+ cflags-$(CONFIG_MVIAC7) += -march=i686
+ cflags-$(CONFIG_MCORE2) += -march=i686 $(call tune,core2)
+-cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom,$(call cc-option,-march=core2,-march=i686)) \
+- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
++cflags-$(CONFIG_MNEHALEM) += -march=i686 $(call tune,nehalem)
++cflags-$(CONFIG_MWESTMERE) += -march=i686 $(call tune,westmere)
++cflags-$(CONFIG_MSILVERMONT) += -march=i686 $(call tune,silvermont)
++cflags-$(CONFIG_MGOLDMONT) += -march=i686 $(call tune,goldmont)
++cflags-$(CONFIG_MGOLDMONTPLUS) += -march=i686 $(call tune,goldmont-plus)
++cflags-$(CONFIG_MSANDYBRIDGE) += -march=i686 $(call tune,sandybridge)
++cflags-$(CONFIG_MIVYBRIDGE) += -march=i686 $(call tune,ivybridge)
++cflags-$(CONFIG_MHASWELL) += -march=i686 $(call tune,haswell)
++cflags-$(CONFIG_MBROADWELL) += -march=i686 $(call tune,broadwell)
++cflags-$(CONFIG_MSKYLAKE) += -march=i686 $(call tune,skylake)
++cflags-$(CONFIG_MSKYLAKEX) += -march=i686 $(call tune,skylake-avx512)
++cflags-$(CONFIG_MCANNONLAKE) += -march=i686 $(call tune,cannonlake)
++cflags-$(CONFIG_MICELAKE) += -march=i686 $(call tune,icelake-client)
++cflags-$(CONFIG_MCASCADELAKE) += -march=i686 $(call tune,cascadelake)
++cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell,$(call cc-option,-march=core2,-march=i686)) \
++ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
+
+ # AMD Elan support
+ cflags-$(CONFIG_MELAN) += -march=i486
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-08-25 17:37 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-08-25 17:37 UTC (permalink / raw
To: gentoo-commits
commit: b62a0b001e2e98264ba2cbe01a779da0ea1a1a35
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Aug 25 17:36:50 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Aug 25 17:36:50 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b62a0b00
Linux patch 4.19.68
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1067_linux-4.19.68.patch | 2580 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2584 insertions(+)
diff --git a/0000_README b/0000_README
index 75aee25..dd97210 100644
--- a/0000_README
+++ b/0000_README
@@ -311,6 +311,10 @@ Patch: 1066_linux-4.19.67.patch
From: https://www.kernel.org
Desc: Linux 4.19.67
+Patch: 1067_linux-4.19.68.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.68
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1067_linux-4.19.68.patch b/1067_linux-4.19.68.patch
new file mode 100644
index 0000000..a4515f2
--- /dev/null
+++ b/1067_linux-4.19.68.patch
@@ -0,0 +1,2580 @@
+diff --git a/Makefile b/Makefile
+index b6aa6e8d4411..6f164b04d953 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 67
++SUBLEVEL = 68
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
+index 7ed320895d1f..f52a2968a3b6 100644
+--- a/arch/arm64/include/asm/efi.h
++++ b/arch/arm64/include/asm/efi.h
+@@ -94,7 +94,11 @@ static inline unsigned long efi_get_max_initrd_addr(unsigned long dram_base,
+ ((protocol##_t *)instance)->f(instance, ##__VA_ARGS__)
+
+ #define alloc_screen_info(x...) &screen_info
+-#define free_screen_info(x...)
++
++static inline void free_screen_info(efi_system_table_t *sys_table_arg,
++ struct screen_info *si)
++{
++}
+
+ /* redeclare as 'hidden' so the compiler will generate relative references */
+ extern struct screen_info screen_info __attribute__((__visibility__("hidden")));
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index ea423db39364..2214a403f39b 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -419,8 +419,8 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
+ PMD_TYPE_SECT)
+
+ #if defined(CONFIG_ARM64_64K_PAGES) || CONFIG_PGTABLE_LEVELS < 3
+-#define pud_sect(pud) (0)
+-#define pud_table(pud) (1)
++static inline bool pud_sect(pud_t pud) { return false; }
++static inline bool pud_table(pud_t pud) { return true; }
+ #else
+ #define pud_sect(pud) ((pud_val(pud) & PUD_TYPE_MASK) == \
+ PUD_TYPE_SECT)
+diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
+index 57e962290df3..7eff8afa035f 100644
+--- a/arch/arm64/kernel/ftrace.c
++++ b/arch/arm64/kernel/ftrace.c
+@@ -76,7 +76,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+
+ if (offset < -SZ_128M || offset >= SZ_128M) {
+ #ifdef CONFIG_ARM64_MODULE_PLTS
+- struct plt_entry trampoline;
++ struct plt_entry trampoline, *dst;
+ struct module *mod;
+
+ /*
+@@ -104,24 +104,27 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+ * is added in the future, but for now, the pr_err() below
+ * deals with a theoretical issue only.
+ */
++ dst = mod->arch.ftrace_trampoline;
+ trampoline = get_plt_entry(addr);
+- if (!plt_entries_equal(mod->arch.ftrace_trampoline,
+- &trampoline)) {
+- if (!plt_entries_equal(mod->arch.ftrace_trampoline,
+- &(struct plt_entry){})) {
++ if (!plt_entries_equal(dst, &trampoline)) {
++ if (!plt_entries_equal(dst, &(struct plt_entry){})) {
+ pr_err("ftrace: far branches to multiple entry points unsupported inside a single module\n");
+ return -EINVAL;
+ }
+
+ /* point the trampoline to our ftrace entry point */
+ module_disable_ro(mod);
+- *mod->arch.ftrace_trampoline = trampoline;
++ *dst = trampoline;
+ module_enable_ro(mod, true);
+
+- /* update trampoline before patching in the branch */
+- smp_wmb();
++ /*
++ * Ensure updated trampoline is visible to instruction
++ * fetch before we patch in the branch.
++ */
++ __flush_icache_range((unsigned long)&dst[0],
++ (unsigned long)&dst[1]);
+ }
+- addr = (unsigned long)(void *)mod->arch.ftrace_trampoline;
++ addr = (unsigned long)dst;
+ #else /* CONFIG_ARM64_MODULE_PLTS */
+ return -EINVAL;
+ #endif /* CONFIG_ARM64_MODULE_PLTS */
+diff --git a/arch/arm64/kernel/return_address.c b/arch/arm64/kernel/return_address.c
+index 933adbc0f654..0311fe52c8ff 100644
+--- a/arch/arm64/kernel/return_address.c
++++ b/arch/arm64/kernel/return_address.c
+@@ -11,6 +11,7 @@
+
+ #include <linux/export.h>
+ #include <linux/ftrace.h>
++#include <linux/kprobes.h>
+
+ #include <asm/stack_pointer.h>
+ #include <asm/stacktrace.h>
+@@ -32,6 +33,7 @@ static int save_return_addr(struct stackframe *frame, void *d)
+ return 0;
+ }
+ }
++NOKPROBE_SYMBOL(save_return_addr);
+
+ void *return_address(unsigned int level)
+ {
+@@ -55,3 +57,4 @@ void *return_address(unsigned int level)
+ return NULL;
+ }
+ EXPORT_SYMBOL_GPL(return_address);
++NOKPROBE_SYMBOL(return_address);
+diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
+index 4989f7ea1e59..bb482ec044b6 100644
+--- a/arch/arm64/kernel/stacktrace.c
++++ b/arch/arm64/kernel/stacktrace.c
+@@ -18,6 +18,7 @@
+ #include <linux/kernel.h>
+ #include <linux/export.h>
+ #include <linux/ftrace.h>
++#include <linux/kprobes.h>
+ #include <linux/sched.h>
+ #include <linux/sched/debug.h>
+ #include <linux/sched/task_stack.h>
+@@ -85,6 +86,7 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
+
+ return 0;
+ }
++NOKPROBE_SYMBOL(unwind_frame);
+
+ void notrace walk_stackframe(struct task_struct *tsk, struct stackframe *frame,
+ int (*fn)(struct stackframe *, void *), void *data)
+@@ -99,6 +101,7 @@ void notrace walk_stackframe(struct task_struct *tsk, struct stackframe *frame,
+ break;
+ }
+ }
++NOKPROBE_SYMBOL(walk_stackframe);
+
+ #ifdef CONFIG_STACKTRACE
+ struct stack_trace_data {
+diff --git a/arch/arm64/kvm/regmap.c b/arch/arm64/kvm/regmap.c
+index 7a5173ea2276..4c2e96ef306e 100644
+--- a/arch/arm64/kvm/regmap.c
++++ b/arch/arm64/kvm/regmap.c
+@@ -189,13 +189,18 @@ void vcpu_write_spsr32(struct kvm_vcpu *vcpu, unsigned long v)
+ switch (spsr_idx) {
+ case KVM_SPSR_SVC:
+ write_sysreg_el1(v, spsr);
++ break;
+ case KVM_SPSR_ABT:
+ write_sysreg(v, spsr_abt);
++ break;
+ case KVM_SPSR_UND:
+ write_sysreg(v, spsr_und);
++ break;
+ case KVM_SPSR_IRQ:
+ write_sysreg(v, spsr_irq);
++ break;
+ case KVM_SPSR_FIQ:
+ write_sysreg(v, spsr_fiq);
++ break;
+ }
+ }
+diff --git a/arch/riscv/include/asm/switch_to.h b/arch/riscv/include/asm/switch_to.h
+index dd6b05bff75b..d911a8c2314d 100644
+--- a/arch/riscv/include/asm/switch_to.h
++++ b/arch/riscv/include/asm/switch_to.h
+@@ -23,7 +23,7 @@ extern void __fstate_restore(struct task_struct *restore_from);
+
+ static inline void __fstate_clean(struct pt_regs *regs)
+ {
+- regs->sstatus |= (regs->sstatus & ~(SR_FS)) | SR_FS_CLEAN;
++ regs->sstatus = (regs->sstatus & ~SR_FS) | SR_FS_CLEAN;
+ }
+
+ static inline void fstate_save(struct task_struct *task,
+diff --git a/arch/sh/kernel/hw_breakpoint.c b/arch/sh/kernel/hw_breakpoint.c
+index d9ff3b42da7c..2569ffc061f9 100644
+--- a/arch/sh/kernel/hw_breakpoint.c
++++ b/arch/sh/kernel/hw_breakpoint.c
+@@ -160,6 +160,7 @@ int arch_bp_generic_fields(int sh_len, int sh_type,
+ switch (sh_type) {
+ case SH_BREAKPOINT_READ:
+ *gen_type = HW_BREAKPOINT_R;
++ break;
+ case SH_BREAKPOINT_WRITE:
+ *gen_type = HW_BREAKPOINT_W;
+ break;
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index a285fbd0fd9b..15580e4fc766 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -515,6 +515,7 @@ void cpu_reset(void)
+ "add %2, %2, %7\n\t"
+ "addi %0, %0, -1\n\t"
+ "bnez %0, 1b\n\t"
++ "isync\n\t"
+ /* Jump to identity mapping */
+ "jx %3\n"
+ "2:\n\t"
+diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
+index c92c10d55374..5bece9752ed6 100644
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -313,6 +313,9 @@ static int ahci_platform_get_phy(struct ahci_host_priv *hpriv, u32 port,
+ hpriv->phys[port] = NULL;
+ rc = 0;
+ break;
++ case -EPROBE_DEFER:
++ /* Do not complain yet */
++ break;
+
+ default:
+ dev_err(dev,
+diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
+index 173e6f2dd9af..eefda51f97d3 100644
+--- a/drivers/ata/libata-zpodd.c
++++ b/drivers/ata/libata-zpodd.c
+@@ -56,7 +56,7 @@ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
+ unsigned int ret;
+ struct rm_feature_desc *desc;
+ struct ata_taskfile tf;
+- static const char cdb[] = { GPCMD_GET_CONFIGURATION,
++ static const char cdb[ATAPI_CDB_LEN] = { GPCMD_GET_CONFIGURATION,
+ 2, /* only 1 feature descriptor requested */
+ 0, 3, /* 3, removable medium feature */
+ 0, 0, 0,/* reserved */
+diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c
+index 33481368740e..113152425a95 100644
+--- a/drivers/clk/at91/clk-generated.c
++++ b/drivers/clk/at91/clk-generated.c
+@@ -153,6 +153,8 @@ static int clk_generated_determine_rate(struct clk_hw *hw,
+ continue;
+
+ div = DIV_ROUND_CLOSEST(parent_rate, req->rate);
++ if (div > GENERATED_MAX_DIV + 1)
++ div = GENERATED_MAX_DIV + 1;
+
+ clk_generated_best_diff(req, parent, parent_rate, div,
+ &best_diff, &best_rate);
+diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
+index f4b013e9352d..24485bee9b49 100644
+--- a/drivers/clk/renesas/renesas-cpg-mssr.c
++++ b/drivers/clk/renesas/renesas-cpg-mssr.c
+@@ -535,17 +535,11 @@ static int cpg_mssr_reset(struct reset_controller_dev *rcdev,
+ unsigned int reg = id / 32;
+ unsigned int bit = id % 32;
+ u32 bitmask = BIT(bit);
+- unsigned long flags;
+- u32 value;
+
+ dev_dbg(priv->dev, "reset %u%02u\n", reg, bit);
+
+ /* Reset module */
+- spin_lock_irqsave(&priv->rmw_lock, flags);
+- value = readl(priv->base + SRCR(reg));
+- value |= bitmask;
+- writel(value, priv->base + SRCR(reg));
+- spin_unlock_irqrestore(&priv->rmw_lock, flags);
++ writel(bitmask, priv->base + SRCR(reg));
+
+ /* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
+ udelay(35);
+@@ -562,16 +556,10 @@ static int cpg_mssr_assert(struct reset_controller_dev *rcdev, unsigned long id)
+ unsigned int reg = id / 32;
+ unsigned int bit = id % 32;
+ u32 bitmask = BIT(bit);
+- unsigned long flags;
+- u32 value;
+
+ dev_dbg(priv->dev, "assert %u%02u\n", reg, bit);
+
+- spin_lock_irqsave(&priv->rmw_lock, flags);
+- value = readl(priv->base + SRCR(reg));
+- value |= bitmask;
+- writel(value, priv->base + SRCR(reg));
+- spin_unlock_irqrestore(&priv->rmw_lock, flags);
++ writel(bitmask, priv->base + SRCR(reg));
+ return 0;
+ }
+
+diff --git a/drivers/clk/sprd/Kconfig b/drivers/clk/sprd/Kconfig
+index 87892471eb96..bad8099832d4 100644
+--- a/drivers/clk/sprd/Kconfig
++++ b/drivers/clk/sprd/Kconfig
+@@ -2,6 +2,7 @@ config SPRD_COMMON_CLK
+ tristate "Clock support for Spreadtrum SoCs"
+ depends on ARCH_SPRD || COMPILE_TEST
+ default ARCH_SPRD
++ select REGMAP_MMIO
+
+ if SPRD_COMMON_CLK
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index f5fb93795a69..65cecfdd9b45 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -707,7 +707,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
+ thread = (*pos & GENMASK_ULL(59, 52)) >> 52;
+ bank = (*pos & GENMASK_ULL(61, 60)) >> 60;
+
+- data = kmalloc_array(1024, sizeof(*data), GFP_KERNEL);
++ data = kcalloc(1024, sizeof(*data), GFP_KERNEL);
+ if (!data)
+ return -ENOMEM;
+
+diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
+index bf6cad6c9178..7a3e5a8f6439 100644
+--- a/drivers/gpu/drm/bridge/Kconfig
++++ b/drivers/gpu/drm/bridge/Kconfig
+@@ -46,6 +46,7 @@ config DRM_DUMB_VGA_DAC
+ config DRM_LVDS_ENCODER
+ tristate "Transparent parallel to LVDS encoder support"
+ depends on OF
++ select DRM_KMS_HELPER
+ select DRM_PANEL_BRIDGE
+ help
+ Support for transparent parallel to LVDS encoders that don't require
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_scaler.c b/drivers/gpu/drm/exynos/exynos_drm_scaler.c
+index 0ddb6eec7b11..df228436a03d 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_scaler.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_scaler.c
+@@ -108,12 +108,12 @@ static inline int scaler_reset(struct scaler_context *scaler)
+ scaler_write(SCALER_CFG_SOFT_RESET, SCALER_CFG);
+ do {
+ cpu_relax();
+- } while (retry > 1 &&
++ } while (--retry > 1 &&
+ scaler_read(SCALER_CFG) & SCALER_CFG_SOFT_RESET);
+ do {
+ cpu_relax();
+ scaler_write(1, SCALER_INT_EN);
+- } while (retry > 0 && scaler_read(SCALER_INT_EN) != 1);
++ } while (--retry > 0 && scaler_read(SCALER_INT_EN) != 1);
+
+ return retry ? 0 : -EIO;
+ }
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index ed9a3a1e50ef..dbfd2c006f74 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -1284,7 +1284,8 @@ static int add_gpu_components(struct device *dev,
+ if (!np)
+ return 0;
+
+- drm_of_component_match_add(dev, matchptr, compare_of, np);
++ if (of_device_is_available(np))
++ drm_of_component_match_add(dev, matchptr, compare_of, np);
+
+ of_node_put(np);
+
+diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c
+index 6e1a4a4fc0c1..ab9da597106f 100644
+--- a/drivers/hid/hid-holtek-kbd.c
++++ b/drivers/hid/hid-holtek-kbd.c
+@@ -126,9 +126,14 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
+
+ /* Locate the boot interface, to receive the LED change events */
+ struct usb_interface *boot_interface = usb_ifnum_to_if(usb_dev, 0);
++ struct hid_device *boot_hid;
++ struct hid_input *boot_hid_input;
+
+- struct hid_device *boot_hid = usb_get_intfdata(boot_interface);
+- struct hid_input *boot_hid_input = list_first_entry(&boot_hid->inputs,
++ if (unlikely(boot_interface == NULL))
++ return -ENODEV;
++
++ boot_hid = usb_get_intfdata(boot_interface);
++ boot_hid_input = list_first_entry(&boot_hid->inputs,
+ struct hid_input, list);
+
+ return boot_hid_input->input->event(boot_hid_input->input, type, code,
+diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
+index a746017fac17..5a949ca42b1d 100644
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -297,6 +297,14 @@ static int hiddev_open(struct inode *inode, struct file *file)
+ spin_unlock_irq(&list->hiddev->list_lock);
+
+ mutex_lock(&hiddev->existancelock);
++ /*
++ * recheck exist with existance lock held to
++ * avoid opening a disconnected device
++ */
++ if (!list->hiddev->exist) {
++ res = -ENODEV;
++ goto bail_unlock;
++ }
+ if (!list->hiddev->open++)
+ if (list->hiddev->exist) {
+ struct hid_device *hid = hiddev->hid;
+@@ -313,6 +321,10 @@ bail_normal_power:
+ hid_hw_power(hid, PM_HINT_NORMAL);
+ bail_unlock:
+ mutex_unlock(&hiddev->existancelock);
++
++ spin_lock_irq(&list->hiddev->list_lock);
++ list_del(&list->node);
++ spin_unlock_irq(&list->hiddev->list_lock);
+ bail:
+ file->private_data = NULL;
+ vfree(list);
+diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
+index ce9af43fa2de..49c1956e6a67 100644
+--- a/drivers/iio/adc/max9611.c
++++ b/drivers/iio/adc/max9611.c
+@@ -483,7 +483,7 @@ static int max9611_init(struct max9611_dev *max9611)
+ if (ret)
+ return ret;
+
+- regval = ret & MAX9611_TEMP_MASK;
++ regval &= MAX9611_TEMP_MASK;
+
+ if ((regval > MAX9611_TEMP_MAX_POS &&
+ regval < MAX9611_TEMP_MIN_NEG) ||
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index ef459f2f2eeb..7586c1dd73f1 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -3182,18 +3182,18 @@ static int ib_mad_port_open(struct ib_device *device,
+ if (has_smi)
+ cq_size *= 2;
+
++ port_priv->pd = ib_alloc_pd(device, 0);
++ if (IS_ERR(port_priv->pd)) {
++ dev_err(&device->dev, "Couldn't create ib_mad PD\n");
++ ret = PTR_ERR(port_priv->pd);
++ goto error3;
++ }
++
+ port_priv->cq = ib_alloc_cq(port_priv->device, port_priv, cq_size, 0,
+ IB_POLL_WORKQUEUE);
+ if (IS_ERR(port_priv->cq)) {
+ dev_err(&device->dev, "Couldn't create ib_mad CQ\n");
+ ret = PTR_ERR(port_priv->cq);
+- goto error3;
+- }
+-
+- port_priv->pd = ib_alloc_pd(device, 0);
+- if (IS_ERR(port_priv->pd)) {
+- dev_err(&device->dev, "Couldn't create ib_mad PD\n");
+- ret = PTR_ERR(port_priv->pd);
+ goto error4;
+ }
+
+@@ -3236,11 +3236,11 @@ error8:
+ error7:
+ destroy_mad_qp(&port_priv->qp_info[0]);
+ error6:
+- ib_dealloc_pd(port_priv->pd);
+-error4:
+ ib_free_cq(port_priv->cq);
+ cleanup_recv_queue(&port_priv->qp_info[1]);
+ cleanup_recv_queue(&port_priv->qp_info[0]);
++error4:
++ ib_dealloc_pd(port_priv->pd);
+ error3:
+ kfree(port_priv);
+
+@@ -3270,8 +3270,8 @@ static int ib_mad_port_close(struct ib_device *device, int port_num)
+ destroy_workqueue(port_priv->wq);
+ destroy_mad_qp(&port_priv->qp_info[1]);
+ destroy_mad_qp(&port_priv->qp_info[0]);
+- ib_dealloc_pd(port_priv->pd);
+ ib_free_cq(port_priv->cq);
++ ib_dealloc_pd(port_priv->pd);
+ cleanup_recv_queue(&port_priv->qp_info[1]);
+ cleanup_recv_queue(&port_priv->qp_info[0]);
+ /* XXX: Handle deallocation of MAD registration tables */
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index c34a6852d691..a18f3f8ad77f 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -49,6 +49,7 @@
+ #include <linux/sched.h>
+ #include <linux/semaphore.h>
+ #include <linux/slab.h>
++#include <linux/nospec.h>
+
+ #include <linux/uaccess.h>
+
+@@ -868,11 +869,14 @@ static int ib_umad_unreg_agent(struct ib_umad_file *file, u32 __user *arg)
+
+ if (get_user(id, arg))
+ return -EFAULT;
++ if (id >= IB_UMAD_MAX_AGENTS)
++ return -EINVAL;
+
+ mutex_lock(&file->port->file_mutex);
+ mutex_lock(&file->mutex);
+
+- if (id >= IB_UMAD_MAX_AGENTS || !__get_agent(file, id)) {
++ id = array_index_nospec(id, IB_UMAD_MAX_AGENTS);
++ if (!__get_agent(file, id)) {
+ ret = -EINVAL;
+ goto out;
+ }
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index 9bab4fb65c68..bd1fdadf7ba0 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -51,22 +51,12 @@ static void clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
+ static void dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
+ static int mr_cache_max_order(struct mlx5_ib_dev *dev);
+ static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
+-static bool umr_can_modify_entity_size(struct mlx5_ib_dev *dev)
+-{
+- return !MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled);
+-}
+
+ static bool umr_can_use_indirect_mkey(struct mlx5_ib_dev *dev)
+ {
+ return !MLX5_CAP_GEN(dev->mdev, umr_indirect_mkey_disabled);
+ }
+
+-static bool use_umr(struct mlx5_ib_dev *dev, int order)
+-{
+- return order <= mr_cache_max_order(dev) &&
+- umr_can_modify_entity_size(dev);
+-}
+-
+ static int destroy_mkey(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
+ {
+ int err = mlx5_core_destroy_mkey(dev->mdev, &mr->mmkey);
+@@ -1305,7 +1295,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+ {
+ struct mlx5_ib_dev *dev = to_mdev(pd->device);
+ struct mlx5_ib_mr *mr = NULL;
+- bool populate_mtts = false;
++ bool use_umr;
+ struct ib_umem *umem;
+ int page_shift;
+ int npages;
+@@ -1338,29 +1328,30 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+ if (err < 0)
+ return ERR_PTR(err);
+
+- if (use_umr(dev, order)) {
++ use_umr = !MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled) &&
++ (!MLX5_CAP_GEN(dev->mdev, umr_modify_atomic_disabled) ||
++ !MLX5_CAP_GEN(dev->mdev, atomic));
++
++ if (order <= mr_cache_max_order(dev) && use_umr) {
+ mr = alloc_mr_from_cache(pd, umem, virt_addr, length, ncont,
+ page_shift, order, access_flags);
+ if (PTR_ERR(mr) == -EAGAIN) {
+ mlx5_ib_dbg(dev, "cache empty for order %d\n", order);
+ mr = NULL;
+ }
+- populate_mtts = false;
+ } else if (!MLX5_CAP_GEN(dev->mdev, umr_extended_translation_offset)) {
+ if (access_flags & IB_ACCESS_ON_DEMAND) {
+ err = -EINVAL;
+ pr_err("Got MR registration for ODP MR > 512MB, not supported for Connect-IB\n");
+ goto error;
+ }
+- populate_mtts = true;
++ use_umr = false;
+ }
+
+ if (!mr) {
+- if (!umr_can_modify_entity_size(dev))
+- populate_mtts = true;
+ mutex_lock(&dev->slow_path_mutex);
+ mr = reg_create(NULL, pd, virt_addr, length, umem, ncont,
+- page_shift, access_flags, populate_mtts);
++ page_shift, access_flags, !use_umr);
+ mutex_unlock(&dev->slow_path_mutex);
+ }
+
+@@ -1378,7 +1369,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+ update_odp_mr(mr);
+ #endif
+
+- if (!populate_mtts) {
++ if (use_umr) {
+ int update_xlt_flags = MLX5_IB_UPD_XLT_ENABLE;
+
+ if (access_flags & IB_ACCESS_ON_DEMAND)
+diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
+index 78073259c9a1..c431df7401b4 100644
+--- a/drivers/input/joystick/iforce/iforce-usb.c
++++ b/drivers/input/joystick/iforce/iforce-usb.c
+@@ -141,7 +141,12 @@ static int iforce_usb_probe(struct usb_interface *intf,
+ return -ENODEV;
+
+ epirq = &interface->endpoint[0].desc;
++ if (!usb_endpoint_is_int_in(epirq))
++ return -ENODEV;
++
+ epout = &interface->endpoint[1].desc;
++ if (!usb_endpoint_is_int_out(epout))
++ return -ENODEV;
+
+ if (!(iforce = kzalloc(sizeof(struct iforce) + 32, GFP_KERNEL)))
+ goto fail;
+diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h
+index 10a039148234..538986e5ac5b 100644
+--- a/drivers/input/mouse/trackpoint.h
++++ b/drivers/input/mouse/trackpoint.h
+@@ -161,7 +161,8 @@ struct trackpoint_data {
+ #ifdef CONFIG_MOUSE_PS2_TRACKPOINT
+ int trackpoint_detect(struct psmouse *psmouse, bool set_properties);
+ #else
+-inline int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
++static inline int trackpoint_detect(struct psmouse *psmouse,
++ bool set_properties)
+ {
+ return -ENOSYS;
+ }
+diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
+index 75b500651e4e..b1cf0c971274 100644
+--- a/drivers/input/tablet/kbtab.c
++++ b/drivers/input/tablet/kbtab.c
+@@ -116,6 +116,10 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
+ if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+ return -ENODEV;
+
++ endpoint = &intf->cur_altsetting->endpoint[0].desc;
++ if (!usb_endpoint_is_int_in(endpoint))
++ return -ENODEV;
++
+ kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL);
+ input_dev = input_allocate_device();
+ if (!kbtab || !input_dev)
+@@ -154,8 +158,6 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
+ input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0);
+ input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0);
+
+- endpoint = &intf->cur_altsetting->endpoint[0].desc;
+-
+ usb_fill_int_urb(kbtab->irq, dev,
+ usb_rcvintpipe(dev, endpoint->bEndpointAddress),
+ kbtab->data, 8,
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 3a1d30304f7e..66b4800bcdd8 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -1710,7 +1710,7 @@ static const struct attribute_group *amd_iommu_groups[] = {
+ NULL,
+ };
+
+-static int iommu_init_pci(struct amd_iommu *iommu)
++static int __init iommu_init_pci(struct amd_iommu *iommu)
+ {
+ int cap_ptr = iommu->cap_ptr;
+ u32 range, misc, low, high;
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index ee30e8965d1b..9ba73e11757d 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2883,7 +2883,7 @@ static int its_vpe_init(struct its_vpe *vpe)
+
+ if (!its_alloc_vpe_table(vpe_id)) {
+ its_vpe_id_free(vpe_id);
+- its_free_pending_table(vpe->vpt_page);
++ its_free_pending_table(vpt_page);
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c
+index 4760307ab43f..cef8f5e2e8fc 100644
+--- a/drivers/irqchip/irq-imx-gpcv2.c
++++ b/drivers/irqchip/irq-imx-gpcv2.c
+@@ -131,6 +131,7 @@ static struct irq_chip gpcv2_irqchip_data_chip = {
+ .irq_unmask = imx_gpcv2_irq_unmask,
+ .irq_set_wake = imx_gpcv2_irq_set_wake,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
++ .irq_set_type = irq_chip_set_type_parent,
+ #ifdef CONFIG_SMP
+ .irq_set_affinity = irq_chip_set_affinity_parent,
+ #endif
+diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
+index 7d480c930eaf..7e426e4d1352 100644
+--- a/drivers/md/dm-core.h
++++ b/drivers/md/dm-core.h
+@@ -130,6 +130,7 @@ struct mapped_device {
+ };
+
+ int md_in_flight(struct mapped_device *md);
++void disable_discard(struct mapped_device *md);
+ void disable_write_same(struct mapped_device *md);
+ void disable_write_zeroes(struct mapped_device *md);
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 6e547b8dd298..264b84e274aa 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -295,11 +295,14 @@ static void dm_done(struct request *clone, blk_status_t error, bool mapped)
+ }
+
+ if (unlikely(error == BLK_STS_TARGET)) {
+- if (req_op(clone) == REQ_OP_WRITE_SAME &&
+- !clone->q->limits.max_write_same_sectors)
++ if (req_op(clone) == REQ_OP_DISCARD &&
++ !clone->q->limits.max_discard_sectors)
++ disable_discard(tio->md);
++ else if (req_op(clone) == REQ_OP_WRITE_SAME &&
++ !clone->q->limits.max_write_same_sectors)
+ disable_write_same(tio->md);
+- if (req_op(clone) == REQ_OP_WRITE_ZEROES &&
+- !clone->q->limits.max_write_zeroes_sectors)
++ else if (req_op(clone) == REQ_OP_WRITE_ZEROES &&
++ !clone->q->limits.max_write_zeroes_sectors)
+ disable_write_zeroes(tio->md);
+ }
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 42768fe92b41..c9860e3b04dd 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -910,6 +910,15 @@ static void dec_pending(struct dm_io *io, blk_status_t error)
+ }
+ }
+
++void disable_discard(struct mapped_device *md)
++{
++ struct queue_limits *limits = dm_get_queue_limits(md);
++
++ /* device doesn't really support DISCARD, disable it */
++ limits->max_discard_sectors = 0;
++ blk_queue_flag_clear(QUEUE_FLAG_DISCARD, md->queue);
++}
++
+ void disable_write_same(struct mapped_device *md)
+ {
+ struct queue_limits *limits = dm_get_queue_limits(md);
+@@ -935,11 +944,14 @@ static void clone_endio(struct bio *bio)
+ dm_endio_fn endio = tio->ti->type->end_io;
+
+ if (unlikely(error == BLK_STS_TARGET) && md->type != DM_TYPE_NVME_BIO_BASED) {
+- if (bio_op(bio) == REQ_OP_WRITE_SAME &&
+- !bio->bi_disk->queue->limits.max_write_same_sectors)
++ if (bio_op(bio) == REQ_OP_DISCARD &&
++ !bio->bi_disk->queue->limits.max_discard_sectors)
++ disable_discard(md);
++ else if (bio_op(bio) == REQ_OP_WRITE_SAME &&
++ !bio->bi_disk->queue->limits.max_write_same_sectors)
+ disable_write_same(md);
+- if (bio_op(bio) == REQ_OP_WRITE_ZEROES &&
+- !bio->bi_disk->queue->limits.max_write_zeroes_sectors)
++ else if (bio_op(bio) == REQ_OP_WRITE_ZEROES &&
++ !bio->bi_disk->queue->limits.max_write_zeroes_sectors)
+ disable_write_zeroes(md);
+ }
+
+diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
+index 7fdac277e382..9c77bfe4334f 100644
+--- a/drivers/mmc/host/sdhci-of-arasan.c
++++ b/drivers/mmc/host/sdhci-of-arasan.c
+@@ -788,7 +788,8 @@ static int sdhci_arasan_probe(struct platform_device *pdev)
+
+ ret = mmc_of_parse(host->mmc);
+ if (ret) {
+- dev_err(&pdev->dev, "parsing dt failed (%d)\n", ret);
++ if (ret != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "parsing dt failed (%d)\n", ret);
+ goto unreg_clk;
+ }
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index be0b785becd0..8f14f85b8e95 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1102,6 +1102,8 @@ static void bond_compute_features(struct bonding *bond)
+ done:
+ bond_dev->vlan_features = vlan_features;
+ bond_dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
++ NETIF_F_HW_VLAN_CTAG_TX |
++ NETIF_F_HW_VLAN_STAG_TX |
+ NETIF_F_GSO_UDP_L4;
+ bond_dev->gso_max_segs = gso_max_segs;
+ netif_set_gso_max_size(bond_dev, gso_max_size);
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 33baa17fa9d5..cf01e73d1bcc 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -3058,12 +3058,13 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
+ /* if VF indicate to PF this function is going down (PF will delete sp
+ * elements and clear initializations
+ */
+- if (IS_VF(bp))
++ if (IS_VF(bp)) {
++ bnx2x_clear_vlan_info(bp);
+ bnx2x_vfpf_close_vf(bp);
+- else if (unload_mode != UNLOAD_RECOVERY)
++ } else if (unload_mode != UNLOAD_RECOVERY) {
+ /* if this is a normal/close unload need to clean up chip*/
+ bnx2x_chip_cleanup(bp, unload_mode, keep_link);
+- else {
++ } else {
+ /* Send the UNLOAD_REQUEST to the MCP */
+ bnx2x_send_unload_req(bp, unload_mode);
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+index 0e508e5defce..ee5159ef837e 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+@@ -425,6 +425,8 @@ void bnx2x_set_reset_global(struct bnx2x *bp);
+ void bnx2x_disable_close_the_gate(struct bnx2x *bp);
+ int bnx2x_init_hw_func_cnic(struct bnx2x *bp);
+
++void bnx2x_clear_vlan_info(struct bnx2x *bp);
++
+ /**
+ * bnx2x_sp_event - handle ramrods completion.
+ *
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 2c9af0f420e5..68c62e32e882 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -8488,11 +8488,21 @@ int bnx2x_set_vlan_one(struct bnx2x *bp, u16 vlan,
+ return rc;
+ }
+
++void bnx2x_clear_vlan_info(struct bnx2x *bp)
++{
++ struct bnx2x_vlan_entry *vlan;
++
++ /* Mark that hw forgot all entries */
++ list_for_each_entry(vlan, &bp->vlan_reg, link)
++ vlan->hw = false;
++
++ bp->vlan_cnt = 0;
++}
++
+ static int bnx2x_del_all_vlans(struct bnx2x *bp)
+ {
+ struct bnx2x_vlan_mac_obj *vlan_obj = &bp->sp_objs[0].vlan_obj;
+ unsigned long ramrod_flags = 0, vlan_flags = 0;
+- struct bnx2x_vlan_entry *vlan;
+ int rc;
+
+ __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
+@@ -8501,10 +8511,7 @@ static int bnx2x_del_all_vlans(struct bnx2x *bp)
+ if (rc)
+ return rc;
+
+- /* Mark that hw forgot all entries */
+- list_for_each_entry(vlan, &bp->vlan_reg, link)
+- vlan->hw = false;
+- bp->vlan_cnt = 0;
++ bnx2x_clear_vlan_info(bp);
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+index f5cd9539980f..45d9a5f8fa1b 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+@@ -1190,7 +1190,7 @@ int mlx4_en_config_rss_steer(struct mlx4_en_priv *priv)
+ err = mlx4_qp_alloc(mdev->dev, priv->base_qpn, rss_map->indir_qp);
+ if (err) {
+ en_err(priv, "Failed to allocate RSS indirection QP\n");
+- goto rss_err;
++ goto qp_alloc_err;
+ }
+
+ rss_map->indir_qp->event = mlx4_en_sqp_event;
+@@ -1244,6 +1244,7 @@ indir_err:
+ MLX4_QP_STATE_RST, NULL, 0, 0, rss_map->indir_qp);
+ mlx4_qp_remove(mdev->dev, rss_map->indir_qp);
+ mlx4_qp_free(mdev->dev, rss_map->indir_qp);
++qp_alloc_err:
+ kfree(rss_map->indir_qp);
+ rss_map->indir_qp = NULL;
+ rss_err:
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
+index 45cdde694d20..a4be04debe67 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
+@@ -437,12 +437,6 @@ arfs_hash_bucket(struct arfs_table *arfs_t, __be16 src_port,
+ return &arfs_t->rules_hash[bucket_idx];
+ }
+
+-static u8 arfs_get_ip_proto(const struct sk_buff *skb)
+-{
+- return (skb->protocol == htons(ETH_P_IP)) ?
+- ip_hdr(skb)->protocol : ipv6_hdr(skb)->nexthdr;
+-}
+-
+ static struct arfs_table *arfs_get_table(struct mlx5e_arfs_tables *arfs,
+ u8 ip_proto, __be16 etype)
+ {
+@@ -599,31 +593,9 @@ out:
+ arfs_may_expire_flow(priv);
+ }
+
+-/* return L4 destination port from ip4/6 packets */
+-static __be16 arfs_get_dst_port(const struct sk_buff *skb)
+-{
+- char *transport_header;
+-
+- transport_header = skb_transport_header(skb);
+- if (arfs_get_ip_proto(skb) == IPPROTO_TCP)
+- return ((struct tcphdr *)transport_header)->dest;
+- return ((struct udphdr *)transport_header)->dest;
+-}
+-
+-/* return L4 source port from ip4/6 packets */
+-static __be16 arfs_get_src_port(const struct sk_buff *skb)
+-{
+- char *transport_header;
+-
+- transport_header = skb_transport_header(skb);
+- if (arfs_get_ip_proto(skb) == IPPROTO_TCP)
+- return ((struct tcphdr *)transport_header)->source;
+- return ((struct udphdr *)transport_header)->source;
+-}
+-
+ static struct arfs_rule *arfs_alloc_rule(struct mlx5e_priv *priv,
+ struct arfs_table *arfs_t,
+- const struct sk_buff *skb,
++ const struct flow_keys *fk,
+ u16 rxq, u32 flow_id)
+ {
+ struct arfs_rule *rule;
+@@ -638,19 +610,19 @@ static struct arfs_rule *arfs_alloc_rule(struct mlx5e_priv *priv,
+ INIT_WORK(&rule->arfs_work, arfs_handle_work);
+
+ tuple = &rule->tuple;
+- tuple->etype = skb->protocol;
++ tuple->etype = fk->basic.n_proto;
++ tuple->ip_proto = fk->basic.ip_proto;
+ if (tuple->etype == htons(ETH_P_IP)) {
+- tuple->src_ipv4 = ip_hdr(skb)->saddr;
+- tuple->dst_ipv4 = ip_hdr(skb)->daddr;
++ tuple->src_ipv4 = fk->addrs.v4addrs.src;
++ tuple->dst_ipv4 = fk->addrs.v4addrs.dst;
+ } else {
+- memcpy(&tuple->src_ipv6, &ipv6_hdr(skb)->saddr,
++ memcpy(&tuple->src_ipv6, &fk->addrs.v6addrs.src,
+ sizeof(struct in6_addr));
+- memcpy(&tuple->dst_ipv6, &ipv6_hdr(skb)->daddr,
++ memcpy(&tuple->dst_ipv6, &fk->addrs.v6addrs.dst,
+ sizeof(struct in6_addr));
+ }
+- tuple->ip_proto = arfs_get_ip_proto(skb);
+- tuple->src_port = arfs_get_src_port(skb);
+- tuple->dst_port = arfs_get_dst_port(skb);
++ tuple->src_port = fk->ports.src;
++ tuple->dst_port = fk->ports.dst;
+
+ rule->flow_id = flow_id;
+ rule->filter_id = priv->fs.arfs.last_filter_id++ % RPS_NO_FILTER;
+@@ -661,37 +633,33 @@ static struct arfs_rule *arfs_alloc_rule(struct mlx5e_priv *priv,
+ return rule;
+ }
+
+-static bool arfs_cmp_ips(struct arfs_tuple *tuple,
+- const struct sk_buff *skb)
++static bool arfs_cmp(const struct arfs_tuple *tuple, const struct flow_keys *fk)
+ {
+- if (tuple->etype == htons(ETH_P_IP) &&
+- tuple->src_ipv4 == ip_hdr(skb)->saddr &&
+- tuple->dst_ipv4 == ip_hdr(skb)->daddr)
+- return true;
+- if (tuple->etype == htons(ETH_P_IPV6) &&
+- (!memcmp(&tuple->src_ipv6, &ipv6_hdr(skb)->saddr,
+- sizeof(struct in6_addr))) &&
+- (!memcmp(&tuple->dst_ipv6, &ipv6_hdr(skb)->daddr,
+- sizeof(struct in6_addr))))
+- return true;
++ if (tuple->src_port != fk->ports.src || tuple->dst_port != fk->ports.dst)
++ return false;
++ if (tuple->etype != fk->basic.n_proto)
++ return false;
++ if (tuple->etype == htons(ETH_P_IP))
++ return tuple->src_ipv4 == fk->addrs.v4addrs.src &&
++ tuple->dst_ipv4 == fk->addrs.v4addrs.dst;
++ if (tuple->etype == htons(ETH_P_IPV6))
++ return !memcmp(&tuple->src_ipv6, &fk->addrs.v6addrs.src,
++ sizeof(struct in6_addr)) &&
++ !memcmp(&tuple->dst_ipv6, &fk->addrs.v6addrs.dst,
++ sizeof(struct in6_addr));
+ return false;
+ }
+
+ static struct arfs_rule *arfs_find_rule(struct arfs_table *arfs_t,
+- const struct sk_buff *skb)
++ const struct flow_keys *fk)
+ {
+ struct arfs_rule *arfs_rule;
+ struct hlist_head *head;
+- __be16 src_port = arfs_get_src_port(skb);
+- __be16 dst_port = arfs_get_dst_port(skb);
+
+- head = arfs_hash_bucket(arfs_t, src_port, dst_port);
++ head = arfs_hash_bucket(arfs_t, fk->ports.src, fk->ports.dst);
+ hlist_for_each_entry(arfs_rule, head, hlist) {
+- if (arfs_rule->tuple.src_port == src_port &&
+- arfs_rule->tuple.dst_port == dst_port &&
+- arfs_cmp_ips(&arfs_rule->tuple, skb)) {
++ if (arfs_cmp(&arfs_rule->tuple, fk))
+ return arfs_rule;
+- }
+ }
+
+ return NULL;
+@@ -704,20 +672,24 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
+ struct mlx5e_arfs_tables *arfs = &priv->fs.arfs;
+ struct arfs_table *arfs_t;
+ struct arfs_rule *arfs_rule;
++ struct flow_keys fk;
++
++ if (!skb_flow_dissect_flow_keys(skb, &fk, 0))
++ return -EPROTONOSUPPORT;
+
+- if (skb->protocol != htons(ETH_P_IP) &&
+- skb->protocol != htons(ETH_P_IPV6))
++ if (fk.basic.n_proto != htons(ETH_P_IP) &&
++ fk.basic.n_proto != htons(ETH_P_IPV6))
+ return -EPROTONOSUPPORT;
+
+ if (skb->encapsulation)
+ return -EPROTONOSUPPORT;
+
+- arfs_t = arfs_get_table(arfs, arfs_get_ip_proto(skb), skb->protocol);
++ arfs_t = arfs_get_table(arfs, fk.basic.ip_proto, fk.basic.n_proto);
+ if (!arfs_t)
+ return -EPROTONOSUPPORT;
+
+ spin_lock_bh(&arfs->arfs_lock);
+- arfs_rule = arfs_find_rule(arfs_t, skb);
++ arfs_rule = arfs_find_rule(arfs_t, &fk);
+ if (arfs_rule) {
+ if (arfs_rule->rxq == rxq_index) {
+ spin_unlock_bh(&arfs->arfs_lock);
+@@ -725,8 +697,7 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
+ }
+ arfs_rule->rxq = rxq_index;
+ } else {
+- arfs_rule = arfs_alloc_rule(priv, arfs_t, skb,
+- rxq_index, flow_id);
++ arfs_rule = arfs_alloc_rule(priv, arfs_t, &fk, rxq_index, flow_id);
+ if (!arfs_rule) {
+ spin_unlock_bh(&arfs->arfs_lock);
+ return -ENOMEM;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 792bb8bc0cd3..2b9350f4c752 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1083,6 +1083,9 @@ static int mlx5e_set_pauseparam(struct net_device *netdev,
+ struct mlx5_core_dev *mdev = priv->mdev;
+ int err;
+
++ if (!MLX5_CAP_GEN(mdev, vport_group_manager))
++ return -EOPNOTSUPP;
++
+ if (pauseparam->autoneg)
+ return -EINVAL;
+
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index dc30f11f4766..3feb49badda9 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -1011,6 +1011,8 @@ static void __team_compute_features(struct team *team)
+
+ team->dev->vlan_features = vlan_features;
+ team->dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
++ NETIF_F_HW_VLAN_CTAG_TX |
++ NETIF_F_HW_VLAN_STAG_TX |
+ NETIF_F_GSO_UDP_L4;
+ team->dev->hard_header_len = max_hard_header_len;
+
+diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
+index f4247b275e09..b7a0df95d4b0 100644
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -285,7 +285,7 @@ static void mdio_write(struct net_device *dev, int phy_id, int loc, int val)
+ static int read_eprom_word(pegasus_t *pegasus, __u8 index, __u16 *retdata)
+ {
+ int i;
+- __u8 tmp;
++ __u8 tmp = 0;
+ __le16 retdatai;
+ int ret;
+
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index d5081ffdc8f0..1c849106b793 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -925,6 +925,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+ skb_shinfo(skb)->nr_frags = MAX_SKB_FRAGS;
+ nskb = xenvif_alloc_skb(0);
+ if (unlikely(nskb == NULL)) {
++ skb_shinfo(skb)->nr_frags = 0;
+ kfree_skb(skb);
+ xenvif_tx_err(queue, &txreq, extra_count, idx);
+ if (net_ratelimit())
+@@ -940,6 +941,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+
+ if (xenvif_set_skb_gso(queue->vif, skb, gso)) {
+ /* Failure in xenvif_set_skb_gso is fatal. */
++ skb_shinfo(skb)->nr_frags = 0;
+ kfree_skb(skb);
+ kfree_skb(nskb);
+ break;
+diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
+index 1c64fd8e9234..72bdda4ccebf 100644
+--- a/drivers/pwm/sysfs.c
++++ b/drivers/pwm/sysfs.c
+@@ -263,7 +263,6 @@ static int pwm_export_child(struct device *parent, struct pwm_device *pwm)
+ export->pwm = pwm;
+ mutex_init(&export->lock);
+
+- export->child.class = parent->class;
+ export->child.release = pwm_export_release;
+ export->child.parent = parent;
+ export->child.devt = MKDEV(0, 0);
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index c43eccdea65d..f570b8c5d857 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -2320,6 +2320,8 @@ static int handle_ioaccel_mode2_error(struct ctlr_info *h,
+ case IOACCEL2_SERV_RESPONSE_COMPLETE:
+ switch (c2->error_data.status) {
+ case IOACCEL2_STATUS_SR_TASK_COMP_GOOD:
++ if (cmd)
++ cmd->result = 0;
+ break;
+ case IOACCEL2_STATUS_SR_TASK_COMP_CHK_COND:
+ cmd->result |= SAM_STAT_CHECK_CONDITION;
+@@ -2479,8 +2481,10 @@ static void process_ioaccel2_completion(struct ctlr_info *h,
+
+ /* check for good status */
+ if (likely(c2->error_data.serv_response == 0 &&
+- c2->error_data.status == 0))
++ c2->error_data.status == 0)) {
++ cmd->result = 0;
+ return hpsa_cmd_free_and_done(h, c, cmd);
++ }
+
+ /*
+ * Any RAID offload error results in retry which will use
+@@ -5617,6 +5621,12 @@ static int hpsa_scsi_queue_command(struct Scsi_Host *sh, struct scsi_cmnd *cmd)
+ }
+ c = cmd_tagged_alloc(h, cmd);
+
++ /*
++ * This is necessary because the SML doesn't zero out this field during
++ * error recovery.
++ */
++ cmd->result = 0;
++
+ /*
+ * Call alternate submit routine for I/O accelerated commands.
+ * Retries always go down the normal I/O path.
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index f84f9bf15027..ddce32fe0513 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -4732,7 +4732,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags)
+ ql_log(ql_log_warn, vha, 0xd049,
+ "Failed to allocate ct_sns request.\n");
+ kfree(fcport);
+- fcport = NULL;
++ return NULL;
+ }
+ INIT_WORK(&fcport->del_work, qla24xx_delete_sess_fn);
+ INIT_LIST_HEAD(&fcport->gnl_entry);
+diff --git a/drivers/staging/comedi/drivers/dt3000.c b/drivers/staging/comedi/drivers/dt3000.c
+index 2edf3ee91300..caf4d4df4bd3 100644
+--- a/drivers/staging/comedi/drivers/dt3000.c
++++ b/drivers/staging/comedi/drivers/dt3000.c
+@@ -342,9 +342,9 @@ static irqreturn_t dt3k_interrupt(int irq, void *d)
+ static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
+ unsigned int flags)
+ {
+- int divider, base, prescale;
++ unsigned int divider, base, prescale;
+
+- /* This function needs improvment */
++ /* This function needs improvement */
+ /* Don't know if divider==0 works. */
+
+ for (prescale = 0; prescale < 16; prescale++) {
+@@ -358,7 +358,7 @@ static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
+ divider = (*nanosec) / base;
+ break;
+ case CMDF_ROUND_UP:
+- divider = (*nanosec) / base;
++ divider = DIV_ROUND_UP(*nanosec, base);
+ break;
+ }
+ if (divider < 65536) {
+@@ -368,7 +368,7 @@ static int dt3k_ns_to_timer(unsigned int timer_base, unsigned int *nanosec,
+ }
+
+ prescale = 15;
+- base = timer_base * (1 << prescale);
++ base = timer_base * (prescale + 1);
+ divider = 65535;
+ *nanosec = divider * base;
+ return (prescale << 16) | (divider);
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 5b442bc68a76..59675cc7aa01 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1333,10 +1333,6 @@ made_compressed_probe:
+ tty_port_init(&acm->port);
+ acm->port.ops = &acm_port_ops;
+
+- minor = acm_alloc_minor(acm);
+- if (minor < 0)
+- goto alloc_fail1;
+-
+ ctrlsize = usb_endpoint_maxp(epctrl);
+ readsize = usb_endpoint_maxp(epread) *
+ (quirks == SINGLE_RX_URB ? 1 : 2);
+@@ -1344,6 +1340,13 @@ made_compressed_probe:
+ acm->writesize = usb_endpoint_maxp(epwrite) * 20;
+ acm->control = control_interface;
+ acm->data = data_interface;
++
++ usb_get_intf(acm->control); /* undone in destruct() */
++
++ minor = acm_alloc_minor(acm);
++ if (minor < 0)
++ goto alloc_fail1;
++
+ acm->minor = minor;
+ acm->dev = usb_dev;
+ if (h.usb_cdc_acm_descriptor)
+@@ -1490,7 +1493,6 @@ skip_countries:
+ usb_driver_claim_interface(&acm_driver, data_interface, acm);
+ usb_set_intfdata(data_interface, acm);
+
+- usb_get_intf(control_interface);
+ tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor,
+ &control_interface->dev);
+ if (IS_ERR(tty_dev)) {
+diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
+index 65de6f73b672..558890ada0e5 100644
+--- a/drivers/usb/core/file.c
++++ b/drivers/usb/core/file.c
+@@ -193,9 +193,10 @@ int usb_register_dev(struct usb_interface *intf,
+ intf->minor = minor;
+ break;
+ }
+- up_write(&minor_rwsem);
+- if (intf->minor < 0)
++ if (intf->minor < 0) {
++ up_write(&minor_rwsem);
+ return -EXFULL;
++ }
+
+ /* create a usb class device for this usb interface */
+ snprintf(name, sizeof(name), class_driver->name, minor - minor_base);
+@@ -203,12 +204,11 @@ int usb_register_dev(struct usb_interface *intf,
+ MKDEV(USB_MAJOR, minor), class_driver,
+ "%s", kbasename(name));
+ if (IS_ERR(intf->usb_dev)) {
+- down_write(&minor_rwsem);
+ usb_minors[minor] = NULL;
+ intf->minor = -1;
+- up_write(&minor_rwsem);
+ retval = PTR_ERR(intf->usb_dev);
+ }
++ up_write(&minor_rwsem);
+ return retval;
+ }
+ EXPORT_SYMBOL_GPL(usb_register_dev);
+@@ -234,12 +234,12 @@ void usb_deregister_dev(struct usb_interface *intf,
+ return;
+
+ dev_dbg(&intf->dev, "removing %d minor\n", intf->minor);
++ device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
+
+ down_write(&minor_rwsem);
+ usb_minors[intf->minor] = NULL;
+ up_write(&minor_rwsem);
+
+- device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
+ intf->usb_dev = NULL;
+ intf->minor = -1;
+ destroy_usb_class();
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index 4020ce8db6ce..0d3fd2083165 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -2211,14 +2211,14 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
+ (struct usb_cdc_dmm_desc *)buffer;
+ break;
+ case USB_CDC_MDLM_TYPE:
+- if (elength < sizeof(struct usb_cdc_mdlm_desc *))
++ if (elength < sizeof(struct usb_cdc_mdlm_desc))
+ goto next_desc;
+ if (desc)
+ return -EINVAL;
+ desc = (struct usb_cdc_mdlm_desc *)buffer;
+ break;
+ case USB_CDC_MDLM_DETAIL_TYPE:
+- if (elength < sizeof(struct usb_cdc_mdlm_detail_desc *))
++ if (elength < sizeof(struct usb_cdc_mdlm_detail_desc))
+ goto next_desc;
+ if (detail)
+ return -EINVAL;
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index fea02c7ad4f4..a5254e82d628 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -19,6 +19,7 @@
+ #include <linux/pm_runtime.h>
+ #include <linux/sizes.h>
+ #include <linux/slab.h>
++#include <linux/string.h>
+ #include <linux/sys_soc.h>
+ #include <linux/uaccess.h>
+ #include <linux/usb/ch9.h>
+@@ -2378,9 +2379,9 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr,
+ if (usb3->forced_b_device)
+ return -EBUSY;
+
+- if (!strncmp(buf, "host", strlen("host")))
++ if (sysfs_streq(buf, "host"))
+ new_mode_is_host = true;
+- else if (!strncmp(buf, "peripheral", strlen("peripheral")))
++ else if (sysfs_streq(buf, "peripheral"))
+ new_mode_is_host = false;
+ else
+ return -EINVAL;
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index e0a4749ba565..56f572cb08f8 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -968,6 +968,11 @@ static const struct usb_device_id option_ids[] = {
+ { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7B) },
+ { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7C) },
+
++ /* Motorola devices */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2a70, 0xff, 0xff, 0xff) }, /* mdm6600 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x2e0a, 0xff, 0xff, 0xff) }, /* mdm9600 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x4281, 0x0a, 0x00, 0xfc) }, /* mdm ram dl */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x900e, 0xff, 0xff, 0xff) }, /* mdm qc dl */
+
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) },
+@@ -1549,6 +1554,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */
+ .driver_info = RSVD(2) },
+ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
+@@ -1952,11 +1958,15 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */
+ .driver_info = RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e3d, 0xff), /* D-Link DWM-222 A2 */
++ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */
+ .driver_info = RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */
++ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c
+index 73427d8e0116..e5694133ebe5 100644
+--- a/drivers/xen/xen-pciback/conf_space_capability.c
++++ b/drivers/xen/xen-pciback/conf_space_capability.c
+@@ -116,13 +116,12 @@ static int pm_ctrl_write(struct pci_dev *dev, int offset, u16 new_value,
+ {
+ int err;
+ u16 old_value;
+- pci_power_t new_state, old_state;
++ pci_power_t new_state;
+
+ err = pci_read_config_word(dev, offset, &old_value);
+ if (err)
+ goto out;
+
+- old_state = (pci_power_t)(old_value & PCI_PM_CTRL_STATE_MASK);
+ new_state = (pci_power_t)(new_value & PCI_PM_CTRL_STATE_MASK);
+
+ new_value &= PM_OK_BITS;
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index ac6c383d6314..19855659f650 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -1485,7 +1485,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr)
+ goto out;
+ }
+
+- trans = btrfs_attach_transaction(root);
++ trans = btrfs_join_transaction_nostart(root);
+ if (IS_ERR(trans)) {
+ if (PTR_ERR(trans) != -ENOENT && PTR_ERR(trans) != -EROFS) {
+ ret = PTR_ERR(trans);
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index f1ca53a3ff0b..26317bca5649 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -28,15 +28,18 @@ static const unsigned int btrfs_blocked_trans_types[TRANS_STATE_MAX] = {
+ [TRANS_STATE_COMMIT_START] = (__TRANS_START | __TRANS_ATTACH),
+ [TRANS_STATE_COMMIT_DOING] = (__TRANS_START |
+ __TRANS_ATTACH |
+- __TRANS_JOIN),
++ __TRANS_JOIN |
++ __TRANS_JOIN_NOSTART),
+ [TRANS_STATE_UNBLOCKED] = (__TRANS_START |
+ __TRANS_ATTACH |
+ __TRANS_JOIN |
+- __TRANS_JOIN_NOLOCK),
++ __TRANS_JOIN_NOLOCK |
++ __TRANS_JOIN_NOSTART),
+ [TRANS_STATE_COMPLETED] = (__TRANS_START |
+ __TRANS_ATTACH |
+ __TRANS_JOIN |
+- __TRANS_JOIN_NOLOCK),
++ __TRANS_JOIN_NOLOCK |
++ __TRANS_JOIN_NOSTART),
+ };
+
+ void btrfs_put_transaction(struct btrfs_transaction *transaction)
+@@ -531,7 +534,8 @@ again:
+ ret = join_transaction(fs_info, type);
+ if (ret == -EBUSY) {
+ wait_current_trans(fs_info);
+- if (unlikely(type == TRANS_ATTACH))
++ if (unlikely(type == TRANS_ATTACH ||
++ type == TRANS_JOIN_NOSTART))
+ ret = -ENOENT;
+ }
+ } while (ret == -EBUSY);
+@@ -647,6 +651,16 @@ struct btrfs_trans_handle *btrfs_join_transaction_nolock(struct btrfs_root *root
+ BTRFS_RESERVE_NO_FLUSH, true);
+ }
+
++/*
++ * Similar to regular join but it never starts a transaction when none is
++ * running or after waiting for the current one to finish.
++ */
++struct btrfs_trans_handle *btrfs_join_transaction_nostart(struct btrfs_root *root)
++{
++ return start_transaction(root, 0, TRANS_JOIN_NOSTART,
++ BTRFS_RESERVE_NO_FLUSH, true);
++}
++
+ /*
+ * btrfs_attach_transaction() - catch the running transaction
+ *
+diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
+index 4cbb1b55387d..c1d34cc70472 100644
+--- a/fs/btrfs/transaction.h
++++ b/fs/btrfs/transaction.h
+@@ -97,11 +97,13 @@ struct btrfs_transaction {
+ #define __TRANS_JOIN (1U << 11)
+ #define __TRANS_JOIN_NOLOCK (1U << 12)
+ #define __TRANS_DUMMY (1U << 13)
++#define __TRANS_JOIN_NOSTART (1U << 14)
+
+ #define TRANS_START (__TRANS_START | __TRANS_FREEZABLE)
+ #define TRANS_ATTACH (__TRANS_ATTACH)
+ #define TRANS_JOIN (__TRANS_JOIN | __TRANS_FREEZABLE)
+ #define TRANS_JOIN_NOLOCK (__TRANS_JOIN_NOLOCK)
++#define TRANS_JOIN_NOSTART (__TRANS_JOIN_NOSTART)
+
+ #define TRANS_EXTWRITERS (__TRANS_START | __TRANS_ATTACH)
+
+@@ -187,6 +189,7 @@ struct btrfs_trans_handle *btrfs_start_transaction_fallback_global_rsv(
+ int min_factor);
+ struct btrfs_trans_handle *btrfs_join_transaction(struct btrfs_root *root);
+ struct btrfs_trans_handle *btrfs_join_transaction_nolock(struct btrfs_root *root);
++struct btrfs_trans_handle *btrfs_join_transaction_nostart(struct btrfs_root *root);
+ struct btrfs_trans_handle *btrfs_attach_transaction(struct btrfs_root *root);
+ struct btrfs_trans_handle *btrfs_attach_transaction_barrier(
+ struct btrfs_root *root);
+diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
+index 3a24ce3deb01..c146e12a8601 100644
+--- a/fs/ocfs2/xattr.c
++++ b/fs/ocfs2/xattr.c
+@@ -3833,7 +3833,6 @@ static int ocfs2_xattr_bucket_find(struct inode *inode,
+ u16 blk_per_bucket = ocfs2_blocks_per_xattr_bucket(inode->i_sb);
+ int low_bucket = 0, bucket, high_bucket;
+ struct ocfs2_xattr_bucket *search;
+- u32 last_hash;
+ u64 blkno, lower_blkno = 0;
+
+ search = ocfs2_xattr_bucket_new(inode);
+@@ -3877,8 +3876,6 @@ static int ocfs2_xattr_bucket_find(struct inode *inode,
+ if (xh->xh_count)
+ xe = &xh->xh_entries[le16_to_cpu(xh->xh_count) - 1];
+
+- last_hash = le32_to_cpu(xe->xe_name_hash);
+-
+ /* record lower_blkno which may be the insert place. */
+ lower_blkno = blkno;
+
+diff --git a/fs/seq_file.c b/fs/seq_file.c
+index 1dea7a8a5255..05e58b56f620 100644
+--- a/fs/seq_file.c
++++ b/fs/seq_file.c
+@@ -119,6 +119,7 @@ static int traverse(struct seq_file *m, loff_t offset)
+ }
+ if (seq_has_overflowed(m))
+ goto Eoverflow;
++ p = m->op->next(m, p, &m->index);
+ if (pos + m->count > offset) {
+ m->from = offset - pos;
+ m->count -= m->from;
+@@ -126,7 +127,6 @@ static int traverse(struct seq_file *m, loff_t offset)
+ }
+ pos += m->count;
+ m->count = 0;
+- p = m->op->next(m, p, &m->index);
+ if (pos == offset)
+ break;
+ }
+diff --git a/include/asm-generic/getorder.h b/include/asm-generic/getorder.h
+index c64bea7a52be..e9f20b813a69 100644
+--- a/include/asm-generic/getorder.h
++++ b/include/asm-generic/getorder.h
+@@ -7,24 +7,6 @@
+ #include <linux/compiler.h>
+ #include <linux/log2.h>
+
+-/*
+- * Runtime evaluation of get_order()
+- */
+-static inline __attribute_const__
+-int __get_order(unsigned long size)
+-{
+- int order;
+-
+- size--;
+- size >>= PAGE_SHIFT;
+-#if BITS_PER_LONG == 32
+- order = fls(size);
+-#else
+- order = fls64(size);
+-#endif
+- return order;
+-}
+-
+ /**
+ * get_order - Determine the allocation order of a memory size
+ * @size: The size for which to get the order
+@@ -43,19 +25,27 @@ int __get_order(unsigned long size)
+ * to hold an object of the specified size.
+ *
+ * The result is undefined if the size is 0.
+- *
+- * This function may be used to initialise variables with compile time
+- * evaluations of constants.
+ */
+-#define get_order(n) \
+-( \
+- __builtin_constant_p(n) ? ( \
+- ((n) == 0UL) ? BITS_PER_LONG - PAGE_SHIFT : \
+- (((n) < (1UL << PAGE_SHIFT)) ? 0 : \
+- ilog2((n) - 1) - PAGE_SHIFT + 1) \
+- ) : \
+- __get_order(n) \
+-)
++static inline __attribute_const__ int get_order(unsigned long size)
++{
++ if (__builtin_constant_p(size)) {
++ if (!size)
++ return BITS_PER_LONG - PAGE_SHIFT;
++
++ if (size < (1UL << PAGE_SHIFT))
++ return 0;
++
++ return ilog2((size) - 1) - PAGE_SHIFT + 1;
++ }
++
++ size--;
++ size >>= PAGE_SHIFT;
++#if BITS_PER_LONG == 32
++ return fls(size);
++#else
++ return fls64(size);
++#endif
++}
+
+ #endif /* __ASSEMBLY__ */
+
+diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
+index fbf5cfc9b352..fd965ffbb92e 100644
+--- a/include/drm/i915_pciids.h
++++ b/include/drm/i915_pciids.h
+@@ -386,6 +386,7 @@
+ INTEL_VGA_DEVICE(0x3E91, info), /* SRV GT2 */ \
+ INTEL_VGA_DEVICE(0x3E92, info), /* SRV GT2 */ \
+ INTEL_VGA_DEVICE(0x3E96, info), /* SRV GT2 */ \
++ INTEL_VGA_DEVICE(0x3E98, info), /* SRV GT2 */ \
+ INTEL_VGA_DEVICE(0x3E9A, info) /* SRV GT2 */
+
+ /* CFL H */
+diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
+index 90ac450745f1..561fefc2a980 100644
+--- a/include/kvm/arm_vgic.h
++++ b/include/kvm/arm_vgic.h
+@@ -361,6 +361,7 @@ int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu);
+
+ void kvm_vgic_load(struct kvm_vcpu *vcpu);
+ void kvm_vgic_put(struct kvm_vcpu *vcpu);
++void kvm_vgic_vmcr_sync(struct kvm_vcpu *vcpu);
+
+ #define irqchip_in_kernel(k) (!!((k)->arch.vgic.in_kernel))
+ #define vgic_initialized(k) ((k)->arch.vgic.initialized)
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index 4e3625109b28..64d54acc9928 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -40,6 +40,7 @@ struct sugov_policy {
+ struct task_struct *thread;
+ bool work_in_progress;
+
++ bool limits_changed;
+ bool need_freq_update;
+ };
+
+@@ -90,8 +91,11 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
+ !cpufreq_this_cpu_can_update(sg_policy->policy))
+ return false;
+
+- if (unlikely(sg_policy->need_freq_update))
++ if (unlikely(sg_policy->limits_changed)) {
++ sg_policy->limits_changed = false;
++ sg_policy->need_freq_update = true;
+ return true;
++ }
+
+ delta_ns = time - sg_policy->last_freq_update_time;
+
+@@ -405,7 +409,7 @@ static inline bool sugov_cpu_is_busy(struct sugov_cpu *sg_cpu) { return false; }
+ static inline void ignore_dl_rate_limit(struct sugov_cpu *sg_cpu, struct sugov_policy *sg_policy)
+ {
+ if (cpu_bw_dl(cpu_rq(sg_cpu->cpu)) > sg_cpu->bw_dl)
+- sg_policy->need_freq_update = true;
++ sg_policy->limits_changed = true;
+ }
+
+ static void sugov_update_single(struct update_util_data *hook, u64 time,
+@@ -425,7 +429,8 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
+ if (!sugov_should_update_freq(sg_policy, time))
+ return;
+
+- busy = sugov_cpu_is_busy(sg_cpu);
++ /* Limits may have changed, don't skip frequency update */
++ busy = !sg_policy->need_freq_update && sugov_cpu_is_busy(sg_cpu);
+
+ util = sugov_get_util(sg_cpu);
+ max = sg_cpu->max;
+@@ -798,6 +803,7 @@ static int sugov_start(struct cpufreq_policy *policy)
+ sg_policy->last_freq_update_time = 0;
+ sg_policy->next_freq = 0;
+ sg_policy->work_in_progress = false;
++ sg_policy->limits_changed = false;
+ sg_policy->need_freq_update = false;
+ sg_policy->cached_raw_freq = 0;
+
+@@ -849,7 +855,7 @@ static void sugov_limits(struct cpufreq_policy *policy)
+ mutex_unlock(&sg_policy->work_lock);
+ }
+
+- sg_policy->need_freq_update = true;
++ sg_policy->limits_changed = true;
+ }
+
+ static struct cpufreq_governor schedutil_gov = {
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index 6c94b6865ac2..5eeabece0c17 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -126,7 +126,7 @@
+ /* GFP bitmask for kmemleak internal allocations */
+ #define gfp_kmemleak_mask(gfp) (((gfp) & (GFP_KERNEL | GFP_ATOMIC)) | \
+ __GFP_NORETRY | __GFP_NOMEMALLOC | \
+- __GFP_NOWARN | __GFP_NOFAIL)
++ __GFP_NOWARN)
+
+ /* scanning area inside a memory block */
+ struct kmemleak_scan_area {
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 7e7cc0cd89fe..ecde75f2189b 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1037,26 +1037,45 @@ void mem_cgroup_iter_break(struct mem_cgroup *root,
+ css_put(&prev->css);
+ }
+
+-static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
++static void __invalidate_reclaim_iterators(struct mem_cgroup *from,
++ struct mem_cgroup *dead_memcg)
+ {
+- struct mem_cgroup *memcg = dead_memcg;
+ struct mem_cgroup_reclaim_iter *iter;
+ struct mem_cgroup_per_node *mz;
+ int nid;
+ int i;
+
+- for (; memcg; memcg = parent_mem_cgroup(memcg)) {
+- for_each_node(nid) {
+- mz = mem_cgroup_nodeinfo(memcg, nid);
+- for (i = 0; i <= DEF_PRIORITY; i++) {
+- iter = &mz->iter[i];
+- cmpxchg(&iter->position,
+- dead_memcg, NULL);
+- }
++ for_each_node(nid) {
++ mz = mem_cgroup_nodeinfo(from, nid);
++ for (i = 0; i <= DEF_PRIORITY; i++) {
++ iter = &mz->iter[i];
++ cmpxchg(&iter->position,
++ dead_memcg, NULL);
+ }
+ }
+ }
+
++static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
++{
++ struct mem_cgroup *memcg = dead_memcg;
++ struct mem_cgroup *last;
++
++ do {
++ __invalidate_reclaim_iterators(memcg, dead_memcg);
++ last = memcg;
++ } while ((memcg = parent_mem_cgroup(memcg)));
++
++ /*
++ * When cgruop1 non-hierarchy mode is used,
++ * parent_mem_cgroup() does not walk all the way up to the
++ * cgroup root (root_mem_cgroup). So we have to handle
++ * dead_memcg from cgroup root separately.
++ */
++ if (last != root_mem_cgroup)
++ __invalidate_reclaim_iterators(root_mem_cgroup,
++ dead_memcg);
++}
++
+ /**
+ * mem_cgroup_scan_tasks - iterate over tasks of a memory cgroup hierarchy
+ * @memcg: hierarchy root
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 62f945ea3e36..70298b635b59 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -403,7 +403,7 @@ static const struct mempolicy_operations mpol_ops[MPOL_MAX] = {
+ },
+ };
+
+-static void migrate_page_add(struct page *page, struct list_head *pagelist,
++static int migrate_page_add(struct page *page, struct list_head *pagelist,
+ unsigned long flags);
+
+ struct queue_pages {
+@@ -429,11 +429,14 @@ static inline bool queue_pages_required(struct page *page,
+ }
+
+ /*
+- * queue_pages_pmd() has three possible return values:
+- * 1 - pages are placed on the right node or queued successfully.
+- * 0 - THP was split.
+- * -EIO - is migration entry or MPOL_MF_STRICT was specified and an existing
+- * page was already on a node that does not follow the policy.
++ * queue_pages_pmd() has four possible return values:
++ * 0 - pages are placed on the right node or queued successfully.
++ * 1 - there is unmovable page, and MPOL_MF_MOVE* & MPOL_MF_STRICT were
++ * specified.
++ * 2 - THP was split.
++ * -EIO - is migration entry or only MPOL_MF_STRICT was specified and an
++ * existing page was already on a node that does not follow the
++ * policy.
+ */
+ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
+ unsigned long end, struct mm_walk *walk)
+@@ -451,23 +454,20 @@ static int queue_pages_pmd(pmd_t *pmd, spinlock_t *ptl, unsigned long addr,
+ if (is_huge_zero_page(page)) {
+ spin_unlock(ptl);
+ __split_huge_pmd(walk->vma, pmd, addr, false, NULL);
++ ret = 2;
+ goto out;
+ }
+- if (!queue_pages_required(page, qp)) {
+- ret = 1;
++ if (!queue_pages_required(page, qp))
+ goto unlock;
+- }
+
+- ret = 1;
+ flags = qp->flags;
+ /* go to thp migration */
+ if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
+- if (!vma_migratable(walk->vma)) {
+- ret = -EIO;
++ if (!vma_migratable(walk->vma) ||
++ migrate_page_add(page, qp->pagelist, flags)) {
++ ret = 1;
+ goto unlock;
+ }
+-
+- migrate_page_add(page, qp->pagelist, flags);
+ } else
+ ret = -EIO;
+ unlock:
+@@ -479,6 +479,13 @@ out:
+ /*
+ * Scan through pages checking if pages follow certain conditions,
+ * and move them to the pagelist if they do.
++ *
++ * queue_pages_pte_range() has three possible return values:
++ * 0 - pages are placed on the right node or queued successfully.
++ * 1 - there is unmovable page, and MPOL_MF_MOVE* & MPOL_MF_STRICT were
++ * specified.
++ * -EIO - only MPOL_MF_STRICT was specified and an existing page was already
++ * on a node that does not follow the policy.
+ */
+ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
+ unsigned long end, struct mm_walk *walk)
+@@ -488,17 +495,17 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
+ struct queue_pages *qp = walk->private;
+ unsigned long flags = qp->flags;
+ int ret;
++ bool has_unmovable = false;
+ pte_t *pte;
+ spinlock_t *ptl;
+
+ ptl = pmd_trans_huge_lock(pmd, vma);
+ if (ptl) {
+ ret = queue_pages_pmd(pmd, ptl, addr, end, walk);
+- if (ret > 0)
+- return 0;
+- else if (ret < 0)
++ if (ret != 2)
+ return ret;
+ }
++ /* THP was split, fall through to pte walk */
+
+ if (pmd_trans_unstable(pmd))
+ return 0;
+@@ -519,14 +526,28 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
+ if (!queue_pages_required(page, qp))
+ continue;
+ if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
+- if (!vma_migratable(vma))
++ /* MPOL_MF_STRICT must be specified if we get here */
++ if (!vma_migratable(vma)) {
++ has_unmovable = true;
+ break;
+- migrate_page_add(page, qp->pagelist, flags);
++ }
++
++ /*
++ * Do not abort immediately since there may be
++ * temporary off LRU pages in the range. Still
++ * need migrate other LRU pages.
++ */
++ if (migrate_page_add(page, qp->pagelist, flags))
++ has_unmovable = true;
+ } else
+ break;
+ }
+ pte_unmap_unlock(pte - 1, ptl);
+ cond_resched();
++
++ if (has_unmovable)
++ return 1;
++
+ return addr != end ? -EIO : 0;
+ }
+
+@@ -639,7 +660,13 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end,
+ *
+ * If pages found in a given range are on a set of nodes (determined by
+ * @nodes and @flags,) it's isolated and queued to the pagelist which is
+- * passed via @private.)
++ * passed via @private.
++ *
++ * queue_pages_range() has three possible return values:
++ * 1 - there is unmovable page, but MPOL_MF_MOVE* & MPOL_MF_STRICT were
++ * specified.
++ * 0 - queue pages successfully or no misplaced page.
++ * -EIO - there is misplaced page and only MPOL_MF_STRICT was specified.
+ */
+ static int
+ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
+@@ -926,7 +953,7 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask,
+ /*
+ * page migration, thp tail pages can be passed.
+ */
+-static void migrate_page_add(struct page *page, struct list_head *pagelist,
++static int migrate_page_add(struct page *page, struct list_head *pagelist,
+ unsigned long flags)
+ {
+ struct page *head = compound_head(page);
+@@ -939,8 +966,19 @@ static void migrate_page_add(struct page *page, struct list_head *pagelist,
+ mod_node_page_state(page_pgdat(head),
+ NR_ISOLATED_ANON + page_is_file_cache(head),
+ hpage_nr_pages(head));
++ } else if (flags & MPOL_MF_STRICT) {
++ /*
++ * Non-movable page may reach here. And, there may be
++ * temporary off LRU pages or non-LRU movable pages.
++ * Treat them as unmovable pages since they can't be
++ * isolated, so they can't be moved at the moment. It
++ * should return -EIO for this case too.
++ */
++ return -EIO;
+ }
+ }
++
++ return 0;
+ }
+
+ /* page allocation callback for NUMA node migration */
+@@ -1143,9 +1181,10 @@ static struct page *new_page(struct page *page, unsigned long start)
+ }
+ #else
+
+-static void migrate_page_add(struct page *page, struct list_head *pagelist,
++static int migrate_page_add(struct page *page, struct list_head *pagelist,
+ unsigned long flags)
+ {
++ return -EIO;
+ }
+
+ int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
+@@ -1168,6 +1207,7 @@ static long do_mbind(unsigned long start, unsigned long len,
+ struct mempolicy *new;
+ unsigned long end;
+ int err;
++ int ret;
+ LIST_HEAD(pagelist);
+
+ if (flags & ~(unsigned long)MPOL_MF_VALID)
+@@ -1229,10 +1269,15 @@ static long do_mbind(unsigned long start, unsigned long len,
+ if (err)
+ goto mpol_out;
+
+- err = queue_pages_range(mm, start, end, nmask,
++ ret = queue_pages_range(mm, start, end, nmask,
+ flags | MPOL_MF_INVERT, &pagelist);
+- if (!err)
+- err = mbind_range(mm, start, end, new);
++
++ if (ret < 0) {
++ err = -EIO;
++ goto up_out;
++ }
++
++ err = mbind_range(mm, start, end, new);
+
+ if (!err) {
+ int nr_failed = 0;
+@@ -1245,13 +1290,14 @@ static long do_mbind(unsigned long start, unsigned long len,
+ putback_movable_pages(&pagelist);
+ }
+
+- if (nr_failed && (flags & MPOL_MF_STRICT))
++ if ((ret > 0) || (nr_failed && (flags & MPOL_MF_STRICT)))
+ err = -EIO;
+ } else
+ putback_movable_pages(&pagelist);
+
++up_out:
+ up_write(&mm->mmap_sem);
+- mpol_out:
++mpol_out:
+ mpol_put(new);
+ return err;
+ }
+diff --git a/mm/rmap.c b/mm/rmap.c
+index f048c2651954..1bd94ea62f7f 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -1467,7 +1467,15 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
+ /*
+ * No need to invalidate here it will synchronize on
+ * against the special swap migration pte.
++ *
++ * The assignment to subpage above was computed from a
++ * swap PTE which results in an invalid pointer.
++ * Since only PAGE_SIZE pages can currently be
++ * migrated, just set it to page. This will need to be
++ * changed when hugepage migrations to device private
++ * memory are supported.
+ */
++ subpage = page;
+ goto discard;
+ }
+
+diff --git a/mm/usercopy.c b/mm/usercopy.c
+index 14faadcedd06..51411f9c4068 100644
+--- a/mm/usercopy.c
++++ b/mm/usercopy.c
+@@ -151,7 +151,7 @@ static inline void check_bogus_address(const unsigned long ptr, unsigned long n,
+ bool to_user)
+ {
+ /* Reject if object wraps past end of memory. */
+- if (ptr + n < ptr)
++ if (ptr + (n - 1) < ptr)
+ usercopy_abort("wrapped address", NULL, to_user, 0, ptr + n);
+
+ /* Reject if NULL or ZERO-allocation. */
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 0bb4d712b80c..995b3842ba7c 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -1779,20 +1779,28 @@ static int compat_calc_entry(const struct ebt_entry *e,
+ return 0;
+ }
+
++static int ebt_compat_init_offsets(unsigned int number)
++{
++ if (number > INT_MAX)
++ return -EINVAL;
++
++ /* also count the base chain policies */
++ number += NF_BR_NUMHOOKS;
++
++ return xt_compat_init_offsets(NFPROTO_BRIDGE, number);
++}
+
+ static int compat_table_info(const struct ebt_table_info *info,
+ struct compat_ebt_replace *newinfo)
+ {
+ unsigned int size = info->entries_size;
+ const void *entries = info->entries;
++ int ret;
+
+ newinfo->entries_size = size;
+- if (info->nentries) {
+- int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
+- info->nentries);
+- if (ret)
+- return ret;
+- }
++ ret = ebt_compat_init_offsets(info->nentries);
++ if (ret)
++ return ret;
+
+ return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
+ entries, newinfo);
+@@ -2241,11 +2249,9 @@ static int compat_do_replace(struct net *net, void __user *user,
+
+ xt_compat_lock(NFPROTO_BRIDGE);
+
+- if (tmp.nentries) {
+- ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
+- if (ret < 0)
+- goto out_unlock;
+- }
++ ret = ebt_compat_init_offsets(tmp.nentries);
++ if (ret < 0)
++ goto out_unlock;
+
+ ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
+ if (ret < 0)
+diff --git a/net/dsa/switch.c b/net/dsa/switch.c
+index 142b294d3446..b0b9413fa5bf 100644
+--- a/net/dsa/switch.c
++++ b/net/dsa/switch.c
+@@ -127,6 +127,9 @@ static void dsa_switch_mdb_add_bitmap(struct dsa_switch *ds,
+ {
+ int port;
+
++ if (!ds->ops->port_mdb_add)
++ return;
++
+ for_each_set_bit(port, bitmap, ds->num_ports)
+ ds->ops->port_mdb_add(ds, port, mdb);
+ }
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 27eff89fad01..c6073d17c324 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -431,13 +431,12 @@ EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
+ * table location, we assume id gets exposed to userspace.
+ *
+ * Following nf_conn items do not change throughout lifetime
+- * of the nf_conn after it has been committed to main hash table:
++ * of the nf_conn:
+ *
+ * 1. nf_conn address
+- * 2. nf_conn->ext address
+- * 3. nf_conn->master address (normally NULL)
+- * 4. tuple
+- * 5. the associated net namespace
++ * 2. nf_conn->master address (normally NULL)
++ * 3. the associated net namespace
++ * 4. the original direction tuple
+ */
+ u32 nf_ct_get_id(const struct nf_conn *ct)
+ {
+@@ -447,9 +446,10 @@ u32 nf_ct_get_id(const struct nf_conn *ct)
+ net_get_random_once(&ct_id_seed, sizeof(ct_id_seed));
+
+ a = (unsigned long)ct;
+- b = (unsigned long)ct->master ^ net_hash_mix(nf_ct_net(ct));
+- c = (unsigned long)ct->ext;
+- d = (unsigned long)siphash(&ct->tuplehash, sizeof(ct->tuplehash),
++ b = (unsigned long)ct->master;
++ c = (unsigned long)nf_ct_net(ct);
++ d = (unsigned long)siphash(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
++ sizeof(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple),
+ &ct_id_seed);
+ #ifdef CONFIG_64BIT
+ return siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &ct_id_seed);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 93b5a4200585..7204e7bbebb0 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2616,6 +2616,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+
+ mutex_lock(&po->pg_vec_lock);
+
++ /* packet_sendmsg() check on tx_ring.pg_vec was lockless,
++ * we need to confirm it under protection of pg_vec_lock.
++ */
++ if (unlikely(!po->tx_ring.pg_vec)) {
++ err = -EBUSY;
++ goto out;
++ }
+ if (likely(saddr == NULL)) {
+ dev = packet_cached_dev_get(po);
+ proto = po->num;
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 3131b4154c74..28adac31f0ff 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -561,7 +561,7 @@ static void sctp_do_8_2_transport_strike(struct sctp_cmd_seq *commands,
+ */
+ if (net->sctp.pf_enable &&
+ (transport->state == SCTP_ACTIVE) &&
+- (asoc->pf_retrans < transport->pathmaxrxt) &&
++ (transport->error_count < transport->pathmaxrxt) &&
+ (transport->error_count > asoc->pf_retrans)) {
+
+ sctp_assoc_control_transport(asoc, transport,
+diff --git a/net/sctp/stream.c b/net/sctp/stream.c
+index 0da57938a6c5..87061a4bb44b 100644
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -416,6 +416,7 @@ int sctp_send_reset_streams(struct sctp_association *asoc,
+ nstr_list[i] = htons(str_list[i]);
+
+ if (out && !sctp_stream_outq_is_empty(stream, str_nums, nstr_list)) {
++ kfree(nstr_list);
+ retval = -EAGAIN;
+ goto out;
+ }
+diff --git a/net/tipc/addr.c b/net/tipc/addr.c
+index b88d48d00913..0f1eaed1bd1b 100644
+--- a/net/tipc/addr.c
++++ b/net/tipc/addr.c
+@@ -75,6 +75,7 @@ void tipc_set_node_addr(struct net *net, u32 addr)
+ tipc_set_node_id(net, node_id);
+ }
+ tn->trial_addr = addr;
++ tn->addr_trial_end = jiffies;
+ pr_info("32-bit node address hash set to %x\n", addr);
+ }
+
+diff --git a/scripts/Kconfig.include b/scripts/Kconfig.include
+index dad5583451af..3b2861f47709 100644
+--- a/scripts/Kconfig.include
++++ b/scripts/Kconfig.include
+@@ -20,7 +20,7 @@ success = $(if-success,$(1),y,n)
+
+ # $(cc-option,<flag>)
+ # Return y if the compiler supports <flag>, n otherwise
+-cc-option = $(success,$(CC) -Werror $(1) -E -x c /dev/null -o /dev/null)
++cc-option = $(success,$(CC) -Werror $(CLANG_FLAGS) $(1) -E -x c /dev/null -o /dev/null)
+
+ # $(ld-option,<flag>)
+ # Return y if the linker supports <flag>, n otherwise
+diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
+index 7d4af0d0accb..51884c7b8069 100644
+--- a/scripts/Makefile.modpost
++++ b/scripts/Makefile.modpost
+@@ -75,7 +75,7 @@ modpost = scripts/mod/modpost \
+ $(if $(CONFIG_MODULE_SRCVERSION_ALL),-a,) \
+ $(if $(KBUILD_EXTMOD),-i,-o) $(kernelsymfile) \
+ $(if $(KBUILD_EXTMOD),-I $(modulesymfile)) \
+- $(if $(KBUILD_EXTRA_SYMBOLS), $(patsubst %, -e %,$(KBUILD_EXTRA_SYMBOLS))) \
++ $(if $(KBUILD_EXTMOD),$(addprefix -e ,$(KBUILD_EXTRA_SYMBOLS))) \
+ $(if $(KBUILD_EXTMOD),-o $(modulesymfile)) \
+ $(if $(CONFIG_DEBUG_SECTION_MISMATCH),,-S) \
+ $(if $(CONFIG_SECTION_MISMATCH_WARN_ONLY),,-E) \
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 579984ecdec3..bb2bd33b00ec 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -6033,6 +6033,24 @@ void snd_hda_gen_free(struct hda_codec *codec)
+ }
+ EXPORT_SYMBOL_GPL(snd_hda_gen_free);
+
++/**
++ * snd_hda_gen_reboot_notify - Make codec enter D3 before rebooting
++ * @codec: the HDA codec
++ *
++ * This can be put as patch_ops reboot_notify function.
++ */
++void snd_hda_gen_reboot_notify(struct hda_codec *codec)
++{
++ /* Make the codec enter D3 to avoid spurious noises from the internal
++ * speaker during (and after) reboot
++ */
++ snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
++ snd_hda_codec_write(codec, codec->core.afg, 0,
++ AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
++ msleep(10);
++}
++EXPORT_SYMBOL_GPL(snd_hda_gen_reboot_notify);
++
+ #ifdef CONFIG_PM
+ /**
+ * snd_hda_gen_check_power_status - check the loopback power save state
+@@ -6060,6 +6078,7 @@ static const struct hda_codec_ops generic_patch_ops = {
+ .init = snd_hda_gen_init,
+ .free = snd_hda_gen_free,
+ .unsol_event = snd_hda_jack_unsol_event,
++ .reboot_notify = snd_hda_gen_reboot_notify,
+ #ifdef CONFIG_PM
+ .check_power_status = snd_hda_gen_check_power_status,
+ #endif
+@@ -6082,7 +6101,7 @@ static int snd_hda_parse_generic_codec(struct hda_codec *codec)
+
+ err = snd_hda_parse_pin_defcfg(codec, &spec->autocfg, NULL, 0);
+ if (err < 0)
+- return err;
++ goto error;
+
+ err = snd_hda_gen_parse_auto_config(codec, &spec->autocfg);
+ if (err < 0)
+diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
+index 10123664fa61..ce9c293717b9 100644
+--- a/sound/pci/hda/hda_generic.h
++++ b/sound/pci/hda/hda_generic.h
+@@ -336,6 +336,7 @@ int snd_hda_gen_parse_auto_config(struct hda_codec *codec,
+ struct auto_pin_cfg *cfg);
+ int snd_hda_gen_build_controls(struct hda_codec *codec);
+ int snd_hda_gen_build_pcms(struct hda_codec *codec);
++void snd_hda_gen_reboot_notify(struct hda_codec *codec);
+
+ /* standard jack event callbacks */
+ void snd_hda_gen_hp_automute(struct hda_codec *codec,
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 81cea34aff1c..7a3e34b120b3 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2655,6 +2655,9 @@ static const struct pci_device_id azx_ids[] = {
+ /* AMD, X370 & co */
+ { PCI_DEVICE(0x1022, 0x1457),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
++ /* AMD, X570 & co */
++ { PCI_DEVICE(0x1022, 0x1487),
++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
+ /* AMD Stoney */
+ { PCI_DEVICE(0x1022, 0x157a),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index b70fbfa80546..6f17b256fcd0 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -176,23 +176,10 @@ static void cx_auto_reboot_notify(struct hda_codec *codec)
+ {
+ struct conexant_spec *spec = codec->spec;
+
+- switch (codec->core.vendor_id) {
+- case 0x14f12008: /* CX8200 */
+- case 0x14f150f2: /* CX20722 */
+- case 0x14f150f4: /* CX20724 */
+- break;
+- default:
+- return;
+- }
+-
+ /* Turn the problematic codec into D3 to avoid spurious noises
+ from the internal speaker during (and after) reboot */
+ cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, false);
+-
+- snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
+- snd_hda_codec_write(codec, codec->core.afg, 0,
+- AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
+- msleep(10);
++ snd_hda_gen_reboot_notify(codec);
+ }
+
+ static void cx_auto_free(struct hda_codec *codec)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index dc1989686f09..9b5caf099bfb 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -868,15 +868,6 @@ static void alc_reboot_notify(struct hda_codec *codec)
+ alc_shutup(codec);
+ }
+
+-/* power down codec to D3 at reboot/shutdown; set as reboot_notify ops */
+-static void alc_d3_at_reboot(struct hda_codec *codec)
+-{
+- snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
+- snd_hda_codec_write(codec, codec->core.afg, 0,
+- AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
+- msleep(10);
+-}
+-
+ #define alc_free snd_hda_gen_free
+
+ #ifdef CONFIG_PM
+@@ -5111,7 +5102,7 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
+ struct alc_spec *spec = codec->spec;
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+- spec->reboot_notify = alc_d3_at_reboot; /* reduce noise */
++ spec->reboot_notify = snd_hda_gen_reboot_notify; /* reduce noise */
+ spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+ codec->power_save_node = 0; /* avoid click noises */
+ snd_hda_apply_pincfgs(codec, pincfgs);
+@@ -6851,6 +6842,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
++ SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 7e1c6c2dc99e..4b3e1c48ca2f 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -83,6 +83,7 @@ struct mixer_build {
+ unsigned char *buffer;
+ unsigned int buflen;
+ DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS);
++ DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS);
+ struct usb_audio_term oterm;
+ const struct usbmix_name_map *map;
+ const struct usbmix_selector_map *selector_map;
+@@ -759,6 +760,8 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
+ return -EINVAL;
+ if (!desc->bNrInPins)
+ return -EINVAL;
++ if (desc->bLength < sizeof(*desc) + desc->bNrInPins)
++ return -EINVAL;
+
+ switch (state->mixer->protocol) {
+ case UAC_VERSION_1:
+@@ -788,16 +791,25 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
+ * parse the source unit recursively until it reaches to a terminal
+ * or a branched unit.
+ */
+-static int check_input_term(struct mixer_build *state, int id,
++static int __check_input_term(struct mixer_build *state, int id,
+ struct usb_audio_term *term)
+ {
+ int protocol = state->mixer->protocol;
+ int err;
+ void *p1;
++ unsigned char *hdr;
+
+ memset(term, 0, sizeof(*term));
+- while ((p1 = find_audio_control_unit(state, id)) != NULL) {
+- unsigned char *hdr = p1;
++ for (;;) {
++ /* a loop in the terminal chain? */
++ if (test_and_set_bit(id, state->termbitmap))
++ return -EINVAL;
++
++ p1 = find_audio_control_unit(state, id);
++ if (!p1)
++ break;
++
++ hdr = p1;
+ term->id = id;
+
+ if (protocol == UAC_VERSION_1 || protocol == UAC_VERSION_2) {
+@@ -815,7 +827,7 @@ static int check_input_term(struct mixer_build *state, int id,
+
+ /* call recursively to verify that the
+ * referenced clock entity is valid */
+- err = check_input_term(state, d->bCSourceID, term);
++ err = __check_input_term(state, d->bCSourceID, term);
+ if (err < 0)
+ return err;
+
+@@ -849,7 +861,7 @@ static int check_input_term(struct mixer_build *state, int id,
+ case UAC2_CLOCK_SELECTOR: {
+ struct uac_selector_unit_descriptor *d = p1;
+ /* call recursively to retrieve the channel info */
+- err = check_input_term(state, d->baSourceID[0], term);
++ err = __check_input_term(state, d->baSourceID[0], term);
+ if (err < 0)
+ return err;
+ term->type = UAC3_SELECTOR_UNIT << 16; /* virtual type */
+@@ -912,7 +924,7 @@ static int check_input_term(struct mixer_build *state, int id,
+
+ /* call recursively to verify that the
+ * referenced clock entity is valid */
+- err = check_input_term(state, d->bCSourceID, term);
++ err = __check_input_term(state, d->bCSourceID, term);
+ if (err < 0)
+ return err;
+
+@@ -963,7 +975,7 @@ static int check_input_term(struct mixer_build *state, int id,
+ case UAC3_CLOCK_SELECTOR: {
+ struct uac_selector_unit_descriptor *d = p1;
+ /* call recursively to retrieve the channel info */
+- err = check_input_term(state, d->baSourceID[0], term);
++ err = __check_input_term(state, d->baSourceID[0], term);
+ if (err < 0)
+ return err;
+ term->type = UAC3_SELECTOR_UNIT << 16; /* virtual type */
+@@ -979,7 +991,7 @@ static int check_input_term(struct mixer_build *state, int id,
+ return -EINVAL;
+
+ /* call recursively to retrieve the channel info */
+- err = check_input_term(state, d->baSourceID[0], term);
++ err = __check_input_term(state, d->baSourceID[0], term);
+ if (err < 0)
+ return err;
+
+@@ -997,6 +1009,15 @@ static int check_input_term(struct mixer_build *state, int id,
+ return -ENODEV;
+ }
+
++
++static int check_input_term(struct mixer_build *state, int id,
++ struct usb_audio_term *term)
++{
++ memset(term, 0, sizeof(*term));
++ memset(state->termbitmap, 0, sizeof(state->termbitmap));
++ return __check_input_term(state, id, term);
++}
++
+ /*
+ * Feature Unit
+ */
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index a94bd6850a0b..54c34c107cab 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -3285,6 +3285,13 @@ int perf_session__read_header(struct perf_session *session)
+ data->file.path);
+ }
+
++ if (f_header.attr_size == 0) {
++ pr_err("ERROR: The %s file's attr size field is 0 which is unexpected.\n"
++ "Was the 'perf record' command properly terminated?\n",
++ data->file.path);
++ return -EINVAL;
++ }
++
+ nr_attrs = f_header.attrs.size / f_header.attr_size;
+ lseek(fd, f_header.attrs.offset, SEEK_SET);
+
+@@ -3365,7 +3372,7 @@ int perf_event__synthesize_attr(struct perf_tool *tool,
+ size += sizeof(struct perf_event_header);
+ size += ids * sizeof(u64);
+
+- ev = malloc(size);
++ ev = zalloc(size);
+
+ if (ev == NULL)
+ return -ENOMEM;
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index 02bac8abd206..d982650deb33 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -338,6 +338,17 @@ int kvm_cpu_has_pending_timer(struct kvm_vcpu *vcpu)
+ void kvm_arch_vcpu_blocking(struct kvm_vcpu *vcpu)
+ {
+ kvm_timer_schedule(vcpu);
++ /*
++ * If we're about to block (most likely because we've just hit a
++ * WFI), we need to sync back the state of the GIC CPU interface
++ * so that we have the lastest PMR and group enables. This ensures
++ * that kvm_arch_vcpu_runnable has up-to-date data to decide
++ * whether we have pending interrupts.
++ */
++ preempt_disable();
++ kvm_vgic_vmcr_sync(vcpu);
++ preempt_enable();
++
+ kvm_vgic_v4_enable_doorbell(vcpu);
+ }
+
+diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
+index 69b892abd7dc..57281c1594d0 100644
+--- a/virt/kvm/arm/vgic/vgic-v2.c
++++ b/virt/kvm/arm/vgic/vgic-v2.c
+@@ -495,10 +495,17 @@ void vgic_v2_load(struct kvm_vcpu *vcpu)
+ kvm_vgic_global_state.vctrl_base + GICH_APR);
+ }
+
+-void vgic_v2_put(struct kvm_vcpu *vcpu)
++void vgic_v2_vmcr_sync(struct kvm_vcpu *vcpu)
+ {
+ struct vgic_v2_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v2;
+
+ cpu_if->vgic_vmcr = readl_relaxed(kvm_vgic_global_state.vctrl_base + GICH_VMCR);
++}
++
++void vgic_v2_put(struct kvm_vcpu *vcpu)
++{
++ struct vgic_v2_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v2;
++
++ vgic_v2_vmcr_sync(vcpu);
+ cpu_if->vgic_apr = readl_relaxed(kvm_vgic_global_state.vctrl_base + GICH_APR);
+ }
+diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
+index 3f2350a4d4ab..5c55995a1a16 100644
+--- a/virt/kvm/arm/vgic/vgic-v3.c
++++ b/virt/kvm/arm/vgic/vgic-v3.c
+@@ -674,12 +674,17 @@ void vgic_v3_load(struct kvm_vcpu *vcpu)
+ __vgic_v3_activate_traps(vcpu);
+ }
+
+-void vgic_v3_put(struct kvm_vcpu *vcpu)
++void vgic_v3_vmcr_sync(struct kvm_vcpu *vcpu)
+ {
+ struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
+
+ if (likely(cpu_if->vgic_sre))
+ cpu_if->vgic_vmcr = kvm_call_hyp(__vgic_v3_read_vmcr);
++}
++
++void vgic_v3_put(struct kvm_vcpu *vcpu)
++{
++ vgic_v3_vmcr_sync(vcpu);
+
+ kvm_call_hyp(__vgic_v3_save_aprs, vcpu);
+
+diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
+index c5165e3b80cb..250cd72c95a5 100644
+--- a/virt/kvm/arm/vgic/vgic.c
++++ b/virt/kvm/arm/vgic/vgic.c
+@@ -902,6 +902,17 @@ void kvm_vgic_put(struct kvm_vcpu *vcpu)
+ vgic_v3_put(vcpu);
+ }
+
++void kvm_vgic_vmcr_sync(struct kvm_vcpu *vcpu)
++{
++ if (unlikely(!irqchip_in_kernel(vcpu->kvm)))
++ return;
++
++ if (kvm_vgic_global_state.type == VGIC_V2)
++ vgic_v2_vmcr_sync(vcpu);
++ else
++ vgic_v3_vmcr_sync(vcpu);
++}
++
+ int kvm_vgic_vcpu_pending_irq(struct kvm_vcpu *vcpu)
+ {
+ struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
+diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
+index a90024718ca4..d5e454279925 100644
+--- a/virt/kvm/arm/vgic/vgic.h
++++ b/virt/kvm/arm/vgic/vgic.h
+@@ -204,6 +204,7 @@ int vgic_register_dist_iodev(struct kvm *kvm, gpa_t dist_base_address,
+ void vgic_v2_init_lrs(void);
+ void vgic_v2_load(struct kvm_vcpu *vcpu);
+ void vgic_v2_put(struct kvm_vcpu *vcpu);
++void vgic_v2_vmcr_sync(struct kvm_vcpu *vcpu);
+
+ void vgic_v2_save_state(struct kvm_vcpu *vcpu);
+ void vgic_v2_restore_state(struct kvm_vcpu *vcpu);
+@@ -234,6 +235,7 @@ bool vgic_v3_check_base(struct kvm *kvm);
+
+ void vgic_v3_load(struct kvm_vcpu *vcpu);
+ void vgic_v3_put(struct kvm_vcpu *vcpu);
++void vgic_v3_vmcr_sync(struct kvm_vcpu *vcpu);
+
+ bool vgic_has_its(struct kvm *kvm);
+ int kvm_vgic_register_its_device(void);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-08-29 14:15 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-08-29 14:15 UTC (permalink / raw
To: gentoo-commits
commit: e82b3f7e057ed2b8500c8faacd875f3dc7d43572
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 29 14:15:04 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Aug 29 14:15:04 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e82b3f7e
Linux patch 4.19.69
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1068_linux-4.19.69.patch | 4438 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4442 insertions(+)
diff --git a/0000_README b/0000_README
index dd97210..c203203 100644
--- a/0000_README
+++ b/0000_README
@@ -315,6 +315,10 @@ Patch: 1067_linux-4.19.68.patch
From: https://www.kernel.org
Desc: Linux 4.19.68
+Patch: 1068_linux-4.19.69.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.69
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1068_linux-4.19.69.patch b/1068_linux-4.19.69.patch
new file mode 100644
index 0000000..c959f94
--- /dev/null
+++ b/1068_linux-4.19.69.patch
@@ -0,0 +1,4438 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index c96a8e9ad5c2..e8ddf0ef232e 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -3948,6 +3948,13 @@
+ Run specified binary instead of /init from the ramdisk,
+ used for early userspace startup. See initrd.
+
++ rdrand= [X86]
++ force - Override the decision by the kernel to hide the
++ advertisement of RDRAND support (this affects
++ certain AMD processors because of buggy BIOS
++ support, specifically around the suspend/resume
++ path).
++
+ rdt= [HW,X86,RDT]
+ Turn on/off individual RDT features. List is:
+ cmt, mbmtotal, mbmlocal, l3cat, l3cdp, l2cat, l2cdp,
+diff --git a/Makefile b/Makefile
+index 6f164b04d953..677341239449 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 68
++SUBLEVEL = 69
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
+index fd6cde23bb5d..871fa50a09f1 100644
+--- a/arch/arm/kvm/coproc.c
++++ b/arch/arm/kvm/coproc.c
+@@ -658,13 +658,22 @@ int kvm_handle_cp14_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
+ }
+
+ static void reset_coproc_regs(struct kvm_vcpu *vcpu,
+- const struct coproc_reg *table, size_t num)
++ const struct coproc_reg *table, size_t num,
++ unsigned long *bmap)
+ {
+ unsigned long i;
+
+ for (i = 0; i < num; i++)
+- if (table[i].reset)
++ if (table[i].reset) {
++ int reg = table[i].reg;
++
+ table[i].reset(vcpu, &table[i]);
++ if (reg > 0 && reg < NR_CP15_REGS) {
++ set_bit(reg, bmap);
++ if (table[i].is_64bit)
++ set_bit(reg + 1, bmap);
++ }
++ }
+ }
+
+ static struct coproc_params decode_32bit_hsr(struct kvm_vcpu *vcpu)
+@@ -1439,17 +1448,15 @@ void kvm_reset_coprocs(struct kvm_vcpu *vcpu)
+ {
+ size_t num;
+ const struct coproc_reg *table;
+-
+- /* Catch someone adding a register without putting in reset entry. */
+- memset(vcpu->arch.ctxt.cp15, 0x42, sizeof(vcpu->arch.ctxt.cp15));
++ DECLARE_BITMAP(bmap, NR_CP15_REGS) = { 0, };
+
+ /* Generic chip reset first (so target could override). */
+- reset_coproc_regs(vcpu, cp15_regs, ARRAY_SIZE(cp15_regs));
++ reset_coproc_regs(vcpu, cp15_regs, ARRAY_SIZE(cp15_regs), bmap);
+
+ table = get_target_table(vcpu->arch.target, &num);
+- reset_coproc_regs(vcpu, table, num);
++ reset_coproc_regs(vcpu, table, num, bmap);
+
+ for (num = 1; num < NR_CP15_REGS; num++)
+- WARN(vcpu_cp15(vcpu, num) == 0x42424242,
++ WARN(!test_bit(num, bmap),
+ "Didn't reset vcpu_cp15(vcpu, %zi)", num);
+ }
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+index d112af75680b..6da2bbdb9648 100644
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -626,7 +626,7 @@ static void reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
+ */
+ val = ((pmcr & ~ARMV8_PMU_PMCR_MASK)
+ | (ARMV8_PMU_PMCR_MASK & 0xdecafbad)) & (~ARMV8_PMU_PMCR_E);
+- __vcpu_sys_reg(vcpu, PMCR_EL0) = val;
++ __vcpu_sys_reg(vcpu, r->reg) = val;
+ }
+
+ static bool check_pmu_access_disabled(struct kvm_vcpu *vcpu, u64 flags)
+@@ -968,13 +968,13 @@ static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
+ /* Silly macro to expand the DBG{BCR,BVR,WVR,WCR}n_EL1 registers in one go */
+ #define DBG_BCR_BVR_WCR_WVR_EL1(n) \
+ { SYS_DESC(SYS_DBGBVRn_EL1(n)), \
+- trap_bvr, reset_bvr, n, 0, get_bvr, set_bvr }, \
++ trap_bvr, reset_bvr, 0, 0, get_bvr, set_bvr }, \
+ { SYS_DESC(SYS_DBGBCRn_EL1(n)), \
+- trap_bcr, reset_bcr, n, 0, get_bcr, set_bcr }, \
++ trap_bcr, reset_bcr, 0, 0, get_bcr, set_bcr }, \
+ { SYS_DESC(SYS_DBGWVRn_EL1(n)), \
+- trap_wvr, reset_wvr, n, 0, get_wvr, set_wvr }, \
++ trap_wvr, reset_wvr, 0, 0, get_wvr, set_wvr }, \
+ { SYS_DESC(SYS_DBGWCRn_EL1(n)), \
+- trap_wcr, reset_wcr, n, 0, get_wcr, set_wcr }
++ trap_wcr, reset_wcr, 0, 0, get_wcr, set_wcr }
+
+ /* Macro to expand the PMEVCNTRn_EL0 register */
+ #define PMU_PMEVCNTR_EL0(n) \
+@@ -1359,7 +1359,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
+
+ { SYS_DESC(SYS_CSSELR_EL1), NULL, reset_unknown, CSSELR_EL1 },
+
+- { SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, },
++ { SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, PMCR_EL0 },
+ { SYS_DESC(SYS_PMCNTENSET_EL0), access_pmcnten, reset_unknown, PMCNTENSET_EL0 },
+ { SYS_DESC(SYS_PMCNTENCLR_EL0), access_pmcnten, NULL, PMCNTENSET_EL0 },
+ { SYS_DESC(SYS_PMOVSCLR_EL0), access_pmovs, NULL, PMOVSSET_EL0 },
+@@ -2072,13 +2072,19 @@ static int emulate_sys_reg(struct kvm_vcpu *vcpu,
+ }
+
+ static void reset_sys_reg_descs(struct kvm_vcpu *vcpu,
+- const struct sys_reg_desc *table, size_t num)
++ const struct sys_reg_desc *table, size_t num,
++ unsigned long *bmap)
+ {
+ unsigned long i;
+
+ for (i = 0; i < num; i++)
+- if (table[i].reset)
++ if (table[i].reset) {
++ int reg = table[i].reg;
++
+ table[i].reset(vcpu, &table[i]);
++ if (reg > 0 && reg < NR_SYS_REGS)
++ set_bit(reg, bmap);
++ }
+ }
+
+ /**
+@@ -2576,18 +2582,16 @@ void kvm_reset_sys_regs(struct kvm_vcpu *vcpu)
+ {
+ size_t num;
+ const struct sys_reg_desc *table;
+-
+- /* Catch someone adding a register without putting in reset entry. */
+- memset(&vcpu->arch.ctxt.sys_regs, 0x42, sizeof(vcpu->arch.ctxt.sys_regs));
++ DECLARE_BITMAP(bmap, NR_SYS_REGS) = { 0, };
+
+ /* Generic chip reset first (so target could override). */
+- reset_sys_reg_descs(vcpu, sys_reg_descs, ARRAY_SIZE(sys_reg_descs));
++ reset_sys_reg_descs(vcpu, sys_reg_descs, ARRAY_SIZE(sys_reg_descs), bmap);
+
+ table = get_target_table(vcpu->arch.target, true, &num);
+- reset_sys_reg_descs(vcpu, table, num);
++ reset_sys_reg_descs(vcpu, table, num, bmap);
+
+ for (num = 1; num < NR_SYS_REGS; num++) {
+- if (WARN(__vcpu_sys_reg(vcpu, num) == 0x4242424242424242,
++ if (WARN(!test_bit(num, bmap),
+ "Didn't reset __vcpu_sys_reg(%zi)\n", num))
+ break;
+ }
+diff --git a/arch/mips/kernel/cacheinfo.c b/arch/mips/kernel/cacheinfo.c
+index 97d5239ca47b..428ef2189203 100644
+--- a/arch/mips/kernel/cacheinfo.c
++++ b/arch/mips/kernel/cacheinfo.c
+@@ -80,6 +80,8 @@ static int __populate_cache_leaves(unsigned int cpu)
+ if (c->tcache.waysize)
+ populate_cache(tcache, this_leaf, 3, CACHE_TYPE_UNIFIED);
+
++ this_cpu_ci->cpu_map_populated = true;
++
+ return 0;
+ }
+
+diff --git a/arch/mips/kernel/i8253.c b/arch/mips/kernel/i8253.c
+index 5f209f111e59..df7ddd246eaa 100644
+--- a/arch/mips/kernel/i8253.c
++++ b/arch/mips/kernel/i8253.c
+@@ -32,7 +32,8 @@ void __init setup_pit_timer(void)
+
+ static int __init init_pit_clocksource(void)
+ {
+- if (num_possible_cpus() > 1) /* PIT does not scale! */
++ if (num_possible_cpus() > 1 || /* PIT does not scale! */
++ !clockevent_state_periodic(&i8253_clockevent))
+ return 0;
+
+ return clocksource_i8253_init();
+diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
+index 262ba9481781..1bf6aaefd26a 100644
+--- a/arch/powerpc/kernel/misc_64.S
++++ b/arch/powerpc/kernel/misc_64.S
+@@ -135,7 +135,7 @@ _GLOBAL_TOC(flush_dcache_range)
+ subf r8,r6,r4 /* compute length */
+ add r8,r8,r5 /* ensure we get enough */
+ lwz r9,DCACHEL1LOGBLOCKSIZE(r10) /* Get log-2 of dcache block size */
+- srw. r8,r8,r9 /* compute line count */
++ srd. r8,r8,r9 /* compute line count */
+ beqlr /* nothing to do? */
+ mtctr r8
+ 0: dcbst 0,r6
+@@ -153,7 +153,7 @@ _GLOBAL(flush_inval_dcache_range)
+ subf r8,r6,r4 /* compute length */
+ add r8,r8,r5 /* ensure we get enough */
+ lwz r9,DCACHEL1LOGBLOCKSIZE(r10)/* Get log-2 of dcache block size */
+- srw. r8,r8,r9 /* compute line count */
++ srd. r8,r8,r9 /* compute line count */
+ beqlr /* nothing to do? */
+ sync
+ isync
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index b43f8d33a369..18ede6e806b9 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -31,10 +31,9 @@ PHDRS {
+ SECTIONS
+ {
+ . = 0x100000;
+- _stext = .; /* Start of text section */
+ .text : {
+- /* Text and read-only data */
+- _text = .;
++ _stext = .; /* Start of text section */
++ _text = .; /* Text and read-only data */
+ HEAD_TEXT
+ TEXT_TEXT
+ SCHED_TEXT
+@@ -46,11 +45,10 @@ SECTIONS
+ *(.text.*_indirect_*)
+ *(.fixup)
+ *(.gnu.warning)
++ . = ALIGN(PAGE_SIZE);
++ _etext = .; /* End of text section */
+ } :text = 0x0700
+
+- . = ALIGN(PAGE_SIZE);
+- _etext = .; /* End of text section */
+-
+ NOTES :text :note
+
+ .dummy : { *(.dummy) } :data
+diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h
+index a07ffd23e4dd..d3983fdf1012 100644
+--- a/arch/x86/include/asm/bootparam_utils.h
++++ b/arch/x86/include/asm/bootparam_utils.h
+@@ -18,6 +18,20 @@
+ * Note: efi_info is commonly left uninitialized, but that field has a
+ * private magic, so it is better to leave it unchanged.
+ */
++
++#define sizeof_mbr(type, member) ({ sizeof(((type *)0)->member); })
++
++#define BOOT_PARAM_PRESERVE(struct_member) \
++ { \
++ .start = offsetof(struct boot_params, struct_member), \
++ .len = sizeof_mbr(struct boot_params, struct_member), \
++ }
++
++struct boot_params_to_save {
++ unsigned int start;
++ unsigned int len;
++};
++
+ static void sanitize_boot_params(struct boot_params *boot_params)
+ {
+ /*
+@@ -36,19 +50,40 @@ static void sanitize_boot_params(struct boot_params *boot_params)
+ */
+ if (boot_params->sentinel) {
+ /* fields in boot_params are left uninitialized, clear them */
+- memset(&boot_params->ext_ramdisk_image, 0,
+- (char *)&boot_params->efi_info -
+- (char *)&boot_params->ext_ramdisk_image);
+- memset(&boot_params->kbd_status, 0,
+- (char *)&boot_params->hdr -
+- (char *)&boot_params->kbd_status);
+- memset(&boot_params->_pad7[0], 0,
+- (char *)&boot_params->edd_mbr_sig_buffer[0] -
+- (char *)&boot_params->_pad7[0]);
+- memset(&boot_params->_pad8[0], 0,
+- (char *)&boot_params->eddbuf[0] -
+- (char *)&boot_params->_pad8[0]);
+- memset(&boot_params->_pad9[0], 0, sizeof(boot_params->_pad9));
++ static struct boot_params scratch;
++ char *bp_base = (char *)boot_params;
++ char *save_base = (char *)&scratch;
++ int i;
++
++ const struct boot_params_to_save to_save[] = {
++ BOOT_PARAM_PRESERVE(screen_info),
++ BOOT_PARAM_PRESERVE(apm_bios_info),
++ BOOT_PARAM_PRESERVE(tboot_addr),
++ BOOT_PARAM_PRESERVE(ist_info),
++ BOOT_PARAM_PRESERVE(hd0_info),
++ BOOT_PARAM_PRESERVE(hd1_info),
++ BOOT_PARAM_PRESERVE(sys_desc_table),
++ BOOT_PARAM_PRESERVE(olpc_ofw_header),
++ BOOT_PARAM_PRESERVE(efi_info),
++ BOOT_PARAM_PRESERVE(alt_mem_k),
++ BOOT_PARAM_PRESERVE(scratch),
++ BOOT_PARAM_PRESERVE(e820_entries),
++ BOOT_PARAM_PRESERVE(eddbuf_entries),
++ BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries),
++ BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer),
++ BOOT_PARAM_PRESERVE(hdr),
++ BOOT_PARAM_PRESERVE(e820_table),
++ BOOT_PARAM_PRESERVE(eddbuf),
++ };
++
++ memset(&scratch, 0, sizeof(scratch));
++
++ for (i = 0; i < ARRAY_SIZE(to_save); i++) {
++ memcpy(save_base + to_save[i].start,
++ bp_base + to_save[i].start, to_save[i].len);
++ }
++
++ memcpy(boot_params, save_base, sizeof(*boot_params));
+ }
+ }
+
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index f85f43db9225..a1d22e4428f6 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -334,6 +334,7 @@
+ #define MSR_AMD64_PATCH_LEVEL 0x0000008b
+ #define MSR_AMD64_TSC_RATIO 0xc0000104
+ #define MSR_AMD64_NB_CFG 0xc001001f
++#define MSR_AMD64_CPUID_FN_1 0xc0011004
+ #define MSR_AMD64_PATCH_LOADER 0xc0010020
+ #define MSR_AMD64_OSVW_ID_LENGTH 0xc0010140
+ #define MSR_AMD64_OSVW_STATUS 0xc0010141
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 599c273f5d00..28cb2b31527a 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -202,7 +202,7 @@
+ " lfence;\n" \
+ " jmp 902b;\n" \
+ " .align 16\n" \
+- "903: addl $4, %%esp;\n" \
++ "903: lea 4(%%esp), %%esp;\n" \
+ " pushl %[thunk_target];\n" \
+ " ret;\n" \
+ " .align 16\n" \
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 272a12865b2a..b316bd61a6ac 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -715,7 +715,7 @@ static __initdata unsigned long lapic_cal_pm1, lapic_cal_pm2;
+ static __initdata unsigned long lapic_cal_j1, lapic_cal_j2;
+
+ /*
+- * Temporary interrupt handler.
++ * Temporary interrupt handler and polled calibration function.
+ */
+ static void __init lapic_cal_handler(struct clock_event_device *dev)
+ {
+@@ -799,7 +799,8 @@ calibrate_by_pmtimer(long deltapm, long *delta, long *deltatsc)
+ static int __init calibrate_APIC_clock(void)
+ {
+ struct clock_event_device *levt = this_cpu_ptr(&lapic_events);
+- void (*real_handler)(struct clock_event_device *dev);
++ u64 tsc_perj = 0, tsc_start = 0;
++ unsigned long jif_start;
+ unsigned long deltaj;
+ long delta, deltatsc;
+ int pm_referenced = 0;
+@@ -830,28 +831,64 @@ static int __init calibrate_APIC_clock(void)
+ apic_printk(APIC_VERBOSE, "Using local APIC timer interrupts.\n"
+ "calibrating APIC timer ...\n");
+
++ /*
++ * There are platforms w/o global clockevent devices. Instead of
++ * making the calibration conditional on that, use a polling based
++ * approach everywhere.
++ */
+ local_irq_disable();
+
+- /* Replace the global interrupt handler */
+- real_handler = global_clock_event->event_handler;
+- global_clock_event->event_handler = lapic_cal_handler;
+-
+ /*
+ * Setup the APIC counter to maximum. There is no way the lapic
+ * can underflow in the 100ms detection time frame
+ */
+ __setup_APIC_LVTT(0xffffffff, 0, 0);
+
+- /* Let the interrupts run */
++ /*
++ * Methods to terminate the calibration loop:
++ * 1) Global clockevent if available (jiffies)
++ * 2) TSC if available and frequency is known
++ */
++ jif_start = READ_ONCE(jiffies);
++
++ if (tsc_khz) {
++ tsc_start = rdtsc();
++ tsc_perj = div_u64((u64)tsc_khz * 1000, HZ);
++ }
++
++ /*
++ * Enable interrupts so the tick can fire, if a global
++ * clockevent device is available
++ */
+ local_irq_enable();
+
+- while (lapic_cal_loops <= LAPIC_CAL_LOOPS)
+- cpu_relax();
++ while (lapic_cal_loops <= LAPIC_CAL_LOOPS) {
++ /* Wait for a tick to elapse */
++ while (1) {
++ if (tsc_khz) {
++ u64 tsc_now = rdtsc();
++ if ((tsc_now - tsc_start) >= tsc_perj) {
++ tsc_start += tsc_perj;
++ break;
++ }
++ } else {
++ unsigned long jif_now = READ_ONCE(jiffies);
+
+- local_irq_disable();
++ if (time_after(jif_now, jif_start)) {
++ jif_start = jif_now;
++ break;
++ }
++ }
++ cpu_relax();
++ }
+
+- /* Restore the real event handler */
+- global_clock_event->event_handler = real_handler;
++ /* Invoke the calibration routine */
++ local_irq_disable();
++ lapic_cal_handler(NULL);
++ local_irq_enable();
++ }
++
++ local_irq_disable();
+
+ /* Build delta t1-t2 as apic timer counts down */
+ delta = lapic_cal_t1 - lapic_cal_t2;
+@@ -904,10 +941,11 @@ static int __init calibrate_APIC_clock(void)
+ levt->features &= ~CLOCK_EVT_FEAT_DUMMY;
+
+ /*
+- * PM timer calibration failed or not turned on
+- * so lets try APIC timer based calibration
++ * PM timer calibration failed or not turned on so lets try APIC
++ * timer based calibration, if a global clockevent device is
++ * available.
+ */
+- if (!pm_referenced) {
++ if (!pm_referenced && global_clock_event) {
+ apic_printk(APIC_VERBOSE, "... verify APIC timer\n");
+
+ /*
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index da1f5e78363e..f86f912ce215 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -799,6 +799,64 @@ static void init_amd_ln(struct cpuinfo_x86 *c)
+ msr_set_bit(MSR_AMD64_DE_CFG, 31);
+ }
+
++static bool rdrand_force;
++
++static int __init rdrand_cmdline(char *str)
++{
++ if (!str)
++ return -EINVAL;
++
++ if (!strcmp(str, "force"))
++ rdrand_force = true;
++ else
++ return -EINVAL;
++
++ return 0;
++}
++early_param("rdrand", rdrand_cmdline);
++
++static void clear_rdrand_cpuid_bit(struct cpuinfo_x86 *c)
++{
++ /*
++ * Saving of the MSR used to hide the RDRAND support during
++ * suspend/resume is done by arch/x86/power/cpu.c, which is
++ * dependent on CONFIG_PM_SLEEP.
++ */
++ if (!IS_ENABLED(CONFIG_PM_SLEEP))
++ return;
++
++ /*
++ * The nordrand option can clear X86_FEATURE_RDRAND, so check for
++ * RDRAND support using the CPUID function directly.
++ */
++ if (!(cpuid_ecx(1) & BIT(30)) || rdrand_force)
++ return;
++
++ msr_clear_bit(MSR_AMD64_CPUID_FN_1, 62);
++
++ /*
++ * Verify that the CPUID change has occurred in case the kernel is
++ * running virtualized and the hypervisor doesn't support the MSR.
++ */
++ if (cpuid_ecx(1) & BIT(30)) {
++ pr_info_once("BIOS may not properly restore RDRAND after suspend, but hypervisor does not support hiding RDRAND via CPUID.\n");
++ return;
++ }
++
++ clear_cpu_cap(c, X86_FEATURE_RDRAND);
++ pr_info_once("BIOS may not properly restore RDRAND after suspend, hiding RDRAND via CPUID. Use rdrand=force to reenable.\n");
++}
++
++static void init_amd_jg(struct cpuinfo_x86 *c)
++{
++ /*
++ * Some BIOS implementations do not restore proper RDRAND support
++ * across suspend and resume. Check on whether to hide the RDRAND
++ * instruction support via CPUID.
++ */
++ clear_rdrand_cpuid_bit(c);
++}
++
+ static void init_amd_bd(struct cpuinfo_x86 *c)
+ {
+ u64 value;
+@@ -813,6 +871,13 @@ static void init_amd_bd(struct cpuinfo_x86 *c)
+ wrmsrl_safe(MSR_F15H_IC_CFG, value);
+ }
+ }
++
++ /*
++ * Some BIOS implementations do not restore proper RDRAND support
++ * across suspend and resume. Check on whether to hide the RDRAND
++ * instruction support via CPUID.
++ */
++ clear_rdrand_cpuid_bit(c);
+ }
+
+ static void init_amd_zn(struct cpuinfo_x86 *c)
+@@ -855,6 +920,7 @@ static void init_amd(struct cpuinfo_x86 *c)
+ case 0x10: init_amd_gh(c); break;
+ case 0x12: init_amd_ln(c); break;
+ case 0x15: init_amd_bd(c); break;
++ case 0x16: init_amd_jg(c); break;
+ case 0x17: init_amd_zn(c); break;
+ }
+
+diff --git a/arch/x86/lib/cpu.c b/arch/x86/lib/cpu.c
+index 2dd1fe13a37b..19f707992db2 100644
+--- a/arch/x86/lib/cpu.c
++++ b/arch/x86/lib/cpu.c
+@@ -1,5 +1,6 @@
+ #include <linux/types.h>
+ #include <linux/export.h>
++#include <asm/cpu.h>
+
+ unsigned int x86_family(unsigned int sig)
+ {
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index 513ce09e9950..3aa3149df07f 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -13,6 +13,7 @@
+ #include <linux/smp.h>
+ #include <linux/perf_event.h>
+ #include <linux/tboot.h>
++#include <linux/dmi.h>
+
+ #include <asm/pgtable.h>
+ #include <asm/proto.h>
+@@ -24,7 +25,7 @@
+ #include <asm/debugreg.h>
+ #include <asm/cpu.h>
+ #include <asm/mmu_context.h>
+-#include <linux/dmi.h>
++#include <asm/cpu_device_id.h>
+
+ #ifdef CONFIG_X86_32
+ __visible unsigned long saved_context_ebx;
+@@ -398,15 +399,14 @@ static int __init bsp_pm_check_init(void)
+
+ core_initcall(bsp_pm_check_init);
+
+-static int msr_init_context(const u32 *msr_id, const int total_num)
++static int msr_build_context(const u32 *msr_id, const int num)
+ {
+- int i = 0;
++ struct saved_msrs *saved_msrs = &saved_context.saved_msrs;
+ struct saved_msr *msr_array;
++ int total_num;
++ int i, j;
+
+- if (saved_context.saved_msrs.array || saved_context.saved_msrs.num > 0) {
+- pr_err("x86/pm: MSR quirk already applied, please check your DMI match table.\n");
+- return -EINVAL;
+- }
++ total_num = saved_msrs->num + num;
+
+ msr_array = kmalloc_array(total_num, sizeof(struct saved_msr), GFP_KERNEL);
+ if (!msr_array) {
+@@ -414,19 +414,30 @@ static int msr_init_context(const u32 *msr_id, const int total_num)
+ return -ENOMEM;
+ }
+
+- for (i = 0; i < total_num; i++) {
+- msr_array[i].info.msr_no = msr_id[i];
++ if (saved_msrs->array) {
++ /*
++ * Multiple callbacks can invoke this function, so copy any
++ * MSR save requests from previous invocations.
++ */
++ memcpy(msr_array, saved_msrs->array,
++ sizeof(struct saved_msr) * saved_msrs->num);
++
++ kfree(saved_msrs->array);
++ }
++
++ for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) {
++ msr_array[i].info.msr_no = msr_id[j];
+ msr_array[i].valid = false;
+ msr_array[i].info.reg.q = 0;
+ }
+- saved_context.saved_msrs.num = total_num;
+- saved_context.saved_msrs.array = msr_array;
++ saved_msrs->num = total_num;
++ saved_msrs->array = msr_array;
+
+ return 0;
+ }
+
+ /*
+- * The following section is a quirk framework for problematic BIOSen:
++ * The following sections are a quirk framework for problematic BIOSen:
+ * Sometimes MSRs are modified by the BIOSen after suspended to
+ * RAM, this might cause unexpected behavior after wakeup.
+ * Thus we save/restore these specified MSRs across suspend/resume
+@@ -441,7 +452,7 @@ static int msr_initialize_bdw(const struct dmi_system_id *d)
+ u32 bdw_msr_id[] = { MSR_IA32_THERM_CONTROL };
+
+ pr_info("x86/pm: %s detected, MSR saving is needed during suspending.\n", d->ident);
+- return msr_init_context(bdw_msr_id, ARRAY_SIZE(bdw_msr_id));
++ return msr_build_context(bdw_msr_id, ARRAY_SIZE(bdw_msr_id));
+ }
+
+ static const struct dmi_system_id msr_save_dmi_table[] = {
+@@ -456,9 +467,58 @@ static const struct dmi_system_id msr_save_dmi_table[] = {
+ {}
+ };
+
++static int msr_save_cpuid_features(const struct x86_cpu_id *c)
++{
++ u32 cpuid_msr_id[] = {
++ MSR_AMD64_CPUID_FN_1,
++ };
++
++ pr_info("x86/pm: family %#hx cpu detected, MSR saving is needed during suspending.\n",
++ c->family);
++
++ return msr_build_context(cpuid_msr_id, ARRAY_SIZE(cpuid_msr_id));
++}
++
++static const struct x86_cpu_id msr_save_cpu_table[] = {
++ {
++ .vendor = X86_VENDOR_AMD,
++ .family = 0x15,
++ .model = X86_MODEL_ANY,
++ .feature = X86_FEATURE_ANY,
++ .driver_data = (kernel_ulong_t)msr_save_cpuid_features,
++ },
++ {
++ .vendor = X86_VENDOR_AMD,
++ .family = 0x16,
++ .model = X86_MODEL_ANY,
++ .feature = X86_FEATURE_ANY,
++ .driver_data = (kernel_ulong_t)msr_save_cpuid_features,
++ },
++ {}
++};
++
++typedef int (*pm_cpu_match_t)(const struct x86_cpu_id *);
++static int pm_cpu_check(const struct x86_cpu_id *c)
++{
++ const struct x86_cpu_id *m;
++ int ret = 0;
++
++ m = x86_match_cpu(msr_save_cpu_table);
++ if (m) {
++ pm_cpu_match_t fn;
++
++ fn = (pm_cpu_match_t)m->driver_data;
++ ret = fn(m);
++ }
++
++ return ret;
++}
++
+ static int pm_check_save_msr(void)
+ {
+ dmi_check_system(msr_save_dmi_table);
++ pm_cpu_check(msr_save_cpu_table);
++
+ return 0;
+ }
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index becd793a258c..d8d2ac294b0c 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -1886,9 +1886,14 @@ static void bfq_request_merged(struct request_queue *q, struct request *req,
+ blk_rq_pos(container_of(rb_prev(&req->rb_node),
+ struct request, rb_node))) {
+ struct bfq_queue *bfqq = bfq_init_rq(req);
+- struct bfq_data *bfqd = bfqq->bfqd;
++ struct bfq_data *bfqd;
+ struct request *prev, *next_rq;
+
++ if (!bfqq)
++ return;
++
++ bfqd = bfqq->bfqd;
++
+ /* Reposition request in its sort_list */
+ elv_rb_del(&bfqq->sort_list, req);
+ elv_rb_add(&bfqq->sort_list, req);
+@@ -1930,6 +1935,9 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq,
+ struct bfq_queue *bfqq = bfq_init_rq(rq),
+ *next_bfqq = bfq_init_rq(next);
+
++ if (!bfqq)
++ return;
++
+ /*
+ * If next and rq belong to the same bfq_queue and next is older
+ * than rq, then reposition rq in the fifo (by substituting next
+@@ -4590,12 +4598,12 @@ static void bfq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
+
+ spin_lock_irq(&bfqd->lock);
+ bfqq = bfq_init_rq(rq);
+- if (at_head || blk_rq_is_passthrough(rq)) {
++ if (!bfqq || at_head || blk_rq_is_passthrough(rq)) {
+ if (at_head)
+ list_add(&rq->queuelist, &bfqd->dispatch);
+ else
+ list_add_tail(&rq->queuelist, &bfqd->dispatch);
+- } else { /* bfqq is assumed to be non null here */
++ } else {
+ idle_timer_disabled = __bfq_insert_request(bfqd, rq);
+ /*
+ * Update bfqq, because, if a queue merge has occurred
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 1984fc78c750..3a64fa4aaf7e 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -1803,6 +1803,21 @@ nothing_to_do:
+ return 1;
+ }
+
++static bool ata_check_nblocks(struct scsi_cmnd *scmd, u32 n_blocks)
++{
++ struct request *rq = scmd->request;
++ u32 req_blocks;
++
++ if (!blk_rq_is_passthrough(rq))
++ return true;
++
++ req_blocks = blk_rq_bytes(rq) / scmd->device->sector_size;
++ if (n_blocks > req_blocks)
++ return false;
++
++ return true;
++}
++
+ /**
+ * ata_scsi_rw_xlat - Translate SCSI r/w command into an ATA one
+ * @qc: Storage for translated ATA taskfile
+@@ -1847,6 +1862,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ scsi_10_lba_len(cdb, &block, &n_block);
+ if (cdb[1] & (1 << 3))
+ tf_flags |= ATA_TFLAG_FUA;
++ if (!ata_check_nblocks(scmd, n_block))
++ goto invalid_fld;
+ break;
+ case READ_6:
+ case WRITE_6:
+@@ -1861,6 +1878,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ */
+ if (!n_block)
+ n_block = 256;
++ if (!ata_check_nblocks(scmd, n_block))
++ goto invalid_fld;
+ break;
+ case READ_16:
+ case WRITE_16:
+@@ -1871,6 +1890,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ scsi_16_lba_len(cdb, &block, &n_block);
+ if (cdb[1] & (1 << 3))
+ tf_flags |= ATA_TFLAG_FUA;
++ if (!ata_check_nblocks(scmd, n_block))
++ goto invalid_fld;
+ break;
+ default:
+ DPRINTK("no-byte command\n");
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index c5ea0fc635e5..873cc0906055 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -674,6 +674,10 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
+ unsigned int offset;
+ unsigned char *buf;
+
++ if (!qc->cursg) {
++ qc->curbytes = qc->nbytes;
++ return;
++ }
+ if (qc->curbytes == qc->nbytes - qc->sect_size)
+ ap->hsm_task_state = HSM_ST_LAST;
+
+@@ -699,6 +703,8 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
+
+ if (qc->cursg_ofs == qc->cursg->length) {
+ qc->cursg = sg_next(qc->cursg);
++ if (!qc->cursg)
++ ap->hsm_task_state = HSM_ST_LAST;
+ qc->cursg_ofs = 0;
+ }
+ }
+diff --git a/drivers/clk/socfpga/clk-periph-s10.c b/drivers/clk/socfpga/clk-periph-s10.c
+index 568f59b58ddf..e7c877d354c7 100644
+--- a/drivers/clk/socfpga/clk-periph-s10.c
++++ b/drivers/clk/socfpga/clk-periph-s10.c
+@@ -37,7 +37,7 @@ static unsigned long clk_peri_cnt_clk_recalc_rate(struct clk_hw *hwclk,
+ if (socfpgaclk->fixed_div) {
+ div = socfpgaclk->fixed_div;
+ } else {
+- if (!socfpgaclk->bypass_reg)
++ if (socfpgaclk->hw.reg)
+ div = ((readl(socfpgaclk->hw.reg) & 0x7ff) + 1);
+ }
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index b308ce92685d..53395852f012 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1082,9 +1082,11 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
+ lineinfo.flags |= GPIOLINE_FLAG_ACTIVE_LOW;
+ if (test_bit(FLAG_OPEN_DRAIN, &desc->flags))
+- lineinfo.flags |= GPIOLINE_FLAG_OPEN_DRAIN;
++ lineinfo.flags |= (GPIOLINE_FLAG_OPEN_DRAIN |
++ GPIOLINE_FLAG_IS_OUT);
+ if (test_bit(FLAG_OPEN_SOURCE, &desc->flags))
+- lineinfo.flags |= GPIOLINE_FLAG_OPEN_SOURCE;
++ lineinfo.flags |= (GPIOLINE_FLAG_OPEN_SOURCE |
++ GPIOLINE_FLAG_IS_OUT);
+
+ if (copy_to_user(ip, &lineinfo, sizeof(lineinfo)))
+ return -EFAULT;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+index b4e7404fe660..a11637b0f6cc 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/aux.c
+@@ -40,8 +40,7 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ u8 *ptr = msg->buf;
+
+ while (remaining) {
+- u8 cnt = (remaining > 16) ? 16 : remaining;
+- u8 cmd;
++ u8 cnt, retries, cmd;
+
+ if (msg->flags & I2C_M_RD)
+ cmd = 1;
+@@ -51,10 +50,19 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ if (mcnt || remaining > 16)
+ cmd |= 4; /* MOT */
+
+- ret = aux->func->xfer(aux, true, cmd, msg->addr, ptr, &cnt);
+- if (ret < 0) {
+- nvkm_i2c_aux_release(aux);
+- return ret;
++ for (retries = 0, cnt = 0;
++ retries < 32 && !cnt;
++ retries++) {
++ cnt = min_t(u8, remaining, 16);
++ ret = aux->func->xfer(aux, true, cmd,
++ msg->addr, ptr, &cnt);
++ if (ret < 0)
++ goto out;
++ }
++ if (!cnt) {
++ AUX_TRACE(aux, "no data after 32 retries");
++ ret = -EIO;
++ goto out;
+ }
+
+ ptr += cnt;
+@@ -64,8 +72,10 @@ nvkm_i2c_aux_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ msg++;
+ }
+
++ ret = num;
++out:
+ nvkm_i2c_aux_release(aux);
+- return num;
++ return ret;
+ }
+
+ static u32
+diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+index 080f05352195..6a4da3a0ff1c 100644
+--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
++++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+@@ -436,7 +436,7 @@ static int rockchip_dp_resume(struct device *dev)
+
+ static const struct dev_pm_ops rockchip_dp_pm_ops = {
+ #ifdef CONFIG_PM_SLEEP
+- .suspend = rockchip_dp_suspend,
++ .suspend_late = rockchip_dp_suspend,
+ .resume_early = rockchip_dp_resume,
+ #endif
+ };
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+index e4e09d47c5c0..59e9d05ab928 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+@@ -389,8 +389,10 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+ break;
+ }
+
+- if (retries == RETRIES)
++ if (retries == RETRIES) {
++ kfree(reply);
+ return -EINVAL;
++ }
+
+ *msg_len = reply_len;
+ *msg = reply;
+diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c
+index 9428ea7cdf8a..c52bd163abb3 100644
+--- a/drivers/hid/hid-a4tech.c
++++ b/drivers/hid/hid-a4tech.c
+@@ -26,12 +26,36 @@
+ #define A4_2WHEEL_MOUSE_HACK_7 0x01
+ #define A4_2WHEEL_MOUSE_HACK_B8 0x02
+
++#define A4_WHEEL_ORIENTATION (HID_UP_GENDESK | 0x000000b8)
++
+ struct a4tech_sc {
+ unsigned long quirks;
+ unsigned int hw_wheel;
+ __s32 delayed_value;
+ };
+
++static int a4_input_mapping(struct hid_device *hdev, struct hid_input *hi,
++ struct hid_field *field, struct hid_usage *usage,
++ unsigned long **bit, int *max)
++{
++ struct a4tech_sc *a4 = hid_get_drvdata(hdev);
++
++ if (a4->quirks & A4_2WHEEL_MOUSE_HACK_B8 &&
++ usage->hid == A4_WHEEL_ORIENTATION) {
++ /*
++ * We do not want to have this usage mapped to anything as it's
++ * nonstandard and doesn't really behave like an HID report.
++ * It's only selecting the orientation (vertical/horizontal) of
++ * the previous mouse wheel report. The input_events will be
++ * generated once both reports are recorded in a4_event().
++ */
++ return -1;
++ }
++
++ return 0;
++
++}
++
+ static int a4_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ struct hid_field *field, struct hid_usage *usage,
+ unsigned long **bit, int *max)
+@@ -53,8 +77,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
+ struct a4tech_sc *a4 = hid_get_drvdata(hdev);
+ struct input_dev *input;
+
+- if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput ||
+- !usage->type)
++ if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput)
+ return 0;
+
+ input = field->hidinput->input;
+@@ -65,7 +88,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
+ return 1;
+ }
+
+- if (usage->hid == 0x000100b8) {
++ if (usage->hid == A4_WHEEL_ORIENTATION) {
+ input_event(input, EV_REL, value ? REL_HWHEEL :
+ REL_WHEEL, a4->delayed_value);
+ return 1;
+@@ -129,6 +152,7 @@ MODULE_DEVICE_TABLE(hid, a4_devices);
+ static struct hid_driver a4_driver = {
+ .name = "a4tech",
+ .id_table = a4_devices,
++ .input_mapping = a4_input_mapping,
+ .input_mapped = a4_input_mapped,
+ .event = a4_event,
+ .probe = a4_probe,
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 2898bb061945..4a2fa57ddcb8 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -971,6 +971,7 @@
+ #define USB_DEVICE_ID_SAITEK_RAT7 0x0cd7
+ #define USB_DEVICE_ID_SAITEK_RAT9 0x0cfa
+ #define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0
++#define USB_DEVICE_ID_SAITEK_X52 0x075c
+
+ #define USB_VENDOR_ID_SAMSUNG 0x0419
+ #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index d29c7c9cd185..e553f6fae7a4 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -143,6 +143,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPAD), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
+diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
+index bea8def64f43..30b8c3256c99 100644
+--- a/drivers/hid/hid-tmff.c
++++ b/drivers/hid/hid-tmff.c
+@@ -34,6 +34,8 @@
+
+ #include "hid-ids.h"
+
++#define THRUSTMASTER_DEVICE_ID_2_IN_1_DT 0xb320
++
+ static const signed short ff_rumble[] = {
+ FF_RUMBLE,
+ -1
+@@ -88,6 +90,7 @@ static int tmff_play(struct input_dev *dev, void *data,
+ struct hid_field *ff_field = tmff->ff_field;
+ int x, y;
+ int left, right; /* Rumbling */
++ int motor_swap;
+
+ switch (effect->type) {
+ case FF_CONSTANT:
+@@ -112,6 +115,13 @@ static int tmff_play(struct input_dev *dev, void *data,
+ ff_field->logical_minimum,
+ ff_field->logical_maximum);
+
++ /* 2-in-1 strong motor is left */
++ if (hid->product == THRUSTMASTER_DEVICE_ID_2_IN_1_DT) {
++ motor_swap = left;
++ left = right;
++ right = motor_swap;
++ }
++
+ dbg_hid("(left,right)=(%08x, %08x)\n", left, right);
+ ff_field->value[0] = left;
+ ff_field->value[1] = right;
+@@ -238,6 +248,8 @@ static const struct hid_device_id tm_devices[] = {
+ .driver_data = (unsigned long)ff_rumble },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304), /* FireStorm Dual Power 2 (and 3) */
+ .driver_data = (unsigned long)ff_rumble },
++ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, THRUSTMASTER_DEVICE_ID_2_IN_1_DT), /* Dual Trigger 2-in-1 */
++ .driver_data = (unsigned long)ff_rumble },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323), /* Dual Trigger 3-in-1 (PC Mode) */
+ .driver_data = (unsigned long)ff_rumble },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb324), /* Dual Trigger 3-in-1 (PS3 Mode) */
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index e56dc97fe4b6..50ef7b6cd195 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -848,6 +848,8 @@ static int wacom_intuos_general(struct wacom_wac *wacom)
+ y >>= 1;
+ distance >>= 1;
+ }
++ if (features->type == INTUOSHT2)
++ distance = features->distance_max - distance;
+ input_report_abs(input, ABS_X, x);
+ input_report_abs(input, ABS_Y, y);
+ input_report_abs(input, ABS_DISTANCE, distance);
+@@ -1061,7 +1063,7 @@ static int wacom_remote_irq(struct wacom_wac *wacom_wac, size_t len)
+ input_report_key(input, BTN_BASE2, (data[11] & 0x02));
+
+ if (data[12] & 0x80)
+- input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f));
++ input_report_abs(input, ABS_WHEEL, (data[12] & 0x7f) - 1);
+ else
+ input_report_abs(input, ABS_WHEEL, 0);
+
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 2f164bd74687..fdb0f832fade 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -38,7 +38,7 @@
+
+ static unsigned long virt_to_hvpfn(void *addr)
+ {
+- unsigned long paddr;
++ phys_addr_t paddr;
+
+ if (is_vmalloc_addr(addr))
+ paddr = page_to_phys(vmalloc_to_page(addr)) +
+diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
+index 060dc7fd66c1..c952002c6301 100644
+--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
+@@ -1406,6 +1406,7 @@ start_isoc_chain(struct usb_fifo *fifo, int num_packets_per_urb,
+ printk(KERN_DEBUG
+ "%s: %s: alloc urb for fifo %i failed",
+ hw->name, __func__, fifo->fifonum);
++ continue;
+ }
+ fifo->iso[i].owner_fifo = (struct usb_fifo *) fifo;
+ fifo->iso[i].indx = i;
+@@ -1704,13 +1705,23 @@ hfcsusb_stop_endpoint(struct hfcsusb *hw, int channel)
+ static int
+ setup_hfcsusb(struct hfcsusb *hw)
+ {
++ void *dmabuf = kmalloc(sizeof(u_char), GFP_KERNEL);
+ u_char b;
++ int ret;
+
+ if (debug & DBG_HFC_CALL_TRACE)
+ printk(KERN_DEBUG "%s: %s\n", hw->name, __func__);
+
++ if (!dmabuf)
++ return -ENOMEM;
++
++ ret = read_reg_atomic(hw, HFCUSB_CHIP_ID, dmabuf);
++
++ memcpy(&b, dmabuf, sizeof(u_char));
++ kfree(dmabuf);
++
+ /* check the chip id */
+- if (read_reg_atomic(hw, HFCUSB_CHIP_ID, &b) != 1) {
++ if (ret != 1) {
+ printk(KERN_DEBUG "%s: %s: cannot read chip id\n",
+ hw->name, __func__);
+ return 1;
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index b1d0ae2dbd3d..dc385b70e4c3 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1602,7 +1602,9 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ unsigned long freed;
+
+ c = container_of(shrink, struct dm_bufio_client, shrinker);
+- if (!dm_bufio_trylock(c))
++ if (sc->gfp_mask & __GFP_FS)
++ dm_bufio_lock(c);
++ else if (!dm_bufio_trylock(c))
+ return SHRINK_STOP;
+
+ freed = __scan(c, sc->nr_to_scan, sc->gfp_mask);
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index dbdcc543832d..2e22d588f056 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -1749,7 +1749,22 @@ offload_to_thread:
+ queue_work(ic->wait_wq, &dio->work);
+ return;
+ }
++ if (journal_read_pos != NOT_FOUND)
++ dio->range.n_sectors = ic->sectors_per_block;
+ wait_and_add_new_range(ic, &dio->range);
++ /*
++ * wait_and_add_new_range drops the spinlock, so the journal
++ * may have been changed arbitrarily. We need to recheck.
++ * To simplify the code, we restrict I/O size to just one block.
++ */
++ if (journal_read_pos != NOT_FOUND) {
++ sector_t next_sector;
++ unsigned new_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector);
++ if (unlikely(new_pos != journal_read_pos)) {
++ remove_range_unlocked(ic, &dio->range);
++ goto retry;
++ }
++ }
+ }
+ spin_unlock_irq(&ic->endio_wait.lock);
+
+diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
+index 671c24332802..3f694d9061ec 100644
+--- a/drivers/md/dm-kcopyd.c
++++ b/drivers/md/dm-kcopyd.c
+@@ -548,8 +548,10 @@ static int run_io_job(struct kcopyd_job *job)
+ * no point in continuing.
+ */
+ if (test_bit(DM_KCOPYD_WRITE_SEQ, &job->flags) &&
+- job->master_job->write_err)
++ job->master_job->write_err) {
++ job->write_err = job->master_job->write_err;
+ return -EIO;
++ }
+
+ io_job_start(job->kc->throttle);
+
+@@ -601,6 +603,7 @@ static int process_jobs(struct list_head *jobs, struct dm_kcopyd_client *kc,
+ else
+ job->read_err = 1;
+ push(&kc->complete_jobs, job);
++ wake(kc);
+ break;
+ }
+
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index c44925e4e481..b78a8a4d061c 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -3199,7 +3199,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ */
+ r = rs_prepare_reshape(rs);
+ if (r)
+- return r;
++ goto bad;
+
+ /* Reshaping ain't recovery, so disable recovery */
+ rs_setup_recovery(rs, MaxSector);
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 34ab30dd5de9..36275c59e4e7 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1349,7 +1349,7 @@ void dm_table_event(struct dm_table *t)
+ }
+ EXPORT_SYMBOL(dm_table_event);
+
+-sector_t dm_table_get_size(struct dm_table *t)
++inline sector_t dm_table_get_size(struct dm_table *t)
+ {
+ return t->num_targets ? (t->highs[t->num_targets - 1] + 1) : 0;
+ }
+@@ -1374,6 +1374,9 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
+ unsigned int l, n = 0, k = 0;
+ sector_t *node;
+
++ if (unlikely(sector >= dm_table_get_size(t)))
++ return &t->targets[t->num_targets];
++
+ for (l = 0; l < t->depth; l++) {
+ n = get_child(n, k);
+ node = get_node(t, l, n);
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index 4cdde7a02e94..7e8d7fc99410 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -401,15 +401,18 @@ static struct dmz_mblock *dmz_get_mblock_slow(struct dmz_metadata *zmd,
+ sector_t block = zmd->sb[zmd->mblk_primary].block + mblk_no;
+ struct bio *bio;
+
++ if (dmz_bdev_is_dying(zmd->dev))
++ return ERR_PTR(-EIO);
++
+ /* Get a new block and a BIO to read it */
+ mblk = dmz_alloc_mblock(zmd, mblk_no);
+ if (!mblk)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ bio = bio_alloc(GFP_NOIO, 1);
+ if (!bio) {
+ dmz_free_mblock(zmd, mblk);
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+
+ spin_lock(&zmd->mblk_lock);
+@@ -540,8 +543,8 @@ static struct dmz_mblock *dmz_get_mblock(struct dmz_metadata *zmd,
+ if (!mblk) {
+ /* Cache miss: read the block from disk */
+ mblk = dmz_get_mblock_slow(zmd, mblk_no);
+- if (!mblk)
+- return ERR_PTR(-ENOMEM);
++ if (IS_ERR(mblk))
++ return mblk;
+ }
+
+ /* Wait for on-going read I/O and check for error */
+@@ -569,16 +572,19 @@ static void dmz_dirty_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk)
+ /*
+ * Issue a metadata block write BIO.
+ */
+-static void dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
+- unsigned int set)
++static int dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
++ unsigned int set)
+ {
+ sector_t block = zmd->sb[set].block + mblk->no;
+ struct bio *bio;
+
++ if (dmz_bdev_is_dying(zmd->dev))
++ return -EIO;
++
+ bio = bio_alloc(GFP_NOIO, 1);
+ if (!bio) {
+ set_bit(DMZ_META_ERROR, &mblk->state);
+- return;
++ return -ENOMEM;
+ }
+
+ set_bit(DMZ_META_WRITING, &mblk->state);
+@@ -590,6 +596,8 @@ static void dmz_write_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk,
+ bio_set_op_attrs(bio, REQ_OP_WRITE, REQ_META | REQ_PRIO);
+ bio_add_page(bio, mblk->page, DMZ_BLOCK_SIZE, 0);
+ submit_bio(bio);
++
++ return 0;
+ }
+
+ /*
+@@ -601,6 +609,9 @@ static int dmz_rdwr_block(struct dmz_metadata *zmd, int op, sector_t block,
+ struct bio *bio;
+ int ret;
+
++ if (dmz_bdev_is_dying(zmd->dev))
++ return -EIO;
++
+ bio = bio_alloc(GFP_NOIO, 1);
+ if (!bio)
+ return -ENOMEM;
+@@ -658,22 +669,29 @@ static int dmz_write_dirty_mblocks(struct dmz_metadata *zmd,
+ {
+ struct dmz_mblock *mblk;
+ struct blk_plug plug;
+- int ret = 0;
++ int ret = 0, nr_mblks_submitted = 0;
+
+ /* Issue writes */
+ blk_start_plug(&plug);
+- list_for_each_entry(mblk, write_list, link)
+- dmz_write_mblock(zmd, mblk, set);
++ list_for_each_entry(mblk, write_list, link) {
++ ret = dmz_write_mblock(zmd, mblk, set);
++ if (ret)
++ break;
++ nr_mblks_submitted++;
++ }
+ blk_finish_plug(&plug);
+
+ /* Wait for completion */
+ list_for_each_entry(mblk, write_list, link) {
++ if (!nr_mblks_submitted)
++ break;
+ wait_on_bit_io(&mblk->state, DMZ_META_WRITING,
+ TASK_UNINTERRUPTIBLE);
+ if (test_bit(DMZ_META_ERROR, &mblk->state)) {
+ clear_bit(DMZ_META_ERROR, &mblk->state);
+ ret = -EIO;
+ }
++ nr_mblks_submitted--;
+ }
+
+ /* Flush drive cache (this will also sync data) */
+@@ -735,6 +753,11 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
+ */
+ dmz_lock_flush(zmd);
+
++ if (dmz_bdev_is_dying(zmd->dev)) {
++ ret = -EIO;
++ goto out;
++ }
++
+ /* Get dirty blocks */
+ spin_lock(&zmd->mblk_lock);
+ list_splice_init(&zmd->mblk_dirty_list, &write_list);
+@@ -1534,7 +1557,7 @@ static struct dm_zone *dmz_get_rnd_zone_for_reclaim(struct dmz_metadata *zmd)
+ struct dm_zone *zone;
+
+ if (list_empty(&zmd->map_rnd_list))
+- return NULL;
++ return ERR_PTR(-EBUSY);
+
+ list_for_each_entry(zone, &zmd->map_rnd_list, link) {
+ if (dmz_is_buf(zone))
+@@ -1545,7 +1568,7 @@ static struct dm_zone *dmz_get_rnd_zone_for_reclaim(struct dmz_metadata *zmd)
+ return dzone;
+ }
+
+- return NULL;
++ return ERR_PTR(-EBUSY);
+ }
+
+ /*
+@@ -1556,7 +1579,7 @@ static struct dm_zone *dmz_get_seq_zone_for_reclaim(struct dmz_metadata *zmd)
+ struct dm_zone *zone;
+
+ if (list_empty(&zmd->map_seq_list))
+- return NULL;
++ return ERR_PTR(-EBUSY);
+
+ list_for_each_entry(zone, &zmd->map_seq_list, link) {
+ if (!zone->bzone)
+@@ -1565,7 +1588,7 @@ static struct dm_zone *dmz_get_seq_zone_for_reclaim(struct dmz_metadata *zmd)
+ return zone;
+ }
+
+- return NULL;
++ return ERR_PTR(-EBUSY);
+ }
+
+ /*
+@@ -1623,6 +1646,10 @@ again:
+ /* Alloate a random zone */
+ dzone = dmz_alloc_zone(zmd, DMZ_ALLOC_RND);
+ if (!dzone) {
++ if (dmz_bdev_is_dying(zmd->dev)) {
++ dzone = ERR_PTR(-EIO);
++ goto out;
++ }
+ dmz_wait_for_free_zones(zmd);
+ goto again;
+ }
+@@ -1720,6 +1747,10 @@ again:
+ /* Alloate a random zone */
+ bzone = dmz_alloc_zone(zmd, DMZ_ALLOC_RND);
+ if (!bzone) {
++ if (dmz_bdev_is_dying(zmd->dev)) {
++ bzone = ERR_PTR(-EIO);
++ goto out;
++ }
+ dmz_wait_for_free_zones(zmd);
+ goto again;
+ }
+diff --git a/drivers/md/dm-zoned-reclaim.c b/drivers/md/dm-zoned-reclaim.c
+index edf4b95eb075..9470b8f77a33 100644
+--- a/drivers/md/dm-zoned-reclaim.c
++++ b/drivers/md/dm-zoned-reclaim.c
+@@ -37,7 +37,7 @@ enum {
+ /*
+ * Number of seconds of target BIO inactivity to consider the target idle.
+ */
+-#define DMZ_IDLE_PERIOD (10UL * HZ)
++#define DMZ_IDLE_PERIOD (10UL * HZ)
+
+ /*
+ * Percentage of unmapped (free) random zones below which reclaim starts
+@@ -134,6 +134,9 @@ static int dmz_reclaim_copy(struct dmz_reclaim *zrc,
+ set_bit(DM_KCOPYD_WRITE_SEQ, &flags);
+
+ while (block < end_block) {
++ if (dev->flags & DMZ_BDEV_DYING)
++ return -EIO;
++
+ /* Get a valid region from the source zone */
+ ret = dmz_first_valid_block(zmd, src_zone, &block);
+ if (ret <= 0)
+@@ -215,7 +218,7 @@ static int dmz_reclaim_buf(struct dmz_reclaim *zrc, struct dm_zone *dzone)
+
+ dmz_unlock_flush(zmd);
+
+- return 0;
++ return ret;
+ }
+
+ /*
+@@ -259,7 +262,7 @@ static int dmz_reclaim_seq_data(struct dmz_reclaim *zrc, struct dm_zone *dzone)
+
+ dmz_unlock_flush(zmd);
+
+- return 0;
++ return ret;
+ }
+
+ /*
+@@ -312,7 +315,7 @@ static int dmz_reclaim_rnd_data(struct dmz_reclaim *zrc, struct dm_zone *dzone)
+
+ dmz_unlock_flush(zmd);
+
+- return 0;
++ return ret;
+ }
+
+ /*
+@@ -334,7 +337,7 @@ static void dmz_reclaim_empty(struct dmz_reclaim *zrc, struct dm_zone *dzone)
+ /*
+ * Find a candidate zone for reclaim and process it.
+ */
+-static void dmz_reclaim(struct dmz_reclaim *zrc)
++static int dmz_do_reclaim(struct dmz_reclaim *zrc)
+ {
+ struct dmz_metadata *zmd = zrc->metadata;
+ struct dm_zone *dzone;
+@@ -344,8 +347,8 @@ static void dmz_reclaim(struct dmz_reclaim *zrc)
+
+ /* Get a data zone */
+ dzone = dmz_get_zone_for_reclaim(zmd);
+- if (!dzone)
+- return;
++ if (IS_ERR(dzone))
++ return PTR_ERR(dzone);
+
+ start = jiffies;
+
+@@ -391,13 +394,20 @@ static void dmz_reclaim(struct dmz_reclaim *zrc)
+ out:
+ if (ret) {
+ dmz_unlock_zone_reclaim(dzone);
+- return;
++ return ret;
+ }
+
+- (void) dmz_flush_metadata(zrc->metadata);
++ ret = dmz_flush_metadata(zrc->metadata);
++ if (ret) {
++ dmz_dev_debug(zrc->dev,
++ "Metadata flush for zone %u failed, err %d\n",
++ dmz_id(zmd, rzone), ret);
++ return ret;
++ }
+
+ dmz_dev_debug(zrc->dev, "Reclaimed zone %u in %u ms",
+ dmz_id(zmd, rzone), jiffies_to_msecs(jiffies - start));
++ return 0;
+ }
+
+ /*
+@@ -442,6 +452,10 @@ static void dmz_reclaim_work(struct work_struct *work)
+ struct dmz_metadata *zmd = zrc->metadata;
+ unsigned int nr_rnd, nr_unmap_rnd;
+ unsigned int p_unmap_rnd;
++ int ret;
++
++ if (dmz_bdev_is_dying(zrc->dev))
++ return;
+
+ if (!dmz_should_reclaim(zrc)) {
+ mod_delayed_work(zrc->wq, &zrc->work, DMZ_IDLE_PERIOD);
+@@ -471,7 +485,17 @@ static void dmz_reclaim_work(struct work_struct *work)
+ (dmz_target_idle(zrc) ? "Idle" : "Busy"),
+ p_unmap_rnd, nr_unmap_rnd, nr_rnd);
+
+- dmz_reclaim(zrc);
++ ret = dmz_do_reclaim(zrc);
++ if (ret) {
++ dmz_dev_debug(zrc->dev, "Reclaim error %d\n", ret);
++ if (ret == -EIO)
++ /*
++ * LLD might be performing some error handling sequence
++ * at the underlying device. To not interfere, do not
++ * attempt to schedule the next reclaim run immediately.
++ */
++ return;
++ }
+
+ dmz_schedule_reclaim(zrc);
+ }
+diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
+index 85fb2baa8a7f..1030c42add05 100644
+--- a/drivers/md/dm-zoned-target.c
++++ b/drivers/md/dm-zoned-target.c
+@@ -133,6 +133,8 @@ static int dmz_submit_bio(struct dmz_target *dmz, struct dm_zone *zone,
+
+ atomic_inc(&bioctx->ref);
+ generic_make_request(clone);
++ if (clone->bi_status == BLK_STS_IOERR)
++ return -EIO;
+
+ if (bio_op(bio) == REQ_OP_WRITE && dmz_is_seq(zone))
+ zone->wp_block += nr_blocks;
+@@ -277,8 +279,8 @@ static int dmz_handle_buffered_write(struct dmz_target *dmz,
+
+ /* Get the buffer zone. One will be allocated if needed */
+ bzone = dmz_get_chunk_buffer(zmd, zone);
+- if (!bzone)
+- return -ENOSPC;
++ if (IS_ERR(bzone))
++ return PTR_ERR(bzone);
+
+ if (dmz_is_readonly(bzone))
+ return -EROFS;
+@@ -389,6 +391,11 @@ static void dmz_handle_bio(struct dmz_target *dmz, struct dm_chunk_work *cw,
+
+ dmz_lock_metadata(zmd);
+
++ if (dmz->dev->flags & DMZ_BDEV_DYING) {
++ ret = -EIO;
++ goto out;
++ }
++
+ /*
+ * Get the data zone mapping the chunk. There may be no
+ * mapping for read and discard. If a mapping is obtained,
+@@ -493,6 +500,8 @@ static void dmz_flush_work(struct work_struct *work)
+
+ /* Flush dirty metadata blocks */
+ ret = dmz_flush_metadata(dmz->metadata);
++ if (ret)
++ dmz_dev_debug(dmz->dev, "Metadata flush failed, rc=%d\n", ret);
+
+ /* Process queued flush requests */
+ while (1) {
+@@ -513,22 +522,24 @@ static void dmz_flush_work(struct work_struct *work)
+ * Get a chunk work and start it to process a new BIO.
+ * If the BIO chunk has no work yet, create one.
+ */
+-static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
++static int dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
+ {
+ unsigned int chunk = dmz_bio_chunk(dmz->dev, bio);
+ struct dm_chunk_work *cw;
++ int ret = 0;
+
+ mutex_lock(&dmz->chunk_lock);
+
+ /* Get the BIO chunk work. If one is not active yet, create one */
+ cw = radix_tree_lookup(&dmz->chunk_rxtree, chunk);
+ if (!cw) {
+- int ret;
+
+ /* Create a new chunk work */
+ cw = kmalloc(sizeof(struct dm_chunk_work), GFP_NOIO);
+- if (!cw)
++ if (unlikely(!cw)) {
++ ret = -ENOMEM;
+ goto out;
++ }
+
+ INIT_WORK(&cw->work, dmz_chunk_work);
+ atomic_set(&cw->refcount, 0);
+@@ -539,7 +550,6 @@ static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
+ ret = radix_tree_insert(&dmz->chunk_rxtree, chunk, cw);
+ if (unlikely(ret)) {
+ kfree(cw);
+- cw = NULL;
+ goto out;
+ }
+ }
+@@ -547,10 +557,38 @@ static void dmz_queue_chunk_work(struct dmz_target *dmz, struct bio *bio)
+ bio_list_add(&cw->bio_list, bio);
+ dmz_get_chunk_work(cw);
+
++ dmz_reclaim_bio_acc(dmz->reclaim);
+ if (queue_work(dmz->chunk_wq, &cw->work))
+ dmz_get_chunk_work(cw);
+ out:
+ mutex_unlock(&dmz->chunk_lock);
++ return ret;
++}
++
++/*
++ * Check the backing device availability. If it's on the way out,
++ * start failing I/O. Reclaim and metadata components also call this
++ * function to cleanly abort operation in the event of such failure.
++ */
++bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev)
++{
++ struct gendisk *disk;
++
++ if (!(dmz_dev->flags & DMZ_BDEV_DYING)) {
++ disk = dmz_dev->bdev->bd_disk;
++ if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) {
++ dmz_dev_warn(dmz_dev, "Backing device queue dying");
++ dmz_dev->flags |= DMZ_BDEV_DYING;
++ } else if (disk->fops->check_events) {
++ if (disk->fops->check_events(disk, 0) &
++ DISK_EVENT_MEDIA_CHANGE) {
++ dmz_dev_warn(dmz_dev, "Backing device offline");
++ dmz_dev->flags |= DMZ_BDEV_DYING;
++ }
++ }
++ }
++
++ return dmz_dev->flags & DMZ_BDEV_DYING;
+ }
+
+ /*
+@@ -564,6 +602,10 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
+ sector_t sector = bio->bi_iter.bi_sector;
+ unsigned int nr_sectors = bio_sectors(bio);
+ sector_t chunk_sector;
++ int ret;
++
++ if (dmz_bdev_is_dying(dmz->dev))
++ return DM_MAPIO_KILL;
+
+ dmz_dev_debug(dev, "BIO op %d sector %llu + %u => chunk %llu, block %llu, %u blocks",
+ bio_op(bio), (unsigned long long)sector, nr_sectors,
+@@ -601,8 +643,14 @@ static int dmz_map(struct dm_target *ti, struct bio *bio)
+ dm_accept_partial_bio(bio, dev->zone_nr_sectors - chunk_sector);
+
+ /* Now ready to handle this BIO */
+- dmz_reclaim_bio_acc(dmz->reclaim);
+- dmz_queue_chunk_work(dmz, bio);
++ ret = dmz_queue_chunk_work(dmz, bio);
++ if (ret) {
++ dmz_dev_debug(dmz->dev,
++ "BIO op %d, can't process chunk %llu, err %i\n",
++ bio_op(bio), (u64)dmz_bio_chunk(dmz->dev, bio),
++ ret);
++ return DM_MAPIO_REQUEUE;
++ }
+
+ return DM_MAPIO_SUBMITTED;
+ }
+@@ -856,6 +904,9 @@ static int dmz_prepare_ioctl(struct dm_target *ti, struct block_device **bdev)
+ {
+ struct dmz_target *dmz = ti->private;
+
++ if (dmz_bdev_is_dying(dmz->dev))
++ return -ENODEV;
++
+ *bdev = dmz->dev->bdev;
+
+ return 0;
+diff --git a/drivers/md/dm-zoned.h b/drivers/md/dm-zoned.h
+index ed8de49c9a08..93a64529f219 100644
+--- a/drivers/md/dm-zoned.h
++++ b/drivers/md/dm-zoned.h
+@@ -56,6 +56,8 @@ struct dmz_dev {
+
+ unsigned int nr_zones;
+
++ unsigned int flags;
++
+ sector_t zone_nr_sectors;
+ unsigned int zone_nr_sectors_shift;
+
+@@ -67,6 +69,9 @@ struct dmz_dev {
+ (dev)->zone_nr_sectors_shift)
+ #define dmz_chunk_block(dev, b) ((b) & ((dev)->zone_nr_blocks - 1))
+
++/* Device flags. */
++#define DMZ_BDEV_DYING (1 << 0)
++
+ /*
+ * Zone descriptor.
+ */
+@@ -245,4 +250,9 @@ void dmz_resume_reclaim(struct dmz_reclaim *zrc);
+ void dmz_reclaim_bio_acc(struct dmz_reclaim *zrc);
+ void dmz_schedule_reclaim(struct dmz_reclaim *zrc);
+
++/*
++ * Functions defined in dm-zoned-target.c
++ */
++bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev);
++
+ #endif /* DM_ZONED_H */
+diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
+index 58b319757b1e..8aae0624a297 100644
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -628,39 +628,40 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key)
+
+ new_parent = shadow_current(s);
+
++ pn = dm_block_data(new_parent);
++ size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ?
++ sizeof(__le64) : s->info->value_type.size;
++
++ /* create & init the left block */
+ r = new_block(s->info, &left);
+ if (r < 0)
+ return r;
+
++ ln = dm_block_data(left);
++ nr_left = le32_to_cpu(pn->header.nr_entries) / 2;
++
++ ln->header.flags = pn->header.flags;
++ ln->header.nr_entries = cpu_to_le32(nr_left);
++ ln->header.max_entries = pn->header.max_entries;
++ ln->header.value_size = pn->header.value_size;
++ memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0]));
++ memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size);
++
++ /* create & init the right block */
+ r = new_block(s->info, &right);
+ if (r < 0) {
+ unlock_block(s->info, left);
+ return r;
+ }
+
+- pn = dm_block_data(new_parent);
+- ln = dm_block_data(left);
+ rn = dm_block_data(right);
+-
+- nr_left = le32_to_cpu(pn->header.nr_entries) / 2;
+ nr_right = le32_to_cpu(pn->header.nr_entries) - nr_left;
+
+- ln->header.flags = pn->header.flags;
+- ln->header.nr_entries = cpu_to_le32(nr_left);
+- ln->header.max_entries = pn->header.max_entries;
+- ln->header.value_size = pn->header.value_size;
+-
+ rn->header.flags = pn->header.flags;
+ rn->header.nr_entries = cpu_to_le32(nr_right);
+ rn->header.max_entries = pn->header.max_entries;
+ rn->header.value_size = pn->header.value_size;
+-
+- memcpy(ln->keys, pn->keys, nr_left * sizeof(pn->keys[0]));
+ memcpy(rn->keys, pn->keys + nr_left, nr_right * sizeof(pn->keys[0]));
+-
+- size = le32_to_cpu(pn->header.flags) & INTERNAL_NODE ?
+- sizeof(__le64) : s->info->value_type.size;
+- memcpy(value_ptr(ln, 0), value_ptr(pn, 0), nr_left * size);
+ memcpy(value_ptr(rn, 0), value_ptr(pn, nr_left),
+ nr_right * size);
+
+diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
+index aec449243966..25328582cc48 100644
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -249,7 +249,7 @@ static int out(struct sm_metadata *smm)
+ }
+
+ if (smm->recursion_count == 1)
+- apply_bops(smm);
++ r = apply_bops(smm);
+
+ smm->recursion_count--;
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 8f14f85b8e95..0d2392c4b625 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2190,6 +2190,15 @@ static void bond_miimon_commit(struct bonding *bond)
+ bond_for_each_slave(bond, slave, iter) {
+ switch (slave->new_link) {
+ case BOND_LINK_NOCHANGE:
++ /* For 802.3ad mode, check current slave speed and
++ * duplex again in case its port was disabled after
++ * invalid speed/duplex reporting but recovered before
++ * link monitoring could make a decision on the actual
++ * link status
++ */
++ if (BOND_MODE(bond) == BOND_MODE_8023AD &&
++ slave->link == BOND_LINK_UP)
++ bond_3ad_adapter_speed_duplex_changed(slave);
+ continue;
+
+ case BOND_LINK_UP:
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index c05e4d50d43d..bd127ce3aba2 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -1260,6 +1260,8 @@ int register_candev(struct net_device *dev)
+ return -EINVAL;
+
+ dev->rtnl_link_ops = &can_link_ops;
++ netif_carrier_off(dev);
++
+ return register_netdev(dev);
+ }
+ EXPORT_SYMBOL_GPL(register_candev);
+diff --git a/drivers/net/can/sja1000/peak_pcmcia.c b/drivers/net/can/sja1000/peak_pcmcia.c
+index b8c39ede7cd5..179bfcd541f2 100644
+--- a/drivers/net/can/sja1000/peak_pcmcia.c
++++ b/drivers/net/can/sja1000/peak_pcmcia.c
+@@ -487,7 +487,7 @@ static void pcan_free_channels(struct pcan_pccard *card)
+ if (!netdev)
+ continue;
+
+- strncpy(name, netdev->name, IFNAMSIZ);
++ strlcpy(name, netdev->name, IFNAMSIZ);
+
+ unregister_sja1000dev(netdev);
+
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index da64e71a62ee..fccb6bf21fad 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -678,17 +678,6 @@ static int mcp251x_power_enable(struct regulator *reg, int enable)
+ return regulator_disable(reg);
+ }
+
+-static void mcp251x_open_clean(struct net_device *net)
+-{
+- struct mcp251x_priv *priv = netdev_priv(net);
+- struct spi_device *spi = priv->spi;
+-
+- free_irq(spi->irq, priv);
+- mcp251x_hw_sleep(spi);
+- mcp251x_power_enable(priv->transceiver, 0);
+- close_candev(net);
+-}
+-
+ static int mcp251x_stop(struct net_device *net)
+ {
+ struct mcp251x_priv *priv = netdev_priv(net);
+@@ -954,37 +943,43 @@ static int mcp251x_open(struct net_device *net)
+ flags | IRQF_ONESHOT, DEVICE_NAME, priv);
+ if (ret) {
+ dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
+- mcp251x_power_enable(priv->transceiver, 0);
+- close_candev(net);
+- goto open_unlock;
++ goto out_close;
+ }
+
+ priv->wq = alloc_workqueue("mcp251x_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
+ 0);
++ if (!priv->wq) {
++ ret = -ENOMEM;
++ goto out_clean;
++ }
+ INIT_WORK(&priv->tx_work, mcp251x_tx_work_handler);
+ INIT_WORK(&priv->restart_work, mcp251x_restart_work_handler);
+
+ ret = mcp251x_hw_reset(spi);
+- if (ret) {
+- mcp251x_open_clean(net);
+- goto open_unlock;
+- }
++ if (ret)
++ goto out_free_wq;
+ ret = mcp251x_setup(net, spi);
+- if (ret) {
+- mcp251x_open_clean(net);
+- goto open_unlock;
+- }
++ if (ret)
++ goto out_free_wq;
+ ret = mcp251x_set_normal_mode(spi);
+- if (ret) {
+- mcp251x_open_clean(net);
+- goto open_unlock;
+- }
++ if (ret)
++ goto out_free_wq;
+
+ can_led_event(net, CAN_LED_EVENT_OPEN);
+
+ netif_wake_queue(net);
++ mutex_unlock(&priv->mcp_lock);
+
+-open_unlock:
++ return 0;
++
++out_free_wq:
++ destroy_workqueue(priv->wq);
++out_clean:
++ free_irq(spi->irq, priv);
++ mcp251x_hw_sleep(spi);
++out_close:
++ mcp251x_power_enable(priv->transceiver, 0);
++ close_candev(net);
+ mutex_unlock(&priv->mcp_lock);
+ return ret;
+ }
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index 740ef47eab01..43b0fa2b9932 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -863,7 +863,7 @@ static void peak_usb_disconnect(struct usb_interface *intf)
+
+ dev_prev_siblings = dev->prev_siblings;
+ dev->state &= ~PCAN_USB_STATE_CONNECTED;
+- strncpy(name, netdev->name, IFNAMSIZ);
++ strlcpy(name, netdev->name, IFNAMSIZ);
+
+ unregister_netdev(netdev);
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+index c34ea385fe4a..6be6de0774b6 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+@@ -3270,7 +3270,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (!adapter->regs) {
+ dev_err(&pdev->dev, "cannot map device registers\n");
+ err = -ENOMEM;
+- goto out_free_adapter;
++ goto out_free_adapter_nofail;
+ }
+
+ adapter->pdev = pdev;
+@@ -3398,6 +3398,9 @@ out_free_dev:
+ if (adapter->port[i])
+ free_netdev(adapter->port[i]);
+
++out_free_adapter_nofail:
++ kfree_skb(adapter->nofail_skb);
++
+ out_free_adapter:
+ kfree(adapter);
+
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index 6127697ede12..a91d49dd92ea 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -157,6 +157,7 @@ struct hip04_priv {
+ unsigned int reg_inten;
+
+ struct napi_struct napi;
++ struct device *dev;
+ struct net_device *ndev;
+
+ struct tx_desc *tx_desc;
+@@ -185,7 +186,7 @@ struct hip04_priv {
+
+ static inline unsigned int tx_count(unsigned int head, unsigned int tail)
+ {
+- return (head - tail) % (TX_DESC_NUM - 1);
++ return (head - tail) % TX_DESC_NUM;
+ }
+
+ static void hip04_config_port(struct net_device *ndev, u32 speed, u32 duplex)
+@@ -387,7 +388,7 @@ static int hip04_tx_reclaim(struct net_device *ndev, bool force)
+ }
+
+ if (priv->tx_phys[tx_tail]) {
+- dma_unmap_single(&ndev->dev, priv->tx_phys[tx_tail],
++ dma_unmap_single(priv->dev, priv->tx_phys[tx_tail],
+ priv->tx_skb[tx_tail]->len,
+ DMA_TO_DEVICE);
+ priv->tx_phys[tx_tail] = 0;
+@@ -437,8 +438,8 @@ static int hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ return NETDEV_TX_BUSY;
+ }
+
+- phys = dma_map_single(&ndev->dev, skb->data, skb->len, DMA_TO_DEVICE);
+- if (dma_mapping_error(&ndev->dev, phys)) {
++ phys = dma_map_single(priv->dev, skb->data, skb->len, DMA_TO_DEVICE);
++ if (dma_mapping_error(priv->dev, phys)) {
+ dev_kfree_skb(skb);
+ return NETDEV_TX_OK;
+ }
+@@ -497,6 +498,9 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
+ u16 len;
+ u32 err;
+
++ /* clean up tx descriptors */
++ tx_remaining = hip04_tx_reclaim(ndev, false);
++
+ while (cnt && !last) {
+ buf = priv->rx_buf[priv->rx_head];
+ skb = build_skb(buf, priv->rx_buf_size);
+@@ -505,7 +509,7 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
+ goto refill;
+ }
+
+- dma_unmap_single(&ndev->dev, priv->rx_phys[priv->rx_head],
++ dma_unmap_single(priv->dev, priv->rx_phys[priv->rx_head],
+ RX_BUF_SIZE, DMA_FROM_DEVICE);
+ priv->rx_phys[priv->rx_head] = 0;
+
+@@ -534,9 +538,9 @@ refill:
+ buf = netdev_alloc_frag(priv->rx_buf_size);
+ if (!buf)
+ goto done;
+- phys = dma_map_single(&ndev->dev, buf,
++ phys = dma_map_single(priv->dev, buf,
+ RX_BUF_SIZE, DMA_FROM_DEVICE);
+- if (dma_mapping_error(&ndev->dev, phys))
++ if (dma_mapping_error(priv->dev, phys))
+ goto done;
+ priv->rx_buf[priv->rx_head] = buf;
+ priv->rx_phys[priv->rx_head] = phys;
+@@ -557,8 +561,7 @@ refill:
+ }
+ napi_complete_done(napi, rx);
+ done:
+- /* clean up tx descriptors and start a new timer if necessary */
+- tx_remaining = hip04_tx_reclaim(ndev, false);
++ /* start a new timer if necessary */
+ if (rx < budget && tx_remaining)
+ hip04_start_tx_timer(priv);
+
+@@ -640,9 +643,9 @@ static int hip04_mac_open(struct net_device *ndev)
+ for (i = 0; i < RX_DESC_NUM; i++) {
+ dma_addr_t phys;
+
+- phys = dma_map_single(&ndev->dev, priv->rx_buf[i],
++ phys = dma_map_single(priv->dev, priv->rx_buf[i],
+ RX_BUF_SIZE, DMA_FROM_DEVICE);
+- if (dma_mapping_error(&ndev->dev, phys))
++ if (dma_mapping_error(priv->dev, phys))
+ return -EIO;
+
+ priv->rx_phys[i] = phys;
+@@ -676,7 +679,7 @@ static int hip04_mac_stop(struct net_device *ndev)
+
+ for (i = 0; i < RX_DESC_NUM; i++) {
+ if (priv->rx_phys[i]) {
+- dma_unmap_single(&ndev->dev, priv->rx_phys[i],
++ dma_unmap_single(priv->dev, priv->rx_phys[i],
+ RX_BUF_SIZE, DMA_FROM_DEVICE);
+ priv->rx_phys[i] = 0;
+ }
+@@ -820,6 +823,7 @@ static int hip04_mac_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ priv = netdev_priv(ndev);
++ priv->dev = d;
+ priv->ndev = ndev;
+ platform_set_drvdata(pdev, ndev);
+ SET_NETDEV_DEV(ndev, &pdev->dev);
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 6455511457ca..9b608d23ff7e 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -4412,9 +4412,9 @@ static void mvpp2_xlg_config(struct mvpp2_port *port, unsigned int mode,
+ if (state->pause & MLO_PAUSE_RX)
+ ctrl0 |= MVPP22_XLG_CTRL0_RX_FLOW_CTRL_EN;
+
+- ctrl4 &= ~MVPP22_XLG_CTRL4_MACMODSELECT_GMAC;
+- ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC |
+- MVPP22_XLG_CTRL4_EN_IDLE_CHECK;
++ ctrl4 &= ~(MVPP22_XLG_CTRL4_MACMODSELECT_GMAC |
++ MVPP22_XLG_CTRL4_EN_IDLE_CHECK);
++ ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC;
+
+ writel(ctrl0, port->base + MVPP22_XLG_CTRL0_REG);
+ writel(ctrl4, port->base + MVPP22_XLG_CTRL4_REG);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
+index b22f464ea3fa..f9e475075d3e 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
+@@ -939,7 +939,7 @@ static int qed_int_deassertion(struct qed_hwfn *p_hwfn,
+ snprintf(bit_name, 30,
+ p_aeu->bit_name, num);
+ else
+- strncpy(bit_name,
++ strlcpy(bit_name,
+ p_aeu->bit_name, 30);
+
+ /* We now need to pass bitmask in its
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index 13802b825d65..909422d93903 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -442,7 +442,7 @@ static void qed_rdma_init_devinfo(struct qed_hwfn *p_hwfn,
+ /* Vendor specific information */
+ dev->vendor_id = cdev->vendor_id;
+ dev->vendor_part_id = cdev->device_id;
+- dev->hw_ver = 0;
++ dev->hw_ver = cdev->chip_rev;
+ dev->fw_ver = (FW_MAJOR_VERSION << 24) | (FW_MINOR_VERSION << 16) |
+ (FW_REVISION_VERSION << 8) | (FW_ENGINEERING_VERSION);
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index d0e6e1503581..48cf5e2b2441 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -88,6 +88,8 @@ static void dwmac4_rx_queue_priority(struct mac_device_info *hw,
+ u32 value;
+
+ base_register = (queue < 4) ? GMAC_RXQ_CTRL2 : GMAC_RXQ_CTRL3;
++ if (queue >= 4)
++ queue -= 4;
+
+ value = readl(ioaddr + base_register);
+
+@@ -105,6 +107,8 @@ static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
+ u32 value;
+
+ base_register = (queue < 4) ? GMAC_TXQ_PRTY_MAP0 : GMAC_TXQ_PRTY_MAP1;
++ if (queue >= 4)
++ queue -= 4;
+
+ value = readl(ioaddr + base_register);
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+index d182f82f7b58..870302a7177e 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+@@ -106,6 +106,8 @@ static void dwxgmac2_rx_queue_prio(struct mac_device_info *hw, u32 prio,
+ u32 value, reg;
+
+ reg = (queue < 4) ? XGMAC_RXQ_CTRL2 : XGMAC_RXQ_CTRL3;
++ if (queue >= 4)
++ queue -= 4;
+
+ value = readl(ioaddr + reg);
+ value &= ~XGMAC_PSRQ(queue);
+@@ -169,6 +171,8 @@ static void dwxgmac2_map_mtl_to_dma(struct mac_device_info *hw, u32 queue,
+ u32 value, reg;
+
+ reg = (queue < 4) ? XGMAC_MTL_RXQ_DMA_MAP0 : XGMAC_MTL_RXQ_DMA_MAP1;
++ if (queue >= 4)
++ queue -= 4;
+
+ value = readl(ioaddr + reg);
+ value &= ~XGMAC_QxMDMACH(queue);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 58ea18af9813..37c0bc699cd9 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -37,7 +37,7 @@ static struct stmmac_tc_entry *tc_find_entry(struct stmmac_priv *priv,
+ entry = &priv->tc_entries[i];
+ if (!entry->in_use && !first && free)
+ first = entry;
+- if (entry->handle == loc && !free)
++ if ((entry->handle == loc) && !free && !entry->is_frag)
+ dup = entry;
+ }
+
+diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c
+index 491efc1bf5c4..7278eca70f9f 100644
+--- a/drivers/net/phy/phy_led_triggers.c
++++ b/drivers/net/phy/phy_led_triggers.c
+@@ -58,8 +58,9 @@ void phy_led_trigger_change_speed(struct phy_device *phy)
+ if (!phy->last_triggered)
+ led_trigger_event(&phy->led_link_trigger->trigger,
+ LED_FULL);
++ else
++ led_trigger_event(&phy->last_triggered->trigger, LED_OFF);
+
+- led_trigger_event(&phy->last_triggered->trigger, LED_OFF);
+ led_trigger_event(&plt->trigger, LED_FULL);
+ phy->last_triggered = plt;
+ }
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 128c8a327d8e..51017c6bb3bc 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1231,6 +1231,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */
+ {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */
+ {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */
++ {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */
+ {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */
+ {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */
+ {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 7cd428c0af43..ce2dd06af62e 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3502,10 +3502,12 @@ static int hwsim_dump_radio_nl(struct sk_buff *skb,
+ hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, &hwsim_genl_family,
+ NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
+- if (!hdr)
++ if (hdr) {
++ genl_dump_check_consistent(cb, hdr);
++ genlmsg_end(skb, hdr);
++ } else {
+ res = -EMSGSIZE;
+- genl_dump_check_consistent(cb, hdr);
+- genlmsg_end(skb, hdr);
++ }
+ }
+
+ done:
+diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c
+index f55d082ace71..5d6e7e931bc6 100644
+--- a/drivers/nfc/st-nci/se.c
++++ b/drivers/nfc/st-nci/se.c
+@@ -344,6 +344,8 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,
+
+ transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
+ skb->len - 2, GFP_KERNEL);
++ if (!transaction)
++ return -ENOMEM;
+
+ transaction->aid_len = skb->data[1];
+ memcpy(transaction->aid, &skb->data[2], transaction->aid_len);
+diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c
+index 4bed9e842db3..fd967a38a94a 100644
+--- a/drivers/nfc/st21nfca/se.c
++++ b/drivers/nfc/st21nfca/se.c
+@@ -328,6 +328,8 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
+
+ transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
+ skb->len - 2, GFP_KERNEL);
++ if (!transaction)
++ return -ENOMEM;
+
+ transaction->aid_len = skb->data[1];
+ memcpy(transaction->aid, &skb->data[2],
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index 9c332a6f6667..476728bdae8c 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -913,8 +913,9 @@ get_more_pages:
+ if (page_offset(page) >= ceph_wbc.i_size) {
+ dout("%p page eof %llu\n",
+ page, ceph_wbc.i_size);
+- if (ceph_wbc.size_stable ||
+- page_offset(page) >= i_size_read(inode))
++ if ((ceph_wbc.size_stable ||
++ page_offset(page) >= i_size_read(inode)) &&
++ clear_page_dirty_for_io(page))
+ mapping->a_ops->invalidatepage(page,
+ 0, PAGE_SIZE);
+ unlock_page(page);
+diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
+index 9dae2ec7e1fa..6a8f4a99582e 100644
+--- a/fs/ceph/locks.c
++++ b/fs/ceph/locks.c
+@@ -111,8 +111,7 @@ static int ceph_lock_message(u8 lock_type, u16 operation, struct inode *inode,
+ req->r_wait_for_completion = ceph_lock_wait_for_completion;
+
+ err = ceph_mdsc_do_request(mdsc, inode, req);
+-
+- if (operation == CEPH_MDS_OP_GETFILELOCK) {
++ if (!err && operation == CEPH_MDS_OP_GETFILELOCK) {
+ fl->fl_pid = -le64_to_cpu(req->r_reply_info.filelock_reply->pid);
+ if (CEPH_LOCK_SHARED == req->r_reply_info.filelock_reply->type)
+ fl->fl_type = F_RDLCK;
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 0ccf8f9b63a2..cc9e846a3865 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2545,7 +2545,15 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
+ static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf,
+ unsigned int buflen)
+ {
+- sg_set_page(sg, virt_to_page(buf), buflen, offset_in_page(buf));
++ void *addr;
++ /*
++ * VMAP_STACK (at least) puts stack into the vmalloc address space
++ */
++ if (is_vmalloc_addr(buf))
++ addr = vmalloc_to_page(buf);
++ else
++ addr = virt_to_page(buf);
++ sg_set_page(sg, addr, buflen, offset_in_page(buf));
+ }
+
+ /* Assumes the first rqst has a transform header as the first iov.
+@@ -3121,7 +3129,6 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
+ {
+ int ret, length;
+ char *buf = server->smallbuf;
+- char *tmpbuf;
+ struct smb2_sync_hdr *shdr;
+ unsigned int pdu_length = server->pdu_size;
+ unsigned int buf_size;
+@@ -3151,18 +3158,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
+ return length;
+
+ next_is_large = server->large_buf;
+- one_more:
++one_more:
+ shdr = (struct smb2_sync_hdr *)buf;
+ if (shdr->NextCommand) {
+- if (next_is_large) {
+- tmpbuf = server->bigbuf;
++ if (next_is_large)
+ next_buffer = (char *)cifs_buf_get();
+- } else {
+- tmpbuf = server->smallbuf;
++ else
+ next_buffer = (char *)cifs_small_buf_get();
+- }
+ memcpy(next_buffer,
+- tmpbuf + le32_to_cpu(shdr->NextCommand),
++ buf + le32_to_cpu(shdr->NextCommand),
+ pdu_length - le32_to_cpu(shdr->NextCommand));
+ }
+
+@@ -3191,12 +3195,21 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
+ pdu_length -= le32_to_cpu(shdr->NextCommand);
+ server->large_buf = next_is_large;
+ if (next_is_large)
+- server->bigbuf = next_buffer;
++ server->bigbuf = buf = next_buffer;
+ else
+- server->smallbuf = next_buffer;
+-
+- buf += le32_to_cpu(shdr->NextCommand);
++ server->smallbuf = buf = next_buffer;
+ goto one_more;
++ } else if (ret != 0) {
++ /*
++ * ret != 0 here means that we didn't get to handle_mid() thus
++ * server->smallbuf and server->bigbuf are still valid. We need
++ * to free next_buffer because it is not going to be used
++ * anywhere.
++ */
++ if (next_is_large)
++ free_rsp_buf(CIFS_LARGE_BUFFER, next_buffer);
++ else
++ free_rsp_buf(CIFS_SMALL_BUFFER, next_buffer);
+ }
+
+ return ret;
+diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
+index 4dc887813c71..a7bc4e0494f9 100644
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -118,6 +118,10 @@ void nfs_fscache_get_super_cookie(struct super_block *sb, const char *uniq, int
+ struct rb_node **p, *parent;
+ int diff;
+
++ nfss->fscache_key = NULL;
++ nfss->fscache = NULL;
++ if (!(nfss->options & NFS_OPTION_FSCACHE))
++ return;
+ if (!uniq) {
+ uniq = "";
+ ulen = 1;
+@@ -230,10 +234,11 @@ void nfs_fscache_release_super_cookie(struct super_block *sb)
+ void nfs_fscache_init_inode(struct inode *inode)
+ {
+ struct nfs_fscache_inode_auxdata auxdata;
++ struct nfs_server *nfss = NFS_SERVER(inode);
+ struct nfs_inode *nfsi = NFS_I(inode);
+
+ nfsi->fscache = NULL;
+- if (!S_ISREG(inode->i_mode))
++ if (!(nfss->fscache && S_ISREG(inode->i_mode)))
+ return;
+
+ memset(&auxdata, 0, sizeof(auxdata));
+diff --git a/fs/nfs/fscache.h b/fs/nfs/fscache.h
+index 161ba2edb9d0..6363ea956858 100644
+--- a/fs/nfs/fscache.h
++++ b/fs/nfs/fscache.h
+@@ -186,7 +186,7 @@ static inline void nfs_fscache_wait_on_invalidate(struct inode *inode)
+ */
+ static inline const char *nfs_server_fscache_state(struct nfs_server *server)
+ {
+- if (server->fscache && (server->options & NFS_OPTION_FSCACHE))
++ if (server->fscache)
+ return "yes";
+ return "no ";
+ }
+diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
+index 63287d911c08..5b61520dce88 100644
+--- a/fs/nfs/nfs4_fs.h
++++ b/fs/nfs/nfs4_fs.h
+@@ -469,7 +469,8 @@ static inline void nfs4_schedule_session_recovery(struct nfs4_session *session,
+
+ extern struct nfs4_state_owner *nfs4_get_state_owner(struct nfs_server *, struct rpc_cred *, gfp_t);
+ extern void nfs4_put_state_owner(struct nfs4_state_owner *);
+-extern void nfs4_purge_state_owners(struct nfs_server *);
++extern void nfs4_purge_state_owners(struct nfs_server *, struct list_head *);
++extern void nfs4_free_state_owners(struct list_head *head);
+ extern struct nfs4_state * nfs4_get_open_state(struct inode *, struct nfs4_state_owner *);
+ extern void nfs4_put_open_state(struct nfs4_state *);
+ extern void nfs4_close_state(struct nfs4_state *, fmode_t);
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 8f53455c4765..86991bcfbeb1 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -754,9 +754,12 @@ out:
+
+ static void nfs4_destroy_server(struct nfs_server *server)
+ {
++ LIST_HEAD(freeme);
++
+ nfs_server_return_all_delegations(server);
+ unset_pnfs_layoutdriver(server);
+- nfs4_purge_state_owners(server);
++ nfs4_purge_state_owners(server, &freeme);
++ nfs4_free_state_owners(&freeme);
+ }
+
+ /*
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 3ba2087469ac..c36ef75f2054 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -628,24 +628,39 @@ void nfs4_put_state_owner(struct nfs4_state_owner *sp)
+ /**
+ * nfs4_purge_state_owners - Release all cached state owners
+ * @server: nfs_server with cached state owners to release
++ * @head: resulting list of state owners
+ *
+ * Called at umount time. Remaining state owners will be on
+ * the LRU with ref count of zero.
++ * Note that the state owners are not freed, but are added
++ * to the list @head, which can later be used as an argument
++ * to nfs4_free_state_owners.
+ */
+-void nfs4_purge_state_owners(struct nfs_server *server)
++void nfs4_purge_state_owners(struct nfs_server *server, struct list_head *head)
+ {
+ struct nfs_client *clp = server->nfs_client;
+ struct nfs4_state_owner *sp, *tmp;
+- LIST_HEAD(doomed);
+
+ spin_lock(&clp->cl_lock);
+ list_for_each_entry_safe(sp, tmp, &server->state_owners_lru, so_lru) {
+- list_move(&sp->so_lru, &doomed);
++ list_move(&sp->so_lru, head);
+ nfs4_remove_state_owner_locked(sp);
+ }
+ spin_unlock(&clp->cl_lock);
++}
+
+- list_for_each_entry_safe(sp, tmp, &doomed, so_lru) {
++/**
++ * nfs4_purge_state_owners - Release all cached state owners
++ * @head: resulting list of state owners
++ *
++ * Frees a list of state owners that was generated by
++ * nfs4_purge_state_owners
++ */
++void nfs4_free_state_owners(struct list_head *head)
++{
++ struct nfs4_state_owner *sp, *tmp;
++
++ list_for_each_entry_safe(sp, tmp, head, so_lru) {
+ list_del(&sp->so_lru);
+ nfs4_free_state_owner(sp);
+ }
+@@ -1843,12 +1858,13 @@ static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recov
+ struct nfs4_state_owner *sp;
+ struct nfs_server *server;
+ struct rb_node *pos;
++ LIST_HEAD(freeme);
+ int status = 0;
+
+ restart:
+ rcu_read_lock();
+ list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+- nfs4_purge_state_owners(server);
++ nfs4_purge_state_owners(server, &freeme);
+ spin_lock(&clp->cl_lock);
+ for (pos = rb_first(&server->state_owners);
+ pos != NULL;
+@@ -1877,6 +1893,7 @@ restart:
+ spin_unlock(&clp->cl_lock);
+ }
+ rcu_read_unlock();
++ nfs4_free_state_owners(&freeme);
+ return 0;
+ }
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 6df9b85caf20..d90efdea9fbd 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2239,6 +2239,7 @@ nfs_compare_remount_data(struct nfs_server *nfss,
+ data->acdirmin != nfss->acdirmin / HZ ||
+ data->acdirmax != nfss->acdirmax / HZ ||
+ data->timeo != (10U * nfss->client->cl_timeout->to_initval / HZ) ||
++ (data->options & NFS_OPTION_FSCACHE) != (nfss->options & NFS_OPTION_FSCACHE) ||
+ data->nfs_server.port != nfss->port ||
+ data->nfs_server.addrlen != nfss->nfs_client->cl_addrlen ||
+ !rpc_cmp_addr((struct sockaddr *)&data->nfs_server.address,
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index e1ebdbe40032..9c2955f67f70 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -881,6 +881,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
+ /* len == 0 means wake all */
+ struct userfaultfd_wake_range range = { .len = 0, };
+ unsigned long new_flags;
++ bool still_valid;
+
+ WRITE_ONCE(ctx->released, true);
+
+@@ -896,8 +897,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
+ * taking the mmap_sem for writing.
+ */
+ down_write(&mm->mmap_sem);
+- if (!mmget_still_valid(mm))
+- goto skip_mm;
++ still_valid = mmget_still_valid(mm);
+ prev = NULL;
+ for (vma = mm->mmap; vma; vma = vma->vm_next) {
+ cond_resched();
+@@ -908,19 +908,20 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
+ continue;
+ }
+ new_flags = vma->vm_flags & ~(VM_UFFD_MISSING | VM_UFFD_WP);
+- prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
+- new_flags, vma->anon_vma,
+- vma->vm_file, vma->vm_pgoff,
+- vma_policy(vma),
+- NULL_VM_UFFD_CTX);
+- if (prev)
+- vma = prev;
+- else
+- prev = vma;
++ if (still_valid) {
++ prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
++ new_flags, vma->anon_vma,
++ vma->vm_file, vma->vm_pgoff,
++ vma_policy(vma),
++ NULL_VM_UFFD_CTX);
++ if (prev)
++ vma = prev;
++ else
++ prev = vma;
++ }
+ vma->vm_flags = new_flags;
+ vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+ }
+-skip_mm:
+ up_write(&mm->mmap_sem);
+ mmput(mm);
+ wakeup:
+diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
+index c6299f82a6e4..6410d3e00ce0 100644
+--- a/fs/xfs/libxfs/xfs_attr.c
++++ b/fs/xfs/libxfs/xfs_attr.c
+@@ -191,6 +191,121 @@ xfs_attr_calc_size(
+ return nblks;
+ }
+
++STATIC int
++xfs_attr_try_sf_addname(
++ struct xfs_inode *dp,
++ struct xfs_da_args *args)
++{
++
++ struct xfs_mount *mp = dp->i_mount;
++ int error, error2;
++
++ error = xfs_attr_shortform_addname(args);
++ if (error == -ENOSPC)
++ return error;
++
++ /*
++ * Commit the shortform mods, and we're done.
++ * NOTE: this is also the error path (EEXIST, etc).
++ */
++ if (!error && (args->flags & ATTR_KERNOTIME) == 0)
++ xfs_trans_ichgtime(args->trans, dp, XFS_ICHGTIME_CHG);
++
++ if (mp->m_flags & XFS_MOUNT_WSYNC)
++ xfs_trans_set_sync(args->trans);
++
++ error2 = xfs_trans_commit(args->trans);
++ args->trans = NULL;
++ return error ? error : error2;
++}
++
++/*
++ * Set the attribute specified in @args.
++ */
++int
++xfs_attr_set_args(
++ struct xfs_da_args *args)
++{
++ struct xfs_inode *dp = args->dp;
++ struct xfs_buf *leaf_bp = NULL;
++ int error;
++
++ /*
++ * If the attribute list is non-existent or a shortform list,
++ * upgrade it to a single-leaf-block attribute list.
++ */
++ if (dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL ||
++ (dp->i_d.di_aformat == XFS_DINODE_FMT_EXTENTS &&
++ dp->i_d.di_anextents == 0)) {
++
++ /*
++ * Build initial attribute list (if required).
++ */
++ if (dp->i_d.di_aformat == XFS_DINODE_FMT_EXTENTS)
++ xfs_attr_shortform_create(args);
++
++ /*
++ * Try to add the attr to the attribute list in the inode.
++ */
++ error = xfs_attr_try_sf_addname(dp, args);
++ if (error != -ENOSPC)
++ return error;
++
++ /*
++ * It won't fit in the shortform, transform to a leaf block.
++ * GROT: another possible req'mt for a double-split btree op.
++ */
++ error = xfs_attr_shortform_to_leaf(args, &leaf_bp);
++ if (error)
++ return error;
++
++ /*
++ * Prevent the leaf buffer from being unlocked so that a
++ * concurrent AIL push cannot grab the half-baked leaf
++ * buffer and run into problems with the write verifier.
++ * Once we're done rolling the transaction we can release
++ * the hold and add the attr to the leaf.
++ */
++ xfs_trans_bhold(args->trans, leaf_bp);
++ error = xfs_defer_finish(&args->trans);
++ xfs_trans_bhold_release(args->trans, leaf_bp);
++ if (error) {
++ xfs_trans_brelse(args->trans, leaf_bp);
++ return error;
++ }
++ }
++
++ if (xfs_bmap_one_block(dp, XFS_ATTR_FORK))
++ error = xfs_attr_leaf_addname(args);
++ else
++ error = xfs_attr_node_addname(args);
++ return error;
++}
++
++/*
++ * Remove the attribute specified in @args.
++ */
++int
++xfs_attr_remove_args(
++ struct xfs_da_args *args)
++{
++ struct xfs_inode *dp = args->dp;
++ int error;
++
++ if (!xfs_inode_hasattr(dp)) {
++ error = -ENOATTR;
++ } else if (dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL) {
++ ASSERT(dp->i_afp->if_flags & XFS_IFINLINE);
++ error = xfs_attr_shortform_remove(args);
++ } else if (xfs_bmap_one_block(dp, XFS_ATTR_FORK)) {
++ error = xfs_attr_leaf_removename(args);
++ } else {
++ error = xfs_attr_node_removename(args);
++ }
++
++ return error;
++}
++
+ int
+ xfs_attr_set(
+ struct xfs_inode *dp,
+@@ -200,11 +315,10 @@ xfs_attr_set(
+ int flags)
+ {
+ struct xfs_mount *mp = dp->i_mount;
+- struct xfs_buf *leaf_bp = NULL;
+ struct xfs_da_args args;
+ struct xfs_trans_res tres;
+ int rsvd = (flags & ATTR_ROOT) != 0;
+- int error, err2, local;
++ int error, local;
+
+ XFS_STATS_INC(mp, xs_attr_set);
+
+@@ -255,93 +369,17 @@ xfs_attr_set(
+ error = xfs_trans_reserve_quota_nblks(args.trans, dp, args.total, 0,
+ rsvd ? XFS_QMOPT_RES_REGBLKS | XFS_QMOPT_FORCE_RES :
+ XFS_QMOPT_RES_REGBLKS);
+- if (error) {
+- xfs_iunlock(dp, XFS_ILOCK_EXCL);
+- xfs_trans_cancel(args.trans);
+- return error;
+- }
++ if (error)
++ goto out_trans_cancel;
+
+ xfs_trans_ijoin(args.trans, dp, 0);
+-
+- /*
+- * If the attribute list is non-existent or a shortform list,
+- * upgrade it to a single-leaf-block attribute list.
+- */
+- if (dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL ||
+- (dp->i_d.di_aformat == XFS_DINODE_FMT_EXTENTS &&
+- dp->i_d.di_anextents == 0)) {
+-
+- /*
+- * Build initial attribute list (if required).
+- */
+- if (dp->i_d.di_aformat == XFS_DINODE_FMT_EXTENTS)
+- xfs_attr_shortform_create(&args);
+-
+- /*
+- * Try to add the attr to the attribute list in
+- * the inode.
+- */
+- error = xfs_attr_shortform_addname(&args);
+- if (error != -ENOSPC) {
+- /*
+- * Commit the shortform mods, and we're done.
+- * NOTE: this is also the error path (EEXIST, etc).
+- */
+- ASSERT(args.trans != NULL);
+-
+- /*
+- * If this is a synchronous mount, make sure that
+- * the transaction goes to disk before returning
+- * to the user.
+- */
+- if (mp->m_flags & XFS_MOUNT_WSYNC)
+- xfs_trans_set_sync(args.trans);
+-
+- if (!error && (flags & ATTR_KERNOTIME) == 0) {
+- xfs_trans_ichgtime(args.trans, dp,
+- XFS_ICHGTIME_CHG);
+- }
+- err2 = xfs_trans_commit(args.trans);
+- xfs_iunlock(dp, XFS_ILOCK_EXCL);
+-
+- return error ? error : err2;
+- }
+-
+- /*
+- * It won't fit in the shortform, transform to a leaf block.
+- * GROT: another possible req'mt for a double-split btree op.
+- */
+- error = xfs_attr_shortform_to_leaf(&args, &leaf_bp);
+- if (error)
+- goto out;
+- /*
+- * Prevent the leaf buffer from being unlocked so that a
+- * concurrent AIL push cannot grab the half-baked leaf
+- * buffer and run into problems with the write verifier.
+- */
+- xfs_trans_bhold(args.trans, leaf_bp);
+- error = xfs_defer_finish(&args.trans);
+- if (error)
+- goto out;
+-
+- /*
+- * Commit the leaf transformation. We'll need another (linked)
+- * transaction to add the new attribute to the leaf, which
+- * means that we have to hold & join the leaf buffer here too.
+- */
+- error = xfs_trans_roll_inode(&args.trans, dp);
+- if (error)
+- goto out;
+- xfs_trans_bjoin(args.trans, leaf_bp);
+- leaf_bp = NULL;
+- }
+-
+- if (xfs_bmap_one_block(dp, XFS_ATTR_FORK))
+- error = xfs_attr_leaf_addname(&args);
+- else
+- error = xfs_attr_node_addname(&args);
++ error = xfs_attr_set_args(&args);
+ if (error)
+- goto out;
++ goto out_trans_cancel;
++ if (!args.trans) {
++ /* shortform attribute has already been committed */
++ goto out_unlock;
++ }
+
+ /*
+ * If this is a synchronous mount, make sure that the
+@@ -358,17 +396,14 @@ xfs_attr_set(
+ */
+ xfs_trans_log_inode(args.trans, dp, XFS_ILOG_CORE);
+ error = xfs_trans_commit(args.trans);
++out_unlock:
+ xfs_iunlock(dp, XFS_ILOCK_EXCL);
+-
+ return error;
+
+-out:
+- if (leaf_bp)
+- xfs_trans_brelse(args.trans, leaf_bp);
++out_trans_cancel:
+ if (args.trans)
+ xfs_trans_cancel(args.trans);
+- xfs_iunlock(dp, XFS_ILOCK_EXCL);
+- return error;
++ goto out_unlock;
+ }
+
+ /*
+@@ -423,17 +458,7 @@ xfs_attr_remove(
+ */
+ xfs_trans_ijoin(args.trans, dp, 0);
+
+- if (!xfs_inode_hasattr(dp)) {
+- error = -ENOATTR;
+- } else if (dp->i_d.di_aformat == XFS_DINODE_FMT_LOCAL) {
+- ASSERT(dp->i_afp->if_flags & XFS_IFINLINE);
+- error = xfs_attr_shortform_remove(&args);
+- } else if (xfs_bmap_one_block(dp, XFS_ATTR_FORK)) {
+- error = xfs_attr_leaf_removename(&args);
+- } else {
+- error = xfs_attr_node_removename(&args);
+- }
+-
++ error = xfs_attr_remove_args(&args);
+ if (error)
+ goto out;
+
+diff --git a/fs/xfs/libxfs/xfs_attr.h b/fs/xfs/libxfs/xfs_attr.h
+new file mode 100644
+index 000000000000..cc04ee0aacfb
+--- /dev/null
++++ b/fs/xfs/libxfs/xfs_attr.h
+@@ -0,0 +1,150 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2000,2002-2003,2005 Silicon Graphics, Inc.
++ * All Rights Reserved.
++ */
++#ifndef __XFS_ATTR_H__
++#define __XFS_ATTR_H__
++
++struct xfs_inode;
++struct xfs_da_args;
++struct xfs_attr_list_context;
++
++/*
++ * Large attribute lists are structured around Btrees where all the data
++ * elements are in the leaf nodes. Attribute names are hashed into an int,
++ * then that int is used as the index into the Btree. Since the hashval
++ * of an attribute name may not be unique, we may have duplicate keys.
++ * The internal links in the Btree are logical block offsets into the file.
++ *
++ * Small attribute lists use a different format and are packed as tightly
++ * as possible so as to fit into the literal area of the inode.
++ */
++
++/*========================================================================
++ * External interfaces
++ *========================================================================*/
++
++
++#define ATTR_DONTFOLLOW 0x0001 /* -- unused, from IRIX -- */
++#define ATTR_ROOT 0x0002 /* use attrs in root (trusted) namespace */
++#define ATTR_TRUST 0x0004 /* -- unused, from IRIX -- */
++#define ATTR_SECURE 0x0008 /* use attrs in security namespace */
++#define ATTR_CREATE 0x0010 /* pure create: fail if attr already exists */
++#define ATTR_REPLACE 0x0020 /* pure set: fail if attr does not exist */
++
++#define ATTR_KERNOTIME 0x1000 /* [kernel] don't update inode timestamps */
++#define ATTR_KERNOVAL 0x2000 /* [kernel] get attr size only, not value */
++
++#define ATTR_INCOMPLETE 0x4000 /* [kernel] return INCOMPLETE attr keys */
++
++#define XFS_ATTR_FLAGS \
++ { ATTR_DONTFOLLOW, "DONTFOLLOW" }, \
++ { ATTR_ROOT, "ROOT" }, \
++ { ATTR_TRUST, "TRUST" }, \
++ { ATTR_SECURE, "SECURE" }, \
++ { ATTR_CREATE, "CREATE" }, \
++ { ATTR_REPLACE, "REPLACE" }, \
++ { ATTR_KERNOTIME, "KERNOTIME" }, \
++ { ATTR_KERNOVAL, "KERNOVAL" }, \
++ { ATTR_INCOMPLETE, "INCOMPLETE" }
++
++/*
++ * The maximum size (into the kernel or returned from the kernel) of an
++ * attribute value or the buffer used for an attr_list() call. Larger
++ * sizes will result in an ERANGE return code.
++ */
++#define ATTR_MAX_VALUELEN (64*1024) /* max length of a value */
++
++/*
++ * Define how lists of attribute names are returned to the user from
++ * the attr_list() call. A large, 32bit aligned, buffer is passed in
++ * along with its size. We put an array of offsets at the top that each
++ * reference an attrlist_ent_t and pack the attrlist_ent_t's at the bottom.
++ */
++typedef struct attrlist {
++ __s32 al_count; /* number of entries in attrlist */
++ __s32 al_more; /* T/F: more attrs (do call again) */
++ __s32 al_offset[1]; /* byte offsets of attrs [var-sized] */
++} attrlist_t;
++
++/*
++ * Show the interesting info about one attribute. This is what the
++ * al_offset[i] entry points to.
++ */
++typedef struct attrlist_ent { /* data from attr_list() */
++ __u32 a_valuelen; /* number bytes in value of attr */
++ char a_name[1]; /* attr name (NULL terminated) */
++} attrlist_ent_t;
++
++/*
++ * Given a pointer to the (char*) buffer containing the attr_list() result,
++ * and an index, return a pointer to the indicated attribute in the buffer.
++ */
++#define ATTR_ENTRY(buffer, index) \
++ ((attrlist_ent_t *) \
++ &((char *)buffer)[ ((attrlist_t *)(buffer))->al_offset[index] ])
++
++/*
++ * Kernel-internal version of the attrlist cursor.
++ */
++typedef struct attrlist_cursor_kern {
++ __u32 hashval; /* hash value of next entry to add */
++ __u32 blkno; /* block containing entry (suggestion) */
++ __u32 offset; /* offset in list of equal-hashvals */
++ __u16 pad1; /* padding to match user-level */
++ __u8 pad2; /* padding to match user-level */
++ __u8 initted; /* T/F: cursor has been initialized */
++} attrlist_cursor_kern_t;
++
++
++/*========================================================================
++ * Structure used to pass context around among the routines.
++ *========================================================================*/
++
++
++/* void; state communicated via *context */
++typedef void (*put_listent_func_t)(struct xfs_attr_list_context *, int,
++ unsigned char *, int, int);
++
++typedef struct xfs_attr_list_context {
++ struct xfs_trans *tp;
++ struct xfs_inode *dp; /* inode */
++ struct attrlist_cursor_kern *cursor; /* position in list */
++ char *alist; /* output buffer */
++ int seen_enough; /* T/F: seen enough of list? */
++ ssize_t count; /* num used entries */
++ int dupcnt; /* count dup hashvals seen */
++ int bufsize; /* total buffer size */
++ int firstu; /* first used byte in buffer */
++ int flags; /* from VOP call */
++ int resynch; /* T/F: resynch with cursor */
++ put_listent_func_t put_listent; /* list output fmt function */
++ int index; /* index into output buffer */
++} xfs_attr_list_context_t;
++
++
++/*========================================================================
++ * Function prototypes for the kernel.
++ *========================================================================*/
++
++/*
++ * Overall external interface routines.
++ */
++int xfs_attr_inactive(struct xfs_inode *dp);
++int xfs_attr_list_int_ilocked(struct xfs_attr_list_context *);
++int xfs_attr_list_int(struct xfs_attr_list_context *);
++int xfs_inode_hasattr(struct xfs_inode *ip);
++int xfs_attr_get_ilocked(struct xfs_inode *ip, struct xfs_da_args *args);
++int xfs_attr_get(struct xfs_inode *ip, const unsigned char *name,
++ unsigned char *value, int *valuelenp, int flags);
++int xfs_attr_set(struct xfs_inode *dp, const unsigned char *name,
++ unsigned char *value, int valuelen, int flags);
++int xfs_attr_set_args(struct xfs_da_args *args);
++int xfs_attr_remove(struct xfs_inode *dp, const unsigned char *name, int flags);
++int xfs_attr_remove_args(struct xfs_da_args *args);
++int xfs_attr_list(struct xfs_inode *dp, char *buffer, int bufsize,
++ int flags, struct attrlist_cursor_kern *cursor);
++
++
++#endif /* __XFS_ATTR_H__ */
+diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
+index 3a496ffe6551..06a7da8dbda5 100644
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -1019,6 +1019,34 @@ xfs_bmap_add_attrfork_local(
+ return -EFSCORRUPTED;
+ }
+
++/* Set an inode attr fork off based on the format */
++int
++xfs_bmap_set_attrforkoff(
++ struct xfs_inode *ip,
++ int size,
++ int *version)
++{
++ switch (ip->i_d.di_format) {
++ case XFS_DINODE_FMT_DEV:
++ ip->i_d.di_forkoff = roundup(sizeof(xfs_dev_t), 8) >> 3;
++ break;
++ case XFS_DINODE_FMT_LOCAL:
++ case XFS_DINODE_FMT_EXTENTS:
++ case XFS_DINODE_FMT_BTREE:
++ ip->i_d.di_forkoff = xfs_attr_shortform_bytesfit(ip, size);
++ if (!ip->i_d.di_forkoff)
++ ip->i_d.di_forkoff = xfs_default_attroffset(ip) >> 3;
++ else if ((ip->i_mount->m_flags & XFS_MOUNT_ATTR2) && version)
++ *version = 2;
++ break;
++ default:
++ ASSERT(0);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ /*
+ * Convert inode from non-attributed to attributed.
+ * Must not be in a transaction, ip must not be locked.
+@@ -1070,26 +1098,9 @@ xfs_bmap_add_attrfork(
+
+ xfs_trans_ijoin(tp, ip, 0);
+ xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+-
+- switch (ip->i_d.di_format) {
+- case XFS_DINODE_FMT_DEV:
+- ip->i_d.di_forkoff = roundup(sizeof(xfs_dev_t), 8) >> 3;
+- break;
+- case XFS_DINODE_FMT_LOCAL:
+- case XFS_DINODE_FMT_EXTENTS:
+- case XFS_DINODE_FMT_BTREE:
+- ip->i_d.di_forkoff = xfs_attr_shortform_bytesfit(ip, size);
+- if (!ip->i_d.di_forkoff)
+- ip->i_d.di_forkoff = xfs_default_attroffset(ip) >> 3;
+- else if (mp->m_flags & XFS_MOUNT_ATTR2)
+- version = 2;
+- break;
+- default:
+- ASSERT(0);
+- error = -EINVAL;
++ error = xfs_bmap_set_attrforkoff(ip, size, &version);
++ if (error)
+ goto trans_cancel;
+- }
+-
+ ASSERT(ip->i_afp == NULL);
+ ip->i_afp = kmem_zone_zalloc(xfs_ifork_zone, KM_SLEEP);
+ ip->i_afp->if_flags = XFS_IFEXTENTS;
+@@ -1178,7 +1189,10 @@ xfs_iread_extents(
+ * Root level must use BMAP_BROOT_PTR_ADDR macro to get ptr out.
+ */
+ level = be16_to_cpu(block->bb_level);
+- ASSERT(level > 0);
++ if (unlikely(level == 0)) {
++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp);
++ return -EFSCORRUPTED;
++ }
+ pp = XFS_BMAP_BROOT_PTR_ADDR(mp, block, 1, ifp->if_broot_bytes);
+ bno = be64_to_cpu(*pp);
+
+diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h
+index b6e9b639e731..488dc8860fd7 100644
+--- a/fs/xfs/libxfs/xfs_bmap.h
++++ b/fs/xfs/libxfs/xfs_bmap.h
+@@ -183,6 +183,7 @@ void xfs_trim_extent(struct xfs_bmbt_irec *irec, xfs_fileoff_t bno,
+ xfs_filblks_t len);
+ void xfs_trim_extent_eof(struct xfs_bmbt_irec *, struct xfs_inode *);
+ int xfs_bmap_add_attrfork(struct xfs_inode *ip, int size, int rsvd);
++int xfs_bmap_set_attrforkoff(struct xfs_inode *ip, int size, int *version);
+ void xfs_bmap_local_to_extents_empty(struct xfs_inode *ip, int whichfork);
+ void __xfs_bmap_add_free(struct xfs_trans *tp, xfs_fsblock_t bno,
+ xfs_filblks_t len, struct xfs_owner_info *oinfo,
+diff --git a/fs/xfs/libxfs/xfs_defer.c b/fs/xfs/libxfs/xfs_defer.c
+index e792b167150a..c52beee31836 100644
+--- a/fs/xfs/libxfs/xfs_defer.c
++++ b/fs/xfs/libxfs/xfs_defer.c
+@@ -266,13 +266,15 @@ xfs_defer_trans_roll(
+
+ trace_xfs_defer_trans_roll(tp, _RET_IP_);
+
+- /* Roll the transaction. */
++ /*
++ * Roll the transaction. Rolling always given a new transaction (even
++ * if committing the old one fails!) to hand back to the caller, so we
++ * join the held resources to the new transaction so that we always
++ * return with the held resources joined to @tpp, no matter what
++ * happened.
++ */
+ error = xfs_trans_roll(tpp);
+ tp = *tpp;
+- if (error) {
+- trace_xfs_defer_trans_roll_error(tp, error);
+- return error;
+- }
+
+ /* Rejoin the joined inodes. */
+ for (i = 0; i < ipcount; i++)
+@@ -284,6 +286,8 @@ xfs_defer_trans_roll(
+ xfs_trans_bhold(tp, bplist[i]);
+ }
+
++ if (error)
++ trace_xfs_defer_trans_roll_error(tp, error);
+ return error;
+ }
+
+diff --git a/fs/xfs/xfs_attr.h b/fs/xfs/xfs_attr.h
+deleted file mode 100644
+index 033ff8c478e2..000000000000
+--- a/fs/xfs/xfs_attr.h
++++ /dev/null
+@@ -1,148 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * Copyright (c) 2000,2002-2003,2005 Silicon Graphics, Inc.
+- * All Rights Reserved.
+- */
+-#ifndef __XFS_ATTR_H__
+-#define __XFS_ATTR_H__
+-
+-struct xfs_inode;
+-struct xfs_da_args;
+-struct xfs_attr_list_context;
+-
+-/*
+- * Large attribute lists are structured around Btrees where all the data
+- * elements are in the leaf nodes. Attribute names are hashed into an int,
+- * then that int is used as the index into the Btree. Since the hashval
+- * of an attribute name may not be unique, we may have duplicate keys.
+- * The internal links in the Btree are logical block offsets into the file.
+- *
+- * Small attribute lists use a different format and are packed as tightly
+- * as possible so as to fit into the literal area of the inode.
+- */
+-
+-/*========================================================================
+- * External interfaces
+- *========================================================================*/
+-
+-
+-#define ATTR_DONTFOLLOW 0x0001 /* -- unused, from IRIX -- */
+-#define ATTR_ROOT 0x0002 /* use attrs in root (trusted) namespace */
+-#define ATTR_TRUST 0x0004 /* -- unused, from IRIX -- */
+-#define ATTR_SECURE 0x0008 /* use attrs in security namespace */
+-#define ATTR_CREATE 0x0010 /* pure create: fail if attr already exists */
+-#define ATTR_REPLACE 0x0020 /* pure set: fail if attr does not exist */
+-
+-#define ATTR_KERNOTIME 0x1000 /* [kernel] don't update inode timestamps */
+-#define ATTR_KERNOVAL 0x2000 /* [kernel] get attr size only, not value */
+-
+-#define ATTR_INCOMPLETE 0x4000 /* [kernel] return INCOMPLETE attr keys */
+-
+-#define XFS_ATTR_FLAGS \
+- { ATTR_DONTFOLLOW, "DONTFOLLOW" }, \
+- { ATTR_ROOT, "ROOT" }, \
+- { ATTR_TRUST, "TRUST" }, \
+- { ATTR_SECURE, "SECURE" }, \
+- { ATTR_CREATE, "CREATE" }, \
+- { ATTR_REPLACE, "REPLACE" }, \
+- { ATTR_KERNOTIME, "KERNOTIME" }, \
+- { ATTR_KERNOVAL, "KERNOVAL" }, \
+- { ATTR_INCOMPLETE, "INCOMPLETE" }
+-
+-/*
+- * The maximum size (into the kernel or returned from the kernel) of an
+- * attribute value or the buffer used for an attr_list() call. Larger
+- * sizes will result in an ERANGE return code.
+- */
+-#define ATTR_MAX_VALUELEN (64*1024) /* max length of a value */
+-
+-/*
+- * Define how lists of attribute names are returned to the user from
+- * the attr_list() call. A large, 32bit aligned, buffer is passed in
+- * along with its size. We put an array of offsets at the top that each
+- * reference an attrlist_ent_t and pack the attrlist_ent_t's at the bottom.
+- */
+-typedef struct attrlist {
+- __s32 al_count; /* number of entries in attrlist */
+- __s32 al_more; /* T/F: more attrs (do call again) */
+- __s32 al_offset[1]; /* byte offsets of attrs [var-sized] */
+-} attrlist_t;
+-
+-/*
+- * Show the interesting info about one attribute. This is what the
+- * al_offset[i] entry points to.
+- */
+-typedef struct attrlist_ent { /* data from attr_list() */
+- __u32 a_valuelen; /* number bytes in value of attr */
+- char a_name[1]; /* attr name (NULL terminated) */
+-} attrlist_ent_t;
+-
+-/*
+- * Given a pointer to the (char*) buffer containing the attr_list() result,
+- * and an index, return a pointer to the indicated attribute in the buffer.
+- */
+-#define ATTR_ENTRY(buffer, index) \
+- ((attrlist_ent_t *) \
+- &((char *)buffer)[ ((attrlist_t *)(buffer))->al_offset[index] ])
+-
+-/*
+- * Kernel-internal version of the attrlist cursor.
+- */
+-typedef struct attrlist_cursor_kern {
+- __u32 hashval; /* hash value of next entry to add */
+- __u32 blkno; /* block containing entry (suggestion) */
+- __u32 offset; /* offset in list of equal-hashvals */
+- __u16 pad1; /* padding to match user-level */
+- __u8 pad2; /* padding to match user-level */
+- __u8 initted; /* T/F: cursor has been initialized */
+-} attrlist_cursor_kern_t;
+-
+-
+-/*========================================================================
+- * Structure used to pass context around among the routines.
+- *========================================================================*/
+-
+-
+-/* void; state communicated via *context */
+-typedef void (*put_listent_func_t)(struct xfs_attr_list_context *, int,
+- unsigned char *, int, int);
+-
+-typedef struct xfs_attr_list_context {
+- struct xfs_trans *tp;
+- struct xfs_inode *dp; /* inode */
+- struct attrlist_cursor_kern *cursor; /* position in list */
+- char *alist; /* output buffer */
+- int seen_enough; /* T/F: seen enough of list? */
+- ssize_t count; /* num used entries */
+- int dupcnt; /* count dup hashvals seen */
+- int bufsize; /* total buffer size */
+- int firstu; /* first used byte in buffer */
+- int flags; /* from VOP call */
+- int resynch; /* T/F: resynch with cursor */
+- put_listent_func_t put_listent; /* list output fmt function */
+- int index; /* index into output buffer */
+-} xfs_attr_list_context_t;
+-
+-
+-/*========================================================================
+- * Function prototypes for the kernel.
+- *========================================================================*/
+-
+-/*
+- * Overall external interface routines.
+- */
+-int xfs_attr_inactive(struct xfs_inode *dp);
+-int xfs_attr_list_int_ilocked(struct xfs_attr_list_context *);
+-int xfs_attr_list_int(struct xfs_attr_list_context *);
+-int xfs_inode_hasattr(struct xfs_inode *ip);
+-int xfs_attr_get_ilocked(struct xfs_inode *ip, struct xfs_da_args *args);
+-int xfs_attr_get(struct xfs_inode *ip, const unsigned char *name,
+- unsigned char *value, int *valuelenp, int flags);
+-int xfs_attr_set(struct xfs_inode *dp, const unsigned char *name,
+- unsigned char *value, int valuelen, int flags);
+-int xfs_attr_remove(struct xfs_inode *dp, const unsigned char *name, int flags);
+-int xfs_attr_list(struct xfs_inode *dp, char *buffer, int bufsize,
+- int flags, struct attrlist_cursor_kern *cursor);
+-
+-
+-#endif /* __XFS_ATTR_H__ */
+diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
+index 87e6dd5326d5..a1af984e4913 100644
+--- a/fs/xfs/xfs_dquot.c
++++ b/fs/xfs/xfs_dquot.c
+@@ -277,7 +277,8 @@ xfs_dquot_set_prealloc_limits(struct xfs_dquot *dqp)
+
+ /*
+ * Ensure that the given in-core dquot has a buffer on disk backing it, and
+- * return the buffer. This is called when the bmapi finds a hole.
++ * return the buffer locked and held. This is called when the bmapi finds a
++ * hole.
+ */
+ STATIC int
+ xfs_dquot_disk_alloc(
+@@ -355,13 +356,14 @@ xfs_dquot_disk_alloc(
+ * If everything succeeds, the caller of this function is returned a
+ * buffer that is locked and held to the transaction. The caller
+ * is responsible for unlocking any buffer passed back, either
+- * manually or by committing the transaction.
++ * manually or by committing the transaction. On error, the buffer is
++ * released and not passed back.
+ */
+ xfs_trans_bhold(tp, bp);
+ error = xfs_defer_finish(tpp);
+- tp = *tpp;
+ if (error) {
+- xfs_buf_relse(bp);
++ xfs_trans_bhold_release(*tpp, bp);
++ xfs_trans_brelse(*tpp, bp);
+ return error;
+ }
+ *bpp = bp;
+@@ -521,7 +523,6 @@ xfs_qm_dqread_alloc(
+ struct xfs_buf **bpp)
+ {
+ struct xfs_trans *tp;
+- struct xfs_buf *bp;
+ int error;
+
+ error = xfs_trans_alloc(mp, &M_RES(mp)->tr_qm_dqalloc,
+@@ -529,7 +530,7 @@ xfs_qm_dqread_alloc(
+ if (error)
+ goto err;
+
+- error = xfs_dquot_disk_alloc(&tp, dqp, &bp);
++ error = xfs_dquot_disk_alloc(&tp, dqp, bpp);
+ if (error)
+ goto err_cancel;
+
+@@ -539,10 +540,10 @@ xfs_qm_dqread_alloc(
+ * Buffer was held to the transaction, so we have to unlock it
+ * manually here because we're not passing it back.
+ */
+- xfs_buf_relse(bp);
++ xfs_buf_relse(*bpp);
++ *bpp = NULL;
+ goto err;
+ }
+- *bpp = bp;
+ return 0;
+
+ err_cancel:
+diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
+index 74047bd0c1ae..e427ad097e2e 100644
+--- a/fs/xfs/xfs_iops.c
++++ b/fs/xfs/xfs_iops.c
+@@ -803,6 +803,7 @@ xfs_setattr_nonsize(
+
+ out_cancel:
+ xfs_trans_cancel(tp);
++ xfs_iunlock(ip, XFS_ILOCK_EXCL);
+ out_dqrele:
+ xfs_qm_dqrele(udqp);
+ xfs_qm_dqrele(gdqp);
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index 147546e0c11b..815dcfa64743 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -500,10 +500,10 @@ rxrpc_tx_points;
+ #define E_(a, b) { a, b }
+
+ TRACE_EVENT(rxrpc_local,
+- TP_PROTO(struct rxrpc_local *local, enum rxrpc_local_trace op,
++ TP_PROTO(unsigned int local_debug_id, enum rxrpc_local_trace op,
+ int usage, const void *where),
+
+- TP_ARGS(local, op, usage, where),
++ TP_ARGS(local_debug_id, op, usage, where),
+
+ TP_STRUCT__entry(
+ __field(unsigned int, local )
+@@ -513,7 +513,7 @@ TRACE_EVENT(rxrpc_local,
+ ),
+
+ TP_fast_assign(
+- __entry->local = local->debug_id;
++ __entry->local = local_debug_id;
+ __entry->op = op;
+ __entry->usage = usage;
+ __entry->where = where;
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index 8e009cee6517..26814a14013c 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -294,6 +294,18 @@ static void irq_sysfs_add(int irq, struct irq_desc *desc)
+ }
+ }
+
++static void irq_sysfs_del(struct irq_desc *desc)
++{
++ /*
++ * If irq_sysfs_init() has not yet been invoked (early boot), then
++ * irq_kobj_base is NULL and the descriptor was never added.
++ * kobject_del() complains about a object with no parent, so make
++ * it conditional.
++ */
++ if (irq_kobj_base)
++ kobject_del(&desc->kobj);
++}
++
+ static int __init irq_sysfs_init(void)
+ {
+ struct irq_desc *desc;
+@@ -324,6 +336,7 @@ static struct kobj_type irq_kobj_type = {
+ };
+
+ static void irq_sysfs_add(int irq, struct irq_desc *desc) {}
++static void irq_sysfs_del(struct irq_desc *desc) {}
+
+ #endif /* CONFIG_SYSFS */
+
+@@ -437,7 +450,7 @@ static void free_desc(unsigned int irq)
+ * The sysfs entry must be serialized against a concurrent
+ * irq_sysfs_init() as well.
+ */
+- kobject_del(&desc->kobj);
++ irq_sysfs_del(desc);
+ delete_irq_desc(irq);
+
+ /*
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 6fad1864ba03..09ce8528bbdd 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -33,6 +33,7 @@
+ #include <linux/page_idle.h>
+ #include <linux/shmem_fs.h>
+ #include <linux/oom.h>
++#include <linux/page_owner.h>
+
+ #include <asm/tlb.h>
+ #include <asm/pgalloc.h>
+@@ -2477,6 +2478,9 @@ static void __split_huge_page(struct page *page, struct list_head *list,
+ }
+
+ ClearPageCompound(head);
++
++ split_page_owner(head, HPAGE_PMD_ORDER);
++
+ /* See comment in __split_huge_page_tail() */
+ if (PageAnon(head)) {
+ /* Additional pin to radix tree of swap cache */
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index 9da65552e7ca..c2c4f739da8f 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -53,6 +53,7 @@
+ #include <linux/zpool.h>
+ #include <linux/mount.h>
+ #include <linux/migrate.h>
++#include <linux/wait.h>
+ #include <linux/pagemap.h>
+ #include <linux/fs.h>
+
+@@ -267,6 +268,10 @@ struct zs_pool {
+ #ifdef CONFIG_COMPACTION
+ struct inode *inode;
+ struct work_struct free_work;
++ /* A wait queue for when migration races with async_free_zspage() */
++ struct wait_queue_head migration_wait;
++ atomic_long_t isolated_pages;
++ bool destroying;
+ #endif
+ };
+
+@@ -1882,6 +1887,31 @@ static void dec_zspage_isolation(struct zspage *zspage)
+ zspage->isolated--;
+ }
+
++static void putback_zspage_deferred(struct zs_pool *pool,
++ struct size_class *class,
++ struct zspage *zspage)
++{
++ enum fullness_group fg;
++
++ fg = putback_zspage(class, zspage);
++ if (fg == ZS_EMPTY)
++ schedule_work(&pool->free_work);
++
++}
++
++static inline void zs_pool_dec_isolated(struct zs_pool *pool)
++{
++ VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
++ atomic_long_dec(&pool->isolated_pages);
++ /*
++ * There's no possibility of racing, since wait_for_isolated_drain()
++ * checks the isolated count under &class->lock after enqueuing
++ * on migration_wait.
++ */
++ if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
++ wake_up_all(&pool->migration_wait);
++}
++
+ static void replace_sub_page(struct size_class *class, struct zspage *zspage,
+ struct page *newpage, struct page *oldpage)
+ {
+@@ -1951,6 +1981,7 @@ static bool zs_page_isolate(struct page *page, isolate_mode_t mode)
+ */
+ if (!list_empty(&zspage->list) && !is_zspage_isolated(zspage)) {
+ get_zspage_mapping(zspage, &class_idx, &fullness);
++ atomic_long_inc(&pool->isolated_pages);
+ remove_zspage(class, zspage, fullness);
+ }
+
+@@ -2050,8 +2081,16 @@ static int zs_page_migrate(struct address_space *mapping, struct page *newpage,
+ * Page migration is done so let's putback isolated zspage to
+ * the list if @page is final isolated subpage in the zspage.
+ */
+- if (!is_zspage_isolated(zspage))
+- putback_zspage(class, zspage);
++ if (!is_zspage_isolated(zspage)) {
++ /*
++ * We cannot race with zs_destroy_pool() here because we wait
++ * for isolation to hit zero before we start destroying.
++ * Also, we ensure that everyone can see pool->destroying before
++ * we start waiting.
++ */
++ putback_zspage_deferred(pool, class, zspage);
++ zs_pool_dec_isolated(pool);
++ }
+
+ reset_page(page);
+ put_page(page);
+@@ -2097,13 +2136,12 @@ static void zs_page_putback(struct page *page)
+ spin_lock(&class->lock);
+ dec_zspage_isolation(zspage);
+ if (!is_zspage_isolated(zspage)) {
+- fg = putback_zspage(class, zspage);
+ /*
+ * Due to page_lock, we cannot free zspage immediately
+ * so let's defer.
+ */
+- if (fg == ZS_EMPTY)
+- schedule_work(&pool->free_work);
++ putback_zspage_deferred(pool, class, zspage);
++ zs_pool_dec_isolated(pool);
+ }
+ spin_unlock(&class->lock);
+ }
+@@ -2127,8 +2165,36 @@ static int zs_register_migration(struct zs_pool *pool)
+ return 0;
+ }
+
++static bool pool_isolated_are_drained(struct zs_pool *pool)
++{
++ return atomic_long_read(&pool->isolated_pages) == 0;
++}
++
++/* Function for resolving migration */
++static void wait_for_isolated_drain(struct zs_pool *pool)
++{
++
++ /*
++ * We're in the process of destroying the pool, so there are no
++ * active allocations. zs_page_isolate() fails for completely free
++ * zspages, so we need only wait for the zs_pool's isolated
++ * count to hit zero.
++ */
++ wait_event(pool->migration_wait,
++ pool_isolated_are_drained(pool));
++}
++
+ static void zs_unregister_migration(struct zs_pool *pool)
+ {
++ pool->destroying = true;
++ /*
++ * We need a memory barrier here to ensure global visibility of
++ * pool->destroying. Thus pool->isolated pages will either be 0 in which
++ * case we don't care, or it will be > 0 and pool->destroying will
++ * ensure that we wake up once isolation hits 0.
++ */
++ smp_mb();
++ wait_for_isolated_drain(pool); /* This can block */
+ flush_work(&pool->free_work);
+ iput(pool->inode);
+ }
+@@ -2366,6 +2432,8 @@ struct zs_pool *zs_create_pool(const char *name)
+ if (!pool->name)
+ goto err;
+
++ init_waitqueue_head(&pool->migration_wait);
++
+ if (create_cache(pool))
+ goto err;
+
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 995b3842ba7c..62ffc989a44a 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2274,8 +2274,10 @@ static int compat_do_replace(struct net *net, void __user *user,
+ state.buf_kern_len = size64;
+
+ ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
+- if (WARN_ON(ret < 0))
++ if (WARN_ON(ret < 0)) {
++ vfree(entries_tmp);
+ goto out_unlock;
++ }
+
+ vfree(entries_tmp);
+ tmp.entries_size = size64;
+diff --git a/net/can/gw.c b/net/can/gw.c
+index 53859346dc9a..bd2161470e45 100644
+--- a/net/can/gw.c
++++ b/net/can/gw.c
+@@ -1046,32 +1046,50 @@ static __init int cgw_module_init(void)
+ pr_info("can: netlink gateway (rev " CAN_GW_VERSION ") max_hops=%d\n",
+ max_hops);
+
+- register_pernet_subsys(&cangw_pernet_ops);
++ ret = register_pernet_subsys(&cangw_pernet_ops);
++ if (ret)
++ return ret;
++
++ ret = -ENOMEM;
+ cgw_cache = kmem_cache_create("can_gw", sizeof(struct cgw_job),
+ 0, 0, NULL);
+-
+ if (!cgw_cache)
+- return -ENOMEM;
++ goto out_cache_create;
+
+ /* set notifier */
+ notifier.notifier_call = cgw_notifier;
+- register_netdevice_notifier(¬ifier);
++ ret = register_netdevice_notifier(¬ifier);
++ if (ret)
++ goto out_register_notifier;
+
+ ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_GETROUTE,
+ NULL, cgw_dump_jobs, 0);
+- if (ret) {
+- unregister_netdevice_notifier(¬ifier);
+- kmem_cache_destroy(cgw_cache);
+- return -ENOBUFS;
+- }
+-
+- /* Only the first call to rtnl_register_module can fail */
+- rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE,
+- cgw_create_job, NULL, 0);
+- rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE,
+- cgw_remove_job, NULL, 0);
++ if (ret)
++ goto out_rtnl_register1;
++
++ ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE,
++ cgw_create_job, NULL, 0);
++ if (ret)
++ goto out_rtnl_register2;
++ ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE,
++ cgw_remove_job, NULL, 0);
++ if (ret)
++ goto out_rtnl_register3;
+
+ return 0;
++
++out_rtnl_register3:
++ rtnl_unregister(PF_CAN, RTM_NEWROUTE);
++out_rtnl_register2:
++ rtnl_unregister(PF_CAN, RTM_GETROUTE);
++out_rtnl_register1:
++ unregister_netdevice_notifier(¬ifier);
++out_register_notifier:
++ kmem_cache_destroy(cgw_cache);
++out_cache_create:
++ unregister_pernet_subsys(&cangw_pernet_ops);
++
++ return ret;
+ }
+
+ static __exit void cgw_module_exit(void)
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 60934bd8796c..76c41a84550e 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -1423,7 +1423,7 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
+ struct ceph_osds up, acting;
+ bool force_resend = false;
+ bool unpaused = false;
+- bool legacy_change;
++ bool legacy_change = false;
+ bool split = false;
+ bool sort_bitwise = ceph_osdmap_flag(osdc, CEPH_OSDMAP_SORTBITWISE);
+ bool recovery_deletes = ceph_osdmap_flag(osdc,
+@@ -1511,15 +1511,14 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
+ t->osd = acting.primary;
+ }
+
+- if (unpaused || legacy_change || force_resend ||
+- (split && con && CEPH_HAVE_FEATURE(con->peer_features,
+- RESEND_ON_SPLIT)))
++ if (unpaused || legacy_change || force_resend || split)
+ ct_res = CALC_TARGET_NEED_RESEND;
+ else
+ ct_res = CALC_TARGET_NO_ACTION;
+
+ out:
+- dout("%s t %p -> ct_res %d osd %d\n", __func__, t, ct_res, t->osd);
++ dout("%s t %p -> %d%d%d%d ct_res %d osd%d\n", __func__, t, unpaused,
++ legacy_change, force_resend, split, ct_res, t->osd);
+ return ct_res;
+ }
+
+diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+index 13ade5782847..4f01321e793c 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+@@ -230,7 +230,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
+
+ e.id = ip_to_id(map, ip);
+
+- if (opt->flags & IPSET_DIM_ONE_SRC)
++ if (opt->flags & IPSET_DIM_TWO_SRC)
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
+ else
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index 1577f2f76060..e2538c578671 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -1157,7 +1157,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
+ return -ENOENT;
+
+ write_lock_bh(&ip_set_ref_lock);
+- if (set->ref != 0) {
++ if (set->ref != 0 || set->ref_netlink != 0) {
+ ret = -IPSET_ERR_REFERENCED;
+ goto out;
+ }
+diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
+index fd87de3ed55b..16ec822e4044 100644
+--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
++++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
+@@ -95,15 +95,11 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
+ struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
+ struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
+
+- /* MAC can be src only */
+- if (!(opt->flags & IPSET_DIM_TWO_SRC))
+- return 0;
+-
+ if (skb_mac_header(skb) < skb->head ||
+ (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ return -EINVAL;
+
+- if (opt->flags & IPSET_DIM_ONE_SRC)
++ if (opt->flags & IPSET_DIM_TWO_SRC)
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
+ else
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index d76e5e58905d..7319d3ca30e9 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -195,7 +195,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
+
+ service_in_use:
+ write_unlock(&local->services_lock);
+- rxrpc_put_local(local);
++ rxrpc_unuse_local(local);
+ ret = -EADDRINUSE;
+ error_unlock:
+ release_sock(&rx->sk);
+@@ -908,7 +908,7 @@ static int rxrpc_release_sock(struct sock *sk)
+ rxrpc_queue_work(&rxnet->service_conn_reaper);
+ rxrpc_queue_work(&rxnet->client_conn_reaper);
+
+- rxrpc_put_local(rx->local);
++ rxrpc_unuse_local(rx->local);
+ rx->local = NULL;
+ key_put(rx->key);
+ rx->key = NULL;
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index 03e0fc8c183f..dfd9eab77cc8 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -258,7 +258,8 @@ struct rxrpc_security {
+ */
+ struct rxrpc_local {
+ struct rcu_head rcu;
+- atomic_t usage;
++ atomic_t active_users; /* Number of users of the local endpoint */
++ atomic_t usage; /* Number of references to the structure */
+ struct rxrpc_net *rxnet; /* The network ns in which this resides */
+ struct list_head link;
+ struct socket *socket; /* my UDP socket */
+@@ -998,6 +999,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *, const struct sockaddr_rxrpc
+ struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *);
+ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *);
+ void rxrpc_put_local(struct rxrpc_local *);
++struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *);
++void rxrpc_unuse_local(struct rxrpc_local *);
+ void rxrpc_queue_local(struct rxrpc_local *);
+ void rxrpc_destroy_all_locals(struct rxrpc_net *);
+
+@@ -1057,6 +1060,7 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *);
+ struct rxrpc_peer *rxrpc_get_peer(struct rxrpc_peer *);
+ struct rxrpc_peer *rxrpc_get_peer_maybe(struct rxrpc_peer *);
+ void rxrpc_put_peer(struct rxrpc_peer *);
++void rxrpc_put_peer_locked(struct rxrpc_peer *);
+
+ /*
+ * proc.c
+diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
+index d591f54cb91f..7965600ee5de 100644
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -1106,8 +1106,12 @@ static void rxrpc_post_packet_to_local(struct rxrpc_local *local,
+ {
+ _enter("%p,%p", local, skb);
+
+- skb_queue_tail(&local->event_queue, skb);
+- rxrpc_queue_local(local);
++ if (rxrpc_get_local_maybe(local)) {
++ skb_queue_tail(&local->event_queue, skb);
++ rxrpc_queue_local(local);
++ } else {
++ rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
++ }
+ }
+
+ /*
+@@ -1117,8 +1121,12 @@ static void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
+ {
+ CHECK_SLAB_OKAY(&local->usage);
+
+- skb_queue_tail(&local->reject_queue, skb);
+- rxrpc_queue_local(local);
++ if (rxrpc_get_local_maybe(local)) {
++ skb_queue_tail(&local->reject_queue, skb);
++ rxrpc_queue_local(local);
++ } else {
++ rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
++ }
+ }
+
+ /*
+diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
+index 10317dbdab5f..c752ad487067 100644
+--- a/net/rxrpc/local_object.c
++++ b/net/rxrpc/local_object.c
+@@ -83,6 +83,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
+ local = kzalloc(sizeof(struct rxrpc_local), GFP_KERNEL);
+ if (local) {
+ atomic_set(&local->usage, 1);
++ atomic_set(&local->active_users, 1);
+ local->rxnet = rxnet;
+ INIT_LIST_HEAD(&local->link);
+ INIT_WORK(&local->processor, rxrpc_local_processor);
+@@ -96,7 +97,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
+ local->debug_id = atomic_inc_return(&rxrpc_debug_id);
+ memcpy(&local->srx, srx, sizeof(*srx));
+ local->srx.srx_service = 0;
+- trace_rxrpc_local(local, rxrpc_local_new, 1, NULL);
++ trace_rxrpc_local(local->debug_id, rxrpc_local_new, 1, NULL);
+ }
+
+ _leave(" = %p", local);
+@@ -270,11 +271,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
+ * bind the transport socket may still fail if we're attempting
+ * to use a local address that the dying object is still using.
+ */
+- if (!rxrpc_get_local_maybe(local)) {
+- cursor = cursor->next;
+- list_del_init(&local->link);
++ if (!rxrpc_use_local(local))
+ break;
+- }
+
+ age = "old";
+ goto found;
+@@ -288,7 +286,10 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
+ if (ret < 0)
+ goto sock_error;
+
+- list_add_tail(&local->link, cursor);
++ if (cursor != &rxnet->local_endpoints)
++ list_replace_init(cursor, &local->link);
++ else
++ list_add_tail(&local->link, cursor);
+ age = "new";
+
+ found:
+@@ -324,7 +325,7 @@ struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *local)
+ int n;
+
+ n = atomic_inc_return(&local->usage);
+- trace_rxrpc_local(local, rxrpc_local_got, n, here);
++ trace_rxrpc_local(local->debug_id, rxrpc_local_got, n, here);
+ return local;
+ }
+
+@@ -338,7 +339,8 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
+ if (local) {
+ int n = atomic_fetch_add_unless(&local->usage, 1, 0);
+ if (n > 0)
+- trace_rxrpc_local(local, rxrpc_local_got, n + 1, here);
++ trace_rxrpc_local(local->debug_id, rxrpc_local_got,
++ n + 1, here);
+ else
+ local = NULL;
+ }
+@@ -346,24 +348,18 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
+ }
+
+ /*
+- * Queue a local endpoint.
++ * Queue a local endpoint and pass the caller's reference to the work item.
+ */
+ void rxrpc_queue_local(struct rxrpc_local *local)
+ {
+ const void *here = __builtin_return_address(0);
++ unsigned int debug_id = local->debug_id;
++ int n = atomic_read(&local->usage);
+
+ if (rxrpc_queue_work(&local->processor))
+- trace_rxrpc_local(local, rxrpc_local_queued,
+- atomic_read(&local->usage), here);
+-}
+-
+-/*
+- * A local endpoint reached its end of life.
+- */
+-static void __rxrpc_put_local(struct rxrpc_local *local)
+-{
+- _enter("%d", local->debug_id);
+- rxrpc_queue_work(&local->processor);
++ trace_rxrpc_local(debug_id, rxrpc_local_queued, n, here);
++ else
++ rxrpc_put_local(local);
+ }
+
+ /*
+@@ -376,10 +372,47 @@ void rxrpc_put_local(struct rxrpc_local *local)
+
+ if (local) {
+ n = atomic_dec_return(&local->usage);
+- trace_rxrpc_local(local, rxrpc_local_put, n, here);
++ trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
+
+ if (n == 0)
+- __rxrpc_put_local(local);
++ call_rcu(&local->rcu, rxrpc_local_rcu);
++ }
++}
++
++/*
++ * Start using a local endpoint.
++ */
++struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *local)
++{
++ unsigned int au;
++
++ local = rxrpc_get_local_maybe(local);
++ if (!local)
++ return NULL;
++
++ au = atomic_fetch_add_unless(&local->active_users, 1, 0);
++ if (au == 0) {
++ rxrpc_put_local(local);
++ return NULL;
++ }
++
++ return local;
++}
++
++/*
++ * Cease using a local endpoint. Once the number of active users reaches 0, we
++ * start the closure of the transport in the work processor.
++ */
++void rxrpc_unuse_local(struct rxrpc_local *local)
++{
++ unsigned int au;
++
++ if (local) {
++ au = atomic_dec_return(&local->active_users);
++ if (au == 0)
++ rxrpc_queue_local(local);
++ else
++ rxrpc_put_local(local);
+ }
+ }
+
+@@ -397,16 +430,6 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
+
+ _enter("%d", local->debug_id);
+
+- /* We can get a race between an incoming call packet queueing the
+- * processor again and the work processor starting the destruction
+- * process which will shut down the UDP socket.
+- */
+- if (local->dead) {
+- _leave(" [already dead]");
+- return;
+- }
+- local->dead = true;
+-
+ mutex_lock(&rxnet->local_mutex);
+ list_del_init(&local->link);
+ mutex_unlock(&rxnet->local_mutex);
+@@ -426,13 +449,11 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
+ */
+ rxrpc_purge_queue(&local->reject_queue);
+ rxrpc_purge_queue(&local->event_queue);
+-
+- _debug("rcu local %d", local->debug_id);
+- call_rcu(&local->rcu, rxrpc_local_rcu);
+ }
+
+ /*
+- * Process events on an endpoint
++ * Process events on an endpoint. The work item carries a ref which
++ * we must release.
+ */
+ static void rxrpc_local_processor(struct work_struct *work)
+ {
+@@ -440,13 +461,15 @@ static void rxrpc_local_processor(struct work_struct *work)
+ container_of(work, struct rxrpc_local, processor);
+ bool again;
+
+- trace_rxrpc_local(local, rxrpc_local_processing,
++ trace_rxrpc_local(local->debug_id, rxrpc_local_processing,
+ atomic_read(&local->usage), NULL);
+
+ do {
+ again = false;
+- if (atomic_read(&local->usage) == 0)
+- return rxrpc_local_destroyer(local);
++ if (atomic_read(&local->active_users) == 0) {
++ rxrpc_local_destroyer(local);
++ break;
++ }
+
+ if (!skb_queue_empty(&local->reject_queue)) {
+ rxrpc_reject_packets(local);
+@@ -458,6 +481,8 @@ static void rxrpc_local_processor(struct work_struct *work)
+ again = true;
+ }
+ } while (again);
++
++ rxrpc_put_local(local);
+ }
+
+ /*
+diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
+index bd2fa3b7caa7..dc7fdaf20445 100644
+--- a/net/rxrpc/peer_event.c
++++ b/net/rxrpc/peer_event.c
+@@ -375,7 +375,7 @@ static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet,
+ spin_lock_bh(&rxnet->peer_hash_lock);
+ list_add_tail(&peer->keepalive_link,
+ &rxnet->peer_keepalive[slot & mask]);
+- rxrpc_put_peer(peer);
++ rxrpc_put_peer_locked(peer);
+ }
+
+ spin_unlock_bh(&rxnet->peer_hash_lock);
+diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
+index 5691b7d266ca..71547e8673b9 100644
+--- a/net/rxrpc/peer_object.c
++++ b/net/rxrpc/peer_object.c
+@@ -440,6 +440,24 @@ void rxrpc_put_peer(struct rxrpc_peer *peer)
+ }
+ }
+
++/*
++ * Drop a ref on a peer record where the caller already holds the
++ * peer_hash_lock.
++ */
++void rxrpc_put_peer_locked(struct rxrpc_peer *peer)
++{
++ const void *here = __builtin_return_address(0);
++ int n;
++
++ n = atomic_dec_return(&peer->usage);
++ trace_rxrpc_peer(peer, rxrpc_peer_put, n, here);
++ if (n == 0) {
++ hash_del_rcu(&peer->hash_link);
++ list_del_init(&peer->keepalive_link);
++ kfree_rcu(peer, rcu);
++ }
++}
++
+ /*
+ * Make sure all peer records have been discarded.
+ */
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index be01f9c5d963..5d6ab4f6fd7a 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -230,6 +230,7 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
+ rxrpc_set_call_completion(call,
+ RXRPC_CALL_LOCAL_ERROR,
+ 0, ret);
++ rxrpc_notify_socket(call);
+ goto out;
+ }
+ _debug("need instant resend %d", ret);
+diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
+index 160b2764b2ad..6a8c279a4b20 100644
+--- a/sound/soc/davinci/davinci-mcasp.c
++++ b/sound/soc/davinci/davinci-mcasp.c
+@@ -1150,6 +1150,28 @@ static int davinci_mcasp_trigger(struct snd_pcm_substream *substream,
+ return ret;
+ }
+
++static int davinci_mcasp_hw_rule_slot_width(struct snd_pcm_hw_params *params,
++ struct snd_pcm_hw_rule *rule)
++{
++ struct davinci_mcasp_ruledata *rd = rule->private;
++ struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
++ struct snd_mask nfmt;
++ int i, slot_width;
++
++ snd_mask_none(&nfmt);
++ slot_width = rd->mcasp->slot_width;
++
++ for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) {
++ if (snd_mask_test(fmt, i)) {
++ if (snd_pcm_format_width(i) <= slot_width) {
++ snd_mask_set(&nfmt, i);
++ }
++ }
++ }
++
++ return snd_mask_refine(fmt, &nfmt);
++}
++
+ static const unsigned int davinci_mcasp_dai_rates[] = {
+ 8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000,
+ 88200, 96000, 176400, 192000,
+@@ -1257,7 +1279,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
+ struct davinci_mcasp_ruledata *ruledata =
+ &mcasp->ruledata[substream->stream];
+ u32 max_channels = 0;
+- int i, dir;
++ int i, dir, ret;
+ int tdm_slots = mcasp->tdm_slots;
+
+ /* Do not allow more then one stream per direction */
+@@ -1286,6 +1308,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
+ max_channels++;
+ }
+ ruledata->serializers = max_channels;
++ ruledata->mcasp = mcasp;
+ max_channels *= tdm_slots;
+ /*
+ * If the already active stream has less channels than the calculated
+@@ -1311,20 +1334,22 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
+ 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+ &mcasp->chconstr[substream->stream]);
+
+- if (mcasp->slot_width)
+- snd_pcm_hw_constraint_minmax(substream->runtime,
+- SNDRV_PCM_HW_PARAM_SAMPLE_BITS,
+- 8, mcasp->slot_width);
++ if (mcasp->slot_width) {
++ /* Only allow formats require <= slot_width bits on the bus */
++ ret = snd_pcm_hw_rule_add(substream->runtime, 0,
++ SNDRV_PCM_HW_PARAM_FORMAT,
++ davinci_mcasp_hw_rule_slot_width,
++ ruledata,
++ SNDRV_PCM_HW_PARAM_FORMAT, -1);
++ if (ret)
++ return ret;
++ }
+
+ /*
+ * If we rely on implicit BCLK divider setting we should
+ * set constraints based on what we can provide.
+ */
+ if (mcasp->bclk_master && mcasp->bclk_div == 0 && mcasp->sysclk_freq) {
+- int ret;
+-
+- ruledata->mcasp = mcasp;
+-
+ ret = snd_pcm_hw_rule_add(substream->runtime, 0,
+ SNDRV_PCM_HW_PARAM_RATE,
+ davinci_mcasp_hw_rule_rate,
+diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
+index 60d43d53a8f5..11399f81c92f 100644
+--- a/sound/soc/rockchip/rockchip_i2s.c
++++ b/sound/soc/rockchip/rockchip_i2s.c
+@@ -329,7 +329,6 @@ static int rockchip_i2s_hw_params(struct snd_pcm_substream *substream,
+ val |= I2S_CHN_4;
+ break;
+ case 2:
+- case 1:
+ val |= I2S_CHN_2;
+ break;
+ default:
+@@ -462,7 +461,7 @@ static struct snd_soc_dai_driver rockchip_i2s_dai = {
+ },
+ .capture = {
+ .stream_name = "Capture",
+- .channels_min = 1,
++ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_8000_192000,
+ .formats = (SNDRV_PCM_FMTBIT_S8 |
+@@ -662,7 +661,7 @@ static int rockchip_i2s_probe(struct platform_device *pdev)
+ }
+
+ if (!of_property_read_u32(node, "rockchip,capture-channels", &val)) {
+- if (val >= 1 && val <= 8)
++ if (val >= 2 && val <= 8)
+ soc_dai->capture.channels_max = val;
+ }
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 62aa320c2070..dafc3b7f8d72 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1513,8 +1513,11 @@ static int soc_probe_link_dais(struct snd_soc_card *card,
+ }
+ }
+
+- if (dai_link->dai_fmt)
+- snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
++ if (dai_link->dai_fmt) {
++ ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
++ if (ret)
++ return ret;
++ }
+
+ ret = soc_post_component_init(rtd, dai_link->name);
+ if (ret)
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 3bfc788372f3..4ce57510b623 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -1145,8 +1145,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget,
+ list_add_tail(&widget->work_list, list);
+
+ if (custom_stop_condition && custom_stop_condition(widget, dir)) {
+- widget->endpoints[dir] = 1;
+- return widget->endpoints[dir];
++ list = NULL;
++ custom_stop_condition = NULL;
+ }
+
+ if ((widget->is_ep & SND_SOC_DAPM_DIR_TO_EP(dir)) && widget->connected) {
+@@ -1183,8 +1183,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget,
+ *
+ * Optionally, can be supplied with a function acting as a stopping condition.
+ * This function takes the dapm widget currently being examined and the walk
+- * direction as an arguments, it should return true if the walk should be
+- * stopped and false otherwise.
++ * direction as an arguments, it should return true if widgets from that point
++ * in the graph onwards should not be added to the widget list.
+ */
+ static int is_connected_output_ep(struct snd_soc_dapm_widget *widget,
+ struct list_head *list,
+diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
+index fa56fde6e8d8..91c0a4434da2 100644
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -378,8 +378,10 @@ static u8 *alloc_data(ssize_t bytes0, int map_flags,
+
+ /* Allocate and initialize all memory on CPU#0: */
+ if (init_cpu0) {
+- orig_mask = bind_to_node(0);
+- bind_to_memnode(0);
++ int node = numa_node_of_cpu(0);
++
++ orig_mask = bind_to_node(node);
++ bind_to_memnode(node);
+ }
+
+ bytes = bytes0 + HPSIZE;
+diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
+index f42f228e8899..137955197ba8 100644
+--- a/tools/perf/builtin-ftrace.c
++++ b/tools/perf/builtin-ftrace.c
+@@ -174,7 +174,7 @@ static int set_tracing_cpumask(struct cpu_map *cpumap)
+ int last_cpu;
+
+ last_cpu = cpu_map__cpu(cpumap, cpumap->nr - 1);
+- mask_size = (last_cpu + 3) / 4 + 1;
++ mask_size = last_cpu / 4 + 2; /* one more byte for EOS */
+ mask_size += last_cpu / 32; /* ',' is needed for every 32th cpus */
+
+ cpumask = malloc(mask_size);
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index 68c92bb599ee..6b36b7110669 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -450,6 +450,7 @@ static struct fixed {
+ { "inst_retired.any_p", "event=0xc0" },
+ { "cpu_clk_unhalted.ref", "event=0x0,umask=0x03" },
+ { "cpu_clk_unhalted.thread", "event=0x3c" },
++ { "cpu_clk_unhalted.core", "event=0x3c" },
+ { "cpu_clk_unhalted.thread_any", "event=0x3c,any=1" },
+ { NULL, NULL},
+ };
+diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
+index 383674f448fc..f93846edc1e0 100644
+--- a/tools/perf/util/cpumap.c
++++ b/tools/perf/util/cpumap.c
+@@ -701,7 +701,10 @@ size_t cpu_map__snprint_mask(struct cpu_map *map, char *buf, size_t size)
+ unsigned char *bitmap;
+ int last_cpu = cpu_map__cpu(map, map->nr - 1);
+
+- bitmap = zalloc((last_cpu + 7) / 8);
++ if (buf == NULL)
++ return 0;
++
++ bitmap = zalloc(last_cpu / 8 + 1);
+ if (bitmap == NULL) {
+ buf[0] = '\0';
+ return 0;
+diff --git a/tools/testing/selftests/bpf/sendmsg6_prog.c b/tools/testing/selftests/bpf/sendmsg6_prog.c
+index 5aeaa284fc47..a68062820410 100644
+--- a/tools/testing/selftests/bpf/sendmsg6_prog.c
++++ b/tools/testing/selftests/bpf/sendmsg6_prog.c
+@@ -41,8 +41,7 @@ int sendmsg_v6_prog(struct bpf_sock_addr *ctx)
+ }
+
+ /* Rewrite destination. */
+- if ((ctx->user_ip6[0] & 0xFFFF) == bpf_htons(0xFACE) &&
+- ctx->user_ip6[0] >> 16 == bpf_htons(0xB00C)) {
++ if (ctx->user_ip6[0] == bpf_htonl(0xFACEB00C)) {
+ ctx->user_ip6[0] = bpf_htonl(DST_REWRITE_IP6_0);
+ ctx->user_ip6[1] = bpf_htonl(DST_REWRITE_IP6_1);
+ ctx->user_ip6[2] = bpf_htonl(DST_REWRITE_IP6_2);
+diff --git a/tools/testing/selftests/kvm/config b/tools/testing/selftests/kvm/config
+new file mode 100644
+index 000000000000..63ed533f73d6
+--- /dev/null
++++ b/tools/testing/selftests/kvm/config
+@@ -0,0 +1,3 @@
++CONFIG_KVM=y
++CONFIG_KVM_INTEL=y
++CONFIG_KVM_AMD=y
+diff --git a/tools/testing/selftests/net/forwarding/gre_multipath.sh b/tools/testing/selftests/net/forwarding/gre_multipath.sh
+index cca2baa03fb8..a8d8e8b3dc81 100755
+--- a/tools/testing/selftests/net/forwarding/gre_multipath.sh
++++ b/tools/testing/selftests/net/forwarding/gre_multipath.sh
+@@ -93,18 +93,10 @@ sw1_create()
+ ip route add vrf v$ol1 192.0.2.16/28 \
+ nexthop dev g1a \
+ nexthop dev g1b
+-
+- tc qdisc add dev $ul1 clsact
+- tc filter add dev $ul1 egress pref 111 prot ipv4 \
+- flower dst_ip 192.0.2.66 action pass
+- tc filter add dev $ul1 egress pref 222 prot ipv4 \
+- flower dst_ip 192.0.2.82 action pass
+ }
+
+ sw1_destroy()
+ {
+- tc qdisc del dev $ul1 clsact
+-
+ ip route del vrf v$ol1 192.0.2.16/28
+
+ ip route del vrf v$ol1 192.0.2.82/32 via 192.0.2.146
+@@ -139,10 +131,18 @@ sw2_create()
+ ip route add vrf v$ol2 192.0.2.0/28 \
+ nexthop dev g2a \
+ nexthop dev g2b
++
++ tc qdisc add dev $ul2 clsact
++ tc filter add dev $ul2 ingress pref 111 prot 802.1Q \
++ flower vlan_id 111 action pass
++ tc filter add dev $ul2 ingress pref 222 prot 802.1Q \
++ flower vlan_id 222 action pass
+ }
+
+ sw2_destroy()
+ {
++ tc qdisc del dev $ul2 clsact
++
+ ip route del vrf v$ol2 192.0.2.0/28
+
+ ip route del vrf v$ol2 192.0.2.81/32 via 192.0.2.145
+@@ -187,12 +187,16 @@ setup_prepare()
+ sw1_create
+ sw2_create
+ h2_create
++
++ forwarding_enable
+ }
+
+ cleanup()
+ {
+ pre_cleanup
+
++ forwarding_restore
++
+ h2_destroy
+ sw2_destroy
+ sw1_destroy
+@@ -211,15 +215,15 @@ multipath4_test()
+ nexthop dev g1a weight $weight1 \
+ nexthop dev g1b weight $weight2
+
+- local t0_111=$(tc_rule_stats_get $ul1 111 egress)
+- local t0_222=$(tc_rule_stats_get $ul1 222 egress)
++ local t0_111=$(tc_rule_stats_get $ul2 111 ingress)
++ local t0_222=$(tc_rule_stats_get $ul2 222 ingress)
+
+ ip vrf exec v$h1 \
+ $MZ $h1 -q -p 64 -A 192.0.2.1 -B 192.0.2.18 \
+ -d 1msec -t udp "sp=1024,dp=0-32768"
+
+- local t1_111=$(tc_rule_stats_get $ul1 111 egress)
+- local t1_222=$(tc_rule_stats_get $ul1 222 egress)
++ local t1_111=$(tc_rule_stats_get $ul2 111 ingress)
++ local t1_222=$(tc_rule_stats_get $ul2 222 ingress)
+
+ local d111=$((t1_111 - t0_111))
+ local d222=$((t1_222 - t0_222))
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-09-06 17:25 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-09-06 17:25 UTC (permalink / raw
To: gentoo-commits
commit: eaf6eee7a1521f25a2bcd2b1479df9fb2357c96e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Sep 6 17:24:41 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Sep 6 17:24:41 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=eaf6eee7
Linux patch 4.19.70 and 4.19.71
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1069_linux-4.19.70.patch | 2977 ++++++++++++++++++++++++++++++++++++++++++++++
1070_linux-4.19.71.patch | 92 ++
3 files changed, 3073 insertions(+)
diff --git a/0000_README b/0000_README
index c203203..807b793 100644
--- a/0000_README
+++ b/0000_README
@@ -319,6 +319,10 @@ Patch: 1068_linux-4.19.69.patch
From: https://www.kernel.org
Desc: Linux 4.19.69
+Patch: 1070_linux-4.19.70.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.70
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1069_linux-4.19.70.patch b/1069_linux-4.19.70.patch
new file mode 100644
index 0000000..739863e
--- /dev/null
+++ b/1069_linux-4.19.70.patch
@@ -0,0 +1,2977 @@
+diff --git a/Makefile b/Makefile
+index 677341239449..ecf8806cb71f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 69
++SUBLEVEL = 70
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index bce06083685d..94babc3d0ec2 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -165,9 +165,17 @@ static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = {
+ };
+
+ static const struct arm64_ftr_bits ftr_id_aa64mmfr0[] = {
+- S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI),
+- S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI),
+- ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI),
++ /*
++ * We already refuse to boot CPUs that don't support our configured
++ * page size, so we can only detect mismatches for a page size other
++ * than the one we're currently using. Unfortunately, SoCs like this
++ * exist in the wild so, even though we don't like it, we'll have to go
++ * along with it and treat them as non-strict.
++ */
++ S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI),
++ S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI),
++ ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI),
++
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_BIGENDEL0_SHIFT, 4, 0),
+ /* Linux shouldn't care about secure memory */
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_SNSMEM_SHIFT, 4, 0),
+diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
+index 9a3f2646ecc7..07a8004c3c23 100644
+--- a/arch/powerpc/kvm/book3s_64_vio.c
++++ b/arch/powerpc/kvm/book3s_64_vio.c
+@@ -602,8 +602,10 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu,
+
+ if (kvmppc_gpa_to_ua(vcpu->kvm,
+ tce & ~(TCE_PCI_READ | TCE_PCI_WRITE),
+- &ua, NULL))
+- return H_PARAMETER;
++ &ua, NULL)) {
++ ret = H_PARAMETER;
++ goto unlock_exit;
++ }
+
+ list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
+ ret = kvmppc_tce_iommu_map(vcpu->kvm, stt,
+diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
+index 6821ead4b4eb..eb8b11515a7f 100644
+--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
++++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
+@@ -528,8 +528,10 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu,
+ ua = 0;
+ if (kvmppc_gpa_to_ua(vcpu->kvm,
+ tce & ~(TCE_PCI_READ | TCE_PCI_WRITE),
+- &ua, NULL))
+- return H_PARAMETER;
++ &ua, NULL)) {
++ ret = H_PARAMETER;
++ goto unlock_exit;
++ }
+
+ list_for_each_entry_lockless(stit, &stt->iommu_tables, next) {
+ ret = kvmppc_rm_tce_iommu_map(vcpu->kvm, stt,
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index b316bd61a6ac..90be3a1506d3 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1140,6 +1140,10 @@ void clear_local_APIC(void)
+ apic_write(APIC_LVT0, v | APIC_LVT_MASKED);
+ v = apic_read(APIC_LVT1);
+ apic_write(APIC_LVT1, v | APIC_LVT_MASKED);
++ if (!x2apic_enabled()) {
++ v = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
++ apic_write(APIC_LDR, v);
++ }
+ if (maxlvt >= 4) {
+ v = apic_read(APIC_LVTPC);
+ apic_write(APIC_LVTPC, v | APIC_LVT_MASKED);
+diff --git a/arch/x86/kernel/apic/bigsmp_32.c b/arch/x86/kernel/apic/bigsmp_32.c
+index afee386ff711..caedd8d60d36 100644
+--- a/arch/x86/kernel/apic/bigsmp_32.c
++++ b/arch/x86/kernel/apic/bigsmp_32.c
+@@ -38,32 +38,12 @@ static int bigsmp_early_logical_apicid(int cpu)
+ return early_per_cpu(x86_cpu_to_apicid, cpu);
+ }
+
+-static inline unsigned long calculate_ldr(int cpu)
+-{
+- unsigned long val, id;
+-
+- val = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
+- id = per_cpu(x86_bios_cpu_apicid, cpu);
+- val |= SET_APIC_LOGICAL_ID(id);
+-
+- return val;
+-}
+-
+ /*
+- * Set up the logical destination ID.
+- *
+- * Intel recommends to set DFR, LDR and TPR before enabling
+- * an APIC. See e.g. "AP-388 82489DX User's Manual" (Intel
+- * document number 292116). So here it goes...
++ * bigsmp enables physical destination mode
++ * and doesn't use LDR and DFR
+ */
+ static void bigsmp_init_apic_ldr(void)
+ {
+- unsigned long val;
+- int cpu = smp_processor_id();
+-
+- apic_write(APIC_DFR, APIC_DFR_FLAT);
+- val = calculate_ldr(cpu);
+- apic_write(APIC_LDR, val);
+ }
+
+ static void bigsmp_setup_apic_routing(void)
+diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
+index aeba77881d85..516ec7586a5f 100644
+--- a/arch/x86/kernel/ptrace.c
++++ b/arch/x86/kernel/ptrace.c
+@@ -652,11 +652,10 @@ static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n)
+ {
+ struct thread_struct *thread = &tsk->thread;
+ unsigned long val = 0;
+- int index = n;
+
+ if (n < HBP_NUM) {
++ int index = array_index_nospec(n, HBP_NUM);
+ struct perf_event *bp = thread->ptrace_bps[index];
+- index = array_index_nospec(index, HBP_NUM);
+
+ if (bp)
+ val = bp->hw.info.address;
+diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
+index deb576b23b7c..9119859ba787 100644
+--- a/arch/x86/kernel/uprobes.c
++++ b/arch/x86/kernel/uprobes.c
+@@ -521,9 +521,12 @@ struct uprobe_xol_ops {
+ void (*abort)(struct arch_uprobe *, struct pt_regs *);
+ };
+
+-static inline int sizeof_long(void)
++static inline int sizeof_long(struct pt_regs *regs)
+ {
+- return in_ia32_syscall() ? 4 : 8;
++ /*
++ * Check registers for mode as in_xxx_syscall() does not apply here.
++ */
++ return user_64bit_mode(regs) ? 8 : 4;
+ }
+
+ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
+@@ -534,9 +537,9 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
+
+ static int emulate_push_stack(struct pt_regs *regs, unsigned long val)
+ {
+- unsigned long new_sp = regs->sp - sizeof_long();
++ unsigned long new_sp = regs->sp - sizeof_long(regs);
+
+- if (copy_to_user((void __user *)new_sp, &val, sizeof_long()))
++ if (copy_to_user((void __user *)new_sp, &val, sizeof_long(regs)))
+ return -EFAULT;
+
+ regs->sp = new_sp;
+@@ -569,7 +572,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
+ long correction = utask->vaddr - utask->xol_vaddr;
+ regs->ip += correction;
+ } else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
+- regs->sp += sizeof_long(); /* Pop incorrect return address */
++ regs->sp += sizeof_long(regs); /* Pop incorrect return address */
+ if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen))
+ return -ERESTART;
+ }
+@@ -688,7 +691,7 @@ static int branch_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
+ * "call" insn was executed out-of-line. Just restore ->sp and restart.
+ * We could also restore ->ip and try to call branch_emulate_op() again.
+ */
+- regs->sp += sizeof_long();
++ regs->sp += sizeof_long(regs);
+ return -ERESTART;
+ }
+
+@@ -1068,7 +1071,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
+ unsigned long
+ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
+ {
+- int rasize = sizeof_long(), nleft;
++ int rasize = sizeof_long(regs), nleft;
+ unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */
+
+ if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize))
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 031bd7f91f98..5f5bc5976804 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -209,6 +209,9 @@ static void recalculate_apic_map(struct kvm *kvm)
+ if (!apic_x2apic_mode(apic) && !new->phys_map[xapic_id])
+ new->phys_map[xapic_id] = apic;
+
++ if (!kvm_apic_sw_enabled(apic))
++ continue;
++
+ ldr = kvm_lapic_get_reg(apic, APIC_LDR);
+
+ if (apic_x2apic_mode(apic)) {
+@@ -252,6 +255,8 @@ static inline void apic_set_spiv(struct kvm_lapic *apic, u32 val)
+ recalculate_apic_map(apic->vcpu->kvm);
+ } else
+ static_key_slow_inc(&apic_sw_disabled.key);
++
++ recalculate_apic_map(apic->vcpu->kvm);
+ }
+ }
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index e10a7a42449b..c27ce6059090 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6308,12 +6308,13 @@ restart:
+ unsigned long rflags = kvm_x86_ops->get_rflags(vcpu);
+ toggle_interruptibility(vcpu, ctxt->interruptibility);
+ vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
+- kvm_rip_write(vcpu, ctxt->eip);
+- if (r == EMULATE_DONE && ctxt->tf)
+- kvm_vcpu_do_singlestep(vcpu, &r);
+ if (!ctxt->have_exception ||
+- exception_type(ctxt->exception.vector) == EXCPT_TRAP)
++ exception_type(ctxt->exception.vector) == EXCPT_TRAP) {
++ kvm_rip_write(vcpu, ctxt->eip);
++ if (r == EMULATE_DONE && ctxt->tf)
++ kvm_vcpu_do_singlestep(vcpu, &r);
+ __kvm_set_rflags(vcpu, ctxt->eflags);
++ }
+
+ /*
+ * For STI, interrupts are shadowed; so KVM_REQ_EVENT will
+diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
+index 3b25a643058c..0b8e2a7d6e93 100644
+--- a/drivers/auxdisplay/panel.c
++++ b/drivers/auxdisplay/panel.c
+@@ -1618,6 +1618,8 @@ static void panel_attach(struct parport *port)
+ return;
+
+ err_lcd_unreg:
++ if (scan_timer.function)
++ del_timer_sync(&scan_timer);
+ if (lcd.enabled)
+ charlcd_unregister(lcd.charlcd);
+ err_unreg_device:
+diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
+index a4bc74e72c39..55869b362fdf 100644
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -974,6 +974,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
+ }
+ blkif->nr_ring_pages = nr_grefs;
+
++ err = -ENOMEM;
+ for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) {
+ req = kzalloc(sizeof(*req), GFP_KERNEL);
+ if (!req)
+@@ -996,7 +997,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
+ err = xen_blkif_map(ring, ring_ref, nr_grefs, evtchn);
+ if (err) {
+ xenbus_dev_fatal(dev, err, "mapping ring-ref port %u", evtchn);
+- return err;
++ goto fail;
+ }
+
+ return 0;
+@@ -1016,8 +1017,7 @@ fail:
+ }
+ kfree(req);
+ }
+- return -ENOMEM;
+-
++ return err;
+ }
+
+ static int connect_ring(struct backend_info *be)
+diff --git a/drivers/bus/hisi_lpc.c b/drivers/bus/hisi_lpc.c
+index d5f85455fa62..e31c02dc7770 100644
+--- a/drivers/bus/hisi_lpc.c
++++ b/drivers/bus/hisi_lpc.c
+@@ -456,6 +456,17 @@ struct hisi_lpc_acpi_cell {
+ size_t pdata_size;
+ };
+
++static void hisi_lpc_acpi_remove(struct device *hostdev)
++{
++ struct acpi_device *adev = ACPI_COMPANION(hostdev);
++ struct acpi_device *child;
++
++ device_for_each_child(hostdev, NULL, hisi_lpc_acpi_remove_subdev);
++
++ list_for_each_entry(child, &adev->children, node)
++ acpi_device_clear_enumerated(child);
++}
++
+ /*
+ * hisi_lpc_acpi_probe - probe children for ACPI FW
+ * @hostdev: LPC host device pointer
+@@ -556,8 +567,7 @@ static int hisi_lpc_acpi_probe(struct device *hostdev)
+ return 0;
+
+ fail:
+- device_for_each_child(hostdev, NULL,
+- hisi_lpc_acpi_remove_subdev);
++ hisi_lpc_acpi_remove(hostdev);
+ return ret;
+ }
+
+@@ -570,6 +580,10 @@ static int hisi_lpc_acpi_probe(struct device *dev)
+ {
+ return -ENODEV;
+ }
++
++static void hisi_lpc_acpi_remove(struct device *hostdev)
++{
++}
+ #endif // CONFIG_ACPI
+
+ /*
+@@ -607,24 +621,27 @@ static int hisi_lpc_probe(struct platform_device *pdev)
+ range->fwnode = dev->fwnode;
+ range->flags = LOGIC_PIO_INDIRECT;
+ range->size = PIO_INDIRECT_SIZE;
++ range->hostdata = lpcdev;
++ range->ops = &hisi_lpc_ops;
++ lpcdev->io_host = range;
+
+ ret = logic_pio_register_range(range);
+ if (ret) {
+ dev_err(dev, "register IO range failed (%d)!\n", ret);
+ return ret;
+ }
+- lpcdev->io_host = range;
+
+ /* register the LPC host PIO resources */
+ if (acpi_device)
+ ret = hisi_lpc_acpi_probe(dev);
+ else
+ ret = of_platform_populate(dev->of_node, NULL, NULL, dev);
+- if (ret)
++ if (ret) {
++ logic_pio_unregister_range(range);
+ return ret;
++ }
+
+- lpcdev->io_host->hostdata = lpcdev;
+- lpcdev->io_host->ops = &hisi_lpc_ops;
++ dev_set_drvdata(dev, lpcdev);
+
+ io_end = lpcdev->io_host->io_start + lpcdev->io_host->size;
+ dev_info(dev, "registered range [%pa - %pa]\n",
+@@ -633,6 +650,23 @@ static int hisi_lpc_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++static int hisi_lpc_remove(struct platform_device *pdev)
++{
++ struct device *dev = &pdev->dev;
++ struct acpi_device *acpi_device = ACPI_COMPANION(dev);
++ struct hisi_lpc_dev *lpcdev = dev_get_drvdata(dev);
++ struct logic_pio_hwaddr *range = lpcdev->io_host;
++
++ if (acpi_device)
++ hisi_lpc_acpi_remove(dev);
++ else
++ of_platform_depopulate(dev);
++
++ logic_pio_unregister_range(range);
++
++ return 0;
++}
++
+ static const struct of_device_id hisi_lpc_of_match[] = {
+ { .compatible = "hisilicon,hip06-lpc", },
+ { .compatible = "hisilicon,hip07-lpc", },
+@@ -646,5 +680,6 @@ static struct platform_driver hisi_lpc_driver = {
+ .acpi_match_table = ACPI_PTR(hisi_lpc_acpi_match),
+ },
+ .probe = hisi_lpc_probe,
++ .remove = hisi_lpc_remove,
+ };
+ builtin_platform_driver(hisi_lpc_driver);
+diff --git a/drivers/crypto/ccp/ccp-dev.c b/drivers/crypto/ccp/ccp-dev.c
+index 9b6d8972a565..b8c94a01cfc9 100644
+--- a/drivers/crypto/ccp/ccp-dev.c
++++ b/drivers/crypto/ccp/ccp-dev.c
+@@ -543,6 +543,10 @@ int ccp_dev_suspend(struct sp_device *sp, pm_message_t state)
+ unsigned long flags;
+ unsigned int i;
+
++ /* If there's no device there's nothing to do */
++ if (!ccp)
++ return 0;
++
+ spin_lock_irqsave(&ccp->cmd_lock, flags);
+
+ ccp->suspending = 1;
+@@ -567,6 +571,10 @@ int ccp_dev_resume(struct sp_device *sp)
+ unsigned long flags;
+ unsigned int i;
+
++ /* If there's no device there's nothing to do */
++ if (!ccp)
++ return 0;
++
+ spin_lock_irqsave(&ccp->cmd_lock, flags);
+
+ ccp->suspending = 0;
+diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
+index f4edfc56f34e..3d55405c49ca 100644
+--- a/drivers/dma/ste_dma40.c
++++ b/drivers/dma/ste_dma40.c
+@@ -142,7 +142,7 @@ enum d40_events {
+ * when the DMA hw is powered off.
+ * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
+ */
+-static u32 d40_backup_regs[] = {
++static __maybe_unused u32 d40_backup_regs[] = {
+ D40_DREG_LCPA,
+ D40_DREG_LCLA,
+ D40_DREG_PRMSE,
+@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = {
+
+ #define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
+
+-static u32 d40_backup_regs_chan[] = {
++static __maybe_unused u32 d40_backup_regs_chan[] = {
+ D40_CHAN_REG_SSCFG,
+ D40_CHAN_REG_SSELT,
+ D40_CHAN_REG_SSPTR,
+diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
+index 06dd1725375e..8c3c3e5b812a 100644
+--- a/drivers/dma/stm32-mdma.c
++++ b/drivers/dma/stm32-mdma.c
+@@ -1376,7 +1376,7 @@ static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid)
+
+ chan = &dmadev->chan[id];
+ if (!chan) {
+- dev_err(chan2dev(chan), "MDMA channel not initialized\n");
++ dev_dbg(mdma2dev(dmadev), "MDMA channel not initialized\n");
+ goto exit;
+ }
+
+diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
+index a4a931ddf6f6..aeb9c29e5255 100644
+--- a/drivers/dma/ti/omap-dma.c
++++ b/drivers/dma/ti/omap-dma.c
+@@ -1237,7 +1237,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved(
+ if (src_icg) {
+ d->ccr |= CCR_SRC_AMODE_DBLIDX;
+ d->ei = 1;
+- d->fi = src_icg;
++ d->fi = src_icg + 1;
+ } else if (xt->src_inc) {
+ d->ccr |= CCR_SRC_AMODE_POSTINC;
+ d->fi = 0;
+@@ -1252,7 +1252,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved(
+ if (dst_icg) {
+ d->ccr |= CCR_DST_AMODE_DBLIDX;
+ sg->ei = 1;
+- sg->fi = dst_icg;
++ sg->fi = dst_icg + 1;
+ } else if (xt->dst_inc) {
+ d->ccr |= CCR_DST_AMODE_POSTINC;
+ sg->fi = 0;
+diff --git a/drivers/fsi/fsi-scom.c b/drivers/fsi/fsi-scom.c
+index df94021dd9d1..fdc0e458dbaa 100644
+--- a/drivers/fsi/fsi-scom.c
++++ b/drivers/fsi/fsi-scom.c
+@@ -47,8 +47,7 @@
+ #define SCOM_STATUS_PIB_RESP_MASK 0x00007000
+ #define SCOM_STATUS_PIB_RESP_SHIFT 12
+
+-#define SCOM_STATUS_ANY_ERR (SCOM_STATUS_ERR_SUMMARY | \
+- SCOM_STATUS_PROTECTION | \
++#define SCOM_STATUS_ANY_ERR (SCOM_STATUS_PROTECTION | \
+ SCOM_STATUS_PARITY | \
+ SCOM_STATUS_PIB_ABORT | \
+ SCOM_STATUS_PIB_RESP_MASK)
+@@ -260,11 +259,6 @@ static int handle_fsi2pib_status(struct scom_device *scom, uint32_t status)
+ /* Return -EBUSY on PIB abort to force a retry */
+ if (status & SCOM_STATUS_PIB_ABORT)
+ return -EBUSY;
+- if (status & SCOM_STATUS_ERR_SUMMARY) {
+- fsi_device_write(scom->fsi_dev, SCOM_FSI2PIB_RESET_REG, &dummy,
+- sizeof(uint32_t));
+- return -EIO;
+- }
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+index 92b11de19581..354c8b6106dc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+@@ -575,6 +575,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
+ { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
++ { 0x1002, 0x699f, 0x1028, 0x0814, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0x1002, 0x6900, 0x17AA, 0x3806, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0, 0, 0, 0, 0 },
+diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
+index 373700c05a00..224fa1ef87ff 100644
+--- a/drivers/gpu/drm/ast/ast_main.c
++++ b/drivers/gpu/drm/ast/ast_main.c
+@@ -131,8 +131,8 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post)
+
+
+ /* Enable extended register access */
+- ast_enable_mmio(dev);
+ ast_open_key(ast);
++ ast_enable_mmio(dev);
+
+ /* Find out whether P2A works or whether to use device-tree */
+ ast_detect_config_mode(dev, &scu_rev);
+@@ -576,6 +576,9 @@ void ast_driver_unload(struct drm_device *dev)
+ {
+ struct ast_private *ast = dev->dev_private;
+
++ /* enable standard VGA decode */
++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x04);
++
+ ast_release_firmware(dev);
+ kfree(ast->dp501_fw_addr);
+ ast_mode_fini(dev);
+diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
+index 8bb355d5d43d..9d92d2d2fcfc 100644
+--- a/drivers/gpu/drm/ast/ast_mode.c
++++ b/drivers/gpu/drm/ast/ast_mode.c
+@@ -600,7 +600,7 @@ static int ast_crtc_mode_set(struct drm_crtc *crtc,
+ return -EINVAL;
+ ast_open_key(ast);
+
+- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
+
+ ast_set_std_reg(crtc, adjusted_mode, &vbios_mode);
+ ast_set_crtc_reg(crtc, adjusted_mode, &vbios_mode);
+diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
+index f7d421359d56..c1d1ac51d1c2 100644
+--- a/drivers/gpu/drm/ast/ast_post.c
++++ b/drivers/gpu/drm/ast/ast_post.c
+@@ -46,7 +46,7 @@ void ast_enable_mmio(struct drm_device *dev)
+ {
+ struct ast_private *ast = dev->dev_private;
+
+- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
+ }
+
+
+diff --git a/drivers/gpu/drm/bridge/ti-tfp410.c b/drivers/gpu/drm/bridge/ti-tfp410.c
+index c3e32138c6bb..9dc109df0808 100644
+--- a/drivers/gpu/drm/bridge/ti-tfp410.c
++++ b/drivers/gpu/drm/bridge/ti-tfp410.c
+@@ -64,7 +64,12 @@ static int tfp410_get_modes(struct drm_connector *connector)
+
+ drm_connector_update_edid_property(connector, edid);
+
+- return drm_add_edid_modes(connector, edid);
++ ret = drm_add_edid_modes(connector, edid);
++
++ kfree(edid);
++
++ return ret;
++
+ fallback:
+ /* No EDID, fallback on the XGA standard modes */
+ ret = drm_add_modes_noedid(connector, 1920, 1200);
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index f8cfd16be534..a4b4ab7b9f8e 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -1120,6 +1120,12 @@ static int i915_driver_init_hw(struct drm_i915_private *dev_priv)
+
+ pci_set_master(pdev);
+
++ /*
++ * We don't have a max segment size, so set it to the max so sg's
++ * debugging layer doesn't complain
++ */
++ dma_set_max_seg_size(&pdev->dev, UINT_MAX);
++
+ /* overlay on gen2 is broken and can't address above 1G */
+ if (IS_GEN2(dev_priv)) {
+ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(30));
+diff --git a/drivers/gpu/drm/i915/i915_vgpu.c b/drivers/gpu/drm/i915/i915_vgpu.c
+index 869cf4a3b6de..a6cb3e034dd5 100644
+--- a/drivers/gpu/drm/i915/i915_vgpu.c
++++ b/drivers/gpu/drm/i915/i915_vgpu.c
+@@ -100,6 +100,9 @@ static struct _balloon_info_ bl_info;
+ static void vgt_deballoon_space(struct i915_ggtt *ggtt,
+ struct drm_mm_node *node)
+ {
++ if (!drm_mm_node_allocated(node))
++ return;
++
+ DRM_DEBUG_DRIVER("deballoon space: range [0x%llx - 0x%llx] %llu KiB.\n",
+ node->start,
+ node->start + node->size,
+diff --git a/drivers/gpu/drm/i915/intel_device_info.c b/drivers/gpu/drm/i915/intel_device_info.c
+index 0ef0c6448d53..01fa98299bae 100644
+--- a/drivers/gpu/drm/i915/intel_device_info.c
++++ b/drivers/gpu/drm/i915/intel_device_info.c
+@@ -474,7 +474,7 @@ static void broadwell_sseu_info_init(struct drm_i915_private *dev_priv)
+ u8 eu_disabled_mask;
+ u32 n_disabled;
+
+- if (!(sseu->subslice_mask[ss] & BIT(ss)))
++ if (!(sseu->subslice_mask[s] & BIT(ss)))
+ /* skip disabled subslice */
+ continue;
+
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+index 0fb300d41a09..e1868776da25 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+@@ -184,6 +184,12 @@ static void tilcdc_fini(struct drm_device *dev)
+ {
+ struct tilcdc_drm_private *priv = dev->dev_private;
+
++#ifdef CONFIG_CPU_FREQ
++ if (priv->freq_transition.notifier_call)
++ cpufreq_unregister_notifier(&priv->freq_transition,
++ CPUFREQ_TRANSITION_NOTIFIER);
++#endif
++
+ if (priv->crtc)
+ tilcdc_crtc_shutdown(priv->crtc);
+
+@@ -198,12 +204,6 @@ static void tilcdc_fini(struct drm_device *dev)
+ drm_mode_config_cleanup(dev);
+ tilcdc_remove_external_device(dev);
+
+-#ifdef CONFIG_CPU_FREQ
+- if (priv->freq_transition.notifier_call)
+- cpufreq_unregister_notifier(&priv->freq_transition,
+- CPUFREQ_TRANSITION_NOTIFIER);
+-#endif
+-
+ if (priv->clk)
+ clk_put(priv->clk);
+
+@@ -274,17 +274,6 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev)
+ goto init_failed;
+ }
+
+-#ifdef CONFIG_CPU_FREQ
+- priv->freq_transition.notifier_call = cpufreq_transition;
+- ret = cpufreq_register_notifier(&priv->freq_transition,
+- CPUFREQ_TRANSITION_NOTIFIER);
+- if (ret) {
+- dev_err(dev, "failed to register cpufreq notifier\n");
+- priv->freq_transition.notifier_call = NULL;
+- goto init_failed;
+- }
+-#endif
+-
+ if (of_property_read_u32(node, "max-bandwidth", &priv->max_bandwidth))
+ priv->max_bandwidth = TILCDC_DEFAULT_MAX_BANDWIDTH;
+
+@@ -361,6 +350,17 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev)
+ }
+ modeset_init(ddev);
+
++#ifdef CONFIG_CPU_FREQ
++ priv->freq_transition.notifier_call = cpufreq_transition;
++ ret = cpufreq_register_notifier(&priv->freq_transition,
++ CPUFREQ_TRANSITION_NOTIFIER);
++ if (ret) {
++ dev_err(dev, "failed to register cpufreq notifier\n");
++ priv->freq_transition.notifier_call = NULL;
++ goto init_failed;
++ }
++#endif
++
+ if (priv->is_componentized) {
+ ret = component_bind_all(dev, ddev);
+ if (ret < 0)
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index e759ac0d48be..968319f4e5f1 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -140,6 +140,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa1a6),
+ .driver_data = (kernel_ulong_t)0,
+ },
++ {
++ /* Lewisburg PCH */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa226),
++ .driver_data = (kernel_ulong_t)0,
++ },
+ {
+ /* Gemini Lake */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
+@@ -175,6 +180,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Tiger Lake PCH */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ { 0 },
+ };
+
+diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
+index 9ec9197edffa..eeba421dc823 100644
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -1098,7 +1098,6 @@ int stm_source_register_device(struct device *parent,
+
+ err:
+ put_device(&src->dev);
+- kfree(src);
+
+ return err;
+ }
+diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c
+index 35b302d983e0..959d4912ec0d 100644
+--- a/drivers/i2c/busses/i2c-emev2.c
++++ b/drivers/i2c/busses/i2c-emev2.c
+@@ -69,6 +69,7 @@ struct em_i2c_device {
+ struct completion msg_done;
+ struct clk *sclk;
+ struct i2c_client *slave;
++ int irq;
+ };
+
+ static inline void em_clear_set_bit(struct em_i2c_device *priv, u8 clear, u8 set, u8 reg)
+@@ -339,6 +340,12 @@ static int em_i2c_unreg_slave(struct i2c_client *slave)
+
+ writeb(0, priv->base + I2C_OFS_SVA0);
+
++ /*
++ * Wait for interrupt to finish. New slave irqs cannot happen because we
++ * cleared the slave address and, thus, only extension codes will be
++ * detected which do not use the slave ptr.
++ */
++ synchronize_irq(priv->irq);
+ priv->slave = NULL;
+
+ return 0;
+@@ -355,7 +362,7 @@ static int em_i2c_probe(struct platform_device *pdev)
+ {
+ struct em_i2c_device *priv;
+ struct resource *r;
+- int irq, ret;
++ int ret;
+
+ priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+@@ -390,8 +397,8 @@ static int em_i2c_probe(struct platform_device *pdev)
+
+ em_i2c_reset(&priv->adap);
+
+- irq = platform_get_irq(pdev, 0);
+- ret = devm_request_irq(&pdev->dev, irq, em_i2c_irq_handler, 0,
++ priv->irq = platform_get_irq(pdev, 0);
++ ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0,
+ "em_i2c", priv);
+ if (ret)
+ goto err_clk;
+@@ -401,7 +408,8 @@ static int em_i2c_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_clk;
+
+- dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, irq);
++ dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr,
++ priv->irq);
+
+ return 0;
+
+diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
+index 90946a8b9a75..9ff3371ec385 100644
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -98,7 +98,7 @@
+ #define SB800_PIIX4_PORT_IDX_MASK 0x06
+ #define SB800_PIIX4_PORT_IDX_SHIFT 1
+
+-/* On kerncz, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
++/* On kerncz and Hudson2, SmBus0Sel is at bit 20:19 of PMx00 DecodeEn */
+ #define SB800_PIIX4_PORT_IDX_KERNCZ 0x02
+ #define SB800_PIIX4_PORT_IDX_MASK_KERNCZ 0x18
+ #define SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ 3
+@@ -362,18 +362,16 @@ static int piix4_setup_sb800(struct pci_dev *PIIX4_dev,
+
+ /* Find which register is used for port selection */
+ if (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD) {
+- switch (PIIX4_dev->device) {
+- case PCI_DEVICE_ID_AMD_KERNCZ_SMBUS:
++ if (PIIX4_dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS ||
++ (PIIX4_dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
++ PIIX4_dev->revision >= 0x1F)) {
+ piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_KERNCZ;
+ piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK_KERNCZ;
+ piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT_KERNCZ;
+- break;
+- case PCI_DEVICE_ID_AMD_HUDSON2_SMBUS:
+- default:
++ } else {
+ piix4_port_sel_sb800 = SB800_PIIX4_PORT_IDX_ALT;
+ piix4_port_mask_sb800 = SB800_PIIX4_PORT_IDX_MASK;
+ piix4_port_shift_sb800 = SB800_PIIX4_PORT_IDX_SHIFT;
+- break;
+ }
+ } else {
+ if (!request_muxed_region(SB800_PIIX4_SMB_IDX, 2,
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 254e6219e538..2c29f901d309 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -139,6 +139,7 @@ struct rcar_i2c_priv {
+ enum dma_data_direction dma_direction;
+
+ struct reset_control *rstc;
++ int irq;
+ };
+
+ #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent)
+@@ -859,9 +860,11 @@ static int rcar_unreg_slave(struct i2c_client *slave)
+
+ WARN_ON(!priv->slave);
+
++ /* disable irqs and ensure none is running before clearing ptr */
+ rcar_i2c_write(priv, ICSIER, 0);
+ rcar_i2c_write(priv, ICSCR, 0);
+
++ synchronize_irq(priv->irq);
+ priv->slave = NULL;
+
+ pm_runtime_put(rcar_i2c_priv_to_dev(priv));
+@@ -916,7 +919,7 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ struct i2c_adapter *adap;
+ struct device *dev = &pdev->dev;
+ struct i2c_timings i2c_t;
+- int irq, ret;
++ int ret;
+
+ priv = devm_kzalloc(dev, sizeof(struct rcar_i2c_priv), GFP_KERNEL);
+ if (!priv)
+@@ -979,10 +982,10 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ pm_runtime_put(dev);
+
+
+- irq = platform_get_irq(pdev, 0);
+- ret = devm_request_irq(dev, irq, rcar_i2c_irq, 0, dev_name(dev), priv);
++ priv->irq = platform_get_irq(pdev, 0);
++ ret = devm_request_irq(dev, priv->irq, rcar_i2c_irq, 0, dev_name(dev), priv);
+ if (ret < 0) {
+- dev_err(dev, "cannot get irq %d\n", irq);
++ dev_err(dev, "cannot get irq %d\n", priv->irq);
+ goto out_pm_disable;
+ }
+
+diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
+index 511ff9a1d6d9..f9dbb064f957 100644
+--- a/drivers/iommu/dma-iommu.c
++++ b/drivers/iommu/dma-iommu.c
+@@ -675,7 +675,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
+ * - and wouldn't make the resulting output segment too long
+ */
+ if (cur_len && !s_iova_off && (dma_addr & seg_mask) &&
+- (cur_len + s_length <= max_len)) {
++ (max_len - cur_len >= s_length)) {
+ /* ...then concatenate it with the previous one */
+ cur_len += s_length;
+ } else {
+diff --git a/drivers/media/platform/omap/omap_vout_vrfb.c b/drivers/media/platform/omap/omap_vout_vrfb.c
+index 29e3f5da59c1..11ec048929e8 100644
+--- a/drivers/media/platform/omap/omap_vout_vrfb.c
++++ b/drivers/media/platform/omap/omap_vout_vrfb.c
+@@ -253,8 +253,7 @@ int omap_vout_prepare_vrfb(struct omap_vout_device *vout,
+ */
+
+ pixsize = vout->bpp * vout->vrfb_bpp;
+- dst_icg = ((MAX_PIXELS_PER_LINE * pixsize) -
+- (vout->pix.width * vout->bpp)) + 1;
++ dst_icg = MAX_PIXELS_PER_LINE * pixsize - vout->pix.width * vout->bpp;
+
+ xt->src_start = vout->buf_phy_addr[vb->i];
+ xt->dst_start = vout->vrfb_context[vb->i].paddr[0];
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index 225373e4a9ef..cdd7af16d5ee 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -141,6 +141,8 @@
+
+ #define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
+
++#define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */
++
+ #define MEI_DEV_ID_MCC 0x4B70 /* Mule Creek Canyon (EHL) */
+ #define MEI_DEV_ID_MCC_4 0x4B75 /* Mule Creek Canyon 4 (EHL) */
+
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index a66ebceea408..e41f9e0a3fdf 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -107,6 +107,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH12_CFG)},
++
+ {MEI_PCI_DEVICE(MEI_DEV_ID_MCC, MEI_ME_PCH12_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_MCC_4, MEI_ME_PCH8_CFG)},
+
+diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c
+index b3fa738ae005..f005206d9033 100644
+--- a/drivers/misc/vmw_vmci/vmci_doorbell.c
++++ b/drivers/misc/vmw_vmci/vmci_doorbell.c
+@@ -318,7 +318,8 @@ int vmci_dbell_host_context_notify(u32 src_cid, struct vmci_handle handle)
+
+ entry = container_of(resource, struct dbell_entry, resource);
+ if (entry->run_delayed) {
+- schedule_work(&entry->work);
++ if (!schedule_work(&entry->work))
++ vmci_resource_put(resource);
+ } else {
+ entry->notify_cb(entry->client_data);
+ vmci_resource_put(resource);
+@@ -366,7 +367,8 @@ static void dbell_fire_entries(u32 notify_idx)
+ atomic_read(&dbell->active) == 1) {
+ if (dbell->run_delayed) {
+ vmci_resource_get(&dbell->resource);
+- schedule_work(&dbell->work);
++ if (!schedule_work(&dbell->work))
++ vmci_resource_put(&dbell->resource);
+ } else {
+ dbell->notify_cb(dbell->client_data);
+ }
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index cfb8ee24eaba..04738359ec02 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1277,6 +1277,12 @@ int mmc_attach_sd(struct mmc_host *host)
+ goto err;
+ }
+
++ /*
++ * Some SD cards claims an out of spec VDD voltage range. Let's treat
++ * these bits as being in-valid and especially also bit7.
++ */
++ ocr &= ~0x7FFF;
++
+ rocr = mmc_select_voltage(host, ocr);
+
+ /*
+diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
+index 682c573e20a7..e284102c16e9 100644
+--- a/drivers/mmc/host/sdhci-of-at91.c
++++ b/drivers/mmc/host/sdhci-of-at91.c
+@@ -365,6 +365,9 @@ static int sdhci_at91_probe(struct platform_device *pdev)
+ pm_runtime_set_autosuspend_delay(&pdev->dev, 50);
+ pm_runtime_use_autosuspend(&pdev->dev);
+
++ /* HS200 is broken at this moment */
++ host->quirks2 = SDHCI_QUIRK2_BROKEN_HS200;
++
+ ret = sdhci_add_host(host);
+ if (ret)
+ goto pm_runtime_disable;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/init.c b/drivers/net/wireless/mediatek/mt76/mt76x0/init.c
+index 0a3e046d78db..da2ba51dec35 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/init.c
+@@ -369,7 +369,7 @@ static void mt76x0_stop_hardware(struct mt76x0_dev *dev)
+ mt76x0_chip_onoff(dev, false, false);
+ }
+
+-int mt76x0_init_hardware(struct mt76x0_dev *dev)
++int mt76x0_init_hardware(struct mt76x0_dev *dev, bool reset)
+ {
+ static const u16 beacon_offsets[16] = {
+ /* 512 byte per beacon */
+@@ -382,7 +382,7 @@ int mt76x0_init_hardware(struct mt76x0_dev *dev)
+
+ dev->beacon_offsets = beacon_offsets;
+
+- mt76x0_chip_onoff(dev, true, true);
++ mt76x0_chip_onoff(dev, true, reset);
+
+ ret = mt76x0_wait_asic_ready(dev);
+ if (ret)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h b/drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h
+index fc9857f61771..f9dfe5097b09 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/mt76x0.h
+@@ -279,7 +279,7 @@ void mt76x0_addr_wr(struct mt76x0_dev *dev, const u32 offset, const u8 *addr);
+
+ /* Init */
+ struct mt76x0_dev *mt76x0_alloc_device(struct device *dev);
+-int mt76x0_init_hardware(struct mt76x0_dev *dev);
++int mt76x0_init_hardware(struct mt76x0_dev *dev, bool reset);
+ int mt76x0_register_device(struct mt76x0_dev *dev);
+ void mt76x0_cleanup(struct mt76x0_dev *dev);
+ void mt76x0_chip_onoff(struct mt76x0_dev *dev, bool enable, bool reset);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
+index 54ae1f113be2..5aacb1f6a841 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
+@@ -300,7 +300,7 @@ static int mt76x0_probe(struct usb_interface *usb_intf,
+ if (!(mt76_rr(dev, MT_EFUSE_CTRL) & MT_EFUSE_CTRL_SEL))
+ dev_warn(dev->mt76.dev, "Warning: eFUSE not present\n");
+
+- ret = mt76x0_init_hardware(dev);
++ ret = mt76x0_init_hardware(dev, true);
+ if (ret)
+ goto err;
+
+@@ -354,7 +354,7 @@ static int mt76x0_resume(struct usb_interface *usb_intf)
+ struct mt76x0_dev *dev = usb_get_intfdata(usb_intf);
+ int ret;
+
+- ret = mt76x0_init_hardware(dev);
++ ret = mt76x0_init_hardware(dev, false);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index e26d1191c5ad..ae0b01059fc6 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1183,6 +1183,9 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
+ */
+ if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
+ mutex_lock(&ctrl->scan_lock);
++ mutex_lock(&ctrl->subsys->lock);
++ nvme_mpath_start_freeze(ctrl->subsys);
++ nvme_mpath_wait_freeze(ctrl->subsys);
+ nvme_start_freeze(ctrl);
+ nvme_wait_freeze(ctrl);
+ }
+@@ -1213,6 +1216,8 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
+ nvme_update_formats(ctrl);
+ if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
+ nvme_unfreeze(ctrl);
++ nvme_mpath_unfreeze(ctrl->subsys);
++ mutex_unlock(&ctrl->subsys->lock);
+ mutex_unlock(&ctrl->scan_lock);
+ }
+ if (effects & NVME_CMD_EFFECTS_CCC)
+@@ -1557,6 +1562,7 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
+ if (ns->head->disk) {
+ nvme_update_disk_info(ns->head->disk, ns, id);
+ blk_queue_stack_limits(ns->head->disk->queue, ns->queue);
++ revalidate_disk(ns->head->disk);
+ }
+ #endif
+ }
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index a11e210d173e..05d6371c7f38 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -20,6 +20,36 @@ module_param(multipath, bool, 0444);
+ MODULE_PARM_DESC(multipath,
+ "turn on native support for multiple controllers per subsystem");
+
++void nvme_mpath_unfreeze(struct nvme_subsystem *subsys)
++{
++ struct nvme_ns_head *h;
++
++ lockdep_assert_held(&subsys->lock);
++ list_for_each_entry(h, &subsys->nsheads, entry)
++ if (h->disk)
++ blk_mq_unfreeze_queue(h->disk->queue);
++}
++
++void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
++{
++ struct nvme_ns_head *h;
++
++ lockdep_assert_held(&subsys->lock);
++ list_for_each_entry(h, &subsys->nsheads, entry)
++ if (h->disk)
++ blk_mq_freeze_queue_wait(h->disk->queue);
++}
++
++void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
++{
++ struct nvme_ns_head *h;
++
++ lockdep_assert_held(&subsys->lock);
++ list_for_each_entry(h, &subsys->nsheads, entry)
++ if (h->disk)
++ blk_freeze_queue_start(h->disk->queue);
++}
++
+ /*
+ * If multipathing is enabled we need to always use the subsystem instance
+ * number for numbering our devices to avoid conflicts between subsystems that
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index d5e29b57eb34..2653e1f4196d 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -469,6 +469,9 @@ static inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl)
+ return ctrl->ana_log_buf != NULL;
+ }
+
++void nvme_mpath_unfreeze(struct nvme_subsystem *subsys);
++void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys);
++void nvme_mpath_start_freeze(struct nvme_subsystem *subsys);
+ void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+ struct nvme_ctrl *ctrl, int *flags);
+ void nvme_failover_req(struct request *req);
+@@ -553,6 +556,15 @@ static inline void nvme_mpath_uninit(struct nvme_ctrl *ctrl)
+ static inline void nvme_mpath_stop(struct nvme_ctrl *ctrl)
+ {
+ }
++static inline void nvme_mpath_unfreeze(struct nvme_subsystem *subsys)
++{
++}
++static inline void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
++{
++}
++static inline void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
++{
++}
+ #endif /* CONFIG_NVME_MULTIPATH */
+
+ #ifdef CONFIG_NVM
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 0a5d064f82ca..a64a8bca0d5b 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2468,7 +2468,7 @@ static void nvme_async_probe(void *data, async_cookie_t cookie)
+ {
+ struct nvme_dev *dev = data;
+
+- nvme_reset_ctrl_sync(&dev->ctrl);
++ flush_work(&dev->ctrl.reset_work);
+ flush_work(&dev->ctrl.scan_work);
+ nvme_put_ctrl(&dev->ctrl);
+ }
+@@ -2535,6 +2535,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
+
++ nvme_reset_ctrl(&dev->ctrl);
+ nvme_get_ctrl(&dev->ctrl);
+ async_schedule(nvme_async_probe, dev);
+
+diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
+index 9908082b32c4..137a27fa369c 100644
+--- a/drivers/nvme/target/loop.c
++++ b/drivers/nvme/target/loop.c
+@@ -678,6 +678,14 @@ static void nvme_loop_remove_port(struct nvmet_port *port)
+ mutex_lock(&nvme_loop_ports_mutex);
+ list_del_init(&port->entry);
+ mutex_unlock(&nvme_loop_ports_mutex);
++
++ /*
++ * Ensure any ctrls that are in the process of being
++ * deleted are in fact deleted before we return
++ * and free the port. This is to prevent active
++ * ctrls from using a port after it's freed.
++ */
++ flush_workqueue(nvme_delete_wq);
+ }
+
+ static const struct nvmet_fabrics_ops nvme_loop_ops = {
+diff --git a/drivers/scsi/ufs/unipro.h b/drivers/scsi/ufs/unipro.h
+index 23129d7b2678..c77e36526447 100644
+--- a/drivers/scsi/ufs/unipro.h
++++ b/drivers/scsi/ufs/unipro.h
+@@ -52,7 +52,7 @@
+ #define RX_HS_UNTERMINATED_ENABLE 0x00A6
+ #define RX_ENTER_HIBERN8 0x00A7
+ #define RX_BYPASS_8B10B_ENABLE 0x00A8
+-#define RX_TERMINATION_FORCE_ENABLE 0x0089
++#define RX_TERMINATION_FORCE_ENABLE 0x00A9
+ #define RX_MIN_ACTIVATETIME_CAPABILITY 0x008F
+ #define RX_HIBERN8TIME_CAPABILITY 0x0092
+ #define RX_REFCLKFREQ 0x00EB
+diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c
+index cb6a331f448a..70f78eda037e 100644
+--- a/drivers/soundwire/cadence_master.c
++++ b/drivers/soundwire/cadence_master.c
+@@ -81,8 +81,8 @@
+
+ #define CDNS_MCP_INTSET 0x4C
+
+-#define CDNS_SDW_SLAVE_STAT 0x50
+-#define CDNS_MCP_SLAVE_STAT_MASK BIT(1, 0)
++#define CDNS_MCP_SLAVE_STAT 0x50
++#define CDNS_MCP_SLAVE_STAT_MASK GENMASK(1, 0)
+
+ #define CDNS_MCP_SLAVE_INTSTAT0 0x54
+ #define CDNS_MCP_SLAVE_INTSTAT1 0x58
+@@ -96,8 +96,8 @@
+ #define CDNS_MCP_SLAVE_INTMASK0 0x5C
+ #define CDNS_MCP_SLAVE_INTMASK1 0x60
+
+-#define CDNS_MCP_SLAVE_INTMASK0_MASK GENMASK(30, 0)
+-#define CDNS_MCP_SLAVE_INTMASK1_MASK GENMASK(16, 0)
++#define CDNS_MCP_SLAVE_INTMASK0_MASK GENMASK(31, 0)
++#define CDNS_MCP_SLAVE_INTMASK1_MASK GENMASK(15, 0)
+
+ #define CDNS_MCP_PORT_INTSTAT 0x64
+ #define CDNS_MCP_PDI_STAT 0x6C
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index cc7c856126df..169ccfacfc75 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -708,12 +708,6 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
+ struct ci_hdrc *ci = container_of(gadget, struct ci_hdrc, gadget);
+ unsigned long flags;
+
+- spin_lock_irqsave(&ci->lock, flags);
+- ci->gadget.speed = USB_SPEED_UNKNOWN;
+- ci->remote_wakeup = 0;
+- ci->suspended = 0;
+- spin_unlock_irqrestore(&ci->lock, flags);
+-
+ /* flush all endpoints */
+ gadget_for_each_ep(ep, gadget) {
+ usb_ep_fifo_flush(ep);
+@@ -731,6 +725,12 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
+ ci->status = NULL;
+ }
+
++ spin_lock_irqsave(&ci->lock, flags);
++ ci->gadget.speed = USB_SPEED_UNKNOWN;
++ ci->remote_wakeup = 0;
++ ci->suspended = 0;
++ spin_unlock_irqrestore(&ci->lock, flags);
++
+ return 0;
+ }
+
+@@ -1302,6 +1302,10 @@ static int ep_disable(struct usb_ep *ep)
+ return -EBUSY;
+
+ spin_lock_irqsave(hwep->lock, flags);
++ if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
++ spin_unlock_irqrestore(hwep->lock, flags);
++ return 0;
++ }
+
+ /* only internal SW should disable ctrl endpts */
+
+@@ -1391,6 +1395,10 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req,
+ return -EINVAL;
+
+ spin_lock_irqsave(hwep->lock, flags);
++ if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
++ spin_unlock_irqrestore(hwep->lock, flags);
++ return 0;
++ }
+ retval = _ep_queue(ep, req, gfp_flags);
+ spin_unlock_irqrestore(hwep->lock, flags);
+ return retval;
+@@ -1414,8 +1422,8 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
+ return -EINVAL;
+
+ spin_lock_irqsave(hwep->lock, flags);
+-
+- hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
++ if (hwep->ci->gadget.speed != USB_SPEED_UNKNOWN)
++ hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
+
+ list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) {
+ dma_pool_free(hwep->td_pool, node->ptr, node->dma);
+@@ -1486,6 +1494,10 @@ static void ep_fifo_flush(struct usb_ep *ep)
+ }
+
+ spin_lock_irqsave(hwep->lock, flags);
++ if (hwep->ci->gadget.speed == USB_SPEED_UNKNOWN) {
++ spin_unlock_irqrestore(hwep->lock, flags);
++ return;
++ }
+
+ hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
+
+@@ -1558,6 +1570,10 @@ static int ci_udc_wakeup(struct usb_gadget *_gadget)
+ int ret = 0;
+
+ spin_lock_irqsave(&ci->lock, flags);
++ if (ci->gadget.speed == USB_SPEED_UNKNOWN) {
++ spin_unlock_irqrestore(&ci->lock, flags);
++ return 0;
++ }
+ if (!ci->remote_wakeup) {
+ ret = -EOPNOTSUPP;
+ goto out;
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index bec581fb7c63..b8a1fdefb515 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -587,10 +587,20 @@ static int wdm_flush(struct file *file, fl_owner_t id)
+ {
+ struct wdm_device *desc = file->private_data;
+
+- wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags));
++ wait_event(desc->wait,
++ /*
++ * needs both flags. We cannot do with one
++ * because resetting it would cause a race
++ * with write() yet we need to signal
++ * a disconnect
++ */
++ !test_bit(WDM_IN_USE, &desc->flags) ||
++ test_bit(WDM_DISCONNECTING, &desc->flags));
+
+ /* cannot dereference desc->intf if WDM_DISCONNECTING */
+- if (desc->werr < 0 && !test_bit(WDM_DISCONNECTING, &desc->flags))
++ if (test_bit(WDM_DISCONNECTING, &desc->flags))
++ return -ENODEV;
++ if (desc->werr < 0)
+ dev_err(&desc->intf->dev, "Error in flush path: %d\n",
+ desc->werr);
+
+@@ -974,8 +984,6 @@ static void wdm_disconnect(struct usb_interface *intf)
+ spin_lock_irqsave(&desc->iuspin, flags);
+ set_bit(WDM_DISCONNECTING, &desc->flags);
+ set_bit(WDM_READ, &desc->flags);
+- /* to terminate pending flushes */
+- clear_bit(WDM_IN_USE, &desc->flags);
+ spin_unlock_irqrestore(&desc->iuspin, flags);
+ wake_up_all(&desc->wait);
+ mutex_lock(&desc->rlock);
+diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
+index 03432467b05f..7537681355f6 100644
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -216,17 +216,18 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ /* EHCI, OHCI */
+ hcd->rsrc_start = pci_resource_start(dev, 0);
+ hcd->rsrc_len = pci_resource_len(dev, 0);
+- if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len,
+- driver->description)) {
++ if (!devm_request_mem_region(&dev->dev, hcd->rsrc_start,
++ hcd->rsrc_len, driver->description)) {
+ dev_dbg(&dev->dev, "controller already in use\n");
+ retval = -EBUSY;
+ goto put_hcd;
+ }
+- hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
++ hcd->regs = devm_ioremap_nocache(&dev->dev, hcd->rsrc_start,
++ hcd->rsrc_len);
+ if (hcd->regs == NULL) {
+ dev_dbg(&dev->dev, "error mapping memory\n");
+ retval = -EFAULT;
+- goto release_mem_region;
++ goto put_hcd;
+ }
+
+ } else {
+@@ -240,8 +241,8 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+
+ hcd->rsrc_start = pci_resource_start(dev, region);
+ hcd->rsrc_len = pci_resource_len(dev, region);
+- if (request_region(hcd->rsrc_start, hcd->rsrc_len,
+- driver->description))
++ if (devm_request_region(&dev->dev, hcd->rsrc_start,
++ hcd->rsrc_len, driver->description))
+ break;
+ }
+ if (region == PCI_ROM_RESOURCE) {
+@@ -275,20 +276,13 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ }
+
+ if (retval != 0)
+- goto unmap_registers;
++ goto put_hcd;
+ device_wakeup_enable(hcd->self.controller);
+
+ if (pci_dev_run_wake(dev))
+ pm_runtime_put_noidle(&dev->dev);
+ return retval;
+
+-unmap_registers:
+- if (driver->flags & HCD_MEMORY) {
+- iounmap(hcd->regs);
+-release_mem_region:
+- release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+- } else
+- release_region(hcd->rsrc_start, hcd->rsrc_len);
+ put_hcd:
+ usb_put_hcd(hcd);
+ disable_pci:
+@@ -347,14 +341,6 @@ void usb_hcd_pci_remove(struct pci_dev *dev)
+ dev_set_drvdata(&dev->dev, NULL);
+ up_read(&companions_rwsem);
+ }
+-
+- if (hcd->driver->flags & HCD_MEMORY) {
+- iounmap(hcd->regs);
+- release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+- } else {
+- release_region(hcd->rsrc_start, hcd->rsrc_len);
+- }
+-
+ usb_put_hcd(hcd);
+ pci_disable_device(dev);
+ }
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index b8a15840b4ff..dfcabadeed01 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1976,6 +1976,7 @@ void composite_disconnect(struct usb_gadget *gadget)
+ * disconnect callbacks?
+ */
+ spin_lock_irqsave(&cdev->lock, flags);
++ cdev->suspended = 0;
+ if (cdev->config)
+ reset_config(cdev);
+ if (cdev->driver->disconnect)
+diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
+index 1074cb82ec17..0b7b4d09785b 100644
+--- a/drivers/usb/gadget/function/f_mass_storage.c
++++ b/drivers/usb/gadget/function/f_mass_storage.c
+@@ -261,7 +261,7 @@ struct fsg_common;
+ struct fsg_common {
+ struct usb_gadget *gadget;
+ struct usb_composite_dev *cdev;
+- struct fsg_dev *fsg, *new_fsg;
++ struct fsg_dev *fsg;
+ wait_queue_head_t io_wait;
+ wait_queue_head_t fsg_wait;
+
+@@ -290,6 +290,7 @@ struct fsg_common {
+ unsigned int bulk_out_maxpacket;
+ enum fsg_state state; /* For exception handling */
+ unsigned int exception_req_tag;
++ void *exception_arg;
+
+ enum data_direction data_dir;
+ u32 data_size;
+@@ -391,7 +392,8 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
+
+ /* These routines may be called in process context or in_irq */
+
+-static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
++static void __raise_exception(struct fsg_common *common, enum fsg_state new_state,
++ void *arg)
+ {
+ unsigned long flags;
+
+@@ -404,6 +406,7 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+ if (common->state <= new_state) {
+ common->exception_req_tag = common->ep0_req_tag;
+ common->state = new_state;
++ common->exception_arg = arg;
+ if (common->thread_task)
+ send_sig_info(SIGUSR1, SEND_SIG_FORCED,
+ common->thread_task);
+@@ -411,6 +414,10 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+ spin_unlock_irqrestore(&common->lock, flags);
+ }
+
++static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
++{
++ __raise_exception(common, new_state, NULL);
++}
+
+ /*-------------------------------------------------------------------------*/
+
+@@ -2285,16 +2292,16 @@ reset:
+ static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+ {
+ struct fsg_dev *fsg = fsg_from_func(f);
+- fsg->common->new_fsg = fsg;
+- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
++
++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, fsg);
+ return USB_GADGET_DELAYED_STATUS;
+ }
+
+ static void fsg_disable(struct usb_function *f)
+ {
+ struct fsg_dev *fsg = fsg_from_func(f);
+- fsg->common->new_fsg = NULL;
+- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
++
++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
+ }
+
+
+@@ -2307,6 +2314,7 @@ static void handle_exception(struct fsg_common *common)
+ enum fsg_state old_state;
+ struct fsg_lun *curlun;
+ unsigned int exception_req_tag;
++ struct fsg_dev *new_fsg;
+
+ /*
+ * Clear the existing signals. Anything but SIGUSR1 is converted
+@@ -2360,6 +2368,7 @@ static void handle_exception(struct fsg_common *common)
+ common->next_buffhd_to_fill = &common->buffhds[0];
+ common->next_buffhd_to_drain = &common->buffhds[0];
+ exception_req_tag = common->exception_req_tag;
++ new_fsg = common->exception_arg;
+ old_state = common->state;
+ common->state = FSG_STATE_NORMAL;
+
+@@ -2413,8 +2422,8 @@ static void handle_exception(struct fsg_common *common)
+ break;
+
+ case FSG_STATE_CONFIG_CHANGE:
+- do_set_interface(common, common->new_fsg);
+- if (common->new_fsg)
++ do_set_interface(common, new_fsg);
++ if (new_fsg)
+ usb_composite_setup_continue(common->cdev);
+ break;
+
+@@ -2989,8 +2998,7 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
+
+ DBG(fsg, "unbind\n");
+ if (fsg->common->fsg == fsg) {
+- fsg->common->new_fsg = NULL;
+- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
+ /* FIXME: make interruptible or killable somehow? */
+ wait_event(common->fsg_wait, common->fsg != fsg);
+ }
+diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
+index e64eb47770c8..2d5a72c15069 100644
+--- a/drivers/usb/host/fotg210-hcd.c
++++ b/drivers/usb/host/fotg210-hcd.c
+@@ -1627,6 +1627,10 @@ static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ /* see what we found out */
+ temp = check_reset_complete(fotg210, wIndex, status_reg,
+ fotg210_readl(fotg210, status_reg));
++
++ /* restart schedule */
++ fotg210->command |= CMD_RUN;
++ fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
+ }
+
+ if (!(temp & (PORT_RESUME|PORT_RESET))) {
+diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
+index 210181fd98d2..af11887f5f9e 100644
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -418,8 +418,7 @@ static void ohci_usb_reset (struct ohci_hcd *ohci)
+ * other cases where the next software may expect clean state from the
+ * "firmware". this is bus-neutral, unlike shutdown() methods.
+ */
+-static void
+-ohci_shutdown (struct usb_hcd *hcd)
++static void _ohci_shutdown(struct usb_hcd *hcd)
+ {
+ struct ohci_hcd *ohci;
+
+@@ -435,6 +434,16 @@ ohci_shutdown (struct usb_hcd *hcd)
+ ohci->rh_state = OHCI_RH_HALTED;
+ }
+
++static void ohci_shutdown(struct usb_hcd *hcd)
++{
++ struct ohci_hcd *ohci = hcd_to_ohci(hcd);
++ unsigned long flags;
++
++ spin_lock_irqsave(&ohci->lock, flags);
++ _ohci_shutdown(hcd);
++ spin_unlock_irqrestore(&ohci->lock, flags);
++}
++
+ /*-------------------------------------------------------------------------*
+ * HC functions
+ *-------------------------------------------------------------------------*/
+@@ -752,7 +761,7 @@ static void io_watchdog_func(struct timer_list *t)
+ died:
+ usb_hc_died(ohci_to_hcd(ohci));
+ ohci_dump(ohci);
+- ohci_shutdown(ohci_to_hcd(ohci));
++ _ohci_shutdown(ohci_to_hcd(ohci));
+ goto done;
+ } else {
+ /* No write back because the done queue was empty */
+diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
+index 8616c52849c6..2b0ccd150209 100644
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -104,7 +104,7 @@ static int xhci_rcar_is_gen2(struct device *dev)
+ return of_device_is_compatible(node, "renesas,xhci-r8a7790") ||
+ of_device_is_compatible(node, "renesas,xhci-r8a7791") ||
+ of_device_is_compatible(node, "renesas,xhci-r8a7793") ||
+- of_device_is_compatible(node, "renensas,rcar-gen2-xhci");
++ of_device_is_compatible(node, "renesas,rcar-gen2-xhci");
+ }
+
+ static int xhci_rcar_is_gen3(struct device *dev)
+diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
+index cc794e25a0b6..1d9ce9cbc831 100644
+--- a/drivers/usb/storage/realtek_cr.c
++++ b/drivers/usb/storage/realtek_cr.c
+@@ -38,7 +38,7 @@ MODULE_LICENSE("GPL");
+
+ static int auto_delink_en = 1;
+ module_param(auto_delink_en, int, S_IRUGO | S_IWUSR);
+-MODULE_PARM_DESC(auto_delink_en, "enable auto delink");
++MODULE_PARM_DESC(auto_delink_en, "auto delink mode (0=firmware, 1=software [default])");
+
+ #ifdef CONFIG_REALTEK_AUTOPM
+ static int ss_en = 1;
+@@ -996,12 +996,15 @@ static int init_realtek_cr(struct us_data *us)
+ goto INIT_FAIL;
+ }
+
+- if (CHECK_FW_VER(chip, 0x5888) || CHECK_FW_VER(chip, 0x5889) ||
+- CHECK_FW_VER(chip, 0x5901))
+- SET_AUTO_DELINK(chip);
+- if (STATUS_LEN(chip) == 16) {
+- if (SUPPORT_AUTO_DELINK(chip))
++ if (CHECK_PID(chip, 0x0138) || CHECK_PID(chip, 0x0158) ||
++ CHECK_PID(chip, 0x0159)) {
++ if (CHECK_FW_VER(chip, 0x5888) || CHECK_FW_VER(chip, 0x5889) ||
++ CHECK_FW_VER(chip, 0x5901))
+ SET_AUTO_DELINK(chip);
++ if (STATUS_LEN(chip) == 16) {
++ if (SUPPORT_AUTO_DELINK(chip))
++ SET_AUTO_DELINK(chip);
++ }
+ }
+ #ifdef CONFIG_REALTEK_AUTOPM
+ if (ss_en)
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index ea0d27a94afe..1cd9b6305b06 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2100,7 +2100,7 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201,
+ US_FL_IGNORE_RESIDUE ),
+
+ /* Reported by Michael Büsch <m@bues.ch> */
+-UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0116,
++UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0117,
+ "JMicron",
+ "USB to ATA/ATAPI Bridge",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index 5f29ce8d6c3f..fb20aa974ae1 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -1445,7 +1445,7 @@ static enum pdo_err tcpm_caps_err(struct tcpm_port *port, const u32 *pdo,
+ else if ((pdo_min_voltage(pdo[i]) ==
+ pdo_min_voltage(pdo[i - 1])) &&
+ (pdo_max_voltage(pdo[i]) ==
+- pdo_min_voltage(pdo[i - 1])))
++ pdo_max_voltage(pdo[i - 1])))
+ return PDO_ERR_DUPE_PDO;
+ break;
+ /*
+diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
+index ed05514cc2dc..e6c27b71b136 100644
+--- a/drivers/watchdog/bcm2835_wdt.c
++++ b/drivers/watchdog/bcm2835_wdt.c
+@@ -249,6 +249,7 @@ module_param(nowayout, bool, 0);
+ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
+ __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
++MODULE_ALIAS("platform:bcm2835-wdt");
+ MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
+ MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer");
+ MODULE_LICENSE("GPL");
+diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
+index 9e51d6fe7e8f..40c6860d4c63 100644
+--- a/fs/afs/cmservice.c
++++ b/fs/afs/cmservice.c
+@@ -423,18 +423,14 @@ static void SRXAFSCB_ProbeUuid(struct work_struct *work)
+ struct afs_call *call = container_of(work, struct afs_call, work);
+ struct afs_uuid *r = call->request;
+
+- struct {
+- __be32 match;
+- } reply;
+-
+ _enter("");
+
+ if (memcmp(r, &call->net->uuid, sizeof(call->net->uuid)) == 0)
+- reply.match = htonl(0);
++ afs_send_empty_reply(call);
+ else
+- reply.match = htonl(1);
++ rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
++ 1, 1, "K-1");
+
+- afs_send_simple_reply(call, &reply, sizeof(reply));
+ afs_put_call(call);
+ _leave("");
+ }
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 855bf2b79fed..54e7f6f1405e 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -937,7 +937,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+ dir_version = (long)dir->status.data_version;
+ de_version = (long)dentry->d_fsdata;
+ if (de_version == dir_version)
+- goto out_valid;
++ goto out_valid_noupdate;
+
+ dir_version = (long)dir->invalid_before;
+ if (de_version - dir_version >= 0)
+@@ -1001,6 +1001,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+
+ out_valid:
+ dentry->d_fsdata = (void *)dir_version;
++out_valid_noupdate:
+ dput(parent);
+ key_put(key);
+ _leave(" = 1 [valid]");
+diff --git a/fs/afs/file.c b/fs/afs/file.c
+index 7d4f26198573..843d3b970b84 100644
+--- a/fs/afs/file.c
++++ b/fs/afs/file.c
+@@ -193,11 +193,13 @@ void afs_put_read(struct afs_read *req)
+ int i;
+
+ if (refcount_dec_and_test(&req->usage)) {
+- for (i = 0; i < req->nr_pages; i++)
+- if (req->pages[i])
+- put_page(req->pages[i]);
+- if (req->pages != req->array)
+- kfree(req->pages);
++ if (req->pages) {
++ for (i = 0; i < req->nr_pages; i++)
++ if (req->pages[i])
++ put_page(req->pages[i]);
++ if (req->pages != req->array)
++ kfree(req->pages);
++ }
+ kfree(req);
+ }
+ }
+diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
+index c3b740813fc7..c7dd47eaff29 100644
+--- a/fs/afs/vlclient.c
++++ b/fs/afs/vlclient.c
+@@ -60,23 +60,24 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call)
+ struct afs_uuid__xdr *xdr;
+ struct afs_uuid *uuid;
+ int j;
++ int n = entry->nr_servers;
+
+ tmp = ntohl(uvldb->serverFlags[i]);
+ if (tmp & AFS_VLSF_DONTUSE ||
+ (new_only && !(tmp & AFS_VLSF_NEWREPSITE)))
+ continue;
+ if (tmp & AFS_VLSF_RWVOL) {
+- entry->fs_mask[i] |= AFS_VOL_VTM_RW;
++ entry->fs_mask[n] |= AFS_VOL_VTM_RW;
+ if (vlflags & AFS_VLF_BACKEXISTS)
+- entry->fs_mask[i] |= AFS_VOL_VTM_BAK;
++ entry->fs_mask[n] |= AFS_VOL_VTM_BAK;
+ }
+ if (tmp & AFS_VLSF_ROVOL)
+- entry->fs_mask[i] |= AFS_VOL_VTM_RO;
+- if (!entry->fs_mask[i])
++ entry->fs_mask[n] |= AFS_VOL_VTM_RO;
++ if (!entry->fs_mask[n])
+ continue;
+
+ xdr = &uvldb->serverNumber[i];
+- uuid = (struct afs_uuid *)&entry->fs_server[i];
++ uuid = (struct afs_uuid *)&entry->fs_server[n];
+ uuid->time_low = xdr->time_low;
+ uuid->time_mid = htons(ntohl(xdr->time_mid));
+ uuid->time_hi_and_version = htons(ntohl(xdr->time_hi_and_version));
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index 33824a0a57bf..f516ace8f45d 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -400,15 +400,21 @@ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
+ unsigned long bytes = 0;
+ struct nfs_direct_req *dreq = hdr->dreq;
+
+- if (test_bit(NFS_IOHDR_REDO, &hdr->flags))
+- goto out_put;
+-
+ spin_lock(&dreq->lock);
+- if (test_bit(NFS_IOHDR_ERROR, &hdr->flags) && (hdr->good_bytes == 0))
++ if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
+ dreq->error = hdr->error;
+- else
++
++ if (test_bit(NFS_IOHDR_REDO, &hdr->flags)) {
++ spin_unlock(&dreq->lock);
++ goto out_put;
++ }
++
++ if (hdr->good_bytes != 0)
+ nfs_direct_good_bytes(dreq, hdr);
+
++ if (test_bit(NFS_IOHDR_EOF, &hdr->flags))
++ dreq->error = 0;
++
+ spin_unlock(&dreq->lock);
+
+ while (!list_empty(&hdr->pages)) {
+@@ -428,7 +434,7 @@ out_put:
+ hdr->release(hdr);
+ }
+
+-static void nfs_read_sync_pgio_error(struct list_head *head)
++static void nfs_read_sync_pgio_error(struct list_head *head, int error)
+ {
+ struct nfs_page *req;
+
+@@ -664,8 +670,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
+
+ list_for_each_entry_safe(req, tmp, &reqs, wb_list) {
+ if (!nfs_pageio_add_request(&desc, req)) {
+- nfs_list_remove_request(req);
+- nfs_list_add_request(req, &failed);
++ nfs_list_move_request(req, &failed);
+ spin_lock(&cinfo.inode->i_lock);
+ dreq->flags = 0;
+ if (desc.pg_error < 0)
+@@ -775,16 +780,19 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr)
+ bool request_commit = false;
+ struct nfs_page *req = nfs_list_entry(hdr->pages.next);
+
+- if (test_bit(NFS_IOHDR_REDO, &hdr->flags))
+- goto out_put;
+-
+ nfs_init_cinfo_from_dreq(&cinfo, dreq);
+
+ spin_lock(&dreq->lock);
+
+ if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
+ dreq->error = hdr->error;
+- if (dreq->error == 0) {
++
++ if (test_bit(NFS_IOHDR_REDO, &hdr->flags)) {
++ spin_unlock(&dreq->lock);
++ goto out_put;
++ }
++
++ if (hdr->good_bytes != 0) {
+ nfs_direct_good_bytes(dreq, hdr);
+ if (nfs_write_need_commit(hdr)) {
+ if (dreq->flags == NFS_ODIRECT_RESCHED_WRITES)
+@@ -821,7 +829,7 @@ out_put:
+ hdr->release(hdr);
+ }
+
+-static void nfs_write_sync_pgio_error(struct list_head *head)
++static void nfs_write_sync_pgio_error(struct list_head *head, int error)
+ {
+ struct nfs_page *req;
+
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index 0ec6bce3dd69..d23ea74b5d20 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -769,8 +769,7 @@ int nfs_generic_pgio(struct nfs_pageio_descriptor *desc,
+ pageused = 0;
+ while (!list_empty(head)) {
+ req = nfs_list_entry(head->next);
+- nfs_list_remove_request(req);
+- nfs_list_add_request(req, &hdr->pages);
++ nfs_list_move_request(req, &hdr->pages);
+
+ if (!last_page || last_page != req->wb_page) {
+ pageused++;
+@@ -962,8 +961,7 @@ static int nfs_pageio_do_add_request(struct nfs_pageio_descriptor *desc,
+ }
+ if (!nfs_can_coalesce_requests(prev, req, desc))
+ return 0;
+- nfs_list_remove_request(req);
+- nfs_list_add_request(req, &mirror->pg_list);
++ nfs_list_move_request(req, &mirror->pg_list);
+ mirror->pg_count += req->wb_bytes;
+ return 1;
+ }
+@@ -995,9 +993,8 @@ nfs_pageio_cleanup_request(struct nfs_pageio_descriptor *desc,
+ {
+ LIST_HEAD(head);
+
+- nfs_list_remove_request(req);
+- nfs_list_add_request(req, &head);
+- desc->pg_completion_ops->error_cleanup(&head);
++ nfs_list_move_request(req, &head);
++ desc->pg_completion_ops->error_cleanup(&head, desc->pg_error);
+ }
+
+ /**
+@@ -1133,7 +1130,8 @@ static void nfs_pageio_error_cleanup(struct nfs_pageio_descriptor *desc)
+
+ for (midx = 0; midx < desc->pg_mirror_count; midx++) {
+ mirror = &desc->pg_mirrors[midx];
+- desc->pg_completion_ops->error_cleanup(&mirror->pg_list);
++ desc->pg_completion_ops->error_cleanup(&mirror->pg_list,
++ desc->pg_error);
+ }
+ }
+
+@@ -1235,21 +1233,23 @@ static void nfs_pageio_complete_mirror(struct nfs_pageio_descriptor *desc,
+ int nfs_pageio_resend(struct nfs_pageio_descriptor *desc,
+ struct nfs_pgio_header *hdr)
+ {
+- LIST_HEAD(failed);
++ LIST_HEAD(pages);
+
+ desc->pg_io_completion = hdr->io_completion;
+ desc->pg_dreq = hdr->dreq;
+- while (!list_empty(&hdr->pages)) {
+- struct nfs_page *req = nfs_list_entry(hdr->pages.next);
++ list_splice_init(&hdr->pages, &pages);
++ while (!list_empty(&pages)) {
++ struct nfs_page *req = nfs_list_entry(pages.next);
+
+- nfs_list_remove_request(req);
+ if (!nfs_pageio_add_request(desc, req))
+- nfs_list_add_request(req, &failed);
++ break;
+ }
+ nfs_pageio_complete(desc);
+- if (!list_empty(&failed)) {
+- list_move(&failed, &hdr->pages);
+- return desc->pg_error < 0 ? desc->pg_error : -EIO;
++ if (!list_empty(&pages)) {
++ int err = desc->pg_error < 0 ? desc->pg_error : -EIO;
++ hdr->completion_ops->error_cleanup(&pages, err);
++ nfs_set_pgio_error(hdr, err, hdr->io_start);
++ return err;
+ }
+ return 0;
+ }
+diff --git a/fs/nfs/read.c b/fs/nfs/read.c
+index 48d7277c60a9..09d5c282f50e 100644
+--- a/fs/nfs/read.c
++++ b/fs/nfs/read.c
+@@ -205,7 +205,7 @@ static void nfs_initiate_read(struct nfs_pgio_header *hdr,
+ }
+
+ static void
+-nfs_async_read_error(struct list_head *head)
++nfs_async_read_error(struct list_head *head, int error)
+ {
+ struct nfs_page *req;
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 51d0b7913c04..5ab997912d8d 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1394,20 +1394,27 @@ static void nfs_redirty_request(struct nfs_page *req)
+ nfs_release_request(req);
+ }
+
+-static void nfs_async_write_error(struct list_head *head)
++static void nfs_async_write_error(struct list_head *head, int error)
+ {
+ struct nfs_page *req;
+
+ while (!list_empty(head)) {
+ req = nfs_list_entry(head->next);
+ nfs_list_remove_request(req);
++ if (nfs_error_is_fatal(error)) {
++ nfs_context_set_write_error(req->wb_context, error);
++ if (nfs_error_is_fatal_on_server(error)) {
++ nfs_write_error_remove_page(req);
++ continue;
++ }
++ }
+ nfs_redirty_request(req);
+ }
+ }
+
+ static void nfs_async_write_reschedule_io(struct nfs_pgio_header *hdr)
+ {
+- nfs_async_write_error(&hdr->pages);
++ nfs_async_write_error(&hdr->pages, 0);
+ filemap_fdatawrite_range(hdr->inode->i_mapping, hdr->args.offset,
+ hdr->args.offset + hdr->args.count - 1);
+ }
+diff --git a/include/linux/logic_pio.h b/include/linux/logic_pio.h
+index cbd9d8495690..88e1e6304a71 100644
+--- a/include/linux/logic_pio.h
++++ b/include/linux/logic_pio.h
+@@ -117,6 +117,7 @@ struct logic_pio_hwaddr *find_io_range_by_fwnode(struct fwnode_handle *fwnode);
+ unsigned long logic_pio_trans_hwaddr(struct fwnode_handle *fwnode,
+ resource_size_t hw_addr, resource_size_t size);
+ int logic_pio_register_range(struct logic_pio_hwaddr *newrange);
++void logic_pio_unregister_range(struct logic_pio_hwaddr *range);
+ resource_size_t logic_pio_to_hwaddr(unsigned long pio);
+ unsigned long logic_pio_trans_cpuaddr(resource_size_t hw_addr);
+
+diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h
+index e27572d30d97..ad69430fd0eb 100644
+--- a/include/linux/nfs_page.h
++++ b/include/linux/nfs_page.h
+@@ -164,6 +164,16 @@ nfs_list_add_request(struct nfs_page *req, struct list_head *head)
+ list_add_tail(&req->wb_list, head);
+ }
+
++/**
++ * nfs_list_move_request - Move a request to a new list
++ * @req: request
++ * @head: head of list into which to insert the request.
++ */
++static inline void
++nfs_list_move_request(struct nfs_page *req, struct list_head *head)
++{
++ list_move_tail(&req->wb_list, head);
++}
+
+ /**
+ * nfs_list_remove_request - Remove a request from its wb_list
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index bd1c889a9ed9..cab24a127feb 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -1539,7 +1539,7 @@ struct nfs_commit_data {
+ };
+
+ struct nfs_pgio_completion_ops {
+- void (*error_cleanup)(struct list_head *head);
++ void (*error_cleanup)(struct list_head *head, int);
+ void (*init_hdr)(struct nfs_pgio_header *hdr);
+ void (*completion)(struct nfs_pgio_header *hdr);
+ void (*reschedule_io)(struct nfs_pgio_header *hdr);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index d9dd709b3c12..7e215dac9693 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3112,6 +3112,14 @@ t_probe_next(struct seq_file *m, loff_t *pos)
+ hnd = &iter->probe_entry->hlist;
+
+ hash = iter->probe->ops.func_hash->filter_hash;
++
++ /*
++ * A probe being registered may temporarily have an empty hash
++ * and it's at the end of the func_probes list.
++ */
++ if (!hash || hash == EMPTY_HASH)
++ return NULL;
++
+ size = 1 << hash->size_bits;
+
+ retry:
+@@ -4307,12 +4315,21 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
+
+ mutex_unlock(&ftrace_lock);
+
++ /*
++ * Note, there's a small window here that the func_hash->filter_hash
++ * may be NULL or empty. Need to be carefule when reading the loop.
++ */
+ mutex_lock(&probe->ops.func_hash->regex_lock);
+
+ orig_hash = &probe->ops.func_hash->filter_hash;
+ old_hash = *orig_hash;
+ hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
+
++ if (!hash) {
++ ret = -ENOMEM;
++ goto out;
++ }
++
+ ret = ftrace_match_records(hash, glob, strlen(glob));
+
+ /* Nothing found? */
+diff --git a/lib/logic_pio.c b/lib/logic_pio.c
+index feea48fd1a0d..905027574e5d 100644
+--- a/lib/logic_pio.c
++++ b/lib/logic_pio.c
+@@ -35,7 +35,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
+ struct logic_pio_hwaddr *range;
+ resource_size_t start;
+ resource_size_t end;
+- resource_size_t mmio_sz = 0;
++ resource_size_t mmio_end = 0;
+ resource_size_t iio_sz = MMIO_UPPER_LIMIT;
+ int ret = 0;
+
+@@ -46,7 +46,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
+ end = new_range->hw_start + new_range->size;
+
+ mutex_lock(&io_range_mutex);
+- list_for_each_entry_rcu(range, &io_range_list, list) {
++ list_for_each_entry(range, &io_range_list, list) {
+ if (range->fwnode == new_range->fwnode) {
+ /* range already there */
+ goto end_register;
+@@ -56,7 +56,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
+ /* for MMIO ranges we need to check for overlap */
+ if (start >= range->hw_start + range->size ||
+ end < range->hw_start) {
+- mmio_sz += range->size;
++ mmio_end = range->io_start + range->size;
+ } else {
+ ret = -EFAULT;
+ goto end_register;
+@@ -69,16 +69,16 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
+
+ /* range not registered yet, check for available space */
+ if (new_range->flags == LOGIC_PIO_CPU_MMIO) {
+- if (mmio_sz + new_range->size - 1 > MMIO_UPPER_LIMIT) {
++ if (mmio_end + new_range->size - 1 > MMIO_UPPER_LIMIT) {
+ /* if it's too big check if 64K space can be reserved */
+- if (mmio_sz + SZ_64K - 1 > MMIO_UPPER_LIMIT) {
++ if (mmio_end + SZ_64K - 1 > MMIO_UPPER_LIMIT) {
+ ret = -E2BIG;
+ goto end_register;
+ }
+ new_range->size = SZ_64K;
+ pr_warn("Requested IO range too big, new size set to 64K\n");
+ }
+- new_range->io_start = mmio_sz;
++ new_range->io_start = mmio_end;
+ } else if (new_range->flags == LOGIC_PIO_INDIRECT) {
+ if (iio_sz + new_range->size - 1 > IO_SPACE_LIMIT) {
+ ret = -E2BIG;
+@@ -98,6 +98,20 @@ end_register:
+ return ret;
+ }
+
++/**
++ * logic_pio_unregister_range - unregister a logical PIO range for a host
++ * @range: pointer to the IO range which has been already registered.
++ *
++ * Unregister a previously-registered IO range node.
++ */
++void logic_pio_unregister_range(struct logic_pio_hwaddr *range)
++{
++ mutex_lock(&io_range_mutex);
++ list_del_rcu(&range->list);
++ mutex_unlock(&io_range_mutex);
++ synchronize_rcu();
++}
++
+ /**
+ * find_io_range_by_fwnode - find logical PIO range for given FW node
+ * @fwnode: FW node handle associated with logical PIO range
+@@ -108,26 +122,38 @@ end_register:
+ */
+ struct logic_pio_hwaddr *find_io_range_by_fwnode(struct fwnode_handle *fwnode)
+ {
+- struct logic_pio_hwaddr *range;
++ struct logic_pio_hwaddr *range, *found_range = NULL;
+
++ rcu_read_lock();
+ list_for_each_entry_rcu(range, &io_range_list, list) {
+- if (range->fwnode == fwnode)
+- return range;
++ if (range->fwnode == fwnode) {
++ found_range = range;
++ break;
++ }
+ }
+- return NULL;
++ rcu_read_unlock();
++
++ return found_range;
+ }
+
+ /* Return a registered range given an input PIO token */
+ static struct logic_pio_hwaddr *find_io_range(unsigned long pio)
+ {
+- struct logic_pio_hwaddr *range;
++ struct logic_pio_hwaddr *range, *found_range = NULL;
+
++ rcu_read_lock();
+ list_for_each_entry_rcu(range, &io_range_list, list) {
+- if (in_range(pio, range->io_start, range->size))
+- return range;
++ if (in_range(pio, range->io_start, range->size)) {
++ found_range = range;
++ break;
++ }
+ }
+- pr_err("PIO entry token %lx invalid\n", pio);
+- return NULL;
++ rcu_read_unlock();
++
++ if (!found_range)
++ pr_err("PIO entry token 0x%lx invalid\n", pio);
++
++ return found_range;
+ }
+
+ /**
+@@ -180,14 +206,23 @@ unsigned long logic_pio_trans_cpuaddr(resource_size_t addr)
+ {
+ struct logic_pio_hwaddr *range;
+
++ rcu_read_lock();
+ list_for_each_entry_rcu(range, &io_range_list, list) {
+ if (range->flags != LOGIC_PIO_CPU_MMIO)
+ continue;
+- if (in_range(addr, range->hw_start, range->size))
+- return addr - range->hw_start + range->io_start;
++ if (in_range(addr, range->hw_start, range->size)) {
++ unsigned long cpuaddr;
++
++ cpuaddr = addr - range->hw_start + range->io_start;
++
++ rcu_read_unlock();
++ return cpuaddr;
++ }
+ }
+- pr_err("addr %llx not registered in io_range_list\n",
+- (unsigned long long) addr);
++ rcu_read_unlock();
++
++ pr_err("addr %pa not registered in io_range_list\n", &addr);
++
+ return ~0UL;
+ }
+
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index c2c4f739da8f..4b9063d12b93 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -2432,7 +2432,9 @@ struct zs_pool *zs_create_pool(const char *name)
+ if (!pool->name)
+ goto err;
+
++#ifdef CONFIG_COMPACTION
+ init_waitqueue_head(&pool->migration_wait);
++#endif
+
+ if (create_cache(pool))
+ goto err;
+diff --git a/net/core/stream.c b/net/core/stream.c
+index 7d329fb1f553..7f5eaa95a675 100644
+--- a/net/core/stream.c
++++ b/net/core/stream.c
+@@ -120,7 +120,6 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
+ int err = 0;
+ long vm_wait = 0;
+ long current_timeo = *timeo_p;
+- bool noblock = (*timeo_p ? false : true);
+ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+
+ if (sk_stream_memory_free(sk))
+@@ -133,11 +132,8 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
+
+ if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
+ goto do_error;
+- if (!*timeo_p) {
+- if (noblock)
+- set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+- goto do_nonblock;
+- }
++ if (!*timeo_p)
++ goto do_eagain;
+ if (signal_pending(current))
+ goto do_interrupted;
+ sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
+@@ -169,7 +165,13 @@ out:
+ do_error:
+ err = -EPIPE;
+ goto out;
+-do_nonblock:
++do_eagain:
++ /* Make sure that whenever EAGAIN is returned, EPOLLOUT event can
++ * be generated later.
++ * When TCP receives ACK packets that make room, tcp_check_space()
++ * only calls tcp_new_space() if SOCK_NOSPACE is set.
++ */
++ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+ err = -EAGAIN;
+ goto out;
+ do_interrupted:
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index ad75c468ecfb..0167e23d1c8f 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -587,7 +587,13 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
+
+ if (!rt)
+ goto out;
+- net = dev_net(rt->dst.dev);
++
++ if (rt->dst.dev)
++ net = dev_net(rt->dst.dev);
++ else if (skb_in->dev)
++ net = dev_net(skb_in->dev);
++ else
++ goto out;
+
+ /*
+ * Find the original header. It is expected to be valid, of course.
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index c57efd5c5b38..49e2f6dac646 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -995,7 +995,8 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
+ int err = 0;
+
+ if (addr_type == IPV6_ADDR_ANY ||
+- addr_type & IPV6_ADDR_MULTICAST ||
++ (addr_type & IPV6_ADDR_MULTICAST &&
++ !(cfg->ifa_flags & IFA_F_MCAUTOJOIN)) ||
+ (!(idev->dev->flags & IFF_LOOPBACK) &&
+ addr_type & IPV6_ADDR_LOOPBACK))
+ return ERR_PTR(-EADDRNOTAVAIL);
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 81220077d62f..c88586380134 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -3109,7 +3109,7 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,
+ rt->fib6_metric = cfg->fc_metric;
+ rt->fib6_nh.nh_weight = 1;
+
+- rt->fib6_type = cfg->fc_type;
++ rt->fib6_type = cfg->fc_type ? : RTN_UNICAST;
+
+ /* We cannot add true routes via loopback here,
+ they would result in kernel looping; promote them to reject routes
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 40c510223467..a48e83b19cfa 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1471,6 +1471,11 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+ if (is_multicast_ether_addr(mac))
+ return -EINVAL;
+
++ if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER) &&
++ sdata->vif.type == NL80211_IFTYPE_STATION &&
++ !sdata->u.mgd.associated)
++ return -EINVAL;
++
+ sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
+ if (!sta)
+ return -ENOMEM;
+@@ -1478,10 +1483,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+ if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
+ sta->sta.tdls = true;
+
+- if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
+- !sdata->u.mgd.associated)
+- return -EINVAL;
+-
+ err = sta_apply_parameters(local, sta, params);
+ if (err) {
+ sta_info_free(local, sta);
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 7523d995ea8a..b12f23c996f4 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2372,11 +2372,13 @@ static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
+ skb->protocol == cpu_to_be16(ETH_P_PREAUTH)) &&
+ sdata->control_port_over_nl80211)) {
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+- bool noencrypt = status->flag & RX_FLAG_DECRYPTED;
++ bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
+
+ cfg80211_rx_control_port(dev, skb, noencrypt);
+ dev_kfree_skb(skb);
+ } else {
++ memset(skb->cb, 0, sizeof(skb->cb));
++
+ /* deliver to local stack */
+ if (rx->napi)
+ napi_gro_receive(rx->napi, skb);
+@@ -2470,8 +2472,6 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
+
+ if (skb) {
+ skb->protocol = eth_type_trans(skb, dev);
+- memset(skb->cb, 0, sizeof(skb->cb));
+-
+ ieee80211_deliver_skb_to_local_stack(skb, rx);
+ }
+
+diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
+index d8366ed51757..28361aef9982 100644
+--- a/net/smc/smc_tx.c
++++ b/net/smc/smc_tx.c
+@@ -75,13 +75,11 @@ static int smc_tx_wait(struct smc_sock *smc, int flags)
+ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ struct smc_connection *conn = &smc->conn;
+ struct sock *sk = &smc->sk;
+- bool noblock;
+ long timeo;
+ int rc = 0;
+
+ /* similar to sk_stream_wait_memory */
+ timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
+- noblock = timeo ? false : true;
+ add_wait_queue(sk_sleep(sk), &wait);
+ while (1) {
+ sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
+@@ -96,8 +94,8 @@ static int smc_tx_wait(struct smc_sock *smc, int flags)
+ break;
+ }
+ if (!timeo) {
+- if (noblock)
+- set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
++ /* ensure EPOLLOUT is subsequently generated */
++ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+ rc = -EAGAIN;
+ break;
+ }
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index 4c0ac79f82d4..3288bdff9889 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -301,6 +301,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
+ #else
+ {
+ #endif
++ if (sk->sk_write_space == tls_write_space)
++ sk->sk_write_space = ctx->sk_write_space;
+ tls_ctx_free(ctx);
+ ctx = NULL;
+ }
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index 6848a8196711..bbb2da70e870 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -354,7 +354,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ {
+ struct tls_context *tls_ctx = tls_get_ctx(sk);
+ struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
+- int ret = 0;
++ int ret;
+ int required_size;
+ long timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
+ bool eor = !(msg->msg_flags & MSG_MORE);
+@@ -370,7 +370,8 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+
+ lock_sock(sk);
+
+- if (tls_complete_pending_work(sk, tls_ctx, msg->msg_flags, &timeo))
++ ret = tls_complete_pending_work(sk, tls_ctx, msg->msg_flags, &timeo);
++ if (ret)
+ goto send_end;
+
+ if (unlikely(msg->msg_controllen)) {
+@@ -505,7 +506,7 @@ int tls_sw_sendpage(struct sock *sk, struct page *page,
+ {
+ struct tls_context *tls_ctx = tls_get_ctx(sk);
+ struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
+- int ret = 0;
++ int ret;
+ long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
+ bool eor;
+ size_t orig_size = size;
+@@ -525,7 +526,8 @@ int tls_sw_sendpage(struct sock *sk, struct page *page,
+
+ sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
+
+- if (tls_complete_pending_work(sk, tls_ctx, flags, &timeo))
++ ret = tls_complete_pending_work(sk, tls_ctx, flags, &timeo);
++ if (ret)
+ goto sendpage_end;
+
+ /* Call the sk_stream functions to manage the sndbuf mem. */
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 8a47297ff206..d8ebf4f0ef6e 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2777,7 +2777,7 @@ static void reg_process_pending_hints(void)
+
+ /* When last_request->processed becomes true this will be rescheduled */
+ if (lr && !lr->processed) {
+- reg_process_hint(lr);
++ pr_debug("Pending regulatory request, waiting for it to be processed...\n");
+ return;
+ }
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index bbf91a5a938b..bd3d68e0489d 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1818,8 +1818,7 @@ static int snd_seq_ioctl_get_client_pool(struct snd_seq_client *client,
+ if (cptr->type == USER_CLIENT) {
+ info->input_pool = cptr->data.user.fifo_pool_size;
+ info->input_free = info->input_pool;
+- if (cptr->data.user.fifo)
+- info->input_free = snd_seq_unused_cells(cptr->data.user.fifo->pool);
++ info->input_free = snd_seq_fifo_unused_cells(cptr->data.user.fifo);
+ } else {
+ info->input_pool = 0;
+ info->input_free = 0;
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index 72c0302a55d2..6a24732704fc 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -280,3 +280,20 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize)
+
+ return 0;
+ }
++
++/* get the number of unused cells safely */
++int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f)
++{
++ unsigned long flags;
++ int cells;
++
++ if (!f)
++ return 0;
++
++ snd_use_lock_use(&f->use_lock);
++ spin_lock_irqsave(&f->lock, flags);
++ cells = snd_seq_unused_cells(f->pool);
++ spin_unlock_irqrestore(&f->lock, flags);
++ snd_use_lock_free(&f->use_lock);
++ return cells;
++}
+diff --git a/sound/core/seq/seq_fifo.h b/sound/core/seq/seq_fifo.h
+index 062c446e7867..5d38a0d7f0cd 100644
+--- a/sound/core/seq/seq_fifo.h
++++ b/sound/core/seq/seq_fifo.h
+@@ -68,5 +68,7 @@ int snd_seq_fifo_poll_wait(struct snd_seq_fifo *f, struct file *file, poll_table
+ /* resize pool in fifo */
+ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize);
+
++/* get the number of unused cells safely */
++int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f);
+
+ #endif
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 6f17b256fcd0..ae8fde4c1a12 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -624,18 +624,20 @@ static void cxt_fixup_hp_gate_mic_jack(struct hda_codec *codec,
+
+ /* update LED status via GPIO */
+ static void cxt_update_gpio_led(struct hda_codec *codec, unsigned int mask,
+- bool enabled)
++ bool led_on)
+ {
+ struct conexant_spec *spec = codec->spec;
+ unsigned int oldval = spec->gpio_led;
+
+ if (spec->mute_led_polarity)
+- enabled = !enabled;
++ led_on = !led_on;
+
+- if (enabled)
+- spec->gpio_led &= ~mask;
+- else
++ if (led_on)
+ spec->gpio_led |= mask;
++ else
++ spec->gpio_led &= ~mask;
++ codec_dbg(codec, "mask:%d enabled:%d gpio_led:%d\n",
++ mask, led_on, spec->gpio_led);
+ if (spec->gpio_led != oldval)
+ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
+ spec->gpio_led);
+@@ -646,8 +648,8 @@ static void cxt_fixup_gpio_mute_hook(void *private_data, int enabled)
+ {
+ struct hda_codec *codec = private_data;
+ struct conexant_spec *spec = codec->spec;
+-
+- cxt_update_gpio_led(codec, spec->gpio_mute_led_mask, enabled);
++ /* muted -> LED on */
++ cxt_update_gpio_led(codec, spec->gpio_mute_led_mask, !enabled);
+ }
+
+ /* turn on/off mic-mute LED via GPIO per capture hook */
+@@ -669,7 +671,6 @@ static void cxt_fixup_mute_led_gpio(struct hda_codec *codec,
+ { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x03 },
+ {}
+ };
+- codec_info(codec, "action: %d gpio_led: %d\n", action, spec->gpio_led);
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ spec->gen.vmaster_mute.hook = cxt_fixup_gpio_mute_hook;
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index dafc3b7f8d72..62aa320c2070 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1513,11 +1513,8 @@ static int soc_probe_link_dais(struct snd_soc_card *card,
+ }
+ }
+
+- if (dai_link->dai_fmt) {
+- ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
+- if (ret)
+- return ret;
+- }
++ if (dai_link->dai_fmt)
++ snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
+
+ ret = soc_post_component_init(rtd, dai_link->name);
+ if (ret)
+diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
+index 78c2d6cab3b5..531564269444 100644
+--- a/sound/usb/line6/pcm.c
++++ b/sound/usb/line6/pcm.c
+@@ -554,6 +554,15 @@ int line6_init_pcm(struct usb_line6 *line6,
+ line6pcm->volume_monitor = 255;
+ line6pcm->line6 = line6;
+
++ spin_lock_init(&line6pcm->out.lock);
++ spin_lock_init(&line6pcm->in.lock);
++ line6pcm->impulse_period = LINE6_IMPULSE_DEFAULT_PERIOD;
++
++ line6->line6pcm = line6pcm;
++
++ pcm->private_data = line6pcm;
++ pcm->private_free = line6_cleanup_pcm;
++
+ line6pcm->max_packet_size_in =
+ usb_maxpacket(line6->usbdev,
+ usb_rcvisocpipe(line6->usbdev, ep_read), 0);
+@@ -566,15 +575,6 @@ int line6_init_pcm(struct usb_line6 *line6,
+ return -EINVAL;
+ }
+
+- spin_lock_init(&line6pcm->out.lock);
+- spin_lock_init(&line6pcm->in.lock);
+- line6pcm->impulse_period = LINE6_IMPULSE_DEFAULT_PERIOD;
+-
+- line6->line6pcm = line6pcm;
+-
+- pcm->private_data = line6pcm;
+- pcm->private_free = line6_cleanup_pcm;
+-
+ err = line6_create_audio_out_urbs(line6pcm);
+ if (err < 0)
+ return err;
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 4b3e1c48ca2f..b0c5d4ef6137 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -754,7 +754,6 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
+ struct uac_mixer_unit_descriptor *desc)
+ {
+ int mu_channels;
+- void *c;
+
+ if (desc->bLength < sizeof(*desc))
+ return -EINVAL;
+@@ -777,13 +776,6 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
+ break;
+ }
+
+- if (!mu_channels)
+- return 0;
+-
+- c = uac_mixer_unit_bmControls(desc, state->mixer->protocol);
+- if (c - (void *)desc + (mu_channels - 1) / 8 >= desc->bLength)
+- return 0; /* no bmControls -> skip */
+-
+ return mu_channels;
+ }
+
+@@ -2028,6 +2020,31 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid,
+ * Mixer Unit
+ */
+
++/* check whether the given in/out overflows bmMixerControls matrix */
++static bool mixer_bitmap_overflow(struct uac_mixer_unit_descriptor *desc,
++ int protocol, int num_ins, int num_outs)
++{
++ u8 *hdr = (u8 *)desc;
++ u8 *c = uac_mixer_unit_bmControls(desc, protocol);
++ size_t rest; /* remaining bytes after bmMixerControls */
++
++ switch (protocol) {
++ case UAC_VERSION_1:
++ default:
++ rest = 1; /* iMixer */
++ break;
++ case UAC_VERSION_2:
++ rest = 2; /* bmControls + iMixer */
++ break;
++ case UAC_VERSION_3:
++ rest = 6; /* bmControls + wMixerDescrStr */
++ break;
++ }
++
++ /* overflow? */
++ return c + (num_ins * num_outs + 7) / 8 + rest > hdr + hdr[0];
++}
++
+ /*
+ * build a mixer unit control
+ *
+@@ -2156,6 +2173,9 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
+ if (err < 0)
+ return err;
+ num_ins += iterm.channels;
++ if (mixer_bitmap_overflow(desc, state->mixer->protocol,
++ num_ins, num_outs))
++ break;
+ for (; ich < num_ins; ich++) {
+ int och, ich_has_controls = 0;
+
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 5b342fe30c75..10c6971cf477 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -1167,17 +1167,17 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip,
+ {
+ struct usb_mixer_interface *mixer;
+ struct usb_mixer_elem_info *cval;
+- int unitid = 12; /* SamleRate ExtensionUnit ID */
++ int unitid = 12; /* SampleRate ExtensionUnit ID */
+
+ list_for_each_entry(mixer, &chip->mixer_list, list) {
+- cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
+- if (cval) {
++ if (mixer->id_elems[unitid]) {
++ cval = mixer_elem_list_to_info(mixer->id_elems[unitid]);
+ snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR,
+ cval->control << 8,
+ samplerate_id);
+ snd_usb_mixer_notify_id(mixer, unitid);
++ break;
+ }
+- break;
+ }
+ }
+
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index db114f3977e0..35c57a4204a8 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -350,6 +350,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ ep = 0x81;
+ ifnum = 2;
+ goto add_sync_ep_from_ifnum;
++ case USB_ID(0x1397, 0x0001): /* Behringer UFX1604 */
+ case USB_ID(0x1397, 0x0002): /* Behringer UFX1204 */
+ ep = 0x81;
+ ifnum = 1;
+diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
+index d7e06fe0270e..0ce50c319cfd 100644
+--- a/tools/hv/hv_kvp_daemon.c
++++ b/tools/hv/hv_kvp_daemon.c
+@@ -1386,6 +1386,8 @@ int main(int argc, char *argv[])
+ daemonize = 0;
+ break;
+ case 'h':
++ print_usage(argv);
++ exit(0);
+ default:
+ print_usage(argv);
+ exit(EXIT_FAILURE);
+diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c
+index b13300172762..c2bb8a360177 100644
+--- a/tools/hv/hv_vss_daemon.c
++++ b/tools/hv/hv_vss_daemon.c
+@@ -229,6 +229,8 @@ int main(int argc, char *argv[])
+ daemonize = 0;
+ break;
+ case 'h':
++ print_usage(argv);
++ exit(0);
+ default:
+ print_usage(argv);
+ exit(EXIT_FAILURE);
+diff --git a/tools/hv/lsvmbus b/tools/hv/lsvmbus
+index 55e7374bade0..099f2c44dbed 100644
+--- a/tools/hv/lsvmbus
++++ b/tools/hv/lsvmbus
+@@ -4,10 +4,10 @@
+ import os
+ from optparse import OptionParser
+
++help_msg = "print verbose messages. Try -vv, -vvv for more verbose messages"
+ parser = OptionParser()
+-parser.add_option("-v", "--verbose", dest="verbose",
+- help="print verbose messages. Try -vv, -vvv for \
+- more verbose messages", action="count")
++parser.add_option(
++ "-v", "--verbose", dest="verbose", help=help_msg, action="count")
+
+ (options, args) = parser.parse_args()
+
+@@ -21,27 +21,28 @@ if not os.path.isdir(vmbus_sys_path):
+ exit(-1)
+
+ vmbus_dev_dict = {
+- '{0e0b6031-5213-4934-818b-38d90ced39db}' : '[Operating system shutdown]',
+- '{9527e630-d0ae-497b-adce-e80ab0175caf}' : '[Time Synchronization]',
+- '{57164f39-9115-4e78-ab55-382f3bd5422d}' : '[Heartbeat]',
+- '{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}' : '[Data Exchange]',
+- '{35fa2e29-ea23-4236-96ae-3a6ebacba440}' : '[Backup (volume checkpoint)]',
+- '{34d14be3-dee4-41c8-9ae7-6b174977c192}' : '[Guest services]',
+- '{525074dc-8985-46e2-8057-a307dc18a502}' : '[Dynamic Memory]',
+- '{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}' : 'Synthetic mouse',
+- '{f912ad6d-2b17-48ea-bd65-f927a61c7684}' : 'Synthetic keyboard',
+- '{da0a7802-e377-4aac-8e77-0558eb1073f8}' : 'Synthetic framebuffer adapter',
+- '{f8615163-df3e-46c5-913f-f2d2f965ed0e}' : 'Synthetic network adapter',
+- '{32412632-86cb-44a2-9b5c-50d1417354f5}' : 'Synthetic IDE Controller',
+- '{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}' : 'Synthetic SCSI Controller',
+- '{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}' : 'Synthetic fiber channel adapter',
+- '{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}' : 'Synthetic RDMA adapter',
+- '{44c4f61d-4444-4400-9d52-802e27ede19f}' : 'PCI Express pass-through',
+- '{276aacf4-ac15-426c-98dd-7521ad3f01fe}' : '[Reserved system device]',
+- '{f8e65716-3cb3-4a06-9a60-1889c5cccab5}' : '[Reserved system device]',
+- '{3375baf4-9e15-4b30-b765-67acb10d607b}' : '[Reserved system device]',
++ '{0e0b6031-5213-4934-818b-38d90ced39db}': '[Operating system shutdown]',
++ '{9527e630-d0ae-497b-adce-e80ab0175caf}': '[Time Synchronization]',
++ '{57164f39-9115-4e78-ab55-382f3bd5422d}': '[Heartbeat]',
++ '{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}': '[Data Exchange]',
++ '{35fa2e29-ea23-4236-96ae-3a6ebacba440}': '[Backup (volume checkpoint)]',
++ '{34d14be3-dee4-41c8-9ae7-6b174977c192}': '[Guest services]',
++ '{525074dc-8985-46e2-8057-a307dc18a502}': '[Dynamic Memory]',
++ '{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}': 'Synthetic mouse',
++ '{f912ad6d-2b17-48ea-bd65-f927a61c7684}': 'Synthetic keyboard',
++ '{da0a7802-e377-4aac-8e77-0558eb1073f8}': 'Synthetic framebuffer adapter',
++ '{f8615163-df3e-46c5-913f-f2d2f965ed0e}': 'Synthetic network adapter',
++ '{32412632-86cb-44a2-9b5c-50d1417354f5}': 'Synthetic IDE Controller',
++ '{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}': 'Synthetic SCSI Controller',
++ '{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}': 'Synthetic fiber channel adapter',
++ '{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}': 'Synthetic RDMA adapter',
++ '{44c4f61d-4444-4400-9d52-802e27ede19f}': 'PCI Express pass-through',
++ '{276aacf4-ac15-426c-98dd-7521ad3f01fe}': '[Reserved system device]',
++ '{f8e65716-3cb3-4a06-9a60-1889c5cccab5}': '[Reserved system device]',
++ '{3375baf4-9e15-4b30-b765-67acb10d607b}': '[Reserved system device]',
+ }
+
++
+ def get_vmbus_dev_attr(dev_name, attr):
+ try:
+ f = open('%s/%s/%s' % (vmbus_sys_path, dev_name, attr), 'r')
+@@ -52,6 +53,7 @@ def get_vmbus_dev_attr(dev_name, attr):
+
+ return lines
+
++
+ class VMBus_Dev:
+ pass
+
+@@ -66,12 +68,13 @@ for f in os.listdir(vmbus_sys_path):
+
+ chn_vp_mapping = get_vmbus_dev_attr(f, 'channel_vp_mapping')
+ chn_vp_mapping = [c.strip() for c in chn_vp_mapping]
+- chn_vp_mapping = sorted(chn_vp_mapping,
+- key = lambda c : int(c.split(':')[0]))
++ chn_vp_mapping = sorted(
++ chn_vp_mapping, key=lambda c: int(c.split(':')[0]))
+
+- chn_vp_mapping = ['\tRel_ID=%s, target_cpu=%s' %
+- (c.split(':')[0], c.split(':')[1])
+- for c in chn_vp_mapping]
++ chn_vp_mapping = [
++ '\tRel_ID=%s, target_cpu=%s' %
++ (c.split(':')[0], c.split(':')[1]) for c in chn_vp_mapping
++ ]
+ d = VMBus_Dev()
+ d.sysfs_path = '%s/%s' % (vmbus_sys_path, f)
+ d.vmbus_id = vmbus_id
+@@ -85,7 +88,7 @@ for f in os.listdir(vmbus_sys_path):
+ vmbus_dev_list.append(d)
+
+
+-vmbus_dev_list = sorted(vmbus_dev_list, key = lambda d : int(d.vmbus_id))
++vmbus_dev_list = sorted(vmbus_dev_list, key=lambda d: int(d.vmbus_id))
+
+ format0 = '%2s: %s'
+ format1 = '%2s: Class_ID = %s - %s\n%s'
+@@ -95,9 +98,15 @@ for d in vmbus_dev_list:
+ if verbose == 0:
+ print(('VMBUS ID ' + format0) % (d.vmbus_id, d.dev_desc))
+ elif verbose == 1:
+- print (('VMBUS ID ' + format1) % \
+- (d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping))
++ print(
++ ('VMBUS ID ' + format1) %
++ (d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping)
++ )
+ else:
+- print (('VMBUS ID ' + format2) % \
+- (d.vmbus_id, d.class_id, d.dev_desc, \
+- d.device_id, d.sysfs_path, d.chn_vp_mapping))
++ print(
++ ('VMBUS ID ' + format2) %
++ (
++ d.vmbus_id, d.class_id, d.dev_desc,
++ d.device_id, d.sysfs_path, d.chn_vp_mapping
++ )
++ )
+diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
+index ceeda7e04a4d..762f81900529 100644
+--- a/virt/kvm/arm/vgic/vgic-mmio.c
++++ b/virt/kvm/arm/vgic/vgic-mmio.c
+@@ -203,6 +203,12 @@ static void vgic_hw_irq_spending(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
+ vgic_irq_set_phys_active(irq, true);
+ }
+
++static bool is_vgic_v2_sgi(struct kvm_vcpu *vcpu, struct vgic_irq *irq)
++{
++ return (vgic_irq_is_sgi(irq->intid) &&
++ vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V2);
++}
++
+ void vgic_mmio_write_spending(struct kvm_vcpu *vcpu,
+ gpa_t addr, unsigned int len,
+ unsigned long val)
+@@ -215,6 +221,12 @@ void vgic_mmio_write_spending(struct kvm_vcpu *vcpu,
+ for_each_set_bit(i, &val, len * 8) {
+ struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
+
++ /* GICD_ISPENDR0 SGI bits are WI */
++ if (is_vgic_v2_sgi(vcpu, irq)) {
++ vgic_put_irq(vcpu->kvm, irq);
++ continue;
++ }
++
+ spin_lock_irqsave(&irq->irq_lock, flags);
+ if (irq->hw)
+ vgic_hw_irq_spending(vcpu, irq, is_uaccess);
+@@ -262,6 +274,12 @@ void vgic_mmio_write_cpending(struct kvm_vcpu *vcpu,
+ for_each_set_bit(i, &val, len * 8) {
+ struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
+
++ /* GICD_ICPENDR0 SGI bits are WI */
++ if (is_vgic_v2_sgi(vcpu, irq)) {
++ vgic_put_irq(vcpu->kvm, irq);
++ continue;
++ }
++
+ spin_lock_irqsave(&irq->irq_lock, flags);
+
+ if (irq->hw)
+diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
+index 57281c1594d0..91b14dfacd1d 100644
+--- a/virt/kvm/arm/vgic/vgic-v2.c
++++ b/virt/kvm/arm/vgic/vgic-v2.c
+@@ -195,7 +195,10 @@ void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
+ if (vgic_irq_is_sgi(irq->intid)) {
+ u32 src = ffs(irq->source);
+
+- BUG_ON(!src);
++ if (WARN_RATELIMIT(!src, "No SGI source for INTID %d\n",
++ irq->intid))
++ return;
++
+ val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
+ irq->source &= ~(1 << (src - 1));
+ if (irq->source) {
+diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
+index 5c55995a1a16..8b958ed05306 100644
+--- a/virt/kvm/arm/vgic/vgic-v3.c
++++ b/virt/kvm/arm/vgic/vgic-v3.c
+@@ -179,7 +179,10 @@ void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
+ model == KVM_DEV_TYPE_ARM_VGIC_V2) {
+ u32 src = ffs(irq->source);
+
+- BUG_ON(!src);
++ if (WARN_RATELIMIT(!src, "No SGI source for INTID %d\n",
++ irq->intid))
++ return;
++
+ val |= (src - 1) << GICH_LR_PHYSID_CPUID_SHIFT;
+ irq->source &= ~(1 << (src - 1));
+ if (irq->source) {
+diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
+index 250cd72c95a5..4040a33cdc90 100644
+--- a/virt/kvm/arm/vgic/vgic.c
++++ b/virt/kvm/arm/vgic/vgic.c
+@@ -244,6 +244,13 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
+ bool penda, pendb;
+ int ret;
+
++ /*
++ * list_sort may call this function with the same element when
++ * the list is fairly long.
++ */
++ if (unlikely(irqa == irqb))
++ return 0;
++
+ spin_lock(&irqa->irq_lock);
+ spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);
+
diff --git a/1070_linux-4.19.71.patch b/1070_linux-4.19.71.patch
new file mode 100644
index 0000000..3bb5f04
--- /dev/null
+++ b/1070_linux-4.19.71.patch
@@ -0,0 +1,92 @@
+diff --git a/Makefile b/Makefile
+index ecf8806cb71f..f6c9d5757470 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 70
++SUBLEVEL = 71
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index eb9b9de47fd1..530142b5a115 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1810,30 +1810,6 @@ static int elantech_create_smbus(struct psmouse *psmouse,
+ leave_breadcrumbs);
+ }
+
+-static bool elantech_use_host_notify(struct psmouse *psmouse,
+- struct elantech_device_info *info)
+-{
+- if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
+- return true;
+-
+- switch (info->bus) {
+- case ETP_BUS_PS2_ONLY:
+- /* expected case */
+- break;
+- case ETP_BUS_SMB_HST_NTFY_ONLY:
+- case ETP_BUS_PS2_SMB_HST_NTFY:
+- /* SMbus implementation is stable since 2018 */
+- if (dmi_get_bios_year() >= 2018)
+- return true;
+- default:
+- psmouse_dbg(psmouse,
+- "Ignoring SMBus bus provider %d\n", info->bus);
+- break;
+- }
+-
+- return false;
+-}
+-
+ /**
+ * elantech_setup_smbus - called once the PS/2 devices are enumerated
+ * and decides to instantiate a SMBus InterTouch device.
+@@ -1853,7 +1829,7 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
+ * i2c_blacklist_pnp_ids.
+ * Old ICs are up to the user to decide.
+ */
+- if (!elantech_use_host_notify(psmouse, info) ||
++ if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) ||
+ psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids))
+ return -ENXIO;
+ }
+@@ -1873,6 +1849,34 @@ static int elantech_setup_smbus(struct psmouse *psmouse,
+ return 0;
+ }
+
++static bool elantech_use_host_notify(struct psmouse *psmouse,
++ struct elantech_device_info *info)
++{
++ if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version))
++ return true;
++
++ switch (info->bus) {
++ case ETP_BUS_PS2_ONLY:
++ /* expected case */
++ break;
++ case ETP_BUS_SMB_ALERT_ONLY:
++ /* fall-through */
++ case ETP_BUS_PS2_SMB_ALERT:
++ psmouse_dbg(psmouse, "Ignoring SMBus provider through alert protocol.\n");
++ break;
++ case ETP_BUS_SMB_HST_NTFY_ONLY:
++ /* fall-through */
++ case ETP_BUS_PS2_SMB_HST_NTFY:
++ return true;
++ default:
++ psmouse_dbg(psmouse,
++ "Ignoring SMBus bus provider %d.\n",
++ info->bus);
++ }
++
++ return false;
++}
++
+ int elantech_init_smbus(struct psmouse *psmouse)
+ {
+ struct elantech_device_info info;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-09-10 11:12 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-09-10 11:12 UTC (permalink / raw
To: gentoo-commits
commit: c0678b2b22ff8412e43d12fbd0c2b879023c728c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Sep 10 11:12:34 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Sep 10 11:12:34 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c0678b2b
Linux patch 4.19.72
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1071_linux-4.19.72.patch | 2096 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2100 insertions(+)
diff --git a/0000_README b/0000_README
index 807b793..5a202ee 100644
--- a/0000_README
+++ b/0000_README
@@ -323,6 +323,10 @@ Patch: 1070_linux-4.19.70.patch
From: https://www.kernel.org
Desc: Linux 4.19.70
+Patch: 1071_linux-4.19.71.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.71
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1071_linux-4.19.72.patch b/1071_linux-4.19.72.patch
new file mode 100644
index 0000000..3d76e8b
--- /dev/null
+++ b/1071_linux-4.19.72.patch
@@ -0,0 +1,2096 @@
+diff --git a/Makefile b/Makefile
+index f6c9d5757470..ef80b1dfb753 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 71
++SUBLEVEL = 72
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c
+index f8debf7aeb4c..76e1edf5bf12 100644
+--- a/arch/x86/boot/compressed/pgtable_64.c
++++ b/arch/x86/boot/compressed/pgtable_64.c
+@@ -73,6 +73,8 @@ static unsigned long find_trampoline_placement(void)
+
+ /* Find the first usable memory region under bios_start. */
+ for (i = boot_params->e820_entries - 1; i >= 0; i--) {
++ unsigned long new = bios_start;
++
+ entry = &boot_params->e820_table[i];
+
+ /* Skip all entries above bios_start. */
+@@ -85,15 +87,20 @@ static unsigned long find_trampoline_placement(void)
+
+ /* Adjust bios_start to the end of the entry if needed. */
+ if (bios_start > entry->addr + entry->size)
+- bios_start = entry->addr + entry->size;
++ new = entry->addr + entry->size;
+
+ /* Keep bios_start page-aligned. */
+- bios_start = round_down(bios_start, PAGE_SIZE);
++ new = round_down(new, PAGE_SIZE);
+
+ /* Skip the entry if it's too small. */
+- if (bios_start - TRAMPOLINE_32BIT_SIZE < entry->addr)
++ if (new - TRAMPOLINE_32BIT_SIZE < entry->addr)
+ continue;
+
++ /* Protect against underflow. */
++ if (new - TRAMPOLINE_32BIT_SIZE > bios_start)
++ break;
++
++ bios_start = new;
+ break;
+ }
+
+diff --git a/arch/x86/include/asm/bootparam_utils.h b/arch/x86/include/asm/bootparam_utils.h
+index d3983fdf1012..8fa49cf1211d 100644
+--- a/arch/x86/include/asm/bootparam_utils.h
++++ b/arch/x86/include/asm/bootparam_utils.h
+@@ -71,6 +71,7 @@ static void sanitize_boot_params(struct boot_params *boot_params)
+ BOOT_PARAM_PRESERVE(eddbuf_entries),
+ BOOT_PARAM_PRESERVE(edd_mbr_sig_buf_entries),
+ BOOT_PARAM_PRESERVE(edd_mbr_sig_buffer),
++ BOOT_PARAM_PRESERVE(secure_boot),
+ BOOT_PARAM_PRESERVE(hdr),
+ BOOT_PARAM_PRESERVE(e820_table),
+ BOOT_PARAM_PRESERVE(eddbuf),
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 90be3a1506d3..b316bd61a6ac 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1140,10 +1140,6 @@ void clear_local_APIC(void)
+ apic_write(APIC_LVT0, v | APIC_LVT_MASKED);
+ v = apic_read(APIC_LVT1);
+ apic_write(APIC_LVT1, v | APIC_LVT_MASKED);
+- if (!x2apic_enabled()) {
+- v = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
+- apic_write(APIC_LDR, v);
+- }
+ if (maxlvt >= 4) {
+ v = apic_read(APIC_LVTPC);
+ apic_write(APIC_LVTPC, v | APIC_LVT_MASKED);
+diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
+index ec9e03a6b778..9e70f7c7e565 100644
+--- a/drivers/bluetooth/btqca.c
++++ b/drivers/bluetooth/btqca.c
+@@ -363,6 +363,9 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
+ return err;
+ }
+
++ /* Give the controller some time to get ready to receive the NVM */
++ msleep(10);
++
+ /* Download NVM configuration */
+ config.type = TLV_TYPE_NVM;
+ if (soc_type == QCA_WCN3990)
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+index fd83046d8376..f6389479fccb 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -220,6 +220,7 @@ static int mtk_drm_kms_init(struct drm_device *drm)
+ struct mtk_drm_private *private = drm->dev_private;
+ struct platform_device *pdev;
+ struct device_node *np;
++ struct device *dma_dev;
+ int ret;
+
+ if (!iommu_present(&platform_bus_type))
+@@ -282,7 +283,29 @@ static int mtk_drm_kms_init(struct drm_device *drm)
+ goto err_component_unbind;
+ }
+
+- private->dma_dev = &pdev->dev;
++ dma_dev = &pdev->dev;
++ private->dma_dev = dma_dev;
++
++ /*
++ * Configure the DMA segment size to make sure we get contiguous IOVA
++ * when importing PRIME buffers.
++ */
++ if (!dma_dev->dma_parms) {
++ private->dma_parms_allocated = true;
++ dma_dev->dma_parms =
++ devm_kzalloc(drm->dev, sizeof(*dma_dev->dma_parms),
++ GFP_KERNEL);
++ }
++ if (!dma_dev->dma_parms) {
++ ret = -ENOMEM;
++ goto err_component_unbind;
++ }
++
++ ret = dma_set_max_seg_size(dma_dev, (unsigned int)DMA_BIT_MASK(32));
++ if (ret) {
++ dev_err(dma_dev, "Failed to set DMA segment size\n");
++ goto err_unset_dma_parms;
++ }
+
+ /*
+ * We don't use the drm_irq_install() helpers provided by the DRM
+@@ -292,13 +315,16 @@ static int mtk_drm_kms_init(struct drm_device *drm)
+ drm->irq_enabled = true;
+ ret = drm_vblank_init(drm, MAX_CRTC);
+ if (ret < 0)
+- goto err_component_unbind;
++ goto err_unset_dma_parms;
+
+ drm_kms_helper_poll_init(drm);
+ drm_mode_config_reset(drm);
+
+ return 0;
+
++err_unset_dma_parms:
++ if (private->dma_parms_allocated)
++ dma_dev->dma_parms = NULL;
+ err_component_unbind:
+ component_unbind_all(drm->dev, drm);
+ err_config_cleanup:
+@@ -309,9 +335,14 @@ err_config_cleanup:
+
+ static void mtk_drm_kms_deinit(struct drm_device *drm)
+ {
++ struct mtk_drm_private *private = drm->dev_private;
++
+ drm_kms_helper_poll_fini(drm);
+ drm_atomic_helper_shutdown(drm);
+
++ if (private->dma_parms_allocated)
++ private->dma_dev->dma_parms = NULL;
++
+ component_unbind_all(drm->dev, drm);
+ drm_mode_config_cleanup(drm);
+ }
+@@ -327,6 +358,18 @@ static const struct file_operations mtk_drm_fops = {
+ .compat_ioctl = drm_compat_ioctl,
+ };
+
++/*
++ * We need to override this because the device used to import the memory is
++ * not dev->dev, as drm_gem_prime_import() expects.
++ */
++struct drm_gem_object *mtk_drm_gem_prime_import(struct drm_device *dev,
++ struct dma_buf *dma_buf)
++{
++ struct mtk_drm_private *private = dev->dev_private;
++
++ return drm_gem_prime_import_dev(dev, dma_buf, private->dma_dev);
++}
++
+ static struct drm_driver mtk_drm_driver = {
+ .driver_features = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME |
+ DRIVER_ATOMIC,
+@@ -338,7 +381,7 @@ static struct drm_driver mtk_drm_driver = {
+ .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
+ .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
+ .gem_prime_export = drm_gem_prime_export,
+- .gem_prime_import = drm_gem_prime_import,
++ .gem_prime_import = mtk_drm_gem_prime_import,
+ .gem_prime_get_sg_table = mtk_gem_prime_get_sg_table,
+ .gem_prime_import_sg_table = mtk_gem_prime_import_sg_table,
+ .gem_prime_mmap = mtk_drm_gem_mmap_buf,
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.h b/drivers/gpu/drm/mediatek/mtk_drm_drv.h
+index ecc00ca3221d..8fa60d46f860 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.h
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.h
+@@ -59,6 +59,8 @@ struct mtk_drm_private {
+ } commit;
+
+ struct drm_atomic_state *suspend_state;
++
++ bool dma_parms_allocated;
+ };
+
+ extern struct platform_driver mtk_ddp_driver;
+diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
+index 271f31461da4..6f65f5257236 100644
+--- a/drivers/hid/hid-cp2112.c
++++ b/drivers/hid/hid-cp2112.c
+@@ -1160,8 +1160,6 @@ static unsigned int cp2112_gpio_irq_startup(struct irq_data *d)
+
+ INIT_DELAYED_WORK(&dev->gpio_poll_worker, cp2112_gpio_poll_callback);
+
+- cp2112_gpio_direction_input(gc, d->hwirq);
+-
+ if (!dev->gpio_poll) {
+ dev->gpio_poll = true;
+ schedule_delayed_work(&dev->gpio_poll_worker, 0);
+@@ -1209,6 +1207,12 @@ static int __maybe_unused cp2112_allocate_irq(struct cp2112_device *dev,
+ return PTR_ERR(dev->desc[pin]);
+ }
+
++ ret = cp2112_gpio_direction_input(&dev->gc, pin);
++ if (ret < 0) {
++ dev_err(dev->gc.parent, "Failed to set GPIO to input dir\n");
++ goto err_desc;
++ }
++
+ ret = gpiochip_lock_as_irq(&dev->gc, pin);
+ if (ret) {
+ dev_err(dev->gc.parent, "Failed to lock GPIO as interrupt\n");
+diff --git a/drivers/infiniband/hw/hfi1/fault.c b/drivers/infiniband/hw/hfi1/fault.c
+index 7eaff4dcbfd7..5bc811b7e6cf 100644
+--- a/drivers/infiniband/hw/hfi1/fault.c
++++ b/drivers/infiniband/hw/hfi1/fault.c
+@@ -141,12 +141,14 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf,
+ if (!data)
+ return -ENOMEM;
+ copy = min(len, datalen - 1);
+- if (copy_from_user(data, buf, copy))
+- return -EFAULT;
++ if (copy_from_user(data, buf, copy)) {
++ ret = -EFAULT;
++ goto free_data;
++ }
+
+ ret = debugfs_file_get(file->f_path.dentry);
+ if (unlikely(ret))
+- return ret;
++ goto free_data;
+ ptr = data;
+ token = ptr;
+ for (ptr = data; *ptr; ptr = end + 1, token = ptr) {
+@@ -195,6 +197,7 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf,
+ ret = len;
+
+ debugfs_file_put(file->f_path.dentry);
++free_data:
+ kfree(data);
+ return ret;
+ }
+@@ -214,7 +217,7 @@ static ssize_t fault_opcodes_read(struct file *file, char __user *buf,
+ return -ENOMEM;
+ ret = debugfs_file_get(file->f_path.dentry);
+ if (unlikely(ret))
+- return ret;
++ goto free_data;
+ bit = find_first_bit(fault->opcodes, bitsize);
+ while (bit < bitsize) {
+ zero = find_next_zero_bit(fault->opcodes, bitsize, bit);
+@@ -232,6 +235,7 @@ static ssize_t fault_opcodes_read(struct file *file, char __user *buf,
+ data[size - 1] = '\n';
+ data[size] = '\0';
+ ret = simple_read_from_buffer(buf, len, pos, data, size);
++free_data:
+ kfree(data);
+ return ret;
+ }
+diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
+index e5466d786bb1..5aaa2a6c431b 100644
+--- a/drivers/infiniband/hw/mlx4/mad.c
++++ b/drivers/infiniband/hw/mlx4/mad.c
+@@ -1668,8 +1668,6 @@ tx_err:
+ tx_buf_size, DMA_TO_DEVICE);
+ kfree(tun_qp->tx_ring[i].buf.addr);
+ }
+- kfree(tun_qp->tx_ring);
+- tun_qp->tx_ring = NULL;
+ i = MLX4_NUM_TUNNEL_BUFS;
+ err:
+ while (i > 0) {
+@@ -1678,6 +1676,8 @@ err:
+ rx_buf_size, DMA_FROM_DEVICE);
+ kfree(tun_qp->ring[i].addr);
+ }
++ kfree(tun_qp->tx_ring);
++ tun_qp->tx_ring = NULL;
+ kfree(tun_qp->ring);
+ tun_qp->ring = NULL;
+ return -ENOMEM;
+diff --git a/drivers/input/serio/hyperv-keyboard.c b/drivers/input/serio/hyperv-keyboard.c
+index a8b9be3e28db..7d0a5ccf5775 100644
+--- a/drivers/input/serio/hyperv-keyboard.c
++++ b/drivers/input/serio/hyperv-keyboard.c
+@@ -245,40 +245,17 @@ static void hv_kbd_handle_received_packet(struct hv_device *hv_dev,
+
+ static void hv_kbd_on_channel_callback(void *context)
+ {
++ struct vmpacket_descriptor *desc;
+ struct hv_device *hv_dev = context;
+- void *buffer;
+- int bufferlen = 0x100; /* Start with sensible size */
+ u32 bytes_recvd;
+ u64 req_id;
+- int error;
+
+- buffer = kmalloc(bufferlen, GFP_ATOMIC);
+- if (!buffer)
+- return;
+-
+- while (1) {
+- error = vmbus_recvpacket_raw(hv_dev->channel, buffer, bufferlen,
+- &bytes_recvd, &req_id);
+- switch (error) {
+- case 0:
+- if (bytes_recvd == 0) {
+- kfree(buffer);
+- return;
+- }
+-
+- hv_kbd_handle_received_packet(hv_dev, buffer,
+- bytes_recvd, req_id);
+- break;
++ foreach_vmbus_pkt(desc, hv_dev->channel) {
++ bytes_recvd = desc->len8 * 8;
++ req_id = desc->trans_id;
+
+- case -ENOBUFS:
+- kfree(buffer);
+- /* Handle large packet */
+- bufferlen = bytes_recvd;
+- buffer = kmalloc(bytes_recvd, GFP_ATOMIC);
+- if (!buffer)
+- return;
+- break;
+- }
++ hv_kbd_handle_received_packet(hv_dev, desc, bytes_recvd,
++ req_id);
+ }
+ }
+
+diff --git a/drivers/net/ethernet/cavium/common/cavium_ptp.c b/drivers/net/ethernet/cavium/common/cavium_ptp.c
+index 6aeb1045c302..1ab40c97403b 100644
+--- a/drivers/net/ethernet/cavium/common/cavium_ptp.c
++++ b/drivers/net/ethernet/cavium/common/cavium_ptp.c
+@@ -10,7 +10,7 @@
+
+ #include "cavium_ptp.h"
+
+-#define DRV_NAME "Cavium PTP Driver"
++#define DRV_NAME "cavium_ptp"
+
+ #define PCI_DEVICE_ID_CAVIUM_PTP 0xA00C
+ #define PCI_DEVICE_ID_CAVIUM_RST 0xA00E
+diff --git a/drivers/net/ethernet/cavium/liquidio/request_manager.c b/drivers/net/ethernet/cavium/liquidio/request_manager.c
+index 8f746e1348d4..3deb3c07681f 100644
+--- a/drivers/net/ethernet/cavium/liquidio/request_manager.c
++++ b/drivers/net/ethernet/cavium/liquidio/request_manager.c
+@@ -238,8 +238,10 @@ int octeon_setup_iq(struct octeon_device *oct,
+ }
+
+ oct->num_iqs++;
+- if (oct->fn_list.enable_io_queues(oct))
++ if (oct->fn_list.enable_io_queues(oct)) {
++ octeon_delete_instr_queue(oct, iq_no);
+ return 1;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+index 0f72f9c4ec74..b429b726b987 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+@@ -3276,8 +3276,10 @@ static ssize_t blocked_fl_write(struct file *filp, const char __user *ubuf,
+ return -ENOMEM;
+
+ err = bitmap_parse_user(ubuf, count, t, adap->sge.egr_sz);
+- if (err)
++ if (err) {
++ kvfree(t);
+ return err;
++ }
+
+ bitmap_copy(adap->sge.blocked_fl, t, adap->sge.egr_sz);
+ kvfree(t);
+diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
+index f70cb4d3c684..40ad1e503255 100644
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -1618,7 +1618,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
+ struct net_device *netdev;
+ struct ibmveth_adapter *adapter;
+ unsigned char *mac_addr_p;
+- unsigned int *mcastFilterSize_p;
++ __be32 *mcastFilterSize_p;
+ long ret;
+ unsigned long ret_attr;
+
+@@ -1640,8 +1640,9 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
+ return -EINVAL;
+ }
+
+- mcastFilterSize_p = (unsigned int *)vio_get_attribute(dev,
+- VETH_MCAST_FILTER_SIZE, NULL);
++ mcastFilterSize_p = (__be32 *)vio_get_attribute(dev,
++ VETH_MCAST_FILTER_SIZE,
++ NULL);
+ if (!mcastFilterSize_p) {
+ dev_err(&dev->dev, "Can't find VETH_MCAST_FILTER_SIZE "
+ "attribute\n");
+@@ -1658,7 +1659,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
+
+ adapter->vdev = dev;
+ adapter->netdev = netdev;
+- adapter->mcastFilterSize = *mcastFilterSize_p;
++ adapter->mcastFilterSize = be32_to_cpu(*mcastFilterSize_p);
+ adapter->pool_config = 0;
+
+ netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16);
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 0ae43d27cdcf..255de7d68cd3 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1586,6 +1586,8 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ lpar_rc = send_subcrq_indirect(adapter, handle_array[queue_num],
+ (u64)tx_buff->indir_dma,
+ (u64)num_entries);
++ dma_unmap_single(dev, tx_buff->indir_dma,
++ sizeof(tx_buff->indir_arr), DMA_TO_DEVICE);
+ } else {
+ tx_buff->num_entries = num_entries;
+ lpar_rc = send_subcrq(adapter, handle_array[queue_num],
+@@ -2747,7 +2749,6 @@ static int ibmvnic_complete_tx(struct ibmvnic_adapter *adapter,
+ union sub_crq *next;
+ int index;
+ int i, j;
+- u8 *first;
+
+ restart_loop:
+ while (pending_scrq(adapter, scrq)) {
+@@ -2777,14 +2778,6 @@ restart_loop:
+
+ txbuff->data_dma[j] = 0;
+ }
+- /* if sub_crq was sent indirectly */
+- first = &txbuff->indir_arr[0].generic.first;
+- if (*first == IBMVNIC_CRQ_CMD) {
+- dma_unmap_single(dev, txbuff->indir_dma,
+- sizeof(txbuff->indir_arr),
+- DMA_TO_DEVICE);
+- *first = 0;
+- }
+
+ if (txbuff->last_frag) {
+ dev_kfree_skb_any(txbuff->skb);
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+index b2d2ec8c11e2..6789eed78ff7 100644
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -3922,7 +3922,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ * setup (if available). */
+ status = myri10ge_request_irq(mgp);
+ if (status != 0)
+- goto abort_with_firmware;
++ goto abort_with_slices;
+ myri10ge_free_irq(mgp);
+
+ /* Save configuration space to be restored if the
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 5f092bbd0514..5462d2e8a1b7 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /* Renesas Ethernet AVB device driver
+ *
+- * Copyright (C) 2014-2015 Renesas Electronics Corporation
++ * Copyright (C) 2014-2019 Renesas Electronics Corporation
+ * Copyright (C) 2015 Renesas Solutions Corp.
+ * Copyright (C) 2015-2016 Cogent Embedded, Inc. <source@cogentembedded.com>
+ *
+@@ -514,7 +514,10 @@ static void ravb_get_tx_tstamp(struct net_device *ndev)
+ kfree(ts_skb);
+ if (tag == tfa_tag) {
+ skb_tstamp_tx(skb, &shhwtstamps);
++ dev_consume_skb_any(skb);
+ break;
++ } else {
++ dev_kfree_skb_any(skb);
+ }
+ }
+ ravb_modify(ndev, TCCR, TCCR_TFR, TCCR_TFR);
+@@ -1556,7 +1559,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ DMA_TO_DEVICE);
+ goto unmap;
+ }
+- ts_skb->skb = skb;
++ ts_skb->skb = skb_get(skb);
+ ts_skb->tag = priv->ts_skb_tag++;
+ priv->ts_skb_tag &= 0x3ff;
+ list_add_tail(&ts_skb->list, &priv->ts_skb_list);
+@@ -1685,6 +1688,7 @@ static int ravb_close(struct net_device *ndev)
+ /* Clear the timestamp list */
+ list_for_each_entry_safe(ts_skb, ts_skb2, &priv->ts_skb_list, list) {
+ list_del(&ts_skb->list);
++ kfree_skb(ts_skb->skb);
+ kfree(ts_skb);
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+index 3b174eae77c1..f45df6df6932 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+@@ -1203,10 +1203,8 @@ static int phy_power_on(struct rk_priv_data *bsp_priv, bool enable)
+ int ret;
+ struct device *dev = &bsp_priv->pdev->dev;
+
+- if (!ldo) {
+- dev_err(dev, "no regulator found\n");
+- return -1;
+- }
++ if (!ldo)
++ return 0;
+
+ if (enable) {
+ ret = regulator_enable(ldo);
+diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c
+index cce9c9ed46aa..9146068979d2 100644
+--- a/drivers/net/ethernet/toshiba/tc35815.c
++++ b/drivers/net/ethernet/toshiba/tc35815.c
+@@ -1497,7 +1497,7 @@ tc35815_rx(struct net_device *dev, int limit)
+ pci_unmap_single(lp->pci_dev,
+ lp->rx_skbs[cur_bd].skb_dma,
+ RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
+- if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN)
++ if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN != 0)
+ memmove(skb->data, skb->data - NET_IP_ALIGN,
+ pkt_len);
+ data = skb_put(skb, pkt_len);
+diff --git a/drivers/net/ethernet/tundra/tsi108_eth.c b/drivers/net/ethernet/tundra/tsi108_eth.c
+index edcd1e60b30d..f076050c8ad3 100644
+--- a/drivers/net/ethernet/tundra/tsi108_eth.c
++++ b/drivers/net/ethernet/tundra/tsi108_eth.c
+@@ -383,9 +383,10 @@ tsi108_stat_carry_one(int carry, int carry_bit, int carry_shift,
+ static void tsi108_stat_carry(struct net_device *dev)
+ {
+ struct tsi108_prv_data *data = netdev_priv(dev);
++ unsigned long flags;
+ u32 carry1, carry2;
+
+- spin_lock_irq(&data->misclock);
++ spin_lock_irqsave(&data->misclock, flags);
+
+ carry1 = TSI_READ(TSI108_STAT_CARRY1);
+ carry2 = TSI_READ(TSI108_STAT_CARRY2);
+@@ -453,7 +454,7 @@ static void tsi108_stat_carry(struct net_device *dev)
+ TSI108_STAT_TXPAUSEDROP_CARRY,
+ &data->tx_pause_drop);
+
+- spin_unlock_irq(&data->misclock);
++ spin_unlock_irqrestore(&data->misclock, flags);
+ }
+
+ /* Read a stat counter atomically with respect to carries.
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index cc60ef9634db..6f6c0dbd91fc 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -1248,12 +1248,15 @@ static void netvsc_get_stats64(struct net_device *net,
+ struct rtnl_link_stats64 *t)
+ {
+ struct net_device_context *ndev_ctx = netdev_priv(net);
+- struct netvsc_device *nvdev = rcu_dereference_rtnl(ndev_ctx->nvdev);
++ struct netvsc_device *nvdev;
+ struct netvsc_vf_pcpu_stats vf_tot;
+ int i;
+
++ rcu_read_lock();
++
++ nvdev = rcu_dereference(ndev_ctx->nvdev);
+ if (!nvdev)
+- return;
++ goto out;
+
+ netdev_stats_to_stats64(t, &net->stats);
+
+@@ -1292,6 +1295,8 @@ static void netvsc_get_stats64(struct net_device *net,
+ t->rx_packets += packets;
+ t->multicast += multicast;
+ }
++out:
++ rcu_read_unlock();
+ }
+
+ static int netvsc_set_mac_addr(struct net_device *ndev, void *p)
+diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
+index 947bea81d924..dfbdea22fbad 100644
+--- a/drivers/net/usb/cx82310_eth.c
++++ b/drivers/net/usb/cx82310_eth.c
+@@ -175,7 +175,8 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
+ }
+ if (!timeout) {
+ dev_err(&udev->dev, "firmware not ready in time\n");
+- return -ETIMEDOUT;
++ ret = -ETIMEDOUT;
++ goto err;
+ }
+
+ /* enable ethernet mode (?) */
+diff --git a/drivers/net/usb/kalmia.c b/drivers/net/usb/kalmia.c
+index bd2ba3659028..0cc6993c279a 100644
+--- a/drivers/net/usb/kalmia.c
++++ b/drivers/net/usb/kalmia.c
+@@ -117,16 +117,16 @@ kalmia_init_and_get_ethernet_addr(struct usbnet *dev, u8 *ethernet_addr)
+ status = kalmia_send_init_packet(dev, usb_buf, ARRAY_SIZE(init_msg_1),
+ usb_buf, 24);
+ if (status != 0)
+- return status;
++ goto out;
+
+ memcpy(usb_buf, init_msg_2, 12);
+ status = kalmia_send_init_packet(dev, usb_buf, ARRAY_SIZE(init_msg_2),
+ usb_buf, 28);
+ if (status != 0)
+- return status;
++ goto out;
+
+ memcpy(ethernet_addr, usb_buf + 10, ETH_ALEN);
+-
++out:
+ kfree(usb_buf);
+ return status;
+ }
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 8d140495da79..e20266bd209e 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -3799,7 +3799,7 @@ static int lan78xx_probe(struct usb_interface *intf,
+ ret = register_netdev(netdev);
+ if (ret != 0) {
+ netif_err(dev, probe, netdev, "couldn't register the device\n");
+- goto out3;
++ goto out4;
+ }
+
+ usb_set_intfdata(intf, dev);
+@@ -3814,12 +3814,14 @@ static int lan78xx_probe(struct usb_interface *intf,
+
+ ret = lan78xx_phy_init(dev);
+ if (ret < 0)
+- goto out4;
++ goto out5;
+
+ return 0;
+
+-out4:
++out5:
+ unregister_netdev(netdev);
++out4:
++ usb_free_urb(dev->urb_intr);
+ out3:
+ lan78xx_unbind(dev, intf);
+ out2:
+diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c
+index e9fc168bb734..489cba9b284d 100644
+--- a/drivers/net/wimax/i2400m/fw.c
++++ b/drivers/net/wimax/i2400m/fw.c
+@@ -351,13 +351,15 @@ int i2400m_barker_db_init(const char *_options)
+ }
+ result = i2400m_barker_db_add(barker);
+ if (result < 0)
+- goto error_add;
++ goto error_parse_add;
+ }
+ kfree(options_orig);
+ }
+ return 0;
+
++error_parse_add:
+ error_parse:
++ kfree(options_orig);
+ error_add:
+ kfree(i2400m_barker_db);
+ return result;
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 05d6371c7f38..f57feb8fdea4 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -323,6 +323,7 @@ static void nvme_mpath_set_live(struct nvme_ns *ns)
+ "failed to create id group.\n");
+ }
+
++ synchronize_srcu(&ns->head->srcu);
+ kblockd_schedule_work(&ns->head->requeue_work);
+ }
+
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index f8f4d3ea67f3..15d493f30810 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -2191,6 +2191,8 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
+ dma_free_coherent(&ha->pdev->dev, vha->gnl.size, vha->gnl.l,
+ vha->gnl.ldma);
+
++ vha->gnl.l = NULL;
++
+ vfree(vha->scan.l);
+
+ if (vha->qpair && vha->qpair->vp_idx == vha->vp_idx) {
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 42b8f0d3e580..02fa81f122c2 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3395,6 +3395,12 @@ skip_dpc:
+ return 0;
+
+ probe_failed:
++ if (base_vha->gnl.l) {
++ dma_free_coherent(&ha->pdev->dev, base_vha->gnl.size,
++ base_vha->gnl.l, base_vha->gnl.ldma);
++ base_vha->gnl.l = NULL;
++ }
++
+ if (base_vha->timer_active)
+ qla2x00_stop_timer(base_vha);
+ base_vha->flags.online = 0;
+@@ -3624,7 +3630,7 @@ qla2x00_remove_one(struct pci_dev *pdev)
+ if (!atomic_read(&pdev->enable_cnt)) {
+ dma_free_coherent(&ha->pdev->dev, base_vha->gnl.size,
+ base_vha->gnl.l, base_vha->gnl.ldma);
+-
++ base_vha->gnl.l = NULL;
+ scsi_host_put(base_vha->host);
+ kfree(ha);
+ pci_set_drvdata(pdev, NULL);
+@@ -3663,6 +3669,8 @@ qla2x00_remove_one(struct pci_dev *pdev)
+ dma_free_coherent(&ha->pdev->dev,
+ base_vha->gnl.size, base_vha->gnl.l, base_vha->gnl.ldma);
+
++ base_vha->gnl.l = NULL;
++
+ vfree(base_vha->scan.l);
+
+ if (IS_QLAFX00(ha))
+@@ -4602,6 +4610,7 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht,
+ "Alloc failed for scan database.\n");
+ dma_free_coherent(&ha->pdev->dev, vha->gnl.size,
+ vha->gnl.l, vha->gnl.ldma);
++ vha->gnl.l = NULL;
+ scsi_remove_host(vha->host);
+ return NULL;
+ }
+diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
+index 3094d818cf06..12c1fa5b06c5 100644
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -178,24 +178,14 @@ static void bcm2835aux_spi_reset_hw(struct bcm2835aux_spi *bs)
+ BCM2835_AUX_SPI_CNTL0_CLEARFIFO);
+ }
+
+-static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)
++static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs)
+ {
+- struct spi_master *master = dev_id;
+- struct bcm2835aux_spi *bs = spi_master_get_devdata(master);
+- irqreturn_t ret = IRQ_NONE;
+-
+- /* IRQ may be shared, so return if our interrupts are disabled */
+- if (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_CNTL1) &
+- (BCM2835_AUX_SPI_CNTL1_TXEMPTY | BCM2835_AUX_SPI_CNTL1_IDLE)))
+- return ret;
++ u32 stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT);
+
+ /* check if we have data to read */
+- while (bs->rx_len &&
+- (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) &
+- BCM2835_AUX_SPI_STAT_RX_EMPTY))) {
++ for (; bs->rx_len && (stat & BCM2835_AUX_SPI_STAT_RX_LVL);
++ stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT))
+ bcm2835aux_rd_fifo(bs);
+- ret = IRQ_HANDLED;
+- }
+
+ /* check if we have data to write */
+ while (bs->tx_len &&
+@@ -203,16 +193,21 @@ static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)
+ (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) &
+ BCM2835_AUX_SPI_STAT_TX_FULL))) {
+ bcm2835aux_wr_fifo(bs);
+- ret = IRQ_HANDLED;
+ }
++}
+
+- /* and check if we have reached "done" */
+- while (bs->rx_len &&
+- (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) &
+- BCM2835_AUX_SPI_STAT_BUSY))) {
+- bcm2835aux_rd_fifo(bs);
+- ret = IRQ_HANDLED;
+- }
++static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)
++{
++ struct spi_master *master = dev_id;
++ struct bcm2835aux_spi *bs = spi_master_get_devdata(master);
++
++ /* IRQ may be shared, so return if our interrupts are disabled */
++ if (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_CNTL1) &
++ (BCM2835_AUX_SPI_CNTL1_TXEMPTY | BCM2835_AUX_SPI_CNTL1_IDLE)))
++ return IRQ_NONE;
++
++ /* do common fifo handling */
++ bcm2835aux_spi_transfer_helper(bs);
+
+ if (!bs->tx_len) {
+ /* disable tx fifo empty interrupt */
+@@ -226,8 +221,7 @@ static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)
+ complete(&master->xfer_completion);
+ }
+
+- /* and return */
+- return ret;
++ return IRQ_HANDLED;
+ }
+
+ static int __bcm2835aux_spi_transfer_one_irq(struct spi_master *master,
+@@ -273,7 +267,6 @@ static int bcm2835aux_spi_transfer_one_poll(struct spi_master *master,
+ {
+ struct bcm2835aux_spi *bs = spi_master_get_devdata(master);
+ unsigned long timeout;
+- u32 stat;
+
+ /* configure spi */
+ bcm2835aux_wr(bs, BCM2835_AUX_SPI_CNTL1, bs->cntl[1]);
+@@ -284,24 +277,9 @@ static int bcm2835aux_spi_transfer_one_poll(struct spi_master *master,
+
+ /* loop until finished the transfer */
+ while (bs->rx_len) {
+- /* read status */
+- stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT);
+-
+- /* fill in tx fifo with remaining data */
+- if ((bs->tx_len) && (!(stat & BCM2835_AUX_SPI_STAT_TX_FULL))) {
+- bcm2835aux_wr_fifo(bs);
+- continue;
+- }
+
+- /* read data from fifo for both cases */
+- if (!(stat & BCM2835_AUX_SPI_STAT_RX_EMPTY)) {
+- bcm2835aux_rd_fifo(bs);
+- continue;
+- }
+- if (!(stat & BCM2835_AUX_SPI_STAT_BUSY)) {
+- bcm2835aux_rd_fifo(bs);
+- continue;
+- }
++ /* do common fifo handling */
++ bcm2835aux_spi_transfer_helper(bs);
+
+ /* there is still data pending to read check the timeout */
+ if (bs->rx_len && time_after(jiffies, timeout)) {
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index c46efa47d68a..7159e8363b83 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -1143,14 +1143,16 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
+ struct se_cmd *se_cmd = cmd->se_cmd;
+ struct tcmu_dev *udev = cmd->tcmu_dev;
+ bool read_len_valid = false;
+- uint32_t read_len = se_cmd->data_length;
++ uint32_t read_len;
+
+ /*
+ * cmd has been completed already from timeout, just reclaim
+ * data area space and free cmd
+ */
+- if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
++ if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
++ WARN_ON_ONCE(se_cmd);
+ goto out;
++ }
+
+ list_del_init(&cmd->queue_entry);
+
+@@ -1163,6 +1165,7 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
+ goto done;
+ }
+
++ read_len = se_cmd->data_length;
+ if (se_cmd->data_direction == DMA_FROM_DEVICE &&
+ (entry->hdr.uflags & TCMU_UFLAG_READ_LEN) && entry->rsp.read_len) {
+ read_len_valid = true;
+@@ -1318,6 +1321,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
+ */
+ scsi_status = SAM_STAT_CHECK_CONDITION;
+ list_del_init(&cmd->queue_entry);
++ cmd->se_cmd = NULL;
+ } else {
+ list_del_init(&cmd->queue_entry);
+ idr_remove(&udev->commands, id);
+@@ -2036,6 +2040,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
+
+ idr_remove(&udev->commands, i);
+ if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
++ WARN_ON(!cmd->se_cmd);
+ list_del_init(&cmd->queue_entry);
+ if (err_level == 1) {
+ /*
+diff --git a/fs/afs/cell.c b/fs/afs/cell.c
+index 6127f0fcd62c..ee07162d35c7 100644
+--- a/fs/afs/cell.c
++++ b/fs/afs/cell.c
+@@ -76,6 +76,7 @@ struct afs_cell *afs_lookup_cell_rcu(struct afs_net *net,
+ cell = rcu_dereference_raw(net->ws_cell);
+ if (cell) {
+ afs_get_cell(cell);
++ ret = 0;
+ break;
+ }
+ ret = -EDESTADDRREQ;
+@@ -110,6 +111,9 @@ struct afs_cell *afs_lookup_cell_rcu(struct afs_net *net,
+
+ done_seqretry(&net->cells_lock, seq);
+
++ if (ret != 0 && cell)
++ afs_put_cell(net, cell);
++
+ return ret == 0 ? cell : ERR_PTR(ret);
+ }
+
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index a11fa0b6b34d..db547af01b59 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1280,6 +1280,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap,
+ {
+ struct ceph_inode_info *ci = cap->ci;
+ struct inode *inode = &ci->vfs_inode;
++ struct ceph_buffer *old_blob = NULL;
+ struct cap_msg_args arg;
+ int held, revoking;
+ int wake = 0;
+@@ -1344,7 +1345,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap,
+ ci->i_requested_max_size = arg.max_size;
+
+ if (flushing & CEPH_CAP_XATTR_EXCL) {
+- __ceph_build_xattrs_blob(ci);
++ old_blob = __ceph_build_xattrs_blob(ci);
+ arg.xattr_version = ci->i_xattrs.version;
+ arg.xattr_buf = ci->i_xattrs.blob;
+ } else {
+@@ -1379,6 +1380,8 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap,
+
+ spin_unlock(&ci->i_ceph_lock);
+
++ ceph_buffer_put(old_blob);
++
+ ret = send_cap_msg(&arg);
+ if (ret < 0) {
+ dout("error sending cap msg, must requeue %p\n", inode);
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 3e518c2ae2bf..11f19432a74c 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -742,6 +742,7 @@ static int fill_inode(struct inode *inode, struct page *locked_page,
+ int issued, new_issued, info_caps;
+ struct timespec64 mtime, atime, ctime;
+ struct ceph_buffer *xattr_blob = NULL;
++ struct ceph_buffer *old_blob = NULL;
+ struct ceph_string *pool_ns = NULL;
+ struct ceph_cap *new_cap = NULL;
+ int err = 0;
+@@ -878,7 +879,7 @@ static int fill_inode(struct inode *inode, struct page *locked_page,
+ if ((ci->i_xattrs.version == 0 || !(issued & CEPH_CAP_XATTR_EXCL)) &&
+ le64_to_cpu(info->xattr_version) > ci->i_xattrs.version) {
+ if (ci->i_xattrs.blob)
+- ceph_buffer_put(ci->i_xattrs.blob);
++ old_blob = ci->i_xattrs.blob;
+ ci->i_xattrs.blob = xattr_blob;
+ if (xattr_blob)
+ memcpy(ci->i_xattrs.blob->vec.iov_base,
+@@ -1017,8 +1018,8 @@ static int fill_inode(struct inode *inode, struct page *locked_page,
+ out:
+ if (new_cap)
+ ceph_put_cap(mdsc, new_cap);
+- if (xattr_blob)
+- ceph_buffer_put(xattr_blob);
++ ceph_buffer_put(old_blob);
++ ceph_buffer_put(xattr_blob);
+ ceph_put_string(pool_ns);
+ return err;
+ }
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index 1f46b02f7314..5cf7b5f4db94 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -460,6 +460,7 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci)
+ struct inode *inode = &ci->vfs_inode;
+ struct ceph_cap_snap *capsnap;
+ struct ceph_snap_context *old_snapc, *new_snapc;
++ struct ceph_buffer *old_blob = NULL;
+ int used, dirty;
+
+ capsnap = kzalloc(sizeof(*capsnap), GFP_NOFS);
+@@ -536,7 +537,7 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci)
+ capsnap->gid = inode->i_gid;
+
+ if (dirty & CEPH_CAP_XATTR_EXCL) {
+- __ceph_build_xattrs_blob(ci);
++ old_blob = __ceph_build_xattrs_blob(ci);
+ capsnap->xattr_blob =
+ ceph_buffer_get(ci->i_xattrs.blob);
+ capsnap->xattr_version = ci->i_xattrs.version;
+@@ -579,6 +580,7 @@ update_snapc:
+ }
+ spin_unlock(&ci->i_ceph_lock);
+
++ ceph_buffer_put(old_blob);
+ kfree(capsnap);
+ ceph_put_snap_context(old_snapc);
+ }
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index d8579a56e5dc..018019309790 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -896,7 +896,7 @@ extern int ceph_getattr(const struct path *path, struct kstat *stat,
+ int __ceph_setxattr(struct inode *, const char *, const void *, size_t, int);
+ ssize_t __ceph_getxattr(struct inode *, const char *, void *, size_t);
+ extern ssize_t ceph_listxattr(struct dentry *, char *, size_t);
+-extern void __ceph_build_xattrs_blob(struct ceph_inode_info *ci);
++extern struct ceph_buffer *__ceph_build_xattrs_blob(struct ceph_inode_info *ci);
+ extern void __ceph_destroy_xattrs(struct ceph_inode_info *ci);
+ extern void __init ceph_xattr_init(void);
+ extern void ceph_xattr_exit(void);
+diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
+index 0a2d4898ee16..5e4f3f833e85 100644
+--- a/fs/ceph/xattr.c
++++ b/fs/ceph/xattr.c
+@@ -734,12 +734,15 @@ static int __get_required_blob_size(struct ceph_inode_info *ci, int name_size,
+
+ /*
+ * If there are dirty xattrs, reencode xattrs into the prealloc_blob
+- * and swap into place.
++ * and swap into place. It returns the old i_xattrs.blob (or NULL) so
++ * that it can be freed by the caller as the i_ceph_lock is likely to be
++ * held.
+ */
+-void __ceph_build_xattrs_blob(struct ceph_inode_info *ci)
++struct ceph_buffer *__ceph_build_xattrs_blob(struct ceph_inode_info *ci)
+ {
+ struct rb_node *p;
+ struct ceph_inode_xattr *xattr = NULL;
++ struct ceph_buffer *old_blob = NULL;
+ void *dest;
+
+ dout("__build_xattrs_blob %p\n", &ci->vfs_inode);
+@@ -770,12 +773,14 @@ void __ceph_build_xattrs_blob(struct ceph_inode_info *ci)
+ dest - ci->i_xattrs.prealloc_blob->vec.iov_base;
+
+ if (ci->i_xattrs.blob)
+- ceph_buffer_put(ci->i_xattrs.blob);
++ old_blob = ci->i_xattrs.blob;
+ ci->i_xattrs.blob = ci->i_xattrs.prealloc_blob;
+ ci->i_xattrs.prealloc_blob = NULL;
+ ci->i_xattrs.dirty = false;
+ ci->i_xattrs.version++;
+ }
++
++ return old_blob;
+ }
+
+ static inline int __get_request_mask(struct inode *in) {
+@@ -1011,6 +1016,7 @@ int __ceph_setxattr(struct inode *inode, const char *name,
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ struct ceph_mds_client *mdsc = ceph_sb_to_client(inode->i_sb)->mdsc;
+ struct ceph_cap_flush *prealloc_cf = NULL;
++ struct ceph_buffer *old_blob = NULL;
+ int issued;
+ int err;
+ int dirty = 0;
+@@ -1084,13 +1090,15 @@ retry:
+ struct ceph_buffer *blob;
+
+ spin_unlock(&ci->i_ceph_lock);
+- dout(" preaallocating new blob size=%d\n", required_blob_size);
++ ceph_buffer_put(old_blob); /* Shouldn't be required */
++ dout(" pre-allocating new blob size=%d\n", required_blob_size);
+ blob = ceph_buffer_new(required_blob_size, GFP_NOFS);
+ if (!blob)
+ goto do_sync_unlocked;
+ spin_lock(&ci->i_ceph_lock);
++ /* prealloc_blob can't be released while holding i_ceph_lock */
+ if (ci->i_xattrs.prealloc_blob)
+- ceph_buffer_put(ci->i_xattrs.prealloc_blob);
++ old_blob = ci->i_xattrs.prealloc_blob;
+ ci->i_xattrs.prealloc_blob = blob;
+ goto retry;
+ }
+@@ -1106,6 +1114,7 @@ retry:
+ }
+
+ spin_unlock(&ci->i_ceph_lock);
++ ceph_buffer_put(old_blob);
+ if (lock_snap_rwsem)
+ up_read(&mdsc->snap_rwsem);
+ if (dirty)
+diff --git a/fs/read_write.c b/fs/read_write.c
+index 85fd7a8ee29e..5fb5ee5b8cd7 100644
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -1888,10 +1888,7 @@ int vfs_clone_file_range(struct file *file_in, loff_t pos_in,
+ }
+ EXPORT_SYMBOL(vfs_clone_file_range);
+
+-/*
+- * Read a page's worth of file data into the page cache. Return the page
+- * locked.
+- */
++/* Read a page's worth of file data into the page cache. */
+ static struct page *vfs_dedupe_get_page(struct inode *inode, loff_t offset)
+ {
+ struct address_space *mapping;
+@@ -1907,10 +1904,32 @@ static struct page *vfs_dedupe_get_page(struct inode *inode, loff_t offset)
+ put_page(page);
+ return ERR_PTR(-EIO);
+ }
+- lock_page(page);
+ return page;
+ }
+
++/*
++ * Lock two pages, ensuring that we lock in offset order if the pages are from
++ * the same file.
++ */
++static void vfs_lock_two_pages(struct page *page1, struct page *page2)
++{
++ /* Always lock in order of increasing index. */
++ if (page1->index > page2->index)
++ swap(page1, page2);
++
++ lock_page(page1);
++ if (page1 != page2)
++ lock_page(page2);
++}
++
++/* Unlock two pages, being careful not to unlock the same page twice. */
++static void vfs_unlock_two_pages(struct page *page1, struct page *page2)
++{
++ unlock_page(page1);
++ if (page1 != page2)
++ unlock_page(page2);
++}
++
+ /*
+ * Compare extents of two files to see if they are the same.
+ * Caller must have locked both inodes to prevent write races.
+@@ -1948,10 +1967,24 @@ int vfs_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
+ dest_page = vfs_dedupe_get_page(dest, destoff);
+ if (IS_ERR(dest_page)) {
+ error = PTR_ERR(dest_page);
+- unlock_page(src_page);
+ put_page(src_page);
+ goto out_error;
+ }
++
++ vfs_lock_two_pages(src_page, dest_page);
++
++ /*
++ * Now that we've locked both pages, make sure they're still
++ * mapped to the file data we're interested in. If not,
++ * someone is invalidating pages on us and we lose.
++ */
++ if (!PageUptodate(src_page) || !PageUptodate(dest_page) ||
++ src_page->mapping != src->i_mapping ||
++ dest_page->mapping != dest->i_mapping) {
++ same = false;
++ goto unlock;
++ }
++
+ src_addr = kmap_atomic(src_page);
+ dest_addr = kmap_atomic(dest_page);
+
+@@ -1963,8 +1996,8 @@ int vfs_dedupe_file_range_compare(struct inode *src, loff_t srcoff,
+
+ kunmap_atomic(dest_addr);
+ kunmap_atomic(src_addr);
+- unlock_page(dest_page);
+- unlock_page(src_page);
++unlock:
++ vfs_unlock_two_pages(src_page, dest_page);
+ put_page(dest_page);
+ put_page(src_page);
+
+diff --git a/include/linux/ceph/buffer.h b/include/linux/ceph/buffer.h
+index 5e58bb29b1a3..11cdc7c60480 100644
+--- a/include/linux/ceph/buffer.h
++++ b/include/linux/ceph/buffer.h
+@@ -30,7 +30,8 @@ static inline struct ceph_buffer *ceph_buffer_get(struct ceph_buffer *b)
+
+ static inline void ceph_buffer_put(struct ceph_buffer *b)
+ {
+- kref_put(&b->kref, ceph_buffer_release);
++ if (b)
++ kref_put(&b->kref, ceph_buffer_release);
+ }
+
+ extern int ceph_decode_buffer(struct ceph_buffer **b, void **p, void *end);
+diff --git a/include/linux/gpio.h b/include/linux/gpio.h
+index 39745b8bdd65..b3115d1a7d49 100644
+--- a/include/linux/gpio.h
++++ b/include/linux/gpio.h
+@@ -240,30 +240,6 @@ static inline int irq_to_gpio(unsigned irq)
+ return -EINVAL;
+ }
+
+-static inline int
+-gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name,
+- unsigned int gpio_offset, unsigned int pin_offset,
+- unsigned int npins)
+-{
+- WARN_ON(1);
+- return -EINVAL;
+-}
+-
+-static inline int
+-gpiochip_add_pingroup_range(struct gpio_chip *chip,
+- struct pinctrl_dev *pctldev,
+- unsigned int gpio_offset, const char *pin_group)
+-{
+- WARN_ON(1);
+- return -EINVAL;
+-}
+-
+-static inline void
+-gpiochip_remove_pin_ranges(struct gpio_chip *chip)
+-{
+- WARN_ON(1);
+-}
+-
+ static inline int devm_gpio_request(struct device *dev, unsigned gpio,
+ const char *label)
+ {
+diff --git a/include/net/act_api.h b/include/net/act_api.h
+index 970303448c90..0c82d7ea6ee1 100644
+--- a/include/net/act_api.h
++++ b/include/net/act_api.h
+@@ -15,6 +15,7 @@
+ struct tcf_idrinfo {
+ spinlock_t lock;
+ struct idr action_idr;
++ struct net *net;
+ };
+
+ struct tc_action_ops;
+@@ -107,7 +108,7 @@ struct tc_action_net {
+ };
+
+ static inline
+-int tc_action_net_init(struct tc_action_net *tn,
++int tc_action_net_init(struct net *net, struct tc_action_net *tn,
+ const struct tc_action_ops *ops)
+ {
+ int err = 0;
+@@ -116,6 +117,7 @@ int tc_action_net_init(struct tc_action_net *tn,
+ if (!tn->idrinfo)
+ return -ENOMEM;
+ tn->ops = ops;
++ tn->idrinfo->net = net;
+ spin_lock_init(&tn->idrinfo->lock);
+ idr_init(&tn->idrinfo->action_idr);
+ return err;
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index f2be5d041ba3..7685cbda9f28 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -418,8 +418,7 @@ struct nft_set {
+ unsigned char *udata;
+ /* runtime data below here */
+ const struct nft_set_ops *ops ____cacheline_aligned;
+- u16 flags:13,
+- bound:1,
++ u16 flags:14,
+ genmask:2;
+ u8 klen;
+ u8 dlen;
+@@ -1337,12 +1336,15 @@ struct nft_trans_rule {
+ struct nft_trans_set {
+ struct nft_set *set;
+ u32 set_id;
++ bool bound;
+ };
+
+ #define nft_trans_set(trans) \
+ (((struct nft_trans_set *)trans->data)->set)
+ #define nft_trans_set_id(trans) \
+ (((struct nft_trans_set *)trans->data)->set_id)
++#define nft_trans_set_bound(trans) \
++ (((struct nft_trans_set *)trans->data)->bound)
+
+ struct nft_trans_chain {
+ bool update;
+@@ -1373,12 +1375,15 @@ struct nft_trans_table {
+ struct nft_trans_elem {
+ struct nft_set *set;
+ struct nft_set_elem elem;
++ bool bound;
+ };
+
+ #define nft_trans_elem_set(trans) \
+ (((struct nft_trans_elem *)trans->data)->set)
+ #define nft_trans_elem(trans) \
+ (((struct nft_trans_elem *)trans->data)->elem)
++#define nft_trans_elem_set_bound(trans) \
++ (((struct nft_trans_elem *)trans->data)->bound)
+
+ struct nft_trans_obj {
+ struct nft_object *obj;
+diff --git a/include/net/psample.h b/include/net/psample.h
+index 9b80f814ab04..94cb37a7bf75 100644
+--- a/include/net/psample.h
++++ b/include/net/psample.h
+@@ -12,6 +12,7 @@ struct psample_group {
+ u32 group_num;
+ u32 refcount;
+ u32 seq;
++ struct rcu_head rcu;
+ };
+
+ struct psample_group *psample_group_get(struct net *net, u32 group_num);
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 29ff6635d259..714d63f60460 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -483,6 +483,7 @@ static DECLARE_DELAYED_WORK(optimizing_work, kprobe_optimizer);
+ */
+ static void do_optimize_kprobes(void)
+ {
++ lockdep_assert_held(&text_mutex);
+ /*
+ * The optimization/unoptimization refers online_cpus via
+ * stop_machine() and cpu-hotplug modifies online_cpus.
+@@ -500,9 +501,7 @@ static void do_optimize_kprobes(void)
+ list_empty(&optimizing_list))
+ return;
+
+- mutex_lock(&text_mutex);
+ arch_optimize_kprobes(&optimizing_list);
+- mutex_unlock(&text_mutex);
+ }
+
+ /*
+@@ -513,6 +512,7 @@ static void do_unoptimize_kprobes(void)
+ {
+ struct optimized_kprobe *op, *tmp;
+
++ lockdep_assert_held(&text_mutex);
+ /* See comment in do_optimize_kprobes() */
+ lockdep_assert_cpus_held();
+
+@@ -520,7 +520,6 @@ static void do_unoptimize_kprobes(void)
+ if (list_empty(&unoptimizing_list))
+ return;
+
+- mutex_lock(&text_mutex);
+ arch_unoptimize_kprobes(&unoptimizing_list, &freeing_list);
+ /* Loop free_list for disarming */
+ list_for_each_entry_safe(op, tmp, &freeing_list, list) {
+@@ -537,7 +536,6 @@ static void do_unoptimize_kprobes(void)
+ } else
+ list_del_init(&op->list);
+ }
+- mutex_unlock(&text_mutex);
+ }
+
+ /* Reclaim all kprobes on the free_list */
+@@ -563,6 +561,7 @@ static void kprobe_optimizer(struct work_struct *work)
+ {
+ mutex_lock(&kprobe_mutex);
+ cpus_read_lock();
++ mutex_lock(&text_mutex);
+ /* Lock modules while optimizing kprobes */
+ mutex_lock(&module_mutex);
+
+@@ -590,6 +589,7 @@ static void kprobe_optimizer(struct work_struct *work)
+ do_free_cleaned_kprobes();
+
+ mutex_unlock(&module_mutex);
++ mutex_unlock(&text_mutex);
+ cpus_read_unlock();
+ mutex_unlock(&kprobe_mutex);
+
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index 3ae899805f8b..a581cf101cd9 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -122,7 +122,7 @@ static void queue_process(struct work_struct *work)
+ txq = netdev_get_tx_queue(dev, q_index);
+ HARD_TX_LOCK(dev, txq, smp_processor_id());
+ if (netif_xmit_frozen_or_stopped(txq) ||
+- netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) {
++ !dev_xmit_complete(netpoll_start_xmit(skb, dev, txq))) {
+ skb_queue_head(&npinfo->txq, skb);
+ HARD_TX_UNLOCK(dev, txq);
+ local_irq_restore(flags);
+@@ -335,7 +335,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
+
+ HARD_TX_UNLOCK(dev, txq);
+
+- if (status == NETDEV_TX_OK)
++ if (dev_xmit_complete(status))
+ break;
+
+ }
+@@ -352,7 +352,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
+
+ }
+
+- if (status != NETDEV_TX_OK) {
++ if (!dev_xmit_complete(status)) {
+ skb_queue_tail(&npinfo->txq, skb);
+ schedule_delayed_work(&npinfo->tx_work,0);
+ }
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index b7ef367fe6a1..611ba174265c 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -934,6 +934,22 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags)
+ return mss_now;
+ }
+
++/* In some cases, both sendpage() and sendmsg() could have added
++ * an skb to the write queue, but failed adding payload on it.
++ * We need to remove it to consume less memory, but more
++ * importantly be able to generate EPOLLOUT for Edge Trigger epoll()
++ * users.
++ */
++static void tcp_remove_empty_skb(struct sock *sk, struct sk_buff *skb)
++{
++ if (skb && !skb->len) {
++ tcp_unlink_write_queue(skb, sk);
++ if (tcp_write_queue_empty(sk))
++ tcp_chrono_stop(sk, TCP_CHRONO_BUSY);
++ sk_wmem_free_skb(sk, skb);
++ }
++}
++
+ ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,
+ size_t size, int flags)
+ {
+@@ -1056,6 +1072,7 @@ out:
+ return copied;
+
+ do_error:
++ tcp_remove_empty_skb(sk, tcp_write_queue_tail(sk));
+ if (copied)
+ goto out;
+ out_err:
+@@ -1409,17 +1426,11 @@ out_nopush:
+ sock_zerocopy_put(uarg);
+ return copied + copied_syn;
+
++do_error:
++ skb = tcp_write_queue_tail(sk);
+ do_fault:
+- if (!skb->len) {
+- tcp_unlink_write_queue(skb, sk);
+- /* It is the one place in all of TCP, except connection
+- * reset, where we can be unlinking the send_head.
+- */
+- tcp_check_send_head(sk, skb);
+- sk_wmem_free_skb(sk, skb);
+- }
++ tcp_remove_empty_skb(sk, skb);
+
+-do_error:
+ if (copied + copied_syn)
+ goto out;
+ out_err:
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 88c7e821fd11..2697e4397e46 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2046,7 +2046,7 @@ static bool tcp_can_coalesce_send_queue_head(struct sock *sk, int len)
+ if (len <= skb->len)
+ break;
+
+- if (unlikely(TCP_SKB_CB(skb)->eor))
++ if (unlikely(TCP_SKB_CB(skb)->eor) || tcp_has_tx_tstamp(skb))
+ return false;
+
+ len -= skb->len;
+@@ -2162,6 +2162,7 @@ static int tcp_mtu_probe(struct sock *sk)
+ * we need to propagate it to the new skb.
+ */
+ TCP_SKB_CB(nskb)->eor = TCP_SKB_CB(skb)->eor;
++ tcp_skb_collapse_tstamp(nskb, skb);
+ tcp_unlink_write_queue(skb, sk);
+ sk_wmem_free_skb(sk, skb);
+ } else {
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index dbab62e3f0d7..2d80e913b82f 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -791,14 +791,15 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
+ if (pmc) {
+ im->idev = pmc->idev;
+ if (im->mca_sfmode == MCAST_INCLUDE) {
+- im->mca_tomb = pmc->mca_tomb;
+- im->mca_sources = pmc->mca_sources;
++ swap(im->mca_tomb, pmc->mca_tomb);
++ swap(im->mca_sources, pmc->mca_sources);
+ for (psf = im->mca_sources; psf; psf = psf->sf_next)
+ psf->sf_crcount = idev->mc_qrv;
+ } else {
+ im->mca_crcount = idev->mc_qrv;
+ }
+ in6_dev_put(pmc->idev);
++ ip6_mc_clear_src(pmc);
+ kfree(pmc);
+ }
+ spin_unlock_bh(&im->mca_lock);
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 29ff59dd99ac..2145581d7b3d 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -121,9 +121,14 @@ static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
+ return;
+
+ list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
+- if (trans->msg_type == NFT_MSG_NEWSET &&
+- nft_trans_set(trans) == set) {
+- set->bound = true;
++ switch (trans->msg_type) {
++ case NFT_MSG_NEWSET:
++ if (nft_trans_set(trans) == set)
++ nft_trans_set_bound(trans) = true;
++ break;
++ case NFT_MSG_NEWSETELEM:
++ if (nft_trans_elem_set(trans) == set)
++ nft_trans_elem_set_bound(trans) = true;
+ break;
+ }
+ }
+@@ -6656,7 +6661,7 @@ static int __nf_tables_abort(struct net *net)
+ break;
+ case NFT_MSG_NEWSET:
+ trans->ctx.table->use--;
+- if (nft_trans_set(trans)->bound) {
++ if (nft_trans_set_bound(trans)) {
+ nft_trans_destroy(trans);
+ break;
+ }
+@@ -6668,7 +6673,7 @@ static int __nf_tables_abort(struct net *net)
+ nft_trans_destroy(trans);
+ break;
+ case NFT_MSG_NEWSETELEM:
+- if (nft_trans_elem_set(trans)->bound) {
++ if (nft_trans_elem_set_bound(trans)) {
+ nft_trans_destroy(trans);
+ break;
+ }
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 6e0c26025ab1..69decbe2c988 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -71,11 +71,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ {
+ struct nft_flow_offload *priv = nft_expr_priv(expr);
+ struct nf_flowtable *flowtable = &priv->flowtable->data;
++ struct tcphdr _tcph, *tcph = NULL;
+ enum ip_conntrack_info ctinfo;
+ struct nf_flow_route route;
+ struct flow_offload *flow;
+ enum ip_conntrack_dir dir;
+- bool is_tcp = false;
+ struct nf_conn *ct;
+ int ret;
+
+@@ -88,7 +88,10 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+
+ switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
+ case IPPROTO_TCP:
+- is_tcp = true;
++ tcph = skb_header_pointer(pkt->skb, pkt->xt.thoff,
++ sizeof(_tcph), &_tcph);
++ if (unlikely(!tcph || tcph->fin || tcph->rst))
++ goto out;
+ break;
+ case IPPROTO_UDP:
+ break;
+@@ -115,7 +118,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ if (!flow)
+ goto err_flow_alloc;
+
+- if (is_tcp) {
++ if (tcph) {
+ ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
+ ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
+ }
+diff --git a/net/psample/psample.c b/net/psample/psample.c
+index 64f95624f219..4cea353221da 100644
+--- a/net/psample/psample.c
++++ b/net/psample/psample.c
+@@ -156,7 +156,7 @@ static void psample_group_destroy(struct psample_group *group)
+ {
+ psample_group_notify(group, PSAMPLE_CMD_DEL_GROUP);
+ list_del(&group->list);
+- kfree(group);
++ kfree_rcu(group, rcu);
+ }
+
+ static struct psample_group *
+diff --git a/net/rds/recv.c b/net/rds/recv.c
+index 504cd6bcc54c..c0b945516cdb 100644
+--- a/net/rds/recv.c
++++ b/net/rds/recv.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2006, 2018 Oracle and/or its affiliates. All rights reserved.
++ * Copyright (c) 2006, 2019 Oracle and/or its affiliates. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses. You may choose to be licensed under the terms of the GNU
+@@ -803,6 +803,7 @@ void rds6_inc_info_copy(struct rds_incoming *inc,
+
+ minfo6.seq = be64_to_cpu(inc->i_hdr.h_sequence);
+ minfo6.len = be32_to_cpu(inc->i_hdr.h_len);
++ minfo6.tos = 0;
+
+ if (flip) {
+ minfo6.laddr = *daddr;
+@@ -816,6 +817,8 @@ void rds6_inc_info_copy(struct rds_incoming *inc,
+ minfo6.fport = inc->i_hdr.h_dport;
+ }
+
++ minfo6.flags = 0;
++
+ rds_info_copy(iter, &minfo6, sizeof(minfo6));
+ }
+ #endif
+diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
+index 20fae5ca87fa..800846d77a56 100644
+--- a/net/sched/act_bpf.c
++++ b/net/sched/act_bpf.c
+@@ -413,7 +413,7 @@ static __net_init int bpf_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, bpf_net_id);
+
+- return tc_action_net_init(tn, &act_bpf_ops);
++ return tc_action_net_init(net, tn, &act_bpf_ops);
+ }
+
+ static void __net_exit bpf_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
+index 605436747978..538dedd84e21 100644
+--- a/net/sched/act_connmark.c
++++ b/net/sched/act_connmark.c
+@@ -215,7 +215,7 @@ static __net_init int connmark_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, connmark_net_id);
+
+- return tc_action_net_init(tn, &act_connmark_ops);
++ return tc_action_net_init(net, tn, &act_connmark_ops);
+ }
+
+ static void __net_exit connmark_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
+index 40437197e053..1e269441065a 100644
+--- a/net/sched/act_csum.c
++++ b/net/sched/act_csum.c
+@@ -678,7 +678,7 @@ static __net_init int csum_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, csum_net_id);
+
+- return tc_action_net_init(tn, &act_csum_ops);
++ return tc_action_net_init(net, tn, &act_csum_ops);
+ }
+
+ static void __net_exit csum_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
+index 72d3347bdd41..dfef9621375e 100644
+--- a/net/sched/act_gact.c
++++ b/net/sched/act_gact.c
+@@ -263,7 +263,7 @@ static __net_init int gact_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, gact_net_id);
+
+- return tc_action_net_init(tn, &act_gact_ops);
++ return tc_action_net_init(net, tn, &act_gact_ops);
+ }
+
+ static void __net_exit gact_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
+index 24047e0e5db0..bac353bea02f 100644
+--- a/net/sched/act_ife.c
++++ b/net/sched/act_ife.c
+@@ -887,7 +887,7 @@ static __net_init int ife_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, ife_net_id);
+
+- return tc_action_net_init(tn, &act_ife_ops);
++ return tc_action_net_init(net, tn, &act_ife_ops);
+ }
+
+ static void __net_exit ife_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index 334f3a057671..01d3669ef498 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -65,12 +65,13 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
+ return 0;
+ }
+
+-static void ipt_destroy_target(struct xt_entry_target *t)
++static void ipt_destroy_target(struct xt_entry_target *t, struct net *net)
+ {
+ struct xt_tgdtor_param par = {
+ .target = t->u.kernel.target,
+ .targinfo = t->data,
+ .family = NFPROTO_IPV4,
++ .net = net,
+ };
+ if (par.target->destroy != NULL)
+ par.target->destroy(&par);
+@@ -82,7 +83,7 @@ static void tcf_ipt_release(struct tc_action *a)
+ struct tcf_ipt *ipt = to_ipt(a);
+
+ if (ipt->tcfi_t) {
+- ipt_destroy_target(ipt->tcfi_t);
++ ipt_destroy_target(ipt->tcfi_t, a->idrinfo->net);
+ kfree(ipt->tcfi_t);
+ }
+ kfree(ipt->tcfi_tname);
+@@ -182,7 +183,7 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla,
+
+ spin_lock_bh(&ipt->tcf_lock);
+ if (ret != ACT_P_CREATED) {
+- ipt_destroy_target(ipt->tcfi_t);
++ ipt_destroy_target(ipt->tcfi_t, net);
+ kfree(ipt->tcfi_tname);
+ kfree(ipt->tcfi_t);
+ }
+@@ -353,7 +354,7 @@ static __net_init int ipt_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, ipt_net_id);
+
+- return tc_action_net_init(tn, &act_ipt_ops);
++ return tc_action_net_init(net, tn, &act_ipt_ops);
+ }
+
+ static void __net_exit ipt_exit_net(struct list_head *net_list)
+@@ -403,7 +404,7 @@ static __net_init int xt_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, xt_net_id);
+
+- return tc_action_net_init(tn, &act_xt_ops);
++ return tc_action_net_init(net, tn, &act_xt_ops);
+ }
+
+ static void __net_exit xt_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index 548614bd9366..399e3beae6cf 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -419,7 +419,7 @@ static __net_init int mirred_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, mirred_net_id);
+
+- return tc_action_net_init(tn, &act_mirred_ops);
++ return tc_action_net_init(net, tn, &act_mirred_ops);
+ }
+
+ static void __net_exit mirred_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
+index 619828920b97..d1b47a1b145c 100644
+--- a/net/sched/act_nat.c
++++ b/net/sched/act_nat.c
+@@ -317,7 +317,7 @@ static __net_init int nat_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, nat_net_id);
+
+- return tc_action_net_init(tn, &act_nat_ops);
++ return tc_action_net_init(net, tn, &act_nat_ops);
+ }
+
+ static void __net_exit nat_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index 82d258b2a75a..33c0cc5ef229 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -488,7 +488,7 @@ static __net_init int pedit_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, pedit_net_id);
+
+- return tc_action_net_init(tn, &act_pedit_ops);
++ return tc_action_net_init(net, tn, &act_pedit_ops);
+ }
+
+ static void __net_exit pedit_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_police.c b/net/sched/act_police.c
+index 997c34db1491..4db25959e156 100644
+--- a/net/sched/act_police.c
++++ b/net/sched/act_police.c
+@@ -342,7 +342,7 @@ static __net_init int police_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, police_net_id);
+
+- return tc_action_net_init(tn, &act_police_ops);
++ return tc_action_net_init(net, tn, &act_police_ops);
+ }
+
+ static void __net_exit police_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
+index ac37654ca292..98635311a5a0 100644
+--- a/net/sched/act_sample.c
++++ b/net/sched/act_sample.c
+@@ -99,7 +99,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
+ s->tcf_action = parm->action;
+ s->rate = rate;
+ s->psample_group_num = psample_group_num;
+- RCU_INIT_POINTER(s->psample_group, psample_group);
++ rcu_swap_protected(s->psample_group, psample_group,
++ lockdep_is_held(&s->tcf_lock));
+
+ if (tb[TCA_SAMPLE_TRUNC_SIZE]) {
+ s->truncate = true;
+@@ -107,6 +108,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
+ }
+ spin_unlock_bh(&s->tcf_lock);
+
++ if (psample_group)
++ psample_group_put(psample_group);
+ if (ret == ACT_P_CREATED)
+ tcf_idr_insert(tn, *a);
+ return ret;
+@@ -255,7 +258,7 @@ static __net_init int sample_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, sample_net_id);
+
+- return tc_action_net_init(tn, &act_sample_ops);
++ return tc_action_net_init(net, tn, &act_sample_ops);
+ }
+
+ static void __net_exit sample_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
+index 658efae71a09..b418ef62e0a4 100644
+--- a/net/sched/act_simple.c
++++ b/net/sched/act_simple.c
+@@ -215,7 +215,7 @@ static __net_init int simp_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, simp_net_id);
+
+- return tc_action_net_init(tn, &act_simp_ops);
++ return tc_action_net_init(net, tn, &act_simp_ops);
+ }
+
+ static void __net_exit simp_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
+index 7709710a41f7..a80179c1075f 100644
+--- a/net/sched/act_skbedit.c
++++ b/net/sched/act_skbedit.c
+@@ -316,7 +316,7 @@ static __net_init int skbedit_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, skbedit_net_id);
+
+- return tc_action_net_init(tn, &act_skbedit_ops);
++ return tc_action_net_init(net, tn, &act_skbedit_ops);
+ }
+
+ static void __net_exit skbedit_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
+index 3038493d18ca..21d195296121 100644
+--- a/net/sched/act_skbmod.c
++++ b/net/sched/act_skbmod.c
+@@ -277,7 +277,7 @@ static __net_init int skbmod_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, skbmod_net_id);
+
+- return tc_action_net_init(tn, &act_skbmod_ops);
++ return tc_action_net_init(net, tn, &act_skbmod_ops);
+ }
+
+ static void __net_exit skbmod_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
+index 66bfe57e74ae..43309ff2b5dc 100644
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -579,7 +579,7 @@ static __net_init int tunnel_key_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
+
+- return tc_action_net_init(tn, &act_tunnel_key_ops);
++ return tc_action_net_init(net, tn, &act_tunnel_key_ops);
+ }
+
+ static void __net_exit tunnel_key_exit_net(struct list_head *net_list)
+diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
+index da993edd2e40..41528b966440 100644
+--- a/net/sched/act_vlan.c
++++ b/net/sched/act_vlan.c
+@@ -324,7 +324,7 @@ static __net_init int vlan_init_net(struct net *net)
+ {
+ struct tc_action_net *tn = net_generic(net, vlan_net_id);
+
+- return tc_action_net_init(tn, &act_vlan_ops);
++ return tc_action_net_init(net, tn, &act_vlan_ops);
+ }
+
+ static void __net_exit vlan_exit_net(struct list_head *net_list)
+diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
+index fcaf00621102..be7aebff0c1e 100644
+--- a/tools/bpf/bpftool/common.c
++++ b/tools/bpf/bpftool/common.c
+@@ -238,7 +238,7 @@ int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(__u32))
+
+ fd = get_fd_by_id(id);
+ if (fd < 0) {
+- p_err("can't get prog by id (%u): %s", id, strerror(errno));
++ p_err("can't open object by id (%u): %s", id, strerror(errno));
+ return -1;
+ }
+
+diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
+index 0ce50c319cfd..ef8a82f29f02 100644
+--- a/tools/hv/hv_kvp_daemon.c
++++ b/tools/hv/hv_kvp_daemon.c
+@@ -809,7 +809,7 @@ kvp_get_ip_info(int family, char *if_name, int op,
+ int sn_offset = 0;
+ int error = 0;
+ char *buffer;
+- struct hv_kvp_ipaddr_value *ip_buffer;
++ struct hv_kvp_ipaddr_value *ip_buffer = NULL;
+ char cidr_mask[5]; /* /xyz */
+ int weight;
+ int i;
+diff --git a/tools/testing/selftests/kvm/lib/x86.c b/tools/testing/selftests/kvm/lib/x86.c
+index a3122f1949a8..4d35eba73dc9 100644
+--- a/tools/testing/selftests/kvm/lib/x86.c
++++ b/tools/testing/selftests/kvm/lib/x86.c
+@@ -809,9 +809,11 @@ struct kvm_x86_state *vcpu_save_state(struct kvm_vm *vm, uint32_t vcpuid)
+ TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_XSAVE, r: %i",
+ r);
+
+- r = ioctl(vcpu->fd, KVM_GET_XCRS, &state->xcrs);
+- TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_XCRS, r: %i",
+- r);
++ if (kvm_check_cap(KVM_CAP_XCRS)) {
++ r = ioctl(vcpu->fd, KVM_GET_XCRS, &state->xcrs);
++ TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_XCRS, r: %i",
++ r);
++ }
+
+ r = ioctl(vcpu->fd, KVM_GET_SREGS, &state->sregs);
+ TEST_ASSERT(r == 0, "Unexpected result from KVM_GET_SREGS, r: %i",
+@@ -858,9 +860,11 @@ void vcpu_load_state(struct kvm_vm *vm, uint32_t vcpuid, struct kvm_x86_state *s
+ TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_XSAVE, r: %i",
+ r);
+
+- r = ioctl(vcpu->fd, KVM_SET_XCRS, &state->xcrs);
+- TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_XCRS, r: %i",
+- r);
++ if (kvm_check_cap(KVM_CAP_XCRS)) {
++ r = ioctl(vcpu->fd, KVM_SET_XCRS, &state->xcrs);
++ TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_XCRS, r: %i",
++ r);
++ }
+
+ r = ioctl(vcpu->fd, KVM_SET_SREGS, &state->sregs);
+ TEST_ASSERT(r == 0, "Unexpected result from KVM_SET_SREGS, r: %i",
+diff --git a/tools/testing/selftests/kvm/platform_info_test.c b/tools/testing/selftests/kvm/platform_info_test.c
+index 3764e7121265..65db510dddc3 100644
+--- a/tools/testing/selftests/kvm/platform_info_test.c
++++ b/tools/testing/selftests/kvm/platform_info_test.c
+@@ -100,8 +100,8 @@ int main(int argc, char *argv[])
+ msr_platform_info = vcpu_get_msr(vm, VCPU_ID, MSR_PLATFORM_INFO);
+ vcpu_set_msr(vm, VCPU_ID, MSR_PLATFORM_INFO,
+ msr_platform_info | MSR_PLATFORM_INFO_MAX_TURBO_RATIO);
+- test_msr_platform_info_disabled(vm);
+ test_msr_platform_info_enabled(vm);
++ test_msr_platform_info_disabled(vm);
+ vcpu_set_msr(vm, VCPU_ID, MSR_PLATFORM_INFO, msr_platform_info);
+
+ kvm_vm_free(vm);
+diff --git a/virt/kvm/arm/mmio.c b/virt/kvm/arm/mmio.c
+index 08443a15e6be..3caee91bca08 100644
+--- a/virt/kvm/arm/mmio.c
++++ b/virt/kvm/arm/mmio.c
+@@ -98,6 +98,12 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
+ unsigned int len;
+ int mask;
+
++ /* Detect an already handled MMIO return */
++ if (unlikely(!vcpu->mmio_needed))
++ return 0;
++
++ vcpu->mmio_needed = 0;
++
+ if (!run->mmio.is_write) {
+ len = run->mmio.len;
+ if (len > sizeof(unsigned long))
+@@ -200,6 +206,7 @@ int io_mem_abort(struct kvm_vcpu *vcpu, struct kvm_run *run,
+ run->mmio.is_write = is_write;
+ run->mmio.phys_addr = fault_ipa;
+ run->mmio.len = len;
++ vcpu->mmio_needed = 1;
+
+ if (!ret) {
+ /* We handled the access successfully in the kernel. */
+diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
+index 8196e4f8731f..cd75df25fe14 100644
+--- a/virt/kvm/arm/vgic/vgic-init.c
++++ b/virt/kvm/arm/vgic/vgic-init.c
+@@ -19,6 +19,7 @@
+ #include <linux/cpu.h>
+ #include <linux/kvm_host.h>
+ #include <kvm/arm_vgic.h>
++#include <asm/kvm_emulate.h>
+ #include <asm/kvm_mmu.h>
+ #include "vgic.h"
+
+@@ -175,12 +176,18 @@ static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis)
+ irq->vcpu = NULL;
+ irq->target_vcpu = vcpu0;
+ kref_init(&irq->refcount);
+- if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V2) {
++ switch (dist->vgic_model) {
++ case KVM_DEV_TYPE_ARM_VGIC_V2:
+ irq->targets = 0;
+ irq->group = 0;
+- } else {
++ break;
++ case KVM_DEV_TYPE_ARM_VGIC_V3:
+ irq->mpidr = 0;
+ irq->group = 1;
++ break;
++ default:
++ kfree(dist->spis);
++ return -EINVAL;
+ }
+ }
+ return 0;
+@@ -220,7 +227,6 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
+ irq->intid = i;
+ irq->vcpu = NULL;
+ irq->target_vcpu = vcpu;
+- irq->targets = 1U << vcpu->vcpu_id;
+ kref_init(&irq->refcount);
+ if (vgic_irq_is_sgi(i)) {
+ /* SGIs */
+@@ -230,11 +236,6 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
+ /* PPIs */
+ irq->config = VGIC_CONFIG_LEVEL;
+ }
+-
+- if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3)
+- irq->group = 1;
+- else
+- irq->group = 0;
+ }
+
+ if (!irqchip_in_kernel(vcpu->kvm))
+@@ -297,10 +298,19 @@ int vgic_init(struct kvm *kvm)
+
+ for (i = 0; i < VGIC_NR_PRIVATE_IRQS; i++) {
+ struct vgic_irq *irq = &vgic_cpu->private_irqs[i];
+- if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3)
++ switch (dist->vgic_model) {
++ case KVM_DEV_TYPE_ARM_VGIC_V3:
+ irq->group = 1;
+- else
++ irq->mpidr = kvm_vcpu_get_mpidr_aff(vcpu);
++ break;
++ case KVM_DEV_TYPE_ARM_VGIC_V2:
+ irq->group = 0;
++ irq->targets = 1U << idx;
++ break;
++ default:
++ ret = -EINVAL;
++ goto out;
++ }
+ }
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-09-16 12:26 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-09-16 12:26 UTC (permalink / raw
To: gentoo-commits
commit: 145454b6a808a552cf3e80041ce442cbae29d912
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Sep 16 12:25:55 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Sep 16 12:25:55 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=145454b6
Linux patch 4.19.73
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 8 +-
1072_linux-4.19.73.patch | 8877 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 8883 insertions(+), 2 deletions(-)
diff --git a/0000_README b/0000_README
index 5a202ee..d5d2e47 100644
--- a/0000_README
+++ b/0000_README
@@ -323,9 +323,13 @@ Patch: 1070_linux-4.19.70.patch
From: https://www.kernel.org
Desc: Linux 4.19.70
-Patch: 1071_linux-4.19.71.patch
+Patch: 1071_linux-4.19.72.patch
From: https://www.kernel.org
-Desc: Linux 4.19.71
+Desc: Linux 4.19.72
+
+Patch: 1072_linux-4.19.73.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.73
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
diff --git a/1072_linux-4.19.73.patch b/1072_linux-4.19.73.patch
new file mode 100644
index 0000000..0364fc7
--- /dev/null
+++ b/1072_linux-4.19.73.patch
@@ -0,0 +1,8877 @@
+diff --git a/Documentation/devicetree/bindings/display/panel/armadeus,st0700-adapt.txt b/Documentation/devicetree/bindings/display/panel/armadeus,st0700-adapt.txt
+new file mode 100644
+index 000000000000..a30d63db3c8f
+--- /dev/null
++++ b/Documentation/devicetree/bindings/display/panel/armadeus,st0700-adapt.txt
+@@ -0,0 +1,9 @@
++Armadeus ST0700 Adapt. A Santek ST0700I5Y-RBSLW 7.0" WVGA (800x480) TFT with
++an adapter board.
++
++Required properties:
++- compatible: "armadeus,st0700-adapt"
++- power-supply: see panel-common.txt
++
++Optional properties:
++- backlight: see panel-common.txt
+diff --git a/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt b/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt
+index 6c49db7f8ad2..e1fe02f3e3e9 100644
+--- a/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt
++++ b/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt
+@@ -11,11 +11,13 @@ New driver handles the following
+
+ Required properties:
+ - compatible: Must be "samsung,exynos-adc-v1"
+- for exynos4412/5250 and s5pv210 controllers.
++ for Exynos5250 controllers.
+ Must be "samsung,exynos-adc-v2" for
+ future controllers.
+ Must be "samsung,exynos3250-adc" for
+ controllers compatible with ADC of Exynos3250.
++ Must be "samsung,exynos4212-adc" for
++ controllers compatible with ADC of Exynos4212 and Exynos4412.
+ Must be "samsung,exynos7-adc" for
+ the ADC in Exynos7 and compatibles
+ Must be "samsung,s3c2410-adc" for
+@@ -28,6 +30,8 @@ Required properties:
+ the ADC in s3c2443 and compatibles
+ Must be "samsung,s3c6410-adc" for
+ the ADC in s3c6410 and compatibles
++ Must be "samsung,s5pv210-adc" for
++ the ADC in s5pv210 and compatibles
+ - reg: List of ADC register address range
+ - The base address and range of ADC register
+ - The base address and range of ADC_PHY register (every
+diff --git a/Documentation/devicetree/bindings/mmc/mmc.txt b/Documentation/devicetree/bindings/mmc/mmc.txt
+index f5a0923b34ca..c269dbe384fe 100644
+--- a/Documentation/devicetree/bindings/mmc/mmc.txt
++++ b/Documentation/devicetree/bindings/mmc/mmc.txt
+@@ -62,6 +62,10 @@ Optional properties:
+ be referred to mmc-pwrseq-simple.txt. But now it's reused as a tunable delay
+ waiting for I/O signalling and card power supply to be stable, regardless of
+ whether pwrseq-simple is used. Default to 10ms if no available.
++- supports-cqe : The presence of this property indicates that the corresponding
++ MMC host controller supports HW command queue feature.
++- disable-cqe-dcmd: This property indicates that the MMC controller's command
++ queue engine (CQE) does not support direct commands (DCMDs).
+
+ *NOTE* on CD and WP polarity. To use common for all SD/MMC host controllers line
+ polarity properties, we have to fix the meaning of the "normal" and "inverted"
+diff --git a/Makefile b/Makefile
+index ef80b1dfb753..9748fa3704bc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 72
++SUBLEVEL = 73
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
+index 5c6663321e87..215f515442e0 100644
+--- a/arch/arc/kernel/troubleshoot.c
++++ b/arch/arc/kernel/troubleshoot.c
+@@ -179,6 +179,12 @@ void show_regs(struct pt_regs *regs)
+ struct task_struct *tsk = current;
+ struct callee_regs *cregs;
+
++ /*
++ * generic code calls us with preemption disabled, but some calls
++ * here could sleep, so re-enable to avoid lockdep splat
++ */
++ preempt_enable();
++
+ print_task_path_n_nm(tsk);
+ show_regs_print_info(KERN_INFO);
+
+@@ -221,6 +227,8 @@ void show_regs(struct pt_regs *regs)
+ cregs = (struct callee_regs *)current->thread.callee_reg;
+ if (cregs)
+ show_callee_regs(cregs);
++
++ preempt_disable();
+ }
+
+ void show_kernel_fault_diag(const char *str, struct pt_regs *regs,
+diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
+index db6913094be3..4e8143de32e7 100644
+--- a/arch/arc/mm/fault.c
++++ b/arch/arc/mm/fault.c
+@@ -66,14 +66,12 @@ void do_page_fault(unsigned long address, struct pt_regs *regs)
+ struct vm_area_struct *vma = NULL;
+ struct task_struct *tsk = current;
+ struct mm_struct *mm = tsk->mm;
+- siginfo_t info;
++ int si_code = SEGV_MAPERR;
+ int ret;
+ vm_fault_t fault;
+ int write = regs->ecr_cause & ECR_C_PROTV_STORE; /* ST/EX */
+ unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+
+- clear_siginfo(&info);
+-
+ /*
+ * We fault-in kernel-space virtual memory on-demand. The
+ * 'reference' page table is init_mm.pgd.
+@@ -83,16 +81,14 @@ void do_page_fault(unsigned long address, struct pt_regs *regs)
+ * only copy the information from the master page table,
+ * nothing more.
+ */
+- if (address >= VMALLOC_START) {
++ if (address >= VMALLOC_START && !user_mode(regs)) {
+ ret = handle_kernel_vaddr_fault(address);
+ if (unlikely(ret))
+- goto bad_area_nosemaphore;
++ goto no_context;
+ else
+ return;
+ }
+
+- info.si_code = SEGV_MAPERR;
+-
+ /*
+ * If we're in an interrupt or have no user
+ * context, we must not take the fault..
+@@ -119,7 +115,7 @@ retry:
+ * we can handle it..
+ */
+ good_area:
+- info.si_code = SEGV_ACCERR;
++ si_code = SEGV_ACCERR;
+
+ /* Handle protection violation, execute on heap or stack */
+
+@@ -143,12 +139,17 @@ good_area:
+ */
+ fault = handle_mm_fault(vma, address, flags);
+
+- /* If Pagefault was interrupted by SIGKILL, exit page fault "early" */
+ if (unlikely(fatal_signal_pending(current))) {
+- if ((fault & VM_FAULT_ERROR) && !(fault & VM_FAULT_RETRY))
+- up_read(&mm->mmap_sem);
+- if (user_mode(regs))
++
++ /*
++ * if fault retry, mmap_sem already relinquished by core mm
++ * so OK to return to user mode (with signal handled first)
++ */
++ if (fault & VM_FAULT_RETRY) {
++ if (!user_mode(regs))
++ goto no_context;
+ return;
++ }
+ }
+
+ perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
+@@ -195,15 +196,10 @@ good_area:
+ bad_area:
+ up_read(&mm->mmap_sem);
+
+-bad_area_nosemaphore:
+ /* User mode accesses just cause a SIGSEGV */
+ if (user_mode(regs)) {
+ tsk->thread.fault_address = address;
+- info.si_signo = SIGSEGV;
+- info.si_errno = 0;
+- /* info.si_code has been set above */
+- info.si_addr = (void __user *)address;
+- force_sig_info(SIGSEGV, &info, tsk);
++ force_sig_fault(SIGSEGV, si_code, (void __user *)address, tsk);
+ return;
+ }
+
+@@ -238,9 +234,5 @@ do_sigbus:
+ goto no_context;
+
+ tsk->thread.fault_address = address;
+- info.si_signo = SIGBUS;
+- info.si_errno = 0;
+- info.si_code = BUS_ADRERR;
+- info.si_addr = (void __user *)address;
+- force_sig_info(SIGBUS, &info, tsk);
++ force_sig_fault(SIGBUS, BUS_ADRERR, (void __user *)address, tsk);
+ }
+diff --git a/arch/arm/boot/dts/gemini-dlink-dir-685.dts b/arch/arm/boot/dts/gemini-dlink-dir-685.dts
+index 502a361d1fe9..15d6157b661d 100644
+--- a/arch/arm/boot/dts/gemini-dlink-dir-685.dts
++++ b/arch/arm/boot/dts/gemini-dlink-dir-685.dts
+@@ -65,7 +65,7 @@
+ gpio-miso = <&gpio1 8 GPIO_ACTIVE_HIGH>;
+ gpio-mosi = <&gpio1 7 GPIO_ACTIVE_HIGH>;
+ /* Collides with pflash CE1, not so cool */
+- cs-gpios = <&gpio0 20 GPIO_ACTIVE_HIGH>;
++ cs-gpios = <&gpio0 20 GPIO_ACTIVE_LOW>;
+ num-chipselects = <1>;
+
+ panel: display@0 {
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 78db67337ed4..54d056b01bb5 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -386,10 +386,10 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000
+- 0x82000000 0 0x48000000 0x48000000 0 0x10000000>;
++ ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000>,
++ <0x82000000 0 0x40300000 0x40300000 0 0x00d00000>;
+
+- interrupts = <GIC_SPI 141 IRQ_TYPE_EDGE_RISING>;
++ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0x7>;
+diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c
+index 3c42bf9fa061..708931b47090 100644
+--- a/arch/arm/mach-davinci/devices-da8xx.c
++++ b/arch/arm/mach-davinci/devices-da8xx.c
+@@ -704,6 +704,46 @@ static struct resource da8xx_gpio_resources[] = {
+ },
+ { /* interrupt */
+ .start = IRQ_DA8XX_GPIO0,
++ .end = IRQ_DA8XX_GPIO0,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO1,
++ .end = IRQ_DA8XX_GPIO1,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO2,
++ .end = IRQ_DA8XX_GPIO2,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO3,
++ .end = IRQ_DA8XX_GPIO3,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO4,
++ .end = IRQ_DA8XX_GPIO4,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO5,
++ .end = IRQ_DA8XX_GPIO5,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO6,
++ .end = IRQ_DA8XX_GPIO6,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO7,
++ .end = IRQ_DA8XX_GPIO7,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO8,
+ .end = IRQ_DA8XX_GPIO8,
+ .flags = IORESOURCE_IRQ,
+ },
+diff --git a/arch/arm/mach-davinci/dm355.c b/arch/arm/mach-davinci/dm355.c
+index 9f7d38d12c88..2b0f5d97ab7c 100644
+--- a/arch/arm/mach-davinci/dm355.c
++++ b/arch/arm/mach-davinci/dm355.c
+@@ -548,6 +548,36 @@ static struct resource dm355_gpio_resources[] = {
+ },
+ { /* interrupt */
+ .start = IRQ_DM355_GPIOBNK0,
++ .end = IRQ_DM355_GPIOBNK0,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK1,
++ .end = IRQ_DM355_GPIOBNK1,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK2,
++ .end = IRQ_DM355_GPIOBNK2,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK3,
++ .end = IRQ_DM355_GPIOBNK3,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK4,
++ .end = IRQ_DM355_GPIOBNK4,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK5,
++ .end = IRQ_DM355_GPIOBNK5,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK6,
+ .end = IRQ_DM355_GPIOBNK6,
+ .flags = IORESOURCE_IRQ,
+ },
+diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c
+index abcf2a5ed89b..42665914166a 100644
+--- a/arch/arm/mach-davinci/dm365.c
++++ b/arch/arm/mach-davinci/dm365.c
+@@ -267,6 +267,41 @@ static struct resource dm365_gpio_resources[] = {
+ },
+ { /* interrupt */
+ .start = IRQ_DM365_GPIO0,
++ .end = IRQ_DM365_GPIO0,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO1,
++ .end = IRQ_DM365_GPIO1,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO2,
++ .end = IRQ_DM365_GPIO2,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO3,
++ .end = IRQ_DM365_GPIO3,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO4,
++ .end = IRQ_DM365_GPIO4,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO5,
++ .end = IRQ_DM365_GPIO5,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO6,
++ .end = IRQ_DM365_GPIO6,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO7,
+ .end = IRQ_DM365_GPIO7,
+ .flags = IORESOURCE_IRQ,
+ },
+diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
+index 0720da7809a6..de1ec6dc01e9 100644
+--- a/arch/arm/mach-davinci/dm644x.c
++++ b/arch/arm/mach-davinci/dm644x.c
+@@ -492,6 +492,26 @@ static struct resource dm644_gpio_resources[] = {
+ },
+ { /* interrupt */
+ .start = IRQ_GPIOBNK0,
++ .end = IRQ_GPIOBNK0,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_GPIOBNK1,
++ .end = IRQ_GPIOBNK1,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_GPIOBNK2,
++ .end = IRQ_GPIOBNK2,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_GPIOBNK3,
++ .end = IRQ_GPIOBNK3,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_GPIOBNK4,
+ .end = IRQ_GPIOBNK4,
+ .flags = IORESOURCE_IRQ,
+ },
+diff --git a/arch/arm/mach-davinci/dm646x.c b/arch/arm/mach-davinci/dm646x.c
+index 6bd2ed069d0d..d9b93e2806d2 100644
+--- a/arch/arm/mach-davinci/dm646x.c
++++ b/arch/arm/mach-davinci/dm646x.c
+@@ -442,6 +442,16 @@ static struct resource dm646x_gpio_resources[] = {
+ },
+ { /* interrupt */
+ .start = IRQ_DM646X_GPIOBNK0,
++ .end = IRQ_DM646X_GPIOBNK0,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM646X_GPIOBNK1,
++ .end = IRQ_DM646X_GPIOBNK1,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM646X_GPIOBNK2,
+ .end = IRQ_DM646X_GPIOBNK2,
+ .flags = IORESOURCE_IRQ,
+ },
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+index 5089aa64088f..9a1ea8a46405 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+@@ -140,6 +140,7 @@
+ tx-fifo-depth = <16384>;
+ rx-fifo-depth = <16384>;
+ snps,multicast-filter-bins = <256>;
++ altr,sysmgr-syscon = <&sysmgr 0x44 0>;
+ status = "disabled";
+ };
+
+@@ -156,6 +157,7 @@
+ tx-fifo-depth = <16384>;
+ rx-fifo-depth = <16384>;
+ snps,multicast-filter-bins = <256>;
++ altr,sysmgr-syscon = <&sysmgr 0x48 0>;
+ status = "disabled";
+ };
+
+@@ -172,6 +174,7 @@
+ tx-fifo-depth = <16384>;
+ rx-fifo-depth = <16384>;
+ snps,multicast-filter-bins = <256>;
++ altr,sysmgr-syscon = <&sysmgr 0x4c 0>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+index c142169a58fc..e9147e35b739 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+@@ -40,6 +40,7 @@
+ pinctrl-0 = <&usb30_host_drv>;
+ regulator-name = "vcc_host_5v";
+ regulator-always-on;
++ regulator-boot-on;
+ vin-supply = <&vcc_sys>;
+ };
+
+@@ -50,6 +51,7 @@
+ pinctrl-0 = <&usb20_host_drv>;
+ regulator-name = "vcc_host1_5v";
+ regulator-always-on;
++ regulator-boot-on;
+ vin-supply = <&vcc_sys>;
+ };
+
+diff --git a/arch/powerpc/include/asm/kvm_book3s.h b/arch/powerpc/include/asm/kvm_book3s.h
+index 83a9aa3cf689..dd18d8174504 100644
+--- a/arch/powerpc/include/asm/kvm_book3s.h
++++ b/arch/powerpc/include/asm/kvm_book3s.h
+@@ -301,12 +301,12 @@ static inline ulong kvmppc_get_gpr(struct kvm_vcpu *vcpu, int num)
+
+ static inline void kvmppc_set_cr(struct kvm_vcpu *vcpu, u32 val)
+ {
+- vcpu->arch.cr = val;
++ vcpu->arch.regs.ccr = val;
+ }
+
+ static inline u32 kvmppc_get_cr(struct kvm_vcpu *vcpu)
+ {
+- return vcpu->arch.cr;
++ return vcpu->arch.regs.ccr;
+ }
+
+ static inline void kvmppc_set_xer(struct kvm_vcpu *vcpu, ulong val)
+diff --git a/arch/powerpc/include/asm/kvm_book3s_64.h b/arch/powerpc/include/asm/kvm_book3s_64.h
+index dc435a5af7d6..14fa07c73f44 100644
+--- a/arch/powerpc/include/asm/kvm_book3s_64.h
++++ b/arch/powerpc/include/asm/kvm_book3s_64.h
+@@ -482,7 +482,7 @@ static inline u64 sanitize_msr(u64 msr)
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ static inline void copy_from_checkpoint(struct kvm_vcpu *vcpu)
+ {
+- vcpu->arch.cr = vcpu->arch.cr_tm;
++ vcpu->arch.regs.ccr = vcpu->arch.cr_tm;
+ vcpu->arch.regs.xer = vcpu->arch.xer_tm;
+ vcpu->arch.regs.link = vcpu->arch.lr_tm;
+ vcpu->arch.regs.ctr = vcpu->arch.ctr_tm;
+@@ -499,7 +499,7 @@ static inline void copy_from_checkpoint(struct kvm_vcpu *vcpu)
+
+ static inline void copy_to_checkpoint(struct kvm_vcpu *vcpu)
+ {
+- vcpu->arch.cr_tm = vcpu->arch.cr;
++ vcpu->arch.cr_tm = vcpu->arch.regs.ccr;
+ vcpu->arch.xer_tm = vcpu->arch.regs.xer;
+ vcpu->arch.lr_tm = vcpu->arch.regs.link;
+ vcpu->arch.ctr_tm = vcpu->arch.regs.ctr;
+diff --git a/arch/powerpc/include/asm/kvm_booke.h b/arch/powerpc/include/asm/kvm_booke.h
+index d513e3ed1c65..f0cef625f17c 100644
+--- a/arch/powerpc/include/asm/kvm_booke.h
++++ b/arch/powerpc/include/asm/kvm_booke.h
+@@ -46,12 +46,12 @@ static inline ulong kvmppc_get_gpr(struct kvm_vcpu *vcpu, int num)
+
+ static inline void kvmppc_set_cr(struct kvm_vcpu *vcpu, u32 val)
+ {
+- vcpu->arch.cr = val;
++ vcpu->arch.regs.ccr = val;
+ }
+
+ static inline u32 kvmppc_get_cr(struct kvm_vcpu *vcpu)
+ {
+- return vcpu->arch.cr;
++ return vcpu->arch.regs.ccr;
+ }
+
+ static inline void kvmppc_set_xer(struct kvm_vcpu *vcpu, ulong val)
+diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
+index 2b6049e83970..2f95e38f0549 100644
+--- a/arch/powerpc/include/asm/kvm_host.h
++++ b/arch/powerpc/include/asm/kvm_host.h
+@@ -538,8 +538,6 @@ struct kvm_vcpu_arch {
+ ulong tar;
+ #endif
+
+- u32 cr;
+-
+ #ifdef CONFIG_PPC_BOOK3S
+ ulong hflags;
+ ulong guest_owned_ext;
+diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
+index b694d6af1150..ae953958c0f3 100644
+--- a/arch/powerpc/include/asm/mmu_context.h
++++ b/arch/powerpc/include/asm/mmu_context.h
+@@ -217,12 +217,6 @@ static inline void enter_lazy_tlb(struct mm_struct *mm,
+ #endif
+ }
+
+-static inline int arch_dup_mmap(struct mm_struct *oldmm,
+- struct mm_struct *mm)
+-{
+- return 0;
+-}
+-
+ #ifndef CONFIG_PPC_BOOK3S_64
+ static inline void arch_exit_mmap(struct mm_struct *mm)
+ {
+@@ -247,6 +241,7 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
+ #ifdef CONFIG_PPC_MEM_KEYS
+ bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,
+ bool execute, bool foreign);
++void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm);
+ #else /* CONFIG_PPC_MEM_KEYS */
+ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
+ bool write, bool execute, bool foreign)
+@@ -259,6 +254,7 @@ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
+ #define thread_pkey_regs_save(thread)
+ #define thread_pkey_regs_restore(new_thread, old_thread)
+ #define thread_pkey_regs_init(thread)
++#define arch_dup_pkeys(oldmm, mm)
+
+ static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)
+ {
+@@ -267,5 +263,12 @@ static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)
+
+ #endif /* CONFIG_PPC_MEM_KEYS */
+
++static inline int arch_dup_mmap(struct mm_struct *oldmm,
++ struct mm_struct *mm)
++{
++ arch_dup_pkeys(oldmm, mm);
++ return 0;
++}
++
+ #endif /* __KERNEL__ */
+ #endif /* __ASM_POWERPC_MMU_CONTEXT_H */
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index e5b314ed054e..640a4d818772 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -118,11 +118,16 @@
+ #define MSR_TS_S __MASK(MSR_TS_S_LG) /* Transaction Suspended */
+ #define MSR_TS_T __MASK(MSR_TS_T_LG) /* Transaction Transactional */
+ #define MSR_TS_MASK (MSR_TS_T | MSR_TS_S) /* Transaction State bits */
+-#define MSR_TM_ACTIVE(x) (((x) & MSR_TS_MASK) != 0) /* Transaction active? */
+ #define MSR_TM_RESV(x) (((x) & MSR_TS_MASK) == MSR_TS_MASK) /* Reserved */
+ #define MSR_TM_TRANSACTIONAL(x) (((x) & MSR_TS_MASK) == MSR_TS_T)
+ #define MSR_TM_SUSPENDED(x) (((x) & MSR_TS_MASK) == MSR_TS_S)
+
++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++#define MSR_TM_ACTIVE(x) (((x) & MSR_TS_MASK) != 0) /* Transaction active? */
++#else
++#define MSR_TM_ACTIVE(x) 0
++#endif
++
+ #if defined(CONFIG_PPC_BOOK3S_64)
+ #define MSR_64BIT MSR_SF
+
+diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
+index 89cf15566c4e..7c3738d890e8 100644
+--- a/arch/powerpc/kernel/asm-offsets.c
++++ b/arch/powerpc/kernel/asm-offsets.c
+@@ -438,7 +438,7 @@ int main(void)
+ #ifdef CONFIG_PPC_BOOK3S
+ OFFSET(VCPU_TAR, kvm_vcpu, arch.tar);
+ #endif
+- OFFSET(VCPU_CR, kvm_vcpu, arch.cr);
++ OFFSET(VCPU_CR, kvm_vcpu, arch.regs.ccr);
+ OFFSET(VCPU_PC, kvm_vcpu, arch.regs.nip);
+ #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
+ OFFSET(VCPU_MSR, kvm_vcpu, arch.shregs.msr);
+@@ -695,7 +695,7 @@ int main(void)
+ #endif /* CONFIG_PPC_BOOK3S_64 */
+
+ #else /* CONFIG_PPC_BOOK3S */
+- OFFSET(VCPU_CR, kvm_vcpu, arch.cr);
++ OFFSET(VCPU_CR, kvm_vcpu, arch.regs.ccr);
+ OFFSET(VCPU_XER, kvm_vcpu, arch.regs.xer);
+ OFFSET(VCPU_LR, kvm_vcpu, arch.regs.link);
+ OFFSET(VCPU_CTR, kvm_vcpu, arch.regs.ctr);
+diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
+index 9168a247e24f..3fb564f3e887 100644
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -906,6 +906,7 @@ p_toc: .8byte __toc_start + 0x8000 - 0b
+ /*
+ * This is where the main kernel code starts.
+ */
++__REF
+ start_here_multiplatform:
+ /* set up the TOC */
+ bl relative_toc
+@@ -981,6 +982,7 @@ start_here_multiplatform:
+ RFI
+ b . /* prevent speculative execution */
+
++ .previous
+ /* This is where all platforms converge execution */
+
+ start_here_common:
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index d29f2dca725b..909c9407e392 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -102,27 +102,8 @@ static void check_if_tm_restore_required(struct task_struct *tsk)
+ }
+ }
+
+-static inline bool msr_tm_active(unsigned long msr)
+-{
+- return MSR_TM_ACTIVE(msr);
+-}
+-
+-static bool tm_active_with_fp(struct task_struct *tsk)
+-{
+- return msr_tm_active(tsk->thread.regs->msr) &&
+- (tsk->thread.ckpt_regs.msr & MSR_FP);
+-}
+-
+-static bool tm_active_with_altivec(struct task_struct *tsk)
+-{
+- return msr_tm_active(tsk->thread.regs->msr) &&
+- (tsk->thread.ckpt_regs.msr & MSR_VEC);
+-}
+ #else
+-static inline bool msr_tm_active(unsigned long msr) { return false; }
+ static inline void check_if_tm_restore_required(struct task_struct *tsk) { }
+-static inline bool tm_active_with_fp(struct task_struct *tsk) { return false; }
+-static inline bool tm_active_with_altivec(struct task_struct *tsk) { return false; }
+ #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
+
+ bool strict_msr_control;
+@@ -247,7 +228,8 @@ void enable_kernel_fp(void)
+ * giveup as this would save to the 'live' structure not the
+ * checkpointed structure.
+ */
+- if(!msr_tm_active(cpumsr) && msr_tm_active(current->thread.regs->msr))
++ if (!MSR_TM_ACTIVE(cpumsr) &&
++ MSR_TM_ACTIVE(current->thread.regs->msr))
+ return;
+ __giveup_fpu(current);
+ }
+@@ -256,7 +238,7 @@ EXPORT_SYMBOL(enable_kernel_fp);
+
+ static int restore_fp(struct task_struct *tsk)
+ {
+- if (tsk->thread.load_fp || tm_active_with_fp(tsk)) {
++ if (tsk->thread.load_fp) {
+ load_fp_state(¤t->thread.fp_state);
+ current->thread.load_fp++;
+ return 1;
+@@ -311,7 +293,8 @@ void enable_kernel_altivec(void)
+ * giveup as this would save to the 'live' structure not the
+ * checkpointed structure.
+ */
+- if(!msr_tm_active(cpumsr) && msr_tm_active(current->thread.regs->msr))
++ if (!MSR_TM_ACTIVE(cpumsr) &&
++ MSR_TM_ACTIVE(current->thread.regs->msr))
+ return;
+ __giveup_altivec(current);
+ }
+@@ -337,8 +320,7 @@ EXPORT_SYMBOL_GPL(flush_altivec_to_thread);
+
+ static int restore_altivec(struct task_struct *tsk)
+ {
+- if (cpu_has_feature(CPU_FTR_ALTIVEC) &&
+- (tsk->thread.load_vec || tm_active_with_altivec(tsk))) {
++ if (cpu_has_feature(CPU_FTR_ALTIVEC) && (tsk->thread.load_vec)) {
+ load_vr_state(&tsk->thread.vr_state);
+ tsk->thread.used_vr = 1;
+ tsk->thread.load_vec++;
+@@ -397,7 +379,8 @@ void enable_kernel_vsx(void)
+ * giveup as this would save to the 'live' structure not the
+ * checkpointed structure.
+ */
+- if(!msr_tm_active(cpumsr) && msr_tm_active(current->thread.regs->msr))
++ if (!MSR_TM_ACTIVE(cpumsr) &&
++ MSR_TM_ACTIVE(current->thread.regs->msr))
+ return;
+ __giveup_vsx(current);
+ }
+@@ -499,13 +482,14 @@ void giveup_all(struct task_struct *tsk)
+ if (!tsk->thread.regs)
+ return;
+
++ check_if_tm_restore_required(tsk);
++
+ usermsr = tsk->thread.regs->msr;
+
+ if ((usermsr & msr_all_available) == 0)
+ return;
+
+ msr_check_and_set(msr_all_available);
+- check_if_tm_restore_required(tsk);
+
+ WARN_ON((usermsr & MSR_VSX) && !((usermsr & MSR_FP) && (usermsr & MSR_VEC)));
+
+@@ -530,7 +514,7 @@ void restore_math(struct pt_regs *regs)
+ {
+ unsigned long msr;
+
+- if (!msr_tm_active(regs->msr) &&
++ if (!MSR_TM_ACTIVE(regs->msr) &&
+ !current->thread.load_fp && !loadvec(current->thread))
+ return;
+
+diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
+index 68e14afecac8..a488c105b923 100644
+--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
++++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
+@@ -744,12 +744,15 @@ void kvmppc_rmap_reset(struct kvm *kvm)
+ srcu_idx = srcu_read_lock(&kvm->srcu);
+ slots = kvm_memslots(kvm);
+ kvm_for_each_memslot(memslot, slots) {
++ /* Mutual exclusion with kvm_unmap_hva_range etc. */
++ spin_lock(&kvm->mmu_lock);
+ /*
+ * This assumes it is acceptable to lose reference and
+ * change bits across a reset.
+ */
+ memset(memslot->arch.rmap, 0,
+ memslot->npages * sizeof(*memslot->arch.rmap));
++ spin_unlock(&kvm->mmu_lock);
+ }
+ srcu_read_unlock(&kvm->srcu, srcu_idx);
+ }
+diff --git a/arch/powerpc/kvm/book3s_emulate.c b/arch/powerpc/kvm/book3s_emulate.c
+index 36b11c5a0dbb..2654df220d05 100644
+--- a/arch/powerpc/kvm/book3s_emulate.c
++++ b/arch/powerpc/kvm/book3s_emulate.c
+@@ -110,7 +110,7 @@ static inline void kvmppc_copyto_vcpu_tm(struct kvm_vcpu *vcpu)
+ vcpu->arch.ctr_tm = vcpu->arch.regs.ctr;
+ vcpu->arch.tar_tm = vcpu->arch.tar;
+ vcpu->arch.lr_tm = vcpu->arch.regs.link;
+- vcpu->arch.cr_tm = vcpu->arch.cr;
++ vcpu->arch.cr_tm = vcpu->arch.regs.ccr;
+ vcpu->arch.xer_tm = vcpu->arch.regs.xer;
+ vcpu->arch.vrsave_tm = vcpu->arch.vrsave;
+ }
+@@ -129,7 +129,7 @@ static inline void kvmppc_copyfrom_vcpu_tm(struct kvm_vcpu *vcpu)
+ vcpu->arch.regs.ctr = vcpu->arch.ctr_tm;
+ vcpu->arch.tar = vcpu->arch.tar_tm;
+ vcpu->arch.regs.link = vcpu->arch.lr_tm;
+- vcpu->arch.cr = vcpu->arch.cr_tm;
++ vcpu->arch.regs.ccr = vcpu->arch.cr_tm;
+ vcpu->arch.regs.xer = vcpu->arch.xer_tm;
+ vcpu->arch.vrsave = vcpu->arch.vrsave_tm;
+ }
+@@ -141,7 +141,7 @@ static void kvmppc_emulate_treclaim(struct kvm_vcpu *vcpu, int ra_val)
+ uint64_t texasr;
+
+ /* CR0 = 0 | MSR[TS] | 0 */
+- vcpu->arch.cr = (vcpu->arch.cr & ~(CR0_MASK << CR0_SHIFT)) |
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & ~(CR0_MASK << CR0_SHIFT)) |
+ (((guest_msr & MSR_TS_MASK) >> (MSR_TS_S_LG - 1))
+ << CR0_SHIFT);
+
+@@ -220,7 +220,7 @@ void kvmppc_emulate_tabort(struct kvm_vcpu *vcpu, int ra_val)
+ tm_abort(ra_val);
+
+ /* CR0 = 0 | MSR[TS] | 0 */
+- vcpu->arch.cr = (vcpu->arch.cr & ~(CR0_MASK << CR0_SHIFT)) |
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & ~(CR0_MASK << CR0_SHIFT)) |
+ (((guest_msr & MSR_TS_MASK) >> (MSR_TS_S_LG - 1))
+ << CR0_SHIFT);
+
+@@ -494,8 +494,8 @@ int kvmppc_core_emulate_op_pr(struct kvm_run *run, struct kvm_vcpu *vcpu,
+
+ if (!(kvmppc_get_msr(vcpu) & MSR_PR)) {
+ preempt_disable();
+- vcpu->arch.cr = (CR0_TBEGIN_FAILURE |
+- (vcpu->arch.cr & ~(CR0_MASK << CR0_SHIFT)));
++ vcpu->arch.regs.ccr = (CR0_TBEGIN_FAILURE |
++ (vcpu->arch.regs.ccr & ~(CR0_MASK << CR0_SHIFT)));
+
+ vcpu->arch.texasr = (TEXASR_FS | TEXASR_EXACT |
+ (((u64)(TM_CAUSE_EMULATE | TM_CAUSE_PERSISTENT))
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 083dcedba11c..05b32cc12e41 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -410,8 +410,8 @@ static void kvmppc_dump_regs(struct kvm_vcpu *vcpu)
+ vcpu->arch.shregs.sprg0, vcpu->arch.shregs.sprg1);
+ pr_err("sprg2 = %.16llx sprg3 = %.16llx\n",
+ vcpu->arch.shregs.sprg2, vcpu->arch.shregs.sprg3);
+- pr_err("cr = %.8x xer = %.16lx dsisr = %.8x\n",
+- vcpu->arch.cr, vcpu->arch.regs.xer, vcpu->arch.shregs.dsisr);
++ pr_err("cr = %.8lx xer = %.16lx dsisr = %.8x\n",
++ vcpu->arch.regs.ccr, vcpu->arch.regs.xer, vcpu->arch.shregs.dsisr);
+ pr_err("dar = %.16llx\n", vcpu->arch.shregs.dar);
+ pr_err("fault dar = %.16lx dsisr = %.8x\n",
+ vcpu->arch.fault_dar, vcpu->arch.fault_dsisr);
+@@ -3813,12 +3813,15 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu)
+ /* Must be called with kvm->lock held and mmu_ready = 0 and no vcpus running */
+ int kvmppc_switch_mmu_to_hpt(struct kvm *kvm)
+ {
++ kvmppc_rmap_reset(kvm);
++ kvm->arch.process_table = 0;
++ /* Mutual exclusion with kvm_unmap_hva_range etc. */
++ spin_lock(&kvm->mmu_lock);
++ kvm->arch.radix = 0;
++ spin_unlock(&kvm->mmu_lock);
+ kvmppc_free_radix(kvm);
+ kvmppc_update_lpcr(kvm, LPCR_VPM1,
+ LPCR_VPM1 | LPCR_UPRT | LPCR_GTSE | LPCR_HR);
+- kvmppc_rmap_reset(kvm);
+- kvm->arch.radix = 0;
+- kvm->arch.process_table = 0;
+ return 0;
+ }
+
+@@ -3831,10 +3834,14 @@ int kvmppc_switch_mmu_to_radix(struct kvm *kvm)
+ if (err)
+ return err;
+
++ kvmppc_rmap_reset(kvm);
++ /* Mutual exclusion with kvm_unmap_hva_range etc. */
++ spin_lock(&kvm->mmu_lock);
++ kvm->arch.radix = 1;
++ spin_unlock(&kvm->mmu_lock);
+ kvmppc_free_hpt(&kvm->arch.hpt);
+ kvmppc_update_lpcr(kvm, LPCR_UPRT | LPCR_GTSE | LPCR_HR,
+ LPCR_VPM1 | LPCR_UPRT | LPCR_GTSE | LPCR_HR);
+- kvm->arch.radix = 1;
+ return 0;
+ }
+
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index 1d14046124a0..68c7591f2b5f 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -56,6 +56,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_300)
+ #define STACK_SLOT_DAWR (SFS-56)
+ #define STACK_SLOT_DAWRX (SFS-64)
+ #define STACK_SLOT_HFSCR (SFS-72)
++#define STACK_SLOT_AMR (SFS-80)
++#define STACK_SLOT_UAMOR (SFS-88)
+
+ /*
+ * Call kvmppc_hv_entry in real mode.
+@@ -760,11 +762,9 @@ BEGIN_FTR_SECTION
+ mfspr r5, SPRN_TIDR
+ mfspr r6, SPRN_PSSCR
+ mfspr r7, SPRN_PID
+- mfspr r8, SPRN_IAMR
+ std r5, STACK_SLOT_TID(r1)
+ std r6, STACK_SLOT_PSSCR(r1)
+ std r7, STACK_SLOT_PID(r1)
+- std r8, STACK_SLOT_IAMR(r1)
+ mfspr r5, SPRN_HFSCR
+ std r5, STACK_SLOT_HFSCR(r1)
+ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+@@ -772,11 +772,18 @@ BEGIN_FTR_SECTION
+ mfspr r5, SPRN_CIABR
+ mfspr r6, SPRN_DAWR
+ mfspr r7, SPRN_DAWRX
++ mfspr r8, SPRN_IAMR
+ std r5, STACK_SLOT_CIABR(r1)
+ std r6, STACK_SLOT_DAWR(r1)
+ std r7, STACK_SLOT_DAWRX(r1)
++ std r8, STACK_SLOT_IAMR(r1)
+ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+
++ mfspr r5, SPRN_AMR
++ std r5, STACK_SLOT_AMR(r1)
++ mfspr r6, SPRN_UAMOR
++ std r6, STACK_SLOT_UAMOR(r1)
++
+ BEGIN_FTR_SECTION
+ /* Set partition DABR */
+ /* Do this before re-enabling PMU to avoid P7 DABR corruption bug */
+@@ -1202,7 +1209,7 @@ BEGIN_FTR_SECTION
+ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
+
+ ld r5, VCPU_LR(r4)
+- lwz r6, VCPU_CR(r4)
++ ld r6, VCPU_CR(r4)
+ mtlr r5
+ mtcr r6
+
+@@ -1313,7 +1320,7 @@ kvmppc_interrupt_hv:
+ std r3, VCPU_GPR(R12)(r9)
+ /* CR is in the high half of r12 */
+ srdi r4, r12, 32
+- stw r4, VCPU_CR(r9)
++ std r4, VCPU_CR(r9)
+ BEGIN_FTR_SECTION
+ ld r3, HSTATE_CFAR(r13)
+ std r3, VCPU_CFAR(r9)
+@@ -1713,22 +1720,25 @@ ALT_FTR_SECTION_END_IFCLR(CPU_FTR_ARCH_300)
+ mtspr SPRN_PSPB, r0
+ mtspr SPRN_WORT, r0
+ BEGIN_FTR_SECTION
+- mtspr SPRN_IAMR, r0
+ mtspr SPRN_TCSCR, r0
+ /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */
+ li r0, 1
+ sldi r0, r0, 31
+ mtspr SPRN_MMCRS, r0
+ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_300)
+-8:
+
+- /* Save and reset AMR and UAMOR before turning on the MMU */
++ /* Save and restore AMR, IAMR and UAMOR before turning on the MMU */
++ ld r8, STACK_SLOT_IAMR(r1)
++ mtspr SPRN_IAMR, r8
++
++8: /* Power7 jumps back in here */
+ mfspr r5,SPRN_AMR
+ mfspr r6,SPRN_UAMOR
+ std r5,VCPU_AMR(r9)
+ std r6,VCPU_UAMOR(r9)
+- li r6,0
+- mtspr SPRN_AMR,r6
++ ld r5,STACK_SLOT_AMR(r1)
++ ld r6,STACK_SLOT_UAMOR(r1)
++ mtspr SPRN_AMR, r5
+ mtspr SPRN_UAMOR, r6
+
+ /* Switch DSCR back to host value */
+@@ -1897,11 +1907,9 @@ BEGIN_FTR_SECTION
+ ld r5, STACK_SLOT_TID(r1)
+ ld r6, STACK_SLOT_PSSCR(r1)
+ ld r7, STACK_SLOT_PID(r1)
+- ld r8, STACK_SLOT_IAMR(r1)
+ mtspr SPRN_TIDR, r5
+ mtspr SPRN_PSSCR, r6
+ mtspr SPRN_PID, r7
+- mtspr SPRN_IAMR, r8
+ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+
+ #ifdef CONFIG_PPC_RADIX_MMU
+diff --git a/arch/powerpc/kvm/book3s_hv_tm.c b/arch/powerpc/kvm/book3s_hv_tm.c
+index 008285058f9b..31cd0f327c8a 100644
+--- a/arch/powerpc/kvm/book3s_hv_tm.c
++++ b/arch/powerpc/kvm/book3s_hv_tm.c
+@@ -130,8 +130,8 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ return RESUME_GUEST;
+ }
+ /* Set CR0 to indicate previous transactional state */
+- vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) |
+- (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) |
++ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 29);
+ /* L=1 => tresume, L=0 => tsuspend */
+ if (instr & (1 << 21)) {
+ if (MSR_TM_SUSPENDED(msr))
+@@ -174,8 +174,8 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ copy_from_checkpoint(vcpu);
+
+ /* Set CR0 to indicate previous transactional state */
+- vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) |
+- (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) |
++ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 29);
+ vcpu->arch.shregs.msr &= ~MSR_TS_MASK;
+ return RESUME_GUEST;
+
+@@ -204,8 +204,8 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ copy_to_checkpoint(vcpu);
+
+ /* Set CR0 to indicate previous transactional state */
+- vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) |
+- (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) |
++ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 29);
+ vcpu->arch.shregs.msr = msr | MSR_TS_S;
+ return RESUME_GUEST;
+ }
+diff --git a/arch/powerpc/kvm/book3s_hv_tm_builtin.c b/arch/powerpc/kvm/book3s_hv_tm_builtin.c
+index b2c7c6fca4f9..3cf5863bc06e 100644
+--- a/arch/powerpc/kvm/book3s_hv_tm_builtin.c
++++ b/arch/powerpc/kvm/book3s_hv_tm_builtin.c
+@@ -89,7 +89,8 @@ int kvmhv_p9_tm_emulation_early(struct kvm_vcpu *vcpu)
+ if (instr & (1 << 21))
+ vcpu->arch.shregs.msr = (msr & ~MSR_TS_MASK) | MSR_TS_T;
+ /* Set CR0 to 0b0010 */
+- vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) | 0x20000000;
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) |
++ 0x20000000;
+ return 1;
+ }
+
+@@ -105,5 +106,5 @@ void kvmhv_emulate_tm_rollback(struct kvm_vcpu *vcpu)
+ vcpu->arch.shregs.msr &= ~MSR_TS_MASK; /* go to N state */
+ vcpu->arch.regs.nip = vcpu->arch.tfhar;
+ copy_from_checkpoint(vcpu);
+- vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) | 0xa0000000;
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) | 0xa0000000;
+ }
+diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c
+index 614ebb4261f7..de9702219dee 100644
+--- a/arch/powerpc/kvm/book3s_pr.c
++++ b/arch/powerpc/kvm/book3s_pr.c
+@@ -167,7 +167,7 @@ void kvmppc_copy_to_svcpu(struct kvm_vcpu *vcpu)
+ svcpu->gpr[11] = vcpu->arch.regs.gpr[11];
+ svcpu->gpr[12] = vcpu->arch.regs.gpr[12];
+ svcpu->gpr[13] = vcpu->arch.regs.gpr[13];
+- svcpu->cr = vcpu->arch.cr;
++ svcpu->cr = vcpu->arch.regs.ccr;
+ svcpu->xer = vcpu->arch.regs.xer;
+ svcpu->ctr = vcpu->arch.regs.ctr;
+ svcpu->lr = vcpu->arch.regs.link;
+@@ -249,7 +249,7 @@ void kvmppc_copy_from_svcpu(struct kvm_vcpu *vcpu)
+ vcpu->arch.regs.gpr[11] = svcpu->gpr[11];
+ vcpu->arch.regs.gpr[12] = svcpu->gpr[12];
+ vcpu->arch.regs.gpr[13] = svcpu->gpr[13];
+- vcpu->arch.cr = svcpu->cr;
++ vcpu->arch.regs.ccr = svcpu->cr;
+ vcpu->arch.regs.xer = svcpu->xer;
+ vcpu->arch.regs.ctr = svcpu->ctr;
+ vcpu->arch.regs.link = svcpu->lr;
+diff --git a/arch/powerpc/kvm/bookehv_interrupts.S b/arch/powerpc/kvm/bookehv_interrupts.S
+index 612b7f6a887f..4e5081e58409 100644
+--- a/arch/powerpc/kvm/bookehv_interrupts.S
++++ b/arch/powerpc/kvm/bookehv_interrupts.S
+@@ -186,7 +186,7 @@ END_BTB_FLUSH_SECTION
+ */
+ PPC_LL r4, PACACURRENT(r13)
+ PPC_LL r4, (THREAD + THREAD_KVM_VCPU)(r4)
+- stw r10, VCPU_CR(r4)
++ PPC_STL r10, VCPU_CR(r4)
+ PPC_STL r11, VCPU_GPR(R4)(r4)
+ PPC_STL r5, VCPU_GPR(R5)(r4)
+ PPC_STL r6, VCPU_GPR(R6)(r4)
+@@ -296,7 +296,7 @@ _GLOBAL(kvmppc_handler_\intno\()_\srr1)
+ PPC_STL r4, VCPU_GPR(R4)(r11)
+ PPC_LL r4, THREAD_NORMSAVE(0)(r10)
+ PPC_STL r5, VCPU_GPR(R5)(r11)
+- stw r13, VCPU_CR(r11)
++ PPC_STL r13, VCPU_CR(r11)
+ mfspr r5, \srr0
+ PPC_STL r3, VCPU_GPR(R10)(r11)
+ PPC_LL r3, THREAD_NORMSAVE(2)(r10)
+@@ -323,7 +323,7 @@ _GLOBAL(kvmppc_handler_\intno\()_\srr1)
+ PPC_STL r4, VCPU_GPR(R4)(r11)
+ PPC_LL r4, GPR9(r8)
+ PPC_STL r5, VCPU_GPR(R5)(r11)
+- stw r9, VCPU_CR(r11)
++ PPC_STL r9, VCPU_CR(r11)
+ mfspr r5, \srr0
+ PPC_STL r3, VCPU_GPR(R8)(r11)
+ PPC_LL r3, GPR10(r8)
+@@ -647,7 +647,7 @@ lightweight_exit:
+ PPC_LL r3, VCPU_LR(r4)
+ PPC_LL r5, VCPU_XER(r4)
+ PPC_LL r6, VCPU_CTR(r4)
+- lwz r7, VCPU_CR(r4)
++ PPC_LL r7, VCPU_CR(r4)
+ PPC_LL r8, VCPU_PC(r4)
+ PPC_LD(r9, VCPU_SHARED_MSR, r11)
+ PPC_LL r0, VCPU_GPR(R0)(r4)
+diff --git a/arch/powerpc/kvm/emulate_loadstore.c b/arch/powerpc/kvm/emulate_loadstore.c
+index 75dce1ef3bc8..f91b1309a0a8 100644
+--- a/arch/powerpc/kvm/emulate_loadstore.c
++++ b/arch/powerpc/kvm/emulate_loadstore.c
+@@ -117,7 +117,6 @@ int kvmppc_emulate_loadstore(struct kvm_vcpu *vcpu)
+
+ emulated = EMULATE_FAIL;
+ vcpu->arch.regs.msr = vcpu->arch.shared->msr;
+- vcpu->arch.regs.ccr = vcpu->arch.cr;
+ if (analyse_instr(&op, &vcpu->arch.regs, inst) == 0) {
+ int type = op.type & INSTR_TYPE_MASK;
+ int size = GETSIZE(op.type);
+diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
+index f23a89d8e4ce..29fd8940867e 100644
+--- a/arch/powerpc/mm/hash_utils_64.c
++++ b/arch/powerpc/mm/hash_utils_64.c
+@@ -1859,11 +1859,20 @@ void hash__setup_initial_memory_limit(phys_addr_t first_memblock_base,
+ *
+ * For guests on platforms before POWER9, we clamp the it limit to 1G
+ * to avoid some funky things such as RTAS bugs etc...
++ *
++ * On POWER9 we limit to 1TB in case the host erroneously told us that
++ * the RMA was >1TB. Effective address bits 0:23 are treated as zero
++ * (meaning the access is aliased to zero i.e. addr = addr % 1TB)
++ * for virtual real mode addressing and so it doesn't make sense to
++ * have an area larger than 1TB as it can't be addressed.
+ */
+ if (!early_cpu_has_feature(CPU_FTR_HVMODE)) {
+ ppc64_rma_size = first_memblock_size;
+ if (!early_cpu_has_feature(CPU_FTR_ARCH_300))
+ ppc64_rma_size = min_t(u64, ppc64_rma_size, 0x40000000);
++ else
++ ppc64_rma_size = min_t(u64, ppc64_rma_size,
++ 1UL << SID_SHIFT_1T);
+
+ /* Finally limit subsequent allocations */
+ memblock_set_current_limit(ppc64_rma_size);
+diff --git a/arch/powerpc/mm/pkeys.c b/arch/powerpc/mm/pkeys.c
+index b271b283c785..25a8dd9cd71d 100644
+--- a/arch/powerpc/mm/pkeys.c
++++ b/arch/powerpc/mm/pkeys.c
+@@ -414,3 +414,13 @@ bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,
+
+ return pkey_access_permitted(vma_pkey(vma), write, execute);
+ }
++
++void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm)
++{
++ if (static_branch_likely(&pkey_disabled))
++ return;
++
++ /* Duplicate the oldmm pkey state in mm: */
++ mm_pkey_allocation_map(mm) = mm_pkey_allocation_map(oldmm);
++ mm->context.execute_only_pkey = oldmm->context.execute_only_pkey;
++}
+diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c
+index c433f6d3dd64..a840b7d074f7 100644
+--- a/arch/riscv/kernel/ftrace.c
++++ b/arch/riscv/kernel/ftrace.c
+@@ -132,7 +132,6 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+ {
+ unsigned long return_hooker = (unsigned long)&return_to_handler;
+ unsigned long old;
+- int err;
+
+ if (unlikely(atomic_read(¤t->tracing_graph_pause)))
+ return;
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 3245b95ad2d9..0d3f5cf3ff3e 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -117,7 +117,7 @@ static inline gfn_t gfn_to_index(gfn_t gfn, gfn_t base_gfn, int level)
+ }
+
+ #define KVM_PERMILLE_MMU_PAGES 20
+-#define KVM_MIN_ALLOC_MMU_PAGES 64
++#define KVM_MIN_ALLOC_MMU_PAGES 64UL
+ #define KVM_MMU_HASH_SHIFT 12
+ #define KVM_NUM_MMU_PAGES (1 << KVM_MMU_HASH_SHIFT)
+ #define KVM_MIN_FREE_MMU_PAGES 5
+@@ -784,6 +784,9 @@ struct kvm_hv {
+ u64 hv_reenlightenment_control;
+ u64 hv_tsc_emulation_control;
+ u64 hv_tsc_emulation_status;
++
++ /* How many vCPUs have VP index != vCPU index */
++ atomic_t num_mismatched_vp_indexes;
+ };
+
+ enum kvm_irqchip_mode {
+@@ -793,9 +796,9 @@ enum kvm_irqchip_mode {
+ };
+
+ struct kvm_arch {
+- unsigned int n_used_mmu_pages;
+- unsigned int n_requested_mmu_pages;
+- unsigned int n_max_mmu_pages;
++ unsigned long n_used_mmu_pages;
++ unsigned long n_requested_mmu_pages;
++ unsigned long n_max_mmu_pages;
+ unsigned int indirect_shadow_pages;
+ unsigned long mmu_valid_gen;
+ struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
+@@ -1198,8 +1201,8 @@ void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm,
+ gfn_t gfn_offset, unsigned long mask);
+ void kvm_mmu_zap_all(struct kvm *kvm);
+ void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen);
+-unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm);
+-void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages);
++unsigned long kvm_mmu_calculate_mmu_pages(struct kvm *kvm);
++void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned long kvm_nr_mmu_pages);
+
+ int load_pdptrs(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, unsigned long cr3);
+ bool pdptrs_changed(struct kvm_vcpu *vcpu);
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index 50d309662d78..5790671857e5 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -53,7 +53,7 @@ int ftrace_arch_code_modify_post_process(void)
+ union ftrace_code_union {
+ char code[MCOUNT_INSN_SIZE];
+ struct {
+- unsigned char e8;
++ unsigned char op;
+ int offset;
+ } __attribute__((packed));
+ };
+@@ -63,20 +63,23 @@ static int ftrace_calc_offset(long ip, long addr)
+ return (int)(addr - ip);
+ }
+
+-static unsigned char *ftrace_call_replace(unsigned long ip, unsigned long addr)
++static unsigned char *
++ftrace_text_replace(unsigned char op, unsigned long ip, unsigned long addr)
+ {
+ static union ftrace_code_union calc;
+
+- calc.e8 = 0xe8;
++ calc.op = op;
+ calc.offset = ftrace_calc_offset(ip + MCOUNT_INSN_SIZE, addr);
+
+- /*
+- * No locking needed, this must be called via kstop_machine
+- * which in essence is like running on a uniprocessor machine.
+- */
+ return calc.code;
+ }
+
++static unsigned char *
++ftrace_call_replace(unsigned long ip, unsigned long addr)
++{
++ return ftrace_text_replace(0xe8, ip, addr);
++}
++
+ static inline int
+ within(unsigned long addr, unsigned long start, unsigned long end)
+ {
+@@ -686,22 +689,6 @@ int __init ftrace_dyn_arch_init(void)
+ return 0;
+ }
+
+-#if defined(CONFIG_X86_64) || defined(CONFIG_FUNCTION_GRAPH_TRACER)
+-static unsigned char *ftrace_jmp_replace(unsigned long ip, unsigned long addr)
+-{
+- static union ftrace_code_union calc;
+-
+- /* Jmp not a call (ignore the .e8) */
+- calc.e8 = 0xe9;
+- calc.offset = ftrace_calc_offset(ip + MCOUNT_INSN_SIZE, addr);
+-
+- /*
+- * ftrace external locks synchronize the access to the static variable.
+- */
+- return calc.code;
+-}
+-#endif
+-
+ /* Currently only x86_64 supports dynamic trampolines */
+ #ifdef CONFIG_X86_64
+
+@@ -923,8 +910,8 @@ static void *addr_from_call(void *ptr)
+ return NULL;
+
+ /* Make sure this is a call */
+- if (WARN_ON_ONCE(calc.e8 != 0xe8)) {
+- pr_warn("Expected e8, got %x\n", calc.e8);
++ if (WARN_ON_ONCE(calc.op != 0xe8)) {
++ pr_warn("Expected e8, got %x\n", calc.op);
+ return NULL;
+ }
+
+@@ -995,6 +982,11 @@ void arch_ftrace_trampoline_free(struct ftrace_ops *ops)
+ #ifdef CONFIG_DYNAMIC_FTRACE
+ extern void ftrace_graph_call(void);
+
++static unsigned char *ftrace_jmp_replace(unsigned long ip, unsigned long addr)
++{
++ return ftrace_text_replace(0xe9, ip, addr);
++}
++
+ static int ftrace_mod_jmp(unsigned long ip, void *func)
+ {
+ unsigned char *new;
+diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
+index 013fe3d21dbb..2ec202cb9dfd 100644
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -117,12 +117,8 @@ static u64 kvm_sched_clock_read(void)
+
+ static inline void kvm_sched_clock_init(bool stable)
+ {
+- if (!stable) {
+- pv_time_ops.sched_clock = kvm_clock_read;
++ if (!stable)
+ clear_sched_clock_stable();
+- return;
+- }
+-
+ kvm_sched_clock_offset = kvm_clock_read();
+ pv_time_ops.sched_clock = kvm_sched_clock_read;
+
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
+index b4866badb235..90ecc108bc8a 100644
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -1251,7 +1251,7 @@ void __init setup_arch(char **cmdline_p)
+ x86_init.hyper.guest_late_init();
+
+ e820__reserve_resources();
+- e820__register_nosave_regions(max_low_pfn);
++ e820__register_nosave_regions(max_pfn);
+
+ x86_init.resources.reserve_resources();
+
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 4a688ef9e448..429728b35bca 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -2331,12 +2331,16 @@ static int em_lseg(struct x86_emulate_ctxt *ctxt)
+
+ static int emulator_has_longmode(struct x86_emulate_ctxt *ctxt)
+ {
++#ifdef CONFIG_X86_64
+ u32 eax, ebx, ecx, edx;
+
+ eax = 0x80000001;
+ ecx = 0;
+ ctxt->ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx, false);
+ return edx & bit(X86_FEATURE_LM);
++#else
++ return false;
++#endif
+ }
+
+ #define GET_SMSTATE(type, smbase, offset) \
+@@ -2381,6 +2385,7 @@ static int rsm_load_seg_32(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
+ return X86EMUL_CONTINUE;
+ }
+
++#ifdef CONFIG_X86_64
+ static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
+ {
+ struct desc_struct desc;
+@@ -2399,6 +2404,7 @@ static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
+ ctxt->ops->set_segment(ctxt, selector, &desc, base3, n);
+ return X86EMUL_CONTINUE;
+ }
++#endif
+
+ static int rsm_enter_protected_mode(struct x86_emulate_ctxt *ctxt,
+ u64 cr0, u64 cr3, u64 cr4)
+@@ -2499,6 +2505,7 @@ static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt, u64 smbase)
+ return rsm_enter_protected_mode(ctxt, cr0, cr3, cr4);
+ }
+
++#ifdef CONFIG_X86_64
+ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
+ {
+ struct desc_struct desc;
+@@ -2560,6 +2567,7 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
+
+ return X86EMUL_CONTINUE;
+ }
++#endif
+
+ static int em_rsm(struct x86_emulate_ctxt *ctxt)
+ {
+@@ -2616,9 +2624,11 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt)
+ if (ctxt->ops->pre_leave_smm(ctxt, smbase))
+ return X86EMUL_UNHANDLEABLE;
+
++#ifdef CONFIG_X86_64
+ if (emulator_has_longmode(ctxt))
+ ret = rsm_load_state_64(ctxt, smbase + 0x8000);
+ else
++#endif
+ ret = rsm_load_state_32(ctxt, smbase + 0x8000);
+
+ if (ret != X86EMUL_CONTINUE) {
+diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
+index 229d99605165..5842c5f587fe 100644
+--- a/arch/x86/kvm/hyperv.c
++++ b/arch/x86/kvm/hyperv.c
+@@ -132,8 +132,10 @@ static struct kvm_vcpu *get_vcpu_by_vpidx(struct kvm *kvm, u32 vpidx)
+ struct kvm_vcpu *vcpu = NULL;
+ int i;
+
+- if (vpidx < KVM_MAX_VCPUS)
+- vcpu = kvm_get_vcpu(kvm, vpidx);
++ if (vpidx >= KVM_MAX_VCPUS)
++ return NULL;
++
++ vcpu = kvm_get_vcpu(kvm, vpidx);
+ if (vcpu && vcpu_to_hv_vcpu(vcpu)->vp_index == vpidx)
+ return vcpu;
+ kvm_for_each_vcpu(i, vcpu, kvm)
+@@ -689,6 +691,24 @@ void kvm_hv_vcpu_uninit(struct kvm_vcpu *vcpu)
+ stimer_cleanup(&hv_vcpu->stimer[i]);
+ }
+
++bool kvm_hv_assist_page_enabled(struct kvm_vcpu *vcpu)
++{
++ if (!(vcpu->arch.hyperv.hv_vapic & HV_X64_MSR_VP_ASSIST_PAGE_ENABLE))
++ return false;
++ return vcpu->arch.pv_eoi.msr_val & KVM_MSR_ENABLED;
++}
++EXPORT_SYMBOL_GPL(kvm_hv_assist_page_enabled);
++
++bool kvm_hv_get_assist_page(struct kvm_vcpu *vcpu,
++ struct hv_vp_assist_page *assist_page)
++{
++ if (!kvm_hv_assist_page_enabled(vcpu))
++ return false;
++ return !kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.pv_eoi.data,
++ assist_page, sizeof(*assist_page));
++}
++EXPORT_SYMBOL_GPL(kvm_hv_get_assist_page);
++
+ static void stimer_prepare_msg(struct kvm_vcpu_hv_stimer *stimer)
+ {
+ struct hv_message *msg = &stimer->msg;
+@@ -1040,21 +1060,41 @@ static u64 current_task_runtime_100ns(void)
+
+ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)
+ {
+- struct kvm_vcpu_hv *hv = &vcpu->arch.hyperv;
++ struct kvm_vcpu_hv *hv_vcpu = &vcpu->arch.hyperv;
+
+ switch (msr) {
+- case HV_X64_MSR_VP_INDEX:
+- if (!host)
++ case HV_X64_MSR_VP_INDEX: {
++ struct kvm_hv *hv = &vcpu->kvm->arch.hyperv;
++ int vcpu_idx = kvm_vcpu_get_idx(vcpu);
++ u32 new_vp_index = (u32)data;
++
++ if (!host || new_vp_index >= KVM_MAX_VCPUS)
+ return 1;
+- hv->vp_index = (u32)data;
++
++ if (new_vp_index == hv_vcpu->vp_index)
++ return 0;
++
++ /*
++ * The VP index is initialized to vcpu_index by
++ * kvm_hv_vcpu_postcreate so they initially match. Now the
++ * VP index is changing, adjust num_mismatched_vp_indexes if
++ * it now matches or no longer matches vcpu_idx.
++ */
++ if (hv_vcpu->vp_index == vcpu_idx)
++ atomic_inc(&hv->num_mismatched_vp_indexes);
++ else if (new_vp_index == vcpu_idx)
++ atomic_dec(&hv->num_mismatched_vp_indexes);
++
++ hv_vcpu->vp_index = new_vp_index;
+ break;
++ }
+ case HV_X64_MSR_VP_ASSIST_PAGE: {
+ u64 gfn;
+ unsigned long addr;
+
+ if (!(data & HV_X64_MSR_VP_ASSIST_PAGE_ENABLE)) {
+- hv->hv_vapic = data;
+- if (kvm_lapic_enable_pv_eoi(vcpu, 0))
++ hv_vcpu->hv_vapic = data;
++ if (kvm_lapic_enable_pv_eoi(vcpu, 0, 0))
+ return 1;
+ break;
+ }
+@@ -1064,10 +1104,11 @@ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)
+ return 1;
+ if (__clear_user((void __user *)addr, PAGE_SIZE))
+ return 1;
+- hv->hv_vapic = data;
++ hv_vcpu->hv_vapic = data;
+ kvm_vcpu_mark_page_dirty(vcpu, gfn);
+ if (kvm_lapic_enable_pv_eoi(vcpu,
+- gfn_to_gpa(gfn) | KVM_MSR_ENABLED))
++ gfn_to_gpa(gfn) | KVM_MSR_ENABLED,
++ sizeof(struct hv_vp_assist_page)))
+ return 1;
+ break;
+ }
+@@ -1080,7 +1121,7 @@ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)
+ case HV_X64_MSR_VP_RUNTIME:
+ if (!host)
+ return 1;
+- hv->runtime_offset = data - current_task_runtime_100ns();
++ hv_vcpu->runtime_offset = data - current_task_runtime_100ns();
+ break;
+ case HV_X64_MSR_SCONTROL:
+ case HV_X64_MSR_SVERSION:
+@@ -1172,11 +1213,11 @@ static int kvm_hv_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata,
+ bool host)
+ {
+ u64 data = 0;
+- struct kvm_vcpu_hv *hv = &vcpu->arch.hyperv;
++ struct kvm_vcpu_hv *hv_vcpu = &vcpu->arch.hyperv;
+
+ switch (msr) {
+ case HV_X64_MSR_VP_INDEX:
+- data = hv->vp_index;
++ data = hv_vcpu->vp_index;
+ break;
+ case HV_X64_MSR_EOI:
+ return kvm_hv_vapic_msr_read(vcpu, APIC_EOI, pdata);
+@@ -1185,10 +1226,10 @@ static int kvm_hv_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata,
+ case HV_X64_MSR_TPR:
+ return kvm_hv_vapic_msr_read(vcpu, APIC_TASKPRI, pdata);
+ case HV_X64_MSR_VP_ASSIST_PAGE:
+- data = hv->hv_vapic;
++ data = hv_vcpu->hv_vapic;
+ break;
+ case HV_X64_MSR_VP_RUNTIME:
+- data = current_task_runtime_100ns() + hv->runtime_offset;
++ data = current_task_runtime_100ns() + hv_vcpu->runtime_offset;
+ break;
+ case HV_X64_MSR_SCONTROL:
+ case HV_X64_MSR_SVERSION:
+diff --git a/arch/x86/kvm/hyperv.h b/arch/x86/kvm/hyperv.h
+index d6aa969e20f1..0e66c12ed2c3 100644
+--- a/arch/x86/kvm/hyperv.h
++++ b/arch/x86/kvm/hyperv.h
+@@ -62,6 +62,10 @@ void kvm_hv_vcpu_init(struct kvm_vcpu *vcpu);
+ void kvm_hv_vcpu_postcreate(struct kvm_vcpu *vcpu);
+ void kvm_hv_vcpu_uninit(struct kvm_vcpu *vcpu);
+
++bool kvm_hv_assist_page_enabled(struct kvm_vcpu *vcpu);
++bool kvm_hv_get_assist_page(struct kvm_vcpu *vcpu,
++ struct hv_vp_assist_page *assist_page);
++
+ static inline struct kvm_vcpu_hv_stimer *vcpu_to_stimer(struct kvm_vcpu *vcpu,
+ int timer_index)
+ {
+diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
+index faa264822cee..007bc654f928 100644
+--- a/arch/x86/kvm/irq.c
++++ b/arch/x86/kvm/irq.c
+@@ -172,3 +172,10 @@ void __kvm_migrate_timers(struct kvm_vcpu *vcpu)
+ __kvm_migrate_apic_timer(vcpu);
+ __kvm_migrate_pit_timer(vcpu);
+ }
++
++bool kvm_arch_irqfd_allowed(struct kvm *kvm, struct kvm_irqfd *args)
++{
++ bool resample = args->flags & KVM_IRQFD_FLAG_RESAMPLE;
++
++ return resample ? irqchip_kernel(kvm) : irqchip_in_kernel(kvm);
++}
+diff --git a/arch/x86/kvm/irq.h b/arch/x86/kvm/irq.h
+index d5005cc26521..fd210cdd4983 100644
+--- a/arch/x86/kvm/irq.h
++++ b/arch/x86/kvm/irq.h
+@@ -114,6 +114,7 @@ static inline int irqchip_in_kernel(struct kvm *kvm)
+ return mode != KVM_IRQCHIP_NONE;
+ }
+
++bool kvm_arch_irqfd_allowed(struct kvm *kvm, struct kvm_irqfd *args);
+ void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu);
+ void kvm_inject_apic_timer_irqs(struct kvm_vcpu *vcpu);
+ void kvm_apic_nmi_wd_deliver(struct kvm_vcpu *vcpu);
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 5f5bc5976804..262e49301cae 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2633,17 +2633,25 @@ int kvm_hv_vapic_msr_read(struct kvm_vcpu *vcpu, u32 reg, u64 *data)
+ return 0;
+ }
+
+-int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data)
++int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data, unsigned long len)
+ {
+ u64 addr = data & ~KVM_MSR_ENABLED;
++ struct gfn_to_hva_cache *ghc = &vcpu->arch.pv_eoi.data;
++ unsigned long new_len;
++
+ if (!IS_ALIGNED(addr, 4))
+ return 1;
+
+ vcpu->arch.pv_eoi.msr_val = data;
+ if (!pv_eoi_enabled(vcpu))
+ return 0;
+- return kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.pv_eoi.data,
+- addr, sizeof(u8));
++
++ if (addr == ghc->gpa && len <= ghc->len)
++ new_len = ghc->len;
++ else
++ new_len = len;
++
++ return kvm_gfn_to_hva_cache_init(vcpu->kvm, ghc, addr, new_len);
+ }
+
+ void kvm_apic_accept_events(struct kvm_vcpu *vcpu)
+diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
+index ed0ed39abd36..ff6ef9c3d760 100644
+--- a/arch/x86/kvm/lapic.h
++++ b/arch/x86/kvm/lapic.h
+@@ -120,7 +120,7 @@ static inline bool kvm_hv_vapic_assist_page_enabled(struct kvm_vcpu *vcpu)
+ return vcpu->arch.hyperv.hv_vapic & HV_X64_MSR_VP_ASSIST_PAGE_ENABLE;
+ }
+
+-int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data);
++int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data, unsigned long len);
+ void kvm_lapic_init(void);
+ void kvm_lapic_exit(void);
+
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index cdc0c460950f..88940261fb53 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -1954,7 +1954,7 @@ static int is_empty_shadow_page(u64 *spt)
+ * aggregate version in order to make the slab shrinker
+ * faster
+ */
+-static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, int nr)
++static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, unsigned long nr)
+ {
+ kvm->arch.n_used_mmu_pages += nr;
+ percpu_counter_add(&kvm_total_used_mmu_pages, nr);
+@@ -2704,7 +2704,7 @@ static bool prepare_zap_oldest_mmu_page(struct kvm *kvm,
+ * Changing the number of mmu pages allocated to the vm
+ * Note: if goal_nr_mmu_pages is too small, you will get dead lock
+ */
+-void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int goal_nr_mmu_pages)
++void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned long goal_nr_mmu_pages)
+ {
+ LIST_HEAD(invalid_list);
+
+@@ -5926,10 +5926,10 @@ out:
+ /*
+ * Caculate mmu pages needed for kvm.
+ */
+-unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm)
++unsigned long kvm_mmu_calculate_mmu_pages(struct kvm *kvm)
+ {
+- unsigned int nr_mmu_pages;
+- unsigned int nr_pages = 0;
++ unsigned long nr_mmu_pages;
++ unsigned long nr_pages = 0;
+ struct kvm_memslots *slots;
+ struct kvm_memory_slot *memslot;
+ int i;
+@@ -5942,8 +5942,7 @@ unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm)
+ }
+
+ nr_mmu_pages = nr_pages * KVM_PERMILLE_MMU_PAGES / 1000;
+- nr_mmu_pages = max(nr_mmu_pages,
+- (unsigned int) KVM_MIN_ALLOC_MMU_PAGES);
++ nr_mmu_pages = max(nr_mmu_pages, KVM_MIN_ALLOC_MMU_PAGES);
+
+ return nr_mmu_pages;
+ }
+diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
+index 1fab69c0b2f3..65892288bf51 100644
+--- a/arch/x86/kvm/mmu.h
++++ b/arch/x86/kvm/mmu.h
+@@ -69,7 +69,7 @@ bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu);
+ int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code,
+ u64 fault_address, char *insn, int insn_len);
+
+-static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
++static inline unsigned long kvm_mmu_available_pages(struct kvm *kvm)
+ {
+ if (kvm->arch.n_max_mmu_pages > kvm->arch.n_used_mmu_pages)
+ return kvm->arch.n_max_mmu_pages -
+diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c
+index e9ea2d45ae66..9f72cc427158 100644
+--- a/arch/x86/kvm/mtrr.c
++++ b/arch/x86/kvm/mtrr.c
+@@ -48,11 +48,6 @@ static bool msr_mtrr_valid(unsigned msr)
+ return false;
+ }
+
+-static bool valid_pat_type(unsigned t)
+-{
+- return t < 8 && (1 << t) & 0xf3; /* 0, 1, 4, 5, 6, 7 */
+-}
+-
+ static bool valid_mtrr_type(unsigned t)
+ {
+ return t < 8 && (1 << t) & 0x73; /* 0, 1, 4, 5, 6 */
+@@ -67,10 +62,7 @@ bool kvm_mtrr_valid(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+ return false;
+
+ if (msr == MSR_IA32_CR_PAT) {
+- for (i = 0; i < 8; i++)
+- if (!valid_pat_type((data >> (i * 8)) & 0xff))
+- return false;
+- return true;
++ return kvm_pat_valid(data);
+ } else if (msr == MSR_MTRRdefType) {
+ if (data & ~0xcff)
+ return false;
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 0f33f00aa4df..ac2cc2ed7a85 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -5622,6 +5622,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
+ svm->vmcb->save.cr2 = vcpu->arch.cr2;
+
+ clgi();
++ kvm_load_guest_xcr0(vcpu);
+
+ /*
+ * If this vCPU has touched SPEC_CTRL, restore the guest's value if
+@@ -5769,6 +5770,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
+ if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
+ kvm_before_interrupt(&svm->vcpu);
+
++ kvm_put_guest_xcr0(vcpu);
+ stgi();
+
+ /* Any pending NMI will happen here */
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 2e310ea62d60..2938b4bcc968 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -4135,7 +4135,10 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ return vmx_get_vmx_msr(&vmx->nested.msrs, msr_info->index,
+ &msr_info->data);
+ case MSR_IA32_XSS:
+- if (!vmx_xsaves_supported())
++ if (!vmx_xsaves_supported() ||
++ (!msr_info->host_initiated &&
++ !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))))
+ return 1;
+ msr_info->data = vcpu->arch.ia32_xss;
+ break;
+@@ -4265,9 +4268,10 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ MSR_TYPE_W);
+ break;
+ case MSR_IA32_CR_PAT:
++ if (!kvm_pat_valid(data))
++ return 1;
++
+ if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
+- if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
+- return 1;
+ vmcs_write64(GUEST_IA32_PAT, data);
+ vcpu->arch.pat = data;
+ break;
+@@ -4301,7 +4305,10 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ return 1;
+ return vmx_set_vmx_msr(vcpu, msr_index, data);
+ case MSR_IA32_XSS:
+- if (!vmx_xsaves_supported())
++ if (!vmx_xsaves_supported() ||
++ (!msr_info->host_initiated &&
++ !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))))
+ return 1;
+ /*
+ * The only supported bit as of Skylake is bit 8, but
+@@ -10437,28 +10444,21 @@ static void vmx_apicv_post_state_restore(struct kvm_vcpu *vcpu)
+
+ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
+ {
+- u32 exit_intr_info = 0;
+- u16 basic_exit_reason = (u16)vmx->exit_reason;
+-
+- if (!(basic_exit_reason == EXIT_REASON_MCE_DURING_VMENTRY
+- || basic_exit_reason == EXIT_REASON_EXCEPTION_NMI))
++ if (vmx->exit_reason != EXIT_REASON_EXCEPTION_NMI)
+ return;
+
+- if (!(vmx->exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY))
+- exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+- vmx->exit_intr_info = exit_intr_info;
++ vmx->exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+
+ /* if exit due to PF check for async PF */
+- if (is_page_fault(exit_intr_info))
++ if (is_page_fault(vmx->exit_intr_info))
+ vmx->vcpu.arch.apf.host_apf_reason = kvm_read_and_reset_pf_reason();
+
+ /* Handle machine checks before interrupts are enabled */
+- if (basic_exit_reason == EXIT_REASON_MCE_DURING_VMENTRY ||
+- is_machine_check(exit_intr_info))
++ if (is_machine_check(vmx->exit_intr_info))
+ kvm_machine_check();
+
+ /* We need to handle NMIs before interrupts are enabled */
+- if (is_nmi(exit_intr_info)) {
++ if (is_nmi(vmx->exit_intr_info)) {
+ kvm_before_interrupt(&vmx->vcpu);
+ asm("int $2");
+ kvm_after_interrupt(&vmx->vcpu);
+@@ -10756,6 +10756,8 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
+ vmx_set_interrupt_shadow(vcpu, 0);
+
++ kvm_load_guest_xcr0(vcpu);
++
+ if (static_cpu_has(X86_FEATURE_PKU) &&
+ kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
+ vcpu->arch.pkru != vmx->host_pkru)
+@@ -10808,7 +10810,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ "mov %%" _ASM_AX", %%cr2 \n\t"
+ "3: \n\t"
+ /* Check if vmlaunch of vmresume is needed */
+- "cmpl $0, %c[launched](%0) \n\t"
++ "cmpb $0, %c[launched](%0) \n\t"
+ /* Load guest registers. Don't clobber flags. */
+ "mov %c[rax](%0), %%" _ASM_AX " \n\t"
+ "mov %c[rbx](%0), %%" _ASM_BX " \n\t"
+@@ -10971,10 +10973,15 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ __write_pkru(vmx->host_pkru);
+ }
+
++ kvm_put_guest_xcr0(vcpu);
++
+ vmx->nested.nested_run_pending = 0;
+ vmx->idt_vectoring_info = 0;
+
+ vmx->exit_reason = vmx->fail ? 0xdead : vmcs_read32(VM_EXIT_REASON);
++ if ((u16)vmx->exit_reason == EXIT_REASON_MCE_DURING_VMENTRY)
++ kvm_machine_check();
++
+ if (vmx->fail || (vmx->exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY))
+ return;
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index c27ce6059090..cbc39751f36b 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -713,7 +713,7 @@ void kvm_lmsw(struct kvm_vcpu *vcpu, unsigned long msw)
+ }
+ EXPORT_SYMBOL_GPL(kvm_lmsw);
+
+-static void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
++void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
+ {
+ if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE) &&
+ !vcpu->guest_xcr0_loaded) {
+@@ -723,8 +723,9 @@ static void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
+ vcpu->guest_xcr0_loaded = 1;
+ }
+ }
++EXPORT_SYMBOL_GPL(kvm_load_guest_xcr0);
+
+-static void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
++void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
+ {
+ if (vcpu->guest_xcr0_loaded) {
+ if (vcpu->arch.xcr0 != host_xcr0)
+@@ -732,6 +733,7 @@ static void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
+ vcpu->guest_xcr0_loaded = 0;
+ }
+ }
++EXPORT_SYMBOL_GPL(kvm_put_guest_xcr0);
+
+ static int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
+ {
+@@ -2494,7 +2496,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+
+ break;
+ case MSR_KVM_PV_EOI_EN:
+- if (kvm_lapic_enable_pv_eoi(vcpu, data))
++ if (kvm_lapic_enable_pv_eoi(vcpu, data, sizeof(u8)))
+ return 1;
+ break;
+
+@@ -4116,7 +4118,7 @@ static int kvm_vm_ioctl_set_identity_map_addr(struct kvm *kvm,
+ }
+
+ static int kvm_vm_ioctl_set_nr_mmu_pages(struct kvm *kvm,
+- u32 kvm_nr_mmu_pages)
++ unsigned long kvm_nr_mmu_pages)
+ {
+ if (kvm_nr_mmu_pages < KVM_MIN_ALLOC_MMU_PAGES)
+ return -EINVAL;
+@@ -4130,7 +4132,7 @@ static int kvm_vm_ioctl_set_nr_mmu_pages(struct kvm *kvm,
+ return 0;
+ }
+
+-static int kvm_vm_ioctl_get_nr_mmu_pages(struct kvm *kvm)
++static unsigned long kvm_vm_ioctl_get_nr_mmu_pages(struct kvm *kvm)
+ {
+ return kvm->arch.n_max_mmu_pages;
+ }
+@@ -7225,9 +7227,9 @@ static void enter_smm_save_state_32(struct kvm_vcpu *vcpu, char *buf)
+ put_smstate(u32, buf, 0x7ef8, vcpu->arch.smbase);
+ }
+
++#ifdef CONFIG_X86_64
+ static void enter_smm_save_state_64(struct kvm_vcpu *vcpu, char *buf)
+ {
+-#ifdef CONFIG_X86_64
+ struct desc_ptr dt;
+ struct kvm_segment seg;
+ unsigned long val;
+@@ -7277,10 +7279,8 @@ static void enter_smm_save_state_64(struct kvm_vcpu *vcpu, char *buf)
+
+ for (i = 0; i < 6; i++)
+ enter_smm_save_seg_64(vcpu, buf, i);
+-#else
+- WARN_ON_ONCE(1);
+-#endif
+ }
++#endif
+
+ static void enter_smm(struct kvm_vcpu *vcpu)
+ {
+@@ -7291,9 +7291,11 @@ static void enter_smm(struct kvm_vcpu *vcpu)
+
+ trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, true);
+ memset(buf, 0, 512);
++#ifdef CONFIG_X86_64
+ if (guest_cpuid_has(vcpu, X86_FEATURE_LM))
+ enter_smm_save_state_64(vcpu, buf);
+ else
++#endif
+ enter_smm_save_state_32(vcpu, buf);
+
+ /*
+@@ -7351,8 +7353,10 @@ static void enter_smm(struct kvm_vcpu *vcpu)
+ kvm_set_segment(vcpu, &ds, VCPU_SREG_GS);
+ kvm_set_segment(vcpu, &ds, VCPU_SREG_SS);
+
++#ifdef CONFIG_X86_64
+ if (guest_cpuid_has(vcpu, X86_FEATURE_LM))
+ kvm_x86_ops->set_efer(vcpu, 0);
++#endif
+
+ kvm_update_cpuid(vcpu);
+ kvm_mmu_reset_context(vcpu);
+@@ -7649,8 +7653,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ goto cancel_injection;
+ }
+
+- kvm_load_guest_xcr0(vcpu);
+-
+ if (req_immediate_exit) {
+ kvm_make_request(KVM_REQ_EVENT, vcpu);
+ kvm_x86_ops->request_immediate_exit(vcpu);
+@@ -7703,8 +7705,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ vcpu->mode = OUTSIDE_GUEST_MODE;
+ smp_wmb();
+
+- kvm_put_guest_xcr0(vcpu);
+-
+ kvm_before_interrupt(vcpu);
+ kvm_x86_ops->handle_external_intr(vcpu);
+ kvm_after_interrupt(vcpu);
+diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
+index 1826ed9dd1c8..3a91ea760f07 100644
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -345,4 +345,16 @@ static inline void kvm_after_interrupt(struct kvm_vcpu *vcpu)
+ __this_cpu_write(current_vcpu, NULL);
+ }
+
++
++static inline bool kvm_pat_valid(u64 data)
++{
++ if (data & 0xF8F8F8F8F8F8F8F8ull)
++ return false;
++ /* 0, 1, 4, 5, 6, 7 are valid values. */
++ return (data | ((data & 0x0202020202020202ull) << 1)) == data;
++}
++
++void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu);
++void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu);
++
+ #endif
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 4a3e1f417880..af635f878f96 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -816,7 +816,8 @@ void blk_cleanup_queue(struct request_queue *q)
+ blk_exit_queue(q);
+
+ if (q->mq_ops)
+- blk_mq_free_queue(q);
++ blk_mq_exit_queue(q);
++
+ percpu_ref_exit(&q->q_usage_counter);
+
+ spin_lock_irq(lock);
+diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
+index f4f7c73fb828..0529e94a20f7 100644
+--- a/block/blk-iolatency.c
++++ b/block/blk-iolatency.c
+@@ -560,15 +560,12 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+ u64 now = ktime_to_ns(ktime_get());
+ bool issue_as_root = bio_issue_as_root_blkg(bio);
+ bool enabled = false;
++ int inflight = 0;
+
+ blkg = bio->bi_blkg;
+ if (!blkg)
+ return;
+
+- /* We didn't actually submit this bio, don't account it. */
+- if (bio->bi_status == BLK_STS_AGAIN)
+- return;
+-
+ iolat = blkg_to_lat(bio->bi_blkg);
+ if (!iolat)
+ return;
+@@ -585,41 +582,24 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+ }
+ rqw = &iolat->rq_wait;
+
+- atomic_dec(&rqw->inflight);
+- if (iolat->min_lat_nsec == 0)
+- goto next;
+- iolatency_record_time(iolat, &bio->bi_issue, now,
+- issue_as_root);
+- window_start = atomic64_read(&iolat->window_start);
+- if (now > window_start &&
+- (now - window_start) >= iolat->cur_win_nsec) {
+- if (atomic64_cmpxchg(&iolat->window_start,
+- window_start, now) == window_start)
+- iolatency_check_latencies(iolat, now);
++ inflight = atomic_dec_return(&rqw->inflight);
++ WARN_ON_ONCE(inflight < 0);
++ /*
++ * If bi_status is BLK_STS_AGAIN, the bio wasn't actually
++ * submitted, so do not account for it.
++ */
++ if (iolat->min_lat_nsec && bio->bi_status != BLK_STS_AGAIN) {
++ iolatency_record_time(iolat, &bio->bi_issue, now,
++ issue_as_root);
++ window_start = atomic64_read(&iolat->window_start);
++ if (now > window_start &&
++ (now - window_start) >= iolat->cur_win_nsec) {
++ if (atomic64_cmpxchg(&iolat->window_start,
++ window_start, now) == window_start)
++ iolatency_check_latencies(iolat, now);
++ }
+ }
+-next:
+- wake_up(&rqw->wait);
+- blkg = blkg->parent;
+- }
+-}
+-
+-static void blkcg_iolatency_cleanup(struct rq_qos *rqos, struct bio *bio)
+-{
+- struct blkcg_gq *blkg;
+-
+- blkg = bio->bi_blkg;
+- while (blkg && blkg->parent) {
+- struct rq_wait *rqw;
+- struct iolatency_grp *iolat;
+-
+- iolat = blkg_to_lat(blkg);
+- if (!iolat)
+- goto next;
+-
+- rqw = &iolat->rq_wait;
+- atomic_dec(&rqw->inflight);
+ wake_up(&rqw->wait);
+-next:
+ blkg = blkg->parent;
+ }
+ }
+@@ -635,7 +615,6 @@ static void blkcg_iolatency_exit(struct rq_qos *rqos)
+
+ static struct rq_qos_ops blkcg_iolatency_ops = {
+ .throttle = blkcg_iolatency_throttle,
+- .cleanup = blkcg_iolatency_cleanup,
+ .done_bio = blkcg_iolatency_done_bio,
+ .exit = blkcg_iolatency_exit,
+ };
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index aafb44224c89..0b7297a43ccd 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -10,6 +10,7 @@
+ #include <linux/smp.h>
+
+ #include <linux/blk-mq.h>
++#include "blk.h"
+ #include "blk-mq.h"
+ #include "blk-mq-tag.h"
+
+@@ -21,6 +22,11 @@ static void blk_mq_hw_sysfs_release(struct kobject *kobj)
+ {
+ struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx,
+ kobj);
++
++ if (hctx->flags & BLK_MQ_F_BLOCKING)
++ cleanup_srcu_struct(hctx->srcu);
++ blk_free_flush_queue(hctx->fq);
++ sbitmap_free(&hctx->ctx_map);
+ free_cpumask_var(hctx->cpumask);
+ kfree(hctx->ctxs);
+ kfree(hctx);
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 70d839b9c3b0..455fda99255a 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2157,12 +2157,7 @@ static void blk_mq_exit_hctx(struct request_queue *q,
+ if (set->ops->exit_hctx)
+ set->ops->exit_hctx(hctx, hctx_idx);
+
+- if (hctx->flags & BLK_MQ_F_BLOCKING)
+- cleanup_srcu_struct(hctx->srcu);
+-
+ blk_mq_remove_cpuhp(hctx);
+- blk_free_flush_queue(hctx->fq);
+- sbitmap_free(&hctx->ctx_map);
+ }
+
+ static void blk_mq_exit_hw_queues(struct request_queue *q,
+@@ -2662,7 +2657,8 @@ err_exit:
+ }
+ EXPORT_SYMBOL(blk_mq_init_allocated_queue);
+
+-void blk_mq_free_queue(struct request_queue *q)
++/* tags can _not_ be used after returning from blk_mq_exit_queue */
++void blk_mq_exit_queue(struct request_queue *q)
+ {
+ struct blk_mq_tag_set *set = q->tag_set;
+
+diff --git a/block/blk-mq.h b/block/blk-mq.h
+index 9497b47e2526..5ad9251627f8 100644
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -31,7 +31,7 @@ struct blk_mq_ctx {
+ } ____cacheline_aligned_in_smp;
+
+ void blk_mq_freeze_queue(struct request_queue *q);
+-void blk_mq_free_queue(struct request_queue *q);
++void blk_mq_exit_queue(struct request_queue *q);
+ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
+ void blk_mq_wake_waiters(struct request_queue *q);
+ bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *, bool);
+diff --git a/drivers/char/tpm/st33zp24/i2c.c b/drivers/char/tpm/st33zp24/i2c.c
+index be5d1abd3e8e..8390c5b54c3b 100644
+--- a/drivers/char/tpm/st33zp24/i2c.c
++++ b/drivers/char/tpm/st33zp24/i2c.c
+@@ -33,7 +33,7 @@
+
+ struct st33zp24_i2c_phy {
+ struct i2c_client *client;
+- u8 buf[TPM_BUFSIZE + 1];
++ u8 buf[ST33ZP24_BUFSIZE + 1];
+ int io_lpcpd;
+ };
+
+diff --git a/drivers/char/tpm/st33zp24/spi.c b/drivers/char/tpm/st33zp24/spi.c
+index d7909ab287a8..ff019a1e3c68 100644
+--- a/drivers/char/tpm/st33zp24/spi.c
++++ b/drivers/char/tpm/st33zp24/spi.c
+@@ -63,7 +63,7 @@
+ * some latency byte before the answer is available (max 15).
+ * We have 2048 + 1024 + 15.
+ */
+-#define ST33ZP24_SPI_BUFFER_SIZE (TPM_BUFSIZE + (TPM_BUFSIZE / 2) +\
++#define ST33ZP24_SPI_BUFFER_SIZE (ST33ZP24_BUFSIZE + (ST33ZP24_BUFSIZE / 2) +\
+ MAX_SPI_LATENCY)
+
+
+diff --git a/drivers/char/tpm/st33zp24/st33zp24.h b/drivers/char/tpm/st33zp24/st33zp24.h
+index 6f4a4198af6a..20da0a84988d 100644
+--- a/drivers/char/tpm/st33zp24/st33zp24.h
++++ b/drivers/char/tpm/st33zp24/st33zp24.h
+@@ -18,8 +18,8 @@
+ #ifndef __LOCAL_ST33ZP24_H__
+ #define __LOCAL_ST33ZP24_H__
+
+-#define TPM_WRITE_DIRECTION 0x80
+-#define TPM_BUFSIZE 2048
++#define TPM_WRITE_DIRECTION 0x80
++#define ST33ZP24_BUFSIZE 2048
+
+ struct st33zp24_dev {
+ struct tpm_chip *chip;
+diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c
+index 977fd42daa1b..3b4e9672ff6c 100644
+--- a/drivers/char/tpm/tpm_i2c_infineon.c
++++ b/drivers/char/tpm/tpm_i2c_infineon.c
+@@ -26,8 +26,7 @@
+ #include <linux/wait.h>
+ #include "tpm.h"
+
+-/* max. buffer size supported by our TPM */
+-#define TPM_BUFSIZE 1260
++#define TPM_I2C_INFINEON_BUFSIZE 1260
+
+ /* max. number of iterations after I2C NAK */
+ #define MAX_COUNT 3
+@@ -63,11 +62,13 @@ enum i2c_chip_type {
+ UNKNOWN,
+ };
+
+-/* Structure to store I2C TPM specific stuff */
+ struct tpm_inf_dev {
+ struct i2c_client *client;
+ int locality;
+- u8 buf[TPM_BUFSIZE + sizeof(u8)]; /* max. buffer size + addr */
++ /* In addition to the data itself, the buffer must fit the 7-bit I2C
++ * address and the direction bit.
++ */
++ u8 buf[TPM_I2C_INFINEON_BUFSIZE + 1];
+ struct tpm_chip *chip;
+ enum i2c_chip_type chip_type;
+ unsigned int adapterlimit;
+@@ -219,7 +220,7 @@ static int iic_tpm_write_generic(u8 addr, u8 *buffer, size_t len,
+ .buf = tpm_dev.buf
+ };
+
+- if (len > TPM_BUFSIZE)
++ if (len > TPM_I2C_INFINEON_BUFSIZE)
+ return -EINVAL;
+
+ if (!tpm_dev.client->adapter->algo->master_xfer)
+@@ -527,8 +528,8 @@ static int tpm_tis_i2c_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ u8 retries = 0;
+ u8 sts = TPM_STS_GO;
+
+- if (len > TPM_BUFSIZE)
+- return -E2BIG; /* command is too long for our tpm, sorry */
++ if (len > TPM_I2C_INFINEON_BUFSIZE)
++ return -E2BIG;
+
+ if (request_locality(chip, 0) < 0)
+ return -EBUSY;
+diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c
+index b8defdfdf2dc..280308009784 100644
+--- a/drivers/char/tpm/tpm_i2c_nuvoton.c
++++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
+@@ -35,14 +35,12 @@
+ #include "tpm.h"
+
+ /* I2C interface offsets */
+-#define TPM_STS 0x00
+-#define TPM_BURST_COUNT 0x01
+-#define TPM_DATA_FIFO_W 0x20
+-#define TPM_DATA_FIFO_R 0x40
+-#define TPM_VID_DID_RID 0x60
+-/* TPM command header size */
+-#define TPM_HEADER_SIZE 10
+-#define TPM_RETRY 5
++#define TPM_STS 0x00
++#define TPM_BURST_COUNT 0x01
++#define TPM_DATA_FIFO_W 0x20
++#define TPM_DATA_FIFO_R 0x40
++#define TPM_VID_DID_RID 0x60
++#define TPM_I2C_RETRIES 5
+ /*
+ * I2C bus device maximum buffer size w/o counting I2C address or command
+ * i.e. max size required for I2C write is 34 = addr, command, 32 bytes data
+@@ -292,7 +290,7 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+ dev_err(dev, "%s() count < header size\n", __func__);
+ return -EIO;
+ }
+- for (retries = 0; retries < TPM_RETRY; retries++) {
++ for (retries = 0; retries < TPM_I2C_RETRIES; retries++) {
+ if (retries > 0) {
+ /* if this is not the first trial, set responseRetry */
+ i2c_nuvoton_write_status(client,
+diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
+index 0934d3724495..4080d4e78e8e 100644
+--- a/drivers/clk/clk-s2mps11.c
++++ b/drivers/clk/clk-s2mps11.c
+@@ -255,7 +255,7 @@ MODULE_DEVICE_TABLE(platform, s2mps11_clk_id);
+ * This requires of_device_id table. In the same time this will not change the
+ * actual *device* matching so do not add .of_match_table.
+ */
+-static const struct of_device_id s2mps11_dt_match[] = {
++static const struct of_device_id s2mps11_dt_match[] __used = {
+ {
+ .compatible = "samsung,s2mps11-clk",
+ .data = (void *)S2MPS11X,
+diff --git a/drivers/clk/tegra/clk-audio-sync.c b/drivers/clk/tegra/clk-audio-sync.c
+index 92d04ce2dee6..53cdc0ec40f3 100644
+--- a/drivers/clk/tegra/clk-audio-sync.c
++++ b/drivers/clk/tegra/clk-audio-sync.c
+@@ -55,7 +55,7 @@ const struct clk_ops tegra_clk_sync_source_ops = {
+ };
+
+ struct clk *tegra_clk_register_sync_source(const char *name,
+- unsigned long rate, unsigned long max_rate)
++ unsigned long max_rate)
+ {
+ struct tegra_clk_sync_source *sync;
+ struct clk_init_data init;
+@@ -67,7 +67,6 @@ struct clk *tegra_clk_register_sync_source(const char *name,
+ return ERR_PTR(-ENOMEM);
+ }
+
+- sync->rate = rate;
+ sync->max_rate = max_rate;
+
+ init.ops = &tegra_clk_sync_source_ops;
+diff --git a/drivers/clk/tegra/clk-tegra-audio.c b/drivers/clk/tegra/clk-tegra-audio.c
+index b37cae7af26d..02dd6487d855 100644
+--- a/drivers/clk/tegra/clk-tegra-audio.c
++++ b/drivers/clk/tegra/clk-tegra-audio.c
+@@ -49,8 +49,6 @@ struct tegra_sync_source_initdata {
+ #define SYNC(_name) \
+ {\
+ .name = #_name,\
+- .rate = 24000000,\
+- .max_rate = 24000000,\
+ .clk_id = tegra_clk_ ## _name,\
+ }
+
+@@ -176,7 +174,7 @@ static void __init tegra_audio_sync_clk_init(void __iomem *clk_base,
+ void __init tegra_audio_clk_init(void __iomem *clk_base,
+ void __iomem *pmc_base, struct tegra_clk *tegra_clks,
+ struct tegra_audio_clk_info *audio_info,
+- unsigned int num_plls)
++ unsigned int num_plls, unsigned long sync_max_rate)
+ {
+ struct clk *clk;
+ struct clk **dt_clk;
+@@ -221,8 +219,7 @@ void __init tegra_audio_clk_init(void __iomem *clk_base,
+ if (!dt_clk)
+ continue;
+
+- clk = tegra_clk_register_sync_source(data->name,
+- data->rate, data->max_rate);
++ clk = tegra_clk_register_sync_source(data->name, sync_max_rate);
+ *dt_clk = clk;
+ }
+
+diff --git a/drivers/clk/tegra/clk-tegra114.c b/drivers/clk/tegra/clk-tegra114.c
+index 1824f014202b..625d11091330 100644
+--- a/drivers/clk/tegra/clk-tegra114.c
++++ b/drivers/clk/tegra/clk-tegra114.c
+@@ -1190,6 +1190,13 @@ static struct tegra_clk_init_table init_table[] __initdata = {
+ { TEGRA114_CLK_XUSB_FALCON_SRC, TEGRA114_CLK_PLL_P, 204000000, 0 },
+ { TEGRA114_CLK_XUSB_HOST_SRC, TEGRA114_CLK_PLL_P, 102000000, 0 },
+ { TEGRA114_CLK_VDE, TEGRA114_CLK_CLK_MAX, 600000000, 0 },
++ { TEGRA114_CLK_SPDIF_IN_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_I2S0_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_I2S1_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_I2S2_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_I2S3_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_I2S4_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_VIMCLK_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
+ /* must be the last entry */
+ { TEGRA114_CLK_CLK_MAX, TEGRA114_CLK_CLK_MAX, 0, 0 },
+ };
+@@ -1362,7 +1369,7 @@ static void __init tegra114_clock_init(struct device_node *np)
+ tegra114_periph_clk_init(clk_base, pmc_base);
+ tegra_audio_clk_init(clk_base, pmc_base, tegra114_clks,
+ tegra114_audio_plls,
+- ARRAY_SIZE(tegra114_audio_plls));
++ ARRAY_SIZE(tegra114_audio_plls), 24000000);
+ tegra_pmc_clk_init(pmc_base, tegra114_clks);
+ tegra_super_clk_gen4_init(clk_base, pmc_base, tegra114_clks,
+ &pll_x_params);
+diff --git a/drivers/clk/tegra/clk-tegra124.c b/drivers/clk/tegra/clk-tegra124.c
+index b6cf28ca2ed2..df0018f7bf7e 100644
+--- a/drivers/clk/tegra/clk-tegra124.c
++++ b/drivers/clk/tegra/clk-tegra124.c
+@@ -1291,6 +1291,13 @@ static struct tegra_clk_init_table common_init_table[] __initdata = {
+ { TEGRA124_CLK_CSITE, TEGRA124_CLK_CLK_MAX, 0, 1 },
+ { TEGRA124_CLK_TSENSOR, TEGRA124_CLK_CLK_M, 400000, 0 },
+ { TEGRA124_CLK_VIC03, TEGRA124_CLK_PLL_C3, 0, 0 },
++ { TEGRA124_CLK_SPDIF_IN_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_I2S0_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_I2S1_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_I2S2_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_I2S3_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_I2S4_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_VIMCLK_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
+ /* must be the last entry */
+ { TEGRA124_CLK_CLK_MAX, TEGRA124_CLK_CLK_MAX, 0, 0 },
+ };
+@@ -1455,7 +1462,7 @@ static void __init tegra124_132_clock_init_pre(struct device_node *np)
+ tegra124_periph_clk_init(clk_base, pmc_base);
+ tegra_audio_clk_init(clk_base, pmc_base, tegra124_clks,
+ tegra124_audio_plls,
+- ARRAY_SIZE(tegra124_audio_plls));
++ ARRAY_SIZE(tegra124_audio_plls), 24576000);
+ tegra_pmc_clk_init(pmc_base, tegra124_clks);
+
+ /* For Tegra124 & Tegra132, PLLD is the only source for DSIA & DSIB */
+diff --git a/drivers/clk/tegra/clk-tegra210.c b/drivers/clk/tegra/clk-tegra210.c
+index 4e1bc23c9865..080bfa24863e 100644
+--- a/drivers/clk/tegra/clk-tegra210.c
++++ b/drivers/clk/tegra/clk-tegra210.c
+@@ -3369,6 +3369,15 @@ static struct tegra_clk_init_table init_table[] __initdata = {
+ { TEGRA210_CLK_SOC_THERM, TEGRA210_CLK_PLL_P, 51000000, 0 },
+ { TEGRA210_CLK_CCLK_G, TEGRA210_CLK_CLK_MAX, 0, 1 },
+ { TEGRA210_CLK_PLL_U_OUT2, TEGRA210_CLK_CLK_MAX, 60000000, 1 },
++ { TEGRA210_CLK_SPDIF_IN_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_I2S0_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_I2S1_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_I2S2_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_I2S3_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_I2S4_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_VIMCLK_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_HDA, TEGRA210_CLK_PLL_P, 51000000, 0 },
++ { TEGRA210_CLK_HDA2CODEC_2X, TEGRA210_CLK_PLL_P, 48000000, 0 },
+ /* This MUST be the last entry. */
+ { TEGRA210_CLK_CLK_MAX, TEGRA210_CLK_CLK_MAX, 0, 0 },
+ };
+@@ -3562,7 +3571,7 @@ static void __init tegra210_clock_init(struct device_node *np)
+ tegra210_periph_clk_init(clk_base, pmc_base);
+ tegra_audio_clk_init(clk_base, pmc_base, tegra210_clks,
+ tegra210_audio_plls,
+- ARRAY_SIZE(tegra210_audio_plls));
++ ARRAY_SIZE(tegra210_audio_plls), 24576000);
+ tegra_pmc_clk_init(pmc_base, tegra210_clks);
+
+ /* For Tegra210, PLLD is the only source for DSIA & DSIB */
+diff --git a/drivers/clk/tegra/clk-tegra30.c b/drivers/clk/tegra/clk-tegra30.c
+index acfe661b2ae7..e0aaecd98fbf 100644
+--- a/drivers/clk/tegra/clk-tegra30.c
++++ b/drivers/clk/tegra/clk-tegra30.c
+@@ -1267,6 +1267,13 @@ static struct tegra_clk_init_table init_table[] __initdata = {
+ { TEGRA30_CLK_GR3D2, TEGRA30_CLK_PLL_C, 300000000, 0 },
+ { TEGRA30_CLK_PLL_U, TEGRA30_CLK_CLK_MAX, 480000000, 0 },
+ { TEGRA30_CLK_VDE, TEGRA30_CLK_CLK_MAX, 600000000, 0 },
++ { TEGRA30_CLK_SPDIF_IN_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_I2S0_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_I2S1_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_I2S2_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_I2S3_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_I2S4_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_VIMCLK_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
+ /* must be the last entry */
+ { TEGRA30_CLK_CLK_MAX, TEGRA30_CLK_CLK_MAX, 0, 0 },
+ };
+@@ -1344,7 +1351,7 @@ static void __init tegra30_clock_init(struct device_node *np)
+ tegra30_periph_clk_init();
+ tegra_audio_clk_init(clk_base, pmc_base, tegra30_clks,
+ tegra30_audio_plls,
+- ARRAY_SIZE(tegra30_audio_plls));
++ ARRAY_SIZE(tegra30_audio_plls), 24000000);
+ tegra_pmc_clk_init(pmc_base, tegra30_clks);
+
+ tegra_init_dup_clks(tegra_clk_duplicates, clks, TEGRA30_CLK_CLK_MAX);
+diff --git a/drivers/clk/tegra/clk.h b/drivers/clk/tegra/clk.h
+index d2c3a010f8e9..09bccbb9640c 100644
+--- a/drivers/clk/tegra/clk.h
++++ b/drivers/clk/tegra/clk.h
+@@ -41,7 +41,7 @@ extern const struct clk_ops tegra_clk_sync_source_ops;
+ extern int *periph_clk_enb_refcnt;
+
+ struct clk *tegra_clk_register_sync_source(const char *name,
+- unsigned long fixed_rate, unsigned long max_rate);
++ unsigned long max_rate);
+
+ /**
+ * struct tegra_clk_frac_div - fractional divider clock
+@@ -796,7 +796,7 @@ void tegra_register_devclks(struct tegra_devclk *dev_clks, int num);
+ void tegra_audio_clk_init(void __iomem *clk_base,
+ void __iomem *pmc_base, struct tegra_clk *tegra_clks,
+ struct tegra_audio_clk_info *audio_info,
+- unsigned int num_plls);
++ unsigned int num_plls, unsigned long sync_max_rate);
+
+ void tegra_periph_clk_init(void __iomem *clk_base, void __iomem *pmc_base,
+ struct tegra_clk *tegra_clks,
+diff --git a/drivers/crypto/ccree/cc_driver.c b/drivers/crypto/ccree/cc_driver.c
+index 1ff229c2aeab..186a2536fb8b 100644
+--- a/drivers/crypto/ccree/cc_driver.c
++++ b/drivers/crypto/ccree/cc_driver.c
+@@ -364,7 +364,7 @@ static int init_cc_resources(struct platform_device *plat_dev)
+ rc = cc_ivgen_init(new_drvdata);
+ if (rc) {
+ dev_err(dev, "cc_ivgen_init failed\n");
+- goto post_power_mgr_err;
++ goto post_buf_mgr_err;
+ }
+
+ /* Allocate crypto algs */
+@@ -387,6 +387,9 @@ static int init_cc_resources(struct platform_device *plat_dev)
+ goto post_hash_err;
+ }
+
++ /* All set, we can allow autosuspend */
++ cc_pm_go(new_drvdata);
++
+ /* If we got here and FIPS mode is enabled
+ * it means all FIPS test passed, so let TEE
+ * know we're good.
+@@ -401,8 +404,6 @@ post_cipher_err:
+ cc_cipher_free(new_drvdata);
+ post_ivgen_err:
+ cc_ivgen_fini(new_drvdata);
+-post_power_mgr_err:
+- cc_pm_fini(new_drvdata);
+ post_buf_mgr_err:
+ cc_buffer_mgr_fini(new_drvdata);
+ post_req_mgr_err:
+diff --git a/drivers/crypto/ccree/cc_pm.c b/drivers/crypto/ccree/cc_pm.c
+index 79fc0a37ba6e..638082dff183 100644
+--- a/drivers/crypto/ccree/cc_pm.c
++++ b/drivers/crypto/ccree/cc_pm.c
+@@ -103,20 +103,19 @@ int cc_pm_put_suspend(struct device *dev)
+
+ int cc_pm_init(struct cc_drvdata *drvdata)
+ {
+- int rc = 0;
+ struct device *dev = drvdata_to_dev(drvdata);
+
+ /* must be before the enabling to avoid resdundent suspending */
+ pm_runtime_set_autosuspend_delay(dev, CC_SUSPEND_TIMEOUT);
+ pm_runtime_use_autosuspend(dev);
+ /* activate the PM module */
+- rc = pm_runtime_set_active(dev);
+- if (rc)
+- return rc;
+- /* enable the PM module*/
+- pm_runtime_enable(dev);
++ return pm_runtime_set_active(dev);
++}
+
+- return rc;
++/* enable the PM module*/
++void cc_pm_go(struct cc_drvdata *drvdata)
++{
++ pm_runtime_enable(drvdata_to_dev(drvdata));
+ }
+
+ void cc_pm_fini(struct cc_drvdata *drvdata)
+diff --git a/drivers/crypto/ccree/cc_pm.h b/drivers/crypto/ccree/cc_pm.h
+index 020a5403c58b..907a6db4d6c0 100644
+--- a/drivers/crypto/ccree/cc_pm.h
++++ b/drivers/crypto/ccree/cc_pm.h
+@@ -16,6 +16,7 @@
+ extern const struct dev_pm_ops ccree_pm;
+
+ int cc_pm_init(struct cc_drvdata *drvdata);
++void cc_pm_go(struct cc_drvdata *drvdata);
+ void cc_pm_fini(struct cc_drvdata *drvdata);
+ int cc_pm_suspend(struct device *dev);
+ int cc_pm_resume(struct device *dev);
+@@ -29,6 +30,8 @@ static inline int cc_pm_init(struct cc_drvdata *drvdata)
+ return 0;
+ }
+
++static inline void cc_pm_go(struct cc_drvdata *drvdata) {}
++
+ static inline void cc_pm_fini(struct cc_drvdata *drvdata) {}
+
+ static inline int cc_pm_suspend(struct device *dev)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+index 5f3f54073818..17862b9ecccd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+@@ -1070,7 +1070,7 @@ void amdgpu_vce_ring_emit_fence(struct amdgpu_ring *ring, u64 addr, u64 seq,
+ int amdgpu_vce_ring_test_ring(struct amdgpu_ring *ring)
+ {
+ struct amdgpu_device *adev = ring->adev;
+- uint32_t rptr = amdgpu_ring_get_rptr(ring);
++ uint32_t rptr;
+ unsigned i;
+ int r, timeout = adev->usec_timeout;
+
+@@ -1084,6 +1084,9 @@ int amdgpu_vce_ring_test_ring(struct amdgpu_ring *ring)
+ ring->idx, r);
+ return r;
+ }
++
++ rptr = amdgpu_ring_get_rptr(ring);
++
+ amdgpu_ring_write(ring, VCE_CMD_END);
+ amdgpu_ring_commit(ring);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+index 400fc74bbae2..205e683fb920 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+@@ -431,7 +431,7 @@ error:
+ int amdgpu_vcn_enc_ring_test_ring(struct amdgpu_ring *ring)
+ {
+ struct amdgpu_device *adev = ring->adev;
+- uint32_t rptr = amdgpu_ring_get_rptr(ring);
++ uint32_t rptr;
+ unsigned i;
+ int r;
+
+@@ -441,6 +441,9 @@ int amdgpu_vcn_enc_ring_test_ring(struct amdgpu_ring *ring)
+ ring->idx, r);
+ return r;
+ }
++
++ rptr = amdgpu_ring_get_rptr(ring);
++
+ amdgpu_ring_write(ring, VCN_ENC_CMD_END);
+ amdgpu_ring_commit(ring);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 46568497ef18..782411649816 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -82,7 +82,8 @@ MODULE_FIRMWARE("amdgpu/raven_rlc.bin");
+
+ static const struct soc15_reg_golden golden_settings_gc_9_0[] =
+ {
+- SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG2, 0xf00fffff, 0x00000420),
++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG2, 0xf00fffff, 0x00000400),
++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG3, 0x80000000, 0x80000000),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmGB_GPU_ID, 0x0000000f, 0x00000000),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_BINNER_EVENT_CNTL_3, 0x00000003, 0x82400024),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_ENHANCE, 0x3fffffff, 0x00000001),
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+index d4070839ac80..80613a74df42 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+@@ -170,7 +170,7 @@ static void uvd_v6_0_enc_ring_set_wptr(struct amdgpu_ring *ring)
+ static int uvd_v6_0_enc_ring_test_ring(struct amdgpu_ring *ring)
+ {
+ struct amdgpu_device *adev = ring->adev;
+- uint32_t rptr = amdgpu_ring_get_rptr(ring);
++ uint32_t rptr;
+ unsigned i;
+ int r;
+
+@@ -180,6 +180,9 @@ static int uvd_v6_0_enc_ring_test_ring(struct amdgpu_ring *ring)
+ ring->idx, r);
+ return r;
+ }
++
++ rptr = amdgpu_ring_get_rptr(ring);
++
+ amdgpu_ring_write(ring, HEVC_ENC_CMD_END);
+ amdgpu_ring_commit(ring);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
+index 057151b17b45..ce16b8329af0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
+@@ -175,7 +175,7 @@ static void uvd_v7_0_enc_ring_set_wptr(struct amdgpu_ring *ring)
+ static int uvd_v7_0_enc_ring_test_ring(struct amdgpu_ring *ring)
+ {
+ struct amdgpu_device *adev = ring->adev;
+- uint32_t rptr = amdgpu_ring_get_rptr(ring);
++ uint32_t rptr;
+ unsigned i;
+ int r;
+
+@@ -188,6 +188,9 @@ static int uvd_v7_0_enc_ring_test_ring(struct amdgpu_ring *ring)
+ ring->me, ring->idx, r);
+ return r;
+ }
++
++ rptr = amdgpu_ring_get_rptr(ring);
++
+ amdgpu_ring_write(ring, HEVC_ENC_CMD_END);
+ amdgpu_ring_commit(ring);
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 5aba50f63ac6..938d0053a820 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -310,6 +310,7 @@ static const struct kfd_deviceid supported_devices[] = {
+ { 0x67CF, &polaris10_device_info }, /* Polaris10 */
+ { 0x67D0, &polaris10_vf_device_info }, /* Polaris10 vf*/
+ { 0x67DF, &polaris10_device_info }, /* Polaris10 */
++ { 0x6FDF, &polaris10_device_info }, /* Polaris10 */
+ { 0x67E0, &polaris11_device_info }, /* Polaris11 */
+ { 0x67E1, &polaris11_device_info }, /* Polaris11 */
+ { 0x67E3, &polaris11_device_info }, /* Polaris11 */
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 59445c83f023..c85bea70d965 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -377,9 +377,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ drm_connector_attach_encoder(&aconnector->base,
+ &aconnector->mst_encoder->base);
+
+- /*
+- * TODO: understand why this one is needed
+- */
+ drm_object_attach_property(
+ &connector->base,
+ dev->mode_config.path_property,
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
+index 2aab1b475945..cede78cdf28d 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
+@@ -669,20 +669,20 @@ int smu_set_watermarks_for_clocks_ranges(void *wt_table,
+ for (i = 0; i < wm_with_clock_ranges->num_wm_dmif_sets; i++) {
+ table->WatermarkRow[1][i].MinClock =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_dcfclk_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_dcfclk_clk_in_khz /
++ 1000));
+ table->WatermarkRow[1][i].MaxClock =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_dcfclk_clk_in_khz) /
+- 100);
++ (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_dcfclk_clk_in_khz /
++ 1000));
+ table->WatermarkRow[1][i].MinUclk =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_mem_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_mem_clk_in_khz /
++ 1000));
+ table->WatermarkRow[1][i].MaxUclk =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_mem_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_mem_clk_in_khz /
++ 1000));
+ table->WatermarkRow[1][i].WmSetting = (uint8_t)
+ wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_set_id;
+ }
+@@ -690,20 +690,20 @@ int smu_set_watermarks_for_clocks_ranges(void *wt_table,
+ for (i = 0; i < wm_with_clock_ranges->num_wm_mcif_sets; i++) {
+ table->WatermarkRow[0][i].MinClock =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_socclk_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_socclk_clk_in_khz /
++ 1000));
+ table->WatermarkRow[0][i].MaxClock =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_socclk_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_socclk_clk_in_khz /
++ 1000));
+ table->WatermarkRow[0][i].MinUclk =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_mem_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_mem_clk_in_khz /
++ 1000));
+ table->WatermarkRow[0][i].MaxUclk =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_mem_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_mem_clk_in_khz /
++ 1000));
+ table->WatermarkRow[0][i].WmSetting = (uint8_t)
+ wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_set_id;
+ }
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index 281cf9cbb44c..1a4b44923aec 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -1702,6 +1702,27 @@ drm_atomic_set_crtc_for_connector(struct drm_connector_state *conn_state,
+ struct drm_connector *connector = conn_state->connector;
+ struct drm_crtc_state *crtc_state;
+
++ /*
++ * For compatibility with legacy users, we want to make sure that
++ * we allow DPMS On<->Off modesets on unregistered connectors, since
++ * legacy modesetting users will not be expecting these to fail. We do
++ * not however, want to allow legacy users to assign a connector
++ * that's been unregistered from sysfs to another CRTC, since doing
++ * this with a now non-existent connector could potentially leave us
++ * in an invalid state.
++ *
++ * Since the connector can be unregistered at any point during an
++ * atomic check or commit, this is racy. But that's OK: all we care
++ * about is ensuring that userspace can't use this connector for new
++ * configurations after it's been notified that the connector is no
++ * longer present.
++ */
++ if (!READ_ONCE(connector->registered) && crtc) {
++ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] is not registered\n",
++ connector->base.id, connector->name);
++ return -EINVAL;
++ }
++
+ if (conn_state->crtc == crtc)
+ return 0;
+
+diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
+index 138680b37c70..f8672238d444 100644
+--- a/drivers/gpu/drm/drm_ioc32.c
++++ b/drivers/gpu/drm/drm_ioc32.c
+@@ -185,7 +185,7 @@ static int compat_drm_getmap(struct file *file, unsigned int cmd,
+ m32.size = map.size;
+ m32.type = map.type;
+ m32.flags = map.flags;
+- m32.handle = ptr_to_compat(map.handle);
++ m32.handle = ptr_to_compat((void __user *)map.handle);
+ m32.mtrr = map.mtrr;
+ if (copy_to_user(argp, &m32, sizeof(m32)))
+ return -EFAULT;
+@@ -216,7 +216,7 @@ static int compat_drm_addmap(struct file *file, unsigned int cmd,
+
+ m32.offset = map.offset;
+ m32.mtrr = map.mtrr;
+- m32.handle = ptr_to_compat(map.handle);
++ m32.handle = ptr_to_compat((void __user *)map.handle);
+ if (map.handle != compat_ptr(m32.handle))
+ pr_err_ratelimited("compat_drm_addmap truncated handle %p for type %d offset %x\n",
+ map.handle, m32.type, m32.offset);
+@@ -529,7 +529,7 @@ static int compat_drm_getsareactx(struct file *file, unsigned int cmd,
+ if (err)
+ return err;
+
+- req32.handle = ptr_to_compat(req.handle);
++ req32.handle = ptr_to_compat((void __user *)req.handle);
+ if (copy_to_user(argp, &req32, sizeof(req32)))
+ return -EFAULT;
+
+diff --git a/drivers/gpu/drm/drm_vblank.c b/drivers/gpu/drm/drm_vblank.c
+index 28cdcf76b6f9..d1859bcc7ccb 100644
+--- a/drivers/gpu/drm/drm_vblank.c
++++ b/drivers/gpu/drm/drm_vblank.c
+@@ -105,13 +105,20 @@ static void store_vblank(struct drm_device *dev, unsigned int pipe,
+ write_sequnlock(&vblank->seqlock);
+ }
+
++static u32 drm_max_vblank_count(struct drm_device *dev, unsigned int pipe)
++{
++ struct drm_vblank_crtc *vblank = &dev->vblank[pipe];
++
++ return vblank->max_vblank_count ?: dev->max_vblank_count;
++}
++
+ /*
+ * "No hw counter" fallback implementation of .get_vblank_counter() hook,
+ * if there is no useable hardware frame counter available.
+ */
+ static u32 drm_vblank_no_hw_counter(struct drm_device *dev, unsigned int pipe)
+ {
+- WARN_ON_ONCE(dev->max_vblank_count != 0);
++ WARN_ON_ONCE(drm_max_vblank_count(dev, pipe) != 0);
+ return 0;
+ }
+
+@@ -198,6 +205,7 @@ static void drm_update_vblank_count(struct drm_device *dev, unsigned int pipe,
+ ktime_t t_vblank;
+ int count = DRM_TIMESTAMP_MAXRETRIES;
+ int framedur_ns = vblank->framedur_ns;
++ u32 max_vblank_count = drm_max_vblank_count(dev, pipe);
+
+ /*
+ * Interrupts were disabled prior to this call, so deal with counter
+@@ -216,9 +224,9 @@ static void drm_update_vblank_count(struct drm_device *dev, unsigned int pipe,
+ rc = drm_get_last_vbltimestamp(dev, pipe, &t_vblank, in_vblank_irq);
+ } while (cur_vblank != __get_vblank_counter(dev, pipe) && --count > 0);
+
+- if (dev->max_vblank_count != 0) {
++ if (max_vblank_count) {
+ /* trust the hw counter when it's around */
+- diff = (cur_vblank - vblank->last) & dev->max_vblank_count;
++ diff = (cur_vblank - vblank->last) & max_vblank_count;
+ } else if (rc && framedur_ns) {
+ u64 diff_ns = ktime_to_ns(ktime_sub(t_vblank, vblank->time));
+
+@@ -1204,6 +1212,37 @@ void drm_crtc_vblank_reset(struct drm_crtc *crtc)
+ }
+ EXPORT_SYMBOL(drm_crtc_vblank_reset);
+
++/**
++ * drm_crtc_set_max_vblank_count - configure the hw max vblank counter value
++ * @crtc: CRTC in question
++ * @max_vblank_count: max hardware vblank counter value
++ *
++ * Update the maximum hardware vblank counter value for @crtc
++ * at runtime. Useful for hardware where the operation of the
++ * hardware vblank counter depends on the currently active
++ * display configuration.
++ *
++ * For example, if the hardware vblank counter does not work
++ * when a specific connector is active the maximum can be set
++ * to zero. And when that specific connector isn't active the
++ * maximum can again be set to the appropriate non-zero value.
++ *
++ * If used, must be called before drm_vblank_on().
++ */
++void drm_crtc_set_max_vblank_count(struct drm_crtc *crtc,
++ u32 max_vblank_count)
++{
++ struct drm_device *dev = crtc->dev;
++ unsigned int pipe = drm_crtc_index(crtc);
++ struct drm_vblank_crtc *vblank = &dev->vblank[pipe];
++
++ WARN_ON(dev->max_vblank_count);
++ WARN_ON(!READ_ONCE(vblank->inmodeset));
++
++ vblank->max_vblank_count = max_vblank_count;
++}
++EXPORT_SYMBOL(drm_crtc_set_max_vblank_count);
++
+ /**
+ * drm_crtc_vblank_on - enable vblank events on a CRTC
+ * @crtc: CRTC in question
+diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
+index f9ce35da4123..e063e98d1e82 100644
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -1788,6 +1788,8 @@ static int i915_emon_status(struct seq_file *m, void *unused)
+ if (!IS_GEN5(dev_priv))
+ return -ENODEV;
+
++ intel_runtime_pm_get(dev_priv);
++
+ ret = mutex_lock_interruptible(&dev->struct_mutex);
+ if (ret)
+ return ret;
+@@ -1802,6 +1804,8 @@ static int i915_emon_status(struct seq_file *m, void *unused)
+ seq_printf(m, "GFX power: %ld\n", gfx);
+ seq_printf(m, "Total power: %ld\n", chipset + gfx);
+
++ intel_runtime_pm_put(dev_priv);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 03cda197fb6b..937287710042 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1874,20 +1874,28 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
+ * pages from.
+ */
+ if (!obj->base.filp) {
+- i915_gem_object_put(obj);
+- return -ENXIO;
++ addr = -ENXIO;
++ goto err;
++ }
++
++ if (range_overflows(args->offset, args->size, (u64)obj->base.size)) {
++ addr = -EINVAL;
++ goto err;
+ }
+
+ addr = vm_mmap(obj->base.filp, 0, args->size,
+ PROT_READ | PROT_WRITE, MAP_SHARED,
+ args->offset);
++ if (IS_ERR_VALUE(addr))
++ goto err;
++
+ if (args->flags & I915_MMAP_WC) {
+ struct mm_struct *mm = current->mm;
+ struct vm_area_struct *vma;
+
+ if (down_write_killable(&mm->mmap_sem)) {
+- i915_gem_object_put(obj);
+- return -EINTR;
++ addr = -EINTR;
++ goto err;
+ }
+ vma = find_vma(mm, addr);
+ if (vma && __vma_matches(vma, obj->base.filp, addr, args->size))
+@@ -1896,17 +1904,20 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
+ else
+ addr = -ENOMEM;
+ up_write(&mm->mmap_sem);
++ if (IS_ERR_VALUE(addr))
++ goto err;
+
+ /* This may race, but that's ok, it only gets set */
+ WRITE_ONCE(obj->frontbuffer_ggtt_origin, ORIGIN_CPU);
+ }
+ i915_gem_object_put(obj);
+- if (IS_ERR((void *)addr))
+- return addr;
+
+ args->addr_ptr = (uint64_t) addr;
+-
+ return 0;
++
++err:
++ i915_gem_object_put(obj);
++ return addr;
+ }
+
+ static unsigned int tile_row_pages(struct drm_i915_gem_object *obj)
+@@ -5595,6 +5606,8 @@ err_uc_misc:
+ i915_gem_cleanup_userptr(dev_priv);
+
+ if (ret == -EIO) {
++ mutex_lock(&dev_priv->drm.struct_mutex);
++
+ /*
+ * Allow engine initialisation to fail by marking the GPU as
+ * wedged. But we only want to do this where the GPU is angry,
+@@ -5605,7 +5618,14 @@ err_uc_misc:
+ "Failed to initialize GPU, declaring it wedged!\n");
+ i915_gem_set_wedged(dev_priv);
+ }
+- ret = 0;
++
++ /* Minimal basic recovery for KMS */
++ ret = i915_ggtt_enable_hw(dev_priv);
++ i915_gem_restore_gtt_mappings(dev_priv);
++ i915_gem_restore_fences(dev_priv);
++ intel_init_clock_gating(dev_priv);
++
++ mutex_unlock(&dev_priv->drm.struct_mutex);
+ }
+
+ i915_gem_drain_freed_objects(dev_priv);
+@@ -5615,6 +5635,7 @@ err_uc_misc:
+ void i915_gem_fini(struct drm_i915_private *dev_priv)
+ {
+ i915_gem_suspend_late(dev_priv);
++ intel_disable_gt_powersave(dev_priv);
+
+ /* Flush any outstanding unpin_work. */
+ i915_gem_drain_workqueue(dev_priv);
+@@ -5626,6 +5647,8 @@ void i915_gem_fini(struct drm_i915_private *dev_priv)
+ i915_gem_contexts_fini(dev_priv);
+ mutex_unlock(&dev_priv->drm.struct_mutex);
+
++ intel_cleanup_gt_powersave(dev_priv);
++
+ intel_uc_fini_misc(dev_priv);
+ i915_gem_cleanup_userptr(dev_priv);
+
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 16f5d2d93801..4e070afb2738 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -6531,7 +6531,7 @@ enum {
+ #define PLANE_CTL_YUV422_UYVY (1 << 16)
+ #define PLANE_CTL_YUV422_YVYU (2 << 16)
+ #define PLANE_CTL_YUV422_VYUY (3 << 16)
+-#define PLANE_CTL_DECOMPRESSION_ENABLE (1 << 15)
++#define PLANE_CTL_RENDER_DECOMPRESSION_ENABLE (1 << 15)
+ #define PLANE_CTL_TRICKLE_FEED_DISABLE (1 << 14)
+ #define PLANE_CTL_PLANE_GAMMA_DISABLE (1 << 13) /* Pre-GLK */
+ #define PLANE_CTL_TILED_MASK (0x7 << 10)
+diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
+index 29075c763428..7b4906ede148 100644
+--- a/drivers/gpu/drm/i915/intel_cdclk.c
++++ b/drivers/gpu/drm/i915/intel_cdclk.c
+@@ -2208,6 +2208,17 @@ int intel_crtc_compute_min_cdclk(const struct intel_crtc_state *crtc_state)
+ if (INTEL_GEN(dev_priv) >= 9)
+ min_cdclk = max(2 * 96000, min_cdclk);
+
++ /*
++ * "For DP audio configuration, cdclk frequency shall be set to
++ * meet the following requirements:
++ * DP Link Frequency(MHz) | Cdclk frequency(MHz)
++ * 270 | 320 or higher
++ * 162 | 200 or higher"
++ */
++ if ((IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) &&
++ intel_crtc_has_dp_encoder(crtc_state) && crtc_state->has_audio)
++ min_cdclk = max(crtc_state->port_clock, min_cdclk);
++
+ /*
+ * On Valleyview some DSI panels lose (v|h)sync when the clock is lower
+ * than 320000KHz.
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 3bd44d042a1d..6902fd2da19c 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2712,6 +2712,17 @@ intel_alloc_initial_plane_obj(struct intel_crtc *crtc,
+ if (size_aligned * 2 > dev_priv->stolen_usable_size)
+ return false;
+
++ switch (fb->modifier) {
++ case DRM_FORMAT_MOD_LINEAR:
++ case I915_FORMAT_MOD_X_TILED:
++ case I915_FORMAT_MOD_Y_TILED:
++ break;
++ default:
++ DRM_DEBUG_DRIVER("Unsupported modifier for initial FB: 0x%llx\n",
++ fb->modifier);
++ return false;
++ }
++
+ mutex_lock(&dev->struct_mutex);
+ obj = i915_gem_object_create_stolen_for_preallocated(dev_priv,
+ base_aligned,
+@@ -2721,8 +2732,17 @@ intel_alloc_initial_plane_obj(struct intel_crtc *crtc,
+ if (!obj)
+ return false;
+
+- if (plane_config->tiling == I915_TILING_X)
+- obj->tiling_and_stride = fb->pitches[0] | I915_TILING_X;
++ switch (plane_config->tiling) {
++ case I915_TILING_NONE:
++ break;
++ case I915_TILING_X:
++ case I915_TILING_Y:
++ obj->tiling_and_stride = fb->pitches[0] | plane_config->tiling;
++ break;
++ default:
++ MISSING_CASE(plane_config->tiling);
++ return false;
++ }
+
+ mode_cmd.pixel_format = fb->format->format;
+ mode_cmd.width = fb->width;
+@@ -3561,11 +3581,11 @@ static u32 skl_plane_ctl_tiling(uint64_t fb_modifier)
+ case I915_FORMAT_MOD_Y_TILED:
+ return PLANE_CTL_TILED_Y;
+ case I915_FORMAT_MOD_Y_TILED_CCS:
+- return PLANE_CTL_TILED_Y | PLANE_CTL_DECOMPRESSION_ENABLE;
++ return PLANE_CTL_TILED_Y | PLANE_CTL_RENDER_DECOMPRESSION_ENABLE;
+ case I915_FORMAT_MOD_Yf_TILED:
+ return PLANE_CTL_TILED_YF;
+ case I915_FORMAT_MOD_Yf_TILED_CCS:
+- return PLANE_CTL_TILED_YF | PLANE_CTL_DECOMPRESSION_ENABLE;
++ return PLANE_CTL_TILED_YF | PLANE_CTL_RENDER_DECOMPRESSION_ENABLE;
+ default:
+ MISSING_CASE(fb_modifier);
+ }
+@@ -8812,13 +8832,14 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
+ fb->modifier = I915_FORMAT_MOD_X_TILED;
+ break;
+ case PLANE_CTL_TILED_Y:
+- if (val & PLANE_CTL_DECOMPRESSION_ENABLE)
++ plane_config->tiling = I915_TILING_Y;
++ if (val & PLANE_CTL_RENDER_DECOMPRESSION_ENABLE)
+ fb->modifier = I915_FORMAT_MOD_Y_TILED_CCS;
+ else
+ fb->modifier = I915_FORMAT_MOD_Y_TILED;
+ break;
+ case PLANE_CTL_TILED_YF:
+- if (val & PLANE_CTL_DECOMPRESSION_ENABLE)
++ if (val & PLANE_CTL_RENDER_DECOMPRESSION_ENABLE)
+ fb->modifier = I915_FORMAT_MOD_Yf_TILED_CCS;
+ else
+ fb->modifier = I915_FORMAT_MOD_Yf_TILED;
+@@ -15951,8 +15972,6 @@ void intel_modeset_cleanup(struct drm_device *dev)
+ flush_work(&dev_priv->atomic_helper.free_work);
+ WARN_ON(!llist_empty(&dev_priv->atomic_helper.free_list));
+
+- intel_disable_gt_powersave(dev_priv);
+-
+ /*
+ * Interrupts and polling as the first thing to avoid creating havoc.
+ * Too much stuff here (turning of connectors, ...) would
+@@ -15980,8 +15999,6 @@ void intel_modeset_cleanup(struct drm_device *dev)
+
+ intel_cleanup_overlay(dev_priv);
+
+- intel_cleanup_gt_powersave(dev_priv);
+-
+ intel_teardown_gmbus(dev_priv);
+
+ destroy_workqueue(dev_priv->modeset_wq);
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index f92079e19de8..20cd4c8acecc 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -4739,6 +4739,22 @@ intel_dp_long_pulse(struct intel_connector *connector,
+ */
+ status = connector_status_disconnected;
+ goto out;
++ } else {
++ /*
++ * If display is now connected check links status,
++ * there has been known issues of link loss triggering
++ * long pulse.
++ *
++ * Some sinks (eg. ASUS PB287Q) seem to perform some
++ * weird HPD ping pong during modesets. So we can apparently
++ * end up with HPD going low during a modeset, and then
++ * going back up soon after. And once that happens we must
++ * retrain the link to get a picture. That's in case no
++ * userspace component reacted to intermittent HPD dip.
++ */
++ struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base;
++
++ intel_dp_retrain_link(encoder, ctx);
+ }
+
+ /*
+diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
+index 1fec0c71b4d9..58ba14966d4f 100644
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -408,8 +408,6 @@ static struct drm_encoder *intel_mst_atomic_best_encoder(struct drm_connector *c
+ struct intel_dp *intel_dp = intel_connector->mst_port;
+ struct intel_crtc *crtc = to_intel_crtc(state->crtc);
+
+- if (!READ_ONCE(connector->registered))
+- return NULL;
+ return &intel_dp->mst_encoders[crtc->pipe]->base.base;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index f889d41a281f..5e01bfb69d7a 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -759,7 +759,8 @@ nv50_msto_enable(struct drm_encoder *encoder)
+
+ slots = drm_dp_find_vcpi_slots(&mstm->mgr, mstc->pbn);
+ r = drm_dp_mst_allocate_vcpi(&mstm->mgr, mstc->port, mstc->pbn, slots);
+- WARN_ON(!r);
++ if (!r)
++ DRM_DEBUG_KMS("Failed to allocate VCPI\n");
+
+ if (!mstm->links++)
+ nv50_outp_acquire(mstm->outp);
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index b1d41c4921dd..5fd94e206029 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -436,6 +436,32 @@ static const struct panel_desc ampire_am800480r3tmqwa1h = {
+ .bus_format = MEDIA_BUS_FMT_RGB666_1X18,
+ };
+
++static const struct display_timing santek_st0700i5y_rbslw_f_timing = {
++ .pixelclock = { 26400000, 33300000, 46800000 },
++ .hactive = { 800, 800, 800 },
++ .hfront_porch = { 16, 210, 354 },
++ .hback_porch = { 45, 36, 6 },
++ .hsync_len = { 1, 10, 40 },
++ .vactive = { 480, 480, 480 },
++ .vfront_porch = { 7, 22, 147 },
++ .vback_porch = { 22, 13, 3 },
++ .vsync_len = { 1, 10, 20 },
++ .flags = DISPLAY_FLAGS_HSYNC_LOW | DISPLAY_FLAGS_VSYNC_LOW |
++ DISPLAY_FLAGS_DE_HIGH | DISPLAY_FLAGS_PIXDATA_POSEDGE
++};
++
++static const struct panel_desc armadeus_st0700_adapt = {
++ .timings = &santek_st0700i5y_rbslw_f_timing,
++ .num_timings = 1,
++ .bpc = 6,
++ .size = {
++ .width = 154,
++ .height = 86,
++ },
++ .bus_format = MEDIA_BUS_FMT_RGB666_1X18,
++ .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_POSEDGE,
++};
++
+ static const struct drm_display_mode auo_b101aw03_mode = {
+ .clock = 51450,
+ .hdisplay = 1024,
+@@ -2330,6 +2356,9 @@ static const struct of_device_id platform_of_match[] = {
+ }, {
+ .compatible = "ampire,am800480r3tmqwa1h",
+ .data = &ire_am800480r3tmqwa1h,
++ }, {
++ .compatible = "armadeus,st0700-adapt",
++ .data = &armadeus_st0700_adapt,
+ }, {
+ .compatible = "auo,b101aw03",
+ .data = &auo_b101aw03,
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+index 59e9d05ab928..0af048d1a815 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+@@ -353,7 +353,7 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+ !!(HIGH_WORD(ecx) & MESSAGE_STATUS_HB));
+ if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) == 0) {
+ kfree(reply);
+-
++ reply = NULL;
+ if ((HIGH_WORD(ebx) & MESSAGE_STATUS_CPT) != 0) {
+ /* A checkpoint occurred. Retry. */
+ continue;
+@@ -377,7 +377,7 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+
+ if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
+ kfree(reply);
+-
++ reply = NULL;
+ if ((HIGH_WORD(ecx) & MESSAGE_STATUS_CPT) != 0) {
+ /* A checkpoint occurred. Retry. */
+ continue;
+@@ -389,10 +389,8 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+ break;
+ }
+
+- if (retries == RETRIES) {
+- kfree(reply);
++ if (!reply)
+ return -EINVAL;
+- }
+
+ *msg_len = reply_len;
+ *msg = reply;
+diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
+index 5eed1e7da15c..d6106e1a0d4a 100644
+--- a/drivers/hv/hv_kvp.c
++++ b/drivers/hv/hv_kvp.c
+@@ -353,7 +353,9 @@ static void process_ib_ipinfo(void *in_msg, void *out_msg, int op)
+
+ out->body.kvp_ip_val.dhcp_enabled = in->kvp_ip_val.dhcp_enabled;
+
+- default:
++ /* fallthrough */
++
++ case KVP_OP_GET_IP_INFO:
+ utf16s_to_utf8s((wchar_t *)in->kvp_ip_val.adapter_id,
+ MAX_ADAPTER_ID_SIZE,
+ UTF16_LITTLE_ENDIAN,
+@@ -406,6 +408,10 @@ kvp_send_key(struct work_struct *dummy)
+ process_ib_ipinfo(in_msg, message, KVP_OP_SET_IP_INFO);
+ break;
+ case KVP_OP_GET_IP_INFO:
++ /*
++ * We only need to pass on the info of operation, adapter_id
++ * and addr_family to the userland kvp daemon.
++ */
+ process_ib_ipinfo(in_msg, message, KVP_OP_GET_IP_INFO);
+ break;
+ case KVP_OP_SET:
+@@ -421,7 +427,7 @@ kvp_send_key(struct work_struct *dummy)
+ UTF16_LITTLE_ENDIAN,
+ message->body.kvp_set.data.value,
+ HV_KVP_EXCHANGE_MAX_VALUE_SIZE - 1) + 1;
+- break;
++ break;
+
+ case REG_U32:
+ /*
+@@ -446,7 +452,10 @@ kvp_send_key(struct work_struct *dummy)
+ break;
+
+ }
+- case KVP_OP_GET:
++
++ /*
++ * The key is always a string - utf16 encoding.
++ */
+ message->body.kvp_set.data.key_size =
+ utf16s_to_utf8s(
+ (wchar_t *)in_msg->body.kvp_set.data.key,
+@@ -454,7 +463,18 @@ kvp_send_key(struct work_struct *dummy)
+ UTF16_LITTLE_ENDIAN,
+ message->body.kvp_set.data.key,
+ HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
+- break;
++
++ break;
++
++ case KVP_OP_GET:
++ message->body.kvp_get.data.key_size =
++ utf16s_to_utf8s(
++ (wchar_t *)in_msg->body.kvp_get.data.key,
++ in_msg->body.kvp_get.data.key_size,
++ UTF16_LITTLE_ENDIAN,
++ message->body.kvp_get.data.key,
++ HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
++ break;
+
+ case KVP_OP_DELETE:
+ message->body.kvp_delete.key_size =
+@@ -464,12 +484,12 @@ kvp_send_key(struct work_struct *dummy)
+ UTF16_LITTLE_ENDIAN,
+ message->body.kvp_delete.key,
+ HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
+- break;
++ break;
+
+ case KVP_OP_ENUMERATE:
+ message->body.kvp_enum_data.index =
+ in_msg->body.kvp_enum_data.index;
+- break;
++ break;
+ }
+
+ kvp_transaction.state = HVUTIL_USERSPACE_REQ;
+diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
+index 3f3e8b3bf5ff..d51bf536bdf7 100644
+--- a/drivers/i2c/busses/i2c-at91.c
++++ b/drivers/i2c/busses/i2c-at91.c
+@@ -270,9 +270,11 @@ static void at91_twi_write_next_byte(struct at91_twi_dev *dev)
+ writeb_relaxed(*dev->buf, dev->base + AT91_TWI_THR);
+
+ /* send stop when last byte has been written */
+- if (--dev->buf_len == 0)
++ if (--dev->buf_len == 0) {
+ if (!dev->use_alt_cmd)
+ at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
++ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_TXRDY);
++ }
+
+ dev_dbg(dev->dev, "wrote 0x%x, to go %zu\n", *dev->buf, dev->buf_len);
+
+@@ -690,9 +692,8 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
+ } else {
+ at91_twi_write_next_byte(dev);
+ at91_twi_write(dev, AT91_TWI_IER,
+- AT91_TWI_TXCOMP |
+- AT91_TWI_NACK |
+- AT91_TWI_TXRDY);
++ AT91_TWI_TXCOMP | AT91_TWI_NACK |
++ (dev->buf_len ? AT91_TWI_TXRDY : 0));
+ }
+ }
+
+@@ -913,7 +914,7 @@ static struct at91_twi_pdata sama5d4_config = {
+
+ static struct at91_twi_pdata sama5d2_config = {
+ .clk_max_div = 7,
+- .clk_offset = 4,
++ .clk_offset = 3,
+ .has_unre_flag = true,
+ .has_alt_cmd = true,
+ .has_hold_field = true,
+diff --git a/drivers/iio/adc/exynos_adc.c b/drivers/iio/adc/exynos_adc.c
+index 4be29ed44755..1ca2c4d39f87 100644
+--- a/drivers/iio/adc/exynos_adc.c
++++ b/drivers/iio/adc/exynos_adc.c
+@@ -115,6 +115,8 @@
+ #define MAX_ADC_V2_CHANNELS 10
+ #define MAX_ADC_V1_CHANNELS 8
+ #define MAX_EXYNOS3250_ADC_CHANNELS 2
++#define MAX_EXYNOS4212_ADC_CHANNELS 4
++#define MAX_S5PV210_ADC_CHANNELS 10
+
+ /* Bit definitions common for ADC_V1 and ADC_V2 */
+ #define ADC_CON_EN_START (1u << 0)
+@@ -270,6 +272,19 @@ static void exynos_adc_v1_start_conv(struct exynos_adc *info,
+ writel(con1 | ADC_CON_EN_START, ADC_V1_CON(info->regs));
+ }
+
++/* Exynos4212 and 4412 is like ADCv1 but with four channels only */
++static const struct exynos_adc_data exynos4212_adc_data = {
++ .num_channels = MAX_EXYNOS4212_ADC_CHANNELS,
++ .mask = ADC_DATX_MASK, /* 12 bit ADC resolution */
++ .needs_adc_phy = true,
++ .phy_offset = EXYNOS_ADCV1_PHY_OFFSET,
++
++ .init_hw = exynos_adc_v1_init_hw,
++ .exit_hw = exynos_adc_v1_exit_hw,
++ .clear_irq = exynos_adc_v1_clear_irq,
++ .start_conv = exynos_adc_v1_start_conv,
++};
++
+ static const struct exynos_adc_data exynos_adc_v1_data = {
+ .num_channels = MAX_ADC_V1_CHANNELS,
+ .mask = ADC_DATX_MASK, /* 12 bit ADC resolution */
+@@ -282,6 +297,16 @@ static const struct exynos_adc_data exynos_adc_v1_data = {
+ .start_conv = exynos_adc_v1_start_conv,
+ };
+
++static const struct exynos_adc_data exynos_adc_s5pv210_data = {
++ .num_channels = MAX_S5PV210_ADC_CHANNELS,
++ .mask = ADC_DATX_MASK, /* 12 bit ADC resolution */
++
++ .init_hw = exynos_adc_v1_init_hw,
++ .exit_hw = exynos_adc_v1_exit_hw,
++ .clear_irq = exynos_adc_v1_clear_irq,
++ .start_conv = exynos_adc_v1_start_conv,
++};
++
+ static void exynos_adc_s3c2416_start_conv(struct exynos_adc *info,
+ unsigned long addr)
+ {
+@@ -478,6 +503,12 @@ static const struct of_device_id exynos_adc_match[] = {
+ }, {
+ .compatible = "samsung,s3c6410-adc",
+ .data = &exynos_adc_s3c64xx_data,
++ }, {
++ .compatible = "samsung,s5pv210-adc",
++ .data = &exynos_adc_s5pv210_data,
++ }, {
++ .compatible = "samsung,exynos4212-adc",
++ .data = &exynos4212_adc_data,
+ }, {
+ .compatible = "samsung,exynos-adc-v1",
+ .data = &exynos_adc_v1_data,
+diff --git a/drivers/iio/adc/rcar-gyroadc.c b/drivers/iio/adc/rcar-gyroadc.c
+index dcb50172186f..f3a966ab35dc 100644
+--- a/drivers/iio/adc/rcar-gyroadc.c
++++ b/drivers/iio/adc/rcar-gyroadc.c
+@@ -391,7 +391,7 @@ static int rcar_gyroadc_parse_subdevs(struct iio_dev *indio_dev)
+ dev_err(dev,
+ "Only %i channels supported with %s, but reg = <%i>.\n",
+ num_channels, child->name, reg);
+- return ret;
++ return -EINVAL;
+ }
+ }
+
+@@ -400,7 +400,7 @@ static int rcar_gyroadc_parse_subdevs(struct iio_dev *indio_dev)
+ dev_err(dev,
+ "Channel %i uses different ADC mode than the rest.\n",
+ reg);
+- return ret;
++ return -EINVAL;
+ }
+
+ /* Channel is valid, grab the regulator. */
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 50152c1b1004..357de3b4fddd 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -265,6 +265,9 @@ void ib_uverbs_release_file(struct kref *ref)
+ if (atomic_dec_and_test(&file->device->refcount))
+ ib_uverbs_comp_dev(file->device);
+
++ if (file->async_file)
++ kref_put(&file->async_file->ref,
++ ib_uverbs_release_async_event_file);
+ kobject_put(&file->device->kobj);
+ kfree(file);
+ }
+@@ -915,10 +918,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
+ }
+ mutex_unlock(&file->device->lists_mutex);
+
+- if (file->async_file)
+- kref_put(&file->async_file->ref,
+- ib_uverbs_release_async_event_file);
+-
+ kref_put(&file->ref, ib_uverbs_release_file);
+
+ return 0;
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index 88e326d6cc49..d648a4167832 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -410,10 +410,7 @@ static void sdma_flush(struct sdma_engine *sde)
+ sdma_flush_descq(sde);
+ spin_lock_irqsave(&sde->flushlist_lock, flags);
+ /* copy flush list */
+- list_for_each_entry_safe(txp, txp_next, &sde->flushlist, list) {
+- list_del_init(&txp->list);
+- list_add_tail(&txp->list, &flushlist);
+- }
++ list_splice_init(&sde->flushlist, &flushlist);
+ spin_unlock_irqrestore(&sde->flushlist_lock, flags);
+ /* flush from flush list */
+ list_for_each_entry_safe(txp, txp_next, &flushlist, list)
+@@ -2426,7 +2423,7 @@ unlock_noconn:
+ wait->tx_count++;
+ wait->count += tx->num_desc;
+ }
+- schedule_work(&sde->flush_worker);
++ queue_work_on(sde->cpu, system_highpri_wq, &sde->flush_worker);
+ ret = -ECOMM;
+ goto unlock;
+ nodesc:
+@@ -2526,7 +2523,7 @@ unlock_noconn:
+ }
+ }
+ spin_unlock(&sde->flushlist_lock);
+- schedule_work(&sde->flush_worker);
++ queue_work_on(sde->cpu, system_highpri_wq, &sde->flush_worker);
+ ret = -ECOMM;
+ goto update_tail;
+ nodesc:
+diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
+index 9e1cac8cb260..453e5c4ac19f 100644
+--- a/drivers/infiniband/hw/mlx5/odp.c
++++ b/drivers/infiniband/hw/mlx5/odp.c
+@@ -497,7 +497,7 @@ void mlx5_ib_free_implicit_mr(struct mlx5_ib_mr *imr)
+ static int pagefault_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
+ u64 io_virt, size_t bcnt, u32 *bytes_mapped)
+ {
+- u64 access_mask = ODP_READ_ALLOWED_BIT;
++ u64 access_mask;
+ int npages = 0, page_shift, np;
+ u64 start_idx, page_mask;
+ struct ib_umem_odp *odp;
+@@ -522,6 +522,7 @@ next_mr:
+ page_shift = mr->umem->page_shift;
+ page_mask = ~(BIT(page_shift) - 1);
+ start_idx = (io_virt - (mr->mmkey.iova & page_mask)) >> page_shift;
++ access_mask = ODP_READ_ALLOWED_BIT;
+
+ if (mr->umem->writable)
+ access_mask |= ODP_WRITE_ALLOWED_BIT;
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 2c1114ee0c6d..bc6a44a16445 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -3401,13 +3401,17 @@ static const match_table_t srp_opt_tokens = {
+
+ /**
+ * srp_parse_in - parse an IP address and port number combination
++ * @net: [in] Network namespace.
++ * @sa: [out] Address family, IP address and port number.
++ * @addr_port_str: [in] IP address and port number.
++ * @has_port: [out] Whether or not @addr_port_str includes a port number.
+ *
+ * Parse the following address formats:
+ * - IPv4: <ip_address>:<port>, e.g. 1.2.3.4:5.
+ * - IPv6: \[<ipv6_address>\]:<port>, e.g. [1::2:3%4]:5.
+ */
+ static int srp_parse_in(struct net *net, struct sockaddr_storage *sa,
+- const char *addr_port_str)
++ const char *addr_port_str, bool *has_port)
+ {
+ char *addr_end, *addr = kstrdup(addr_port_str, GFP_KERNEL);
+ char *port_str;
+@@ -3416,9 +3420,12 @@ static int srp_parse_in(struct net *net, struct sockaddr_storage *sa,
+ if (!addr)
+ return -ENOMEM;
+ port_str = strrchr(addr, ':');
+- if (!port_str)
+- return -EINVAL;
+- *port_str++ = '\0';
++ if (port_str && strchr(port_str, ']'))
++ port_str = NULL;
++ if (port_str)
++ *port_str++ = '\0';
++ if (has_port)
++ *has_port = port_str != NULL;
+ ret = inet_pton_with_scope(net, AF_INET, addr, port_str, sa);
+ if (ret && addr[0]) {
+ addr_end = addr + strlen(addr) - 1;
+@@ -3440,6 +3447,7 @@ static int srp_parse_options(struct net *net, const char *buf,
+ char *p;
+ substring_t args[MAX_OPT_ARGS];
+ unsigned long long ull;
++ bool has_port;
+ int opt_mask = 0;
+ int token;
+ int ret = -EINVAL;
+@@ -3538,7 +3546,8 @@ static int srp_parse_options(struct net *net, const char *buf,
+ ret = -ENOMEM;
+ goto out;
+ }
+- ret = srp_parse_in(net, &target->rdma_cm.src.ss, p);
++ ret = srp_parse_in(net, &target->rdma_cm.src.ss, p,
++ NULL);
+ if (ret < 0) {
+ pr_warn("bad source parameter '%s'\n", p);
+ kfree(p);
+@@ -3554,7 +3563,10 @@ static int srp_parse_options(struct net *net, const char *buf,
+ ret = -ENOMEM;
+ goto out;
+ }
+- ret = srp_parse_in(net, &target->rdma_cm.dst.ss, p);
++ ret = srp_parse_in(net, &target->rdma_cm.dst.ss, p,
++ &has_port);
++ if (!has_port)
++ ret = -EINVAL;
+ if (ret < 0) {
+ pr_warn("bad dest parameter '%s'\n", p);
+ kfree(p);
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index 60348d707b99..9a576ae837dc 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -148,8 +148,9 @@ __cached_rbnode_delete_update(struct iova_domain *iovad, struct iova *free)
+ struct iova *cached_iova;
+
+ cached_iova = rb_entry(iovad->cached32_node, struct iova, node);
+- if (free->pfn_hi < iovad->dma_32bit_pfn &&
+- free->pfn_lo >= cached_iova->pfn_lo)
++ if (free == cached_iova ||
++ (free->pfn_hi < iovad->dma_32bit_pfn &&
++ free->pfn_lo >= cached_iova->pfn_lo))
+ iovad->cached32_node = rb_next(&free->node);
+
+ cached_iova = rb_entry(iovad->cached_node, struct iova, node);
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 3f4211b5cd33..45f684689c35 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -35,7 +35,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/sched/clock.h>
+ #include <linux/rculist.h>
+-
++#include <linux/delay.h>
+ #include <trace/events/bcache.h>
+
+ /*
+@@ -649,7 +649,25 @@ static int mca_reap(struct btree *b, unsigned int min_order, bool flush)
+ up(&b->io_mutex);
+ }
+
++retry:
++ /*
++ * BTREE_NODE_dirty might be cleared in btree_flush_btree() by
++ * __bch_btree_node_write(). To avoid an extra flush, acquire
++ * b->write_lock before checking BTREE_NODE_dirty bit.
++ */
+ mutex_lock(&b->write_lock);
++ /*
++ * If this btree node is selected in btree_flush_write() by journal
++ * code, delay and retry until the node is flushed by journal code
++ * and BTREE_NODE_journal_flush bit cleared by btree_flush_write().
++ */
++ if (btree_node_journal_flush(b)) {
++ pr_debug("bnode %p is flushing by journal, retry", b);
++ mutex_unlock(&b->write_lock);
++ udelay(1);
++ goto retry;
++ }
++
+ if (btree_node_dirty(b))
+ __bch_btree_node_write(b, &cl);
+ mutex_unlock(&b->write_lock);
+@@ -772,10 +790,15 @@ void bch_btree_cache_free(struct cache_set *c)
+ while (!list_empty(&c->btree_cache)) {
+ b = list_first_entry(&c->btree_cache, struct btree, list);
+
+- if (btree_node_dirty(b))
++ /*
++ * This function is called by cache_set_free(), no I/O
++ * request on cache now, it is unnecessary to acquire
++ * b->write_lock before clearing BTREE_NODE_dirty anymore.
++ */
++ if (btree_node_dirty(b)) {
+ btree_complete_write(b, btree_current_write(b));
+- clear_bit(BTREE_NODE_dirty, &b->flags);
+-
++ clear_bit(BTREE_NODE_dirty, &b->flags);
++ }
+ mca_data_free(b);
+ }
+
+@@ -1061,11 +1084,25 @@ static void btree_node_free(struct btree *b)
+
+ BUG_ON(b == b->c->root);
+
++retry:
+ mutex_lock(&b->write_lock);
++ /*
++ * If the btree node is selected and flushing in btree_flush_write(),
++ * delay and retry until the BTREE_NODE_journal_flush bit cleared,
++ * then it is safe to free the btree node here. Otherwise this btree
++ * node will be in race condition.
++ */
++ if (btree_node_journal_flush(b)) {
++ mutex_unlock(&b->write_lock);
++ pr_debug("bnode %p journal_flush set, retry", b);
++ udelay(1);
++ goto retry;
++ }
+
+- if (btree_node_dirty(b))
++ if (btree_node_dirty(b)) {
+ btree_complete_write(b, btree_current_write(b));
+- clear_bit(BTREE_NODE_dirty, &b->flags);
++ clear_bit(BTREE_NODE_dirty, &b->flags);
++ }
+
+ mutex_unlock(&b->write_lock);
+
+diff --git a/drivers/md/bcache/btree.h b/drivers/md/bcache/btree.h
+index a68d6c55783b..4d0cca145f69 100644
+--- a/drivers/md/bcache/btree.h
++++ b/drivers/md/bcache/btree.h
+@@ -158,11 +158,13 @@ enum btree_flags {
+ BTREE_NODE_io_error,
+ BTREE_NODE_dirty,
+ BTREE_NODE_write_idx,
++ BTREE_NODE_journal_flush,
+ };
+
+ BTREE_FLAG(io_error);
+ BTREE_FLAG(dirty);
+ BTREE_FLAG(write_idx);
++BTREE_FLAG(journal_flush);
+
+ static inline struct btree_write *btree_current_write(struct btree *b)
+ {
+diff --git a/drivers/md/bcache/extents.c b/drivers/md/bcache/extents.c
+index c809724e6571..886710043025 100644
+--- a/drivers/md/bcache/extents.c
++++ b/drivers/md/bcache/extents.c
+@@ -538,6 +538,7 @@ static bool bch_extent_bad(struct btree_keys *bk, const struct bkey *k)
+ {
+ struct btree *b = container_of(bk, struct btree, keys);
+ unsigned int i, stale;
++ char buf[80];
+
+ if (!KEY_PTRS(k) ||
+ bch_extent_invalid(bk, k))
+@@ -547,19 +548,19 @@ static bool bch_extent_bad(struct btree_keys *bk, const struct bkey *k)
+ if (!ptr_available(b->c, k, i))
+ return true;
+
+- if (!expensive_debug_checks(b->c) && KEY_DIRTY(k))
+- return false;
+-
+ for (i = 0; i < KEY_PTRS(k); i++) {
+ stale = ptr_stale(b->c, k, i);
+
+- btree_bug_on(stale > 96, b,
++ if (stale && KEY_DIRTY(k)) {
++ bch_extent_to_text(buf, sizeof(buf), k);
++ pr_info("stale dirty pointer, stale %u, key: %s",
++ stale, buf);
++ }
++
++ btree_bug_on(stale > BUCKET_GC_GEN_MAX, b,
+ "key too stale: %i, need_gc %u",
+ stale, b->c->need_gc);
+
+- btree_bug_on(stale && KEY_DIRTY(k) && KEY_SIZE(k),
+- b, "stale dirty pointer");
+-
+ if (stale)
+ return true;
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index ec1e35a62934..7bb15cddca5e 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -404,6 +404,7 @@ static void btree_flush_write(struct cache_set *c)
+ retry:
+ best = NULL;
+
++ mutex_lock(&c->bucket_lock);
+ for_each_cached_btree(b, c, i)
+ if (btree_current_write(b)->journal) {
+ if (!best)
+@@ -416,9 +417,14 @@ retry:
+ }
+
+ b = best;
++ if (b)
++ set_btree_node_journal_flush(b);
++ mutex_unlock(&c->bucket_lock);
++
+ if (b) {
+ mutex_lock(&b->write_lock);
+ if (!btree_current_write(b)->journal) {
++ clear_bit(BTREE_NODE_journal_flush, &b->flags);
+ mutex_unlock(&b->write_lock);
+ /* We raced */
+ atomic_long_inc(&c->retry_flush_write);
+@@ -426,6 +432,7 @@ retry:
+ }
+
+ __bch_btree_node_write(b, NULL);
++ clear_bit(BTREE_NODE_journal_flush, &b->flags);
+ mutex_unlock(&b->write_lock);
+ }
+ }
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index f3dcc7640319..34f5de13a93d 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -949,6 +949,7 @@ static int crypt_integrity_ctr(struct crypt_config *cc, struct dm_target *ti)
+ {
+ #ifdef CONFIG_BLK_DEV_INTEGRITY
+ struct blk_integrity *bi = blk_get_integrity(cc->dev->bdev->bd_disk);
++ struct mapped_device *md = dm_table_get_md(ti->table);
+
+ /* From now we require underlying device with our integrity profile */
+ if (!bi || strcasecmp(bi->profile->name, "DM-DIF-EXT-TAG")) {
+@@ -968,7 +969,7 @@ static int crypt_integrity_ctr(struct crypt_config *cc, struct dm_target *ti)
+
+ if (crypt_integrity_aead(cc)) {
+ cc->integrity_tag_size = cc->on_disk_tag_size - cc->integrity_iv_size;
+- DMINFO("Integrity AEAD, tag size %u, IV size %u.",
++ DMDEBUG("%s: Integrity AEAD, tag size %u, IV size %u.", dm_device_name(md),
+ cc->integrity_tag_size, cc->integrity_iv_size);
+
+ if (crypto_aead_setauthsize(any_tfm_aead(cc), cc->integrity_tag_size)) {
+@@ -976,7 +977,7 @@ static int crypt_integrity_ctr(struct crypt_config *cc, struct dm_target *ti)
+ return -EINVAL;
+ }
+ } else if (cc->integrity_iv_size)
+- DMINFO("Additional per-sector space %u bytes for IV.",
++ DMDEBUG("%s: Additional per-sector space %u bytes for IV.", dm_device_name(md),
+ cc->integrity_iv_size);
+
+ if ((cc->integrity_tag_size + cc->integrity_iv_size) != bi->tag_size) {
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index baa966e2778c..481e54ded9dc 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -554,8 +554,23 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
+ return DM_MAPIO_REMAPPED;
+ }
+
+-static void multipath_release_clone(struct request *clone)
++static void multipath_release_clone(struct request *clone,
++ union map_info *map_context)
+ {
++ if (unlikely(map_context)) {
++ /*
++ * non-NULL map_context means caller is still map
++ * method; must undo multipath_clone_and_map()
++ */
++ struct dm_mpath_io *mpio = get_mpio(map_context);
++ struct pgpath *pgpath = mpio->pgpath;
++
++ if (pgpath && pgpath->pg->ps.type->end_io)
++ pgpath->pg->ps.type->end_io(&pgpath->pg->ps,
++ &pgpath->path,
++ mpio->nr_bytes);
++ }
++
+ blk_put_request(clone);
+ }
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 264b84e274aa..17c6a73c536c 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -219,7 +219,7 @@ static void dm_end_request(struct request *clone, blk_status_t error)
+ struct request *rq = tio->orig;
+
+ blk_rq_unprep_clone(clone);
+- tio->ti->type->release_clone_rq(clone);
++ tio->ti->type->release_clone_rq(clone, NULL);
+
+ rq_end_stats(md, rq);
+ if (!rq->q->mq_ops)
+@@ -270,7 +270,7 @@ static void dm_requeue_original_request(struct dm_rq_target_io *tio, bool delay_
+ rq_end_stats(md, rq);
+ if (tio->clone) {
+ blk_rq_unprep_clone(tio->clone);
+- tio->ti->type->release_clone_rq(tio->clone);
++ tio->ti->type->release_clone_rq(tio->clone, NULL);
+ }
+
+ if (!rq->q->mq_ops)
+@@ -495,7 +495,7 @@ check_again:
+ case DM_MAPIO_REMAPPED:
+ if (setup_clone(clone, rq, tio, GFP_ATOMIC)) {
+ /* -ENOMEM */
+- ti->type->release_clone_rq(clone);
++ ti->type->release_clone_rq(clone, &tio->info);
+ return DM_MAPIO_REQUEUE;
+ }
+
+@@ -505,7 +505,7 @@ check_again:
+ ret = dm_dispatch_clone_request(clone, rq);
+ if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) {
+ blk_rq_unprep_clone(clone);
+- tio->ti->type->release_clone_rq(clone);
++ tio->ti->type->release_clone_rq(clone, &tio->info);
+ tio->clone = NULL;
+ if (!rq->q->mq_ops)
+ r = DM_MAPIO_DELAY_REQUEUE;
+diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
+index 314d17ca6466..64dd0b34fcf4 100644
+--- a/drivers/md/dm-target.c
++++ b/drivers/md/dm-target.c
+@@ -136,7 +136,8 @@ static int io_err_clone_and_map_rq(struct dm_target *ti, struct request *rq,
+ return DM_MAPIO_KILL;
+ }
+
+-static void io_err_release_clone_rq(struct request *clone)
++static void io_err_release_clone_rq(struct request *clone,
++ union map_info *map_context)
+ {
+ }
+
+diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
+index ed3caceaed07..6a26afcc1fd6 100644
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -2001,16 +2001,19 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
+
+ int dm_pool_metadata_set_needs_check(struct dm_pool_metadata *pmd)
+ {
+- int r;
++ int r = -EINVAL;
+ struct dm_block *sblock;
+ struct thin_disk_superblock *disk_super;
+
+ down_write(&pmd->root_lock);
++ if (pmd->fail_io)
++ goto out;
++
+ pmd->flags |= THIN_METADATA_NEEDS_CHECK_FLAG;
+
+ r = superblock_lock(pmd, &sblock);
+ if (r) {
+- DMERR("couldn't read superblock");
++ DMERR("couldn't lock superblock");
+ goto out;
+ }
+
+diff --git a/drivers/media/cec/Makefile b/drivers/media/cec/Makefile
+index 29a2ab9e77c5..ad8677d8c896 100644
+--- a/drivers/media/cec/Makefile
++++ b/drivers/media/cec/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
+-cec-objs := cec-core.o cec-adap.o cec-api.o cec-edid.o
++cec-objs := cec-core.o cec-adap.o cec-api.o
+
+ ifeq ($(CONFIG_CEC_NOTIFIER),y)
+ cec-objs += cec-notifier.o
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index a7ea27d2aa8e..4a15d53f659e 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -62,6 +62,19 @@ static unsigned int cec_log_addr2dev(const struct cec_adapter *adap, u8 log_addr
+ return adap->log_addrs.primary_device_type[i < 0 ? 0 : i];
+ }
+
++u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
++ unsigned int *offset)
++{
++ unsigned int loc = cec_get_edid_spa_location(edid, size);
++
++ if (offset)
++ *offset = loc;
++ if (loc == 0)
++ return CEC_PHYS_ADDR_INVALID;
++ return (edid[loc] << 8) | edid[loc + 1];
++}
++EXPORT_SYMBOL_GPL(cec_get_edid_phys_addr);
++
+ /*
+ * Queue a new event for this filehandle. If ts == 0, then set it
+ * to the current time.
+diff --git a/drivers/media/cec/cec-edid.c b/drivers/media/cec/cec-edid.c
+deleted file mode 100644
+index f587e8eaefd8..000000000000
+--- a/drivers/media/cec/cec-edid.c
++++ /dev/null
+@@ -1,95 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0-only
+-/*
+- * cec-edid - HDMI Consumer Electronics Control EDID & CEC helper functions
+- *
+- * Copyright 2016 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
+- */
+-
+-#include <linux/module.h>
+-#include <linux/kernel.h>
+-#include <linux/types.h>
+-#include <media/cec.h>
+-
+-u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
+- unsigned int *offset)
+-{
+- unsigned int loc = cec_get_edid_spa_location(edid, size);
+-
+- if (offset)
+- *offset = loc;
+- if (loc == 0)
+- return CEC_PHYS_ADDR_INVALID;
+- return (edid[loc] << 8) | edid[loc + 1];
+-}
+-EXPORT_SYMBOL_GPL(cec_get_edid_phys_addr);
+-
+-void cec_set_edid_phys_addr(u8 *edid, unsigned int size, u16 phys_addr)
+-{
+- unsigned int loc = cec_get_edid_spa_location(edid, size);
+- u8 sum = 0;
+- unsigned int i;
+-
+- if (loc == 0)
+- return;
+- edid[loc] = phys_addr >> 8;
+- edid[loc + 1] = phys_addr & 0xff;
+- loc &= ~0x7f;
+-
+- /* update the checksum */
+- for (i = loc; i < loc + 127; i++)
+- sum += edid[i];
+- edid[i] = 256 - sum;
+-}
+-EXPORT_SYMBOL_GPL(cec_set_edid_phys_addr);
+-
+-u16 cec_phys_addr_for_input(u16 phys_addr, u8 input)
+-{
+- /* Check if input is sane */
+- if (WARN_ON(input == 0 || input > 0xf))
+- return CEC_PHYS_ADDR_INVALID;
+-
+- if (phys_addr == 0)
+- return input << 12;
+-
+- if ((phys_addr & 0x0fff) == 0)
+- return phys_addr | (input << 8);
+-
+- if ((phys_addr & 0x00ff) == 0)
+- return phys_addr | (input << 4);
+-
+- if ((phys_addr & 0x000f) == 0)
+- return phys_addr | input;
+-
+- /*
+- * All nibbles are used so no valid physical addresses can be assigned
+- * to the input.
+- */
+- return CEC_PHYS_ADDR_INVALID;
+-}
+-EXPORT_SYMBOL_GPL(cec_phys_addr_for_input);
+-
+-int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port)
+-{
+- int i;
+-
+- if (parent)
+- *parent = phys_addr;
+- if (port)
+- *port = 0;
+- if (phys_addr == CEC_PHYS_ADDR_INVALID)
+- return 0;
+- for (i = 0; i < 16; i += 4)
+- if (phys_addr & (0xf << i))
+- break;
+- if (i == 16)
+- return 0;
+- if (parent)
+- *parent = phys_addr & (0xfff0 << i);
+- if (port)
+- *port = (phys_addr >> i) & 0xf;
+- for (i += 4; i < 16; i += 4)
+- if ((phys_addr & (0xf << i)) == 0)
+- return -EINVAL;
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(cec_phys_addr_validate);
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index 63c9ac2c6a5f..8b1ae1d6680b 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -60,8 +60,9 @@ config VIDEO_TDA1997X
+ tristate "NXP TDA1997x HDMI receiver"
+ depends on VIDEO_V4L2 && I2C && VIDEO_V4L2_SUBDEV_API
+ depends on SND_SOC
+- select SND_PCM
+ select HDMI
++ select SND_PCM
++ select V4L2_FWNODE
+ ---help---
+ V4L2 subdevice driver for the NXP TDA1997x HDMI receivers.
+
+diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
+index f01964c36ad5..a4b0a89c7e7e 100644
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -2297,8 +2297,8 @@ static int adv76xx_set_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid)
+ edid->blocks = 2;
+ return -E2BIG;
+ }
+- pa = cec_get_edid_phys_addr(edid->edid, edid->blocks * 128, &spa_loc);
+- err = cec_phys_addr_validate(pa, &pa, NULL);
++ pa = v4l2_get_edid_phys_addr(edid->edid, edid->blocks * 128, &spa_loc);
++ err = v4l2_phys_addr_validate(pa, &pa, NULL);
+ if (err)
+ return err;
+
+diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
+index bb43a75ed6d0..58662ba92d4f 100644
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -791,8 +791,8 @@ static int edid_write_hdmi_segment(struct v4l2_subdev *sd, u8 port)
+ return 0;
+ }
+
+- pa = cec_get_edid_phys_addr(edid, 256, &spa_loc);
+- err = cec_phys_addr_validate(pa, &pa, NULL);
++ pa = v4l2_get_edid_phys_addr(edid, 256, &spa_loc);
++ err = v4l2_phys_addr_validate(pa, &pa, NULL);
+ if (err)
+ return err;
+
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index 26070fb6ce4e..e4c0a27b636a 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1789,7 +1789,7 @@ static int tc358743_s_edid(struct v4l2_subdev *sd,
+ return -E2BIG;
+ }
+ pa = cec_get_edid_phys_addr(edid->edid, edid->blocks * 128, NULL);
+- err = cec_phys_addr_validate(pa, &pa, NULL);
++ err = v4l2_phys_addr_validate(pa, &pa, NULL);
+ if (err)
+ return err;
+
+diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c
+index d38682265892..1d9c028e52cb 100644
+--- a/drivers/media/platform/stm32/stm32-dcmi.c
++++ b/drivers/media/platform/stm32/stm32-dcmi.c
+@@ -1681,7 +1681,7 @@ static int dcmi_probe(struct platform_device *pdev)
+ if (irq <= 0) {
+ if (irq != -EPROBE_DEFER)
+ dev_err(&pdev->dev, "Could not get irq\n");
+- return irq;
++ return irq ? irq : -ENXIO;
+ }
+
+ dcmi->res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
+index 462099a141e4..7b8cf661f238 100644
+--- a/drivers/media/platform/vim2m.c
++++ b/drivers/media/platform/vim2m.c
+@@ -3,7 +3,8 @@
+ *
+ * This is a virtual device driver for testing mem-to-mem videobuf framework.
+ * It simulates a device that uses memory buffers for both source and
+- * destination, processes the data and issues an "irq" (simulated by a timer).
++ * destination, processes the data and issues an "irq" (simulated by a delayed
++ * workqueue).
+ * The device is capable of multi-instance, multi-buffer-per-transaction
+ * operation (via the mem2mem framework).
+ *
+@@ -19,7 +20,6 @@
+ #include <linux/module.h>
+ #include <linux/delay.h>
+ #include <linux/fs.h>
+-#include <linux/timer.h>
+ #include <linux/sched.h>
+ #include <linux/slab.h>
+
+@@ -148,7 +148,7 @@ struct vim2m_dev {
+ struct mutex dev_mutex;
+ spinlock_t irqlock;
+
+- struct timer_list timer;
++ struct delayed_work work_run;
+
+ struct v4l2_m2m_dev *m2m_dev;
+ };
+@@ -336,12 +336,6 @@ static int device_process(struct vim2m_ctx *ctx,
+ return 0;
+ }
+
+-static void schedule_irq(struct vim2m_dev *dev, int msec_timeout)
+-{
+- dprintk(dev, "Scheduling a simulated irq\n");
+- mod_timer(&dev->timer, jiffies + msecs_to_jiffies(msec_timeout));
+-}
+-
+ /*
+ * mem2mem callbacks
+ */
+@@ -387,13 +381,14 @@ static void device_run(void *priv)
+
+ device_process(ctx, src_buf, dst_buf);
+
+- /* Run a timer, which simulates a hardware irq */
+- schedule_irq(dev, ctx->transtime);
++ /* Run delayed work, which simulates a hardware irq */
++ schedule_delayed_work(&dev->work_run, msecs_to_jiffies(ctx->transtime));
+ }
+
+-static void device_isr(struct timer_list *t)
++static void device_work(struct work_struct *w)
+ {
+- struct vim2m_dev *vim2m_dev = from_timer(vim2m_dev, t, timer);
++ struct vim2m_dev *vim2m_dev =
++ container_of(w, struct vim2m_dev, work_run.work);
+ struct vim2m_ctx *curr_ctx;
+ struct vb2_v4l2_buffer *src_vb, *dst_vb;
+ unsigned long flags;
+@@ -802,9 +797,13 @@ static int vim2m_start_streaming(struct vb2_queue *q, unsigned count)
+ static void vim2m_stop_streaming(struct vb2_queue *q)
+ {
+ struct vim2m_ctx *ctx = vb2_get_drv_priv(q);
++ struct vim2m_dev *dev = ctx->dev;
+ struct vb2_v4l2_buffer *vbuf;
+ unsigned long flags;
+
++ if (v4l2_m2m_get_curr_priv(dev->m2m_dev) == ctx)
++ cancel_delayed_work_sync(&dev->work_run);
++
+ for (;;) {
+ if (V4L2_TYPE_IS_OUTPUT(q->type))
+ vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+@@ -1015,6 +1014,7 @@ static int vim2m_probe(struct platform_device *pdev)
+ vfd = &dev->vfd;
+ vfd->lock = &dev->dev_mutex;
+ vfd->v4l2_dev = &dev->v4l2_dev;
++ INIT_DELAYED_WORK(&dev->work_run, device_work);
+
+ ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0);
+ if (ret) {
+@@ -1026,7 +1026,6 @@ static int vim2m_probe(struct platform_device *pdev)
+ v4l2_info(&dev->v4l2_dev,
+ "Device registered as /dev/video%d\n", vfd->num);
+
+- timer_setup(&dev->timer, device_isr, 0);
+ platform_set_drvdata(pdev, dev);
+
+ dev->m2m_dev = v4l2_m2m_init(&m2m_ops);
+@@ -1083,7 +1082,6 @@ static int vim2m_remove(struct platform_device *pdev)
+ media_device_cleanup(&dev->mdev);
+ #endif
+ v4l2_m2m_release(dev->m2m_dev);
+- del_timer_sync(&dev->timer);
+ video_unregister_device(&dev->vfd);
+ v4l2_device_unregister(&dev->v4l2_dev);
+
+diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
+index 3b09ffceefd5..2e273f4dfc29 100644
+--- a/drivers/media/platform/vivid/vivid-vid-cap.c
++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
+@@ -1724,7 +1724,7 @@ int vidioc_s_edid(struct file *file, void *_fh,
+ return -E2BIG;
+ }
+ phys_addr = cec_get_edid_phys_addr(edid->edid, edid->blocks * 128, NULL);
+- ret = cec_phys_addr_validate(phys_addr, &phys_addr, NULL);
++ ret = v4l2_phys_addr_validate(phys_addr, &phys_addr, NULL);
+ if (ret)
+ return ret;
+
+@@ -1740,7 +1740,7 @@ set_phys_addr:
+
+ for (i = 0; i < MAX_OUTPUTS && dev->cec_tx_adap[i]; i++)
+ cec_s_phys_addr(dev->cec_tx_adap[i],
+- cec_phys_addr_for_input(phys_addr, i + 1),
++ v4l2_phys_addr_for_input(phys_addr, i + 1),
+ false);
+ return 0;
+ }
+diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c
+index 2079861d2270..e108e9befb77 100644
+--- a/drivers/media/platform/vivid/vivid-vid-common.c
++++ b/drivers/media/platform/vivid/vivid-vid-common.c
+@@ -863,7 +863,7 @@ int vidioc_g_edid(struct file *file, void *_fh,
+ if (edid->blocks > dev->edid_blocks - edid->start_block)
+ edid->blocks = dev->edid_blocks - edid->start_block;
+ if (adap)
+- cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr);
++ v4l2_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr);
+ memcpy(edid->edid, dev->edid + edid->start_block * 128, edid->blocks * 128);
+ return 0;
+ }
+diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
+index c7c600c1f63b..a24b40dfec97 100644
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -15,6 +15,7 @@
+ #include <media/v4l2-dv-timings.h>
+ #include <linux/math64.h>
+ #include <linux/hdmi.h>
++#include <media/cec.h>
+
+ MODULE_AUTHOR("Hans Verkuil");
+ MODULE_DESCRIPTION("V4L2 DV Timings Helper Functions");
+@@ -942,3 +943,153 @@ v4l2_hdmi_rx_colorimetry(const struct hdmi_avi_infoframe *avi,
+ return c;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_hdmi_rx_colorimetry);
++
++/**
++ * v4l2_get_edid_phys_addr() - find and return the physical address
++ *
++ * @edid: pointer to the EDID data
++ * @size: size in bytes of the EDID data
++ * @offset: If not %NULL then the location of the physical address
++ * bytes in the EDID will be returned here. This is set to 0
++ * if there is no physical address found.
++ *
++ * Return: the physical address or CEC_PHYS_ADDR_INVALID if there is none.
++ */
++u16 v4l2_get_edid_phys_addr(const u8 *edid, unsigned int size,
++ unsigned int *offset)
++{
++ unsigned int loc = cec_get_edid_spa_location(edid, size);
++
++ if (offset)
++ *offset = loc;
++ if (loc == 0)
++ return CEC_PHYS_ADDR_INVALID;
++ return (edid[loc] << 8) | edid[loc + 1];
++}
++EXPORT_SYMBOL_GPL(v4l2_get_edid_phys_addr);
++
++/**
++ * v4l2_set_edid_phys_addr() - find and set the physical address
++ *
++ * @edid: pointer to the EDID data
++ * @size: size in bytes of the EDID data
++ * @phys_addr: the new physical address
++ *
++ * This function finds the location of the physical address in the EDID
++ * and fills in the given physical address and updates the checksum
++ * at the end of the EDID block. It does nothing if the EDID doesn't
++ * contain a physical address.
++ */
++void v4l2_set_edid_phys_addr(u8 *edid, unsigned int size, u16 phys_addr)
++{
++ unsigned int loc = cec_get_edid_spa_location(edid, size);
++ u8 sum = 0;
++ unsigned int i;
++
++ if (loc == 0)
++ return;
++ edid[loc] = phys_addr >> 8;
++ edid[loc + 1] = phys_addr & 0xff;
++ loc &= ~0x7f;
++
++ /* update the checksum */
++ for (i = loc; i < loc + 127; i++)
++ sum += edid[i];
++ edid[i] = 256 - sum;
++}
++EXPORT_SYMBOL_GPL(v4l2_set_edid_phys_addr);
++
++/**
++ * v4l2_phys_addr_for_input() - calculate the PA for an input
++ *
++ * @phys_addr: the physical address of the parent
++ * @input: the number of the input port, must be between 1 and 15
++ *
++ * This function calculates a new physical address based on the input
++ * port number. For example:
++ *
++ * PA = 0.0.0.0 and input = 2 becomes 2.0.0.0
++ *
++ * PA = 3.0.0.0 and input = 1 becomes 3.1.0.0
++ *
++ * PA = 3.2.1.0 and input = 5 becomes 3.2.1.5
++ *
++ * PA = 3.2.1.3 and input = 5 becomes f.f.f.f since it maxed out the depth.
++ *
++ * Return: the new physical address or CEC_PHYS_ADDR_INVALID.
++ */
++u16 v4l2_phys_addr_for_input(u16 phys_addr, u8 input)
++{
++ /* Check if input is sane */
++ if (WARN_ON(input == 0 || input > 0xf))
++ return CEC_PHYS_ADDR_INVALID;
++
++ if (phys_addr == 0)
++ return input << 12;
++
++ if ((phys_addr & 0x0fff) == 0)
++ return phys_addr | (input << 8);
++
++ if ((phys_addr & 0x00ff) == 0)
++ return phys_addr | (input << 4);
++
++ if ((phys_addr & 0x000f) == 0)
++ return phys_addr | input;
++
++ /*
++ * All nibbles are used so no valid physical addresses can be assigned
++ * to the input.
++ */
++ return CEC_PHYS_ADDR_INVALID;
++}
++EXPORT_SYMBOL_GPL(v4l2_phys_addr_for_input);
++
++/**
++ * v4l2_phys_addr_validate() - validate a physical address from an EDID
++ *
++ * @phys_addr: the physical address to validate
++ * @parent: if not %NULL, then this is filled with the parents PA.
++ * @port: if not %NULL, then this is filled with the input port.
++ *
++ * This validates a physical address as read from an EDID. If the
++ * PA is invalid (such as 1.0.1.0 since '0' is only allowed at the end),
++ * then it will return -EINVAL.
++ *
++ * The parent PA is passed into %parent and the input port is passed into
++ * %port. For example:
++ *
++ * PA = 0.0.0.0: has parent 0.0.0.0 and input port 0.
++ *
++ * PA = 1.0.0.0: has parent 0.0.0.0 and input port 1.
++ *
++ * PA = 3.2.0.0: has parent 3.0.0.0 and input port 2.
++ *
++ * PA = f.f.f.f: has parent f.f.f.f and input port 0.
++ *
++ * Return: 0 if the PA is valid, -EINVAL if not.
++ */
++int v4l2_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port)
++{
++ int i;
++
++ if (parent)
++ *parent = phys_addr;
++ if (port)
++ *port = 0;
++ if (phys_addr == CEC_PHYS_ADDR_INVALID)
++ return 0;
++ for (i = 0; i < 16; i += 4)
++ if (phys_addr & (0xf << i))
++ break;
++ if (i == 16)
++ return 0;
++ if (parent)
++ *parent = phys_addr & (0xfff0 << i);
++ if (port)
++ *port = (phys_addr >> i) & 0xf;
++ for (i += 4; i < 16; i += 4)
++ if ((phys_addr & (0xf << i)) == 0)
++ return -EINVAL;
++ return 0;
++}
++EXPORT_SYMBOL_GPL(v4l2_phys_addr_validate);
+diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
+index 11841f4b7b2b..dd938a5d0409 100644
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -509,10 +509,10 @@ config INTEL_SOC_PMIC
+ bool "Support for Crystal Cove PMIC"
+ depends on ACPI && HAS_IOMEM && I2C=y && GPIOLIB && COMMON_CLK
+ depends on X86 || COMPILE_TEST
++ depends on I2C_DESIGNWARE_PLATFORM=y
+ select MFD_CORE
+ select REGMAP_I2C
+ select REGMAP_IRQ
+- select I2C_DESIGNWARE_PLATFORM
+ help
+ Select this option to enable support for Crystal Cove PMIC
+ on some Intel SoC systems. The PMIC provides ADC, GPIO,
+@@ -538,10 +538,10 @@ config INTEL_SOC_PMIC_CHTWC
+ bool "Support for Intel Cherry Trail Whiskey Cove PMIC"
+ depends on ACPI && HAS_IOMEM && I2C=y && COMMON_CLK
+ depends on X86 || COMPILE_TEST
++ depends on I2C_DESIGNWARE_PLATFORM=y
+ select MFD_CORE
+ select REGMAP_I2C
+ select REGMAP_IRQ
+- select I2C_DESIGNWARE_PLATFORM
+ help
+ Select this option to enable support for the Intel Cherry Trail
+ Whiskey Cove PMIC found on some Intel Cherry Trail systems.
+@@ -1403,9 +1403,9 @@ config MFD_TPS65217
+ config MFD_TPS68470
+ bool "TI TPS68470 Power Management / LED chips"
+ depends on ACPI && I2C=y
++ depends on I2C_DESIGNWARE_PLATFORM=y
+ select MFD_CORE
+ select REGMAP_I2C
+- select I2C_DESIGNWARE_PLATFORM
+ help
+ If you say yes here you get support for the TPS68470 series of
+ Power Management / LED chips.
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 45baf5d9120e..61f0faddfd88 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -636,6 +636,13 @@ int renesas_sdhi_probe(struct platform_device *pdev,
+ host->ops.card_busy = renesas_sdhi_card_busy;
+ host->ops.start_signal_voltage_switch =
+ renesas_sdhi_start_signal_voltage_switch;
++
++ /* SDR and HS200/400 registers requires HW reset */
++ if (of_data && of_data->scc_offset) {
++ priv->scc_ctl = host->ctl + of_data->scc_offset;
++ host->mmc->caps |= MMC_CAP_HW_RESET;
++ host->hw_reset = renesas_sdhi_hw_reset;
++ }
+ }
+
+ /* Orginally registers were 16 bit apart, could be 32 or 64 nowadays */
+@@ -693,8 +700,6 @@ int renesas_sdhi_probe(struct platform_device *pdev,
+ const struct renesas_sdhi_scc *taps = of_data->taps;
+ bool hit = false;
+
+- host->mmc->caps |= MMC_CAP_HW_RESET;
+-
+ for (i = 0; i < of_data->taps_num; i++) {
+ if (taps[i].clk_rate == 0 ||
+ taps[i].clk_rate == host->mmc->f_max) {
+@@ -707,12 +712,10 @@ int renesas_sdhi_probe(struct platform_device *pdev,
+ if (!hit)
+ dev_warn(&host->pdev->dev, "Unknown clock rate for SDR104\n");
+
+- priv->scc_ctl = host->ctl + of_data->scc_offset;
+ host->init_tuning = renesas_sdhi_init_tuning;
+ host->prepare_tuning = renesas_sdhi_prepare_tuning;
+ host->select_tuning = renesas_sdhi_select_tuning;
+ host->check_scc_error = renesas_sdhi_check_scc_error;
+- host->hw_reset = renesas_sdhi_hw_reset;
+ host->prepare_hs400_tuning =
+ renesas_sdhi_prepare_hs400_tuning;
+ host->hs400_downgrade = renesas_sdhi_disable_scc;
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index c4115bae5db1..71794391f48f 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -1577,6 +1577,8 @@ static const struct pci_device_id pci_ids[] = {
+ SDHCI_PCI_DEVICE(INTEL, CNPH_SD, intel_byt_sd),
+ SDHCI_PCI_DEVICE(INTEL, ICP_EMMC, intel_glk_emmc),
+ SDHCI_PCI_DEVICE(INTEL, ICP_SD, intel_byt_sd),
++ SDHCI_PCI_DEVICE(INTEL, CML_EMMC, intel_glk_emmc),
++ SDHCI_PCI_DEVICE(INTEL, CML_SD, intel_byt_sd),
+ SDHCI_PCI_DEVICE(O2, 8120, o2),
+ SDHCI_PCI_DEVICE(O2, 8220, o2),
+ SDHCI_PCI_DEVICE(O2, 8221, o2),
+diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h
+index 2ef0bdca9197..6f04a62b2998 100644
+--- a/drivers/mmc/host/sdhci-pci.h
++++ b/drivers/mmc/host/sdhci-pci.h
+@@ -50,6 +50,8 @@
+ #define PCI_DEVICE_ID_INTEL_CNPH_SD 0xa375
+ #define PCI_DEVICE_ID_INTEL_ICP_EMMC 0x34c4
+ #define PCI_DEVICE_ID_INTEL_ICP_SD 0x34f8
++#define PCI_DEVICE_ID_INTEL_CML_EMMC 0x02c4
++#define PCI_DEVICE_ID_INTEL_CML_SD 0x02f5
+
+ #define PCI_DEVICE_ID_SYSKONNECT_8000 0x8000
+ #define PCI_DEVICE_ID_VIA_95D0 0x95d0
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+index 91ca77c7571c..b4347806a59e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+@@ -77,10 +77,13 @@
+ #define IWL_22000_HR_FW_PRE "iwlwifi-Qu-a0-hr-a0-"
+ #define IWL_22000_HR_CDB_FW_PRE "iwlwifi-QuIcp-z0-hrcdb-a0-"
+ #define IWL_22000_HR_A_F0_FW_PRE "iwlwifi-QuQnj-f0-hr-a0-"
+-#define IWL_22000_HR_B_FW_PRE "iwlwifi-Qu-b0-hr-b0-"
++#define IWL_22000_HR_B_F0_FW_PRE "iwlwifi-Qu-b0-hr-b0-"
++#define IWL_22000_QU_B_HR_B_FW_PRE "iwlwifi-Qu-b0-hr-b0-"
++#define IWL_22000_HR_B_FW_PRE "iwlwifi-QuQnj-b0-hr-b0-"
+ #define IWL_22000_JF_B0_FW_PRE "iwlwifi-QuQnj-a0-jf-b0-"
+ #define IWL_22000_HR_A0_FW_PRE "iwlwifi-QuQnj-a0-hr-a0-"
+ #define IWL_22000_SU_Z0_FW_PRE "iwlwifi-su-z0-"
++#define IWL_QU_B_JF_B_FW_PRE "iwlwifi-Qu-b0-jf-b0-"
+
+ #define IWL_22000_HR_MODULE_FIRMWARE(api) \
+ IWL_22000_HR_FW_PRE __stringify(api) ".ucode"
+@@ -88,7 +91,11 @@
+ IWL_22000_JF_FW_PRE __stringify(api) ".ucode"
+ #define IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(api) \
+ IWL_22000_HR_A_F0_FW_PRE __stringify(api) ".ucode"
+-#define IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(api) \
++#define IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(api) \
++ IWL_22000_HR_B_F0_FW_PRE __stringify(api) ".ucode"
++#define IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(api) \
++ IWL_22000_QU_B_HR_B_FW_PRE __stringify(api) ".ucode"
++#define IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(api) \
+ IWL_22000_HR_B_FW_PRE __stringify(api) ".ucode"
+ #define IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(api) \
+ IWL_22000_JF_B0_FW_PRE __stringify(api) ".ucode"
+@@ -96,6 +103,8 @@
+ IWL_22000_HR_A0_FW_PRE __stringify(api) ".ucode"
+ #define IWL_22000_SU_Z0_MODULE_FIRMWARE(api) \
+ IWL_22000_SU_Z0_FW_PRE __stringify(api) ".ucode"
++#define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
++ IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
+
+ #define NVM_HW_SECTION_NUM_FAMILY_22000 10
+
+@@ -190,7 +199,54 @@ const struct iwl_cfg iwl22000_2ac_cfg_jf = {
+
+ const struct iwl_cfg iwl22000_2ax_cfg_hr = {
+ .name = "Intel(R) Dual Band Wireless AX 22000",
+- .fw_name_pre = IWL_22000_HR_FW_PRE,
++ .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
++ IWL_DEVICE_22500,
++ /*
++ * This device doesn't support receiving BlockAck with a large bitmap
++ * so we need to restrict the size of transmitted aggregation to the
++ * HT size; mac80211 would otherwise pick the HE max (256) by default.
++ */
++ .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
++};
++
++/*
++ * All JF radio modules are part of the 9000 series, but the MAC part
++ * looks more like 22000. That's why this device is here, but called
++ * 9560 nevertheless.
++ */
++const struct iwl_cfg iwl9461_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Intel(R) Wireless-AC 9461",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg iwl9462_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Intel(R) Wireless-AC 9462",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg iwl9560_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Intel(R) Wireless-AC 9560",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg killer1550i_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg killer1550s_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg iwl22000_2ax_cfg_jf = {
++ .name = "Intel(R) Dual Band Wireless AX 22000",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
+ IWL_DEVICE_22500,
+ /*
+ * This device doesn't support receiving BlockAck with a large bitmap
+@@ -264,7 +320,10 @@ const struct iwl_cfg iwl22560_2ax_cfg_su_cdb = {
+ MODULE_FIRMWARE(IWL_22000_HR_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_SU_Z0_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL_QU_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+index 12fddcf15bab..2e9fd7a30398 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+@@ -574,11 +574,18 @@ extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
+ extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
+ extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_hr;
++extern const struct iwl_cfg iwl9461_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg iwl9462_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg iwl9560_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg killer1550i_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg killer1550s_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg iwl22000_2ax_cfg_jf;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0_f0;
++extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0_f0;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_jf_b0;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0;
+ extern const struct iwl_cfg iwl22560_2ax_cfg_su_cdb;
+-#endif /* CONFIG_IWLMVM */
++#endif /* CPTCFG_IWLMVM || CPTCFG_IWLFMAC */
+
+ #endif /* __IWL_CONFIG_H__ */
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 5d65500a8aa7..0982bd99b1c3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -601,6 +601,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x2526, 0x4018, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x4034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+@@ -696,34 +697,33 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x31DC, 0x40A4, iwl9462_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x4234, iwl9560_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x42A4, iwl9462_2ac_cfg_shared_clk)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0038, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x003C, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0060, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0064, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x00A0, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x00A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0230, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0234, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0238, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x023C, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0260, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0264, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x02A0, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x02A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x4034, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x40A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x4234, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x42A4, iwl9462_2ac_cfg_soc)},
++
++ {IWL_PCI_DEVICE(0x34F0, 0x0030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0038, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x003C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++
+ {IWL_PCI_DEVICE(0x3DF0, 0x0030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x3DF0, 0x0034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x3DF0, 0x0038, iwl9560_2ac_cfg_soc)},
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c b/drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c
+index 6542644bc325..cec31f0c3017 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c
+@@ -402,7 +402,7 @@ void mt76x2_mac_write_txwi(struct mt76x2_dev *dev, struct mt76x2_txwi *txwi,
+ ccmp_pn[6] = pn >> 32;
+ ccmp_pn[7] = pn >> 40;
+ txwi->iv = *((__le32 *)&ccmp_pn[0]);
+- txwi->eiv = *((__le32 *)&ccmp_pn[1]);
++ txwi->eiv = *((__le32 *)&ccmp_pn[4]);
+ }
+
+ spin_lock_bh(&dev->mt76.lock);
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 67dec8860bf3..565bddcfd130 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -206,7 +206,7 @@ static LIST_HEAD(nvme_fc_lport_list);
+ static DEFINE_IDA(nvme_fc_local_port_cnt);
+ static DEFINE_IDA(nvme_fc_ctrl_cnt);
+
+-
++static struct workqueue_struct *nvme_fc_wq;
+
+ /*
+ * These items are short-term. They will eventually be moved into
+@@ -2053,7 +2053,7 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
+ */
+ if (ctrl->ctrl.state == NVME_CTRL_CONNECTING) {
+ active = atomic_xchg(&ctrl->err_work_active, 1);
+- if (!active && !schedule_work(&ctrl->err_work)) {
++ if (!active && !queue_work(nvme_fc_wq, &ctrl->err_work)) {
+ atomic_set(&ctrl->err_work_active, 0);
+ WARN_ON(1);
+ }
+@@ -3321,6 +3321,10 @@ static int __init nvme_fc_init_module(void)
+ {
+ int ret;
+
++ nvme_fc_wq = alloc_workqueue("nvme_fc_wq", WQ_MEM_RECLAIM, 0);
++ if (!nvme_fc_wq)
++ return -ENOMEM;
++
+ /*
+ * NOTE:
+ * It is expected that in the future the kernel will combine
+@@ -3338,7 +3342,8 @@ static int __init nvme_fc_init_module(void)
+ fc_class = class_create(THIS_MODULE, "fc");
+ if (IS_ERR(fc_class)) {
+ pr_err("couldn't register class fc\n");
+- return PTR_ERR(fc_class);
++ ret = PTR_ERR(fc_class);
++ goto out_destroy_wq;
+ }
+
+ /*
+@@ -3362,6 +3367,9 @@ out_destroy_device:
+ device_destroy(fc_class, MKDEV(0, 0));
+ out_destroy_class:
+ class_destroy(fc_class);
++out_destroy_wq:
++ destroy_workqueue(nvme_fc_wq);
++
+ return ret;
+ }
+
+@@ -3378,6 +3386,7 @@ static void __exit nvme_fc_exit_module(void)
+
+ device_destroy(fc_class, MKDEV(0, 0));
+ class_destroy(fc_class);
++ destroy_workqueue(nvme_fc_wq);
+ }
+
+ module_init(nvme_fc_init_module);
+diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
+index acd50920c2ff..b57ee79f6d69 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -356,7 +356,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ dev_err(dev, "Missing *config* reg space\n");
+ }
+
+- bridge = pci_alloc_host_bridge(0);
++ bridge = devm_pci_alloc_host_bridge(dev, 0);
+ if (!bridge)
+ return -ENOMEM;
+
+@@ -367,7 +367,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+
+ ret = devm_request_pci_bus_resources(dev, &bridge->windows);
+ if (ret)
+- goto error;
++ return ret;
+
+ /* Get the I/O and memory ranges from DT */
+ resource_list_for_each_entry_safe(win, tmp, &bridge->windows) {
+@@ -411,8 +411,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ resource_size(pp->cfg));
+ if (!pci->dbi_base) {
+ dev_err(dev, "Error with ioremap\n");
+- ret = -ENOMEM;
+- goto error;
++ return -ENOMEM;
+ }
+ }
+
+@@ -423,8 +422,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ pp->cfg0_base, pp->cfg0_size);
+ if (!pp->va_cfg0_base) {
+ dev_err(dev, "Error with ioremap in function\n");
+- ret = -ENOMEM;
+- goto error;
++ return -ENOMEM;
+ }
+ }
+
+@@ -434,8 +432,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ pp->cfg1_size);
+ if (!pp->va_cfg1_base) {
+ dev_err(dev, "Error with ioremap\n");
+- ret = -ENOMEM;
+- goto error;
++ return -ENOMEM;
+ }
+ }
+
+@@ -458,14 +455,14 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ pp->num_vectors == 0) {
+ dev_err(dev,
+ "Invalid number of vectors\n");
+- goto error;
++ return -EINVAL;
+ }
+ }
+
+ if (!pp->ops->msi_host_init) {
+ ret = dw_pcie_allocate_domains(pp);
+ if (ret)
+- goto error;
++ return ret;
+
+ if (pp->msi_irq)
+ irq_set_chained_handler_and_data(pp->msi_irq,
+@@ -474,7 +471,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ } else {
+ ret = pp->ops->msi_host_init(pp);
+ if (ret < 0)
+- goto error;
++ return ret;
+ }
+ }
+
+@@ -514,8 +511,6 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ err_free_msi:
+ if (pci_msi_enabled() && !pp->ops->msi_host_init)
+ dw_pcie_free_msi(pp);
+-error:
+- pci_free_host_bridge(bridge);
+ return ret;
+ }
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 87a8887fd4d3..e292801fff7f 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -1091,7 +1091,6 @@ static int qcom_pcie_host_init(struct pcie_port *pp)
+ struct qcom_pcie *pcie = to_qcom_pcie(pci);
+ int ret;
+
+- pm_runtime_get_sync(pci->dev);
+ qcom_ep_reset_assert(pcie);
+
+ ret = pcie->ops->init(pcie);
+@@ -1128,7 +1127,6 @@ err_disable_phy:
+ phy_power_off(pcie->phy);
+ err_deinit:
+ pcie->ops->deinit(pcie);
+- pm_runtime_put(pci->dev);
+
+ return ret;
+ }
+@@ -1218,6 +1216,12 @@ static int qcom_pcie_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ pm_runtime_enable(dev);
++ ret = pm_runtime_get_sync(dev);
++ if (ret < 0) {
++ pm_runtime_disable(dev);
++ return ret;
++ }
++
+ pci->dev = dev;
+ pci->ops = &dw_pcie_ops;
+ pp = &pci->pp;
+@@ -1226,45 +1230,57 @@ static int qcom_pcie_probe(struct platform_device *pdev)
+
+ pcie->ops = of_device_get_match_data(dev);
+
+- pcie->reset = devm_gpiod_get_optional(dev, "perst", GPIOD_OUT_LOW);
+- if (IS_ERR(pcie->reset))
+- return PTR_ERR(pcie->reset);
++ pcie->reset = devm_gpiod_get_optional(dev, "perst", GPIOD_OUT_HIGH);
++ if (IS_ERR(pcie->reset)) {
++ ret = PTR_ERR(pcie->reset);
++ goto err_pm_runtime_put;
++ }
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "parf");
+ pcie->parf = devm_ioremap_resource(dev, res);
+- if (IS_ERR(pcie->parf))
+- return PTR_ERR(pcie->parf);
++ if (IS_ERR(pcie->parf)) {
++ ret = PTR_ERR(pcie->parf);
++ goto err_pm_runtime_put;
++ }
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dbi");
+ pci->dbi_base = devm_pci_remap_cfg_resource(dev, res);
+- if (IS_ERR(pci->dbi_base))
+- return PTR_ERR(pci->dbi_base);
++ if (IS_ERR(pci->dbi_base)) {
++ ret = PTR_ERR(pci->dbi_base);
++ goto err_pm_runtime_put;
++ }
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "elbi");
+ pcie->elbi = devm_ioremap_resource(dev, res);
+- if (IS_ERR(pcie->elbi))
+- return PTR_ERR(pcie->elbi);
++ if (IS_ERR(pcie->elbi)) {
++ ret = PTR_ERR(pcie->elbi);
++ goto err_pm_runtime_put;
++ }
+
+ pcie->phy = devm_phy_optional_get(dev, "pciephy");
+- if (IS_ERR(pcie->phy))
+- return PTR_ERR(pcie->phy);
++ if (IS_ERR(pcie->phy)) {
++ ret = PTR_ERR(pcie->phy);
++ goto err_pm_runtime_put;
++ }
+
+ ret = pcie->ops->get_resources(pcie);
+ if (ret)
+- return ret;
++ goto err_pm_runtime_put;
+
+ pp->ops = &qcom_pcie_dw_ops;
+
+ if (IS_ENABLED(CONFIG_PCI_MSI)) {
+ pp->msi_irq = platform_get_irq_byname(pdev, "msi");
+- if (pp->msi_irq < 0)
+- return pp->msi_irq;
++ if (pp->msi_irq < 0) {
++ ret = pp->msi_irq;
++ goto err_pm_runtime_put;
++ }
+ }
+
+ ret = phy_init(pcie->phy);
+ if (ret) {
+ pm_runtime_disable(&pdev->dev);
+- return ret;
++ goto err_pm_runtime_put;
+ }
+
+ platform_set_drvdata(pdev, pcie);
+@@ -1273,10 +1289,16 @@ static int qcom_pcie_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(dev, "cannot initialize host\n");
+ pm_runtime_disable(&pdev->dev);
+- return ret;
++ goto err_pm_runtime_put;
+ }
+
+ return 0;
++
++err_pm_runtime_put:
++ pm_runtime_put(dev);
++ pm_runtime_disable(dev);
++
++ return ret;
+ }
+
+ static const struct of_device_id qcom_pcie_match[] = {
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 28c64f84bfe7..06be52912dcd 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5082,59 +5082,95 @@ static void quirk_switchtec_ntb_dma_alias(struct pci_dev *pdev)
+ pci_iounmap(pdev, mmio);
+ pci_disable_device(pdev);
+ }
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8531,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8532,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8533,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8534,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8535,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8536,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8543,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8544,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8545,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8546,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8551,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8552,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8553,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8554,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8555,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8556,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8561,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8562,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8563,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8564,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8565,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8566,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8571,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8572,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8573,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8574,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8575,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8576,
+- quirk_switchtec_ntb_dma_alias);
++#define SWITCHTEC_QUIRK(vid) \
++ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, vid, \
++ quirk_switchtec_ntb_dma_alias)
++
++SWITCHTEC_QUIRK(0x8531); /* PFX 24xG3 */
++SWITCHTEC_QUIRK(0x8532); /* PFX 32xG3 */
++SWITCHTEC_QUIRK(0x8533); /* PFX 48xG3 */
++SWITCHTEC_QUIRK(0x8534); /* PFX 64xG3 */
++SWITCHTEC_QUIRK(0x8535); /* PFX 80xG3 */
++SWITCHTEC_QUIRK(0x8536); /* PFX 96xG3 */
++SWITCHTEC_QUIRK(0x8541); /* PSX 24xG3 */
++SWITCHTEC_QUIRK(0x8542); /* PSX 32xG3 */
++SWITCHTEC_QUIRK(0x8543); /* PSX 48xG3 */
++SWITCHTEC_QUIRK(0x8544); /* PSX 64xG3 */
++SWITCHTEC_QUIRK(0x8545); /* PSX 80xG3 */
++SWITCHTEC_QUIRK(0x8546); /* PSX 96xG3 */
++SWITCHTEC_QUIRK(0x8551); /* PAX 24XG3 */
++SWITCHTEC_QUIRK(0x8552); /* PAX 32XG3 */
++SWITCHTEC_QUIRK(0x8553); /* PAX 48XG3 */
++SWITCHTEC_QUIRK(0x8554); /* PAX 64XG3 */
++SWITCHTEC_QUIRK(0x8555); /* PAX 80XG3 */
++SWITCHTEC_QUIRK(0x8556); /* PAX 96XG3 */
++SWITCHTEC_QUIRK(0x8561); /* PFXL 24XG3 */
++SWITCHTEC_QUIRK(0x8562); /* PFXL 32XG3 */
++SWITCHTEC_QUIRK(0x8563); /* PFXL 48XG3 */
++SWITCHTEC_QUIRK(0x8564); /* PFXL 64XG3 */
++SWITCHTEC_QUIRK(0x8565); /* PFXL 80XG3 */
++SWITCHTEC_QUIRK(0x8566); /* PFXL 96XG3 */
++SWITCHTEC_QUIRK(0x8571); /* PFXI 24XG3 */
++SWITCHTEC_QUIRK(0x8572); /* PFXI 32XG3 */
++SWITCHTEC_QUIRK(0x8573); /* PFXI 48XG3 */
++SWITCHTEC_QUIRK(0x8574); /* PFXI 64XG3 */
++SWITCHTEC_QUIRK(0x8575); /* PFXI 80XG3 */
++SWITCHTEC_QUIRK(0x8576); /* PFXI 96XG3 */
++
++/*
++ * On Lenovo Thinkpad P50 SKUs with a Nvidia Quadro M1000M, the BIOS does
++ * not always reset the secondary Nvidia GPU between reboots if the system
++ * is configured to use Hybrid Graphics mode. This results in the GPU
++ * being left in whatever state it was in during the *previous* boot, which
++ * causes spurious interrupts from the GPU, which in turn causes us to
++ * disable the wrong IRQ and end up breaking the touchpad. Unsurprisingly,
++ * this also completely breaks nouveau.
++ *
++ * Luckily, it seems a simple reset of the Nvidia GPU brings it back to a
++ * clean state and fixes all these issues.
++ *
++ * When the machine is configured in Dedicated display mode, the issue
++ * doesn't occur. Fortunately the GPU advertises NoReset+ when in this
++ * mode, so we can detect that and avoid resetting it.
++ */
++static void quirk_reset_lenovo_thinkpad_p50_nvgpu(struct pci_dev *pdev)
++{
++ void __iomem *map;
++ int ret;
++
++ if (pdev->subsystem_vendor != PCI_VENDOR_ID_LENOVO ||
++ pdev->subsystem_device != 0x222e ||
++ !pdev->reset_fn)
++ return;
++
++ if (pci_enable_device_mem(pdev))
++ return;
++
++ /*
++ * Based on nvkm_device_ctor() in
++ * drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
++ */
++ map = pci_iomap(pdev, 0, 0x23000);
++ if (!map) {
++ pci_err(pdev, "Can't map MMIO space\n");
++ goto out_disable;
++ }
++
++ /*
++ * Make sure the GPU looks like it's been POSTed before resetting
++ * it.
++ */
++ if (ioread32(map + 0x2240c) & 0x2) {
++ pci_info(pdev, FW_BUG "GPU left initialized by EFI, resetting\n");
++ ret = pci_reset_bus(pdev);
++ if (ret < 0)
++ pci_err(pdev, "Failed to reset GPU: %d\n", ret);
++ }
++
++ iounmap(map);
++out_disable:
++ pci_disable_device(pdev);
++}
++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, 0x13b1,
++ PCI_CLASS_DISPLAY_VGA, 8,
++ quirk_reset_lenovo_thinkpad_p50_nvgpu);
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index e9ab90c19304..602af839421d 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -188,6 +188,14 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ init_completion(&q6v5->stop_done);
+
+ q6v5->wdog_irq = platform_get_irq_byname(pdev, "wdog");
++ if (q6v5->wdog_irq < 0) {
++ if (q6v5->wdog_irq != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "failed to retrieve wdog IRQ: %d\n",
++ q6v5->wdog_irq);
++ return q6v5->wdog_irq;
++ }
++
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->wdog_irq,
+ NULL, q6v5_wdog_interrupt,
+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+@@ -198,8 +206,13 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->fatal_irq = platform_get_irq_byname(pdev, "fatal");
+- if (q6v5->fatal_irq == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (q6v5->fatal_irq < 0) {
++ if (q6v5->fatal_irq != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "failed to retrieve fatal IRQ: %d\n",
++ q6v5->fatal_irq);
++ return q6v5->fatal_irq;
++ }
+
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->fatal_irq,
+ NULL, q6v5_fatal_interrupt,
+@@ -211,8 +224,13 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->ready_irq = platform_get_irq_byname(pdev, "ready");
+- if (q6v5->ready_irq == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (q6v5->ready_irq < 0) {
++ if (q6v5->ready_irq != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "failed to retrieve ready IRQ: %d\n",
++ q6v5->ready_irq);
++ return q6v5->ready_irq;
++ }
+
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->ready_irq,
+ NULL, q6v5_ready_interrupt,
+@@ -224,8 +242,13 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->handover_irq = platform_get_irq_byname(pdev, "handover");
+- if (q6v5->handover_irq == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (q6v5->handover_irq < 0) {
++ if (q6v5->handover_irq != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "failed to retrieve handover IRQ: %d\n",
++ q6v5->handover_irq);
++ return q6v5->handover_irq;
++ }
+
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->handover_irq,
+ NULL, q6v5_handover_interrupt,
+@@ -238,8 +261,13 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ disable_irq(q6v5->handover_irq);
+
+ q6v5->stop_irq = platform_get_irq_byname(pdev, "stop-ack");
+- if (q6v5->stop_irq == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (q6v5->stop_irq < 0) {
++ if (q6v5->stop_irq != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "failed to retrieve stop-ack IRQ: %d\n",
++ q6v5->stop_irq);
++ return q6v5->stop_irq;
++ }
+
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->stop_irq,
+ NULL, q6v5_stop_interrupt,
+diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c
+index d7a4b9eca5d2..6a84b6372897 100644
+--- a/drivers/remoteproc/qcom_q6v5_pil.c
++++ b/drivers/remoteproc/qcom_q6v5_pil.c
+@@ -1132,6 +1132,9 @@ static int q6v5_probe(struct platform_device *pdev)
+ if (!desc)
+ return -EINVAL;
+
++ if (desc->need_mem_protection && !qcom_scm_is_available())
++ return -EPROBE_DEFER;
++
+ rproc = rproc_alloc(&pdev->dev, pdev->name, &q6v5_ops,
+ desc->hexagon_mba_image, sizeof(*qproc));
+ if (!rproc) {
+diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
+index a57b969b8973..3be54651698a 100644
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -777,6 +777,8 @@ static int ap_device_probe(struct device *dev)
+ drvres = ap_drv->flags & AP_DRIVER_FLAG_DEFAULT;
+ if (!!devres != !!drvres)
+ return -ENODEV;
++ /* (re-)init queue's state machine */
++ ap_queue_reinit_state(to_ap_queue(dev));
+ }
+
+ /* Add queue/card to list of active queues/cards */
+@@ -809,6 +811,8 @@ static int ap_device_remove(struct device *dev)
+ struct ap_device *ap_dev = to_ap_dev(dev);
+ struct ap_driver *ap_drv = ap_dev->drv;
+
++ if (is_queue_dev(dev))
++ ap_queue_remove(to_ap_queue(dev));
+ if (ap_drv->remove)
+ ap_drv->remove(ap_dev);
+
+@@ -1446,10 +1450,6 @@ static void ap_scan_bus(struct work_struct *unused)
+ aq->ap_dev.device.parent = &ac->ap_dev.device;
+ dev_set_name(&aq->ap_dev.device,
+ "%02x.%04x", id, dom);
+- /* Start with a device reset */
+- spin_lock_bh(&aq->lock);
+- ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
+- spin_unlock_bh(&aq->lock);
+ /* Register device */
+ rc = device_register(&aq->ap_dev.device);
+ if (rc) {
+diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
+index 5246cd8c16a6..7e85d238767b 100644
+--- a/drivers/s390/crypto/ap_bus.h
++++ b/drivers/s390/crypto/ap_bus.h
+@@ -253,6 +253,7 @@ struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type);
+ void ap_queue_remove(struct ap_queue *aq);
+ void ap_queue_suspend(struct ap_device *ap_dev);
+ void ap_queue_resume(struct ap_device *ap_dev);
++void ap_queue_reinit_state(struct ap_queue *aq);
+
+ struct ap_card *ap_card_create(int id, int queue_depth, int raw_device_type,
+ int comp_device_type, unsigned int functions);
+diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
+index 66f7334bcb03..0aa4b3ccc948 100644
+--- a/drivers/s390/crypto/ap_queue.c
++++ b/drivers/s390/crypto/ap_queue.c
+@@ -718,5 +718,20 @@ void ap_queue_remove(struct ap_queue *aq)
+ {
+ ap_flush_queue(aq);
+ del_timer_sync(&aq->timeout);
++
++ /* reset with zero, also clears irq registration */
++ spin_lock_bh(&aq->lock);
++ ap_zapq(aq->qid);
++ aq->state = AP_STATE_BORKED;
++ spin_unlock_bh(&aq->lock);
+ }
+ EXPORT_SYMBOL(ap_queue_remove);
++
++void ap_queue_reinit_state(struct ap_queue *aq)
++{
++ spin_lock_bh(&aq->lock);
++ aq->state = AP_STATE_RESET_START;
++ ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
++ spin_unlock_bh(&aq->lock);
++}
++EXPORT_SYMBOL(ap_queue_reinit_state);
+diff --git a/drivers/s390/crypto/zcrypt_cex2a.c b/drivers/s390/crypto/zcrypt_cex2a.c
+index f4ae5fa30ec9..ff17a00273f7 100644
+--- a/drivers/s390/crypto/zcrypt_cex2a.c
++++ b/drivers/s390/crypto/zcrypt_cex2a.c
+@@ -198,7 +198,6 @@ static void zcrypt_cex2a_queue_remove(struct ap_device *ap_dev)
+ struct ap_queue *aq = to_ap_queue(&ap_dev->device);
+ struct zcrypt_queue *zq = aq->private;
+
+- ap_queue_remove(aq);
+ if (zq)
+ zcrypt_queue_unregister(zq);
+ }
+diff --git a/drivers/s390/crypto/zcrypt_cex4.c b/drivers/s390/crypto/zcrypt_cex4.c
+index 35d58dbbc4da..2a42e5962317 100644
+--- a/drivers/s390/crypto/zcrypt_cex4.c
++++ b/drivers/s390/crypto/zcrypt_cex4.c
+@@ -273,7 +273,6 @@ static void zcrypt_cex4_queue_remove(struct ap_device *ap_dev)
+ struct ap_queue *aq = to_ap_queue(&ap_dev->device);
+ struct zcrypt_queue *zq = aq->private;
+
+- ap_queue_remove(aq);
+ if (zq)
+ zcrypt_queue_unregister(zq);
+ }
+diff --git a/drivers/s390/crypto/zcrypt_pcixcc.c b/drivers/s390/crypto/zcrypt_pcixcc.c
+index 94d9f7224aea..baa683c3f5d3 100644
+--- a/drivers/s390/crypto/zcrypt_pcixcc.c
++++ b/drivers/s390/crypto/zcrypt_pcixcc.c
+@@ -276,7 +276,6 @@ static void zcrypt_pcixcc_queue_remove(struct ap_device *ap_dev)
+ struct ap_queue *aq = to_ap_queue(&ap_dev->device);
+ struct zcrypt_queue *zq = aq->private;
+
+- ap_queue_remove(aq);
+ if (zq)
+ zcrypt_queue_unregister(zq);
+ }
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index 3c86e27f094d..aff073a5b52b 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -1594,6 +1594,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+ struct zfcp_fsf_req *req;
++ unsigned long req_id = 0;
+ int retval = -EIO;
+
+ spin_lock_irq(&qdio->req_q_lock);
+@@ -1616,6 +1617,8 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ hton24(req->qtcb->bottom.support.d_id, wka_port->d_id);
+ req->data = wka_port;
+
++ req_id = req->req_id;
++
+ zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
+ retval = zfcp_fsf_req_send(req);
+ if (retval)
+@@ -1623,7 +1626,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ out:
+ spin_unlock_irq(&qdio->req_q_lock);
+ if (!retval)
+- zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
++ zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req_id);
+ return retval;
+ }
+
+@@ -1649,6 +1652,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+ struct zfcp_fsf_req *req;
++ unsigned long req_id = 0;
+ int retval = -EIO;
+
+ spin_lock_irq(&qdio->req_q_lock);
+@@ -1671,6 +1675,8 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ req->data = wka_port;
+ req->qtcb->header.port_handle = wka_port->handle;
+
++ req_id = req->req_id;
++
+ zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
+ retval = zfcp_fsf_req_send(req);
+ if (retval)
+@@ -1678,7 +1684,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ out:
+ spin_unlock_irq(&qdio->req_q_lock);
+ if (!retval)
+- zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);
++ zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req_id);
+ return retval;
+ }
+
+diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
+index ec54538f7ae1..67efdf25657f 100644
+--- a/drivers/s390/virtio/virtio_ccw.c
++++ b/drivers/s390/virtio/virtio_ccw.c
+@@ -132,6 +132,7 @@ struct airq_info {
+ struct airq_iv *aiv;
+ };
+ static struct airq_info *airq_areas[MAX_AIRQ_AREAS];
++static DEFINE_MUTEX(airq_areas_lock);
+
+ #define CCW_CMD_SET_VQ 0x13
+ #define CCW_CMD_VDEV_RESET 0x33
+@@ -244,9 +245,11 @@ static unsigned long get_airq_indicator(struct virtqueue *vqs[], int nvqs,
+ unsigned long bit, flags;
+
+ for (i = 0; i < MAX_AIRQ_AREAS && !indicator_addr; i++) {
++ mutex_lock(&airq_areas_lock);
+ if (!airq_areas[i])
+ airq_areas[i] = new_airq_info();
+ info = airq_areas[i];
++ mutex_unlock(&airq_areas_lock);
+ if (!info)
+ return 0;
+ write_lock_irqsave(&info->lock, flags);
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 806ceabcabc3..bc37666f998e 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -5218,7 +5218,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ {
+ u32 max_sectors_1;
+ u32 max_sectors_2, tmp_sectors, msix_enable;
+- u32 scratch_pad_2, scratch_pad_3, scratch_pad_4;
++ u32 scratch_pad_2, scratch_pad_3, scratch_pad_4, status_reg;
+ resource_size_t base_addr;
+ struct megasas_register_set __iomem *reg_set;
+ struct megasas_ctrl_info *ctrl_info = NULL;
+@@ -5226,6 +5226,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ int i, j, loop, fw_msix_count = 0;
+ struct IOV_111 *iovPtr;
+ struct fusion_context *fusion;
++ bool do_adp_reset = true;
+
+ fusion = instance->ctrl_context;
+
+@@ -5274,19 +5275,29 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ }
+
+ if (megasas_transition_to_ready(instance, 0)) {
+- atomic_set(&instance->fw_reset_no_pci_access, 1);
+- instance->instancet->adp_reset
+- (instance, instance->reg_set);
+- atomic_set(&instance->fw_reset_no_pci_access, 0);
+- dev_info(&instance->pdev->dev,
+- "FW restarted successfully from %s!\n",
+- __func__);
++ if (instance->adapter_type >= INVADER_SERIES) {
++ status_reg = instance->instancet->read_fw_status_reg(
++ instance->reg_set);
++ do_adp_reset = status_reg & MFI_RESET_ADAPTER;
++ }
+
+- /*waitting for about 30 second before retry*/
+- ssleep(30);
++ if (do_adp_reset) {
++ atomic_set(&instance->fw_reset_no_pci_access, 1);
++ instance->instancet->adp_reset
++ (instance, instance->reg_set);
++ atomic_set(&instance->fw_reset_no_pci_access, 0);
++ dev_info(&instance->pdev->dev,
++ "FW restarted successfully from %s!\n",
++ __func__);
+
+- if (megasas_transition_to_ready(instance, 0))
++ /*waiting for about 30 second before retry*/
++ ssleep(30);
++
++ if (megasas_transition_to_ready(instance, 0))
++ goto fail_ready_state;
++ } else {
+ goto fail_ready_state;
++ }
+ }
+
+ megasas_init_ctrl_params(instance);
+@@ -5325,12 +5336,29 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ instance->msix_vectors = (scratch_pad_2
+ & MR_MAX_REPLY_QUEUES_OFFSET) + 1;
+ fw_msix_count = instance->msix_vectors;
+- } else { /* Invader series supports more than 8 MSI-x vectors*/
++ } else {
+ instance->msix_vectors = ((scratch_pad_2
+ & MR_MAX_REPLY_QUEUES_EXT_OFFSET)
+ >> MR_MAX_REPLY_QUEUES_EXT_OFFSET_SHIFT) + 1;
+- if (instance->msix_vectors > 16)
+- instance->msix_combined = true;
++
++ /*
++ * For Invader series, > 8 MSI-x vectors
++ * supported by FW/HW implies combined
++ * reply queue mode is enabled.
++ * For Ventura series, > 16 MSI-x vectors
++ * supported by FW/HW implies combined
++ * reply queue mode is enabled.
++ */
++ switch (instance->adapter_type) {
++ case INVADER_SERIES:
++ if (instance->msix_vectors > 8)
++ instance->msix_combined = true;
++ break;
++ case VENTURA_SERIES:
++ if (instance->msix_vectors > 16)
++ instance->msix_combined = true;
++ break;
++ }
+
+ if (rdpq_enable)
+ instance->is_rdpq = (scratch_pad_2 & MR_RDPQ_MODE_OFFSET) ?
+@@ -6028,13 +6056,13 @@ static int megasas_io_attach(struct megasas_instance *instance)
+ * @instance: Adapter soft state
+ * Description:
+ *
+- * For Ventura, driver/FW will operate in 64bit DMA addresses.
++ * For Ventura, driver/FW will operate in 63bit DMA addresses.
+ *
+ * For invader-
+ * By default, driver/FW will operate in 32bit DMA addresses
+ * for consistent DMA mapping but if 32 bit consistent
+- * DMA mask fails, driver will try with 64 bit consistent
+- * mask provided FW is true 64bit DMA capable
++ * DMA mask fails, driver will try with 63 bit consistent
++ * mask provided FW is true 63bit DMA capable
+ *
+ * For older controllers(Thunderbolt and MFI based adapters)-
+ * driver/FW will operate in 32 bit consistent DMA addresses.
+@@ -6047,15 +6075,15 @@ megasas_set_dma_mask(struct megasas_instance *instance)
+ u32 scratch_pad_2;
+
+ pdev = instance->pdev;
+- consistent_mask = (instance->adapter_type == VENTURA_SERIES) ?
+- DMA_BIT_MASK(64) : DMA_BIT_MASK(32);
++ consistent_mask = (instance->adapter_type >= VENTURA_SERIES) ?
++ DMA_BIT_MASK(63) : DMA_BIT_MASK(32);
+
+ if (IS_DMA64) {
+- if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) &&
++ if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(63)) &&
+ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))
+ goto fail_set_dma_mask;
+
+- if ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) &&
++ if ((*pdev->dev.dma_mask == DMA_BIT_MASK(63)) &&
+ (dma_set_coherent_mask(&pdev->dev, consistent_mask) &&
+ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))) {
+ /*
+@@ -6068,7 +6096,7 @@ megasas_set_dma_mask(struct megasas_instance *instance)
+ if (!(scratch_pad_2 & MR_CAN_HANDLE_64_BIT_DMA_OFFSET))
+ goto fail_set_dma_mask;
+ else if (dma_set_mask_and_coherent(&pdev->dev,
+- DMA_BIT_MASK(64)))
++ DMA_BIT_MASK(63)))
+ goto fail_set_dma_mask;
+ }
+ } else if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))
+@@ -6080,8 +6108,8 @@ megasas_set_dma_mask(struct megasas_instance *instance)
+ instance->consistent_mask_64bit = true;
+
+ dev_info(&pdev->dev, "%s bit DMA mask and %s bit consistent mask\n",
+- ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) ? "64" : "32"),
+- (instance->consistent_mask_64bit ? "64" : "32"));
++ ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) ? "63" : "32"),
++ (instance->consistent_mask_64bit ? "63" : "32"));
+
+ return 0;
+
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index 1f1a05a90d3d..fc08e46a93ca 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3360,15 +3360,15 @@ int qla24xx_async_gpsc(scsi_qla_host_t *vha, fc_port_t *fcport)
+ sp->u.iocb_cmd.timeout = qla2x00_async_iocb_timeout;
+ sp->done = qla24xx_async_gpsc_sp_done;
+
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+-
+ ql_dbg(ql_dbg_disc, vha, 0x205e,
+ "Async-%s %8phC hdl=%x loopid=%x portid=%02x%02x%02x.\n",
+ sp->name, fcport->port_name, sp->handle,
+ fcport->loop_id, fcport->d_id.b.domain,
+ fcport->d_id.b.area, fcport->d_id.b.al_pa);
++
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
+ return rval;
+
+ done_free_sp:
+@@ -3729,13 +3729,14 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id)
+ sp->u.iocb_cmd.timeout = qla2x00_async_iocb_timeout;
+ sp->done = qla2x00_async_gpnid_sp_done;
+
++ ql_dbg(ql_dbg_disc, vha, 0x2067,
++ "Async-%s hdl=%x ID %3phC.\n", sp->name,
++ sp->handle, ct_req->req.port_id.port_id);
++
+ rval = qla2x00_start_sp(sp);
+ if (rval != QLA_SUCCESS)
+ goto done_free_sp;
+
+- ql_dbg(ql_dbg_disc, vha, 0x2067,
+- "Async-%s hdl=%x ID %3phC.\n", sp->name,
+- sp->handle, ct_req->req.port_id.port_id);
+ return rval;
+
+ done_free_sp:
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index ddce32fe0513..39a8f4a671aa 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -247,6 +247,12 @@ qla2x00_async_login(struct scsi_qla_host *vha, fc_port_t *fcport,
+
+ }
+
++ ql_dbg(ql_dbg_disc, vha, 0x2072,
++ "Async-login - %8phC hdl=%x, loopid=%x portid=%02x%02x%02x "
++ "retries=%d.\n", fcport->port_name, sp->handle, fcport->loop_id,
++ fcport->d_id.b.domain, fcport->d_id.b.area, fcport->d_id.b.al_pa,
++ fcport->login_retry);
++
+ rval = qla2x00_start_sp(sp);
+ if (rval != QLA_SUCCESS) {
+ fcport->flags |= FCF_LOGIN_NEEDED;
+@@ -254,11 +260,6 @@ qla2x00_async_login(struct scsi_qla_host *vha, fc_port_t *fcport,
+ goto done_free_sp;
+ }
+
+- ql_dbg(ql_dbg_disc, vha, 0x2072,
+- "Async-login - %8phC hdl=%x, loopid=%x portid=%02x%02x%02x "
+- "retries=%d.\n", fcport->port_name, sp->handle, fcport->loop_id,
+- fcport->d_id.b.domain, fcport->d_id.b.area, fcport->d_id.b.al_pa,
+- fcport->login_retry);
+ return rval;
+
+ done_free_sp:
+@@ -303,15 +304,16 @@ qla2x00_async_logout(struct scsi_qla_host *vha, fc_port_t *fcport)
+ qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
+
+ sp->done = qla2x00_async_logout_sp_done;
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+
+ ql_dbg(ql_dbg_disc, vha, 0x2070,
+ "Async-logout - hdl=%x loop-id=%x portid=%02x%02x%02x %8phC.\n",
+ sp->handle, fcport->loop_id, fcport->d_id.b.domain,
+ fcport->d_id.b.area, fcport->d_id.b.al_pa,
+ fcport->port_name);
++
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
+ return rval;
+
+ done_free_sp:
+@@ -489,13 +491,15 @@ qla2x00_async_adisc(struct scsi_qla_host *vha, fc_port_t *fcport,
+ sp->done = qla2x00_async_adisc_sp_done;
+ if (data[1] & QLA_LOGIO_LOGIN_RETRIED)
+ lio->u.logio.flags |= SRB_LOGIN_RETRIED;
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+
+ ql_dbg(ql_dbg_disc, vha, 0x206f,
+ "Async-adisc - hdl=%x loopid=%x portid=%06x %8phC.\n",
+ sp->handle, fcport->loop_id, fcport->d_id.b24, fcport->port_name);
++
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
++
+ return rval;
+
+ done_free_sp:
+@@ -1161,14 +1165,13 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt)
+
+ sp->done = qla24xx_async_gpdb_sp_done;
+
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+-
+ ql_dbg(ql_dbg_disc, vha, 0x20dc,
+ "Async-%s %8phC hndl %x opt %x\n",
+ sp->name, fcport->port_name, sp->handle, opt);
+
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
+ return rval;
+
+ done_free_sp:
+@@ -1698,15 +1701,14 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
+ tm_iocb->u.tmf.data = tag;
+ sp->done = qla2x00_tmf_sp_done;
+
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+-
+ ql_dbg(ql_dbg_taskm, vha, 0x802f,
+ "Async-tmf hdl=%x loop-id=%x portid=%02x%02x%02x.\n",
+ sp->handle, fcport->loop_id, fcport->d_id.b.domain,
+ fcport->d_id.b.area, fcport->d_id.b.al_pa);
+
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
+ wait_for_completion(&tm_iocb->u.tmf.comp);
+
+ rval = tm_iocb->u.tmf.data;
+@@ -1790,14 +1792,14 @@ qla24xx_async_abort_cmd(srb_t *cmd_sp, bool wait)
+
+ sp->done = qla24xx_abort_sp_done;
+
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+-
+ ql_dbg(ql_dbg_async, vha, 0x507c,
+ "Abort command issued - hdl=%x, target_id=%x\n",
+ cmd_sp->handle, fcport->tgt_id);
+
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
++
+ if (wait) {
+ wait_for_completion(&abt_iocb->u.abt.comp);
+ rval = abt_iocb->u.abt.comp_status == CS_COMPLETE ?
+diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
+index 088772ebef9b..77838d8fd9bb 100644
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -410,7 +410,7 @@ static int spi_gpio_probe(struct platform_device *pdev)
+ return status;
+
+ master->bits_per_word_mask = SPI_BPW_RANGE_MASK(1, 32);
+- master->mode_bits = SPI_3WIRE | SPI_CPHA | SPI_CPOL;
++ master->mode_bits = SPI_3WIRE | SPI_CPHA | SPI_CPOL | SPI_CS_HIGH;
+ master->flags = master_flags;
+ master->bus_num = pdev->id;
+ /* The master needs to think there is a chipselect even if not connected */
+@@ -437,7 +437,6 @@ static int spi_gpio_probe(struct platform_device *pdev)
+ spi_gpio->bitbang.txrx_word[SPI_MODE_3] = spi_gpio_spec_txrx_word_mode3;
+ }
+ spi_gpio->bitbang.setup_transfer = spi_bitbang_setup_transfer;
+- spi_gpio->bitbang.flags = SPI_CS_HIGH;
+
+ status = spi_bitbang_start(&spi_gpio->bitbang);
+ if (status)
+diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c
+index 649caae2b603..25798119426b 100644
+--- a/drivers/staging/wilc1000/linux_wlan.c
++++ b/drivers/staging/wilc1000/linux_wlan.c
+@@ -649,17 +649,17 @@ static int wilc_wlan_initialize(struct net_device *dev, struct wilc_vif *vif)
+ goto fail_locks;
+ }
+
+- if (wl->gpio_irq && init_irq(dev)) {
+- ret = -EIO;
+- goto fail_locks;
+- }
+-
+ ret = wlan_initialize_threads(dev);
+ if (ret < 0) {
+ ret = -EIO;
+ goto fail_wilc_wlan;
+ }
+
++ if (wl->gpio_irq && init_irq(dev)) {
++ ret = -EIO;
++ goto fail_threads;
++ }
++
+ if (!wl->dev_irq_num &&
+ wl->hif_func->enable_interrupt &&
+ wl->hif_func->enable_interrupt(wl)) {
+@@ -715,7 +715,7 @@ fail_irq_enable:
+ fail_irq_init:
+ if (wl->dev_irq_num)
+ deinit_irq(dev);
+-
++fail_threads:
+ wlan_deinitialize_threads(dev);
+ fail_wilc_wlan:
+ wilc_wlan_cleanup(dev);
+diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
+index ce1321a5cb7b..854b2bcca7c1 100644
+--- a/drivers/target/target_core_iblock.c
++++ b/drivers/target/target_core_iblock.c
+@@ -514,8 +514,8 @@ iblock_execute_write_same(struct se_cmd *cmd)
+ }
+
+ /* Always in 512 byte units for Linux/Block */
+- block_lba += sg->length >> IBLOCK_LBA_SHIFT;
+- sectors -= 1;
++ block_lba += sg->length >> SECTOR_SHIFT;
++ sectors -= sg->length >> SECTOR_SHIFT;
+ }
+
+ iblock_submit_bios(&list);
+@@ -757,7 +757,7 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
+ }
+
+ /* Always in 512 byte units for Linux/Block */
+- block_lba += sg->length >> IBLOCK_LBA_SHIFT;
++ block_lba += sg->length >> SECTOR_SHIFT;
+ sg_num--;
+ }
+
+diff --git a/drivers/target/target_core_iblock.h b/drivers/target/target_core_iblock.h
+index 9cc3843404d4..cefc641145b3 100644
+--- a/drivers/target/target_core_iblock.h
++++ b/drivers/target/target_core_iblock.h
+@@ -9,7 +9,6 @@
+ #define IBLOCK_VERSION "4.0"
+
+ #define IBLOCK_MAX_CDBS 16
+-#define IBLOCK_LBA_SHIFT 9
+
+ struct iblock_req {
+ refcount_t pending;
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index fb20aa974ae1..819ae3b2bd7e 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -37,6 +37,7 @@
+ S(SRC_ATTACHED), \
+ S(SRC_STARTUP), \
+ S(SRC_SEND_CAPABILITIES), \
++ S(SRC_SEND_CAPABILITIES_TIMEOUT), \
+ S(SRC_NEGOTIATE_CAPABILITIES), \
+ S(SRC_TRANSITION_SUPPLY), \
+ S(SRC_READY), \
+@@ -2987,10 +2988,34 @@ static void run_state_machine(struct tcpm_port *port)
+ /* port->hard_reset_count = 0; */
+ port->caps_count = 0;
+ port->pd_capable = true;
+- tcpm_set_state_cond(port, hard_reset_state(port),
++ tcpm_set_state_cond(port, SRC_SEND_CAPABILITIES_TIMEOUT,
+ PD_T_SEND_SOURCE_CAP);
+ }
+ break;
++ case SRC_SEND_CAPABILITIES_TIMEOUT:
++ /*
++ * Error recovery for a PD_DATA_SOURCE_CAP reply timeout.
++ *
++ * PD 2.0 sinks are supposed to accept src-capabilities with a
++ * 3.0 header and simply ignore any src PDOs which the sink does
++ * not understand such as PPS but some 2.0 sinks instead ignore
++ * the entire PD_DATA_SOURCE_CAP message, causing contract
++ * negotiation to fail.
++ *
++ * After PD_N_HARD_RESET_COUNT hard-reset attempts, we try
++ * sending src-capabilities with a lower PD revision to
++ * make these broken sinks work.
++ */
++ if (port->hard_reset_count < PD_N_HARD_RESET_COUNT) {
++ tcpm_set_state(port, HARD_RESET_SEND, 0);
++ } else if (port->negotiated_rev > PD_REV20) {
++ port->negotiated_rev--;
++ port->hard_reset_count = 0;
++ tcpm_set_state(port, SRC_SEND_CAPABILITIES, 0);
++ } else {
++ tcpm_set_state(port, hard_reset_state(port), 0);
++ }
++ break;
+ case SRC_NEGOTIATE_CAPABILITIES:
+ ret = tcpm_pd_check_request(port);
+ if (ret < 0) {
+diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
+index 40589850eb33..a9be2d8e98df 100644
+--- a/drivers/vhost/test.c
++++ b/drivers/vhost/test.c
+@@ -23,6 +23,12 @@
+ * Using this limit prevents one virtqueue from starving others. */
+ #define VHOST_TEST_WEIGHT 0x80000
+
++/* Max number of packets transferred before requeueing the job.
++ * Using this limit prevents one virtqueue from starving others with
++ * pkts.
++ */
++#define VHOST_TEST_PKT_WEIGHT 256
++
+ enum {
+ VHOST_TEST_VQ = 0,
+ VHOST_TEST_VQ_MAX = 1,
+@@ -81,10 +87,8 @@ static void handle_vq(struct vhost_test *n)
+ }
+ vhost_add_used_and_signal(&n->dev, vq, head, 0);
+ total_len += len;
+- if (unlikely(total_len >= VHOST_TEST_WEIGHT)) {
+- vhost_poll_queue(&vq->poll);
++ if (unlikely(vhost_exceeds_weight(vq, 0, total_len)))
+ break;
+- }
+ }
+
+ mutex_unlock(&vq->mutex);
+@@ -116,7 +120,8 @@ static int vhost_test_open(struct inode *inode, struct file *f)
+ dev = &n->dev;
+ vqs[VHOST_TEST_VQ] = &n->vqs[VHOST_TEST_VQ];
+ n->vqs[VHOST_TEST_VQ].handle_kick = handle_vq_kick;
+- vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX);
++ vhost_dev_init(dev, vqs, VHOST_TEST_VQ_MAX, UIO_MAXIOV,
++ VHOST_TEST_PKT_WEIGHT, VHOST_TEST_WEIGHT);
+
+ f->private_data = n;
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 0752f8dc47b1..98b6eb902df9 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -2073,7 +2073,7 @@ static int get_indirect(struct vhost_virtqueue *vq,
+ /* If this is an input descriptor, increment that count. */
+ if (access == VHOST_ACCESS_WO) {
+ *in_num += ret;
+- if (unlikely(log)) {
++ if (unlikely(log && ret)) {
+ log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
+ log[*log_num].len = vhost32_to_cpu(vq, desc.len);
+ ++*log_num;
+@@ -2216,7 +2216,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq,
+ /* If this is an input descriptor,
+ * increment that count. */
+ *in_num += ret;
+- if (unlikely(log)) {
++ if (unlikely(log && ret)) {
+ log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
+ log[*log_num].len = vhost32_to_cpu(vq, desc.len);
+ ++*log_num;
+diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
+index 9bfa66592aa7..c71e534ca7ef 100644
+--- a/fs/btrfs/compression.c
++++ b/fs/btrfs/compression.c
+@@ -42,6 +42,22 @@ const char* btrfs_compress_type2str(enum btrfs_compression_type type)
+ return NULL;
+ }
+
++bool btrfs_compress_is_valid_type(const char *str, size_t len)
++{
++ int i;
++
++ for (i = 1; i < ARRAY_SIZE(btrfs_compress_types); i++) {
++ size_t comp_len = strlen(btrfs_compress_types[i]);
++
++ if (len < comp_len)
++ continue;
++
++ if (!strncmp(btrfs_compress_types[i], str, comp_len))
++ return true;
++ }
++ return false;
++}
++
+ static int btrfs_decompress_bio(struct compressed_bio *cb);
+
+ static inline int compressed_bio_size(struct btrfs_fs_info *fs_info,
+diff --git a/fs/btrfs/compression.h b/fs/btrfs/compression.h
+index ddda9b80bf20..f97d90a1fa53 100644
+--- a/fs/btrfs/compression.h
++++ b/fs/btrfs/compression.h
+@@ -127,6 +127,7 @@ extern const struct btrfs_compress_op btrfs_lzo_compress;
+ extern const struct btrfs_compress_op btrfs_zstd_compress;
+
+ const char* btrfs_compress_type2str(enum btrfs_compression_type type);
++bool btrfs_compress_is_valid_type(const char *str, size_t len);
+
+ int btrfs_compress_heuristic(struct inode *inode, u64 start, u64 end);
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 82682da5a40d..4644f9b629a5 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -3200,6 +3200,9 @@ int btrfs_prealloc_file_range_trans(struct inode *inode,
+ struct btrfs_trans_handle *trans, int mode,
+ u64 start, u64 num_bytes, u64 min_size,
+ loff_t actual_len, u64 *alloc_hint);
++int btrfs_run_delalloc_range(void *private_data, struct page *locked_page,
++ u64 start, u64 end, int *page_started, unsigned long *nr_written,
++ struct writeback_control *wbc);
+ extern const struct dentry_operations btrfs_dentry_operations;
+ #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+ void btrfs_test_inode_set_ops(struct inode *inode);
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 0cc800d22a08..88c939f7aad9 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10478,22 +10478,6 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ }
+ spin_unlock(&block_group->lock);
+
+- if (remove_em) {
+- struct extent_map_tree *em_tree;
+-
+- em_tree = &fs_info->mapping_tree.map_tree;
+- write_lock(&em_tree->lock);
+- /*
+- * The em might be in the pending_chunks list, so make sure the
+- * chunk mutex is locked, since remove_extent_mapping() will
+- * delete us from that list.
+- */
+- remove_extent_mapping(em_tree, em);
+- write_unlock(&em_tree->lock);
+- /* once for the tree */
+- free_extent_map(em);
+- }
+-
+ mutex_unlock(&fs_info->chunk_mutex);
+
+ ret = remove_block_group_free_space(trans, block_group);
+@@ -10510,6 +10494,24 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ goto out;
+
+ ret = btrfs_del_item(trans, root, path);
++ if (ret)
++ goto out;
++
++ if (remove_em) {
++ struct extent_map_tree *em_tree;
++
++ em_tree = &fs_info->mapping_tree.map_tree;
++ write_lock(&em_tree->lock);
++ /*
++ * The em might be in the pending_chunks list, so make sure the
++ * chunk mutex is locked, since remove_extent_mapping() will
++ * delete us from that list.
++ */
++ remove_extent_mapping(em_tree, em);
++ write_unlock(&em_tree->lock);
++ /* once for the tree */
++ free_extent_map(em);
++ }
+ out:
+ btrfs_free_path(path);
+ return ret;
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 90b0a6eff535..cb598eb4f3bd 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -3199,7 +3199,7 @@ static void update_nr_written(struct writeback_control *wbc,
+ /*
+ * helper for __extent_writepage, doing all of the delayed allocation setup.
+ *
+- * This returns 1 if our fill_delalloc function did all the work required
++ * This returns 1 if btrfs_run_delalloc_range function did all the work required
+ * to write the page (copy into inline extent). In this case the IO has
+ * been started and the page is already unlocked.
+ *
+@@ -3220,7 +3220,7 @@ static noinline_for_stack int writepage_delalloc(struct inode *inode,
+ int ret;
+ int page_started = 0;
+
+- if (epd->extent_locked || !tree->ops || !tree->ops->fill_delalloc)
++ if (epd->extent_locked)
+ return 0;
+
+ while (delalloc_end < page_end) {
+@@ -3233,18 +3233,16 @@ static noinline_for_stack int writepage_delalloc(struct inode *inode,
+ delalloc_start = delalloc_end + 1;
+ continue;
+ }
+- ret = tree->ops->fill_delalloc(inode, page,
+- delalloc_start,
+- delalloc_end,
+- &page_started,
+- nr_written, wbc);
++ ret = btrfs_run_delalloc_range(inode, page, delalloc_start,
++ delalloc_end, &page_started, nr_written, wbc);
+ /* File system has been set read-only */
+ if (ret) {
+ SetPageError(page);
+- /* fill_delalloc should be return < 0 for error
+- * but just in case, we use > 0 here meaning the
+- * IO is started, so we don't want to return > 0
+- * unless things are going well.
++ /*
++ * btrfs_run_delalloc_range should return < 0 for error
++ * but just in case, we use > 0 here meaning the IO is
++ * started, so we don't want to return > 0 unless
++ * things are going well.
+ */
+ ret = ret < 0 ? ret : -EIO;
+ goto done;
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index b4d03e677e1d..ed27becd963c 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -106,11 +106,6 @@ struct extent_io_ops {
+ /*
+ * Optional hooks, called if the pointer is not NULL
+ */
+- int (*fill_delalloc)(void *private_data, struct page *locked_page,
+- u64 start, u64 end, int *page_started,
+- unsigned long *nr_written,
+- struct writeback_control *wbc);
+-
+ int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
+ void (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
+ struct extent_state *state, int uptodate);
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 355ff08e9d44..98c535ae038d 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -110,17 +110,17 @@ static void __endio_write_update_ordered(struct inode *inode,
+ * extent_clear_unlock_delalloc() to clear both the bits EXTENT_DO_ACCOUNTING
+ * and EXTENT_DELALLOC simultaneously, because that causes the reserved metadata
+ * to be released, which we want to happen only when finishing the ordered
+- * extent (btrfs_finish_ordered_io()). Also note that the caller of the
+- * fill_delalloc() callback already does proper cleanup for the first page of
+- * the range, that is, it invokes the callback writepage_end_io_hook() for the
+- * range of the first page.
++ * extent (btrfs_finish_ordered_io()).
+ */
+ static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
+- const u64 offset,
+- const u64 bytes)
++ struct page *locked_page,
++ u64 offset, u64 bytes)
+ {
+ unsigned long index = offset >> PAGE_SHIFT;
+ unsigned long end_index = (offset + bytes - 1) >> PAGE_SHIFT;
++ u64 page_start = page_offset(locked_page);
++ u64 page_end = page_start + PAGE_SIZE - 1;
++
+ struct page *page;
+
+ while (index <= end_index) {
+@@ -131,8 +131,18 @@ static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
+ ClearPagePrivate2(page);
+ put_page(page);
+ }
+- return __endio_write_update_ordered(inode, offset + PAGE_SIZE,
+- bytes - PAGE_SIZE, false);
++
++ /*
++ * In case this page belongs to the delalloc range being instantiated
++ * then skip it, since the first page of a range is going to be
++ * properly cleaned up by the caller of run_delalloc_range
++ */
++ if (page_start >= offset && page_end <= (offset + bytes - 1)) {
++ offset += PAGE_SIZE;
++ bytes -= PAGE_SIZE;
++ }
++
++ return __endio_write_update_ordered(inode, offset, bytes, false);
+ }
+
+ static int btrfs_dirty_inode(struct inode *inode);
+@@ -1599,12 +1609,12 @@ static inline int need_force_cow(struct inode *inode, u64 start, u64 end)
+ }
+
+ /*
+- * extent_io.c call back to do delayed allocation processing
++ * Function to process delayed allocation (create CoW) for ranges which are
++ * being touched for the first time.
+ */
+-static int run_delalloc_range(void *private_data, struct page *locked_page,
+- u64 start, u64 end, int *page_started,
+- unsigned long *nr_written,
+- struct writeback_control *wbc)
++int btrfs_run_delalloc_range(void *private_data, struct page *locked_page,
++ u64 start, u64 end, int *page_started, unsigned long *nr_written,
++ struct writeback_control *wbc)
+ {
+ struct inode *inode = private_data;
+ int ret;
+@@ -1629,7 +1639,8 @@ static int run_delalloc_range(void *private_data, struct page *locked_page,
+ write_flags);
+ }
+ if (ret)
+- btrfs_cleanup_ordered_extents(inode, start, end - start + 1);
++ btrfs_cleanup_ordered_extents(inode, locked_page, start,
++ end - start + 1);
+ return ret;
+ }
+
+@@ -10598,7 +10609,6 @@ static const struct extent_io_ops btrfs_extent_io_ops = {
+ .readpage_io_failed_hook = btrfs_readpage_io_failed_hook,
+
+ /* optional callbacks */
+- .fill_delalloc = run_delalloc_range,
+ .writepage_end_io_hook = btrfs_writepage_end_io_hook,
+ .writepage_start_hook = btrfs_writepage_start_hook,
+ .set_bit_hook = btrfs_set_bit_hook,
+diff --git a/fs/btrfs/props.c b/fs/btrfs/props.c
+index 61d22a56c0ba..6980a0e13f18 100644
+--- a/fs/btrfs/props.c
++++ b/fs/btrfs/props.c
+@@ -366,11 +366,7 @@ int btrfs_subvol_inherit_props(struct btrfs_trans_handle *trans,
+
+ static int prop_compression_validate(const char *value, size_t len)
+ {
+- if (!strncmp("lzo", value, 3))
+- return 0;
+- else if (!strncmp("zlib", value, 4))
+- return 0;
+- else if (!strncmp("zstd", value, 4))
++ if (btrfs_compress_is_valid_type(value, len))
+ return 0;
+
+ return -EINVAL;
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index 3be1456b5116..916c39770467 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -322,6 +322,7 @@ static struct full_stripe_lock *insert_full_stripe_lock(
+ struct rb_node *parent = NULL;
+ struct full_stripe_lock *entry;
+ struct full_stripe_lock *ret;
++ unsigned int nofs_flag;
+
+ lockdep_assert_held(&locks_root->lock);
+
+@@ -339,8 +340,17 @@ static struct full_stripe_lock *insert_full_stripe_lock(
+ }
+ }
+
+- /* Insert new lock */
++ /*
++ * Insert new lock.
++ *
++ * We must use GFP_NOFS because the scrub task might be waiting for a
++ * worker task executing this function and in turn a transaction commit
++ * might be waiting the scrub task to pause (which needs to wait for all
++ * the worker tasks to complete before pausing).
++ */
++ nofs_flag = memalloc_nofs_save();
+ ret = kmalloc(sizeof(*ret), GFP_KERNEL);
++ memalloc_nofs_restore(nofs_flag);
+ if (!ret)
+ return ERR_PTR(-ENOMEM);
+ ret->logical = fstripe_logical;
+@@ -568,12 +578,11 @@ static void scrub_put_ctx(struct scrub_ctx *sctx)
+ scrub_free_ctx(sctx);
+ }
+
+-static noinline_for_stack
+-struct scrub_ctx *scrub_setup_ctx(struct btrfs_device *dev, int is_dev_replace)
++static noinline_for_stack struct scrub_ctx *scrub_setup_ctx(
++ struct btrfs_fs_info *fs_info, int is_dev_replace)
+ {
+ struct scrub_ctx *sctx;
+ int i;
+- struct btrfs_fs_info *fs_info = dev->fs_info;
+
+ sctx = kzalloc(sizeof(*sctx), GFP_KERNEL);
+ if (!sctx)
+@@ -582,7 +591,8 @@ struct scrub_ctx *scrub_setup_ctx(struct btrfs_device *dev, int is_dev_replace)
+ sctx->is_dev_replace = is_dev_replace;
+ sctx->pages_per_rd_bio = SCRUB_PAGES_PER_RD_BIO;
+ sctx->curr = -1;
+- sctx->fs_info = dev->fs_info;
++ sctx->fs_info = fs_info;
++ INIT_LIST_HEAD(&sctx->csum_list);
+ for (i = 0; i < SCRUB_BIOS_PER_SCTX; ++i) {
+ struct scrub_bio *sbio;
+
+@@ -607,7 +617,6 @@ struct scrub_ctx *scrub_setup_ctx(struct btrfs_device *dev, int is_dev_replace)
+ atomic_set(&sctx->workers_pending, 0);
+ atomic_set(&sctx->cancel_req, 0);
+ sctx->csum_size = btrfs_super_csum_size(fs_info->super_copy);
+- INIT_LIST_HEAD(&sctx->csum_list);
+
+ spin_lock_init(&sctx->list_lock);
+ spin_lock_init(&sctx->stat_lock);
+@@ -1622,8 +1631,19 @@ static int scrub_add_page_to_wr_bio(struct scrub_ctx *sctx,
+ mutex_lock(&sctx->wr_lock);
+ again:
+ if (!sctx->wr_curr_bio) {
++ unsigned int nofs_flag;
++
++ /*
++ * We must use GFP_NOFS because the scrub task might be waiting
++ * for a worker task executing this function and in turn a
++ * transaction commit might be waiting the scrub task to pause
++ * (which needs to wait for all the worker tasks to complete
++ * before pausing).
++ */
++ nofs_flag = memalloc_nofs_save();
+ sctx->wr_curr_bio = kzalloc(sizeof(*sctx->wr_curr_bio),
+ GFP_KERNEL);
++ memalloc_nofs_restore(nofs_flag);
+ if (!sctx->wr_curr_bio) {
+ mutex_unlock(&sctx->wr_lock);
+ return -ENOMEM;
+@@ -3022,8 +3042,7 @@ out:
+ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
+ struct map_lookup *map,
+ struct btrfs_device *scrub_dev,
+- int num, u64 base, u64 length,
+- int is_dev_replace)
++ int num, u64 base, u64 length)
+ {
+ struct btrfs_path *path, *ppath;
+ struct btrfs_fs_info *fs_info = sctx->fs_info;
+@@ -3299,7 +3318,7 @@ again:
+ extent_physical = extent_logical - logical + physical;
+ extent_dev = scrub_dev;
+ extent_mirror_num = mirror_num;
+- if (is_dev_replace)
++ if (sctx->is_dev_replace)
+ scrub_remap_extent(fs_info, extent_logical,
+ extent_len, &extent_physical,
+ &extent_dev,
+@@ -3397,8 +3416,7 @@ static noinline_for_stack int scrub_chunk(struct scrub_ctx *sctx,
+ struct btrfs_device *scrub_dev,
+ u64 chunk_offset, u64 length,
+ u64 dev_offset,
+- struct btrfs_block_group_cache *cache,
+- int is_dev_replace)
++ struct btrfs_block_group_cache *cache)
+ {
+ struct btrfs_fs_info *fs_info = sctx->fs_info;
+ struct btrfs_mapping_tree *map_tree = &fs_info->mapping_tree;
+@@ -3435,8 +3453,7 @@ static noinline_for_stack int scrub_chunk(struct scrub_ctx *sctx,
+ if (map->stripes[i].dev->bdev == scrub_dev->bdev &&
+ map->stripes[i].physical == dev_offset) {
+ ret = scrub_stripe(sctx, map, scrub_dev, i,
+- chunk_offset, length,
+- is_dev_replace);
++ chunk_offset, length);
+ if (ret)
+ goto out;
+ }
+@@ -3449,8 +3466,7 @@ out:
+
+ static noinline_for_stack
+ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
+- struct btrfs_device *scrub_dev, u64 start, u64 end,
+- int is_dev_replace)
++ struct btrfs_device *scrub_dev, u64 start, u64 end)
+ {
+ struct btrfs_dev_extent *dev_extent = NULL;
+ struct btrfs_path *path;
+@@ -3544,7 +3560,7 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
+ */
+ scrub_pause_on(fs_info);
+ ret = btrfs_inc_block_group_ro(cache);
+- if (!ret && is_dev_replace) {
++ if (!ret && sctx->is_dev_replace) {
+ /*
+ * If we are doing a device replace wait for any tasks
+ * that started dellaloc right before we set the block
+@@ -3609,7 +3625,7 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
+ dev_replace->item_needs_writeback = 1;
+ btrfs_dev_replace_write_unlock(&fs_info->dev_replace);
+ ret = scrub_chunk(sctx, scrub_dev, chunk_offset, length,
+- found_key.offset, cache, is_dev_replace);
++ found_key.offset, cache);
+
+ /*
+ * flush, submit all pending read and write bios, afterwards
+@@ -3670,7 +3686,7 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
+ btrfs_put_block_group(cache);
+ if (ret)
+ break;
+- if (is_dev_replace &&
++ if (sctx->is_dev_replace &&
+ atomic64_read(&dev_replace->num_write_errors) > 0) {
+ ret = -EIO;
+ break;
+@@ -3762,16 +3778,6 @@ fail_scrub_workers:
+ return -ENOMEM;
+ }
+
+-static noinline_for_stack void scrub_workers_put(struct btrfs_fs_info *fs_info)
+-{
+- if (--fs_info->scrub_workers_refcnt == 0) {
+- btrfs_destroy_workqueue(fs_info->scrub_workers);
+- btrfs_destroy_workqueue(fs_info->scrub_wr_completion_workers);
+- btrfs_destroy_workqueue(fs_info->scrub_parity_workers);
+- }
+- WARN_ON(fs_info->scrub_workers_refcnt < 0);
+-}
+-
+ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ u64 end, struct btrfs_scrub_progress *progress,
+ int readonly, int is_dev_replace)
+@@ -3779,6 +3785,10 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ struct scrub_ctx *sctx;
+ int ret;
+ struct btrfs_device *dev;
++ unsigned int nofs_flag;
++ struct btrfs_workqueue *scrub_workers = NULL;
++ struct btrfs_workqueue *scrub_wr_comp = NULL;
++ struct btrfs_workqueue *scrub_parity = NULL;
+
+ if (btrfs_fs_closing(fs_info))
+ return -EINVAL;
+@@ -3820,13 +3830,18 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ return -EINVAL;
+ }
+
++ /* Allocate outside of device_list_mutex */
++ sctx = scrub_setup_ctx(fs_info, is_dev_replace);
++ if (IS_ERR(sctx))
++ return PTR_ERR(sctx);
+
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+ dev = btrfs_find_device(fs_info, devid, NULL, NULL);
+ if (!dev || (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state) &&
+ !is_dev_replace)) {
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+- return -ENODEV;
++ ret = -ENODEV;
++ goto out_free_ctx;
+ }
+
+ if (!is_dev_replace && !readonly &&
+@@ -3834,7 +3849,8 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+ btrfs_err_in_rcu(fs_info, "scrub: device %s is not writable",
+ rcu_str_deref(dev->name));
+- return -EROFS;
++ ret = -EROFS;
++ goto out_free_ctx;
+ }
+
+ mutex_lock(&fs_info->scrub_lock);
+@@ -3842,7 +3858,8 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ test_bit(BTRFS_DEV_STATE_REPLACE_TGT, &dev->dev_state)) {
+ mutex_unlock(&fs_info->scrub_lock);
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+- return -EIO;
++ ret = -EIO;
++ goto out_free_ctx;
+ }
+
+ btrfs_dev_replace_read_lock(&fs_info->dev_replace);
+@@ -3852,7 +3869,8 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ btrfs_dev_replace_read_unlock(&fs_info->dev_replace);
+ mutex_unlock(&fs_info->scrub_lock);
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+- return -EINPROGRESS;
++ ret = -EINPROGRESS;
++ goto out_free_ctx;
+ }
+ btrfs_dev_replace_read_unlock(&fs_info->dev_replace);
+
+@@ -3860,16 +3878,9 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ if (ret) {
+ mutex_unlock(&fs_info->scrub_lock);
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+- return ret;
++ goto out_free_ctx;
+ }
+
+- sctx = scrub_setup_ctx(dev, is_dev_replace);
+- if (IS_ERR(sctx)) {
+- mutex_unlock(&fs_info->scrub_lock);
+- mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+- scrub_workers_put(fs_info);
+- return PTR_ERR(sctx);
+- }
+ sctx->readonly = readonly;
+ dev->scrub_ctx = sctx;
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+@@ -3882,6 +3893,16 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ atomic_inc(&fs_info->scrubs_running);
+ mutex_unlock(&fs_info->scrub_lock);
+
++ /*
++ * In order to avoid deadlock with reclaim when there is a transaction
++ * trying to pause scrub, make sure we use GFP_NOFS for all the
++ * allocations done at btrfs_scrub_pages() and scrub_pages_for_parity()
++ * invoked by our callees. The pausing request is done when the
++ * transaction commit starts, and it blocks the transaction until scrub
++ * is paused (done at specific points at scrub_stripe() or right above
++ * before incrementing fs_info->scrubs_running).
++ */
++ nofs_flag = memalloc_nofs_save();
+ if (!is_dev_replace) {
+ /*
+ * by holding device list mutex, we can
+@@ -3893,8 +3914,8 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ }
+
+ if (!ret)
+- ret = scrub_enumerate_chunks(sctx, dev, start, end,
+- is_dev_replace);
++ ret = scrub_enumerate_chunks(sctx, dev, start, end);
++ memalloc_nofs_restore(nofs_flag);
+
+ wait_event(sctx->list_wait, atomic_read(&sctx->bios_in_flight) == 0);
+ atomic_dec(&fs_info->scrubs_running);
+@@ -3907,11 +3928,23 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+
+ mutex_lock(&fs_info->scrub_lock);
+ dev->scrub_ctx = NULL;
+- scrub_workers_put(fs_info);
++ if (--fs_info->scrub_workers_refcnt == 0) {
++ scrub_workers = fs_info->scrub_workers;
++ scrub_wr_comp = fs_info->scrub_wr_completion_workers;
++ scrub_parity = fs_info->scrub_parity_workers;
++ }
+ mutex_unlock(&fs_info->scrub_lock);
+
++ btrfs_destroy_workqueue(scrub_workers);
++ btrfs_destroy_workqueue(scrub_wr_comp);
++ btrfs_destroy_workqueue(scrub_parity);
+ scrub_put_ctx(sctx);
+
++ return ret;
++
++out_free_ctx:
++ scrub_free_ctx(sctx);
++
+ return ret;
+ }
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 6e008bd5c8cd..a8297e7489d9 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -7411,6 +7411,7 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info,
+ struct extent_map_tree *em_tree = &fs_info->mapping_tree.map_tree;
+ struct extent_map *em;
+ struct map_lookup *map;
++ struct btrfs_device *dev;
+ u64 stripe_len;
+ bool found = false;
+ int ret = 0;
+@@ -7460,6 +7461,34 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info,
+ physical_offset, devid);
+ ret = -EUCLEAN;
+ }
++
++ /* Make sure no dev extent is beyond device bondary */
++ dev = btrfs_find_device(fs_info, devid, NULL, NULL);
++ if (!dev) {
++ btrfs_err(fs_info, "failed to find devid %llu", devid);
++ ret = -EUCLEAN;
++ goto out;
++ }
++
++ /* It's possible this device is a dummy for seed device */
++ if (dev->disk_total_bytes == 0) {
++ dev = find_device(fs_info->fs_devices->seed, devid, NULL);
++ if (!dev) {
++ btrfs_err(fs_info, "failed to find seed devid %llu",
++ devid);
++ ret = -EUCLEAN;
++ goto out;
++ }
++ }
++
++ if (physical_offset + physical_len > dev->disk_total_bytes) {
++ btrfs_err(fs_info,
++"dev extent devid %llu physical offset %llu len %llu is beyond device boundary %llu",
++ devid, physical_offset, physical_len,
++ dev->disk_total_bytes);
++ ret = -EUCLEAN;
++ goto out;
++ }
+ out:
+ free_extent_map(em);
+ return ret;
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 11f19432a74c..665a86f83f4b 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -528,13 +528,16 @@ static void ceph_i_callback(struct rcu_head *head)
+ kmem_cache_free(ceph_inode_cachep, ci);
+ }
+
+-void ceph_destroy_inode(struct inode *inode)
++void ceph_evict_inode(struct inode *inode)
+ {
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ struct ceph_inode_frag *frag;
+ struct rb_node *n;
+
+- dout("destroy_inode %p ino %llx.%llx\n", inode, ceph_vinop(inode));
++ dout("evict_inode %p ino %llx.%llx\n", inode, ceph_vinop(inode));
++
++ truncate_inode_pages_final(&inode->i_data);
++ clear_inode(inode);
+
+ ceph_fscache_unregister_inode_cookie(ci);
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index c5cf46e43f2e..02528e11bf33 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -827,9 +827,9 @@ static int ceph_remount(struct super_block *sb, int *flags, char *data)
+
+ static const struct super_operations ceph_super_ops = {
+ .alloc_inode = ceph_alloc_inode,
+- .destroy_inode = ceph_destroy_inode,
+ .write_inode = ceph_write_inode,
+ .drop_inode = ceph_drop_inode,
++ .evict_inode = ceph_evict_inode,
+ .sync_fs = ceph_sync_fs,
+ .put_super = ceph_put_super,
+ .remount_fs = ceph_remount,
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index 018019309790..6e968e48e5e4 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -854,7 +854,7 @@ static inline bool __ceph_have_pending_cap_snap(struct ceph_inode_info *ci)
+ extern const struct inode_operations ceph_file_iops;
+
+ extern struct inode *ceph_alloc_inode(struct super_block *sb);
+-extern void ceph_destroy_inode(struct inode *inode);
++extern void ceph_evict_inode(struct inode *inode);
+ extern int ceph_drop_inode(struct inode *inode);
+
+ extern struct inode *ceph_get_inode(struct super_block *sb,
+diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h
+index 9731d0d891e7..aba2b48d4da1 100644
+--- a/fs/cifs/cifs_fs_sb.h
++++ b/fs/cifs/cifs_fs_sb.h
+@@ -72,5 +72,10 @@ struct cifs_sb_info {
+ struct delayed_work prune_tlinks;
+ struct rcu_head rcu;
+ char *prepath;
++ /*
++ * Indicate whether serverino option was turned off later
++ * (cifs_autodisable_serverino) in order to match new mounts.
++ */
++ bool mnt_cifs_serverino_autodisabled;
+ };
+ #endif /* _CIFS_FS_SB_H */
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index fb32f3d6925e..64e3888f30e6 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -292,6 +292,7 @@ cifs_alloc_inode(struct super_block *sb)
+ cifs_inode->uniqueid = 0;
+ cifs_inode->createtime = 0;
+ cifs_inode->epoch = 0;
++ spin_lock_init(&cifs_inode->open_file_lock);
+ generate_random_uuid(cifs_inode->lease_key);
+
+ /*
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 6f227cc781e5..57af9bac0045 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1287,6 +1287,7 @@ struct cifsInodeInfo {
+ struct rw_semaphore lock_sem; /* protect the fields above */
+ /* BB add in lists for dirty pages i.e. write caching info for oplock */
+ struct list_head openFileList;
++ spinlock_t open_file_lock; /* protects openFileList */
+ __u32 cifsAttrs; /* e.g. DOS archive bit, sparse, compressed, system */
+ unsigned int oplock; /* oplock/lease level we have */
+ unsigned int epoch; /* used to track lease state changes */
+@@ -1563,6 +1564,25 @@ static inline void free_dfs_info_array(struct dfs_info3_param *param,
+ kfree(param);
+ }
+
++static inline bool is_interrupt_error(int error)
++{
++ switch (error) {
++ case -EINTR:
++ case -ERESTARTSYS:
++ case -ERESTARTNOHAND:
++ case -ERESTARTNOINTR:
++ return true;
++ }
++ return false;
++}
++
++static inline bool is_retryable_error(int error)
++{
++ if (is_interrupt_error(error) || error == -EAGAIN)
++ return true;
++ return false;
++}
++
+ #define MID_FREE 0
+ #define MID_REQUEST_ALLOCATED 1
+ #define MID_REQUEST_SUBMITTED 2
+@@ -1668,10 +1688,14 @@ require use of the stronger protocol */
+ * tcp_ses_lock protects:
+ * list operations on tcp and SMB session lists
+ * tcon->open_file_lock protects the list of open files hanging off the tcon
++ * inode->open_file_lock protects the openFileList hanging off the inode
+ * cfile->file_info_lock protects counters and fields in cifs file struct
+ * f_owner.lock protects certain per file struct operations
+ * mapping->page_lock protects certain per page operations
+ *
++ * Note that the cifs_tcon.open_file_lock should be taken before
++ * not after the cifsInodeInfo.open_file_lock
++ *
+ * Semaphores
+ * ----------
+ * sesSem operations on smb session
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 269471c8f42b..86a54b809c48 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -2033,16 +2033,17 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
+
+ wdata2->cfile = find_writable_file(CIFS_I(inode), false);
+ if (!wdata2->cfile) {
+- cifs_dbg(VFS, "No writable handles for inode\n");
++ cifs_dbg(VFS, "No writable handle to retry writepages\n");
+ rc = -EBADF;
+- break;
++ } else {
++ wdata2->pid = wdata2->cfile->pid;
++ rc = server->ops->async_writev(wdata2,
++ cifs_writedata_release);
+ }
+- wdata2->pid = wdata2->cfile->pid;
+- rc = server->ops->async_writev(wdata2, cifs_writedata_release);
+
+ for (j = 0; j < nr_pages; j++) {
+ unlock_page(wdata2->pages[j]);
+- if (rc != 0 && rc != -EAGAIN) {
++ if (rc != 0 && !is_retryable_error(rc)) {
+ SetPageError(wdata2->pages[j]);
+ end_page_writeback(wdata2->pages[j]);
+ put_page(wdata2->pages[j]);
+@@ -2051,8 +2052,9 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
+
+ if (rc) {
+ kref_put(&wdata2->refcount, cifs_writedata_release);
+- if (rc == -EAGAIN)
++ if (is_retryable_error(rc))
+ continue;
++ i += nr_pages;
+ break;
+ }
+
+@@ -2060,7 +2062,15 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
+ i += nr_pages;
+ } while (i < wdata->nr_pages);
+
+- mapping_set_error(inode->i_mapping, rc);
++ /* cleanup remaining pages from the original wdata */
++ for (; i < wdata->nr_pages; i++) {
++ SetPageError(wdata->pages[i]);
++ end_page_writeback(wdata->pages[i]);
++ put_page(wdata->pages[i]);
++ }
++
++ if (rc != 0 && !is_retryable_error(rc))
++ mapping_set_error(inode->i_mapping, rc);
+ kref_put(&wdata->refcount, cifs_writedata_release);
+ }
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index c53a2e86ed54..208430bb66fc 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3247,12 +3247,16 @@ compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
+ {
+ struct cifs_sb_info *old = CIFS_SB(sb);
+ struct cifs_sb_info *new = mnt_data->cifs_sb;
++ unsigned int oldflags = old->mnt_cifs_flags & CIFS_MOUNT_MASK;
++ unsigned int newflags = new->mnt_cifs_flags & CIFS_MOUNT_MASK;
+
+ if ((sb->s_flags & CIFS_MS_MASK) != (mnt_data->flags & CIFS_MS_MASK))
+ return 0;
+
+- if ((old->mnt_cifs_flags & CIFS_MOUNT_MASK) !=
+- (new->mnt_cifs_flags & CIFS_MOUNT_MASK))
++ if (old->mnt_cifs_serverino_autodisabled)
++ newflags &= ~CIFS_MOUNT_SERVER_INUM;
++
++ if (oldflags != newflags)
+ return 0;
+
+ /*
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 23cee91ed442..8703b5f26f45 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -336,10 +336,12 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ list_add(&cfile->tlist, &tcon->openFileList);
+
+ /* if readable file instance put first in list*/
++ spin_lock(&cinode->open_file_lock);
+ if (file->f_mode & FMODE_READ)
+ list_add(&cfile->flist, &cinode->openFileList);
+ else
+ list_add_tail(&cfile->flist, &cinode->openFileList);
++ spin_unlock(&cinode->open_file_lock);
+ spin_unlock(&tcon->open_file_lock);
+
+ if (fid->purge_cache)
+@@ -411,7 +413,9 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ cifs_add_pending_open_locked(&fid, cifs_file->tlink, &open);
+
+ /* remove it from the lists */
++ spin_lock(&cifsi->open_file_lock);
+ list_del(&cifs_file->flist);
++ spin_unlock(&cifsi->open_file_lock);
+ list_del(&cifs_file->tlist);
+
+ if (list_empty(&cifsi->openFileList)) {
+@@ -749,7 +753,8 @@ reopen_success:
+
+ if (can_flush) {
+ rc = filemap_write_and_wait(inode->i_mapping);
+- mapping_set_error(inode->i_mapping, rc);
++ if (!is_interrupt_error(rc))
++ mapping_set_error(inode->i_mapping, rc);
+
+ if (tcon->unix_ext)
+ rc = cifs_get_inode_info_unix(&inode, full_path,
+@@ -1928,10 +1933,10 @@ refind_writable:
+ if (!rc)
+ return inv_file;
+ else {
+- spin_lock(&tcon->open_file_lock);
++ spin_lock(&cifs_inode->open_file_lock);
+ list_move_tail(&inv_file->flist,
+ &cifs_inode->openFileList);
+- spin_unlock(&tcon->open_file_lock);
++ spin_unlock(&cifs_inode->open_file_lock);
+ cifsFileInfo_put(inv_file);
+ ++refind;
+ inv_file = NULL;
+@@ -2137,6 +2142,7 @@ static int cifs_writepages(struct address_space *mapping,
+ pgoff_t end, index;
+ struct cifs_writedata *wdata;
+ int rc = 0;
++ int saved_rc = 0;
+
+ /*
+ * If wsize is smaller than the page cache size, default to writing
+@@ -2163,8 +2169,10 @@ retry:
+
+ rc = server->ops->wait_mtu_credits(server, cifs_sb->wsize,
+ &wsize, &credits);
+- if (rc)
++ if (rc != 0) {
++ done = true;
+ break;
++ }
+
+ tofind = min((wsize / PAGE_SIZE) - 1, end - index) + 1;
+
+@@ -2172,6 +2180,7 @@ retry:
+ &found_pages);
+ if (!wdata) {
+ rc = -ENOMEM;
++ done = true;
+ add_credits_and_wake_if(server, credits, 0);
+ break;
+ }
+@@ -2200,7 +2209,7 @@ retry:
+ if (rc != 0) {
+ add_credits_and_wake_if(server, wdata->credits, 0);
+ for (i = 0; i < nr_pages; ++i) {
+- if (rc == -EAGAIN)
++ if (is_retryable_error(rc))
+ redirty_page_for_writepage(wbc,
+ wdata->pages[i]);
+ else
+@@ -2208,7 +2217,7 @@ retry:
+ end_page_writeback(wdata->pages[i]);
+ put_page(wdata->pages[i]);
+ }
+- if (rc != -EAGAIN)
++ if (!is_retryable_error(rc))
+ mapping_set_error(mapping, rc);
+ }
+ kref_put(&wdata->refcount, cifs_writedata_release);
+@@ -2218,6 +2227,15 @@ retry:
+ continue;
+ }
+
++ /* Return immediately if we received a signal during writing */
++ if (is_interrupt_error(rc)) {
++ done = true;
++ break;
++ }
++
++ if (rc != 0 && saved_rc == 0)
++ saved_rc = rc;
++
+ wbc->nr_to_write -= nr_pages;
+ if (wbc->nr_to_write <= 0)
+ done = true;
+@@ -2235,6 +2253,9 @@ retry:
+ goto retry;
+ }
+
++ if (saved_rc != 0)
++ rc = saved_rc;
++
+ if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
+ mapping->writeback_index = index;
+
+@@ -2266,8 +2287,8 @@ cifs_writepage_locked(struct page *page, struct writeback_control *wbc)
+ set_page_writeback(page);
+ retry_write:
+ rc = cifs_partialpagewrite(page, 0, PAGE_SIZE);
+- if (rc == -EAGAIN) {
+- if (wbc->sync_mode == WB_SYNC_ALL)
++ if (is_retryable_error(rc)) {
++ if (wbc->sync_mode == WB_SYNC_ALL && rc == -EAGAIN)
+ goto retry_write;
+ redirty_page_for_writepage(wbc, page);
+ } else if (rc != 0) {
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 1fadd314ae7f..53f3d08898af 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -2261,6 +2261,11 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs)
+ * the flush returns error?
+ */
+ rc = filemap_write_and_wait(inode->i_mapping);
++ if (is_interrupt_error(rc)) {
++ rc = -ERESTARTSYS;
++ goto out;
++ }
++
+ mapping_set_error(inode->i_mapping, rc);
+ rc = 0;
+
+@@ -2404,6 +2409,11 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs)
+ * the flush returns error?
+ */
+ rc = filemap_write_and_wait(inode->i_mapping);
++ if (is_interrupt_error(rc)) {
++ rc = -ERESTARTSYS;
++ goto cifs_setattr_exit;
++ }
++
+ mapping_set_error(inode->i_mapping, rc);
+ rc = 0;
+
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index facc94e159a1..e45f8e321371 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -523,6 +523,7 @@ cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb)
+ {
+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
+ cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM;
++ cifs_sb->mnt_cifs_serverino_autodisabled = true;
+ cifs_dbg(VFS, "Autodisabling the use of server inode numbers on %s. This server doesn't seem to support them properly. Hardlinks will not be recognized on this mount. Consider mounting with the \"noserverino\" option to silence this message.\n",
+ cifs_sb_master_tcon(cifs_sb)->treeName);
+ }
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 2bc47eb6215e..cbe633f1840a 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -712,6 +712,7 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
+ } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
+ /* ops set to 3.0 by default for default so update */
+ ses->server->ops = &smb21_operations;
++ ses->server->vals = &smb21_values;
+ }
+ } else if (le16_to_cpu(rsp->DialectRevision) !=
+ ses->server->vals->protocol_id) {
+diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
+index 5fdb9a509a97..1959931e14c1 100644
+--- a/fs/cifs/smbdirect.c
++++ b/fs/cifs/smbdirect.c
+@@ -2090,7 +2090,8 @@ int smbd_recv(struct smbd_connection *info, struct msghdr *msg)
+ * rqst: the data to write
+ * return value: 0 if successfully write, otherwise error code
+ */
+-int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst)
++int smbd_send(struct TCP_Server_Info *server,
++ int num_rqst, struct smb_rqst *rqst_array)
+ {
+ struct smbd_connection *info = server->smbd_conn;
+ struct kvec vec;
+@@ -2102,6 +2103,8 @@ int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst)
+ info->max_send_size - sizeof(struct smbd_data_transfer);
+ struct kvec *iov;
+ int rc;
++ struct smb_rqst *rqst;
++ int rqst_idx;
+
+ info->smbd_send_pending++;
+ if (info->transport_status != SMBD_CONNECTED) {
+@@ -2109,47 +2112,41 @@ int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst)
+ goto done;
+ }
+
+- /*
+- * Skip the RFC1002 length defined in MS-SMB2 section 2.1
+- * It is used only for TCP transport in the iov[0]
+- * In future we may want to add a transport layer under protocol
+- * layer so this will only be issued to TCP transport
+- */
+-
+- if (rqst->rq_iov[0].iov_len != 4) {
+- log_write(ERR, "expected the pdu length in 1st iov, but got %zu\n", rqst->rq_iov[0].iov_len);
+- return -EINVAL;
+- }
+-
+ /*
+ * Add in the page array if there is one. The caller needs to set
+ * rq_tailsz to PAGE_SIZE when the buffer has multiple pages and
+ * ends at page boundary
+ */
+- buflen = smb_rqst_len(server, rqst);
++ remaining_data_length = 0;
++ for (i = 0; i < num_rqst; i++)
++ remaining_data_length += smb_rqst_len(server, &rqst_array[i]);
+
+- if (buflen + sizeof(struct smbd_data_transfer) >
++ if (remaining_data_length + sizeof(struct smbd_data_transfer) >
+ info->max_fragmented_send_size) {
+ log_write(ERR, "payload size %d > max size %d\n",
+- buflen, info->max_fragmented_send_size);
++ remaining_data_length, info->max_fragmented_send_size);
+ rc = -EINVAL;
+ goto done;
+ }
+
+- iov = &rqst->rq_iov[1];
++ rqst_idx = 0;
++
++next_rqst:
++ rqst = &rqst_array[rqst_idx];
++ iov = rqst->rq_iov;
+
+- cifs_dbg(FYI, "Sending smb (RDMA): smb_len=%u\n", buflen);
+- for (i = 0; i < rqst->rq_nvec-1; i++)
++ cifs_dbg(FYI, "Sending smb (RDMA): idx=%d smb_len=%lu\n",
++ rqst_idx, smb_rqst_len(server, rqst));
++ for (i = 0; i < rqst->rq_nvec; i++)
+ dump_smb(iov[i].iov_base, iov[i].iov_len);
+
+- remaining_data_length = buflen;
+
+- log_write(INFO, "rqst->rq_nvec=%d rqst->rq_npages=%d rq_pagesz=%d "
+- "rq_tailsz=%d buflen=%d\n",
+- rqst->rq_nvec, rqst->rq_npages, rqst->rq_pagesz,
+- rqst->rq_tailsz, buflen);
++ log_write(INFO, "rqst_idx=%d nvec=%d rqst->rq_npages=%d rq_pagesz=%d "
++ "rq_tailsz=%d buflen=%lu\n",
++ rqst_idx, rqst->rq_nvec, rqst->rq_npages, rqst->rq_pagesz,
++ rqst->rq_tailsz, smb_rqst_len(server, rqst));
+
+- start = i = iov[0].iov_len ? 0 : 1;
++ start = i = 0;
+ buflen = 0;
+ while (true) {
+ buflen += iov[i].iov_len;
+@@ -2197,14 +2194,14 @@ int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst)
+ goto done;
+ }
+ i++;
+- if (i == rqst->rq_nvec-1)
++ if (i == rqst->rq_nvec)
+ break;
+ }
+ start = i;
+ buflen = 0;
+ } else {
+ i++;
+- if (i == rqst->rq_nvec-1) {
++ if (i == rqst->rq_nvec) {
+ /* send out all remaining vecs */
+ remaining_data_length -= buflen;
+ log_write(INFO,
+@@ -2248,6 +2245,10 @@ int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst)
+ }
+ }
+
++ rqst_idx++;
++ if (rqst_idx < num_rqst)
++ goto next_rqst;
++
+ done:
+ /*
+ * As an optimization, we don't wait for individual I/O to finish
+diff --git a/fs/cifs/smbdirect.h b/fs/cifs/smbdirect.h
+index a11096254f29..b5c240ff2191 100644
+--- a/fs/cifs/smbdirect.h
++++ b/fs/cifs/smbdirect.h
+@@ -292,7 +292,8 @@ void smbd_destroy(struct smbd_connection *info);
+
+ /* Interface for carrying upper layer I/O through send/recv */
+ int smbd_recv(struct smbd_connection *info, struct msghdr *msg);
+-int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst);
++int smbd_send(struct TCP_Server_Info *server,
++ int num_rqst, struct smb_rqst *rqst);
+
+ enum mr_state {
+ MR_READY,
+@@ -332,7 +333,7 @@ static inline void *smbd_get_connection(
+ static inline int smbd_reconnect(struct TCP_Server_Info *server) {return -1; }
+ static inline void smbd_destroy(struct smbd_connection *info) {}
+ static inline int smbd_recv(struct smbd_connection *info, struct msghdr *msg) {return -1; }
+-static inline int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst) {return -1; }
++static inline int smbd_send(struct TCP_Server_Info *server, int num_rqst, struct smb_rqst *rqst) {return -1; }
+ #endif
+
+ #endif
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index f2938bd95c40..fe77f41bff9f 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -287,7 +287,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
+ __be32 rfc1002_marker;
+
+ if (cifs_rdma_enabled(server) && server->smbd_conn) {
+- rc = smbd_send(server, rqst);
++ rc = smbd_send(server, num_rqst, rqst);
+ goto smbd_done;
+ }
+ if (ssocket == NULL)
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index 913061c0de1b..e8e27cdc2f67 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -137,6 +137,49 @@ static void debug_print_tree(struct ext4_sb_info *sbi)
+ printk(KERN_CONT "\n");
+ }
+
++static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
++{
++ struct inode *inode;
++ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ struct ext4_map_blocks map;
++ u32 i = 0, num;
++ int err = 0, n;
++
++ if ((ino < EXT4_ROOT_INO) ||
++ (ino > le32_to_cpu(sbi->s_es->s_inodes_count)))
++ return -EINVAL;
++ inode = ext4_iget(sb, ino, EXT4_IGET_SPECIAL);
++ if (IS_ERR(inode))
++ return PTR_ERR(inode);
++ num = (inode->i_size + sb->s_blocksize - 1) >> sb->s_blocksize_bits;
++ while (i < num) {
++ map.m_lblk = i;
++ map.m_len = num - i;
++ n = ext4_map_blocks(NULL, inode, &map, 0);
++ if (n < 0) {
++ err = n;
++ break;
++ }
++ if (n == 0) {
++ i++;
++ } else {
++ if (!ext4_data_block_valid(sbi, map.m_pblk, n)) {
++ ext4_error(sb, "blocks %llu-%llu from inode %u "
++ "overlap system zone", map.m_pblk,
++ map.m_pblk + map.m_len - 1, ino);
++ err = -EFSCORRUPTED;
++ break;
++ }
++ err = add_system_zone(sbi, map.m_pblk, n);
++ if (err < 0)
++ break;
++ i += n;
++ }
++ }
++ iput(inode);
++ return err;
++}
++
+ int ext4_setup_system_zone(struct super_block *sb)
+ {
+ ext4_group_t ngroups = ext4_get_groups_count(sb);
+@@ -171,6 +214,12 @@ int ext4_setup_system_zone(struct super_block *sb)
+ if (ret)
+ return ret;
+ }
++ if (ext4_has_feature_journal(sb) && sbi->s_es->s_journal_inum) {
++ ret = ext4_protect_reserved_inode(sb,
++ le32_to_cpu(sbi->s_es->s_journal_inum));
++ if (ret)
++ return ret;
++ }
+
+ if (test_opt(sb, DEBUG))
+ debug_print_tree(sbi);
+@@ -227,6 +276,11 @@ int ext4_check_blockref(const char *function, unsigned int line,
+ __le32 *bref = p;
+ unsigned int blk;
+
++ if (ext4_has_feature_journal(inode->i_sb) &&
++ (inode->i_ino ==
++ le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum)))
++ return 0;
++
+ while (bref < p+max) {
+ blk = le32_to_cpu(*bref++);
+ if (blk &&
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 45aea792d22a..00bf0b67aae8 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -518,10 +518,14 @@ __read_extent_tree_block(const char *function, unsigned int line,
+ }
+ if (buffer_verified(bh) && !(flags & EXT4_EX_FORCE_CACHE))
+ return bh;
+- err = __ext4_ext_check(function, line, inode,
+- ext_block_hdr(bh), depth, pblk);
+- if (err)
+- goto errout;
++ if (!ext4_has_feature_journal(inode->i_sb) ||
++ (inode->i_ino !=
++ le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) {
++ err = __ext4_ext_check(function, line, inode,
++ ext_block_hdr(bh), depth, pblk);
++ if (err)
++ goto errout;
++ }
+ set_buffer_verified(bh);
+ /*
+ * If this is a leaf block, cache all of its entries
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index e65559bf7728..cff6277f7a9f 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -399,6 +399,10 @@ static int __check_block_validity(struct inode *inode, const char *func,
+ unsigned int line,
+ struct ext4_map_blocks *map)
+ {
++ if (ext4_has_feature_journal(inode->i_sb) &&
++ (inode->i_ino ==
++ le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum)))
++ return 0;
+ if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), map->m_pblk,
+ map->m_len)) {
+ ext4_error_inode(inode, func, line, map->m_pblk,
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 75fe92eaa681..1624618c2bc7 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -153,7 +153,7 @@ again:
+ /* Block nfs4_proc_unlck */
+ mutex_lock(&sp->so_delegreturn_mutex);
+ seq = raw_seqcount_begin(&sp->so_reclaim_seqcount);
+- err = nfs4_open_delegation_recall(ctx, state, stateid, type);
++ err = nfs4_open_delegation_recall(ctx, state, stateid);
+ if (!err)
+ err = nfs_delegation_claim_locks(ctx, state, stateid);
+ if (!err && read_seqcount_retry(&sp->so_reclaim_seqcount, seq))
+diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
+index bb1ef8c37af4..c95477823fa6 100644
+--- a/fs/nfs/delegation.h
++++ b/fs/nfs/delegation.h
+@@ -61,7 +61,7 @@ void nfs_reap_expired_delegations(struct nfs_client *clp);
+
+ /* NFSv4 delegation-related procedures */
+ int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync);
+-int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid, fmode_t type);
++int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid);
+ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state, const nfs4_stateid *stateid);
+ bool nfs4_copy_delegation_stateid(struct inode *inode, fmode_t flags, nfs4_stateid *dst, struct rpc_cred **cred);
+ bool nfs4_refresh_delegation_stateid(nfs4_stateid *dst, struct inode *inode);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 31ae3bd5d9d2..621e3cf90f4e 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2113,12 +2113,10 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
+ case -NFS4ERR_BAD_HIGH_SLOT:
+ case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
+ case -NFS4ERR_DEADSESSION:
+- set_bit(NFS_DELEGATED_STATE, &state->flags);
+ nfs4_schedule_session_recovery(server->nfs_client->cl_session, err);
+ return -EAGAIN;
+ case -NFS4ERR_STALE_CLIENTID:
+ case -NFS4ERR_STALE_STATEID:
+- set_bit(NFS_DELEGATED_STATE, &state->flags);
+ /* Don't recall a delegation if it was lost */
+ nfs4_schedule_lease_recovery(server->nfs_client);
+ return -EAGAIN;
+@@ -2139,7 +2137,6 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
+ return -EAGAIN;
+ case -NFS4ERR_DELAY:
+ case -NFS4ERR_GRACE:
+- set_bit(NFS_DELEGATED_STATE, &state->flags);
+ ssleep(1);
+ return -EAGAIN;
+ case -ENOMEM:
+@@ -2155,8 +2152,7 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
+ }
+
+ int nfs4_open_delegation_recall(struct nfs_open_context *ctx,
+- struct nfs4_state *state, const nfs4_stateid *stateid,
+- fmode_t type)
++ struct nfs4_state *state, const nfs4_stateid *stateid)
+ {
+ struct nfs_server *server = NFS_SERVER(state->inode);
+ struct nfs4_opendata *opendata;
+@@ -2167,20 +2163,23 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx,
+ if (IS_ERR(opendata))
+ return PTR_ERR(opendata);
+ nfs4_stateid_copy(&opendata->o_arg.u.delegation, stateid);
+- nfs_state_clear_delegation(state);
+- switch (type & (FMODE_READ|FMODE_WRITE)) {
+- case FMODE_READ|FMODE_WRITE:
+- case FMODE_WRITE:
++ if (!test_bit(NFS_O_RDWR_STATE, &state->flags)) {
+ err = nfs4_open_recover_helper(opendata, FMODE_READ|FMODE_WRITE);
+ if (err)
+- break;
++ goto out;
++ }
++ if (!test_bit(NFS_O_WRONLY_STATE, &state->flags)) {
+ err = nfs4_open_recover_helper(opendata, FMODE_WRITE);
+ if (err)
+- break;
+- /* Fall through */
+- case FMODE_READ:
++ goto out;
++ }
++ if (!test_bit(NFS_O_RDONLY_STATE, &state->flags)) {
+ err = nfs4_open_recover_helper(opendata, FMODE_READ);
++ if (err)
++ goto out;
+ }
++ nfs_state_clear_delegation(state);
++out:
+ nfs4_opendata_put(opendata);
+ return nfs4_handle_delegation_recall_error(server, state, stateid, NULL, err);
+ }
+diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c
+index 8cf2218b46a7..6f90d91a8733 100644
+--- a/fs/pstore/inode.c
++++ b/fs/pstore/inode.c
+@@ -330,10 +330,6 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record)
+ goto fail;
+ inode->i_mode = S_IFREG | 0444;
+ inode->i_fop = &pstore_file_operations;
+- private = kzalloc(sizeof(*private), GFP_KERNEL);
+- if (!private)
+- goto fail_alloc;
+- private->record = record;
+
+ switch (record->type) {
+ case PSTORE_TYPE_DMESG:
+@@ -383,12 +379,16 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record)
+ break;
+ }
+
++ private = kzalloc(sizeof(*private), GFP_KERNEL);
++ if (!private)
++ goto fail_inode;
++
+ dentry = d_alloc_name(root, name);
+ if (!dentry)
+ goto fail_private;
+
++ private->record = record;
+ inode->i_size = private->total_size = size;
+-
+ inode->i_private = private;
+
+ if (record->time.tv_sec)
+@@ -404,7 +404,7 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record)
+
+ fail_private:
+ free_pstore_private(private);
+-fail_alloc:
++fail_inode:
+ iput(inode);
+
+ fail:
+diff --git a/include/drm/drm_device.h b/include/drm/drm_device.h
+index f9c6e0e3aec7..fa117e11458a 100644
+--- a/include/drm/drm_device.h
++++ b/include/drm/drm_device.h
+@@ -174,7 +174,13 @@ struct drm_device {
+ * races and imprecision over longer time periods, hence exposing a
+ * hardware vblank counter is always recommended.
+ *
+- * If non-zeor, &drm_crtc_funcs.get_vblank_counter must be set.
++ * This is the statically configured device wide maximum. The driver
++ * can instead choose to use a runtime configurable per-crtc value
++ * &drm_vblank_crtc.max_vblank_count, in which case @max_vblank_count
++ * must be left at zero. See drm_crtc_set_max_vblank_count() on how
++ * to use the per-crtc value.
++ *
++ * If non-zero, &drm_crtc_funcs.get_vblank_counter must be set.
+ */
+ u32 max_vblank_count; /**< size of vblank counter register */
+
+diff --git a/include/drm/drm_vblank.h b/include/drm/drm_vblank.h
+index d25a9603ab57..e9c676381fd4 100644
+--- a/include/drm/drm_vblank.h
++++ b/include/drm/drm_vblank.h
+@@ -128,6 +128,26 @@ struct drm_vblank_crtc {
+ * @last: Protected by &drm_device.vbl_lock, used for wraparound handling.
+ */
+ u32 last;
++ /**
++ * @max_vblank_count:
++ *
++ * Maximum value of the vblank registers for this crtc. This value +1
++ * will result in a wrap-around of the vblank register. It is used
++ * by the vblank core to handle wrap-arounds.
++ *
++ * If set to zero the vblank core will try to guess the elapsed vblanks
++ * between times when the vblank interrupt is disabled through
++ * high-precision timestamps. That approach is suffering from small
++ * races and imprecision over longer time periods, hence exposing a
++ * hardware vblank counter is always recommended.
++ *
++ * This is the runtime configurable per-crtc maximum set through
++ * drm_crtc_set_max_vblank_count(). If this is used the driver
++ * must leave the device wide &drm_device.max_vblank_count at zero.
++ *
++ * If non-zero, &drm_crtc_funcs.get_vblank_counter must be set.
++ */
++ u32 max_vblank_count;
+ /**
+ * @inmodeset: Tracks whether the vblank is disabled due to a modeset.
+ * For legacy driver bit 2 additionally tracks whether an additional
+@@ -206,4 +226,6 @@ bool drm_calc_vbltimestamp_from_scanoutpos(struct drm_device *dev,
+ void drm_calc_timestamping_constants(struct drm_crtc *crtc,
+ const struct drm_display_mode *mode);
+ wait_queue_head_t *drm_crtc_vblank_waitqueue(struct drm_crtc *crtc);
++void drm_crtc_set_max_vblank_count(struct drm_crtc *crtc,
++ u32 max_vblank_count);
+ #endif
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index bef2e36c01b4..91f9f95ad506 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -62,7 +62,8 @@ typedef int (*dm_clone_and_map_request_fn) (struct dm_target *ti,
+ struct request *rq,
+ union map_info *map_context,
+ struct request **clone);
+-typedef void (*dm_release_clone_request_fn) (struct request *clone);
++typedef void (*dm_release_clone_request_fn) (struct request *clone,
++ union map_info *map_context);
+
+ /*
+ * Returns:
+diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
+index acc4279ad5e3..412098b24f58 100644
+--- a/include/linux/gpio/consumer.h
++++ b/include/linux/gpio/consumer.h
+@@ -222,7 +222,7 @@ static inline void gpiod_put(struct gpio_desc *desc)
+ might_sleep();
+
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+
+ static inline void gpiod_put_array(struct gpio_descs *descs)
+@@ -230,7 +230,7 @@ static inline void gpiod_put_array(struct gpio_descs *descs)
+ might_sleep();
+
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(descs);
+ }
+
+ static inline struct gpio_desc *__must_check
+@@ -283,7 +283,7 @@ static inline void devm_gpiod_put(struct device *dev, struct gpio_desc *desc)
+ might_sleep();
+
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+
+ static inline void devm_gpiod_put_array(struct device *dev,
+@@ -292,32 +292,32 @@ static inline void devm_gpiod_put_array(struct device *dev,
+ might_sleep();
+
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(descs);
+ }
+
+
+ static inline int gpiod_get_direction(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+ static inline int gpiod_direction_input(struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+ static inline int gpiod_direction_output(struct gpio_desc *desc, int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+ static inline int gpiod_direction_output_raw(struct gpio_desc *desc, int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+
+@@ -325,7 +325,7 @@ static inline int gpiod_direction_output_raw(struct gpio_desc *desc, int value)
+ static inline int gpiod_get_value(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+ static inline int gpiod_get_array_value(unsigned int array_size,
+@@ -333,25 +333,25 @@ static inline int gpiod_get_array_value(unsigned int array_size,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+ static inline void gpiod_set_value(struct gpio_desc *desc, int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+ static inline void gpiod_set_array_value(unsigned int array_size,
+ struct gpio_desc **desc_array,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ }
+ static inline int gpiod_get_raw_value(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+ static inline int gpiod_get_raw_array_value(unsigned int array_size,
+@@ -359,27 +359,27 @@ static inline int gpiod_get_raw_array_value(unsigned int array_size,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+ static inline void gpiod_set_raw_value(struct gpio_desc *desc, int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+ static inline int gpiod_set_raw_array_value(unsigned int array_size,
+ struct gpio_desc **desc_array,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+
+ static inline int gpiod_get_value_cansleep(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+ static inline int gpiod_get_array_value_cansleep(unsigned int array_size,
+@@ -387,25 +387,25 @@ static inline int gpiod_get_array_value_cansleep(unsigned int array_size,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+ static inline void gpiod_set_value_cansleep(struct gpio_desc *desc, int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+ static inline void gpiod_set_array_value_cansleep(unsigned int array_size,
+ struct gpio_desc **desc_array,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ }
+ static inline int gpiod_get_raw_value_cansleep(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+ static inline int gpiod_get_raw_array_value_cansleep(unsigned int array_size,
+@@ -413,55 +413,55 @@ static inline int gpiod_get_raw_array_value_cansleep(unsigned int array_size,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+ static inline void gpiod_set_raw_value_cansleep(struct gpio_desc *desc,
+ int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+ static inline int gpiod_set_raw_array_value_cansleep(unsigned int array_size,
+ struct gpio_desc **desc_array,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+
+ static inline int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+
+ static inline int gpiod_set_transitory(struct gpio_desc *desc, bool transitory)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+
+ static inline int gpiod_is_active_low(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+ static inline int gpiod_cansleep(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+
+ static inline int gpiod_to_irq(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -EINVAL;
+ }
+
+@@ -469,7 +469,7 @@ static inline int gpiod_set_consumer_name(struct gpio_desc *desc,
+ const char *name)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -EINVAL;
+ }
+
+@@ -481,7 +481,7 @@ static inline struct gpio_desc *gpio_to_desc(unsigned gpio)
+ static inline int desc_to_gpio(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -EINVAL;
+ }
+
+diff --git a/include/media/cec.h b/include/media/cec.h
+index dc4b412e8fa1..59bf280e9715 100644
+--- a/include/media/cec.h
++++ b/include/media/cec.h
+@@ -333,67 +333,6 @@ void cec_queue_pin_5v_event(struct cec_adapter *adap, bool is_high, ktime_t ts);
+ u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
+ unsigned int *offset);
+
+-/**
+- * cec_set_edid_phys_addr() - find and set the physical address
+- *
+- * @edid: pointer to the EDID data
+- * @size: size in bytes of the EDID data
+- * @phys_addr: the new physical address
+- *
+- * This function finds the location of the physical address in the EDID
+- * and fills in the given physical address and updates the checksum
+- * at the end of the EDID block. It does nothing if the EDID doesn't
+- * contain a physical address.
+- */
+-void cec_set_edid_phys_addr(u8 *edid, unsigned int size, u16 phys_addr);
+-
+-/**
+- * cec_phys_addr_for_input() - calculate the PA for an input
+- *
+- * @phys_addr: the physical address of the parent
+- * @input: the number of the input port, must be between 1 and 15
+- *
+- * This function calculates a new physical address based on the input
+- * port number. For example:
+- *
+- * PA = 0.0.0.0 and input = 2 becomes 2.0.0.0
+- *
+- * PA = 3.0.0.0 and input = 1 becomes 3.1.0.0
+- *
+- * PA = 3.2.1.0 and input = 5 becomes 3.2.1.5
+- *
+- * PA = 3.2.1.3 and input = 5 becomes f.f.f.f since it maxed out the depth.
+- *
+- * Return: the new physical address or CEC_PHYS_ADDR_INVALID.
+- */
+-u16 cec_phys_addr_for_input(u16 phys_addr, u8 input);
+-
+-/**
+- * cec_phys_addr_validate() - validate a physical address from an EDID
+- *
+- * @phys_addr: the physical address to validate
+- * @parent: if not %NULL, then this is filled with the parents PA.
+- * @port: if not %NULL, then this is filled with the input port.
+- *
+- * This validates a physical address as read from an EDID. If the
+- * PA is invalid (such as 1.0.1.0 since '0' is only allowed at the end),
+- * then it will return -EINVAL.
+- *
+- * The parent PA is passed into %parent and the input port is passed into
+- * %port. For example:
+- *
+- * PA = 0.0.0.0: has parent 0.0.0.0 and input port 0.
+- *
+- * PA = 1.0.0.0: has parent 0.0.0.0 and input port 1.
+- *
+- * PA = 3.2.0.0: has parent 3.0.0.0 and input port 2.
+- *
+- * PA = f.f.f.f: has parent f.f.f.f and input port 0.
+- *
+- * Return: 0 if the PA is valid, -EINVAL if not.
+- */
+-int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port);
+-
+ #else
+
+ static inline int cec_register_adapter(struct cec_adapter *adap,
+@@ -428,25 +367,6 @@ static inline u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
+ return CEC_PHYS_ADDR_INVALID;
+ }
+
+-static inline void cec_set_edid_phys_addr(u8 *edid, unsigned int size,
+- u16 phys_addr)
+-{
+-}
+-
+-static inline u16 cec_phys_addr_for_input(u16 phys_addr, u8 input)
+-{
+- return CEC_PHYS_ADDR_INVALID;
+-}
+-
+-static inline int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port)
+-{
+- if (parent)
+- *parent = phys_addr;
+- if (port)
+- *port = 0;
+- return 0;
+-}
+-
+ #endif
+
+ /**
+diff --git a/include/media/v4l2-dv-timings.h b/include/media/v4l2-dv-timings.h
+index 17cb27df1b81..4e7732d3908c 100644
+--- a/include/media/v4l2-dv-timings.h
++++ b/include/media/v4l2-dv-timings.h
+@@ -234,4 +234,10 @@ v4l2_hdmi_rx_colorimetry(const struct hdmi_avi_infoframe *avi,
+ const struct hdmi_vendor_infoframe *hdmi,
+ unsigned int height);
+
++u16 v4l2_get_edid_phys_addr(const u8 *edid, unsigned int size,
++ unsigned int *offset);
++void v4l2_set_edid_phys_addr(u8 *edid, unsigned int size, u16 phys_addr);
++u16 v4l2_phys_addr_for_input(u16 phys_addr, u8 input);
++int v4l2_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port);
++
+ #endif
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 67e0a990144a..468deae5d603 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -6562,6 +6562,21 @@ int cfg80211_external_auth_request(struct net_device *netdev,
+ struct cfg80211_external_auth_params *params,
+ gfp_t gfp);
+
++/**
++ * cfg80211_iftype_allowed - check whether the interface can be allowed
++ * @wiphy: the wiphy
++ * @iftype: interface type
++ * @is_4addr: use_4addr flag, must be '0' when check_swif is '1'
++ * @check_swif: check iftype against software interfaces
++ *
++ * Check whether the interface is allowed to operate; additionally, this API
++ * can be used to check iftype against the software interfaces when
++ * check_swif is '1'.
++ */
++bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
++ bool is_4addr, u8 check_swif);
++
++
+ /* Logging, debugging and troubleshooting/diagnostic helpers. */
+
+ /* wiphy_printk helpers, similar to dev_printk */
+diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
+index 7b8c9e19bad1..0f3cb13db8e9 100644
+--- a/include/uapi/linux/keyctl.h
++++ b/include/uapi/linux/keyctl.h
+@@ -65,7 +65,12 @@
+
+ /* keyctl structures */
+ struct keyctl_dh_params {
+- __s32 private;
++ union {
++#ifndef __cplusplus
++ __s32 private;
++#endif
++ __s32 priv;
++ };
+ __s32 prime;
+ __s32 base;
+ };
+diff --git a/kernel/module.c b/kernel/module.c
+index 3fda10c549a2..0d86fc73d63d 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -76,14 +76,9 @@
+
+ /*
+ * Modules' sections will be aligned on page boundaries
+- * to ensure complete separation of code and data, but
+- * only when CONFIG_STRICT_MODULE_RWX=y
++ * to ensure complete separation of code and data
+ */
+-#ifdef CONFIG_STRICT_MODULE_RWX
+ # define debug_align(X) ALIGN(X, PAGE_SIZE)
+-#else
+-# define debug_align(X) (X)
+-#endif
+
+ /* If this is set, the section belongs in the init part of the module */
+ #define INIT_OFFSET_MASK (1UL << (BITS_PER_LONG-1))
+@@ -1699,6 +1694,8 @@ static int add_usage_links(struct module *mod)
+ return ret;
+ }
+
++static void module_remove_modinfo_attrs(struct module *mod, int end);
++
+ static int module_add_modinfo_attrs(struct module *mod)
+ {
+ struct module_attribute *attr;
+@@ -1713,24 +1710,34 @@ static int module_add_modinfo_attrs(struct module *mod)
+ return -ENOMEM;
+
+ temp_attr = mod->modinfo_attrs;
+- for (i = 0; (attr = modinfo_attrs[i]) && !error; i++) {
++ for (i = 0; (attr = modinfo_attrs[i]); i++) {
+ if (!attr->test || attr->test(mod)) {
+ memcpy(temp_attr, attr, sizeof(*temp_attr));
+ sysfs_attr_init(&temp_attr->attr);
+ error = sysfs_create_file(&mod->mkobj.kobj,
+ &temp_attr->attr);
++ if (error)
++ goto error_out;
+ ++temp_attr;
+ }
+ }
++
++ return 0;
++
++error_out:
++ if (i > 0)
++ module_remove_modinfo_attrs(mod, --i);
+ return error;
+ }
+
+-static void module_remove_modinfo_attrs(struct module *mod)
++static void module_remove_modinfo_attrs(struct module *mod, int end)
+ {
+ struct module_attribute *attr;
+ int i;
+
+ for (i = 0; (attr = &mod->modinfo_attrs[i]); i++) {
++ if (end >= 0 && i > end)
++ break;
+ /* pick a field to test for end of list */
+ if (!attr->attr.name)
+ break;
+@@ -1818,7 +1825,7 @@ static int mod_sysfs_setup(struct module *mod,
+ return 0;
+
+ out_unreg_modinfo_attrs:
+- module_remove_modinfo_attrs(mod);
++ module_remove_modinfo_attrs(mod, -1);
+ out_unreg_param:
+ module_param_sysfs_remove(mod);
+ out_unreg_holders:
+@@ -1854,7 +1861,7 @@ static void mod_sysfs_fini(struct module *mod)
+ {
+ }
+
+-static void module_remove_modinfo_attrs(struct module *mod)
++static void module_remove_modinfo_attrs(struct module *mod, int end)
+ {
+ }
+
+@@ -1870,7 +1877,7 @@ static void init_param_lock(struct module *mod)
+ static void mod_sysfs_teardown(struct module *mod)
+ {
+ del_usage_links(mod);
+- module_remove_modinfo_attrs(mod);
++ module_remove_modinfo_attrs(mod, -1);
+ module_param_sysfs_remove(mod);
+ kobject_put(mod->mkobj.drivers_dir);
+ kobject_put(mod->holders_dir);
+diff --git a/kernel/resource.c b/kernel/resource.c
+index 30e1bc68503b..bce773cc5e41 100644
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -318,24 +318,27 @@ int release_resource(struct resource *old)
+
+ EXPORT_SYMBOL(release_resource);
+
+-/*
+- * Finds the lowest iomem resource existing within [res->start.res->end).
+- * The caller must specify res->start, res->end, res->flags, and optionally
+- * desc. If found, returns 0, res is overwritten, if not found, returns -1.
+- * This function walks the whole tree and not just first level children until
+- * and unless first_level_children_only is true.
++/**
++ * Finds the lowest iomem resource that covers part of [start..end]. The
++ * caller must specify start, end, flags, and desc (which may be
++ * IORES_DESC_NONE).
++ *
++ * If a resource is found, returns 0 and *res is overwritten with the part
++ * of the resource that's within [start..end]; if none is found, returns
++ * -ENODEV. Returns -EINVAL for invalid parameters.
++ *
++ * This function walks the whole tree and not just first level children
++ * unless @first_level_children_only is true.
+ */
+-static int find_next_iomem_res(struct resource *res, unsigned long desc,
+- bool first_level_children_only)
++static int find_next_iomem_res(resource_size_t start, resource_size_t end,
++ unsigned long flags, unsigned long desc,
++ bool first_level_children_only,
++ struct resource *res)
+ {
+- resource_size_t start, end;
+ struct resource *p;
+ bool sibling_only = false;
+
+ BUG_ON(!res);
+-
+- start = res->start;
+- end = res->end;
+ BUG_ON(start >= end);
+
+ if (first_level_children_only)
+@@ -344,7 +347,7 @@ static int find_next_iomem_res(struct resource *res, unsigned long desc,
+ read_lock(&resource_lock);
+
+ for (p = iomem_resource.child; p; p = next_resource(p, sibling_only)) {
+- if ((p->flags & res->flags) != res->flags)
++ if ((p->flags & flags) != flags)
+ continue;
+ if ((desc != IORES_DESC_NONE) && (desc != p->desc))
+ continue;
+@@ -352,39 +355,38 @@ static int find_next_iomem_res(struct resource *res, unsigned long desc,
+ p = NULL;
+ break;
+ }
+- if ((p->end >= start) && (p->start < end))
++ if ((p->end >= start) && (p->start <= end))
+ break;
+ }
+
++ if (p) {
++ /* copy data */
++ res->start = max(start, p->start);
++ res->end = min(end, p->end);
++ res->flags = p->flags;
++ res->desc = p->desc;
++ }
++
+ read_unlock(&resource_lock);
+- if (!p)
+- return -1;
+- /* copy data */
+- if (res->start < p->start)
+- res->start = p->start;
+- if (res->end > p->end)
+- res->end = p->end;
+- res->flags = p->flags;
+- res->desc = p->desc;
+- return 0;
++ return p ? 0 : -ENODEV;
+ }
+
+-static int __walk_iomem_res_desc(struct resource *res, unsigned long desc,
+- bool first_level_children_only,
+- void *arg,
++static int __walk_iomem_res_desc(resource_size_t start, resource_size_t end,
++ unsigned long flags, unsigned long desc,
++ bool first_level_children_only, void *arg,
+ int (*func)(struct resource *, void *))
+ {
+- u64 orig_end = res->end;
++ struct resource res;
+ int ret = -1;
+
+- while ((res->start < res->end) &&
+- !find_next_iomem_res(res, desc, first_level_children_only)) {
+- ret = (*func)(res, arg);
++ while (start < end &&
++ !find_next_iomem_res(start, end, flags, desc,
++ first_level_children_only, &res)) {
++ ret = (*func)(&res, arg);
+ if (ret)
+ break;
+
+- res->start = res->end + 1;
+- res->end = orig_end;
++ start = res.end + 1;
+ }
+
+ return ret;
+@@ -407,13 +409,7 @@ static int __walk_iomem_res_desc(struct resource *res, unsigned long desc,
+ int walk_iomem_res_desc(unsigned long desc, unsigned long flags, u64 start,
+ u64 end, void *arg, int (*func)(struct resource *, void *))
+ {
+- struct resource res;
+-
+- res.start = start;
+- res.end = end;
+- res.flags = flags;
+-
+- return __walk_iomem_res_desc(&res, desc, false, arg, func);
++ return __walk_iomem_res_desc(start, end, flags, desc, false, arg, func);
+ }
+ EXPORT_SYMBOL_GPL(walk_iomem_res_desc);
+
+@@ -427,13 +423,9 @@ EXPORT_SYMBOL_GPL(walk_iomem_res_desc);
+ int walk_system_ram_res(u64 start, u64 end, void *arg,
+ int (*func)(struct resource *, void *))
+ {
+- struct resource res;
++ unsigned long flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
+
+- res.start = start;
+- res.end = end;
+- res.flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
+-
+- return __walk_iomem_res_desc(&res, IORES_DESC_NONE, true,
++ return __walk_iomem_res_desc(start, end, flags, IORES_DESC_NONE, true,
+ arg, func);
+ }
+
+@@ -444,13 +436,9 @@ int walk_system_ram_res(u64 start, u64 end, void *arg,
+ int walk_mem_res(u64 start, u64 end, void *arg,
+ int (*func)(struct resource *, void *))
+ {
+- struct resource res;
++ unsigned long flags = IORESOURCE_MEM | IORESOURCE_BUSY;
+
+- res.start = start;
+- res.end = end;
+- res.flags = IORESOURCE_MEM | IORESOURCE_BUSY;
+-
+- return __walk_iomem_res_desc(&res, IORES_DESC_NONE, true,
++ return __walk_iomem_res_desc(start, end, flags, IORES_DESC_NONE, true,
+ arg, func);
+ }
+
+@@ -464,25 +452,25 @@ int walk_mem_res(u64 start, u64 end, void *arg,
+ int walk_system_ram_range(unsigned long start_pfn, unsigned long nr_pages,
+ void *arg, int (*func)(unsigned long, unsigned long, void *))
+ {
++ resource_size_t start, end;
++ unsigned long flags;
+ struct resource res;
+ unsigned long pfn, end_pfn;
+- u64 orig_end;
+ int ret = -1;
+
+- res.start = (u64) start_pfn << PAGE_SHIFT;
+- res.end = ((u64)(start_pfn + nr_pages) << PAGE_SHIFT) - 1;
+- res.flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
+- orig_end = res.end;
+- while ((res.start < res.end) &&
+- (find_next_iomem_res(&res, IORES_DESC_NONE, true) >= 0)) {
++ start = (u64) start_pfn << PAGE_SHIFT;
++ end = ((u64)(start_pfn + nr_pages) << PAGE_SHIFT) - 1;
++ flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
++ while (start < end &&
++ !find_next_iomem_res(start, end, flags, IORES_DESC_NONE,
++ true, &res)) {
+ pfn = (res.start + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ end_pfn = (res.end + 1) >> PAGE_SHIFT;
+ if (end_pfn > pfn)
+ ret = (*func)(pfn, end_pfn - pfn, arg);
+ if (ret)
+ break;
+- res.start = res.end + 1;
+- res.end = orig_end;
++ start = res.end + 1;
+ }
+ return ret;
+ }
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 75f322603d44..49ed38914669 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4420,6 +4420,8 @@ static void __account_cfs_rq_runtime(struct cfs_rq *cfs_rq, u64 delta_exec)
+ if (likely(cfs_rq->runtime_remaining > 0))
+ return;
+
++ if (cfs_rq->throttled)
++ return;
+ /*
+ * if we're unable to extend our runtime we resched so that the active
+ * hierarchy can be throttled
+@@ -4615,6 +4617,9 @@ static u64 distribute_cfs_runtime(struct cfs_bandwidth *cfs_b,
+ if (!cfs_rq_throttled(cfs_rq))
+ goto next;
+
++ /* By the above check, this should never be true */
++ SCHED_WARN_ON(cfs_rq->runtime_remaining > 0);
++
+ runtime = -cfs_rq->runtime_remaining + 1;
+ if (runtime > remaining)
+ runtime = remaining;
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 443edcddac8a..c2708e1f0c69 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -823,7 +823,7 @@ ktime_t ktime_get_coarse_with_offset(enum tk_offsets offs)
+
+ } while (read_seqcount_retry(&tk_core.seq, seq));
+
+- return base + nsecs;
++ return ktime_add_ns(base, nsecs);
+ }
+ EXPORT_SYMBOL_GPL(ktime_get_coarse_with_offset);
+
+diff --git a/mm/migrate.c b/mm/migrate.c
+index b2ea7d1e6f24..0c48191a9036 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -2328,16 +2328,13 @@ next:
+ */
+ static void migrate_vma_collect(struct migrate_vma *migrate)
+ {
+- struct mm_walk mm_walk;
+-
+- mm_walk.pmd_entry = migrate_vma_collect_pmd;
+- mm_walk.pte_entry = NULL;
+- mm_walk.pte_hole = migrate_vma_collect_hole;
+- mm_walk.hugetlb_entry = NULL;
+- mm_walk.test_walk = NULL;
+- mm_walk.vma = migrate->vma;
+- mm_walk.mm = migrate->vma->vm_mm;
+- mm_walk.private = migrate;
++ struct mm_walk mm_walk = {
++ .pmd_entry = migrate_vma_collect_pmd,
++ .pte_hole = migrate_vma_collect_hole,
++ .vma = migrate->vma,
++ .mm = migrate->vma->vm_mm,
++ .private = migrate,
++ };
+
+ mmu_notifier_invalidate_range_start(mm_walk.mm,
+ migrate->start,
+diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
+index 0b7b36fa0d5c..36f244125d24 100644
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -463,17 +463,23 @@ static u8 batadv_hop_penalty(u8 tq, const struct batadv_priv *bat_priv)
+ * batadv_iv_ogm_aggr_packet() - checks if there is another OGM attached
+ * @buff_pos: current position in the skb
+ * @packet_len: total length of the skb
+- * @tvlv_len: tvlv length of the previously considered OGM
++ * @ogm_packet: potential OGM in buffer
+ *
+ * Return: true if there is enough space for another OGM, false otherwise.
+ */
+-static bool batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len,
+- __be16 tvlv_len)
++static bool
++batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len,
++ const struct batadv_ogm_packet *ogm_packet)
+ {
+ int next_buff_pos = 0;
+
+- next_buff_pos += buff_pos + BATADV_OGM_HLEN;
+- next_buff_pos += ntohs(tvlv_len);
++ /* check if there is enough space for the header */
++ next_buff_pos += buff_pos + sizeof(*ogm_packet);
++ if (next_buff_pos > packet_len)
++ return false;
++
++ /* check if there is enough space for the optional TVLV */
++ next_buff_pos += ntohs(ogm_packet->tvlv_len);
+
+ return (next_buff_pos <= packet_len) &&
+ (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
+@@ -501,7 +507,7 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet,
+
+ /* adjust all flags and log packets */
+ while (batadv_iv_ogm_aggr_packet(buff_pos, forw_packet->packet_len,
+- batadv_ogm_packet->tvlv_len)) {
++ batadv_ogm_packet)) {
+ /* we might have aggregated direct link packets with an
+ * ordinary base packet
+ */
+@@ -1852,7 +1858,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
+
+ /* unpack the aggregated packets and process them one by one */
+ while (batadv_iv_ogm_aggr_packet(ogm_offset, skb_headlen(skb),
+- ogm_packet->tvlv_len)) {
++ ogm_packet)) {
+ batadv_iv_ogm_process(skb, ogm_offset, if_incoming);
+
+ ogm_offset += BATADV_OGM_HLEN;
+diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c
+index 0d9459b69bdb..c32820963b8e 100644
+--- a/net/batman-adv/netlink.c
++++ b/net/batman-adv/netlink.c
+@@ -118,7 +118,7 @@ batadv_netlink_get_ifindex(const struct nlmsghdr *nlh, int attrtype)
+ {
+ struct nlattr *attr = nlmsg_find_attr(nlh, GENL_HDRLEN, attrtype);
+
+- return attr ? nla_get_u32(attr) : 0;
++ return (attr && nla_len(attr) == sizeof(u32)) ? nla_get_u32(attr) : 0;
+ }
+
+ /**
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index c59638574cf8..f101a6460b44 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -3527,9 +3527,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+ }
+
+ /* Always allow software iftypes */
+- if (local->hw.wiphy->software_iftypes & BIT(iftype) ||
+- (iftype == NL80211_IFTYPE_AP_VLAN &&
+- local->hw.wiphy->flags & WIPHY_FLAG_4ADDR_AP)) {
++ if (cfg80211_iftype_allowed(local->hw.wiphy, iftype, 0, 1)) {
+ if (radar_detect)
+ return -EINVAL;
+ return 0;
+@@ -3564,7 +3562,8 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+
+ if (sdata_iter == sdata ||
+ !ieee80211_sdata_running(sdata_iter) ||
+- local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
++ cfg80211_iftype_allowed(local->hw.wiphy,
++ wdev_iter->iftype, 0, 1))
+ continue;
+
+ params.iftype_num[wdev_iter->iftype]++;
+diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
+index 9c7da811d130..98f193fd5315 100644
+--- a/net/vmw_vsock/hyperv_transport.c
++++ b/net/vmw_vsock/hyperv_transport.c
+@@ -320,6 +320,11 @@ static void hvs_close_connection(struct vmbus_channel *chan)
+ lock_sock(sk);
+ hvs_do_close_lock_held(vsock_sk(sk), true);
+ release_sock(sk);
++
++ /* Release the refcnt for the channel that's opened in
++ * hvs_open_connection().
++ */
++ sock_put(sk);
+ }
+
+ static void hvs_open_connection(struct vmbus_channel *chan)
+@@ -388,6 +393,9 @@ static void hvs_open_connection(struct vmbus_channel *chan)
+ }
+
+ set_per_channel_state(chan, conn_from_host ? new : sk);
++
++ /* This reference will be dropped by hvs_close_connection(). */
++ sock_hold(conn_from_host ? new : sk);
+ vmbus_set_chn_rescind_callback(chan, hvs_close_connection);
+
+ /* Set the pending send size to max packet size to always get
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index 2a46ec3cb72c..68660781aa51 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -1335,10 +1335,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
+ }
+ break;
+ case NETDEV_PRE_UP:
+- if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)) &&
+- !(wdev->iftype == NL80211_IFTYPE_AP_VLAN &&
+- rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP &&
+- wdev->use_4addr))
++ if (!cfg80211_iftype_allowed(wdev->wiphy, wdev->iftype,
++ wdev->use_4addr, 0))
+ return notifier_from_errno(-EOPNOTSUPP);
+
+ if (rfkill_blocked(rdev->rfkill))
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 8e2f03ab4cc9..2a85bff6a8f3 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3210,9 +3210,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
+ return err;
+ }
+
+- if (!(rdev->wiphy.interface_modes & (1 << type)) &&
+- !(type == NL80211_IFTYPE_AP_VLAN && params.use_4addr &&
+- rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP))
++ if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
+ return -EOPNOTSUPP;
+
+ err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index d57e2f679a3e..c14e8f6e5e19 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1670,7 +1670,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
+ for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+ num_interfaces += params->iftype_num[iftype];
+ if (params->iftype_num[iftype] > 0 &&
+- !(wiphy->software_iftypes & BIT(iftype)))
++ !cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
+ used_iftypes |= BIT(iftype);
+ }
+
+@@ -1692,7 +1692,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
+ return -ENOMEM;
+
+ for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+- if (wiphy->software_iftypes & BIT(iftype))
++ if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
+ continue;
+ for (j = 0; j < c->n_limits; j++) {
+ all_iftypes |= limits[j].types;
+@@ -1895,3 +1895,26 @@ EXPORT_SYMBOL(rfc1042_header);
+ const unsigned char bridge_tunnel_header[] __aligned(2) =
+ { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
+ EXPORT_SYMBOL(bridge_tunnel_header);
++
++bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
++ bool is_4addr, u8 check_swif)
++
++{
++ bool is_vlan = iftype == NL80211_IFTYPE_AP_VLAN;
++
++ switch (check_swif) {
++ case 0:
++ if (is_vlan && is_4addr)
++ return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
++ return wiphy->interface_modes & BIT(iftype);
++ case 1:
++ if (!(wiphy->software_iftypes & BIT(iftype)) && is_vlan)
++ return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
++ return wiphy->software_iftypes & BIT(iftype);
++ default:
++ break;
++ }
++
++ return false;
++}
++EXPORT_SYMBOL(cfg80211_iftype_allowed);
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index c4a9ddb174bc..5aa75a0a1ced 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -78,7 +78,7 @@ parse_symbol() {
+ fi
+
+ # Strip out the base of the path
+- code=${code//^$basepath/""}
++ code=${code#$basepath/}
+
+ # In the case of inlines, move everything to same line
+ code=${code//$'\n'/' '}
+diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
+index 088ea2ac8570..612f737cee83 100644
+--- a/security/apparmor/policy_unpack.c
++++ b/security/apparmor/policy_unpack.c
+@@ -223,16 +223,21 @@ static void *kvmemdup(const void *src, size_t len)
+ static size_t unpack_u16_chunk(struct aa_ext *e, char **chunk)
+ {
+ size_t size = 0;
++ void *pos = e->pos;
+
+ if (!inbounds(e, sizeof(u16)))
+- return 0;
++ goto fail;
+ size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
+ e->pos += sizeof(__le16);
+ if (!inbounds(e, size))
+- return 0;
++ goto fail;
+ *chunk = e->pos;
+ e->pos += size;
+ return size;
++
++fail:
++ e->pos = pos;
++ return 0;
+ }
+
+ /* unpack control byte */
+@@ -294,49 +299,66 @@ fail:
+
+ static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
+ {
++ void *pos = e->pos;
++
+ if (unpack_nameX(e, AA_U32, name)) {
+ if (!inbounds(e, sizeof(u32)))
+- return 0;
++ goto fail;
+ if (data)
+ *data = le32_to_cpu(get_unaligned((__le32 *) e->pos));
+ e->pos += sizeof(u32);
+ return 1;
+ }
++
++fail:
++ e->pos = pos;
+ return 0;
+ }
+
+ static bool unpack_u64(struct aa_ext *e, u64 *data, const char *name)
+ {
++ void *pos = e->pos;
++
+ if (unpack_nameX(e, AA_U64, name)) {
+ if (!inbounds(e, sizeof(u64)))
+- return 0;
++ goto fail;
+ if (data)
+ *data = le64_to_cpu(get_unaligned((__le64 *) e->pos));
+ e->pos += sizeof(u64);
+ return 1;
+ }
++
++fail:
++ e->pos = pos;
+ return 0;
+ }
+
+ static size_t unpack_array(struct aa_ext *e, const char *name)
+ {
++ void *pos = e->pos;
++
+ if (unpack_nameX(e, AA_ARRAY, name)) {
+ int size;
+ if (!inbounds(e, sizeof(u16)))
+- return 0;
++ goto fail;
+ size = (int)le16_to_cpu(get_unaligned((__le16 *) e->pos));
+ e->pos += sizeof(u16);
+ return size;
+ }
++
++fail:
++ e->pos = pos;
+ return 0;
+ }
+
+ static size_t unpack_blob(struct aa_ext *e, char **blob, const char *name)
+ {
++ void *pos = e->pos;
++
+ if (unpack_nameX(e, AA_BLOB, name)) {
+ u32 size;
+ if (!inbounds(e, sizeof(u32)))
+- return 0;
++ goto fail;
+ size = le32_to_cpu(get_unaligned((__le32 *) e->pos));
+ e->pos += sizeof(u32);
+ if (inbounds(e, (size_t) size)) {
+@@ -345,6 +367,9 @@ static size_t unpack_blob(struct aa_ext *e, char **blob, const char *name)
+ return size;
+ }
+ }
++
++fail:
++ e->pos = pos;
+ return 0;
+ }
+
+@@ -361,9 +386,10 @@ static int unpack_str(struct aa_ext *e, const char **string, const char *name)
+ if (src_str[size - 1] != 0)
+ goto fail;
+ *string = src_str;
++
++ return size;
+ }
+ }
+- return size;
+
+ fail:
+ e->pos = pos;
+diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
+index b9a6b66aeb0e..d8ba3a6d5042 100644
+--- a/sound/pci/hda/hda_auto_parser.c
++++ b/sound/pci/hda/hda_auto_parser.c
+@@ -828,6 +828,8 @@ static void apply_fixup(struct hda_codec *codec, int id, int action, int depth)
+ while (id >= 0) {
+ const struct hda_fixup *fix = codec->fixup_list + id;
+
++ if (++depth > 10)
++ break;
+ if (fix->chained_before)
+ apply_fixup(codec, fix->chain_id, action, depth + 1);
+
+@@ -867,8 +869,6 @@ static void apply_fixup(struct hda_codec *codec, int id, int action, int depth)
+ }
+ if (!fix->chained || fix->chained_before)
+ break;
+- if (++depth > 10)
+- break;
+ id = fix->chain_id;
+ }
+ }
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index a6233775e779..82b0dc9f528f 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2947,15 +2947,19 @@ static int hda_codec_runtime_resume(struct device *dev)
+ #ifdef CONFIG_PM_SLEEP
+ static int hda_codec_force_resume(struct device *dev)
+ {
++ struct hda_codec *codec = dev_to_hda_codec(dev);
++ bool forced_resume = !codec->relaxed_resume;
+ int ret;
+
+ /* The get/put pair below enforces the runtime resume even if the
+ * device hasn't been used at suspend time. This trick is needed to
+ * update the jack state change during the sleep.
+ */
+- pm_runtime_get_noresume(dev);
++ if (forced_resume)
++ pm_runtime_get_noresume(dev);
+ ret = pm_runtime_force_resume(dev);
+- pm_runtime_put(dev);
++ if (forced_resume)
++ pm_runtime_put(dev);
+ return ret;
+ }
+
+diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
+index acacc1900265..2003403ce1c8 100644
+--- a/sound/pci/hda/hda_codec.h
++++ b/sound/pci/hda/hda_codec.h
+@@ -261,6 +261,8 @@ struct hda_codec {
+ unsigned int auto_runtime_pm:1; /* enable automatic codec runtime pm */
+ unsigned int force_pin_prefix:1; /* Add location prefix */
+ unsigned int link_down_at_suspend:1; /* link down at runtime suspend */
++ unsigned int relaxed_resume:1; /* don't resume forcibly for jack */
++
+ #ifdef CONFIG_PM
+ unsigned long power_on_acct;
+ unsigned long power_off_acct;
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index bb2bd33b00ec..2609161707a4 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -5991,7 +5991,8 @@ int snd_hda_gen_init(struct hda_codec *codec)
+ if (spec->init_hook)
+ spec->init_hook(codec);
+
+- snd_hda_apply_verbs(codec);
++ if (!spec->skip_verbs)
++ snd_hda_apply_verbs(codec);
+
+ init_multi_out(codec);
+ init_extra_out(codec);
+diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
+index ce9c293717b9..8933c0f64cc4 100644
+--- a/sound/pci/hda/hda_generic.h
++++ b/sound/pci/hda/hda_generic.h
+@@ -247,6 +247,7 @@ struct hda_gen_spec {
+ unsigned int indep_hp_enabled:1; /* independent HP enabled */
+ unsigned int have_aamix_ctl:1;
+ unsigned int hp_mic_jack_modes:1;
++ unsigned int skip_verbs:1; /* don't apply verbs at snd_hda_gen_init() */
+
+ /* additional mute flags (only effective with auto_mute_via_amp=1) */
+ u64 mute_bits;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 7a3e34b120b3..c3e3d80ff720 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -329,13 +329,11 @@ enum {
+
+ #define AZX_DCAPS_INTEL_SKYLAKE \
+ (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME |\
++ AZX_DCAPS_SYNC_WRITE |\
+ AZX_DCAPS_SEPARATE_STREAM_TAG | AZX_DCAPS_I915_COMPONENT |\
+ AZX_DCAPS_I915_POWERWELL)
+
+-#define AZX_DCAPS_INTEL_BROXTON \
+- (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME |\
+- AZX_DCAPS_SEPARATE_STREAM_TAG | AZX_DCAPS_I915_COMPONENT |\
+- AZX_DCAPS_I915_POWERWELL)
++#define AZX_DCAPS_INTEL_BROXTON AZX_DCAPS_INTEL_SKYLAKE
+
+ /* quirks for ATI SB / AMD Hudson */
+ #define AZX_DCAPS_PRESET_ATI_SB \
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 35931a18418f..e4fbfb5557ab 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2293,8 +2293,10 @@ static void generic_hdmi_free(struct hda_codec *codec)
+ struct hdmi_spec *spec = codec->spec;
+ int pin_idx, pcm_idx;
+
+- if (codec_has_acomp(codec))
++ if (codec_has_acomp(codec)) {
+ snd_hdac_acomp_register_notifier(&codec->bus->core, NULL);
++ codec->relaxed_resume = 0;
++ }
+
+ for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
+ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+@@ -2550,6 +2552,8 @@ static void register_i915_notifier(struct hda_codec *codec)
+ spec->drm_audio_ops.pin_eld_notify = intel_pin_eld_notify;
+ snd_hdac_acomp_register_notifier(&codec->bus->core,
+ &spec->drm_audio_ops);
++ /* no need for forcible resume for jack check thanks to notifier */
++ codec->relaxed_resume = 1;
+ }
+
+ /* setup_stream ops override for HSW+ */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9b5caf099bfb..7f74ebee8c2d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -836,9 +836,11 @@ static int alc_init(struct hda_codec *codec)
+ if (spec->init_hook)
+ spec->init_hook(codec);
+
++ spec->gen.skip_verbs = 1; /* applied in below */
+ snd_hda_gen_init(codec);
+ alc_fix_pll(codec);
+ alc_auto_init_amp(codec, spec->init_amp);
++ snd_hda_apply_verbs(codec); /* apply verbs here after own init */
+
+ snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT);
+
+@@ -5673,6 +5675,7 @@ enum {
+ ALC286_FIXUP_ACER_AIO_HEADSET_MIC,
+ ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+ ALC299_FIXUP_PREDATOR_SPK,
++ ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6701,6 +6704,16 @@ static const struct hda_fixup alc269_fixups[] = {
+ { }
+ }
+ },
++ [ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x14, 0x411111f0 }, /* disable confusing internal speaker */
++ { 0x19, 0x04a11150 }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6843,6 +6856,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
++ SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+@@ -6859,6 +6873,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+ SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
++ SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
+@@ -6936,6 +6951,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
++ SND_PCI_QUIRK(0x17aa, 0x3151, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+@@ -8798,6 +8814,7 @@ static int patch_alc680(struct hda_codec *codec)
+ static const struct hda_device_id snd_hda_id_realtek[] = {
+ HDA_CODEC_ENTRY(0x10ec0215, "ALC215", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0221, "ALC221", patch_alc269),
++ HDA_CODEC_ENTRY(0x10ec0222, "ALC222", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0225, "ALC225", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0231, "ALC231", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0233, "ALC233", patch_alc269),
+diff --git a/tools/testing/selftests/net/fib_rule_tests.sh b/tools/testing/selftests/net/fib_rule_tests.sh
+index 1ba069967fa2..ba2d9fab28d0 100755
+--- a/tools/testing/selftests/net/fib_rule_tests.sh
++++ b/tools/testing/selftests/net/fib_rule_tests.sh
+@@ -15,6 +15,7 @@ GW_IP6=2001:db8:1::2
+ SRC_IP6=2001:db8:1::3
+
+ DEV_ADDR=192.51.100.1
++DEV_ADDR6=2001:db8:1::1
+ DEV=dummy0
+
+ log_test()
+@@ -55,8 +56,8 @@ setup()
+
+ $IP link add dummy0 type dummy
+ $IP link set dev dummy0 up
+- $IP address add 192.51.100.1/24 dev dummy0
+- $IP -6 address add 2001:db8:1::1/64 dev dummy0
++ $IP address add $DEV_ADDR/24 dev dummy0
++ $IP -6 address add $DEV_ADDR6/64 dev dummy0
+
+ set +e
+ }
+diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
+index b20b751286fc..757a17f5ebde 100644
+--- a/virt/kvm/eventfd.c
++++ b/virt/kvm/eventfd.c
+@@ -44,6 +44,12 @@
+
+ static struct workqueue_struct *irqfd_cleanup_wq;
+
++bool __attribute__((weak))
++kvm_arch_irqfd_allowed(struct kvm *kvm, struct kvm_irqfd *args)
++{
++ return true;
++}
++
+ static void
+ irqfd_inject(struct work_struct *work)
+ {
+@@ -297,6 +303,9 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
+ if (!kvm_arch_intc_initialized(kvm))
+ return -EAGAIN;
+
++ if (!kvm_arch_irqfd_allowed(kvm, args))
++ return -EINVAL;
++
+ irqfd = kzalloc(sizeof(*irqfd), GFP_KERNEL);
+ if (!irqfd)
+ return -ENOMEM;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-09-19 10:04 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-09-19 10:04 UTC (permalink / raw
To: gentoo-commits
commit: b28b4e9d1e4258389e49dd53e4243018cdb7493a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 19 10:04:29 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Sep 19 10:04:29 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b28b4e9d
Linux patch 4.19.74
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1073_linux-4.19.74.patch | 1433 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1437 insertions(+)
diff --git a/0000_README b/0000_README
index d5d2e47..7734d78 100644
--- a/0000_README
+++ b/0000_README
@@ -331,6 +331,10 @@ Patch: 1072_linux-4.19.73.patch
From: https://www.kernel.org
Desc: Linux 4.19.73
+Patch: 1073_linux-4.19.74.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.74
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1073_linux-4.19.74.patch b/1073_linux-4.19.74.patch
new file mode 100644
index 0000000..2a11d7d
--- /dev/null
+++ b/1073_linux-4.19.74.patch
@@ -0,0 +1,1433 @@
+diff --git a/Makefile b/Makefile
+index 9748fa3704bc..3509e0c6e5ae 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 73
++SUBLEVEL = 74
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index 23bea99bf8d5..1ca9e37f7cc9 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -306,6 +306,7 @@ extern unsigned long __copy_tofrom_user(void __user *to,
+ static inline unsigned long
+ raw_copy_in_user(void __user *to, const void __user *from, unsigned long n)
+ {
++ barrier_nospec();
+ return __copy_tofrom_user(to, from, n);
+ }
+ #endif /* __powerpc64__ */
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index fcb55b02990e..05ea466b9e40 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -1879,6 +1879,16 @@ int s390int_to_s390irq(struct kvm_s390_interrupt *s390int,
+ case KVM_S390_MCHK:
+ irq->u.mchk.mcic = s390int->parm64;
+ break;
++ case KVM_S390_INT_PFAULT_INIT:
++ irq->u.ext.ext_params = s390int->parm;
++ irq->u.ext.ext_params2 = s390int->parm64;
++ break;
++ case KVM_S390_RESTART:
++ case KVM_S390_INT_CLOCK_COMP:
++ case KVM_S390_INT_CPU_TIMER:
++ break;
++ default:
++ return -EINVAL;
+ }
+ return 0;
+ }
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index fc7de27960e7..e0551c948c59 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -928,6 +928,8 @@ static int kvm_s390_vm_start_migration(struct kvm *kvm)
+ /* mark all the pages in active slots as dirty */
+ for (slotnr = 0; slotnr < slots->used_slots; slotnr++) {
+ ms = slots->memslots + slotnr;
++ if (!ms->dirty_bitmap)
++ return -EINVAL;
+ /*
+ * The second half of the bitmap is only used on x86,
+ * and would be wasted otherwise, so we put it to good
+@@ -3956,7 +3958,7 @@ long kvm_arch_vcpu_async_ioctl(struct file *filp,
+ }
+ case KVM_S390_INTERRUPT: {
+ struct kvm_s390_interrupt s390int;
+- struct kvm_s390_irq s390irq;
++ struct kvm_s390_irq s390irq = {};
+
+ if (copy_from_user(&s390int, argp, sizeof(s390int)))
+ return -EFAULT;
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index ce0d0424a53d..4833dd7e2cc0 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -38,6 +38,7 @@ REALMODE_CFLAGS := $(M16_CFLAGS) -g -Os -DDISABLE_BRANCH_PROFILING \
+
+ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -ffreestanding)
+ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -fno-stack-protector)
++REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -Wno-address-of-packed-member)
+ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), $(cc_stack_align4))
+ export REALMODE_CFLAGS
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 2938b4bcc968..e83f4f6bfdac 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -8757,6 +8757,7 @@ static int handle_vmread(struct kvm_vcpu *vcpu)
+ u32 vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+ gva_t gva = 0;
+ struct vmcs12 *vmcs12;
++ struct x86_exception e;
+
+ if (!nested_vmx_check_permission(vcpu))
+ return 1;
+@@ -8798,8 +8799,10 @@ static int handle_vmread(struct kvm_vcpu *vcpu)
+ vmx_instruction_info, true, &gva))
+ return 1;
+ /* _system ok, nested_vmx_check_permission has verified cpl=0 */
+- kvm_write_guest_virt_system(vcpu, gva, &field_value,
+- (is_long_mode(vcpu) ? 8 : 4), NULL);
++ if (kvm_write_guest_virt_system(vcpu, gva, &field_value,
++ (is_long_mode(vcpu) ? 8 : 4),
++ NULL))
++ kvm_inject_page_fault(vcpu, &e);
+ }
+
+ nested_vmx_succeed(vcpu);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index cbc39751f36b..dbae8415cf4a 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -5016,6 +5016,13 @@ int kvm_write_guest_virt_system(struct kvm_vcpu *vcpu, gva_t addr, void *val,
+ /* kvm_write_guest_virt_system can pull in tons of pages. */
+ vcpu->arch.l1tf_flush_l1d = true;
+
++ /*
++ * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
++ * is returned, but our callers are not ready for that and they blindly
++ * call kvm_inject_page_fault. Ensure that they at least do not leak
++ * uninitialized kernel stack memory into cr2 and error code.
++ */
++ memset(exception, 0, sizeof(*exception));
+ return kvm_write_guest_virt_helper(addr, val, bytes, vcpu,
+ PFERR_WRITE_MASK, exception);
+ }
+diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
+index 8901a1f89cf5..10fb42da0007 100644
+--- a/arch/x86/purgatory/Makefile
++++ b/arch/x86/purgatory/Makefile
+@@ -18,37 +18,40 @@ targets += purgatory.ro
+ KASAN_SANITIZE := n
+ KCOV_INSTRUMENT := n
+
++# These are adjustments to the compiler flags used for objects that
++# make up the standalone purgatory.ro
++
++PURGATORY_CFLAGS_REMOVE := -mcmodel=kernel
++PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss
++
+ # Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
+ # in turn leaves some undefined symbols like __fentry__ in purgatory and not
+ # sure how to relocate those.
+ ifdef CONFIG_FUNCTION_TRACER
+-CFLAGS_REMOVE_sha256.o += $(CC_FLAGS_FTRACE)
+-CFLAGS_REMOVE_purgatory.o += $(CC_FLAGS_FTRACE)
+-CFLAGS_REMOVE_string.o += $(CC_FLAGS_FTRACE)
+-CFLAGS_REMOVE_kexec-purgatory.o += $(CC_FLAGS_FTRACE)
++PURGATORY_CFLAGS_REMOVE += $(CC_FLAGS_FTRACE)
+ endif
+
+ ifdef CONFIG_STACKPROTECTOR
+-CFLAGS_REMOVE_sha256.o += -fstack-protector
+-CFLAGS_REMOVE_purgatory.o += -fstack-protector
+-CFLAGS_REMOVE_string.o += -fstack-protector
+-CFLAGS_REMOVE_kexec-purgatory.o += -fstack-protector
++PURGATORY_CFLAGS_REMOVE += -fstack-protector
+ endif
+
+ ifdef CONFIG_STACKPROTECTOR_STRONG
+-CFLAGS_REMOVE_sha256.o += -fstack-protector-strong
+-CFLAGS_REMOVE_purgatory.o += -fstack-protector-strong
+-CFLAGS_REMOVE_string.o += -fstack-protector-strong
+-CFLAGS_REMOVE_kexec-purgatory.o += -fstack-protector-strong
++PURGATORY_CFLAGS_REMOVE += -fstack-protector-strong
+ endif
+
+ ifdef CONFIG_RETPOLINE
+-CFLAGS_REMOVE_sha256.o += $(RETPOLINE_CFLAGS)
+-CFLAGS_REMOVE_purgatory.o += $(RETPOLINE_CFLAGS)
+-CFLAGS_REMOVE_string.o += $(RETPOLINE_CFLAGS)
+-CFLAGS_REMOVE_kexec-purgatory.o += $(RETPOLINE_CFLAGS)
++PURGATORY_CFLAGS_REMOVE += $(RETPOLINE_CFLAGS)
+ endif
+
++CFLAGS_REMOVE_purgatory.o += $(PURGATORY_CFLAGS_REMOVE)
++CFLAGS_purgatory.o += $(PURGATORY_CFLAGS)
++
++CFLAGS_REMOVE_sha256.o += $(PURGATORY_CFLAGS_REMOVE)
++CFLAGS_sha256.o += $(PURGATORY_CFLAGS)
++
++CFLAGS_REMOVE_string.o += $(PURGATORY_CFLAGS_REMOVE)
++CFLAGS_string.o += $(PURGATORY_CFLAGS)
++
+ $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
+ $(call if_changed,ld)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index e1a8d5c06f65..fcda6313e7de 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1648,12 +1648,63 @@ static inline struct kobject *get_glue_dir(struct device *dev)
+ */
+ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)
+ {
++ unsigned int ref;
++
+ /* see if we live in a "glue" directory */
+ if (!live_in_glue_dir(glue_dir, dev))
+ return;
+
+ mutex_lock(&gdp_mutex);
+- if (!kobject_has_children(glue_dir))
++ /**
++ * There is a race condition between removing glue directory
++ * and adding a new device under the glue directory.
++ *
++ * CPU1: CPU2:
++ *
++ * device_add()
++ * get_device_parent()
++ * class_dir_create_and_add()
++ * kobject_add_internal()
++ * create_dir() // create glue_dir
++ *
++ * device_add()
++ * get_device_parent()
++ * kobject_get() // get glue_dir
++ *
++ * device_del()
++ * cleanup_glue_dir()
++ * kobject_del(glue_dir)
++ *
++ * kobject_add()
++ * kobject_add_internal()
++ * create_dir() // in glue_dir
++ * sysfs_create_dir_ns()
++ * kernfs_create_dir_ns(sd)
++ *
++ * sysfs_remove_dir() // glue_dir->sd=NULL
++ * sysfs_put() // free glue_dir->sd
++ *
++ * // sd is freed
++ * kernfs_new_node(sd)
++ * kernfs_get(glue_dir)
++ * kernfs_add_one()
++ * kernfs_put()
++ *
++ * Before CPU1 remove last child device under glue dir, if CPU2 add
++ * a new device under glue dir, the glue_dir kobject reference count
++ * will be increase to 2 in kobject_get(k). And CPU2 has been called
++ * kernfs_create_dir_ns(). Meanwhile, CPU1 call sysfs_remove_dir()
++ * and sysfs_put(). This result in glue_dir->sd is freed.
++ *
++ * Then the CPU2 will see a stale "empty" but still potentially used
++ * glue dir around in kernfs_new_node().
++ *
++ * In order to avoid this happening, we also should make sure that
++ * kernfs_node for glue_dir is released in CPU1 only when refcount
++ * for glue_dir kobj is 1.
++ */
++ ref = kref_read(&glue_dir->kref);
++ if (!kobject_has_children(glue_dir) && !--ref)
+ kobject_del(glue_dir);
+ kobject_put(glue_dir);
+ mutex_unlock(&gdp_mutex);
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 75cf605f54e5..09c83dc2ef67 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1139,10 +1139,6 @@ static int btusb_open(struct hci_dev *hdev)
+ }
+
+ data->intf->needs_remote_wakeup = 1;
+- /* device specific wakeup source enabled and required for USB
+- * remote wakeup while host is suspended
+- */
+- device_wakeup_enable(&data->udev->dev);
+
+ if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
+ goto done;
+@@ -1206,7 +1202,6 @@ static int btusb_close(struct hci_dev *hdev)
+ goto failed;
+
+ data->intf->needs_remote_wakeup = 0;
+- device_wakeup_disable(&data->udev->dev);
+ usb_autopm_put_interface(data->intf);
+
+ failed:
+diff --git a/drivers/clk/rockchip/clk-mmc-phase.c b/drivers/clk/rockchip/clk-mmc-phase.c
+index 026a26bb702d..dbec84238ecd 100644
+--- a/drivers/clk/rockchip/clk-mmc-phase.c
++++ b/drivers/clk/rockchip/clk-mmc-phase.c
+@@ -61,10 +61,8 @@ static int rockchip_mmc_get_phase(struct clk_hw *hw)
+ u32 delay_num = 0;
+
+ /* See the comment for rockchip_mmc_set_phase below */
+- if (!rate) {
+- pr_err("%s: invalid clk rate\n", __func__);
++ if (!rate)
+ return -EINVAL;
+- }
+
+ raw_value = readl(mmc_clock->reg) >> (mmc_clock->shift);
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 41b288bdcdbf..064315edd289 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -959,11 +959,13 @@ static void talitos_sg_unmap(struct device *dev,
+
+ static void ipsec_esp_unmap(struct device *dev,
+ struct talitos_edesc *edesc,
+- struct aead_request *areq)
++ struct aead_request *areq, bool encrypt)
+ {
+ struct crypto_aead *aead = crypto_aead_reqtfm(areq);
+ struct talitos_ctx *ctx = crypto_aead_ctx(aead);
+ unsigned int ivsize = crypto_aead_ivsize(aead);
++ unsigned int authsize = crypto_aead_authsize(aead);
++ unsigned int cryptlen = areq->cryptlen - (encrypt ? 0 : authsize);
+ bool is_ipsec_esp = edesc->desc.hdr & DESC_HDR_TYPE_IPSEC_ESP;
+ struct talitos_ptr *civ_ptr = &edesc->desc.ptr[is_ipsec_esp ? 2 : 3];
+
+@@ -972,7 +974,7 @@ static void ipsec_esp_unmap(struct device *dev,
+ DMA_FROM_DEVICE);
+ unmap_single_talitos_ptr(dev, civ_ptr, DMA_TO_DEVICE);
+
+- talitos_sg_unmap(dev, edesc, areq->src, areq->dst, areq->cryptlen,
++ talitos_sg_unmap(dev, edesc, areq->src, areq->dst, cryptlen,
+ areq->assoclen);
+
+ if (edesc->dma_len)
+@@ -983,7 +985,7 @@ static void ipsec_esp_unmap(struct device *dev,
+ unsigned int dst_nents = edesc->dst_nents ? : 1;
+
+ sg_pcopy_to_buffer(areq->dst, dst_nents, ctx->iv, ivsize,
+- areq->assoclen + areq->cryptlen - ivsize);
++ areq->assoclen + cryptlen - ivsize);
+ }
+ }
+
+@@ -1005,7 +1007,7 @@ static void ipsec_esp_encrypt_done(struct device *dev,
+
+ edesc = container_of(desc, struct talitos_edesc, desc);
+
+- ipsec_esp_unmap(dev, edesc, areq);
++ ipsec_esp_unmap(dev, edesc, areq, true);
+
+ /* copy the generated ICV to dst */
+ if (edesc->icv_ool) {
+@@ -1039,7 +1041,7 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
+
+ edesc = container_of(desc, struct talitos_edesc, desc);
+
+- ipsec_esp_unmap(dev, edesc, req);
++ ipsec_esp_unmap(dev, edesc, req, false);
+
+ if (!err) {
+ char icvdata[SHA512_DIGEST_SIZE];
+@@ -1085,7 +1087,7 @@ static void ipsec_esp_decrypt_hwauth_done(struct device *dev,
+
+ edesc = container_of(desc, struct talitos_edesc, desc);
+
+- ipsec_esp_unmap(dev, edesc, req);
++ ipsec_esp_unmap(dev, edesc, req, false);
+
+ /* check ICV auth status */
+ if (!err && ((desc->hdr_lo & DESC_HDR_LO_ICCR1_MASK) !=
+@@ -1188,6 +1190,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
+ * fill in and submit ipsec_esp descriptor
+ */
+ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
++ bool encrypt,
+ void (*callback)(struct device *dev,
+ struct talitos_desc *desc,
+ void *context, int error))
+@@ -1197,7 +1200,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ struct talitos_ctx *ctx = crypto_aead_ctx(aead);
+ struct device *dev = ctx->dev;
+ struct talitos_desc *desc = &edesc->desc;
+- unsigned int cryptlen = areq->cryptlen;
++ unsigned int cryptlen = areq->cryptlen - (encrypt ? 0 : authsize);
+ unsigned int ivsize = crypto_aead_ivsize(aead);
+ int tbl_off = 0;
+ int sg_count, ret;
+@@ -1324,7 +1327,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+
+ ret = talitos_submit(dev, ctx->ch, desc, callback, areq);
+ if (ret != -EINPROGRESS) {
+- ipsec_esp_unmap(dev, edesc, areq);
++ ipsec_esp_unmap(dev, edesc, areq, encrypt);
+ kfree(edesc);
+ }
+ return ret;
+@@ -1438,9 +1441,10 @@ static struct talitos_edesc *aead_edesc_alloc(struct aead_request *areq, u8 *iv,
+ unsigned int authsize = crypto_aead_authsize(authenc);
+ struct talitos_ctx *ctx = crypto_aead_ctx(authenc);
+ unsigned int ivsize = crypto_aead_ivsize(authenc);
++ unsigned int cryptlen = areq->cryptlen - (encrypt ? 0 : authsize);
+
+ return talitos_edesc_alloc(ctx->dev, areq->src, areq->dst,
+- iv, areq->assoclen, areq->cryptlen,
++ iv, areq->assoclen, cryptlen,
+ authsize, ivsize, icv_stashing,
+ areq->base.flags, encrypt);
+ }
+@@ -1459,7 +1463,7 @@ static int aead_encrypt(struct aead_request *req)
+ /* set encrypt */
+ edesc->desc.hdr = ctx->desc_hdr_template | DESC_HDR_MODE0_ENCRYPT;
+
+- return ipsec_esp(edesc, req, ipsec_esp_encrypt_done);
++ return ipsec_esp(edesc, req, true, ipsec_esp_encrypt_done);
+ }
+
+ static int aead_decrypt(struct aead_request *req)
+@@ -1471,14 +1475,13 @@ static int aead_decrypt(struct aead_request *req)
+ struct talitos_edesc *edesc;
+ void *icvdata;
+
+- req->cryptlen -= authsize;
+-
+ /* allocate extended descriptor */
+ edesc = aead_edesc_alloc(req, req->iv, 1, false);
+ if (IS_ERR(edesc))
+ return PTR_ERR(edesc);
+
+- if ((priv->features & TALITOS_FTR_HW_AUTH_CHECK) &&
++ if ((edesc->desc.hdr & DESC_HDR_TYPE_IPSEC_ESP) &&
++ (priv->features & TALITOS_FTR_HW_AUTH_CHECK) &&
+ ((!edesc->src_nents && !edesc->dst_nents) ||
+ priv->features & TALITOS_FTR_SRC_LINK_TBL_LEN_INCLUDES_EXTENT)) {
+
+@@ -1489,7 +1492,8 @@ static int aead_decrypt(struct aead_request *req)
+
+ /* reset integrity check result bits */
+
+- return ipsec_esp(edesc, req, ipsec_esp_decrypt_hwauth_done);
++ return ipsec_esp(edesc, req, false,
++ ipsec_esp_decrypt_hwauth_done);
+ }
+
+ /* Have to check the ICV with software */
+@@ -1505,7 +1509,7 @@ static int aead_decrypt(struct aead_request *req)
+ sg_pcopy_to_buffer(req->src, edesc->src_nents ? : 1, icvdata, authsize,
+ req->assoclen + req->cryptlen - authsize);
+
+- return ipsec_esp(edesc, req, ipsec_esp_decrypt_swauth_done);
++ return ipsec_esp(edesc, req, false, ipsec_esp_decrypt_swauth_done);
+ }
+
+ static int ablkcipher_setkey(struct crypto_ablkcipher *cipher,
+@@ -1538,6 +1542,18 @@ static int ablkcipher_setkey(struct crypto_ablkcipher *cipher,
+ return 0;
+ }
+
++static int ablkcipher_aes_setkey(struct crypto_ablkcipher *cipher,
++ const u8 *key, unsigned int keylen)
++{
++ if (keylen == AES_KEYSIZE_128 || keylen == AES_KEYSIZE_192 ||
++ keylen == AES_KEYSIZE_256)
++ return ablkcipher_setkey(cipher, key, keylen);
++
++ crypto_ablkcipher_set_flags(cipher, CRYPTO_TFM_RES_BAD_KEY_LEN);
++
++ return -EINVAL;
++}
++
+ static void common_nonsnoop_unmap(struct device *dev,
+ struct talitos_edesc *edesc,
+ struct ablkcipher_request *areq)
+@@ -1660,6 +1676,14 @@ static int ablkcipher_encrypt(struct ablkcipher_request *areq)
+ struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq);
+ struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher);
+ struct talitos_edesc *edesc;
++ unsigned int blocksize =
++ crypto_tfm_alg_blocksize(crypto_ablkcipher_tfm(cipher));
++
++ if (!areq->nbytes)
++ return 0;
++
++ if (areq->nbytes % blocksize)
++ return -EINVAL;
+
+ /* allocate extended descriptor */
+ edesc = ablkcipher_edesc_alloc(areq, true);
+@@ -1677,6 +1701,14 @@ static int ablkcipher_decrypt(struct ablkcipher_request *areq)
+ struct crypto_ablkcipher *cipher = crypto_ablkcipher_reqtfm(areq);
+ struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher);
+ struct talitos_edesc *edesc;
++ unsigned int blocksize =
++ crypto_tfm_alg_blocksize(crypto_ablkcipher_tfm(cipher));
++
++ if (!areq->nbytes)
++ return 0;
++
++ if (areq->nbytes % blocksize)
++ return -EINVAL;
+
+ /* allocate extended descriptor */
+ edesc = ablkcipher_edesc_alloc(areq, false);
+@@ -2705,6 +2737,7 @@ static struct talitos_alg_template driver_algs[] = {
+ .min_keysize = AES_MIN_KEY_SIZE,
+ .max_keysize = AES_MAX_KEY_SIZE,
+ .ivsize = AES_BLOCK_SIZE,
++ .setkey = ablkcipher_aes_setkey,
+ }
+ },
+ .desc_hdr_template = DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU |
+@@ -2715,13 +2748,13 @@ static struct talitos_alg_template driver_algs[] = {
+ .alg.crypto = {
+ .cra_name = "ctr(aes)",
+ .cra_driver_name = "ctr-aes-talitos",
+- .cra_blocksize = AES_BLOCK_SIZE,
++ .cra_blocksize = 1,
+ .cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER |
+ CRYPTO_ALG_ASYNC,
+ .cra_ablkcipher = {
+ .min_keysize = AES_MIN_KEY_SIZE,
+ .max_keysize = AES_MAX_KEY_SIZE,
+- .ivsize = AES_BLOCK_SIZE,
++ .setkey = ablkcipher_aes_setkey,
+ }
+ },
+ .desc_hdr_template = DESC_HDR_TYPE_AESU_CTR_NONSNOOP |
+diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
+index 7fa744793bc5..5e35a66ed0ae 100644
+--- a/drivers/firmware/ti_sci.c
++++ b/drivers/firmware/ti_sci.c
+@@ -463,9 +463,9 @@ static int ti_sci_cmd_get_revision(struct ti_sci_info *info)
+ struct ti_sci_xfer *xfer;
+ int ret;
+
+- /* No need to setup flags since it is expected to respond */
+ xfer = ti_sci_get_one_xfer(info, TI_SCI_MSG_VERSION,
+- 0x0, sizeof(struct ti_sci_msg_hdr),
++ TI_SCI_FLAG_REQ_ACK_ON_PROCESSED,
++ sizeof(struct ti_sci_msg_hdr),
+ sizeof(*rev_info));
+ if (IS_ERR(xfer)) {
+ ret = PTR_ERR(xfer);
+@@ -593,9 +593,9 @@ static int ti_sci_get_device_state(const struct ti_sci_handle *handle,
+ info = handle_to_ti_sci_info(handle);
+ dev = info->dev;
+
+- /* Response is expected, so need of any flags */
+ xfer = ti_sci_get_one_xfer(info, TI_SCI_MSG_GET_DEVICE_STATE,
+- 0, sizeof(*req), sizeof(*resp));
++ TI_SCI_FLAG_REQ_ACK_ON_PROCESSED,
++ sizeof(*req), sizeof(*resp));
+ if (IS_ERR(xfer)) {
+ ret = PTR_ERR(xfer);
+ dev_err(dev, "Message alloc failed(%d)\n", ret);
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index c5e009f61021..cf2604e63599 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -10,6 +10,7 @@
+ * published by the Free Software Foundation.
+ */
+
++#include <linux/dmi.h>
+ #include <linux/errno.h>
+ #include <linux/gpio.h>
+ #include <linux/gpio/consumer.h>
+@@ -23,6 +24,11 @@
+
+ #include "gpiolib.h"
+
++static int run_edge_events_on_boot = -1;
++module_param(run_edge_events_on_boot, int, 0444);
++MODULE_PARM_DESC(run_edge_events_on_boot,
++ "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto");
++
+ /**
+ * struct acpi_gpio_event - ACPI GPIO event handler data
+ *
+@@ -174,10 +180,13 @@ static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio,
+ event->irq_requested = true;
+
+ /* Make sure we trigger the initial state of edge-triggered IRQs */
+- value = gpiod_get_raw_value_cansleep(event->desc);
+- if (((event->irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
+- ((event->irqflags & IRQF_TRIGGER_FALLING) && value == 0))
+- event->handler(event->irq, event);
++ if (run_edge_events_on_boot &&
++ (event->irqflags & (IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING))) {
++ value = gpiod_get_raw_value_cansleep(event->desc);
++ if (((event->irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
++ ((event->irqflags & IRQF_TRIGGER_FALLING) && value == 0))
++ event->handler(event->irq, event);
++ }
+ }
+
+ static void acpi_gpiochip_request_irqs(struct acpi_gpio_chip *acpi_gpio)
+@@ -1253,3 +1262,28 @@ static int acpi_gpio_handle_deferred_request_irqs(void)
+ }
+ /* We must use _sync so that this runs after the first deferred_probe run */
+ late_initcall_sync(acpi_gpio_handle_deferred_request_irqs);
++
++static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = {
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MINIX"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"),
++ }
++ },
++ {} /* Terminating entry */
++};
++
++static int acpi_gpio_setup_params(void)
++{
++ if (run_edge_events_on_boot < 0) {
++ if (dmi_check_system(run_edge_events_on_boot_blacklist))
++ run_edge_events_on_boot = 0;
++ else
++ run_edge_events_on_boot = 1;
++ }
++
++ return 0;
++}
++
++/* Directly after dmi_setup() which runs as core_initcall() */
++postcore_initcall(acpi_gpio_setup_params);
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 53395852f012..3289b53a7ba1 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -524,6 +524,14 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip)
+ if (lflags & ~GPIOHANDLE_REQUEST_VALID_FLAGS)
+ return -EINVAL;
+
++ /*
++ * Do not allow both INPUT & OUTPUT flags to be set as they are
++ * contradictory.
++ */
++ if ((lflags & GPIOHANDLE_REQUEST_INPUT) &&
++ (lflags & GPIOHANDLE_REQUEST_OUTPUT))
++ return -EINVAL;
++
+ /*
+ * Do not allow OPEN_SOURCE & OPEN_DRAIN flags in a single request. If
+ * the hardware actually supports enabling both at the same time the
+@@ -916,7 +924,9 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
+ }
+
+ /* This is just wrong: we don't look for events on output lines */
+- if (lflags & GPIOHANDLE_REQUEST_OUTPUT) {
++ if ((lflags & GPIOHANDLE_REQUEST_OUTPUT) ||
++ (lflags & GPIOHANDLE_REQUEST_OPEN_DRAIN) ||
++ (lflags & GPIOHANDLE_REQUEST_OPEN_SOURCE)) {
+ ret = -EINVAL;
+ goto out_free_label;
+ }
+@@ -930,10 +940,6 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip)
+
+ if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW)
+ set_bit(FLAG_ACTIVE_LOW, &desc->flags);
+- if (lflags & GPIOHANDLE_REQUEST_OPEN_DRAIN)
+- set_bit(FLAG_OPEN_DRAIN, &desc->flags);
+- if (lflags & GPIOHANDLE_REQUEST_OPEN_SOURCE)
+- set_bit(FLAG_OPEN_SOURCE, &desc->flags);
+
+ ret = gpiod_direction_input(desc);
+ if (ret)
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index b44bed554211..cc354b491774 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -82,6 +82,12 @@ static const struct drm_dmi_panel_orientation_data itworks_tw891 = {
+ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+ };
+
++static const struct drm_dmi_panel_orientation_data lcd720x1280_rightside_up = {
++ .width = 720,
++ .height = 1280,
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = {
+ .width = 800,
+ .height = 1280,
+@@ -109,6 +115,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
+ },
+ .driver_data = (void *)&gpd_micropc,
++ }, { /* GPD MicroPC (later BIOS versions with proper DMI strings) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"),
++ },
++ .driver_data = (void *)&lcd720x1280_rightside_up,
+ }, { /*
+ * GPD Pocket, note that the the DMI data is less generic then
+ * it seems, devices with a board-vendor of "AMI Corporation"
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+index f6389479fccb..947bc6d62302 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -566,12 +566,15 @@ static int mtk_drm_probe(struct platform_device *pdev)
+ comp = devm_kzalloc(dev, sizeof(*comp), GFP_KERNEL);
+ if (!comp) {
+ ret = -ENOMEM;
++ of_node_put(node);
+ goto err_node;
+ }
+
+ ret = mtk_ddp_comp_init(dev, node, comp, comp_id, NULL);
+- if (ret)
++ if (ret) {
++ of_node_put(node);
+ goto err_node;
++ }
+
+ private->ddp_comp[comp_id] = comp;
+ }
+diff --git a/drivers/gpu/drm/meson/meson_plane.c b/drivers/gpu/drm/meson/meson_plane.c
+index 12c80dfcff59..c7daae53fa1f 100644
+--- a/drivers/gpu/drm/meson/meson_plane.c
++++ b/drivers/gpu/drm/meson/meson_plane.c
+@@ -120,6 +120,13 @@ static void meson_plane_atomic_update(struct drm_plane *plane,
+ priv->viu.osd1_blk0_cfg[0] |= OSD_BLK_MODE_32 |
+ OSD_COLOR_MATRIX_32_ARGB;
+ break;
++ case DRM_FORMAT_XBGR8888:
++ /* For XRGB, replace the pixel's alpha by 0xFF */
++ writel_bits_relaxed(OSD_REPLACE_EN, OSD_REPLACE_EN,
++ priv->io_base + _REG(VIU_OSD1_CTRL_STAT2));
++ priv->viu.osd1_blk0_cfg[0] |= OSD_BLK_MODE_32 |
++ OSD_COLOR_MATRIX_32_ABGR;
++ break;
+ case DRM_FORMAT_ARGB8888:
+ /* For ARGB, use the pixel's alpha */
+ writel_bits_relaxed(OSD_REPLACE_EN, 0,
+@@ -127,6 +134,13 @@ static void meson_plane_atomic_update(struct drm_plane *plane,
+ priv->viu.osd1_blk0_cfg[0] |= OSD_BLK_MODE_32 |
+ OSD_COLOR_MATRIX_32_ARGB;
+ break;
++ case DRM_FORMAT_ABGR8888:
++ /* For ARGB, use the pixel's alpha */
++ writel_bits_relaxed(OSD_REPLACE_EN, 0,
++ priv->io_base + _REG(VIU_OSD1_CTRL_STAT2));
++ priv->viu.osd1_blk0_cfg[0] |= OSD_BLK_MODE_32 |
++ OSD_COLOR_MATRIX_32_ABGR;
++ break;
+ case DRM_FORMAT_RGB888:
+ priv->viu.osd1_blk0_cfg[0] |= OSD_BLK_MODE_24 |
+ OSD_COLOR_MATRIX_24_RGB;
+@@ -196,7 +210,9 @@ static const struct drm_plane_funcs meson_plane_funcs = {
+
+ static const uint32_t supported_drm_formats[] = {
+ DRM_FORMAT_ARGB8888,
++ DRM_FORMAT_ABGR8888,
+ DRM_FORMAT_XRGB8888,
++ DRM_FORMAT_XBGR8888,
+ DRM_FORMAT_RGB888,
+ DRM_FORMAT_RGB565,
+ };
+diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
+index 15a115210108..f5586dd6414d 100644
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -981,11 +981,11 @@ static int stm32_dfsdm_adc_chan_init_one(struct iio_dev *indio_dev,
+ ch->info_mask_shared_by_all = BIT(IIO_CHAN_INFO_OVERSAMPLING_RATIO);
+
+ if (adc->dev_data->type == DFSDM_AUDIO) {
+- ch->scan_type.sign = 's';
+ ch->ext_info = dfsdm_adc_audio_ext_info;
+ } else {
+- ch->scan_type.sign = 'u';
++ ch->scan_type.shift = 8;
+ }
++ ch->scan_type.sign = 's';
+ ch->scan_type.realbits = 24;
+ ch->scan_type.storagebits = 32;
+
+diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
+index ef5560b848ab..21786a442368 100644
+--- a/drivers/isdn/capi/capi.c
++++ b/drivers/isdn/capi/capi.c
+@@ -688,6 +688,9 @@ capi_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos
+ if (!cdev->ap.applid)
+ return -ENODEV;
+
++ if (count < CAPIMSG_BASELEN)
++ return -EINVAL;
++
+ skb = alloc_skb(count, GFP_USER);
+ if (!skb)
+ return -ENOMEM;
+@@ -698,7 +701,8 @@ capi_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos
+ }
+ mlen = CAPIMSG_LEN(skb->data);
+ if (CAPIMSG_CMD(skb->data) == CAPI_DATA_B3_REQ) {
+- if ((size_t)(mlen + CAPIMSG_DATALEN(skb->data)) != count) {
++ if (count < CAPI_DATA_B3_REQ_LEN ||
++ (size_t)(mlen + CAPIMSG_DATALEN(skb->data)) != count) {
+ kfree_skb(skb);
+ return -EINVAL;
+ }
+@@ -711,6 +715,10 @@ capi_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos
+ CAPIMSG_SETAPPID(skb->data, cdev->ap.applid);
+
+ if (CAPIMSG_CMD(skb->data) == CAPI_DISCONNECT_B3_RESP) {
++ if (count < CAPI_DISCONNECT_B3_RESP_LEN) {
++ kfree_skb(skb);
++ return -EINVAL;
++ }
+ mutex_lock(&cdev->lock);
+ capincci_free(cdev, CAPIMSG_NCCI(skb->data));
+ mutex_unlock(&cdev->lock);
+diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
+index dce5b7e44e7a..ab5a8778c4b2 100644
+--- a/drivers/mtd/nand/raw/mtk_nand.c
++++ b/drivers/mtd/nand/raw/mtk_nand.c
+@@ -863,19 +863,21 @@ static int mtk_nfc_write_oob_std(struct mtd_info *mtd, struct nand_chip *chip,
+ return mtk_nfc_write_page_raw(mtd, chip, NULL, 1, page);
+ }
+
+-static int mtk_nfc_update_ecc_stats(struct mtd_info *mtd, u8 *buf, u32 sectors)
++static int mtk_nfc_update_ecc_stats(struct mtd_info *mtd, u8 *buf, u32 start,
++ u32 sectors)
+ {
+ struct nand_chip *chip = mtd_to_nand(mtd);
+ struct mtk_nfc *nfc = nand_get_controller_data(chip);
+ struct mtk_nfc_nand_chip *mtk_nand = to_mtk_nand(chip);
+ struct mtk_ecc_stats stats;
++ u32 reg_size = mtk_nand->fdm.reg_size;
+ int rc, i;
+
+ rc = nfi_readl(nfc, NFI_STA) & STA_EMP_PAGE;
+ if (rc) {
+ memset(buf, 0xff, sectors * chip->ecc.size);
+ for (i = 0; i < sectors; i++)
+- memset(oob_ptr(chip, i), 0xff, mtk_nand->fdm.reg_size);
++ memset(oob_ptr(chip, start + i), 0xff, reg_size);
+ return 0;
+ }
+
+@@ -895,7 +897,7 @@ static int mtk_nfc_read_subpage(struct mtd_info *mtd, struct nand_chip *chip,
+ u32 spare = mtk_nand->spare_per_sector;
+ u32 column, sectors, start, end, reg;
+ dma_addr_t addr;
+- int bitflips;
++ int bitflips = 0;
+ size_t len;
+ u8 *buf;
+ int rc;
+@@ -962,14 +964,11 @@ static int mtk_nfc_read_subpage(struct mtd_info *mtd, struct nand_chip *chip,
+ if (rc < 0) {
+ dev_err(nfc->dev, "subpage done timeout\n");
+ bitflips = -EIO;
+- } else {
+- bitflips = 0;
+- if (!raw) {
+- rc = mtk_ecc_wait_done(nfc->ecc, ECC_DECODE);
+- bitflips = rc < 0 ? -ETIMEDOUT :
+- mtk_nfc_update_ecc_stats(mtd, buf, sectors);
+- mtk_nfc_read_fdm(chip, start, sectors);
+- }
++ } else if (!raw) {
++ rc = mtk_ecc_wait_done(nfc->ecc, ECC_DECODE);
++ bitflips = rc < 0 ? -ETIMEDOUT :
++ mtk_nfc_update_ecc_stats(mtd, buf, start, sectors);
++ mtk_nfc_read_fdm(chip, start, sectors);
+ }
+
+ dma_unmap_single(nfc->dev, addr, len, DMA_FROM_DEVICE);
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 410d5d3aa393..85280765d793 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -34,6 +34,7 @@
+ #include <net/tc_act/tc_mirred.h>
+ #include <net/vxlan.h>
+ #include <net/mpls.h>
++#include <net/xfrm.h>
+
+ #include "ixgbe.h"
+ #include "ixgbe_common.h"
+@@ -2625,7 +2626,7 @@ adjust_by_size:
+ /* 16K ints/sec to 9.2K ints/sec */
+ avg_wire_size *= 15;
+ avg_wire_size += 11452;
+- } else if (avg_wire_size <= 1980) {
++ } else if (avg_wire_size < 1968) {
+ /* 9.2K ints/sec to 8K ints/sec */
+ avg_wire_size *= 5;
+ avg_wire_size += 22420;
+@@ -2658,6 +2659,8 @@ adjust_by_size:
+ case IXGBE_LINK_SPEED_2_5GB_FULL:
+ case IXGBE_LINK_SPEED_1GB_FULL:
+ case IXGBE_LINK_SPEED_10_FULL:
++ if (avg_wire_size > 8064)
++ avg_wire_size = 8064;
+ itr += DIV_ROUND_UP(avg_wire_size,
+ IXGBE_ITR_ADAPTIVE_MIN_INC * 64) *
+ IXGBE_ITR_ADAPTIVE_MIN_INC;
+@@ -8599,7 +8602,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
+ #endif /* IXGBE_FCOE */
+
+ #ifdef CONFIG_XFRM_OFFLOAD
+- if (skb->sp && !ixgbe_ipsec_tx(tx_ring, first, &ipsec_tx))
++ if (xfrm_offload(skb) &&
++ !ixgbe_ipsec_tx(tx_ring, first, &ipsec_tx))
+ goto out_drop;
+ #endif
+ tso = ixgbe_tso(tx_ring, first, &hdr_len, &ipsec_tx);
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 2e8056d48f4a..723611ac9102 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -380,8 +380,8 @@ static void phylink_get_fixed_state(struct phylink *pl, struct phylink_link_stat
+ * Local device Link partner
+ * Pause AsymDir Pause AsymDir Result
+ * 1 X 1 X TX+RX
+- * 0 1 1 1 RX
+- * 1 1 0 1 TX
++ * 0 1 1 1 TX
++ * 1 1 0 1 RX
+ */
+ static void phylink_resolve_flow(struct phylink *pl,
+ struct phylink_link_state *state)
+@@ -402,7 +402,7 @@ static void phylink_resolve_flow(struct phylink *pl,
+ new_pause = MLO_PAUSE_TX | MLO_PAUSE_RX;
+ else if (pause & MLO_PAUSE_ASYM)
+ new_pause = state->pause & MLO_PAUSE_SYM ?
+- MLO_PAUSE_RX : MLO_PAUSE_TX;
++ MLO_PAUSE_TX : MLO_PAUSE_RX;
+ } else {
+ new_pause = pl->link_config.pause & MLO_PAUSE_TXRX_MASK;
+ }
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 5fa7047ea361..e1ac1c57089f 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -801,7 +801,8 @@ static void tun_detach_all(struct net_device *dev)
+ }
+
+ static int tun_attach(struct tun_struct *tun, struct file *file,
+- bool skip_filter, bool napi, bool napi_frags)
++ bool skip_filter, bool napi, bool napi_frags,
++ bool publish_tun)
+ {
+ struct tun_file *tfile = file->private_data;
+ struct net_device *dev = tun->dev;
+@@ -881,7 +882,8 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
+ * initialized tfile; otherwise we risk using half-initialized
+ * object.
+ */
+- rcu_assign_pointer(tfile->tun, tun);
++ if (publish_tun)
++ rcu_assign_pointer(tfile->tun, tun);
+ rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
+ tun->numqueues++;
+ tun_set_real_num_queues(tun);
+@@ -2553,7 +2555,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
+
+ err = tun_attach(tun, file, ifr->ifr_flags & IFF_NOFILTER,
+ ifr->ifr_flags & IFF_NAPI,
+- ifr->ifr_flags & IFF_NAPI_FRAGS);
++ ifr->ifr_flags & IFF_NAPI_FRAGS, true);
+ if (err < 0)
+ return err;
+
+@@ -2652,13 +2654,17 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
+
+ INIT_LIST_HEAD(&tun->disabled);
+ err = tun_attach(tun, file, false, ifr->ifr_flags & IFF_NAPI,
+- ifr->ifr_flags & IFF_NAPI_FRAGS);
++ ifr->ifr_flags & IFF_NAPI_FRAGS, false);
+ if (err < 0)
+ goto err_free_flow;
+
+ err = register_netdevice(tun->dev);
+ if (err < 0)
+ goto err_detach;
++ /* free_netdev() won't check refcnt, to aovid race
++ * with dev_put() we need publish tun after registration.
++ */
++ rcu_assign_pointer(tfile->tun, tun);
+ }
+
+ netif_carrier_on(tun->dev);
+@@ -2802,7 +2808,7 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr)
+ if (ret < 0)
+ goto unlock;
+ ret = tun_attach(tun, file, false, tun->flags & IFF_NAPI,
+- tun->flags & IFF_NAPI_FRAGS);
++ tun->flags & IFF_NAPI_FRAGS, true);
+ } else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
+ tun = rtnl_dereference(tfile->tun);
+ if (!tun || !(tun->flags & IFF_MULTI_QUEUE) || tfile->detached)
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 5c42cf81a08b..85fba64c3fcf 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -221,9 +221,16 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+ goto bad_desc;
+ }
+ skip:
+- if ( rndis &&
+- header.usb_cdc_acm_descriptor &&
+- header.usb_cdc_acm_descriptor->bmCapabilities) {
++ /* Communcation class functions with bmCapabilities are not
++ * RNDIS. But some Wireless class RNDIS functions use
++ * bmCapabilities for their own purpose. The failsafe is
++ * therefore applied only to Communication class RNDIS
++ * functions. The rndis test is redundant, but a cheap
++ * optimization.
++ */
++ if (rndis && is_rndis(&intf->cur_altsetting->desc) &&
++ header.usb_cdc_acm_descriptor &&
++ header.usb_cdc_acm_descriptor->bmCapabilities) {
+ dev_dbg(&intf->dev,
+ "ACM capabilities %02x, not really RNDIS?\n",
+ header.usb_cdc_acm_descriptor->bmCapabilities);
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index f360690396dd..14e56bee0548 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -643,7 +643,6 @@ fail_rx:
+ kfree(rsi_dev->tx_buffer);
+
+ fail_eps:
+- kfree(rsi_dev);
+
+ return status;
+ }
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index 99de51e87f7f..d32eba11c000 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -415,10 +415,17 @@ static int nvmem_setup_compat(struct nvmem_device *nvmem,
+ if (!config->base_dev)
+ return -EINVAL;
+
+- if (nvmem->read_only)
+- nvmem->eeprom = bin_attr_ro_root_nvmem;
+- else
+- nvmem->eeprom = bin_attr_rw_root_nvmem;
++ if (nvmem->read_only) {
++ if (config->root_only)
++ nvmem->eeprom = bin_attr_ro_root_nvmem;
++ else
++ nvmem->eeprom = bin_attr_ro_nvmem;
++ } else {
++ if (config->root_only)
++ nvmem->eeprom = bin_attr_rw_root_nvmem;
++ else
++ nvmem->eeprom = bin_attr_rw_nvmem;
++ }
+ nvmem->eeprom.attr.name = "eeprom";
+ nvmem->eeprom.size = nvmem->size;
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 956ee7527d2c..ec317bcb1bca 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -399,7 +399,8 @@ void __weak pcibios_free_irq(struct pci_dev *dev)
+ #ifdef CONFIG_PCI_IOV
+ static inline bool pci_device_can_probe(struct pci_dev *pdev)
+ {
+- return (!pdev->is_virtfn || pdev->physfn->sriov->drivers_autoprobe);
++ return (!pdev->is_virtfn || pdev->physfn->sriov->drivers_autoprobe ||
++ pdev->driver_override);
+ }
+ #else
+ static inline bool pci_device_can_probe(struct pci_dev *pdev)
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index b1d804376237..6a61028cbb3c 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -421,6 +421,14 @@ static const struct dmi_system_id critclk_systems[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "CB3163"),
+ },
+ },
++ {
++ /* pmc_plt_clk* - are used for ethernet controllers */
++ .ident = "Beckhoff CB4063",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
++ DMI_MATCH(DMI_BOARD_NAME, "CB4063"),
++ },
++ },
+ {
+ /* pmc_plt_clk* - are used for ethernet controllers */
+ .ident = "Beckhoff CB6263",
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 08c5afa06aee..e561eb475339 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -5107,7 +5107,7 @@ again:
+ BTRFS_I(other_inode),
+ LOG_OTHER_INODE, 0, LLONG_MAX,
+ ctx);
+- iput(other_inode);
++ btrfs_add_delayed_iput(other_inode);
+ if (err)
+ goto out_unlock;
+ else
+@@ -5519,7 +5519,7 @@ process_leaf:
+ }
+
+ if (btrfs_inode_in_log(BTRFS_I(di_inode), trans->transid)) {
+- iput(di_inode);
++ btrfs_add_delayed_iput(di_inode);
+ break;
+ }
+
+@@ -5531,7 +5531,7 @@ process_leaf:
+ if (!ret &&
+ btrfs_must_commit_transaction(trans, BTRFS_I(di_inode)))
+ ret = 1;
+- iput(di_inode);
++ btrfs_add_delayed_iput(di_inode);
+ if (ret)
+ goto next_dir_inode;
+ if (ctx->log_new_dentries) {
+@@ -5678,7 +5678,7 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans,
+ if (!ret && ctx && ctx->log_new_dentries)
+ ret = log_new_dir_dentries(trans, root,
+ BTRFS_I(dir_inode), ctx);
+- iput(dir_inode);
++ btrfs_add_delayed_iput(dir_inode);
+ if (ret)
+ goto out;
+ }
+diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
+index bf416e512743..f15ac37956e7 100644
+--- a/fs/ubifs/tnc.c
++++ b/fs/ubifs/tnc.c
+@@ -1165,8 +1165,8 @@ static struct ubifs_znode *dirty_cow_bottom_up(struct ubifs_info *c,
+ * o exact match, i.e. the found zero-level znode contains key @key, then %1
+ * is returned and slot number of the matched branch is stored in @n;
+ * o not exact match, which means that zero-level znode does not contain
+- * @key, then %0 is returned and slot number of the closest branch is stored
+- * in @n;
++ * @key, then %0 is returned and slot number of the closest branch or %-1
++ * is stored in @n; In this case calling tnc_next() is mandatory.
+ * o @key is so small that it is even less than the lowest key of the
+ * leftmost zero-level node, then %0 is returned and %0 is stored in @n.
+ *
+@@ -1883,13 +1883,19 @@ int ubifs_tnc_lookup_nm(struct ubifs_info *c, const union ubifs_key *key,
+
+ static int search_dh_cookie(struct ubifs_info *c, const union ubifs_key *key,
+ struct ubifs_dent_node *dent, uint32_t cookie,
+- struct ubifs_znode **zn, int *n)
++ struct ubifs_znode **zn, int *n, int exact)
+ {
+ int err;
+ struct ubifs_znode *znode = *zn;
+ struct ubifs_zbranch *zbr;
+ union ubifs_key *dkey;
+
++ if (!exact) {
++ err = tnc_next(c, &znode, n);
++ if (err)
++ return err;
++ }
++
+ for (;;) {
+ zbr = &znode->zbranch[*n];
+ dkey = &zbr->key;
+@@ -1931,7 +1937,7 @@ static int do_lookup_dh(struct ubifs_info *c, const union ubifs_key *key,
+ if (unlikely(err < 0))
+ goto out_unlock;
+
+- err = search_dh_cookie(c, key, dent, cookie, &znode, &n);
++ err = search_dh_cookie(c, key, dent, cookie, &znode, &n, err);
+
+ out_unlock:
+ mutex_unlock(&c->tnc_mutex);
+@@ -2718,7 +2724,7 @@ int ubifs_tnc_remove_dh(struct ubifs_info *c, const union ubifs_key *key,
+ if (unlikely(err < 0))
+ goto out_free;
+
+- err = search_dh_cookie(c, key, dent, cookie, &znode, &n);
++ err = search_dh_cookie(c, key, dent, cookie, &znode, &n, err);
+ if (err)
+ goto out_free;
+ }
+diff --git a/include/uapi/linux/isdn/capicmd.h b/include/uapi/linux/isdn/capicmd.h
+index 4941628a4fb9..5ec88e7548a9 100644
+--- a/include/uapi/linux/isdn/capicmd.h
++++ b/include/uapi/linux/isdn/capicmd.h
+@@ -16,6 +16,7 @@
+ #define CAPI_MSG_BASELEN 8
+ #define CAPI_DATA_B3_REQ_LEN (CAPI_MSG_BASELEN+4+4+2+2+2)
+ #define CAPI_DATA_B3_RESP_LEN (CAPI_MSG_BASELEN+4+2)
++#define CAPI_DISCONNECT_B3_RESP_LEN (CAPI_MSG_BASELEN+4)
+
+ /*----- CAPI commands -----*/
+ #define CAPI_ALERT 0x01
+diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
+index 95414ad3506a..98c04ca5fa43 100644
+--- a/kernel/irq/resend.c
++++ b/kernel/irq/resend.c
+@@ -36,6 +36,8 @@ static void resend_irqs(unsigned long arg)
+ irq = find_first_bit(irqs_resend, nr_irqs);
+ clear_bit(irq, irqs_resend);
+ desc = irq_to_desc(irq);
++ if (!desc)
++ continue;
+ local_irq_disable();
+ desc->handle_irq(desc);
+ local_irq_enable();
+diff --git a/kernel/module.c b/kernel/module.c
+index 0d86fc73d63d..8257110bf599 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1884,7 +1884,7 @@ static void mod_sysfs_teardown(struct module *mod)
+ mod_sysfs_fini(mod);
+ }
+
+-#ifdef CONFIG_STRICT_MODULE_RWX
++#ifdef CONFIG_ARCH_HAS_STRICT_MODULE_RWX
+ /*
+ * LKM RO/NX protection: protect module's text/ro-data
+ * from modification and any data from execution.
+@@ -1907,6 +1907,7 @@ static void frob_text(const struct module_layout *layout,
+ layout->text_size >> PAGE_SHIFT);
+ }
+
++#ifdef CONFIG_STRICT_MODULE_RWX
+ static void frob_rodata(const struct module_layout *layout,
+ int (*set_memory)(unsigned long start, int num_pages))
+ {
+@@ -1956,13 +1957,9 @@ void module_enable_ro(const struct module *mod, bool after_init)
+ return;
+
+ frob_text(&mod->core_layout, set_memory_ro);
+- frob_text(&mod->core_layout, set_memory_x);
+
+ frob_rodata(&mod->core_layout, set_memory_ro);
+-
+ frob_text(&mod->init_layout, set_memory_ro);
+- frob_text(&mod->init_layout, set_memory_x);
+-
+ frob_rodata(&mod->init_layout, set_memory_ro);
+
+ if (after_init)
+@@ -2043,11 +2040,23 @@ static void disable_ro_nx(const struct module_layout *layout)
+ frob_writable_data(layout, set_memory_x);
+ }
+
+-#else
++#else /* !CONFIG_STRICT_MODULE_RWX */
+ static void disable_ro_nx(const struct module_layout *layout) { }
+ static void module_enable_nx(const struct module *mod) { }
+ static void module_disable_nx(const struct module *mod) { }
+-#endif
++#endif /* CONFIG_STRICT_MODULE_RWX */
++
++static void module_enable_x(const struct module *mod)
++{
++ frob_text(&mod->core_layout, set_memory_x);
++ frob_text(&mod->init_layout, set_memory_x);
++}
++#else /* !CONFIG_ARCH_HAS_STRICT_MODULE_RWX */
++static void disable_ro_nx(const struct module_layout *layout) { }
++static void module_enable_nx(const struct module *mod) { }
++static void module_disable_nx(const struct module *mod) { }
++static void module_enable_x(const struct module *mod) { }
++#endif /* CONFIG_ARCH_HAS_STRICT_MODULE_RWX */
+
+ #ifdef CONFIG_LIVEPATCH
+ /*
+@@ -3604,6 +3613,7 @@ static int complete_formation(struct module *mod, struct load_info *info)
+
+ module_enable_ro(mod, false);
+ module_enable_nx(mod);
++ module_enable_x(mod);
+
+ /* Mark state as coming so strong_try_module_get() ignores us,
+ * but kallsyms etc. can see us. */
+diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
+index 6d9f48bd374a..55198818e3e5 100644
+--- a/net/bridge/br_mdb.c
++++ b/net/bridge/br_mdb.c
+@@ -419,7 +419,7 @@ static int nlmsg_populate_rtr_fill(struct sk_buff *skb,
+ struct nlmsghdr *nlh;
+ struct nlattr *nest;
+
+- nlh = nlmsg_put(skb, pid, seq, type, sizeof(*bpm), NLM_F_MULTI);
++ nlh = nlmsg_put(skb, pid, seq, type, sizeof(*bpm), 0);
+ if (!nlh)
+ return -EMSGSIZE;
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index e4b4cb40da00..ddd8aab20adf 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -8562,6 +8562,8 @@ int register_netdevice(struct net_device *dev)
+ ret = notifier_to_errno(ret);
+ if (ret) {
+ rollback_registered(dev);
++ rcu_barrier();
++
+ dev->reg_state = NETREG_UNREGISTERED;
+ }
+ /*
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 9b9f696281a9..0629ca89ab74 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3530,6 +3530,25 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
+ int pos;
+ int dummy;
+
++ if (list_skb && !list_skb->head_frag && skb_headlen(list_skb) &&
++ (skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY)) {
++ /* gso_size is untrusted, and we have a frag_list with a linear
++ * non head_frag head.
++ *
++ * (we assume checking the first list_skb member suffices;
++ * i.e if either of the list_skb members have non head_frag
++ * head, then the first one has too).
++ *
++ * If head_skb's headlen does not fit requested gso_size, it
++ * means that the frag_list members do NOT terminate on exact
++ * gso_size boundaries. Hence we cannot perform skb_frag_t page
++ * sharing. Therefore we must fallback to copying the frag_list
++ * skbs; we do so by disabling SG.
++ */
++ if (mss != GSO_BY_FRAGS && mss != skb_headlen(head_skb))
++ features &= ~NETIF_F_SG;
++ }
++
+ __skb_push(head_skb, doffset);
+ proto = skb_network_protocol(head_skb, &dummy);
+ if (unlikely(!proto))
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 4a8869d39662..14a6a489937c 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -260,7 +260,7 @@ static void tcp_ecn_accept_cwr(struct sock *sk, const struct sk_buff *skb)
+
+ static void tcp_ecn_withdraw_cwr(struct tcp_sock *tp)
+ {
+- tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
++ tp->ecn_flags &= ~TCP_ECN_QUEUE_CWR;
+ }
+
+ static void __tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb)
+diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
+index 4c04bccc7417..5c9be8594483 100644
+--- a/net/ipv6/ping.c
++++ b/net/ipv6/ping.c
+@@ -228,7 +228,7 @@ static int __net_init ping_v6_proc_init_net(struct net *net)
+ return 0;
+ }
+
+-static void __net_init ping_v6_proc_exit_net(struct net *net)
++static void __net_exit ping_v6_proc_exit_net(struct net *net)
+ {
+ remove_proc_entry("icmp6", net->proc_net);
+ }
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 77b289da7763..875f521bce0d 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -49,6 +49,8 @@ EXPORT_SYMBOL(default_qdisc_ops);
+ * - updates to tree and tree walking are only done under the rtnl mutex.
+ */
+
++#define SKB_XOFF_MAGIC ((struct sk_buff *)1UL)
++
+ static inline struct sk_buff *__skb_dequeue_bad_txq(struct Qdisc *q)
+ {
+ const struct netdev_queue *txq = q->dev_queue;
+@@ -74,7 +76,7 @@ static inline struct sk_buff *__skb_dequeue_bad_txq(struct Qdisc *q)
+ q->q.qlen--;
+ }
+ } else {
+- skb = NULL;
++ skb = SKB_XOFF_MAGIC;
+ }
+ }
+
+@@ -272,8 +274,11 @@ validate:
+ return skb;
+
+ skb = qdisc_dequeue_skb_bad_txq(q);
+- if (unlikely(skb))
++ if (unlikely(skb)) {
++ if (skb == SKB_XOFF_MAGIC)
++ return NULL;
+ goto bulk;
++ }
+ skb = q->dequeue(q);
+ if (skb) {
+ bulk:
+diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
+index c3a8388dcdf6..a80fe8aa8527 100644
+--- a/net/sched/sch_hhf.c
++++ b/net/sched/sch_hhf.c
+@@ -529,7 +529,7 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt,
+ new_hhf_non_hh_weight = nla_get_u32(tb[TCA_HHF_NON_HH_WEIGHT]);
+
+ non_hh_quantum = (u64)new_quantum * new_hhf_non_hh_weight;
+- if (non_hh_quantum > INT_MAX)
++ if (non_hh_quantum == 0 || non_hh_quantum > INT_MAX)
+ return -EINVAL;
+
+ sch_tree_lock(sch);
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index d97b2b4b7a8b..6d36f74ad295 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -1350,7 +1350,7 @@ static int __net_init sctp_ctrlsock_init(struct net *net)
+ return status;
+ }
+
+-static void __net_init sctp_ctrlsock_exit(struct net *net)
++static void __net_exit sctp_ctrlsock_exit(struct net *net)
+ {
+ /* Free the control endpoint. */
+ inet_ctl_sock_destroy(net->sctp.ctl_sock);
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 28adac31f0ff..de8a82bc6b42 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -562,7 +562,7 @@ static void sctp_do_8_2_transport_strike(struct sctp_cmd_seq *commands,
+ if (net->sctp.pf_enable &&
+ (transport->state == SCTP_ACTIVE) &&
+ (transport->error_count < transport->pathmaxrxt) &&
+- (transport->error_count > asoc->pf_retrans)) {
++ (transport->error_count > transport->pf_retrans)) {
+
+ sctp_assoc_control_transport(asoc, transport,
+ SCTP_TRANSPORT_PF,
+diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
+index 3cfeb9df64b0..e0a3dd424d8c 100644
+--- a/net/tipc/name_distr.c
++++ b/net/tipc/name_distr.c
+@@ -221,7 +221,8 @@ static void tipc_publ_purge(struct net *net, struct publication *publ, u32 addr)
+ publ->key);
+ }
+
+- kfree_rcu(p, rcu);
++ if (p)
++ kfree_rcu(p, rcu);
+ }
+
+ /**
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-09-19 12:34 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-09-19 12:34 UTC (permalink / raw
To: gentoo-commits
commit: 54426b255db58e42cf9bbd99f31867c27b1b599c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 19 12:34:12 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Sep 19 12:34:12 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=54426b25
Add FILE_LOCKING to GENTOO_LINUX config. See bug #694688.
Thanks to Marius Stoica for reporting.
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
4567_distro-Gentoo-Kconfig.patch | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index d6e791a..25f36df 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -6,9 +6,9 @@
source "lib/Kconfig.debug"
+
+source "distro/Kconfig"
---- /dev/null 2018-12-28 10:40:34.089999934 -0500
-+++ b/distro/Kconfig 2018-12-28 18:54:40.467970759 -0500
-@@ -0,0 +1,147 @@
+--- /dev/null 2019-09-19 03:42:24.710222248 -0400
++++ b/distro/Kconfig 2019-09-19 08:22:31.146930385 -0400
+@@ -0,0 +1,149 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -91,6 +91,7 @@
+ depends on GENTOO_LINUX
+
+ select BINFMT_SCRIPT
++ select FILE_LOCKING
+
+ help
+ The init system is the first thing that loads after the kernel booted.
@@ -123,6 +124,7 @@
+ select EPOLL
+ select FANOTIFY
+ select FHANDLE
++ select FILE_LOCKING
+ select INOTIFY_USER
+ select IPV6
+ select NET
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-09-21 17:11 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-09-21 17:11 UTC (permalink / raw
To: gentoo-commits
commit: 66eff6029f38be9ed1d7319d914910c1c07101a0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 21 17:11:29 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Sep 21 17:11:29 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=66eff602
Linux patch 4.19.75
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1074_linux-4.19.75.patch | 2496 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2500 insertions(+)
diff --git a/0000_README b/0000_README
index 7734d78..050c323 100644
--- a/0000_README
+++ b/0000_README
@@ -335,6 +335,10 @@ Patch: 1073_linux-4.19.74.patch
From: https://www.kernel.org
Desc: Linux 4.19.74
+Patch: 1074_linux-4.19.75.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.75
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1074_linux-4.19.75.patch b/1074_linux-4.19.75.patch
new file mode 100644
index 0000000..e01e663
--- /dev/null
+++ b/1074_linux-4.19.75.patch
@@ -0,0 +1,2496 @@
+diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
+index eef7d9d259e8..d7dc9c818b83 100644
+--- a/Documentation/filesystems/overlayfs.txt
++++ b/Documentation/filesystems/overlayfs.txt
+@@ -302,7 +302,7 @@ beneath or above the path of another overlay lower layer path.
+
+ Using an upper layer path and/or a workdir path that are already used by
+ another overlay mount is not allowed and may fail with EBUSY. Using
+-partially overlapping paths is not allowed but will not fail with EBUSY.
++partially overlapping paths is not allowed and may fail with EBUSY.
+ If files are accessed from two overlayfs mounts which share or overlap the
+ upper layer and/or workdir path the behavior of the overlay is undefined,
+ though it will not result in a crash or deadlock.
+diff --git a/Makefile b/Makefile
+index 3509e0c6e5ae..4bf6f24916bf 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 74
++SUBLEVEL = 75
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am571x-idk.dts b/arch/arm/boot/dts/am571x-idk.dts
+index d9a2049a1ea8..6bebedfc0f35 100644
+--- a/arch/arm/boot/dts/am571x-idk.dts
++++ b/arch/arm/boot/dts/am571x-idk.dts
+@@ -98,14 +98,9 @@
+ };
+
+ &mmc1 {
+- pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
++ pinctrl-names = "default", "hs";
+ pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
+ pinctrl-1 = <&mmc1_pins_hs>;
+- pinctrl-2 = <&mmc1_pins_sdr12>;
+- pinctrl-3 = <&mmc1_pins_sdr25>;
+- pinctrl-4 = <&mmc1_pins_sdr50>;
+- pinctrl-5 = <&mmc1_pins_ddr50_rev20 &mmc1_iodelay_ddr50_conf>;
+- pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>;
+ };
+
+ &mmc2 {
+diff --git a/arch/arm/boot/dts/am572x-idk.dts b/arch/arm/boot/dts/am572x-idk.dts
+index 3ef9111d0e8b..9235173edbd3 100644
+--- a/arch/arm/boot/dts/am572x-idk.dts
++++ b/arch/arm/boot/dts/am572x-idk.dts
+@@ -20,14 +20,9 @@
+ };
+
+ &mmc1 {
+- pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
++ pinctrl-names = "default", "hs";
+ pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
+ pinctrl-1 = <&mmc1_pins_hs>;
+- pinctrl-2 = <&mmc1_pins_sdr12>;
+- pinctrl-3 = <&mmc1_pins_sdr25>;
+- pinctrl-4 = <&mmc1_pins_sdr50>;
+- pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev20_conf>;
+- pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>;
+ };
+
+ &mmc2 {
+diff --git a/arch/arm/boot/dts/am574x-idk.dts b/arch/arm/boot/dts/am574x-idk.dts
+index 378dfa780ac1..ae43de3297f4 100644
+--- a/arch/arm/boot/dts/am574x-idk.dts
++++ b/arch/arm/boot/dts/am574x-idk.dts
+@@ -24,14 +24,9 @@
+ };
+
+ &mmc1 {
+- pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
++ pinctrl-names = "default", "hs";
+ pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
+ pinctrl-1 = <&mmc1_pins_hs>;
+- pinctrl-2 = <&mmc1_pins_default>;
+- pinctrl-3 = <&mmc1_pins_hs>;
+- pinctrl-4 = <&mmc1_pins_sdr50>;
+- pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_conf>;
+- pinctrl-6 = <&mmc1_pins_ddr50 &mmc1_iodelay_sdr104_conf>;
+ };
+
+ &mmc2 {
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+index ad953113cefb..d53532b47947 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
++++ b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+@@ -433,6 +433,7 @@
+
+ bus-width = <4>;
+ cd-gpios = <&gpio6 27 GPIO_ACTIVE_LOW>; /* gpio 219 */
++ no-1-8-v;
+ };
+
+ &mmc2 {
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts b/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts
+index 5a77b334923d..34c69965821b 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts
++++ b/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts
+@@ -19,14 +19,9 @@
+ };
+
+ &mmc1 {
+- pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
++ pinctrl-names = "default", "hs";
+ pinctrl-0 = <&mmc1_pins_default>;
+ pinctrl-1 = <&mmc1_pins_hs>;
+- pinctrl-2 = <&mmc1_pins_sdr12>;
+- pinctrl-3 = <&mmc1_pins_sdr25>;
+- pinctrl-4 = <&mmc1_pins_sdr50>;
+- pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev11_conf>;
+- pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev11_conf>;
+ vmmc-supply = <&vdd_3v3>;
+ vqmmc-supply = <&ldo1_reg>;
+ };
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts b/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts
+index 17c41da3b55f..ccd99160bbdf 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts
++++ b/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts
+@@ -19,14 +19,9 @@
+ };
+
+ &mmc1 {
+- pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
++ pinctrl-names = "default", "hs";
+ pinctrl-0 = <&mmc1_pins_default>;
+ pinctrl-1 = <&mmc1_pins_hs>;
+- pinctrl-2 = <&mmc1_pins_sdr12>;
+- pinctrl-3 = <&mmc1_pins_sdr25>;
+- pinctrl-4 = <&mmc1_pins_sdr50>;
+- pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev20_conf>;
+- pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>;
+ vmmc-supply = <&vdd_3v3>;
+ vqmmc-supply = <&ldo1_reg>;
+ };
+diff --git a/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi b/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi
+index 28ebb4eb884a..214b9e6de2c3 100644
+--- a/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi
++++ b/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi
+@@ -32,7 +32,7 @@
+ *
+ * Datamanual Revisions:
+ *
+- * AM572x Silicon Revision 2.0: SPRS953B, Revised November 2016
++ * AM572x Silicon Revision 2.0: SPRS953F, Revised May 2019
+ * AM572x Silicon Revision 1.1: SPRS915R, Revised November 2016
+ *
+ */
+@@ -229,45 +229,45 @@
+
+ mmc3_pins_default: mmc3_pins_default {
+ pinctrl-single,pins = <
+- DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+- DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+- DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+- DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+- DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+- DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
++ DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
++ DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
++ DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
++ DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
++ DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
++ DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+ >;
+ };
+
+ mmc3_pins_hs: mmc3_pins_hs {
+ pinctrl-single,pins = <
+- DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+- DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+- DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+- DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+- DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+- DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
++ DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
++ DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
++ DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
++ DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
++ DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
++ DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+ >;
+ };
+
+ mmc3_pins_sdr12: mmc3_pins_sdr12 {
+ pinctrl-single,pins = <
+- DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+- DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+- DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+- DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+- DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+- DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
++ DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
++ DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
++ DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
++ DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
++ DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
++ DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+ >;
+ };
+
+ mmc3_pins_sdr25: mmc3_pins_sdr25 {
+ pinctrl-single,pins = <
+- DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+- DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+- DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+- DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+- DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+- DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
++ DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
++ DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
++ DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
++ DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
++ DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
++ DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+ >;
+ };
+
+diff --git a/arch/arm/mach-omap1/ams-delta-fiq-handler.S b/arch/arm/mach-omap1/ams-delta-fiq-handler.S
+index ddc27638ba2a..017c792be0a0 100644
+--- a/arch/arm/mach-omap1/ams-delta-fiq-handler.S
++++ b/arch/arm/mach-omap1/ams-delta-fiq-handler.S
+@@ -135,6 +135,8 @@ restart:
+ orr r11, r11, r13 @ mask all requested interrupts
+ str r11, [r12, #OMAP1510_GPIO_INT_MASK]
+
++ str r13, [r12, #OMAP1510_GPIO_INT_STATUS] @ ack all requested interrupts
++
+ ands r10, r13, #KEYBRD_CLK_MASK @ extract keyboard status - set?
+ beq hksw @ no - try next source
+
+@@ -142,7 +144,6 @@ restart:
+ @@@@@@@@@@@@@@@@@@@@@@
+ @ Keyboard clock FIQ mode interrupt handler
+ @ r10 now contains KEYBRD_CLK_MASK, use it
+- str r10, [r12, #OMAP1510_GPIO_INT_STATUS] @ ack the interrupt
+ bic r11, r11, r10 @ unmask it
+ str r11, [r12, #OMAP1510_GPIO_INT_MASK]
+
+diff --git a/arch/arm/mach-omap1/ams-delta-fiq.c b/arch/arm/mach-omap1/ams-delta-fiq.c
+index b0dc7ddf5877..b8ba763fe108 100644
+--- a/arch/arm/mach-omap1/ams-delta-fiq.c
++++ b/arch/arm/mach-omap1/ams-delta-fiq.c
+@@ -73,9 +73,7 @@ static irqreturn_t deferred_fiq(int irq, void *dev_id)
+ * interrupts default to since commit 80ac93c27441
+ * requires interrupt already acked and unmasked.
+ */
+- if (irq_chip->irq_ack)
+- irq_chip->irq_ack(d);
+- if (irq_chip->irq_unmask)
++ if (!WARN_ON_ONCE(!irq_chip->irq_unmask))
+ irq_chip->irq_unmask(d);
+ }
+ for (; irq_counter[gpio] < fiq_count; irq_counter[gpio]++)
+diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
+index b226c8aaf8b1..7074cfd1ff41 100644
+--- a/arch/arm/mach-omap2/omap4-common.c
++++ b/arch/arm/mach-omap2/omap4-common.c
+@@ -131,6 +131,9 @@ static int __init omap4_sram_init(void)
+ struct device_node *np;
+ struct gen_pool *sram_pool;
+
++ if (!soc_is_omap44xx() && !soc_is_omap54xx())
++ return 0;
++
+ np = of_find_compatible_node(NULL, NULL, "ti,omap4-mpu");
+ if (!np)
+ pr_warn("%s:Unable to allocate sram needed to handle errata I688\n",
+diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+index e6c7061a8e73..3547f32822b6 100644
+--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+@@ -385,7 +385,8 @@ static struct omap_hwmod dra7xx_dcan2_hwmod = {
+ static struct omap_hwmod_class_sysconfig dra7xx_epwmss_sysc = {
+ .rev_offs = 0x0,
+ .sysc_offs = 0x4,
+- .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET,
++ .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
++ SYSC_HAS_RESET_STATUS,
+ .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
+ .sysc_fields = &omap_hwmod_sysc_type2,
+ };
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index 0cc8e04295a4..e1d330a26921 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -196,6 +196,11 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max_low,
+ #ifdef CONFIG_HAVE_ARCH_PFN_VALID
+ int pfn_valid(unsigned long pfn)
+ {
++ phys_addr_t addr = __pfn_to_phys(pfn);
++
++ if (__phys_to_pfn(addr) != pfn)
++ return 0;
++
+ return memblock_is_map_memory(__pfn_to_phys(pfn));
+ }
+ EXPORT_SYMBOL(pfn_valid);
+@@ -713,7 +718,8 @@ static void update_sections_early(struct section_perm perms[], int n)
+ if (t->flags & PF_KTHREAD)
+ continue;
+ for_each_thread(t, s)
+- set_section_perms(perms, n, true, s->mm);
++ if (s->mm)
++ set_section_perms(perms, n, true, s->mm);
+ }
+ set_section_perms(perms, n, true, current->active_mm);
+ set_section_perms(perms, n, true, &init_mm);
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index 94babc3d0ec2..859d63cc99a3 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -895,6 +895,12 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
+ static const struct midr_range kpti_safe_list[] = {
+ MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
+ MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A35),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A53),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A55),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A57),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A72),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
+ { /* sentinel */ }
+ };
+ char const *str = "command line option";
+diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
+index c879979faa73..3ea4c1f107d7 100644
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -521,14 +521,6 @@ void __init radix__early_init_devtree(void)
+ mmu_psize_defs[MMU_PAGE_64K].shift = 16;
+ mmu_psize_defs[MMU_PAGE_64K].ap = 0x5;
+ found:
+-#ifdef CONFIG_SPARSEMEM_VMEMMAP
+- if (mmu_psize_defs[MMU_PAGE_2M].shift) {
+- /*
+- * map vmemmap using 2M if available
+- */
+- mmu_vmemmap_psize = MMU_PAGE_2M;
+- }
+-#endif /* CONFIG_SPARSEMEM_VMEMMAP */
+ return;
+ }
+
+@@ -567,7 +559,13 @@ void __init radix__early_init_mmu(void)
+
+ #ifdef CONFIG_SPARSEMEM_VMEMMAP
+ /* vmemmap mapping */
+- mmu_vmemmap_psize = mmu_virtual_psize;
++ if (mmu_psize_defs[MMU_PAGE_2M].shift) {
++ /*
++ * map vmemmap using 2M if available
++ */
++ mmu_vmemmap_psize = MMU_PAGE_2M;
++ } else
++ mmu_vmemmap_psize = mmu_virtual_psize;
+ #endif
+ /*
+ * initialize page table size
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index d7052cbe984f..2617e426c792 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -841,7 +841,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ break;
+ case BPF_ALU64 | BPF_NEG: /* dst = -dst */
+ /* lcgr %dst,%dst */
+- EMIT4(0xb9130000, dst_reg, dst_reg);
++ EMIT4(0xb9030000, dst_reg, dst_reg);
+ break;
+ /*
+ * BPF_FROM_BE/LE
+@@ -1015,8 +1015,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ /* llgf %w1,map.max_entries(%b2) */
+ EMIT6_DISP_LH(0xe3000000, 0x0016, REG_W1, REG_0, BPF_REG_2,
+ offsetof(struct bpf_array, map.max_entries));
+- /* clgrj %b3,%w1,0xa,label0: if %b3 >= %w1 goto out */
+- EMIT6_PCREL_LABEL(0xec000000, 0x0065, BPF_REG_3,
++ /* clrj %b3,%w1,0xa,label0: if (u32)%b3 >= (u32)%w1 goto out */
++ EMIT6_PCREL_LABEL(0xec000000, 0x0077, BPF_REG_3,
+ REG_W1, 0, 0xa);
+
+ /*
+@@ -1042,8 +1042,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ * goto out;
+ */
+
+- /* sllg %r1,%b3,3: %r1 = index * 8 */
+- EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, BPF_REG_3, REG_0, 3);
++ /* llgfr %r1,%b3: %r1 = (u32) index */
++ EMIT4(0xb9160000, REG_1, BPF_REG_3);
++ /* sllg %r1,%r1,3: %r1 *= 8 */
++ EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, REG_1, REG_0, 3);
+ /* lg %r1,prog(%b2,%r1) */
+ EMIT6_DISP_LH(0xe3000000, 0x0004, REG_1, BPF_REG_2,
+ REG_1, offsetof(struct bpf_array, ptrs));
+diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
+index d50bb4dc0650..80c6d84cad67 100644
+--- a/arch/x86/events/amd/ibs.c
++++ b/arch/x86/events/amd/ibs.c
+@@ -672,10 +672,17 @@ fail:
+
+ throttle = perf_event_overflow(event, &data, ®s);
+ out:
+- if (throttle)
++ if (throttle) {
+ perf_ibs_stop(event, 0);
+- else
+- perf_ibs_enable_event(perf_ibs, hwc, period >> 4);
++ } else {
++ period >>= 4;
++
++ if ((ibs_caps & IBS_CAPS_RDWROPCNT) &&
++ (*config & IBS_OP_CNT_CTL))
++ period |= *config & IBS_OP_CUR_CNT_RAND;
++
++ perf_ibs_enable_event(perf_ibs, hwc, period);
++ }
+
+ perf_event_update_userpage(event);
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index db5a2ba61753..2dd8b0d64295 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3319,6 +3319,11 @@ static u64 bdw_limit_period(struct perf_event *event, u64 left)
+ return left;
+ }
+
++static u64 nhm_limit_period(struct perf_event *event, u64 left)
++{
++ return max(left, 32ULL);
++}
++
+ PMU_FORMAT_ATTR(event, "config:0-7" );
+ PMU_FORMAT_ATTR(umask, "config:8-15" );
+ PMU_FORMAT_ATTR(edge, "config:18" );
+@@ -4115,6 +4120,7 @@ __init int intel_pmu_init(void)
+ x86_pmu.pebs_constraints = intel_nehalem_pebs_event_constraints;
+ x86_pmu.enable_all = intel_pmu_nhm_enable_all;
+ x86_pmu.extra_regs = intel_nehalem_extra_regs;
++ x86_pmu.limit_period = nhm_limit_period;
+
+ x86_pmu.cpu_events = nhm_events_attrs;
+
+diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c
+index ef5f29f913d7..2f34d5275352 100644
+--- a/arch/x86/hyperv/mmu.c
++++ b/arch/x86/hyperv/mmu.c
+@@ -37,12 +37,14 @@ static inline int fill_gva_list(u64 gva_list[], int offset,
+ * Lower 12 bits encode the number of additional
+ * pages to flush (in addition to the 'cur' page).
+ */
+- if (diff >= HV_TLB_FLUSH_UNIT)
++ if (diff >= HV_TLB_FLUSH_UNIT) {
+ gva_list[gva_n] |= ~PAGE_MASK;
+- else if (diff)
++ cur += HV_TLB_FLUSH_UNIT;
++ } else if (diff) {
+ gva_list[gva_n] |= (diff - 1) >> PAGE_SHIFT;
++ cur = end;
++ }
+
+- cur += HV_TLB_FLUSH_UNIT;
+ gva_n++;
+
+ } while (cur < end);
+diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
+index 78241b736f2a..f6c4915a863e 100644
+--- a/arch/x86/include/asm/perf_event.h
++++ b/arch/x86/include/asm/perf_event.h
+@@ -209,16 +209,20 @@ struct x86_pmu_capability {
+ #define IBSCTL_LVT_OFFSET_VALID (1ULL<<8)
+ #define IBSCTL_LVT_OFFSET_MASK 0x0F
+
+-/* ibs fetch bits/masks */
++/* IBS fetch bits/masks */
+ #define IBS_FETCH_RAND_EN (1ULL<<57)
+ #define IBS_FETCH_VAL (1ULL<<49)
+ #define IBS_FETCH_ENABLE (1ULL<<48)
+ #define IBS_FETCH_CNT 0xFFFF0000ULL
+ #define IBS_FETCH_MAX_CNT 0x0000FFFFULL
+
+-/* ibs op bits/masks */
+-/* lower 4 bits of the current count are ignored: */
+-#define IBS_OP_CUR_CNT (0xFFFF0ULL<<32)
++/*
++ * IBS op bits/masks
++ * The lower 7 bits of the current count are random bits
++ * preloaded by hardware and ignored in software
++ */
++#define IBS_OP_CUR_CNT (0xFFF80ULL<<32)
++#define IBS_OP_CUR_CNT_RAND (0x0007FULL<<32)
+ #define IBS_OP_CNT_CTL (1ULL<<19)
+ #define IBS_OP_VAL (1ULL<<18)
+ #define IBS_OP_ENABLE (1ULL<<17)
+diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
+index 4111edb3188e..971830341061 100644
+--- a/arch/x86/include/asm/uaccess.h
++++ b/arch/x86/include/asm/uaccess.h
+@@ -451,8 +451,10 @@ do { \
+ ({ \
+ int __gu_err; \
+ __inttype(*(ptr)) __gu_val; \
++ __typeof__(ptr) __gu_ptr = (ptr); \
++ __typeof__(size) __gu_size = (size); \
+ __uaccess_begin_nospec(); \
+- __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
++ __get_user_size(__gu_val, __gu_ptr, __gu_size, __gu_err, -EFAULT); \
+ __uaccess_end(); \
+ (x) = (__force __typeof__(*(ptr)))__gu_val; \
+ __builtin_expect(__gu_err, 0); \
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 4077e309e5c4..ab22eded61d2 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2432,7 +2432,13 @@ unsigned int arch_dynirq_lower_bound(unsigned int from)
+ * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use
+ * gsi_top if ioapic_dynirq_base hasn't been initialized yet.
+ */
+- return ioapic_initialized ? ioapic_dynirq_base : gsi_top;
++ if (!ioapic_initialized)
++ return gsi_top;
++ /*
++ * For DT enabled machines ioapic_dynirq_base is irrelevant and not
++ * updated. So simply return @from if ioapic_dynirq_base == 0.
++ */
++ return ioapic_dynirq_base ? : from;
+ }
+
+ #ifdef CONFIG_X86_32
+diff --git a/drivers/atm/Kconfig b/drivers/atm/Kconfig
+index 2e2efa577437..8c37294f1d1e 100644
+--- a/drivers/atm/Kconfig
++++ b/drivers/atm/Kconfig
+@@ -200,7 +200,7 @@ config ATM_NICSTAR_USE_SUNI
+ make the card work).
+
+ config ATM_NICSTAR_USE_IDT77105
+- bool "Use IDT77015 PHY driver (25Mbps)"
++ bool "Use IDT77105 PHY driver (25Mbps)"
+ depends on ATM_NICSTAR
+ help
+ Support for the PHYsical layer chip in ForeRunner LE25 cards. In
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 4a9a4d12721a..e71589e244fb 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -3791,7 +3791,7 @@ static int compat_getdrvprm(int drive,
+ v.native_format = UDP->native_format;
+ mutex_unlock(&floppy_mutex);
+
+- if (copy_from_user(arg, &v, sizeof(struct compat_floppy_drive_params)))
++ if (copy_to_user(arg, &v, sizeof(struct compat_floppy_drive_params)))
+ return -EFAULT;
+ return 0;
+ }
+@@ -3827,7 +3827,7 @@ static int compat_getdrvstat(int drive, bool poll,
+ v.bufblocks = UDRS->bufblocks;
+ mutex_unlock(&floppy_mutex);
+
+- if (copy_from_user(arg, &v, sizeof(struct compat_floppy_drive_struct)))
++ if (copy_to_user(arg, &v, sizeof(struct compat_floppy_drive_struct)))
+ return -EFAULT;
+ return 0;
+ Eintr:
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index e4fe954e63a9..e95b26319cd9 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -1022,10 +1022,7 @@ static int sysc_init_sysc_mask(struct sysc *ddata)
+ if (error)
+ return 0;
+
+- if (val)
+- ddata->cfg.sysc_val = val & ddata->cap->sysc_mask;
+- else
+- ddata->cfg.sysc_val = ddata->cap->sysc_mask;
++ ddata->cfg.sysc_val = val & ddata->cap->sysc_mask;
+
+ return 0;
+ }
+@@ -1688,7 +1685,7 @@ static int sysc_probe(struct platform_device *pdev)
+
+ error = sysc_init_dts_quirks(ddata);
+ if (error)
+- goto unprepare;
++ return error;
+
+ error = sysc_get_clocks(ddata);
+ if (error)
+@@ -1696,27 +1693,27 @@ static int sysc_probe(struct platform_device *pdev)
+
+ error = sysc_map_and_check_registers(ddata);
+ if (error)
+- goto unprepare;
++ return error;
+
+ error = sysc_init_sysc_mask(ddata);
+ if (error)
+- goto unprepare;
++ return error;
+
+ error = sysc_init_idlemodes(ddata);
+ if (error)
+- goto unprepare;
++ return error;
+
+ error = sysc_init_syss_mask(ddata);
+ if (error)
+- goto unprepare;
++ return error;
+
+ error = sysc_init_pdata(ddata);
+ if (error)
+- goto unprepare;
++ return error;
+
+ error = sysc_init_resets(ddata);
+ if (error)
+- return error;
++ goto unprepare;
+
+ pm_runtime_enable(ddata->dev);
+ error = sysc_init_module(ddata);
+diff --git a/drivers/dma/ti/dma-crossbar.c b/drivers/dma/ti/dma-crossbar.c
+index 9272b173c746..6574cb5a12fe 100644
+--- a/drivers/dma/ti/dma-crossbar.c
++++ b/drivers/dma/ti/dma-crossbar.c
+@@ -395,8 +395,10 @@ static int ti_dra7_xbar_probe(struct platform_device *pdev)
+
+ ret = of_property_read_u32_array(node, pname, (u32 *)rsv_events,
+ nelm * 2);
+- if (ret)
++ if (ret) {
++ kfree(rsv_events);
+ return ret;
++ }
+
+ for (i = 0; i < nelm; i++) {
+ ti_dra7_xbar_reserve(rsv_events[i][0], rsv_events[i][1],
+diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
+index aeb9c29e5255..c192bdc30aae 100644
+--- a/drivers/dma/ti/omap-dma.c
++++ b/drivers/dma/ti/omap-dma.c
+@@ -1543,8 +1543,10 @@ static int omap_dma_probe(struct platform_device *pdev)
+
+ rc = devm_request_irq(&pdev->dev, irq, omap_dma_irq,
+ IRQF_SHARED, "omap-dma-engine", od);
+- if (rc)
++ if (rc) {
++ omap_dma_free(od);
+ return rc;
++ }
+ }
+
+ if (omap_dma_glbl_read(od, CAPS_0) & CAPS_0_SUPPORT_LL123)
+diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
+index 1aa67bb5d8c0..ebd3ffc7ca00 100644
+--- a/drivers/firmware/google/vpd.c
++++ b/drivers/firmware/google/vpd.c
+@@ -100,8 +100,8 @@ static int vpd_section_check_key_name(const u8 *key, s32 key_len)
+ return VPD_OK;
+ }
+
+-static int vpd_section_attrib_add(const u8 *key, s32 key_len,
+- const u8 *value, s32 value_len,
++static int vpd_section_attrib_add(const u8 *key, u32 key_len,
++ const u8 *value, u32 value_len,
+ void *arg)
+ {
+ int ret;
+diff --git a/drivers/firmware/google/vpd_decode.c b/drivers/firmware/google/vpd_decode.c
+index 943acaa8aa76..e75abe9fa122 100644
+--- a/drivers/firmware/google/vpd_decode.c
++++ b/drivers/firmware/google/vpd_decode.c
+@@ -19,8 +19,8 @@
+
+ #include "vpd_decode.h"
+
+-static int vpd_decode_len(const s32 max_len, const u8 *in,
+- s32 *length, s32 *decoded_len)
++static int vpd_decode_len(const u32 max_len, const u8 *in,
++ u32 *length, u32 *decoded_len)
+ {
+ u8 more;
+ int i = 0;
+@@ -40,18 +40,39 @@ static int vpd_decode_len(const s32 max_len, const u8 *in,
+ } while (more);
+
+ *decoded_len = i;
++ return VPD_OK;
++}
++
++static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
++ u32 *_consumed, const u8 **entry, u32 *entry_len)
++{
++ u32 decoded_len;
++ u32 consumed = *_consumed;
++
++ if (vpd_decode_len(max_len - consumed, &input_buf[consumed],
++ entry_len, &decoded_len) != VPD_OK)
++ return VPD_FAIL;
++ if (max_len - consumed < decoded_len)
++ return VPD_FAIL;
++
++ consumed += decoded_len;
++ *entry = input_buf + consumed;
++
++ /* entry_len is untrusted data and must be checked again. */
++ if (max_len - consumed < *entry_len)
++ return VPD_FAIL;
+
++ consumed += decoded_len;
++ *_consumed = consumed;
+ return VPD_OK;
+ }
+
+-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
++int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
+ vpd_decode_callback callback, void *callback_arg)
+ {
+ int type;
+- int res;
+- s32 key_len;
+- s32 value_len;
+- s32 decoded_len;
++ u32 key_len;
++ u32 value_len;
+ const u8 *key;
+ const u8 *value;
+
+@@ -66,26 +87,14 @@ int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
+ case VPD_TYPE_STRING:
+ (*consumed)++;
+
+- /* key */
+- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
+- &key_len, &decoded_len);
+- if (res != VPD_OK || *consumed + decoded_len >= max_len)
++ if (vpd_decode_entry(max_len, input_buf, consumed, &key,
++ &key_len) != VPD_OK)
+ return VPD_FAIL;
+
+- *consumed += decoded_len;
+- key = &input_buf[*consumed];
+- *consumed += key_len;
+-
+- /* value */
+- res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
+- &value_len, &decoded_len);
+- if (res != VPD_OK || *consumed + decoded_len > max_len)
++ if (vpd_decode_entry(max_len, input_buf, consumed, &value,
++ &value_len) != VPD_OK)
+ return VPD_FAIL;
+
+- *consumed += decoded_len;
+- value = &input_buf[*consumed];
+- *consumed += value_len;
+-
+ if (type == VPD_TYPE_STRING)
+ return callback(key, key_len, value, value_len,
+ callback_arg);
+diff --git a/drivers/firmware/google/vpd_decode.h b/drivers/firmware/google/vpd_decode.h
+index be3d62c5ca2f..e921456b8e78 100644
+--- a/drivers/firmware/google/vpd_decode.h
++++ b/drivers/firmware/google/vpd_decode.h
+@@ -33,8 +33,8 @@ enum {
+ };
+
+ /* Callback for vpd_decode_string to invoke. */
+-typedef int vpd_decode_callback(const u8 *key, s32 key_len,
+- const u8 *value, s32 value_len,
++typedef int vpd_decode_callback(const u8 *key, u32 key_len,
++ const u8 *value, u32 value_len,
+ void *arg);
+
+ /*
+@@ -52,7 +52,7 @@ typedef int vpd_decode_callback(const u8 *key, s32 key_len,
+ * If one entry is successfully decoded, sends it to callback and returns the
+ * result.
+ */
+-int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
++int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
+ vpd_decode_callback callback, void *callback_arg);
+
+ #endif /* __VPD_DECODE_H */
+diff --git a/drivers/fpga/altera-ps-spi.c b/drivers/fpga/altera-ps-spi.c
+index 24b25c626036..4925cae7dcdd 100644
+--- a/drivers/fpga/altera-ps-spi.c
++++ b/drivers/fpga/altera-ps-spi.c
+@@ -207,7 +207,7 @@ static int altera_ps_write_complete(struct fpga_manager *mgr,
+ return -EIO;
+ }
+
+- if (!IS_ERR(conf->confd)) {
++ if (conf->confd) {
+ if (!gpiod_get_raw_value_cansleep(conf->confd)) {
+ dev_err(&mgr->dev, "CONF_DONE is inactive!\n");
+ return -EIO;
+@@ -265,10 +265,13 @@ static int altera_ps_probe(struct spi_device *spi)
+ return PTR_ERR(conf->status);
+ }
+
+- conf->confd = devm_gpiod_get(&spi->dev, "confd", GPIOD_IN);
++ conf->confd = devm_gpiod_get_optional(&spi->dev, "confd", GPIOD_IN);
+ if (IS_ERR(conf->confd)) {
+- dev_warn(&spi->dev, "Not using confd gpio: %ld\n",
+- PTR_ERR(conf->confd));
++ dev_err(&spi->dev, "Failed to get confd gpio: %ld\n",
++ PTR_ERR(conf->confd));
++ return PTR_ERR(conf->confd);
++ } else if (!conf->confd) {
++ dev_warn(&spi->dev, "Not using confd gpio");
+ }
+
+ /* Register manager with unique name */
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 9cd4705b74bd..5a2d5140c1f4 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -282,14 +282,16 @@ static void wacom_feature_mapping(struct hid_device *hdev,
+ /* leave touch_max as is if predefined */
+ if (!features->touch_max) {
+ /* read manually */
+- data = kzalloc(2, GFP_KERNEL);
++ n = hid_report_len(field->report);
++ data = hid_alloc_report_buf(field->report, GFP_KERNEL);
+ if (!data)
+ break;
+ data[0] = field->report->id;
+ ret = wacom_get_report(hdev, HID_FEATURE_REPORT,
+- data, 2, WAC_CMD_RETRIES);
+- if (ret == 2) {
+- features->touch_max = data[1];
++ data, n, WAC_CMD_RETRIES);
++ if (ret == n) {
++ ret = hid_report_raw_event(hdev,
++ HID_FEATURE_REPORT, data, n, 0);
+ } else {
+ features->touch_max = 16;
+ hid_warn(hdev, "wacom_feature_mapping: "
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 50ef7b6cd195..6f5c838f9d47 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2533,6 +2533,7 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
+ struct wacom *wacom = hid_get_drvdata(hdev);
+ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+ unsigned equivalent_usage = wacom_equivalent_usage(usage->hid);
++ struct wacom_features *features = &wacom->wacom_wac.features;
+
+ switch (equivalent_usage) {
+ case HID_GD_X:
+@@ -2553,6 +2554,9 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
+ case HID_DG_TIPSWITCH:
+ wacom_wac->hid_data.tipswitch = value;
+ break;
++ case HID_DG_CONTACTMAX:
++ features->touch_max = value;
++ return;
+ }
+
+
+diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c
+index e7f9305b2dd9..f5f001738df5 100644
+--- a/drivers/i2c/busses/i2c-designware-slave.c
++++ b/drivers/i2c/busses/i2c-designware-slave.c
+@@ -94,6 +94,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave)
+
+ dev->disable_int(dev);
+ dev->disable(dev);
++ synchronize_irq(dev->irq);
+ dev->slave = NULL;
+ pm_runtime_put(dev->dev);
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 39dc7be56884..6257be21cbed 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -1723,8 +1723,8 @@ void rdma_destroy_id(struct rdma_cm_id *id)
+ mutex_lock(&id_priv->handler_mutex);
+ mutex_unlock(&id_priv->handler_mutex);
+
++ rdma_restrack_del(&id_priv->res);
+ if (id_priv->cma_dev) {
+- rdma_restrack_del(&id_priv->res);
+ if (rdma_cap_ib_cm(id_priv->id.device, 1)) {
+ if (id_priv->cm_id.ib)
+ ib_destroy_cm_id(id_priv->cm_id.ib);
+@@ -3463,10 +3463,9 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
+
+ return 0;
+ err2:
+- if (id_priv->cma_dev) {
+- rdma_restrack_del(&id_priv->res);
++ rdma_restrack_del(&id_priv->res);
++ if (id_priv->cma_dev)
+ cma_release_dev(id_priv);
+- }
+ err1:
+ cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_IDLE);
+ return ret;
+diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c
+index 3b7fa0ccaa08..f67fa24b3aff 100644
+--- a/drivers/infiniband/core/restrack.c
++++ b/drivers/infiniband/core/restrack.c
+@@ -209,7 +209,7 @@ void rdma_restrack_del(struct rdma_restrack_entry *res)
+ struct ib_device *dev;
+
+ if (!res->valid)
+- return;
++ goto out;
+
+ dev = res_to_dev(res);
+ if (!dev)
+@@ -222,8 +222,10 @@ void rdma_restrack_del(struct rdma_restrack_entry *res)
+ down_write(&dev->res.rwsem);
+ hash_del(&res->node);
+ res->valid = false;
++ up_write(&dev->res.rwsem);
++
++out:
+ if (res->task)
+ put_task_struct(res->task);
+- up_write(&dev->res.rwsem);
+ }
+ EXPORT_SYMBOL(rdma_restrack_del);
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index f9525d6f0bfe..ae012639ae1d 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1358,7 +1358,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
+ { "ELAN0618", 0 },
+ { "ELAN0619", 0 },
+ { "ELAN061A", 0 },
+- { "ELAN061B", 0 },
++/* { "ELAN061B", 0 }, not working on the Lenovo Legion Y7000 */
+ { "ELAN061C", 0 },
+ { "ELAN061D", 0 },
+ { "ELAN061E", 0 },
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 8d9920ff4134..69c269dc4f1b 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -1153,6 +1153,17 @@ static void amd_iommu_flush_tlb_all(struct amd_iommu *iommu)
+ iommu_completion_wait(iommu);
+ }
+
++static void amd_iommu_flush_tlb_domid(struct amd_iommu *iommu, u32 dom_id)
++{
++ struct iommu_cmd cmd;
++
++ build_inv_iommu_pages(&cmd, 0, CMD_INV_IOMMU_ALL_PAGES_ADDRESS,
++ dom_id, 1);
++ iommu_queue_command(iommu, &cmd);
++
++ iommu_completion_wait(iommu);
++}
++
+ static void amd_iommu_flush_all(struct amd_iommu *iommu)
+ {
+ struct iommu_cmd cmd;
+@@ -1329,18 +1340,21 @@ static void domain_flush_devices(struct protection_domain *domain)
+ * another level increases the size of the address space by 9 bits to a size up
+ * to 64 bits.
+ */
+-static bool increase_address_space(struct protection_domain *domain,
++static void increase_address_space(struct protection_domain *domain,
+ gfp_t gfp)
+ {
++ unsigned long flags;
+ u64 *pte;
+
+- if (domain->mode == PAGE_MODE_6_LEVEL)
++ spin_lock_irqsave(&domain->lock, flags);
++
++ if (WARN_ON_ONCE(domain->mode == PAGE_MODE_6_LEVEL))
+ /* address space already 64 bit large */
+- return false;
++ goto out;
+
+ pte = (void *)get_zeroed_page(gfp);
+ if (!pte)
+- return false;
++ goto out;
+
+ *pte = PM_LEVEL_PDE(domain->mode,
+ iommu_virt_to_phys(domain->pt_root));
+@@ -1348,7 +1362,10 @@ static bool increase_address_space(struct protection_domain *domain,
+ domain->mode += 1;
+ domain->updated = true;
+
+- return true;
++out:
++ spin_unlock_irqrestore(&domain->lock, flags);
++
++ return;
+ }
+
+ static u64 *alloc_pte(struct protection_domain *domain,
+@@ -1838,6 +1855,7 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain,
+ {
+ u64 pte_root = 0;
+ u64 flags = 0;
++ u32 old_domid;
+
+ if (domain->mode != PAGE_MODE_NONE)
+ pte_root = iommu_virt_to_phys(domain->pt_root);
+@@ -1887,8 +1905,20 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain,
+ flags &= ~DEV_DOMID_MASK;
+ flags |= domain->id;
+
++ old_domid = amd_iommu_dev_table[devid].data[1] & DEV_DOMID_MASK;
+ amd_iommu_dev_table[devid].data[1] = flags;
+ amd_iommu_dev_table[devid].data[0] = pte_root;
++
++ /*
++ * A kdump kernel might be replacing a domain ID that was copied from
++ * the previous kernel--if so, it needs to flush the translation cache
++ * entries for the old domain ID that is being overwritten
++ */
++ if (old_domid) {
++ struct amd_iommu *iommu = amd_iommu_rlookup_table[devid];
++
++ amd_iommu_flush_tlb_domid(iommu, old_domid);
++ }
+ }
+
+ static void clear_dte_entry(u16 devid)
+diff --git a/drivers/media/usb/dvb-usb/technisat-usb2.c b/drivers/media/usb/dvb-usb/technisat-usb2.c
+index 18d0f8f5283f..8d8e9f56a8be 100644
+--- a/drivers/media/usb/dvb-usb/technisat-usb2.c
++++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
+@@ -607,10 +607,9 @@ static int technisat_usb2_frontend_attach(struct dvb_usb_adapter *a)
+ static int technisat_usb2_get_ir(struct dvb_usb_device *d)
+ {
+ struct technisat_usb2_state *state = d->priv;
+- u8 *buf = state->buf;
+- u8 *b;
+- int ret;
+ struct ir_raw_event ev;
++ u8 *buf = state->buf;
++ int i, ret;
+
+ buf[0] = GET_IR_DATA_VENDOR_REQUEST;
+ buf[1] = 0x08;
+@@ -646,26 +645,25 @@ unlock:
+ return 0; /* no key pressed */
+
+ /* decoding */
+- b = buf+1;
+
+ #if 0
+ deb_rc("RC: %d ", ret);
+- debug_dump(b, ret, deb_rc);
++ debug_dump(buf + 1, ret, deb_rc);
+ #endif
+
+ ev.pulse = 0;
+- while (1) {
+- ev.pulse = !ev.pulse;
+- ev.duration = (*b * FIRMWARE_CLOCK_DIVISOR * FIRMWARE_CLOCK_TICK) / 1000;
+- ir_raw_event_store(d->rc_dev, &ev);
+-
+- b++;
+- if (*b == 0xff) {
++ for (i = 1; i < ARRAY_SIZE(state->buf); i++) {
++ if (buf[i] == 0xff) {
+ ev.pulse = 0;
+ ev.duration = 888888*2;
+ ir_raw_event_store(d->rc_dev, &ev);
+ break;
+ }
++
++ ev.pulse = !ev.pulse;
++ ev.duration = (buf[i] * FIRMWARE_CLOCK_DIVISOR *
++ FIRMWARE_CLOCK_TICK) / 1000;
++ ir_raw_event_store(d->rc_dev, &ev);
+ }
+
+ ir_raw_event_handle(d->rc_dev);
+diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c
+index 3a4e545c6037..3db2fd7f5d7c 100644
+--- a/drivers/media/usb/tm6000/tm6000-dvb.c
++++ b/drivers/media/usb/tm6000/tm6000-dvb.c
+@@ -105,6 +105,7 @@ static void tm6000_urb_received(struct urb *urb)
+ printk(KERN_ERR "tm6000: error %s\n", __func__);
+ kfree(urb->transfer_buffer);
+ usb_free_urb(urb);
++ dev->dvb->bulk_urb = NULL;
+ }
+ }
+ }
+@@ -135,6 +136,7 @@ static int tm6000_start_stream(struct tm6000_core *dev)
+ dvb->bulk_urb->transfer_buffer = kzalloc(size, GFP_KERNEL);
+ if (!dvb->bulk_urb->transfer_buffer) {
+ usb_free_urb(dvb->bulk_urb);
++ dvb->bulk_urb = NULL;
+ return -ENOMEM;
+ }
+
+@@ -161,6 +163,7 @@ static int tm6000_start_stream(struct tm6000_core *dev)
+
+ kfree(dvb->bulk_urb->transfer_buffer);
+ usb_free_urb(dvb->bulk_urb);
++ dvb->bulk_urb = NULL;
+ return ret;
+ }
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+index b41f23679a08..7ce9c69e9c44 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+@@ -469,13 +469,19 @@ static int __init xgbe_mod_init(void)
+
+ ret = xgbe_platform_init();
+ if (ret)
+- return ret;
++ goto err_platform_init;
+
+ ret = xgbe_pci_init();
+ if (ret)
+- return ret;
++ goto err_pci_init;
+
+ return 0;
++
++err_pci_init:
++ xgbe_platform_exit();
++err_platform_init:
++ unregister_netdevice_notifier(&xgbe_netdev_notifier);
++ return ret;
+ }
+
+ static void __exit xgbe_mod_exit(void)
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+index d335c334fa56..82582fa54d5d 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+@@ -89,6 +89,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
+ }
+ }
+
++err_exit:
+ if (!was_tx_cleaned)
+ work_done = budget;
+
+@@ -98,7 +99,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
+ 1U << self->aq_ring_param.vec_idx);
+ }
+ }
+-err_exit:
++
+ return work_done;
+ }
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 255de7d68cd3..5a57be66a487 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1998,6 +1998,10 @@ static void __ibmvnic_reset(struct work_struct *work)
+
+ rwi = get_next_rwi(adapter);
+ while (rwi) {
++ if (adapter->state == VNIC_REMOVING ||
++ adapter->state == VNIC_REMOVED)
++ goto out;
++
+ if (adapter->force_reset_recovery) {
+ adapter->force_reset_recovery = false;
+ rc = do_hard_reset(adapter, rwi, reset_state);
+@@ -2022,7 +2026,7 @@ static void __ibmvnic_reset(struct work_struct *work)
+ netdev_dbg(adapter->netdev, "Reset failed\n");
+ free_all_rwi(adapter);
+ }
+-
++out:
+ adapter->resetting = false;
+ if (we_lock_rtnl)
+ rtnl_unlock();
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index 4ade864c8d53..d013f30019b6 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -4954,6 +4954,13 @@ static const struct dmi_system_id msi_blacklist[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "P6T"),
+ },
+ },
++ {
++ .ident = "ASUS P6X",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "P6X"),
++ },
++ },
+ {}
+ };
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
+index cf3b0e3dc350..637687b766ff 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -1150,7 +1150,7 @@ static int qed_slowpath_start(struct qed_dev *cdev,
+ &drv_version);
+ if (rc) {
+ DP_NOTICE(cdev, "Failed sending drv version command\n");
+- return rc;
++ goto err4;
+ }
+ }
+
+@@ -1158,6 +1158,8 @@ static int qed_slowpath_start(struct qed_dev *cdev,
+
+ return 0;
+
++err4:
++ qed_ll2_dealloc_if(cdev);
+ err3:
+ qed_hw_stop(cdev);
+ err2:
+diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c
+index 696037d5ac3d..ad557f457b2c 100644
+--- a/drivers/net/ethernet/seeq/sgiseeq.c
++++ b/drivers/net/ethernet/seeq/sgiseeq.c
+@@ -793,15 +793,16 @@ static int sgiseeq_probe(struct platform_device *pdev)
+ printk(KERN_ERR "Sgiseeq: Cannot register net device, "
+ "aborting.\n");
+ err = -ENODEV;
+- goto err_out_free_page;
++ goto err_out_free_attrs;
+ }
+
+ printk(KERN_INFO "%s: %s %pM\n", dev->name, sgiseeqstr, dev->dev_addr);
+
+ return 0;
+
+-err_out_free_page:
+- free_page((unsigned long) sp->srings);
++err_out_free_attrs:
++ dma_free_attrs(&pdev->dev, sizeof(*sp->srings), sp->srings,
++ sp->srings_dma, DMA_ATTR_NON_CONSISTENT);
+ err_out_free_dev:
+ free_netdev(dev);
+
+diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
+index f1ed1744801c..be1f1a86bcd6 100644
+--- a/drivers/net/ieee802154/mac802154_hwsim.c
++++ b/drivers/net/ieee802154/mac802154_hwsim.c
+@@ -821,7 +821,7 @@ static int hwsim_add_one(struct genl_info *info, struct device *dev,
+ err = hwsim_subscribe_all_others(phy);
+ if (err < 0) {
+ mutex_unlock(&hwsim_phys_lock);
+- goto err_reg;
++ goto err_subscribe;
+ }
+ }
+ list_add_tail(&phy->list, &hwsim_phys);
+@@ -831,6 +831,8 @@ static int hwsim_add_one(struct genl_info *info, struct device *dev,
+
+ return idx;
+
++err_subscribe:
++ ieee802154_unregister_hw(phy->hw);
+ err_reg:
+ kfree(pib);
+ err_pib:
+@@ -920,9 +922,9 @@ static __init int hwsim_init_module(void)
+ return 0;
+
+ platform_drv:
+- genl_unregister_family(&hwsim_genl_family);
+-platform_dev:
+ platform_device_unregister(mac802154hwsim_dev);
++platform_dev:
++ genl_unregister_family(&hwsim_genl_family);
+ return rc;
+ }
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index f1b5201cc320..a065a6184f7e 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -788,8 +788,11 @@ int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
+ ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0),
+ RTL8152_REQ_GET_REGS, RTL8152_REQT_READ,
+ value, index, tmp, size, 500);
++ if (ret < 0)
++ memset(data, 0xff, size);
++ else
++ memcpy(data, tmp, size);
+
+- memcpy(data, tmp, size);
+ kfree(tmp);
+
+ return ret;
+diff --git a/drivers/net/wireless/marvell/mwifiex/ie.c b/drivers/net/wireless/marvell/mwifiex/ie.c
+index 801a2d7b020a..a3f4a5e92105 100644
+--- a/drivers/net/wireless/marvell/mwifiex/ie.c
++++ b/drivers/net/wireless/marvell/mwifiex/ie.c
+@@ -241,6 +241,9 @@ static int mwifiex_update_vs_ie(const u8 *ies, int ies_len,
+ }
+
+ vs_ie = (struct ieee_types_header *)vendor_ie;
++ if (le16_to_cpu(ie->ie_length) + vs_ie->len + 2 >
++ IEEE_MAX_IE_SIZE)
++ return -EINVAL;
+ memcpy(ie->ie_buffer + le16_to_cpu(ie->ie_length),
+ vs_ie, vs_ie->len + 2);
+ le16_unaligned_add_cpu(&ie->ie_length, vs_ie->len + 2);
+diff --git a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
+index 18f7d9bf30b2..0939a8c8f3ab 100644
+--- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
++++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
+@@ -265,6 +265,8 @@ mwifiex_set_uap_rates(struct mwifiex_uap_bss_param *bss_cfg,
+
+ rate_ie = (void *)cfg80211_find_ie(WLAN_EID_SUPP_RATES, var_pos, len);
+ if (rate_ie) {
++ if (rate_ie->len > MWIFIEX_SUPPORTED_RATES)
++ return;
+ memcpy(bss_cfg->rates, rate_ie + 1, rate_ie->len);
+ rate_len = rate_ie->len;
+ }
+@@ -272,8 +274,11 @@ mwifiex_set_uap_rates(struct mwifiex_uap_bss_param *bss_cfg,
+ rate_ie = (void *)cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES,
+ params->beacon.tail,
+ params->beacon.tail_len);
+- if (rate_ie)
++ if (rate_ie) {
++ if (rate_ie->len > MWIFIEX_SUPPORTED_RATES - rate_len)
++ return;
+ memcpy(bss_cfg->rates + rate_len, rate_ie + 1, rate_ie->len);
++ }
+
+ return;
+ }
+@@ -391,6 +396,8 @@ mwifiex_set_wmm_params(struct mwifiex_private *priv,
+ params->beacon.tail_len);
+ if (vendor_ie) {
+ wmm_ie = vendor_ie;
++ if (*(wmm_ie + 1) > sizeof(struct mwifiex_types_wmm_info))
++ return;
+ memcpy(&bss_cfg->wmm_info, wmm_ie +
+ sizeof(struct ieee_types_header), *(wmm_ie + 1));
+ priv->wmm_enabled = 1;
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 5b97cc946d70..a2a4c19bc95e 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -909,7 +909,7 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
+ __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
+ }
+ if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+- queue->rx.rsp_cons = ++cons;
++ queue->rx.rsp_cons = ++cons + skb_queue_len(list);
+ kfree_skb(nskb);
+ return ~0U;
+ }
+diff --git a/drivers/pci/controller/dwc/pcie-kirin.c b/drivers/pci/controller/dwc/pcie-kirin.c
+index 5352e0c3be82..9b599296205d 100644
+--- a/drivers/pci/controller/dwc/pcie-kirin.c
++++ b/drivers/pci/controller/dwc/pcie-kirin.c
+@@ -467,8 +467,8 @@ static int kirin_pcie_add_msi(struct dw_pcie *pci,
+ return 0;
+ }
+
+-static int __init kirin_add_pcie_port(struct dw_pcie *pci,
+- struct platform_device *pdev)
++static int kirin_add_pcie_port(struct dw_pcie *pci,
++ struct platform_device *pdev)
+ {
+ int ret;
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+index fb8f05e39cf7..6fb2b6969590 100644
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -66,6 +66,7 @@
+ USB2_OBINT_IDDIGCHG)
+
+ /* VBCTRL */
++#define USB2_VBCTRL_OCCLREN BIT(16)
+ #define USB2_VBCTRL_DRVVBUSSEL BIT(8)
+
+ /* LINECTRL1 */
+@@ -289,6 +290,7 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch)
+ u32 val;
+
+ val = readl(usb2_base + USB2_VBCTRL);
++ val &= ~USB2_VBCTRL_OCCLREN;
+ writel(val | USB2_VBCTRL_DRVVBUSSEL, usb2_base + USB2_VBCTRL);
+ writel(USB2_OBINT_BITS, usb2_base + USB2_OBINTSTA);
+ val = readl(usb2_base + USB2_OBINTEN);
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 1cb80fe5f95c..dd8949e8fcd7 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -1270,7 +1270,6 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending)
+
+ atmel_port->hd_start_rx = false;
+ atmel_start_rx(port);
+- return;
+ }
+
+ atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
+diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
+index 828f1143859c..2774af86763e 100644
+--- a/drivers/tty/serial/sprd_serial.c
++++ b/drivers/tty/serial/sprd_serial.c
+@@ -232,7 +232,7 @@ static inline void sprd_rx(struct uart_port *port)
+
+ if (lsr & (SPRD_LSR_BI | SPRD_LSR_PE |
+ SPRD_LSR_FE | SPRD_LSR_OE))
+- if (handle_lsr_errors(port, &lsr, &flag))
++ if (handle_lsr_errors(port, &flag, &lsr))
+ continue;
+ if (uart_handle_sysrq_char(port, ch))
+ continue;
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index e723ddd79bcf..921ad6998dec 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -925,7 +925,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
+ struct usb_bos_descriptor *bos;
+ struct usb_dev_cap_header *cap;
+ struct usb_ssp_cap_descriptor *ssp_cap;
+- unsigned char *buffer;
++ unsigned char *buffer, *buffer0;
+ int length, total_len, num, i, ssac;
+ __u8 cap_type;
+ int ret;
+@@ -970,10 +970,12 @@ int usb_get_bos_descriptor(struct usb_device *dev)
+ ret = -ENOMSG;
+ goto err;
+ }
++
++ buffer0 = buffer;
+ total_len -= length;
++ buffer += length;
+
+ for (i = 0; i < num; i++) {
+- buffer += length;
+ cap = (struct usb_dev_cap_header *)buffer;
+
+ if (total_len < sizeof(*cap) || total_len < cap->bLength) {
+@@ -987,8 +989,6 @@ int usb_get_bos_descriptor(struct usb_device *dev)
+ break;
+ }
+
+- total_len -= length;
+-
+ if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
+ dev_warn(ddev, "descriptor type invalid, skip\n");
+ continue;
+@@ -1023,7 +1023,11 @@ int usb_get_bos_descriptor(struct usb_device *dev)
+ default:
+ break;
+ }
++
++ total_len -= length;
++ buffer += length;
+ }
++ dev->bos->desc->wTotalLength = cpu_to_le16(buffer - buffer0);
+
+ return 0;
+
+diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
+index b1cce989bd12..fe37dacc695f 100644
+--- a/drivers/usb/host/xhci-tegra.c
++++ b/drivers/usb/host/xhci-tegra.c
+@@ -1148,6 +1148,16 @@ static int tegra_xusb_probe(struct platform_device *pdev)
+
+ tegra_xusb_ipfs_config(tegra, regs);
+
++ /*
++ * The XUSB Falcon microcontroller can only address 40 bits, so set
++ * the DMA mask accordingly.
++ */
++ err = dma_set_mask_and_coherent(tegra->dev, DMA_BIT_MASK(40));
++ if (err < 0) {
++ dev_err(&pdev->dev, "failed to set DMA mask: %d\n", err);
++ goto put_rpm;
++ }
++
+ err = tegra_xusb_load_firmware(tegra);
+ if (err < 0) {
+ dev_err(&pdev->dev, "failed to load firmware: %d\n", err);
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index efae2fb0930a..9a47e4e5dea0 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1137,6 +1137,17 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ current->mm->start_stack = bprm->p;
+
+ if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
++ /*
++ * For architectures with ELF randomization, when executing
++ * a loader directly (i.e. no interpreter listed in ELF
++ * headers), move the brk area out of the mmap region
++ * (since it grows up, and may collide early with the stack
++ * growing down), and into the unused ELF_ET_DYN_BASE region.
++ */
++ if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && !interpreter)
++ current->mm->brk = current->mm->start_brk =
++ ELF_ET_DYN_BASE;
++
+ current->mm->brk = current->mm->start_brk =
+ arch_randomize_brk(current->mm);
+ #ifdef compat_brk_randomized
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 208430bb66fc..c290e231f918 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2756,6 +2756,7 @@ static int
+ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
+ {
+ int rc = 0;
++ int is_domain = 0;
+ const char *delim, *payload;
+ char *desc;
+ ssize_t len;
+@@ -2803,6 +2804,7 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
+ rc = PTR_ERR(key);
+ goto out_err;
+ }
++ is_domain = 1;
+ }
+
+ down_read(&key->sem);
+@@ -2860,6 +2862,26 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
+ goto out_key_put;
+ }
+
++ /*
++ * If we have a domain key then we must set the domainName in the
++ * for the request.
++ */
++ if (is_domain && ses->domainName) {
++ vol->domainname = kstrndup(ses->domainName,
++ strlen(ses->domainName),
++ GFP_KERNEL);
++ if (!vol->domainname) {
++ cifs_dbg(FYI, "Unable to allocate %zd bytes for "
++ "domain\n", len);
++ rc = -ENOMEM;
++ kfree(vol->username);
++ vol->username = NULL;
++ kzfree(vol->password);
++ vol->password = NULL;
++ goto out_key_put;
++ }
++ }
++
+ out_key_put:
+ up_read(&key->sem);
+ key_put(key);
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 71b2e390becf..b8d686087952 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -1486,7 +1486,7 @@ static int nfs_finish_open(struct nfs_open_context *ctx,
+ if (S_ISREG(file->f_path.dentry->d_inode->i_mode))
+ nfs_file_set_open_context(file, ctx);
+ else
+- err = -ESTALE;
++ err = -EOPENSTALE;
+ out:
+ return err;
+ }
+diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
+index 61abbb087ed1..75d3cf86f172 100644
+--- a/fs/nfs/nfs4file.c
++++ b/fs/nfs/nfs4file.c
+@@ -73,13 +73,13 @@ nfs4_file_open(struct inode *inode, struct file *filp)
+ if (IS_ERR(inode)) {
+ err = PTR_ERR(inode);
+ switch (err) {
+- case -EPERM:
+- case -EACCES:
+- case -EDQUOT:
+- case -ENOSPC:
+- case -EROFS:
+- goto out_put_ctx;
+ default:
++ goto out_put_ctx;
++ case -ENOENT:
++ case -ESTALE:
++ case -EISDIR:
++ case -ENOTDIR:
++ case -ELOOP:
+ goto out_drop;
+ }
+ }
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index d23ea74b5d20..9cf59e2622f8 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -567,7 +567,7 @@ static void nfs_pgio_rpcsetup(struct nfs_pgio_header *hdr,
+ }
+
+ hdr->res.fattr = &hdr->fattr;
+- hdr->res.count = count;
++ hdr->res.count = 0;
+ hdr->res.eof = 0;
+ hdr->res.verf = &hdr->verf;
+ nfs_fattr_init(&hdr->fattr);
+diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
+index e0c257bd62b9..0e0335e77ce6 100644
+--- a/fs/nfs/proc.c
++++ b/fs/nfs/proc.c
+@@ -594,7 +594,8 @@ static int nfs_read_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
+ /* Emulate the eof flag, which isn't normally needed in NFSv2
+ * as it is guaranteed to always return the file attributes
+ */
+- if (hdr->args.offset + hdr->res.count >= hdr->res.fattr->size)
++ if ((hdr->res.count == 0 && hdr->args.count > 0) ||
++ hdr->args.offset + hdr->res.count >= hdr->res.fattr->size)
+ hdr->res.eof = 1;
+ }
+ return 0;
+@@ -615,8 +616,10 @@ static int nfs_proc_pgio_rpc_prepare(struct rpc_task *task,
+
+ static int nfs_write_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
+ {
+- if (task->tk_status >= 0)
++ if (task->tk_status >= 0) {
++ hdr->res.count = hdr->args.count;
+ nfs_writeback_update_inode(hdr);
++ }
+ return 0;
+ }
+
+diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
+index 6ed1ace8f8b3..1a1adc697c55 100644
+--- a/fs/overlayfs/ovl_entry.h
++++ b/fs/overlayfs/ovl_entry.h
+@@ -69,6 +69,7 @@ struct ovl_fs {
+ bool workdir_locked;
+ /* Traps in ovl inode cache */
+ struct inode *upperdir_trap;
++ struct inode *workbasedir_trap;
+ struct inode *workdir_trap;
+ struct inode *indexdir_trap;
+ /* Inode numbers in all layers do not use the high xino_bits */
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 2d028c02621f..127df4a85c8a 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -217,6 +217,7 @@ static void ovl_free_fs(struct ovl_fs *ofs)
+ {
+ unsigned i;
+
++ iput(ofs->workbasedir_trap);
+ iput(ofs->indexdir_trap);
+ iput(ofs->workdir_trap);
+ iput(ofs->upperdir_trap);
+@@ -1007,6 +1008,25 @@ static int ovl_setup_trap(struct super_block *sb, struct dentry *dir,
+ return 0;
+ }
+
++/*
++ * Determine how we treat concurrent use of upperdir/workdir based on the
++ * index feature. This is papering over mount leaks of container runtimes,
++ * for example, an old overlay mount is leaked and now its upperdir is
++ * attempted to be used as a lower layer in a new overlay mount.
++ */
++static int ovl_report_in_use(struct ovl_fs *ofs, const char *name)
++{
++ if (ofs->config.index) {
++ pr_err("overlayfs: %s is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.\n",
++ name);
++ return -EBUSY;
++ } else {
++ pr_warn("overlayfs: %s is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.\n",
++ name);
++ return 0;
++ }
++}
++
+ static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs,
+ struct path *upperpath)
+ {
+@@ -1044,14 +1064,12 @@ static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs,
+ upper_mnt->mnt_flags &= ~(MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME);
+ ofs->upper_mnt = upper_mnt;
+
+- err = -EBUSY;
+ if (ovl_inuse_trylock(ofs->upper_mnt->mnt_root)) {
+ ofs->upperdir_locked = true;
+- } else if (ofs->config.index) {
+- pr_err("overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.\n");
+- goto out;
+ } else {
+- pr_warn("overlayfs: upperdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
++ err = ovl_report_in_use(ofs, "upperdir");
++ if (err)
++ goto out;
+ }
+
+ err = 0;
+@@ -1161,16 +1179,19 @@ static int ovl_get_workdir(struct super_block *sb, struct ovl_fs *ofs,
+
+ ofs->workbasedir = dget(workpath.dentry);
+
+- err = -EBUSY;
+ if (ovl_inuse_trylock(ofs->workbasedir)) {
+ ofs->workdir_locked = true;
+- } else if (ofs->config.index) {
+- pr_err("overlayfs: workdir is in-use by another mount, mount with '-o index=off' to override exclusive workdir protection.\n");
+- goto out;
+ } else {
+- pr_warn("overlayfs: workdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
++ err = ovl_report_in_use(ofs, "workdir");
++ if (err)
++ goto out;
+ }
+
++ err = ovl_setup_trap(sb, ofs->workbasedir, &ofs->workbasedir_trap,
++ "workdir");
++ if (err)
++ goto out;
++
+ err = ovl_make_workdir(sb, ofs, &workpath);
+
+ out:
+@@ -1289,16 +1310,16 @@ static int ovl_get_lower_layers(struct super_block *sb, struct ovl_fs *ofs,
+ if (err < 0)
+ goto out;
+
+- err = -EBUSY;
+- if (ovl_is_inuse(stack[i].dentry)) {
+- pr_err("overlayfs: lowerdir is in-use as upperdir/workdir\n");
+- goto out;
+- }
+-
+ err = ovl_setup_trap(sb, stack[i].dentry, &trap, "lowerdir");
+ if (err)
+ goto out;
+
++ if (ovl_is_inuse(stack[i].dentry)) {
++ err = ovl_report_in_use(ofs, "lowerdir");
++ if (err)
++ goto out;
++ }
++
+ mnt = clone_private_mount(&stack[i]);
+ err = PTR_ERR(mnt);
+ if (IS_ERR(mnt)) {
+@@ -1445,8 +1466,8 @@ out_err:
+ * - another layer of this overlayfs instance
+ * - upper/work dir of any overlayfs instance
+ */
+-static int ovl_check_layer(struct super_block *sb, struct dentry *dentry,
+- const char *name)
++static int ovl_check_layer(struct super_block *sb, struct ovl_fs *ofs,
++ struct dentry *dentry, const char *name)
+ {
+ struct dentry *next = dentry, *parent;
+ int err = 0;
+@@ -1458,13 +1479,11 @@ static int ovl_check_layer(struct super_block *sb, struct dentry *dentry,
+
+ /* Walk back ancestors to root (inclusive) looking for traps */
+ while (!err && parent != next) {
+- if (ovl_is_inuse(parent)) {
+- err = -EBUSY;
+- pr_err("overlayfs: %s path overlapping in-use upperdir/workdir\n",
+- name);
+- } else if (ovl_lookup_trap_inode(sb, parent)) {
++ if (ovl_lookup_trap_inode(sb, parent)) {
+ err = -ELOOP;
+ pr_err("overlayfs: overlapping %s path\n", name);
++ } else if (ovl_is_inuse(parent)) {
++ err = ovl_report_in_use(ofs, name);
+ }
+ next = parent;
+ parent = dget_parent(next);
+@@ -1485,7 +1504,8 @@ static int ovl_check_overlapping_layers(struct super_block *sb,
+ int i, err;
+
+ if (ofs->upper_mnt) {
+- err = ovl_check_layer(sb, ofs->upper_mnt->mnt_root, "upperdir");
++ err = ovl_check_layer(sb, ofs, ofs->upper_mnt->mnt_root,
++ "upperdir");
+ if (err)
+ return err;
+
+@@ -1496,13 +1516,14 @@ static int ovl_check_overlapping_layers(struct super_block *sb,
+ * workbasedir. In that case, we already have their traps in
+ * inode cache and we will catch that case on lookup.
+ */
+- err = ovl_check_layer(sb, ofs->workbasedir, "workdir");
++ err = ovl_check_layer(sb, ofs, ofs->workbasedir, "workdir");
+ if (err)
+ return err;
+ }
+
+ for (i = 0; i < ofs->numlower; i++) {
+- err = ovl_check_layer(sb, ofs->lower_layers[i].mnt->mnt_root,
++ err = ovl_check_layer(sb, ofs,
++ ofs->lower_layers[i].mnt->mnt_root,
+ "lowerdir");
+ if (err)
+ return err;
+diff --git a/include/net/sock_reuseport.h b/include/net/sock_reuseport.h
+index 8a5f70c7cdf2..5e69fba181bc 100644
+--- a/include/net/sock_reuseport.h
++++ b/include/net/sock_reuseport.h
+@@ -21,7 +21,8 @@ struct sock_reuseport {
+ unsigned int synq_overflow_ts;
+ /* ID stays the same even after the size of socks[] grows. */
+ unsigned int reuseport_id;
+- bool bind_inany;
++ unsigned int bind_inany:1;
++ unsigned int has_conns:1;
+ struct bpf_prog __rcu *prog; /* optional BPF sock selector */
+ struct sock *socks[0]; /* array of sock pointers */
+ };
+@@ -35,6 +36,24 @@ extern struct sock *reuseport_select_sock(struct sock *sk,
+ struct sk_buff *skb,
+ int hdr_len);
+ extern int reuseport_attach_prog(struct sock *sk, struct bpf_prog *prog);
++
++static inline bool reuseport_has_conns(struct sock *sk, bool set)
++{
++ struct sock_reuseport *reuse;
++ bool ret = false;
++
++ rcu_read_lock();
++ reuse = rcu_dereference(sk->sk_reuseport_cb);
++ if (reuse) {
++ if (set)
++ reuse->has_conns = 1;
++ ret = reuse->has_conns;
++ }
++ rcu_read_unlock();
++
++ return ret;
++}
++
+ int reuseport_get_id(struct sock_reuseport *reuse);
+
+ #endif /* _SOCK_REUSEPORT_H */
+diff --git a/include/uapi/linux/netfilter/xt_nfacct.h b/include/uapi/linux/netfilter/xt_nfacct.h
+index 5c8a4d760ee3..b5123ab8d54a 100644
+--- a/include/uapi/linux/netfilter/xt_nfacct.h
++++ b/include/uapi/linux/netfilter/xt_nfacct.h
+@@ -11,4 +11,9 @@ struct xt_nfacct_match_info {
+ struct nf_acct *nfacct;
+ };
+
++struct xt_nfacct_match_info_v1 {
++ char name[NFACCT_NAME_MAX];
++ struct nf_acct *nfacct __attribute__((aligned(8)));
++};
++
+ #endif /* _XT_NFACCT_MATCH_H */
+diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
+index 02a0b01380d8..ed87dac8378c 100644
+--- a/kernel/kallsyms.c
++++ b/kernel/kallsyms.c
+@@ -262,8 +262,10 @@ int kallsyms_lookup_size_offset(unsigned long addr, unsigned long *symbolsize,
+ {
+ char namebuf[KSYM_NAME_LEN];
+
+- if (is_ksym_addr(addr))
+- return !!get_symbol_pos(addr, symbolsize, offset);
++ if (is_ksym_addr(addr)) {
++ get_symbol_pos(addr, symbolsize, offset);
++ return 1;
++ }
+ return !!module_address_lookup(addr, symbolsize, offset, NULL, namebuf) ||
+ !!__bpf_address_lookup(addr, symbolsize, offset, namebuf);
+ }
+diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
+index 2948b41b06d4..d241ccc0ca02 100644
+--- a/net/batman-adv/bat_v_ogm.c
++++ b/net/batman-adv/bat_v_ogm.c
+@@ -643,17 +643,23 @@ batadv_v_ogm_process_per_outif(struct batadv_priv *bat_priv,
+ * batadv_v_ogm_aggr_packet() - checks if there is another OGM aggregated
+ * @buff_pos: current position in the skb
+ * @packet_len: total length of the skb
+- * @tvlv_len: tvlv length of the previously considered OGM
++ * @ogm2_packet: potential OGM2 in buffer
+ *
+ * Return: true if there is enough space for another OGM, false otherwise.
+ */
+-static bool batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
+- __be16 tvlv_len)
++static bool
++batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
++ const struct batadv_ogm2_packet *ogm2_packet)
+ {
+ int next_buff_pos = 0;
+
+- next_buff_pos += buff_pos + BATADV_OGM2_HLEN;
+- next_buff_pos += ntohs(tvlv_len);
++ /* check if there is enough space for the header */
++ next_buff_pos += buff_pos + sizeof(*ogm2_packet);
++ if (next_buff_pos > packet_len)
++ return false;
++
++ /* check if there is enough space for the optional TVLV */
++ next_buff_pos += ntohs(ogm2_packet->tvlv_len);
+
+ return (next_buff_pos <= packet_len) &&
+ (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
+@@ -830,7 +836,7 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb,
+ ogm_packet = (struct batadv_ogm2_packet *)skb->data;
+
+ while (batadv_v_ogm_aggr_packet(ogm_offset, skb_headlen(skb),
+- ogm_packet->tvlv_len)) {
++ ogm_packet)) {
+ batadv_v_ogm_process(skb, ogm_offset, if_incoming);
+
+ ogm_offset += BATADV_OGM2_HLEN;
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 62ffc989a44a..7d249afa1466 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -225,7 +225,7 @@ unsigned int ebt_do_table(struct sk_buff *skb,
+ return NF_DROP;
+ }
+
+- ADD_COUNTER(*(counter_base + i), 1, skb->len);
++ ADD_COUNTER(*(counter_base + i), skb->len, 1);
+
+ /* these should only watch: not modify, nor tell us
+ * what to do with the packet
+@@ -963,8 +963,8 @@ static void get_counters(const struct ebt_counter *oldcounters,
+ continue;
+ counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
+ for (i = 0; i < nentries; i++)
+- ADD_COUNTER(counters[i], counter_base[i].pcnt,
+- counter_base[i].bcnt);
++ ADD_COUNTER(counters[i], counter_base[i].bcnt,
++ counter_base[i].pcnt);
+ }
+ }
+
+@@ -1289,7 +1289,7 @@ static int do_update_counters(struct net *net, const char *name,
+
+ /* we add to the counters of the first cpu */
+ for (i = 0; i < num_counters; i++)
+- ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt);
++ ADD_COUNTER(t->private->counters[i], tmp[i].bcnt, tmp[i].pcnt);
+
+ write_unlock_bh(&t->lock);
+ ret = 0;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index c996380f2959..e6fa88506c00 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -7234,13 +7234,13 @@ sk_reuseport_is_valid_access(int off, int size,
+ return size == size_default;
+
+ /* Fields that allow narrowing */
+- case offsetof(struct sk_reuseport_md, eth_protocol):
++ case bpf_ctx_range(struct sk_reuseport_md, eth_protocol):
+ if (size < FIELD_SIZEOF(struct sk_buff, protocol))
+ return false;
+ /* fall through */
+- case offsetof(struct sk_reuseport_md, ip_protocol):
+- case offsetof(struct sk_reuseport_md, bind_inany):
+- case offsetof(struct sk_reuseport_md, len):
++ case bpf_ctx_range(struct sk_reuseport_md, ip_protocol):
++ case bpf_ctx_range(struct sk_reuseport_md, bind_inany):
++ case bpf_ctx_range(struct sk_reuseport_md, len):
+ bpf_ctx_record_field_size(info, size_default);
+ return bpf_ctx_narrow_access_ok(off, size, size_default);
+
+diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
+index ba5cba56f574..fd38cf1d2b02 100644
+--- a/net/core/sock_reuseport.c
++++ b/net/core/sock_reuseport.c
+@@ -292,8 +292,19 @@ struct sock *reuseport_select_sock(struct sock *sk,
+
+ select_by_hash:
+ /* no bpf or invalid bpf result: fall back to hash usage */
+- if (!sk2)
+- sk2 = reuse->socks[reciprocal_scale(hash, socks)];
++ if (!sk2) {
++ int i, j;
++
++ i = j = reciprocal_scale(hash, socks);
++ while (reuse->socks[i]->sk_state == TCP_ESTABLISHED) {
++ i++;
++ if (i >= reuse->num_socks)
++ i = 0;
++ if (i == j)
++ goto out;
++ }
++ sk2 = reuse->socks[i];
++ }
+ }
+
+ out:
+diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
+index f915abff1350..80107a6a2c4a 100644
+--- a/net/ipv4/datagram.c
++++ b/net/ipv4/datagram.c
+@@ -19,6 +19,7 @@
+ #include <net/sock.h>
+ #include <net/route.h>
+ #include <net/tcp_states.h>
++#include <net/sock_reuseport.h>
+
+ int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ {
+@@ -73,6 +74,7 @@ int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
+ }
+ inet->inet_daddr = fl4->daddr;
+ inet->inet_dport = usin->sin_port;
++ reuseport_has_conns(sk, true);
+ sk->sk_state = TCP_ESTABLISHED;
+ sk_set_txhash(sk);
+ inet->inet_id = jiffies;
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 6ab68b06fa39..2085fc0046de 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -443,12 +443,13 @@ static struct sock *udp4_lib_lookup2(struct net *net,
+ score = compute_score(sk, net, saddr, sport,
+ daddr, hnum, dif, sdif, exact_dif);
+ if (score > badness) {
+- if (sk->sk_reuseport) {
++ if (sk->sk_reuseport &&
++ sk->sk_state != TCP_ESTABLISHED) {
+ hash = udp_ehashfn(net, daddr, hnum,
+ saddr, sport);
+ result = reuseport_select_sock(sk, hash, skb,
+ sizeof(struct udphdr));
+- if (result)
++ if (result && !reuseport_has_conns(sk, false))
+ return result;
+ }
+ badness = score;
+diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
+index cb24850d2c7f..971a0fdf1fbc 100644
+--- a/net/ipv6/datagram.c
++++ b/net/ipv6/datagram.c
+@@ -31,6 +31,7 @@
+ #include <net/ip6_route.h>
+ #include <net/tcp_states.h>
+ #include <net/dsfield.h>
++#include <net/sock_reuseport.h>
+
+ #include <linux/errqueue.h>
+ #include <linux/uaccess.h>
+@@ -258,6 +259,7 @@ ipv4_connected:
+ goto out;
+ }
+
++ reuseport_has_conns(sk, true);
+ sk->sk_state = TCP_ESTABLISHED;
+ sk_set_txhash(sk);
+ out:
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index a53ef079a539..a23516e22056 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -988,7 +988,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ if (unlikely(!tun_info ||
+ !(tun_info->mode & IP_TUNNEL_INFO_TX) ||
+ ip_tunnel_info_af(tun_info) != AF_INET6))
+- return -EINVAL;
++ goto tx_err;
+
+ key = &tun_info->key;
+ memset(&fl6, 0, sizeof(fl6));
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 164f1d01273c..3a27c04ff62f 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -177,13 +177,14 @@ static struct sock *udp6_lib_lookup2(struct net *net,
+ score = compute_score(sk, net, saddr, sport,
+ daddr, hnum, dif, sdif, exact_dif);
+ if (score > badness) {
+- if (sk->sk_reuseport) {
++ if (sk->sk_reuseport &&
++ sk->sk_state != TCP_ESTABLISHED) {
+ hash = udp6_ehashfn(net, daddr, hnum,
+ saddr, sport);
+
+ result = reuseport_select_sock(sk, hash, skb,
+ sizeof(struct udphdr));
+- if (result)
++ if (result && !reuseport_has_conns(sk, false))
+ return result;
+ }
+ result = sk;
+diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
+index a11c304fb771..efc14c7b4f8e 100644
+--- a/net/netfilter/nf_conntrack_ftp.c
++++ b/net/netfilter/nf_conntrack_ftp.c
+@@ -323,7 +323,7 @@ static int find_pattern(const char *data, size_t dlen,
+ i++;
+ }
+
+- pr_debug("Skipped up to `%c'!\n", skip);
++ pr_debug("Skipped up to 0x%hhx delimiter!\n", skip);
+
+ *numoff = i;
+ *numlen = getnum(data + i, dlen - i, cmd, term, numoff);
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index 5df7486bb416..8ade40512944 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -203,7 +203,7 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
+ return err;
+ }
+
+- flow->timeout = (u32)jiffies;
++ flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(flow_offload_add);
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 69decbe2c988..1ef8cb789c41 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -149,6 +149,11 @@ static int nft_flow_offload_validate(const struct nft_ctx *ctx,
+ return nft_chain_validate_hooks(ctx->chain, hook_mask);
+ }
+
++static const struct nla_policy nft_flow_offload_policy[NFTA_FLOW_MAX + 1] = {
++ [NFTA_FLOW_TABLE_NAME] = { .type = NLA_STRING,
++ .len = NFT_NAME_MAXLEN - 1 },
++};
++
+ static int nft_flow_offload_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nlattr * const tb[])
+@@ -207,6 +212,7 @@ static const struct nft_expr_ops nft_flow_offload_ops = {
+ static struct nft_expr_type nft_flow_offload_type __read_mostly = {
+ .name = "flow_offload",
+ .ops = &nft_flow_offload_ops,
++ .policy = nft_flow_offload_policy,
+ .maxattr = NFTA_FLOW_MAX,
+ .owner = THIS_MODULE,
+ };
+diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
+index 6b56f4170860..3241fee9f2a1 100644
+--- a/net/netfilter/xt_nfacct.c
++++ b/net/netfilter/xt_nfacct.c
+@@ -57,25 +57,39 @@ nfacct_mt_destroy(const struct xt_mtdtor_param *par)
+ nfnl_acct_put(info->nfacct);
+ }
+
+-static struct xt_match nfacct_mt_reg __read_mostly = {
+- .name = "nfacct",
+- .family = NFPROTO_UNSPEC,
+- .checkentry = nfacct_mt_checkentry,
+- .match = nfacct_mt,
+- .destroy = nfacct_mt_destroy,
+- .matchsize = sizeof(struct xt_nfacct_match_info),
+- .usersize = offsetof(struct xt_nfacct_match_info, nfacct),
+- .me = THIS_MODULE,
++static struct xt_match nfacct_mt_reg[] __read_mostly = {
++ {
++ .name = "nfacct",
++ .revision = 0,
++ .family = NFPROTO_UNSPEC,
++ .checkentry = nfacct_mt_checkentry,
++ .match = nfacct_mt,
++ .destroy = nfacct_mt_destroy,
++ .matchsize = sizeof(struct xt_nfacct_match_info),
++ .usersize = offsetof(struct xt_nfacct_match_info, nfacct),
++ .me = THIS_MODULE,
++ },
++ {
++ .name = "nfacct",
++ .revision = 1,
++ .family = NFPROTO_UNSPEC,
++ .checkentry = nfacct_mt_checkentry,
++ .match = nfacct_mt,
++ .destroy = nfacct_mt_destroy,
++ .matchsize = sizeof(struct xt_nfacct_match_info_v1),
++ .usersize = offsetof(struct xt_nfacct_match_info_v1, nfacct),
++ .me = THIS_MODULE,
++ },
+ };
+
+ static int __init nfacct_mt_init(void)
+ {
+- return xt_register_match(&nfacct_mt_reg);
++ return xt_register_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
+ }
+
+ static void __exit nfacct_mt_exit(void)
+ {
+- xt_unregister_match(&nfacct_mt_reg);
++ xt_unregister_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
+ }
+
+ module_init(nfacct_mt_init);
+diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
+index 05f00fb20b04..cd15ea79e3e2 100644
+--- a/net/netfilter/xt_physdev.c
++++ b/net/netfilter/xt_physdev.c
+@@ -104,11 +104,9 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
+ if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) &&
+ (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
+ info->invert & XT_PHYSDEV_OP_BRIDGED) &&
+- par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
+- (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
++ par->hook_mask & (1 << NF_INET_LOCAL_OUT)) {
+ pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n");
+- if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
+- return -EINVAL;
++ return -EINVAL;
+ }
+
+ if (!brnf_probed) {
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 875f521bce0d..30e32df5f84a 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -947,9 +947,13 @@ void qdisc_free(struct Qdisc *qdisc)
+
+ void qdisc_destroy(struct Qdisc *qdisc)
+ {
+- const struct Qdisc_ops *ops = qdisc->ops;
++ const struct Qdisc_ops *ops;
+ struct sk_buff *skb, *tmp;
+
++ if (!qdisc)
++ return;
++ ops = qdisc->ops;
++
+ if (qdisc->flags & TCQ_F_BUILTIN ||
+ !refcount_dec_and_test(&qdisc->refcnt))
+ return;
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 2a85bff6a8f3..6168db3c35e4 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -10270,9 +10270,11 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
+ hyst = wdev->cqm_config->rssi_hyst;
+ n = wdev->cqm_config->n_rssi_thresholds;
+
+- for (i = 0; i < n; i++)
++ for (i = 0; i < n; i++) {
++ i = array_index_nospec(i, n);
+ if (last < wdev->cqm_config->rssi_thresholds[i])
+ break;
++ }
+
+ low_index = i - 1;
+ if (low_index >= 0) {
+diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
+index a3b037fbfecd..8cab91c482ff 100644
+--- a/net/xdp/xdp_umem.c
++++ b/net/xdp/xdp_umem.c
+@@ -322,7 +322,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
+ umem->pages = kcalloc(umem->npgs, sizeof(*umem->pages), GFP_KERNEL);
+ if (!umem->pages) {
+ err = -ENOMEM;
+- goto out_account;
++ goto out_pin;
+ }
+
+ for (i = 0; i < umem->npgs; i++)
+@@ -330,6 +330,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
+
+ return 0;
+
++out_pin:
++ xdp_umem_unpin_pages(umem);
+ out_account:
+ xdp_umem_unaccount_pages(umem);
+ return err;
+diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
+index 5e515791ccd1..1d34b2a5f485 100644
+--- a/security/keys/request_key_auth.c
++++ b/security/keys/request_key_auth.c
+@@ -71,6 +71,9 @@ static void request_key_auth_describe(const struct key *key,
+ {
+ struct request_key_auth *rka = get_request_key_auth(key);
+
++ if (!rka)
++ return;
++
+ seq_puts(m, "key:");
+ seq_puts(m, key->description);
+ if (key_is_positive(key))
+@@ -88,6 +91,9 @@ static long request_key_auth_read(const struct key *key,
+ size_t datalen;
+ long ret;
+
++ if (!rka)
++ return -EKEYREVOKED;
++
+ datalen = rka->callout_len;
+ ret = datalen;
+
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index bbba0d61570f..4f9611af4642 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -381,7 +381,9 @@ static int do_show(int argc, char **argv)
+ if (fd < 0)
+ return -1;
+
+- return show_prog(fd);
++ err = show_prog(fd);
++ close(fd);
++ return err;
+ }
+
+ if (argc)
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index fbb53c952b73..71cf7e77291a 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -4953,7 +4953,7 @@ int initialize_counters(int cpu_id)
+
+ void allocate_output_buffer()
+ {
+- output_buffer = calloc(1, (1 + topo.num_cpus) * 1024);
++ output_buffer = calloc(1, (1 + topo.num_cpus) * 2048);
+ outp = output_buffer;
+ if (outp == NULL)
+ err(-1, "calloc output buffer");
+diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+index 65bbe627a425..2aba622d1c5a 100644
+--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
++++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+@@ -546,7 +546,7 @@ void cmdline(int argc, char **argv)
+
+ progname = argv[0];
+
+- while ((opt = getopt_long_only(argc, argv, "+a:c:dD:E:e:f:m:M:rt:u:vw",
++ while ((opt = getopt_long_only(argc, argv, "+a:c:dD:E:e:f:m:M:rt:u:vw:",
+ long_options, &option_index)) != -1) {
+ switch (opt) {
+ case 'a':
+@@ -1260,6 +1260,15 @@ void probe_dev_msr(void)
+ if (system("/sbin/modprobe msr > /dev/null 2>&1"))
+ err(-5, "no /dev/cpu/0/msr, Try \"# modprobe msr\" ");
+ }
++
++static void get_cpuid_or_exit(unsigned int leaf,
++ unsigned int *eax, unsigned int *ebx,
++ unsigned int *ecx, unsigned int *edx)
++{
++ if (!__get_cpuid(leaf, eax, ebx, ecx, edx))
++ errx(1, "Processor not supported\n");
++}
++
+ /*
+ * early_cpuid()
+ * initialize turbo_is_enabled, has_hwp, has_epb
+@@ -1267,15 +1276,10 @@ void probe_dev_msr(void)
+ */
+ void early_cpuid(void)
+ {
+- unsigned int eax, ebx, ecx, edx, max_level;
++ unsigned int eax, ebx, ecx, edx;
+ unsigned int fms, family, model;
+
+- __get_cpuid(0, &max_level, &ebx, &ecx, &edx);
+-
+- if (max_level < 6)
+- errx(1, "Processor not supported\n");
+-
+- __get_cpuid(1, &fms, &ebx, &ecx, &edx);
++ get_cpuid_or_exit(1, &fms, &ebx, &ecx, &edx);
+ family = (fms >> 8) & 0xf;
+ model = (fms >> 4) & 0xf;
+ if (family == 6 || family == 0xf)
+@@ -1289,7 +1293,7 @@ void early_cpuid(void)
+ bdx_highest_ratio = msr & 0xFF;
+ }
+
+- __get_cpuid(0x6, &eax, &ebx, &ecx, &edx);
++ get_cpuid_or_exit(0x6, &eax, &ebx, &ecx, &edx);
+ turbo_is_enabled = (eax >> 1) & 1;
+ has_hwp = (eax >> 7) & 1;
+ has_epb = (ecx >> 3) & 1;
+@@ -1307,7 +1311,7 @@ void parse_cpuid(void)
+
+ eax = ebx = ecx = edx = 0;
+
+- __get_cpuid(0, &max_level, &ebx, &ecx, &edx);
++ get_cpuid_or_exit(0, &max_level, &ebx, &ecx, &edx);
+
+ if (ebx == 0x756e6547 && edx == 0x49656e69 && ecx == 0x6c65746e)
+ genuine_intel = 1;
+@@ -1316,7 +1320,7 @@ void parse_cpuid(void)
+ fprintf(stderr, "CPUID(0): %.4s%.4s%.4s ",
+ (char *)&ebx, (char *)&edx, (char *)&ecx);
+
+- __get_cpuid(1, &fms, &ebx, &ecx, &edx);
++ get_cpuid_or_exit(1, &fms, &ebx, &ecx, &edx);
+ family = (fms >> 8) & 0xf;
+ model = (fms >> 4) & 0xf;
+ stepping = fms & 0xf;
+@@ -1341,7 +1345,7 @@ void parse_cpuid(void)
+ errx(1, "CPUID: no MSR");
+
+
+- __get_cpuid(0x6, &eax, &ebx, &ecx, &edx);
++ get_cpuid_or_exit(0x6, &eax, &ebx, &ecx, &edx);
+ /* turbo_is_enabled already set */
+ /* has_hwp already set */
+ has_hwp_notify = eax & (1 << 8);
+diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
+index b8ebe2f58074..e9567122070a 100644
+--- a/tools/testing/selftests/bpf/test_sock.c
++++ b/tools/testing/selftests/bpf/test_sock.c
+@@ -13,6 +13,7 @@
+ #include <bpf/bpf.h>
+
+ #include "cgroup_helpers.h"
++#include "bpf_endian.h"
+ #include "bpf_rlimit.h"
+ #include "bpf_util.h"
+
+@@ -231,7 +232,8 @@ static struct sock_test tests[] = {
+ /* if (ip == expected && port == expected) */
+ BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+ offsetof(struct bpf_sock, src_ip6[3])),
+- BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x01000000, 4),
++ BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
++ __bpf_constant_ntohl(0x00000001), 4),
+ BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+ offsetof(struct bpf_sock, src_port)),
+ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x2001, 2),
+@@ -260,7 +262,8 @@ static struct sock_test tests[] = {
+ /* if (ip == expected && port == expected) */
+ BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+ offsetof(struct bpf_sock, src_ip4)),
+- BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x0100007F, 4),
++ BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
++ __bpf_constant_ntohl(0x7F000001), 4),
+ BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
+ offsetof(struct bpf_sock, src_port)),
+ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),
+diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
+index 9e65feb6fa58..b9336693c87e 100644
+--- a/virt/kvm/coalesced_mmio.c
++++ b/virt/kvm/coalesced_mmio.c
+@@ -40,7 +40,7 @@ static int coalesced_mmio_in_range(struct kvm_coalesced_mmio_dev *dev,
+ return 1;
+ }
+
+-static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev)
++static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev, u32 last)
+ {
+ struct kvm_coalesced_mmio_ring *ring;
+ unsigned avail;
+@@ -52,7 +52,7 @@ static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev)
+ * there is always one unused entry in the buffer
+ */
+ ring = dev->kvm->coalesced_mmio_ring;
+- avail = (ring->first - ring->last - 1) % KVM_COALESCED_MMIO_MAX;
++ avail = (ring->first - last - 1) % KVM_COALESCED_MMIO_MAX;
+ if (avail == 0) {
+ /* full */
+ return 0;
+@@ -67,24 +67,27 @@ static int coalesced_mmio_write(struct kvm_vcpu *vcpu,
+ {
+ struct kvm_coalesced_mmio_dev *dev = to_mmio(this);
+ struct kvm_coalesced_mmio_ring *ring = dev->kvm->coalesced_mmio_ring;
++ __u32 insert;
+
+ if (!coalesced_mmio_in_range(dev, addr, len))
+ return -EOPNOTSUPP;
+
+ spin_lock(&dev->kvm->ring_lock);
+
+- if (!coalesced_mmio_has_room(dev)) {
++ insert = READ_ONCE(ring->last);
++ if (!coalesced_mmio_has_room(dev, insert) ||
++ insert >= KVM_COALESCED_MMIO_MAX) {
+ spin_unlock(&dev->kvm->ring_lock);
+ return -EOPNOTSUPP;
+ }
+
+ /* copy data in first free entry of the ring */
+
+- ring->coalesced_mmio[ring->last].phys_addr = addr;
+- ring->coalesced_mmio[ring->last].len = len;
+- memcpy(ring->coalesced_mmio[ring->last].data, val, len);
++ ring->coalesced_mmio[insert].phys_addr = addr;
++ ring->coalesced_mmio[insert].len = len;
++ memcpy(ring->coalesced_mmio[insert].data, val, len);
+ smp_wmb();
+- ring->last = (ring->last + 1) % KVM_COALESCED_MMIO_MAX;
++ ring->last = (insert + 1) % KVM_COALESCED_MMIO_MAX;
+ spin_unlock(&dev->kvm->ring_lock);
+ return 0;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-10-01 10:10 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-10-01 10:10 UTC (permalink / raw
To: gentoo-commits
commit: 393593668bea9feb99e59b8b931d8bd663b5ef29
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 1 10:10:20 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Oct 1 10:10:20 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=39359366
Linux patch 4.19.76
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1075_linux-4.19.76.patch | 2525 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2529 insertions(+)
diff --git a/0000_README b/0000_README
index 050c323..871922b 100644
--- a/0000_README
+++ b/0000_README
@@ -339,6 +339,10 @@ Patch: 1074_linux-4.19.75.patch
From: https://www.kernel.org
Desc: Linux 4.19.75
+Patch: 1075_linux-4.19.76.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.76
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1075_linux-4.19.76.patch b/1075_linux-4.19.76.patch
new file mode 100644
index 0000000..5f0f12f
--- /dev/null
+++ b/1075_linux-4.19.76.patch
@@ -0,0 +1,2525 @@
+diff --git a/Makefile b/Makefile
+index 4bf6f24916bf..9cb471a75a1b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 75
++SUBLEVEL = 76
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h
+index ff3866473afe..d8d886dee54e 100644
+--- a/arch/powerpc/include/asm/opal.h
++++ b/arch/powerpc/include/asm/opal.h
+@@ -275,7 +275,7 @@ int64_t opal_xive_get_vp_info(uint64_t vp,
+ int64_t opal_xive_set_vp_info(uint64_t vp,
+ uint64_t flags,
+ uint64_t report_cl_pair);
+-int64_t opal_xive_allocate_irq(uint32_t chip_id);
++int64_t opal_xive_allocate_irq_raw(uint32_t chip_id);
+ int64_t opal_xive_free_irq(uint32_t girq);
+ int64_t opal_xive_sync(uint32_t type, uint32_t id);
+ int64_t opal_xive_dump(uint32_t type, uint32_t id);
+diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
+index f4875fe3f8ff..74215ebda142 100644
+--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
++++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
+@@ -303,7 +303,7 @@ OPAL_CALL(opal_xive_set_queue_info, OPAL_XIVE_SET_QUEUE_INFO);
+ OPAL_CALL(opal_xive_donate_page, OPAL_XIVE_DONATE_PAGE);
+ OPAL_CALL(opal_xive_alloc_vp_block, OPAL_XIVE_ALLOCATE_VP_BLOCK);
+ OPAL_CALL(opal_xive_free_vp_block, OPAL_XIVE_FREE_VP_BLOCK);
+-OPAL_CALL(opal_xive_allocate_irq, OPAL_XIVE_ALLOCATE_IRQ);
++OPAL_CALL(opal_xive_allocate_irq_raw, OPAL_XIVE_ALLOCATE_IRQ);
+ OPAL_CALL(opal_xive_free_irq, OPAL_XIVE_FREE_IRQ);
+ OPAL_CALL(opal_xive_get_vp_info, OPAL_XIVE_GET_VP_INFO);
+ OPAL_CALL(opal_xive_set_vp_info, OPAL_XIVE_SET_VP_INFO);
+diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
+index 5b20a678d755..6d5b28022452 100644
+--- a/arch/powerpc/sysdev/xive/native.c
++++ b/arch/powerpc/sysdev/xive/native.c
+@@ -235,6 +235,17 @@ static bool xive_native_match(struct device_node *node)
+ return of_device_is_compatible(node, "ibm,opal-xive-vc");
+ }
+
++static s64 opal_xive_allocate_irq(u32 chip_id)
++{
++ s64 irq = opal_xive_allocate_irq_raw(chip_id);
++
++ /*
++ * Old versions of skiboot can incorrectly return 0xffffffff to
++ * indicate no space, fix it up here.
++ */
++ return irq == 0xffffffff ? OPAL_RESOURCE : irq;
++}
++
+ #ifdef CONFIG_SMP
+ static int xive_native_get_ipi(unsigned int cpu, struct xive_cpu *xc)
+ {
+diff --git a/block/blk-core.c b/block/blk-core.c
+index af635f878f96..074ae9376189 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -1165,7 +1165,7 @@ int blk_init_allocated_queue(struct request_queue *q)
+ {
+ WARN_ON_ONCE(q->mq_ops);
+
+- q->fq = blk_alloc_flush_queue(q, NUMA_NO_NODE, q->cmd_size);
++ q->fq = blk_alloc_flush_queue(q, NUMA_NO_NODE, q->cmd_size, GFP_KERNEL);
+ if (!q->fq)
+ return -ENOMEM;
+
+diff --git a/block/blk-flush.c b/block/blk-flush.c
+index 76487948a27f..87fc49daa2b4 100644
+--- a/block/blk-flush.c
++++ b/block/blk-flush.c
+@@ -566,12 +566,12 @@ int blkdev_issue_flush(struct block_device *bdev, gfp_t gfp_mask,
+ EXPORT_SYMBOL(blkdev_issue_flush);
+
+ struct blk_flush_queue *blk_alloc_flush_queue(struct request_queue *q,
+- int node, int cmd_size)
++ int node, int cmd_size, gfp_t flags)
+ {
+ struct blk_flush_queue *fq;
+ int rq_sz = sizeof(struct request);
+
+- fq = kzalloc_node(sizeof(*fq), GFP_KERNEL, node);
++ fq = kzalloc_node(sizeof(*fq), flags, node);
+ if (!fq)
+ goto fail;
+
+@@ -579,7 +579,7 @@ struct blk_flush_queue *blk_alloc_flush_queue(struct request_queue *q,
+ spin_lock_init(&fq->mq_flush_lock);
+
+ rq_sz = round_up(rq_sz + cmd_size, cache_line_size());
+- fq->flush_rq = kzalloc_node(rq_sz, GFP_KERNEL, node);
++ fq->flush_rq = kzalloc_node(rq_sz, flags, node);
+ if (!fq->flush_rq)
+ goto fail_rq;
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 455fda99255a..7ea85ec52026 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2198,12 +2198,12 @@ static int blk_mq_init_hctx(struct request_queue *q,
+ * runtime
+ */
+ hctx->ctxs = kmalloc_array_node(nr_cpu_ids, sizeof(void *),
+- GFP_KERNEL, node);
++ GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY, node);
+ if (!hctx->ctxs)
+ goto unregister_cpu_notifier;
+
+- if (sbitmap_init_node(&hctx->ctx_map, nr_cpu_ids, ilog2(8), GFP_KERNEL,
+- node))
++ if (sbitmap_init_node(&hctx->ctx_map, nr_cpu_ids, ilog2(8),
++ GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY, node))
+ goto free_ctxs;
+
+ hctx->nr_ctx = 0;
+@@ -2216,7 +2216,8 @@ static int blk_mq_init_hctx(struct request_queue *q,
+ set->ops->init_hctx(hctx, set->driver_data, hctx_idx))
+ goto free_bitmap;
+
+- hctx->fq = blk_alloc_flush_queue(q, hctx->numa_node, set->cmd_size);
++ hctx->fq = blk_alloc_flush_queue(q, hctx->numa_node, set->cmd_size,
++ GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY);
+ if (!hctx->fq)
+ goto exit_hctx;
+
+@@ -2460,8 +2461,6 @@ void blk_mq_release(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ unsigned int i;
+
+- cancel_delayed_work_sync(&q->requeue_work);
+-
+ /* hctx kobj stays in hctx */
+ queue_for_each_hw_ctx(q, hctx, i) {
+ if (!hctx)
+@@ -2530,12 +2529,14 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
+
+ node = blk_mq_hw_queue_to_node(q->mq_map, i);
+ hctxs[i] = kzalloc_node(blk_mq_hw_ctx_size(set),
+- GFP_KERNEL, node);
++ GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY,
++ node);
+ if (!hctxs[i])
+ break;
+
+- if (!zalloc_cpumask_var_node(&hctxs[i]->cpumask, GFP_KERNEL,
+- node)) {
++ if (!zalloc_cpumask_var_node(&hctxs[i]->cpumask,
++ GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY,
++ node)) {
+ kfree(hctxs[i]);
+ hctxs[i] = NULL;
+ break;
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 3772671cf2bc..bab47a17b96f 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -836,6 +836,9 @@ static void __blk_release_queue(struct work_struct *work)
+
+ blk_free_queue_stats(q->stats);
+
++ if (q->mq_ops)
++ cancel_delayed_work_sync(&q->requeue_work);
++
+ blk_exit_rl(q, &q->root_rl);
+
+ if (q->queue_tags)
+diff --git a/block/blk.h b/block/blk.h
+index 977d4b5d968d..11e4ca2f2cd4 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -124,7 +124,7 @@ static inline void __blk_get_queue(struct request_queue *q)
+ }
+
+ struct blk_flush_queue *blk_alloc_flush_queue(struct request_queue *q,
+- int node, int cmd_size);
++ int node, int cmd_size, gfp_t flags);
+ void blk_free_flush_queue(struct blk_flush_queue *q);
+
+ int blk_init_rl(struct request_list *rl, struct request_queue *q,
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index d73afb562ad9..1a23e7aa74df 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -73,6 +73,12 @@ module_param(report_key_events, int, 0644);
+ MODULE_PARM_DESC(report_key_events,
+ "0: none, 1: output changes, 2: brightness changes, 3: all");
+
++static int hw_changes_brightness = -1;
++module_param(hw_changes_brightness, int, 0644);
++MODULE_PARM_DESC(hw_changes_brightness,
++ "Set this to 1 on buggy hw which changes the brightness itself when "
++ "a hotkey is pressed: -1: auto, 0: normal 1: hw-changes-brightness");
++
+ /*
+ * Whether the struct acpi_video_device_attrib::device_id_scheme bit should be
+ * assumed even if not actually set.
+@@ -418,6 +424,14 @@ static int video_set_report_key_events(const struct dmi_system_id *id)
+ return 0;
+ }
+
++static int video_hw_changes_brightness(
++ const struct dmi_system_id *d)
++{
++ if (hw_changes_brightness == -1)
++ hw_changes_brightness = 1;
++ return 0;
++}
++
+ static const struct dmi_system_id video_dmi_table[] = {
+ /*
+ * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
+@@ -542,6 +556,21 @@ static const struct dmi_system_id video_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V131"),
+ },
+ },
++ /*
++ * Some machines change the brightness themselves when a brightness
++ * hotkey gets pressed, despite us telling them not to. In this case
++ * acpi_video_device_notify() should only call backlight_force_update(
++ * BACKLIGHT_UPDATE_HOTKEY) and not do anything else.
++ */
++ {
++ /* https://bugzilla.kernel.org/show_bug.cgi?id=204077 */
++ .callback = video_hw_changes_brightness,
++ .ident = "Packard Bell EasyNote MZ35",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Packard Bell"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "EasyNote MZ35"),
++ },
++ },
+ {}
+ };
+
+@@ -1625,6 +1654,14 @@ static void acpi_video_device_notify(acpi_handle handle, u32 event, void *data)
+ bus = video_device->video;
+ input = bus->input;
+
++ if (hw_changes_brightness > 0) {
++ if (video_device->backlight)
++ backlight_force_update(video_device->backlight,
++ BACKLIGHT_UPDATE_HOTKEY);
++ acpi_notifier_call_chain(device, event, 0);
++ return;
++ }
++
+ switch (event) {
+ case ACPI_VIDEO_NOTIFY_CYCLE_BRIGHTNESS: /* Cycle brightness */
+ brightness_switch_event(video_device, event);
+diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
+index 1342f8e6025c..8d1cd2479e36 100644
+--- a/drivers/bluetooth/btrtl.c
++++ b/drivers/bluetooth/btrtl.c
+@@ -639,6 +639,26 @@ int btrtl_setup_realtek(struct hci_dev *hdev)
+ }
+ EXPORT_SYMBOL_GPL(btrtl_setup_realtek);
+
++int btrtl_shutdown_realtek(struct hci_dev *hdev)
++{
++ struct sk_buff *skb;
++ int ret;
++
++ /* According to the vendor driver, BT must be reset on close to avoid
++ * firmware crash.
++ */
++ skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
++ if (IS_ERR(skb)) {
++ ret = PTR_ERR(skb);
++ bt_dev_err(hdev, "HCI reset during shutdown failed");
++ return ret;
++ }
++ kfree_skb(skb);
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(btrtl_shutdown_realtek);
++
+ static unsigned int btrtl_convert_baudrate(u32 device_baudrate)
+ {
+ switch (device_baudrate) {
+diff --git a/drivers/bluetooth/btrtl.h b/drivers/bluetooth/btrtl.h
+index f5e36f3993a8..852f27d4ee28 100644
+--- a/drivers/bluetooth/btrtl.h
++++ b/drivers/bluetooth/btrtl.h
+@@ -65,6 +65,7 @@ void btrtl_free(struct btrtl_device_info *btrtl_dev);
+ int btrtl_download_firmware(struct hci_dev *hdev,
+ struct btrtl_device_info *btrtl_dev);
+ int btrtl_setup_realtek(struct hci_dev *hdev);
++int btrtl_shutdown_realtek(struct hci_dev *hdev);
+ int btrtl_get_uart_settings(struct hci_dev *hdev,
+ struct btrtl_device_info *btrtl_dev,
+ unsigned int *controller_baudrate,
+@@ -93,6 +94,11 @@ static inline int btrtl_setup_realtek(struct hci_dev *hdev)
+ return -EOPNOTSUPP;
+ }
+
++static inline int btrtl_shutdown_realtek(struct hci_dev *hdev)
++{
++ return -EOPNOTSUPP;
++}
++
+ static inline int btrtl_get_uart_settings(struct hci_dev *hdev,
+ struct btrtl_device_info *btrtl_dev,
+ unsigned int *controller_baudrate,
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 09c83dc2ef67..08936bf696d3 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -391,6 +391,9 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
+
++ /* Additional Realtek 8822CE Bluetooth devices */
++ { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK },
++
+ /* Silicon Wave based devices */
+ { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
+
+@@ -3128,6 +3131,7 @@ static int btusb_probe(struct usb_interface *intf,
+ #ifdef CONFIG_BT_HCIBTUSB_RTL
+ if (id->driver_info & BTUSB_REALTEK) {
+ hdev->setup = btrtl_setup_realtek;
++ hdev->shutdown = btrtl_shutdown_realtek;
+
+ /* Realtek devices lose their updated firmware over suspend,
+ * but the USB hub doesn't notice any status change.
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 064315edd289..634ae487c372 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -3124,6 +3124,7 @@ static int talitos_remove(struct platform_device *ofdev)
+ break;
+ case CRYPTO_ALG_TYPE_AEAD:
+ crypto_unregister_aead(&t_alg->algt.alg.aead);
++ break;
+ case CRYPTO_ALG_TYPE_AHASH:
+ crypto_unregister_ahash(&t_alg->algt.alg.hash);
+ break;
+diff --git a/drivers/gpu/drm/amd/display/dc/calcs/Makefile b/drivers/gpu/drm/amd/display/dc/calcs/Makefile
+index 95f332ee3e7e..16614d73a5fc 100644
+--- a/drivers/gpu/drm/amd/display/dc/calcs/Makefile
++++ b/drivers/gpu/drm/amd/display/dc/calcs/Makefile
+@@ -32,6 +32,10 @@ endif
+
+ calcs_ccflags := -mhard-float -msse $(cc_stack_align)
+
++ifdef CONFIG_CC_IS_CLANG
++calcs_ccflags += -msse2
++endif
++
+ CFLAGS_dcn_calcs.o := $(calcs_ccflags)
+ CFLAGS_dcn_calc_auto.o := $(calcs_ccflags)
+ CFLAGS_dcn_calc_math.o := $(calcs_ccflags) -Wno-tautological-compare
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/Makefile b/drivers/gpu/drm/amd/display/dc/dml/Makefile
+index d97ca6528f9d..934ffe1b4b00 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/Makefile
++++ b/drivers/gpu/drm/amd/display/dc/dml/Makefile
+@@ -32,6 +32,10 @@ endif
+
+ dml_ccflags := -mhard-float -msse $(cc_stack_align)
+
++ifdef CONFIG_CC_IS_CLANG
++dml_ccflags += -msse2
++endif
++
+ CFLAGS_display_mode_lib.o := $(dml_ccflags)
+ CFLAGS_display_pipe_clocks.o := $(dml_ccflags)
+ CFLAGS_dml1_display_rq_dlg_calc.o := $(dml_ccflags)
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+index c9a15baf2c10..0adfc5392cd3 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+@@ -1222,17 +1222,14 @@ static int smu8_dpm_force_dpm_level(struct pp_hwmgr *hwmgr,
+
+ static int smu8_dpm_powerdown_uvd(struct pp_hwmgr *hwmgr)
+ {
+- if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) {
+- smu8_nbdpm_pstate_enable_disable(hwmgr, true, true);
++ if (PP_CAP(PHM_PlatformCaps_UVDPowerGating))
+ return smum_send_msg_to_smc(hwmgr, PPSMC_MSG_UVDPowerOFF);
+- }
+ return 0;
+ }
+
+ static int smu8_dpm_powerup_uvd(struct pp_hwmgr *hwmgr)
+ {
+ if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) {
+- smu8_nbdpm_pstate_enable_disable(hwmgr, false, true);
+ return smum_send_msg_to_smc_with_parameter(
+ hwmgr,
+ PPSMC_MSG_UVDPowerON,
+diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
+index d18b7e27ef64..c0b26135dbd5 100644
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -581,6 +581,9 @@ static void output_poll_execute(struct work_struct *work)
+ enum drm_connector_status old_status;
+ bool repoll = false, changed;
+
++ if (!dev->mode_config.poll_enabled)
++ return;
++
+ /* Pick up any changes detected by the probe functions. */
+ changed = dev->mode_config.delayed_event;
+ dev->mode_config.delayed_event = false;
+@@ -735,7 +738,11 @@ EXPORT_SYMBOL(drm_kms_helper_poll_init);
+ */
+ void drm_kms_helper_poll_fini(struct drm_device *dev)
+ {
+- drm_kms_helper_poll_disable(dev);
++ if (!dev->mode_config.poll_enabled)
++ return;
++
++ dev->mode_config.poll_enabled = false;
++ cancel_delayed_work_sync(&dev->mode_config.output_poll_work);
+ }
+ EXPORT_SYMBOL(drm_kms_helper_poll_fini);
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/head.c b/drivers/gpu/drm/nouveau/dispnv50/head.c
+index d81a99bb2ac3..b041ffb3af27 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/head.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/head.c
+@@ -169,14 +169,34 @@ nv50_head_atomic_check_view(struct nv50_head_atom *armh,
+ */
+ switch (mode) {
+ case DRM_MODE_SCALE_CENTER:
+- asyh->view.oW = min((u16)umode->hdisplay, asyh->view.oW);
+- asyh->view.oH = min((u16)umode_vdisplay, asyh->view.oH);
+- /* fall-through */
++ /* NOTE: This will cause scaling when the input is
++ * larger than the output.
++ */
++ asyh->view.oW = min(asyh->view.iW, asyh->view.oW);
++ asyh->view.oH = min(asyh->view.iH, asyh->view.oH);
++ break;
+ case DRM_MODE_SCALE_ASPECT:
+- if (asyh->view.oH < asyh->view.oW) {
++ /* Determine whether the scaling should be on width or on
++ * height. This is done by comparing the aspect ratios of the
++ * sizes. If the output AR is larger than input AR, that means
++ * we want to change the width (letterboxed on the
++ * left/right), otherwise on the height (letterboxed on the
++ * top/bottom).
++ *
++ * E.g. 4:3 (1.333) AR image displayed on a 16:10 (1.6) AR
++ * screen will have letterboxes on the left/right. However a
++ * 16:9 (1.777) AR image on that same screen will have
++ * letterboxes on the top/bottom.
++ *
++ * inputAR = iW / iH; outputAR = oW / oH
++ * outputAR > inputAR is equivalent to oW * iH > iW * oH
++ */
++ if (asyh->view.oW * asyh->view.iH > asyh->view.iW * asyh->view.oH) {
++ /* Recompute output width, i.e. left/right letterbox */
+ u32 r = (asyh->view.iW << 19) / asyh->view.iH;
+ asyh->view.oW = ((asyh->view.oH * r) + (r / 2)) >> 19;
+ } else {
++ /* Recompute output height, i.e. top/bottom letterbox */
+ u32 r = (asyh->view.iH << 19) / asyh->view.iW;
+ asyh->view.oH = ((asyh->view.oW * r) + (r / 2)) >> 19;
+ }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 4a2fa57ddcb8..0eeb273fb73d 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -559,6 +559,7 @@
+ #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A 0x094a
++#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941 0x0941
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641 0x0641
+
+ #define USB_VENDOR_ID_HUION 0x256c
+diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
+index 596227ddb6e0..17d6123f7930 100644
+--- a/drivers/hid/hid-lg.c
++++ b/drivers/hid/hid-lg.c
+@@ -763,7 +763,7 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
+
+ if (!buf) {
+ ret = -ENOMEM;
+- goto err_free;
++ goto err_stop;
+ }
+
+ ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(cbuf),
+@@ -795,9 +795,12 @@ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ ret = lg4ff_init(hdev);
+
+ if (ret)
+- goto err_free;
++ goto err_stop;
+
+ return 0;
++
++err_stop:
++ hid_hw_stop(hdev);
+ err_free:
+ kfree(drv_data);
+ return ret;
+@@ -808,8 +811,7 @@ static void lg_remove(struct hid_device *hdev)
+ struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
+ if (drv_data->quirks & LG_FF4)
+ lg4ff_deinit(hdev);
+- else
+- hid_hw_stop(hdev);
++ hid_hw_stop(hdev);
+ kfree(drv_data);
+ }
+
+diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
+index 512d67e1aae3..4b26928cb2b6 100644
+--- a/drivers/hid/hid-lg4ff.c
++++ b/drivers/hid/hid-lg4ff.c
+@@ -1483,7 +1483,6 @@ int lg4ff_deinit(struct hid_device *hid)
+ }
+ }
+ #endif
+- hid_hw_stop(hid);
+ drv_data->device_props = NULL;
+
+ kfree(entry);
+diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c
+index 87eda34ea2f8..d3773251b374 100644
+--- a/drivers/hid/hid-prodikeys.c
++++ b/drivers/hid/hid-prodikeys.c
+@@ -555,10 +555,14 @@ static void pcmidi_setup_extra_keys(
+
+ static int pcmidi_set_operational(struct pcmidi_snd *pm)
+ {
++ int rc;
++
+ if (pm->ifnum != 1)
+ return 0; /* only set up ONCE for interace 1 */
+
+- pcmidi_get_output_report(pm);
++ rc = pcmidi_get_output_report(pm);
++ if (rc < 0)
++ return rc;
+ pcmidi_submit_output_report(pm, 0xc1);
+ return 0;
+ }
+@@ -687,7 +691,11 @@ static int pcmidi_snd_initialise(struct pcmidi_snd *pm)
+ spin_lock_init(&pm->rawmidi_in_lock);
+
+ init_sustain_timers(pm);
+- pcmidi_set_operational(pm);
++ err = pcmidi_set_operational(pm);
++ if (err < 0) {
++ pk_error("failed to find output report\n");
++ goto fail_register;
++ }
+
+ /* register it */
+ err = snd_card_register(card);
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index e553f6fae7a4..a407fd2399ff 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -94,6 +94,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL },
++ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI), HID_QUIRK_MULTI_INPUT },
+diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
+index 31f1023214d3..09f2c617b09f 100644
+--- a/drivers/hid/hid-sony.c
++++ b/drivers/hid/hid-sony.c
+@@ -2806,7 +2806,6 @@ err_stop:
+ sony_cancel_work_sync(sc);
+ sony_remove_dev_list(sc);
+ sony_release_device_id(sc);
+- hid_hw_stop(hdev);
+ return ret;
+ }
+
+@@ -2868,6 +2867,7 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ */
+ if (!(hdev->claimed & HID_CLAIMED_INPUT)) {
+ hid_err(hdev, "failed to claim input\n");
++ hid_hw_stop(hdev);
+ return -ENODEV;
+ }
+
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index 4a44e48e08b2..c7cff929b419 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -378,7 +378,7 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
+
+ mutex_lock(&minors_lock);
+ dev = hidraw_table[minor];
+- if (!dev) {
++ if (!dev || !dev->exist) {
+ ret = -ENODEV;
+ goto out;
+ }
+diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
+index af5ad6a56ae4..9271f7290005 100644
+--- a/drivers/infiniband/core/cq.c
++++ b/drivers/infiniband/core/cq.c
+@@ -112,12 +112,12 @@ static void ib_cq_poll_work(struct work_struct *work)
+ IB_POLL_BATCH);
+ if (completed >= IB_POLL_BUDGET_WORKQUEUE ||
+ ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0)
+- queue_work(ib_comp_wq, &cq->work);
++ queue_work(cq->comp_wq, &cq->work);
+ }
+
+ static void ib_cq_completion_workqueue(struct ib_cq *cq, void *private)
+ {
+- queue_work(ib_comp_wq, &cq->work);
++ queue_work(cq->comp_wq, &cq->work);
+ }
+
+ /**
+@@ -175,9 +175,12 @@ struct ib_cq *__ib_alloc_cq(struct ib_device *dev, void *private,
+ ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
+ break;
+ case IB_POLL_WORKQUEUE:
++ case IB_POLL_UNBOUND_WORKQUEUE:
+ cq->comp_handler = ib_cq_completion_workqueue;
+ INIT_WORK(&cq->work, ib_cq_poll_work);
+ ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
++ cq->comp_wq = (cq->poll_ctx == IB_POLL_WORKQUEUE) ?
++ ib_comp_wq : ib_comp_unbound_wq;
+ break;
+ default:
+ ret = -EINVAL;
+@@ -213,6 +216,7 @@ void ib_free_cq(struct ib_cq *cq)
+ irq_poll_disable(&cq->iop);
+ break;
+ case IB_POLL_WORKQUEUE:
++ case IB_POLL_UNBOUND_WORKQUEUE:
+ cancel_work_sync(&cq->work);
+ break;
+ default:
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index db3b6271f09d..6d8ac51a39cc 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -61,6 +61,7 @@ struct ib_client_data {
+ };
+
+ struct workqueue_struct *ib_comp_wq;
++struct workqueue_struct *ib_comp_unbound_wq;
+ struct workqueue_struct *ib_wq;
+ EXPORT_SYMBOL_GPL(ib_wq);
+
+@@ -1166,10 +1167,19 @@ static int __init ib_core_init(void)
+ goto err;
+ }
+
++ ib_comp_unbound_wq =
++ alloc_workqueue("ib-comp-unb-wq",
++ WQ_UNBOUND | WQ_HIGHPRI | WQ_MEM_RECLAIM |
++ WQ_SYSFS, WQ_UNBOUND_MAX_ACTIVE);
++ if (!ib_comp_unbound_wq) {
++ ret = -ENOMEM;
++ goto err_comp;
++ }
++
+ ret = class_register(&ib_class);
+ if (ret) {
+ pr_warn("Couldn't create InfiniBand device class\n");
+- goto err_comp;
++ goto err_comp_unbound;
+ }
+
+ ret = rdma_nl_init();
+@@ -1218,6 +1228,8 @@ err_ibnl:
+ rdma_nl_exit();
+ err_sysfs:
+ class_unregister(&ib_class);
++err_comp_unbound:
++ destroy_workqueue(ib_comp_unbound_wq);
+ err_comp:
+ destroy_workqueue(ib_comp_wq);
+ err:
+@@ -1236,6 +1248,7 @@ static void __exit ib_core_cleanup(void)
+ addr_cleanup();
+ rdma_nl_exit();
+ class_unregister(&ib_class);
++ destroy_workqueue(ib_comp_unbound_wq);
+ destroy_workqueue(ib_comp_wq);
+ /* Make sure that any pending umem accounting work is done. */
+ destroy_workqueue(ib_wq);
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index 7586c1dd73f1..74aa3e651bc3 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -3190,7 +3190,7 @@ static int ib_mad_port_open(struct ib_device *device,
+ }
+
+ port_priv->cq = ib_alloc_cq(port_priv->device, port_priv, cq_size, 0,
+- IB_POLL_WORKQUEUE);
++ IB_POLL_UNBOUND_WORKQUEUE);
+ if (IS_ERR(port_priv->cq)) {
+ dev_err(&device->dev, "Couldn't create ib_mad CQ\n");
+ ret = PTR_ERR(port_priv->cq);
+diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c
+index f67fa24b3aff..279f0ae65912 100644
+--- a/drivers/infiniband/core/restrack.c
++++ b/drivers/infiniband/core/restrack.c
+@@ -225,7 +225,9 @@ void rdma_restrack_del(struct rdma_restrack_entry *res)
+ up_write(&dev->res.rwsem);
+
+ out:
+- if (res->task)
++ if (res->task) {
+ put_task_struct(res->task);
++ res->task = NULL;
++ }
+ }
+ EXPORT_SYMBOL(rdma_restrack_del);
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 9ba73e11757d..e7549a2b1482 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2514,14 +2514,13 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
+ struct its_node *its = its_dev->its;
+ int i;
+
++ bitmap_release_region(its_dev->event_map.lpi_map,
++ its_get_event_id(irq_domain_get_irq_data(domain, virq)),
++ get_count_order(nr_irqs));
++
+ for (i = 0; i < nr_irqs; i++) {
+ struct irq_data *data = irq_domain_get_irq_data(domain,
+ virq + i);
+- u32 event = its_get_event_id(data);
+-
+- /* Mark interrupt index as unused */
+- clear_bit(event, its_dev->event_map.lpi_map);
+-
+ /* Nuke the entry in the domain */
+ irq_domain_reset_irq_data(data);
+ }
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index e6c7a84bb1df..2321643974da 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1768,7 +1768,6 @@ static int run_cache_set(struct cache_set *c)
+ set_gc_sectors(c);
+
+ if (CACHE_SYNC(&c->sb)) {
+- LIST_HEAD(journal);
+ struct bkey *k;
+ struct jset *j;
+
+diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
+index 1030c42add05..3dd668f69405 100644
+--- a/drivers/md/dm-zoned-target.c
++++ b/drivers/md/dm-zoned-target.c
+@@ -133,8 +133,6 @@ static int dmz_submit_bio(struct dmz_target *dmz, struct dm_zone *zone,
+
+ atomic_inc(&bioctx->ref);
+ generic_make_request(clone);
+- if (clone->bi_status == BLK_STS_IOERR)
+- return -EIO;
+
+ if (bio_op(bio) == REQ_OP_WRITE && dmz_is_seq(zone))
+ zone->wp_block += nr_blocks;
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 8b450fc53202..15a5e98b3d45 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -828,7 +828,7 @@ static int tvp5150_s_ctrl(struct v4l2_ctrl *ctrl)
+ return 0;
+ case V4L2_CID_HUE:
+ tvp5150_write(sd, TVP5150_HUE_CTL, ctrl->val);
+- break;
++ return 0;
+ case V4L2_CID_TEST_PATTERN:
+ decoder->enable = ctrl->val ? false : true;
+ tvp5150_selmux(sd);
+diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
+index 72428b6bfc47..ba44ea6d497e 100644
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -1627,29 +1627,35 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
+ continue;
+ }
+
+- if (time_after(jiffies, timeo) && !chip_ready(map, adr)){
++ /*
++ * We check "time_after" and "!chip_good" before checking
++ * "chip_good" to avoid the failure due to scheduling.
++ */
++ if (time_after(jiffies, timeo) && !chip_good(map, adr, datum)) {
+ xip_enable(map, chip, adr);
+ printk(KERN_WARNING "MTD %s(): software timeout\n", __func__);
+ xip_disable(map, chip, adr);
++ ret = -EIO;
+ break;
+ }
+
+- if (chip_ready(map, adr))
++ if (chip_good(map, adr, datum))
+ break;
+
+ /* Latency issues. Drop the lock, wait a while and retry */
+ UDELAY(map, chip, adr, 1);
+ }
++
+ /* Did we succeed? */
+- if (!chip_good(map, adr, datum)) {
++ if (ret) {
+ /* reset on all failures. */
+ map_write(map, CMD(0xF0), chip->start);
+ /* FIXME - should have reset delay before continuing */
+
+- if (++retry_cnt <= MAX_RETRIES)
++ if (++retry_cnt <= MAX_RETRIES) {
++ ret = 0;
+ goto retry;
+-
+- ret = -EIO;
++ }
+ }
+ xip_enable(map, chip, adr);
+ op_done:
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 5a57be66a487..aa067a7a72d4 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1999,8 +1999,11 @@ static void __ibmvnic_reset(struct work_struct *work)
+ rwi = get_next_rwi(adapter);
+ while (rwi) {
+ if (adapter->state == VNIC_REMOVING ||
+- adapter->state == VNIC_REMOVED)
+- goto out;
++ adapter->state == VNIC_REMOVED) {
++ kfree(rwi);
++ rc = EBUSY;
++ break;
++ }
+
+ if (adapter->force_reset_recovery) {
+ adapter->force_reset_recovery = false;
+@@ -2026,7 +2029,7 @@ static void __ibmvnic_reset(struct work_struct *work)
+ netdev_dbg(adapter->netdev, "Reset failed\n");
+ free_all_rwi(adapter);
+ }
+-out:
++
+ adapter->resetting = false;
+ if (we_lock_rtnl)
+ rtnl_unlock();
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+index da52e60d4437..d79e177f8990 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -210,6 +210,7 @@ static const char mlx5e_priv_flags[][ETH_GSTRING_LEN] = {
+ "tx_cqe_moder",
+ "rx_cqe_compress",
+ "rx_striding_rq",
++ "rx_no_csum_complete",
+ };
+
+ enum mlx5e_priv_flag {
+@@ -217,6 +218,7 @@ enum mlx5e_priv_flag {
+ MLX5E_PFLAG_TX_CQE_BASED_MODER = (1 << 1),
+ MLX5E_PFLAG_RX_CQE_COMPRESS = (1 << 2),
+ MLX5E_PFLAG_RX_STRIDING_RQ = (1 << 3),
++ MLX5E_PFLAG_RX_NO_CSUM_COMPLETE = (1 << 4),
+ };
+
+ #define MLX5E_SET_PFLAG(params, pflag, enable) \
+@@ -298,6 +300,7 @@ struct mlx5e_dcbx_dp {
+ enum {
+ MLX5E_RQ_STATE_ENABLED,
+ MLX5E_RQ_STATE_AM,
++ MLX5E_RQ_STATE_NO_CSUM_COMPLETE,
+ };
+
+ struct mlx5e_cq {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 2b9350f4c752..10d72c83714d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1510,6 +1510,28 @@ static int set_pflag_rx_striding_rq(struct net_device *netdev, bool enable)
+ return 0;
+ }
+
++static int set_pflag_rx_no_csum_complete(struct net_device *netdev, bool enable)
++{
++ struct mlx5e_priv *priv = netdev_priv(netdev);
++ struct mlx5e_channels *channels = &priv->channels;
++ struct mlx5e_channel *c;
++ int i;
++
++ if (!test_bit(MLX5E_STATE_OPENED, &priv->state) ||
++ priv->channels.params.xdp_prog)
++ return 0;
++
++ for (i = 0; i < channels->num; i++) {
++ c = channels->c[i];
++ if (enable)
++ __set_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &c->rq.state);
++ else
++ __clear_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &c->rq.state);
++ }
++
++ return 0;
++}
++
+ static int mlx5e_handle_pflag(struct net_device *netdev,
+ u32 wanted_flags,
+ enum mlx5e_priv_flag flag,
+@@ -1561,6 +1583,12 @@ static int mlx5e_set_priv_flags(struct net_device *netdev, u32 pflags)
+ err = mlx5e_handle_pflag(netdev, pflags,
+ MLX5E_PFLAG_RX_STRIDING_RQ,
+ set_pflag_rx_striding_rq);
++ if (err)
++ goto out;
++
++ err = mlx5e_handle_pflag(netdev, pflags,
++ MLX5E_PFLAG_RX_NO_CSUM_COMPLETE,
++ set_pflag_rx_no_csum_complete);
+
+ out:
+ mutex_unlock(&priv->state_lock);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 83ab2c0e6b61..7e6706333fa8 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -934,6 +934,13 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
+ if (params->rx_dim_enabled)
+ __set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
+
++ /* We disable csum_complete when XDP is enabled since
++ * XDP programs might manipulate packets which will render
++ * skb->checksum incorrect.
++ */
++ if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_NO_CSUM_COMPLETE) || c->xdp)
++ __set_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &c->rq.state);
++
+ return 0;
+
+ err_destroy_rq:
+@@ -4533,6 +4540,7 @@ void mlx5e_build_nic_params(struct mlx5_core_dev *mdev,
+ params->rx_cqe_compress_def = slow_pci_heuristic(mdev);
+
+ MLX5E_SET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS, params->rx_cqe_compress_def);
++ MLX5E_SET_PFLAG(params, MLX5E_PFLAG_RX_NO_CSUM_COMPLETE, false);
+
+ /* RQ */
+ /* Prefer Striding RQ, unless any of the following holds:
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index d3f794d4fb96..df49dc143c47 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -37,6 +37,7 @@
+ #include <net/busy_poll.h>
+ #include <net/ip6_checksum.h>
+ #include <net/page_pool.h>
++#include <net/inet_ecn.h>
+ #include "en.h"
+ #include "en_tc.h"
+ #include "eswitch.h"
+@@ -688,27 +689,110 @@ static inline void mlx5e_skb_set_hash(struct mlx5_cqe64 *cqe,
+ skb_set_hash(skb, be32_to_cpu(cqe->rss_hash_result), ht);
+ }
+
+-static inline bool is_last_ethertype_ip(struct sk_buff *skb, int *network_depth)
++static inline bool is_last_ethertype_ip(struct sk_buff *skb, int *network_depth,
++ __be16 *proto)
+ {
+- __be16 ethertype = ((struct ethhdr *)skb->data)->h_proto;
++ *proto = ((struct ethhdr *)skb->data)->h_proto;
++ *proto = __vlan_get_protocol(skb, *proto, network_depth);
+
+- ethertype = __vlan_get_protocol(skb, ethertype, network_depth);
+- return (ethertype == htons(ETH_P_IP) || ethertype == htons(ETH_P_IPV6));
++ if (*proto == htons(ETH_P_IP))
++ return pskb_may_pull(skb, *network_depth + sizeof(struct iphdr));
++
++ if (*proto == htons(ETH_P_IPV6))
++ return pskb_may_pull(skb, *network_depth + sizeof(struct ipv6hdr));
++
++ return false;
+ }
+
+-static u32 mlx5e_get_fcs(const struct sk_buff *skb)
++static inline void mlx5e_enable_ecn(struct mlx5e_rq *rq, struct sk_buff *skb)
+ {
+- const void *fcs_bytes;
+- u32 _fcs_bytes;
++ int network_depth = 0;
++ __be16 proto;
++ void *ip;
++ int rc;
+
+- fcs_bytes = skb_header_pointer(skb, skb->len - ETH_FCS_LEN,
+- ETH_FCS_LEN, &_fcs_bytes);
++ if (unlikely(!is_last_ethertype_ip(skb, &network_depth, &proto)))
++ return;
++
++ ip = skb->data + network_depth;
++ rc = ((proto == htons(ETH_P_IP)) ? IP_ECN_set_ce((struct iphdr *)ip) :
++ IP6_ECN_set_ce(skb, (struct ipv6hdr *)ip));
++
++ rq->stats->ecn_mark += !!rc;
++}
++
++static u8 get_ip_proto(struct sk_buff *skb, int network_depth, __be16 proto)
++{
++ void *ip_p = skb->data + network_depth;
+
+- return __get_unaligned_cpu32(fcs_bytes);
++ return (proto == htons(ETH_P_IP)) ? ((struct iphdr *)ip_p)->protocol :
++ ((struct ipv6hdr *)ip_p)->nexthdr;
+ }
+
+ #define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN)
+
++#define MAX_PADDING 8
++
++static void
++tail_padding_csum_slow(struct sk_buff *skb, int offset, int len,
++ struct mlx5e_rq_stats *stats)
++{
++ stats->csum_complete_tail_slow++;
++ skb->csum = csum_block_add(skb->csum,
++ skb_checksum(skb, offset, len, 0),
++ offset);
++}
++
++static void
++tail_padding_csum(struct sk_buff *skb, int offset,
++ struct mlx5e_rq_stats *stats)
++{
++ u8 tail_padding[MAX_PADDING];
++ int len = skb->len - offset;
++ void *tail;
++
++ if (unlikely(len > MAX_PADDING)) {
++ tail_padding_csum_slow(skb, offset, len, stats);
++ return;
++ }
++
++ tail = skb_header_pointer(skb, offset, len, tail_padding);
++ if (unlikely(!tail)) {
++ tail_padding_csum_slow(skb, offset, len, stats);
++ return;
++ }
++
++ stats->csum_complete_tail++;
++ skb->csum = csum_block_add(skb->csum, csum_partial(tail, len, 0), offset);
++}
++
++static void
++mlx5e_skb_padding_csum(struct sk_buff *skb, int network_depth, __be16 proto,
++ struct mlx5e_rq_stats *stats)
++{
++ struct ipv6hdr *ip6;
++ struct iphdr *ip4;
++ int pkt_len;
++
++ switch (proto) {
++ case htons(ETH_P_IP):
++ ip4 = (struct iphdr *)(skb->data + network_depth);
++ pkt_len = network_depth + ntohs(ip4->tot_len);
++ break;
++ case htons(ETH_P_IPV6):
++ ip6 = (struct ipv6hdr *)(skb->data + network_depth);
++ pkt_len = network_depth + sizeof(*ip6) + ntohs(ip6->payload_len);
++ break;
++ default:
++ return;
++ }
++
++ if (likely(pkt_len >= skb->len))
++ return;
++
++ tail_padding_csum(skb, pkt_len, stats);
++}
++
+ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ struct mlx5_cqe64 *cqe,
+ struct mlx5e_rq *rq,
+@@ -717,6 +801,7 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ {
+ struct mlx5e_rq_stats *stats = rq->stats;
+ int network_depth = 0;
++ __be16 proto;
+
+ if (unlikely(!(netdev->features & NETIF_F_RXCSUM)))
+ goto csum_none;
+@@ -727,6 +812,10 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ return;
+ }
+
++ /* True when explicitly set via priv flag, or XDP prog is loaded */
++ if (test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state))
++ goto csum_unnecessary;
++
+ /* CQE csum doesn't cover padding octets in short ethernet
+ * frames. And the pad field is appended prior to calculating
+ * and appending the FCS field.
+@@ -738,7 +827,10 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ if (short_frame(skb->len))
+ goto csum_unnecessary;
+
+- if (likely(is_last_ethertype_ip(skb, &network_depth))) {
++ if (likely(is_last_ethertype_ip(skb, &network_depth, &proto))) {
++ if (unlikely(get_ip_proto(skb, network_depth, proto) == IPPROTO_SCTP))
++ goto csum_unnecessary;
++
+ skb->ip_summed = CHECKSUM_COMPLETE;
+ skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
+ if (network_depth > ETH_HLEN)
+@@ -749,10 +841,8 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ skb->csum = csum_partial(skb->data + ETH_HLEN,
+ network_depth - ETH_HLEN,
+ skb->csum);
+- if (unlikely(netdev->features & NETIF_F_RXFCS))
+- skb->csum = csum_block_add(skb->csum,
+- (__force __wsum)mlx5e_get_fcs(skb),
+- skb->len - ETH_FCS_LEN);
++
++ mlx5e_skb_padding_csum(skb, network_depth, proto, stats);
+ stats->csum_complete++;
+ return;
+ }
+@@ -775,6 +865,8 @@ csum_none:
+ stats->csum_none++;
+ }
+
++#define MLX5E_CE_BIT_MASK 0x80
++
+ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe,
+ u32 cqe_bcnt,
+ struct mlx5e_rq *rq,
+@@ -819,6 +911,10 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe,
+ skb->mark = be32_to_cpu(cqe->sop_drop_qpn) & MLX5E_TC_FLOW_ID_MASK;
+
+ mlx5e_handle_csum(netdev, cqe, rq, skb, !!lro_num_seg);
++ /* checking CE bit in cqe - MSB in ml_path field */
++ if (unlikely(cqe->ml_path & MLX5E_CE_BIT_MASK))
++ mlx5e_enable_ecn(rq, skb);
++
+ skb->protocol = eth_type_trans(skb, netdev);
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index 7047cc293545..8255d797ea94 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -53,10 +53,13 @@ static const struct counter_desc sw_stats_desc[] = {
+
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_lro_packets) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_lro_bytes) },
++ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_ecn_mark) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_removed_vlan_packets) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_none) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete) },
++ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete_tail) },
++ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete_tail_slow) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary_inner) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_drop) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_redirect) },
+@@ -144,9 +147,12 @@ void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
+ s->rx_bytes += rq_stats->bytes;
+ s->rx_lro_packets += rq_stats->lro_packets;
+ s->rx_lro_bytes += rq_stats->lro_bytes;
++ s->rx_ecn_mark += rq_stats->ecn_mark;
+ s->rx_removed_vlan_packets += rq_stats->removed_vlan_packets;
+ s->rx_csum_none += rq_stats->csum_none;
+ s->rx_csum_complete += rq_stats->csum_complete;
++ s->rx_csum_complete_tail += rq_stats->csum_complete_tail;
++ s->rx_csum_complete_tail_slow += rq_stats->csum_complete_tail_slow;
+ s->rx_csum_unnecessary += rq_stats->csum_unnecessary;
+ s->rx_csum_unnecessary_inner += rq_stats->csum_unnecessary_inner;
+ s->rx_xdp_drop += rq_stats->xdp_drop;
+@@ -1137,6 +1143,8 @@ static const struct counter_desc rq_stats_desc[] = {
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, packets) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, bytes) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete) },
++ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete_tail) },
++ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete_tail_slow) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary_inner) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_none) },
+@@ -1144,6 +1152,7 @@ static const struct counter_desc rq_stats_desc[] = {
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, xdp_redirect) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, lro_packets) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, lro_bytes) },
++ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, ecn_mark) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, removed_vlan_packets) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, wqe_err) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler_cqes) },
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+index 0ad7a165443a..3ea8033ed6bd 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+@@ -66,10 +66,13 @@ struct mlx5e_sw_stats {
+ u64 tx_nop;
+ u64 rx_lro_packets;
+ u64 rx_lro_bytes;
++ u64 rx_ecn_mark;
+ u64 rx_removed_vlan_packets;
+ u64 rx_csum_unnecessary;
+ u64 rx_csum_none;
+ u64 rx_csum_complete;
++ u64 rx_csum_complete_tail;
++ u64 rx_csum_complete_tail_slow;
+ u64 rx_csum_unnecessary_inner;
+ u64 rx_xdp_drop;
+ u64 rx_xdp_redirect;
+@@ -179,11 +182,14 @@ struct mlx5e_rq_stats {
+ u64 packets;
+ u64 bytes;
+ u64 csum_complete;
++ u64 csum_complete_tail;
++ u64 csum_complete_tail_slow;
+ u64 csum_unnecessary;
+ u64 csum_unnecessary_inner;
+ u64 csum_none;
+ u64 lro_packets;
+ u64 lro_bytes;
++ u64 ecn_mark;
+ u64 removed_vlan_packets;
+ u64 xdp_drop;
+ u64 xdp_redirect;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
+index d1c1a8069c7e..5e1e671d2002 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
+@@ -315,7 +315,7 @@ out:
+ }
+
+ void rs_fw_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- enum nl80211_band band)
++ enum nl80211_band band, bool update)
+ {
+ struct ieee80211_hw *hw = mvm->hw;
+ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+@@ -324,7 +324,8 @@ void rs_fw_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ struct ieee80211_supported_band *sband;
+ struct iwl_tlc_config_cmd cfg_cmd = {
+ .sta_id = mvmsta->sta_id,
+- .max_ch_width = rs_fw_bw_from_sta_bw(sta),
++ .max_ch_width = update ?
++ rs_fw_bw_from_sta_bw(sta) : RATE_MCS_CHAN_WIDTH_20,
+ .flags = cpu_to_le16(rs_fw_set_config_flags(mvm, sta)),
+ .chains = rs_fw_set_active_chains(iwl_mvm_get_valid_tx_ant(mvm)),
+ .max_mpdu_len = cpu_to_le16(sta->max_amsdu_len),
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+index 6b9c670fcef8..6f4508d62a97 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+@@ -4113,7 +4113,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ enum nl80211_band band, bool update)
+ {
+ if (iwl_mvm_has_tlc_offload(mvm))
+- rs_fw_rate_init(mvm, sta, band);
++ rs_fw_rate_init(mvm, sta, band, update);
+ else
+ rs_drv_rate_init(mvm, sta, band, update);
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+index 8e7f993e2911..d0f47899f284 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+@@ -461,7 +461,7 @@ void rs_remove_sta_debugfs(void *mvm, void *mvm_sta);
+
+ void iwl_mvm_rs_add_sta(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta);
+ void rs_fw_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- enum nl80211_band band);
++ enum nl80211_band band, bool update);
+ int rs_fw_tx_protection(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
+ bool enable);
+ void iwl_mvm_tlc_update_notif(struct iwl_mvm *mvm,
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index ffae299c3492..5615ce55cef5 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -671,7 +671,7 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
+ if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE ||
+ info.control.vif->type == NL80211_IFTYPE_AP ||
+ info.control.vif->type == NL80211_IFTYPE_ADHOC) {
+- if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE)
++ if (!ieee80211_is_data(hdr->frame_control))
+ sta_id = mvmvif->bcast_sta.sta_id;
+ else
+ sta_id = mvmvif->mcast_sta.sta_id;
+diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
+index 5dadc964ad3b..5c2849846641 100644
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -2706,8 +2706,8 @@ static int hv_pci_remove(struct hv_device *hdev)
+ /* Remove the bus from PCI's point of view. */
+ pci_lock_rescan_remove();
+ pci_stop_root_bus(hbus->pci_bus);
+- pci_remove_root_bus(hbus->pci_bus);
+ hv_pci_remove_slots(hbus);
++ pci_remove_root_bus(hbus->pci_bus);
+ pci_unlock_rescan_remove();
+ hbus->state = hv_pcibus_removed;
+ }
+diff --git a/drivers/pinctrl/sprd/pinctrl-sprd.c b/drivers/pinctrl/sprd/pinctrl-sprd.c
+index 78c2f548b25f..8f3468d9f848 100644
+--- a/drivers/pinctrl/sprd/pinctrl-sprd.c
++++ b/drivers/pinctrl/sprd/pinctrl-sprd.c
+@@ -159,10 +159,8 @@ struct sprd_pinctrl {
+ struct sprd_pinctrl_soc_info *info;
+ };
+
+-enum sprd_pinconf_params {
+- SPRD_PIN_CONFIG_CONTROL = PIN_CONFIG_END + 1,
+- SPRD_PIN_CONFIG_SLEEP_MODE = PIN_CONFIG_END + 2,
+-};
++#define SPRD_PIN_CONFIG_CONTROL (PIN_CONFIG_END + 1)
++#define SPRD_PIN_CONFIG_SLEEP_MODE (PIN_CONFIG_END + 2)
+
+ static int sprd_pinctrl_get_id_by_name(struct sprd_pinctrl *sprd_pctl,
+ const char *name)
+diff --git a/drivers/power/supply/power_supply_sysfs.c b/drivers/power/supply/power_supply_sysfs.c
+index 5a2757a7f408..5358a80d854f 100644
+--- a/drivers/power/supply/power_supply_sysfs.c
++++ b/drivers/power/supply/power_supply_sysfs.c
+@@ -131,7 +131,8 @@ static ssize_t power_supply_show_property(struct device *dev,
+ dev_dbg(dev, "driver has no data for `%s' property\n",
+ attr->attr.name);
+ else if (ret != -ENODEV && ret != -EAGAIN)
+- dev_err(dev, "driver failed to report `%s' property: %zd\n",
++ dev_err_ratelimited(dev,
++ "driver failed to report `%s' property: %zd\n",
+ attr->attr.name, ret);
+ return ret;
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index fc08e46a93ca..34ff4bbc8de1 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -4045,6 +4045,41 @@ out:
+ }
+ }
+
++static int qla2x00_post_gnnft_gpnft_done_work(struct scsi_qla_host *vha,
++ srb_t *sp, int cmd)
++{
++ struct qla_work_evt *e;
++
++ if (cmd != QLA_EVT_GPNFT_DONE && cmd != QLA_EVT_GNNFT_DONE)
++ return QLA_PARAMETER_ERROR;
++
++ e = qla2x00_alloc_work(vha, cmd);
++ if (!e)
++ return QLA_FUNCTION_FAILED;
++
++ e->u.iosb.sp = sp;
++
++ return qla2x00_post_work(vha, e);
++}
++
++static int qla2x00_post_nvme_gpnft_done_work(struct scsi_qla_host *vha,
++ srb_t *sp, int cmd)
++{
++ struct qla_work_evt *e;
++
++ if (cmd != QLA_EVT_GPNFT)
++ return QLA_PARAMETER_ERROR;
++
++ e = qla2x00_alloc_work(vha, cmd);
++ if (!e)
++ return QLA_FUNCTION_FAILED;
++
++ e->u.gpnft.fc4_type = FC4_TYPE_NVME;
++ e->u.gpnft.sp = sp;
++
++ return qla2x00_post_work(vha, e);
++}
++
+ static void qla2x00_find_free_fcp_nvme_slot(struct scsi_qla_host *vha,
+ struct srb *sp)
+ {
+@@ -4145,22 +4180,36 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
+ {
+ struct srb *sp = s;
+ struct scsi_qla_host *vha = sp->vha;
+- struct qla_work_evt *e;
+ struct ct_sns_req *ct_req =
+ (struct ct_sns_req *)sp->u.iocb_cmd.u.ctarg.req;
+ u16 cmd = be16_to_cpu(ct_req->command);
+ u8 fc4_type = sp->gen2;
+ unsigned long flags;
++ int rc;
+
+ /* gen2 field is holding the fc4type */
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "Async done-%s res %x FC4Type %x\n",
+ sp->name, res, sp->gen2);
+
++ sp->rc = res;
+ if (res) {
+ unsigned long flags;
++ const char *name = sp->name;
++
++ /*
++ * We are in an Interrupt context, queue up this
++ * sp for GNNFT_DONE work. This will allow all
++ * the resource to get freed up.
++ */
++ rc = qla2x00_post_gnnft_gpnft_done_work(vha, sp,
++ QLA_EVT_GNNFT_DONE);
++ if (rc) {
++ /* Cleanup here to prevent memory leak */
++ qla24xx_sp_unmap(vha, sp);
++ sp->free(sp);
++ }
+
+- sp->free(sp);
+ spin_lock_irqsave(&vha->work_lock, flags);
+ vha->scan.scan_flags &= ~SF_SCANNING;
+ vha->scan.scan_retry++;
+@@ -4171,9 +4220,9 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
+ set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+ qla2xxx_wake_dpc(vha);
+ } else {
+- ql_dbg(ql_dbg_disc, sp->vha, 0xffff,
+- "Async done-%s rescan failed on all retries\n",
+- sp->name);
++ ql_dbg(ql_dbg_disc, vha, 0xffff,
++ "Async done-%s rescan failed on all retries.\n",
++ name);
+ }
+ return;
+ }
+@@ -4188,77 +4237,31 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
+ vha->scan.scan_flags &= ~SF_SCANNING;
+ spin_unlock_irqrestore(&vha->work_lock, flags);
+
+- e = qla2x00_alloc_work(vha, QLA_EVT_GPNFT);
+- if (!e) {
+- /*
+- * please ignore kernel warning. Otherwise,
+- * we have mem leak.
+- */
+- if (sp->u.iocb_cmd.u.ctarg.req) {
+- dma_free_coherent(&vha->hw->pdev->dev,
+- sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+- sp->u.iocb_cmd.u.ctarg.req,
+- sp->u.iocb_cmd.u.ctarg.req_dma);
+- sp->u.iocb_cmd.u.ctarg.req = NULL;
+- }
+- if (sp->u.iocb_cmd.u.ctarg.rsp) {
+- dma_free_coherent(&vha->hw->pdev->dev,
+- sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+- sp->u.iocb_cmd.u.ctarg.rsp,
+- sp->u.iocb_cmd.u.ctarg.rsp_dma);
+- sp->u.iocb_cmd.u.ctarg.rsp = NULL;
+- }
+-
+- ql_dbg(ql_dbg_disc, vha, 0xffff,
+- "Async done-%s unable to alloc work element\n",
+- sp->name);
+- sp->free(sp);
++ sp->rc = res;
++ rc = qla2x00_post_nvme_gpnft_done_work(vha, sp, QLA_EVT_GPNFT);
++ if (!rc) {
++ qla24xx_sp_unmap(vha, sp);
+ set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
+ set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+ return;
+ }
+- e->u.gpnft.fc4_type = FC4_TYPE_NVME;
+- sp->rc = res;
+- e->u.gpnft.sp = sp;
+-
+- qla2x00_post_work(vha, e);
+- return;
+ }
+
+- if (cmd == GPN_FT_CMD)
+- e = qla2x00_alloc_work(vha, QLA_EVT_GPNFT_DONE);
+- else
+- e = qla2x00_alloc_work(vha, QLA_EVT_GNNFT_DONE);
+- if (!e) {
+- /* please ignore kernel warning. Otherwise, we have mem leak. */
+- if (sp->u.iocb_cmd.u.ctarg.req) {
+- dma_free_coherent(&vha->hw->pdev->dev,
+- sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+- sp->u.iocb_cmd.u.ctarg.req,
+- sp->u.iocb_cmd.u.ctarg.req_dma);
+- sp->u.iocb_cmd.u.ctarg.req = NULL;
+- }
+- if (sp->u.iocb_cmd.u.ctarg.rsp) {
+- dma_free_coherent(&vha->hw->pdev->dev,
+- sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+- sp->u.iocb_cmd.u.ctarg.rsp,
+- sp->u.iocb_cmd.u.ctarg.rsp_dma);
+- sp->u.iocb_cmd.u.ctarg.rsp = NULL;
+- }
++ if (cmd == GPN_FT_CMD) {
++ del_timer(&sp->u.iocb_cmd.timer);
++ rc = qla2x00_post_gnnft_gpnft_done_work(vha, sp,
++ QLA_EVT_GPNFT_DONE);
++ } else {
++ rc = qla2x00_post_gnnft_gpnft_done_work(vha, sp,
++ QLA_EVT_GNNFT_DONE);
++ }
+
+- ql_dbg(ql_dbg_disc, vha, 0xffff,
+- "Async done-%s unable to alloc work element\n",
+- sp->name);
+- sp->free(sp);
++ if (rc) {
++ qla24xx_sp_unmap(vha, sp);
+ set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
+ set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+ return;
+ }
+-
+- sp->rc = res;
+- e->u.iosb.sp = sp;
+-
+- qla2x00_post_work(vha, e);
+ }
+
+ /*
+@@ -4357,7 +4360,6 @@ void qla24xx_async_gpnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ {
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s enter\n", __func__);
+- del_timer(&sp->u.iocb_cmd.timer);
+ qla24xx_async_gnnft(vha, sp, sp->gen2);
+ }
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 39a8f4a671aa..7c1f36b69bdc 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -54,7 +54,7 @@ qla2x00_sp_timeout(struct timer_list *t)
+ unsigned long flags;
+ struct qla_hw_data *ha = sp->vha->hw;
+
+- WARN_ON(irqs_disabled());
++ WARN_ON_ONCE(irqs_disabled());
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+ req = sp->qpair->req;
+ req->outstanding_cmds[sp->handle] = NULL;
+@@ -796,6 +796,9 @@ qla24xx_async_gnl_sp_done(void *s, int res)
+ sp->name, res, sp->u.iocb_cmd.u.mbx.in_mb[1],
+ sp->u.iocb_cmd.u.mbx.in_mb[2]);
+
++ if (res == QLA_FUNCTION_TIMEOUT)
++ return;
++
+ memset(&ea, 0, sizeof(ea));
+ ea.sp = sp;
+ ea.rc = res;
+@@ -979,17 +982,13 @@ void qla24xx_async_gpdb_sp_done(void *s, int res)
+ "Async done-%s res %x, WWPN %8phC mb[1]=%x mb[2]=%x \n",
+ sp->name, res, fcport->port_name, mb[1], mb[2]);
+
+- fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+-
+- if (res == QLA_FUNCTION_TIMEOUT)
+- return;
+-
+ if (res == QLA_FUNCTION_TIMEOUT) {
+ dma_pool_free(sp->vha->hw->s_dma_pool, sp->u.iocb_cmd.u.mbx.in,
+ sp->u.iocb_cmd.u.mbx.in_dma);
+ return;
+ }
+
++ fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+ memset(&ea, 0, sizeof(ea));
+ ea.event = FCME_GPDB_DONE;
+ ea.fcport = fcport;
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index cc9e846a3865..094be406cde4 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -553,7 +553,50 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
+ oparams.fid = pfid;
+ oparams.reconnect = false;
+
++ /*
++ * We do not hold the lock for the open because in case
++ * SMB2_open needs to reconnect, it will end up calling
++ * cifs_mark_open_files_invalid() which takes the lock again
++ * thus causing a deadlock
++ */
++ mutex_unlock(&tcon->crfid.fid_mutex);
+ rc = SMB2_open(xid, &oparams, &srch_path, &oplock, NULL, NULL, NULL);
++ mutex_lock(&tcon->crfid.fid_mutex);
++
++ /*
++ * Now we need to check again as the cached root might have
++ * been successfully re-opened from a concurrent process
++ */
++
++ if (tcon->crfid.is_valid) {
++ /* work was already done */
++
++ /* stash fids for close() later */
++ struct cifs_fid fid = {
++ .persistent_fid = pfid->persistent_fid,
++ .volatile_fid = pfid->volatile_fid,
++ };
++
++ /*
++ * Caller expects this func to set pfid to a valid
++ * cached root, so we copy the existing one and get a
++ * reference
++ */
++ memcpy(pfid, tcon->crfid.fid, sizeof(*pfid));
++ kref_get(&tcon->crfid.refcount);
++
++ mutex_unlock(&tcon->crfid.fid_mutex);
++
++ if (rc == 0) {
++ /* close extra handle outside of critical section */
++ SMB2_close(xid, tcon, fid.persistent_fid,
++ fid.volatile_fid);
++ }
++ return 0;
++ }
++
++ /* Cached root is still invalid, continue normaly */
++
+ if (rc == 0) {
+ memcpy(tcon->crfid.fid, pfid, sizeof(struct cifs_fid));
+ tcon->crfid.tcon = tcon;
+@@ -561,6 +604,7 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
+ kref_init(&tcon->crfid.refcount);
+ kref_get(&tcon->crfid.refcount);
+ }
++
+ mutex_unlock(&tcon->crfid.fid_mutex);
+ return rc;
+ }
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index 59d0472013f4..388500eec729 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -849,6 +849,7 @@ int f2fs_get_valid_checkpoint(struct f2fs_sb_info *sbi)
+ unsigned int cp_blks = 1 + __cp_payload(sbi);
+ block_t cp_blk_no;
+ int i;
++ int err;
+
+ sbi->ckpt = f2fs_kzalloc(sbi, array_size(blk_size, cp_blks),
+ GFP_KERNEL);
+@@ -876,6 +877,7 @@ int f2fs_get_valid_checkpoint(struct f2fs_sb_info *sbi)
+ } else if (cp2) {
+ cur_page = cp2;
+ } else {
++ err = -EFSCORRUPTED;
+ goto fail_no_cp;
+ }
+
+@@ -888,8 +890,10 @@ int f2fs_get_valid_checkpoint(struct f2fs_sb_info *sbi)
+ sbi->cur_cp_pack = 2;
+
+ /* Sanity checking of checkpoint */
+- if (f2fs_sanity_check_ckpt(sbi))
++ if (f2fs_sanity_check_ckpt(sbi)) {
++ err = -EFSCORRUPTED;
+ goto free_fail_no_cp;
++ }
+
+ if (cp_blks <= 1)
+ goto done;
+@@ -903,8 +907,10 @@ int f2fs_get_valid_checkpoint(struct f2fs_sb_info *sbi)
+ unsigned char *ckpt = (unsigned char *)sbi->ckpt;
+
+ cur_page = f2fs_get_meta_page(sbi, cp_blk_no + i);
+- if (IS_ERR(cur_page))
++ if (IS_ERR(cur_page)) {
++ err = PTR_ERR(cur_page);
+ goto free_fail_no_cp;
++ }
+ sit_bitmap_ptr = page_address(cur_page);
+ memcpy(ckpt + i * blk_size, sit_bitmap_ptr, blk_size);
+ f2fs_put_page(cur_page, 1);
+@@ -919,7 +925,7 @@ free_fail_no_cp:
+ f2fs_put_page(cp2, 1);
+ fail_no_cp:
+ kfree(sbi->ckpt);
+- return -EINVAL;
++ return err;
+ }
+
+ static void __add_dirty_inode(struct inode *inode, enum inode_type type)
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 4d02e76b648a..9511466bc785 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -449,7 +449,7 @@ int f2fs_submit_page_bio(struct f2fs_io_info *fio)
+
+ if (!f2fs_is_valid_blkaddr(fio->sbi, fio->new_blkaddr,
+ __is_meta_io(fio) ? META_GENERIC : DATA_GENERIC))
+- return -EFAULT;
++ return -EFSCORRUPTED;
+
+ trace_f2fs_submit_page_bio(page, fio);
+ f2fs_trace_ios(fio, 0);
+@@ -1071,7 +1071,7 @@ next_block:
+
+ if (__is_valid_data_blkaddr(blkaddr) &&
+ !f2fs_is_valid_blkaddr(sbi, blkaddr, DATA_GENERIC)) {
+- err = -EFAULT;
++ err = -EFSCORRUPTED;
+ goto sync_out;
+ }
+
+@@ -1755,7 +1755,7 @@ int f2fs_do_write_data_page(struct f2fs_io_info *fio)
+
+ if (!f2fs_is_valid_blkaddr(fio->sbi, fio->old_blkaddr,
+ DATA_GENERIC))
+- return -EFAULT;
++ return -EFSCORRUPTED;
+
+ ipu_force = true;
+ fio->need_lock = LOCK_DONE;
+@@ -1781,7 +1781,7 @@ got_it:
+ if (__is_valid_data_blkaddr(fio->old_blkaddr) &&
+ !f2fs_is_valid_blkaddr(fio->sbi, fio->old_blkaddr,
+ DATA_GENERIC)) {
+- err = -EFAULT;
++ err = -EFSCORRUPTED;
+ goto out_writepage;
+ }
+ /*
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 44ea7ac69ef4..fb216488d67a 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3487,3 +3487,7 @@ extern void f2fs_build_fault_attr(struct f2fs_sb_info *sbi, unsigned int rate,
+ #endif
+
+ #endif
++
++#define EFSBADCRC EBADMSG /* Bad CRC detected */
++#define EFSCORRUPTED EUCLEAN /* Filesystem is corrupted */
++
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index d44b57a363ff..dd29a49143f5 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -636,7 +636,7 @@ static int ra_data_block(struct inode *inode, pgoff_t index)
+
+ if (unlikely(!f2fs_is_valid_blkaddr(sbi, dn.data_blkaddr,
+ DATA_GENERIC))) {
+- err = -EFAULT;
++ err = -EFSCORRUPTED;
+ goto put_page;
+ }
+ got_it:
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index 92703efde36e..6bbb5f6801e2 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -146,7 +146,7 @@ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page)
+ "%s: corrupted inline inode ino=%lx, i_addr[0]:0x%x, "
+ "run fsck to fix.",
+ __func__, dn->inode->i_ino, dn->data_blkaddr);
+- return -EINVAL;
++ return -EFSCORRUPTED;
+ }
+
+ f2fs_bug_on(F2FS_P_SB(page), PageWriteback(page));
+@@ -389,7 +389,7 @@ static int f2fs_move_inline_dirents(struct inode *dir, struct page *ipage,
+ "%s: corrupted inline inode ino=%lx, i_addr[0]:0x%x, "
+ "run fsck to fix.",
+ __func__, dir->i_ino, dn.data_blkaddr);
+- err = -EINVAL;
++ err = -EFSCORRUPTED;
+ goto out;
+ }
+
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index 0f31df01e36c..540d45759621 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -76,7 +76,7 @@ static int __written_first_block(struct f2fs_sb_info *sbi,
+ if (!__is_valid_data_blkaddr(addr))
+ return 1;
+ if (!f2fs_is_valid_blkaddr(sbi, addr, DATA_GENERIC))
+- return -EFAULT;
++ return -EFSCORRUPTED;
+ return 0;
+ }
+
+@@ -361,7 +361,7 @@ static int do_read_inode(struct inode *inode)
+
+ if (!sanity_check_inode(inode, node_page)) {
+ f2fs_put_page(node_page, 1);
+- return -EINVAL;
++ return -EFSCORRUPTED;
+ }
+
+ /* check data exist */
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index e2d9edad758c..aa8f19e1bdb3 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -40,7 +40,7 @@ int f2fs_check_nid_range(struct f2fs_sb_info *sbi, nid_t nid)
+ f2fs_msg(sbi->sb, KERN_WARNING,
+ "%s: out-of-range nid=%x, run fsck to fix.",
+ __func__, nid);
+- return -EINVAL;
++ return -EFSCORRUPTED;
+ }
+ return 0;
+ }
+@@ -1284,7 +1284,7 @@ static int read_node_page(struct page *page, int op_flags)
+ if (PageUptodate(page)) {
+ if (!f2fs_inode_chksum_verify(sbi, page)) {
+ ClearPageUptodate(page);
+- return -EBADMSG;
++ return -EFSBADCRC;
+ }
+ return LOCKED_PAGE;
+ }
+@@ -1370,7 +1370,7 @@ repeat:
+ }
+
+ if (!f2fs_inode_chksum_verify(sbi, page)) {
+- err = -EBADMSG;
++ err = -EFSBADCRC;
+ goto out_err;
+ }
+ page_hit:
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index bf5c5f4fa77e..0b224f4a4a65 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -491,7 +491,7 @@ retry_dn:
+ "Inconsistent ofs_of_node, ino:%lu, ofs:%u, %u",
+ inode->i_ino, ofs_of_node(dn.node_page),
+ ofs_of_node(page));
+- err = -EFAULT;
++ err = -EFSCORRUPTED;
+ goto err;
+ }
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 92f72bb5aff4..10d5dcdb34be 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -2657,7 +2657,7 @@ int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range)
+ if (is_sbi_flag_set(sbi, SBI_NEED_FSCK)) {
+ f2fs_msg(sbi->sb, KERN_WARNING,
+ "Found FS corruption, run fsck to fix.");
+- return -EIO;
++ return -EFSCORRUPTED;
+ }
+
+ /* start/end segment number in main_area */
+@@ -3079,7 +3079,7 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
+
+ if (!IS_DATASEG(get_seg_entry(sbi, segno)->type)) {
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+- return -EFAULT;
++ return -EFSCORRUPTED;
+ }
+
+ stat_inc_inplace_blocks(fio->sbi);
+@@ -3261,11 +3261,6 @@ static int read_compacted_summaries(struct f2fs_sb_info *sbi)
+ seg_i = CURSEG_I(sbi, i);
+ segno = le32_to_cpu(ckpt->cur_data_segno[i]);
+ blk_off = le16_to_cpu(ckpt->cur_data_blkoff[i]);
+- if (blk_off > ENTRIES_IN_SUM) {
+- f2fs_bug_on(sbi, 1);
+- f2fs_put_page(page, 1);
+- return -EFAULT;
+- }
+ seg_i->next_segno = segno;
+ reset_curseg(sbi, i, 0);
+ seg_i->alloc_type = ckpt->alloc_type[i];
+@@ -3971,7 +3966,7 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)
+ "Wrong journal entry on segno %u",
+ start);
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+- err = -EINVAL;
++ err = -EFSCORRUPTED;
+ break;
+ }
+
+@@ -4012,7 +4007,7 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)
+ "SIT is corrupted node# %u vs %u",
+ total_node_blocks, valid_node_count(sbi));
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+- err = -EINVAL;
++ err = -EFSCORRUPTED;
+ }
+
+ return err;
+@@ -4103,6 +4098,41 @@ static int build_dirty_segmap(struct f2fs_sb_info *sbi)
+ return init_victim_secmap(sbi);
+ }
+
++static int sanity_check_curseg(struct f2fs_sb_info *sbi)
++{
++ int i;
++
++ /*
++ * In LFS/SSR curseg, .next_blkoff should point to an unused blkaddr;
++ * In LFS curseg, all blkaddr after .next_blkoff should be unused.
++ */
++ for (i = 0; i < NO_CHECK_TYPE; i++) {
++ struct curseg_info *curseg = CURSEG_I(sbi, i);
++ struct seg_entry *se = get_seg_entry(sbi, curseg->segno);
++ unsigned int blkofs = curseg->next_blkoff;
++
++ if (f2fs_test_bit(blkofs, se->cur_valid_map))
++ goto out;
++
++ if (curseg->alloc_type == SSR)
++ continue;
++
++ for (blkofs += 1; blkofs < sbi->blocks_per_seg; blkofs++) {
++ if (!f2fs_test_bit(blkofs, se->cur_valid_map))
++ continue;
++out:
++ f2fs_msg(sbi->sb, KERN_ERR,
++ "Current segment's next free block offset is "
++ "inconsistent with bitmap, logtype:%u, "
++ "segno:%u, type:%u, next_blkoff:%u, blkofs:%u",
++ i, curseg->segno, curseg->alloc_type,
++ curseg->next_blkoff, blkofs);
++ return -EFSCORRUPTED;
++ }
++ }
++ return 0;
++}
++
+ /*
+ * Update min, max modified time for cost-benefit GC algorithm
+ */
+@@ -4198,6 +4228,10 @@ int f2fs_build_segment_manager(struct f2fs_sb_info *sbi)
+ if (err)
+ return err;
+
++ err = sanity_check_curseg(sbi);
++ if (err)
++ return err;
++
+ init_min_max_mtime(sbi);
+ return 0;
+ }
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index 5079532cb176..9c2a55ad61bc 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -684,7 +684,7 @@ static inline int check_block_count(struct f2fs_sb_info *sbi,
+ "Mismatch valid blocks %d vs. %d",
+ GET_SIT_VBLOCKS(raw_sit), valid_blocks);
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+- return -EINVAL;
++ return -EFSCORRUPTED;
+ }
+
+ /* check segment usage, and check boundary of a given segment number */
+@@ -694,7 +694,7 @@ static inline int check_block_count(struct f2fs_sb_info *sbi,
+ "Wrong valid blocks %d or segno %u",
+ GET_SIT_VBLOCKS(raw_sit), segno);
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+- return -EINVAL;
++ return -EFSCORRUPTED;
+ }
+ return 0;
+ }
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 1871031e2d5e..fdafcfd8b20e 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -2413,11 +2413,11 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
+ }
+ }
+ for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {
+- for (j = i; j < NR_CURSEG_DATA_TYPE; j++) {
++ for (j = 0; j < NR_CURSEG_DATA_TYPE; j++) {
+ if (le32_to_cpu(ckpt->cur_node_segno[i]) ==
+ le32_to_cpu(ckpt->cur_data_segno[j])) {
+ f2fs_msg(sbi->sb, KERN_ERR,
+- "Data segment (%u) and Data segment (%u)"
++ "Node segment (%u) and Data segment (%u)"
+ " has the same segno: %u", i, j,
+ le32_to_cpu(ckpt->cur_node_segno[i]));
+ return 1;
+@@ -2616,7 +2616,7 @@ static int read_raw_super_block(struct f2fs_sb_info *sbi,
+ f2fs_msg(sb, KERN_ERR,
+ "Can't find valid F2FS filesystem in %dth superblock",
+ block + 1);
+- err = -EINVAL;
++ err = -EFSCORRUPTED;
+ brelse(bh);
+ continue;
+ }
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 88e30f7cf9e1..1dae74f7ccca 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -349,7 +349,7 @@ static int lookup_all_xattrs(struct inode *inode, struct page *ipage,
+
+ *xe = __find_xattr(cur_addr, last_txattr_addr, index, len, name);
+ if (!*xe) {
+- err = -EFAULT;
++ err = -EFSCORRUPTED;
+ goto out;
+ }
+ check:
+@@ -625,7 +625,7 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ /* find entry with wanted name. */
+ here = __find_xattr(base_addr, last_base_addr, index, len, name);
+ if (!here) {
+- error = -EFAULT;
++ error = -EFSCORRUPTED;
+ goto exit;
+ }
+
+diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
+index 06a7da8dbda5..38dc0b43c366 100644
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -3841,15 +3841,28 @@ xfs_bmapi_read(
+ XFS_STATS_INC(mp, xs_blk_mapr);
+
+ ifp = XFS_IFORK_PTR(ip, whichfork);
++ if (!ifp) {
++ /* No CoW fork? Return a hole. */
++ if (whichfork == XFS_COW_FORK) {
++ mval->br_startoff = bno;
++ mval->br_startblock = HOLESTARTBLOCK;
++ mval->br_blockcount = len;
++ mval->br_state = XFS_EXT_NORM;
++ *nmap = 1;
++ return 0;
++ }
+
+- /* No CoW fork? Return a hole. */
+- if (whichfork == XFS_COW_FORK && !ifp) {
+- mval->br_startoff = bno;
+- mval->br_startblock = HOLESTARTBLOCK;
+- mval->br_blockcount = len;
+- mval->br_state = XFS_EXT_NORM;
+- *nmap = 1;
+- return 0;
++ /*
++ * A missing attr ifork implies that the inode says we're in
++ * extents or btree format but failed to pass the inode fork
++ * verifier while trying to load it. Treat that as a file
++ * corruption too.
++ */
++#ifdef DEBUG
++ xfs_alert(mp, "%s: inode %llu missing fork %d",
++ __func__, ip->i_ino, whichfork);
++#endif /* DEBUG */
++ return -EFSCORRUPTED;
+ }
+
+ if (!(ifp->if_flags & XFS_IFEXTENTS)) {
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index 412c2820626d..b7d63c3970d1 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -71,6 +71,7 @@
+
+ extern struct workqueue_struct *ib_wq;
+ extern struct workqueue_struct *ib_comp_wq;
++extern struct workqueue_struct *ib_comp_unbound_wq;
+
+ union ib_gid {
+ u8 raw[16];
+@@ -1576,9 +1577,10 @@ struct ib_ah {
+ typedef void (*ib_comp_handler)(struct ib_cq *cq, void *cq_context);
+
+ enum ib_poll_context {
+- IB_POLL_DIRECT, /* caller context, no hw completions */
+- IB_POLL_SOFTIRQ, /* poll from softirq context */
+- IB_POLL_WORKQUEUE, /* poll from workqueue */
++ IB_POLL_DIRECT, /* caller context, no hw completions */
++ IB_POLL_SOFTIRQ, /* poll from softirq context */
++ IB_POLL_WORKQUEUE, /* poll from workqueue */
++ IB_POLL_UNBOUND_WORKQUEUE, /* poll from unbound workqueue */
+ };
+
+ struct ib_cq {
+@@ -1595,6 +1597,7 @@ struct ib_cq {
+ struct irq_poll iop;
+ struct work_struct work;
+ };
++ struct workqueue_struct *comp_wq;
+ /*
+ * Implementation details of the RDMA core, don't use in drivers:
+ */
+diff --git a/init/initramfs.c b/init/initramfs.c
+index cd5fb00fcb54..dab8d63459f6 100644
+--- a/init/initramfs.c
++++ b/init/initramfs.c
+@@ -524,7 +524,7 @@ static void __init free_initrd(void)
+ unsigned long crashk_start = (unsigned long)__va(crashk_res.start);
+ unsigned long crashk_end = (unsigned long)__va(crashk_res.end);
+ #endif
+- if (do_retain_initrd)
++ if (do_retain_initrd || !initrd_start)
+ goto skip;
+
+ #ifdef CONFIG_KEXEC_CORE
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index e810e8cb17e1..1e272f6a01e7 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -3605,6 +3605,9 @@ static int __lock_downgrade(struct lockdep_map *lock, unsigned long ip)
+ unsigned int depth;
+ int i;
+
++ if (unlikely(!debug_locks))
++ return 0;
++
+ depth = curr->lockdep_depth;
+ /*
+ * This function is about (re)setting the class of a held lock,
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 0adcddb211fa..3e7badb3ac2d 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -5545,11 +5545,6 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
+ return send_conn_param_neg_reply(hdev, handle,
+ HCI_ERROR_UNKNOWN_CONN_ID);
+
+- if (min < hcon->le_conn_min_interval ||
+- max > hcon->le_conn_max_interval)
+- return send_conn_param_neg_reply(hdev, handle,
+- HCI_ERROR_INVALID_LL_PARAMS);
+-
+ if (hci_check_conn_params(min, max, latency, timeout))
+ return send_conn_param_neg_reply(hdev, handle,
+ HCI_ERROR_INVALID_LL_PARAMS);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index a54dadf4a6ca..260ef5426e0c 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -5287,14 +5287,7 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
+
+ memset(&rsp, 0, sizeof(rsp));
+
+- if (min < hcon->le_conn_min_interval ||
+- max > hcon->le_conn_max_interval) {
+- BT_DBG("requested connection interval exceeds current bounds.");
+- err = -EINVAL;
+- } else {
+- err = hci_check_conn_params(min, max, latency, to_multiplier);
+- }
+-
++ err = hci_check_conn_params(min, max, latency, to_multiplier);
+ if (err)
+ rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
+ else
+diff --git a/net/ipv4/raw_diag.c b/net/ipv4/raw_diag.c
+index c200065ef9a5..6367ecdf76c4 100644
+--- a/net/ipv4/raw_diag.c
++++ b/net/ipv4/raw_diag.c
+@@ -23,9 +23,6 @@ raw_get_hashinfo(const struct inet_diag_req_v2 *r)
+ return &raw_v6_hashinfo;
+ #endif
+ } else {
+- pr_warn_once("Unexpected inet family %d\n",
+- r->sdiag_family);
+- WARN_ON_ONCE(1);
+ return ERR_PTR(-EINVAL);
+ }
+ }
+diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
+index d7f3776dfd71..637ce3e8c575 100644
+--- a/net/netfilter/nft_socket.c
++++ b/net/netfilter/nft_socket.c
+@@ -47,9 +47,6 @@ static void nft_socket_eval(const struct nft_expr *expr,
+ return;
+ }
+
+- /* So that subsequent socket matching not to require other lookups. */
+- skb->sk = sk;
+-
+ switch(priv->key) {
+ case NFT_SOCKET_TRANSPARENT:
+ nft_reg_store8(dest, inet_sk_transparent(sk));
+@@ -66,6 +63,9 @@ static void nft_socket_eval(const struct nft_expr *expr,
+ WARN_ON(1);
+ regs->verdict.code = NFT_BREAK;
+ }
++
++ if (sk != skb->sk)
++ sock_gen_put(sk);
+ }
+
+ static const struct nla_policy nft_socket_policy[NFTA_SOCKET_MAX + 1] = {
+diff --git a/net/rds/bind.c b/net/rds/bind.c
+index 0f4398e7f2a7..93e336535d3b 100644
+--- a/net/rds/bind.c
++++ b/net/rds/bind.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2006, 2018 Oracle and/or its affiliates. All rights reserved.
++ * Copyright (c) 2006, 2019 Oracle and/or its affiliates. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses. You may choose to be licensed under the terms of the GNU
+@@ -239,34 +239,33 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ goto out;
+ }
+
+- sock_set_flag(sk, SOCK_RCU_FREE);
+- ret = rds_add_bound(rs, binding_addr, &port, scope_id);
+- if (ret)
+- goto out;
+-
+- if (rs->rs_transport) { /* previously bound */
++ /* The transport can be set using SO_RDS_TRANSPORT option before the
++ * socket is bound.
++ */
++ if (rs->rs_transport) {
+ trans = rs->rs_transport;
+- if (trans->laddr_check(sock_net(sock->sk),
++ if (!trans->laddr_check ||
++ trans->laddr_check(sock_net(sock->sk),
+ binding_addr, scope_id) != 0) {
+ ret = -ENOPROTOOPT;
+- rds_remove_bound(rs);
+- } else {
+- ret = 0;
++ goto out;
+ }
+- goto out;
+- }
+- trans = rds_trans_get_preferred(sock_net(sock->sk), binding_addr,
+- scope_id);
+- if (!trans) {
+- ret = -EADDRNOTAVAIL;
+- rds_remove_bound(rs);
+- pr_info_ratelimited("RDS: %s could not find a transport for %pI6c, load rds_tcp or rds_rdma?\n",
+- __func__, binding_addr);
+- goto out;
++ } else {
++ trans = rds_trans_get_preferred(sock_net(sock->sk),
++ binding_addr, scope_id);
++ if (!trans) {
++ ret = -EADDRNOTAVAIL;
++ pr_info_ratelimited("RDS: %s could not find a transport for %pI6c, load rds_tcp or rds_rdma?\n",
++ __func__, binding_addr);
++ goto out;
++ }
++ rs->rs_transport = trans;
+ }
+
+- rs->rs_transport = trans;
+- ret = 0;
++ sock_set_flag(sk, SOCK_RCU_FREE);
++ ret = rds_add_bound(rs, binding_addr, &port, scope_id);
++ if (ret)
++ rs->rs_transport = NULL;
+
+ out:
+ release_sock(sk);
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index be7cd140b2a3..b06cc5e50412 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1831,6 +1831,8 @@ static void tc_bind_tclass(struct Qdisc *q, u32 portid, u32 clid,
+ cl = cops->find(q, portid);
+ if (!cl)
+ return;
++ if (!cops->tcf_block)
++ return;
+ block = cops->tcf_block(q, cl, NULL);
+ if (!block)
+ return;
+diff --git a/sound/firewire/dice/dice-alesis.c b/sound/firewire/dice/dice-alesis.c
+index 218292bdace6..f5b325263b67 100644
+--- a/sound/firewire/dice/dice-alesis.c
++++ b/sound/firewire/dice/dice-alesis.c
+@@ -15,7 +15,7 @@ alesis_io14_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = {
+
+ static const unsigned int
+ alesis_io26_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = {
+- {10, 10, 8}, /* Tx0 = Analog + S/PDIF. */
++ {10, 10, 4}, /* Tx0 = Analog + S/PDIF. */
+ {16, 8, 0}, /* Tx1 = ADAT1 + ADAT2. */
+ };
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index c3e3d80ff720..0b24c5ce2fd6 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2662,8 +2662,7 @@ static const struct pci_device_id azx_ids[] = {
+ AZX_DCAPS_PM_RUNTIME },
+ /* AMD Raven */
+ { PCI_DEVICE(0x1022, 0x15e3),
+- .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
+- AZX_DCAPS_PM_RUNTIME },
++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
+ /* ATI HDMI */
+ { PCI_DEVICE(0x1002, 0x0002),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
+index fd476fb40e1b..677dcc0aca97 100644
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -370,6 +370,7 @@ static const struct hda_fixup ad1986a_fixups[] = {
+
+ static const struct snd_pci_quirk ad1986a_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x30af, "HP B2800", AD1986A_FIXUP_LAPTOP_IMIC),
++ SND_PCI_QUIRK(0x1043, 0x1153, "ASUS M9V", AD1986A_FIXUP_LAPTOP_IMIC),
+ SND_PCI_QUIRK(0x1043, 0x1443, "ASUS Z99He", AD1986A_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1043, 0x1447, "ASUS A8JN", AD1986A_FIXUP_EAPD),
+ SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8100, "ASUS P5", AD1986A_FIXUP_3STACK),
+diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
+index 0a648229e643..09b2967befd9 100644
+--- a/sound/soc/fsl/fsl_ssi.c
++++ b/sound/soc/fsl/fsl_ssi.c
+@@ -1439,8 +1439,10 @@ static int fsl_ssi_probe_from_dt(struct fsl_ssi *ssi)
+ * different name to register the device.
+ */
+ if (!ssi->card_name[0] && of_get_property(np, "codec-handle", NULL)) {
+- sprop = of_get_property(of_find_node_by_path("/"),
+- "compatible", NULL);
++ struct device_node *root = of_find_node_by_path("/");
++
++ sprop = of_get_property(root, "compatible", NULL);
++ of_node_put(root);
+ /* Strip "fsl," in the compatible name if applicable */
+ p = strrchr(sprop, ',');
+ if (p)
+diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+index 08a5152e635a..e7620017e725 100644
+--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
++++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+@@ -42,6 +42,7 @@ struct cht_mc_private {
+ struct clk *mclk;
+ struct snd_soc_jack jack;
+ bool ts3a227e_present;
++ int quirks;
+ };
+
+ static int platform_clock_control(struct snd_soc_dapm_widget *w,
+@@ -53,6 +54,10 @@ static int platform_clock_control(struct snd_soc_dapm_widget *w,
+ struct cht_mc_private *ctx = snd_soc_card_get_drvdata(card);
+ int ret;
+
++ /* See the comment in snd_cht_mc_probe() */
++ if (ctx->quirks & QUIRK_PMC_PLT_CLK_0)
++ return 0;
++
+ codec_dai = snd_soc_card_get_codec_dai(card, CHT_CODEC_DAI);
+ if (!codec_dai) {
+ dev_err(card->dev, "Codec dai not found; Unable to set platform clock\n");
+@@ -222,6 +227,10 @@ static int cht_codec_init(struct snd_soc_pcm_runtime *runtime)
+ "jack detection gpios not added, error %d\n", ret);
+ }
+
++ /* See the comment in snd_cht_mc_probe() */
++ if (ctx->quirks & QUIRK_PMC_PLT_CLK_0)
++ return 0;
++
+ /*
+ * The firmware might enable the clock at
+ * boot (this information may or may not
+@@ -420,16 +429,15 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
+ int ret_val = 0;
+ struct cht_mc_private *drv;
+ const char *mclk_name;
+- int quirks = 0;
+-
+- dmi_id = dmi_first_match(cht_max98090_quirk_table);
+- if (dmi_id)
+- quirks = (unsigned long)dmi_id->driver_data;
+
+ drv = devm_kzalloc(&pdev->dev, sizeof(*drv), GFP_KERNEL);
+ if (!drv)
+ return -ENOMEM;
+
++ dmi_id = dmi_first_match(cht_max98090_quirk_table);
++ if (dmi_id)
++ drv->quirks = (unsigned long)dmi_id->driver_data;
++
+ drv->ts3a227e_present = acpi_dev_found("104C227E");
+ if (!drv->ts3a227e_present) {
+ /* no need probe TI jack detection chip */
+@@ -446,7 +454,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
+ snd_soc_card_cht.dev = &pdev->dev;
+ snd_soc_card_set_drvdata(&snd_soc_card_cht, drv);
+
+- if (quirks & QUIRK_PMC_PLT_CLK_0)
++ if (drv->quirks & QUIRK_PMC_PLT_CLK_0)
+ mclk_name = "pmc_plt_clk_0";
+ else
+ mclk_name = "pmc_plt_clk_3";
+@@ -459,6 +467,21 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
+ return PTR_ERR(drv->mclk);
+ }
+
++ /*
++ * Boards which have the MAX98090's clk connected to clk_0 do not seem
++ * to like it if we muck with the clock. If we disable the clock when
++ * it is unused we get "max98090 i2c-193C9890:00: PLL unlocked" errors
++ * and the PLL never seems to lock again.
++ * So for these boards we enable it here once and leave it at that.
++ */
++ if (drv->quirks & QUIRK_PMC_PLT_CLK_0) {
++ ret_val = clk_prepare_enable(drv->mclk);
++ if (ret_val < 0) {
++ dev_err(&pdev->dev, "MCLK enable error: %d\n", ret_val);
++ return ret_val;
++ }
++ }
++
+ ret_val = devm_snd_soc_register_card(&pdev->dev, &snd_soc_card_cht);
+ if (ret_val) {
+ dev_err(&pdev->dev,
+@@ -469,11 +492,23 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
+ return ret_val;
+ }
+
++static int snd_cht_mc_remove(struct platform_device *pdev)
++{
++ struct snd_soc_card *card = platform_get_drvdata(pdev);
++ struct cht_mc_private *ctx = snd_soc_card_get_drvdata(card);
++
++ if (ctx->quirks & QUIRK_PMC_PLT_CLK_0)
++ clk_disable_unprepare(ctx->mclk);
++
++ return 0;
++}
++
+ static struct platform_driver snd_cht_mc_driver = {
+ .driver = {
+ .name = "cht-bsw-max98090",
+ },
+ .probe = snd_cht_mc_probe,
++ .remove = snd_cht_mc_remove,
+ };
+
+ module_platform_driver(snd_cht_mc_driver)
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index d71e01954975..60d00091f64b 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1449,6 +1449,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ case 0x152a: /* Thesycon devices */
+ case 0x25ce: /* Mytek devices */
+ case 0x2ab6: /* T+A devices */
++ case 0x3842: /* EVGA */
++ case 0xc502: /* HiBy devices */
+ if (fp->dsd_raw)
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
+index dd0b68d1f4be..482025b72839 100644
+--- a/tools/lib/bpf/bpf.c
++++ b/tools/lib/bpf/bpf.c
+@@ -75,6 +75,17 @@ static inline int sys_bpf(enum bpf_cmd cmd, union bpf_attr *attr,
+ return syscall(__NR_bpf, cmd, attr, size);
+ }
+
++static inline int sys_bpf_prog_load(union bpf_attr *attr, unsigned int size)
++{
++ int fd;
++
++ do {
++ fd = sys_bpf(BPF_PROG_LOAD, attr, size);
++ } while (fd < 0 && errno == EAGAIN);
++
++ return fd;
++}
++
+ int bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr)
+ {
+ __u32 name_len = create_attr->name ? strlen(create_attr->name) : 0;
+@@ -218,7 +229,7 @@ int bpf_load_program_xattr(const struct bpf_load_program_attr *load_attr,
+ memcpy(attr.prog_name, load_attr->name,
+ min(name_len, BPF_OBJ_NAME_LEN - 1));
+
+- fd = sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
++ fd = sys_bpf_prog_load(&attr, sizeof(attr));
+ if (fd >= 0 || !log_buf || !log_buf_sz)
+ return fd;
+
+@@ -227,7 +238,7 @@ int bpf_load_program_xattr(const struct bpf_load_program_attr *load_attr,
+ attr.log_size = log_buf_sz;
+ attr.log_level = 1;
+ log_buf[0] = 0;
+- return sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
++ return sys_bpf_prog_load(&attr, sizeof(attr));
+ }
+
+ int bpf_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+@@ -268,7 +279,7 @@ int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+ attr.kern_version = kern_version;
+ attr.prog_flags = strict_alignment ? BPF_F_STRICT_ALIGNMENT : 0;
+
+- return sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
++ return sys_bpf_prog_load(&attr, sizeof(attr));
+ }
+
+ int bpf_map_update_elem(int fd, const void *key, const void *value,
+diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
+index 88158239622b..20f67fcf378d 100644
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -35,7 +35,7 @@ INCLUDES := -I$(srctree)/tools/include \
+ -I$(srctree)/tools/arch/$(HOSTARCH)/include/uapi \
+ -I$(srctree)/tools/objtool/arch/$(ARCH)/include
+ WARNINGS := $(EXTRA_WARNINGS) -Wno-switch-default -Wno-switch-enum -Wno-packed
+-CFLAGS += -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -g $(INCLUDES) $(LIBELF_FLAGS)
++CFLAGS := -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -g $(INCLUDES) $(LIBELF_FLAGS)
+ LDFLAGS += $(LIBELF_LIBS) $(LIBSUBCMD) $(KBUILD_HOSTLDFLAGS)
+
+ # Allow old libelf to be used:
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-10-05 11:42 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-10-05 11:42 UTC (permalink / raw
To: gentoo-commits
commit: 78f3e56944444ae953990be586ca8067a7653d5b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 5 11:41:52 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Oct 5 11:41:52 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=78f3e569
Linux patch 4.19.77
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1076_linux-4.19.77.patch | 7298 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 7302 insertions(+)
diff --git a/0000_README b/0000_README
index 871922b..a687ae2 100644
--- a/0000_README
+++ b/0000_README
@@ -343,6 +343,10 @@ Patch: 1075_linux-4.19.76.patch
From: https://www.kernel.org
Desc: Linux 4.19.76
+Patch: 1076_linux-4.19.77.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.77
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1076_linux-4.19.77.patch b/1076_linux-4.19.77.patch
new file mode 100644
index 0000000..c003ebc
--- /dev/null
+++ b/1076_linux-4.19.77.patch
@@ -0,0 +1,7298 @@
+diff --git a/Makefile b/Makefile
+index 9cb471a75a1b..aeabc6459acc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 76
++SUBLEVEL = 77
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+index 57c2332bf282..25bdc9d97a4d 100644
+--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
++++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+@@ -437,6 +437,7 @@
+ regulator-name = "vdd_ldo10";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-state-mem {
+ regulator-off-in-suspend;
+ };
+diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+index d80ab9085da1..7989631b39cc 100644
+--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts
++++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+@@ -437,6 +437,7 @@
+ regulator-name = "vdd_ldo10";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-state-mem {
+ regulator-off-in-suspend;
+ };
+diff --git a/arch/arm/boot/dts/imx7-colibri.dtsi b/arch/arm/boot/dts/imx7-colibri.dtsi
+index 895fbde4d433..c1ed83131b49 100644
+--- a/arch/arm/boot/dts/imx7-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7-colibri.dtsi
+@@ -323,6 +323,7 @@
+ vmmc-supply = <®_module_3v3>;
+ vqmmc-supply = <®_DCDC3>;
+ non-removable;
++ sdhci-caps-mask = <0x80000000 0x0>;
+ };
+
+ &iomuxc {
+diff --git a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
+index 8bf365d28cac..584418f517a8 100644
+--- a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
++++ b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
+@@ -43,7 +43,7 @@
+ <&clks IMX7D_ENET1_TIME_ROOT_CLK>;
+ assigned-clock-parents = <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>;
+ assigned-clock-rates = <0>, <100000000>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <ðphy0>;
+ fsl,magic-packet;
+ status = "okay";
+@@ -69,7 +69,7 @@
+ <&clks IMX7D_ENET2_TIME_ROOT_CLK>;
+ assigned-clock-parents = <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>;
+ assigned-clock-rates = <0>, <100000000>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <ðphy1>;
+ fsl,magic-packet;
+ status = "okay";
+diff --git a/arch/arm/mach-zynq/platsmp.c b/arch/arm/mach-zynq/platsmp.c
+index caa6d5fe9078..b296ada97409 100644
+--- a/arch/arm/mach-zynq/platsmp.c
++++ b/arch/arm/mach-zynq/platsmp.c
+@@ -65,7 +65,7 @@ int zynq_cpun_start(u32 address, int cpu)
+ * 0x4: Jump by mov instruction
+ * 0x8: Jumping address
+ */
+- memcpy((__force void *)zero, &zynq_secondary_trampoline,
++ memcpy_toio(zero, &zynq_secondary_trampoline,
+ trampoline_size);
+ writel(address, zero + trampoline_size);
+
+diff --git a/arch/arm/plat-samsung/watchdog-reset.c b/arch/arm/plat-samsung/watchdog-reset.c
+index ce42cc640a61..71d85ff323f7 100644
+--- a/arch/arm/plat-samsung/watchdog-reset.c
++++ b/arch/arm/plat-samsung/watchdog-reset.c
+@@ -62,6 +62,7 @@ void samsung_wdt_reset(void)
+ #ifdef CONFIG_OF
+ static const struct of_device_id s3c2410_wdt_match[] = {
+ { .compatible = "samsung,s3c2410-wdt" },
++ { .compatible = "samsung,s3c6410-wdt" },
+ {},
+ };
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index e065394360bb..92186edefeb9 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -708,6 +708,7 @@
+ <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>;
+ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ fifo-depth = <0x100>;
++ max-frequency = <150000000>;
+ status = "disabled";
+ };
+
+@@ -719,6 +720,7 @@
+ <&cru SCLK_SDIO_DRV>, <&cru SCLK_SDIO_SAMPLE>;
+ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ fifo-depth = <0x100>;
++ max-frequency = <150000000>;
+ status = "disabled";
+ };
+
+@@ -730,6 +732,7 @@
+ <&cru SCLK_EMMC_DRV>, <&cru SCLK_EMMC_SAMPLE>;
+ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ fifo-depth = <0x100>;
++ max-frequency = <150000000>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
+index b4a48419769f..9b7d5abd04af 100644
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -62,14 +62,6 @@
+ #define MIDR_CPU_MODEL_MASK (MIDR_IMPLEMENTOR_MASK | MIDR_PARTNUM_MASK | \
+ MIDR_ARCHITECTURE_MASK)
+
+-#define MIDR_IS_CPU_MODEL_RANGE(midr, model, rv_min, rv_max) \
+-({ \
+- u32 _model = (midr) & MIDR_CPU_MODEL_MASK; \
+- u32 rv = (midr) & (MIDR_REVISION_MASK | MIDR_VARIANT_MASK); \
+- \
+- _model == (model) && rv >= (rv_min) && rv <= (rv_max); \
+- })
+-
+ #define ARM_CPU_IMP_ARM 0x41
+ #define ARM_CPU_IMP_APM 0x50
+ #define ARM_CPU_IMP_CAVIUM 0x43
+@@ -153,10 +145,19 @@ struct midr_range {
+
+ #define MIDR_ALL_VERSIONS(m) MIDR_RANGE(m, 0, 0, 0xf, 0xf)
+
++static inline bool midr_is_cpu_model_range(u32 midr, u32 model, u32 rv_min,
++ u32 rv_max)
++{
++ u32 _model = midr & MIDR_CPU_MODEL_MASK;
++ u32 rv = midr & (MIDR_REVISION_MASK | MIDR_VARIANT_MASK);
++
++ return _model == model && rv >= rv_min && rv <= rv_max;
++}
++
+ static inline bool is_midr_in_range(u32 midr, struct midr_range const *range)
+ {
+- return MIDR_IS_CPU_MODEL_RANGE(midr, range->model,
+- range->rv_min, range->rv_max);
++ return midr_is_cpu_model_range(midr, range->model,
++ range->rv_min, range->rv_max);
+ }
+
+ static inline bool
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 2214a403f39b..212a48826655 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -224,8 +224,10 @@ static inline void set_pte(pte_t *ptep, pte_t pte)
+ * Only if the new pte is valid and kernel, otherwise TLB maintenance
+ * or update_mmu_cache() have the necessary barriers.
+ */
+- if (pte_valid_not_user(pte))
++ if (pte_valid_not_user(pte)) {
+ dsb(ishst);
++ isb();
++ }
+ }
+
+ extern void __sync_icache_dcache(pte_t pteval);
+@@ -432,6 +434,7 @@ static inline void set_pmd(pmd_t *pmdp, pmd_t pmd)
+ {
+ WRITE_ONCE(*pmdp, pmd);
+ dsb(ishst);
++ isb();
+ }
+
+ static inline void pmd_clear(pmd_t *pmdp)
+@@ -483,6 +486,7 @@ static inline void set_pud(pud_t *pudp, pud_t pud)
+ {
+ WRITE_ONCE(*pudp, pud);
+ dsb(ishst);
++ isb();
+ }
+
+ static inline void pud_clear(pud_t *pudp)
+diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
+index a4a1901140ee..fc247b96619c 100644
+--- a/arch/arm64/include/asm/tlbflush.h
++++ b/arch/arm64/include/asm/tlbflush.h
+@@ -224,6 +224,7 @@ static inline void __flush_tlb_kernel_pgtable(unsigned long kaddr)
+
+ __tlbi(vaae1is, addr);
+ dsb(ish);
++ isb();
+ }
+ #endif
+
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index 859d63cc99a3..a897efdb3ddd 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -846,7 +846,7 @@ static bool has_no_hw_prefetch(const struct arm64_cpu_capabilities *entry, int _
+ u32 midr = read_cpuid_id();
+
+ /* Cavium ThunderX pass 1.x and 2.x */
+- return MIDR_IS_CPU_MODEL_RANGE(midr, MIDR_THUNDERX,
++ return midr_is_cpu_model_range(midr, MIDR_THUNDERX,
+ MIDR_CPU_VAR_REV(0, 0),
+ MIDR_CPU_VAR_REV(1, MIDR_REVISION_MASK));
+ }
+diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
+index 8cce091b6c21..ec6aa1863316 100644
+--- a/arch/arm64/mm/proc.S
++++ b/arch/arm64/mm/proc.S
+@@ -294,6 +294,15 @@ skip_pgd:
+ msr sctlr_el1, x18
+ isb
+
++ /*
++ * Invalidate the local I-cache so that any instructions fetched
++ * speculatively from the PoC are discarded, since they may have
++ * been dynamically patched at the PoU.
++ */
++ ic iallu
++ dsb nsh
++ isb
++
+ /* Set the flag to zero to indicate that we're all done */
+ str wzr, [flag_ptr]
+ ret
+diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
+index 326448f9df16..1a42ba885188 100644
+--- a/arch/ia64/kernel/module.c
++++ b/arch/ia64/kernel/module.c
+@@ -914,10 +914,14 @@ module_finalize (const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs, struct module *mo
+ void
+ module_arch_cleanup (struct module *mod)
+ {
+- if (mod->arch.init_unw_table)
++ if (mod->arch.init_unw_table) {
+ unw_remove_unwind_table(mod->arch.init_unw_table);
+- if (mod->arch.core_unw_table)
++ mod->arch.init_unw_table = NULL;
++ }
++ if (mod->arch.core_unw_table) {
+ unw_remove_unwind_table(mod->arch.core_unw_table);
++ mod->arch.core_unw_table = NULL;
++ }
+ }
+
+ void *dereference_module_function_descriptor(struct module *mod, void *ptr)
+diff --git a/arch/m68k/include/asm/atarihw.h b/arch/m68k/include/asm/atarihw.h
+index 9000b249d225..407a617fa3a2 100644
+--- a/arch/m68k/include/asm/atarihw.h
++++ b/arch/m68k/include/asm/atarihw.h
+@@ -22,7 +22,6 @@
+
+ #include <linux/types.h>
+ #include <asm/bootinfo-atari.h>
+-#include <asm/raw_io.h>
+ #include <asm/kmap.h>
+
+ extern u_long atari_mch_cookie;
+@@ -126,14 +125,6 @@ extern struct atari_hw_present atari_hw_present;
+ */
+
+
+-#define atari_readb raw_inb
+-#define atari_writeb raw_outb
+-
+-#define atari_inb_p raw_inb
+-#define atari_outb_p raw_outb
+-
+-
+-
+ #include <linux/mm.h>
+ #include <asm/cacheflush.h>
+
+diff --git a/arch/m68k/include/asm/io_mm.h b/arch/m68k/include/asm/io_mm.h
+index 782b78f8a048..e056feabbaf0 100644
+--- a/arch/m68k/include/asm/io_mm.h
++++ b/arch/m68k/include/asm/io_mm.h
+@@ -29,7 +29,11 @@
+ #include <asm-generic/iomap.h>
+
+ #ifdef CONFIG_ATARI
+-#include <asm/atarihw.h>
++#define atari_readb raw_inb
++#define atari_writeb raw_outb
++
++#define atari_inb_p raw_inb
++#define atari_outb_p raw_outb
+ #endif
+
+
+diff --git a/arch/m68k/include/asm/macintosh.h b/arch/m68k/include/asm/macintosh.h
+index 08cee11180e6..e441517785fd 100644
+--- a/arch/m68k/include/asm/macintosh.h
++++ b/arch/m68k/include/asm/macintosh.h
+@@ -4,6 +4,7 @@
+
+ #include <linux/seq_file.h>
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
+
+ #include <asm/bootinfo-mac.h>
+
+diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c
+index 828f6656f8f7..649fb268f446 100644
+--- a/arch/powerpc/platforms/powernv/opal-imc.c
++++ b/arch/powerpc/platforms/powernv/opal-imc.c
+@@ -57,9 +57,9 @@ static void export_imc_mode_and_cmd(struct device_node *node,
+ struct imc_pmu *pmu_ptr)
+ {
+ static u64 loc, *imc_mode_addr, *imc_cmd_addr;
+- int chip = 0, nid;
+ char mode[16], cmd[16];
+ u32 cb_offset;
++ struct imc_mem_info *ptr = pmu_ptr->mem_info;
+
+ imc_debugfs_parent = debugfs_create_dir("imc", powerpc_debugfs_root);
+
+@@ -73,20 +73,20 @@ static void export_imc_mode_and_cmd(struct device_node *node,
+ if (of_property_read_u32(node, "cb_offset", &cb_offset))
+ cb_offset = IMC_CNTL_BLK_OFFSET;
+
+- for_each_node(nid) {
+- loc = (u64)(pmu_ptr->mem_info[chip].vbase) + cb_offset;
++ while (ptr->vbase != NULL) {
++ loc = (u64)(ptr->vbase) + cb_offset;
+ imc_mode_addr = (u64 *)(loc + IMC_CNTL_BLK_MODE_OFFSET);
+- sprintf(mode, "imc_mode_%d", nid);
++ sprintf(mode, "imc_mode_%d", (u32)(ptr->id));
+ if (!imc_debugfs_create_x64(mode, 0600, imc_debugfs_parent,
+ imc_mode_addr))
+ goto err;
+
+ imc_cmd_addr = (u64 *)(loc + IMC_CNTL_BLK_CMD_OFFSET);
+- sprintf(cmd, "imc_cmd_%d", nid);
++ sprintf(cmd, "imc_cmd_%d", (u32)(ptr->id));
+ if (!imc_debugfs_create_x64(cmd, 0600, imc_debugfs_parent,
+ imc_cmd_addr))
+ goto err;
+- chip++;
++ ptr++;
+ }
+ return;
+
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index 8ff7cb3da1cb..2bc189187ed4 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -585,6 +585,9 @@ static int xts_aes_encrypt(struct blkcipher_desc *desc,
+ struct s390_xts_ctx *xts_ctx = crypto_blkcipher_ctx(desc->tfm);
+ struct blkcipher_walk walk;
+
++ if (!nbytes)
++ return -EINVAL;
++
+ if (unlikely(!xts_ctx->fc))
+ return xts_fallback_encrypt(desc, dst, src, nbytes);
+
+@@ -599,6 +602,9 @@ static int xts_aes_decrypt(struct blkcipher_desc *desc,
+ struct s390_xts_ctx *xts_ctx = crypto_blkcipher_ctx(desc->tfm);
+ struct blkcipher_walk walk;
+
++ if (!nbytes)
++ return -EINVAL;
++
+ if (unlikely(!xts_ctx->fc))
+ return xts_fallback_decrypt(desc, dst, src, nbytes);
+
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index aebedbaf5260..5d0b72f28140 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -58,6 +58,9 @@
+ #define INTEL_FAM6_ICELAKE_MOBILE 0x7E
+ #define INTEL_FAM6_ICELAKE_NNPI 0x9D
+
++#define INTEL_FAM6_TIGERLAKE_L 0x8C
++#define INTEL_FAM6_TIGERLAKE 0x8D
++
+ /* "Small Core" Processors (Atom) */
+
+ #define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index b316bd61a6ac..dfdd1caf0d55 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1450,54 +1450,72 @@ static void lapic_setup_esr(void)
+ oldvalue, value);
+ }
+
+-static void apic_pending_intr_clear(void)
++#define APIC_IR_REGS APIC_ISR_NR
++#define APIC_IR_BITS (APIC_IR_REGS * 32)
++#define APIC_IR_MAPSIZE (APIC_IR_BITS / BITS_PER_LONG)
++
++union apic_ir {
++ unsigned long map[APIC_IR_MAPSIZE];
++ u32 regs[APIC_IR_REGS];
++};
++
++static bool apic_check_and_ack(union apic_ir *irr, union apic_ir *isr)
+ {
+- long long max_loops = cpu_khz ? cpu_khz : 1000000;
+- unsigned long long tsc = 0, ntsc;
+- unsigned int queued;
+- unsigned long value;
+- int i, j, acked = 0;
++ int i, bit;
++
++ /* Read the IRRs */
++ for (i = 0; i < APIC_IR_REGS; i++)
++ irr->regs[i] = apic_read(APIC_IRR + i * 0x10);
++
++ /* Read the ISRs */
++ for (i = 0; i < APIC_IR_REGS; i++)
++ isr->regs[i] = apic_read(APIC_ISR + i * 0x10);
+
+- if (boot_cpu_has(X86_FEATURE_TSC))
+- tsc = rdtsc();
+ /*
+- * After a crash, we no longer service the interrupts and a pending
+- * interrupt from previous kernel might still have ISR bit set.
+- *
+- * Most probably by now CPU has serviced that pending interrupt and
+- * it might not have done the ack_APIC_irq() because it thought,
+- * interrupt came from i8259 as ExtInt. LAPIC did not get EOI so it
+- * does not clear the ISR bit and cpu thinks it has already serivced
+- * the interrupt. Hence a vector might get locked. It was noticed
+- * for timer irq (vector 0x31). Issue an extra EOI to clear ISR.
++ * If the ISR map is not empty. ACK the APIC and run another round
++ * to verify whether a pending IRR has been unblocked and turned
++ * into a ISR.
+ */
+- do {
+- queued = 0;
+- for (i = APIC_ISR_NR - 1; i >= 0; i--)
+- queued |= apic_read(APIC_IRR + i*0x10);
+-
+- for (i = APIC_ISR_NR - 1; i >= 0; i--) {
+- value = apic_read(APIC_ISR + i*0x10);
+- for_each_set_bit(j, &value, 32) {
+- ack_APIC_irq();
+- acked++;
+- }
+- }
+- if (acked > 256) {
+- pr_err("LAPIC pending interrupts after %d EOI\n", acked);
+- break;
+- }
+- if (queued) {
+- if (boot_cpu_has(X86_FEATURE_TSC) && cpu_khz) {
+- ntsc = rdtsc();
+- max_loops = (long long)cpu_khz << 10;
+- max_loops -= ntsc - tsc;
+- } else {
+- max_loops--;
+- }
+- }
+- } while (queued && max_loops > 0);
+- WARN_ON(max_loops <= 0);
++ if (!bitmap_empty(isr->map, APIC_IR_BITS)) {
++ /*
++ * There can be multiple ISR bits set when a high priority
++ * interrupt preempted a lower priority one. Issue an ACK
++ * per set bit.
++ */
++ for_each_set_bit(bit, isr->map, APIC_IR_BITS)
++ ack_APIC_irq();
++ return true;
++ }
++
++ return !bitmap_empty(irr->map, APIC_IR_BITS);
++}
++
++/*
++ * After a crash, we no longer service the interrupts and a pending
++ * interrupt from previous kernel might still have ISR bit set.
++ *
++ * Most probably by now the CPU has serviced that pending interrupt and it
++ * might not have done the ack_APIC_irq() because it thought, interrupt
++ * came from i8259 as ExtInt. LAPIC did not get EOI so it does not clear
++ * the ISR bit and cpu thinks it has already serivced the interrupt. Hence
++ * a vector might get locked. It was noticed for timer irq (vector
++ * 0x31). Issue an extra EOI to clear ISR.
++ *
++ * If there are pending IRR bits they turn into ISR bits after a higher
++ * priority ISR bit has been acked.
++ */
++static void apic_pending_intr_clear(void)
++{
++ union apic_ir irr, isr;
++ unsigned int i;
++
++ /* 512 loops are way oversized and give the APIC a chance to obey. */
++ for (i = 0; i < 512; i++) {
++ if (!apic_check_and_ack(&irr, &isr))
++ return;
++ }
++ /* Dump the IRR/ISR content if that failed */
++ pr_warn("APIC: Stale IRR: %256pb ISR: %256pb\n", irr.map, isr.map);
+ }
+
+ /**
+@@ -1520,6 +1538,14 @@ static void setup_local_APIC(void)
+ return;
+ }
+
++ /*
++ * If this comes from kexec/kcrash the APIC might be enabled in
++ * SPIV. Soft disable it before doing further initialization.
++ */
++ value = apic_read(APIC_SPIV);
++ value &= ~APIC_SPIV_APIC_ENABLED;
++ apic_write(APIC_SPIV, value);
++
+ #ifdef CONFIG_X86_32
+ /* Pound the ESR really hard over the head with a big hammer - mbligh */
+ if (lapic_is_integrated() && apic->disable_esr) {
+@@ -1565,6 +1591,7 @@ static void setup_local_APIC(void)
+ value &= ~APIC_TPRI_MASK;
+ apic_write(APIC_TASKPRI, value);
+
++ /* Clear eventually stale ISR/IRR bits */
+ apic_pending_intr_clear();
+
+ /*
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index 10e1d17aa060..c352ca2e1456 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -400,6 +400,17 @@ static int activate_reserved(struct irq_data *irqd)
+ if (!irqd_can_reserve(irqd))
+ apicd->can_reserve = false;
+ }
++
++ /*
++ * Check to ensure that the effective affinity mask is a subset
++ * the user supplied affinity mask, and warn the user if it is not
++ */
++ if (!cpumask_subset(irq_data_get_effective_affinity_mask(irqd),
++ irq_data_get_affinity_mask(irqd))) {
++ pr_warn("irq %u: Affinity broken due to vector space exhaustion.\n",
++ irqd->irq);
++ }
++
+ return ret;
+ }
+
+diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
+index 04adc8d60aed..b2b87b91f336 100644
+--- a/arch/x86/kernel/smp.c
++++ b/arch/x86/kernel/smp.c
+@@ -181,6 +181,12 @@ asmlinkage __visible void smp_reboot_interrupt(void)
+ irq_exit();
+ }
+
++static int register_stop_handler(void)
++{
++ return register_nmi_handler(NMI_LOCAL, smp_stop_nmi_callback,
++ NMI_FLAG_FIRST, "smp_stop");
++}
++
+ static void native_stop_other_cpus(int wait)
+ {
+ unsigned long flags;
+@@ -214,39 +220,41 @@ static void native_stop_other_cpus(int wait)
+ apic->send_IPI_allbutself(REBOOT_VECTOR);
+
+ /*
+- * Don't wait longer than a second if the caller
+- * didn't ask us to wait.
++ * Don't wait longer than a second for IPI completion. The
++ * wait request is not checked here because that would
++ * prevent an NMI shutdown attempt in case that not all
++ * CPUs reach shutdown state.
+ */
+ timeout = USEC_PER_SEC;
+- while (num_online_cpus() > 1 && (wait || timeout--))
++ while (num_online_cpus() > 1 && timeout--)
+ udelay(1);
+ }
+-
+- /* if the REBOOT_VECTOR didn't work, try with the NMI */
+- if ((num_online_cpus() > 1) && (!smp_no_nmi_ipi)) {
+- if (register_nmi_handler(NMI_LOCAL, smp_stop_nmi_callback,
+- NMI_FLAG_FIRST, "smp_stop"))
+- /* Note: we ignore failures here */
+- /* Hope the REBOOT_IRQ is good enough */
+- goto finish;
+-
+- /* sync above data before sending IRQ */
+- wmb();
+
+- pr_emerg("Shutting down cpus with NMI\n");
++ /* if the REBOOT_VECTOR didn't work, try with the NMI */
++ if (num_online_cpus() > 1) {
++ /*
++ * If NMI IPI is enabled, try to register the stop handler
++ * and send the IPI. In any case try to wait for the other
++ * CPUs to stop.
++ */
++ if (!smp_no_nmi_ipi && !register_stop_handler()) {
++ /* Sync above data before sending IRQ */
++ wmb();
+
+- apic->send_IPI_allbutself(NMI_VECTOR);
++ pr_emerg("Shutting down cpus with NMI\n");
+
++ apic->send_IPI_allbutself(NMI_VECTOR);
++ }
+ /*
+- * Don't wait longer than a 10 ms if the caller
+- * didn't ask us to wait.
++ * Don't wait longer than 10 ms if the caller didn't
++ * reqeust it. If wait is true, the machine hangs here if
++ * one or more CPUs do not reach shutdown state.
+ */
+ timeout = USEC_PER_MSEC * 10;
+ while (num_online_cpus() > 1 && (wait || timeout--))
+ udelay(1);
+ }
+
+-finish:
+ local_irq_save(flags);
+ disable_local_APIC();
+ mcheck_cpu_clear(this_cpu_ptr(&cpu_info));
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 429728b35bca..e699f4d2a450 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -5368,6 +5368,8 @@ done_prefixes:
+ ctxt->memopp->addr.mem.ea + ctxt->_eip);
+
+ done:
++ if (rc == X86EMUL_PROPAGATE_FAULT)
++ ctxt->have_exception = true;
+ return (rc != X86EMUL_CONTINUE) ? EMULATION_FAILED : EMULATION_OK;
+ }
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index dbae8415cf4a..05cb5855255e 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -581,8 +581,14 @@ static int kvm_read_nested_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn,
+ data, offset, len, access);
+ }
+
++static inline u64 pdptr_rsvd_bits(struct kvm_vcpu *vcpu)
++{
++ return rsvd_bits(cpuid_maxphyaddr(vcpu), 63) | rsvd_bits(5, 8) |
++ rsvd_bits(1, 2);
++}
++
+ /*
+- * Load the pae pdptrs. Return true is they are all valid.
++ * Load the pae pdptrs. Return 1 if they are all valid, 0 otherwise.
+ */
+ int load_pdptrs(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, unsigned long cr3)
+ {
+@@ -601,8 +607,7 @@ int load_pdptrs(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, unsigned long cr3)
+ }
+ for (i = 0; i < ARRAY_SIZE(pdpte); ++i) {
+ if ((pdpte[i] & PT_PRESENT_MASK) &&
+- (pdpte[i] &
+- vcpu->arch.mmu.guest_rsvd_check.rsvd_bits_mask[0][2])) {
++ (pdpte[i] & pdptr_rsvd_bits(vcpu))) {
+ ret = 0;
+ goto out;
+ }
+@@ -6244,8 +6249,16 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
+ if (reexecute_instruction(vcpu, cr2, write_fault_to_spt,
+ emulation_type))
+ return EMULATE_DONE;
+- if (ctxt->have_exception && inject_emulated_exception(vcpu))
++ if (ctxt->have_exception) {
++ /*
++ * #UD should result in just EMULATION_FAILED, and trap-like
++ * exception should not be encountered during decode.
++ */
++ WARN_ON_ONCE(ctxt->exception.vector == UD_VECTOR ||
++ exception_type(ctxt->exception.vector) == EXCPT_TRAP);
++ inject_emulated_exception(vcpu);
+ return EMULATE_DONE;
++ }
+ if (emulation_type & EMULTYPE_SKIP)
+ return EMULATE_FAIL;
+ return handle_emulation_failure(vcpu, emulation_type);
+diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
+index 4df3e5c89d57..622d5968c979 100644
+--- a/arch/x86/mm/pti.c
++++ b/arch/x86/mm/pti.c
+@@ -338,13 +338,15 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
+
+ pud = pud_offset(p4d, addr);
+ if (pud_none(*pud)) {
+- addr += PUD_SIZE;
++ WARN_ON_ONCE(addr & ~PUD_MASK);
++ addr = round_up(addr + 1, PUD_SIZE);
+ continue;
+ }
+
+ pmd = pmd_offset(pud, addr);
+ if (pmd_none(*pmd)) {
+- addr += PMD_SIZE;
++ WARN_ON_ONCE(addr & ~PMD_MASK);
++ addr = round_up(addr + 1, PMD_SIZE);
+ continue;
+ }
+
+@@ -643,6 +645,8 @@ void __init pti_init(void)
+ */
+ void pti_finalize(void)
+ {
++ if (!boot_cpu_has(X86_FEATURE_PTI))
++ return;
+ /*
+ * We need to clone everything (again) that maps parts of the
+ * kernel image.
+diff --git a/block/blk-flush.c b/block/blk-flush.c
+index 87fc49daa2b4..256fa1ccc2bd 100644
+--- a/block/blk-flush.c
++++ b/block/blk-flush.c
+@@ -232,6 +232,16 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error)
+
+ /* release the tag's ownership to the req cloned from */
+ spin_lock_irqsave(&fq->mq_flush_lock, flags);
++
++ if (!refcount_dec_and_test(&flush_rq->ref)) {
++ fq->rq_status = error;
++ spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
++ return;
++ }
++
++ if (fq->rq_status != BLK_STS_OK)
++ error = fq->rq_status;
++
+ hctx = blk_mq_map_queue(q, flush_rq->mq_ctx->cpu);
+ if (!q->elevator) {
+ blk_mq_tag_set_rq(hctx, flush_rq->tag, fq->orig_rq);
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 7ea85ec52026..684acaa96db7 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -844,7 +844,10 @@ static void blk_mq_check_expired(struct blk_mq_hw_ctx *hctx,
+ */
+ if (blk_mq_req_expired(rq, next))
+ blk_mq_rq_timed_out(rq, reserved);
+- if (refcount_dec_and_test(&rq->ref))
++
++ if (is_flush_rq(rq, hctx))
++ rq->end_io(rq, 0);
++ else if (refcount_dec_and_test(&rq->ref))
+ __blk_mq_free_request(rq);
+ }
+
+diff --git a/block/blk.h b/block/blk.h
+index 11e4ca2f2cd4..1a5b67b57e6b 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -23,6 +23,7 @@ struct blk_flush_queue {
+ unsigned int flush_queue_delayed:1;
+ unsigned int flush_pending_idx:1;
+ unsigned int flush_running_idx:1;
++ blk_status_t rq_status;
+ unsigned long flush_pending_since;
+ struct list_head flush_queue[2];
+ struct list_head flush_data_in_flight;
+@@ -123,6 +124,12 @@ static inline void __blk_get_queue(struct request_queue *q)
+ kobject_get(&q->kobj);
+ }
+
++static inline bool
++is_flush_rq(struct request *req, struct blk_mq_hw_ctx *hctx)
++{
++ return hctx->fq->flush_rq == req;
++}
++
+ struct blk_flush_queue *blk_alloc_flush_queue(struct request_queue *q,
+ int node, int cmd_size, gfp_t flags);
+ void blk_free_flush_queue(struct blk_flush_queue *q);
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index fc447410ae4d..a448cdf56718 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -282,9 +282,13 @@ static int acpi_processor_get_info(struct acpi_device *device)
+ }
+
+ if (acpi_duplicate_processor_id(pr->acpi_id)) {
+- dev_err(&device->dev,
+- "Failed to get unique processor _UID (0x%x)\n",
+- pr->acpi_id);
++ if (pr->acpi_id == 0xff)
++ dev_info_once(&device->dev,
++ "Entry not well-defined, consider updating BIOS\n");
++ else
++ dev_err(&device->dev,
++ "Failed to get unique processor _UID (0x%x)\n",
++ pr->acpi_id);
+ return -ENODEV;
+ }
+
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index d9ce4b162e2c..a1aa59849b96 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -369,8 +369,10 @@ static int acpi_get_psd(struct cpc_desc *cpc_ptr, acpi_handle handle)
+ union acpi_object *psd = NULL;
+ struct acpi_psd_package *pdomain;
+
+- status = acpi_evaluate_object_typed(handle, "_PSD", NULL, &buffer,
+- ACPI_TYPE_PACKAGE);
++ status = acpi_evaluate_object_typed(handle, "_PSD", NULL,
++ &buffer, ACPI_TYPE_PACKAGE);
++ if (status == AE_NOT_FOUND) /* _PSD is optional */
++ return 0;
+ if (ACPI_FAILURE(status))
+ return -ENODEV;
+
+diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c
+index e967c1173ba3..222ea3f12f41 100644
+--- a/drivers/acpi/custom_method.c
++++ b/drivers/acpi/custom_method.c
+@@ -48,8 +48,10 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
+ if ((*ppos > max_size) ||
+ (*ppos + count > max_size) ||
+ (*ppos + count < count) ||
+- (count > uncopied_bytes))
++ (count > uncopied_bytes)) {
++ kfree(buf);
+ return -EINVAL;
++ }
+
+ if (copy_from_user(buf + (*ppos), user_buf, count)) {
+ kfree(buf);
+@@ -69,6 +71,7 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
+ add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE);
+ }
+
++ kfree(buf);
+ return count;
+ }
+
+diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
+index c576a6fe4ebb..94ded9513c73 100644
+--- a/drivers/acpi/pci_irq.c
++++ b/drivers/acpi/pci_irq.c
+@@ -462,8 +462,10 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
+ * No IRQ known to the ACPI subsystem - maybe the BIOS /
+ * driver reported one, then use it. Exit in any case.
+ */
+- if (!acpi_pci_irq_valid(dev, pin))
++ if (!acpi_pci_irq_valid(dev, pin)) {
++ kfree(entry);
+ return 0;
++ }
+
+ if (acpi_isa_register_gsi(dev))
+ dev_warn(&dev->dev, "PCI INT %c: no GSI\n",
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 021ce46e2e57..5d110b1362e7 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -81,6 +81,12 @@ enum board_ids {
+ board_ahci_sb700, /* for SB700 and SB800 */
+ board_ahci_vt8251,
+
++ /*
++ * board IDs for Intel chipsets that support more than 6 ports
++ * *and* end up needing the PCS quirk.
++ */
++ board_ahci_pcs7,
++
+ /* aliases */
+ board_ahci_mcp_linux = board_ahci_mcp65,
+ board_ahci_mcp67 = board_ahci_mcp65,
+@@ -236,6 +242,12 @@ static const struct ata_port_info ahci_port_info[] = {
+ .udma_mask = ATA_UDMA6,
+ .port_ops = &ahci_vt8251_ops,
+ },
++ [board_ahci_pcs7] = {
++ .flags = AHCI_FLAG_COMMON,
++ .pio_mask = ATA_PIO4,
++ .udma_mask = ATA_UDMA6,
++ .port_ops = &ahci_ops,
++ },
+ };
+
+ static const struct pci_device_id ahci_pci_tbl[] = {
+@@ -280,26 +292,26 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */
+ { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci_mobile }, /* PCH M RAID */
+ { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b0), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b1), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b2), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b3), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b4), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b5), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b6), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b7), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19bE), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19bF), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c0), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c1), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c2), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c3), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c4), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c5), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c6), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c7), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19cE), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19cF), board_ahci_pcs7 }, /* DNV AHCI */
+ { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */
+ { PCI_VDEVICE(INTEL, 0x1c03), board_ahci_mobile }, /* CPT M AHCI */
+ { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */
+@@ -639,30 +651,6 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
+ ahci_save_initial_config(&pdev->dev, hpriv);
+ }
+
+-static int ahci_pci_reset_controller(struct ata_host *host)
+-{
+- struct pci_dev *pdev = to_pci_dev(host->dev);
+- int rc;
+-
+- rc = ahci_reset_controller(host);
+- if (rc)
+- return rc;
+-
+- if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
+- struct ahci_host_priv *hpriv = host->private_data;
+- u16 tmp16;
+-
+- /* configure PCS */
+- pci_read_config_word(pdev, 0x92, &tmp16);
+- if ((tmp16 & hpriv->port_map) != hpriv->port_map) {
+- tmp16 |= hpriv->port_map;
+- pci_write_config_word(pdev, 0x92, tmp16);
+- }
+- }
+-
+- return 0;
+-}
+-
+ static void ahci_pci_init_controller(struct ata_host *host)
+ {
+ struct ahci_host_priv *hpriv = host->private_data;
+@@ -865,7 +853,7 @@ static int ahci_pci_device_runtime_resume(struct device *dev)
+ struct ata_host *host = pci_get_drvdata(pdev);
+ int rc;
+
+- rc = ahci_pci_reset_controller(host);
++ rc = ahci_reset_controller(host);
+ if (rc)
+ return rc;
+ ahci_pci_init_controller(host);
+@@ -900,7 +888,7 @@ static int ahci_pci_device_resume(struct device *dev)
+ ahci_mcp89_apple_enable(pdev);
+
+ if (pdev->dev.power.power_state.event == PM_EVENT_SUSPEND) {
+- rc = ahci_pci_reset_controller(host);
++ rc = ahci_reset_controller(host);
+ if (rc)
+ return rc;
+
+@@ -1635,6 +1623,34 @@ update_policy:
+ ap->target_lpm_policy = policy;
+ }
+
++static void ahci_intel_pcs_quirk(struct pci_dev *pdev, struct ahci_host_priv *hpriv)
++{
++ const struct pci_device_id *id = pci_match_id(ahci_pci_tbl, pdev);
++ u16 tmp16;
++
++ /*
++ * Only apply the 6-port PCS quirk for known legacy platforms.
++ */
++ if (!id || id->vendor != PCI_VENDOR_ID_INTEL)
++ return;
++ if (((enum board_ids) id->driver_data) < board_ahci_pcs7)
++ return;
++
++ /*
++ * port_map is determined from PORTS_IMPL PCI register which is
++ * implemented as write or write-once register. If the register
++ * isn't programmed, ahci automatically generates it from number
++ * of ports, which is good enough for PCS programming. It is
++ * otherwise expected that platform firmware enables the ports
++ * before the OS boots.
++ */
++ pci_read_config_word(pdev, PCS_6, &tmp16);
++ if ((tmp16 & hpriv->port_map) != hpriv->port_map) {
++ tmp16 |= hpriv->port_map;
++ pci_write_config_word(pdev, PCS_6, tmp16);
++ }
++}
++
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ unsigned int board_id = ent->driver_data;
+@@ -1747,6 +1763,12 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /* save initial config */
+ ahci_pci_save_initial_config(pdev, hpriv);
+
++ /*
++ * If platform firmware failed to enable ports, try to enable
++ * them here.
++ */
++ ahci_intel_pcs_quirk(pdev, hpriv);
++
+ /* prepare host */
+ if (hpriv->cap & HOST_CAP_NCQ) {
+ pi.flags |= ATA_FLAG_NCQ;
+@@ -1856,7 +1878,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (rc)
+ return rc;
+
+- rc = ahci_pci_reset_controller(host);
++ rc = ahci_reset_controller(host);
+ if (rc)
+ return rc;
+
+diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
+index 6a1515f0da40..9290e787abdc 100644
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -261,6 +261,8 @@ enum {
+ ATA_FLAG_ACPI_SATA | ATA_FLAG_AN,
+
+ ICH_MAP = 0x90, /* ICH MAP register */
++ PCS_6 = 0x92, /* 6 port PCS */
++ PCS_7 = 0x94, /* 7+ port PCS (Denverton) */
+
+ /* em constants */
+ EM_MAX_SLOTS = 8,
+diff --git a/drivers/base/soc.c b/drivers/base/soc.c
+index 10b280f30217..7e91894a380b 100644
+--- a/drivers/base/soc.c
++++ b/drivers/base/soc.c
+@@ -157,6 +157,7 @@ out2:
+ out1:
+ return ERR_PTR(ret);
+ }
++EXPORT_SYMBOL_GPL(soc_device_register);
+
+ /* Ensure soc_dev->attr is freed prior to calling soc_device_unregister. */
+ void soc_device_unregister(struct soc_device *soc_dev)
+@@ -166,6 +167,7 @@ void soc_device_unregister(struct soc_device *soc_dev)
+ device_unregister(&soc_dev->dev);
+ early_soc_dev_attr = NULL;
+ }
++EXPORT_SYMBOL_GPL(soc_device_unregister);
+
+ static int __init soc_bus_register(void)
+ {
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index cef8e00c9d9d..126c2c514673 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1719,6 +1719,7 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode,
+ case LOOP_SET_FD:
+ case LOOP_CHANGE_FD:
+ case LOOP_SET_BLOCK_SIZE:
++ case LOOP_SET_DIRECT_IO:
+ err = lo_ioctl(bdev, mode, cmd, arg);
+ break;
+ default:
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index fa60f265ee50..b1c7009de1f4 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -353,8 +353,10 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
+ }
+ config = nbd->config;
+
+- if (!mutex_trylock(&cmd->lock))
++ if (!mutex_trylock(&cmd->lock)) {
++ nbd_config_put(nbd);
+ return BLK_EH_RESET_TIMER;
++ }
+
+ if (config->num_connections > 1) {
+ dev_err_ratelimited(nbd_to_dev(nbd),
+diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
+index aaf9e5afaad4..0ef7cb0448e8 100644
+--- a/drivers/char/hw_random/core.c
++++ b/drivers/char/hw_random/core.c
+@@ -67,7 +67,7 @@ static void add_early_randomness(struct hwrng *rng)
+ size_t size = min_t(size_t, 16, rng_buffer_size());
+
+ mutex_lock(&reading_mutex);
+- bytes_read = rng_get_data(rng, rng_buffer, size, 1);
++ bytes_read = rng_get_data(rng, rng_buffer, size, 0);
+ mutex_unlock(&reading_mutex);
+ if (bytes_read > 0)
+ add_device_randomness(rng_buffer, bytes_read);
+diff --git a/drivers/char/mem.c b/drivers/char/mem.c
+index 7b4e4de778e4..54b86490d9ca 100644
+--- a/drivers/char/mem.c
++++ b/drivers/char/mem.c
+@@ -97,6 +97,13 @@ void __weak unxlate_dev_mem_ptr(phys_addr_t phys, void *addr)
+ }
+ #endif
+
++static inline bool should_stop_iteration(void)
++{
++ if (need_resched())
++ cond_resched();
++ return fatal_signal_pending(current);
++}
++
+ /*
+ * This funcion reads the *physical* memory. The f_pos points directly to the
+ * memory location.
+@@ -175,6 +182,8 @@ static ssize_t read_mem(struct file *file, char __user *buf,
+ p += sz;
+ count -= sz;
+ read += sz;
++ if (should_stop_iteration())
++ break;
+ }
+ kfree(bounce);
+
+@@ -251,6 +260,8 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
+ p += sz;
+ count -= sz;
+ written += sz;
++ if (should_stop_iteration())
++ break;
+ }
+
+ *ppos += written;
+@@ -468,6 +479,10 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
+ read += sz;
+ low_count -= sz;
+ count -= sz;
++ if (should_stop_iteration()) {
++ count = 0;
++ break;
++ }
+ }
+ }
+
+@@ -492,6 +507,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
+ buf += sz;
+ read += sz;
+ p += sz;
++ if (should_stop_iteration())
++ break;
+ }
+ free_page((unsigned long)kbuf);
+ }
+@@ -544,6 +561,8 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
+ p += sz;
+ count -= sz;
+ written += sz;
++ if (should_stop_iteration())
++ break;
+ }
+
+ *ppos += written;
+@@ -595,6 +614,8 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
+ buf += sz;
+ virtr += sz;
+ p += sz;
++ if (should_stop_iteration())
++ break;
+ }
+ free_page((unsigned long)kbuf);
+ }
+diff --git a/drivers/devfreq/exynos-bus.c b/drivers/devfreq/exynos-bus.c
+index c25658b26598..24a9658348d7 100644
+--- a/drivers/devfreq/exynos-bus.c
++++ b/drivers/devfreq/exynos-bus.c
+@@ -194,11 +194,10 @@ static void exynos_bus_exit(struct device *dev)
+ if (ret < 0)
+ dev_warn(dev, "failed to disable the devfreq-event devices\n");
+
+- if (bus->regulator)
+- regulator_disable(bus->regulator);
+-
+ dev_pm_opp_of_remove_table(dev);
+ clk_disable_unprepare(bus->clk);
++ if (bus->regulator)
++ regulator_disable(bus->regulator);
+ }
+
+ /*
+@@ -386,6 +385,7 @@ static int exynos_bus_probe(struct platform_device *pdev)
+ struct exynos_bus *bus;
+ int ret, max_state;
+ unsigned long min_freq, max_freq;
++ bool passive = false;
+
+ if (!np) {
+ dev_err(dev, "failed to find devicetree node\n");
+@@ -399,27 +399,27 @@ static int exynos_bus_probe(struct platform_device *pdev)
+ bus->dev = &pdev->dev;
+ platform_set_drvdata(pdev, bus);
+
+- /* Parse the device-tree to get the resource information */
+- ret = exynos_bus_parse_of(np, bus);
+- if (ret < 0)
+- return ret;
+-
+ profile = devm_kzalloc(dev, sizeof(*profile), GFP_KERNEL);
+- if (!profile) {
+- ret = -ENOMEM;
+- goto err;
+- }
++ if (!profile)
++ return -ENOMEM;
+
+ node = of_parse_phandle(dev->of_node, "devfreq", 0);
+ if (node) {
+ of_node_put(node);
+- goto passive;
++ passive = true;
+ } else {
+ ret = exynos_bus_parent_parse_of(np, bus);
++ if (ret < 0)
++ return ret;
+ }
+
++ /* Parse the device-tree to get the resource information */
++ ret = exynos_bus_parse_of(np, bus);
+ if (ret < 0)
+- goto err;
++ goto err_reg;
++
++ if (passive)
++ goto passive;
+
+ /* Initialize the struct profile and governor data for parent device */
+ profile->polling_ms = 50;
+@@ -510,6 +510,9 @@ out:
+ err:
+ dev_pm_opp_of_remove_table(dev);
+ clk_disable_unprepare(bus->clk);
++err_reg:
++ if (!passive)
++ regulator_disable(bus->regulator);
+
+ return ret;
+ }
+diff --git a/drivers/devfreq/governor_passive.c b/drivers/devfreq/governor_passive.c
+index 3bc29acbd54e..8cfb69749d49 100644
+--- a/drivers/devfreq/governor_passive.c
++++ b/drivers/devfreq/governor_passive.c
+@@ -152,7 +152,6 @@ static int devfreq_passive_notifier_call(struct notifier_block *nb,
+ static int devfreq_passive_event_handler(struct devfreq *devfreq,
+ unsigned int event, void *data)
+ {
+- struct device *dev = devfreq->dev.parent;
+ struct devfreq_passive_data *p_data
+ = (struct devfreq_passive_data *)devfreq->data;
+ struct devfreq *parent = (struct devfreq *)p_data->parent;
+@@ -168,12 +167,12 @@ static int devfreq_passive_event_handler(struct devfreq *devfreq,
+ p_data->this = devfreq;
+
+ nb->notifier_call = devfreq_passive_notifier_call;
+- ret = devm_devfreq_register_notifier(dev, parent, nb,
++ ret = devfreq_register_notifier(parent, nb,
+ DEVFREQ_TRANSITION_NOTIFIER);
+ break;
+ case DEVFREQ_GOV_STOP:
+- devm_devfreq_unregister_notifier(dev, parent, nb,
+- DEVFREQ_TRANSITION_NOTIFIER);
++ WARN_ON(devfreq_unregister_notifier(parent, nb,
++ DEVFREQ_TRANSITION_NOTIFIER));
+ break;
+ default:
+ break;
+diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
+index 2b11d967acd0..9d782cc95c6a 100644
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -898,8 +898,10 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
+ pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask;
+
+ rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+- if (rc)
++ if (rc) {
++ dev_err(&pdev->dev, "Unable to set DMA mask\n");
+ return rc;
++ }
+
+ od = devm_kzalloc(&pdev->dev, sizeof(*od), GFP_KERNEL);
+ if (!od)
+diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c
+index a410657f7bcd..012584cf3c17 100644
+--- a/drivers/dma/iop-adma.c
++++ b/drivers/dma/iop-adma.c
+@@ -125,9 +125,9 @@ static void __iop_adma_slot_cleanup(struct iop_adma_chan *iop_chan)
+ list_for_each_entry_safe(iter, _iter, &iop_chan->chain,
+ chain_node) {
+ pr_debug("\tcookie: %d slot: %d busy: %d "
+- "this_desc: %#x next_desc: %#x ack: %d\n",
++ "this_desc: %#x next_desc: %#llx ack: %d\n",
+ iter->async_tx.cookie, iter->idx, busy,
+- iter->async_tx.phys, iop_desc_get_next_desc(iter),
++ iter->async_tx.phys, (u64)iop_desc_get_next_desc(iter),
+ async_tx_test_ack(&iter->async_tx));
+ prefetch(_iter);
+ prefetch(&_iter->async_tx);
+@@ -315,9 +315,9 @@ retry:
+ int i;
+ dev_dbg(iop_chan->device->common.dev,
+ "allocated slot: %d "
+- "(desc %p phys: %#x) slots_per_op %d\n",
++ "(desc %p phys: %#llx) slots_per_op %d\n",
+ iter->idx, iter->hw_desc,
+- iter->async_tx.phys, slots_per_op);
++ (u64)iter->async_tx.phys, slots_per_op);
+
+ /* pre-ack all but the last descriptor */
+ if (num_slots != slots_per_op)
+@@ -525,7 +525,7 @@ iop_adma_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dma_dest,
+ return NULL;
+ BUG_ON(len > IOP_ADMA_MAX_BYTE_COUNT);
+
+- dev_dbg(iop_chan->device->common.dev, "%s len: %u\n",
++ dev_dbg(iop_chan->device->common.dev, "%s len: %zu\n",
+ __func__, len);
+
+ spin_lock_bh(&iop_chan->lock);
+@@ -558,7 +558,7 @@ iop_adma_prep_dma_xor(struct dma_chan *chan, dma_addr_t dma_dest,
+ BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT);
+
+ dev_dbg(iop_chan->device->common.dev,
+- "%s src_cnt: %d len: %u flags: %lx\n",
++ "%s src_cnt: %d len: %zu flags: %lx\n",
+ __func__, src_cnt, len, flags);
+
+ spin_lock_bh(&iop_chan->lock);
+@@ -591,7 +591,7 @@ iop_adma_prep_dma_xor_val(struct dma_chan *chan, dma_addr_t *dma_src,
+ if (unlikely(!len))
+ return NULL;
+
+- dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %u\n",
++ dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %zu\n",
+ __func__, src_cnt, len);
+
+ spin_lock_bh(&iop_chan->lock);
+@@ -629,7 +629,7 @@ iop_adma_prep_dma_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
+ BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT);
+
+ dev_dbg(iop_chan->device->common.dev,
+- "%s src_cnt: %d len: %u flags: %lx\n",
++ "%s src_cnt: %d len: %zu flags: %lx\n",
+ __func__, src_cnt, len, flags);
+
+ if (dmaf_p_disabled_continue(flags))
+@@ -692,7 +692,7 @@ iop_adma_prep_dma_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
+ return NULL;
+ BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT);
+
+- dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %u\n",
++ dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %zu\n",
+ __func__, src_cnt, len);
+
+ spin_lock_bh(&iop_chan->lock);
+diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
+index ceabdea40ae0..982631d4e1f8 100644
+--- a/drivers/dma/ti/edma.c
++++ b/drivers/dma/ti/edma.c
+@@ -2273,9 +2273,6 @@ static int edma_probe(struct platform_device *pdev)
+
+ ecc->default_queue = info->default_queue;
+
+- for (i = 0; i < ecc->num_slots; i++)
+- edma_write_slot(ecc, i, &dummy_paramset);
+-
+ if (info->rsv) {
+ /* Set the reserved slots in inuse list */
+ rsv_slots = info->rsv->rsv_slots;
+@@ -2288,6 +2285,12 @@ static int edma_probe(struct platform_device *pdev)
+ }
+ }
+
++ for (i = 0; i < ecc->num_slots; i++) {
++ /* Reset only unused - not reserved - paRAM slots */
++ if (!test_bit(i, ecc->slot_inuse))
++ edma_write_slot(ecc, i, &dummy_paramset);
++ }
++
+ /* Clear the xbar mapped channels in unused list */
+ xbar_chans = info->xbar_chans;
+ if (xbar_chans) {
+diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c
+index 5762c3c383f2..56de378ad13d 100644
+--- a/drivers/edac/altera_edac.c
++++ b/drivers/edac/altera_edac.c
+@@ -1956,6 +1956,7 @@ static void altr_edac_a10_irq_handler(struct irq_desc *desc)
+ struct altr_arria10_edac *edac = irq_desc_get_handler_data(desc);
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+ int irq = irq_desc_get_irq(desc);
++ unsigned long bits;
+
+ dberr = (irq == edac->db_irq) ? 1 : 0;
+ sm_offset = dberr ? A10_SYSMGR_ECC_INTSTAT_DERR_OFST :
+@@ -1965,7 +1966,8 @@ static void altr_edac_a10_irq_handler(struct irq_desc *desc)
+
+ regmap_read(edac->ecc_mgr_map, sm_offset, &irq_status);
+
+- for_each_set_bit(bit, (unsigned long *)&irq_status, 32) {
++ bits = irq_status;
++ for_each_set_bit(bit, &bits, 32) {
+ irq = irq_linear_revmap(edac->domain, dberr * 32 + bit);
+ if (irq)
+ generic_handle_irq(irq);
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index e2addb2bca29..94265e438514 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2501,13 +2501,6 @@ static void decode_umc_error(int node_id, struct mce *m)
+ goto log_error;
+ }
+
+- if (umc_normaddr_to_sysaddr(m->addr, pvt->mc_node_id, err.channel, &sys_addr)) {
+- err.err_code = ERR_NORM_ADDR;
+- goto log_error;
+- }
+-
+- error_address_to_page_and_offset(sys_addr, &err);
+-
+ if (!(m->status & MCI_STATUS_SYNDV)) {
+ err.err_code = ERR_SYND;
+ goto log_error;
+@@ -2524,6 +2517,13 @@ static void decode_umc_error(int node_id, struct mce *m)
+
+ err.csrow = m->synd & 0x7;
+
++ if (umc_normaddr_to_sysaddr(m->addr, pvt->mc_node_id, err.channel, &sys_addr)) {
++ err.err_code = ERR_NORM_ADDR;
++ goto log_error;
++ }
++
++ error_address_to_page_and_offset(sys_addr, &err);
++
+ log_error:
+ __log_ecc_error(mci, &err, ecc_type);
+ }
+@@ -3101,12 +3101,15 @@ static bool ecc_enabled(struct pci_dev *F3, u16 nid)
+ static inline void
+ f17h_determine_edac_ctl_cap(struct mem_ctl_info *mci, struct amd64_pvt *pvt)
+ {
+- u8 i, ecc_en = 1, cpk_en = 1;
++ u8 i, ecc_en = 1, cpk_en = 1, dev_x4 = 1, dev_x16 = 1;
+
+ for (i = 0; i < NUM_UMCS; i++) {
+ if (pvt->umc[i].sdp_ctrl & UMC_SDP_INIT) {
+ ecc_en &= !!(pvt->umc[i].umc_cap_hi & UMC_ECC_ENABLED);
+ cpk_en &= !!(pvt->umc[i].umc_cap_hi & UMC_ECC_CHIPKILL_CAP);
++
++ dev_x4 &= !!(pvt->umc[i].dimm_cfg & BIT(6));
++ dev_x16 &= !!(pvt->umc[i].dimm_cfg & BIT(7));
+ }
+ }
+
+@@ -3114,8 +3117,15 @@ f17h_determine_edac_ctl_cap(struct mem_ctl_info *mci, struct amd64_pvt *pvt)
+ if (ecc_en) {
+ mci->edac_ctl_cap |= EDAC_FLAG_SECDED;
+
+- if (cpk_en)
++ if (!cpk_en)
++ return;
++
++ if (dev_x4)
+ mci->edac_ctl_cap |= EDAC_FLAG_S4ECD4ED;
++ else if (dev_x16)
++ mci->edac_ctl_cap |= EDAC_FLAG_S16ECD16ED;
++ else
++ mci->edac_ctl_cap |= EDAC_FLAG_S8ECD8ED;
+ }
+ }
+
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index 7d3edd713932..f59511bd9926 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -1246,9 +1246,13 @@ void edac_mc_handle_error(const enum hw_event_mc_err_type type,
+ if (p > e->location)
+ *(p - 1) = '\0';
+
+- /* Report the error via the trace interface */
+- grain_bits = fls_long(e->grain) + 1;
++ /* Sanity-check driver-supplied grain value. */
++ if (WARN_ON_ONCE(!e->grain))
++ e->grain = 1;
++
++ grain_bits = fls_long(e->grain - 1);
+
++ /* Report the error via the trace interface */
+ if (IS_ENABLED(CONFIG_RAS))
+ trace_mc_event(type, e->msg, e->label, e->error_count,
+ mci->mc_idx, e->top_layer, e->mid_layer,
+diff --git a/drivers/edac/pnd2_edac.c b/drivers/edac/pnd2_edac.c
+index 903a4f1fadcc..0153c730750e 100644
+--- a/drivers/edac/pnd2_edac.c
++++ b/drivers/edac/pnd2_edac.c
+@@ -268,11 +268,14 @@ static u64 get_sideband_reg_base_addr(void)
+ }
+ }
+
++#define DNV_MCHBAR_SIZE 0x8000
++#define DNV_SB_PORT_SIZE 0x10000
+ static int dnv_rd_reg(int port, int off, int op, void *data, size_t sz, char *name)
+ {
+ struct pci_dev *pdev;
+ char *base;
+ u64 addr;
++ unsigned long size;
+
+ if (op == 4) {
+ pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x1980, NULL);
+@@ -287,15 +290,17 @@ static int dnv_rd_reg(int port, int off, int op, void *data, size_t sz, char *na
+ addr = get_mem_ctrl_hub_base_addr();
+ if (!addr)
+ return -ENODEV;
++ size = DNV_MCHBAR_SIZE;
+ } else {
+ /* MMIO via sideband register base address */
+ addr = get_sideband_reg_base_addr();
+ if (!addr)
+ return -ENODEV;
+ addr += (port << 16);
++ size = DNV_SB_PORT_SIZE;
+ }
+
+- base = ioremap((resource_size_t)addr, 0x10000);
++ base = ioremap((resource_size_t)addr, size);
+ if (!base)
+ return -ENODEV;
+
+diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
+index 8f952f2f1a29..09119e3f5c01 100644
+--- a/drivers/firmware/arm_scmi/driver.c
++++ b/drivers/firmware/arm_scmi/driver.c
+@@ -271,6 +271,14 @@ static void scmi_tx_prepare(struct mbox_client *cl, void *m)
+ struct scmi_chan_info *cinfo = client_to_scmi_chan_info(cl);
+ struct scmi_shared_mem __iomem *mem = cinfo->payload;
+
++ /*
++ * Ideally channel must be free by now unless OS timeout last
++ * request and platform continued to process the same, wait
++ * until it releases the shared memory, otherwise we may endup
++ * overwriting its response with new message payload or vice-versa
++ */
++ spin_until_cond(ioread32(&mem->channel_status) &
++ SCMI_SHMEM_CHAN_STAT_CHANNEL_FREE);
+ /* Mark channel busy + clear error */
+ iowrite32(0x0, &mem->channel_status);
+ iowrite32(t->hdr.poll_completion ? 0 : SCMI_SHMEM_FLAG_INTR_ENABLED,
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 6090d25dce85..4045098ddb86 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -402,6 +402,21 @@ static void cper_print_pcie(const char *pfx, const struct cper_sec_pcie *pcie,
+ printk(
+ "%s""bridge: secondary_status: 0x%04x, control: 0x%04x\n",
+ pfx, pcie->bridge.secondary_status, pcie->bridge.control);
++
++ /* Fatal errors call __ghes_panic() before AER handler prints this */
++ if ((pcie->validation_bits & CPER_PCIE_VALID_AER_INFO) &&
++ (gdata->error_severity & CPER_SEV_FATAL)) {
++ struct aer_capability_regs *aer;
++
++ aer = (struct aer_capability_regs *)pcie->aer_info;
++ printk("%saer_uncor_status: 0x%08x, aer_uncor_mask: 0x%08x\n",
++ pfx, aer->uncor_status, aer->uncor_mask);
++ printk("%saer_uncor_severity: 0x%08x\n",
++ pfx, aer->uncor_severity);
++ printk("%sTLP Header: %08x %08x %08x %08x\n", pfx,
++ aer->header_log.dw0, aer->header_log.dw1,
++ aer->header_log.dw2, aer->header_log.dw3);
++ }
+ }
+
+ static void cper_print_tstamp(const char *pfx,
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index e778af766fae..98c987188835 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -18,6 +18,7 @@
+ #include <linux/init.h>
+ #include <linux/cpumask.h>
+ #include <linux/export.h>
++#include <linux/dma-direct.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/module.h>
+ #include <linux/types.h>
+@@ -449,6 +450,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ phys_addr_t mem_to_map_phys;
+ phys_addr_t dest_phys;
+ phys_addr_t ptr_phys;
++ dma_addr_t ptr_dma;
+ size_t mem_to_map_sz;
+ size_t dest_sz;
+ size_t src_sz;
+@@ -466,9 +468,10 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ ptr_sz = ALIGN(src_sz, SZ_64) + ALIGN(mem_to_map_sz, SZ_64) +
+ ALIGN(dest_sz, SZ_64);
+
+- ptr = dma_alloc_coherent(__scm->dev, ptr_sz, &ptr_phys, GFP_KERNEL);
++ ptr = dma_alloc_coherent(__scm->dev, ptr_sz, &ptr_dma, GFP_KERNEL);
+ if (!ptr)
+ return -ENOMEM;
++ ptr_phys = dma_to_phys(__scm->dev, ptr_dma);
+
+ /* Fill source vmid detail */
+ src = ptr;
+@@ -498,7 +501,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+
+ ret = __qcom_scm_assign_mem(__scm->dev, mem_to_map_phys, mem_to_map_sz,
+ ptr_phys, src_sz, dest_phys, dest_sz);
+- dma_free_coherent(__scm->dev, ALIGN(ptr_sz, SZ_64), ptr, ptr_phys);
++ dma_free_coherent(__scm->dev, ptr_sz, ptr, ptr_dma);
+ if (ret) {
+ dev_err(__scm->dev,
+ "Assign memory protection call failed %d.\n", ret);
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 221de241535a..3b07a316680c 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1462,6 +1462,7 @@ static int amdgpu_dm_backlight_get_brightness(struct backlight_device *bd)
+ }
+
+ static const struct backlight_ops amdgpu_dm_backlight_ops = {
++ .options = BL_CORE_SUSPENDRESUME,
+ .get_brightness = amdgpu_dm_backlight_get_brightness,
+ .update_status = amdgpu_dm_backlight_update_status,
+ };
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index b52ccab428a9..c7c505095402 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -4052,6 +4052,11 @@ static int smu7_program_display_gap(struct pp_hwmgr *hwmgr)
+
+ data->frame_time_x2 = frame_time_in_us * 2 / 100;
+
++ if (data->frame_time_x2 < 280) {
++ pr_debug("%s: enforce minimal VBITimeout: %d -> 280\n", __func__, data->frame_time_x2);
++ data->frame_time_x2 = 280;
++ }
++
+ display_gap2 = pre_vbi_time_in_us * (ref_clock / 100);
+
+ cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixCG_DISPLAY_GAP_CNTL2, display_gap2);
+diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
+index 34e45b97629e..2f2fb1966958 100644
+--- a/drivers/hwmon/acpi_power_meter.c
++++ b/drivers/hwmon/acpi_power_meter.c
+@@ -694,8 +694,8 @@ static int setup_attrs(struct acpi_power_meter_resource *resource)
+
+ if (resource->caps.flags & POWER_METER_CAN_CAP) {
+ if (!can_cap_in_hardware()) {
+- dev_err(&resource->acpi_dev->dev,
+- "Ignoring unsafe software power cap!\n");
++ dev_warn(&resource->acpi_dev->dev,
++ "Ignoring unsafe software power cap!\n");
+ goto skip_unsafe_cap;
+ }
+
+diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c
+index b75ff144b570..e6f351c92c02 100644
+--- a/drivers/i2c/busses/i2c-riic.c
++++ b/drivers/i2c/busses/i2c-riic.c
+@@ -203,6 +203,7 @@ static irqreturn_t riic_tend_isr(int irq, void *data)
+ if (readb(riic->base + RIIC_ICSR2) & ICSR2_NACKF) {
+ /* We got a NACKIE */
+ readb(riic->base + RIIC_ICDRR); /* dummy read */
++ riic_clear_set_bit(riic, ICSR2_NACKF, 0, RIIC_ICSR2);
+ riic->err = -ENXIO;
+ } else if (riic->bytes_left) {
+ return IRQ_NONE;
+diff --git a/drivers/infiniband/hw/hfi1/mad.c b/drivers/infiniband/hw/hfi1/mad.c
+index 0307405491e0..f208a25d0e4f 100644
+--- a/drivers/infiniband/hw/hfi1/mad.c
++++ b/drivers/infiniband/hw/hfi1/mad.c
+@@ -2326,7 +2326,7 @@ struct opa_port_status_req {
+ __be32 vl_select_mask;
+ };
+
+-#define VL_MASK_ALL 0x000080ff
++#define VL_MASK_ALL 0x00000000000080ffUL
+
+ struct opa_port_status_rsp {
+ __u8 port_num;
+@@ -2625,15 +2625,14 @@ static int pma_get_opa_classportinfo(struct opa_pma_mad *pmp,
+ }
+
+ static void a0_portstatus(struct hfi1_pportdata *ppd,
+- struct opa_port_status_rsp *rsp, u32 vl_select_mask)
++ struct opa_port_status_rsp *rsp)
+ {
+ if (!is_bx(ppd->dd)) {
+ unsigned long vl;
+ u64 sum_vl_xmit_wait = 0;
+- u32 vl_all_mask = VL_MASK_ALL;
++ unsigned long vl_all_mask = VL_MASK_ALL;
+
+- for_each_set_bit(vl, (unsigned long *)&(vl_all_mask),
+- 8 * sizeof(vl_all_mask)) {
++ for_each_set_bit(vl, &vl_all_mask, BITS_PER_LONG) {
+ u64 tmp = sum_vl_xmit_wait +
+ read_port_cntr(ppd, C_TX_WAIT_VL,
+ idx_from_vl(vl));
+@@ -2730,12 +2729,12 @@ static int pma_get_opa_portstatus(struct opa_pma_mad *pmp,
+ (struct opa_port_status_req *)pmp->data;
+ struct hfi1_devdata *dd = dd_from_ibdev(ibdev);
+ struct opa_port_status_rsp *rsp;
+- u32 vl_select_mask = be32_to_cpu(req->vl_select_mask);
++ unsigned long vl_select_mask = be32_to_cpu(req->vl_select_mask);
+ unsigned long vl;
+ size_t response_data_size;
+ u32 nports = be32_to_cpu(pmp->mad_hdr.attr_mod) >> 24;
+ u8 port_num = req->port_num;
+- u8 num_vls = hweight32(vl_select_mask);
++ u8 num_vls = hweight64(vl_select_mask);
+ struct _vls_pctrs *vlinfo;
+ struct hfi1_ibport *ibp = to_iport(ibdev, port);
+ struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
+@@ -2771,7 +2770,7 @@ static int pma_get_opa_portstatus(struct opa_pma_mad *pmp,
+
+ hfi1_read_link_quality(dd, &rsp->link_quality_indicator);
+
+- rsp->vl_select_mask = cpu_to_be32(vl_select_mask);
++ rsp->vl_select_mask = cpu_to_be32((u32)vl_select_mask);
+ rsp->port_xmit_data = cpu_to_be64(read_dev_cntr(dd, C_DC_XMIT_FLITS,
+ CNTR_INVALID_VL));
+ rsp->port_rcv_data = cpu_to_be64(read_dev_cntr(dd, C_DC_RCV_FLITS,
+@@ -2842,8 +2841,7 @@ static int pma_get_opa_portstatus(struct opa_pma_mad *pmp,
+ * So in the for_each_set_bit() loop below, we don't need
+ * any additional checks for vl.
+ */
+- for_each_set_bit(vl, (unsigned long *)&(vl_select_mask),
+- 8 * sizeof(vl_select_mask)) {
++ for_each_set_bit(vl, &vl_select_mask, BITS_PER_LONG) {
+ memset(vlinfo, 0, sizeof(*vlinfo));
+
+ tmp = read_dev_cntr(dd, C_DC_RX_FLIT_VL, idx_from_vl(vl));
+@@ -2884,7 +2882,7 @@ static int pma_get_opa_portstatus(struct opa_pma_mad *pmp,
+ vfi++;
+ }
+
+- a0_portstatus(ppd, rsp, vl_select_mask);
++ a0_portstatus(ppd, rsp);
+
+ if (resp_len)
+ *resp_len += response_data_size;
+@@ -2931,16 +2929,14 @@ static u64 get_error_counter_summary(struct ib_device *ibdev, u8 port,
+ return error_counter_summary;
+ }
+
+-static void a0_datacounters(struct hfi1_pportdata *ppd, struct _port_dctrs *rsp,
+- u32 vl_select_mask)
++static void a0_datacounters(struct hfi1_pportdata *ppd, struct _port_dctrs *rsp)
+ {
+ if (!is_bx(ppd->dd)) {
+ unsigned long vl;
+ u64 sum_vl_xmit_wait = 0;
+- u32 vl_all_mask = VL_MASK_ALL;
++ unsigned long vl_all_mask = VL_MASK_ALL;
+
+- for_each_set_bit(vl, (unsigned long *)&(vl_all_mask),
+- 8 * sizeof(vl_all_mask)) {
++ for_each_set_bit(vl, &vl_all_mask, BITS_PER_LONG) {
+ u64 tmp = sum_vl_xmit_wait +
+ read_port_cntr(ppd, C_TX_WAIT_VL,
+ idx_from_vl(vl));
+@@ -2995,7 +2991,7 @@ static int pma_get_opa_datacounters(struct opa_pma_mad *pmp,
+ u64 port_mask;
+ u8 port_num;
+ unsigned long vl;
+- u32 vl_select_mask;
++ unsigned long vl_select_mask;
+ int vfi;
+ u16 link_width;
+ u16 link_speed;
+@@ -3073,8 +3069,7 @@ static int pma_get_opa_datacounters(struct opa_pma_mad *pmp,
+ * So in the for_each_set_bit() loop below, we don't need
+ * any additional checks for vl.
+ */
+- for_each_set_bit(vl, (unsigned long *)&(vl_select_mask),
+- 8 * sizeof(req->vl_select_mask)) {
++ for_each_set_bit(vl, &vl_select_mask, BITS_PER_LONG) {
+ memset(vlinfo, 0, sizeof(*vlinfo));
+
+ rsp->vls[vfi].port_vl_xmit_data =
+@@ -3122,7 +3117,7 @@ static int pma_get_opa_datacounters(struct opa_pma_mad *pmp,
+ vfi++;
+ }
+
+- a0_datacounters(ppd, rsp, vl_select_mask);
++ a0_datacounters(ppd, rsp);
+
+ if (resp_len)
+ *resp_len += response_data_size;
+@@ -3217,7 +3212,7 @@ static int pma_get_opa_porterrors(struct opa_pma_mad *pmp,
+ struct _vls_ectrs *vlinfo;
+ unsigned long vl;
+ u64 port_mask, tmp;
+- u32 vl_select_mask;
++ unsigned long vl_select_mask;
+ int vfi;
+
+ req = (struct opa_port_error_counters64_msg *)pmp->data;
+@@ -3276,8 +3271,7 @@ static int pma_get_opa_porterrors(struct opa_pma_mad *pmp,
+ vlinfo = &rsp->vls[0];
+ vfi = 0;
+ vl_select_mask = be32_to_cpu(req->vl_select_mask);
+- for_each_set_bit(vl, (unsigned long *)&(vl_select_mask),
+- 8 * sizeof(req->vl_select_mask)) {
++ for_each_set_bit(vl, &vl_select_mask, BITS_PER_LONG) {
+ memset(vlinfo, 0, sizeof(*vlinfo));
+ rsp->vls[vfi].port_vl_xmit_discards =
+ cpu_to_be64(read_port_cntr(ppd, C_SW_XMIT_DSCD_VL,
+@@ -3488,7 +3482,7 @@ static int pma_set_opa_portstatus(struct opa_pma_mad *pmp,
+ u32 nports = be32_to_cpu(pmp->mad_hdr.attr_mod) >> 24;
+ u64 portn = be64_to_cpu(req->port_select_mask[3]);
+ u32 counter_select = be32_to_cpu(req->counter_select_mask);
+- u32 vl_select_mask = VL_MASK_ALL; /* clear all per-vl cnts */
++ unsigned long vl_select_mask = VL_MASK_ALL; /* clear all per-vl cnts */
+ unsigned long vl;
+
+ if ((nports != 1) || (portn != 1 << port)) {
+@@ -3582,8 +3576,7 @@ static int pma_set_opa_portstatus(struct opa_pma_mad *pmp,
+ if (counter_select & CS_UNCORRECTABLE_ERRORS)
+ write_dev_cntr(dd, C_DC_UNC_ERR, CNTR_INVALID_VL, 0);
+
+- for_each_set_bit(vl, (unsigned long *)&(vl_select_mask),
+- 8 * sizeof(vl_select_mask)) {
++ for_each_set_bit(vl, &vl_select_mask, BITS_PER_LONG) {
+ if (counter_select & CS_PORT_XMIT_DATA)
+ write_port_cntr(ppd, C_TX_FLIT_VL, idx_from_vl(vl), 0);
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 53eccc0da8fd..c05eae93170e 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -6370,6 +6370,7 @@ static void mlx5_ib_remove(struct mlx5_core_dev *mdev, void *context)
+ mlx5_ib_unbind_slave_port(mpi->ibdev, mpi);
+ list_del(&mpi->list);
+ mutex_unlock(&mlx5_ib_multiport_mutex);
++ kfree(mpi);
+ return;
+ }
+
+diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
+index ab5eba6edf82..e13ea199f589 100644
+--- a/drivers/iommu/Makefile
++++ b/drivers/iommu/Makefile
+@@ -10,7 +10,7 @@ obj-$(CONFIG_IOMMU_IO_PGTABLE_LPAE) += io-pgtable-arm.o
+ obj-$(CONFIG_IOMMU_IOVA) += iova.o
+ obj-$(CONFIG_OF_IOMMU) += of_iommu.o
+ obj-$(CONFIG_MSM_IOMMU) += msm_iommu.o
+-obj-$(CONFIG_AMD_IOMMU) += amd_iommu.o amd_iommu_init.o
++obj-$(CONFIG_AMD_IOMMU) += amd_iommu.o amd_iommu_init.o amd_iommu_quirks.o
+ obj-$(CONFIG_AMD_IOMMU_DEBUGFS) += amd_iommu_debugfs.o
+ obj-$(CONFIG_AMD_IOMMU_V2) += amd_iommu_v2.o
+ obj-$(CONFIG_ARM_SMMU) += arm-smmu.o
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 69c269dc4f1b..1f2ed44de243 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2563,7 +2563,9 @@ static int map_sg(struct device *dev, struct scatterlist *sglist,
+
+ bus_addr = address + s->dma_address + (j << PAGE_SHIFT);
+ phys_addr = (sg_phys(s) & PAGE_MASK) + (j << PAGE_SHIFT);
+- ret = iommu_map_page(domain, bus_addr, phys_addr, PAGE_SIZE, prot, GFP_ATOMIC);
++ ret = iommu_map_page(domain, bus_addr, phys_addr,
++ PAGE_SIZE, prot,
++ GFP_ATOMIC | __GFP_NOWARN);
+ if (ret)
+ goto out_unmap;
+
+diff --git a/drivers/iommu/amd_iommu.h b/drivers/iommu/amd_iommu.h
+new file mode 100644
+index 000000000000..12d540d9b59b
+--- /dev/null
++++ b/drivers/iommu/amd_iommu.h
+@@ -0,0 +1,14 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#ifndef AMD_IOMMU_H
++#define AMD_IOMMU_H
++
++int __init add_special_device(u8 type, u8 id, u16 *devid, bool cmd_line);
++
++#ifdef CONFIG_DMI
++void amd_iommu_apply_ivrs_quirks(void);
++#else
++static void amd_iommu_apply_ivrs_quirks(void) { }
++#endif
++
++#endif
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 66b4800bcdd8..1e9a5da562f0 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -39,6 +39,7 @@
+ #include <asm/irq_remapping.h>
+
+ #include <linux/crash_dump.h>
++#include "amd_iommu.h"
+ #include "amd_iommu_proto.h"
+ #include "amd_iommu_types.h"
+ #include "irq_remapping.h"
+@@ -1002,7 +1003,7 @@ static void __init set_dev_entry_from_acpi(struct amd_iommu *iommu,
+ set_iommu_for_device(iommu, devid);
+ }
+
+-static int __init add_special_device(u8 type, u8 id, u16 *devid, bool cmd_line)
++int __init add_special_device(u8 type, u8 id, u16 *devid, bool cmd_line)
+ {
+ struct devid_map *entry;
+ struct list_head *list;
+@@ -1153,6 +1154,8 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ if (ret)
+ return ret;
+
++ amd_iommu_apply_ivrs_quirks();
++
+ /*
+ * First save the recommended feature enable bits from ACPI
+ */
+diff --git a/drivers/iommu/amd_iommu_quirks.c b/drivers/iommu/amd_iommu_quirks.c
+new file mode 100644
+index 000000000000..c235f79b7a20
+--- /dev/null
++++ b/drivers/iommu/amd_iommu_quirks.c
+@@ -0,0 +1,92 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++/*
++ * Quirks for AMD IOMMU
++ *
++ * Copyright (C) 2019 Kai-Heng Feng <kai.heng.feng@canonical.com>
++ */
++
++#ifdef CONFIG_DMI
++#include <linux/dmi.h>
++
++#include "amd_iommu.h"
++
++#define IVHD_SPECIAL_IOAPIC 1
++
++struct ivrs_quirk_entry {
++ u8 id;
++ u16 devid;
++};
++
++enum {
++ DELL_INSPIRON_7375 = 0,
++ DELL_LATITUDE_5495,
++ LENOVO_IDEAPAD_330S_15ARR,
++};
++
++static const struct ivrs_quirk_entry ivrs_ioapic_quirks[][3] __initconst = {
++ /* ivrs_ioapic[4]=00:14.0 ivrs_ioapic[5]=00:00.2 */
++ [DELL_INSPIRON_7375] = {
++ { .id = 4, .devid = 0xa0 },
++ { .id = 5, .devid = 0x2 },
++ {}
++ },
++ /* ivrs_ioapic[4]=00:14.0 */
++ [DELL_LATITUDE_5495] = {
++ { .id = 4, .devid = 0xa0 },
++ {}
++ },
++ /* ivrs_ioapic[32]=00:14.0 */
++ [LENOVO_IDEAPAD_330S_15ARR] = {
++ { .id = 32, .devid = 0xa0 },
++ {}
++ },
++ {}
++};
++
++static int __init ivrs_ioapic_quirk_cb(const struct dmi_system_id *d)
++{
++ const struct ivrs_quirk_entry *i;
++
++ for (i = d->driver_data; i->id != 0 && i->devid != 0; i++)
++ add_special_device(IVHD_SPECIAL_IOAPIC, i->id, (u16 *)&i->devid, 0);
++
++ return 0;
++}
++
++static const struct dmi_system_id ivrs_quirks[] __initconst = {
++ {
++ .callback = ivrs_ioapic_quirk_cb,
++ .ident = "Dell Inspiron 7375",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7375"),
++ },
++ .driver_data = (void *)&ivrs_ioapic_quirks[DELL_INSPIRON_7375],
++ },
++ {
++ .callback = ivrs_ioapic_quirk_cb,
++ .ident = "Dell Latitude 5495",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude 5495"),
++ },
++ .driver_data = (void *)&ivrs_ioapic_quirks[DELL_LATITUDE_5495],
++ },
++ {
++ .callback = ivrs_ioapic_quirk_cb,
++ .ident = "Lenovo ideapad 330S-15ARR",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "81FB"),
++ },
++ .driver_data = (void *)&ivrs_ioapic_quirks[LENOVO_IDEAPAD_330S_15ARR],
++ },
++ {}
++};
++
++void __init amd_iommu_apply_ivrs_quirks(void)
++{
++ dmi_check_system(ivrs_quirks);
++}
++#endif
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index 9a576ae837dc..da4516fbf542 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -580,7 +580,9 @@ void queue_iova(struct iova_domain *iovad,
+
+ spin_unlock_irqrestore(&fq->lock, flags);
+
+- if (atomic_cmpxchg(&iovad->fq_timer_on, 0, 1) == 0)
++ /* Avoid false sharing as much as possible. */
++ if (!atomic_read(&iovad->fq_timer_on) &&
++ !atomic_cmpxchg(&iovad->fq_timer_on, 0, 1))
+ mod_timer(&iovad->fq_timer,
+ jiffies + msecs_to_jiffies(IOVA_FQ_TIMEOUT));
+ }
+diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
+index a73337b74f41..db588a79a9f0 100644
+--- a/drivers/isdn/mISDN/socket.c
++++ b/drivers/isdn/mISDN/socket.c
+@@ -764,6 +764,8 @@ base_sock_create(struct net *net, struct socket *sock, int protocol, int kern)
+
+ if (sock->type != SOCK_RAW)
+ return -ESOCKTNOSUPPORT;
++ if (!capable(CAP_NET_RAW))
++ return -EPERM;
+
+ sk = sk_alloc(net, PF_ISDN, GFP_KERNEL, &mISDN_proto, kern);
+ if (!sk)
+diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c
+index 17d73db1456e..e4cb3811e82a 100644
+--- a/drivers/leds/led-triggers.c
++++ b/drivers/leds/led-triggers.c
+@@ -177,6 +177,7 @@ err_activate:
+ list_del(&led_cdev->trig_list);
+ write_unlock_irqrestore(&led_cdev->trigger->leddev_list_lock, flags);
+ led_set_brightness(led_cdev, LED_OFF);
++ kfree(event);
+
+ return ret;
+ }
+diff --git a/drivers/leds/leds-lp5562.c b/drivers/leds/leds-lp5562.c
+index 2a9009fe5545..18edc8bdc9f7 100644
+--- a/drivers/leds/leds-lp5562.c
++++ b/drivers/leds/leds-lp5562.c
+@@ -263,7 +263,11 @@ static void lp5562_firmware_loaded(struct lp55xx_chip *chip)
+ {
+ const struct firmware *fw = chip->fw;
+
+- if (fw->size > LP5562_PROGRAM_LENGTH) {
++ /*
++ * the firmware is encoded in ascii hex character, with 2 chars
++ * per byte
++ */
++ if (fw->size > (LP5562_PROGRAM_LENGTH * 2)) {
+ dev_err(&chip->cl->dev, "firmware data size overflow: %zu\n",
+ fw->size);
+ return;
+diff --git a/drivers/md/bcache/closure.c b/drivers/md/bcache/closure.c
+index 73f5319295bc..c12cd809ab19 100644
+--- a/drivers/md/bcache/closure.c
++++ b/drivers/md/bcache/closure.c
+@@ -105,8 +105,14 @@ struct closure_syncer {
+
+ static void closure_sync_fn(struct closure *cl)
+ {
+- cl->s->done = 1;
+- wake_up_process(cl->s->task);
++ struct closure_syncer *s = cl->s;
++ struct task_struct *p;
++
++ rcu_read_lock();
++ p = READ_ONCE(s->task);
++ s->done = 1;
++ wake_up_process(p);
++ rcu_read_unlock();
+ }
+
+ void __sched __closure_sync(struct closure *cl)
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 17c6a73c536c..4d36373e1c0f 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -505,6 +505,7 @@ check_again:
+ ret = dm_dispatch_clone_request(clone, rq);
+ if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) {
+ blk_rq_unprep_clone(clone);
++ blk_mq_cleanup_rq(clone);
+ tio->ti->type->release_clone_rq(clone, &tio->info);
+ tio->clone = NULL;
+ if (!rq->q->mq_ops)
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index fb5d702e43b5..a8fbaa384e9a 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1770,8 +1770,15 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
+ if (!(le32_to_cpu(sb->feature_map) &
+ MD_FEATURE_RECOVERY_BITMAP))
+ rdev->saved_raid_disk = -1;
+- } else
+- set_bit(In_sync, &rdev->flags);
++ } else {
++ /*
++ * If the array is FROZEN, then the device can't
++ * be in_sync with rest of array.
++ */
++ if (!test_bit(MD_RECOVERY_FROZEN,
++ &mddev->recovery))
++ set_bit(In_sync, &rdev->flags);
++ }
+ rdev->raid_disk = role;
+ break;
+ }
+@@ -4116,7 +4123,7 @@ array_state_show(struct mddev *mddev, char *page)
+ {
+ enum array_state st = inactive;
+
+- if (mddev->pers)
++ if (mddev->pers && !test_bit(MD_NOT_READY, &mddev->flags))
+ switch(mddev->ro) {
+ case 1:
+ st = readonly;
+@@ -5671,9 +5678,6 @@ int md_run(struct mddev *mddev)
+ md_update_sb(mddev, 0);
+
+ md_new_event(mddev);
+- sysfs_notify_dirent_safe(mddev->sysfs_state);
+- sysfs_notify_dirent_safe(mddev->sysfs_action);
+- sysfs_notify(&mddev->kobj, NULL, "degraded");
+ return 0;
+
+ abort:
+@@ -5687,6 +5691,7 @@ static int do_md_run(struct mddev *mddev)
+ {
+ int err;
+
++ set_bit(MD_NOT_READY, &mddev->flags);
+ err = md_run(mddev);
+ if (err)
+ goto out;
+@@ -5707,9 +5712,14 @@ static int do_md_run(struct mddev *mddev)
+
+ set_capacity(mddev->gendisk, mddev->array_sectors);
+ revalidate_disk(mddev->gendisk);
++ clear_bit(MD_NOT_READY, &mddev->flags);
+ mddev->changed = 1;
+ kobject_uevent(&disk_to_dev(mddev->gendisk)->kobj, KOBJ_CHANGE);
++ sysfs_notify_dirent_safe(mddev->sysfs_state);
++ sysfs_notify_dirent_safe(mddev->sysfs_action);
++ sysfs_notify(&mddev->kobj, NULL, "degraded");
+ out:
++ clear_bit(MD_NOT_READY, &mddev->flags);
+ return err;
+ }
+
+@@ -8797,6 +8807,7 @@ void md_check_recovery(struct mddev *mddev)
+
+ if (mddev_trylock(mddev)) {
+ int spares = 0;
++ bool try_set_sync = mddev->safemode != 0;
+
+ if (!mddev->external && mddev->safemode == 1)
+ mddev->safemode = 0;
+@@ -8842,7 +8853,7 @@ void md_check_recovery(struct mddev *mddev)
+ }
+ }
+
+- if (!mddev->external && !mddev->in_sync) {
++ if (try_set_sync && !mddev->external && !mddev->in_sync) {
+ spin_lock(&mddev->lock);
+ set_in_sync(mddev);
+ spin_unlock(&mddev->lock);
+@@ -8948,7 +8959,8 @@ void md_reap_sync_thread(struct mddev *mddev)
+ /* resync has finished, collect result */
+ md_unregister_thread(&mddev->sync_thread);
+ if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
+- !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
++ !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) &&
++ mddev->degraded != mddev->raid_disks) {
+ /* success...*/
+ /* activate any spares */
+ if (mddev->pers->spare_active(mddev)) {
+diff --git a/drivers/md/md.h b/drivers/md/md.h
+index 325cb2136a49..4f89463e0b01 100644
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -243,6 +243,9 @@ enum mddev_flags {
+ MD_UPDATING_SB, /* md_check_recovery is updating the metadata
+ * without explicitly holding reconfig_mutex.
+ */
++ MD_NOT_READY, /* do_md_run() is active, so 'array_state'
++ * must not report that array is ready yet
++ */
+ };
+
+ enum mddev_sb_flags {
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index f4daa56d204d..43fa7dbf844b 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -26,6 +26,9 @@
+ #include "raid0.h"
+ #include "raid5.h"
+
++static int default_layout = 0;
++module_param(default_layout, int, 0644);
++
+ #define UNSUPPORTED_MDDEV_FLAGS \
+ ((1L << MD_HAS_JOURNAL) | \
+ (1L << MD_JOURNAL_CLEAN) | \
+@@ -146,6 +149,19 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ }
+ pr_debug("md/raid0:%s: FINAL %d zones\n",
+ mdname(mddev), conf->nr_strip_zones);
++
++ if (conf->nr_strip_zones == 1) {
++ conf->layout = RAID0_ORIG_LAYOUT;
++ } else if (default_layout == RAID0_ORIG_LAYOUT ||
++ default_layout == RAID0_ALT_MULTIZONE_LAYOUT) {
++ conf->layout = default_layout;
++ } else {
++ pr_err("md/raid0:%s: cannot assemble multi-zone RAID0 with default_layout setting\n",
++ mdname(mddev));
++ pr_err("md/raid0: please set raid.default_layout to 1 or 2\n");
++ err = -ENOTSUPP;
++ goto abort;
++ }
+ /*
+ * now since we have the hard sector sizes, we can make sure
+ * chunk size is a multiple of that sector size
+@@ -555,10 +571,12 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio)
+
+ static bool raid0_make_request(struct mddev *mddev, struct bio *bio)
+ {
++ struct r0conf *conf = mddev->private;
+ struct strip_zone *zone;
+ struct md_rdev *tmp_dev;
+ sector_t bio_sector;
+ sector_t sector;
++ sector_t orig_sector;
+ unsigned chunk_sects;
+ unsigned sectors;
+
+@@ -592,8 +610,21 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio)
+ bio = split;
+ }
+
++ orig_sector = sector;
+ zone = find_zone(mddev->private, §or);
+- tmp_dev = map_sector(mddev, zone, sector, §or);
++ switch (conf->layout) {
++ case RAID0_ORIG_LAYOUT:
++ tmp_dev = map_sector(mddev, zone, orig_sector, §or);
++ break;
++ case RAID0_ALT_MULTIZONE_LAYOUT:
++ tmp_dev = map_sector(mddev, zone, sector, §or);
++ break;
++ default:
++ WARN("md/raid0:%s: Invalid layout\n", mdname(mddev));
++ bio_io_error(bio);
++ return true;
++ }
++
+ bio_set_dev(bio, tmp_dev->bdev);
+ bio->bi_iter.bi_sector = sector + zone->dev_start +
+ tmp_dev->data_offset;
+diff --git a/drivers/md/raid0.h b/drivers/md/raid0.h
+index 540e65d92642..3816e5477db1 100644
+--- a/drivers/md/raid0.h
++++ b/drivers/md/raid0.h
+@@ -8,11 +8,25 @@ struct strip_zone {
+ int nb_dev; /* # of devices attached to the zone */
+ };
+
++/* Linux 3.14 (20d0189b101) made an unintended change to
++ * the RAID0 layout for multi-zone arrays (where devices aren't all
++ * the same size.
++ * RAID0_ORIG_LAYOUT restores the original layout
++ * RAID0_ALT_MULTIZONE_LAYOUT uses the altered layout
++ * The layouts are identical when there is only one zone (all
++ * devices the same size).
++ */
++
++enum r0layout {
++ RAID0_ORIG_LAYOUT = 1,
++ RAID0_ALT_MULTIZONE_LAYOUT = 2,
++};
+ struct r0conf {
+ struct strip_zone *strip_zone;
+ struct md_rdev **devlist; /* lists of rdevs, pointed to
+ * by strip_zone->dev */
+ int nr_strip_zones;
++ enum r0layout layout;
+ };
+
+ #endif
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index fa47249fa3e4..6929d110d804 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -434,19 +434,21 @@ static void raid1_end_write_request(struct bio *bio)
+ /* We never try FailFast to WriteMostly devices */
+ !test_bit(WriteMostly, &rdev->flags)) {
+ md_error(r1_bio->mddev, rdev);
+- if (!test_bit(Faulty, &rdev->flags))
+- /* This is the only remaining device,
+- * We need to retry the write without
+- * FailFast
+- */
+- set_bit(R1BIO_WriteError, &r1_bio->state);
+- else {
+- /* Finished with this branch */
+- r1_bio->bios[mirror] = NULL;
+- to_put = bio;
+- }
+- } else
++ }
++
++ /*
++ * When the device is faulty, it is not necessary to
++ * handle write error.
++ * For failfast, this is the only remaining device,
++ * We need to retry the write without FailFast.
++ */
++ if (!test_bit(Faulty, &rdev->flags))
+ set_bit(R1BIO_WriteError, &r1_bio->state);
++ else {
++ /* Finished with this branch */
++ r1_bio->bios[mirror] = NULL;
++ to_put = bio;
++ }
+ } else {
+ /*
+ * Set R1BIO_Uptodate in our master bio, so that we
+@@ -3103,6 +3105,13 @@ static int raid1_run(struct mddev *mddev)
+ !test_bit(In_sync, &conf->mirrors[i].rdev->flags) ||
+ test_bit(Faulty, &conf->mirrors[i].rdev->flags))
+ mddev->degraded++;
++ /*
++ * RAID1 needs at least one disk in active
++ */
++ if (conf->raid_disks - mddev->degraded < 1) {
++ ret = -EINVAL;
++ goto abort;
++ }
+
+ if (conf->raid_disks - mddev->degraded == 1)
+ mddev->recovery_cp = MaxSector;
+@@ -3136,8 +3145,12 @@ static int raid1_run(struct mddev *mddev)
+ ret = md_integrity_register(mddev);
+ if (ret) {
+ md_unregister_thread(&mddev->thread);
+- raid1_free(mddev, conf);
++ goto abort;
+ }
++ return 0;
++
++abort:
++ raid1_free(mddev, conf);
+ return ret;
+ }
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index a147619498df..4a5aad26ded7 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2540,7 +2540,8 @@ static void raid5_end_read_request(struct bio * bi)
+ int set_bad = 0;
+
+ clear_bit(R5_UPTODATE, &sh->dev[i].flags);
+- atomic_inc(&rdev->read_errors);
++ if (!(bi->bi_status == BLK_STS_PROTECTION))
++ atomic_inc(&rdev->read_errors);
+ if (test_bit(R5_ReadRepl, &sh->dev[i].flags))
+ pr_warn_ratelimited(
+ "md/raid:%s: read error on replacement device (sector %llu on %s).\n",
+@@ -2572,7 +2573,9 @@ static void raid5_end_read_request(struct bio * bi)
+ && !test_bit(R5_ReadNoMerge, &sh->dev[i].flags))
+ retry = 1;
+ if (retry)
+- if (test_bit(R5_ReadNoMerge, &sh->dev[i].flags)) {
++ if (sh->qd_idx >= 0 && sh->pd_idx == i)
++ set_bit(R5_ReadError, &sh->dev[i].flags);
++ else if (test_bit(R5_ReadNoMerge, &sh->dev[i].flags)) {
+ set_bit(R5_ReadError, &sh->dev[i].flags);
+ clear_bit(R5_ReadNoMerge, &sh->dev[i].flags);
+ } else
+@@ -5721,7 +5724,8 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi)
+ do_flush = false;
+ }
+
+- set_bit(STRIPE_HANDLE, &sh->state);
++ if (!sh->batch_head)
++ set_bit(STRIPE_HANDLE, &sh->state);
+ clear_bit(STRIPE_DELAYED, &sh->state);
+ if ((!sh->batch_head || sh == sh->batch_head) &&
+ (bi->bi_opf & REQ_SYNC) &&
+diff --git a/drivers/media/cec/cec-notifier.c b/drivers/media/cec/cec-notifier.c
+index dd2078b27a41..2424680f71c3 100644
+--- a/drivers/media/cec/cec-notifier.c
++++ b/drivers/media/cec/cec-notifier.c
+@@ -123,6 +123,8 @@ void cec_notifier_unregister(struct cec_notifier *n)
+ {
+ mutex_lock(&n->lock);
+ n->callback = NULL;
++ n->cec_adap->notifier = NULL;
++ n->cec_adap = NULL;
+ mutex_unlock(&n->lock);
+ cec_notifier_put(n);
+ }
+diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
+index c4e7ebfe4d29..8a61150ee249 100644
+--- a/drivers/media/dvb-core/dvb_frontend.c
++++ b/drivers/media/dvb-core/dvb_frontend.c
+@@ -164,6 +164,9 @@ static void dvb_frontend_free(struct kref *ref)
+
+ static void dvb_frontend_put(struct dvb_frontend *fe)
+ {
++ /* call detach before dropping the reference count */
++ if (fe->ops.detach)
++ fe->ops.detach(fe);
+ /*
+ * Check if the frontend was registered, as otherwise
+ * kref was not initialized yet.
+@@ -3035,7 +3038,6 @@ void dvb_frontend_detach(struct dvb_frontend *fe)
+ dvb_frontend_invoke_release(fe, fe->ops.release_sec);
+ dvb_frontend_invoke_release(fe, fe->ops.tuner_ops.release);
+ dvb_frontend_invoke_release(fe, fe->ops.analog_ops.release);
+- dvb_frontend_invoke_release(fe, fe->ops.detach);
+ dvb_frontend_put(fe);
+ }
+ EXPORT_SYMBOL(dvb_frontend_detach);
+diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
+index 3c8778570331..04dc2f4bc7aa 100644
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -339,8 +339,10 @@ static int dvb_create_media_entity(struct dvb_device *dvbdev,
+ if (npads) {
+ dvbdev->pads = kcalloc(npads, sizeof(*dvbdev->pads),
+ GFP_KERNEL);
+- if (!dvbdev->pads)
++ if (!dvbdev->pads) {
++ kfree(dvbdev->entity);
+ return -ENOMEM;
++ }
+ }
+
+ switch (type) {
+diff --git a/drivers/media/dvb-frontends/dvb-pll.c b/drivers/media/dvb-frontends/dvb-pll.c
+index 29836c1a40e9..ee830c76e4b3 100644
+--- a/drivers/media/dvb-frontends/dvb-pll.c
++++ b/drivers/media/dvb-frontends/dvb-pll.c
+@@ -18,6 +18,7 @@
+
+ #include <linux/slab.h>
+ #include <linux/module.h>
++#include <linux/idr.h>
+ #include <linux/dvb/frontend.h>
+ #include <asm/types.h>
+
+@@ -43,8 +44,7 @@ struct dvb_pll_priv {
+ };
+
+ #define DVB_PLL_MAX 64
+-
+-static unsigned int dvb_pll_devcount;
++static DEFINE_IDA(pll_ida);
+
+ static int debug;
+ module_param(debug, int, 0644);
+@@ -796,6 +796,7 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
+ struct dvb_pll_priv *priv = NULL;
+ int ret;
+ const struct dvb_pll_desc *desc;
++ int nr;
+
+ b1 = kmalloc(1, GFP_KERNEL);
+ if (!b1)
+@@ -804,9 +805,14 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
+ b1[0] = 0;
+ msg.buf = b1;
+
+- if ((id[dvb_pll_devcount] > DVB_PLL_UNDEFINED) &&
+- (id[dvb_pll_devcount] < ARRAY_SIZE(pll_list)))
+- pll_desc_id = id[dvb_pll_devcount];
++ nr = ida_simple_get(&pll_ida, 0, DVB_PLL_MAX, GFP_KERNEL);
++ if (nr < 0) {
++ kfree(b1);
++ return NULL;
++ }
++
++ if (id[nr] > DVB_PLL_UNDEFINED && id[nr] < ARRAY_SIZE(pll_list))
++ pll_desc_id = id[nr];
+
+ BUG_ON(pll_desc_id < 1 || pll_desc_id >= ARRAY_SIZE(pll_list));
+
+@@ -817,24 +823,20 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
+ fe->ops.i2c_gate_ctrl(fe, 1);
+
+ ret = i2c_transfer (i2c, &msg, 1);
+- if (ret != 1) {
+- kfree(b1);
+- return NULL;
+- }
++ if (ret != 1)
++ goto out;
+ if (fe->ops.i2c_gate_ctrl)
+ fe->ops.i2c_gate_ctrl(fe, 0);
+ }
+
+ priv = kzalloc(sizeof(struct dvb_pll_priv), GFP_KERNEL);
+- if (!priv) {
+- kfree(b1);
+- return NULL;
+- }
++ if (!priv)
++ goto out;
+
+ priv->pll_i2c_address = pll_addr;
+ priv->i2c = i2c;
+ priv->pll_desc = desc;
+- priv->nr = dvb_pll_devcount++;
++ priv->nr = nr;
+
+ memcpy(&fe->ops.tuner_ops, &dvb_pll_tuner_ops,
+ sizeof(struct dvb_tuner_ops));
+@@ -867,6 +869,11 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
+ kfree(b1);
+
+ return fe;
++out:
++ kfree(b1);
++ ida_simple_remove(&pll_ida, nr);
++
++ return NULL;
+ }
+ EXPORT_SYMBOL(dvb_pll_attach);
+
+@@ -903,9 +910,10 @@ dvb_pll_probe(struct i2c_client *client, const struct i2c_device_id *id)
+
+ static int dvb_pll_remove(struct i2c_client *client)
+ {
+- struct dvb_frontend *fe;
++ struct dvb_frontend *fe = i2c_get_clientdata(client);
++ struct dvb_pll_priv *priv = fe->tuner_priv;
+
+- fe = i2c_get_clientdata(client);
++ ida_simple_remove(&pll_ida, priv->nr);
+ dvb_pll_release(fe);
+ return 0;
+ }
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index d5c0ffc55d46..a3bbef682fb8 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -2787,9 +2787,14 @@ static int ov5640_probe(struct i2c_client *client,
+ /* request optional power down pin */
+ sensor->pwdn_gpio = devm_gpiod_get_optional(dev, "powerdown",
+ GPIOD_OUT_HIGH);
++ if (IS_ERR(sensor->pwdn_gpio))
++ return PTR_ERR(sensor->pwdn_gpio);
++
+ /* request optional reset pin */
+ sensor->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+ GPIOD_OUT_HIGH);
++ if (IS_ERR(sensor->reset_gpio))
++ return PTR_ERR(sensor->reset_gpio);
+
+ v4l2_i2c_subdev_init(&sensor->sd, client, &ov5640_subdev_ops);
+
+diff --git a/drivers/media/i2c/ov5645.c b/drivers/media/i2c/ov5645.c
+index 1722cdab0daf..34343bc10007 100644
+--- a/drivers/media/i2c/ov5645.c
++++ b/drivers/media/i2c/ov5645.c
+@@ -53,6 +53,8 @@
+ #define OV5645_CHIP_ID_HIGH_BYTE 0x56
+ #define OV5645_CHIP_ID_LOW 0x300b
+ #define OV5645_CHIP_ID_LOW_BYTE 0x45
++#define OV5645_IO_MIPI_CTRL00 0x300e
++#define OV5645_PAD_OUTPUT00 0x3019
+ #define OV5645_AWB_MANUAL_CONTROL 0x3406
+ #define OV5645_AWB_MANUAL_ENABLE BIT(0)
+ #define OV5645_AEC_PK_MANUAL 0x3503
+@@ -63,6 +65,7 @@
+ #define OV5645_ISP_VFLIP BIT(2)
+ #define OV5645_TIMING_TC_REG21 0x3821
+ #define OV5645_SENSOR_MIRROR BIT(1)
++#define OV5645_MIPI_CTRL00 0x4800
+ #define OV5645_PRE_ISP_TEST_SETTING_1 0x503d
+ #define OV5645_TEST_PATTERN_MASK 0x3
+ #define OV5645_SET_TEST_PATTERN(x) ((x) & OV5645_TEST_PATTERN_MASK)
+@@ -129,7 +132,6 @@ static const struct reg_value ov5645_global_init_setting[] = {
+ { 0x3503, 0x07 },
+ { 0x3002, 0x1c },
+ { 0x3006, 0xc3 },
+- { 0x300e, 0x45 },
+ { 0x3017, 0x00 },
+ { 0x3018, 0x00 },
+ { 0x302e, 0x0b },
+@@ -358,7 +360,10 @@ static const struct reg_value ov5645_global_init_setting[] = {
+ { 0x3a1f, 0x14 },
+ { 0x0601, 0x02 },
+ { 0x3008, 0x42 },
+- { 0x3008, 0x02 }
++ { 0x3008, 0x02 },
++ { OV5645_IO_MIPI_CTRL00, 0x40 },
++ { OV5645_MIPI_CTRL00, 0x24 },
++ { OV5645_PAD_OUTPUT00, 0x70 }
+ };
+
+ static const struct reg_value ov5645_setting_sxga[] = {
+@@ -745,13 +750,9 @@ static int ov5645_s_power(struct v4l2_subdev *sd, int on)
+ goto exit;
+ }
+
+- ret = ov5645_write_reg(ov5645, OV5645_SYSTEM_CTRL0,
+- OV5645_SYSTEM_CTRL0_STOP);
+- if (ret < 0) {
+- ov5645_set_power_off(ov5645);
+- goto exit;
+- }
++ usleep_range(500, 1000);
+ } else {
++ ov5645_write_reg(ov5645, OV5645_IO_MIPI_CTRL00, 0x58);
+ ov5645_set_power_off(ov5645);
+ }
+ }
+@@ -1057,11 +1058,20 @@ static int ov5645_s_stream(struct v4l2_subdev *subdev, int enable)
+ dev_err(ov5645->dev, "could not sync v4l2 controls\n");
+ return ret;
+ }
++
++ ret = ov5645_write_reg(ov5645, OV5645_IO_MIPI_CTRL00, 0x45);
++ if (ret < 0)
++ return ret;
++
+ ret = ov5645_write_reg(ov5645, OV5645_SYSTEM_CTRL0,
+ OV5645_SYSTEM_CTRL0_START);
+ if (ret < 0)
+ return ret;
+ } else {
++ ret = ov5645_write_reg(ov5645, OV5645_IO_MIPI_CTRL00, 0x40);
++ if (ret < 0)
++ return ret;
++
+ ret = ov5645_write_reg(ov5645, OV5645_SYSTEM_CTRL0,
+ OV5645_SYSTEM_CTRL0_STOP);
+ if (ret < 0)
+diff --git a/drivers/media/i2c/ov9650.c b/drivers/media/i2c/ov9650.c
+index 5bea31cd41aa..33a21d585dc9 100644
+--- a/drivers/media/i2c/ov9650.c
++++ b/drivers/media/i2c/ov9650.c
+@@ -716,6 +716,11 @@ static int ov965x_set_gain(struct ov965x *ov965x, int auto_gain)
+ for (m = 6; m >= 0; m--)
+ if (gain >= (1 << m) * 16)
+ break;
++
++ /* Sanity check: don't adjust the gain with a negative value */
++ if (m < 0)
++ return -EINVAL;
++
+ rgain = (gain - ((1 << m) * 16)) / (1 << m);
+ rgain |= (((1 << m) - 1) << 4);
+
+diff --git a/drivers/media/pci/saa7134/saa7134-i2c.c b/drivers/media/pci/saa7134/saa7134-i2c.c
+index cf1e526de56a..8a1128c60680 100644
+--- a/drivers/media/pci/saa7134/saa7134-i2c.c
++++ b/drivers/media/pci/saa7134/saa7134-i2c.c
+@@ -351,7 +351,11 @@ static const struct i2c_client saa7134_client_template = {
+
+ /* ----------------------------------------------------------- */
+
+-/* On Medion 7134 reading EEPROM needs DVB-T demod i2c gate open */
++/*
++ * On Medion 7134 reading the SAA7134 chip config EEPROM needs DVB-T
++ * demod i2c gate closed due to an address clash between this EEPROM
++ * and the demod one.
++ */
+ static void saa7134_i2c_eeprom_md7134_gate(struct saa7134_dev *dev)
+ {
+ u8 subaddr = 0x7, dmdregval;
+@@ -368,14 +372,14 @@ static void saa7134_i2c_eeprom_md7134_gate(struct saa7134_dev *dev)
+
+ ret = i2c_transfer(&dev->i2c_adap, i2cgatemsg_r, 2);
+ if ((ret == 2) && (dmdregval & 0x2)) {
+- pr_debug("%s: DVB-T demod i2c gate was left closed\n",
++ pr_debug("%s: DVB-T demod i2c gate was left open\n",
+ dev->name);
+
+ data[0] = subaddr;
+ data[1] = (dmdregval & ~0x2);
+ if (i2c_transfer(&dev->i2c_adap, i2cgatemsg_w, 1) != 1)
+- pr_err("%s: EEPROM i2c gate open failure\n",
+- dev->name);
++ pr_err("%s: EEPROM i2c gate close failure\n",
++ dev->name);
+ }
+ }
+
+diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c
+index 6d8e4afe9673..8c56d4c37a52 100644
+--- a/drivers/media/pci/saa7146/hexium_gemini.c
++++ b/drivers/media/pci/saa7146/hexium_gemini.c
+@@ -304,6 +304,9 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d
+ ret = saa7146_register_device(&hexium->video_dev, dev, "hexium gemini", VFL_TYPE_GRABBER);
+ if (ret < 0) {
+ pr_err("cannot register capture v4l2 device. skipping.\n");
++ saa7146_vv_release(dev);
++ i2c_del_adapter(&hexium->i2c_adapter);
++ kfree(hexium);
+ return ret;
+ }
+
+diff --git a/drivers/media/platform/exynos4-is/fimc-is.c b/drivers/media/platform/exynos4-is/fimc-is.c
+index 5ddb2321e9e4..0fe9be93fabe 100644
+--- a/drivers/media/platform/exynos4-is/fimc-is.c
++++ b/drivers/media/platform/exynos4-is/fimc-is.c
+@@ -819,6 +819,7 @@ static int fimc_is_probe(struct platform_device *pdev)
+ return -ENODEV;
+
+ is->pmu_regs = of_iomap(node, 0);
++ of_node_put(node);
+ if (!is->pmu_regs)
+ return -ENOMEM;
+
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index deb499f76412..b5993532831d 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -498,6 +498,7 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd)
+ continue;
+
+ ret = fimc_md_parse_port_node(fmd, port, index);
++ of_node_put(port);
+ if (ret < 0) {
+ of_node_put(node);
+ goto rpm_put;
+@@ -531,6 +532,7 @@ static int __of_get_csis_id(struct device_node *np)
+ if (!np)
+ return -EINVAL;
+ of_property_read_u32(np, "reg", ®);
++ of_node_put(np);
+ return reg - FIMC_INPUT_MIPI_CSI2_0;
+ }
+
+diff --git a/drivers/media/platform/fsl-viu.c b/drivers/media/platform/fsl-viu.c
+index 0273302aa741..83086eea1450 100644
+--- a/drivers/media/platform/fsl-viu.c
++++ b/drivers/media/platform/fsl-viu.c
+@@ -37,7 +37,7 @@
+ #define VIU_VERSION "0.5.1"
+
+ /* Allow building this driver with COMPILE_TEST */
+-#ifndef CONFIG_PPC
++#if !defined(CONFIG_PPC) && !defined(CONFIG_MICROBLAZE)
+ #define out_be32(v, a) iowrite32be(a, (void __iomem *)v)
+ #define in_be32(a) ioread32be((void __iomem *)a)
+ #endif
+diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_core.c b/drivers/media/platform/mtk-mdp/mtk_mdp_core.c
+index bbb24fb95b95..3deb0549b1a1 100644
+--- a/drivers/media/platform/mtk-mdp/mtk_mdp_core.c
++++ b/drivers/media/platform/mtk-mdp/mtk_mdp_core.c
+@@ -118,7 +118,9 @@ static int mtk_mdp_probe(struct platform_device *pdev)
+ mutex_init(&mdp->vpulock);
+
+ /* Old dts had the components as child nodes */
+- if (of_get_next_child(dev->of_node, NULL)) {
++ node = of_get_next_child(dev->of_node, NULL);
++ if (node) {
++ of_node_put(node);
+ parent = dev->of_node;
+ dev_warn(dev, "device tree is out of date\n");
+ } else {
+diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
+index 432bc7fbedc9..addd03b51748 100644
+--- a/drivers/media/platform/omap3isp/isp.c
++++ b/drivers/media/platform/omap3isp/isp.c
+@@ -722,6 +722,10 @@ static int isp_pipeline_enable(struct isp_pipeline *pipe,
+ s_stream, mode);
+ pipe->do_propagation = true;
+ }
++
++ /* Stop at the first external sub-device. */
++ if (subdev->dev != isp->dev)
++ break;
+ }
+
+ return 0;
+@@ -836,6 +840,10 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
+ &subdev->entity);
+ failure = -ETIMEDOUT;
+ }
++
++ /* Stop at the first external sub-device. */
++ if (subdev->dev != isp->dev)
++ break;
+ }
+
+ return failure;
+diff --git a/drivers/media/platform/omap3isp/ispccdc.c b/drivers/media/platform/omap3isp/ispccdc.c
+index 77b73e27a274..412438dce285 100644
+--- a/drivers/media/platform/omap3isp/ispccdc.c
++++ b/drivers/media/platform/omap3isp/ispccdc.c
+@@ -2605,6 +2605,7 @@ int omap3isp_ccdc_register_entities(struct isp_ccdc_device *ccdc,
+ int ret;
+
+ /* Register the subdev and video node. */
++ ccdc->subdev.dev = vdev->mdev->dev;
+ ret = v4l2_device_register_subdev(vdev, &ccdc->subdev);
+ if (ret < 0)
+ goto error;
+diff --git a/drivers/media/platform/omap3isp/ispccp2.c b/drivers/media/platform/omap3isp/ispccp2.c
+index e062939d0d05..47b0d3fe87d8 100644
+--- a/drivers/media/platform/omap3isp/ispccp2.c
++++ b/drivers/media/platform/omap3isp/ispccp2.c
+@@ -1034,6 +1034,7 @@ int omap3isp_ccp2_register_entities(struct isp_ccp2_device *ccp2,
+ int ret;
+
+ /* Register the subdev and video nodes. */
++ ccp2->subdev.dev = vdev->mdev->dev;
+ ret = v4l2_device_register_subdev(vdev, &ccp2->subdev);
+ if (ret < 0)
+ goto error;
+diff --git a/drivers/media/platform/omap3isp/ispcsi2.c b/drivers/media/platform/omap3isp/ispcsi2.c
+index a4d3d030e81e..e45292a1bf6c 100644
+--- a/drivers/media/platform/omap3isp/ispcsi2.c
++++ b/drivers/media/platform/omap3isp/ispcsi2.c
+@@ -1201,6 +1201,7 @@ int omap3isp_csi2_register_entities(struct isp_csi2_device *csi2,
+ int ret;
+
+ /* Register the subdev and video nodes. */
++ csi2->subdev.dev = vdev->mdev->dev;
+ ret = v4l2_device_register_subdev(vdev, &csi2->subdev);
+ if (ret < 0)
+ goto error;
+diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c
+index 3195f7c8b8b7..591c6de498f8 100644
+--- a/drivers/media/platform/omap3isp/isppreview.c
++++ b/drivers/media/platform/omap3isp/isppreview.c
+@@ -2228,6 +2228,7 @@ int omap3isp_preview_register_entities(struct isp_prev_device *prev,
+ int ret;
+
+ /* Register the subdev and video nodes. */
++ prev->subdev.dev = vdev->mdev->dev;
+ ret = v4l2_device_register_subdev(vdev, &prev->subdev);
+ if (ret < 0)
+ goto error;
+diff --git a/drivers/media/platform/omap3isp/ispresizer.c b/drivers/media/platform/omap3isp/ispresizer.c
+index 0b6a87508584..2035e3c6a9de 100644
+--- a/drivers/media/platform/omap3isp/ispresizer.c
++++ b/drivers/media/platform/omap3isp/ispresizer.c
+@@ -1684,6 +1684,7 @@ int omap3isp_resizer_register_entities(struct isp_res_device *res,
+ int ret;
+
+ /* Register the subdev and video nodes. */
++ res->subdev.dev = vdev->mdev->dev;
+ ret = v4l2_device_register_subdev(vdev, &res->subdev);
+ if (ret < 0)
+ goto error;
+diff --git a/drivers/media/platform/omap3isp/ispstat.c b/drivers/media/platform/omap3isp/ispstat.c
+index 47353fee26c3..bfa2d0504646 100644
+--- a/drivers/media/platform/omap3isp/ispstat.c
++++ b/drivers/media/platform/omap3isp/ispstat.c
+@@ -1029,6 +1029,8 @@ void omap3isp_stat_unregister_entities(struct ispstat *stat)
+ int omap3isp_stat_register_entities(struct ispstat *stat,
+ struct v4l2_device *vdev)
+ {
++ stat->subdev.dev = vdev->mdev->dev;
++
+ return v4l2_device_register_subdev(vdev, &stat->subdev);
+ }
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 0d1467028811..5a30f1d84fe1 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2306,7 +2306,7 @@ static int fdp1_probe(struct platform_device *pdev)
+ fdp1->fcp = rcar_fcp_get(fcp_node);
+ of_node_put(fcp_node);
+ if (IS_ERR(fdp1->fcp)) {
+- dev_err(&pdev->dev, "FCP not found (%ld)\n",
++ dev_dbg(&pdev->dev, "FCP not found (%ld)\n",
+ PTR_ERR(fdp1->fcp));
+ return PTR_ERR(fdp1->fcp);
+ }
+diff --git a/drivers/media/platform/vsp1/vsp1_dl.c b/drivers/media/platform/vsp1/vsp1_dl.c
+index 26289adaf658..a5634ca85a31 100644
+--- a/drivers/media/platform/vsp1/vsp1_dl.c
++++ b/drivers/media/platform/vsp1/vsp1_dl.c
+@@ -557,8 +557,10 @@ static struct vsp1_dl_list *vsp1_dl_list_alloc(struct vsp1_dl_manager *dlm)
+
+ /* Get a default body for our list. */
+ dl->body0 = vsp1_dl_body_get(dlm->pool);
+- if (!dl->body0)
++ if (!dl->body0) {
++ kfree(dl);
+ return NULL;
++ }
+
+ header_offset = dl->body0->max_entries * sizeof(*dl->body0->entries);
+
+diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c
+index 313a95f195a2..19e381dd5808 100644
+--- a/drivers/media/radio/si470x/radio-si470x-usb.c
++++ b/drivers/media/radio/si470x/radio-si470x-usb.c
+@@ -743,7 +743,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
+ /* start radio */
+ retval = si470x_start_usb(radio);
+ if (retval < 0)
+- goto err_all;
++ goto err_buf;
+
+ /* set initial frequency */
+ si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */
+@@ -758,6 +758,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
+
+ return 0;
+ err_all:
++ usb_kill_urb(radio->int_in_urb);
++err_buf:
+ kfree(radio->buffer);
+ err_ctrl:
+ v4l2_ctrl_handler_free(&radio->hdl);
+@@ -831,6 +833,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf)
+ mutex_lock(&radio->lock);
+ v4l2_device_disconnect(&radio->v4l2_dev);
+ video_unregister_device(&radio->videodev);
++ usb_kill_urb(radio->int_in_urb);
+ usb_set_intfdata(intf, NULL);
+ mutex_unlock(&radio->lock);
+ v4l2_device_put(&radio->v4l2_dev);
+diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
+index 7daac8bab83b..6f3030b2054d 100644
+--- a/drivers/media/rc/iguanair.c
++++ b/drivers/media/rc/iguanair.c
+@@ -424,6 +424,10 @@ static int iguanair_probe(struct usb_interface *intf,
+ int ret, pipein, pipeout;
+ struct usb_host_interface *idesc;
+
++ idesc = intf->altsetting;
++ if (idesc->desc.bNumEndpoints < 2)
++ return -ENODEV;
++
+ ir = kzalloc(sizeof(*ir), GFP_KERNEL);
+ rc = rc_allocate_device(RC_DRIVER_IR_RAW);
+ if (!ir || !rc) {
+@@ -438,18 +442,13 @@ static int iguanair_probe(struct usb_interface *intf,
+ ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);
+ ir->urb_out = usb_alloc_urb(0, GFP_KERNEL);
+
+- if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out) {
++ if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out ||
++ !usb_endpoint_is_int_in(&idesc->endpoint[0].desc) ||
++ !usb_endpoint_is_int_out(&idesc->endpoint[1].desc)) {
+ ret = -ENOMEM;
+ goto out;
+ }
+
+- idesc = intf->altsetting;
+-
+- if (idesc->desc.bNumEndpoints < 2) {
+- ret = -ENODEV;
+- goto out;
+- }
+-
+ ir->rc = rc;
+ ir->dev = &intf->dev;
+ ir->udev = udev;
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index 1041c056854d..f23a220352f7 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -1835,12 +1835,17 @@ static void imon_get_ffdc_type(struct imon_context *ictx)
+ break;
+ /* iMON VFD, MCE IR */
+ case 0x46:
+- case 0x7e:
+ case 0x9e:
+ dev_info(ictx->dev, "0xffdc iMON VFD, MCE IR");
+ detected_display_type = IMON_DISPLAY_TYPE_VFD;
+ allowed_protos = RC_PROTO_BIT_RC6_MCE;
+ break;
++ /* iMON VFD, iMON or MCE IR */
++ case 0x7e:
++ dev_info(ictx->dev, "0xffdc iMON VFD, iMON or MCE IR");
++ detected_display_type = IMON_DISPLAY_TYPE_VFD;
++ allowed_protos |= RC_PROTO_BIT_RC6_MCE;
++ break;
+ /* iMON LCD, MCE IR */
+ case 0x9f:
+ dev_info(ictx->dev, "0xffdc iMON LCD, MCE IR");
+diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
+index 4c0c8008872a..f1dfb8409432 100644
+--- a/drivers/media/rc/mceusb.c
++++ b/drivers/media/rc/mceusb.c
+@@ -42,21 +42,22 @@
+ #include <linux/pm_wakeup.h>
+ #include <media/rc-core.h>
+
+-#define DRIVER_VERSION "1.94"
++#define DRIVER_VERSION "1.95"
+ #define DRIVER_AUTHOR "Jarod Wilson <jarod@redhat.com>"
+ #define DRIVER_DESC "Windows Media Center Ed. eHome Infrared Transceiver " \
+ "device driver"
+ #define DRIVER_NAME "mceusb"
+
++#define USB_TX_TIMEOUT 1000 /* in milliseconds */
+ #define USB_CTRL_MSG_SZ 2 /* Size of usb ctrl msg on gen1 hw */
+ #define MCE_G1_INIT_MSGS 40 /* Init messages on gen1 hw to throw out */
+
+ /* MCE constants */
+-#define MCE_CMDBUF_SIZE 384 /* MCE Command buffer length */
++#define MCE_IRBUF_SIZE 128 /* TX IR buffer length */
+ #define MCE_TIME_UNIT 50 /* Approx 50us resolution */
+-#define MCE_CODE_LENGTH 5 /* Normal length of packet (with header) */
+-#define MCE_PACKET_SIZE 4 /* Normal length of packet (without header) */
+-#define MCE_IRDATA_HEADER 0x84 /* Actual header format is 0x80 + num_bytes */
++#define MCE_PACKET_SIZE 31 /* Max length of packet (with header) */
++#define MCE_IRDATA_HEADER (0x80 + MCE_PACKET_SIZE - 1)
++ /* Actual format is 0x80 + num_bytes */
+ #define MCE_IRDATA_TRAILER 0x80 /* End of IR data */
+ #define MCE_MAX_CHANNELS 2 /* Two transmitters, hardware dependent? */
+ #define MCE_DEFAULT_TX_MASK 0x03 /* Vals: TX1=0x01, TX2=0x02, ALL=0x03 */
+@@ -609,9 +610,9 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len,
+ if (len <= skip)
+ return;
+
+- dev_dbg(dev, "%cx data: %*ph (length=%d)",
+- (out ? 't' : 'r'),
+- min(len, buf_len - offset), buf + offset, len);
++ dev_dbg(dev, "%cx data[%d]: %*ph (len=%d sz=%d)",
++ (out ? 't' : 'r'), offset,
++ min(len, buf_len - offset), buf + offset, len, buf_len);
+
+ inout = out ? "Request" : "Got";
+
+@@ -733,6 +734,9 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len,
+ case MCE_RSP_CMD_ILLEGAL:
+ dev_dbg(dev, "Illegal PORT_IR command");
+ break;
++ case MCE_RSP_TX_TIMEOUT:
++ dev_dbg(dev, "IR TX timeout (TX buffer underrun)");
++ break;
+ default:
+ dev_dbg(dev, "Unknown command 0x%02x 0x%02x",
+ cmd, subcmd);
+@@ -747,13 +751,14 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len,
+ dev_dbg(dev, "End of raw IR data");
+ else if ((cmd != MCE_CMD_PORT_IR) &&
+ ((cmd & MCE_PORT_MASK) == MCE_COMMAND_IRDATA))
+- dev_dbg(dev, "Raw IR data, %d pulse/space samples", ir->rem);
++ dev_dbg(dev, "Raw IR data, %d pulse/space samples",
++ cmd & MCE_PACKET_LENGTH_MASK);
+ #endif
+ }
+
+ /*
+ * Schedule work that can't be done in interrupt handlers
+- * (mceusb_dev_recv() and mce_async_callback()) nor tasklets.
++ * (mceusb_dev_recv() and mce_write_callback()) nor tasklets.
+ * Invokes mceusb_deferred_kevent() for recovering from
+ * error events specified by the kevent bit field.
+ */
+@@ -766,23 +771,80 @@ static void mceusb_defer_kevent(struct mceusb_dev *ir, int kevent)
+ dev_dbg(ir->dev, "kevent %d scheduled", kevent);
+ }
+
+-static void mce_async_callback(struct urb *urb)
++static void mce_write_callback(struct urb *urb)
+ {
+- struct mceusb_dev *ir;
+- int len;
+-
+ if (!urb)
+ return;
+
+- ir = urb->context;
++ complete(urb->context);
++}
++
++/*
++ * Write (TX/send) data to MCE device USB endpoint out.
++ * Used for IR blaster TX and MCE device commands.
++ *
++ * Return: The number of bytes written (> 0) or errno (< 0).
++ */
++static int mce_write(struct mceusb_dev *ir, u8 *data, int size)
++{
++ int ret;
++ struct urb *urb;
++ struct device *dev = ir->dev;
++ unsigned char *buf_out;
++ struct completion tx_done;
++ unsigned long expire;
++ unsigned long ret_wait;
++
++ mceusb_dev_printdata(ir, data, size, 0, size, true);
++
++ urb = usb_alloc_urb(0, GFP_KERNEL);
++ if (unlikely(!urb)) {
++ dev_err(dev, "Error: mce write couldn't allocate urb");
++ return -ENOMEM;
++ }
++
++ buf_out = kmalloc(size, GFP_KERNEL);
++ if (!buf_out) {
++ usb_free_urb(urb);
++ return -ENOMEM;
++ }
++
++ init_completion(&tx_done);
++
++ /* outbound data */
++ if (usb_endpoint_xfer_int(ir->usb_ep_out))
++ usb_fill_int_urb(urb, ir->usbdev, ir->pipe_out,
++ buf_out, size, mce_write_callback, &tx_done,
++ ir->usb_ep_out->bInterval);
++ else
++ usb_fill_bulk_urb(urb, ir->usbdev, ir->pipe_out,
++ buf_out, size, mce_write_callback, &tx_done);
++ memcpy(buf_out, data, size);
++
++ ret = usb_submit_urb(urb, GFP_KERNEL);
++ if (ret) {
++ dev_err(dev, "Error: mce write submit urb error = %d", ret);
++ kfree(buf_out);
++ usb_free_urb(urb);
++ return ret;
++ }
++
++ expire = msecs_to_jiffies(USB_TX_TIMEOUT);
++ ret_wait = wait_for_completion_timeout(&tx_done, expire);
++ if (!ret_wait) {
++ dev_err(dev, "Error: mce write timed out (expire = %lu (%dms))",
++ expire, USB_TX_TIMEOUT);
++ usb_kill_urb(urb);
++ ret = (urb->status == -ENOENT ? -ETIMEDOUT : urb->status);
++ } else {
++ ret = urb->status;
++ }
++ if (ret >= 0)
++ ret = urb->actual_length; /* bytes written */
+
+ switch (urb->status) {
+ /* success */
+ case 0:
+- len = urb->actual_length;
+-
+- mceusb_dev_printdata(ir, urb->transfer_buffer, len,
+- 0, len, true);
+ break;
+
+ case -ECONNRESET:
+@@ -792,140 +854,135 @@ static void mce_async_callback(struct urb *urb)
+ break;
+
+ case -EPIPE:
+- dev_err(ir->dev, "Error: request urb status = %d (TX HALT)",
++ dev_err(ir->dev, "Error: mce write urb status = %d (TX HALT)",
+ urb->status);
+ mceusb_defer_kevent(ir, EVENT_TX_HALT);
+ break;
+
+ default:
+- dev_err(ir->dev, "Error: request urb status = %d", urb->status);
++ dev_err(ir->dev, "Error: mce write urb status = %d",
++ urb->status);
+ break;
+ }
+
+- /* the transfer buffer and urb were allocated in mce_request_packet */
+- kfree(urb->transfer_buffer);
+- usb_free_urb(urb);
+-}
+-
+-/* request outgoing (send) usb packet - used to initialize remote */
+-static void mce_request_packet(struct mceusb_dev *ir, unsigned char *data,
+- int size)
+-{
+- int res;
+- struct urb *async_urb;
+- struct device *dev = ir->dev;
+- unsigned char *async_buf;
++ dev_dbg(dev, "tx done status = %d (wait = %lu, expire = %lu (%dms), urb->actual_length = %d, urb->status = %d)",
++ ret, ret_wait, expire, USB_TX_TIMEOUT,
++ urb->actual_length, urb->status);
+
+- async_urb = usb_alloc_urb(0, GFP_KERNEL);
+- if (unlikely(!async_urb)) {
+- dev_err(dev, "Error, couldn't allocate urb!");
+- return;
+- }
+-
+- async_buf = kmalloc(size, GFP_KERNEL);
+- if (!async_buf) {
+- usb_free_urb(async_urb);
+- return;
+- }
+-
+- /* outbound data */
+- if (usb_endpoint_xfer_int(ir->usb_ep_out))
+- usb_fill_int_urb(async_urb, ir->usbdev, ir->pipe_out,
+- async_buf, size, mce_async_callback, ir,
+- ir->usb_ep_out->bInterval);
+- else
+- usb_fill_bulk_urb(async_urb, ir->usbdev, ir->pipe_out,
+- async_buf, size, mce_async_callback, ir);
+-
+- memcpy(async_buf, data, size);
+-
+- dev_dbg(dev, "send request called (size=%#x)", size);
++ kfree(buf_out);
++ usb_free_urb(urb);
+
+- res = usb_submit_urb(async_urb, GFP_ATOMIC);
+- if (res) {
+- dev_err(dev, "send request FAILED! (res=%d)", res);
+- kfree(async_buf);
+- usb_free_urb(async_urb);
+- return;
+- }
+- dev_dbg(dev, "send request complete (res=%d)", res);
++ return ret;
+ }
+
+-static void mce_async_out(struct mceusb_dev *ir, unsigned char *data, int size)
++static void mce_command_out(struct mceusb_dev *ir, u8 *data, int size)
+ {
+ int rsize = sizeof(DEVICE_RESUME);
+
+ if (ir->need_reset) {
+ ir->need_reset = false;
+- mce_request_packet(ir, DEVICE_RESUME, rsize);
++ mce_write(ir, DEVICE_RESUME, rsize);
+ msleep(10);
+ }
+
+- mce_request_packet(ir, data, size);
++ mce_write(ir, data, size);
+ msleep(10);
+ }
+
+-/* Send data out the IR blaster port(s) */
++/*
++ * Transmit IR out the MCE device IR blaster port(s).
++ *
++ * Convert IR pulse/space sequence from LIRC to MCE format.
++ * Break up a long IR sequence into multiple parts (MCE IR data packets).
++ *
++ * u32 txbuf[] consists of IR pulse, space, ..., and pulse times in usec.
++ * Pulses and spaces are implicit by their position.
++ * The first IR sample, txbuf[0], is always a pulse.
++ *
++ * u8 irbuf[] consists of multiple IR data packets for the MCE device.
++ * A packet is 1 u8 MCE_IRDATA_HEADER and up to 30 u8 IR samples.
++ * An IR sample is 1-bit pulse/space flag with 7-bit time
++ * in MCE time units (50usec).
++ *
++ * Return: The number of IR samples sent (> 0) or errno (< 0).
++ */
+ static int mceusb_tx_ir(struct rc_dev *dev, unsigned *txbuf, unsigned count)
+ {
+ struct mceusb_dev *ir = dev->priv;
+- int i, length, ret = 0;
+- int cmdcount = 0;
+- unsigned char cmdbuf[MCE_CMDBUF_SIZE];
+-
+- /* MCE tx init header */
+- cmdbuf[cmdcount++] = MCE_CMD_PORT_IR;
+- cmdbuf[cmdcount++] = MCE_CMD_SETIRTXPORTS;
+- cmdbuf[cmdcount++] = ir->tx_mask;
++ u8 cmdbuf[3] = { MCE_CMD_PORT_IR, MCE_CMD_SETIRTXPORTS, 0x00 };
++ u8 irbuf[MCE_IRBUF_SIZE];
++ int ircount = 0;
++ unsigned int irsample;
++ int i, length, ret;
+
+ /* Send the set TX ports command */
+- mce_async_out(ir, cmdbuf, cmdcount);
+- cmdcount = 0;
+-
+- /* Generate mce packet data */
+- for (i = 0; (i < count) && (cmdcount < MCE_CMDBUF_SIZE); i++) {
+- txbuf[i] = txbuf[i] / MCE_TIME_UNIT;
+-
+- do { /* loop to support long pulses/spaces > 127*50us=6.35ms */
+-
+- /* Insert mce packet header every 4th entry */
+- if ((cmdcount < MCE_CMDBUF_SIZE) &&
+- (cmdcount % MCE_CODE_LENGTH) == 0)
+- cmdbuf[cmdcount++] = MCE_IRDATA_HEADER;
+-
+- /* Insert mce packet data */
+- if (cmdcount < MCE_CMDBUF_SIZE)
+- cmdbuf[cmdcount++] =
+- (txbuf[i] < MCE_PULSE_BIT ?
+- txbuf[i] : MCE_MAX_PULSE_LENGTH) |
+- (i & 1 ? 0x00 : MCE_PULSE_BIT);
+- else {
+- ret = -EINVAL;
+- goto out;
++ cmdbuf[2] = ir->tx_mask;
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
++
++ /* Generate mce IR data packet */
++ for (i = 0; i < count; i++) {
++ irsample = txbuf[i] / MCE_TIME_UNIT;
++
++ /* loop to support long pulses/spaces > 6350us (127*50us) */
++ while (irsample > 0) {
++ /* Insert IR header every 30th entry */
++ if (ircount % MCE_PACKET_SIZE == 0) {
++ /* Room for IR header and one IR sample? */
++ if (ircount >= MCE_IRBUF_SIZE - 1) {
++ /* Send near full buffer */
++ ret = mce_write(ir, irbuf, ircount);
++ if (ret < 0)
++ return ret;
++ ircount = 0;
++ }
++ irbuf[ircount++] = MCE_IRDATA_HEADER;
+ }
+
+- } while ((txbuf[i] > MCE_MAX_PULSE_LENGTH) &&
+- (txbuf[i] -= MCE_MAX_PULSE_LENGTH));
+- }
+-
+- /* Check if we have room for the empty packet at the end */
+- if (cmdcount >= MCE_CMDBUF_SIZE) {
+- ret = -EINVAL;
+- goto out;
+- }
++ /* Insert IR sample */
++ if (irsample <= MCE_MAX_PULSE_LENGTH) {
++ irbuf[ircount] = irsample;
++ irsample = 0;
++ } else {
++ irbuf[ircount] = MCE_MAX_PULSE_LENGTH;
++ irsample -= MCE_MAX_PULSE_LENGTH;
++ }
++ /*
++ * Even i = IR pulse
++ * Odd i = IR space
++ */
++ irbuf[ircount] |= (i & 1 ? 0 : MCE_PULSE_BIT);
++ ircount++;
++
++ /* IR buffer full? */
++ if (ircount >= MCE_IRBUF_SIZE) {
++ /* Fix packet length in last header */
++ length = ircount % MCE_PACKET_SIZE;
++ if (length > 0)
++ irbuf[ircount - length] -=
++ MCE_PACKET_SIZE - length;
++ /* Send full buffer */
++ ret = mce_write(ir, irbuf, ircount);
++ if (ret < 0)
++ return ret;
++ ircount = 0;
++ }
++ }
++ } /* after for loop, 0 <= ircount < MCE_IRBUF_SIZE */
+
+ /* Fix packet length in last header */
+- length = cmdcount % MCE_CODE_LENGTH;
+- cmdbuf[cmdcount - length] -= MCE_CODE_LENGTH - length;
++ length = ircount % MCE_PACKET_SIZE;
++ if (length > 0)
++ irbuf[ircount - length] -= MCE_PACKET_SIZE - length;
+
+- /* All mce commands end with an empty packet (0x80) */
+- cmdbuf[cmdcount++] = MCE_IRDATA_TRAILER;
++ /* Append IR trailer (0x80) to final partial (or empty) IR buffer */
++ irbuf[ircount++] = MCE_IRDATA_TRAILER;
+
+- /* Transmit the command to the mce device */
+- mce_async_out(ir, cmdbuf, cmdcount);
++ /* Send final buffer */
++ ret = mce_write(ir, irbuf, ircount);
++ if (ret < 0)
++ return ret;
+
+-out:
+- return ret ? ret : count;
++ return count;
+ }
+
+ /* Sets active IR outputs -- mce devices typically have two */
+@@ -965,7 +1022,7 @@ static int mceusb_set_tx_carrier(struct rc_dev *dev, u32 carrier)
+ cmdbuf[2] = MCE_CMD_SIG_END;
+ cmdbuf[3] = MCE_IRDATA_TRAILER;
+ dev_dbg(ir->dev, "disabling carrier modulation");
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ return 0;
+ }
+
+@@ -979,7 +1036,7 @@ static int mceusb_set_tx_carrier(struct rc_dev *dev, u32 carrier)
+ carrier);
+
+ /* Transmit new carrier to mce device */
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ return 0;
+ }
+ }
+@@ -1002,10 +1059,10 @@ static int mceusb_set_timeout(struct rc_dev *dev, unsigned int timeout)
+ cmdbuf[2] = units >> 8;
+ cmdbuf[3] = units;
+
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+
+ /* get receiver timeout value */
+- mce_async_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT));
++ mce_command_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT));
+
+ return 0;
+ }
+@@ -1030,7 +1087,7 @@ static int mceusb_set_rx_wideband(struct rc_dev *dev, int enable)
+ ir->wideband_rx_enabled = false;
+ cmdbuf[2] = 1; /* port 1 is long range receiver */
+ }
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ /* response from device sets ir->learning_active */
+
+ return 0;
+@@ -1053,7 +1110,7 @@ static int mceusb_set_rx_carrier_report(struct rc_dev *dev, int enable)
+ ir->carrier_report_enabled = true;
+ if (!ir->learning_active) {
+ cmdbuf[2] = 2; /* port 2 is short range receiver */
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ }
+ } else {
+ ir->carrier_report_enabled = false;
+@@ -1064,7 +1121,7 @@ static int mceusb_set_rx_carrier_report(struct rc_dev *dev, int enable)
+ */
+ if (ir->learning_active && !ir->wideband_rx_enabled) {
+ cmdbuf[2] = 1; /* port 1 is long range receiver */
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ }
+ }
+
+@@ -1143,6 +1200,7 @@ static void mceusb_handle_command(struct mceusb_dev *ir, int index)
+ }
+ break;
+ case MCE_RSP_CMD_ILLEGAL:
++ case MCE_RSP_TX_TIMEOUT:
+ ir->need_reset = true;
+ break;
+ default:
+@@ -1280,7 +1338,7 @@ static void mceusb_get_emulator_version(struct mceusb_dev *ir)
+ {
+ /* If we get no reply or an illegal command reply, its ver 1, says MS */
+ ir->emver = 1;
+- mce_async_out(ir, GET_EMVER, sizeof(GET_EMVER));
++ mce_command_out(ir, GET_EMVER, sizeof(GET_EMVER));
+ }
+
+ static void mceusb_gen1_init(struct mceusb_dev *ir)
+@@ -1326,10 +1384,10 @@ static void mceusb_gen1_init(struct mceusb_dev *ir)
+ dev_dbg(dev, "set handshake - retC = %d", ret);
+
+ /* device resume */
+- mce_async_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME));
++ mce_command_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME));
+
+ /* get hw/sw revision? */
+- mce_async_out(ir, GET_REVISION, sizeof(GET_REVISION));
++ mce_command_out(ir, GET_REVISION, sizeof(GET_REVISION));
+
+ kfree(data);
+ }
+@@ -1337,13 +1395,13 @@ static void mceusb_gen1_init(struct mceusb_dev *ir)
+ static void mceusb_gen2_init(struct mceusb_dev *ir)
+ {
+ /* device resume */
+- mce_async_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME));
++ mce_command_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME));
+
+ /* get wake version (protocol, key, address) */
+- mce_async_out(ir, GET_WAKEVERSION, sizeof(GET_WAKEVERSION));
++ mce_command_out(ir, GET_WAKEVERSION, sizeof(GET_WAKEVERSION));
+
+ /* unknown what this one actually returns... */
+- mce_async_out(ir, GET_UNKNOWN2, sizeof(GET_UNKNOWN2));
++ mce_command_out(ir, GET_UNKNOWN2, sizeof(GET_UNKNOWN2));
+ }
+
+ static void mceusb_get_parameters(struct mceusb_dev *ir)
+@@ -1357,24 +1415,24 @@ static void mceusb_get_parameters(struct mceusb_dev *ir)
+ ir->num_rxports = 2;
+
+ /* get number of tx and rx ports */
+- mce_async_out(ir, GET_NUM_PORTS, sizeof(GET_NUM_PORTS));
++ mce_command_out(ir, GET_NUM_PORTS, sizeof(GET_NUM_PORTS));
+
+ /* get the carrier and frequency */
+- mce_async_out(ir, GET_CARRIER_FREQ, sizeof(GET_CARRIER_FREQ));
++ mce_command_out(ir, GET_CARRIER_FREQ, sizeof(GET_CARRIER_FREQ));
+
+ if (ir->num_txports && !ir->flags.no_tx)
+ /* get the transmitter bitmask */
+- mce_async_out(ir, GET_TX_BITMASK, sizeof(GET_TX_BITMASK));
++ mce_command_out(ir, GET_TX_BITMASK, sizeof(GET_TX_BITMASK));
+
+ /* get receiver timeout value */
+- mce_async_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT));
++ mce_command_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT));
+
+ /* get receiver sensor setting */
+- mce_async_out(ir, GET_RX_SENSOR, sizeof(GET_RX_SENSOR));
++ mce_command_out(ir, GET_RX_SENSOR, sizeof(GET_RX_SENSOR));
+
+ for (i = 0; i < ir->num_txports; i++) {
+ cmdbuf[2] = i;
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ }
+ }
+
+@@ -1383,7 +1441,7 @@ static void mceusb_flash_led(struct mceusb_dev *ir)
+ if (ir->emver < 2)
+ return;
+
+- mce_async_out(ir, FLASH_LED, sizeof(FLASH_LED));
++ mce_command_out(ir, FLASH_LED, sizeof(FLASH_LED));
+ }
+
+ /*
+diff --git a/drivers/media/rc/mtk-cir.c b/drivers/media/rc/mtk-cir.c
+index e42efd9d382e..d37b85d2bc75 100644
+--- a/drivers/media/rc/mtk-cir.c
++++ b/drivers/media/rc/mtk-cir.c
+@@ -44,6 +44,11 @@
+ /* Fields containing pulse width data */
+ #define MTK_WIDTH_MASK (GENMASK(7, 0))
+
++/* IR threshold */
++#define MTK_IRTHD 0x14
++#define MTK_DG_CNT_MASK (GENMASK(12, 8))
++#define MTK_DG_CNT(x) ((x) << 8)
++
+ /* Bit to enable interrupt */
+ #define MTK_IRINT_EN BIT(0)
+
+@@ -409,6 +414,9 @@ static int mtk_ir_probe(struct platform_device *pdev)
+ mtk_w32_mask(ir, val, ir->data->fields[MTK_HW_PERIOD].mask,
+ ir->data->fields[MTK_HW_PERIOD].reg);
+
++ /* Set de-glitch counter */
++ mtk_w32_mask(ir, MTK_DG_CNT(1), MTK_DG_CNT_MASK, MTK_IRTHD);
++
+ /* Enable IR and PWM */
+ val = mtk_r32(ir, MTK_CONFIG_HIGH_REG);
+ val |= MTK_OK_COUNT(ir->data->ok_count) | MTK_PWM_EN | MTK_IR_EN;
+diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
+index f5b04594e209..4c191fcd3a7f 100644
+--- a/drivers/media/usb/cpia2/cpia2_usb.c
++++ b/drivers/media/usb/cpia2/cpia2_usb.c
+@@ -685,6 +685,10 @@ static int submit_urbs(struct camera_data *cam)
+ if (!urb) {
+ for (j = 0; j < i; j++)
+ usb_free_urb(cam->sbuf[j].urb);
++ for (j = 0; j < NUM_SBUF; j++) {
++ kfree(cam->sbuf[j].data);
++ cam->sbuf[j].data = NULL;
++ }
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
+index 091389fdf89e..c8d79502827b 100644
+--- a/drivers/media/usb/dvb-usb/dib0700_devices.c
++++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
+@@ -2442,9 +2442,13 @@ static int dib9090_tuner_attach(struct dvb_usb_adapter *adap)
+ 8, 0x0486,
+ };
+
++ if (!IS_ENABLED(CONFIG_DVB_DIB9000))
++ return -ENODEV;
+ if (dvb_attach(dib0090_fw_register, adap->fe_adap[0].fe, i2c, &dib9090_dib0090_config) == NULL)
+ return -ENODEV;
+ i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_1_2, 0);
++ if (!i2c)
++ return -ENODEV;
+ if (dib01x0_pmu_update(i2c, data_dib190, 10) != 0)
+ return -ENODEV;
+ dib0700_set_i2c_speed(adap->dev, 1500);
+@@ -2520,10 +2524,14 @@ static int nim9090md_tuner_attach(struct dvb_usb_adapter *adap)
+ 0, 0x00ef,
+ 8, 0x0406,
+ };
++ if (!IS_ENABLED(CONFIG_DVB_DIB9000))
++ return -ENODEV;
+ i2c = dib9000_get_tuner_interface(adap->fe_adap[0].fe);
+ if (dvb_attach(dib0090_fw_register, adap->fe_adap[0].fe, i2c, &nim9090md_dib0090_config[0]) == NULL)
+ return -ENODEV;
+ i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_1_2, 0);
++ if (!i2c)
++ return -ENODEV;
+ if (dib01x0_pmu_update(i2c, data_dib190, 10) < 0)
+ return -ENODEV;
+
+diff --git a/drivers/media/usb/dvb-usb/pctv452e.c b/drivers/media/usb/dvb-usb/pctv452e.c
+index 0af74383083d..ae793dac4964 100644
+--- a/drivers/media/usb/dvb-usb/pctv452e.c
++++ b/drivers/media/usb/dvb-usb/pctv452e.c
+@@ -913,14 +913,6 @@ static int pctv452e_frontend_attach(struct dvb_usb_adapter *a)
+ &a->dev->i2c_adap);
+ if (!a->fe_adap[0].fe)
+ return -ENODEV;
+-
+- /*
+- * dvb_frontend will call dvb_detach for both stb0899_detach
+- * and stb0899_release but we only do dvb_attach(stb0899_attach).
+- * Increment the module refcount instead.
+- */
+- symbol_get(stb0899_attach);
+-
+ if ((dvb_attach(lnbp22_attach, a->fe_adap[0].fe,
+ &a->dev->i2c_adap)) == NULL)
+ err("Cannot attach lnbp22\n");
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index 87b887b7604e..3f59a98dbf9a 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -4020,7 +4020,6 @@ static void em28xx_usb_disconnect(struct usb_interface *intf)
+ dev->dev_next->disconnected = 1;
+ dev_info(&dev->intf->dev, "Disconnecting %s\n",
+ dev->dev_next->name);
+- flush_request_modules(dev->dev_next);
+ }
+
+ dev->disconnected = 1;
+diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c
+index 989ae997f66d..89b9293b31be 100644
+--- a/drivers/media/usb/gspca/konica.c
++++ b/drivers/media/usb/gspca/konica.c
+@@ -123,6 +123,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 value, u16 index)
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, 2);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/nw80x.c b/drivers/media/usb/gspca/nw80x.c
+index bedc04a72e97..bde4441f935e 100644
+--- a/drivers/media/usb/gspca/nw80x.c
++++ b/drivers/media/usb/gspca/nw80x.c
+@@ -1581,6 +1581,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ return;
+ }
+ if (len == 1)
+diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c
+index 10fcbe9e8614..cb41e61d50dd 100644
+--- a/drivers/media/usb/gspca/ov519.c
++++ b/drivers/media/usb/gspca/ov519.c
+@@ -2083,6 +2083,11 @@ static int reg_r(struct sd *sd, u16 index)
+ } else {
+ gspca_err(gspca_dev, "reg_r %02x failed %d\n", index, ret);
+ sd->gspca_dev.usb_err = ret;
++ /*
++ * Make sure the result is zeroed to avoid uninitialized
++ * values.
++ */
++ gspca_dev->usb_buf[0] = 0;
+ }
+
+ return ret;
+@@ -2111,6 +2116,11 @@ static int reg_r8(struct sd *sd,
+ } else {
+ gspca_err(gspca_dev, "reg_r8 %02x failed %d\n", index, ret);
+ sd->gspca_dev.usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, 8);
+ }
+
+ return ret;
+diff --git a/drivers/media/usb/gspca/ov534.c b/drivers/media/usb/gspca/ov534.c
+index d06dc0755b9a..9e3326b66c79 100644
+--- a/drivers/media/usb/gspca/ov534.c
++++ b/drivers/media/usb/gspca/ov534.c
+@@ -642,6 +642,11 @@ static u8 ov534_reg_read(struct gspca_dev *gspca_dev, u16 reg)
+ if (ret < 0) {
+ pr_err("read failed %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the result is zeroed to avoid uninitialized
++ * values.
++ */
++ gspca_dev->usb_buf[0] = 0;
+ }
+ return gspca_dev->usb_buf[0];
+ }
+diff --git a/drivers/media/usb/gspca/ov534_9.c b/drivers/media/usb/gspca/ov534_9.c
+index 3d1364d2f83e..4d4ae22e9640 100644
+--- a/drivers/media/usb/gspca/ov534_9.c
++++ b/drivers/media/usb/gspca/ov534_9.c
+@@ -1154,6 +1154,7 @@ static u8 reg_r(struct gspca_dev *gspca_dev, u16 reg)
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ return 0;
+ }
+ return gspca_dev->usb_buf[0];
+ }
+diff --git a/drivers/media/usb/gspca/se401.c b/drivers/media/usb/gspca/se401.c
+index 477da0664b7d..40b87717bb5c 100644
+--- a/drivers/media/usb/gspca/se401.c
++++ b/drivers/media/usb/gspca/se401.c
+@@ -111,6 +111,11 @@ static void se401_read_req(struct gspca_dev *gspca_dev, u16 req, int silent)
+ pr_err("read req failed req %#04x error %d\n",
+ req, err);
+ gspca_dev->usb_err = err;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, READ_REQ_SIZE);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/sn9c20x.c b/drivers/media/usb/gspca/sn9c20x.c
+index cfa2a04d9f3f..efca54ee0f35 100644
+--- a/drivers/media/usb/gspca/sn9c20x.c
++++ b/drivers/media/usb/gspca/sn9c20x.c
+@@ -132,6 +132,13 @@ static const struct dmi_system_id flip_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_VERSION, "0341")
+ }
+ },
++ {
++ .ident = "MSI MS-1039",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MICRO-STAR INT'L CO.,LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MS-1039"),
++ }
++ },
+ {
+ .ident = "MSI MS-1632",
+ .matches = {
+@@ -918,6 +925,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 reg, u16 length)
+ if (unlikely(result < 0 || result != length)) {
+ pr_err("Read register %02x failed %d\n", reg, result);
+ gspca_dev->usb_err = result;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c
+index 5f3f2979540a..22de65d840dd 100644
+--- a/drivers/media/usb/gspca/sonixb.c
++++ b/drivers/media/usb/gspca/sonixb.c
+@@ -462,6 +462,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ dev_err(gspca_dev->v4l2_dev.dev,
+ "Error reading register %02x: %d\n", value, res);
+ gspca_dev->usb_err = res;
++ /*
++ * Make sure the result is zeroed to avoid uninitialized
++ * values.
++ */
++ gspca_dev->usb_buf[0] = 0;
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/sonixj.c b/drivers/media/usb/gspca/sonixj.c
+index df8d8482b795..fa108ce000ad 100644
+--- a/drivers/media/usb/gspca/sonixj.c
++++ b/drivers/media/usb/gspca/sonixj.c
+@@ -1171,6 +1171,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/spca1528.c b/drivers/media/usb/gspca/spca1528.c
+index d25924e430f3..a20eb8580db2 100644
+--- a/drivers/media/usb/gspca/spca1528.c
++++ b/drivers/media/usb/gspca/spca1528.c
+@@ -80,6 +80,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/sq930x.c b/drivers/media/usb/gspca/sq930x.c
+index d7cbcf2b3947..3521f5ff428e 100644
+--- a/drivers/media/usb/gspca/sq930x.c
++++ b/drivers/media/usb/gspca/sq930x.c
+@@ -434,6 +434,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r %04x failed %d\n", value, ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c
+index 437a3367ab97..26eae69a2562 100644
+--- a/drivers/media/usb/gspca/sunplus.c
++++ b/drivers/media/usb/gspca/sunplus.c
+@@ -264,6 +264,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/vc032x.c b/drivers/media/usb/gspca/vc032x.c
+index 52d071659634..6e32264d3825 100644
+--- a/drivers/media/usb/gspca/vc032x.c
++++ b/drivers/media/usb/gspca/vc032x.c
+@@ -2915,6 +2915,11 @@ static void reg_r_i(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+ static void reg_r(struct gspca_dev *gspca_dev,
+diff --git a/drivers/media/usb/gspca/w996Xcf.c b/drivers/media/usb/gspca/w996Xcf.c
+index abfab3de1866..ef0a839f9b8a 100644
+--- a/drivers/media/usb/gspca/w996Xcf.c
++++ b/drivers/media/usb/gspca/w996Xcf.c
+@@ -143,6 +143,11 @@ static int w9968cf_read_sb(struct sd *sd)
+ } else {
+ pr_err("Read SB reg [01] failed\n");
+ sd->gspca_dev.usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(sd->gspca_dev.usb_buf, 0, 2);
+ }
+
+ udelay(W9968CF_I2C_BUS_DELAY);
+diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c
+index 29ac7fc5b039..3316a17c141b 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-core.c
++++ b/drivers/media/usb/hdpvr/hdpvr-core.c
+@@ -141,6 +141,7 @@ static int device_authorization(struct hdpvr_device *dev)
+
+ dev->fw_ver = dev->usbc_buf[1];
+
++ dev->usbc_buf[46] = '\0';
+ v4l2_info(&dev->v4l2_dev, "firmware version 0x%x dated %s\n",
+ dev->fw_ver, &dev->usbc_buf[2]);
+
+@@ -275,6 +276,7 @@ static int hdpvr_probe(struct usb_interface *interface,
+ #endif
+ size_t buffer_size;
+ int i;
++ int dev_num;
+ int retval = -ENOMEM;
+
+ /* allocate memory for our device state and initialize it */
+@@ -372,8 +374,17 @@ static int hdpvr_probe(struct usb_interface *interface,
+ }
+ #endif
+
++ dev_num = atomic_inc_return(&dev_nr);
++ if (dev_num >= HDPVR_MAX) {
++ v4l2_err(&dev->v4l2_dev,
++ "max device number reached, device register failed\n");
++ atomic_dec(&dev_nr);
++ retval = -ENODEV;
++ goto reg_fail;
++ }
++
+ retval = hdpvr_register_videodev(dev, &interface->dev,
+- video_nr[atomic_inc_return(&dev_nr)]);
++ video_nr[dev_num]);
+ if (retval < 0) {
+ v4l2_err(&dev->v4l2_dev, "registering videodev failed\n");
+ goto reg_fail;
+diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
+index 44ca66cb9b8f..f34efa7c61b4 100644
+--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
++++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
+@@ -329,7 +329,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
+
+ dprintk("%s\n", __func__);
+
+- b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
++ b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
+ if (!b)
+ return -ENOMEM;
+
+diff --git a/drivers/mmc/core/sdio_irq.c b/drivers/mmc/core/sdio_irq.c
+index b299a24d33f9..d206f2de80d2 100644
+--- a/drivers/mmc/core/sdio_irq.c
++++ b/drivers/mmc/core/sdio_irq.c
+@@ -35,6 +35,7 @@ static int process_sdio_pending_irqs(struct mmc_host *host)
+ {
+ struct mmc_card *card = host->card;
+ int i, ret, count;
++ bool sdio_irq_pending = host->sdio_irq_pending;
+ unsigned char pending;
+ struct sdio_func *func;
+
+@@ -42,13 +43,16 @@ static int process_sdio_pending_irqs(struct mmc_host *host)
+ if (mmc_card_suspended(card))
+ return 0;
+
++ /* Clear the flag to indicate that we have processed the IRQ. */
++ host->sdio_irq_pending = false;
++
+ /*
+ * Optimization, if there is only 1 function interrupt registered
+ * and we know an IRQ was signaled then call irq handler directly.
+ * Otherwise do the full probe.
+ */
+ func = card->sdio_single_irq;
+- if (func && host->sdio_irq_pending) {
++ if (func && sdio_irq_pending) {
+ func->irq_handler(func);
+ return 1;
+ }
+@@ -100,7 +104,6 @@ void sdio_run_irqs(struct mmc_host *host)
+ {
+ mmc_claim_host(host);
+ if (host->sdio_irqs) {
+- host->sdio_irq_pending = true;
+ process_sdio_pending_irqs(host);
+ if (host->ops->ack_sdio_irq)
+ host->ops->ack_sdio_irq(host);
+@@ -119,6 +122,7 @@ void sdio_irq_work(struct work_struct *work)
+
+ void sdio_signal_irq(struct mmc_host *host)
+ {
++ host->sdio_irq_pending = true;
+ queue_delayed_work(system_wq, &host->sdio_irq_work, 0);
+ }
+ EXPORT_SYMBOL_GPL(sdio_signal_irq);
+@@ -164,7 +168,6 @@ static int sdio_irq_thread(void *_host)
+ if (ret)
+ break;
+ ret = process_sdio_pending_irqs(host);
+- host->sdio_irq_pending = false;
+ mmc_release_host(host);
+
+ /*
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index 942da07c9eb8..22c454c7aaca 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -3486,6 +3486,10 @@ int dw_mci_runtime_resume(struct device *dev)
+ /* Force setup bus to guarantee available clock output */
+ dw_mci_setup_bus(host->slot, true);
+
++ /* Re-enable SDIO interrupts. */
++ if (sdio_irq_claimed(host->slot->mmc))
++ __dw_mci_enable_sdio_irq(host->slot, 1);
++
+ /* Now that slots are all setup, we can enable card detect */
+ dw_mci_enable_cd(host);
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index c749d3dc1d36..eb33b892b484 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1713,7 +1713,9 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR104;
+ else if (timing == MMC_TIMING_UHS_SDR12)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR12;
+- else if (timing == MMC_TIMING_UHS_SDR25)
++ else if (timing == MMC_TIMING_SD_HS ||
++ timing == MMC_TIMING_MMC_HS ||
++ timing == MMC_TIMING_UHS_SDR25)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR25;
+ else if (timing == MMC_TIMING_UHS_SDR50)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR50;
+diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
+index 8459115d9d4e..553776cc1d29 100644
+--- a/drivers/net/arcnet/arcnet.c
++++ b/drivers/net/arcnet/arcnet.c
+@@ -1063,31 +1063,34 @@ EXPORT_SYMBOL(arcnet_interrupt);
+ static void arcnet_rx(struct net_device *dev, int bufnum)
+ {
+ struct arcnet_local *lp = netdev_priv(dev);
+- struct archdr pkt;
++ union {
++ struct archdr pkt;
++ char buf[512];
++ } rxdata;
+ struct arc_rfc1201 *soft;
+ int length, ofs;
+
+- soft = &pkt.soft.rfc1201;
++ soft = &rxdata.pkt.soft.rfc1201;
+
+- lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
+- if (pkt.hard.offset[0]) {
+- ofs = pkt.hard.offset[0];
++ lp->hw.copy_from_card(dev, bufnum, 0, &rxdata.pkt, ARC_HDR_SIZE);
++ if (rxdata.pkt.hard.offset[0]) {
++ ofs = rxdata.pkt.hard.offset[0];
+ length = 256 - ofs;
+ } else {
+- ofs = pkt.hard.offset[1];
++ ofs = rxdata.pkt.hard.offset[1];
+ length = 512 - ofs;
+ }
+
+ /* get the full header, if possible */
+- if (sizeof(pkt.soft) <= length) {
+- lp->hw.copy_from_card(dev, bufnum, ofs, soft, sizeof(pkt.soft));
++ if (sizeof(rxdata.pkt.soft) <= length) {
++ lp->hw.copy_from_card(dev, bufnum, ofs, soft, sizeof(rxdata.pkt.soft));
+ } else {
+- memset(&pkt.soft, 0, sizeof(pkt.soft));
++ memset(&rxdata.pkt.soft, 0, sizeof(rxdata.pkt.soft));
+ lp->hw.copy_from_card(dev, bufnum, ofs, soft, length);
+ }
+
+ arc_printk(D_DURING, dev, "Buffer #%d: received packet from %02Xh to %02Xh (%d+4 bytes)\n",
+- bufnum, pkt.hard.source, pkt.hard.dest, length);
++ bufnum, rxdata.pkt.hard.source, rxdata.pkt.hard.dest, length);
+
+ dev->stats.rx_packets++;
+ dev->stats.rx_bytes += length + ARC_HDR_SIZE;
+@@ -1096,13 +1099,13 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
+ if (arc_proto_map[soft->proto]->is_ip) {
+ if (BUGLVL(D_PROTO)) {
+ struct ArcProto
+- *oldp = arc_proto_map[lp->default_proto[pkt.hard.source]],
++ *oldp = arc_proto_map[lp->default_proto[rxdata.pkt.hard.source]],
+ *newp = arc_proto_map[soft->proto];
+
+ if (oldp != newp) {
+ arc_printk(D_PROTO, dev,
+ "got protocol %02Xh; encap for host %02Xh is now '%c' (was '%c')\n",
+- soft->proto, pkt.hard.source,
++ soft->proto, rxdata.pkt.hard.source,
+ newp->suffix, oldp->suffix);
+ }
+ }
+@@ -1111,10 +1114,10 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
+ lp->default_proto[0] = soft->proto;
+
+ /* in striking contrast, the following isn't a hack. */
+- lp->default_proto[pkt.hard.source] = soft->proto;
++ lp->default_proto[rxdata.pkt.hard.source] = soft->proto;
+ }
+ /* call the protocol-specific receiver. */
+- arc_proto_map[soft->proto]->rx(dev, bufnum, &pkt, length);
++ arc_proto_map[soft->proto]->rx(dev, bufnum, &rxdata.pkt, length);
+ }
+
+ static void null_rx(struct net_device *dev, int bufnum,
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index cdae0efde8e6..7998a73b6a0f 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -1429,6 +1429,16 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ else
+ phy_reg |= 0xFA;
+ e1e_wphy_locked(hw, I217_PLL_CLOCK_GATE_REG, phy_reg);
++
++ if (speed == SPEED_1000) {
++ hw->phy.ops.read_reg_locked(hw, HV_PM_CTRL,
++ &phy_reg);
++
++ phy_reg |= HV_PM_CTRL_K1_CLK_REQ;
++
++ hw->phy.ops.write_reg_locked(hw, HV_PM_CTRL,
++ phy_reg);
++ }
+ }
+ hw->phy.ops.release(hw);
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+index eb09c755fa17..1502895eb45d 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+@@ -210,7 +210,7 @@
+
+ /* PHY Power Management Control */
+ #define HV_PM_CTRL PHY_REG(770, 17)
+-#define HV_PM_CTRL_PLL_STOP_IN_K1_GIGA 0x100
++#define HV_PM_CTRL_K1_CLK_REQ 0x200
+ #define HV_PM_CTRL_K1_ENABLE 0x4000
+
+ #define I217_PLL_CLOCK_GATE_REG PHY_REG(772, 28)
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 4e04985fb430..055562c930fb 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -2566,6 +2566,10 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
+ return;
+ if (!test_and_clear_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state))
+ return;
++ if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) {
++ set_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state);
++ return;
++ }
+
+ for (v = 0; v < pf->num_alloc_vsi; v++) {
+ if (pf->vsi[v] &&
+@@ -2580,6 +2584,7 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
+ }
+ }
+ }
++ clear_bit(__I40E_VF_DISABLE, pf->state);
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
+index 15dea48e0195..d6f8a41c3e35 100644
+--- a/drivers/net/ethernet/marvell/skge.c
++++ b/drivers/net/ethernet/marvell/skge.c
+@@ -3122,7 +3122,7 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
+ skb_put(skb, len);
+
+ if (dev->features & NETIF_F_RXCSUM) {
+- skb->csum = csum;
++ skb->csum = le16_to_cpu(csum);
+ skb->ip_summed = CHECKSUM_COMPLETE;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 0e820cf92f8a..231ed508c240 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1642,6 +1642,7 @@ static const struct pci_device_id mlx5_core_pci_table[] = {
+ { PCI_VDEVICE(MELLANOX, 0x101c), MLX5_PCI_DEV_IS_VF}, /* ConnectX-6 VF */
+ { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */
+ { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */
++ { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */
+ { 0, }
+ };
+
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
+index e57d23746585..22c572a09b32 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
+@@ -259,6 +259,7 @@ nfp_flower_spawn_vnic_reprs(struct nfp_app *app,
+ repr_priv = kzalloc(sizeof(*repr_priv), GFP_KERNEL);
+ if (!repr_priv) {
+ err = -ENOMEM;
++ nfp_repr_free(repr);
+ goto err_reprs_clean;
+ }
+
+@@ -291,6 +292,7 @@ nfp_flower_spawn_vnic_reprs(struct nfp_app *app,
+ err = nfp_repr_init(app, repr,
+ port_id, port, priv->nn->dp.netdev);
+ if (err) {
++ kfree(repr_priv);
+ nfp_port_free(port);
+ nfp_repr_free(repr);
+ goto err_reprs_clean;
+@@ -373,6 +375,7 @@ nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv)
+ repr_priv = kzalloc(sizeof(*repr_priv), GFP_KERNEL);
+ if (!repr_priv) {
+ err = -ENOMEM;
++ nfp_repr_free(repr);
+ goto err_reprs_clean;
+ }
+
+@@ -382,11 +385,13 @@ nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv)
+ port = nfp_port_alloc(app, NFP_PORT_PHYS_PORT, repr);
+ if (IS_ERR(port)) {
+ err = PTR_ERR(port);
++ kfree(repr_priv);
+ nfp_repr_free(repr);
+ goto err_reprs_clean;
+ }
+ err = nfp_port_init_phy_port(app->pf, app, port, i);
+ if (err) {
++ kfree(repr_priv);
+ nfp_port_free(port);
+ nfp_repr_free(repr);
+ goto err_reprs_clean;
+@@ -399,6 +404,7 @@ nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv)
+ err = nfp_repr_init(app, repr,
+ cmsg_port_id, port, priv->nn->dp.netdev);
+ if (err) {
++ kfree(repr_priv);
+ nfp_port_free(port);
+ nfp_repr_free(repr);
+ goto err_reprs_clean;
+diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
+index 08381ef8bdb4..41d30f55c946 100644
+--- a/drivers/net/ethernet/nxp/lpc_eth.c
++++ b/drivers/net/ethernet/nxp/lpc_eth.c
+@@ -1371,13 +1371,14 @@ static int lpc_eth_drv_probe(struct platform_device *pdev)
+ pldat->dma_buff_base_p = dma_handle;
+
+ netdev_dbg(ndev, "IO address space :%pR\n", res);
+- netdev_dbg(ndev, "IO address size :%d\n", resource_size(res));
++ netdev_dbg(ndev, "IO address size :%zd\n",
++ (size_t)resource_size(res));
+ netdev_dbg(ndev, "IO address (mapped) :0x%p\n",
+ pldat->net_base);
+ netdev_dbg(ndev, "IRQ number :%d\n", ndev->irq);
+- netdev_dbg(ndev, "DMA buffer size :%d\n", pldat->dma_buff_size);
+- netdev_dbg(ndev, "DMA buffer P address :0x%08x\n",
+- pldat->dma_buff_base_p);
++ netdev_dbg(ndev, "DMA buffer size :%zd\n", pldat->dma_buff_size);
++ netdev_dbg(ndev, "DMA buffer P address :%pad\n",
++ &pldat->dma_buff_base_p);
+ netdev_dbg(ndev, "DMA buffer V address :0x%p\n",
+ pldat->dma_buff_base_v);
+
+@@ -1424,8 +1425,8 @@ static int lpc_eth_drv_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_out_unregister_netdev;
+
+- netdev_info(ndev, "LPC mac at 0x%08x irq %d\n",
+- res->start, ndev->irq);
++ netdev_info(ndev, "LPC mac at 0x%08lx irq %d\n",
++ (unsigned long)res->start, ndev->irq);
+
+ phydev = ndev->phydev;
+
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 2c971357e66c..0dc92d2faa64 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -1238,6 +1238,7 @@ deliver:
+ macsec_rxsa_put(rx_sa);
+ macsec_rxsc_put(rx_sc);
+
++ skb_orphan(skb);
+ ret = gro_cells_receive(&macsec->gro_cells, skb);
+ if (ret == NET_RX_SUCCESS)
+ count_rx(dev, skb->len);
+diff --git a/drivers/net/phy/national.c b/drivers/net/phy/national.c
+index 2b1e336961f9..bf4070ef6b84 100644
+--- a/drivers/net/phy/national.c
++++ b/drivers/net/phy/national.c
+@@ -110,14 +110,17 @@ static void ns_giga_speed_fallback(struct phy_device *phydev, int mode)
+
+ static void ns_10_base_t_hdx_loopack(struct phy_device *phydev, int disable)
+ {
++ u16 lb_dis = BIT(1);
++
+ if (disable)
+- ns_exp_write(phydev, 0x1c0, ns_exp_read(phydev, 0x1c0) | 1);
++ ns_exp_write(phydev, 0x1c0,
++ ns_exp_read(phydev, 0x1c0) | lb_dis);
+ else
+ ns_exp_write(phydev, 0x1c0,
+- ns_exp_read(phydev, 0x1c0) & 0xfffe);
++ ns_exp_read(phydev, 0x1c0) & ~lb_dis);
+
+ pr_debug("10BASE-T HDX loopback %s\n",
+- (ns_exp_read(phydev, 0x1c0) & 0x0001) ? "off" : "on");
++ (ns_exp_read(phydev, 0x1c0) & lb_dis) ? "off" : "on");
+ }
+
+ static int ns_config_init(struct phy_device *phydev)
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 02ad03a2fab7..3e014ecffef8 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -1419,6 +1419,8 @@ static void __ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb)
+ netif_wake_queue(ppp->dev);
+ else
+ netif_stop_queue(ppp->dev);
++ } else {
++ kfree_skb(skb);
+ }
+ ppp_xmit_unlock(ppp);
+ }
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index 1eaec648bd1f..f53e3e4e25f3 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -681,8 +681,12 @@ cdc_ncm_find_endpoints(struct usbnet *dev, struct usb_interface *intf)
+ u8 ep;
+
+ for (ep = 0; ep < intf->cur_altsetting->desc.bNumEndpoints; ep++) {
+-
+ e = intf->cur_altsetting->endpoint + ep;
++
++ /* ignore endpoints which cannot transfer data */
++ if (!usb_endpoint_maxp(&e->desc))
++ continue;
++
+ switch (e->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
+ case USB_ENDPOINT_XFER_INT:
+ if (usb_endpoint_dir_in(&e->desc)) {
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 10854977c55f..84b354f76dea 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -112,6 +112,11 @@ int usbnet_get_endpoints(struct usbnet *dev, struct usb_interface *intf)
+ int intr = 0;
+
+ e = alt->endpoint + ep;
++
++ /* ignore endpoints which cannot transfer data */
++ if (!usb_endpoint_maxp(&e->desc))
++ continue;
++
+ switch (e->desc.bmAttributes) {
+ case USB_ENDPOINT_XFER_INT:
+ if (!usb_endpoint_dir_in(&e->desc))
+@@ -351,6 +356,8 @@ void usbnet_update_max_qlen(struct usbnet *dev)
+ {
+ enum usb_device_speed speed = dev->udev->speed;
+
++ if (!dev->rx_urb_size || !dev->hard_mtu)
++ goto insanity;
+ switch (speed) {
+ case USB_SPEED_HIGH:
+ dev->rx_qlen = MAX_QUEUE_MEMORY / dev->rx_urb_size;
+@@ -367,6 +374,7 @@ void usbnet_update_max_qlen(struct usbnet *dev)
+ dev->tx_qlen = 5 * MAX_QUEUE_MEMORY / dev->hard_mtu;
+ break;
+ default:
++insanity:
+ dev->rx_qlen = dev->tx_qlen = 4;
+ }
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 3fe7605a2cca..9cb9f0544c9b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -843,11 +843,13 @@ static bool iwl_mvm_sar_geo_support(struct iwl_mvm *mvm)
+ * firmware versions. Unfortunately, we don't have a TLV API
+ * flag to rely on, so rely on the major version which is in
+ * the first byte of ucode_ver. This was implemented
+- * initially on version 38 and then backported to 36, 29 and
+- * 17.
++ * initially on version 38 and then backported to29 and 17.
++ * The intention was to have it in 36 as well, but not all
++ * 8000 family got this feature enabled. The 8000 family is
++ * the only one using version 36, so skip this version
++ * entirely.
+ */
+ return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 38 ||
+- IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 36 ||
+ IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 ||
+ IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17;
+ }
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index 3dbfce972c56..9e82ec12564b 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -49,7 +49,8 @@ static const struct lbs_fw_table fw_table[] = {
+ { MODEL_8388, "libertas/usb8388_v5.bin", NULL },
+ { MODEL_8388, "libertas/usb8388.bin", NULL },
+ { MODEL_8388, "usb8388.bin", NULL },
+- { MODEL_8682, "libertas/usb8682.bin", NULL }
++ { MODEL_8682, "libertas/usb8682.bin", NULL },
++ { 0, NULL, NULL }
+ };
+
+ static const struct usb_device_id if_usb_table[] = {
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index f57feb8fdea4..892ef5212232 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -404,14 +404,16 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
+
+ down_write(&ctrl->namespaces_rwsem);
+ list_for_each_entry(ns, &ctrl->namespaces, list) {
+- if (ns->head->ns_id != le32_to_cpu(desc->nsids[n]))
++ unsigned nsid = le32_to_cpu(desc->nsids[n]);
++
++ if (ns->head->ns_id < nsid)
+ continue;
+- nvme_update_ns_ana_state(desc, ns);
++ if (ns->head->ns_id == nsid)
++ nvme_update_ns_ana_state(desc, ns);
+ if (++n == nr_nsids)
+ break;
+ }
+ up_write(&ctrl->namespaces_rwsem);
+- WARN_ON_ONCE(n < nr_nsids);
+ return 0;
+ }
+
+diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
+index 2008fa62a373..a8eb8784e151 100644
+--- a/drivers/nvme/target/admin-cmd.c
++++ b/drivers/nvme/target/admin-cmd.c
+@@ -68,9 +68,11 @@ static u16 nvmet_get_smart_log_nsid(struct nvmet_req *req,
+ goto out;
+
+ host_reads = part_stat_read(ns->bdev->bd_part, ios[READ]);
+- data_units_read = part_stat_read(ns->bdev->bd_part, sectors[READ]);
++ data_units_read = DIV_ROUND_UP(part_stat_read(ns->bdev->bd_part,
++ sectors[READ]), 1000);
+ host_writes = part_stat_read(ns->bdev->bd_part, ios[WRITE]);
+- data_units_written = part_stat_read(ns->bdev->bd_part, sectors[WRITE]);
++ data_units_written = DIV_ROUND_UP(part_stat_read(ns->bdev->bd_part,
++ sectors[WRITE]), 1000);
+
+ put_unaligned_le64(host_reads, &slog->host_reads[0]);
+ put_unaligned_le64(data_units_read, &slog->data_units_read[0]);
+@@ -98,11 +100,11 @@ static u16 nvmet_get_smart_log_all(struct nvmet_req *req,
+ if (!ns->bdev)
+ continue;
+ host_reads += part_stat_read(ns->bdev->bd_part, ios[READ]);
+- data_units_read +=
+- part_stat_read(ns->bdev->bd_part, sectors[READ]);
++ data_units_read += DIV_ROUND_UP(
++ part_stat_read(ns->bdev->bd_part, sectors[READ]), 1000);
+ host_writes += part_stat_read(ns->bdev->bd_part, ios[WRITE]);
+- data_units_written +=
+- part_stat_read(ns->bdev->bd_part, sectors[WRITE]);
++ data_units_written += DIV_ROUND_UP(
++ part_stat_read(ns->bdev->bd_part, sectors[WRITE]), 1000);
+
+ }
+ rcu_read_unlock();
+diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
+index 7390fb8ca9d1..29df6ab29e95 100644
+--- a/drivers/parisc/dino.c
++++ b/drivers/parisc/dino.c
+@@ -160,6 +160,15 @@ struct dino_device
+ (struct dino_device *)__pdata; })
+
+
++/* Check if PCI device is behind a Card-mode Dino. */
++static int pci_dev_is_behind_card_dino(struct pci_dev *dev)
++{
++ struct dino_device *dino_dev;
++
++ dino_dev = DINO_DEV(parisc_walk_tree(dev->bus->bridge));
++ return is_card_dino(&dino_dev->hba.dev->id);
++}
++
+ /*
+ * Dino Configuration Space Accessor Functions
+ */
+@@ -442,6 +451,21 @@ static void quirk_cirrus_cardbus(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_6832, quirk_cirrus_cardbus );
+
++#ifdef CONFIG_TULIP
++static void pci_fixup_tulip(struct pci_dev *dev)
++{
++ if (!pci_dev_is_behind_card_dino(dev))
++ return;
++ if (!(pci_resource_flags(dev, 1) & IORESOURCE_MEM))
++ return;
++ pr_warn("%s: HP HSC-PCI Cards with card-mode Dino not yet supported.\n",
++ pci_name(dev));
++ /* Disable this card by zeroing the PCI resources */
++ memset(&dev->resource[0], 0, sizeof(dev->resource[0]));
++ memset(&dev->resource[1], 0, sizeof(dev->resource[1]));
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_DEC, PCI_ANY_ID, pci_fixup_tulip);
++#endif /* CONFIG_TULIP */
+
+ static void __init
+ dino_bios_init(void)
+diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c
+index 088d1c2047e6..36bd2545afb6 100644
+--- a/drivers/platform/x86/intel_pmc_core.c
++++ b/drivers/platform/x86/intel_pmc_core.c
+@@ -685,10 +685,14 @@ static int __init pmc_core_probe(void)
+ if (pmcdev->map == &spt_reg_map && !pci_dev_present(pmc_pci_ids))
+ pmcdev->map = &cnp_reg_map;
+
+- if (lpit_read_residency_count_address(&slp_s0_addr))
++ if (lpit_read_residency_count_address(&slp_s0_addr)) {
+ pmcdev->base_addr = PMC_BASE_ADDR_DEFAULT;
+- else
++
++ if (page_is_ram(PHYS_PFN(pmcdev->base_addr)))
++ return -ENODEV;
++ } else {
+ pmcdev->base_addr = slp_s0_addr - pmcdev->map->slp_s0_offset;
++ }
+
+ pmcdev->regbase = ioremap(pmcdev->base_addr,
+ pmcdev->map->regmap_length);
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 9577d8941846..f312764660e6 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4789,7 +4789,7 @@ static int __init regulator_init(void)
+ /* init early to allow our consumers to complete system booting */
+ core_initcall(regulator_init);
+
+-static int __init regulator_late_cleanup(struct device *dev, void *data)
++static int regulator_late_cleanup(struct device *dev, void *data)
+ {
+ struct regulator_dev *rdev = dev_to_rdev(dev);
+ const struct regulator_ops *ops = rdev->desc->ops;
+@@ -4838,17 +4838,8 @@ unlock:
+ return 0;
+ }
+
+-static int __init regulator_init_complete(void)
++static void regulator_init_complete_work_function(struct work_struct *work)
+ {
+- /*
+- * Since DT doesn't provide an idiomatic mechanism for
+- * enabling full constraints and since it's much more natural
+- * with DT to provide them just assume that a DT enabled
+- * system has full constraints.
+- */
+- if (of_have_populated_dt())
+- has_full_constraints = true;
+-
+ /*
+ * Regulators may had failed to resolve their input supplies
+ * when were registered, either because the input supply was
+@@ -4866,6 +4857,35 @@ static int __init regulator_init_complete(void)
+ */
+ class_for_each_device(®ulator_class, NULL, NULL,
+ regulator_late_cleanup);
++}
++
++static DECLARE_DELAYED_WORK(regulator_init_complete_work,
++ regulator_init_complete_work_function);
++
++static int __init regulator_init_complete(void)
++{
++ /*
++ * Since DT doesn't provide an idiomatic mechanism for
++ * enabling full constraints and since it's much more natural
++ * with DT to provide them just assume that a DT enabled
++ * system has full constraints.
++ */
++ if (of_have_populated_dt())
++ has_full_constraints = true;
++
++ /*
++ * We punt completion for an arbitrary amount of time since
++ * systems like distros will load many drivers from userspace
++ * so consumers might not always be ready yet, this is
++ * particularly an issue with laptops where this might bounce
++ * the display off then on. Ideally we'd get a notification
++ * from userspace when this happens but we don't so just wait
++ * a bit and hope we waited long enough. It'd be better if
++ * we'd only do this on systems that need it, and a kernel
++ * command line option might be useful.
++ */
++ schedule_delayed_work(®ulator_init_complete_work,
++ msecs_to_jiffies(30000));
+
+ class_for_each_device(®ulator_class, NULL, NULL,
+ regulator_register_fill_coupling_array);
+diff --git a/drivers/regulator/lm363x-regulator.c b/drivers/regulator/lm363x-regulator.c
+index b615a413ca9f..27c0a67cfd0e 100644
+--- a/drivers/regulator/lm363x-regulator.c
++++ b/drivers/regulator/lm363x-regulator.c
+@@ -33,7 +33,7 @@
+
+ /* LM3632 */
+ #define LM3632_BOOST_VSEL_MAX 0x26
+-#define LM3632_LDO_VSEL_MAX 0x29
++#define LM3632_LDO_VSEL_MAX 0x28
+ #define LM3632_VBOOST_MIN 4500000
+ #define LM3632_VLDO_MIN 4000000
+
+diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
+index d27fabae8ddd..6c629ef1bc4e 100644
+--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
++++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
+@@ -546,6 +546,8 @@ static void send_mode_select(struct work_struct *work)
+ spin_unlock(&ctlr->ms_lock);
+
+ retry:
++ memset(cdb, 0, sizeof(cdb));
++
+ data_size = rdac_failover_get(ctlr, &list, cdb);
+
+ RDAC_LOG(RDAC_LOG_FAILOVER, sdev, "array %s, ctlr %d, "
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 7c1f36b69bdc..bee9cfb29152 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -216,8 +216,13 @@ qla2x00_async_login(struct scsi_qla_host *vha, fc_port_t *fcport,
+ struct srb_iocb *lio;
+ int rval = QLA_FUNCTION_FAILED;
+
+- if (!vha->flags.online)
+- goto done;
++ if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT) ||
++ fcport->loop_id == FC_NO_LOOP_ID) {
++ ql_log(ql_log_warn, vha, 0xffff,
++ "%s: %8phC - not sending command.\n",
++ __func__, fcport->port_name);
++ return rval;
++ }
+
+ sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
+ if (!sp)
+@@ -1123,8 +1128,13 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt)
+ struct port_database_24xx *pd;
+ struct qla_hw_data *ha = vha->hw;
+
+- if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT))
++ if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT) ||
++ fcport->loop_id == FC_NO_LOOP_ID) {
++ ql_log(ql_log_warn, vha, 0xffff,
++ "%s: %8phC - not sending command.\n",
++ __func__, fcport->port_name);
+ return rval;
++ }
+
+ fcport->disc_state = DSC_GPDB;
+
+@@ -1904,8 +1914,11 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea)
+ return;
+ }
+
+- if (fcport->disc_state == DSC_DELETE_PEND)
++ if ((fcport->disc_state == DSC_DELETE_PEND) ||
++ (fcport->disc_state == DSC_DELETED)) {
++ set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
+ return;
++ }
+
+ if (ea->sp->gen2 != fcport->login_gen) {
+ /* target side must have changed it. */
+@@ -6557,8 +6570,10 @@ qla2x00_abort_isp_cleanup(scsi_qla_host_t *vha)
+ }
+
+ /* Clear all async request states across all VPs. */
+- list_for_each_entry(fcport, &vha->vp_fcports, list)
++ list_for_each_entry(fcport, &vha->vp_fcports, list) {
+ fcport->flags &= ~(FCF_LOGIN_NEEDED | FCF_ASYNC_SENT);
++ fcport->scan_state = 0;
++ }
+ spin_lock_irqsave(&ha->vport_slock, flags);
+ list_for_each_entry(vp, &ha->vp_list, list) {
+ atomic_inc(&vp->vref_count);
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 02fa81f122c2..60b6019a2fca 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -4864,6 +4864,7 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
+ if (fcport) {
+ fcport->id_changed = 1;
+ fcport->scan_state = QLA_FCPORT_FOUND;
++ fcport->chip_reset = vha->hw->base_qpair->chip_reset;
+ memcpy(fcport->node_name, e->u.new_sess.node_name, WWN_SIZE);
+
+ if (pla) {
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 9d7feb005acf..7a1cc0b25e59 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1216,7 +1216,6 @@ static void qla24xx_chk_fcp_state(struct fc_port *sess)
+ sess->logout_on_delete = 0;
+ sess->logo_ack_needed = 0;
+ sess->fw_login_state = DSC_LS_PORT_UNAVAIL;
+- sess->scan_state = 0;
+ }
+ }
+
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 75b926e70076..abfcc2f924ce 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1252,6 +1252,18 @@ static void scsi_initialize_rq(struct request *rq)
+ cmd->retries = 0;
+ }
+
++/*
++ * Only called when the request isn't completed by SCSI, and not freed by
++ * SCSI
++ */
++static void scsi_cleanup_rq(struct request *rq)
++{
++ if (rq->rq_flags & RQF_DONTPREP) {
++ scsi_mq_uninit_cmd(blk_mq_rq_to_pdu(rq));
++ rq->rq_flags &= ~RQF_DONTPREP;
++ }
++}
++
+ /* Add a command to the list used by the aacraid and dpt_i2o drivers */
+ void scsi_add_cmd_to_list(struct scsi_cmnd *cmd)
+ {
+@@ -2339,6 +2351,7 @@ static const struct blk_mq_ops scsi_mq_ops = {
+ .init_request = scsi_mq_init_request,
+ .exit_request = scsi_mq_exit_request,
+ .initialize_rq_fn = scsi_initialize_rq,
++ .cleanup_rq = scsi_cleanup_rq,
+ .map_queues = scsi_map_queues,
+ };
+
+diff --git a/drivers/staging/media/imx/imx6-mipi-csi2.c b/drivers/staging/media/imx/imx6-mipi-csi2.c
+index ceeeb3069a02..212fa06f7c57 100644
+--- a/drivers/staging/media/imx/imx6-mipi-csi2.c
++++ b/drivers/staging/media/imx/imx6-mipi-csi2.c
+@@ -247,7 +247,7 @@ static int __maybe_unused csi2_dphy_wait_ulp(struct csi2_dev *csi2)
+ }
+
+ /* Waits for low-power LP-11 state on data and clock lanes. */
+-static int csi2_dphy_wait_stopstate(struct csi2_dev *csi2)
++static void csi2_dphy_wait_stopstate(struct csi2_dev *csi2)
+ {
+ u32 mask, reg;
+ int ret;
+@@ -258,11 +258,9 @@ static int csi2_dphy_wait_stopstate(struct csi2_dev *csi2)
+ ret = readl_poll_timeout(csi2->base + CSI2_PHY_STATE, reg,
+ (reg & mask) == mask, 0, 500000);
+ if (ret) {
+- v4l2_err(&csi2->sd, "LP-11 timeout, phy_state = 0x%08x\n", reg);
+- return ret;
++ v4l2_warn(&csi2->sd, "LP-11 wait timeout, likely a sensor driver bug, expect capture failures.\n");
++ v4l2_warn(&csi2->sd, "phy_state = 0x%08x\n", reg);
+ }
+-
+- return 0;
+ }
+
+ /* Wait for active clock on the clock lane. */
+@@ -320,9 +318,7 @@ static int csi2_start(struct csi2_dev *csi2)
+ csi2_enable(csi2, true);
+
+ /* Step 5 */
+- ret = csi2_dphy_wait_stopstate(csi2);
+- if (ret)
+- goto err_assert_reset;
++ csi2_dphy_wait_stopstate(csi2);
+
+ /* Step 6 */
+ ret = v4l2_subdev_call(csi2->src_sd, video, s_stream, 1);
+diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
+index 9f39f0c360e0..cc1006375cac 100644
+--- a/drivers/video/fbdev/efifb.c
++++ b/drivers/video/fbdev/efifb.c
+@@ -122,28 +122,13 @@ static void efifb_copy_bmp(u8 *src, u32 *dst, int width, struct screen_info *si)
+ */
+ static bool efifb_bgrt_sanity_check(struct screen_info *si, u32 bmp_width)
+ {
+- static const int default_resolutions[][2] = {
+- { 800, 600 },
+- { 1024, 768 },
+- { 1280, 1024 },
+- };
+- u32 i, right_margin;
+-
+- for (i = 0; i < ARRAY_SIZE(default_resolutions); i++) {
+- if (default_resolutions[i][0] == si->lfb_width &&
+- default_resolutions[i][1] == si->lfb_height)
+- break;
+- }
+- /* If not a default resolution used for textmode, this should be fine */
+- if (i >= ARRAY_SIZE(default_resolutions))
+- return true;
+-
+- /* If the right margin is 5 times smaller then the left one, reject */
+- right_margin = si->lfb_width - (bgrt_tab.image_offset_x + bmp_width);
+- if (right_margin < (bgrt_tab.image_offset_x / 5))
+- return false;
++ /*
++ * All x86 firmwares horizontally center the image (the yoffset
++ * calculations differ between boards, but xoffset is predictable).
++ */
++ u32 expected_xoffset = (si->lfb_width - bmp_width) / 2;
+
+- return true;
++ return bgrt_tab.image_offset_x == expected_xoffset;
+ }
+ #else
+ static bool efifb_bgrt_sanity_check(struct screen_info *si, u32 bmp_width)
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 9a47e4e5dea0..e7fd0b5b9234 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1144,7 +1144,8 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ * (since it grows up, and may collide early with the stack
+ * growing down), and into the unused ELF_ET_DYN_BASE region.
+ */
+- if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && !interpreter)
++ if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) &&
++ loc->elf_ex.e_type == ET_DYN && !interpreter)
+ current->mm->brk = current->mm->start_brk =
+ ELF_ET_DYN_BASE;
+
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 79ac1ebabaf7..9fd383285f0e 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1374,6 +1374,7 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+ struct tree_mod_elem *tm;
+ struct extent_buffer *eb = NULL;
+ struct extent_buffer *eb_root;
++ u64 eb_root_owner = 0;
+ struct extent_buffer *old;
+ struct tree_mod_root *old_root = NULL;
+ u64 old_generation = 0;
+@@ -1411,6 +1412,7 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+ free_extent_buffer(old);
+ }
+ } else if (old_root) {
++ eb_root_owner = btrfs_header_owner(eb_root);
+ btrfs_tree_read_unlock(eb_root);
+ free_extent_buffer(eb_root);
+ eb = alloc_dummy_extent_buffer(fs_info, logical);
+@@ -1428,7 +1430,7 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+ if (old_root) {
+ btrfs_set_header_bytenr(eb, eb->start);
+ btrfs_set_header_backref_rev(eb, BTRFS_MIXED_BACKREF_REV);
+- btrfs_set_header_owner(eb, btrfs_header_owner(eb_root));
++ btrfs_set_header_owner(eb, eb_root_owner);
+ btrfs_set_header_level(eb, old_root->level);
+ btrfs_set_header_generation(eb, old_generation);
+ }
+@@ -5514,6 +5516,7 @@ int btrfs_compare_trees(struct btrfs_root *left_root,
+ advance_left = advance_right = 0;
+
+ while (1) {
++ cond_resched();
+ if (advance_left && !left_end_reached) {
+ ret = tree_advance(fs_info, left_path, &left_level,
+ left_root_level,
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 4644f9b629a5..faca485ccd8f 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -39,6 +39,7 @@ extern struct kmem_cache *btrfs_trans_handle_cachep;
+ extern struct kmem_cache *btrfs_bit_radix_cachep;
+ extern struct kmem_cache *btrfs_path_cachep;
+ extern struct kmem_cache *btrfs_free_space_cachep;
++extern struct kmem_cache *btrfs_free_space_bitmap_cachep;
+ struct btrfs_ordered_sum;
+
+ #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 88c939f7aad9..e49e29288049 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -7367,6 +7367,14 @@ search:
+ */
+ if ((flags & extra) && !(block_group->flags & extra))
+ goto loop;
++
++ /*
++ * This block group has different flags than we want.
++ * It's possible that we have MIXED_GROUP flag but no
++ * block group is mixed. Just skip such block group.
++ */
++ btrfs_release_block_group(block_group, delalloc);
++ continue;
+ }
+
+ have_block_group:
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index 8ecf8c0e5fe6..4381e0aba8c0 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -763,7 +763,8 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
+ } else {
+ ASSERT(num_bitmaps);
+ num_bitmaps--;
+- e->bitmap = kzalloc(PAGE_SIZE, GFP_NOFS);
++ e->bitmap = kmem_cache_zalloc(
++ btrfs_free_space_bitmap_cachep, GFP_NOFS);
+ if (!e->bitmap) {
+ kmem_cache_free(
+ btrfs_free_space_cachep, e);
+@@ -1864,7 +1865,7 @@ static void free_bitmap(struct btrfs_free_space_ctl *ctl,
+ struct btrfs_free_space *bitmap_info)
+ {
+ unlink_free_space(ctl, bitmap_info);
+- kfree(bitmap_info->bitmap);
++ kmem_cache_free(btrfs_free_space_bitmap_cachep, bitmap_info->bitmap);
+ kmem_cache_free(btrfs_free_space_cachep, bitmap_info);
+ ctl->total_bitmaps--;
+ ctl->op->recalc_thresholds(ctl);
+@@ -2118,7 +2119,8 @@ new_bitmap:
+ }
+
+ /* allocate the bitmap */
+- info->bitmap = kzalloc(PAGE_SIZE, GFP_NOFS);
++ info->bitmap = kmem_cache_zalloc(btrfs_free_space_bitmap_cachep,
++ GFP_NOFS);
+ spin_lock(&ctl->tree_lock);
+ if (!info->bitmap) {
+ ret = -ENOMEM;
+@@ -2130,7 +2132,8 @@ new_bitmap:
+ out:
+ if (info) {
+ if (info->bitmap)
+- kfree(info->bitmap);
++ kmem_cache_free(btrfs_free_space_bitmap_cachep,
++ info->bitmap);
+ kmem_cache_free(btrfs_free_space_cachep, info);
+ }
+
+@@ -2786,7 +2789,8 @@ out:
+ if (entry->bytes == 0) {
+ ctl->free_extents--;
+ if (entry->bitmap) {
+- kfree(entry->bitmap);
++ kmem_cache_free(btrfs_free_space_bitmap_cachep,
++ entry->bitmap);
+ ctl->total_bitmaps--;
+ ctl->op->recalc_thresholds(ctl);
+ }
+@@ -3594,7 +3598,7 @@ again:
+ }
+
+ if (!map) {
+- map = kzalloc(PAGE_SIZE, GFP_NOFS);
++ map = kmem_cache_zalloc(btrfs_free_space_bitmap_cachep, GFP_NOFS);
+ if (!map) {
+ kmem_cache_free(btrfs_free_space_cachep, info);
+ return -ENOMEM;
+@@ -3624,7 +3628,7 @@ again:
+ if (info)
+ kmem_cache_free(btrfs_free_space_cachep, info);
+ if (map)
+- kfree(map);
++ kmem_cache_free(btrfs_free_space_bitmap_cachep, map);
+ return 0;
+ }
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 98c535ae038d..37332f83a3a9 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -72,6 +72,7 @@ static struct kmem_cache *btrfs_inode_cachep;
+ struct kmem_cache *btrfs_trans_handle_cachep;
+ struct kmem_cache *btrfs_path_cachep;
+ struct kmem_cache *btrfs_free_space_cachep;
++struct kmem_cache *btrfs_free_space_bitmap_cachep;
+
+ #define S_SHIFT 12
+ static const unsigned char btrfs_type_by_mode[S_IFMT >> S_SHIFT] = {
+@@ -9361,6 +9362,7 @@ void __cold btrfs_destroy_cachep(void)
+ kmem_cache_destroy(btrfs_trans_handle_cachep);
+ kmem_cache_destroy(btrfs_path_cachep);
+ kmem_cache_destroy(btrfs_free_space_cachep);
++ kmem_cache_destroy(btrfs_free_space_bitmap_cachep);
+ }
+
+ int __init btrfs_init_cachep(void)
+@@ -9390,6 +9392,12 @@ int __init btrfs_init_cachep(void)
+ if (!btrfs_free_space_cachep)
+ goto fail;
+
++ btrfs_free_space_bitmap_cachep = kmem_cache_create("btrfs_free_space_bitmap",
++ PAGE_SIZE, PAGE_SIZE,
++ SLAB_RED_ZONE, NULL);
++ if (!btrfs_free_space_bitmap_cachep)
++ goto fail;
++
+ return 0;
+ fail:
+ btrfs_destroy_cachep();
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 734866ab5194..3ea2008dcde3 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2796,9 +2796,6 @@ out:
+ btrfs_free_path(path);
+
+ mutex_lock(&fs_info->qgroup_rescan_lock);
+- if (!btrfs_fs_closing(fs_info))
+- fs_info->qgroup_flags &= ~BTRFS_QGROUP_STATUS_FLAG_RESCAN;
+-
+ if (err > 0 &&
+ fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT) {
+ fs_info->qgroup_flags &= ~BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT;
+@@ -2814,16 +2811,30 @@ out:
+ trans = btrfs_start_transaction(fs_info->quota_root, 1);
+ if (IS_ERR(trans)) {
+ err = PTR_ERR(trans);
++ trans = NULL;
+ btrfs_err(fs_info,
+ "fail to start transaction for status update: %d",
+ err);
+- goto done;
+ }
+- ret = update_qgroup_status_item(trans);
+- if (ret < 0) {
+- err = ret;
+- btrfs_err(fs_info, "fail to update qgroup status: %d", err);
++
++ mutex_lock(&fs_info->qgroup_rescan_lock);
++ if (!btrfs_fs_closing(fs_info))
++ fs_info->qgroup_flags &= ~BTRFS_QGROUP_STATUS_FLAG_RESCAN;
++ if (trans) {
++ ret = update_qgroup_status_item(trans);
++ if (ret < 0) {
++ err = ret;
++ btrfs_err(fs_info, "fail to update qgroup status: %d",
++ err);
++ }
+ }
++ fs_info->qgroup_rescan_running = false;
++ complete_all(&fs_info->qgroup_rescan_completion);
++ mutex_unlock(&fs_info->qgroup_rescan_lock);
++
++ if (!trans)
++ return;
++
+ btrfs_end_transaction(trans);
+
+ if (btrfs_fs_closing(fs_info)) {
+@@ -2834,12 +2845,6 @@ out:
+ } else {
+ btrfs_err(fs_info, "qgroup scan failed with %d", err);
+ }
+-
+-done:
+- mutex_lock(&fs_info->qgroup_rescan_lock);
+- fs_info->qgroup_rescan_running = false;
+- mutex_unlock(&fs_info->qgroup_rescan_lock);
+- complete_all(&fs_info->qgroup_rescan_completion);
+ }
+
+ /*
+@@ -3067,6 +3072,9 @@ cleanup:
+ while ((unode = ulist_next(&reserved->range_changed, &uiter)))
+ clear_extent_bit(&BTRFS_I(inode)->io_tree, unode->val,
+ unode->aux, EXTENT_QGROUP_RESERVED, 0, 0, NULL);
++ /* Also free data bytes of already reserved one */
++ btrfs_qgroup_free_refroot(root->fs_info, root->root_key.objectid,
++ orig_reserved, BTRFS_QGROUP_RSV_DATA);
+ extent_changeset_release(reserved);
+ return ret;
+ }
+@@ -3111,7 +3119,7 @@ static int qgroup_free_reserved_data(struct inode *inode,
+ * EXTENT_QGROUP_RESERVED, we won't double free.
+ * So not need to rush.
+ */
+- ret = clear_record_extent_bits(&BTRFS_I(inode)->io_failure_tree,
++ ret = clear_record_extent_bits(&BTRFS_I(inode)->io_tree,
+ free_start, free_start + free_len - 1,
+ EXTENT_QGROUP_RESERVED, &changeset);
+ if (ret < 0)
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 665a86f83f4b..c06845237cba 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -579,7 +579,10 @@ void ceph_evict_inode(struct inode *inode)
+ ceph_buffer_put(ci->i_xattrs.prealloc_blob);
+
+ ceph_put_string(rcu_dereference_raw(ci->i_layout.pool_ns));
++}
+
++void ceph_destroy_inode(struct inode *inode)
++{
+ call_rcu(&inode->i_rcu, ceph_i_callback);
+ }
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index 02528e11bf33..ccab249a37f6 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -827,6 +827,7 @@ static int ceph_remount(struct super_block *sb, int *flags, char *data)
+
+ static const struct super_operations ceph_super_ops = {
+ .alloc_inode = ceph_alloc_inode,
++ .destroy_inode = ceph_destroy_inode,
+ .write_inode = ceph_write_inode,
+ .drop_inode = ceph_drop_inode,
+ .evict_inode = ceph_evict_inode,
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index 6e968e48e5e4..8d3eabf06d66 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -855,6 +855,7 @@ extern const struct inode_operations ceph_file_iops;
+
+ extern struct inode *ceph_alloc_inode(struct super_block *sb);
+ extern void ceph_evict_inode(struct inode *inode);
++extern void ceph_destroy_inode(struct inode *inode);
+ extern int ceph_drop_inode(struct inode *inode);
+
+ extern struct inode *ceph_get_inode(struct super_block *sb,
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 64e3888f30e6..d5457015801d 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -428,6 +428,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
+ cifs_show_security(s, tcon->ses);
+ cifs_show_cache_flavor(s, cifs_sb);
+
++ if (tcon->no_lease)
++ seq_puts(s, ",nolease");
+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER)
+ seq_puts(s, ",multiuser");
+ else if (tcon->ses->user_name)
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 57af9bac0045..4dbae6e268d6 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -543,6 +543,7 @@ struct smb_vol {
+ bool noblocksnd:1;
+ bool noautotune:1;
+ bool nostrictsync:1; /* do not force expensive SMBflush on every sync */
++ bool no_lease:1; /* disable requesting leases */
+ bool fsc:1; /* enable fscache */
+ bool mfsymlinks:1; /* use Minshall+French Symlinks */
+ bool multiuser:1;
+@@ -1004,6 +1005,7 @@ struct cifs_tcon {
+ bool need_reopen_files:1; /* need to reopen tcon file handles */
+ bool use_resilient:1; /* use resilient instead of durable handles */
+ bool use_persistent:1; /* use persistent instead of durable handles */
++ bool no_lease:1; /* Do not request leases on files or directories */
+ __le32 capabilities;
+ __u32 share_flags;
+ __u32 maximal_access;
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index c290e231f918..966e493c82e5 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -70,7 +70,7 @@ enum {
+ Opt_user_xattr, Opt_nouser_xattr,
+ Opt_forceuid, Opt_noforceuid,
+ Opt_forcegid, Opt_noforcegid,
+- Opt_noblocksend, Opt_noautotune,
++ Opt_noblocksend, Opt_noautotune, Opt_nolease,
+ Opt_hard, Opt_soft, Opt_perm, Opt_noperm,
+ Opt_mapposix, Opt_nomapposix,
+ Opt_mapchars, Opt_nomapchars, Opt_sfu,
+@@ -129,6 +129,7 @@ static const match_table_t cifs_mount_option_tokens = {
+ { Opt_noforcegid, "noforcegid" },
+ { Opt_noblocksend, "noblocksend" },
+ { Opt_noautotune, "noautotune" },
++ { Opt_nolease, "nolease" },
+ { Opt_hard, "hard" },
+ { Opt_soft, "soft" },
+ { Opt_perm, "perm" },
+@@ -1542,6 +1543,9 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ case Opt_noautotune:
+ vol->noautotune = 1;
+ break;
++ case Opt_nolease:
++ vol->no_lease = 1;
++ break;
+ case Opt_hard:
+ vol->retry = 1;
+ break;
+@@ -3023,6 +3027,8 @@ static int match_tcon(struct cifs_tcon *tcon, struct smb_vol *volume_info)
+ return 0;
+ if (tcon->snapshot_time != volume_info->snapshot_time)
+ return 0;
++ if (tcon->no_lease != volume_info->no_lease)
++ return 0;
+ return 1;
+ }
+
+@@ -3231,6 +3237,7 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
+ tcon->nocase = volume_info->nocase;
+ tcon->nohandlecache = volume_info->nohandlecache;
+ tcon->local_lease = volume_info->local_lease;
++ tcon->no_lease = volume_info->no_lease;
+ INIT_LIST_HEAD(&tcon->pending_opens);
+
+ spin_lock(&cifs_tcp_ses_lock);
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 094be406cde4..f0d966da7f37 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2398,6 +2398,11 @@ smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
+ if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE)
+ return;
+
++ /* Check if the server granted an oplock rather than a lease */
++ if (oplock & SMB2_OPLOCK_LEVEL_EXCLUSIVE)
++ return smb2_set_oplock_level(cinode, oplock, epoch,
++ purge_cache);
++
+ if (oplock & SMB2_LEASE_READ_CACHING_HE) {
+ new_oplock |= CIFS_CACHE_READ_FLG;
+ strcat(message, "R");
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index cbe633f1840a..b1f5d0d28335 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2192,7 +2192,7 @@ SMB2_open_init(struct cifs_tcon *tcon, struct smb_rqst *rqst, __u8 *oplock,
+ iov[1].iov_len = uni_path_len;
+ iov[1].iov_base = path;
+
+- if (!server->oplocks)
++ if ((!server->oplocks) || (tcon->no_lease))
+ *oplock = SMB2_OPLOCK_LEVEL_NONE;
+
+ if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) ||
+diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
+index 50ddb795aaeb..a2db401a58ed 100644
+--- a/fs/cifs/xattr.c
++++ b/fs/cifs/xattr.c
+@@ -31,7 +31,7 @@
+ #include "cifs_fs_sb.h"
+ #include "cifs_unicode.h"
+
+-#define MAX_EA_VALUE_SIZE 65535
++#define MAX_EA_VALUE_SIZE CIFSMaxBufSize
+ #define CIFS_XATTR_CIFS_ACL "system.cifs_acl"
+ #define CIFS_XATTR_ATTRIB "cifs.dosattrib" /* full name: user.cifs.dosattrib */
+ #define CIFS_XATTR_CREATETIME "cifs.creationtime" /* user.cifs.creationtime */
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 00bf0b67aae8..f81eb1785af2 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3748,8 +3748,8 @@ static int ext4_convert_unwritten_extents_endio(handle_t *handle,
+ * illegal.
+ */
+ if (ee_block != map->m_lblk || ee_len > map->m_len) {
+-#ifdef EXT4_DEBUG
+- ext4_warning("Inode (%ld) finished: extent logical block %llu,"
++#ifdef CONFIG_EXT4_DEBUG
++ ext4_warning(inode->i_sb, "Inode (%ld) finished: extent logical block %llu,"
+ " len %u; IO logical block %llu, len %u",
+ inode->i_ino, (unsigned long long)ee_block, ee_len,
+ (unsigned long long)map->m_lblk, map->m_len);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index cff6277f7a9f..a0c94c365a4c 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4265,6 +4265,15 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
+
+ trace_ext4_punch_hole(inode, offset, length, 0);
+
++ ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
++ if (ext4_has_inline_data(inode)) {
++ down_write(&EXT4_I(inode)->i_mmap_sem);
++ ret = ext4_convert_inline_data(inode);
++ up_write(&EXT4_I(inode)->i_mmap_sem);
++ if (ret)
++ return ret;
++ }
++
+ /*
+ * Write out all dirty pages to avoid race conditions
+ * Then release them.
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 6ee471b72a34..6d39143cfa09 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -331,7 +331,7 @@ static void queue_request(struct fuse_iqueue *fiq, struct fuse_req *req)
+ req->in.h.len = sizeof(struct fuse_in_header) +
+ len_args(req->in.numargs, (struct fuse_arg *) req->in.args);
+ list_add_tail(&req->list, &fiq->pending);
+- wake_up_locked(&fiq->waitq);
++ wake_up(&fiq->waitq);
+ kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
+ }
+
+@@ -343,16 +343,16 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
+ forget->forget_one.nodeid = nodeid;
+ forget->forget_one.nlookup = nlookup;
+
+- spin_lock(&fiq->waitq.lock);
++ spin_lock(&fiq->lock);
+ if (fiq->connected) {
+ fiq->forget_list_tail->next = forget;
+ fiq->forget_list_tail = forget;
+- wake_up_locked(&fiq->waitq);
++ wake_up(&fiq->waitq);
+ kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
+ } else {
+ kfree(forget);
+ }
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ }
+
+ static void flush_bg_queue(struct fuse_conn *fc)
+@@ -365,10 +365,10 @@ static void flush_bg_queue(struct fuse_conn *fc)
+ req = list_entry(fc->bg_queue.next, struct fuse_req, list);
+ list_del(&req->list);
+ fc->active_background++;
+- spin_lock(&fiq->waitq.lock);
++ spin_lock(&fiq->lock);
+ req->in.h.unique = fuse_get_unique(fiq);
+ queue_request(fiq, req);
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ }
+ }
+
+@@ -387,9 +387,9 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
+ if (test_and_set_bit(FR_FINISHED, &req->flags))
+ goto put_request;
+
+- spin_lock(&fiq->waitq.lock);
++ spin_lock(&fiq->lock);
+ list_del_init(&req->intr_entry);
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ WARN_ON(test_bit(FR_PENDING, &req->flags));
+ WARN_ON(test_bit(FR_SENT, &req->flags));
+ if (test_bit(FR_BACKGROUND, &req->flags)) {
+@@ -427,16 +427,16 @@ put_request:
+
+ static void queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req)
+ {
+- spin_lock(&fiq->waitq.lock);
++ spin_lock(&fiq->lock);
+ if (test_bit(FR_FINISHED, &req->flags)) {
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ return;
+ }
+ if (list_empty(&req->intr_entry)) {
+ list_add_tail(&req->intr_entry, &fiq->interrupts);
+- wake_up_locked(&fiq->waitq);
++ wake_up(&fiq->waitq);
+ }
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
+ }
+
+@@ -466,16 +466,16 @@ static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
+ if (!err)
+ return;
+
+- spin_lock(&fiq->waitq.lock);
++ spin_lock(&fiq->lock);
+ /* Request is not yet in userspace, bail out */
+ if (test_bit(FR_PENDING, &req->flags)) {
+ list_del(&req->list);
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ __fuse_put_request(req);
+ req->out.h.error = -EINTR;
+ return;
+ }
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ }
+
+ /*
+@@ -490,9 +490,9 @@ static void __fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
+ struct fuse_iqueue *fiq = &fc->iq;
+
+ BUG_ON(test_bit(FR_BACKGROUND, &req->flags));
+- spin_lock(&fiq->waitq.lock);
++ spin_lock(&fiq->lock);
+ if (!fiq->connected) {
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ req->out.h.error = -ENOTCONN;
+ } else {
+ req->in.h.unique = fuse_get_unique(fiq);
+@@ -500,7 +500,7 @@ static void __fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
+ /* acquire extra reference, since request is still needed
+ after request_end() */
+ __fuse_get_request(req);
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+
+ request_wait_answer(fc, req);
+ /* Pairs with smp_wmb() in request_end() */
+@@ -633,12 +633,12 @@ static int fuse_request_send_notify_reply(struct fuse_conn *fc,
+
+ __clear_bit(FR_ISREPLY, &req->flags);
+ req->in.h.unique = unique;
+- spin_lock(&fiq->waitq.lock);
++ spin_lock(&fiq->lock);
+ if (fiq->connected) {
+ queue_request(fiq, req);
+ err = 0;
+ }
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+
+ return err;
+ }
+@@ -1082,12 +1082,12 @@ static int request_pending(struct fuse_iqueue *fiq)
+ * Unlike other requests this is assembled on demand, without a need
+ * to allocate a separate fuse_req structure.
+ *
+- * Called with fiq->waitq.lock held, releases it
++ * Called with fiq->lock held, releases it
+ */
+ static int fuse_read_interrupt(struct fuse_iqueue *fiq,
+ struct fuse_copy_state *cs,
+ size_t nbytes, struct fuse_req *req)
+-__releases(fiq->waitq.lock)
++__releases(fiq->lock)
+ {
+ struct fuse_in_header ih;
+ struct fuse_interrupt_in arg;
+@@ -1103,7 +1103,7 @@ __releases(fiq->waitq.lock)
+ ih.unique = req->intr_unique;
+ arg.unique = req->in.h.unique;
+
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ if (nbytes < reqsize)
+ return -EINVAL;
+
+@@ -1140,7 +1140,7 @@ static struct fuse_forget_link *dequeue_forget(struct fuse_iqueue *fiq,
+ static int fuse_read_single_forget(struct fuse_iqueue *fiq,
+ struct fuse_copy_state *cs,
+ size_t nbytes)
+-__releases(fiq->waitq.lock)
++__releases(fiq->lock)
+ {
+ int err;
+ struct fuse_forget_link *forget = dequeue_forget(fiq, 1, NULL);
+@@ -1154,7 +1154,7 @@ __releases(fiq->waitq.lock)
+ .len = sizeof(ih) + sizeof(arg),
+ };
+
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ kfree(forget);
+ if (nbytes < ih.len)
+ return -EINVAL;
+@@ -1172,7 +1172,7 @@ __releases(fiq->waitq.lock)
+
+ static int fuse_read_batch_forget(struct fuse_iqueue *fiq,
+ struct fuse_copy_state *cs, size_t nbytes)
+-__releases(fiq->waitq.lock)
++__releases(fiq->lock)
+ {
+ int err;
+ unsigned max_forgets;
+@@ -1186,13 +1186,13 @@ __releases(fiq->waitq.lock)
+ };
+
+ if (nbytes < ih.len) {
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ return -EINVAL;
+ }
+
+ max_forgets = (nbytes - ih.len) / sizeof(struct fuse_forget_one);
+ head = dequeue_forget(fiq, max_forgets, &count);
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+
+ arg.count = count;
+ ih.len += count * sizeof(struct fuse_forget_one);
+@@ -1222,7 +1222,7 @@ __releases(fiq->waitq.lock)
+ static int fuse_read_forget(struct fuse_conn *fc, struct fuse_iqueue *fiq,
+ struct fuse_copy_state *cs,
+ size_t nbytes)
+-__releases(fiq->waitq.lock)
++__releases(fiq->lock)
+ {
+ if (fc->minor < 16 || fiq->forget_list_head.next->next == NULL)
+ return fuse_read_single_forget(fiq, cs, nbytes);
+@@ -1251,16 +1251,19 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
+ unsigned reqsize;
+
+ restart:
+- spin_lock(&fiq->waitq.lock);
+- err = -EAGAIN;
+- if ((file->f_flags & O_NONBLOCK) && fiq->connected &&
+- !request_pending(fiq))
+- goto err_unlock;
++ for (;;) {
++ spin_lock(&fiq->lock);
++ if (!fiq->connected || request_pending(fiq))
++ break;
++ spin_unlock(&fiq->lock);
+
+- err = wait_event_interruptible_exclusive_locked(fiq->waitq,
++ if (file->f_flags & O_NONBLOCK)
++ return -EAGAIN;
++ err = wait_event_interruptible_exclusive(fiq->waitq,
+ !fiq->connected || request_pending(fiq));
+- if (err)
+- goto err_unlock;
++ if (err)
++ return err;
++ }
+
+ if (!fiq->connected) {
+ err = (fc->aborted && fc->abort_err) ? -ECONNABORTED : -ENODEV;
+@@ -1284,7 +1287,7 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
+ req = list_entry(fiq->pending.next, struct fuse_req, list);
+ clear_bit(FR_PENDING, &req->flags);
+ list_del_init(&req->list);
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+
+ in = &req->in;
+ reqsize = in->h.len;
+@@ -1341,7 +1344,7 @@ out_end:
+ return err;
+
+ err_unlock:
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+ return err;
+ }
+
+@@ -2054,12 +2057,12 @@ static __poll_t fuse_dev_poll(struct file *file, poll_table *wait)
+ fiq = &fud->fc->iq;
+ poll_wait(file, &fiq->waitq, wait);
+
+- spin_lock(&fiq->waitq.lock);
++ spin_lock(&fiq->lock);
+ if (!fiq->connected)
+ mask = EPOLLERR;
+ else if (request_pending(fiq))
+ mask |= EPOLLIN | EPOLLRDNORM;
+- spin_unlock(&fiq->waitq.lock);
++ spin_unlock(&fiq->lock);
+
+ return mask;
+ }
+@@ -2150,15 +2153,15 @@ void fuse_abort_conn(struct fuse_conn *fc, bool is_abort)
+ fc->max_background = UINT_MAX;
+ flush_bg_queue(fc);
+
+- spin_lock(&fiq->waitq.lock);
++ spin_lock(&fiq->lock);
+ fiq->connected = 0;
+ list_for_each_entry(req, &fiq->pending, list)
+ clear_bit(FR_PENDING, &req->flags);
+ list_splice_tail_init(&fiq->pending, &to_end);
+ while (forget_pending(fiq))
+ kfree(dequeue_forget(fiq, 1, NULL));
+- wake_up_all_locked(&fiq->waitq);
+- spin_unlock(&fiq->waitq.lock);
++ wake_up_all(&fiq->waitq);
++ spin_unlock(&fiq->lock);
+ kill_fasync(&fiq->fasync, SIGIO, POLL_IN);
+ end_polls(fc);
+ wake_up_all(&fc->blocked_waitq);
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 9a22aa580fe7..96d46b3ad235 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1700,6 +1700,7 @@ static int fuse_writepage(struct page *page, struct writeback_control *wbc)
+ WARN_ON(wbc->sync_mode == WB_SYNC_ALL);
+
+ redirty_page_for_writepage(wbc, page);
++ unlock_page(page);
+ return 0;
+ }
+
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index cec8b8e74969..900bdcf79bfc 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -388,6 +388,9 @@ struct fuse_iqueue {
+ /** Connection established */
+ unsigned connected;
+
++ /** Lock protecting accesses to members of this structure */
++ spinlock_t lock;
++
+ /** Readers of the connection are waiting on this */
+ wait_queue_head_t waitq;
+
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index db9e60b7eb69..cb018315ecaf 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -585,6 +585,7 @@ static int fuse_show_options(struct seq_file *m, struct dentry *root)
+ static void fuse_iqueue_init(struct fuse_iqueue *fiq)
+ {
+ memset(fiq, 0, sizeof(struct fuse_iqueue));
++ spin_lock_init(&fiq->lock);
+ init_waitqueue_head(&fiq->waitq);
+ INIT_LIST_HEAD(&fiq->pending);
+ INIT_LIST_HEAD(&fiq->interrupts);
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index d14d71d8d7ee..52feccedd7a4 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -1630,6 +1630,7 @@ out_unlock:
+ brelse(dibh);
+ up_write(&ip->i_rw_mutex);
+ gfs2_trans_end(sdp);
++ buf_in_tr = false;
+ }
+ gfs2_glock_dq_uninit(rd_gh);
+ cond_resched();
+diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c
+index 54e5d17d7f3e..6fe303850c9e 100644
+--- a/fs/overlayfs/export.c
++++ b/fs/overlayfs/export.c
+@@ -230,9 +230,8 @@ static int ovl_d_to_fh(struct dentry *dentry, char *buf, int buflen)
+ /* Encode an upper or lower file handle */
+ fh = ovl_encode_real_fh(enc_lower ? ovl_dentry_lower(dentry) :
+ ovl_dentry_upper(dentry), !enc_lower);
+- err = PTR_ERR(fh);
+ if (IS_ERR(fh))
+- goto fail;
++ return PTR_ERR(fh);
+
+ err = -EOVERFLOW;
+ if (fh->len > buflen)
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index f0389849fd80..4f4964eeb086 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -386,7 +386,8 @@ static bool ovl_can_list(const char *s)
+ return true;
+
+ /* Never list trusted.overlay, list other trusted for superuser only */
+- return !ovl_is_private_xattr(s) && capable(CAP_SYS_ADMIN);
++ return !ovl_is_private_xattr(s) &&
++ ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN);
+ }
+
+ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
+diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
+index 1da59c16f637..2885dce1ad49 100644
+--- a/include/linux/blk-mq.h
++++ b/include/linux/blk-mq.h
+@@ -114,6 +114,7 @@ typedef void (busy_iter_fn)(struct blk_mq_hw_ctx *, struct request *, void *,
+ typedef void (busy_tag_iter_fn)(struct request *, void *, bool);
+ typedef int (poll_fn)(struct blk_mq_hw_ctx *, unsigned int);
+ typedef int (map_queues_fn)(struct blk_mq_tag_set *set);
++typedef void (cleanup_rq_fn)(struct request *);
+
+
+ struct blk_mq_ops {
+@@ -165,6 +166,12 @@ struct blk_mq_ops {
+ /* Called from inside blk_get_request() */
+ void (*initialize_rq_fn)(struct request *rq);
+
++ /*
++ * Called before freeing one request which isn't completed yet,
++ * and usually for freeing the driver private data
++ */
++ cleanup_rq_fn *cleanup_rq;
++
+ map_queues_fn *map_queues;
+
+ #ifdef CONFIG_BLK_DEBUG_FS
+@@ -324,4 +331,10 @@ static inline void *blk_mq_rq_to_pdu(struct request *rq)
+ for ((i) = 0; (i) < (hctx)->nr_ctx && \
+ ({ ctx = (hctx)->ctxs[(i)]; 1; }); (i)++)
+
++static inline void blk_mq_cleanup_rq(struct request *rq)
++{
++ if (rq->q->mq_ops->cleanup_rq)
++ rq->q->mq_ops->cleanup_rq(rq);
++}
++
+ #endif
+diff --git a/include/linux/bug.h b/include/linux/bug.h
+index fe5916550da8..f639bd0122f3 100644
+--- a/include/linux/bug.h
++++ b/include/linux/bug.h
+@@ -47,6 +47,11 @@ void generic_bug_clear_once(void);
+
+ #else /* !CONFIG_GENERIC_BUG */
+
++static inline void *find_bug(unsigned long bugaddr)
++{
++ return NULL;
++}
++
+ static inline enum bug_trap_type report_bug(unsigned long bug_addr,
+ struct pt_regs *regs)
+ {
+diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
+index 2ff52de1c2b8..840462ed1ec7 100644
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -488,6 +488,15 @@ void mmc_command_done(struct mmc_host *host, struct mmc_request *mrq);
+
+ void mmc_cqe_request_done(struct mmc_host *host, struct mmc_request *mrq);
+
++/*
++ * May be called from host driver's system/runtime suspend/resume callbacks,
++ * to know if SDIO IRQs has been claimed.
++ */
++static inline bool sdio_irq_claimed(struct mmc_host *host)
++{
++ return host->sdio_irqs > 0;
++}
++
+ static inline void mmc_signal_sdio_irq(struct mmc_host *host)
+ {
+ host->ops->enable_sdio_irq(host, 0);
+diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
+index dc905a4ff8d7..185d94829701 100644
+--- a/include/linux/quotaops.h
++++ b/include/linux/quotaops.h
+@@ -22,7 +22,7 @@ static inline struct quota_info *sb_dqopt(struct super_block *sb)
+ /* i_mutex must being held */
+ static inline bool is_quota_modification(struct inode *inode, struct iattr *ia)
+ {
+- return (ia->ia_valid & ATTR_SIZE && ia->ia_size != inode->i_size) ||
++ return (ia->ia_valid & ATTR_SIZE) ||
+ (ia->ia_valid & ATTR_UID && !uid_eq(ia->ia_uid, inode->i_uid)) ||
+ (ia->ia_valid & ATTR_GID && !gid_eq(ia->ia_gid, inode->i_gid));
+ }
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 714d63f60460..b8efca9dc2cb 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1505,7 +1505,8 @@ static int check_kprobe_address_safe(struct kprobe *p,
+ /* Ensure it is not in reserved area nor out of text */
+ if (!kernel_text_address((unsigned long) p->addr) ||
+ within_kprobe_blacklist((unsigned long) p->addr) ||
+- jump_label_text_reserved(p->addr, p->addr)) {
++ jump_label_text_reserved(p->addr, p->addr) ||
++ find_bug((unsigned long)p->addr)) {
+ ret = -EINVAL;
+ goto out;
+ }
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 06045abd1887..d0d03223b45b 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -3210,7 +3210,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
+ /* move first record forward until length fits into the buffer */
+ seq = dumper->cur_seq;
+ idx = dumper->cur_idx;
+- while (l > size && seq < dumper->next_seq) {
++ while (l >= size && seq < dumper->next_seq) {
+ struct printk_log *msg = log_from_idx(idx);
+
+ l -= msg_print_text(msg, true, NULL, 0);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 795c63ca44a9..f4e050681ba1 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3066,8 +3066,36 @@ void scheduler_tick(void)
+
+ struct tick_work {
+ int cpu;
++ atomic_t state;
+ struct delayed_work work;
+ };
++/* Values for ->state, see diagram below. */
++#define TICK_SCHED_REMOTE_OFFLINE 0
++#define TICK_SCHED_REMOTE_OFFLINING 1
++#define TICK_SCHED_REMOTE_RUNNING 2
++
++/*
++ * State diagram for ->state:
++ *
++ *
++ * TICK_SCHED_REMOTE_OFFLINE
++ * | ^
++ * | |
++ * | | sched_tick_remote()
++ * | |
++ * | |
++ * +--TICK_SCHED_REMOTE_OFFLINING
++ * | ^
++ * | |
++ * sched_tick_start() | | sched_tick_stop()
++ * | |
++ * V |
++ * TICK_SCHED_REMOTE_RUNNING
++ *
++ *
++ * Other transitions get WARN_ON_ONCE(), except that sched_tick_remote()
++ * and sched_tick_start() are happy to leave the state in RUNNING.
++ */
+
+ static struct tick_work __percpu *tick_work_cpu;
+
+@@ -3080,6 +3108,7 @@ static void sched_tick_remote(struct work_struct *work)
+ struct task_struct *curr;
+ struct rq_flags rf;
+ u64 delta;
++ int os;
+
+ /*
+ * Handle the tick only if it appears the remote CPU is running in full
+@@ -3093,7 +3122,7 @@ static void sched_tick_remote(struct work_struct *work)
+
+ rq_lock_irq(rq, &rf);
+ curr = rq->curr;
+- if (is_idle_task(curr))
++ if (is_idle_task(curr) || cpu_is_offline(cpu))
+ goto out_unlock;
+
+ update_rq_clock(rq);
+@@ -3113,13 +3142,18 @@ out_requeue:
+ /*
+ * Run the remote tick once per second (1Hz). This arbitrary
+ * frequency is large enough to avoid overload but short enough
+- * to keep scheduler internal stats reasonably up to date.
++ * to keep scheduler internal stats reasonably up to date. But
++ * first update state to reflect hotplug activity if required.
+ */
+- queue_delayed_work(system_unbound_wq, dwork, HZ);
++ os = atomic_fetch_add_unless(&twork->state, -1, TICK_SCHED_REMOTE_RUNNING);
++ WARN_ON_ONCE(os == TICK_SCHED_REMOTE_OFFLINE);
++ if (os == TICK_SCHED_REMOTE_RUNNING)
++ queue_delayed_work(system_unbound_wq, dwork, HZ);
+ }
+
+ static void sched_tick_start(int cpu)
+ {
++ int os;
+ struct tick_work *twork;
+
+ if (housekeeping_cpu(cpu, HK_FLAG_TICK))
+@@ -3128,15 +3162,20 @@ static void sched_tick_start(int cpu)
+ WARN_ON_ONCE(!tick_work_cpu);
+
+ twork = per_cpu_ptr(tick_work_cpu, cpu);
+- twork->cpu = cpu;
+- INIT_DELAYED_WORK(&twork->work, sched_tick_remote);
+- queue_delayed_work(system_unbound_wq, &twork->work, HZ);
++ os = atomic_xchg(&twork->state, TICK_SCHED_REMOTE_RUNNING);
++ WARN_ON_ONCE(os == TICK_SCHED_REMOTE_RUNNING);
++ if (os == TICK_SCHED_REMOTE_OFFLINE) {
++ twork->cpu = cpu;
++ INIT_DELAYED_WORK(&twork->work, sched_tick_remote);
++ queue_delayed_work(system_unbound_wq, &twork->work, HZ);
++ }
+ }
+
+ #ifdef CONFIG_HOTPLUG_CPU
+ static void sched_tick_stop(int cpu)
+ {
+ struct tick_work *twork;
++ int os;
+
+ if (housekeeping_cpu(cpu, HK_FLAG_TICK))
+ return;
+@@ -3144,7 +3183,10 @@ static void sched_tick_stop(int cpu)
+ WARN_ON_ONCE(!tick_work_cpu);
+
+ twork = per_cpu_ptr(tick_work_cpu, cpu);
+- cancel_delayed_work_sync(&twork->work);
++ /* There cannot be competing actions, but don't rely on stop-machine. */
++ os = atomic_xchg(&twork->state, TICK_SCHED_REMOTE_OFFLINING);
++ WARN_ON_ONCE(os != TICK_SCHED_REMOTE_RUNNING);
++ /* Don't cancel, as this would mess up the state machine. */
+ }
+ #endif /* CONFIG_HOTPLUG_CPU */
+
+@@ -3152,7 +3194,6 @@ int __init sched_tick_offload_init(void)
+ {
+ tick_work_cpu = alloc_percpu(struct tick_work);
+ BUG_ON(!tick_work_cpu);
+-
+ return 0;
+ }
+
+@@ -6453,10 +6494,6 @@ static int cpu_cgroup_can_attach(struct cgroup_taskset *tset)
+ #ifdef CONFIG_RT_GROUP_SCHED
+ if (!sched_rt_can_attach(css_tg(css), task))
+ return -EINVAL;
+-#else
+- /* We don't support RT-tasks being in separate groups */
+- if (task->sched_class != &fair_sched_class)
+- return -EINVAL;
+ #endif
+ /*
+ * Serialize against wake_up_new_task() such that if its
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index 64d54acc9928..54fcff656ecd 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -118,6 +118,7 @@ static void sugov_fast_switch(struct sugov_policy *sg_policy, u64 time,
+ unsigned int next_freq)
+ {
+ struct cpufreq_policy *policy = sg_policy->policy;
++ int cpu;
+
+ if (!sugov_update_next_freq(sg_policy, time, next_freq))
+ return;
+@@ -127,7 +128,11 @@ static void sugov_fast_switch(struct sugov_policy *sg_policy, u64 time,
+ return;
+
+ policy->cur = next_freq;
+- trace_cpu_frequency(next_freq, smp_processor_id());
++
++ if (trace_cpu_frequency_enabled()) {
++ for_each_cpu(cpu, policy->cpus)
++ trace_cpu_frequency(next_freq, cpu);
++ }
+ }
+
+ static void sugov_deferred_update(struct sugov_policy *sg_policy, u64 time,
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 72c07059ef37..ebec37cb3be9 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -529,6 +529,7 @@ static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq);
+ static struct rq *dl_task_offline_migration(struct rq *rq, struct task_struct *p)
+ {
+ struct rq *later_rq = NULL;
++ struct dl_bw *dl_b;
+
+ later_rq = find_lock_later_rq(p, rq);
+ if (!later_rq) {
+@@ -557,6 +558,38 @@ static struct rq *dl_task_offline_migration(struct rq *rq, struct task_struct *p
+ double_lock_balance(rq, later_rq);
+ }
+
++ if (p->dl.dl_non_contending || p->dl.dl_throttled) {
++ /*
++ * Inactive timer is armed (or callback is running, but
++ * waiting for us to release rq locks). In any case, when it
++ * will fire (or continue), it will see running_bw of this
++ * task migrated to later_rq (and correctly handle it).
++ */
++ sub_running_bw(&p->dl, &rq->dl);
++ sub_rq_bw(&p->dl, &rq->dl);
++
++ add_rq_bw(&p->dl, &later_rq->dl);
++ add_running_bw(&p->dl, &later_rq->dl);
++ } else {
++ sub_rq_bw(&p->dl, &rq->dl);
++ add_rq_bw(&p->dl, &later_rq->dl);
++ }
++
++ /*
++ * And we finally need to fixup root_domain(s) bandwidth accounting,
++ * since p is still hanging out in the old (now moved to default) root
++ * domain.
++ */
++ dl_b = &rq->rd->dl_bw;
++ raw_spin_lock(&dl_b->lock);
++ __dl_sub(dl_b, p->dl.dl_bw, cpumask_weight(rq->rd->span));
++ raw_spin_unlock(&dl_b->lock);
++
++ dl_b = &later_rq->rd->dl_bw;
++ raw_spin_lock(&dl_b->lock);
++ __dl_add(dl_b, p->dl.dl_bw, cpumask_weight(later_rq->rd->span));
++ raw_spin_unlock(&dl_b->lock);
++
+ set_task_cpu(p, later_rq->cpu);
+ double_unlock_balance(later_rq, rq);
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 49ed38914669..32d2dac680a7 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -8863,9 +8863,10 @@ more_balance:
+ out_balanced:
+ /*
+ * We reach balance although we may have faced some affinity
+- * constraints. Clear the imbalance flag if it was set.
++ * constraints. Clear the imbalance flag only if other tasks got
++ * a chance to move and fix the imbalance.
+ */
+- if (sd_parent) {
++ if (sd_parent && !(env.flags & LBF_ALL_PINNED)) {
+ int *group_imbalance = &sd_parent->groups->sgc->imbalance;
+
+ if (*group_imbalance)
+@@ -10078,18 +10079,18 @@ err:
+ void online_fair_sched_group(struct task_group *tg)
+ {
+ struct sched_entity *se;
++ struct rq_flags rf;
+ struct rq *rq;
+ int i;
+
+ for_each_possible_cpu(i) {
+ rq = cpu_rq(i);
+ se = tg->se[i];
+-
+- raw_spin_lock_irq(&rq->lock);
++ rq_lock_irq(rq, &rf);
+ update_rq_clock(rq);
+ attach_entity_cfs_rq(se);
+ sync_throttle(tg, i);
+- raw_spin_unlock_irq(&rq->lock);
++ rq_unlock_irq(rq, &rf);
+ }
+ }
+
+diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
+index 16f84142f2f4..44a17366c8ec 100644
+--- a/kernel/sched/idle.c
++++ b/kernel/sched/idle.c
+@@ -240,13 +240,14 @@ static void do_idle(void)
+ check_pgt_cache();
+ rmb();
+
++ local_irq_disable();
++
+ if (cpu_is_offline(cpu)) {
+- tick_nohz_idle_stop_tick_protected();
++ tick_nohz_idle_stop_tick();
+ cpuhp_report_idle_dead();
+ arch_cpu_idle_dead();
+ }
+
+- local_irq_disable();
+ arch_cpu_idle_enter();
+
+ /*
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index fdeb9bc6affb..f4255a65c44b 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -676,7 +676,7 @@ static int alarm_timer_create(struct k_itimer *new_timer)
+ enum alarmtimer_type type;
+
+ if (!alarmtimer_get_rtcdev())
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+
+ if (!capable(CAP_WAKE_ALARM))
+ return -EPERM;
+@@ -794,7 +794,7 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags,
+ int ret = 0;
+
+ if (!alarmtimer_get_rtcdev())
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+
+ if (flags & ~TIMER_ABSTIME)
+ return -EINVAL;
+diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
+index 76801b9b481e..d62d7ae5201c 100644
+--- a/kernel/time/posix-cpu-timers.c
++++ b/kernel/time/posix-cpu-timers.c
+@@ -375,7 +375,8 @@ static int posix_cpu_timer_del(struct k_itimer *timer)
+ struct sighand_struct *sighand;
+ struct task_struct *p = timer->it.cpu.task;
+
+- WARN_ON_ONCE(p == NULL);
++ if (WARN_ON_ONCE(!p))
++ return -EINVAL;
+
+ /*
+ * Protect against sighand release/switch in exit/exec and process/
+@@ -580,7 +581,8 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags,
+ u64 old_expires, new_expires, old_incr, val;
+ int ret;
+
+- WARN_ON_ONCE(p == NULL);
++ if (WARN_ON_ONCE(!p))
++ return -EINVAL;
+
+ /*
+ * Use the to_ktime conversion because that clamps the maximum
+@@ -716,10 +718,11 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags,
+
+ static void posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec64 *itp)
+ {
+- u64 now;
+ struct task_struct *p = timer->it.cpu.task;
++ u64 now;
+
+- WARN_ON_ONCE(p == NULL);
++ if (WARN_ON_ONCE(!p))
++ return;
+
+ /*
+ * Easy part: convert the reload time.
+@@ -1004,12 +1007,13 @@ static void check_process_timers(struct task_struct *tsk,
+ */
+ static void posix_cpu_timer_rearm(struct k_itimer *timer)
+ {
++ struct task_struct *p = timer->it.cpu.task;
+ struct sighand_struct *sighand;
+ unsigned long flags;
+- struct task_struct *p = timer->it.cpu.task;
+ u64 now;
+
+- WARN_ON_ONCE(p == NULL);
++ if (WARN_ON_ONCE(!p))
++ return;
+
+ /*
+ * Fetch the current sample and update the timer's expiry time.
+@@ -1206,7 +1210,9 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clock_idx,
+ u64 now;
+ int ret;
+
+- WARN_ON_ONCE(clock_idx == CPUCLOCK_SCHED);
++ if (WARN_ON_ONCE(clock_idx >= CPUCLOCK_SCHED))
++ return;
++
+ ret = cpu_timer_sample_group(clock_idx, tsk, &now);
+
+ if (oldval && ret != -EINVAL) {
+diff --git a/mm/compaction.c b/mm/compaction.c
+index faca45ebe62d..5079ddbec8f9 100644
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -1540,6 +1540,17 @@ static enum compact_result compact_zone(struct zone *zone, struct compact_contro
+ unsigned long end_pfn = zone_end_pfn(zone);
+ const bool sync = cc->mode != MIGRATE_ASYNC;
+
++ /*
++ * These counters track activities during zone compaction. Initialize
++ * them before compacting a new zone.
++ */
++ cc->total_migrate_scanned = 0;
++ cc->total_free_scanned = 0;
++ cc->nr_migratepages = 0;
++ cc->nr_freepages = 0;
++ INIT_LIST_HEAD(&cc->freepages);
++ INIT_LIST_HEAD(&cc->migratepages);
++
+ cc->migratetype = gfpflags_to_migratetype(cc->gfp_mask);
+ ret = compaction_suitable(zone, cc->order, cc->alloc_flags,
+ cc->classzone_idx);
+@@ -1703,10 +1714,6 @@ static enum compact_result compact_zone_order(struct zone *zone, int order,
+ {
+ enum compact_result ret;
+ struct compact_control cc = {
+- .nr_freepages = 0,
+- .nr_migratepages = 0,
+- .total_migrate_scanned = 0,
+- .total_free_scanned = 0,
+ .order = order,
+ .gfp_mask = gfp_mask,
+ .zone = zone,
+@@ -1719,8 +1726,6 @@ static enum compact_result compact_zone_order(struct zone *zone, int order,
+ .ignore_skip_hint = (prio == MIN_COMPACT_PRIORITY),
+ .ignore_block_suitable = (prio == MIN_COMPACT_PRIORITY)
+ };
+- INIT_LIST_HEAD(&cc.freepages);
+- INIT_LIST_HEAD(&cc.migratepages);
+
+ ret = compact_zone(zone, &cc);
+
+@@ -1819,8 +1824,6 @@ static void compact_node(int nid)
+ struct zone *zone;
+ struct compact_control cc = {
+ .order = -1,
+- .total_migrate_scanned = 0,
+- .total_free_scanned = 0,
+ .mode = MIGRATE_SYNC,
+ .ignore_skip_hint = true,
+ .whole_zone = true,
+@@ -1834,11 +1837,7 @@ static void compact_node(int nid)
+ if (!populated_zone(zone))
+ continue;
+
+- cc.nr_freepages = 0;
+- cc.nr_migratepages = 0;
+ cc.zone = zone;
+- INIT_LIST_HEAD(&cc.freepages);
+- INIT_LIST_HEAD(&cc.migratepages);
+
+ compact_zone(zone, &cc);
+
+@@ -1947,8 +1946,6 @@ static void kcompactd_do_work(pg_data_t *pgdat)
+ struct zone *zone;
+ struct compact_control cc = {
+ .order = pgdat->kcompactd_max_order,
+- .total_migrate_scanned = 0,
+- .total_free_scanned = 0,
+ .classzone_idx = pgdat->kcompactd_classzone_idx,
+ .mode = MIGRATE_SYNC_LIGHT,
+ .ignore_skip_hint = false,
+@@ -1972,16 +1969,10 @@ static void kcompactd_do_work(pg_data_t *pgdat)
+ COMPACT_CONTINUE)
+ continue;
+
+- cc.nr_freepages = 0;
+- cc.nr_migratepages = 0;
+- cc.total_migrate_scanned = 0;
+- cc.total_free_scanned = 0;
+- cc.zone = zone;
+- INIT_LIST_HEAD(&cc.freepages);
+- INIT_LIST_HEAD(&cc.migratepages);
+-
+ if (kthread_should_stop())
+ return;
++
++ cc.zone = zone;
+ status = compact_zone(zone, &cc);
+
+ if (status == COMPACT_SUCCESS) {
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index ecde75f2189b..65da189a433b 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -2637,6 +2637,16 @@ int memcg_kmem_charge_memcg(struct page *page, gfp_t gfp, int order,
+
+ if (!cgroup_subsys_on_dfl(memory_cgrp_subsys) &&
+ !page_counter_try_charge(&memcg->kmem, nr_pages, &counter)) {
++
++ /*
++ * Enforce __GFP_NOFAIL allocation because callers are not
++ * prepared to see failures and likely do not have any failure
++ * handling code.
++ */
++ if (gfp & __GFP_NOFAIL) {
++ page_counter_charge(&memcg->kmem, nr_pages);
++ return 0;
++ }
+ cancel_charge(memcg, nr_pages);
+ return -ENOMEM;
+ }
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index dbddb7a409dd..a581fe2a2f1f 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -1089,9 +1089,10 @@ bool out_of_memory(struct oom_control *oc)
+ * The OOM killer does not compensate for IO-less reclaim.
+ * pagefault_out_of_memory lost its gfp context so we have to
+ * make sure exclude 0 mask - all other users should have at least
+- * ___GFP_DIRECT_RECLAIM to get here.
++ * ___GFP_DIRECT_RECLAIM to get here. But mem_cgroup_oom() has to
++ * invoke the OOM killer even if it is a GFP_NOFS allocation.
+ */
+- if (oc->gfp_mask && !(oc->gfp_mask & __GFP_FS))
++ if (oc->gfp_mask && !(oc->gfp_mask & __GFP_FS) && !is_memcg_oom(oc))
+ return true;
+
+ /*
+diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
+index 795fbc6c06aa..9abb18fffbc3 100644
+--- a/net/appletalk/ddp.c
++++ b/net/appletalk/ddp.c
+@@ -1028,6 +1028,11 @@ static int atalk_create(struct net *net, struct socket *sock, int protocol,
+ */
+ if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
+ goto out;
++
++ rc = -EPERM;
++ if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
++ goto out;
++
+ rc = -ENOMEM;
+ sk = sk_alloc(net, PF_APPLETALK, GFP_KERNEL, &ddp_proto, kern);
+ if (!sk)
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index 5d01edf8d819..44ec492f3dc2 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -858,6 +858,8 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol,
+ break;
+
+ case SOCK_RAW:
++ if (!capable(CAP_NET_RAW))
++ return -EPERM;
+ break;
+ default:
+ return -ESOCKTNOSUPPORT;
+diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
+index bc6b912603f1..89819745e482 100644
+--- a/net/ieee802154/socket.c
++++ b/net/ieee802154/socket.c
+@@ -1018,6 +1018,9 @@ static int ieee802154_create(struct net *net, struct socket *sock,
+
+ switch (sock->type) {
+ case SOCK_RAW:
++ rc = -EPERM;
++ if (!capable(CAP_NET_RAW))
++ goto out;
+ proto = &ieee802154_raw_prot;
+ ops = &ieee802154_raw_ops;
+ break;
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 17335a370e64..9d775b8df57d 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -219,7 +219,7 @@ static int tcp_write_timeout(struct sock *sk)
+ struct inet_connection_sock *icsk = inet_csk(sk);
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct net *net = sock_net(sk);
+- bool expired, do_reset;
++ bool expired = false, do_reset;
+ int retry_until;
+
+ if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
+@@ -251,9 +251,10 @@ static int tcp_write_timeout(struct sock *sk)
+ if (tcp_out_of_resources(sk, do_reset))
+ return 1;
+ }
++ }
++ if (!expired)
+ expired = retransmits_timed_out(sk, retry_until,
+ icsk->icsk_user_timeout);
+- }
+ tcp_fastopen_active_detect_blackhole(sk, expired);
+
+ if (BPF_SOCK_OPS_TEST_FLAG(tp, BPF_SOCK_OPS_RTO_CB_FLAG))
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index ae296273ce3d..ff254e8c0c44 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -1011,10 +1011,13 @@ static int llcp_sock_create(struct net *net, struct socket *sock,
+ sock->type != SOCK_RAW)
+ return -ESOCKTNOSUPPORT;
+
+- if (sock->type == SOCK_RAW)
++ if (sock->type == SOCK_RAW) {
++ if (!capable(CAP_NET_RAW))
++ return -EPERM;
+ sock->ops = &llcp_rawsock_ops;
+- else
++ } else {
+ sock->ops = &llcp_sock_ops;
++ }
+
+ sk = nfc_llcp_sock_alloc(sock, sock->type, GFP_ATOMIC, kern);
+ if (sk == NULL)
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index 0f5ce77460d4..8e396c7c8389 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -2239,7 +2239,7 @@ static const struct nla_policy vport_policy[OVS_VPORT_ATTR_MAX + 1] = {
+ [OVS_VPORT_ATTR_STATS] = { .len = sizeof(struct ovs_vport_stats) },
+ [OVS_VPORT_ATTR_PORT_NO] = { .type = NLA_U32 },
+ [OVS_VPORT_ATTR_TYPE] = { .type = NLA_U32 },
+- [OVS_VPORT_ATTR_UPCALL_PID] = { .type = NLA_U32 },
++ [OVS_VPORT_ATTR_UPCALL_PID] = { .type = NLA_UNSPEC },
+ [OVS_VPORT_ATTR_OPTIONS] = { .type = NLA_NESTED },
+ [OVS_VPORT_ATTR_IFINDEX] = { .type = NLA_U32 },
+ [OVS_VPORT_ATTR_NETNSID] = { .type = NLA_S32 },
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 86e1e37eb4e8..5c75118539bb 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -157,6 +157,7 @@ static void __qrtr_node_release(struct kref *kref)
+ list_del(&node->item);
+ mutex_unlock(&qrtr_node_lock);
+
++ cancel_work_sync(&node->work);
+ skb_queue_purge(&node->rx_queue);
+ kfree(node);
+ }
+diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
+index 98635311a5a0..ea0738ceb5bb 100644
+--- a/net/sched/act_sample.c
++++ b/net/sched/act_sample.c
+@@ -134,6 +134,7 @@ static bool tcf_sample_dev_ok_push(struct net_device *dev)
+ case ARPHRD_TUNNEL6:
+ case ARPHRD_SIT:
+ case ARPHRD_IPGRE:
++ case ARPHRD_IP6GRE:
+ case ARPHRD_VOID:
+ case ARPHRD_NONE:
+ return false;
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 4159bcb479c6..e217ebc693f8 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -2038,8 +2038,10 @@ out:
+ void tcf_exts_destroy(struct tcf_exts *exts)
+ {
+ #ifdef CONFIG_NET_CLS_ACT
+- tcf_action_destroy(exts->actions, TCA_ACT_UNBIND);
+- kfree(exts->actions);
++ if (exts->actions) {
++ tcf_action_destroy(exts->actions, TCA_ACT_UNBIND);
++ kfree(exts->actions);
++ }
+ exts->nr_actions = 0;
+ #endif
+ }
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index b06cc5e50412..84fdc4857771 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1308,7 +1308,8 @@ check_loop_fn(struct Qdisc *q, unsigned long cl, struct qdisc_walker *w)
+ }
+
+ const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = {
+- [TCA_KIND] = { .type = NLA_STRING },
++ [TCA_KIND] = { .type = NLA_NUL_STRING,
++ .len = IFNAMSIZ - 1 },
+ [TCA_RATE] = { .type = NLA_BINARY,
+ .len = sizeof(struct tc_estimator) },
+ [TCA_STAB] = { .type = NLA_NESTED },
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 4dfe10b9f96c..86350fe5cfc8 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -749,7 +749,7 @@ static int get_dist_table(struct Qdisc *sch, struct disttable **tbl,
+ struct disttable *d;
+ int i;
+
+- if (n > NETEM_DIST_MAX)
++ if (!n || n > NETEM_DIST_MAX)
+ return -EINVAL;
+
+ d = kvmalloc(sizeof(struct disttable) + n * sizeof(s16), GFP_KERNEL);
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index c14e8f6e5e19..d641d81da759 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -930,6 +930,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
+ }
+
+ cfg80211_process_rdev_events(rdev);
++ cfg80211_mlme_purge_registrations(dev->ieee80211_ptr);
+ }
+
+ err = rdev_change_virtual_intf(rdev, dev, ntype, params);
+diff --git a/scripts/gcc-plugins/randomize_layout_plugin.c b/scripts/gcc-plugins/randomize_layout_plugin.c
+index 6d5bbd31db7f..bd29e4e7a524 100644
+--- a/scripts/gcc-plugins/randomize_layout_plugin.c
++++ b/scripts/gcc-plugins/randomize_layout_plugin.c
+@@ -443,13 +443,13 @@ static int is_pure_ops_struct(const_tree node)
+ if (node == fieldtype)
+ continue;
+
+- if (!is_fptr(fieldtype))
+- return 0;
+-
+- if (code != RECORD_TYPE && code != UNION_TYPE)
++ if (code == RECORD_TYPE || code == UNION_TYPE) {
++ if (!is_pure_ops_struct(fieldtype))
++ return 0;
+ continue;
++ }
+
+- if (!is_pure_ops_struct(fieldtype))
++ if (!is_fptr(fieldtype))
+ return 0;
+ }
+
+diff --git a/sound/firewire/motu/motu.c b/sound/firewire/motu/motu.c
+index 743015e87a96..e240fdfcae31 100644
+--- a/sound/firewire/motu/motu.c
++++ b/sound/firewire/motu/motu.c
+@@ -255,6 +255,17 @@ static const struct snd_motu_spec motu_audio_express = {
+ .analog_out_ports = 4,
+ };
+
++static const struct snd_motu_spec motu_4pre = {
++ .name = "4pre",
++ .protocol = &snd_motu_protocol_v3,
++ .flags = SND_MOTU_SPEC_SUPPORT_CLOCK_X2 |
++ SND_MOTU_SPEC_TX_MICINST_CHUNK |
++ SND_MOTU_SPEC_TX_RETURN_CHUNK |
++ SND_MOTU_SPEC_RX_SEPARETED_MAIN,
++ .analog_in_ports = 2,
++ .analog_out_ports = 2,
++};
++
+ #define SND_MOTU_DEV_ENTRY(model, data) \
+ { \
+ .match_flags = IEEE1394_MATCH_VENDOR_ID | \
+@@ -272,6 +283,7 @@ static const struct ieee1394_device_id motu_id_table[] = {
+ SND_MOTU_DEV_ENTRY(0x000015, &motu_828mk3), /* FireWire only. */
+ SND_MOTU_DEV_ENTRY(0x000035, &motu_828mk3), /* Hybrid. */
+ SND_MOTU_DEV_ENTRY(0x000033, &motu_audio_express),
++ SND_MOTU_DEV_ENTRY(0x000045, &motu_4pre),
+ { }
+ };
+ MODULE_DEVICE_TABLE(ieee1394, motu_id_table);
+diff --git a/sound/firewire/tascam/tascam-pcm.c b/sound/firewire/tascam/tascam-pcm.c
+index e4cc8990e195..9e58633e2dea 100644
+--- a/sound/firewire/tascam/tascam-pcm.c
++++ b/sound/firewire/tascam/tascam-pcm.c
+@@ -57,6 +57,9 @@ static int pcm_open(struct snd_pcm_substream *substream)
+ goto err_locked;
+
+ err = snd_tscm_stream_get_clock(tscm, &clock);
++ if (err < 0)
++ goto err_locked;
++
+ if (clock != SND_TSCM_CLOCK_INTERNAL ||
+ amdtp_stream_pcm_running(&tscm->rx_stream) ||
+ amdtp_stream_pcm_running(&tscm->tx_stream)) {
+diff --git a/sound/firewire/tascam/tascam-stream.c b/sound/firewire/tascam/tascam-stream.c
+index f1657a4e0621..a1308f12a65b 100644
+--- a/sound/firewire/tascam/tascam-stream.c
++++ b/sound/firewire/tascam/tascam-stream.c
+@@ -9,20 +9,37 @@
+ #include <linux/delay.h>
+ #include "tascam.h"
+
++#define CLOCK_STATUS_MASK 0xffff0000
++#define CLOCK_CONFIG_MASK 0x0000ffff
++
+ #define CALLBACK_TIMEOUT 500
+
+ static int get_clock(struct snd_tscm *tscm, u32 *data)
+ {
++ int trial = 0;
+ __be32 reg;
+ int err;
+
+- err = snd_fw_transaction(tscm->unit, TCODE_READ_QUADLET_REQUEST,
+- TSCM_ADDR_BASE + TSCM_OFFSET_CLOCK_STATUS,
+- ®, sizeof(reg), 0);
+- if (err >= 0)
++ while (trial++ < 5) {
++ err = snd_fw_transaction(tscm->unit, TCODE_READ_QUADLET_REQUEST,
++ TSCM_ADDR_BASE + TSCM_OFFSET_CLOCK_STATUS,
++ ®, sizeof(reg), 0);
++ if (err < 0)
++ return err;
++
+ *data = be32_to_cpu(reg);
++ if (*data & CLOCK_STATUS_MASK)
++ break;
+
+- return err;
++ // In intermediate state after changing clock status.
++ msleep(50);
++ }
++
++ // Still in the intermediate state.
++ if (trial >= 5)
++ return -EAGAIN;
++
++ return 0;
+ }
+
+ static int set_clock(struct snd_tscm *tscm, unsigned int rate,
+@@ -35,7 +52,7 @@ static int set_clock(struct snd_tscm *tscm, unsigned int rate,
+ err = get_clock(tscm, &data);
+ if (err < 0)
+ return err;
+- data &= 0x0000ffff;
++ data &= CLOCK_CONFIG_MASK;
+
+ if (rate > 0) {
+ data &= 0x000000ff;
+@@ -80,17 +97,14 @@ static int set_clock(struct snd_tscm *tscm, unsigned int rate,
+
+ int snd_tscm_stream_get_rate(struct snd_tscm *tscm, unsigned int *rate)
+ {
+- u32 data = 0x0;
+- unsigned int trials = 0;
++ u32 data;
+ int err;
+
+- while (data == 0x0 || trials++ < 5) {
+- err = get_clock(tscm, &data);
+- if (err < 0)
+- return err;
++ err = get_clock(tscm, &data);
++ if (err < 0)
++ return err;
+
+- data = (data & 0xff000000) >> 24;
+- }
++ data = (data & 0xff000000) >> 24;
+
+ /* Check base rate. */
+ if ((data & 0x0f) == 0x01)
+diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
+index 74244d8e2909..e858b6fa0c3a 100644
+--- a/sound/hda/hdac_controller.c
++++ b/sound/hda/hdac_controller.c
+@@ -443,6 +443,8 @@ static void azx_int_disable(struct hdac_bus *bus)
+ list_for_each_entry(azx_dev, &bus->stream_list, list)
+ snd_hdac_stream_updateb(azx_dev, SD_CTL, SD_INT_MASK, 0);
+
++ synchronize_irq(bus->irq);
++
+ /* disable SIE for all streams */
+ snd_hdac_chip_writeb(bus, INTCTL, 0);
+
+diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c
+index 7f2761a2e7c8..971197c34fce 100644
+--- a/sound/i2c/other/ak4xxx-adda.c
++++ b/sound/i2c/other/ak4xxx-adda.c
+@@ -789,11 +789,12 @@ static int build_adc_controls(struct snd_akm4xxx *ak)
+ return err;
+
+ memset(&knew, 0, sizeof(knew));
+- knew.name = ak->adc_info[mixer_ch].selector_name;
+- if (!knew.name) {
++ if (!ak->adc_info ||
++ !ak->adc_info[mixer_ch].selector_name) {
+ knew.name = "Capture Channel";
+ knew.index = mixer_ch + ak->idx_offset * 2;
+- }
++ } else
++ knew.name = ak->adc_info[mixer_ch].selector_name;
+
+ knew.iface = SNDRV_CTL_ELEM_IFACE_MIXER;
+ knew.info = ak4xxx_capture_source_info;
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index a41c1bec7c88..8fcb421193e0 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -877,10 +877,13 @@ static int azx_rirb_get_response(struct hdac_bus *bus, unsigned int addr,
+ */
+ if (hbus->allow_bus_reset && !hbus->response_reset && !hbus->in_reset) {
+ hbus->response_reset = 1;
++ dev_err(chip->card->dev,
++ "No response from codec, resetting bus: last cmd=0x%08x\n",
++ bus->last_cmd[addr]);
+ return -EAGAIN; /* give a chance to retry */
+ }
+
+- dev_err(chip->card->dev,
++ dev_WARN(chip->card->dev,
+ "azx_get_response timeout, switching to single_cmd mode: last cmd=0x%08x\n",
+ bus->last_cmd[addr]);
+ chip->single_cmd = 1;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 0b24c5ce2fd6..bfc45086cf79 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1455,9 +1455,9 @@ static int azx_free(struct azx *chip)
+ }
+
+ if (bus->chip_init) {
++ azx_stop_chip(chip);
+ azx_clear_irq_pending(chip);
+ azx_stop_all_streams(chip);
+- azx_stop_chip(chip);
+ }
+
+ if (bus->irq >= 0)
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index e4fbfb5557ab..107ec7f3e221 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2583,6 +2583,8 @@ static void i915_pin_cvt_fixup(struct hda_codec *codec,
+ /* precondition and allocation for Intel codecs */
+ static int alloc_intel_hdmi(struct hda_codec *codec)
+ {
++ int err;
++
+ /* requires i915 binding */
+ if (!codec->bus->core.audio_component) {
+ codec_info(codec, "No i915 binding for Intel HDMI/DP codec\n");
+@@ -2591,7 +2593,12 @@ static int alloc_intel_hdmi(struct hda_codec *codec)
+ return -ENODEV;
+ }
+
+- return alloc_generic_hdmi(codec);
++ err = alloc_generic_hdmi(codec);
++ if (err < 0)
++ return err;
++ /* no need to handle unsol events */
++ codec->patch_ops.unsol_event = NULL;
++ return 0;
+ }
+
+ /* parse and post-process for Intel codecs */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 7f74ebee8c2d..e1b08d6f2a51 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1057,6 +1057,9 @@ static const struct snd_pci_quirk beep_white_list[] = {
+ SND_PCI_QUIRK(0x1043, 0x834a, "EeePC", 1),
+ SND_PCI_QUIRK(0x1458, 0xa002, "GA-MA790X", 1),
+ SND_PCI_QUIRK(0x8086, 0xd613, "Intel", 1),
++ /* blacklist -- no beep available */
++ SND_PCI_QUIRK(0x17aa, 0x309e, "Lenovo ThinkCentre M73", 0),
++ SND_PCI_QUIRK(0x17aa, 0x30a3, "Lenovo ThinkCentre M93", 0),
+ {}
+ };
+
+@@ -5676,6 +5679,7 @@ enum {
+ ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+ ALC299_FIXUP_PREDATOR_SPK,
+ ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC,
++ ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6714,6 +6718,16 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+ },
++ [ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x04a11040 },
++ { 0x21, 0x04211020 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6977,6 +6991,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
+ SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MBXP", ALC256_FIXUP_HUAWEI_MBXP_PINS),
+ SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
++ SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE),
+
+ #if 0
+ /* Below is a quirk table taken from the old code.
+@@ -7141,6 +7156,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC255_FIXUP_DELL_HEADSET_MIC, .name = "alc255-dell-headset"},
+ {.id = ALC295_FIXUP_HP_X360, .name = "alc295-hp-x360"},
+ {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"},
++ {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"},
+ {}
+ };
+ #define ALC225_STANDARD_PINS \
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index e97d12d578b0..9ebe77c3784a 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -46,7 +46,10 @@ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(adc_vol_tlv, -9600, 50, 1);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_max_gain_tlv, -650, 150, 0);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_min_gain_tlv, -1200, 150, 0);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_target_tlv, -1650, 150, 0);
+-static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(hpmixer_gain_tlv, -1200, 150, 0);
++static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(hpmixer_gain_tlv,
++ 0, 4, TLV_DB_SCALE_ITEM(-1200, 150, 0),
++ 8, 11, TLV_DB_SCALE_ITEM(-450, 150, 0),
++);
+
+ static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(adc_pga_gain_tlv,
+ 0, 0, TLV_DB_SCALE_ITEM(-350, 0, 0),
+@@ -84,7 +87,7 @@ static const struct snd_kcontrol_new es8316_snd_controls[] = {
+ SOC_DOUBLE_TLV("Headphone Playback Volume", ES8316_CPHP_ICAL_VOL,
+ 4, 0, 3, 1, hpout_vol_tlv),
+ SOC_DOUBLE_TLV("Headphone Mixer Volume", ES8316_HPMIX_VOL,
+- 0, 4, 7, 0, hpmixer_gain_tlv),
++ 0, 4, 11, 0, hpmixer_gain_tlv),
+
+ SOC_ENUM("Playback Polarity", dacpol),
+ SOC_DOUBLE_R_TLV("DAC Playback Volume", ES8316_DAC_VOLL,
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 60764f6201b1..18cddf1729a6 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1165,12 +1165,17 @@ static int sgtl5000_set_power_regs(struct snd_soc_component *component)
+ SGTL5000_INT_OSC_EN);
+ /* Enable VDDC charge pump */
+ ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
+- } else if (vddio >= 3100 && vdda >= 3100) {
++ } else {
+ ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
+- /* VDDC use VDDIO rail */
+- lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
+- lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
+- SGTL5000_VDDC_MAN_ASSN_SHIFT;
++ /*
++ * if vddio == vdda the source of charge pump should be
++ * assigned manually to VDDIO
++ */
++ if (vddio == vdda) {
++ lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
++ lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
++ SGTL5000_VDDC_MAN_ASSN_SHIFT;
++ }
+ }
+
+ snd_soc_component_write(component, SGTL5000_CHIP_LINREG_CTRL, lreg_ctrl);
+@@ -1280,6 +1285,7 @@ static int sgtl5000_probe(struct snd_soc_component *component)
+ int ret;
+ u16 reg;
+ struct sgtl5000_priv *sgtl5000 = snd_soc_component_get_drvdata(component);
++ unsigned int zcd_mask = SGTL5000_HP_ZCD_EN | SGTL5000_ADC_ZCD_EN;
+
+ /* power up sgtl5000 */
+ ret = sgtl5000_set_power_regs(component);
+@@ -1305,9 +1311,8 @@ static int sgtl5000_probe(struct snd_soc_component *component)
+ reg = ((sgtl5000->lrclk_strength) << SGTL5000_PAD_I2S_LRCLK_SHIFT | 0x5f);
+ snd_soc_component_write(component, SGTL5000_CHIP_PAD_STRENGTH, reg);
+
+- snd_soc_component_write(component, SGTL5000_CHIP_ANA_CTRL,
+- SGTL5000_HP_ZCD_EN |
+- SGTL5000_ADC_ZCD_EN);
++ snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_CTRL,
++ zcd_mask, zcd_mask);
+
+ snd_soc_component_update_bits(component, SGTL5000_CHIP_MIC_CTRL,
+ SGTL5000_BIAS_R_MASK,
+diff --git a/sound/soc/codecs/tlv320aic31xx.c b/sound/soc/codecs/tlv320aic31xx.c
+index bf92d36b8f8a..3c75dcf91741 100644
+--- a/sound/soc/codecs/tlv320aic31xx.c
++++ b/sound/soc/codecs/tlv320aic31xx.c
+@@ -1441,7 +1441,8 @@ static int aic31xx_i2c_probe(struct i2c_client *i2c,
+ aic31xx->gpio_reset = devm_gpiod_get_optional(aic31xx->dev, "reset",
+ GPIOD_OUT_LOW);
+ if (IS_ERR(aic31xx->gpio_reset)) {
+- dev_err(aic31xx->dev, "not able to acquire gpio\n");
++ if (PTR_ERR(aic31xx->gpio_reset) != -EPROBE_DEFER)
++ dev_err(aic31xx->dev, "not able to acquire gpio\n");
+ return PTR_ERR(aic31xx->gpio_reset);
+ }
+
+@@ -1452,7 +1453,9 @@ static int aic31xx_i2c_probe(struct i2c_client *i2c,
+ ARRAY_SIZE(aic31xx->supplies),
+ aic31xx->supplies);
+ if (ret) {
+- dev_err(aic31xx->dev, "Failed to request supplies: %d\n", ret);
++ if (ret != -EPROBE_DEFER)
++ dev_err(aic31xx->dev,
++ "Failed to request supplies: %d\n", ret);
+ return ret;
+ }
+
+diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
+index 09b2967befd9..d83be26d6446 100644
+--- a/sound/soc/fsl/fsl_ssi.c
++++ b/sound/soc/fsl/fsl_ssi.c
+@@ -799,15 +799,6 @@ static int fsl_ssi_hw_params(struct snd_pcm_substream *substream,
+ u32 wl = SSI_SxCCR_WL(sample_size);
+ int ret;
+
+- /*
+- * SSI is properly configured if it is enabled and running in
+- * the synchronous mode; Note that AC97 mode is an exception
+- * that should set separate configurations for STCCR and SRCCR
+- * despite running in the synchronous mode.
+- */
+- if (ssi->streams && ssi->synchronous)
+- return 0;
+-
+ if (fsl_ssi_is_i2s_master(ssi)) {
+ ret = fsl_ssi_set_bclk(substream, dai, hw_params);
+ if (ret)
+@@ -823,6 +814,15 @@ static int fsl_ssi_hw_params(struct snd_pcm_substream *substream,
+ }
+ }
+
++ /*
++ * SSI is properly configured if it is enabled and running in
++ * the synchronous mode; Note that AC97 mode is an exception
++ * that should set separate configurations for STCCR and SRCCR
++ * despite running in the synchronous mode.
++ */
++ if (ssi->streams && ssi->synchronous)
++ return 0;
++
+ if (!fsl_ssi_is_ac97(ssi)) {
+ /*
+ * Keep the ssi->i2s_net intact while having a local variable
+diff --git a/sound/soc/intel/common/sst-ipc.c b/sound/soc/intel/common/sst-ipc.c
+index dcff13802c00..771734fd7707 100644
+--- a/sound/soc/intel/common/sst-ipc.c
++++ b/sound/soc/intel/common/sst-ipc.c
+@@ -231,6 +231,8 @@ struct ipc_message *sst_ipc_reply_find_msg(struct sst_generic_ipc *ipc,
+
+ if (ipc->ops.reply_msg_match != NULL)
+ header = ipc->ops.reply_msg_match(header, &mask);
++ else
++ mask = (u64)-1;
+
+ if (list_empty(&ipc->rx_list)) {
+ dev_err(ipc->dev, "error: rx list empty but received 0x%llx\n",
+diff --git a/sound/soc/intel/skylake/skl-debug.c b/sound/soc/intel/skylake/skl-debug.c
+index 5d7ac2ee7a3c..faf1cba57abb 100644
+--- a/sound/soc/intel/skylake/skl-debug.c
++++ b/sound/soc/intel/skylake/skl-debug.c
+@@ -196,7 +196,7 @@ static ssize_t fw_softreg_read(struct file *file, char __user *user_buf,
+ memset(d->fw_read_buff, 0, FW_REG_BUF);
+
+ if (w0_stat_sz > 0)
+- __iowrite32_copy(d->fw_read_buff, fw_reg_addr, w0_stat_sz >> 2);
++ __ioread32_copy(d->fw_read_buff, fw_reg_addr, w0_stat_sz >> 2);
+
+ for (offset = 0; offset < FW_REG_SIZE; offset += 16) {
+ ret += snprintf(tmp + ret, FW_REG_BUF - ret, "%#.4x: ", offset);
+diff --git a/sound/soc/intel/skylake/skl-nhlt.c b/sound/soc/intel/skylake/skl-nhlt.c
+index 01a050cf8775..3cef2ebfd8be 100644
+--- a/sound/soc/intel/skylake/skl-nhlt.c
++++ b/sound/soc/intel/skylake/skl-nhlt.c
+@@ -231,7 +231,7 @@ int skl_nhlt_update_topology_bin(struct skl *skl)
+ struct hdac_bus *bus = skl_to_bus(skl);
+ struct device *dev = bus->dev;
+
+- dev_dbg(dev, "oem_id %.6s, oem_table_id %8s oem_revision %d\n",
++ dev_dbg(dev, "oem_id %.6s, oem_table_id %.8s oem_revision %d\n",
+ nhlt->header.oem_id, nhlt->header.oem_table_id,
+ nhlt->header.oem_revision);
+
+diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
+index 051f96405346..549a137878a6 100644
+--- a/sound/soc/sh/rcar/adg.c
++++ b/sound/soc/sh/rcar/adg.c
+@@ -30,6 +30,7 @@ struct rsnd_adg {
+ struct clk *clkout[CLKOUTMAX];
+ struct clk_onecell_data onecell;
+ struct rsnd_mod mod;
++ int clk_rate[CLKMAX];
+ u32 flags;
+ u32 ckr;
+ u32 rbga;
+@@ -113,9 +114,9 @@ static void __rsnd_adg_get_timesel_ratio(struct rsnd_priv *priv,
+ unsigned int val, en;
+ unsigned int min, diff;
+ unsigned int sel_rate[] = {
+- clk_get_rate(adg->clk[CLKA]), /* 0000: CLKA */
+- clk_get_rate(adg->clk[CLKB]), /* 0001: CLKB */
+- clk_get_rate(adg->clk[CLKC]), /* 0010: CLKC */
++ adg->clk_rate[CLKA], /* 0000: CLKA */
++ adg->clk_rate[CLKB], /* 0001: CLKB */
++ adg->clk_rate[CLKC], /* 0010: CLKC */
+ adg->rbga_rate_for_441khz, /* 0011: RBGA */
+ adg->rbgb_rate_for_48khz, /* 0100: RBGB */
+ };
+@@ -331,7 +332,7 @@ int rsnd_adg_clk_query(struct rsnd_priv *priv, unsigned int rate)
+ * AUDIO_CLKA/AUDIO_CLKB/AUDIO_CLKC/AUDIO_CLKI.
+ */
+ for_each_rsnd_clk(clk, adg, i) {
+- if (rate == clk_get_rate(clk))
++ if (rate == adg->clk_rate[i])
+ return sel_table[i];
+ }
+
+@@ -398,10 +399,18 @@ void rsnd_adg_clk_control(struct rsnd_priv *priv, int enable)
+
+ for_each_rsnd_clk(clk, adg, i) {
+ ret = 0;
+- if (enable)
++ if (enable) {
+ ret = clk_prepare_enable(clk);
+- else
++
++ /*
++ * We shouldn't use clk_get_rate() under
++ * atomic context. Let's keep it when
++ * rsnd_adg_clk_enable() was called
++ */
++ adg->clk_rate[i] = clk_get_rate(adg->clk[i]);
++ } else {
+ clk_disable_unprepare(clk);
++ }
+
+ if (ret < 0)
+ dev_warn(dev, "can't use clk %d\n", i);
+diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c
+index 30e791a53352..232df04ca586 100644
+--- a/sound/soc/soc-generic-dmaengine-pcm.c
++++ b/sound/soc/soc-generic-dmaengine-pcm.c
+@@ -313,6 +313,12 @@ static int dmaengine_pcm_new(struct snd_soc_pcm_runtime *rtd)
+
+ if (!dmaengine_pcm_can_report_residue(dev, pcm->chan[i]))
+ pcm->flags |= SND_DMAENGINE_PCM_FLAG_NO_RESIDUE;
++
++ if (rtd->pcm->streams[i].pcm->name[0] == '\0') {
++ strncpy(rtd->pcm->streams[i].pcm->name,
++ rtd->pcm->streams[i].pcm->id,
++ sizeof(rtd->pcm->streams[i].pcm->name));
++ }
+ }
+
+ return 0;
+diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
+index 6173dd86c62c..18cf8404d27c 100644
+--- a/sound/soc/sunxi/sun4i-i2s.c
++++ b/sound/soc/sunxi/sun4i-i2s.c
+@@ -223,10 +223,11 @@ static const struct sun4i_i2s_clk_div sun4i_i2s_mclk_div[] = {
+ };
+
+ static int sun4i_i2s_get_bclk_div(struct sun4i_i2s *i2s,
+- unsigned int oversample_rate,
++ unsigned long parent_rate,
++ unsigned int sampling_rate,
+ unsigned int word_size)
+ {
+- int div = oversample_rate / word_size / 2;
++ int div = parent_rate / sampling_rate / word_size / 2;
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(sun4i_i2s_bclk_div); i++) {
+@@ -316,8 +317,8 @@ static int sun4i_i2s_set_clk_rate(struct snd_soc_dai *dai,
+ return -EINVAL;
+ }
+
+- bclk_div = sun4i_i2s_get_bclk_div(i2s, oversample_rate,
+- word_size);
++ bclk_div = sun4i_i2s_get_bclk_div(i2s, i2s->mclk_freq,
++ rate, word_size);
+ if (bclk_div < 0) {
+ dev_err(dai->dev, "Unsupported BCLK divider: %d\n", bclk_div);
+ return -EINVAL;
+diff --git a/sound/soc/uniphier/aio-cpu.c b/sound/soc/uniphier/aio-cpu.c
+index ee90e6c3937c..2ae582a99b63 100644
+--- a/sound/soc/uniphier/aio-cpu.c
++++ b/sound/soc/uniphier/aio-cpu.c
+@@ -424,8 +424,11 @@ int uniphier_aio_dai_suspend(struct snd_soc_dai *dai)
+ {
+ struct uniphier_aio *aio = uniphier_priv(dai);
+
+- reset_control_assert(aio->chip->rst);
+- clk_disable_unprepare(aio->chip->clk);
++ aio->chip->num_wup_aios--;
++ if (!aio->chip->num_wup_aios) {
++ reset_control_assert(aio->chip->rst);
++ clk_disable_unprepare(aio->chip->clk);
++ }
+
+ return 0;
+ }
+@@ -439,13 +442,15 @@ int uniphier_aio_dai_resume(struct snd_soc_dai *dai)
+ if (!aio->chip->active)
+ return 0;
+
+- ret = clk_prepare_enable(aio->chip->clk);
+- if (ret)
+- return ret;
++ if (!aio->chip->num_wup_aios) {
++ ret = clk_prepare_enable(aio->chip->clk);
++ if (ret)
++ return ret;
+
+- ret = reset_control_deassert(aio->chip->rst);
+- if (ret)
+- goto err_out_clock;
++ ret = reset_control_deassert(aio->chip->rst);
++ if (ret)
++ goto err_out_clock;
++ }
+
+ aio_iecout_set_enable(aio->chip, true);
+ aio_chip_init(aio->chip);
+@@ -458,7 +463,7 @@ int uniphier_aio_dai_resume(struct snd_soc_dai *dai)
+
+ ret = aio_init(sub);
+ if (ret)
+- goto err_out_clock;
++ goto err_out_reset;
+
+ if (!sub->setting)
+ continue;
+@@ -466,11 +471,16 @@ int uniphier_aio_dai_resume(struct snd_soc_dai *dai)
+ aio_port_reset(sub);
+ aio_src_reset(sub);
+ }
++ aio->chip->num_wup_aios++;
+
+ return 0;
+
++err_out_reset:
++ if (!aio->chip->num_wup_aios)
++ reset_control_assert(aio->chip->rst);
+ err_out_clock:
+- clk_disable_unprepare(aio->chip->clk);
++ if (!aio->chip->num_wup_aios)
++ clk_disable_unprepare(aio->chip->clk);
+
+ return ret;
+ }
+@@ -619,6 +629,7 @@ int uniphier_aio_probe(struct platform_device *pdev)
+ return PTR_ERR(chip->rst);
+
+ chip->num_aios = chip->chip_spec->num_dais;
++ chip->num_wup_aios = chip->num_aios;
+ chip->aios = devm_kcalloc(dev,
+ chip->num_aios, sizeof(struct uniphier_aio),
+ GFP_KERNEL);
+diff --git a/sound/soc/uniphier/aio.h b/sound/soc/uniphier/aio.h
+index ca6ccbae0ee8..a7ff7e556429 100644
+--- a/sound/soc/uniphier/aio.h
++++ b/sound/soc/uniphier/aio.h
+@@ -285,6 +285,7 @@ struct uniphier_aio_chip {
+
+ struct uniphier_aio *aios;
+ int num_aios;
++ int num_wup_aios;
+ struct uniphier_aio_pll *plls;
+ int num_plls;
+
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 35c57a4204a8..13ea63c959d3 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -464,6 +464,7 @@ static int set_sync_endpoint(struct snd_usb_substream *subs,
+ }
+ ep = get_endpoint(alts, 1)->bEndpointAddress;
+ if (get_endpoint(alts, 0)->bLength >= USB_DT_ENDPOINT_AUDIO_SIZE &&
++ get_endpoint(alts, 0)->bSynchAddress != 0 &&
+ ((is_playback && ep != (unsigned int)(get_endpoint(alts, 0)->bSynchAddress | USB_DIR_IN)) ||
+ (!is_playback && ep != (unsigned int)(get_endpoint(alts, 0)->bSynchAddress & ~USB_DIR_IN)))) {
+ dev_err(&dev->dev,
+diff --git a/tools/include/uapi/asm/bitsperlong.h b/tools/include/uapi/asm/bitsperlong.h
+index 57aaeaf8e192..edba4d93e9e6 100644
+--- a/tools/include/uapi/asm/bitsperlong.h
++++ b/tools/include/uapi/asm/bitsperlong.h
+@@ -1,22 +1,22 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+ #if defined(__i386__) || defined(__x86_64__)
+-#include "../../arch/x86/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/x86/include/uapi/asm/bitsperlong.h"
+ #elif defined(__aarch64__)
+-#include "../../arch/arm64/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/arm64/include/uapi/asm/bitsperlong.h"
+ #elif defined(__powerpc__)
+-#include "../../arch/powerpc/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/powerpc/include/uapi/asm/bitsperlong.h"
+ #elif defined(__s390__)
+-#include "../../arch/s390/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/s390/include/uapi/asm/bitsperlong.h"
+ #elif defined(__sparc__)
+-#include "../../arch/sparc/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/sparc/include/uapi/asm/bitsperlong.h"
+ #elif defined(__mips__)
+-#include "../../arch/mips/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/mips/include/uapi/asm/bitsperlong.h"
+ #elif defined(__ia64__)
+-#include "../../arch/ia64/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/ia64/include/uapi/asm/bitsperlong.h"
+ #elif defined(__riscv)
+-#include "../../arch/riscv/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/riscv/include/uapi/asm/bitsperlong.h"
+ #elif defined(__alpha__)
+-#include "../../arch/alpha/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/alpha/include/uapi/asm/bitsperlong.h"
+ #else
+ #include <asm-generic/bitsperlong.h>
+ #endif
+diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
+index 0b4e833088a4..95a43ccb6dd0 100644
+--- a/tools/lib/traceevent/Makefile
++++ b/tools/lib/traceevent/Makefile
+@@ -55,15 +55,15 @@ set_plugin_dir := 1
+
+ # Set plugin_dir to preffered global plugin location
+ # If we install under $HOME directory we go under
+-# $(HOME)/.traceevent/plugins
++# $(HOME)/.local/lib/traceevent/plugins
+ #
+ # We dont set PLUGIN_DIR in case we install under $HOME
+ # directory, because by default the code looks under:
+-# $(HOME)/.traceevent/plugins by default.
++# $(HOME)/.local/lib/traceevent/plugins by default.
+ #
+ ifeq ($(plugin_dir),)
+ ifeq ($(prefix),$(HOME))
+-override plugin_dir = $(HOME)/.traceevent/plugins
++override plugin_dir = $(HOME)/.local/lib/traceevent/plugins
+ set_plugin_dir := 0
+ else
+ override plugin_dir = $(libdir)/traceevent/plugins
+diff --git a/tools/lib/traceevent/event-plugin.c b/tools/lib/traceevent/event-plugin.c
+index f17e25097e1e..52874eb94ace 100644
+--- a/tools/lib/traceevent/event-plugin.c
++++ b/tools/lib/traceevent/event-plugin.c
+@@ -16,7 +16,7 @@
+ #include "event-parse.h"
+ #include "event-utils.h"
+
+-#define LOCAL_PLUGIN_DIR ".traceevent/plugins"
++#define LOCAL_PLUGIN_DIR ".local/lib/traceevent/plugins/"
+
+ static struct registered_plugin_options {
+ struct registered_plugin_options *next;
+diff --git a/tools/perf/perf.c b/tools/perf/perf.c
+index a11cb006f968..80f8ae8b1366 100644
+--- a/tools/perf/perf.c
++++ b/tools/perf/perf.c
+@@ -439,6 +439,9 @@ int main(int argc, const char **argv)
+
+ srandom(time(NULL));
+
++ /* Setting $PERF_CONFIG makes perf read _only_ the given config file. */
++ config_exclusive_filename = getenv("PERF_CONFIG");
++
+ err = perf_config(perf_default_config, NULL);
+ if (err)
+ return err;
+diff --git a/tools/perf/tests/shell/trace+probe_vfs_getname.sh b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
+index 4ce276efe6b4..fe223fc5c1f8 100755
+--- a/tools/perf/tests/shell/trace+probe_vfs_getname.sh
++++ b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
+@@ -29,6 +29,10 @@ if [ $err -ne 0 ] ; then
+ exit $err
+ fi
+
++# Do not use whatever ~/.perfconfig file, it may change the output
++# via trace.{show_timestamp,show_prefix,etc}
++export PERF_CONFIG=/dev/null
++
+ trace_open_vfs_getname
+ err=$?
+ rm -f ${file}
+diff --git a/tools/perf/trace/beauty/ioctl.c b/tools/perf/trace/beauty/ioctl.c
+index 1be3b4cf0827..82346ca06f17 100644
+--- a/tools/perf/trace/beauty/ioctl.c
++++ b/tools/perf/trace/beauty/ioctl.c
+@@ -22,7 +22,7 @@
+ static size_t ioctl__scnprintf_tty_cmd(int nr, int dir, char *bf, size_t size)
+ {
+ static const char *ioctl_tty_cmd[] = {
+- "TCGETS", "TCSETS", "TCSETSW", "TCSETSF", "TCGETA", "TCSETA", "TCSETAW",
++ [_IOC_NR(TCGETS)] = "TCGETS", "TCSETS", "TCSETSW", "TCSETSF", "TCGETA", "TCSETA", "TCSETAW",
+ "TCSETAF", "TCSBRK", "TCXONC", "TCFLSH", "TIOCEXCL", "TIOCNXCL", "TIOCSCTTY",
+ "TIOCGPGRP", "TIOCSPGRP", "TIOCOUTQ", "TIOCSTI", "TIOCGWINSZ", "TIOCSWINSZ",
+ "TIOCMGET", "TIOCMBIS", "TIOCMBIC", "TIOCMSET", "TIOCGSOFTCAR", "TIOCSSOFTCAR",
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index 54c34c107cab..0c70788593c8 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -2184,8 +2184,10 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused)
+ /* On s390 the socket_id number is not related to the numbers of cpus.
+ * The socket_id number might be higher than the numbers of cpus.
+ * This depends on the configuration.
++ * AArch64 is the same.
+ */
+- if (ph->env.arch && !strncmp(ph->env.arch, "s390", 4))
++ if (ph->env.arch && (!strncmp(ph->env.arch, "s390", 4)
++ || !strncmp(ph->env.arch, "aarch64", 7)))
+ do_core_id_test = false;
+
+ for (i = 0; i < (u32)cpu_nr; i++) {
+diff --git a/tools/perf/util/xyarray.h b/tools/perf/util/xyarray.h
+index 7ffe562e7ae7..2627b038b6f2 100644
+--- a/tools/perf/util/xyarray.h
++++ b/tools/perf/util/xyarray.h
+@@ -2,6 +2,7 @@
+ #ifndef _PERF_XYARRAY_H_
+ #define _PERF_XYARRAY_H_ 1
+
++#include <linux/compiler.h>
+ #include <sys/types.h>
+
+ struct xyarray {
+@@ -10,7 +11,7 @@ struct xyarray {
+ size_t entries;
+ size_t max_x;
+ size_t max_y;
+- char contents[];
++ char contents[] __aligned(8);
+ };
+
+ struct xyarray *xyarray__new(int xlen, int ylen, size_t entry_size);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-10-07 17:42 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-10-07 17:42 UTC (permalink / raw
To: gentoo-commits
commit: ed27c176cde87113b8051d0c822a5cfbabff4bfe
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Oct 7 17:41:37 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Oct 7 17:41:37 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ed27c176
Linux patch 4.19.78
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1077_linux-4.19.78.patch | 4003 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4007 insertions(+)
diff --git a/0000_README b/0000_README
index a687ae2..021985c 100644
--- a/0000_README
+++ b/0000_README
@@ -347,6 +347,10 @@ Patch: 1076_linux-4.19.77.patch
From: https://www.kernel.org
Desc: Linux 4.19.77
+Patch: 1077_linux-4.19.78.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.78
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1077_linux-4.19.78.patch b/1077_linux-4.19.78.patch
new file mode 100644
index 0000000..4035e59
--- /dev/null
+++ b/1077_linux-4.19.78.patch
@@ -0,0 +1,4003 @@
+diff --git a/Makefile b/Makefile
+index aeabc6459acc..440c5b5c4f4b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 77
++SUBLEVEL = 78
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 51794c7fa6d5..185e552f1461 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1586,8 +1586,9 @@ config ARM_PATCH_IDIV
+ code to do integer division.
+
+ config AEABI
+- bool "Use the ARM EABI to compile the kernel" if !CPU_V7 && !CPU_V7M && !CPU_V6 && !CPU_V6K
+- default CPU_V7 || CPU_V7M || CPU_V6 || CPU_V6K
++ bool "Use the ARM EABI to compile the kernel" if !CPU_V7 && \
++ !CPU_V7M && !CPU_V6 && !CPU_V6K && !CC_IS_CLANG
++ default CPU_V7 || CPU_V7M || CPU_V6 || CPU_V6K || CC_IS_CLANG
+ help
+ This option allows for the kernel to be compiled using the latest
+ ARM ABI (aka EABI). This is only useful if you are using a user
+diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
+index 3232afb6fdc0..a9ee0d9dc740 100644
+--- a/arch/arm/mm/fault.c
++++ b/arch/arm/mm/fault.c
+@@ -216,7 +216,7 @@ static inline bool access_error(unsigned int fsr, struct vm_area_struct *vma)
+ {
+ unsigned int mask = VM_READ | VM_WRITE | VM_EXEC;
+
+- if (fsr & FSR_WRITE)
++ if ((fsr & FSR_WRITE) && !(fsr & FSR_CM))
+ mask = VM_WRITE;
+ if (fsr & FSR_LNX_PF)
+ mask = VM_EXEC;
+@@ -287,7 +287,7 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+
+ if (user_mode(regs))
+ flags |= FAULT_FLAG_USER;
+- if (fsr & FSR_WRITE)
++ if ((fsr & FSR_WRITE) && !(fsr & FSR_CM))
+ flags |= FAULT_FLAG_WRITE;
+
+ /*
+diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
+index c063708fa503..9ecc2097a87a 100644
+--- a/arch/arm/mm/fault.h
++++ b/arch/arm/mm/fault.h
+@@ -6,6 +6,7 @@
+ * Fault status register encodings. We steal bit 31 for our own purposes.
+ */
+ #define FSR_LNX_PF (1 << 31)
++#define FSR_CM (1 << 13)
+ #define FSR_WRITE (1 << 11)
+ #define FSR_FS4 (1 << 10)
+ #define FSR_FS3_0 (15)
+diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
+index f866870db749..0b94b674aa91 100644
+--- a/arch/arm/mm/mmap.c
++++ b/arch/arm/mm/mmap.c
+@@ -18,8 +18,9 @@
+ (((pgoff)<<PAGE_SHIFT) & (SHMLBA-1)))
+
+ /* gap between mmap and stack */
+-#define MIN_GAP (128*1024*1024UL)
+-#define MAX_GAP ((TASK_SIZE)/6*5)
++#define MIN_GAP (128*1024*1024UL)
++#define MAX_GAP ((STACK_TOP)/6*5)
++#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))
+
+ static int mmap_is_legacy(struct rlimit *rlim_stack)
+ {
+@@ -35,13 +36,22 @@ static int mmap_is_legacy(struct rlimit *rlim_stack)
+ static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
+ {
+ unsigned long gap = rlim_stack->rlim_cur;
++ unsigned long pad = stack_guard_gap;
++
++ /* Account for stack randomization if necessary */
++ if (current->flags & PF_RANDOMIZE)
++ pad += (STACK_RND_MASK << PAGE_SHIFT);
++
++ /* Values close to RLIM_INFINITY can overflow. */
++ if (gap + pad > gap)
++ gap += pad;
+
+ if (gap < MIN_GAP)
+ gap = MIN_GAP;
+ else if (gap > MAX_GAP)
+ gap = MAX_GAP;
+
+- return PAGE_ALIGN(TASK_SIZE - gap - rnd);
++ return PAGE_ALIGN(STACK_TOP - gap - rnd);
+ }
+
+ /*
+diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
+index e46a6a446cdd..70e560cf8ca0 100644
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -1175,6 +1175,22 @@ void __init adjust_lowmem_bounds(void)
+ */
+ vmalloc_limit = (u64)(uintptr_t)vmalloc_min - PAGE_OFFSET + PHYS_OFFSET;
+
++ /*
++ * The first usable region must be PMD aligned. Mark its start
++ * as MEMBLOCK_NOMAP if it isn't
++ */
++ for_each_memblock(memory, reg) {
++ if (!memblock_is_nomap(reg)) {
++ if (!IS_ALIGNED(reg->base, PMD_SIZE)) {
++ phys_addr_t len;
++
++ len = round_up(reg->base, PMD_SIZE) - reg->base;
++ memblock_mark_nomap(reg->base, len);
++ }
++ break;
++ }
++ }
++
+ for_each_memblock(memory, reg) {
+ phys_addr_t block_start = reg->base;
+ phys_addr_t block_end = reg->base + reg->size;
+diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h
+index 3b0938281541..d8b01c7c9cd3 100644
+--- a/arch/arm64/include/asm/cmpxchg.h
++++ b/arch/arm64/include/asm/cmpxchg.h
+@@ -74,7 +74,7 @@ __XCHG_CASE( , , mb_8, dmb ish, nop, , a, l, "memory")
+ #undef __XCHG_CASE
+
+ #define __XCHG_GEN(sfx) \
+-static inline unsigned long __xchg##sfx(unsigned long x, \
++static __always_inline unsigned long __xchg##sfx(unsigned long x, \
+ volatile void *ptr, \
+ int size) \
+ { \
+@@ -116,7 +116,7 @@ __XCHG_GEN(_mb)
+ #define xchg(...) __xchg_wrapper( _mb, __VA_ARGS__)
+
+ #define __CMPXCHG_GEN(sfx) \
+-static inline unsigned long __cmpxchg##sfx(volatile void *ptr, \
++static __always_inline unsigned long __cmpxchg##sfx(volatile void *ptr, \
+ unsigned long old, \
+ unsigned long new, \
+ int size) \
+@@ -223,7 +223,7 @@ __CMPWAIT_CASE( , , 8);
+ #undef __CMPWAIT_CASE
+
+ #define __CMPWAIT_GEN(sfx) \
+-static inline void __cmpwait##sfx(volatile void *ptr, \
++static __always_inline void __cmpwait##sfx(volatile void *ptr, \
+ unsigned long val, \
+ int size) \
+ { \
+diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
+index 842c8a5fcd53..157f2caa1351 100644
+--- a/arch/arm64/mm/mmap.c
++++ b/arch/arm64/mm/mmap.c
+@@ -65,7 +65,11 @@ unsigned long arch_mmap_rnd(void)
+ static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
+ {
+ unsigned long gap = rlim_stack->rlim_cur;
+- unsigned long pad = (STACK_RND_MASK << PAGE_SHIFT) + stack_guard_gap;
++ unsigned long pad = stack_guard_gap;
++
++ /* Account for stack randomization if necessary */
++ if (current->flags & PF_RANDOMIZE)
++ pad += (STACK_RND_MASK << PAGE_SHIFT);
+
+ /* Values close to RLIM_INFINITY can overflow. */
+ if (gap + pad > gap)
+diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
+index 01df9ad62fb8..1bb9448777c5 100644
+--- a/arch/mips/include/asm/mipsregs.h
++++ b/arch/mips/include/asm/mipsregs.h
+@@ -688,6 +688,9 @@
+ #define MIPS_CONF7_IAR (_ULCAST_(1) << 10)
+ #define MIPS_CONF7_AR (_ULCAST_(1) << 16)
+
++/* Ingenic Config7 bits */
++#define MIPS_CONF7_BTB_LOOP_EN (_ULCAST_(1) << 4)
++
+ /* Config7 Bits specific to MIPS Technologies. */
+
+ /* Performance counters implemented Per TC */
+@@ -2774,6 +2777,7 @@ __BUILD_SET_C0(status)
+ __BUILD_SET_C0(cause)
+ __BUILD_SET_C0(config)
+ __BUILD_SET_C0(config5)
++__BUILD_SET_C0(config7)
+ __BUILD_SET_C0(intcontrol)
+ __BUILD_SET_C0(intctl)
+ __BUILD_SET_C0(srsmap)
+diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
+index d535fc706a8b..25cd8737e7fe 100644
+--- a/arch/mips/kernel/cpu-probe.c
++++ b/arch/mips/kernel/cpu-probe.c
+@@ -1879,6 +1879,13 @@ static inline void cpu_probe_ingenic(struct cpuinfo_mips *c, unsigned int cpu)
+ c->cputype = CPU_JZRISC;
+ c->writecombine = _CACHE_UNCACHED_ACCELERATED;
+ __cpu_name[cpu] = "Ingenic JZRISC";
++ /*
++ * The XBurst core by default attempts to avoid branch target
++ * buffer lookups by detecting & special casing loops. This
++ * feature will cause BogoMIPS and lpj calculate in error.
++ * Set cp0 config7 bit 4 to disable this feature.
++ */
++ set_c0_config7(MIPS_CONF7_BTB_LOOP_EN);
+ break;
+ default:
+ panic("Unknown Ingenic Processor ID!");
+diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
+index 1b705fb2f10c..233033f99d8f 100644
+--- a/arch/mips/mm/mmap.c
++++ b/arch/mips/mm/mmap.c
+@@ -21,8 +21,9 @@ unsigned long shm_align_mask = PAGE_SIZE - 1; /* Sane caches */
+ EXPORT_SYMBOL(shm_align_mask);
+
+ /* gap between mmap and stack */
+-#define MIN_GAP (128*1024*1024UL)
+-#define MAX_GAP ((TASK_SIZE)/6*5)
++#define MIN_GAP (128*1024*1024UL)
++#define MAX_GAP ((TASK_SIZE)/6*5)
++#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))
+
+ static int mmap_is_legacy(struct rlimit *rlim_stack)
+ {
+@@ -38,6 +39,15 @@ static int mmap_is_legacy(struct rlimit *rlim_stack)
+ static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
+ {
+ unsigned long gap = rlim_stack->rlim_cur;
++ unsigned long pad = stack_guard_gap;
++
++ /* Account for stack randomization if necessary */
++ if (current->flags & PF_RANDOMIZE)
++ pad += (STACK_RND_MASK << PAGE_SHIFT);
++
++ /* Values close to RLIM_INFINITY can overflow. */
++ if (gap + pad > gap)
++ gap += pad;
+
+ if (gap < MIN_GAP)
+ gap = MIN_GAP;
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index 8c4fda52b91d..355f8eadb1cd 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -630,7 +630,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p,
+ return;
+ }
+
+- if (cpu_has_rixi && _PAGE_NO_EXEC) {
++ if (cpu_has_rixi && !!_PAGE_NO_EXEC) {
+ if (fill_includes_sw_bits) {
+ UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL));
+ } else {
+diff --git a/arch/powerpc/include/asm/futex.h b/arch/powerpc/include/asm/futex.h
+index 94542776a62d..2a7b01f97a56 100644
+--- a/arch/powerpc/include/asm/futex.h
++++ b/arch/powerpc/include/asm/futex.h
+@@ -59,8 +59,7 @@ static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
+
+ pagefault_enable();
+
+- if (!ret)
+- *oval = oldval;
++ *oval = oldval;
+
+ return ret;
+ }
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 67619b4b3f96..110eba400de7 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -811,6 +811,10 @@ void eeh_handle_normal_event(struct eeh_pe *pe)
+ pr_warn("EEH: This PCI device has failed %d times in the last hour and will be permanently disabled after %d failures.\n",
+ pe->freeze_count, eeh_max_freezes);
+
++ eeh_for_each_pe(pe, tmp_pe)
++ eeh_pe_for_each_dev(tmp_pe, edev, tmp)
++ edev->mode &= ~EEH_DEV_NO_HANDLER;
++
+ /* Walk the various device drivers attached to this slot through
+ * a reset sequence, giving each an opportunity to do what it needs
+ * to accomplish the reset. Each child gets a report of the
+@@ -1004,7 +1008,8 @@ final:
+ */
+ void eeh_handle_special_event(void)
+ {
+- struct eeh_pe *pe, *phb_pe;
++ struct eeh_pe *pe, *phb_pe, *tmp_pe;
++ struct eeh_dev *edev, *tmp_edev;
+ struct pci_bus *bus;
+ struct pci_controller *hose;
+ unsigned long flags;
+@@ -1075,6 +1080,10 @@ void eeh_handle_special_event(void)
+ (phb_pe->state & EEH_PE_RECOVERING))
+ continue;
+
++ eeh_for_each_pe(pe, tmp_pe)
++ eeh_pe_for_each_dev(tmp_pe, edev, tmp_edev)
++ edev->mode &= ~EEH_DEV_NO_HANDLER;
++
+ /* Notify all devices to be down */
+ eeh_pe_state_clear(pe, EEH_PE_PRI_BUS);
+ eeh_set_channel_state(pe, pci_channel_io_perm_failure);
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 06cc77813dbb..90af86f143a9 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -520,6 +520,10 @@ EXC_COMMON_BEGIN(machine_check_handle_early)
+ RFI_TO_USER_OR_KERNEL
+ 9:
+ /* Deliver the machine check to host kernel in V mode. */
++BEGIN_FTR_SECTION
++ ld r10,ORIG_GPR3(r1)
++ mtspr SPRN_CFAR,r10
++END_FTR_SECTION_IFSET(CPU_FTR_CFAR)
+ MACHINE_CHECK_HANDLER_WINDUP
+ b machine_check_pSeries
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 8afd146bc9c7..9e41a9de4323 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -875,15 +875,17 @@ static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
+ return 0;
+
+ for_each_cpu(cpu, cpus) {
++ struct device *dev = get_cpu_device(cpu);
++
+ switch (state) {
+ case DOWN:
+- cpuret = cpu_down(cpu);
++ cpuret = device_offline(dev);
+ break;
+ case UP:
+- cpuret = cpu_up(cpu);
++ cpuret = device_online(dev);
+ break;
+ }
+- if (cpuret) {
++ if (cpuret < 0) {
+ pr_debug("%s: cpu_%s for cpu#%d returned %d.\n",
+ __func__,
+ ((state == UP) ? "up" : "down"),
+@@ -972,6 +974,8 @@ int rtas_ibm_suspend_me(u64 handle)
+ data.token = rtas_token("ibm,suspend-me");
+ data.complete = &done;
+
++ lock_device_hotplug();
++
+ /* All present CPUs must be online */
+ cpumask_andnot(offline_mask, cpu_present_mask, cpu_online_mask);
+ cpuret = rtas_online_cpus_mask(offline_mask);
+@@ -1003,6 +1007,7 @@ int rtas_ibm_suspend_me(u64 handle)
+ __func__);
+
+ out:
++ unlock_device_hotplug();
+ free_cpumask_var(offline_mask);
+ return atomic_read(&data.error);
+ }
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 02fe6d020174..d5f351f02c15 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -399,6 +399,7 @@ void system_reset_exception(struct pt_regs *regs)
+ if (debugger(regs))
+ goto out;
+
++ kmsg_dump(KMSG_DUMP_OOPS);
+ /*
+ * A system reset is a request to dump, so we always send
+ * it through the crashdump code (if fadump or kdump are
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda-tce.c b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+index f5adb6b756f7..29e66d6e5763 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda-tce.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+@@ -36,7 +36,8 @@ static __be64 *pnv_alloc_tce_level(int nid, unsigned int shift)
+ struct page *tce_mem = NULL;
+ __be64 *addr;
+
+- tce_mem = alloc_pages_node(nid, GFP_KERNEL, shift - PAGE_SHIFT);
++ tce_mem = alloc_pages_node(nid, GFP_ATOMIC | __GFP_NOWARN,
++ shift - PAGE_SHIFT);
+ if (!tce_mem) {
+ pr_err("Failed to allocate a TCE memory, level shift=%d\n",
+ shift);
+@@ -161,6 +162,9 @@ void pnv_tce_free(struct iommu_table *tbl, long index, long npages)
+
+ if (ptce)
+ *ptce = cpu_to_be64(0);
++ else
++ /* Skip the rest of the level */
++ i |= tbl->it_level_size - 1;
+ }
+ }
+
+@@ -260,7 +264,6 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+ unsigned int table_shift = max_t(unsigned int, entries_shift + 3,
+ PAGE_SHIFT);
+ const unsigned long tce_table_size = 1UL << table_shift;
+- unsigned int tmplevels = levels;
+
+ if (!levels || (levels > POWERNV_IOMMU_MAX_LEVELS))
+ return -EINVAL;
+@@ -268,9 +271,6 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+ if (!is_power_of_2(window_size))
+ return -EINVAL;
+
+- if (alloc_userspace_copy && (window_size > (1ULL << 32)))
+- tmplevels = 1;
+-
+ /* Adjust direct table size from window_size and levels */
+ entries_shift = (entries_shift + levels - 1) / levels;
+ level_shift = entries_shift + 3;
+@@ -281,7 +281,7 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+
+ /* Allocate TCE table */
+ addr = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
+- tmplevels, tce_table_size, &offset, &total_allocated);
++ 1, tce_table_size, &offset, &total_allocated);
+
+ /* addr==NULL means that the first level allocation failed */
+ if (!addr)
+@@ -292,18 +292,18 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+ * we did not allocate as much as we wanted,
+ * release partially allocated table.
+ */
+- if (tmplevels == levels && offset < tce_table_size)
++ if (levels == 1 && offset < tce_table_size)
+ goto free_tces_exit;
+
+ /* Allocate userspace view of the TCE table */
+ if (alloc_userspace_copy) {
+ offset = 0;
+ uas = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
+- tmplevels, tce_table_size, &offset,
++ 1, tce_table_size, &offset,
+ &total_allocated_uas);
+ if (!uas)
+ goto free_tces_exit;
+- if (tmplevels == levels && (offset < tce_table_size ||
++ if (levels == 1 && (offset < tce_table_size ||
+ total_allocated_uas != total_allocated))
+ goto free_uas_exit;
+ }
+@@ -318,7 +318,7 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+
+ pr_debug("Created TCE table: ws=%08llx ts=%lx @%08llx base=%lx uas=%p levels=%d/%d\n",
+ window_size, tce_table_size, bus_offset, tbl->it_base,
+- tbl->it_userspace, tmplevels, levels);
++ tbl->it_userspace, 1, levels);
+
+ return 0;
+
+diff --git a/arch/powerpc/platforms/powernv/pci.h b/arch/powerpc/platforms/powernv/pci.h
+index 8b37b28e3831..e302aa092d4f 100644
+--- a/arch/powerpc/platforms/powernv/pci.h
++++ b/arch/powerpc/platforms/powernv/pci.h
+@@ -243,7 +243,7 @@ extern void pnv_npu_release_ownership(struct pnv_ioda_pe *npe);
+ extern int pnv_npu2_init(struct pnv_phb *phb);
+
+ /* pci-ioda-tce.c */
+-#define POWERNV_IOMMU_DEFAULT_LEVELS 1
++#define POWERNV_IOMMU_DEFAULT_LEVELS 2
+ #define POWERNV_IOMMU_MAX_LEVELS 5
+
+ extern int pnv_tce_build(struct iommu_table *tbl, long index, long npages,
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index 7b60fcf04dc4..e4ea71383383 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -12,6 +12,7 @@
+ #include <linux/cpu.h>
+ #include <linux/kernel.h>
+ #include <linux/kobject.h>
++#include <linux/sched.h>
+ #include <linux/smp.h>
+ #include <linux/stat.h>
+ #include <linux/completion.h>
+@@ -209,7 +210,11 @@ static int update_dt_node(__be32 phandle, s32 scope)
+
+ prop_data += vd;
+ }
++
++ cond_resched();
+ }
++
++ cond_resched();
+ } while (rtas_rc == 1);
+
+ of_node_put(dn);
+@@ -318,8 +323,12 @@ int pseries_devicetree_update(s32 scope)
+ add_dt_node(phandle, drc_index);
+ break;
+ }
++
++ cond_resched();
+ }
+ }
++
++ cond_resched();
+ } while (rc == 1);
+
+ kfree(rtas_buf);
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index ba1791fd3234..67f49159ea70 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -325,6 +325,9 @@ static void pseries_lpar_idle(void)
+ * low power mode by ceding processor to hypervisor
+ */
+
++ if (!prep_irq_for_idle())
++ return;
++
+ /* Indicate to hypervisor that we are idle. */
+ get_lppaca()->idle = 1;
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 74cfc1be04d6..bb5db7bfd853 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -2497,13 +2497,16 @@ static void dump_pacas(void)
+ static void dump_one_xive(int cpu)
+ {
+ unsigned int hwid = get_hard_smp_processor_id(cpu);
++ bool hv = cpu_has_feature(CPU_FTR_HVMODE);
+
+- opal_xive_dump(XIVE_DUMP_TM_HYP, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_POOL, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_OS, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_USER, hwid);
+- opal_xive_dump(XIVE_DUMP_VP, hwid);
+- opal_xive_dump(XIVE_DUMP_EMU_STATE, hwid);
++ if (hv) {
++ opal_xive_dump(XIVE_DUMP_TM_HYP, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_POOL, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_OS, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_USER, hwid);
++ opal_xive_dump(XIVE_DUMP_VP, hwid);
++ opal_xive_dump(XIVE_DUMP_EMU_STATE, hwid);
++ }
+
+ if (setjmp(bus_error_jmp) != 0) {
+ catch_memory_errors = 0;
+diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c
+index c681329fdeec..e4d17d9ea93d 100644
+--- a/arch/s390/hypfs/inode.c
++++ b/arch/s390/hypfs/inode.c
+@@ -269,7 +269,7 @@ static int hypfs_show_options(struct seq_file *s, struct dentry *root)
+ static int hypfs_fill_super(struct super_block *sb, void *data, int silent)
+ {
+ struct inode *root_inode;
+- struct dentry *root_dentry;
++ struct dentry *root_dentry, *update_file;
+ int rc = 0;
+ struct hypfs_sb_info *sbi;
+
+@@ -300,9 +300,10 @@ static int hypfs_fill_super(struct super_block *sb, void *data, int silent)
+ rc = hypfs_diag_create_files(root_dentry);
+ if (rc)
+ return rc;
+- sbi->update_file = hypfs_create_update_file(root_dentry);
+- if (IS_ERR(sbi->update_file))
+- return PTR_ERR(sbi->update_file);
++ update_file = hypfs_create_update_file(root_dentry);
++ if (IS_ERR(update_file))
++ return PTR_ERR(update_file);
++ sbi->update_file = update_file;
+ hypfs_update_update(sb);
+ pr_info("Hypervisor filesystem mounted\n");
+ return 0;
+diff --git a/block/mq-deadline.c b/block/mq-deadline.c
+index d5e21ce44d2c..69094d641062 100644
+--- a/block/mq-deadline.c
++++ b/block/mq-deadline.c
+@@ -376,13 +376,6 @@ done:
+ * hardware queue, but we may return a request that is for a
+ * different hardware queue. This is because mq-deadline has shared
+ * state for all hardware queues, in terms of sorting, FIFOs, etc.
+- *
+- * For a zoned block device, __dd_dispatch_request() may return NULL
+- * if all the queued write requests are directed at zones that are already
+- * locked due to on-going write requests. In this case, make sure to mark
+- * the queue as needing a restart to ensure that the queue is run again
+- * and the pending writes dispatched once the target zones for the ongoing
+- * write requests are unlocked in dd_finish_request().
+ */
+ static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx)
+ {
+@@ -391,9 +384,6 @@ static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx)
+
+ spin_lock(&dd->lock);
+ rq = __dd_dispatch_request(dd);
+- if (!rq && blk_queue_is_zoned(hctx->queue) &&
+- !list_empty(&dd->fifo_list[WRITE]))
+- blk_mq_sched_mark_restart_hctx(hctx);
+ spin_unlock(&dd->lock);
+
+ return rq;
+@@ -559,6 +549,13 @@ static void dd_prepare_request(struct request *rq, struct bio *bio)
+ * spinlock so that the zone is never unlocked while deadline_fifo_request()
+ * or deadline_next_request() are executing. This function is called for
+ * all requests, whether or not these requests complete successfully.
++ *
++ * For a zoned block device, __dd_dispatch_request() may have stopped
++ * dispatching requests if all the queued requests are write requests directed
++ * at zones that are already locked due to on-going write requests. To ensure
++ * write request dispatch progress in this case, mark the queue as needing a
++ * restart to ensure that the queue is run again after completion of the
++ * request and zones being unlocked.
+ */
+ static void dd_finish_request(struct request *rq)
+ {
+@@ -570,6 +567,12 @@ static void dd_finish_request(struct request *rq)
+
+ spin_lock_irqsave(&dd->zone_lock, flags);
+ blk_req_zone_write_unlock(rq);
++ if (!list_empty(&dd->fifo_list[WRITE])) {
++ struct blk_mq_hw_ctx *hctx;
++
++ hctx = blk_mq_map_queue(q, rq->mq_ctx->cpu);
++ blk_mq_sched_mark_restart_hctx(hctx);
++ }
+ spin_unlock_irqrestore(&dd->zone_lock, flags);
+ }
+ }
+diff --git a/drivers/base/regmap/Kconfig b/drivers/base/regmap/Kconfig
+index 6ad5ef48b61e..8cd2ac650b50 100644
+--- a/drivers/base/regmap/Kconfig
++++ b/drivers/base/regmap/Kconfig
+@@ -44,7 +44,7 @@ config REGMAP_IRQ
+
+ config REGMAP_SOUNDWIRE
+ tristate
+- depends on SOUNDWIRE_BUS
++ depends on SOUNDWIRE
+
+ config REGMAP_SCCB
+ tristate
+diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
+index 6f1d25c1eb64..0bc344d22f01 100644
+--- a/drivers/block/pktcdvd.c
++++ b/drivers/block/pktcdvd.c
+@@ -2596,7 +2596,6 @@ static int pkt_new_dev(struct pktcdvd_device *pd, dev_t dev)
+ if (ret)
+ return ret;
+ if (!blk_queue_scsi_passthrough(bdev_get_queue(bdev))) {
+- WARN_ONCE(true, "Attempt to register a non-SCSI queue\n");
+ blkdev_put(bdev, FMODE_READ | FMODE_NDELAY);
+ return -EINVAL;
+ }
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index 75e5006f395a..006d76525678 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -221,6 +221,9 @@ struct smi_info {
+ */
+ bool irq_enable_broken;
+
++ /* Is the driver in maintenance mode? */
++ bool in_maintenance_mode;
++
+ /*
+ * Did we get an attention that we did not handle?
+ */
+@@ -1013,11 +1016,20 @@ static int ipmi_thread(void *data)
+ spin_unlock_irqrestore(&(smi_info->si_lock), flags);
+ busy_wait = ipmi_thread_busy_wait(smi_result, smi_info,
+ &busy_until);
+- if (smi_result == SI_SM_CALL_WITHOUT_DELAY)
++ if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
+ ; /* do nothing */
+- else if (smi_result == SI_SM_CALL_WITH_DELAY && busy_wait)
+- schedule();
+- else if (smi_result == SI_SM_IDLE) {
++ } else if (smi_result == SI_SM_CALL_WITH_DELAY && busy_wait) {
++ /*
++ * In maintenance mode we run as fast as
++ * possible to allow firmware updates to
++ * complete as fast as possible, but normally
++ * don't bang on the scheduler.
++ */
++ if (smi_info->in_maintenance_mode)
++ schedule();
++ else
++ usleep_range(100, 200);
++ } else if (smi_result == SI_SM_IDLE) {
+ if (atomic_read(&smi_info->need_watch)) {
+ schedule_timeout_interruptible(100);
+ } else {
+@@ -1025,8 +1037,9 @@ static int ipmi_thread(void *data)
+ __set_current_state(TASK_INTERRUPTIBLE);
+ schedule();
+ }
+- } else
++ } else {
+ schedule_timeout_interruptible(1);
++ }
+ }
+ return 0;
+ }
+@@ -1201,6 +1214,7 @@ static void set_maintenance_mode(void *send_info, bool enable)
+
+ if (!enable)
+ atomic_set(&smi_info->req_events, 0);
++ smi_info->in_maintenance_mode = enable;
+ }
+
+ static void shutdown_smi(void *send_info);
+diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
+index 46caadca916a..0b01eb7b14e5 100644
+--- a/drivers/char/tpm/tpm-chip.c
++++ b/drivers/char/tpm/tpm-chip.c
+@@ -187,12 +187,13 @@ static int tpm_class_shutdown(struct device *dev)
+ {
+ struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev);
+
++ down_write(&chip->ops_sem);
+ if (chip->flags & TPM_CHIP_FLAG_TPM2) {
+- down_write(&chip->ops_sem);
+ tpm2_shutdown(chip, TPM2_SU_CLEAR);
+ chip->ops = NULL;
+- up_write(&chip->ops_sem);
+ }
++ chip->ops = NULL;
++ up_write(&chip->ops_sem);
+
+ return 0;
+ }
+diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
+index 83a77a445538..177a60e5c6ec 100644
+--- a/drivers/char/tpm/tpm-sysfs.c
++++ b/drivers/char/tpm/tpm-sysfs.c
+@@ -39,7 +39,6 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
+ {
+ struct tpm_buf tpm_buf;
+ struct tpm_readpubek_out *out;
+- ssize_t rc;
+ int i;
+ char *str = buf;
+ struct tpm_chip *chip = to_tpm_chip(dev);
+@@ -47,19 +46,18 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
+
+ memset(&anti_replay, 0, sizeof(anti_replay));
+
+- rc = tpm_buf_init(&tpm_buf, TPM_TAG_RQU_COMMAND, TPM_ORD_READPUBEK);
+- if (rc)
+- return rc;
++ if (tpm_try_get_ops(chip))
++ return 0;
++
++ if (tpm_buf_init(&tpm_buf, TPM_TAG_RQU_COMMAND, TPM_ORD_READPUBEK))
++ goto out_ops;
+
+ tpm_buf_append(&tpm_buf, anti_replay, sizeof(anti_replay));
+
+- rc = tpm_transmit_cmd(chip, NULL, tpm_buf.data, PAGE_SIZE,
++ if (tpm_transmit_cmd(chip, NULL, tpm_buf.data, PAGE_SIZE,
+ READ_PUBEK_RESULT_MIN_BODY_SIZE, 0,
+- "attempting to read the PUBEK");
+- if (rc) {
+- tpm_buf_destroy(&tpm_buf);
+- return 0;
+- }
++ "attempting to read the PUBEK"))
++ goto out_buf;
+
+ out = (struct tpm_readpubek_out *)&tpm_buf.data[10];
+ str +=
+@@ -90,9 +88,11 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
+ str += sprintf(str, "\n");
+ }
+
+- rc = str - buf;
++out_buf:
+ tpm_buf_destroy(&tpm_buf);
+- return rc;
++out_ops:
++ tpm_put_ops(chip);
++ return str - buf;
+ }
+ static DEVICE_ATTR_RO(pubek);
+
+@@ -106,12 +106,16 @@ static ssize_t pcrs_show(struct device *dev, struct device_attribute *attr,
+ char *str = buf;
+ struct tpm_chip *chip = to_tpm_chip(dev);
+
+- rc = tpm_getcap(chip, TPM_CAP_PROP_PCR, &cap,
+- "attempting to determine the number of PCRS",
+- sizeof(cap.num_pcrs));
+- if (rc)
++ if (tpm_try_get_ops(chip))
+ return 0;
+
++ if (tpm_getcap(chip, TPM_CAP_PROP_PCR, &cap,
++ "attempting to determine the number of PCRS",
++ sizeof(cap.num_pcrs))) {
++ tpm_put_ops(chip);
++ return 0;
++ }
++
+ num_pcrs = be32_to_cpu(cap.num_pcrs);
+ for (i = 0; i < num_pcrs; i++) {
+ rc = tpm_pcr_read_dev(chip, i, digest);
+@@ -122,6 +126,7 @@ static ssize_t pcrs_show(struct device *dev, struct device_attribute *attr,
+ str += sprintf(str, "%02X ", digest[j]);
+ str += sprintf(str, "\n");
+ }
++ tpm_put_ops(chip);
+ return str - buf;
+ }
+ static DEVICE_ATTR_RO(pcrs);
+@@ -129,16 +134,21 @@ static DEVICE_ATTR_RO(pcrs);
+ static ssize_t enabled_show(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
++ struct tpm_chip *chip = to_tpm_chip(dev);
++ ssize_t rc = 0;
+ cap_t cap;
+- ssize_t rc;
+
+- rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_PERM, &cap,
+- "attempting to determine the permanent enabled state",
+- sizeof(cap.perm_flags));
+- if (rc)
++ if (tpm_try_get_ops(chip))
+ return 0;
+
++ if (tpm_getcap(chip, TPM_CAP_FLAG_PERM, &cap,
++ "attempting to determine the permanent enabled state",
++ sizeof(cap.perm_flags)))
++ goto out_ops;
++
+ rc = sprintf(buf, "%d\n", !cap.perm_flags.disable);
++out_ops:
++ tpm_put_ops(chip);
+ return rc;
+ }
+ static DEVICE_ATTR_RO(enabled);
+@@ -146,16 +156,21 @@ static DEVICE_ATTR_RO(enabled);
+ static ssize_t active_show(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
++ struct tpm_chip *chip = to_tpm_chip(dev);
++ ssize_t rc = 0;
+ cap_t cap;
+- ssize_t rc;
+
+- rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_PERM, &cap,
+- "attempting to determine the permanent active state",
+- sizeof(cap.perm_flags));
+- if (rc)
++ if (tpm_try_get_ops(chip))
+ return 0;
+
++ if (tpm_getcap(chip, TPM_CAP_FLAG_PERM, &cap,
++ "attempting to determine the permanent active state",
++ sizeof(cap.perm_flags)))
++ goto out_ops;
++
+ rc = sprintf(buf, "%d\n", !cap.perm_flags.deactivated);
++out_ops:
++ tpm_put_ops(chip);
+ return rc;
+ }
+ static DEVICE_ATTR_RO(active);
+@@ -163,16 +178,21 @@ static DEVICE_ATTR_RO(active);
+ static ssize_t owned_show(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
++ struct tpm_chip *chip = to_tpm_chip(dev);
++ ssize_t rc = 0;
+ cap_t cap;
+- ssize_t rc;
+
+- rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_PROP_OWNER, &cap,
+- "attempting to determine the owner state",
+- sizeof(cap.owned));
+- if (rc)
++ if (tpm_try_get_ops(chip))
+ return 0;
+
++ if (tpm_getcap(to_tpm_chip(dev), TPM_CAP_PROP_OWNER, &cap,
++ "attempting to determine the owner state",
++ sizeof(cap.owned)))
++ goto out_ops;
++
+ rc = sprintf(buf, "%d\n", cap.owned);
++out_ops:
++ tpm_put_ops(chip);
+ return rc;
+ }
+ static DEVICE_ATTR_RO(owned);
+@@ -180,16 +200,21 @@ static DEVICE_ATTR_RO(owned);
+ static ssize_t temp_deactivated_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
++ struct tpm_chip *chip = to_tpm_chip(dev);
++ ssize_t rc = 0;
+ cap_t cap;
+- ssize_t rc;
+
+- rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_VOL, &cap,
+- "attempting to determine the temporary state",
+- sizeof(cap.stclear_flags));
+- if (rc)
++ if (tpm_try_get_ops(chip))
+ return 0;
+
++ if (tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_VOL, &cap,
++ "attempting to determine the temporary state",
++ sizeof(cap.stclear_flags)))
++ goto out_ops;
++
+ rc = sprintf(buf, "%d\n", cap.stclear_flags.deactivated);
++out_ops:
++ tpm_put_ops(chip);
+ return rc;
+ }
+ static DEVICE_ATTR_RO(temp_deactivated);
+@@ -198,15 +223,18 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+ struct tpm_chip *chip = to_tpm_chip(dev);
+- cap_t cap;
+- ssize_t rc;
++ ssize_t rc = 0;
+ char *str = buf;
++ cap_t cap;
+
+- rc = tpm_getcap(chip, TPM_CAP_PROP_MANUFACTURER, &cap,
+- "attempting to determine the manufacturer",
+- sizeof(cap.manufacturer_id));
+- if (rc)
++ if (tpm_try_get_ops(chip))
+ return 0;
++
++ if (tpm_getcap(chip, TPM_CAP_PROP_MANUFACTURER, &cap,
++ "attempting to determine the manufacturer",
++ sizeof(cap.manufacturer_id)))
++ goto out_ops;
++
+ str += sprintf(str, "Manufacturer: 0x%x\n",
+ be32_to_cpu(cap.manufacturer_id));
+
+@@ -223,20 +251,22 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
+ cap.tpm_version_1_2.revMinor);
+ } else {
+ /* Otherwise just use TPM_STRUCT_VER */
+- rc = tpm_getcap(chip, TPM_CAP_VERSION_1_1, &cap,
+- "attempting to determine the 1.1 version",
+- sizeof(cap.tpm_version));
+- if (rc)
+- return 0;
++ if (tpm_getcap(chip, TPM_CAP_VERSION_1_1, &cap,
++ "attempting to determine the 1.1 version",
++ sizeof(cap.tpm_version)))
++ goto out_ops;
++
+ str += sprintf(str,
+ "TCG version: %d.%d\nFirmware version: %d.%d\n",
+ cap.tpm_version.Major,
+ cap.tpm_version.Minor,
+ cap.tpm_version.revMajor,
+ cap.tpm_version.revMinor);
+- }
+-
+- return str - buf;
++}
++ rc = str - buf;
++out_ops:
++ tpm_put_ops(chip);
++ return rc;
+ }
+ static DEVICE_ATTR_RO(caps);
+
+@@ -244,10 +274,12 @@ static ssize_t cancel_store(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
+ struct tpm_chip *chip = to_tpm_chip(dev);
+- if (chip == NULL)
++
++ if (tpm_try_get_ops(chip))
+ return 0;
+
+ chip->ops->cancel(chip);
++ tpm_put_ops(chip);
+ return count;
+ }
+ static DEVICE_ATTR_WO(cancel);
+diff --git a/drivers/clk/actions/owl-common.c b/drivers/clk/actions/owl-common.c
+index 61c1071b5180..e9be34b17f3f 100644
+--- a/drivers/clk/actions/owl-common.c
++++ b/drivers/clk/actions/owl-common.c
+@@ -67,16 +67,17 @@ int owl_clk_probe(struct device *dev, struct clk_hw_onecell_data *hw_clks)
+ struct clk_hw *hw;
+
+ for (i = 0; i < hw_clks->num; i++) {
++ const char *name;
+
+ hw = hw_clks->hws[i];
+-
+ if (IS_ERR_OR_NULL(hw))
+ continue;
+
++ name = hw->init->name;
+ ret = devm_clk_hw_register(dev, hw);
+ if (ret) {
+ dev_err(dev, "Couldn't register clock %d - %s\n",
+- i, hw->init->name);
++ i, name);
+ return ret;
+ }
+ }
+diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
+index c813c27f2e58..2f97a843d6d6 100644
+--- a/drivers/clk/at91/clk-main.c
++++ b/drivers/clk/at91/clk-main.c
+@@ -27,6 +27,10 @@
+
+ #define MOR_KEY_MASK (0xff << 16)
+
++#define clk_main_parent_select(s) (((s) & \
++ (AT91_PMC_MOSCEN | \
++ AT91_PMC_OSCBYPASS)) ? 1 : 0)
++
+ struct clk_main_osc {
+ struct clk_hw hw;
+ struct regmap *regmap;
+@@ -119,7 +123,7 @@ static int clk_main_osc_is_prepared(struct clk_hw *hw)
+
+ regmap_read(regmap, AT91_PMC_SR, &status);
+
+- return (status & AT91_PMC_MOSCS) && (tmp & AT91_PMC_MOSCEN);
++ return (status & AT91_PMC_MOSCS) && clk_main_parent_select(tmp);
+ }
+
+ static const struct clk_ops main_osc_ops = {
+@@ -530,7 +534,7 @@ static u8 clk_sam9x5_main_get_parent(struct clk_hw *hw)
+
+ regmap_read(clkmain->regmap, AT91_CKGR_MOR, &status);
+
+- return status & AT91_PMC_MOSCEN ? 1 : 0;
++ return clk_main_parent_select(status);
+ }
+
+ static const struct clk_ops sam9x5_main_ops = {
+@@ -572,7 +576,7 @@ at91_clk_register_sam9x5_main(struct regmap *regmap,
+ clkmain->hw.init = &init;
+ clkmain->regmap = regmap;
+ regmap_read(clkmain->regmap, AT91_CKGR_MOR, &status);
+- clkmain->parent = status & AT91_PMC_MOSCEN ? 1 : 0;
++ clkmain->parent = clk_main_parent_select(status);
+
+ hw = &clkmain->hw;
+ ret = clk_hw_register(NULL, &clkmain->hw);
+diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
+index 3a1812f65e5d..8abc5c8cb8b8 100644
+--- a/drivers/clk/clk-qoriq.c
++++ b/drivers/clk/clk-qoriq.c
+@@ -610,7 +610,7 @@ static const struct clockgen_chipinfo chipinfo[] = {
+ .guts_compat = "fsl,qoriq-device-config-1.0",
+ .init_periph = p5020_init_periph,
+ .cmux_groups = {
+- &p2041_cmux_grp1, &p2041_cmux_grp2
++ &p5020_cmux_grp1, &p5020_cmux_grp2
+ },
+ .cmux_to_group = {
+ 0, 1, -1
+diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
+index 3bf11a620094..ada3e4aeb38f 100644
+--- a/drivers/clk/qcom/gcc-sdm845.c
++++ b/drivers/clk/qcom/gcc-sdm845.c
+@@ -647,7 +647,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
+ .name = "gcc_sdcc2_apps_clk_src",
+ .parent_names = gcc_parent_names_10,
+ .num_parents = 5,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_floor_ops,
+ },
+ };
+
+@@ -671,7 +671,7 @@ static struct clk_rcg2 gcc_sdcc4_apps_clk_src = {
+ .name = "gcc_sdcc4_apps_clk_src",
+ .parent_names = gcc_parent_names_0,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_floor_ops,
+ },
+ };
+
+diff --git a/drivers/clk/renesas/clk-mstp.c b/drivers/clk/renesas/clk-mstp.c
+index e82adcb16a52..45d94fb9703d 100644
+--- a/drivers/clk/renesas/clk-mstp.c
++++ b/drivers/clk/renesas/clk-mstp.c
+@@ -341,7 +341,8 @@ void __init cpg_mstp_add_clk_domain(struct device_node *np)
+ return;
+
+ pd->name = np->name;
+- pd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ACTIVE_WAKEUP;
++ pd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ALWAYS_ON |
++ GENPD_FLAG_ACTIVE_WAKEUP;
+ pd->attach_dev = cpg_mstp_attach_dev;
+ pd->detach_dev = cpg_mstp_detach_dev;
+ pm_genpd_init(pd, &pm_domain_always_on_gov, false);
+diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
+index 24485bee9b49..d7a2ad617369 100644
+--- a/drivers/clk/renesas/renesas-cpg-mssr.c
++++ b/drivers/clk/renesas/renesas-cpg-mssr.c
+@@ -514,7 +514,8 @@ static int __init cpg_mssr_add_clk_domain(struct device *dev,
+
+ genpd = &pd->genpd;
+ genpd->name = np->name;
+- genpd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ACTIVE_WAKEUP;
++ genpd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ALWAYS_ON |
++ GENPD_FLAG_ACTIVE_WAKEUP;
+ genpd->attach_dev = cpg_mssr_attach_dev;
+ genpd->detach_dev = cpg_mssr_detach_dev;
+ pm_genpd_init(genpd, &pm_domain_always_on_gov, false);
+diff --git a/drivers/clk/sirf/clk-common.c b/drivers/clk/sirf/clk-common.c
+index d8f9efa5129a..25351d6a55ba 100644
+--- a/drivers/clk/sirf/clk-common.c
++++ b/drivers/clk/sirf/clk-common.c
+@@ -298,9 +298,10 @@ static u8 dmn_clk_get_parent(struct clk_hw *hw)
+ {
+ struct clk_dmn *clk = to_dmnclk(hw);
+ u32 cfg = clkc_readl(clk->regofs);
++ const char *name = clk_hw_get_name(hw);
+
+ /* parent of io domain can only be pll3 */
+- if (strcmp(hw->init->name, "io") == 0)
++ if (strcmp(name, "io") == 0)
+ return 4;
+
+ WARN_ON((cfg & (BIT(3) - 1)) > 4);
+@@ -312,9 +313,10 @@ static int dmn_clk_set_parent(struct clk_hw *hw, u8 parent)
+ {
+ struct clk_dmn *clk = to_dmnclk(hw);
+ u32 cfg = clkc_readl(clk->regofs);
++ const char *name = clk_hw_get_name(hw);
+
+ /* parent of io domain can only be pll3 */
+- if (strcmp(hw->init->name, "io") == 0)
++ if (strcmp(name, "io") == 0)
+ return -EINVAL;
+
+ cfg &= ~(BIT(3) - 1);
+@@ -354,7 +356,8 @@ static long dmn_clk_round_rate(struct clk_hw *hw, unsigned long rate,
+ {
+ unsigned long fin;
+ unsigned ratio, wait, hold;
+- unsigned bits = (strcmp(hw->init->name, "mem") == 0) ? 3 : 4;
++ const char *name = clk_hw_get_name(hw);
++ unsigned bits = (strcmp(name, "mem") == 0) ? 3 : 4;
+
+ fin = *parent_rate;
+ ratio = fin / rate;
+@@ -376,7 +379,8 @@ static int dmn_clk_set_rate(struct clk_hw *hw, unsigned long rate,
+ struct clk_dmn *clk = to_dmnclk(hw);
+ unsigned long fin;
+ unsigned ratio, wait, hold, reg;
+- unsigned bits = (strcmp(hw->init->name, "mem") == 0) ? 3 : 4;
++ const char *name = clk_hw_get_name(hw);
++ unsigned bits = (strcmp(name, "mem") == 0) ? 3 : 4;
+
+ fin = parent_rate;
+ ratio = fin / rate;
+diff --git a/drivers/clk/sprd/common.c b/drivers/clk/sprd/common.c
+index e038b0447206..8bdab1c3013b 100644
+--- a/drivers/clk/sprd/common.c
++++ b/drivers/clk/sprd/common.c
+@@ -71,16 +71,17 @@ int sprd_clk_probe(struct device *dev, struct clk_hw_onecell_data *clkhw)
+ struct clk_hw *hw;
+
+ for (i = 0; i < clkhw->num; i++) {
++ const char *name;
+
+ hw = clkhw->hws[i];
+-
+ if (!hw)
+ continue;
+
++ name = hw->init->name;
+ ret = devm_clk_hw_register(dev, hw);
+ if (ret) {
+ dev_err(dev, "Couldn't register clock %d - %s\n",
+- i, hw->init->name);
++ i, name);
+ return ret;
+ }
+ }
+diff --git a/drivers/clk/sprd/pll.c b/drivers/clk/sprd/pll.c
+index 36b4402bf09e..640270f51aa5 100644
+--- a/drivers/clk/sprd/pll.c
++++ b/drivers/clk/sprd/pll.c
+@@ -136,6 +136,7 @@ static unsigned long _sprd_pll_recalc_rate(const struct sprd_pll *pll,
+ k2 + refin * nint * CLK_PLL_1M;
+ }
+
++ kfree(cfg);
+ return rate;
+ }
+
+@@ -222,6 +223,7 @@ static int _sprd_pll_set_rate(const struct sprd_pll *pll,
+ if (!ret)
+ udelay(pll->udelay);
+
++ kfree(cfg);
+ return ret;
+ }
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+index ac12f261f8ca..9e3f4088724b 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+@@ -499,6 +499,9 @@ static struct clk_hw_onecell_data sun8i_v3s_hw_clks = {
+ [CLK_MMC1] = &mmc1_clk.common.hw,
+ [CLK_MMC1_SAMPLE] = &mmc1_sample_clk.common.hw,
+ [CLK_MMC1_OUTPUT] = &mmc1_output_clk.common.hw,
++ [CLK_MMC2] = &mmc2_clk.common.hw,
++ [CLK_MMC2_SAMPLE] = &mmc2_sample_clk.common.hw,
++ [CLK_MMC2_OUTPUT] = &mmc2_output_clk.common.hw,
+ [CLK_CE] = &ce_clk.common.hw,
+ [CLK_SPI0] = &spi0_clk.common.hw,
+ [CLK_USB_PHY0] = &usb_phy0_clk.common.hw,
+diff --git a/drivers/clk/zte/clk-zx296718.c b/drivers/clk/zte/clk-zx296718.c
+index 354dd508c516..8dfb8523b79d 100644
+--- a/drivers/clk/zte/clk-zx296718.c
++++ b/drivers/clk/zte/clk-zx296718.c
+@@ -567,6 +567,7 @@ static int __init top_clocks_init(struct device_node *np)
+ {
+ void __iomem *reg_base;
+ int i, ret;
++ const char *name;
+
+ reg_base = of_iomap(np, 0);
+ if (!reg_base) {
+@@ -576,11 +577,10 @@ static int __init top_clocks_init(struct device_node *np)
+
+ for (i = 0; i < ARRAY_SIZE(zx296718_pll_clk); i++) {
+ zx296718_pll_clk[i].reg_base += (uintptr_t)reg_base;
++ name = zx296718_pll_clk[i].hw.init->name;
+ ret = clk_hw_register(NULL, &zx296718_pll_clk[i].hw);
+- if (ret) {
+- pr_warn("top clk %s init error!\n",
+- zx296718_pll_clk[i].hw.init->name);
+- }
++ if (ret)
++ pr_warn("top clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(top_ffactor_clk); i++) {
+@@ -588,11 +588,10 @@ static int __init top_clocks_init(struct device_node *np)
+ top_hw_onecell_data.hws[top_ffactor_clk[i].id] =
+ &top_ffactor_clk[i].factor.hw;
+
++ name = top_ffactor_clk[i].factor.hw.init->name;
+ ret = clk_hw_register(NULL, &top_ffactor_clk[i].factor.hw);
+- if (ret) {
+- pr_warn("top clk %s init error!\n",
+- top_ffactor_clk[i].factor.hw.init->name);
+- }
++ if (ret)
++ pr_warn("top clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(top_mux_clk); i++) {
+@@ -601,11 +600,10 @@ static int __init top_clocks_init(struct device_node *np)
+ &top_mux_clk[i].mux.hw;
+
+ top_mux_clk[i].mux.reg += (uintptr_t)reg_base;
++ name = top_mux_clk[i].mux.hw.init->name;
+ ret = clk_hw_register(NULL, &top_mux_clk[i].mux.hw);
+- if (ret) {
+- pr_warn("top clk %s init error!\n",
+- top_mux_clk[i].mux.hw.init->name);
+- }
++ if (ret)
++ pr_warn("top clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(top_gate_clk); i++) {
+@@ -614,11 +612,10 @@ static int __init top_clocks_init(struct device_node *np)
+ &top_gate_clk[i].gate.hw;
+
+ top_gate_clk[i].gate.reg += (uintptr_t)reg_base;
++ name = top_gate_clk[i].gate.hw.init->name;
+ ret = clk_hw_register(NULL, &top_gate_clk[i].gate.hw);
+- if (ret) {
+- pr_warn("top clk %s init error!\n",
+- top_gate_clk[i].gate.hw.init->name);
+- }
++ if (ret)
++ pr_warn("top clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(top_div_clk); i++) {
+@@ -627,11 +624,10 @@ static int __init top_clocks_init(struct device_node *np)
+ &top_div_clk[i].div.hw;
+
+ top_div_clk[i].div.reg += (uintptr_t)reg_base;
++ name = top_div_clk[i].div.hw.init->name;
+ ret = clk_hw_register(NULL, &top_div_clk[i].div.hw);
+- if (ret) {
+- pr_warn("top clk %s init error!\n",
+- top_div_clk[i].div.hw.init->name);
+- }
++ if (ret)
++ pr_warn("top clk %s init error!\n", name);
+ }
+
+ ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
+@@ -757,6 +753,7 @@ static int __init lsp0_clocks_init(struct device_node *np)
+ {
+ void __iomem *reg_base;
+ int i, ret;
++ const char *name;
+
+ reg_base = of_iomap(np, 0);
+ if (!reg_base) {
+@@ -770,11 +767,10 @@ static int __init lsp0_clocks_init(struct device_node *np)
+ &lsp0_mux_clk[i].mux.hw;
+
+ lsp0_mux_clk[i].mux.reg += (uintptr_t)reg_base;
++ name = lsp0_mux_clk[i].mux.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp0_mux_clk[i].mux.hw);
+- if (ret) {
+- pr_warn("lsp0 clk %s init error!\n",
+- lsp0_mux_clk[i].mux.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp0 clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(lsp0_gate_clk); i++) {
+@@ -783,11 +779,10 @@ static int __init lsp0_clocks_init(struct device_node *np)
+ &lsp0_gate_clk[i].gate.hw;
+
+ lsp0_gate_clk[i].gate.reg += (uintptr_t)reg_base;
++ name = lsp0_gate_clk[i].gate.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp0_gate_clk[i].gate.hw);
+- if (ret) {
+- pr_warn("lsp0 clk %s init error!\n",
+- lsp0_gate_clk[i].gate.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp0 clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(lsp0_div_clk); i++) {
+@@ -796,11 +791,10 @@ static int __init lsp0_clocks_init(struct device_node *np)
+ &lsp0_div_clk[i].div.hw;
+
+ lsp0_div_clk[i].div.reg += (uintptr_t)reg_base;
++ name = lsp0_div_clk[i].div.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp0_div_clk[i].div.hw);
+- if (ret) {
+- pr_warn("lsp0 clk %s init error!\n",
+- lsp0_div_clk[i].div.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp0 clk %s init error!\n", name);
+ }
+
+ ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
+@@ -865,6 +859,7 @@ static int __init lsp1_clocks_init(struct device_node *np)
+ {
+ void __iomem *reg_base;
+ int i, ret;
++ const char *name;
+
+ reg_base = of_iomap(np, 0);
+ if (!reg_base) {
+@@ -878,11 +873,10 @@ static int __init lsp1_clocks_init(struct device_node *np)
+ &lsp0_mux_clk[i].mux.hw;
+
+ lsp1_mux_clk[i].mux.reg += (uintptr_t)reg_base;
++ name = lsp1_mux_clk[i].mux.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp1_mux_clk[i].mux.hw);
+- if (ret) {
+- pr_warn("lsp1 clk %s init error!\n",
+- lsp1_mux_clk[i].mux.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp1 clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(lsp1_gate_clk); i++) {
+@@ -891,11 +885,10 @@ static int __init lsp1_clocks_init(struct device_node *np)
+ &lsp1_gate_clk[i].gate.hw;
+
+ lsp1_gate_clk[i].gate.reg += (uintptr_t)reg_base;
++ name = lsp1_gate_clk[i].gate.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp1_gate_clk[i].gate.hw);
+- if (ret) {
+- pr_warn("lsp1 clk %s init error!\n",
+- lsp1_gate_clk[i].gate.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp1 clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(lsp1_div_clk); i++) {
+@@ -904,11 +897,10 @@ static int __init lsp1_clocks_init(struct device_node *np)
+ &lsp1_div_clk[i].div.hw;
+
+ lsp1_div_clk[i].div.reg += (uintptr_t)reg_base;
++ name = lsp1_div_clk[i].div.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp1_div_clk[i].div.hw);
+- if (ret) {
+- pr_warn("lsp1 clk %s init error!\n",
+- lsp1_div_clk[i].div.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp1 clk %s init error!\n", name);
+ }
+
+ ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
+@@ -982,6 +974,7 @@ static int __init audio_clocks_init(struct device_node *np)
+ {
+ void __iomem *reg_base;
+ int i, ret;
++ const char *name;
+
+ reg_base = of_iomap(np, 0);
+ if (!reg_base) {
+@@ -995,11 +988,10 @@ static int __init audio_clocks_init(struct device_node *np)
+ &audio_mux_clk[i].mux.hw;
+
+ audio_mux_clk[i].mux.reg += (uintptr_t)reg_base;
++ name = audio_mux_clk[i].mux.hw.init->name;
+ ret = clk_hw_register(NULL, &audio_mux_clk[i].mux.hw);
+- if (ret) {
+- pr_warn("audio clk %s init error!\n",
+- audio_mux_clk[i].mux.hw.init->name);
+- }
++ if (ret)
++ pr_warn("audio clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(audio_adiv_clk); i++) {
+@@ -1008,11 +1000,10 @@ static int __init audio_clocks_init(struct device_node *np)
+ &audio_adiv_clk[i].hw;
+
+ audio_adiv_clk[i].reg_base += (uintptr_t)reg_base;
++ name = audio_adiv_clk[i].hw.init->name;
+ ret = clk_hw_register(NULL, &audio_adiv_clk[i].hw);
+- if (ret) {
+- pr_warn("audio clk %s init error!\n",
+- audio_adiv_clk[i].hw.init->name);
+- }
++ if (ret)
++ pr_warn("audio clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(audio_div_clk); i++) {
+@@ -1021,11 +1012,10 @@ static int __init audio_clocks_init(struct device_node *np)
+ &audio_div_clk[i].div.hw;
+
+ audio_div_clk[i].div.reg += (uintptr_t)reg_base;
++ name = audio_div_clk[i].div.hw.init->name;
+ ret = clk_hw_register(NULL, &audio_div_clk[i].div.hw);
+- if (ret) {
+- pr_warn("audio clk %s init error!\n",
+- audio_div_clk[i].div.hw.init->name);
+- }
++ if (ret)
++ pr_warn("audio clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(audio_gate_clk); i++) {
+@@ -1034,11 +1024,10 @@ static int __init audio_clocks_init(struct device_node *np)
+ &audio_gate_clk[i].gate.hw;
+
+ audio_gate_clk[i].gate.reg += (uintptr_t)reg_base;
++ name = audio_gate_clk[i].gate.hw.init->name;
+ ret = clk_hw_register(NULL, &audio_gate_clk[i].gate.hw);
+- if (ret) {
+- pr_warn("audio clk %s init error!\n",
+- audio_gate_clk[i].gate.hw.init->name);
+- }
++ if (ret)
++ pr_warn("audio clk %s init error!\n", name);
+ }
+
+ ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
+diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c
+index cdc4f9a171d9..db2983c51f1e 100644
+--- a/drivers/crypto/hisilicon/sec/sec_algs.c
++++ b/drivers/crypto/hisilicon/sec/sec_algs.c
+@@ -215,17 +215,18 @@ static void sec_free_hw_sgl(struct sec_hw_sgl *hw_sgl,
+ dma_addr_t psec_sgl, struct sec_dev_info *info)
+ {
+ struct sec_hw_sgl *sgl_current, *sgl_next;
++ dma_addr_t sgl_next_dma;
+
+- if (!hw_sgl)
+- return;
+ sgl_current = hw_sgl;
+- while (sgl_current->next) {
++ while (sgl_current) {
+ sgl_next = sgl_current->next;
+- dma_pool_free(info->hw_sgl_pool, sgl_current,
+- sgl_current->next_sgl);
++ sgl_next_dma = sgl_current->next_sgl;
++
++ dma_pool_free(info->hw_sgl_pool, sgl_current, psec_sgl);
++
+ sgl_current = sgl_next;
++ psec_sgl = sgl_next_dma;
+ }
+- dma_pool_free(info->hw_sgl_pool, hw_sgl, psec_sgl);
+ }
+
+ static int sec_alg_skcipher_setkey(struct crypto_skcipher *tfm,
+diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
+index 53c1d6d36a64..81ba4eb34890 100644
+--- a/drivers/dma-buf/sw_sync.c
++++ b/drivers/dma-buf/sw_sync.c
+@@ -141,17 +141,14 @@ static void timeline_fence_release(struct dma_fence *fence)
+ {
+ struct sync_pt *pt = dma_fence_to_sync_pt(fence);
+ struct sync_timeline *parent = dma_fence_parent(fence);
++ unsigned long flags;
+
++ spin_lock_irqsave(fence->lock, flags);
+ if (!list_empty(&pt->link)) {
+- unsigned long flags;
+-
+- spin_lock_irqsave(fence->lock, flags);
+- if (!list_empty(&pt->link)) {
+- list_del(&pt->link);
+- rb_erase(&pt->node, &parent->pt_tree);
+- }
+- spin_unlock_irqrestore(fence->lock, flags);
++ list_del(&pt->link);
++ rb_erase(&pt->node, &parent->pt_tree);
+ }
++ spin_unlock_irqrestore(fence->lock, flags);
+
+ sync_timeline_put(parent);
+ dma_fence_free(fence);
+@@ -274,7 +271,8 @@ static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
+ p = &parent->rb_left;
+ } else {
+ if (dma_fence_get_rcu(&other->base)) {
+- dma_fence_put(&pt->base);
++ sync_timeline_put(obj);
++ kfree(pt);
+ pt = other;
+ goto unlock;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
+index c364ef94cc36..77c9f4d8668a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si.c
++++ b/drivers/gpu/drm/amd/amdgpu/si.c
+@@ -1813,7 +1813,7 @@ static void si_program_aspm(struct amdgpu_device *adev)
+ if (orig != data)
+ si_pif_phy1_wreg(adev,PB1_PIF_PWRDOWN_1, data);
+
+- if ((adev->family != CHIP_OLAND) && (adev->family != CHIP_HAINAN)) {
++ if ((adev->asic_type != CHIP_OLAND) && (adev->asic_type != CHIP_HAINAN)) {
+ orig = data = si_pif_phy0_rreg(adev,PB0_PIF_PWRDOWN_0);
+ data &= ~PLL_RAMP_UP_TIME_0_MASK;
+ if (orig != data)
+@@ -1862,14 +1862,14 @@ static void si_program_aspm(struct amdgpu_device *adev)
+
+ orig = data = si_pif_phy0_rreg(adev,PB0_PIF_CNTL);
+ data &= ~LS2_EXIT_TIME_MASK;
+- if ((adev->family == CHIP_OLAND) || (adev->family == CHIP_HAINAN))
++ if ((adev->asic_type == CHIP_OLAND) || (adev->asic_type == CHIP_HAINAN))
+ data |= LS2_EXIT_TIME(5);
+ if (orig != data)
+ si_pif_phy0_wreg(adev,PB0_PIF_CNTL, data);
+
+ orig = data = si_pif_phy1_rreg(adev,PB1_PIF_CNTL);
+ data &= ~LS2_EXIT_TIME_MASK;
+- if ((adev->family == CHIP_OLAND) || (adev->family == CHIP_HAINAN))
++ if ((adev->asic_type == CHIP_OLAND) || (adev->asic_type == CHIP_HAINAN))
+ data |= LS2_EXIT_TIME(5);
+ if (orig != data)
+ si_pif_phy1_wreg(adev,PB1_PIF_CNTL, data);
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index f4b89d1ea6f6..2b2efe443c36 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -1585,6 +1585,14 @@ void dc_set_power_state(
+ dc_resource_state_construct(dc, dc->current_state);
+
+ dc->hwss.init_hw(dc);
++
++#ifdef CONFIG_DRM_AMD_DC_DCN2_0
++ if (dc->hwss.init_sys_ctx != NULL &&
++ dc->vm_pa_config.valid) {
++ dc->hwss.init_sys_ctx(dc->hwseq, dc, &dc->vm_pa_config);
++ }
++#endif
++
+ break;
+ default:
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index f0d68aa7c8fc..d440b28ee43f 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -229,12 +229,10 @@ bool resource_construct(
+ DC_ERR("DC: failed to create audio!\n");
+ return false;
+ }
+-
+ if (!aud->funcs->endpoint_valid(aud)) {
+ aud->funcs->destroy(&aud);
+ break;
+ }
+-
+ pool->audios[i] = aud;
+ pool->audio_count++;
+ }
+@@ -1703,24 +1701,25 @@ static struct audio *find_first_free_audio(
+ const struct resource_pool *pool,
+ enum engine_id id)
+ {
+- int i;
+- for (i = 0; i < pool->audio_count; i++) {
++ int i, available_audio_count;
++
++ available_audio_count = pool->audio_count;
++
++ for (i = 0; i < available_audio_count; i++) {
+ if ((res_ctx->is_audio_acquired[i] == false) && (res_ctx->is_stream_enc_acquired[i] == true)) {
+ /*we have enough audio endpoint, find the matching inst*/
+ if (id != i)
+ continue;
+-
+ return pool->audios[i];
+ }
+ }
+
+- /* use engine id to find free audio */
+- if ((id < pool->audio_count) && (res_ctx->is_audio_acquired[id] == false)) {
++ /* use engine id to find free audio */
++ if ((id < available_audio_count) && (res_ctx->is_audio_acquired[id] == false)) {
+ return pool->audios[id];
+ }
+-
+ /*not found the matching one, first come first serve*/
+- for (i = 0; i < pool->audio_count; i++) {
++ for (i = 0; i < available_audio_count; i++) {
+ if (res_ctx->is_audio_acquired[i] == false) {
+ return pool->audios[i];
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c b/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c
+index 7f6d724686f1..abb559ce6408 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c
+@@ -611,6 +611,8 @@ void dce_aud_az_configure(
+
+ AZ_REG_WRITE(AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1,
+ value);
++ DC_LOG_HW_AUDIO("\n\tAUDIO:az_configure: index: %u data, 0x%x, displayName %s: \n",
++ audio->inst, value, audio_info->display_name);
+
+ /*
+ *write the port ID:
+@@ -922,7 +924,6 @@ static const struct audio_funcs funcs = {
+ .az_configure = dce_aud_az_configure,
+ .destroy = dce_aud_destroy,
+ };
+-
+ void dce_aud_destroy(struct audio **audio)
+ {
+ struct dce_audio *aud = DCE_AUD(*audio);
+@@ -953,7 +954,6 @@ struct audio *dce_audio_create(
+ audio->regs = reg;
+ audio->shifts = shifts;
+ audio->masks = masks;
+-
+ return &audio->base;
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+index 5d95a997fd9f..f8904f73f57b 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+@@ -292,9 +292,10 @@ bool cm_helper_translate_curve_to_hw_format(
+ seg_distr[7] = 4;
+ seg_distr[8] = 4;
+ seg_distr[9] = 4;
++ seg_distr[10] = 1;
+
+ region_start = -10;
+- region_end = 0;
++ region_end = 1;
+ }
+
+ for (i = region_end - region_start; i < MAX_REGIONS_NUMBER ; i++)
+diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+index d68986cea132..84abf5d6f760 100644
+--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+@@ -1040,16 +1040,17 @@ static int analogix_dp_commit(struct analogix_dp_device *dp)
+ if (ret)
+ return ret;
+
++ /* Check whether panel supports fast training */
++ ret = analogix_dp_fast_link_train_detection(dp);
++ if (ret)
++ dp->psr_enable = false;
++
+ if (dp->psr_enable) {
+ ret = analogix_dp_enable_sink_psr(dp);
+ if (ret)
+ return ret;
+ }
+
+- /* Check whether panel supports fast training */
+- ret = analogix_dp_fast_link_train_detection(dp);
+- if (ret)
+- dp->psr_enable = false;
+
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index aaca5248da07..d728b6cf6109 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -302,7 +302,7 @@ static ssize_t tc_aux_transfer(struct drm_dp_aux *aux,
+ struct drm_dp_aux_msg *msg)
+ {
+ struct tc_data *tc = aux_to_tc(aux);
+- size_t size = min_t(size_t, 8, msg->size);
++ size_t size = min_t(size_t, DP_AUX_MAX_PAYLOAD_BYTES - 1, msg->size);
+ u8 request = msg->request & ~DP_AUX_I2C_MOT;
+ u8 *buf = msg->buffer;
+ u32 tmp = 0;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c
+index 7143ea4611aa..33a9fb5ac558 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c
+@@ -96,6 +96,8 @@ nvbios_volt_parse(struct nvkm_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len,
+ info->min = min(info->base,
+ info->base + info->step * info->vidmask);
+ info->max = nvbios_rd32(bios, volt + 0x0e);
++ if (!info->max)
++ info->max = max(info->base, info->base + info->step * info->vidmask);
+ break;
+ case 0x50:
+ info->min = nvbios_rd32(bios, volt + 0x0a);
+diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+index 2c9c9722734f..9a2cb8aeab3a 100644
+--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+@@ -400,7 +400,13 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
+
+ /* Look up the DSI host. It needs to probe before we do. */
+ endpoint = of_graph_get_next_endpoint(dev->of_node, NULL);
++ if (!endpoint)
++ return -ENODEV;
++
+ dsi_host_node = of_graph_get_remote_port_parent(endpoint);
++ if (!dsi_host_node)
++ goto error;
++
+ host = of_find_mipi_dsi_host_by_node(dsi_host_node);
+ of_node_put(dsi_host_node);
+ if (!host) {
+@@ -409,6 +415,9 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
+ }
+
+ info.node = of_graph_get_remote_port(endpoint);
++ if (!info.node)
++ goto error;
++
+ of_node_put(endpoint);
+
+ ts->dsi = mipi_dsi_device_register_full(host, &info);
+@@ -429,6 +438,10 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
+ return ret;
+
+ return 0;
++
++error:
++ of_node_put(endpoint);
++ return -ENODEV;
+ }
+
+ static int rpi_touchscreen_remove(struct i2c_client *i2c)
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 5fd94e206029..654fea2b4312 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -689,9 +689,9 @@ static const struct panel_desc auo_g133han01 = {
+ static const struct display_timing auo_g185han01_timings = {
+ .pixelclock = { 120000000, 144000000, 175000000 },
+ .hactive = { 1920, 1920, 1920 },
+- .hfront_porch = { 18, 60, 74 },
+- .hback_porch = { 12, 44, 54 },
+- .hsync_len = { 10, 24, 32 },
++ .hfront_porch = { 36, 120, 148 },
++ .hback_porch = { 24, 88, 108 },
++ .hsync_len = { 20, 48, 64 },
+ .vactive = { 1080, 1080, 1080 },
+ .vfront_porch = { 6, 10, 40 },
+ .vback_porch = { 2, 5, 20 },
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index 414642e5b7a3..de656f555383 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -751,7 +751,7 @@ static int radeon_connector_set_property(struct drm_connector *connector, struct
+
+ radeon_encoder->output_csc = val;
+
+- if (connector->encoder->crtc) {
++ if (connector->encoder && connector->encoder->crtc) {
+ struct drm_crtc *crtc = connector->encoder->crtc;
+ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
+index 2a7977a23b31..25b5407c74b5 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -364,11 +364,19 @@ radeon_pci_remove(struct pci_dev *pdev)
+ static void
+ radeon_pci_shutdown(struct pci_dev *pdev)
+ {
++ struct drm_device *ddev = pci_get_drvdata(pdev);
++
+ /* if we are running in a VM, make sure the device
+ * torn down properly on reboot/shutdown
+ */
+ if (radeon_device_is_virtual())
+ radeon_pci_remove(pdev);
++
++ /* Some adapters need to be suspended before a
++ * shutdown occurs in order to prevent an error
++ * during kexec.
++ */
++ radeon_suspend_kms(ddev, true, true, false);
+ }
+
+ static int radeon_pmops_suspend(struct device *dev)
+diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c
+index 808d9fb627e9..477d0a27b9a5 100644
+--- a/drivers/gpu/drm/stm/ltdc.c
++++ b/drivers/gpu/drm/stm/ltdc.c
+@@ -19,6 +19,7 @@
+ #include <drm/drm_crtc_helper.h>
+ #include <drm/drm_fb_cma_helper.h>
+ #include <drm/drm_gem_cma_helper.h>
++#include <drm/drm_gem_framebuffer_helper.h>
+ #include <drm/drm_of.h>
+ #include <drm/drm_bridge.h>
+ #include <drm/drm_plane_helper.h>
+@@ -825,6 +826,7 @@ static const struct drm_plane_funcs ltdc_plane_funcs = {
+ };
+
+ static const struct drm_plane_helper_funcs ltdc_plane_helper_funcs = {
++ .prepare_fb = drm_gem_fb_prepare_fb,
+ .atomic_check = ltdc_plane_atomic_check,
+ .atomic_update = ltdc_plane_atomic_update,
+ .atomic_disable = ltdc_plane_atomic_disable,
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 1cb41992aaa1..d0a81a03ddbd 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -57,7 +57,6 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\")
+ struct apple_sc {
+ unsigned long quirks;
+ unsigned int fn_on;
+- DECLARE_BITMAP(pressed_fn, KEY_CNT);
+ DECLARE_BITMAP(pressed_numlock, KEY_CNT);
+ };
+
+@@ -184,6 +183,8 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
+ {
+ struct apple_sc *asc = hid_get_drvdata(hid);
+ const struct apple_key_translation *trans, *table;
++ bool do_translate;
++ u16 code = 0;
+
+ if (usage->code == KEY_FN) {
+ asc->fn_on = !!value;
+@@ -192,8 +193,6 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
+ }
+
+ if (fnmode) {
+- int do_translate;
+-
+ if (hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
+ hid->product <= USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS)
+ table = macbookair_fn_keys;
+@@ -205,25 +204,33 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
+ trans = apple_find_translation (table, usage->code);
+
+ if (trans) {
+- if (test_bit(usage->code, asc->pressed_fn))
+- do_translate = 1;
+- else if (trans->flags & APPLE_FLAG_FKEY)
+- do_translate = (fnmode == 2 && asc->fn_on) ||
+- (fnmode == 1 && !asc->fn_on);
+- else
+- do_translate = asc->fn_on;
+-
+- if (do_translate) {
+- if (value)
+- set_bit(usage->code, asc->pressed_fn);
+- else
+- clear_bit(usage->code, asc->pressed_fn);
+-
+- input_event(input, usage->type, trans->to,
+- value);
+-
+- return 1;
++ if (test_bit(trans->from, input->key))
++ code = trans->from;
++ else if (test_bit(trans->to, input->key))
++ code = trans->to;
++
++ if (!code) {
++ if (trans->flags & APPLE_FLAG_FKEY) {
++ switch (fnmode) {
++ case 1:
++ do_translate = !asc->fn_on;
++ break;
++ case 2:
++ do_translate = asc->fn_on;
++ break;
++ default:
++ /* should never happen */
++ do_translate = false;
++ }
++ } else {
++ do_translate = asc->fn_on;
++ }
++
++ code = do_translate ? trans->to : trans->from;
+ }
++
++ input_event(input, usage->type, code, value);
++ return 1;
+ }
+
+ if (asc->quirks & APPLE_NUMLOCK_EMULATION &&
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 5a2d5140c1f4..3038c975e417 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -91,7 +91,7 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
+ }
+
+ static int wacom_wac_pen_serial_enforce(struct hid_device *hdev,
+- struct hid_report *report, u8 *raw_data, int size)
++ struct hid_report *report, u8 *raw_data, int report_size)
+ {
+ struct wacom *wacom = hid_get_drvdata(hdev);
+ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+@@ -152,7 +152,8 @@ static int wacom_wac_pen_serial_enforce(struct hid_device *hdev,
+ if (flush)
+ wacom_wac_queue_flush(hdev, &wacom_wac->pen_fifo);
+ else if (insert)
+- wacom_wac_queue_insert(hdev, &wacom_wac->pen_fifo, raw_data, size);
++ wacom_wac_queue_insert(hdev, &wacom_wac->pen_fifo,
++ raw_data, report_size);
+
+ return insert && !flush;
+ }
+@@ -2147,7 +2148,7 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix)
+ {
+ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+ struct wacom_features *features = &wacom_wac->features;
+- char name[WACOM_NAME_MAX];
++ char name[WACOM_NAME_MAX - 20]; /* Leave some room for suffixes */
+
+ /* Generic devices name unspecified */
+ if ((features->type == HID_GENERIC) && !strcmp("Wacom HID", features->name)) {
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 6f5c838f9d47..1df037e7f0b4 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -255,7 +255,7 @@ static int wacom_dtu_irq(struct wacom_wac *wacom)
+
+ static int wacom_dtus_irq(struct wacom_wac *wacom)
+ {
+- char *data = wacom->data;
++ unsigned char *data = wacom->data;
+ struct input_dev *input = wacom->pen_input;
+ unsigned short prox, pressure = 0;
+
+@@ -576,7 +576,7 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
+ strip2 = ((data[3] & 0x1f) << 8) | data[4];
+ }
+
+- prox = (buttons & ~(~0 << nbuttons)) | (keys & ~(~0 << nkeys)) |
++ prox = (buttons & ~(~0U << nbuttons)) | (keys & ~(~0U << nkeys)) |
+ (ring1 & 0x80) | (ring2 & 0x80) | strip1 | strip2;
+
+ wacom_report_numbered_buttons(input, nbuttons, buttons);
+diff --git a/drivers/i2c/busses/i2c-cht-wc.c b/drivers/i2c/busses/i2c-cht-wc.c
+index c4d176f5ed79..f890af67f501 100644
+--- a/drivers/i2c/busses/i2c-cht-wc.c
++++ b/drivers/i2c/busses/i2c-cht-wc.c
+@@ -187,6 +187,51 @@ static const struct i2c_algorithm cht_wc_i2c_adap_algo = {
+ .smbus_xfer = cht_wc_i2c_adap_smbus_xfer,
+ };
+
++/*
++ * We are an i2c-adapter which itself is part of an i2c-client. This means that
++ * transfers done through us take adapter->bus_lock twice, once for our parent
++ * i2c-adapter and once to take our own bus_lock. Lockdep does not like this
++ * nested locking, to make lockdep happy in the case of busses with muxes, the
++ * i2c-core's i2c_adapter_lock_bus function calls:
++ * rt_mutex_lock_nested(&adapter->bus_lock, i2c_adapter_depth(adapter));
++ *
++ * But i2c_adapter_depth only works when the direct parent of the adapter is
++ * another adapter, as it is only meant for muxes. In our case there is an
++ * i2c-client and MFD instantiated platform_device in the parent->child chain
++ * between the 2 devices.
++ *
++ * So we override the default i2c_lock_operations and pass a hardcoded
++ * depth of 1 to rt_mutex_lock_nested, to make lockdep happy.
++ *
++ * Note that if there were to be a mux attached to our adapter, this would
++ * break things again since the i2c-mux code expects the root-adapter to have
++ * a locking depth of 0. But we always have only 1 client directly attached
++ * in the form of the Charger IC paired with the CHT Whiskey Cove PMIC.
++ */
++static void cht_wc_i2c_adap_lock_bus(struct i2c_adapter *adapter,
++ unsigned int flags)
++{
++ rt_mutex_lock_nested(&adapter->bus_lock, 1);
++}
++
++static int cht_wc_i2c_adap_trylock_bus(struct i2c_adapter *adapter,
++ unsigned int flags)
++{
++ return rt_mutex_trylock(&adapter->bus_lock);
++}
++
++static void cht_wc_i2c_adap_unlock_bus(struct i2c_adapter *adapter,
++ unsigned int flags)
++{
++ rt_mutex_unlock(&adapter->bus_lock);
++}
++
++static const struct i2c_lock_operations cht_wc_i2c_adap_lock_ops = {
++ .lock_bus = cht_wc_i2c_adap_lock_bus,
++ .trylock_bus = cht_wc_i2c_adap_trylock_bus,
++ .unlock_bus = cht_wc_i2c_adap_unlock_bus,
++};
++
+ /**** irqchip for the client connected to the extchgr i2c adapter ****/
+ static void cht_wc_i2c_irq_lock(struct irq_data *data)
+ {
+@@ -295,6 +340,7 @@ static int cht_wc_i2c_adap_i2c_probe(struct platform_device *pdev)
+ adap->adapter.owner = THIS_MODULE;
+ adap->adapter.class = I2C_CLASS_HWMON;
+ adap->adapter.algo = &cht_wc_i2c_adap_algo;
++ adap->adapter.lock_ops = &cht_wc_i2c_adap_lock_ops;
+ strlcpy(adap->adapter.name, "PMIC I2C Adapter",
+ sizeof(adap->adapter.name));
+ adap->adapter.dev.parent = &pdev->dev;
+diff --git a/drivers/mailbox/qcom-apcs-ipc-mailbox.c b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
+index 333ed4a9d4b8..5255dcb551a7 100644
+--- a/drivers/mailbox/qcom-apcs-ipc-mailbox.c
++++ b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
+@@ -55,7 +55,6 @@ static const struct mbox_chan_ops qcom_apcs_ipc_ops = {
+
+ static int qcom_apcs_ipc_probe(struct platform_device *pdev)
+ {
+- struct device_node *np = pdev->dev.of_node;
+ struct qcom_apcs_ipc *apcs;
+ struct regmap *regmap;
+ struct resource *res;
+@@ -63,6 +62,11 @@ static int qcom_apcs_ipc_probe(struct platform_device *pdev)
+ void __iomem *base;
+ unsigned long i;
+ int ret;
++ const struct of_device_id apcs_clk_match_table[] = {
++ { .compatible = "qcom,msm8916-apcs-kpss-global", },
++ { .compatible = "qcom,qcs404-apcs-apps-global", },
++ {}
++ };
+
+ apcs = devm_kzalloc(&pdev->dev, sizeof(*apcs), GFP_KERNEL);
+ if (!apcs)
+@@ -97,7 +101,7 @@ static int qcom_apcs_ipc_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- if (of_device_is_compatible(np, "qcom,msm8916-apcs-kpss-global")) {
++ if (of_match_device(apcs_clk_match_table, &pdev->dev)) {
+ apcs->clk = platform_device_register_data(&pdev->dev,
+ "qcom-apcs-msm8916-clk",
+ -1, NULL, 0);
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index 0e5282fc1467..c37c8bb86068 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -39,6 +39,8 @@ static int intel_lpss_pci_probe(struct pci_dev *pdev,
+ info->mem = &pdev->resource[0];
+ info->irq = pdev->irq;
+
++ pdev->d3cold_delay = 0;
++
+ /* Probably it is enough to set this for iDMA capable devices only */
+ pci_set_master(pdev);
+ pci_try_set_mwi(pdev);
+diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c
+index 35b767baf21f..c281c488a306 100644
+--- a/drivers/net/dsa/rtl8366.c
++++ b/drivers/net/dsa/rtl8366.c
+@@ -339,10 +339,12 @@ int rtl8366_vlan_prepare(struct dsa_switch *ds, int port,
+ const struct switchdev_obj_port_vlan *vlan)
+ {
+ struct realtek_smi *smi = ds->priv;
++ u16 vid;
+ int ret;
+
+- if (!smi->ops->is_vlan_valid(smi, port))
+- return -EINVAL;
++ for (vid = vlan->vid_begin; vid < vlan->vid_end; vid++)
++ if (!smi->ops->is_vlan_valid(smi, vid))
++ return -EINVAL;
+
+ dev_info(smi->dev, "prepare VLANs %04x..%04x\n",
+ vlan->vid_begin, vlan->vid_end);
+@@ -370,8 +372,9 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port,
+ u16 vid;
+ int ret;
+
+- if (!smi->ops->is_vlan_valid(smi, port))
+- return;
++ for (vid = vlan->vid_begin; vid < vlan->vid_end; vid++)
++ if (!smi->ops->is_vlan_valid(smi, vid))
++ return;
+
+ dev_info(smi->dev, "add VLAN on port %d, %s, %s\n",
+ port,
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+index 4bc211093c98..dba8a0c1eda3 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+@@ -137,13 +137,12 @@ static int uldrx_handler(struct sge_rspq *q, const __be64 *rsp,
+ static int alloc_uld_rxqs(struct adapter *adap,
+ struct sge_uld_rxq_info *rxq_info, bool lro)
+ {
+- struct sge *s = &adap->sge;
+ unsigned int nq = rxq_info->nrxq + rxq_info->nciq;
++ int i, err, msi_idx, que_idx = 0, bmap_idx = 0;
+ struct sge_ofld_rxq *q = rxq_info->uldrxq;
+ unsigned short *ids = rxq_info->rspq_id;
+- unsigned int bmap_idx = 0;
++ struct sge *s = &adap->sge;
+ unsigned int per_chan;
+- int i, err, msi_idx, que_idx = 0;
+
+ per_chan = rxq_info->nrxq / adap->params.nports;
+
+@@ -161,6 +160,10 @@ static int alloc_uld_rxqs(struct adapter *adap,
+
+ if (msi_idx >= 0) {
+ bmap_idx = get_msix_idx_from_bmap(adap);
++ if (bmap_idx < 0) {
++ err = -ENOSPC;
++ goto freeout;
++ }
+ msi_idx = adap->msix_info_ulds[bmap_idx].idx;
+ }
+ err = t4_sge_alloc_rxq(adap, &q->rspq, false,
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
+index 10b075bc5959..783ee6a32b5d 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -2788,6 +2788,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev)
+ netdev_err(qdev->ndev,
+ "PCI mapping failed with error: %d\n",
+ err);
++ dev_kfree_skb_irq(skb);
+ ql_free_large_buffers(qdev);
+ return -ENOMEM;
+ }
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index d6916f787fce..5251c5f6f96e 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -2634,14 +2634,18 @@ static struct hso_device *hso_create_bulk_serial_device(
+ */
+ if (serial->tiocmget) {
+ tiocmget = serial->tiocmget;
++ tiocmget->endp = hso_get_ep(interface,
++ USB_ENDPOINT_XFER_INT,
++ USB_DIR_IN);
++ if (!tiocmget->endp) {
++ dev_err(&interface->dev, "Failed to find INT IN ep\n");
++ goto exit;
++ }
++
+ tiocmget->urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (tiocmget->urb) {
+ mutex_init(&tiocmget->mutex);
+ init_waitqueue_head(&tiocmget->waitq);
+- tiocmget->endp = hso_get_ep(
+- interface,
+- USB_ENDPOINT_XFER_INT,
+- USB_DIR_IN);
+ } else
+ hso_free_tiomget(serial);
+ }
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 51017c6bb3bc..6f517e673020 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1286,6 +1286,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)}, /* Cinterion PHxx,PXxx (2 RmNet) */
+ {QMI_FIXED_INTF(0x1e2d, 0x0082, 5)}, /* Cinterion PHxx,PXxx (2 RmNet) */
+ {QMI_FIXED_INTF(0x1e2d, 0x0083, 4)}, /* Cinterion PHxx,PXxx (1 RmNet + USB Audio)*/
++ {QMI_QUIRK_SET_DTR(0x1e2d, 0x00b0, 4)}, /* Cinterion CLS8 */
+ {QMI_FIXED_INTF(0x413c, 0x81a2, 8)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
+ {QMI_FIXED_INTF(0x413c, 0x81a3, 8)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
+ {QMI_FIXED_INTF(0x413c, 0x81a4, 8)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index a2a4c19bc95e..6b4675a9494b 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -890,9 +890,9 @@ static int xennet_set_skb_gso(struct sk_buff *skb,
+ return 0;
+ }
+
+-static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
+- struct sk_buff *skb,
+- struct sk_buff_head *list)
++static int xennet_fill_frags(struct netfront_queue *queue,
++ struct sk_buff *skb,
++ struct sk_buff_head *list)
+ {
+ RING_IDX cons = queue->rx.rsp_cons;
+ struct sk_buff *nskb;
+@@ -911,7 +911,7 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
+ if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+ queue->rx.rsp_cons = ++cons + skb_queue_len(list);
+ kfree_skb(nskb);
+- return ~0U;
++ return -ENOENT;
+ }
+
+ skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+@@ -922,7 +922,9 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
+ kfree_skb(nskb);
+ }
+
+- return cons;
++ queue->rx.rsp_cons = cons;
++
++ return 0;
+ }
+
+ static int checksum_setup(struct net_device *dev, struct sk_buff *skb)
+@@ -1048,8 +1050,7 @@ err:
+ skb->data_len = rx->status;
+ skb->len += rx->status;
+
+- i = xennet_fill_frags(queue, skb, &tmpq);
+- if (unlikely(i == ~0U))
++ if (unlikely(xennet_fill_frags(queue, skb, &tmpq)))
+ goto err;
+
+ if (rx->flags & XEN_NETRXF_csum_blank)
+@@ -1059,7 +1060,7 @@ err:
+
+ __skb_queue_tail(&rxq, skb);
+
+- queue->rx.rsp_cons = ++i;
++ i = ++queue->rx.rsp_cons;
+ work_done++;
+ }
+
+diff --git a/drivers/pci/controller/dwc/pci-exynos.c b/drivers/pci/controller/dwc/pci-exynos.c
+index cee5f2f590e2..14a6ba4067fb 100644
+--- a/drivers/pci/controller/dwc/pci-exynos.c
++++ b/drivers/pci/controller/dwc/pci-exynos.c
+@@ -465,7 +465,7 @@ static int __init exynos_pcie_probe(struct platform_device *pdev)
+
+ ep->phy = devm_of_phy_get(dev, np, NULL);
+ if (IS_ERR(ep->phy)) {
+- if (PTR_ERR(ep->phy) == -EPROBE_DEFER)
++ if (PTR_ERR(ep->phy) != -ENODEV)
+ return PTR_ERR(ep->phy);
+
+ ep->phy = NULL;
+diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
+index 3826b444298c..3b2ceb566728 100644
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -807,8 +807,8 @@ static int imx6_pcie_probe(struct platform_device *pdev)
+
+ imx6_pcie->vpcie = devm_regulator_get_optional(&pdev->dev, "vpcie");
+ if (IS_ERR(imx6_pcie->vpcie)) {
+- if (PTR_ERR(imx6_pcie->vpcie) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(imx6_pcie->vpcie) != -ENODEV)
++ return PTR_ERR(imx6_pcie->vpcie);
+ imx6_pcie->vpcie = NULL;
+ }
+
+diff --git a/drivers/pci/controller/dwc/pcie-histb.c b/drivers/pci/controller/dwc/pcie-histb.c
+index 7b32e619b959..a3489839a8fc 100644
+--- a/drivers/pci/controller/dwc/pcie-histb.c
++++ b/drivers/pci/controller/dwc/pcie-histb.c
+@@ -340,8 +340,8 @@ static int histb_pcie_probe(struct platform_device *pdev)
+
+ hipcie->vpcie = devm_regulator_get_optional(dev, "vpcie");
+ if (IS_ERR(hipcie->vpcie)) {
+- if (PTR_ERR(hipcie->vpcie) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(hipcie->vpcie) != -ENODEV)
++ return PTR_ERR(hipcie->vpcie);
+ hipcie->vpcie = NULL;
+ }
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index f4f53d092e00..976eaa9a9f26 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -1975,14 +1975,15 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
+ err = of_pci_get_devfn(port);
+ if (err < 0) {
+ dev_err(dev, "failed to parse address: %d\n", err);
+- return err;
++ goto err_node_put;
+ }
+
+ index = PCI_SLOT(err);
+
+ if (index < 1 || index > soc->num_ports) {
+ dev_err(dev, "invalid port number: %d\n", index);
+- return -EINVAL;
++ err = -EINVAL;
++ goto err_node_put;
+ }
+
+ index--;
+@@ -1991,12 +1992,13 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
+ if (err < 0) {
+ dev_err(dev, "failed to parse # of lanes: %d\n",
+ err);
+- return err;
++ goto err_node_put;
+ }
+
+ if (value > 16) {
+ dev_err(dev, "invalid # of lanes: %u\n", value);
+- return -EINVAL;
++ err = -EINVAL;
++ goto err_node_put;
+ }
+
+ lanes |= value << (index << 3);
+@@ -2010,13 +2012,15 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
+ lane += value;
+
+ rp = devm_kzalloc(dev, sizeof(*rp), GFP_KERNEL);
+- if (!rp)
+- return -ENOMEM;
++ if (!rp) {
++ err = -ENOMEM;
++ goto err_node_put;
++ }
+
+ err = of_address_to_resource(port, 0, &rp->regs);
+ if (err < 0) {
+ dev_err(dev, "failed to parse address: %d\n", err);
+- return err;
++ goto err_node_put;
+ }
+
+ INIT_LIST_HEAD(&rp->list);
+@@ -2043,6 +2047,10 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
+ return err;
+
+ return 0;
++
++err_node_put:
++ of_node_put(port);
++ return err;
+ }
+
+ /*
+diff --git a/drivers/pci/controller/pcie-rockchip-host.c b/drivers/pci/controller/pcie-rockchip-host.c
+index 1372d270764f..5ce8e6375687 100644
+--- a/drivers/pci/controller/pcie-rockchip-host.c
++++ b/drivers/pci/controller/pcie-rockchip-host.c
+@@ -608,29 +608,29 @@ static int rockchip_pcie_parse_host_dt(struct rockchip_pcie *rockchip)
+
+ rockchip->vpcie12v = devm_regulator_get_optional(dev, "vpcie12v");
+ if (IS_ERR(rockchip->vpcie12v)) {
+- if (PTR_ERR(rockchip->vpcie12v) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(rockchip->vpcie12v) != -ENODEV)
++ return PTR_ERR(rockchip->vpcie12v);
+ dev_info(dev, "no vpcie12v regulator found\n");
+ }
+
+ rockchip->vpcie3v3 = devm_regulator_get_optional(dev, "vpcie3v3");
+ if (IS_ERR(rockchip->vpcie3v3)) {
+- if (PTR_ERR(rockchip->vpcie3v3) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(rockchip->vpcie3v3) != -ENODEV)
++ return PTR_ERR(rockchip->vpcie3v3);
+ dev_info(dev, "no vpcie3v3 regulator found\n");
+ }
+
+ rockchip->vpcie1v8 = devm_regulator_get_optional(dev, "vpcie1v8");
+ if (IS_ERR(rockchip->vpcie1v8)) {
+- if (PTR_ERR(rockchip->vpcie1v8) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(rockchip->vpcie1v8) != -ENODEV)
++ return PTR_ERR(rockchip->vpcie1v8);
+ dev_info(dev, "no vpcie1v8 regulator found\n");
+ }
+
+ rockchip->vpcie0v9 = devm_regulator_get_optional(dev, "vpcie0v9");
+ if (IS_ERR(rockchip->vpcie0v9)) {
+- if (PTR_ERR(rockchip->vpcie0v9) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(rockchip->vpcie0v9) != -ENODEV)
++ return PTR_ERR(rockchip->vpcie0v9);
+ dev_info(dev, "no vpcie0v9 regulator found\n");
+ }
+
+diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c
+index 857c358b727b..cc860c5f7d26 100644
+--- a/drivers/pci/hotplug/rpaphp_core.c
++++ b/drivers/pci/hotplug/rpaphp_core.c
+@@ -230,7 +230,7 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,
+ struct of_drc_info drc;
+ const __be32 *value;
+ char cell_drc_name[MAX_DRC_NAME_LEN];
+- int j, fndit;
++ int j;
+
+ info = of_find_property(dn->parent, "ibm,drc-info", NULL);
+ if (info == NULL)
+@@ -245,17 +245,13 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,
+
+ /* Should now know end of current entry */
+
+- if (my_index > drc.last_drc_index)
+- continue;
+-
+- fndit = 1;
+- break;
++ /* Found it */
++ if (my_index <= drc.last_drc_index) {
++ sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix,
++ my_index);
++ break;
++ }
+ }
+- /* Found it */
+-
+- if (fndit)
+- sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix,
+- my_index);
+
+ if (((drc_name == NULL) ||
+ (drc_name && !strcmp(drc_name, cell_drc_name))) &&
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+index 4edeb4cae72a..c4c70dc57dbe 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+@@ -198,8 +198,8 @@ static const unsigned int uart_rts_b_pins[] = { GPIODV_27 };
+
+ static const unsigned int uart_tx_c_pins[] = { GPIOY_13 };
+ static const unsigned int uart_rx_c_pins[] = { GPIOY_14 };
+-static const unsigned int uart_cts_c_pins[] = { GPIOX_11 };
+-static const unsigned int uart_rts_c_pins[] = { GPIOX_12 };
++static const unsigned int uart_cts_c_pins[] = { GPIOY_11 };
++static const unsigned int uart_rts_c_pins[] = { GPIOY_12 };
+
+ static const unsigned int i2c_sck_a_pins[] = { GPIODV_25 };
+ static const unsigned int i2c_sda_a_pins[] = { GPIODV_24 };
+@@ -445,10 +445,10 @@ static struct meson_pmx_group meson_gxbb_periphs_groups[] = {
+ GROUP(pwm_f_x, 3, 18),
+
+ /* Bank Y */
+- GROUP(uart_cts_c, 1, 19),
+- GROUP(uart_rts_c, 1, 18),
+- GROUP(uart_tx_c, 1, 17),
+- GROUP(uart_rx_c, 1, 16),
++ GROUP(uart_cts_c, 1, 17),
++ GROUP(uart_rts_c, 1, 16),
++ GROUP(uart_tx_c, 1, 19),
++ GROUP(uart_rx_c, 1, 18),
+ GROUP(pwm_a_y, 1, 21),
+ GROUP(pwm_f_y, 1, 20),
+ GROUP(i2s_out_ch23_y, 1, 5),
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index 1425c2874d40..cd7a5d95b499 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -569,15 +569,25 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
+ !(regval & BIT(INTERRUPT_MASK_OFF)))
+ continue;
+ irq = irq_find_mapping(gc->irq.domain, irqnr + i);
+- generic_handle_irq(irq);
++ if (irq != 0)
++ generic_handle_irq(irq);
+
+ /* Clear interrupt.
+ * We must read the pin register again, in case the
+ * value was changed while executing
+ * generic_handle_irq() above.
++ * If we didn't find a mapping for the interrupt,
++ * disable it in order to avoid a system hang caused
++ * by an interrupt storm.
+ */
+ raw_spin_lock_irqsave(&gpio_dev->lock, flags);
+ regval = readl(regs + i);
++ if (irq == 0) {
++ regval &= ~BIT(INTERRUPT_ENABLE_OFF);
++ dev_dbg(&gpio_dev->pdev->dev,
++ "Disabling spurious GPIO IRQ %d\n",
++ irqnr + i);
++ }
+ writel(regval, regs + i);
+ raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
+ ret = IRQ_HANDLED;
+diff --git a/drivers/pinctrl/tegra/pinctrl-tegra.c b/drivers/pinctrl/tegra/pinctrl-tegra.c
+index 1aba75897d14..26a3f1eb9c6b 100644
+--- a/drivers/pinctrl/tegra/pinctrl-tegra.c
++++ b/drivers/pinctrl/tegra/pinctrl-tegra.c
+@@ -40,7 +40,9 @@ static inline u32 pmx_readl(struct tegra_pmx *pmx, u32 bank, u32 reg)
+
+ static inline void pmx_writel(struct tegra_pmx *pmx, u32 val, u32 bank, u32 reg)
+ {
+- writel(val, pmx->regs[bank] + reg);
++ writel_relaxed(val, pmx->regs[bank] + reg);
++ /* make sure pinmux register write completed */
++ pmx_readl(pmx, bank, reg);
+ }
+
+ static int tegra_pinctrl_get_groups_count(struct pinctrl_dev *pctldev)
+diff --git a/drivers/rtc/rtc-pcf85363.c b/drivers/rtc/rtc-pcf85363.c
+index c04a1edcd571..c3702684b342 100644
+--- a/drivers/rtc/rtc-pcf85363.c
++++ b/drivers/rtc/rtc-pcf85363.c
+@@ -169,7 +169,12 @@ static int pcf85363_rtc_set_time(struct device *dev, struct rtc_time *tm)
+ buf[DT_YEARS] = bin2bcd(tm->tm_year % 100);
+
+ ret = regmap_bulk_write(pcf85363->regmap, CTRL_STOP_EN,
+- tmp, sizeof(tmp));
++ tmp, 2);
++ if (ret)
++ return ret;
++
++ ret = regmap_bulk_write(pcf85363->regmap, DT_100THS,
++ buf, sizeof(tmp) - 2);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
+index b2483a749ac4..3cf011e12053 100644
+--- a/drivers/rtc/rtc-snvs.c
++++ b/drivers/rtc/rtc-snvs.c
+@@ -273,6 +273,10 @@ static int snvs_rtc_probe(struct platform_device *pdev)
+ if (!data)
+ return -ENOMEM;
+
++ data->rtc = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(data->rtc))
++ return PTR_ERR(data->rtc);
++
+ data->regmap = syscon_regmap_lookup_by_phandle(pdev->dev.of_node, "regmap");
+
+ if (IS_ERR(data->regmap)) {
+@@ -335,10 +339,9 @@ static int snvs_rtc_probe(struct platform_device *pdev)
+ goto error_rtc_device_register;
+ }
+
+- data->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
+- &snvs_rtc_ops, THIS_MODULE);
+- if (IS_ERR(data->rtc)) {
+- ret = PTR_ERR(data->rtc);
++ data->rtc->ops = &snvs_rtc_ops;
++ ret = rtc_register_device(data->rtc);
++ if (ret) {
+ dev_err(&pdev->dev, "failed to register rtc: %d\n", ret);
+ goto error_rtc_device_register;
+ }
+diff --git a/drivers/scsi/scsi_logging.c b/drivers/scsi/scsi_logging.c
+index bd70339c1242..03d9855a6afd 100644
+--- a/drivers/scsi/scsi_logging.c
++++ b/drivers/scsi/scsi_logging.c
+@@ -16,57 +16,15 @@
+ #include <scsi/scsi_eh.h>
+ #include <scsi/scsi_dbg.h>
+
+-#define SCSI_LOG_SPOOLSIZE 4096
+-
+-#if (SCSI_LOG_SPOOLSIZE / SCSI_LOG_BUFSIZE) > BITS_PER_LONG
+-#warning SCSI logging bitmask too large
+-#endif
+-
+-struct scsi_log_buf {
+- char buffer[SCSI_LOG_SPOOLSIZE];
+- unsigned long map;
+-};
+-
+-static DEFINE_PER_CPU(struct scsi_log_buf, scsi_format_log);
+-
+ static char *scsi_log_reserve_buffer(size_t *len)
+ {
+- struct scsi_log_buf *buf;
+- unsigned long map_bits = sizeof(buf->buffer) / SCSI_LOG_BUFSIZE;
+- unsigned long idx = 0;
+-
+- preempt_disable();
+- buf = this_cpu_ptr(&scsi_format_log);
+- idx = find_first_zero_bit(&buf->map, map_bits);
+- if (likely(idx < map_bits)) {
+- while (test_and_set_bit(idx, &buf->map)) {
+- idx = find_next_zero_bit(&buf->map, map_bits, idx);
+- if (idx >= map_bits)
+- break;
+- }
+- }
+- if (WARN_ON(idx >= map_bits)) {
+- preempt_enable();
+- return NULL;
+- }
+- *len = SCSI_LOG_BUFSIZE;
+- return buf->buffer + idx * SCSI_LOG_BUFSIZE;
++ *len = 128;
++ return kmalloc(*len, GFP_ATOMIC);
+ }
+
+ static void scsi_log_release_buffer(char *bufptr)
+ {
+- struct scsi_log_buf *buf;
+- unsigned long idx;
+- int ret;
+-
+- buf = this_cpu_ptr(&scsi_format_log);
+- if (bufptr >= buf->buffer &&
+- bufptr < buf->buffer + SCSI_LOG_SPOOLSIZE) {
+- idx = (bufptr - buf->buffer) / SCSI_LOG_BUFSIZE;
+- ret = test_and_clear_bit(idx, &buf->map);
+- WARN_ON(!ret);
+- }
+- preempt_enable();
++ kfree(bufptr);
+ }
+
+ static inline const char *scmd_name(const struct scsi_cmnd *scmd)
+diff --git a/drivers/soundwire/Kconfig b/drivers/soundwire/Kconfig
+index 19c8efb9a5ee..1ba1556f1987 100644
+--- a/drivers/soundwire/Kconfig
++++ b/drivers/soundwire/Kconfig
+@@ -3,8 +3,8 @@
+ #
+
+ menuconfig SOUNDWIRE
+- bool "SoundWire support"
+- ---help---
++ tristate "SoundWire support"
++ help
+ SoundWire is a 2-Pin interface with data and clock line ratified
+ by the MIPI Alliance. SoundWire is used for transporting data
+ typically related to audio functions. SoundWire interface is
+@@ -16,17 +16,12 @@ if SOUNDWIRE
+
+ comment "SoundWire Devices"
+
+-config SOUNDWIRE_BUS
+- tristate
+- select REGMAP_SOUNDWIRE
+-
+ config SOUNDWIRE_CADENCE
+ tristate
+
+ config SOUNDWIRE_INTEL
+ tristate "Intel SoundWire Master driver"
+ select SOUNDWIRE_CADENCE
+- select SOUNDWIRE_BUS
+ depends on X86 && ACPI && SND_SOC
+ ---help---
+ SoundWire Intel Master driver.
+diff --git a/drivers/soundwire/Makefile b/drivers/soundwire/Makefile
+index 5817beaca0e1..1e2c00163142 100644
+--- a/drivers/soundwire/Makefile
++++ b/drivers/soundwire/Makefile
+@@ -4,7 +4,7 @@
+
+ #Bus Objs
+ soundwire-bus-objs := bus_type.o bus.o slave.o mipi_disco.o stream.o
+-obj-$(CONFIG_SOUNDWIRE_BUS) += soundwire-bus.o
++obj-$(CONFIG_SOUNDWIRE) += soundwire-bus.o
+
+ #Cadence Objs
+ soundwire-cadence-objs := cadence_master.o
+diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
+index a6e2581ada70..29bc99c4a7b6 100644
+--- a/drivers/soundwire/intel.c
++++ b/drivers/soundwire/intel.c
+@@ -282,6 +282,16 @@ intel_pdi_get_ch_cap(struct sdw_intel *sdw, unsigned int pdi_num, bool pcm)
+
+ if (pcm) {
+ count = intel_readw(shim, SDW_SHIM_PCMSYCHC(link_id, pdi_num));
++
++ /*
++ * WORKAROUND: on all existing Intel controllers, pdi
++ * number 2 reports channel count as 1 even though it
++ * supports 8 channels. Performing hardcoding for pdi
++ * number 2.
++ */
++ if (pdi_num == 2)
++ count = 7;
++
+ } else {
+ count = intel_readw(shim, SDW_SHIM_PDMSCAP(link_id));
+ count = ((count & SDW_SHIM_PDMSCAP_CPSS) >>
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 6cf00d9f512b..a92c2868d902 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -373,11 +373,20 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev)
+ pci_write_config_word(pdev, PCI_COMMAND, PCI_COMMAND_INTX_DISABLE);
+
+ /*
+- * Try to reset the device. The success of this is dependent on
+- * being able to lock the device, which is not always possible.
++ * Try to get the locks ourselves to prevent a deadlock. The
++ * success of this is dependent on being able to lock the device,
++ * which is not always possible.
++ * We can not use the "try" reset interface here, which will
++ * overwrite the previously restored configuration information.
+ */
+- if (vdev->reset_works && !pci_try_reset_function(pdev))
+- vdev->needs_reset = false;
++ if (vdev->reset_works && pci_cfg_access_trylock(pdev)) {
++ if (device_trylock(&pdev->dev)) {
++ if (!__pci_reset_function_locked(pdev))
++ vdev->needs_reset = false;
++ device_unlock(&pdev->dev);
++ }
++ pci_cfg_access_unlock(pdev);
++ }
+
+ pci_restore_state(pdev);
+ out:
+diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
+index 6439231f2db2..da565f39c9b0 100644
+--- a/drivers/video/fbdev/ssd1307fb.c
++++ b/drivers/video/fbdev/ssd1307fb.c
+@@ -433,7 +433,7 @@ static int ssd1307fb_init(struct ssd1307fb_par *par)
+ if (ret < 0)
+ return ret;
+
+- ret = ssd1307fb_write_cmd(par->client, 0x0);
++ ret = ssd1307fb_write_cmd(par->client, par->page_offset);
+ if (ret < 0)
+ return ret;
+
+diff --git a/fs/9p/cache.c b/fs/9p/cache.c
+index 9eb34701a566..a43a8d2436db 100644
+--- a/fs/9p/cache.c
++++ b/fs/9p/cache.c
+@@ -66,6 +66,8 @@ void v9fs_cache_session_get_cookie(struct v9fs_session_info *v9ses)
+ if (!v9ses->cachetag) {
+ if (v9fs_random_cachetag(v9ses) < 0) {
+ v9ses->fscache = NULL;
++ kfree(v9ses->cachetag);
++ v9ses->cachetag = NULL;
+ return;
+ }
+ }
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index e8e27cdc2f67..7edc8172c53a 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -38,6 +38,7 @@ int __init ext4_init_system_zone(void)
+
+ void ext4_exit_system_zone(void)
+ {
++ rcu_barrier();
+ kmem_cache_destroy(ext4_system_zone_cachep);
+ }
+
+@@ -49,17 +50,26 @@ static inline int can_merge(struct ext4_system_zone *entry1,
+ return 0;
+ }
+
++static void release_system_zone(struct ext4_system_blocks *system_blks)
++{
++ struct ext4_system_zone *entry, *n;
++
++ rbtree_postorder_for_each_entry_safe(entry, n,
++ &system_blks->root, node)
++ kmem_cache_free(ext4_system_zone_cachep, entry);
++}
++
+ /*
+ * Mark a range of blocks as belonging to the "system zone" --- that
+ * is, filesystem metadata blocks which should never be used by
+ * inodes.
+ */
+-static int add_system_zone(struct ext4_sb_info *sbi,
++static int add_system_zone(struct ext4_system_blocks *system_blks,
+ ext4_fsblk_t start_blk,
+ unsigned int count)
+ {
+ struct ext4_system_zone *new_entry = NULL, *entry;
+- struct rb_node **n = &sbi->system_blks.rb_node, *node;
++ struct rb_node **n = &system_blks->root.rb_node, *node;
+ struct rb_node *parent = NULL, *new_node = NULL;
+
+ while (*n) {
+@@ -91,7 +101,7 @@ static int add_system_zone(struct ext4_sb_info *sbi,
+ new_node = &new_entry->node;
+
+ rb_link_node(new_node, parent, n);
+- rb_insert_color(new_node, &sbi->system_blks);
++ rb_insert_color(new_node, &system_blks->root);
+ }
+
+ /* Can we merge to the left? */
+@@ -101,7 +111,7 @@ static int add_system_zone(struct ext4_sb_info *sbi,
+ if (can_merge(entry, new_entry)) {
+ new_entry->start_blk = entry->start_blk;
+ new_entry->count += entry->count;
+- rb_erase(node, &sbi->system_blks);
++ rb_erase(node, &system_blks->root);
+ kmem_cache_free(ext4_system_zone_cachep, entry);
+ }
+ }
+@@ -112,7 +122,7 @@ static int add_system_zone(struct ext4_sb_info *sbi,
+ entry = rb_entry(node, struct ext4_system_zone, node);
+ if (can_merge(new_entry, entry)) {
+ new_entry->count += entry->count;
+- rb_erase(node, &sbi->system_blks);
++ rb_erase(node, &system_blks->root);
+ kmem_cache_free(ext4_system_zone_cachep, entry);
+ }
+ }
+@@ -126,7 +136,7 @@ static void debug_print_tree(struct ext4_sb_info *sbi)
+ int first = 1;
+
+ printk(KERN_INFO "System zones: ");
+- node = rb_first(&sbi->system_blks);
++ node = rb_first(&sbi->system_blks->root);
+ while (node) {
+ entry = rb_entry(node, struct ext4_system_zone, node);
+ printk(KERN_CONT "%s%llu-%llu", first ? "" : ", ",
+@@ -137,7 +147,47 @@ static void debug_print_tree(struct ext4_sb_info *sbi)
+ printk(KERN_CONT "\n");
+ }
+
+-static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
++/*
++ * Returns 1 if the passed-in block region (start_blk,
++ * start_blk+count) is valid; 0 if some part of the block region
++ * overlaps with filesystem metadata blocks.
++ */
++static int ext4_data_block_valid_rcu(struct ext4_sb_info *sbi,
++ struct ext4_system_blocks *system_blks,
++ ext4_fsblk_t start_blk,
++ unsigned int count)
++{
++ struct ext4_system_zone *entry;
++ struct rb_node *n;
++
++ if ((start_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
++ (start_blk + count < start_blk) ||
++ (start_blk + count > ext4_blocks_count(sbi->s_es))) {
++ sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
++ return 0;
++ }
++
++ if (system_blks == NULL)
++ return 1;
++
++ n = system_blks->root.rb_node;
++ while (n) {
++ entry = rb_entry(n, struct ext4_system_zone, node);
++ if (start_blk + count - 1 < entry->start_blk)
++ n = n->rb_left;
++ else if (start_blk >= (entry->start_blk + entry->count))
++ n = n->rb_right;
++ else {
++ sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
++ return 0;
++ }
++ }
++ return 1;
++}
++
++static int ext4_protect_reserved_inode(struct super_block *sb,
++ struct ext4_system_blocks *system_blks,
++ u32 ino)
+ {
+ struct inode *inode;
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+@@ -163,14 +213,15 @@ static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
+ if (n == 0) {
+ i++;
+ } else {
+- if (!ext4_data_block_valid(sbi, map.m_pblk, n)) {
++ if (!ext4_data_block_valid_rcu(sbi, system_blks,
++ map.m_pblk, n)) {
+ ext4_error(sb, "blocks %llu-%llu from inode %u "
+ "overlap system zone", map.m_pblk,
+ map.m_pblk + map.m_len - 1, ino);
+ err = -EFSCORRUPTED;
+ break;
+ }
+- err = add_system_zone(sbi, map.m_pblk, n);
++ err = add_system_zone(system_blks, map.m_pblk, n);
+ if (err < 0)
+ break;
+ i += n;
+@@ -180,93 +231,129 @@ static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
+ return err;
+ }
+
++static void ext4_destroy_system_zone(struct rcu_head *rcu)
++{
++ struct ext4_system_blocks *system_blks;
++
++ system_blks = container_of(rcu, struct ext4_system_blocks, rcu);
++ release_system_zone(system_blks);
++ kfree(system_blks);
++}
++
++/*
++ * Build system zone rbtree which is used for block validity checking.
++ *
++ * The update of system_blks pointer in this function is protected by
++ * sb->s_umount semaphore. However we have to be careful as we can be
++ * racing with ext4_data_block_valid() calls reading system_blks rbtree
++ * protected only by RCU. That's why we first build the rbtree and then
++ * swap it in place.
++ */
+ int ext4_setup_system_zone(struct super_block *sb)
+ {
+ ext4_group_t ngroups = ext4_get_groups_count(sb);
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ struct ext4_system_blocks *system_blks;
+ struct ext4_group_desc *gdp;
+ ext4_group_t i;
+ int flex_size = ext4_flex_bg_size(sbi);
+ int ret;
+
+ if (!test_opt(sb, BLOCK_VALIDITY)) {
+- if (sbi->system_blks.rb_node)
++ if (sbi->system_blks)
+ ext4_release_system_zone(sb);
+ return 0;
+ }
+- if (sbi->system_blks.rb_node)
++ if (sbi->system_blks)
+ return 0;
+
++ system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL);
++ if (!system_blks)
++ return -ENOMEM;
++
+ for (i=0; i < ngroups; i++) {
+ if (ext4_bg_has_super(sb, i) &&
+ ((i < 5) || ((i % flex_size) == 0)))
+- add_system_zone(sbi, ext4_group_first_block_no(sb, i),
++ add_system_zone(system_blks,
++ ext4_group_first_block_no(sb, i),
+ ext4_bg_num_gdb(sb, i) + 1);
+ gdp = ext4_get_group_desc(sb, i, NULL);
+- ret = add_system_zone(sbi, ext4_block_bitmap(sb, gdp), 1);
++ ret = add_system_zone(system_blks,
++ ext4_block_bitmap(sb, gdp), 1);
+ if (ret)
+- return ret;
+- ret = add_system_zone(sbi, ext4_inode_bitmap(sb, gdp), 1);
++ goto err;
++ ret = add_system_zone(system_blks,
++ ext4_inode_bitmap(sb, gdp), 1);
+ if (ret)
+- return ret;
+- ret = add_system_zone(sbi, ext4_inode_table(sb, gdp),
++ goto err;
++ ret = add_system_zone(system_blks,
++ ext4_inode_table(sb, gdp),
+ sbi->s_itb_per_group);
+ if (ret)
+- return ret;
++ goto err;
+ }
+ if (ext4_has_feature_journal(sb) && sbi->s_es->s_journal_inum) {
+- ret = ext4_protect_reserved_inode(sb,
++ ret = ext4_protect_reserved_inode(sb, system_blks,
+ le32_to_cpu(sbi->s_es->s_journal_inum));
+ if (ret)
+- return ret;
++ goto err;
+ }
+
++ /*
++ * System blks rbtree complete, announce it once to prevent racing
++ * with ext4_data_block_valid() accessing the rbtree at the same
++ * time.
++ */
++ rcu_assign_pointer(sbi->system_blks, system_blks);
++
+ if (test_opt(sb, DEBUG))
+ debug_print_tree(sbi);
+ return 0;
++err:
++ release_system_zone(system_blks);
++ kfree(system_blks);
++ return ret;
+ }
+
+-/* Called when the filesystem is unmounted */
++/*
++ * Called when the filesystem is unmounted or when remounting it with
++ * noblock_validity specified.
++ *
++ * The update of system_blks pointer in this function is protected by
++ * sb->s_umount semaphore. However we have to be careful as we can be
++ * racing with ext4_data_block_valid() calls reading system_blks rbtree
++ * protected only by RCU. So we first clear the system_blks pointer and
++ * then free the rbtree only after RCU grace period expires.
++ */
+ void ext4_release_system_zone(struct super_block *sb)
+ {
+- struct ext4_system_zone *entry, *n;
++ struct ext4_system_blocks *system_blks;
+
+- rbtree_postorder_for_each_entry_safe(entry, n,
+- &EXT4_SB(sb)->system_blks, node)
+- kmem_cache_free(ext4_system_zone_cachep, entry);
++ system_blks = rcu_dereference_protected(EXT4_SB(sb)->system_blks,
++ lockdep_is_held(&sb->s_umount));
++ rcu_assign_pointer(EXT4_SB(sb)->system_blks, NULL);
+
+- EXT4_SB(sb)->system_blks = RB_ROOT;
++ if (system_blks)
++ call_rcu(&system_blks->rcu, ext4_destroy_system_zone);
+ }
+
+-/*
+- * Returns 1 if the passed-in block region (start_blk,
+- * start_blk+count) is valid; 0 if some part of the block region
+- * overlaps with filesystem metadata blocks.
+- */
+ int ext4_data_block_valid(struct ext4_sb_info *sbi, ext4_fsblk_t start_blk,
+ unsigned int count)
+ {
+- struct ext4_system_zone *entry;
+- struct rb_node *n = sbi->system_blks.rb_node;
++ struct ext4_system_blocks *system_blks;
++ int ret;
+
+- if ((start_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
+- (start_blk + count < start_blk) ||
+- (start_blk + count > ext4_blocks_count(sbi->s_es))) {
+- sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
+- return 0;
+- }
+- while (n) {
+- entry = rb_entry(n, struct ext4_system_zone, node);
+- if (start_blk + count - 1 < entry->start_blk)
+- n = n->rb_left;
+- else if (start_blk >= (entry->start_blk + entry->count))
+- n = n->rb_right;
+- else {
+- sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
+- return 0;
+- }
+- }
+- return 1;
++ /*
++ * Lock the system zone to prevent it being released concurrently
++ * when doing a remount which inverse current "[no]block_validity"
++ * mount option.
++ */
++ rcu_read_lock();
++ system_blks = rcu_dereference(sbi->system_blks);
++ ret = ext4_data_block_valid_rcu(sbi, system_blks, start_blk,
++ count);
++ rcu_read_unlock();
++ return ret;
+ }
+
+ int ext4_check_blockref(const char *function, unsigned int line,
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 1ee51d3a978a..f8456a423c4e 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -194,6 +194,14 @@ struct ext4_map_blocks {
+ unsigned int m_flags;
+ };
+
++/*
++ * Block validity checking, system zone rbtree.
++ */
++struct ext4_system_blocks {
++ struct rb_root root;
++ struct rcu_head rcu;
++};
++
+ /*
+ * Flags for ext4_io_end->flags
+ */
+@@ -1409,7 +1417,7 @@ struct ext4_sb_info {
+ int s_jquota_fmt; /* Format of quota to use */
+ #endif
+ unsigned int s_want_extra_isize; /* New inodes should reserve # bytes */
+- struct rb_root system_blks;
++ struct ext4_system_blocks __rcu *system_blks;
+
+ #ifdef EXTENTS_STATS
+ /* ext4 extents stats */
+diff --git a/fs/fat/dir.c b/fs/fat/dir.c
+index 7f5f3699fc6c..de60c05c0ca1 100644
+--- a/fs/fat/dir.c
++++ b/fs/fat/dir.c
+@@ -1097,8 +1097,11 @@ static int fat_zeroed_cluster(struct inode *dir, sector_t blknr, int nr_used,
+ err = -ENOMEM;
+ goto error;
+ }
++ /* Avoid race with userspace read via bdev */
++ lock_buffer(bhs[n]);
+ memset(bhs[n]->b_data, 0, sb->s_blocksize);
+ set_buffer_uptodate(bhs[n]);
++ unlock_buffer(bhs[n]);
+ mark_buffer_dirty_inode(bhs[n], dir);
+
+ n++;
+@@ -1155,6 +1158,8 @@ int fat_alloc_new_dir(struct inode *dir, struct timespec64 *ts)
+ fat_time_unix2fat(sbi, ts, &time, &date, &time_cs);
+
+ de = (struct msdos_dir_entry *)bhs[0]->b_data;
++ /* Avoid race with userspace read via bdev */
++ lock_buffer(bhs[0]);
+ /* filling the new directory slots ("." and ".." entries) */
+ memcpy(de[0].name, MSDOS_DOT, MSDOS_NAME);
+ memcpy(de[1].name, MSDOS_DOTDOT, MSDOS_NAME);
+@@ -1177,6 +1182,7 @@ int fat_alloc_new_dir(struct inode *dir, struct timespec64 *ts)
+ de[0].size = de[1].size = 0;
+ memset(de + 2, 0, sb->s_blocksize - 2 * sizeof(*de));
+ set_buffer_uptodate(bhs[0]);
++ unlock_buffer(bhs[0]);
+ mark_buffer_dirty_inode(bhs[0], dir);
+
+ err = fat_zeroed_cluster(dir, blknr, 1, bhs, MAX_BUF_PER_PAGE);
+@@ -1234,11 +1240,14 @@ static int fat_add_new_entries(struct inode *dir, void *slots, int nr_slots,
+
+ /* fill the directory entry */
+ copy = min(size, sb->s_blocksize);
++ /* Avoid race with userspace read via bdev */
++ lock_buffer(bhs[n]);
+ memcpy(bhs[n]->b_data, slots, copy);
+- slots += copy;
+- size -= copy;
+ set_buffer_uptodate(bhs[n]);
++ unlock_buffer(bhs[n]);
+ mark_buffer_dirty_inode(bhs[n], dir);
++ slots += copy;
++ size -= copy;
+ if (!size)
+ break;
+ n++;
+diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
+index f58c0cacc531..4c6c635bc8aa 100644
+--- a/fs/fat/fatent.c
++++ b/fs/fat/fatent.c
+@@ -390,8 +390,11 @@ static int fat_mirror_bhs(struct super_block *sb, struct buffer_head **bhs,
+ err = -ENOMEM;
+ goto error;
+ }
++ /* Avoid race with userspace read via bdev */
++ lock_buffer(c_bh);
+ memcpy(c_bh->b_data, bhs[n]->b_data, sb->s_blocksize);
+ set_buffer_uptodate(c_bh);
++ unlock_buffer(c_bh);
+ mark_buffer_dirty_inode(c_bh, sbi->fat_inode);
+ if (sb->s_flags & SB_SYNCHRONOUS)
+ err = sync_dirty_buffer(c_bh);
+diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
+index 63d701cd1e2e..c8e9b7031d9a 100644
+--- a/fs/ocfs2/dlm/dlmunlock.c
++++ b/fs/ocfs2/dlm/dlmunlock.c
+@@ -105,7 +105,8 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
+ enum dlm_status status;
+ int actions = 0;
+ int in_use;
+- u8 owner;
++ u8 owner;
++ int recovery_wait = 0;
+
+ mlog(0, "master_node = %d, valblk = %d\n", master_node,
+ flags & LKM_VALBLK);
+@@ -208,9 +209,12 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
+ }
+ if (flags & LKM_CANCEL)
+ lock->cancel_pending = 0;
+- else
+- lock->unlock_pending = 0;
+-
++ else {
++ if (!lock->unlock_pending)
++ recovery_wait = 1;
++ else
++ lock->unlock_pending = 0;
++ }
+ }
+
+ /* get an extra ref on lock. if we are just switching
+@@ -244,6 +248,17 @@ leave:
+ spin_unlock(&res->spinlock);
+ wake_up(&res->wq);
+
++ if (recovery_wait) {
++ spin_lock(&res->spinlock);
++ /* Unlock request will directly succeed after owner dies,
++ * and the lock is already removed from grant list. We have to
++ * wait for RECOVERING done or we miss the chance to purge it
++ * since the removement is much faster than RECOVERING proc.
++ */
++ __dlm_wait_on_lockres_flags(res, DLM_LOCK_RES_RECOVERING);
++ spin_unlock(&res->spinlock);
++ }
++
+ /* let the caller's final dlm_lock_put handle the actual kfree */
+ if (actions & DLM_UNLOCK_FREE_LOCK) {
+ /* this should always be coupled with list removal */
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 316c16463b20..015d74ee31a0 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -162,6 +162,7 @@ static int ramoops_read_kmsg_hdr(char *buffer, struct timespec64 *time,
+ if (sscanf(buffer, RAMOOPS_KERNMSG_HDR "%lld.%lu-%c\n%n",
+ (time64_t *)&time->tv_sec, &time->tv_nsec, &data_type,
+ &header_length) == 3) {
++ time->tv_nsec *= 1000;
+ if (data_type == 'C')
+ *compressed = true;
+ else
+@@ -169,6 +170,7 @@ static int ramoops_read_kmsg_hdr(char *buffer, struct timespec64 *time,
+ } else if (sscanf(buffer, RAMOOPS_KERNMSG_HDR "%lld.%lu\n%n",
+ (time64_t *)&time->tv_sec, &time->tv_nsec,
+ &header_length) == 2) {
++ time->tv_nsec *= 1000;
+ *compressed = false;
+ } else {
+ time->tv_sec = 0;
+diff --git a/include/scsi/scsi_dbg.h b/include/scsi/scsi_dbg.h
+index e03bd9d41fa8..7b196d234626 100644
+--- a/include/scsi/scsi_dbg.h
++++ b/include/scsi/scsi_dbg.h
+@@ -6,8 +6,6 @@ struct scsi_cmnd;
+ struct scsi_device;
+ struct scsi_sense_hdr;
+
+-#define SCSI_LOG_BUFSIZE 128
+-
+ extern void scsi_print_command(struct scsi_cmnd *);
+ extern size_t __scsi_format_command(char *, size_t,
+ const unsigned char *, size_t);
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index 815dcfa64743..0fe169c6afd8 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -1073,7 +1073,7 @@ TRACE_EVENT(rxrpc_recvmsg,
+ ),
+
+ TP_fast_assign(
+- __entry->call = call->debug_id;
++ __entry->call = call ? call->debug_id : 0;
+ __entry->why = why;
+ __entry->seq = seq;
+ __entry->offset = offset;
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 118e3a8fc764..6e544e364821 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1454,19 +1454,25 @@ static int bpf_prog_load(union bpf_attr *attr)
+ if (err)
+ goto free_used_maps;
+
++ /* Upon success of bpf_prog_alloc_id(), the BPF prog is
++ * effectively publicly exposed. However, retrieving via
++ * bpf_prog_get_fd_by_id() will take another reference,
++ * therefore it cannot be gone underneath us.
++ *
++ * Only for the time /after/ successful bpf_prog_new_fd()
++ * and before returning to userspace, we might just hold
++ * one reference and any parallel close on that fd could
++ * rip everything out. Hence, below notifications must
++ * happen before bpf_prog_new_fd().
++ *
++ * Also, any failure handling from this point onwards must
++ * be using bpf_prog_put() given the program is exposed.
++ */
++ bpf_prog_kallsyms_add(prog);
++
+ err = bpf_prog_new_fd(prog);
+- if (err < 0) {
+- /* failed to allocate fd.
+- * bpf_prog_put() is needed because the above
+- * bpf_prog_alloc_id() has published the prog
+- * to the userspace and the userspace may
+- * have refcnt-ed it through BPF_PROG_GET_FD_BY_ID.
+- */
++ if (err < 0)
+ bpf_prog_put(prog);
+- return err;
+- }
+-
+- bpf_prog_kallsyms_add(prog);
+ return err;
+
+ free_used_maps:
+diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
+index 23a83a4da38a..f50b90d0d1c2 100644
+--- a/kernel/kexec_core.c
++++ b/kernel/kexec_core.c
+@@ -301,6 +301,8 @@ static struct page *kimage_alloc_pages(gfp_t gfp_mask, unsigned int order)
+ {
+ struct page *pages;
+
++ if (fatal_signal_pending(current))
++ return NULL;
+ pages = alloc_pages(gfp_mask & ~__GFP_ZERO, order);
+ if (pages) {
+ unsigned int count, i;
+diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
+index 722c27c40e5b..a1250ad591c1 100644
+--- a/kernel/livepatch/core.c
++++ b/kernel/livepatch/core.c
+@@ -1027,6 +1027,7 @@ err:
+ pr_warn("patch '%s' failed for module '%s', refusing to load module '%s'\n",
+ patch->mod->name, obj->mod->name, obj->mod->name);
+ mod->klp_alive = false;
++ obj->mod = NULL;
+ klp_cleanup_module_patches_limited(mod, patch);
+ mutex_unlock(&klp_mutex);
+
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 3dea52f7be9c..46a910acce3f 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -570,7 +570,7 @@ config DEBUG_KMEMLEAK_EARLY_LOG_SIZE
+ int "Maximum kmemleak early log entries"
+ depends on DEBUG_KMEMLEAK
+ range 200 40000
+- default 400
++ default 16000
+ help
+ Kmemleak must track all the memory allocations to avoid
+ reporting false positives. Since memory may be allocated or
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 9c32e8eb64da..f881eea1c4a4 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1563,8 +1563,6 @@ static void __sk_destruct(struct rcu_head *head)
+ sk_filter_uncharge(sk, filter);
+ RCU_INIT_POINTER(sk->sk_filter, NULL);
+ }
+- if (rcu_access_pointer(sk->sk_reuseport_cb))
+- reuseport_detach_sock(sk);
+
+ sock_disable_timestamp(sk, SK_FLAGS_TIMESTAMP);
+
+@@ -1587,7 +1585,14 @@ static void __sk_destruct(struct rcu_head *head)
+
+ void sk_destruct(struct sock *sk)
+ {
+- if (sock_flag(sk, SOCK_RCU_FREE))
++ bool use_call_rcu = sock_flag(sk, SOCK_RCU_FREE);
++
++ if (rcu_access_pointer(sk->sk_reuseport_cb)) {
++ reuseport_detach_sock(sk);
++ use_call_rcu = true;
++ }
++
++ if (use_call_rcu)
+ call_rcu(&sk->sk_rcu, __sk_destruct);
+ else
+ __sk_destruct(&sk->sk_rcu);
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 3c734832bb7c..0b87558f265e 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -1531,6 +1531,7 @@ static void erspan_setup(struct net_device *dev)
+ struct ip_tunnel *t = netdev_priv(dev);
+
+ ether_setup(dev);
++ dev->max_mtu = 0;
+ dev->netdev_ops = &erspan_netdev_ops;
+ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 232581c140a0..7065d68086ab 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -908,16 +908,15 @@ void ip_rt_send_redirect(struct sk_buff *skb)
+ if (peer->rate_tokens == 0 ||
+ time_after(jiffies,
+ (peer->rate_last +
+- (ip_rt_redirect_load << peer->rate_tokens)))) {
++ (ip_rt_redirect_load << peer->n_redirects)))) {
+ __be32 gw = rt_nexthop(rt, ip_hdr(skb)->daddr);
+
+ icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
+ peer->rate_last = jiffies;
+- ++peer->rate_tokens;
+ ++peer->n_redirects;
+ #ifdef CONFIG_IP_ROUTE_VERBOSE
+ if (log_martians &&
+- peer->rate_tokens == ip_rt_redirect_number)
++ peer->n_redirects == ip_rt_redirect_number)
+ net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
+ &ip_hdr(skb)->saddr, inet_iif(skb),
+ &ip_hdr(skb)->daddr, &gw);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 2085fc0046de..aa59acc8ee0e 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -775,6 +775,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
+ int is_udplite = IS_UDPLITE(sk);
+ int offset = skb_transport_offset(skb);
+ int len = skb->len - offset;
++ int datalen = len - sizeof(*uh);
+ __wsum csum = 0;
+
+ /*
+@@ -808,10 +809,12 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
+ return -EIO;
+ }
+
+- skb_shinfo(skb)->gso_size = cork->gso_size;
+- skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
+- skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(len - sizeof(uh),
+- cork->gso_size);
++ if (datalen > cork->gso_size) {
++ skb_shinfo(skb)->gso_size = cork->gso_size;
++ skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
++ skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(datalen,
++ cork->gso_size);
++ }
+ goto csum_partial;
+ }
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 49e2f6dac646..d2968a79abea 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -5678,13 +5678,20 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
+ switch (event) {
+ case RTM_NEWADDR:
+ /*
+- * If the address was optimistic
+- * we inserted the route at the start of
+- * our DAD process, so we don't need
+- * to do it again
++ * If the address was optimistic we inserted the route at the
++ * start of our DAD process, so we don't need to do it again.
++ * If the device was taken down in the middle of the DAD
++ * cycle there is a race where we could get here without a
++ * host route, so nothing to insert. That will be fixed when
++ * the device is brought up.
+ */
+- if (!rcu_access_pointer(ifp->rt->fib6_node))
++ if (ifp->rt && !rcu_access_pointer(ifp->rt->fib6_node)) {
+ ip6_ins_rt(net, ifp->rt);
++ } else if (!ifp->rt && (ifp->idev->dev->flags & IFF_UP)) {
++ pr_warn("BUG: Address %pI6c on device %s is missing its host route.\n",
++ &ifp->addr, ifp->idev->dev->name);
++ }
++
+ if (ifp->idev->cnf.forwarding)
+ addrconf_join_anycast(ifp);
+ if (!ipv6_addr_any(&ifp->peer_addr))
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index 6b74523fc1c4..2b6d43022383 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -220,6 +220,16 @@ static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev,
+ if (ipv6_addr_is_multicast(&hdr->saddr))
+ goto err;
+
++ /* While RFC4291 is not explicit about v4mapped addresses
++ * in IPv6 headers, it seems clear linux dual-stack
++ * model can not deal properly with these.
++ * Security models could be fooled by ::ffff:127.0.0.1 for example.
++ *
++ * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02
++ */
++ if (ipv6_addr_v4mapped(&hdr->saddr))
++ goto err;
++
+ skb->transport_header = skb->network_header + sizeof(*hdr);
+ IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
+
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 3a27c04ff62f..d1c59cb6dceb 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1047,6 +1047,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
+ __wsum csum = 0;
+ int offset = skb_transport_offset(skb);
+ int len = skb->len - offset;
++ int datalen = len - sizeof(*uh);
+
+ /*
+ * Create a UDP header
+@@ -1079,8 +1080,12 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
+ return -EIO;
+ }
+
+- skb_shinfo(skb)->gso_size = cork->gso_size;
+- skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
++ if (datalen > cork->gso_size) {
++ skb_shinfo(skb)->gso_size = cork->gso_size;
++ skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
++ skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(datalen,
++ cork->gso_size);
++ }
+ goto csum_partial;
+ }
+
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index ff254e8c0c44..e0a2cb8a029f 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -119,9 +119,14 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
+ llcp_sock->service_name = kmemdup(llcp_addr.service_name,
+ llcp_sock->service_name_len,
+ GFP_KERNEL);
+-
++ if (!llcp_sock->service_name) {
++ ret = -ENOMEM;
++ goto put_dev;
++ }
+ llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
+ if (llcp_sock->ssap == LLCP_SAP_MAX) {
++ kfree(llcp_sock->service_name);
++ llcp_sock->service_name = NULL;
+ ret = -EADDRINUSE;
+ goto put_dev;
+ }
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index 9f2875efb4ac..b3662264aa24 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -981,7 +981,8 @@ static int nfc_genl_dep_link_down(struct sk_buff *skb, struct genl_info *info)
+ int rc;
+ u32 idx;
+
+- if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
++ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
++ !info->attrs[NFC_ATTR_TARGET_INDEX])
+ return -EINVAL;
+
+ idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
+@@ -1029,7 +1030,8 @@ static int nfc_genl_llc_get_params(struct sk_buff *skb, struct genl_info *info)
+ struct sk_buff *msg = NULL;
+ u32 idx;
+
+- if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
++ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
++ !info->attrs[NFC_ATTR_FIRMWARE_NAME])
+ return -EINVAL;
+
+ idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
+diff --git a/net/rds/ib.c b/net/rds/ib.c
+index eba75c1ba359..ba3379085c52 100644
+--- a/net/rds/ib.c
++++ b/net/rds/ib.c
+@@ -143,6 +143,9 @@ static void rds_ib_add_one(struct ib_device *device)
+ refcount_set(&rds_ibdev->refcount, 1);
+ INIT_WORK(&rds_ibdev->free_work, rds_ib_dev_free);
+
++ INIT_LIST_HEAD(&rds_ibdev->ipaddr_list);
++ INIT_LIST_HEAD(&rds_ibdev->conn_list);
++
+ rds_ibdev->max_wrs = device->attrs.max_qp_wr;
+ rds_ibdev->max_sge = min(device->attrs.max_send_sge, RDS_IB_MAX_SGE);
+
+@@ -203,9 +206,6 @@ static void rds_ib_add_one(struct ib_device *device)
+ device->name,
+ rds_ibdev->use_fastreg ? "FRMR" : "FMR");
+
+- INIT_LIST_HEAD(&rds_ibdev->ipaddr_list);
+- INIT_LIST_HEAD(&rds_ibdev->conn_list);
+-
+ down_write(&rds_ib_devices_lock);
+ list_add_tail_rcu(&rds_ibdev->list, &rds_ib_devices);
+ up_write(&rds_ib_devices_lock);
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index f42025d53cfe..ebc3c8c7e666 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -1132,6 +1132,32 @@ static const struct nla_policy cbq_policy[TCA_CBQ_MAX + 1] = {
+ [TCA_CBQ_POLICE] = { .len = sizeof(struct tc_cbq_police) },
+ };
+
++static int cbq_opt_parse(struct nlattr *tb[TCA_CBQ_MAX + 1],
++ struct nlattr *opt,
++ struct netlink_ext_ack *extack)
++{
++ int err;
++
++ if (!opt) {
++ NL_SET_ERR_MSG(extack, "CBQ options are required for this operation");
++ return -EINVAL;
++ }
++
++ err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy, extack);
++ if (err < 0)
++ return err;
++
++ if (tb[TCA_CBQ_WRROPT]) {
++ const struct tc_cbq_wrropt *wrr = nla_data(tb[TCA_CBQ_WRROPT]);
++
++ if (wrr->priority > TC_CBQ_MAXPRIO) {
++ NL_SET_ERR_MSG(extack, "priority is bigger than TC_CBQ_MAXPRIO");
++ err = -EINVAL;
++ }
++ }
++ return err;
++}
++
+ static int cbq_init(struct Qdisc *sch, struct nlattr *opt,
+ struct netlink_ext_ack *extack)
+ {
+@@ -1144,12 +1170,7 @@ static int cbq_init(struct Qdisc *sch, struct nlattr *opt,
+ hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED);
+ q->delay_timer.function = cbq_undelay;
+
+- if (!opt) {
+- NL_SET_ERR_MSG(extack, "CBQ options are required for this operation");
+- return -EINVAL;
+- }
+-
+- err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy, extack);
++ err = cbq_opt_parse(tb, opt, extack);
+ if (err < 0)
+ return err;
+
+@@ -1466,12 +1487,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
+ struct cbq_class *parent;
+ struct qdisc_rate_table *rtab = NULL;
+
+- if (!opt) {
+- NL_SET_ERR_MSG(extack, "Mandatory qdisc options missing");
+- return -EINVAL;
+- }
+-
+- err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy, extack);
++ err = cbq_opt_parse(tb, opt, extack);
+ if (err < 0)
+ return err;
+
+diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
+index 049714c57075..84c948c91914 100644
+--- a/net/sched/sch_dsmark.c
++++ b/net/sched/sch_dsmark.c
+@@ -357,6 +357,8 @@ static int dsmark_init(struct Qdisc *sch, struct nlattr *opt,
+ goto errout;
+
+ err = -EINVAL;
++ if (!tb[TCA_DSMARK_INDICES])
++ goto errout;
+ indices = nla_get_u16(tb[TCA_DSMARK_INDICES]);
+
+ if (hweight32(indices) != 1)
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 836727e363c4..6344aca4487b 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -161,6 +161,7 @@ struct tipc_link {
+ struct {
+ u16 len;
+ u16 limit;
++ struct sk_buff *target_bskb;
+ } backlog[5];
+ u16 snd_nxt;
+ u16 last_retransm;
+@@ -846,6 +847,7 @@ static void link_prepare_wakeup(struct tipc_link *l)
+ void tipc_link_reset(struct tipc_link *l)
+ {
+ struct sk_buff_head list;
++ u32 imp;
+
+ __skb_queue_head_init(&list);
+
+@@ -864,11 +866,10 @@ void tipc_link_reset(struct tipc_link *l)
+ __skb_queue_purge(&l->transmq);
+ __skb_queue_purge(&l->deferdq);
+ __skb_queue_purge(&l->backlogq);
+- l->backlog[TIPC_LOW_IMPORTANCE].len = 0;
+- l->backlog[TIPC_MEDIUM_IMPORTANCE].len = 0;
+- l->backlog[TIPC_HIGH_IMPORTANCE].len = 0;
+- l->backlog[TIPC_CRITICAL_IMPORTANCE].len = 0;
+- l->backlog[TIPC_SYSTEM_IMPORTANCE].len = 0;
++ for (imp = 0; imp <= TIPC_SYSTEM_IMPORTANCE; imp++) {
++ l->backlog[imp].len = 0;
++ l->backlog[imp].target_bskb = NULL;
++ }
+ kfree_skb(l->reasm_buf);
+ kfree_skb(l->failover_reasm_skb);
+ l->reasm_buf = NULL;
+@@ -909,7 +910,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
+ u16 bc_ack = l->bc_rcvlink->rcv_nxt - 1;
+ struct sk_buff_head *transmq = &l->transmq;
+ struct sk_buff_head *backlogq = &l->backlogq;
+- struct sk_buff *skb, *_skb, *bskb;
++ struct sk_buff *skb, *_skb, **tskb;
+ int pkt_cnt = skb_queue_len(list);
+ int rc = 0;
+
+@@ -955,19 +956,21 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
+ seqno++;
+ continue;
+ }
+- if (tipc_msg_bundle(skb_peek_tail(backlogq), hdr, mtu)) {
++ tskb = &l->backlog[imp].target_bskb;
++ if (tipc_msg_bundle(*tskb, hdr, mtu)) {
+ kfree_skb(__skb_dequeue(list));
+ l->stats.sent_bundled++;
+ continue;
+ }
+- if (tipc_msg_make_bundle(&bskb, hdr, mtu, l->addr)) {
++ if (tipc_msg_make_bundle(tskb, hdr, mtu, l->addr)) {
+ kfree_skb(__skb_dequeue(list));
+- __skb_queue_tail(backlogq, bskb);
+- l->backlog[msg_importance(buf_msg(bskb))].len++;
++ __skb_queue_tail(backlogq, *tskb);
++ l->backlog[imp].len++;
+ l->stats.sent_bundled++;
+ l->stats.sent_bundles++;
+ continue;
+ }
++ l->backlog[imp].target_bskb = NULL;
+ l->backlog[imp].len += skb_queue_len(list);
+ skb_queue_splice_tail_init(list, backlogq);
+ }
+@@ -983,6 +986,7 @@ static void tipc_link_advance_backlog(struct tipc_link *l,
+ u16 seqno = l->snd_nxt;
+ u16 ack = l->rcv_nxt - 1;
+ u16 bc_ack = l->bc_rcvlink->rcv_nxt - 1;
++ u32 imp;
+
+ while (skb_queue_len(&l->transmq) < l->window) {
+ skb = skb_peek(&l->backlogq);
+@@ -993,7 +997,10 @@ static void tipc_link_advance_backlog(struct tipc_link *l,
+ break;
+ __skb_dequeue(&l->backlogq);
+ hdr = buf_msg(skb);
+- l->backlog[msg_importance(hdr)].len--;
++ imp = msg_importance(hdr);
++ l->backlog[imp].len--;
++ if (unlikely(skb == l->backlog[imp].target_bskb))
++ l->backlog[imp].target_bskb = NULL;
+ __skb_queue_tail(&l->transmq, skb);
+ __skb_queue_tail(xmitq, _skb);
+ TIPC_SKB_CB(skb)->ackers = l->ackers;
+diff --git a/net/tipc/msg.c b/net/tipc/msg.c
+index b61891054709..cbccf1791d3c 100644
+--- a/net/tipc/msg.c
++++ b/net/tipc/msg.c
+@@ -484,10 +484,7 @@ bool tipc_msg_make_bundle(struct sk_buff **skb, struct tipc_msg *msg,
+ bmsg = buf_msg(_skb);
+ tipc_msg_init(msg_prevnode(msg), bmsg, MSG_BUNDLER, 0,
+ INT_H_SIZE, dnode);
+- if (msg_isdata(msg))
+- msg_set_importance(bmsg, TIPC_CRITICAL_IMPORTANCE);
+- else
+- msg_set_importance(bmsg, TIPC_SYSTEM_IMPORTANCE);
++ msg_set_importance(bmsg, msg_importance(msg));
+ msg_set_seqno(bmsg, msg_seqno(msg));
+ msg_set_ack(bmsg, msg_ack(msg));
+ msg_set_bcast_ack(bmsg, msg_bcast_ack(msg));
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 2e30bf197583..2a4613b239e0 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -641,7 +641,7 @@ struct sock *__vsock_create(struct net *net,
+ }
+ EXPORT_SYMBOL_GPL(__vsock_create);
+
+-static void __vsock_release(struct sock *sk)
++static void __vsock_release(struct sock *sk, int level)
+ {
+ if (sk) {
+ struct sk_buff *skb;
+@@ -651,9 +651,17 @@ static void __vsock_release(struct sock *sk)
+ vsk = vsock_sk(sk);
+ pending = NULL; /* Compiler warning. */
+
++ /* The release call is supposed to use lock_sock_nested()
++ * rather than lock_sock(), if a sock lock should be acquired.
++ */
+ transport->release(vsk);
+
+- lock_sock(sk);
++ /* When "level" is SINGLE_DEPTH_NESTING, use the nested
++ * version to avoid the warning "possible recursive locking
++ * detected". When "level" is 0, lock_sock_nested(sk, level)
++ * is the same as lock_sock(sk).
++ */
++ lock_sock_nested(sk, level);
+ sock_orphan(sk);
+ sk->sk_shutdown = SHUTDOWN_MASK;
+
+@@ -662,7 +670,7 @@ static void __vsock_release(struct sock *sk)
+
+ /* Clean up any sockets that never were accepted. */
+ while ((pending = vsock_dequeue_accept(sk)) != NULL) {
+- __vsock_release(pending);
++ __vsock_release(pending, SINGLE_DEPTH_NESTING);
+ sock_put(pending);
+ }
+
+@@ -711,7 +719,7 @@ EXPORT_SYMBOL_GPL(vsock_stream_has_space);
+
+ static int vsock_release(struct socket *sock)
+ {
+- __vsock_release(sock->sk);
++ __vsock_release(sock->sk, 0);
+ sock->sk = NULL;
+ sock->state = SS_FREE;
+
+diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
+index 98f193fd5315..70350dc67366 100644
+--- a/net/vmw_vsock/hyperv_transport.c
++++ b/net/vmw_vsock/hyperv_transport.c
+@@ -538,7 +538,7 @@ static void hvs_release(struct vsock_sock *vsk)
+ struct sock *sk = sk_vsock(vsk);
+ bool remove_sock;
+
+- lock_sock(sk);
++ lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+ remove_sock = hvs_close_lock_held(vsk);
+ release_sock(sk);
+ if (remove_sock)
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index e30f53728725..3c199f752fd3 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -791,7 +791,7 @@ void virtio_transport_release(struct vsock_sock *vsk)
+ struct sock *sk = &vsk->sk;
+ bool remove_sock = true;
+
+- lock_sock(sk);
++ lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+ if (sk->sk_type == SOCK_STREAM)
+ remove_sock = virtio_transport_close(vsk);
+
+diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
+index 9a4c0ad46518..c071c356a963 100644
+--- a/security/smack/smack_access.c
++++ b/security/smack/smack_access.c
+@@ -469,7 +469,7 @@ char *smk_parse_smack(const char *string, int len)
+ if (i == 0 || i >= SMK_LONGLABEL)
+ return ERR_PTR(-EINVAL);
+
+- smack = kzalloc(i + 1, GFP_KERNEL);
++ smack = kzalloc(i + 1, GFP_NOFS);
+ if (smack == NULL)
+ return ERR_PTR(-ENOMEM);
+
+@@ -504,7 +504,7 @@ int smk_netlbl_mls(int level, char *catset, struct netlbl_lsm_secattr *sap,
+ if ((m & *cp) == 0)
+ continue;
+ rc = netlbl_catmap_setbit(&sap->attr.mls.cat,
+- cat, GFP_KERNEL);
++ cat, GFP_NOFS);
+ if (rc < 0) {
+ netlbl_catmap_free(sap->attr.mls.cat);
+ return rc;
+@@ -540,7 +540,7 @@ struct smack_known *smk_import_entry(const char *string, int len)
+ if (skp != NULL)
+ goto freeout;
+
+- skp = kzalloc(sizeof(*skp), GFP_KERNEL);
++ skp = kzalloc(sizeof(*skp), GFP_NOFS);
+ if (skp == NULL) {
+ skp = ERR_PTR(-ENOMEM);
+ goto freeout;
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 017c47eb795e..221de4c755c3 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -270,7 +270,7 @@ static struct smack_known *smk_fetch(const char *name, struct inode *ip,
+ if (!(ip->i_opflags & IOP_XATTR))
+ return ERR_PTR(-EOPNOTSUPP);
+
+- buffer = kzalloc(SMK_LONGLABEL, GFP_KERNEL);
++ buffer = kzalloc(SMK_LONGLABEL, GFP_NOFS);
+ if (buffer == NULL)
+ return ERR_PTR(-ENOMEM);
+
+@@ -947,7 +947,8 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm)
+
+ if (rc != 0)
+ return rc;
+- } else if (bprm->unsafe)
++ }
++ if (bprm->unsafe & ~LSM_UNSAFE_PTRACE)
+ return -EPERM;
+
+ bsp->smk_task = isp->smk_task;
+@@ -4005,6 +4006,8 @@ access_check:
+ skp = smack_ipv6host_label(&sadd);
+ if (skp == NULL)
+ skp = smack_net_ambient;
++ if (skb == NULL)
++ break;
+ #ifdef CONFIG_AUDIT
+ smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+ ad.a.u.net->family = family;
+diff --git a/tools/testing/selftests/net/udpgso.c b/tools/testing/selftests/net/udpgso.c
+index e279051bc631..270c17ab071e 100644
+--- a/tools/testing/selftests/net/udpgso.c
++++ b/tools/testing/selftests/net/udpgso.c
+@@ -90,12 +90,9 @@ struct testcase testcases_v4[] = {
+ .tfail = true,
+ },
+ {
+- /* send a single MSS: will fail with GSO, because the segment
+- * logic in udp4_ufo_fragment demands a gso skb to be > MTU
+- */
++ /* send a single MSS: will fall back to no GSO */
+ .tlen = CONST_MSS_V4,
+ .gso_len = CONST_MSS_V4,
+- .tfail = true,
+ .r_num_mss = 1,
+ },
+ {
+@@ -140,10 +137,9 @@ struct testcase testcases_v4[] = {
+ .tfail = true,
+ },
+ {
+- /* send a single 1B MSS: will fail, see single MSS above */
++ /* send a single 1B MSS: will fall back to no GSO */
+ .tlen = 1,
+ .gso_len = 1,
+- .tfail = true,
+ .r_num_mss = 1,
+ },
+ {
+@@ -197,12 +193,9 @@ struct testcase testcases_v6[] = {
+ .tfail = true,
+ },
+ {
+- /* send a single MSS: will fail with GSO, because the segment
+- * logic in udp4_ufo_fragment demands a gso skb to be > MTU
+- */
++ /* send a single MSS: will fall back to no GSO */
+ .tlen = CONST_MSS_V6,
+ .gso_len = CONST_MSS_V6,
+- .tfail = true,
+ .r_num_mss = 1,
+ },
+ {
+@@ -247,10 +240,9 @@ struct testcase testcases_v6[] = {
+ .tfail = true,
+ },
+ {
+- /* send a single 1B MSS: will fail, see single MSS above */
++ /* send a single 1B MSS: will fall back to no GSO */
+ .tlen = 1,
+ .gso_len = 1,
+- .tfail = true,
+ .r_num_mss = 1,
+ },
+ {
+diff --git a/usr/Makefile b/usr/Makefile
+index 748f6a60bb1e..138c18cefb52 100644
+--- a/usr/Makefile
++++ b/usr/Makefile
+@@ -11,6 +11,9 @@ datafile_y = initramfs_data.cpio$(suffix_y)
+ datafile_d_y = .$(datafile_y).d
+ AFLAGS_initramfs_data.o += -DINITRAMFS_IMAGE="usr/$(datafile_y)"
+
++# clean rules do not have CONFIG_INITRAMFS_COMPRESSION. So clean up after all
++# possible compression formats.
++clean-files += initramfs_data.cpio*
+
+ # Generate builtin.o based on initramfs_data.o
+ obj-$(CONFIG_BLK_DEV_INITRD) := initramfs_data.o
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-10-11 17:04 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-10-11 17:04 UTC (permalink / raw
To: gentoo-commits
commit: 18c77bab22d8887efd5b3439655f1b258b7aafce
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 11 17:04:36 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Oct 11 17:04:36 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=18c77bab
Linux patch 4.19.79
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1078_linux-4.19.79.patch | 4369 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4373 insertions(+)
diff --git a/0000_README b/0000_README
index 021985c..e1f1ada 100644
--- a/0000_README
+++ b/0000_README
@@ -351,6 +351,10 @@ Patch: 1077_linux-4.19.78.patch
From: https://www.kernel.org
Desc: Linux 4.19.78
+Patch: 1078_linux-4.19.79.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.79
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1078_linux-4.19.79.patch b/1078_linux-4.19.79.patch
new file mode 100644
index 0000000..46d1d23
--- /dev/null
+++ b/1078_linux-4.19.79.patch
@@ -0,0 +1,4369 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index e8ddf0ef232e..16607b178b47 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2503,8 +2503,8 @@
+ http://repo.or.cz/w/linux-2.6/mini2440.git
+
+ mitigations=
+- [X86,PPC,S390] Control optional mitigations for CPU
+- vulnerabilities. This is a set of curated,
++ [X86,PPC,S390,ARM64] Control optional mitigations for
++ CPU vulnerabilities. This is a set of curated,
+ arch-independent options, each of which is an
+ aggregation of existing arch-specific options.
+
+@@ -2513,12 +2513,14 @@
+ improves system performance, but it may also
+ expose users to several CPU vulnerabilities.
+ Equivalent to: nopti [X86,PPC]
++ kpti=0 [ARM64]
+ nospectre_v1 [PPC]
+ nobp=0 [S390]
+ nospectre_v1 [X86]
+- nospectre_v2 [X86,PPC,S390]
++ nospectre_v2 [X86,PPC,S390,ARM64]
+ spectre_v2_user=off [X86]
+ spec_store_bypass_disable=off [X86,PPC]
++ ssbd=force-off [ARM64]
+ l1tf=off [X86]
+ mds=off [X86]
+
+@@ -2866,10 +2868,10 @@
+ (bounds check bypass). With this option data leaks
+ are possible in the system.
+
+- nospectre_v2 [X86,PPC_FSL_BOOK3E] Disable all mitigations for the Spectre variant 2
+- (indirect branch prediction) vulnerability. System may
+- allow data leaks with this option, which is equivalent
+- to spectre_v2=off.
++ nospectre_v2 [X86,PPC_FSL_BOOK3E,ARM64] Disable all mitigations for
++ the Spectre variant 2 (indirect branch prediction)
++ vulnerability. System may allow data leaks with this
++ option.
+
+ nospec_store_bypass_disable
+ [HW] Disable all mitigations for the Speculative Store Bypass vulnerability
+diff --git a/Documentation/arm64/elf_hwcaps.txt b/Documentation/arm64/elf_hwcaps.txt
+index d6aff2c5e9e2..6feaffe90e22 100644
+--- a/Documentation/arm64/elf_hwcaps.txt
++++ b/Documentation/arm64/elf_hwcaps.txt
+@@ -178,3 +178,7 @@ HWCAP_ILRCPC
+ HWCAP_FLAGM
+
+ Functionality implied by ID_AA64ISAR0_EL1.TS == 0b0001.
++
++HWCAP_SSBS
++
++ Functionality implied by ID_AA64PFR1_EL1.SSBS == 0b0010.
+diff --git a/Makefile b/Makefile
+index 440c5b5c4f4b..4d29c7370b46 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 78
++SUBLEVEL = 79
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index e3ebece79617..51fe21f5d078 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -84,6 +84,7 @@ config ARM64
+ select GENERIC_CLOCKEVENTS
+ select GENERIC_CLOCKEVENTS_BROADCAST
+ select GENERIC_CPU_AUTOPROBE
++ select GENERIC_CPU_VULNERABILITIES
+ select GENERIC_EARLY_IOREMAP
+ select GENERIC_IDLE_POLL_SETUP
+ select GENERIC_IRQ_MULTI_HANDLER
+diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h
+index 25ce9056cf64..c3de0bbf0e9a 100644
+--- a/arch/arm64/include/asm/cpucaps.h
++++ b/arch/arm64/include/asm/cpucaps.h
+@@ -52,7 +52,8 @@
+ #define ARM64_MISMATCHED_CACHE_TYPE 31
+ #define ARM64_HAS_STAGE2_FWB 32
+ #define ARM64_WORKAROUND_1463225 33
++#define ARM64_SSBS 34
+
+-#define ARM64_NCAPS 34
++#define ARM64_NCAPS 35
+
+ #endif /* __ASM_CPUCAPS_H */
+diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
+index 510f687d269a..dda6e5056810 100644
+--- a/arch/arm64/include/asm/cpufeature.h
++++ b/arch/arm64/include/asm/cpufeature.h
+@@ -525,11 +525,7 @@ static inline int arm64_get_ssbd_state(void)
+ #endif
+ }
+
+-#ifdef CONFIG_ARM64_SSBD
+ void arm64_set_ssbd_mitigation(bool state);
+-#else
+-static inline void arm64_set_ssbd_mitigation(bool state) {}
+-#endif
+
+ #endif /* __ASSEMBLY__ */
+
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index 6abe4002945f..367b2e0b6d76 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -398,6 +398,8 @@ struct kvm_vcpu *kvm_mpidr_to_vcpu(struct kvm *kvm, unsigned long mpidr);
+
+ DECLARE_PER_CPU(kvm_cpu_context_t, kvm_host_cpu_state);
+
++void __kvm_enable_ssbs(void);
++
+ static inline void __cpu_init_hyp_mode(phys_addr_t pgd_ptr,
+ unsigned long hyp_stack_ptr,
+ unsigned long vector_ptr)
+@@ -418,6 +420,15 @@ static inline void __cpu_init_hyp_mode(phys_addr_t pgd_ptr,
+ */
+ BUG_ON(!static_branch_likely(&arm64_const_caps_ready));
+ __kvm_call_hyp((void *)pgd_ptr, hyp_stack_ptr, vector_ptr, tpidr_el2);
++
++ /*
++ * Disabling SSBD on a non-VHE system requires us to enable SSBS
++ * at EL2.
++ */
++ if (!has_vhe() && this_cpu_has_cap(ARM64_SSBS) &&
++ arm64_get_ssbd_state() == ARM64_SSBD_FORCE_DISABLE) {
++ kvm_call_hyp(__kvm_enable_ssbs);
++ }
+ }
+
+ static inline bool kvm_arch_check_sve_has_vhe(void)
+diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
+index def5a5e807f0..773ea8e0e442 100644
+--- a/arch/arm64/include/asm/processor.h
++++ b/arch/arm64/include/asm/processor.h
+@@ -177,11 +177,25 @@ static inline void start_thread_common(struct pt_regs *regs, unsigned long pc)
+ regs->pc = pc;
+ }
+
++static inline void set_ssbs_bit(struct pt_regs *regs)
++{
++ regs->pstate |= PSR_SSBS_BIT;
++}
++
++static inline void set_compat_ssbs_bit(struct pt_regs *regs)
++{
++ regs->pstate |= PSR_AA32_SSBS_BIT;
++}
++
+ static inline void start_thread(struct pt_regs *regs, unsigned long pc,
+ unsigned long sp)
+ {
+ start_thread_common(regs, pc);
+ regs->pstate = PSR_MODE_EL0t;
++
++ if (arm64_get_ssbd_state() != ARM64_SSBD_FORCE_ENABLE)
++ set_ssbs_bit(regs);
++
+ regs->sp = sp;
+ }
+
+@@ -198,6 +212,9 @@ static inline void compat_start_thread(struct pt_regs *regs, unsigned long pc,
+ regs->pstate |= PSR_AA32_E_BIT;
+ #endif
+
++ if (arm64_get_ssbd_state() != ARM64_SSBD_FORCE_ENABLE)
++ set_compat_ssbs_bit(regs);
++
+ regs->compat_sp = sp;
+ }
+ #endif
+diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h
+index 177b851ca6d9..6bc43889d11e 100644
+--- a/arch/arm64/include/asm/ptrace.h
++++ b/arch/arm64/include/asm/ptrace.h
+@@ -50,6 +50,7 @@
+ #define PSR_AA32_I_BIT 0x00000080
+ #define PSR_AA32_A_BIT 0x00000100
+ #define PSR_AA32_E_BIT 0x00000200
++#define PSR_AA32_SSBS_BIT 0x00800000
+ #define PSR_AA32_DIT_BIT 0x01000000
+ #define PSR_AA32_Q_BIT 0x08000000
+ #define PSR_AA32_V_BIT 0x10000000
+diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
+index c1470931b897..3091ae5975a3 100644
+--- a/arch/arm64/include/asm/sysreg.h
++++ b/arch/arm64/include/asm/sysreg.h
+@@ -86,11 +86,14 @@
+
+ #define REG_PSTATE_PAN_IMM sys_reg(0, 0, 4, 0, 4)
+ #define REG_PSTATE_UAO_IMM sys_reg(0, 0, 4, 0, 3)
++#define REG_PSTATE_SSBS_IMM sys_reg(0, 3, 4, 0, 1)
+
+ #define SET_PSTATE_PAN(x) __emit_inst(0xd5000000 | REG_PSTATE_PAN_IMM | \
+ (!!x)<<8 | 0x1f)
+ #define SET_PSTATE_UAO(x) __emit_inst(0xd5000000 | REG_PSTATE_UAO_IMM | \
+ (!!x)<<8 | 0x1f)
++#define SET_PSTATE_SSBS(x) __emit_inst(0xd5000000 | REG_PSTATE_SSBS_IMM | \
++ (!!x)<<8 | 0x1f)
+
+ #define SYS_DC_ISW sys_insn(1, 0, 7, 6, 2)
+ #define SYS_DC_CSW sys_insn(1, 0, 7, 10, 2)
+@@ -419,6 +422,7 @@
+ #define SYS_ICH_LR15_EL2 __SYS__LR8_EL2(7)
+
+ /* Common SCTLR_ELx flags. */
++#define SCTLR_ELx_DSSBS (1UL << 44)
+ #define SCTLR_ELx_EE (1 << 25)
+ #define SCTLR_ELx_IESB (1 << 21)
+ #define SCTLR_ELx_WXN (1 << 19)
+@@ -439,7 +443,7 @@
+ (1 << 10) | (1 << 13) | (1 << 14) | (1 << 15) | \
+ (1 << 17) | (1 << 20) | (1 << 24) | (1 << 26) | \
+ (1 << 27) | (1 << 30) | (1 << 31) | \
+- (0xffffffffUL << 32))
++ (0xffffefffUL << 32))
+
+ #ifdef CONFIG_CPU_BIG_ENDIAN
+ #define ENDIAN_SET_EL2 SCTLR_ELx_EE
+@@ -453,7 +457,7 @@
+ #define SCTLR_EL2_SET (SCTLR_ELx_IESB | ENDIAN_SET_EL2 | SCTLR_EL2_RES1)
+ #define SCTLR_EL2_CLEAR (SCTLR_ELx_M | SCTLR_ELx_A | SCTLR_ELx_C | \
+ SCTLR_ELx_SA | SCTLR_ELx_I | SCTLR_ELx_WXN | \
+- ENDIAN_CLEAR_EL2 | SCTLR_EL2_RES0)
++ SCTLR_ELx_DSSBS | ENDIAN_CLEAR_EL2 | SCTLR_EL2_RES0)
+
+ #if (SCTLR_EL2_SET ^ SCTLR_EL2_CLEAR) != 0xffffffffffffffff
+ #error "Inconsistent SCTLR_EL2 set/clear bits"
+@@ -477,7 +481,7 @@
+ (1 << 29))
+ #define SCTLR_EL1_RES0 ((1 << 6) | (1 << 10) | (1 << 13) | (1 << 17) | \
+ (1 << 27) | (1 << 30) | (1 << 31) | \
+- (0xffffffffUL << 32))
++ (0xffffefffUL << 32))
+
+ #ifdef CONFIG_CPU_BIG_ENDIAN
+ #define ENDIAN_SET_EL1 (SCTLR_EL1_E0E | SCTLR_ELx_EE)
+@@ -494,7 +498,7 @@
+ ENDIAN_SET_EL1 | SCTLR_EL1_UCI | SCTLR_EL1_RES1)
+ #define SCTLR_EL1_CLEAR (SCTLR_ELx_A | SCTLR_EL1_CP15BEN | SCTLR_EL1_ITD |\
+ SCTLR_EL1_UMA | SCTLR_ELx_WXN | ENDIAN_CLEAR_EL1 |\
+- SCTLR_EL1_RES0)
++ SCTLR_ELx_DSSBS | SCTLR_EL1_RES0)
+
+ #if (SCTLR_EL1_SET ^ SCTLR_EL1_CLEAR) != 0xffffffffffffffff
+ #error "Inconsistent SCTLR_EL1 set/clear bits"
+@@ -544,6 +548,13 @@
+ #define ID_AA64PFR0_EL0_64BIT_ONLY 0x1
+ #define ID_AA64PFR0_EL0_32BIT_64BIT 0x2
+
++/* id_aa64pfr1 */
++#define ID_AA64PFR1_SSBS_SHIFT 4
++
++#define ID_AA64PFR1_SSBS_PSTATE_NI 0
++#define ID_AA64PFR1_SSBS_PSTATE_ONLY 1
++#define ID_AA64PFR1_SSBS_PSTATE_INSNS 2
++
+ /* id_aa64mmfr0 */
+ #define ID_AA64MMFR0_TGRAN4_SHIFT 28
+ #define ID_AA64MMFR0_TGRAN64_SHIFT 24
+diff --git a/arch/arm64/include/uapi/asm/hwcap.h b/arch/arm64/include/uapi/asm/hwcap.h
+index 17c65c8f33cb..2bcd6e4f3474 100644
+--- a/arch/arm64/include/uapi/asm/hwcap.h
++++ b/arch/arm64/include/uapi/asm/hwcap.h
+@@ -48,5 +48,6 @@
+ #define HWCAP_USCAT (1 << 25)
+ #define HWCAP_ILRCPC (1 << 26)
+ #define HWCAP_FLAGM (1 << 27)
++#define HWCAP_SSBS (1 << 28)
+
+ #endif /* _UAPI__ASM_HWCAP_H */
+diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h
+index 5dff8eccd17d..b0fd1d300154 100644
+--- a/arch/arm64/include/uapi/asm/ptrace.h
++++ b/arch/arm64/include/uapi/asm/ptrace.h
+@@ -46,6 +46,7 @@
+ #define PSR_I_BIT 0x00000080
+ #define PSR_A_BIT 0x00000100
+ #define PSR_D_BIT 0x00000200
++#define PSR_SSBS_BIT 0x00001000
+ #define PSR_PAN_BIT 0x00400000
+ #define PSR_UAO_BIT 0x00800000
+ #define PSR_V_BIT 0x10000000
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index dc6c535cbd13..9ccf16939d13 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -19,6 +19,7 @@
+ #include <linux/arm-smccc.h>
+ #include <linux/psci.h>
+ #include <linux/types.h>
++#include <linux/cpu.h>
+ #include <asm/cpu.h>
+ #include <asm/cputype.h>
+ #include <asm/cpufeature.h>
+@@ -87,7 +88,6 @@ cpu_enable_trap_ctr_access(const struct arm64_cpu_capabilities *__unused)
+
+ atomic_t arm64_el2_vector_last_slot = ATOMIC_INIT(-1);
+
+-#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+ #include <asm/mmu_context.h>
+ #include <asm/cacheflush.h>
+
+@@ -109,9 +109,9 @@ static void __copy_hyp_vect_bpi(int slot, const char *hyp_vecs_start,
+ __flush_icache_range((uintptr_t)dst, (uintptr_t)dst + SZ_2K);
+ }
+
+-static void __install_bp_hardening_cb(bp_hardening_cb_t fn,
+- const char *hyp_vecs_start,
+- const char *hyp_vecs_end)
++static void install_bp_hardening_cb(bp_hardening_cb_t fn,
++ const char *hyp_vecs_start,
++ const char *hyp_vecs_end)
+ {
+ static DEFINE_SPINLOCK(bp_lock);
+ int cpu, slot = -1;
+@@ -138,7 +138,7 @@ static void __install_bp_hardening_cb(bp_hardening_cb_t fn,
+ #define __smccc_workaround_1_smc_start NULL
+ #define __smccc_workaround_1_smc_end NULL
+
+-static void __install_bp_hardening_cb(bp_hardening_cb_t fn,
++static void install_bp_hardening_cb(bp_hardening_cb_t fn,
+ const char *hyp_vecs_start,
+ const char *hyp_vecs_end)
+ {
+@@ -146,23 +146,6 @@ static void __install_bp_hardening_cb(bp_hardening_cb_t fn,
+ }
+ #endif /* CONFIG_KVM_INDIRECT_VECTORS */
+
+-static void install_bp_hardening_cb(const struct arm64_cpu_capabilities *entry,
+- bp_hardening_cb_t fn,
+- const char *hyp_vecs_start,
+- const char *hyp_vecs_end)
+-{
+- u64 pfr0;
+-
+- if (!entry->matches(entry, SCOPE_LOCAL_CPU))
+- return;
+-
+- pfr0 = read_cpuid(ID_AA64PFR0_EL1);
+- if (cpuid_feature_extract_unsigned_field(pfr0, ID_AA64PFR0_CSV2_SHIFT))
+- return;
+-
+- __install_bp_hardening_cb(fn, hyp_vecs_start, hyp_vecs_end);
+-}
+-
+ #include <uapi/linux/psci.h>
+ #include <linux/arm-smccc.h>
+ #include <linux/psci.h>
+@@ -189,60 +172,83 @@ static void qcom_link_stack_sanitization(void)
+ : "=&r" (tmp));
+ }
+
+-static void
+-enable_smccc_arch_workaround_1(const struct arm64_cpu_capabilities *entry)
++static bool __nospectre_v2;
++static int __init parse_nospectre_v2(char *str)
++{
++ __nospectre_v2 = true;
++ return 0;
++}
++early_param("nospectre_v2", parse_nospectre_v2);
++
++/*
++ * -1: No workaround
++ * 0: No workaround required
++ * 1: Workaround installed
++ */
++static int detect_harden_bp_fw(void)
+ {
+ bp_hardening_cb_t cb;
+ void *smccc_start, *smccc_end;
+ struct arm_smccc_res res;
+ u32 midr = read_cpuid_id();
+
+- if (!entry->matches(entry, SCOPE_LOCAL_CPU))
+- return;
+-
+ if (psci_ops.smccc_version == SMCCC_VERSION_1_0)
+- return;
++ return -1;
+
+ switch (psci_ops.conduit) {
+ case PSCI_CONDUIT_HVC:
+ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+- if ((int)res.a0 < 0)
+- return;
+- cb = call_hvc_arch_workaround_1;
+- /* This is a guest, no need to patch KVM vectors */
+- smccc_start = NULL;
+- smccc_end = NULL;
++ switch ((int)res.a0) {
++ case 1:
++ /* Firmware says we're just fine */
++ return 0;
++ case 0:
++ cb = call_hvc_arch_workaround_1;
++ /* This is a guest, no need to patch KVM vectors */
++ smccc_start = NULL;
++ smccc_end = NULL;
++ break;
++ default:
++ return -1;
++ }
+ break;
+
+ case PSCI_CONDUIT_SMC:
+ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+- if ((int)res.a0 < 0)
+- return;
+- cb = call_smc_arch_workaround_1;
+- smccc_start = __smccc_workaround_1_smc_start;
+- smccc_end = __smccc_workaround_1_smc_end;
++ switch ((int)res.a0) {
++ case 1:
++ /* Firmware says we're just fine */
++ return 0;
++ case 0:
++ cb = call_smc_arch_workaround_1;
++ smccc_start = __smccc_workaround_1_smc_start;
++ smccc_end = __smccc_workaround_1_smc_end;
++ break;
++ default:
++ return -1;
++ }
+ break;
+
+ default:
+- return;
++ return -1;
+ }
+
+ if (((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR) ||
+ ((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR_V1))
+ cb = qcom_link_stack_sanitization;
+
+- install_bp_hardening_cb(entry, cb, smccc_start, smccc_end);
++ if (IS_ENABLED(CONFIG_HARDEN_BRANCH_PREDICTOR))
++ install_bp_hardening_cb(cb, smccc_start, smccc_end);
+
+- return;
++ return 1;
+ }
+-#endif /* CONFIG_HARDEN_BRANCH_PREDICTOR */
+
+-#ifdef CONFIG_ARM64_SSBD
+ DEFINE_PER_CPU_READ_MOSTLY(u64, arm64_ssbd_callback_required);
+
+ int ssbd_state __read_mostly = ARM64_SSBD_KERNEL;
++static bool __ssb_safe = true;
+
+ static const struct ssbd_options {
+ const char *str;
+@@ -312,6 +318,19 @@ void __init arm64_enable_wa2_handling(struct alt_instr *alt,
+
+ void arm64_set_ssbd_mitigation(bool state)
+ {
++ if (!IS_ENABLED(CONFIG_ARM64_SSBD)) {
++ pr_info_once("SSBD disabled by kernel configuration\n");
++ return;
++ }
++
++ if (this_cpu_has_cap(ARM64_SSBS)) {
++ if (state)
++ asm volatile(SET_PSTATE_SSBS(0));
++ else
++ asm volatile(SET_PSTATE_SSBS(1));
++ return;
++ }
++
+ switch (psci_ops.conduit) {
+ case PSCI_CONDUIT_HVC:
+ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_2, state, NULL);
+@@ -333,11 +352,28 @@ static bool has_ssbd_mitigation(const struct arm64_cpu_capabilities *entry,
+ struct arm_smccc_res res;
+ bool required = true;
+ s32 val;
++ bool this_cpu_safe = false;
+
+ WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible());
+
++ if (cpu_mitigations_off())
++ ssbd_state = ARM64_SSBD_FORCE_DISABLE;
++
++ /* delay setting __ssb_safe until we get a firmware response */
++ if (is_midr_in_range_list(read_cpuid_id(), entry->midr_range_list))
++ this_cpu_safe = true;
++
++ if (this_cpu_has_cap(ARM64_SSBS)) {
++ if (!this_cpu_safe)
++ __ssb_safe = false;
++ required = false;
++ goto out_printmsg;
++ }
++
+ if (psci_ops.smccc_version == SMCCC_VERSION_1_0) {
+ ssbd_state = ARM64_SSBD_UNKNOWN;
++ if (!this_cpu_safe)
++ __ssb_safe = false;
+ return false;
+ }
+
+@@ -354,6 +390,8 @@ static bool has_ssbd_mitigation(const struct arm64_cpu_capabilities *entry,
+
+ default:
+ ssbd_state = ARM64_SSBD_UNKNOWN;
++ if (!this_cpu_safe)
++ __ssb_safe = false;
+ return false;
+ }
+
+@@ -362,14 +400,18 @@ static bool has_ssbd_mitigation(const struct arm64_cpu_capabilities *entry,
+ switch (val) {
+ case SMCCC_RET_NOT_SUPPORTED:
+ ssbd_state = ARM64_SSBD_UNKNOWN;
++ if (!this_cpu_safe)
++ __ssb_safe = false;
+ return false;
+
++ /* machines with mixed mitigation requirements must not return this */
+ case SMCCC_RET_NOT_REQUIRED:
+ pr_info_once("%s mitigation not required\n", entry->desc);
+ ssbd_state = ARM64_SSBD_MITIGATED;
+ return false;
+
+ case SMCCC_RET_SUCCESS:
++ __ssb_safe = false;
+ required = true;
+ break;
+
+@@ -379,12 +421,13 @@ static bool has_ssbd_mitigation(const struct arm64_cpu_capabilities *entry,
+
+ default:
+ WARN_ON(1);
++ if (!this_cpu_safe)
++ __ssb_safe = false;
+ return false;
+ }
+
+ switch (ssbd_state) {
+ case ARM64_SSBD_FORCE_DISABLE:
+- pr_info_once("%s disabled from command-line\n", entry->desc);
+ arm64_set_ssbd_mitigation(false);
+ required = false;
+ break;
+@@ -397,7 +440,6 @@ static bool has_ssbd_mitigation(const struct arm64_cpu_capabilities *entry,
+ break;
+
+ case ARM64_SSBD_FORCE_ENABLE:
+- pr_info_once("%s forced from command-line\n", entry->desc);
+ arm64_set_ssbd_mitigation(true);
+ required = true;
+ break;
+@@ -407,9 +449,27 @@ static bool has_ssbd_mitigation(const struct arm64_cpu_capabilities *entry,
+ break;
+ }
+
++out_printmsg:
++ switch (ssbd_state) {
++ case ARM64_SSBD_FORCE_DISABLE:
++ pr_info_once("%s disabled from command-line\n", entry->desc);
++ break;
++
++ case ARM64_SSBD_FORCE_ENABLE:
++ pr_info_once("%s forced from command-line\n", entry->desc);
++ break;
++ }
++
+ return required;
+ }
+-#endif /* CONFIG_ARM64_SSBD */
++
++/* known invulnerable cores */
++static const struct midr_range arm64_ssb_cpus[] = {
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A35),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A53),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A55),
++ {},
++};
+
+ #ifdef CONFIG_ARM64_ERRATUM_1463225
+ DEFINE_PER_CPU(int, __in_cortex_a76_erratum_1463225_wa);
+@@ -464,6 +524,10 @@ has_cortex_a76_erratum_1463225(const struct arm64_cpu_capabilities *entry,
+ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, \
+ CAP_MIDR_RANGE_LIST(midr_list)
+
++/* Track overall mitigation state. We are only mitigated if all cores are ok */
++static bool __hardenbp_enab = true;
++static bool __spectrev2_safe = true;
++
+ /*
+ * Generic helper for handling capabilties with multiple (match,enable) pairs
+ * of call backs, sharing the same capability bit.
+@@ -496,26 +560,63 @@ multi_entry_cap_cpu_enable(const struct arm64_cpu_capabilities *entry)
+ caps->cpu_enable(caps);
+ }
+
+-#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+-
+ /*
+- * List of CPUs where we need to issue a psci call to
+- * harden the branch predictor.
++ * List of CPUs that do not need any Spectre-v2 mitigation at all.
+ */
+-static const struct midr_range arm64_bp_harden_smccc_cpus[] = {
+- MIDR_ALL_VERSIONS(MIDR_CORTEX_A57),
+- MIDR_ALL_VERSIONS(MIDR_CORTEX_A72),
+- MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
+- MIDR_ALL_VERSIONS(MIDR_CORTEX_A75),
+- MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
+- MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
+- MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR_V1),
+- MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
+- MIDR_ALL_VERSIONS(MIDR_NVIDIA_DENVER),
+- {},
++static const struct midr_range spectre_v2_safe_list[] = {
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A35),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A53),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A55),
++ { /* sentinel */ }
+ };
+
+-#endif
++/*
++ * Track overall bp hardening for all heterogeneous cores in the machine.
++ * We are only considered "safe" if all booted cores are known safe.
++ */
++static bool __maybe_unused
++check_branch_predictor(const struct arm64_cpu_capabilities *entry, int scope)
++{
++ int need_wa;
++
++ WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible());
++
++ /* If the CPU has CSV2 set, we're safe */
++ if (cpuid_feature_extract_unsigned_field(read_cpuid(ID_AA64PFR0_EL1),
++ ID_AA64PFR0_CSV2_SHIFT))
++ return false;
++
++ /* Alternatively, we have a list of unaffected CPUs */
++ if (is_midr_in_range_list(read_cpuid_id(), spectre_v2_safe_list))
++ return false;
++
++ /* Fallback to firmware detection */
++ need_wa = detect_harden_bp_fw();
++ if (!need_wa)
++ return false;
++
++ __spectrev2_safe = false;
++
++ if (!IS_ENABLED(CONFIG_HARDEN_BRANCH_PREDICTOR)) {
++ pr_warn_once("spectrev2 mitigation disabled by kernel configuration\n");
++ __hardenbp_enab = false;
++ return false;
++ }
++
++ /* forced off */
++ if (__nospectre_v2 || cpu_mitigations_off()) {
++ pr_info_once("spectrev2 mitigation disabled by command line option\n");
++ __hardenbp_enab = false;
++ return false;
++ }
++
++ if (need_wa < 0) {
++ pr_warn_once("ARM_SMCCC_ARCH_WORKAROUND_1 missing from firmware\n");
++ __hardenbp_enab = false;
++ }
++
++ return (need_wa > 0);
++}
+
+ #ifdef CONFIG_HARDEN_EL2_VECTORS
+
+@@ -674,13 +775,11 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ ERRATA_MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
+ },
+ #endif
+-#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+ {
+ .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+- .cpu_enable = enable_smccc_arch_workaround_1,
+- ERRATA_MIDR_RANGE_LIST(arm64_bp_harden_smccc_cpus),
++ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
++ .matches = check_branch_predictor,
+ },
+-#endif
+ #ifdef CONFIG_HARDEN_EL2_VECTORS
+ {
+ .desc = "EL2 vector hardening",
+@@ -688,14 +787,13 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ ERRATA_MIDR_RANGE_LIST(arm64_harden_el2_vectors),
+ },
+ #endif
+-#ifdef CONFIG_ARM64_SSBD
+ {
+ .desc = "Speculative Store Bypass Disable",
+ .capability = ARM64_SSBD,
+ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+ .matches = has_ssbd_mitigation,
++ .midr_range_list = arm64_ssb_cpus,
+ },
+-#endif
+ #ifdef CONFIG_ARM64_ERRATUM_1463225
+ {
+ .desc = "ARM erratum 1463225",
+@@ -707,3 +805,38 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ {
+ }
+ };
++
++ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr,
++ char *buf)
++{
++ return sprintf(buf, "Mitigation: __user pointer sanitization\n");
++}
++
++ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr,
++ char *buf)
++{
++ if (__spectrev2_safe)
++ return sprintf(buf, "Not affected\n");
++
++ if (__hardenbp_enab)
++ return sprintf(buf, "Mitigation: Branch predictor hardening\n");
++
++ return sprintf(buf, "Vulnerable\n");
++}
++
++ssize_t cpu_show_spec_store_bypass(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ if (__ssb_safe)
++ return sprintf(buf, "Not affected\n");
++
++ switch (ssbd_state) {
++ case ARM64_SSBD_KERNEL:
++ case ARM64_SSBD_FORCE_ENABLE:
++ if (IS_ENABLED(CONFIG_ARM64_SSBD))
++ return sprintf(buf,
++ "Mitigation: Speculative Store Bypass disabled via prctl\n");
++ }
++
++ return sprintf(buf, "Vulnerable\n");
++}
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index a897efdb3ddd..ff5beb59b3dc 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -24,6 +24,7 @@
+ #include <linux/stop_machine.h>
+ #include <linux/types.h>
+ #include <linux/mm.h>
++#include <linux/cpu.h>
+ #include <asm/cpu.h>
+ #include <asm/cpufeature.h>
+ #include <asm/cpu_ops.h>
+@@ -164,6 +165,11 @@ static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = {
+ ARM64_FTR_END,
+ };
+
++static const struct arm64_ftr_bits ftr_id_aa64pfr1[] = {
++ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR1_SSBS_SHIFT, 4, ID_AA64PFR1_SSBS_PSTATE_NI),
++ ARM64_FTR_END,
++};
++
+ static const struct arm64_ftr_bits ftr_id_aa64mmfr0[] = {
+ /*
+ * We already refuse to boot CPUs that don't support our configured
+@@ -379,7 +385,7 @@ static const struct __ftr_reg_entry {
+
+ /* Op1 = 0, CRn = 0, CRm = 4 */
+ ARM64_FTR_REG(SYS_ID_AA64PFR0_EL1, ftr_id_aa64pfr0),
+- ARM64_FTR_REG(SYS_ID_AA64PFR1_EL1, ftr_raz),
++ ARM64_FTR_REG(SYS_ID_AA64PFR1_EL1, ftr_id_aa64pfr1),
+ ARM64_FTR_REG(SYS_ID_AA64ZFR0_EL1, ftr_raz),
+
+ /* Op1 = 0, CRn = 0, CRm = 5 */
+@@ -669,7 +675,6 @@ void update_cpu_features(int cpu,
+
+ /*
+ * EL3 is not our concern.
+- * ID_AA64PFR1 is currently RES0.
+ */
+ taint |= check_update_ftr_reg(SYS_ID_AA64PFR0_EL1, cpu,
+ info->reg_id_aa64pfr0, boot->reg_id_aa64pfr0);
+@@ -885,7 +890,7 @@ static bool has_cache_dic(const struct arm64_cpu_capabilities *entry,
+ return ctr & BIT(CTR_DIC_SHIFT);
+ }
+
+-#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
++static bool __meltdown_safe = true;
+ static int __kpti_forced; /* 0: not forced, >0: forced on, <0: forced off */
+
+ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
+@@ -903,7 +908,17 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
+ { /* sentinel */ }
+ };
+- char const *str = "command line option";
++ char const *str = "kpti command line option";
++ bool meltdown_safe;
++
++ meltdown_safe = is_midr_in_range_list(read_cpuid_id(), kpti_safe_list);
++
++ /* Defer to CPU feature registers */
++ if (has_cpuid_feature(entry, scope))
++ meltdown_safe = true;
++
++ if (!meltdown_safe)
++ __meltdown_safe = false;
+
+ /*
+ * For reasons that aren't entirely clear, enabling KPTI on Cavium
+@@ -915,6 +930,24 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
+ __kpti_forced = -1;
+ }
+
++ /* Useful for KASLR robustness */
++ if (IS_ENABLED(CONFIG_RANDOMIZE_BASE) && kaslr_offset() > 0) {
++ if (!__kpti_forced) {
++ str = "KASLR";
++ __kpti_forced = 1;
++ }
++ }
++
++ if (cpu_mitigations_off() && !__kpti_forced) {
++ str = "mitigations=off";
++ __kpti_forced = -1;
++ }
++
++ if (!IS_ENABLED(CONFIG_UNMAP_KERNEL_AT_EL0)) {
++ pr_info_once("kernel page table isolation disabled by kernel configuration\n");
++ return false;
++ }
++
+ /* Forced? */
+ if (__kpti_forced) {
+ pr_info_once("kernel page table isolation forced %s by %s\n",
+@@ -922,18 +955,10 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
+ return __kpti_forced > 0;
+ }
+
+- /* Useful for KASLR robustness */
+- if (IS_ENABLED(CONFIG_RANDOMIZE_BASE))
+- return true;
+-
+- /* Don't force KPTI for CPUs that are not vulnerable */
+- if (is_midr_in_range_list(read_cpuid_id(), kpti_safe_list))
+- return false;
+-
+- /* Defer to CPU feature registers */
+- return !has_cpuid_feature(entry, scope);
++ return !meltdown_safe;
+ }
+
++#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+ static void
+ kpti_install_ng_mappings(const struct arm64_cpu_capabilities *__unused)
+ {
+@@ -958,6 +983,12 @@ kpti_install_ng_mappings(const struct arm64_cpu_capabilities *__unused)
+
+ return;
+ }
++#else
++static void
++kpti_install_ng_mappings(const struct arm64_cpu_capabilities *__unused)
++{
++}
++#endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */
+
+ static int __init parse_kpti(char *str)
+ {
+@@ -971,7 +1002,6 @@ static int __init parse_kpti(char *str)
+ return 0;
+ }
+ early_param("kpti", parse_kpti);
+-#endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */
+
+ #ifdef CONFIG_ARM64_HW_AFDBM
+ static inline void __cpu_enable_hw_dbm(void)
+@@ -1067,6 +1097,48 @@ static void cpu_has_fwb(const struct arm64_cpu_capabilities *__unused)
+ WARN_ON(val & (7 << 27 | 7 << 21));
+ }
+
++#ifdef CONFIG_ARM64_SSBD
++static int ssbs_emulation_handler(struct pt_regs *regs, u32 instr)
++{
++ if (user_mode(regs))
++ return 1;
++
++ if (instr & BIT(CRm_shift))
++ regs->pstate |= PSR_SSBS_BIT;
++ else
++ regs->pstate &= ~PSR_SSBS_BIT;
++
++ arm64_skip_faulting_instruction(regs, 4);
++ return 0;
++}
++
++static struct undef_hook ssbs_emulation_hook = {
++ .instr_mask = ~(1U << CRm_shift),
++ .instr_val = 0xd500001f | REG_PSTATE_SSBS_IMM,
++ .fn = ssbs_emulation_handler,
++};
++
++static void cpu_enable_ssbs(const struct arm64_cpu_capabilities *__unused)
++{
++ static bool undef_hook_registered = false;
++ static DEFINE_SPINLOCK(hook_lock);
++
++ spin_lock(&hook_lock);
++ if (!undef_hook_registered) {
++ register_undef_hook(&ssbs_emulation_hook);
++ undef_hook_registered = true;
++ }
++ spin_unlock(&hook_lock);
++
++ if (arm64_get_ssbd_state() == ARM64_SSBD_FORCE_DISABLE) {
++ sysreg_clear_set(sctlr_el1, 0, SCTLR_ELx_DSSBS);
++ arm64_set_ssbd_mitigation(false);
++ } else {
++ arm64_set_ssbd_mitigation(true);
++ }
++}
++#endif /* CONFIG_ARM64_SSBD */
++
+ static const struct arm64_cpu_capabilities arm64_features[] = {
+ {
+ .desc = "GIC system register CPU interface",
+@@ -1150,7 +1222,6 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
+ .field_pos = ID_AA64PFR0_EL0_SHIFT,
+ .min_field_value = ID_AA64PFR0_EL0_32BIT_64BIT,
+ },
+-#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+ {
+ .desc = "Kernel page table isolation (KPTI)",
+ .capability = ARM64_UNMAP_KERNEL_AT_EL0,
+@@ -1166,7 +1237,6 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
+ .matches = unmap_kernel_at_el0,
+ .cpu_enable = kpti_install_ng_mappings,
+ },
+-#endif
+ {
+ /* FP/SIMD is not implemented */
+ .capability = ARM64_HAS_NO_FPSIMD,
+@@ -1253,6 +1323,19 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
+ .matches = has_hw_dbm,
+ .cpu_enable = cpu_enable_hw_dbm,
+ },
++#endif
++#ifdef CONFIG_ARM64_SSBD
++ {
++ .desc = "Speculative Store Bypassing Safe (SSBS)",
++ .capability = ARM64_SSBS,
++ .type = ARM64_CPUCAP_WEAK_LOCAL_CPU_FEATURE,
++ .matches = has_cpuid_feature,
++ .sys_reg = SYS_ID_AA64PFR1_EL1,
++ .field_pos = ID_AA64PFR1_SSBS_SHIFT,
++ .sign = FTR_UNSIGNED,
++ .min_field_value = ID_AA64PFR1_SSBS_PSTATE_ONLY,
++ .cpu_enable = cpu_enable_ssbs,
++ },
+ #endif
+ {},
+ };
+@@ -1299,6 +1382,7 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = {
+ #ifdef CONFIG_ARM64_SVE
+ HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_SVE_SHIFT, FTR_UNSIGNED, ID_AA64PFR0_SVE, CAP_HWCAP, HWCAP_SVE),
+ #endif
++ HWCAP_CAP(SYS_ID_AA64PFR1_EL1, ID_AA64PFR1_SSBS_SHIFT, FTR_UNSIGNED, ID_AA64PFR1_SSBS_PSTATE_INSNS, CAP_HWCAP, HWCAP_SSBS),
+ {},
+ };
+
+@@ -1793,3 +1877,15 @@ void cpu_clear_disr(const struct arm64_cpu_capabilities *__unused)
+ /* Firmware may have left a deferred SError in this register. */
+ write_sysreg_s(0, SYS_DISR_EL1);
+ }
++
++ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr,
++ char *buf)
++{
++ if (__meltdown_safe)
++ return sprintf(buf, "Not affected\n");
++
++ if (arm64_kernel_unmapped_at_el0())
++ return sprintf(buf, "Mitigation: PTI\n");
++
++ return sprintf(buf, "Vulnerable\n");
++}
+diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
+index e9ab7b3ed317..dce971f2c167 100644
+--- a/arch/arm64/kernel/cpuinfo.c
++++ b/arch/arm64/kernel/cpuinfo.c
+@@ -81,6 +81,7 @@ static const char *const hwcap_str[] = {
+ "uscat",
+ "ilrcpc",
+ "flagm",
++ "ssbs",
+ NULL
+ };
+
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
+index 7f1628effe6d..bc2226608e13 100644
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -358,6 +358,10 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start,
+ if (IS_ENABLED(CONFIG_ARM64_UAO) &&
+ cpus_have_const_cap(ARM64_HAS_UAO))
+ childregs->pstate |= PSR_UAO_BIT;
++
++ if (arm64_get_ssbd_state() == ARM64_SSBD_FORCE_DISABLE)
++ set_ssbs_bit(childregs);
++
+ p->thread.cpu_context.x19 = stack_start;
+ p->thread.cpu_context.x20 = stk_sz;
+ }
+@@ -397,6 +401,32 @@ void uao_thread_switch(struct task_struct *next)
+ }
+ }
+
++/*
++ * Force SSBS state on context-switch, since it may be lost after migrating
++ * from a CPU which treats the bit as RES0 in a heterogeneous system.
++ */
++static void ssbs_thread_switch(struct task_struct *next)
++{
++ struct pt_regs *regs = task_pt_regs(next);
++
++ /*
++ * Nothing to do for kernel threads, but 'regs' may be junk
++ * (e.g. idle task) so check the flags and bail early.
++ */
++ if (unlikely(next->flags & PF_KTHREAD))
++ return;
++
++ /* If the mitigation is enabled, then we leave SSBS clear. */
++ if ((arm64_get_ssbd_state() == ARM64_SSBD_FORCE_ENABLE) ||
++ test_tsk_thread_flag(next, TIF_SSBD))
++ return;
++
++ if (compat_user_mode(regs))
++ set_compat_ssbs_bit(regs);
++ else if (user_mode(regs))
++ set_ssbs_bit(regs);
++}
++
+ /*
+ * We store our current task in sp_el0, which is clobbered by userspace. Keep a
+ * shadow copy so that we can restore this upon entry from userspace.
+@@ -425,6 +455,7 @@ __notrace_funcgraph struct task_struct *__switch_to(struct task_struct *prev,
+ contextidr_thread_switch(next);
+ entry_task_switch(next);
+ uao_thread_switch(next);
++ ssbs_thread_switch(next);
+
+ /*
+ * Complete any pending TLB or cache maintenance on this CPU in case
+diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
+index 6219486fa25f..0211c3c7533b 100644
+--- a/arch/arm64/kernel/ptrace.c
++++ b/arch/arm64/kernel/ptrace.c
+@@ -1666,19 +1666,20 @@ void syscall_trace_exit(struct pt_regs *regs)
+ }
+
+ /*
+- * SPSR_ELx bits which are always architecturally RES0 per ARM DDI 0487C.a
+- * We also take into account DIT (bit 24), which is not yet documented, and
+- * treat PAN and UAO as RES0 bits, as they are meaningless at EL0, and may be
+- * allocated an EL0 meaning in future.
++ * SPSR_ELx bits which are always architecturally RES0 per ARM DDI 0487D.a.
++ * We permit userspace to set SSBS (AArch64 bit 12, AArch32 bit 23) which is
++ * not described in ARM DDI 0487D.a.
++ * We treat PAN and UAO as RES0 bits, as they are meaningless at EL0, and may
++ * be allocated an EL0 meaning in future.
+ * Userspace cannot use these until they have an architectural meaning.
+ * Note that this follows the SPSR_ELx format, not the AArch32 PSR format.
+ * We also reserve IL for the kernel; SS is handled dynamically.
+ */
+ #define SPSR_EL1_AARCH64_RES0_BITS \
+- (GENMASK_ULL(63,32) | GENMASK_ULL(27, 25) | GENMASK_ULL(23, 22) | \
+- GENMASK_ULL(20, 10) | GENMASK_ULL(5, 5))
++ (GENMASK_ULL(63, 32) | GENMASK_ULL(27, 25) | GENMASK_ULL(23, 22) | \
++ GENMASK_ULL(20, 13) | GENMASK_ULL(11, 10) | GENMASK_ULL(5, 5))
+ #define SPSR_EL1_AARCH32_RES0_BITS \
+- (GENMASK_ULL(63,32) | GENMASK_ULL(23, 22) | GENMASK_ULL(20,20))
++ (GENMASK_ULL(63, 32) | GENMASK_ULL(22, 22) | GENMASK_ULL(20, 20))
+
+ static int valid_compat_regs(struct user_pt_regs *regs)
+ {
+diff --git a/arch/arm64/kernel/ssbd.c b/arch/arm64/kernel/ssbd.c
+index 388f8fc13080..f496fb2f7122 100644
+--- a/arch/arm64/kernel/ssbd.c
++++ b/arch/arm64/kernel/ssbd.c
+@@ -3,13 +3,31 @@
+ * Copyright (C) 2018 ARM Ltd, All Rights Reserved.
+ */
+
++#include <linux/compat.h>
+ #include <linux/errno.h>
+ #include <linux/prctl.h>
+ #include <linux/sched.h>
++#include <linux/sched/task_stack.h>
+ #include <linux/thread_info.h>
+
+ #include <asm/cpufeature.h>
+
++static void ssbd_ssbs_enable(struct task_struct *task)
++{
++ u64 val = is_compat_thread(task_thread_info(task)) ?
++ PSR_AA32_SSBS_BIT : PSR_SSBS_BIT;
++
++ task_pt_regs(task)->pstate |= val;
++}
++
++static void ssbd_ssbs_disable(struct task_struct *task)
++{
++ u64 val = is_compat_thread(task_thread_info(task)) ?
++ PSR_AA32_SSBS_BIT : PSR_SSBS_BIT;
++
++ task_pt_regs(task)->pstate &= ~val;
++}
++
+ /*
+ * prctl interface for SSBD
+ * FIXME: Drop the below ifdefery once merged in 4.18.
+@@ -47,12 +65,14 @@ static int ssbd_prctl_set(struct task_struct *task, unsigned long ctrl)
+ return -EPERM;
+ task_clear_spec_ssb_disable(task);
+ clear_tsk_thread_flag(task, TIF_SSBD);
++ ssbd_ssbs_enable(task);
+ break;
+ case PR_SPEC_DISABLE:
+ if (state == ARM64_SSBD_FORCE_DISABLE)
+ return -EPERM;
+ task_set_spec_ssb_disable(task);
+ set_tsk_thread_flag(task, TIF_SSBD);
++ ssbd_ssbs_disable(task);
+ break;
+ case PR_SPEC_FORCE_DISABLE:
+ if (state == ARM64_SSBD_FORCE_DISABLE)
+@@ -60,6 +80,7 @@ static int ssbd_prctl_set(struct task_struct *task, unsigned long ctrl)
+ task_set_spec_ssb_disable(task);
+ task_set_spec_ssb_force_disable(task);
+ set_tsk_thread_flag(task, TIF_SSBD);
++ ssbd_ssbs_disable(task);
+ break;
+ default:
+ return -ERANGE;
+diff --git a/arch/arm64/kvm/hyp/sysreg-sr.c b/arch/arm64/kvm/hyp/sysreg-sr.c
+index 963d669ae3a2..7414b76191c2 100644
+--- a/arch/arm64/kvm/hyp/sysreg-sr.c
++++ b/arch/arm64/kvm/hyp/sysreg-sr.c
+@@ -293,3 +293,14 @@ void kvm_vcpu_put_sysregs(struct kvm_vcpu *vcpu)
+
+ vcpu->arch.sysregs_loaded_on_cpu = false;
+ }
++
++void __hyp_text __kvm_enable_ssbs(void)
++{
++ u64 tmp;
++
++ asm volatile(
++ "mrs %0, sctlr_el2\n"
++ "orr %0, %0, %1\n"
++ "msr sctlr_el2, %0"
++ : "=&r" (tmp) : "L" (SCTLR_ELx_DSSBS));
++}
+diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
+index 0edba3e75747..4e2ee743088f 100644
+--- a/arch/mips/include/asm/cpu-features.h
++++ b/arch/mips/include/asm/cpu-features.h
+@@ -387,6 +387,22 @@
+ #define cpu_has_dsp3 __ase(MIPS_ASE_DSP3)
+ #endif
+
++#ifndef cpu_has_loongson_mmi
++#define cpu_has_loongson_mmi __ase(MIPS_ASE_LOONGSON_MMI)
++#endif
++
++#ifndef cpu_has_loongson_cam
++#define cpu_has_loongson_cam __ase(MIPS_ASE_LOONGSON_CAM)
++#endif
++
++#ifndef cpu_has_loongson_ext
++#define cpu_has_loongson_ext __ase(MIPS_ASE_LOONGSON_EXT)
++#endif
++
++#ifndef cpu_has_loongson_ext2
++#define cpu_has_loongson_ext2 __ase(MIPS_ASE_LOONGSON_EXT2)
++#endif
++
+ #ifndef cpu_has_mipsmt
+ #define cpu_has_mipsmt __isa_lt_and_ase(6, MIPS_ASE_MIPSMT)
+ #endif
+diff --git a/arch/mips/include/asm/cpu.h b/arch/mips/include/asm/cpu.h
+index dacbdb84516a..2b4b14a56575 100644
+--- a/arch/mips/include/asm/cpu.h
++++ b/arch/mips/include/asm/cpu.h
+@@ -436,5 +436,9 @@ enum cpu_type_enum {
+ #define MIPS_ASE_MSA 0x00000100 /* MIPS SIMD Architecture */
+ #define MIPS_ASE_DSP3 0x00000200 /* Signal Processing ASE Rev 3*/
+ #define MIPS_ASE_MIPS16E2 0x00000400 /* MIPS16e2 */
++#define MIPS_ASE_LOONGSON_MMI 0x00000800 /* Loongson MultiMedia extensions Instructions */
++#define MIPS_ASE_LOONGSON_CAM 0x00001000 /* Loongson CAM */
++#define MIPS_ASE_LOONGSON_EXT 0x00002000 /* Loongson EXTensions */
++#define MIPS_ASE_LOONGSON_EXT2 0x00004000 /* Loongson EXTensions R2 */
+
+ #endif /* _ASM_CPU_H */
+diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
+index 25cd8737e7fe..958b627592c3 100644
+--- a/arch/mips/kernel/cpu-probe.c
++++ b/arch/mips/kernel/cpu-probe.c
+@@ -1489,6 +1489,8 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
+ __cpu_name[cpu] = "ICT Loongson-3";
+ set_elf_platform(cpu, "loongson3a");
+ set_isa(c, MIPS_CPU_ISA_M64R1);
++ c->ases |= (MIPS_ASE_LOONGSON_MMI | MIPS_ASE_LOONGSON_CAM |
++ MIPS_ASE_LOONGSON_EXT);
+ break;
+ case PRID_REV_LOONGSON3B_R1:
+ case PRID_REV_LOONGSON3B_R2:
+@@ -1496,6 +1498,8 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c, unsigned int cpu)
+ __cpu_name[cpu] = "ICT Loongson-3";
+ set_elf_platform(cpu, "loongson3b");
+ set_isa(c, MIPS_CPU_ISA_M64R1);
++ c->ases |= (MIPS_ASE_LOONGSON_MMI | MIPS_ASE_LOONGSON_CAM |
++ MIPS_ASE_LOONGSON_EXT);
+ break;
+ }
+
+@@ -1861,6 +1865,8 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu)
+ decode_configs(c);
+ c->options |= MIPS_CPU_FTLB | MIPS_CPU_TLBINV | MIPS_CPU_LDPTE;
+ c->writecombine = _CACHE_UNCACHED_ACCELERATED;
++ c->ases |= (MIPS_ASE_LOONGSON_MMI | MIPS_ASE_LOONGSON_CAM |
++ MIPS_ASE_LOONGSON_EXT | MIPS_ASE_LOONGSON_EXT2);
+ break;
+ default:
+ panic("Unknown Loongson Processor ID!");
+diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c
+index b2de408a259e..f8d36710cd58 100644
+--- a/arch/mips/kernel/proc.c
++++ b/arch/mips/kernel/proc.c
+@@ -124,6 +124,10 @@ static int show_cpuinfo(struct seq_file *m, void *v)
+ if (cpu_has_eva) seq_printf(m, "%s", " eva");
+ if (cpu_has_htw) seq_printf(m, "%s", " htw");
+ if (cpu_has_xpa) seq_printf(m, "%s", " xpa");
++ if (cpu_has_loongson_mmi) seq_printf(m, "%s", " loongson-mmi");
++ if (cpu_has_loongson_cam) seq_printf(m, "%s", " loongson-cam");
++ if (cpu_has_loongson_ext) seq_printf(m, "%s", " loongson-ext");
++ if (cpu_has_loongson_ext2) seq_printf(m, "%s", " loongson-ext2");
+ seq_printf(m, "\n");
+
+ if (cpu_has_mmips) {
+diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
+index 29f49a35d6ee..6a6804c2e1b0 100644
+--- a/arch/powerpc/include/asm/cputable.h
++++ b/arch/powerpc/include/asm/cputable.h
+@@ -212,7 +212,7 @@ static inline void cpu_feature_keys_init(void) { }
+ #define CPU_FTR_POWER9_DD2_1 LONG_ASM_CONST(0x0000080000000000)
+ #define CPU_FTR_P9_TM_HV_ASSIST LONG_ASM_CONST(0x0000100000000000)
+ #define CPU_FTR_P9_TM_XER_SO_BUG LONG_ASM_CONST(0x0000200000000000)
+-#define CPU_FTR_P9_TLBIE_BUG LONG_ASM_CONST(0x0000400000000000)
++#define CPU_FTR_P9_TLBIE_STQ_BUG LONG_ASM_CONST(0x0000400000000000)
+ #define CPU_FTR_P9_TIDR LONG_ASM_CONST(0x0000800000000000)
+
+ #ifndef __ASSEMBLY__
+@@ -460,7 +460,7 @@ static inline void cpu_feature_keys_init(void) { }
+ CPU_FTR_CFAR | CPU_FTR_HVMODE | CPU_FTR_VMX_COPY | \
+ CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_ARCH_207S | \
+ CPU_FTR_TM_COMP | CPU_FTR_ARCH_300 | CPU_FTR_PKEY | \
+- CPU_FTR_P9_TLBIE_BUG | CPU_FTR_P9_TIDR)
++ CPU_FTR_P9_TLBIE_STQ_BUG | CPU_FTR_P9_TIDR)
+ #define CPU_FTRS_POWER9_DD2_0 CPU_FTRS_POWER9
+ #define CPU_FTRS_POWER9_DD2_1 (CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD2_1)
+ #define CPU_FTRS_POWER9_DD2_2 (CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD2_1 | \
+diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
+index f432054234a4..f3b8e04eca9c 100644
+--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
+@@ -694,9 +694,35 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
+ return true;
+ }
+
++/*
++ * Handle POWER9 broadcast tlbie invalidation issue using
++ * cpu feature flag.
++ */
++static __init void update_tlbie_feature_flag(unsigned long pvr)
++{
++ if (PVR_VER(pvr) == PVR_POWER9) {
++ /*
++ * Set the tlbie feature flag for anything below
++ * Nimbus DD 2.3 and Cumulus DD 1.3
++ */
++ if ((pvr & 0xe000) == 0) {
++ /* Nimbus */
++ if ((pvr & 0xfff) < 0x203)
++ cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_STQ_BUG;
++ } else if ((pvr & 0xc000) == 0) {
++ /* Cumulus */
++ if ((pvr & 0xfff) < 0x103)
++ cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_STQ_BUG;
++ } else {
++ WARN_ONCE(1, "Unknown PVR");
++ cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_STQ_BUG;
++ }
++ }
++}
++
+ static __init void cpufeatures_cpu_quirks(void)
+ {
+- int version = mfspr(SPRN_PVR);
++ unsigned long version = mfspr(SPRN_PVR);
+
+ /*
+ * Not all quirks can be derived from the cpufeatures device tree.
+@@ -715,10 +741,10 @@ static __init void cpufeatures_cpu_quirks(void)
+
+ if ((version & 0xffff0000) == 0x004e0000) {
+ cur_cpu_spec->cpu_features &= ~(CPU_FTR_DAWR);
+- cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_BUG;
+ cur_cpu_spec->cpu_features |= CPU_FTR_P9_TIDR;
+ }
+
++ update_tlbie_feature_flag(version);
+ /*
+ * PKEY was not in the initial base or feature node
+ * specification, but it should become optional in the next
+diff --git a/arch/powerpc/kernel/mce.c b/arch/powerpc/kernel/mce.c
+index efdd16a79075..93e06778b136 100644
+--- a/arch/powerpc/kernel/mce.c
++++ b/arch/powerpc/kernel/mce.c
+@@ -45,6 +45,7 @@ static DEFINE_PER_CPU(struct machine_check_event[MAX_MC_EVT],
+ mce_ue_event_queue);
+
+ static void machine_check_process_queued_event(struct irq_work *work);
++static void machine_check_ue_irq_work(struct irq_work *work);
+ void machine_check_ue_event(struct machine_check_event *evt);
+ static void machine_process_ue_event(struct work_struct *work);
+
+@@ -52,6 +53,10 @@ static struct irq_work mce_event_process_work = {
+ .func = machine_check_process_queued_event,
+ };
+
++static struct irq_work mce_ue_event_irq_work = {
++ .func = machine_check_ue_irq_work,
++};
++
+ DECLARE_WORK(mce_ue_event_work, machine_process_ue_event);
+
+ static void mce_set_error_info(struct machine_check_event *mce,
+@@ -208,6 +213,10 @@ void release_mce_event(void)
+ get_mce_event(NULL, true);
+ }
+
++static void machine_check_ue_irq_work(struct irq_work *work)
++{
++ schedule_work(&mce_ue_event_work);
++}
+
+ /*
+ * Queue up the MCE event which then can be handled later.
+@@ -225,7 +234,7 @@ void machine_check_ue_event(struct machine_check_event *evt)
+ memcpy(this_cpu_ptr(&mce_ue_event_queue[index]), evt, sizeof(*evt));
+
+ /* Queue work to process this event later. */
+- schedule_work(&mce_ue_event_work);
++ irq_work_queue(&mce_ue_event_irq_work);
+ }
+
+ /*
+diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
+index 3022d67f0c48..37a110b8e7e1 100644
+--- a/arch/powerpc/kernel/mce_power.c
++++ b/arch/powerpc/kernel/mce_power.c
+@@ -39,6 +39,7 @@
+ static unsigned long addr_to_pfn(struct pt_regs *regs, unsigned long addr)
+ {
+ pte_t *ptep;
++ unsigned int shift;
+ unsigned long flags;
+ struct mm_struct *mm;
+
+@@ -48,13 +49,18 @@ static unsigned long addr_to_pfn(struct pt_regs *regs, unsigned long addr)
+ mm = &init_mm;
+
+ local_irq_save(flags);
+- if (mm == current->mm)
+- ptep = find_current_mm_pte(mm->pgd, addr, NULL, NULL);
+- else
+- ptep = find_init_mm_pte(addr, NULL);
++ ptep = __find_linux_pte(mm->pgd, addr, NULL, &shift);
+ local_irq_restore(flags);
++
+ if (!ptep || pte_special(*ptep))
+ return ULONG_MAX;
++
++ if (shift > PAGE_SHIFT) {
++ unsigned long rpnmask = (1ul << shift) - PAGE_SIZE;
++
++ return pte_pfn(__pte(pte_val(*ptep) | (addr & rpnmask)));
++ }
++
+ return pte_pfn(*ptep);
+ }
+
+@@ -339,7 +345,7 @@ static const struct mce_derror_table mce_p9_derror_table[] = {
+ MCE_INITIATOR_CPU, MCE_SEV_ERROR_SYNC, },
+ { 0, false, 0, 0, 0, 0 } };
+
+-static int mce_find_instr_ea_and_pfn(struct pt_regs *regs, uint64_t *addr,
++static int mce_find_instr_ea_and_phys(struct pt_regs *regs, uint64_t *addr,
+ uint64_t *phys_addr)
+ {
+ /*
+@@ -530,7 +536,8 @@ static int mce_handle_derror(struct pt_regs *regs,
+ * kernel/exception-64s.h
+ */
+ if (get_paca()->in_mce < MAX_MCE_DEPTH)
+- mce_find_instr_ea_and_pfn(regs, addr, phys_addr);
++ mce_find_instr_ea_and_phys(regs, addr,
++ phys_addr);
+ }
+ found = 1;
+ }
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 05b32cc12e41..3ae3e8d141e3 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -1407,7 +1407,14 @@ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
+ *val = get_reg_val(id, vcpu->arch.pspb);
+ break;
+ case KVM_REG_PPC_DPDES:
+- *val = get_reg_val(id, vcpu->arch.vcore->dpdes);
++ /*
++ * On POWER9, where we are emulating msgsndp etc.,
++ * we return 1 bit for each vcpu, which can come from
++ * either vcore->dpdes or doorbell_request.
++ * On POWER8, doorbell_request is 0.
++ */
++ *val = get_reg_val(id, vcpu->arch.vcore->dpdes |
++ vcpu->arch.doorbell_request);
+ break;
+ case KVM_REG_PPC_VTB:
+ *val = get_reg_val(id, vcpu->arch.vcore->vtb);
+@@ -2550,7 +2557,7 @@ static void collect_piggybacks(struct core_info *cip, int target_threads)
+ if (!spin_trylock(&pvc->lock))
+ continue;
+ prepare_threads(pvc);
+- if (!pvc->n_runnable) {
++ if (!pvc->n_runnable || !pvc->kvm->arch.mmu_ready) {
+ list_del_init(&pvc->preempt_list);
+ if (pvc->runner == NULL) {
+ pvc->vcore_state = VCORE_INACTIVE;
+@@ -2571,15 +2578,20 @@ static void collect_piggybacks(struct core_info *cip, int target_threads)
+ spin_unlock(&lp->lock);
+ }
+
+-static bool recheck_signals(struct core_info *cip)
++static bool recheck_signals_and_mmu(struct core_info *cip)
+ {
+ int sub, i;
+ struct kvm_vcpu *vcpu;
++ struct kvmppc_vcore *vc;
+
+- for (sub = 0; sub < cip->n_subcores; ++sub)
+- for_each_runnable_thread(i, vcpu, cip->vc[sub])
++ for (sub = 0; sub < cip->n_subcores; ++sub) {
++ vc = cip->vc[sub];
++ if (!vc->kvm->arch.mmu_ready)
++ return true;
++ for_each_runnable_thread(i, vcpu, vc)
+ if (signal_pending(vcpu->arch.run_task))
+ return true;
++ }
+ return false;
+ }
+
+@@ -2800,7 +2812,7 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
+ local_irq_disable();
+ hard_irq_disable();
+ if (lazy_irq_pending() || need_resched() ||
+- recheck_signals(&core_info) || !vc->kvm->arch.mmu_ready) {
++ recheck_signals_and_mmu(&core_info)) {
+ local_irq_enable();
+ vc->vcore_state = VCORE_INACTIVE;
+ /* Unlock all except the primary vcore */
+diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+index a67cf1cdeda4..7c68d834c94a 100644
+--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
++++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+@@ -452,7 +452,7 @@ static void do_tlbies(struct kvm *kvm, unsigned long *rbvalues,
+ "r" (rbvalues[i]), "r" (kvm->arch.lpid));
+ }
+
+- if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) {
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
+ /*
+ * Need the extra ptesync to make sure we don't
+ * re-order the tlbie
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index 68c7591f2b5f..f1878e13dd56 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -2903,29 +2903,39 @@ kvm_cede_prodded:
+ kvm_cede_exit:
+ ld r9, HSTATE_KVM_VCPU(r13)
+ #ifdef CONFIG_KVM_XICS
+- /* Abort if we still have a pending escalation */
++ /* are we using XIVE with single escalation? */
++ ld r10, VCPU_XIVE_ESC_VADDR(r9)
++ cmpdi r10, 0
++ beq 3f
++ li r6, XIVE_ESB_SET_PQ_00
++ /*
++ * If we still have a pending escalation, abort the cede,
++ * and we must set PQ to 10 rather than 00 so that we don't
++ * potentially end up with two entries for the escalation
++ * interrupt in the XIVE interrupt queue. In that case
++ * we also don't want to set xive_esc_on to 1 here in
++ * case we race with xive_esc_irq().
++ */
+ lbz r5, VCPU_XIVE_ESC_ON(r9)
+ cmpwi r5, 0
+- beq 1f
++ beq 4f
+ li r0, 0
+ stb r0, VCPU_CEDED(r9)
+-1: /* Enable XIVE escalation */
+- li r5, XIVE_ESB_SET_PQ_00
++ li r6, XIVE_ESB_SET_PQ_10
++ b 5f
++4: li r0, 1
++ stb r0, VCPU_XIVE_ESC_ON(r9)
++ /* make sure store to xive_esc_on is seen before xive_esc_irq runs */
++ sync
++5: /* Enable XIVE escalation */
+ mfmsr r0
+ andi. r0, r0, MSR_DR /* in real mode? */
+ beq 1f
+- ld r10, VCPU_XIVE_ESC_VADDR(r9)
+- cmpdi r10, 0
+- beq 3f
+- ldx r0, r10, r5
++ ldx r0, r10, r6
+ b 2f
+ 1: ld r10, VCPU_XIVE_ESC_RADDR(r9)
+- cmpdi r10, 0
+- beq 3f
+- ldcix r0, r10, r5
++ ldcix r0, r10, r6
+ 2: sync
+- li r0, 1
+- stb r0, VCPU_XIVE_ESC_ON(r9)
+ #endif /* CONFIG_KVM_XICS */
+ 3: b guest_exit_cont
+
+diff --git a/arch/powerpc/kvm/book3s_xive.c b/arch/powerpc/kvm/book3s_xive.c
+index aae34f218ab4..031f07f048af 100644
+--- a/arch/powerpc/kvm/book3s_xive.c
++++ b/arch/powerpc/kvm/book3s_xive.c
+@@ -1037,20 +1037,22 @@ void kvmppc_xive_cleanup_vcpu(struct kvm_vcpu *vcpu)
+ /* Mask the VP IPI */
+ xive_vm_esb_load(&xc->vp_ipi_data, XIVE_ESB_SET_PQ_01);
+
+- /* Disable the VP */
+- xive_native_disable_vp(xc->vp_id);
+-
+- /* Free the queues & associated interrupts */
++ /* Free escalations */
+ for (i = 0; i < KVMPPC_XIVE_Q_COUNT; i++) {
+- struct xive_q *q = &xc->queues[i];
+-
+- /* Free the escalation irq */
+ if (xc->esc_virq[i]) {
+ free_irq(xc->esc_virq[i], vcpu);
+ irq_dispose_mapping(xc->esc_virq[i]);
+ kfree(xc->esc_virq_names[i]);
+ }
+- /* Free the queue */
++ }
++
++ /* Disable the VP */
++ xive_native_disable_vp(xc->vp_id);
++
++ /* Free the queues */
++ for (i = 0; i < KVMPPC_XIVE_Q_COUNT; i++) {
++ struct xive_q *q = &xc->queues[i];
++
+ xive_native_disable_queue(xc->vp_id, q, i);
+ if (q->qpage) {
+ free_pages((unsigned long)q->qpage,
+diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
+index aaa28fd918fe..0c13561d8b80 100644
+--- a/arch/powerpc/mm/hash_native_64.c
++++ b/arch/powerpc/mm/hash_native_64.c
+@@ -203,7 +203,7 @@ static inline unsigned long ___tlbie(unsigned long vpn, int psize,
+
+ static inline void fixup_tlbie(unsigned long vpn, int psize, int apsize, int ssize)
+ {
+- if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) {
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
+ /* Need the extra ptesync to ensure we don't reorder tlbie*/
+ asm volatile("ptesync": : :"memory");
+ ___tlbie(vpn, psize, apsize, ssize);
+diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
+index 29fd8940867e..b1007e9a31ba 100644
+--- a/arch/powerpc/mm/hash_utils_64.c
++++ b/arch/powerpc/mm/hash_utils_64.c
+@@ -37,6 +37,7 @@
+ #include <linux/context_tracking.h>
+ #include <linux/libfdt.h>
+ #include <linux/pkeys.h>
++#include <linux/cpu.h>
+
+ #include <asm/debugfs.h>
+ #include <asm/processor.h>
+@@ -1891,10 +1892,16 @@ static int hpt_order_get(void *data, u64 *val)
+
+ static int hpt_order_set(void *data, u64 val)
+ {
++ int ret;
++
+ if (!mmu_hash_ops.resize_hpt)
+ return -ENODEV;
+
+- return mmu_hash_ops.resize_hpt(val);
++ cpus_read_lock();
++ ret = mmu_hash_ops.resize_hpt(val);
++ cpus_read_unlock();
++
++ return ret;
+ }
+
+ DEFINE_SIMPLE_ATTRIBUTE(fops_hpt_order, hpt_order_get, hpt_order_set, "%llu\n");
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index fef3e1eb3a19..0cddae4263f9 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -220,7 +220,7 @@ static inline void fixup_tlbie(void)
+ unsigned long pid = 0;
+ unsigned long va = ((1UL << 52) - 1);
+
+- if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) {
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
+ asm volatile("ptesync": : :"memory");
+ __tlbie_va(va, pid, mmu_get_ap(MMU_PAGE_64K), RIC_FLUSH_TLB);
+ }
+@@ -230,7 +230,7 @@ static inline void fixup_tlbie_lpid(unsigned long lpid)
+ {
+ unsigned long va = ((1UL << 52) - 1);
+
+- if (cpu_has_feature(CPU_FTR_P9_TLBIE_BUG)) {
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
+ asm volatile("ptesync": : :"memory");
+ __tlbie_lpid_va(va, lpid, mmu_get_ap(MMU_PAGE_64K), RIC_FLUSH_TLB);
+ }
+diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
+index 38fe4087484a..edf9032e2e5c 100644
+--- a/arch/powerpc/platforms/powernv/opal.c
++++ b/arch/powerpc/platforms/powernv/opal.c
+@@ -680,7 +680,10 @@ static ssize_t symbol_map_read(struct file *fp, struct kobject *kobj,
+ bin_attr->size);
+ }
+
+-static BIN_ATTR_RO(symbol_map, 0);
++static struct bin_attribute symbol_map_attr = {
++ .attr = {.name = "symbol_map", .mode = 0400},
++ .read = symbol_map_read
++};
+
+ static void opal_export_symmap(void)
+ {
+@@ -697,10 +700,10 @@ static void opal_export_symmap(void)
+ return;
+
+ /* Setup attributes */
+- bin_attr_symbol_map.private = __va(be64_to_cpu(syms[0]));
+- bin_attr_symbol_map.size = be64_to_cpu(syms[1]);
++ symbol_map_attr.private = __va(be64_to_cpu(syms[0]));
++ symbol_map_attr.size = be64_to_cpu(syms[1]);
+
+- rc = sysfs_create_bin_file(opal_kobj, &bin_attr_symbol_map);
++ rc = sysfs_create_bin_file(opal_kobj, &symbol_map_attr);
+ if (rc)
+ pr_warn("Error %d creating OPAL symbols file\n", rc);
+ }
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda-tce.c b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+index 29e66d6e5763..15a567128c0f 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda-tce.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+@@ -49,6 +49,9 @@ static __be64 *pnv_alloc_tce_level(int nid, unsigned int shift)
+ return addr;
+ }
+
++static void pnv_pci_ioda2_table_do_free_pages(__be64 *addr,
++ unsigned long size, unsigned int levels);
++
+ static __be64 *pnv_tce(struct iommu_table *tbl, bool user, long idx, bool alloc)
+ {
+ __be64 *tmp = user ? tbl->it_userspace : (__be64 *) tbl->it_base;
+@@ -58,9 +61,9 @@ static __be64 *pnv_tce(struct iommu_table *tbl, bool user, long idx, bool alloc)
+
+ while (level) {
+ int n = (idx & mask) >> (level * shift);
+- unsigned long tce;
++ unsigned long oldtce, tce = be64_to_cpu(READ_ONCE(tmp[n]));
+
+- if (tmp[n] == 0) {
++ if (!tce) {
+ __be64 *tmp2;
+
+ if (!alloc)
+@@ -71,10 +74,15 @@ static __be64 *pnv_tce(struct iommu_table *tbl, bool user, long idx, bool alloc)
+ if (!tmp2)
+ return NULL;
+
+- tmp[n] = cpu_to_be64(__pa(tmp2) |
+- TCE_PCI_READ | TCE_PCI_WRITE);
++ tce = __pa(tmp2) | TCE_PCI_READ | TCE_PCI_WRITE;
++ oldtce = be64_to_cpu(cmpxchg(&tmp[n], 0,
++ cpu_to_be64(tce)));
++ if (oldtce) {
++ pnv_pci_ioda2_table_do_free_pages(tmp2,
++ ilog2(tbl->it_level_size) + 3, 1);
++ tce = oldtce;
++ }
+ }
+- tce = be64_to_cpu(tmp[n]);
+
+ tmp = __va(tce & ~(TCE_PCI_READ | TCE_PCI_WRITE));
+ idx &= ~mask;
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index 9e52b686a8fa..ea602f7f97ce 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -647,7 +647,10 @@ static int pseries_lpar_resize_hpt_commit(void *data)
+ return 0;
+ }
+
+-/* Must be called in user context */
++/*
++ * Must be called in process context. The caller must hold the
++ * cpus_lock.
++ */
+ static int pseries_lpar_resize_hpt(unsigned long shift)
+ {
+ struct hpt_resize_state state = {
+@@ -699,7 +702,8 @@ static int pseries_lpar_resize_hpt(unsigned long shift)
+
+ t1 = ktime_get();
+
+- rc = stop_machine(pseries_lpar_resize_hpt_commit, &state, NULL);
++ rc = stop_machine_cpuslocked(pseries_lpar_resize_hpt_commit,
++ &state, NULL);
+
+ t2 = ktime_get();
+
+diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
+index fa2c08e3c05e..a03821b2656a 100644
+--- a/arch/riscv/kernel/entry.S
++++ b/arch/riscv/kernel/entry.S
+@@ -171,9 +171,13 @@ ENTRY(handle_exception)
+ move a1, s4 /* scause */
+ tail do_IRQ
+ 1:
+- /* Exceptions run with interrupts enabled */
++ /* Exceptions run with interrupts enabled or disabled
++ depending on the state of sstatus.SR_SPIE */
++ andi t0, s1, SR_SPIE
++ beqz t0, 1f
+ csrs sstatus, SR_SIE
+
++1:
+ /* Handle syscalls */
+ li t0, EXC_SYSCALL
+ beq s4, t0, handle_syscall
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index 6e758bb6cd29..99ef537e548a 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -183,20 +183,30 @@ unsigned long get_wchan(struct task_struct *p)
+
+ if (!p || p == current || p->state == TASK_RUNNING || !task_stack_page(p))
+ return 0;
++
++ if (!try_get_task_stack(p))
++ return 0;
++
+ low = task_stack_page(p);
+ high = (struct stack_frame *) task_pt_regs(p);
+ sf = (struct stack_frame *) p->thread.ksp;
+- if (sf <= low || sf > high)
+- return 0;
++ if (sf <= low || sf > high) {
++ return_address = 0;
++ goto out;
++ }
+ for (count = 0; count < 16; count++) {
+ sf = (struct stack_frame *) sf->back_chain;
+- if (sf <= low || sf > high)
+- return 0;
++ if (sf <= low || sf > high) {
++ return_address = 0;
++ goto out;
++ }
+ return_address = sf->gprs[8];
+ if (!in_sched_functions(return_address))
+- return return_address;
++ goto out;
+ }
+- return 0;
++out:
++ put_task_stack(p);
++ return return_address;
+ }
+
+ unsigned long arch_align_stack(unsigned long sp)
+diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
+index e8184a15578a..7b96888974db 100644
+--- a/arch/s390/kernel/topology.c
++++ b/arch/s390/kernel/topology.c
+@@ -311,7 +311,8 @@ int arch_update_cpu_topology(void)
+ on_each_cpu(__arch_update_dedicated_flag, NULL, 0);
+ for_each_online_cpu(cpu) {
+ dev = get_cpu_device(cpu);
+- kobject_uevent(&dev->kobj, KOBJ_CHANGE);
++ if (dev)
++ kobject_uevent(&dev->kobj, KOBJ_CHANGE);
+ }
+ return rc;
+ }
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index e0551c948c59..fac1d4eaa426 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -3890,7 +3890,7 @@ static long kvm_s390_guest_mem_op(struct kvm_vcpu *vcpu,
+ const u64 supported_flags = KVM_S390_MEMOP_F_INJECT_EXCEPTION
+ | KVM_S390_MEMOP_F_CHECK_ONLY;
+
+- if (mop->flags & ~supported_flags)
++ if (mop->flags & ~supported_flags || mop->ar >= NUM_ACRS || !mop->size)
+ return -EINVAL;
+
+ if (mop->size > MEM_OP_MAX_SIZE)
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index e83f4f6bfdac..6f7b3acdab26 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -8801,7 +8801,7 @@ static int handle_vmread(struct kvm_vcpu *vcpu)
+ /* _system ok, nested_vmx_check_permission has verified cpl=0 */
+ if (kvm_write_guest_virt_system(vcpu, gva, &field_value,
+ (is_long_mode(vcpu) ? 8 : 4),
+- NULL))
++ &e))
+ kvm_inject_page_fault(vcpu, &e);
+ }
+
+@@ -12574,7 +12574,7 @@ static int check_vmentry_prereqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
+
+ /* VM-entry exception error code */
+ if (has_error_code &&
+- vmcs12->vm_entry_exception_error_code & GENMASK(31, 15))
++ vmcs12->vm_entry_exception_error_code & GENMASK(31, 16))
+ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+
+ /* VM-entry interruption-info field: reserved bits */
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 05cb5855255e..6ae8a013af31 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -791,34 +791,42 @@ int kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
+ }
+ EXPORT_SYMBOL_GPL(kvm_set_xcr);
+
+-int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
++static int kvm_valid_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+- unsigned long old_cr4 = kvm_read_cr4(vcpu);
+- unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE |
+- X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE;
+-
+ if (cr4 & CR4_RESERVED_BITS)
+- return 1;
++ return -EINVAL;
+
+ if (!guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) && (cr4 & X86_CR4_OSXSAVE))
+- return 1;
++ return -EINVAL;
+
+ if (!guest_cpuid_has(vcpu, X86_FEATURE_SMEP) && (cr4 & X86_CR4_SMEP))
+- return 1;
++ return -EINVAL;
+
+ if (!guest_cpuid_has(vcpu, X86_FEATURE_SMAP) && (cr4 & X86_CR4_SMAP))
+- return 1;
++ return -EINVAL;
+
+ if (!guest_cpuid_has(vcpu, X86_FEATURE_FSGSBASE) && (cr4 & X86_CR4_FSGSBASE))
+- return 1;
++ return -EINVAL;
+
+ if (!guest_cpuid_has(vcpu, X86_FEATURE_PKU) && (cr4 & X86_CR4_PKE))
+- return 1;
++ return -EINVAL;
+
+ if (!guest_cpuid_has(vcpu, X86_FEATURE_LA57) && (cr4 & X86_CR4_LA57))
+- return 1;
++ return -EINVAL;
+
+ if (!guest_cpuid_has(vcpu, X86_FEATURE_UMIP) && (cr4 & X86_CR4_UMIP))
++ return -EINVAL;
++
++ return 0;
++}
++
++int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
++{
++ unsigned long old_cr4 = kvm_read_cr4(vcpu);
++ unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE |
++ X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE;
++
++ if (kvm_valid_cr4(vcpu, cr4))
+ return 1;
+
+ if (is_long_mode(vcpu)) {
+@@ -8237,10 +8245,6 @@ EXPORT_SYMBOL_GPL(kvm_task_switch);
+
+ static int kvm_valid_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
+ {
+- if (!guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
+- (sregs->cr4 & X86_CR4_OSXSAVE))
+- return -EINVAL;
+-
+ if ((sregs->efer & EFER_LME) && (sregs->cr0 & X86_CR0_PG)) {
+ /*
+ * When EFER.LME and CR0.PG are set, the processor is in
+@@ -8259,7 +8263,7 @@ static int kvm_valid_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
+ return -EINVAL;
+ }
+
+- return 0;
++ return kvm_valid_cr4(vcpu, sregs->cr4);
+ }
+
+ static int __set_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
+diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
+index 10fb42da0007..b81b5172cf99 100644
+--- a/arch/x86/purgatory/Makefile
++++ b/arch/x86/purgatory/Makefile
+@@ -23,6 +23,7 @@ KCOV_INSTRUMENT := n
+
+ PURGATORY_CFLAGS_REMOVE := -mcmodel=kernel
+ PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss
++PURGATORY_CFLAGS += $(DISABLE_STACKLEAK_PLUGIN)
+
+ # Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
+ # in turn leaves some undefined symbols like __fentry__ in purgatory and not
+diff --git a/crypto/skcipher.c b/crypto/skcipher.c
+index b664cf867f5f..a8750b4ebf26 100644
+--- a/crypto/skcipher.c
++++ b/crypto/skcipher.c
+@@ -95,7 +95,7 @@ static inline u8 *skcipher_get_spot(u8 *start, unsigned int len)
+ return max(start, end_page);
+ }
+
+-static void skcipher_done_slow(struct skcipher_walk *walk, unsigned int bsize)
++static int skcipher_done_slow(struct skcipher_walk *walk, unsigned int bsize)
+ {
+ u8 *addr;
+
+@@ -103,19 +103,21 @@ static void skcipher_done_slow(struct skcipher_walk *walk, unsigned int bsize)
+ addr = skcipher_get_spot(addr, bsize);
+ scatterwalk_copychunks(addr, &walk->out, bsize,
+ (walk->flags & SKCIPHER_WALK_PHYS) ? 2 : 1);
++ return 0;
+ }
+
+ int skcipher_walk_done(struct skcipher_walk *walk, int err)
+ {
+- unsigned int n; /* bytes processed */
+- bool more;
++ unsigned int n = walk->nbytes;
++ unsigned int nbytes = 0;
+
+- if (unlikely(err < 0))
++ if (!n)
+ goto finish;
+
+- n = walk->nbytes - err;
+- walk->total -= n;
+- more = (walk->total != 0);
++ if (likely(err >= 0)) {
++ n -= err;
++ nbytes = walk->total - n;
++ }
+
+ if (likely(!(walk->flags & (SKCIPHER_WALK_PHYS |
+ SKCIPHER_WALK_SLOW |
+@@ -131,7 +133,7 @@ unmap_src:
+ memcpy(walk->dst.virt.addr, walk->page, n);
+ skcipher_unmap_dst(walk);
+ } else if (unlikely(walk->flags & SKCIPHER_WALK_SLOW)) {
+- if (err) {
++ if (err > 0) {
+ /*
+ * Didn't process all bytes. Either the algorithm is
+ * broken, or this was the last step and it turned out
+@@ -139,27 +141,29 @@ unmap_src:
+ * the algorithm requires it.
+ */
+ err = -EINVAL;
+- goto finish;
+- }
+- skcipher_done_slow(walk, n);
+- goto already_advanced;
++ nbytes = 0;
++ } else
++ n = skcipher_done_slow(walk, n);
+ }
+
++ if (err > 0)
++ err = 0;
++
++ walk->total = nbytes;
++ walk->nbytes = 0;
++
+ scatterwalk_advance(&walk->in, n);
+ scatterwalk_advance(&walk->out, n);
+-already_advanced:
+- scatterwalk_done(&walk->in, 0, more);
+- scatterwalk_done(&walk->out, 1, more);
++ scatterwalk_done(&walk->in, 0, nbytes);
++ scatterwalk_done(&walk->out, 1, nbytes);
+
+- if (more) {
++ if (nbytes) {
+ crypto_yield(walk->flags & SKCIPHER_WALK_SLEEP ?
+ CRYPTO_TFM_REQ_MAY_SLEEP : 0);
+ return skcipher_walk_next(walk);
+ }
+- err = 0;
+-finish:
+- walk->nbytes = 0;
+
++finish:
+ /* Short-circuit for the common/fast path. */
+ if (!((unsigned long)walk->buffer | (unsigned long)walk->page))
+ goto out;
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index b1c7009de1f4..bc2fa4e85f0c 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -106,6 +106,7 @@ struct nbd_device {
+ struct nbd_config *config;
+ struct mutex config_lock;
+ struct gendisk *disk;
++ struct workqueue_struct *recv_workq;
+
+ struct list_head list;
+ struct task_struct *task_recv;
+@@ -132,9 +133,10 @@ static struct dentry *nbd_dbg_dir;
+
+ #define NBD_MAGIC 0x68797548
+
++#define NBD_DEF_BLKSIZE 1024
++
+ static unsigned int nbds_max = 16;
+ static int max_part = 16;
+-static struct workqueue_struct *recv_workqueue;
+ static int part_shift;
+
+ static int nbd_dev_dbg_init(struct nbd_device *nbd);
+@@ -1025,7 +1027,7 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg)
+ /* We take the tx_mutex in an error path in the recv_work, so we
+ * need to queue_work outside of the tx_mutex.
+ */
+- queue_work(recv_workqueue, &args->work);
++ queue_work(nbd->recv_workq, &args->work);
+
+ atomic_inc(&config->live_connections);
+ wake_up(&config->conn_wait);
+@@ -1126,6 +1128,10 @@ static void nbd_config_put(struct nbd_device *nbd)
+ kfree(nbd->config);
+ nbd->config = NULL;
+
++ if (nbd->recv_workq)
++ destroy_workqueue(nbd->recv_workq);
++ nbd->recv_workq = NULL;
++
+ nbd->tag_set.timeout = 0;
+ nbd->disk->queue->limits.discard_granularity = 0;
+ nbd->disk->queue->limits.discard_alignment = 0;
+@@ -1154,6 +1160,14 @@ static int nbd_start_device(struct nbd_device *nbd)
+ return -EINVAL;
+ }
+
++ nbd->recv_workq = alloc_workqueue("knbd%d-recv",
++ WQ_MEM_RECLAIM | WQ_HIGHPRI |
++ WQ_UNBOUND, 0, nbd->index);
++ if (!nbd->recv_workq) {
++ dev_err(disk_to_dev(nbd->disk), "Could not allocate knbd recv work queue.\n");
++ return -ENOMEM;
++ }
++
+ blk_mq_update_nr_hw_queues(&nbd->tag_set, config->num_connections);
+ nbd->task_recv = current;
+
+@@ -1184,7 +1198,7 @@ static int nbd_start_device(struct nbd_device *nbd)
+ INIT_WORK(&args->work, recv_work);
+ args->nbd = nbd;
+ args->index = i;
+- queue_work(recv_workqueue, &args->work);
++ queue_work(nbd->recv_workq, &args->work);
+ }
+ nbd_size_update(nbd);
+ return error;
+@@ -1204,8 +1218,10 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
+ mutex_unlock(&nbd->config_lock);
+ ret = wait_event_interruptible(config->recv_wq,
+ atomic_read(&config->recv_threads) == 0);
+- if (ret)
++ if (ret) {
+ sock_shutdown(nbd);
++ flush_workqueue(nbd->recv_workq);
++ }
+ mutex_lock(&nbd->config_lock);
+ nbd_bdev_reset(bdev);
+ /* user requested, ignore socket errors */
+@@ -1227,6 +1243,14 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
+ nbd_config_put(nbd);
+ }
+
++static bool nbd_is_valid_blksize(unsigned long blksize)
++{
++ if (!blksize || !is_power_of_2(blksize) || blksize < 512 ||
++ blksize > PAGE_SIZE)
++ return false;
++ return true;
++}
++
+ /* Must be called with config_lock held */
+ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ unsigned int cmd, unsigned long arg)
+@@ -1242,8 +1266,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ case NBD_SET_SOCK:
+ return nbd_add_socket(nbd, arg, false);
+ case NBD_SET_BLKSIZE:
+- if (!arg || !is_power_of_2(arg) || arg < 512 ||
+- arg > PAGE_SIZE)
++ if (!arg)
++ arg = NBD_DEF_BLKSIZE;
++ if (!nbd_is_valid_blksize(arg))
+ return -EINVAL;
+ nbd_size_set(nbd, arg,
+ div_s64(config->bytesize, arg));
+@@ -1323,7 +1348,7 @@ static struct nbd_config *nbd_alloc_config(void)
+ atomic_set(&config->recv_threads, 0);
+ init_waitqueue_head(&config->recv_wq);
+ init_waitqueue_head(&config->conn_wait);
+- config->blksize = 1024;
++ config->blksize = NBD_DEF_BLKSIZE;
+ atomic_set(&config->live_connections, 0);
+ try_module_get(THIS_MODULE);
+ return config;
+@@ -1759,6 +1784,12 @@ again:
+ if (info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]) {
+ u64 bsize =
+ nla_get_u64(info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]);
++ if (!bsize)
++ bsize = NBD_DEF_BLKSIZE;
++ if (!nbd_is_valid_blksize(bsize)) {
++ ret = -EINVAL;
++ goto out;
++ }
+ nbd_size_set(nbd, bsize, div64_u64(config->bytesize, bsize));
+ }
+ if (info->attrs[NBD_ATTR_TIMEOUT]) {
+@@ -1835,6 +1866,12 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd)
+ nbd_disconnect(nbd);
+ nbd_clear_sock(nbd);
+ mutex_unlock(&nbd->config_lock);
++ /*
++ * Make sure recv thread has finished, so it does not drop the last
++ * config ref and try to destroy the workqueue from inside the work
++ * queue.
++ */
++ flush_workqueue(nbd->recv_workq);
+ if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
+ &nbd->config->runtime_flags))
+ nbd_config_put(nbd);
+@@ -2215,20 +2252,12 @@ static int __init nbd_init(void)
+
+ if (nbds_max > 1UL << (MINORBITS - part_shift))
+ return -EINVAL;
+- recv_workqueue = alloc_workqueue("knbd-recv",
+- WQ_MEM_RECLAIM | WQ_HIGHPRI |
+- WQ_UNBOUND, 0);
+- if (!recv_workqueue)
+- return -ENOMEM;
+
+- if (register_blkdev(NBD_MAJOR, "nbd")) {
+- destroy_workqueue(recv_workqueue);
++ if (register_blkdev(NBD_MAJOR, "nbd"))
+ return -EIO;
+- }
+
+ if (genl_register_family(&nbd_genl_family)) {
+ unregister_blkdev(NBD_MAJOR, "nbd");
+- destroy_workqueue(recv_workqueue);
+ return -EINVAL;
+ }
+ nbd_dbg_init();
+@@ -2270,7 +2299,6 @@ static void __exit nbd_cleanup(void)
+
+ idr_destroy(&nbd_index_idr);
+ genl_unregister_family(&nbd_genl_family);
+- destroy_workqueue(recv_workqueue);
+ unregister_blkdev(NBD_MAJOR, "nbd");
+ }
+
+diff --git a/drivers/crypto/caam/caamalg_desc.c b/drivers/crypto/caam/caamalg_desc.c
+index a408edd84f34..edacf9b39b63 100644
+--- a/drivers/crypto/caam/caamalg_desc.c
++++ b/drivers/crypto/caam/caamalg_desc.c
+@@ -509,6 +509,7 @@ void cnstr_shdsc_aead_givencap(u32 * const desc, struct alginfo *cdata,
+ const bool is_qi, int era)
+ {
+ u32 geniv, moveiv;
++ u32 *wait_cmd;
+
+ /* Note: Context registers are saved. */
+ init_sh_desc_key_aead(desc, cdata, adata, is_rfc3686, nonce, era);
+@@ -604,6 +605,14 @@ copy_iv:
+
+ /* Will read cryptlen */
+ append_math_add(desc, VARSEQINLEN, SEQINLEN, REG0, CAAM_CMD_SZ);
++
++ /*
++ * Wait for IV transfer (ofifo -> class2) to finish before starting
++ * ciphertext transfer (ofifo -> external memory).
++ */
++ wait_cmd = append_jump(desc, JUMP_JSL | JUMP_TEST_ALL | JUMP_COND_NIFP);
++ set_jump_tgt_here(desc, wait_cmd);
++
+ append_seq_fifo_load(desc, 0, FIFOLD_CLASS_BOTH | KEY_VLF |
+ FIFOLD_TYPE_MSG1OUT2 | FIFOLD_TYPE_LASTBOTH);
+ append_seq_fifo_store(desc, 0, FIFOST_TYPE_MESSAGE_DATA | KEY_VLF);
+diff --git a/drivers/crypto/caam/caamalg_desc.h b/drivers/crypto/caam/caamalg_desc.h
+index a917af5776ce..05516b0a4240 100644
+--- a/drivers/crypto/caam/caamalg_desc.h
++++ b/drivers/crypto/caam/caamalg_desc.h
+@@ -12,7 +12,7 @@
+ #define DESC_AEAD_BASE (4 * CAAM_CMD_SZ)
+ #define DESC_AEAD_ENC_LEN (DESC_AEAD_BASE + 11 * CAAM_CMD_SZ)
+ #define DESC_AEAD_DEC_LEN (DESC_AEAD_BASE + 15 * CAAM_CMD_SZ)
+-#define DESC_AEAD_GIVENC_LEN (DESC_AEAD_ENC_LEN + 7 * CAAM_CMD_SZ)
++#define DESC_AEAD_GIVENC_LEN (DESC_AEAD_ENC_LEN + 8 * CAAM_CMD_SZ)
+ #define DESC_QI_AEAD_ENC_LEN (DESC_AEAD_ENC_LEN + 3 * CAAM_CMD_SZ)
+ #define DESC_QI_AEAD_DEC_LEN (DESC_AEAD_DEC_LEN + 3 * CAAM_CMD_SZ)
+ #define DESC_QI_AEAD_GIVENC_LEN (DESC_AEAD_GIVENC_LEN + 3 * CAAM_CMD_SZ)
+diff --git a/drivers/crypto/cavium/zip/zip_main.c b/drivers/crypto/cavium/zip/zip_main.c
+index 6183f9128a8a..ea901bc5733c 100644
+--- a/drivers/crypto/cavium/zip/zip_main.c
++++ b/drivers/crypto/cavium/zip/zip_main.c
+@@ -593,6 +593,7 @@ static const struct file_operations zip_stats_fops = {
+ .owner = THIS_MODULE,
+ .open = zip_stats_open,
+ .read = seq_read,
++ .release = single_release,
+ };
+
+ static int zip_clear_open(struct inode *inode, struct file *file)
+@@ -604,6 +605,7 @@ static const struct file_operations zip_clear_fops = {
+ .owner = THIS_MODULE,
+ .open = zip_clear_open,
+ .read = seq_read,
++ .release = single_release,
+ };
+
+ static int zip_regs_open(struct inode *inode, struct file *file)
+@@ -615,6 +617,7 @@ static const struct file_operations zip_regs_fops = {
+ .owner = THIS_MODULE,
+ .open = zip_regs_open,
+ .read = seq_read,
++ .release = single_release,
+ };
+
+ /* Root directory for thunderx_zip debugfs entry */
+diff --git a/drivers/crypto/ccree/cc_aead.c b/drivers/crypto/ccree/cc_aead.c
+index 0669033f5be5..aa6b45bc13b9 100644
+--- a/drivers/crypto/ccree/cc_aead.c
++++ b/drivers/crypto/ccree/cc_aead.c
+@@ -227,7 +227,7 @@ static void cc_aead_complete(struct device *dev, void *cc_req, int err)
+ /* In case of payload authentication failure, MUST NOT
+ * revealed the decrypted message --> zero its memory.
+ */
+- cc_zero_sgl(areq->dst, areq_ctx->cryptlen);
++ cc_zero_sgl(areq->dst, areq->cryptlen);
+ err = -EBADMSG;
+ }
+ } else { /*ENCRYPT*/
+diff --git a/drivers/crypto/ccree/cc_fips.c b/drivers/crypto/ccree/cc_fips.c
+index 09f708f6418e..bac278d274b0 100644
+--- a/drivers/crypto/ccree/cc_fips.c
++++ b/drivers/crypto/ccree/cc_fips.c
+@@ -21,7 +21,13 @@ static bool cc_get_tee_fips_status(struct cc_drvdata *drvdata)
+ u32 reg;
+
+ reg = cc_ioread(drvdata, CC_REG(GPR_HOST));
+- return (reg == (CC_FIPS_SYNC_TEE_STATUS | CC_FIPS_SYNC_MODULE_OK));
++ /* Did the TEE report status? */
++ if (reg & CC_FIPS_SYNC_TEE_STATUS)
++ /* Yes. Is it OK? */
++ return (reg & CC_FIPS_SYNC_MODULE_OK);
++
++ /* No. It's either not in use or will be reported later */
++ return true;
+ }
+
+ /*
+diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h
+index 5c4c0a253129..d78f8d5c89c3 100644
+--- a/drivers/crypto/qat/qat_common/adf_common_drv.h
++++ b/drivers/crypto/qat/qat_common/adf_common_drv.h
+@@ -95,7 +95,7 @@ struct service_hndl {
+
+ static inline int get_current_node(void)
+ {
+- return topology_physical_package_id(smp_processor_id());
++ return topology_physical_package_id(raw_smp_processor_id());
+ }
+
+ int adf_service_register(struct service_hndl *service);
+diff --git a/drivers/devfreq/tegra-devfreq.c b/drivers/devfreq/tegra-devfreq.c
+index c59d2eee5d30..06768074d2d8 100644
+--- a/drivers/devfreq/tegra-devfreq.c
++++ b/drivers/devfreq/tegra-devfreq.c
+@@ -486,11 +486,11 @@ static int tegra_devfreq_target(struct device *dev, unsigned long *freq,
+ {
+ struct tegra_devfreq *tegra = dev_get_drvdata(dev);
+ struct dev_pm_opp *opp;
+- unsigned long rate = *freq * KHZ;
++ unsigned long rate;
+
+- opp = devfreq_recommended_opp(dev, &rate, flags);
++ opp = devfreq_recommended_opp(dev, freq, flags);
+ if (IS_ERR(opp)) {
+- dev_err(dev, "Failed to find opp for %lu KHz\n", *freq);
++ dev_err(dev, "Failed to find opp for %lu Hz\n", *freq);
+ return PTR_ERR(opp);
+ }
+ rate = dev_pm_opp_get_freq(opp);
+@@ -499,8 +499,6 @@ static int tegra_devfreq_target(struct device *dev, unsigned long *freq,
+ clk_set_min_rate(tegra->emc_clock, rate);
+ clk_set_rate(tegra->emc_clock, 0);
+
+- *freq = rate;
+-
+ return 0;
+ }
+
+@@ -510,7 +508,7 @@ static int tegra_devfreq_get_dev_status(struct device *dev,
+ struct tegra_devfreq *tegra = dev_get_drvdata(dev);
+ struct tegra_devfreq_device *actmon_dev;
+
+- stat->current_frequency = tegra->cur_freq;
++ stat->current_frequency = tegra->cur_freq * KHZ;
+
+ /* To be used by the tegra governor */
+ stat->private_data = tegra;
+@@ -565,7 +563,7 @@ static int tegra_governor_get_target(struct devfreq *devfreq,
+ target_freq = max(target_freq, dev->target_freq);
+ }
+
+- *freq = target_freq;
++ *freq = target_freq * KHZ;
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+index 51b5e977ca88..f4e9d1b10e3e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+@@ -139,7 +139,8 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned num_ibs,
+ /* ring tests don't use a job */
+ if (job) {
+ vm = job->vm;
+- fence_ctx = job->base.s_fence->scheduled.context;
++ fence_ctx = job->base.s_fence ?
++ job->base.s_fence->scheduled.context : 0;
+ } else {
+ vm = NULL;
+ fence_ctx = 0;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index c0396e83f352..fc93b103f777 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -562,6 +562,9 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK)
+ sh_num = 0xffffffff;
+
++ if (info->read_mmr_reg.count > 128)
++ return -EINVAL;
++
+ regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs), GFP_KERNEL);
+ if (!regs)
+ return -ENOMEM;
+diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
+index 663a7c9ca3d3..d0e216d85a22 100644
+--- a/drivers/gpu/drm/i915/gvt/scheduler.c
++++ b/drivers/gpu/drm/i915/gvt/scheduler.c
+@@ -1276,9 +1276,6 @@ static int prepare_mm(struct intel_vgpu_workload *workload)
+ #define same_context(a, b) (((a)->context_id == (b)->context_id) && \
+ ((a)->lrca == (b)->lrca))
+
+-#define get_last_workload(q) \
+- (list_empty(q) ? NULL : container_of(q->prev, \
+- struct intel_vgpu_workload, list))
+ /**
+ * intel_vgpu_create_workload - create a vGPU workload
+ * @vgpu: a vGPU
+@@ -1297,7 +1294,7 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
+ {
+ struct intel_vgpu_submission *s = &vgpu->submission;
+ struct list_head *q = workload_q_head(vgpu, ring_id);
+- struct intel_vgpu_workload *last_workload = get_last_workload(q);
++ struct intel_vgpu_workload *last_workload = NULL;
+ struct intel_vgpu_workload *workload = NULL;
+ struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
+ u64 ring_context_gpa;
+@@ -1320,15 +1317,20 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
+ head &= RB_HEAD_OFF_MASK;
+ tail &= RB_TAIL_OFF_MASK;
+
+- if (last_workload && same_context(&last_workload->ctx_desc, desc)) {
+- gvt_dbg_el("ring id %d cur workload == last\n", ring_id);
+- gvt_dbg_el("ctx head %x real head %lx\n", head,
+- last_workload->rb_tail);
+- /*
+- * cannot use guest context head pointer here,
+- * as it might not be updated at this time
+- */
+- head = last_workload->rb_tail;
++ list_for_each_entry_reverse(last_workload, q, list) {
++
++ if (same_context(&last_workload->ctx_desc, desc)) {
++ gvt_dbg_el("ring id %d cur workload == last\n",
++ ring_id);
++ gvt_dbg_el("ctx head %x real head %lx\n", head,
++ last_workload->rb_tail);
++ /*
++ * cannot use guest context head pointer here,
++ * as it might not be updated at this time
++ */
++ head = last_workload->rb_tail;
++ break;
++ }
+ }
+
+ gvt_dbg_el("ring id %d begin a new workload\n", ring_id);
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 96fb5f635314..cc4ea5502d6c 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -429,15 +429,15 @@ static int dsi_clk_init(struct msm_dsi_host *msm_host)
+ }
+
+ msm_host->byte_clk_src = clk_get_parent(msm_host->byte_clk);
+- if (!msm_host->byte_clk_src) {
+- ret = -ENODEV;
++ if (IS_ERR(msm_host->byte_clk_src)) {
++ ret = PTR_ERR(msm_host->byte_clk_src);
+ pr_err("%s: can't find byte_clk clock. ret=%d\n", __func__, ret);
+ goto exit;
+ }
+
+ msm_host->pixel_clk_src = clk_get_parent(msm_host->pixel_clk);
+- if (!msm_host->pixel_clk_src) {
+- ret = -ENODEV;
++ if (IS_ERR(msm_host->pixel_clk_src)) {
++ ret = PTR_ERR(msm_host->pixel_clk_src);
+ pr_err("%s: can't find pixel_clk clock. ret=%d\n", __func__, ret);
+ goto exit;
+ }
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index 5e01bfb69d7a..10107e551fac 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -1517,7 +1517,8 @@ nv50_sor_create(struct drm_connector *connector, struct dcb_output *dcbe)
+ nv_encoder->aux = aux;
+ }
+
+- if ((data = nvbios_dp_table(bios, &ver, &hdr, &cnt, &len)) &&
++ if (nv_connector->type != DCB_CONNECTOR_eDP &&
++ (data = nvbios_dp_table(bios, &ver, &hdr, &cnt, &len)) &&
+ ver >= 0x40 && (nvbios_rd08(bios, data + 0x08) & 0x04)) {
+ ret = nv50_mstm_new(nv_encoder, &nv_connector->aux, 16,
+ nv_connector->base.base.id,
+diff --git a/drivers/gpu/drm/omapdrm/dss/dss.c b/drivers/gpu/drm/omapdrm/dss/dss.c
+index cb80ddaa19d2..7e9e2f064454 100644
+--- a/drivers/gpu/drm/omapdrm/dss/dss.c
++++ b/drivers/gpu/drm/omapdrm/dss/dss.c
+@@ -1110,7 +1110,7 @@ static const struct dss_features omap34xx_dss_feats = {
+
+ static const struct dss_features omap3630_dss_feats = {
+ .model = DSS_MODEL_OMAP3,
+- .fck_div_max = 32,
++ .fck_div_max = 31,
+ .fck_freq_max = 173000000,
+ .dss_fck_multiplier = 1,
+ .parent_clk_name = "dpll4_ck",
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
+index 25b5407c74b5..d83310751a8e 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -340,8 +340,39 @@ static int radeon_kick_out_firmware_fb(struct pci_dev *pdev)
+ static int radeon_pci_probe(struct pci_dev *pdev,
+ const struct pci_device_id *ent)
+ {
++ unsigned long flags = 0;
+ int ret;
+
++ if (!ent)
++ return -ENODEV; /* Avoid NULL-ptr deref in drm_get_pci_dev */
++
++ flags = ent->driver_data;
++
++ if (!radeon_si_support) {
++ switch (flags & RADEON_FAMILY_MASK) {
++ case CHIP_TAHITI:
++ case CHIP_PITCAIRN:
++ case CHIP_VERDE:
++ case CHIP_OLAND:
++ case CHIP_HAINAN:
++ dev_info(&pdev->dev,
++ "SI support disabled by module param\n");
++ return -ENODEV;
++ }
++ }
++ if (!radeon_cik_support) {
++ switch (flags & RADEON_FAMILY_MASK) {
++ case CHIP_KAVERI:
++ case CHIP_BONAIRE:
++ case CHIP_HAWAII:
++ case CHIP_KABINI:
++ case CHIP_MULLINS:
++ dev_info(&pdev->dev,
++ "CIK support disabled by module param\n");
++ return -ENODEV;
++ }
++ }
++
+ if (vga_switcheroo_client_probe_defer(pdev))
+ return -EPROBE_DEFER;
+
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index 6a8fb6fd183c..3ff835767ac5 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -95,31 +95,6 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
+ struct radeon_device *rdev;
+ int r, acpi_status;
+
+- if (!radeon_si_support) {
+- switch (flags & RADEON_FAMILY_MASK) {
+- case CHIP_TAHITI:
+- case CHIP_PITCAIRN:
+- case CHIP_VERDE:
+- case CHIP_OLAND:
+- case CHIP_HAINAN:
+- dev_info(dev->dev,
+- "SI support disabled by module param\n");
+- return -ENODEV;
+- }
+- }
+- if (!radeon_cik_support) {
+- switch (flags & RADEON_FAMILY_MASK) {
+- case CHIP_KAVERI:
+- case CHIP_BONAIRE:
+- case CHIP_HAWAII:
+- case CHIP_KABINI:
+- case CHIP_MULLINS:
+- dev_info(dev->dev,
+- "CIK support disabled by module param\n");
+- return -ENODEV;
+- }
+- }
+-
+ rdev = kzalloc(sizeof(struct radeon_device), GFP_KERNEL);
+ if (rdev == NULL) {
+ return -ENOMEM;
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
+index 2bce7cf0b0af..e45b5ec2f451 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x.c
+@@ -174,6 +174,12 @@ static void etm4_enable_hw(void *info)
+ if (coresight_timeout(drvdata->base, TRCSTATR, TRCSTATR_IDLE_BIT, 0))
+ dev_err(drvdata->dev,
+ "timeout while waiting for Idle Trace Status\n");
++ /*
++ * As recommended by section 4.3.7 ("Synchronization when using the
++ * memory-mapped interface") of ARM IHI 0064D
++ */
++ dsb(sy);
++ isb();
+
+ CS_LOCK(drvdata->base);
+
+@@ -324,8 +330,12 @@ static void etm4_disable_hw(void *info)
+ /* EN, bit[0] Trace unit enable bit */
+ control &= ~0x1;
+
+- /* make sure everything completes before disabling */
+- mb();
++ /*
++ * Make sure everything completes before disabling, as recommended
++ * by section 7.3.77 ("TRCVICTLR, ViewInst Main Control Register,
++ * SSTATUS") of ARM IHI 0064D
++ */
++ dsb(sy);
+ isb();
+ writel_relaxed(control, drvdata->base + TRCPRGCTLR);
+
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index e5c598ae5f24..6627523e728b 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -480,7 +480,12 @@ static int esdhc_of_enable_dma(struct sdhci_host *host)
+ dma_set_mask_and_coherent(dev, DMA_BIT_MASK(40));
+
+ value = sdhci_readl(host, ESDHC_DMA_SYSCTL);
+- value |= ESDHC_DMA_SNOOP;
++
++ if (of_dma_is_coherent(dev->of_node))
++ value |= ESDHC_DMA_SNOOP;
++ else
++ value &= ~ESDHC_DMA_SNOOP;
++
+ sdhci_writel(host, value, ESDHC_DMA_SYSCTL);
+ return 0;
+ }
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index eb33b892b484..e99d5632d8fa 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2720,6 +2720,7 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p)
+ static void sdhci_adma_show_error(struct sdhci_host *host)
+ {
+ void *desc = host->adma_table;
++ dma_addr_t dma = host->adma_addr;
+
+ sdhci_dumpregs(host);
+
+@@ -2727,18 +2728,21 @@ static void sdhci_adma_show_error(struct sdhci_host *host)
+ struct sdhci_adma2_64_desc *dma_desc = desc;
+
+ if (host->flags & SDHCI_USE_64_BIT_DMA)
+- DBG("%p: DMA 0x%08x%08x, LEN 0x%04x, Attr=0x%02x\n",
+- desc, le32_to_cpu(dma_desc->addr_hi),
++ SDHCI_DUMP("%08llx: DMA 0x%08x%08x, LEN 0x%04x, Attr=0x%02x\n",
++ (unsigned long long)dma,
++ le32_to_cpu(dma_desc->addr_hi),
+ le32_to_cpu(dma_desc->addr_lo),
+ le16_to_cpu(dma_desc->len),
+ le16_to_cpu(dma_desc->cmd));
+ else
+- DBG("%p: DMA 0x%08x, LEN 0x%04x, Attr=0x%02x\n",
+- desc, le32_to_cpu(dma_desc->addr_lo),
++ SDHCI_DUMP("%08llx: DMA 0x%08x, LEN 0x%04x, Attr=0x%02x\n",
++ (unsigned long long)dma,
++ le32_to_cpu(dma_desc->addr_lo),
+ le16_to_cpu(dma_desc->len),
+ le16_to_cpu(dma_desc->cmd));
+
+ desc += host->desc_sz;
++ dma += host->desc_sz;
+
+ if (dma_desc->cmd & cpu_to_le16(ADMA2_END))
+ break;
+@@ -2814,7 +2818,8 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask)
+ != MMC_BUS_TEST_R)
+ host->data->error = -EILSEQ;
+ else if (intmask & SDHCI_INT_ADMA_ERROR) {
+- pr_err("%s: ADMA error\n", mmc_hostname(host->mmc));
++ pr_err("%s: ADMA error: 0x%08x\n", mmc_hostname(host->mmc),
++ intmask);
+ sdhci_adma_show_error(host);
+ host->data->error = -EIO;
+ if (host->ops->adma_workaround)
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index fccb6bf21fad..de8d9dceb123 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -626,7 +626,7 @@ static int mcp251x_setup(struct net_device *net, struct spi_device *spi)
+ static int mcp251x_hw_reset(struct spi_device *spi)
+ {
+ struct mcp251x_priv *priv = spi_get_drvdata(spi);
+- u8 reg;
++ unsigned long timeout;
+ int ret;
+
+ /* Wait for oscillator startup timer after power up */
+@@ -640,10 +640,19 @@ static int mcp251x_hw_reset(struct spi_device *spi)
+ /* Wait for oscillator startup timer after reset */
+ mdelay(MCP251X_OST_DELAY_MS);
+
+- reg = mcp251x_read_reg(spi, CANSTAT);
+- if ((reg & CANCTRL_REQOP_MASK) != CANCTRL_REQOP_CONF)
+- return -ENODEV;
+-
++ /* Wait for reset to finish */
++ timeout = jiffies + HZ;
++ while ((mcp251x_read_reg(spi, CANSTAT) & CANCTRL_REQOP_MASK) !=
++ CANCTRL_REQOP_CONF) {
++ usleep_range(MCP251X_OST_DELAY_MS * 1000,
++ MCP251X_OST_DELAY_MS * 1000 * 2);
++
++ if (time_after(jiffies, timeout)) {
++ dev_err(&spi->dev,
++ "MCP251x didn't enter in conf mode after reset\n");
++ return -EBUSY;
++ }
++ }
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
+index 22c572a09b32..c19e88efe958 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
+@@ -272,6 +272,7 @@ nfp_flower_spawn_vnic_reprs(struct nfp_app *app,
+ port = nfp_port_alloc(app, port_type, repr);
+ if (IS_ERR(port)) {
+ err = PTR_ERR(port);
++ kfree(repr_priv);
+ nfp_repr_free(repr);
+ goto err_reprs_clean;
+ }
+diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
+index 4f684cbcdc57..078027bbe002 100644
+--- a/drivers/net/ieee802154/atusb.c
++++ b/drivers/net/ieee802154/atusb.c
+@@ -1140,10 +1140,11 @@ static void atusb_disconnect(struct usb_interface *interface)
+
+ ieee802154_unregister_hw(atusb->hw);
+
++ usb_put_dev(atusb->usb_dev);
++
+ ieee802154_free_hw(atusb->hw);
+
+ usb_set_intfdata(interface, NULL);
+- usb_put_dev(atusb->usb_dev);
+
+ pr_debug("%s done\n", __func__);
+ }
+diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
+index 2a9d6b0d1f19..80508da3c8b5 100644
+--- a/drivers/ntb/test/ntb_perf.c
++++ b/drivers/ntb/test/ntb_perf.c
+@@ -1373,7 +1373,7 @@ static int perf_setup_peer_mw(struct perf_peer *peer)
+ int ret;
+
+ /* Get outbound MW parameters and map it */
+- ret = ntb_peer_mw_get_addr(perf->ntb, peer->gidx, &phys_addr,
++ ret = ntb_peer_mw_get_addr(perf->ntb, perf->gidx, &phys_addr,
+ &peer->outbuf_size);
+ if (ret)
+ return ret;
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 2ba22cd1331b..54a633e8cb5d 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -189,7 +189,7 @@ static int nvdimm_clear_badblocks_region(struct device *dev, void *data)
+ sector_t sector;
+
+ /* make sure device is a region */
+- if (!is_nd_pmem(dev))
++ if (!is_memory(dev))
+ return 0;
+
+ nd_region = to_nd_region(dev);
+diff --git a/drivers/nvdimm/region.c b/drivers/nvdimm/region.c
+index f9130cc157e8..22224b21c34d 100644
+--- a/drivers/nvdimm/region.c
++++ b/drivers/nvdimm/region.c
+@@ -42,7 +42,7 @@ static int nd_region_probe(struct device *dev)
+ if (rc)
+ return rc;
+
+- if (is_nd_pmem(&nd_region->dev)) {
++ if (is_memory(&nd_region->dev)) {
+ struct resource ndr_res;
+
+ if (devm_init_badblocks(dev, &nd_region->bb))
+@@ -131,7 +131,7 @@ static void nd_region_notify(struct device *dev, enum nvdimm_event event)
+ struct nd_region *nd_region = to_nd_region(dev);
+ struct resource res;
+
+- if (is_nd_pmem(&nd_region->dev)) {
++ if (is_memory(&nd_region->dev)) {
+ res.start = nd_region->ndr_start;
+ res.end = nd_region->ndr_start +
+ nd_region->ndr_size - 1;
+diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
+index 0303296e6d5b..609fc450522a 100644
+--- a/drivers/nvdimm/region_devs.c
++++ b/drivers/nvdimm/region_devs.c
+@@ -633,11 +633,11 @@ static umode_t region_visible(struct kobject *kobj, struct attribute *a, int n)
+ if (!is_memory(dev) && a == &dev_attr_dax_seed.attr)
+ return 0;
+
+- if (!is_nd_pmem(dev) && a == &dev_attr_badblocks.attr)
++ if (!is_memory(dev) && a == &dev_attr_badblocks.attr)
+ return 0;
+
+ if (a == &dev_attr_resource.attr) {
+- if (is_nd_pmem(dev))
++ if (is_memory(dev))
+ return 0400;
+ else
+ return 0;
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index fd2dbd7eed7b..52d4fa4161dc 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -31,6 +31,9 @@
+ #define PCI_REG_VMLOCK 0x70
+ #define MB2_SHADOW_EN(vmlock) (vmlock & 0x2)
+
++#define MB2_SHADOW_OFFSET 0x2000
++#define MB2_SHADOW_SIZE 16
++
+ enum vmd_features {
+ /*
+ * Device may contain registers which hint the physical location of the
+@@ -600,7 +603,7 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+ u32 vmlock;
+ int ret;
+
+- membar2_offset = 0x2018;
++ membar2_offset = MB2_SHADOW_OFFSET + MB2_SHADOW_SIZE;
+ ret = pci_read_config_dword(vmd->dev, PCI_REG_VMLOCK, &vmlock);
+ if (ret || vmlock == ~0)
+ return -ENODEV;
+@@ -612,9 +615,9 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+ if (!membar2)
+ return -ENOMEM;
+ offset[0] = vmd->dev->resource[VMD_MEMBAR1].start -
+- readq(membar2 + 0x2008);
++ readq(membar2 + MB2_SHADOW_OFFSET);
+ offset[1] = vmd->dev->resource[VMD_MEMBAR2].start -
+- readq(membar2 + 0x2010);
++ readq(membar2 + MB2_SHADOW_OFFSET + 8);
+ pci_iounmap(vmd->dev, membar2);
+ }
+ }
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index c65465385d8c..6384930a6749 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1366,7 +1366,7 @@ static void pci_restore_rebar_state(struct pci_dev *pdev)
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
+ bar_idx = ctrl & PCI_REBAR_CTRL_BAR_IDX;
+ res = pdev->resource + bar_idx;
+- size = order_base_2((resource_size(res) >> 20) | 1) - 1;
++ size = ilog2(resource_size(res)) - 20;
+ ctrl &= ~PCI_REBAR_CTRL_BAR_SIZE;
+ ctrl |= size << PCI_REBAR_CTRL_BAR_SHIFT;
+ pci_write_config_dword(pdev, pos + PCI_REBAR_CTRL, ctrl);
+diff --git a/drivers/power/supply/sbs-battery.c b/drivers/power/supply/sbs-battery.c
+index 8ba6abf584de..3958ee03eec1 100644
+--- a/drivers/power/supply/sbs-battery.c
++++ b/drivers/power/supply/sbs-battery.c
+@@ -323,17 +323,22 @@ static int sbs_get_battery_presence_and_health(
+ {
+ int ret;
+
+- if (psp == POWER_SUPPLY_PROP_PRESENT) {
+- /* Dummy command; if it succeeds, battery is present. */
+- ret = sbs_read_word_data(client, sbs_data[REG_STATUS].addr);
+- if (ret < 0)
+- val->intval = 0; /* battery disconnected */
+- else
+- val->intval = 1; /* battery present */
+- } else { /* POWER_SUPPLY_PROP_HEALTH */
++ /* Dummy command; if it succeeds, battery is present. */
++ ret = sbs_read_word_data(client, sbs_data[REG_STATUS].addr);
++
++ if (ret < 0) { /* battery not present*/
++ if (psp == POWER_SUPPLY_PROP_PRESENT) {
++ val->intval = 0;
++ return 0;
++ }
++ return ret;
++ }
++
++ if (psp == POWER_SUPPLY_PROP_PRESENT)
++ val->intval = 1; /* battery present */
++ else /* POWER_SUPPLY_PROP_HEALTH */
+ /* SBS spec doesn't have a general health command. */
+ val->intval = POWER_SUPPLY_HEALTH_UNKNOWN;
+- }
+
+ return 0;
+ }
+@@ -629,12 +634,14 @@ static int sbs_get_property(struct power_supply *psy,
+ switch (psp) {
+ case POWER_SUPPLY_PROP_PRESENT:
+ case POWER_SUPPLY_PROP_HEALTH:
+- if (client->flags & SBS_FLAGS_TI_BQ20Z75)
++ if (chip->flags & SBS_FLAGS_TI_BQ20Z75)
+ ret = sbs_get_ti_battery_presence_and_health(client,
+ psp, val);
+ else
+ ret = sbs_get_battery_presence_and_health(client, psp,
+ val);
++
++ /* this can only be true if no gpio is used */
+ if (psp == POWER_SUPPLY_PROP_PRESENT)
+ return 0;
+ break;
+diff --git a/drivers/pwm/pwm-stm32-lp.c b/drivers/pwm/pwm-stm32-lp.c
+index 0059b24cfdc3..28e1f6413476 100644
+--- a/drivers/pwm/pwm-stm32-lp.c
++++ b/drivers/pwm/pwm-stm32-lp.c
+@@ -58,6 +58,12 @@ static int stm32_pwm_lp_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ /* Calculate the period and prescaler value */
+ div = (unsigned long long)clk_get_rate(priv->clk) * state->period;
+ do_div(div, NSEC_PER_SEC);
++ if (!div) {
++ /* Clock is too slow to achieve requested period. */
++ dev_dbg(priv->chip.dev, "Can't reach %u ns\n", state->period);
++ return -EINVAL;
++ }
++
+ prd = div;
+ while (div > STM32_LPTIM_MAX_ARR) {
+ presc++;
+diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
+index 93b2862bd3fa..674d848e377c 100644
+--- a/drivers/s390/cio/ccwgroup.c
++++ b/drivers/s390/cio/ccwgroup.c
+@@ -372,7 +372,7 @@ int ccwgroup_create_dev(struct device *parent, struct ccwgroup_driver *gdrv,
+ goto error;
+ }
+ /* Check for trailing stuff. */
+- if (i == num_devices && strlen(buf) > 0) {
++ if (i == num_devices && buf && strlen(buf) > 0) {
+ rc = -EINVAL;
+ goto error;
+ }
+diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
+index aea502922646..df09ed53ab45 100644
+--- a/drivers/s390/cio/css.c
++++ b/drivers/s390/cio/css.c
+@@ -1213,6 +1213,8 @@ device_initcall(cio_settle_init);
+
+ int sch_is_pseudo_sch(struct subchannel *sch)
+ {
++ if (!sch->dev.parent)
++ return 0;
+ return sch == to_css(sch->dev.parent)->pseudo_subchannel;
+ }
+
+diff --git a/drivers/staging/erofs/dir.c b/drivers/staging/erofs/dir.c
+index 0a089cf5c78f..fe6683effd05 100644
+--- a/drivers/staging/erofs/dir.c
++++ b/drivers/staging/erofs/dir.c
+@@ -100,8 +100,15 @@ static int erofs_readdir(struct file *f, struct dir_context *ctx)
+ unsigned nameoff, maxsize;
+
+ dentry_page = read_mapping_page(mapping, i, NULL);
+- if (IS_ERR(dentry_page))
+- continue;
++ if (dentry_page == ERR_PTR(-ENOMEM)) {
++ err = -ENOMEM;
++ break;
++ } else if (IS_ERR(dentry_page)) {
++ errln("fail to readdir of logical block %u of nid %llu",
++ i, EROFS_V(dir)->nid);
++ err = PTR_ERR(dentry_page);
++ break;
++ }
+
+ lock_page(dentry_page);
+ de = (struct erofs_dirent *)kmap(dentry_page);
+diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c
+index ad6fe6d9d00a..0f1558c6747e 100644
+--- a/drivers/staging/erofs/unzip_vle.c
++++ b/drivers/staging/erofs/unzip_vle.c
+@@ -311,7 +311,11 @@ z_erofs_vle_work_lookup(struct super_block *sb,
+ /* if multiref is disabled, `primary' is always true */
+ primary = true;
+
+- DBG_BUGON(work->pageofs != pageofs);
++ if (work->pageofs != pageofs) {
++ DBG_BUGON(1);
++ erofs_workgroup_put(egrp);
++ return ERR_PTR(-EIO);
++ }
+
+ /*
+ * lock must be taken first to avoid grp->next == NIL between
+@@ -853,6 +857,7 @@ repeat:
+ for (i = 0; i < nr_pages; ++i)
+ pages[i] = NULL;
+
++ err = 0;
+ z_erofs_pagevec_ctor_init(&ctor,
+ Z_EROFS_VLE_INLINE_PAGEVECS, work->pagevec, 0);
+
+@@ -874,8 +879,17 @@ repeat:
+ pagenr = z_erofs_onlinepage_index(page);
+
+ DBG_BUGON(pagenr >= nr_pages);
+- DBG_BUGON(pages[pagenr]);
+
++ /*
++ * currently EROFS doesn't support multiref(dedup),
++ * so here erroring out one multiref page.
++ */
++ if (pages[pagenr]) {
++ DBG_BUGON(1);
++ SetPageError(pages[pagenr]);
++ z_erofs_onlinepage_endio(pages[pagenr]);
++ err = -EIO;
++ }
+ pages[pagenr] = page;
+ }
+ sparsemem_pages = i;
+@@ -885,7 +899,6 @@ repeat:
+ overlapped = false;
+ compressed_pages = grp->compressed_pages;
+
+- err = 0;
+ for (i = 0; i < clusterpages; ++i) {
+ unsigned pagenr;
+
+@@ -911,7 +924,12 @@ repeat:
+ pagenr = z_erofs_onlinepage_index(page);
+
+ DBG_BUGON(pagenr >= nr_pages);
+- DBG_BUGON(pages[pagenr]);
++ if (pages[pagenr]) {
++ DBG_BUGON(1);
++ SetPageError(pages[pagenr]);
++ z_erofs_onlinepage_endio(pages[pagenr]);
++ err = -EIO;
++ }
+ ++sparsemem_pages;
+ pages[pagenr] = page;
+
+@@ -1335,19 +1353,18 @@ static int z_erofs_vle_normalaccess_readpage(struct file *file,
+ err = z_erofs_do_read_page(&f, page, &pagepool);
+ (void)z_erofs_vle_work_iter_end(&f.builder);
+
+- if (err) {
++ /* if some compressed cluster ready, need submit them anyway */
++ z_erofs_submit_and_unzip(&f, &pagepool, true);
++
++ if (err)
+ errln("%s, failed to read, err [%d]", __func__, err);
+- goto out;
+- }
+
+- z_erofs_submit_and_unzip(&f, &pagepool, true);
+-out:
+ if (f.m_iter.mpage != NULL)
+ put_page(f.m_iter.mpage);
+
+ /* clean up the remaining free pages */
+ put_pages_list(&pagepool);
+- return 0;
++ return err;
+ }
+
+ static inline int __z_erofs_vle_normalaccess_readpages(
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index bf9721fc2824..be3eafc7682b 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -296,7 +296,7 @@ static void thermal_zone_device_set_polling(struct thermal_zone_device *tz,
+ mod_delayed_work(system_freezable_wq, &tz->poll_queue,
+ msecs_to_jiffies(delay));
+ else
+- cancel_delayed_work(&tz->poll_queue);
++ cancel_delayed_work_sync(&tz->poll_queue);
+ }
+
+ static void monitor_thermal_zone(struct thermal_zone_device *tz)
+diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
+index 40c69a533b24..dd5d8ee37928 100644
+--- a/drivers/thermal/thermal_hwmon.c
++++ b/drivers/thermal/thermal_hwmon.c
+@@ -87,13 +87,17 @@ static struct thermal_hwmon_device *
+ thermal_hwmon_lookup_by_type(const struct thermal_zone_device *tz)
+ {
+ struct thermal_hwmon_device *hwmon;
++ char type[THERMAL_NAME_LENGTH];
+
+ mutex_lock(&thermal_hwmon_list_lock);
+- list_for_each_entry(hwmon, &thermal_hwmon_list, node)
+- if (!strcmp(hwmon->type, tz->type)) {
++ list_for_each_entry(hwmon, &thermal_hwmon_list, node) {
++ strcpy(type, tz->type);
++ strreplace(type, '-', '_');
++ if (!strcmp(hwmon->type, type)) {
+ mutex_unlock(&thermal_hwmon_list_lock);
+ return hwmon;
+ }
++ }
+ mutex_unlock(&thermal_hwmon_list_lock);
+
+ return NULL;
+diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c
+index 1abe4d021fd2..ffde179a9bb2 100644
+--- a/drivers/watchdog/aspeed_wdt.c
++++ b/drivers/watchdog/aspeed_wdt.c
+@@ -38,6 +38,7 @@ static const struct aspeed_wdt_config ast2500_config = {
+ static const struct of_device_id aspeed_wdt_of_table[] = {
+ { .compatible = "aspeed,ast2400-wdt", .data = &ast2400_config },
+ { .compatible = "aspeed,ast2500-wdt", .data = &ast2500_config },
++ { .compatible = "aspeed,ast2600-wdt", .data = &ast2500_config },
+ { },
+ };
+ MODULE_DEVICE_TABLE(of, aspeed_wdt_of_table);
+@@ -264,7 +265,8 @@ static int aspeed_wdt_probe(struct platform_device *pdev)
+ set_bit(WDOG_HW_RUNNING, &wdt->wdd.status);
+ }
+
+- if (of_device_is_compatible(np, "aspeed,ast2500-wdt")) {
++ if ((of_device_is_compatible(np, "aspeed,ast2500-wdt")) ||
++ (of_device_is_compatible(np, "aspeed,ast2600-wdt"))) {
+ u32 reg = readl(wdt->base + WDT_RESET_WIDTH);
+
+ reg &= config->ext_pulse_width_mask;
+diff --git a/drivers/watchdog/imx2_wdt.c b/drivers/watchdog/imx2_wdt.c
+index 7e7bdcbbc741..9f3123b04536 100644
+--- a/drivers/watchdog/imx2_wdt.c
++++ b/drivers/watchdog/imx2_wdt.c
+@@ -55,7 +55,7 @@
+
+ #define IMX2_WDT_WMCR 0x08 /* Misc Register */
+
+-#define IMX2_WDT_MAX_TIME 128
++#define IMX2_WDT_MAX_TIME 128U
+ #define IMX2_WDT_DEFAULT_TIME 60 /* in seconds */
+
+ #define WDOG_SEC_TO_COUNT(s) ((s * 2 - 1) << 8)
+@@ -180,7 +180,7 @@ static int imx2_wdt_set_timeout(struct watchdog_device *wdog,
+ {
+ unsigned int actual;
+
+- actual = min(new_timeout, wdog->max_hw_heartbeat_ms * 1000);
++ actual = min(new_timeout, IMX2_WDT_MAX_TIME);
+ __imx2_wdt_set_timeout(wdog, actual);
+ wdog->timeout = new_timeout;
+ return 0;
+diff --git a/drivers/xen/pci.c b/drivers/xen/pci.c
+index 7494dbeb4409..db58aaa4dc59 100644
+--- a/drivers/xen/pci.c
++++ b/drivers/xen/pci.c
+@@ -29,6 +29,8 @@
+ #include "../pci/pci.h"
+ #ifdef CONFIG_PCI_MMCONFIG
+ #include <asm/pci_x86.h>
++
++static int xen_mcfg_late(void);
+ #endif
+
+ static bool __read_mostly pci_seg_supported = true;
+@@ -40,7 +42,18 @@ static int xen_add_device(struct device *dev)
+ #ifdef CONFIG_PCI_IOV
+ struct pci_dev *physfn = pci_dev->physfn;
+ #endif
+-
++#ifdef CONFIG_PCI_MMCONFIG
++ static bool pci_mcfg_reserved = false;
++ /*
++ * Reserve MCFG areas in Xen on first invocation due to this being
++ * potentially called from inside of acpi_init immediately after
++ * MCFG table has been finally parsed.
++ */
++ if (!pci_mcfg_reserved) {
++ xen_mcfg_late();
++ pci_mcfg_reserved = true;
++ }
++#endif
+ if (pci_seg_supported) {
+ struct {
+ struct physdev_pci_device_add add;
+@@ -213,7 +226,7 @@ static int __init register_xen_pci_notifier(void)
+ arch_initcall(register_xen_pci_notifier);
+
+ #ifdef CONFIG_PCI_MMCONFIG
+-static int __init xen_mcfg_late(void)
++static int xen_mcfg_late(void)
+ {
+ struct pci_mmcfg_region *cfg;
+ int rc;
+@@ -252,8 +265,4 @@ static int __init xen_mcfg_late(void)
+ }
+ return 0;
+ }
+-/*
+- * Needs to be done after acpi_init which are subsys_initcall.
+- */
+-subsys_initcall_sync(xen_mcfg_late);
+ #endif
+diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
+index 39c63152a358..454c6826abdb 100644
+--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
+@@ -55,6 +55,7 @@
+ #include <linux/string.h>
+ #include <linux/slab.h>
+ #include <linux/miscdevice.h>
++#include <linux/workqueue.h>
+
+ #include <xen/xenbus.h>
+ #include <xen/xen.h>
+@@ -116,6 +117,8 @@ struct xenbus_file_priv {
+ wait_queue_head_t read_waitq;
+
+ struct kref kref;
++
++ struct work_struct wq;
+ };
+
+ /* Read out any raw xenbus messages queued up. */
+@@ -300,14 +303,14 @@ static void watch_fired(struct xenbus_watch *watch,
+ mutex_unlock(&adap->dev_data->reply_mutex);
+ }
+
+-static void xenbus_file_free(struct kref *kref)
++static void xenbus_worker(struct work_struct *wq)
+ {
+ struct xenbus_file_priv *u;
+ struct xenbus_transaction_holder *trans, *tmp;
+ struct watch_adapter *watch, *tmp_watch;
+ struct read_buffer *rb, *tmp_rb;
+
+- u = container_of(kref, struct xenbus_file_priv, kref);
++ u = container_of(wq, struct xenbus_file_priv, wq);
+
+ /*
+ * No need for locking here because there are no other users,
+@@ -333,6 +336,18 @@ static void xenbus_file_free(struct kref *kref)
+ kfree(u);
+ }
+
++static void xenbus_file_free(struct kref *kref)
++{
++ struct xenbus_file_priv *u;
++
++ /*
++ * We might be called in xenbus_thread().
++ * Use workqueue to avoid deadlock.
++ */
++ u = container_of(kref, struct xenbus_file_priv, kref);
++ schedule_work(&u->wq);
++}
++
+ static struct xenbus_transaction_holder *xenbus_get_transaction(
+ struct xenbus_file_priv *u, uint32_t tx_id)
+ {
+@@ -652,6 +667,7 @@ static int xenbus_file_open(struct inode *inode, struct file *filp)
+ INIT_LIST_HEAD(&u->watches);
+ INIT_LIST_HEAD(&u->read_buffers);
+ init_waitqueue_head(&u->read_waitq);
++ INIT_WORK(&u->wq, xenbus_worker);
+
+ mutex_init(&u->reply_mutex);
+ mutex_init(&u->msgbuffer_mutex);
+diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
+index 05454a7e22dc..550d0b169d7c 100644
+--- a/fs/9p/vfs_file.c
++++ b/fs/9p/vfs_file.c
+@@ -528,6 +528,7 @@ v9fs_mmap_file_mmap(struct file *filp, struct vm_area_struct *vma)
+ v9inode = V9FS_I(inode);
+ mutex_lock(&v9inode->v_mutex);
+ if (!v9inode->writeback_fid &&
++ (vma->vm_flags & VM_SHARED) &&
+ (vma->vm_flags & VM_WRITE)) {
+ /*
+ * clone a fid and add it to writeback_fid
+@@ -629,6 +630,8 @@ static void v9fs_mmap_vm_close(struct vm_area_struct *vma)
+ (vma->vm_end - vma->vm_start - 1),
+ };
+
++ if (!(vma->vm_flags & VM_SHARED))
++ return;
+
+ p9_debug(P9_DEBUG_VFS, "9p VMA close, %p, flushing", vma);
+
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index c06845237cba..8196c21d8623 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -807,7 +807,12 @@ static int fill_inode(struct inode *inode, struct page *locked_page,
+
+ /* update inode */
+ inode->i_rdev = le32_to_cpu(info->rdev);
+- inode->i_blkbits = fls(le32_to_cpu(info->layout.fl_stripe_unit)) - 1;
++ /* directories have fl_stripe_unit set to zero */
++ if (le32_to_cpu(info->layout.fl_stripe_unit))
++ inode->i_blkbits =
++ fls(le32_to_cpu(info->layout.fl_stripe_unit)) - 1;
++ else
++ inode->i_blkbits = CEPH_BLOCK_SHIFT;
+
+ __ceph_update_quota(ci, iinfo->max_bytes, iinfo->max_files);
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index bfcf11c70bfa..09db6d08614d 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -3640,7 +3640,9 @@ static void delayed_work(struct work_struct *work)
+ pr_info("mds%d hung\n", s->s_mds);
+ }
+ }
+- if (s->s_state < CEPH_MDS_SESSION_OPEN) {
++ if (s->s_state == CEPH_MDS_SESSION_NEW ||
++ s->s_state == CEPH_MDS_SESSION_RESTARTING ||
++ s->s_state == CEPH_MDS_SESSION_REJECTED) {
+ /* this mds is failed or recovering, just wait */
+ ceph_put_mds_session(s);
+ continue;
+diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
+index 8f68181256c0..f057c213c453 100644
+--- a/fs/fuse/cuse.c
++++ b/fs/fuse/cuse.c
+@@ -518,6 +518,7 @@ static int cuse_channel_open(struct inode *inode, struct file *file)
+ rc = cuse_send_init(cc);
+ if (rc) {
+ fuse_dev_free(fud);
++ fuse_conn_put(&cc->fc);
+ return rc;
+ }
+ file->private_data = fud;
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index b7bde12d8cd5..1c0227c78a7b 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -1171,7 +1171,7 @@ static void encode_attrs(struct xdr_stream *xdr, const struct iattr *iap,
+ } else
+ *p++ = cpu_to_be32(NFS4_SET_TO_SERVER_TIME);
+ }
+- if (bmval[2] & FATTR4_WORD2_SECURITY_LABEL) {
++ if (label && (bmval[2] & FATTR4_WORD2_SECURITY_LABEL)) {
+ *p++ = cpu_to_be32(label->lfs);
+ *p++ = cpu_to_be32(label->pi);
+ *p++ = cpu_to_be32(label->len);
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 4931c3a75f03..c818f9886f61 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1426,10 +1426,15 @@ void pnfs_roc_release(struct nfs4_layoutreturn_args *args,
+ const nfs4_stateid *res_stateid = NULL;
+ struct nfs4_xdr_opaque_data *ld_private = args->ld_private;
+
+- if (ret == 0) {
+- arg_stateid = &args->stateid;
++ switch (ret) {
++ case -NFS4ERR_NOMATCHING_LAYOUT:
++ break;
++ case 0:
+ if (res->lrs_present)
+ res_stateid = &res->stateid;
++ /* Fallthrough */
++ default:
++ arg_stateid = &args->stateid;
+ }
+ pnfs_layoutreturn_free_lsegs(lo, arg_stateid, &args->range,
+ res_stateid);
+diff --git a/fs/statfs.c b/fs/statfs.c
+index f0216629621d..56f655f757ff 100644
+--- a/fs/statfs.c
++++ b/fs/statfs.c
+@@ -304,19 +304,10 @@ COMPAT_SYSCALL_DEFINE2(fstatfs, unsigned int, fd, struct compat_statfs __user *,
+ static int put_compat_statfs64(struct compat_statfs64 __user *ubuf, struct kstatfs *kbuf)
+ {
+ struct compat_statfs64 buf;
+- if (sizeof(ubuf->f_bsize) == 4) {
+- if ((kbuf->f_type | kbuf->f_bsize | kbuf->f_namelen |
+- kbuf->f_frsize | kbuf->f_flags) & 0xffffffff00000000ULL)
+- return -EOVERFLOW;
+- /* f_files and f_ffree may be -1; it's okay
+- * to stuff that into 32 bits */
+- if (kbuf->f_files != 0xffffffffffffffffULL
+- && (kbuf->f_files & 0xffffffff00000000ULL))
+- return -EOVERFLOW;
+- if (kbuf->f_ffree != 0xffffffffffffffffULL
+- && (kbuf->f_ffree & 0xffffffff00000000ULL))
+- return -EOVERFLOW;
+- }
++
++ if ((kbuf->f_bsize | kbuf->f_frsize) & 0xffffffff00000000ULL)
++ return -EOVERFLOW;
++
+ memset(&buf, 0, sizeof(struct compat_statfs64));
+ buf.f_type = kbuf->f_type;
+ buf.f_bsize = kbuf->f_bsize;
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index 9c03a7d5e400..c83478271c2e 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -3185,4 +3185,57 @@ static inline bool ieee80211_action_contains_tpc(struct sk_buff *skb)
+ return true;
+ }
+
++struct element {
++ u8 id;
++ u8 datalen;
++ u8 data[];
++} __packed;
++
++/* element iteration helpers */
++#define for_each_element(_elem, _data, _datalen) \
++ for (_elem = (const struct element *)(_data); \
++ (const u8 *)(_data) + (_datalen) - (const u8 *)_elem >= \
++ (int)sizeof(*_elem) && \
++ (const u8 *)(_data) + (_datalen) - (const u8 *)_elem >= \
++ (int)sizeof(*_elem) + _elem->datalen; \
++ _elem = (const struct element *)(_elem->data + _elem->datalen))
++
++#define for_each_element_id(element, _id, data, datalen) \
++ for_each_element(element, data, datalen) \
++ if (element->id == (_id))
++
++#define for_each_element_extid(element, extid, data, datalen) \
++ for_each_element(element, data, datalen) \
++ if (element->id == WLAN_EID_EXTENSION && \
++ element->datalen > 0 && \
++ element->data[0] == (extid))
++
++#define for_each_subelement(sub, element) \
++ for_each_element(sub, (element)->data, (element)->datalen)
++
++#define for_each_subelement_id(sub, id, element) \
++ for_each_element_id(sub, id, (element)->data, (element)->datalen)
++
++#define for_each_subelement_extid(sub, extid, element) \
++ for_each_element_extid(sub, extid, (element)->data, (element)->datalen)
++
++/**
++ * for_each_element_completed - determine if element parsing consumed all data
++ * @element: element pointer after for_each_element() or friends
++ * @data: same data pointer as passed to for_each_element() or friends
++ * @datalen: same data length as passed to for_each_element() or friends
++ *
++ * This function returns %true if all the data was parsed or considered
++ * while walking the elements. Only use this if your for_each_element()
++ * loop cannot be broken out of, otherwise it always returns %false.
++ *
++ * If some data was malformed, this returns %false since the last parsed
++ * element will not fill the whole remaining data.
++ */
++static inline bool for_each_element_completed(const struct element *element,
++ const void *data, size_t datalen)
++{
++ return (const u8 *)element == (const u8 *)data + datalen;
++}
++
+ #endif /* LINUX_IEEE80211_H */
+diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
+index 0d10b7ce0da7..e9d4e389aed9 100644
+--- a/include/linux/sched/mm.h
++++ b/include/linux/sched/mm.h
+@@ -330,6 +330,8 @@ enum {
+
+ static inline void membarrier_mm_sync_core_before_usermode(struct mm_struct *mm)
+ {
++ if (current->mm != mm)
++ return;
+ if (likely(!(atomic_read(&mm->membarrier_state) &
+ MEMBARRIER_STATE_PRIVATE_EXPEDITED_SYNC_CORE)))
+ return;
+diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
+index fdaaafdc7a00..5165e3b30899 100644
+--- a/include/sound/soc-dapm.h
++++ b/include/sound/soc-dapm.h
+@@ -353,6 +353,8 @@ struct device;
+ #define SND_SOC_DAPM_WILL_PMD 0x80 /* called at start of sequence */
+ #define SND_SOC_DAPM_PRE_POST_PMD \
+ (SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD)
++#define SND_SOC_DAPM_PRE_POST_PMU \
++ (SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU)
+
+ /* convenience event type detection */
+ #define SND_SOC_DAPM_EVENT_ON(e) \
+diff --git a/kernel/elfcore.c b/kernel/elfcore.c
+index fc482c8e0bd8..57fb4dcff434 100644
+--- a/kernel/elfcore.c
++++ b/kernel/elfcore.c
+@@ -3,6 +3,7 @@
+ #include <linux/fs.h>
+ #include <linux/mm.h>
+ #include <linux/binfmts.h>
++#include <linux/elfcore.h>
+
+ Elf_Half __weak elf_core_extra_phdrs(void)
+ {
+diff --git a/kernel/locking/qspinlock_paravirt.h b/kernel/locking/qspinlock_paravirt.h
+index 5a0cf5f9008c..82104d3dd18e 100644
+--- a/kernel/locking/qspinlock_paravirt.h
++++ b/kernel/locking/qspinlock_paravirt.h
+@@ -271,7 +271,7 @@ pv_wait_early(struct pv_node *prev, int loop)
+ if ((loop & PV_PREV_CHECK_MASK) != 0)
+ return false;
+
+- return READ_ONCE(prev->state) != vcpu_running || vcpu_is_preempted(prev->cpu);
++ return READ_ONCE(prev->state) != vcpu_running;
+ }
+
+ /*
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index f4e050681ba1..78ecdfae25b6 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1077,7 +1077,8 @@ static int __set_cpus_allowed_ptr(struct task_struct *p,
+ if (cpumask_equal(&p->cpus_allowed, new_mask))
+ goto out;
+
+- if (!cpumask_intersects(new_mask, cpu_valid_mask)) {
++ dest_cpu = cpumask_any_and(cpu_valid_mask, new_mask);
++ if (dest_cpu >= nr_cpu_ids) {
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -1098,7 +1099,6 @@ static int __set_cpus_allowed_ptr(struct task_struct *p,
+ if (cpumask_test_cpu(task_cpu(p), new_mask))
+ goto out;
+
+- dest_cpu = cpumask_any_and(cpu_valid_mask, new_mask);
+ if (task_running(rq, p) || p->state == TASK_WAKING) {
+ struct migration_arg arg = { p, dest_cpu };
+ /* Need help from migration thread: drop lock and wait. */
+diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c
+index 76e0eaf4654e..dd27e632b1ba 100644
+--- a/kernel/sched/membarrier.c
++++ b/kernel/sched/membarrier.c
+@@ -235,7 +235,7 @@ static int membarrier_register_private_expedited(int flags)
+ * groups, which use the same mm. (CLONE_VM but not
+ * CLONE_THREAD).
+ */
+- if (atomic_read(&mm->membarrier_state) & state)
++ if ((atomic_read(&mm->membarrier_state) & state) == state)
+ return 0;
+ atomic_or(MEMBARRIER_STATE_PRIVATE_EXPEDITED, &mm->membarrier_state);
+ if (flags & MEMBARRIER_FLAG_SYNC_CORE)
+diff --git a/kernel/time/tick-broadcast-hrtimer.c b/kernel/time/tick-broadcast-hrtimer.c
+index a59641fb88b6..a836efd34589 100644
+--- a/kernel/time/tick-broadcast-hrtimer.c
++++ b/kernel/time/tick-broadcast-hrtimer.c
+@@ -44,34 +44,39 @@ static int bc_shutdown(struct clock_event_device *evt)
+ */
+ static int bc_set_next(ktime_t expires, struct clock_event_device *bc)
+ {
+- int bc_moved;
+ /*
+- * We try to cancel the timer first. If the callback is on
+- * flight on some other cpu then we let it handle it. If we
+- * were able to cancel the timer nothing can rearm it as we
+- * own broadcast_lock.
++ * This is called either from enter/exit idle code or from the
++ * broadcast handler. In all cases tick_broadcast_lock is held.
+ *
+- * However we can also be called from the event handler of
+- * ce_broadcast_hrtimer itself when it expires. We cannot
+- * restart the timer because we are in the callback, but we
+- * can set the expiry time and let the callback return
+- * HRTIMER_RESTART.
++ * hrtimer_cancel() cannot be called here neither from the
++ * broadcast handler nor from the enter/exit idle code. The idle
++ * code can run into the problem described in bc_shutdown() and the
++ * broadcast handler cannot wait for itself to complete for obvious
++ * reasons.
+ *
+- * Since we are in the idle loop at this point and because
+- * hrtimer_{start/cancel} functions call into tracing,
+- * calls to these functions must be bound within RCU_NONIDLE.
++ * Each caller tries to arm the hrtimer on its own CPU, but if the
++ * hrtimer callbback function is currently running, then
++ * hrtimer_start() cannot move it and the timer stays on the CPU on
++ * which it is assigned at the moment.
++ *
++ * As this can be called from idle code, the hrtimer_start()
++ * invocation has to be wrapped with RCU_NONIDLE() as
++ * hrtimer_start() can call into tracing.
+ */
+- RCU_NONIDLE({
+- bc_moved = hrtimer_try_to_cancel(&bctimer) >= 0;
+- if (bc_moved)
+- hrtimer_start(&bctimer, expires,
+- HRTIMER_MODE_ABS_PINNED);});
+- if (bc_moved) {
+- /* Bind the "device" to the cpu */
+- bc->bound_on = smp_processor_id();
+- } else if (bc->bound_on == smp_processor_id()) {
+- hrtimer_set_expires(&bctimer, expires);
+- }
++ RCU_NONIDLE( {
++ hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED);
++ /*
++ * The core tick broadcast mode expects bc->bound_on to be set
++ * correctly to prevent a CPU which has the broadcast hrtimer
++ * armed from going deep idle.
++ *
++ * As tick_broadcast_lock is held, nothing can change the cpu
++ * base which was just established in hrtimer_start() above. So
++ * the below access is safe even without holding the hrtimer
++ * base lock.
++ */
++ bc->bound_on = bctimer.base->cpu_base->cpu;
++ } );
+ return 0;
+ }
+
+@@ -97,10 +102,6 @@ static enum hrtimer_restart bc_handler(struct hrtimer *t)
+ {
+ ce_broadcast_hrtimer.event_handler(&ce_broadcast_hrtimer);
+
+- if (clockevent_state_oneshot(&ce_broadcast_hrtimer))
+- if (ce_broadcast_hrtimer.next_event != KTIME_MAX)
+- return HRTIMER_RESTART;
+-
+ return HRTIMER_NORESTART;
+ }
+
+diff --git a/kernel/time/timer.c b/kernel/time/timer.c
+index fa49cd753dea..ae64cb819a9a 100644
+--- a/kernel/time/timer.c
++++ b/kernel/time/timer.c
+@@ -1590,24 +1590,26 @@ void timer_clear_idle(void)
+ static int collect_expired_timers(struct timer_base *base,
+ struct hlist_head *heads)
+ {
++ unsigned long now = READ_ONCE(jiffies);
++
+ /*
+ * NOHZ optimization. After a long idle sleep we need to forward the
+ * base to current jiffies. Avoid a loop by searching the bitfield for
+ * the next expiring timer.
+ */
+- if ((long)(jiffies - base->clk) > 2) {
++ if ((long)(now - base->clk) > 2) {
+ unsigned long next = __next_timer_interrupt(base);
+
+ /*
+ * If the next timer is ahead of time forward to current
+ * jiffies, otherwise forward to the next expiry time:
+ */
+- if (time_after(next, jiffies)) {
++ if (time_after(next, now)) {
+ /*
+ * The call site will increment base->clk and then
+ * terminate the expiry loop immediately.
+ */
+- base->clk = jiffies;
++ base->clk = now;
+ return 0;
+ }
+ base->clk = next;
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 3f34cfb66a85..bdf104596d12 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -2526,6 +2526,8 @@ static struct hist_field *create_alias(struct hist_trigger_data *hist_data,
+ return NULL;
+ }
+
++ alias->var_ref_idx = var_ref->var_ref_idx;
++
+ return alias;
+ }
+
+diff --git a/mm/usercopy.c b/mm/usercopy.c
+index 51411f9c4068..e81d11715d95 100644
+--- a/mm/usercopy.c
++++ b/mm/usercopy.c
+@@ -15,6 +15,7 @@
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+ #include <linux/mm.h>
++#include <linux/highmem.h>
+ #include <linux/slab.h>
+ #include <linux/sched.h>
+ #include <linux/sched/task.h>
+@@ -231,7 +232,12 @@ static inline void check_heap_object(const void *ptr, unsigned long n,
+ if (!virt_addr_valid(ptr))
+ return;
+
+- page = virt_to_head_page(ptr);
++ /*
++ * When CONFIG_HIGHMEM=y, kmap_to_page() will give either the
++ * highmem page or fallback to virt_to_page(). The following
++ * is effectively a highmem-aware virt_to_head_page().
++ */
++ page = compound_head(kmap_to_page((void *)ptr));
+
+ if (PageSlab(page)) {
+ /* Check slab allocator for flags and size. */
+diff --git a/net/9p/client.c b/net/9p/client.c
+index b615aae5a0f8..d62f83f93d7b 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -296,6 +296,7 @@ p9_tag_alloc(struct p9_client *c, int8_t type, unsigned int max_size)
+
+ p9pdu_reset(&req->tc);
+ p9pdu_reset(&req->rc);
++ req->t_err = 0;
+ req->status = REQ_STATUS_ALLOC;
+ init_waitqueue_head(&req->wq);
+ INIT_LIST_HEAD(&req->req_list);
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 2145581d7b3d..24fddf032279 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3429,8 +3429,11 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
+ NFT_SET_OBJECT))
+ return -EINVAL;
+ /* Only one of these operations is supported */
+- if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
+- (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
++ if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
++ (NFT_SET_MAP | NFT_SET_OBJECT))
++ return -EOPNOTSUPP;
++ if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
++ (NFT_SET_EVAL | NFT_SET_OBJECT))
+ return -EOPNOTSUPP;
+ }
+
+diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
+index 161c3451a747..55754d9939b5 100644
+--- a/net/netfilter/nft_lookup.c
++++ b/net/netfilter/nft_lookup.c
+@@ -76,9 +76,6 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
+ if (IS_ERR(set))
+ return PTR_ERR(set);
+
+- if (set->flags & NFT_SET_EVAL)
+- return -EOPNOTSUPP;
+-
+ priv->sreg = nft_parse_register(tb[NFTA_LOOKUP_SREG]);
+ err = nft_validate_register_load(priv->sreg, set->klen);
+ if (err < 0)
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 6168db3c35e4..334e3181f1c5 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -200,6 +200,38 @@ cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
+ return __cfg80211_rdev_from_attrs(netns, info->attrs);
+ }
+
++static int validate_beacon_head(const struct nlattr *attr,
++ struct netlink_ext_ack *extack)
++{
++ const u8 *data = nla_data(attr);
++ unsigned int len = nla_len(attr);
++ const struct element *elem;
++ const struct ieee80211_mgmt *mgmt = (void *)data;
++ unsigned int fixedlen = offsetof(struct ieee80211_mgmt,
++ u.beacon.variable);
++
++ if (len < fixedlen)
++ goto err;
++
++ if (ieee80211_hdrlen(mgmt->frame_control) !=
++ offsetof(struct ieee80211_mgmt, u.beacon))
++ goto err;
++
++ data += fixedlen;
++ len -= fixedlen;
++
++ for_each_element(elem, data, len) {
++ /* nothing */
++ }
++
++ if (for_each_element_completed(elem, data, len))
++ return 0;
++
++err:
++ NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
++ return -EINVAL;
++}
++
+ /* policy for the attributes */
+ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
+@@ -2299,6 +2331,8 @@ static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
+
+ control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
+
++ memset(chandef, 0, sizeof(*chandef));
++
+ chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
+ chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
+ chandef->center_freq1 = control_freq;
+@@ -2819,7 +2853,7 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flag
+
+ if (rdev->ops->get_channel) {
+ int ret;
+- struct cfg80211_chan_def chandef;
++ struct cfg80211_chan_def chandef = {};
+
+ ret = rdev_get_channel(rdev, wdev, &chandef);
+ if (ret == 0) {
+@@ -4014,6 +4048,12 @@ static int nl80211_parse_beacon(struct nlattr *attrs[],
+ memset(bcn, 0, sizeof(*bcn));
+
+ if (attrs[NL80211_ATTR_BEACON_HEAD]) {
++ int ret = validate_beacon_head(attrs[NL80211_ATTR_BEACON_HEAD],
++ NULL);
++
++ if (ret)
++ return ret;
++
+ bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
+ bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
+ if (!bcn->head_len)
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index d8ebf4f0ef6e..cccbf845079c 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2095,7 +2095,7 @@ static void reg_call_notifier(struct wiphy *wiphy,
+
+ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
+ {
+- struct cfg80211_chan_def chandef;
++ struct cfg80211_chan_def chandef = {};
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+ enum nl80211_iftype iftype;
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index d0e7472dd9fd..e5d61ba837ad 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -484,6 +484,8 @@ const u8 *cfg80211_find_ie_match(u8 eid, const u8 *ies, int len,
+ const u8 *match, int match_len,
+ int match_offset)
+ {
++ const struct element *elem;
++
+ /* match_offset can't be smaller than 2, unless match_len is
+ * zero, in which case match_offset must be zero as well.
+ */
+@@ -491,14 +493,10 @@ const u8 *cfg80211_find_ie_match(u8 eid, const u8 *ies, int len,
+ (!match_len && match_offset)))
+ return NULL;
+
+- while (len >= 2 && len >= ies[1] + 2) {
+- if ((ies[0] == eid) &&
+- (ies[1] + 2 >= match_offset + match_len) &&
+- !memcmp(ies + match_offset, match, match_len))
+- return ies;
+-
+- len -= ies[1] + 2;
+- ies += ies[1] + 2;
++ for_each_element_id(elem, eid, ies, len) {
++ if (elem->datalen >= match_offset - 2 + match_len &&
++ !memcmp(elem->data + match_offset - 2, match, match_len))
++ return (void *)elem;
+ }
+
+ return NULL;
+diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
+index 06943d9c9835..4f0cfb8cc682 100644
+--- a/net/wireless/wext-compat.c
++++ b/net/wireless/wext-compat.c
+@@ -800,7 +800,7 @@ static int cfg80211_wext_giwfreq(struct net_device *dev,
+ {
+ struct wireless_dev *wdev = dev->ieee80211_ptr;
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+- struct cfg80211_chan_def chandef;
++ struct cfg80211_chan_def chandef = {};
+ int ret;
+
+ switch (wdev->iftype) {
+diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
+index d9e7728027c6..f63b4bd45d60 100644
+--- a/security/integrity/ima/ima_crypto.c
++++ b/security/integrity/ima/ima_crypto.c
+@@ -271,8 +271,16 @@ static int ima_calc_file_hash_atfm(struct file *file,
+ rbuf_len = min_t(loff_t, i_size - offset, rbuf_size[active]);
+ rc = integrity_kernel_read(file, offset, rbuf[active],
+ rbuf_len);
+- if (rc != rbuf_len)
++ if (rc != rbuf_len) {
++ if (rc >= 0)
++ rc = -EINVAL;
++ /*
++ * Forward current rc, do not overwrite with return value
++ * from ahash_wait()
++ */
++ ahash_wait(ahash_rc, &wait);
+ goto out3;
++ }
+
+ if (rbuf[1] && offset) {
+ /* Using two buffers, and it is not the first
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 18cddf1729a6..64a52d495b1f 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -31,6 +31,13 @@
+ #define SGTL5000_DAP_REG_OFFSET 0x0100
+ #define SGTL5000_MAX_REG_OFFSET 0x013A
+
++/* Delay for the VAG ramp up */
++#define SGTL5000_VAG_POWERUP_DELAY 500 /* ms */
++/* Delay for the VAG ramp down */
++#define SGTL5000_VAG_POWERDOWN_DELAY 500 /* ms */
++
++#define SGTL5000_OUTPUTS_MUTE (SGTL5000_HP_MUTE | SGTL5000_LINE_OUT_MUTE)
++
+ /* default value of sgtl5000 registers */
+ static const struct reg_default sgtl5000_reg_defaults[] = {
+ { SGTL5000_CHIP_DIG_POWER, 0x0000 },
+@@ -116,6 +123,13 @@ enum {
+ I2S_LRCLK_STRENGTH_HIGH,
+ };
+
++enum {
++ HP_POWER_EVENT,
++ DAC_POWER_EVENT,
++ ADC_POWER_EVENT,
++ LAST_POWER_EVENT = ADC_POWER_EVENT
++};
++
+ /* sgtl5000 private structure in codec */
+ struct sgtl5000_priv {
+ int sysclk; /* sysclk rate */
+@@ -129,8 +143,109 @@ struct sgtl5000_priv {
+ u8 micbias_resistor;
+ u8 micbias_voltage;
+ u8 lrclk_strength;
++ u16 mute_state[LAST_POWER_EVENT + 1];
+ };
+
++static inline int hp_sel_input(struct snd_soc_component *component)
++{
++ return (snd_soc_component_read32(component, SGTL5000_CHIP_ANA_CTRL) &
++ SGTL5000_HP_SEL_MASK) >> SGTL5000_HP_SEL_SHIFT;
++}
++
++static inline u16 mute_output(struct snd_soc_component *component,
++ u16 mute_mask)
++{
++ u16 mute_reg = snd_soc_component_read32(component,
++ SGTL5000_CHIP_ANA_CTRL);
++
++ snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_CTRL,
++ mute_mask, mute_mask);
++ return mute_reg;
++}
++
++static inline void restore_output(struct snd_soc_component *component,
++ u16 mute_mask, u16 mute_reg)
++{
++ snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_CTRL,
++ mute_mask, mute_reg);
++}
++
++static void vag_power_on(struct snd_soc_component *component, u32 source)
++{
++ if (snd_soc_component_read32(component, SGTL5000_CHIP_ANA_POWER) &
++ SGTL5000_VAG_POWERUP)
++ return;
++
++ snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_POWER,
++ SGTL5000_VAG_POWERUP, SGTL5000_VAG_POWERUP);
++
++ /* When VAG powering on to get local loop from Line-In, the sleep
++ * is required to avoid loud pop.
++ */
++ if (hp_sel_input(component) == SGTL5000_HP_SEL_LINE_IN &&
++ source == HP_POWER_EVENT)
++ msleep(SGTL5000_VAG_POWERUP_DELAY);
++}
++
++static int vag_power_consumers(struct snd_soc_component *component,
++ u16 ana_pwr_reg, u32 source)
++{
++ int consumers = 0;
++
++ /* count dac/adc consumers unconditional */
++ if (ana_pwr_reg & SGTL5000_DAC_POWERUP)
++ consumers++;
++ if (ana_pwr_reg & SGTL5000_ADC_POWERUP)
++ consumers++;
++
++ /*
++ * If the event comes from HP and Line-In is selected,
++ * current action is 'DAC to be powered down'.
++ * As HP_POWERUP is not set when HP muxed to line-in,
++ * we need to keep VAG power ON.
++ */
++ if (source == HP_POWER_EVENT) {
++ if (hp_sel_input(component) == SGTL5000_HP_SEL_LINE_IN)
++ consumers++;
++ } else {
++ if (ana_pwr_reg & SGTL5000_HP_POWERUP)
++ consumers++;
++ }
++
++ return consumers;
++}
++
++static void vag_power_off(struct snd_soc_component *component, u32 source)
++{
++ u16 ana_pwr = snd_soc_component_read32(component,
++ SGTL5000_CHIP_ANA_POWER);
++
++ if (!(ana_pwr & SGTL5000_VAG_POWERUP))
++ return;
++
++ /*
++ * This function calls when any of VAG power consumers is disappearing.
++ * Thus, if there is more than one consumer at the moment, as minimum
++ * one consumer will definitely stay after the end of the current
++ * event.
++ * Don't clear VAG_POWERUP if 2 or more consumers of VAG present:
++ * - LINE_IN (for HP events) / HP (for DAC/ADC events)
++ * - DAC
++ * - ADC
++ * (the current consumer is disappearing right now)
++ */
++ if (vag_power_consumers(component, ana_pwr, source) >= 2)
++ return;
++
++ snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_POWER,
++ SGTL5000_VAG_POWERUP, 0);
++ /* In power down case, we need wait 400-1000 ms
++ * when VAG fully ramped down.
++ * As longer we wait, as smaller pop we've got.
++ */
++ msleep(SGTL5000_VAG_POWERDOWN_DELAY);
++}
++
+ /*
+ * mic_bias power on/off share the same register bits with
+ * output impedance of mic bias, when power on mic bias, we
+@@ -162,36 +277,46 @@ static int mic_bias_event(struct snd_soc_dapm_widget *w,
+ return 0;
+ }
+
+-/*
+- * As manual described, ADC/DAC only works when VAG powerup,
+- * So enabled VAG before ADC/DAC up.
+- * In power down case, we need wait 400ms when vag fully ramped down.
+- */
+-static int power_vag_event(struct snd_soc_dapm_widget *w,
+- struct snd_kcontrol *kcontrol, int event)
++static int vag_and_mute_control(struct snd_soc_component *component,
++ int event, int event_source)
+ {
+- struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+- const u32 mask = SGTL5000_DAC_POWERUP | SGTL5000_ADC_POWERUP;
++ static const u16 mute_mask[] = {
++ /*
++ * Mask for HP_POWER_EVENT.
++ * Muxing Headphones have to be wrapped with mute/unmute
++ * headphones only.
++ */
++ SGTL5000_HP_MUTE,
++ /*
++ * Masks for DAC_POWER_EVENT/ADC_POWER_EVENT.
++ * Muxing DAC or ADC block have to wrapped with mute/unmute
++ * both headphones and line-out.
++ */
++ SGTL5000_OUTPUTS_MUTE,
++ SGTL5000_OUTPUTS_MUTE
++ };
++
++ struct sgtl5000_priv *sgtl5000 =
++ snd_soc_component_get_drvdata(component);
+
+ switch (event) {
++ case SND_SOC_DAPM_PRE_PMU:
++ sgtl5000->mute_state[event_source] =
++ mute_output(component, mute_mask[event_source]);
++ break;
+ case SND_SOC_DAPM_POST_PMU:
+- snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_POWER,
+- SGTL5000_VAG_POWERUP, SGTL5000_VAG_POWERUP);
+- msleep(400);
++ vag_power_on(component, event_source);
++ restore_output(component, mute_mask[event_source],
++ sgtl5000->mute_state[event_source]);
+ break;
+-
+ case SND_SOC_DAPM_PRE_PMD:
+- /*
+- * Don't clear VAG_POWERUP, when both DAC and ADC are
+- * operational to prevent inadvertently starving the
+- * other one of them.
+- */
+- if ((snd_soc_component_read32(component, SGTL5000_CHIP_ANA_POWER) &
+- mask) != mask) {
+- snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_POWER,
+- SGTL5000_VAG_POWERUP, 0);
+- msleep(400);
+- }
++ sgtl5000->mute_state[event_source] =
++ mute_output(component, mute_mask[event_source]);
++ vag_power_off(component, event_source);
++ break;
++ case SND_SOC_DAPM_POST_PMD:
++ restore_output(component, mute_mask[event_source],
++ sgtl5000->mute_state[event_source]);
+ break;
+ default:
+ break;
+@@ -200,6 +325,41 @@ static int power_vag_event(struct snd_soc_dapm_widget *w,
+ return 0;
+ }
+
++/*
++ * Mute Headphone when power it up/down.
++ * Control VAG power on HP power path.
++ */
++static int headphone_pga_event(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
++{
++ struct snd_soc_component *component =
++ snd_soc_dapm_to_component(w->dapm);
++
++ return vag_and_mute_control(component, event, HP_POWER_EVENT);
++}
++
++/* As manual describes, ADC/DAC powering up/down requires
++ * to mute outputs to avoid pops.
++ * Control VAG power on ADC/DAC power path.
++ */
++static int adc_updown_depop(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
++{
++ struct snd_soc_component *component =
++ snd_soc_dapm_to_component(w->dapm);
++
++ return vag_and_mute_control(component, event, ADC_POWER_EVENT);
++}
++
++static int dac_updown_depop(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
++{
++ struct snd_soc_component *component =
++ snd_soc_dapm_to_component(w->dapm);
++
++ return vag_and_mute_control(component, event, DAC_POWER_EVENT);
++}
++
+ /* input sources for ADC */
+ static const char *adc_mux_text[] = {
+ "MIC_IN", "LINE_IN"
+@@ -272,7 +432,10 @@ static const struct snd_soc_dapm_widget sgtl5000_dapm_widgets[] = {
+ mic_bias_event,
+ SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+
+- SND_SOC_DAPM_PGA("HP", SGTL5000_CHIP_ANA_POWER, 4, 0, NULL, 0),
++ SND_SOC_DAPM_PGA_E("HP", SGTL5000_CHIP_ANA_POWER, 4, 0, NULL, 0,
++ headphone_pga_event,
++ SND_SOC_DAPM_PRE_POST_PMU |
++ SND_SOC_DAPM_PRE_POST_PMD),
+ SND_SOC_DAPM_PGA("LO", SGTL5000_CHIP_ANA_POWER, 0, 0, NULL, 0),
+
+ SND_SOC_DAPM_MUX("Capture Mux", SND_SOC_NOPM, 0, 0, &adc_mux),
+@@ -293,11 +456,12 @@ static const struct snd_soc_dapm_widget sgtl5000_dapm_widgets[] = {
+ 0, SGTL5000_CHIP_DIG_POWER,
+ 1, 0),
+
+- SND_SOC_DAPM_ADC("ADC", "Capture", SGTL5000_CHIP_ANA_POWER, 1, 0),
+- SND_SOC_DAPM_DAC("DAC", "Playback", SGTL5000_CHIP_ANA_POWER, 3, 0),
+-
+- SND_SOC_DAPM_PRE("VAG_POWER_PRE", power_vag_event),
+- SND_SOC_DAPM_POST("VAG_POWER_POST", power_vag_event),
++ SND_SOC_DAPM_ADC_E("ADC", "Capture", SGTL5000_CHIP_ANA_POWER, 1, 0,
++ adc_updown_depop, SND_SOC_DAPM_PRE_POST_PMU |
++ SND_SOC_DAPM_PRE_POST_PMD),
++ SND_SOC_DAPM_DAC_E("DAC", "Playback", SGTL5000_CHIP_ANA_POWER, 3, 0,
++ dac_updown_depop, SND_SOC_DAPM_PRE_POST_PMU |
++ SND_SOC_DAPM_PRE_POST_PMD),
+ };
+
+ /* routes for sgtl5000 */
+diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
+index 95a43ccb6dd0..bca0c9e5452c 100644
+--- a/tools/lib/traceevent/Makefile
++++ b/tools/lib/traceevent/Makefile
+@@ -259,8 +259,8 @@ endef
+
+ define do_generate_dynamic_list_file
+ symbol_type=`$(NM) -u -D $1 | awk 'NF>1 {print $$1}' | \
+- xargs echo "U W w" | tr ' ' '\n' | sort -u | xargs echo`;\
+- if [ "$$symbol_type" = "U W w" ];then \
++ xargs echo "U w W" | tr 'w ' 'W\n' | sort -u | xargs echo`;\
++ if [ "$$symbol_type" = "U W" ];then \
+ (echo '{'; \
+ $(NM) -u -D $1 | awk 'NF>1 {print "\t"$$2";"}' | sort -u;\
+ echo '};'; \
+diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
+index 6ccfd13d5cf9..382e476629fb 100644
+--- a/tools/lib/traceevent/event-parse.c
++++ b/tools/lib/traceevent/event-parse.c
+@@ -254,10 +254,10 @@ static int add_new_comm(struct tep_handle *pevent, const char *comm, int pid)
+ errno = ENOMEM;
+ return -1;
+ }
++ pevent->cmdlines = cmdlines;
+
+ cmdlines[pevent->cmdline_count].comm = strdup(comm);
+ if (!cmdlines[pevent->cmdline_count].comm) {
+- free(cmdlines);
+ errno = ENOMEM;
+ return -1;
+ }
+@@ -268,7 +268,6 @@ static int add_new_comm(struct tep_handle *pevent, const char *comm, int pid)
+ pevent->cmdline_count++;
+
+ qsort(cmdlines, pevent->cmdline_count, sizeof(*cmdlines), cmdline_cmp);
+- pevent->cmdlines = cmdlines;
+
+ return 0;
+ }
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index 849b3be15bd8..510caedd7319 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -837,7 +837,7 @@ ifndef NO_JVMTI
+ JDIR=$(shell /usr/sbin/update-java-alternatives -l | head -1 | awk '{print $$3}')
+ else
+ ifneq (,$(wildcard /usr/sbin/alternatives))
+- JDIR=$(shell /usr/sbin/alternatives --display java | tail -1 | cut -d' ' -f 5 | sed 's%/jre/bin/java.%%g')
++ JDIR=$(shell /usr/sbin/alternatives --display java | tail -1 | cut -d' ' -f 5 | sed -e 's%/jre/bin/java.%%g' -e 's%/bin/java.%%g')
+ endif
+ endif
+ ifndef JDIR
+diff --git a/tools/perf/arch/x86/util/unwind-libunwind.c b/tools/perf/arch/x86/util/unwind-libunwind.c
+index 05920e3edf7a..47357973b55b 100644
+--- a/tools/perf/arch/x86/util/unwind-libunwind.c
++++ b/tools/perf/arch/x86/util/unwind-libunwind.c
+@@ -1,11 +1,11 @@
+ // SPDX-License-Identifier: GPL-2.0
+
+ #include <errno.h>
++#include "../../util/debug.h"
+ #ifndef REMOTE_UNWIND_LIBUNWIND
+ #include <libunwind.h>
+ #include "perf_regs.h"
+ #include "../../util/unwind.h"
+-#include "../../util/debug.h"
+ #endif
+
+ #ifdef HAVE_ARCH_X86_64_SUPPORT
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 789962565c9c..6aae10ff954c 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -3090,8 +3090,11 @@ int cmd_stat(int argc, const char **argv)
+ fprintf(output, "[ perf stat: executing run #%d ... ]\n",
+ run_idx + 1);
+
++ if (run_idx != 0)
++ perf_evlist__reset_prev_raw_counts(evsel_list);
++
+ status = run_perf_stat(argc, argv, run_idx);
+- if (forever && status != -1) {
++ if (forever && status != -1 && !interval) {
+ print_counters(NULL, argc, argv);
+ perf_stat__reset_stats();
+ }
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index 0c70788593c8..3c0d74fc1ff2 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -1114,7 +1114,7 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
+
+ scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path);
+ if (sysfs__read_str(file, &cache->map, &len)) {
+- free(cache->map);
++ free(cache->size);
+ free(cache->type);
+ return -1;
+ }
+diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
+index a0061e0b0fad..6917ba8a0024 100644
+--- a/tools/perf/util/stat.c
++++ b/tools/perf/util/stat.c
+@@ -154,6 +154,15 @@ static void perf_evsel__free_prev_raw_counts(struct perf_evsel *evsel)
+ evsel->prev_raw_counts = NULL;
+ }
+
++static void perf_evsel__reset_prev_raw_counts(struct perf_evsel *evsel)
++{
++ if (evsel->prev_raw_counts) {
++ evsel->prev_raw_counts->aggr.val = 0;
++ evsel->prev_raw_counts->aggr.ena = 0;
++ evsel->prev_raw_counts->aggr.run = 0;
++ }
++}
++
+ static int perf_evsel__alloc_stats(struct perf_evsel *evsel, bool alloc_raw)
+ {
+ int ncpus = perf_evsel__nr_cpus(evsel);
+@@ -204,6 +213,14 @@ void perf_evlist__reset_stats(struct perf_evlist *evlist)
+ }
+ }
+
++void perf_evlist__reset_prev_raw_counts(struct perf_evlist *evlist)
++{
++ struct perf_evsel *evsel;
++
++ evlist__for_each_entry(evlist, evsel)
++ perf_evsel__reset_prev_raw_counts(evsel);
++}
++
+ static void zero_per_pkg(struct perf_evsel *counter)
+ {
+ if (counter->per_pkg_mask)
+diff --git a/tools/perf/util/stat.h b/tools/perf/util/stat.h
+index 36efb986f7fc..e19abb1635c4 100644
+--- a/tools/perf/util/stat.h
++++ b/tools/perf/util/stat.h
+@@ -158,6 +158,7 @@ void perf_stat__collect_metric_expr(struct perf_evlist *);
+ int perf_evlist__alloc_stats(struct perf_evlist *evlist, bool alloc_raw);
+ void perf_evlist__free_stats(struct perf_evlist *evlist);
+ void perf_evlist__reset_stats(struct perf_evlist *evlist);
++void perf_evlist__reset_prev_raw_counts(struct perf_evlist *evlist);
+
+ int perf_stat_process_counter(struct perf_stat_config *config,
+ struct perf_evsel *counter);
+diff --git a/tools/testing/nvdimm/test/nfit_test.h b/tools/testing/nvdimm/test/nfit_test.h
+index 33752e06ff8d..3de57cc8716b 100644
+--- a/tools/testing/nvdimm/test/nfit_test.h
++++ b/tools/testing/nvdimm/test/nfit_test.h
+@@ -12,6 +12,7 @@
+ */
+ #ifndef __NFIT_TEST_H__
+ #define __NFIT_TEST_H__
++#include <linux/acpi.h>
+ #include <linux/list.h>
+ #include <linux/uuid.h>
+ #include <linux/ioport.h>
+@@ -234,9 +235,6 @@ struct nd_intel_lss {
+ __u32 status;
+ } __packed;
+
+-union acpi_object;
+-typedef void *acpi_handle;
+-
+ typedef struct nfit_test_resource *(*nfit_test_lookup_fn)(resource_size_t);
+ typedef union acpi_object *(*nfit_test_evaluate_dsm_fn)(acpi_handle handle,
+ const guid_t *guid, u64 rev, u64 func,
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-10-17 22:27 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-10-17 22:27 UTC (permalink / raw
To: gentoo-commits
commit: 70fa93ee16ccde9d51810e352e2a25b7edb13e78
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Oct 17 22:26:53 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Oct 17 22:26:53 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=70fa93ee
Linux patch 4.19.80
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1079_linux-4.19.80.patch | 4613 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4617 insertions(+)
diff --git a/0000_README b/0000_README
index e1f1ada..4a75724 100644
--- a/0000_README
+++ b/0000_README
@@ -355,6 +355,10 @@ Patch: 1078_linux-4.19.79.patch
From: https://www.kernel.org
Desc: Linux 4.19.79
+Patch: 1079_linux-4.19.80.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.80
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1079_linux-4.19.80.patch b/1079_linux-4.19.80.patch
new file mode 100644
index 0000000..f45dec4
--- /dev/null
+++ b/1079_linux-4.19.80.patch
@@ -0,0 +1,4613 @@
+diff --git a/Documentation/usb/rio.txt b/Documentation/usb/rio.txt
+deleted file mode 100644
+index aee715af7db7..000000000000
+--- a/Documentation/usb/rio.txt
++++ /dev/null
+@@ -1,138 +0,0 @@
+-Copyright (C) 1999, 2000 Bruce Tenison
+-Portions Copyright (C) 1999, 2000 David Nelson
+-Thanks to David Nelson for guidance and the usage of the scanner.txt
+-and scanner.c files to model our driver and this informative file.
+-
+-Mar. 2, 2000
+-
+-CHANGES
+-
+-- Initial Revision
+-
+-
+-OVERVIEW
+-
+-This README will address issues regarding how to configure the kernel
+-to access a RIO 500 mp3 player.
+-Before I explain how to use this to access the Rio500 please be warned:
+-
+-W A R N I N G:
+---------------
+-
+-Please note that this software is still under development. The authors
+-are in no way responsible for any damage that may occur, no matter how
+-inconsequential.
+-
+-It seems that the Rio has a problem when sending .mp3 with low batteries.
+-I suggest when the batteries are low and you want to transfer stuff that you
+-replace it with a fresh one. In my case, what happened is I lost two 16kb
+-blocks (they are no longer usable to store information to it). But I don't
+-know if that's normal or not; it could simply be a problem with the flash
+-memory.
+-
+-In an extreme case, I left my Rio playing overnight and the batteries wore
+-down to nothing and appear to have corrupted the flash memory. My RIO
+-needed to be replaced as a result. Diamond tech support is aware of the
+-problem. Do NOT allow your batteries to wear down to nothing before
+-changing them. It appears RIO 500 firmware does not handle low battery
+-power well at all.
+-
+-On systems with OHCI controllers, the kernel OHCI code appears to have
+-power on problems with some chipsets. If you are having problems
+-connecting to your RIO 500, try turning it on first and then plugging it
+-into the USB cable.
+-
+-Contact information:
+---------------------
+-
+- The main page for the project is hosted at sourceforge.net in the following
+- URL: <http://rio500.sourceforge.net>. You can also go to the project's
+- sourceforge home page at: <http://sourceforge.net/projects/rio500/>.
+- There is also a mailing list: rio500-users@lists.sourceforge.net
+-
+-Authors:
+--------
+-
+-Most of the code was written by Cesar Miquel <miquel@df.uba.ar>. Keith
+-Clayton <kclayton@jps.net> is incharge of the PPC port and making sure
+-things work there. Bruce Tenison <btenison@dibbs.net> is adding support
+-for .fon files and also does testing. The program will mostly sure be
+-re-written and Pete Ikusz along with the rest will re-design it. I would
+-also like to thank Tri Nguyen <tmn_3022000@hotmail.com> who provided use
+-with some important information regarding the communication with the Rio.
+-
+-ADDITIONAL INFORMATION and Userspace tools
+-
+-http://rio500.sourceforge.net/
+-
+-
+-REQUIREMENTS
+-
+-A host with a USB port. Ideally, either a UHCI (Intel) or OHCI
+-(Compaq and others) hardware port should work.
+-
+-A Linux development kernel (2.3.x) with USB support enabled or a
+-backported version to linux-2.2.x. See http://www.linux-usb.org for
+-more information on accomplishing this.
+-
+-A Linux kernel with RIO 500 support enabled.
+-
+-'lspci' which is only needed to determine the type of USB hardware
+-available in your machine.
+-
+-CONFIGURATION
+-
+-Using `lspci -v`, determine the type of USB hardware available.
+-
+- If you see something like:
+-
+- USB Controller: ......
+- Flags: .....
+- I/O ports at ....
+-
+- Then you have a UHCI based controller.
+-
+- If you see something like:
+-
+- USB Controller: .....
+- Flags: ....
+- Memory at .....
+-
+- Then you have a OHCI based controller.
+-
+-Using `make menuconfig` or your preferred method for configuring the
+-kernel, select 'Support for USB', 'OHCI/UHCI' depending on your
+-hardware (determined from the steps above), 'USB Diamond Rio500 support', and
+-'Preliminary USB device filesystem'. Compile and install the modules
+-(you may need to execute `depmod -a` to update the module
+-dependencies).
+-
+-Add a device for the USB rio500:
+- `mknod /dev/usb/rio500 c 180 64`
+-
+-Set appropriate permissions for /dev/usb/rio500 (don't forget about
+-group and world permissions). Both read and write permissions are
+-required for proper operation.
+-
+-Load the appropriate modules (if compiled as modules):
+-
+- OHCI:
+- modprobe usbcore
+- modprobe usb-ohci
+- modprobe rio500
+-
+- UHCI:
+- modprobe usbcore
+- modprobe usb-uhci (or uhci)
+- modprobe rio500
+-
+-That's it. The Rio500 Utils at: http://rio500.sourceforge.net should
+-be able to access the rio500.
+-
+-BUGS
+-
+-If you encounter any problems feel free to drop me an email.
+-
+-Bruce Tenison
+-btenison@dibbs.net
+-
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 11a59e82d92e..d735500d3dad 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -15117,13 +15117,6 @@ W: http://www.linux-usb.org/usbnet
+ S: Maintained
+ F: drivers/net/usb/dm9601.c
+
+-USB DIAMOND RIO500 DRIVER
+-M: Cesar Miquel <miquel@df.uba.ar>
+-L: rio500-users@lists.sourceforge.net
+-W: http://rio500.sourceforge.net
+-S: Maintained
+-F: drivers/usb/misc/rio500*
+-
+ USB EHCI DRIVER
+ M: Alan Stern <stern@rowland.harvard.edu>
+ L: linux-usb@vger.kernel.org
+diff --git a/Makefile b/Makefile
+index 4d29c7370b46..ced4a9fd9754 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 79
++SUBLEVEL = 80
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/configs/badge4_defconfig b/arch/arm/configs/badge4_defconfig
+index 5ae5b5228467..ef484c4cfd1a 100644
+--- a/arch/arm/configs/badge4_defconfig
++++ b/arch/arm/configs/badge4_defconfig
+@@ -91,7 +91,6 @@ CONFIG_USB_SERIAL_PL2303=m
+ CONFIG_USB_SERIAL_CYBERJACK=m
+ CONFIG_USB_SERIAL_XIRCOM=m
+ CONFIG_USB_SERIAL_OMNINET=m
+-CONFIG_USB_RIO500=m
+ CONFIG_EXT2_FS=m
+ CONFIG_EXT3_FS=m
+ CONFIG_MSDOS_FS=y
+diff --git a/arch/arm/configs/corgi_defconfig b/arch/arm/configs/corgi_defconfig
+index 09e1672777c9..0ba8df0d48b9 100644
+--- a/arch/arm/configs/corgi_defconfig
++++ b/arch/arm/configs/corgi_defconfig
+@@ -197,7 +197,6 @@ CONFIG_USB_SERIAL_XIRCOM=m
+ CONFIG_USB_SERIAL_OMNINET=m
+ CONFIG_USB_EMI62=m
+ CONFIG_USB_EMI26=m
+-CONFIG_USB_RIO500=m
+ CONFIG_USB_LEGOTOWER=m
+ CONFIG_USB_LCD=m
+ CONFIG_USB_CYTHERM=m
+diff --git a/arch/arm/configs/pxa_defconfig b/arch/arm/configs/pxa_defconfig
+index 6bb506edb1f5..cc63d09a1f86 100644
+--- a/arch/arm/configs/pxa_defconfig
++++ b/arch/arm/configs/pxa_defconfig
+@@ -588,7 +588,6 @@ CONFIG_USB_SERIAL_XIRCOM=m
+ CONFIG_USB_SERIAL_OMNINET=m
+ CONFIG_USB_EMI62=m
+ CONFIG_USB_EMI26=m
+-CONFIG_USB_RIO500=m
+ CONFIG_USB_LEGOTOWER=m
+ CONFIG_USB_LCD=m
+ CONFIG_USB_CYTHERM=m
+diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig
+index 2afb359f3168..bd71d5bf98c9 100644
+--- a/arch/arm/configs/s3c2410_defconfig
++++ b/arch/arm/configs/s3c2410_defconfig
+@@ -334,7 +334,6 @@ CONFIG_USB_EMI62=m
+ CONFIG_USB_EMI26=m
+ CONFIG_USB_ADUTUX=m
+ CONFIG_USB_SEVSEG=m
+-CONFIG_USB_RIO500=m
+ CONFIG_USB_LEGOTOWER=m
+ CONFIG_USB_LCD=m
+ CONFIG_USB_CYPRESS_CY7C63=m
+diff --git a/arch/arm/configs/spitz_defconfig b/arch/arm/configs/spitz_defconfig
+index 9ea82c118661..3aff4ca2a94e 100644
+--- a/arch/arm/configs/spitz_defconfig
++++ b/arch/arm/configs/spitz_defconfig
+@@ -191,7 +191,6 @@ CONFIG_USB_SERIAL_XIRCOM=m
+ CONFIG_USB_SERIAL_OMNINET=m
+ CONFIG_USB_EMI62=m
+ CONFIG_USB_EMI26=m
+-CONFIG_USB_RIO500=m
+ CONFIG_USB_LEGOTOWER=m
+ CONFIG_USB_LCD=m
+ CONFIG_USB_CYTHERM=m
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
+index bc2226608e13..d668c13218b8 100644
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -285,22 +285,27 @@ void arch_release_task_struct(struct task_struct *tsk)
+ fpsimd_release_task(tsk);
+ }
+
+-/*
+- * src and dst may temporarily have aliased sve_state after task_struct
+- * is copied. We cannot fix this properly here, because src may have
+- * live SVE state and dst's thread_info may not exist yet, so tweaking
+- * either src's or dst's TIF_SVE is not safe.
+- *
+- * The unaliasing is done in copy_thread() instead. This works because
+- * dst is not schedulable or traceable until both of these functions
+- * have been called.
+- */
+ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+ {
+ if (current->mm)
+ fpsimd_preserve_current_state();
+ *dst = *src;
+
++ /* We rely on the above assignment to initialize dst's thread_flags: */
++ BUILD_BUG_ON(!IS_ENABLED(CONFIG_THREAD_INFO_IN_TASK));
++
++ /*
++ * Detach src's sve_state (if any) from dst so that it does not
++ * get erroneously used or freed prematurely. dst's sve_state
++ * will be allocated on demand later on if dst uses SVE.
++ * For consistency, also clear TIF_SVE here: this could be done
++ * later in copy_process(), but to avoid tripping up future
++ * maintainers it is best not to leave TIF_SVE and sve_state in
++ * an inconsistent state, even temporarily.
++ */
++ dst->thread.sve_state = NULL;
++ clear_tsk_thread_flag(dst, TIF_SVE);
++
+ return 0;
+ }
+
+@@ -313,13 +318,6 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start,
+
+ memset(&p->thread.cpu_context, 0, sizeof(struct cpu_context));
+
+- /*
+- * Unalias p->thread.sve_state (if any) from the parent task
+- * and disable discard SVE state for p:
+- */
+- clear_tsk_thread_flag(p, TIF_SVE);
+- p->thread.sve_state = NULL;
+-
+ /*
+ * In case p was allocated the same task_struct pointer as some
+ * other recently-exited task, make sure p is disassociated from
+diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c
+index 0825c4a856e3..6106c49f84bc 100644
+--- a/arch/arm64/kernel/topology.c
++++ b/arch/arm64/kernel/topology.c
+@@ -340,17 +340,28 @@ void remove_cpu_topology(unsigned int cpu)
+ }
+
+ #ifdef CONFIG_ACPI
++static bool __init acpi_cpu_is_threaded(int cpu)
++{
++ int is_threaded = acpi_pptt_cpu_is_thread(cpu);
++
++ /*
++ * if the PPTT doesn't have thread information, assume a homogeneous
++ * machine and return the current CPU's thread state.
++ */
++ if (is_threaded < 0)
++ is_threaded = read_cpuid_mpidr() & MPIDR_MT_BITMASK;
++
++ return !!is_threaded;
++}
++
+ /*
+ * Propagate the topology information of the processor_topology_node tree to the
+ * cpu_topology array.
+ */
+ static int __init parse_acpi_topology(void)
+ {
+- bool is_threaded;
+ int cpu, topology_id;
+
+- is_threaded = read_cpuid_mpidr() & MPIDR_MT_BITMASK;
+-
+ for_each_possible_cpu(cpu) {
+ int i, cache_id;
+
+@@ -358,7 +369,7 @@ static int __init parse_acpi_topology(void)
+ if (topology_id < 0)
+ return topology_id;
+
+- if (is_threaded) {
++ if (acpi_cpu_is_threaded(cpu)) {
+ cpu_topology[cpu].thread_id = topology_id;
+ topology_id = find_acpi_cpu_topology(cpu, 1);
+ cpu_topology[cpu].core_id = topology_id;
+diff --git a/arch/mips/configs/mtx1_defconfig b/arch/mips/configs/mtx1_defconfig
+index c3d0d0a6e044..6895430b5b2c 100644
+--- a/arch/mips/configs/mtx1_defconfig
++++ b/arch/mips/configs/mtx1_defconfig
+@@ -623,7 +623,6 @@ CONFIG_USB_SERIAL_OMNINET=m
+ CONFIG_USB_EMI62=m
+ CONFIG_USB_EMI26=m
+ CONFIG_USB_ADUTUX=m
+-CONFIG_USB_RIO500=m
+ CONFIG_USB_LEGOTOWER=m
+ CONFIG_USB_LCD=m
+ CONFIG_USB_CYPRESS_CY7C63=m
+diff --git a/arch/mips/configs/rm200_defconfig b/arch/mips/configs/rm200_defconfig
+index 5f71aa598b06..1a3e1fec4e86 100644
+--- a/arch/mips/configs/rm200_defconfig
++++ b/arch/mips/configs/rm200_defconfig
+@@ -335,7 +335,6 @@ CONFIG_USB_SERIAL_SAFE_PADDED=y
+ CONFIG_USB_SERIAL_CYBERJACK=m
+ CONFIG_USB_SERIAL_XIRCOM=m
+ CONFIG_USB_SERIAL_OMNINET=m
+-CONFIG_USB_RIO500=m
+ CONFIG_USB_LEGOTOWER=m
+ CONFIG_USB_LCD=m
+ CONFIG_USB_CYTHERM=m
+diff --git a/arch/mips/include/uapi/asm/hwcap.h b/arch/mips/include/uapi/asm/hwcap.h
+index a2aba4b059e6..1ade1daa4921 100644
+--- a/arch/mips/include/uapi/asm/hwcap.h
++++ b/arch/mips/include/uapi/asm/hwcap.h
+@@ -6,5 +6,16 @@
+ #define HWCAP_MIPS_R6 (1 << 0)
+ #define HWCAP_MIPS_MSA (1 << 1)
+ #define HWCAP_MIPS_CRC32 (1 << 2)
++#define HWCAP_MIPS_MIPS16 (1 << 3)
++#define HWCAP_MIPS_MDMX (1 << 4)
++#define HWCAP_MIPS_MIPS3D (1 << 5)
++#define HWCAP_MIPS_SMARTMIPS (1 << 6)
++#define HWCAP_MIPS_DSP (1 << 7)
++#define HWCAP_MIPS_DSP2 (1 << 8)
++#define HWCAP_MIPS_DSP3 (1 << 9)
++#define HWCAP_MIPS_MIPS16E2 (1 << 10)
++#define HWCAP_LOONGSON_MMI (1 << 11)
++#define HWCAP_LOONGSON_EXT (1 << 12)
++#define HWCAP_LOONGSON_EXT2 (1 << 13)
+
+ #endif /* _UAPI_ASM_HWCAP_H */
+diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
+index 958b627592c3..581defb369c3 100644
+--- a/arch/mips/kernel/cpu-probe.c
++++ b/arch/mips/kernel/cpu-probe.c
+@@ -2105,6 +2105,39 @@ void cpu_probe(void)
+ elf_hwcap |= HWCAP_MIPS_MSA;
+ }
+
++ if (cpu_has_mips16)
++ elf_hwcap |= HWCAP_MIPS_MIPS16;
++
++ if (cpu_has_mdmx)
++ elf_hwcap |= HWCAP_MIPS_MDMX;
++
++ if (cpu_has_mips3d)
++ elf_hwcap |= HWCAP_MIPS_MIPS3D;
++
++ if (cpu_has_smartmips)
++ elf_hwcap |= HWCAP_MIPS_SMARTMIPS;
++
++ if (cpu_has_dsp)
++ elf_hwcap |= HWCAP_MIPS_DSP;
++
++ if (cpu_has_dsp2)
++ elf_hwcap |= HWCAP_MIPS_DSP2;
++
++ if (cpu_has_dsp3)
++ elf_hwcap |= HWCAP_MIPS_DSP3;
++
++ if (cpu_has_mips16e2)
++ elf_hwcap |= HWCAP_MIPS_MIPS16E2;
++
++ if (cpu_has_loongson_mmi)
++ elf_hwcap |= HWCAP_LOONGSON_MMI;
++
++ if (cpu_has_loongson_ext)
++ elf_hwcap |= HWCAP_LOONGSON_EXT;
++
++ if (cpu_has_loongson_ext2)
++ elf_hwcap |= HWCAP_LOONGSON_EXT2;
++
+ if (cpu_has_vz)
+ cpu_probe_vz(c);
+
+diff --git a/arch/mips/loongson64/Platform b/arch/mips/loongson64/Platform
+index 0fce4608aa88..12abf14aed4a 100644
+--- a/arch/mips/loongson64/Platform
++++ b/arch/mips/loongson64/Platform
+@@ -43,6 +43,10 @@ else
+ $(call cc-option,-march=mips64r2,-mips64r2 -U_MIPS_ISA -D_MIPS_ISA=_MIPS_ISA_MIPS64)
+ endif
+
++# Some -march= flags enable MMI instructions, and GCC complains about that
++# support being enabled alongside -msoft-float. Thus explicitly disable MMI.
++cflags-y += $(call cc-option,-mno-loongson-mmi)
++
+ #
+ # Loongson Machines' Support
+ #
+diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile
+index 6f10312e0c76..c99fa1c1bd9c 100644
+--- a/arch/mips/vdso/Makefile
++++ b/arch/mips/vdso/Makefile
+@@ -9,6 +9,7 @@ ccflags-vdso := \
+ $(filter -mmicromips,$(KBUILD_CFLAGS)) \
+ $(filter -march=%,$(KBUILD_CFLAGS)) \
+ $(filter -m%-float,$(KBUILD_CFLAGS)) \
++ $(filter -mno-loongson-%,$(KBUILD_CFLAGS)) \
+ -D__VDSO__
+
+ ifeq ($(cc-name),clang)
+diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h
+index eb0f80ce8524..3aa82deeab5a 100644
+--- a/arch/x86/include/asm/mwait.h
++++ b/arch/x86/include/asm/mwait.h
+@@ -21,7 +21,7 @@
+ #define MWAIT_ECX_INTERRUPT_BREAK 0x1
+ #define MWAITX_ECX_TIMER_ENABLE BIT(1)
+ #define MWAITX_MAX_LOOPS ((u32)-1)
+-#define MWAITX_DISABLE_CSTATES 0xf
++#define MWAITX_DISABLE_CSTATES 0xf0
+
+ static inline void __monitor(const void *eax, unsigned long ecx,
+ unsigned long edx)
+diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
+index f5b7f1b3b6d7..614c2c6b1959 100644
+--- a/arch/x86/lib/delay.c
++++ b/arch/x86/lib/delay.c
+@@ -113,8 +113,8 @@ static void delay_mwaitx(unsigned long __loops)
+ __monitorx(raw_cpu_ptr(&cpu_tss_rw), 0, 0);
+
+ /*
+- * AMD, like Intel, supports the EAX hint and EAX=0xf
+- * means, do not enter any deep C-state and we use it
++ * AMD, like Intel's MWAIT version, supports the EAX hint and
++ * EAX=0xf0 means, do not enter any deep C-state and we use it
+ * here in delay() to minimize wakeup latency.
+ */
+ __mwaitx(MWAITX_DISABLE_CSTATES, delay, MWAITX_ECX_TIMER_ENABLE);
+diff --git a/block/blk-rq-qos.c b/block/blk-rq-qos.c
+index 0005dfd568dd..43bcd4e7a7f9 100644
+--- a/block/blk-rq-qos.c
++++ b/block/blk-rq-qos.c
+@@ -148,24 +148,27 @@ bool rq_depth_calc_max_depth(struct rq_depth *rqd)
+ return ret;
+ }
+
+-void rq_depth_scale_up(struct rq_depth *rqd)
++/* Returns true on success and false if scaling up wasn't possible */
++bool rq_depth_scale_up(struct rq_depth *rqd)
+ {
+ /*
+ * Hit max in previous round, stop here
+ */
+ if (rqd->scaled_max)
+- return;
++ return false;
+
+ rqd->scale_step--;
+
+ rqd->scaled_max = rq_depth_calc_max_depth(rqd);
++ return true;
+ }
+
+ /*
+ * Scale rwb down. If 'hard_throttle' is set, do it quicker, since we
+- * had a latency violation.
++ * had a latency violation. Returns true on success and returns false if
++ * scaling down wasn't possible.
+ */
+-void rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle)
++bool rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle)
+ {
+ /*
+ * Stop scaling down when we've hit the limit. This also prevents
+@@ -173,7 +176,7 @@ void rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle)
+ * keep up.
+ */
+ if (rqd->max_depth == 1)
+- return;
++ return false;
+
+ if (rqd->scale_step < 0 && hard_throttle)
+ rqd->scale_step = 0;
+@@ -182,6 +185,7 @@ void rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle)
+
+ rqd->scaled_max = false;
+ rq_depth_calc_max_depth(rqd);
++ return true;
+ }
+
+ void rq_qos_exit(struct request_queue *q)
+diff --git a/block/blk-rq-qos.h b/block/blk-rq-qos.h
+index 32b02efbfa66..60fac2d066cf 100644
+--- a/block/blk-rq-qos.h
++++ b/block/blk-rq-qos.h
+@@ -94,8 +94,8 @@ static inline void rq_qos_del(struct request_queue *q, struct rq_qos *rqos)
+ }
+
+ bool rq_wait_inc_below(struct rq_wait *rq_wait, unsigned int limit);
+-void rq_depth_scale_up(struct rq_depth *rqd);
+-void rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle);
++bool rq_depth_scale_up(struct rq_depth *rqd);
++bool rq_depth_scale_down(struct rq_depth *rqd, bool hard_throttle);
+ bool rq_depth_calc_max_depth(struct rq_depth *rqd);
+
+ void rq_qos_cleanup(struct request_queue *, struct bio *);
+diff --git a/block/blk-wbt.c b/block/blk-wbt.c
+index 0c62bf4eca75..f1de8ba483a9 100644
+--- a/block/blk-wbt.c
++++ b/block/blk-wbt.c
+@@ -307,7 +307,8 @@ static void calc_wb_limits(struct rq_wb *rwb)
+
+ static void scale_up(struct rq_wb *rwb)
+ {
+- rq_depth_scale_up(&rwb->rq_depth);
++ if (!rq_depth_scale_up(&rwb->rq_depth))
++ return;
+ calc_wb_limits(rwb);
+ rwb->unknown_cnt = 0;
+ rwb_wake_all(rwb);
+@@ -316,7 +317,8 @@ static void scale_up(struct rq_wb *rwb)
+
+ static void scale_down(struct rq_wb *rwb, bool hard_throttle)
+ {
+- rq_depth_scale_down(&rwb->rq_depth, hard_throttle);
++ if (!rq_depth_scale_down(&rwb->rq_depth, hard_throttle))
++ return;
+ calc_wb_limits(rwb);
+ rwb->unknown_cnt = 0;
+ rwb_trace_step(rwb, "scale down");
+diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c
+index da031b1df6f5..9dbf86a0c827 100644
+--- a/drivers/acpi/pptt.c
++++ b/drivers/acpi/pptt.c
+@@ -509,6 +509,44 @@ static int find_acpi_cpu_topology_tag(unsigned int cpu, int level, int flag)
+ return retval;
+ }
+
++/**
++ * check_acpi_cpu_flag() - Determine if CPU node has a flag set
++ * @cpu: Kernel logical CPU number
++ * @rev: The minimum PPTT revision defining the flag
++ * @flag: The flag itself
++ *
++ * Check the node representing a CPU for a given flag.
++ *
++ * Return: -ENOENT if the PPTT doesn't exist, the CPU cannot be found or
++ * the table revision isn't new enough.
++ * 1, any passed flag set
++ * 0, flag unset
++ */
++static int check_acpi_cpu_flag(unsigned int cpu, int rev, u32 flag)
++{
++ struct acpi_table_header *table;
++ acpi_status status;
++ u32 acpi_cpu_id = get_acpi_id_for_cpu(cpu);
++ struct acpi_pptt_processor *cpu_node = NULL;
++ int ret = -ENOENT;
++
++ status = acpi_get_table(ACPI_SIG_PPTT, 0, &table);
++ if (ACPI_FAILURE(status)) {
++ pr_warn_once("No PPTT table found, cpu topology may be inaccurate\n");
++ return ret;
++ }
++
++ if (table->revision >= rev)
++ cpu_node = acpi_find_processor_node(table, acpi_cpu_id);
++
++ if (cpu_node)
++ ret = (cpu_node->flags & flag) != 0;
++
++ acpi_put_table(table);
++
++ return ret;
++}
++
+ /**
+ * acpi_find_last_cache_level() - Determines the number of cache levels for a PE
+ * @cpu: Kernel logical cpu number
+@@ -573,6 +611,20 @@ int cache_setup_acpi(unsigned int cpu)
+ return status;
+ }
+
++/**
++ * acpi_pptt_cpu_is_thread() - Determine if CPU is a thread
++ * @cpu: Kernel logical CPU number
++ *
++ * Return: 1, a thread
++ * 0, not a thread
++ * -ENOENT ,if the PPTT doesn't exist, the CPU cannot be found or
++ * the table revision isn't new enough.
++ */
++int acpi_pptt_cpu_is_thread(unsigned int cpu)
++{
++ return check_acpi_cpu_flag(cpu, 2, ACPI_PPTT_ACPI_PROCESSOR_IS_THREAD);
++}
++
+ /**
+ * find_acpi_cpu_topology() - Determine a unique topology value for a given cpu
+ * @cpu: Kernel logical cpu number
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index 2a29dd9c986d..d54fca902e64 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -281,6 +281,9 @@ static __init int efivar_ssdt_load(void)
+ void *data;
+ int ret;
+
++ if (!efivar_ssdt[0])
++ return 0;
++
+ ret = efivar_init(efivar_ssdt_iter, &entries, true, &entries);
+
+ list_for_each_entry_safe(entry, aux, &entries, list) {
+diff --git a/drivers/firmware/google/vpd_decode.c b/drivers/firmware/google/vpd_decode.c
+index e75abe9fa122..6c7ab2ba85d2 100644
+--- a/drivers/firmware/google/vpd_decode.c
++++ b/drivers/firmware/google/vpd_decode.c
+@@ -62,7 +62,7 @@ static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
+ if (max_len - consumed < *entry_len)
+ return VPD_FAIL;
+
+- consumed += decoded_len;
++ consumed += *entry_len;
+ *_consumed = consumed;
+ return VPD_OK;
+ }
+diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
+index 6cf2e2ce4093..4935cda5301e 100644
+--- a/drivers/gpio/gpio-eic-sprd.c
++++ b/drivers/gpio/gpio-eic-sprd.c
+@@ -529,11 +529,12 @@ static void sprd_eic_handle_one_type(struct gpio_chip *chip)
+ }
+
+ for_each_set_bit(n, ®, SPRD_EIC_PER_BANK_NR) {
+- girq = irq_find_mapping(chip->irq.domain,
+- bank * SPRD_EIC_PER_BANK_NR + n);
++ u32 offset = bank * SPRD_EIC_PER_BANK_NR + n;
++
++ girq = irq_find_mapping(chip->irq.domain, offset);
+
+ generic_handle_irq(girq);
+- sprd_eic_toggle_trigger(chip, girq, n);
++ sprd_eic_toggle_trigger(chip, girq, offset);
+ }
+ }
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 3289b53a7ba1..565ab945698c 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2649,8 +2649,10 @@ int gpiod_direction_output(struct gpio_desc *desc, int value)
+ if (!ret)
+ goto set_output_value;
+ /* Emulate open drain by not actively driving the line high */
+- if (value)
+- return gpiod_direction_input(desc);
++ if (value) {
++ ret = gpiod_direction_input(desc);
++ goto set_output_flag;
++ }
+ }
+ else if (test_bit(FLAG_OPEN_SOURCE, &desc->flags)) {
+ ret = gpio_set_drive_single_ended(gc, gpio_chip_hwgpio(desc),
+@@ -2658,8 +2660,10 @@ int gpiod_direction_output(struct gpio_desc *desc, int value)
+ if (!ret)
+ goto set_output_value;
+ /* Emulate open source by not actively driving the line low */
+- if (!value)
+- return gpiod_direction_input(desc);
++ if (!value) {
++ ret = gpiod_direction_input(desc);
++ goto set_output_flag;
++ }
+ } else {
+ gpio_set_drive_single_ended(gc, gpio_chip_hwgpio(desc),
+ PIN_CONFIG_DRIVE_PUSH_PULL);
+@@ -2667,6 +2671,17 @@ int gpiod_direction_output(struct gpio_desc *desc, int value)
+
+ set_output_value:
+ return gpiod_direction_output_raw_commit(desc, value);
++
++set_output_flag:
++ /*
++ * When emulating open-source or open-drain functionalities by not
++ * actively driving the line (setting mode to input) we still need to
++ * set the IS_OUT flag or otherwise we won't be able to set the line
++ * value anymore.
++ */
++ if (ret == 0)
++ set_bit(FLAG_IS_OUT, &desc->flags);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(gpiod_direction_output);
+
+@@ -2980,8 +2995,6 @@ static void gpio_set_open_drain_value_commit(struct gpio_desc *desc, bool value)
+
+ if (value) {
+ err = chip->direction_input(chip, offset);
+- if (!err)
+- clear_bit(FLAG_IS_OUT, &desc->flags);
+ } else {
+ err = chip->direction_output(chip, offset, 0);
+ if (!err)
+@@ -3011,8 +3024,6 @@ static void gpio_set_open_source_value_commit(struct gpio_desc *desc, bool value
+ set_bit(FLAG_IS_OUT, &desc->flags);
+ } else {
+ err = chip->direction_input(chip, offset);
+- if (!err)
+- clear_bit(FLAG_IS_OUT, &desc->flags);
+ }
+ trace_gpio_direction(desc_to_gpio(desc), !value, err);
+ if (err < 0)
+diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
+index e1da67d5ee22..9e61720db7ea 100644
+--- a/drivers/iio/adc/ad799x.c
++++ b/drivers/iio/adc/ad799x.c
+@@ -814,10 +814,10 @@ static int ad799x_probe(struct i2c_client *client,
+
+ ret = ad799x_write_config(st, st->chip_config->default_config);
+ if (ret < 0)
+- goto error_disable_reg;
++ goto error_disable_vref;
+ ret = ad799x_read_config(st);
+ if (ret < 0)
+- goto error_disable_reg;
++ goto error_disable_vref;
+ st->config = ret;
+
+ ret = iio_triggered_buffer_setup(indio_dev, NULL,
+diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
+index 4e339cfd0c54..e6ce25bcc01c 100644
+--- a/drivers/iio/adc/axp288_adc.c
++++ b/drivers/iio/adc/axp288_adc.c
+@@ -16,6 +16,7 @@
+ *
+ */
+
++#include <linux/dmi.h>
+ #include <linux/module.h>
+ #include <linux/kernel.h>
+ #include <linux/device.h>
+@@ -34,6 +35,11 @@
+ #define AXP288_ADC_EN_MASK 0xF0
+ #define AXP288_ADC_TS_ENABLE 0x01
+
++#define AXP288_ADC_TS_BIAS_MASK GENMASK(5, 4)
++#define AXP288_ADC_TS_BIAS_20UA (0 << 4)
++#define AXP288_ADC_TS_BIAS_40UA (1 << 4)
++#define AXP288_ADC_TS_BIAS_60UA (2 << 4)
++#define AXP288_ADC_TS_BIAS_80UA (3 << 4)
+ #define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0)
+ #define AXP288_ADC_TS_CURRENT_OFF (0 << 0)
+ #define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0)
+@@ -186,10 +192,36 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
+ return ret;
+ }
+
++/*
++ * We rely on the machine's firmware to correctly setup the TS pin bias current
++ * at boot. This lists systems with broken fw where we need to set it ourselves.
++ */
++static const struct dmi_system_id axp288_adc_ts_bias_override[] = {
++ {
++ /* Lenovo Ideapad 100S (11 inch) */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad 100S-11IBY"),
++ },
++ .driver_data = (void *)(uintptr_t)AXP288_ADC_TS_BIAS_80UA,
++ },
++ {}
++};
++
+ static int axp288_adc_initialize(struct axp288_adc_info *info)
+ {
++ const struct dmi_system_id *bias_override;
+ int ret, adc_enable_val;
+
++ bias_override = dmi_first_match(axp288_adc_ts_bias_override);
++ if (bias_override) {
++ ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL,
++ AXP288_ADC_TS_BIAS_MASK,
++ (uintptr_t)bias_override->driver_data);
++ if (ret)
++ return ret;
++ }
++
+ /*
+ * Determine if the TS pin is enabled and set the TS current-source
+ * accordingly.
+diff --git a/drivers/iio/adc/hx711.c b/drivers/iio/adc/hx711.c
+index 36b59d8957fb..6c5d81a89aec 100644
+--- a/drivers/iio/adc/hx711.c
++++ b/drivers/iio/adc/hx711.c
+@@ -109,14 +109,14 @@ struct hx711_data {
+
+ static int hx711_cycle(struct hx711_data *hx711_data)
+ {
+- int val;
++ unsigned long flags;
+
+ /*
+ * if preempted for more then 60us while PD_SCK is high:
+ * hx711 is going in reset
+ * ==> measuring is false
+ */
+- preempt_disable();
++ local_irq_save(flags);
+ gpiod_set_value(hx711_data->gpiod_pd_sck, 1);
+
+ /*
+@@ -126,7 +126,6 @@ static int hx711_cycle(struct hx711_data *hx711_data)
+ */
+ ndelay(hx711_data->data_ready_delay_ns);
+
+- val = gpiod_get_value(hx711_data->gpiod_dout);
+ /*
+ * here we are not waiting for 0.2 us as suggested by the datasheet,
+ * because the oscilloscope showed in a test scenario
+@@ -134,7 +133,7 @@ static int hx711_cycle(struct hx711_data *hx711_data)
+ * and 0.56 us for PD_SCK low on TI Sitara with 800 MHz
+ */
+ gpiod_set_value(hx711_data->gpiod_pd_sck, 0);
+- preempt_enable();
++ local_irq_restore(flags);
+
+ /*
+ * make it a square wave for addressing cases with capacitance on
+@@ -142,7 +141,8 @@ static int hx711_cycle(struct hx711_data *hx711_data)
+ */
+ ndelay(hx711_data->data_ready_delay_ns);
+
+- return val;
++ /* sample as late as possible */
++ return gpiod_get_value(hx711_data->gpiod_dout);
+ }
+
+ static int hx711_read(struct hx711_data *hx711_data)
+diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c
+index ca432e7b6ff1..38eb96693079 100644
+--- a/drivers/iio/adc/stm32-adc-core.c
++++ b/drivers/iio/adc/stm32-adc-core.c
+@@ -21,45 +21,22 @@
+
+ #include "stm32-adc-core.h"
+
+-/* STM32F4 - common registers for all ADC instances: 1, 2 & 3 */
+-#define STM32F4_ADC_CSR (STM32_ADCX_COMN_OFFSET + 0x00)
+-#define STM32F4_ADC_CCR (STM32_ADCX_COMN_OFFSET + 0x04)
+-
+-/* STM32F4_ADC_CSR - bit fields */
+-#define STM32F4_EOC3 BIT(17)
+-#define STM32F4_EOC2 BIT(9)
+-#define STM32F4_EOC1 BIT(1)
+-
+-/* STM32F4_ADC_CCR - bit fields */
+-#define STM32F4_ADC_ADCPRE_SHIFT 16
+-#define STM32F4_ADC_ADCPRE_MASK GENMASK(17, 16)
+-
+-/* STM32H7 - common registers for all ADC instances */
+-#define STM32H7_ADC_CSR (STM32_ADCX_COMN_OFFSET + 0x00)
+-#define STM32H7_ADC_CCR (STM32_ADCX_COMN_OFFSET + 0x08)
+-
+-/* STM32H7_ADC_CSR - bit fields */
+-#define STM32H7_EOC_SLV BIT(18)
+-#define STM32H7_EOC_MST BIT(2)
+-
+-/* STM32H7_ADC_CCR - bit fields */
+-#define STM32H7_PRESC_SHIFT 18
+-#define STM32H7_PRESC_MASK GENMASK(21, 18)
+-#define STM32H7_CKMODE_SHIFT 16
+-#define STM32H7_CKMODE_MASK GENMASK(17, 16)
+-
+ /**
+ * stm32_adc_common_regs - stm32 common registers, compatible dependent data
+ * @csr: common status register offset
+ * @eoc1: adc1 end of conversion flag in @csr
+ * @eoc2: adc2 end of conversion flag in @csr
+ * @eoc3: adc3 end of conversion flag in @csr
++ * @ier: interrupt enable register offset for each adc
++ * @eocie_msk: end of conversion interrupt enable mask in @ier
+ */
+ struct stm32_adc_common_regs {
+ u32 csr;
+ u32 eoc1_msk;
+ u32 eoc2_msk;
+ u32 eoc3_msk;
++ u32 ier;
++ u32 eocie_msk;
+ };
+
+ struct stm32_adc_priv;
+@@ -268,6 +245,8 @@ static const struct stm32_adc_common_regs stm32f4_adc_common_regs = {
+ .eoc1_msk = STM32F4_EOC1,
+ .eoc2_msk = STM32F4_EOC2,
+ .eoc3_msk = STM32F4_EOC3,
++ .ier = STM32F4_ADC_CR1,
++ .eocie_msk = STM32F4_EOCIE,
+ };
+
+ /* STM32H7 common registers definitions */
+@@ -275,8 +254,24 @@ static const struct stm32_adc_common_regs stm32h7_adc_common_regs = {
+ .csr = STM32H7_ADC_CSR,
+ .eoc1_msk = STM32H7_EOC_MST,
+ .eoc2_msk = STM32H7_EOC_SLV,
++ .ier = STM32H7_ADC_IER,
++ .eocie_msk = STM32H7_EOCIE,
++};
++
++static const unsigned int stm32_adc_offset[STM32_ADC_MAX_ADCS] = {
++ 0, STM32_ADC_OFFSET, STM32_ADC_OFFSET * 2,
+ };
+
++static unsigned int stm32_adc_eoc_enabled(struct stm32_adc_priv *priv,
++ unsigned int adc)
++{
++ u32 ier, offset = stm32_adc_offset[adc];
++
++ ier = readl_relaxed(priv->common.base + offset + priv->cfg->regs->ier);
++
++ return ier & priv->cfg->regs->eocie_msk;
++}
++
+ /* ADC common interrupt for all instances */
+ static void stm32_adc_irq_handler(struct irq_desc *desc)
+ {
+@@ -287,13 +282,28 @@ static void stm32_adc_irq_handler(struct irq_desc *desc)
+ chained_irq_enter(chip, desc);
+ status = readl_relaxed(priv->common.base + priv->cfg->regs->csr);
+
+- if (status & priv->cfg->regs->eoc1_msk)
++ /*
++ * End of conversion may be handled by using IRQ or DMA. There may be a
++ * race here when two conversions complete at the same time on several
++ * ADCs. EOC may be read 'set' for several ADCs, with:
++ * - an ADC configured to use DMA (EOC triggers the DMA request, and
++ * is then automatically cleared by DR read in hardware)
++ * - an ADC configured to use IRQs (EOCIE bit is set. The handler must
++ * be called in this case)
++ * So both EOC status bit in CSR and EOCIE control bit must be checked
++ * before invoking the interrupt handler (e.g. call ISR only for
++ * IRQ-enabled ADCs).
++ */
++ if (status & priv->cfg->regs->eoc1_msk &&
++ stm32_adc_eoc_enabled(priv, 0))
+ generic_handle_irq(irq_find_mapping(priv->domain, 0));
+
+- if (status & priv->cfg->regs->eoc2_msk)
++ if (status & priv->cfg->regs->eoc2_msk &&
++ stm32_adc_eoc_enabled(priv, 1))
+ generic_handle_irq(irq_find_mapping(priv->domain, 1));
+
+- if (status & priv->cfg->regs->eoc3_msk)
++ if (status & priv->cfg->regs->eoc3_msk &&
++ stm32_adc_eoc_enabled(priv, 2))
+ generic_handle_irq(irq_find_mapping(priv->domain, 2));
+
+ chained_irq_exit(chip, desc);
+diff --git a/drivers/iio/adc/stm32-adc-core.h b/drivers/iio/adc/stm32-adc-core.h
+index 8af507b3f32d..2579d514c2a3 100644
+--- a/drivers/iio/adc/stm32-adc-core.h
++++ b/drivers/iio/adc/stm32-adc-core.h
+@@ -25,8 +25,145 @@
+ * --------------------------------------------------------
+ */
+ #define STM32_ADC_MAX_ADCS 3
++#define STM32_ADC_OFFSET 0x100
+ #define STM32_ADCX_COMN_OFFSET 0x300
+
++/* STM32F4 - Registers for each ADC instance */
++#define STM32F4_ADC_SR 0x00
++#define STM32F4_ADC_CR1 0x04
++#define STM32F4_ADC_CR2 0x08
++#define STM32F4_ADC_SMPR1 0x0C
++#define STM32F4_ADC_SMPR2 0x10
++#define STM32F4_ADC_HTR 0x24
++#define STM32F4_ADC_LTR 0x28
++#define STM32F4_ADC_SQR1 0x2C
++#define STM32F4_ADC_SQR2 0x30
++#define STM32F4_ADC_SQR3 0x34
++#define STM32F4_ADC_JSQR 0x38
++#define STM32F4_ADC_JDR1 0x3C
++#define STM32F4_ADC_JDR2 0x40
++#define STM32F4_ADC_JDR3 0x44
++#define STM32F4_ADC_JDR4 0x48
++#define STM32F4_ADC_DR 0x4C
++
++/* STM32F4 - common registers for all ADC instances: 1, 2 & 3 */
++#define STM32F4_ADC_CSR (STM32_ADCX_COMN_OFFSET + 0x00)
++#define STM32F4_ADC_CCR (STM32_ADCX_COMN_OFFSET + 0x04)
++
++/* STM32F4_ADC_SR - bit fields */
++#define STM32F4_STRT BIT(4)
++#define STM32F4_EOC BIT(1)
++
++/* STM32F4_ADC_CR1 - bit fields */
++#define STM32F4_RES_SHIFT 24
++#define STM32F4_RES_MASK GENMASK(25, 24)
++#define STM32F4_SCAN BIT(8)
++#define STM32F4_EOCIE BIT(5)
++
++/* STM32F4_ADC_CR2 - bit fields */
++#define STM32F4_SWSTART BIT(30)
++#define STM32F4_EXTEN_SHIFT 28
++#define STM32F4_EXTEN_MASK GENMASK(29, 28)
++#define STM32F4_EXTSEL_SHIFT 24
++#define STM32F4_EXTSEL_MASK GENMASK(27, 24)
++#define STM32F4_EOCS BIT(10)
++#define STM32F4_DDS BIT(9)
++#define STM32F4_DMA BIT(8)
++#define STM32F4_ADON BIT(0)
++
++/* STM32F4_ADC_CSR - bit fields */
++#define STM32F4_EOC3 BIT(17)
++#define STM32F4_EOC2 BIT(9)
++#define STM32F4_EOC1 BIT(1)
++
++/* STM32F4_ADC_CCR - bit fields */
++#define STM32F4_ADC_ADCPRE_SHIFT 16
++#define STM32F4_ADC_ADCPRE_MASK GENMASK(17, 16)
++
++/* STM32H7 - Registers for each ADC instance */
++#define STM32H7_ADC_ISR 0x00
++#define STM32H7_ADC_IER 0x04
++#define STM32H7_ADC_CR 0x08
++#define STM32H7_ADC_CFGR 0x0C
++#define STM32H7_ADC_SMPR1 0x14
++#define STM32H7_ADC_SMPR2 0x18
++#define STM32H7_ADC_PCSEL 0x1C
++#define STM32H7_ADC_SQR1 0x30
++#define STM32H7_ADC_SQR2 0x34
++#define STM32H7_ADC_SQR3 0x38
++#define STM32H7_ADC_SQR4 0x3C
++#define STM32H7_ADC_DR 0x40
++#define STM32H7_ADC_DIFSEL 0xC0
++#define STM32H7_ADC_CALFACT 0xC4
++#define STM32H7_ADC_CALFACT2 0xC8
++
++/* STM32H7 - common registers for all ADC instances */
++#define STM32H7_ADC_CSR (STM32_ADCX_COMN_OFFSET + 0x00)
++#define STM32H7_ADC_CCR (STM32_ADCX_COMN_OFFSET + 0x08)
++
++/* STM32H7_ADC_ISR - bit fields */
++#define STM32MP1_VREGREADY BIT(12)
++#define STM32H7_EOC BIT(2)
++#define STM32H7_ADRDY BIT(0)
++
++/* STM32H7_ADC_IER - bit fields */
++#define STM32H7_EOCIE STM32H7_EOC
++
++/* STM32H7_ADC_CR - bit fields */
++#define STM32H7_ADCAL BIT(31)
++#define STM32H7_ADCALDIF BIT(30)
++#define STM32H7_DEEPPWD BIT(29)
++#define STM32H7_ADVREGEN BIT(28)
++#define STM32H7_LINCALRDYW6 BIT(27)
++#define STM32H7_LINCALRDYW5 BIT(26)
++#define STM32H7_LINCALRDYW4 BIT(25)
++#define STM32H7_LINCALRDYW3 BIT(24)
++#define STM32H7_LINCALRDYW2 BIT(23)
++#define STM32H7_LINCALRDYW1 BIT(22)
++#define STM32H7_ADCALLIN BIT(16)
++#define STM32H7_BOOST BIT(8)
++#define STM32H7_ADSTP BIT(4)
++#define STM32H7_ADSTART BIT(2)
++#define STM32H7_ADDIS BIT(1)
++#define STM32H7_ADEN BIT(0)
++
++/* STM32H7_ADC_CFGR bit fields */
++#define STM32H7_EXTEN_SHIFT 10
++#define STM32H7_EXTEN_MASK GENMASK(11, 10)
++#define STM32H7_EXTSEL_SHIFT 5
++#define STM32H7_EXTSEL_MASK GENMASK(9, 5)
++#define STM32H7_RES_SHIFT 2
++#define STM32H7_RES_MASK GENMASK(4, 2)
++#define STM32H7_DMNGT_SHIFT 0
++#define STM32H7_DMNGT_MASK GENMASK(1, 0)
++
++enum stm32h7_adc_dmngt {
++ STM32H7_DMNGT_DR_ONLY, /* Regular data in DR only */
++ STM32H7_DMNGT_DMA_ONESHOT, /* DMA one shot mode */
++ STM32H7_DMNGT_DFSDM, /* DFSDM mode */
++ STM32H7_DMNGT_DMA_CIRC, /* DMA circular mode */
++};
++
++/* STM32H7_ADC_CALFACT - bit fields */
++#define STM32H7_CALFACT_D_SHIFT 16
++#define STM32H7_CALFACT_D_MASK GENMASK(26, 16)
++#define STM32H7_CALFACT_S_SHIFT 0
++#define STM32H7_CALFACT_S_MASK GENMASK(10, 0)
++
++/* STM32H7_ADC_CALFACT2 - bit fields */
++#define STM32H7_LINCALFACT_SHIFT 0
++#define STM32H7_LINCALFACT_MASK GENMASK(29, 0)
++
++/* STM32H7_ADC_CSR - bit fields */
++#define STM32H7_EOC_SLV BIT(18)
++#define STM32H7_EOC_MST BIT(2)
++
++/* STM32H7_ADC_CCR - bit fields */
++#define STM32H7_PRESC_SHIFT 18
++#define STM32H7_PRESC_MASK GENMASK(21, 18)
++#define STM32H7_CKMODE_SHIFT 16
++#define STM32H7_CKMODE_MASK GENMASK(17, 16)
++
+ /**
+ * struct stm32_adc_common - stm32 ADC driver common data (for all instances)
+ * @base: control registers base cpu addr
+diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
+index 378411853d75..c52d20f7ca2e 100644
+--- a/drivers/iio/adc/stm32-adc.c
++++ b/drivers/iio/adc/stm32-adc.c
+@@ -27,115 +27,6 @@
+
+ #include "stm32-adc-core.h"
+
+-/* STM32F4 - Registers for each ADC instance */
+-#define STM32F4_ADC_SR 0x00
+-#define STM32F4_ADC_CR1 0x04
+-#define STM32F4_ADC_CR2 0x08
+-#define STM32F4_ADC_SMPR1 0x0C
+-#define STM32F4_ADC_SMPR2 0x10
+-#define STM32F4_ADC_HTR 0x24
+-#define STM32F4_ADC_LTR 0x28
+-#define STM32F4_ADC_SQR1 0x2C
+-#define STM32F4_ADC_SQR2 0x30
+-#define STM32F4_ADC_SQR3 0x34
+-#define STM32F4_ADC_JSQR 0x38
+-#define STM32F4_ADC_JDR1 0x3C
+-#define STM32F4_ADC_JDR2 0x40
+-#define STM32F4_ADC_JDR3 0x44
+-#define STM32F4_ADC_JDR4 0x48
+-#define STM32F4_ADC_DR 0x4C
+-
+-/* STM32F4_ADC_SR - bit fields */
+-#define STM32F4_STRT BIT(4)
+-#define STM32F4_EOC BIT(1)
+-
+-/* STM32F4_ADC_CR1 - bit fields */
+-#define STM32F4_RES_SHIFT 24
+-#define STM32F4_RES_MASK GENMASK(25, 24)
+-#define STM32F4_SCAN BIT(8)
+-#define STM32F4_EOCIE BIT(5)
+-
+-/* STM32F4_ADC_CR2 - bit fields */
+-#define STM32F4_SWSTART BIT(30)
+-#define STM32F4_EXTEN_SHIFT 28
+-#define STM32F4_EXTEN_MASK GENMASK(29, 28)
+-#define STM32F4_EXTSEL_SHIFT 24
+-#define STM32F4_EXTSEL_MASK GENMASK(27, 24)
+-#define STM32F4_EOCS BIT(10)
+-#define STM32F4_DDS BIT(9)
+-#define STM32F4_DMA BIT(8)
+-#define STM32F4_ADON BIT(0)
+-
+-/* STM32H7 - Registers for each ADC instance */
+-#define STM32H7_ADC_ISR 0x00
+-#define STM32H7_ADC_IER 0x04
+-#define STM32H7_ADC_CR 0x08
+-#define STM32H7_ADC_CFGR 0x0C
+-#define STM32H7_ADC_SMPR1 0x14
+-#define STM32H7_ADC_SMPR2 0x18
+-#define STM32H7_ADC_PCSEL 0x1C
+-#define STM32H7_ADC_SQR1 0x30
+-#define STM32H7_ADC_SQR2 0x34
+-#define STM32H7_ADC_SQR3 0x38
+-#define STM32H7_ADC_SQR4 0x3C
+-#define STM32H7_ADC_DR 0x40
+-#define STM32H7_ADC_DIFSEL 0xC0
+-#define STM32H7_ADC_CALFACT 0xC4
+-#define STM32H7_ADC_CALFACT2 0xC8
+-
+-/* STM32H7_ADC_ISR - bit fields */
+-#define STM32MP1_VREGREADY BIT(12)
+-#define STM32H7_EOC BIT(2)
+-#define STM32H7_ADRDY BIT(0)
+-
+-/* STM32H7_ADC_IER - bit fields */
+-#define STM32H7_EOCIE STM32H7_EOC
+-
+-/* STM32H7_ADC_CR - bit fields */
+-#define STM32H7_ADCAL BIT(31)
+-#define STM32H7_ADCALDIF BIT(30)
+-#define STM32H7_DEEPPWD BIT(29)
+-#define STM32H7_ADVREGEN BIT(28)
+-#define STM32H7_LINCALRDYW6 BIT(27)
+-#define STM32H7_LINCALRDYW5 BIT(26)
+-#define STM32H7_LINCALRDYW4 BIT(25)
+-#define STM32H7_LINCALRDYW3 BIT(24)
+-#define STM32H7_LINCALRDYW2 BIT(23)
+-#define STM32H7_LINCALRDYW1 BIT(22)
+-#define STM32H7_ADCALLIN BIT(16)
+-#define STM32H7_BOOST BIT(8)
+-#define STM32H7_ADSTP BIT(4)
+-#define STM32H7_ADSTART BIT(2)
+-#define STM32H7_ADDIS BIT(1)
+-#define STM32H7_ADEN BIT(0)
+-
+-/* STM32H7_ADC_CFGR bit fields */
+-#define STM32H7_EXTEN_SHIFT 10
+-#define STM32H7_EXTEN_MASK GENMASK(11, 10)
+-#define STM32H7_EXTSEL_SHIFT 5
+-#define STM32H7_EXTSEL_MASK GENMASK(9, 5)
+-#define STM32H7_RES_SHIFT 2
+-#define STM32H7_RES_MASK GENMASK(4, 2)
+-#define STM32H7_DMNGT_SHIFT 0
+-#define STM32H7_DMNGT_MASK GENMASK(1, 0)
+-
+-enum stm32h7_adc_dmngt {
+- STM32H7_DMNGT_DR_ONLY, /* Regular data in DR only */
+- STM32H7_DMNGT_DMA_ONESHOT, /* DMA one shot mode */
+- STM32H7_DMNGT_DFSDM, /* DFSDM mode */
+- STM32H7_DMNGT_DMA_CIRC, /* DMA circular mode */
+-};
+-
+-/* STM32H7_ADC_CALFACT - bit fields */
+-#define STM32H7_CALFACT_D_SHIFT 16
+-#define STM32H7_CALFACT_D_MASK GENMASK(26, 16)
+-#define STM32H7_CALFACT_S_SHIFT 0
+-#define STM32H7_CALFACT_S_MASK GENMASK(10, 0)
+-
+-/* STM32H7_ADC_CALFACT2 - bit fields */
+-#define STM32H7_LINCALFACT_SHIFT 0
+-#define STM32H7_LINCALFACT_MASK GENMASK(29, 0)
+-
+ /* Number of linear calibration shadow registers / LINCALRDYW control bits */
+ #define STM32H7_LINCALFACT_NUM 6
+
+diff --git a/drivers/iio/light/opt3001.c b/drivers/iio/light/opt3001.c
+index 54d88b60e303..f9d13e4ec108 100644
+--- a/drivers/iio/light/opt3001.c
++++ b/drivers/iio/light/opt3001.c
+@@ -694,6 +694,7 @@ static irqreturn_t opt3001_irq(int irq, void *_iio)
+ struct iio_dev *iio = _iio;
+ struct opt3001 *opt = iio_priv(iio);
+ int ret;
++ bool wake_result_ready_queue = false;
+
+ if (!opt->ok_to_ignore_lock)
+ mutex_lock(&opt->lock);
+@@ -728,13 +729,16 @@ static irqreturn_t opt3001_irq(int irq, void *_iio)
+ }
+ opt->result = ret;
+ opt->result_ready = true;
+- wake_up(&opt->result_ready_queue);
++ wake_result_ready_queue = true;
+ }
+
+ out:
+ if (!opt->ok_to_ignore_lock)
+ mutex_unlock(&opt->lock);
+
++ if (wake_result_ready_queue)
++ wake_up(&opt->result_ready_queue);
++
+ return IRQ_HANDLED;
+ }
+
+diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
+index 5accb5241072..6e3f234e790b 100644
+--- a/drivers/media/usb/stkwebcam/stk-webcam.c
++++ b/drivers/media/usb/stkwebcam/stk-webcam.c
+@@ -641,8 +641,7 @@ static int v4l_stk_release(struct file *fp)
+ dev->owner = NULL;
+ }
+
+- if (is_present(dev))
+- usb_autopm_put_interface(dev->interface);
++ usb_autopm_put_interface(dev->interface);
+ mutex_unlock(&dev->lock);
+ return v4l2_fh_release(fp);
+ }
+diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
+index a6f41f96f2a1..198e030e5b3d 100644
+--- a/drivers/misc/mei/bus-fixup.c
++++ b/drivers/misc/mei/bus-fixup.c
+@@ -214,13 +214,21 @@ static void mei_mkhi_fix(struct mei_cl_device *cldev)
+ {
+ int ret;
+
++ /* No need to enable the client if nothing is needed from it */
++ if (!cldev->bus->fw_f_fw_ver_supported &&
++ !cldev->bus->hbm_f_os_supported)
++ return;
++
+ ret = mei_cldev_enable(cldev);
+ if (ret)
+ return;
+
+- ret = mei_fwver(cldev);
+- if (ret < 0)
+- dev_err(&cldev->dev, "FW version command failed %d\n", ret);
++ if (cldev->bus->fw_f_fw_ver_supported) {
++ ret = mei_fwver(cldev);
++ if (ret < 0)
++ dev_err(&cldev->dev, "FW version command failed %d\n",
++ ret);
++ }
+
+ if (cldev->bus->hbm_f_os_supported) {
+ ret = mei_osver(cldev);
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index cdd7af16d5ee..f85aa3f4042d 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -139,6 +139,9 @@
+ #define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */
+ #define MEI_DEV_ID_CNP_H_4 0xA364 /* Cannon Point H 4 (iTouch) */
+
++#define MEI_DEV_ID_CMP_LP 0x02e0 /* Comet Point LP */
++#define MEI_DEV_ID_CMP_LP_3 0x02e4 /* Comet Point LP 3 (iTouch) */
++
+ #define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
+
+ #define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */
+diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
+index 0759c3a668de..60c8c84181a9 100644
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -1368,6 +1368,8 @@ static bool mei_me_fw_type_sps(struct pci_dev *pdev)
+ #define MEI_CFG_FW_SPS \
+ .quirk_probe = mei_me_fw_type_sps
+
++#define MEI_CFG_FW_VER_SUPP \
++ .fw_ver_supported = 1
+
+ #define MEI_CFG_ICH_HFS \
+ .fw_status.count = 0
+@@ -1405,31 +1407,41 @@ static const struct mei_cfg mei_me_ich10_cfg = {
+ MEI_CFG_ICH10_HFS,
+ };
+
+-/* PCH devices */
+-static const struct mei_cfg mei_me_pch_cfg = {
++/* PCH6 devices */
++static const struct mei_cfg mei_me_pch6_cfg = {
+ MEI_CFG_PCH_HFS,
+ };
+
++/* PCH7 devices */
++static const struct mei_cfg mei_me_pch7_cfg = {
++ MEI_CFG_PCH_HFS,
++ MEI_CFG_FW_VER_SUPP,
++};
++
+ /* PCH Cougar Point and Patsburg with quirk for Node Manager exclusion */
+ static const struct mei_cfg mei_me_pch_cpt_pbg_cfg = {
+ MEI_CFG_PCH_HFS,
++ MEI_CFG_FW_VER_SUPP,
+ MEI_CFG_FW_NM,
+ };
+
+ /* PCH8 Lynx Point and newer devices */
+ static const struct mei_cfg mei_me_pch8_cfg = {
+ MEI_CFG_PCH8_HFS,
++ MEI_CFG_FW_VER_SUPP,
+ };
+
+ /* PCH8 Lynx Point with quirk for SPS Firmware exclusion */
+ static const struct mei_cfg mei_me_pch8_sps_cfg = {
+ MEI_CFG_PCH8_HFS,
++ MEI_CFG_FW_VER_SUPP,
+ MEI_CFG_FW_SPS,
+ };
+
+ /* Cannon Lake and newer devices */
+ static const struct mei_cfg mei_me_pch12_cfg = {
+ MEI_CFG_PCH8_HFS,
++ MEI_CFG_FW_VER_SUPP,
+ MEI_CFG_DMA_128,
+ };
+
+@@ -1441,7 +1453,8 @@ static const struct mei_cfg *const mei_cfg_list[] = {
+ [MEI_ME_UNDEF_CFG] = NULL,
+ [MEI_ME_ICH_CFG] = &mei_me_ich_cfg,
+ [MEI_ME_ICH10_CFG] = &mei_me_ich10_cfg,
+- [MEI_ME_PCH_CFG] = &mei_me_pch_cfg,
++ [MEI_ME_PCH6_CFG] = &mei_me_pch6_cfg,
++ [MEI_ME_PCH7_CFG] = &mei_me_pch7_cfg,
+ [MEI_ME_PCH_CPT_PBG_CFG] = &mei_me_pch_cpt_pbg_cfg,
+ [MEI_ME_PCH8_CFG] = &mei_me_pch8_cfg,
+ [MEI_ME_PCH8_SPS_CFG] = &mei_me_pch8_sps_cfg,
+@@ -1480,6 +1493,8 @@ struct mei_device *mei_me_dev_init(struct pci_dev *pdev,
+
+ mei_device_init(dev, &pdev->dev, &mei_me_hw_ops);
+ hw->cfg = cfg;
++ dev->fw_f_fw_ver_supported = cfg->fw_ver_supported;
++
+ return dev;
+ }
+
+diff --git a/drivers/misc/mei/hw-me.h b/drivers/misc/mei/hw-me.h
+index bbcc5fc106cd..775971339789 100644
+--- a/drivers/misc/mei/hw-me.h
++++ b/drivers/misc/mei/hw-me.h
+@@ -32,11 +32,13 @@
+ * @fw_status: FW status
+ * @quirk_probe: device exclusion quirk
+ * @dma_size: device DMA buffers size
++ * @fw_ver_supported: is fw version retrievable from FW
+ */
+ struct mei_cfg {
+ const struct mei_fw_status fw_status;
+ bool (*quirk_probe)(struct pci_dev *pdev);
+ size_t dma_size[DMA_DSCR_NUM];
++ u32 fw_ver_supported:1;
+ };
+
+
+@@ -74,7 +76,8 @@ struct mei_me_hw {
+ * @MEI_ME_UNDEF_CFG: Lower sentinel.
+ * @MEI_ME_ICH_CFG: I/O Controller Hub legacy devices.
+ * @MEI_ME_ICH10_CFG: I/O Controller Hub platforms Gen10
+- * @MEI_ME_PCH_CFG: Platform Controller Hub platforms (Up to Gen8).
++ * @MEI_ME_PCH6_CFG: Platform Controller Hub platforms (Gen6).
++ * @MEI_ME_PCH7_CFG: Platform Controller Hub platforms (Gen7).
+ * @MEI_ME_PCH_CPT_PBG_CFG:Platform Controller Hub workstations
+ * with quirk for Node Manager exclusion.
+ * @MEI_ME_PCH8_CFG: Platform Controller Hub Gen8 and newer
+@@ -89,7 +92,8 @@ enum mei_cfg_idx {
+ MEI_ME_UNDEF_CFG,
+ MEI_ME_ICH_CFG,
+ MEI_ME_ICH10_CFG,
+- MEI_ME_PCH_CFG,
++ MEI_ME_PCH6_CFG,
++ MEI_ME_PCH7_CFG,
+ MEI_ME_PCH_CPT_PBG_CFG,
+ MEI_ME_PCH8_CFG,
+ MEI_ME_PCH8_SPS_CFG,
+diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
+index 377397e1b5a5..fc7a5e3fbfcd 100644
+--- a/drivers/misc/mei/mei_dev.h
++++ b/drivers/misc/mei/mei_dev.h
+@@ -422,6 +422,8 @@ struct mei_fw_version {
+ *
+ * @fw_ver : FW versions
+ *
++ * @fw_f_fw_ver_supported : fw feature: fw version supported
++ *
+ * @me_clients_rwsem: rw lock over me_clients list
+ * @me_clients : list of FW clients
+ * @me_clients_map : FW clients bit map
+@@ -500,6 +502,8 @@ struct mei_device {
+
+ struct mei_fw_version fw_ver[MEI_MAX_FW_VER_BLOCKS];
+
++ unsigned int fw_f_fw_ver_supported:1;
++
+ struct rw_semaphore me_clients_rwsem;
+ struct list_head me_clients;
+ DECLARE_BITMAP(me_clients_map, MEI_CLIENTS_MAX);
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index e41f9e0a3fdf..28cdd87851cb 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -70,13 +70,13 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_3, MEI_ME_ICH10_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_4, MEI_ME_ICH10_CFG)},
+
+- {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_1, MEI_ME_PCH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_2, MEI_ME_PCH_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_1, MEI_ME_PCH6_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_2, MEI_ME_PCH6_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CPT_1, MEI_ME_PCH_CPT_PBG_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_PBG_1, MEI_ME_PCH_CPT_PBG_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_1, MEI_ME_PCH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_2, MEI_ME_PCH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_3, MEI_ME_PCH_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_1, MEI_ME_PCH7_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_2, MEI_ME_PCH7_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_3, MEI_ME_PCH7_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_H, MEI_ME_PCH8_SPS_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_W, MEI_ME_PCH8_SPS_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_LP, MEI_ME_PCH8_CFG)},
+@@ -105,6 +105,9 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP, MEI_ME_PCH12_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP_3, MEI_ME_PCH8_CFG)},
++
+ {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH12_CFG)},
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index 52d4fa4161dc..65eaa6b61868 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -97,6 +97,7 @@ struct vmd_dev {
+ struct resource resources[3];
+ struct irq_domain *irq_domain;
+ struct pci_bus *bus;
++ u8 busn_start;
+
+ #ifdef CONFIG_X86_DEV_DMA_OPS
+ struct dma_map_ops dma_ops;
+@@ -468,7 +469,8 @@ static char __iomem *vmd_cfg_addr(struct vmd_dev *vmd, struct pci_bus *bus,
+ unsigned int devfn, int reg, int len)
+ {
+ char __iomem *addr = vmd->cfgbar +
+- (bus->number << 20) + (devfn << 12) + reg;
++ ((bus->number - vmd->busn_start) << 20) +
++ (devfn << 12) + reg;
+
+ if ((addr - vmd->cfgbar) + len >=
+ resource_size(&vmd->dev->resource[VMD_CFGBAR]))
+@@ -591,7 +593,7 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+ unsigned long flags;
+ LIST_HEAD(resources);
+ resource_size_t offset[2] = {0};
+- resource_size_t membar2_offset = 0x2000, busn_start = 0;
++ resource_size_t membar2_offset = 0x2000;
+
+ /*
+ * Shadow registers may exist in certain VMD device ids which allow
+@@ -633,14 +635,14 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+ pci_read_config_dword(vmd->dev, PCI_REG_VMCONFIG, &vmconfig);
+ if (BUS_RESTRICT_CAP(vmcap) &&
+ (BUS_RESTRICT_CFG(vmconfig) == 0x1))
+- busn_start = 128;
++ vmd->busn_start = 128;
+ }
+
+ res = &vmd->dev->resource[VMD_CFGBAR];
+ vmd->resources[0] = (struct resource) {
+ .name = "VMD CFGBAR",
+- .start = busn_start,
+- .end = busn_start + (resource_size(res) >> 20) - 1,
++ .start = vmd->busn_start,
++ .end = vmd->busn_start + (resource_size(res) >> 20) - 1,
+ .flags = IORESOURCE_BUS | IORESOURCE_PCI_FIXED,
+ };
+
+@@ -708,8 +710,8 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+ pci_add_resource_offset(&resources, &vmd->resources[1], offset[0]);
+ pci_add_resource_offset(&resources, &vmd->resources[2], offset[1]);
+
+- vmd->bus = pci_create_root_bus(&vmd->dev->dev, busn_start, &vmd_ops,
+- sd, &resources);
++ vmd->bus = pci_create_root_bus(&vmd->dev->dev, vmd->busn_start,
++ &vmd_ops, sd, &resources);
+ if (!vmd->bus) {
+ pci_free_resource_list(&resources);
+ irq_domain_remove(vmd->irq_domain);
+diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c
+index a2df02d97a8e..16fcf633e60f 100644
+--- a/drivers/staging/fbtft/fbtft-core.c
++++ b/drivers/staging/fbtft/fbtft-core.c
+@@ -819,7 +819,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,
+ if (par->gamma.curves && gamma) {
+ if (fbtft_gamma_parse_str(par, par->gamma.curves, gamma,
+ strlen(gamma)))
+- goto alloc_fail;
++ goto release_framebuf;
+ }
+
+ /* Transmit buffer */
+@@ -836,7 +836,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,
+ if (txbuflen > 0) {
+ txbuf = devm_kzalloc(par->info->device, txbuflen, GFP_KERNEL);
+ if (!txbuf)
+- goto alloc_fail;
++ goto release_framebuf;
+ par->txbuf.buf = txbuf;
+ par->txbuf.len = txbuflen;
+ }
+@@ -872,6 +872,9 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,
+
+ return info;
+
++release_framebuf:
++ framebuffer_release(info);
++
+ alloc_fail:
+ vfree(vmem);
+
+diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
+index 607804aa560d..76f434c1c088 100644
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -1755,8 +1755,10 @@ vt6655_probe(struct pci_dev *pcid, const struct pci_device_id *ent)
+
+ priv->hw->max_signal = 100;
+
+- if (vnt_init(priv))
++ if (vnt_init(priv)) {
++ device_free_info(priv);
+ return -ENODEV;
++ }
+
+ device_print_info(priv);
+ pci_set_drvdata(pcid, priv);
+diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
+index 98d3eadd2fd0..8df305822668 100644
+--- a/drivers/tty/serial/uartlite.c
++++ b/drivers/tty/serial/uartlite.c
+@@ -837,7 +837,8 @@ err_uart:
+ static void __exit ulite_exit(void)
+ {
+ platform_driver_unregister(&ulite_platform_driver);
+- uart_unregister_driver(&ulite_uart_driver);
++ if (ulite_uart_driver.state)
++ uart_unregister_driver(&ulite_uart_driver);
+ }
+
+ module_init(ulite_init);
+diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
+index 407a7a6198a2..502e9bf1746f 100644
+--- a/drivers/usb/class/usblp.c
++++ b/drivers/usb/class/usblp.c
+@@ -461,10 +461,12 @@ static int usblp_release(struct inode *inode, struct file *file)
+
+ mutex_lock(&usblp_mutex);
+ usblp->used = 0;
+- if (usblp->present) {
++ if (usblp->present)
+ usblp_unlink_urbs(usblp);
+- usb_autopm_put_interface(usblp->intf);
+- } else /* finish cleanup from disconnect */
++
++ usb_autopm_put_interface(usblp->intf);
++
++ if (!usblp->present) /* finish cleanup from disconnect */
+ usblp_cleanup(usblp);
+ mutex_unlock(&usblp_mutex);
+ return 0;
+diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
+index 213b52508621..1505e554d245 100644
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -48,6 +48,7 @@
+ #define DRIVER_VERSION "02 May 2005"
+
+ #define POWER_BUDGET 500 /* in mA; use 8 for low-power port testing */
++#define POWER_BUDGET_3 900 /* in mA */
+
+ static const char driver_name[] = "dummy_hcd";
+ static const char driver_desc[] = "USB Host+Gadget Emulator";
+@@ -2446,7 +2447,7 @@ static int dummy_start_ss(struct dummy_hcd *dum_hcd)
+ dum_hcd->rh_state = DUMMY_RH_RUNNING;
+ dum_hcd->stream_en_ep = 0;
+ INIT_LIST_HEAD(&dum_hcd->urbp_list);
+- dummy_hcd_to_hcd(dum_hcd)->power_budget = POWER_BUDGET;
++ dummy_hcd_to_hcd(dum_hcd)->power_budget = POWER_BUDGET_3;
+ dummy_hcd_to_hcd(dum_hcd)->state = HC_STATE_RUNNING;
+ dummy_hcd_to_hcd(dum_hcd)->uses_new_polling = 1;
+ #ifdef CONFIG_USB_OTG
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index f896a00662ef..9d79824ab5b6 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3154,10 +3154,10 @@ static int xhci_align_td(struct xhci_hcd *xhci, struct urb *urb, u32 enqd_len,
+ if (usb_urb_dir_out(urb)) {
+ len = sg_pcopy_to_buffer(urb->sg, urb->num_sgs,
+ seg->bounce_buf, new_buff_len, enqd_len);
+- if (len != seg->bounce_len)
++ if (len != new_buff_len)
+ xhci_warn(xhci,
+ "WARN Wrong bounce buffer write length: %zu != %d\n",
+- len, seg->bounce_len);
++ len, new_buff_len);
+ seg->bounce_dma = dma_map_single(dev, seg->bounce_buf,
+ max_pkt, DMA_TO_DEVICE);
+ } else {
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 4ffadca2c71a..36865d50171f 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1022,7 +1022,7 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
+ writel(command, &xhci->op_regs->command);
+ xhci->broken_suspend = 0;
+ if (xhci_handshake(&xhci->op_regs->status,
+- STS_SAVE, 0, 10 * 1000)) {
++ STS_SAVE, 0, 20 * 1000)) {
+ /*
+ * AMD SNPS xHC 3.0 occasionally does not clear the
+ * SSS bit of USBSTS and when driver tries to poll
+@@ -1098,6 +1098,18 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ hibernated = true;
+
+ if (!hibernated) {
++ /*
++ * Some controllers might lose power during suspend, so wait
++ * for controller not ready bit to clear, just as in xHC init.
++ */
++ retval = xhci_handshake(&xhci->op_regs->status,
++ STS_CNR, 0, 10 * 1000 * 1000);
++ if (retval) {
++ xhci_warn(xhci, "Controller not ready at resume %d\n",
++ retval);
++ spin_unlock_irq(&xhci->lock);
++ return retval;
++ }
+ /* step 1: restore register */
+ xhci_restore_registers(xhci);
+ /* step 2: initialize command ring buffer */
+@@ -3053,6 +3065,7 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
+ unsigned int ep_index;
+ unsigned long flags;
+ u32 ep_flag;
++ int err;
+
+ xhci = hcd_to_xhci(hcd);
+ if (!host_ep->hcpriv)
+@@ -3102,7 +3115,17 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
+ xhci_free_command(xhci, cfg_cmd);
+ goto cleanup;
+ }
+- xhci_queue_stop_endpoint(xhci, stop_cmd, udev->slot_id, ep_index, 0);
++
++ err = xhci_queue_stop_endpoint(xhci, stop_cmd, udev->slot_id,
++ ep_index, 0);
++ if (err < 0) {
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ xhci_free_command(xhci, cfg_cmd);
++ xhci_dbg(xhci, "%s: Failed to queue stop ep command, %d ",
++ __func__, err);
++ goto cleanup;
++ }
++
+ xhci_ring_cmd_db(xhci);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+
+@@ -3116,8 +3139,16 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
+ ctrl_ctx, ep_flag, ep_flag);
+ xhci_endpoint_copy(xhci, cfg_cmd->in_ctx, vdev->out_ctx, ep_index);
+
+- xhci_queue_configure_endpoint(xhci, cfg_cmd, cfg_cmd->in_ctx->dma,
++ err = xhci_queue_configure_endpoint(xhci, cfg_cmd, cfg_cmd->in_ctx->dma,
+ udev->slot_id, false);
++ if (err < 0) {
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ xhci_free_command(xhci, cfg_cmd);
++ xhci_dbg(xhci, "%s: Failed to queue config ep command, %d ",
++ __func__, err);
++ goto cleanup;
++ }
++
+ xhci_ring_cmd_db(xhci);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+
+@@ -4631,12 +4662,12 @@ static int xhci_update_timeout_for_endpoint(struct xhci_hcd *xhci,
+ alt_timeout = xhci_call_host_update_timeout_for_endpoint(xhci, udev,
+ desc, state, timeout);
+
+- /* If we found we can't enable hub-initiated LPM, or
++ /* If we found we can't enable hub-initiated LPM, and
+ * the U1 or U2 exit latency was too high to allow
+- * device-initiated LPM as well, just stop searching.
++ * device-initiated LPM as well, then we will disable LPM
++ * for this device, so stop searching any further.
+ */
+- if (alt_timeout == USB3_LPM_DISABLED ||
+- alt_timeout == USB3_LPM_DEVICE_INITIATED) {
++ if (alt_timeout == USB3_LPM_DISABLED) {
+ *timeout = alt_timeout;
+ return -E2BIG;
+ }
+@@ -4747,10 +4778,12 @@ static u16 xhci_calculate_lpm_timeout(struct usb_hcd *hcd,
+ if (intf->dev.driver) {
+ driver = to_usb_driver(intf->dev.driver);
+ if (driver && driver->disable_hub_initiated_lpm) {
+- dev_dbg(&udev->dev, "Hub-initiated %s disabled "
+- "at request of driver %s\n",
+- state_name, driver->name);
+- return xhci_get_timeout_no_hub_lpm(udev, state);
++ dev_dbg(&udev->dev, "Hub-initiated %s disabled at request of driver %s\n",
++ state_name, driver->name);
++ timeout = xhci_get_timeout_no_hub_lpm(udev,
++ state);
++ if (timeout == USB3_LPM_DISABLED)
++ return timeout;
+ }
+ }
+
+@@ -5034,11 +5067,18 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+ hcd->has_tt = 1;
+ } else {
+ /*
+- * Some 3.1 hosts return sbrn 0x30, use xhci supported protocol
+- * minor revision instead of sbrn. Minor revision is a two digit
+- * BCD containing minor and sub-minor numbers, only show minor.
++ * Early xHCI 1.1 spec did not mention USB 3.1 capable hosts
++ * should return 0x31 for sbrn, or that the minor revision
++ * is a two digit BCD containig minor and sub-minor numbers.
++ * This was later clarified in xHCI 1.2.
++ *
++ * Some USB 3.1 capable hosts therefore have sbrn 0x30, and
++ * minor revision set to 0x1 instead of 0x10.
+ */
+- minor_rev = xhci->usb3_rhub.min_rev / 0x10;
++ if (xhci->usb3_rhub.min_rev == 0x1)
++ minor_rev = 1;
++ else
++ minor_rev = xhci->usb3_rhub.min_rev / 0x10;
+
+ switch (minor_rev) {
+ case 2:
+diff --git a/drivers/usb/image/microtek.c b/drivers/usb/image/microtek.c
+index 9f2f563c82ed..addbb47a5033 100644
+--- a/drivers/usb/image/microtek.c
++++ b/drivers/usb/image/microtek.c
+@@ -721,6 +721,10 @@ static int mts_usb_probe(struct usb_interface *intf,
+
+ }
+
++ if (ep_in_current != &ep_in_set[2]) {
++ MTS_WARNING("couldn't find two input bulk endpoints. Bailing out.\n");
++ return -ENODEV;
++ }
+
+ if ( ep_out == -1 ) {
+ MTS_WARNING( "couldn't find an output bulk endpoint. Bailing out.\n" );
+diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
+index 68d2f2cd17dd..2e3fc63619b7 100644
+--- a/drivers/usb/misc/Kconfig
++++ b/drivers/usb/misc/Kconfig
+@@ -46,16 +46,6 @@ config USB_SEVSEG
+ To compile this driver as a module, choose M here: the
+ module will be called usbsevseg.
+
+-config USB_RIO500
+- tristate "USB Diamond Rio500 support"
+- help
+- Say Y here if you want to connect a USB Rio500 mp3 player to your
+- computer's USB port. Please read <file:Documentation/usb/rio.txt>
+- for more information.
+-
+- To compile this driver as a module, choose M here: the
+- module will be called rio500.
+-
+ config USB_LEGOTOWER
+ tristate "USB Lego Infrared Tower support"
+ help
+diff --git a/drivers/usb/misc/Makefile b/drivers/usb/misc/Makefile
+index 109f54f5b9aa..0d416eb624bb 100644
+--- a/drivers/usb/misc/Makefile
++++ b/drivers/usb/misc/Makefile
+@@ -17,7 +17,6 @@ obj-$(CONFIG_USB_ISIGHTFW) += isight_firmware.o
+ obj-$(CONFIG_USB_LCD) += usblcd.o
+ obj-$(CONFIG_USB_LD) += ldusb.o
+ obj-$(CONFIG_USB_LEGOTOWER) += legousbtower.o
+-obj-$(CONFIG_USB_RIO500) += rio500.o
+ obj-$(CONFIG_USB_TEST) += usbtest.o
+ obj-$(CONFIG_USB_EHSET_TEST_FIXTURE) += ehset.o
+ obj-$(CONFIG_USB_TRANCEVIBRATOR) += trancevibrator.o
+diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
+index 9465fb95d70a..9a51760df026 100644
+--- a/drivers/usb/misc/adutux.c
++++ b/drivers/usb/misc/adutux.c
+@@ -75,6 +75,7 @@ struct adu_device {
+ char serial_number[8];
+
+ int open_count; /* number of times this port has been opened */
++ unsigned long disconnected:1;
+
+ char *read_buffer_primary;
+ int read_buffer_length;
+@@ -116,7 +117,7 @@ static void adu_abort_transfers(struct adu_device *dev)
+ {
+ unsigned long flags;
+
+- if (dev->udev == NULL)
++ if (dev->disconnected)
+ return;
+
+ /* shutdown transfer */
+@@ -148,6 +149,7 @@ static void adu_delete(struct adu_device *dev)
+ kfree(dev->read_buffer_secondary);
+ kfree(dev->interrupt_in_buffer);
+ kfree(dev->interrupt_out_buffer);
++ usb_put_dev(dev->udev);
+ kfree(dev);
+ }
+
+@@ -243,7 +245,7 @@ static int adu_open(struct inode *inode, struct file *file)
+ }
+
+ dev = usb_get_intfdata(interface);
+- if (!dev || !dev->udev) {
++ if (!dev) {
+ retval = -ENODEV;
+ goto exit_no_device;
+ }
+@@ -326,7 +328,7 @@ static int adu_release(struct inode *inode, struct file *file)
+ }
+
+ adu_release_internal(dev);
+- if (dev->udev == NULL) {
++ if (dev->disconnected) {
+ /* the device was unplugged before the file was released */
+ if (!dev->open_count) /* ... and we're the last user */
+ adu_delete(dev);
+@@ -355,7 +357,7 @@ static ssize_t adu_read(struct file *file, __user char *buffer, size_t count,
+ return -ERESTARTSYS;
+
+ /* verify that the device wasn't unplugged */
+- if (dev->udev == NULL) {
++ if (dev->disconnected) {
+ retval = -ENODEV;
+ pr_err("No device or device unplugged %d\n", retval);
+ goto exit;
+@@ -520,7 +522,7 @@ static ssize_t adu_write(struct file *file, const __user char *buffer,
+ goto exit_nolock;
+
+ /* verify that the device wasn't unplugged */
+- if (dev->udev == NULL) {
++ if (dev->disconnected) {
+ retval = -ENODEV;
+ pr_err("No device or device unplugged %d\n", retval);
+ goto exit;
+@@ -665,7 +667,7 @@ static int adu_probe(struct usb_interface *interface,
+
+ mutex_init(&dev->mtx);
+ spin_lock_init(&dev->buflock);
+- dev->udev = udev;
++ dev->udev = usb_get_dev(udev);
+ init_waitqueue_head(&dev->read_wait);
+ init_waitqueue_head(&dev->write_wait);
+
+@@ -764,14 +766,18 @@ static void adu_disconnect(struct usb_interface *interface)
+
+ dev = usb_get_intfdata(interface);
+
+- mutex_lock(&dev->mtx); /* not interruptible */
+- dev->udev = NULL; /* poison */
+ usb_deregister_dev(interface, &adu_class);
+- mutex_unlock(&dev->mtx);
++
++ usb_poison_urb(dev->interrupt_in_urb);
++ usb_poison_urb(dev->interrupt_out_urb);
+
+ mutex_lock(&adutux_mutex);
+ usb_set_intfdata(interface, NULL);
+
++ mutex_lock(&dev->mtx); /* not interruptible */
++ dev->disconnected = 1;
++ mutex_unlock(&dev->mtx);
++
+ /* if the device is not opened, then we clean up right now */
+ if (!dev->open_count)
+ adu_delete(dev);
+diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
+index cf5828ce927a..34e6cd6f40d3 100644
+--- a/drivers/usb/misc/chaoskey.c
++++ b/drivers/usb/misc/chaoskey.c
+@@ -98,6 +98,7 @@ static void chaoskey_free(struct chaoskey *dev)
+ usb_free_urb(dev->urb);
+ kfree(dev->name);
+ kfree(dev->buf);
++ usb_put_intf(dev->interface);
+ kfree(dev);
+ }
+ }
+@@ -145,6 +146,8 @@ static int chaoskey_probe(struct usb_interface *interface,
+ if (dev == NULL)
+ goto out;
+
++ dev->interface = usb_get_intf(interface);
++
+ dev->buf = kmalloc(size, GFP_KERNEL);
+
+ if (dev->buf == NULL)
+@@ -174,8 +177,6 @@ static int chaoskey_probe(struct usb_interface *interface,
+ goto out;
+ }
+
+- dev->interface = interface;
+-
+ dev->in_ep = in_ep;
+
+ if (le16_to_cpu(udev->descriptor.idVendor) != ALEA_VENDOR_ID)
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index 55db0fc87927..2d9d9490cdd4 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -87,6 +87,7 @@ struct iowarrior {
+ char chip_serial[9]; /* the serial number string of the chip connected */
+ int report_size; /* number of bytes in a report */
+ u16 product_id;
++ struct usb_anchor submitted;
+ };
+
+ /*--------------*/
+@@ -243,6 +244,7 @@ static inline void iowarrior_delete(struct iowarrior *dev)
+ kfree(dev->int_in_buffer);
+ usb_free_urb(dev->int_in_urb);
+ kfree(dev->read_queue);
++ usb_put_intf(dev->interface);
+ kfree(dev);
+ }
+
+@@ -424,11 +426,13 @@ static ssize_t iowarrior_write(struct file *file,
+ retval = -EFAULT;
+ goto error;
+ }
++ usb_anchor_urb(int_out_urb, &dev->submitted);
+ retval = usb_submit_urb(int_out_urb, GFP_KERNEL);
+ if (retval) {
+ dev_dbg(&dev->interface->dev,
+ "submit error %d for urb nr.%d\n",
+ retval, atomic_read(&dev->write_busy));
++ usb_unanchor_urb(int_out_urb);
+ goto error;
+ }
+ /* submit was ok */
+@@ -764,11 +768,13 @@ static int iowarrior_probe(struct usb_interface *interface,
+ init_waitqueue_head(&dev->write_wait);
+
+ dev->udev = udev;
+- dev->interface = interface;
++ dev->interface = usb_get_intf(interface);
+
+ iface_desc = interface->cur_altsetting;
+ dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
+
++ init_usb_anchor(&dev->submitted);
++
+ res = usb_find_last_int_in_endpoint(iface_desc, &dev->int_in_endpoint);
+ if (res) {
+ dev_err(&interface->dev, "no interrupt-in endpoint found\n");
+@@ -866,8 +872,6 @@ static void iowarrior_disconnect(struct usb_interface *interface)
+ dev = usb_get_intfdata(interface);
+ mutex_lock(&iowarrior_open_disc_lock);
+ usb_set_intfdata(interface, NULL);
+- /* prevent device read, write and ioctl */
+- dev->present = 0;
+
+ minor = dev->minor;
+ mutex_unlock(&iowarrior_open_disc_lock);
+@@ -878,8 +882,7 @@ static void iowarrior_disconnect(struct usb_interface *interface)
+ mutex_lock(&dev->mutex);
+
+ /* prevent device read, write and ioctl */
+-
+- mutex_unlock(&dev->mutex);
++ dev->present = 0;
+
+ if (dev->opened) {
+ /* There is a process that holds a filedescriptor to the device ,
+@@ -887,10 +890,13 @@ static void iowarrior_disconnect(struct usb_interface *interface)
+ Deleting the device is postponed until close() was called.
+ */
+ usb_kill_urb(dev->int_in_urb);
++ usb_kill_anchored_urbs(&dev->submitted);
+ wake_up_interruptible(&dev->read_wait);
+ wake_up_interruptible(&dev->write_wait);
++ mutex_unlock(&dev->mutex);
+ } else {
+ /* no process is using the device, cleanup now */
++ mutex_unlock(&dev->mutex);
+ iowarrior_delete(dev);
+ }
+
+diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
+index 006762b72ff5..b9cbcf35d4e1 100644
+--- a/drivers/usb/misc/ldusb.c
++++ b/drivers/usb/misc/ldusb.c
+@@ -153,6 +153,7 @@ MODULE_PARM_DESC(min_interrupt_out_interval, "Minimum interrupt out interval in
+ struct ld_usb {
+ struct mutex mutex; /* locks this structure */
+ struct usb_interface *intf; /* save off the usb interface pointer */
++ unsigned long disconnected:1;
+
+ int open_count; /* number of times this port has been opened */
+
+@@ -192,12 +193,10 @@ static void ld_usb_abort_transfers(struct ld_usb *dev)
+ /* shutdown transfer */
+ if (dev->interrupt_in_running) {
+ dev->interrupt_in_running = 0;
+- if (dev->intf)
+- usb_kill_urb(dev->interrupt_in_urb);
++ usb_kill_urb(dev->interrupt_in_urb);
+ }
+ if (dev->interrupt_out_busy)
+- if (dev->intf)
+- usb_kill_urb(dev->interrupt_out_urb);
++ usb_kill_urb(dev->interrupt_out_urb);
+ }
+
+ /**
+@@ -205,8 +204,6 @@ static void ld_usb_abort_transfers(struct ld_usb *dev)
+ */
+ static void ld_usb_delete(struct ld_usb *dev)
+ {
+- ld_usb_abort_transfers(dev);
+-
+ /* free data structures */
+ usb_free_urb(dev->interrupt_in_urb);
+ usb_free_urb(dev->interrupt_out_urb);
+@@ -263,7 +260,7 @@ static void ld_usb_interrupt_in_callback(struct urb *urb)
+
+ resubmit:
+ /* resubmit if we're still running */
+- if (dev->interrupt_in_running && !dev->buffer_overflow && dev->intf) {
++ if (dev->interrupt_in_running && !dev->buffer_overflow) {
+ retval = usb_submit_urb(dev->interrupt_in_urb, GFP_ATOMIC);
+ if (retval) {
+ dev_err(&dev->intf->dev,
+@@ -392,7 +389,7 @@ static int ld_usb_release(struct inode *inode, struct file *file)
+ retval = -ENODEV;
+ goto unlock_exit;
+ }
+- if (dev->intf == NULL) {
++ if (dev->disconnected) {
+ /* the device was unplugged before the file was released */
+ mutex_unlock(&dev->mutex);
+ /* unlock here as ld_usb_delete frees dev */
+@@ -423,7 +420,7 @@ static __poll_t ld_usb_poll(struct file *file, poll_table *wait)
+
+ dev = file->private_data;
+
+- if (!dev->intf)
++ if (dev->disconnected)
+ return EPOLLERR | EPOLLHUP;
+
+ poll_wait(file, &dev->read_wait, wait);
+@@ -462,7 +459,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
+ }
+
+ /* verify that the device wasn't unplugged */
+- if (dev->intf == NULL) {
++ if (dev->disconnected) {
+ retval = -ENODEV;
+ printk(KERN_ERR "ldusb: No device or device unplugged %d\n", retval);
+ goto unlock_exit;
+@@ -542,7 +539,7 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer,
+ }
+
+ /* verify that the device wasn't unplugged */
+- if (dev->intf == NULL) {
++ if (dev->disconnected) {
+ retval = -ENODEV;
+ printk(KERN_ERR "ldusb: No device or device unplugged %d\n", retval);
+ goto unlock_exit;
+@@ -764,6 +761,9 @@ static void ld_usb_disconnect(struct usb_interface *intf)
+ /* give back our minor */
+ usb_deregister_dev(intf, &ld_usb_class);
+
++ usb_poison_urb(dev->interrupt_in_urb);
++ usb_poison_urb(dev->interrupt_out_urb);
++
+ mutex_lock(&dev->mutex);
+
+ /* if the device is not opened, then we clean up right now */
+@@ -771,7 +771,7 @@ static void ld_usb_disconnect(struct usb_interface *intf)
+ mutex_unlock(&dev->mutex);
+ ld_usb_delete(dev);
+ } else {
+- dev->intf = NULL;
++ dev->disconnected = 1;
+ /* wake up pollers */
+ wake_up_interruptible_all(&dev->read_wait);
+ wake_up_interruptible_all(&dev->write_wait);
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index 006cf13b2199..9d4c52a7ebe0 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -179,7 +179,6 @@ static const struct usb_device_id tower_table[] = {
+ };
+
+ MODULE_DEVICE_TABLE (usb, tower_table);
+-static DEFINE_MUTEX(open_disc_mutex);
+
+ #define LEGO_USB_TOWER_MINOR_BASE 160
+
+@@ -191,6 +190,7 @@ struct lego_usb_tower {
+ unsigned char minor; /* the starting minor number for this device */
+
+ int open_count; /* number of times this port has been opened */
++ unsigned long disconnected:1;
+
+ char* read_buffer;
+ size_t read_buffer_length; /* this much came in */
+@@ -290,14 +290,13 @@ static inline void lego_usb_tower_debug_data(struct device *dev,
+ */
+ static inline void tower_delete (struct lego_usb_tower *dev)
+ {
+- tower_abort_transfers (dev);
+-
+ /* free data structures */
+ usb_free_urb(dev->interrupt_in_urb);
+ usb_free_urb(dev->interrupt_out_urb);
+ kfree (dev->read_buffer);
+ kfree (dev->interrupt_in_buffer);
+ kfree (dev->interrupt_out_buffer);
++ usb_put_dev(dev->udev);
+ kfree (dev);
+ }
+
+@@ -332,18 +331,14 @@ static int tower_open (struct inode *inode, struct file *file)
+ goto exit;
+ }
+
+- mutex_lock(&open_disc_mutex);
+ dev = usb_get_intfdata(interface);
+-
+ if (!dev) {
+- mutex_unlock(&open_disc_mutex);
+ retval = -ENODEV;
+ goto exit;
+ }
+
+ /* lock this device */
+ if (mutex_lock_interruptible(&dev->lock)) {
+- mutex_unlock(&open_disc_mutex);
+ retval = -ERESTARTSYS;
+ goto exit;
+ }
+@@ -351,12 +346,9 @@ static int tower_open (struct inode *inode, struct file *file)
+
+ /* allow opening only once */
+ if (dev->open_count) {
+- mutex_unlock(&open_disc_mutex);
+ retval = -EBUSY;
+ goto unlock_exit;
+ }
+- dev->open_count = 1;
+- mutex_unlock(&open_disc_mutex);
+
+ /* reset the tower */
+ result = usb_control_msg (dev->udev,
+@@ -396,13 +388,14 @@ static int tower_open (struct inode *inode, struct file *file)
+ dev_err(&dev->udev->dev,
+ "Couldn't submit interrupt_in_urb %d\n", retval);
+ dev->interrupt_in_running = 0;
+- dev->open_count = 0;
+ goto unlock_exit;
+ }
+
+ /* save device in the file's private structure */
+ file->private_data = dev;
+
++ dev->open_count = 1;
++
+ unlock_exit:
+ mutex_unlock(&dev->lock);
+
+@@ -423,10 +416,9 @@ static int tower_release (struct inode *inode, struct file *file)
+
+ if (dev == NULL) {
+ retval = -ENODEV;
+- goto exit_nolock;
++ goto exit;
+ }
+
+- mutex_lock(&open_disc_mutex);
+ if (mutex_lock_interruptible(&dev->lock)) {
+ retval = -ERESTARTSYS;
+ goto exit;
+@@ -438,7 +430,8 @@ static int tower_release (struct inode *inode, struct file *file)
+ retval = -ENODEV;
+ goto unlock_exit;
+ }
+- if (dev->udev == NULL) {
++
++ if (dev->disconnected) {
+ /* the device was unplugged before the file was released */
+
+ /* unlock here as tower_delete frees dev */
+@@ -456,10 +449,7 @@ static int tower_release (struct inode *inode, struct file *file)
+
+ unlock_exit:
+ mutex_unlock(&dev->lock);
+-
+ exit:
+- mutex_unlock(&open_disc_mutex);
+-exit_nolock:
+ return retval;
+ }
+
+@@ -477,10 +467,9 @@ static void tower_abort_transfers (struct lego_usb_tower *dev)
+ if (dev->interrupt_in_running) {
+ dev->interrupt_in_running = 0;
+ mb();
+- if (dev->udev)
+- usb_kill_urb (dev->interrupt_in_urb);
++ usb_kill_urb(dev->interrupt_in_urb);
+ }
+- if (dev->interrupt_out_busy && dev->udev)
++ if (dev->interrupt_out_busy)
+ usb_kill_urb(dev->interrupt_out_urb);
+ }
+
+@@ -516,7 +505,7 @@ static __poll_t tower_poll (struct file *file, poll_table *wait)
+
+ dev = file->private_data;
+
+- if (!dev->udev)
++ if (dev->disconnected)
+ return EPOLLERR | EPOLLHUP;
+
+ poll_wait(file, &dev->read_wait, wait);
+@@ -563,7 +552,7 @@ static ssize_t tower_read (struct file *file, char __user *buffer, size_t count,
+ }
+
+ /* verify that the device wasn't unplugged */
+- if (dev->udev == NULL) {
++ if (dev->disconnected) {
+ retval = -ENODEV;
+ pr_err("No device or device unplugged %d\n", retval);
+ goto unlock_exit;
+@@ -649,7 +638,7 @@ static ssize_t tower_write (struct file *file, const char __user *buffer, size_t
+ }
+
+ /* verify that the device wasn't unplugged */
+- if (dev->udev == NULL) {
++ if (dev->disconnected) {
+ retval = -ENODEV;
+ pr_err("No device or device unplugged %d\n", retval);
+ goto unlock_exit;
+@@ -759,7 +748,7 @@ static void tower_interrupt_in_callback (struct urb *urb)
+
+ resubmit:
+ /* resubmit if we're still running */
+- if (dev->interrupt_in_running && dev->udev) {
++ if (dev->interrupt_in_running) {
+ retval = usb_submit_urb (dev->interrupt_in_urb, GFP_ATOMIC);
+ if (retval)
+ dev_err(&dev->udev->dev,
+@@ -822,8 +811,9 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
+
+ mutex_init(&dev->lock);
+
+- dev->udev = udev;
++ dev->udev = usb_get_dev(udev);
+ dev->open_count = 0;
++ dev->disconnected = 0;
+
+ dev->read_buffer = NULL;
+ dev->read_buffer_length = 0;
+@@ -891,8 +881,10 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
+ get_version_reply,
+ sizeof(*get_version_reply),
+ 1000);
+- if (result < 0) {
+- dev_err(idev, "LEGO USB Tower get version control request failed\n");
++ if (result < sizeof(*get_version_reply)) {
++ if (result >= 0)
++ result = -EIO;
++ dev_err(idev, "get version request failed: %d\n", result);
+ retval = result;
+ goto error;
+ }
+@@ -910,7 +902,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
+ if (retval) {
+ /* something prevented us from registering this driver */
+ dev_err(idev, "Not able to get a minor for this device.\n");
+- usb_set_intfdata (interface, NULL);
+ goto error;
+ }
+ dev->minor = interface->minor;
+@@ -942,23 +933,24 @@ static void tower_disconnect (struct usb_interface *interface)
+ int minor;
+
+ dev = usb_get_intfdata (interface);
+- mutex_lock(&open_disc_mutex);
+- usb_set_intfdata (interface, NULL);
+
+ minor = dev->minor;
+
+- /* give back our minor */
++ /* give back our minor and prevent further open() */
+ usb_deregister_dev (interface, &tower_class);
+
++ /* stop I/O */
++ usb_poison_urb(dev->interrupt_in_urb);
++ usb_poison_urb(dev->interrupt_out_urb);
++
+ mutex_lock(&dev->lock);
+- mutex_unlock(&open_disc_mutex);
+
+ /* if the device is not opened, then we clean up right now */
+ if (!dev->open_count) {
+ mutex_unlock(&dev->lock);
+ tower_delete (dev);
+ } else {
+- dev->udev = NULL;
++ dev->disconnected = 1;
+ /* wake up pollers */
+ wake_up_interruptible_all(&dev->read_wait);
+ wake_up_interruptible_all(&dev->write_wait);
+diff --git a/drivers/usb/misc/rio500.c b/drivers/usb/misc/rio500.c
+deleted file mode 100644
+index a32d61a79ab8..000000000000
+--- a/drivers/usb/misc/rio500.c
++++ /dev/null
+@@ -1,561 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0+
+-/* -*- linux-c -*- */
+-
+-/*
+- * Driver for USB Rio 500
+- *
+- * Cesar Miquel (miquel@df.uba.ar)
+- *
+- * based on hp_scanner.c by David E. Nelson (dnelson@jump.net)
+- *
+- * Based upon mouse.c (Brad Keryan) and printer.c (Michael Gee).
+- *
+- * Changelog:
+- * 30/05/2003 replaced lock/unlock kernel with up/down
+- * Daniele Bellucci bellucda@tiscali.it
+- * */
+-
+-#include <linux/module.h>
+-#include <linux/kernel.h>
+-#include <linux/signal.h>
+-#include <linux/sched/signal.h>
+-#include <linux/mutex.h>
+-#include <linux/errno.h>
+-#include <linux/random.h>
+-#include <linux/poll.h>
+-#include <linux/slab.h>
+-#include <linux/spinlock.h>
+-#include <linux/usb.h>
+-#include <linux/wait.h>
+-
+-#include "rio500_usb.h"
+-
+-#define DRIVER_AUTHOR "Cesar Miquel <miquel@df.uba.ar>"
+-#define DRIVER_DESC "USB Rio 500 driver"
+-
+-#define RIO_MINOR 64
+-
+-/* stall/wait timeout for rio */
+-#define NAK_TIMEOUT (HZ)
+-
+-#define IBUF_SIZE 0x1000
+-
+-/* Size of the rio buffer */
+-#define OBUF_SIZE 0x10000
+-
+-struct rio_usb_data {
+- struct usb_device *rio_dev; /* init: probe_rio */
+- unsigned int ifnum; /* Interface number of the USB device */
+- int isopen; /* nz if open */
+- int present; /* Device is present on the bus */
+- char *obuf, *ibuf; /* transfer buffers */
+- char bulk_in_ep, bulk_out_ep; /* Endpoint assignments */
+- wait_queue_head_t wait_q; /* for timeouts */
+- struct mutex lock; /* general race avoidance */
+-};
+-
+-static DEFINE_MUTEX(rio500_mutex);
+-static struct rio_usb_data rio_instance;
+-
+-static int open_rio(struct inode *inode, struct file *file)
+-{
+- struct rio_usb_data *rio = &rio_instance;
+-
+- /* against disconnect() */
+- mutex_lock(&rio500_mutex);
+- mutex_lock(&(rio->lock));
+-
+- if (rio->isopen || !rio->present) {
+- mutex_unlock(&(rio->lock));
+- mutex_unlock(&rio500_mutex);
+- return -EBUSY;
+- }
+- rio->isopen = 1;
+-
+- init_waitqueue_head(&rio->wait_q);
+-
+- mutex_unlock(&(rio->lock));
+-
+- dev_info(&rio->rio_dev->dev, "Rio opened.\n");
+- mutex_unlock(&rio500_mutex);
+-
+- return 0;
+-}
+-
+-static int close_rio(struct inode *inode, struct file *file)
+-{
+- struct rio_usb_data *rio = &rio_instance;
+-
+- /* against disconnect() */
+- mutex_lock(&rio500_mutex);
+- mutex_lock(&(rio->lock));
+-
+- rio->isopen = 0;
+- if (!rio->present) {
+- /* cleanup has been delayed */
+- kfree(rio->ibuf);
+- kfree(rio->obuf);
+- rio->ibuf = NULL;
+- rio->obuf = NULL;
+- } else {
+- dev_info(&rio->rio_dev->dev, "Rio closed.\n");
+- }
+- mutex_unlock(&(rio->lock));
+- mutex_unlock(&rio500_mutex);
+- return 0;
+-}
+-
+-static long ioctl_rio(struct file *file, unsigned int cmd, unsigned long arg)
+-{
+- struct RioCommand rio_cmd;
+- struct rio_usb_data *rio = &rio_instance;
+- void __user *data;
+- unsigned char *buffer;
+- int result, requesttype;
+- int retries;
+- int retval=0;
+-
+- mutex_lock(&(rio->lock));
+- /* Sanity check to make sure rio is connected, powered, etc */
+- if (rio->present == 0 || rio->rio_dev == NULL) {
+- retval = -ENODEV;
+- goto err_out;
+- }
+-
+- switch (cmd) {
+- case RIO_RECV_COMMAND:
+- data = (void __user *) arg;
+- if (data == NULL)
+- break;
+- if (copy_from_user(&rio_cmd, data, sizeof(struct RioCommand))) {
+- retval = -EFAULT;
+- goto err_out;
+- }
+- if (rio_cmd.length < 0 || rio_cmd.length > PAGE_SIZE) {
+- retval = -EINVAL;
+- goto err_out;
+- }
+- buffer = (unsigned char *) __get_free_page(GFP_KERNEL);
+- if (buffer == NULL) {
+- retval = -ENOMEM;
+- goto err_out;
+- }
+- if (copy_from_user(buffer, rio_cmd.buffer, rio_cmd.length)) {
+- retval = -EFAULT;
+- free_page((unsigned long) buffer);
+- goto err_out;
+- }
+-
+- requesttype = rio_cmd.requesttype | USB_DIR_IN |
+- USB_TYPE_VENDOR | USB_RECIP_DEVICE;
+- dev_dbg(&rio->rio_dev->dev,
+- "sending command:reqtype=%0x req=%0x value=%0x index=%0x len=%0x\n",
+- requesttype, rio_cmd.request, rio_cmd.value,
+- rio_cmd.index, rio_cmd.length);
+- /* Send rio control message */
+- retries = 3;
+- while (retries) {
+- result = usb_control_msg(rio->rio_dev,
+- usb_rcvctrlpipe(rio-> rio_dev, 0),
+- rio_cmd.request,
+- requesttype,
+- rio_cmd.value,
+- rio_cmd.index, buffer,
+- rio_cmd.length,
+- jiffies_to_msecs(rio_cmd.timeout));
+- if (result == -ETIMEDOUT)
+- retries--;
+- else if (result < 0) {
+- dev_err(&rio->rio_dev->dev,
+- "Error executing ioctrl. code = %d\n",
+- result);
+- retries = 0;
+- } else {
+- dev_dbg(&rio->rio_dev->dev,
+- "Executed ioctl. Result = %d (data=%02x)\n",
+- result, buffer[0]);
+- if (copy_to_user(rio_cmd.buffer, buffer,
+- rio_cmd.length)) {
+- free_page((unsigned long) buffer);
+- retval = -EFAULT;
+- goto err_out;
+- }
+- retries = 0;
+- }
+-
+- /* rio_cmd.buffer contains a raw stream of single byte
+- data which has been returned from rio. Data is
+- interpreted at application level. For data that
+- will be cast to data types longer than 1 byte, data
+- will be little_endian and will potentially need to
+- be swapped at the app level */
+-
+- }
+- free_page((unsigned long) buffer);
+- break;
+-
+- case RIO_SEND_COMMAND:
+- data = (void __user *) arg;
+- if (data == NULL)
+- break;
+- if (copy_from_user(&rio_cmd, data, sizeof(struct RioCommand))) {
+- retval = -EFAULT;
+- goto err_out;
+- }
+- if (rio_cmd.length < 0 || rio_cmd.length > PAGE_SIZE) {
+- retval = -EINVAL;
+- goto err_out;
+- }
+- buffer = (unsigned char *) __get_free_page(GFP_KERNEL);
+- if (buffer == NULL) {
+- retval = -ENOMEM;
+- goto err_out;
+- }
+- if (copy_from_user(buffer, rio_cmd.buffer, rio_cmd.length)) {
+- free_page((unsigned long)buffer);
+- retval = -EFAULT;
+- goto err_out;
+- }
+-
+- requesttype = rio_cmd.requesttype | USB_DIR_OUT |
+- USB_TYPE_VENDOR | USB_RECIP_DEVICE;
+- dev_dbg(&rio->rio_dev->dev,
+- "sending command: reqtype=%0x req=%0x value=%0x index=%0x len=%0x\n",
+- requesttype, rio_cmd.request, rio_cmd.value,
+- rio_cmd.index, rio_cmd.length);
+- /* Send rio control message */
+- retries = 3;
+- while (retries) {
+- result = usb_control_msg(rio->rio_dev,
+- usb_sndctrlpipe(rio-> rio_dev, 0),
+- rio_cmd.request,
+- requesttype,
+- rio_cmd.value,
+- rio_cmd.index, buffer,
+- rio_cmd.length,
+- jiffies_to_msecs(rio_cmd.timeout));
+- if (result == -ETIMEDOUT)
+- retries--;
+- else if (result < 0) {
+- dev_err(&rio->rio_dev->dev,
+- "Error executing ioctrl. code = %d\n",
+- result);
+- retries = 0;
+- } else {
+- dev_dbg(&rio->rio_dev->dev,
+- "Executed ioctl. Result = %d\n", result);
+- retries = 0;
+-
+- }
+-
+- }
+- free_page((unsigned long) buffer);
+- break;
+-
+- default:
+- retval = -ENOTTY;
+- break;
+- }
+-
+-
+-err_out:
+- mutex_unlock(&(rio->lock));
+- return retval;
+-}
+-
+-static ssize_t
+-write_rio(struct file *file, const char __user *buffer,
+- size_t count, loff_t * ppos)
+-{
+- DEFINE_WAIT(wait);
+- struct rio_usb_data *rio = &rio_instance;
+-
+- unsigned long copy_size;
+- unsigned long bytes_written = 0;
+- unsigned int partial;
+-
+- int result = 0;
+- int maxretry;
+- int errn = 0;
+- int intr;
+-
+- intr = mutex_lock_interruptible(&(rio->lock));
+- if (intr)
+- return -EINTR;
+- /* Sanity check to make sure rio is connected, powered, etc */
+- if (rio->present == 0 || rio->rio_dev == NULL) {
+- mutex_unlock(&(rio->lock));
+- return -ENODEV;
+- }
+-
+-
+-
+- do {
+- unsigned long thistime;
+- char *obuf = rio->obuf;
+-
+- thistime = copy_size =
+- (count >= OBUF_SIZE) ? OBUF_SIZE : count;
+- if (copy_from_user(rio->obuf, buffer, copy_size)) {
+- errn = -EFAULT;
+- goto error;
+- }
+- maxretry = 5;
+- while (thistime) {
+- if (!rio->rio_dev) {
+- errn = -ENODEV;
+- goto error;
+- }
+- if (signal_pending(current)) {
+- mutex_unlock(&(rio->lock));
+- return bytes_written ? bytes_written : -EINTR;
+- }
+-
+- result = usb_bulk_msg(rio->rio_dev,
+- usb_sndbulkpipe(rio->rio_dev, 2),
+- obuf, thistime, &partial, 5000);
+-
+- dev_dbg(&rio->rio_dev->dev,
+- "write stats: result:%d thistime:%lu partial:%u\n",
+- result, thistime, partial);
+-
+- if (result == -ETIMEDOUT) { /* NAK - so hold for a while */
+- if (!maxretry--) {
+- errn = -ETIME;
+- goto error;
+- }
+- prepare_to_wait(&rio->wait_q, &wait, TASK_INTERRUPTIBLE);
+- schedule_timeout(NAK_TIMEOUT);
+- finish_wait(&rio->wait_q, &wait);
+- continue;
+- } else if (!result && partial) {
+- obuf += partial;
+- thistime -= partial;
+- } else
+- break;
+- }
+- if (result) {
+- dev_err(&rio->rio_dev->dev, "Write Whoops - %x\n",
+- result);
+- errn = -EIO;
+- goto error;
+- }
+- bytes_written += copy_size;
+- count -= copy_size;
+- buffer += copy_size;
+- } while (count > 0);
+-
+- mutex_unlock(&(rio->lock));
+-
+- return bytes_written ? bytes_written : -EIO;
+-
+-error:
+- mutex_unlock(&(rio->lock));
+- return errn;
+-}
+-
+-static ssize_t
+-read_rio(struct file *file, char __user *buffer, size_t count, loff_t * ppos)
+-{
+- DEFINE_WAIT(wait);
+- struct rio_usb_data *rio = &rio_instance;
+- ssize_t read_count;
+- unsigned int partial;
+- int this_read;
+- int result;
+- int maxretry = 10;
+- char *ibuf;
+- int intr;
+-
+- intr = mutex_lock_interruptible(&(rio->lock));
+- if (intr)
+- return -EINTR;
+- /* Sanity check to make sure rio is connected, powered, etc */
+- if (rio->present == 0 || rio->rio_dev == NULL) {
+- mutex_unlock(&(rio->lock));
+- return -ENODEV;
+- }
+-
+- ibuf = rio->ibuf;
+-
+- read_count = 0;
+-
+-
+- while (count > 0) {
+- if (signal_pending(current)) {
+- mutex_unlock(&(rio->lock));
+- return read_count ? read_count : -EINTR;
+- }
+- if (!rio->rio_dev) {
+- mutex_unlock(&(rio->lock));
+- return -ENODEV;
+- }
+- this_read = (count >= IBUF_SIZE) ? IBUF_SIZE : count;
+-
+- result = usb_bulk_msg(rio->rio_dev,
+- usb_rcvbulkpipe(rio->rio_dev, 1),
+- ibuf, this_read, &partial,
+- 8000);
+-
+- dev_dbg(&rio->rio_dev->dev,
+- "read stats: result:%d this_read:%u partial:%u\n",
+- result, this_read, partial);
+-
+- if (partial) {
+- count = this_read = partial;
+- } else if (result == -ETIMEDOUT || result == 15) { /* FIXME: 15 ??? */
+- if (!maxretry--) {
+- mutex_unlock(&(rio->lock));
+- dev_err(&rio->rio_dev->dev,
+- "read_rio: maxretry timeout\n");
+- return -ETIME;
+- }
+- prepare_to_wait(&rio->wait_q, &wait, TASK_INTERRUPTIBLE);
+- schedule_timeout(NAK_TIMEOUT);
+- finish_wait(&rio->wait_q, &wait);
+- continue;
+- } else if (result != -EREMOTEIO) {
+- mutex_unlock(&(rio->lock));
+- dev_err(&rio->rio_dev->dev,
+- "Read Whoops - result:%d partial:%u this_read:%u\n",
+- result, partial, this_read);
+- return -EIO;
+- } else {
+- mutex_unlock(&(rio->lock));
+- return (0);
+- }
+-
+- if (this_read) {
+- if (copy_to_user(buffer, ibuf, this_read)) {
+- mutex_unlock(&(rio->lock));
+- return -EFAULT;
+- }
+- count -= this_read;
+- read_count += this_read;
+- buffer += this_read;
+- }
+- }
+- mutex_unlock(&(rio->lock));
+- return read_count;
+-}
+-
+-static const struct file_operations usb_rio_fops = {
+- .owner = THIS_MODULE,
+- .read = read_rio,
+- .write = write_rio,
+- .unlocked_ioctl = ioctl_rio,
+- .open = open_rio,
+- .release = close_rio,
+- .llseek = noop_llseek,
+-};
+-
+-static struct usb_class_driver usb_rio_class = {
+- .name = "rio500%d",
+- .fops = &usb_rio_fops,
+- .minor_base = RIO_MINOR,
+-};
+-
+-static int probe_rio(struct usb_interface *intf,
+- const struct usb_device_id *id)
+-{
+- struct usb_device *dev = interface_to_usbdev(intf);
+- struct rio_usb_data *rio = &rio_instance;
+- int retval = 0;
+-
+- mutex_lock(&rio500_mutex);
+- if (rio->present) {
+- dev_info(&intf->dev, "Second USB Rio at address %d refused\n", dev->devnum);
+- retval = -EBUSY;
+- goto bail_out;
+- } else {
+- dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum);
+- }
+-
+- retval = usb_register_dev(intf, &usb_rio_class);
+- if (retval) {
+- dev_err(&dev->dev,
+- "Not able to get a minor for this device.\n");
+- retval = -ENOMEM;
+- goto bail_out;
+- }
+-
+- rio->rio_dev = dev;
+-
+- if (!(rio->obuf = kmalloc(OBUF_SIZE, GFP_KERNEL))) {
+- dev_err(&dev->dev,
+- "probe_rio: Not enough memory for the output buffer\n");
+- usb_deregister_dev(intf, &usb_rio_class);
+- retval = -ENOMEM;
+- goto bail_out;
+- }
+- dev_dbg(&intf->dev, "obuf address:%p\n", rio->obuf);
+-
+- if (!(rio->ibuf = kmalloc(IBUF_SIZE, GFP_KERNEL))) {
+- dev_err(&dev->dev,
+- "probe_rio: Not enough memory for the input buffer\n");
+- usb_deregister_dev(intf, &usb_rio_class);
+- kfree(rio->obuf);
+- retval = -ENOMEM;
+- goto bail_out;
+- }
+- dev_dbg(&intf->dev, "ibuf address:%p\n", rio->ibuf);
+-
+- mutex_init(&(rio->lock));
+-
+- usb_set_intfdata (intf, rio);
+- rio->present = 1;
+-bail_out:
+- mutex_unlock(&rio500_mutex);
+-
+- return retval;
+-}
+-
+-static void disconnect_rio(struct usb_interface *intf)
+-{
+- struct rio_usb_data *rio = usb_get_intfdata (intf);
+-
+- usb_set_intfdata (intf, NULL);
+- mutex_lock(&rio500_mutex);
+- if (rio) {
+- usb_deregister_dev(intf, &usb_rio_class);
+-
+- mutex_lock(&(rio->lock));
+- if (rio->isopen) {
+- rio->isopen = 0;
+- /* better let it finish - the release will do whats needed */
+- rio->rio_dev = NULL;
+- mutex_unlock(&(rio->lock));
+- mutex_unlock(&rio500_mutex);
+- return;
+- }
+- kfree(rio->ibuf);
+- kfree(rio->obuf);
+-
+- dev_info(&intf->dev, "USB Rio disconnected.\n");
+-
+- rio->present = 0;
+- mutex_unlock(&(rio->lock));
+- }
+- mutex_unlock(&rio500_mutex);
+-}
+-
+-static const struct usb_device_id rio_table[] = {
+- { USB_DEVICE(0x0841, 1) }, /* Rio 500 */
+- { } /* Terminating entry */
+-};
+-
+-MODULE_DEVICE_TABLE (usb, rio_table);
+-
+-static struct usb_driver rio_driver = {
+- .name = "rio500",
+- .probe = probe_rio,
+- .disconnect = disconnect_rio,
+- .id_table = rio_table,
+-};
+-
+-module_usb_driver(rio_driver);
+-
+-MODULE_AUTHOR( DRIVER_AUTHOR );
+-MODULE_DESCRIPTION( DRIVER_DESC );
+-MODULE_LICENSE("GPL");
+-
+diff --git a/drivers/usb/misc/rio500_usb.h b/drivers/usb/misc/rio500_usb.h
+deleted file mode 100644
+index 6db7a5863496..000000000000
+--- a/drivers/usb/misc/rio500_usb.h
++++ /dev/null
+@@ -1,20 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0+
+-/* ----------------------------------------------------------------------
+- Copyright (C) 2000 Cesar Miquel (miquel@df.uba.ar)
+- ---------------------------------------------------------------------- */
+-
+-#define RIO_SEND_COMMAND 0x1
+-#define RIO_RECV_COMMAND 0x2
+-
+-#define RIO_DIR_OUT 0x0
+-#define RIO_DIR_IN 0x1
+-
+-struct RioCommand {
+- short length;
+- int request;
+- int requesttype;
+- int value;
+- int index;
+- void __user *buffer;
+- int timeout;
+-};
+diff --git a/drivers/usb/misc/usblcd.c b/drivers/usb/misc/usblcd.c
+index 9ba4a4e68d91..aa982d3ca36b 100644
+--- a/drivers/usb/misc/usblcd.c
++++ b/drivers/usb/misc/usblcd.c
+@@ -18,6 +18,7 @@
+ #include <linux/slab.h>
+ #include <linux/errno.h>
+ #include <linux/mutex.h>
++#include <linux/rwsem.h>
+ #include <linux/uaccess.h>
+ #include <linux/usb.h>
+
+@@ -57,6 +58,8 @@ struct usb_lcd {
+ using up all RAM */
+ struct usb_anchor submitted; /* URBs to wait for
+ before suspend */
++ struct rw_semaphore io_rwsem;
++ unsigned long disconnected:1;
+ };
+ #define to_lcd_dev(d) container_of(d, struct usb_lcd, kref)
+
+@@ -142,6 +145,13 @@ static ssize_t lcd_read(struct file *file, char __user * buffer,
+
+ dev = file->private_data;
+
++ down_read(&dev->io_rwsem);
++
++ if (dev->disconnected) {
++ retval = -ENODEV;
++ goto out_up_io;
++ }
++
+ /* do a blocking bulk read to get data from the device */
+ retval = usb_bulk_msg(dev->udev,
+ usb_rcvbulkpipe(dev->udev,
+@@ -158,6 +168,9 @@ static ssize_t lcd_read(struct file *file, char __user * buffer,
+ retval = bytes_read;
+ }
+
++out_up_io:
++ up_read(&dev->io_rwsem);
++
+ return retval;
+ }
+
+@@ -237,11 +250,18 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer,
+ if (r < 0)
+ return -EINTR;
+
++ down_read(&dev->io_rwsem);
++
++ if (dev->disconnected) {
++ retval = -ENODEV;
++ goto err_up_io;
++ }
++
+ /* create a urb, and a buffer for it, and copy the data to the urb */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!urb) {
+ retval = -ENOMEM;
+- goto err_no_buf;
++ goto err_up_io;
+ }
+
+ buf = usb_alloc_coherent(dev->udev, count, GFP_KERNEL,
+@@ -278,6 +298,7 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer,
+ the USB core will eventually free it entirely */
+ usb_free_urb(urb);
+
++ up_read(&dev->io_rwsem);
+ exit:
+ return count;
+ error_unanchor:
+@@ -285,7 +306,8 @@ error_unanchor:
+ error:
+ usb_free_coherent(dev->udev, count, buf, urb->transfer_dma);
+ usb_free_urb(urb);
+-err_no_buf:
++err_up_io:
++ up_read(&dev->io_rwsem);
+ up(&dev->limit_sem);
+ return retval;
+ }
+@@ -325,6 +347,7 @@ static int lcd_probe(struct usb_interface *interface,
+
+ kref_init(&dev->kref);
+ sema_init(&dev->limit_sem, USB_LCD_CONCURRENT_WRITES);
++ init_rwsem(&dev->io_rwsem);
+ init_usb_anchor(&dev->submitted);
+
+ dev->udev = usb_get_dev(interface_to_usbdev(interface));
+@@ -422,6 +445,12 @@ static void lcd_disconnect(struct usb_interface *interface)
+ /* give back our minor */
+ usb_deregister_dev(interface, &lcd_class);
+
++ down_write(&dev->io_rwsem);
++ dev->disconnected = 1;
++ up_write(&dev->io_rwsem);
++
++ usb_kill_anchored_urbs(&dev->submitted);
++
+ /* decrement our usage count */
+ kref_put(&dev->kref, lcd_delete);
+
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index 6715a128e6c8..be0505b8b5d4 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -60,6 +60,7 @@ struct usb_yurex {
+
+ struct kref kref;
+ struct mutex io_mutex;
++ unsigned long disconnected:1;
+ struct fasync_struct *async_queue;
+ wait_queue_head_t waitq;
+
+@@ -107,6 +108,7 @@ static void yurex_delete(struct kref *kref)
+ dev->int_buffer, dev->urb->transfer_dma);
+ usb_free_urb(dev->urb);
+ }
++ usb_put_intf(dev->interface);
+ usb_put_dev(dev->udev);
+ kfree(dev);
+ }
+@@ -132,6 +134,7 @@ static void yurex_interrupt(struct urb *urb)
+ switch (status) {
+ case 0: /*success*/
+ break;
++ /* The device is terminated or messed up, give up */
+ case -EOVERFLOW:
+ dev_err(&dev->interface->dev,
+ "%s - overflow with length %d, actual length is %d\n",
+@@ -140,12 +143,13 @@ static void yurex_interrupt(struct urb *urb)
+ case -ENOENT:
+ case -ESHUTDOWN:
+ case -EILSEQ:
+- /* The device is terminated, clean up */
++ case -EPROTO:
++ case -ETIME:
+ return;
+ default:
+ dev_err(&dev->interface->dev,
+ "%s - unknown status received: %d\n", __func__, status);
+- goto exit;
++ return;
+ }
+
+ /* handle received message */
+@@ -177,7 +181,6 @@ static void yurex_interrupt(struct urb *urb)
+ break;
+ }
+
+-exit:
+ retval = usb_submit_urb(dev->urb, GFP_ATOMIC);
+ if (retval) {
+ dev_err(&dev->interface->dev, "%s - usb_submit_urb failed: %d\n",
+@@ -204,7 +207,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
+ init_waitqueue_head(&dev->waitq);
+
+ dev->udev = usb_get_dev(interface_to_usbdev(interface));
+- dev->interface = interface;
++ dev->interface = usb_get_intf(interface);
+
+ /* set up the endpoint information */
+ iface_desc = interface->cur_altsetting;
+@@ -315,8 +318,9 @@ static void yurex_disconnect(struct usb_interface *interface)
+
+ /* prevent more I/O from starting */
+ usb_poison_urb(dev->urb);
++ usb_poison_urb(dev->cntl_urb);
+ mutex_lock(&dev->io_mutex);
+- dev->interface = NULL;
++ dev->disconnected = 1;
+ mutex_unlock(&dev->io_mutex);
+
+ /* wakeup waiters */
+@@ -404,7 +408,7 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
+ dev = file->private_data;
+
+ mutex_lock(&dev->io_mutex);
+- if (!dev->interface) { /* already disconnected */
++ if (dev->disconnected) { /* already disconnected */
+ mutex_unlock(&dev->io_mutex);
+ return -ENODEV;
+ }
+@@ -439,7 +443,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
+ goto error;
+
+ mutex_lock(&dev->io_mutex);
+- if (!dev->interface) { /* already disconnected */
++ if (dev->disconnected) { /* already disconnected */
+ mutex_unlock(&dev->io_mutex);
+ retval = -ENODEV;
+ goto error;
+diff --git a/drivers/usb/renesas_usbhs/common.h b/drivers/usb/renesas_usbhs/common.h
+index 6137f7942c05..c47b721b8bca 100644
+--- a/drivers/usb/renesas_usbhs/common.h
++++ b/drivers/usb/renesas_usbhs/common.h
+@@ -207,6 +207,7 @@ struct usbhs_priv;
+ /* DCPCTR */
+ #define BSTS (1 << 15) /* Buffer Status */
+ #define SUREQ (1 << 14) /* Sending SETUP Token */
++#define INBUFM (1 << 14) /* (PIPEnCTR) Transfer Buffer Monitor */
+ #define CSSTS (1 << 12) /* CSSTS Status */
+ #define ACLRM (1 << 9) /* Buffer Auto-Clear Mode */
+ #define SQCLR (1 << 8) /* Toggle Bit Clear */
+diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
+index 6036cbae8c78..aeb53ec5cc6a 100644
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -89,7 +89,7 @@ static void __usbhsf_pkt_del(struct usbhs_pkt *pkt)
+ list_del_init(&pkt->node);
+ }
+
+-static struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe)
++struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe)
+ {
+ return list_first_entry_or_null(&pipe->list, struct usbhs_pkt, node);
+ }
+diff --git a/drivers/usb/renesas_usbhs/fifo.h b/drivers/usb/renesas_usbhs/fifo.h
+index 88d1816bcda2..c3d3cc35cee0 100644
+--- a/drivers/usb/renesas_usbhs/fifo.h
++++ b/drivers/usb/renesas_usbhs/fifo.h
+@@ -97,5 +97,6 @@ void usbhs_pkt_push(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt,
+ void *buf, int len, int zero, int sequence);
+ struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt);
+ void usbhs_pkt_start(struct usbhs_pipe *pipe);
++struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe);
+
+ #endif /* RENESAS_USB_FIFO_H */
+diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
+index 59cac40aafcc..7feac4128a2d 100644
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -721,8 +721,7 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge)
+ struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
+ struct device *dev = usbhsg_gpriv_to_dev(gpriv);
+ unsigned long flags;
+-
+- usbhsg_pipe_disable(uep);
++ int ret = 0;
+
+ dev_dbg(dev, "set halt %d (pipe %d)\n",
+ halt, usbhs_pipe_number(pipe));
+@@ -730,6 +729,18 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge)
+ /******************** spin lock ********************/
+ usbhs_lock(priv, flags);
+
++ /*
++ * According to usb_ep_set_halt()'s description, this function should
++ * return -EAGAIN if the IN endpoint has any queue or data. Note
++ * that the usbhs_pipe_is_dir_in() returns false if the pipe is an
++ * IN endpoint in the gadget mode.
++ */
++ if (!usbhs_pipe_is_dir_in(pipe) && (__usbhsf_pkt_get(pipe) ||
++ usbhs_pipe_contains_transmittable_data(pipe))) {
++ ret = -EAGAIN;
++ goto out;
++ }
++
+ if (halt)
+ usbhs_pipe_stall(pipe);
+ else
+@@ -740,10 +751,11 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge)
+ else
+ usbhsg_status_clr(gpriv, USBHSG_STATUS_WEDGE);
+
++out:
+ usbhs_unlock(priv, flags);
+ /******************** spin unlock ******************/
+
+- return 0;
++ return ret;
+ }
+
+ static int usbhsg_ep_set_halt(struct usb_ep *ep, int value)
+diff --git a/drivers/usb/renesas_usbhs/pipe.c b/drivers/usb/renesas_usbhs/pipe.c
+index c4922b96c93b..9e5afdde1adb 100644
+--- a/drivers/usb/renesas_usbhs/pipe.c
++++ b/drivers/usb/renesas_usbhs/pipe.c
+@@ -277,6 +277,21 @@ int usbhs_pipe_is_accessible(struct usbhs_pipe *pipe)
+ return -EBUSY;
+ }
+
++bool usbhs_pipe_contains_transmittable_data(struct usbhs_pipe *pipe)
++{
++ u16 val;
++
++ /* Do not support for DCP pipe */
++ if (usbhs_pipe_is_dcp(pipe))
++ return false;
++
++ val = usbhsp_pipectrl_get(pipe);
++ if (val & INBUFM)
++ return true;
++
++ return false;
++}
++
+ /*
+ * PID ctrl
+ */
+diff --git a/drivers/usb/renesas_usbhs/pipe.h b/drivers/usb/renesas_usbhs/pipe.h
+index 3080423e600c..3b130529408b 100644
+--- a/drivers/usb/renesas_usbhs/pipe.h
++++ b/drivers/usb/renesas_usbhs/pipe.h
+@@ -83,6 +83,7 @@ void usbhs_pipe_clear(struct usbhs_pipe *pipe);
+ void usbhs_pipe_clear_without_sequence(struct usbhs_pipe *pipe,
+ int needs_bfre, int bfre_enable);
+ int usbhs_pipe_is_accessible(struct usbhs_pipe *pipe);
++bool usbhs_pipe_contains_transmittable_data(struct usbhs_pipe *pipe);
+ void usbhs_pipe_enable(struct usbhs_pipe *pipe);
+ void usbhs_pipe_disable(struct usbhs_pipe *pipe);
+ void usbhs_pipe_stall(struct usbhs_pipe *pipe);
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index e18735e00463..f06706efb7f1 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1020,6 +1020,9 @@ static const struct usb_device_id id_table_combined[] = {
+ /* EZPrototypes devices */
+ { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) },
+ { USB_DEVICE_INTERFACE_NUMBER(UNJO_VID, UNJO_ISODEBUG_V1_PID, 1) },
++ /* Sienna devices */
++ { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) },
++ { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index f12d806220b4..22d66217cb41 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -39,6 +39,9 @@
+
+ #define FTDI_LUMEL_PD12_PID 0x6002
+
++/* Sienna Serial Interface by Secyourit GmbH */
++#define FTDI_SIENNA_PID 0x8348
++
+ /* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */
+ #define CYBER_CORTEX_AV_PID 0x8698
+
+@@ -688,6 +691,12 @@
+ #define BANDB_TTL3USB9M_PID 0xAC50
+ #define BANDB_ZZ_PROG1_USB_PID 0xBA02
+
++/*
++ * Echelon USB Serial Interface
++ */
++#define ECHELON_VID 0x0920
++#define ECHELON_U20_PID 0x7500
++
+ /*
+ * Intrepid Control Systems (http://www.intrepidcs.com/) ValueCAN and NeoVI
+ */
+diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
+index d34779fe4a8d..e66a59ef43a1 100644
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -1741,8 +1741,8 @@ static struct urb *keyspan_setup_urb(struct usb_serial *serial, int endpoint,
+
+ ep_desc = find_ep(serial, endpoint);
+ if (!ep_desc) {
+- /* leak the urb, something's wrong and the callers don't care */
+- return urb;
++ usb_free_urb(urb);
++ return NULL;
+ }
+ if (usb_endpoint_xfer_int(ep_desc)) {
+ ep_type_name = "INT";
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 56f572cb08f8..3cc659a62782 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -419,6 +419,7 @@ static void option_instat_callback(struct urb *urb);
+ #define CINTERION_PRODUCT_PH8_AUDIO 0x0083
+ #define CINTERION_PRODUCT_AHXX_2RMNET 0x0084
+ #define CINTERION_PRODUCT_AHXX_AUDIO 0x0085
++#define CINTERION_PRODUCT_CLS8 0x00b0
+
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID 0x0b3c
+@@ -1154,6 +1155,14 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
+ .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1050, 0xff), /* Telit FN980 (rmnet) */
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1051, 0xff), /* Telit FN980 (MBIM) */
++ .driver_info = NCTRL(0) | RSVD(1) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1052, 0xff), /* Telit FN980 (RNDIS) */
++ .driver_info = NCTRL(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1053, 0xff), /* Telit FN980 (ECM) */
++ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+@@ -1847,6 +1856,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) },
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_CLS8, 0xff),
++ .driver_info = RSVD(0) | RSVD(4) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index f7aaa7f079e1..434153790982 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -311,10 +311,7 @@ static void serial_cleanup(struct tty_struct *tty)
+ serial = port->serial;
+ owner = serial->type->driver.owner;
+
+- mutex_lock(&serial->disc_mutex);
+- if (!serial->disconnected)
+- usb_autopm_put_interface(serial->interface);
+- mutex_unlock(&serial->disc_mutex);
++ usb_autopm_put_interface(serial->interface);
+
+ usb_serial_put(serial);
+ module_put(owner);
+diff --git a/drivers/usb/usb-skeleton.c b/drivers/usb/usb-skeleton.c
+index f101347e3ea3..e0cf11f798c5 100644
+--- a/drivers/usb/usb-skeleton.c
++++ b/drivers/usb/usb-skeleton.c
+@@ -59,6 +59,7 @@ struct usb_skel {
+ spinlock_t err_lock; /* lock for errors */
+ struct kref kref;
+ struct mutex io_mutex; /* synchronize I/O with disconnect */
++ unsigned long disconnected:1;
+ wait_queue_head_t bulk_in_wait; /* to wait for an ongoing read */
+ };
+ #define to_skel_dev(d) container_of(d, struct usb_skel, kref)
+@@ -71,6 +72,7 @@ static void skel_delete(struct kref *kref)
+ struct usb_skel *dev = to_skel_dev(kref);
+
+ usb_free_urb(dev->bulk_in_urb);
++ usb_put_intf(dev->interface);
+ usb_put_dev(dev->udev);
+ kfree(dev->bulk_in_buffer);
+ kfree(dev);
+@@ -122,10 +124,7 @@ static int skel_release(struct inode *inode, struct file *file)
+ return -ENODEV;
+
+ /* allow the device to be autosuspended */
+- mutex_lock(&dev->io_mutex);
+- if (dev->interface)
+- usb_autopm_put_interface(dev->interface);
+- mutex_unlock(&dev->io_mutex);
++ usb_autopm_put_interface(dev->interface);
+
+ /* decrement the count on our device */
+ kref_put(&dev->kref, skel_delete);
+@@ -238,7 +237,7 @@ static ssize_t skel_read(struct file *file, char *buffer, size_t count,
+ if (rv < 0)
+ return rv;
+
+- if (!dev->interface) { /* disconnect() was called */
++ if (dev->disconnected) { /* disconnect() was called */
+ rv = -ENODEV;
+ goto exit;
+ }
+@@ -420,7 +419,7 @@ static ssize_t skel_write(struct file *file, const char *user_buffer,
+
+ /* this lock makes sure we don't submit URBs to gone devices */
+ mutex_lock(&dev->io_mutex);
+- if (!dev->interface) { /* disconnect() was called */
++ if (dev->disconnected) { /* disconnect() was called */
+ mutex_unlock(&dev->io_mutex);
+ retval = -ENODEV;
+ goto error;
+@@ -505,7 +504,7 @@ static int skel_probe(struct usb_interface *interface,
+ init_waitqueue_head(&dev->bulk_in_wait);
+
+ dev->udev = usb_get_dev(interface_to_usbdev(interface));
+- dev->interface = interface;
++ dev->interface = usb_get_intf(interface);
+
+ /* set up the endpoint information */
+ /* use only the first bulk-in and bulk-out endpoints */
+@@ -571,7 +570,7 @@ static void skel_disconnect(struct usb_interface *interface)
+
+ /* prevent more I/O from starting */
+ mutex_lock(&dev->io_mutex);
+- dev->interface = NULL;
++ dev->disconnected = 1;
+ mutex_unlock(&dev->io_mutex);
+
+ usb_kill_anchored_urbs(&dev->submitted);
+diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
+index e5b9e596bb92..cd2a5864e103 100644
+--- a/fs/btrfs/ref-verify.c
++++ b/fs/btrfs/ref-verify.c
+@@ -511,7 +511,7 @@ static int process_leaf(struct btrfs_root *root,
+ struct btrfs_extent_data_ref *dref;
+ struct btrfs_shared_data_ref *sref;
+ u32 count;
+- int i = 0, tree_block_level = 0, ret;
++ int i = 0, tree_block_level = 0, ret = 0;
+ struct btrfs_key key;
+ int nritems = btrfs_header_nritems(leaf);
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index e561eb475339..4d4f57f0f08c 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -2860,7 +2860,8 @@ out:
+ * in the tree of log roots
+ */
+ static int update_log_root(struct btrfs_trans_handle *trans,
+- struct btrfs_root *log)
++ struct btrfs_root *log,
++ struct btrfs_root_item *root_item)
+ {
+ struct btrfs_fs_info *fs_info = log->fs_info;
+ int ret;
+@@ -2868,10 +2869,10 @@ static int update_log_root(struct btrfs_trans_handle *trans,
+ if (log->log_transid == 1) {
+ /* insert root item on the first sync */
+ ret = btrfs_insert_root(trans, fs_info->log_root_tree,
+- &log->root_key, &log->root_item);
++ &log->root_key, root_item);
+ } else {
+ ret = btrfs_update_root(trans, fs_info->log_root_tree,
+- &log->root_key, &log->root_item);
++ &log->root_key, root_item);
+ }
+ return ret;
+ }
+@@ -2969,6 +2970,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
+ struct btrfs_fs_info *fs_info = root->fs_info;
+ struct btrfs_root *log = root->log_root;
+ struct btrfs_root *log_root_tree = fs_info->log_root_tree;
++ struct btrfs_root_item new_root_item;
+ int log_transid = 0;
+ struct btrfs_log_ctx root_log_ctx;
+ struct blk_plug plug;
+@@ -3032,17 +3034,25 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
+ goto out;
+ }
+
++ /*
++ * We _must_ update under the root->log_mutex in order to make sure we
++ * have a consistent view of the log root we are trying to commit at
++ * this moment.
++ *
++ * We _must_ copy this into a local copy, because we are not holding the
++ * log_root_tree->log_mutex yet. This is important because when we
++ * commit the log_root_tree we must have a consistent view of the
++ * log_root_tree when we update the super block to point at the
++ * log_root_tree bytenr. If we update the log_root_tree here we'll race
++ * with the commit and possibly point at the new block which we may not
++ * have written out.
++ */
+ btrfs_set_root_node(&log->root_item, log->node);
++ memcpy(&new_root_item, &log->root_item, sizeof(new_root_item));
+
+ root->log_transid++;
+ log->log_transid = root->log_transid;
+ root->log_start_pid = 0;
+- /*
+- * Update or create log root item under the root's log_mutex to prevent
+- * races with concurrent log syncs that can lead to failure to update
+- * log root item because it was not created yet.
+- */
+- ret = update_log_root(trans, log);
+ /*
+ * IO has been started, blocks of the log tree have WRITTEN flag set
+ * in their headers. new modifications of the log will be written to
+@@ -3063,6 +3073,14 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
+ mutex_unlock(&log_root_tree->log_mutex);
+
+ mutex_lock(&log_root_tree->log_mutex);
++
++ /*
++ * Now we are safe to update the log_root_tree because we're under the
++ * log_mutex, and we're a current writer so we're holding the commit
++ * open until we drop the log_mutex.
++ */
++ ret = update_log_root(trans, log, &new_root_item);
++
+ if (atomic_dec_and_test(&log_root_tree->log_writers)) {
+ /* atomic_dec_and_test implies a barrier */
+ cond_wake_up_nomb(&log_root_tree->log_writer_wait);
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index 907e85d65bb4..2fb6fa51fd3c 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -840,10 +840,16 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
+ static int
+ cifs_d_revalidate(struct dentry *direntry, unsigned int flags)
+ {
++ struct inode *inode;
++
+ if (flags & LOOKUP_RCU)
+ return -ECHILD;
+
+ if (d_really_is_positive(direntry)) {
++ inode = d_inode(direntry);
++ if ((flags & LOOKUP_REVAL) && !CIFS_CACHE_READ(CIFS_I(inode)))
++ CIFS_I(inode)->time = 0; /* force reval */
++
+ if (cifs_revalidate_dentry(direntry))
+ return 0;
+ else {
+@@ -854,7 +860,7 @@ cifs_d_revalidate(struct dentry *direntry, unsigned int flags)
+ * attributes will have been updated by
+ * cifs_revalidate_dentry().
+ */
+- if (IS_AUTOMOUNT(d_inode(direntry)) &&
++ if (IS_AUTOMOUNT(inode) &&
+ !(direntry->d_flags & DCACHE_NEED_AUTOMOUNT)) {
+ spin_lock(&direntry->d_lock);
+ direntry->d_flags |= DCACHE_NEED_AUTOMOUNT;
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 8703b5f26f45..617f86beb08b 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -252,6 +252,12 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb,
+ rc = cifs_get_inode_info(&inode, full_path, buf, inode->i_sb,
+ xid, fid);
+
++ if (rc) {
++ server->ops->close(xid, tcon, fid);
++ if (rc == -ESTALE)
++ rc = -EOPENSTALE;
++ }
++
+ out:
+ kfree(buf);
+ return rc;
+@@ -1835,13 +1841,12 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
+ {
+ struct cifsFileInfo *open_file = NULL;
+ struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);
+- struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
+
+ /* only filter by fsuid on multiuser mounts */
+ if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
+ fsuid_only = false;
+
+- spin_lock(&tcon->open_file_lock);
++ spin_lock(&cifs_inode->open_file_lock);
+ /* we could simply get the first_list_entry since write-only entries
+ are always at the end of the list but since the first entry might
+ have a close pending, we go through the whole list */
+@@ -1853,7 +1858,7 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
+ /* found a good file */
+ /* lock it so it will not be closed on us */
+ cifsFileInfo_get(open_file);
+- spin_unlock(&tcon->open_file_lock);
++ spin_unlock(&cifs_inode->open_file_lock);
+ return open_file;
+ } /* else might as well continue, and look for
+ another, or simply have the caller reopen it
+@@ -1861,7 +1866,7 @@ struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode,
+ } else /* write only file */
+ break; /* write only files are last so must be done */
+ }
+- spin_unlock(&tcon->open_file_lock);
++ spin_unlock(&cifs_inode->open_file_lock);
+ return NULL;
+ }
+
+@@ -1870,7 +1875,6 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
+ {
+ struct cifsFileInfo *open_file, *inv_file = NULL;
+ struct cifs_sb_info *cifs_sb;
+- struct cifs_tcon *tcon;
+ bool any_available = false;
+ int rc;
+ unsigned int refind = 0;
+@@ -1886,16 +1890,15 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode,
+ }
+
+ cifs_sb = CIFS_SB(cifs_inode->vfs_inode.i_sb);
+- tcon = cifs_sb_master_tcon(cifs_sb);
+
+ /* only filter by fsuid on multiuser mounts */
+ if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER))
+ fsuid_only = false;
+
+- spin_lock(&tcon->open_file_lock);
++ spin_lock(&cifs_inode->open_file_lock);
+ refind_writable:
+ if (refind > MAX_REOPEN_ATT) {
+- spin_unlock(&tcon->open_file_lock);
++ spin_unlock(&cifs_inode->open_file_lock);
+ return NULL;
+ }
+ list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
+@@ -1907,7 +1910,7 @@ refind_writable:
+ if (!open_file->invalidHandle) {
+ /* found a good writable file */
+ cifsFileInfo_get(open_file);
+- spin_unlock(&tcon->open_file_lock);
++ spin_unlock(&cifs_inode->open_file_lock);
+ return open_file;
+ } else {
+ if (!inv_file)
+@@ -1926,7 +1929,7 @@ refind_writable:
+ cifsFileInfo_get(inv_file);
+ }
+
+- spin_unlock(&tcon->open_file_lock);
++ spin_unlock(&cifs_inode->open_file_lock);
+
+ if (inv_file) {
+ rc = cifs_reopen_file(inv_file, false);
+@@ -1940,7 +1943,7 @@ refind_writable:
+ cifsFileInfo_put(inv_file);
+ ++refind;
+ inv_file = NULL;
+- spin_lock(&tcon->open_file_lock);
++ spin_lock(&cifs_inode->open_file_lock);
+ goto refind_writable;
+ }
+ }
+@@ -4001,17 +4004,15 @@ static int cifs_readpage(struct file *file, struct page *page)
+ static int is_inode_writable(struct cifsInodeInfo *cifs_inode)
+ {
+ struct cifsFileInfo *open_file;
+- struct cifs_tcon *tcon =
+- cifs_sb_master_tcon(CIFS_SB(cifs_inode->vfs_inode.i_sb));
+
+- spin_lock(&tcon->open_file_lock);
++ spin_lock(&cifs_inode->open_file_lock);
+ list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
+ if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {
+- spin_unlock(&tcon->open_file_lock);
++ spin_unlock(&cifs_inode->open_file_lock);
+ return 1;
+ }
+ }
+- spin_unlock(&tcon->open_file_lock);
++ spin_unlock(&cifs_inode->open_file_lock);
+ return 0;
+ }
+
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 53f3d08898af..26154db6c87f 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -410,6 +410,7 @@ int cifs_get_inode_info_unix(struct inode **pinode,
+ /* if uniqueid is different, return error */
+ if (unlikely(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM &&
+ CIFS_I(*pinode)->uniqueid != fattr.cf_uniqueid)) {
++ CIFS_I(*pinode)->time = 0; /* force reval */
+ rc = -ESTALE;
+ goto cgiiu_exit;
+ }
+@@ -417,6 +418,7 @@ int cifs_get_inode_info_unix(struct inode **pinode,
+ /* if filetype is different, return error */
+ if (unlikely(((*pinode)->i_mode & S_IFMT) !=
+ (fattr.cf_mode & S_IFMT))) {
++ CIFS_I(*pinode)->time = 0; /* force reval */
+ rc = -ESTALE;
+ goto cgiiu_exit;
+ }
+@@ -926,6 +928,7 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
+ /* if uniqueid is different, return error */
+ if (unlikely(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM &&
+ CIFS_I(*inode)->uniqueid != fattr.cf_uniqueid)) {
++ CIFS_I(*inode)->time = 0; /* force reval */
+ rc = -ESTALE;
+ goto cgii_exit;
+ }
+@@ -933,6 +936,7 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
+ /* if filetype is different, return error */
+ if (unlikely(((*inode)->i_mode & S_IFMT) !=
+ (fattr.cf_mode & S_IFMT))) {
++ CIFS_I(*inode)->time = 0; /* force reval */
+ rc = -ESTALE;
+ goto cgii_exit;
+ }
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index fdafcfd8b20e..6851afc3bf80 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -2196,11 +2196,11 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ struct super_block *sb = sbi->sb;
+ unsigned int blocksize;
+
+- if (F2FS_SUPER_MAGIC != le32_to_cpu(raw_super->magic)) {
++ if (le32_to_cpu(raw_super->magic) != F2FS_SUPER_MAGIC) {
+ f2fs_msg(sb, KERN_INFO,
+ "Magic Mismatch, valid(0x%x) - read(0x%x)",
+ F2FS_SUPER_MAGIC, le32_to_cpu(raw_super->magic));
+- return 1;
++ return -EINVAL;
+ }
+
+ /* Currently, support only 4KB page cache size */
+@@ -2208,7 +2208,7 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ f2fs_msg(sb, KERN_INFO,
+ "Invalid page_cache_size (%lu), supports only 4KB\n",
+ PAGE_SIZE);
+- return 1;
++ return -EFSCORRUPTED;
+ }
+
+ /* Currently, support only 4KB block size */
+@@ -2217,7 +2217,7 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ f2fs_msg(sb, KERN_INFO,
+ "Invalid blocksize (%u), supports only 4KB\n",
+ blocksize);
+- return 1;
++ return -EFSCORRUPTED;
+ }
+
+ /* check log blocks per segment */
+@@ -2225,7 +2225,7 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ f2fs_msg(sb, KERN_INFO,
+ "Invalid log blocks per segment (%u)\n",
+ le32_to_cpu(raw_super->log_blocks_per_seg));
+- return 1;
++ return -EFSCORRUPTED;
+ }
+
+ /* Currently, support 512/1024/2048/4096 bytes sector size */
+@@ -2235,7 +2235,7 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ F2FS_MIN_LOG_SECTOR_SIZE) {
+ f2fs_msg(sb, KERN_INFO, "Invalid log sectorsize (%u)",
+ le32_to_cpu(raw_super->log_sectorsize));
+- return 1;
++ return -EFSCORRUPTED;
+ }
+ if (le32_to_cpu(raw_super->log_sectors_per_block) +
+ le32_to_cpu(raw_super->log_sectorsize) !=
+@@ -2244,7 +2244,7 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ "Invalid log sectors per block(%u) log sectorsize(%u)",
+ le32_to_cpu(raw_super->log_sectors_per_block),
+ le32_to_cpu(raw_super->log_sectorsize));
+- return 1;
++ return -EFSCORRUPTED;
+ }
+
+ segment_count = le32_to_cpu(raw_super->segment_count);
+@@ -2260,7 +2260,7 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ f2fs_msg(sb, KERN_INFO,
+ "Invalid segment count (%u)",
+ segment_count);
+- return 1;
++ return -EFSCORRUPTED;
+ }
+
+ if (total_sections > segment_count ||
+@@ -2269,28 +2269,28 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ f2fs_msg(sb, KERN_INFO,
+ "Invalid segment/section count (%u, %u x %u)",
+ segment_count, total_sections, segs_per_sec);
+- return 1;
++ return -EFSCORRUPTED;
+ }
+
+ if ((segment_count / segs_per_sec) < total_sections) {
+ f2fs_msg(sb, KERN_INFO,
+ "Small segment_count (%u < %u * %u)",
+ segment_count, segs_per_sec, total_sections);
+- return 1;
++ return -EFSCORRUPTED;
+ }
+
+ if (segment_count > (le64_to_cpu(raw_super->block_count) >> 9)) {
+ f2fs_msg(sb, KERN_INFO,
+ "Wrong segment_count / block_count (%u > %llu)",
+ segment_count, le64_to_cpu(raw_super->block_count));
+- return 1;
++ return -EFSCORRUPTED;
+ }
+
+ if (secs_per_zone > total_sections || !secs_per_zone) {
+ f2fs_msg(sb, KERN_INFO,
+ "Wrong secs_per_zone / total_sections (%u, %u)",
+ secs_per_zone, total_sections);
+- return 1;
++ return -EFSCORRUPTED;
+ }
+ if (le32_to_cpu(raw_super->extension_count) > F2FS_MAX_EXTENSION ||
+ raw_super->hot_ext_count > F2FS_MAX_EXTENSION ||
+@@ -2301,7 +2301,7 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ le32_to_cpu(raw_super->extension_count),
+ raw_super->hot_ext_count,
+ F2FS_MAX_EXTENSION);
+- return 1;
++ return -EFSCORRUPTED;
+ }
+
+ if (le32_to_cpu(raw_super->cp_payload) >
+@@ -2310,7 +2310,7 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ "Insane cp_payload (%u > %u)",
+ le32_to_cpu(raw_super->cp_payload),
+ blocks_per_seg - F2FS_CP_PACKS);
+- return 1;
++ return -EFSCORRUPTED;
+ }
+
+ /* check reserved ino info */
+@@ -2322,12 +2322,12 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ le32_to_cpu(raw_super->node_ino),
+ le32_to_cpu(raw_super->meta_ino),
+ le32_to_cpu(raw_super->root_ino));
+- return 1;
++ return -EFSCORRUPTED;
+ }
+
+ /* check CP/SIT/NAT/SSA/MAIN_AREA area boundary */
+ if (sanity_check_area_boundary(sbi, bh))
+- return 1;
++ return -EFSCORRUPTED;
+
+ return 0;
+ }
+@@ -2612,11 +2612,11 @@ static int read_raw_super_block(struct f2fs_sb_info *sbi,
+ }
+
+ /* sanity checking of raw super */
+- if (sanity_check_raw_super(sbi, bh)) {
++ err = sanity_check_raw_super(sbi, bh);
++ if (err) {
+ f2fs_msg(sb, KERN_ERR,
+ "Can't find valid F2FS filesystem in %dth superblock",
+ block + 1);
+- err = -EFSCORRUPTED;
+ brelse(bh);
+ continue;
+ }
+diff --git a/fs/libfs.c b/fs/libfs.c
+index 0fb590d79f30..bd2d193d0a2a 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -86,58 +86,47 @@ int dcache_dir_close(struct inode *inode, struct file *file)
+ EXPORT_SYMBOL(dcache_dir_close);
+
+ /* parent is locked at least shared */
+-static struct dentry *next_positive(struct dentry *parent,
+- struct list_head *from,
+- int count)
++/*
++ * Returns an element of siblings' list.
++ * We are looking for <count>th positive after <p>; if
++ * found, dentry is grabbed and passed to caller via *<res>.
++ * If no such element exists, the anchor of list is returned
++ * and *<res> is set to NULL.
++ */
++static struct list_head *scan_positives(struct dentry *cursor,
++ struct list_head *p,
++ loff_t count,
++ struct dentry **res)
+ {
+- unsigned *seq = &parent->d_inode->i_dir_seq, n;
+- struct dentry *res;
+- struct list_head *p;
+- bool skipped;
+- int i;
++ struct dentry *dentry = cursor->d_parent, *found = NULL;
+
+-retry:
+- i = count;
+- skipped = false;
+- n = smp_load_acquire(seq) & ~1;
+- res = NULL;
+- rcu_read_lock();
+- for (p = from->next; p != &parent->d_subdirs; p = p->next) {
++ spin_lock(&dentry->d_lock);
++ while ((p = p->next) != &dentry->d_subdirs) {
+ struct dentry *d = list_entry(p, struct dentry, d_child);
+- if (!simple_positive(d)) {
+- skipped = true;
+- } else if (!--i) {
+- res = d;
+- break;
++ // we must at least skip cursors, to avoid livelocks
++ if (d->d_flags & DCACHE_DENTRY_CURSOR)
++ continue;
++ if (simple_positive(d) && !--count) {
++ spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
++ if (simple_positive(d))
++ found = dget_dlock(d);
++ spin_unlock(&d->d_lock);
++ if (likely(found))
++ break;
++ count = 1;
++ }
++ if (need_resched()) {
++ list_move(&cursor->d_child, p);
++ p = &cursor->d_child;
++ spin_unlock(&dentry->d_lock);
++ cond_resched();
++ spin_lock(&dentry->d_lock);
+ }
+ }
+- rcu_read_unlock();
+- if (skipped) {
+- smp_rmb();
+- if (unlikely(*seq != n))
+- goto retry;
+- }
+- return res;
+-}
+-
+-static void move_cursor(struct dentry *cursor, struct list_head *after)
+-{
+- struct dentry *parent = cursor->d_parent;
+- unsigned n, *seq = &parent->d_inode->i_dir_seq;
+- spin_lock(&parent->d_lock);
+- for (;;) {
+- n = *seq;
+- if (!(n & 1) && cmpxchg(seq, n, n + 1) == n)
+- break;
+- cpu_relax();
+- }
+- __list_del(cursor->d_child.prev, cursor->d_child.next);
+- if (after)
+- list_add(&cursor->d_child, after);
+- else
+- list_add_tail(&cursor->d_child, &parent->d_subdirs);
+- smp_store_release(seq, n + 2);
+- spin_unlock(&parent->d_lock);
++ spin_unlock(&dentry->d_lock);
++ dput(*res);
++ *res = found;
++ return p;
+ }
+
+ loff_t dcache_dir_lseek(struct file *file, loff_t offset, int whence)
+@@ -153,17 +142,28 @@ loff_t dcache_dir_lseek(struct file *file, loff_t offset, int whence)
+ return -EINVAL;
+ }
+ if (offset != file->f_pos) {
++ struct dentry *cursor = file->private_data;
++ struct dentry *to = NULL;
++ struct list_head *p;
++
+ file->f_pos = offset;
+- if (file->f_pos >= 2) {
+- struct dentry *cursor = file->private_data;
+- struct dentry *to;
+- loff_t n = file->f_pos - 2;
+-
+- inode_lock_shared(dentry->d_inode);
+- to = next_positive(dentry, &dentry->d_subdirs, n);
+- move_cursor(cursor, to ? &to->d_child : NULL);
+- inode_unlock_shared(dentry->d_inode);
++ inode_lock_shared(dentry->d_inode);
++
++ if (file->f_pos > 2) {
++ p = scan_positives(cursor, &dentry->d_subdirs,
++ file->f_pos - 2, &to);
++ spin_lock(&dentry->d_lock);
++ list_move(&cursor->d_child, p);
++ spin_unlock(&dentry->d_lock);
++ } else {
++ spin_lock(&dentry->d_lock);
++ list_del_init(&cursor->d_child);
++ spin_unlock(&dentry->d_lock);
+ }
++
++ dput(to);
++
++ inode_unlock_shared(dentry->d_inode);
+ }
+ return offset;
+ }
+@@ -185,25 +185,29 @@ int dcache_readdir(struct file *file, struct dir_context *ctx)
+ {
+ struct dentry *dentry = file->f_path.dentry;
+ struct dentry *cursor = file->private_data;
+- struct list_head *p = &cursor->d_child;
+- struct dentry *next;
+- bool moved = false;
++ struct list_head *anchor = &dentry->d_subdirs;
++ struct dentry *next = NULL;
++ struct list_head *p;
+
+ if (!dir_emit_dots(file, ctx))
+ return 0;
+
+ if (ctx->pos == 2)
+- p = &dentry->d_subdirs;
+- while ((next = next_positive(dentry, p, 1)) != NULL) {
++ p = anchor;
++ else
++ p = &cursor->d_child;
++
++ while ((p = scan_positives(cursor, p, 1, &next)) != anchor) {
+ if (!dir_emit(ctx, next->d_name.name, next->d_name.len,
+ d_inode(next)->i_ino, dt_type(d_inode(next))))
+ break;
+- moved = true;
+- p = &next->d_child;
+ ctx->pos++;
+ }
+- if (moved)
+- move_cursor(cursor, p);
++ spin_lock(&dentry->d_lock);
++ list_move_tail(&cursor->d_child, p);
++ spin_unlock(&dentry->d_lock);
++ dput(next);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(dcache_readdir);
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index f516ace8f45d..29b70337dcd9 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -122,32 +122,49 @@ static inline int put_dreq(struct nfs_direct_req *dreq)
+ }
+
+ static void
+-nfs_direct_good_bytes(struct nfs_direct_req *dreq, struct nfs_pgio_header *hdr)
++nfs_direct_handle_truncated(struct nfs_direct_req *dreq,
++ const struct nfs_pgio_header *hdr,
++ ssize_t dreq_len)
+ {
+- int i;
+- ssize_t count;
++ struct nfs_direct_mirror *mirror = &dreq->mirrors[hdr->pgio_mirror_idx];
++
++ if (!(test_bit(NFS_IOHDR_ERROR, &hdr->flags) ||
++ test_bit(NFS_IOHDR_EOF, &hdr->flags)))
++ return;
++ if (dreq->max_count >= dreq_len) {
++ dreq->max_count = dreq_len;
++ if (dreq->count > dreq_len)
++ dreq->count = dreq_len;
++
++ if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
++ dreq->error = hdr->error;
++ else /* Clear outstanding error if this is EOF */
++ dreq->error = 0;
++ }
++ if (mirror->count > dreq_len)
++ mirror->count = dreq_len;
++}
+
+- WARN_ON_ONCE(dreq->count >= dreq->max_count);
++static void
++nfs_direct_count_bytes(struct nfs_direct_req *dreq,
++ const struct nfs_pgio_header *hdr)
++{
++ struct nfs_direct_mirror *mirror = &dreq->mirrors[hdr->pgio_mirror_idx];
++ loff_t hdr_end = hdr->io_start + hdr->good_bytes;
++ ssize_t dreq_len = 0;
+
+- if (dreq->mirror_count == 1) {
+- dreq->mirrors[hdr->pgio_mirror_idx].count += hdr->good_bytes;
+- dreq->count += hdr->good_bytes;
+- } else {
+- /* mirrored writes */
+- count = dreq->mirrors[hdr->pgio_mirror_idx].count;
+- if (count + dreq->io_start < hdr->io_start + hdr->good_bytes) {
+- count = hdr->io_start + hdr->good_bytes - dreq->io_start;
+- dreq->mirrors[hdr->pgio_mirror_idx].count = count;
+- }
+- /* update the dreq->count by finding the minimum agreed count from all
+- * mirrors */
+- count = dreq->mirrors[0].count;
++ if (hdr_end > dreq->io_start)
++ dreq_len = hdr_end - dreq->io_start;
+
+- for (i = 1; i < dreq->mirror_count; i++)
+- count = min(count, dreq->mirrors[i].count);
++ nfs_direct_handle_truncated(dreq, hdr, dreq_len);
+
+- dreq->count = count;
+- }
++ if (dreq_len > dreq->max_count)
++ dreq_len = dreq->max_count;
++
++ if (mirror->count < dreq_len)
++ mirror->count = dreq_len;
++ if (dreq->count < dreq_len)
++ dreq->count = dreq_len;
+ }
+
+ /*
+@@ -401,20 +418,12 @@ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
+ struct nfs_direct_req *dreq = hdr->dreq;
+
+ spin_lock(&dreq->lock);
+- if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
+- dreq->error = hdr->error;
+-
+ if (test_bit(NFS_IOHDR_REDO, &hdr->flags)) {
+ spin_unlock(&dreq->lock);
+ goto out_put;
+ }
+
+- if (hdr->good_bytes != 0)
+- nfs_direct_good_bytes(dreq, hdr);
+-
+- if (test_bit(NFS_IOHDR_EOF, &hdr->flags))
+- dreq->error = 0;
+-
++ nfs_direct_count_bytes(dreq, hdr);
+ spin_unlock(&dreq->lock);
+
+ while (!list_empty(&hdr->pages)) {
+@@ -651,6 +660,9 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
+ nfs_direct_write_scan_commit_list(dreq->inode, &reqs, &cinfo);
+
+ dreq->count = 0;
++ dreq->max_count = 0;
++ list_for_each_entry(req, &reqs, wb_list)
++ dreq->max_count += req->wb_bytes;
+ dreq->verf.committed = NFS_INVALID_STABLE_HOW;
+ nfs_clear_pnfs_ds_commit_verifiers(&dreq->ds_cinfo);
+ for (i = 0; i < dreq->mirror_count; i++)
+@@ -783,17 +795,13 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr)
+ nfs_init_cinfo_from_dreq(&cinfo, dreq);
+
+ spin_lock(&dreq->lock);
+-
+- if (test_bit(NFS_IOHDR_ERROR, &hdr->flags))
+- dreq->error = hdr->error;
+-
+ if (test_bit(NFS_IOHDR_REDO, &hdr->flags)) {
+ spin_unlock(&dreq->lock);
+ goto out_put;
+ }
+
++ nfs_direct_count_bytes(dreq, hdr);
+ if (hdr->good_bytes != 0) {
+- nfs_direct_good_bytes(dreq, hdr);
+ if (nfs_write_need_commit(hdr)) {
+ if (dreq->flags == NFS_ODIRECT_RESCHED_WRITES)
+ request_commit = true;
+diff --git a/include/acpi/actbl2.h b/include/acpi/actbl2.h
+index c50ef7e6b942..1d4ef0621174 100644
+--- a/include/acpi/actbl2.h
++++ b/include/acpi/actbl2.h
+@@ -1472,8 +1472,11 @@ struct acpi_pptt_processor {
+
+ /* Flags */
+
+-#define ACPI_PPTT_PHYSICAL_PACKAGE (1) /* Physical package */
+-#define ACPI_PPTT_ACPI_PROCESSOR_ID_VALID (2) /* ACPI Processor ID valid */
++#define ACPI_PPTT_PHYSICAL_PACKAGE (1)
++#define ACPI_PPTT_ACPI_PROCESSOR_ID_VALID (1<<1)
++#define ACPI_PPTT_ACPI_PROCESSOR_IS_THREAD (1<<2) /* ACPI 6.3 */
++#define ACPI_PPTT_ACPI_LEAF_NODE (1<<3) /* ACPI 6.3 */
++#define ACPI_PPTT_ACPI_IDENTICAL (1<<4) /* ACPI 6.3 */
+
+ /* 1: Cache Type Structure */
+
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index b4d23b3a2ef2..59a416dfcaaa 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -1291,10 +1291,15 @@ static inline int lpit_read_residency_count_address(u64 *address)
+ #endif
+
+ #ifdef CONFIG_ACPI_PPTT
++int acpi_pptt_cpu_is_thread(unsigned int cpu);
+ int find_acpi_cpu_topology(unsigned int cpu, int level);
+ int find_acpi_cpu_topology_package(unsigned int cpu);
+ int find_acpi_cpu_cache_topology(unsigned int cpu, int level);
+ #else
++static inline int acpi_pptt_cpu_is_thread(unsigned int cpu)
++{
++ return -EINVAL;
++}
+ static inline int find_acpi_cpu_topology(unsigned int cpu, int level)
+ {
+ return -EINVAL;
+diff --git a/include/linux/hwmon.h b/include/linux/hwmon.h
+index 9493d4a388db..8fde789f2eff 100644
+--- a/include/linux/hwmon.h
++++ b/include/linux/hwmon.h
+@@ -225,7 +225,7 @@ enum hwmon_power_attributes {
+ #define HWMON_P_LABEL BIT(hwmon_power_label)
+ #define HWMON_P_ALARM BIT(hwmon_power_alarm)
+ #define HWMON_P_CAP_ALARM BIT(hwmon_power_cap_alarm)
+-#define HWMON_P_MIN_ALARM BIT(hwmon_power_max_alarm)
++#define HWMON_P_MIN_ALARM BIT(hwmon_power_min_alarm)
+ #define HWMON_P_MAX_ALARM BIT(hwmon_power_max_alarm)
+ #define HWMON_P_LCRIT_ALARM BIT(hwmon_power_lcrit_alarm)
+ #define HWMON_P_CRIT_ALARM BIT(hwmon_power_crit_alarm)
+diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
+index d6b56180827c..bf3f2d325faa 100644
+--- a/kernel/events/hw_breakpoint.c
++++ b/kernel/events/hw_breakpoint.c
+@@ -426,7 +426,7 @@ static int hw_breakpoint_parse(struct perf_event *bp,
+
+ int register_perf_hw_breakpoint(struct perf_event *bp)
+ {
+- struct arch_hw_breakpoint hw;
++ struct arch_hw_breakpoint hw = { };
+ int err;
+
+ err = reserve_bp_slot(bp);
+@@ -474,7 +474,7 @@ int
+ modify_user_hw_breakpoint_check(struct perf_event *bp, struct perf_event_attr *attr,
+ bool check)
+ {
+- struct arch_hw_breakpoint hw;
++ struct arch_hw_breakpoint hw = { };
+ int err;
+
+ err = hw_breakpoint_parse(bp, attr, &hw);
+diff --git a/kernel/fork.c b/kernel/fork.c
+index e76ce81c9c75..aef1430bdce0 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -2623,7 +2623,7 @@ int sysctl_max_threads(struct ctl_table *table, int write,
+ struct ctl_table t;
+ int ret;
+ int threads = max_threads;
+- int min = MIN_THREADS;
++ int min = 1;
+ int max = MAX_THREADS;
+
+ t = *table;
+@@ -2635,7 +2635,7 @@ int sysctl_max_threads(struct ctl_table *table, int write,
+ if (ret || !write)
+ return ret;
+
+- set_max_threads(threads);
++ max_threads = threads;
+
+ return 0;
+ }
+diff --git a/kernel/panic.c b/kernel/panic.c
+index 6a6df23acd1a..72e001e3753e 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -149,6 +149,7 @@ void panic(const char *fmt, ...)
+ * after setting panic_cpu) from invoking panic() again.
+ */
+ local_irq_disable();
++ preempt_disable_notrace();
+
+ /*
+ * It's possible to come here directly from a panic-assertion and
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 7e215dac9693..b84eb9659e95 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3557,21 +3557,22 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
+ struct ftrace_hash *hash;
+ struct list_head *mod_head;
+ struct trace_array *tr = ops->private;
+- int ret = 0;
++ int ret = -ENOMEM;
+
+ ftrace_ops_init(ops);
+
+ if (unlikely(ftrace_disabled))
+ return -ENODEV;
+
++ if (tr && trace_array_get(tr) < 0)
++ return -ENODEV;
++
+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
+ if (!iter)
+- return -ENOMEM;
++ goto out;
+
+- if (trace_parser_get_init(&iter->parser, FTRACE_BUFF_MAX)) {
+- kfree(iter);
+- return -ENOMEM;
+- }
++ if (trace_parser_get_init(&iter->parser, FTRACE_BUFF_MAX))
++ goto out;
+
+ iter->ops = ops;
+ iter->flags = flag;
+@@ -3601,13 +3602,13 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
+
+ if (!iter->hash) {
+ trace_parser_put(&iter->parser);
+- kfree(iter);
+- ret = -ENOMEM;
+ goto out_unlock;
+ }
+ } else
+ iter->hash = hash;
+
++ ret = 0;
++
+ if (file->f_mode & FMODE_READ) {
+ iter->pg = ftrace_pages_start;
+
+@@ -3619,7 +3620,6 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
+ /* Failed */
+ free_ftrace_hash(iter->hash);
+ trace_parser_put(&iter->parser);
+- kfree(iter);
+ }
+ } else
+ file->private_data = iter;
+@@ -3627,6 +3627,13 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
+ out_unlock:
+ mutex_unlock(&ops->func_hash->regex_lock);
+
++ out:
++ if (ret) {
++ kfree(iter);
++ if (tr)
++ trace_array_put(tr);
++ }
++
+ return ret;
+ }
+
+@@ -5024,6 +5031,8 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
+
+ mutex_unlock(&iter->ops->func_hash->regex_lock);
+ free_ftrace_hash(iter->hash);
++ if (iter->tr)
++ trace_array_put(iter->tr);
+ kfree(iter);
+
+ return 0;
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 3b0de19b9ed7..27b17ea44f74 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4154,9 +4154,14 @@ static int show_traces_open(struct inode *inode, struct file *file)
+ if (tracing_disabled)
+ return -ENODEV;
+
++ if (trace_array_get(tr) < 0)
++ return -ENODEV;
++
+ ret = seq_open(file, &show_traces_seq_ops);
+- if (ret)
++ if (ret) {
++ trace_array_put(tr);
+ return ret;
++ }
+
+ m = file->private_data;
+ m->private = tr;
+@@ -4164,6 +4169,14 @@ static int show_traces_open(struct inode *inode, struct file *file)
+ return 0;
+ }
+
++static int show_traces_release(struct inode *inode, struct file *file)
++{
++ struct trace_array *tr = inode->i_private;
++
++ trace_array_put(tr);
++ return seq_release(inode, file);
++}
++
+ static ssize_t
+ tracing_write_stub(struct file *filp, const char __user *ubuf,
+ size_t count, loff_t *ppos)
+@@ -4194,8 +4207,8 @@ static const struct file_operations tracing_fops = {
+ static const struct file_operations show_traces_fops = {
+ .open = show_traces_open,
+ .read = seq_read,
+- .release = seq_release,
+ .llseek = seq_lseek,
++ .release = show_traces_release,
+ };
+
+ static ssize_t
+diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
+index 1e6db9cbe4dc..8030e24dbf14 100644
+--- a/kernel/trace/trace_hwlat.c
++++ b/kernel/trace/trace_hwlat.c
+@@ -150,7 +150,7 @@ void trace_hwlat_callback(bool enter)
+ if (enter)
+ nmi_ts_start = time_get();
+ else
+- nmi_total_ts = time_get() - nmi_ts_start;
++ nmi_total_ts += time_get() - nmi_ts_start;
+ }
+
+ if (enter)
+@@ -256,6 +256,8 @@ static int get_sample(void)
+ /* Keep a running maximum ever recorded hardware latency */
+ if (sample > tr->max_latency)
+ tr->max_latency = sample;
++ if (outer_sample > tr->max_latency)
++ tr->max_latency = outer_sample;
+ }
+
+ out:
+diff --git a/mm/vmpressure.c b/mm/vmpressure.c
+index 4854584ec436..39021133cec8 100644
+--- a/mm/vmpressure.c
++++ b/mm/vmpressure.c
+@@ -358,6 +358,9 @@ void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg, int prio)
+ * "hierarchy" or "local").
+ *
+ * To be used as memcg event method.
++ *
++ * Return: 0 on success, -ENOMEM on memory failure or -EINVAL if @args could
++ * not be parsed.
+ */
+ int vmpressure_register_event(struct mem_cgroup *memcg,
+ struct eventfd_ctx *eventfd, const char *args)
+@@ -365,7 +368,7 @@ int vmpressure_register_event(struct mem_cgroup *memcg,
+ struct vmpressure *vmpr = memcg_to_vmpressure(memcg);
+ struct vmpressure_event *ev;
+ enum vmpressure_modes mode = VMPRESSURE_NO_PASSTHROUGH;
+- enum vmpressure_levels level = -1;
++ enum vmpressure_levels level;
+ char *spec, *spec_orig;
+ char *token;
+ int ret = 0;
+@@ -378,20 +381,18 @@ int vmpressure_register_event(struct mem_cgroup *memcg,
+
+ /* Find required level */
+ token = strsep(&spec, ",");
+- level = match_string(vmpressure_str_levels, VMPRESSURE_NUM_LEVELS, token);
+- if (level < 0) {
+- ret = level;
++ ret = match_string(vmpressure_str_levels, VMPRESSURE_NUM_LEVELS, token);
++ if (ret < 0)
+ goto out;
+- }
++ level = ret;
+
+ /* Find optional mode */
+ token = strsep(&spec, ",");
+ if (token) {
+- mode = match_string(vmpressure_str_modes, VMPRESSURE_NUM_MODES, token);
+- if (mode < 0) {
+- ret = mode;
++ ret = match_string(vmpressure_str_modes, VMPRESSURE_NUM_MODES, token);
++ if (ret < 0)
+ goto out;
+- }
++ mode = ret;
+ }
+
+ ev = kzalloc(sizeof(*ev), GFP_KERNEL);
+@@ -407,6 +408,7 @@ int vmpressure_register_event(struct mem_cgroup *memcg,
+ mutex_lock(&vmpr->events_lock);
+ list_add(&ev->node, &vmpr->events);
+ mutex_unlock(&vmpr->events_lock);
++ ret = 0;
+ out:
+ kfree(spec_orig);
+ return ret;
+diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c
+index a1863000e972..663e790c2693 100644
+--- a/tools/perf/util/jitdump.c
++++ b/tools/perf/util/jitdump.c
+@@ -394,7 +394,7 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd, union jr_entry *jr)
+ size_t size;
+ u16 idr_size;
+ const char *sym;
+- uint32_t count;
++ uint64_t count;
+ int ret, csize, usize;
+ pid_t pid, tid;
+ struct {
+@@ -417,7 +417,7 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd, union jr_entry *jr)
+ return -1;
+
+ filename = event->mmap2.filename;
+- size = snprintf(filename, PATH_MAX, "%s/jitted-%d-%u.so",
++ size = snprintf(filename, PATH_MAX, "%s/jitted-%d-%" PRIu64 ".so",
+ jd->dir,
+ pid,
+ count);
+@@ -530,7 +530,7 @@ static int jit_repipe_code_move(struct jit_buf_desc *jd, union jr_entry *jr)
+ return -1;
+
+ filename = event->mmap2.filename;
+- size = snprintf(filename, PATH_MAX, "%s/jitted-%d-%"PRIu64,
++ size = snprintf(filename, PATH_MAX, "%s/jitted-%d-%" PRIu64 ".so",
+ jd->dir,
+ pid,
+ jr->move.code_index);
+diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
+index 19262f98cd4e..2344d86cd778 100644
+--- a/tools/perf/util/llvm-utils.c
++++ b/tools/perf/util/llvm-utils.c
+@@ -230,14 +230,14 @@ static int detect_kbuild_dir(char **kbuild_dir)
+ const char *prefix_dir = "";
+ const char *suffix_dir = "";
+
++ /* _UTSNAME_LENGTH is 65 */
++ char release[128];
++
+ char *autoconf_path;
+
+ int err;
+
+ if (!test_dir) {
+- /* _UTSNAME_LENGTH is 65 */
+- char release[128];
+-
+ err = fetch_kernel_version(NULL, release,
+ sizeof(release));
+ if (err)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-10-29 12:04 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-10-29 12:04 UTC (permalink / raw
To: gentoo-commits
commit: 3af0f636399a165ea0a180550c66d5a5515a9c60
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Oct 29 12:04:29 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Oct 29 12:04:29 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3af0f636
Linux patch 4.19.81
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1080_linux-4.19.81.patch | 2700 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2704 insertions(+)
diff --git a/0000_README b/0000_README
index 4a75724..3811a86 100644
--- a/0000_README
+++ b/0000_README
@@ -359,6 +359,10 @@ Patch: 1079_linux-4.19.80.patch
From: https://www.kernel.org
Desc: Linux 4.19.80
+Patch: 1080_linux-4.19.81.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.81
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1080_linux-4.19.81.patch b/1080_linux-4.19.81.patch
new file mode 100644
index 0000000..55ea23d
--- /dev/null
+++ b/1080_linux-4.19.81.patch
@@ -0,0 +1,2700 @@
+diff --git a/Makefile b/Makefile
+index ced4a9fd9754..3c146e8d93dc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 80
++SUBLEVEL = 81
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
+index d4b7c59eec68..cf1e4f747242 100644
+--- a/arch/arm/boot/dts/am4372.dtsi
++++ b/arch/arm/boot/dts/am4372.dtsi
+@@ -1142,6 +1142,8 @@
+ ti,hwmods = "dss_dispc";
+ clocks = <&disp_clk>;
+ clock-names = "fck";
++
++ max-memory-bandwidth = <230000000>;
+ };
+
+ rfbi: rfbi@4832a800 {
+diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+index 9ded7bf972e7..3b8fe014a3e9 100644
+--- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+@@ -946,7 +946,8 @@ static struct omap_hwmod_class_sysconfig am33xx_timer_sysc = {
+ .rev_offs = 0x0000,
+ .sysc_offs = 0x0010,
+ .syss_offs = 0x0014,
+- .sysc_flags = (SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET),
++ .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
++ SYSC_HAS_RESET_STATUS,
+ .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
+ SIDLE_SMART_WKUP),
+ .sysc_fields = &omap_hwmod_sysc_type2,
+diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
+index ca03af8fe43f..ddf96adf65ab 100644
+--- a/arch/arm/mach-omap2/pm.c
++++ b/arch/arm/mach-omap2/pm.c
+@@ -77,83 +77,6 @@ int omap_pm_clkdms_setup(struct clockdomain *clkdm, void *unused)
+ return 0;
+ }
+
+-/*
+- * This API is to be called during init to set the various voltage
+- * domains to the voltage as per the opp table. Typically we boot up
+- * at the nominal voltage. So this function finds out the rate of
+- * the clock associated with the voltage domain, finds out the correct
+- * opp entry and sets the voltage domain to the voltage specified
+- * in the opp entry
+- */
+-static int __init omap2_set_init_voltage(char *vdd_name, char *clk_name,
+- const char *oh_name)
+-{
+- struct voltagedomain *voltdm;
+- struct clk *clk;
+- struct dev_pm_opp *opp;
+- unsigned long freq, bootup_volt;
+- struct device *dev;
+-
+- if (!vdd_name || !clk_name || !oh_name) {
+- pr_err("%s: invalid parameters\n", __func__);
+- goto exit;
+- }
+-
+- if (!strncmp(oh_name, "mpu", 3))
+- /*
+- * All current OMAPs share voltage rail and clock
+- * source, so CPU0 is used to represent the MPU-SS.
+- */
+- dev = get_cpu_device(0);
+- else
+- dev = omap_device_get_by_hwmod_name(oh_name);
+-
+- if (IS_ERR(dev)) {
+- pr_err("%s: Unable to get dev pointer for hwmod %s\n",
+- __func__, oh_name);
+- goto exit;
+- }
+-
+- voltdm = voltdm_lookup(vdd_name);
+- if (!voltdm) {
+- pr_err("%s: unable to get vdd pointer for vdd_%s\n",
+- __func__, vdd_name);
+- goto exit;
+- }
+-
+- clk = clk_get(NULL, clk_name);
+- if (IS_ERR(clk)) {
+- pr_err("%s: unable to get clk %s\n", __func__, clk_name);
+- goto exit;
+- }
+-
+- freq = clk_get_rate(clk);
+- clk_put(clk);
+-
+- opp = dev_pm_opp_find_freq_ceil(dev, &freq);
+- if (IS_ERR(opp)) {
+- pr_err("%s: unable to find boot up OPP for vdd_%s\n",
+- __func__, vdd_name);
+- goto exit;
+- }
+-
+- bootup_volt = dev_pm_opp_get_voltage(opp);
+- dev_pm_opp_put(opp);
+-
+- if (!bootup_volt) {
+- pr_err("%s: unable to find voltage corresponding to the bootup OPP for vdd_%s\n",
+- __func__, vdd_name);
+- goto exit;
+- }
+-
+- voltdm_scale(voltdm, bootup_volt);
+- return 0;
+-
+-exit:
+- pr_err("%s: unable to set vdd_%s\n", __func__, vdd_name);
+- return -EINVAL;
+-}
+-
+ #ifdef CONFIG_SUSPEND
+ static int omap_pm_enter(suspend_state_t suspend_state)
+ {
+@@ -211,25 +134,6 @@ void omap_common_suspend_init(void *pm_suspend)
+ }
+ #endif /* CONFIG_SUSPEND */
+
+-static void __init omap3_init_voltages(void)
+-{
+- if (!soc_is_omap34xx())
+- return;
+-
+- omap2_set_init_voltage("mpu_iva", "dpll1_ck", "mpu");
+- omap2_set_init_voltage("core", "l3_ick", "l3_main");
+-}
+-
+-static void __init omap4_init_voltages(void)
+-{
+- if (!soc_is_omap44xx())
+- return;
+-
+- omap2_set_init_voltage("mpu", "dpll_mpu_ck", "mpu");
+- omap2_set_init_voltage("core", "l3_div_ck", "l3_main_1");
+- omap2_set_init_voltage("iva", "dpll_iva_m5x2_ck", "iva");
+-}
+-
+ int __maybe_unused omap_pm_nop_init(void)
+ {
+ return 0;
+@@ -249,10 +153,6 @@ int __init omap2_common_pm_late_init(void)
+ omap4_twl_init();
+ omap_voltage_late_init();
+
+- /* Initialize the voltages */
+- omap3_init_voltages();
+- omap4_init_voltages();
+-
+ /* Smartreflex device init */
+ omap_devinit_smartreflex();
+
+diff --git a/arch/arm/xen/efi.c b/arch/arm/xen/efi.c
+index b4d78959cadf..bc9a37b3cecd 100644
+--- a/arch/arm/xen/efi.c
++++ b/arch/arm/xen/efi.c
+@@ -31,7 +31,9 @@ void __init xen_efi_runtime_setup(void)
+ efi.get_variable = xen_efi_get_variable;
+ efi.get_next_variable = xen_efi_get_next_variable;
+ efi.set_variable = xen_efi_set_variable;
++ efi.set_variable_nonblocking = xen_efi_set_variable;
+ efi.query_variable_info = xen_efi_query_variable_info;
++ efi.query_variable_info_nonblocking = xen_efi_query_variable_info;
+ efi.update_capsule = xen_efi_update_capsule;
+ efi.query_capsule_caps = xen_efi_query_capsule_caps;
+ efi.get_next_high_mono_count = xen_efi_get_next_high_mono_count;
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index 9ccf16939d13..71888808ded7 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -23,6 +23,7 @@
+ #include <asm/cpu.h>
+ #include <asm/cputype.h>
+ #include <asm/cpufeature.h>
++#include <asm/smp_plat.h>
+
+ static bool __maybe_unused
+ is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope)
+@@ -618,6 +619,30 @@ check_branch_predictor(const struct arm64_cpu_capabilities *entry, int scope)
+ return (need_wa > 0);
+ }
+
++static const __maybe_unused struct midr_range tx2_family_cpus[] = {
++ MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
++ MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
++ {},
++};
++
++static bool __maybe_unused
++needs_tx2_tvm_workaround(const struct arm64_cpu_capabilities *entry,
++ int scope)
++{
++ int i;
++
++ if (!is_affected_midr_range_list(entry, scope) ||
++ !is_hyp_mode_available())
++ return false;
++
++ for_each_possible_cpu(i) {
++ if (MPIDR_AFFINITY_LEVEL(cpu_logical_map(i), 0) != 0)
++ return true;
++ }
++
++ return false;
++}
++
+ #ifdef CONFIG_HARDEN_EL2_VECTORS
+
+ static const struct midr_range arm64_harden_el2_vectors[] = {
+@@ -801,6 +826,14 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+ .matches = has_cortex_a76_erratum_1463225,
+ },
++#endif
++#ifdef CONFIG_CAVIUM_TX2_ERRATUM_219
++ {
++ .desc = "Cavium ThunderX2 erratum 219 (KVM guest sysreg trapping)",
++ .capability = ARM64_WORKAROUND_CAVIUM_TX2_219_TVM,
++ ERRATA_MIDR_RANGE_LIST(tx2_family_cpus),
++ .matches = needs_tx2_tvm_workaround,
++ },
+ #endif
+ {
+ }
+diff --git a/arch/mips/boot/dts/qca/ar9331.dtsi b/arch/mips/boot/dts/qca/ar9331.dtsi
+index 2bae201aa365..1c7bf11f8450 100644
+--- a/arch/mips/boot/dts/qca/ar9331.dtsi
++++ b/arch/mips/boot/dts/qca/ar9331.dtsi
+@@ -99,7 +99,7 @@
+
+ miscintc: interrupt-controller@18060010 {
+ compatible = "qca,ar7240-misc-intc";
+- reg = <0x18060010 0x4>;
++ reg = <0x18060010 0x8>;
+
+ interrupt-parent = <&cpuintc>;
+ interrupts = <6>;
+diff --git a/arch/mips/loongson64/common/serial.c b/arch/mips/loongson64/common/serial.c
+index ffefc1cb2612..98c3a7feb10f 100644
+--- a/arch/mips/loongson64/common/serial.c
++++ b/arch/mips/loongson64/common/serial.c
+@@ -110,7 +110,7 @@ static int __init serial_init(void)
+ }
+ module_init(serial_init);
+
+-static void __init serial_exit(void)
++static void __exit serial_exit(void)
+ {
+ platform_device_unregister(&uart8250_device);
+ }
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index 355f8eadb1cd..3944c49eee0c 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -654,6 +654,13 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r,
+ int restore_scratch)
+ {
+ if (restore_scratch) {
++ /*
++ * Ensure the MFC0 below observes the value written to the
++ * KScratch register by the prior MTC0.
++ */
++ if (scratch_reg >= 0)
++ uasm_i_ehb(p);
++
+ /* Reset default page size */
+ if (PM_DEFAULT_MASK >> 16) {
+ uasm_i_lui(p, tmp, PM_DEFAULT_MASK >> 16);
+@@ -668,12 +675,10 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r,
+ uasm_i_mtc0(p, 0, C0_PAGEMASK);
+ uasm_il_b(p, r, lid);
+ }
+- if (scratch_reg >= 0) {
+- uasm_i_ehb(p);
++ if (scratch_reg >= 0)
+ UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
+- } else {
++ else
+ UASM_i_LW(p, 1, scratchpad_offset(0), 0);
+- }
+ } else {
+ /* Reset default page size */
+ if (PM_DEFAULT_MASK >> 16) {
+@@ -922,6 +927,10 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
+ }
+ if (mode != not_refill && check_for_high_segbits) {
+ uasm_l_large_segbits_fault(l, *p);
++
++ if (mode == refill_scratch && scratch_reg >= 0)
++ uasm_i_ehb(p);
++
+ /*
+ * We get here if we are an xsseg address, or if we are
+ * an xuseg address above (PGDIR_SHIFT+PGDIR_BITS) boundary.
+@@ -938,12 +947,10 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
+ uasm_i_jr(p, ptr);
+
+ if (mode == refill_scratch) {
+- if (scratch_reg >= 0) {
+- uasm_i_ehb(p);
++ if (scratch_reg >= 0)
+ UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
+- } else {
++ else
+ UASM_i_LW(p, 1, scratchpad_offset(0), 0);
+- }
+ } else {
+ uasm_i_nop(p);
+ }
+diff --git a/arch/parisc/mm/ioremap.c b/arch/parisc/mm/ioremap.c
+index 92a9b5f12f98..f29f682352f0 100644
+--- a/arch/parisc/mm/ioremap.c
++++ b/arch/parisc/mm/ioremap.c
+@@ -3,7 +3,7 @@
+ * arch/parisc/mm/ioremap.c
+ *
+ * (C) Copyright 1995 1996 Linus Torvalds
+- * (C) Copyright 2001-2006 Helge Deller <deller@gmx.de>
++ * (C) Copyright 2001-2019 Helge Deller <deller@gmx.de>
+ * (C) Copyright 2005 Kyle McMartin <kyle@parisc-linux.org>
+ */
+
+@@ -84,7 +84,7 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l
+ addr = (void __iomem *) area->addr;
+ if (ioremap_page_range((unsigned long)addr, (unsigned long)addr + size,
+ phys_addr, pgprot)) {
+- vfree(addr);
++ vunmap(addr);
+ return NULL;
+ }
+
+@@ -92,9 +92,11 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l
+ }
+ EXPORT_SYMBOL(__ioremap);
+
+-void iounmap(const volatile void __iomem *addr)
++void iounmap(const volatile void __iomem *io_addr)
+ {
+- if (addr > high_memory)
+- return vfree((void *) (PAGE_MASK & (unsigned long __force) addr));
++ unsigned long addr = (unsigned long)io_addr & PAGE_MASK;
++
++ if (is_vmalloc_addr((void *)addr))
++ vunmap((void *)addr);
+ }
+ EXPORT_SYMBOL(iounmap);
+diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
+index 7685444a106b..145517934171 100644
+--- a/arch/x86/kernel/apic/x2apic_cluster.c
++++ b/arch/x86/kernel/apic/x2apic_cluster.c
+@@ -158,7 +158,8 @@ static int x2apic_dead_cpu(unsigned int dead_cpu)
+ {
+ struct cluster_mask *cmsk = per_cpu(cluster_masks, dead_cpu);
+
+- cpumask_clear_cpu(dead_cpu, &cmsk->mask);
++ if (cmsk)
++ cpumask_clear_cpu(dead_cpu, &cmsk->mask);
+ free_cpumask_var(per_cpu(ipi_mask, dead_cpu));
+ return 0;
+ }
+diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
+index 250cfa85b633..88dc38b4a147 100644
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -222,13 +222,31 @@ unsigned long __head __startup_64(unsigned long physaddr,
+ * we might write invalid pmds, when the kernel is relocated
+ * cleanup_highmap() fixes this up along with the mappings
+ * beyond _end.
++ *
++ * Only the region occupied by the kernel image has so far
++ * been checked against the table of usable memory regions
++ * provided by the firmware, so invalidate pages outside that
++ * region. A page table entry that maps to a reserved area of
++ * memory would allow processor speculation into that area,
++ * and on some hardware (particularly the UV platform) even
++ * speculative access to some reserved areas is caught as an
++ * error, causing the BIOS to halt the system.
+ */
+
+ pmd = fixup_pointer(level2_kernel_pgt, physaddr);
+- for (i = 0; i < PTRS_PER_PMD; i++) {
++
++ /* invalidate pages before the kernel image */
++ for (i = 0; i < pmd_index((unsigned long)_text); i++)
++ pmd[i] &= ~_PAGE_PRESENT;
++
++ /* fixup pages that are part of the kernel image */
++ for (; i <= pmd_index((unsigned long)_end); i++)
+ if (pmd[i] & _PAGE_PRESENT)
+ pmd[i] += load_delta;
+- }
++
++ /* invalidate pages after the kernel image */
++ for (; i < PTRS_PER_PMD; i++)
++ pmd[i] &= ~_PAGE_PRESENT;
+
+ /*
+ * Fixup phys_base - remove the memory encryption mask to obtain
+diff --git a/arch/x86/xen/efi.c b/arch/x86/xen/efi.c
+index 1804b27f9632..66bcdeeee639 100644
+--- a/arch/x86/xen/efi.c
++++ b/arch/x86/xen/efi.c
+@@ -77,7 +77,9 @@ static efi_system_table_t __init *xen_efi_probe(void)
+ efi.get_variable = xen_efi_get_variable;
+ efi.get_next_variable = xen_efi_get_next_variable;
+ efi.set_variable = xen_efi_set_variable;
++ efi.set_variable_nonblocking = xen_efi_set_variable;
+ efi.query_variable_info = xen_efi_query_variable_info;
++ efi.query_variable_info_nonblocking = xen_efi_query_variable_info;
+ efi.update_capsule = xen_efi_update_capsule;
+ efi.query_capsule_caps = xen_efi_query_capsule_caps;
+ efi.get_next_high_mono_count = xen_efi_get_next_high_mono_count;
+diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
+index 04f19de46700..4092555828b1 100644
+--- a/arch/xtensa/kernel/xtensa_ksyms.c
++++ b/arch/xtensa/kernel/xtensa_ksyms.c
+@@ -119,13 +119,6 @@ EXPORT_SYMBOL(__invalidate_icache_range);
+ // FIXME EXPORT_SYMBOL(screen_info);
+ #endif
+
+-EXPORT_SYMBOL(outsb);
+-EXPORT_SYMBOL(outsw);
+-EXPORT_SYMBOL(outsl);
+-EXPORT_SYMBOL(insb);
+-EXPORT_SYMBOL(insw);
+-EXPORT_SYMBOL(insl);
+-
+ extern long common_exception_return;
+ EXPORT_SYMBOL(common_exception_return);
+
+diff --git a/block/blk-rq-qos.h b/block/blk-rq-qos.h
+index 60fac2d066cf..98caba3e962e 100644
+--- a/block/blk-rq-qos.h
++++ b/block/blk-rq-qos.h
+@@ -80,16 +80,13 @@ static inline void rq_qos_add(struct request_queue *q, struct rq_qos *rqos)
+
+ static inline void rq_qos_del(struct request_queue *q, struct rq_qos *rqos)
+ {
+- struct rq_qos *cur, *prev = NULL;
+- for (cur = q->rq_qos; cur; cur = cur->next) {
+- if (cur == rqos) {
+- if (prev)
+- prev->next = rqos->next;
+- else
+- q->rq_qos = cur;
++ struct rq_qos **cur;
++
++ for (cur = &q->rq_qos; *cur; cur = &(*cur)->next) {
++ if (*cur == rqos) {
++ *cur = rqos->next;
+ break;
+ }
+- prev = cur;
+ }
+ }
+
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index a1aa59849b96..41228e545e82 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -909,8 +909,8 @@ void acpi_cppc_processor_exit(struct acpi_processor *pr)
+ pcc_data[pcc_ss_id]->refcount--;
+ if (!pcc_data[pcc_ss_id]->refcount) {
+ pcc_mbox_free_channel(pcc_data[pcc_ss_id]->pcc_channel);
+- pcc_data[pcc_ss_id]->pcc_channel_acquired = 0;
+ kfree(pcc_data[pcc_ss_id]);
++ pcc_data[pcc_ss_id] = NULL;
+ }
+ }
+ }
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 5d110b1362e7..fa1c5a442957 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -1633,7 +1633,9 @@ static void ahci_intel_pcs_quirk(struct pci_dev *pdev, struct ahci_host_priv *hp
+ */
+ if (!id || id->vendor != PCI_VENDOR_ID_INTEL)
+ return;
+- if (((enum board_ids) id->driver_data) < board_ahci_pcs7)
++
++ /* Skip applying the quirk on Denverton and beyond */
++ if (((enum board_ids) id->driver_data) >= board_ahci_pcs7)
+ return;
+
+ /*
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index fcda6313e7de..985ccced33a2 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -8,6 +8,7 @@
+ * Copyright (c) 2006 Novell, Inc.
+ */
+
++#include <linux/cpufreq.h>
+ #include <linux/device.h>
+ #include <linux/err.h>
+ #include <linux/fwnode.h>
+@@ -2943,6 +2944,8 @@ void device_shutdown(void)
+ wait_for_device_probe();
+ device_block_probing();
+
++ cpufreq_suspend();
++
+ spin_lock(&devices_kset->list_lock);
+ /*
+ * Walk the devices list backward, shutting down each in turn.
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index 817320c7c4c1..85ee64d0a44e 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -554,6 +554,9 @@ store_soft_offline_page(struct device *dev,
+ pfn >>= PAGE_SHIFT;
+ if (!pfn_valid(pfn))
+ return -ENXIO;
++ /* Only online pages can be soft-offlined (esp., not ZONE_DEVICE). */
++ if (!pfn_to_online_page(pfn))
++ return -EIO;
+ ret = soft_offline_page(pfn_to_page(pfn), 0);
+ return ret == 0 ? count : ret;
+ }
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index d3213594d1a7..ace5ec65e36f 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -2578,14 +2578,6 @@ int cpufreq_unregister_driver(struct cpufreq_driver *driver)
+ }
+ EXPORT_SYMBOL_GPL(cpufreq_unregister_driver);
+
+-/*
+- * Stop cpufreq at shutdown to make sure it isn't holding any locks
+- * or mutexes when secondary CPUs are halted.
+- */
+-static struct syscore_ops cpufreq_syscore_ops = {
+- .shutdown = cpufreq_suspend,
+-};
+-
+ struct kobject *cpufreq_global_kobject;
+ EXPORT_SYMBOL(cpufreq_global_kobject);
+
+@@ -2597,8 +2589,6 @@ static int __init cpufreq_core_init(void)
+ cpufreq_global_kobject = kobject_create_and_add("cpufreq", &cpu_subsys.dev_root->kobj);
+ BUG_ON(!cpufreq_global_kobject);
+
+- register_syscore_ops(&cpufreq_syscore_ops);
+-
+ return 0;
+ }
+ module_param(off, int, 0444);
+diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c
+index 473aeec4b1da..574bce603337 100644
+--- a/drivers/edac/ghes_edac.c
++++ b/drivers/edac/ghes_edac.c
+@@ -532,7 +532,11 @@ void ghes_edac_unregister(struct ghes *ghes)
+ if (!ghes_pvt)
+ return;
+
++ if (atomic_dec_return(&ghes_init))
++ return;
++
+ mci = ghes_pvt->mci;
++ ghes_pvt = NULL;
+ edac_mc_del_mc(mci->pdev);
+ edac_mc_free(mci);
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index b40e9c76af0c..5e29f14f4b30 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -841,6 +841,41 @@ static int amdgpu_pci_probe(struct pci_dev *pdev,
+ if (ret == -EPROBE_DEFER)
+ return ret;
+
++#ifdef CONFIG_DRM_AMDGPU_SI
++ if (!amdgpu_si_support) {
++ switch (flags & AMD_ASIC_MASK) {
++ case CHIP_TAHITI:
++ case CHIP_PITCAIRN:
++ case CHIP_VERDE:
++ case CHIP_OLAND:
++ case CHIP_HAINAN:
++ dev_info(&pdev->dev,
++ "SI support provided by radeon.\n");
++ dev_info(&pdev->dev,
++ "Use radeon.si_support=0 amdgpu.si_support=1 to override.\n"
++ );
++ return -ENODEV;
++ }
++ }
++#endif
++#ifdef CONFIG_DRM_AMDGPU_CIK
++ if (!amdgpu_cik_support) {
++ switch (flags & AMD_ASIC_MASK) {
++ case CHIP_KAVERI:
++ case CHIP_BONAIRE:
++ case CHIP_HAWAII:
++ case CHIP_KABINI:
++ case CHIP_MULLINS:
++ dev_info(&pdev->dev,
++ "CIK support provided by radeon.\n");
++ dev_info(&pdev->dev,
++ "Use radeon.cik_support=0 amdgpu.cik_support=1 to override.\n"
++ );
++ return -ENODEV;
++ }
++ }
++#endif
++
+ /* Get rid of things like offb */
+ ret = amdgpu_kick_out_firmware_fb(pdev);
+ if (ret)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index fc93b103f777..ba10577569f8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -87,41 +87,6 @@ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags)
+ struct amdgpu_device *adev;
+ int r, acpi_status;
+
+-#ifdef CONFIG_DRM_AMDGPU_SI
+- if (!amdgpu_si_support) {
+- switch (flags & AMD_ASIC_MASK) {
+- case CHIP_TAHITI:
+- case CHIP_PITCAIRN:
+- case CHIP_VERDE:
+- case CHIP_OLAND:
+- case CHIP_HAINAN:
+- dev_info(dev->dev,
+- "SI support provided by radeon.\n");
+- dev_info(dev->dev,
+- "Use radeon.si_support=0 amdgpu.si_support=1 to override.\n"
+- );
+- return -ENODEV;
+- }
+- }
+-#endif
+-#ifdef CONFIG_DRM_AMDGPU_CIK
+- if (!amdgpu_cik_support) {
+- switch (flags & AMD_ASIC_MASK) {
+- case CHIP_KAVERI:
+- case CHIP_BONAIRE:
+- case CHIP_HAWAII:
+- case CHIP_KABINI:
+- case CHIP_MULLINS:
+- dev_info(dev->dev,
+- "CIK support provided by radeon.\n");
+- dev_info(dev->dev,
+- "Use radeon.cik_support=0 amdgpu.cik_support=1 to override.\n"
+- );
+- return -ENODEV;
+- }
+- }
+-#endif
+-
+ adev = kzalloc(sizeof(struct amdgpu_device), GFP_KERNEL);
+ if (adev == NULL) {
+ return -ENOMEM;
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index e5e7e65934da..f5926bf5dabd 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -166,6 +166,9 @@ static const struct edid_quirk {
+ /* Medion MD 30217 PG */
+ { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
+
++ /* Lenovo G50 */
++ { "SDC", 18514, EDID_QUIRK_FORCE_6BPC },
++
+ /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
+ { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
+
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
+index d83310751a8e..c26f09b47ecb 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -395,19 +395,11 @@ radeon_pci_remove(struct pci_dev *pdev)
+ static void
+ radeon_pci_shutdown(struct pci_dev *pdev)
+ {
+- struct drm_device *ddev = pci_get_drvdata(pdev);
+-
+ /* if we are running in a VM, make sure the device
+ * torn down properly on reboot/shutdown
+ */
+ if (radeon_device_is_virtual())
+ radeon_pci_remove(pdev);
+-
+- /* Some adapters need to be suspended before a
+- * shutdown occurs in order to prevent an error
+- * during kexec.
+- */
+- radeon_suspend_kms(ddev, true, true, false);
+ }
+
+ static int radeon_pmops_suspend(struct device *dev)
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+index 6fe91c1b692d..185655f22f89 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+@@ -273,15 +273,13 @@ static vm_fault_t ttm_bo_vm_fault(struct vm_fault *vmf)
+ else
+ ret = vmf_insert_pfn(&cvma, address, pfn);
+
+- /*
+- * Somebody beat us to this PTE or prefaulting to
+- * an already populated PTE, or prefaulting error.
+- */
+-
+- if (unlikely((ret == VM_FAULT_NOPAGE && i > 0)))
+- break;
+- else if (unlikely(ret & VM_FAULT_ERROR))
+- goto out_io_unlock;
++ /* Never error on prefaulted PTEs */
++ if (unlikely((ret & VM_FAULT_ERROR))) {
++ if (i == 0)
++ goto out_io_unlock;
++ else
++ break;
++ }
+
+ address += PAGE_SIZE;
+ if (unlikely(++page_offset >= page_last))
+diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
+index 7b76e6f81aeb..f2fb7318abc1 100644
+--- a/drivers/infiniband/hw/cxgb4/mem.c
++++ b/drivers/infiniband/hw/cxgb4/mem.c
+@@ -274,13 +274,17 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
+ struct sk_buff *skb, struct c4iw_wr_wait *wr_waitp)
+ {
+ int err;
+- struct fw_ri_tpte tpt;
++ struct fw_ri_tpte *tpt;
+ u32 stag_idx;
+ static atomic_t key;
+
+ if (c4iw_fatal_error(rdev))
+ return -EIO;
+
++ tpt = kmalloc(sizeof(*tpt), GFP_KERNEL);
++ if (!tpt)
++ return -ENOMEM;
++
+ stag_state = stag_state > 0;
+ stag_idx = (*stag) >> 8;
+
+@@ -290,6 +294,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
+ mutex_lock(&rdev->stats.lock);
+ rdev->stats.stag.fail++;
+ mutex_unlock(&rdev->stats.lock);
++ kfree(tpt);
+ return -ENOMEM;
+ }
+ mutex_lock(&rdev->stats.lock);
+@@ -304,28 +309,28 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
+
+ /* write TPT entry */
+ if (reset_tpt_entry)
+- memset(&tpt, 0, sizeof(tpt));
++ memset(tpt, 0, sizeof(*tpt));
+ else {
+- tpt.valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
++ tpt->valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
+ FW_RI_TPTE_STAGKEY_V((*stag & FW_RI_TPTE_STAGKEY_M)) |
+ FW_RI_TPTE_STAGSTATE_V(stag_state) |
+ FW_RI_TPTE_STAGTYPE_V(type) | FW_RI_TPTE_PDID_V(pdid));
+- tpt.locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
++ tpt->locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
+ (bind_enabled ? FW_RI_TPTE_MWBINDEN_F : 0) |
+ FW_RI_TPTE_ADDRTYPE_V((zbva ? FW_RI_ZERO_BASED_TO :
+ FW_RI_VA_BASED_TO))|
+ FW_RI_TPTE_PS_V(page_size));
+- tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
++ tpt->nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
+ FW_RI_TPTE_PBLADDR_V(PBL_OFF(rdev, pbl_addr)>>3));
+- tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
+- tpt.va_hi = cpu_to_be32((u32)(to >> 32));
+- tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
+- tpt.dca_mwbcnt_pstag = cpu_to_be32(0);
+- tpt.len_hi = cpu_to_be32((u32)(len >> 32));
++ tpt->len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
++ tpt->va_hi = cpu_to_be32((u32)(to >> 32));
++ tpt->va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
++ tpt->dca_mwbcnt_pstag = cpu_to_be32(0);
++ tpt->len_hi = cpu_to_be32((u32)(len >> 32));
+ }
+ err = write_adapter_mem(rdev, stag_idx +
+ (rdev->lldi.vr->stag.start >> 5),
+- sizeof(tpt), &tpt, skb, wr_waitp);
++ sizeof(*tpt), tpt, skb, wr_waitp);
+
+ if (reset_tpt_entry) {
+ c4iw_put_resource(&rdev->resource.tpt_table, stag_idx);
+@@ -333,6 +338,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
+ rdev->stats.stag.cur -= 32;
+ mutex_unlock(&rdev->stats.lock);
+ }
++ kfree(tpt);
+ return err;
+ }
+
+diff --git a/drivers/input/misc/da9063_onkey.c b/drivers/input/misc/da9063_onkey.c
+index 3e9c353d82ef..a01b25facf46 100644
+--- a/drivers/input/misc/da9063_onkey.c
++++ b/drivers/input/misc/da9063_onkey.c
+@@ -248,10 +248,7 @@ static int da9063_onkey_probe(struct platform_device *pdev)
+ onkey->input->phys = onkey->phys;
+ onkey->input->dev.parent = &pdev->dev;
+
+- if (onkey->key_power)
+- input_set_capability(onkey->input, EV_KEY, KEY_POWER);
+-
+- input_set_capability(onkey->input, EV_KEY, KEY_SLEEP);
++ input_set_capability(onkey->input, EV_KEY, KEY_POWER);
+
+ INIT_DELAYED_WORK(&onkey->work, da9063_poll_on);
+
+diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
+index 7fb358f96195..162526a0d463 100644
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -149,7 +149,7 @@ static int rmi_process_interrupt_requests(struct rmi_device *rmi_dev)
+ }
+
+ mutex_lock(&data->irq_mutex);
+- bitmap_and(data->irq_status, data->irq_status, data->current_irq_mask,
++ bitmap_and(data->irq_status, data->irq_status, data->fn_irq_bits,
+ data->irq_count);
+ /*
+ * At this point, irq_status has all bits that are set in the
+@@ -388,6 +388,8 @@ static int rmi_driver_set_irq_bits(struct rmi_device *rmi_dev,
+ bitmap_copy(data->current_irq_mask, data->new_irq_mask,
+ data->num_of_irq_regs);
+
++ bitmap_or(data->fn_irq_bits, data->fn_irq_bits, mask, data->irq_count);
++
+ error_unlock:
+ mutex_unlock(&data->irq_mutex);
+ return error;
+@@ -401,6 +403,8 @@ static int rmi_driver_clear_irq_bits(struct rmi_device *rmi_dev,
+ struct device *dev = &rmi_dev->dev;
+
+ mutex_lock(&data->irq_mutex);
++ bitmap_andnot(data->fn_irq_bits,
++ data->fn_irq_bits, mask, data->irq_count);
+ bitmap_andnot(data->new_irq_mask,
+ data->current_irq_mask, mask, data->irq_count);
+
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index b29a8327eed1..84ff70027c25 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -541,7 +541,7 @@ static void wake_migration_worker(struct cache *cache)
+
+ static struct dm_bio_prison_cell_v2 *alloc_prison_cell(struct cache *cache)
+ {
+- return dm_bio_prison_alloc_cell_v2(cache->prison, GFP_NOWAIT);
++ return dm_bio_prison_alloc_cell_v2(cache->prison, GFP_NOIO);
+ }
+
+ static void free_prison_cell(struct cache *cache, struct dm_bio_prison_cell_v2 *cell)
+@@ -553,9 +553,7 @@ static struct dm_cache_migration *alloc_migration(struct cache *cache)
+ {
+ struct dm_cache_migration *mg;
+
+- mg = mempool_alloc(&cache->migration_pool, GFP_NOWAIT);
+- if (!mg)
+- return NULL;
++ mg = mempool_alloc(&cache->migration_pool, GFP_NOIO);
+
+ memset(mg, 0, sizeof(*mg));
+
+@@ -663,10 +661,6 @@ static bool bio_detain_shared(struct cache *cache, dm_oblock_t oblock, struct bi
+ struct dm_bio_prison_cell_v2 *cell_prealloc, *cell;
+
+ cell_prealloc = alloc_prison_cell(cache); /* FIXME: allow wait if calling from worker */
+- if (!cell_prealloc) {
+- defer_bio(cache, bio);
+- return false;
+- }
+
+ build_key(oblock, end, &key);
+ r = dm_cell_get_v2(cache->prison, &key, lock_level(bio), bio, cell_prealloc, &cell);
+@@ -1492,11 +1486,6 @@ static int mg_lock_writes(struct dm_cache_migration *mg)
+ struct dm_bio_prison_cell_v2 *prealloc;
+
+ prealloc = alloc_prison_cell(cache);
+- if (!prealloc) {
+- DMERR_LIMIT("%s: alloc_prison_cell failed", cache_device_name(cache));
+- mg_complete(mg, false);
+- return -ENOMEM;
+- }
+
+ /*
+ * Prevent writes to the block, but allow reads to continue.
+@@ -1534,11 +1523,6 @@ static int mg_start(struct cache *cache, struct policy_work *op, struct bio *bio
+ }
+
+ mg = alloc_migration(cache);
+- if (!mg) {
+- policy_complete_background_work(cache->policy, op, false);
+- background_work_end(cache);
+- return -ENOMEM;
+- }
+
+ mg->op = op;
+ mg->overwrite_bio = bio;
+@@ -1627,10 +1611,6 @@ static int invalidate_lock(struct dm_cache_migration *mg)
+ struct dm_bio_prison_cell_v2 *prealloc;
+
+ prealloc = alloc_prison_cell(cache);
+- if (!prealloc) {
+- invalidate_complete(mg, false);
+- return -ENOMEM;
+- }
+
+ build_key(mg->invalidate_oblock, oblock_succ(mg->invalidate_oblock), &key);
+ r = dm_cell_lock_v2(cache->prison, &key,
+@@ -1668,10 +1648,6 @@ static int invalidate_start(struct cache *cache, dm_cblock_t cblock,
+ return -EPERM;
+
+ mg = alloc_migration(cache);
+- if (!mg) {
+- background_work_end(cache);
+- return -ENOMEM;
+- }
+
+ mg->overwrite_bio = bio;
+ mg->invalidate_cblock = cblock;
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index 43fa7dbf844b..3cafbfd655f5 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -158,7 +158,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ } else {
+ pr_err("md/raid0:%s: cannot assemble multi-zone RAID0 with default_layout setting\n",
+ mdname(mddev));
+- pr_err("md/raid0: please set raid.default_layout to 1 or 2\n");
++ pr_err("md/raid0: please set raid0.default_layout to 1 or 2\n");
+ err = -ENOTSUPP;
+ goto abort;
+ }
+diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c
+index bcdca9fbef51..29f5021d21ea 100644
+--- a/drivers/memstick/host/jmb38x_ms.c
++++ b/drivers/memstick/host/jmb38x_ms.c
+@@ -949,7 +949,7 @@ static int jmb38x_ms_probe(struct pci_dev *pdev,
+ if (!cnt) {
+ rc = -ENODEV;
+ pci_dev_busy = 1;
+- goto err_out;
++ goto err_out_int;
+ }
+
+ jm = kzalloc(sizeof(struct jmb38x_ms)
+diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
+index a8af682a9182..28f5aaca505a 100644
+--- a/drivers/mmc/host/cqhci.c
++++ b/drivers/mmc/host/cqhci.c
+@@ -617,7 +617,8 @@ static int cqhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
+ cq_host->slot[tag].flags = 0;
+
+ cq_host->qcnt += 1;
+-
++ /* Make sure descriptors are ready before ringing the doorbell */
++ wmb();
+ cqhci_writel(cq_host, 1 << tag, CQHCI_TDBR);
+ if (!(cqhci_readl(cq_host, CQHCI_TDBR) & (1 << tag)))
+ pr_debug("%s: cqhci: doorbell not set for tag %d\n",
+diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
+index bdd8f2df6630..33232cc9fb04 100644
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -543,7 +543,7 @@ qca8k_setup(struct dsa_switch *ds)
+ BIT(0) << QCA8K_GLOBAL_FW_CTRL1_UC_DP_S);
+
+ /* Setup connection between CPU port & user ports */
+- for (i = 0; i < DSA_MAX_PORTS; i++) {
++ for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+ /* CPU port gets connected to all user ports of the switch */
+ if (dsa_is_cpu_port(ds, i)) {
+ qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(QCA8K_CPU_PORT),
+@@ -897,7 +897,7 @@ qca8k_sw_probe(struct mdio_device *mdiodev)
+ if (id != QCA8K_ID_QCA8337)
+ return -ENODEV;
+
+- priv->ds = dsa_switch_alloc(&mdiodev->dev, DSA_MAX_PORTS);
++ priv->ds = dsa_switch_alloc(&mdiodev->dev, QCA8K_NUM_PORTS);
+ if (!priv->ds)
+ return -ENOMEM;
+
+diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c
+index a4d5049df692..f4b14b6acd22 100644
+--- a/drivers/net/dsa/rtl8366rb.c
++++ b/drivers/net/dsa/rtl8366rb.c
+@@ -507,7 +507,8 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ irq = of_irq_get(intc, 0);
+ if (irq <= 0) {
+ dev_err(smi->dev, "failed to get parent IRQ\n");
+- return irq ? irq : -EINVAL;
++ ret = irq ? irq : -EINVAL;
++ goto out_put_node;
+ }
+
+ /* This clears the IRQ status register */
+@@ -515,7 +516,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ &val);
+ if (ret) {
+ dev_err(smi->dev, "can't read interrupt status\n");
+- return ret;
++ goto out_put_node;
+ }
+
+ /* Fetch IRQ edge information from the descriptor */
+@@ -537,7 +538,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ val);
+ if (ret) {
+ dev_err(smi->dev, "could not configure IRQ polarity\n");
+- return ret;
++ goto out_put_node;
+ }
+
+ ret = devm_request_threaded_irq(smi->dev, irq, NULL,
+@@ -545,7 +546,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ "RTL8366RB", smi);
+ if (ret) {
+ dev_err(smi->dev, "unable to request irq: %d\n", ret);
+- return ret;
++ goto out_put_node;
+ }
+ smi->irqdomain = irq_domain_add_linear(intc,
+ RTL8366RB_NUM_INTERRUPT,
+@@ -553,12 +554,15 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ smi);
+ if (!smi->irqdomain) {
+ dev_err(smi->dev, "failed to create IRQ domain\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out_put_node;
+ }
+ for (i = 0; i < smi->num_ports; i++)
+ irq_set_parent(irq_create_mapping(smi->irqdomain, i), irq);
+
+- return 0;
++out_put_node:
++ of_node_put(intc);
++ return ret;
+ }
+
+ static int rtl8366rb_set_addr(struct realtek_smi *smi)
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+index 14b49612aa86..4dabf37319c8 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+@@ -369,6 +369,7 @@ struct bcmgenet_mib_counters {
+ #define EXT_PWR_DOWN_PHY_EN (1 << 20)
+
+ #define EXT_RGMII_OOB_CTRL 0x0C
++#define RGMII_MODE_EN_V123 (1 << 0)
+ #define RGMII_LINK (1 << 4)
+ #define OOB_DISABLE (1 << 5)
+ #define RGMII_MODE_EN (1 << 6)
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index de0e24d912fe..0d527fa5de61 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -261,7 +261,11 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ */
+ if (priv->ext_phy) {
+ reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL);
+- reg |= RGMII_MODE_EN | id_mode_dis;
++ reg |= id_mode_dis;
++ if (GENET_IS_V1(priv) || GENET_IS_V2(priv) || GENET_IS_V3(priv))
++ reg |= RGMII_MODE_EN_V123;
++ else
++ reg |= RGMII_MODE_EN;
+ bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
+ }
+
+@@ -276,11 +280,12 @@ int bcmgenet_mii_probe(struct net_device *dev)
+ struct bcmgenet_priv *priv = netdev_priv(dev);
+ struct device_node *dn = priv->pdev->dev.of_node;
+ struct phy_device *phydev;
+- u32 phy_flags;
++ u32 phy_flags = 0;
+ int ret;
+
+ /* Communicate the integrated PHY revision */
+- phy_flags = priv->gphy_rev;
++ if (priv->internal_phy)
++ phy_flags = priv->gphy_rev;
+
+ /* Initialize link state variables that bcmgenet_mii_setup() uses */
+ priv->old_link = -1;
+diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
+index baf5cc251f32..9a3bc0994a1d 100644
+--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
++++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
+@@ -156,11 +156,15 @@ static int mdio_sc_cfg_reg_write(struct hns_mdio_device *mdio_dev,
+ {
+ u32 time_cnt;
+ u32 reg_value;
++ int ret;
+
+ regmap_write(mdio_dev->subctrl_vbase, cfg_reg, set_val);
+
+ for (time_cnt = MDIO_TIMEOUT; time_cnt; time_cnt--) {
+- regmap_read(mdio_dev->subctrl_vbase, st_reg, ®_value);
++ ret = regmap_read(mdio_dev->subctrl_vbase, st_reg, ®_value);
++ if (ret)
++ return ret;
++
+ reg_value &= st_msk;
+ if ((!!check_st) == (!!reg_value))
+ break;
+diff --git a/drivers/net/ethernet/i825xx/lasi_82596.c b/drivers/net/ethernet/i825xx/lasi_82596.c
+index b69c622ba8b2..6f0e4019adef 100644
+--- a/drivers/net/ethernet/i825xx/lasi_82596.c
++++ b/drivers/net/ethernet/i825xx/lasi_82596.c
+@@ -96,6 +96,8 @@
+
+ #define OPT_SWAP_PORT 0x0001 /* Need to wordswp on the MPU port */
+
++#define LIB82596_DMA_ATTR DMA_ATTR_NON_CONSISTENT
++
+ #define DMA_WBACK(ndev, addr, len) \
+ do { dma_cache_sync((ndev)->dev.parent, (void *)addr, len, DMA_TO_DEVICE); } while (0)
+
+@@ -199,7 +201,7 @@ static int __exit lan_remove_chip(struct parisc_device *pdev)
+
+ unregister_netdev (dev);
+ dma_free_attrs(&pdev->dev, sizeof(struct i596_private), lp->dma,
+- lp->dma_addr, DMA_ATTR_NON_CONSISTENT);
++ lp->dma_addr, LIB82596_DMA_ATTR);
+ free_netdev (dev);
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/i825xx/lib82596.c b/drivers/net/ethernet/i825xx/lib82596.c
+index 2f7ae118217f..d0e8193ca470 100644
+--- a/drivers/net/ethernet/i825xx/lib82596.c
++++ b/drivers/net/ethernet/i825xx/lib82596.c
+@@ -1065,7 +1065,7 @@ static int i82596_probe(struct net_device *dev)
+
+ dma = dma_alloc_attrs(dev->dev.parent, sizeof(struct i596_dma),
+ &lp->dma_addr, GFP_KERNEL,
+- DMA_ATTR_NON_CONSISTENT);
++ LIB82596_DMA_ATTR);
+ if (!dma) {
+ printk(KERN_ERR "%s: Couldn't get shared memory\n", __FILE__);
+ return -ENOMEM;
+@@ -1087,7 +1087,7 @@ static int i82596_probe(struct net_device *dev)
+ i = register_netdev(dev);
+ if (i) {
+ dma_free_attrs(dev->dev.parent, sizeof(struct i596_dma),
+- dma, lp->dma_addr, DMA_ATTR_NON_CONSISTENT);
++ dma, lp->dma_addr, LIB82596_DMA_ATTR);
+ return i;
+ }
+
+diff --git a/drivers/net/ethernet/i825xx/sni_82596.c b/drivers/net/ethernet/i825xx/sni_82596.c
+index b2c04a789744..43c1fd18670b 100644
+--- a/drivers/net/ethernet/i825xx/sni_82596.c
++++ b/drivers/net/ethernet/i825xx/sni_82596.c
+@@ -23,6 +23,8 @@
+
+ static const char sni_82596_string[] = "snirm_82596";
+
++#define LIB82596_DMA_ATTR 0
++
+ #define DMA_WBACK(priv, addr, len) do { } while (0)
+ #define DMA_INV(priv, addr, len) do { } while (0)
+ #define DMA_WBACK_INV(priv, addr, len) do { } while (0)
+@@ -151,7 +153,7 @@ static int sni_82596_driver_remove(struct platform_device *pdev)
+
+ unregister_netdev(dev);
+ dma_free_attrs(dev->dev.parent, sizeof(struct i596_private), lp->dma,
+- lp->dma_addr, DMA_ATTR_NON_CONSISTENT);
++ lp->dma_addr, LIB82596_DMA_ATTR);
+ iounmap(lp->ca);
+ iounmap(lp->mpu_port);
+ free_netdev (dev);
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index aa067a7a72d4..8fa14736449b 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2731,12 +2731,10 @@ static int enable_scrq_irq(struct ibmvnic_adapter *adapter,
+
+ if (adapter->resetting &&
+ adapter->reset_reason == VNIC_RESET_MOBILITY) {
+- u64 val = (0xff000000) | scrq->hw_irq;
++ struct irq_desc *desc = irq_to_desc(scrq->irq);
++ struct irq_chip *chip = irq_desc_get_chip(desc);
+
+- rc = plpar_hcall_norets(H_EOI, val);
+- if (rc)
+- dev_err(dev, "H_EOI FAILED irq 0x%llx. rc=%ld\n",
+- val, rc);
++ chip->irq_eoi(&desc->irq_data);
+ }
+
+ rc = plpar_hcall_norets(H_VIOCTL, adapter->vdev->unit_address,
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 0101ebaecf02..014fe93ed2d8 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4522,8 +4522,10 @@ int stmmac_suspend(struct device *dev)
+ stmmac_mac_set(priv, priv->ioaddr, false);
+ pinctrl_pm_select_sleep_state(priv->device);
+ /* Disable clock in case of PWM is off */
+- clk_disable(priv->plat->pclk);
+- clk_disable(priv->plat->stmmac_clk);
++ if (priv->plat->clk_ptp_ref)
++ clk_disable_unprepare(priv->plat->clk_ptp_ref);
++ clk_disable_unprepare(priv->plat->pclk);
++ clk_disable_unprepare(priv->plat->stmmac_clk);
+ }
+ mutex_unlock(&priv->lock);
+
+@@ -4588,8 +4590,10 @@ int stmmac_resume(struct device *dev)
+ } else {
+ pinctrl_pm_select_default_state(priv->device);
+ /* enable the clk previously disabled */
+- clk_enable(priv->plat->stmmac_clk);
+- clk_enable(priv->plat->pclk);
++ clk_prepare_enable(priv->plat->stmmac_clk);
++ clk_prepare_enable(priv->plat->pclk);
++ if (priv->plat->clk_ptp_ref)
++ clk_prepare_enable(priv->plat->clk_ptp_ref);
+ /* reset the phy so that it's ready */
+ if (priv->mii)
+ stmmac_mdio_reset(priv->mii);
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index b2ff903a9cb6..38a41651e451 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -3151,12 +3151,12 @@ static int ca8210_probe(struct spi_device *spi_device)
+ goto error;
+ }
+
++ priv->spi->dev.platform_data = pdata;
+ ret = ca8210_get_platform_data(priv->spi, pdata);
+ if (ret) {
+ dev_crit(&spi_device->dev, "ca8210_get_platform_data failed\n");
+ goto error;
+ }
+- priv->spi->dev.platform_data = pdata;
+
+ ret = ca8210_dev_com_init(priv);
+ if (ret) {
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index a065a6184f7e..a291e5f2daef 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -4474,10 +4474,9 @@ static int rtl8152_reset_resume(struct usb_interface *intf)
+ struct r8152 *tp = usb_get_intfdata(intf);
+
+ clear_bit(SELECTIVE_SUSPEND, &tp->flags);
+- mutex_lock(&tp->control);
+ tp->rtl_ops.init(tp);
+ queue_delayed_work(system_long_wq, &tp->hw_phy_work, 0);
+- mutex_unlock(&tp->control);
++ set_ethernet_addr(tp);
+ return rtl8152_resume(intf);
+ }
+
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index 82add0ac4a5f..27b6b141cb71 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -718,7 +718,6 @@ err_unmap:
+ xenvif_unmap_frontend_data_rings(queue);
+ netif_napi_del(&queue->napi);
+ err:
+- module_put(THIS_MODULE);
+ return err;
+ }
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index ae0b01059fc6..5d0f99bcc987 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -111,10 +111,13 @@ static void nvme_set_queue_dying(struct nvme_ns *ns)
+ */
+ if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
+ return;
+- revalidate_disk(ns->disk);
+ blk_set_queue_dying(ns->queue);
+ /* Forcibly unquiesce queues to avoid blocking dispatch */
+ blk_mq_unquiesce_queue(ns->queue);
++ /*
++ * Revalidate after unblocking dispatchers that may be holding bd_butex
++ */
++ revalidate_disk(ns->disk);
+ }
+
+ static void nvme_queue_scan(struct nvme_ctrl *ctrl)
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 6384930a6749..2baf1f82f893 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -925,19 +925,6 @@ void pci_update_current_state(struct pci_dev *dev, pci_power_t state)
+ }
+ }
+
+-/**
+- * pci_power_up - Put the given device into D0 forcibly
+- * @dev: PCI device to power up
+- */
+-void pci_power_up(struct pci_dev *dev)
+-{
+- if (platform_pci_power_manageable(dev))
+- platform_pci_set_power_state(dev, PCI_D0);
+-
+- pci_raw_set_power_state(dev, PCI_D0);
+- pci_update_current_state(dev, PCI_D0);
+-}
+-
+ /**
+ * pci_platform_power_transition - Use platform to change device power state
+ * @dev: PCI device to handle.
+@@ -1116,6 +1103,17 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state)
+ }
+ EXPORT_SYMBOL(pci_set_power_state);
+
++/**
++ * pci_power_up - Put the given device into D0 forcibly
++ * @dev: PCI device to power up
++ */
++void pci_power_up(struct pci_dev *dev)
++{
++ __pci_start_power_transition(dev, PCI_D0);
++ pci_raw_set_power_state(dev, PCI_D0);
++ pci_update_current_state(dev, PCI_D0);
++}
++
+ /**
+ * pci_choose_state - Choose the power state of a PCI device
+ * @dev: PCI device to be suspended
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index b7e272d6ae81..227646eb817c 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1524,7 +1524,6 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+ DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_Strago"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ },
+ },
+ {
+@@ -1532,7 +1531,6 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Setzer"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ },
+ },
+ {
+@@ -1540,7 +1538,6 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Cyan"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ },
+ },
+ {
+@@ -1548,7 +1545,6 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ },
+ },
+ {}
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index aa48b3f23c7f..3aac640596ad 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -183,10 +183,10 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {
+ PIN_GRP_EXTRA("uart2", 9, 2, BIT(1) | BIT(13) | BIT(14) | BIT(19),
+ BIT(1) | BIT(13) | BIT(14), BIT(1) | BIT(19),
+ 18, 2, "gpio", "uart"),
+- PIN_GRP_GPIO("led0_od", 11, 1, BIT(20), "led"),
+- PIN_GRP_GPIO("led1_od", 12, 1, BIT(21), "led"),
+- PIN_GRP_GPIO("led2_od", 13, 1, BIT(22), "led"),
+- PIN_GRP_GPIO("led3_od", 14, 1, BIT(23), "led"),
++ PIN_GRP_GPIO_2("led0_od", 11, 1, BIT(20), BIT(20), 0, "led"),
++ PIN_GRP_GPIO_2("led1_od", 12, 1, BIT(21), BIT(21), 0, "led"),
++ PIN_GRP_GPIO_2("led2_od", 13, 1, BIT(22), BIT(22), 0, "led"),
++ PIN_GRP_GPIO_2("led3_od", 14, 1, BIT(23), BIT(23), 0, "led"),
+
+ };
+
+@@ -218,11 +218,11 @@ static const struct armada_37xx_pin_data armada_37xx_pin_sb = {
+ };
+
+ static inline void armada_37xx_update_reg(unsigned int *reg,
+- unsigned int offset)
++ unsigned int *offset)
+ {
+ /* We never have more than 2 registers */
+- if (offset >= GPIO_PER_REG) {
+- offset -= GPIO_PER_REG;
++ if (*offset >= GPIO_PER_REG) {
++ *offset -= GPIO_PER_REG;
+ *reg += sizeof(u32);
+ }
+ }
+@@ -373,7 +373,7 @@ static inline void armada_37xx_irq_update_reg(unsigned int *reg,
+ {
+ int offset = irqd_to_hwirq(d);
+
+- armada_37xx_update_reg(reg, offset);
++ armada_37xx_update_reg(reg, &offset);
+ }
+
+ static int armada_37xx_gpio_direction_input(struct gpio_chip *chip,
+@@ -383,7 +383,7 @@ static int armada_37xx_gpio_direction_input(struct gpio_chip *chip,
+ unsigned int reg = OUTPUT_EN;
+ unsigned int mask;
+
+- armada_37xx_update_reg(®, offset);
++ armada_37xx_update_reg(®, &offset);
+ mask = BIT(offset);
+
+ return regmap_update_bits(info->regmap, reg, mask, 0);
+@@ -396,7 +396,7 @@ static int armada_37xx_gpio_get_direction(struct gpio_chip *chip,
+ unsigned int reg = OUTPUT_EN;
+ unsigned int val, mask;
+
+- armada_37xx_update_reg(®, offset);
++ armada_37xx_update_reg(®, &offset);
+ mask = BIT(offset);
+ regmap_read(info->regmap, reg, &val);
+
+@@ -410,7 +410,7 @@ static int armada_37xx_gpio_direction_output(struct gpio_chip *chip,
+ unsigned int reg = OUTPUT_EN;
+ unsigned int mask, val, ret;
+
+- armada_37xx_update_reg(®, offset);
++ armada_37xx_update_reg(®, &offset);
+ mask = BIT(offset);
+
+ ret = regmap_update_bits(info->regmap, reg, mask, mask);
+@@ -431,7 +431,7 @@ static int armada_37xx_gpio_get(struct gpio_chip *chip, unsigned int offset)
+ unsigned int reg = INPUT_VAL;
+ unsigned int val, mask;
+
+- armada_37xx_update_reg(®, offset);
++ armada_37xx_update_reg(®, &offset);
+ mask = BIT(offset);
+
+ regmap_read(info->regmap, reg, &val);
+@@ -446,7 +446,7 @@ static void armada_37xx_gpio_set(struct gpio_chip *chip, unsigned int offset,
+ unsigned int reg = OUTPUT_VAL;
+ unsigned int mask, val;
+
+- armada_37xx_update_reg(®, offset);
++ armada_37xx_update_reg(®, &offset);
+ mask = BIT(offset);
+ val = value ? mask : 0;
+
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index aff073a5b52b..df888506e363 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -21,6 +21,11 @@
+
+ struct kmem_cache *zfcp_fsf_qtcb_cache;
+
++static bool ber_stop = true;
++module_param(ber_stop, bool, 0600);
++MODULE_PARM_DESC(ber_stop,
++ "Shuts down FCP devices for FCP channels that report a bit-error count in excess of its threshold (default on)");
++
+ static void zfcp_fsf_request_timeout_handler(struct timer_list *t)
+ {
+ struct zfcp_fsf_req *fsf_req = from_timer(fsf_req, t, timer);
+@@ -230,10 +235,15 @@ static void zfcp_fsf_status_read_handler(struct zfcp_fsf_req *req)
+ case FSF_STATUS_READ_SENSE_DATA_AVAIL:
+ break;
+ case FSF_STATUS_READ_BIT_ERROR_THRESHOLD:
+- dev_warn(&adapter->ccw_device->dev,
+- "The error threshold for checksum statistics "
+- "has been exceeded\n");
+ zfcp_dbf_hba_bit_err("fssrh_3", req);
++ if (ber_stop) {
++ dev_warn(&adapter->ccw_device->dev,
++ "All paths over this FCP device are disused because of excessive bit errors\n");
++ zfcp_erp_adapter_shutdown(adapter, 0, "fssrh_b");
++ } else {
++ dev_warn(&adapter->ccw_device->dev,
++ "The error threshold for checksum statistics has been exceeded\n");
++ }
+ break;
+ case FSF_STATUS_READ_LINK_DOWN:
+ zfcp_fsf_status_read_link_down(req);
+diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c
+index 1c5051b1c125..9e287927b7f9 100644
+--- a/drivers/scsi/ch.c
++++ b/drivers/scsi/ch.c
+@@ -578,7 +578,6 @@ ch_release(struct inode *inode, struct file *file)
+ scsi_changer *ch = file->private_data;
+
+ scsi_device_put(ch->device);
+- ch->device = NULL;
+ file->private_data = NULL;
+ kref_put(&ch->ref, ch_destroy);
+ return 0;
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index 8c7154143a4e..a84878fbf45d 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -4189,11 +4189,11 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ */
+ if (pdev->subsystem_vendor == PCI_VENDOR_ID_COMPAQ &&
+ pdev->subsystem_device == 0xC000)
+- return -ENODEV;
++ goto out_disable_device;
+ /* Now check the magic signature byte */
+ pci_read_config_word(pdev, PCI_CONF_AMISIG, &magic);
+ if (magic != HBA_SIGNATURE_471 && magic != HBA_SIGNATURE)
+- return -ENODEV;
++ goto out_disable_device;
+ /* Ok it is probably a megaraid */
+ }
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 7a1cc0b25e59..d6dc320f81a7 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1023,6 +1023,7 @@ void qlt_free_session_done(struct work_struct *work)
+
+ if (logout_started) {
+ bool traced = false;
++ u16 cnt = 0;
+
+ while (!READ_ONCE(sess->logout_completed)) {
+ if (!traced) {
+@@ -1032,6 +1033,9 @@ void qlt_free_session_done(struct work_struct *work)
+ traced = true;
+ }
+ msleep(100);
++ cnt++;
++ if (cnt > 200)
++ break;
+ }
+
+ ql_dbg(ql_dbg_disc, vha, 0xf087,
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index b7a8fdfeb2f4..e731af504f07 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -970,6 +970,7 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
+ ses->sdb = scmd->sdb;
+ ses->next_rq = scmd->request->next_rq;
+ ses->result = scmd->result;
++ ses->resid_len = scmd->req.resid_len;
+ ses->underflow = scmd->underflow;
+ ses->prot_op = scmd->prot_op;
+ ses->eh_eflags = scmd->eh_eflags;
+@@ -981,6 +982,7 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
+ memset(&scmd->sdb, 0, sizeof(scmd->sdb));
+ scmd->request->next_rq = NULL;
+ scmd->result = 0;
++ scmd->req.resid_len = 0;
+
+ if (sense_bytes) {
+ scmd->sdb.length = min_t(unsigned, SCSI_SENSE_BUFFERSIZE,
+@@ -1034,6 +1036,7 @@ void scsi_eh_restore_cmnd(struct scsi_cmnd* scmd, struct scsi_eh_save *ses)
+ scmd->sdb = ses->sdb;
+ scmd->request->next_rq = ses->next_rq;
+ scmd->result = ses->result;
++ scmd->req.resid_len = ses->resid_len;
+ scmd->underflow = ses->underflow;
+ scmd->prot_op = ses->prot_op;
+ scmd->eh_eflags = ses->eh_eflags;
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 3aee9464a7bf..186f779fa60c 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -723,6 +723,14 @@ sdev_store_delete(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
+ struct kernfs_node *kn;
++ struct scsi_device *sdev = to_scsi_device(dev);
++
++ /*
++ * We need to try to get module, avoiding the module been removed
++ * during delete.
++ */
++ if (scsi_device_get(sdev))
++ return -ENODEV;
+
+ kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
+ WARN_ON_ONCE(!kn);
+@@ -737,9 +745,10 @@ sdev_store_delete(struct device *dev, struct device_attribute *attr,
+ * state into SDEV_DEL.
+ */
+ device_remove_file(dev, attr);
+- scsi_remove_device(to_scsi_device(dev));
++ scsi_remove_device(sdev);
+ if (kn)
+ sysfs_unbreak_active_protection(kn);
++ scsi_device_put(sdev);
+ return count;
+ };
+ static DEVICE_ATTR(delete, S_IWUSR, NULL, sdev_store_delete);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 77cb45ef55fc..f8a09e6678d4 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1646,7 +1646,8 @@ static int sd_sync_cache(struct scsi_disk *sdkp, struct scsi_sense_hdr *sshdr)
+ /* we need to evaluate the error return */
+ if (scsi_sense_valid(sshdr) &&
+ (sshdr->asc == 0x3a || /* medium not present */
+- sshdr->asc == 0x20)) /* invalid command */
++ sshdr->asc == 0x20 || /* invalid command */
++ (sshdr->asc == 0x74 && sshdr->ascq == 0x71))) /* drive is password locked */
+ /* this is no error here */
+ return 0;
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index b8b59cfeacd1..4aaba3e03055 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -7874,6 +7874,9 @@ int ufshcd_shutdown(struct ufs_hba *hba)
+ {
+ int ret = 0;
+
++ if (!hba->is_powered)
++ goto out;
++
+ if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba))
+ goto out;
+
+diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
+index d4cf09b11e33..095df245ced5 100644
+--- a/drivers/staging/wlan-ng/cfg80211.c
++++ b/drivers/staging/wlan-ng/cfg80211.c
+@@ -476,10 +476,8 @@ static int prism2_connect(struct wiphy *wiphy, struct net_device *dev,
+ /* Set the encryption - we only support wep */
+ if (is_wep) {
+ if (sme->key) {
+- if (sme->key_idx >= NUM_WEPKEYS) {
+- err = -EINVAL;
+- goto exit;
+- }
++ if (sme->key_idx >= NUM_WEPKEYS)
++ return -EINVAL;
+
+ result = prism2_domibset_uint32(wlandev,
+ DIDmib_dot11smt_dot11PrivacyTable_dot11WEPDefaultKeyID,
+diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
+index 502e9bf1746f..4a80103675d5 100644
+--- a/drivers/usb/class/usblp.c
++++ b/drivers/usb/class/usblp.c
+@@ -445,6 +445,7 @@ static void usblp_cleanup(struct usblp *usblp)
+ kfree(usblp->readbuf);
+ kfree(usblp->device_id_string);
+ kfree(usblp->statusbuf);
++ usb_put_intf(usblp->intf);
+ kfree(usblp);
+ }
+
+@@ -1107,7 +1108,7 @@ static int usblp_probe(struct usb_interface *intf,
+ init_waitqueue_head(&usblp->wwait);
+ init_usb_anchor(&usblp->urbs);
+ usblp->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
+- usblp->intf = intf;
++ usblp->intf = usb_get_intf(intf);
+
+ /* Malloc device ID string buffer to the largest expected length,
+ * since we can re-query it on an ioctl and a dynamic string
+@@ -1196,6 +1197,7 @@ abort:
+ kfree(usblp->readbuf);
+ kfree(usblp->statusbuf);
+ kfree(usblp->device_id_string);
++ usb_put_intf(usblp->intf);
+ kfree(usblp);
+ abort_ret:
+ return retval;
+diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
+index eafc2a00c96a..21921db068f6 100644
+--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
+@@ -1165,11 +1165,11 @@ static void udc_pop_fifo(struct lpc32xx_udc *udc, u8 *data, u32 bytes)
+ tmp = readl(USBD_RXDATA(udc->udp_baseaddr));
+
+ bl = bytes - n;
+- if (bl > 3)
+- bl = 3;
++ if (bl > 4)
++ bl = 4;
+
+ for (i = 0; i < bl; i++)
+- data[n + i] = (u8) ((tmp >> (n * 8)) & 0xFF);
++ data[n + i] = (u8) ((tmp >> (i * 8)) & 0xFF);
+ }
+ break;
+
+diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
+index b9cbcf35d4e1..6b3a6fd7d271 100644
+--- a/drivers/usb/misc/ldusb.c
++++ b/drivers/usb/misc/ldusb.c
+@@ -380,10 +380,7 @@ static int ld_usb_release(struct inode *inode, struct file *file)
+ goto exit;
+ }
+
+- if (mutex_lock_interruptible(&dev->mutex)) {
+- retval = -ERESTARTSYS;
+- goto exit;
+- }
++ mutex_lock(&dev->mutex);
+
+ if (dev->open_count != 1) {
+ retval = -ENODEV;
+@@ -467,7 +464,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
+
+ /* wait for data */
+ spin_lock_irq(&dev->rbsl);
+- if (dev->ring_head == dev->ring_tail) {
++ while (dev->ring_head == dev->ring_tail) {
+ dev->interrupt_in_done = 0;
+ spin_unlock_irq(&dev->rbsl);
+ if (file->f_flags & O_NONBLOCK) {
+@@ -477,12 +474,17 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
+ retval = wait_event_interruptible(dev->read_wait, dev->interrupt_in_done);
+ if (retval < 0)
+ goto unlock_exit;
+- } else {
+- spin_unlock_irq(&dev->rbsl);
++
++ spin_lock_irq(&dev->rbsl);
+ }
++ spin_unlock_irq(&dev->rbsl);
+
+ /* actual_buffer contains actual_length + interrupt_in_buffer */
+ actual_buffer = (size_t *)(dev->ring_buffer + dev->ring_tail * (sizeof(size_t)+dev->interrupt_in_endpoint_size));
++ if (*actual_buffer > dev->interrupt_in_endpoint_size) {
++ retval = -EIO;
++ goto unlock_exit;
++ }
+ bytes_to_read = min(count, *actual_buffer);
+ if (bytes_to_read < *actual_buffer)
+ dev_warn(&dev->intf->dev, "Read buffer overflow, %zd bytes dropped\n",
+@@ -693,10 +695,9 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
+ dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n");
+
+ dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
+- dev->ring_buffer =
+- kmalloc_array(ring_buffer_size,
+- sizeof(size_t) + dev->interrupt_in_endpoint_size,
+- GFP_KERNEL);
++ dev->ring_buffer = kcalloc(ring_buffer_size,
++ sizeof(size_t) + dev->interrupt_in_endpoint_size,
++ GFP_KERNEL);
+ if (!dev->ring_buffer)
+ goto error;
+ dev->interrupt_in_buffer = kmalloc(dev->interrupt_in_endpoint_size, GFP_KERNEL);
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index 9d4c52a7ebe0..62dab2441ec4 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -419,10 +419,7 @@ static int tower_release (struct inode *inode, struct file *file)
+ goto exit;
+ }
+
+- if (mutex_lock_interruptible(&dev->lock)) {
+- retval = -ERESTARTSYS;
+- goto exit;
+- }
++ mutex_lock(&dev->lock);
+
+ if (dev->open_count != 1) {
+ dev_dbg(&dev->udev->dev, "%s: device not opened exactly once\n",
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index e3c5832337e0..c9201e0a8241 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -776,7 +776,6 @@ static void ti_close(struct usb_serial_port *port)
+ struct ti_port *tport;
+ int port_number;
+ int status;
+- int do_unlock;
+ unsigned long flags;
+
+ tdev = usb_get_serial_data(port->serial);
+@@ -800,16 +799,13 @@ static void ti_close(struct usb_serial_port *port)
+ "%s - cannot send close port command, %d\n"
+ , __func__, status);
+
+- /* if mutex_lock is interrupted, continue anyway */
+- do_unlock = !mutex_lock_interruptible(&tdev->td_open_close_lock);
++ mutex_lock(&tdev->td_open_close_lock);
+ --tport->tp_tdev->td_open_port_count;
+- if (tport->tp_tdev->td_open_port_count <= 0) {
++ if (tport->tp_tdev->td_open_port_count == 0) {
+ /* last port is closed, shut down interrupt urb */
+ usb_kill_urb(port->serial->port[0]->interrupt_in_urb);
+- tport->tp_tdev->td_open_port_count = 0;
+ }
+- if (do_unlock)
+- mutex_unlock(&tdev->td_open_close_lock);
++ mutex_unlock(&tdev->td_open_close_lock);
+ }
+
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index e49e29288049..72c745682996 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10000,6 +10000,7 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info)
+ btrfs_err(info,
+ "bg %llu is a mixed block group but filesystem hasn't enabled mixed block groups",
+ cache->key.objectid);
++ btrfs_put_block_group(cache);
+ ret = -EINVAL;
+ goto error;
+ }
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index c84186563c31..4870440d6424 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -2056,25 +2056,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ struct btrfs_trans_handle *trans;
+ struct btrfs_log_ctx ctx;
+ int ret = 0, err;
+- u64 len;
+
+- /*
+- * If the inode needs a full sync, make sure we use a full range to
+- * avoid log tree corruption, due to hole detection racing with ordered
+- * extent completion for adjacent ranges, and assertion failures during
+- * hole detection.
+- */
+- if (test_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
+- &BTRFS_I(inode)->runtime_flags)) {
+- start = 0;
+- end = LLONG_MAX;
+- }
+-
+- /*
+- * The range length can be represented by u64, we have to do the typecasts
+- * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync()
+- */
+- len = (u64)end - (u64)start + 1;
+ trace_btrfs_sync_file(file, datasync);
+
+ btrfs_init_log_ctx(&ctx, inode);
+@@ -2100,6 +2082,19 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+
+ atomic_inc(&root->log_batch);
+
++ /*
++ * If the inode needs a full sync, make sure we use a full range to
++ * avoid log tree corruption, due to hole detection racing with ordered
++ * extent completion for adjacent ranges, and assertion failures during
++ * hole detection. Do this while holding the inode lock, to avoid races
++ * with other tasks.
++ */
++ if (test_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
++ &BTRFS_I(inode)->runtime_flags)) {
++ start = 0;
++ end = LLONG_MAX;
++ }
++
+ /*
+ * Before we acquired the inode's lock, someone may have dirtied more
+ * pages in the target range. We need to make sure that writeback for
+@@ -2127,8 +2122,11 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ /*
+ * We have to do this here to avoid the priority inversion of waiting on
+ * IO of a lower priority task while holding a transaciton open.
++ *
++ * Also, the range length can be represented by u64, we have to do the
++ * typecasts to avoid signed overflow if it's [0, LLONG_MAX].
+ */
+- ret = btrfs_wait_ordered_range(inode, start, len);
++ ret = btrfs_wait_ordered_range(inode, start, (u64)end - (u64)start + 1);
+ if (ret) {
+ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 5d57ed629345..bccd9dede2af 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -3187,6 +3187,8 @@ static int relocate_file_extent_cluster(struct inode *inode,
+ if (!page) {
+ btrfs_delalloc_release_metadata(BTRFS_I(inode),
+ PAGE_SIZE, true);
++ btrfs_delalloc_release_extents(BTRFS_I(inode),
++ PAGE_SIZE, true);
+ ret = -ENOMEM;
+ goto out;
+ }
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 617f86beb08b..b4e33ef2ff31 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -403,10 +403,11 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ bool oplock_break_cancelled;
+
+ spin_lock(&tcon->open_file_lock);
+-
++ spin_lock(&cifsi->open_file_lock);
+ spin_lock(&cifs_file->file_info_lock);
+ if (--cifs_file->count > 0) {
+ spin_unlock(&cifs_file->file_info_lock);
++ spin_unlock(&cifsi->open_file_lock);
+ spin_unlock(&tcon->open_file_lock);
+ return;
+ }
+@@ -419,9 +420,7 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ cifs_add_pending_open_locked(&fid, cifs_file->tlink, &open);
+
+ /* remove it from the lists */
+- spin_lock(&cifsi->open_file_lock);
+ list_del(&cifs_file->flist);
+- spin_unlock(&cifsi->open_file_lock);
+ list_del(&cifs_file->tlist);
+
+ if (list_empty(&cifsi->openFileList)) {
+@@ -437,6 +436,7 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ cifs_set_oplock_level(cifsi, 0);
+ }
+
++ spin_unlock(&cifsi->open_file_lock);
+ spin_unlock(&tcon->open_file_lock);
+
+ oplock_break_cancelled = wait_oplock_handler ?
+diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
+index 47db8eb6cbcf..c7f0c8566442 100644
+--- a/fs/cifs/smb1ops.c
++++ b/fs/cifs/smb1ops.c
+@@ -183,6 +183,9 @@ cifs_get_next_mid(struct TCP_Server_Info *server)
+ /* we do not want to loop forever */
+ last_mid = cur_mid;
+ cur_mid++;
++ /* avoid 0xFFFF MID */
++ if (cur_mid == 0xffff)
++ cur_mid++;
+
+ /*
+ * This nested loop looks more expensive than it is.
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index bd3475694e83..c492cbb2410f 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -231,7 +231,8 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb)
+ /* At this point, we know that no more recovery threads can be
+ * launched, so wait for any recovery completion work to
+ * complete. */
+- flush_workqueue(osb->ocfs2_wq);
++ if (osb->ocfs2_wq)
++ flush_workqueue(osb->ocfs2_wq);
+
+ /*
+ * Now that recovery is shut down, and the osb is about to be
+diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
+index 30208233f65b..a46aff7135d3 100644
+--- a/fs/ocfs2/localalloc.c
++++ b/fs/ocfs2/localalloc.c
+@@ -391,7 +391,8 @@ void ocfs2_shutdown_local_alloc(struct ocfs2_super *osb)
+ struct ocfs2_dinode *alloc = NULL;
+
+ cancel_delayed_work(&osb->la_enable_wq);
+- flush_workqueue(osb->ocfs2_wq);
++ if (osb->ocfs2_wq)
++ flush_workqueue(osb->ocfs2_wq);
+
+ if (osb->local_alloc_state == OCFS2_LA_UNUSED)
+ goto out;
+diff --git a/fs/proc/page.c b/fs/proc/page.c
+index 792c78a49174..64293df0faa3 100644
+--- a/fs/proc/page.c
++++ b/fs/proc/page.c
+@@ -42,10 +42,12 @@ static ssize_t kpagecount_read(struct file *file, char __user *buf,
+ return -EINVAL;
+
+ while (count > 0) {
+- if (pfn_valid(pfn))
+- ppage = pfn_to_page(pfn);
+- else
+- ppage = NULL;
++ /*
++ * TODO: ZONE_DEVICE support requires to identify
++ * memmaps that were actually initialized.
++ */
++ ppage = pfn_to_online_page(pfn);
++
+ if (!ppage || PageSlab(ppage))
+ pcount = 0;
+ else
+@@ -216,10 +218,11 @@ static ssize_t kpageflags_read(struct file *file, char __user *buf,
+ return -EINVAL;
+
+ while (count > 0) {
+- if (pfn_valid(pfn))
+- ppage = pfn_to_page(pfn);
+- else
+- ppage = NULL;
++ /*
++ * TODO: ZONE_DEVICE support requires to identify
++ * memmaps that were actually initialized.
++ */
++ ppage = pfn_to_online_page(pfn);
+
+ if (put_user(stable_page_flags(ppage), out)) {
+ ret = -EFAULT;
+@@ -261,10 +264,11 @@ static ssize_t kpagecgroup_read(struct file *file, char __user *buf,
+ return -EINVAL;
+
+ while (count > 0) {
+- if (pfn_valid(pfn))
+- ppage = pfn_to_page(pfn);
+- else
+- ppage = NULL;
++ /*
++ * TODO: ZONE_DEVICE support requires to identify
++ * memmaps that were actually initialized.
++ */
++ ppage = pfn_to_online_page(pfn);
+
+ if (ppage)
+ ino = page_cgroup_ino(ppage);
+diff --git a/include/scsi/scsi_eh.h b/include/scsi/scsi_eh.h
+index 2b7e227960e1..91f403341dd7 100644
+--- a/include/scsi/scsi_eh.h
++++ b/include/scsi/scsi_eh.h
+@@ -32,6 +32,7 @@ extern int scsi_ioctl_reset(struct scsi_device *, int __user *);
+ struct scsi_eh_save {
+ /* saved state */
+ int result;
++ unsigned int resid_len;
+ int eh_eflags;
+ enum dma_data_direction data_direction;
+ unsigned underflow;
+diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
+index b401c4e36394..eb3f668b8bce 100644
+--- a/include/trace/events/btrfs.h
++++ b/include/trace/events/btrfs.h
+@@ -1655,6 +1655,7 @@ TRACE_EVENT(qgroup_update_reserve,
+ __entry->qgid = qgroup->qgroupid;
+ __entry->cur_reserved = qgroup->rsv.values[type];
+ __entry->diff = diff;
++ __entry->type = type;
+ ),
+
+ TP_printk_btrfs("qgid=%llu type=%s cur_reserved=%llu diff=%lld",
+@@ -1677,6 +1678,7 @@ TRACE_EVENT(qgroup_meta_reserve,
+ TP_fast_assign_btrfs(root->fs_info,
+ __entry->refroot = root->objectid;
+ __entry->diff = diff;
++ __entry->type = type;
+ ),
+
+ TP_printk_btrfs("refroot=%llu(%s) type=%s diff=%lld",
+@@ -1693,7 +1695,6 @@ TRACE_EVENT(qgroup_meta_convert,
+ TP_STRUCT__entry_btrfs(
+ __field( u64, refroot )
+ __field( s64, diff )
+- __field( int, type )
+ ),
+
+ TP_fast_assign_btrfs(root->fs_info,
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 7ca44b8523c8..625ba462e5bb 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -6813,7 +6813,7 @@ static void __perf_event_output_stop(struct perf_event *event, void *data)
+ static int __perf_pmu_output_stop(void *info)
+ {
+ struct perf_event *event = info;
+- struct pmu *pmu = event->pmu;
++ struct pmu *pmu = event->ctx->pmu;
+ struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
+ struct remote_output ro = {
+ .rb = event->rb,
+diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
+index e6945b55c688..f5b3bf0e69f6 100644
+--- a/kernel/trace/trace_event_perf.c
++++ b/kernel/trace/trace_event_perf.c
+@@ -272,9 +272,11 @@ int perf_kprobe_init(struct perf_event *p_event, bool is_retprobe)
+ goto out;
+ }
+
++ mutex_lock(&event_mutex);
+ ret = perf_trace_event_init(tp_event, p_event);
+ if (ret)
+ destroy_local_trace_kprobe(tp_event);
++ mutex_unlock(&event_mutex);
+ out:
+ kfree(func);
+ return ret;
+@@ -282,8 +284,10 @@ out:
+
+ void perf_kprobe_destroy(struct perf_event *p_event)
+ {
++ mutex_lock(&event_mutex);
+ perf_trace_event_close(p_event);
+ perf_trace_event_unreg(p_event);
++ mutex_unlock(&event_mutex);
+
+ destroy_local_trace_kprobe(p_event->tp_event);
+ }
+diff --git a/lib/textsearch.c b/lib/textsearch.c
+index 5939549c0e7b..9135c29add62 100644
+--- a/lib/textsearch.c
++++ b/lib/textsearch.c
+@@ -93,9 +93,9 @@
+ * goto errout;
+ * }
+ *
+- * pos = textsearch_find_continuous(conf, \&state, example, strlen(example));
++ * pos = textsearch_find_continuous(conf, &state, example, strlen(example));
+ * if (pos != UINT_MAX)
+- * panic("Oh my god, dancing chickens at \%d\n", pos);
++ * panic("Oh my god, dancing chickens at %d\n", pos);
+ *
+ * textsearch_destroy(conf);
+ */
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 57053affaad2..6f4ce9547658 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1073,11 +1073,10 @@ static bool pfn_range_valid_gigantic(struct zone *z,
+ struct page *page;
+
+ for (i = start_pfn; i < end_pfn; i++) {
+- if (!pfn_valid(i))
++ page = pfn_to_online_page(i);
++ if (!page)
+ return false;
+
+- page = pfn_to_page(i);
+-
+ if (page_zone(page) != z)
+ return false;
+
+diff --git a/mm/memfd.c b/mm/memfd.c
+index 2bb5e257080e..5859705dafe1 100644
+--- a/mm/memfd.c
++++ b/mm/memfd.c
+@@ -34,11 +34,12 @@ static void memfd_tag_pins(struct address_space *mapping)
+ void __rcu **slot;
+ pgoff_t start;
+ struct page *page;
++ unsigned int tagged = 0;
+
+ lru_add_drain();
+ start = 0;
+- rcu_read_lock();
+
++ xa_lock_irq(&mapping->i_pages);
+ radix_tree_for_each_slot(slot, &mapping->i_pages, &iter, start) {
+ page = radix_tree_deref_slot(slot);
+ if (!page || radix_tree_exception(page)) {
+@@ -47,18 +48,19 @@ static void memfd_tag_pins(struct address_space *mapping)
+ continue;
+ }
+ } else if (page_count(page) - page_mapcount(page) > 1) {
+- xa_lock_irq(&mapping->i_pages);
+ radix_tree_tag_set(&mapping->i_pages, iter.index,
+ MEMFD_TAG_PINNED);
+- xa_unlock_irq(&mapping->i_pages);
+ }
+
+- if (need_resched()) {
+- slot = radix_tree_iter_resume(slot, &iter);
+- cond_resched_rcu();
+- }
++ if (++tagged % 1024)
++ continue;
++
++ slot = radix_tree_iter_resume(slot, &iter);
++ xa_unlock_irq(&mapping->i_pages);
++ cond_resched();
++ xa_lock_irq(&mapping->i_pages);
+ }
+- rcu_read_unlock();
++ xa_unlock_irq(&mapping->i_pages);
+ }
+
+ /*
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 2994ceb2e7b0..148fdd929a19 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -202,7 +202,6 @@ struct to_kill {
+ struct task_struct *tsk;
+ unsigned long addr;
+ short size_shift;
+- char addr_valid;
+ };
+
+ /*
+@@ -327,22 +326,27 @@ static void add_to_kill(struct task_struct *tsk, struct page *p,
+ }
+ }
+ tk->addr = page_address_in_vma(p, vma);
+- tk->addr_valid = 1;
+ if (is_zone_device_page(p))
+ tk->size_shift = dev_pagemap_mapping_shift(p, vma);
+ else
+ tk->size_shift = compound_order(compound_head(p)) + PAGE_SHIFT;
+
+ /*
+- * In theory we don't have to kill when the page was
+- * munmaped. But it could be also a mremap. Since that's
+- * likely very rare kill anyways just out of paranoia, but use
+- * a SIGKILL because the error is not contained anymore.
++ * Send SIGKILL if "tk->addr == -EFAULT". Also, as
++ * "tk->size_shift" is always non-zero for !is_zone_device_page(),
++ * so "tk->size_shift == 0" effectively checks no mapping on
++ * ZONE_DEVICE. Indeed, when a devdax page is mmapped N times
++ * to a process' address space, it's possible not all N VMAs
++ * contain mappings for the page, but at least one VMA does.
++ * Only deliver SIGBUS with payload derived from the VMA that
++ * has a mapping for the page.
+ */
+- if (tk->addr == -EFAULT || tk->size_shift == 0) {
++ if (tk->addr == -EFAULT) {
+ pr_info("Memory failure: Unable to find user space address %lx in %s\n",
+ page_to_pfn(p), tsk->comm);
+- tk->addr_valid = 0;
++ } else if (tk->size_shift == 0) {
++ kfree(tk);
++ return;
+ }
+ get_task_struct(tsk);
+ tk->tsk = tsk;
+@@ -369,7 +373,7 @@ static void kill_procs(struct list_head *to_kill, int forcekill, bool fail,
+ * make sure the process doesn't catch the
+ * signal and then access the memory. Just kill it.
+ */
+- if (fail || tk->addr_valid == 0) {
++ if (fail || tk->addr == -EFAULT) {
+ pr_err("Memory failure: %#lx: forcibly killing %s:%d because of failure to unmap corrupted page\n",
+ pfn, tk->tsk->comm, tk->tsk->pid);
+ do_send_sig_info(SIGKILL, SEND_SIG_PRIV,
+@@ -1258,17 +1262,19 @@ int memory_failure(unsigned long pfn, int flags)
+ if (!sysctl_memory_failure_recovery)
+ panic("Memory failure on page %lx", pfn);
+
+- if (!pfn_valid(pfn)) {
++ p = pfn_to_online_page(pfn);
++ if (!p) {
++ if (pfn_valid(pfn)) {
++ pgmap = get_dev_pagemap(pfn, NULL);
++ if (pgmap)
++ return memory_failure_dev_pagemap(pfn, flags,
++ pgmap);
++ }
+ pr_err("Memory failure: %#lx: memory outside kernel control\n",
+ pfn);
+ return -ENXIO;
+ }
+
+- pgmap = get_dev_pagemap(pfn, NULL);
+- if (pgmap)
+- return memory_failure_dev_pagemap(pfn, flags, pgmap);
+-
+- p = pfn_to_page(pfn);
+ if (PageHuge(p))
+ return memory_failure_hugetlb(pfn, flags);
+ if (TestSetPageHWPoison(p)) {
+diff --git a/mm/page_owner.c b/mm/page_owner.c
+index d80adfe702d3..63b1053f5b41 100644
+--- a/mm/page_owner.c
++++ b/mm/page_owner.c
+@@ -273,7 +273,8 @@ void pagetypeinfo_showmixedcount_print(struct seq_file *m,
+ * not matter as the mixed block count will still be correct
+ */
+ for (; pfn < end_pfn; ) {
+- if (!pfn_valid(pfn)) {
++ page = pfn_to_online_page(pfn);
++ if (!page) {
+ pfn = ALIGN(pfn + 1, MAX_ORDER_NR_PAGES);
+ continue;
+ }
+@@ -281,13 +282,13 @@ void pagetypeinfo_showmixedcount_print(struct seq_file *m,
+ block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages);
+ block_end_pfn = min(block_end_pfn, end_pfn);
+
+- page = pfn_to_page(pfn);
+ pageblock_mt = get_pageblock_migratetype(page);
+
+ for (; pfn < block_end_pfn; pfn++) {
+ if (!pfn_valid_within(pfn))
+ continue;
+
++ /* The pageblock is online, no need to recheck. */
+ page = pfn_to_page(pfn);
+
+ if (page_zone(page) != zone)
+diff --git a/mm/slub.c b/mm/slub.c
+index 09c0e24a06d8..9c3937c5ce38 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -4797,7 +4797,17 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
+ }
+ }
+
+- get_online_mems();
++ /*
++ * It is impossible to take "mem_hotplug_lock" here with "kernfs_mutex"
++ * already held which will conflict with an existing lock order:
++ *
++ * mem_hotplug_lock->slab_mutex->kernfs_mutex
++ *
++ * We don't really need mem_hotplug_lock (to hold off
++ * slab_mem_going_offline_callback) here because slab's memory hot
++ * unplug code doesn't destroy the kmem_cache->node[] data.
++ */
++
+ #ifdef CONFIG_SLUB_DEBUG
+ if (flags & SO_ALL) {
+ struct kmem_cache_node *n;
+@@ -4838,7 +4848,6 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
+ x += sprintf(buf + x, " N%d=%lu",
+ node, nodes[node]);
+ #endif
+- put_online_mems();
+ kfree(nodes);
+ return x + sprintf(buf + x, "\n");
+ }
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 7065d68086ab..69127f6039b2 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1476,7 +1476,7 @@ static bool rt_cache_route(struct fib_nh *nh, struct rtable *rt)
+ prev = cmpxchg(p, orig, rt);
+ if (prev == orig) {
+ if (orig) {
+- dst_dev_put(&orig->dst);
++ rt_add_uncached_list(orig);
+ dst_release(&orig->dst);
+ }
+ } else {
+@@ -2381,14 +2381,17 @@ struct rtable *ip_route_output_key_hash_rcu(struct net *net, struct flowi4 *fl4,
+ int orig_oif = fl4->flowi4_oif;
+ unsigned int flags = 0;
+ struct rtable *rth;
+- int err = -ENETUNREACH;
++ int err;
+
+ if (fl4->saddr) {
+- rth = ERR_PTR(-EINVAL);
+ if (ipv4_is_multicast(fl4->saddr) ||
+ ipv4_is_lbcast(fl4->saddr) ||
+- ipv4_is_zeronet(fl4->saddr))
++ ipv4_is_zeronet(fl4->saddr)) {
++ rth = ERR_PTR(-EINVAL);
+ goto out;
++ }
++
++ rth = ERR_PTR(-ENETUNREACH);
+
+ /* I removed check for oif == dev_out->oif here.
+ It was wrong for two reasons:
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index 2b6d43022383..acf0749ee5bb 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -80,8 +80,10 @@ static void ip6_sublist_rcv_finish(struct list_head *head)
+ {
+ struct sk_buff *skb, *next;
+
+- list_for_each_entry_safe(skb, next, head, list)
++ list_for_each_entry_safe(skb, next, head, list) {
++ skb_list_del_init(skb);
+ dst_input(skb);
++ }
+ }
+
+ static void ip6_list_rcv_finish(struct net *net, struct sock *sk,
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index d37d4acafebf..316250ae9071 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -490,9 +490,14 @@ static ssize_t ieee80211_if_fmt_aqm(
+ const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
+ {
+ struct ieee80211_local *local = sdata->local;
+- struct txq_info *txqi = to_txq_info(sdata->vif.txq);
++ struct txq_info *txqi;
+ int len;
+
++ if (!sdata->vif.txq)
++ return 0;
++
++ txqi = to_txq_info(sdata->vif.txq);
++
+ spin_lock_bh(&local->fq.lock);
+ rcu_read_lock();
+
+@@ -659,7 +664,9 @@ static void add_common_files(struct ieee80211_sub_if_data *sdata)
+ DEBUGFS_ADD(rc_rateidx_vht_mcs_mask_5ghz);
+ DEBUGFS_ADD(hw_queues);
+
+- if (sdata->local->ops->wake_tx_queue)
++ if (sdata->local->ops->wake_tx_queue &&
++ sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
++ sdata->vif.type != NL80211_IFTYPE_NAN)
+ DEBUGFS_ADD(aqm);
+ }
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index b5c06242a92e..5c9dcafbc342 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2554,7 +2554,8 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
+
+ rcu_read_lock();
+ ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
+- if (WARN_ON_ONCE(ssid == NULL))
++ if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
++ "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
+ ssid_len = 0;
+ else
+ ssid_len = ssid[1];
+@@ -5039,7 +5040,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+
+ rcu_read_lock();
+ ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
+- if (!ssidie) {
++ if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
+ rcu_read_unlock();
+ kfree(assoc_data);
+ return -EINVAL;
+diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
+index af1497ab9464..69d6173f91e2 100644
+--- a/net/netfilter/nft_connlimit.c
++++ b/net/netfilter/nft_connlimit.c
+@@ -218,8 +218,13 @@ static void nft_connlimit_destroy_clone(const struct nft_ctx *ctx,
+ static bool nft_connlimit_gc(struct net *net, const struct nft_expr *expr)
+ {
+ struct nft_connlimit *priv = nft_expr_priv(expr);
++ bool ret;
+
+- return nf_conncount_gc_list(net, &priv->list);
++ local_bh_disable();
++ ret = nf_conncount_gc_list(net, &priv->list);
++ local_bh_enable();
++
++ return ret;
+ }
+
+ static struct nft_expr_type nft_connlimit_type;
+diff --git a/net/sched/act_api.c b/net/sched/act_api.c
+index 7c4a4b874248..f2c4bfc79663 100644
+--- a/net/sched/act_api.c
++++ b/net/sched/act_api.c
+@@ -1307,11 +1307,16 @@ static int tcf_action_add(struct net *net, struct nlattr *nla,
+ struct netlink_ext_ack *extack)
+ {
+ size_t attr_size = 0;
+- int ret = 0;
++ int loop, ret;
+ struct tc_action *actions[TCA_ACT_MAX_PRIO] = {};
+
+- ret = tcf_action_init(net, NULL, nla, NULL, NULL, ovr, 0, actions,
+- &attr_size, true, extack);
++ for (loop = 0; loop < 10; loop++) {
++ ret = tcf_action_init(net, NULL, nla, NULL, NULL, ovr, 0,
++ actions, &attr_size, true, extack);
++ if (ret != -EAGAIN)
++ break;
++ }
++
+ if (ret < 0)
+ return ret;
+ ret = tcf_add_notify(net, n, actions, portid, attr_size, extack);
+@@ -1361,11 +1366,8 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n,
+ */
+ if (n->nlmsg_flags & NLM_F_REPLACE)
+ ovr = 1;
+-replay:
+ ret = tcf_action_add(net, tca[TCA_ACT_TAB], n, portid, ovr,
+ extack);
+- if (ret == -EAGAIN)
+- goto replay;
+ break;
+ case RTM_DELACTION:
+ ret = tca_action_gd(net, tca[TCA_ACT_TAB], n,
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 9f5b4e547b63..227b050cfe45 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -8957,7 +8957,7 @@ struct proto sctp_prot = {
+ .backlog_rcv = sctp_backlog_rcv,
+ .hash = sctp_hash,
+ .unhash = sctp_unhash,
+- .get_port = sctp_get_port,
++ .no_autobind = true,
+ .obj_size = sizeof(struct sctp_sock),
+ .useroffset = offsetof(struct sctp_sock, subscribe),
+ .usersize = offsetof(struct sctp_sock, initmsg) -
+@@ -8999,7 +8999,7 @@ struct proto sctpv6_prot = {
+ .backlog_rcv = sctp_backlog_rcv,
+ .hash = sctp_hash,
+ .unhash = sctp_unhash,
+- .get_port = sctp_get_port,
++ .no_autobind = true,
+ .obj_size = sizeof(struct sctp6_sock),
+ .useroffset = offsetof(struct sctp6_sock, sctp.subscribe),
+ .usersize = offsetof(struct sctp6_sock, sctp.initmsg) -
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 334e3181f1c5..a28d6456e93e 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -5843,6 +5843,9 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
+ if (!rdev->ops->del_mpath)
+ return -EOPNOTSUPP;
+
++ if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
++ return -EOPNOTSUPP;
++
+ return rdev_del_mpath(rdev, dev, dst);
+ }
+
+diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
+index c67d7a82ab13..73fd0eae08ca 100644
+--- a/net/wireless/wext-sme.c
++++ b/net/wireless/wext-sme.c
+@@ -202,6 +202,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
+ struct iw_point *data, char *ssid)
+ {
+ struct wireless_dev *wdev = dev->ieee80211_ptr;
++ int ret = 0;
+
+ /* call only for station! */
+ if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+@@ -219,7 +220,10 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
+ if (ie) {
+ data->flags = 1;
+ data->length = ie[1];
+- memcpy(ssid, ie + 2, data->length);
++ if (data->length > IW_ESSID_MAX_SIZE)
++ ret = -EINVAL;
++ else
++ memcpy(ssid, ie + 2, data->length);
+ }
+ rcu_read_unlock();
+ } else if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
+@@ -229,7 +233,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
+ }
+ wdev_unlock(wdev);
+
+- return 0;
++ return ret;
+ }
+
+ int cfg80211_mgd_wext_siwap(struct net_device *dev,
+diff --git a/scripts/namespace.pl b/scripts/namespace.pl
+index 6135574a6f39..1da7bca201a4 100755
+--- a/scripts/namespace.pl
++++ b/scripts/namespace.pl
+@@ -65,13 +65,14 @@
+ use warnings;
+ use strict;
+ use File::Find;
++use File::Spec;
+
+ my $nm = ($ENV{'NM'} || "nm") . " -p";
+ my $objdump = ($ENV{'OBJDUMP'} || "objdump") . " -s -j .comment";
+-my $srctree = "";
+-my $objtree = "";
+-$srctree = "$ENV{'srctree'}/" if (exists($ENV{'srctree'}));
+-$objtree = "$ENV{'objtree'}/" if (exists($ENV{'objtree'}));
++my $srctree = File::Spec->curdir();
++my $objtree = File::Spec->curdir();
++$srctree = File::Spec->rel2abs($ENV{'srctree'}) if (exists($ENV{'srctree'}));
++$objtree = File::Spec->rel2abs($ENV{'objtree'}) if (exists($ENV{'objtree'}));
+
+ if ($#ARGV != -1) {
+ print STDERR "usage: $0 takes no parameters\n";
+@@ -231,9 +232,9 @@ sub do_nm
+ }
+ ($source = $basename) =~ s/\.o$//;
+ if (-e "$source.c" || -e "$source.S") {
+- $source = "$objtree$File::Find::dir/$source";
++ $source = File::Spec->catfile($objtree, $File::Find::dir, $source)
+ } else {
+- $source = "$srctree$File::Find::dir/$source";
++ $source = File::Spec->catfile($srctree, $File::Find::dir, $source)
+ }
+ if (! -e "$source.c" && ! -e "$source.S") {
+ # No obvious source, exclude the object if it is conglomerate
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 107ec7f3e221..c827a2a89cc3 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3264,6 +3264,8 @@ static int patch_nvhdmi(struct hda_codec *codec)
+ nvhdmi_chmap_cea_alloc_validate_get_type;
+ spec->chmap.ops.chmap_validate = nvhdmi_chmap_validate;
+
++ codec->link_down_at_suspend = 1;
++
+ return 0;
+ }
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index e1b08d6f2a51..dd46354270d0 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -405,6 +405,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0700:
+ case 0x10ec0701:
+ case 0x10ec0703:
++ case 0x10ec0711:
+ alc_update_coef_idx(codec, 0x10, 1<<15, 0);
+ break;
+ case 0x10ec0662:
+@@ -5676,6 +5677,7 @@ enum {
+ ALC225_FIXUP_WYSE_AUTO_MUTE,
+ ALC225_FIXUP_WYSE_DISABLE_MIC_VREF,
+ ALC286_FIXUP_ACER_AIO_HEADSET_MIC,
++ ALC256_FIXUP_ASUS_HEADSET_MIC,
+ ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+ ALC299_FIXUP_PREDATOR_SPK,
+ ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC,
+@@ -6692,6 +6694,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE
+ },
++ [ALC256_FIXUP_ASUS_HEADSET_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x03a11020 }, /* headset mic with jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
++ },
+ [ALC256_FIXUP_ASUS_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -6888,6 +6899,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
+@@ -7752,6 +7764,7 @@ static int patch_alc269(struct hda_codec *codec)
+ case 0x10ec0700:
+ case 0x10ec0701:
+ case 0x10ec0703:
++ case 0x10ec0711:
+ spec->codec_variant = ALC269_TYPE_ALC700;
+ spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
+ alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
+@@ -8883,6 +8896,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ HDA_CODEC_ENTRY(0x10ec0700, "ALC700", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0701, "ALC701", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0703, "ALC703", patch_alc269),
++ HDA_CODEC_ENTRY(0x10ec0711, "ALC711", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0867, "ALC891", patch_alc662),
+ HDA_CODEC_ENTRY(0x10ec0880, "ALC880", patch_alc880),
+ HDA_CODEC_ENTRY(0x10ec0882, "ALC882", patch_alc882),
+diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
+index d23c2bbff0cf..15a31820df16 100644
+--- a/sound/soc/sh/rcar/core.c
++++ b/sound/soc/sh/rcar/core.c
+@@ -674,6 +674,7 @@ static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ }
+
+ /* set format */
++ rdai->bit_clk_inv = 0;
+ switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+ case SND_SOC_DAIFMT_I2S:
+ rdai->sys_delay = 0;
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 13ea63c959d3..1828225ba882 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -355,6 +355,9 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ ep = 0x81;
+ ifnum = 1;
+ goto add_sync_ep_from_ifnum;
++ case USB_ID(0x0582, 0x01d8): /* BOSS Katana */
++ /* BOSS Katana amplifiers do not need quirks */
++ return 0;
+ }
+
+ if (attr == USB_ENDPOINT_SYNC_ASYNC &&
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-11-06 14:26 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-11-06 14:26 UTC (permalink / raw
To: gentoo-commits
commit: 46f0bbc3e59063dce5368e70959b4c30c29533e6
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 6 14:26:23 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Nov 6 14:26:23 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=46f0bbc3
Linux patch 4.19.82
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1081_linux-4.19.82.patch | 5814 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5818 insertions(+)
diff --git a/0000_README b/0000_README
index 3811a86..3a289a8 100644
--- a/0000_README
+++ b/0000_README
@@ -363,6 +363,10 @@ Patch: 1080_linux-4.19.81.patch
From: https://www.kernel.org
Desc: Linux 4.19.81
+Patch: 1081_linux-4.19.82.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.82
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1081_linux-4.19.82.patch b/1081_linux-4.19.82.patch
new file mode 100644
index 0000000..a9bb6a1
--- /dev/null
+++ b/1081_linux-4.19.82.patch
@@ -0,0 +1,5814 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 16607b178b47..a855f83defa6 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -5117,6 +5117,10 @@
+ the unplug protocol
+ never -- do not unplug even if version check succeeds
+
++ xen_legacy_crash [X86,XEN]
++ Crash from Xen panic notifier, without executing late
++ panic() code such as dumping handler.
++
+ xen_nopvspin [X86,XEN]
+ Disables the ticketlock slowpath using Xen PV
+ optimizations.
+diff --git a/Makefile b/Makefile
+index 3c146e8d93dc..6af1c13d8753 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 81
++SUBLEVEL = 82
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S
+index 997b02302c31..9328f2010bc1 100644
+--- a/arch/arm/kernel/head-common.S
++++ b/arch/arm/kernel/head-common.S
+@@ -72,7 +72,7 @@ ENDPROC(__vet_atags)
+ * The following fragment of code is executed with the MMU on in MMU mode,
+ * and uses absolute addresses; this is not position independent.
+ *
+- * r0 = cp#15 control register
++ * r0 = cp#15 control register (exc_ret for M-class)
+ * r1 = machine ID
+ * r2 = atags/dtb pointer
+ * r9 = processor ID
+@@ -141,7 +141,8 @@ __mmap_switched_data:
+ #ifdef CONFIG_CPU_CP15
+ .long cr_alignment @ r3
+ #else
+- .long 0 @ r3
++M_CLASS(.long exc_ret) @ r3
++AR_CLASS(.long 0) @ r3
+ #endif
+ .size __mmap_switched_data, . - __mmap_switched_data
+
+diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
+index cab89479d15e..326a97aa3ea0 100644
+--- a/arch/arm/kernel/head-nommu.S
++++ b/arch/arm/kernel/head-nommu.S
+@@ -205,6 +205,8 @@ M_CLASS(streq r3, [r12, #PMSAv8_MAIR1])
+ bic r0, r0, #V7M_SCB_CCR_IC
+ #endif
+ str r0, [r12, V7M_SCB_CCR]
++ /* Pass exc_ret to __mmap_switched */
++ mov r0, r10
+ #endif /* CONFIG_CPU_CP15 elif CONFIG_CPU_V7M */
+ ret lr
+ ENDPROC(__after_proc_init)
+diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S
+index 92e84181933a..59d82864c134 100644
+--- a/arch/arm/mm/proc-v7m.S
++++ b/arch/arm/mm/proc-v7m.S
+@@ -139,9 +139,8 @@ __v7m_setup_cont:
+ cpsie i
+ svc #0
+ 1: cpsid i
+- ldr r0, =exc_ret
+- orr lr, lr, #EXC_RET_THREADMODE_PROCESSSTACK
+- str lr, [r0]
++ /* Calculate exc_ret */
++ orr r10, lr, #EXC_RET_THREADMODE_PROCESSSTACK
+ ldmia sp, {r0-r3, r12}
+ str r5, [r12, #11 * 4] @ restore the original SVC vector entry
+ mov lr, r6 @ restore LR
+diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
+index 9b7d5abd04af..fa770c070fdd 100644
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -68,6 +68,7 @@
+ #define ARM_CPU_IMP_BRCM 0x42
+ #define ARM_CPU_IMP_QCOM 0x51
+ #define ARM_CPU_IMP_NVIDIA 0x4E
++#define ARM_CPU_IMP_HISI 0x48
+
+ #define ARM_CPU_PART_AEM_V8 0xD0F
+ #define ARM_CPU_PART_FOUNDATION 0xD00
+@@ -96,6 +97,8 @@
+ #define NVIDIA_CPU_PART_DENVER 0x003
+ #define NVIDIA_CPU_PART_CARMEL 0x004
+
++#define HISI_CPU_PART_TSV110 0xD01
++
+ #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53)
+ #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57)
+ #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72)
+@@ -114,6 +117,7 @@
+ #define MIDR_QCOM_KRYO MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO)
+ #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER)
+ #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL)
++#define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110)
+
+ #ifndef __ASSEMBLY__
+
+diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h
+index 78b942c1bea4..e060c2746f36 100644
+--- a/arch/arm64/include/asm/pgtable-prot.h
++++ b/arch/arm64/include/asm/pgtable-prot.h
+@@ -43,11 +43,11 @@
+ #define PROT_DEFAULT (_PROT_DEFAULT | PTE_MAYBE_NG)
+ #define PROT_SECT_DEFAULT (_PROT_SECT_DEFAULT | PMD_MAYBE_NG)
+
+-#define PROT_DEVICE_nGnRnE (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRnE))
+-#define PROT_DEVICE_nGnRE (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRE))
+-#define PROT_NORMAL_NC (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_NC))
+-#define PROT_NORMAL_WT (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_WT))
+-#define PROT_NORMAL (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL))
++#define PROT_DEVICE_nGnRnE (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRnE))
++#define PROT_DEVICE_nGnRE (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRE))
++#define PROT_NORMAL_NC (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_NC))
++#define PROT_NORMAL_WT (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_WT))
++#define PROT_NORMAL (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL))
+
+ #define PROT_SECT_DEVICE_nGnRE (PROT_SECT_DEFAULT | PMD_SECT_PXN | PMD_SECT_UXN | PMD_ATTRINDX(MT_DEVICE_nGnRE))
+ #define PROT_SECT_NORMAL (PROT_SECT_DEFAULT | PMD_SECT_PXN | PMD_SECT_UXN | PMD_ATTRINDX(MT_NORMAL))
+@@ -91,8 +91,9 @@
+ #define PAGE_S2_DEVICE __pgprot(_PROT_DEFAULT | PAGE_S2_MEMATTR(DEVICE_nGnRE) | PTE_S2_RDONLY | PAGE_S2_XN)
+
+ #define PAGE_NONE __pgprot(((_PAGE_DEFAULT) & ~PTE_VALID) | PTE_PROT_NONE | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN)
+-#define PAGE_SHARED __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_UXN | PTE_WRITE)
+-#define PAGE_SHARED_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_WRITE)
++/* shared+writable pages are clean by default, hence PTE_RDONLY|PTE_WRITE */
++#define PAGE_SHARED __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN | PTE_WRITE)
++#define PAGE_SHARED_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_WRITE)
+ #define PAGE_READONLY __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN)
+ #define PAGE_READONLY_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN)
+ #define PAGE_EXECONLY __pgprot(_PAGE_DEFAULT | PTE_RDONLY | PTE_NG | PTE_PXN)
+diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
+index 92be1d12d590..39dc98dd78eb 100644
+--- a/arch/arm64/kernel/armv8_deprecated.c
++++ b/arch/arm64/kernel/armv8_deprecated.c
+@@ -177,6 +177,9 @@ static void __init register_insn_emulation(struct insn_emulation_ops *ops)
+ struct insn_emulation *insn;
+
+ insn = kzalloc(sizeof(*insn), GFP_KERNEL);
++ if (!insn)
++ return;
++
+ insn->ops = ops;
+ insn->min = INSN_UNDEF;
+
+@@ -236,6 +239,8 @@ static void __init register_insn_emulation_sysctl(void)
+
+ insns_sysctl = kcalloc(nr_insn_emulated + 1, sizeof(*sysctl),
+ GFP_KERNEL);
++ if (!insns_sysctl)
++ return;
+
+ raw_spin_lock_irqsave(&insn_emulation_lock, flags);
+ list_for_each_entry(insn, &insn_emulation, node) {
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index ff5beb59b3dc..220ebfa0ece6 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -906,6 +906,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A57),
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A72),
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
+ { /* sentinel */ }
+ };
+ char const *str = "kpti command line option";
+diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
+index 7eff8afa035f..b6618391be8c 100644
+--- a/arch/arm64/kernel/ftrace.c
++++ b/arch/arm64/kernel/ftrace.c
+@@ -119,10 +119,16 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+
+ /*
+ * Ensure updated trampoline is visible to instruction
+- * fetch before we patch in the branch.
++ * fetch before we patch in the branch. Although the
++ * architecture doesn't require an IPI in this case,
++ * Neoverse-N1 erratum #1542419 does require one
++ * if the TLB maintenance in module_enable_ro() is
++ * skipped due to rodata_enabled. It doesn't seem worth
++ * it to make it conditional given that this is
++ * certainly not a fast-path.
+ */
+- __flush_icache_range((unsigned long)&dst[0],
+- (unsigned long)&dst[1]);
++ flush_icache_range((unsigned long)&dst[0],
++ (unsigned long)&dst[1]);
+ }
+ addr = (unsigned long)dst;
+ #else /* CONFIG_ARM64_MODULE_PLTS */
+diff --git a/arch/mips/fw/sni/sniprom.c b/arch/mips/fw/sni/sniprom.c
+index 8772617b64ce..80112f2298b6 100644
+--- a/arch/mips/fw/sni/sniprom.c
++++ b/arch/mips/fw/sni/sniprom.c
+@@ -43,7 +43,7 @@
+
+ /* O32 stack has to be 8-byte aligned. */
+ static u64 o32_stk[4096];
+-#define O32_STK &o32_stk[sizeof(o32_stk)]
++#define O32_STK (&o32_stk[ARRAY_SIZE(o32_stk)])
+
+ #define __PROM_O32(fun, arg) fun arg __asm__(#fun); \
+ __asm__(#fun " = call_o32")
+diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h
+index 89e9fb7976fe..520ca166cbed 100644
+--- a/arch/mips/include/asm/cmpxchg.h
++++ b/arch/mips/include/asm/cmpxchg.h
+@@ -73,8 +73,8 @@ extern unsigned long __xchg_called_with_bad_pointer(void)
+ extern unsigned long __xchg_small(volatile void *ptr, unsigned long val,
+ unsigned int size);
+
+-static inline unsigned long __xchg(volatile void *ptr, unsigned long x,
+- int size)
++static __always_inline
++unsigned long __xchg(volatile void *ptr, unsigned long x, int size)
+ {
+ switch (size) {
+ case 1:
+@@ -146,8 +146,9 @@ static inline unsigned long __xchg(volatile void *ptr, unsigned long x,
+ extern unsigned long __cmpxchg_small(volatile void *ptr, unsigned long old,
+ unsigned long new, unsigned int size);
+
+-static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
+- unsigned long new, unsigned int size)
++static __always_inline
++unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
++ unsigned long new, unsigned int size)
+ {
+ switch (size) {
+ case 1:
+diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c
+index a29fdf8a2e56..232bf5987f91 100644
+--- a/arch/powerpc/platforms/powernv/memtrace.c
++++ b/arch/powerpc/platforms/powernv/memtrace.c
+@@ -70,6 +70,7 @@ static int change_memblock_state(struct memory_block *mem, void *arg)
+ return 0;
+ }
+
++/* called with device_hotplug_lock held */
+ static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages)
+ {
+ u64 end_pfn = start_pfn + nr_pages - 1;
+@@ -110,6 +111,7 @@ static u64 memtrace_alloc_node(u32 nid, u64 size)
+ /* Trace memory needs to be aligned to the size */
+ end_pfn = round_down(end_pfn - nr_pages, nr_pages);
+
++ lock_device_hotplug();
+ for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) {
+ if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) {
+ /*
+@@ -118,7 +120,6 @@ static u64 memtrace_alloc_node(u32 nid, u64 size)
+ * we never try to remove memory that spans two iomem
+ * resources.
+ */
+- lock_device_hotplug();
+ end_pfn = base_pfn + nr_pages;
+ for (pfn = base_pfn; pfn < end_pfn; pfn += bytes>> PAGE_SHIFT) {
+ remove_memory(nid, pfn << PAGE_SHIFT, bytes);
+@@ -127,6 +128,7 @@ static u64 memtrace_alloc_node(u32 nid, u64 size)
+ return base_pfn << PAGE_SHIFT;
+ }
+ }
++ unlock_device_hotplug();
+
+ return 0;
+ }
+diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
+index db09c7022635..fdd9577d1798 100644
+--- a/arch/powerpc/platforms/powernv/smp.c
++++ b/arch/powerpc/platforms/powernv/smp.c
+@@ -150,20 +150,25 @@ static int pnv_smp_cpu_disable(void)
+ return 0;
+ }
+
++static void pnv_flush_interrupts(void)
++{
++ if (cpu_has_feature(CPU_FTR_ARCH_300)) {
++ if (xive_enabled())
++ xive_flush_interrupt();
++ else
++ icp_opal_flush_interrupt();
++ } else {
++ icp_native_flush_interrupt();
++ }
++}
++
+ static void pnv_smp_cpu_kill_self(void)
+ {
++ unsigned long srr1, unexpected_mask, wmask;
+ unsigned int cpu;
+- unsigned long srr1, wmask;
+ u64 lpcr_val;
+
+ /* Standard hot unplug procedure */
+- /*
+- * This hard disables local interurpts, ensuring we have no lazy
+- * irqs pending.
+- */
+- WARN_ON(irqs_disabled());
+- hard_irq_disable();
+- WARN_ON(lazy_irq_pending());
+
+ idle_task_exit();
+ current->active_mm = NULL; /* for sanity */
+@@ -176,6 +181,27 @@ static void pnv_smp_cpu_kill_self(void)
+ if (cpu_has_feature(CPU_FTR_ARCH_207S))
+ wmask = SRR1_WAKEMASK_P8;
+
++ /*
++ * This turns the irq soft-disabled state we're called with, into a
++ * hard-disabled state with pending irq_happened interrupts cleared.
++ *
++ * PACA_IRQ_DEC - Decrementer should be ignored.
++ * PACA_IRQ_HMI - Can be ignored, processing is done in real mode.
++ * PACA_IRQ_DBELL, EE, PMI - Unexpected.
++ */
++ hard_irq_disable();
++ if (generic_check_cpu_restart(cpu))
++ goto out;
++
++ unexpected_mask = ~(PACA_IRQ_DEC | PACA_IRQ_HMI | PACA_IRQ_HARD_DIS);
++ if (local_paca->irq_happened & unexpected_mask) {
++ if (local_paca->irq_happened & PACA_IRQ_EE)
++ pnv_flush_interrupts();
++ DBG("CPU%d Unexpected exit while offline irq_happened=%lx!\n",
++ cpu, local_paca->irq_happened);
++ }
++ local_paca->irq_happened = PACA_IRQ_HARD_DIS;
++
+ /*
+ * We don't want to take decrementer interrupts while we are
+ * offline, so clear LPCR:PECE1. We keep PECE2 (and
+@@ -201,6 +227,7 @@ static void pnv_smp_cpu_kill_self(void)
+
+ srr1 = pnv_cpu_offline(cpu);
+
++ WARN_ON_ONCE(!irqs_disabled());
+ WARN_ON(lazy_irq_pending());
+
+ /*
+@@ -216,13 +243,7 @@ static void pnv_smp_cpu_kill_self(void)
+ */
+ if (((srr1 & wmask) == SRR1_WAKEEE) ||
+ ((srr1 & wmask) == SRR1_WAKEHVI)) {
+- if (cpu_has_feature(CPU_FTR_ARCH_300)) {
+- if (xive_enabled())
+- xive_flush_interrupt();
+- else
+- icp_opal_flush_interrupt();
+- } else
+- icp_native_flush_interrupt();
++ pnv_flush_interrupts();
+ } else if ((srr1 & wmask) == SRR1_WAKEHDBELL) {
+ unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER);
+ asm volatile(PPC_MSGCLR(%0) : : "r" (msg));
+@@ -270,7 +291,7 @@ static void pnv_smp_cpu_kill_self(void)
+ */
+ lpcr_val = mfspr(SPRN_LPCR) | (u64)LPCR_PECE1;
+ pnv_program_cpu_hotplug_lpcr(cpu, lpcr_val);
+-
++out:
+ DBG("CPU%d coming online...\n", cpu);
+ }
+
+diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
+index 5332f628c1ed..40194f8c772a 100644
+--- a/arch/s390/include/asm/uaccess.h
++++ b/arch/s390/include/asm/uaccess.h
+@@ -84,7 +84,7 @@ raw_copy_to_user(void __user *to, const void *from, unsigned long n);
+ __rc; \
+ })
+
+-static inline int __put_user_fn(void *x, void __user *ptr, unsigned long size)
++static __always_inline int __put_user_fn(void *x, void __user *ptr, unsigned long size)
+ {
+ unsigned long spec = 0x010000UL;
+ int rc;
+@@ -114,7 +114,7 @@ static inline int __put_user_fn(void *x, void __user *ptr, unsigned long size)
+ return rc;
+ }
+
+-static inline int __get_user_fn(void *x, const void __user *ptr, unsigned long size)
++static __always_inline int __get_user_fn(void *x, const void __user *ptr, unsigned long size)
+ {
+ unsigned long spec = 0x01UL;
+ int rc;
+diff --git a/arch/s390/kernel/idle.c b/arch/s390/kernel/idle.c
+index b9d8fe45737a..8f8456816d83 100644
+--- a/arch/s390/kernel/idle.c
++++ b/arch/s390/kernel/idle.c
+@@ -69,18 +69,26 @@ DEVICE_ATTR(idle_count, 0444, show_idle_count, NULL);
+ static ssize_t show_idle_time(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
++ unsigned long long now, idle_time, idle_enter, idle_exit, in_idle;
+ struct s390_idle_data *idle = &per_cpu(s390_idle, dev->id);
+- unsigned long long now, idle_time, idle_enter, idle_exit;
+ unsigned int seq;
+
+ do {
+- now = get_tod_clock();
+ seq = read_seqcount_begin(&idle->seqcount);
+ idle_time = READ_ONCE(idle->idle_time);
+ idle_enter = READ_ONCE(idle->clock_idle_enter);
+ idle_exit = READ_ONCE(idle->clock_idle_exit);
+ } while (read_seqcount_retry(&idle->seqcount, seq));
+- idle_time += idle_enter ? ((idle_exit ? : now) - idle_enter) : 0;
++ in_idle = 0;
++ now = get_tod_clock();
++ if (idle_enter) {
++ if (idle_exit) {
++ in_idle = idle_exit - idle_enter;
++ } else if (now > idle_enter) {
++ in_idle = now - idle_enter;
++ }
++ }
++ idle_time += in_idle;
+ return sprintf(buf, "%llu\n", idle_time >> 12);
+ }
+ DEVICE_ATTR(idle_time_us, 0444, show_idle_time, NULL);
+@@ -88,17 +96,24 @@ DEVICE_ATTR(idle_time_us, 0444, show_idle_time, NULL);
+ u64 arch_cpu_idle_time(int cpu)
+ {
+ struct s390_idle_data *idle = &per_cpu(s390_idle, cpu);
+- unsigned long long now, idle_enter, idle_exit;
++ unsigned long long now, idle_enter, idle_exit, in_idle;
+ unsigned int seq;
+
+ do {
+- now = get_tod_clock();
+ seq = read_seqcount_begin(&idle->seqcount);
+ idle_enter = READ_ONCE(idle->clock_idle_enter);
+ idle_exit = READ_ONCE(idle->clock_idle_exit);
+ } while (read_seqcount_retry(&idle->seqcount, seq));
+-
+- return cputime_to_nsecs(idle_enter ? ((idle_exit ?: now) - idle_enter) : 0);
++ in_idle = 0;
++ now = get_tod_clock();
++ if (idle_enter) {
++ if (idle_exit) {
++ in_idle = idle_exit - idle_enter;
++ } else if (now > idle_enter) {
++ in_idle = now - idle_enter;
++ }
++ }
++ return cputime_to_nsecs(in_idle);
+ }
+
+ void arch_cpu_idle_enter(void)
+diff --git a/arch/s390/mm/cmm.c b/arch/s390/mm/cmm.c
+index 510a18299196..a51c892f14f3 100644
+--- a/arch/s390/mm/cmm.c
++++ b/arch/s390/mm/cmm.c
+@@ -298,16 +298,16 @@ static int cmm_timeout_handler(struct ctl_table *ctl, int write,
+ }
+
+ if (write) {
+- len = *lenp;
+- if (copy_from_user(buf, buffer,
+- len > sizeof(buf) ? sizeof(buf) : len))
++ len = min(*lenp, sizeof(buf));
++ if (copy_from_user(buf, buffer, len))
+ return -EFAULT;
+- buf[sizeof(buf) - 1] = '\0';
++ buf[len - 1] = '\0';
+ cmm_skip_blanks(buf, &p);
+ nr = simple_strtoul(p, &p, 0);
+ cmm_skip_blanks(p, &p);
+ seconds = simple_strtoul(p, &p, 0);
+ cmm_set_timeout(nr, seconds);
++ *ppos += *lenp;
+ } else {
+ len = sprintf(buf, "%ld %ld\n",
+ cmm_timeout_pages, cmm_timeout_seconds);
+@@ -315,9 +315,9 @@ static int cmm_timeout_handler(struct ctl_table *ctl, int write,
+ len = *lenp;
+ if (copy_to_user(buffer, buf, len))
+ return -EFAULT;
++ *lenp = len;
++ *ppos += len;
+ }
+- *lenp = len;
+- *ppos += len;
+ return 0;
+ }
+
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index 27ade3cb6482..defb536aebce 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -4,12 +4,14 @@
+ #include <linux/init.h>
+ #include <linux/slab.h>
+ #include <linux/delay.h>
++#include <linux/jiffies.h>
+ #include <asm/apicdef.h>
+ #include <asm/nmi.h>
+
+ #include "../perf_event.h"
+
+-static DEFINE_PER_CPU(unsigned int, perf_nmi_counter);
++static DEFINE_PER_CPU(unsigned long, perf_nmi_tstamp);
++static unsigned long perf_nmi_window;
+
+ static __initconst const u64 amd_hw_cache_event_ids
+ [PERF_COUNT_HW_CACHE_MAX]
+@@ -640,11 +642,12 @@ static void amd_pmu_disable_event(struct perf_event *event)
+ * handler when multiple PMCs are active or PMC overflow while handling some
+ * other source of an NMI.
+ *
+- * Attempt to mitigate this by using the number of active PMCs to determine
+- * whether to return NMI_HANDLED if the perf NMI handler did not handle/reset
+- * any PMCs. The per-CPU perf_nmi_counter variable is set to a minimum of the
+- * number of active PMCs or 2. The value of 2 is used in case an NMI does not
+- * arrive at the LAPIC in time to be collapsed into an already pending NMI.
++ * Attempt to mitigate this by creating an NMI window in which un-handled NMIs
++ * received during this window will be claimed. This prevents extending the
++ * window past when it is possible that latent NMIs should be received. The
++ * per-CPU perf_nmi_tstamp will be set to the window end time whenever perf has
++ * handled a counter. When an un-handled NMI is received, it will be claimed
++ * only if arriving within that window.
+ */
+ static int amd_pmu_handle_irq(struct pt_regs *regs)
+ {
+@@ -662,21 +665,19 @@ static int amd_pmu_handle_irq(struct pt_regs *regs)
+ handled = x86_pmu_handle_irq(regs);
+
+ /*
+- * If a counter was handled, record the number of possible remaining
+- * NMIs that can occur.
++ * If a counter was handled, record a timestamp such that un-handled
++ * NMIs will be claimed if arriving within that window.
+ */
+ if (handled) {
+- this_cpu_write(perf_nmi_counter,
+- min_t(unsigned int, 2, active));
++ this_cpu_write(perf_nmi_tstamp,
++ jiffies + perf_nmi_window);
+
+ return handled;
+ }
+
+- if (!this_cpu_read(perf_nmi_counter))
++ if (time_after(jiffies, this_cpu_read(perf_nmi_tstamp)))
+ return NMI_DONE;
+
+- this_cpu_dec(perf_nmi_counter);
+-
+ return NMI_HANDLED;
+ }
+
+@@ -908,6 +909,9 @@ static int __init amd_core_pmu_init(void)
+ if (!boot_cpu_has(X86_FEATURE_PERFCTR_CORE))
+ return 0;
+
++ /* Avoid calulating the value each time in the NMI handler */
++ perf_nmi_window = msecs_to_jiffies(100);
++
+ switch (boot_cpu_data.x86) {
+ case 0x15:
+ pr_cont("Fam15h ");
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 5d0b72f28140..2a8e5f78e23c 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -6,7 +6,7 @@
+ * "Big Core" Processors (Branded as Core, Xeon, etc...)
+ *
+ * The "_X" parts are generally the EP and EX Xeons, or the
+- * "Extreme" ones, like Broadwell-E.
++ * "Extreme" ones, like Broadwell-E, or Atom microserver.
+ *
+ * While adding a new CPUID for a new microarchitecture, add a new
+ * group to keep logically sorted out in chronological order. Within
+@@ -61,6 +61,9 @@
+ #define INTEL_FAM6_TIGERLAKE_L 0x8C
+ #define INTEL_FAM6_TIGERLAKE 0x8D
+
++#define INTEL_FAM6_COMETLAKE 0xA5
++#define INTEL_FAM6_COMETLAKE_L 0xA6
++
+ /* "Small Core" Processors (Atom) */
+
+ #define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */
+@@ -80,6 +83,7 @@
+ #define INTEL_FAM6_ATOM_GOLDMONT 0x5C /* Apollo Lake */
+ #define INTEL_FAM6_ATOM_GOLDMONT_X 0x5F /* Denverton */
+ #define INTEL_FAM6_ATOM_GOLDMONT_PLUS 0x7A /* Gemini Lake */
++#define INTEL_FAM6_ATOM_TREMONT_X 0x86 /* Jacobsville */
+
+ /* Xeon Phi */
+
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 9061babfbc83..335a62e74a2e 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -893,9 +893,6 @@ static void __init kexec_enter_virtual_mode(void)
+
+ if (efi_enabled(EFI_OLD_MEMMAP) && (__supported_pte_mask & _PAGE_NX))
+ runtime_code_page_mkexec();
+-
+- /* clean DUMMY object */
+- efi_delete_dummy_variable();
+ #endif
+ }
+
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index c6c7c9b7b5c1..2483ff345bbc 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -266,19 +266,41 @@ void xen_reboot(int reason)
+ BUG();
+ }
+
++static int reboot_reason = SHUTDOWN_reboot;
++static bool xen_legacy_crash;
+ void xen_emergency_restart(void)
+ {
+- xen_reboot(SHUTDOWN_reboot);
++ xen_reboot(reboot_reason);
+ }
+
+ static int
+ xen_panic_event(struct notifier_block *this, unsigned long event, void *ptr)
+ {
+- if (!kexec_crash_loaded())
+- xen_reboot(SHUTDOWN_crash);
++ if (!kexec_crash_loaded()) {
++ if (xen_legacy_crash)
++ xen_reboot(SHUTDOWN_crash);
++
++ reboot_reason = SHUTDOWN_crash;
++
++ /*
++ * If panic_timeout==0 then we are supposed to wait forever.
++ * However, to preserve original dom0 behavior we have to drop
++ * into hypervisor. (domU behavior is controlled by its
++ * config file)
++ */
++ if (panic_timeout == 0)
++ panic_timeout = -1;
++ }
+ return NOTIFY_DONE;
+ }
+
++static int __init parse_xen_legacy_crash(char *arg)
++{
++ xen_legacy_crash = true;
++ return 0;
++}
++early_param("xen_legacy_crash", parse_xen_legacy_crash);
++
+ static struct notifier_block xen_panic_block = {
+ .notifier_call = xen_panic_event,
+ .priority = INT_MIN
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index bc2fa4e85f0c..bd9aafe86c2f 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -228,8 +228,8 @@ static void nbd_put(struct nbd_device *nbd)
+ if (refcount_dec_and_mutex_lock(&nbd->refs,
+ &nbd_index_mutex)) {
+ idr_remove(&nbd_index_idr, nbd->index);
+- mutex_unlock(&nbd_index_mutex);
+ nbd_dev_remove(nbd);
++ mutex_unlock(&nbd_index_mutex);
+ }
+ }
+
+@@ -924,6 +924,25 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
+ return ret;
+ }
+
++static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
++ int *err)
++{
++ struct socket *sock;
++
++ *err = 0;
++ sock = sockfd_lookup(fd, err);
++ if (!sock)
++ return NULL;
++
++ if (sock->ops->shutdown == sock_no_shutdown) {
++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
++ *err = -EINVAL;
++ return NULL;
++ }
++
++ return sock;
++}
++
+ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+ bool netlink)
+ {
+@@ -933,7 +952,7 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+ struct nbd_sock *nsock;
+ int err;
+
+- sock = sockfd_lookup(arg, &err);
++ sock = nbd_get_socket(nbd, arg, &err);
+ if (!sock)
+ return err;
+
+@@ -985,7 +1004,7 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg)
+ int i;
+ int err;
+
+- sock = sockfd_lookup(arg, &err);
++ sock = nbd_get_socket(nbd, arg, &err);
+ if (!sock)
+ return err;
+
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 70cbd0ee1b07..76abe40bfa83 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -312,13 +312,14 @@ static void reset_bdev(struct zram *zram)
+ static ssize_t backing_dev_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
++ struct file *file;
+ struct zram *zram = dev_to_zram(dev);
+- struct file *file = zram->backing_dev;
+ char *p;
+ ssize_t ret;
+
+ down_read(&zram->init_lock);
+- if (!zram_wb_enabled(zram)) {
++ file = zram->backing_dev;
++ if (!file) {
+ memcpy(buf, "none\n", 5);
+ up_read(&zram->init_lock);
+ return 5;
+diff --git a/drivers/clk/imgtec/clk-boston.c b/drivers/clk/imgtec/clk-boston.c
+index f5d54a64d33c..dddda45127a8 100644
+--- a/drivers/clk/imgtec/clk-boston.c
++++ b/drivers/clk/imgtec/clk-boston.c
+@@ -73,31 +73,39 @@ static void __init clk_boston_setup(struct device_node *np)
+ hw = clk_hw_register_fixed_rate(NULL, "input", NULL, 0, in_freq);
+ if (IS_ERR(hw)) {
+ pr_err("failed to register input clock: %ld\n", PTR_ERR(hw));
+- goto error;
++ goto fail_input;
+ }
+ onecell->hws[BOSTON_CLK_INPUT] = hw;
+
+ hw = clk_hw_register_fixed_rate(NULL, "sys", "input", 0, sys_freq);
+ if (IS_ERR(hw)) {
+ pr_err("failed to register sys clock: %ld\n", PTR_ERR(hw));
+- goto error;
++ goto fail_sys;
+ }
+ onecell->hws[BOSTON_CLK_SYS] = hw;
+
+ hw = clk_hw_register_fixed_rate(NULL, "cpu", "input", 0, cpu_freq);
+ if (IS_ERR(hw)) {
+ pr_err("failed to register cpu clock: %ld\n", PTR_ERR(hw));
+- goto error;
++ goto fail_cpu;
+ }
+ onecell->hws[BOSTON_CLK_CPU] = hw;
+
+ err = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, onecell);
+- if (err)
++ if (err) {
+ pr_err("failed to add DT provider: %d\n", err);
++ goto fail_clk_add;
++ }
+
+ return;
+
+-error:
++fail_clk_add:
++ clk_hw_unregister_fixed_rate(onecell->hws[BOSTON_CLK_CPU]);
++fail_cpu:
++ clk_hw_unregister_fixed_rate(onecell->hws[BOSTON_CLK_SYS]);
++fail_sys:
++ clk_hw_unregister_fixed_rate(onecell->hws[BOSTON_CLK_INPUT]);
++fail_input:
+ kfree(onecell);
+ }
+
+diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c
+index 489c8fa4d2e2..4451ccfaf7c9 100644
+--- a/drivers/dma/qcom/bam_dma.c
++++ b/drivers/dma/qcom/bam_dma.c
+@@ -703,6 +703,25 @@ static int bam_dma_terminate_all(struct dma_chan *chan)
+
+ /* remove all transactions, including active transaction */
+ spin_lock_irqsave(&bchan->vc.lock, flag);
++ /*
++ * If we have transactions queued, then some might be committed to the
++ * hardware in the desc fifo. The only way to reset the desc fifo is
++ * to do a hardware reset (either by pipe or the entire block).
++ * bam_chan_init_hw() will trigger a pipe reset, and also reinit the
++ * pipe. If the pipe is left disabled (default state after pipe reset)
++ * and is accessed by a connected hardware engine, a fatal error in
++ * the BAM will occur. There is a small window where this could happen
++ * with bam_chan_init_hw(), but it is assumed that the caller has
++ * stopped activity on any attached hardware engine. Make sure to do
++ * this first so that the BAM hardware doesn't cause memory corruption
++ * by accessing freed resources.
++ */
++ if (!list_empty(&bchan->desc_list)) {
++ async_desc = list_first_entry(&bchan->desc_list,
++ struct bam_async_desc, desc_node);
++ bam_chan_init_hw(bchan, async_desc->dir);
++ }
++
+ list_for_each_entry_safe(async_desc, tmp,
+ &bchan->desc_list, desc_node) {
+ list_add(&async_desc->vd.node, &bchan->vc.desc_issued);
+diff --git a/drivers/dma/ti/cppi41.c b/drivers/dma/ti/cppi41.c
+index e507ec36c0d3..f8fa99402f12 100644
+--- a/drivers/dma/ti/cppi41.c
++++ b/drivers/dma/ti/cppi41.c
+@@ -585,9 +585,22 @@ static struct dma_async_tx_descriptor *cppi41_dma_prep_slave_sg(
+ enum dma_transfer_direction dir, unsigned long tx_flags, void *context)
+ {
+ struct cppi41_channel *c = to_cpp41_chan(chan);
++ struct dma_async_tx_descriptor *txd = NULL;
++ struct cppi41_dd *cdd = c->cdd;
+ struct cppi41_desc *d;
+ struct scatterlist *sg;
+ unsigned int i;
++ int error;
++
++ error = pm_runtime_get(cdd->ddev.dev);
++ if (error < 0) {
++ pm_runtime_put_noidle(cdd->ddev.dev);
++
++ return NULL;
++ }
++
++ if (cdd->is_suspended)
++ goto err_out_not_ready;
+
+ d = c->desc;
+ for_each_sg(sgl, sg, sg_len, i) {
+@@ -610,7 +623,13 @@ static struct dma_async_tx_descriptor *cppi41_dma_prep_slave_sg(
+ d++;
+ }
+
+- return &c->txd;
++ txd = &c->txd;
++
++err_out_not_ready:
++ pm_runtime_mark_last_busy(cdd->ddev.dev);
++ pm_runtime_put_autosuspend(cdd->ddev.dev);
++
++ return txd;
+ }
+
+ static void cppi41_compute_td_desc(struct cppi41_desc *d)
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 4045098ddb86..116989cf3d45 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -393,7 +393,7 @@ static void cper_print_pcie(const char *pfx, const struct cper_sec_pcie *pcie,
+ printk("%s""vendor_id: 0x%04x, device_id: 0x%04x\n", pfx,
+ pcie->device_id.vendor_id, pcie->device_id.device_id);
+ p = pcie->device_id.class_code;
+- printk("%s""class_code: %02x%02x%02x\n", pfx, p[0], p[1], p[2]);
++ printk("%s""class_code: %02x%02x%02x\n", pfx, p[2], p[1], p[0]);
+ }
+ if (pcie->validation_bits & CPER_PCIE_VALID_SERIAL_NUMBER)
+ printk("%s""serial number: 0x%04x, 0x%04x\n", pfx,
+diff --git a/drivers/gpio/gpio-max77620.c b/drivers/gpio/gpio-max77620.c
+index 538bce4b5b42..ac6c1c0548b6 100644
+--- a/drivers/gpio/gpio-max77620.c
++++ b/drivers/gpio/gpio-max77620.c
+@@ -163,13 +163,13 @@ static int max77620_gpio_set_debounce(struct max77620_gpio *mgpio,
+ case 0:
+ val = MAX77620_CNFG_GPIO_DBNC_None;
+ break;
+- case 1 ... 8:
++ case 1000 ... 8000:
+ val = MAX77620_CNFG_GPIO_DBNC_8ms;
+ break;
+- case 9 ... 16:
++ case 9000 ... 16000:
+ val = MAX77620_CNFG_GPIO_DBNC_16ms;
+ break;
+- case 17 ... 32:
++ case 17000 ... 32000:
+ val = MAX77620_CNFG_GPIO_DBNC_32ms;
+ break;
+ default:
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+index b80243d3972e..ce7f18c5ccb2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+@@ -264,7 +264,7 @@ int amdgpu_bo_list_ioctl(struct drm_device *dev, void *data,
+
+ r = amdgpu_bo_create_list_entry_array(&args->in, &info);
+ if (r)
+- goto error_free;
++ return r;
+
+ switch (args->in.operation) {
+ case AMDGPU_BO_LIST_OP_CREATE:
+@@ -277,8 +277,7 @@ int amdgpu_bo_list_ioctl(struct drm_device *dev, void *data,
+ r = idr_alloc(&fpriv->bo_list_handles, list, 1, 0, GFP_KERNEL);
+ mutex_unlock(&fpriv->bo_list_lock);
+ if (r < 0) {
+- amdgpu_bo_list_put(list);
+- return r;
++ goto error_put_list;
+ }
+
+ handle = r;
+@@ -300,9 +299,8 @@ int amdgpu_bo_list_ioctl(struct drm_device *dev, void *data,
+ mutex_unlock(&fpriv->bo_list_lock);
+
+ if (IS_ERR(old)) {
+- amdgpu_bo_list_put(list);
+ r = PTR_ERR(old);
+- goto error_free;
++ goto error_put_list;
+ }
+
+ amdgpu_bo_list_put(old);
+@@ -319,8 +317,10 @@ int amdgpu_bo_list_ioctl(struct drm_device *dev, void *data,
+
+ return 0;
+
++error_put_list:
++ amdgpu_bo_list_put(list);
++
+ error_free:
+- if (info)
+- kvfree(info);
++ kvfree(info);
+ return r;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index d440b28ee43f..6896d69b8c24 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -1399,9 +1399,9 @@ bool dc_remove_plane_from_context(
+ * For head pipe detach surfaces from pipe for tail
+ * pipe just zero it out
+ */
+- if (!pipe_ctx->top_pipe ||
+- (!pipe_ctx->top_pipe->top_pipe &&
++ if (!pipe_ctx->top_pipe || (!pipe_ctx->top_pipe->top_pipe &&
+ pipe_ctx->top_pipe->stream_res.opp != pipe_ctx->stream_res.opp)) {
++ pipe_ctx->top_pipe = NULL;
+ pipe_ctx->plane_state = NULL;
+ pipe_ctx->bottom_pipe = NULL;
+ } else {
+@@ -1803,8 +1803,6 @@ enum dc_status dc_remove_stream_from_ctx(
+ dc->res_pool->funcs->remove_stream_from_ctx(dc, new_ctx, stream);
+
+ memset(del_pipe, 0, sizeof(*del_pipe));
+-
+- break;
+ }
+ }
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+index fb86c24394ff..ce459ea4ec3a 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+@@ -4751,9 +4751,7 @@ static void vega10_odn_update_soc_table(struct pp_hwmgr *hwmgr,
+
+ if (type == PP_OD_EDIT_SCLK_VDDC_TABLE) {
+ podn_vdd_dep = &data->odn_dpm_table.vdd_dep_on_sclk;
+- for (i = 0; i < podn_vdd_dep->count - 1; i++)
+- od_vddc_lookup_table->entries[i].us_vdd = podn_vdd_dep->entries[i].vddc;
+- if (od_vddc_lookup_table->entries[i].us_vdd < podn_vdd_dep->entries[i].vddc)
++ for (i = 0; i < podn_vdd_dep->count; i++)
+ od_vddc_lookup_table->entries[i].us_vdd = podn_vdd_dep->entries[i].vddc;
+ } else if (type == PP_OD_EDIT_MCLK_VDDC_TABLE) {
+ podn_vdd_dep = &data->odn_dpm_table.vdd_dep_on_mclk;
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+index 74cc204b07e8..2d9b7b5fb49c 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+@@ -442,35 +442,38 @@ static void dpu_kms_wait_for_commit_done(struct msm_kms *kms,
+ }
+ }
+
+-static void _dpu_kms_initialize_dsi(struct drm_device *dev,
++static int _dpu_kms_initialize_dsi(struct drm_device *dev,
+ struct msm_drm_private *priv,
+ struct dpu_kms *dpu_kms)
+ {
+ struct drm_encoder *encoder = NULL;
+- int i, rc;
++ int i, rc = 0;
++
++ if (!(priv->dsi[0] || priv->dsi[1]))
++ return rc;
+
+ /*TODO: Support two independent DSI connectors */
+ encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_DSI);
+- if (IS_ERR_OR_NULL(encoder)) {
++ if (IS_ERR(encoder)) {
+ DPU_ERROR("encoder init failed for dsi display\n");
+- return;
++ return PTR_ERR(encoder);
+ }
+
+ priv->encoders[priv->num_encoders++] = encoder;
+
+ for (i = 0; i < ARRAY_SIZE(priv->dsi); i++) {
+- if (!priv->dsi[i]) {
+- DPU_DEBUG("invalid msm_dsi for ctrl %d\n", i);
+- return;
+- }
++ if (!priv->dsi[i])
++ continue;
+
+ rc = msm_dsi_modeset_init(priv->dsi[i], dev, encoder);
+ if (rc) {
+ DPU_ERROR("modeset_init failed for dsi[%d], rc = %d\n",
+ i, rc);
+- continue;
++ break;
+ }
+ }
++
++ return rc;
+ }
+
+ /**
+@@ -481,16 +484,16 @@ static void _dpu_kms_initialize_dsi(struct drm_device *dev,
+ * @dpu_kms: Pointer to dpu kms structure
+ * Returns: Zero on success
+ */
+-static void _dpu_kms_setup_displays(struct drm_device *dev,
++static int _dpu_kms_setup_displays(struct drm_device *dev,
+ struct msm_drm_private *priv,
+ struct dpu_kms *dpu_kms)
+ {
+- _dpu_kms_initialize_dsi(dev, priv, dpu_kms);
+-
+ /**
+ * Extend this function to initialize other
+ * types of displays
+ */
++
++ return _dpu_kms_initialize_dsi(dev, priv, dpu_kms);
+ }
+
+ static void _dpu_kms_drm_obj_destroy(struct dpu_kms *dpu_kms)
+@@ -552,7 +555,9 @@ static int _dpu_kms_drm_obj_init(struct dpu_kms *dpu_kms)
+ * Create encoder and query display drivers to create
+ * bridges and connectors
+ */
+- _dpu_kms_setup_displays(dev, priv, dpu_kms);
++ ret = _dpu_kms_setup_displays(dev, priv, dpu_kms);
++ if (ret)
++ goto fail;
+
+ max_crtc_count = min(catalog->mixer_count, priv->num_encoders);
+
+diff --git a/drivers/hid/hid-axff.c b/drivers/hid/hid-axff.c
+index a594e478a1e2..843aed4dec80 100644
+--- a/drivers/hid/hid-axff.c
++++ b/drivers/hid/hid-axff.c
+@@ -75,13 +75,20 @@ static int axff_init(struct hid_device *hid)
+ {
+ struct axff_device *axff;
+ struct hid_report *report;
+- struct hid_input *hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
++ struct hid_input *hidinput;
+ struct list_head *report_list =&hid->report_enum[HID_OUTPUT_REPORT].report_list;
+- struct input_dev *dev = hidinput->input;
++ struct input_dev *dev;
+ int field_count = 0;
+ int i, j;
+ int error;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
++ dev = hidinput->input;
++
+ if (list_empty(report_list)) {
+ hid_err(hid, "no output reports found\n");
+ return -ENODEV;
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 861375561156..63a1628f7cf7 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -975,6 +975,7 @@ int hid_open_report(struct hid_device *device)
+ __u8 *start;
+ __u8 *buf;
+ __u8 *end;
++ __u8 *next;
+ int ret;
+ static int (*dispatch_type[])(struct hid_parser *parser,
+ struct hid_item *item) = {
+@@ -1028,7 +1029,8 @@ int hid_open_report(struct hid_device *device)
+ device->collection_size = HID_DEFAULT_NUM_COLLECTIONS;
+
+ ret = -EINVAL;
+- while ((start = fetch_item(start, end, &item)) != NULL) {
++ while ((next = fetch_item(start, end, &item)) != NULL) {
++ start = next;
+
+ if (item.format != HID_ITEM_FORMAT_SHORT) {
+ hid_err(device, "unexpected long global item\n");
+@@ -1058,7 +1060,8 @@ int hid_open_report(struct hid_device *device)
+ }
+ }
+
+- hid_err(device, "item fetching failed at offset %d\n", (int)(end - start));
++ hid_err(device, "item fetching failed at offset %u/%u\n",
++ size - (unsigned int)(end - start), size);
+ err:
+ kfree(parser->collection_stack);
+ alloc_err:
+diff --git a/drivers/hid/hid-dr.c b/drivers/hid/hid-dr.c
+index 818ea7d93533..309969b8dc2e 100644
+--- a/drivers/hid/hid-dr.c
++++ b/drivers/hid/hid-dr.c
+@@ -87,13 +87,19 @@ static int drff_init(struct hid_device *hid)
+ {
+ struct drff_device *drff;
+ struct hid_report *report;
+- struct hid_input *hidinput = list_first_entry(&hid->inputs,
+- struct hid_input, list);
++ struct hid_input *hidinput;
+ struct list_head *report_list =
+ &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+- struct input_dev *dev = hidinput->input;
++ struct input_dev *dev;
+ int error;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
++ dev = hidinput->input;
++
+ if (list_empty(report_list)) {
+ hid_err(hid, "no output reports found\n");
+ return -ENODEV;
+diff --git a/drivers/hid/hid-emsff.c b/drivers/hid/hid-emsff.c
+index d82d75bb11f7..80f9a02dfa69 100644
+--- a/drivers/hid/hid-emsff.c
++++ b/drivers/hid/hid-emsff.c
+@@ -59,13 +59,19 @@ static int emsff_init(struct hid_device *hid)
+ {
+ struct emsff_device *emsff;
+ struct hid_report *report;
+- struct hid_input *hidinput = list_first_entry(&hid->inputs,
+- struct hid_input, list);
++ struct hid_input *hidinput;
+ struct list_head *report_list =
+ &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+- struct input_dev *dev = hidinput->input;
++ struct input_dev *dev;
+ int error;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
++ dev = hidinput->input;
++
+ if (list_empty(report_list)) {
+ hid_err(hid, "no output reports found\n");
+ return -ENODEV;
+diff --git a/drivers/hid/hid-gaff.c b/drivers/hid/hid-gaff.c
+index 2d8cead3adca..5a02c50443cb 100644
+--- a/drivers/hid/hid-gaff.c
++++ b/drivers/hid/hid-gaff.c
+@@ -77,14 +77,20 @@ static int gaff_init(struct hid_device *hid)
+ {
+ struct gaff_device *gaff;
+ struct hid_report *report;
+- struct hid_input *hidinput = list_entry(hid->inputs.next,
+- struct hid_input, list);
++ struct hid_input *hidinput;
+ struct list_head *report_list =
+ &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+ struct list_head *report_ptr = report_list;
+- struct input_dev *dev = hidinput->input;
++ struct input_dev *dev;
+ int error;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_entry(hid->inputs.next, struct hid_input, list);
++ dev = hidinput->input;
++
+ if (list_empty(report_list)) {
+ hid_err(hid, "no output reports found\n");
+ return -ENODEV;
+diff --git a/drivers/hid/hid-holtekff.c b/drivers/hid/hid-holtekff.c
+index edc0f64bb584..c68486ee203c 100644
+--- a/drivers/hid/hid-holtekff.c
++++ b/drivers/hid/hid-holtekff.c
+@@ -136,13 +136,19 @@ static int holtekff_init(struct hid_device *hid)
+ {
+ struct holtekff_device *holtekff;
+ struct hid_report *report;
+- struct hid_input *hidinput = list_entry(hid->inputs.next,
+- struct hid_input, list);
++ struct hid_input *hidinput;
+ struct list_head *report_list =
+ &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+- struct input_dev *dev = hidinput->input;
++ struct input_dev *dev;
+ int error;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_entry(hid->inputs.next, struct hid_input, list);
++ dev = hidinput->input;
++
+ if (list_empty(report_list)) {
+ hid_err(hid, "no output report found\n");
+ return -ENODEV;
+diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c
+index 704049e62d58..4d1496f60071 100644
+--- a/drivers/hid/hid-hyperv.c
++++ b/drivers/hid/hid-hyperv.c
+@@ -322,60 +322,24 @@ static void mousevsc_on_receive(struct hv_device *device,
+
+ static void mousevsc_on_channel_callback(void *context)
+ {
+- const int packet_size = 0x100;
+- int ret;
+ struct hv_device *device = context;
+- u32 bytes_recvd;
+- u64 req_id;
+ struct vmpacket_descriptor *desc;
+- unsigned char *buffer;
+- int bufferlen = packet_size;
+-
+- buffer = kmalloc(bufferlen, GFP_ATOMIC);
+- if (!buffer)
+- return;
+-
+- do {
+- ret = vmbus_recvpacket_raw(device->channel, buffer,
+- bufferlen, &bytes_recvd, &req_id);
+-
+- switch (ret) {
+- case 0:
+- if (bytes_recvd <= 0) {
+- kfree(buffer);
+- return;
+- }
+- desc = (struct vmpacket_descriptor *)buffer;
+-
+- switch (desc->type) {
+- case VM_PKT_COMP:
+- break;
+-
+- case VM_PKT_DATA_INBAND:
+- mousevsc_on_receive(device, desc);
+- break;
+-
+- default:
+- pr_err("unhandled packet type %d, tid %llx len %d\n",
+- desc->type, req_id, bytes_recvd);
+- break;
+- }
+
++ foreach_vmbus_pkt(desc, device->channel) {
++ switch (desc->type) {
++ case VM_PKT_COMP:
+ break;
+
+- case -ENOBUFS:
+- kfree(buffer);
+- /* Handle large packet */
+- bufferlen = bytes_recvd;
+- buffer = kmalloc(bytes_recvd, GFP_ATOMIC);
+-
+- if (!buffer)
+- return;
++ case VM_PKT_DATA_INBAND:
++ mousevsc_on_receive(device, desc);
++ break;
+
++ default:
++ pr_err("Unhandled packet type %d, tid %llx len %d\n",
++ desc->type, desc->trans_id, desc->len8 * 8);
+ break;
+ }
+- } while (1);
+-
++ }
+ }
+
+ static int mousevsc_connect_to_vsp(struct hv_device *device)
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 0eeb273fb73d..6b33117ca60e 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -713,6 +713,7 @@
+ #define USB_VENDOR_ID_LG 0x1fd2
+ #define USB_DEVICE_ID_LG_MULTITOUCH 0x0064
+ #define USB_DEVICE_ID_LG_MELFAS_MT 0x6007
++#define I2C_DEVICE_ID_LG_8001 0x8001
+
+ #define USB_VENDOR_ID_LOGITECH 0x046d
+ #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index d988b92b20c8..01bed2f6862e 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -328,6 +328,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_SYMBOL,
+ USB_DEVICE_ID_SYMBOL_SCANNER_3),
+ HID_BATTERY_QUIRK_IGNORE },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ASUSTEK,
++ USB_DEVICE_ID_ASUSTEK_T100CHI_KEYBOARD),
++ HID_BATTERY_QUIRK_IGNORE },
+ {}
+ };
+
+diff --git a/drivers/hid/hid-lg2ff.c b/drivers/hid/hid-lg2ff.c
+index 0e3fb1a7e421..6909d9c2fc67 100644
+--- a/drivers/hid/hid-lg2ff.c
++++ b/drivers/hid/hid-lg2ff.c
+@@ -62,11 +62,17 @@ int lg2ff_init(struct hid_device *hid)
+ {
+ struct lg2ff_device *lg2ff;
+ struct hid_report *report;
+- struct hid_input *hidinput = list_entry(hid->inputs.next,
+- struct hid_input, list);
+- struct input_dev *dev = hidinput->input;
++ struct hid_input *hidinput;
++ struct input_dev *dev;
+ int error;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_entry(hid->inputs.next, struct hid_input, list);
++ dev = hidinput->input;
++
+ /* Check that the report looks ok */
+ report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7);
+ if (!report)
+diff --git a/drivers/hid/hid-lg3ff.c b/drivers/hid/hid-lg3ff.c
+index 8c2da183d3bc..acf739fc4060 100644
+--- a/drivers/hid/hid-lg3ff.c
++++ b/drivers/hid/hid-lg3ff.c
+@@ -129,12 +129,19 @@ static const signed short ff3_joystick_ac[] = {
+
+ int lg3ff_init(struct hid_device *hid)
+ {
+- struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+- struct input_dev *dev = hidinput->input;
++ struct hid_input *hidinput;
++ struct input_dev *dev;
+ const signed short *ff_bits = ff3_joystick_ac;
+ int error;
+ int i;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_entry(hid->inputs.next, struct hid_input, list);
++ dev = hidinput->input;
++
+ /* Check that the report looks ok */
+ if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 35))
+ return -ENODEV;
+diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
+index 4b26928cb2b6..ef80c592b88a 100644
+--- a/drivers/hid/hid-lg4ff.c
++++ b/drivers/hid/hid-lg4ff.c
+@@ -1259,8 +1259,8 @@ static int lg4ff_handle_multimode_wheel(struct hid_device *hid, u16 *real_produc
+
+ int lg4ff_init(struct hid_device *hid)
+ {
+- struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+- struct input_dev *dev = hidinput->input;
++ struct hid_input *hidinput;
++ struct input_dev *dev;
+ struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+ struct hid_report *report = list_entry(report_list->next, struct hid_report, list);
+ const struct usb_device_descriptor *udesc = &(hid_to_usb_dev(hid)->descriptor);
+@@ -1272,6 +1272,13 @@ int lg4ff_init(struct hid_device *hid)
+ int mmode_ret, mmode_idx = -1;
+ u16 real_product_id;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_entry(hid->inputs.next, struct hid_input, list);
++ dev = hidinput->input;
++
+ /* Check that the report looks ok */
+ if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7))
+ return -1;
+diff --git a/drivers/hid/hid-lgff.c b/drivers/hid/hid-lgff.c
+index e1394af0ae7b..1871cdcd1e0a 100644
+--- a/drivers/hid/hid-lgff.c
++++ b/drivers/hid/hid-lgff.c
+@@ -127,12 +127,19 @@ static void hid_lgff_set_autocenter(struct input_dev *dev, u16 magnitude)
+
+ int lgff_init(struct hid_device* hid)
+ {
+- struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+- struct input_dev *dev = hidinput->input;
++ struct hid_input *hidinput;
++ struct input_dev *dev;
+ const signed short *ff_bits = ff_joystick;
+ int error;
+ int i;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_entry(hid->inputs.next, struct hid_input, list);
++ dev = hidinput->input;
++
+ /* Check that the report looks ok */
+ if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7))
+ return -ENODEV;
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index e642cfaf303b..034c883e57fa 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -1867,8 +1867,8 @@ static void hidpp_ff_destroy(struct ff_device *ff)
+ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
+ {
+ struct hid_device *hid = hidpp->hid_dev;
+- struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list);
+- struct input_dev *dev = hidinput->input;
++ struct hid_input *hidinput;
++ struct input_dev *dev;
+ const struct usb_device_descriptor *udesc = &(hid_to_usb_dev(hid)->descriptor);
+ const u16 bcdDevice = le16_to_cpu(udesc->bcdDevice);
+ struct ff_device *ff;
+@@ -1877,6 +1877,13 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
+ int error, j, num_slots;
+ u8 version;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_entry(hid->inputs.next, struct hid_input, list);
++ dev = hidinput->input;
++
+ if (!dev) {
+ hid_err(hid, "Struct input_dev not set!\n");
+ return -EINVAL;
+diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
+index 09f2c617b09f..d05c387a588e 100644
+--- a/drivers/hid/hid-sony.c
++++ b/drivers/hid/hid-sony.c
+@@ -2249,9 +2249,15 @@ static int sony_play_effect(struct input_dev *dev, void *data,
+
+ static int sony_init_ff(struct sony_sc *sc)
+ {
+- struct hid_input *hidinput = list_entry(sc->hdev->inputs.next,
+- struct hid_input, list);
+- struct input_dev *input_dev = hidinput->input;
++ struct hid_input *hidinput;
++ struct input_dev *input_dev;
++
++ if (list_empty(&sc->hdev->inputs)) {
++ hid_err(sc->hdev, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_entry(sc->hdev->inputs.next, struct hid_input, list);
++ input_dev = hidinput->input;
+
+ input_set_capability(input_dev, EV_FF, FF_RUMBLE);
+ return input_ff_create_memless(input_dev, NULL, sony_play_effect);
+diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
+index dc4128bfe2ca..8dae0f9b819e 100644
+--- a/drivers/hid/hid-steam.c
++++ b/drivers/hid/hid-steam.c
+@@ -283,11 +283,6 @@ static void steam_set_lizard_mode(struct steam_device *steam, bool enable)
+ static int steam_input_open(struct input_dev *dev)
+ {
+ struct steam_device *steam = input_get_drvdata(dev);
+- int ret;
+-
+- ret = hid_hw_open(steam->hdev);
+- if (ret)
+- return ret;
+
+ mutex_lock(&steam->mutex);
+ if (!steam->client_opened && lizard_mode)
+@@ -304,8 +299,6 @@ static void steam_input_close(struct input_dev *dev)
+ if (!steam->client_opened && lizard_mode)
+ steam_set_lizard_mode(steam, true);
+ mutex_unlock(&steam->mutex);
+-
+- hid_hw_close(steam->hdev);
+ }
+
+ static enum power_supply_property steam_battery_props[] = {
+@@ -506,6 +499,7 @@ static void steam_battery_unregister(struct steam_device *steam)
+ static int steam_register(struct steam_device *steam)
+ {
+ int ret;
++ bool client_opened;
+
+ /*
+ * This function can be called several times in a row with the
+@@ -518,9 +512,11 @@ static int steam_register(struct steam_device *steam)
+ * Unlikely, but getting the serial could fail, and it is not so
+ * important, so make up a serial number and go on.
+ */
++ mutex_lock(&steam->mutex);
+ if (steam_get_serial(steam) < 0)
+ strlcpy(steam->serial_no, "XXXXXXXXXX",
+ sizeof(steam->serial_no));
++ mutex_unlock(&steam->mutex);
+
+ hid_info(steam->hdev, "Steam Controller '%s' connected",
+ steam->serial_no);
+@@ -535,13 +531,15 @@ static int steam_register(struct steam_device *steam)
+ }
+
+ mutex_lock(&steam->mutex);
+- if (!steam->client_opened) {
++ client_opened = steam->client_opened;
++ if (!client_opened)
+ steam_set_lizard_mode(steam, lizard_mode);
++ mutex_unlock(&steam->mutex);
++
++ if (!client_opened)
+ ret = steam_input_register(steam);
+- } else {
++ else
+ ret = 0;
+- }
+- mutex_unlock(&steam->mutex);
+
+ return ret;
+ }
+@@ -623,11 +621,6 @@ static void steam_client_ll_stop(struct hid_device *hdev)
+ static int steam_client_ll_open(struct hid_device *hdev)
+ {
+ struct steam_device *steam = hdev->driver_data;
+- int ret;
+-
+- ret = hid_hw_open(steam->hdev);
+- if (ret)
+- return ret;
+
+ mutex_lock(&steam->mutex);
+ steam->client_opened = true;
+@@ -635,22 +628,28 @@ static int steam_client_ll_open(struct hid_device *hdev)
+
+ steam_input_unregister(steam);
+
+- return ret;
++ return 0;
+ }
+
+ static void steam_client_ll_close(struct hid_device *hdev)
+ {
+ struct steam_device *steam = hdev->driver_data;
+
++ unsigned long flags;
++ bool connected;
++
++ spin_lock_irqsave(&steam->lock, flags);
++ connected = steam->connected;
++ spin_unlock_irqrestore(&steam->lock, flags);
++
+ mutex_lock(&steam->mutex);
+ steam->client_opened = false;
++ if (connected)
++ steam_set_lizard_mode(steam, lizard_mode);
+ mutex_unlock(&steam->mutex);
+
+- hid_hw_close(steam->hdev);
+- if (steam->connected) {
+- steam_set_lizard_mode(steam, lizard_mode);
++ if (connected)
+ steam_input_register(steam);
+- }
+ }
+
+ static int steam_client_ll_raw_request(struct hid_device *hdev,
+@@ -759,14 +758,15 @@ static int steam_probe(struct hid_device *hdev,
+ if (ret)
+ goto client_hdev_add_fail;
+
++ ret = hid_hw_open(hdev);
++ if (ret) {
++ hid_err(hdev,
++ "%s:hid_hw_open\n",
++ __func__);
++ goto hid_hw_open_fail;
++ }
++
+ if (steam->quirks & STEAM_QUIRK_WIRELESS) {
+- ret = hid_hw_open(hdev);
+- if (ret) {
+- hid_err(hdev,
+- "%s:hid_hw_open for wireless\n",
+- __func__);
+- goto hid_hw_open_fail;
+- }
+ hid_info(hdev, "Steam wireless receiver connected");
+ steam_request_conn_status(steam);
+ } else {
+@@ -781,8 +781,8 @@ static int steam_probe(struct hid_device *hdev,
+
+ return 0;
+
+-hid_hw_open_fail:
+ input_register_fail:
++hid_hw_open_fail:
+ client_hdev_add_fail:
+ hid_hw_stop(hdev);
+ hid_hw_start_fail:
+@@ -809,8 +809,8 @@ static void steam_remove(struct hid_device *hdev)
+ cancel_work_sync(&steam->work_connect);
+ if (steam->quirks & STEAM_QUIRK_WIRELESS) {
+ hid_info(hdev, "Steam wireless receiver disconnected");
+- hid_hw_close(hdev);
+ }
++ hid_hw_close(hdev);
+ hid_hw_stop(hdev);
+ steam_unregister(steam);
+ }
+diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
+index 30b8c3256c99..efe8c2a0261e 100644
+--- a/drivers/hid/hid-tmff.c
++++ b/drivers/hid/hid-tmff.c
+@@ -136,12 +136,18 @@ static int tmff_init(struct hid_device *hid, const signed short *ff_bits)
+ struct tmff_device *tmff;
+ struct hid_report *report;
+ struct list_head *report_list;
+- struct hid_input *hidinput = list_entry(hid->inputs.next,
+- struct hid_input, list);
+- struct input_dev *input_dev = hidinput->input;
++ struct hid_input *hidinput;
++ struct input_dev *input_dev;
+ int error;
+ int i;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_entry(hid->inputs.next, struct hid_input, list);
++ input_dev = hidinput->input;
++
+ tmff = kzalloc(sizeof(struct tmff_device), GFP_KERNEL);
+ if (!tmff)
+ return -ENOMEM;
+diff --git a/drivers/hid/hid-zpff.c b/drivers/hid/hid-zpff.c
+index a29756c6ca02..4e7e01be99b1 100644
+--- a/drivers/hid/hid-zpff.c
++++ b/drivers/hid/hid-zpff.c
+@@ -66,11 +66,17 @@ static int zpff_init(struct hid_device *hid)
+ {
+ struct zpff_device *zpff;
+ struct hid_report *report;
+- struct hid_input *hidinput = list_entry(hid->inputs.next,
+- struct hid_input, list);
+- struct input_dev *dev = hidinput->input;
++ struct hid_input *hidinput;
++ struct input_dev *dev;
+ int i, error;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++ hidinput = list_entry(hid->inputs.next, struct hid_input, list);
++ dev = hidinput->input;
++
+ for (i = 0; i < 4; i++) {
+ report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, i, 1);
+ if (!report)
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 3cde7c1b9c33..2f940c1de616 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -50,6 +50,7 @@
+ #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(1)
+ #define I2C_HID_QUIRK_NO_RUNTIME_PM BIT(2)
+ #define I2C_HID_QUIRK_DELAY_AFTER_SLEEP BIT(3)
++#define I2C_HID_QUIRK_BOGUS_IRQ BIT(4)
+
+ /* flags */
+ #define I2C_HID_STARTED 0
+@@ -177,6 +178,10 @@ static const struct i2c_hid_quirks {
+ I2C_HID_QUIRK_NO_RUNTIME_PM },
+ { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33,
+ I2C_HID_QUIRK_DELAY_AFTER_SLEEP },
++ { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001,
++ I2C_HID_QUIRK_NO_RUNTIME_PM },
++ { USB_VENDOR_ID_ELAN, HID_ANY_ID,
++ I2C_HID_QUIRK_BOGUS_IRQ },
+ { 0, 0 }
+ };
+
+@@ -501,6 +506,12 @@ static void i2c_hid_get_input(struct i2c_hid *ihid)
+ return;
+ }
+
++ if (ihid->quirks & I2C_HID_QUIRK_BOGUS_IRQ && ret_size == 0xffff) {
++ dev_warn_once(&ihid->client->dev, "%s: IRQ triggered but "
++ "there's no data\n", __func__);
++ return;
++ }
++
+ if ((ret_size > size) || (ret_size < 2)) {
+ dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
+ __func__, size, ret_size);
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index cac262a912c1..10af8585c820 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -322,6 +322,25 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ /*
++ * There are at least 2 Primebook C11B versions, the older
++ * version has a product-name of "Primebook C11B", and a
++ * bios version / release / firmware revision of:
++ * V2.1.2 / 05/03/2018 / 18.2
++ * The new version has "PRIMEBOOK C11B" as product-name and a
++ * bios version / release / firmware revision of:
++ * CFALKSW05_BIOS_V1.1.2 / 11/19/2018 / 19.2
++ * Only the older version needs this quirk, note the newer
++ * version will not match as it has a different product-name.
++ */
++ .ident = "Trekstor Primebook C11B",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TREKSTOR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Primebook C11B"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ {
+ .ident = "Direkt-Tek DTLAPY116-2",
+ .matches = {
+@@ -330,6 +349,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ .ident = "Direkt-Tek DTLAPY133-1",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Direkt-Tek"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "DTLAPY133-1"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ {
+ .ident = "Mediacom Flexbook Edge 11",
+ .matches = {
+@@ -338,6 +365,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ .ident = "Odys Winbook 13",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AXDIA International GmbH"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "WINBOOK 13"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ { } /* Terminate list */
+ };
+
+diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
+index 383c802eb5b8..cb8c98a44010 100644
+--- a/drivers/iio/accel/bmc150-accel-core.c
++++ b/drivers/iio/accel/bmc150-accel-core.c
+@@ -125,7 +125,7 @@
+ #define BMC150_ACCEL_SLEEP_1_SEC 0x0F
+
+ #define BMC150_ACCEL_REG_TEMP 0x08
+-#define BMC150_ACCEL_TEMP_CENTER_VAL 24
++#define BMC150_ACCEL_TEMP_CENTER_VAL 23
+
+ #define BMC150_ACCEL_AXIS_TO_REG(axis) (BMC150_ACCEL_REG_XOUT_L + (axis * 2))
+ #define BMC150_AUTO_SUSPEND_DELAY_MS 2000
+diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
+index 5dd104cf0939..6e0ef9bb2497 100644
+--- a/drivers/iio/adc/meson_saradc.c
++++ b/drivers/iio/adc/meson_saradc.c
+@@ -1023,6 +1023,11 @@ static int meson_sar_adc_probe(struct platform_device *pdev)
+ if (IS_ERR(base))
+ return PTR_ERR(base);
+
++ priv->regmap = devm_regmap_init_mmio(&pdev->dev, base,
++ priv->data->param->regmap_config);
++ if (IS_ERR(priv->regmap))
++ return PTR_ERR(priv->regmap);
++
+ irq = irq_of_parse_and_map(pdev->dev.of_node, 0);
+ if (!irq)
+ return -EINVAL;
+@@ -1032,11 +1037,6 @@ static int meson_sar_adc_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
+- priv->regmap = devm_regmap_init_mmio(&pdev->dev, base,
+- priv->data->param->regmap_config);
+- if (IS_ERR(priv->regmap))
+- return PTR_ERR(priv->regmap);
+-
+ priv->clkin = devm_clk_get(&pdev->dev, "clkin");
+ if (IS_ERR(priv->clkin)) {
+ dev_err(&pdev->dev, "failed to get clkin\n");
+diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c
+index 76643c5571aa..e59d0438de73 100644
+--- a/drivers/iio/imu/adis_buffer.c
++++ b/drivers/iio/imu/adis_buffer.c
+@@ -39,8 +39,11 @@ int adis_update_scan_mode(struct iio_dev *indio_dev,
+ return -ENOMEM;
+
+ adis->buffer = kcalloc(indio_dev->scan_bytes, 2, GFP_KERNEL);
+- if (!adis->buffer)
++ if (!adis->buffer) {
++ kfree(adis->xfer);
++ adis->xfer = NULL;
+ return -ENOMEM;
++ }
+
+ rx = adis->buffer;
+ tx = rx + scan_count;
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 6257be21cbed..1f373ba573b6 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2270,9 +2270,10 @@ static int iw_conn_req_handler(struct iw_cm_id *cm_id,
+ conn_id->cm_id.iw = NULL;
+ cma_exch(conn_id, RDMA_CM_DESTROYING);
+ mutex_unlock(&conn_id->handler_mutex);
++ mutex_unlock(&listen_id->handler_mutex);
+ cma_deref_id(conn_id);
+ rdma_destroy_id(&conn_id->id);
+- goto out;
++ return ret;
+ }
+
+ mutex_unlock(&conn_id->handler_mutex);
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index d648a4167832..64ab92f8a4a2 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -1518,8 +1518,11 @@ int sdma_init(struct hfi1_devdata *dd, u8 port)
+ }
+
+ ret = rhashtable_init(tmp_sdma_rht, &sdma_rht_params);
+- if (ret < 0)
++ if (ret < 0) {
++ kfree(tmp_sdma_rht);
+ goto bail;
++ }
++
+ dd->sdma_rht = tmp_sdma_rht;
+
+ dd_dev_info(dd, "SDMA num_sdma: %u\n", dd->num_sdma);
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index 5bb81e564ce8..3e8d1f1b562f 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -289,7 +289,9 @@ STORE(__cached_dev)
+ sysfs_strtoul_clamp(writeback_rate_p_term_inverse,
+ dc->writeback_rate_p_term_inverse,
+ 1, UINT_MAX);
+- d_strtoul_nonzero(writeback_rate_minimum);
++ sysfs_strtoul_clamp(writeback_rate_minimum,
++ dc->writeback_rate_minimum,
++ 1, UINT_MAX);
+
+ sysfs_strtoul_clamp(io_error_limit, dc->error_limit, 0, INT_MAX);
+
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index 36805b12661e..d3f28a9e3fd9 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -19,7 +19,6 @@
+ #include <linux/vmalloc.h>
+ #include <linux/log2.h>
+ #include <linux/dm-kcopyd.h>
+-#include <linux/semaphore.h>
+
+ #include "dm.h"
+
+@@ -106,8 +105,8 @@ struct dm_snapshot {
+ /* The on disk metadata handler */
+ struct dm_exception_store *store;
+
+- /* Maximum number of in-flight COW jobs. */
+- struct semaphore cow_count;
++ unsigned in_progress;
++ struct wait_queue_head in_progress_wait;
+
+ struct dm_kcopyd_client *kcopyd_client;
+
+@@ -158,8 +157,8 @@ struct dm_snapshot {
+ */
+ #define DEFAULT_COW_THRESHOLD 2048
+
+-static int cow_threshold = DEFAULT_COW_THRESHOLD;
+-module_param_named(snapshot_cow_threshold, cow_threshold, int, 0644);
++static unsigned cow_threshold = DEFAULT_COW_THRESHOLD;
++module_param_named(snapshot_cow_threshold, cow_threshold, uint, 0644);
+ MODULE_PARM_DESC(snapshot_cow_threshold, "Maximum number of chunks being copied on write");
+
+ DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle,
+@@ -1207,7 +1206,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ goto bad_hash_tables;
+ }
+
+- sema_init(&s->cow_count, (cow_threshold > 0) ? cow_threshold : INT_MAX);
++ init_waitqueue_head(&s->in_progress_wait);
+
+ s->kcopyd_client = dm_kcopyd_client_create(&dm_kcopyd_throttle);
+ if (IS_ERR(s->kcopyd_client)) {
+@@ -1396,9 +1395,56 @@ static void snapshot_dtr(struct dm_target *ti)
+
+ dm_put_device(ti, s->origin);
+
++ WARN_ON(s->in_progress);
++
+ kfree(s);
+ }
+
++static void account_start_copy(struct dm_snapshot *s)
++{
++ spin_lock(&s->in_progress_wait.lock);
++ s->in_progress++;
++ spin_unlock(&s->in_progress_wait.lock);
++}
++
++static void account_end_copy(struct dm_snapshot *s)
++{
++ spin_lock(&s->in_progress_wait.lock);
++ BUG_ON(!s->in_progress);
++ s->in_progress--;
++ if (likely(s->in_progress <= cow_threshold) &&
++ unlikely(waitqueue_active(&s->in_progress_wait)))
++ wake_up_locked(&s->in_progress_wait);
++ spin_unlock(&s->in_progress_wait.lock);
++}
++
++static bool wait_for_in_progress(struct dm_snapshot *s, bool unlock_origins)
++{
++ if (unlikely(s->in_progress > cow_threshold)) {
++ spin_lock(&s->in_progress_wait.lock);
++ if (likely(s->in_progress > cow_threshold)) {
++ /*
++ * NOTE: this throttle doesn't account for whether
++ * the caller is servicing an IO that will trigger a COW
++ * so excess throttling may result for chunks not required
++ * to be COW'd. But if cow_threshold was reached, extra
++ * throttling is unlikely to negatively impact performance.
++ */
++ DECLARE_WAITQUEUE(wait, current);
++ __add_wait_queue(&s->in_progress_wait, &wait);
++ __set_current_state(TASK_UNINTERRUPTIBLE);
++ spin_unlock(&s->in_progress_wait.lock);
++ if (unlock_origins)
++ up_read(&_origins_lock);
++ io_schedule();
++ remove_wait_queue(&s->in_progress_wait, &wait);
++ return false;
++ }
++ spin_unlock(&s->in_progress_wait.lock);
++ }
++ return true;
++}
++
+ /*
+ * Flush a list of buffers.
+ */
+@@ -1414,7 +1460,7 @@ static void flush_bios(struct bio *bio)
+ }
+ }
+
+-static int do_origin(struct dm_dev *origin, struct bio *bio);
++static int do_origin(struct dm_dev *origin, struct bio *bio, bool limit);
+
+ /*
+ * Flush a list of buffers.
+@@ -1427,7 +1473,7 @@ static void retry_origin_bios(struct dm_snapshot *s, struct bio *bio)
+ while (bio) {
+ n = bio->bi_next;
+ bio->bi_next = NULL;
+- r = do_origin(s->origin, bio);
++ r = do_origin(s->origin, bio, false);
+ if (r == DM_MAPIO_REMAPPED)
+ generic_make_request(bio);
+ bio = n;
+@@ -1594,7 +1640,7 @@ static void copy_callback(int read_err, unsigned long write_err, void *context)
+ rb_link_node(&pe->out_of_order_node, parent, p);
+ rb_insert_color(&pe->out_of_order_node, &s->out_of_order_tree);
+ }
+- up(&s->cow_count);
++ account_end_copy(s);
+ }
+
+ /*
+@@ -1618,7 +1664,7 @@ static void start_copy(struct dm_snap_pending_exception *pe)
+ dest.count = src.count;
+
+ /* Hand over to kcopyd */
+- down(&s->cow_count);
++ account_start_copy(s);
+ dm_kcopyd_copy(s->kcopyd_client, &src, 1, &dest, 0, copy_callback, pe);
+ }
+
+@@ -1638,7 +1684,7 @@ static void start_full_bio(struct dm_snap_pending_exception *pe,
+ pe->full_bio = bio;
+ pe->full_bio_end_io = bio->bi_end_io;
+
+- down(&s->cow_count);
++ account_start_copy(s);
+ callback_data = dm_kcopyd_prepare_callback(s->kcopyd_client,
+ copy_callback, pe);
+
+@@ -1729,6 +1775,11 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio)
+ if (!s->valid)
+ return DM_MAPIO_KILL;
+
++ if (bio_data_dir(bio) == WRITE) {
++ while (unlikely(!wait_for_in_progress(s, false)))
++ ; /* wait_for_in_progress() has slept */
++ }
++
+ mutex_lock(&s->lock);
+
+ if (!s->valid || (unlikely(s->snapshot_overflowed) &&
+@@ -1877,7 +1928,7 @@ redirect_to_origin:
+
+ if (bio_data_dir(bio) == WRITE) {
+ mutex_unlock(&s->lock);
+- return do_origin(s->origin, bio);
++ return do_origin(s->origin, bio, false);
+ }
+
+ out_unlock:
+@@ -2214,15 +2265,24 @@ next_snapshot:
+ /*
+ * Called on a write from the origin driver.
+ */
+-static int do_origin(struct dm_dev *origin, struct bio *bio)
++static int do_origin(struct dm_dev *origin, struct bio *bio, bool limit)
+ {
+ struct origin *o;
+ int r = DM_MAPIO_REMAPPED;
+
++again:
+ down_read(&_origins_lock);
+ o = __lookup_origin(origin->bdev);
+- if (o)
++ if (o) {
++ if (limit) {
++ struct dm_snapshot *s;
++ list_for_each_entry(s, &o->snapshots, list)
++ if (unlikely(!wait_for_in_progress(s, true)))
++ goto again;
++ }
++
+ r = __origin_write(&o->snapshots, bio->bi_iter.bi_sector, bio);
++ }
+ up_read(&_origins_lock);
+
+ return r;
+@@ -2335,7 +2395,7 @@ static int origin_map(struct dm_target *ti, struct bio *bio)
+ dm_accept_partial_bio(bio, available_sectors);
+
+ /* Only tell snapshots if this is a write */
+- return do_origin(o->dev, bio);
++ return do_origin(o->dev, bio, true);
+ }
+
+ static long origin_dax_direct_access(struct dm_target *ti, pgoff_t pgoff,
+diff --git a/drivers/media/platform/vimc/vimc-sensor.c b/drivers/media/platform/vimc/vimc-sensor.c
+index 9e0d70e9f119..3f0ffd4915cd 100644
+--- a/drivers/media/platform/vimc/vimc-sensor.c
++++ b/drivers/media/platform/vimc/vimc-sensor.c
+@@ -204,13 +204,6 @@ static void *vimc_sen_process_frame(struct vimc_ent_device *ved,
+ {
+ struct vimc_sen_device *vsen = container_of(ved, struct vimc_sen_device,
+ ved);
+- const struct vimc_pix_map *vpix;
+- unsigned int frame_size;
+-
+- /* Calculate the frame size */
+- vpix = vimc_pix_map_by_code(vsen->mbus_format.code);
+- frame_size = vsen->mbus_format.width * vpix->bpp *
+- vsen->mbus_format.height;
+
+ tpg_fill_plane_buffer(&vsen->tpg, 0, 0, vsen->frame);
+ return vsen->frame;
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 0d2392c4b625..2804e2d1ae5e 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4033,7 +4033,7 @@ out:
+ * this to-be-skipped slave to send a packet out.
+ */
+ old_arr = rtnl_dereference(bond->slave_arr);
+- for (idx = 0; idx < old_arr->count; idx++) {
++ for (idx = 0; old_arr != NULL && idx < old_arr->count; idx++) {
+ if (skipslave == old_arr->arr[idx]) {
+ old_arr->arr[idx] =
+ old_arr->arr[old_arr->count-1];
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 703e6bdaf0e1..d075f0f7a3de 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -456,10 +456,12 @@ static int mv88e6xxx_g1_irq_setup(struct mv88e6xxx_chip *chip)
+ */
+ irq_set_lockdep_class(chip->irq, &lock_key, &request_key);
+
++ mutex_unlock(&chip->reg_lock);
+ err = request_threaded_irq(chip->irq, NULL,
+ mv88e6xxx_g1_irq_thread_fn,
+ IRQF_ONESHOT,
+ dev_name(chip->dev), chip);
++ mutex_lock(&chip->reg_lock);
+ if (err)
+ mv88e6xxx_g1_irq_free_common(chip);
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index ee126bcf7c35..ccd9aca281b3 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -4410,9 +4410,6 @@ static int mlxsw_sp_port_lag_join(struct mlxsw_sp_port *mlxsw_sp_port,
+ err = mlxsw_sp_lag_col_port_add(mlxsw_sp_port, lag_id, port_index);
+ if (err)
+ goto err_col_port_add;
+- err = mlxsw_sp_lag_col_port_enable(mlxsw_sp_port, lag_id);
+- if (err)
+- goto err_col_port_enable;
+
+ mlxsw_core_lag_mapping_set(mlxsw_sp->core, lag_id, port_index,
+ mlxsw_sp_port->local_port);
+@@ -4427,8 +4424,6 @@ static int mlxsw_sp_port_lag_join(struct mlxsw_sp_port *mlxsw_sp_port,
+
+ return 0;
+
+-err_col_port_enable:
+- mlxsw_sp_lag_col_port_remove(mlxsw_sp_port, lag_id);
+ err_col_port_add:
+ if (!lag->ref_count)
+ mlxsw_sp_lag_destroy(mlxsw_sp, lag_id);
+@@ -4447,7 +4442,6 @@ static void mlxsw_sp_port_lag_leave(struct mlxsw_sp_port *mlxsw_sp_port,
+ lag = mlxsw_sp_lag_get(mlxsw_sp, lag_id);
+ WARN_ON(lag->ref_count == 0);
+
+- mlxsw_sp_lag_col_port_disable(mlxsw_sp_port, lag_id);
+ mlxsw_sp_lag_col_port_remove(mlxsw_sp_port, lag_id);
+
+ /* Any VLANs configured on the port are no longer valid */
+@@ -4492,21 +4486,56 @@ static int mlxsw_sp_lag_dist_port_remove(struct mlxsw_sp_port *mlxsw_sp_port,
+ return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sldr), sldr_pl);
+ }
+
+-static int mlxsw_sp_port_lag_tx_en_set(struct mlxsw_sp_port *mlxsw_sp_port,
+- bool lag_tx_enabled)
++static int
++mlxsw_sp_port_lag_col_dist_enable(struct mlxsw_sp_port *mlxsw_sp_port)
+ {
+- if (lag_tx_enabled)
+- return mlxsw_sp_lag_dist_port_add(mlxsw_sp_port,
+- mlxsw_sp_port->lag_id);
+- else
+- return mlxsw_sp_lag_dist_port_remove(mlxsw_sp_port,
+- mlxsw_sp_port->lag_id);
++ int err;
++
++ err = mlxsw_sp_lag_col_port_enable(mlxsw_sp_port,
++ mlxsw_sp_port->lag_id);
++ if (err)
++ return err;
++
++ err = mlxsw_sp_lag_dist_port_add(mlxsw_sp_port, mlxsw_sp_port->lag_id);
++ if (err)
++ goto err_dist_port_add;
++
++ return 0;
++
++err_dist_port_add:
++ mlxsw_sp_lag_col_port_disable(mlxsw_sp_port, mlxsw_sp_port->lag_id);
++ return err;
++}
++
++static int
++mlxsw_sp_port_lag_col_dist_disable(struct mlxsw_sp_port *mlxsw_sp_port)
++{
++ int err;
++
++ err = mlxsw_sp_lag_dist_port_remove(mlxsw_sp_port,
++ mlxsw_sp_port->lag_id);
++ if (err)
++ return err;
++
++ err = mlxsw_sp_lag_col_port_disable(mlxsw_sp_port,
++ mlxsw_sp_port->lag_id);
++ if (err)
++ goto err_col_port_disable;
++
++ return 0;
++
++err_col_port_disable:
++ mlxsw_sp_lag_dist_port_add(mlxsw_sp_port, mlxsw_sp_port->lag_id);
++ return err;
+ }
+
+ static int mlxsw_sp_port_lag_changed(struct mlxsw_sp_port *mlxsw_sp_port,
+ struct netdev_lag_lower_state_info *info)
+ {
+- return mlxsw_sp_port_lag_tx_en_set(mlxsw_sp_port, info->tx_enabled);
++ if (info->tx_enabled)
++ return mlxsw_sp_port_lag_col_dist_enable(mlxsw_sp_port);
++ else
++ return mlxsw_sp_port_lag_col_dist_disable(mlxsw_sp_port);
+ }
+
+ static int mlxsw_sp_port_stp_set(struct mlxsw_sp_port *mlxsw_sp_port,
+@@ -4668,8 +4697,7 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
+ err = mlxsw_sp_port_lag_join(mlxsw_sp_port,
+ upper_dev);
+ } else {
+- mlxsw_sp_port_lag_tx_en_set(mlxsw_sp_port,
+- false);
++ mlxsw_sp_port_lag_col_dist_disable(mlxsw_sp_port);
+ mlxsw_sp_port_lag_leave(mlxsw_sp_port,
+ upper_dev);
+ }
+diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
+index 35f39f23d881..8f8c9ede88c2 100644
+--- a/drivers/net/usb/sr9800.c
++++ b/drivers/net/usb/sr9800.c
+@@ -336,7 +336,7 @@ static void sr_set_multicast(struct net_device *net)
+ static int sr_mdio_read(struct net_device *net, int phy_id, int loc)
+ {
+ struct usbnet *dev = netdev_priv(net);
+- __le16 res;
++ __le16 res = 0;
+
+ mutex_lock(&dev->phy_mutex);
+ sr_set_sw_mii(dev);
+diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
+index 5210cffb5344..2791ef2fd716 100644
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -532,7 +532,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .hw_ops = &wcn3990_ops,
+ .decap_align_bytes = 1,
+ .num_peers = TARGET_HL_10_TLV_NUM_PEERS,
+- .n_cipher_suites = 8,
++ .n_cipher_suites = 11,
+ .ast_skid_limit = TARGET_HL_10_TLV_AST_SKID_LIMIT,
+ .num_wds_entries = TARGET_HL_10_TLV_NUM_WDS_ENTRIES,
+ .target_64bit = true,
+diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
+index 4defb7a0330f..53b66e9434c9 100644
+--- a/drivers/net/wireless/ath/ath6kl/usb.c
++++ b/drivers/net/wireless/ath/ath6kl/usb.c
+@@ -132,6 +132,10 @@ ath6kl_usb_alloc_urb_from_pipe(struct ath6kl_usb_pipe *pipe)
+ struct ath6kl_urb_context *urb_context = NULL;
+ unsigned long flags;
+
++ /* bail if this pipe is not initialized */
++ if (!pipe->ar_usb)
++ return NULL;
++
+ spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags);
+ if (!list_empty(&pipe->urb_list_head)) {
+ urb_context =
+@@ -150,6 +154,10 @@ static void ath6kl_usb_free_urb_to_pipe(struct ath6kl_usb_pipe *pipe,
+ {
+ unsigned long flags;
+
++ /* bail if this pipe is not initialized */
++ if (!pipe->ar_usb)
++ return;
++
+ spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags);
+ pipe->urb_cnt++;
+
+diff --git a/drivers/net/wireless/ath/wil6210/txrx_edma.c b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+index 3e7fc2983cbb..409a6fa8b6c8 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx_edma.c
++++ b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+@@ -234,9 +234,10 @@ static int wil_rx_refill_edma(struct wil6210_priv *wil)
+ struct wil_ring *ring = &wil->ring_rx;
+ u32 next_head;
+ int rc = 0;
+- u32 swtail = *ring->edma_rx_swtail.va;
++ ring->swtail = *ring->edma_rx_swtail.va;
+
+- for (; next_head = wil_ring_next_head(ring), (next_head != swtail);
++ for (; next_head = wil_ring_next_head(ring),
++ (next_head != ring->swtail);
+ ring->swhead = next_head) {
+ rc = wil_ring_alloc_skb_edma(wil, ring, ring->swhead);
+ if (unlikely(rc)) {
+@@ -264,43 +265,26 @@ static void wil_move_all_rx_buff_to_free_list(struct wil6210_priv *wil,
+ struct wil_ring *ring)
+ {
+ struct device *dev = wil_to_dev(wil);
+- u32 next_tail;
+- u32 swhead = (ring->swhead + 1) % ring->size;
++ struct list_head *active = &wil->rx_buff_mgmt.active;
+ dma_addr_t pa;
+- u16 dmalen;
+
+- for (; next_tail = wil_ring_next_tail(ring), (next_tail != swhead);
+- ring->swtail = next_tail) {
+- struct wil_rx_enhanced_desc dd, *d = ⅆ
+- struct wil_rx_enhanced_desc *_d =
+- (struct wil_rx_enhanced_desc *)
+- &ring->va[ring->swtail].rx.enhanced;
+- struct sk_buff *skb;
+- u16 buff_id;
++ while (!list_empty(active)) {
++ struct wil_rx_buff *rx_buff =
++ list_first_entry(active, struct wil_rx_buff, list);
++ struct sk_buff *skb = rx_buff->skb;
+
+- *d = *_d;
+-
+- /* Extract the SKB from the rx_buff management array */
+- buff_id = __le16_to_cpu(d->mac.buff_id);
+- if (buff_id >= wil->rx_buff_mgmt.size) {
+- wil_err(wil, "invalid buff_id %d\n", buff_id);
+- continue;
+- }
+- skb = wil->rx_buff_mgmt.buff_arr[buff_id].skb;
+- wil->rx_buff_mgmt.buff_arr[buff_id].skb = NULL;
+ if (unlikely(!skb)) {
+- wil_err(wil, "No Rx skb at buff_id %d\n", buff_id);
++ wil_err(wil, "No Rx skb at buff_id %d\n", rx_buff->id);
+ } else {
+- pa = wil_rx_desc_get_addr_edma(&d->dma);
+- dmalen = le16_to_cpu(d->dma.length);
+- dma_unmap_single(dev, pa, dmalen, DMA_FROM_DEVICE);
+-
++ rx_buff->skb = NULL;
++ memcpy(&pa, skb->cb, sizeof(pa));
++ dma_unmap_single(dev, pa, wil->rx_buf_len,
++ DMA_FROM_DEVICE);
+ kfree_skb(skb);
+ }
+
+ /* Move the buffer from the active to the free list */
+- list_move(&wil->rx_buff_mgmt.buff_arr[buff_id].list,
+- &wil->rx_buff_mgmt.free);
++ list_move(&rx_buff->list, &wil->rx_buff_mgmt.free);
+ }
+ }
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 9cb9f0544c9b..2eba6d6f367f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -843,15 +843,17 @@ static bool iwl_mvm_sar_geo_support(struct iwl_mvm *mvm)
+ * firmware versions. Unfortunately, we don't have a TLV API
+ * flag to rely on, so rely on the major version which is in
+ * the first byte of ucode_ver. This was implemented
+- * initially on version 38 and then backported to29 and 17.
+- * The intention was to have it in 36 as well, but not all
+- * 8000 family got this feature enabled. The 8000 family is
+- * the only one using version 36, so skip this version
+- * entirely.
++ * initially on version 38 and then backported to 17. It was
++ * also backported to 29, but only for 7265D devices. The
++ * intention was to have it in 36 as well, but not all 8000
++ * family got this feature enabled. The 8000 family is the
++ * only one using version 36, so skip this version entirely.
+ */
+ return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 38 ||
+- IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 ||
+- IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17;
++ IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17 ||
++ (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 &&
++ ((mvm->trans->hw_rev & CSR_HW_REV_TYPE_MSK) ==
++ CSR_HW_REV_TYPE_7265D));
+ }
+
+ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
+index 479a4cfc245d..5f998ea2d5a6 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
+@@ -775,6 +775,9 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
+ return;
+ } else {
+ noa_num = (noa_len - 2) / 13;
++ if (noa_num > P2P_MAX_NOA_NUM)
++ noa_num = P2P_MAX_NOA_NUM;
++
+ }
+ noa_index = ie[3];
+ if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
+@@ -869,6 +872,9 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
+ return;
+ } else {
+ noa_num = (noa_len - 2) / 13;
++ if (noa_num > P2P_MAX_NOA_NUM)
++ noa_num = P2P_MAX_NOA_NUM;
++
+ }
+ noa_index = ie[3];
+ if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
+diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c
+index 5d823e965883..fcb57d64d97e 100644
+--- a/drivers/nfc/pn533/usb.c
++++ b/drivers/nfc/pn533/usb.c
+@@ -559,18 +559,25 @@ static int pn533_usb_probe(struct usb_interface *interface,
+
+ rc = pn533_finalize_setup(priv);
+ if (rc)
+- goto error;
++ goto err_deregister;
+
+ usb_set_intfdata(interface, phy);
+
+ return 0;
+
++err_deregister:
++ pn533_unregister_device(phy->priv);
+ error:
++ usb_kill_urb(phy->in_urb);
++ usb_kill_urb(phy->out_urb);
++ usb_kill_urb(phy->ack_urb);
++
+ usb_free_urb(phy->in_urb);
+ usb_free_urb(phy->out_urb);
+ usb_free_urb(phy->ack_urb);
+ usb_put_dev(phy->udev);
+ kfree(in_buf);
++ kfree(phy->ack_buffer);
+
+ return rc;
+ }
+diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c
+index e85c5a8206c4..6ac17f0c4077 100644
+--- a/drivers/pci/pcie/pme.c
++++ b/drivers/pci/pcie/pme.c
+@@ -437,6 +437,7 @@ static void pcie_pme_remove(struct pcie_device *srv)
+
+ pcie_pme_disable_interrupt(srv->port, data);
+ free_irq(srv->irq, srv);
++ cancel_work_sync(&data->work);
+ kfree(data);
+ }
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 06be52912dcd..64933994f772 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5083,8 +5083,8 @@ static void quirk_switchtec_ntb_dma_alias(struct pci_dev *pdev)
+ pci_disable_device(pdev);
+ }
+ #define SWITCHTEC_QUIRK(vid) \
+- DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, vid, \
+- quirk_switchtec_ntb_dma_alias)
++ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_MICROSEMI, vid, \
++ PCI_CLASS_BRIDGE_OTHER, 8, quirk_switchtec_ntb_dma_alias)
+
+ SWITCHTEC_QUIRK(0x8531); /* PFX 24xG3 */
+ SWITCHTEC_QUIRK(0x8532); /* PFX 32xG3 */
+diff --git a/drivers/platform/x86/intel_atomisp2_pm.c b/drivers/platform/x86/intel_atomisp2_pm.c
+index 9371603a0ac9..b0f421fea2a5 100644
+--- a/drivers/platform/x86/intel_atomisp2_pm.c
++++ b/drivers/platform/x86/intel_atomisp2_pm.c
+@@ -33,46 +33,45 @@
+ #define ISPSSPM0_IUNIT_POWER_ON 0x0
+ #define ISPSSPM0_IUNIT_POWER_OFF 0x3
+
+-static int isp_probe(struct pci_dev *dev, const struct pci_device_id *id)
++static int isp_set_power(struct pci_dev *dev, bool enable)
+ {
+ unsigned long timeout;
+- u32 val;
+-
+- pci_write_config_dword(dev, PCI_INTERRUPT_CTRL, 0);
+-
+- /*
+- * MRFLD IUNIT DPHY is located in an always-power-on island
+- * MRFLD HW design need all CSI ports are disabled before
+- * powering down the IUNIT.
+- */
+- pci_read_config_dword(dev, PCI_CSI_CONTROL, &val);
+- val |= PCI_CSI_CONTROL_PORTS_OFF_MASK;
+- pci_write_config_dword(dev, PCI_CSI_CONTROL, val);
++ u32 val = enable ? ISPSSPM0_IUNIT_POWER_ON :
++ ISPSSPM0_IUNIT_POWER_OFF;
+
+- /* Write 0x3 to ISPSSPM0 bit[1:0] to power off the IUNIT */
++ /* Write to ISPSSPM0 bit[1:0] to power on/off the IUNIT */
+ iosf_mbi_modify(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0,
+- ISPSSPM0_IUNIT_POWER_OFF, ISPSSPM0_ISPSSC_MASK);
++ val, ISPSSPM0_ISPSSC_MASK);
+
+ /*
+ * There should be no IUNIT access while power-down is
+ * in progress HW sighting: 4567865
+ * Wait up to 50 ms for the IUNIT to shut down.
++ * And we do the same for power on.
+ */
+ timeout = jiffies + msecs_to_jiffies(50);
+ while (1) {
+- /* Wait until ISPSSPM0 bit[25:24] shows 0x3 */
+- iosf_mbi_read(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0, &val);
+- val = (val & ISPSSPM0_ISPSSS_MASK) >> ISPSSPM0_ISPSSS_OFFSET;
+- if (val == ISPSSPM0_IUNIT_POWER_OFF)
++ u32 tmp;
++
++ /* Wait until ISPSSPM0 bit[25:24] shows the right value */
++ iosf_mbi_read(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0, &tmp);
++ tmp = (tmp & ISPSSPM0_ISPSSS_MASK) >> ISPSSPM0_ISPSSS_OFFSET;
++ if (tmp == val)
+ break;
+
+ if (time_after(jiffies, timeout)) {
+- dev_err(&dev->dev, "IUNIT power-off timeout.\n");
++ dev_err(&dev->dev, "IUNIT power-%s timeout.\n",
++ enable ? "on" : "off");
+ return -EBUSY;
+ }
+ usleep_range(1000, 2000);
+ }
+
++ return 0;
++}
++
++static int isp_probe(struct pci_dev *dev, const struct pci_device_id *id)
++{
+ pm_runtime_allow(&dev->dev);
+ pm_runtime_put_sync_suspend(&dev->dev);
+
+@@ -87,11 +86,40 @@ static void isp_remove(struct pci_dev *dev)
+
+ static int isp_pci_suspend(struct device *dev)
+ {
++ struct pci_dev *pdev = to_pci_dev(dev);
++ u32 val;
++
++ pci_write_config_dword(pdev, PCI_INTERRUPT_CTRL, 0);
++
++ /*
++ * MRFLD IUNIT DPHY is located in an always-power-on island
++ * MRFLD HW design need all CSI ports are disabled before
++ * powering down the IUNIT.
++ */
++ pci_read_config_dword(pdev, PCI_CSI_CONTROL, &val);
++ val |= PCI_CSI_CONTROL_PORTS_OFF_MASK;
++ pci_write_config_dword(pdev, PCI_CSI_CONTROL, val);
++
++ /*
++ * We lose config space access when punit power gates
++ * the ISP. Can't use pci_set_power_state() because
++ * pmcsr won't actually change when we write to it.
++ */
++ pci_save_state(pdev);
++ pdev->current_state = PCI_D3cold;
++ isp_set_power(pdev, false);
++
+ return 0;
+ }
+
+ static int isp_pci_resume(struct device *dev)
+ {
++ struct pci_dev *pdev = to_pci_dev(dev);
++
++ isp_set_power(pdev, true);
++ pdev->current_state = PCI_D0;
++ pci_restore_state(pdev);
++
+ return 0;
+ }
+
+@@ -99,6 +127,7 @@ static UNIVERSAL_DEV_PM_OPS(isp_pm_ops, isp_pci_suspend,
+ isp_pci_resume, NULL);
+
+ static const struct pci_device_id isp_id_table[] = {
++ { PCI_VDEVICE(INTEL, 0x0f38), },
+ { PCI_VDEVICE(INTEL, 0x22b8), },
+ { 0, }
+ };
+diff --git a/drivers/power/supply/max14656_charger_detector.c b/drivers/power/supply/max14656_charger_detector.c
+index d19307f791c6..9e6472834e37 100644
+--- a/drivers/power/supply/max14656_charger_detector.c
++++ b/drivers/power/supply/max14656_charger_detector.c
+@@ -240,6 +240,14 @@ static enum power_supply_property max14656_battery_props[] = {
+ POWER_SUPPLY_PROP_MANUFACTURER,
+ };
+
++static void stop_irq_work(void *data)
++{
++ struct max14656_chip *chip = data;
++
++ cancel_delayed_work_sync(&chip->irq_work);
++}
++
++
+ static int max14656_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+@@ -278,8 +286,6 @@ static int max14656_probe(struct i2c_client *client,
+ if (ret)
+ return -ENODEV;
+
+- INIT_DELAYED_WORK(&chip->irq_work, max14656_irq_worker);
+-
+ chip->detect_psy = devm_power_supply_register(dev,
+ &chip->psy_desc, &psy_cfg);
+ if (IS_ERR(chip->detect_psy)) {
+@@ -287,6 +293,13 @@ static int max14656_probe(struct i2c_client *client,
+ return -EINVAL;
+ }
+
++ INIT_DELAYED_WORK(&chip->irq_work, max14656_irq_worker);
++ ret = devm_add_action(dev, stop_irq_work, chip);
++ if (ret) {
++ dev_err(dev, "devm_add_action %d failed\n", ret);
++ return ret;
++ }
++
+ ret = devm_request_irq(dev, chip->irq, max14656_irq,
+ IRQF_TRIGGER_FALLING,
+ MAX14656_NAME, chip);
+diff --git a/drivers/rtc/rtc-pcf8523.c b/drivers/rtc/rtc-pcf8523.c
+index 3fcd2cbafc84..2e03021f15d1 100644
+--- a/drivers/rtc/rtc-pcf8523.c
++++ b/drivers/rtc/rtc-pcf8523.c
+@@ -97,8 +97,9 @@ static int pcf8523_voltage_low(struct i2c_client *client)
+ return !!(value & REG_CONTROL3_BLF);
+ }
+
+-static int pcf8523_select_capacitance(struct i2c_client *client, bool high)
++static int pcf8523_load_capacitance(struct i2c_client *client)
+ {
++ u32 load;
+ u8 value;
+ int err;
+
+@@ -106,14 +107,24 @@ static int pcf8523_select_capacitance(struct i2c_client *client, bool high)
+ if (err < 0)
+ return err;
+
+- if (!high)
+- value &= ~REG_CONTROL1_CAP_SEL;
+- else
++ load = 12500;
++ of_property_read_u32(client->dev.of_node, "quartz-load-femtofarads",
++ &load);
++
++ switch (load) {
++ default:
++ dev_warn(&client->dev, "Unknown quartz-load-femtofarads value: %d. Assuming 12500",
++ load);
++ /* fall through */
++ case 12500:
+ value |= REG_CONTROL1_CAP_SEL;
++ break;
++ case 7000:
++ value &= ~REG_CONTROL1_CAP_SEL;
++ break;
++ }
+
+ err = pcf8523_write(client, REG_CONTROL1, value);
+- if (err < 0)
+- return err;
+
+ return err;
+ }
+@@ -347,9 +358,10 @@ static int pcf8523_probe(struct i2c_client *client,
+ if (!pcf)
+ return -ENOMEM;
+
+- err = pcf8523_select_capacitance(client, true);
++ err = pcf8523_load_capacitance(client);
+ if (err < 0)
+- return err;
++ dev_warn(&client->dev, "failed to set xtal load capacitance: %d",
++ err);
+
+ err = pcf8523_set_pm(client, 0);
+ if (err < 0)
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index e2575c8ec93e..22efefcc6cd8 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -1713,7 +1713,11 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
+ }
+ tgtp->tport_unreg_cmp = &tport_unreg_cmp;
+ nvmet_fc_unregister_targetport(phba->targetport);
+- wait_for_completion_timeout(&tport_unreg_cmp, 5);
++ if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp,
++ msecs_to_jiffies(LPFC_NVMET_WAIT_TMO)))
++ lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
++ "6179 Unreg targetport %p timeout "
++ "reached.\n", phba->targetport);
+ lpfc_nvmet_cleanup_io_context(phba);
+ }
+ phba->targetport = NULL;
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
+index 0ec1082ce7ef..3b170284a0e5 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.h
++++ b/drivers/scsi/lpfc/lpfc_nvmet.h
+@@ -31,6 +31,8 @@
+ #define LPFC_NVMET_MRQ_AUTO 0
+ #define LPFC_NVMET_MRQ_MAX 16
+
++#define LPFC_NVMET_WAIT_TMO (5 * MSEC_PER_SEC)
++
+ /* Used for NVME Target */
+ struct lpfc_nvmet_tgtport {
+ struct lpfc_hba *phba;
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 200b5bca1f5f..666495f21c24 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -4161,7 +4161,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
+ /* If pCmd was set to NULL from abort path, do not call scsi_done */
+ if (xchg(&lpfc_cmd->pCmd, NULL) == NULL) {
+ lpfc_printf_vlog(vport, KERN_INFO, LOG_FCP,
+- "0711 FCP cmd already NULL, sid: 0x%06x, "
++ "5688 FCP cmd already NULL, sid: 0x%06x, "
+ "did: 0x%06x, oxid: 0x%04x\n",
+ vport->fc_myDID,
+ (pnode) ? pnode->nlp_DID : 0,
+diff --git a/drivers/staging/mt7621-pinctrl/Kconfig b/drivers/staging/mt7621-pinctrl/Kconfig
+index 37cf9c3273be..fc3612711307 100644
+--- a/drivers/staging/mt7621-pinctrl/Kconfig
++++ b/drivers/staging/mt7621-pinctrl/Kconfig
+@@ -2,3 +2,4 @@ config PINCTRL_RT2880
+ bool "RT2800 pinctrl driver for RALINK/Mediatek SOCs"
+ depends on RALINK
+ select PINMUX
++ select GENERIC_PINCONF
+diff --git a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
+index aa98fbb17013..80e7067cfb79 100644
+--- a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
++++ b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
+@@ -11,6 +11,7 @@
+ #include <linux/of.h>
+ #include <linux/pinctrl/pinctrl.h>
+ #include <linux/pinctrl/pinconf.h>
++#include <linux/pinctrl/pinconf-generic.h>
+ #include <linux/pinctrl/pinmux.h>
+ #include <linux/pinctrl/consumer.h>
+ #include <linux/pinctrl/machine.h>
+@@ -73,48 +74,12 @@ static int rt2880_get_group_pins(struct pinctrl_dev *pctrldev,
+ return 0;
+ }
+
+-static int rt2880_pinctrl_dt_node_to_map(struct pinctrl_dev *pctrldev,
+- struct device_node *np_config,
+- struct pinctrl_map **map,
+- unsigned int *num_maps)
+-{
+- struct rt2880_priv *p = pinctrl_dev_get_drvdata(pctrldev);
+- struct property *prop;
+- const char *function_name, *group_name;
+- int ret;
+- int ngroups = 0;
+- unsigned int reserved_maps = 0;
+-
+- for_each_node_with_property(np_config, "group")
+- ngroups++;
+-
+- *map = NULL;
+- ret = pinctrl_utils_reserve_map(pctrldev, map, &reserved_maps,
+- num_maps, ngroups);
+- if (ret) {
+- dev_err(p->dev, "can't reserve map: %d\n", ret);
+- return ret;
+- }
+-
+- of_property_for_each_string(np_config, "group", prop, group_name) {
+- ret = pinctrl_utils_add_map_mux(pctrldev, map, &reserved_maps,
+- num_maps, group_name,
+- function_name);
+- if (ret) {
+- dev_err(p->dev, "can't add map: %d\n", ret);
+- return ret;
+- }
+- }
+-
+- return 0;
+-}
+-
+ static const struct pinctrl_ops rt2880_pctrl_ops = {
+ .get_groups_count = rt2880_get_group_count,
+ .get_group_name = rt2880_get_group_name,
+ .get_group_pins = rt2880_get_group_pins,
+- .dt_node_to_map = rt2880_pinctrl_dt_node_to_map,
+- .dt_free_map = pinctrl_utils_free_map,
++ .dt_node_to_map = pinconf_generic_dt_node_to_map_all,
++ .dt_free_map = pinconf_generic_dt_free_map,
+ };
+
+ static int rt2880_pmx_func_count(struct pinctrl_dev *pctrldev)
+diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+index dfee6985efa6..8ef7b44b6abc 100644
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -348,8 +348,10 @@ static struct adapter *rtw_usb_if1_init(struct dvobj_priv *dvobj,
+ }
+
+ padapter->HalData = kzalloc(sizeof(struct hal_data_8188e), GFP_KERNEL);
+- if (!padapter->HalData)
+- DBG_88E("cant not alloc memory for HAL DATA\n");
++ if (!padapter->HalData) {
++ DBG_88E("Failed to allocate memory for HAL data\n");
++ goto free_adapter;
++ }
+
+ /* step read_chip_version */
+ rtw_hal_read_chip_version(padapter);
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+index b19c960d5490..d46eee369864 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+@@ -1832,7 +1832,7 @@ static void cxgbit_fw4_ack(struct cxgbit_sock *csk, struct sk_buff *skb)
+
+ while (credits) {
+ struct sk_buff *p = cxgbit_sock_peek_wr(csk);
+- const u32 csum = (__force u32)p->csum;
++ u32 csum;
+
+ if (unlikely(!p)) {
+ pr_err("csk 0x%p,%u, cr %u,%u+%u, empty.\n",
+@@ -1841,6 +1841,7 @@ static void cxgbit_fw4_ack(struct cxgbit_sock *csk, struct sk_buff *skb)
+ break;
+ }
+
++ csum = (__force u32)p->csum;
+ if (unlikely(credits < csum)) {
+ pr_warn("csk 0x%p,%u, cr %u,%u+%u, < %u.\n",
+ csk, csk->tid,
+diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
+index 5cd6bdfa068f..d436a1534fc2 100644
+--- a/drivers/thunderbolt/nhi.c
++++ b/drivers/thunderbolt/nhi.c
+@@ -142,9 +142,20 @@ static void __iomem *ring_options_base(struct tb_ring *ring)
+ return io;
+ }
+
+-static void ring_iowrite16desc(struct tb_ring *ring, u32 value, u32 offset)
++static void ring_iowrite_cons(struct tb_ring *ring, u16 cons)
+ {
+- iowrite16(value, ring_desc_base(ring) + offset);
++ /*
++ * The other 16-bits in the register is read-only and writes to it
++ * are ignored by the hardware so we can save one ioread32() by
++ * filling the read-only bits with zeroes.
++ */
++ iowrite32(cons, ring_desc_base(ring) + 8);
++}
++
++static void ring_iowrite_prod(struct tb_ring *ring, u16 prod)
++{
++ /* See ring_iowrite_cons() above for explanation */
++ iowrite32(prod << 16, ring_desc_base(ring) + 8);
+ }
+
+ static void ring_iowrite32desc(struct tb_ring *ring, u32 value, u32 offset)
+@@ -196,7 +207,10 @@ static void ring_write_descriptors(struct tb_ring *ring)
+ descriptor->sof = frame->sof;
+ }
+ ring->head = (ring->head + 1) % ring->size;
+- ring_iowrite16desc(ring, ring->head, ring->is_tx ? 10 : 8);
++ if (ring->is_tx)
++ ring_iowrite_prod(ring, ring->head);
++ else
++ ring_iowrite_cons(ring, ring->head);
+ }
+ }
+
+@@ -660,7 +674,7 @@ void tb_ring_stop(struct tb_ring *ring)
+
+ ring_iowrite32options(ring, 0, 0);
+ ring_iowrite64desc(ring, 0, 0);
+- ring_iowrite16desc(ring, 0, ring->is_tx ? 10 : 8);
++ ring_iowrite32desc(ring, 0, 8);
+ ring_iowrite32desc(ring, 0, 12);
+ ring->head = 0;
+ ring->tail = 0;
+diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
+index bb63519db7ae..c943716c019e 100644
+--- a/drivers/tty/n_hdlc.c
++++ b/drivers/tty/n_hdlc.c
+@@ -968,6 +968,11 @@ static int __init n_hdlc_init(void)
+
+ } /* end of init_module() */
+
++#ifdef CONFIG_SPARC
++#undef __exitdata
++#define __exitdata
++#endif
++
+ static const char hdlc_unregister_ok[] __exitdata =
+ KERN_INFO "N_HDLC: line discipline unregistered\n";
+ static const char hdlc_unregister_fail[] __exitdata =
+diff --git a/drivers/tty/serial/owl-uart.c b/drivers/tty/serial/owl-uart.c
+index 29a6dc6a8d23..73fcc6bdb031 100644
+--- a/drivers/tty/serial/owl-uart.c
++++ b/drivers/tty/serial/owl-uart.c
+@@ -742,7 +742,7 @@ static int __init owl_uart_init(void)
+ return ret;
+ }
+
+-static void __init owl_uart_exit(void)
++static void __exit owl_uart_exit(void)
+ {
+ platform_driver_unregister(&owl_uart_platform_driver);
+ uart_unregister_driver(&owl_uart_driver);
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index 372cc7ff228f..ebea4a9d8e69 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -328,6 +328,7 @@ struct sc16is7xx_port {
+ struct kthread_worker kworker;
+ struct task_struct *kworker_task;
+ struct kthread_work irq_work;
++ struct mutex efr_lock;
+ struct sc16is7xx_one p[0];
+ };
+
+@@ -499,6 +500,21 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)
+ div /= 4;
+ }
+
++ /* In an amazing feat of design, the Enhanced Features Register shares
++ * the address of the Interrupt Identification Register, and is
++ * switched in by writing a magic value (0xbf) to the Line Control
++ * Register. Any interrupt firing during this time will see the EFR
++ * where it expects the IIR to be, leading to "Unexpected interrupt"
++ * messages.
++ *
++ * Prevent this possibility by claiming a mutex while accessing the
++ * EFR, and claiming the same mutex from within the interrupt handler.
++ * This is similar to disabling the interrupt, but that doesn't work
++ * because the bulk of the interrupt processing is run as a workqueue
++ * job in thread context.
++ */
++ mutex_lock(&s->efr_lock);
++
+ lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG);
+
+ /* Open the LCR divisors for configuration */
+@@ -514,6 +530,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)
+ /* Put LCR back to the normal mode */
+ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);
+
++ mutex_unlock(&s->efr_lock);
++
+ sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
+ SC16IS7XX_MCR_CLKSEL_BIT,
+ prescaler);
+@@ -696,6 +714,8 @@ static void sc16is7xx_ist(struct kthread_work *ws)
+ {
+ struct sc16is7xx_port *s = to_sc16is7xx_port(ws, irq_work);
+
++ mutex_lock(&s->efr_lock);
++
+ while (1) {
+ bool keep_polling = false;
+ int i;
+@@ -705,6 +725,8 @@ static void sc16is7xx_ist(struct kthread_work *ws)
+ if (!keep_polling)
+ break;
+ }
++
++ mutex_unlock(&s->efr_lock);
+ }
+
+ static irqreturn_t sc16is7xx_irq(int irq, void *dev_id)
+@@ -899,6 +921,9 @@ static void sc16is7xx_set_termios(struct uart_port *port,
+ if (!(termios->c_cflag & CREAD))
+ port->ignore_status_mask |= SC16IS7XX_LSR_BRK_ERROR_MASK;
+
++ /* As above, claim the mutex while accessing the EFR. */
++ mutex_lock(&s->efr_lock);
++
+ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG,
+ SC16IS7XX_LCR_CONF_MODE_B);
+
+@@ -920,6 +945,8 @@ static void sc16is7xx_set_termios(struct uart_port *port,
+ /* Update LCR register */
+ sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);
+
++ mutex_unlock(&s->efr_lock);
++
+ /* Get baud rate generator configuration */
+ baud = uart_get_baud_rate(port, termios, old,
+ port->uartclk / 16 / 4 / 0xffff,
+@@ -1185,6 +1212,7 @@ static int sc16is7xx_probe(struct device *dev,
+ s->regmap = regmap;
+ s->devtype = devtype;
+ dev_set_drvdata(dev, s);
++ mutex_init(&s->efr_lock);
+
+ kthread_init_worker(&s->kworker);
+ kthread_init_work(&s->irq_work, sc16is7xx_ist);
+diff --git a/drivers/tty/serial/serial_mctrl_gpio.c b/drivers/tty/serial/serial_mctrl_gpio.c
+index 07f318603e74..af0412a784d2 100644
+--- a/drivers/tty/serial/serial_mctrl_gpio.c
++++ b/drivers/tty/serial/serial_mctrl_gpio.c
+@@ -60,6 +60,9 @@ EXPORT_SYMBOL_GPL(mctrl_gpio_set);
+ struct gpio_desc *mctrl_gpio_to_gpiod(struct mctrl_gpios *gpios,
+ enum mctrl_gpio_idx gidx)
+ {
++ if (gpios == NULL)
++ return NULL;
++
+ return gpios->gpio[gidx];
+ }
+ EXPORT_SYMBOL_GPL(mctrl_gpio_to_gpiod);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 8018f813972e..d5fbd36cf462 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -107,6 +107,8 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem);
+ static void hub_release(struct kref *kref);
+ static int usb_reset_and_verify_device(struct usb_device *udev);
+ static int hub_port_disable(struct usb_hub *hub, int port1, int set_state);
++static bool hub_port_warm_reset_required(struct usb_hub *hub, int port1,
++ u16 portstatus);
+
+ static inline char *portspeed(struct usb_hub *hub, int portstatus)
+ {
+@@ -1111,6 +1113,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ USB_PORT_FEAT_ENABLE);
+ }
+
++ /* Make sure a warm-reset request is handled by port_event */
++ if (type == HUB_RESUME &&
++ hub_port_warm_reset_required(hub, port1, portstatus))
++ set_bit(port1, hub->event_bits);
++
+ /*
+ * Add debounce if USB3 link is in polling/link training state.
+ * Link will automatically transition to Enabled state after
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index aad7edc29bdd..a5c8329fd462 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -3568,6 +3568,7 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq,
+ u32 port_status;
+ u32 speed;
+ u32 pcgctl;
++ u32 pwr;
+
+ switch (typereq) {
+ case ClearHubFeature:
+@@ -3616,8 +3617,11 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq,
+ dev_dbg(hsotg->dev,
+ "ClearPortFeature USB_PORT_FEAT_POWER\n");
+ hprt0 = dwc2_read_hprt0(hsotg);
++ pwr = hprt0 & HPRT0_PWR;
+ hprt0 &= ~HPRT0_PWR;
+ dwc2_writel(hsotg, hprt0, HPRT0);
++ if (pwr)
++ dwc2_vbus_supply_exit(hsotg);
+ break;
+
+ case USB_PORT_FEAT_INDICATOR:
+@@ -3827,8 +3831,11 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq,
+ dev_dbg(hsotg->dev,
+ "SetPortFeature - USB_PORT_FEAT_POWER\n");
+ hprt0 = dwc2_read_hprt0(hsotg);
++ pwr = hprt0 & HPRT0_PWR;
+ hprt0 |= HPRT0_PWR;
+ dwc2_writel(hsotg, hprt0, HPRT0);
++ if (!pwr)
++ dwc2_vbus_supply_init(hsotg);
+ break;
+
+ case USB_PORT_FEAT_RESET:
+@@ -3845,6 +3852,7 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq,
+ dwc2_writel(hsotg, 0, PCGCTL);
+
+ hprt0 = dwc2_read_hprt0(hsotg);
++ pwr = hprt0 & HPRT0_PWR;
+ /* Clear suspend bit if resetting from suspend state */
+ hprt0 &= ~HPRT0_SUSP;
+
+@@ -3858,6 +3866,8 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq,
+ dev_dbg(hsotg->dev,
+ "In host mode, hprt0=%08x\n", hprt0);
+ dwc2_writel(hsotg, hprt0, HPRT0);
++ if (!pwr)
++ dwc2_vbus_supply_init(hsotg);
+ }
+
+ /* Clear reset bit in 10ms (FS/LS) or 50ms (HS) */
+@@ -4400,6 +4410,7 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
+ struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd);
+ struct usb_bus *bus = hcd_to_bus(hcd);
+ unsigned long flags;
++ u32 hprt0;
+ int ret;
+
+ dev_dbg(hsotg->dev, "DWC OTG HCD START\n");
+@@ -4416,12 +4427,16 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
+
+ dwc2_hcd_reinit(hsotg);
+
+- /* enable external vbus supply before resuming root hub */
+- spin_unlock_irqrestore(&hsotg->lock, flags);
+- ret = dwc2_vbus_supply_init(hsotg);
+- if (ret)
+- return ret;
+- spin_lock_irqsave(&hsotg->lock, flags);
++ hprt0 = dwc2_read_hprt0(hsotg);
++ /* Has vbus power been turned on in dwc2_core_host_init ? */
++ if (hprt0 & HPRT0_PWR) {
++ /* Enable external vbus supply before resuming root hub */
++ spin_unlock_irqrestore(&hsotg->lock, flags);
++ ret = dwc2_vbus_supply_init(hsotg);
++ if (ret)
++ return ret;
++ spin_lock_irqsave(&hsotg->lock, flags);
++ }
+
+ /* Initialize and connect root hub if one is not already attached */
+ if (bus->root_hub) {
+@@ -4443,6 +4458,7 @@ static void _dwc2_hcd_stop(struct usb_hcd *hcd)
+ {
+ struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd);
+ unsigned long flags;
++ u32 hprt0;
+
+ /* Turn off all host-specific interrupts */
+ dwc2_disable_host_interrupts(hsotg);
+@@ -4451,6 +4467,7 @@ static void _dwc2_hcd_stop(struct usb_hcd *hcd)
+ synchronize_irq(hcd->irq);
+
+ spin_lock_irqsave(&hsotg->lock, flags);
++ hprt0 = dwc2_read_hprt0(hsotg);
+ /* Ensure hcd is disconnected */
+ dwc2_hcd_disconnect(hsotg, true);
+ dwc2_hcd_stop(hsotg);
+@@ -4459,7 +4476,9 @@ static void _dwc2_hcd_stop(struct usb_hcd *hcd)
+ clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+ spin_unlock_irqrestore(&hsotg->lock, flags);
+
+- dwc2_vbus_supply_exit(hsotg);
++ /* keep balanced supply init/exit by checking HPRT0_PWR */
++ if (hprt0 & HPRT0_PWR)
++ dwc2_vbus_supply_exit(hsotg);
+
+ usleep_range(1000, 3000);
+ }
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index e7461c995116..54de73255064 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -375,19 +375,9 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
+
+ trace_dwc3_gadget_ep_cmd(dep, cmd, params, cmd_status);
+
+- if (ret == 0) {
+- switch (DWC3_DEPCMD_CMD(cmd)) {
+- case DWC3_DEPCMD_STARTTRANSFER:
+- dep->flags |= DWC3_EP_TRANSFER_STARTED;
+- dwc3_gadget_ep_get_transfer_index(dep);
+- break;
+- case DWC3_DEPCMD_ENDTRANSFER:
+- dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
+- break;
+- default:
+- /* nothing */
+- break;
+- }
++ if (ret == 0 && DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) {
++ dep->flags |= DWC3_EP_TRANSFER_STARTED;
++ dwc3_gadget_ep_get_transfer_index(dep);
+ }
+
+ if (unlikely(susphy)) {
+@@ -1410,7 +1400,10 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
+ goto out0;
+
+ dwc3_gadget_move_cancelled_request(req);
+- goto out0;
++ if (dep->flags & DWC3_EP_TRANSFER_STARTED)
++ goto out0;
++ else
++ goto out1;
+ }
+ dev_err(dwc->dev, "request %pK was not queued to %s\n",
+ request, ep->name);
+@@ -1418,6 +1411,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
+ goto out0;
+ }
+
++out1:
+ dwc3_gadget_giveback(dep, req, -ECONNRESET);
+
+ out0:
+@@ -2413,7 +2407,8 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc,
+ cmd = DEPEVT_PARAMETER_CMD(event->parameters);
+
+ if (cmd == DWC3_DEPCMD_ENDTRANSFER) {
+- dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING;
++ dep->flags &= ~(DWC3_EP_END_TRANSFER_PENDING |
++ DWC3_EP_TRANSFER_STARTED);
+ dwc3_gadget_ep_cleanup_cancelled_requests(dep);
+ }
+ break;
+diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
+index af88b48c1cea..aa31d36bed00 100644
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -98,6 +98,17 @@ int usb_ep_enable(struct usb_ep *ep)
+ if (ep->enabled)
+ goto out;
+
++ /* UDC drivers can't handle endpoints with maxpacket size 0 */
++ if (usb_endpoint_maxp(ep->desc) == 0) {
++ /*
++ * We should log an error message here, but we can't call
++ * dev_err() because there's no way to find the gadget
++ * given only ep.
++ */
++ ret = -EINVAL;
++ goto out;
++ }
++
+ ret = ep->ops->enable(ep, ep->desc);
+ if (ret)
+ goto out;
+diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
+index 7ba6afc7ef23..76c3f29562d2 100644
+--- a/drivers/usb/host/xhci-debugfs.c
++++ b/drivers/usb/host/xhci-debugfs.c
+@@ -202,10 +202,10 @@ static void xhci_ring_dump_segment(struct seq_file *s,
+ trb = &seg->trbs[i];
+ dma = seg->dma + i * sizeof(*trb);
+ seq_printf(s, "%pad: %s\n", &dma,
+- xhci_decode_trb(trb->generic.field[0],
+- trb->generic.field[1],
+- trb->generic.field[2],
+- trb->generic.field[3]));
++ xhci_decode_trb(le32_to_cpu(trb->generic.field[0]),
++ le32_to_cpu(trb->generic.field[1]),
++ le32_to_cpu(trb->generic.field[2]),
++ le32_to_cpu(trb->generic.field[3])));
+ }
+ }
+
+@@ -263,10 +263,10 @@ static int xhci_slot_context_show(struct seq_file *s, void *unused)
+ xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus));
+ slot_ctx = xhci_get_slot_ctx(xhci, dev->out_ctx);
+ seq_printf(s, "%pad: %s\n", &dev->out_ctx->dma,
+- xhci_decode_slot_context(slot_ctx->dev_info,
+- slot_ctx->dev_info2,
+- slot_ctx->tt_info,
+- slot_ctx->dev_state));
++ xhci_decode_slot_context(le32_to_cpu(slot_ctx->dev_info),
++ le32_to_cpu(slot_ctx->dev_info2),
++ le32_to_cpu(slot_ctx->tt_info),
++ le32_to_cpu(slot_ctx->dev_state)));
+
+ return 0;
+ }
+@@ -286,10 +286,10 @@ static int xhci_endpoint_context_show(struct seq_file *s, void *unused)
+ ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, dci);
+ dma = dev->out_ctx->dma + dci * CTX_SIZE(xhci->hcc_params);
+ seq_printf(s, "%pad: %s\n", &dma,
+- xhci_decode_ep_context(ep_ctx->ep_info,
+- ep_ctx->ep_info2,
+- ep_ctx->deq,
+- ep_ctx->tx_info));
++ xhci_decode_ep_context(le32_to_cpu(ep_ctx->ep_info),
++ le32_to_cpu(ep_ctx->ep_info2),
++ le64_to_cpu(ep_ctx->deq),
++ le32_to_cpu(ep_ctx->tx_info)));
+ }
+
+ return 0;
+diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
+index 6b3a6fd7d271..320b06e0724b 100644
+--- a/drivers/usb/misc/ldusb.c
++++ b/drivers/usb/misc/ldusb.c
+@@ -495,11 +495,11 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
+ retval = -EFAULT;
+ goto unlock_exit;
+ }
+- dev->ring_tail = (dev->ring_tail+1) % ring_buffer_size;
+-
+ retval = bytes_to_read;
+
+ spin_lock_irq(&dev->rbsl);
++ dev->ring_tail = (dev->ring_tail + 1) % ring_buffer_size;
++
+ if (dev->buffer_overflow) {
+ dev->buffer_overflow = 0;
+ spin_unlock_irq(&dev->rbsl);
+@@ -580,7 +580,7 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer,
+ 1 << 8, 0,
+ dev->interrupt_out_buffer,
+ bytes_to_write,
+- USB_CTRL_SET_TIMEOUT * HZ);
++ USB_CTRL_SET_TIMEOUT);
+ if (retval < 0)
+ dev_err(&dev->intf->dev,
+ "Couldn't submit HID_REQ_SET_REPORT %d\n",
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index 62dab2441ec4..23061f1526b4 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -878,7 +878,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
+ get_version_reply,
+ sizeof(*get_version_reply),
+ 1000);
+- if (result < sizeof(*get_version_reply)) {
++ if (result != sizeof(*get_version_reply)) {
+ if (result >= 0)
+ result = -EIO;
+ dev_err(idev, "get version request failed: %d\n", result);
+diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
+index 1c7b46a8620c..16b275123f10 100644
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -571,6 +571,10 @@ static int firm_send_command(struct usb_serial_port *port, __u8 command,
+
+ command_port = port->serial->port[COMMAND_PORT];
+ command_info = usb_get_serial_port_data(command_port);
++
++ if (command_port->bulk_out_size < datasize + 1)
++ return -EIO;
++
+ mutex_lock(&command_info->mutex);
+ command_info->command_finished = false;
+
+@@ -644,6 +648,7 @@ static void firm_setup_port(struct tty_struct *tty)
+ struct device *dev = &port->dev;
+ struct whiteheat_port_settings port_settings;
+ unsigned int cflag = tty->termios.c_cflag;
++ speed_t baud;
+
+ port_settings.port = port->port_number + 1;
+
+@@ -704,11 +709,13 @@ static void firm_setup_port(struct tty_struct *tty)
+ dev_dbg(dev, "%s - XON = %2x, XOFF = %2x\n", __func__, port_settings.xon, port_settings.xoff);
+
+ /* get the baud rate wanted */
+- port_settings.baud = tty_get_baud_rate(tty);
+- dev_dbg(dev, "%s - baud rate = %d\n", __func__, port_settings.baud);
++ baud = tty_get_baud_rate(tty);
++ port_settings.baud = cpu_to_le32(baud);
++ dev_dbg(dev, "%s - baud rate = %u\n", __func__, baud);
+
+ /* fixme: should set validated settings */
+- tty_encode_baud_rate(tty, port_settings.baud, port_settings.baud);
++ tty_encode_baud_rate(tty, baud, baud);
++
+ /* handle any settings that aren't specified in the tty structure */
+ port_settings.lloop = 0;
+
+diff --git a/drivers/usb/serial/whiteheat.h b/drivers/usb/serial/whiteheat.h
+index 72c1b0cf4063..56a3e8323f33 100644
+--- a/drivers/usb/serial/whiteheat.h
++++ b/drivers/usb/serial/whiteheat.h
+@@ -87,7 +87,7 @@ struct whiteheat_simple {
+
+ struct whiteheat_port_settings {
+ __u8 port; /* port number (1 to N) */
+- __u32 baud; /* any value 7 - 460800, firmware calculates
++ __le32 baud; /* any value 7 - 460800, firmware calculates
+ best fit; arrives little endian */
+ __u8 bits; /* 5, 6, 7, or 8 */
+ __u8 stop; /* 1 or 2, default 1 (2 = 1.5 if bits = 5) */
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index 59d82b45e758..f287ee8183df 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -65,7 +65,6 @@ static const char* host_info(struct Scsi_Host *host)
+ static int slave_alloc (struct scsi_device *sdev)
+ {
+ struct us_data *us = host_to_us(sdev->host);
+- int maxp;
+
+ /*
+ * Set the INQUIRY transfer length to 36. We don't use any of
+@@ -74,15 +73,6 @@ static int slave_alloc (struct scsi_device *sdev)
+ */
+ sdev->inquiry_len = 36;
+
+- /*
+- * USB has unusual scatter-gather requirements: the length of each
+- * scatterlist element except the last must be divisible by the
+- * Bulk maxpacket value. Fortunately this value is always a
+- * power of 2. Inform the block layer about this requirement.
+- */
+- maxp = usb_maxpacket(us->pusb_dev, us->recv_bulk_pipe, 0);
+- blk_queue_virt_boundary(sdev->request_queue, maxp - 1);
+-
+ /*
+ * Some host controllers may have alignment requirements.
+ * We'll play it safe by requiring 512-byte alignment always.
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index 5b1d09367475..bad391da4b8e 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -796,29 +796,9 @@ static int uas_slave_alloc(struct scsi_device *sdev)
+ {
+ struct uas_dev_info *devinfo =
+ (struct uas_dev_info *)sdev->host->hostdata;
+- int maxp;
+
+ sdev->hostdata = devinfo;
+
+- /*
+- * We have two requirements here. We must satisfy the requirements
+- * of the physical HC and the demands of the protocol, as we
+- * definitely want no additional memory allocation in this path
+- * ruling out using bounce buffers.
+- *
+- * For a transmission on USB to continue we must never send
+- * a package that is smaller than maxpacket. Hence the length of each
+- * scatterlist element except the last must be divisible by the
+- * Bulk maxpacket value.
+- * If the HC does not ensure that through SG,
+- * the upper layer must do that. We must assume nothing
+- * about the capabilities off the HC, so we use the most
+- * pessimistic requirement.
+- */
+-
+- maxp = usb_maxpacket(devinfo->udev, devinfo->data_in_pipe, 0);
+- blk_queue_virt_boundary(sdev->request_queue, maxp - 1);
+-
+ /*
+ * The protocol has no requirements on alignment in the strict sense.
+ * Controllers may or may not have alignment restrictions.
+diff --git a/drivers/virt/vboxguest/vboxguest_utils.c b/drivers/virt/vboxguest/vboxguest_utils.c
+index bf4474214b4d..92091006589a 100644
+--- a/drivers/virt/vboxguest/vboxguest_utils.c
++++ b/drivers/virt/vboxguest/vboxguest_utils.c
+@@ -217,6 +217,8 @@ static int hgcm_call_preprocess_linaddr(
+ if (!bounce_buf)
+ return -ENOMEM;
+
++ *bounce_buf_ret = bounce_buf;
++
+ if (copy_in) {
+ ret = copy_from_user(bounce_buf, (void __user *)buf, len);
+ if (ret)
+@@ -225,7 +227,6 @@ static int hgcm_call_preprocess_linaddr(
+ memset(bounce_buf, 0, len);
+ }
+
+- *bounce_buf_ret = bounce_buf;
+ hgcm_call_add_pagelist_size(bounce_buf, len, extra);
+ return 0;
+ }
+diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
+index 7cde3f46ad26..e996174cbfc0 100644
+--- a/fs/binfmt_script.c
++++ b/fs/binfmt_script.c
+@@ -14,13 +14,30 @@
+ #include <linux/err.h>
+ #include <linux/fs.h>
+
++static inline bool spacetab(char c) { return c == ' ' || c == '\t'; }
++static inline char *next_non_spacetab(char *first, const char *last)
++{
++ for (; first <= last; first++)
++ if (!spacetab(*first))
++ return first;
++ return NULL;
++}
++static inline char *next_terminator(char *first, const char *last)
++{
++ for (; first <= last; first++)
++ if (spacetab(*first) || !*first)
++ return first;
++ return NULL;
++}
++
+ static int load_script(struct linux_binprm *bprm)
+ {
+ const char *i_arg, *i_name;
+- char *cp;
++ char *cp, *buf_end;
+ struct file *file;
+ int retval;
+
++ /* Not ours to exec if we don't start with "#!". */
+ if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
+ return -ENOEXEC;
+
+@@ -33,18 +50,40 @@ static int load_script(struct linux_binprm *bprm)
+ if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE)
+ return -ENOENT;
+
+- /*
+- * This section does the #! interpretation.
+- * Sorta complicated, but hopefully it will work. -TYT
+- */
+-
++ /* Release since we are not mapping a binary into memory. */
+ allow_write_access(bprm->file);
+ fput(bprm->file);
+ bprm->file = NULL;
+
+- bprm->buf[BINPRM_BUF_SIZE - 1] = '\0';
+- if ((cp = strchr(bprm->buf, '\n')) == NULL)
+- cp = bprm->buf+BINPRM_BUF_SIZE-1;
++ /*
++ * This section handles parsing the #! line into separate
++ * interpreter path and argument strings. We must be careful
++ * because bprm->buf is not yet guaranteed to be NUL-terminated
++ * (though the buffer will have trailing NUL padding when the
++ * file size was smaller than the buffer size).
++ *
++ * We do not want to exec a truncated interpreter path, so either
++ * we find a newline (which indicates nothing is truncated), or
++ * we find a space/tab/NUL after the interpreter path (which
++ * itself may be preceded by spaces/tabs). Truncating the
++ * arguments is fine: the interpreter can re-read the script to
++ * parse them on its own.
++ */
++ buf_end = bprm->buf + sizeof(bprm->buf) - 1;
++ cp = strnchr(bprm->buf, sizeof(bprm->buf), '\n');
++ if (!cp) {
++ cp = next_non_spacetab(bprm->buf + 2, buf_end);
++ if (!cp)
++ return -ENOEXEC; /* Entire buf is spaces/tabs */
++ /*
++ * If there is no later space/tab/NUL we must assume the
++ * interpreter path is truncated.
++ */
++ if (!next_terminator(cp, buf_end))
++ return -ENOEXEC;
++ cp = buf_end;
++ }
++ /* NUL-terminate the buffer and any trailing spaces/tabs. */
+ *cp = '\0';
+ while (cp > bprm->buf) {
+ cp--;
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index faca485ccd8f..cc2d268e2cd7 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2747,8 +2747,7 @@ int btrfs_subvolume_reserve_metadata(struct btrfs_root *root,
+ int nitems, bool use_global_rsv);
+ void btrfs_subvolume_release_metadata(struct btrfs_fs_info *fs_info,
+ struct btrfs_block_rsv *rsv);
+-void btrfs_delalloc_release_extents(struct btrfs_inode *inode, u64 num_bytes,
+- bool qgroup_free);
++void btrfs_delalloc_release_extents(struct btrfs_inode *inode, u64 num_bytes);
+
+ int btrfs_delalloc_reserve_metadata(struct btrfs_inode *inode, u64 num_bytes);
+ void btrfs_delalloc_release_metadata(struct btrfs_inode *inode, u64 num_bytes,
+@@ -3178,6 +3177,9 @@ void btrfs_destroy_inode(struct inode *inode);
+ int btrfs_drop_inode(struct inode *inode);
+ int __init btrfs_init_cachep(void);
+ void __cold btrfs_destroy_cachep(void);
++struct inode *btrfs_iget_path(struct super_block *s, struct btrfs_key *location,
++ struct btrfs_root *root, int *new,
++ struct btrfs_path *path);
+ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
+ struct btrfs_root *root, int *was_new);
+ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode,
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 72c745682996..024dd336b20a 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -5980,8 +5980,7 @@ void btrfs_delalloc_release_metadata(struct btrfs_inode *inode, u64 num_bytes,
+ * temporarily tracked outstanding_extents. This _must_ be used in conjunction
+ * with btrfs_delalloc_reserve_metadata.
+ */
+-void btrfs_delalloc_release_extents(struct btrfs_inode *inode, u64 num_bytes,
+- bool qgroup_free)
++void btrfs_delalloc_release_extents(struct btrfs_inode *inode, u64 num_bytes)
+ {
+ struct btrfs_fs_info *fs_info = inode->root->fs_info;
+ unsigned num_extents;
+@@ -5995,7 +5994,7 @@ void btrfs_delalloc_release_extents(struct btrfs_inode *inode, u64 num_bytes,
+ if (btrfs_is_testing(fs_info))
+ return;
+
+- btrfs_inode_rsv_release(inode, qgroup_free);
++ btrfs_inode_rsv_release(inode, true);
+ }
+
+ /**
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 4870440d6424..a456801e0cd5 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1591,7 +1591,6 @@ static noinline ssize_t btrfs_buffered_write(struct kiocb *iocb,
+ struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+ struct btrfs_root *root = BTRFS_I(inode)->root;
+ struct page **pages = NULL;
+- struct extent_state *cached_state = NULL;
+ struct extent_changeset *data_reserved = NULL;
+ u64 release_bytes = 0;
+ u64 lockstart;
+@@ -1612,6 +1611,7 @@ static noinline ssize_t btrfs_buffered_write(struct kiocb *iocb,
+
+ while (iov_iter_count(i) > 0) {
+ size_t offset = pos & (PAGE_SIZE - 1);
++ struct extent_state *cached_state = NULL;
+ size_t sector_offset;
+ size_t write_bytes = min(iov_iter_count(i),
+ nrptrs * (size_t)PAGE_SIZE -
+@@ -1692,7 +1692,7 @@ again:
+ force_page_uptodate);
+ if (ret) {
+ btrfs_delalloc_release_extents(BTRFS_I(inode),
+- reserve_bytes, true);
++ reserve_bytes);
+ break;
+ }
+
+@@ -1704,7 +1704,7 @@ again:
+ if (extents_locked == -EAGAIN)
+ goto again;
+ btrfs_delalloc_release_extents(BTRFS_I(inode),
+- reserve_bytes, true);
++ reserve_bytes);
+ ret = extents_locked;
+ break;
+ }
+@@ -1758,11 +1758,21 @@ again:
+ if (copied > 0)
+ ret = btrfs_dirty_pages(inode, pages, dirty_pages,
+ pos, copied, &cached_state);
++
++ /*
++ * If we have not locked the extent range, because the range's
++ * start offset is >= i_size, we might still have a non-NULL
++ * cached extent state, acquired while marking the extent range
++ * as delalloc through btrfs_dirty_pages(). Therefore free any
++ * possible cached extent state to avoid a memory leak.
++ */
+ if (extents_locked)
+ unlock_extent_cached(&BTRFS_I(inode)->io_tree,
+ lockstart, lockend, &cached_state);
+- btrfs_delalloc_release_extents(BTRFS_I(inode), reserve_bytes,
+- true);
++ else
++ free_extent_state(cached_state);
++
++ btrfs_delalloc_release_extents(BTRFS_I(inode), reserve_bytes);
+ if (ret) {
+ btrfs_drop_pages(pages, num_pages);
+ break;
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index 4381e0aba8c0..ec01bd38d675 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -75,7 +75,8 @@ static struct inode *__lookup_free_space_inode(struct btrfs_root *root,
+ * sure NOFS is set to keep us from deadlocking.
+ */
+ nofs_flag = memalloc_nofs_save();
+- inode = btrfs_iget(fs_info->sb, &location, root, NULL);
++ inode = btrfs_iget_path(fs_info->sb, &location, root, NULL, path);
++ btrfs_release_path(path);
+ memalloc_nofs_restore(nofs_flag);
+ if (IS_ERR(inode))
+ return inode;
+@@ -839,6 +840,25 @@ int load_free_space_cache(struct btrfs_fs_info *fs_info,
+ path->search_commit_root = 1;
+ path->skip_locking = 1;
+
++ /*
++ * We must pass a path with search_commit_root set to btrfs_iget in
++ * order to avoid a deadlock when allocating extents for the tree root.
++ *
++ * When we are COWing an extent buffer from the tree root, when looking
++ * for a free extent, at extent-tree.c:find_free_extent(), we can find
++ * block group without its free space cache loaded. When we find one
++ * we must load its space cache which requires reading its free space
++ * cache's inode item from the root tree. If this inode item is located
++ * in the same leaf that we started COWing before, then we end up in
++ * deadlock on the extent buffer (trying to read lock it when we
++ * previously write locked it).
++ *
++ * It's safe to read the inode item using the commit root because
++ * block groups, once loaded, stay in memory forever (until they are
++ * removed) as well as their space caches once loaded. New block groups
++ * once created get their ->cached field set to BTRFS_CACHE_FINISHED so
++ * we will never try to read their inode item while the fs is mounted.
++ */
+ inode = lookup_free_space_inode(fs_info, block_group, path);
+ if (IS_ERR(inode)) {
+ btrfs_free_path(path);
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index ffca2abf13d0..e1b50c62ba65 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -483,12 +483,13 @@ again:
+ ret = btrfs_prealloc_file_range_trans(inode, trans, 0, 0, prealloc,
+ prealloc, prealloc, &alloc_hint);
+ if (ret) {
+- btrfs_delalloc_release_extents(BTRFS_I(inode), prealloc, true);
++ btrfs_delalloc_release_extents(BTRFS_I(inode), prealloc);
++ btrfs_delalloc_release_metadata(BTRFS_I(inode), prealloc, true);
+ goto out_put;
+ }
+
+ ret = btrfs_write_out_ino_cache(root, trans, path, inode);
+- btrfs_delalloc_release_extents(BTRFS_I(inode), prealloc, false);
++ btrfs_delalloc_release_extents(BTRFS_I(inode), prealloc);
+ out_put:
+ iput(inode);
+ out_release:
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 37332f83a3a9..f0f7bc5d2e4a 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -2166,7 +2166,7 @@ again:
+
+ ClearPageChecked(page);
+ set_page_dirty(page);
+- btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE, false);
++ btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE);
+ out:
+ unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end,
+ &cached_state);
+@@ -3607,10 +3607,11 @@ static noinline int acls_after_inode_item(struct extent_buffer *leaf,
+ /*
+ * read an inode from the btree into the in-memory inode
+ */
+-static int btrfs_read_locked_inode(struct inode *inode)
++static int btrfs_read_locked_inode(struct inode *inode,
++ struct btrfs_path *in_path)
+ {
+ struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+- struct btrfs_path *path;
++ struct btrfs_path *path = in_path;
+ struct extent_buffer *leaf;
+ struct btrfs_inode_item *inode_item;
+ struct btrfs_root *root = BTRFS_I(inode)->root;
+@@ -3626,15 +3627,18 @@ static int btrfs_read_locked_inode(struct inode *inode)
+ if (!ret)
+ filled = true;
+
+- path = btrfs_alloc_path();
+- if (!path)
+- return -ENOMEM;
++ if (!path) {
++ path = btrfs_alloc_path();
++ if (!path)
++ return -ENOMEM;
++ }
+
+ memcpy(&location, &BTRFS_I(inode)->location, sizeof(location));
+
+ ret = btrfs_lookup_inode(NULL, root, path, &location, 0);
+ if (ret) {
+- btrfs_free_path(path);
++ if (path != in_path)
++ btrfs_free_path(path);
+ return ret;
+ }
+
+@@ -3774,7 +3778,8 @@ cache_acl:
+ btrfs_ino(BTRFS_I(inode)),
+ root->root_key.objectid, ret);
+ }
+- btrfs_free_path(path);
++ if (path != in_path)
++ btrfs_free_path(path);
+
+ if (!maybe_acls)
+ cache_no_acl(inode);
+@@ -4918,7 +4923,7 @@ again:
+ if (!page) {
+ btrfs_delalloc_release_space(inode, data_reserved,
+ block_start, blocksize, true);
+- btrfs_delalloc_release_extents(BTRFS_I(inode), blocksize, true);
++ btrfs_delalloc_release_extents(BTRFS_I(inode), blocksize);
+ ret = -ENOMEM;
+ goto out;
+ }
+@@ -4986,7 +4991,7 @@ out_unlock:
+ if (ret)
+ btrfs_delalloc_release_space(inode, data_reserved, block_start,
+ blocksize, true);
+- btrfs_delalloc_release_extents(BTRFS_I(inode), blocksize, (ret != 0));
++ btrfs_delalloc_release_extents(BTRFS_I(inode), blocksize);
+ unlock_page(page);
+ put_page(page);
+ out:
+@@ -5716,8 +5721,9 @@ static struct inode *btrfs_iget_locked(struct super_block *s,
+ /* Get an inode object given its location and corresponding root.
+ * Returns in *is_new if the inode was read from disk
+ */
+-struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
+- struct btrfs_root *root, int *new)
++struct inode *btrfs_iget_path(struct super_block *s, struct btrfs_key *location,
++ struct btrfs_root *root, int *new,
++ struct btrfs_path *path)
+ {
+ struct inode *inode;
+
+@@ -5728,7 +5734,7 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
+ if (inode->i_state & I_NEW) {
+ int ret;
+
+- ret = btrfs_read_locked_inode(inode);
++ ret = btrfs_read_locked_inode(inode, path);
+ if (!ret) {
+ inode_tree_add(inode);
+ unlock_new_inode(inode);
+@@ -5750,6 +5756,12 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
+ return inode;
+ }
+
++struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
++ struct btrfs_root *root, int *new)
++{
++ return btrfs_iget_path(s, location, root, new, NULL);
++}
++
+ static struct inode *new_simple_dir(struct super_block *s,
+ struct btrfs_key *key,
+ struct btrfs_root *root)
+@@ -8660,7 +8672,7 @@ static ssize_t btrfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
+ } else if (ret >= 0 && (size_t)ret < count)
+ btrfs_delalloc_release_space(inode, data_reserved,
+ offset, count - (size_t)ret, true);
+- btrfs_delalloc_release_extents(BTRFS_I(inode), count, false);
++ btrfs_delalloc_release_extents(BTRFS_I(inode), count);
+ }
+ out:
+ if (wakeup)
+@@ -9013,7 +9025,7 @@ again:
+ unlock_extent_cached(io_tree, page_start, page_end, &cached_state);
+
+ if (!ret2) {
+- btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE, true);
++ btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE);
+ sb_end_pagefault(inode->i_sb);
+ extent_changeset_free(data_reserved);
+ return VM_FAULT_LOCKED;
+@@ -9022,7 +9034,7 @@ again:
+ out_unlock:
+ unlock_page(page);
+ out:
+- btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE, (ret != 0));
++ btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE);
+ btrfs_delalloc_release_space(inode, data_reserved, page_start,
+ reserved_space, (ret != 0));
+ out_noreserve:
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 0eb333c62fe4..7592beb53fc4 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1359,8 +1359,7 @@ again:
+ unlock_page(pages[i]);
+ put_page(pages[i]);
+ }
+- btrfs_delalloc_release_extents(BTRFS_I(inode), page_cnt << PAGE_SHIFT,
+- false);
++ btrfs_delalloc_release_extents(BTRFS_I(inode), page_cnt << PAGE_SHIFT);
+ extent_changeset_free(data_reserved);
+ return i_done;
+ out:
+@@ -1371,8 +1370,7 @@ out:
+ btrfs_delalloc_release_space(inode, data_reserved,
+ start_index << PAGE_SHIFT,
+ page_cnt << PAGE_SHIFT, true);
+- btrfs_delalloc_release_extents(BTRFS_I(inode), page_cnt << PAGE_SHIFT,
+- true);
++ btrfs_delalloc_release_extents(BTRFS_I(inode), page_cnt << PAGE_SHIFT);
+ extent_changeset_free(data_reserved);
+ return ret;
+
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 3ea2008dcde3..cdd6d5021000 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -3259,7 +3259,7 @@ int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes,
+ return 0;
+
+ BUG_ON(num_bytes != round_down(num_bytes, fs_info->nodesize));
+- trace_qgroup_meta_reserve(root, type, (s64)num_bytes);
++ trace_qgroup_meta_reserve(root, (s64)num_bytes, type);
+ ret = qgroup_reserve(root, num_bytes, enforce, type);
+ if (ret < 0)
+ return ret;
+@@ -3306,7 +3306,7 @@ void __btrfs_qgroup_free_meta(struct btrfs_root *root, int num_bytes,
+ */
+ num_bytes = sub_root_meta_rsv(root, num_bytes, type);
+ BUG_ON(num_bytes != round_down(num_bytes, fs_info->nodesize));
+- trace_qgroup_meta_reserve(root, type, -(s64)num_bytes);
++ trace_qgroup_meta_reserve(root, -(s64)num_bytes, type);
+ btrfs_qgroup_free_refroot(fs_info, root->objectid, num_bytes, type);
+ }
+
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index bccd9dede2af..b4958f724ce5 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -3188,7 +3188,7 @@ static int relocate_file_extent_cluster(struct inode *inode,
+ btrfs_delalloc_release_metadata(BTRFS_I(inode),
+ PAGE_SIZE, true);
+ btrfs_delalloc_release_extents(BTRFS_I(inode),
+- PAGE_SIZE, true);
++ PAGE_SIZE);
+ ret = -ENOMEM;
+ goto out;
+ }
+@@ -3209,7 +3209,7 @@ static int relocate_file_extent_cluster(struct inode *inode,
+ btrfs_delalloc_release_metadata(BTRFS_I(inode),
+ PAGE_SIZE, true);
+ btrfs_delalloc_release_extents(BTRFS_I(inode),
+- PAGE_SIZE, true);
++ PAGE_SIZE);
+ ret = -EIO;
+ goto out;
+ }
+@@ -3238,7 +3238,7 @@ static int relocate_file_extent_cluster(struct inode *inode,
+ btrfs_delalloc_release_metadata(BTRFS_I(inode),
+ PAGE_SIZE, true);
+ btrfs_delalloc_release_extents(BTRFS_I(inode),
+- PAGE_SIZE, true);
++ PAGE_SIZE);
+
+ clear_extent_bits(&BTRFS_I(inode)->io_tree,
+ page_start, page_end,
+@@ -3254,8 +3254,7 @@ static int relocate_file_extent_cluster(struct inode *inode,
+ put_page(page);
+
+ index++;
+- btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE,
+- false);
++ btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE);
+ balance_dirty_pages_ratelimited(inode->i_mapping);
+ btrfs_throttle(fs_info);
+ }
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 86a54b809c48..8b9471904f67 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -1521,9 +1521,10 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+
+ /* set up first two iov for signature check and to get credits */
+ rdata->iov[0].iov_base = buf;
+- rdata->iov[0].iov_len = 4;
+- rdata->iov[1].iov_base = buf + 4;
+- rdata->iov[1].iov_len = server->total_read - 4;
++ rdata->iov[0].iov_len = server->vals->header_preamble_size;
++ rdata->iov[1].iov_base = buf + server->vals->header_preamble_size;
++ rdata->iov[1].iov_len =
++ server->total_read - server->vals->header_preamble_size;
+ cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
+ rdata->iov[0].iov_base, rdata->iov[0].iov_len);
+ cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 966e493c82e5..7e85070d010f 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -930,6 +930,26 @@ cifs_handle_standard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+ return 0;
+ }
+
++static void
++smb2_add_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
++{
++ struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buffer;
++
++ /*
++ * SMB1 does not use credits.
++ */
++ if (server->vals->header_preamble_size)
++ return;
++
++ if (shdr->CreditRequest) {
++ spin_lock(&server->req_lock);
++ server->credits += le16_to_cpu(shdr->CreditRequest);
++ spin_unlock(&server->req_lock);
++ wake_up(&server->request_q);
++ }
++}
++
++
+ static int
+ cifs_demultiplex_thread(void *p)
+ {
+@@ -1059,6 +1079,7 @@ next_pdu:
+ } else if (server->ops->is_oplock_break &&
+ server->ops->is_oplock_break(bufs[i],
+ server)) {
++ smb2_add_credits_from_hdr(bufs[i], server);
+ cifs_dbg(FYI, "Received oplock break\n");
+ } else {
+ cifs_dbg(VFS, "No task to wake, unknown frame "
+@@ -1070,6 +1091,7 @@ next_pdu:
+ if (server->ops->dump_detail)
+ server->ops->dump_detail(bufs[i],
+ server);
++ smb2_add_credits_from_hdr(bufs[i], server);
+ cifs_dump_mids(server);
+ #endif /* CIFS_DEBUG2 */
+ }
+diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
+index fdd908e4a26b..66c10121a6ea 100644
+--- a/fs/cifs/netmisc.c
++++ b/fs/cifs/netmisc.c
+@@ -130,10 +130,6 @@ static const struct smb_to_posix_error mapping_table_ERRSRV[] = {
+ {0, 0}
+ };
+
+-static const struct smb_to_posix_error mapping_table_ERRHRD[] = {
+- {0, 0}
+-};
+-
+ /*
+ * Convert a string containing text IPv4 or IPv6 address to binary form.
+ *
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 0a7ed2e3ad4f..e311f58dc1c8 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -659,13 +659,6 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ if (rsp->sync_hdr.Command != SMB2_OPLOCK_BREAK)
+ return false;
+
+- if (rsp->sync_hdr.CreditRequest) {
+- spin_lock(&server->req_lock);
+- server->credits += le16_to_cpu(rsp->sync_hdr.CreditRequest);
+- spin_unlock(&server->req_lock);
+- wake_up(&server->request_q);
+- }
+-
+ if (rsp->StructureSize !=
+ smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) {
+ if (le16_to_cpu(rsp->StructureSize) == 44)
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index f0d966da7f37..6fc16329ceb4 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -3000,10 +3000,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+
+ /* set up first two iov to get credits */
+ rdata->iov[0].iov_base = buf;
+- rdata->iov[0].iov_len = 4;
+- rdata->iov[1].iov_base = buf + 4;
++ rdata->iov[0].iov_len = 0;
++ rdata->iov[1].iov_base = buf;
+ rdata->iov[1].iov_len =
+- min_t(unsigned int, buf_len, server->vals->read_rsp_size) - 4;
++ min_t(unsigned int, buf_len, server->vals->read_rsp_size);
+ cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
+ rdata->iov[0].iov_base, rdata->iov[0].iov_len);
+ cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index abb6fcff0a1d..783c54bb2ce7 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -132,6 +132,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
+
+ if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) ||
+ IS_SWAPFILE(inode) || IS_ENCRYPTED(inode) ||
++ (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL) ||
+ ext4_has_inline_data(inode)) {
+ err = -EINVAL;
+ goto journal_err_out;
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 0b224f4a4a65..2c3be4c3c626 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -226,6 +226,9 @@ static void recover_inode(struct inode *inode, struct page *page)
+
+ F2FS_I(inode)->i_advise = raw->i_advise;
+ F2FS_I(inode)->i_flags = le32_to_cpu(raw->i_flags);
++ f2fs_set_inode_flags(inode);
++ F2FS_I(inode)->i_gc_failures[GC_FAILURE_PIN] =
++ le16_to_cpu(raw->i_gc_failures);
+
+ recover_inline_flags(inode, raw);
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 6851afc3bf80..d9106bbe7df6 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1886,6 +1886,12 @@ void f2fs_quota_off_umount(struct super_block *sb)
+ set_sbi_flag(F2FS_SB(sb), SBI_NEED_FSCK);
+ }
+ }
++ /*
++ * In case of checkpoint=disable, we must flush quota blocks.
++ * This can cause NULL exception for node_inode in end_io, since
++ * put_super already dropped it.
++ */
++ sync_filesystem(sb);
+ }
+
+ static void f2fs_truncate_quota_inode_pages(struct super_block *sb)
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 82a13221775e..e7a2a988533d 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1665,6 +1665,19 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,
+ if (attr->ia_valid & ATTR_SIZE)
+ is_truncate = true;
+
++ /* Flush dirty data/metadata before non-truncate SETATTR */
++ if (is_wb && S_ISREG(inode->i_mode) &&
++ attr->ia_valid &
++ (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_MTIME_SET |
++ ATTR_TIMES_SET)) {
++ err = write_inode_now(inode, true);
++ if (err)
++ return err;
++
++ fuse_set_nowrite(inode);
++ fuse_release_nowrite(inode);
++ }
++
+ if (is_truncate) {
+ fuse_set_nowrite(inode);
+ set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 96d46b3ad235..3964325432ae 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -202,7 +202,7 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
+ {
+ struct fuse_conn *fc = get_fuse_conn(inode);
+ int err;
+- bool lock_inode = (file->f_flags & O_TRUNC) &&
++ bool is_wb_truncate = (file->f_flags & O_TRUNC) &&
+ fc->atomic_o_trunc &&
+ fc->writeback_cache;
+
+@@ -210,16 +210,20 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
+ if (err)
+ return err;
+
+- if (lock_inode)
++ if (is_wb_truncate) {
+ inode_lock(inode);
++ fuse_set_nowrite(inode);
++ }
+
+ err = fuse_do_open(fc, get_node_id(inode), file, isdir);
+
+ if (!err)
+ fuse_finish_open(inode, file);
+
+- if (lock_inode)
++ if (is_wb_truncate) {
++ fuse_release_nowrite(inode);
+ inode_unlock(inode);
++ }
+
+ return err;
+ }
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 1624618c2bc7..825a8c52165a 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -1154,7 +1154,7 @@ bool nfs4_refresh_delegation_stateid(nfs4_stateid *dst, struct inode *inode)
+ if (delegation != NULL &&
+ nfs4_stateid_match_other(dst, &delegation->stateid)) {
+ dst->seqid = delegation->stateid.seqid;
+- return ret;
++ ret = true;
+ }
+ rcu_read_unlock();
+ out:
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 621e3cf90f4e..75faef7af22d 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5943,6 +5943,7 @@ int nfs4_proc_setclientid(struct nfs_client *clp, u32 program,
+ }
+ status = task->tk_status;
+ if (setclientid.sc_cred) {
++ kfree(clp->cl_acceptor);
+ clp->cl_acceptor = rpcauth_stringify_acceptor(setclientid.sc_cred);
+ put_rpccred(setclientid.sc_cred);
+ }
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index c36ef75f2054..b3086e99420c 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2613,7 +2613,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ return;
+ if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
+ return;
+- } while (refcount_read(&clp->cl_count) > 1);
++ } while (refcount_read(&clp->cl_count) > 1 && !signalled());
+ goto out_drain;
+
+ out_error:
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 5ab997912d8d..117ffd90419e 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -783,7 +783,6 @@ static void nfs_inode_remove_request(struct nfs_page *req)
+ struct nfs_inode *nfsi = NFS_I(inode);
+ struct nfs_page *head;
+
+- atomic_long_dec(&nfsi->nrequests);
+ if (nfs_page_group_sync_on_bit(req, PG_REMOVE)) {
+ head = req->wb_head;
+
+@@ -796,8 +795,10 @@ static void nfs_inode_remove_request(struct nfs_page *req)
+ spin_unlock(&mapping->private_lock);
+ }
+
+- if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags))
++ if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags)) {
+ nfs_release_request(req);
++ atomic_long_dec(&nfsi->nrequests);
++ }
+ }
+
+ static void
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
+index 7578bd507c70..543efa3e5655 100644
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -2056,7 +2056,8 @@ out_write_size:
+ inode->i_mtime = inode->i_ctime = current_time(inode);
+ di->i_mtime = di->i_ctime = cpu_to_le64(inode->i_mtime.tv_sec);
+ di->i_mtime_nsec = di->i_ctime_nsec = cpu_to_le32(inode->i_mtime.tv_nsec);
+- ocfs2_update_inode_fsync_trans(handle, inode, 1);
++ if (handle)
++ ocfs2_update_inode_fsync_trans(handle, inode, 1);
+ }
+ if (handle)
+ ocfs2_journal_dirty(handle, wc->w_di_bh);
+@@ -2153,13 +2154,30 @@ static int ocfs2_dio_wr_get_block(struct inode *inode, sector_t iblock,
+ struct ocfs2_dio_write_ctxt *dwc = NULL;
+ struct buffer_head *di_bh = NULL;
+ u64 p_blkno;
+- loff_t pos = iblock << inode->i_sb->s_blocksize_bits;
++ unsigned int i_blkbits = inode->i_sb->s_blocksize_bits;
++ loff_t pos = iblock << i_blkbits;
++ sector_t endblk = (i_size_read(inode) - 1) >> i_blkbits;
+ unsigned len, total_len = bh_result->b_size;
+ int ret = 0, first_get_block = 0;
+
+ len = osb->s_clustersize - (pos & (osb->s_clustersize - 1));
+ len = min(total_len, len);
+
++ /*
++ * bh_result->b_size is count in get_more_blocks according to write
++ * "pos" and "end", we need map twice to return different buffer state:
++ * 1. area in file size, not set NEW;
++ * 2. area out file size, set NEW.
++ *
++ * iblock endblk
++ * |--------|---------|---------|---------
++ * |<-------area in file------->|
++ */
++
++ if ((iblock <= endblk) &&
++ ((iblock + ((len - 1) >> i_blkbits)) > endblk))
++ len = (endblk - iblock + 1) << i_blkbits;
++
+ mlog(0, "get block of %lu at %llu:%u req %u\n",
+ inode->i_ino, pos, len, total_len);
+
+@@ -2243,6 +2261,9 @@ static int ocfs2_dio_wr_get_block(struct inode *inode, sector_t iblock,
+ if (desc->c_needs_zero)
+ set_buffer_new(bh_result);
+
++ if (iblock > endblk)
++ set_buffer_new(bh_result);
++
+ /* May sleep in end_io. It should not happen in a irq context. So defer
+ * it to dio work queue. */
+ set_buffer_defer_completion(bh_result);
+diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
+index 994726ada857..a6c328211dcc 100644
+--- a/fs/ocfs2/ioctl.c
++++ b/fs/ocfs2/ioctl.c
+@@ -290,7 +290,7 @@ static int ocfs2_info_scan_inode_alloc(struct ocfs2_super *osb,
+ if (inode_alloc)
+ inode_lock(inode_alloc);
+
+- if (o2info_coherent(&fi->ifi_req)) {
++ if (inode_alloc && o2info_coherent(&fi->ifi_req)) {
+ status = ocfs2_inode_lock(inode_alloc, &bh, 0);
+ if (status < 0) {
+ mlog_errno(status);
+diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
+index c146e12a8601..0d80e0df6c24 100644
+--- a/fs/ocfs2/xattr.c
++++ b/fs/ocfs2/xattr.c
+@@ -1498,18 +1498,6 @@ static int ocfs2_xa_check_space(struct ocfs2_xa_loc *loc,
+ return loc->xl_ops->xlo_check_space(loc, xi);
+ }
+
+-static void ocfs2_xa_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash)
+-{
+- loc->xl_ops->xlo_add_entry(loc, name_hash);
+- loc->xl_entry->xe_name_hash = cpu_to_le32(name_hash);
+- /*
+- * We can't leave the new entry's xe_name_offset at zero or
+- * add_namevalue() will go nuts. We set it to the size of our
+- * storage so that it can never be less than any other entry.
+- */
+- loc->xl_entry->xe_name_offset = cpu_to_le16(loc->xl_size);
+-}
+-
+ static void ocfs2_xa_add_namevalue(struct ocfs2_xa_loc *loc,
+ struct ocfs2_xattr_info *xi)
+ {
+@@ -2141,29 +2129,31 @@ static int ocfs2_xa_prepare_entry(struct ocfs2_xa_loc *loc,
+ if (rc)
+ goto out;
+
+- if (loc->xl_entry) {
+- if (ocfs2_xa_can_reuse_entry(loc, xi)) {
+- orig_value_size = loc->xl_entry->xe_value_size;
+- rc = ocfs2_xa_reuse_entry(loc, xi, ctxt);
+- if (rc)
+- goto out;
+- goto alloc_value;
+- }
++ if (!loc->xl_entry) {
++ rc = -EINVAL;
++ goto out;
++ }
+
+- if (!ocfs2_xattr_is_local(loc->xl_entry)) {
+- orig_clusters = ocfs2_xa_value_clusters(loc);
+- rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
+- if (rc) {
+- mlog_errno(rc);
+- ocfs2_xa_cleanup_value_truncate(loc,
+- "overwriting",
+- orig_clusters);
+- goto out;
+- }
++ if (ocfs2_xa_can_reuse_entry(loc, xi)) {
++ orig_value_size = loc->xl_entry->xe_value_size;
++ rc = ocfs2_xa_reuse_entry(loc, xi, ctxt);
++ if (rc)
++ goto out;
++ goto alloc_value;
++ }
++
++ if (!ocfs2_xattr_is_local(loc->xl_entry)) {
++ orig_clusters = ocfs2_xa_value_clusters(loc);
++ rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
++ if (rc) {
++ mlog_errno(rc);
++ ocfs2_xa_cleanup_value_truncate(loc,
++ "overwriting",
++ orig_clusters);
++ goto out;
+ }
+- ocfs2_xa_wipe_namevalue(loc);
+- } else
+- ocfs2_xa_add_entry(loc, name_hash);
++ }
++ ocfs2_xa_wipe_namevalue(loc);
+
+ /*
+ * If we get here, we have a blank entry. Fill it. We grow our
+diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
+index df528a623548..ea985aa7a6c5 100644
+--- a/include/net/llc_conn.h
++++ b/include/net/llc_conn.h
+@@ -104,7 +104,7 @@ void llc_sk_reset(struct sock *sk);
+
+ /* Access to a connection */
+ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb);
+-int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb);
++void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb);
+ void llc_conn_rtn_pdu(struct sock *sk, struct sk_buff *skb);
+ void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit);
+ void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit);
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index c44da48de7df..c9cd5086bd54 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -421,6 +421,11 @@ static inline struct Qdisc *qdisc_root(const struct Qdisc *qdisc)
+ return q;
+ }
+
++static inline struct Qdisc *qdisc_root_bh(const struct Qdisc *qdisc)
++{
++ return rcu_dereference_bh(qdisc->dev_queue->qdisc);
++}
++
+ static inline struct Qdisc *qdisc_root_sleeping(const struct Qdisc *qdisc)
+ {
+ return qdisc->dev_queue->qdisc_sleeping;
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index 0fe169c6afd8..a08916eb7615 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -527,10 +527,10 @@ TRACE_EVENT(rxrpc_local,
+ );
+
+ TRACE_EVENT(rxrpc_peer,
+- TP_PROTO(struct rxrpc_peer *peer, enum rxrpc_peer_trace op,
++ TP_PROTO(unsigned int peer_debug_id, enum rxrpc_peer_trace op,
+ int usage, const void *where),
+
+- TP_ARGS(peer, op, usage, where),
++ TP_ARGS(peer_debug_id, op, usage, where),
+
+ TP_STRUCT__entry(
+ __field(unsigned int, peer )
+@@ -540,7 +540,7 @@ TRACE_EVENT(rxrpc_peer,
+ ),
+
+ TP_fast_assign(
+- __entry->peer = peer->debug_id;
++ __entry->peer = peer_debug_id;
+ __entry->op = op;
+ __entry->usage = usage;
+ __entry->where = where;
+diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
+index 0796f938c4f0..54eb9457b21d 100644
+--- a/kernel/sched/cputime.c
++++ b/kernel/sched/cputime.c
+@@ -739,7 +739,7 @@ void vtime_account_system(struct task_struct *tsk)
+
+ write_seqcount_begin(&vtime->seqcount);
+ /* We might have scheduled out from guest path */
+- if (current->flags & PF_VCPU)
++ if (tsk->flags & PF_VCPU)
+ vtime_account_guest(tsk, vtime);
+ else
+ __vtime_account_system(tsk, vtime);
+@@ -782,7 +782,7 @@ void vtime_guest_enter(struct task_struct *tsk)
+ */
+ write_seqcount_begin(&vtime->seqcount);
+ __vtime_account_system(tsk, vtime);
+- current->flags |= PF_VCPU;
++ tsk->flags |= PF_VCPU;
+ write_seqcount_end(&vtime->seqcount);
+ }
+ EXPORT_SYMBOL_GPL(vtime_guest_enter);
+@@ -793,7 +793,7 @@ void vtime_guest_exit(struct task_struct *tsk)
+
+ write_seqcount_begin(&vtime->seqcount);
+ vtime_account_guest(tsk, vtime);
+- current->flags &= ~PF_VCPU;
++ tsk->flags &= ~PF_VCPU;
+ write_seqcount_end(&vtime->seqcount);
+ }
+ EXPORT_SYMBOL_GPL(vtime_guest_exit);
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 27b17ea44f74..bdd7f3d78724 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -5766,6 +5766,7 @@ waitagain:
+ sizeof(struct trace_iterator) -
+ offsetof(struct trace_iterator, seq));
+ cpumask_clear(iter->started);
++ trace_seq_init(&iter->seq);
+ iter->pos = -1;
+
+ trace_event_read_lock();
+diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
+index 36f244125d24..f5941837c3ad 100644
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -35,6 +35,7 @@
+ #include <linux/kref.h>
+ #include <linux/list.h>
+ #include <linux/lockdep.h>
++#include <linux/mutex.h>
+ #include <linux/netdevice.h>
+ #include <linux/netlink.h>
+ #include <linux/pkt_sched.h>
+@@ -379,14 +380,18 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
+ unsigned char *ogm_buff;
+ u32 random_seqno;
+
++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
++
+ /* randomize initial seqno to avoid collision */
+ get_random_bytes(&random_seqno, sizeof(random_seqno));
+ atomic_set(&hard_iface->bat_iv.ogm_seqno, random_seqno);
+
+ hard_iface->bat_iv.ogm_buff_len = BATADV_OGM_HLEN;
+ ogm_buff = kmalloc(hard_iface->bat_iv.ogm_buff_len, GFP_ATOMIC);
+- if (!ogm_buff)
++ if (!ogm_buff) {
++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
+ return -ENOMEM;
++ }
+
+ hard_iface->bat_iv.ogm_buff = ogm_buff;
+
+@@ -398,35 +403,59 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
+ batadv_ogm_packet->reserved = 0;
+ batadv_ogm_packet->tq = BATADV_TQ_MAX_VALUE;
+
++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
++
+ return 0;
+ }
+
+ static void batadv_iv_ogm_iface_disable(struct batadv_hard_iface *hard_iface)
+ {
++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
++
+ kfree(hard_iface->bat_iv.ogm_buff);
+ hard_iface->bat_iv.ogm_buff = NULL;
++
++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
+ }
+
+ static void batadv_iv_ogm_iface_update_mac(struct batadv_hard_iface *hard_iface)
+ {
+ struct batadv_ogm_packet *batadv_ogm_packet;
+- unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff;
++ void *ogm_buff;
+
+- batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
++
++ ogm_buff = hard_iface->bat_iv.ogm_buff;
++ if (!ogm_buff)
++ goto unlock;
++
++ batadv_ogm_packet = ogm_buff;
+ ether_addr_copy(batadv_ogm_packet->orig,
+ hard_iface->net_dev->dev_addr);
+ ether_addr_copy(batadv_ogm_packet->prev_sender,
+ hard_iface->net_dev->dev_addr);
++
++unlock:
++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
+ }
+
+ static void
+ batadv_iv_ogm_primary_iface_set(struct batadv_hard_iface *hard_iface)
+ {
+ struct batadv_ogm_packet *batadv_ogm_packet;
+- unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff;
++ void *ogm_buff;
+
+- batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
++
++ ogm_buff = hard_iface->bat_iv.ogm_buff;
++ if (!ogm_buff)
++ goto unlock;
++
++ batadv_ogm_packet = ogm_buff;
+ batadv_ogm_packet->ttl = BATADV_TTL;
++
++unlock:
++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
+ }
+
+ /* when do we schedule our own ogm to be sent */
+@@ -924,7 +953,11 @@ batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
+ }
+ }
+
+-static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
++/**
++ * batadv_iv_ogm_schedule_buff() - schedule submission of hardif ogm buffer
++ * @hard_iface: interface whose ogm buffer should be transmitted
++ */
++static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface)
+ {
+ struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
+ unsigned char **ogm_buff = &hard_iface->bat_iv.ogm_buff;
+@@ -935,9 +968,7 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
+ u16 tvlv_len = 0;
+ unsigned long send_time;
+
+- if (hard_iface->if_status == BATADV_IF_NOT_IN_USE ||
+- hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)
+- return;
++ lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex);
+
+ /* the interface gets activated here to avoid race conditions between
+ * the moment of activating the interface in
+@@ -1005,6 +1036,17 @@ out:
+ batadv_hardif_put(primary_if);
+ }
+
++static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
++{
++ if (hard_iface->if_status == BATADV_IF_NOT_IN_USE ||
++ hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)
++ return;
++
++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
++ batadv_iv_ogm_schedule_buff(hard_iface);
++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
++}
++
+ /**
+ * batadv_iv_ogm_orig_update() - use OGM to update corresponding data in an
+ * originator
+diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
+index 36f0962040d1..c4e0435c952d 100644
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -29,6 +29,7 @@
+ #include <linux/kernel.h>
+ #include <linux/kref.h>
+ #include <linux/list.h>
++#include <linux/mutex.h>
+ #include <linux/netdevice.h>
+ #include <linux/printk.h>
+ #include <linux/rculist.h>
+@@ -933,6 +934,7 @@ batadv_hardif_add_interface(struct net_device *net_dev)
+ INIT_LIST_HEAD(&hard_iface->list);
+ INIT_HLIST_HEAD(&hard_iface->neigh_list);
+
++ mutex_init(&hard_iface->bat_iv.ogm_buff_mutex);
+ spin_lock_init(&hard_iface->neigh_list_lock);
+ kref_init(&hard_iface->refcount);
+
+diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
+index fdba8a144d73..87e54f8a3f83 100644
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -91,6 +91,9 @@ struct batadv_hard_iface_bat_iv {
+
+ /** @ogm_seqno: OGM sequence number - used to identify each OGM */
+ atomic_t ogm_seqno;
++
++ /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */
++ struct mutex ogm_buff_mutex;
+ };
+
+ /**
+diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
+index 4d78375f9872..647c0554d04c 100644
+--- a/net/llc/llc_c_ac.c
++++ b/net/llc/llc_c_ac.c
+@@ -372,6 +372,7 @@ int llc_conn_ac_send_i_cmd_p_set_1(struct sock *sk, struct sk_buff *skb)
+ llc_pdu_init_as_i_cmd(skb, 1, llc->vS, llc->vR);
+ rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
+ if (likely(!rc)) {
++ skb_get(skb);
+ llc_conn_send_pdu(sk, skb);
+ llc_conn_ac_inc_vs_by_1(sk, skb);
+ }
+@@ -389,7 +390,8 @@ static int llc_conn_ac_send_i_cmd_p_set_0(struct sock *sk, struct sk_buff *skb)
+ llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR);
+ rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
+ if (likely(!rc)) {
+- rc = llc_conn_send_pdu(sk, skb);
++ skb_get(skb);
++ llc_conn_send_pdu(sk, skb);
+ llc_conn_ac_inc_vs_by_1(sk, skb);
+ }
+ return rc;
+@@ -406,6 +408,7 @@ int llc_conn_ac_send_i_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
+ llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR);
+ rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
+ if (likely(!rc)) {
++ skb_get(skb);
+ llc_conn_send_pdu(sk, skb);
+ llc_conn_ac_inc_vs_by_1(sk, skb);
+ }
+@@ -916,7 +919,8 @@ static int llc_conn_ac_send_i_rsp_f_set_ackpf(struct sock *sk,
+ llc_pdu_init_as_i_cmd(skb, llc->ack_pf, llc->vS, llc->vR);
+ rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
+ if (likely(!rc)) {
+- rc = llc_conn_send_pdu(sk, skb);
++ skb_get(skb);
++ llc_conn_send_pdu(sk, skb);
+ llc_conn_ac_inc_vs_by_1(sk, skb);
+ }
+ return rc;
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index 4ff89cb7c86f..ed2aca12460c 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -30,7 +30,7 @@
+ #endif
+
+ static int llc_find_offset(int state, int ev_type);
+-static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *skb);
++static void llc_conn_send_pdus(struct sock *sk);
+ static int llc_conn_service(struct sock *sk, struct sk_buff *skb);
+ static int llc_exec_conn_trans_actions(struct sock *sk,
+ struct llc_conn_state_trans *trans,
+@@ -193,11 +193,11 @@ out_skb_put:
+ return rc;
+ }
+
+-int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb)
++void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb)
+ {
+ /* queue PDU to send to MAC layer */
+ skb_queue_tail(&sk->sk_write_queue, skb);
+- return llc_conn_send_pdus(sk, skb);
++ llc_conn_send_pdus(sk);
+ }
+
+ /**
+@@ -255,7 +255,7 @@ void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit)
+ if (howmany_resend > 0)
+ llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
+ /* any PDUs to re-send are queued up; start sending to MAC */
+- llc_conn_send_pdus(sk, NULL);
++ llc_conn_send_pdus(sk);
+ out:;
+ }
+
+@@ -296,7 +296,7 @@ void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit)
+ if (howmany_resend > 0)
+ llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
+ /* any PDUs to re-send are queued up; start sending to MAC */
+- llc_conn_send_pdus(sk, NULL);
++ llc_conn_send_pdus(sk);
+ out:;
+ }
+
+@@ -340,16 +340,12 @@ out:
+ /**
+ * llc_conn_send_pdus - Sends queued PDUs
+ * @sk: active connection
+- * @hold_skb: the skb held by caller, or NULL if does not care
+ *
+- * Sends queued pdus to MAC layer for transmission. When @hold_skb is
+- * NULL, always return 0. Otherwise, return 0 if @hold_skb is sent
+- * successfully, or 1 for failure.
++ * Sends queued pdus to MAC layer for transmission.
+ */
+-static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *hold_skb)
++static void llc_conn_send_pdus(struct sock *sk)
+ {
+ struct sk_buff *skb;
+- int ret = 0;
+
+ while ((skb = skb_dequeue(&sk->sk_write_queue)) != NULL) {
+ struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+@@ -361,20 +357,10 @@ static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *hold_skb)
+ skb_queue_tail(&llc_sk(sk)->pdu_unack_q, skb);
+ if (!skb2)
+ break;
+- dev_queue_xmit(skb2);
+- } else {
+- bool is_target = skb == hold_skb;
+- int rc;
+-
+- if (is_target)
+- skb_get(skb);
+- rc = dev_queue_xmit(skb);
+- if (is_target)
+- ret = rc;
++ skb = skb2;
+ }
++ dev_queue_xmit(skb);
+ }
+-
+- return ret;
+ }
+
+ /**
+diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c
+index a94bd56bcac6..7ae4cc684d3a 100644
+--- a/net/llc/llc_s_ac.c
++++ b/net/llc/llc_s_ac.c
+@@ -58,8 +58,10 @@ int llc_sap_action_send_ui(struct llc_sap *sap, struct sk_buff *skb)
+ ev->daddr.lsap, LLC_PDU_CMD);
+ llc_pdu_init_as_ui_cmd(skb);
+ rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);
+- if (likely(!rc))
++ if (likely(!rc)) {
++ skb_get(skb);
+ rc = dev_queue_xmit(skb);
++ }
+ return rc;
+ }
+
+@@ -81,8 +83,10 @@ int llc_sap_action_send_xid_c(struct llc_sap *sap, struct sk_buff *skb)
+ ev->daddr.lsap, LLC_PDU_CMD);
+ llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0);
+ rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);
+- if (likely(!rc))
++ if (likely(!rc)) {
++ skb_get(skb);
+ rc = dev_queue_xmit(skb);
++ }
+ return rc;
+ }
+
+@@ -135,8 +139,10 @@ int llc_sap_action_send_test_c(struct llc_sap *sap, struct sk_buff *skb)
+ ev->daddr.lsap, LLC_PDU_CMD);
+ llc_pdu_init_as_test_cmd(skb);
+ rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);
+- if (likely(!rc))
++ if (likely(!rc)) {
++ skb_get(skb);
+ rc = dev_queue_xmit(skb);
++ }
+ return rc;
+ }
+
+diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
+index a7f7b8ff4729..be419062e19a 100644
+--- a/net/llc/llc_sap.c
++++ b/net/llc/llc_sap.c
+@@ -197,29 +197,22 @@ out:
+ * After executing actions of the event, upper layer will be indicated
+ * if needed(on receiving an UI frame). sk can be null for the
+ * datalink_proto case.
++ *
++ * This function always consumes a reference to the skb.
+ */
+ static void llc_sap_state_process(struct llc_sap *sap, struct sk_buff *skb)
+ {
+ struct llc_sap_state_ev *ev = llc_sap_ev(skb);
+
+- /*
+- * We have to hold the skb, because llc_sap_next_state
+- * will kfree it in the sending path and we need to
+- * look at the skb->cb, where we encode llc_sap_state_ev.
+- */
+- skb_get(skb);
+ ev->ind_cfm_flag = 0;
+ llc_sap_next_state(sap, skb);
+- if (ev->ind_cfm_flag == LLC_IND) {
+- if (skb->sk->sk_state == TCP_LISTEN)
+- kfree_skb(skb);
+- else {
+- llc_save_primitive(skb->sk, skb, ev->prim);
+
+- /* queue skb to the user. */
+- if (sock_queue_rcv_skb(skb->sk, skb))
+- kfree_skb(skb);
+- }
++ if (ev->ind_cfm_flag == LLC_IND && skb->sk->sk_state != TCP_LISTEN) {
++ llc_save_primitive(skb->sk, skb, ev->prim);
++
++ /* queue skb to the user. */
++ if (sock_queue_rcv_skb(skb->sk, skb) == 0)
++ return;
+ }
+ kfree_skb(skb);
+ }
+diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+index 4f01321e793c..794e0335a864 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+@@ -235,6 +235,9 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
+ else
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
+
++ if (is_zero_ether_addr(e.ether))
++ return -EINVAL;
++
+ return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags);
+ }
+
+diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
+index 16ec822e4044..25560ea742d6 100644
+--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
++++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
+@@ -36,9 +36,6 @@ MODULE_ALIAS("ip_set_hash:ip,mac");
+ /* Type specific function prefix */
+ #define HTYPE hash_ipmac
+
+-/* Zero valued element is not supported */
+-static const unsigned char invalid_ether[ETH_ALEN] = { 0 };
+-
+ /* IPv4 variant */
+
+ /* Member elements */
+@@ -104,7 +101,7 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
+ else
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
+
+- if (ether_addr_equal(e.ether, invalid_ether))
++ if (is_zero_ether_addr(e.ether))
+ return -EINVAL;
+
+ ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip);
+@@ -140,7 +137,7 @@ hash_ipmac4_uadt(struct ip_set *set, struct nlattr *tb[],
+ if (ret)
+ return ret;
+ memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
+- if (ether_addr_equal(e.ether, invalid_ether))
++ if (is_zero_ether_addr(e.ether))
+ return -IPSET_ERR_HASH_ELEM;
+
+ return adtfn(set, &e, &ext, &ext, flags);
+@@ -220,7 +217,7 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb,
+ else
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
+
+- if (ether_addr_equal(e.ether, invalid_ether))
++ if (is_zero_ether_addr(e.ether))
+ return -EINVAL;
+
+ ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6);
+@@ -260,7 +257,7 @@ hash_ipmac6_uadt(struct ip_set *set, struct nlattr *tb[],
+ return ret;
+
+ memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN);
+- if (ether_addr_equal(e.ether, invalid_ether))
++ if (is_zero_ether_addr(e.ether))
+ return -IPSET_ERR_HASH_ELEM;
+
+ return adtfn(set, &e, &ext, &ext, flags);
+diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
+index 71547e8673b9..b91b090217cd 100644
+--- a/net/rxrpc/peer_object.c
++++ b/net/rxrpc/peer_object.c
+@@ -220,7 +220,7 @@ struct rxrpc_peer *rxrpc_alloc_peer(struct rxrpc_local *local, gfp_t gfp)
+ peer = kzalloc(sizeof(struct rxrpc_peer), gfp);
+ if (peer) {
+ atomic_set(&peer->usage, 1);
+- peer->local = local;
++ peer->local = rxrpc_get_local(local);
+ INIT_HLIST_HEAD(&peer->error_targets);
+ peer->service_conns = RB_ROOT;
+ seqlock_init(&peer->service_conn_lock);
+@@ -311,7 +311,6 @@ void rxrpc_new_incoming_peer(struct rxrpc_sock *rx, struct rxrpc_local *local,
+ unsigned long hash_key;
+
+ hash_key = rxrpc_peer_hash_key(local, &peer->srx);
+- peer->local = local;
+ rxrpc_init_peer(rx, peer, hash_key);
+
+ spin_lock(&rxnet->peer_hash_lock);
+@@ -386,7 +385,7 @@ struct rxrpc_peer *rxrpc_get_peer(struct rxrpc_peer *peer)
+ int n;
+
+ n = atomic_inc_return(&peer->usage);
+- trace_rxrpc_peer(peer, rxrpc_peer_got, n, here);
++ trace_rxrpc_peer(peer->debug_id, rxrpc_peer_got, n, here);
+ return peer;
+ }
+
+@@ -400,7 +399,7 @@ struct rxrpc_peer *rxrpc_get_peer_maybe(struct rxrpc_peer *peer)
+ if (peer) {
+ int n = atomic_fetch_add_unless(&peer->usage, 1, 0);
+ if (n > 0)
+- trace_rxrpc_peer(peer, rxrpc_peer_got, n + 1, here);
++ trace_rxrpc_peer(peer->debug_id, rxrpc_peer_got, n + 1, here);
+ else
+ peer = NULL;
+ }
+@@ -421,6 +420,7 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer)
+ list_del_init(&peer->keepalive_link);
+ spin_unlock_bh(&rxnet->peer_hash_lock);
+
++ rxrpc_put_local(peer->local);
+ kfree_rcu(peer, rcu);
+ }
+
+@@ -430,11 +430,13 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer)
+ void rxrpc_put_peer(struct rxrpc_peer *peer)
+ {
+ const void *here = __builtin_return_address(0);
++ unsigned int debug_id;
+ int n;
+
+ if (peer) {
++ debug_id = peer->debug_id;
+ n = atomic_dec_return(&peer->usage);
+- trace_rxrpc_peer(peer, rxrpc_peer_put, n, here);
++ trace_rxrpc_peer(debug_id, rxrpc_peer_put, n, here);
+ if (n == 0)
+ __rxrpc_put_peer(peer);
+ }
+@@ -447,13 +449,15 @@ void rxrpc_put_peer(struct rxrpc_peer *peer)
+ void rxrpc_put_peer_locked(struct rxrpc_peer *peer)
+ {
+ const void *here = __builtin_return_address(0);
++ unsigned int debug_id = peer->debug_id;
+ int n;
+
+ n = atomic_dec_return(&peer->usage);
+- trace_rxrpc_peer(peer, rxrpc_peer_put, n, here);
++ trace_rxrpc_peer(debug_id, rxrpc_peer_put, n, here);
+ if (n == 0) {
+ hash_del_rcu(&peer->hash_link);
+ list_del_init(&peer->keepalive_link);
++ rxrpc_put_local(peer->local);
+ kfree_rcu(peer, rcu);
+ }
+ }
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index 5d6ab4f6fd7a..3e54ead1e921 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -661,6 +661,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
+ case RXRPC_CALL_SERVER_PREALLOC:
+ case RXRPC_CALL_SERVER_SECURING:
+ case RXRPC_CALL_SERVER_ACCEPTING:
++ rxrpc_put_call(call, rxrpc_call_put);
+ ret = -EBUSY;
+ goto error_release_sock;
+ default:
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 86350fe5cfc8..15f8f24c190d 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -474,7 +474,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ * skb will be queued.
+ */
+ if (count > 1 && (skb2 = skb_clone(skb, GFP_ATOMIC)) != NULL) {
+- struct Qdisc *rootq = qdisc_root(sch);
++ struct Qdisc *rootq = qdisc_root_bh(sch);
+ u32 dupsave = q->duplicate; /* prevent duplicating a dup... */
+
+ q->duplicate = 0;
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index a28d6456e93e..2ef1f56504cb 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -284,7 +284,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
+ [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
+ .len = IEEE80211_MAX_MESH_ID_LEN },
+- [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
++ [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_BINARY,
++ .len = ETH_ALEN },
+
+ [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
+ [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
+diff --git a/samples/bpf/bpf_load.c b/samples/bpf/bpf_load.c
+index 5061a2ec4564..176c04a454dc 100644
+--- a/samples/bpf/bpf_load.c
++++ b/samples/bpf/bpf_load.c
+@@ -59,7 +59,9 @@ static int write_kprobe_events(const char *val)
+ {
+ int fd, ret, flags;
+
+- if ((val != NULL) && (val[0] == '\0'))
++ if (val == NULL)
++ return -1;
++ else if (val[0] == '\0')
+ flags = O_WRONLY | O_TRUNC;
+ else
+ flags = O_WRONLY | O_APPEND;
+diff --git a/scripts/setlocalversion b/scripts/setlocalversion
+index 71f39410691b..365b3c2b8f43 100755
+--- a/scripts/setlocalversion
++++ b/scripts/setlocalversion
+@@ -73,8 +73,16 @@ scm_version()
+ printf -- '-svn%s' "`git svn find-rev $head`"
+ fi
+
+- # Check for uncommitted changes
+- if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then
++ # Check for uncommitted changes.
++ # First, with git-status, but --no-optional-locks is only
++ # supported in git >= 2.14, so fall back to git-diff-index if
++ # it fails. Note that git-diff-index does not refresh the
++ # index, so it may give misleading results. See
++ # git-update-index(1), git-diff-index(1), and git-status(1).
++ if {
++ git --no-optional-locks status -uno --porcelain 2>/dev/null ||
++ git diff-index --name-only HEAD
++ } | grep -qvE '^(.. )?scripts/package'; then
+ printf '%s' -dirty
+ fi
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 61a0cec6e1f6..ec74705f003b 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -240,7 +240,8 @@ static int snd_timer_check_master(struct snd_timer_instance *master)
+ return 0;
+ }
+
+-static int snd_timer_close_locked(struct snd_timer_instance *timeri);
++static int snd_timer_close_locked(struct snd_timer_instance *timeri,
++ struct device **card_devp_to_put);
+
+ /*
+ * open a timer instance
+@@ -252,21 +253,23 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ {
+ struct snd_timer *timer;
+ struct snd_timer_instance *timeri = NULL;
++ struct device *card_dev_to_put = NULL;
+ int err;
+
++ mutex_lock(®ister_mutex);
+ if (tid->dev_class == SNDRV_TIMER_CLASS_SLAVE) {
+ /* open a slave instance */
+ if (tid->dev_sclass <= SNDRV_TIMER_SCLASS_NONE ||
+ tid->dev_sclass > SNDRV_TIMER_SCLASS_OSS_SEQUENCER) {
+ pr_debug("ALSA: timer: invalid slave class %i\n",
+ tid->dev_sclass);
+- return -EINVAL;
++ err = -EINVAL;
++ goto unlock;
+ }
+- mutex_lock(®ister_mutex);
+ timeri = snd_timer_instance_new(owner, NULL);
+ if (!timeri) {
+- mutex_unlock(®ister_mutex);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto unlock;
+ }
+ timeri->slave_class = tid->dev_sclass;
+ timeri->slave_id = tid->device;
+@@ -274,16 +277,13 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ list_add_tail(&timeri->open_list, &snd_timer_slave_list);
+ err = snd_timer_check_slave(timeri);
+ if (err < 0) {
+- snd_timer_close_locked(timeri);
++ snd_timer_close_locked(timeri, &card_dev_to_put);
+ timeri = NULL;
+ }
+- mutex_unlock(®ister_mutex);
+- *ti = timeri;
+- return err;
++ goto unlock;
+ }
+
+ /* open a master instance */
+- mutex_lock(®ister_mutex);
+ timer = snd_timer_find(tid);
+ #ifdef CONFIG_MODULES
+ if (!timer) {
+@@ -294,25 +294,26 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ }
+ #endif
+ if (!timer) {
+- mutex_unlock(®ister_mutex);
+- return -ENODEV;
++ err = -ENODEV;
++ goto unlock;
+ }
+ if (!list_empty(&timer->open_list_head)) {
+ timeri = list_entry(timer->open_list_head.next,
+ struct snd_timer_instance, open_list);
+ if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
+- mutex_unlock(®ister_mutex);
+- return -EBUSY;
++ err = -EBUSY;
++ timeri = NULL;
++ goto unlock;
+ }
+ }
+ if (timer->num_instances >= timer->max_instances) {
+- mutex_unlock(®ister_mutex);
+- return -EBUSY;
++ err = -EBUSY;
++ goto unlock;
+ }
+ timeri = snd_timer_instance_new(owner, timer);
+ if (!timeri) {
+- mutex_unlock(®ister_mutex);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto unlock;
+ }
+ /* take a card refcount for safe disconnection */
+ if (timer->card)
+@@ -321,16 +322,16 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ timeri->slave_id = slave_id;
+
+ if (list_empty(&timer->open_list_head) && timer->hw.open) {
+- int err = timer->hw.open(timer);
++ err = timer->hw.open(timer);
+ if (err) {
+ kfree(timeri->owner);
+ kfree(timeri);
++ timeri = NULL;
+
+ if (timer->card)
+- put_device(&timer->card->card_dev);
++ card_dev_to_put = &timer->card->card_dev;
+ module_put(timer->module);
+- mutex_unlock(®ister_mutex);
+- return err;
++ goto unlock;
+ }
+ }
+
+@@ -338,10 +339,15 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ timer->num_instances++;
+ err = snd_timer_check_master(timeri);
+ if (err < 0) {
+- snd_timer_close_locked(timeri);
++ snd_timer_close_locked(timeri, &card_dev_to_put);
+ timeri = NULL;
+ }
++
++ unlock:
+ mutex_unlock(®ister_mutex);
++ /* put_device() is called after unlock for avoiding deadlock */
++ if (card_dev_to_put)
++ put_device(card_dev_to_put);
+ *ti = timeri;
+ return err;
+ }
+@@ -351,7 +357,8 @@ EXPORT_SYMBOL(snd_timer_open);
+ * close a timer instance
+ * call this with register_mutex down.
+ */
+-static int snd_timer_close_locked(struct snd_timer_instance *timeri)
++static int snd_timer_close_locked(struct snd_timer_instance *timeri,
++ struct device **card_devp_to_put)
+ {
+ struct snd_timer *timer = NULL;
+ struct snd_timer_instance *slave, *tmp;
+@@ -403,7 +410,7 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+ timer->hw.close(timer);
+ /* release a card refcount for safe disconnection */
+ if (timer->card)
+- put_device(&timer->card->card_dev);
++ *card_devp_to_put = &timer->card->card_dev;
+ module_put(timer->module);
+ }
+
+@@ -415,14 +422,18 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+ */
+ int snd_timer_close(struct snd_timer_instance *timeri)
+ {
++ struct device *card_dev_to_put = NULL;
+ int err;
+
+ if (snd_BUG_ON(!timeri))
+ return -ENXIO;
+
+ mutex_lock(®ister_mutex);
+- err = snd_timer_close_locked(timeri);
++ err = snd_timer_close_locked(timeri, &card_dev_to_put);
+ mutex_unlock(®ister_mutex);
++ /* put_device() is called after unlock for avoiding deadlock */
++ if (card_dev_to_put)
++ put_device(card_dev_to_put);
+ return err;
+ }
+ EXPORT_SYMBOL(snd_timer_close);
+diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c
+index 4d3034a68bdf..be2c056eb62d 100644
+--- a/sound/firewire/bebob/bebob_stream.c
++++ b/sound/firewire/bebob/bebob_stream.c
+@@ -253,8 +253,7 @@ end:
+ return err;
+ }
+
+-static unsigned int
+-map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s)
++static int map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s)
+ {
+ unsigned int sec, sections, ch, channels;
+ unsigned int pcm, midi, location;
+diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
+index e858b6fa0c3a..74244d8e2909 100644
+--- a/sound/hda/hdac_controller.c
++++ b/sound/hda/hdac_controller.c
+@@ -443,8 +443,6 @@ static void azx_int_disable(struct hdac_bus *bus)
+ list_for_each_entry(azx_dev, &bus->stream_list, list)
+ snd_hdac_stream_updateb(azx_dev, SD_CTL, SD_INT_MASK, 0);
+
+- synchronize_irq(bus->irq);
+-
+ /* disable SIE for all streams */
+ snd_hdac_chip_writeb(bus, INTCTL, 0);
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index bfc45086cf79..0b24c5ce2fd6 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1455,9 +1455,9 @@ static int azx_free(struct azx *chip)
+ }
+
+ if (bus->chip_init) {
+- azx_stop_chip(chip);
+ azx_clear_irq_pending(chip);
+ azx_stop_all_streams(chip);
++ azx_stop_chip(chip);
+ }
+
+ if (bus->irq >= 0)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index dd46354270d0..7e86aeb3ec33 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -421,6 +421,9 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0672:
+ alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */
+ break;
++ case 0x10ec0623:
++ alc_update_coef_idx(codec, 0x19, 1<<13, 0);
++ break;
+ case 0x10ec0668:
+ alc_update_coef_idx(codec, 0x7, 3<<13, 0);
+ break;
+@@ -2908,6 +2911,7 @@ enum {
+ ALC269_TYPE_ALC225,
+ ALC269_TYPE_ALC294,
+ ALC269_TYPE_ALC300,
++ ALC269_TYPE_ALC623,
+ ALC269_TYPE_ALC700,
+ };
+
+@@ -2943,6 +2947,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
+ case ALC269_TYPE_ALC225:
+ case ALC269_TYPE_ALC294:
+ case ALC269_TYPE_ALC300:
++ case ALC269_TYPE_ALC623:
+ case ALC269_TYPE_ALC700:
+ ssids = alc269_ssids;
+ break;
+@@ -3458,7 +3463,9 @@ static void alc294_init(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+
+- if (!spec->done_hp_init) {
++ /* required only at boot or S4 resume time */
++ if (!spec->done_hp_init ||
++ codec->core.dev.power.power_state.event == PM_EVENT_RESTORE) {
+ alc294_hp_init(codec);
+ spec->done_hp_init = true;
+ }
+@@ -5251,6 +5258,17 @@ static void alc271_hp_gate_mic_jack(struct hda_codec *codec,
+ }
+ }
+
++static void alc256_fixup_dell_xps_13_headphone_noise2(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ if (action != HDA_FIXUP_ACT_PRE_PROBE)
++ return;
++
++ snd_hda_codec_amp_stereo(codec, 0x1a, HDA_INPUT, 0, HDA_AMP_VOLMASK, 1);
++ snd_hda_override_wcaps(codec, 0x1a, get_wcaps(codec, 0x1a) & ~AC_WCAP_IN_AMP);
++}
++
+ static void alc269_fixup_limit_int_mic_boost(struct hda_codec *codec,
+ const struct hda_fixup *fix,
+ int action)
+@@ -5633,6 +5651,7 @@ enum {
+ ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
+ ALC275_FIXUP_DELL_XPS,
+ ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
++ ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2,
+ ALC293_FIXUP_LENOVO_SPK_NOISE,
+ ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
+ ALC255_FIXUP_DELL_SPK_NOISE,
+@@ -6350,6 +6369,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+ },
++ [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc256_fixup_dell_xps_13_headphone_noise2,
++ .chained = true,
++ .chain_id = ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE
++ },
+ [ALC293_FIXUP_LENOVO_SPK_NOISE] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_disable_aamix,
+@@ -6792,17 +6817,17 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+ SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+ SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+- SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
++ SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2),
+ SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP),
+- SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
++ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2),
+ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
+ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE),
+- SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
++ SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2),
+ SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+@@ -6978,6 +7003,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x3151, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x17aa, 0x3176, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+@@ -7761,6 +7788,9 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->codec_variant = ALC269_TYPE_ALC300;
+ spec->gen.mixer_nid = 0; /* no loopback on ALC300 */
+ break;
++ case 0x10ec0623:
++ spec->codec_variant = ALC269_TYPE_ALC623;
++ break;
+ case 0x10ec0700:
+ case 0x10ec0701:
+ case 0x10ec0703:
+@@ -8879,6 +8909,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ HDA_CODEC_ENTRY(0x10ec0298, "ALC298", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0299, "ALC299", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0300, "ALC300", patch_alc269),
++ HDA_CODEC_ENTRY(0x10ec0623, "ALC623", patch_alc269),
+ HDA_CODEC_REV_ENTRY(0x10ec0861, 0x100340, "ALC660", patch_alc861),
+ HDA_CODEC_ENTRY(0x10ec0660, "ALC660-VD", patch_alc861vd),
+ HDA_CODEC_ENTRY(0x10ec0861, "ALC861", patch_alc861),
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 60d00091f64b..c102c0377ad9 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1343,7 +1343,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ struct usb_interface *iface;
+
+ /* Playback Designs */
+- if (USB_ID_VENDOR(chip->usb_id) == 0x23ba) {
++ if (USB_ID_VENDOR(chip->usb_id) == 0x23ba &&
++ USB_ID_PRODUCT(chip->usb_id) < 0x0110) {
+ switch (fp->altsetting) {
+ case 1:
+ fp->dsd_dop = true;
+@@ -1360,37 +1361,19 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ /* XMOS based USB DACs */
+ switch (chip->usb_id) {
+ case USB_ID(0x1511, 0x0037): /* AURALiC VEGA */
+- case USB_ID(0x20b1, 0x0002): /* Wyred 4 Sound DAC-2 DSD */
+- case USB_ID(0x20b1, 0x2004): /* Matrix Audio X-SPDIF 2 */
+- case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */
+- case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */
+- case USB_ID(0x22d9, 0x0416): /* OPPO HA-1 */
+- case USB_ID(0x22d9, 0x0436): /* OPPO Sonica */
+- case USB_ID(0x22d9, 0x0461): /* OPPO UDP-205 */
+ case USB_ID(0x2522, 0x0012): /* LH Labs VI DAC Infinity */
+ case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */
+ if (fp->altsetting == 2)
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+
+- case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */
+- case USB_ID(0x152a, 0x85de): /* SMSL D1 DAC */
+- case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
+ case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
++ case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */
+ case USB_ID(0x16b0, 0x06b2): /* NuPrime DAC-10 */
++ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
+ case USB_ID(0x16d0, 0x0733): /* Furutech ADL Stratos */
+ case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */
+ case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */
+- case USB_ID(0x20b1, 0x000a): /* Gustard DAC-X20U */
+- case USB_ID(0x20b1, 0x2005): /* Denafrips Ares DAC */
+- case USB_ID(0x20b1, 0x2009): /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */
+- case USB_ID(0x20b1, 0x2023): /* JLsounds I2SoverUSB */
+- case USB_ID(0x20b1, 0x3021): /* Eastern El. MiniMax Tube DAC Supreme */
+- case USB_ID(0x20b1, 0x3023): /* Aune X1S 32BIT/384 DSD DAC */
+- case USB_ID(0x20b1, 0x302d): /* Unison Research Unico CD Due */
+- case USB_ID(0x20b1, 0x307b): /* CH Precision C1 DAC */
+- case USB_ID(0x20b1, 0x3086): /* Singxer F-1 converter board */
+- case USB_ID(0x22d9, 0x0426): /* OPPO HA-2 */
+ case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */
+ case USB_ID(0x249c, 0x9326): /* M2Tech Young MkIII */
+ case USB_ID(0x2616, 0x0106): /* PS Audio NuWave DAC */
+@@ -1445,9 +1428,13 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ * from XMOS/Thesycon
+ */
+ switch (USB_ID_VENDOR(chip->usb_id)) {
+- case 0x20b1: /* XMOS based devices */
+ case 0x152a: /* Thesycon devices */
++ case 0x20b1: /* XMOS based devices */
++ case 0x22d9: /* Oppo */
++ case 0x23ba: /* Playback Designs */
+ case 0x25ce: /* Mytek devices */
++ case 0x278b: /* Rotel? */
++ case 0x292b: /* Gustard/Ess based devices */
+ case 0x2ab6: /* T+A devices */
+ case 0x3842: /* EVGA */
+ case 0xc502: /* HiBy devices */
+diff --git a/tools/lib/subcmd/Makefile b/tools/lib/subcmd/Makefile
+index ed61fb3a46c0..5b2cd5e58df0 100644
+--- a/tools/lib/subcmd/Makefile
++++ b/tools/lib/subcmd/Makefile
+@@ -20,7 +20,13 @@ MAKEFLAGS += --no-print-directory
+ LIBFILE = $(OUTPUT)libsubcmd.a
+
+ CFLAGS := $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
+-CFLAGS += -ggdb3 -Wall -Wextra -std=gnu99 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -fPIC
++CFLAGS += -ggdb3 -Wall -Wextra -std=gnu99 -fPIC
++
++ifeq ($(DEBUG),0)
++ ifeq ($(feature-fortify-source), 1)
++ CFLAGS += -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2
++ endif
++endif
+
+ ifeq ($(CC_NO_CLANG), 0)
+ CFLAGS += -O3
+diff --git a/tools/perf/arch/powerpc/util/header.c b/tools/perf/arch/powerpc/util/header.c
+index 0b242664f5ea..e46be9ef5a68 100644
+--- a/tools/perf/arch/powerpc/util/header.c
++++ b/tools/perf/arch/powerpc/util/header.c
+@@ -1,5 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include <sys/types.h>
++#include <errno.h>
+ #include <unistd.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+@@ -31,7 +32,7 @@ get_cpuid(char *buffer, size_t sz)
+ buffer[nb-1] = '\0';
+ return 0;
+ }
+- return -1;
++ return ENOBUFS;
+ }
+
+ char *
+diff --git a/tools/perf/arch/s390/util/header.c b/tools/perf/arch/s390/util/header.c
+index 163b92f33998..cc72554c362a 100644
+--- a/tools/perf/arch/s390/util/header.c
++++ b/tools/perf/arch/s390/util/header.c
+@@ -11,6 +11,7 @@
+ */
+
+ #include <sys/types.h>
++#include <errno.h>
+ #include <unistd.h>
+ #include <stdio.h>
+ #include <string.h>
+@@ -56,7 +57,7 @@ int get_cpuid(char *buffer, size_t sz)
+
+ sysinfo = fopen(SYSINFO, "r");
+ if (sysinfo == NULL)
+- return -1;
++ return errno;
+
+ while ((read = getline(&line, &line_sz, sysinfo)) != -1) {
+ if (!strncmp(line, SYSINFO_MANU, strlen(SYSINFO_MANU))) {
+@@ -91,7 +92,7 @@ int get_cpuid(char *buffer, size_t sz)
+
+ /* Missing manufacturer, type or model information should not happen */
+ if (!manufacturer[0] || !type[0] || !model[0])
+- return -1;
++ return EINVAL;
+
+ /*
+ * Scan /proc/service_levels and return the CPU-MF counter facility
+@@ -135,14 +136,14 @@ skip_sysinfo:
+ else
+ nbytes = snprintf(buffer, sz, "%s,%s,%s", manufacturer, type,
+ model);
+- return (nbytes >= sz) ? -1 : 0;
++ return (nbytes >= sz) ? ENOBUFS : 0;
+ }
+
+ char *get_cpuid_str(struct perf_pmu *pmu __maybe_unused)
+ {
+ char *buf = malloc(128);
+
+- if (buf && get_cpuid(buf, 128) < 0)
++ if (buf && get_cpuid(buf, 128))
+ zfree(&buf);
+ return buf;
+ }
+diff --git a/tools/perf/arch/x86/util/header.c b/tools/perf/arch/x86/util/header.c
+index fb0d71afee8b..2a5daec6fb8b 100644
+--- a/tools/perf/arch/x86/util/header.c
++++ b/tools/perf/arch/x86/util/header.c
+@@ -1,5 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include <sys/types.h>
++#include <errno.h>
+ #include <unistd.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+@@ -56,7 +57,7 @@ __get_cpuid(char *buffer, size_t sz, const char *fmt)
+ buffer[nb-1] = '\0';
+ return 0;
+ }
+- return -1;
++ return ENOBUFS;
+ }
+
+ int
+diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c
+index 2b1ef704169f..952e2228f6c6 100644
+--- a/tools/perf/builtin-kvm.c
++++ b/tools/perf/builtin-kvm.c
+@@ -699,14 +699,15 @@ static int process_sample_event(struct perf_tool *tool,
+
+ static int cpu_isa_config(struct perf_kvm_stat *kvm)
+ {
+- char buf[64], *cpuid;
++ char buf[128], *cpuid;
+ int err;
+
+ if (kvm->live) {
+ err = get_cpuid(buf, sizeof(buf));
+ if (err != 0) {
+- pr_err("Failed to look up CPU type\n");
+- return err;
++ pr_err("Failed to look up CPU type: %s\n",
++ str_error_r(err, buf, sizeof(buf)));
++ return -err;
+ }
+ cpuid = buf;
+ } else
+diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
+index 53c11fc0855e..d20f851796c5 100644
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -1021,7 +1021,7 @@ static int perf_sample__fprintf_brstackinsn(struct perf_sample *sample,
+ continue;
+
+ insn = 0;
+- for (off = 0;; off += ilen) {
++ for (off = 0; off < (unsigned)len; off += ilen) {
+ uint64_t ip = start + off;
+
+ printed += ip__fprintf_sym(ip, thread, x.cpumode, x.cpu, &lastsym, attr, fp);
+@@ -1029,6 +1029,7 @@ static int perf_sample__fprintf_brstackinsn(struct perf_sample *sample,
+ printed += ip__fprintf_jump(ip, &br->entries[i], &x, buffer + off, len - off, insn, fp);
+ break;
+ } else {
++ ilen = 0;
+ printed += fprintf(fp, "\t%016" PRIx64 "\t%s\n", ip,
+ dump_insn(&x, ip, buffer + off, len - off, &ilen));
+ if (ilen == 0)
+@@ -1036,6 +1037,8 @@ static int perf_sample__fprintf_brstackinsn(struct perf_sample *sample,
+ insn++;
+ }
+ }
++ if (off != (unsigned)len)
++ printed += fprintf(fp, "\tmismatch of LBR data and executable\n");
+ }
+
+ /*
+@@ -1066,6 +1069,7 @@ static int perf_sample__fprintf_brstackinsn(struct perf_sample *sample,
+ goto out;
+ }
+ for (off = 0; off <= end - start; off += ilen) {
++ ilen = 0;
+ printed += fprintf(fp, "\t%016" PRIx64 "\t%s\n", start + off,
+ dump_insn(&x, start + off, buffer + off, len - off, &ilen));
+ if (ilen == 0)
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index 6b36b7110669..6cd9623ebc93 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -446,12 +446,12 @@ static struct fixed {
+ const char *name;
+ const char *event;
+ } fixed[] = {
+- { "inst_retired.any", "event=0xc0" },
+- { "inst_retired.any_p", "event=0xc0" },
+- { "cpu_clk_unhalted.ref", "event=0x0,umask=0x03" },
+- { "cpu_clk_unhalted.thread", "event=0x3c" },
+- { "cpu_clk_unhalted.core", "event=0x3c" },
+- { "cpu_clk_unhalted.thread_any", "event=0x3c,any=1" },
++ { "inst_retired.any", "event=0xc0,period=2000003" },
++ { "inst_retired.any_p", "event=0xc0,period=2000003" },
++ { "cpu_clk_unhalted.ref", "event=0x0,umask=0x03,period=2000003" },
++ { "cpu_clk_unhalted.thread", "event=0x3c,period=2000003" },
++ { "cpu_clk_unhalted.core", "event=0x3c,period=2000003" },
++ { "cpu_clk_unhalted.thread_any", "event=0x3c,any=1,period=2000003" },
+ { NULL, NULL},
+ };
+
+diff --git a/tools/perf/tests/perf-hooks.c b/tools/perf/tests/perf-hooks.c
+index a693bcf017ea..44c16fd11bf6 100644
+--- a/tools/perf/tests/perf-hooks.c
++++ b/tools/perf/tests/perf-hooks.c
+@@ -20,12 +20,11 @@ static void sigsegv_handler(int sig __maybe_unused)
+ static void the_hook(void *_hook_flags)
+ {
+ int *hook_flags = _hook_flags;
+- int *p = NULL;
+
+ *hook_flags = 1234;
+
+ /* Generate a segfault, test perf_hooks__recover */
+- *p = 0;
++ raise(SIGSEGV);
+ }
+
+ int test__perf_hooks(struct test *test __maybe_unused, int subtest __maybe_unused)
+diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
+index daea1fdf7385..6958d7eed5be 100644
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -1614,7 +1614,7 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
+
+ build_id_path = strdup(filename);
+ if (!build_id_path)
+- return -1;
++ return ENOMEM;
+
+ /*
+ * old style build-id cache has name of XX/XXXXXXX.. while
+@@ -1871,11 +1871,11 @@ int symbol__annotate(struct symbol *sym, struct map *map,
+ int err;
+
+ if (!arch_name)
+- return -1;
++ return errno;
+
+ args.arch = arch = arch__find(arch_name);
+ if (arch == NULL)
+- return -ENOTSUP;
++ return ENOTSUP;
+
+ if (parch)
+ *parch = arch;
+@@ -2732,7 +2732,7 @@ int symbol__annotate2(struct symbol *sym, struct map *map, struct perf_evsel *ev
+
+ notes->offsets = zalloc(size * sizeof(struct annotation_line *));
+ if (notes->offsets == NULL)
+- return -1;
++ return ENOMEM;
+
+ if (perf_evsel__is_group_event(evsel))
+ nr_pcnt = evsel->nr_members;
+@@ -2757,7 +2757,7 @@ int symbol__annotate2(struct symbol *sym, struct map *map, struct perf_evsel *ev
+
+ out_free_offsets:
+ zfree(¬es->offsets);
+- return -1;
++ return err;
+ }
+
+ #define ANNOTATION__CFG(n) \
+diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
+index 6a6929f208b4..1117ab86ebd3 100644
+--- a/tools/perf/util/map.c
++++ b/tools/perf/util/map.c
+@@ -1,5 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include "symbol.h"
++#include <assert.h>
+ #include <errno.h>
+ #include <inttypes.h>
+ #include <limits.h>
+@@ -751,6 +752,8 @@ static int maps__fixup_overlappings(struct maps *maps, struct map *map, FILE *fp
+ }
+
+ after->start = map->end;
++ after->pgoff += map->end - pos->start;
++ assert(pos->map_ip(pos, map->end) == after->map_ip(after, map->end));
+ __map_groups__insert(pos->groups, after);
+ if (verbose >= 2 && !use_browser)
+ map__fprintf(after, fp);
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 71cf7e77291a..823bbc741ad7 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -1953,11 +1953,12 @@ done:
+ #define PCL_7S 11 /* PC7 Shrink */
+ #define PCL__8 12 /* PC8 */
+ #define PCL__9 13 /* PC9 */
+-#define PCLUNL 14 /* Unlimited */
++#define PCL_10 14 /* PC10 */
++#define PCLUNL 15 /* Unlimited */
+
+ int pkg_cstate_limit = PCLUKN;
+ char *pkg_cstate_limit_strings[] = { "reserved", "unknown", "pc0", "pc1", "pc2",
+- "pc3", "pc4", "pc6", "pc6n", "pc6r", "pc7", "pc7s", "pc8", "pc9", "unlimited"};
++ "pc3", "pc4", "pc6", "pc6n", "pc6r", "pc7", "pc7s", "pc8", "pc9", "pc10", "unlimited"};
+
+ int nhm_pkg_cstate_limits[16] = {PCL__0, PCL__1, PCL__3, PCL__6, PCL__7, PCLRSV, PCLRSV, PCLUNL, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV};
+ int snb_pkg_cstate_limits[16] = {PCL__0, PCL__2, PCL_6N, PCL_6R, PCL__7, PCL_7S, PCLRSV, PCLUNL, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV};
+@@ -1965,7 +1966,7 @@ int hsw_pkg_cstate_limits[16] = {PCL__0, PCL__2, PCL__3, PCL__6, PCL__7, PCL_7S,
+ int slv_pkg_cstate_limits[16] = {PCL__0, PCL__1, PCLRSV, PCLRSV, PCL__4, PCLRSV, PCL__6, PCL__7, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCL__6, PCL__7};
+ int amt_pkg_cstate_limits[16] = {PCLUNL, PCL__1, PCL__2, PCLRSV, PCLRSV, PCLRSV, PCL__6, PCL__7, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV};
+ int phi_pkg_cstate_limits[16] = {PCL__0, PCL__2, PCL_6N, PCL_6R, PCLRSV, PCLRSV, PCLRSV, PCLUNL, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV};
+-int bxt_pkg_cstate_limits[16] = {PCL__0, PCL__2, PCLUNL, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV};
++int glm_pkg_cstate_limits[16] = {PCLUNL, PCL__1, PCL__3, PCL__6, PCL__7, PCL_7S, PCL__8, PCL__9, PCL_10, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV};
+ int skx_pkg_cstate_limits[16] = {PCL__0, PCL__2, PCL_6N, PCL_6R, PCLRSV, PCLRSV, PCLRSV, PCLUNL, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV};
+
+
+@@ -3165,7 +3166,7 @@ int probe_nhm_msrs(unsigned int family, unsigned int model)
+ case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */
+ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ case INTEL_FAM6_ATOM_GOLDMONT_X: /* DNV */
+- pkg_cstate_limits = bxt_pkg_cstate_limits;
++ pkg_cstate_limits = glm_pkg_cstate_limits;
+ break;
+ default:
+ return 0;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-11-10 16:20 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-11-10 16:20 UTC (permalink / raw
To: gentoo-commits
commit: b8aafdcd425c5d7d9ae6dfddacd215b4c1084bbe
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 10 16:20:21 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Nov 10 16:20:21 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b8aafdcd
Linux patch 4.19.83
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1082_linux-4.19.83.patch | 4183 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4187 insertions(+)
diff --git a/0000_README b/0000_README
index 3a289a8..4a7a926 100644
--- a/0000_README
+++ b/0000_README
@@ -367,6 +367,10 @@ Patch: 1081_linux-4.19.82.patch
From: https://www.kernel.org
Desc: Linux 4.19.82
+Patch: 1082_linux-4.19.83.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.83
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1082_linux-4.19.83.patch b/1082_linux-4.19.83.patch
new file mode 100644
index 0000000..9df0797
--- /dev/null
+++ b/1082_linux-4.19.83.patch
@@ -0,0 +1,4183 @@
+diff --git a/Makefile b/Makefile
+index 6af1c13d8753..c2c0cf2b1bd7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 82
++SUBLEVEL = 83
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -835,6 +835,12 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=designated-init)
+ # change __FILE__ to the relative path from the srctree
+ KBUILD_CFLAGS += $(call cc-option,-fmacro-prefix-map=$(srctree)/=)
+
++# ensure -fcf-protection is disabled when using retpoline as it is
++# incompatible with -mindirect-branch=thunk-extern
++ifdef CONFIG_RETPOLINE
++KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
++endif
++
+ # use the deterministic mode of AR if available
+ KBUILD_ARFLAGS := $(call ar-option,D)
+
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index a7f697b0290f..90f5bdfa9b3c 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -443,7 +443,7 @@
+ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+ reg = <0x302d0000 0x10000>;
+ interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX7D_CLK_DUMMY>,
++ clocks = <&clks IMX7D_GPT1_ROOT_CLK>,
+ <&clks IMX7D_GPT1_ROOT_CLK>;
+ clock-names = "ipg", "per";
+ };
+@@ -452,7 +452,7 @@
+ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+ reg = <0x302e0000 0x10000>;
+ interrupts = <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX7D_CLK_DUMMY>,
++ clocks = <&clks IMX7D_GPT2_ROOT_CLK>,
+ <&clks IMX7D_GPT2_ROOT_CLK>;
+ clock-names = "ipg", "per";
+ status = "disabled";
+@@ -462,7 +462,7 @@
+ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+ reg = <0x302f0000 0x10000>;
+ interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX7D_CLK_DUMMY>,
++ clocks = <&clks IMX7D_GPT3_ROOT_CLK>,
+ <&clks IMX7D_GPT3_ROOT_CLK>;
+ clock-names = "ipg", "per";
+ status = "disabled";
+@@ -472,7 +472,7 @@
+ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+ reg = <0x30300000 0x10000>;
+ interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX7D_CLK_DUMMY>,
++ clocks = <&clks IMX7D_GPT4_ROOT_CLK>,
+ <&clks IMX7D_GPT4_ROOT_CLK>;
+ clock-names = "ipg", "per";
+ status = "disabled";
+diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+index 7d2302e8706c..9354da4efe09 100644
+--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
++++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+@@ -196,3 +196,7 @@
+ &twl_gpio {
+ ti,use-leds;
+ };
++
++&twl_keypad {
++ status = "disabled";
++};
+diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c
+index 42665914166a..83ca89a35300 100644
+--- a/arch/arm/mach-davinci/dm365.c
++++ b/arch/arm/mach-davinci/dm365.c
+@@ -458,8 +458,8 @@ static s8 dm365_queue_priority_mapping[][2] = {
+ };
+
+ static const struct dma_slave_map dm365_edma_map[] = {
+- { "davinci-mcbsp.0", "tx", EDMA_FILTER_PARAM(0, 2) },
+- { "davinci-mcbsp.0", "rx", EDMA_FILTER_PARAM(0, 3) },
++ { "davinci-mcbsp", "tx", EDMA_FILTER_PARAM(0, 2) },
++ { "davinci-mcbsp", "rx", EDMA_FILTER_PARAM(0, 3) },
+ { "davinci_voicecodec", "tx", EDMA_FILTER_PARAM(0, 2) },
+ { "davinci_voicecodec", "rx", EDMA_FILTER_PARAM(0, 3) },
+ { "spi_davinci.2", "tx", EDMA_FILTER_PARAM(0, 10) },
+diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
+index bd2c739d8083..84a6bbaf8cb2 100644
+--- a/arch/arm/mm/alignment.c
++++ b/arch/arm/mm/alignment.c
+@@ -768,6 +768,36 @@ do_alignment_t32_to_handler(unsigned long *pinstr, struct pt_regs *regs,
+ return NULL;
+ }
+
++static int alignment_get_arm(struct pt_regs *regs, u32 *ip, unsigned long *inst)
++{
++ u32 instr = 0;
++ int fault;
++
++ if (user_mode(regs))
++ fault = get_user(instr, ip);
++ else
++ fault = probe_kernel_address(ip, instr);
++
++ *inst = __mem_to_opcode_arm(instr);
++
++ return fault;
++}
++
++static int alignment_get_thumb(struct pt_regs *regs, u16 *ip, u16 *inst)
++{
++ u16 instr = 0;
++ int fault;
++
++ if (user_mode(regs))
++ fault = get_user(instr, ip);
++ else
++ fault = probe_kernel_address(ip, instr);
++
++ *inst = __mem_to_opcode_thumb16(instr);
++
++ return fault;
++}
++
+ static int
+ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ {
+@@ -775,10 +805,10 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ unsigned long instr = 0, instrptr;
+ int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs *regs);
+ unsigned int type;
+- unsigned int fault;
+ u16 tinstr = 0;
+ int isize = 4;
+ int thumb2_32b = 0;
++ int fault;
+
+ if (interrupts_enabled(regs))
+ local_irq_enable();
+@@ -787,15 +817,14 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+
+ if (thumb_mode(regs)) {
+ u16 *ptr = (u16 *)(instrptr & ~1);
+- fault = probe_kernel_address(ptr, tinstr);
+- tinstr = __mem_to_opcode_thumb16(tinstr);
++
++ fault = alignment_get_thumb(regs, ptr, &tinstr);
+ if (!fault) {
+ if (cpu_architecture() >= CPU_ARCH_ARMv7 &&
+ IS_T32(tinstr)) {
+ /* Thumb-2 32-bit */
+- u16 tinst2 = 0;
+- fault = probe_kernel_address(ptr + 1, tinst2);
+- tinst2 = __mem_to_opcode_thumb16(tinst2);
++ u16 tinst2;
++ fault = alignment_get_thumb(regs, ptr + 1, &tinst2);
+ instr = __opcode_thumb32_compose(tinstr, tinst2);
+ thumb2_32b = 1;
+ } else {
+@@ -804,8 +833,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ }
+ }
+ } else {
+- fault = probe_kernel_address((void *)instrptr, instr);
+- instr = __mem_to_opcode_arm(instr);
++ fault = alignment_get_arm(regs, (void *)instrptr, &instr);
+ }
+
+ if (fault) {
+diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S
+index 59d82864c134..9c2978c128d9 100644
+--- a/arch/arm/mm/proc-v7m.S
++++ b/arch/arm/mm/proc-v7m.S
+@@ -135,7 +135,6 @@ __v7m_setup_cont:
+ dsb
+ mov r6, lr @ save LR
+ ldr sp, =init_thread_union + THREAD_START_SP
+- stmia sp, {r0-r3, r12}
+ cpsie i
+ svc #0
+ 1: cpsid i
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+index 24f1aac366d6..d5b6e8159a33 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+@@ -63,3 +63,12 @@
+ reg = <1>;
+ };
+ };
++
++®_dc1sw {
++ /*
++ * Ethernet PHY needs 30ms to properly power up and some more
++ * to initialize. 100ms should be plenty of time to finish
++ * whole process.
++ */
++ regulator-enable-ramp-delay = <100000>;
++};
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+index c21f2331add6..285cb7143b96 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+@@ -113,6 +113,12 @@
+ };
+
+ ®_dc1sw {
++ /*
++ * Ethernet PHY needs 30ms to properly power up and some more
++ * to initialize. 100ms should be plenty of time to finish
++ * whole process.
++ */
++ regulator-enable-ramp-delay = <100000>;
+ regulator-name = "vcc-phy";
+ };
+
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray-pinctrl.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray-pinctrl.dtsi
+index 8a3a770e8f2c..56789ccf9454 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/stingray-pinctrl.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray-pinctrl.dtsi
+@@ -42,13 +42,14 @@
+
+ pinmux: pinmux@14029c {
+ compatible = "pinctrl-single";
+- reg = <0x0014029c 0x250>;
++ reg = <0x0014029c 0x26c>;
+ #address-cells = <1>;
+ #size-cells = <1>;
+ pinctrl-single,register-width = <32>;
+ pinctrl-single,function-mask = <0xf>;
+ pinctrl-single,gpio-range = <
+- &range 0 154 MODE_GPIO
++ &range 0 91 MODE_GPIO
++ &range 95 60 MODE_GPIO
+ >;
+ range: gpio-range {
+ #pinctrl-single,gpio-range-cells = <3>;
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+index e283480bfc7e..84101ea1fd2c 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+@@ -463,8 +463,7 @@
+ <&pinmux 108 16 27>,
+ <&pinmux 135 77 6>,
+ <&pinmux 141 67 4>,
+- <&pinmux 145 149 6>,
+- <&pinmux 151 91 4>;
++ <&pinmux 145 149 6>;
+ };
+
+ i2c1: i2c@e0000 {
+diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+index 2409344df4fa..e23c5762355d 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+@@ -21,7 +21,7 @@
+ */
+ interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+
+- gic_its: gic-its@18200000 {
++ gic_its: gic-its@1820000 {
+ compatible = "arm,gic-v3-its";
+ reg = <0x01820000 0x10000>;
+ msi-controller;
+diff --git a/arch/mips/bcm63xx/prom.c b/arch/mips/bcm63xx/prom.c
+index 7019e2967009..bbbf8057565b 100644
+--- a/arch/mips/bcm63xx/prom.c
++++ b/arch/mips/bcm63xx/prom.c
+@@ -84,7 +84,7 @@ void __init prom_init(void)
+ * Here we will start up CPU1 in the background and ask it to
+ * reconfigure itself then go back to sleep.
+ */
+- memcpy((void *)0xa0000200, &bmips_smp_movevec, 0x20);
++ memcpy((void *)0xa0000200, bmips_smp_movevec, 0x20);
+ __sync();
+ set_c0_cause(C_SW0);
+ cpumask_set_cpu(1, &bmips_booted_mask);
+diff --git a/arch/mips/include/asm/bmips.h b/arch/mips/include/asm/bmips.h
+index bf6a8afd7ad2..581a6a3c66e4 100644
+--- a/arch/mips/include/asm/bmips.h
++++ b/arch/mips/include/asm/bmips.h
+@@ -75,11 +75,11 @@ static inline int register_bmips_smp_ops(void)
+ #endif
+ }
+
+-extern char bmips_reset_nmi_vec;
+-extern char bmips_reset_nmi_vec_end;
+-extern char bmips_smp_movevec;
+-extern char bmips_smp_int_vec;
+-extern char bmips_smp_int_vec_end;
++extern char bmips_reset_nmi_vec[];
++extern char bmips_reset_nmi_vec_end[];
++extern char bmips_smp_movevec[];
++extern char bmips_smp_int_vec[];
++extern char bmips_smp_int_vec_end[];
+
+ extern int bmips_smp_enabled;
+ extern int bmips_cpu_offset;
+diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
+index 159e83add4bb..5ec546b5eed1 100644
+--- a/arch/mips/kernel/smp-bmips.c
++++ b/arch/mips/kernel/smp-bmips.c
+@@ -457,10 +457,10 @@ static void bmips_wr_vec(unsigned long dst, char *start, char *end)
+
+ static inline void bmips_nmi_handler_setup(void)
+ {
+- bmips_wr_vec(BMIPS_NMI_RESET_VEC, &bmips_reset_nmi_vec,
+- &bmips_reset_nmi_vec_end);
+- bmips_wr_vec(BMIPS_WARM_RESTART_VEC, &bmips_smp_int_vec,
+- &bmips_smp_int_vec_end);
++ bmips_wr_vec(BMIPS_NMI_RESET_VEC, bmips_reset_nmi_vec,
++ bmips_reset_nmi_vec_end);
++ bmips_wr_vec(BMIPS_WARM_RESTART_VEC, bmips_smp_int_vec,
++ bmips_smp_int_vec_end);
+ }
+
+ struct reset_vec_info {
+diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
+index 6a6804c2e1b0..3ce690e5f345 100644
+--- a/arch/powerpc/include/asm/cputable.h
++++ b/arch/powerpc/include/asm/cputable.h
+@@ -214,6 +214,7 @@ static inline void cpu_feature_keys_init(void) { }
+ #define CPU_FTR_P9_TM_XER_SO_BUG LONG_ASM_CONST(0x0000200000000000)
+ #define CPU_FTR_P9_TLBIE_STQ_BUG LONG_ASM_CONST(0x0000400000000000)
+ #define CPU_FTR_P9_TIDR LONG_ASM_CONST(0x0000800000000000)
++#define CPU_FTR_P9_TLBIE_ERAT_BUG LONG_ASM_CONST(0x0001000000000000)
+
+ #ifndef __ASSEMBLY__
+
+@@ -460,7 +461,7 @@ static inline void cpu_feature_keys_init(void) { }
+ CPU_FTR_CFAR | CPU_FTR_HVMODE | CPU_FTR_VMX_COPY | \
+ CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_ARCH_207S | \
+ CPU_FTR_TM_COMP | CPU_FTR_ARCH_300 | CPU_FTR_PKEY | \
+- CPU_FTR_P9_TLBIE_STQ_BUG | CPU_FTR_P9_TIDR)
++ CPU_FTR_P9_TLBIE_STQ_BUG | CPU_FTR_P9_TLBIE_ERAT_BUG | CPU_FTR_P9_TIDR)
+ #define CPU_FTRS_POWER9_DD2_0 CPU_FTRS_POWER9
+ #define CPU_FTRS_POWER9_DD2_1 (CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD2_1)
+ #define CPU_FTRS_POWER9_DD2_2 (CPU_FTRS_POWER9 | CPU_FTR_POWER9_DD2_1 | \
+diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
+index f3b8e04eca9c..c6f41907f0d7 100644
+--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
+@@ -717,6 +717,8 @@ static __init void update_tlbie_feature_flag(unsigned long pvr)
+ WARN_ONCE(1, "Unknown PVR");
+ cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_STQ_BUG;
+ }
++
++ cur_cpu_spec->cpu_features |= CPU_FTR_P9_TLBIE_ERAT_BUG;
+ }
+ }
+
+diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+index 7c68d834c94a..02ab86be9ded 100644
+--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
++++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+@@ -434,6 +434,37 @@ static inline int is_mmio_hpte(unsigned long v, unsigned long r)
+ (HPTE_R_KEY_HI | HPTE_R_KEY_LO));
+ }
+
++static inline void fixup_tlbie_lpid(unsigned long rb_value, unsigned long lpid)
++{
++
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_ERAT_BUG)) {
++ /* Radix flush for a hash guest */
++
++ unsigned long rb,rs,prs,r,ric;
++
++ rb = PPC_BIT(52); /* IS = 2 */
++ rs = 0; /* lpid = 0 */
++ prs = 0; /* partition scoped */
++ r = 1; /* radix format */
++ ric = 0; /* RIC_FLSUH_TLB */
++
++ /*
++ * Need the extra ptesync to make sure we don't
++ * re-order the tlbie
++ */
++ asm volatile("ptesync": : :"memory");
++ asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
++ : : "r"(rb), "i"(r), "i"(prs),
++ "i"(ric), "r"(rs) : "memory");
++ }
++
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
++ asm volatile("ptesync": : :"memory");
++ asm volatile(PPC_TLBIE_5(%0,%1,0,0,0) : :
++ "r" (rb_value), "r" (lpid));
++ }
++}
++
+ static void do_tlbies(struct kvm *kvm, unsigned long *rbvalues,
+ long npages, int global, bool need_sync)
+ {
+@@ -452,16 +483,7 @@ static void do_tlbies(struct kvm *kvm, unsigned long *rbvalues,
+ "r" (rbvalues[i]), "r" (kvm->arch.lpid));
+ }
+
+- if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
+- /*
+- * Need the extra ptesync to make sure we don't
+- * re-order the tlbie
+- */
+- asm volatile("ptesync": : :"memory");
+- asm volatile(PPC_TLBIE_5(%0,%1,0,0,0) : :
+- "r" (rbvalues[0]), "r" (kvm->arch.lpid));
+- }
+-
++ fixup_tlbie_lpid(rbvalues[i - 1], kvm->arch.lpid);
+ asm volatile("eieio; tlbsync; ptesync" : : : "memory");
+ } else {
+ if (need_sync)
+diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
+index 0c13561d8b80..42a48c5f7b7f 100644
+--- a/arch/powerpc/mm/hash_native_64.c
++++ b/arch/powerpc/mm/hash_native_64.c
+@@ -201,8 +201,31 @@ static inline unsigned long ___tlbie(unsigned long vpn, int psize,
+ return va;
+ }
+
+-static inline void fixup_tlbie(unsigned long vpn, int psize, int apsize, int ssize)
++static inline void fixup_tlbie_vpn(unsigned long vpn, int psize,
++ int apsize, int ssize)
+ {
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_ERAT_BUG)) {
++ /* Radix flush for a hash guest */
++
++ unsigned long rb,rs,prs,r,ric;
++
++ rb = PPC_BIT(52); /* IS = 2 */
++ rs = 0; /* lpid = 0 */
++ prs = 0; /* partition scoped */
++ r = 1; /* radix format */
++ ric = 0; /* RIC_FLSUH_TLB */
++
++ /*
++ * Need the extra ptesync to make sure we don't
++ * re-order the tlbie
++ */
++ asm volatile("ptesync": : :"memory");
++ asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
++ : : "r"(rb), "i"(r), "i"(prs),
++ "i"(ric), "r"(rs) : "memory");
++ }
++
++
+ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
+ /* Need the extra ptesync to ensure we don't reorder tlbie*/
+ asm volatile("ptesync": : :"memory");
+@@ -287,7 +310,7 @@ static inline void tlbie(unsigned long vpn, int psize, int apsize,
+ asm volatile("ptesync": : :"memory");
+ } else {
+ __tlbie(vpn, psize, apsize, ssize);
+- fixup_tlbie(vpn, psize, apsize, ssize);
++ fixup_tlbie_vpn(vpn, psize, apsize, ssize);
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+ if (lock_tlbie && !use_local)
+@@ -860,7 +883,7 @@ static void native_flush_hash_range(unsigned long number, int local)
+ /*
+ * Just do one more with the last used values.
+ */
+- fixup_tlbie(vpn, psize, psize, ssize);
++ fixup_tlbie_vpn(vpn, psize, psize, ssize);
+ asm volatile("eieio; tlbsync; ptesync":::"memory");
+
+ if (lock_tlbie)
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 0cddae4263f9..62be0e5732b7 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -215,21 +215,82 @@ static inline void __tlbie_lpid_va(unsigned long va, unsigned long lpid,
+ trace_tlbie(lpid, 0, rb, rs, ric, prs, r);
+ }
+
+-static inline void fixup_tlbie(void)
++
++static inline void fixup_tlbie_va(unsigned long va, unsigned long pid,
++ unsigned long ap)
+ {
+- unsigned long pid = 0;
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_ERAT_BUG)) {
++ asm volatile("ptesync": : :"memory");
++ __tlbie_va(va, 0, ap, RIC_FLUSH_TLB);
++ }
++
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
++ asm volatile("ptesync": : :"memory");
++ __tlbie_va(va, pid, ap, RIC_FLUSH_TLB);
++ }
++}
++
++static inline void fixup_tlbie_va_range(unsigned long va, unsigned long pid,
++ unsigned long ap)
++{
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_ERAT_BUG)) {
++ asm volatile("ptesync": : :"memory");
++ __tlbie_pid(0, RIC_FLUSH_TLB);
++ }
++
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
++ asm volatile("ptesync": : :"memory");
++ __tlbie_va(va, pid, ap, RIC_FLUSH_TLB);
++ }
++}
++
++static inline void fixup_tlbie_pid(unsigned long pid)
++{
++ /*
++ * We can use any address for the invalidation, pick one which is
++ * probably unused as an optimisation.
++ */
+ unsigned long va = ((1UL << 52) - 1);
+
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_ERAT_BUG)) {
++ asm volatile("ptesync": : :"memory");
++ __tlbie_pid(0, RIC_FLUSH_TLB);
++ }
++
+ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
+ asm volatile("ptesync": : :"memory");
+ __tlbie_va(va, pid, mmu_get_ap(MMU_PAGE_64K), RIC_FLUSH_TLB);
+ }
+ }
+
++
++static inline void fixup_tlbie_lpid_va(unsigned long va, unsigned long lpid,
++ unsigned long ap)
++{
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_ERAT_BUG)) {
++ asm volatile("ptesync": : :"memory");
++ __tlbie_lpid_va(va, 0, ap, RIC_FLUSH_TLB);
++ }
++
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
++ asm volatile("ptesync": : :"memory");
++ __tlbie_lpid_va(va, lpid, ap, RIC_FLUSH_TLB);
++ }
++}
++
+ static inline void fixup_tlbie_lpid(unsigned long lpid)
+ {
++ /*
++ * We can use any address for the invalidation, pick one which is
++ * probably unused as an optimisation.
++ */
+ unsigned long va = ((1UL << 52) - 1);
+
++ if (cpu_has_feature(CPU_FTR_P9_TLBIE_ERAT_BUG)) {
++ asm volatile("ptesync": : :"memory");
++ __tlbie_lpid(0, RIC_FLUSH_TLB);
++ }
++
+ if (cpu_has_feature(CPU_FTR_P9_TLBIE_STQ_BUG)) {
+ asm volatile("ptesync": : :"memory");
+ __tlbie_lpid_va(va, lpid, mmu_get_ap(MMU_PAGE_64K), RIC_FLUSH_TLB);
+@@ -277,6 +338,7 @@ static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
+ switch (ric) {
+ case RIC_FLUSH_TLB:
+ __tlbie_pid(pid, RIC_FLUSH_TLB);
++ fixup_tlbie_pid(pid);
+ break;
+ case RIC_FLUSH_PWC:
+ __tlbie_pid(pid, RIC_FLUSH_PWC);
+@@ -284,8 +346,8 @@ static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
+ case RIC_FLUSH_ALL:
+ default:
+ __tlbie_pid(pid, RIC_FLUSH_ALL);
++ fixup_tlbie_pid(pid);
+ }
+- fixup_tlbie();
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+
+@@ -329,6 +391,7 @@ static inline void _tlbie_lpid(unsigned long lpid, unsigned long ric)
+ switch (ric) {
+ case RIC_FLUSH_TLB:
+ __tlbie_lpid(lpid, RIC_FLUSH_TLB);
++ fixup_tlbie_lpid(lpid);
+ break;
+ case RIC_FLUSH_PWC:
+ __tlbie_lpid(lpid, RIC_FLUSH_PWC);
+@@ -336,8 +399,8 @@ static inline void _tlbie_lpid(unsigned long lpid, unsigned long ric)
+ case RIC_FLUSH_ALL:
+ default:
+ __tlbie_lpid(lpid, RIC_FLUSH_ALL);
++ fixup_tlbie_lpid(lpid);
+ }
+- fixup_tlbie_lpid(lpid);
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+
+@@ -410,6 +473,8 @@ static inline void __tlbie_va_range(unsigned long start, unsigned long end,
+
+ for (addr = start; addr < end; addr += page_size)
+ __tlbie_va(addr, pid, ap, RIC_FLUSH_TLB);
++
++ fixup_tlbie_va_range(addr - page_size, pid, ap);
+ }
+
+ static inline void _tlbie_va(unsigned long va, unsigned long pid,
+@@ -419,7 +484,7 @@ static inline void _tlbie_va(unsigned long va, unsigned long pid,
+
+ asm volatile("ptesync": : :"memory");
+ __tlbie_va(va, pid, ap, ric);
+- fixup_tlbie();
++ fixup_tlbie_va(va, pid, ap);
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+
+@@ -430,7 +495,7 @@ static inline void _tlbie_lpid_va(unsigned long va, unsigned long lpid,
+
+ asm volatile("ptesync": : :"memory");
+ __tlbie_lpid_va(va, lpid, ap, ric);
+- fixup_tlbie_lpid(lpid);
++ fixup_tlbie_lpid_va(va, lpid, ap);
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+
+@@ -442,7 +507,6 @@ static inline void _tlbie_va_range(unsigned long start, unsigned long end,
+ if (also_pwc)
+ __tlbie_pid(pid, RIC_FLUSH_PWC);
+ __tlbie_va_range(start, end, pid, page_size, psize);
+- fixup_tlbie();
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+
+@@ -773,7 +837,7 @@ is_local:
+ if (gflush)
+ __tlbie_va_range(gstart, gend, pid,
+ PUD_SIZE, MMU_PAGE_1G);
+- fixup_tlbie();
++
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+ }
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index bd9aafe86c2f..867841c56a6d 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -349,17 +349,16 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
+ struct nbd_device *nbd = cmd->nbd;
+ struct nbd_config *config;
+
++ if (!mutex_trylock(&cmd->lock))
++ return BLK_EH_RESET_TIMER;
++
+ if (!refcount_inc_not_zero(&nbd->config_refs)) {
+ cmd->status = BLK_STS_TIMEOUT;
++ mutex_unlock(&cmd->lock);
+ goto done;
+ }
+ config = nbd->config;
+
+- if (!mutex_trylock(&cmd->lock)) {
+- nbd_config_put(nbd);
+- return BLK_EH_RESET_TIMER;
+- }
+-
+ if (config->num_connections > 1) {
+ dev_err_ratelimited(nbd_to_dev(nbd),
+ "Connection timed out, retrying (%d/%d alive)\n",
+@@ -664,6 +663,12 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
+ ret = -ENOENT;
+ goto out;
+ }
++ if (cmd->status != BLK_STS_OK) {
++ dev_err(disk_to_dev(nbd->disk), "Command already handled %p\n",
++ req);
++ ret = -ENOENT;
++ goto out;
++ }
+ if (test_bit(NBD_CMD_REQUEUED, &cmd->flags)) {
+ dev_err(disk_to_dev(nbd->disk), "Raced with timeout on req %p\n",
+ req);
+@@ -745,7 +750,10 @@ static void nbd_clear_req(struct request *req, void *data, bool reserved)
+ {
+ struct nbd_cmd *cmd = blk_mq_rq_to_pdu(req);
+
++ mutex_lock(&cmd->lock);
+ cmd->status = BLK_STS_IOERR;
++ mutex_unlock(&cmd->lock);
++
+ blk_mq_complete_request(req);
+ }
+
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index 0997e166ea57..8b749c721c87 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -1276,7 +1276,7 @@ static void make_established(struct sock *sk, u32 snd_isn, unsigned int opt)
+ tp->write_seq = snd_isn;
+ tp->snd_nxt = snd_isn;
+ tp->snd_una = snd_isn;
+- inet_sk(sk)->inet_id = tp->write_seq ^ jiffies;
++ inet_sk(sk)->inet_id = prandom_u32();
+ assign_rxopt(sk, opt);
+
+ if (tp->rcv_wnd > (RCV_BUFSIZ_M << 10))
+diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c
+index afebbd87c4aa..1587f4ac6821 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_io.c
++++ b/drivers/crypto/chelsio/chtls/chtls_io.c
+@@ -1716,7 +1716,7 @@ int chtls_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ return peekmsg(sk, msg, len, nonblock, flags);
+
+ if (sk_can_busy_loop(sk) &&
+- skb_queue_empty(&sk->sk_receive_queue) &&
++ skb_queue_empty_lockless(&sk->sk_receive_queue) &&
+ sk->sk_state == TCP_ESTABLISHED)
+ sk_busy_loop(sk, nonblock);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+index b0e14a3d54ef..b14ce112703f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+@@ -428,7 +428,8 @@ static int amdgpu_bo_do_create(struct amdgpu_device *adev,
+ .interruptible = (bp->type != ttm_bo_type_kernel),
+ .no_wait_gpu = false,
+ .resv = bp->resv,
+- .flags = TTM_OPT_FLAG_ALLOW_RES_EVICT
++ .flags = bp->type != ttm_bo_type_kernel ?
++ TTM_OPT_FLAG_ALLOW_RES_EVICT : 0
+ };
+ struct amdgpu_bo *bo;
+ unsigned long page_align, size = bp->size;
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index ac9c9486b834..f4e3613f9361 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -297,7 +297,7 @@ struct stm32f7_i2c_dev {
+ bool use_dma;
+ };
+
+-/**
++/*
+ * All these values are coming from I2C Specification, Version 6.0, 4th of
+ * April 2014.
+ *
+@@ -1177,6 +1177,8 @@ static void stm32f7_i2c_slave_start(struct stm32f7_i2c_dev *i2c_dev)
+ STM32F7_I2C_CR1_TXIE;
+ stm32f7_i2c_set_bits(base + STM32F7_I2C_CR1, mask);
+
++ /* Write 1st data byte */
++ writel_relaxed(value, base + STM32F7_I2C_TXDR);
+ } else {
+ /* Notify i2c slave that new write transfer is starting */
+ i2c_slave_event(slave, I2C_SLAVE_WRITE_REQUESTED, &value);
+@@ -1486,7 +1488,7 @@ static irqreturn_t stm32f7_i2c_isr_error(int irq, void *data)
+ void __iomem *base = i2c_dev->base;
+ struct device *dev = i2c_dev->dev;
+ struct stm32_i2c_dma *dma = i2c_dev->dma;
+- u32 mask, status;
++ u32 status;
+
+ status = readl_relaxed(i2c_dev->base + STM32F7_I2C_ISR);
+
+@@ -1511,12 +1513,15 @@ static irqreturn_t stm32f7_i2c_isr_error(int irq, void *data)
+ f7_msg->result = -EINVAL;
+ }
+
+- /* Disable interrupts */
+- if (stm32f7_i2c_is_slave_registered(i2c_dev))
+- mask = STM32F7_I2C_XFER_IRQ_MASK;
+- else
+- mask = STM32F7_I2C_ALL_IRQ_MASK;
+- stm32f7_i2c_disable_irq(i2c_dev, mask);
++ if (!i2c_dev->slave_running) {
++ u32 mask;
++ /* Disable interrupts */
++ if (stm32f7_i2c_is_slave_registered(i2c_dev))
++ mask = STM32F7_I2C_XFER_IRQ_MASK;
++ else
++ mask = STM32F7_I2C_ALL_IRQ_MASK;
++ stm32f7_i2c_disable_irq(i2c_dev, mask);
++ }
+
+ /* Disable dma */
+ if (i2c_dev->use_dma) {
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index e7549a2b1482..050d6e040128 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -182,6 +182,22 @@ static DEFINE_IDA(its_vpeid_ida);
+ #define gic_data_rdist_rd_base() (gic_data_rdist()->rd_base)
+ #define gic_data_rdist_vlpi_base() (gic_data_rdist_rd_base() + SZ_128K)
+
++static u16 get_its_list(struct its_vm *vm)
++{
++ struct its_node *its;
++ unsigned long its_list = 0;
++
++ list_for_each_entry(its, &its_nodes, entry) {
++ if (!its->is_v4)
++ continue;
++
++ if (vm->vlpi_count[its->list_nr])
++ __set_bit(its->list_nr, &its_list);
++ }
++
++ return (u16)its_list;
++}
++
+ static struct its_collection *dev_event_to_col(struct its_device *its_dev,
+ u32 event)
+ {
+@@ -983,17 +999,15 @@ static void its_send_vmapp(struct its_node *its,
+
+ static void its_send_vmovp(struct its_vpe *vpe)
+ {
+- struct its_cmd_desc desc;
++ struct its_cmd_desc desc = {};
+ struct its_node *its;
+ unsigned long flags;
+ int col_id = vpe->col_idx;
+
+ desc.its_vmovp_cmd.vpe = vpe;
+- desc.its_vmovp_cmd.its_list = (u16)its_list_map;
+
+ if (!its_list_map) {
+ its = list_first_entry(&its_nodes, struct its_node, entry);
+- desc.its_vmovp_cmd.seq_num = 0;
+ desc.its_vmovp_cmd.col = &its->collections[col_id];
+ its_send_single_vcommand(its, its_build_vmovp_cmd, &desc);
+ return;
+@@ -1010,6 +1024,7 @@ static void its_send_vmovp(struct its_vpe *vpe)
+ raw_spin_lock_irqsave(&vmovp_lock, flags);
+
+ desc.its_vmovp_cmd.seq_num = vmovp_seq_num++;
++ desc.its_vmovp_cmd.its_list = get_its_list(vpe->its_vm);
+
+ /* Emit VMOVPs */
+ list_for_each_entry(its, &its_nodes, entry) {
+diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
+index 21786a442368..c67fd2fb333c 100644
+--- a/drivers/isdn/capi/capi.c
++++ b/drivers/isdn/capi/capi.c
+@@ -744,7 +744,7 @@ capi_poll(struct file *file, poll_table *wait)
+
+ poll_wait(file, &(cdev->recvwait), wait);
+ mask = EPOLLOUT | EPOLLWRNORM;
+- if (!skb_queue_empty(&cdev->recvqueue))
++ if (!skb_queue_empty_lockless(&cdev->recvqueue))
+ mask |= EPOLLIN | EPOLLRDNORM;
+ return mask;
+ }
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index ad534b90ef21..2d3a2cb026d2 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1584,7 +1584,6 @@ int b53_mirror_add(struct dsa_switch *ds, int port,
+ loc = B53_EG_MIR_CTL;
+
+ b53_read16(dev, B53_MGMT_PAGE, loc, ®);
+- reg &= ~MIRROR_MASK;
+ reg |= BIT(port);
+ b53_write16(dev, B53_MGMT_PAGE, loc, reg);
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 2fa2caf7a746..ca3655d28e00 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -41,22 +41,11 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)
+ unsigned int i;
+ u32 reg, offset;
+
+- if (priv->type == BCM7445_DEVICE_ID)
+- offset = CORE_STS_OVERRIDE_IMP;
+- else
+- offset = CORE_STS_OVERRIDE_IMP2;
+-
+ /* Enable the port memories */
+ reg = core_readl(priv, CORE_MEM_PSM_VDD_CTRL);
+ reg &= ~P_TXQ_PSM_VDD(port);
+ core_writel(priv, reg, CORE_MEM_PSM_VDD_CTRL);
+
+- /* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
+- reg = core_readl(priv, CORE_IMP_CTL);
+- reg |= (RX_BCST_EN | RX_MCST_EN | RX_UCST_EN);
+- reg &= ~(RX_DIS | TX_DIS);
+- core_writel(priv, reg, CORE_IMP_CTL);
+-
+ /* Enable forwarding */
+ core_writel(priv, SW_FWDG_EN, CORE_SWMODE);
+
+@@ -75,10 +64,27 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)
+
+ b53_brcm_hdr_setup(ds, port);
+
+- /* Force link status for IMP port */
+- reg = core_readl(priv, offset);
+- reg |= (MII_SW_OR | LINK_STS);
+- core_writel(priv, reg, offset);
++ if (port == 8) {
++ if (priv->type == BCM7445_DEVICE_ID)
++ offset = CORE_STS_OVERRIDE_IMP;
++ else
++ offset = CORE_STS_OVERRIDE_IMP2;
++
++ /* Force link status for IMP port */
++ reg = core_readl(priv, offset);
++ reg |= (MII_SW_OR | LINK_STS);
++ core_writel(priv, reg, offset);
++
++ /* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
++ reg = core_readl(priv, CORE_IMP_CTL);
++ reg |= (RX_BCST_EN | RX_MCST_EN | RX_UCST_EN);
++ reg &= ~(RX_DIS | TX_DIS);
++ core_writel(priv, reg, CORE_IMP_CTL);
++ } else {
++ reg = core_readl(priv, CORE_G_PCTL_PORT(port));
++ reg &= ~(RX_DIS | TX_DIS);
++ core_writel(priv, reg, CORE_G_PCTL_PORT(port));
++ }
+ }
+
+ static void bcm_sf2_gphy_enable_set(struct dsa_switch *ds, bool enable)
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index fd587bed32eb..bb60104b4f80 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2020,6 +2020,8 @@ static void bcmgenet_link_intr_enable(struct bcmgenet_priv *priv)
+ */
+ if (priv->internal_phy) {
+ int0_enable |= UMAC_IRQ_LINK_EVENT;
++ if (GENET_IS_V1(priv) || GENET_IS_V2(priv) || GENET_IS_V3(priv))
++ int0_enable |= UMAC_IRQ_PHY_DET_R;
+ } else if (priv->ext_phy) {
+ int0_enable |= UMAC_IRQ_LINK_EVENT;
+ } else if (priv->phy_interface == PHY_INTERFACE_MODE_MOCA) {
+@@ -2618,11 +2620,14 @@ static void bcmgenet_irq_task(struct work_struct *work)
+ priv->irq0_stat = 0;
+ spin_unlock_irq(&priv->lock);
+
++ if (status & UMAC_IRQ_PHY_DET_R &&
++ priv->dev->phydev->autoneg != AUTONEG_ENABLE)
++ phy_init_hw(priv->dev->phydev);
++
+ /* Link UP/DOWN event */
+- if (status & UMAC_IRQ_LINK_EVENT) {
+- priv->dev->phydev->link = !!(status & UMAC_IRQ_LINK_UP);
++ if (status & UMAC_IRQ_LINK_EVENT)
+ phy_mac_interrupt(priv->dev->phydev);
+- }
++
+ }
+
+ /* bcmgenet_isr1: handle Rx and Tx priority queues */
+@@ -2717,7 +2722,7 @@ static irqreturn_t bcmgenet_isr0(int irq, void *dev_id)
+ }
+
+ /* all other interested interrupts handled in bottom half */
+- status &= UMAC_IRQ_LINK_EVENT;
++ status &= (UMAC_IRQ_LINK_EVENT | UMAC_IRQ_PHY_DET_R);
+ if (status) {
+ /* Save irq status for bottom-half processing. */
+ spin_lock_irqsave(&priv->lock, flags);
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+index dba8a0c1eda3..3d834d40e81e 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+@@ -673,10 +673,10 @@ static void uld_init(struct adapter *adap, struct cxgb4_lld_info *lld)
+ lld->write_cmpl_support = adap->params.write_cmpl_support;
+ }
+
+-static void uld_attach(struct adapter *adap, unsigned int uld)
++static int uld_attach(struct adapter *adap, unsigned int uld)
+ {
+- void *handle;
+ struct cxgb4_lld_info lli;
++ void *handle;
+
+ uld_init(adap, &lli);
+ uld_queue_init(adap, uld, &lli);
+@@ -686,7 +686,7 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
+ dev_warn(adap->pdev_dev,
+ "could not attach to the %s driver, error %ld\n",
+ adap->uld[uld].name, PTR_ERR(handle));
+- return;
++ return PTR_ERR(handle);
+ }
+
+ adap->uld[uld].handle = handle;
+@@ -694,23 +694,24 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
+
+ if (adap->flags & FULL_INIT_DONE)
+ adap->uld[uld].state_change(handle, CXGB4_STATE_UP);
++
++ return 0;
+ }
+
+-/**
+- * cxgb4_register_uld - register an upper-layer driver
+- * @type: the ULD type
+- * @p: the ULD methods
++/* cxgb4_register_uld - register an upper-layer driver
++ * @type: the ULD type
++ * @p: the ULD methods
+ *
+- * Registers an upper-layer driver with this driver and notifies the ULD
+- * about any presently available devices that support its type. Returns
+- * %-EBUSY if a ULD of the same type is already registered.
++ * Registers an upper-layer driver with this driver and notifies the ULD
++ * about any presently available devices that support its type. Returns
++ * %-EBUSY if a ULD of the same type is already registered.
+ */
+ int cxgb4_register_uld(enum cxgb4_uld type,
+ const struct cxgb4_uld_info *p)
+ {
+- int ret = 0;
+ unsigned int adap_idx = 0;
+ struct adapter *adap;
++ int ret = 0;
+
+ if (type >= CXGB4_ULD_MAX)
+ return -EINVAL;
+@@ -744,12 +745,16 @@ int cxgb4_register_uld(enum cxgb4_uld type,
+ if (ret)
+ goto free_irq;
+ adap->uld[type] = *p;
+- uld_attach(adap, type);
++ ret = uld_attach(adap, type);
++ if (ret)
++ goto free_txq;
+ adap_idx++;
+ }
+ mutex_unlock(&uld_mutex);
+ return 0;
+
++free_txq:
++ release_sge_txq_uld(adap, type);
+ free_irq:
+ if (adap->flags & FULL_INIT_DONE)
+ quiesce_rx_uld(adap, type);
+diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
+index ed6c76d20b45..f6ed889bc36a 100644
+--- a/drivers/net/ethernet/faraday/ftgmac100.c
++++ b/drivers/net/ethernet/faraday/ftgmac100.c
+@@ -739,6 +739,18 @@ static int ftgmac100_hard_start_xmit(struct sk_buff *skb,
+ */
+ nfrags = skb_shinfo(skb)->nr_frags;
+
++ /* Setup HW checksumming */
++ csum_vlan = 0;
++ if (skb->ip_summed == CHECKSUM_PARTIAL &&
++ !ftgmac100_prep_tx_csum(skb, &csum_vlan))
++ goto drop;
++
++ /* Add VLAN tag */
++ if (skb_vlan_tag_present(skb)) {
++ csum_vlan |= FTGMAC100_TXDES1_INS_VLANTAG;
++ csum_vlan |= skb_vlan_tag_get(skb) & 0xffff;
++ }
++
+ /* Get header len */
+ len = skb_headlen(skb);
+
+@@ -765,19 +777,6 @@ static int ftgmac100_hard_start_xmit(struct sk_buff *skb,
+ if (nfrags == 0)
+ f_ctl_stat |= FTGMAC100_TXDES0_LTS;
+ txdes->txdes3 = cpu_to_le32(map);
+-
+- /* Setup HW checksumming */
+- csum_vlan = 0;
+- if (skb->ip_summed == CHECKSUM_PARTIAL &&
+- !ftgmac100_prep_tx_csum(skb, &csum_vlan))
+- goto drop;
+-
+- /* Add VLAN tag */
+- if (skb_vlan_tag_present(skb)) {
+- csum_vlan |= FTGMAC100_TXDES1_INS_VLANTAG;
+- csum_vlan |= skb_vlan_tag_get(skb) & 0xffff;
+- }
+-
+ txdes->txdes1 = cpu_to_le32(csum_vlan);
+
+ /* Next descriptor */
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index a91d49dd92ea..2f8f03e0db81 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -174,6 +174,7 @@ struct hip04_priv {
+ dma_addr_t rx_phys[RX_DESC_NUM];
+ unsigned int rx_head;
+ unsigned int rx_buf_size;
++ unsigned int rx_cnt_remaining;
+
+ struct device_node *phy_node;
+ struct phy_device *phy;
+@@ -487,7 +488,6 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
+ struct hip04_priv *priv = container_of(napi, struct hip04_priv, napi);
+ struct net_device *ndev = priv->ndev;
+ struct net_device_stats *stats = &ndev->stats;
+- unsigned int cnt = hip04_recv_cnt(priv);
+ struct rx_desc *desc;
+ struct sk_buff *skb;
+ unsigned char *buf;
+@@ -500,8 +500,8 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
+
+ /* clean up tx descriptors */
+ tx_remaining = hip04_tx_reclaim(ndev, false);
+-
+- while (cnt && !last) {
++ priv->rx_cnt_remaining += hip04_recv_cnt(priv);
++ while (priv->rx_cnt_remaining && !last) {
+ buf = priv->rx_buf[priv->rx_head];
+ skb = build_skb(buf, priv->rx_buf_size);
+ if (unlikely(!skb)) {
+@@ -547,11 +547,13 @@ refill:
+ hip04_set_recv_desc(priv, phys);
+
+ priv->rx_head = RX_NEXT(priv->rx_head);
+- if (rx >= budget)
++ if (rx >= budget) {
++ --priv->rx_cnt_remaining;
+ goto done;
++ }
+
+- if (--cnt == 0)
+- cnt = hip04_recv_cnt(priv);
++ if (--priv->rx_cnt_remaining == 0)
++ priv->rx_cnt_remaining += hip04_recv_cnt(priv);
+ }
+
+ if (!(priv->reg_inten & RCV_INT)) {
+@@ -636,6 +638,7 @@ static int hip04_mac_open(struct net_device *ndev)
+ int i;
+
+ priv->rx_head = 0;
++ priv->rx_cnt_remaining = 0;
+ priv->tx_head = 0;
+ priv->tx_tail = 0;
+ hip04_reset_ppe(priv);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+index 676428a57662..a4c1ed65f620 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -471,12 +471,31 @@ void mlx4_init_quotas(struct mlx4_dev *dev)
+ priv->mfunc.master.res_tracker.res_alloc[RES_MPT].quota[pf];
+ }
+
+-static int get_max_gauranteed_vfs_counter(struct mlx4_dev *dev)
++static int
++mlx4_calc_res_counter_guaranteed(struct mlx4_dev *dev,
++ struct resource_allocator *res_alloc,
++ int vf)
+ {
+- /* reduce the sink counter */
+- return (dev->caps.max_counters - 1 -
+- (MLX4_PF_COUNTERS_PER_PORT * MLX4_MAX_PORTS))
+- / MLX4_MAX_PORTS;
++ struct mlx4_active_ports actv_ports;
++ int ports, counters_guaranteed;
++
++ /* For master, only allocate according to the number of phys ports */
++ if (vf == mlx4_master_func_num(dev))
++ return MLX4_PF_COUNTERS_PER_PORT * dev->caps.num_ports;
++
++ /* calculate real number of ports for the VF */
++ actv_ports = mlx4_get_active_ports(dev, vf);
++ ports = bitmap_weight(actv_ports.ports, dev->caps.num_ports);
++ counters_guaranteed = ports * MLX4_VF_COUNTERS_PER_PORT;
++
++ /* If we do not have enough counters for this VF, do not
++ * allocate any for it. '-1' to reduce the sink counter.
++ */
++ if ((res_alloc->res_reserved + counters_guaranteed) >
++ (dev->caps.max_counters - 1))
++ return 0;
++
++ return counters_guaranteed;
+ }
+
+ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
+@@ -484,7 +503,6 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
+ struct mlx4_priv *priv = mlx4_priv(dev);
+ int i, j;
+ int t;
+- int max_vfs_guarantee_counter = get_max_gauranteed_vfs_counter(dev);
+
+ priv->mfunc.master.res_tracker.slave_list =
+ kcalloc(dev->num_slaves, sizeof(struct slave_list),
+@@ -603,16 +621,8 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
+ break;
+ case RES_COUNTER:
+ res_alloc->quota[t] = dev->caps.max_counters;
+- if (t == mlx4_master_func_num(dev))
+- res_alloc->guaranteed[t] =
+- MLX4_PF_COUNTERS_PER_PORT *
+- MLX4_MAX_PORTS;
+- else if (t <= max_vfs_guarantee_counter)
+- res_alloc->guaranteed[t] =
+- MLX4_VF_COUNTERS_PER_PORT *
+- MLX4_MAX_PORTS;
+- else
+- res_alloc->guaranteed[t] = 0;
++ res_alloc->guaranteed[t] =
++ mlx4_calc_res_counter_guaranteed(dev, res_alloc, t);
+ break;
+ default:
+ break;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index df49dc143c47..9cbc4173973e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -1267,8 +1267,11 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
+ if (unlikely(!test_bit(MLX5E_RQ_STATE_ENABLED, &rq->state)))
+ return 0;
+
+- if (cq->decmprs_left)
++ if (cq->decmprs_left) {
+ work_done += mlx5e_decompress_cqes_cont(rq, cq, 0, budget);
++ if (cq->decmprs_left || work_done >= budget)
++ goto out;
++ }
+
+ cqe = mlx5_cqwq_get_cqe(&cq->wq);
+ if (!cqe) {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+index 4382ef85488c..5fb088b54e66 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+@@ -35,6 +35,7 @@
+ #include <linux/udp.h>
+ #include <net/udp.h>
+ #include "en.h"
++#include "en/port.h"
+
+ enum {
+ MLX5E_ST_LINK_STATE,
+@@ -80,22 +81,12 @@ static int mlx5e_test_link_state(struct mlx5e_priv *priv)
+
+ static int mlx5e_test_link_speed(struct mlx5e_priv *priv)
+ {
+- u32 out[MLX5_ST_SZ_DW(ptys_reg)];
+- u32 eth_proto_oper;
+- int i;
++ u32 speed;
+
+ if (!netif_carrier_ok(priv->netdev))
+ return 1;
+
+- if (mlx5_query_port_ptys(priv->mdev, out, sizeof(out), MLX5_PTYS_EN, 1))
+- return 1;
+-
+- eth_proto_oper = MLX5_GET(ptys_reg, out, eth_proto_oper);
+- for (i = 0; i < MLX5E_LINK_MODES_NUMBER; i++) {
+- if (eth_proto_oper & MLX5E_PROT_MASK(i))
+- return 0;
+- }
+- return 1;
++ return mlx5e_port_linkspeed(priv->mdev, &speed);
+ }
+
+ struct mlx5ehdr {
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 0c8b7146637e..4ab87fe84542 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -1010,6 +1010,10 @@ static int r8168dp_2_mdio_read(struct rtl8169_private *tp, int reg)
+ {
+ int value;
+
++ /* Work around issue with chip reporting wrong PHY ID */
++ if (reg == MII_PHYSID2)
++ return 0xc912;
++
+ r8168dp_2_mdio_start(tp);
+
+ value = r8169_mdio_read(tp, reg);
+diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c
+index b2b6307d64a4..acaf072bb4b0 100644
+--- a/drivers/net/phy/bcm7xxx.c
++++ b/drivers/net/phy/bcm7xxx.c
+@@ -643,6 +643,7 @@ static int bcm7xxx_28nm_probe(struct phy_device *phydev)
+ .name = _name, \
+ .features = PHY_BASIC_FEATURES, \
+ .flags = PHY_IS_INTERNAL, \
++ .soft_reset = genphy_soft_reset, \
+ .config_init = bcm7xxx_config_init, \
+ .suspend = bcm7xxx_suspend, \
+ .resume = bcm7xxx_config_init, \
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 85fba64c3fcf..c3cf9ae6d1df 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -800,6 +800,13 @@ static const struct usb_device_id products[] = {
+ .driver_info = 0,
+ },
+
++/* ThinkPad USB-C Dock Gen 2 (based on Realtek RTL8153) */
++{
++ USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0xa387, USB_CLASS_COMM,
++ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
++ .driver_info = 0,
++},
++
+ /* NVIDIA Tegra USB 3.0 Ethernet Adapters (based on Realtek RTL8153) */
+ {
+ USB_DEVICE_AND_INTERFACE_INFO(NVIDIA_VENDOR_ID, 0x09ff, USB_CLASS_COMM,
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index e20266bd209e..3a172fcb06fe 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1278,8 +1278,11 @@ static void lan78xx_status(struct lan78xx_net *dev, struct urb *urb)
+ netif_dbg(dev, link, dev->net, "PHY INTR: 0x%08x\n", intdata);
+ lan78xx_defer_kevent(dev, EVENT_LINK_RESET);
+
+- if (dev->domain_data.phyirq > 0)
++ if (dev->domain_data.phyirq > 0) {
++ local_irq_disable();
+ generic_handle_irq(dev->domain_data.phyirq);
++ local_irq_enable();
++ }
+ } else
+ netdev_warn(dev->net,
+ "unexpected interrupt: 0x%08x\n", intdata);
+@@ -3796,10 +3799,14 @@ static int lan78xx_probe(struct usb_interface *intf,
+ /* driver requires remote-wakeup capability during autosuspend. */
+ intf->needs_remote_wakeup = 1;
+
++ ret = lan78xx_phy_init(dev);
++ if (ret < 0)
++ goto out4;
++
+ ret = register_netdev(netdev);
+ if (ret != 0) {
+ netif_err(dev, probe, netdev, "couldn't register the device\n");
+- goto out4;
++ goto out5;
+ }
+
+ usb_set_intfdata(intf, dev);
+@@ -3812,14 +3819,10 @@ static int lan78xx_probe(struct usb_interface *intf,
+ pm_runtime_set_autosuspend_delay(&udev->dev,
+ DEFAULT_AUTOSUSPEND_DELAY);
+
+- ret = lan78xx_phy_init(dev);
+- if (ret < 0)
+- goto out5;
+-
+ return 0;
+
+ out5:
+- unregister_netdev(netdev);
++ phy_disconnect(netdev->phydev);
+ out4:
+ usb_free_urb(dev->urb_intr);
+ out3:
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index a291e5f2daef..91d47a714afd 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -5339,6 +5339,7 @@ static const struct usb_device_id rtl8152_table[] = {
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x7205)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x720c)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x7214)},
++ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0xa387)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA, 0x09ff)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_TPLINK, 0x0601)},
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 0b1ec44acbf9..2a536f84d5f6 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2174,9 +2174,11 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ vni = tunnel_id_to_key32(info->key.tun_id);
+ ifindex = 0;
+ dst_cache = &info->dst_cache;
+- if (info->options_len &&
+- info->key.tun_flags & TUNNEL_VXLAN_OPT)
++ if (info->key.tun_flags & TUNNEL_VXLAN_OPT) {
++ if (info->options_len < sizeof(*md))
++ goto drop;
+ md = ip_tunnel_info_opts(info);
++ }
+ ttl = info->key.ttl;
+ tos = info->key.tos;
+ label = info->key.label;
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 7f42314da6ae..bac4b4bbc33d 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -1159,6 +1159,7 @@ static int __init unittest_data_add(void)
+ of_fdt_unflatten_tree(unittest_data, NULL, &unittest_data_node);
+ if (!unittest_data_node) {
+ pr_warn("%s: No tree to attach; not running tests\n", __func__);
++ kfree(unittest_data);
+ return -ENODATA;
+ }
+
+diff --git a/drivers/pinctrl/bcm/pinctrl-ns2-mux.c b/drivers/pinctrl/bcm/pinctrl-ns2-mux.c
+index 4b5cf0e0f16e..951090faa6a9 100644
+--- a/drivers/pinctrl/bcm/pinctrl-ns2-mux.c
++++ b/drivers/pinctrl/bcm/pinctrl-ns2-mux.c
+@@ -640,8 +640,8 @@ static int ns2_pinmux_enable(struct pinctrl_dev *pctrl_dev,
+ const struct ns2_pin_function *func;
+ const struct ns2_pin_group *grp;
+
+- if (grp_select > pinctrl->num_groups ||
+- func_select > pinctrl->num_functions)
++ if (grp_select >= pinctrl->num_groups ||
++ func_select >= pinctrl->num_functions)
+ return -EINVAL;
+
+ func = &pinctrl->functions[func_select];
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index 6a61028cbb3c..429166e6ec9e 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -445,6 +445,13 @@ static const struct dmi_system_id critclk_systems[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "CB6363"),
+ },
+ },
++ {
++ .ident = "SIMATIC IPC227E",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SIEMENS AG"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "6ES7647-8B"),
++ },
++ },
+ { /*sentinel*/ }
+ };
+
+diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
+index 210fc20f7de7..b255590aef36 100644
+--- a/drivers/regulator/of_regulator.c
++++ b/drivers/regulator/of_regulator.c
+@@ -214,12 +214,12 @@ static void of_get_regulation_constraints(struct device_node *np,
+ "regulator-off-in-suspend"))
+ suspend_state->enabled = DISABLE_IN_SUSPEND;
+
+- if (!of_property_read_u32(np, "regulator-suspend-min-microvolt",
+- &pval))
++ if (!of_property_read_u32(suspend_np,
++ "regulator-suspend-min-microvolt", &pval))
+ suspend_state->min_uV = pval;
+
+- if (!of_property_read_u32(np, "regulator-suspend-max-microvolt",
+- &pval))
++ if (!of_property_read_u32(suspend_np,
++ "regulator-suspend-max-microvolt", &pval))
+ suspend_state->max_uV = pval;
+
+ if (!of_property_read_u32(suspend_np,
+diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
+index 31c3a236120a..69a377ab2604 100644
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -710,7 +710,13 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
+
+ /* SW2~SW4 high bit check and modify the voltage value table */
+ if (i >= sw_check_start && i <= sw_check_end) {
+- regmap_read(pfuze_chip->regmap, desc->vsel_reg, &val);
++ ret = regmap_read(pfuze_chip->regmap,
++ desc->vsel_reg, &val);
++ if (ret) {
++ dev_err(&client->dev, "Fails to read from the register.\n");
++ return ret;
++ }
++
+ if (val & sw_hi) {
+ if (pfuze_chip->chip_id == PFUZE3000 ||
+ pfuze_chip->chip_id == PFUZE3001) {
+diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
+index cced1ffb896c..89b9314d64c9 100644
+--- a/drivers/regulator/ti-abb-regulator.c
++++ b/drivers/regulator/ti-abb-regulator.c
+@@ -173,19 +173,14 @@ static int ti_abb_wait_txdone(struct device *dev, struct ti_abb *abb)
+ while (timeout++ <= abb->settling_time) {
+ status = ti_abb_check_txdone(abb);
+ if (status)
+- break;
++ return 0;
+
+ udelay(1);
+ }
+
+- if (timeout > abb->settling_time) {
+- dev_warn_ratelimited(dev,
+- "%s:TRANXDONE timeout(%duS) int=0x%08x\n",
+- __func__, timeout, readl(abb->int_base));
+- return -ETIMEDOUT;
+- }
+-
+- return 0;
++ dev_warn_ratelimited(dev, "%s:TRANXDONE timeout(%duS) int=0x%08x\n",
++ __func__, timeout, readl(abb->int_base));
++ return -ETIMEDOUT;
+ }
+
+ /**
+@@ -205,19 +200,14 @@ static int ti_abb_clear_all_txdone(struct device *dev, const struct ti_abb *abb)
+
+ status = ti_abb_check_txdone(abb);
+ if (!status)
+- break;
++ return 0;
+
+ udelay(1);
+ }
+
+- if (timeout > abb->settling_time) {
+- dev_warn_ratelimited(dev,
+- "%s:TRANXDONE timeout(%duS) int=0x%08x\n",
+- __func__, timeout, readl(abb->int_base));
+- return -ETIMEDOUT;
+- }
+-
+- return 0;
++ dev_warn_ratelimited(dev, "%s:TRANXDONE timeout(%duS) int=0x%08x\n",
++ __func__, timeout, readl(abb->int_base));
++ return -ETIMEDOUT;
+ }
+
+ /**
+diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
+index 7c097006c54d..a8ac48027632 100644
+--- a/drivers/scsi/Kconfig
++++ b/drivers/scsi/Kconfig
+@@ -862,7 +862,7 @@ config SCSI_SNI_53C710
+
+ config 53C700_LE_ON_BE
+ bool
+- depends on SCSI_LASI700
++ depends on SCSI_LASI700 || SCSI_SNI_53C710
+ default y
+
+ config SCSI_STEX
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index 9c21938ed67e..c95c782b93a5 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -526,6 +526,7 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ unsigned int tpg_desc_tbl_off;
+ unsigned char orig_transition_tmo;
+ unsigned long flags;
++ bool transitioning_sense = false;
+
+ if (!pg->expiry) {
+ unsigned long transition_tmo = ALUA_FAILOVER_TIMEOUT * HZ;
+@@ -586,13 +587,19 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ goto retry;
+ }
+ /*
+- * Retry on ALUA state transition or if any
+- * UNIT ATTENTION occurred.
++ * If the array returns with 'ALUA state transition'
++ * sense code here it cannot return RTPG data during
++ * transition. So set the state to 'transitioning' directly.
+ */
+ if (sense_hdr.sense_key == NOT_READY &&
+- sense_hdr.asc == 0x04 && sense_hdr.ascq == 0x0a)
+- err = SCSI_DH_RETRY;
+- else if (sense_hdr.sense_key == UNIT_ATTENTION)
++ sense_hdr.asc == 0x04 && sense_hdr.ascq == 0x0a) {
++ transitioning_sense = true;
++ goto skip_rtpg;
++ }
++ /*
++ * Retry on any other UNIT ATTENTION occurred.
++ */
++ if (sense_hdr.sense_key == UNIT_ATTENTION)
+ err = SCSI_DH_RETRY;
+ if (err == SCSI_DH_RETRY &&
+ pg->expiry != 0 && time_before(jiffies, pg->expiry)) {
+@@ -680,7 +687,11 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ off = 8 + (desc[7] * 4);
+ }
+
++ skip_rtpg:
+ spin_lock_irqsave(&pg->lock, flags);
++ if (transitioning_sense)
++ pg->state = SCSI_ACCESS_STATE_TRANSITIONING;
++
+ sdev_printk(KERN_INFO, sdev,
+ "%s: port group %02x state %c %s supports %c%c%c%c%c%c%c\n",
+ ALUA_DH_NAME, pg->group_id, print_alua_state(pg->state),
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 60b6019a2fca..856a7ceb9a04 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3186,6 +3186,10 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ req->req_q_in, req->req_q_out, rsp->rsp_q_in, rsp->rsp_q_out);
+
+ ha->wq = alloc_workqueue("qla2xxx_wq", 0, 0);
++ if (unlikely(!ha->wq)) {
++ ret = -ENOMEM;
++ goto probe_failed;
++ }
+
+ if (ha->isp_ops->initialize_adapter(base_vha)) {
+ ql_log(ql_log_fatal, base_vha, 0x00d6,
+diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c
+index 1f9a087daf69..3102a75984d3 100644
+--- a/drivers/scsi/sni_53c710.c
++++ b/drivers/scsi/sni_53c710.c
+@@ -78,10 +78,8 @@ static int snirm710_probe(struct platform_device *dev)
+
+ base = res->start;
+ hostdata = kzalloc(sizeof(*hostdata), GFP_KERNEL);
+- if (!hostdata) {
+- dev_printk(KERN_ERR, dev, "Failed to allocate host data\n");
++ if (!hostdata)
+ return -ENOMEM;
+- }
+
+ hostdata->dev = &dev->dev;
+ dma_set_mask(&dev->dev, DMA_BIT_MASK(32));
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index 47b5ef153135..e9ff2a7c0c0e 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -1128,27 +1128,6 @@ passthrough_parse_cdb(struct se_cmd *cmd,
+ struct se_device *dev = cmd->se_dev;
+ unsigned int size;
+
+- /*
+- * Clear a lun set in the cdb if the initiator talking to use spoke
+- * and old standards version, as we can't assume the underlying device
+- * won't choke up on it.
+- */
+- switch (cdb[0]) {
+- case READ_10: /* SBC - RDProtect */
+- case READ_12: /* SBC - RDProtect */
+- case READ_16: /* SBC - RDProtect */
+- case SEND_DIAGNOSTIC: /* SPC - SELF-TEST Code */
+- case VERIFY: /* SBC - VRProtect */
+- case VERIFY_16: /* SBC - VRProtect */
+- case WRITE_VERIFY: /* SBC - VRProtect */
+- case WRITE_VERIFY_12: /* SBC - VRProtect */
+- case MAINTENANCE_IN: /* SPC - Parameter Data Format for SA RTPG */
+- break;
+- default:
+- cdb[1] &= 0x1f; /* clear logical unit number */
+- break;
+- }
+-
+ /*
+ * For REPORT LUNS we always need to emulate the response, for everything
+ * else, pass it up.
+diff --git a/drivers/tty/serial/8250/8250_men_mcb.c b/drivers/tty/serial/8250/8250_men_mcb.c
+index 127017cc41d9..057b1eaf6d2e 100644
+--- a/drivers/tty/serial/8250/8250_men_mcb.c
++++ b/drivers/tty/serial/8250/8250_men_mcb.c
+@@ -71,8 +71,8 @@ static int serial_8250_men_mcb_probe(struct mcb_device *mdev,
+ {
+ struct serial_8250_men_mcb_data *data;
+ struct resource *mem;
+- unsigned int num_ports;
+- unsigned int i;
++ int num_ports;
++ int i;
+ void __iomem *membase;
+
+ mem = mcb_get_resource(mdev, IORESOURCE_MEM);
+@@ -87,7 +87,7 @@ static int serial_8250_men_mcb_probe(struct mcb_device *mdev,
+ dev_dbg(&mdev->dev, "found a 16z%03u with %u ports\n",
+ mdev->id, num_ports);
+
+- if (num_ports == 0 || num_ports > 4) {
++ if (num_ports <= 0 || num_ports > 4) {
+ dev_err(&mdev->dev, "unexpected number of ports: %u\n",
+ num_ports);
+ return -ENODEV;
+@@ -132,7 +132,7 @@ static int serial_8250_men_mcb_probe(struct mcb_device *mdev,
+
+ static void serial_8250_men_mcb_remove(struct mcb_device *mdev)
+ {
+- unsigned int num_ports, i;
++ int num_ports, i;
+ struct serial_8250_men_mcb_data *data = mcb_get_drvdata(mdev);
+
+ if (!data)
+diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
+index aa31d36bed00..1a79a9955187 100644
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -1149,7 +1149,7 @@ static int check_pending_gadget_drivers(struct usb_udc *udc)
+ dev_name(&udc->dev)) == 0) {
+ ret = udc_bind_to_driver(udc, driver);
+ if (ret != -EPROBE_DEFER)
+- list_del(&driver->pending);
++ list_del_init(&driver->pending);
+ break;
+ }
+
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 4dbae6e268d6..71c2dd0c7f03 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1286,6 +1286,11 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file);
+ struct cifsInodeInfo {
+ bool can_cache_brlcks;
+ struct list_head llist; /* locks helb by this inode */
++ /*
++ * NOTE: Some code paths call down_read(lock_sem) twice, so
++ * we must always use use cifs_down_write() instead of down_write()
++ * for this semaphore to avoid deadlocks.
++ */
+ struct rw_semaphore lock_sem; /* protect the fields above */
+ /* BB add in lists for dirty pages i.e. write caching info for oplock */
+ struct list_head openFileList;
+diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
+index 20adda4de83b..d7ac75ea881c 100644
+--- a/fs/cifs/cifsproto.h
++++ b/fs/cifs/cifsproto.h
+@@ -159,6 +159,7 @@ extern int cifs_unlock_range(struct cifsFileInfo *cfile,
+ struct file_lock *flock, const unsigned int xid);
+ extern int cifs_push_mandatory_locks(struct cifsFileInfo *cfile);
+
++extern void cifs_down_write(struct rw_semaphore *sem);
+ extern struct cifsFileInfo *cifs_new_fileinfo(struct cifs_fid *fid,
+ struct file *file,
+ struct tcon_link *tlink,
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index b4e33ef2ff31..a8e2bc47dcf2 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -280,6 +280,13 @@ cifs_has_mand_locks(struct cifsInodeInfo *cinode)
+ return has_locks;
+ }
+
++void
++cifs_down_write(struct rw_semaphore *sem)
++{
++ while (!down_write_trylock(sem))
++ msleep(10);
++}
++
+ struct cifsFileInfo *
+ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ struct tcon_link *tlink, __u32 oplock)
+@@ -305,7 +312,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ INIT_LIST_HEAD(&fdlocks->locks);
+ fdlocks->cfile = cfile;
+ cfile->llist = fdlocks;
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ list_add(&fdlocks->llist, &cinode->llist);
+ up_write(&cinode->lock_sem);
+
+@@ -461,7 +468,7 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ * Delete any outstanding lock records. We'll lose them when the file
+ * is closed anyway.
+ */
+- down_write(&cifsi->lock_sem);
++ cifs_down_write(&cifsi->lock_sem);
+ list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) {
+ list_del(&li->llist);
+ cifs_del_lock_waiters(li);
+@@ -1016,7 +1023,7 @@ static void
+ cifs_lock_add(struct cifsFileInfo *cfile, struct cifsLockInfo *lock)
+ {
+ struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry));
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ list_add_tail(&lock->llist, &cfile->llist->locks);
+ up_write(&cinode->lock_sem);
+ }
+@@ -1038,7 +1045,7 @@ cifs_lock_add_if(struct cifsFileInfo *cfile, struct cifsLockInfo *lock,
+
+ try_again:
+ exist = false;
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+
+ exist = cifs_find_lock_conflict(cfile, lock->offset, lock->length,
+ lock->type, &conf_lock, CIFS_LOCK_OP);
+@@ -1060,7 +1067,7 @@ try_again:
+ (lock->blist.next == &lock->blist));
+ if (!rc)
+ goto try_again;
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ list_del_init(&lock->blist);
+ }
+
+@@ -1113,7 +1120,7 @@ cifs_posix_lock_set(struct file *file, struct file_lock *flock)
+ return rc;
+
+ try_again:
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ if (!cinode->can_cache_brlcks) {
+ up_write(&cinode->lock_sem);
+ return rc;
+@@ -1319,7 +1326,7 @@ cifs_push_locks(struct cifsFileInfo *cfile)
+ int rc = 0;
+
+ /* we are going to update can_cache_brlcks here - need a write access */
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ if (!cinode->can_cache_brlcks) {
+ up_write(&cinode->lock_sem);
+ return rc;
+@@ -1510,7 +1517,7 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+ if (!buf)
+ return -ENOMEM;
+
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ for (i = 0; i < 2; i++) {
+ cur = buf;
+ num = 0;
+diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
+index b204e84b87fb..9168b2266e4f 100644
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -137,7 +137,7 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+
+ cur = buf;
+
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ list_for_each_entry_safe(li, tmp, &cfile->llist->locks, llist) {
+ if (flock->fl_start > li->offset ||
+ (flock->fl_start + length) <
+diff --git a/include/linux/gfp.h b/include/linux/gfp.h
+index 24bcc5eec6b4..f78d1e89593f 100644
+--- a/include/linux/gfp.h
++++ b/include/linux/gfp.h
+@@ -325,6 +325,29 @@ static inline bool gfpflags_allow_blocking(const gfp_t gfp_flags)
+ return !!(gfp_flags & __GFP_DIRECT_RECLAIM);
+ }
+
++/**
++ * gfpflags_normal_context - is gfp_flags a normal sleepable context?
++ * @gfp_flags: gfp_flags to test
++ *
++ * Test whether @gfp_flags indicates that the allocation is from the
++ * %current context and allowed to sleep.
++ *
++ * An allocation being allowed to block doesn't mean it owns the %current
++ * context. When direct reclaim path tries to allocate memory, the
++ * allocation context is nested inside whatever %current was doing at the
++ * time of the original allocation. The nested allocation may be allowed
++ * to block but modifying anything %current owns can corrupt the outer
++ * context's expectations.
++ *
++ * %true result from this function indicates that the allocation context
++ * can sleep and use anything that's associated with %current.
++ */
++static inline bool gfpflags_normal_context(const gfp_t gfp_flags)
++{
++ return (gfp_flags & (__GFP_DIRECT_RECLAIM | __GFP_MEMALLOC)) ==
++ __GFP_DIRECT_RECLAIM;
++}
++
+ #ifdef CONFIG_HIGHMEM
+ #define OPT_ZONE_HIGHMEM ZONE_HIGHMEM
+ #else
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 28baccb1efd5..80c3da1aa8b1 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1251,7 +1251,8 @@ static inline __u32 skb_get_hash_flowi6(struct sk_buff *skb, const struct flowi6
+ return skb->hash;
+ }
+
+-__u32 skb_get_hash_perturb(const struct sk_buff *skb, u32 perturb);
++__u32 skb_get_hash_perturb(const struct sk_buff *skb,
++ const siphash_key_t *perturb);
+
+ static inline __u32 skb_get_hash_raw(const struct sk_buff *skb)
+ {
+@@ -1379,6 +1380,19 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
+ return list->next == (const struct sk_buff *) list;
+ }
+
++/**
++ * skb_queue_empty_lockless - check if a queue is empty
++ * @list: queue head
++ *
++ * Returns true if the queue is empty, false otherwise.
++ * This variant can be used in lockless contexts.
++ */
++static inline bool skb_queue_empty_lockless(const struct sk_buff_head *list)
++{
++ return READ_ONCE(list->next) == (const struct sk_buff *) list;
++}
++
++
+ /**
+ * skb_queue_is_last - check if skb is the last entry in the queue
+ * @list: queue head
+@@ -1723,9 +1737,11 @@ static inline void __skb_insert(struct sk_buff *newsk,
+ struct sk_buff *prev, struct sk_buff *next,
+ struct sk_buff_head *list)
+ {
+- newsk->next = next;
+- newsk->prev = prev;
+- next->prev = prev->next = newsk;
++ /* see skb_queue_empty_lockless() for the opposite READ_ONCE() */
++ WRITE_ONCE(newsk->next, next);
++ WRITE_ONCE(newsk->prev, prev);
++ WRITE_ONCE(next->prev, newsk);
++ WRITE_ONCE(prev->next, newsk);
+ list->qlen++;
+ }
+
+@@ -1736,11 +1752,11 @@ static inline void __skb_queue_splice(const struct sk_buff_head *list,
+ struct sk_buff *first = list->next;
+ struct sk_buff *last = list->prev;
+
+- first->prev = prev;
+- prev->next = first;
++ WRITE_ONCE(first->prev, prev);
++ WRITE_ONCE(prev->next, first);
+
+- last->next = next;
+- next->prev = last;
++ WRITE_ONCE(last->next, next);
++ WRITE_ONCE(next->prev, last);
+ }
+
+ /**
+@@ -1881,8 +1897,8 @@ static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
+ next = skb->next;
+ prev = skb->prev;
+ skb->next = skb->prev = NULL;
+- next->prev = prev;
+- prev->next = next;
++ WRITE_ONCE(next->prev, prev);
++ WRITE_ONCE(prev->next, next);
+ }
+
+ /**
+diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
+index ba61cdd09eaa..cf8f792743ec 100644
+--- a/include/net/busy_poll.h
++++ b/include/net/busy_poll.h
+@@ -134,7 +134,7 @@ static inline void skb_mark_napi_id(struct sk_buff *skb,
+ static inline void sk_mark_napi_id(struct sock *sk, const struct sk_buff *skb)
+ {
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+- sk->sk_napi_id = skb->napi_id;
++ WRITE_ONCE(sk->sk_napi_id, skb->napi_id);
+ #endif
+ sk_rx_queue_set(sk, skb);
+ }
+@@ -144,8 +144,8 @@ static inline void sk_mark_napi_id_once(struct sock *sk,
+ const struct sk_buff *skb)
+ {
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+- if (!sk->sk_napi_id)
+- sk->sk_napi_id = skb->napi_id;
++ if (!READ_ONCE(sk->sk_napi_id))
++ WRITE_ONCE(sk->sk_napi_id, skb->napi_id);
+ #endif
+ }
+
+diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
+index 6a4586dcdede..4618cbbe3632 100644
+--- a/include/net/flow_dissector.h
++++ b/include/net/flow_dissector.h
+@@ -4,6 +4,7 @@
+
+ #include <linux/types.h>
+ #include <linux/in6.h>
++#include <linux/siphash.h>
+ #include <uapi/linux/if_ether.h>
+
+ /**
+@@ -252,7 +253,7 @@ struct flow_keys_basic {
+ struct flow_keys {
+ struct flow_dissector_key_control control;
+ #define FLOW_KEYS_HASH_START_FIELD basic
+- struct flow_dissector_key_basic basic;
++ struct flow_dissector_key_basic basic __aligned(SIPHASH_ALIGNMENT);
+ struct flow_dissector_key_tags tags;
+ struct flow_dissector_key_vlan vlan;
+ struct flow_dissector_key_vlan cvlan;
+diff --git a/include/net/fq.h b/include/net/fq.h
+index ac944a686840..c51be50e1349 100644
+--- a/include/net/fq.h
++++ b/include/net/fq.h
+@@ -70,7 +70,7 @@ struct fq {
+ struct list_head backlogs;
+ spinlock_t lock;
+ u32 flows_cnt;
+- u32 perturbation;
++ siphash_key_t perturbation;
+ u32 limit;
+ u32 memory_limit;
+ u32 memory_usage;
+diff --git a/include/net/fq_impl.h b/include/net/fq_impl.h
+index be7c0fab3478..89a012905ef0 100644
+--- a/include/net/fq_impl.h
++++ b/include/net/fq_impl.h
+@@ -118,7 +118,7 @@ static struct fq_flow *fq_flow_classify(struct fq *fq,
+
+ lockdep_assert_held(&fq->lock);
+
+- hash = skb_get_hash_perturb(skb, fq->perturbation);
++ hash = skb_get_hash_perturb(skb, &fq->perturbation);
+ idx = reciprocal_scale(hash, fq->flows_cnt);
+ flow = &fq->flows[idx];
+
+@@ -307,7 +307,7 @@ static int fq_init(struct fq *fq, int flows_cnt)
+ INIT_LIST_HEAD(&fq->backlogs);
+ spin_lock_init(&fq->lock);
+ fq->flows_cnt = max_t(u32, flows_cnt, 1);
+- fq->perturbation = prandom_u32();
++ get_random_bytes(&fq->perturbation, sizeof(fq->perturbation));
+ fq->quantum = 300;
+ fq->limit = 8192;
+ fq->memory_limit = 16 << 20; /* 16 MBytes */
+diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
+index 3f7b166262d7..5007eaba207d 100644
+--- a/include/net/net_namespace.h
++++ b/include/net/net_namespace.h
+@@ -322,7 +322,7 @@ static inline struct net *read_pnet(const possible_net_t *pnet)
+ #define __net_initconst __initconst
+ #endif
+
+-int peernet2id_alloc(struct net *net, struct net *peer);
++int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp);
+ int peernet2id(struct net *net, struct net *peer);
+ bool peernet_has_id(struct net *net, struct net *peer);
+ struct net *get_net_ns_by_id(struct net *net, int id);
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 1ece7736c49c..05e8faa84717 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -945,8 +945,8 @@ static inline void sk_incoming_cpu_update(struct sock *sk)
+ {
+ int cpu = raw_smp_processor_id();
+
+- if (unlikely(sk->sk_incoming_cpu != cpu))
+- sk->sk_incoming_cpu = cpu;
++ if (unlikely(READ_ONCE(sk->sk_incoming_cpu) != cpu))
++ WRITE_ONCE(sk->sk_incoming_cpu, cpu);
+ }
+
+ static inline void sock_rps_record_flow_hash(__u32 hash)
+@@ -2216,12 +2216,17 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp,
+ * sk_page_frag - return an appropriate page_frag
+ * @sk: socket
+ *
+- * If socket allocation mode allows current thread to sleep, it means its
+- * safe to use the per task page_frag instead of the per socket one.
++ * Use the per task page_frag instead of the per socket one for
++ * optimization when we know that we're in the normal context and owns
++ * everything that's associated with %current.
++ *
++ * gfpflags_allow_blocking() isn't enough here as direct reclaim may nest
++ * inside other socket operations and end up recursing into sk_page_frag()
++ * while it's already in use.
+ */
+ static inline struct page_frag *sk_page_frag(struct sock *sk)
+ {
+- if (gfpflags_allow_blocking(sk->sk_allocation))
++ if (gfpflags_normal_context(sk->sk_allocation))
+ return ¤t->task_frag;
+
+ return &sk->sk_frag;
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index bdf104596d12..dac518977e7d 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -448,6 +448,8 @@ static bool synth_field_signed(char *type)
+ {
+ if (strncmp(type, "u", 1) == 0)
+ return false;
++ if (strcmp(type, "gfp_t") == 0)
++ return false;
+
+ return true;
+ }
+diff --git a/net/atm/common.c b/net/atm/common.c
+index a38c174fc766..6772eddf6ec0 100644
+--- a/net/atm/common.c
++++ b/net/atm/common.c
+@@ -667,7 +667,7 @@ __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
+ mask |= EPOLLHUP;
+
+ /* readable? */
+- if (!skb_queue_empty(&sk->sk_receive_queue))
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+ /* writable? */
+diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
+index 8d12198eaa94..ee60c30f3be2 100644
+--- a/net/bluetooth/af_bluetooth.c
++++ b/net/bluetooth/af_bluetooth.c
+@@ -460,7 +460,7 @@ __poll_t bt_sock_poll(struct file *file, struct socket *sock,
+ if (sk->sk_state == BT_LISTEN)
+ return bt_accept_poll(sk);
+
+- if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
++ if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
+ mask |= EPOLLERR |
+ (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
+
+@@ -470,7 +470,7 @@ __poll_t bt_sock_poll(struct file *file, struct socket *sock,
+ if (sk->sk_shutdown == SHUTDOWN_MASK)
+ mask |= EPOLLHUP;
+
+- if (!skb_queue_empty(&sk->sk_receive_queue))
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+ if (sk->sk_state == BT_CLOSED)
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index 416717c57cd1..4b31f0aaa96d 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -953,7 +953,7 @@ static __poll_t caif_poll(struct file *file,
+ mask |= EPOLLRDHUP;
+
+ /* readable? */
+- if (!skb_queue_empty(&sk->sk_receive_queue) ||
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
+ (sk->sk_shutdown & RCV_SHUTDOWN))
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index a487df53a453..865a8cb7b0bd 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -95,7 +95,7 @@ int __skb_wait_for_more_packets(struct sock *sk, int *err, long *timeo_p,
+ if (error)
+ goto out_err;
+
+- if (sk->sk_receive_queue.prev != skb)
++ if (READ_ONCE(sk->sk_receive_queue.prev) != skb)
+ goto out;
+
+ /* Socket shut down? */
+@@ -279,7 +279,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk, unsigned int flags,
+ break;
+
+ sk_busy_loop(sk, flags & MSG_DONTWAIT);
+- } while (sk->sk_receive_queue.prev != *last);
++ } while (READ_ONCE(sk->sk_receive_queue.prev) != *last);
+
+ error = -EAGAIN;
+
+@@ -842,7 +842,7 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
+ mask = 0;
+
+ /* exceptional events? */
+- if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
++ if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
+ mask |= EPOLLERR |
+ (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
+
+@@ -852,7 +852,7 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
+ mask |= EPOLLHUP;
+
+ /* readable? */
+- if (!skb_queue_empty(&sk->sk_receive_queue))
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+ /* Connection-based need to check for termination and startup */
+diff --git a/net/core/dev.c b/net/core/dev.c
+index ddd8aab20adf..4a2ee1ce6c02 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -9211,7 +9211,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
+ call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
+ rcu_barrier();
+
+- new_nsid = peernet2id_alloc(dev_net(dev), net);
++ new_nsid = peernet2id_alloc(dev_net(dev), net, GFP_KERNEL);
+ /* If there is an ifindex conflict assign a new one */
+ if (__dev_get_by_index(net, dev->ifindex))
+ new_ifindex = dev_new_index(net);
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 996813f345d5..09d828a6a173 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -1482,11 +1482,13 @@ static int ethtool_reset(struct net_device *dev, char __user *useraddr)
+
+ static int ethtool_get_wol(struct net_device *dev, char __user *useraddr)
+ {
+- struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
++ struct ethtool_wolinfo wol;
+
+ if (!dev->ethtool_ops->get_wol)
+ return -EOPNOTSUPP;
+
++ memset(&wol, 0, sizeof(struct ethtool_wolinfo));
++ wol.cmd = ETHTOOL_GWOL;
+ dev->ethtool_ops->get_wol(dev, &wol);
+
+ if (copy_to_user(useraddr, &wol, sizeof(wol)))
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index 415b95f76b66..4362ffe9b5ef 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -1077,30 +1077,21 @@ out_bad:
+ }
+ EXPORT_SYMBOL(__skb_flow_dissect);
+
+-static u32 hashrnd __read_mostly;
++static siphash_key_t hashrnd __read_mostly;
+ static __always_inline void __flow_hash_secret_init(void)
+ {
+ net_get_random_once(&hashrnd, sizeof(hashrnd));
+ }
+
+-static __always_inline u32 __flow_hash_words(const u32 *words, u32 length,
+- u32 keyval)
++static const void *flow_keys_hash_start(const struct flow_keys *flow)
+ {
+- return jhash2(words, length, keyval);
+-}
+-
+-static inline const u32 *flow_keys_hash_start(const struct flow_keys *flow)
+-{
+- const void *p = flow;
+-
+- BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % sizeof(u32));
+- return (const u32 *)(p + FLOW_KEYS_HASH_OFFSET);
++ BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % SIPHASH_ALIGNMENT);
++ return &flow->FLOW_KEYS_HASH_START_FIELD;
+ }
+
+ static inline size_t flow_keys_hash_length(const struct flow_keys *flow)
+ {
+ size_t diff = FLOW_KEYS_HASH_OFFSET + sizeof(flow->addrs);
+- BUILD_BUG_ON((sizeof(*flow) - FLOW_KEYS_HASH_OFFSET) % sizeof(u32));
+ BUILD_BUG_ON(offsetof(typeof(*flow), addrs) !=
+ sizeof(*flow) - sizeof(flow->addrs));
+
+@@ -1115,7 +1106,7 @@ static inline size_t flow_keys_hash_length(const struct flow_keys *flow)
+ diff -= sizeof(flow->addrs.tipckey);
+ break;
+ }
+- return (sizeof(*flow) - diff) / sizeof(u32);
++ return sizeof(*flow) - diff;
+ }
+
+ __be32 flow_get_u32_src(const struct flow_keys *flow)
+@@ -1181,14 +1172,15 @@ static inline void __flow_hash_consistentify(struct flow_keys *keys)
+ }
+ }
+
+-static inline u32 __flow_hash_from_keys(struct flow_keys *keys, u32 keyval)
++static inline u32 __flow_hash_from_keys(struct flow_keys *keys,
++ const siphash_key_t *keyval)
+ {
+ u32 hash;
+
+ __flow_hash_consistentify(keys);
+
+- hash = __flow_hash_words(flow_keys_hash_start(keys),
+- flow_keys_hash_length(keys), keyval);
++ hash = siphash(flow_keys_hash_start(keys),
++ flow_keys_hash_length(keys), keyval);
+ if (!hash)
+ hash = 1;
+
+@@ -1198,12 +1190,13 @@ static inline u32 __flow_hash_from_keys(struct flow_keys *keys, u32 keyval)
+ u32 flow_hash_from_keys(struct flow_keys *keys)
+ {
+ __flow_hash_secret_init();
+- return __flow_hash_from_keys(keys, hashrnd);
++ return __flow_hash_from_keys(keys, &hashrnd);
+ }
+ EXPORT_SYMBOL(flow_hash_from_keys);
+
+ static inline u32 ___skb_get_hash(const struct sk_buff *skb,
+- struct flow_keys *keys, u32 keyval)
++ struct flow_keys *keys,
++ const siphash_key_t *keyval)
+ {
+ skb_flow_dissect_flow_keys(skb, keys,
+ FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
+@@ -1251,7 +1244,7 @@ u32 __skb_get_hash_symmetric(const struct sk_buff *skb)
+ NULL, 0, 0, 0,
+ FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
+
+- return __flow_hash_from_keys(&keys, hashrnd);
++ return __flow_hash_from_keys(&keys, &hashrnd);
+ }
+ EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric);
+
+@@ -1271,13 +1264,14 @@ void __skb_get_hash(struct sk_buff *skb)
+
+ __flow_hash_secret_init();
+
+- hash = ___skb_get_hash(skb, &keys, hashrnd);
++ hash = ___skb_get_hash(skb, &keys, &hashrnd);
+
+ __skb_set_sw_hash(skb, hash, flow_keys_have_l4(&keys));
+ }
+ EXPORT_SYMBOL(__skb_get_hash);
+
+-__u32 skb_get_hash_perturb(const struct sk_buff *skb, u32 perturb)
++__u32 skb_get_hash_perturb(const struct sk_buff *skb,
++ const siphash_key_t *perturb)
+ {
+ struct flow_keys keys;
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 7320f0844a50..6dab186d4b8f 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -226,11 +226,11 @@ static int __peernet2id(struct net *net, struct net *peer)
+ return __peernet2id_alloc(net, peer, &no);
+ }
+
+-static void rtnl_net_notifyid(struct net *net, int cmd, int id);
++static void rtnl_net_notifyid(struct net *net, int cmd, int id, gfp_t gfp);
+ /* This function returns the id of a peer netns. If no id is assigned, one will
+ * be allocated and returned.
+ */
+-int peernet2id_alloc(struct net *net, struct net *peer)
++int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp)
+ {
+ bool alloc = false, alive = false;
+ int id;
+@@ -249,7 +249,7 @@ int peernet2id_alloc(struct net *net, struct net *peer)
+ id = __peernet2id_alloc(net, peer, &alloc);
+ spin_unlock_bh(&net->nsid_lock);
+ if (alloc && id >= 0)
+- rtnl_net_notifyid(net, RTM_NEWNSID, id);
++ rtnl_net_notifyid(net, RTM_NEWNSID, id, gfp);
+ if (alive)
+ put_net(peer);
+ return id;
+@@ -495,7 +495,8 @@ static void unhash_nsid(struct net *net, struct net *last)
+ idr_remove(&tmp->netns_ids, id);
+ spin_unlock_bh(&tmp->nsid_lock);
+ if (id >= 0)
+- rtnl_net_notifyid(tmp, RTM_DELNSID, id);
++ rtnl_net_notifyid(tmp, RTM_DELNSID, id,
++ GFP_KERNEL);
+ if (tmp == last)
+ break;
+ }
+@@ -720,7 +721,7 @@ static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
+ err = alloc_netid(net, peer, nsid);
+ spin_unlock_bh(&net->nsid_lock);
+ if (err >= 0) {
+- rtnl_net_notifyid(net, RTM_NEWNSID, err);
++ rtnl_net_notifyid(net, RTM_NEWNSID, err, GFP_KERNEL);
+ err = 0;
+ } else if (err == -ENOSPC && nsid >= 0) {
+ err = -EEXIST;
+@@ -862,12 +863,12 @@ static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
+ return skb->len;
+ }
+
+-static void rtnl_net_notifyid(struct net *net, int cmd, int id)
++static void rtnl_net_notifyid(struct net *net, int cmd, int id, gfp_t gfp)
+ {
+ struct sk_buff *msg;
+ int err = -ENOMEM;
+
+- msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
++ msg = nlmsg_new(rtnl_net_get_size(), gfp);
+ if (!msg)
+ goto out;
+
+@@ -875,7 +876,7 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id)
+ if (err < 0)
+ goto err_out;
+
+- rtnl_notify(msg, net, 0, RTNLGRP_NSID, NULL, 0);
++ rtnl_notify(msg, net, 0, RTNLGRP_NSID, NULL, gfp);
+ return;
+
+ err_out:
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 3932eed379a4..95768a9fca06 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1519,7 +1519,7 @@ static noinline_for_stack int nla_put_ifalias(struct sk_buff *skb,
+
+ static int rtnl_fill_link_netnsid(struct sk_buff *skb,
+ const struct net_device *dev,
+- struct net *src_net)
++ struct net *src_net, gfp_t gfp)
+ {
+ bool put_iflink = false;
+
+@@ -1527,7 +1527,7 @@ static int rtnl_fill_link_netnsid(struct sk_buff *skb,
+ struct net *link_net = dev->rtnl_link_ops->get_link_net(dev);
+
+ if (!net_eq(dev_net(dev), link_net)) {
+- int id = peernet2id_alloc(src_net, link_net);
++ int id = peernet2id_alloc(src_net, link_net, gfp);
+
+ if (nla_put_s32(skb, IFLA_LINK_NETNSID, id))
+ return -EMSGSIZE;
+@@ -1585,7 +1585,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
+ int type, u32 pid, u32 seq, u32 change,
+ unsigned int flags, u32 ext_filter_mask,
+ u32 event, int *new_nsid, int new_ifindex,
+- int tgt_netnsid)
++ int tgt_netnsid, gfp_t gfp)
+ {
+ struct ifinfomsg *ifm;
+ struct nlmsghdr *nlh;
+@@ -1677,7 +1677,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
+ goto nla_put_failure;
+ }
+
+- if (rtnl_fill_link_netnsid(skb, dev, src_net))
++ if (rtnl_fill_link_netnsid(skb, dev, src_net, gfp))
+ goto nla_put_failure;
+
+ if (new_nsid &&
+@@ -1933,7 +1933,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ cb->nlh->nlmsg_seq, 0,
+ flags,
+ ext_filter_mask, 0, NULL, 0,
+- netnsid);
++ netnsid, GFP_KERNEL);
+
+ if (err < 0) {
+ if (likely(skb->len))
+@@ -3215,7 +3215,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh,
+ err = rtnl_fill_ifinfo(nskb, dev, net,
+ RTM_NEWLINK, NETLINK_CB(skb).portid,
+ nlh->nlmsg_seq, 0, 0, ext_filter_mask,
+- 0, NULL, 0, netnsid);
++ 0, NULL, 0, netnsid, GFP_KERNEL);
+ if (err < 0) {
+ /* -EMSGSIZE implies BUG in if_nlmsg_size */
+ WARN_ON(err == -EMSGSIZE);
+@@ -3325,7 +3325,7 @@ struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev,
+
+ err = rtnl_fill_ifinfo(skb, dev, dev_net(dev),
+ type, 0, 0, change, 0, 0, event,
+- new_nsid, new_ifindex, -1);
++ new_nsid, new_ifindex, -1, flags);
+ if (err < 0) {
+ /* -EMSGSIZE implies BUG in if_nlmsg_size() */
+ WARN_ON(err == -EMSGSIZE);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index f881eea1c4a4..6c1107821776 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1005,7 +1005,7 @@ set_rcvbuf:
+ break;
+
+ case SO_INCOMING_CPU:
+- sk->sk_incoming_cpu = val;
++ WRITE_ONCE(sk->sk_incoming_cpu, val);
+ break;
+
+ case SO_CNX_ADVICE:
+@@ -1341,7 +1341,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+ break;
+
+ case SO_INCOMING_CPU:
+- v.val = sk->sk_incoming_cpu;
++ v.val = READ_ONCE(sk->sk_incoming_cpu);
+ break;
+
+ case SO_MEMINFO:
+@@ -3483,7 +3483,7 @@ bool sk_busy_loop_end(void *p, unsigned long start_time)
+ {
+ struct sock *sk = p;
+
+- return !skb_queue_empty(&sk->sk_receive_queue) ||
++ return !skb_queue_empty_lockless(&sk->sk_receive_queue) ||
+ sk_busy_loop_timeout(sk, start_time);
+ }
+ EXPORT_SYMBOL(sk_busy_loop_end);
+diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
+index 8e08cea6f178..176bddacc16e 100644
+--- a/net/dccp/ipv4.c
++++ b/net/dccp/ipv4.c
+@@ -121,7 +121,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ inet->inet_daddr,
+ inet->inet_sport,
+ inet->inet_dport);
+- inet->inet_id = dp->dccps_iss ^ jiffies;
++ inet->inet_id = prandom_u32();
+
+ err = dccp_connect(sk);
+ rt = NULL;
+@@ -417,7 +417,7 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk,
+ RCU_INIT_POINTER(newinet->inet_opt, rcu_dereference(ireq->ireq_opt));
+ newinet->mc_index = inet_iif(skb);
+ newinet->mc_ttl = ip_hdr(skb)->ttl;
+- newinet->inet_id = jiffies;
++ newinet->inet_id = prandom_u32();
+
+ if (dst == NULL && (dst = inet_csk_route_child_sock(sk, newsk, req)) == NULL)
+ goto put_and_exit;
+diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
+index 7d6ff983ba2c..0e6f32defd67 100644
+--- a/net/decnet/af_decnet.c
++++ b/net/decnet/af_decnet.c
+@@ -1213,7 +1213,7 @@ static __poll_t dn_poll(struct file *file, struct socket *sock, poll_table *wai
+ struct dn_scp *scp = DN_SK(sk);
+ __poll_t mask = datagram_poll(file, sock, wait);
+
+- if (!skb_queue_empty(&scp->other_receive_queue))
++ if (!skb_queue_empty_lockless(&scp->other_receive_queue))
+ mask |= EPOLLRDBAND;
+
+ return mask;
+diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
+index a1917025e155..46ae4dee522a 100644
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -49,7 +49,7 @@ static struct dsa_switch_tree *dsa_tree_alloc(int index)
+ dst->index = index;
+
+ INIT_LIST_HEAD(&dst->list);
+- list_add_tail(&dsa_tree_list, &dst->list);
++ list_add_tail(&dst->list, &dsa_tree_list);
+
+ kref_init(&dst->refcount);
+
+diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
+index 80107a6a2c4a..dc8517c2cdc7 100644
+--- a/net/ipv4/datagram.c
++++ b/net/ipv4/datagram.c
+@@ -77,7 +77,7 @@ int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
+ reuseport_has_conns(sk, true);
+ sk->sk_state = TCP_ESTABLISHED;
+ sk_set_txhash(sk);
+- inet->inet_id = jiffies;
++ inet->inet_id = prandom_u32();
+
+ sk_dst_set(sk, &rt->dst);
+ err = 0;
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index dae743b649c1..7f4ec36e5f70 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -946,7 +946,7 @@ void fib_modify_prefix_metric(struct in_ifaddr *ifa, u32 new_metric)
+ if (!(dev->flags & IFF_UP) ||
+ ifa->ifa_flags & (IFA_F_SECONDARY | IFA_F_NOPREFIXROUTE) ||
+ ipv4_is_zeronet(prefix) ||
+- prefix == ifa->ifa_local || ifa->ifa_prefixlen == 32)
++ (prefix == ifa->ifa_local && ifa->ifa_prefixlen == 32))
+ return;
+
+ /* add the new */
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index f5c9ef2586de..7be966a60801 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -248,7 +248,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
+ if (sk->sk_bound_dev_if)
+ score += 4;
+ }
+- if (sk->sk_incoming_cpu == raw_smp_processor_id())
++ if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
+ score++;
+ }
+ return score;
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 0b87558f265e..758a0f86d499 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -589,9 +589,9 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
+ key = &tun_info->key;
+ if (!(tun_info->key.tun_flags & TUNNEL_ERSPAN_OPT))
+ goto err_free_rt;
++ if (tun_info->options_len < sizeof(*md))
++ goto err_free_rt;
+ md = ip_tunnel_info_opts(tun_info);
+- if (!md)
+- goto err_free_rt;
+
+ /* ERSPAN has fixed 8 byte GRE header */
+ version = md->version;
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 611ba174265c..647ba447bf1a 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -595,7 +595,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ }
+ /* This barrier is coupled with smp_wmb() in tcp_reset() */
+ smp_rmb();
+- if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
++ if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
+ mask |= EPOLLERR;
+
+ return mask;
+@@ -1948,7 +1948,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
+ if (unlikely(flags & MSG_ERRQUEUE))
+ return inet_recv_error(sk, msg, len, addr_len);
+
+- if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue) &&
++ if (sk_can_busy_loop(sk) && skb_queue_empty_lockless(&sk->sk_receive_queue) &&
+ (sk->sk_state == TCP_ESTABLISHED))
+ sk_busy_loop(sk, nonblock);
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index b76cf96d5cfe..bfec48849735 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -305,7 +305,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ inet->inet_daddr);
+ }
+
+- inet->inet_id = tp->write_seq ^ jiffies;
++ inet->inet_id = prandom_u32();
+
+ if (tcp_fastopen_defer_connect(sk, &err))
+ return err;
+@@ -1436,7 +1436,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
+ inet_csk(newsk)->icsk_ext_hdr_len = 0;
+ if (inet_opt)
+ inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
+- newinet->inet_id = newtp->write_seq ^ jiffies;
++ newinet->inet_id = prandom_u32();
+
+ if (!dst) {
+ dst = inet_csk_route_child_sock(sk, newsk, req);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index aa59acc8ee0e..8877bd140a0d 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -408,7 +408,7 @@ static int compute_score(struct sock *sk, struct net *net,
+ score += 4;
+ }
+
+- if (sk->sk_incoming_cpu == raw_smp_processor_id())
++ if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
+ score++;
+ return score;
+ }
+@@ -1270,6 +1270,20 @@ static void udp_set_dev_scratch(struct sk_buff *skb)
+ scratch->_tsize_state |= UDP_SKB_IS_STATELESS;
+ }
+
++static void udp_skb_csum_unnecessary_set(struct sk_buff *skb)
++{
++ /* We come here after udp_lib_checksum_complete() returned 0.
++ * This means that __skb_checksum_complete() might have
++ * set skb->csum_valid to 1.
++ * On 64bit platforms, we can set csum_unnecessary
++ * to true, but only if the skb is not shared.
++ */
++#if BITS_PER_LONG == 64
++ if (!skb_shared(skb))
++ udp_skb_scratch(skb)->csum_unnecessary = true;
++#endif
++}
++
+ static int udp_skb_truesize(struct sk_buff *skb)
+ {
+ return udp_skb_scratch(skb)->_tsize_state & ~UDP_SKB_IS_STATELESS;
+@@ -1504,10 +1518,7 @@ static struct sk_buff *__first_packet_length(struct sock *sk,
+ *total += skb->truesize;
+ kfree_skb(skb);
+ } else {
+- /* the csum related bits could be changed, refresh
+- * the scratch area
+- */
+- udp_set_dev_scratch(skb);
++ udp_skb_csum_unnecessary_set(skb);
+ break;
+ }
+ }
+@@ -1531,7 +1542,7 @@ static int first_packet_length(struct sock *sk)
+
+ spin_lock_bh(&rcvq->lock);
+ skb = __first_packet_length(sk, rcvq, &total);
+- if (!skb && !skb_queue_empty(sk_queue)) {
++ if (!skb && !skb_queue_empty_lockless(sk_queue)) {
+ spin_lock(&sk_queue->lock);
+ skb_queue_splice_tail_init(sk_queue, rcvq);
+ spin_unlock(&sk_queue->lock);
+@@ -1606,7 +1617,7 @@ struct sk_buff *__skb_recv_udp(struct sock *sk, unsigned int flags,
+ return skb;
+ }
+
+- if (skb_queue_empty(sk_queue)) {
++ if (skb_queue_empty_lockless(sk_queue)) {
+ spin_unlock_bh(&queue->lock);
+ goto busy_check;
+ }
+@@ -1633,7 +1644,7 @@ busy_check:
+ break;
+
+ sk_busy_loop(sk, flags & MSG_DONTWAIT);
+- } while (!skb_queue_empty(sk_queue));
++ } while (!skb_queue_empty_lockless(sk_queue));
+
+ /* sk_queue is empty, reader_queue may contain peeked packets */
+ } while (timeo &&
+@@ -2640,7 +2651,7 @@ __poll_t udp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ __poll_t mask = datagram_poll(file, sock, wait);
+ struct sock *sk = sock->sk;
+
+- if (!skb_queue_empty(&udp_sk(sk)->reader_queue))
++ if (!skb_queue_empty_lockless(&udp_sk(sk)->reader_queue))
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+ /* Check for false positives due to checksum errors */
+diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
+index 3d7c7460a0c5..91d6ea937ffb 100644
+--- a/net/ipv6/inet6_hashtables.c
++++ b/net/ipv6/inet6_hashtables.c
+@@ -118,7 +118,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
+ if (sk->sk_bound_dev_if)
+ score++;
+ }
+- if (sk->sk_incoming_cpu == raw_smp_processor_id())
++ if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
+ score++;
+ }
+ return score;
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index a23516e22056..dee4113f21a9 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1000,9 +1000,9 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ dsfield = key->tos;
+ if (!(tun_info->key.tun_flags & TUNNEL_ERSPAN_OPT))
+ goto tx_err;
+- md = ip_tunnel_info_opts(tun_info);
+- if (!md)
++ if (tun_info->options_len < sizeof(*md))
+ goto tx_err;
++ md = ip_tunnel_info_opts(tun_info);
+
+ tun_id = tunnel_id_to_key32(key->tun_id);
+ if (md->version == 1) {
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index d1c59cb6dceb..1979922bcf67 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -154,7 +154,7 @@ static int compute_score(struct sock *sk, struct net *net,
+ score++;
+ }
+
+- if (sk->sk_incoming_cpu == raw_smp_processor_id())
++ if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
+ score++;
+
+ return score;
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index e0a2cb8a029f..7d766350c08e 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -566,11 +566,11 @@ static __poll_t llcp_sock_poll(struct file *file, struct socket *sock,
+ if (sk->sk_state == LLCP_LISTEN)
+ return llcp_accept_poll(sk);
+
+- if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
++ if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
+ mask |= EPOLLERR |
+ (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
+
+- if (!skb_queue_empty(&sk->sk_receive_queue))
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+ if (sk->sk_state == LLCP_CLOSED)
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index 8e396c7c8389..c297fe8afdfe 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -1843,7 +1843,7 @@ static struct genl_family dp_datapath_genl_family __ro_after_init = {
+ /* Called with ovs_mutex or RCU read lock. */
+ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
+ struct net *net, u32 portid, u32 seq,
+- u32 flags, u8 cmd)
++ u32 flags, u8 cmd, gfp_t gfp)
+ {
+ struct ovs_header *ovs_header;
+ struct ovs_vport_stats vport_stats;
+@@ -1864,7 +1864,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
+ goto nla_put_failure;
+
+ if (!net_eq(net, dev_net(vport->dev))) {
+- int id = peernet2id_alloc(net, dev_net(vport->dev));
++ int id = peernet2id_alloc(net, dev_net(vport->dev), gfp);
+
+ if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id))
+ goto nla_put_failure;
+@@ -1905,11 +1905,12 @@ struct sk_buff *ovs_vport_cmd_build_info(struct vport *vport, struct net *net,
+ struct sk_buff *skb;
+ int retval;
+
+- skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
++ skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+ if (!skb)
+ return ERR_PTR(-ENOMEM);
+
+- retval = ovs_vport_cmd_fill_info(vport, skb, net, portid, seq, 0, cmd);
++ retval = ovs_vport_cmd_fill_info(vport, skb, net, portid, seq, 0, cmd,
++ GFP_KERNEL);
+ BUG_ON(retval < 0);
+
+ return skb;
+@@ -2042,7 +2043,7 @@ restart:
+
+ err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
+ info->snd_portid, info->snd_seq, 0,
+- OVS_VPORT_CMD_NEW);
++ OVS_VPORT_CMD_NEW, GFP_KERNEL);
+
+ if (netdev_get_fwd_headroom(vport->dev) > dp->max_headroom)
+ update_headroom(dp);
+@@ -2101,7 +2102,7 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
+
+ err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
+ info->snd_portid, info->snd_seq, 0,
+- OVS_VPORT_CMD_NEW);
++ OVS_VPORT_CMD_NEW, GFP_ATOMIC);
+ BUG_ON(err < 0);
+
+ ovs_unlock();
+@@ -2140,7 +2141,7 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)
+
+ err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
+ info->snd_portid, info->snd_seq, 0,
+- OVS_VPORT_CMD_DEL);
++ OVS_VPORT_CMD_DEL, GFP_KERNEL);
+ BUG_ON(err < 0);
+
+ /* the vport deletion may trigger dp headroom update */
+@@ -2182,7 +2183,7 @@ static int ovs_vport_cmd_get(struct sk_buff *skb, struct genl_info *info)
+ goto exit_unlock_free;
+ err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
+ info->snd_portid, info->snd_seq, 0,
+- OVS_VPORT_CMD_NEW);
++ OVS_VPORT_CMD_NEW, GFP_ATOMIC);
+ BUG_ON(err < 0);
+ rcu_read_unlock();
+
+@@ -2218,7 +2219,8 @@ static int ovs_vport_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
+ NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq,
+ NLM_F_MULTI,
+- OVS_VPORT_CMD_NEW) < 0)
++ OVS_VPORT_CMD_NEW,
++ GFP_ATOMIC) < 0)
+ goto out;
+
+ j++;
+diff --git a/net/phonet/socket.c b/net/phonet/socket.c
+index 30187990257f..1ae629544444 100644
+--- a/net/phonet/socket.c
++++ b/net/phonet/socket.c
+@@ -351,9 +351,9 @@ static __poll_t pn_socket_poll(struct file *file, struct socket *sock,
+
+ if (sk->sk_state == TCP_CLOSE)
+ return EPOLLERR;
+- if (!skb_queue_empty(&sk->sk_receive_queue))
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+ mask |= EPOLLIN | EPOLLRDNORM;
+- if (!skb_queue_empty(&pn->ctrlreq_queue))
++ if (!skb_queue_empty_lockless(&pn->ctrlreq_queue))
+ mask |= EPOLLPRI;
+ if (!mask && sk->sk_state == TCP_CLOSE_WAIT)
+ return EPOLLHUP;
+diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
+index a80fe8aa8527..c53b720674c6 100644
+--- a/net/sched/sch_hhf.c
++++ b/net/sched/sch_hhf.c
+@@ -4,11 +4,11 @@
+ * Copyright (C) 2013 Nandita Dukkipati <nanditad@google.com>
+ */
+
+-#include <linux/jhash.h>
+ #include <linux/jiffies.h>
+ #include <linux/module.h>
+ #include <linux/skbuff.h>
+ #include <linux/vmalloc.h>
++#include <linux/siphash.h>
+ #include <net/pkt_sched.h>
+ #include <net/sock.h>
+
+@@ -125,7 +125,7 @@ struct wdrr_bucket {
+
+ struct hhf_sched_data {
+ struct wdrr_bucket buckets[WDRR_BUCKET_CNT];
+- u32 perturbation; /* hash perturbation */
++ siphash_key_t perturbation; /* hash perturbation */
+ u32 quantum; /* psched_mtu(qdisc_dev(sch)); */
+ u32 drop_overlimit; /* number of times max qdisc packet
+ * limit was hit
+@@ -263,7 +263,7 @@ static enum wdrr_bucket_idx hhf_classify(struct sk_buff *skb, struct Qdisc *sch)
+ }
+
+ /* Get hashed flow-id of the skb. */
+- hash = skb_get_hash_perturb(skb, q->perturbation);
++ hash = skb_get_hash_perturb(skb, &q->perturbation);
+
+ /* Check if this packet belongs to an already established HH flow. */
+ flow_pos = hash & HHF_BIT_MASK;
+@@ -580,7 +580,7 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt,
+
+ sch->limit = 1000;
+ q->quantum = psched_mtu(qdisc_dev(sch));
+- q->perturbation = prandom_u32();
++ get_random_bytes(&q->perturbation, sizeof(q->perturbation));
+ INIT_LIST_HEAD(&q->new_buckets);
+ INIT_LIST_HEAD(&q->old_buckets);
+
+diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
+index 7cbdad8419b7..1aa95e761671 100644
+--- a/net/sched/sch_sfb.c
++++ b/net/sched/sch_sfb.c
+@@ -22,7 +22,7 @@
+ #include <linux/errno.h>
+ #include <linux/skbuff.h>
+ #include <linux/random.h>
+-#include <linux/jhash.h>
++#include <linux/siphash.h>
+ #include <net/ip.h>
+ #include <net/pkt_sched.h>
+ #include <net/pkt_cls.h>
+@@ -49,7 +49,7 @@ struct sfb_bucket {
+ * (Section 4.4 of SFB reference : moving hash functions)
+ */
+ struct sfb_bins {
+- u32 perturbation; /* jhash perturbation */
++ siphash_key_t perturbation; /* siphash key */
+ struct sfb_bucket bins[SFB_LEVELS][SFB_NUMBUCKETS];
+ };
+
+@@ -221,7 +221,8 @@ static u32 sfb_compute_qlen(u32 *prob_r, u32 *avgpm_r, const struct sfb_sched_da
+
+ static void sfb_init_perturbation(u32 slot, struct sfb_sched_data *q)
+ {
+- q->bins[slot].perturbation = prandom_u32();
++ get_random_bytes(&q->bins[slot].perturbation,
++ sizeof(q->bins[slot].perturbation));
+ }
+
+ static void sfb_swap_slot(struct sfb_sched_data *q)
+@@ -318,9 +319,9 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ /* If using external classifiers, get result and record it. */
+ if (!sfb_classify(skb, fl, &ret, &salt))
+ goto other_drop;
+- sfbhash = jhash_1word(salt, q->bins[slot].perturbation);
++ sfbhash = siphash_1u32(salt, &q->bins[slot].perturbation);
+ } else {
+- sfbhash = skb_get_hash_perturb(skb, q->bins[slot].perturbation);
++ sfbhash = skb_get_hash_perturb(skb, &q->bins[slot].perturbation);
+ }
+
+
+@@ -356,7 +357,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ /* Inelastic flow */
+ if (q->double_buffering) {
+ sfbhash = skb_get_hash_perturb(skb,
+- q->bins[slot].perturbation);
++ &q->bins[slot].perturbation);
+ if (!sfbhash)
+ sfbhash = 1;
+ sfb_skb_cb(skb)->hashes[slot] = sfbhash;
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index 650f21463853..d483d6ba59b7 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -18,7 +18,7 @@
+ #include <linux/errno.h>
+ #include <linux/init.h>
+ #include <linux/skbuff.h>
+-#include <linux/jhash.h>
++#include <linux/siphash.h>
+ #include <linux/slab.h>
+ #include <linux/vmalloc.h>
+ #include <net/netlink.h>
+@@ -121,7 +121,7 @@ struct sfq_sched_data {
+ u8 headdrop;
+ u8 maxdepth; /* limit of packets per flow */
+
+- u32 perturbation;
++ siphash_key_t perturbation;
+ u8 cur_depth; /* depth of longest slot */
+ u8 flags;
+ unsigned short scaled_quantum; /* SFQ_ALLOT_SIZE(quantum) */
+@@ -161,7 +161,7 @@ static inline struct sfq_head *sfq_dep_head(struct sfq_sched_data *q, sfq_index
+ static unsigned int sfq_hash(const struct sfq_sched_data *q,
+ const struct sk_buff *skb)
+ {
+- return skb_get_hash_perturb(skb, q->perturbation) & (q->divisor - 1);
++ return skb_get_hash_perturb(skb, &q->perturbation) & (q->divisor - 1);
+ }
+
+ static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch,
+@@ -611,9 +611,11 @@ static void sfq_perturbation(struct timer_list *t)
+ struct sfq_sched_data *q = from_timer(q, t, perturb_timer);
+ struct Qdisc *sch = q->sch;
+ spinlock_t *root_lock = qdisc_lock(qdisc_root_sleeping(sch));
++ siphash_key_t nkey;
+
++ get_random_bytes(&nkey, sizeof(nkey));
+ spin_lock(root_lock);
+- q->perturbation = prandom_u32();
++ q->perturbation = nkey;
+ if (!q->filter_list && q->tail)
+ sfq_rehash(sch);
+ spin_unlock(root_lock);
+@@ -692,7 +694,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
+ del_timer(&q->perturb_timer);
+ if (q->perturb_period) {
+ mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
+- q->perturbation = prandom_u32();
++ get_random_bytes(&q->perturbation, sizeof(q->perturbation));
+ }
+ sch_tree_unlock(sch);
+ kfree(p);
+@@ -749,7 +751,7 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt,
+ q->quantum = psched_mtu(qdisc_dev(sch));
+ q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum);
+ q->perturb_period = 0;
+- q->perturbation = prandom_u32();
++ get_random_bytes(&q->perturbation, sizeof(q->perturbation));
+
+ if (opt) {
+ int err = sfq_change(sch, opt);
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 227b050cfe45..c76631552722 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -7939,7 +7939,7 @@ __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ mask = 0;
+
+ /* Is there any exceptional events? */
+- if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
++ if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
+ mask |= EPOLLERR |
+ (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
+ if (sk->sk_shutdown & RCV_SHUTDOWN)
+@@ -7948,7 +7948,7 @@ __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ mask |= EPOLLHUP;
+
+ /* Is it readable? Reconsider this code with TCP-style support. */
+- if (!skb_queue_empty(&sk->sk_receive_queue))
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+ /* The association is either gone or not ready. */
+@@ -8334,7 +8334,7 @@ struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
+ if (sk_can_busy_loop(sk)) {
+ sk_busy_loop(sk, noblock);
+
+- if (!skb_queue_empty(&sk->sk_receive_queue))
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+ continue;
+ }
+
+@@ -8777,7 +8777,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
+ newinet->inet_rcv_saddr = inet->inet_rcv_saddr;
+ newinet->inet_dport = htons(asoc->peer.port);
+ newinet->pmtudisc = inet->pmtudisc;
+- newinet->inet_id = asoc->next_tsn ^ jiffies;
++ newinet->inet_id = prandom_u32();
+
+ newinet->uc_ttl = inet->uc_ttl;
+ newinet->mc_loop = 1;
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 6c91f1217dcf..5841d62ff580 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -731,7 +731,7 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
+ /* fall thru' */
+ case TIPC_LISTEN:
+ case TIPC_CONNECTING:
+- if (!skb_queue_empty(&sk->sk_receive_queue))
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+ revents |= EPOLLIN | EPOLLRDNORM;
+ break;
+ case TIPC_OPEN:
+@@ -739,7 +739,7 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
+ revents |= EPOLLOUT;
+ if (!tipc_sk_type_connectionless(sk))
+ break;
+- if (skb_queue_empty(&sk->sk_receive_queue))
++ if (skb_queue_empty_lockless(&sk->sk_receive_queue))
+ break;
+ revents |= EPOLLIN | EPOLLRDNORM;
+ break;
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index f601933ad728..231b6c032d2c 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -2661,7 +2661,7 @@ static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wa
+ mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
+
+ /* readable? */
+- if (!skb_queue_empty(&sk->sk_receive_queue))
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+ /* Connection-based need to check for termination and startup */
+@@ -2690,7 +2690,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
+ mask = 0;
+
+ /* exceptional events? */
+- if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
++ if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
+ mask |= EPOLLERR |
+ (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
+
+@@ -2700,7 +2700,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
+ mask |= EPOLLHUP;
+
+ /* readable? */
+- if (!skb_queue_empty(&sk->sk_receive_queue))
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+ /* Connection-based need to check for termination and startup */
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 2a4613b239e0..b2724fb06bbb 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -873,7 +873,7 @@ static __poll_t vsock_poll(struct file *file, struct socket *sock,
+ * the queue and write as long as the socket isn't shutdown for
+ * sending.
+ */
+- if (!skb_queue_empty(&sk->sk_receive_queue) ||
++ if (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
+ (sk->sk_shutdown & RCV_SHUTDOWN)) {
+ mask |= EPOLLIN | EPOLLRDNORM;
+ }
+diff --git a/net/wireless/Makefile b/net/wireless/Makefile
+index 1d84f91bbfb0..8158b375d170 100644
+--- a/net/wireless/Makefile
++++ b/net/wireless/Makefile
+@@ -38,6 +38,7 @@ $(obj)/extra-certs.c: $(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR:"%"=%) \
+ @(set -e; \
+ allf=""; \
+ for f in $^ ; do \
++ test -f $$f || continue;\
+ # similar to hexdump -v -e '1/1 "0x%.2x," "\n"' \
+ thisf=$$(od -An -v -tx1 < $$f | \
+ sed -e 's/ /\n/g' | \
+diff --git a/sound/soc/codecs/pcm3168a.c b/sound/soc/codecs/pcm3168a.c
+index e3de1ff3b6c2..439e40245bb0 100644
+--- a/sound/soc/codecs/pcm3168a.c
++++ b/sound/soc/codecs/pcm3168a.c
+@@ -24,8 +24,7 @@
+
+ #define PCM3168A_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | \
+ SNDRV_PCM_FMTBIT_S24_3LE | \
+- SNDRV_PCM_FMTBIT_S24_LE | \
+- SNDRV_PCM_FMTBIT_S32_LE)
++ SNDRV_PCM_FMTBIT_S24_LE)
+
+ #define PCM3168A_FMT_I2S 0x0
+ #define PCM3168A_FMT_LEFT_J 0x1
+diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
+index 6f5dac09cede..21e7c430baf7 100644
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -982,6 +982,16 @@ static int rt5682_set_jack_detect(struct snd_soc_component *component,
+ {
+ struct rt5682_priv *rt5682 = snd_soc_component_get_drvdata(component);
+
++ rt5682->hs_jack = hs_jack;
++
++ if (!hs_jack) {
++ regmap_update_bits(rt5682->regmap, RT5682_IRQ_CTRL_2,
++ RT5682_JD1_EN_MASK, RT5682_JD1_DIS);
++ regmap_update_bits(rt5682->regmap, RT5682_RC_CLK_CTRL,
++ RT5682_POW_JDH | RT5682_POW_JDL, 0);
++ return 0;
++ }
++
+ switch (rt5682->pdata.jd_src) {
+ case RT5682_JD1:
+ snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_2,
+@@ -1019,8 +1029,6 @@ static int rt5682_set_jack_detect(struct snd_soc_component *component,
+ break;
+ }
+
+- rt5682->hs_jack = hs_jack;
+-
+ return 0;
+ }
+
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 14f1b0c0d286..01acb8da2f48 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -537,13 +537,10 @@ static SOC_ENUM_SINGLE_DECL(dac_osr,
+ static SOC_ENUM_SINGLE_DECL(adc_osr,
+ WM8994_OVERSAMPLING, 1, osr_text);
+
+-static const struct snd_kcontrol_new wm8994_snd_controls[] = {
++static const struct snd_kcontrol_new wm8994_common_snd_controls[] = {
+ SOC_DOUBLE_R_TLV("AIF1ADC1 Volume", WM8994_AIF1_ADC1_LEFT_VOLUME,
+ WM8994_AIF1_ADC1_RIGHT_VOLUME,
+ 1, 119, 0, digital_tlv),
+-SOC_DOUBLE_R_TLV("AIF1ADC2 Volume", WM8994_AIF1_ADC2_LEFT_VOLUME,
+- WM8994_AIF1_ADC2_RIGHT_VOLUME,
+- 1, 119, 0, digital_tlv),
+ SOC_DOUBLE_R_TLV("AIF2ADC Volume", WM8994_AIF2_ADC_LEFT_VOLUME,
+ WM8994_AIF2_ADC_RIGHT_VOLUME,
+ 1, 119, 0, digital_tlv),
+@@ -560,8 +557,6 @@ SOC_ENUM("AIF2DACR Source", aif2dacr_src),
+
+ SOC_DOUBLE_R_TLV("AIF1DAC1 Volume", WM8994_AIF1_DAC1_LEFT_VOLUME,
+ WM8994_AIF1_DAC1_RIGHT_VOLUME, 1, 96, 0, digital_tlv),
+-SOC_DOUBLE_R_TLV("AIF1DAC2 Volume", WM8994_AIF1_DAC2_LEFT_VOLUME,
+- WM8994_AIF1_DAC2_RIGHT_VOLUME, 1, 96, 0, digital_tlv),
+ SOC_DOUBLE_R_TLV("AIF2DAC Volume", WM8994_AIF2_DAC_LEFT_VOLUME,
+ WM8994_AIF2_DAC_RIGHT_VOLUME, 1, 96, 0, digital_tlv),
+
+@@ -569,17 +564,12 @@ SOC_SINGLE_TLV("AIF1 Boost Volume", WM8994_AIF1_CONTROL_2, 10, 3, 0, aif_tlv),
+ SOC_SINGLE_TLV("AIF2 Boost Volume", WM8994_AIF2_CONTROL_2, 10, 3, 0, aif_tlv),
+
+ SOC_SINGLE("AIF1DAC1 EQ Switch", WM8994_AIF1_DAC1_EQ_GAINS_1, 0, 1, 0),
+-SOC_SINGLE("AIF1DAC2 EQ Switch", WM8994_AIF1_DAC2_EQ_GAINS_1, 0, 1, 0),
+ SOC_SINGLE("AIF2 EQ Switch", WM8994_AIF2_EQ_GAINS_1, 0, 1, 0),
+
+ WM8994_DRC_SWITCH("AIF1DAC1 DRC Switch", WM8994_AIF1_DRC1_1, 2),
+ WM8994_DRC_SWITCH("AIF1ADC1L DRC Switch", WM8994_AIF1_DRC1_1, 1),
+ WM8994_DRC_SWITCH("AIF1ADC1R DRC Switch", WM8994_AIF1_DRC1_1, 0),
+
+-WM8994_DRC_SWITCH("AIF1DAC2 DRC Switch", WM8994_AIF1_DRC2_1, 2),
+-WM8994_DRC_SWITCH("AIF1ADC2L DRC Switch", WM8994_AIF1_DRC2_1, 1),
+-WM8994_DRC_SWITCH("AIF1ADC2R DRC Switch", WM8994_AIF1_DRC2_1, 0),
+-
+ WM8994_DRC_SWITCH("AIF2DAC DRC Switch", WM8994_AIF2_DRC_1, 2),
+ WM8994_DRC_SWITCH("AIF2ADCL DRC Switch", WM8994_AIF2_DRC_1, 1),
+ WM8994_DRC_SWITCH("AIF2ADCR DRC Switch", WM8994_AIF2_DRC_1, 0),
+@@ -598,9 +588,6 @@ SOC_SINGLE("Sidetone HPF Switch", WM8994_SIDETONE, 6, 1, 0),
+ SOC_ENUM("AIF1ADC1 HPF Mode", aif1adc1_hpf),
+ SOC_DOUBLE("AIF1ADC1 HPF Switch", WM8994_AIF1_ADC1_FILTERS, 12, 11, 1, 0),
+
+-SOC_ENUM("AIF1ADC2 HPF Mode", aif1adc2_hpf),
+-SOC_DOUBLE("AIF1ADC2 HPF Switch", WM8994_AIF1_ADC2_FILTERS, 12, 11, 1, 0),
+-
+ SOC_ENUM("AIF2ADC HPF Mode", aif2adc_hpf),
+ SOC_DOUBLE("AIF2ADC HPF Switch", WM8994_AIF2_ADC_FILTERS, 12, 11, 1, 0),
+
+@@ -641,6 +628,24 @@ SOC_SINGLE("AIF2DAC 3D Stereo Switch", WM8994_AIF2_DAC_FILTERS_2,
+ 8, 1, 0),
+ };
+
++/* Controls not available on WM1811 */
++static const struct snd_kcontrol_new wm8994_snd_controls[] = {
++SOC_DOUBLE_R_TLV("AIF1ADC2 Volume", WM8994_AIF1_ADC2_LEFT_VOLUME,
++ WM8994_AIF1_ADC2_RIGHT_VOLUME,
++ 1, 119, 0, digital_tlv),
++SOC_DOUBLE_R_TLV("AIF1DAC2 Volume", WM8994_AIF1_DAC2_LEFT_VOLUME,
++ WM8994_AIF1_DAC2_RIGHT_VOLUME, 1, 96, 0, digital_tlv),
++
++SOC_SINGLE("AIF1DAC2 EQ Switch", WM8994_AIF1_DAC2_EQ_GAINS_1, 0, 1, 0),
++
++WM8994_DRC_SWITCH("AIF1DAC2 DRC Switch", WM8994_AIF1_DRC2_1, 2),
++WM8994_DRC_SWITCH("AIF1ADC2L DRC Switch", WM8994_AIF1_DRC2_1, 1),
++WM8994_DRC_SWITCH("AIF1ADC2R DRC Switch", WM8994_AIF1_DRC2_1, 0),
++
++SOC_ENUM("AIF1ADC2 HPF Mode", aif1adc2_hpf),
++SOC_DOUBLE("AIF1ADC2 HPF Switch", WM8994_AIF1_ADC2_FILTERS, 12, 11, 1, 0),
++};
++
+ static const struct snd_kcontrol_new wm8994_eq_controls[] = {
+ SOC_SINGLE_TLV("AIF1DAC1 EQ1 Volume", WM8994_AIF1_DAC1_EQ_GAINS_1, 11, 31, 0,
+ eq_tlv),
+@@ -4262,13 +4267,15 @@ static int wm8994_component_probe(struct snd_soc_component *component)
+ wm8994_handle_pdata(wm8994);
+
+ wm_hubs_add_analogue_controls(component);
+- snd_soc_add_component_controls(component, wm8994_snd_controls,
+- ARRAY_SIZE(wm8994_snd_controls));
++ snd_soc_add_component_controls(component, wm8994_common_snd_controls,
++ ARRAY_SIZE(wm8994_common_snd_controls));
+ snd_soc_dapm_new_controls(dapm, wm8994_dapm_widgets,
+ ARRAY_SIZE(wm8994_dapm_widgets));
+
+ switch (control->type) {
+ case WM8994:
++ snd_soc_add_component_controls(component, wm8994_snd_controls,
++ ARRAY_SIZE(wm8994_snd_controls));
+ snd_soc_dapm_new_controls(dapm, wm8994_specific_dapm_widgets,
+ ARRAY_SIZE(wm8994_specific_dapm_widgets));
+ if (control->revision < 4) {
+@@ -4288,8 +4295,10 @@ static int wm8994_component_probe(struct snd_soc_component *component)
+ }
+ break;
+ case WM8958:
++ snd_soc_add_component_controls(component, wm8994_snd_controls,
++ ARRAY_SIZE(wm8994_snd_controls));
+ snd_soc_add_component_controls(component, wm8958_snd_controls,
+- ARRAY_SIZE(wm8958_snd_controls));
++ ARRAY_SIZE(wm8958_snd_controls));
+ snd_soc_dapm_new_controls(dapm, wm8958_dapm_widgets,
+ ARRAY_SIZE(wm8958_dapm_widgets));
+ if (control->revision < 1) {
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index ee85056a8577..b114fc7b2a95 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -1147,8 +1147,7 @@ static unsigned int wmfw_convert_flags(unsigned int in, unsigned int len)
+ }
+
+ if (in) {
+- if (in & WMFW_CTL_FLAG_READABLE)
+- out |= rd;
++ out |= rd;
+ if (in & WMFW_CTL_FLAG_WRITEABLE)
+ out |= wr;
+ if (in & WMFW_CTL_FLAG_VOLATILE)
+diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
+index 11399f81c92f..b86f76c3598c 100644
+--- a/sound/soc/rockchip/rockchip_i2s.c
++++ b/sound/soc/rockchip/rockchip_i2s.c
+@@ -677,7 +677,7 @@ static int rockchip_i2s_probe(struct platform_device *pdev)
+ ret = rockchip_pcm_platform_register(&pdev->dev);
+ if (ret) {
+ dev_err(&pdev->dev, "Could not register PCM\n");
+- return ret;
++ goto err_suspend;
+ }
+
+ return 0;
+diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
+index 763c2edf52e7..1452e5153c60 100644
+--- a/tools/perf/builtin-c2c.c
++++ b/tools/perf/builtin-c2c.c
+@@ -2626,6 +2626,7 @@ static int build_cl_output(char *cl_sort, bool no_source)
+ bool add_sym = false;
+ bool add_dso = false;
+ bool add_src = false;
++ int ret = 0;
+
+ if (!buf)
+ return -ENOMEM;
+@@ -2644,7 +2645,8 @@ static int build_cl_output(char *cl_sort, bool no_source)
+ add_dso = true;
+ } else if (strcmp(tok, "offset")) {
+ pr_err("unrecognized sort token: %s\n", tok);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err;
+ }
+ }
+
+@@ -2667,13 +2669,15 @@ static int build_cl_output(char *cl_sort, bool no_source)
+ add_sym ? "symbol," : "",
+ add_dso ? "dso," : "",
+ add_src ? "cl_srcline," : "",
+- "node") < 0)
+- return -ENOMEM;
++ "node") < 0) {
++ ret = -ENOMEM;
++ goto err;
++ }
+
+ c2c.show_src = add_src;
+-
++err:
+ free(buf);
+- return 0;
++ return ret;
+ }
+
+ static int setup_coalesce(const char *coalesce, bool no_source)
+diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c
+index b63bca4b0c2a..56dd5d1476e0 100644
+--- a/tools/perf/builtin-kmem.c
++++ b/tools/perf/builtin-kmem.c
+@@ -686,6 +686,7 @@ static char *compact_gfp_flags(char *gfp_flags)
+ new = realloc(new_flags, len + strlen(cpt) + 2);
+ if (new == NULL) {
+ free(new_flags);
++ free(orig_flags);
+ return NULL;
+ }
+
+diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
+index 2f190aa8fc5f..c0885fb65767 100755
+--- a/tools/testing/selftests/net/fib_tests.sh
++++ b/tools/testing/selftests/net/fib_tests.sh
+@@ -1301,6 +1301,27 @@ ipv4_addr_metric_test()
+ fi
+ log_test $rc 0 "Prefix route with metric on link up"
+
++ # explicitly check for metric changes on edge scenarios
++ run_cmd "$IP addr flush dev dummy2"
++ run_cmd "$IP addr add dev dummy2 172.16.104.0/24 metric 259"
++ run_cmd "$IP addr change dev dummy2 172.16.104.0/24 metric 260"
++ rc=$?
++ if [ $rc -eq 0 ]; then
++ check_route "172.16.104.0/24 dev dummy2 proto kernel scope link src 172.16.104.0 metric 260"
++ rc=$?
++ fi
++ log_test $rc 0 "Modify metric of .0/24 address"
++
++ run_cmd "$IP addr flush dev dummy2"
++ run_cmd "$IP addr add dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 260"
++ run_cmd "$IP addr change dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 261"
++ rc=$?
++ if [ $rc -eq 0 ]; then
++ check_route "172.16.104.2 dev dummy2 proto kernel scope link src 172.16.104.1 metric 261"
++ rc=$?
++ fi
++ log_test $rc 0 "Modify metric of address with peer route"
++
+ $IP li del dummy1
+ $IP li del dummy2
+ cleanup
+diff --git a/tools/testing/selftests/net/reuseport_dualstack.c b/tools/testing/selftests/net/reuseport_dualstack.c
+index fe3230c55986..fb7a59ed759e 100644
+--- a/tools/testing/selftests/net/reuseport_dualstack.c
++++ b/tools/testing/selftests/net/reuseport_dualstack.c
+@@ -129,7 +129,7 @@ static void test(int *rcv_fds, int count, int proto)
+ {
+ struct epoll_event ev;
+ int epfd, i, test_fd;
+- uint16_t test_family;
++ int test_family;
+ socklen_t len;
+
+ epfd = epoll_create(1);
+@@ -146,6 +146,7 @@ static void test(int *rcv_fds, int count, int proto)
+ send_from_v4(proto);
+
+ test_fd = receive_once(epfd, proto);
++ len = sizeof(test_family);
+ if (getsockopt(test_fd, SOL_SOCKET, SO_DOMAIN, &test_family, &len))
+ error(1, errno, "failed to read socket domain");
+ if (test_family != AF_INET)
+diff --git a/tools/testing/selftests/powerpc/mm/Makefile b/tools/testing/selftests/powerpc/mm/Makefile
+index 33ced6e0ad25..869628234d54 100644
+--- a/tools/testing/selftests/powerpc/mm/Makefile
++++ b/tools/testing/selftests/powerpc/mm/Makefile
+@@ -3,6 +3,7 @@ noarg:
+ $(MAKE) -C ../
+
+ TEST_GEN_PROGS := hugetlb_vs_thp_test subpage_prot prot_sao segv_errors
++TEST_GEN_PROGS_EXTENDED := tlbie_test
+ TEST_GEN_FILES := tempfile
+
+ top_srcdir = ../../../../..
+@@ -15,3 +16,4 @@ $(OUTPUT)/prot_sao: ../utils.c
+ $(OUTPUT)/tempfile:
+ dd if=/dev/zero of=$@ bs=64k count=1
+
++$(OUTPUT)/tlbie_test: LDLIBS += -lpthread
+diff --git a/tools/testing/selftests/powerpc/mm/tlbie_test.c b/tools/testing/selftests/powerpc/mm/tlbie_test.c
+new file mode 100644
+index 000000000000..f85a0938ab25
+--- /dev/null
++++ b/tools/testing/selftests/powerpc/mm/tlbie_test.c
+@@ -0,0 +1,734 @@
++// SPDX-License-Identifier: GPL-2.0
++
++/*
++ * Copyright 2019, Nick Piggin, Gautham R. Shenoy, Aneesh Kumar K.V, IBM Corp.
++ */
++
++/*
++ *
++ * Test tlbie/mtpidr race. We have 4 threads doing flush/load/compare/store
++ * sequence in a loop. The same threads also rung a context switch task
++ * that does sched_yield() in loop.
++ *
++ * The snapshot thread mark the mmap area PROT_READ in between, make a copy
++ * and copy it back to the original area. This helps us to detect if any
++ * store continued to happen after we marked the memory PROT_READ.
++ */
++
++#define _GNU_SOURCE
++#include <stdio.h>
++#include <sys/mman.h>
++#include <sys/types.h>
++#include <sys/wait.h>
++#include <sys/ipc.h>
++#include <sys/shm.h>
++#include <sys/stat.h>
++#include <sys/time.h>
++#include <linux/futex.h>
++#include <unistd.h>
++#include <asm/unistd.h>
++#include <string.h>
++#include <stdlib.h>
++#include <fcntl.h>
++#include <sched.h>
++#include <time.h>
++#include <stdarg.h>
++#include <sched.h>
++#include <pthread.h>
++#include <signal.h>
++#include <sys/prctl.h>
++
++static inline void dcbf(volatile unsigned int *addr)
++{
++ __asm__ __volatile__ ("dcbf %y0; sync" : : "Z"(*(unsigned char *)addr) : "memory");
++}
++
++static void err_msg(char *msg)
++{
++
++ time_t now;
++ time(&now);
++ printf("=================================\n");
++ printf(" Error: %s\n", msg);
++ printf(" %s", ctime(&now));
++ printf("=================================\n");
++ exit(1);
++}
++
++static char *map1;
++static char *map2;
++static pid_t rim_process_pid;
++
++/*
++ * A "rim-sequence" is defined to be the sequence of the following
++ * operations performed on a memory word:
++ * 1) FLUSH the contents of that word.
++ * 2) LOAD the contents of that word.
++ * 3) COMPARE the contents of that word with the content that was
++ * previously stored at that word
++ * 4) STORE new content into that word.
++ *
++ * The threads in this test that perform the rim-sequence are termed
++ * as rim_threads.
++ */
++
++/*
++ * A "corruption" is defined to be the failed COMPARE operation in a
++ * rim-sequence.
++ *
++ * A rim_thread that detects a corruption informs about it to all the
++ * other rim_threads, and the mem_snapshot thread.
++ */
++static volatile unsigned int corruption_found;
++
++/*
++ * This defines the maximum number of rim_threads in this test.
++ *
++ * The THREAD_ID_BITS denote the number of bits required
++ * to represent the thread_ids [0..MAX_THREADS - 1].
++ * We are being a bit paranoid here and set it to 8 bits,
++ * though 6 bits suffice.
++ *
++ */
++#define MAX_THREADS 64
++#define THREAD_ID_BITS 8
++#define THREAD_ID_MASK ((1 << THREAD_ID_BITS) - 1)
++static unsigned int rim_thread_ids[MAX_THREADS];
++static pthread_t rim_threads[MAX_THREADS];
++
++
++/*
++ * Each rim_thread works on an exclusive "chunk" of size
++ * RIM_CHUNK_SIZE.
++ *
++ * The ith rim_thread works on the ith chunk.
++ *
++ * The ith chunk begins at
++ * map1 + (i * RIM_CHUNK_SIZE)
++ */
++#define RIM_CHUNK_SIZE 1024
++#define BITS_PER_BYTE 8
++#define WORD_SIZE (sizeof(unsigned int))
++#define WORD_BITS (WORD_SIZE * BITS_PER_BYTE)
++#define WORDS_PER_CHUNK (RIM_CHUNK_SIZE/WORD_SIZE)
++
++static inline char *compute_chunk_start_addr(unsigned int thread_id)
++{
++ char *chunk_start;
++
++ chunk_start = (char *)((unsigned long)map1 +
++ (thread_id * RIM_CHUNK_SIZE));
++
++ return chunk_start;
++}
++
++/*
++ * The "word-offset" of a word-aligned address inside a chunk, is
++ * defined to be the number of words that precede the address in that
++ * chunk.
++ *
++ * WORD_OFFSET_BITS denote the number of bits required to represent
++ * the word-offsets of all the word-aligned addresses of a chunk.
++ */
++#define WORD_OFFSET_BITS (__builtin_ctz(WORDS_PER_CHUNK))
++#define WORD_OFFSET_MASK ((1 << WORD_OFFSET_BITS) - 1)
++
++static inline unsigned int compute_word_offset(char *start, unsigned int *addr)
++{
++ unsigned int delta_bytes, ret;
++ delta_bytes = (unsigned long)addr - (unsigned long)start;
++
++ ret = delta_bytes/WORD_SIZE;
++
++ return ret;
++}
++
++/*
++ * A "sweep" is defined to be the sequential execution of the
++ * rim-sequence by a rim_thread on its chunk one word at a time,
++ * starting from the first word of its chunk and ending with the last
++ * word of its chunk.
++ *
++ * Each sweep of a rim_thread is uniquely identified by a sweep_id.
++ * SWEEP_ID_BITS denote the number of bits required to represent
++ * the sweep_ids of rim_threads.
++ *
++ * As to why SWEEP_ID_BITS are computed as a function of THREAD_ID_BITS,
++ * WORD_OFFSET_BITS, and WORD_BITS, see the "store-pattern" below.
++ */
++#define SWEEP_ID_BITS (WORD_BITS - (THREAD_ID_BITS + WORD_OFFSET_BITS))
++#define SWEEP_ID_MASK ((1 << SWEEP_ID_BITS) - 1)
++
++/*
++ * A "store-pattern" is the word-pattern that is stored into a word
++ * location in the 4)STORE step of the rim-sequence.
++ *
++ * In the store-pattern, we shall encode:
++ *
++ * - The thread-id of the rim_thread performing the store
++ * (The most significant THREAD_ID_BITS)
++ *
++ * - The word-offset of the address into which the store is being
++ * performed (The next WORD_OFFSET_BITS)
++ *
++ * - The sweep_id of the current sweep in which the store is
++ * being performed. (The lower SWEEP_ID_BITS)
++ *
++ * Store Pattern: 32 bits
++ * |------------------|--------------------|---------------------------------|
++ * | Thread id | Word offset | sweep_id |
++ * |------------------|--------------------|---------------------------------|
++ * THREAD_ID_BITS WORD_OFFSET_BITS SWEEP_ID_BITS
++ *
++ * In the store pattern, the (Thread-id + Word-offset) uniquely identify the
++ * address to which the store is being performed i.e,
++ * address == map1 +
++ * (Thread-id * RIM_CHUNK_SIZE) + (Word-offset * WORD_SIZE)
++ *
++ * And the sweep_id in the store pattern identifies the time when the
++ * store was performed by the rim_thread.
++ *
++ * We shall use this property in the 3)COMPARE step of the
++ * rim-sequence.
++ */
++#define SWEEP_ID_SHIFT 0
++#define WORD_OFFSET_SHIFT (SWEEP_ID_BITS)
++#define THREAD_ID_SHIFT (WORD_OFFSET_BITS + SWEEP_ID_BITS)
++
++/*
++ * Compute the store pattern for a given thread with id @tid, at
++ * location @addr in the sweep identified by @sweep_id
++ */
++static inline unsigned int compute_store_pattern(unsigned int tid,
++ unsigned int *addr,
++ unsigned int sweep_id)
++{
++ unsigned int ret = 0;
++ char *start = compute_chunk_start_addr(tid);
++ unsigned int word_offset = compute_word_offset(start, addr);
++
++ ret += (tid & THREAD_ID_MASK) << THREAD_ID_SHIFT;
++ ret += (word_offset & WORD_OFFSET_MASK) << WORD_OFFSET_SHIFT;
++ ret += (sweep_id & SWEEP_ID_MASK) << SWEEP_ID_SHIFT;
++ return ret;
++}
++
++/* Extract the thread-id from the given store-pattern */
++static inline unsigned int extract_tid(unsigned int pattern)
++{
++ unsigned int ret;
++
++ ret = (pattern >> THREAD_ID_SHIFT) & THREAD_ID_MASK;
++ return ret;
++}
++
++/* Extract the word-offset from the given store-pattern */
++static inline unsigned int extract_word_offset(unsigned int pattern)
++{
++ unsigned int ret;
++
++ ret = (pattern >> WORD_OFFSET_SHIFT) & WORD_OFFSET_MASK;
++
++ return ret;
++}
++
++/* Extract the sweep-id from the given store-pattern */
++static inline unsigned int extract_sweep_id(unsigned int pattern)
++
++{
++ unsigned int ret;
++
++ ret = (pattern >> SWEEP_ID_SHIFT) & SWEEP_ID_MASK;
++
++ return ret;
++}
++
++/************************************************************
++ * *
++ * Logging the output of the verification *
++ * *
++ ************************************************************/
++#define LOGDIR_NAME_SIZE 100
++static char logdir[LOGDIR_NAME_SIZE];
++
++static FILE *fp[MAX_THREADS];
++static const char logfilename[] ="Thread-%02d-Chunk";
++
++static inline void start_verification_log(unsigned int tid,
++ unsigned int *addr,
++ unsigned int cur_sweep_id,
++ unsigned int prev_sweep_id)
++{
++ FILE *f;
++ char logfile[30];
++ char path[LOGDIR_NAME_SIZE + 30];
++ char separator[2] = "/";
++ char *chunk_start = compute_chunk_start_addr(tid);
++ unsigned int size = RIM_CHUNK_SIZE;
++
++ sprintf(logfile, logfilename, tid);
++ strcpy(path, logdir);
++ strcat(path, separator);
++ strcat(path, logfile);
++ f = fopen(path, "w");
++
++ if (!f) {
++ err_msg("Unable to create logfile\n");
++ }
++
++ fp[tid] = f;
++
++ fprintf(f, "----------------------------------------------------------\n");
++ fprintf(f, "PID = %d\n", rim_process_pid);
++ fprintf(f, "Thread id = %02d\n", tid);
++ fprintf(f, "Chunk Start Addr = 0x%016lx\n", (unsigned long)chunk_start);
++ fprintf(f, "Chunk Size = %d\n", size);
++ fprintf(f, "Next Store Addr = 0x%016lx\n", (unsigned long)addr);
++ fprintf(f, "Current sweep-id = 0x%08x\n", cur_sweep_id);
++ fprintf(f, "Previous sweep-id = 0x%08x\n", prev_sweep_id);
++ fprintf(f, "----------------------------------------------------------\n");
++}
++
++static inline void log_anamoly(unsigned int tid, unsigned int *addr,
++ unsigned int expected, unsigned int observed)
++{
++ FILE *f = fp[tid];
++
++ fprintf(f, "Thread %02d: Addr 0x%lx: Expected 0x%x, Observed 0x%x\n",
++ tid, (unsigned long)addr, expected, observed);
++ fprintf(f, "Thread %02d: Expected Thread id = %02d\n", tid, extract_tid(expected));
++ fprintf(f, "Thread %02d: Observed Thread id = %02d\n", tid, extract_tid(observed));
++ fprintf(f, "Thread %02d: Expected Word offset = %03d\n", tid, extract_word_offset(expected));
++ fprintf(f, "Thread %02d: Observed Word offset = %03d\n", tid, extract_word_offset(observed));
++ fprintf(f, "Thread %02d: Expected sweep-id = 0x%x\n", tid, extract_sweep_id(expected));
++ fprintf(f, "Thread %02d: Observed sweep-id = 0x%x\n", tid, extract_sweep_id(observed));
++ fprintf(f, "----------------------------------------------------------\n");
++}
++
++static inline void end_verification_log(unsigned int tid, unsigned nr_anamolies)
++{
++ FILE *f = fp[tid];
++ char logfile[30];
++ char path[LOGDIR_NAME_SIZE + 30];
++ char separator[] = "/";
++
++ fclose(f);
++
++ if (nr_anamolies == 0) {
++ remove(path);
++ return;
++ }
++
++ sprintf(logfile, logfilename, tid);
++ strcpy(path, logdir);
++ strcat(path, separator);
++ strcat(path, logfile);
++
++ printf("Thread %02d chunk has %d corrupted words. For details check %s\n",
++ tid, nr_anamolies, path);
++}
++
++/*
++ * When a COMPARE step of a rim-sequence fails, the rim_thread informs
++ * everyone else via the shared_memory pointed to by
++ * corruption_found variable. On seeing this, every thread verifies the
++ * content of its chunk as follows.
++ *
++ * Suppose a thread identified with @tid was about to store (but not
++ * yet stored) to @next_store_addr in its current sweep identified
++ * @cur_sweep_id. Let @prev_sweep_id indicate the previous sweep_id.
++ *
++ * This implies that for all the addresses @addr < @next_store_addr,
++ * Thread @tid has already performed a store as part of its current
++ * sweep. Hence we expect the content of such @addr to be:
++ * |-------------------------------------------------|
++ * | tid | word_offset(addr) | cur_sweep_id |
++ * |-------------------------------------------------|
++ *
++ * Since Thread @tid is yet to perform stores on address
++ * @next_store_addr and above, we expect the content of such an
++ * address @addr to be:
++ * |-------------------------------------------------|
++ * | tid | word_offset(addr) | prev_sweep_id |
++ * |-------------------------------------------------|
++ *
++ * The verifier function @verify_chunk does this verification and logs
++ * any anamolies that it finds.
++ */
++static void verify_chunk(unsigned int tid, unsigned int *next_store_addr,
++ unsigned int cur_sweep_id,
++ unsigned int prev_sweep_id)
++{
++ unsigned int *iter_ptr;
++ unsigned int size = RIM_CHUNK_SIZE;
++ unsigned int expected;
++ unsigned int observed;
++ char *chunk_start = compute_chunk_start_addr(tid);
++
++ int nr_anamolies = 0;
++
++ start_verification_log(tid, next_store_addr,
++ cur_sweep_id, prev_sweep_id);
++
++ for (iter_ptr = (unsigned int *)chunk_start;
++ (unsigned long)iter_ptr < (unsigned long)chunk_start + size;
++ iter_ptr++) {
++ unsigned int expected_sweep_id;
++
++ if (iter_ptr < next_store_addr) {
++ expected_sweep_id = cur_sweep_id;
++ } else {
++ expected_sweep_id = prev_sweep_id;
++ }
++
++ expected = compute_store_pattern(tid, iter_ptr, expected_sweep_id);
++
++ dcbf((volatile unsigned int*)iter_ptr); //Flush before reading
++ observed = *iter_ptr;
++
++ if (observed != expected) {
++ nr_anamolies++;
++ log_anamoly(tid, iter_ptr, expected, observed);
++ }
++ }
++
++ end_verification_log(tid, nr_anamolies);
++}
++
++static void set_pthread_cpu(pthread_t th, int cpu)
++{
++ cpu_set_t run_cpu_mask;
++ struct sched_param param;
++
++ CPU_ZERO(&run_cpu_mask);
++ CPU_SET(cpu, &run_cpu_mask);
++ pthread_setaffinity_np(th, sizeof(cpu_set_t), &run_cpu_mask);
++
++ param.sched_priority = 1;
++ if (0 && sched_setscheduler(0, SCHED_FIFO, ¶m) == -1) {
++ /* haven't reproduced with this setting, it kills random preemption which may be a factor */
++ fprintf(stderr, "could not set SCHED_FIFO, run as root?\n");
++ }
++}
++
++static void set_mycpu(int cpu)
++{
++ cpu_set_t run_cpu_mask;
++ struct sched_param param;
++
++ CPU_ZERO(&run_cpu_mask);
++ CPU_SET(cpu, &run_cpu_mask);
++ sched_setaffinity(0, sizeof(cpu_set_t), &run_cpu_mask);
++
++ param.sched_priority = 1;
++ if (0 && sched_setscheduler(0, SCHED_FIFO, ¶m) == -1) {
++ fprintf(stderr, "could not set SCHED_FIFO, run as root?\n");
++ }
++}
++
++static volatile int segv_wait;
++
++static void segv_handler(int signo, siginfo_t *info, void *extra)
++{
++ while (segv_wait) {
++ sched_yield();
++ }
++
++}
++
++static void set_segv_handler(void)
++{
++ struct sigaction sa;
++
++ sa.sa_flags = SA_SIGINFO;
++ sa.sa_sigaction = segv_handler;
++
++ if (sigaction(SIGSEGV, &sa, NULL) == -1) {
++ perror("sigaction");
++ exit(EXIT_FAILURE);
++ }
++}
++
++int timeout = 0;
++/*
++ * This function is executed by every rim_thread.
++ *
++ * This function performs sweeps over the exclusive chunks of the
++ * rim_threads executing the rim-sequence one word at a time.
++ */
++static void *rim_fn(void *arg)
++{
++ unsigned int tid = *((unsigned int *)arg);
++
++ int size = RIM_CHUNK_SIZE;
++ char *chunk_start = compute_chunk_start_addr(tid);
++
++ unsigned int prev_sweep_id;
++ unsigned int cur_sweep_id = 0;
++
++ /* word access */
++ unsigned int pattern = cur_sweep_id;
++ unsigned int *pattern_ptr = &pattern;
++ unsigned int *w_ptr, read_data;
++
++ set_segv_handler();
++
++ /*
++ * Let us initialize the chunk:
++ *
++ * Each word-aligned address addr in the chunk,
++ * is initialized to :
++ * |-------------------------------------------------|
++ * | tid | word_offset(addr) | 0 |
++ * |-------------------------------------------------|
++ */
++ for (w_ptr = (unsigned int *)chunk_start;
++ (unsigned long)w_ptr < (unsigned long)(chunk_start) + size;
++ w_ptr++) {
++
++ *pattern_ptr = compute_store_pattern(tid, w_ptr, cur_sweep_id);
++ *w_ptr = *pattern_ptr;
++ }
++
++ while (!corruption_found && !timeout) {
++ prev_sweep_id = cur_sweep_id;
++ cur_sweep_id = cur_sweep_id + 1;
++
++ for (w_ptr = (unsigned int *)chunk_start;
++ (unsigned long)w_ptr < (unsigned long)(chunk_start) + size;
++ w_ptr++) {
++ unsigned int old_pattern;
++
++ /*
++ * Compute the pattern that we would have
++ * stored at this location in the previous
++ * sweep.
++ */
++ old_pattern = compute_store_pattern(tid, w_ptr, prev_sweep_id);
++
++ /*
++ * FLUSH:Ensure that we flush the contents of
++ * the cache before loading
++ */
++ dcbf((volatile unsigned int*)w_ptr); //Flush
++
++ /* LOAD: Read the value */
++ read_data = *w_ptr; //Load
++
++ /*
++ * COMPARE: Is it the same as what we had stored
++ * in the previous sweep ? It better be!
++ */
++ if (read_data != old_pattern) {
++ /* No it isn't! Tell everyone */
++ corruption_found = 1;
++ }
++
++ /*
++ * Before performing a store, let us check if
++ * any rim_thread has found a corruption.
++ */
++ if (corruption_found || timeout) {
++ /*
++ * Yes. Someone (including us!) has found
++ * a corruption :(
++ *
++ * Let us verify that our chunk is
++ * correct.
++ */
++ /* But first, let us allow the dust to settle down! */
++ verify_chunk(tid, w_ptr, cur_sweep_id, prev_sweep_id);
++
++ return 0;
++ }
++
++ /*
++ * Compute the new pattern that we are going
++ * to write to this location
++ */
++ *pattern_ptr = compute_store_pattern(tid, w_ptr, cur_sweep_id);
++
++ /*
++ * STORE: Now let us write this pattern into
++ * the location
++ */
++ *w_ptr = *pattern_ptr;
++ }
++ }
++
++ return NULL;
++}
++
++
++static unsigned long start_cpu = 0;
++static unsigned long nrthreads = 4;
++
++static pthread_t mem_snapshot_thread;
++
++static void *mem_snapshot_fn(void *arg)
++{
++ int page_size = getpagesize();
++ size_t size = page_size;
++ void *tmp = malloc(size);
++
++ while (!corruption_found && !timeout) {
++ /* Stop memory migration once corruption is found */
++ segv_wait = 1;
++
++ mprotect(map1, size, PROT_READ);
++
++ /*
++ * Load from the working alias (map1). Loading from map2
++ * also fails.
++ */
++ memcpy(tmp, map1, size);
++
++ /*
++ * Stores must go via map2 which has write permissions, but
++ * the corrupted data tends to be seen in the snapshot buffer,
++ * so corruption does not appear to be introduced at the
++ * copy-back via map2 alias here.
++ */
++ memcpy(map2, tmp, size);
++ /*
++ * Before releasing other threads, must ensure the copy
++ * back to
++ */
++ asm volatile("sync" ::: "memory");
++ mprotect(map1, size, PROT_READ|PROT_WRITE);
++ asm volatile("sync" ::: "memory");
++ segv_wait = 0;
++
++ usleep(1); /* This value makes a big difference */
++ }
++
++ return 0;
++}
++
++void alrm_sighandler(int sig)
++{
++ timeout = 1;
++}
++
++int main(int argc, char *argv[])
++{
++ int c;
++ int page_size = getpagesize();
++ time_t now;
++ int i, dir_error;
++ pthread_attr_t attr;
++ key_t shm_key = (key_t) getpid();
++ int shmid, run_time = 20 * 60;
++ struct sigaction sa_alrm;
++
++ snprintf(logdir, LOGDIR_NAME_SIZE,
++ "/tmp/logdir-%u", (unsigned int)getpid());
++ while ((c = getopt(argc, argv, "r:hn:l:t:")) != -1) {
++ switch(c) {
++ case 'r':
++ start_cpu = strtoul(optarg, NULL, 10);
++ break;
++ case 'h':
++ printf("%s [-r <start_cpu>] [-n <nrthreads>] [-l <logdir>] [-t <timeout>]\n", argv[0]);
++ exit(0);
++ break;
++ case 'n':
++ nrthreads = strtoul(optarg, NULL, 10);
++ break;
++ case 'l':
++ strncpy(logdir, optarg, LOGDIR_NAME_SIZE - 1);
++ break;
++ case 't':
++ run_time = strtoul(optarg, NULL, 10);
++ break;
++ default:
++ printf("invalid option\n");
++ exit(0);
++ break;
++ }
++ }
++
++ if (nrthreads > MAX_THREADS)
++ nrthreads = MAX_THREADS;
++
++ shmid = shmget(shm_key, page_size, IPC_CREAT|0666);
++ if (shmid < 0) {
++ err_msg("Failed shmget\n");
++ }
++
++ map1 = shmat(shmid, NULL, 0);
++ if (map1 == (void *) -1) {
++ err_msg("Failed shmat");
++ }
++
++ map2 = shmat(shmid, NULL, 0);
++ if (map2 == (void *) -1) {
++ err_msg("Failed shmat");
++ }
++
++ dir_error = mkdir(logdir, 0755);
++
++ if (dir_error) {
++ err_msg("Failed mkdir");
++ }
++
++ printf("start_cpu list:%lu\n", start_cpu);
++ printf("number of worker threads:%lu + 1 snapshot thread\n", nrthreads);
++ printf("Allocated address:0x%016lx + secondary map:0x%016lx\n", (unsigned long)map1, (unsigned long)map2);
++ printf("logdir at : %s\n", logdir);
++ printf("Timeout: %d seconds\n", run_time);
++
++ time(&now);
++ printf("=================================\n");
++ printf(" Starting Test\n");
++ printf(" %s", ctime(&now));
++ printf("=================================\n");
++
++ for (i = 0; i < nrthreads; i++) {
++ if (1 && !fork()) {
++ prctl(PR_SET_PDEATHSIG, SIGKILL);
++ set_mycpu(start_cpu + i);
++ for (;;)
++ sched_yield();
++ exit(0);
++ }
++ }
++
++
++ sa_alrm.sa_handler = &alrm_sighandler;
++ sigemptyset(&sa_alrm.sa_mask);
++ sa_alrm.sa_flags = 0;
++
++ if (sigaction(SIGALRM, &sa_alrm, 0) == -1) {
++ err_msg("Failed signal handler registration\n");
++ }
++
++ alarm(run_time);
++
++ pthread_attr_init(&attr);
++ for (i = 0; i < nrthreads; i++) {
++ rim_thread_ids[i] = i;
++ pthread_create(&rim_threads[i], &attr, rim_fn, &rim_thread_ids[i]);
++ set_pthread_cpu(rim_threads[i], start_cpu + i);
++ }
++
++ pthread_create(&mem_snapshot_thread, &attr, mem_snapshot_fn, map1);
++ set_pthread_cpu(mem_snapshot_thread, start_cpu + i);
++
++
++ pthread_join(mem_snapshot_thread, NULL);
++ for (i = 0; i < nrthreads; i++) {
++ pthread_join(rim_threads[i], NULL);
++ }
++
++ if (!timeout) {
++ time(&now);
++ printf("=================================\n");
++ printf(" Data Corruption Detected\n");
++ printf(" %s", ctime(&now));
++ printf(" See logfiles in %s\n", logdir);
++ printf("=================================\n");
++ return 1;
++ }
++ return 0;
++}
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-11-12 21:00 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-11-12 21:00 UTC (permalink / raw
To: gentoo-commits
commit: 87cd611e311f55748b99b57248370a5289a2f86a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 12 21:00:29 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 12 21:00:29 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=87cd611e
Linux patch 4.19.84
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1083_linux-4.19.84.patch | 11705 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 11709 insertions(+)
diff --git a/0000_README b/0000_README
index 4a7a926..3d259d6 100644
--- a/0000_README
+++ b/0000_README
@@ -371,6 +371,10 @@ Patch: 1082_linux-4.19.83.patch
From: https://www.kernel.org
Desc: Linux 4.19.83
+Patch: 1083_linux-4.19.84.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.84
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1083_linux-4.19.84.patch b/1083_linux-4.19.84.patch
new file mode 100644
index 0000000..8627211
--- /dev/null
+++ b/1083_linux-4.19.84.patch
@@ -0,0 +1,11705 @@
+diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
+index 8718d4ad227b..b492fb6057c9 100644
+--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
++++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
+@@ -478,6 +478,8 @@ What: /sys/devices/system/cpu/vulnerabilities
+ /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
+ /sys/devices/system/cpu/vulnerabilities/l1tf
+ /sys/devices/system/cpu/vulnerabilities/mds
++ /sys/devices/system/cpu/vulnerabilities/tsx_async_abort
++ /sys/devices/system/cpu/vulnerabilities/itlb_multihit
+ Date: January 2018
+ Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>
+ Description: Information about CPU vulnerabilities
+diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst
+index 49311f3da6f2..0795e3c2643f 100644
+--- a/Documentation/admin-guide/hw-vuln/index.rst
++++ b/Documentation/admin-guide/hw-vuln/index.rst
+@@ -12,3 +12,5 @@ are configurable at compile, boot or run time.
+ spectre
+ l1tf
+ mds
++ tsx_async_abort
++ multihit.rst
+diff --git a/Documentation/admin-guide/hw-vuln/multihit.rst b/Documentation/admin-guide/hw-vuln/multihit.rst
+new file mode 100644
+index 000000000000..ba9988d8bce5
+--- /dev/null
++++ b/Documentation/admin-guide/hw-vuln/multihit.rst
+@@ -0,0 +1,163 @@
++iTLB multihit
++=============
++
++iTLB multihit is an erratum where some processors may incur a machine check
++error, possibly resulting in an unrecoverable CPU lockup, when an
++instruction fetch hits multiple entries in the instruction TLB. This can
++occur when the page size is changed along with either the physical address
++or cache type. A malicious guest running on a virtualized system can
++exploit this erratum to perform a denial of service attack.
++
++
++Affected processors
++-------------------
++
++Variations of this erratum are present on most Intel Core and Xeon processor
++models. The erratum is not present on:
++
++ - non-Intel processors
++
++ - Some Atoms (Airmont, Bonnell, Goldmont, GoldmontPlus, Saltwell, Silvermont)
++
++ - Intel processors that have the PSCHANGE_MC_NO bit set in the
++ IA32_ARCH_CAPABILITIES MSR.
++
++
++Related CVEs
++------------
++
++The following CVE entry is related to this issue:
++
++ ============== =================================================
++ CVE-2018-12207 Machine Check Error Avoidance on Page Size Change
++ ============== =================================================
++
++
++Problem
++-------
++
++Privileged software, including OS and virtual machine managers (VMM), are in
++charge of memory management. A key component in memory management is the control
++of the page tables. Modern processors use virtual memory, a technique that creates
++the illusion of a very large memory for processors. This virtual space is split
++into pages of a given size. Page tables translate virtual addresses to physical
++addresses.
++
++To reduce latency when performing a virtual to physical address translation,
++processors include a structure, called TLB, that caches recent translations.
++There are separate TLBs for instruction (iTLB) and data (dTLB).
++
++Under this errata, instructions are fetched from a linear address translated
++using a 4 KB translation cached in the iTLB. Privileged software modifies the
++paging structure so that the same linear address using large page size (2 MB, 4
++MB, 1 GB) with a different physical address or memory type. After the page
++structure modification but before the software invalidates any iTLB entries for
++the linear address, a code fetch that happens on the same linear address may
++cause a machine-check error which can result in a system hang or shutdown.
++
++
++Attack scenarios
++----------------
++
++Attacks against the iTLB multihit erratum can be mounted from malicious
++guests in a virtualized system.
++
++
++iTLB multihit system information
++--------------------------------
++
++The Linux kernel provides a sysfs interface to enumerate the current iTLB
++multihit status of the system:whether the system is vulnerable and which
++mitigations are active. The relevant sysfs file is:
++
++/sys/devices/system/cpu/vulnerabilities/itlb_multihit
++
++The possible values in this file are:
++
++.. list-table::
++
++ * - Not affected
++ - The processor is not vulnerable.
++ * - KVM: Mitigation: Split huge pages
++ - Software changes mitigate this issue.
++ * - KVM: Vulnerable
++ - The processor is vulnerable, but no mitigation enabled
++
++
++Enumeration of the erratum
++--------------------------------
++
++A new bit has been allocated in the IA32_ARCH_CAPABILITIES (PSCHANGE_MC_NO) msr
++and will be set on CPU's which are mitigated against this issue.
++
++ ======================================= =========== ===============================
++ IA32_ARCH_CAPABILITIES MSR Not present Possibly vulnerable,check model
++ IA32_ARCH_CAPABILITIES[PSCHANGE_MC_NO] '0' Likely vulnerable,check model
++ IA32_ARCH_CAPABILITIES[PSCHANGE_MC_NO] '1' Not vulnerable
++ ======================================= =========== ===============================
++
++
++Mitigation mechanism
++-------------------------
++
++This erratum can be mitigated by restricting the use of large page sizes to
++non-executable pages. This forces all iTLB entries to be 4K, and removes
++the possibility of multiple hits.
++
++In order to mitigate the vulnerability, KVM initially marks all huge pages
++as non-executable. If the guest attempts to execute in one of those pages,
++the page is broken down into 4K pages, which are then marked executable.
++
++If EPT is disabled or not available on the host, KVM is in control of TLB
++flushes and the problematic situation cannot happen. However, the shadow
++EPT paging mechanism used by nested virtualization is vulnerable, because
++the nested guest can trigger multiple iTLB hits by modifying its own
++(non-nested) page tables. For simplicity, KVM will make large pages
++non-executable in all shadow paging modes.
++
++Mitigation control on the kernel command line and KVM - module parameter
++------------------------------------------------------------------------
++
++The KVM hypervisor mitigation mechanism for marking huge pages as
++non-executable can be controlled with a module parameter "nx_huge_pages=".
++The kernel command line allows to control the iTLB multihit mitigations at
++boot time with the option "kvm.nx_huge_pages=".
++
++The valid arguments for these options are:
++
++ ========== ================================================================
++ force Mitigation is enabled. In this case, the mitigation implements
++ non-executable huge pages in Linux kernel KVM module. All huge
++ pages in the EPT are marked as non-executable.
++ If a guest attempts to execute in one of those pages, the page is
++ broken down into 4K pages, which are then marked executable.
++
++ off Mitigation is disabled.
++
++ auto Enable mitigation only if the platform is affected and the kernel
++ was not booted with the "mitigations=off" command line parameter.
++ This is the default option.
++ ========== ================================================================
++
++
++Mitigation selection guide
++--------------------------
++
++1. No virtualization in use
++^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ The system is protected by the kernel unconditionally and no further
++ action is required.
++
++2. Virtualization with trusted guests
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++ If the guest comes from a trusted source, you may assume that the guest will
++ not attempt to maliciously exploit these errata and no further action is
++ required.
++
++3. Virtualization with untrusted guests
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++ If the guest comes from an untrusted source, the guest host kernel will need
++ to apply iTLB multihit mitigation via the kernel command line or kvm
++ module parameter.
+diff --git a/Documentation/admin-guide/hw-vuln/tsx_async_abort.rst b/Documentation/admin-guide/hw-vuln/tsx_async_abort.rst
+new file mode 100644
+index 000000000000..fddbd7579c53
+--- /dev/null
++++ b/Documentation/admin-guide/hw-vuln/tsx_async_abort.rst
+@@ -0,0 +1,276 @@
++.. SPDX-License-Identifier: GPL-2.0
++
++TAA - TSX Asynchronous Abort
++======================================
++
++TAA is a hardware vulnerability that allows unprivileged speculative access to
++data which is available in various CPU internal buffers by using asynchronous
++aborts within an Intel TSX transactional region.
++
++Affected processors
++-------------------
++
++This vulnerability only affects Intel processors that support Intel
++Transactional Synchronization Extensions (TSX) when the TAA_NO bit (bit 8)
++is 0 in the IA32_ARCH_CAPABILITIES MSR. On processors where the MDS_NO bit
++(bit 5) is 0 in the IA32_ARCH_CAPABILITIES MSR, the existing MDS mitigations
++also mitigate against TAA.
++
++Whether a processor is affected or not can be read out from the TAA
++vulnerability file in sysfs. See :ref:`tsx_async_abort_sys_info`.
++
++Related CVEs
++------------
++
++The following CVE entry is related to this TAA issue:
++
++ ============== ===== ===================================================
++ CVE-2019-11135 TAA TSX Asynchronous Abort (TAA) condition on some
++ microprocessors utilizing speculative execution may
++ allow an authenticated user to potentially enable
++ information disclosure via a side channel with
++ local access.
++ ============== ===== ===================================================
++
++Problem
++-------
++
++When performing store, load or L1 refill operations, processors write
++data into temporary microarchitectural structures (buffers). The data in
++those buffers can be forwarded to load operations as an optimization.
++
++Intel TSX is an extension to the x86 instruction set architecture that adds
++hardware transactional memory support to improve performance of multi-threaded
++software. TSX lets the processor expose and exploit concurrency hidden in an
++application due to dynamically avoiding unnecessary synchronization.
++
++TSX supports atomic memory transactions that are either committed (success) or
++aborted. During an abort, operations that happened within the transactional region
++are rolled back. An asynchronous abort takes place, among other options, when a
++different thread accesses a cache line that is also used within the transactional
++region when that access might lead to a data race.
++
++Immediately after an uncompleted asynchronous abort, certain speculatively
++executed loads may read data from those internal buffers and pass it to dependent
++operations. This can be then used to infer the value via a cache side channel
++attack.
++
++Because the buffers are potentially shared between Hyper-Threads cross
++Hyper-Thread attacks are possible.
++
++The victim of a malicious actor does not need to make use of TSX. Only the
++attacker needs to begin a TSX transaction and raise an asynchronous abort
++which in turn potenitally leaks data stored in the buffers.
++
++More detailed technical information is available in the TAA specific x86
++architecture section: :ref:`Documentation/x86/tsx_async_abort.rst <tsx_async_abort>`.
++
++
++Attack scenarios
++----------------
++
++Attacks against the TAA vulnerability can be implemented from unprivileged
++applications running on hosts or guests.
++
++As for MDS, the attacker has no control over the memory addresses that can
++be leaked. Only the victim is responsible for bringing data to the CPU. As
++a result, the malicious actor has to sample as much data as possible and
++then postprocess it to try to infer any useful information from it.
++
++A potential attacker only has read access to the data. Also, there is no direct
++privilege escalation by using this technique.
++
++
++.. _tsx_async_abort_sys_info:
++
++TAA system information
++-----------------------
++
++The Linux kernel provides a sysfs interface to enumerate the current TAA status
++of mitigated systems. The relevant sysfs file is:
++
++/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
++
++The possible values in this file are:
++
++.. list-table::
++
++ * - 'Vulnerable'
++ - The CPU is affected by this vulnerability and the microcode and kernel mitigation are not applied.
++ * - 'Vulnerable: Clear CPU buffers attempted, no microcode'
++ - The system tries to clear the buffers but the microcode might not support the operation.
++ * - 'Mitigation: Clear CPU buffers'
++ - The microcode has been updated to clear the buffers. TSX is still enabled.
++ * - 'Mitigation: TSX disabled'
++ - TSX is disabled.
++ * - 'Not affected'
++ - The CPU is not affected by this issue.
++
++.. _ucode_needed:
++
++Best effort mitigation mode
++^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++If the processor is vulnerable, but the availability of the microcode-based
++mitigation mechanism is not advertised via CPUID the kernel selects a best
++effort mitigation mode. This mode invokes the mitigation instructions
++without a guarantee that they clear the CPU buffers.
++
++This is done to address virtualization scenarios where the host has the
++microcode update applied, but the hypervisor is not yet updated to expose the
++CPUID to the guest. If the host has updated microcode the protection takes
++effect; otherwise a few CPU cycles are wasted pointlessly.
++
++The state in the tsx_async_abort sysfs file reflects this situation
++accordingly.
++
++
++Mitigation mechanism
++--------------------
++
++The kernel detects the affected CPUs and the presence of the microcode which is
++required. If a CPU is affected and the microcode is available, then the kernel
++enables the mitigation by default.
++
++
++The mitigation can be controlled at boot time via a kernel command line option.
++See :ref:`taa_mitigation_control_command_line`.
++
++.. _virt_mechanism:
++
++Virtualization mitigation
++^^^^^^^^^^^^^^^^^^^^^^^^^
++
++Affected systems where the host has TAA microcode and TAA is mitigated by
++having disabled TSX previously, are not vulnerable regardless of the status
++of the VMs.
++
++In all other cases, if the host either does not have the TAA microcode or
++the kernel is not mitigated, the system might be vulnerable.
++
++
++.. _taa_mitigation_control_command_line:
++
++Mitigation control on the kernel command line
++---------------------------------------------
++
++The kernel command line allows to control the TAA mitigations at boot time with
++the option "tsx_async_abort=". The valid arguments for this option are:
++
++ ============ =============================================================
++ off This option disables the TAA mitigation on affected platforms.
++ If the system has TSX enabled (see next parameter) and the CPU
++ is affected, the system is vulnerable.
++
++ full TAA mitigation is enabled. If TSX is enabled, on an affected
++ system it will clear CPU buffers on ring transitions. On
++ systems which are MDS-affected and deploy MDS mitigation,
++ TAA is also mitigated. Specifying this option on those
++ systems will have no effect.
++
++ full,nosmt The same as tsx_async_abort=full, with SMT disabled on
++ vulnerable CPUs that have TSX enabled. This is the complete
++ mitigation. When TSX is disabled, SMT is not disabled because
++ CPU is not vulnerable to cross-thread TAA attacks.
++ ============ =============================================================
++
++Not specifying this option is equivalent to "tsx_async_abort=full".
++
++The kernel command line also allows to control the TSX feature using the
++parameter "tsx=" on CPUs which support TSX control. MSR_IA32_TSX_CTRL is used
++to control the TSX feature and the enumeration of the TSX feature bits (RTM
++and HLE) in CPUID.
++
++The valid options are:
++
++ ============ =============================================================
++ off Disables TSX on the system.
++
++ Note that this option takes effect only on newer CPUs which are
++ not vulnerable to MDS, i.e., have MSR_IA32_ARCH_CAPABILITIES.MDS_NO=1
++ and which get the new IA32_TSX_CTRL MSR through a microcode
++ update. This new MSR allows for the reliable deactivation of
++ the TSX functionality.
++
++ on Enables TSX.
++
++ Although there are mitigations for all known security
++ vulnerabilities, TSX has been known to be an accelerator for
++ several previous speculation-related CVEs, and so there may be
++ unknown security risks associated with leaving it enabled.
++
++ auto Disables TSX if X86_BUG_TAA is present, otherwise enables TSX
++ on the system.
++ ============ =============================================================
++
++Not specifying this option is equivalent to "tsx=off".
++
++The following combinations of the "tsx_async_abort" and "tsx" are possible. For
++affected platforms tsx=auto is equivalent to tsx=off and the result will be:
++
++ ========= ========================== =========================================
++ tsx=on tsx_async_abort=full The system will use VERW to clear CPU
++ buffers. Cross-thread attacks are still
++ possible on SMT machines.
++ tsx=on tsx_async_abort=full,nosmt As above, cross-thread attacks on SMT
++ mitigated.
++ tsx=on tsx_async_abort=off The system is vulnerable.
++ tsx=off tsx_async_abort=full TSX might be disabled if microcode
++ provides a TSX control MSR. If so,
++ system is not vulnerable.
++ tsx=off tsx_async_abort=full,nosmt Ditto
++ tsx=off tsx_async_abort=off ditto
++ ========= ========================== =========================================
++
++
++For unaffected platforms "tsx=on" and "tsx_async_abort=full" does not clear CPU
++buffers. For platforms without TSX control (MSR_IA32_ARCH_CAPABILITIES.MDS_NO=0)
++"tsx" command line argument has no effect.
++
++For the affected platforms below table indicates the mitigation status for the
++combinations of CPUID bit MD_CLEAR and IA32_ARCH_CAPABILITIES MSR bits MDS_NO
++and TSX_CTRL_MSR.
++
++ ======= ========= ============= ========================================
++ MDS_NO MD_CLEAR TSX_CTRL_MSR Status
++ ======= ========= ============= ========================================
++ 0 0 0 Vulnerable (needs microcode)
++ 0 1 0 MDS and TAA mitigated via VERW
++ 1 1 0 MDS fixed, TAA vulnerable if TSX enabled
++ because MD_CLEAR has no meaning and
++ VERW is not guaranteed to clear buffers
++ 1 X 1 MDS fixed, TAA can be mitigated by
++ VERW or TSX_CTRL_MSR
++ ======= ========= ============= ========================================
++
++Mitigation selection guide
++--------------------------
++
++1. Trusted userspace and guests
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++If all user space applications are from a trusted source and do not execute
++untrusted code which is supplied externally, then the mitigation can be
++disabled. The same applies to virtualized environments with trusted guests.
++
++
++2. Untrusted userspace and guests
++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
++
++If there are untrusted applications or guests on the system, enabling TSX
++might allow a malicious actor to leak data from the host or from other
++processes running on the same physical core.
++
++If the microcode is available and the TSX is disabled on the host, attacks
++are prevented in a virtualized environment as well, even if the VMs do not
++explicitly enable the mitigation.
++
++
++.. _taa_default_mitigations:
++
++Default mitigations
++-------------------
++
++The kernel's default action for vulnerable processors is:
++
++ - Deploy TSX disable mitigation (tsx_async_abort=full tsx=off).
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index a855f83defa6..475ed980b25b 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1956,6 +1956,25 @@
+ KVM MMU at runtime.
+ Default is 0 (off)
+
++ kvm.nx_huge_pages=
++ [KVM] Controls the software workaround for the
++ X86_BUG_ITLB_MULTIHIT bug.
++ force : Always deploy workaround.
++ off : Never deploy workaround.
++ auto : Deploy workaround based on the presence of
++ X86_BUG_ITLB_MULTIHIT.
++
++ Default is 'auto'.
++
++ If the software workaround is enabled for the host,
++ guests do need not to enable it for nested guests.
++
++ kvm.nx_huge_pages_recovery_ratio=
++ [KVM] Controls how many 4KiB pages are periodically zapped
++ back to huge pages. 0 disables the recovery, otherwise if
++ the value is N KVM will zap 1/Nth of the 4KiB pages every
++ minute. The default is 60.
++
+ kvm-amd.nested= [KVM,AMD] Allow nested virtualization in KVM/SVM.
+ Default is 1 (enabled)
+
+@@ -2523,6 +2542,13 @@
+ ssbd=force-off [ARM64]
+ l1tf=off [X86]
+ mds=off [X86]
++ tsx_async_abort=off [X86]
++ kvm.nx_huge_pages=off [X86]
++
++ Exceptions:
++ This does not have any effect on
++ kvm.nx_huge_pages when
++ kvm.nx_huge_pages=force.
+
+ auto (default)
+ Mitigate all CPU vulnerabilities, but leave SMT
+@@ -2538,6 +2564,7 @@
+ be fully mitigated, even if it means losing SMT.
+ Equivalent to: l1tf=flush,nosmt [X86]
+ mds=full,nosmt [X86]
++ tsx_async_abort=full,nosmt [X86]
+
+ mminit_loglevel=
+ [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this
+@@ -4690,6 +4717,71 @@
+ marks the TSC unconditionally unstable at bootup and
+ avoids any further wobbles once the TSC watchdog notices.
+
++ tsx= [X86] Control Transactional Synchronization
++ Extensions (TSX) feature in Intel processors that
++ support TSX control.
++
++ This parameter controls the TSX feature. The options are:
++
++ on - Enable TSX on the system. Although there are
++ mitigations for all known security vulnerabilities,
++ TSX has been known to be an accelerator for
++ several previous speculation-related CVEs, and
++ so there may be unknown security risks associated
++ with leaving it enabled.
++
++ off - Disable TSX on the system. (Note that this
++ option takes effect only on newer CPUs which are
++ not vulnerable to MDS, i.e., have
++ MSR_IA32_ARCH_CAPABILITIES.MDS_NO=1 and which get
++ the new IA32_TSX_CTRL MSR through a microcode
++ update. This new MSR allows for the reliable
++ deactivation of the TSX functionality.)
++
++ auto - Disable TSX if X86_BUG_TAA is present,
++ otherwise enable TSX on the system.
++
++ Not specifying this option is equivalent to tsx=off.
++
++ See Documentation/admin-guide/hw-vuln/tsx_async_abort.rst
++ for more details.
++
++ tsx_async_abort= [X86,INTEL] Control mitigation for the TSX Async
++ Abort (TAA) vulnerability.
++
++ Similar to Micro-architectural Data Sampling (MDS)
++ certain CPUs that support Transactional
++ Synchronization Extensions (TSX) are vulnerable to an
++ exploit against CPU internal buffers which can forward
++ information to a disclosure gadget under certain
++ conditions.
++
++ In vulnerable processors, the speculatively forwarded
++ data can be used in a cache side channel attack, to
++ access data to which the attacker does not have direct
++ access.
++
++ This parameter controls the TAA mitigation. The
++ options are:
++
++ full - Enable TAA mitigation on vulnerable CPUs
++ if TSX is enabled.
++
++ full,nosmt - Enable TAA mitigation and disable SMT on
++ vulnerable CPUs. If TSX is disabled, SMT
++ is not disabled because CPU is not
++ vulnerable to cross-thread TAA attacks.
++ off - Unconditionally disable TAA mitigation
++
++ Not specifying this option is equivalent to
++ tsx_async_abort=full. On CPUs which are MDS affected
++ and deploy MDS mitigation, TAA mitigation is not
++ required and doesn't provide any additional
++ mitigation.
++
++ For details see:
++ Documentation/admin-guide/hw-vuln/tsx_async_abort.rst
++
+ turbografx.map[2|3]= [HW,JOY]
+ TurboGraFX parallel port interface
+ Format:
+diff --git a/Documentation/scheduler/sched-bwc.txt b/Documentation/scheduler/sched-bwc.txt
+index f6b1873f68ab..de583fbbfe42 100644
+--- a/Documentation/scheduler/sched-bwc.txt
++++ b/Documentation/scheduler/sched-bwc.txt
+@@ -90,6 +90,51 @@ There are two ways in which a group may become throttled:
+ In case b) above, even though the child may have runtime remaining it will not
+ be allowed to until the parent's runtime is refreshed.
+
++CFS Bandwidth Quota Caveats
++---------------------------
++Once a slice is assigned to a cpu it does not expire. However all but 1ms of
++the slice may be returned to the global pool if all threads on that cpu become
++unrunnable. This is configured at compile time by the min_cfs_rq_runtime
++variable. This is a performance tweak that helps prevent added contention on
++the global lock.
++
++The fact that cpu-local slices do not expire results in some interesting corner
++cases that should be understood.
++
++For cgroup cpu constrained applications that are cpu limited this is a
++relatively moot point because they will naturally consume the entirety of their
++quota as well as the entirety of each cpu-local slice in each period. As a
++result it is expected that nr_periods roughly equal nr_throttled, and that
++cpuacct.usage will increase roughly equal to cfs_quota_us in each period.
++
++For highly-threaded, non-cpu bound applications this non-expiration nuance
++allows applications to briefly burst past their quota limits by the amount of
++unused slice on each cpu that the task group is running on (typically at most
++1ms per cpu or as defined by min_cfs_rq_runtime). This slight burst only
++applies if quota had been assigned to a cpu and then not fully used or returned
++in previous periods. This burst amount will not be transferred between cores.
++As a result, this mechanism still strictly limits the task group to quota
++average usage, albeit over a longer time window than a single period. This
++also limits the burst ability to no more than 1ms per cpu. This provides
++better more predictable user experience for highly threaded applications with
++small quota limits on high core count machines. It also eliminates the
++propensity to throttle these applications while simultanously using less than
++quota amounts of cpu. Another way to say this, is that by allowing the unused
++portion of a slice to remain valid across periods we have decreased the
++possibility of wastefully expiring quota on cpu-local silos that don't need a
++full slice's amount of cpu time.
++
++The interaction between cpu-bound and non-cpu-bound-interactive applications
++should also be considered, especially when single core usage hits 100%. If you
++gave each of these applications half of a cpu-core and they both got scheduled
++on the same CPU it is theoretically possible that the non-cpu bound application
++will use up to 1ms additional quota in some periods, thereby preventing the
++cpu-bound application from fully using its quota by that same amount. In these
++instances it will be up to the CFS algorithm (see sched-design-CFS.rst) to
++decide which application is chosen to run, as they will both be runnable and
++have remaining quota. This runtime discrepancy will be made up in the following
++periods when the interactive application idles.
++
+ Examples
+ --------
+ 1. Limit a group to 1 CPU worth of runtime.
+diff --git a/Documentation/virtual/kvm/locking.txt b/Documentation/virtual/kvm/locking.txt
+index 1bb8bcaf8497..635cd6eaf714 100644
+--- a/Documentation/virtual/kvm/locking.txt
++++ b/Documentation/virtual/kvm/locking.txt
+@@ -15,8 +15,6 @@ The acquisition orders for mutexes are as follows:
+
+ On x86, vcpu->mutex is taken outside kvm->arch.hyperv.hv_lock.
+
+-For spinlocks, kvm_lock is taken outside kvm->mmu_lock.
+-
+ Everything else is a leaf: no other lock is taken inside the critical
+ sections.
+
+@@ -169,7 +167,7 @@ which time it will be set using the Dirty tracking mechanism described above.
+ ------------
+
+ Name: kvm_lock
+-Type: spinlock_t
++Type: mutex
+ Arch: any
+ Protects: - vm_list
+
+diff --git a/Documentation/x86/index.rst b/Documentation/x86/index.rst
+index ef389dcf1b1d..0780d55c5aa8 100644
+--- a/Documentation/x86/index.rst
++++ b/Documentation/x86/index.rst
+@@ -6,3 +6,4 @@ x86 architecture specifics
+ :maxdepth: 1
+
+ mds
++ tsx_async_abort
+diff --git a/Documentation/x86/tsx_async_abort.rst b/Documentation/x86/tsx_async_abort.rst
+new file mode 100644
+index 000000000000..583ddc185ba2
+--- /dev/null
++++ b/Documentation/x86/tsx_async_abort.rst
+@@ -0,0 +1,117 @@
++.. SPDX-License-Identifier: GPL-2.0
++
++TSX Async Abort (TAA) mitigation
++================================
++
++.. _tsx_async_abort:
++
++Overview
++--------
++
++TSX Async Abort (TAA) is a side channel attack on internal buffers in some
++Intel processors similar to Microachitectural Data Sampling (MDS). In this
++case certain loads may speculatively pass invalid data to dependent operations
++when an asynchronous abort condition is pending in a Transactional
++Synchronization Extensions (TSX) transaction. This includes loads with no
++fault or assist condition. Such loads may speculatively expose stale data from
++the same uarch data structures as in MDS, with same scope of exposure i.e.
++same-thread and cross-thread. This issue affects all current processors that
++support TSX.
++
++Mitigation strategy
++-------------------
++
++a) TSX disable - one of the mitigations is to disable TSX. A new MSR
++IA32_TSX_CTRL will be available in future and current processors after
++microcode update which can be used to disable TSX. In addition, it
++controls the enumeration of the TSX feature bits (RTM and HLE) in CPUID.
++
++b) Clear CPU buffers - similar to MDS, clearing the CPU buffers mitigates this
++vulnerability. More details on this approach can be found in
++:ref:`Documentation/admin-guide/hw-vuln/mds.rst <mds>`.
++
++Kernel internal mitigation modes
++--------------------------------
++
++ ============= ============================================================
++ off Mitigation is disabled. Either the CPU is not affected or
++ tsx_async_abort=off is supplied on the kernel command line.
++
++ tsx disabled Mitigation is enabled. TSX feature is disabled by default at
++ bootup on processors that support TSX control.
++
++ verw Mitigation is enabled. CPU is affected and MD_CLEAR is
++ advertised in CPUID.
++
++ ucode needed Mitigation is enabled. CPU is affected and MD_CLEAR is not
++ advertised in CPUID. That is mainly for virtualization
++ scenarios where the host has the updated microcode but the
++ hypervisor does not expose MD_CLEAR in CPUID. It's a best
++ effort approach without guarantee.
++ ============= ============================================================
++
++If the CPU is affected and the "tsx_async_abort" kernel command line parameter is
++not provided then the kernel selects an appropriate mitigation depending on the
++status of RTM and MD_CLEAR CPUID bits.
++
++Below tables indicate the impact of tsx=on|off|auto cmdline options on state of
++TAA mitigation, VERW behavior and TSX feature for various combinations of
++MSR_IA32_ARCH_CAPABILITIES bits.
++
++1. "tsx=off"
++
++========= ========= ============ ============ ============== =================== ======================
++MSR_IA32_ARCH_CAPABILITIES bits Result with cmdline tsx=off
++---------------------------------- -------------------------------------------------------------------------
++TAA_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation
++ after bootup CPU buffers tsx_async_abort=off tsx_async_abort=full
++========= ========= ============ ============ ============== =================== ======================
++ 0 0 0 HW default Yes Same as MDS Same as MDS
++ 0 0 1 Invalid case Invalid case Invalid case Invalid case
++ 0 1 0 HW default No Need ucode update Need ucode update
++ 0 1 1 Disabled Yes TSX disabled TSX disabled
++ 1 X 1 Disabled X None needed None needed
++========= ========= ============ ============ ============== =================== ======================
++
++2. "tsx=on"
++
++========= ========= ============ ============ ============== =================== ======================
++MSR_IA32_ARCH_CAPABILITIES bits Result with cmdline tsx=on
++---------------------------------- -------------------------------------------------------------------------
++TAA_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation
++ after bootup CPU buffers tsx_async_abort=off tsx_async_abort=full
++========= ========= ============ ============ ============== =================== ======================
++ 0 0 0 HW default Yes Same as MDS Same as MDS
++ 0 0 1 Invalid case Invalid case Invalid case Invalid case
++ 0 1 0 HW default No Need ucode update Need ucode update
++ 0 1 1 Enabled Yes None Same as MDS
++ 1 X 1 Enabled X None needed None needed
++========= ========= ============ ============ ============== =================== ======================
++
++3. "tsx=auto"
++
++========= ========= ============ ============ ============== =================== ======================
++MSR_IA32_ARCH_CAPABILITIES bits Result with cmdline tsx=auto
++---------------------------------- -------------------------------------------------------------------------
++TAA_NO MDS_NO TSX_CTRL_MSR TSX state VERW can clear TAA mitigation TAA mitigation
++ after bootup CPU buffers tsx_async_abort=off tsx_async_abort=full
++========= ========= ============ ============ ============== =================== ======================
++ 0 0 0 HW default Yes Same as MDS Same as MDS
++ 0 0 1 Invalid case Invalid case Invalid case Invalid case
++ 0 1 0 HW default No Need ucode update Need ucode update
++ 0 1 1 Disabled Yes TSX disabled TSX disabled
++ 1 X 1 Enabled X None needed None needed
++========= ========= ============ ============ ============== =================== ======================
++
++In the tables, TSX_CTRL_MSR is a new bit in MSR_IA32_ARCH_CAPABILITIES that
++indicates whether MSR_IA32_TSX_CTRL is supported.
++
++There are two control bits in IA32_TSX_CTRL MSR:
++
++ Bit 0: When set it disables the Restricted Transactional Memory (RTM)
++ sub-feature of TSX (will force all transactions to abort on the
++ XBEGIN instruction).
++
++ Bit 1: When set it disables the enumeration of the RTM and HLE feature
++ (i.e. it will make CPUID(EAX=7).EBX{bit4} and
++ CPUID(EAX=7).EBX{bit11} read as 0).
+diff --git a/Makefile b/Makefile
+index c2c0cf2b1bd7..1ca0b8f37951 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 83
++SUBLEVEL = 84
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c
+index b4037b603897..ff173e67eed2 100644
+--- a/arch/arm/mach-sunxi/mc_smp.c
++++ b/arch/arm/mach-sunxi/mc_smp.c
+@@ -478,14 +478,18 @@ static void sunxi_mc_smp_cpu_die(unsigned int l_cpu)
+ static int sunxi_cpu_powerdown(unsigned int cpu, unsigned int cluster)
+ {
+ u32 reg;
++ int gating_bit = cpu;
+
+ pr_debug("%s: cluster %u cpu %u\n", __func__, cluster, cpu);
+ if (cpu >= SUNXI_CPUS_PER_CLUSTER || cluster >= SUNXI_NR_CLUSTERS)
+ return -EINVAL;
+
++ if (is_a83t && cpu == 0)
++ gating_bit = 4;
++
+ /* gate processor power */
+ reg = readl(prcm_base + PRCM_PWROFF_GATING_REG(cluster));
+- reg |= PRCM_PWROFF_GATING_REG_CORE(cpu);
++ reg |= PRCM_PWROFF_GATING_REG_CORE(gating_bit);
+ writel(reg, prcm_base + PRCM_PWROFF_GATING_REG(cluster));
+ udelay(20);
+
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 212a48826655..7ae553c15b9a 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -274,23 +274,6 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
+ set_pte(ptep, pte);
+ }
+
+-#define __HAVE_ARCH_PTE_SAME
+-static inline int pte_same(pte_t pte_a, pte_t pte_b)
+-{
+- pteval_t lhs, rhs;
+-
+- lhs = pte_val(pte_a);
+- rhs = pte_val(pte_b);
+-
+- if (pte_present(pte_a))
+- lhs &= ~PTE_RDONLY;
+-
+- if (pte_present(pte_b))
+- rhs &= ~PTE_RDONLY;
+-
+- return (lhs == rhs);
+-}
+-
+ /*
+ * Huge pte definitions.
+ */
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index fac1d4eaa426..3c317bc6b799 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -2110,13 +2110,13 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
+ kvm->arch.sca = (struct bsca_block *) get_zeroed_page(alloc_flags);
+ if (!kvm->arch.sca)
+ goto out_err;
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ sca_offset += 16;
+ if (sca_offset + sizeof(struct bsca_block) > PAGE_SIZE)
+ sca_offset = 0;
+ kvm->arch.sca = (struct bsca_block *)
+ ((char *) kvm->arch.sca + sca_offset);
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ sprintf(debug_name, "kvm-%u", current->pid);
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index e76d16ac2776..5726b264036f 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -1903,6 +1903,51 @@ config X86_INTEL_MEMORY_PROTECTION_KEYS
+
+ If unsure, say y.
+
++choice
++ prompt "TSX enable mode"
++ depends on CPU_SUP_INTEL
++ default X86_INTEL_TSX_MODE_OFF
++ help
++ Intel's TSX (Transactional Synchronization Extensions) feature
++ allows to optimize locking protocols through lock elision which
++ can lead to a noticeable performance boost.
++
++ On the other hand it has been shown that TSX can be exploited
++ to form side channel attacks (e.g. TAA) and chances are there
++ will be more of those attacks discovered in the future.
++
++ Therefore TSX is not enabled by default (aka tsx=off). An admin
++ might override this decision by tsx=on the command line parameter.
++ Even with TSX enabled, the kernel will attempt to enable the best
++ possible TAA mitigation setting depending on the microcode available
++ for the particular machine.
++
++ This option allows to set the default tsx mode between tsx=on, =off
++ and =auto. See Documentation/admin-guide/kernel-parameters.txt for more
++ details.
++
++ Say off if not sure, auto if TSX is in use but it should be used on safe
++ platforms or on if TSX is in use and the security aspect of tsx is not
++ relevant.
++
++config X86_INTEL_TSX_MODE_OFF
++ bool "off"
++ help
++ TSX is disabled if possible - equals to tsx=off command line parameter.
++
++config X86_INTEL_TSX_MODE_ON
++ bool "on"
++ help
++ TSX is always enabled on TSX capable HW - equals the tsx=on command
++ line parameter.
++
++config X86_INTEL_TSX_MODE_AUTO
++ bool "auto"
++ help
++ TSX is enabled on TSX capable HW that is believed to be safe against
++ side channel attacks- equals the tsx=auto command line parameter.
++endchoice
++
+ config EFI
+ bool "EFI runtime service support"
+ depends on ACPI
+diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
+index 80c6d84cad67..07bf5517d9d8 100644
+--- a/arch/x86/events/amd/ibs.c
++++ b/arch/x86/events/amd/ibs.c
+@@ -389,7 +389,8 @@ static inline void perf_ibs_disable_event(struct perf_ibs *perf_ibs,
+ struct hw_perf_event *hwc, u64 config)
+ {
+ config &= ~perf_ibs->cnt_mask;
+- wrmsrl(hwc->config_base, config);
++ if (boot_cpu_data.x86 == 0x10)
++ wrmsrl(hwc->config_base, config);
+ config &= ~perf_ibs->enable_mask;
+ wrmsrl(hwc->config_base, config);
+ }
+@@ -564,7 +565,8 @@ static struct perf_ibs perf_ibs_op = {
+ },
+ .msr = MSR_AMD64_IBSOPCTL,
+ .config_mask = IBS_OP_CONFIG_MASK,
+- .cnt_mask = IBS_OP_MAX_CNT,
++ .cnt_mask = IBS_OP_MAX_CNT | IBS_OP_CUR_CNT |
++ IBS_OP_CUR_CNT_RAND,
+ .enable_mask = IBS_OP_ENABLE,
+ .valid_mask = IBS_OP_VAL,
+ .max_period = IBS_OP_MAX_CNT << 4,
+@@ -625,7 +627,7 @@ fail:
+ if (event->attr.sample_type & PERF_SAMPLE_RAW)
+ offset_max = perf_ibs->offset_max;
+ else if (check_rip)
+- offset_max = 2;
++ offset_max = 3;
+ else
+ offset_max = 1;
+ do {
+diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
+index 2690135bf83f..7098b9b05d56 100644
+--- a/arch/x86/events/intel/uncore.c
++++ b/arch/x86/events/intel/uncore.c
+@@ -485,10 +485,8 @@ void uncore_pmu_event_start(struct perf_event *event, int flags)
+ local64_set(&event->hw.prev_count, uncore_read_counter(box, event));
+ uncore_enable_event(box, event);
+
+- if (box->n_active == 1) {
+- uncore_enable_box(box);
++ if (box->n_active == 1)
+ uncore_pmu_start_hrtimer(box);
+- }
+ }
+
+ void uncore_pmu_event_stop(struct perf_event *event, int flags)
+@@ -512,10 +510,8 @@ void uncore_pmu_event_stop(struct perf_event *event, int flags)
+ WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED);
+ hwc->state |= PERF_HES_STOPPED;
+
+- if (box->n_active == 0) {
+- uncore_disable_box(box);
++ if (box->n_active == 0)
+ uncore_pmu_cancel_hrtimer(box);
+- }
+ }
+
+ if ((flags & PERF_EF_UPDATE) && !(hwc->state & PERF_HES_UPTODATE)) {
+@@ -769,6 +765,40 @@ static int uncore_pmu_event_init(struct perf_event *event)
+ return ret;
+ }
+
++static void uncore_pmu_enable(struct pmu *pmu)
++{
++ struct intel_uncore_pmu *uncore_pmu;
++ struct intel_uncore_box *box;
++
++ uncore_pmu = container_of(pmu, struct intel_uncore_pmu, pmu);
++ if (!uncore_pmu)
++ return;
++
++ box = uncore_pmu_to_box(uncore_pmu, smp_processor_id());
++ if (!box)
++ return;
++
++ if (uncore_pmu->type->ops->enable_box)
++ uncore_pmu->type->ops->enable_box(box);
++}
++
++static void uncore_pmu_disable(struct pmu *pmu)
++{
++ struct intel_uncore_pmu *uncore_pmu;
++ struct intel_uncore_box *box;
++
++ uncore_pmu = container_of(pmu, struct intel_uncore_pmu, pmu);
++ if (!uncore_pmu)
++ return;
++
++ box = uncore_pmu_to_box(uncore_pmu, smp_processor_id());
++ if (!box)
++ return;
++
++ if (uncore_pmu->type->ops->disable_box)
++ uncore_pmu->type->ops->disable_box(box);
++}
++
+ static ssize_t uncore_get_attr_cpumask(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+@@ -794,6 +824,8 @@ static int uncore_pmu_register(struct intel_uncore_pmu *pmu)
+ pmu->pmu = (struct pmu) {
+ .attr_groups = pmu->type->attr_groups,
+ .task_ctx_nr = perf_invalid_context,
++ .pmu_enable = uncore_pmu_enable,
++ .pmu_disable = uncore_pmu_disable,
+ .event_init = uncore_pmu_event_init,
+ .add = uncore_pmu_event_add,
+ .del = uncore_pmu_event_del,
+diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
+index 42fa3974c421..40e040ec31b5 100644
+--- a/arch/x86/events/intel/uncore.h
++++ b/arch/x86/events/intel/uncore.h
+@@ -412,18 +412,6 @@ static inline int uncore_freerunning_hw_config(struct intel_uncore_box *box,
+ return -EINVAL;
+ }
+
+-static inline void uncore_disable_box(struct intel_uncore_box *box)
+-{
+- if (box->pmu->type->ops->disable_box)
+- box->pmu->type->ops->disable_box(box);
+-}
+-
+-static inline void uncore_enable_box(struct intel_uncore_box *box)
+-{
+- if (box->pmu->type->ops->enable_box)
+- box->pmu->type->ops->enable_box(box);
+-}
+-
+ static inline void uncore_disable_event(struct intel_uncore_box *box,
+ struct perf_event *event)
+ {
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 759f0a176612..8c13b99b9507 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -389,5 +389,7 @@
+ #define X86_BUG_MDS X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */
+ #define X86_BUG_MSBDS_ONLY X86_BUG(20) /* CPU is only affected by the MSDBS variant of BUG_MDS */
+ #define X86_BUG_SWAPGS X86_BUG(21) /* CPU is affected by speculation through SWAPGS */
++#define X86_BUG_TAA X86_BUG(22) /* CPU is affected by TSX Async Abort(TAA) */
++#define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
+
+ #endif /* _ASM_X86_CPUFEATURES_H */
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 0d3f5cf3ff3e..155be8adb934 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -281,6 +281,7 @@ struct kvm_rmap_head {
+ struct kvm_mmu_page {
+ struct list_head link;
+ struct hlist_node hash_link;
++ struct list_head lpage_disallowed_link;
+
+ /*
+ * The following two entries are used to key the shadow page in the
+@@ -293,6 +294,7 @@ struct kvm_mmu_page {
+ /* hold the gfn of each spte inside spt */
+ gfn_t *gfns;
+ bool unsync;
++ bool lpage_disallowed; /* Can't be replaced by an equiv large page */
+ int root_count; /* Currently serving as active root */
+ unsigned int unsync_children;
+ struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */
+@@ -807,6 +809,7 @@ struct kvm_arch {
+ */
+ struct list_head active_mmu_pages;
+ struct list_head zapped_obsolete_pages;
++ struct list_head lpage_disallowed_mmu_pages;
+ struct kvm_page_track_notifier_node mmu_sp_tracker;
+ struct kvm_page_track_notifier_head track_notifier_head;
+
+@@ -877,6 +880,8 @@ struct kvm_arch {
+ bool x2apic_broadcast_quirk_disabled;
+
+ bool guest_can_read_msr_platform_info;
++
++ struct task_struct *nx_lpage_recovery_thread;
+ };
+
+ struct kvm_vm_stat {
+@@ -890,6 +895,7 @@ struct kvm_vm_stat {
+ ulong mmu_unsync;
+ ulong remote_tlb_flush;
+ ulong lpages;
++ ulong nx_lpage_splits;
+ ulong max_mmu_page_hash_collisions;
+ };
+
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index a1d22e4428f6..0f4feee6d082 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -84,6 +84,18 @@
+ * Microarchitectural Data
+ * Sampling (MDS) vulnerabilities.
+ */
++#define ARCH_CAP_PSCHANGE_MC_NO BIT(6) /*
++ * The processor is not susceptible to a
++ * machine check error due to modifying the
++ * code page size along with either the
++ * physical address or cache type
++ * without TLB invalidation.
++ */
++#define ARCH_CAP_TSX_CTRL_MSR BIT(7) /* MSR for TSX control is available. */
++#define ARCH_CAP_TAA_NO BIT(8) /*
++ * Not susceptible to
++ * TSX Async Abort (TAA) vulnerabilities.
++ */
+
+ #define MSR_IA32_FLUSH_CMD 0x0000010b
+ #define L1D_FLUSH BIT(0) /*
+@@ -94,6 +106,10 @@
+ #define MSR_IA32_BBL_CR_CTL 0x00000119
+ #define MSR_IA32_BBL_CR_CTL3 0x0000011e
+
++#define MSR_IA32_TSX_CTRL 0x00000122
++#define TSX_CTRL_RTM_DISABLE BIT(0) /* Disable RTM feature */
++#define TSX_CTRL_CPUID_CLEAR BIT(1) /* Disable TSX enumeration */
++
+ #define MSR_IA32_SYSENTER_CS 0x00000174
+ #define MSR_IA32_SYSENTER_ESP 0x00000175
+ #define MSR_IA32_SYSENTER_EIP 0x00000176
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 28cb2b31527a..09c7466c4880 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -323,7 +323,7 @@ DECLARE_STATIC_KEY_FALSE(mds_idle_clear);
+ #include <asm/segment.h>
+
+ /**
+- * mds_clear_cpu_buffers - Mitigation for MDS vulnerability
++ * mds_clear_cpu_buffers - Mitigation for MDS and TAA vulnerability
+ *
+ * This uses the otherwise unused and obsolete VERW instruction in
+ * combination with microcode which triggers a CPU buffer flush when the
+@@ -346,7 +346,7 @@ static inline void mds_clear_cpu_buffers(void)
+ }
+
+ /**
+- * mds_user_clear_cpu_buffers - Mitigation for MDS vulnerability
++ * mds_user_clear_cpu_buffers - Mitigation for MDS and TAA vulnerability
+ *
+ * Clear CPU buffers if the corresponding static key is enabled
+ */
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index b54f25697beb..efb44bd3a714 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -1003,4 +1003,11 @@ enum mds_mitigations {
+ MDS_MITIGATION_VMWERV,
+ };
+
++enum taa_mitigations {
++ TAA_MITIGATION_OFF,
++ TAA_MITIGATION_UCODE_NEEDED,
++ TAA_MITIGATION_VERW,
++ TAA_MITIGATION_TSX_DISABLED,
++};
++
+ #endif /* _ASM_X86_PROCESSOR_H */
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index dfdd1caf0d55..1ca76ca944ba 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1528,9 +1528,6 @@ static void setup_local_APIC(void)
+ {
+ int cpu = smp_processor_id();
+ unsigned int value;
+-#ifdef CONFIG_X86_32
+- int logical_apicid, ldr_apicid;
+-#endif
+
+
+ if (disable_apic) {
+@@ -1571,16 +1568,21 @@ static void setup_local_APIC(void)
+ apic->init_apic_ldr();
+
+ #ifdef CONFIG_X86_32
+- /*
+- * APIC LDR is initialized. If logical_apicid mapping was
+- * initialized during get_smp_config(), make sure it matches the
+- * actual value.
+- */
+- logical_apicid = early_per_cpu(x86_cpu_to_logical_apicid, cpu);
+- ldr_apicid = GET_APIC_LOGICAL_ID(apic_read(APIC_LDR));
+- WARN_ON(logical_apicid != BAD_APICID && logical_apicid != ldr_apicid);
+- /* always use the value from LDR */
+- early_per_cpu(x86_cpu_to_logical_apicid, cpu) = ldr_apicid;
++ if (apic->dest_logical) {
++ int logical_apicid, ldr_apicid;
++
++ /*
++ * APIC LDR is initialized. If logical_apicid mapping was
++ * initialized during get_smp_config(), make sure it matches
++ * the actual value.
++ */
++ logical_apicid = early_per_cpu(x86_cpu_to_logical_apicid, cpu);
++ ldr_apicid = GET_APIC_LOGICAL_ID(apic_read(APIC_LDR));
++ if (logical_apicid != BAD_APICID)
++ WARN_ON(logical_apicid != ldr_apicid);
++ /* Always use the value from LDR. */
++ early_per_cpu(x86_cpu_to_logical_apicid, cpu) = ldr_apicid;
++ }
+ #endif
+
+ /*
+diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
+index 347137e80bf5..320769b4807b 100644
+--- a/arch/x86/kernel/cpu/Makefile
++++ b/arch/x86/kernel/cpu/Makefile
+@@ -28,7 +28,7 @@ obj-y += cpuid-deps.o
+ obj-$(CONFIG_PROC_FS) += proc.o
+ obj-$(CONFIG_X86_FEATURE_NAMES) += capflags.o powerflags.o
+
+-obj-$(CONFIG_CPU_SUP_INTEL) += intel.o intel_pconfig.o
++obj-$(CONFIG_CPU_SUP_INTEL) += intel.o intel_pconfig.o tsx.o
+ obj-$(CONFIG_CPU_SUP_AMD) += amd.o
+ obj-$(CONFIG_CPU_SUP_CYRIX_32) += cyrix.o
+ obj-$(CONFIG_CPU_SUP_CENTAUR) += centaur.o
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index ee7d17611ead..4684ad7ba793 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -32,11 +32,14 @@
+ #include <asm/e820/api.h>
+ #include <asm/hypervisor.h>
+
++#include "cpu.h"
++
+ static void __init spectre_v1_select_mitigation(void);
+ static void __init spectre_v2_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
+ static void __init mds_select_mitigation(void);
++static void __init taa_select_mitigation(void);
+
+ /* The base value of the SPEC_CTRL MSR that always has to be preserved. */
+ u64 x86_spec_ctrl_base;
+@@ -103,6 +106,7 @@ void __init check_bugs(void)
+ ssb_select_mitigation();
+ l1tf_select_mitigation();
+ mds_select_mitigation();
++ taa_select_mitigation();
+
+ arch_smt_update();
+
+@@ -266,6 +270,100 @@ static int __init mds_cmdline(char *str)
+ }
+ early_param("mds", mds_cmdline);
+
++#undef pr_fmt
++#define pr_fmt(fmt) "TAA: " fmt
++
++/* Default mitigation for TAA-affected CPUs */
++static enum taa_mitigations taa_mitigation __ro_after_init = TAA_MITIGATION_VERW;
++static bool taa_nosmt __ro_after_init;
++
++static const char * const taa_strings[] = {
++ [TAA_MITIGATION_OFF] = "Vulnerable",
++ [TAA_MITIGATION_UCODE_NEEDED] = "Vulnerable: Clear CPU buffers attempted, no microcode",
++ [TAA_MITIGATION_VERW] = "Mitigation: Clear CPU buffers",
++ [TAA_MITIGATION_TSX_DISABLED] = "Mitigation: TSX disabled",
++};
++
++static void __init taa_select_mitigation(void)
++{
++ u64 ia32_cap;
++
++ if (!boot_cpu_has_bug(X86_BUG_TAA)) {
++ taa_mitigation = TAA_MITIGATION_OFF;
++ return;
++ }
++
++ /* TSX previously disabled by tsx=off */
++ if (!boot_cpu_has(X86_FEATURE_RTM)) {
++ taa_mitigation = TAA_MITIGATION_TSX_DISABLED;
++ goto out;
++ }
++
++ if (cpu_mitigations_off()) {
++ taa_mitigation = TAA_MITIGATION_OFF;
++ return;
++ }
++
++ /* TAA mitigation is turned off on the cmdline (tsx_async_abort=off) */
++ if (taa_mitigation == TAA_MITIGATION_OFF)
++ goto out;
++
++ if (boot_cpu_has(X86_FEATURE_MD_CLEAR))
++ taa_mitigation = TAA_MITIGATION_VERW;
++ else
++ taa_mitigation = TAA_MITIGATION_UCODE_NEEDED;
++
++ /*
++ * VERW doesn't clear the CPU buffers when MD_CLEAR=1 and MDS_NO=1.
++ * A microcode update fixes this behavior to clear CPU buffers. It also
++ * adds support for MSR_IA32_TSX_CTRL which is enumerated by the
++ * ARCH_CAP_TSX_CTRL_MSR bit.
++ *
++ * On MDS_NO=1 CPUs if ARCH_CAP_TSX_CTRL_MSR is not set, microcode
++ * update is required.
++ */
++ ia32_cap = x86_read_arch_cap_msr();
++ if ( (ia32_cap & ARCH_CAP_MDS_NO) &&
++ !(ia32_cap & ARCH_CAP_TSX_CTRL_MSR))
++ taa_mitigation = TAA_MITIGATION_UCODE_NEEDED;
++
++ /*
++ * TSX is enabled, select alternate mitigation for TAA which is
++ * the same as MDS. Enable MDS static branch to clear CPU buffers.
++ *
++ * For guests that can't determine whether the correct microcode is
++ * present on host, enable the mitigation for UCODE_NEEDED as well.
++ */
++ static_branch_enable(&mds_user_clear);
++
++ if (taa_nosmt || cpu_mitigations_auto_nosmt())
++ cpu_smt_disable(false);
++
++out:
++ pr_info("%s\n", taa_strings[taa_mitigation]);
++}
++
++static int __init tsx_async_abort_parse_cmdline(char *str)
++{
++ if (!boot_cpu_has_bug(X86_BUG_TAA))
++ return 0;
++
++ if (!str)
++ return -EINVAL;
++
++ if (!strcmp(str, "off")) {
++ taa_mitigation = TAA_MITIGATION_OFF;
++ } else if (!strcmp(str, "full")) {
++ taa_mitigation = TAA_MITIGATION_VERW;
++ } else if (!strcmp(str, "full,nosmt")) {
++ taa_mitigation = TAA_MITIGATION_VERW;
++ taa_nosmt = true;
++ }
++
++ return 0;
++}
++early_param("tsx_async_abort", tsx_async_abort_parse_cmdline);
++
+ #undef pr_fmt
+ #define pr_fmt(fmt) "Spectre V1 : " fmt
+
+@@ -772,13 +870,10 @@ static void update_mds_branch_idle(void)
+ }
+
+ #define MDS_MSG_SMT "MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.\n"
++#define TAA_MSG_SMT "TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.\n"
+
+ void arch_smt_update(void)
+ {
+- /* Enhanced IBRS implies STIBP. No update required. */
+- if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+- return;
+-
+ mutex_lock(&spec_ctrl_mutex);
+
+ switch (spectre_v2_user) {
+@@ -804,6 +899,17 @@ void arch_smt_update(void)
+ break;
+ }
+
++ switch (taa_mitigation) {
++ case TAA_MITIGATION_VERW:
++ case TAA_MITIGATION_UCODE_NEEDED:
++ if (sched_smt_active())
++ pr_warn_once(TAA_MSG_SMT);
++ break;
++ case TAA_MITIGATION_TSX_DISABLED:
++ case TAA_MITIGATION_OFF:
++ break;
++ }
++
+ mutex_unlock(&spec_ctrl_mutex);
+ }
+
+@@ -1119,6 +1225,9 @@ void x86_spec_ctrl_setup_ap(void)
+ x86_amd_ssb_disable();
+ }
+
++bool itlb_multihit_kvm_mitigation;
++EXPORT_SYMBOL_GPL(itlb_multihit_kvm_mitigation);
++
+ #undef pr_fmt
+ #define pr_fmt(fmt) "L1TF: " fmt
+
+@@ -1274,11 +1383,24 @@ static ssize_t l1tf_show_state(char *buf)
+ l1tf_vmx_states[l1tf_vmx_mitigation],
+ sched_smt_active() ? "vulnerable" : "disabled");
+ }
++
++static ssize_t itlb_multihit_show_state(char *buf)
++{
++ if (itlb_multihit_kvm_mitigation)
++ return sprintf(buf, "KVM: Mitigation: Split huge pages\n");
++ else
++ return sprintf(buf, "KVM: Vulnerable\n");
++}
+ #else
+ static ssize_t l1tf_show_state(char *buf)
+ {
+ return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG);
+ }
++
++static ssize_t itlb_multihit_show_state(char *buf)
++{
++ return sprintf(buf, "Processor vulnerable\n");
++}
+ #endif
+
+ static ssize_t mds_show_state(char *buf)
+@@ -1298,6 +1420,21 @@ static ssize_t mds_show_state(char *buf)
+ sched_smt_active() ? "vulnerable" : "disabled");
+ }
+
++static ssize_t tsx_async_abort_show_state(char *buf)
++{
++ if ((taa_mitigation == TAA_MITIGATION_TSX_DISABLED) ||
++ (taa_mitigation == TAA_MITIGATION_OFF))
++ return sprintf(buf, "%s\n", taa_strings[taa_mitigation]);
++
++ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
++ return sprintf(buf, "%s; SMT Host state unknown\n",
++ taa_strings[taa_mitigation]);
++ }
++
++ return sprintf(buf, "%s; SMT %s\n", taa_strings[taa_mitigation],
++ sched_smt_active() ? "vulnerable" : "disabled");
++}
++
+ static char *stibp_state(void)
+ {
+ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+@@ -1366,6 +1503,12 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ case X86_BUG_MDS:
+ return mds_show_state(buf);
+
++ case X86_BUG_TAA:
++ return tsx_async_abort_show_state(buf);
++
++ case X86_BUG_ITLB_MULTIHIT:
++ return itlb_multihit_show_state(buf);
++
+ default:
+ break;
+ }
+@@ -1402,4 +1545,14 @@ ssize_t cpu_show_mds(struct device *dev, struct device_attribute *attr, char *bu
+ {
+ return cpu_show_common(dev, attr, buf, X86_BUG_MDS);
+ }
++
++ssize_t cpu_show_tsx_async_abort(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ return cpu_show_common(dev, attr, buf, X86_BUG_TAA);
++}
++
++ssize_t cpu_show_itlb_multihit(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ return cpu_show_common(dev, attr, buf, X86_BUG_ITLB_MULTIHIT);
++}
+ #endif
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index b33fdfa0ff49..1e07814f02bc 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -946,13 +946,14 @@ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
+ #endif
+ }
+
+-#define NO_SPECULATION BIT(0)
+-#define NO_MELTDOWN BIT(1)
+-#define NO_SSB BIT(2)
+-#define NO_L1TF BIT(3)
+-#define NO_MDS BIT(4)
+-#define MSBDS_ONLY BIT(5)
+-#define NO_SWAPGS BIT(6)
++#define NO_SPECULATION BIT(0)
++#define NO_MELTDOWN BIT(1)
++#define NO_SSB BIT(2)
++#define NO_L1TF BIT(3)
++#define NO_MDS BIT(4)
++#define MSBDS_ONLY BIT(5)
++#define NO_SWAPGS BIT(6)
++#define NO_ITLB_MULTIHIT BIT(7)
+
+ #define VULNWL(_vendor, _family, _model, _whitelist) \
+ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist }
+@@ -970,26 +971,26 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+ VULNWL(NSC, 5, X86_MODEL_ANY, NO_SPECULATION),
+
+ /* Intel Family 6 */
+- VULNWL_INTEL(ATOM_SALTWELL, NO_SPECULATION),
+- VULNWL_INTEL(ATOM_SALTWELL_TABLET, NO_SPECULATION),
+- VULNWL_INTEL(ATOM_SALTWELL_MID, NO_SPECULATION),
+- VULNWL_INTEL(ATOM_BONNELL, NO_SPECULATION),
+- VULNWL_INTEL(ATOM_BONNELL_MID, NO_SPECULATION),
+-
+- VULNWL_INTEL(ATOM_SILVERMONT, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+- VULNWL_INTEL(ATOM_SILVERMONT_X, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+- VULNWL_INTEL(ATOM_SILVERMONT_MID, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+- VULNWL_INTEL(ATOM_AIRMONT, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+- VULNWL_INTEL(XEON_PHI_KNL, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
+- VULNWL_INTEL(XEON_PHI_KNM, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
++ VULNWL_INTEL(ATOM_SALTWELL, NO_SPECULATION | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(ATOM_SALTWELL_TABLET, NO_SPECULATION | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(ATOM_SALTWELL_MID, NO_SPECULATION | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(ATOM_BONNELL, NO_SPECULATION | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(ATOM_BONNELL_MID, NO_SPECULATION | NO_ITLB_MULTIHIT),
++
++ VULNWL_INTEL(ATOM_SILVERMONT, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(ATOM_SILVERMONT_X, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(ATOM_SILVERMONT_MID, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(ATOM_AIRMONT, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(XEON_PHI_KNL, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(XEON_PHI_KNM, NO_SSB | NO_L1TF | MSBDS_ONLY | NO_SWAPGS | NO_ITLB_MULTIHIT),
+
+ VULNWL_INTEL(CORE_YONAH, NO_SSB),
+
+- VULNWL_INTEL(ATOM_AIRMONT_MID, NO_L1TF | MSBDS_ONLY | NO_SWAPGS),
++ VULNWL_INTEL(ATOM_AIRMONT_MID, NO_L1TF | MSBDS_ONLY | NO_SWAPGS | NO_ITLB_MULTIHIT),
+
+- VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF | NO_SWAPGS),
+- VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF | NO_SWAPGS),
+- VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS),
++ VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT),
+
+ /*
+ * Technically, swapgs isn't serializing on AMD (despite it previously
+@@ -999,14 +1000,16 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+ * good enough for our purposes.
+ */
+
++ VULNWL_INTEL(ATOM_TREMONT_X, NO_ITLB_MULTIHIT),
++
+ /* AMD Family 0xf - 0x12 */
+- VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
+- VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
+- VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
+- VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS),
++ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
+
+ /* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */
+- VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS),
++ VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
+ {}
+ };
+
+@@ -1017,19 +1020,30 @@ static bool __init cpu_matches(unsigned long which)
+ return m && !!(m->driver_data & which);
+ }
+
+-static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
++u64 x86_read_arch_cap_msr(void)
+ {
+ u64 ia32_cap = 0;
+
++ if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES))
++ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap);
++
++ return ia32_cap;
++}
++
++static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
++{
++ u64 ia32_cap = x86_read_arch_cap_msr();
++
++ /* Set ITLB_MULTIHIT bug if cpu is not in the whitelist and not mitigated */
++ if (!cpu_matches(NO_ITLB_MULTIHIT) && !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO))
++ setup_force_cpu_bug(X86_BUG_ITLB_MULTIHIT);
++
+ if (cpu_matches(NO_SPECULATION))
+ return;
+
+ setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
+ setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
+
+- if (cpu_has(c, X86_FEATURE_ARCH_CAPABILITIES))
+- rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap);
+-
+ if (!cpu_matches(NO_SSB) && !(ia32_cap & ARCH_CAP_SSB_NO) &&
+ !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
+ setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
+@@ -1046,6 +1060,21 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ if (!cpu_matches(NO_SWAPGS))
+ setup_force_cpu_bug(X86_BUG_SWAPGS);
+
++ /*
++ * When the CPU is not mitigated for TAA (TAA_NO=0) set TAA bug when:
++ * - TSX is supported or
++ * - TSX_CTRL is present
++ *
++ * TSX_CTRL check is needed for cases when TSX could be disabled before
++ * the kernel boot e.g. kexec.
++ * TSX_CTRL check alone is not sufficient for cases when the microcode
++ * update is not present or running as guest that don't get TSX_CTRL.
++ */
++ if (!(ia32_cap & ARCH_CAP_TAA_NO) &&
++ (cpu_has(c, X86_FEATURE_RTM) ||
++ (ia32_cap & ARCH_CAP_TSX_CTRL_MSR)))
++ setup_force_cpu_bug(X86_BUG_TAA);
++
+ if (cpu_matches(NO_MELTDOWN))
+ return;
+
+@@ -1475,6 +1504,7 @@ void __init identify_boot_cpu(void)
+ enable_sep_cpu();
+ #endif
+ cpu_detect_tlb(&boot_cpu_data);
++ tsx_init();
+ }
+
+ void identify_secondary_cpu(struct cpuinfo_x86 *c)
+diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
+index 7b229afa0a37..236582c90d3f 100644
+--- a/arch/x86/kernel/cpu/cpu.h
++++ b/arch/x86/kernel/cpu/cpu.h
+@@ -45,6 +45,22 @@ struct _tlb_table {
+ extern const struct cpu_dev *const __x86_cpu_dev_start[],
+ *const __x86_cpu_dev_end[];
+
++#ifdef CONFIG_CPU_SUP_INTEL
++enum tsx_ctrl_states {
++ TSX_CTRL_ENABLE,
++ TSX_CTRL_DISABLE,
++ TSX_CTRL_NOT_SUPPORTED,
++};
++
++extern __ro_after_init enum tsx_ctrl_states tsx_ctrl_state;
++
++extern void __init tsx_init(void);
++extern void tsx_enable(void);
++extern void tsx_disable(void);
++#else
++static inline void tsx_init(void) { }
++#endif /* CONFIG_CPU_SUP_INTEL */
++
+ extern void get_cpu_cap(struct cpuinfo_x86 *c);
+ extern void get_cpu_address_sizes(struct cpuinfo_x86 *c);
+ extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c);
+@@ -65,4 +81,6 @@ unsigned int aperfmperf_get_khz(int cpu);
+
+ extern void x86_spec_ctrl_setup_ap(void);
+
++extern u64 x86_read_arch_cap_msr(void);
++
+ #endif /* ARCH_X86_CPU_H */
+diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
+index fc3c07fe7df5..a5287b18a63f 100644
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -766,6 +766,11 @@ static void init_intel(struct cpuinfo_x86 *c)
+ init_intel_energy_perf(c);
+
+ init_intel_misc_features(c);
++
++ if (tsx_ctrl_state == TSX_CTRL_ENABLE)
++ tsx_enable();
++ if (tsx_ctrl_state == TSX_CTRL_DISABLE)
++ tsx_disable();
+ }
+
+ #ifdef CONFIG_X86_32
+diff --git a/arch/x86/kernel/cpu/tsx.c b/arch/x86/kernel/cpu/tsx.c
+new file mode 100644
+index 000000000000..3e20d322bc98
+--- /dev/null
++++ b/arch/x86/kernel/cpu/tsx.c
+@@ -0,0 +1,140 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Intel Transactional Synchronization Extensions (TSX) control.
++ *
++ * Copyright (C) 2019 Intel Corporation
++ *
++ * Author:
++ * Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
++ */
++
++#include <linux/cpufeature.h>
++
++#include <asm/cmdline.h>
++
++#include "cpu.h"
++
++enum tsx_ctrl_states tsx_ctrl_state __ro_after_init = TSX_CTRL_NOT_SUPPORTED;
++
++void tsx_disable(void)
++{
++ u64 tsx;
++
++ rdmsrl(MSR_IA32_TSX_CTRL, tsx);
++
++ /* Force all transactions to immediately abort */
++ tsx |= TSX_CTRL_RTM_DISABLE;
++
++ /*
++ * Ensure TSX support is not enumerated in CPUID.
++ * This is visible to userspace and will ensure they
++ * do not waste resources trying TSX transactions that
++ * will always abort.
++ */
++ tsx |= TSX_CTRL_CPUID_CLEAR;
++
++ wrmsrl(MSR_IA32_TSX_CTRL, tsx);
++}
++
++void tsx_enable(void)
++{
++ u64 tsx;
++
++ rdmsrl(MSR_IA32_TSX_CTRL, tsx);
++
++ /* Enable the RTM feature in the cpu */
++ tsx &= ~TSX_CTRL_RTM_DISABLE;
++
++ /*
++ * Ensure TSX support is enumerated in CPUID.
++ * This is visible to userspace and will ensure they
++ * can enumerate and use the TSX feature.
++ */
++ tsx &= ~TSX_CTRL_CPUID_CLEAR;
++
++ wrmsrl(MSR_IA32_TSX_CTRL, tsx);
++}
++
++static bool __init tsx_ctrl_is_supported(void)
++{
++ u64 ia32_cap = x86_read_arch_cap_msr();
++
++ /*
++ * TSX is controlled via MSR_IA32_TSX_CTRL. However, support for this
++ * MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES.
++ *
++ * TSX control (aka MSR_IA32_TSX_CTRL) is only available after a
++ * microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES
++ * bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get
++ * MSR_IA32_TSX_CTRL support even after a microcode update. Thus,
++ * tsx= cmdline requests will do nothing on CPUs without
++ * MSR_IA32_TSX_CTRL support.
++ */
++ return !!(ia32_cap & ARCH_CAP_TSX_CTRL_MSR);
++}
++
++static enum tsx_ctrl_states x86_get_tsx_auto_mode(void)
++{
++ if (boot_cpu_has_bug(X86_BUG_TAA))
++ return TSX_CTRL_DISABLE;
++
++ return TSX_CTRL_ENABLE;
++}
++
++void __init tsx_init(void)
++{
++ char arg[5] = {};
++ int ret;
++
++ if (!tsx_ctrl_is_supported())
++ return;
++
++ ret = cmdline_find_option(boot_command_line, "tsx", arg, sizeof(arg));
++ if (ret >= 0) {
++ if (!strcmp(arg, "on")) {
++ tsx_ctrl_state = TSX_CTRL_ENABLE;
++ } else if (!strcmp(arg, "off")) {
++ tsx_ctrl_state = TSX_CTRL_DISABLE;
++ } else if (!strcmp(arg, "auto")) {
++ tsx_ctrl_state = x86_get_tsx_auto_mode();
++ } else {
++ tsx_ctrl_state = TSX_CTRL_DISABLE;
++ pr_err("tsx: invalid option, defaulting to off\n");
++ }
++ } else {
++ /* tsx= not provided */
++ if (IS_ENABLED(CONFIG_X86_INTEL_TSX_MODE_AUTO))
++ tsx_ctrl_state = x86_get_tsx_auto_mode();
++ else if (IS_ENABLED(CONFIG_X86_INTEL_TSX_MODE_OFF))
++ tsx_ctrl_state = TSX_CTRL_DISABLE;
++ else
++ tsx_ctrl_state = TSX_CTRL_ENABLE;
++ }
++
++ if (tsx_ctrl_state == TSX_CTRL_DISABLE) {
++ tsx_disable();
++
++ /*
++ * tsx_disable() will change the state of the
++ * RTM CPUID bit. Clear it here since it is now
++ * expected to be not set.
++ */
++ setup_clear_cpu_cap(X86_FEATURE_RTM);
++ } else if (tsx_ctrl_state == TSX_CTRL_ENABLE) {
++
++ /*
++ * HW defaults TSX to be enabled at bootup.
++ * We may still need the TSX enable support
++ * during init for special cases like
++ * kexec after TSX is disabled.
++ */
++ tsx_enable();
++
++ /*
++ * tsx_enable() will change the state of the
++ * RTM CPUID bit. Force it here since it is now
++ * expected to be set.
++ */
++ setup_force_cpu_cap(X86_FEATURE_RTM);
++ }
++}
+diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
+index b810102a9cfa..970e261ef3e8 100644
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -501,8 +501,16 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ /* PKU is not yet implemented for shadow paging. */
+ if (!tdp_enabled || !boot_cpu_has(X86_FEATURE_OSPKE))
+ entry->ecx &= ~F(PKU);
++
+ entry->edx &= kvm_cpuid_7_0_edx_x86_features;
+ cpuid_mask(&entry->edx, CPUID_7_EDX);
++ if (boot_cpu_has(X86_FEATURE_IBPB) &&
++ boot_cpu_has(X86_FEATURE_IBRS))
++ entry->edx |= F(SPEC_CTRL);
++ if (boot_cpu_has(X86_FEATURE_STIBP))
++ entry->edx |= F(INTEL_STIBP);
++ if (boot_cpu_has(X86_FEATURE_SSBD))
++ entry->edx |= F(SPEC_CTRL_SSBD);
+ /*
+ * We emulate ARCH_CAPABILITIES in software even
+ * if the host doesn't support it.
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 88940261fb53..d7db7608de5f 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -40,6 +40,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/hash.h>
+ #include <linux/kern_levels.h>
++#include <linux/kthread.h>
+
+ #include <asm/page.h>
+ #include <asm/pat.h>
+@@ -49,6 +50,30 @@
+ #include <asm/kvm_page_track.h>
+ #include "trace.h"
+
++extern bool itlb_multihit_kvm_mitigation;
++
++static int __read_mostly nx_huge_pages = -1;
++static uint __read_mostly nx_huge_pages_recovery_ratio = 60;
++
++static int set_nx_huge_pages(const char *val, const struct kernel_param *kp);
++static int set_nx_huge_pages_recovery_ratio(const char *val, const struct kernel_param *kp);
++
++static struct kernel_param_ops nx_huge_pages_ops = {
++ .set = set_nx_huge_pages,
++ .get = param_get_bool,
++};
++
++static struct kernel_param_ops nx_huge_pages_recovery_ratio_ops = {
++ .set = set_nx_huge_pages_recovery_ratio,
++ .get = param_get_uint,
++};
++
++module_param_cb(nx_huge_pages, &nx_huge_pages_ops, &nx_huge_pages, 0644);
++__MODULE_PARM_TYPE(nx_huge_pages, "bool");
++module_param_cb(nx_huge_pages_recovery_ratio, &nx_huge_pages_recovery_ratio_ops,
++ &nx_huge_pages_recovery_ratio, 0644);
++__MODULE_PARM_TYPE(nx_huge_pages_recovery_ratio, "uint");
++
+ /*
+ * When setting this variable to true it enables Two-Dimensional-Paging
+ * where the hardware walks 2 page tables:
+@@ -140,9 +165,6 @@ module_param(dbg, bool, 0644);
+
+ #include <trace/events/kvm.h>
+
+-#define CREATE_TRACE_POINTS
+-#include "mmutrace.h"
+-
+ #define SPTE_HOST_WRITEABLE (1ULL << PT_FIRST_AVAIL_BITS_SHIFT)
+ #define SPTE_MMU_WRITEABLE (1ULL << (PT_FIRST_AVAIL_BITS_SHIFT + 1))
+
+@@ -261,9 +283,14 @@ static u64 __read_mostly shadow_nonpresent_or_rsvd_lower_gfn_mask;
+
+
+ static void mmu_spte_set(u64 *sptep, u64 spte);
++static bool is_executable_pte(u64 spte);
+ static union kvm_mmu_page_role
+ kvm_mmu_calc_root_page_role(struct kvm_vcpu *vcpu);
+
++#define CREATE_TRACE_POINTS
++#include "mmutrace.h"
++
++
+ void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask, u64 mmio_value)
+ {
+ BUG_ON((mmio_mask & mmio_value) != mmio_value);
+@@ -283,6 +310,11 @@ static inline bool spte_ad_enabled(u64 spte)
+ return !(spte & shadow_acc_track_value);
+ }
+
++static bool is_nx_huge_page_enabled(void)
++{
++ return READ_ONCE(nx_huge_pages);
++}
++
+ static inline u64 spte_shadow_accessed_mask(u64 spte)
+ {
+ MMU_WARN_ON((spte & shadow_mmio_mask) == shadow_mmio_value);
+@@ -1027,10 +1059,16 @@ static gfn_t kvm_mmu_page_get_gfn(struct kvm_mmu_page *sp, int index)
+
+ static void kvm_mmu_page_set_gfn(struct kvm_mmu_page *sp, int index, gfn_t gfn)
+ {
+- if (sp->role.direct)
+- BUG_ON(gfn != kvm_mmu_page_get_gfn(sp, index));
+- else
++ if (!sp->role.direct) {
+ sp->gfns[index] = gfn;
++ return;
++ }
++
++ if (WARN_ON(gfn != kvm_mmu_page_get_gfn(sp, index)))
++ pr_err_ratelimited("gfn mismatch under direct page %llx "
++ "(expected %llx, got %llx)\n",
++ sp->gfn,
++ kvm_mmu_page_get_gfn(sp, index), gfn);
+ }
+
+ /*
+@@ -1089,6 +1127,17 @@ static void account_shadowed(struct kvm *kvm, struct kvm_mmu_page *sp)
+ kvm_mmu_gfn_disallow_lpage(slot, gfn);
+ }
+
++static void account_huge_nx_page(struct kvm *kvm, struct kvm_mmu_page *sp)
++{
++ if (sp->lpage_disallowed)
++ return;
++
++ ++kvm->stat.nx_lpage_splits;
++ list_add_tail(&sp->lpage_disallowed_link,
++ &kvm->arch.lpage_disallowed_mmu_pages);
++ sp->lpage_disallowed = true;
++}
++
+ static void unaccount_shadowed(struct kvm *kvm, struct kvm_mmu_page *sp)
+ {
+ struct kvm_memslots *slots;
+@@ -1106,6 +1155,13 @@ static void unaccount_shadowed(struct kvm *kvm, struct kvm_mmu_page *sp)
+ kvm_mmu_gfn_allow_lpage(slot, gfn);
+ }
+
++static void unaccount_huge_nx_page(struct kvm *kvm, struct kvm_mmu_page *sp)
++{
++ --kvm->stat.nx_lpage_splits;
++ sp->lpage_disallowed = false;
++ list_del(&sp->lpage_disallowed_link);
++}
++
+ static bool __mmu_gfn_lpage_is_disallowed(gfn_t gfn, int level,
+ struct kvm_memory_slot *slot)
+ {
+@@ -2658,6 +2714,9 @@ static int kvm_mmu_prepare_zap_page(struct kvm *kvm, struct kvm_mmu_page *sp,
+ kvm_reload_remote_mmus(kvm);
+ }
+
++ if (sp->lpage_disallowed)
++ unaccount_huge_nx_page(kvm, sp);
++
+ sp->role.invalid = 1;
+ return ret;
+ }
+@@ -2866,6 +2925,11 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
+ if (!speculative)
+ spte |= spte_shadow_accessed_mask(spte);
+
++ if (level > PT_PAGE_TABLE_LEVEL && (pte_access & ACC_EXEC_MASK) &&
++ is_nx_huge_page_enabled()) {
++ pte_access &= ~ACC_EXEC_MASK;
++ }
++
+ if (pte_access & ACC_EXEC_MASK)
+ spte |= shadow_x_mask;
+ else
+@@ -2986,10 +3050,7 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep, unsigned pte_access,
+ ret = RET_PF_EMULATE;
+
+ pgprintk("%s: setting spte %llx\n", __func__, *sptep);
+- pgprintk("instantiating %s PTE (%s) at %llx (%llx) addr %p\n",
+- is_large_pte(*sptep)? "2MB" : "4kB",
+- *sptep & PT_WRITABLE_MASK ? "RW" : "R", gfn,
+- *sptep, sptep);
++ trace_kvm_mmu_set_spte(level, gfn, sptep);
+ if (!was_rmapped && is_large_pte(*sptep))
+ ++vcpu->kvm->stat.lpages;
+
+@@ -3001,8 +3062,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep, unsigned pte_access,
+ }
+ }
+
+- kvm_release_pfn_clean(pfn);
+-
+ return ret;
+ }
+
+@@ -3037,9 +3096,11 @@ static int direct_pte_prefetch_many(struct kvm_vcpu *vcpu,
+ if (ret <= 0)
+ return -1;
+
+- for (i = 0; i < ret; i++, gfn++, start++)
++ for (i = 0; i < ret; i++, gfn++, start++) {
+ mmu_set_spte(vcpu, start, access, 0, sp->role.level, gfn,
+ page_to_pfn(pages[i]), true, true);
++ put_page(pages[i]);
++ }
+
+ return 0;
+ }
+@@ -3087,40 +3148,71 @@ static void direct_pte_prefetch(struct kvm_vcpu *vcpu, u64 *sptep)
+ __direct_pte_prefetch(vcpu, sp, sptep);
+ }
+
+-static int __direct_map(struct kvm_vcpu *vcpu, int write, int map_writable,
+- int level, gfn_t gfn, kvm_pfn_t pfn, bool prefault)
++static void disallowed_hugepage_adjust(struct kvm_shadow_walk_iterator it,
++ gfn_t gfn, kvm_pfn_t *pfnp, int *levelp)
+ {
+- struct kvm_shadow_walk_iterator iterator;
++ int level = *levelp;
++ u64 spte = *it.sptep;
++
++ if (it.level == level && level > PT_PAGE_TABLE_LEVEL &&
++ is_nx_huge_page_enabled() &&
++ is_shadow_present_pte(spte) &&
++ !is_large_pte(spte)) {
++ /*
++ * A small SPTE exists for this pfn, but FNAME(fetch)
++ * and __direct_map would like to create a large PTE
++ * instead: just force them to go down another level,
++ * patching back for them into pfn the next 9 bits of
++ * the address.
++ */
++ u64 page_mask = KVM_PAGES_PER_HPAGE(level) - KVM_PAGES_PER_HPAGE(level - 1);
++ *pfnp |= gfn & page_mask;
++ (*levelp)--;
++ }
++}
++
++static int __direct_map(struct kvm_vcpu *vcpu, gpa_t gpa, int write,
++ int map_writable, int level, kvm_pfn_t pfn,
++ bool prefault, bool lpage_disallowed)
++{
++ struct kvm_shadow_walk_iterator it;
+ struct kvm_mmu_page *sp;
+- int emulate = 0;
+- gfn_t pseudo_gfn;
++ int ret;
++ gfn_t gfn = gpa >> PAGE_SHIFT;
++ gfn_t base_gfn = gfn;
+
+ if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
+- return 0;
++ return RET_PF_RETRY;
+
+- for_each_shadow_entry(vcpu, (u64)gfn << PAGE_SHIFT, iterator) {
+- if (iterator.level == level) {
+- emulate = mmu_set_spte(vcpu, iterator.sptep, ACC_ALL,
+- write, level, gfn, pfn, prefault,
+- map_writable);
+- direct_pte_prefetch(vcpu, iterator.sptep);
+- ++vcpu->stat.pf_fixed;
+- break;
+- }
++ trace_kvm_mmu_spte_requested(gpa, level, pfn);
++ for_each_shadow_entry(vcpu, gpa, it) {
++ /*
++ * We cannot overwrite existing page tables with an NX
++ * large page, as the leaf could be executable.
++ */
++ disallowed_hugepage_adjust(it, gfn, &pfn, &level);
+
+- drop_large_spte(vcpu, iterator.sptep);
+- if (!is_shadow_present_pte(*iterator.sptep)) {
+- u64 base_addr = iterator.addr;
++ base_gfn = gfn & ~(KVM_PAGES_PER_HPAGE(it.level) - 1);
++ if (it.level == level)
++ break;
+
+- base_addr &= PT64_LVL_ADDR_MASK(iterator.level);
+- pseudo_gfn = base_addr >> PAGE_SHIFT;
+- sp = kvm_mmu_get_page(vcpu, pseudo_gfn, iterator.addr,
+- iterator.level - 1, 1, ACC_ALL);
++ drop_large_spte(vcpu, it.sptep);
++ if (!is_shadow_present_pte(*it.sptep)) {
++ sp = kvm_mmu_get_page(vcpu, base_gfn, it.addr,
++ it.level - 1, true, ACC_ALL);
+
+- link_shadow_page(vcpu, iterator.sptep, sp);
++ link_shadow_page(vcpu, it.sptep, sp);
++ if (lpage_disallowed)
++ account_huge_nx_page(vcpu->kvm, sp);
+ }
+ }
+- return emulate;
++
++ ret = mmu_set_spte(vcpu, it.sptep, ACC_ALL,
++ write, level, base_gfn, pfn, prefault,
++ map_writable);
++ direct_pte_prefetch(vcpu, it.sptep);
++ ++vcpu->stat.pf_fixed;
++ return ret;
+ }
+
+ static void kvm_send_hwpoison_signal(unsigned long address, struct task_struct *tsk)
+@@ -3156,11 +3248,10 @@ static int kvm_handle_bad_page(struct kvm_vcpu *vcpu, gfn_t gfn, kvm_pfn_t pfn)
+ }
+
+ static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
+- gfn_t *gfnp, kvm_pfn_t *pfnp,
++ gfn_t gfn, kvm_pfn_t *pfnp,
+ int *levelp)
+ {
+ kvm_pfn_t pfn = *pfnp;
+- gfn_t gfn = *gfnp;
+ int level = *levelp;
+
+ /*
+@@ -3187,8 +3278,6 @@ static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
+ mask = KVM_PAGES_PER_HPAGE(level) - 1;
+ VM_BUG_ON((gfn & mask) != (pfn & mask));
+ if (pfn & mask) {
+- gfn &= ~mask;
+- *gfnp = gfn;
+ kvm_release_pfn_clean(pfn);
+ pfn &= ~mask;
+ kvm_get_pfn(pfn);
+@@ -3415,11 +3504,14 @@ static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, u32 error_code,
+ {
+ int r;
+ int level;
+- bool force_pt_level = false;
++ bool force_pt_level;
+ kvm_pfn_t pfn;
+ unsigned long mmu_seq;
+ bool map_writable, write = error_code & PFERR_WRITE_MASK;
++ bool lpage_disallowed = (error_code & PFERR_FETCH_MASK) &&
++ is_nx_huge_page_enabled();
+
++ force_pt_level = lpage_disallowed;
+ level = mapping_level(vcpu, gfn, &force_pt_level);
+ if (likely(!force_pt_level)) {
+ /*
+@@ -3445,22 +3537,20 @@ static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, u32 error_code,
+ if (handle_abnormal_pfn(vcpu, v, gfn, pfn, ACC_ALL, &r))
+ return r;
+
++ r = RET_PF_RETRY;
+ spin_lock(&vcpu->kvm->mmu_lock);
+ if (mmu_notifier_retry(vcpu->kvm, mmu_seq))
+ goto out_unlock;
+ if (make_mmu_pages_available(vcpu) < 0)
+ goto out_unlock;
+ if (likely(!force_pt_level))
+- transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
+- r = __direct_map(vcpu, write, map_writable, level, gfn, pfn, prefault);
+- spin_unlock(&vcpu->kvm->mmu_lock);
+-
+- return r;
+-
++ transparent_hugepage_adjust(vcpu, gfn, &pfn, &level);
++ r = __direct_map(vcpu, v, write, map_writable, level, pfn,
++ prefault, false);
+ out_unlock:
+ spin_unlock(&vcpu->kvm->mmu_lock);
+ kvm_release_pfn_clean(pfn);
+- return RET_PF_RETRY;
++ return r;
+ }
+
+ static void mmu_free_root_page(struct kvm *kvm, hpa_t *root_hpa,
+@@ -4050,6 +4140,8 @@ static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa, u32 error_code,
+ unsigned long mmu_seq;
+ int write = error_code & PFERR_WRITE_MASK;
+ bool map_writable;
++ bool lpage_disallowed = (error_code & PFERR_FETCH_MASK) &&
++ is_nx_huge_page_enabled();
+
+ MMU_WARN_ON(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
+
+@@ -4060,8 +4152,9 @@ static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa, u32 error_code,
+ if (r)
+ return r;
+
+- force_pt_level = !check_hugepage_cache_consistency(vcpu, gfn,
+- PT_DIRECTORY_LEVEL);
++ force_pt_level =
++ lpage_disallowed ||
++ !check_hugepage_cache_consistency(vcpu, gfn, PT_DIRECTORY_LEVEL);
+ level = mapping_level(vcpu, gfn, &force_pt_level);
+ if (likely(!force_pt_level)) {
+ if (level > PT_DIRECTORY_LEVEL &&
+@@ -4082,22 +4175,20 @@ static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa, u32 error_code,
+ if (handle_abnormal_pfn(vcpu, 0, gfn, pfn, ACC_ALL, &r))
+ return r;
+
++ r = RET_PF_RETRY;
+ spin_lock(&vcpu->kvm->mmu_lock);
+ if (mmu_notifier_retry(vcpu->kvm, mmu_seq))
+ goto out_unlock;
+ if (make_mmu_pages_available(vcpu) < 0)
+ goto out_unlock;
+ if (likely(!force_pt_level))
+- transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
+- r = __direct_map(vcpu, write, map_writable, level, gfn, pfn, prefault);
+- spin_unlock(&vcpu->kvm->mmu_lock);
+-
+- return r;
+-
++ transparent_hugepage_adjust(vcpu, gfn, &pfn, &level);
++ r = __direct_map(vcpu, gpa, write, map_writable, level, pfn,
++ prefault, lpage_disallowed);
+ out_unlock:
+ spin_unlock(&vcpu->kvm->mmu_lock);
+ kvm_release_pfn_clean(pfn);
+- return RET_PF_RETRY;
++ return r;
+ }
+
+ static void nonpaging_init_context(struct kvm_vcpu *vcpu,
+@@ -5819,7 +5910,7 @@ mmu_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ int nr_to_scan = sc->nr_to_scan;
+ unsigned long freed = 0;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ int idx;
+@@ -5869,7 +5960,7 @@ unlock:
+ break;
+ }
+
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+ return freed;
+ }
+
+@@ -5891,10 +5982,60 @@ static void mmu_destroy_caches(void)
+ kmem_cache_destroy(mmu_page_header_cache);
+ }
+
++static bool get_nx_auto_mode(void)
++{
++ /* Return true when CPU has the bug, and mitigations are ON */
++ return boot_cpu_has_bug(X86_BUG_ITLB_MULTIHIT) && !cpu_mitigations_off();
++}
++
++static void __set_nx_huge_pages(bool val)
++{
++ nx_huge_pages = itlb_multihit_kvm_mitigation = val;
++}
++
++static int set_nx_huge_pages(const char *val, const struct kernel_param *kp)
++{
++ bool old_val = nx_huge_pages;
++ bool new_val;
++
++ /* In "auto" mode deploy workaround only if CPU has the bug. */
++ if (sysfs_streq(val, "off"))
++ new_val = 0;
++ else if (sysfs_streq(val, "force"))
++ new_val = 1;
++ else if (sysfs_streq(val, "auto"))
++ new_val = get_nx_auto_mode();
++ else if (strtobool(val, &new_val) < 0)
++ return -EINVAL;
++
++ __set_nx_huge_pages(new_val);
++
++ if (new_val != old_val) {
++ struct kvm *kvm;
++ int idx;
++
++ mutex_lock(&kvm_lock);
++
++ list_for_each_entry(kvm, &vm_list, vm_list) {
++ idx = srcu_read_lock(&kvm->srcu);
++ kvm_mmu_invalidate_zap_all_pages(kvm);
++ srcu_read_unlock(&kvm->srcu, idx);
++
++ wake_up_process(kvm->arch.nx_lpage_recovery_thread);
++ }
++ mutex_unlock(&kvm_lock);
++ }
++
++ return 0;
++}
++
+ int kvm_mmu_module_init(void)
+ {
+ int ret = -ENOMEM;
+
++ if (nx_huge_pages == -1)
++ __set_nx_huge_pages(get_nx_auto_mode());
++
+ kvm_mmu_reset_all_pte_masks();
+
+ pte_list_desc_cache = kmem_cache_create("pte_list_desc",
+@@ -5961,3 +6102,116 @@ void kvm_mmu_module_exit(void)
+ unregister_shrinker(&mmu_shrinker);
+ mmu_audit_disable();
+ }
++
++static int set_nx_huge_pages_recovery_ratio(const char *val, const struct kernel_param *kp)
++{
++ unsigned int old_val;
++ int err;
++
++ old_val = nx_huge_pages_recovery_ratio;
++ err = param_set_uint(val, kp);
++ if (err)
++ return err;
++
++ if (READ_ONCE(nx_huge_pages) &&
++ !old_val && nx_huge_pages_recovery_ratio) {
++ struct kvm *kvm;
++
++ mutex_lock(&kvm_lock);
++
++ list_for_each_entry(kvm, &vm_list, vm_list)
++ wake_up_process(kvm->arch.nx_lpage_recovery_thread);
++
++ mutex_unlock(&kvm_lock);
++ }
++
++ return err;
++}
++
++static void kvm_recover_nx_lpages(struct kvm *kvm)
++{
++ int rcu_idx;
++ struct kvm_mmu_page *sp;
++ unsigned int ratio;
++ LIST_HEAD(invalid_list);
++ ulong to_zap;
++
++ rcu_idx = srcu_read_lock(&kvm->srcu);
++ spin_lock(&kvm->mmu_lock);
++
++ ratio = READ_ONCE(nx_huge_pages_recovery_ratio);
++ to_zap = ratio ? DIV_ROUND_UP(kvm->stat.nx_lpage_splits, ratio) : 0;
++ while (to_zap && !list_empty(&kvm->arch.lpage_disallowed_mmu_pages)) {
++ /*
++ * We use a separate list instead of just using active_mmu_pages
++ * because the number of lpage_disallowed pages is expected to
++ * be relatively small compared to the total.
++ */
++ sp = list_first_entry(&kvm->arch.lpage_disallowed_mmu_pages,
++ struct kvm_mmu_page,
++ lpage_disallowed_link);
++ WARN_ON_ONCE(!sp->lpage_disallowed);
++ kvm_mmu_prepare_zap_page(kvm, sp, &invalid_list);
++ WARN_ON_ONCE(sp->lpage_disallowed);
++
++ if (!--to_zap || need_resched() || spin_needbreak(&kvm->mmu_lock)) {
++ kvm_mmu_commit_zap_page(kvm, &invalid_list);
++ if (to_zap)
++ cond_resched_lock(&kvm->mmu_lock);
++ }
++ }
++
++ spin_unlock(&kvm->mmu_lock);
++ srcu_read_unlock(&kvm->srcu, rcu_idx);
++}
++
++static long get_nx_lpage_recovery_timeout(u64 start_time)
++{
++ return READ_ONCE(nx_huge_pages) && READ_ONCE(nx_huge_pages_recovery_ratio)
++ ? start_time + 60 * HZ - get_jiffies_64()
++ : MAX_SCHEDULE_TIMEOUT;
++}
++
++static int kvm_nx_lpage_recovery_worker(struct kvm *kvm, uintptr_t data)
++{
++ u64 start_time;
++ long remaining_time;
++
++ while (true) {
++ start_time = get_jiffies_64();
++ remaining_time = get_nx_lpage_recovery_timeout(start_time);
++
++ set_current_state(TASK_INTERRUPTIBLE);
++ while (!kthread_should_stop() && remaining_time > 0) {
++ schedule_timeout(remaining_time);
++ remaining_time = get_nx_lpage_recovery_timeout(start_time);
++ set_current_state(TASK_INTERRUPTIBLE);
++ }
++
++ set_current_state(TASK_RUNNING);
++
++ if (kthread_should_stop())
++ return 0;
++
++ kvm_recover_nx_lpages(kvm);
++ }
++}
++
++int kvm_mmu_post_init_vm(struct kvm *kvm)
++{
++ int err;
++
++ err = kvm_vm_create_worker_thread(kvm, kvm_nx_lpage_recovery_worker, 0,
++ "kvm-nx-lpage-recovery",
++ &kvm->arch.nx_lpage_recovery_thread);
++ if (!err)
++ kthread_unpark(kvm->arch.nx_lpage_recovery_thread);
++
++ return err;
++}
++
++void kvm_mmu_pre_destroy_vm(struct kvm *kvm)
++{
++ if (kvm->arch.nx_lpage_recovery_thread)
++ kthread_stop(kvm->arch.nx_lpage_recovery_thread);
++}
+diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
+index 65892288bf51..f7b2de7b6382 100644
+--- a/arch/x86/kvm/mmu.h
++++ b/arch/x86/kvm/mmu.h
+@@ -216,4 +216,8 @@ void kvm_mmu_gfn_allow_lpage(struct kvm_memory_slot *slot, gfn_t gfn);
+ bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm,
+ struct kvm_memory_slot *slot, u64 gfn);
+ int kvm_arch_write_log_dirty(struct kvm_vcpu *vcpu);
++
++int kvm_mmu_post_init_vm(struct kvm *kvm);
++void kvm_mmu_pre_destroy_vm(struct kvm *kvm);
++
+ #endif
+diff --git a/arch/x86/kvm/mmutrace.h b/arch/x86/kvm/mmutrace.h
+index c73bf4e4988c..918b0d5bf272 100644
+--- a/arch/x86/kvm/mmutrace.h
++++ b/arch/x86/kvm/mmutrace.h
+@@ -325,6 +325,65 @@ TRACE_EVENT(
+ __entry->kvm_gen == __entry->spte_gen
+ )
+ );
++
++TRACE_EVENT(
++ kvm_mmu_set_spte,
++ TP_PROTO(int level, gfn_t gfn, u64 *sptep),
++ TP_ARGS(level, gfn, sptep),
++
++ TP_STRUCT__entry(
++ __field(u64, gfn)
++ __field(u64, spte)
++ __field(u64, sptep)
++ __field(u8, level)
++ /* These depend on page entry type, so compute them now. */
++ __field(bool, r)
++ __field(bool, x)
++ __field(u8, u)
++ ),
++
++ TP_fast_assign(
++ __entry->gfn = gfn;
++ __entry->spte = *sptep;
++ __entry->sptep = virt_to_phys(sptep);
++ __entry->level = level;
++ __entry->r = shadow_present_mask || (__entry->spte & PT_PRESENT_MASK);
++ __entry->x = is_executable_pte(__entry->spte);
++ __entry->u = shadow_user_mask ? !!(__entry->spte & shadow_user_mask) : -1;
++ ),
++
++ TP_printk("gfn %llx spte %llx (%s%s%s%s) level %d at %llx",
++ __entry->gfn, __entry->spte,
++ __entry->r ? "r" : "-",
++ __entry->spte & PT_WRITABLE_MASK ? "w" : "-",
++ __entry->x ? "x" : "-",
++ __entry->u == -1 ? "" : (__entry->u ? "u" : "-"),
++ __entry->level, __entry->sptep
++ )
++);
++
++TRACE_EVENT(
++ kvm_mmu_spte_requested,
++ TP_PROTO(gpa_t addr, int level, kvm_pfn_t pfn),
++ TP_ARGS(addr, level, pfn),
++
++ TP_STRUCT__entry(
++ __field(u64, gfn)
++ __field(u64, pfn)
++ __field(u8, level)
++ ),
++
++ TP_fast_assign(
++ __entry->gfn = addr >> PAGE_SHIFT;
++ __entry->pfn = pfn | (__entry->gfn & (KVM_PAGES_PER_HPAGE(level) - 1));
++ __entry->level = level;
++ ),
++
++ TP_printk("gfn %llx pfn %llx level %d",
++ __entry->gfn, __entry->pfn, __entry->level
++ )
++);
++
+ #endif /* _TRACE_KVMMMU_H */
+
+ #undef TRACE_INCLUDE_PATH
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index 14ffd973df54..adf42dc8d38b 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -522,6 +522,7 @@ FNAME(prefetch_gpte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
+ mmu_set_spte(vcpu, spte, pte_access, 0, PT_PAGE_TABLE_LEVEL, gfn, pfn,
+ true, true);
+
++ kvm_release_pfn_clean(pfn);
+ return true;
+ }
+
+@@ -595,12 +596,14 @@ static void FNAME(pte_prefetch)(struct kvm_vcpu *vcpu, struct guest_walker *gw,
+ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
+ struct guest_walker *gw,
+ int write_fault, int hlevel,
+- kvm_pfn_t pfn, bool map_writable, bool prefault)
++ kvm_pfn_t pfn, bool map_writable, bool prefault,
++ bool lpage_disallowed)
+ {
+ struct kvm_mmu_page *sp = NULL;
+ struct kvm_shadow_walk_iterator it;
+ unsigned direct_access, access = gw->pt_access;
+ int top_level, ret;
++ gfn_t gfn, base_gfn;
+
+ direct_access = gw->pte_access;
+
+@@ -645,35 +648,48 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
+ link_shadow_page(vcpu, it.sptep, sp);
+ }
+
+- for (;
+- shadow_walk_okay(&it) && it.level > hlevel;
+- shadow_walk_next(&it)) {
+- gfn_t direct_gfn;
++ /*
++ * FNAME(page_fault) might have clobbered the bottom bits of
++ * gw->gfn, restore them from the virtual address.
++ */
++ gfn = gw->gfn | ((addr & PT_LVL_OFFSET_MASK(gw->level)) >> PAGE_SHIFT);
++ base_gfn = gfn;
+
++ trace_kvm_mmu_spte_requested(addr, gw->level, pfn);
++
++ for (; shadow_walk_okay(&it); shadow_walk_next(&it)) {
+ clear_sp_write_flooding_count(it.sptep);
+- validate_direct_spte(vcpu, it.sptep, direct_access);
+
+- drop_large_spte(vcpu, it.sptep);
++ /*
++ * We cannot overwrite existing page tables with an NX
++ * large page, as the leaf could be executable.
++ */
++ disallowed_hugepage_adjust(it, gfn, &pfn, &hlevel);
+
+- if (is_shadow_present_pte(*it.sptep))
+- continue;
++ base_gfn = gfn & ~(KVM_PAGES_PER_HPAGE(it.level) - 1);
++ if (it.level == hlevel)
++ break;
++
++ validate_direct_spte(vcpu, it.sptep, direct_access);
+
+- direct_gfn = gw->gfn & ~(KVM_PAGES_PER_HPAGE(it.level) - 1);
++ drop_large_spte(vcpu, it.sptep);
+
+- sp = kvm_mmu_get_page(vcpu, direct_gfn, addr, it.level-1,
+- true, direct_access);
+- link_shadow_page(vcpu, it.sptep, sp);
++ if (!is_shadow_present_pte(*it.sptep)) {
++ sp = kvm_mmu_get_page(vcpu, base_gfn, addr,
++ it.level - 1, true, direct_access);
++ link_shadow_page(vcpu, it.sptep, sp);
++ if (lpage_disallowed)
++ account_huge_nx_page(vcpu->kvm, sp);
++ }
+ }
+
+- clear_sp_write_flooding_count(it.sptep);
+ ret = mmu_set_spte(vcpu, it.sptep, gw->pte_access, write_fault,
+- it.level, gw->gfn, pfn, prefault, map_writable);
++ it.level, base_gfn, pfn, prefault, map_writable);
+ FNAME(pte_prefetch)(vcpu, gw, it.sptep);
+-
++ ++vcpu->stat.pf_fixed;
+ return ret;
+
+ out_gpte_changed:
+- kvm_release_pfn_clean(pfn);
+ return RET_PF_RETRY;
+ }
+
+@@ -740,9 +756,11 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code,
+ int r;
+ kvm_pfn_t pfn;
+ int level = PT_PAGE_TABLE_LEVEL;
+- bool force_pt_level = false;
+ unsigned long mmu_seq;
+ bool map_writable, is_self_change_mapping;
++ bool lpage_disallowed = (error_code & PFERR_FETCH_MASK) &&
++ is_nx_huge_page_enabled();
++ bool force_pt_level = lpage_disallowed;
+
+ pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
+
+@@ -821,6 +839,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code,
+ walker.pte_access &= ~ACC_EXEC_MASK;
+ }
+
++ r = RET_PF_RETRY;
+ spin_lock(&vcpu->kvm->mmu_lock);
+ if (mmu_notifier_retry(vcpu->kvm, mmu_seq))
+ goto out_unlock;
+@@ -829,19 +848,15 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code,
+ if (make_mmu_pages_available(vcpu) < 0)
+ goto out_unlock;
+ if (!force_pt_level)
+- transparent_hugepage_adjust(vcpu, &walker.gfn, &pfn, &level);
++ transparent_hugepage_adjust(vcpu, walker.gfn, &pfn, &level);
+ r = FNAME(fetch)(vcpu, addr, &walker, write_fault,
+- level, pfn, map_writable, prefault);
+- ++vcpu->stat.pf_fixed;
++ level, pfn, map_writable, prefault, lpage_disallowed);
+ kvm_mmu_audit(vcpu, AUDIT_POST_PAGE_FAULT);
+- spin_unlock(&vcpu->kvm->mmu_lock);
+-
+- return r;
+
+ out_unlock:
+ spin_unlock(&vcpu->kvm->mmu_lock);
+ kvm_release_pfn_clean(pfn);
+- return RET_PF_RETRY;
++ return r;
+ }
+
+ static gpa_t FNAME(get_level1_sp_gpa)(struct kvm_mmu_page *sp)
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index ac2cc2ed7a85..7657dcd72134 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -736,8 +736,14 @@ static int get_npt_level(struct kvm_vcpu *vcpu)
+ static void svm_set_efer(struct kvm_vcpu *vcpu, u64 efer)
+ {
+ vcpu->arch.efer = efer;
+- if (!npt_enabled && !(efer & EFER_LMA))
+- efer &= ~EFER_LME;
++
++ if (!npt_enabled) {
++ /* Shadow paging assumes NX to be available. */
++ efer |= EFER_NX;
++
++ if (!(efer & EFER_LMA))
++ efer &= ~EFER_LME;
++ }
+
+ to_svm(vcpu)->vmcb->save.efer = efer | EFER_SVME;
+ mark_dirty(to_svm(vcpu)->vmcb, VMCB_CR);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 6f7b3acdab26..4eda2a9c234a 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2785,17 +2785,9 @@ static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset)
+ u64 guest_efer = vmx->vcpu.arch.efer;
+ u64 ignore_bits = 0;
+
+- if (!enable_ept) {
+- /*
+- * NX is needed to handle CR0.WP=1, CR4.SMEP=1. Testing
+- * host CPUID is more efficient than testing guest CPUID
+- * or CR4. Host SMEP is anyway a requirement for guest SMEP.
+- */
+- if (boot_cpu_has(X86_FEATURE_SMEP))
+- guest_efer |= EFER_NX;
+- else if (!(guest_efer & EFER_NX))
+- ignore_bits |= EFER_NX;
+- }
++ /* Shadow paging assumes NX to be available. */
++ if (!enable_ept)
++ guest_efer |= EFER_NX;
+
+ /*
+ * LMA and LME handled by hardware; SCE meaningless outside long mode.
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 6ae8a013af31..e536503ac788 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -92,8 +92,8 @@ u64 __read_mostly efer_reserved_bits = ~((u64)(EFER_SCE | EFER_LME | EFER_LMA));
+ static u64 __read_mostly efer_reserved_bits = ~((u64)EFER_SCE);
+ #endif
+
+-#define VM_STAT(x) offsetof(struct kvm, stat.x), KVM_STAT_VM
+-#define VCPU_STAT(x) offsetof(struct kvm_vcpu, stat.x), KVM_STAT_VCPU
++#define VM_STAT(x, ...) offsetof(struct kvm, stat.x), KVM_STAT_VM, ## __VA_ARGS__
++#define VCPU_STAT(x, ...) offsetof(struct kvm_vcpu, stat.x), KVM_STAT_VCPU, ## __VA_ARGS__
+
+ #define KVM_X2APIC_API_VALID_FLAGS (KVM_X2APIC_API_USE_32BIT_IDS | \
+ KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK)
+@@ -205,7 +205,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
+ { "mmu_cache_miss", VM_STAT(mmu_cache_miss) },
+ { "mmu_unsync", VM_STAT(mmu_unsync) },
+ { "remote_tlb_flush", VM_STAT(remote_tlb_flush) },
+- { "largepages", VM_STAT(lpages) },
++ { "largepages", VM_STAT(lpages, .mode = 0444) },
++ { "nx_largepages_splitted", VM_STAT(nx_lpage_splits, .mode = 0444) },
+ { "max_mmu_page_hash_collisions",
+ VM_STAT(max_mmu_page_hash_collisions) },
+ { NULL }
+@@ -1130,6 +1131,14 @@ u64 kvm_get_arch_capabilities(void)
+
+ rdmsrl_safe(MSR_IA32_ARCH_CAPABILITIES, &data);
+
++ /*
++ * If nx_huge_pages is enabled, KVM's shadow paging will ensure that
++ * the nested hypervisor runs with NX huge pages. If it is not,
++ * L1 is anyway vulnerable to ITLB_MULTIHIT explots from other
++ * L1 guests, so it need not worry about its own (L2) guests.
++ */
++ data |= ARCH_CAP_PSCHANGE_MC_NO;
++
+ /*
+ * If we're doing cache flushes (either "always" or "cond")
+ * we will do one whenever the guest does a vmlaunch/vmresume.
+@@ -1142,8 +1151,35 @@ u64 kvm_get_arch_capabilities(void)
+ if (l1tf_vmx_mitigation != VMENTER_L1D_FLUSH_NEVER)
+ data |= ARCH_CAP_SKIP_VMENTRY_L1DFLUSH;
+
++ if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
++ data |= ARCH_CAP_RDCL_NO;
++ if (!boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS))
++ data |= ARCH_CAP_SSB_NO;
++ if (!boot_cpu_has_bug(X86_BUG_MDS))
++ data |= ARCH_CAP_MDS_NO;
++
++ /*
++ * On TAA affected systems, export MDS_NO=0 when:
++ * - TSX is enabled on the host, i.e. X86_FEATURE_RTM=1.
++ * - Updated microcode is present. This is detected by
++ * the presence of ARCH_CAP_TSX_CTRL_MSR and ensures
++ * that VERW clears CPU buffers.
++ *
++ * When MDS_NO=0 is exported, guests deploy clear CPU buffer
++ * mitigation and don't complain:
++ *
++ * "Vulnerable: Clear CPU buffers attempted, no microcode"
++ *
++ * If TSX is disabled on the system, guests are also mitigated against
++ * TAA and clear CPU buffer mitigation is not required for guests.
++ */
++ if (boot_cpu_has_bug(X86_BUG_TAA) && boot_cpu_has(X86_FEATURE_RTM) &&
++ (data & ARCH_CAP_TSX_CTRL_MSR))
++ data &= ~ARCH_CAP_MDS_NO;
++
+ return data;
+ }
++
+ EXPORT_SYMBOL_GPL(kvm_get_arch_capabilities);
+
+ static int kvm_get_msr_feature(struct kvm_msr_entry *msr)
+@@ -6502,7 +6538,7 @@ static void kvm_hyperv_tsc_notifier(void)
+ struct kvm_vcpu *vcpu;
+ int cpu;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list)
+ kvm_make_mclock_inprogress_request(kvm);
+
+@@ -6528,7 +6564,7 @@ static void kvm_hyperv_tsc_notifier(void)
+
+ spin_unlock(&ka->pvclock_gtod_sync_lock);
+ }
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+ }
+ #endif
+
+@@ -6586,17 +6622,17 @@ static int kvmclock_cpufreq_notifier(struct notifier_block *nb, unsigned long va
+
+ smp_call_function_single(freq->cpu, tsc_khz_changed, freq, 1);
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ kvm_for_each_vcpu(i, vcpu, kvm) {
+ if (vcpu->cpu != freq->cpu)
+ continue;
+ kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
+- if (vcpu->cpu != smp_processor_id())
++ if (vcpu->cpu != raw_smp_processor_id())
+ send_ipi = 1;
+ }
+ }
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ if (freq->old < freq->new && send_ipi) {
+ /*
+@@ -6722,12 +6758,12 @@ static void pvclock_gtod_update_fn(struct work_struct *work)
+ struct kvm_vcpu *vcpu;
+ int i;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list)
+ kvm_for_each_vcpu(i, vcpu, kvm)
+ kvm_make_request(KVM_REQ_MASTERCLOCK_UPDATE, vcpu);
+ atomic_set(&kvm_guest_has_master_clock, 0);
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+ }
+
+ static DECLARE_WORK(pvclock_gtod_work, pvclock_gtod_update_fn);
+@@ -8949,6 +8985,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
+ INIT_HLIST_HEAD(&kvm->arch.mask_notifier_list);
+ INIT_LIST_HEAD(&kvm->arch.active_mmu_pages);
+ INIT_LIST_HEAD(&kvm->arch.zapped_obsolete_pages);
++ INIT_LIST_HEAD(&kvm->arch.lpage_disallowed_mmu_pages);
+ INIT_LIST_HEAD(&kvm->arch.assigned_dev_head);
+ atomic_set(&kvm->arch.noncoherent_dma_count, 0);
+
+@@ -8980,6 +9017,11 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
+ return 0;
+ }
+
++int kvm_arch_post_init_vm(struct kvm *kvm)
++{
++ return kvm_mmu_post_init_vm(kvm);
++}
++
+ static void kvm_unload_vcpu_mmu(struct kvm_vcpu *vcpu)
+ {
+ vcpu_load(vcpu);
+@@ -9081,6 +9123,11 @@ int x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size)
+ }
+ EXPORT_SYMBOL_GPL(x86_set_memory_region);
+
++void kvm_arch_pre_destroy_vm(struct kvm *kvm)
++{
++ kvm_mmu_pre_destroy_vm(kvm);
++}
++
+ void kvm_arch_destroy_vm(struct kvm *kvm)
+ {
+ if (current->mm == kvm->mm) {
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 527524134693..a06547fe6f6b 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -955,9 +955,14 @@ static int blkcg_print_stat(struct seq_file *sf, void *v)
+ int i;
+ bool has_stats = false;
+
++ spin_lock_irq(blkg->q->queue_lock);
++
++ if (!blkg->online)
++ goto skip;
++
+ dname = blkg_dev_name(blkg);
+ if (!dname)
+- continue;
++ goto skip;
+
+ /*
+ * Hooray string manipulation, count is the size written NOT
+@@ -967,8 +972,6 @@ static int blkcg_print_stat(struct seq_file *sf, void *v)
+ */
+ off += scnprintf(buf+off, size-off, "%s ", dname);
+
+- spin_lock_irq(blkg->q->queue_lock);
+-
+ rwstat = blkg_rwstat_recursive_sum(blkg, NULL,
+ offsetof(struct blkcg_gq, stat_bytes));
+ rbytes = atomic64_read(&rwstat.aux_cnt[BLKG_RWSTAT_READ]);
+@@ -981,8 +984,6 @@ static int blkcg_print_stat(struct seq_file *sf, void *v)
+ wios = atomic64_read(&rwstat.aux_cnt[BLKG_RWSTAT_WRITE]);
+ dios = atomic64_read(&rwstat.aux_cnt[BLKG_RWSTAT_DISCARD]);
+
+- spin_unlock_irq(blkg->q->queue_lock);
+-
+ if (rbytes || wbytes || rios || wios) {
+ has_stats = true;
+ off += scnprintf(buf+off, size-off,
+@@ -1023,6 +1024,8 @@ next:
+ seq_commit(sf, -1);
+ }
+ }
++ skip:
++ spin_unlock_irq(blkg->q->queue_lock);
+ }
+
+ rcu_read_unlock();
+diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
+index 2fd6ca1021c2..f3ecf7418ed4 100644
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -552,12 +552,27 @@ ssize_t __weak cpu_show_mds(struct device *dev,
+ return sprintf(buf, "Not affected\n");
+ }
+
++ssize_t __weak cpu_show_tsx_async_abort(struct device *dev,
++ struct device_attribute *attr,
++ char *buf)
++{
++ return sprintf(buf, "Not affected\n");
++}
++
++ssize_t __weak cpu_show_itlb_multihit(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ return sprintf(buf, "Not affected\n");
++}
++
+ static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
+ static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
+ static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
+ static DEVICE_ATTR(spec_store_bypass, 0444, cpu_show_spec_store_bypass, NULL);
+ static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL);
+ static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL);
++static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL);
++static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL);
+
+ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_meltdown.attr,
+@@ -566,6 +581,8 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_spec_store_bypass.attr,
+ &dev_attr_l1tf.attr,
+ &dev_attr_mds.attr,
++ &dev_attr_tsx_async_abort.attr,
++ &dev_attr_itlb_multihit.attr,
+ NULL
+ };
+
+diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
+index 1ed1c7efa288..9e8ce56a83d8 100644
+--- a/drivers/dma/sprd-dma.c
++++ b/drivers/dma/sprd-dma.c
+@@ -181,6 +181,7 @@ struct sprd_dma_dev {
+ struct sprd_dma_chn channels[0];
+ };
+
++static void sprd_dma_free_desc(struct virt_dma_desc *vd);
+ static bool sprd_dma_filter_fn(struct dma_chan *chan, void *param);
+ static struct of_dma_filter_info sprd_dma_info = {
+ .filter_fn = sprd_dma_filter_fn,
+@@ -493,12 +494,19 @@ static int sprd_dma_alloc_chan_resources(struct dma_chan *chan)
+ static void sprd_dma_free_chan_resources(struct dma_chan *chan)
+ {
+ struct sprd_dma_chn *schan = to_sprd_dma_chan(chan);
++ struct virt_dma_desc *cur_vd = NULL;
+ unsigned long flags;
+
+ spin_lock_irqsave(&schan->vc.lock, flags);
++ if (schan->cur_desc)
++ cur_vd = &schan->cur_desc->vd;
++
+ sprd_dma_stop(schan);
+ spin_unlock_irqrestore(&schan->vc.lock, flags);
+
++ if (cur_vd)
++ sprd_dma_free_desc(cur_vd);
++
+ vchan_free_chan_resources(&schan->vc);
+ pm_runtime_put(chan->device->dev);
+ }
+@@ -814,15 +822,22 @@ static int sprd_dma_resume(struct dma_chan *chan)
+ static int sprd_dma_terminate_all(struct dma_chan *chan)
+ {
+ struct sprd_dma_chn *schan = to_sprd_dma_chan(chan);
++ struct virt_dma_desc *cur_vd = NULL;
+ unsigned long flags;
+ LIST_HEAD(head);
+
+ spin_lock_irqsave(&schan->vc.lock, flags);
++ if (schan->cur_desc)
++ cur_vd = &schan->cur_desc->vd;
++
+ sprd_dma_stop(schan);
+
+ vchan_get_all_descriptors(&schan->vc, &head);
+ spin_unlock_irqrestore(&schan->vc.lock, flags);
+
++ if (cur_vd)
++ sprd_dma_free_desc(cur_vd);
++
+ vchan_dma_desc_free_list(&schan->vc, &head);
+ return 0;
+ }
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index c12442312595..8aec137b4fca 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -72,6 +72,9 @@
+ #define XILINX_DMA_DMACR_CIRC_EN BIT(1)
+ #define XILINX_DMA_DMACR_RUNSTOP BIT(0)
+ #define XILINX_DMA_DMACR_FSYNCSRC_MASK GENMASK(6, 5)
++#define XILINX_DMA_DMACR_DELAY_MASK GENMASK(31, 24)
++#define XILINX_DMA_DMACR_FRAME_COUNT_MASK GENMASK(23, 16)
++#define XILINX_DMA_DMACR_MASTER_MASK GENMASK(11, 8)
+
+ #define XILINX_DMA_REG_DMASR 0x0004
+ #define XILINX_DMA_DMASR_EOL_LATE_ERR BIT(15)
+@@ -2112,8 +2115,10 @@ int xilinx_vdma_channel_set_config(struct dma_chan *dchan,
+ chan->config.gen_lock = cfg->gen_lock;
+ chan->config.master = cfg->master;
+
++ dmacr &= ~XILINX_DMA_DMACR_GENLOCK_EN;
+ if (cfg->gen_lock && chan->genlock) {
+ dmacr |= XILINX_DMA_DMACR_GENLOCK_EN;
++ dmacr &= ~XILINX_DMA_DMACR_MASTER_MASK;
+ dmacr |= cfg->master << XILINX_DMA_DMACR_MASTER_SHIFT;
+ }
+
+@@ -2129,11 +2134,13 @@ int xilinx_vdma_channel_set_config(struct dma_chan *dchan,
+ chan->config.delay = cfg->delay;
+
+ if (cfg->coalesc <= XILINX_DMA_DMACR_FRAME_COUNT_MAX) {
++ dmacr &= ~XILINX_DMA_DMACR_FRAME_COUNT_MASK;
+ dmacr |= cfg->coalesc << XILINX_DMA_DMACR_FRAME_COUNT_SHIFT;
+ chan->config.coalesc = cfg->coalesc;
+ }
+
+ if (cfg->delay <= XILINX_DMA_DMACR_DELAY_MAX) {
++ dmacr &= ~XILINX_DMA_DMACR_DELAY_MASK;
+ dmacr |= cfg->delay << XILINX_DMA_DMACR_DELAY_SHIFT;
+ chan->config.delay = cfg->delay;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+index f823d4baf044..cf582cc46d53 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+@@ -203,7 +203,7 @@ static struct dma_fence *amdgpu_job_run(struct drm_sched_job *sched_job)
+ struct amdgpu_ring *ring = to_amdgpu_ring(sched_job->sched);
+ struct dma_fence *fence = NULL, *finished;
+ struct amdgpu_job *job;
+- int r;
++ int r = 0;
+
+ job = to_amdgpu_job(sched_job);
+ finished = &job->base.s_fence->finished;
+@@ -228,6 +228,8 @@ static struct dma_fence *amdgpu_job_run(struct drm_sched_job *sched_job)
+ job->fence = dma_fence_get(fence);
+
+ amdgpu_job_free_resources(job);
++
++ fence = r ? ERR_PTR(r) : fence;
+ return fence;
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+index 8def0d9fa0ff..46c9cb47a96e 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+@@ -433,6 +433,7 @@ void dal_ddc_service_i2c_query_dp_dual_mode_adaptor(
+ enum display_dongle_type *dongle = &sink_cap->dongle_type;
+ uint8_t type2_dongle_buf[DP_ADAPTOR_TYPE2_SIZE];
+ bool is_type2_dongle = false;
++ int retry_count = 2;
+ struct dp_hdmi_dongle_signature_data *dongle_signature;
+
+ /* Assume we have no valid DP passive dongle connected */
+@@ -445,13 +446,24 @@ void dal_ddc_service_i2c_query_dp_dual_mode_adaptor(
+ DP_HDMI_DONGLE_ADDRESS,
+ type2_dongle_buf,
+ sizeof(type2_dongle_buf))) {
+- *dongle = DISPLAY_DONGLE_DP_DVI_DONGLE;
+- sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_DVI_MAX_TMDS_CLK;
++ /* Passive HDMI dongles can sometimes fail here without retrying*/
++ while (retry_count > 0) {
++ if (i2c_read(ddc,
++ DP_HDMI_DONGLE_ADDRESS,
++ type2_dongle_buf,
++ sizeof(type2_dongle_buf)))
++ break;
++ retry_count--;
++ }
++ if (retry_count == 0) {
++ *dongle = DISPLAY_DONGLE_DP_DVI_DONGLE;
++ sink_cap->max_hdmi_pixel_clock = DP_ADAPTOR_DVI_MAX_TMDS_CLK;
+
+- CONN_DATA_DETECT(ddc->link, type2_dongle_buf, sizeof(type2_dongle_buf),
+- "DP-DVI passive dongle %dMhz: ",
+- DP_ADAPTOR_DVI_MAX_TMDS_CLK / 1000);
+- return;
++ CONN_DATA_DETECT(ddc->link, type2_dongle_buf, sizeof(type2_dongle_buf),
++ "DP-DVI passive dongle %dMhz: ",
++ DP_ADAPTOR_DVI_MAX_TMDS_CLK / 1000);
++ return;
++ }
+ }
+
+ /* Check if Type 2 dongle.*/
+diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c
+index 95478db9998b..e4b9eb1f6b60 100644
+--- a/drivers/gpu/drm/i915/i915_cmd_parser.c
++++ b/drivers/gpu/drm/i915/i915_cmd_parser.c
+@@ -51,13 +51,11 @@
+ * granting userspace undue privileges. There are three categories of privilege.
+ *
+ * First, commands which are explicitly defined as privileged or which should
+- * only be used by the kernel driver. The parser generally rejects such
+- * commands, though it may allow some from the drm master process.
++ * only be used by the kernel driver. The parser rejects such commands
+ *
+ * Second, commands which access registers. To support correct/enhanced
+ * userspace functionality, particularly certain OpenGL extensions, the parser
+- * provides a whitelist of registers which userspace may safely access (for both
+- * normal and drm master processes).
++ * provides a whitelist of registers which userspace may safely access
+ *
+ * Third, commands which access privileged memory (i.e. GGTT, HWS page, etc).
+ * The parser always rejects such commands.
+@@ -82,9 +80,9 @@
+ * in the per-engine command tables.
+ *
+ * Other command table entries map fairly directly to high level categories
+- * mentioned above: rejected, master-only, register whitelist. The parser
+- * implements a number of checks, including the privileged memory checks, via a
+- * general bitmasking mechanism.
++ * mentioned above: rejected, register whitelist. The parser implements a number
++ * of checks, including the privileged memory checks, via a general bitmasking
++ * mechanism.
+ */
+
+ /*
+@@ -102,8 +100,6 @@ struct drm_i915_cmd_descriptor {
+ * CMD_DESC_REJECT: The command is never allowed
+ * CMD_DESC_REGISTER: The command should be checked against the
+ * register whitelist for the appropriate ring
+- * CMD_DESC_MASTER: The command is allowed if the submitting process
+- * is the DRM master
+ */
+ u32 flags;
+ #define CMD_DESC_FIXED (1<<0)
+@@ -111,7 +107,6 @@ struct drm_i915_cmd_descriptor {
+ #define CMD_DESC_REJECT (1<<2)
+ #define CMD_DESC_REGISTER (1<<3)
+ #define CMD_DESC_BITMASK (1<<4)
+-#define CMD_DESC_MASTER (1<<5)
+
+ /*
+ * The command's unique identification bits and the bitmask to get them.
+@@ -192,7 +187,7 @@ struct drm_i915_cmd_table {
+ #define CMD(op, opm, f, lm, fl, ...) \
+ { \
+ .flags = (fl) | ((f) ? CMD_DESC_FIXED : 0), \
+- .cmd = { (op), ~0u << (opm) }, \
++ .cmd = { (op & ~0u << (opm)), ~0u << (opm) }, \
+ .length = { (lm) }, \
+ __VA_ARGS__ \
+ }
+@@ -207,14 +202,13 @@ struct drm_i915_cmd_table {
+ #define R CMD_DESC_REJECT
+ #define W CMD_DESC_REGISTER
+ #define B CMD_DESC_BITMASK
+-#define M CMD_DESC_MASTER
+
+ /* Command Mask Fixed Len Action
+ ---------------------------------------------------------- */
+-static const struct drm_i915_cmd_descriptor common_cmds[] = {
++static const struct drm_i915_cmd_descriptor gen7_common_cmds[] = {
+ CMD( MI_NOOP, SMI, F, 1, S ),
+ CMD( MI_USER_INTERRUPT, SMI, F, 1, R ),
+- CMD( MI_WAIT_FOR_EVENT, SMI, F, 1, M ),
++ CMD( MI_WAIT_FOR_EVENT, SMI, F, 1, R ),
+ CMD( MI_ARB_CHECK, SMI, F, 1, S ),
+ CMD( MI_REPORT_HEAD, SMI, F, 1, S ),
+ CMD( MI_SUSPEND_FLUSH, SMI, F, 1, S ),
+@@ -244,7 +238,7 @@ static const struct drm_i915_cmd_descriptor common_cmds[] = {
+ CMD( MI_BATCH_BUFFER_START, SMI, !F, 0xFF, S ),
+ };
+
+-static const struct drm_i915_cmd_descriptor render_cmds[] = {
++static const struct drm_i915_cmd_descriptor gen7_render_cmds[] = {
+ CMD( MI_FLUSH, SMI, F, 1, S ),
+ CMD( MI_ARB_ON_OFF, SMI, F, 1, R ),
+ CMD( MI_PREDICATE, SMI, F, 1, S ),
+@@ -311,7 +305,7 @@ static const struct drm_i915_cmd_descriptor hsw_render_cmds[] = {
+ CMD( MI_URB_ATOMIC_ALLOC, SMI, F, 1, S ),
+ CMD( MI_SET_APPID, SMI, F, 1, S ),
+ CMD( MI_RS_CONTEXT, SMI, F, 1, S ),
+- CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, M ),
++ CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, R ),
+ CMD( MI_LOAD_SCAN_LINES_EXCL, SMI, !F, 0x3F, R ),
+ CMD( MI_LOAD_REGISTER_REG, SMI, !F, 0xFF, W,
+ .reg = { .offset = 1, .mask = 0x007FFFFC, .step = 1 } ),
+@@ -328,7 +322,7 @@ static const struct drm_i915_cmd_descriptor hsw_render_cmds[] = {
+ CMD( GFX_OP_3DSTATE_BINDING_TABLE_EDIT_PS, S3D, !F, 0x1FF, S ),
+ };
+
+-static const struct drm_i915_cmd_descriptor video_cmds[] = {
++static const struct drm_i915_cmd_descriptor gen7_video_cmds[] = {
+ CMD( MI_ARB_ON_OFF, SMI, F, 1, R ),
+ CMD( MI_SET_APPID, SMI, F, 1, S ),
+ CMD( MI_STORE_DWORD_IMM, SMI, !F, 0xFF, B,
+@@ -372,7 +366,7 @@ static const struct drm_i915_cmd_descriptor video_cmds[] = {
+ CMD( MFX_WAIT, SMFX, F, 1, S ),
+ };
+
+-static const struct drm_i915_cmd_descriptor vecs_cmds[] = {
++static const struct drm_i915_cmd_descriptor gen7_vecs_cmds[] = {
+ CMD( MI_ARB_ON_OFF, SMI, F, 1, R ),
+ CMD( MI_SET_APPID, SMI, F, 1, S ),
+ CMD( MI_STORE_DWORD_IMM, SMI, !F, 0xFF, B,
+@@ -410,7 +404,7 @@ static const struct drm_i915_cmd_descriptor vecs_cmds[] = {
+ }}, ),
+ };
+
+-static const struct drm_i915_cmd_descriptor blt_cmds[] = {
++static const struct drm_i915_cmd_descriptor gen7_blt_cmds[] = {
+ CMD( MI_DISPLAY_FLIP, SMI, !F, 0xFF, R ),
+ CMD( MI_STORE_DWORD_IMM, SMI, !F, 0x3FF, B,
+ .bits = {{
+@@ -444,10 +438,64 @@ static const struct drm_i915_cmd_descriptor blt_cmds[] = {
+ };
+
+ static const struct drm_i915_cmd_descriptor hsw_blt_cmds[] = {
+- CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, M ),
++ CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, R ),
+ CMD( MI_LOAD_SCAN_LINES_EXCL, SMI, !F, 0x3F, R ),
+ };
+
++/*
++ * For Gen9 we can still rely on the h/w to enforce cmd security, and only
++ * need to re-enforce the register access checks. We therefore only need to
++ * teach the cmdparser how to find the end of each command, and identify
++ * register accesses. The table doesn't need to reject any commands, and so
++ * the only commands listed here are:
++ * 1) Those that touch registers
++ * 2) Those that do not have the default 8-bit length
++ *
++ * Note that the default MI length mask chosen for this table is 0xFF, not
++ * the 0x3F used on older devices. This is because the vast majority of MI
++ * cmds on Gen9 use a standard 8-bit Length field.
++ * All the Gen9 blitter instructions are standard 0xFF length mask, and
++ * none allow access to non-general registers, so in fact no BLT cmds are
++ * included in the table at all.
++ *
++ */
++static const struct drm_i915_cmd_descriptor gen9_blt_cmds[] = {
++ CMD( MI_NOOP, SMI, F, 1, S ),
++ CMD( MI_USER_INTERRUPT, SMI, F, 1, S ),
++ CMD( MI_WAIT_FOR_EVENT, SMI, F, 1, S ),
++ CMD( MI_FLUSH, SMI, F, 1, S ),
++ CMD( MI_ARB_CHECK, SMI, F, 1, S ),
++ CMD( MI_REPORT_HEAD, SMI, F, 1, S ),
++ CMD( MI_ARB_ON_OFF, SMI, F, 1, S ),
++ CMD( MI_SUSPEND_FLUSH, SMI, F, 1, S ),
++ CMD( MI_LOAD_SCAN_LINES_INCL, SMI, !F, 0x3F, S ),
++ CMD( MI_LOAD_SCAN_LINES_EXCL, SMI, !F, 0x3F, S ),
++ CMD( MI_STORE_DWORD_IMM, SMI, !F, 0x3FF, S ),
++ CMD( MI_LOAD_REGISTER_IMM(1), SMI, !F, 0xFF, W,
++ .reg = { .offset = 1, .mask = 0x007FFFFC, .step = 2 } ),
++ CMD( MI_UPDATE_GTT, SMI, !F, 0x3FF, S ),
++ CMD( MI_STORE_REGISTER_MEM_GEN8, SMI, F, 4, W,
++ .reg = { .offset = 1, .mask = 0x007FFFFC } ),
++ CMD( MI_FLUSH_DW, SMI, !F, 0x3F, S ),
++ CMD( MI_LOAD_REGISTER_MEM_GEN8, SMI, F, 4, W,
++ .reg = { .offset = 1, .mask = 0x007FFFFC } ),
++ CMD( MI_LOAD_REGISTER_REG, SMI, !F, 0xFF, W,
++ .reg = { .offset = 1, .mask = 0x007FFFFC, .step = 1 } ),
++
++ /*
++ * We allow BB_START but apply further checks. We just sanitize the
++ * basic fields here.
++ */
++#define MI_BB_START_OPERAND_MASK GENMASK(SMI-1, 0)
++#define MI_BB_START_OPERAND_EXPECT (MI_BATCH_PPGTT_HSW | 1)
++ CMD( MI_BATCH_BUFFER_START_GEN8, SMI, !F, 0xFF, B,
++ .bits = {{
++ .offset = 0,
++ .mask = MI_BB_START_OPERAND_MASK,
++ .expected = MI_BB_START_OPERAND_EXPECT,
++ }}, ),
++};
++
+ static const struct drm_i915_cmd_descriptor noop_desc =
+ CMD(MI_NOOP, SMI, F, 1, S);
+
+@@ -461,40 +509,44 @@ static const struct drm_i915_cmd_descriptor noop_desc =
+ #undef R
+ #undef W
+ #undef B
+-#undef M
+
+-static const struct drm_i915_cmd_table gen7_render_cmds[] = {
+- { common_cmds, ARRAY_SIZE(common_cmds) },
+- { render_cmds, ARRAY_SIZE(render_cmds) },
++static const struct drm_i915_cmd_table gen7_render_cmd_table[] = {
++ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) },
++ { gen7_render_cmds, ARRAY_SIZE(gen7_render_cmds) },
+ };
+
+-static const struct drm_i915_cmd_table hsw_render_ring_cmds[] = {
+- { common_cmds, ARRAY_SIZE(common_cmds) },
+- { render_cmds, ARRAY_SIZE(render_cmds) },
++static const struct drm_i915_cmd_table hsw_render_ring_cmd_table[] = {
++ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) },
++ { gen7_render_cmds, ARRAY_SIZE(gen7_render_cmds) },
+ { hsw_render_cmds, ARRAY_SIZE(hsw_render_cmds) },
+ };
+
+-static const struct drm_i915_cmd_table gen7_video_cmds[] = {
+- { common_cmds, ARRAY_SIZE(common_cmds) },
+- { video_cmds, ARRAY_SIZE(video_cmds) },
++static const struct drm_i915_cmd_table gen7_video_cmd_table[] = {
++ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) },
++ { gen7_video_cmds, ARRAY_SIZE(gen7_video_cmds) },
+ };
+
+-static const struct drm_i915_cmd_table hsw_vebox_cmds[] = {
+- { common_cmds, ARRAY_SIZE(common_cmds) },
+- { vecs_cmds, ARRAY_SIZE(vecs_cmds) },
++static const struct drm_i915_cmd_table hsw_vebox_cmd_table[] = {
++ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) },
++ { gen7_vecs_cmds, ARRAY_SIZE(gen7_vecs_cmds) },
+ };
+
+-static const struct drm_i915_cmd_table gen7_blt_cmds[] = {
+- { common_cmds, ARRAY_SIZE(common_cmds) },
+- { blt_cmds, ARRAY_SIZE(blt_cmds) },
++static const struct drm_i915_cmd_table gen7_blt_cmd_table[] = {
++ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) },
++ { gen7_blt_cmds, ARRAY_SIZE(gen7_blt_cmds) },
+ };
+
+-static const struct drm_i915_cmd_table hsw_blt_ring_cmds[] = {
+- { common_cmds, ARRAY_SIZE(common_cmds) },
+- { blt_cmds, ARRAY_SIZE(blt_cmds) },
++static const struct drm_i915_cmd_table hsw_blt_ring_cmd_table[] = {
++ { gen7_common_cmds, ARRAY_SIZE(gen7_common_cmds) },
++ { gen7_blt_cmds, ARRAY_SIZE(gen7_blt_cmds) },
+ { hsw_blt_cmds, ARRAY_SIZE(hsw_blt_cmds) },
+ };
+
++static const struct drm_i915_cmd_table gen9_blt_cmd_table[] = {
++ { gen9_blt_cmds, ARRAY_SIZE(gen9_blt_cmds) },
++};
++
++
+ /*
+ * Register whitelists, sorted by increasing register offset.
+ */
+@@ -610,17 +662,27 @@ static const struct drm_i915_reg_descriptor gen7_blt_regs[] = {
+ REG64_IDX(RING_TIMESTAMP, BLT_RING_BASE),
+ };
+
+-static const struct drm_i915_reg_descriptor ivb_master_regs[] = {
+- REG32(FORCEWAKE_MT),
+- REG32(DERRMR),
+- REG32(GEN7_PIPE_DE_LOAD_SL(PIPE_A)),
+- REG32(GEN7_PIPE_DE_LOAD_SL(PIPE_B)),
+- REG32(GEN7_PIPE_DE_LOAD_SL(PIPE_C)),
+-};
+-
+-static const struct drm_i915_reg_descriptor hsw_master_regs[] = {
+- REG32(FORCEWAKE_MT),
+- REG32(DERRMR),
++static const struct drm_i915_reg_descriptor gen9_blt_regs[] = {
++ REG64_IDX(RING_TIMESTAMP, RENDER_RING_BASE),
++ REG64_IDX(RING_TIMESTAMP, BSD_RING_BASE),
++ REG32(BCS_SWCTRL),
++ REG64_IDX(RING_TIMESTAMP, BLT_RING_BASE),
++ REG64_IDX(BCS_GPR, 0),
++ REG64_IDX(BCS_GPR, 1),
++ REG64_IDX(BCS_GPR, 2),
++ REG64_IDX(BCS_GPR, 3),
++ REG64_IDX(BCS_GPR, 4),
++ REG64_IDX(BCS_GPR, 5),
++ REG64_IDX(BCS_GPR, 6),
++ REG64_IDX(BCS_GPR, 7),
++ REG64_IDX(BCS_GPR, 8),
++ REG64_IDX(BCS_GPR, 9),
++ REG64_IDX(BCS_GPR, 10),
++ REG64_IDX(BCS_GPR, 11),
++ REG64_IDX(BCS_GPR, 12),
++ REG64_IDX(BCS_GPR, 13),
++ REG64_IDX(BCS_GPR, 14),
++ REG64_IDX(BCS_GPR, 15),
+ };
+
+ #undef REG64
+@@ -629,28 +691,27 @@ static const struct drm_i915_reg_descriptor hsw_master_regs[] = {
+ struct drm_i915_reg_table {
+ const struct drm_i915_reg_descriptor *regs;
+ int num_regs;
+- bool master;
+ };
+
+ static const struct drm_i915_reg_table ivb_render_reg_tables[] = {
+- { gen7_render_regs, ARRAY_SIZE(gen7_render_regs), false },
+- { ivb_master_regs, ARRAY_SIZE(ivb_master_regs), true },
++ { gen7_render_regs, ARRAY_SIZE(gen7_render_regs) },
+ };
+
+ static const struct drm_i915_reg_table ivb_blt_reg_tables[] = {
+- { gen7_blt_regs, ARRAY_SIZE(gen7_blt_regs), false },
+- { ivb_master_regs, ARRAY_SIZE(ivb_master_regs), true },
++ { gen7_blt_regs, ARRAY_SIZE(gen7_blt_regs) },
+ };
+
+ static const struct drm_i915_reg_table hsw_render_reg_tables[] = {
+- { gen7_render_regs, ARRAY_SIZE(gen7_render_regs), false },
+- { hsw_render_regs, ARRAY_SIZE(hsw_render_regs), false },
+- { hsw_master_regs, ARRAY_SIZE(hsw_master_regs), true },
++ { gen7_render_regs, ARRAY_SIZE(gen7_render_regs) },
++ { hsw_render_regs, ARRAY_SIZE(hsw_render_regs) },
+ };
+
+ static const struct drm_i915_reg_table hsw_blt_reg_tables[] = {
+- { gen7_blt_regs, ARRAY_SIZE(gen7_blt_regs), false },
+- { hsw_master_regs, ARRAY_SIZE(hsw_master_regs), true },
++ { gen7_blt_regs, ARRAY_SIZE(gen7_blt_regs) },
++};
++
++static const struct drm_i915_reg_table gen9_blt_reg_tables[] = {
++ { gen9_blt_regs, ARRAY_SIZE(gen9_blt_regs) },
+ };
+
+ static u32 gen7_render_get_cmd_length_mask(u32 cmd_header)
+@@ -708,6 +769,17 @@ static u32 gen7_blt_get_cmd_length_mask(u32 cmd_header)
+ return 0;
+ }
+
++static u32 gen9_blt_get_cmd_length_mask(u32 cmd_header)
++{
++ u32 client = cmd_header >> INSTR_CLIENT_SHIFT;
++
++ if (client == INSTR_MI_CLIENT || client == INSTR_BC_CLIENT)
++ return 0xFF;
++
++ DRM_DEBUG_DRIVER("CMD: Abnormal blt cmd length! 0x%08X\n", cmd_header);
++ return 0;
++}
++
+ static bool validate_cmds_sorted(const struct intel_engine_cs *engine,
+ const struct drm_i915_cmd_table *cmd_tables,
+ int cmd_table_count)
+@@ -865,18 +937,19 @@ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine)
+ int cmd_table_count;
+ int ret;
+
+- if (!IS_GEN7(engine->i915))
++ if (!IS_GEN7(engine->i915) && !(IS_GEN9(engine->i915) &&
++ engine->id == BCS))
+ return;
+
+ switch (engine->id) {
+ case RCS:
+ if (IS_HASWELL(engine->i915)) {
+- cmd_tables = hsw_render_ring_cmds;
++ cmd_tables = hsw_render_ring_cmd_table;
+ cmd_table_count =
+- ARRAY_SIZE(hsw_render_ring_cmds);
++ ARRAY_SIZE(hsw_render_ring_cmd_table);
+ } else {
+- cmd_tables = gen7_render_cmds;
+- cmd_table_count = ARRAY_SIZE(gen7_render_cmds);
++ cmd_tables = gen7_render_cmd_table;
++ cmd_table_count = ARRAY_SIZE(gen7_render_cmd_table);
+ }
+
+ if (IS_HASWELL(engine->i915)) {
+@@ -886,36 +959,46 @@ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine)
+ engine->reg_tables = ivb_render_reg_tables;
+ engine->reg_table_count = ARRAY_SIZE(ivb_render_reg_tables);
+ }
+-
+ engine->get_cmd_length_mask = gen7_render_get_cmd_length_mask;
+ break;
+ case VCS:
+- cmd_tables = gen7_video_cmds;
+- cmd_table_count = ARRAY_SIZE(gen7_video_cmds);
++ cmd_tables = gen7_video_cmd_table;
++ cmd_table_count = ARRAY_SIZE(gen7_video_cmd_table);
+ engine->get_cmd_length_mask = gen7_bsd_get_cmd_length_mask;
+ break;
+ case BCS:
+- if (IS_HASWELL(engine->i915)) {
+- cmd_tables = hsw_blt_ring_cmds;
+- cmd_table_count = ARRAY_SIZE(hsw_blt_ring_cmds);
++ engine->get_cmd_length_mask = gen7_blt_get_cmd_length_mask;
++ if (IS_GEN9(engine->i915)) {
++ cmd_tables = gen9_blt_cmd_table;
++ cmd_table_count = ARRAY_SIZE(gen9_blt_cmd_table);
++ engine->get_cmd_length_mask =
++ gen9_blt_get_cmd_length_mask;
++
++ /* BCS Engine unsafe without parser */
++ engine->flags |= I915_ENGINE_REQUIRES_CMD_PARSER;
++ } else if (IS_HASWELL(engine->i915)) {
++ cmd_tables = hsw_blt_ring_cmd_table;
++ cmd_table_count = ARRAY_SIZE(hsw_blt_ring_cmd_table);
+ } else {
+- cmd_tables = gen7_blt_cmds;
+- cmd_table_count = ARRAY_SIZE(gen7_blt_cmds);
++ cmd_tables = gen7_blt_cmd_table;
++ cmd_table_count = ARRAY_SIZE(gen7_blt_cmd_table);
+ }
+
+- if (IS_HASWELL(engine->i915)) {
++ if (IS_GEN9(engine->i915)) {
++ engine->reg_tables = gen9_blt_reg_tables;
++ engine->reg_table_count =
++ ARRAY_SIZE(gen9_blt_reg_tables);
++ } else if (IS_HASWELL(engine->i915)) {
+ engine->reg_tables = hsw_blt_reg_tables;
+ engine->reg_table_count = ARRAY_SIZE(hsw_blt_reg_tables);
+ } else {
+ engine->reg_tables = ivb_blt_reg_tables;
+ engine->reg_table_count = ARRAY_SIZE(ivb_blt_reg_tables);
+ }
+-
+- engine->get_cmd_length_mask = gen7_blt_get_cmd_length_mask;
+ break;
+ case VECS:
+- cmd_tables = hsw_vebox_cmds;
+- cmd_table_count = ARRAY_SIZE(hsw_vebox_cmds);
++ cmd_tables = hsw_vebox_cmd_table;
++ cmd_table_count = ARRAY_SIZE(hsw_vebox_cmd_table);
+ /* VECS can use the same length_mask function as VCS */
+ engine->get_cmd_length_mask = gen7_bsd_get_cmd_length_mask;
+ break;
+@@ -941,7 +1024,7 @@ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine)
+ return;
+ }
+
+- engine->flags |= I915_ENGINE_NEEDS_CMD_PARSER;
++ engine->flags |= I915_ENGINE_USING_CMD_PARSER;
+ }
+
+ /**
+@@ -953,7 +1036,7 @@ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine)
+ */
+ void intel_engine_cleanup_cmd_parser(struct intel_engine_cs *engine)
+ {
+- if (!intel_engine_needs_cmd_parser(engine))
++ if (!intel_engine_using_cmd_parser(engine))
+ return;
+
+ fini_hash_table(engine);
+@@ -1027,22 +1110,16 @@ __find_reg(const struct drm_i915_reg_descriptor *table, int count, u32 addr)
+ }
+
+ static const struct drm_i915_reg_descriptor *
+-find_reg(const struct intel_engine_cs *engine, bool is_master, u32 addr)
++find_reg(const struct intel_engine_cs *engine, u32 addr)
+ {
+ const struct drm_i915_reg_table *table = engine->reg_tables;
++ const struct drm_i915_reg_descriptor *reg = NULL;
+ int count = engine->reg_table_count;
+
+- for (; count > 0; ++table, --count) {
+- if (!table->master || is_master) {
+- const struct drm_i915_reg_descriptor *reg;
++ for (; !reg && (count > 0); ++table, --count)
++ reg = __find_reg(table->regs, table->num_regs, addr);
+
+- reg = __find_reg(table->regs, table->num_regs, addr);
+- if (reg != NULL)
+- return reg;
+- }
+- }
+-
+- return NULL;
++ return reg;
+ }
+
+ /* Returns a vmap'd pointer to dst_obj, which the caller must unmap */
+@@ -1127,8 +1204,7 @@ unpin_src:
+
+ static bool check_cmd(const struct intel_engine_cs *engine,
+ const struct drm_i915_cmd_descriptor *desc,
+- const u32 *cmd, u32 length,
+- const bool is_master)
++ const u32 *cmd, u32 length)
+ {
+ if (desc->flags & CMD_DESC_SKIP)
+ return true;
+@@ -1138,12 +1214,6 @@ static bool check_cmd(const struct intel_engine_cs *engine,
+ return false;
+ }
+
+- if ((desc->flags & CMD_DESC_MASTER) && !is_master) {
+- DRM_DEBUG_DRIVER("CMD: Rejected master-only command: 0x%08X\n",
+- *cmd);
+- return false;
+- }
+-
+ if (desc->flags & CMD_DESC_REGISTER) {
+ /*
+ * Get the distance between individual register offset
+@@ -1157,7 +1227,7 @@ static bool check_cmd(const struct intel_engine_cs *engine,
+ offset += step) {
+ const u32 reg_addr = cmd[offset] & desc->reg.mask;
+ const struct drm_i915_reg_descriptor *reg =
+- find_reg(engine, is_master, reg_addr);
++ find_reg(engine, reg_addr);
+
+ if (!reg) {
+ DRM_DEBUG_DRIVER("CMD: Rejected register 0x%08X in command: 0x%08X (%s)\n",
+@@ -1235,16 +1305,112 @@ static bool check_cmd(const struct intel_engine_cs *engine,
+ return true;
+ }
+
++static int check_bbstart(const struct i915_gem_context *ctx,
++ u32 *cmd, u32 offset, u32 length,
++ u32 batch_len,
++ u64 batch_start,
++ u64 shadow_batch_start)
++{
++ u64 jump_offset, jump_target;
++ u32 target_cmd_offset, target_cmd_index;
++
++ /* For igt compatibility on older platforms */
++ if (CMDPARSER_USES_GGTT(ctx->i915)) {
++ DRM_DEBUG("CMD: Rejecting BB_START for ggtt based submission\n");
++ return -EACCES;
++ }
++
++ if (length != 3) {
++ DRM_DEBUG("CMD: Recursive BB_START with bad length(%u)\n",
++ length);
++ return -EINVAL;
++ }
++
++ jump_target = *(u64*)(cmd+1);
++ jump_offset = jump_target - batch_start;
++
++ /*
++ * Any underflow of jump_target is guaranteed to be outside the range
++ * of a u32, so >= test catches both too large and too small
++ */
++ if (jump_offset >= batch_len) {
++ DRM_DEBUG("CMD: BB_START to 0x%llx jumps out of BB\n",
++ jump_target);
++ return -EINVAL;
++ }
++
++ /*
++ * This cannot overflow a u32 because we already checked jump_offset
++ * is within the BB, and the batch_len is a u32
++ */
++ target_cmd_offset = lower_32_bits(jump_offset);
++ target_cmd_index = target_cmd_offset / sizeof(u32);
++
++ *(u64*)(cmd + 1) = shadow_batch_start + target_cmd_offset;
++
++ if (target_cmd_index == offset)
++ return 0;
++
++ if (ctx->jump_whitelist_cmds <= target_cmd_index) {
++ DRM_DEBUG("CMD: Rejecting BB_START - truncated whitelist array\n");
++ return -EINVAL;
++ } else if (!test_bit(target_cmd_index, ctx->jump_whitelist)) {
++ DRM_DEBUG("CMD: BB_START to 0x%llx not a previously executed cmd\n",
++ jump_target);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++static void init_whitelist(struct i915_gem_context *ctx, u32 batch_len)
++{
++ const u32 batch_cmds = DIV_ROUND_UP(batch_len, sizeof(u32));
++ const u32 exact_size = BITS_TO_LONGS(batch_cmds);
++ u32 next_size = BITS_TO_LONGS(roundup_pow_of_two(batch_cmds));
++ unsigned long *next_whitelist;
++
++ if (CMDPARSER_USES_GGTT(ctx->i915))
++ return;
++
++ if (batch_cmds <= ctx->jump_whitelist_cmds) {
++ bitmap_zero(ctx->jump_whitelist, batch_cmds);
++ return;
++ }
++
++again:
++ next_whitelist = kcalloc(next_size, sizeof(long), GFP_KERNEL);
++ if (next_whitelist) {
++ kfree(ctx->jump_whitelist);
++ ctx->jump_whitelist = next_whitelist;
++ ctx->jump_whitelist_cmds =
++ next_size * BITS_PER_BYTE * sizeof(long);
++ return;
++ }
++
++ if (next_size > exact_size) {
++ next_size = exact_size;
++ goto again;
++ }
++
++ DRM_DEBUG("CMD: Failed to extend whitelist. BB_START may be disallowed\n");
++ bitmap_zero(ctx->jump_whitelist, ctx->jump_whitelist_cmds);
++
++ return;
++}
++
+ #define LENGTH_BIAS 2
+
+ /**
+ * i915_parse_cmds() - parse a submitted batch buffer for privilege violations
++ * @ctx: the context in which the batch is to execute
+ * @engine: the engine on which the batch is to execute
+ * @batch_obj: the batch buffer in question
+- * @shadow_batch_obj: copy of the batch buffer in question
++ * @batch_start: Canonical base address of batch
+ * @batch_start_offset: byte offset in the batch at which execution starts
+ * @batch_len: length of the commands in batch_obj
+- * @is_master: is the submitting process the drm master?
++ * @shadow_batch_obj: copy of the batch buffer in question
++ * @shadow_batch_start: Canonical base address of shadow_batch_obj
+ *
+ * Parses the specified batch buffer looking for privilege violations as
+ * described in the overview.
+@@ -1252,14 +1418,17 @@ static bool check_cmd(const struct intel_engine_cs *engine,
+ * Return: non-zero if the parser finds violations or otherwise fails; -EACCES
+ * if the batch appears legal but should use hardware parsing
+ */
+-int intel_engine_cmd_parser(struct intel_engine_cs *engine,
++
++int intel_engine_cmd_parser(struct i915_gem_context *ctx,
++ struct intel_engine_cs *engine,
+ struct drm_i915_gem_object *batch_obj,
+- struct drm_i915_gem_object *shadow_batch_obj,
++ u64 batch_start,
+ u32 batch_start_offset,
+ u32 batch_len,
+- bool is_master)
++ struct drm_i915_gem_object *shadow_batch_obj,
++ u64 shadow_batch_start)
+ {
+- u32 *cmd, *batch_end;
++ u32 *cmd, *batch_end, offset = 0;
+ struct drm_i915_cmd_descriptor default_desc = noop_desc;
+ const struct drm_i915_cmd_descriptor *desc = &default_desc;
+ bool needs_clflush_after = false;
+@@ -1273,6 +1442,8 @@ int intel_engine_cmd_parser(struct intel_engine_cs *engine,
+ return PTR_ERR(cmd);
+ }
+
++ init_whitelist(ctx, batch_len);
++
+ /*
+ * We use the batch length as size because the shadow object is as
+ * large or larger and copy_batch() will write MI_NOPs to the extra
+@@ -1282,31 +1453,15 @@ int intel_engine_cmd_parser(struct intel_engine_cs *engine,
+ do {
+ u32 length;
+
+- if (*cmd == MI_BATCH_BUFFER_END) {
+- if (needs_clflush_after) {
+- void *ptr = page_mask_bits(shadow_batch_obj->mm.mapping);
+- drm_clflush_virt_range(ptr,
+- (void *)(cmd + 1) - ptr);
+- }
++ if (*cmd == MI_BATCH_BUFFER_END)
+ break;
+- }
+
+ desc = find_cmd(engine, *cmd, desc, &default_desc);
+ if (!desc) {
+ DRM_DEBUG_DRIVER("CMD: Unrecognized command: 0x%08X\n",
+ *cmd);
+ ret = -EINVAL;
+- break;
+- }
+-
+- /*
+- * If the batch buffer contains a chained batch, return an
+- * error that tells the caller to abort and dispatch the
+- * workload as a non-secure batch.
+- */
+- if (desc->cmd.value == MI_BATCH_BUFFER_START) {
+- ret = -EACCES;
+- break;
++ goto err;
+ }
+
+ if (desc->flags & CMD_DESC_FIXED)
+@@ -1320,22 +1475,43 @@ int intel_engine_cmd_parser(struct intel_engine_cs *engine,
+ length,
+ batch_end - cmd);
+ ret = -EINVAL;
+- break;
++ goto err;
+ }
+
+- if (!check_cmd(engine, desc, cmd, length, is_master)) {
++ if (!check_cmd(engine, desc, cmd, length)) {
+ ret = -EACCES;
++ goto err;
++ }
++
++ if (desc->cmd.value == MI_BATCH_BUFFER_START) {
++ ret = check_bbstart(ctx, cmd, offset, length,
++ batch_len, batch_start,
++ shadow_batch_start);
++
++ if (ret)
++ goto err;
+ break;
+ }
+
++ if (ctx->jump_whitelist_cmds > offset)
++ set_bit(offset, ctx->jump_whitelist);
++
+ cmd += length;
++ offset += length;
+ if (cmd >= batch_end) {
+ DRM_DEBUG_DRIVER("CMD: Got to the end of the buffer w/o a BBE cmd!\n");
+ ret = -EINVAL;
+- break;
++ goto err;
+ }
+ } while (1);
+
++ if (needs_clflush_after) {
++ void *ptr = page_mask_bits(shadow_batch_obj->mm.mapping);
++
++ drm_clflush_virt_range(ptr, (void *)(cmd + 1) - ptr);
++ }
++
++err:
+ i915_gem_object_unpin_map(shadow_batch_obj);
+ return ret;
+ }
+@@ -1357,7 +1533,7 @@ int i915_cmd_parser_get_version(struct drm_i915_private *dev_priv)
+
+ /* If the command parser is not enabled, report 0 - unsupported */
+ for_each_engine(engine, dev_priv, id) {
+- if (intel_engine_needs_cmd_parser(engine)) {
++ if (intel_engine_using_cmd_parser(engine)) {
+ active = true;
+ break;
+ }
+@@ -1382,6 +1558,7 @@ int i915_cmd_parser_get_version(struct drm_i915_private *dev_priv)
+ * the parser enabled.
+ * 9. Don't whitelist or handle oacontrol specially, as ownership
+ * for oacontrol state is moving to i915-perf.
++ * 10. Support for Gen9 BCS Parsing
+ */
+- return 9;
++ return 10;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index a4b4ab7b9f8e..b0d76a7a0946 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -351,7 +351,7 @@ static int i915_getparam_ioctl(struct drm_device *dev, void *data,
+ value = HAS_LEGACY_SEMAPHORES(dev_priv);
+ break;
+ case I915_PARAM_HAS_SECURE_BATCHES:
+- value = capable(CAP_SYS_ADMIN);
++ value = HAS_SECURE_BATCHES(dev_priv) && capable(CAP_SYS_ADMIN);
+ break;
+ case I915_PARAM_CMD_PARSER_VERSION:
+ value = i915_cmd_parser_get_version(dev_priv);
+@@ -1627,6 +1627,7 @@ static int i915_drm_suspend_late(struct drm_device *dev, bool hibernation)
+ i915_gem_suspend_late(dev_priv);
+
+ intel_display_set_init_power(dev_priv, false);
++ i915_rc6_ctx_wa_suspend(dev_priv);
+ intel_uncore_suspend(dev_priv);
+
+ /*
+@@ -1853,6 +1854,8 @@ static int i915_drm_resume_early(struct drm_device *dev)
+ else
+ intel_display_set_init_power(dev_priv, true);
+
++ i915_rc6_ctx_wa_resume(dev_priv);
++
+ intel_engines_sanitize(dev_priv);
+
+ enable_rpm_wakeref_asserts(dev_priv);
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index d6c25bea4382..db2e9af49ae6 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -801,6 +801,7 @@ struct intel_rps {
+
+ struct intel_rc6 {
+ bool enabled;
++ bool ctx_corrupted;
+ u64 prev_hw_residency[4];
+ u64 cur_residency[4];
+ };
+@@ -2496,6 +2497,12 @@ intel_info(const struct drm_i915_private *dev_priv)
+ #define IS_GEN9_LP(dev_priv) (IS_GEN9(dev_priv) && IS_LP(dev_priv))
+ #define IS_GEN9_BC(dev_priv) (IS_GEN9(dev_priv) && !IS_LP(dev_priv))
+
++/*
++ * The Gen7 cmdparser copies the scanned buffer to the ggtt for execution
++ * All later gens can run the final buffer from the ppgtt
++ */
++#define CMDPARSER_USES_GGTT(dev_priv) IS_GEN7(dev_priv)
++
+ #define ENGINE_MASK(id) BIT(id)
+ #define RENDER_RING ENGINE_MASK(RCS)
+ #define BSD_RING ENGINE_MASK(VCS)
+@@ -2517,6 +2524,8 @@ intel_info(const struct drm_i915_private *dev_priv)
+
+ #define HAS_LEGACY_SEMAPHORES(dev_priv) IS_GEN7(dev_priv)
+
++#define HAS_SECURE_BATCHES(dev_priv) (INTEL_GEN(dev_priv) < 6)
++
+ #define HAS_LLC(dev_priv) ((dev_priv)->info.has_llc)
+ #define HAS_SNOOP(dev_priv) ((dev_priv)->info.has_snoop)
+ #define HAS_EDRAM(dev_priv) (!!((dev_priv)->edram_cap & EDRAM_ENABLED))
+@@ -2549,10 +2558,12 @@ intel_info(const struct drm_i915_private *dev_priv)
+ /* Early gen2 have a totally busted CS tlb and require pinned batches. */
+ #define HAS_BROKEN_CS_TLB(dev_priv) (IS_I830(dev_priv) || IS_I845G(dev_priv))
+
++#define NEEDS_RC6_CTX_CORRUPTION_WA(dev_priv) \
++ (IS_BROADWELL(dev_priv) || INTEL_GEN(dev_priv) == 9)
++
+ /* WaRsDisableCoarsePowerGating:skl,cnl */
+ #define NEEDS_WaRsDisableCoarsePowerGating(dev_priv) \
+- (IS_CANNONLAKE(dev_priv) || \
+- IS_SKL_GT3(dev_priv) || IS_SKL_GT4(dev_priv))
++ (IS_CANNONLAKE(dev_priv) || INTEL_GEN(dev_priv) == 9)
+
+ #define HAS_GMBUS_IRQ(dev_priv) (INTEL_GEN(dev_priv) >= 4)
+ #define HAS_GMBUS_BURST_READ(dev_priv) (INTEL_GEN(dev_priv) >= 10 || \
+@@ -2944,6 +2955,14 @@ i915_gem_object_ggtt_pin(struct drm_i915_gem_object *obj,
+ u64 alignment,
+ u64 flags);
+
++struct i915_vma * __must_check
++i915_gem_object_pin(struct drm_i915_gem_object *obj,
++ struct i915_address_space *vm,
++ const struct i915_ggtt_view *view,
++ u64 size,
++ u64 alignment,
++ u64 flags);
++
+ int i915_gem_object_unbind(struct drm_i915_gem_object *obj);
+ void i915_gem_release_mmap(struct drm_i915_gem_object *obj);
+
+@@ -3337,12 +3356,14 @@ const char *i915_cache_level_str(struct drm_i915_private *i915, int type);
+ int i915_cmd_parser_get_version(struct drm_i915_private *dev_priv);
+ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine);
+ void intel_engine_cleanup_cmd_parser(struct intel_engine_cs *engine);
+-int intel_engine_cmd_parser(struct intel_engine_cs *engine,
++int intel_engine_cmd_parser(struct i915_gem_context *cxt,
++ struct intel_engine_cs *engine,
+ struct drm_i915_gem_object *batch_obj,
+- struct drm_i915_gem_object *shadow_batch_obj,
++ u64 user_batch_start,
+ u32 batch_start_offset,
+ u32 batch_len,
+- bool is_master);
++ struct drm_i915_gem_object *shadow_batch_obj,
++ u64 shadow_batch_start);
+
+ /* i915_perf.c */
+ extern void i915_perf_init(struct drm_i915_private *dev_priv);
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 937287710042..c7d05ac7af3c 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -174,6 +174,11 @@ static u32 __i915_gem_park(struct drm_i915_private *i915)
+ if (INTEL_GEN(i915) >= 6)
+ gen6_rps_idle(i915);
+
++ if (NEEDS_RC6_CTX_CORRUPTION_WA(i915)) {
++ i915_rc6_ctx_wa_check(i915);
++ intel_uncore_forcewake_put(i915, FORCEWAKE_ALL);
++ }
++
+ intel_display_power_put(i915, POWER_DOMAIN_GT_IRQ);
+
+ intel_runtime_pm_put(i915);
+@@ -220,6 +225,9 @@ void i915_gem_unpark(struct drm_i915_private *i915)
+ */
+ intel_display_power_get(i915, POWER_DOMAIN_GT_IRQ);
+
++ if (NEEDS_RC6_CTX_CORRUPTION_WA(i915))
++ intel_uncore_forcewake_get(i915, FORCEWAKE_ALL);
++
+ i915->gt.awake = true;
+ if (unlikely(++i915->gt.epoch == 0)) /* keep 0 as invalid */
+ i915->gt.epoch = 1;
+@@ -4425,6 +4433,20 @@ i915_gem_object_ggtt_pin(struct drm_i915_gem_object *obj,
+ {
+ struct drm_i915_private *dev_priv = to_i915(obj->base.dev);
+ struct i915_address_space *vm = &dev_priv->ggtt.vm;
++
++ return i915_gem_object_pin(obj, vm, view, size, alignment,
++ flags | PIN_GLOBAL);
++}
++
++struct i915_vma *
++i915_gem_object_pin(struct drm_i915_gem_object *obj,
++ struct i915_address_space *vm,
++ const struct i915_ggtt_view *view,
++ u64 size,
++ u64 alignment,
++ u64 flags)
++{
++ struct drm_i915_private *dev_priv = to_i915(obj->base.dev);
+ struct i915_vma *vma;
+ int ret;
+
+@@ -4488,7 +4510,7 @@ i915_gem_object_ggtt_pin(struct drm_i915_gem_object *obj,
+ return ERR_PTR(ret);
+ }
+
+- ret = i915_vma_pin(vma, size, alignment, flags | PIN_GLOBAL);
++ ret = i915_vma_pin(vma, size, alignment, flags);
+ if (ret)
+ return ERR_PTR(ret);
+
+diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
+index b10770cfccd2..7a0e6dbbad2e 100644
+--- a/drivers/gpu/drm/i915/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/i915_gem_context.c
+@@ -124,6 +124,8 @@ static void i915_gem_context_free(struct i915_gem_context *ctx)
+
+ i915_ppgtt_put(ctx->ppgtt);
+
++ kfree(ctx->jump_whitelist);
++
+ for (n = 0; n < ARRAY_SIZE(ctx->__engine); n++) {
+ struct intel_context *ce = &ctx->__engine[n];
+
+@@ -339,6 +341,9 @@ __create_hw_context(struct drm_i915_private *dev_priv,
+ else
+ ctx->ggtt_offset_bias = I915_GTT_PAGE_SIZE;
+
++ ctx->jump_whitelist = NULL;
++ ctx->jump_whitelist_cmds = 0;
++
+ return ctx;
+
+ err_pid:
+diff --git a/drivers/gpu/drm/i915/i915_gem_context.h b/drivers/gpu/drm/i915/i915_gem_context.h
+index b116e4942c10..834d3951d8a9 100644
+--- a/drivers/gpu/drm/i915/i915_gem_context.h
++++ b/drivers/gpu/drm/i915/i915_gem_context.h
+@@ -183,6 +183,12 @@ struct i915_gem_context {
+ /** remap_slice: Bitmask of cache lines that need remapping */
+ u8 remap_slice;
+
++ /** jump_whitelist: Bit array for tracking cmds during cmdparsing */
++ unsigned long *jump_whitelist;
++
++ /** jump_whitelist_cmds: No of cmd slots available */
++ u32 jump_whitelist_cmds;
++
+ /** handles_vma: rbtree to look up our context specific obj/vma for
+ * the user handle. (user handles are per fd, but the binding is
+ * per vm, which may be one per context or shared with the global GTT)
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index 679bbae52945..f08c54740cbe 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -309,7 +309,9 @@ static inline u64 gen8_noncanonical_addr(u64 address)
+
+ static inline bool eb_use_cmdparser(const struct i915_execbuffer *eb)
+ {
+- return intel_engine_needs_cmd_parser(eb->engine) && eb->batch_len;
++ return intel_engine_requires_cmd_parser(eb->engine) ||
++ (intel_engine_using_cmd_parser(eb->engine) &&
++ eb->args->batch_len);
+ }
+
+ static int eb_create(struct i915_execbuffer *eb)
+@@ -1893,10 +1895,38 @@ static int i915_reset_gen7_sol_offsets(struct i915_request *rq)
+ return 0;
+ }
+
+-static struct i915_vma *eb_parse(struct i915_execbuffer *eb, bool is_master)
++static struct i915_vma *
++shadow_batch_pin(struct i915_execbuffer *eb, struct drm_i915_gem_object *obj)
++{
++ struct drm_i915_private *dev_priv = eb->i915;
++ struct i915_address_space *vm;
++ u64 flags;
++
++ /*
++ * PPGTT backed shadow buffers must be mapped RO, to prevent
++ * post-scan tampering
++ */
++ if (CMDPARSER_USES_GGTT(dev_priv)) {
++ flags = PIN_GLOBAL;
++ vm = &dev_priv->ggtt.vm;
++ } else if (eb->vm->has_read_only) {
++ flags = PIN_USER;
++ vm = eb->vm;
++ i915_gem_object_set_readonly(obj);
++ } else {
++ DRM_DEBUG("Cannot prevent post-scan tampering without RO capable vm\n");
++ return ERR_PTR(-EINVAL);
++ }
++
++ return i915_gem_object_pin(obj, vm, NULL, 0, 0, flags);
++}
++
++static struct i915_vma *eb_parse(struct i915_execbuffer *eb)
+ {
+ struct drm_i915_gem_object *shadow_batch_obj;
+ struct i915_vma *vma;
++ u64 batch_start;
++ u64 shadow_batch_start;
+ int err;
+
+ shadow_batch_obj = i915_gem_batch_pool_get(&eb->engine->batch_pool,
+@@ -1904,29 +1934,54 @@ static struct i915_vma *eb_parse(struct i915_execbuffer *eb, bool is_master)
+ if (IS_ERR(shadow_batch_obj))
+ return ERR_CAST(shadow_batch_obj);
+
+- err = intel_engine_cmd_parser(eb->engine,
++ vma = shadow_batch_pin(eb, shadow_batch_obj);
++ if (IS_ERR(vma))
++ goto out;
++
++ batch_start = gen8_canonical_addr(eb->batch->node.start) +
++ eb->batch_start_offset;
++
++ shadow_batch_start = gen8_canonical_addr(vma->node.start);
++
++ err = intel_engine_cmd_parser(eb->ctx,
++ eb->engine,
+ eb->batch->obj,
+- shadow_batch_obj,
++ batch_start,
+ eb->batch_start_offset,
+ eb->batch_len,
+- is_master);
++ shadow_batch_obj,
++ shadow_batch_start);
++
+ if (err) {
+- if (err == -EACCES) /* unhandled chained batch */
++ i915_vma_unpin(vma);
++
++ /*
++ * Unsafe GGTT-backed buffers can still be submitted safely
++ * as non-secure.
++ * For PPGTT backing however, we have no choice but to forcibly
++ * reject unsafe buffers
++ */
++ if (CMDPARSER_USES_GGTT(eb->i915) && (err == -EACCES))
++ /* Execute original buffer non-secure */
+ vma = NULL;
+ else
+ vma = ERR_PTR(err);
+- goto out;
+- }
+
+- vma = i915_gem_object_ggtt_pin(shadow_batch_obj, NULL, 0, 0, 0);
+- if (IS_ERR(vma))
+ goto out;
++ }
+
+ eb->vma[eb->buffer_count] = i915_vma_get(vma);
+ eb->flags[eb->buffer_count] =
+ __EXEC_OBJECT_HAS_PIN | __EXEC_OBJECT_HAS_REF;
+ vma->exec_flags = &eb->flags[eb->buffer_count];
+ eb->buffer_count++;
++ eb->batch_start_offset = 0;
++ eb->batch = vma;
++
++ /* eb->batch_len unchanged */
++
++ if (CMDPARSER_USES_GGTT(eb->i915))
++ eb->batch_flags |= I915_DISPATCH_SECURE;
+
+ out:
+ i915_gem_object_unpin_pages(shadow_batch_obj);
+@@ -2177,6 +2232,7 @@ i915_gem_do_execbuffer(struct drm_device *dev,
+ struct drm_i915_gem_exec_object2 *exec,
+ struct drm_syncobj **fences)
+ {
++ struct drm_i915_private *i915 = to_i915(dev);
+ struct i915_execbuffer eb;
+ struct dma_fence *in_fence = NULL;
+ struct sync_file *out_fence = NULL;
+@@ -2187,7 +2243,7 @@ i915_gem_do_execbuffer(struct drm_device *dev,
+ BUILD_BUG_ON(__EXEC_OBJECT_INTERNAL_FLAGS &
+ ~__EXEC_OBJECT_UNKNOWN_FLAGS);
+
+- eb.i915 = to_i915(dev);
++ eb.i915 = i915;
+ eb.file = file;
+ eb.args = args;
+ if (DBG_FORCE_RELOC || !(args->flags & I915_EXEC_NO_RELOC))
+@@ -2209,8 +2265,15 @@ i915_gem_do_execbuffer(struct drm_device *dev,
+
+ eb.batch_flags = 0;
+ if (args->flags & I915_EXEC_SECURE) {
++ if (INTEL_GEN(i915) >= 11)
++ return -ENODEV;
++
++ /* Return -EPERM to trigger fallback code on old binaries. */
++ if (!HAS_SECURE_BATCHES(i915))
++ return -EPERM;
++
+ if (!drm_is_current_master(file) || !capable(CAP_SYS_ADMIN))
+- return -EPERM;
++ return -EPERM;
+
+ eb.batch_flags |= I915_DISPATCH_SECURE;
+ }
+@@ -2297,34 +2360,19 @@ i915_gem_do_execbuffer(struct drm_device *dev,
+ goto err_vma;
+ }
+
++ if (eb.batch_len == 0)
++ eb.batch_len = eb.batch->size - eb.batch_start_offset;
++
+ if (eb_use_cmdparser(&eb)) {
+ struct i915_vma *vma;
+
+- vma = eb_parse(&eb, drm_is_current_master(file));
++ vma = eb_parse(&eb);
+ if (IS_ERR(vma)) {
+ err = PTR_ERR(vma);
+ goto err_vma;
+ }
+-
+- if (vma) {
+- /*
+- * Batch parsed and accepted:
+- *
+- * Set the DISPATCH_SECURE bit to remove the NON_SECURE
+- * bit from MI_BATCH_BUFFER_START commands issued in
+- * the dispatch_execbuffer implementations. We
+- * specifically don't want that set on batches the
+- * command parser has accepted.
+- */
+- eb.batch_flags |= I915_DISPATCH_SECURE;
+- eb.batch_start_offset = 0;
+- eb.batch = vma;
+- }
+ }
+
+- if (eb.batch_len == 0)
+- eb.batch_len = eb.batch->size - eb.batch_start_offset;
+-
+ /*
+ * snb/ivb/vlv conflate the "batch in ppgtt" bit with the "non-secure
+ * batch" bit. Hence we need to pin secure batches into the global gtt.
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
+index 87411a5aba77..d4c6aa7fbac8 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -158,7 +158,8 @@ int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
+ if (enable_ppgtt == 0 && INTEL_GEN(dev_priv) < 9)
+ return 0;
+
+- if (enable_ppgtt == 1)
++ /* Full PPGTT is required by the Gen9 cmdparser */
++ if (enable_ppgtt == 1 && INTEL_GEN(dev_priv) != 9)
+ return 1;
+
+ if (enable_ppgtt == 2 && has_full_ppgtt)
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 4e070afb2738..a6f4f32dd71c 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -387,6 +387,8 @@ static inline bool i915_mmio_reg_valid(i915_reg_t reg)
+ #define ECOCHK_PPGTT_WT_HSW (0x2 << 3)
+ #define ECOCHK_PPGTT_WB_HSW (0x3 << 3)
+
++#define GEN8_RC6_CTX_INFO _MMIO(0x8504)
++
+ #define GAC_ECO_BITS _MMIO(0x14090)
+ #define ECOBITS_SNB_BIT (1 << 13)
+ #define ECOBITS_PPGTT_CACHE64B (3 << 8)
+@@ -471,6 +473,10 @@ static inline bool i915_mmio_reg_valid(i915_reg_t reg)
+ */
+ #define BCS_SWCTRL _MMIO(0x22200)
+
++/* There are 16 GPR registers */
++#define BCS_GPR(n) _MMIO(0x22600 + (n) * 8)
++#define BCS_GPR_UDW(n) _MMIO(0x22600 + (n) * 8 + 4)
++
+ #define GPGPU_THREADS_DISPATCHED _MMIO(0x2290)
+ #define GPGPU_THREADS_DISPATCHED_UDW _MMIO(0x2290 + 4)
+ #define HS_INVOCATION_COUNT _MMIO(0x2300)
+@@ -7005,6 +7011,10 @@ enum {
+ #define SKL_CSR_DC5_DC6_COUNT _MMIO(0x8002C)
+ #define BXT_CSR_DC3_DC5_COUNT _MMIO(0x80038)
+
++/* Display Internal Timeout Register */
++#define RM_TIMEOUT _MMIO(0x42060)
++#define MMIO_TIMEOUT_US(us) ((us) << 0)
++
+ /* interrupts */
+ #define DE_MASTER_IRQ_CONTROL (1 << 31)
+ #define DE_SPRITEB_FLIP_DONE (1 << 29)
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index 50d56498de77..b1154d803564 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -2064,6 +2064,9 @@ void intel_sanitize_gt_powersave(struct drm_i915_private *dev_priv);
+ void intel_enable_gt_powersave(struct drm_i915_private *dev_priv);
+ void intel_disable_gt_powersave(struct drm_i915_private *dev_priv);
+ void intel_suspend_gt_powersave(struct drm_i915_private *dev_priv);
++bool i915_rc6_ctx_wa_check(struct drm_i915_private *i915);
++void i915_rc6_ctx_wa_suspend(struct drm_i915_private *i915);
++void i915_rc6_ctx_wa_resume(struct drm_i915_private *i915);
+ void gen6_rps_busy(struct drm_i915_private *dev_priv);
+ void gen6_rps_reset_ei(struct drm_i915_private *dev_priv);
+ void gen6_rps_idle(struct drm_i915_private *dev_priv);
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 425df814de75..8d731eb1de69 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -114,6 +114,14 @@ static void bxt_init_clock_gating(struct drm_i915_private *dev_priv)
+ */
+ I915_WRITE(GEN9_CLKGATE_DIS_0, I915_READ(GEN9_CLKGATE_DIS_0) |
+ PWM1_GATING_DIS | PWM2_GATING_DIS);
++
++ /*
++ * Lower the display internal timeout.
++ * This is needed to avoid any hard hangs when DSI port PLL
++ * is off and a MMIO access is attempted by any privilege
++ * application, using batch buffers or any other means.
++ */
++ I915_WRITE(RM_TIMEOUT, MMIO_TIMEOUT_US(950));
+ }
+
+ static void glk_init_clock_gating(struct drm_i915_private *dev_priv)
+@@ -8188,6 +8196,95 @@ static void intel_init_emon(struct drm_i915_private *dev_priv)
+ dev_priv->ips.corr = (lcfuse & LCFUSE_HIV_MASK);
+ }
+
++static bool i915_rc6_ctx_corrupted(struct drm_i915_private *dev_priv)
++{
++ return !I915_READ(GEN8_RC6_CTX_INFO);
++}
++
++static void i915_rc6_ctx_wa_init(struct drm_i915_private *i915)
++{
++ if (!NEEDS_RC6_CTX_CORRUPTION_WA(i915))
++ return;
++
++ if (i915_rc6_ctx_corrupted(i915)) {
++ DRM_INFO("RC6 context corrupted, disabling runtime power management\n");
++ i915->gt_pm.rc6.ctx_corrupted = true;
++ intel_runtime_pm_get(i915);
++ }
++}
++
++static void i915_rc6_ctx_wa_cleanup(struct drm_i915_private *i915)
++{
++ if (i915->gt_pm.rc6.ctx_corrupted) {
++ intel_runtime_pm_put(i915);
++ i915->gt_pm.rc6.ctx_corrupted = false;
++ }
++}
++
++/**
++ * i915_rc6_ctx_wa_suspend - system suspend sequence for the RC6 CTX WA
++ * @i915: i915 device
++ *
++ * Perform any steps needed to clean up the RC6 CTX WA before system suspend.
++ */
++void i915_rc6_ctx_wa_suspend(struct drm_i915_private *i915)
++{
++ if (i915->gt_pm.rc6.ctx_corrupted)
++ intel_runtime_pm_put(i915);
++}
++
++/**
++ * i915_rc6_ctx_wa_resume - system resume sequence for the RC6 CTX WA
++ * @i915: i915 device
++ *
++ * Perform any steps needed to re-init the RC6 CTX WA after system resume.
++ */
++void i915_rc6_ctx_wa_resume(struct drm_i915_private *i915)
++{
++ if (!i915->gt_pm.rc6.ctx_corrupted)
++ return;
++
++ if (i915_rc6_ctx_corrupted(i915)) {
++ intel_runtime_pm_get(i915);
++ return;
++ }
++
++ DRM_INFO("RC6 context restored, re-enabling runtime power management\n");
++ i915->gt_pm.rc6.ctx_corrupted = false;
++}
++
++static void intel_disable_rc6(struct drm_i915_private *dev_priv);
++
++/**
++ * i915_rc6_ctx_wa_check - check for a new RC6 CTX corruption
++ * @i915: i915 device
++ *
++ * Check if an RC6 CTX corruption has happened since the last check and if so
++ * disable RC6 and runtime power management.
++ *
++ * Return false if no context corruption has happened since the last call of
++ * this function, true otherwise.
++*/
++bool i915_rc6_ctx_wa_check(struct drm_i915_private *i915)
++{
++ if (!NEEDS_RC6_CTX_CORRUPTION_WA(i915))
++ return false;
++
++ if (i915->gt_pm.rc6.ctx_corrupted)
++ return false;
++
++ if (!i915_rc6_ctx_corrupted(i915))
++ return false;
++
++ DRM_NOTE("RC6 context corruption, disabling runtime power management\n");
++
++ intel_disable_rc6(i915);
++ i915->gt_pm.rc6.ctx_corrupted = true;
++ intel_runtime_pm_get_noresume(i915);
++
++ return true;
++}
++
+ void intel_init_gt_powersave(struct drm_i915_private *dev_priv)
+ {
+ struct intel_rps *rps = &dev_priv->gt_pm.rps;
+@@ -8203,6 +8300,8 @@ void intel_init_gt_powersave(struct drm_i915_private *dev_priv)
+
+ mutex_lock(&dev_priv->pcu_lock);
+
++ i915_rc6_ctx_wa_init(dev_priv);
++
+ /* Initialize RPS limits (for userspace) */
+ if (IS_CHERRYVIEW(dev_priv))
+ cherryview_init_gt_powersave(dev_priv);
+@@ -8249,6 +8348,8 @@ void intel_cleanup_gt_powersave(struct drm_i915_private *dev_priv)
+ if (IS_VALLEYVIEW(dev_priv))
+ valleyview_cleanup_gt_powersave(dev_priv);
+
++ i915_rc6_ctx_wa_cleanup(dev_priv);
++
+ if (!HAS_RC6(dev_priv))
+ intel_runtime_pm_put(dev_priv);
+ }
+@@ -8293,7 +8394,7 @@ static inline void intel_disable_llc_pstate(struct drm_i915_private *i915)
+ i915->gt_pm.llc_pstate.enabled = false;
+ }
+
+-static void intel_disable_rc6(struct drm_i915_private *dev_priv)
++static void __intel_disable_rc6(struct drm_i915_private *dev_priv)
+ {
+ lockdep_assert_held(&dev_priv->pcu_lock);
+
+@@ -8312,6 +8413,13 @@ static void intel_disable_rc6(struct drm_i915_private *dev_priv)
+ dev_priv->gt_pm.rc6.enabled = false;
+ }
+
++static void intel_disable_rc6(struct drm_i915_private *dev_priv)
++{
++ mutex_lock(&dev_priv->pcu_lock);
++ __intel_disable_rc6(dev_priv);
++ mutex_unlock(&dev_priv->pcu_lock);
++}
++
+ static void intel_disable_rps(struct drm_i915_private *dev_priv)
+ {
+ lockdep_assert_held(&dev_priv->pcu_lock);
+@@ -8337,7 +8445,7 @@ void intel_disable_gt_powersave(struct drm_i915_private *dev_priv)
+ {
+ mutex_lock(&dev_priv->pcu_lock);
+
+- intel_disable_rc6(dev_priv);
++ __intel_disable_rc6(dev_priv);
+ intel_disable_rps(dev_priv);
+ if (HAS_LLC(dev_priv))
+ intel_disable_llc_pstate(dev_priv);
+@@ -8364,6 +8472,9 @@ static void intel_enable_rc6(struct drm_i915_private *dev_priv)
+ if (dev_priv->gt_pm.rc6.enabled)
+ return;
+
++ if (dev_priv->gt_pm.rc6.ctx_corrupted)
++ return;
++
+ if (IS_CHERRYVIEW(dev_priv))
+ cherryview_enable_rc6(dev_priv);
+ else if (IS_VALLEYVIEW(dev_priv))
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
+index f5ffa6d31e82..eaf1a161bc96 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
+@@ -584,9 +584,10 @@ struct intel_engine_cs {
+
+ struct intel_engine_hangcheck hangcheck;
+
+-#define I915_ENGINE_NEEDS_CMD_PARSER BIT(0)
+-#define I915_ENGINE_SUPPORTS_STATS BIT(1)
+-#define I915_ENGINE_HAS_PREEMPTION BIT(2)
++#define I915_ENGINE_USING_CMD_PARSER BIT(0)
++#define I915_ENGINE_SUPPORTS_STATS BIT(1)
++#define I915_ENGINE_HAS_PREEMPTION BIT(2)
++#define I915_ENGINE_REQUIRES_CMD_PARSER BIT(3)
+ unsigned int flags;
+
+ /*
+@@ -647,9 +648,15 @@ struct intel_engine_cs {
+ };
+
+ static inline bool
+-intel_engine_needs_cmd_parser(const struct intel_engine_cs *engine)
++intel_engine_using_cmd_parser(const struct intel_engine_cs *engine)
+ {
+- return engine->flags & I915_ENGINE_NEEDS_CMD_PARSER;
++ return engine->flags & I915_ENGINE_USING_CMD_PARSER;
++}
++
++static inline bool
++intel_engine_requires_cmd_parser(const struct intel_engine_cs *engine)
++{
++ return engine->flags & I915_ENGINE_REQUIRES_CMD_PARSER;
+ }
+
+ static inline bool
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index 0a785ef0ab66..db2d8b84e137 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -1956,6 +1956,7 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev)
+ case 0x682C:
+ si_pi->cac_weights = cac_weights_cape_verde_pro;
+ si_pi->dte_data = dte_data_sun_xt;
++ update_dte_from_pl2 = true;
+ break;
+ case 0x6825:
+ case 0x6827:
+diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c
+index 6bf4da7ad63a..8cb63ea9977d 100644
+--- a/drivers/hid/hid-google-hammer.c
++++ b/drivers/hid/hid-google-hammer.c
+@@ -120,6 +120,10 @@ static int hammer_input_configured(struct hid_device *hdev,
+ static const struct hid_device_id hammer_devices[] = {
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_HAMMER) },
++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MAGNEMITE) },
++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MASTERBALL) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_STAFF) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 6b33117ca60e..02c263a4c083 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -466,6 +466,8 @@
+ #define USB_DEVICE_ID_GOOGLE_STAFF 0x502b
+ #define USB_DEVICE_ID_GOOGLE_WAND 0x502d
+ #define USB_DEVICE_ID_GOOGLE_WHISKERS 0x5030
++#define USB_DEVICE_ID_GOOGLE_MASTERBALL 0x503c
++#define USB_DEVICE_ID_GOOGLE_MAGNEMITE 0x503d
+
+ #define USB_VENDOR_ID_GOTOP 0x08f2
+ #define USB_DEVICE_ID_SUPER_Q2 0x007f
+diff --git a/drivers/hid/intel-ish-hid/ishtp/client-buffers.c b/drivers/hid/intel-ish-hid/ishtp/client-buffers.c
+index b9b917d2d50d..c41dbb167c91 100644
+--- a/drivers/hid/intel-ish-hid/ishtp/client-buffers.c
++++ b/drivers/hid/intel-ish-hid/ishtp/client-buffers.c
+@@ -90,7 +90,7 @@ int ishtp_cl_alloc_tx_ring(struct ishtp_cl *cl)
+ return 0;
+ out:
+ dev_err(&cl->device->dev, "error in allocating Tx pool\n");
+- ishtp_cl_free_rx_ring(cl);
++ ishtp_cl_free_tx_ring(cl);
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/hid/wacom.h b/drivers/hid/wacom.h
+index 3c37c3cbf6f1..9c0900c35b23 100644
+--- a/drivers/hid/wacom.h
++++ b/drivers/hid/wacom.h
+@@ -205,6 +205,21 @@ static inline void wacom_schedule_work(struct wacom_wac *wacom_wac,
+ }
+ }
+
++/*
++ * Convert a signed 32-bit integer to an unsigned n-bit integer. Undoes
++ * the normally-helpful work of 'hid_snto32' for fields that use signed
++ * ranges for questionable reasons.
++ */
++static inline __u32 wacom_s32tou(s32 value, __u8 n)
++{
++ switch (n) {
++ case 8: return ((__u8)value);
++ case 16: return ((__u16)value);
++ case 32: return ((__u32)value);
++ }
++ return value & (1 << (n - 1)) ? value & (~(~0U << n)) : value;
++}
++
+ extern const struct hid_device_id wacom_ids[];
+
+ void wacom_wac_irq(struct wacom_wac *wacom_wac, size_t len);
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 1df037e7f0b4..77bb46948eea 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2271,7 +2271,7 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
+ case HID_DG_TOOLSERIALNUMBER:
+ if (value) {
+ wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
+- wacom_wac->serial[0] |= (__u32)value;
++ wacom_wac->serial[0] |= wacom_s32tou(value, field->report_size);
+ }
+ return;
+ case HID_DG_TWIST:
+@@ -2287,15 +2287,17 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
+ return;
+ case WACOM_HID_WD_SERIALHI:
+ if (value) {
++ __u32 raw_value = wacom_s32tou(value, field->report_size);
++
+ wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF);
+- wacom_wac->serial[0] |= ((__u64)value) << 32;
++ wacom_wac->serial[0] |= ((__u64)raw_value) << 32;
+ /*
+ * Non-USI EMR devices may contain additional tool type
+ * information here. See WACOM_HID_WD_TOOLTYPE case for
+ * more details.
+ */
+ if (value >> 20 == 1) {
+- wacom_wac->id[0] |= value & 0xFFFFF;
++ wacom_wac->id[0] |= raw_value & 0xFFFFF;
+ }
+ }
+ return;
+@@ -2307,7 +2309,7 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
+ * bitwise OR so the complete value can be built
+ * up over time :(
+ */
+- wacom_wac->id[0] |= value;
++ wacom_wac->id[0] |= wacom_s32tou(value, field->report_size);
+ return;
+ case WACOM_HID_WD_OFFSETLEFT:
+ if (features->offset_left && value != features->offset_left)
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 968319f4e5f1..8421009d3a9d 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -175,6 +175,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x02a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Comet Lake PCH */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x06a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ {
+ /* Ice Lake NNPI */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5),
+@@ -185,6 +190,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Jasper Lake PCH */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ { 0 },
+ };
+
+diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
+index c52d20f7ca2e..0409dcf5b047 100644
+--- a/drivers/iio/adc/stm32-adc.c
++++ b/drivers/iio/adc/stm32-adc.c
+@@ -1340,7 +1340,7 @@ static int stm32_adc_dma_start(struct iio_dev *indio_dev)
+ cookie = dmaengine_submit(desc);
+ ret = dma_submit_error(cookie);
+ if (ret) {
+- dmaengine_terminate_all(adc->dma_chan);
++ dmaengine_terminate_sync(adc->dma_chan);
+ return ret;
+ }
+
+@@ -1413,7 +1413,7 @@ static int stm32_adc_buffer_predisable(struct iio_dev *indio_dev)
+ dev_err(&indio_dev->dev, "predisable failed\n");
+
+ if (adc->dma_chan)
+- dmaengine_terminate_all(adc->dma_chan);
++ dmaengine_terminate_sync(adc->dma_chan);
+
+ if (stm32_adc_set_trig(indio_dev, NULL))
+ dev_err(&indio_dev->dev, "Can't clear trigger\n");
+diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
+index a27fe208f3ae..d3af4f28cbbb 100644
+--- a/drivers/iio/imu/adis16480.c
++++ b/drivers/iio/imu/adis16480.c
+@@ -270,8 +270,11 @@ static int adis16480_set_freq(struct iio_dev *indio_dev, int val, int val2)
+ struct adis16480 *st = iio_priv(indio_dev);
+ unsigned int t;
+
++ if (val < 0 || val2 < 0)
++ return -EINVAL;
++
+ t = val * 1000 + val2 / 1000;
+- if (t <= 0)
++ if (t == 0)
+ return -EINVAL;
+
+ t = 2460000 / t;
+diff --git a/drivers/iio/imu/inv_mpu6050/Kconfig b/drivers/iio/imu/inv_mpu6050/Kconfig
+index 5483b2ea754d..d2fe9dbddda7 100644
+--- a/drivers/iio/imu/inv_mpu6050/Kconfig
++++ b/drivers/iio/imu/inv_mpu6050/Kconfig
+@@ -13,8 +13,8 @@ config INV_MPU6050_I2C
+ select INV_MPU6050_IIO
+ select REGMAP_I2C
+ help
+- This driver supports the Invensense MPU6050/6500/9150 and ICM20608
+- motion tracking devices over I2C.
++ This driver supports the Invensense MPU6050/6500/9150 and
++ ICM20608/20602 motion tracking devices over I2C.
+ This driver can be built as a module. The module will be called
+ inv-mpu6050-i2c.
+
+@@ -24,7 +24,7 @@ config INV_MPU6050_SPI
+ select INV_MPU6050_IIO
+ select REGMAP_SPI
+ help
+- This driver supports the Invensense MPU6050/6500/9150 and ICM20608
+- motion tracking devices over SPI.
++ This driver supports the Invensense MPU6050/6500/9150 and
++ ICM20608/20602 motion tracking devices over SPI.
+ This driver can be built as a module. The module will be called
+ inv-mpu6050-spi.
+diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+index d80ef468508a..baba8e5459d0 100644
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+@@ -37,6 +37,29 @@ static const int gyro_scale_6050[] = {133090, 266181, 532362, 1064724};
+ */
+ static const int accel_scale[] = {598, 1196, 2392, 4785};
+
++static const struct inv_mpu6050_reg_map reg_set_icm20602 = {
++ .sample_rate_div = INV_MPU6050_REG_SAMPLE_RATE_DIV,
++ .lpf = INV_MPU6050_REG_CONFIG,
++ .accel_lpf = INV_MPU6500_REG_ACCEL_CONFIG_2,
++ .user_ctrl = INV_MPU6050_REG_USER_CTRL,
++ .fifo_en = INV_MPU6050_REG_FIFO_EN,
++ .gyro_config = INV_MPU6050_REG_GYRO_CONFIG,
++ .accl_config = INV_MPU6050_REG_ACCEL_CONFIG,
++ .fifo_count_h = INV_MPU6050_REG_FIFO_COUNT_H,
++ .fifo_r_w = INV_MPU6050_REG_FIFO_R_W,
++ .raw_gyro = INV_MPU6050_REG_RAW_GYRO,
++ .raw_accl = INV_MPU6050_REG_RAW_ACCEL,
++ .temperature = INV_MPU6050_REG_TEMPERATURE,
++ .int_enable = INV_MPU6050_REG_INT_ENABLE,
++ .int_status = INV_MPU6050_REG_INT_STATUS,
++ .pwr_mgmt_1 = INV_MPU6050_REG_PWR_MGMT_1,
++ .pwr_mgmt_2 = INV_MPU6050_REG_PWR_MGMT_2,
++ .int_pin_cfg = INV_MPU6050_REG_INT_PIN_CFG,
++ .accl_offset = INV_MPU6500_REG_ACCEL_OFFSET,
++ .gyro_offset = INV_MPU6050_REG_GYRO_OFFSET,
++ .i2c_if = INV_ICM20602_REG_I2C_IF,
++};
++
+ static const struct inv_mpu6050_reg_map reg_set_6500 = {
+ .sample_rate_div = INV_MPU6050_REG_SAMPLE_RATE_DIV,
+ .lpf = INV_MPU6050_REG_CONFIG,
+@@ -57,6 +80,7 @@ static const struct inv_mpu6050_reg_map reg_set_6500 = {
+ .int_pin_cfg = INV_MPU6050_REG_INT_PIN_CFG,
+ .accl_offset = INV_MPU6500_REG_ACCEL_OFFSET,
+ .gyro_offset = INV_MPU6050_REG_GYRO_OFFSET,
++ .i2c_if = 0,
+ };
+
+ static const struct inv_mpu6050_reg_map reg_set_6050 = {
+@@ -77,6 +101,7 @@ static const struct inv_mpu6050_reg_map reg_set_6050 = {
+ .int_pin_cfg = INV_MPU6050_REG_INT_PIN_CFG,
+ .accl_offset = INV_MPU6050_REG_ACCEL_OFFSET,
+ .gyro_offset = INV_MPU6050_REG_GYRO_OFFSET,
++ .i2c_if = 0,
+ };
+
+ static const struct inv_mpu6050_chip_config chip_config_6050 = {
+@@ -96,48 +121,63 @@ static const struct inv_mpu6050_hw hw_info[] = {
+ .name = "MPU6050",
+ .reg = ®_set_6050,
+ .config = &chip_config_6050,
++ .fifo_size = 1024,
+ },
+ {
+ .whoami = INV_MPU6500_WHOAMI_VALUE,
+ .name = "MPU6500",
+ .reg = ®_set_6500,
+ .config = &chip_config_6050,
++ .fifo_size = 512,
+ },
+ {
+ .whoami = INV_MPU6515_WHOAMI_VALUE,
+ .name = "MPU6515",
+ .reg = ®_set_6500,
+ .config = &chip_config_6050,
++ .fifo_size = 512,
+ },
+ {
+ .whoami = INV_MPU6000_WHOAMI_VALUE,
+ .name = "MPU6000",
+ .reg = ®_set_6050,
+ .config = &chip_config_6050,
++ .fifo_size = 1024,
+ },
+ {
+ .whoami = INV_MPU9150_WHOAMI_VALUE,
+ .name = "MPU9150",
+ .reg = ®_set_6050,
+ .config = &chip_config_6050,
++ .fifo_size = 1024,
+ },
+ {
+ .whoami = INV_MPU9250_WHOAMI_VALUE,
+ .name = "MPU9250",
+ .reg = ®_set_6500,
+ .config = &chip_config_6050,
++ .fifo_size = 512,
+ },
+ {
+ .whoami = INV_MPU9255_WHOAMI_VALUE,
+ .name = "MPU9255",
+ .reg = ®_set_6500,
+ .config = &chip_config_6050,
++ .fifo_size = 512,
+ },
+ {
+ .whoami = INV_ICM20608_WHOAMI_VALUE,
+ .name = "ICM20608",
+ .reg = ®_set_6500,
+ .config = &chip_config_6050,
++ .fifo_size = 512,
++ },
++ {
++ .whoami = INV_ICM20602_WHOAMI_VALUE,
++ .name = "ICM20602",
++ .reg = ®_set_icm20602,
++ .config = &chip_config_6050,
++ .fifo_size = 1008,
+ },
+ };
+
+@@ -439,7 +479,10 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev,
+ return IIO_VAL_INT_PLUS_MICRO;
+ case IIO_TEMP:
+ *val = 0;
+- *val2 = INV_MPU6050_TEMP_SCALE;
++ if (st->chip_type == INV_ICM20602)
++ *val2 = INV_ICM20602_TEMP_SCALE;
++ else
++ *val2 = INV_MPU6050_TEMP_SCALE;
+
+ return IIO_VAL_INT_PLUS_MICRO;
+ default:
+@@ -448,7 +491,10 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev,
+ case IIO_CHAN_INFO_OFFSET:
+ switch (chan->type) {
+ case IIO_TEMP:
+- *val = INV_MPU6050_TEMP_OFFSET;
++ if (st->chip_type == INV_ICM20602)
++ *val = INV_ICM20602_TEMP_OFFSET;
++ else
++ *val = INV_MPU6050_TEMP_OFFSET;
+
+ return IIO_VAL_INT;
+ default:
+@@ -813,6 +859,32 @@ static const struct iio_chan_spec inv_mpu_channels[] = {
+ INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_Z, INV_MPU6050_SCAN_ACCL_Z),
+ };
+
++static const struct iio_chan_spec inv_icm20602_channels[] = {
++ IIO_CHAN_SOFT_TIMESTAMP(INV_ICM20602_SCAN_TIMESTAMP),
++ {
++ .type = IIO_TEMP,
++ .info_mask_separate = BIT(IIO_CHAN_INFO_RAW)
++ | BIT(IIO_CHAN_INFO_OFFSET)
++ | BIT(IIO_CHAN_INFO_SCALE),
++ .scan_index = INV_ICM20602_SCAN_TEMP,
++ .scan_type = {
++ .sign = 's',
++ .realbits = 16,
++ .storagebits = 16,
++ .shift = 0,
++ .endianness = IIO_BE,
++ },
++ },
++
++ INV_MPU6050_CHAN(IIO_ANGL_VEL, IIO_MOD_X, INV_ICM20602_SCAN_GYRO_X),
++ INV_MPU6050_CHAN(IIO_ANGL_VEL, IIO_MOD_Y, INV_ICM20602_SCAN_GYRO_Y),
++ INV_MPU6050_CHAN(IIO_ANGL_VEL, IIO_MOD_Z, INV_ICM20602_SCAN_GYRO_Z),
++
++ INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_Y, INV_ICM20602_SCAN_ACCL_Y),
++ INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_X, INV_ICM20602_SCAN_ACCL_X),
++ INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_Z, INV_ICM20602_SCAN_ACCL_Z),
++};
++
+ /*
+ * The user can choose any frequency between INV_MPU6050_MIN_FIFO_RATE and
+ * INV_MPU6050_MAX_FIFO_RATE, but only these frequencies are matched by the
+@@ -1013,8 +1085,14 @@ int inv_mpu_core_probe(struct regmap *regmap, int irq, const char *name,
+ indio_dev->name = name;
+ else
+ indio_dev->name = dev_name(dev);
+- indio_dev->channels = inv_mpu_channels;
+- indio_dev->num_channels = ARRAY_SIZE(inv_mpu_channels);
++
++ if (chip_type == INV_ICM20602) {
++ indio_dev->channels = inv_icm20602_channels;
++ indio_dev->num_channels = ARRAY_SIZE(inv_icm20602_channels);
++ } else {
++ indio_dev->channels = inv_mpu_channels;
++ indio_dev->num_channels = ARRAY_SIZE(inv_mpu_channels);
++ }
+
+ indio_dev->info = &mpu_info;
+ indio_dev->modes = INDIO_BUFFER_TRIGGERED;
+diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_i2c.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_i2c.c
+index dd758e3d403d..e46eb4ddea21 100644
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_i2c.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_i2c.c
+@@ -127,6 +127,7 @@ static int inv_mpu_probe(struct i2c_client *client,
+ st = iio_priv(dev_get_drvdata(&client->dev));
+ switch (st->chip_type) {
+ case INV_ICM20608:
++ case INV_ICM20602:
+ /* no i2c auxiliary bus on the chip */
+ break;
+ default:
+@@ -179,6 +180,7 @@ static const struct i2c_device_id inv_mpu_id[] = {
+ {"mpu9250", INV_MPU9250},
+ {"mpu9255", INV_MPU9255},
+ {"icm20608", INV_ICM20608},
++ {"icm20602", INV_ICM20602},
+ {}
+ };
+
+@@ -213,6 +215,10 @@ static const struct of_device_id inv_of_match[] = {
+ .compatible = "invensense,icm20608",
+ .data = (void *)INV_ICM20608
+ },
++ {
++ .compatible = "invensense,icm20602",
++ .data = (void *)INV_ICM20602
++ },
+ { }
+ };
+ MODULE_DEVICE_TABLE(of, inv_of_match);
+diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
+index e69a59659dbc..6ef872f97c17 100644
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
+@@ -44,6 +44,7 @@
+ * @int_pin_cfg; Controls interrupt pin configuration.
+ * @accl_offset: Controls the accelerometer calibration offset.
+ * @gyro_offset: Controls the gyroscope calibration offset.
++ * @i2c_if: Controls the i2c interface
+ */
+ struct inv_mpu6050_reg_map {
+ u8 sample_rate_div;
+@@ -65,6 +66,7 @@ struct inv_mpu6050_reg_map {
+ u8 int_pin_cfg;
+ u8 accl_offset;
+ u8 gyro_offset;
++ u8 i2c_if;
+ };
+
+ /*device enum */
+@@ -77,6 +79,7 @@ enum inv_devices {
+ INV_MPU9250,
+ INV_MPU9255,
+ INV_ICM20608,
++ INV_ICM20602,
+ INV_NUM_PARTS
+ };
+
+@@ -105,12 +108,14 @@ struct inv_mpu6050_chip_config {
+ * @name: name of the chip.
+ * @reg: register map of the chip.
+ * @config: configuration of the chip.
++ * @fifo_size: size of the FIFO in bytes.
+ */
+ struct inv_mpu6050_hw {
+ u8 whoami;
+ u8 *name;
+ const struct inv_mpu6050_reg_map *reg;
+ const struct inv_mpu6050_chip_config *config;
++ size_t fifo_size;
+ };
+
+ /*
+@@ -193,12 +198,19 @@ struct inv_mpu6050_state {
+ #define INV_MPU6050_BIT_PWR_ACCL_STBY 0x38
+ #define INV_MPU6050_BIT_PWR_GYRO_STBY 0x07
+
++/* ICM20602 register */
++#define INV_ICM20602_REG_I2C_IF 0x70
++#define INV_ICM20602_BIT_I2C_IF_DIS 0x40
++
+ #define INV_MPU6050_REG_FIFO_COUNT_H 0x72
+ #define INV_MPU6050_REG_FIFO_R_W 0x74
+
+ #define INV_MPU6050_BYTES_PER_3AXIS_SENSOR 6
+ #define INV_MPU6050_FIFO_COUNT_BYTE 2
+
++/* ICM20602 FIFO samples include temperature readings */
++#define INV_ICM20602_BYTES_PER_TEMP_SENSOR 2
++
+ /* mpu6500 registers */
+ #define INV_MPU6500_REG_ACCEL_CONFIG_2 0x1D
+ #define INV_MPU6500_REG_ACCEL_OFFSET 0x77
+@@ -220,6 +232,9 @@ struct inv_mpu6050_state {
+ #define INV_MPU6050_GYRO_CONFIG_FSR_SHIFT 3
+ #define INV_MPU6050_ACCL_CONFIG_FSR_SHIFT 3
+
++#define INV_ICM20602_TEMP_OFFSET 8170
++#define INV_ICM20602_TEMP_SCALE 3060
++
+ /* 6 + 6 round up and plus 8 */
+ #define INV_MPU6050_OUTPUT_DATA_SIZE 24
+
+@@ -259,8 +274,9 @@ struct inv_mpu6050_state {
+ #define INV_MPU9255_WHOAMI_VALUE 0x73
+ #define INV_MPU6515_WHOAMI_VALUE 0x74
+ #define INV_ICM20608_WHOAMI_VALUE 0xAF
++#define INV_ICM20602_WHOAMI_VALUE 0x12
+
+-/* scan element definition */
++/* scan element definition for generic MPU6xxx devices */
+ enum inv_mpu6050_scan {
+ INV_MPU6050_SCAN_ACCL_X,
+ INV_MPU6050_SCAN_ACCL_Y,
+@@ -271,6 +287,18 @@ enum inv_mpu6050_scan {
+ INV_MPU6050_SCAN_TIMESTAMP,
+ };
+
++/* scan element definition for ICM20602, which includes temperature */
++enum inv_icm20602_scan {
++ INV_ICM20602_SCAN_ACCL_X,
++ INV_ICM20602_SCAN_ACCL_Y,
++ INV_ICM20602_SCAN_ACCL_Z,
++ INV_ICM20602_SCAN_TEMP,
++ INV_ICM20602_SCAN_GYRO_X,
++ INV_ICM20602_SCAN_GYRO_Y,
++ INV_ICM20602_SCAN_GYRO_Z,
++ INV_ICM20602_SCAN_TIMESTAMP,
++};
++
+ enum inv_mpu6050_filter_e {
+ INV_MPU6050_FILTER_256HZ_NOLPF2 = 0,
+ INV_MPU6050_FILTER_188HZ,
+diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+index 548e042f7b5b..0e54f2d54bd7 100644
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+@@ -188,9 +188,6 @@ irqreturn_t inv_mpu6050_read_fifo(int irq, void *p)
+ "failed to ack interrupt\n");
+ goto flush_fifo;
+ }
+- /* handle fifo overflow by reseting fifo */
+- if (int_status & INV_MPU6050_BIT_FIFO_OVERFLOW_INT)
+- goto flush_fifo;
+ if (!(int_status & INV_MPU6050_BIT_RAW_DATA_RDY_INT)) {
+ dev_warn(regmap_get_device(st->map),
+ "spurious interrupt with status 0x%x\n", int_status);
+@@ -207,6 +204,9 @@ irqreturn_t inv_mpu6050_read_fifo(int irq, void *p)
+ if (st->chip_config.gyro_fifo_enable)
+ bytes_per_datum += INV_MPU6050_BYTES_PER_3AXIS_SENSOR;
+
++ if (st->chip_type == INV_ICM20602)
++ bytes_per_datum += INV_ICM20602_BYTES_PER_TEMP_SENSOR;
++
+ /*
+ * read fifo_count register to know how many bytes are inside the FIFO
+ * right now
+@@ -216,6 +216,18 @@ irqreturn_t inv_mpu6050_read_fifo(int irq, void *p)
+ if (result)
+ goto end_session;
+ fifo_count = get_unaligned_be16(&data[0]);
++
++ /*
++ * Handle fifo overflow by resetting fifo.
++ * Reset if there is only 3 data set free remaining to mitigate
++ * possible delay between reading fifo count and fifo data.
++ */
++ nb = 3 * bytes_per_datum;
++ if (fifo_count >= st->hw->fifo_size - nb) {
++ dev_warn(regmap_get_device(st->map), "fifo overflow reset\n");
++ goto flush_fifo;
++ }
++
+ /* compute and process all complete datum */
+ nb = fifo_count / bytes_per_datum;
+ inv_mpu6050_update_period(st, pf->timestamp, nb);
+diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c
+index 227f50afff22..a112c3f45f74 100644
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c
+@@ -31,9 +31,14 @@ static int inv_mpu_i2c_disable(struct iio_dev *indio_dev)
+ if (ret)
+ return ret;
+
+- st->chip_config.user_ctrl |= INV_MPU6050_BIT_I2C_IF_DIS;
+- ret = regmap_write(st->map, st->reg->user_ctrl,
+- st->chip_config.user_ctrl);
++ if (st->reg->i2c_if) {
++ ret = regmap_write(st->map, st->reg->i2c_if,
++ INV_ICM20602_BIT_I2C_IF_DIS);
++ } else {
++ st->chip_config.user_ctrl |= INV_MPU6050_BIT_I2C_IF_DIS;
++ ret = regmap_write(st->map, st->reg->user_ctrl,
++ st->chip_config.user_ctrl);
++ }
+ if (ret) {
+ inv_mpu6050_set_power_itg(st, false);
+ return ret;
+@@ -81,6 +86,7 @@ static const struct spi_device_id inv_mpu_id[] = {
+ {"mpu9250", INV_MPU9250},
+ {"mpu9255", INV_MPU9255},
+ {"icm20608", INV_ICM20608},
++ {"icm20602", INV_ICM20602},
+ {}
+ };
+
+diff --git a/drivers/iio/proximity/srf04.c b/drivers/iio/proximity/srf04.c
+index 09c7b9c095b0..0428a0dfcbd4 100644
+--- a/drivers/iio/proximity/srf04.c
++++ b/drivers/iio/proximity/srf04.c
+@@ -105,7 +105,7 @@ static int srf04_read(struct srf04_data *data)
+ udelay(10);
+ gpiod_set_value(data->gpiod_trig, 0);
+
+- /* it cannot take more than 20 ms */
++ /* it should not take more than 20 ms until echo is rising */
+ ret = wait_for_completion_killable_timeout(&data->rising, HZ/50);
+ if (ret < 0) {
+ mutex_unlock(&data->lock);
+@@ -115,7 +115,8 @@ static int srf04_read(struct srf04_data *data)
+ return -ETIMEDOUT;
+ }
+
+- ret = wait_for_completion_killable_timeout(&data->falling, HZ/50);
++ /* it cannot take more than 50 ms until echo is falling */
++ ret = wait_for_completion_killable_timeout(&data->falling, HZ/20);
+ if (ret < 0) {
+ mutex_unlock(&data->lock);
+ return ret;
+@@ -130,19 +131,19 @@ static int srf04_read(struct srf04_data *data)
+
+ dt_ns = ktime_to_ns(ktime_dt);
+ /*
+- * measuring more than 3 meters is beyond the capabilities of
+- * the sensor
++ * measuring more than 6,45 meters is beyond the capabilities of
++ * the supported sensors
+ * ==> filter out invalid results for not measuring echos of
+ * another us sensor
+ *
+ * formula:
+- * distance 3 m
+- * time = ---------- = --------- = 9404389 ns
+- * speed 319 m/s
++ * distance 6,45 * 2 m
++ * time = ---------- = ------------ = 40438871 ns
++ * speed 319 m/s
+ *
+ * using a minimum speed at -20 °C of 319 m/s
+ */
+- if (dt_ns > 9404389)
++ if (dt_ns > 40438871)
+ return -EIO;
+
+ time_ns = dt_ns;
+@@ -154,20 +155,20 @@ static int srf04_read(struct srf04_data *data)
+ * with Temp in °C
+ * and speed in m/s
+ *
+- * use 343 m/s as ultrasonic speed at 20 °C here in absence of the
++ * use 343,5 m/s as ultrasonic speed at 20 °C here in absence of the
+ * temperature
+ *
+ * therefore:
+- * time 343
+- * distance = ------ * -----
+- * 10^6 2
++ * time 343,5 time * 106
++ * distance = ------ * ------- = ------------
++ * 10^6 2 617176
+ * with time in ns
+ * and distance in mm (one way)
+ *
+- * because we limit to 3 meters the multiplication with 343 just
++ * because we limit to 6,45 meters the multiplication with 106 just
+ * fits into 32 bit
+ */
+- distance_mm = time_ns * 343 / 2000000;
++ distance_mm = time_ns * 106 / 617176;
+
+ return distance_mm;
+ }
+diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
+index 5df8e548cc14..4a14de2d8c71 100644
+--- a/drivers/infiniband/core/uverbs.h
++++ b/drivers/infiniband/core/uverbs.h
+@@ -98,7 +98,7 @@ ib_uverbs_init_udata_buf_or_null(struct ib_udata *udata,
+
+ struct ib_uverbs_device {
+ atomic_t refcount;
+- int num_comp_vectors;
++ u32 num_comp_vectors;
+ struct completion comp;
+ struct device *dev;
+ struct ib_device __rcu *ib_dev;
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 3be6405d9855..a5ff1f0f2073 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -493,7 +493,6 @@ static int _put_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
+
+ ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
+ release_ep_resources(ep);
+- kfree_skb(skb);
+ return 0;
+ }
+
+@@ -504,7 +503,6 @@ static int _put_pass_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
+ ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
+ c4iw_put_ep(&ep->parent_ep->com);
+ release_ep_resources(ep);
+- kfree_skb(skb);
+ return 0;
+ }
+
+@@ -2380,20 +2378,6 @@ static int accept_cr(struct c4iw_ep *ep, struct sk_buff *skb,
+ enum chip_type adapter_type = ep->com.dev->rdev.lldi.adapter_type;
+
+ pr_debug("ep %p tid %u\n", ep, ep->hwtid);
+-
+- skb_get(skb);
+- rpl = cplhdr(skb);
+- if (!is_t4(adapter_type)) {
+- skb_trim(skb, roundup(sizeof(*rpl5), 16));
+- rpl5 = (void *)rpl;
+- INIT_TP_WR(rpl5, ep->hwtid);
+- } else {
+- skb_trim(skb, sizeof(*rpl));
+- INIT_TP_WR(rpl, ep->hwtid);
+- }
+- OPCODE_TID(rpl) = cpu_to_be32(MK_OPCODE_TID(CPL_PASS_ACCEPT_RPL,
+- ep->hwtid));
+-
+ cxgb_best_mtu(ep->com.dev->rdev.lldi.mtus, ep->mtu, &mtu_idx,
+ enable_tcp_timestamps && req->tcpopt.tstamp,
+ (ep->com.remote_addr.ss_family == AF_INET) ? 0 : 1);
+@@ -2439,6 +2423,20 @@ static int accept_cr(struct c4iw_ep *ep, struct sk_buff *skb,
+ if (tcph->ece && tcph->cwr)
+ opt2 |= CCTRL_ECN_V(1);
+ }
++
++ skb_get(skb);
++ rpl = cplhdr(skb);
++ if (!is_t4(adapter_type)) {
++ skb_trim(skb, roundup(sizeof(*rpl5), 16));
++ rpl5 = (void *)rpl;
++ INIT_TP_WR(rpl5, ep->hwtid);
++ } else {
++ skb_trim(skb, sizeof(*rpl));
++ INIT_TP_WR(rpl, ep->hwtid);
++ }
++ OPCODE_TID(rpl) = cpu_to_be32(MK_OPCODE_TID(CPL_PASS_ACCEPT_RPL,
++ ep->hwtid));
++
+ if (CHELSIO_CHIP_VERSION(adapter_type) > CHELSIO_T4) {
+ u32 isn = (prandom_u32() & ~7UL) - 1;
+ opt2 |= T5_OPT_2_VALID_F;
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index a442b29e7611..cf878e1b71fc 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4572,9 +4572,9 @@ static void hns_roce_v2_free_eq(struct hns_roce_dev *hr_dev,
+ return;
+ }
+
+- if (eq->buf_list)
+- dma_free_coherent(hr_dev->dev, buf_chk_sz,
+- eq->buf_list->buf, eq->buf_list->map);
++ dma_free_coherent(hr_dev->dev, buf_chk_sz, eq->buf_list->buf,
++ eq->buf_list->map);
++ kfree(eq->buf_list);
+ }
+
+ static void hns_roce_config_eqc(struct hns_roce_dev *hr_dev,
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 77b1f3fd086a..900f85ce0fb0 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -2828,10 +2828,12 @@ static int modify_raw_packet_qp_sq(struct mlx5_core_dev *dev,
+ }
+
+ /* Only remove the old rate after new rate was set */
+- if ((old_rl.rate &&
+- !mlx5_rl_are_equal(&old_rl, &new_rl)) ||
+- (new_state != MLX5_SQC_STATE_RDY))
++ if ((old_rl.rate && !mlx5_rl_are_equal(&old_rl, &new_rl)) ||
++ (new_state != MLX5_SQC_STATE_RDY)) {
+ mlx5_rl_remove_rate(dev, &old_rl);
++ if (new_state != MLX5_SQC_STATE_RDY)
++ memset(&new_rl, 0, sizeof(new_rl));
++ }
+
+ ibqp->rl = new_rl;
+ sq->state = new_state;
+diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
+index a0af6d424aed..d1680d3b5825 100644
+--- a/drivers/infiniband/hw/qedr/main.c
++++ b/drivers/infiniband/hw/qedr/main.c
+@@ -77,7 +77,7 @@ static void qedr_get_dev_fw_str(struct ib_device *ibdev, char *str)
+ struct qedr_dev *qedr = get_qedr_dev(ibdev);
+ u32 fw_ver = (u32)qedr->attr.fw_ver;
+
+- snprintf(str, IB_FW_VERSION_NAME_MAX, "%d. %d. %d. %d",
++ snprintf(str, IB_FW_VERSION_NAME_MAX, "%d.%d.%d.%d",
+ (fw_ver >> 24) & 0xFF, (fw_ver >> 16) & 0xFF,
+ (fw_ver >> 8) & 0xFF, fw_ver & 0xFF);
+ }
+diff --git a/drivers/iommu/amd_iommu_quirks.c b/drivers/iommu/amd_iommu_quirks.c
+index c235f79b7a20..5120ce4fdce3 100644
+--- a/drivers/iommu/amd_iommu_quirks.c
++++ b/drivers/iommu/amd_iommu_quirks.c
+@@ -73,6 +73,19 @@ static const struct dmi_system_id ivrs_quirks[] __initconst = {
+ },
+ .driver_data = (void *)&ivrs_ioapic_quirks[DELL_LATITUDE_5495],
+ },
++ {
++ /*
++ * Acer Aspire A315-41 requires the very same workaround as
++ * Dell Latitude 5495
++ */
++ .callback = ivrs_ioapic_quirk_cb,
++ .ident = "Acer Aspire A315-41",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A315-41"),
++ },
++ .driver_data = (void *)&ivrs_ioapic_quirks[DELL_LATITUDE_5495],
++ },
+ {
+ .callback = ivrs_ioapic_quirk_cb,
+ .ident = "Lenovo ideapad 330S-15ARR",
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 2804e2d1ae5e..9b8143dca512 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1798,7 +1798,8 @@ err_detach:
+ slave_disable_netpoll(new_slave);
+
+ err_close:
+- slave_dev->priv_flags &= ~IFF_BONDING;
++ if (!netif_is_bond_master(slave_dev))
++ slave_dev->priv_flags &= ~IFF_BONDING;
+ dev_close(slave_dev);
+
+ err_restore_mac:
+@@ -2004,7 +2005,8 @@ static int __bond_release_one(struct net_device *bond_dev,
+ else
+ dev_set_mtu(slave_dev, slave->original_mtu);
+
+- slave_dev->priv_flags &= ~IFF_BONDING;
++ if (!netif_is_bond_master(slave_dev))
++ slave_dev->priv_flags &= ~IFF_BONDING;
+
+ bond_free_slave(slave);
+
+@@ -2074,8 +2076,7 @@ static int bond_miimon_inspect(struct bonding *bond)
+ ignore_updelay = !rcu_dereference(bond->curr_active_slave);
+
+ bond_for_each_slave_rcu(bond, slave, iter) {
+- slave->new_link = BOND_LINK_NOCHANGE;
+- slave->link_new_state = slave->link;
++ bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
+
+ link_state = bond_check_dev_link(bond, slave->dev, 0);
+
+@@ -2111,7 +2112,7 @@ static int bond_miimon_inspect(struct bonding *bond)
+ }
+
+ if (slave->delay <= 0) {
+- slave->new_link = BOND_LINK_DOWN;
++ bond_propose_link_state(slave, BOND_LINK_DOWN);
+ commit++;
+ continue;
+ }
+@@ -2150,7 +2151,7 @@ static int bond_miimon_inspect(struct bonding *bond)
+ slave->delay = 0;
+
+ if (slave->delay <= 0) {
+- slave->new_link = BOND_LINK_UP;
++ bond_propose_link_state(slave, BOND_LINK_UP);
+ commit++;
+ ignore_updelay = false;
+ continue;
+@@ -2188,7 +2189,7 @@ static void bond_miimon_commit(struct bonding *bond)
+ struct slave *slave, *primary;
+
+ bond_for_each_slave(bond, slave, iter) {
+- switch (slave->new_link) {
++ switch (slave->link_new_state) {
+ case BOND_LINK_NOCHANGE:
+ /* For 802.3ad mode, check current slave speed and
+ * duplex again in case its port was disabled after
+@@ -2263,8 +2264,8 @@ static void bond_miimon_commit(struct bonding *bond)
+
+ default:
+ netdev_err(bond->dev, "invalid new link %d on slave %s\n",
+- slave->new_link, slave->dev->name);
+- slave->new_link = BOND_LINK_NOCHANGE;
++ slave->link_new_state, slave->dev->name);
++ bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
+
+ continue;
+ }
+@@ -2664,13 +2665,13 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
+ bond_for_each_slave_rcu(bond, slave, iter) {
+ unsigned long trans_start = dev_trans_start(slave->dev);
+
+- slave->new_link = BOND_LINK_NOCHANGE;
++ bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
+
+ if (slave->link != BOND_LINK_UP) {
+ if (bond_time_in_interval(bond, trans_start, 1) &&
+ bond_time_in_interval(bond, slave->last_rx, 1)) {
+
+- slave->new_link = BOND_LINK_UP;
++ bond_propose_link_state(slave, BOND_LINK_UP);
+ slave_state_changed = 1;
+
+ /* primary_slave has no meaning in round-robin
+@@ -2697,7 +2698,7 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
+ if (!bond_time_in_interval(bond, trans_start, 2) ||
+ !bond_time_in_interval(bond, slave->last_rx, 2)) {
+
+- slave->new_link = BOND_LINK_DOWN;
++ bond_propose_link_state(slave, BOND_LINK_DOWN);
+ slave_state_changed = 1;
+
+ if (slave->link_failure_count < UINT_MAX)
+@@ -2729,8 +2730,8 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
+ goto re_arm;
+
+ bond_for_each_slave(bond, slave, iter) {
+- if (slave->new_link != BOND_LINK_NOCHANGE)
+- slave->link = slave->new_link;
++ if (slave->link_new_state != BOND_LINK_NOCHANGE)
++ slave->link = slave->link_new_state;
+ }
+
+ if (slave_state_changed) {
+@@ -2753,9 +2754,9 @@ re_arm:
+ }
+
+ /* Called to inspect slaves for active-backup mode ARP monitor link state
+- * changes. Sets new_link in slaves to specify what action should take
+- * place for the slave. Returns 0 if no changes are found, >0 if changes
+- * to link states must be committed.
++ * changes. Sets proposed link state in slaves to specify what action
++ * should take place for the slave. Returns 0 if no changes are found, >0
++ * if changes to link states must be committed.
+ *
+ * Called with rcu_read_lock held.
+ */
+@@ -2767,12 +2768,12 @@ static int bond_ab_arp_inspect(struct bonding *bond)
+ int commit = 0;
+
+ bond_for_each_slave_rcu(bond, slave, iter) {
+- slave->new_link = BOND_LINK_NOCHANGE;
++ bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
+ last_rx = slave_last_rx(bond, slave);
+
+ if (slave->link != BOND_LINK_UP) {
+ if (bond_time_in_interval(bond, last_rx, 1)) {
+- slave->new_link = BOND_LINK_UP;
++ bond_propose_link_state(slave, BOND_LINK_UP);
+ commit++;
+ }
+ continue;
+@@ -2800,7 +2801,7 @@ static int bond_ab_arp_inspect(struct bonding *bond)
+ if (!bond_is_active_slave(slave) &&
+ !rcu_access_pointer(bond->current_arp_slave) &&
+ !bond_time_in_interval(bond, last_rx, 3)) {
+- slave->new_link = BOND_LINK_DOWN;
++ bond_propose_link_state(slave, BOND_LINK_DOWN);
+ commit++;
+ }
+
+@@ -2813,7 +2814,7 @@ static int bond_ab_arp_inspect(struct bonding *bond)
+ if (bond_is_active_slave(slave) &&
+ (!bond_time_in_interval(bond, trans_start, 2) ||
+ !bond_time_in_interval(bond, last_rx, 2))) {
+- slave->new_link = BOND_LINK_DOWN;
++ bond_propose_link_state(slave, BOND_LINK_DOWN);
+ commit++;
+ }
+ }
+@@ -2833,7 +2834,7 @@ static void bond_ab_arp_commit(struct bonding *bond)
+ struct slave *slave;
+
+ bond_for_each_slave(bond, slave, iter) {
+- switch (slave->new_link) {
++ switch (slave->link_new_state) {
+ case BOND_LINK_NOCHANGE:
+ continue;
+
+@@ -2886,7 +2887,7 @@ static void bond_ab_arp_commit(struct bonding *bond)
+
+ default:
+ netdev_err(bond->dev, "impossible: new_link %d on slave %s\n",
+- slave->new_link, slave->dev->name);
++ slave->link_new_state, slave->dev->name);
+ continue;
+ }
+
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 606b7d8ffe13..9b61bfbea6cd 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -97,6 +97,9 @@
+ #define BTR_TSEG2_SHIFT 12
+ #define BTR_TSEG2_MASK (0x7 << BTR_TSEG2_SHIFT)
+
++/* interrupt register */
++#define INT_STS_PENDING 0x8000
++
+ /* brp extension register */
+ #define BRP_EXT_BRPE_MASK 0x0f
+ #define BRP_EXT_BRPE_SHIFT 0
+@@ -1029,10 +1032,16 @@ static int c_can_poll(struct napi_struct *napi, int quota)
+ u16 curr, last = priv->last_status;
+ int work_done = 0;
+
+- priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG);
+- /* Ack status on C_CAN. D_CAN is self clearing */
+- if (priv->type != BOSCH_D_CAN)
+- priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
++ /* Only read the status register if a status interrupt was pending */
++ if (atomic_xchg(&priv->sie_pending, 0)) {
++ priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG);
++ /* Ack status on C_CAN. D_CAN is self clearing */
++ if (priv->type != BOSCH_D_CAN)
++ priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
++ } else {
++ /* no change detected ... */
++ curr = last;
++ }
+
+ /* handle state changes */
+ if ((curr & STATUS_EWARN) && (!(last & STATUS_EWARN))) {
+@@ -1083,10 +1092,16 @@ static irqreturn_t c_can_isr(int irq, void *dev_id)
+ {
+ struct net_device *dev = (struct net_device *)dev_id;
+ struct c_can_priv *priv = netdev_priv(dev);
++ int reg_int;
+
+- if (!priv->read_reg(priv, C_CAN_INT_REG))
++ reg_int = priv->read_reg(priv, C_CAN_INT_REG);
++ if (!reg_int)
+ return IRQ_NONE;
+
++ /* save for later use */
++ if (reg_int & INT_STS_PENDING)
++ atomic_set(&priv->sie_pending, 1);
++
+ /* disable all interrupts and schedule the NAPI */
+ c_can_irq_control(priv, false);
+ napi_schedule(&priv->napi);
+diff --git a/drivers/net/can/c_can/c_can.h b/drivers/net/can/c_can/c_can.h
+index 8acdc7fa4792..d5567a7c1c6d 100644
+--- a/drivers/net/can/c_can/c_can.h
++++ b/drivers/net/can/c_can/c_can.h
+@@ -198,6 +198,7 @@ struct c_can_priv {
+ struct net_device *dev;
+ struct device *device;
+ atomic_t tx_active;
++ atomic_t sie_pending;
+ unsigned long tx_dir;
+ int last_status;
+ u16 (*read_reg) (const struct c_can_priv *priv, enum reg index);
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index bd127ce3aba2..49b853f53f59 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -853,6 +853,7 @@ void of_can_transceiver(struct net_device *dev)
+ return;
+
+ ret = of_property_read_u32(dn, "max-bitrate", &priv->bitrate_max);
++ of_node_put(dn);
+ if ((ret && ret != -EINVAL) || (!ret && !priv->bitrate_max))
+ netdev_warn(dev, "Invalid value for transceiver max bitrate. Ignoring bitrate limit.\n");
+ }
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 6f265d2e647b..581e84d8e2c8 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -1048,6 +1048,7 @@ static int flexcan_chip_start(struct net_device *dev)
+ reg_mecr = priv->read(®s->mecr);
+ reg_mecr &= ~FLEXCAN_MECR_ECRWRDIS;
+ priv->write(reg_mecr, ®s->mecr);
++ reg_mecr |= FLEXCAN_MECR_ECCDIS;
+ reg_mecr &= ~(FLEXCAN_MECR_NCEFAFRZ | FLEXCAN_MECR_HANCEI_MSK |
+ FLEXCAN_MECR_FANCEI_MSK);
+ priv->write(reg_mecr, ®s->mecr);
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 727691dd08fb..6cf0d0bc1e8d 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -216,8 +216,10 @@ int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
+ unsigned long flags;
+
+ if (skb_queue_len(&offload->skb_queue) >
+- offload->skb_queue_len_max)
+- return -ENOMEM;
++ offload->skb_queue_len_max) {
++ kfree_skb(skb);
++ return -ENOBUFS;
++ }
+
+ cb = can_rx_offload_get_cb(skb);
+ cb->timestamp = timestamp;
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index 17c21ad3b95e..3a39f51a9e24 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -631,6 +631,7 @@ static int gs_can_open(struct net_device *netdev)
+ rc);
+
+ usb_unanchor_urb(urb);
++ usb_free_urb(urb);
+ break;
+ }
+
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
+index 8d8c2086424d..1b0afeaf1a3c 100644
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -887,9 +887,8 @@ static void mcba_usb_disconnect(struct usb_interface *intf)
+ netdev_info(priv->netdev, "device disconnected\n");
+
+ unregister_candev(priv->netdev);
+- free_candev(priv->netdev);
+-
+ mcba_urb_unlink(priv);
++ free_candev(priv->netdev);
+ }
+
+ static struct usb_driver mcba_usb_driver = {
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
+index 13238a72a338..61f33c2fb1cd 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
+@@ -108,7 +108,7 @@ struct pcan_usb_msg_context {
+ u8 *end;
+ u8 rec_cnt;
+ u8 rec_idx;
+- u8 rec_data_idx;
++ u8 rec_ts_idx;
+ struct net_device *netdev;
+ struct pcan_usb *pdev;
+ };
+@@ -555,10 +555,15 @@ static int pcan_usb_decode_status(struct pcan_usb_msg_context *mc,
+ mc->ptr += PCAN_USB_CMD_ARGS;
+
+ if (status_len & PCAN_USB_STATUSLEN_TIMESTAMP) {
+- int err = pcan_usb_decode_ts(mc, !mc->rec_idx);
++ int err = pcan_usb_decode_ts(mc, !mc->rec_ts_idx);
+
+ if (err)
+ return err;
++
++ /* Next packet in the buffer will have a timestamp on a single
++ * byte
++ */
++ mc->rec_ts_idx++;
+ }
+
+ switch (f) {
+@@ -640,10 +645,13 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len)
+
+ cf->can_dlc = get_can_dlc(rec_len);
+
+- /* first data packet timestamp is a word */
+- if (pcan_usb_decode_ts(mc, !mc->rec_data_idx))
++ /* Only first packet timestamp is a word */
++ if (pcan_usb_decode_ts(mc, !mc->rec_ts_idx))
+ goto decode_failed;
+
++ /* Next packet in the buffer will have a timestamp on a single byte */
++ mc->rec_ts_idx++;
++
+ /* read data */
+ memset(cf->data, 0x0, sizeof(cf->data));
+ if (status_len & PCAN_USB_STATUSLEN_RTR) {
+@@ -696,7 +704,6 @@ static int pcan_usb_decode_msg(struct peak_usb_device *dev, u8 *ibuf, u32 lbuf)
+ /* handle normal can frames here */
+ } else {
+ err = pcan_usb_decode_data(&mc, sl);
+- mc.rec_data_idx++;
+ }
+ }
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index 43b0fa2b9932..afc8d978124e 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -758,7 +758,7 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
+ dev = netdev_priv(netdev);
+
+ /* allocate a buffer large enough to send commands */
+- dev->cmd_buf = kmalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL);
++ dev->cmd_buf = kzalloc(PCAN_USB_MAX_CMD_LEN, GFP_KERNEL);
+ if (!dev->cmd_buf) {
+ err = -ENOMEM;
+ goto lbl_free_candev;
+diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
+index 27861c417c94..3e4416473607 100644
+--- a/drivers/net/can/usb/usb_8dev.c
++++ b/drivers/net/can/usb/usb_8dev.c
+@@ -1007,9 +1007,8 @@ static void usb_8dev_disconnect(struct usb_interface *intf)
+ netdev_info(priv->netdev, "device disconnected\n");
+
+ unregister_netdev(priv->netdev);
+- free_candev(priv->netdev);
+-
+ unlink_all_urbs(priv);
++ free_candev(priv->netdev);
+ }
+
+ }
+diff --git a/drivers/net/ethernet/arc/emac_rockchip.c b/drivers/net/ethernet/arc/emac_rockchip.c
+index 0f6576802607..a1df2ebab07f 100644
+--- a/drivers/net/ethernet/arc/emac_rockchip.c
++++ b/drivers/net/ethernet/arc/emac_rockchip.c
+@@ -265,6 +265,9 @@ static int emac_rockchip_remove(struct platform_device *pdev)
+ if (priv->regulator)
+ regulator_disable(priv->regulator);
+
++ if (priv->soc_data->need_div_macclk)
++ clk_disable_unprepare(priv->macclk);
++
+ free_netdev(ndev);
+ return err;
+ }
+diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+index bb43ddb7539e..592fb9e847b9 100644
+--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
++++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+@@ -1495,7 +1495,7 @@ static int octeon_mgmt_probe(struct platform_device *pdev)
+ netdev->ethtool_ops = &octeon_mgmt_ethtool_ops;
+
+ netdev->min_mtu = 64 - OCTEON_MGMT_RX_HEADROOM;
+- netdev->max_mtu = 16383 - OCTEON_MGMT_RX_HEADROOM;
++ netdev->max_mtu = 16383 - OCTEON_MGMT_RX_HEADROOM - VLAN_HLEN;
+
+ mac = of_get_mac_address(pdev->dev.of_node);
+
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index 2f8f03e0db81..644ad78d0051 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -945,7 +945,6 @@ static int hip04_remove(struct platform_device *pdev)
+
+ hip04_free_ring(ndev, d);
+ unregister_netdev(ndev);
+- free_irq(ndev->irq, ndev);
+ of_node_put(priv->phy_node);
+ cancel_work_sync(&priv->tx_timeout_task);
+ free_netdev(ndev);
+diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
+index c7fa97a7e1f4..b758b3e79337 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
++++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
+@@ -203,7 +203,6 @@ hnae_init_ring(struct hnae_queue *q, struct hnae_ring *ring, int flags)
+
+ ring->q = q;
+ ring->flags = flags;
+- spin_lock_init(&ring->lock);
+ ring->coal_param = q->handle->coal_param;
+ assert(!ring->desc && !ring->desc_cb && !ring->desc_dma_addr);
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
+index 08a750fb60c4..c8cbbe5d5549 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
++++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
+@@ -278,9 +278,6 @@ struct hnae_ring {
+ /* statistic */
+ struct ring_stats stats;
+
+- /* ring lock for poll one */
+- spinlock_t lock;
+-
+ dma_addr_t desc_dma_addr;
+ u32 buf_size; /* size for hnae_desc->addr, preset by AE */
+ u16 desc_num; /* total number of desc */
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 1c70f9aa0aa7..7f8cf809e02b 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -947,15 +947,6 @@ static int is_valid_clean_head(struct hnae_ring *ring, int h)
+ return u > c ? (h > c && h <= u) : (h > c || h <= u);
+ }
+
+-/* netif_tx_lock will turn down the performance, set only when necessary */
+-#ifdef CONFIG_NET_POLL_CONTROLLER
+-#define NETIF_TX_LOCK(ring) spin_lock(&(ring)->lock)
+-#define NETIF_TX_UNLOCK(ring) spin_unlock(&(ring)->lock)
+-#else
+-#define NETIF_TX_LOCK(ring)
+-#define NETIF_TX_UNLOCK(ring)
+-#endif
+-
+ /* reclaim all desc in one budget
+ * return error or number of desc left
+ */
+@@ -969,21 +960,16 @@ static int hns_nic_tx_poll_one(struct hns_nic_ring_data *ring_data,
+ int head;
+ int bytes, pkts;
+
+- NETIF_TX_LOCK(ring);
+-
+ head = readl_relaxed(ring->io_base + RCB_REG_HEAD);
+ rmb(); /* make sure head is ready before touch any data */
+
+- if (is_ring_empty(ring) || head == ring->next_to_clean) {
+- NETIF_TX_UNLOCK(ring);
++ if (is_ring_empty(ring) || head == ring->next_to_clean)
+ return 0; /* no data to poll */
+- }
+
+ if (!is_valid_clean_head(ring, head)) {
+ netdev_err(ndev, "wrong head (%d, %d-%d)\n", head,
+ ring->next_to_use, ring->next_to_clean);
+ ring->stats.io_err_cnt++;
+- NETIF_TX_UNLOCK(ring);
+ return -EIO;
+ }
+
+@@ -998,8 +984,6 @@ static int hns_nic_tx_poll_one(struct hns_nic_ring_data *ring_data,
+ ring->stats.tx_pkts += pkts;
+ ring->stats.tx_bytes += bytes;
+
+- NETIF_TX_UNLOCK(ring);
+-
+ dev_queue = netdev_get_tx_queue(ndev, ring_data->queue_index);
+ netdev_tx_completed_queue(dev_queue, pkts, bytes);
+
+@@ -1059,16 +1043,12 @@ static void hns_nic_tx_clr_all_bufs(struct hns_nic_ring_data *ring_data)
+ int head;
+ int bytes, pkts;
+
+- NETIF_TX_LOCK(ring);
+-
+ head = ring->next_to_use; /* ntu :soft setted ring position*/
+ bytes = 0;
+ pkts = 0;
+ while (head != ring->next_to_clean)
+ hns_nic_reclaim_one_desc(ring, &bytes, &pkts);
+
+- NETIF_TX_UNLOCK(ring);
+-
+ dev_queue = netdev_get_tx_queue(ndev, ring_data->queue_index);
+ netdev_tx_reset_queue(dev_queue);
+ }
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+index 2569a168334c..903b0a902cb9 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+@@ -607,6 +607,7 @@ static int e1000_set_ringparam(struct net_device *netdev,
+ for (i = 0; i < adapter->num_rx_queues; i++)
+ rxdr[i].count = rxdr->count;
+
++ err = 0;
+ if (netif_running(adapter->netdev)) {
+ /* Try to get new resources before deleting old */
+ err = e1000_setup_all_rx_resources(adapter);
+@@ -627,14 +628,13 @@ static int e1000_set_ringparam(struct net_device *netdev,
+ adapter->rx_ring = rxdr;
+ adapter->tx_ring = txdr;
+ err = e1000_up(adapter);
+- if (err)
+- goto err_setup;
+ }
+ kfree(tx_old);
+ kfree(rx_old);
+
+ clear_bit(__E1000_RESETTING, &adapter->flags);
+- return 0;
++ return err;
++
+ err_setup_tx:
+ e1000_free_all_rx_resources(adapter);
+ err_setup_rx:
+@@ -646,7 +646,6 @@ err_alloc_rx:
+ err_alloc_tx:
+ if (netif_running(adapter->netdev))
+ e1000_up(adapter);
+-err_setup:
+ clear_bit(__E1000_RESETTING, &adapter->flags);
+ return err;
+ }
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index ab76a5f77cd0..36db874f3c92 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -2064,7 +2064,8 @@ static void igb_check_swap_media(struct igb_adapter *adapter)
+ if ((hw->phy.media_type == e1000_media_type_copper) &&
+ (!(connsw & E1000_CONNSW_AUTOSENSE_EN))) {
+ swap_now = true;
+- } else if (!(connsw & E1000_CONNSW_SERDESD)) {
++ } else if ((hw->phy.media_type != e1000_media_type_copper) &&
++ !(connsw & E1000_CONNSW_SERDESD)) {
+ /* copper signal takes time to appear */
+ if (adapter->copper_tries < 4) {
+ adapter->copper_tries++;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+index 0b03d65474e9..73dce92c41c4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+@@ -462,7 +462,10 @@ netdev_tx_t mlx5e_xmit(struct sk_buff *skb, struct net_device *dev)
+ static void mlx5e_dump_error_cqe(struct mlx5e_txqsq *sq,
+ struct mlx5_err_cqe *err_cqe)
+ {
+- u32 ci = mlx5_cqwq_get_ci(&sq->cq.wq);
++ struct mlx5_cqwq *wq = &sq->cq.wq;
++ u32 ci;
++
++ ci = mlx5_cqwq_ctr2ix(wq, wq->cc - 1);
+
+ netdev_err(sq->channel->netdev,
+ "Error cqe on cqn 0x%x, ci 0x%x, sqn 0x%x, syndrome 0x%x, vendor syndrome 0x%x\n",
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
+index 8ca1d1949d93..d8d0b6bd5c5a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
+@@ -462,8 +462,10 @@ static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size)
+ }
+
+ err = mlx5_vector2eqn(mdev, smp_processor_id(), &eqn, &irqn);
+- if (err)
++ if (err) {
++ kvfree(in);
+ goto err_cqwq;
++ }
+
+ cqc = MLX5_ADDR_OF(create_cq_in, in, cq_context);
+ MLX5_SET(cqc, cqc, log_cq_size, ilog2(cq_size));
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 732ba21d3369..a29a6a618110 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -253,8 +253,15 @@ static int ocelot_vlan_vid_add(struct net_device *dev, u16 vid, bool pvid,
+ port->pvid = vid;
+
+ /* Untagged egress vlan clasification */
+- if (untagged)
++ if (untagged && port->vid != vid) {
++ if (port->vid) {
++ dev_err(ocelot->dev,
++ "Port already has a native VLAN: %d\n",
++ port->vid);
++ return -EBUSY;
++ }
+ port->vid = vid;
++ }
+
+ ocelot_vlan_port_apply(ocelot, port);
+
+@@ -886,7 +893,7 @@ end:
+ static int ocelot_vlan_rx_add_vid(struct net_device *dev, __be16 proto,
+ u16 vid)
+ {
+- return ocelot_vlan_vid_add(dev, vid, false, true);
++ return ocelot_vlan_vid_add(dev, vid, false, false);
+ }
+
+ static int ocelot_vlan_rx_kill_vid(struct net_device *dev, __be16 proto,
+@@ -1506,9 +1513,6 @@ static int ocelot_netdevice_port_event(struct net_device *dev,
+ struct ocelot_port *ocelot_port = netdev_priv(dev);
+ int err = 0;
+
+- if (!ocelot_netdevice_dev_check(dev))
+- return 0;
+-
+ switch (event) {
+ case NETDEV_CHANGEUPPER:
+ if (netif_is_bridge_master(info->upper_dev)) {
+@@ -1545,12 +1549,16 @@ static int ocelot_netdevice_event(struct notifier_block *unused,
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+ int ret = 0;
+
++ if (!ocelot_netdevice_dev_check(dev))
++ return 0;
++
+ if (event == NETDEV_PRECHANGEUPPER &&
+ netif_is_lag_master(info->upper_dev)) {
+ struct netdev_lag_upper_info *lag_upper_info = info->upper_info;
+ struct netlink_ext_ack *extack;
+
+- if (lag_upper_info->tx_type != NETDEV_LAG_TX_TYPE_HASH) {
++ if (lag_upper_info &&
++ lag_upper_info->tx_type != NETDEV_LAG_TX_TYPE_HASH) {
+ extack = netdev_notifier_info_to_extack(&info->info);
+ NL_SET_ERR_MSG_MOD(extack, "LAG device using unsupported Tx type");
+
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
+index f3d9c40c4115..630b13a9c3d5 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
+@@ -1170,8 +1170,16 @@ enum qede_remove_mode {
+ static void __qede_remove(struct pci_dev *pdev, enum qede_remove_mode mode)
+ {
+ struct net_device *ndev = pci_get_drvdata(pdev);
+- struct qede_dev *edev = netdev_priv(ndev);
+- struct qed_dev *cdev = edev->cdev;
++ struct qede_dev *edev;
++ struct qed_dev *cdev;
++
++ if (!ndev) {
++ dev_info(&pdev->dev, "Device has already been removed\n");
++ return;
++ }
++
++ edev = netdev_priv(ndev);
++ cdev = edev->cdev;
+
+ DP_INFO(edev, "Starting qede_remove\n");
+
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+index 5f4e447c5dce..f66d1255e36a 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+@@ -66,10 +66,10 @@ static int rmnet_unregister_real_device(struct net_device *real_dev,
+ if (port->nr_rmnet_devs)
+ return -EINVAL;
+
+- kfree(port);
+-
+ netdev_rx_handler_unregister(real_dev);
+
++ kfree(port);
++
+ /* release reference on real_dev */
+ dev_put(real_dev);
+
+diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
+index d3eae1239045..61a9843346ad 100644
+--- a/drivers/net/fjes/fjes_main.c
++++ b/drivers/net/fjes/fjes_main.c
+@@ -1252,8 +1252,17 @@ static int fjes_probe(struct platform_device *plat_dev)
+ adapter->open_guard = false;
+
+ adapter->txrx_wq = alloc_workqueue(DRV_NAME "/txrx", WQ_MEM_RECLAIM, 0);
++ if (unlikely(!adapter->txrx_wq)) {
++ err = -ENOMEM;
++ goto err_free_netdev;
++ }
++
+ adapter->control_wq = alloc_workqueue(DRV_NAME "/control",
+ WQ_MEM_RECLAIM, 0);
++ if (unlikely(!adapter->control_wq)) {
++ err = -ENOMEM;
++ goto err_free_txrx_wq;
++ }
+
+ INIT_WORK(&adapter->tx_stall_task, fjes_tx_stall_task);
+ INIT_WORK(&adapter->raise_intr_rxdata_task,
+@@ -1270,7 +1279,7 @@ static int fjes_probe(struct platform_device *plat_dev)
+ hw->hw_res.irq = platform_get_irq(plat_dev, 0);
+ err = fjes_hw_init(&adapter->hw);
+ if (err)
+- goto err_free_netdev;
++ goto err_free_control_wq;
+
+ /* setup MAC address (02:00:00:00:00:[epid])*/
+ netdev->dev_addr[0] = 2;
+@@ -1292,6 +1301,10 @@ static int fjes_probe(struct platform_device *plat_dev)
+
+ err_hw_exit:
+ fjes_hw_exit(&adapter->hw);
++err_free_control_wq:
++ destroy_workqueue(adapter->control_wq);
++err_free_txrx_wq:
++ destroy_workqueue(adapter->txrx_wq);
+ err_free_netdev:
+ free_netdev(netdev);
+ err_out:
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 6f6c0dbd91fc..b7a71c203aa3 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -993,7 +993,7 @@ static int netvsc_attach(struct net_device *ndev,
+ if (netif_running(ndev)) {
+ ret = rndis_filter_open(nvdev);
+ if (ret)
+- return ret;
++ goto err;
+
+ rdev = nvdev->extension;
+ if (!rdev->link_state)
+@@ -1001,6 +1001,13 @@ static int netvsc_attach(struct net_device *ndev,
+ }
+
+ return 0;
++
++err:
++ netif_device_detach(ndev);
++
++ rndis_filter_device_remove(hdev, nvdev);
++
++ return ret;
+ }
+
+ static int netvsc_set_channels(struct net_device *net,
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 0dc92d2faa64..05115fb0c97a 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -3008,12 +3008,10 @@ static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = {
+ static void macsec_free_netdev(struct net_device *dev)
+ {
+ struct macsec_dev *macsec = macsec_priv(dev);
+- struct net_device *real_dev = macsec->real_dev;
+
+ free_percpu(macsec->stats);
+ free_percpu(macsec->secy.tx_sc.stats);
+
+- dev_put(real_dev);
+ }
+
+ static void macsec_setup(struct net_device *dev)
+@@ -3268,8 +3266,6 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ if (err < 0)
+ return err;
+
+- dev_hold(real_dev);
+-
+ macsec->nest_level = dev_get_nest_level(real_dev) + 1;
+ netdev_lockdep_set_classes(dev);
+ lockdep_set_class_and_subclass(&dev->addr_list_lock,
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index f53e3e4e25f3..a57d82ef0f81 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -578,8 +578,8 @@ static void cdc_ncm_set_dgram_size(struct usbnet *dev, int new_size)
+ /* read current mtu value from device */
+ err = usbnet_read_cmd(dev, USB_CDC_GET_MAX_DATAGRAM_SIZE,
+ USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
+- 0, iface_no, &max_datagram_size, 2);
+- if (err < 0) {
++ 0, iface_no, &max_datagram_size, sizeof(max_datagram_size));
++ if (err < sizeof(max_datagram_size)) {
+ dev_dbg(&dev->intf->dev, "GET_MAX_DATAGRAM_SIZE failed\n");
+ goto out;
+ }
+@@ -590,7 +590,7 @@ static void cdc_ncm_set_dgram_size(struct usbnet *dev, int new_size)
+ max_datagram_size = cpu_to_le16(ctx->max_datagram_size);
+ err = usbnet_write_cmd(dev, USB_CDC_SET_MAX_DATAGRAM_SIZE,
+ USB_TYPE_CLASS | USB_DIR_OUT | USB_RECIP_INTERFACE,
+- 0, iface_no, &max_datagram_size, 2);
++ 0, iface_no, &max_datagram_size, sizeof(max_datagram_size));
+ if (err < 0)
+ dev_dbg(&dev->intf->dev, "SET_MAX_DATAGRAM_SIZE failed\n");
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 6f517e673020..9f037c50054d 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1297,6 +1297,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x413c, 0x81b6, 8)}, /* Dell Wireless 5811e */
+ {QMI_FIXED_INTF(0x413c, 0x81b6, 10)}, /* Dell Wireless 5811e */
+ {QMI_FIXED_INTF(0x413c, 0x81d7, 0)}, /* Dell Wireless 5821e */
++ {QMI_FIXED_INTF(0x413c, 0x81e0, 0)}, /* Dell Wireless 5821e with eSIM support*/
+ {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
+ {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */
+ {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */
+diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
+index d8d70dd830b0..7f143387b9ff 100644
+--- a/drivers/nfc/fdp/i2c.c
++++ b/drivers/nfc/fdp/i2c.c
+@@ -267,7 +267,7 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev,
+ *fw_vsc_cfg, len);
+
+ if (r) {
+- devm_kfree(dev, fw_vsc_cfg);
++ devm_kfree(dev, *fw_vsc_cfg);
+ goto vsc_read_err;
+ }
+ } else {
+diff --git a/drivers/nfc/st21nfca/core.c b/drivers/nfc/st21nfca/core.c
+index e803fdfa9189..f37069b53b20 100644
+--- a/drivers/nfc/st21nfca/core.c
++++ b/drivers/nfc/st21nfca/core.c
+@@ -719,6 +719,7 @@ static int st21nfca_hci_complete_target_discovered(struct nfc_hci_dev *hdev,
+ NFC_PROTO_FELICA_MASK;
+ } else {
+ kfree_skb(nfcid_skb);
++ nfcid_skb = NULL;
+ /* P2P in type A */
+ r = nfc_hci_get_param(hdev, ST21NFCA_RF_READER_F_GATE,
+ ST21NFCA_RF_READER_F_NFCID1,
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 892ef5212232..838ee58d80cd 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -575,7 +575,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
+ goto out;
+ }
+
+- error = nvme_read_ana_log(ctrl, true);
++ error = nvme_read_ana_log(ctrl, false);
+ if (error)
+ goto out_free_ana_log_buf;
+ return 0;
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 976eaa9a9f26..58e487352853 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -545,12 +545,15 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA, 0x0bf1, tegra_pcie_fixup_class);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA, 0x0e1c, tegra_pcie_fixup_class);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA, 0x0e1d, tegra_pcie_fixup_class);
+
+-/* Tegra PCIE requires relaxed ordering */
++/* Tegra20 and Tegra30 PCIE requires relaxed ordering */
+ static void tegra_pcie_relax_enable(struct pci_dev *dev)
+ {
+ pcie_capability_set_word(dev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_RELAX_EN);
+ }
+-DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, tegra_pcie_relax_enable);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0bf0, tegra_pcie_relax_enable);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0bf1, tegra_pcie_relax_enable);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0e1c, tegra_pcie_relax_enable);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0e1d, tegra_pcie_relax_enable);
+
+ static int tegra_pcie_request_resources(struct tegra_pcie *pcie)
+ {
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index 227646eb817c..9eab50839581 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1595,7 +1595,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ intsel >>= CHV_PADCTRL0_INTSEL_SHIFT;
+
+ if (need_valid_mask && intsel >= community->nirqs)
+- clear_bit(i, chip->irq.valid_mask);
++ clear_bit(desc->number, chip->irq.valid_mask);
+ }
+
+ /*
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
+index 1ea3438ea67e..89ff2795a8b5 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.c
++++ b/drivers/pinctrl/intel/pinctrl-intel.c
+@@ -49,6 +49,7 @@
+ #define PADCFG0_GPIROUTNMI BIT(17)
+ #define PADCFG0_PMODE_SHIFT 10
+ #define PADCFG0_PMODE_MASK (0xf << PADCFG0_PMODE_SHIFT)
++#define PADCFG0_PMODE_GPIO 0
+ #define PADCFG0_GPIORXDIS BIT(9)
+ #define PADCFG0_GPIOTXDIS BIT(8)
+ #define PADCFG0_GPIORXSTATE BIT(1)
+@@ -301,7 +302,7 @@ static void intel_pin_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s,
+ cfg1 = readl(intel_get_padcfg(pctrl, pin, PADCFG1));
+
+ mode = (cfg0 & PADCFG0_PMODE_MASK) >> PADCFG0_PMODE_SHIFT;
+- if (!mode)
++ if (mode == PADCFG0_PMODE_GPIO)
+ seq_puts(s, "GPIO ");
+ else
+ seq_printf(s, "mode %d ", mode);
+@@ -422,6 +423,11 @@ static void __intel_gpio_set_direction(void __iomem *padcfg0, bool input)
+ writel(value, padcfg0);
+ }
+
++static int intel_gpio_get_gpio_mode(void __iomem *padcfg0)
++{
++ return (readl(padcfg0) & PADCFG0_PMODE_MASK) >> PADCFG0_PMODE_SHIFT;
++}
++
+ static void intel_gpio_set_gpio_mode(void __iomem *padcfg0)
+ {
+ u32 value;
+@@ -450,7 +456,20 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+ }
+
+ padcfg0 = intel_get_padcfg(pctrl, pin, PADCFG0);
++
++ /*
++ * If pin is already configured in GPIO mode, we assume that
++ * firmware provides correct settings. In such case we avoid
++ * potential glitches on the pin. Otherwise, for the pin in
++ * alternative mode, consumer has to supply respective flags.
++ */
++ if (intel_gpio_get_gpio_mode(padcfg0) == PADCFG0_PMODE_GPIO) {
++ raw_spin_unlock_irqrestore(&pctrl->lock, flags);
++ return 0;
++ }
++
+ intel_gpio_set_gpio_mode(padcfg0);
++
+ /* Disable TX buffer and enable RX (this will be input) */
+ __intel_gpio_set_direction(padcfg0, true);
+
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index a6619fd8238c..ae6301c79678 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -844,9 +844,9 @@ lpfc_disc_set_adisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
+
+ if (!(vport->fc_flag & FC_PT2PT)) {
+ /* Check config parameter use-adisc or FCP-2 */
+- if ((vport->cfg_use_adisc && (vport->fc_flag & FC_RSCN_MODE)) ||
++ if (vport->cfg_use_adisc && ((vport->fc_flag & FC_RSCN_MODE) ||
+ ((ndlp->nlp_fcp_info & NLP_FCP_2_DEVICE) &&
+- (ndlp->nlp_type & NLP_FCP_TARGET))) {
++ (ndlp->nlp_type & NLP_FCP_TARGET)))) {
+ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag |= NLP_NPR_ADISC;
+ spin_unlock_irq(shost->host_lock);
+diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
+index 4a9fd8d944d6..85b03a7f473c 100644
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -258,7 +258,7 @@ qla2x00_process_els(struct bsg_job *bsg_job)
+ srb_t *sp;
+ const char *type;
+ int req_sg_cnt, rsp_sg_cnt;
+- int rval = (DRIVER_ERROR << 16);
++ int rval = (DID_ERROR << 16);
+ uint16_t nextlid = 0;
+
+ if (bsg_request->msgcode == FC_BSG_RPT_ELS) {
+@@ -433,7 +433,7 @@ qla2x00_process_ct(struct bsg_job *bsg_job)
+ struct Scsi_Host *host = fc_bsg_to_shost(bsg_job);
+ scsi_qla_host_t *vha = shost_priv(host);
+ struct qla_hw_data *ha = vha->hw;
+- int rval = (DRIVER_ERROR << 16);
++ int rval = (DID_ERROR << 16);
+ int req_sg_cnt, rsp_sg_cnt;
+ uint16_t loop_id;
+ struct fc_port *fcport;
+@@ -1948,7 +1948,7 @@ qlafx00_mgmt_cmd(struct bsg_job *bsg_job)
+ struct Scsi_Host *host = fc_bsg_to_shost(bsg_job);
+ scsi_qla_host_t *vha = shost_priv(host);
+ struct qla_hw_data *ha = vha->hw;
+- int rval = (DRIVER_ERROR << 16);
++ int rval = (DID_ERROR << 16);
+ struct qla_mt_iocb_rqst_fx00 *piocb_rqst;
+ srb_t *sp;
+ int req_sg_cnt = 0, rsp_sg_cnt = 0;
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 84f57f075455..128fcff24f1b 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -684,6 +684,7 @@ qla2x00_execute_fw(scsi_qla_host_t *vha, uint32_t risc_addr)
+ mcp->mb[2] = LSW(risc_addr);
+ mcp->mb[3] = 0;
+ mcp->mb[4] = 0;
++ mcp->mb[11] = 0;
+ ha->flags.using_lr_setting = 0;
+ if (IS_QLA25XX(ha) || IS_QLA81XX(ha) || IS_QLA83XX(ha) ||
+ IS_QLA27XX(ha)) {
+@@ -727,7 +728,7 @@ qla2x00_execute_fw(scsi_qla_host_t *vha, uint32_t risc_addr)
+ if (ha->flags.exchoffld_enabled)
+ mcp->mb[4] |= ENABLE_EXCHANGE_OFFLD;
+
+- mcp->out_mb |= MBX_4|MBX_3|MBX_2|MBX_1;
++ mcp->out_mb |= MBX_4 | MBX_3 | MBX_2 | MBX_1 | MBX_11;
+ mcp->in_mb |= MBX_3 | MBX_2 | MBX_1;
+ } else {
+ mcp->mb[1] = LSW(risc_addr);
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 856a7ceb9a04..18ee614fe07f 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3496,6 +3496,10 @@ qla2x00_shutdown(struct pci_dev *pdev)
+ qla2x00_try_to_stop_firmware(vha);
+ }
+
++ /* Disable timer */
++ if (vha->timer_active)
++ qla2x00_stop_timer(vha);
++
+ /* Turn adapter off line */
+ vha->flags.online = 0;
+
+diff --git a/drivers/soundwire/Kconfig b/drivers/soundwire/Kconfig
+index 1ba1556f1987..c7708feaa62e 100644
+--- a/drivers/soundwire/Kconfig
++++ b/drivers/soundwire/Kconfig
+@@ -4,6 +4,7 @@
+
+ menuconfig SOUNDWIRE
+ tristate "SoundWire support"
++ depends on ACPI
+ help
+ SoundWire is a 2-Pin interface with data and clock line ratified
+ by the MIPI Alliance. SoundWire is used for transporting data
+diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
+index dcc0ff9f0c22..83576810eee6 100644
+--- a/drivers/soundwire/bus.c
++++ b/drivers/soundwire/bus.c
+@@ -805,7 +805,7 @@ static int sdw_handle_port_interrupt(struct sdw_slave *slave,
+ static int sdw_handle_slave_alerts(struct sdw_slave *slave)
+ {
+ struct sdw_slave_intr_status slave_intr;
+- u8 clear = 0, bit, port_status[15];
++ u8 clear = 0, bit, port_status[15] = {0};
+ int port_num, stat, ret, count = 0;
+ unsigned long port;
+ bool slave_notify = false;
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 921ad6998dec..1eb72be75fb7 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -348,6 +348,11 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+
+ /* Validate the wMaxPacketSize field */
+ maxp = usb_endpoint_maxp(&endpoint->desc);
++ if (maxp == 0) {
++ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n",
++ cfgno, inum, asnum, d->bEndpointAddress);
++ goto skip_to_next_endpoint_or_interface_descriptor;
++ }
+
+ /* Find the highest legal maxpacket size for this endpoint */
+ i = 0; /* additional transactions per microframe */
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 05b9ccff7447..aca7e7fa5e47 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -299,8 +299,7 @@ static void dwc3_frame_length_adjustment(struct dwc3 *dwc)
+
+ reg = dwc3_readl(dwc->regs, DWC3_GFLADJ);
+ dft = reg & DWC3_GFLADJ_30MHZ_MASK;
+- if (!dev_WARN_ONCE(dwc->dev, dft == dwc->fladj,
+- "request value same as default, ignoring\n")) {
++ if (dft != dwc->fladj) {
+ reg &= ~DWC3_GFLADJ_30MHZ_MASK;
+ reg |= DWC3_GFLADJ_30MHZ_SDBND_SEL | dwc->fladj;
+ dwc3_writel(dwc->regs, DWC3_GFLADJ, reg);
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 8cced3609e24..b4e42d597211 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -256,7 +256,7 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+
+ ret = platform_device_add_properties(dwc->dwc3, p);
+ if (ret < 0)
+- return ret;
++ goto err;
+
+ ret = dwc3_pci_quirks(dwc);
+ if (ret)
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 54de73255064..8398c33d08e7 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -698,6 +698,12 @@ static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep)
+
+ dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
+ }
++
++ while (!list_empty(&dep->cancelled_list)) {
++ req = next_request(&dep->cancelled_list);
++
++ dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
++ }
+ }
+
+ /**
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index dfcabadeed01..33115e19756c 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -2156,14 +2156,18 @@ void composite_dev_cleanup(struct usb_composite_dev *cdev)
+ usb_ep_dequeue(cdev->gadget->ep0, cdev->os_desc_req);
+
+ kfree(cdev->os_desc_req->buf);
++ cdev->os_desc_req->buf = NULL;
+ usb_ep_free_request(cdev->gadget->ep0, cdev->os_desc_req);
++ cdev->os_desc_req = NULL;
+ }
+ if (cdev->req) {
+ if (cdev->setup_pending)
+ usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
+
+ kfree(cdev->req->buf);
++ cdev->req->buf = NULL;
+ usb_ep_free_request(cdev->gadget->ep0, cdev->req);
++ cdev->req = NULL;
+ }
+ cdev->next_string_id = 0;
+ device_remove_file(&cdev->gadget->dev, &dev_attr_suspended);
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 025129942894..33852c2b29d1 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -61,6 +61,8 @@ struct gadget_info {
+ bool use_os_desc;
+ char b_vendor_code;
+ char qw_sign[OS_STRING_QW_SIGN_LEN];
++ spinlock_t spinlock;
++ bool unbind;
+ };
+
+ static inline struct gadget_info *to_gadget_info(struct config_item *item)
+@@ -1244,6 +1246,7 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
+ int ret;
+
+ /* the gi->lock is hold by the caller */
++ gi->unbind = 0;
+ cdev->gadget = gadget;
+ set_gadget_data(gadget, cdev);
+ ret = composite_dev_prepare(composite, cdev);
+@@ -1376,31 +1379,128 @@ static void configfs_composite_unbind(struct usb_gadget *gadget)
+ {
+ struct usb_composite_dev *cdev;
+ struct gadget_info *gi;
++ unsigned long flags;
+
+ /* the gi->lock is hold by the caller */
+
+ cdev = get_gadget_data(gadget);
+ gi = container_of(cdev, struct gadget_info, cdev);
++ spin_lock_irqsave(&gi->spinlock, flags);
++ gi->unbind = 1;
++ spin_unlock_irqrestore(&gi->spinlock, flags);
+
+ kfree(otg_desc[0]);
+ otg_desc[0] = NULL;
+ purge_configs_funcs(gi);
+ composite_dev_cleanup(cdev);
+ usb_ep_autoconfig_reset(cdev->gadget);
++ spin_lock_irqsave(&gi->spinlock, flags);
+ cdev->gadget = NULL;
+ set_gadget_data(gadget, NULL);
++ spin_unlock_irqrestore(&gi->spinlock, flags);
++}
++
++static int configfs_composite_setup(struct usb_gadget *gadget,
++ const struct usb_ctrlrequest *ctrl)
++{
++ struct usb_composite_dev *cdev;
++ struct gadget_info *gi;
++ unsigned long flags;
++ int ret;
++
++ cdev = get_gadget_data(gadget);
++ if (!cdev)
++ return 0;
++
++ gi = container_of(cdev, struct gadget_info, cdev);
++ spin_lock_irqsave(&gi->spinlock, flags);
++ cdev = get_gadget_data(gadget);
++ if (!cdev || gi->unbind) {
++ spin_unlock_irqrestore(&gi->spinlock, flags);
++ return 0;
++ }
++
++ ret = composite_setup(gadget, ctrl);
++ spin_unlock_irqrestore(&gi->spinlock, flags);
++ return ret;
++}
++
++static void configfs_composite_disconnect(struct usb_gadget *gadget)
++{
++ struct usb_composite_dev *cdev;
++ struct gadget_info *gi;
++ unsigned long flags;
++
++ cdev = get_gadget_data(gadget);
++ if (!cdev)
++ return;
++
++ gi = container_of(cdev, struct gadget_info, cdev);
++ spin_lock_irqsave(&gi->spinlock, flags);
++ cdev = get_gadget_data(gadget);
++ if (!cdev || gi->unbind) {
++ spin_unlock_irqrestore(&gi->spinlock, flags);
++ return;
++ }
++
++ composite_disconnect(gadget);
++ spin_unlock_irqrestore(&gi->spinlock, flags);
++}
++
++static void configfs_composite_suspend(struct usb_gadget *gadget)
++{
++ struct usb_composite_dev *cdev;
++ struct gadget_info *gi;
++ unsigned long flags;
++
++ cdev = get_gadget_data(gadget);
++ if (!cdev)
++ return;
++
++ gi = container_of(cdev, struct gadget_info, cdev);
++ spin_lock_irqsave(&gi->spinlock, flags);
++ cdev = get_gadget_data(gadget);
++ if (!cdev || gi->unbind) {
++ spin_unlock_irqrestore(&gi->spinlock, flags);
++ return;
++ }
++
++ composite_suspend(gadget);
++ spin_unlock_irqrestore(&gi->spinlock, flags);
++}
++
++static void configfs_composite_resume(struct usb_gadget *gadget)
++{
++ struct usb_composite_dev *cdev;
++ struct gadget_info *gi;
++ unsigned long flags;
++
++ cdev = get_gadget_data(gadget);
++ if (!cdev)
++ return;
++
++ gi = container_of(cdev, struct gadget_info, cdev);
++ spin_lock_irqsave(&gi->spinlock, flags);
++ cdev = get_gadget_data(gadget);
++ if (!cdev || gi->unbind) {
++ spin_unlock_irqrestore(&gi->spinlock, flags);
++ return;
++ }
++
++ composite_resume(gadget);
++ spin_unlock_irqrestore(&gi->spinlock, flags);
+ }
+
+ static const struct usb_gadget_driver configfs_driver_template = {
+ .bind = configfs_composite_bind,
+ .unbind = configfs_composite_unbind,
+
+- .setup = composite_setup,
+- .reset = composite_disconnect,
+- .disconnect = composite_disconnect,
++ .setup = configfs_composite_setup,
++ .reset = configfs_composite_disconnect,
++ .disconnect = configfs_composite_disconnect,
+
+- .suspend = composite_suspend,
+- .resume = composite_resume,
++ .suspend = configfs_composite_suspend,
++ .resume = configfs_composite_resume,
+
+ .max_speed = USB_SPEED_SUPER,
+ .driver = {
+diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
+index 8f267be1745d..a4ab23033578 100644
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -436,9 +436,11 @@ static void submit_request(struct usba_ep *ep, struct usba_request *req)
+ next_fifo_transaction(ep, req);
+ if (req->last_transaction) {
+ usba_ep_writel(ep, CTL_DIS, USBA_TX_PK_RDY);
+- usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
++ if (ep_is_control(ep))
++ usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
+ } else {
+- usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
++ if (ep_is_control(ep))
++ usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
+ usba_ep_writel(ep, CTL_ENB, USBA_TX_PK_RDY);
+ }
+ }
+diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
+index be59309e848c..d44b26d5b2a2 100644
+--- a/drivers/usb/gadget/udc/fsl_udc_core.c
++++ b/drivers/usb/gadget/udc/fsl_udc_core.c
+@@ -2552,7 +2552,7 @@ static int fsl_udc_remove(struct platform_device *pdev)
+ dma_pool_destroy(udc_controller->td_pool);
+ free_irq(udc_controller->irq, udc_controller);
+ iounmap(dr_regs);
+- if (pdata->operating_mode == FSL_USB2_DR_DEVICE)
++ if (res && (pdata->operating_mode == FSL_USB2_DR_DEVICE))
+ release_mem_region(res->start, resource_size(res));
+
+ /* free udc --wait for the release() finished */
+diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
+index 320b06e0724b..67c1b8f5d54d 100644
+--- a/drivers/usb/misc/ldusb.c
++++ b/drivers/usb/misc/ldusb.c
+@@ -487,7 +487,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
+ }
+ bytes_to_read = min(count, *actual_buffer);
+ if (bytes_to_read < *actual_buffer)
+- dev_warn(&dev->intf->dev, "Read buffer overflow, %zd bytes dropped\n",
++ dev_warn(&dev->intf->dev, "Read buffer overflow, %zu bytes dropped\n",
+ *actual_buffer-bytes_to_read);
+
+ /* copy one interrupt_in_buffer from ring_buffer into userspace */
+@@ -562,8 +562,9 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer,
+ /* write the data into interrupt_out_buffer from userspace */
+ bytes_to_write = min(count, write_buffer_size*dev->interrupt_out_endpoint_size);
+ if (bytes_to_write < count)
+- dev_warn(&dev->intf->dev, "Write buffer overflow, %zd bytes dropped\n", count-bytes_to_write);
+- dev_dbg(&dev->intf->dev, "%s: count = %zd, bytes_to_write = %zd\n",
++ dev_warn(&dev->intf->dev, "Write buffer overflow, %zu bytes dropped\n",
++ count - bytes_to_write);
++ dev_dbg(&dev->intf->dev, "%s: count = %zu, bytes_to_write = %zu\n",
+ __func__, count, bytes_to_write);
+
+ if (copy_from_user(dev->interrupt_out_buffer, buffer, bytes_to_write)) {
+diff --git a/drivers/usb/usbip/stub.h b/drivers/usb/usbip/stub.h
+index 35618ceb2791..d11270560c24 100644
+--- a/drivers/usb/usbip/stub.h
++++ b/drivers/usb/usbip/stub.h
+@@ -52,7 +52,11 @@ struct stub_priv {
+ unsigned long seqnum;
+ struct list_head list;
+ struct stub_device *sdev;
+- struct urb *urb;
++ struct urb **urbs;
++ struct scatterlist *sgl;
++ int num_urbs;
++ int completed_urbs;
++ int urb_status;
+
+ int unlinking;
+ };
+@@ -86,6 +90,7 @@ extern struct usb_device_driver stub_driver;
+ struct bus_id_priv *get_busid_priv(const char *busid);
+ void put_busid_priv(struct bus_id_priv *bid);
+ int del_match_busid(char *busid);
++void stub_free_priv_and_urb(struct stub_priv *priv);
+ void stub_device_cleanup_urbs(struct stub_device *sdev);
+
+ /* stub_rx.c */
+diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
+index bf8a5feb0ee9..a20bb2d04f4d 100644
+--- a/drivers/usb/usbip/stub_main.c
++++ b/drivers/usb/usbip/stub_main.c
+@@ -6,6 +6,7 @@
+ #include <linux/string.h>
+ #include <linux/module.h>
+ #include <linux/device.h>
++#include <linux/scatterlist.h>
+
+ #include "usbip_common.h"
+ #include "stub.h"
+@@ -283,13 +284,49 @@ static struct stub_priv *stub_priv_pop_from_listhead(struct list_head *listhead)
+ struct stub_priv *priv, *tmp;
+
+ list_for_each_entry_safe(priv, tmp, listhead, list) {
+- list_del(&priv->list);
++ list_del_init(&priv->list);
+ return priv;
+ }
+
+ return NULL;
+ }
+
++void stub_free_priv_and_urb(struct stub_priv *priv)
++{
++ struct urb *urb;
++ int i;
++
++ for (i = 0; i < priv->num_urbs; i++) {
++ urb = priv->urbs[i];
++
++ if (!urb)
++ return;
++
++ kfree(urb->setup_packet);
++ urb->setup_packet = NULL;
++
++
++ if (urb->transfer_buffer && !priv->sgl) {
++ kfree(urb->transfer_buffer);
++ urb->transfer_buffer = NULL;
++ }
++
++ if (urb->num_sgs) {
++ sgl_free(urb->sg);
++ urb->sg = NULL;
++ urb->num_sgs = 0;
++ }
++
++ usb_free_urb(urb);
++ }
++ if (!list_empty(&priv->list))
++ list_del(&priv->list);
++ if (priv->sgl)
++ sgl_free(priv->sgl);
++ kfree(priv->urbs);
++ kmem_cache_free(stub_priv_cache, priv);
++}
++
+ static struct stub_priv *stub_priv_pop(struct stub_device *sdev)
+ {
+ unsigned long flags;
+@@ -316,25 +353,15 @@ done:
+ void stub_device_cleanup_urbs(struct stub_device *sdev)
+ {
+ struct stub_priv *priv;
+- struct urb *urb;
++ int i;
+
+ dev_dbg(&sdev->udev->dev, "Stub device cleaning up urbs\n");
+
+ while ((priv = stub_priv_pop(sdev))) {
+- urb = priv->urb;
+- dev_dbg(&sdev->udev->dev, "free urb seqnum %lu\n",
+- priv->seqnum);
+- usb_kill_urb(urb);
+-
+- kmem_cache_free(stub_priv_cache, priv);
++ for (i = 0; i < priv->num_urbs; i++)
++ usb_kill_urb(priv->urbs[i]);
+
+- kfree(urb->transfer_buffer);
+- urb->transfer_buffer = NULL;
+-
+- kfree(urb->setup_packet);
+- urb->setup_packet = NULL;
+-
+- usb_free_urb(urb);
++ stub_free_priv_and_urb(priv);
+ }
+ }
+
+diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
+index dbfb2f24d71e..75d8756c6d27 100644
+--- a/drivers/usb/usbip/stub_rx.c
++++ b/drivers/usb/usbip/stub_rx.c
+@@ -7,6 +7,7 @@
+ #include <linux/kthread.h>
+ #include <linux/usb.h>
+ #include <linux/usb/hcd.h>
++#include <linux/scatterlist.h>
+
+ #include "usbip_common.h"
+ #include "stub.h"
+@@ -201,7 +202,7 @@ static void tweak_special_requests(struct urb *urb)
+ static int stub_recv_cmd_unlink(struct stub_device *sdev,
+ struct usbip_header *pdu)
+ {
+- int ret;
++ int ret, i;
+ unsigned long flags;
+ struct stub_priv *priv;
+
+@@ -246,12 +247,14 @@ static int stub_recv_cmd_unlink(struct stub_device *sdev,
+ * so a driver in a client host will know the failure
+ * of the unlink request ?
+ */
+- ret = usb_unlink_urb(priv->urb);
+- if (ret != -EINPROGRESS)
+- dev_err(&priv->urb->dev->dev,
+- "failed to unlink a urb # %lu, ret %d\n",
+- priv->seqnum, ret);
+-
++ for (i = priv->completed_urbs; i < priv->num_urbs; i++) {
++ ret = usb_unlink_urb(priv->urbs[i]);
++ if (ret != -EINPROGRESS)
++ dev_err(&priv->urbs[i]->dev->dev,
++ "failed to unlink %d/%d urb of seqnum %lu, ret %d\n",
++ i + 1, priv->num_urbs,
++ priv->seqnum, ret);
++ }
+ return 0;
+ }
+
+@@ -433,14 +436,36 @@ static void masking_bogus_flags(struct urb *urb)
+ urb->transfer_flags &= allowed;
+ }
+
++static int stub_recv_xbuff(struct usbip_device *ud, struct stub_priv *priv)
++{
++ int ret;
++ int i;
++
++ for (i = 0; i < priv->num_urbs; i++) {
++ ret = usbip_recv_xbuff(ud, priv->urbs[i]);
++ if (ret < 0)
++ break;
++ }
++
++ return ret;
++}
++
+ static void stub_recv_cmd_submit(struct stub_device *sdev,
+ struct usbip_header *pdu)
+ {
+- int ret;
+ struct stub_priv *priv;
+ struct usbip_device *ud = &sdev->ud;
+ struct usb_device *udev = sdev->udev;
++ struct scatterlist *sgl = NULL, *sg;
++ void *buffer = NULL;
++ unsigned long long buf_len;
++ int nents;
++ int num_urbs = 1;
+ int pipe = get_pipe(sdev, pdu);
++ int use_sg = pdu->u.cmd_submit.transfer_flags & URB_DMA_MAP_SG;
++ int support_sg = 1;
++ int np = 0;
++ int ret, i;
+
+ if (pipe == -1)
+ return;
+@@ -449,76 +474,139 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
+ if (!priv)
+ return;
+
+- /* setup a urb */
+- if (usb_pipeisoc(pipe))
+- priv->urb = usb_alloc_urb(pdu->u.cmd_submit.number_of_packets,
+- GFP_KERNEL);
+- else
+- priv->urb = usb_alloc_urb(0, GFP_KERNEL);
++ buf_len = (unsigned long long)pdu->u.cmd_submit.transfer_buffer_length;
+
+- if (!priv->urb) {
+- usbip_event_add(ud, SDEV_EVENT_ERROR_MALLOC);
+- return;
++ /* allocate urb transfer buffer, if needed */
++ if (buf_len) {
++ if (use_sg) {
++ sgl = sgl_alloc(buf_len, GFP_KERNEL, &nents);
++ if (!sgl)
++ goto err_malloc;
++ } else {
++ buffer = kzalloc(buf_len, GFP_KERNEL);
++ if (!buffer)
++ goto err_malloc;
++ }
+ }
+
+- /* allocate urb transfer buffer, if needed */
+- if (pdu->u.cmd_submit.transfer_buffer_length > 0) {
+- priv->urb->transfer_buffer =
+- kzalloc(pdu->u.cmd_submit.transfer_buffer_length,
+- GFP_KERNEL);
+- if (!priv->urb->transfer_buffer) {
++ /* Check if the server's HCD supports SG */
++ if (use_sg && !udev->bus->sg_tablesize) {
++ /*
++ * If the server's HCD doesn't support SG, break a single SG
++ * request into several URBs and map each SG list entry to
++ * corresponding URB buffer. The previously allocated SG
++ * list is stored in priv->sgl (If the server's HCD support SG,
++ * SG list is stored only in urb->sg) and it is used as an
++ * indicator that the server split single SG request into
++ * several URBs. Later, priv->sgl is used by stub_complete() and
++ * stub_send_ret_submit() to reassemble the divied URBs.
++ */
++ support_sg = 0;
++ num_urbs = nents;
++ priv->completed_urbs = 0;
++ pdu->u.cmd_submit.transfer_flags &= ~URB_DMA_MAP_SG;
++ }
++
++ /* allocate urb array */
++ priv->num_urbs = num_urbs;
++ priv->urbs = kmalloc_array(num_urbs, sizeof(*priv->urbs), GFP_KERNEL);
++ if (!priv->urbs)
++ goto err_urbs;
++
++ /* setup a urb */
++ if (support_sg) {
++ if (usb_pipeisoc(pipe))
++ np = pdu->u.cmd_submit.number_of_packets;
++
++ priv->urbs[0] = usb_alloc_urb(np, GFP_KERNEL);
++ if (!priv->urbs[0])
++ goto err_urb;
++
++ if (buf_len) {
++ if (use_sg) {
++ priv->urbs[0]->sg = sgl;
++ priv->urbs[0]->num_sgs = nents;
++ priv->urbs[0]->transfer_buffer = NULL;
++ } else {
++ priv->urbs[0]->transfer_buffer = buffer;
++ }
++ }
++
++ /* copy urb setup packet */
++ priv->urbs[0]->setup_packet = kmemdup(&pdu->u.cmd_submit.setup,
++ 8, GFP_KERNEL);
++ if (!priv->urbs[0]->setup_packet) {
+ usbip_event_add(ud, SDEV_EVENT_ERROR_MALLOC);
+ return;
+ }
+- }
+
+- /* copy urb setup packet */
+- priv->urb->setup_packet = kmemdup(&pdu->u.cmd_submit.setup, 8,
+- GFP_KERNEL);
+- if (!priv->urb->setup_packet) {
+- dev_err(&udev->dev, "allocate setup_packet\n");
+- usbip_event_add(ud, SDEV_EVENT_ERROR_MALLOC);
+- return;
++ usbip_pack_pdu(pdu, priv->urbs[0], USBIP_CMD_SUBMIT, 0);
++ } else {
++ for_each_sg(sgl, sg, nents, i) {
++ priv->urbs[i] = usb_alloc_urb(0, GFP_KERNEL);
++ /* The URBs which is previously allocated will be freed
++ * in stub_device_cleanup_urbs() if error occurs.
++ */
++ if (!priv->urbs[i])
++ goto err_urb;
++
++ usbip_pack_pdu(pdu, priv->urbs[i], USBIP_CMD_SUBMIT, 0);
++ priv->urbs[i]->transfer_buffer = sg_virt(sg);
++ priv->urbs[i]->transfer_buffer_length = sg->length;
++ }
++ priv->sgl = sgl;
+ }
+
+- /* set other members from the base header of pdu */
+- priv->urb->context = (void *) priv;
+- priv->urb->dev = udev;
+- priv->urb->pipe = pipe;
+- priv->urb->complete = stub_complete;
++ for (i = 0; i < num_urbs; i++) {
++ /* set other members from the base header of pdu */
++ priv->urbs[i]->context = (void *) priv;
++ priv->urbs[i]->dev = udev;
++ priv->urbs[i]->pipe = pipe;
++ priv->urbs[i]->complete = stub_complete;
+
+- usbip_pack_pdu(pdu, priv->urb, USBIP_CMD_SUBMIT, 0);
++ /* no need to submit an intercepted request, but harmless? */
++ tweak_special_requests(priv->urbs[i]);
+
++ masking_bogus_flags(priv->urbs[i]);
++ }
+
+- if (usbip_recv_xbuff(ud, priv->urb) < 0)
++ if (stub_recv_xbuff(ud, priv) < 0)
+ return;
+
+- if (usbip_recv_iso(ud, priv->urb) < 0)
++ if (usbip_recv_iso(ud, priv->urbs[0]) < 0)
+ return;
+
+- /* no need to submit an intercepted request, but harmless? */
+- tweak_special_requests(priv->urb);
+-
+- masking_bogus_flags(priv->urb);
+ /* urb is now ready to submit */
+- ret = usb_submit_urb(priv->urb, GFP_KERNEL);
+-
+- if (ret == 0)
+- usbip_dbg_stub_rx("submit urb ok, seqnum %u\n",
+- pdu->base.seqnum);
+- else {
+- dev_err(&udev->dev, "submit_urb error, %d\n", ret);
+- usbip_dump_header(pdu);
+- usbip_dump_urb(priv->urb);
+-
+- /*
+- * Pessimistic.
+- * This connection will be discarded.
+- */
+- usbip_event_add(ud, SDEV_EVENT_ERROR_SUBMIT);
++ for (i = 0; i < priv->num_urbs; i++) {
++ ret = usb_submit_urb(priv->urbs[i], GFP_KERNEL);
++
++ if (ret == 0)
++ usbip_dbg_stub_rx("submit urb ok, seqnum %u\n",
++ pdu->base.seqnum);
++ else {
++ dev_err(&udev->dev, "submit_urb error, %d\n", ret);
++ usbip_dump_header(pdu);
++ usbip_dump_urb(priv->urbs[i]);
++
++ /*
++ * Pessimistic.
++ * This connection will be discarded.
++ */
++ usbip_event_add(ud, SDEV_EVENT_ERROR_SUBMIT);
++ break;
++ }
+ }
+
+ usbip_dbg_stub_rx("Leave\n");
++ return;
++
++err_urb:
++ kfree(priv->urbs);
++err_urbs:
++ kfree(buffer);
++ sgl_free(sgl);
++err_malloc:
++ usbip_event_add(ud, SDEV_EVENT_ERROR_MALLOC);
+ }
+
+ /* recv a pdu */
+diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c
+index f0ec41a50cbc..36010a82b359 100644
+--- a/drivers/usb/usbip/stub_tx.c
++++ b/drivers/usb/usbip/stub_tx.c
+@@ -5,25 +5,11 @@
+
+ #include <linux/kthread.h>
+ #include <linux/socket.h>
++#include <linux/scatterlist.h>
+
+ #include "usbip_common.h"
+ #include "stub.h"
+
+-static void stub_free_priv_and_urb(struct stub_priv *priv)
+-{
+- struct urb *urb = priv->urb;
+-
+- kfree(urb->setup_packet);
+- urb->setup_packet = NULL;
+-
+- kfree(urb->transfer_buffer);
+- urb->transfer_buffer = NULL;
+-
+- list_del(&priv->list);
+- kmem_cache_free(stub_priv_cache, priv);
+- usb_free_urb(urb);
+-}
+-
+ /* be in spin_lock_irqsave(&sdev->priv_lock, flags) */
+ void stub_enqueue_ret_unlink(struct stub_device *sdev, __u32 seqnum,
+ __u32 status)
+@@ -85,6 +71,22 @@ void stub_complete(struct urb *urb)
+ break;
+ }
+
++ /*
++ * If the server breaks single SG request into the several URBs, the
++ * URBs must be reassembled before sending completed URB to the vhci.
++ * Don't wake up the tx thread until all the URBs are completed.
++ */
++ if (priv->sgl) {
++ priv->completed_urbs++;
++
++ /* Only save the first error status */
++ if (urb->status && !priv->urb_status)
++ priv->urb_status = urb->status;
++
++ if (priv->completed_urbs < priv->num_urbs)
++ return;
++ }
++
+ /* link a urb to the queue of tx. */
+ spin_lock_irqsave(&sdev->priv_lock, flags);
+ if (sdev->ud.tcp_socket == NULL) {
+@@ -156,18 +158,22 @@ static int stub_send_ret_submit(struct stub_device *sdev)
+ size_t total_size = 0;
+
+ while ((priv = dequeue_from_priv_tx(sdev)) != NULL) {
+- int ret;
+- struct urb *urb = priv->urb;
++ struct urb *urb = priv->urbs[0];
+ struct usbip_header pdu_header;
+ struct usbip_iso_packet_descriptor *iso_buffer = NULL;
+ struct kvec *iov = NULL;
++ struct scatterlist *sg;
++ u32 actual_length = 0;
+ int iovnum = 0;
++ int ret;
++ int i;
+
+ txsize = 0;
+ memset(&pdu_header, 0, sizeof(pdu_header));
+ memset(&msg, 0, sizeof(msg));
+
+- if (urb->actual_length > 0 && !urb->transfer_buffer) {
++ if (urb->actual_length > 0 && !urb->transfer_buffer &&
++ !urb->num_sgs) {
+ dev_err(&sdev->udev->dev,
+ "urb: actual_length %d transfer_buffer null\n",
+ urb->actual_length);
+@@ -176,6 +182,11 @@ static int stub_send_ret_submit(struct stub_device *sdev)
+
+ if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
+ iovnum = 2 + urb->number_of_packets;
++ else if (usb_pipein(urb->pipe) && urb->actual_length > 0 &&
++ urb->num_sgs)
++ iovnum = 1 + urb->num_sgs;
++ else if (usb_pipein(urb->pipe) && priv->sgl)
++ iovnum = 1 + priv->num_urbs;
+ else
+ iovnum = 2;
+
+@@ -192,6 +203,15 @@ static int stub_send_ret_submit(struct stub_device *sdev)
+ setup_ret_submit_pdu(&pdu_header, urb);
+ usbip_dbg_stub_tx("setup txdata seqnum: %d\n",
+ pdu_header.base.seqnum);
++
++ if (priv->sgl) {
++ for (i = 0; i < priv->num_urbs; i++)
++ actual_length += priv->urbs[i]->actual_length;
++
++ pdu_header.u.ret_submit.status = priv->urb_status;
++ pdu_header.u.ret_submit.actual_length = actual_length;
++ }
++
+ usbip_header_correct_endian(&pdu_header, 1);
+
+ iov[iovnum].iov_base = &pdu_header;
+@@ -200,12 +220,47 @@ static int stub_send_ret_submit(struct stub_device *sdev)
+ txsize += sizeof(pdu_header);
+
+ /* 2. setup transfer buffer */
+- if (usb_pipein(urb->pipe) &&
++ if (usb_pipein(urb->pipe) && priv->sgl) {
++ /* If the server split a single SG request into several
++ * URBs because the server's HCD doesn't support SG,
++ * reassemble the split URB buffers into a single
++ * return command.
++ */
++ for (i = 0; i < priv->num_urbs; i++) {
++ iov[iovnum].iov_base =
++ priv->urbs[i]->transfer_buffer;
++ iov[iovnum].iov_len =
++ priv->urbs[i]->actual_length;
++ iovnum++;
++ }
++ txsize += actual_length;
++ } else if (usb_pipein(urb->pipe) &&
+ usb_pipetype(urb->pipe) != PIPE_ISOCHRONOUS &&
+ urb->actual_length > 0) {
+- iov[iovnum].iov_base = urb->transfer_buffer;
+- iov[iovnum].iov_len = urb->actual_length;
+- iovnum++;
++ if (urb->num_sgs) {
++ unsigned int copy = urb->actual_length;
++ int size;
++
++ for_each_sg(urb->sg, sg, urb->num_sgs, i) {
++ if (copy == 0)
++ break;
++
++ if (copy < sg->length)
++ size = copy;
++ else
++ size = sg->length;
++
++ iov[iovnum].iov_base = sg_virt(sg);
++ iov[iovnum].iov_len = size;
++
++ iovnum++;
++ copy -= size;
++ }
++ } else {
++ iov[iovnum].iov_base = urb->transfer_buffer;
++ iov[iovnum].iov_len = urb->actual_length;
++ iovnum++;
++ }
+ txsize += urb->actual_length;
+ } else if (usb_pipein(urb->pipe) &&
+ usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
+index 9756752c0681..d88a5b15f073 100644
+--- a/drivers/usb/usbip/usbip_common.c
++++ b/drivers/usb/usbip/usbip_common.c
+@@ -680,8 +680,12 @@ EXPORT_SYMBOL_GPL(usbip_pad_iso);
+ /* some members of urb must be substituted before. */
+ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
+ {
+- int ret;
++ struct scatterlist *sg;
++ int ret = 0;
++ int recv;
+ int size;
++ int copy;
++ int i;
+
+ if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC) {
+ /* the direction of urb must be OUT. */
+@@ -701,29 +705,48 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
+ if (!(size > 0))
+ return 0;
+
+- if (size > urb->transfer_buffer_length) {
++ if (size > urb->transfer_buffer_length)
+ /* should not happen, probably malicious packet */
+- if (ud->side == USBIP_STUB) {
+- usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
+- return 0;
+- } else {
+- usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+- return -EPIPE;
+- }
+- }
++ goto error;
+
+- ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
+- if (ret != size) {
+- dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);
+- if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC) {
+- usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
+- } else {
+- usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+- return -EPIPE;
++ if (urb->num_sgs) {
++ copy = size;
++ for_each_sg(urb->sg, sg, urb->num_sgs, i) {
++ int recv_size;
++
++ if (copy < sg->length)
++ recv_size = copy;
++ else
++ recv_size = sg->length;
++
++ recv = usbip_recv(ud->tcp_socket, sg_virt(sg),
++ recv_size);
++
++ if (recv != recv_size)
++ goto error;
++
++ copy -= recv;
++ ret += recv;
+ }
++
++ if (ret != size)
++ goto error;
++ } else {
++ ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
++ if (ret != size)
++ goto error;
+ }
+
+ return ret;
++
++error:
++ dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);
++ if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC)
++ usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
++ else
++ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
++
++ return -EPIPE;
+ }
+ EXPORT_SYMBOL_GPL(usbip_recv_xbuff);
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 1e592ec94ba4..d5a036bf904b 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -702,8 +702,11 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ }
+ vdev = &vhci_hcd->vdev[portnum-1];
+
+- /* patch to usb_sg_init() is in 2.5.60 */
+- BUG_ON(!urb->transfer_buffer && urb->transfer_buffer_length);
++ if (!urb->transfer_buffer && !urb->num_sgs &&
++ urb->transfer_buffer_length) {
++ dev_dbg(dev, "Null URB transfer buffer\n");
++ return -EINVAL;
++ }
+
+ spin_lock_irqsave(&vhci->lock, flags);
+
+@@ -1146,6 +1149,15 @@ static int vhci_setup(struct usb_hcd *hcd)
+ hcd->speed = HCD_USB3;
+ hcd->self.root_hub->speed = USB_SPEED_SUPER;
+ }
++
++ /*
++ * Support SG.
++ * sg_tablesize is an arbitrary value to alleviate memory pressure
++ * on the host.
++ */
++ hcd->self.sg_tablesize = 32;
++ hcd->self.no_sg_constraint = 1;
++
+ return 0;
+ }
+
+diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c
+index 44cd64518925..33f8972ba842 100644
+--- a/drivers/usb/usbip/vhci_rx.c
++++ b/drivers/usb/usbip/vhci_rx.c
+@@ -90,6 +90,9 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
+ if (usbip_dbg_flag_vhci_rx)
+ usbip_dump_urb(urb);
+
++ if (urb->num_sgs)
++ urb->transfer_flags &= ~URB_DMA_MAP_SG;
++
+ usbip_dbg_vhci_rx("now giveback urb %u\n", pdu->base.seqnum);
+
+ spin_lock_irqsave(&vhci->lock, flags);
+diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c
+index 9aed15a358b7..acac49402c2b 100644
+--- a/drivers/usb/usbip/vhci_tx.c
++++ b/drivers/usb/usbip/vhci_tx.c
+@@ -5,6 +5,7 @@
+
+ #include <linux/kthread.h>
+ #include <linux/slab.h>
++#include <linux/scatterlist.h>
+
+ #include "usbip_common.h"
+ #include "vhci.h"
+@@ -50,19 +51,23 @@ static struct vhci_priv *dequeue_from_priv_tx(struct vhci_device *vdev)
+
+ static int vhci_send_cmd_submit(struct vhci_device *vdev)
+ {
++ struct usbip_iso_packet_descriptor *iso_buffer = NULL;
+ struct vhci_priv *priv = NULL;
++ struct scatterlist *sg;
+
+ struct msghdr msg;
+- struct kvec iov[3];
++ struct kvec *iov;
+ size_t txsize;
+
+ size_t total_size = 0;
++ int iovnum;
++ int err = -ENOMEM;
++ int i;
+
+ while ((priv = dequeue_from_priv_tx(vdev)) != NULL) {
+ int ret;
+ struct urb *urb = priv->urb;
+ struct usbip_header pdu_header;
+- struct usbip_iso_packet_descriptor *iso_buffer = NULL;
+
+ txsize = 0;
+ memset(&pdu_header, 0, sizeof(pdu_header));
+@@ -72,18 +77,45 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev)
+ usbip_dbg_vhci_tx("setup txdata urb seqnum %lu\n",
+ priv->seqnum);
+
++ if (urb->num_sgs && usb_pipeout(urb->pipe))
++ iovnum = 2 + urb->num_sgs;
++ else
++ iovnum = 3;
++
++ iov = kcalloc(iovnum, sizeof(*iov), GFP_KERNEL);
++ if (!iov) {
++ usbip_event_add(&vdev->ud, SDEV_EVENT_ERROR_MALLOC);
++ return -ENOMEM;
++ }
++
++ if (urb->num_sgs)
++ urb->transfer_flags |= URB_DMA_MAP_SG;
++
+ /* 1. setup usbip_header */
+ setup_cmd_submit_pdu(&pdu_header, urb);
+ usbip_header_correct_endian(&pdu_header, 1);
++ iovnum = 0;
+
+- iov[0].iov_base = &pdu_header;
+- iov[0].iov_len = sizeof(pdu_header);
++ iov[iovnum].iov_base = &pdu_header;
++ iov[iovnum].iov_len = sizeof(pdu_header);
+ txsize += sizeof(pdu_header);
++ iovnum++;
+
+ /* 2. setup transfer buffer */
+ if (!usb_pipein(urb->pipe) && urb->transfer_buffer_length > 0) {
+- iov[1].iov_base = urb->transfer_buffer;
+- iov[1].iov_len = urb->transfer_buffer_length;
++ if (urb->num_sgs &&
++ !usb_endpoint_xfer_isoc(&urb->ep->desc)) {
++ for_each_sg(urb->sg, sg, urb->num_sgs, i) {
++ iov[iovnum].iov_base = sg_virt(sg);
++ iov[iovnum].iov_len = sg->length;
++ iovnum++;
++ }
++ } else {
++ iov[iovnum].iov_base = urb->transfer_buffer;
++ iov[iovnum].iov_len =
++ urb->transfer_buffer_length;
++ iovnum++;
++ }
+ txsize += urb->transfer_buffer_length;
+ }
+
+@@ -95,30 +127,43 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev)
+ if (!iso_buffer) {
+ usbip_event_add(&vdev->ud,
+ SDEV_EVENT_ERROR_MALLOC);
+- return -1;
++ goto err_iso_buffer;
+ }
+
+- iov[2].iov_base = iso_buffer;
+- iov[2].iov_len = len;
++ iov[iovnum].iov_base = iso_buffer;
++ iov[iovnum].iov_len = len;
++ iovnum++;
+ txsize += len;
+ }
+
+- ret = kernel_sendmsg(vdev->ud.tcp_socket, &msg, iov, 3, txsize);
++ ret = kernel_sendmsg(vdev->ud.tcp_socket, &msg, iov, iovnum,
++ txsize);
+ if (ret != txsize) {
+ pr_err("sendmsg failed!, ret=%d for %zd\n", ret,
+ txsize);
+- kfree(iso_buffer);
+ usbip_event_add(&vdev->ud, VDEV_EVENT_ERROR_TCP);
+- return -1;
++ err = -EPIPE;
++ goto err_tx;
+ }
+
++ kfree(iov);
++ /* This is only for isochronous case */
+ kfree(iso_buffer);
++ iso_buffer = NULL;
++
+ usbip_dbg_vhci_tx("send txdata\n");
+
+ total_size += txsize;
+ }
+
+ return total_size;
++
++err_tx:
++ kfree(iso_buffer);
++err_iso_buffer:
++ kfree(iov);
++
++ return err;
+ }
+
+ static struct vhci_unlink *dequeue_from_unlink_tx(struct vhci_device *vdev)
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index db547af01b59..4c0b220e20ba 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1053,6 +1053,11 @@ void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release)
+
+ dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
+
++ /* remove from inode's cap rbtree, and clear auth cap */
++ rb_erase(&cap->ci_node, &ci->i_caps);
++ if (ci->i_auth_cap == cap)
++ ci->i_auth_cap = NULL;
++
+ /* remove from session list */
+ spin_lock(&session->s_cap_lock);
+ if (session->s_cap_iterator == cap) {
+@@ -1088,11 +1093,6 @@ void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release)
+
+ spin_unlock(&session->s_cap_lock);
+
+- /* remove from inode list */
+- rb_erase(&cap->ci_node, &ci->i_caps);
+- if (ci->i_auth_cap == cap)
+- ci->i_auth_cap = NULL;
+-
+ if (removed)
+ ceph_put_cap(mdsc, cap);
+
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 8196c21d8623..acb70a6a82f0 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1399,6 +1399,7 @@ retry_lookup:
+ dout(" final dn %p\n", dn);
+ } else if ((req->r_op == CEPH_MDS_OP_LOOKUPSNAP ||
+ req->r_op == CEPH_MDS_OP_MKSNAP) &&
++ test_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags) &&
+ !test_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags)) {
+ struct dentry *dn = req->r_dentry;
+ struct inode *dir = req->r_parent;
+diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
+index 437257d1116f..308c682fa4d3 100644
+--- a/fs/cifs/smb2pdu.h
++++ b/fs/cifs/smb2pdu.h
+@@ -777,6 +777,7 @@ struct create_durable_handle_reconnect_v2 {
+ struct create_context ccontext;
+ __u8 Name[8];
+ struct durable_reconnect_context_v2 dcontext;
++ __u8 Pad[4];
+ } __packed;
+
+ /* See MS-SMB2 2.2.13.2.5 */
+diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
+index ccc31fa6f1a7..16eb59adf5aa 100644
+--- a/fs/configfs/configfs_internal.h
++++ b/fs/configfs/configfs_internal.h
+@@ -34,6 +34,15 @@
+ #include <linux/list.h>
+ #include <linux/spinlock.h>
+
++struct configfs_fragment {
++ atomic_t frag_count;
++ struct rw_semaphore frag_sem;
++ bool frag_dead;
++};
++
++void put_fragment(struct configfs_fragment *);
++struct configfs_fragment *get_fragment(struct configfs_fragment *);
++
+ struct configfs_dirent {
+ atomic_t s_count;
+ int s_dependent_count;
+@@ -48,6 +57,7 @@ struct configfs_dirent {
+ #ifdef CONFIG_LOCKDEP
+ int s_depth;
+ #endif
++ struct configfs_fragment *s_frag;
+ };
+
+ #define CONFIGFS_ROOT 0x0001
+@@ -75,8 +85,8 @@ extern int configfs_create(struct dentry *, umode_t mode, void (*init)(struct in
+ extern int configfs_create_file(struct config_item *, const struct configfs_attribute *);
+ extern int configfs_create_bin_file(struct config_item *,
+ const struct configfs_bin_attribute *);
+-extern int configfs_make_dirent(struct configfs_dirent *,
+- struct dentry *, void *, umode_t, int);
++extern int configfs_make_dirent(struct configfs_dirent *, struct dentry *,
++ void *, umode_t, int, struct configfs_fragment *);
+ extern int configfs_dirent_is_ready(struct configfs_dirent *);
+
+ extern void configfs_hash_and_remove(struct dentry * dir, const char * name);
+@@ -151,6 +161,7 @@ static inline void release_configfs_dirent(struct configfs_dirent * sd)
+ {
+ if (!(sd->s_type & CONFIGFS_ROOT)) {
+ kfree(sd->s_iattr);
++ put_fragment(sd->s_frag);
+ kmem_cache_free(configfs_dir_cachep, sd);
+ }
+ }
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index 809c1edffbaf..2cc6b1c49d34 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -164,11 +164,38 @@ configfs_adjust_dir_dirent_depth_after_populate(struct configfs_dirent *sd)
+
+ #endif /* CONFIG_LOCKDEP */
+
++static struct configfs_fragment *new_fragment(void)
++{
++ struct configfs_fragment *p;
++
++ p = kmalloc(sizeof(struct configfs_fragment), GFP_KERNEL);
++ if (p) {
++ atomic_set(&p->frag_count, 1);
++ init_rwsem(&p->frag_sem);
++ p->frag_dead = false;
++ }
++ return p;
++}
++
++void put_fragment(struct configfs_fragment *frag)
++{
++ if (frag && atomic_dec_and_test(&frag->frag_count))
++ kfree(frag);
++}
++
++struct configfs_fragment *get_fragment(struct configfs_fragment *frag)
++{
++ if (likely(frag))
++ atomic_inc(&frag->frag_count);
++ return frag;
++}
++
+ /*
+ * Allocates a new configfs_dirent and links it to the parent configfs_dirent
+ */
+ static struct configfs_dirent *configfs_new_dirent(struct configfs_dirent *parent_sd,
+- void *element, int type)
++ void *element, int type,
++ struct configfs_fragment *frag)
+ {
+ struct configfs_dirent * sd;
+
+@@ -188,6 +215,7 @@ static struct configfs_dirent *configfs_new_dirent(struct configfs_dirent *paren
+ kmem_cache_free(configfs_dir_cachep, sd);
+ return ERR_PTR(-ENOENT);
+ }
++ sd->s_frag = get_fragment(frag);
+ list_add(&sd->s_sibling, &parent_sd->s_children);
+ spin_unlock(&configfs_dirent_lock);
+
+@@ -222,11 +250,11 @@ static int configfs_dirent_exists(struct configfs_dirent *parent_sd,
+
+ int configfs_make_dirent(struct configfs_dirent * parent_sd,
+ struct dentry * dentry, void * element,
+- umode_t mode, int type)
++ umode_t mode, int type, struct configfs_fragment *frag)
+ {
+ struct configfs_dirent * sd;
+
+- sd = configfs_new_dirent(parent_sd, element, type);
++ sd = configfs_new_dirent(parent_sd, element, type, frag);
+ if (IS_ERR(sd))
+ return PTR_ERR(sd);
+
+@@ -273,7 +301,8 @@ static void init_symlink(struct inode * inode)
+ * until it is validated by configfs_dir_set_ready()
+ */
+
+-static int configfs_create_dir(struct config_item *item, struct dentry *dentry)
++static int configfs_create_dir(struct config_item *item, struct dentry *dentry,
++ struct configfs_fragment *frag)
+ {
+ int error;
+ umode_t mode = S_IFDIR| S_IRWXU | S_IRUGO | S_IXUGO;
+@@ -286,7 +315,8 @@ static int configfs_create_dir(struct config_item *item, struct dentry *dentry)
+ return error;
+
+ error = configfs_make_dirent(p->d_fsdata, dentry, item, mode,
+- CONFIGFS_DIR | CONFIGFS_USET_CREATING);
++ CONFIGFS_DIR | CONFIGFS_USET_CREATING,
++ frag);
+ if (unlikely(error))
+ return error;
+
+@@ -351,9 +381,10 @@ int configfs_create_link(struct configfs_symlink *sl,
+ {
+ int err = 0;
+ umode_t mode = S_IFLNK | S_IRWXUGO;
++ struct configfs_dirent *p = parent->d_fsdata;
+
+- err = configfs_make_dirent(parent->d_fsdata, dentry, sl, mode,
+- CONFIGFS_ITEM_LINK);
++ err = configfs_make_dirent(p, dentry, sl, mode,
++ CONFIGFS_ITEM_LINK, p->s_frag);
+ if (!err) {
+ err = configfs_create(dentry, mode, init_symlink);
+ if (err) {
+@@ -612,7 +643,8 @@ static int populate_attrs(struct config_item *item)
+
+ static int configfs_attach_group(struct config_item *parent_item,
+ struct config_item *item,
+- struct dentry *dentry);
++ struct dentry *dentry,
++ struct configfs_fragment *frag);
+ static void configfs_detach_group(struct config_item *item);
+
+ static void detach_groups(struct config_group *group)
+@@ -660,7 +692,8 @@ static void detach_groups(struct config_group *group)
+ * try using vfs_mkdir. Just a thought.
+ */
+ static int create_default_group(struct config_group *parent_group,
+- struct config_group *group)
++ struct config_group *group,
++ struct configfs_fragment *frag)
+ {
+ int ret;
+ struct configfs_dirent *sd;
+@@ -676,7 +709,7 @@ static int create_default_group(struct config_group *parent_group,
+ d_add(child, NULL);
+
+ ret = configfs_attach_group(&parent_group->cg_item,
+- &group->cg_item, child);
++ &group->cg_item, child, frag);
+ if (!ret) {
+ sd = child->d_fsdata;
+ sd->s_type |= CONFIGFS_USET_DEFAULT;
+@@ -690,13 +723,14 @@ static int create_default_group(struct config_group *parent_group,
+ return ret;
+ }
+
+-static int populate_groups(struct config_group *group)
++static int populate_groups(struct config_group *group,
++ struct configfs_fragment *frag)
+ {
+ struct config_group *new_group;
+ int ret = 0;
+
+ list_for_each_entry(new_group, &group->default_groups, group_entry) {
+- ret = create_default_group(group, new_group);
++ ret = create_default_group(group, new_group, frag);
+ if (ret) {
+ detach_groups(group);
+ break;
+@@ -810,11 +844,12 @@ static void link_group(struct config_group *parent_group, struct config_group *g
+ */
+ static int configfs_attach_item(struct config_item *parent_item,
+ struct config_item *item,
+- struct dentry *dentry)
++ struct dentry *dentry,
++ struct configfs_fragment *frag)
+ {
+ int ret;
+
+- ret = configfs_create_dir(item, dentry);
++ ret = configfs_create_dir(item, dentry, frag);
+ if (!ret) {
+ ret = populate_attrs(item);
+ if (ret) {
+@@ -844,12 +879,13 @@ static void configfs_detach_item(struct config_item *item)
+
+ static int configfs_attach_group(struct config_item *parent_item,
+ struct config_item *item,
+- struct dentry *dentry)
++ struct dentry *dentry,
++ struct configfs_fragment *frag)
+ {
+ int ret;
+ struct configfs_dirent *sd;
+
+- ret = configfs_attach_item(parent_item, item, dentry);
++ ret = configfs_attach_item(parent_item, item, dentry, frag);
+ if (!ret) {
+ sd = dentry->d_fsdata;
+ sd->s_type |= CONFIGFS_USET_DIR;
+@@ -865,7 +901,7 @@ static int configfs_attach_group(struct config_item *parent_item,
+ */
+ inode_lock_nested(d_inode(dentry), I_MUTEX_CHILD);
+ configfs_adjust_dir_dirent_depth_before_populate(sd);
+- ret = populate_groups(to_config_group(item));
++ ret = populate_groups(to_config_group(item), frag);
+ if (ret) {
+ configfs_detach_item(item);
+ d_inode(dentry)->i_flags |= S_DEAD;
+@@ -1260,6 +1296,7 @@ static int configfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
+ struct configfs_dirent *sd;
+ const struct config_item_type *type;
+ struct module *subsys_owner = NULL, *new_item_owner = NULL;
++ struct configfs_fragment *frag;
+ char *name;
+
+ sd = dentry->d_parent->d_fsdata;
+@@ -1278,6 +1315,12 @@ static int configfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
+ goto out;
+ }
+
++ frag = new_fragment();
++ if (!frag) {
++ ret = -ENOMEM;
++ goto out;
++ }
++
+ /* Get a working ref for the duration of this function */
+ parent_item = configfs_get_config_item(dentry->d_parent);
+ type = parent_item->ci_type;
+@@ -1380,9 +1423,9 @@ static int configfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
+ spin_unlock(&configfs_dirent_lock);
+
+ if (group)
+- ret = configfs_attach_group(parent_item, item, dentry);
++ ret = configfs_attach_group(parent_item, item, dentry, frag);
+ else
+- ret = configfs_attach_item(parent_item, item, dentry);
++ ret = configfs_attach_item(parent_item, item, dentry, frag);
+
+ spin_lock(&configfs_dirent_lock);
+ sd->s_type &= ~CONFIGFS_USET_IN_MKDIR;
+@@ -1419,6 +1462,7 @@ out_put:
+ * reference.
+ */
+ config_item_put(parent_item);
++ put_fragment(frag);
+
+ out:
+ return ret;
+@@ -1430,6 +1474,7 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry)
+ struct config_item *item;
+ struct configfs_subsystem *subsys;
+ struct configfs_dirent *sd;
++ struct configfs_fragment *frag;
+ struct module *subsys_owner = NULL, *dead_item_owner = NULL;
+ int ret;
+
+@@ -1487,6 +1532,16 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry)
+ }
+ } while (ret == -EAGAIN);
+
++ frag = sd->s_frag;
++ if (down_write_killable(&frag->frag_sem)) {
++ spin_lock(&configfs_dirent_lock);
++ configfs_detach_rollback(dentry);
++ spin_unlock(&configfs_dirent_lock);
++ return -EINTR;
++ }
++ frag->frag_dead = true;
++ up_write(&frag->frag_sem);
++
+ /* Get a working ref for the duration of this function */
+ item = configfs_get_config_item(dentry);
+
+@@ -1587,7 +1642,7 @@ static int configfs_dir_open(struct inode *inode, struct file *file)
+ */
+ err = -ENOENT;
+ if (configfs_dirent_is_ready(parent_sd)) {
+- file->private_data = configfs_new_dirent(parent_sd, NULL, 0);
++ file->private_data = configfs_new_dirent(parent_sd, NULL, 0, NULL);
+ if (IS_ERR(file->private_data))
+ err = PTR_ERR(file->private_data);
+ else
+@@ -1743,8 +1798,13 @@ int configfs_register_group(struct config_group *parent_group,
+ {
+ struct configfs_subsystem *subsys = parent_group->cg_subsys;
+ struct dentry *parent;
++ struct configfs_fragment *frag;
+ int ret;
+
++ frag = new_fragment();
++ if (!frag)
++ return -ENOMEM;
++
+ mutex_lock(&subsys->su_mutex);
+ link_group(parent_group, group);
+ mutex_unlock(&subsys->su_mutex);
+@@ -1752,7 +1812,7 @@ int configfs_register_group(struct config_group *parent_group,
+ parent = parent_group->cg_item.ci_dentry;
+
+ inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+- ret = create_default_group(parent_group, group);
++ ret = create_default_group(parent_group, group, frag);
+ if (ret)
+ goto err_out;
+
+@@ -1760,12 +1820,14 @@ int configfs_register_group(struct config_group *parent_group,
+ configfs_dir_set_ready(group->cg_item.ci_dentry->d_fsdata);
+ spin_unlock(&configfs_dirent_lock);
+ inode_unlock(d_inode(parent));
++ put_fragment(frag);
+ return 0;
+ err_out:
+ inode_unlock(d_inode(parent));
+ mutex_lock(&subsys->su_mutex);
+ unlink_group(group);
+ mutex_unlock(&subsys->su_mutex);
++ put_fragment(frag);
+ return ret;
+ }
+ EXPORT_SYMBOL(configfs_register_group);
+@@ -1781,16 +1843,12 @@ void configfs_unregister_group(struct config_group *group)
+ struct configfs_subsystem *subsys = group->cg_subsys;
+ struct dentry *dentry = group->cg_item.ci_dentry;
+ struct dentry *parent = group->cg_item.ci_parent->ci_dentry;
++ struct configfs_dirent *sd = dentry->d_fsdata;
++ struct configfs_fragment *frag = sd->s_frag;
+
+- mutex_lock(&subsys->su_mutex);
+- if (!group->cg_item.ci_parent->ci_group) {
+- /*
+- * The parent has already been unlinked and detached
+- * due to a rmdir.
+- */
+- goto unlink_group;
+- }
+- mutex_unlock(&subsys->su_mutex);
++ down_write(&frag->frag_sem);
++ frag->frag_dead = true;
++ up_write(&frag->frag_sem);
+
+ inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+ spin_lock(&configfs_dirent_lock);
+@@ -1806,7 +1864,6 @@ void configfs_unregister_group(struct config_group *group)
+ dput(dentry);
+
+ mutex_lock(&subsys->su_mutex);
+-unlink_group:
+ unlink_group(group);
+ mutex_unlock(&subsys->su_mutex);
+ }
+@@ -1863,10 +1920,17 @@ int configfs_register_subsystem(struct configfs_subsystem *subsys)
+ struct dentry *dentry;
+ struct dentry *root;
+ struct configfs_dirent *sd;
++ struct configfs_fragment *frag;
++
++ frag = new_fragment();
++ if (!frag)
++ return -ENOMEM;
+
+ root = configfs_pin_fs();
+- if (IS_ERR(root))
++ if (IS_ERR(root)) {
++ put_fragment(frag);
+ return PTR_ERR(root);
++ }
+
+ if (!group->cg_item.ci_name)
+ group->cg_item.ci_name = group->cg_item.ci_namebuf;
+@@ -1882,7 +1946,7 @@ int configfs_register_subsystem(struct configfs_subsystem *subsys)
+ d_add(dentry, NULL);
+
+ err = configfs_attach_group(sd->s_element, &group->cg_item,
+- dentry);
++ dentry, frag);
+ if (err) {
+ BUG_ON(d_inode(dentry));
+ d_drop(dentry);
+@@ -1900,6 +1964,7 @@ int configfs_register_subsystem(struct configfs_subsystem *subsys)
+ unlink_group(group);
+ configfs_release_fs();
+ }
++ put_fragment(frag);
+
+ return err;
+ }
+@@ -1909,12 +1974,18 @@ void configfs_unregister_subsystem(struct configfs_subsystem *subsys)
+ struct config_group *group = &subsys->su_group;
+ struct dentry *dentry = group->cg_item.ci_dentry;
+ struct dentry *root = dentry->d_sb->s_root;
++ struct configfs_dirent *sd = dentry->d_fsdata;
++ struct configfs_fragment *frag = sd->s_frag;
+
+ if (dentry->d_parent != root) {
+ pr_err("Tried to unregister non-subsystem!\n");
+ return;
+ }
+
++ down_write(&frag->frag_sem);
++ frag->frag_dead = true;
++ up_write(&frag->frag_sem);
++
+ inode_lock_nested(d_inode(root),
+ I_MUTEX_PARENT);
+ inode_lock_nested(d_inode(dentry), I_MUTEX_CHILD);
+diff --git a/fs/configfs/file.c b/fs/configfs/file.c
+index 62580dba3552..bb0a427517e9 100644
+--- a/fs/configfs/file.c
++++ b/fs/configfs/file.c
+@@ -53,40 +53,44 @@ struct configfs_buffer {
+ bool write_in_progress;
+ char *bin_buffer;
+ int bin_buffer_size;
++ int cb_max_size;
++ struct config_item *item;
++ struct module *owner;
++ union {
++ struct configfs_attribute *attr;
++ struct configfs_bin_attribute *bin_attr;
++ };
+ };
+
++static inline struct configfs_fragment *to_frag(struct file *file)
++{
++ struct configfs_dirent *sd = file->f_path.dentry->d_fsdata;
+
+-/**
+- * fill_read_buffer - allocate and fill buffer from item.
+- * @dentry: dentry pointer.
+- * @buffer: data buffer for file.
+- *
+- * Allocate @buffer->page, if it hasn't been already, then call the
+- * config_item's show() method to fill the buffer with this attribute's
+- * data.
+- * This is called only once, on the file's first read.
+- */
+-static int fill_read_buffer(struct dentry * dentry, struct configfs_buffer * buffer)
++ return sd->s_frag;
++}
++
++static int fill_read_buffer(struct file *file, struct configfs_buffer *buffer)
+ {
+- struct configfs_attribute * attr = to_attr(dentry);
+- struct config_item * item = to_item(dentry->d_parent);
+- int ret = 0;
+- ssize_t count;
++ struct configfs_fragment *frag = to_frag(file);
++ ssize_t count = -ENOENT;
+
+ if (!buffer->page)
+ buffer->page = (char *) get_zeroed_page(GFP_KERNEL);
+ if (!buffer->page)
+ return -ENOMEM;
+
+- count = attr->show(item, buffer->page);
+-
+- BUG_ON(count > (ssize_t)SIMPLE_ATTR_SIZE);
+- if (count >= 0) {
+- buffer->needs_read_fill = 0;
+- buffer->count = count;
+- } else
+- ret = count;
+- return ret;
++ down_read(&frag->frag_sem);
++ if (!frag->frag_dead)
++ count = buffer->attr->show(buffer->item, buffer->page);
++ up_read(&frag->frag_sem);
++
++ if (count < 0)
++ return count;
++ if (WARN_ON_ONCE(count > (ssize_t)SIMPLE_ATTR_SIZE))
++ return -EIO;
++ buffer->needs_read_fill = 0;
++ buffer->count = count;
++ return 0;
+ }
+
+ /**
+@@ -111,12 +115,13 @@ static int fill_read_buffer(struct dentry * dentry, struct configfs_buffer * buf
+ static ssize_t
+ configfs_read_file(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+ {
+- struct configfs_buffer * buffer = file->private_data;
++ struct configfs_buffer *buffer = file->private_data;
+ ssize_t retval = 0;
+
+ mutex_lock(&buffer->mutex);
+ if (buffer->needs_read_fill) {
+- if ((retval = fill_read_buffer(file->f_path.dentry,buffer)))
++ retval = fill_read_buffer(file, buffer);
++ if (retval)
+ goto out;
+ }
+ pr_debug("%s: count = %zd, ppos = %lld, buf = %s\n",
+@@ -152,10 +157,8 @@ static ssize_t
+ configfs_read_bin_file(struct file *file, char __user *buf,
+ size_t count, loff_t *ppos)
+ {
++ struct configfs_fragment *frag = to_frag(file);
+ struct configfs_buffer *buffer = file->private_data;
+- struct dentry *dentry = file->f_path.dentry;
+- struct config_item *item = to_item(dentry->d_parent);
+- struct configfs_bin_attribute *bin_attr = to_bin_attr(dentry);
+ ssize_t retval = 0;
+ ssize_t len = min_t(size_t, count, PAGE_SIZE);
+
+@@ -170,14 +173,19 @@ configfs_read_bin_file(struct file *file, char __user *buf,
+
+ if (buffer->needs_read_fill) {
+ /* perform first read with buf == NULL to get extent */
+- len = bin_attr->read(item, NULL, 0);
++ down_read(&frag->frag_sem);
++ if (!frag->frag_dead)
++ len = buffer->bin_attr->read(buffer->item, NULL, 0);
++ else
++ len = -ENOENT;
++ up_read(&frag->frag_sem);
+ if (len <= 0) {
+ retval = len;
+ goto out;
+ }
+
+ /* do not exceed the maximum value */
+- if (bin_attr->cb_max_size && len > bin_attr->cb_max_size) {
++ if (buffer->cb_max_size && len > buffer->cb_max_size) {
+ retval = -EFBIG;
+ goto out;
+ }
+@@ -190,7 +198,13 @@ configfs_read_bin_file(struct file *file, char __user *buf,
+ buffer->bin_buffer_size = len;
+
+ /* perform second read to fill buffer */
+- len = bin_attr->read(item, buffer->bin_buffer, len);
++ down_read(&frag->frag_sem);
++ if (!frag->frag_dead)
++ len = buffer->bin_attr->read(buffer->item,
++ buffer->bin_buffer, len);
++ else
++ len = -ENOENT;
++ up_read(&frag->frag_sem);
+ if (len < 0) {
+ retval = len;
+ vfree(buffer->bin_buffer);
+@@ -240,25 +254,17 @@ fill_write_buffer(struct configfs_buffer * buffer, const char __user * buf, size
+ return error ? -EFAULT : count;
+ }
+
+-
+-/**
+- * flush_write_buffer - push buffer to config_item.
+- * @dentry: dentry to the attribute
+- * @buffer: data buffer for file.
+- * @count: number of bytes
+- *
+- * Get the correct pointers for the config_item and the attribute we're
+- * dealing with, then call the store() method for the attribute,
+- * passing the buffer that we acquired in fill_write_buffer().
+- */
+-
+ static int
+-flush_write_buffer(struct dentry * dentry, struct configfs_buffer * buffer, size_t count)
++flush_write_buffer(struct file *file, struct configfs_buffer *buffer, size_t count)
+ {
+- struct configfs_attribute * attr = to_attr(dentry);
+- struct config_item * item = to_item(dentry->d_parent);
+-
+- return attr->store(item, buffer->page, count);
++ struct configfs_fragment *frag = to_frag(file);
++ int res = -ENOENT;
++
++ down_read(&frag->frag_sem);
++ if (!frag->frag_dead)
++ res = buffer->attr->store(buffer->item, buffer->page, count);
++ up_read(&frag->frag_sem);
++ return res;
+ }
+
+
+@@ -282,13 +288,13 @@ flush_write_buffer(struct dentry * dentry, struct configfs_buffer * buffer, size
+ static ssize_t
+ configfs_write_file(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
+ {
+- struct configfs_buffer * buffer = file->private_data;
++ struct configfs_buffer *buffer = file->private_data;
+ ssize_t len;
+
+ mutex_lock(&buffer->mutex);
+ len = fill_write_buffer(buffer, buf, count);
+ if (len > 0)
+- len = flush_write_buffer(file->f_path.dentry, buffer, len);
++ len = flush_write_buffer(file, buffer, len);
+ if (len > 0)
+ *ppos += len;
+ mutex_unlock(&buffer->mutex);
+@@ -313,8 +319,6 @@ configfs_write_bin_file(struct file *file, const char __user *buf,
+ size_t count, loff_t *ppos)
+ {
+ struct configfs_buffer *buffer = file->private_data;
+- struct dentry *dentry = file->f_path.dentry;
+- struct configfs_bin_attribute *bin_attr = to_bin_attr(dentry);
+ void *tbuf = NULL;
+ ssize_t len;
+
+@@ -330,8 +334,8 @@ configfs_write_bin_file(struct file *file, const char __user *buf,
+ /* buffer grows? */
+ if (*ppos + count > buffer->bin_buffer_size) {
+
+- if (bin_attr->cb_max_size &&
+- *ppos + count > bin_attr->cb_max_size) {
++ if (buffer->cb_max_size &&
++ *ppos + count > buffer->cb_max_size) {
+ len = -EFBIG;
+ goto out;
+ }
+@@ -363,31 +367,51 @@ out:
+ return len;
+ }
+
+-static int check_perm(struct inode * inode, struct file * file, int type)
++static int __configfs_open_file(struct inode *inode, struct file *file, int type)
+ {
+- struct config_item *item = configfs_get_config_item(file->f_path.dentry->d_parent);
+- struct configfs_attribute * attr = to_attr(file->f_path.dentry);
+- struct configfs_bin_attribute *bin_attr = NULL;
+- struct configfs_buffer * buffer;
+- struct configfs_item_operations * ops = NULL;
+- int error = 0;
++ struct dentry *dentry = file->f_path.dentry;
++ struct configfs_fragment *frag = to_frag(file);
++ struct configfs_attribute *attr;
++ struct configfs_buffer *buffer;
++ int error;
+
+- if (!item || !attr)
+- goto Einval;
++ error = -ENOMEM;
++ buffer = kzalloc(sizeof(struct configfs_buffer), GFP_KERNEL);
++ if (!buffer)
++ goto out;
+
+- if (type & CONFIGFS_ITEM_BIN_ATTR)
+- bin_attr = to_bin_attr(file->f_path.dentry);
++ error = -ENOENT;
++ down_read(&frag->frag_sem);
++ if (unlikely(frag->frag_dead))
++ goto out_free_buffer;
+
+- /* Grab the module reference for this attribute if we have one */
+- if (!try_module_get(attr->ca_owner)) {
+- error = -ENODEV;
+- goto Done;
++ error = -EINVAL;
++ buffer->item = to_item(dentry->d_parent);
++ if (!buffer->item)
++ goto out_free_buffer;
++
++ attr = to_attr(dentry);
++ if (!attr)
++ goto out_put_item;
++
++ if (type & CONFIGFS_ITEM_BIN_ATTR) {
++ buffer->bin_attr = to_bin_attr(dentry);
++ buffer->cb_max_size = buffer->bin_attr->cb_max_size;
++ } else {
++ buffer->attr = attr;
+ }
+
+- if (item->ci_type)
+- ops = item->ci_type->ct_item_ops;
+- else
+- goto Eaccess;
++ buffer->owner = attr->ca_owner;
++ /* Grab the module reference for this attribute if we have one */
++ error = -ENODEV;
++ if (!try_module_get(buffer->owner))
++ goto out_put_item;
++
++ error = -EACCES;
++ if (!buffer->item->ci_type)
++ goto out_put_module;
++
++ buffer->ops = buffer->item->ci_type->ct_item_ops;
+
+ /* File needs write support.
+ * The inode's perms must say it's ok,
+@@ -395,13 +419,11 @@ static int check_perm(struct inode * inode, struct file * file, int type)
+ */
+ if (file->f_mode & FMODE_WRITE) {
+ if (!(inode->i_mode & S_IWUGO))
+- goto Eaccess;
+-
++ goto out_put_module;
+ if ((type & CONFIGFS_ITEM_ATTR) && !attr->store)
+- goto Eaccess;
+-
+- if ((type & CONFIGFS_ITEM_BIN_ATTR) && !bin_attr->write)
+- goto Eaccess;
++ goto out_put_module;
++ if ((type & CONFIGFS_ITEM_BIN_ATTR) && !buffer->bin_attr->write)
++ goto out_put_module;
+ }
+
+ /* File needs read support.
+@@ -410,92 +432,72 @@ static int check_perm(struct inode * inode, struct file * file, int type)
+ */
+ if (file->f_mode & FMODE_READ) {
+ if (!(inode->i_mode & S_IRUGO))
+- goto Eaccess;
+-
++ goto out_put_module;
+ if ((type & CONFIGFS_ITEM_ATTR) && !attr->show)
+- goto Eaccess;
+-
+- if ((type & CONFIGFS_ITEM_BIN_ATTR) && !bin_attr->read)
+- goto Eaccess;
++ goto out_put_module;
++ if ((type & CONFIGFS_ITEM_BIN_ATTR) && !buffer->bin_attr->read)
++ goto out_put_module;
+ }
+
+- /* No error? Great, allocate a buffer for the file, and store it
+- * it in file->private_data for easy access.
+- */
+- buffer = kzalloc(sizeof(struct configfs_buffer),GFP_KERNEL);
+- if (!buffer) {
+- error = -ENOMEM;
+- goto Enomem;
+- }
+ mutex_init(&buffer->mutex);
+ buffer->needs_read_fill = 1;
+ buffer->read_in_progress = false;
+ buffer->write_in_progress = false;
+- buffer->ops = ops;
+ file->private_data = buffer;
+- goto Done;
++ up_read(&frag->frag_sem);
++ return 0;
+
+- Einval:
+- error = -EINVAL;
+- goto Done;
+- Eaccess:
+- error = -EACCES;
+- Enomem:
+- module_put(attr->ca_owner);
+- Done:
+- if (error && item)
+- config_item_put(item);
++out_put_module:
++ module_put(buffer->owner);
++out_put_item:
++ config_item_put(buffer->item);
++out_free_buffer:
++ up_read(&frag->frag_sem);
++ kfree(buffer);
++out:
+ return error;
+ }
+
+ static int configfs_release(struct inode *inode, struct file *filp)
+ {
+- struct config_item * item = to_item(filp->f_path.dentry->d_parent);
+- struct configfs_attribute * attr = to_attr(filp->f_path.dentry);
+- struct module * owner = attr->ca_owner;
+- struct configfs_buffer * buffer = filp->private_data;
+-
+- if (item)
+- config_item_put(item);
+- /* After this point, attr should not be accessed. */
+- module_put(owner);
+-
+- if (buffer) {
+- if (buffer->page)
+- free_page((unsigned long)buffer->page);
+- mutex_destroy(&buffer->mutex);
+- kfree(buffer);
+- }
++ struct configfs_buffer *buffer = filp->private_data;
++
++ module_put(buffer->owner);
++ if (buffer->page)
++ free_page((unsigned long)buffer->page);
++ mutex_destroy(&buffer->mutex);
++ kfree(buffer);
+ return 0;
+ }
+
+ static int configfs_open_file(struct inode *inode, struct file *filp)
+ {
+- return check_perm(inode, filp, CONFIGFS_ITEM_ATTR);
++ return __configfs_open_file(inode, filp, CONFIGFS_ITEM_ATTR);
+ }
+
+ static int configfs_open_bin_file(struct inode *inode, struct file *filp)
+ {
+- return check_perm(inode, filp, CONFIGFS_ITEM_BIN_ATTR);
++ return __configfs_open_file(inode, filp, CONFIGFS_ITEM_BIN_ATTR);
+ }
+
+-static int configfs_release_bin_file(struct inode *inode, struct file *filp)
++static int configfs_release_bin_file(struct inode *inode, struct file *file)
+ {
+- struct configfs_buffer *buffer = filp->private_data;
+- struct dentry *dentry = filp->f_path.dentry;
+- struct config_item *item = to_item(dentry->d_parent);
+- struct configfs_bin_attribute *bin_attr = to_bin_attr(dentry);
+- ssize_t len = 0;
+- int ret;
++ struct configfs_buffer *buffer = file->private_data;
+
+ buffer->read_in_progress = false;
+
+ if (buffer->write_in_progress) {
++ struct configfs_fragment *frag = to_frag(file);
+ buffer->write_in_progress = false;
+
+- len = bin_attr->write(item, buffer->bin_buffer,
+- buffer->bin_buffer_size);
+-
++ down_read(&frag->frag_sem);
++ if (!frag->frag_dead) {
++ /* result of ->release() is ignored */
++ buffer->bin_attr->write(buffer->item,
++ buffer->bin_buffer,
++ buffer->bin_buffer_size);
++ }
++ up_read(&frag->frag_sem);
+ /* vfree on NULL is safe */
+ vfree(buffer->bin_buffer);
+ buffer->bin_buffer = NULL;
+@@ -503,10 +505,8 @@ static int configfs_release_bin_file(struct inode *inode, struct file *filp)
+ buffer->needs_read_fill = 1;
+ }
+
+- ret = configfs_release(inode, filp);
+- if (len < 0)
+- return len;
+- return ret;
++ configfs_release(inode, file);
++ return 0;
+ }
+
+
+@@ -541,7 +541,7 @@ int configfs_create_file(struct config_item * item, const struct configfs_attrib
+
+ inode_lock_nested(d_inode(dir), I_MUTEX_NORMAL);
+ error = configfs_make_dirent(parent_sd, NULL, (void *) attr, mode,
+- CONFIGFS_ITEM_ATTR);
++ CONFIGFS_ITEM_ATTR, parent_sd->s_frag);
+ inode_unlock(d_inode(dir));
+
+ return error;
+@@ -563,7 +563,7 @@ int configfs_create_bin_file(struct config_item *item,
+
+ inode_lock_nested(dir->d_inode, I_MUTEX_NORMAL);
+ error = configfs_make_dirent(parent_sd, NULL, (void *) bin_attr, mode,
+- CONFIGFS_ITEM_BIN_ATTR);
++ CONFIGFS_ITEM_BIN_ATTR, parent_sd->s_frag);
+ inode_unlock(dir->d_inode);
+
+ return error;
+diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c
+index a5c54af861f7..1996643bb654 100644
+--- a/fs/configfs/symlink.c
++++ b/fs/configfs/symlink.c
+@@ -157,11 +157,42 @@ int configfs_symlink(struct inode *dir, struct dentry *dentry, const char *symna
+ !type->ct_item_ops->allow_link)
+ goto out_put;
+
++ /*
++ * This is really sick. What they wanted was a hybrid of
++ * link(2) and symlink(2) - they wanted the target resolved
++ * at syscall time (as link(2) would've done), be a directory
++ * (which link(2) would've refused to do) *AND* be a deep
++ * fucking magic, making the target busy from rmdir POV.
++ * symlink(2) is nothing of that sort, and the locking it
++ * gets matches the normal symlink(2) semantics. Without
++ * attempts to resolve the target (which might very well
++ * not even exist yet) done prior to locking the parent
++ * directory. This perversion, OTOH, needs to resolve
++ * the target, which would lead to obvious deadlocks if
++ * attempted with any directories locked.
++ *
++ * Unfortunately, that garbage is userland ABI and we should've
++ * said "no" back in 2005. Too late now, so we get to
++ * play very ugly games with locking.
++ *
++ * Try *ANYTHING* of that sort in new code, and you will
++ * really regret it. Just ask yourself - what could a BOFH
++ * do to me and do I want to find it out first-hand?
++ *
++ * AV, a thoroughly annoyed bastard.
++ */
++ inode_unlock(dir);
+ ret = get_target(symname, &path, &target_item, dentry->d_sb);
++ inode_lock(dir);
+ if (ret)
+ goto out_put;
+
+- ret = type->ct_item_ops->allow_link(parent_item, target_item);
++ if (dentry->d_inode || d_unhashed(dentry))
++ ret = -EEXIST;
++ else
++ ret = inode_permission(dir, MAY_WRITE | MAY_EXEC);
++ if (!ret)
++ ret = type->ct_item_ops->allow_link(parent_item, target_item);
+ if (!ret) {
+ mutex_lock(&configfs_symlink_mutex);
+ ret = create_link(parent_item, target_item, dentry);
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 7ee86d8f313d..a89e27367e34 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -582,10 +582,13 @@ void wbc_attach_and_unlock_inode(struct writeback_control *wbc,
+ spin_unlock(&inode->i_lock);
+
+ /*
+- * A dying wb indicates that the memcg-blkcg mapping has changed
+- * and a new wb is already serving the memcg. Switch immediately.
++ * A dying wb indicates that either the blkcg associated with the
++ * memcg changed or the associated memcg is dying. In the first
++ * case, a replacement wb should already be available and we should
++ * refresh the wb immediately. In the second case, trying to
++ * refresh will keep failing.
+ */
+- if (unlikely(wb_dying(wbc->wb)))
++ if (unlikely(wb_dying(wbc->wb) && !css_is_dying(wbc->wb->memcg_css)))
+ inode_switch_wbs(inode, wbc->wb_id);
+ }
+
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 825a8c52165a..c5c3394148f7 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -54,6 +54,16 @@ nfs4_is_valid_delegation(const struct nfs_delegation *delegation,
+ return false;
+ }
+
++struct nfs_delegation *nfs4_get_valid_delegation(const struct inode *inode)
++{
++ struct nfs_delegation *delegation;
++
++ delegation = rcu_dereference(NFS_I(inode)->delegation);
++ if (nfs4_is_valid_delegation(delegation, 0))
++ return delegation;
++ return NULL;
++}
++
+ static int
+ nfs4_do_check_delegation(struct inode *inode, fmode_t flags, bool mark)
+ {
+diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
+index c95477823fa6..dd0f3eed3890 100644
+--- a/fs/nfs/delegation.h
++++ b/fs/nfs/delegation.h
+@@ -66,6 +66,7 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
+ bool nfs4_copy_delegation_stateid(struct inode *inode, fmode_t flags, nfs4_stateid *dst, struct rpc_cred **cred);
+ bool nfs4_refresh_delegation_stateid(nfs4_stateid *dst, struct inode *inode);
+
++struct nfs_delegation *nfs4_get_valid_delegation(const struct inode *inode);
+ void nfs_mark_delegation_referenced(struct nfs_delegation *delegation);
+ int nfs4_have_delegation(struct inode *inode, fmode_t flags);
+ int nfs4_check_delegation(struct inode *inode, fmode_t flags);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 75faef7af22d..792f8821b5d6 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1393,8 +1393,6 @@ static int can_open_delegated(struct nfs_delegation *delegation, fmode_t fmode,
+ return 0;
+ if ((delegation->type & fmode) != fmode)
+ return 0;
+- if (test_bit(NFS_DELEGATION_RETURNING, &delegation->flags))
+- return 0;
+ switch (claim) {
+ case NFS4_OPEN_CLAIM_NULL:
+ case NFS4_OPEN_CLAIM_FH:
+@@ -1751,7 +1749,6 @@ static void nfs4_return_incompatible_delegation(struct inode *inode, fmode_t fmo
+ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
+ {
+ struct nfs4_state *state = opendata->state;
+- struct nfs_inode *nfsi = NFS_I(state->inode);
+ struct nfs_delegation *delegation;
+ int open_mode = opendata->o_arg.open_flags;
+ fmode_t fmode = opendata->o_arg.fmode;
+@@ -1768,7 +1765,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
+ }
+ spin_unlock(&state->owner->so_lock);
+ rcu_read_lock();
+- delegation = rcu_dereference(nfsi->delegation);
++ delegation = nfs4_get_valid_delegation(state->inode);
+ if (!can_open_delegated(delegation, fmode, claim)) {
+ rcu_read_unlock();
+ break;
+@@ -2293,7 +2290,7 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata)
+ data->o_arg.open_flags, claim))
+ goto out_no_action;
+ rcu_read_lock();
+- delegation = rcu_dereference(NFS_I(data->state->inode)->delegation);
++ delegation = nfs4_get_valid_delegation(data->state->inode);
+ if (can_open_delegated(delegation, data->o_arg.fmode, claim))
+ goto unlock_no_action;
+ rcu_read_unlock();
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 9fa35cb6f6e0..a847fe52c56e 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2106,54 +2106,90 @@ static int ocfs2_is_io_unaligned(struct inode *inode, size_t count, loff_t pos)
+ return 0;
+ }
+
+-static int ocfs2_prepare_inode_for_refcount(struct inode *inode,
+- struct file *file,
+- loff_t pos, size_t count,
+- int *meta_level)
++static int ocfs2_inode_lock_for_extent_tree(struct inode *inode,
++ struct buffer_head **di_bh,
++ int meta_level,
++ int overwrite_io,
++ int write_sem,
++ int wait)
+ {
+- int ret;
+- struct buffer_head *di_bh = NULL;
+- u32 cpos = pos >> OCFS2_SB(inode->i_sb)->s_clustersize_bits;
+- u32 clusters =
+- ocfs2_clusters_for_bytes(inode->i_sb, pos + count) - cpos;
++ int ret = 0;
+
+- ret = ocfs2_inode_lock(inode, &di_bh, 1);
+- if (ret) {
+- mlog_errno(ret);
++ if (wait)
++ ret = ocfs2_inode_lock(inode, NULL, meta_level);
++ else
++ ret = ocfs2_try_inode_lock(inode,
++ overwrite_io ? NULL : di_bh, meta_level);
++ if (ret < 0)
+ goto out;
++
++ if (wait) {
++ if (write_sem)
++ down_write(&OCFS2_I(inode)->ip_alloc_sem);
++ else
++ down_read(&OCFS2_I(inode)->ip_alloc_sem);
++ } else {
++ if (write_sem)
++ ret = down_write_trylock(&OCFS2_I(inode)->ip_alloc_sem);
++ else
++ ret = down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem);
++
++ if (!ret) {
++ ret = -EAGAIN;
++ goto out_unlock;
++ }
+ }
+
+- *meta_level = 1;
++ return ret;
+
+- ret = ocfs2_refcount_cow(inode, di_bh, cpos, clusters, UINT_MAX);
+- if (ret)
+- mlog_errno(ret);
++out_unlock:
++ brelse(*di_bh);
++ ocfs2_inode_unlock(inode, meta_level);
+ out:
+- brelse(di_bh);
+ return ret;
+ }
+
++static void ocfs2_inode_unlock_for_extent_tree(struct inode *inode,
++ struct buffer_head **di_bh,
++ int meta_level,
++ int write_sem)
++{
++ if (write_sem)
++ up_write(&OCFS2_I(inode)->ip_alloc_sem);
++ else
++ up_read(&OCFS2_I(inode)->ip_alloc_sem);
++
++ brelse(*di_bh);
++ *di_bh = NULL;
++
++ if (meta_level >= 0)
++ ocfs2_inode_unlock(inode, meta_level);
++}
++
+ static int ocfs2_prepare_inode_for_write(struct file *file,
+ loff_t pos, size_t count, int wait)
+ {
+ int ret = 0, meta_level = 0, overwrite_io = 0;
++ int write_sem = 0;
+ struct dentry *dentry = file->f_path.dentry;
+ struct inode *inode = d_inode(dentry);
+ struct buffer_head *di_bh = NULL;
+ loff_t end;
++ u32 cpos;
++ u32 clusters;
+
+ /*
+ * We start with a read level meta lock and only jump to an ex
+ * if we need to make modifications here.
+ */
+ for(;;) {
+- if (wait)
+- ret = ocfs2_inode_lock(inode, NULL, meta_level);
+- else
+- ret = ocfs2_try_inode_lock(inode,
+- overwrite_io ? NULL : &di_bh, meta_level);
++ ret = ocfs2_inode_lock_for_extent_tree(inode,
++ &di_bh,
++ meta_level,
++ overwrite_io,
++ write_sem,
++ wait);
+ if (ret < 0) {
+- meta_level = -1;
+ if (ret != -EAGAIN)
+ mlog_errno(ret);
+ goto out;
+@@ -2165,15 +2201,8 @@ static int ocfs2_prepare_inode_for_write(struct file *file,
+ */
+ if (!wait && !overwrite_io) {
+ overwrite_io = 1;
+- if (!down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem)) {
+- ret = -EAGAIN;
+- goto out_unlock;
+- }
+
+ ret = ocfs2_overwrite_io(inode, di_bh, pos, count);
+- brelse(di_bh);
+- di_bh = NULL;
+- up_read(&OCFS2_I(inode)->ip_alloc_sem);
+ if (ret < 0) {
+ if (ret != -EAGAIN)
+ mlog_errno(ret);
+@@ -2192,7 +2221,10 @@ static int ocfs2_prepare_inode_for_write(struct file *file,
+ * set inode->i_size at the end of a write. */
+ if (should_remove_suid(dentry)) {
+ if (meta_level == 0) {
+- ocfs2_inode_unlock(inode, meta_level);
++ ocfs2_inode_unlock_for_extent_tree(inode,
++ &di_bh,
++ meta_level,
++ write_sem);
+ meta_level = 1;
+ continue;
+ }
+@@ -2208,18 +2240,32 @@ static int ocfs2_prepare_inode_for_write(struct file *file,
+
+ ret = ocfs2_check_range_for_refcount(inode, pos, count);
+ if (ret == 1) {
+- ocfs2_inode_unlock(inode, meta_level);
+- meta_level = -1;
+-
+- ret = ocfs2_prepare_inode_for_refcount(inode,
+- file,
+- pos,
+- count,
+- &meta_level);
++ ocfs2_inode_unlock_for_extent_tree(inode,
++ &di_bh,
++ meta_level,
++ write_sem);
++ ret = ocfs2_inode_lock_for_extent_tree(inode,
++ &di_bh,
++ meta_level,
++ overwrite_io,
++ 1,
++ wait);
++ write_sem = 1;
++ if (ret < 0) {
++ if (ret != -EAGAIN)
++ mlog_errno(ret);
++ goto out;
++ }
++
++ cpos = pos >> OCFS2_SB(inode->i_sb)->s_clustersize_bits;
++ clusters =
++ ocfs2_clusters_for_bytes(inode->i_sb, pos + count) - cpos;
++ ret = ocfs2_refcount_cow(inode, di_bh, cpos, clusters, UINT_MAX);
+ }
+
+ if (ret < 0) {
+- mlog_errno(ret);
++ if (ret != -EAGAIN)
++ mlog_errno(ret);
+ goto out_unlock;
+ }
+
+@@ -2230,10 +2276,10 @@ out_unlock:
+ trace_ocfs2_prepare_inode_for_write(OCFS2_I(inode)->ip_blkno,
+ pos, count, wait);
+
+- brelse(di_bh);
+-
+- if (meta_level >= 0)
+- ocfs2_inode_unlock(inode, meta_level);
++ ocfs2_inode_unlock_for_extent_tree(inode,
++ &di_bh,
++ meta_level,
++ write_sem);
+
+ out:
+ return ret;
+diff --git a/include/linux/cpu.h b/include/linux/cpu.h
+index 006f69f9277b..aab4273810e3 100644
+--- a/include/linux/cpu.h
++++ b/include/linux/cpu.h
+@@ -59,6 +59,11 @@ extern ssize_t cpu_show_l1tf(struct device *dev,
+ struct device_attribute *attr, char *buf);
+ extern ssize_t cpu_show_mds(struct device *dev,
+ struct device_attribute *attr, char *buf);
++extern ssize_t cpu_show_tsx_async_abort(struct device *dev,
++ struct device_attribute *attr,
++ char *buf);
++extern ssize_t cpu_show_itlb_multihit(struct device *dev,
++ struct device_attribute *attr, char *buf);
+
+ extern __printf(4, 5)
+ struct device *cpu_device_create(struct device *parent, void *drvdata,
+@@ -193,28 +198,7 @@ static inline int cpuhp_smt_enable(void) { return 0; }
+ static inline int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval) { return 0; }
+ #endif
+
+-/*
+- * These are used for a global "mitigations=" cmdline option for toggling
+- * optional CPU mitigations.
+- */
+-enum cpu_mitigations {
+- CPU_MITIGATIONS_OFF,
+- CPU_MITIGATIONS_AUTO,
+- CPU_MITIGATIONS_AUTO_NOSMT,
+-};
+-
+-extern enum cpu_mitigations cpu_mitigations;
+-
+-/* mitigations=off */
+-static inline bool cpu_mitigations_off(void)
+-{
+- return cpu_mitigations == CPU_MITIGATIONS_OFF;
+-}
+-
+-/* mitigations=auto,nosmt */
+-static inline bool cpu_mitigations_auto_nosmt(void)
+-{
+- return cpu_mitigations == CPU_MITIGATIONS_AUTO_NOSMT;
+-}
++extern bool cpu_mitigations_off(void);
++extern bool cpu_mitigations_auto_nosmt(void);
+
+ #endif /* _LINUX_CPU_H_ */
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index d42a36e4e6c2..96207939d862 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -141,7 +141,7 @@ static inline bool is_error_page(struct page *page)
+
+ extern struct kmem_cache *kvm_vcpu_cache;
+
+-extern spinlock_t kvm_lock;
++extern struct mutex kvm_lock;
+ extern struct list_head vm_list;
+
+ struct kvm_io_range {
+@@ -1034,6 +1034,7 @@ enum kvm_stat_kind {
+
+ struct kvm_stat_data {
+ int offset;
++ int mode;
+ struct kvm *kvm;
+ };
+
+@@ -1041,6 +1042,7 @@ struct kvm_stats_debugfs_item {
+ const char *name;
+ int offset;
+ enum kvm_stat_kind kind;
++ int mode;
+ };
+ extern struct kvm_stats_debugfs_item debugfs_entries[];
+ extern struct dentry *kvm_debugfs_dir;
+@@ -1303,4 +1305,10 @@ static inline int kvm_arch_vcpu_run_pid_change(struct kvm_vcpu *vcpu)
+ }
+ #endif /* CONFIG_HAVE_KVM_VCPU_RUN_PID_CHANGE */
+
++typedef int (*kvm_vm_thread_fn_t)(struct kvm *kvm, uintptr_t data);
++
++int kvm_vm_create_worker_thread(struct kvm *kvm, kvm_vm_thread_fn_t thread_fn,
++ uintptr_t data, const char *name,
++ struct task_struct **thread_ptr);
++
+ #endif
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index bdec425c8e14..45f10f5896b7 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -602,11 +602,6 @@ static inline void *kvcalloc(size_t n, size_t size, gfp_t flags)
+
+ extern void kvfree(const void *addr);
+
+-static inline atomic_t *compound_mapcount_ptr(struct page *page)
+-{
+- return &page[1].compound_mapcount;
+-}
+-
+ static inline int compound_mapcount(struct page *page)
+ {
+ VM_BUG_ON_PAGE(!PageCompound(page), page);
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 5ed8f6292a53..3a9a996af229 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -226,6 +226,11 @@ struct page_frag_cache {
+
+ typedef unsigned long vm_flags_t;
+
++static inline atomic_t *compound_mapcount_ptr(struct page *page)
++{
++ return &page[1].compound_mapcount;
++}
++
+ /*
+ * A region containing a mapping of a non-memory backed file under NOMMU
+ * conditions. These are held in a global tree and are pinned by the VMAs that
+diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
+index 74bee8cecf4c..3f066ce63a63 100644
+--- a/include/linux/page-flags.h
++++ b/include/linux/page-flags.h
+@@ -577,12 +577,28 @@ static inline int PageTransCompound(struct page *page)
+ *
+ * Unlike PageTransCompound, this is safe to be called only while
+ * split_huge_pmd() cannot run from under us, like if protected by the
+- * MMU notifier, otherwise it may result in page->_mapcount < 0 false
++ * MMU notifier, otherwise it may result in page->_mapcount check false
+ * positives.
++ *
++ * We have to treat page cache THP differently since every subpage of it
++ * would get _mapcount inc'ed once it is PMD mapped. But, it may be PTE
++ * mapped in the current process so comparing subpage's _mapcount to
++ * compound_mapcount to filter out PTE mapped case.
+ */
+ static inline int PageTransCompoundMap(struct page *page)
+ {
+- return PageTransCompound(page) && atomic_read(&page->_mapcount) < 0;
++ struct page *head;
++
++ if (!PageTransCompound(page))
++ return 0;
++
++ if (PageAnon(page))
++ return atomic_read(&page->_mapcount) < 0;
++
++ head = compound_head(page);
++ /* File THP is PMD mapped and not PTE mapped */
++ return atomic_read(&page->_mapcount) ==
++ atomic_read(compound_mapcount_ptr(head));
+ }
+
+ /*
+diff --git a/include/net/bonding.h b/include/net/bonding.h
+index b46d68acf701..8116648873c3 100644
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -149,7 +149,6 @@ struct slave {
+ unsigned long target_last_arp_rx[BOND_MAX_ARP_TARGETS];
+ s8 link; /* one of BOND_LINK_XXXX */
+ s8 link_new_state; /* one of BOND_LINK_XXXX */
+- s8 new_link;
+ u8 backup:1, /* indicates backup slave. Value corresponds with
+ BOND_STATE_ACTIVE and BOND_STATE_BACKUP */
+ inactive:1, /* indicates inactive slave */
+@@ -539,7 +538,7 @@ static inline void bond_propose_link_state(struct slave *slave, int state)
+
+ static inline void bond_commit_link_state(struct slave *slave, bool notify)
+ {
+- if (slave->link == slave->link_new_state)
++ if (slave->link_new_state == BOND_LINK_NOCHANGE)
+ return;
+
+ slave->link = slave->link_new_state;
+diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
+index 0e3c0d83bd99..af0ede9ad4d0 100644
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -885,6 +885,7 @@ struct netns_ipvs {
+ struct delayed_work defense_work; /* Work handler */
+ int drop_rate;
+ int drop_counter;
++ int old_secure_tcp;
+ atomic_t dropentry;
+ /* locks in ctl.c */
+ spinlock_t dropentry_lock; /* drop entry handling */
+diff --git a/include/net/neighbour.h b/include/net/neighbour.h
+index beeeed126872..c84807c1c5bd 100644
+--- a/include/net/neighbour.h
++++ b/include/net/neighbour.h
+@@ -430,8 +430,8 @@ static inline int neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+ {
+ unsigned long now = jiffies;
+
+- if (neigh->used != now)
+- neigh->used = now;
++ if (READ_ONCE(neigh->used) != now)
++ WRITE_ONCE(neigh->used, now);
+ if (!(neigh->nud_state&(NUD_CONNECTED|NUD_DELAY|NUD_PROBE)))
+ return __neigh_event_send(neigh, skb);
+ return 0;
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 7685cbda9f28..024636c31adc 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -793,7 +793,8 @@ struct nft_expr_ops {
+ */
+ struct nft_expr {
+ const struct nft_expr_ops *ops;
+- unsigned char data[];
++ unsigned char data[]
++ __attribute__((aligned(__alignof__(u64))));
+ };
+
+ static inline void *nft_expr_priv(const struct nft_expr *expr)
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 05e8faa84717..0252c0d00310 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -2318,7 +2318,7 @@ static inline ktime_t sock_read_timestamp(struct sock *sk)
+
+ return kt;
+ #else
+- return sk->sk_stamp;
++ return READ_ONCE(sk->sk_stamp);
+ #endif
+ }
+
+@@ -2329,7 +2329,7 @@ static inline void sock_write_timestamp(struct sock *sk, ktime_t kt)
+ sk->sk_stamp = kt;
+ write_sequnlock(&sk->sk_stamp_seq);
+ #else
+- sk->sk_stamp = kt;
++ WRITE_ONCE(sk->sk_stamp, kt);
+ #endif
+ }
+
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index b7d63c3970d1..f3d475024d37 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -310,7 +310,7 @@ struct ib_tm_caps {
+
+ struct ib_cq_init_attr {
+ unsigned int cqe;
+- int comp_vector;
++ u32 comp_vector;
+ u32 flags;
+ };
+
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index d9f855cb9f6f..9bb57ce57d98 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2282,7 +2282,18 @@ void __init boot_cpu_hotplug_init(void)
+ this_cpu_write(cpuhp_state.state, CPUHP_ONLINE);
+ }
+
+-enum cpu_mitigations cpu_mitigations __ro_after_init = CPU_MITIGATIONS_AUTO;
++/*
++ * These are used for a global "mitigations=" cmdline option for toggling
++ * optional CPU mitigations.
++ */
++enum cpu_mitigations {
++ CPU_MITIGATIONS_OFF,
++ CPU_MITIGATIONS_AUTO,
++ CPU_MITIGATIONS_AUTO_NOSMT,
++};
++
++static enum cpu_mitigations cpu_mitigations __ro_after_init =
++ CPU_MITIGATIONS_AUTO;
+
+ static int __init mitigations_parse_cmdline(char *arg)
+ {
+@@ -2299,3 +2310,17 @@ static int __init mitigations_parse_cmdline(char *arg)
+ return 0;
+ }
+ early_param("mitigations", mitigations_parse_cmdline);
++
++/* mitigations=off */
++bool cpu_mitigations_off(void)
++{
++ return cpu_mitigations == CPU_MITIGATIONS_OFF;
++}
++EXPORT_SYMBOL_GPL(cpu_mitigations_off);
++
++/* mitigations=auto,nosmt */
++bool cpu_mitigations_auto_nosmt(void)
++{
++ return cpu_mitigations == CPU_MITIGATIONS_AUTO_NOSMT;
++}
++EXPORT_SYMBOL_GPL(cpu_mitigations_auto_nosmt);
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 32d2dac680a7..e5e8f6721872 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4305,23 +4305,16 @@ static inline u64 sched_cfs_bandwidth_slice(void)
+ }
+
+ /*
+- * Replenish runtime according to assigned quota and update expiration time.
+- * We use sched_clock_cpu directly instead of rq->clock to avoid adding
+- * additional synchronization around rq->lock.
++ * Replenish runtime according to assigned quota. We use sched_clock_cpu
++ * directly instead of rq->clock to avoid adding additional synchronization
++ * around rq->lock.
+ *
+ * requires cfs_b->lock
+ */
+ void __refill_cfs_bandwidth_runtime(struct cfs_bandwidth *cfs_b)
+ {
+- u64 now;
+-
+- if (cfs_b->quota == RUNTIME_INF)
+- return;
+-
+- now = sched_clock_cpu(smp_processor_id());
+- cfs_b->runtime = cfs_b->quota;
+- cfs_b->runtime_expires = now + ktime_to_ns(cfs_b->period);
+- cfs_b->expires_seq++;
++ if (cfs_b->quota != RUNTIME_INF)
++ cfs_b->runtime = cfs_b->quota;
+ }
+
+ static inline struct cfs_bandwidth *tg_cfs_bandwidth(struct task_group *tg)
+@@ -4343,8 +4336,7 @@ static int assign_cfs_rq_runtime(struct cfs_rq *cfs_rq)
+ {
+ struct task_group *tg = cfs_rq->tg;
+ struct cfs_bandwidth *cfs_b = tg_cfs_bandwidth(tg);
+- u64 amount = 0, min_amount, expires;
+- int expires_seq;
++ u64 amount = 0, min_amount;
+
+ /* note: this is a positive sum as runtime_remaining <= 0 */
+ min_amount = sched_cfs_bandwidth_slice() - cfs_rq->runtime_remaining;
+@@ -4361,61 +4353,17 @@ static int assign_cfs_rq_runtime(struct cfs_rq *cfs_rq)
+ cfs_b->idle = 0;
+ }
+ }
+- expires_seq = cfs_b->expires_seq;
+- expires = cfs_b->runtime_expires;
+ raw_spin_unlock(&cfs_b->lock);
+
+ cfs_rq->runtime_remaining += amount;
+- /*
+- * we may have advanced our local expiration to account for allowed
+- * spread between our sched_clock and the one on which runtime was
+- * issued.
+- */
+- if (cfs_rq->expires_seq != expires_seq) {
+- cfs_rq->expires_seq = expires_seq;
+- cfs_rq->runtime_expires = expires;
+- }
+
+ return cfs_rq->runtime_remaining > 0;
+ }
+
+-/*
+- * Note: This depends on the synchronization provided by sched_clock and the
+- * fact that rq->clock snapshots this value.
+- */
+-static void expire_cfs_rq_runtime(struct cfs_rq *cfs_rq)
+-{
+- struct cfs_bandwidth *cfs_b = tg_cfs_bandwidth(cfs_rq->tg);
+-
+- /* if the deadline is ahead of our clock, nothing to do */
+- if (likely((s64)(rq_clock(rq_of(cfs_rq)) - cfs_rq->runtime_expires) < 0))
+- return;
+-
+- if (cfs_rq->runtime_remaining < 0)
+- return;
+-
+- /*
+- * If the local deadline has passed we have to consider the
+- * possibility that our sched_clock is 'fast' and the global deadline
+- * has not truly expired.
+- *
+- * Fortunately we can check determine whether this the case by checking
+- * whether the global deadline(cfs_b->expires_seq) has advanced.
+- */
+- if (cfs_rq->expires_seq == cfs_b->expires_seq) {
+- /* extend local deadline, drift is bounded above by 2 ticks */
+- cfs_rq->runtime_expires += TICK_NSEC;
+- } else {
+- /* global deadline is ahead, expiration has passed */
+- cfs_rq->runtime_remaining = 0;
+- }
+-}
+-
+ static void __account_cfs_rq_runtime(struct cfs_rq *cfs_rq, u64 delta_exec)
+ {
+ /* dock delta_exec before expiring quota (as it could span periods) */
+ cfs_rq->runtime_remaining -= delta_exec;
+- expire_cfs_rq_runtime(cfs_rq);
+
+ if (likely(cfs_rq->runtime_remaining > 0))
+ return;
+@@ -4600,8 +4548,7 @@ void unthrottle_cfs_rq(struct cfs_rq *cfs_rq)
+ resched_curr(rq);
+ }
+
+-static u64 distribute_cfs_runtime(struct cfs_bandwidth *cfs_b,
+- u64 remaining, u64 expires)
++static u64 distribute_cfs_runtime(struct cfs_bandwidth *cfs_b, u64 remaining)
+ {
+ struct cfs_rq *cfs_rq;
+ u64 runtime;
+@@ -4626,7 +4573,6 @@ static u64 distribute_cfs_runtime(struct cfs_bandwidth *cfs_b,
+ remaining -= runtime;
+
+ cfs_rq->runtime_remaining += runtime;
+- cfs_rq->runtime_expires = expires;
+
+ /* we check whether we're throttled above */
+ if (cfs_rq->runtime_remaining > 0)
+@@ -4651,7 +4597,7 @@ next:
+ */
+ static int do_sched_cfs_period_timer(struct cfs_bandwidth *cfs_b, int overrun)
+ {
+- u64 runtime, runtime_expires;
++ u64 runtime;
+ int throttled;
+
+ /* no need to continue the timer with no bandwidth constraint */
+@@ -4679,8 +4625,6 @@ static int do_sched_cfs_period_timer(struct cfs_bandwidth *cfs_b, int overrun)
+ /* account preceding periods in which throttling occurred */
+ cfs_b->nr_throttled += overrun;
+
+- runtime_expires = cfs_b->runtime_expires;
+-
+ /*
+ * This check is repeated as we are holding onto the new bandwidth while
+ * we unthrottle. This can potentially race with an unthrottled group
+@@ -4693,8 +4637,7 @@ static int do_sched_cfs_period_timer(struct cfs_bandwidth *cfs_b, int overrun)
+ cfs_b->distribute_running = 1;
+ raw_spin_unlock(&cfs_b->lock);
+ /* we can't nest cfs_b->lock while distributing bandwidth */
+- runtime = distribute_cfs_runtime(cfs_b, runtime,
+- runtime_expires);
++ runtime = distribute_cfs_runtime(cfs_b, runtime);
+ raw_spin_lock(&cfs_b->lock);
+
+ cfs_b->distribute_running = 0;
+@@ -4771,8 +4714,7 @@ static void __return_cfs_rq_runtime(struct cfs_rq *cfs_rq)
+ return;
+
+ raw_spin_lock(&cfs_b->lock);
+- if (cfs_b->quota != RUNTIME_INF &&
+- cfs_rq->runtime_expires == cfs_b->runtime_expires) {
++ if (cfs_b->quota != RUNTIME_INF) {
+ cfs_b->runtime += slack_runtime;
+
+ /* we are under rq->lock, defer unthrottling using a timer */
+@@ -4804,7 +4746,6 @@ static __always_inline void return_cfs_rq_runtime(struct cfs_rq *cfs_rq)
+ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b)
+ {
+ u64 runtime = 0, slice = sched_cfs_bandwidth_slice();
+- u64 expires;
+
+ /* confirm we're still not at a refresh boundary */
+ raw_spin_lock(&cfs_b->lock);
+@@ -4821,7 +4762,6 @@ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b)
+ if (cfs_b->quota != RUNTIME_INF && cfs_b->runtime > slice)
+ runtime = cfs_b->runtime;
+
+- expires = cfs_b->runtime_expires;
+ if (runtime)
+ cfs_b->distribute_running = 1;
+
+@@ -4830,11 +4770,10 @@ static void do_sched_cfs_slack_timer(struct cfs_bandwidth *cfs_b)
+ if (!runtime)
+ return;
+
+- runtime = distribute_cfs_runtime(cfs_b, runtime, expires);
++ runtime = distribute_cfs_runtime(cfs_b, runtime);
+
+ raw_spin_lock(&cfs_b->lock);
+- if (expires == cfs_b->runtime_expires)
+- cfs_b->runtime -= min(runtime, cfs_b->runtime);
++ cfs_b->runtime -= min(runtime, cfs_b->runtime);
+ cfs_b->distribute_running = 0;
+ raw_spin_unlock(&cfs_b->lock);
+ }
+@@ -4980,17 +4919,13 @@ static void init_cfs_rq_runtime(struct cfs_rq *cfs_rq)
+
+ void start_cfs_bandwidth(struct cfs_bandwidth *cfs_b)
+ {
+- u64 overrun;
+-
+ lockdep_assert_held(&cfs_b->lock);
+
+ if (cfs_b->period_active)
+ return;
+
+ cfs_b->period_active = 1;
+- overrun = hrtimer_forward_now(&cfs_b->period_timer, cfs_b->period);
+- cfs_b->runtime_expires += (overrun + 1) * ktime_to_ns(cfs_b->period);
+- cfs_b->expires_seq++;
++ hrtimer_forward_now(&cfs_b->period_timer, cfs_b->period);
+ hrtimer_start_expires(&cfs_b->period_timer, HRTIMER_MODE_ABS_PINNED);
+ }
+
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 9a7c3d08b39f..62058fd6dcf6 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -334,8 +334,6 @@ struct cfs_bandwidth {
+ u64 quota;
+ u64 runtime;
+ s64 hierarchical_quota;
+- u64 runtime_expires;
+- int expires_seq;
+
+ short idle;
+ short period_active;
+@@ -555,8 +553,6 @@ struct cfs_rq {
+
+ #ifdef CONFIG_CFS_BANDWIDTH
+ int runtime_enabled;
+- int expires_seq;
+- u64 runtime_expires;
+ s64 runtime_remaining;
+
+ u64 throttled_clock;
+diff --git a/lib/dump_stack.c b/lib/dump_stack.c
+index 5cff72f18c4a..33ffbf308853 100644
+--- a/lib/dump_stack.c
++++ b/lib/dump_stack.c
+@@ -106,7 +106,12 @@ retry:
+ was_locked = 1;
+ } else {
+ local_irq_restore(flags);
+- cpu_relax();
++ /*
++ * Wait for the lock to release before jumping to
++ * atomic_cmpxchg() in order to mitigate the thundering herd
++ * problem.
++ */
++ do { cpu_relax(); } while (atomic_read(&dump_lock) != -1);
+ goto retry;
+ }
+
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 287f3fa02e5e..45f1c6d73b5b 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -438,7 +438,8 @@ int __filemap_fdatawrite_range(struct address_space *mapping, loff_t start,
+ .range_end = end,
+ };
+
+- if (!mapping_cap_writeback_dirty(mapping))
++ if (!mapping_cap_writeback_dirty(mapping) ||
++ !mapping_tagged(mapping, PAGECACHE_TAG_DIRTY))
+ return 0;
+
+ wbc_attach_fdatawrite_inode(&wbc, mapping->host);
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 65da189a433b..e0f7b94a4e9b 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -2224,6 +2224,15 @@ retry:
+ goto retry;
+ }
+
++ /*
++ * Memcg doesn't have a dedicated reserve for atomic
++ * allocations. But like the global atomic pool, we need to
++ * put the burden of reclaim on regular allocation requests
++ * and let these go through as privileged allocations.
++ */
++ if (gfp_mask & __GFP_ATOMIC)
++ goto force;
++
+ /*
+ * Unlike in global OOM situations, memcg is not in a physical
+ * memory shortage. Allow dying and OOM-killed tasks to
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 2d04bd2e1ced..b34348a41bfe 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1742,6 +1742,14 @@ void __init page_alloc_init_late(void)
+ /* Block until all are initialised */
+ wait_for_completion(&pgdat_init_all_done_comp);
+
++ /*
++ * The number of managed pages has changed due to the initialisation
++ * so the pcpu batch and high limits needs to be updated or the limits
++ * will be artificially small.
++ */
++ for_each_populated_zone(zone)
++ zone_pcp_update(zone);
++
+ /*
+ * We initialized the rest of the deferred pages. Permanently disable
+ * on-demand struct page initialization.
+@@ -8011,7 +8019,6 @@ void free_contig_range(unsigned long pfn, unsigned nr_pages)
+ }
+ #endif
+
+-#ifdef CONFIG_MEMORY_HOTPLUG
+ /*
+ * The zone indicated has a new number of managed_pages; batch sizes and percpu
+ * page high values need to be recalulated.
+@@ -8025,7 +8032,6 @@ void __meminit zone_pcp_update(struct zone *zone)
+ per_cpu_ptr(zone->pageset, cpu));
+ mutex_unlock(&pcp_batch_high_lock);
+ }
+-#endif
+
+ void zone_pcp_reset(struct zone *zone)
+ {
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index 4a387937f9f5..a2b2ea786c9b 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -1972,7 +1972,7 @@ void __init init_mm_internals(void)
+ #endif
+ #ifdef CONFIG_PROC_FS
+ proc_create_seq("buddyinfo", 0444, NULL, &fragmentation_op);
+- proc_create_seq("pagetypeinfo", 0444, NULL, &pagetypeinfo_op);
++ proc_create_seq("pagetypeinfo", 0400, NULL, &pagetypeinfo_op);
+ proc_create_seq("vmstat", 0444, NULL, &vmstat_op);
+ proc_create_seq("zoneinfo", 0444, NULL, &zoneinfo_op);
+ #endif
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index 446204ca7406..a8fc4e83cd95 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -1421,8 +1421,8 @@ int fib_sync_down_addr(struct net_device *dev, __be32 local)
+ int ret = 0;
+ unsigned int hash = fib_laddr_hashfn(local);
+ struct hlist_head *head = &fib_info_laddrhash[hash];
++ int tb_id = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN;
+ struct net *net = dev_net(dev);
+- int tb_id = l3mdev_fib_table(dev);
+ struct fib_info *fi;
+
+ if (!fib_info_laddrhash || local == 0)
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index c88586380134..076c21f6a645 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -521,6 +521,7 @@ static void rt6_probe(struct fib6_info *rt)
+ {
+ struct __rt6_probe_work *work = NULL;
+ const struct in6_addr *nh_gw;
++ unsigned long last_probe;
+ struct neighbour *neigh;
+ struct net_device *dev;
+ struct inet6_dev *idev;
+@@ -539,6 +540,7 @@ static void rt6_probe(struct fib6_info *rt)
+ nh_gw = &rt->fib6_nh.nh_gw;
+ dev = rt->fib6_nh.nh_dev;
+ rcu_read_lock_bh();
++ last_probe = READ_ONCE(rt->last_probe);
+ idev = __in6_dev_get(dev);
+ neigh = __ipv6_neigh_lookup_noref(dev, nh_gw);
+ if (neigh) {
+@@ -554,13 +556,15 @@ static void rt6_probe(struct fib6_info *rt)
+ __neigh_set_probe_once(neigh);
+ }
+ write_unlock(&neigh->lock);
+- } else if (time_after(jiffies, rt->last_probe +
++ } else if (time_after(jiffies, last_probe +
+ idev->cnf.rtr_probe_interval)) {
+ work = kmalloc(sizeof(*work), GFP_ATOMIC);
+ }
+
+- if (work) {
+- rt->last_probe = jiffies;
++ if (!work || cmpxchg(&rt->last_probe,
++ last_probe, jiffies) != last_probe) {
++ kfree(work);
++ } else {
+ INIT_WORK(&work->work, rt6_probe_deferred);
+ work->target = *nh_gw;
+ dev_hold(dev);
+@@ -3066,6 +3070,9 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,
+ if (!rt)
+ goto out;
+
++#ifdef CONFIG_IPV6_ROUTER_PREF
++ rt->last_probe = jiffies;
++#endif
+ if (cfg->fc_flags & RTF_ADDRCONF)
+ rt->dst_nocount = true;
+
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index e2538c578671..1566261b6b5a 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -1977,8 +1977,9 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
+ }
+
+ req_version->version = IPSET_PROTOCOL;
+- ret = copy_to_user(user, req_version,
+- sizeof(struct ip_set_req_version));
++ if (copy_to_user(user, req_version,
++ sizeof(struct ip_set_req_version)))
++ ret = -EFAULT;
+ goto done;
+ }
+ case IP_SET_OP_GET_BYNAME: {
+@@ -2035,7 +2036,8 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
+ } /* end of switch(op) */
+
+ copy:
+- ret = copy_to_user(user, data, copylen);
++ if (copy_to_user(user, data, copylen))
++ ret = -EFAULT;
+
+ done:
+ vfree(data);
+diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
+index 25560ea742d6..f2c2f72e2fff 100644
+--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
++++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
+@@ -212,7 +212,7 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb,
+ (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ return -EINVAL;
+
+- if (opt->flags & IPSET_DIM_ONE_SRC)
++ if (opt->flags & IPSET_DIM_TWO_SRC)
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
+ else
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
+diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
+index 7588aeaa605f..80759aadd3e0 100644
+--- a/net/netfilter/ipvs/ip_vs_app.c
++++ b/net/netfilter/ipvs/ip_vs_app.c
+@@ -198,21 +198,29 @@ struct ip_vs_app *register_ip_vs_app(struct netns_ipvs *ipvs, struct ip_vs_app *
+
+ mutex_lock(&__ip_vs_app_mutex);
+
++ /* increase the module use count */
++ if (!ip_vs_use_count_inc()) {
++ err = -ENOENT;
++ goto out_unlock;
++ }
++
+ list_for_each_entry(a, &ipvs->app_list, a_list) {
+ if (!strcmp(app->name, a->name)) {
+ err = -EEXIST;
++ /* decrease the module use count */
++ ip_vs_use_count_dec();
+ goto out_unlock;
+ }
+ }
+ a = kmemdup(app, sizeof(*app), GFP_KERNEL);
+ if (!a) {
+ err = -ENOMEM;
++ /* decrease the module use count */
++ ip_vs_use_count_dec();
+ goto out_unlock;
+ }
+ INIT_LIST_HEAD(&a->incs_list);
+ list_add(&a->a_list, &ipvs->app_list);
+- /* increase the module use count */
+- ip_vs_use_count_inc();
+
+ out_unlock:
+ mutex_unlock(&__ip_vs_app_mutex);
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 3df94a499126..c339b5e386b7 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -98,7 +98,6 @@ static bool __ip_vs_addr_is_local_v6(struct net *net,
+ static void update_defense_level(struct netns_ipvs *ipvs)
+ {
+ struct sysinfo i;
+- static int old_secure_tcp = 0;
+ int availmem;
+ int nomem;
+ int to_change = -1;
+@@ -179,35 +178,35 @@ static void update_defense_level(struct netns_ipvs *ipvs)
+ spin_lock(&ipvs->securetcp_lock);
+ switch (ipvs->sysctl_secure_tcp) {
+ case 0:
+- if (old_secure_tcp >= 2)
++ if (ipvs->old_secure_tcp >= 2)
+ to_change = 0;
+ break;
+ case 1:
+ if (nomem) {
+- if (old_secure_tcp < 2)
++ if (ipvs->old_secure_tcp < 2)
+ to_change = 1;
+ ipvs->sysctl_secure_tcp = 2;
+ } else {
+- if (old_secure_tcp >= 2)
++ if (ipvs->old_secure_tcp >= 2)
+ to_change = 0;
+ }
+ break;
+ case 2:
+ if (nomem) {
+- if (old_secure_tcp < 2)
++ if (ipvs->old_secure_tcp < 2)
+ to_change = 1;
+ } else {
+- if (old_secure_tcp >= 2)
++ if (ipvs->old_secure_tcp >= 2)
+ to_change = 0;
+ ipvs->sysctl_secure_tcp = 1;
+ }
+ break;
+ case 3:
+- if (old_secure_tcp < 2)
++ if (ipvs->old_secure_tcp < 2)
+ to_change = 1;
+ break;
+ }
+- old_secure_tcp = ipvs->sysctl_secure_tcp;
++ ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp;
+ if (to_change >= 0)
+ ip_vs_protocol_timeout_change(ipvs,
+ ipvs->sysctl_secure_tcp > 1);
+@@ -1204,7 +1203,8 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
+ struct ip_vs_service *svc = NULL;
+
+ /* increase the module use count */
+- ip_vs_use_count_inc();
++ if (!ip_vs_use_count_inc())
++ return -ENOPROTOOPT;
+
+ /* Lookup the scheduler by 'u->sched_name' */
+ if (strcmp(u->sched_name, "none")) {
+@@ -2363,9 +2363,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+ if (copy_from_user(arg, user, len) != 0)
+ return -EFAULT;
+
+- /* increase the module use count */
+- ip_vs_use_count_inc();
+-
+ /* Handle daemons since they have another lock */
+ if (cmd == IP_VS_SO_SET_STARTDAEMON ||
+ cmd == IP_VS_SO_SET_STOPDAEMON) {
+@@ -2378,13 +2375,13 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+ ret = -EINVAL;
+ if (strscpy(cfg.mcast_ifn, dm->mcast_ifn,
+ sizeof(cfg.mcast_ifn)) <= 0)
+- goto out_dec;
++ return ret;
+ cfg.syncid = dm->syncid;
+ ret = start_sync_thread(ipvs, &cfg, dm->state);
+ } else {
+ ret = stop_sync_thread(ipvs, dm->state);
+ }
+- goto out_dec;
++ return ret;
+ }
+
+ mutex_lock(&__ip_vs_mutex);
+@@ -2479,10 +2476,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+
+ out_unlock:
+ mutex_unlock(&__ip_vs_mutex);
+- out_dec:
+- /* decrease the module use count */
+- ip_vs_use_count_dec();
+-
+ return ret;
+ }
+
+diff --git a/net/netfilter/ipvs/ip_vs_pe.c b/net/netfilter/ipvs/ip_vs_pe.c
+index 0df17caa8af6..714e7e05c102 100644
+--- a/net/netfilter/ipvs/ip_vs_pe.c
++++ b/net/netfilter/ipvs/ip_vs_pe.c
+@@ -67,7 +67,8 @@ int register_ip_vs_pe(struct ip_vs_pe *pe)
+ struct ip_vs_pe *tmp;
+
+ /* increase the module use count */
+- ip_vs_use_count_inc();
++ if (!ip_vs_use_count_inc())
++ return -ENOENT;
+
+ mutex_lock(&ip_vs_pe_mutex);
+ /* Make sure that the pe with this name doesn't exist
+diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
+index a2ff7d746ebf..3bd0ff36dc41 100644
+--- a/net/netfilter/ipvs/ip_vs_sched.c
++++ b/net/netfilter/ipvs/ip_vs_sched.c
+@@ -184,7 +184,8 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
+ }
+
+ /* increase the module use count */
+- ip_vs_use_count_inc();
++ if (!ip_vs_use_count_inc())
++ return -ENOENT;
+
+ mutex_lock(&ip_vs_sched_mutex);
+
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index ecb71062fcb3..5acd99f83166 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -1762,6 +1762,10 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+ IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %zd bytes\n",
+ sizeof(struct ip_vs_sync_conn_v0));
+
++ /* increase the module use count */
++ if (!ip_vs_use_count_inc())
++ return -ENOPROTOOPT;
++
+ /* Do not hold one mutex and then to block on another */
+ for (;;) {
+ rtnl_lock();
+@@ -1892,9 +1896,6 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
+ mutex_unlock(&ipvs->sync_mutex);
+ rtnl_unlock();
+
+- /* increase the module use count */
+- ip_vs_use_count_inc();
+-
+ return 0;
+
+ out:
+@@ -1924,11 +1925,17 @@ out:
+ }
+ kfree(ti);
+ }
++
++ /* decrease the module use count */
++ ip_vs_use_count_dec();
+ return result;
+
+ out_early:
+ mutex_unlock(&ipvs->sync_mutex);
+ rtnl_unlock();
++
++ /* decrease the module use count */
++ ip_vs_use_count_dec();
+ return result;
+ }
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index 8ade40512944..70bd730ca059 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -187,6 +187,8 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
+ {
+ int err;
+
++ flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
++
+ err = rhashtable_insert_fast(&flow_table->rhashtable,
+ &flow->tuplehash[0].node,
+ nf_flow_offload_rhash_params);
+@@ -203,7 +205,6 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
+ return err;
+ }
+
+- flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(flow_offload_add);
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index b3662264aa24..30938854bb8d 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -1110,7 +1110,6 @@ static int nfc_genl_llc_set_params(struct sk_buff *skb, struct genl_info *info)
+
+ local = nfc_llcp_find_local(dev);
+ if (!local) {
+- nfc_put_device(dev);
+ rc = -ENODEV;
+ goto exit;
+ }
+@@ -1170,7 +1169,6 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
+
+ local = nfc_llcp_find_local(dev);
+ if (!local) {
+- nfc_put_device(dev);
+ rc = -ENODEV;
+ goto exit;
+ }
+diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
+index 5a304cfc8423..d2356a284646 100644
+--- a/net/openvswitch/vport-internal_dev.c
++++ b/net/openvswitch/vport-internal_dev.c
+@@ -149,7 +149,7 @@ static void do_setup(struct net_device *netdev)
+ netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH |
+ IFF_NO_QUEUE;
+ netdev->needs_free_netdev = true;
+- netdev->priv_destructor = internal_dev_destructor;
++ netdev->priv_destructor = NULL;
+ netdev->ethtool_ops = &internal_dev_ethtool_ops;
+ netdev->rtnl_link_ops = &internal_dev_link_ops;
+
+@@ -171,7 +171,6 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
+ struct internal_dev *internal_dev;
+ struct net_device *dev;
+ int err;
+- bool free_vport = true;
+
+ vport = ovs_vport_alloc(0, &ovs_internal_vport_ops, parms);
+ if (IS_ERR(vport)) {
+@@ -202,10 +201,9 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
+
+ rtnl_lock();
+ err = register_netdevice(vport->dev);
+- if (err) {
+- free_vport = false;
++ if (err)
+ goto error_unlock;
+- }
++ vport->dev->priv_destructor = internal_dev_destructor;
+
+ dev_set_promiscuity(vport->dev, 1);
+ rtnl_unlock();
+@@ -219,8 +217,7 @@ error_unlock:
+ error_free_netdev:
+ free_netdev(dev);
+ error_free_vport:
+- if (free_vport)
+- ovs_vport_free(vport);
++ ovs_vport_free(vport);
+ error:
+ return ERR_PTR(err);
+ }
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 3c199f752fd3..2a8651aa90c8 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -871,9 +871,11 @@ virtio_transport_recv_connected(struct sock *sk,
+ if (le32_to_cpu(pkt->hdr.flags) & VIRTIO_VSOCK_SHUTDOWN_SEND)
+ vsk->peer_shutdown |= SEND_SHUTDOWN;
+ if (vsk->peer_shutdown == SHUTDOWN_MASK &&
+- vsock_stream_has_data(vsk) <= 0) {
+- sock_set_flag(sk, SOCK_DONE);
+- sk->sk_state = TCP_CLOSING;
++ vsock_stream_has_data(vsk) <= 0 &&
++ !sock_flag(sk, SOCK_DONE)) {
++ (void)virtio_transport_reset(vsk, NULL);
++
++ virtio_transport_do_close(vsk, true);
+ }
+ if (le32_to_cpu(pkt->hdr.flags))
+ sk->sk_state_change(sk);
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index ec74705f003b..86a31e69fc7d 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -298,11 +298,11 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ goto unlock;
+ }
+ if (!list_empty(&timer->open_list_head)) {
+- timeri = list_entry(timer->open_list_head.next,
++ struct snd_timer_instance *t =
++ list_entry(timer->open_list_head.next,
+ struct snd_timer_instance, open_list);
+- if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
++ if (t->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
+ err = -EBUSY;
+- timeri = NULL;
+ goto unlock;
+ }
+ }
+diff --git a/sound/firewire/bebob/bebob_focusrite.c b/sound/firewire/bebob/bebob_focusrite.c
+index 52b8b61ecddd..62d989edd129 100644
+--- a/sound/firewire/bebob/bebob_focusrite.c
++++ b/sound/firewire/bebob/bebob_focusrite.c
+@@ -28,6 +28,8 @@
+ #define SAFFIRE_CLOCK_SOURCE_SPDIF 1
+
+ /* clock sources as returned from register of Saffire Pro 10 and 26 */
++#define SAFFIREPRO_CLOCK_SOURCE_SELECT_MASK 0x000000ff
++#define SAFFIREPRO_CLOCK_SOURCE_DETECT_MASK 0x0000ff00
+ #define SAFFIREPRO_CLOCK_SOURCE_INTERNAL 0
+ #define SAFFIREPRO_CLOCK_SOURCE_SKIP 1 /* never used on hardware */
+ #define SAFFIREPRO_CLOCK_SOURCE_SPDIF 2
+@@ -190,6 +192,7 @@ saffirepro_both_clk_src_get(struct snd_bebob *bebob, unsigned int *id)
+ map = saffirepro_clk_maps[1];
+
+ /* In a case that this driver cannot handle the value of register. */
++ value &= SAFFIREPRO_CLOCK_SOURCE_SELECT_MASK;
+ if (value >= SAFFIREPRO_CLOCK_SOURCE_COUNT || map[value] < 0) {
+ err = -EIO;
+ goto end;
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 0436789e7cd8..3e978b75be9a 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -6769,7 +6769,7 @@ static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
+ /* Delay enabling the HP amp, to let the mic-detection
+ * state machine run.
+ */
+- cancel_delayed_work_sync(&spec->unsol_hp_work);
++ cancel_delayed_work(&spec->unsol_hp_work);
+ schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500));
+ tbl = snd_hda_jack_tbl_get(codec, cb->nid);
+ if (tbl)
+diff --git a/sound/usb/Makefile b/sound/usb/Makefile
+index d330f74c90e6..a12fffcbcb20 100644
+--- a/sound/usb/Makefile
++++ b/sound/usb/Makefile
+@@ -16,7 +16,8 @@ snd-usb-audio-objs := card.o \
+ power.o \
+ proc.o \
+ quirks.o \
+- stream.o
++ stream.o \
++ validate.o
+
+ snd-usbmidi-lib-objs := midi.o
+
+diff --git a/sound/usb/clock.c b/sound/usb/clock.c
+index db5e39d67a90..e31349865f20 100644
+--- a/sound/usb/clock.c
++++ b/sound/usb/clock.c
+@@ -52,39 +52,37 @@ static void *find_uac_clock_desc(struct usb_host_interface *iface, int id,
+ static bool validate_clock_source_v2(void *p, int id)
+ {
+ struct uac_clock_source_descriptor *cs = p;
+- return cs->bLength == sizeof(*cs) && cs->bClockID == id;
++ return cs->bClockID == id;
+ }
+
+ static bool validate_clock_source_v3(void *p, int id)
+ {
+ struct uac3_clock_source_descriptor *cs = p;
+- return cs->bLength == sizeof(*cs) && cs->bClockID == id;
++ return cs->bClockID == id;
+ }
+
+ static bool validate_clock_selector_v2(void *p, int id)
+ {
+ struct uac_clock_selector_descriptor *cs = p;
+- return cs->bLength >= sizeof(*cs) && cs->bClockID == id &&
+- cs->bLength == 7 + cs->bNrInPins;
++ return cs->bClockID == id;
+ }
+
+ static bool validate_clock_selector_v3(void *p, int id)
+ {
+ struct uac3_clock_selector_descriptor *cs = p;
+- return cs->bLength >= sizeof(*cs) && cs->bClockID == id &&
+- cs->bLength == 11 + cs->bNrInPins;
++ return cs->bClockID == id;
+ }
+
+ static bool validate_clock_multiplier_v2(void *p, int id)
+ {
+ struct uac_clock_multiplier_descriptor *cs = p;
+- return cs->bLength == sizeof(*cs) && cs->bClockID == id;
++ return cs->bClockID == id;
+ }
+
+ static bool validate_clock_multiplier_v3(void *p, int id)
+ {
+ struct uac3_clock_multiplier_descriptor *cs = p;
+- return cs->bLength == sizeof(*cs) && cs->bClockID == id;
++ return cs->bClockID == id;
+ }
+
+ #define DEFINE_FIND_HELPER(name, obj, validator, type) \
+diff --git a/sound/usb/helper.h b/sound/usb/helper.h
+index d338bd0e0ca6..f5b4c6647e4d 100644
+--- a/sound/usb/helper.h
++++ b/sound/usb/helper.h
+@@ -30,4 +30,8 @@ static inline int snd_usb_ctrl_intf(struct snd_usb_audio *chip)
+ return get_iface_desc(chip->ctrl_intf)->bInterfaceNumber;
+ }
+
++/* in validate.c */
++bool snd_usb_validate_audio_desc(void *p, int protocol);
++bool snd_usb_validate_midi_desc(void *p);
++
+ #endif /* __USBAUDIO_HELPER_H */
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index b0c5d4ef6137..bb67131e6437 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -755,13 +755,6 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
+ {
+ int mu_channels;
+
+- if (desc->bLength < sizeof(*desc))
+- return -EINVAL;
+- if (!desc->bNrInPins)
+- return -EINVAL;
+- if (desc->bLength < sizeof(*desc) + desc->bNrInPins)
+- return -EINVAL;
+-
+ switch (state->mixer->protocol) {
+ case UAC_VERSION_1:
+ case UAC_VERSION_2:
+@@ -780,222 +773,242 @@ static int uac_mixer_unit_get_channels(struct mixer_build *state,
+ }
+
+ /*
+- * parse the source unit recursively until it reaches to a terminal
+- * or a branched unit.
++ * Parse Input Terminal Unit
+ */
+ static int __check_input_term(struct mixer_build *state, int id,
+- struct usb_audio_term *term)
++ struct usb_audio_term *term);
++
++static int parse_term_uac1_iterm_unit(struct mixer_build *state,
++ struct usb_audio_term *term,
++ void *p1, int id)
+ {
+- int protocol = state->mixer->protocol;
++ struct uac_input_terminal_descriptor *d = p1;
++
++ term->type = le16_to_cpu(d->wTerminalType);
++ term->channels = d->bNrChannels;
++ term->chconfig = le16_to_cpu(d->wChannelConfig);
++ term->name = d->iTerminal;
++ return 0;
++}
++
++static int parse_term_uac2_iterm_unit(struct mixer_build *state,
++ struct usb_audio_term *term,
++ void *p1, int id)
++{
++ struct uac2_input_terminal_descriptor *d = p1;
+ int err;
+- void *p1;
+- unsigned char *hdr;
+
+- memset(term, 0, sizeof(*term));
+- for (;;) {
+- /* a loop in the terminal chain? */
+- if (test_and_set_bit(id, state->termbitmap))
+- return -EINVAL;
++ /* call recursively to verify the referenced clock entity */
++ err = __check_input_term(state, d->bCSourceID, term);
++ if (err < 0)
++ return err;
+
+- p1 = find_audio_control_unit(state, id);
+- if (!p1)
+- break;
++ /* save input term properties after recursion,
++ * to ensure they are not overriden by the recursion calls
++ */
++ term->id = id;
++ term->type = le16_to_cpu(d->wTerminalType);
++ term->channels = d->bNrChannels;
++ term->chconfig = le32_to_cpu(d->bmChannelConfig);
++ term->name = d->iTerminal;
++ return 0;
++}
+
+- hdr = p1;
+- term->id = id;
++static int parse_term_uac3_iterm_unit(struct mixer_build *state,
++ struct usb_audio_term *term,
++ void *p1, int id)
++{
++ struct uac3_input_terminal_descriptor *d = p1;
++ int err;
+
+- if (protocol == UAC_VERSION_1 || protocol == UAC_VERSION_2) {
+- switch (hdr[2]) {
+- case UAC_INPUT_TERMINAL:
+- if (protocol == UAC_VERSION_1) {
+- struct uac_input_terminal_descriptor *d = p1;
+-
+- term->type = le16_to_cpu(d->wTerminalType);
+- term->channels = d->bNrChannels;
+- term->chconfig = le16_to_cpu(d->wChannelConfig);
+- term->name = d->iTerminal;
+- } else { /* UAC_VERSION_2 */
+- struct uac2_input_terminal_descriptor *d = p1;
+-
+- /* call recursively to verify that the
+- * referenced clock entity is valid */
+- err = __check_input_term(state, d->bCSourceID, term);
+- if (err < 0)
+- return err;
++ /* call recursively to verify the referenced clock entity */
++ err = __check_input_term(state, d->bCSourceID, term);
++ if (err < 0)
++ return err;
+
+- /* save input term properties after recursion,
+- * to ensure they are not overriden by the
+- * recursion calls */
+- term->id = id;
+- term->type = le16_to_cpu(d->wTerminalType);
+- term->channels = d->bNrChannels;
+- term->chconfig = le32_to_cpu(d->bmChannelConfig);
+- term->name = d->iTerminal;
+- }
+- return 0;
+- case UAC_FEATURE_UNIT: {
+- /* the header is the same for v1 and v2 */
+- struct uac_feature_unit_descriptor *d = p1;
++ /* save input term properties after recursion,
++ * to ensure they are not overriden by the recursion calls
++ */
++ term->id = id;
++ term->type = le16_to_cpu(d->wTerminalType);
+
+- id = d->bSourceID;
+- break; /* continue to parse */
+- }
+- case UAC_MIXER_UNIT: {
+- struct uac_mixer_unit_descriptor *d = p1;
+-
+- term->type = UAC3_MIXER_UNIT << 16; /* virtual type */
+- term->channels = uac_mixer_unit_bNrChannels(d);
+- term->chconfig = uac_mixer_unit_wChannelConfig(d, protocol);
+- term->name = uac_mixer_unit_iMixer(d);
+- return 0;
+- }
+- case UAC_SELECTOR_UNIT:
+- case UAC2_CLOCK_SELECTOR: {
+- struct uac_selector_unit_descriptor *d = p1;
+- /* call recursively to retrieve the channel info */
+- err = __check_input_term(state, d->baSourceID[0], term);
+- if (err < 0)
+- return err;
+- term->type = UAC3_SELECTOR_UNIT << 16; /* virtual type */
+- term->id = id;
+- term->name = uac_selector_unit_iSelector(d);
+- return 0;
+- }
+- case UAC1_PROCESSING_UNIT:
+- /* UAC2_EFFECT_UNIT */
+- if (protocol == UAC_VERSION_1)
+- term->type = UAC3_PROCESSING_UNIT << 16; /* virtual type */
+- else /* UAC_VERSION_2 */
+- term->type = UAC3_EFFECT_UNIT << 16; /* virtual type */
+- /* fall through */
+- case UAC1_EXTENSION_UNIT:
+- /* UAC2_PROCESSING_UNIT_V2 */
+- if (protocol == UAC_VERSION_1 && !term->type)
+- term->type = UAC3_EXTENSION_UNIT << 16; /* virtual type */
+- else if (protocol == UAC_VERSION_2 && !term->type)
+- term->type = UAC3_PROCESSING_UNIT << 16; /* virtual type */
+- /* fall through */
+- case UAC2_EXTENSION_UNIT_V2: {
+- struct uac_processing_unit_descriptor *d = p1;
+-
+- if (protocol == UAC_VERSION_2 &&
+- hdr[2] == UAC2_EFFECT_UNIT) {
+- /* UAC2/UAC1 unit IDs overlap here in an
+- * uncompatible way. Ignore this unit for now.
+- */
+- return 0;
+- }
++ err = get_cluster_channels_v3(state, le16_to_cpu(d->wClusterDescrID));
++ if (err < 0)
++ return err;
++ term->channels = err;
+
+- if (d->bNrInPins) {
+- id = d->baSourceID[0];
+- break; /* continue to parse */
+- }
+- if (!term->type)
+- term->type = UAC3_EXTENSION_UNIT << 16; /* virtual type */
++ /* REVISIT: UAC3 IT doesn't have channels cfg */
++ term->chconfig = 0;
+
+- term->channels = uac_processing_unit_bNrChannels(d);
+- term->chconfig = uac_processing_unit_wChannelConfig(d, protocol);
+- term->name = uac_processing_unit_iProcessing(d, protocol);
+- return 0;
+- }
+- case UAC2_CLOCK_SOURCE: {
+- struct uac_clock_source_descriptor *d = p1;
++ term->name = le16_to_cpu(d->wTerminalDescrStr);
++ return 0;
++}
+
+- term->type = UAC3_CLOCK_SOURCE << 16; /* virtual type */
+- term->id = id;
+- term->name = d->iClockSource;
+- return 0;
+- }
+- default:
+- return -ENODEV;
+- }
+- } else { /* UAC_VERSION_3 */
+- switch (hdr[2]) {
+- case UAC_INPUT_TERMINAL: {
+- struct uac3_input_terminal_descriptor *d = p1;
+-
+- /* call recursively to verify that the
+- * referenced clock entity is valid */
+- err = __check_input_term(state, d->bCSourceID, term);
+- if (err < 0)
+- return err;
++static int parse_term_mixer_unit(struct mixer_build *state,
++ struct usb_audio_term *term,
++ void *p1, int id)
++{
++ struct uac_mixer_unit_descriptor *d = p1;
++ int protocol = state->mixer->protocol;
++ int err;
+
+- /* save input term properties after recursion,
+- * to ensure they are not overriden by the
+- * recursion calls */
+- term->id = id;
+- term->type = le16_to_cpu(d->wTerminalType);
++ err = uac_mixer_unit_get_channels(state, d);
++ if (err <= 0)
++ return err;
+
+- err = get_cluster_channels_v3(state, le16_to_cpu(d->wClusterDescrID));
+- if (err < 0)
+- return err;
+- term->channels = err;
++ term->type = UAC3_MIXER_UNIT << 16; /* virtual type */
++ term->channels = err;
++ if (protocol != UAC_VERSION_3) {
++ term->chconfig = uac_mixer_unit_wChannelConfig(d, protocol);
++ term->name = uac_mixer_unit_iMixer(d);
++ }
++ return 0;
++}
+
+- /* REVISIT: UAC3 IT doesn't have channels cfg */
+- term->chconfig = 0;
++static int parse_term_selector_unit(struct mixer_build *state,
++ struct usb_audio_term *term,
++ void *p1, int id)
++{
++ struct uac_selector_unit_descriptor *d = p1;
++ int err;
+
+- term->name = le16_to_cpu(d->wTerminalDescrStr);
+- return 0;
+- }
+- case UAC3_FEATURE_UNIT: {
+- struct uac3_feature_unit_descriptor *d = p1;
++ /* call recursively to retrieve the channel info */
++ err = __check_input_term(state, d->baSourceID[0], term);
++ if (err < 0)
++ return err;
++ term->type = UAC3_SELECTOR_UNIT << 16; /* virtual type */
++ term->id = id;
++ if (state->mixer->protocol != UAC_VERSION_3)
++ term->name = uac_selector_unit_iSelector(d);
++ return 0;
++}
+
+- id = d->bSourceID;
+- break; /* continue to parse */
+- }
+- case UAC3_CLOCK_SOURCE: {
+- struct uac3_clock_source_descriptor *d = p1;
++static int parse_term_proc_unit(struct mixer_build *state,
++ struct usb_audio_term *term,
++ void *p1, int id, int vtype)
++{
++ struct uac_processing_unit_descriptor *d = p1;
++ int protocol = state->mixer->protocol;
++ int err;
+
+- term->type = UAC3_CLOCK_SOURCE << 16; /* virtual type */
+- term->id = id;
+- term->name = le16_to_cpu(d->wClockSourceStr);
+- return 0;
+- }
+- case UAC3_MIXER_UNIT: {
+- struct uac_mixer_unit_descriptor *d = p1;
++ if (d->bNrInPins) {
++ /* call recursively to retrieve the channel info */
++ err = __check_input_term(state, d->baSourceID[0], term);
++ if (err < 0)
++ return err;
++ }
+
+- err = uac_mixer_unit_get_channels(state, d);
+- if (err <= 0)
+- return err;
++ term->type = vtype << 16; /* virtual type */
++ term->id = id;
+
+- term->channels = err;
+- term->type = UAC3_MIXER_UNIT << 16; /* virtual type */
++ if (protocol == UAC_VERSION_3)
++ return 0;
+
+- return 0;
+- }
+- case UAC3_SELECTOR_UNIT:
+- case UAC3_CLOCK_SELECTOR: {
+- struct uac_selector_unit_descriptor *d = p1;
+- /* call recursively to retrieve the channel info */
+- err = __check_input_term(state, d->baSourceID[0], term);
+- if (err < 0)
+- return err;
+- term->type = UAC3_SELECTOR_UNIT << 16; /* virtual type */
+- term->id = id;
+- term->name = 0; /* TODO: UAC3 Class-specific strings */
++ if (!term->channels) {
++ term->channels = uac_processing_unit_bNrChannels(d);
++ term->chconfig = uac_processing_unit_wChannelConfig(d, protocol);
++ }
++ term->name = uac_processing_unit_iProcessing(d, protocol);
++ return 0;
++}
+
+- return 0;
+- }
+- case UAC3_PROCESSING_UNIT: {
+- struct uac_processing_unit_descriptor *d = p1;
++static int parse_term_uac2_clock_source(struct mixer_build *state,
++ struct usb_audio_term *term,
++ void *p1, int id)
++{
++ struct uac_clock_source_descriptor *d = p1;
+
+- if (!d->bNrInPins)
+- return -EINVAL;
++ term->type = UAC3_CLOCK_SOURCE << 16; /* virtual type */
++ term->id = id;
++ term->name = d->iClockSource;
++ return 0;
++}
+
+- /* call recursively to retrieve the channel info */
+- err = __check_input_term(state, d->baSourceID[0], term);
+- if (err < 0)
+- return err;
++static int parse_term_uac3_clock_source(struct mixer_build *state,
++ struct usb_audio_term *term,
++ void *p1, int id)
++{
++ struct uac3_clock_source_descriptor *d = p1;
++
++ term->type = UAC3_CLOCK_SOURCE << 16; /* virtual type */
++ term->id = id;
++ term->name = le16_to_cpu(d->wClockSourceStr);
++ return 0;
++}
+
+- term->type = UAC3_PROCESSING_UNIT << 16; /* virtual type */
+- term->id = id;
+- term->name = 0; /* TODO: UAC3 Class-specific strings */
++#define PTYPE(a, b) ((a) << 8 | (b))
+
+- return 0;
+- }
+- default:
+- return -ENODEV;
+- }
++/*
++ * parse the source unit recursively until it reaches to a terminal
++ * or a branched unit.
++ */
++static int __check_input_term(struct mixer_build *state, int id,
++ struct usb_audio_term *term)
++{
++ int protocol = state->mixer->protocol;
++ void *p1;
++ unsigned char *hdr;
++
++ for (;;) {
++ /* a loop in the terminal chain? */
++ if (test_and_set_bit(id, state->termbitmap))
++ return -EINVAL;
++
++ p1 = find_audio_control_unit(state, id);
++ if (!p1)
++ break;
++ if (!snd_usb_validate_audio_desc(p1, protocol))
++ break; /* bad descriptor */
++
++ hdr = p1;
++ term->id = id;
++
++ switch (PTYPE(protocol, hdr[2])) {
++ case PTYPE(UAC_VERSION_1, UAC_FEATURE_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC_FEATURE_UNIT):
++ case PTYPE(UAC_VERSION_3, UAC3_FEATURE_UNIT): {
++ /* the header is the same for all versions */
++ struct uac_feature_unit_descriptor *d = p1;
++
++ id = d->bSourceID;
++ break; /* continue to parse */
++ }
++ case PTYPE(UAC_VERSION_1, UAC_INPUT_TERMINAL):
++ return parse_term_uac1_iterm_unit(state, term, p1, id);
++ case PTYPE(UAC_VERSION_2, UAC_INPUT_TERMINAL):
++ return parse_term_uac2_iterm_unit(state, term, p1, id);
++ case PTYPE(UAC_VERSION_3, UAC_INPUT_TERMINAL):
++ return parse_term_uac3_iterm_unit(state, term, p1, id);
++ case PTYPE(UAC_VERSION_1, UAC_MIXER_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC_MIXER_UNIT):
++ case PTYPE(UAC_VERSION_3, UAC3_MIXER_UNIT):
++ return parse_term_mixer_unit(state, term, p1, id);
++ case PTYPE(UAC_VERSION_1, UAC_SELECTOR_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC_SELECTOR_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC2_CLOCK_SELECTOR):
++ case PTYPE(UAC_VERSION_3, UAC3_SELECTOR_UNIT):
++ case PTYPE(UAC_VERSION_3, UAC3_CLOCK_SELECTOR):
++ return parse_term_selector_unit(state, term, p1, id);
++ case PTYPE(UAC_VERSION_1, UAC1_PROCESSING_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2):
++ case PTYPE(UAC_VERSION_3, UAC3_PROCESSING_UNIT):
++ return parse_term_proc_unit(state, term, p1, id,
++ UAC3_PROCESSING_UNIT);
++ case PTYPE(UAC_VERSION_2, UAC2_EFFECT_UNIT):
++ case PTYPE(UAC_VERSION_3, UAC3_EFFECT_UNIT):
++ return parse_term_proc_unit(state, term, p1, id,
++ UAC3_EFFECT_UNIT);
++ case PTYPE(UAC_VERSION_1, UAC1_EXTENSION_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2):
++ case PTYPE(UAC_VERSION_3, UAC3_EXTENSION_UNIT):
++ return parse_term_proc_unit(state, term, p1, id,
++ UAC3_EXTENSION_UNIT);
++ case PTYPE(UAC_VERSION_2, UAC2_CLOCK_SOURCE):
++ return parse_term_uac2_clock_source(state, term, p1, id);
++ case PTYPE(UAC_VERSION_3, UAC3_CLOCK_SOURCE):
++ return parse_term_uac3_clock_source(state, term, p1, id);
++ default:
++ return -ENODEV;
+ }
+ }
+ return -ENODEV;
+@@ -1039,10 +1052,15 @@ static struct usb_feature_control_info audio_feature_info[] = {
+ { UAC2_FU_PHASE_INVERTER, "Phase Inverter Control", USB_MIXER_BOOLEAN, -1 },
+ };
+
++static void usb_mixer_elem_info_free(struct usb_mixer_elem_info *cval)
++{
++ kfree(cval);
++}
++
+ /* private_free callback */
+ void snd_usb_mixer_elem_free(struct snd_kcontrol *kctl)
+ {
+- kfree(kctl->private_data);
++ usb_mixer_elem_info_free(kctl->private_data);
+ kctl->private_data = NULL;
+ }
+
+@@ -1565,7 +1583,7 @@ static void __build_feature_ctl(struct usb_mixer_interface *mixer,
+
+ ctl_info = get_feature_control_info(control);
+ if (!ctl_info) {
+- kfree(cval);
++ usb_mixer_elem_info_free(cval);
+ return;
+ }
+ if (mixer->protocol == UAC_VERSION_1)
+@@ -1598,7 +1616,7 @@ static void __build_feature_ctl(struct usb_mixer_interface *mixer,
+
+ if (!kctl) {
+ usb_audio_err(mixer->chip, "cannot malloc kcontrol\n");
+- kfree(cval);
++ usb_mixer_elem_info_free(cval);
+ return;
+ }
+ kctl->private_free = snd_usb_mixer_elem_free;
+@@ -1768,7 +1786,7 @@ static void build_connector_control(struct usb_mixer_interface *mixer,
+ kctl = snd_ctl_new1(&usb_connector_ctl_ro, cval);
+ if (!kctl) {
+ usb_audio_err(mixer->chip, "cannot malloc kcontrol\n");
+- kfree(cval);
++ usb_mixer_elem_info_free(cval);
+ return;
+ }
+ get_connector_control_name(mixer, term, is_input, kctl->id.name,
+@@ -1789,13 +1807,6 @@ static int parse_clock_source_unit(struct mixer_build *state, int unitid,
+ if (state->mixer->protocol != UAC_VERSION_2)
+ return -EINVAL;
+
+- if (hdr->bLength != sizeof(*hdr)) {
+- usb_audio_dbg(state->chip,
+- "Bogus clock source descriptor length of %d, ignoring.\n",
+- hdr->bLength);
+- return 0;
+- }
+-
+ /*
+ * The only property of this unit we are interested in is the
+ * clock source validity. If that isn't readable, just bail out.
+@@ -1821,7 +1832,7 @@ static int parse_clock_source_unit(struct mixer_build *state, int unitid,
+ kctl = snd_ctl_new1(&usb_bool_master_control_ctl_ro, cval);
+
+ if (!kctl) {
+- kfree(cval);
++ usb_mixer_elem_info_free(cval);
+ return -ENOMEM;
+ }
+
+@@ -1854,62 +1865,20 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid,
+ __u8 *bmaControls;
+
+ if (state->mixer->protocol == UAC_VERSION_1) {
+- if (hdr->bLength < 7) {
+- usb_audio_err(state->chip,
+- "unit %u: invalid UAC_FEATURE_UNIT descriptor\n",
+- unitid);
+- return -EINVAL;
+- }
+ csize = hdr->bControlSize;
+- if (!csize) {
+- usb_audio_dbg(state->chip,
+- "unit %u: invalid bControlSize == 0\n",
+- unitid);
+- return -EINVAL;
+- }
+ channels = (hdr->bLength - 7) / csize - 1;
+ bmaControls = hdr->bmaControls;
+- if (hdr->bLength < 7 + csize) {
+- usb_audio_err(state->chip,
+- "unit %u: invalid UAC_FEATURE_UNIT descriptor\n",
+- unitid);
+- return -EINVAL;
+- }
+ } else if (state->mixer->protocol == UAC_VERSION_2) {
+ struct uac2_feature_unit_descriptor *ftr = _ftr;
+- if (hdr->bLength < 6) {
+- usb_audio_err(state->chip,
+- "unit %u: invalid UAC_FEATURE_UNIT descriptor\n",
+- unitid);
+- return -EINVAL;
+- }
+ csize = 4;
+ channels = (hdr->bLength - 6) / 4 - 1;
+ bmaControls = ftr->bmaControls;
+- if (hdr->bLength < 6 + csize) {
+- usb_audio_err(state->chip,
+- "unit %u: invalid UAC_FEATURE_UNIT descriptor\n",
+- unitid);
+- return -EINVAL;
+- }
+ } else { /* UAC_VERSION_3 */
+ struct uac3_feature_unit_descriptor *ftr = _ftr;
+
+- if (hdr->bLength < 7) {
+- usb_audio_err(state->chip,
+- "unit %u: invalid UAC3_FEATURE_UNIT descriptor\n",
+- unitid);
+- return -EINVAL;
+- }
+ csize = 4;
+ channels = (ftr->bLength - 7) / 4 - 1;
+ bmaControls = ftr->bmaControls;
+- if (hdr->bLength < 7 + csize) {
+- usb_audio_err(state->chip,
+- "unit %u: invalid UAC3_FEATURE_UNIT descriptor\n",
+- unitid);
+- return -EINVAL;
+- }
+ }
+
+ /* parse the source unit */
+@@ -2087,7 +2056,7 @@ static void build_mixer_unit_ctl(struct mixer_build *state,
+ kctl = snd_ctl_new1(&usb_feature_unit_ctl, cval);
+ if (!kctl) {
+ usb_audio_err(state->chip, "cannot malloc kcontrol\n");
+- kfree(cval);
++ usb_mixer_elem_info_free(cval);
+ return;
+ }
+ kctl->private_free = snd_usb_mixer_elem_free;
+@@ -2113,15 +2082,11 @@ static int parse_audio_input_terminal(struct mixer_build *state, int unitid,
+
+ if (state->mixer->protocol == UAC_VERSION_2) {
+ struct uac2_input_terminal_descriptor *d_v2 = raw_desc;
+- if (d_v2->bLength < sizeof(*d_v2))
+- return -EINVAL;
+ control = UAC2_TE_CONNECTOR;
+ term_id = d_v2->bTerminalID;
+ bmctls = le16_to_cpu(d_v2->bmControls);
+ } else if (state->mixer->protocol == UAC_VERSION_3) {
+ struct uac3_input_terminal_descriptor *d_v3 = raw_desc;
+- if (d_v3->bLength < sizeof(*d_v3))
+- return -EINVAL;
+ control = UAC3_TE_INSERTION;
+ term_id = d_v3->bTerminalID;
+ bmctls = le32_to_cpu(d_v3->bmControls);
+@@ -2383,18 +2348,7 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ const char *name = extension_unit ?
+ "Extension Unit" : "Processing Unit";
+
+- if (desc->bLength < 13) {
+- usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid);
+- return -EINVAL;
+- }
+-
+ num_ins = desc->bNrInPins;
+- if (desc->bLength < 13 + num_ins ||
+- desc->bLength < num_ins + uac_processing_unit_bControlSize(desc, state->mixer->protocol)) {
+- usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid);
+- return -EINVAL;
+- }
+-
+ for (i = 0; i < num_ins; i++) {
+ err = parse_audio_unit(state, desc->baSourceID[i]);
+ if (err < 0)
+@@ -2485,7 +2439,7 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+
+ kctl = snd_ctl_new1(&mixer_procunit_ctl, cval);
+ if (!kctl) {
+- kfree(cval);
++ usb_mixer_elem_info_free(cval);
+ return -ENOMEM;
+ }
+ kctl->private_free = snd_usb_mixer_elem_free;
+@@ -2623,7 +2577,7 @@ static void usb_mixer_selector_elem_free(struct snd_kcontrol *kctl)
+ if (kctl->private_data) {
+ struct usb_mixer_elem_info *cval = kctl->private_data;
+ num_ins = cval->max;
+- kfree(cval);
++ usb_mixer_elem_info_free(cval);
+ kctl->private_data = NULL;
+ }
+ if (kctl->private_value) {
+@@ -2649,13 +2603,6 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
+ const struct usbmix_name_map *map;
+ char **namelist;
+
+- if (desc->bLength < 5 || !desc->bNrInPins ||
+- desc->bLength < 5 + desc->bNrInPins) {
+- usb_audio_err(state->chip,
+- "invalid SELECTOR UNIT descriptor %d\n", unitid);
+- return -EINVAL;
+- }
+-
+ for (i = 0; i < desc->bNrInPins; i++) {
+ err = parse_audio_unit(state, desc->baSourceID[i]);
+ if (err < 0)
+@@ -2695,10 +2642,10 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
+ break;
+ }
+
+- namelist = kmalloc_array(desc->bNrInPins, sizeof(char *), GFP_KERNEL);
++ namelist = kcalloc(desc->bNrInPins, sizeof(char *), GFP_KERNEL);
+ if (!namelist) {
+- kfree(cval);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto error_cval;
+ }
+ #define MAX_ITEM_NAME_LEN 64
+ for (i = 0; i < desc->bNrInPins; i++) {
+@@ -2706,11 +2653,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
+ len = 0;
+ namelist[i] = kmalloc(MAX_ITEM_NAME_LEN, GFP_KERNEL);
+ if (!namelist[i]) {
+- while (i--)
+- kfree(namelist[i]);
+- kfree(namelist);
+- kfree(cval);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto error_name;
+ }
+ len = check_mapped_selector_name(state, unitid, i, namelist[i],
+ MAX_ITEM_NAME_LEN);
+@@ -2724,11 +2668,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
+ kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
+ if (! kctl) {
+ usb_audio_err(state->chip, "cannot malloc kcontrol\n");
+- for (i = 0; i < desc->bNrInPins; i++)
+- kfree(namelist[i]);
+- kfree(namelist);
+- kfree(cval);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto error_name;
+ }
+ kctl->private_value = (unsigned long)namelist;
+ kctl->private_free = usb_mixer_selector_elem_free;
+@@ -2774,6 +2715,14 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
+ usb_audio_dbg(state->chip, "[%d] SU [%s] items = %d\n",
+ cval->head.id, kctl->id.name, desc->bNrInPins);
+ return snd_usb_mixer_add_control(&cval->head, kctl);
++
++ error_name:
++ for (i = 0; i < desc->bNrInPins; i++)
++ kfree(namelist[i]);
++ kfree(namelist);
++ error_cval:
++ usb_mixer_elem_info_free(cval);
++ return err;
+ }
+
+ /*
+@@ -2794,62 +2743,49 @@ static int parse_audio_unit(struct mixer_build *state, int unitid)
+ return -EINVAL;
+ }
+
+- if (protocol == UAC_VERSION_1 || protocol == UAC_VERSION_2) {
+- switch (p1[2]) {
+- case UAC_INPUT_TERMINAL:
+- return parse_audio_input_terminal(state, unitid, p1);
+- case UAC_MIXER_UNIT:
+- return parse_audio_mixer_unit(state, unitid, p1);
+- case UAC2_CLOCK_SOURCE:
+- return parse_clock_source_unit(state, unitid, p1);
+- case UAC_SELECTOR_UNIT:
+- case UAC2_CLOCK_SELECTOR:
+- return parse_audio_selector_unit(state, unitid, p1);
+- case UAC_FEATURE_UNIT:
+- return parse_audio_feature_unit(state, unitid, p1);
+- case UAC1_PROCESSING_UNIT:
+- /* UAC2_EFFECT_UNIT has the same value */
+- if (protocol == UAC_VERSION_1)
+- return parse_audio_processing_unit(state, unitid, p1);
+- else
+- return 0; /* FIXME - effect units not implemented yet */
+- case UAC1_EXTENSION_UNIT:
+- /* UAC2_PROCESSING_UNIT_V2 has the same value */
+- if (protocol == UAC_VERSION_1)
+- return parse_audio_extension_unit(state, unitid, p1);
+- else /* UAC_VERSION_2 */
+- return parse_audio_processing_unit(state, unitid, p1);
+- case UAC2_EXTENSION_UNIT_V2:
+- return parse_audio_extension_unit(state, unitid, p1);
+- default:
+- usb_audio_err(state->chip,
+- "unit %u: unexpected type 0x%02x\n", unitid, p1[2]);
+- return -EINVAL;
+- }
+- } else { /* UAC_VERSION_3 */
+- switch (p1[2]) {
+- case UAC_INPUT_TERMINAL:
+- return parse_audio_input_terminal(state, unitid, p1);
+- case UAC3_MIXER_UNIT:
+- return parse_audio_mixer_unit(state, unitid, p1);
+- case UAC3_CLOCK_SOURCE:
+- return parse_clock_source_unit(state, unitid, p1);
+- case UAC3_SELECTOR_UNIT:
+- case UAC3_CLOCK_SELECTOR:
+- return parse_audio_selector_unit(state, unitid, p1);
+- case UAC3_FEATURE_UNIT:
+- return parse_audio_feature_unit(state, unitid, p1);
+- case UAC3_EFFECT_UNIT:
+- return 0; /* FIXME - effect units not implemented yet */
+- case UAC3_PROCESSING_UNIT:
+- return parse_audio_processing_unit(state, unitid, p1);
+- case UAC3_EXTENSION_UNIT:
+- return parse_audio_extension_unit(state, unitid, p1);
+- default:
+- usb_audio_err(state->chip,
+- "unit %u: unexpected type 0x%02x\n", unitid, p1[2]);
+- return -EINVAL;
+- }
++ if (!snd_usb_validate_audio_desc(p1, protocol)) {
++ usb_audio_dbg(state->chip, "invalid unit %d\n", unitid);
++ return 0; /* skip invalid unit */
++ }
++
++ switch (PTYPE(protocol, p1[2])) {
++ case PTYPE(UAC_VERSION_1, UAC_INPUT_TERMINAL):
++ case PTYPE(UAC_VERSION_2, UAC_INPUT_TERMINAL):
++ case PTYPE(UAC_VERSION_3, UAC_INPUT_TERMINAL):
++ return parse_audio_input_terminal(state, unitid, p1);
++ case PTYPE(UAC_VERSION_1, UAC_MIXER_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC_MIXER_UNIT):
++ case PTYPE(UAC_VERSION_3, UAC3_MIXER_UNIT):
++ return parse_audio_mixer_unit(state, unitid, p1);
++ case PTYPE(UAC_VERSION_2, UAC2_CLOCK_SOURCE):
++ case PTYPE(UAC_VERSION_3, UAC3_CLOCK_SOURCE):
++ return parse_clock_source_unit(state, unitid, p1);
++ case PTYPE(UAC_VERSION_1, UAC_SELECTOR_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC_SELECTOR_UNIT):
++ case PTYPE(UAC_VERSION_3, UAC3_SELECTOR_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC2_CLOCK_SELECTOR):
++ case PTYPE(UAC_VERSION_3, UAC3_CLOCK_SELECTOR):
++ return parse_audio_selector_unit(state, unitid, p1);
++ case PTYPE(UAC_VERSION_1, UAC_FEATURE_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC_FEATURE_UNIT):
++ case PTYPE(UAC_VERSION_3, UAC3_FEATURE_UNIT):
++ return parse_audio_feature_unit(state, unitid, p1);
++ case PTYPE(UAC_VERSION_1, UAC1_PROCESSING_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2):
++ case PTYPE(UAC_VERSION_3, UAC3_PROCESSING_UNIT):
++ return parse_audio_processing_unit(state, unitid, p1);
++ case PTYPE(UAC_VERSION_1, UAC1_EXTENSION_UNIT):
++ case PTYPE(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2):
++ case PTYPE(UAC_VERSION_3, UAC3_EXTENSION_UNIT):
++ return parse_audio_extension_unit(state, unitid, p1);
++ case PTYPE(UAC_VERSION_2, UAC2_EFFECT_UNIT):
++ case PTYPE(UAC_VERSION_3, UAC3_EFFECT_UNIT):
++ return 0; /* FIXME - effect units not implemented yet */
++ default:
++ usb_audio_err(state->chip,
++ "unit %u: unexpected type 0x%02x\n",
++ unitid, p1[2]);
++ return -EINVAL;
+ }
+ }
+
+@@ -3164,11 +3100,12 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ while ((p = snd_usb_find_csint_desc(mixer->hostif->extra,
+ mixer->hostif->extralen,
+ p, UAC_OUTPUT_TERMINAL)) != NULL) {
++ if (!snd_usb_validate_audio_desc(p, mixer->protocol))
++ continue; /* skip invalid descriptor */
++
+ if (mixer->protocol == UAC_VERSION_1) {
+ struct uac1_output_terminal_descriptor *desc = p;
+
+- if (desc->bLength < sizeof(*desc))
+- continue; /* invalid descriptor? */
+ /* mark terminal ID as visited */
+ set_bit(desc->bTerminalID, state.unitbitmap);
+ state.oterm.id = desc->bTerminalID;
+@@ -3180,8 +3117,6 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ } else if (mixer->protocol == UAC_VERSION_2) {
+ struct uac2_output_terminal_descriptor *desc = p;
+
+- if (desc->bLength < sizeof(*desc))
+- continue; /* invalid descriptor? */
+ /* mark terminal ID as visited */
+ set_bit(desc->bTerminalID, state.unitbitmap);
+ state.oterm.id = desc->bTerminalID;
+@@ -3207,8 +3142,6 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ } else { /* UAC_VERSION_3 */
+ struct uac3_output_terminal_descriptor *desc = p;
+
+- if (desc->bLength < sizeof(*desc))
+- continue; /* invalid descriptor? */
+ /* mark terminal ID as visited */
+ set_bit(desc->bTerminalID, state.unitbitmap);
+ state.oterm.id = desc->bTerminalID;
+diff --git a/sound/usb/power.c b/sound/usb/power.c
+index bd303a1ba1b7..606a2cb23eab 100644
+--- a/sound/usb/power.c
++++ b/sound/usb/power.c
+@@ -31,6 +31,8 @@ snd_usb_find_power_domain(struct usb_host_interface *ctrl_iface,
+ struct uac3_power_domain_descriptor *pd_desc = p;
+ int i;
+
++ if (!snd_usb_validate_audio_desc(p, UAC_VERSION_3))
++ continue;
+ for (i = 0; i < pd_desc->bNrEntities; i++) {
+ if (pd_desc->baEntityID[i] == id) {
+ pd->pd_id = pd_desc->bPowerDomainID;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index c102c0377ad9..ea253c97b8b9 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -259,6 +259,9 @@ static int create_yamaha_midi_quirk(struct snd_usb_audio *chip,
+ NULL, USB_MS_MIDI_OUT_JACK);
+ if (!injd && !outjd)
+ return -ENODEV;
++ if (!(injd && snd_usb_validate_midi_desc(injd)) ||
++ !(outjd && snd_usb_validate_midi_desc(outjd)))
++ return -ENODEV;
+ if (injd && (injd->bLength < 5 ||
+ (injd->bJackType != USB_MS_EMBEDDED &&
+ injd->bJackType != USB_MS_EXTERNAL)))
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index bc582202bd10..9d020bd0de17 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -637,16 +637,14 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip,
+ */
+ static void *
+ snd_usb_find_input_terminal_descriptor(struct usb_host_interface *ctrl_iface,
+- int terminal_id, bool uac23)
++ int terminal_id, int protocol)
+ {
+ struct uac2_input_terminal_descriptor *term = NULL;
+- size_t minlen = uac23 ? sizeof(struct uac2_input_terminal_descriptor) :
+- sizeof(struct uac_input_terminal_descriptor);
+
+ while ((term = snd_usb_find_csint_desc(ctrl_iface->extra,
+ ctrl_iface->extralen,
+ term, UAC_INPUT_TERMINAL))) {
+- if (term->bLength < minlen)
++ if (!snd_usb_validate_audio_desc(term, protocol))
+ continue;
+ if (term->bTerminalID == terminal_id)
+ return term;
+@@ -657,7 +655,7 @@ snd_usb_find_input_terminal_descriptor(struct usb_host_interface *ctrl_iface,
+
+ static void *
+ snd_usb_find_output_terminal_descriptor(struct usb_host_interface *ctrl_iface,
+- int terminal_id)
++ int terminal_id, int protocol)
+ {
+ /* OK to use with both UAC2 and UAC3 */
+ struct uac2_output_terminal_descriptor *term = NULL;
+@@ -665,8 +663,9 @@ snd_usb_find_output_terminal_descriptor(struct usb_host_interface *ctrl_iface,
+ while ((term = snd_usb_find_csint_desc(ctrl_iface->extra,
+ ctrl_iface->extralen,
+ term, UAC_OUTPUT_TERMINAL))) {
+- if (term->bLength >= sizeof(*term) &&
+- term->bTerminalID == terminal_id)
++ if (!snd_usb_validate_audio_desc(term, protocol))
++ continue;
++ if (term->bTerminalID == terminal_id)
+ return term;
+ }
+
+@@ -741,7 +740,7 @@ snd_usb_get_audioformat_uac12(struct snd_usb_audio *chip,
+
+ iterm = snd_usb_find_input_terminal_descriptor(chip->ctrl_intf,
+ as->bTerminalLink,
+- false);
++ protocol);
+ if (iterm) {
+ num_channels = iterm->bNrChannels;
+ chconfig = le16_to_cpu(iterm->wChannelConfig);
+@@ -777,7 +776,7 @@ snd_usb_get_audioformat_uac12(struct snd_usb_audio *chip,
+ */
+ input_term = snd_usb_find_input_terminal_descriptor(chip->ctrl_intf,
+ as->bTerminalLink,
+- true);
++ protocol);
+ if (input_term) {
+ clock = input_term->bCSourceID;
+ if (!chconfig && (num_channels == input_term->bNrChannels))
+@@ -786,7 +785,8 @@ snd_usb_get_audioformat_uac12(struct snd_usb_audio *chip,
+ }
+
+ output_term = snd_usb_find_output_terminal_descriptor(chip->ctrl_intf,
+- as->bTerminalLink);
++ as->bTerminalLink,
++ protocol);
+ if (output_term) {
+ clock = output_term->bCSourceID;
+ goto found_clock;
+@@ -1012,14 +1012,15 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip,
+ */
+ input_term = snd_usb_find_input_terminal_descriptor(chip->ctrl_intf,
+ as->bTerminalLink,
+- true);
++ UAC_VERSION_3);
+ if (input_term) {
+ clock = input_term->bCSourceID;
+ goto found_clock;
+ }
+
+ output_term = snd_usb_find_output_terminal_descriptor(chip->ctrl_intf,
+- as->bTerminalLink);
++ as->bTerminalLink,
++ UAC_VERSION_3);
+ if (output_term) {
+ clock = output_term->bCSourceID;
+ goto found_clock;
+diff --git a/sound/usb/validate.c b/sound/usb/validate.c
+new file mode 100644
+index 000000000000..a5e584b60dcd
+--- /dev/null
++++ b/sound/usb/validate.c
+@@ -0,0 +1,332 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++//
++// Validation of USB-audio class descriptors
++//
++
++#include <linux/init.h>
++#include <linux/usb.h>
++#include <linux/usb/audio.h>
++#include <linux/usb/audio-v2.h>
++#include <linux/usb/audio-v3.h>
++#include <linux/usb/midi.h>
++#include "usbaudio.h"
++#include "helper.h"
++
++struct usb_desc_validator {
++ unsigned char protocol;
++ unsigned char type;
++ bool (*func)(const void *p, const struct usb_desc_validator *v);
++ size_t size;
++};
++
++#define UAC_VERSION_ALL (unsigned char)(-1)
++
++/* UAC1 only */
++static bool validate_uac1_header(const void *p,
++ const struct usb_desc_validator *v)
++{
++ const struct uac1_ac_header_descriptor *d = p;
++
++ return d->bLength >= sizeof(*d) &&
++ d->bLength >= sizeof(*d) + d->bInCollection;
++}
++
++/* for mixer unit; covering all UACs */
++static bool validate_mixer_unit(const void *p,
++ const struct usb_desc_validator *v)
++{
++ const struct uac_mixer_unit_descriptor *d = p;
++ size_t len;
++
++ if (d->bLength < sizeof(*d) || !d->bNrInPins)
++ return false;
++ len = sizeof(*d) + d->bNrInPins;
++ /* We can't determine the bitmap size only from this unit descriptor,
++ * so just check with the remaining length.
++ * The actual bitmap is checked at mixer unit parser.
++ */
++ switch (v->protocol) {
++ case UAC_VERSION_1:
++ default:
++ len += 2 + 1; /* wChannelConfig, iChannelNames */
++ /* bmControls[n*m] */
++ len += 1; /* iMixer */
++ break;
++ case UAC_VERSION_2:
++ len += 4 + 1; /* bmChannelConfig, iChannelNames */
++ /* bmMixerControls[n*m] */
++ len += 1 + 1; /* bmControls, iMixer */
++ break;
++ case UAC_VERSION_3:
++ len += 2; /* wClusterDescrID */
++ /* bmMixerControls[n*m] */
++ break;
++ }
++ return d->bLength >= len;
++}
++
++/* both for processing and extension units; covering all UACs */
++static bool validate_processing_unit(const void *p,
++ const struct usb_desc_validator *v)
++{
++ const struct uac_processing_unit_descriptor *d = p;
++ const unsigned char *hdr = p;
++ size_t len, m;
++
++ if (d->bLength < sizeof(*d))
++ return false;
++ len = sizeof(*d) + d->bNrInPins;
++ if (d->bLength < len)
++ return false;
++ switch (v->protocol) {
++ case UAC_VERSION_1:
++ default:
++ /* bNrChannels, wChannelConfig, iChannelNames, bControlSize */
++ len += 1 + 2 + 1 + 1;
++ if (d->bLength < len) /* bControlSize */
++ return false;
++ m = hdr[len];
++ len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */
++ break;
++ case UAC_VERSION_2:
++ /* bNrChannels, bmChannelConfig, iChannelNames */
++ len += 1 + 4 + 1;
++ if (v->type == UAC2_PROCESSING_UNIT_V2)
++ len += 2; /* bmControls -- 2 bytes for PU */
++ else
++ len += 1; /* bmControls -- 1 byte for EU */
++ len += 1; /* iProcessing */
++ break;
++ case UAC_VERSION_3:
++ /* wProcessingDescrStr, bmControls */
++ len += 2 + 4;
++ break;
++ }
++ if (d->bLength < len)
++ return false;
++
++ switch (v->protocol) {
++ case UAC_VERSION_1:
++ default:
++ if (v->type == UAC1_EXTENSION_UNIT)
++ return true; /* OK */
++ switch (d->wProcessType) {
++ case UAC_PROCESS_UP_DOWNMIX:
++ case UAC_PROCESS_DOLBY_PROLOGIC:
++ if (d->bLength < len + 1) /* bNrModes */
++ return false;
++ m = hdr[len];
++ len += 1 + m * 2; /* bNrModes, waModes(n) */
++ break;
++ default:
++ break;
++ }
++ break;
++ case UAC_VERSION_2:
++ if (v->type == UAC2_EXTENSION_UNIT_V2)
++ return true; /* OK */
++ switch (d->wProcessType) {
++ case UAC2_PROCESS_UP_DOWNMIX:
++ case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */
++ if (d->bLength < len + 1) /* bNrModes */
++ return false;
++ m = hdr[len];
++ len += 1 + m * 4; /* bNrModes, daModes(n) */
++ break;
++ default:
++ break;
++ }
++ break;
++ case UAC_VERSION_3:
++ if (v->type == UAC3_EXTENSION_UNIT) {
++ len += 2; /* wClusterDescrID */
++ break;
++ }
++ switch (d->wProcessType) {
++ case UAC3_PROCESS_UP_DOWNMIX:
++ if (d->bLength < len + 1) /* bNrModes */
++ return false;
++ m = hdr[len];
++ len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */
++ break;
++ case UAC3_PROCESS_MULTI_FUNCTION:
++ len += 2 + 4; /* wClusterDescrID, bmAlgorighms */
++ break;
++ default:
++ break;
++ }
++ break;
++ }
++ if (d->bLength < len)
++ return false;
++
++ return true;
++}
++
++/* both for selector and clock selector units; covering all UACs */
++static bool validate_selector_unit(const void *p,
++ const struct usb_desc_validator *v)
++{
++ const struct uac_selector_unit_descriptor *d = p;
++ size_t len;
++
++ if (d->bLength < sizeof(*d))
++ return false;
++ len = sizeof(*d) + d->bNrInPins;
++ switch (v->protocol) {
++ case UAC_VERSION_1:
++ default:
++ len += 1; /* iSelector */
++ break;
++ case UAC_VERSION_2:
++ len += 1 + 1; /* bmControls, iSelector */
++ break;
++ case UAC_VERSION_3:
++ len += 4 + 2; /* bmControls, wSelectorDescrStr */
++ break;
++ }
++ return d->bLength >= len;
++}
++
++static bool validate_uac1_feature_unit(const void *p,
++ const struct usb_desc_validator *v)
++{
++ const struct uac_feature_unit_descriptor *d = p;
++
++ if (d->bLength < sizeof(*d) || !d->bControlSize)
++ return false;
++ /* at least bmaControls(0) for master channel + iFeature */
++ return d->bLength >= sizeof(*d) + d->bControlSize + 1;
++}
++
++static bool validate_uac2_feature_unit(const void *p,
++ const struct usb_desc_validator *v)
++{
++ const struct uac2_feature_unit_descriptor *d = p;
++
++ if (d->bLength < sizeof(*d))
++ return false;
++ /* at least bmaControls(0) for master channel + iFeature */
++ return d->bLength >= sizeof(*d) + 4 + 1;
++}
++
++static bool validate_uac3_feature_unit(const void *p,
++ const struct usb_desc_validator *v)
++{
++ const struct uac3_feature_unit_descriptor *d = p;
++
++ if (d->bLength < sizeof(*d))
++ return false;
++ /* at least bmaControls(0) for master channel + wFeatureDescrStr */
++ return d->bLength >= sizeof(*d) + 4 + 2;
++}
++
++static bool validate_midi_out_jack(const void *p,
++ const struct usb_desc_validator *v)
++{
++ const struct usb_midi_out_jack_descriptor *d = p;
++
++ return d->bLength >= sizeof(*d) &&
++ d->bLength >= sizeof(*d) + d->bNrInputPins * 2;
++}
++
++#define FIXED(p, t, s) { .protocol = (p), .type = (t), .size = sizeof(s) }
++#define FUNC(p, t, f) { .protocol = (p), .type = (t), .func = (f) }
++
++static struct usb_desc_validator audio_validators[] = {
++ /* UAC1 */
++ FUNC(UAC_VERSION_1, UAC_HEADER, validate_uac1_header),
++ FIXED(UAC_VERSION_1, UAC_INPUT_TERMINAL,
++ struct uac_input_terminal_descriptor),
++ FIXED(UAC_VERSION_1, UAC_OUTPUT_TERMINAL,
++ struct uac1_output_terminal_descriptor),
++ FUNC(UAC_VERSION_1, UAC_MIXER_UNIT, validate_mixer_unit),
++ FUNC(UAC_VERSION_1, UAC_SELECTOR_UNIT, validate_selector_unit),
++ FUNC(UAC_VERSION_1, UAC_FEATURE_UNIT, validate_uac1_feature_unit),
++ FUNC(UAC_VERSION_1, UAC1_PROCESSING_UNIT, validate_processing_unit),
++ FUNC(UAC_VERSION_1, UAC1_EXTENSION_UNIT, validate_processing_unit),
++
++ /* UAC2 */
++ FIXED(UAC_VERSION_2, UAC_HEADER, struct uac2_ac_header_descriptor),
++ FIXED(UAC_VERSION_2, UAC_INPUT_TERMINAL,
++ struct uac2_input_terminal_descriptor),
++ FIXED(UAC_VERSION_2, UAC_OUTPUT_TERMINAL,
++ struct uac2_output_terminal_descriptor),
++ FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
++ FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
++ FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
++ /* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
++ FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
++ FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
++ FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
++ struct uac_clock_source_descriptor),
++ FUNC(UAC_VERSION_2, UAC2_CLOCK_SELECTOR, validate_selector_unit),
++ FIXED(UAC_VERSION_2, UAC2_CLOCK_MULTIPLIER,
++ struct uac_clock_multiplier_descriptor),
++ /* UAC_VERSION_2, UAC2_SAMPLE_RATE_CONVERTER: not implemented yet */
++
++ /* UAC3 */
++ FIXED(UAC_VERSION_2, UAC_HEADER, struct uac3_ac_header_descriptor),
++ FIXED(UAC_VERSION_3, UAC_INPUT_TERMINAL,
++ struct uac3_input_terminal_descriptor),
++ FIXED(UAC_VERSION_3, UAC_OUTPUT_TERMINAL,
++ struct uac3_output_terminal_descriptor),
++ /* UAC_VERSION_3, UAC3_EXTENDED_TERMINAL: not implemented yet */
++ FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
++ FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
++ FUNC(UAC_VERSION_3, UAC_FEATURE_UNIT, validate_uac3_feature_unit),
++ /* UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
++ FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
++ FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
++ FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
++ struct uac3_clock_source_descriptor),
++ FUNC(UAC_VERSION_3, UAC3_CLOCK_SELECTOR, validate_selector_unit),
++ FIXED(UAC_VERSION_3, UAC3_CLOCK_MULTIPLIER,
++ struct uac3_clock_multiplier_descriptor),
++ /* UAC_VERSION_3, UAC3_SAMPLE_RATE_CONVERTER: not implemented yet */
++ /* UAC_VERSION_3, UAC3_CONNECTORS: not implemented yet */
++ { } /* terminator */
++};
++
++static struct usb_desc_validator midi_validators[] = {
++ FIXED(UAC_VERSION_ALL, USB_MS_HEADER,
++ struct usb_ms_header_descriptor),
++ FIXED(UAC_VERSION_ALL, USB_MS_MIDI_IN_JACK,
++ struct usb_midi_in_jack_descriptor),
++ FUNC(UAC_VERSION_ALL, USB_MS_MIDI_OUT_JACK,
++ validate_midi_out_jack),
++ { } /* terminator */
++};
++
++
++/* Validate the given unit descriptor, return true if it's OK */
++static bool validate_desc(unsigned char *hdr, int protocol,
++ const struct usb_desc_validator *v)
++{
++ if (hdr[1] != USB_DT_CS_INTERFACE)
++ return true; /* don't care */
++
++ for (; v->type; v++) {
++ if (v->type == hdr[2] &&
++ (v->protocol == UAC_VERSION_ALL ||
++ v->protocol == protocol)) {
++ if (v->func)
++ return v->func(hdr, v);
++ /* check for the fixed size */
++ return hdr[0] >= v->size;
++ }
++ }
++
++ return true; /* not matching, skip validation */
++}
++
++bool snd_usb_validate_audio_desc(void *p, int protocol)
++{
++ return validate_desc(p, protocol, audio_validators);
++}
++
++bool snd_usb_validate_midi_desc(void *p)
++{
++ return validate_desc(p, UAC_VERSION_1, midi_validators);
++}
++
+diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
+index 240eda014b37..f8bc8656a544 100644
+--- a/tools/gpio/Makefile
++++ b/tools/gpio/Makefile
+@@ -3,7 +3,11 @@ include ../scripts/Makefile.include
+
+ bindir ?= /usr/bin
+
+-ifeq ($(srctree),)
++# This will work when gpio is built in tools env. where srctree
++# isn't set and when invoked from selftests build, where srctree
++# is set to ".". building_out_of_srctree is undefined for in srctree
++# builds
++ifndef building_out_of_srctree
+ srctree := $(patsubst %/,%,$(dir $(CURDIR)))
+ srctree := $(patsubst %/,%,$(dir $(srctree)))
+ endif
+diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
+index e1e94b44d588..918260b65c60 100644
+--- a/tools/perf/util/hist.c
++++ b/tools/perf/util/hist.c
+@@ -1508,7 +1508,7 @@ int hists__collapse_resort(struct hists *hists, struct ui_progress *prog)
+ return 0;
+ }
+
+-static int hist_entry__sort(struct hist_entry *a, struct hist_entry *b)
++static int64_t hist_entry__sort(struct hist_entry *a, struct hist_entry *b)
+ {
+ struct hists *hists = a->hists;
+ struct perf_hpp_fmt *fmt;
+diff --git a/tools/usb/usbip/libsrc/usbip_device_driver.c b/tools/usb/usbip/libsrc/usbip_device_driver.c
+index ec3a0b794f15..67ae6c1557b8 100644
+--- a/tools/usb/usbip/libsrc/usbip_device_driver.c
++++ b/tools/usb/usbip/libsrc/usbip_device_driver.c
+@@ -81,7 +81,7 @@ int read_usb_vudc_device(struct udev_device *sdev, struct usbip_usb_device *dev)
+ FILE *fd = NULL;
+ struct udev_device *plat;
+ const char *speed;
+- int ret = 0;
++ size_t ret;
+
+ plat = udev_device_get_parent(sdev);
+ path = udev_device_get_syspath(plat);
+@@ -91,8 +91,10 @@ int read_usb_vudc_device(struct udev_device *sdev, struct usbip_usb_device *dev)
+ if (!fd)
+ return -1;
+ ret = fread((char *) &descr, sizeof(descr), 1, fd);
+- if (ret < 0)
++ if (ret != 1) {
++ err("Cannot read vudc device descr file: %s", strerror(errno));
+ goto err;
++ }
+ fclose(fd);
+
+ copy_descr_attr(dev, &descr, bDeviceClass);
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 4a584a575221..7a0d86d52230 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -51,6 +51,7 @@
+ #include <linux/slab.h>
+ #include <linux/sort.h>
+ #include <linux/bsearch.h>
++#include <linux/kthread.h>
+
+ #include <asm/processor.h>
+ #include <asm/io.h>
+@@ -92,7 +93,7 @@ EXPORT_SYMBOL_GPL(halt_poll_ns_shrink);
+ * kvm->lock --> kvm->slots_lock --> kvm->irq_lock
+ */
+
+-DEFINE_SPINLOCK(kvm_lock);
++DEFINE_MUTEX(kvm_lock);
+ static DEFINE_RAW_SPINLOCK(kvm_count_lock);
+ LIST_HEAD(vm_list);
+
+@@ -616,13 +617,31 @@ static int kvm_create_vm_debugfs(struct kvm *kvm, int fd)
+
+ stat_data->kvm = kvm;
+ stat_data->offset = p->offset;
++ stat_data->mode = p->mode ? p->mode : 0644;
+ kvm->debugfs_stat_data[p - debugfs_entries] = stat_data;
+- debugfs_create_file(p->name, 0644, kvm->debugfs_dentry,
++ debugfs_create_file(p->name, stat_data->mode, kvm->debugfs_dentry,
+ stat_data, stat_fops_per_vm[p->kind]);
+ }
+ return 0;
+ }
+
++/*
++ * Called after the VM is otherwise initialized, but just before adding it to
++ * the vm_list.
++ */
++int __weak kvm_arch_post_init_vm(struct kvm *kvm)
++{
++ return 0;
++}
++
++/*
++ * Called just after removing the VM from the vm_list, but before doing any
++ * other destruction.
++ */
++void __weak kvm_arch_pre_destroy_vm(struct kvm *kvm)
++{
++}
++
+ static struct kvm *kvm_create_vm(unsigned long type)
+ {
+ int r, i;
+@@ -677,22 +696,31 @@ static struct kvm *kvm_create_vm(unsigned long type)
+ rcu_assign_pointer(kvm->buses[i],
+ kzalloc(sizeof(struct kvm_io_bus), GFP_KERNEL));
+ if (!kvm->buses[i])
+- goto out_err;
++ goto out_err_no_mmu_notifier;
+ }
+
+ r = kvm_init_mmu_notifier(kvm);
++ if (r)
++ goto out_err_no_mmu_notifier;
++
++ r = kvm_arch_post_init_vm(kvm);
+ if (r)
+ goto out_err;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_add(&kvm->vm_list, &vm_list);
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ preempt_notifier_inc();
+
+ return kvm;
+
+ out_err:
++#if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
++ if (kvm->mmu_notifier.ops)
++ mmu_notifier_unregister(&kvm->mmu_notifier, current->mm);
++#endif
++out_err_no_mmu_notifier:
+ cleanup_srcu_struct(&kvm->irq_srcu);
+ out_err_no_irq_srcu:
+ cleanup_srcu_struct(&kvm->srcu);
+@@ -732,9 +760,11 @@ static void kvm_destroy_vm(struct kvm *kvm)
+ kvm_uevent_notify_change(KVM_EVENT_DESTROY_VM, kvm);
+ kvm_destroy_vm_debugfs(kvm);
+ kvm_arch_sync_events(kvm);
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_del(&kvm->vm_list);
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
++ kvm_arch_pre_destroy_vm(kvm);
++
+ kvm_free_irq_routing(kvm);
+ for (i = 0; i < KVM_NR_BUSES; i++) {
+ struct kvm_io_bus *bus = kvm_get_bus(kvm, i);
+@@ -3714,7 +3744,9 @@ static int kvm_debugfs_open(struct inode *inode, struct file *file,
+ if (!refcount_inc_not_zero(&stat_data->kvm->users_count))
+ return -ENOENT;
+
+- if (simple_attr_open(inode, file, get, set, fmt)) {
++ if (simple_attr_open(inode, file, get,
++ stat_data->mode & S_IWUGO ? set : NULL,
++ fmt)) {
+ kvm_put_kvm(stat_data->kvm);
+ return -ENOMEM;
+ }
+@@ -3828,13 +3860,13 @@ static int vm_stat_get(void *_offset, u64 *val)
+ u64 tmp_val;
+
+ *val = 0;
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ stat_tmp.kvm = kvm;
+ vm_stat_get_per_vm((void *)&stat_tmp, &tmp_val);
+ *val += tmp_val;
+ }
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+ return 0;
+ }
+
+@@ -3847,12 +3879,12 @@ static int vm_stat_clear(void *_offset, u64 val)
+ if (val)
+ return -EINVAL;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ stat_tmp.kvm = kvm;
+ vm_stat_clear_per_vm((void *)&stat_tmp, 0);
+ }
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ return 0;
+ }
+@@ -3867,13 +3899,13 @@ static int vcpu_stat_get(void *_offset, u64 *val)
+ u64 tmp_val;
+
+ *val = 0;
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ stat_tmp.kvm = kvm;
+ vcpu_stat_get_per_vm((void *)&stat_tmp, &tmp_val);
+ *val += tmp_val;
+ }
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+ return 0;
+ }
+
+@@ -3886,12 +3918,12 @@ static int vcpu_stat_clear(void *_offset, u64 val)
+ if (val)
+ return -EINVAL;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ stat_tmp.kvm = kvm;
+ vcpu_stat_clear_per_vm((void *)&stat_tmp, 0);
+ }
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ return 0;
+ }
+@@ -3912,7 +3944,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm)
+ if (!kvm_dev.this_device || !kvm)
+ return;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ if (type == KVM_EVENT_CREATE_VM) {
+ kvm_createvm_count++;
+ kvm_active_vms++;
+@@ -3921,7 +3953,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm)
+ }
+ created = kvm_createvm_count;
+ active = kvm_active_vms;
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ env = kzalloc(sizeof(*env), GFP_KERNEL);
+ if (!env)
+@@ -3962,7 +3994,8 @@ static void kvm_init_debug(void)
+
+ kvm_debugfs_num_entries = 0;
+ for (p = debugfs_entries; p->name; ++p, kvm_debugfs_num_entries++) {
+- debugfs_create_file(p->name, 0644, kvm_debugfs_dir,
++ int mode = p->mode ? p->mode : 0644;
++ debugfs_create_file(p->name, mode, kvm_debugfs_dir,
+ (void *)(long)p->offset,
+ stat_fops[p->kind]);
+ }
+@@ -4138,3 +4171,86 @@ void kvm_exit(void)
+ kvm_vfio_ops_exit();
+ }
+ EXPORT_SYMBOL_GPL(kvm_exit);
++
++struct kvm_vm_worker_thread_context {
++ struct kvm *kvm;
++ struct task_struct *parent;
++ struct completion init_done;
++ kvm_vm_thread_fn_t thread_fn;
++ uintptr_t data;
++ int err;
++};
++
++static int kvm_vm_worker_thread(void *context)
++{
++ /*
++ * The init_context is allocated on the stack of the parent thread, so
++ * we have to locally copy anything that is needed beyond initialization
++ */
++ struct kvm_vm_worker_thread_context *init_context = context;
++ struct kvm *kvm = init_context->kvm;
++ kvm_vm_thread_fn_t thread_fn = init_context->thread_fn;
++ uintptr_t data = init_context->data;
++ int err;
++
++ err = kthread_park(current);
++ /* kthread_park(current) is never supposed to return an error */
++ WARN_ON(err != 0);
++ if (err)
++ goto init_complete;
++
++ err = cgroup_attach_task_all(init_context->parent, current);
++ if (err) {
++ kvm_err("%s: cgroup_attach_task_all failed with err %d\n",
++ __func__, err);
++ goto init_complete;
++ }
++
++ set_user_nice(current, task_nice(init_context->parent));
++
++init_complete:
++ init_context->err = err;
++ complete(&init_context->init_done);
++ init_context = NULL;
++
++ if (err)
++ return err;
++
++ /* Wait to be woken up by the spawner before proceeding. */
++ kthread_parkme();
++
++ if (!kthread_should_stop())
++ err = thread_fn(kvm, data);
++
++ return err;
++}
++
++int kvm_vm_create_worker_thread(struct kvm *kvm, kvm_vm_thread_fn_t thread_fn,
++ uintptr_t data, const char *name,
++ struct task_struct **thread_ptr)
++{
++ struct kvm_vm_worker_thread_context init_context = {};
++ struct task_struct *thread;
++
++ *thread_ptr = NULL;
++ init_context.kvm = kvm;
++ init_context.parent = current;
++ init_context.thread_fn = thread_fn;
++ init_context.data = data;
++ init_completion(&init_context.init_done);
++
++ thread = kthread_run(kvm_vm_worker_thread, &init_context,
++ "%s-%d", name, task_pid_nr(current));
++ if (IS_ERR(thread))
++ return PTR_ERR(thread);
++
++ /* kthread_run is never supposed to return NULL */
++ WARN_ON(thread == NULL);
++
++ wait_for_completion(&init_context.init_done);
++
++ if (!init_context.err)
++ *thread_ptr = thread;
++
++ return init_context.err;
++}
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-11-20 19:36 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-11-20 19:36 UTC (permalink / raw
To: gentoo-commits
commit: be4317599ac3994425dde3590fe479ebf3386e51
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 20 19:35:45 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Nov 20 19:35:45 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=be431759
Linux patch 4.19.85
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1084_linux-4.19.85.patch | 16272 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 16276 insertions(+)
diff --git a/0000_README b/0000_README
index 3d259d6..ebd08d7 100644
--- a/0000_README
+++ b/0000_README
@@ -375,6 +375,10 @@ Patch: 1083_linux-4.19.84.patch
From: https://www.kernel.org
Desc: Linux 4.19.84
+Patch: 1084_linux-4.19.85.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.85
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1084_linux-4.19.85.patch b/1084_linux-4.19.85.patch
new file mode 100644
index 0000000..9949947
--- /dev/null
+++ b/1084_linux-4.19.85.patch
@@ -0,0 +1,16272 @@
+diff --git a/Documentation/devicetree/bindings/media/i2c/adv748x.txt b/Documentation/devicetree/bindings/media/i2c/adv748x.txt
+index 21ffb5ed8183..54d1d3bc1869 100644
+--- a/Documentation/devicetree/bindings/media/i2c/adv748x.txt
++++ b/Documentation/devicetree/bindings/media/i2c/adv748x.txt
+@@ -73,7 +73,7 @@ Example:
+ };
+ };
+
+- port@10 {
++ port@a {
+ reg = <10>;
+
+ adv7482_txa: endpoint {
+@@ -83,7 +83,7 @@ Example:
+ };
+ };
+
+- port@11 {
++ port@b {
+ reg = <11>;
+
+ adv7482_txb: endpoint {
+diff --git a/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt b/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt
+index 4648948f7c3b..e15589f47787 100644
+--- a/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt
++++ b/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt
+@@ -19,6 +19,9 @@ Optional properties:
+ - interrupt-names: must be "mdio_done_error" when there is a share interrupt fed
+ to this hardware block, or must be "mdio_done" for the first interrupt and
+ "mdio_error" for the second when there are separate interrupts
++- clocks: A reference to the clock supplying the MDIO bus controller
++- clock-frequency: the MDIO bus clock that must be output by the MDIO bus
++ hardware, if absent, the default hardware values are used
+
+ Child nodes of this MDIO bus controller node are standard Ethernet PHY device
+ nodes as described in Documentation/devicetree/bindings/net/phy.txt
+diff --git a/Makefile b/Makefile
+index 1ca0b8f37951..d6f7c5a323c0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 84
++SUBLEVEL = 85
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h
+index 07437816e098..b36c0289a308 100644
+--- a/arch/arm/boot/compressed/libfdt_env.h
++++ b/arch/arm/boot/compressed/libfdt_env.h
+@@ -6,6 +6,8 @@
+ #include <linux/string.h>
+ #include <asm/byteorder.h>
+
++#define INT_MAX ((int)(~0U>>1))
++
+ typedef __be16 fdt16_t;
+ typedef __be32 fdt32_t;
+ typedef __be64 fdt64_t;
+diff --git a/arch/arm/boot/dts/am335x-boneblack-common.dtsi b/arch/arm/boot/dts/am335x-boneblack-common.dtsi
+index 325daae40278..21bc1173fa6b 100644
+--- a/arch/arm/boot/dts/am335x-boneblack-common.dtsi
++++ b/arch/arm/boot/dts/am335x-boneblack-common.dtsi
+@@ -88,7 +88,7 @@
+ };
+
+ &i2c0 {
+- tda19988: tda19988 {
++ tda19988: tda19988@70 {
+ compatible = "nxp,tda998x";
+ reg = <0x70>;
+
+diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
+index 20bbb899b3b7..cc59e42c9134 100644
+--- a/arch/arm/boot/dts/am335x-evm.dts
++++ b/arch/arm/boot/dts/am335x-evm.dts
+@@ -731,6 +731,7 @@
+ pinctrl-0 = <&cpsw_default>;
+ pinctrl-1 = <&cpsw_sleep>;
+ status = "okay";
++ slaves = <1>;
+ };
+
+ &davinci_mdio {
+@@ -738,15 +739,14 @@
+ pinctrl-0 = <&davinci_mdio_default>;
+ pinctrl-1 = <&davinci_mdio_sleep>;
+ status = "okay";
+-};
+
+-&cpsw_emac0 {
+- phy_id = <&davinci_mdio>, <0>;
+- phy-mode = "rgmii-txid";
++ ethphy0: ethernet-phy@0 {
++ reg = <0>;
++ };
+ };
+
+-&cpsw_emac1 {
+- phy_id = <&davinci_mdio>, <1>;
++&cpsw_emac0 {
++ phy-handle = <ðphy0>;
+ phy-mode = "rgmii-txid";
+ };
+
+diff --git a/arch/arm/boot/dts/am335x-osd3358-sm-red.dts b/arch/arm/boot/dts/am335x-osd3358-sm-red.dts
+index 4d969013f99a..d9e92671055b 100644
+--- a/arch/arm/boot/dts/am335x-osd3358-sm-red.dts
++++ b/arch/arm/boot/dts/am335x-osd3358-sm-red.dts
+@@ -161,7 +161,7 @@
+ invensense,key = [4e cc 7e eb f6 1e 35 22 00 34 0d 65 32 e9 94 89];*/
+ };
+
+- bmp280: pressure@78 {
++ bmp280: pressure@76 {
+ compatible = "bosch,bmp280";
+ reg = <0x76>;
+ };
+diff --git a/arch/arm/boot/dts/am335x-pdu001.dts b/arch/arm/boot/dts/am335x-pdu001.dts
+index 1ad530a39a95..34fb63ef420f 100644
+--- a/arch/arm/boot/dts/am335x-pdu001.dts
++++ b/arch/arm/boot/dts/am335x-pdu001.dts
+@@ -373,7 +373,7 @@
+ ti,pindir-d0-out-d1-in;
+ status = "okay";
+
+- cfaf240320a032t {
++ display-controller@0 {
+ compatible = "orisetech,otm3225a";
+ reg = <0>;
+ spi-max-frequency = <1000000>;
+diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
+index cf1e4f747242..09e58fb810d9 100644
+--- a/arch/arm/boot/dts/am4372.dtsi
++++ b/arch/arm/boot/dts/am4372.dtsi
+@@ -1101,7 +1101,7 @@
+ };
+ };
+
+- qspi: qspi@47900000 {
++ qspi: spi@47900000 {
+ compatible = "ti,am4372-qspi";
+ reg = <0x47900000 0x100>,
+ <0x30000000 0x4000000>;
+diff --git a/arch/arm/boot/dts/am57xx-cl-som-am57x.dts b/arch/arm/boot/dts/am57xx-cl-som-am57x.dts
+index 203266f88480..52ae8eef60fc 100644
+--- a/arch/arm/boot/dts/am57xx-cl-som-am57x.dts
++++ b/arch/arm/boot/dts/am57xx-cl-som-am57x.dts
+@@ -518,7 +518,7 @@
+ };
+
+ /* touch controller */
+- ads7846@0 {
++ touchscreen@1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&ads7846_pins>;
+
+diff --git a/arch/arm/boot/dts/arm-realview-eb.dtsi b/arch/arm/boot/dts/arm-realview-eb.dtsi
+index a917cf8825ca..0e4c7c4c8c09 100644
+--- a/arch/arm/boot/dts/arm-realview-eb.dtsi
++++ b/arch/arm/boot/dts/arm-realview-eb.dtsi
+@@ -371,7 +371,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp: ssp@1000d000 {
++ ssp: spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ clocks = <&sspclk>, <&pclk>;
+diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts
+index f935b72d3d96..f2a1d25eb6cf 100644
+--- a/arch/arm/boot/dts/arm-realview-pb1176.dts
++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts
+@@ -380,7 +380,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- pb1176_ssp: ssp@1010b000 {
++ pb1176_ssp: spi@1010b000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1010b000 0x1000>;
+ interrupt-parent = <&intc_dc1176>;
+diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+index 36203288de42..7f9cbdf33a51 100644
+--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts
++++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+@@ -523,7 +523,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp@1000d000 {
++ spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ interrupt-parent = <&intc_pb11mp>;
+diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+index 10868ba3277f..a5676697ff3b 100644
+--- a/arch/arm/boot/dts/arm-realview-pbx.dtsi
++++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+@@ -362,7 +362,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp: ssp@1000d000 {
++ ssp: spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ clocks = <&sspclk>, <&pclk>;
+diff --git a/arch/arm/boot/dts/armada-388-clearfog.dtsi b/arch/arm/boot/dts/armada-388-clearfog.dtsi
+index 7c6ad2afb094..1b0d0680c8b6 100644
+--- a/arch/arm/boot/dts/armada-388-clearfog.dtsi
++++ b/arch/arm/boot/dts/armada-388-clearfog.dtsi
+@@ -48,7 +48,7 @@
+ &clearfog_sdhci_cd_pins>;
+ pinctrl-names = "default";
+ status = "okay";
+- vmmc = <®_3p3v>;
++ vmmc-supply = <®_3p3v>;
+ wp-inverted;
+ };
+
+diff --git a/arch/arm/boot/dts/aspeed-g4.dtsi b/arch/arm/boot/dts/aspeed-g4.dtsi
+index b23a983f95a5..69f6b9d2e7e7 100644
+--- a/arch/arm/boot/dts/aspeed-g4.dtsi
++++ b/arch/arm/boot/dts/aspeed-g4.dtsi
+@@ -350,7 +350,7 @@
+ status = "disabled";
+ };
+
+- i2c: i2c@1e78a000 {
++ i2c: bus@1e78a000 {
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+diff --git a/arch/arm/boot/dts/aspeed-g5.dtsi b/arch/arm/boot/dts/aspeed-g5.dtsi
+index 87fdc146ff52..d107459fc0f8 100644
+--- a/arch/arm/boot/dts/aspeed-g5.dtsi
++++ b/arch/arm/boot/dts/aspeed-g5.dtsi
+@@ -410,7 +410,7 @@
+ status = "disabled";
+ };
+
+- i2c: i2c@1e78a000 {
++ i2c: bus@1e78a000 {
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+diff --git a/arch/arm/boot/dts/at91-dvk_su60_somc.dtsi b/arch/arm/boot/dts/at91-dvk_su60_somc.dtsi
+index bb86f17ed5ed..21876da7c442 100644
+--- a/arch/arm/boot/dts/at91-dvk_su60_somc.dtsi
++++ b/arch/arm/boot/dts/at91-dvk_su60_somc.dtsi
+@@ -70,9 +70,9 @@
+ &i2c1 {
+ status = "okay";
+
+- eeprom@87 {
++ eeprom@57 {
+ compatible = "giantec,gt24c32a", "atmel,24c32";
+- reg = <87>;
++ reg = <0x57>;
+ pagesize = <32>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/at91-dvk_su60_somc_lcm.dtsi b/arch/arm/boot/dts/at91-dvk_su60_somc_lcm.dtsi
+index 4b9176dc5d02..df0f0cc575c1 100644
+--- a/arch/arm/boot/dts/at91-dvk_su60_somc_lcm.dtsi
++++ b/arch/arm/boot/dts/at91-dvk_su60_somc_lcm.dtsi
+@@ -59,9 +59,9 @@
+ &i2c1 {
+ status = "okay";
+
+- ft5426@56 {
++ ft5426@38 {
+ compatible = "focaltech,ft5426", "edt,edt-ft5406";
+- reg = <56>;
++ reg = <0x38>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_lcd_ctp_int>;
+
+diff --git a/arch/arm/boot/dts/at91-vinco.dts b/arch/arm/boot/dts/at91-vinco.dts
+index 1be9889a2b3a..430277291e02 100644
+--- a/arch/arm/boot/dts/at91-vinco.dts
++++ b/arch/arm/boot/dts/at91-vinco.dts
+@@ -128,7 +128,7 @@
+ i2c2: i2c@f8024000 {
+ status = "okay";
+
+- rtc1: rtc@64 {
++ rtc1: rtc@32 {
+ compatible = "epson,rx8900";
+ reg = <0x32>;
+ };
+diff --git a/arch/arm/boot/dts/at91sam9260ek.dts b/arch/arm/boot/dts/at91sam9260ek.dts
+index d2b865f60293..07d1b571e601 100644
+--- a/arch/arm/boot/dts/at91sam9260ek.dts
++++ b/arch/arm/boot/dts/at91sam9260ek.dts
+@@ -127,7 +127,7 @@
+
+ spi0: spi@fffc8000 {
+ cs-gpios = <0>, <&pioC 11 0>, <0>, <0>;
+- mtd_dataflash@0 {
++ mtd_dataflash@1 {
+ compatible = "atmel,at45", "atmel,dataflash";
+ spi-max-frequency = <50000000>;
+ reg = <1>;
+diff --git a/arch/arm/boot/dts/at91sam9261ek.dts b/arch/arm/boot/dts/at91sam9261ek.dts
+index a29fc0494076..a57f2d435dca 100644
+--- a/arch/arm/boot/dts/at91sam9261ek.dts
++++ b/arch/arm/boot/dts/at91sam9261ek.dts
+@@ -160,7 +160,7 @@
+ spi-max-frequency = <15000000>;
+ };
+
+- tsc2046@0 {
++ tsc2046@2 {
+ reg = <2>;
+ compatible = "ti,ads7843";
+ interrupts-extended = <&pioC 2 IRQ_TYPE_EDGE_BOTH>;
+diff --git a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+index 71df3adfc7ca..ec1f17ab6753 100644
+--- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
++++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+@@ -109,7 +109,7 @@
+
+ spi0: spi@fffc8000 {
+ cs-gpios = <0>, <&pioC 11 0>, <0>, <0>;
+- mtd_dataflash@0 {
++ mtd_dataflash@1 {
+ compatible = "atmel,at45", "atmel,dataflash";
+ spi-max-frequency = <50000000>;
+ reg = <1>;
+diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
+index 1ee25a475be8..d16db1fa7e15 100644
+--- a/arch/arm/boot/dts/at91sam9g45.dtsi
++++ b/arch/arm/boot/dts/at91sam9g45.dtsi
+@@ -570,7 +570,7 @@
+ };
+ };
+
+- uart1 {
++ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+ <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_NONE
+diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
+index 3084a7c95733..e4d49731287f 100644
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -216,7 +216,7 @@
+ reg = <0x33000 0x14>;
+ };
+
+- qspi: qspi@27200 {
++ qspi: spi@27200 {
+ compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
+index 09ba85046322..2b219addeb44 100644
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -273,7 +273,7 @@
+ brcm,nand-has-wp;
+ };
+
+- qspi: qspi@27200 {
++ qspi: spi@27200 {
+ compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+diff --git a/arch/arm/boot/dts/dove-cubox.dts b/arch/arm/boot/dts/dove-cubox.dts
+index 580e3cbcfbf7..3e1584e787ae 100644
+--- a/arch/arm/boot/dts/dove-cubox.dts
++++ b/arch/arm/boot/dts/dove-cubox.dts
+@@ -87,7 +87,7 @@
+ status = "okay";
+ clock-frequency = <100000>;
+
+- si5351: clock-generator {
++ si5351: clock-generator@60 {
+ compatible = "silabs,si5351a-msop";
+ reg = <0x60>;
+ #address-cells = <1>;
+diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi
+index 4a0a5115b298..250ad0535e8c 100644
+--- a/arch/arm/boot/dts/dove.dtsi
++++ b/arch/arm/boot/dts/dove.dtsi
+@@ -155,7 +155,7 @@
+ 0xffffe000 MBUS_ID(0x03, 0x01) 0 0x0000800 /* CESA SRAM 2k */
+ 0xfffff000 MBUS_ID(0x0d, 0x00) 0 0x0000800>; /* PMU SRAM 2k */
+
+- spi0: spi-ctrl@10600 {
++ spi0: spi@10600 {
+ compatible = "marvell,orion-spi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -168,7 +168,7 @@
+ status = "disabled";
+ };
+
+- i2c: i2c-ctrl@11000 {
++ i2c: i2c@11000 {
+ compatible = "marvell,mv64xxx-i2c";
+ reg = <0x11000 0x20>;
+ #address-cells = <1>;
+@@ -218,7 +218,7 @@
+ status = "disabled";
+ };
+
+- spi1: spi-ctrl@14600 {
++ spi1: spi@14600 {
+ compatible = "marvell,orion-spi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 2cb45ddd2ae3..9136b3cf9a2c 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -1369,7 +1369,7 @@
+ status = "disabled";
+ };
+
+- qspi: qspi@4b300000 {
++ qspi: spi@4b300000 {
+ compatible = "ti,dra7xxx-qspi";
+ reg = <0x4b300000 0x100>,
+ <0x5c000000 0x4000000>;
+diff --git a/arch/arm/boot/dts/exynos3250-artik5.dtsi b/arch/arm/boot/dts/exynos3250-artik5.dtsi
+index 620b50c19ead..7c22cbf6f3d4 100644
+--- a/arch/arm/boot/dts/exynos3250-artik5.dtsi
++++ b/arch/arm/boot/dts/exynos3250-artik5.dtsi
+@@ -69,6 +69,8 @@
+ compatible = "samsung,s2mps14-pmic";
+ interrupt-parent = <&gpx3>;
+ interrupts = <5 IRQ_TYPE_NONE>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&s2mps14_irq>;
+ reg = <0x66>;
+
+ s2mps14_osc: clocks {
+@@ -350,6 +352,11 @@
+ samsung,pin-drv = <EXYNOS4_PIN_DRV_LV3>;
+ samsung,pin-val = <1>;
+ };
++
++ s2mps14_irq: s2mps14-irq {
++ samsung,pins = "gpx3-5";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
+ };
+
+ &rtc {
+diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts
+index 7a8a5c55701a..4ab1f1c66c27 100644
+--- a/arch/arm/boot/dts/exynos5250-arndale.dts
++++ b/arch/arm/boot/dts/exynos5250-arndale.dts
+@@ -149,9 +149,11 @@
+ };
+
+ &hdmi {
++ pinctrl-names = "default";
++ pinctrl-0 = <&hdmi_hpd>;
+ status = "okay";
+- ddc = <&i2c_2>;
+- hpd-gpios = <&gpx3 7 GPIO_ACTIVE_LOW>;
++ ddc = <&i2c_ddc>;
++ hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>;
+ vdd_osc-supply = <&ldo10_reg>;
+ vdd_pll-supply = <&ldo8_reg>;
+ vdd-supply = <&ldo8_reg>;
+@@ -168,6 +170,8 @@
+ reg = <0x66>;
+ interrupt-parent = <&gpx3>;
+ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&s5m8767_irq>;
+
+ vinb1-supply = <&main_dc_reg>;
+ vinb2-supply = <&main_dc_reg>;
+@@ -452,13 +456,6 @@
+ };
+ };
+
+-&i2c_2 {
+- status = "okay";
+- /* used by HDMI DDC */
+- samsung,i2c-sda-delay = <100>;
+- samsung,i2c-max-bus-freq = <66000>;
+-};
+-
+ &i2c_3 {
+ status = "okay";
+
+@@ -535,6 +532,13 @@
+ cap-sd-highspeed;
+ };
+
++&pinctrl_0 {
++ s5m8767_irq: s5m8767-irq {
++ samsung,pins = "gpx3-2";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
++};
++
+ &rtc {
+ status = "okay";
+ };
+@@ -547,3 +551,22 @@
+ status = "okay";
+ samsung,exynos-sataphy-i2c-phandle = <&sata_phy_i2c>;
+ };
++
++&soc {
++ /*
++ * For unknown reasons HDMI-DDC does not work with Exynos I2C
++ * controllers. Lets use software I2C over GPIO pins as a workaround.
++ */
++ i2c_ddc: i2c-gpio {
++ pinctrl-names = "default";
++ pinctrl-0 = <&i2c2_gpio_bus>;
++ status = "okay";
++ compatible = "i2c-gpio";
++ gpios = <&gpa0 6 0 /* sda */
++ &gpa0 7 0 /* scl */
++ >;
++ i2c-gpio,delay-us = <2>;
++ #address-cells = <1>;
++ #size-cells = <0>;
++ };
++};
+diff --git a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
+index 6ff6dea29d44..d31a68672bfa 100644
+--- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
++++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
+@@ -225,6 +225,12 @@
+ samsung,pin-drv = <EXYNOS4_PIN_DRV_LV1>;
+ };
+
++ i2c2_gpio_bus: i2c2-gpio-bus {
++ samsung,pins = "gpa0-6", "gpa0-7";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ samsung,pin-drv = <EXYNOS4_PIN_DRV_LV1>;
++ };
++
+ uart2_data: uart2-data {
+ samsung,pins = "gpa1-0", "gpa1-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+@@ -593,6 +599,11 @@
+ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
+ samsung,pin-drv = <EXYNOS4_PIN_DRV_LV1>;
+ };
++
++ hdmi_hpd: hdmi-hpd {
++ samsung,pins = "gpx3-7";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
+ };
+
+ &pinctrl_1 {
+diff --git a/arch/arm/boot/dts/exynos5250-snow-rev5.dts b/arch/arm/boot/dts/exynos5250-snow-rev5.dts
+index 0348b1c49a69..7cbfc6f1f4b8 100644
+--- a/arch/arm/boot/dts/exynos5250-snow-rev5.dts
++++ b/arch/arm/boot/dts/exynos5250-snow-rev5.dts
+@@ -20,6 +20,14 @@
+
+ samsung,model = "Snow-I2S-MAX98090";
+ samsung,audio-codec = <&max98090>;
++
++ cpu {
++ sound-dai = <&i2s0 0>;
++ };
++
++ codec {
++ sound-dai = <&max98090 0>, <&hdmi>;
++ };
+ };
+ };
+
+@@ -31,6 +39,9 @@
+ interrupt-parent = <&gpx0>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max98090_irq>;
++ clocks = <&pmu_system_controller 0>;
++ clock-names = "mclk";
++ #sound-dai-cells = <1>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+index 25bdc9d97a4d..9eb48cabcca4 100644
+--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
++++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+@@ -153,7 +153,7 @@
+
+ &clock_audss {
+ assigned-clocks = <&clock_audss EXYNOS_MOUT_AUDSS>;
+- assigned-clock-parents = <&clock CLK_FOUT_EPLL>;
++ assigned-clock-parents = <&clock CLK_MAU_EPLL>;
+ };
+
+ &cpu0 {
+@@ -312,6 +312,7 @@
+ regulator-name = "vdd_1v35";
+ regulator-min-microvolt = <1350000>;
+ regulator-max-microvolt = <1350000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -333,6 +334,7 @@
+ regulator-name = "vdd_2v";
+ regulator-min-microvolt = <2000000>;
+ regulator-max-microvolt = <2000000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -343,6 +345,7 @@
+ regulator-name = "vdd_1v8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+index 7989631b39cc..4398f2d1fe88 100644
+--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts
++++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+@@ -153,7 +153,7 @@
+
+ &clock_audss {
+ assigned-clocks = <&clock_audss EXYNOS_MOUT_AUDSS>;
+- assigned-clock-parents = <&clock CLK_FOUT_EPLL>;
++ assigned-clock-parents = <&clock CLK_MAU_EPLL>;
+ };
+
+ &cpu0 {
+@@ -312,6 +312,7 @@
+ regulator-name = "vdd_1v35";
+ regulator-min-microvolt = <1350000>;
+ regulator-max-microvolt = <1350000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -333,6 +334,7 @@
+ regulator-name = "vdd_2v";
+ regulator-min-microvolt = <2000000>;
+ regulator-max-microvolt = <2000000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -343,6 +345,7 @@
+ regulator-name = "vdd_1v8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+diff --git a/arch/arm/boot/dts/imx51-zii-rdu1.dts b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+index 6e80254c4562..3fb66ddfe93a 100644
+--- a/arch/arm/boot/dts/imx51-zii-rdu1.dts
++++ b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+@@ -514,7 +514,7 @@
+ };
+
+ ds1341: rtc@68 {
+- compatible = "maxim,ds1341";
++ compatible = "dallas,ds1341";
+ reg = <0x68>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ull.dtsi b/arch/arm/boot/dts/imx6ull.dtsi
+index cd1776a7015a..796ed35d4ac9 100644
+--- a/arch/arm/boot/dts/imx6ull.dtsi
++++ b/arch/arm/boot/dts/imx6ull.dtsi
+@@ -22,7 +22,7 @@
+ >;
+ fsl,soc-operating-points = <
+ /* KHz uV */
+- 900000 1175000
++ 900000 1250000
+ 792000 1175000
+ 528000 1175000
+ 396000 1175000
+diff --git a/arch/arm/boot/dts/keystone-k2g.dtsi b/arch/arm/boot/dts/keystone-k2g.dtsi
+index 738b44cf2b0b..1c833105d6c5 100644
+--- a/arch/arm/boot/dts/keystone-k2g.dtsi
++++ b/arch/arm/boot/dts/keystone-k2g.dtsi
+@@ -416,7 +416,7 @@
+ clock-names = "fck", "mmchsdb_fck";
+ };
+
+- qspi: qspi@2940000 {
++ qspi: spi@2940000 {
+ compatible = "ti,k2g-qspi", "cdns,qspi-nor";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 4981741377f3..ed0d6fb20122 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -179,7 +179,7 @@
+ * ssp0 and spi1 are shared pins;
+ * enable one in your board dts, as needed.
+ */
+- ssp0: ssp@20084000 {
++ ssp0: spi@20084000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x20084000 0x1000>;
+ interrupts = <20 IRQ_TYPE_LEVEL_HIGH>;
+@@ -199,7 +199,7 @@
+ * ssp1 and spi2 are shared pins;
+ * enable one in your board dts, as needed.
+ */
+- ssp1: ssp@2008c000 {
++ ssp1: spi@2008c000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x2008c000 0x1000>;
+ interrupts = <21 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi
+index d77dcf890cfc..7162e0ca05b0 100644
+--- a/arch/arm/boot/dts/meson8.dtsi
++++ b/arch/arm/boot/dts/meson8.dtsi
+@@ -194,7 +194,7 @@
+ #clock-cells = <1>;
+ #reset-cells = <1>;
+ compatible = "amlogic,meson8-clkc";
+- reg = <0x8000 0x4>, <0x4000 0x460>;
++ reg = <0x8000 0x4>, <0x4000 0x400>;
+ };
+
+ reset: reset-controller@4404 {
+diff --git a/arch/arm/boot/dts/meson8b.dtsi b/arch/arm/boot/dts/meson8b.dtsi
+index 5b3e5c50c72f..4293047a4b76 100644
+--- a/arch/arm/boot/dts/meson8b.dtsi
++++ b/arch/arm/boot/dts/meson8b.dtsi
+@@ -163,7 +163,7 @@
+ #clock-cells = <1>;
+ #reset-cells = <1>;
+ compatible = "amlogic,meson8b-clkc";
+- reg = <0x8000 0x4>, <0x4000 0x460>;
++ reg = <0x8000 0x4>, <0x4000 0x400>;
+ };
+
+ reset: reset-controller@4404 {
+diff --git a/arch/arm/boot/dts/omap2.dtsi b/arch/arm/boot/dts/omap2.dtsi
+index f1d6de8b3c19..000bf16de651 100644
+--- a/arch/arm/boot/dts/omap2.dtsi
++++ b/arch/arm/boot/dts/omap2.dtsi
+@@ -114,7 +114,7 @@
+ dma-names = "tx", "rx";
+ };
+
+- mcspi1: mcspi@48098000 {
++ mcspi1: spi@48098000 {
+ compatible = "ti,omap2-mcspi";
+ ti,hwmods = "mcspi1";
+ reg = <0x48098000 0x100>;
+@@ -125,7 +125,7 @@
+ "tx2", "rx2", "tx3", "rx3";
+ };
+
+- mcspi2: mcspi@4809a000 {
++ mcspi2: spi@4809a000 {
+ compatible = "ti,omap2-mcspi";
+ ti,hwmods = "mcspi2";
+ reg = <0x4809a000 0x100>;
+diff --git a/arch/arm/boot/dts/omap2430.dtsi b/arch/arm/boot/dts/omap2430.dtsi
+index 84635eeb99cd..7f57af2f10ac 100644
+--- a/arch/arm/boot/dts/omap2430.dtsi
++++ b/arch/arm/boot/dts/omap2430.dtsi
+@@ -285,7 +285,7 @@
+ ti,timer-alwon;
+ };
+
+- mcspi3: mcspi@480b8000 {
++ mcspi3: spi@480b8000 {
+ compatible = "ti,omap2-mcspi";
+ ti,hwmods = "mcspi3";
+ reg = <0x480b8000 0x100>;
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index ac830b917776..0c39a2340030 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -28,6 +28,7 @@
+
+ aliases {
+ display0 = &lcd;
++ display1 = &tv0;
+ };
+
+ /* fixed 26MHz oscillator */
+@@ -78,7 +79,7 @@
+ #sound-dai-cells = <0>;
+ };
+
+- spi_lcd {
++ spi_lcd: spi_lcd {
+ compatible = "spi-gpio";
+ #address-cells = <0x1>;
+ #size-cells = <0x0>;
+@@ -131,7 +132,7 @@
+ };
+
+ tv0: connector {
+- compatible = "svideo-connector";
++ compatible = "composite-video-connector";
+ label = "tv";
+
+ port {
+@@ -143,7 +144,7 @@
+
+ tv_amp: opa362 {
+ compatible = "ti,opa362";
+- enable-gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>;
++ enable-gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>; /* GPIO_23 to enable video out amplifier */
+
+ ports {
+ #address-cells = <1>;
+@@ -282,6 +283,13 @@
+ OMAP3_CORE1_IOPAD(0x2134, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio112 */
+ >;
+ };
++
++ penirq_pins: pinmux_penirq_pins {
++ pinctrl-single,pins = <
++ /* here we could enable to wakeup the cpu from suspend by a pen touch */
++ OMAP3_CORE1_IOPAD(0x2194, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio160 */
++ >;
++ };
+ };
+
+ &omap3_pmx_core2 {
+@@ -422,10 +430,19 @@
+ tsc2007@48 {
+ compatible = "ti,tsc2007";
+ reg = <0x48>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&penirq_pins>;
+ interrupt-parent = <&gpio6>;
+ interrupts = <0 IRQ_TYPE_EDGE_FALLING>; /* GPIO_160 */
+- gpios = <&gpio6 0 GPIO_ACTIVE_LOW>;
++ gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* GPIO_160 */
+ ti,x-plate-ohms = <600>;
++ touchscreen-size-x = <480>;
++ touchscreen-size-y = <640>;
++ touchscreen-max-pressure = <1000>;
++ touchscreen-fuzz-x = <3>;
++ touchscreen-fuzz-y = <8>;
++ touchscreen-fuzz-pressure = <10>;
++ touchscreen-inverted-y;
+ };
+
+ /* RFID EEPROM */
+@@ -531,6 +548,12 @@
+ regulator-max-microvolt = <3150000>;
+ };
+
++/* Needed to power the DPI pins */
++
++&vpll2 {
++ regulator-always-on;
++};
++
+ &dss {
+ pinctrl-names = "default";
+ pinctrl-0 = < &dss_dpi_pins >;
+@@ -551,10 +574,14 @@
+
+ vdda-supply = <&vdac>;
+
++ #address-cells = <1>;
++ #size-cells = <0>;
++
+ port {
++ reg = <0>;
+ venc_out: endpoint {
+ remote-endpoint = <&opa_in>;
+- ti,channels = <2>;
++ ti,channels = <1>;
+ ti,invert-polarity;
+ };
+ };
+@@ -598,22 +625,22 @@
+
+ bootloaders@80000 {
+ label = "U-Boot";
+- reg = <0x80000 0x1e0000>;
++ reg = <0x80000 0x1c0000>;
+ };
+
+- bootloaders_env@260000 {
++ bootloaders_env@240000 {
+ label = "U-Boot Env";
+- reg = <0x260000 0x20000>;
++ reg = <0x240000 0x40000>;
+ };
+
+ kernel@280000 {
+ label = "Kernel";
+- reg = <0x280000 0x400000>;
++ reg = <0x280000 0x600000>;
+ };
+
+- filesystem@680000 {
++ filesystem@880000 {
+ label = "File System";
+- reg = <0x680000 0xf980000>;
++ reg = <0x880000 0>; /* 0 = MTDPART_SIZ_FULL */
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/omap3-n9.dts b/arch/arm/boot/dts/omap3-n9.dts
+index ded5fcf084eb..1f91646b8951 100644
+--- a/arch/arm/boot/dts/omap3-n9.dts
++++ b/arch/arm/boot/dts/omap3-n9.dts
+@@ -40,7 +40,7 @@
+ };
+
+ &i2c3 {
+- ak8975@0f {
++ ak8975@f {
+ compatible = "asahi-kasei,ak8975";
+ reg = <0x0f>;
+ };
+diff --git a/arch/arm/boot/dts/orion5x-linkstation.dtsi b/arch/arm/boot/dts/orion5x-linkstation.dtsi
+index ebd93df5d07a..b6c9b85951ea 100644
+--- a/arch/arm/boot/dts/orion5x-linkstation.dtsi
++++ b/arch/arm/boot/dts/orion5x-linkstation.dtsi
+@@ -156,7 +156,7 @@
+ &i2c {
+ status = "okay";
+
+- rtc {
++ rtc@32 {
+ compatible = "ricoh,rs5c372a";
+ reg = <0x32>;
+ };
+diff --git a/arch/arm/boot/dts/pxa25x.dtsi b/arch/arm/boot/dts/pxa25x.dtsi
+index 95d59be97213..8494b5787170 100644
+--- a/arch/arm/boot/dts/pxa25x.dtsi
++++ b/arch/arm/boot/dts/pxa25x.dtsi
+@@ -80,6 +80,10 @@
+ #pwm-cells = <1>;
+ clocks = <&clks CLK_PWM1>;
+ };
++
++ rtc@40900000 {
++ clocks = <&clks CLK_OSC32k768>;
++ };
+ };
+
+ timer@40a00000 {
+diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi
+index 747f750f675d..3228ad5fb725 100644
+--- a/arch/arm/boot/dts/pxa27x.dtsi
++++ b/arch/arm/boot/dts/pxa27x.dtsi
+@@ -71,7 +71,7 @@
+ clocks = <&clks CLK_PWM1>;
+ };
+
+- pwri2c: i2c@40f000180 {
++ pwri2c: i2c@40f00180 {
+ compatible = "mrvl,pxa-i2c";
+ reg = <0x40f00180 0x24>;
+ interrupts = <6>;
+@@ -113,6 +113,10 @@
+
+ status = "disabled";
+ };
++
++ rtc@40900000 {
++ clocks = <&clks CLK_OSC32k768>;
++ };
+ };
+
+ clocks {
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 54d056b01bb5..8328ad589e2b 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -313,7 +313,7 @@
+
+ saw0: regulator@b089000 {
+ compatible = "qcom,saw2";
+- reg = <0x02089000 0x1000>, <0x0b009000 0x1000>;
++ reg = <0x0b089000 0x1000>, <0x0b009000 0x1000>;
+ regulator;
+ };
+
+diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi
+index 6b997bc016ee..03919714645a 100644
+--- a/arch/arm/boot/dts/r8a7779.dtsi
++++ b/arch/arm/boot/dts/r8a7779.dtsi
+@@ -344,7 +344,7 @@
+
+ sata: sata@fc600000 {
+ compatible = "renesas,sata-r8a7779", "renesas,rcar-sata";
+- reg = <0xfc600000 0x2000>;
++ reg = <0xfc600000 0x200000>;
+ interrupts = <GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&mstp1_clks R8A7779_CLK_SATA>;
+ power-domains = <&sysc R8A7779_PD_ALWAYS_ON>;
+diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi
+index 0925bdca438f..52a757f47bf0 100644
+--- a/arch/arm/boot/dts/r8a7790.dtsi
++++ b/arch/arm/boot/dts/r8a7790.dtsi
+@@ -1559,7 +1559,7 @@
+ sata0: sata@ee300000 {
+ compatible = "renesas,sata-r8a7790",
+ "renesas,rcar-gen2-sata";
+- reg = <0 0xee300000 0 0x2000>;
++ reg = <0 0xee300000 0 0x200000>;
+ interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cpg CPG_MOD 815>;
+ power-domains = <&sysc R8A7790_PD_ALWAYS_ON>;
+@@ -1570,7 +1570,7 @@
+ sata1: sata@ee500000 {
+ compatible = "renesas,sata-r8a7790",
+ "renesas,rcar-gen2-sata";
+- reg = <0 0xee500000 0 0x2000>;
++ reg = <0 0xee500000 0 0x200000>;
+ interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cpg CPG_MOD 814>;
+ power-domains = <&sysc R8A7790_PD_ALWAYS_ON>;
+diff --git a/arch/arm/boot/dts/r8a7791.dtsi b/arch/arm/boot/dts/r8a7791.dtsi
+index 991ac6feedd5..25b6a99dd87a 100644
+--- a/arch/arm/boot/dts/r8a7791.dtsi
++++ b/arch/arm/boot/dts/r8a7791.dtsi
+@@ -1543,7 +1543,7 @@
+ sata0: sata@ee300000 {
+ compatible = "renesas,sata-r8a7791",
+ "renesas,rcar-gen2-sata";
+- reg = <0 0xee300000 0 0x2000>;
++ reg = <0 0xee300000 0 0x200000>;
+ interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cpg CPG_MOD 815>;
+ power-domains = <&sysc R8A7791_PD_ALWAYS_ON>;
+@@ -1554,7 +1554,7 @@
+ sata1: sata@ee500000 {
+ compatible = "renesas,sata-r8a7791",
+ "renesas,rcar-gen2-sata";
+- reg = <0 0xee500000 0 0x2000>;
++ reg = <0 0xee500000 0 0x200000>;
+ interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cpg CPG_MOD 814>;
+ power-domains = <&sysc R8A7791_PD_ALWAYS_ON>;
+diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi
+index 67f57200d9a0..d560fc4051c5 100644
+--- a/arch/arm/boot/dts/rk3036.dtsi
++++ b/arch/arm/boot/dts/rk3036.dtsi
+@@ -733,7 +733,7 @@
+ /* no rts / cts for uart2 */
+ };
+
+- spi {
++ spi-pins {
+ spi_txd:spi-txd {
+ rockchip,pins = <1 29 RK_FUNC_3 &pcfg_pull_default>;
+ };
+diff --git a/arch/arm/boot/dts/rk3188-radxarock.dts b/arch/arm/boot/dts/rk3188-radxarock.dts
+index 45fd2b302dda..4a2890618f6f 100644
+--- a/arch/arm/boot/dts/rk3188-radxarock.dts
++++ b/arch/arm/boot/dts/rk3188-radxarock.dts
+@@ -93,6 +93,8 @@
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+ gpio = <&gpio3 RK_PA1 GPIO_ACTIVE_LOW>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&sdmmc_pwr>;
+ startup-delay-us = <100000>;
+ vin-supply = <&vcc_io>;
+ };
+@@ -315,6 +317,12 @@
+ };
+ };
+
++ sd0 {
++ sdmmc_pwr: sdmmc-pwr {
++ rockchip,pins = <RK_GPIO3 1 RK_FUNC_GPIO &pcfg_pull_none>;
++ };
++ };
++
+ usb {
+ host_vbus_drv: host-vbus-drv {
+ rockchip,pins = <0 3 RK_FUNC_GPIO &pcfg_pull_none>;
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
+index b280e6494193..31b01a998b2e 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
+@@ -88,7 +88,7 @@
+ status = "okay";
+ clock-frequency = <100000>;
+
+- adxl345: adxl345@0 {
++ adxl345: adxl345@53 {
+ compatible = "adi,adxl345";
+ reg = <0x53>;
+
+diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+index 2310a4e97768..986767735e24 100644
+--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+@@ -197,7 +197,7 @@
+ <0xa0410100 0x100>;
+ };
+
+- scu@a04100000 {
++ scu@a0410000 {
+ compatible = "arm,cortex-a9-scu";
+ reg = <0xa0410000 0x100>;
+ };
+@@ -878,7 +878,7 @@
+ power-domains = <&pm_domains DOMAIN_VAPE>;
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x80002000 0x1000>;
+ interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+@@ -892,7 +892,7 @@
+ power-domains = <&pm_domains DOMAIN_VAPE>;
+ };
+
+- ssp@80003000 {
++ spi@80003000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x80003000 0x1000>;
+ interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
+index 5c5cea232743..1ec193b0c506 100644
+--- a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
++++ b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
+@@ -607,16 +607,20 @@
+
+ mcde {
+ lcd_default_mode: lcd_default {
+- default_mux {
++ default_mux1 {
+ /* Mux in VSI0 and all the data lines */
+ function = "lcd";
+ groups =
+ "lcdvsi0_a_1", /* VSI0 for LCD */
+ "lcd_d0_d7_a_1", /* Data lines */
+ "lcd_d8_d11_a_1", /* TV-out */
+- "lcdaclk_b_1", /* Clock line for TV-out */
+ "lcdvsi1_a_1"; /* VSI1 for HDMI */
+ };
++ default_mux2 {
++ function = "lcda";
++ groups =
++ "lcdaclk_b_1"; /* Clock line for TV-out */
++ };
+ default_cfg1 {
+ pins =
+ "GPIO68_E1", /* VSI0 */
+diff --git a/arch/arm/boot/dts/ste-hrefprev60.dtsi b/arch/arm/boot/dts/ste-hrefprev60.dtsi
+index 3f14b4df69b4..94eeb7f1c947 100644
+--- a/arch/arm/boot/dts/ste-hrefprev60.dtsi
++++ b/arch/arm/boot/dts/ste-hrefprev60.dtsi
+@@ -57,7 +57,7 @@
+ };
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ /*
+ * On the first generation boards, this SSP/SPI port was connected
+ * to the AB8500.
+diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
+index b0b94d053098..603890461ae0 100644
+--- a/arch/arm/boot/dts/ste-snowball.dts
++++ b/arch/arm/boot/dts/ste-snowball.dts
+@@ -376,7 +376,7 @@
+ pinctrl-1 = <&i2c3_sleep_mode>;
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&ssp0_snowball_mode>;
+ };
+diff --git a/arch/arm/boot/dts/ste-u300.dts b/arch/arm/boot/dts/ste-u300.dts
+index 62ecb6a2fa39..1bd1aba3322f 100644
+--- a/arch/arm/boot/dts/ste-u300.dts
++++ b/arch/arm/boot/dts/ste-u300.dts
+@@ -442,7 +442,7 @@
+ dma-names = "rx";
+ };
+
+- spi: ssp@c0006000 {
++ spi: spi@c0006000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0xc0006000 0x1000>;
+ interrupt-parent = <&vica>;
+diff --git a/arch/arm/boot/dts/stm32mp157c-ev1.dts b/arch/arm/boot/dts/stm32mp157c-ev1.dts
+index 372bc2ea6b92..063ee8ac5dcb 100644
+--- a/arch/arm/boot/dts/stm32mp157c-ev1.dts
++++ b/arch/arm/boot/dts/stm32mp157c-ev1.dts
+@@ -6,6 +6,7 @@
+ /dts-v1/;
+
+ #include "stm32mp157c-ed1.dts"
++#include <dt-bindings/gpio/gpio.h>
+
+ / {
+ model = "STMicroelectronics STM32MP157C eval daughter on eval mother";
+@@ -19,6 +20,58 @@
+ serial0 = &uart4;
+ ethernet0 = ðernet0;
+ };
++
++ panel_backlight: panel-backlight {
++ compatible = "gpio-backlight";
++ gpios = <&gpiod 13 GPIO_ACTIVE_LOW>;
++ default-on;
++ status = "okay";
++ };
++};
++
++&cec {
++ pinctrl-names = "default";
++ pinctrl-0 = <&cec_pins_a>;
++ status = "okay";
++};
++
++&dsi {
++ #address-cells = <1>;
++ #size-cells = <0>;
++ status = "okay";
++
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++ dsi_in: endpoint {
++ remote-endpoint = <<dc_ep0_out>;
++ };
++ };
++
++ port@1 {
++ reg = <1>;
++ dsi_out: endpoint {
++ remote-endpoint = <&dsi_panel_in>;
++ };
++ };
++ };
++
++ panel-dsi@0 {
++ compatible = "raydium,rm68200";
++ reg = <0>;
++ reset-gpios = <&gpiof 15 GPIO_ACTIVE_LOW>;
++ backlight = <&panel_backlight>;
++ status = "okay";
++
++ port {
++ dsi_panel_in: endpoint {
++ remote-endpoint = <&dsi_out>;
++ };
++ };
++ };
+ };
+
+ ðernet0 {
+@@ -40,12 +93,6 @@
+ };
+ };
+
+-&cec {
+- pinctrl-names = "default";
+- pinctrl-0 = <&cec_pins_a>;
+- status = "okay";
+-};
+-
+ &i2c2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&i2c2_pins_a>;
+@@ -62,6 +109,20 @@
+ status = "okay";
+ };
+
++<dc {
++ status = "okay";
++
++ port {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ ltdc_ep0_out: endpoint@0 {
++ reg = <0>;
++ remote-endpoint = <&dsi_in>;
++ };
++ };
++};
++
+ &m_can1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&m_can1_pins_a>;
+diff --git a/arch/arm/boot/dts/stm32mp157c.dtsi b/arch/arm/boot/dts/stm32mp157c.dtsi
+index 185541a5b69f..c50c36baba75 100644
+--- a/arch/arm/boot/dts/stm32mp157c.dtsi
++++ b/arch/arm/boot/dts/stm32mp157c.dtsi
+@@ -947,7 +947,7 @@
+ dma-requests = <48>;
+ };
+
+- qspi: qspi@58003000 {
++ qspi: spi@58003000 {
+ compatible = "st,stm32f469-qspi";
+ reg = <0x58003000 0x1000>, <0x70000000 0x10000000>;
+ reg-names = "qspi", "qspi_mm";
+diff --git a/arch/arm/boot/dts/sun5i-reference-design-tablet.dtsi b/arch/arm/boot/dts/sun5i-reference-design-tablet.dtsi
+index 8acbaab14fe5..d2a2eb8b3f26 100644
+--- a/arch/arm/boot/dts/sun5i-reference-design-tablet.dtsi
++++ b/arch/arm/boot/dts/sun5i-reference-design-tablet.dtsi
+@@ -92,7 +92,8 @@
+ */
+ clock-frequency = <400000>;
+
+- touchscreen: touchscreen {
++ touchscreen: touchscreen@40 {
++ reg = <0x40>;
+ interrupt-parent = <&pio>;
+ interrupts = <6 11 IRQ_TYPE_EDGE_FALLING>; /* EINT11 (PG11) */
+ pinctrl-names = "default";
+diff --git a/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi b/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
+index 880096c7e252..5e8a95af89b8 100644
+--- a/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
++++ b/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
+@@ -69,7 +69,8 @@
+ */
+ clock-frequency = <400000>;
+
+- touchscreen: touchscreen@0 {
++ touchscreen: touchscreen@40 {
++ reg = <0x40>;
+ interrupt-parent = <&pio>;
+ interrupts = <1 5 IRQ_TYPE_EDGE_FALLING>; /* PB5 */
+ pinctrl-names = "default";
+diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+index 35859d8f3267..bf97f6244c23 100644
+--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+@@ -95,7 +95,7 @@
+ &i2c0 {
+ status = "okay";
+
+- axp22x: pmic@68 {
++ axp22x: pmic@34 {
+ compatible = "x-powers,axp221";
+ reg = <0x34>;
+ interrupt-parent = <&nmi_intc>;
+diff --git a/arch/arm/boot/dts/sun9i-a80.dtsi b/arch/arm/boot/dts/sun9i-a80.dtsi
+index 25591d6883ef..d9532fb1ef65 100644
+--- a/arch/arm/boot/dts/sun9i-a80.dtsi
++++ b/arch/arm/boot/dts/sun9i-a80.dtsi
+@@ -1196,7 +1196,7 @@
+ };
+ };
+
+- r_rsb: i2c@8003400 {
++ r_rsb: rsb@8003400 {
+ compatible = "allwinner,sun8i-a23-rsb";
+ reg = <0x08003400 0x400>;
+ interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/boot/dts/tegra20-paz00.dts b/arch/arm/boot/dts/tegra20-paz00.dts
+index ef245291924f..4f9b4a889feb 100644
+--- a/arch/arm/boot/dts/tegra20-paz00.dts
++++ b/arch/arm/boot/dts/tegra20-paz00.dts
+@@ -524,10 +524,10 @@
+ gpio-keys {
+ compatible = "gpio-keys";
+
+- power {
+- label = "Power";
++ wakeup {
++ label = "Wakeup";
+ gpios = <&gpio TEGRA_GPIO(J, 7) GPIO_ACTIVE_LOW>;
+- linux,code = <KEY_POWER>;
++ linux,code = <KEY_WAKEUP>;
+ wakeup-source;
+ };
+ };
+diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi
+index 15b73bd377f0..80854f7de765 100644
+--- a/arch/arm/boot/dts/tegra20.dtsi
++++ b/arch/arm/boot/dts/tegra20.dtsi
+@@ -419,19 +419,6 @@
+ status = "disabled";
+ };
+
+- gmi@70009000 {
+- compatible = "nvidia,tegra20-gmi";
+- reg = <0x70009000 0x1000>;
+- #address-cells = <2>;
+- #size-cells = <1>;
+- ranges = <0 0 0xd0000000 0xfffffff>;
+- clocks = <&tegra_car TEGRA20_CLK_NOR>;
+- clock-names = "gmi";
+- resets = <&tegra_car 42>;
+- reset-names = "gmi";
+- status = "disabled";
+- };
+-
+ nand-controller@70008000 {
+ compatible = "nvidia,tegra20-nand";
+ reg = <0x70008000 0x100>;
+@@ -447,6 +434,19 @@
+ status = "disabled";
+ };
+
++ gmi@70009000 {
++ compatible = "nvidia,tegra20-gmi";
++ reg = <0x70009000 0x1000>;
++ #address-cells = <2>;
++ #size-cells = <1>;
++ ranges = <0 0 0xd0000000 0xfffffff>;
++ clocks = <&tegra_car TEGRA20_CLK_NOR>;
++ clock-names = "gmi";
++ resets = <&tegra_car 42>;
++ reset-names = "gmi";
++ status = "disabled";
++ };
++
+ pwm: pwm@7000a000 {
+ compatible = "nvidia,tegra20-pwm";
+ reg = <0x7000a000 0x100>;
+diff --git a/arch/arm/boot/dts/tegra30-apalis.dtsi b/arch/arm/boot/dts/tegra30-apalis.dtsi
+index 2f807d40c1b7..f810bbf8212b 100644
+--- a/arch/arm/boot/dts/tegra30-apalis.dtsi
++++ b/arch/arm/boot/dts/tegra30-apalis.dtsi
+@@ -171,14 +171,14 @@
+
+ /* Apalis MMC1 */
+ sdmmc3_clk_pa6 {
+- nvidia,pins = "sdmmc3_clk_pa6",
+- "sdmmc3_cmd_pa7";
++ nvidia,pins = "sdmmc3_clk_pa6";
+ nvidia,function = "sdmmc3";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ };
+ sdmmc3_dat0_pb7 {
+- nvidia,pins = "sdmmc3_dat0_pb7",
++ nvidia,pins = "sdmmc3_cmd_pa7",
++ "sdmmc3_dat0_pb7",
+ "sdmmc3_dat1_pb6",
+ "sdmmc3_dat2_pb5",
+ "sdmmc3_dat3_pb4",
+@@ -659,7 +659,7 @@
+ reg = <1>;
+ clocks = <&clk16m>;
+ interrupt-parent = <&gpio>;
+- interrupts = <TEGRA_GPIO(W, 3) IRQ_TYPE_EDGE_RISING>;
++ interrupts = <TEGRA_GPIO(W, 3) IRQ_TYPE_EDGE_FALLING>;
+ spi-max-frequency = <10000000>;
+ };
+ };
+@@ -674,7 +674,7 @@
+ reg = <0>;
+ clocks = <&clk16m>;
+ interrupt-parent = <&gpio>;
+- interrupts = <TEGRA_GPIO(W, 2) IRQ_TYPE_EDGE_RISING>;
++ interrupts = <TEGRA_GPIO(W, 2) IRQ_TYPE_EDGE_FALLING>;
+ spi-max-frequency = <10000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts b/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
+index 16e1f387aa6d..a0c550e26738 100644
+--- a/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
++++ b/arch/arm/boot/dts/tegra30-colibri-eval-v3.dts
+@@ -79,7 +79,8 @@
+ reg = <0>;
+ clocks = <&clk16m>;
+ interrupt-parent = <&gpio>;
+- interrupts = <TEGRA_GPIO(S, 0) IRQ_TYPE_EDGE_RISING>;
++ /* CAN_INT */
++ interrupts = <TEGRA_GPIO(S, 0) IRQ_TYPE_EDGE_FALLING>;
+ spi-max-frequency = <10000000>;
+ };
+ spidev0: spi@1 {
+diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
+index a6781f653310..5a04ddefb71f 100644
+--- a/arch/arm/boot/dts/tegra30.dtsi
++++ b/arch/arm/boot/dts/tegra30.dtsi
+@@ -896,7 +896,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <1>;
+ nvidia,xcvr-lsrslew = <1>;
+ nvidia,xcvr-hsslew = <32>;
+@@ -933,7 +933,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+ nvidia,xcvr-hsslew = <32>;
+@@ -969,7 +969,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+ nvidia,xcvr-hsslew = <32>;
+diff --git a/arch/arm/boot/dts/versatile-ab.dts b/arch/arm/boot/dts/versatile-ab.dts
+index 5f61d3609027..6f4f60ba5429 100644
+--- a/arch/arm/boot/dts/versatile-ab.dts
++++ b/arch/arm/boot/dts/versatile-ab.dts
+@@ -373,7 +373,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- ssp@101f4000 {
++ spi@101f4000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x101f4000 0x1000>;
+ interrupts = <11>;
+diff --git a/arch/arm/boot/dts/zynq-zc702.dts b/arch/arm/boot/dts/zynq-zc702.dts
+index cc5a3dc2b4a0..27cd6cb52f1b 100644
+--- a/arch/arm/boot/dts/zynq-zc702.dts
++++ b/arch/arm/boot/dts/zynq-zc702.dts
+@@ -174,17 +174,17 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ reg = <7>;
+- hwmon@52 {
++ hwmon@34 {
+ compatible = "ti,ucd9248";
+- reg = <52>;
++ reg = <0x34>;
+ };
+- hwmon@53 {
++ hwmon@35 {
+ compatible = "ti,ucd9248";
+- reg = <53>;
++ reg = <0x35>;
+ };
+- hwmon@54 {
++ hwmon@36 {
+ compatible = "ti,ucd9248";
+- reg = <54>;
++ reg = <0x36>;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/zynq-zc770-xm010.dts b/arch/arm/boot/dts/zynq-zc770-xm010.dts
+index 0e1bfdd3421f..0dd352289a45 100644
+--- a/arch/arm/boot/dts/zynq-zc770-xm010.dts
++++ b/arch/arm/boot/dts/zynq-zc770-xm010.dts
+@@ -68,7 +68,7 @@
+ status = "okay";
+ num-cs = <4>;
+ is-decoded-cs = <0>;
+- flash@0 {
++ flash@1 {
+ compatible = "sst25wf080", "jedec,spi-nor";
+ reg = <1>;
+ spi-max-frequency = <1000000>;
+diff --git a/arch/arm/boot/dts/zynq-zc770-xm013.dts b/arch/arm/boot/dts/zynq-zc770-xm013.dts
+index 651913f1afa2..4ae2c85df3a0 100644
+--- a/arch/arm/boot/dts/zynq-zc770-xm013.dts
++++ b/arch/arm/boot/dts/zynq-zc770-xm013.dts
+@@ -62,7 +62,7 @@
+ status = "okay";
+ num-cs = <4>;
+ is-decoded-cs = <0>;
+- eeprom: eeprom@0 {
++ eeprom: eeprom@2 {
+ at25,byte-len = <8192>;
+ at25,addr-mode = <2>;
+ at25,page-size = <32>;
+diff --git a/arch/arm/crypto/crc32-ce-glue.c b/arch/arm/crypto/crc32-ce-glue.c
+index 96e62ec105d0..cd9e93b46c2d 100644
+--- a/arch/arm/crypto/crc32-ce-glue.c
++++ b/arch/arm/crypto/crc32-ce-glue.c
+@@ -236,7 +236,7 @@ static void __exit crc32_pmull_mod_exit(void)
+ ARRAY_SIZE(crc32_pmull_algs));
+ }
+
+-static const struct cpu_feature crc32_cpu_feature[] = {
++static const struct cpu_feature __maybe_unused crc32_cpu_feature[] = {
+ { cpu_feature(CRC32) }, { cpu_feature(PMULL) }, { }
+ };
+ MODULE_DEVICE_TABLE(cpu, crc32_cpu_feature);
+diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
+index 0921e2c10edf..e2e4df3d11e5 100644
+--- a/arch/arm/mach-at91/pm.c
++++ b/arch/arm/mach-at91/pm.c
+@@ -143,15 +143,15 @@ static int at91_pm_config_ws(unsigned int pm_mode, bool set)
+
+ /* Check if enabled on SHDWC. */
+ if (wsi->shdwc_mr_bit && !(val & wsi->shdwc_mr_bit))
+- goto put_node;
++ goto put_device;
+
+ mode |= wsi->pmc_fsmr_bit;
+ if (wsi->set_polarity)
+ polarity |= wsi->pmc_fsmr_bit;
+ }
+
+-put_node:
+- of_node_put(np);
++put_device:
++ put_device(&pdev->dev);
+ }
+
+ if (mode) {
+diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
+index b08e407d8d96..529f4b5bbd3a 100644
+--- a/arch/arm/mach-imx/pm-imx6.c
++++ b/arch/arm/mach-imx/pm-imx6.c
+@@ -618,6 +618,28 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata
+ IMX6Q_GPR1_GINT);
+ }
+
++static void imx6_pm_stby_poweroff(void)
++{
++ imx6_set_lpm(STOP_POWER_OFF);
++ imx6q_suspend_finish(0);
++
++ mdelay(1000);
++
++ pr_emerg("Unable to poweroff system\n");
++}
++
++static int imx6_pm_stby_poweroff_probe(void)
++{
++ if (pm_power_off) {
++ pr_warn("%s: pm_power_off already claimed %p %pf!\n",
++ __func__, pm_power_off, pm_power_off);
++ return -EBUSY;
++ }
++
++ pm_power_off = imx6_pm_stby_poweroff;
++ return 0;
++}
++
+ void __init imx6_pm_ccm_init(const char *ccm_compat)
+ {
+ struct device_node *np;
+@@ -634,6 +656,9 @@ void __init imx6_pm_ccm_init(const char *ccm_compat)
+ val = readl_relaxed(ccm_base + CLPCR);
+ val &= ~BM_CLPCR_LPM;
+ writel_relaxed(val, ccm_base + CLPCR);
++
++ if (of_property_read_bool(np, "fsl,pmic-stby-poweroff"))
++ imx6_pm_stby_poweroff_probe();
+ }
+
+ void __init imx6q_pm_init(void)
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts
+index 98dbff19f5cc..5caba225b4f7 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts
+@@ -125,9 +125,9 @@
+
+ ®_dcdc1 {
+ regulator-always-on;
+- regulator-min-microvolt = <3000000>;
+- regulator-max-microvolt = <3000000>;
+- regulator-name = "vcc-3v";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ regulator-name = "vcc-3v3";
+ };
+
+ ®_dcdc2 {
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
+index 3f531393eaee..b3f186434f36 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
+@@ -142,10 +142,14 @@
+
+ /* DCDC3 is polyphased with DCDC2 */
+
++/*
++ * The board uses DDR3L DRAM chips. 1.36V is the closest to the nominal
++ * 1.35V that the PMIC can drive.
++ */
+ ®_dcdc5 {
+ regulator-always-on;
+- regulator-min-microvolt = <1500000>;
+- regulator-max-microvolt = <1500000>;
++ regulator-min-microvolt = <1360000>;
++ regulator-max-microvolt = <1360000>;
+ regulator-name = "vcc-ddr3";
+ };
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+index 1221764f5719..667016815cf3 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+@@ -67,7 +67,9 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc0_pins>;
+ vmmc-supply = <®_dcdc1>;
+- cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>;
++ cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>; /* PF6 */
++ disable-wp;
++ bus-width = <4>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+index 7c661753bfaf..faa017d4cd56 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+@@ -124,6 +124,8 @@
+ &i2c1 {
+ status = "okay";
+ clock-frequency = <100000>;
++ i2c-sda-falling-time-ns = <890>; /* hcnt */
++ i2c-sdl-falling-time-ns = <890>; /* lcnt */
+
+ adc@14 {
+ compatible = "lltc,ltc2497";
+diff --git a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
+index 125f4deb52fe..b664e7af74eb 100644
+--- a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
++++ b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
+@@ -107,7 +107,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- spi0: ssp@e1020000 {
++ spi0: spi@e1020000 {
+ status = "disabled";
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0 0xe1020000 0 0x1000>;
+@@ -117,7 +117,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- spi1: ssp@e1030000 {
++ spi1: spi@e1030000 {
+ status = "disabled";
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0 0xe1030000 0 0x1000>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+index c518130e5ce7..3c34f14fa508 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+@@ -458,7 +458,7 @@
+ };
+
+ ethmac: ethernet@ff3f0000 {
+- compatible = "amlogic,meson-gxbb-dwmac", "snps,dwmac";
++ compatible = "amlogic,meson-axg-dwmac", "snps,dwmac";
+ reg = <0x0 0xff3f0000 0x0 0x10000
+ 0x0 0xff634540 0x0 0x8>;
+ interrupts = <GIC_SPI 8 IRQ_TYPE_EDGE_RISING>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+index 98cbba6809ca..1ade7e486828 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+@@ -390,7 +390,7 @@
+ };
+ };
+
+- spi_pins: spi {
++ spi_pins: spi-pins {
+ mux {
+ groups = "spi_miso",
+ "spi_mosi",
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+index f63bceb88caa..90a56af967a7 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+@@ -13,7 +13,7 @@
+
+ / {
+ compatible = "libretech,cc", "amlogic,s905x", "amlogic,meson-gxl";
+- model = "Libre Technology CC";
++ model = "Libre Computer Board AML-S905X-CC";
+
+ aliases {
+ serial0 = &uart_AO;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+index c87a80e9bcc6..8f0bb3c44bd6 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+@@ -337,7 +337,7 @@
+ };
+ };
+
+- spi_pins: spi {
++ spi_pins: spi-pins {
+ mux {
+ groups = "spi_miso",
+ "spi_mosi",
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+index 1a406a76c86a..ea854f689fda 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -639,7 +639,7 @@
+ status = "disabled";
+ };
+
+- ssp0: ssp@66180000 {
++ ssp0: spi@66180000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x66180000 0x1000>;
+ interrupts = <GIC_SPI 404 IRQ_TYPE_LEVEL_HIGH>;
+@@ -650,7 +650,7 @@
+ status = "disabled";
+ };
+
+- ssp1: ssp@66190000 {
++ ssp1: spi@66190000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x66190000 0x1000>;
+ interrupts = <GIC_SPI 405 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/bcm958742-base.dtsi b/arch/arm64/boot/dts/broadcom/stingray/bcm958742-base.dtsi
+index bc299c3d9068..a9b92e52d50e 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/bcm958742-base.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/bcm958742-base.dtsi
+@@ -138,7 +138,7 @@
+ &i2c1 {
+ status = "okay";
+
+- pcf8574: pcf8574@20 {
++ pcf8574: pcf8574@27 {
+ compatible = "nxp,pcf8574a";
+ gpio-controller;
+ #gpio-cells = <2>;
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+index 84101ea1fd2c..ff714fcbac68 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+@@ -520,7 +520,7 @@
+ status = "disabled";
+ };
+
+- ssp0: ssp@180000 {
++ ssp0: spi@180000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x00180000 0x1000>;
+ interrupts = <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>;
+@@ -532,7 +532,7 @@
+ status = "disabled";
+ };
+
+- ssp1: ssp@190000 {
++ ssp1: spi@190000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x00190000 0x1000>;
+ interrupts = <GIC_SPI 188 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
+index 68ac78c4564d..5da732f82fa0 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
+@@ -337,7 +337,7 @@
+ status = "disabled";
+ };
+
+- dspi: dspi@2100000 {
++ dspi: spi@2100000 {
+ compatible = "fsl,ls1012a-dspi", "fsl,ls1021a-v1.0-dspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
+index 7881e3d81a9a..b9c0f2de8f12 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
+@@ -284,7 +284,7 @@
+ interrupts = <0 43 0x4>;
+ };
+
+- qspi: quadspi@1550000 {
++ qspi: spi@1550000 {
+ compatible = "fsl,ls1043a-qspi", "fsl,ls1021a-qspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -382,7 +382,7 @@
+ ranges = <0x0 0x5 0x00000000 0x8000000>;
+ };
+
+- dspi0: dspi@2100000 {
++ dspi0: spi@2100000 {
+ compatible = "fsl,ls1043a-dspi", "fsl,ls1021a-v1.0-dspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -395,7 +395,7 @@
+ status = "disabled";
+ };
+
+- dspi1: dspi@2110000 {
++ dspi1: spi@2110000 {
+ compatible = "fsl,ls1043a-dspi", "fsl,ls1021a-v1.0-dspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
+index 440e111651d5..a59b48203688 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
+@@ -57,12 +57,12 @@
+ reg = <0x4c>;
+ };
+
+- eeprom@56 {
++ eeprom@52 {
+ compatible = "atmel,24c512";
+ reg = <0x52>;
+ };
+
+- eeprom@57 {
++ eeprom@53 {
+ compatible = "atmel,24c512";
+ reg = <0x53>;
+ };
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
+index ef83786b8b90..de6af453a6e1 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
+@@ -202,7 +202,7 @@
+ interrupts = <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH>;
+ };
+
+- qspi: quadspi@1550000 {
++ qspi: spi@1550000 {
+ compatible = "fsl,ls1021a-qspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -361,7 +361,7 @@
+ #thermal-sensor-cells = <1>;
+ };
+
+- dspi: dspi@2100000 {
++ dspi: spi@2100000 {
+ compatible = "fsl,ls1021a-v1.0-dspi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
+index 8cb78dd99672..ebe0cd4bf2b7 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
+@@ -469,7 +469,7 @@
+ mmu-masters = <&fsl_mc 0x300 0>;
+ };
+
+- dspi: dspi@2100000 {
++ dspi: spi@2100000 {
+ status = "disabled";
+ compatible = "fsl,ls2080a-dspi", "fsl,ls2085a-dspi";
+ #address-cells = <1>;
+@@ -595,7 +595,7 @@
+ 3 0 0x5 0x20000000 0x00010000>;
+ };
+
+- qspi: quadspi@20c0000 {
++ qspi: spi@20c0000 {
+ status = "disabled";
+ compatible = "fsl,ls2080a-qspi", "fsl,ls1021a-qspi";
+ #address-cells = <1>;
+diff --git a/arch/arm64/boot/dts/lg/lg1312.dtsi b/arch/arm64/boot/dts/lg/lg1312.dtsi
+index 860c8fb10795..4bde7b6f2b11 100644
+--- a/arch/arm64/boot/dts/lg/lg1312.dtsi
++++ b/arch/arm64/boot/dts/lg/lg1312.dtsi
+@@ -168,14 +168,14 @@
+ clock-names = "apb_pclk";
+ status="disabled";
+ };
+- spi0: ssp@fe800000 {
++ spi0: spi@fe800000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe800000 0x1000>;
+ interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_bus>;
+ clock-names = "apb_pclk";
+ };
+- spi1: ssp@fe900000 {
++ spi1: spi@fe900000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe900000 0x1000>;
+ interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm64/boot/dts/lg/lg1313.dtsi b/arch/arm64/boot/dts/lg/lg1313.dtsi
+index 1887af654a7d..16ced1ff1ad3 100644
+--- a/arch/arm64/boot/dts/lg/lg1313.dtsi
++++ b/arch/arm64/boot/dts/lg/lg1313.dtsi
+@@ -168,14 +168,14 @@
+ clock-names = "apb_pclk";
+ status="disabled";
+ };
+- spi0: ssp@fe800000 {
++ spi0: spi@fe800000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe800000 0x1000>;
+ interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_bus>;
+ clock-names = "apb_pclk";
+ };
+- spi1: ssp@fe900000 {
++ spi1: spi@fe900000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe900000 0x1000>;
+ interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+index a4dfcd19b9e8..9fc14bb9a0af 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+@@ -118,7 +118,7 @@
+ };
+
+ gen1_i2c: i2c@3160000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x03160000 0x10000>;
+ interrupts = <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -143,7 +143,7 @@
+ };
+
+ cam_i2c: i2c@3180000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x03180000 0x10000>;
+ interrupts = <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -157,7 +157,7 @@
+
+ /* shares pads with dpaux1 */
+ dp_aux_ch1_i2c: i2c@3190000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x03190000 0x10000>;
+ interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -171,7 +171,7 @@
+
+ /* shares pads with dpaux0 */
+ dp_aux_ch0_i2c: i2c@31b0000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x031b0000 0x10000>;
+ interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -184,7 +184,7 @@
+ };
+
+ gen7_i2c: i2c@31c0000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x031c0000 0x10000>;
+ interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -197,7 +197,7 @@
+ };
+
+ gen9_i2c: i2c@31e0000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x031e0000 0x10000>;
+ interrupts = <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -264,7 +264,7 @@
+ };
+
+ gen2_i2c: i2c@c240000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x0c240000 0x10000>;
+ interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+@@ -277,7 +277,7 @@
+ };
+
+ gen8_i2c: i2c@c250000 {
+- compatible = "nvidia,tegra194-i2c", "nvidia,tegra114-i2c";
++ compatible = "nvidia,tegra194-i2c";
+ reg = <0x0c250000 0x10000>;
+ interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+index 7398ae8856dc..ccaa555180dc 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+@@ -282,6 +282,7 @@
+ status = "okay";
+ bus-width = <8>;
+ non-removable;
++ vqmmc-supply = <&vdd_1v8>;
+ };
+
+ clocks {
+diff --git a/arch/arm64/boot/dts/renesas/r8a77965.dtsi b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+index f60f08ba1a6f..f1dfd17413b9 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77965.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77965.dtsi
+@@ -545,7 +545,7 @@
+ };
+
+ hsusb: usb@e6590000 {
+- compatible = "renesas,usbhs-r8a7796",
++ compatible = "renesas,usbhs-r8a77965",
+ "renesas,rcar-gen3-usbhs";
+ reg = <0 0xe6590000 0 0x100>;
+ interrupts = <GIC_SPI 107 IRQ_TYPE_LEVEL_HIGH>;
+@@ -634,6 +634,14 @@
+ resets = <&cpg 219>;
+ #dma-cells = <1>;
+ dma-channels = <16>;
++ iommus = <&ipmmu_ds0 0>, <&ipmmu_ds0 1>,
++ <&ipmmu_ds0 2>, <&ipmmu_ds0 3>,
++ <&ipmmu_ds0 4>, <&ipmmu_ds0 5>,
++ <&ipmmu_ds0 6>, <&ipmmu_ds0 7>,
++ <&ipmmu_ds0 8>, <&ipmmu_ds0 9>,
++ <&ipmmu_ds0 10>, <&ipmmu_ds0 11>,
++ <&ipmmu_ds0 12>, <&ipmmu_ds0 13>,
++ <&ipmmu_ds0 14>, <&ipmmu_ds0 15>;
+ };
+
+ dmac1: dma-controller@e7300000 {
+@@ -668,6 +676,14 @@
+ resets = <&cpg 218>;
+ #dma-cells = <1>;
+ dma-channels = <16>;
++ iommus = <&ipmmu_ds1 0>, <&ipmmu_ds1 1>,
++ <&ipmmu_ds1 2>, <&ipmmu_ds1 3>,
++ <&ipmmu_ds1 4>, <&ipmmu_ds1 5>,
++ <&ipmmu_ds1 6>, <&ipmmu_ds1 7>,
++ <&ipmmu_ds1 8>, <&ipmmu_ds1 9>,
++ <&ipmmu_ds1 10>, <&ipmmu_ds1 11>,
++ <&ipmmu_ds1 12>, <&ipmmu_ds1 13>,
++ <&ipmmu_ds1 14>, <&ipmmu_ds1 15>;
+ };
+
+ dmac2: dma-controller@e7310000 {
+@@ -702,6 +718,14 @@
+ resets = <&cpg 217>;
+ #dma-cells = <1>;
+ dma-channels = <16>;
++ iommus = <&ipmmu_ds1 16>, <&ipmmu_ds1 17>,
++ <&ipmmu_ds1 18>, <&ipmmu_ds1 19>,
++ <&ipmmu_ds1 20>, <&ipmmu_ds1 21>,
++ <&ipmmu_ds1 22>, <&ipmmu_ds1 23>,
++ <&ipmmu_ds1 24>, <&ipmmu_ds1 25>,
++ <&ipmmu_ds1 26>, <&ipmmu_ds1 27>,
++ <&ipmmu_ds1 28>, <&ipmmu_ds1 29>,
++ <&ipmmu_ds1 30>, <&ipmmu_ds1 31>;
+ };
+
+ ipmmu_ds0: mmu@e6740000 {
+@@ -1455,9 +1479,9 @@
+ compatible = "renesas,usb2-phy-r8a77965",
+ "renesas,rcar-gen3-usb2-phy";
+ reg = <0 0xee0a0200 0 0x700>;
+- clocks = <&cpg CPG_MOD 703>;
++ clocks = <&cpg CPG_MOD 702>;
+ power-domains = <&sysc R8A77965_PD_ALWAYS_ON>;
+- resets = <&cpg 703>;
++ resets = <&cpg 702>;
+ #phy-cells = <0>;
+ status = "disabled";
+ };
+diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+index 7d3d866a0063..3b90f816dfef 100644
+--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
++++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+@@ -420,7 +420,10 @@
+
+ video-receiver@70 {
+ compatible = "adi,adv7482";
+- reg = <0x70>;
++ reg = <0x70 0x71 0x72 0x73 0x74 0x75
++ 0x60 0x61 0x62 0x63 0x64 0x65>;
++ reg-names = "main", "dpll", "cp", "hdmi", "edid", "repeater",
++ "infoframe", "cbus", "cec", "sdp", "txa", "txb" ;
+
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
+index 8ce4a79d9360..1e6a71066c16 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
+@@ -131,7 +131,7 @@
+ status = "okay";
+ clock-frequency = <400000>;
+
+- sgtl5000: codec@0a {
++ sgtl5000: codec@a {
+ compatible = "fsl,sgtl5000";
+ reg = <0x0a>;
+ clocks = <&sgtl5000_clk>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+index 36b60791c156..6062cc8250b1 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+@@ -93,6 +93,19 @@
+ vin-supply = <&vcc_1v8>;
+ };
+
++ vcc3v0_sd: vcc3v0-sd {
++ compatible = "regulator-fixed";
++ enable-active-high;
++ gpio = <&gpio0 RK_PA1 GPIO_ACTIVE_HIGH>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&sdmmc0_pwr_h>;
++ regulator-always-on;
++ regulator-max-microvolt = <3000000>;
++ regulator-min-microvolt = <3000000>;
++ regulator-name = "vcc3v0_sd";
++ vin-supply = <&vcc3v3_sys>;
++ };
++
+ vcc3v3_sys: vcc3v3-sys {
+ compatible = "regulator-fixed";
+ regulator-name = "vcc3v3_sys";
+@@ -116,7 +129,7 @@
+ vcc5v0_host: vcc5v0-host-regulator {
+ compatible = "regulator-fixed";
+ enable-active-high;
+- gpio = <&gpio1 RK_PD1 GPIO_ACTIVE_HIGH>;
++ gpio = <&gpio4 RK_PD1 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&vcc5v0_host_en>;
+ regulator-name = "vcc5v0_host";
+@@ -310,7 +323,7 @@
+ regulator-always-on;
+ regulator-boot-on;
+ regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <3000000>;
++ regulator-max-microvolt = <3300000>;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+ regulator-suspend-microvolt = <3000000>;
+@@ -469,6 +482,13 @@
+ };
+ };
+
++ sd {
++ sdmmc0_pwr_h: sdmmc0-pwr-h {
++ rockchip,pins =
++ <RK_GPIO0 RK_PA1 RK_FUNC_GPIO &pcfg_pull_none>;
++ };
++ };
++
+ usb2 {
+ vcc5v0_host_en: vcc5v0-host-en {
+ rockchip,pins =
+@@ -499,6 +519,7 @@
+ };
+
+ &sdmmc {
++ broken-cd;
+ bus-width = <4>;
+ cap-mmc-highspeed;
+ cap-sd-highspeed;
+@@ -507,6 +528,7 @@
+ max-frequency = <150000000>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_cd &sdmmc_bus4>;
++ vmmc-supply = <&vcc3v0_sd>;
+ vqmmc-supply = <&vcc_sdio>;
+ status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+index e23c5762355d..2e3917171b17 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+@@ -8,13 +8,13 @@
+ &cbass_main {
+ gic500: interrupt-controller@1800000 {
+ compatible = "arm,gic-v3";
+- #address-cells = <1>;
+- #size-cells = <1>;
++ #address-cells = <2>;
++ #size-cells = <2>;
+ ranges;
+ #interrupt-cells = <3>;
+ interrupt-controller;
+- reg = <0x01800000 0x10000>, /* GICD */
+- <0x01880000 0x90000>; /* GICR */
++ reg = <0x00 0x01800000 0x00 0x10000>, /* GICD */
++ <0x00 0x01880000 0x00 0x90000>; /* GICR */
+ /*
+ * vcpumntirq:
+ * virtual CPU interface maintenance interrupt
+@@ -23,7 +23,7 @@
+
+ gic_its: gic-its@1820000 {
+ compatible = "arm,gic-v3-its";
+- reg = <0x01820000 0x10000>;
++ reg = <0x00 0x01820000 0x00 0x10000>;
+ msi-controller;
+ #msi-cells = <1>;
+ };
+diff --git a/arch/arm64/boot/dts/ti/k3-am65.dtsi b/arch/arm64/boot/dts/ti/k3-am65.dtsi
+index cede1fa0983c..ded364d20835 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65.dtsi
+@@ -46,38 +46,38 @@
+
+ cbass_main: interconnect@100000 {
+ compatible = "simple-bus";
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges = <0x00100000 0x00 0x00100000 0x00020000>, /* ctrl mmr */
+- <0x00600000 0x00 0x00600000 0x00001100>, /* GPIO */
+- <0x00900000 0x00 0x00900000 0x00012000>, /* serdes */
+- <0x01000000 0x00 0x01000000 0x0af02400>, /* Most peripherals */
+- <0x30800000 0x00 0x30800000 0x0bc00000>, /* MAIN NAVSS */
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x00 0x00100000 0x00 0x00100000 0x00 0x00020000>, /* ctrl mmr */
++ <0x00 0x00600000 0x00 0x00600000 0x00 0x00001100>, /* GPIO */
++ <0x00 0x00900000 0x00 0x00900000 0x00 0x00012000>, /* serdes */
++ <0x00 0x01000000 0x00 0x01000000 0x00 0x0af02400>, /* Most peripherals */
++ <0x00 0x30800000 0x00 0x30800000 0x00 0x0bc00000>, /* MAIN NAVSS */
+ /* MCUSS Range */
+- <0x28380000 0x00 0x28380000 0x03880000>,
+- <0x40200000 0x00 0x40200000 0x00900100>,
+- <0x42040000 0x00 0x42040000 0x03ac2400>,
+- <0x45100000 0x00 0x45100000 0x00c24000>,
+- <0x46000000 0x00 0x46000000 0x00200000>,
+- <0x47000000 0x00 0x47000000 0x00068400>;
++ <0x00 0x28380000 0x00 0x28380000 0x00 0x03880000>,
++ <0x00 0x40200000 0x00 0x40200000 0x00 0x00900100>,
++ <0x00 0x42040000 0x00 0x42040000 0x00 0x03ac2400>,
++ <0x00 0x45100000 0x00 0x45100000 0x00 0x00c24000>,
++ <0x00 0x46000000 0x00 0x46000000 0x00 0x00200000>,
++ <0x00 0x47000000 0x00 0x47000000 0x00 0x00068400>;
+
+ cbass_mcu: interconnect@28380000 {
+ compatible = "simple-bus";
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges = <0x28380000 0x28380000 0x03880000>, /* MCU NAVSS*/
+- <0x40200000 0x40200000 0x00900100>, /* First peripheral window */
+- <0x42040000 0x42040000 0x03ac2400>, /* WKUP */
+- <0x45100000 0x45100000 0x00c24000>, /* MMRs, remaining NAVSS */
+- <0x46000000 0x46000000 0x00200000>, /* CPSW */
+- <0x47000000 0x47000000 0x00068400>; /* OSPI space 1 */
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x00 0x28380000 0x00 0x28380000 0x00 0x03880000>, /* MCU NAVSS*/
++ <0x00 0x40200000 0x00 0x40200000 0x00 0x00900100>, /* First peripheral window */
++ <0x00 0x42040000 0x00 0x42040000 0x00 0x03ac2400>, /* WKUP */
++ <0x00 0x45100000 0x00 0x45100000 0x00 0x00c24000>, /* MMRs, remaining NAVSS */
++ <0x00 0x46000000 0x00 0x46000000 0x00 0x00200000>, /* CPSW */
++ <0x00 0x47000000 0x00 0x47000000 0x00 0x00068400>; /* OSPI space 1 */
+
+ cbass_wakeup: interconnect@42040000 {
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ /* WKUP Basic peripherals */
+- ranges = <0x42040000 0x42040000 0x03ac2400>;
++ ranges = <0x42040000 0x00 0x42040000 0x03ac2400>;
+ };
+ };
+ };
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index a0099be4311a..c8dc3a3640e7 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -611,7 +611,6 @@ asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr)
+ handler[reason], smp_processor_id(), esr,
+ esr_get_class_string(esr));
+
+- die("Oops - bad mode", regs, 0);
+ local_daif_mask();
+ panic("bad mode");
+ }
+diff --git a/arch/mips/bcm47xx/workarounds.c b/arch/mips/bcm47xx/workarounds.c
+index 1a8a07e7a563..46eddbec8d9f 100644
+--- a/arch/mips/bcm47xx/workarounds.c
++++ b/arch/mips/bcm47xx/workarounds.c
+@@ -5,9 +5,8 @@
+ #include <bcm47xx_board.h>
+ #include <bcm47xx.h>
+
+-static void __init bcm47xx_workarounds_netgear_wnr3500l(void)
++static void __init bcm47xx_workarounds_enable_usb_power(int usb_power)
+ {
+- const int usb_power = 12;
+ int err;
+
+ err = gpio_request_one(usb_power, GPIOF_OUT_INIT_HIGH, "usb_power");
+@@ -23,7 +22,10 @@ void __init bcm47xx_workarounds(void)
+
+ switch (board) {
+ case BCM47XX_BOARD_NETGEAR_WNR3500L:
+- bcm47xx_workarounds_netgear_wnr3500l();
++ bcm47xx_workarounds_enable_usb_power(12);
++ break;
++ case BCM47XX_BOARD_NETGEAR_WNDR3400_V3:
++ bcm47xx_workarounds_enable_usb_power(21);
+ break;
+ default:
+ /* No workaround(s) needed */
+diff --git a/arch/mips/bcm63xx/reset.c b/arch/mips/bcm63xx/reset.c
+index a2af38cf28a7..64574e74cb23 100644
+--- a/arch/mips/bcm63xx/reset.c
++++ b/arch/mips/bcm63xx/reset.c
+@@ -120,7 +120,7 @@
+ #define BCM6368_RESET_DSL 0
+ #define BCM6368_RESET_SAR SOFTRESET_6368_SAR_MASK
+ #define BCM6368_RESET_EPHY SOFTRESET_6368_EPHY_MASK
+-#define BCM6368_RESET_ENETSW 0
++#define BCM6368_RESET_ENETSW SOFTRESET_6368_ENETSW_MASK
+ #define BCM6368_RESET_PCM SOFTRESET_6368_PCM_MASK
+ #define BCM6368_RESET_MPI SOFTRESET_6368_MPI_MASK
+ #define BCM6368_RESET_PCIE 0
+diff --git a/arch/mips/include/asm/kexec.h b/arch/mips/include/asm/kexec.h
+index 493a3cc7c39a..cfdbe66575f4 100644
+--- a/arch/mips/include/asm/kexec.h
++++ b/arch/mips/include/asm/kexec.h
+@@ -12,11 +12,11 @@
+ #include <asm/stacktrace.h>
+
+ /* Maximum physical address we can use pages from */
+-#define KEXEC_SOURCE_MEMORY_LIMIT (0x20000000)
++#define KEXEC_SOURCE_MEMORY_LIMIT (-1UL)
+ /* Maximum address we can reach in physical address mode */
+-#define KEXEC_DESTINATION_MEMORY_LIMIT (0x20000000)
++#define KEXEC_DESTINATION_MEMORY_LIMIT (-1UL)
+ /* Maximum address we can use for the control code buffer */
+-#define KEXEC_CONTROL_MEMORY_LIMIT (0x20000000)
++#define KEXEC_CONTROL_MEMORY_LIMIT (-1UL)
+ /* Reserve 3*4096 bytes for board-specific info */
+ #define KEXEC_CONTROL_PAGE_SIZE (4096 + 3*4096)
+
+diff --git a/arch/mips/txx9/generic/setup.c b/arch/mips/txx9/generic/setup.c
+index f6d9182ef82a..70a1ab66d252 100644
+--- a/arch/mips/txx9/generic/setup.c
++++ b/arch/mips/txx9/generic/setup.c
+@@ -960,12 +960,11 @@ void __init txx9_sramc_init(struct resource *r)
+ goto exit_put;
+ err = sysfs_create_bin_file(&dev->dev.kobj, &dev->bindata_attr);
+ if (err) {
+- device_unregister(&dev->dev);
+ iounmap(dev->base);
+- kfree(dev);
++ device_unregister(&dev->dev);
+ }
+ return;
+ exit_put:
++ iounmap(dev->base);
+ put_device(&dev->dev);
+- return;
+ }
+diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h
+index 2a0c8b1bf147..2abc8e83b95e 100644
+--- a/arch/powerpc/boot/libfdt_env.h
++++ b/arch/powerpc/boot/libfdt_env.h
+@@ -5,6 +5,8 @@
+ #include <types.h>
+ #include <string.h>
+
++#define INT_MAX ((int)(~0U>>1))
++
+ #include "of.h"
+
+ typedef unsigned long uintptr_t;
+diff --git a/arch/powerpc/include/asm/drmem.h b/arch/powerpc/include/asm/drmem.h
+index ce242b9ea8c6..7c1d8e74b25d 100644
+--- a/arch/powerpc/include/asm/drmem.h
++++ b/arch/powerpc/include/asm/drmem.h
+@@ -99,4 +99,9 @@ void __init walk_drmem_lmbs_early(unsigned long node,
+ void (*func)(struct drmem_lmb *, const __be32 **));
+ #endif
+
++static inline void invalidate_lmb_associativity_index(struct drmem_lmb *lmb)
++{
++ lmb->aa_index = 0xffffffff;
++}
++
+ #endif /* _ASM_POWERPC_LMB_H */
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index 1ca9e37f7cc9..38a25ff8afb7 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -260,7 +260,7 @@ do { \
+ ({ \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+- const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+ __chk_user_ptr(ptr); \
+ if (!is_kernel_addr((unsigned long)__gu_addr)) \
+ might_fault(); \
+@@ -274,7 +274,7 @@ do { \
+ ({ \
+ long __gu_err = -EFAULT; \
+ __long_type(*(ptr)) __gu_val = 0; \
+- const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+ might_fault(); \
+ if (access_ok(VERIFY_READ, __gu_addr, (size))) { \
+ barrier_nospec(); \
+@@ -288,7 +288,7 @@ do { \
+ ({ \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+- const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+ __chk_user_ptr(ptr); \
+ barrier_nospec(); \
+ __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
+diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
+index 19b4c628f3be..f0dc680e659a 100644
+--- a/arch/powerpc/kernel/iommu.c
++++ b/arch/powerpc/kernel/iommu.c
+@@ -785,9 +785,9 @@ dma_addr_t iommu_map_page(struct device *dev, struct iommu_table *tbl,
+
+ vaddr = page_address(page) + offset;
+ uaddr = (unsigned long)vaddr;
+- npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl));
+
+ if (tbl) {
++ npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl));
+ align = 0;
+ if (tbl->it_page_shift < PAGE_SHIFT && size >= PAGE_SIZE &&
+ ((unsigned long)vaddr & ~PAGE_MASK) == 0)
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 9e41a9de4323..95d1264ba795 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -985,6 +985,7 @@ int rtas_ibm_suspend_me(u64 handle)
+ goto out;
+ }
+
++ cpu_hotplug_disable();
+ stop_topology_update();
+
+ /* Call function on all CPUs. One of us will make the
+@@ -999,6 +1000,7 @@ int rtas_ibm_suspend_me(u64 handle)
+ printk(KERN_ERR "Error doing global join\n");
+
+ start_topology_update();
++ cpu_hotplug_enable();
+
+ /* Take down CPUs not online prior to suspend */
+ cpuret = rtas_offline_cpus_mask(offline_mask);
+diff --git a/arch/powerpc/kernel/vdso32/datapage.S b/arch/powerpc/kernel/vdso32/datapage.S
+index 3745113fcc65..2a7eb5452aba 100644
+--- a/arch/powerpc/kernel/vdso32/datapage.S
++++ b/arch/powerpc/kernel/vdso32/datapage.S
+@@ -37,6 +37,7 @@ data_page_branch:
+ mtlr r0
+ addi r3, r3, __kernel_datapage_offset-data_page_branch
+ lwz r0,0(r3)
++ .cfi_restore lr
+ add r3,r0,r3
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
+index 75cff3f336b3..afd516b572f8 100644
+--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
+@@ -139,6 +139,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ */
+ 99:
+ li r0,__NR_clock_gettime
++ .cfi_restore lr
+ sc
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S
+index abf17feffe40..bf9668691511 100644
+--- a/arch/powerpc/kernel/vdso64/datapage.S
++++ b/arch/powerpc/kernel/vdso64/datapage.S
+@@ -37,6 +37,7 @@ data_page_branch:
+ mtlr r0
+ addi r3, r3, __kernel_datapage_offset-data_page_branch
+ lwz r0,0(r3)
++ .cfi_restore lr
+ add r3,r0,r3
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
+index afbad2ac3147..1f324c28705b 100644
+--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
+@@ -169,6 +169,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ */
+ 99:
+ li r0,__NR_clock_gettime
++ .cfi_restore lr
+ sc
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
+index 9f574e59d178..2f162c6e52d4 100644
+--- a/arch/powerpc/mm/slb.c
++++ b/arch/powerpc/mm/slb.c
+@@ -355,7 +355,7 @@ void slb_initialize(void)
+ #endif
+ }
+
+- get_paca()->stab_rr = SLB_NUM_BOLTED;
++ get_paca()->stab_rr = SLB_NUM_BOLTED - 1;
+
+ lflags = SLB_VSID_KERNEL | linear_llp;
+ vflags = SLB_VSID_KERNEL | vmalloc_llp;
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index f99cd31b6fd1..2f166136bb50 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -163,7 +163,7 @@ static u32 find_aa_index(struct device_node *dr_node,
+ return aa_index;
+ }
+
+-static u32 lookup_lmb_associativity_index(struct drmem_lmb *lmb)
++static int update_lmb_associativity_index(struct drmem_lmb *lmb)
+ {
+ struct device_node *parent, *lmb_node, *dr_node;
+ struct property *ala_prop;
+@@ -203,43 +203,14 @@ static u32 lookup_lmb_associativity_index(struct drmem_lmb *lmb)
+ aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc);
+
+ dlpar_free_cc_nodes(lmb_node);
+- return aa_index;
+-}
+-
+-static int dlpar_add_device_tree_lmb(struct drmem_lmb *lmb)
+-{
+- int rc, aa_index;
+-
+- lmb->flags |= DRCONF_MEM_ASSIGNED;
+
+- aa_index = lookup_lmb_associativity_index(lmb);
+ if (aa_index < 0) {
+- pr_err("Couldn't find associativity index for drc index %x\n",
+- lmb->drc_index);
+- return aa_index;
++ pr_err("Could not find LMB associativity\n");
++ return -1;
+ }
+
+ lmb->aa_index = aa_index;
+-
+- rtas_hp_event = true;
+- rc = drmem_update_dt();
+- rtas_hp_event = false;
+-
+- return rc;
+-}
+-
+-static int dlpar_remove_device_tree_lmb(struct drmem_lmb *lmb)
+-{
+- int rc;
+-
+- lmb->flags &= ~DRCONF_MEM_ASSIGNED;
+- lmb->aa_index = 0xffffffff;
+-
+- rtas_hp_event = true;
+- rc = drmem_update_dt();
+- rtas_hp_event = false;
+-
+- return rc;
++ return 0;
+ }
+
+ static struct memory_block *lmb_to_memblock(struct drmem_lmb *lmb)
+@@ -431,7 +402,9 @@ static int dlpar_remove_lmb(struct drmem_lmb *lmb)
+ /* Update memory regions for memory remove */
+ memblock_remove(lmb->base_addr, block_sz);
+
+- dlpar_remove_device_tree_lmb(lmb);
++ invalidate_lmb_associativity_index(lmb);
++ lmb->flags &= ~DRCONF_MEM_ASSIGNED;
++
+ return 0;
+ }
+
+@@ -691,10 +664,8 @@ static int dlpar_add_lmb(struct drmem_lmb *lmb)
+ if (lmb->flags & DRCONF_MEM_ASSIGNED)
+ return -EINVAL;
+
+- rc = dlpar_add_device_tree_lmb(lmb);
++ rc = update_lmb_associativity_index(lmb);
+ if (rc) {
+- pr_err("Couldn't update device tree for drc index %x\n",
+- lmb->drc_index);
+ dlpar_release_drc(lmb->drc_index);
+ return rc;
+ }
+@@ -707,14 +678,14 @@ static int dlpar_add_lmb(struct drmem_lmb *lmb)
+ /* Add the memory */
+ rc = add_memory(nid, lmb->base_addr, block_sz);
+ if (rc) {
+- dlpar_remove_device_tree_lmb(lmb);
++ invalidate_lmb_associativity_index(lmb);
+ return rc;
+ }
+
+ rc = dlpar_online_lmb(lmb);
+ if (rc) {
+ remove_memory(nid, lmb->base_addr, block_sz);
+- dlpar_remove_device_tree_lmb(lmb);
++ invalidate_lmb_associativity_index(lmb);
+ } else {
+ lmb->flags |= DRCONF_MEM_ASSIGNED;
+ }
+@@ -961,6 +932,12 @@ int dlpar_memory(struct pseries_hp_errorlog *hp_elog)
+ break;
+ }
+
++ if (!rc) {
++ rtas_hp_event = true;
++ rc = drmem_update_dt();
++ rtas_hp_event = false;
++ }
++
+ unlock_device_hotplug();
+ return rc;
+ }
+diff --git a/arch/s390/include/asm/mmu.h b/arch/s390/include/asm/mmu.h
+index a8418e1379eb..bcfb6371086f 100644
+--- a/arch/s390/include/asm/mmu.h
++++ b/arch/s390/include/asm/mmu.h
+@@ -32,6 +32,8 @@ typedef struct {
+ unsigned int uses_cmm:1;
+ /* The gmaps associated with this context are allowed to use huge pages. */
+ unsigned int allow_gmap_hpage_1m:1;
++ /* The mmu context is for compat task */
++ unsigned int compat_mm:1;
+ } mm_context_t;
+
+ #define INIT_MM_CONTEXT(name) \
+diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
+index 09b61d0e491f..8d04e6f3f796 100644
+--- a/arch/s390/include/asm/mmu_context.h
++++ b/arch/s390/include/asm/mmu_context.h
+@@ -25,6 +25,7 @@ static inline int init_new_context(struct task_struct *tsk,
+ atomic_set(&mm->context.flush_count, 0);
+ mm->context.gmap_asce = 0;
+ mm->context.flush_mm = 0;
++ mm->context.compat_mm = test_thread_flag(TIF_31BIT);
+ #ifdef CONFIG_PGSTE
+ mm->context.alloc_pgste = page_table_allocate_pgste ||
+ test_thread_flag(TIF_PGSTE) ||
+diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
+index 3031cc6dd0ab..7ab7d256d1eb 100644
+--- a/arch/s390/kernel/vdso.c
++++ b/arch/s390/kernel/vdso.c
+@@ -56,7 +56,7 @@ static vm_fault_t vdso_fault(const struct vm_special_mapping *sm,
+ vdso_pagelist = vdso64_pagelist;
+ vdso_pages = vdso64_pages;
+ #ifdef CONFIG_COMPAT
+- if (is_compat_task()) {
++ if (vma->vm_mm->context.compat_mm) {
+ vdso_pagelist = vdso32_pagelist;
+ vdso_pages = vdso32_pages;
+ }
+@@ -77,7 +77,7 @@ static int vdso_mremap(const struct vm_special_mapping *sm,
+
+ vdso_pages = vdso64_pages;
+ #ifdef CONFIG_COMPAT
+- if (is_compat_task())
++ if (vma->vm_mm->context.compat_mm)
+ vdso_pages = vdso32_pages;
+ #endif
+
+@@ -224,7 +224,8 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+
+ vdso_pages = vdso64_pages;
+ #ifdef CONFIG_COMPAT
+- if (is_compat_task())
++ mm->context.compat_mm = is_compat_task();
++ if (mm->context.compat_mm)
+ vdso_pages = vdso32_pages;
+ #endif
+ /*
+diff --git a/arch/s390/kernel/vdso32/clock_gettime.S b/arch/s390/kernel/vdso32/clock_gettime.S
+index a9418bf975db..ada5c11a16e5 100644
+--- a/arch/s390/kernel/vdso32/clock_gettime.S
++++ b/arch/s390/kernel/vdso32/clock_gettime.S
+@@ -10,6 +10,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/unistd.h>
+ #include <asm/dwarf.h>
++#include <asm/ptrace.h>
+
+ .text
+ .align 4
+@@ -18,8 +19,8 @@
+ __kernel_clock_gettime:
+ CFI_STARTPROC
+ ahi %r15,-16
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ basr %r5,0
+ 0: al %r5,21f-0b(%r5) /* get &_vdso_data */
+ chi %r2,__CLOCK_REALTIME_COARSE
+@@ -72,13 +73,13 @@ __kernel_clock_gettime:
+ st %r1,4(%r3) /* store tp->tv_nsec */
+ lhi %r2,0
+ ahi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+
+ /* CLOCK_MONOTONIC_COARSE */
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ 9: l %r4,__VDSO_UPD_COUNT+4(%r5) /* load update counter */
+ tml %r4,0x0001 /* pending update ? loop */
+ jnz 9b
+@@ -158,17 +159,17 @@ __kernel_clock_gettime:
+ st %r1,4(%r3) /* store tp->tv_nsec */
+ lhi %r2,0
+ ahi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+
+ /* Fallback to system call */
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ 19: lhi %r1,__NR_clock_gettime
+ svc 0
+ ahi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+ CFI_ENDPROC
+diff --git a/arch/s390/kernel/vdso32/gettimeofday.S b/arch/s390/kernel/vdso32/gettimeofday.S
+index 3c0db0fa6ad9..b23063fbc892 100644
+--- a/arch/s390/kernel/vdso32/gettimeofday.S
++++ b/arch/s390/kernel/vdso32/gettimeofday.S
+@@ -10,6 +10,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/unistd.h>
+ #include <asm/dwarf.h>
++#include <asm/ptrace.h>
+
+ .text
+ .align 4
+@@ -19,7 +20,7 @@ __kernel_gettimeofday:
+ CFI_STARTPROC
+ ahi %r15,-16
+ CFI_ADJUST_CFA_OFFSET 16
+- CFI_VAL_OFFSET 15, -160
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ basr %r5,0
+ 0: al %r5,13f-0b(%r5) /* get &_vdso_data */
+ 1: ltr %r3,%r3 /* check if tz is NULL */
+diff --git a/arch/s390/kernel/vdso64/clock_gettime.S b/arch/s390/kernel/vdso64/clock_gettime.S
+index fac3ab5ec83a..9d2ee79b90f2 100644
+--- a/arch/s390/kernel/vdso64/clock_gettime.S
++++ b/arch/s390/kernel/vdso64/clock_gettime.S
+@@ -10,6 +10,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/unistd.h>
+ #include <asm/dwarf.h>
++#include <asm/ptrace.h>
+
+ .text
+ .align 4
+@@ -18,8 +19,8 @@
+ __kernel_clock_gettime:
+ CFI_STARTPROC
+ aghi %r15,-16
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ larl %r5,_vdso_data
+ cghi %r2,__CLOCK_REALTIME_COARSE
+ je 4f
+@@ -56,13 +57,13 @@ __kernel_clock_gettime:
+ stg %r1,8(%r3) /* store tp->tv_nsec */
+ lghi %r2,0
+ aghi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+
+ /* CLOCK_MONOTONIC_COARSE */
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ 3: lg %r4,__VDSO_UPD_COUNT(%r5) /* load update counter */
+ tmll %r4,0x0001 /* pending update ? loop */
+ jnz 3b
+@@ -115,13 +116,13 @@ __kernel_clock_gettime:
+ stg %r1,8(%r3) /* store tp->tv_nsec */
+ lghi %r2,0
+ aghi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+
+ /* CPUCLOCK_VIRT for this thread */
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ 9: lghi %r4,0
+ icm %r0,15,__VDSO_ECTG_OK(%r5)
+ jz 12f
+@@ -142,17 +143,17 @@ __kernel_clock_gettime:
+ stg %r4,8(%r3)
+ lghi %r2,0
+ aghi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+
+ /* Fallback to system call */
+- CFI_DEF_CFA_OFFSET 176
+- CFI_VAL_OFFSET 15, -160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD+16
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ 12: lghi %r1,__NR_clock_gettime
+ svc 0
+ aghi %r15,16
+- CFI_DEF_CFA_OFFSET 160
++ CFI_DEF_CFA_OFFSET STACK_FRAME_OVERHEAD
+ CFI_RESTORE 15
+ br %r14
+ CFI_ENDPROC
+diff --git a/arch/s390/kernel/vdso64/gettimeofday.S b/arch/s390/kernel/vdso64/gettimeofday.S
+index 6e1f0b421695..aebe10dc7c99 100644
+--- a/arch/s390/kernel/vdso64/gettimeofday.S
++++ b/arch/s390/kernel/vdso64/gettimeofday.S
+@@ -10,6 +10,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/unistd.h>
+ #include <asm/dwarf.h>
++#include <asm/ptrace.h>
+
+ .text
+ .align 4
+@@ -19,7 +20,7 @@ __kernel_gettimeofday:
+ CFI_STARTPROC
+ aghi %r15,-16
+ CFI_ADJUST_CFA_OFFSET 16
+- CFI_VAL_OFFSET 15, -160
++ CFI_VAL_OFFSET 15, -STACK_FRAME_OVERHEAD
+ larl %r5,_vdso_data
+ 0: ltgr %r3,%r3 /* check if tz is NULL */
+ je 1f
+diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
+index 3fb855155286..8a9cff1f129d 100644
+--- a/arch/x86/hyperv/hv_init.c
++++ b/arch/x86/hyperv/hv_init.c
+@@ -17,6 +17,7 @@
+ *
+ */
+
++#include <linux/efi.h>
+ #include <linux/types.h>
+ #include <asm/apic.h>
+ #include <asm/desc.h>
+@@ -257,6 +258,22 @@ static int hv_cpu_die(unsigned int cpu)
+ return 0;
+ }
+
++static int __init hv_pci_init(void)
++{
++ int gen2vm = efi_enabled(EFI_BOOT);
++
++ /*
++ * For Generation-2 VM, we exit from pci_arch_init() by returning 0.
++ * The purpose is to suppress the harmless warning:
++ * "PCI: Fatal: No config space access function found"
++ */
++ if (gen2vm)
++ return 0;
++
++ /* For Generation-1 VM, we'll proceed in pci_arch_init(). */
++ return 1;
++}
++
+ /*
+ * This function is to be invoked early in the boot sequence after the
+ * hypervisor has been detected.
+@@ -333,6 +350,8 @@ void __init hyperv_init(void)
+
+ hv_apic_init();
+
++ x86_init.pci.arch_init = hv_pci_init;
++
+ /*
+ * Register Hyper-V specific clocksource.
+ */
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 1e07814f02bc..a6458ab499c2 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1133,6 +1133,9 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
+ memset(&c->x86_capability, 0, sizeof c->x86_capability);
+ c->extended_cpuid_level = 0;
+
++ if (!have_cpuid_p())
++ identify_cpu_without_cpuid(c);
++
+ /* cyrix could have cpuid enabled via c_identify()*/
+ if (have_cpuid_p()) {
+ cpu_detect(c);
+@@ -1150,7 +1153,6 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
+ if (this_cpu->c_bsp_init)
+ this_cpu->c_bsp_init(c);
+ } else {
+- identify_cpu_without_cpuid(c);
+ setup_clear_cpu_cap(X86_FEATURE_CPUID);
+ }
+
+diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
+index fa61c870ada9..1d9b8aaea06c 100644
+--- a/arch/x86/kernel/cpu/cyrix.c
++++ b/arch/x86/kernel/cpu/cyrix.c
+@@ -437,7 +437,7 @@ static void cyrix_identify(struct cpuinfo_x86 *c)
+ /* enable MAPEN */
+ setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10);
+ /* enable cpuid */
+- setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80);
++ setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x80);
+ /* disable MAPEN */
+ setCx86(CX86_CCR3, ccr3);
+ local_irq_restore(flags);
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+index ff1c00b695ae..1ceccc4a5472 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+@@ -106,6 +106,9 @@ static void setup_inj_struct(struct mce *m)
+ memset(m, 0, sizeof(struct mce));
+
+ m->cpuvendor = boot_cpu_data.x86_vendor;
++ m->time = ktime_get_real_seconds();
++ m->cpuid = cpuid_eax(1);
++ m->microcode = boot_cpu_data.microcode;
+ }
+
+ /* Update fake mce registers on current CPU. */
+@@ -580,6 +583,9 @@ static int inj_bank_set(void *data, u64 val)
+ m->bank = val;
+ do_inject();
+
++ /* Reset injection struct */
++ setup_inj_struct(&i_mce);
++
+ return 0;
+ }
+
+diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
+index 9119859ba787..420aa7d3a2e6 100644
+--- a/arch/x86/kernel/uprobes.c
++++ b/arch/x86/kernel/uprobes.c
+@@ -1089,7 +1089,7 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs
+ pr_err("return address clobbered: pid=%d, %%sp=%#lx, %%ip=%#lx\n",
+ current->pid, regs->sp, regs->ip);
+
+- force_sig_info(SIGSEGV, SEND_SIG_FORCED, current);
++ force_sig(SIGSEGV, current);
+ }
+
+ return -1;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 4eda2a9c234a..1ab4bb3d6a04 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -5173,7 +5173,7 @@ static void ept_load_pdptrs(struct kvm_vcpu *vcpu)
+ (unsigned long *)&vcpu->arch.regs_dirty))
+ return;
+
+- if (is_paging(vcpu) && is_pae(vcpu) && !is_long_mode(vcpu)) {
++ if (is_pae_paging(vcpu)) {
+ vmcs_write64(GUEST_PDPTR0, mmu->pdptrs[0]);
+ vmcs_write64(GUEST_PDPTR1, mmu->pdptrs[1]);
+ vmcs_write64(GUEST_PDPTR2, mmu->pdptrs[2]);
+@@ -5185,7 +5185,7 @@ static void ept_save_pdptrs(struct kvm_vcpu *vcpu)
+ {
+ struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
+
+- if (is_paging(vcpu) && is_pae(vcpu) && !is_long_mode(vcpu)) {
++ if (is_pae_paging(vcpu)) {
+ mmu->pdptrs[0] = vmcs_read64(GUEST_PDPTR0);
+ mmu->pdptrs[1] = vmcs_read64(GUEST_PDPTR1);
+ mmu->pdptrs[2] = vmcs_read64(GUEST_PDPTR2);
+@@ -12013,8 +12013,7 @@ static int nested_vmx_load_cr3(struct kvm_vcpu *vcpu, unsigned long cr3, bool ne
+ * If PAE paging and EPT are both on, CR3 is not used by the CPU and
+ * must not be dereferenced.
+ */
+- if (!is_long_mode(vcpu) && is_pae(vcpu) && is_paging(vcpu) &&
+- !nested_ept) {
++ if (is_pae_paging(vcpu) && !nested_ept) {
+ if (!load_pdptrs(vcpu, vcpu->arch.walk_mmu, cr3)) {
+ *entry_failure_code = ENTRY_FAIL_PDPTE;
+ return 1;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index e536503ac788..6cf8af022b21 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -634,7 +634,7 @@ bool pdptrs_changed(struct kvm_vcpu *vcpu)
+ gfn_t gfn;
+ int r;
+
+- if (is_long_mode(vcpu) || !is_pae(vcpu) || !is_paging(vcpu))
++ if (!is_pae_paging(vcpu))
+ return false;
+
+ if (!test_bit(VCPU_EXREG_PDPTR,
+@@ -885,8 +885,8 @@ int kvm_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
+ if (is_long_mode(vcpu) &&
+ (cr3 & rsvd_bits(cpuid_maxphyaddr(vcpu), 63)))
+ return 1;
+- else if (is_pae(vcpu) && is_paging(vcpu) &&
+- !load_pdptrs(vcpu, vcpu->arch.walk_mmu, cr3))
++ else if (is_pae_paging(vcpu) &&
++ !load_pdptrs(vcpu, vcpu->arch.walk_mmu, cr3))
+ return 1;
+
+ kvm_mmu_new_cr3(vcpu, cr3, skip_tlb_flush);
+@@ -8348,7 +8348,7 @@ static int __set_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
+ kvm_update_cpuid(vcpu);
+
+ idx = srcu_read_lock(&vcpu->kvm->srcu);
+- if (!is_long_mode(vcpu) && is_pae(vcpu) && is_paging(vcpu)) {
++ if (is_pae_paging(vcpu)) {
+ load_pdptrs(vcpu, vcpu->arch.walk_mmu, kvm_read_cr3(vcpu));
+ mmu_reset_needed = 1;
+ }
+diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
+index 3a91ea760f07..608e5f8c5d0a 100644
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -139,6 +139,11 @@ static inline int is_paging(struct kvm_vcpu *vcpu)
+ return likely(kvm_read_cr0_bits(vcpu, X86_CR0_PG));
+ }
+
++static inline bool is_pae_paging(struct kvm_vcpu *vcpu)
++{
++ return !is_long_mode(vcpu) && is_pae(vcpu) && is_paging(vcpu);
++}
++
+ static inline u32 bit(int bitno)
+ {
+ return 1 << (bitno & 31);
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index d8d2ac294b0c..66b1ebc21ce4 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -3195,6 +3195,13 @@ static unsigned long bfq_bfqq_softrt_next_start(struct bfq_data *bfqd,
+ jiffies + nsecs_to_jiffies(bfqq->bfqd->bfq_slice_idle) + 4);
+ }
+
++static bool bfq_bfqq_injectable(struct bfq_queue *bfqq)
++{
++ return BFQQ_SEEKY(bfqq) && bfqq->wr_coeff == 1 &&
++ blk_queue_nonrot(bfqq->bfqd->queue) &&
++ bfqq->bfqd->hw_tag;
++}
++
+ /**
+ * bfq_bfqq_expire - expire a queue.
+ * @bfqd: device owning the queue.
+@@ -3304,6 +3311,8 @@ void bfq_bfqq_expire(struct bfq_data *bfqd,
+ if (ref == 1) /* bfqq is gone, no more actions on it */
+ return;
+
++ bfqq->injected_service = 0;
++
+ /* mark bfqq as waiting a request only if a bic still points to it */
+ if (!bfq_bfqq_busy(bfqq) &&
+ reason != BFQQE_BUDGET_TIMEOUT &&
+@@ -3584,7 +3593,12 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
+ * whether bfqq is being weight-raised, because
+ * bfq_symmetric_scenario() does not take into account also
+ * weight-raised queues (see comments on
+- * bfq_weights_tree_add()).
++ * bfq_weights_tree_add()). In particular, if bfqq is being
++ * weight-raised, it is important to idle only if there are
++ * other, non-weight-raised queues that may steal throughput
++ * to bfqq. Actually, we should be even more precise, and
++ * differentiate between interactive weight raising and
++ * soft real-time weight raising.
+ *
+ * As a side note, it is worth considering that the above
+ * device-idling countermeasures may however fail in the
+@@ -3596,7 +3610,8 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
+ * to let requests be served in the desired order until all
+ * the requests already queued in the device have been served.
+ */
+- asymmetric_scenario = bfqq->wr_coeff > 1 ||
++ asymmetric_scenario = (bfqq->wr_coeff > 1 &&
++ bfqd->wr_busy_queues < bfqd->busy_queues) ||
+ !bfq_symmetric_scenario(bfqd);
+
+ /*
+@@ -3642,6 +3657,30 @@ static bool bfq_bfqq_must_idle(struct bfq_queue *bfqq)
+ return RB_EMPTY_ROOT(&bfqq->sort_list) && bfq_better_to_idle(bfqq);
+ }
+
++static struct bfq_queue *bfq_choose_bfqq_for_injection(struct bfq_data *bfqd)
++{
++ struct bfq_queue *bfqq;
++
++ /*
++ * A linear search; but, with a high probability, very few
++ * steps are needed to find a candidate queue, i.e., a queue
++ * with enough budget left for its next request. In fact:
++ * - BFQ dynamically updates the budget of every queue so as
++ * to accommodate the expected backlog of the queue;
++ * - if a queue gets all its requests dispatched as injected
++ * service, then the queue is removed from the active list
++ * (and re-added only if it gets new requests, but with
++ * enough budget for its new backlog).
++ */
++ list_for_each_entry(bfqq, &bfqd->active_list, bfqq_list)
++ if (!RB_EMPTY_ROOT(&bfqq->sort_list) &&
++ bfq_serv_to_charge(bfqq->next_rq, bfqq) <=
++ bfq_bfqq_budget_left(bfqq))
++ return bfqq;
++
++ return NULL;
++}
++
+ /*
+ * Select a queue for service. If we have a current queue in service,
+ * check whether to continue servicing it, or retrieve and set a new one.
+@@ -3723,10 +3762,19 @@ check_queue:
+ * No requests pending. However, if the in-service queue is idling
+ * for a new request, or has requests waiting for a completion and
+ * may idle after their completion, then keep it anyway.
++ *
++ * Yet, to boost throughput, inject service from other queues if
++ * possible.
+ */
+ if (bfq_bfqq_wait_request(bfqq) ||
+ (bfqq->dispatched != 0 && bfq_better_to_idle(bfqq))) {
+- bfqq = NULL;
++ if (bfq_bfqq_injectable(bfqq) &&
++ bfqq->injected_service * bfqq->inject_coeff <
++ bfqq->entity.service * 10)
++ bfqq = bfq_choose_bfqq_for_injection(bfqd);
++ else
++ bfqq = NULL;
++
+ goto keep_queue;
+ }
+
+@@ -3816,6 +3864,14 @@ static struct request *bfq_dispatch_rq_from_bfqq(struct bfq_data *bfqd,
+
+ bfq_dispatch_remove(bfqd->queue, rq);
+
++ if (bfqq != bfqd->in_service_queue) {
++ if (likely(bfqd->in_service_queue))
++ bfqd->in_service_queue->injected_service +=
++ bfq_serv_to_charge(rq, bfqq);
++
++ goto return_rq;
++ }
++
+ /*
+ * If weight raising has to terminate for bfqq, then next
+ * function causes an immediate update of bfqq's weight,
+@@ -3834,13 +3890,12 @@ static struct request *bfq_dispatch_rq_from_bfqq(struct bfq_data *bfqd,
+ * belongs to CLASS_IDLE and other queues are waiting for
+ * service.
+ */
+- if (bfqd->busy_queues > 1 && bfq_class_idle(bfqq))
+- goto expire;
+-
+- return rq;
++ if (!(bfqd->busy_queues > 1 && bfq_class_idle(bfqq)))
++ goto return_rq;
+
+-expire:
+ bfq_bfqq_expire(bfqd, bfqq, false, BFQQE_BUDGET_EXHAUSTED);
++
++return_rq:
+ return rq;
+ }
+
+@@ -4246,6 +4301,13 @@ static void bfq_init_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ bfq_mark_bfqq_has_short_ttime(bfqq);
+ bfq_mark_bfqq_sync(bfqq);
+ bfq_mark_bfqq_just_created(bfqq);
++ /*
++ * Aggressively inject a lot of service: up to 90%.
++ * This coefficient remains constant during bfqq life,
++ * but this behavior might be changed, after enough
++ * testing and tuning.
++ */
++ bfqq->inject_coeff = 1;
+ } else
+ bfq_clear_bfqq_sync(bfqq);
+
+diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
+index d5e9e60cb1a5..a41e9884f2dd 100644
+--- a/block/bfq-iosched.h
++++ b/block/bfq-iosched.h
+@@ -351,6 +351,32 @@ struct bfq_queue {
+ unsigned long split_time; /* time of last split */
+
+ unsigned long first_IO_time; /* time of first I/O for this queue */
++
++ /* max service rate measured so far */
++ u32 max_service_rate;
++ /*
++ * Ratio between the service received by bfqq while it is in
++ * service, and the cumulative service (of requests of other
++ * queues) that may be injected while bfqq is empty but still
++ * in service. To increase precision, the coefficient is
++ * measured in tenths of unit. Here are some example of (1)
++ * ratios, (2) resulting percentages of service injected
++ * w.r.t. to the total service dispatched while bfqq is in
++ * service, and (3) corresponding values of the coefficient:
++ * 1 (50%) -> 10
++ * 2 (33%) -> 20
++ * 10 (9%) -> 100
++ * 9.9 (9%) -> 99
++ * 1.5 (40%) -> 15
++ * 0.5 (66%) -> 5
++ * 0.1 (90%) -> 1
++ *
++ * So, if the coefficient is lower than 10, then
++ * injected service is more than bfqq service.
++ */
++ unsigned int inject_coeff;
++ /* amount of service injected in current service slot */
++ unsigned int injected_service;
+ };
+
+ /**
+diff --git a/crypto/chacha20_generic.c b/crypto/chacha20_generic.c
+index e451c3cb6a56..3ae96587caf9 100644
+--- a/crypto/chacha20_generic.c
++++ b/crypto/chacha20_generic.c
+@@ -18,20 +18,21 @@
+ static void chacha20_docrypt(u32 *state, u8 *dst, const u8 *src,
+ unsigned int bytes)
+ {
+- u32 stream[CHACHA20_BLOCK_WORDS];
++ /* aligned to potentially speed up crypto_xor() */
++ u8 stream[CHACHA20_BLOCK_SIZE] __aligned(sizeof(long));
+
+ if (dst != src)
+ memcpy(dst, src, bytes);
+
+ while (bytes >= CHACHA20_BLOCK_SIZE) {
+ chacha20_block(state, stream);
+- crypto_xor(dst, (const u8 *)stream, CHACHA20_BLOCK_SIZE);
++ crypto_xor(dst, stream, CHACHA20_BLOCK_SIZE);
+ bytes -= CHACHA20_BLOCK_SIZE;
+ dst += CHACHA20_BLOCK_SIZE;
+ }
+ if (bytes) {
+ chacha20_block(state, stream);
+- crypto_xor(dst, (const u8 *)stream, bytes);
++ crypto_xor(dst, stream, bytes);
+ }
+ }
+
+diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
+index 9893dbfc1af4..812476e46821 100644
+--- a/crypto/rsa-pkcs1pad.c
++++ b/crypto/rsa-pkcs1pad.c
+@@ -261,15 +261,6 @@ static int pkcs1pad_encrypt(struct akcipher_request *req)
+ pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,
+ ctx->key_size - 1 - req->src_len, req->src);
+
+- req_ctx->out_buf = kmalloc(ctx->key_size, GFP_KERNEL);
+- if (!req_ctx->out_buf) {
+- kfree(req_ctx->in_buf);
+- return -ENOMEM;
+- }
+-
+- pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
+- ctx->key_size, NULL);
+-
+ akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
+ akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
+ pkcs1pad_encrypt_sign_complete_cb, req);
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index c651e206d796..7eda27d43b48 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -99,6 +99,9 @@ struct lpss_private_data {
+ u32 prv_reg_ctx[LPSS_PRV_REG_COUNT];
+ };
+
++/* Devices which need to be in D3 before lpss_iosf_enter_d3_state() proceeds */
++static u32 pmc_atom_d3_mask = 0xfe000ffe;
++
+ /* LPSS run time quirks */
+ static unsigned int lpss_quirks;
+
+@@ -175,6 +178,21 @@ static void byt_pwm_setup(struct lpss_private_data *pdata)
+
+ static void byt_i2c_setup(struct lpss_private_data *pdata)
+ {
++ const char *uid_str = acpi_device_uid(pdata->adev);
++ acpi_handle handle = pdata->adev->handle;
++ unsigned long long shared_host = 0;
++ acpi_status status;
++ long uid = 0;
++
++ /* Expected to always be true, but better safe then sorry */
++ if (uid_str)
++ uid = simple_strtol(uid_str, NULL, 10);
++
++ /* Detect I2C bus shared with PUNIT and ignore its d3 status */
++ status = acpi_evaluate_integer(handle, "_SEM", NULL, &shared_host);
++ if (ACPI_SUCCESS(status) && shared_host && uid)
++ pmc_atom_d3_mask &= ~(BIT_LPSS2_F1_I2C1 << (uid - 1));
++
+ lpss_deassert_reset(pdata);
+
+ if (readl(pdata->mmio_base + pdata->dev_desc->prv_offset))
+@@ -894,7 +912,7 @@ static void lpss_iosf_enter_d3_state(void)
+ * Here we read the values related to LPSS power island, i.e. LPSS
+ * devices, excluding both LPSS DMA controllers, along with SCC domain.
+ */
+- u32 func_dis, d3_sts_0, pmc_status, pmc_mask = 0xfe000ffe;
++ u32 func_dis, d3_sts_0, pmc_status;
+ int ret;
+
+ ret = pmc_atom_read(PMC_FUNC_DIS, &func_dis);
+@@ -912,7 +930,7 @@ static void lpss_iosf_enter_d3_state(void)
+ * Shutdown both LPSS DMA controllers if and only if all other devices
+ * are already in D3hot.
+ */
+- pmc_status = (~(d3_sts_0 | func_dis)) & pmc_mask;
++ pmc_status = (~(d3_sts_0 | func_dis)) & pmc_atom_d3_mask;
+ if (pmc_status)
+ goto exit;
+
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index 7433035ded95..e465e720eab2 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -455,8 +455,9 @@ static void negotiate_os_control(struct acpi_pci_root *root, int *no_aspm)
+ decode_osc_support(root, "OS supports", support);
+ status = acpi_pci_osc_support(root, support);
+ if (ACPI_FAILURE(status)) {
+- dev_info(&device->dev, "_OSC failed (%s); disabling ASPM\n",
+- acpi_format_exception(status));
++ dev_info(&device->dev, "_OSC failed (%s)%s\n",
++ acpi_format_exception(status),
++ pcie_aspm_support_enabled() ? "; disabling ASPM" : "");
+ *no_aspm = 1;
+ return;
+ }
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 6e04e7a707a1..cf4367135a00 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -822,6 +822,7 @@ static void
+ binder_enqueue_deferred_thread_work_ilocked(struct binder_thread *thread,
+ struct binder_work *work)
+ {
++ WARN_ON(!list_empty(&thread->waiting_thread_node));
+ binder_enqueue_work_ilocked(work, &thread->todo);
+ }
+
+@@ -839,6 +840,7 @@ static void
+ binder_enqueue_thread_work_ilocked(struct binder_thread *thread,
+ struct binder_work *work)
+ {
++ WARN_ON(!list_empty(&thread->waiting_thread_node));
+ binder_enqueue_work_ilocked(work, &thread->todo);
+ thread->process_todo = true;
+ }
+@@ -1270,19 +1272,12 @@ static int binder_inc_node_nilocked(struct binder_node *node, int strong,
+ } else
+ node->local_strong_refs++;
+ if (!node->has_strong_ref && target_list) {
++ struct binder_thread *thread = container_of(target_list,
++ struct binder_thread, todo);
+ binder_dequeue_work_ilocked(&node->work);
+- /*
+- * Note: this function is the only place where we queue
+- * directly to a thread->todo without using the
+- * corresponding binder_enqueue_thread_work() helper
+- * functions; in this case it's ok to not set the
+- * process_todo flag, since we know this node work will
+- * always be followed by other work that starts queue
+- * processing: in case of synchronous transactions, a
+- * BR_REPLY or BR_ERROR; in case of oneway
+- * transactions, a BR_TRANSACTION_COMPLETE.
+- */
+- binder_enqueue_work_ilocked(&node->work, target_list);
++ BUG_ON(&thread->todo != target_list);
++ binder_enqueue_deferred_thread_work_ilocked(thread,
++ &node->work);
+ }
+ } else {
+ if (!internal)
+@@ -2733,6 +2728,7 @@ static void binder_transaction(struct binder_proc *proc,
+ {
+ int ret;
+ struct binder_transaction *t;
++ struct binder_work *w;
+ struct binder_work *tcomplete;
+ binder_size_t *offp, *off_end, *off_start;
+ binder_size_t off_min;
+@@ -2874,6 +2870,29 @@ static void binder_transaction(struct binder_proc *proc,
+ goto err_invalid_target_handle;
+ }
+ binder_inner_proc_lock(proc);
++
++ w = list_first_entry_or_null(&thread->todo,
++ struct binder_work, entry);
++ if (!(tr->flags & TF_ONE_WAY) && w &&
++ w->type == BINDER_WORK_TRANSACTION) {
++ /*
++ * Do not allow new outgoing transaction from a
++ * thread that has a transaction at the head of
++ * its todo list. Only need to check the head
++ * because binder_select_thread_ilocked picks a
++ * thread from proc->waiting_threads to enqueue
++ * the transaction, and nothing is queued to the
++ * todo list while the thread is on waiting_threads.
++ */
++ binder_user_error("%d:%d new transaction not allowed when there is a transaction on thread todo\n",
++ proc->pid, thread->pid);
++ binder_inner_proc_unlock(proc);
++ return_error = BR_FAILED_REPLY;
++ return_error_param = -EPROTO;
++ return_error_line = __LINE__;
++ goto err_bad_todo_list;
++ }
++
+ if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
+ struct binder_transaction *tmp;
+
+@@ -3256,6 +3275,7 @@ err_alloc_tcomplete_failed:
+ kfree(t);
+ binder_stats_deleted(BINDER_STAT_TRANSACTION);
+ err_alloc_t_failed:
++err_bad_todo_list:
+ err_bad_call_stack:
+ err_empty_call_stack:
+ err_dead_binder:
+diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
+index 46f0bd75eff7..cf1e0e18a7a9 100644
+--- a/drivers/ata/ahci_platform.c
++++ b/drivers/ata/ahci_platform.c
+@@ -33,6 +33,13 @@ static const struct ata_port_info ahci_port_info = {
+ .port_ops = &ahci_platform_ops,
+ };
+
++static const struct ata_port_info ahci_port_info_nolpm = {
++ .flags = AHCI_FLAG_COMMON | ATA_FLAG_NO_LPM,
++ .pio_mask = ATA_PIO4,
++ .udma_mask = ATA_UDMA6,
++ .port_ops = &ahci_platform_ops,
++};
++
+ static struct scsi_host_template ahci_platform_sht = {
+ AHCI_SHT(DRV_NAME),
+ };
+@@ -41,6 +48,7 @@ static int ahci_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct ahci_host_priv *hpriv;
++ const struct ata_port_info *port;
+ int rc;
+
+ hpriv = ahci_platform_get_resources(pdev,
+@@ -58,7 +66,11 @@ static int ahci_probe(struct platform_device *pdev)
+ if (of_device_is_compatible(dev->of_node, "hisilicon,hisi-ahci"))
+ hpriv->flags |= AHCI_HFLAG_NO_FBS | AHCI_HFLAG_NO_NCQ;
+
+- rc = ahci_platform_init_host(pdev, hpriv, &ahci_port_info,
++ port = acpi_device_get_match_data(dev);
++ if (!port)
++ port = &ahci_port_info;
++
++ rc = ahci_platform_init_host(pdev, hpriv, port,
+ &ahci_platform_sht);
+ if (rc)
+ goto disable_resources;
+@@ -85,6 +97,7 @@ static const struct of_device_id ahci_of_match[] = {
+ MODULE_DEVICE_TABLE(of, ahci_of_match);
+
+ static const struct acpi_device_id ahci_acpi_match[] = {
++ { "APMC0D33", (unsigned long)&ahci_port_info_nolpm },
+ { ACPI_DEVICE_CLASS(PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff) },
+ {},
+ };
+diff --git a/drivers/base/component.c b/drivers/base/component.c
+index 8946dfee4768..e8d676fad0c9 100644
+--- a/drivers/base/component.c
++++ b/drivers/base/component.c
+@@ -536,9 +536,9 @@ int component_bind_all(struct device *master_dev, void *data)
+ }
+
+ if (ret != 0) {
+- for (; i--; )
+- if (!master->match->compare[i].duplicate) {
+- c = master->match->compare[i].component;
++ for (; i > 0; i--)
++ if (!master->match->compare[i - 1].duplicate) {
++ c = master->match->compare[i - 1].component;
+ component_unbind(c, master, data);
+ }
+ }
+diff --git a/drivers/bluetooth/btrsi.c b/drivers/bluetooth/btrsi.c
+index 60d1419590ba..3951f7b23840 100644
+--- a/drivers/bluetooth/btrsi.c
++++ b/drivers/bluetooth/btrsi.c
+@@ -21,8 +21,9 @@
+ #include <net/rsi_91x.h>
+ #include <net/genetlink.h>
+
+-#define RSI_HEADROOM_FOR_BT_HAL 16
++#define RSI_DMA_ALIGN 8
+ #define RSI_FRAME_DESC_SIZE 16
++#define RSI_HEADROOM_FOR_BT_HAL (RSI_FRAME_DESC_SIZE + RSI_DMA_ALIGN)
+
+ struct rsi_hci_adapter {
+ void *priv;
+@@ -70,6 +71,16 @@ static int rsi_hci_send_pkt(struct hci_dev *hdev, struct sk_buff *skb)
+ bt_cb(new_skb)->pkt_type = hci_skb_pkt_type(skb);
+ kfree_skb(skb);
+ skb = new_skb;
++ if (!IS_ALIGNED((unsigned long)skb->data, RSI_DMA_ALIGN)) {
++ u8 *skb_data = skb->data;
++ int skb_len = skb->len;
++
++ skb_push(skb, RSI_DMA_ALIGN);
++ skb_pull(skb, PTR_ALIGN(skb->data,
++ RSI_DMA_ALIGN) - skb->data);
++ memmove(skb->data, skb_data, skb_len);
++ skb_trim(skb, skb_len);
++ }
+ }
+
+ return h_adapter->proto_ops->coex_send_pkt(h_adapter->priv, skb,
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index aa2543b3c286..46e20444ba19 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -368,6 +368,7 @@ void hci_uart_unregister_device(struct hci_uart *hu)
+ {
+ struct hci_dev *hdev = hu->hdev;
+
++ clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+ hci_unregister_dev(hdev);
+ hci_free_dev(hdev);
+
+diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c
+index e2c143861b1e..28dbd5529188 100644
+--- a/drivers/char/ipmi/ipmi_dmi.c
++++ b/drivers/char/ipmi/ipmi_dmi.c
+@@ -217,6 +217,10 @@ static void __init dmi_decode_ipmi(const struct dmi_header *dm)
+ slave_addr = data[DMI_IPMI_SLAVEADDR];
+
+ memcpy(&base_addr, data + DMI_IPMI_ADDR, sizeof(unsigned long));
++ if (!base_addr) {
++ pr_err("Base address is zero, assuming no IPMI interface\n");
++ return;
++ }
+ if (len >= DMI_IPMI_VER2_LENGTH) {
+ if (type == IPMI_DMI_TYPE_SSIF) {
+ offset = 0;
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 3fb297b5fb17..84c17f936c09 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -1365,7 +1365,7 @@ int ipmi_set_my_LUN(struct ipmi_user *user,
+ }
+ release_ipmi_user(user, index);
+
+- return 0;
++ return rv;
+ }
+ EXPORT_SYMBOL(ipmi_set_my_LUN);
+
+diff --git a/drivers/char/ipmi/ipmi_si_mem_io.c b/drivers/char/ipmi/ipmi_si_mem_io.c
+index 638f4ab88f44..75583612ab10 100644
+--- a/drivers/char/ipmi/ipmi_si_mem_io.c
++++ b/drivers/char/ipmi/ipmi_si_mem_io.c
+@@ -51,7 +51,7 @@ static unsigned char mem_inq(const struct si_sm_io *io, unsigned int offset)
+ static void mem_outq(const struct si_sm_io *io, unsigned int offset,
+ unsigned char b)
+ {
+- writeq(b << io->regshift, (io->addr)+(offset * io->regspacing));
++ writeq((u64)b << io->regshift, (io->addr)+(offset * io->regspacing));
+ }
+ #endif
+
+diff --git a/drivers/char/ipmi/ipmi_si_pci.c b/drivers/char/ipmi/ipmi_si_pci.c
+index f54ca6869ed2..022e03634ce2 100644
+--- a/drivers/char/ipmi/ipmi_si_pci.c
++++ b/drivers/char/ipmi/ipmi_si_pci.c
+@@ -120,6 +120,8 @@ static int ipmi_pci_probe(struct pci_dev *pdev,
+ }
+ io.addr_data = pci_resource_start(pdev, 0);
+
++ io.dev = &pdev->dev;
++
+ io.regspacing = ipmi_pci_probe_regspacing(&io);
+ io.regsize = DEFAULT_REGSIZE;
+ io.regshift = 0;
+@@ -128,8 +130,6 @@ static int ipmi_pci_probe(struct pci_dev *pdev,
+ if (io.irq)
+ io.irq_setup = ipmi_std_irq_setup;
+
+- io.dev = &pdev->dev;
+-
+ dev_info(&pdev->dev, "%pR regsize %d spacing %d irq %d\n",
+ &pdev->resource[0], io.regsize, io.regspacing, io.irq);
+
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 0a84b7f468ad..86fe1df90239 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -433,9 +433,9 @@ static int crng_init_cnt = 0;
+ static unsigned long crng_global_init_time = 0;
+ #define CRNG_INIT_CNT_THRESH (2*CHACHA20_KEY_SIZE)
+ static void _extract_crng(struct crng_state *crng,
+- __u32 out[CHACHA20_BLOCK_WORDS]);
++ __u8 out[CHACHA20_BLOCK_SIZE]);
+ static void _crng_backtrack_protect(struct crng_state *crng,
+- __u32 tmp[CHACHA20_BLOCK_WORDS], int used);
++ __u8 tmp[CHACHA20_BLOCK_SIZE], int used);
+ static void process_random_ready_list(void);
+ static void _get_random_bytes(void *buf, int nbytes);
+
+@@ -929,7 +929,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
+ unsigned long flags;
+ int i, num;
+ union {
+- __u32 block[CHACHA20_BLOCK_WORDS];
++ __u8 block[CHACHA20_BLOCK_SIZE];
+ __u32 key[8];
+ } buf;
+
+@@ -976,7 +976,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
+ }
+
+ static void _extract_crng(struct crng_state *crng,
+- __u32 out[CHACHA20_BLOCK_WORDS])
++ __u8 out[CHACHA20_BLOCK_SIZE])
+ {
+ unsigned long v, flags;
+
+@@ -993,7 +993,7 @@ static void _extract_crng(struct crng_state *crng,
+ spin_unlock_irqrestore(&crng->lock, flags);
+ }
+
+-static void extract_crng(__u32 out[CHACHA20_BLOCK_WORDS])
++static void extract_crng(__u8 out[CHACHA20_BLOCK_SIZE])
+ {
+ struct crng_state *crng = NULL;
+
+@@ -1011,7 +1011,7 @@ static void extract_crng(__u32 out[CHACHA20_BLOCK_WORDS])
+ * enough) to mutate the CRNG key to provide backtracking protection.
+ */
+ static void _crng_backtrack_protect(struct crng_state *crng,
+- __u32 tmp[CHACHA20_BLOCK_WORDS], int used)
++ __u8 tmp[CHACHA20_BLOCK_SIZE], int used)
+ {
+ unsigned long flags;
+ __u32 *s, *d;
+@@ -1023,14 +1023,14 @@ static void _crng_backtrack_protect(struct crng_state *crng,
+ used = 0;
+ }
+ spin_lock_irqsave(&crng->lock, flags);
+- s = &tmp[used / sizeof(__u32)];
++ s = (__u32 *) &tmp[used];
+ d = &crng->state[4];
+ for (i=0; i < 8; i++)
+ *d++ ^= *s++;
+ spin_unlock_irqrestore(&crng->lock, flags);
+ }
+
+-static void crng_backtrack_protect(__u32 tmp[CHACHA20_BLOCK_WORDS], int used)
++static void crng_backtrack_protect(__u8 tmp[CHACHA20_BLOCK_SIZE], int used)
+ {
+ struct crng_state *crng = NULL;
+
+@@ -1046,7 +1046,7 @@ static void crng_backtrack_protect(__u32 tmp[CHACHA20_BLOCK_WORDS], int used)
+ static ssize_t extract_crng_user(void __user *buf, size_t nbytes)
+ {
+ ssize_t ret = 0, i = CHACHA20_BLOCK_SIZE;
+- __u32 tmp[CHACHA20_BLOCK_WORDS];
++ __u8 tmp[CHACHA20_BLOCK_SIZE] __aligned(4);
+ int large_request = (nbytes > 256);
+
+ while (nbytes) {
+@@ -1625,7 +1625,7 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
+ */
+ static void _get_random_bytes(void *buf, int nbytes)
+ {
+- __u32 tmp[CHACHA20_BLOCK_WORDS];
++ __u8 tmp[CHACHA20_BLOCK_SIZE] __aligned(4);
+
+ trace_get_random_bytes(nbytes, _RET_IP_);
+
+@@ -2251,7 +2251,7 @@ u64 get_random_u64(void)
+ batch = raw_cpu_ptr(&batched_entropy_u64);
+ spin_lock_irqsave(&batch->batch_lock, flags);
+ if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
+- extract_crng((__u32 *)batch->entropy_u64);
++ extract_crng((u8 *)batch->entropy_u64);
+ batch->position = 0;
+ }
+ ret = batch->entropy_u64[batch->position++];
+@@ -2278,7 +2278,7 @@ u32 get_random_u32(void)
+ batch = raw_cpu_ptr(&batched_entropy_u32);
+ spin_lock_irqsave(&batch->batch_lock, flags);
+ if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
+- extract_crng(batch->entropy_u32);
++ extract_crng((u8 *)batch->entropy_u32);
+ batch->position = 0;
+ }
+ ret = batch->entropy_u32[batch->position++];
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+index 0f7a0ffd3f70..d425b47cef17 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+@@ -352,7 +352,7 @@ static SUNXI_CCU_GATE(bus_dbg_clk, "bus-dbg", "psi-ahb1-ahb2",
+ static SUNXI_CCU_GATE(bus_psi_clk, "bus-psi", "psi-ahb1-ahb2",
+ 0x79c, BIT(0), 0);
+
+-static SUNXI_CCU_GATE(bus_pwm_clk, "bus-pwm", "apb1", 0x79c, BIT(0), 0);
++static SUNXI_CCU_GATE(bus_pwm_clk, "bus-pwm", "apb1", 0x7ac, BIT(0), 0);
+
+ static SUNXI_CCU_GATE(bus_iommu_clk, "bus-iommu", "apb1", 0x7bc, BIT(0), 0);
+
+diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
+index faa282074e5a..b7216935236f 100644
+--- a/drivers/crypto/s5p-sss.c
++++ b/drivers/crypto/s5p-sss.c
+@@ -475,9 +475,9 @@ static void s5p_sg_done(struct s5p_aes_dev *dev)
+ }
+
+ /* Calls the completion. Cannot be called with dev->lock hold. */
+-static void s5p_aes_complete(struct s5p_aes_dev *dev, int err)
++static void s5p_aes_complete(struct ablkcipher_request *req, int err)
+ {
+- dev->req->base.complete(&dev->req->base, err);
++ req->base.complete(&req->base, err);
+ }
+
+ static void s5p_unset_outdata(struct s5p_aes_dev *dev)
+@@ -491,7 +491,7 @@ static void s5p_unset_indata(struct s5p_aes_dev *dev)
+ }
+
+ static int s5p_make_sg_cpy(struct s5p_aes_dev *dev, struct scatterlist *src,
+- struct scatterlist **dst)
++ struct scatterlist **dst)
+ {
+ void *pages;
+ int len;
+@@ -655,6 +655,7 @@ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id)
+ {
+ struct platform_device *pdev = dev_id;
+ struct s5p_aes_dev *dev = platform_get_drvdata(pdev);
++ struct ablkcipher_request *req;
+ int err_dma_tx = 0;
+ int err_dma_rx = 0;
+ int err_dma_hx = 0;
+@@ -727,7 +728,7 @@ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id)
+
+ spin_unlock_irqrestore(&dev->lock, flags);
+
+- s5p_aes_complete(dev, 0);
++ s5p_aes_complete(dev->req, 0);
+ /* Device is still busy */
+ tasklet_schedule(&dev->tasklet);
+ } else {
+@@ -752,11 +753,12 @@ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id)
+ error:
+ s5p_sg_done(dev);
+ dev->busy = false;
++ req = dev->req;
+ if (err_dma_hx == 1)
+ s5p_set_dma_hashdata(dev, dev->hash_sg_iter);
+
+ spin_unlock_irqrestore(&dev->lock, flags);
+- s5p_aes_complete(dev, err);
++ s5p_aes_complete(req, err);
+
+ hash_irq_end:
+ /*
+@@ -1887,7 +1889,7 @@ static int s5p_set_indata_start(struct s5p_aes_dev *dev,
+ }
+
+ static int s5p_set_outdata_start(struct s5p_aes_dev *dev,
+- struct ablkcipher_request *req)
++ struct ablkcipher_request *req)
+ {
+ struct scatterlist *sg;
+ int err;
+@@ -1983,7 +1985,7 @@ indata_error:
+ s5p_sg_done(dev);
+ dev->busy = false;
+ spin_unlock_irqrestore(&dev->lock, flags);
+- s5p_aes_complete(dev, err);
++ s5p_aes_complete(req, err);
+ }
+
+ static void s5p_tasklet_cb(unsigned long data)
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
+index dacf3f42426d..a4f95574eb9a 100644
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -143,7 +143,7 @@ config DMA_JZ4740
+
+ config DMA_JZ4780
+ tristate "JZ4780 DMA support"
+- depends on MACH_JZ4780 || COMPILE_TEST
++ depends on MIPS || COMPILE_TEST
+ select DMA_ENGINE
+ select DMA_VIRTUAL_CHANNELS
+ help
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index db5b8fe1dd4a..7db66f974041 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -1608,7 +1608,7 @@ static void at_xdmac_tasklet(unsigned long data)
+ dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc);
+ if (!desc->active_xfer) {
+ dev_err(chan2dev(&atchan->chan), "Xfer not active: exiting");
+- spin_unlock_bh(&atchan->lock);
++ spin_unlock(&atchan->lock);
+ return;
+ }
+
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index 987899610b46..edff93aacad3 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -587,7 +587,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
+ to_jz4780_dma_desc(vdesc), 0);
+ } else if (cookie == jzchan->desc->vdesc.tx.cookie) {
+ txstate->residue = jz4780_dma_desc_residue(jzchan, jzchan->desc,
+- (jzchan->curr_hwdesc + 1) % jzchan->desc->count);
++ jzchan->curr_hwdesc + 1);
+ } else
+ txstate->residue = 0;
+
+diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
+index d92d56cee101..299b441647cd 100644
+--- a/drivers/edac/i3200_edac.c
++++ b/drivers/edac/i3200_edac.c
+@@ -399,7 +399,7 @@ static int i3200_probe1(struct pci_dev *pdev, int dev_idx)
+ if (nr_pages == 0)
+ continue;
+
+- edac_dbg(0, "csrow %d, channel %d%s, size = %ld Mb\n", i, j,
++ edac_dbg(0, "csrow %d, channel %d%s, size = %ld MiB\n", i, j,
+ stacked ? " (stacked)" : "", PAGES_TO_MiB(nr_pages));
+
+ dimm->nr_pages = nr_pages;
+diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
+index f1d19504a028..4a3300c2da33 100644
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -597,7 +597,7 @@ static int get_dimm_config(struct mem_ctl_info *mci)
+ /* DDR3 has 8 I/O banks */
+ size = (rows * cols * banks * ranks) >> (20 - 3);
+
+- edac_dbg(0, "\tdimm %d %d Mb offset: %x, bank: %d, rank: %d, row: %#x, col: %#x\n",
++ edac_dbg(0, "\tdimm %d %d MiB offset: %x, bank: %d, rank: %d, row: %#x, col: %#x\n",
+ j, size,
+ RANKOFFSET(dimm_dod[j]),
+ banks, ranks, rows, cols);
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 72cea3cb8622..53074ad361e5 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -1622,7 +1622,7 @@ static int __populate_dimms(struct mem_ctl_info *mci,
+ size = ((u64)rows * cols * banks * ranks) >> (20 - 3);
+ npages = MiB_TO_PAGES(size);
+
+- edac_dbg(0, "mc#%d: ha %d channel %d, dimm %d, %lld Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
++ edac_dbg(0, "mc#%d: ha %d channel %d, dimm %d, %lld MiB (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
+ pvt->sbridge_dev->mc, pvt->sbridge_dev->dom, i, j,
+ size, npages,
+ banks, ranks, rows, cols);
+@@ -2912,35 +2912,27 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
+ * cccc = channel
+ * If the mask doesn't match, report an error to the parsing logic
+ */
+- if (! ((errcode & 0xef80) == 0x80)) {
+- optype = "Can't parse: it is not a mem";
+- } else {
+- switch (optypenum) {
+- case 0:
+- optype = "generic undef request error";
+- break;
+- case 1:
+- optype = "memory read error";
+- break;
+- case 2:
+- optype = "memory write error";
+- break;
+- case 3:
+- optype = "addr/cmd error";
+- break;
+- case 4:
+- optype = "memory scrubbing error";
+- break;
+- default:
+- optype = "reserved";
+- break;
+- }
++ switch (optypenum) {
++ case 0:
++ optype = "generic undef request error";
++ break;
++ case 1:
++ optype = "memory read error";
++ break;
++ case 2:
++ optype = "memory write error";
++ break;
++ case 3:
++ optype = "addr/cmd error";
++ break;
++ case 4:
++ optype = "memory scrubbing error";
++ break;
++ default:
++ optype = "reserved";
++ break;
+ }
+
+- /* Only decode errors with an valid address (ADDRV) */
+- if (!GET_BITFIELD(m->status, 58, 58))
+- return;
+-
+ if (pvt->info.type == KNIGHTS_LANDING) {
+ if (channel == 14) {
+ edac_dbg(0, "%s%s err_code:%04x:%04x EDRAM bank %d\n",
+@@ -3046,17 +3038,11 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val,
+ {
+ struct mce *mce = (struct mce *)data;
+ struct mem_ctl_info *mci;
+- struct sbridge_pvt *pvt;
+ char *type;
+
+ if (edac_get_report_status() == EDAC_REPORTING_DISABLED)
+ return NOTIFY_DONE;
+
+- mci = get_mci_for_node_id(mce->socketid, IMC0);
+- if (!mci)
+- return NOTIFY_DONE;
+- pvt = mci->pvt_info;
+-
+ /*
+ * Just let mcelog handle it if the error is
+ * outside the memory controller. A memory error
+@@ -3066,6 +3052,22 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val,
+ if ((mce->status & 0xefff) >> 7 != 1)
+ return NOTIFY_DONE;
+
++ /* Check ADDRV bit in STATUS */
++ if (!GET_BITFIELD(mce->status, 58, 58))
++ return NOTIFY_DONE;
++
++ /* Check MISCV bit in STATUS */
++ if (!GET_BITFIELD(mce->status, 59, 59))
++ return NOTIFY_DONE;
++
++ /* Check address type in MISC (physical address only) */
++ if (GET_BITFIELD(mce->misc, 6, 8) != 2)
++ return NOTIFY_DONE;
++
++ mci = get_mci_for_node_id(mce->socketid, IMC0);
++ if (!mci)
++ return NOTIFY_DONE;
++
+ if (mce->mcgstatus & MCG_STATUS_MCIP)
+ type = "Exception";
+ else
+diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
+index 4ba92f1dd0f7..dd209e0dd9ab 100644
+--- a/drivers/edac/skx_edac.c
++++ b/drivers/edac/skx_edac.c
+@@ -364,7 +364,7 @@ static int get_dimm_info(u32 mtr, u32 amap, struct dimm_info *dimm,
+ size = ((1ull << (rows + cols + ranks)) * banks) >> (20 - 3);
+ npages = MiB_TO_PAGES(size);
+
+- edac_dbg(0, "mc#%d: channel %d, dimm %d, %lld Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
++ edac_dbg(0, "mc#%d: channel %d, dimm %d, %lld MiB (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
+ imc->mc, chan, dimmno, size, npages,
+ banks, 1 << ranks, rows, cols);
+
+@@ -424,7 +424,7 @@ unknown_size:
+ dimm->mtype = MEM_NVDIMM;
+ dimm->edac_mode = EDAC_SECDED; /* likely better than this */
+
+- edac_dbg(0, "mc#%d: channel %d, dimm %d, %llu Mb (%u pages)\n",
++ edac_dbg(0, "mc#%d: channel %d, dimm %d, %llu MiB (%u pages)\n",
+ imc->mc, chan, dimmno, size >> 20, dimm->nr_pages);
+
+ snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u",
+diff --git a/drivers/extcon/extcon-intel-cht-wc.c b/drivers/extcon/extcon-intel-cht-wc.c
+index 5e1dd2772278..bdb67878179e 100644
+--- a/drivers/extcon/extcon-intel-cht-wc.c
++++ b/drivers/extcon/extcon-intel-cht-wc.c
+@@ -156,7 +156,7 @@ static int cht_wc_extcon_get_charger(struct cht_wc_extcon_data *ext,
+ dev_warn(ext->dev,
+ "Unhandled charger type %d, defaulting to SDP\n",
+ ret);
+- /* Fall through, treat as SDP */
++ return EXTCON_CHG_USB_SDP;
+ case CHT_WC_USBSRC_TYPE_SDP:
+ case CHT_WC_USBSRC_TYPE_FLOAT_DP_DN:
+ case CHT_WC_USBSRC_TYPE_OTHER:
+diff --git a/drivers/firmware/arm_scmi/base.c b/drivers/firmware/arm_scmi/base.c
+index 9dff33ea6416..204390297f4b 100644
+--- a/drivers/firmware/arm_scmi/base.c
++++ b/drivers/firmware/arm_scmi/base.c
+@@ -208,7 +208,7 @@ static int scmi_base_discover_agent_get(const struct scmi_handle *handle,
+
+ ret = scmi_do_xfer(handle, t);
+ if (!ret)
+- memcpy(name, t->rx.buf, SCMI_MAX_STR_SIZE);
++ strlcpy(name, t->rx.buf, SCMI_MAX_STR_SIZE);
+
+ scmi_xfer_put(handle, t);
+
+diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c
+index e4119eb34986..30fc04e28431 100644
+--- a/drivers/firmware/arm_scmi/clock.c
++++ b/drivers/firmware/arm_scmi/clock.c
+@@ -111,7 +111,7 @@ static int scmi_clock_attributes_get(const struct scmi_handle *handle,
+
+ ret = scmi_do_xfer(handle, t);
+ if (!ret)
+- memcpy(clk->name, attr->name, SCMI_MAX_STR_SIZE);
++ strlcpy(clk->name, attr->name, SCMI_MAX_STR_SIZE);
+ else
+ clk->name[0] = '\0';
+
+diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c
+index 64342944d917..87c99d296ecd 100644
+--- a/drivers/firmware/arm_scmi/perf.c
++++ b/drivers/firmware/arm_scmi/perf.c
+@@ -174,7 +174,7 @@ scmi_perf_domain_attributes_get(const struct scmi_handle *handle, u32 domain,
+ dom_info->mult_factor =
+ (dom_info->sustained_freq_khz * 1000) /
+ dom_info->sustained_perf_level;
+- memcpy(dom_info->name, attr->name, SCMI_MAX_STR_SIZE);
++ strlcpy(dom_info->name, attr->name, SCMI_MAX_STR_SIZE);
+ }
+
+ scmi_xfer_put(handle, t);
+diff --git a/drivers/firmware/arm_scmi/power.c b/drivers/firmware/arm_scmi/power.c
+index cfa033b05aed..62f3401a1f01 100644
+--- a/drivers/firmware/arm_scmi/power.c
++++ b/drivers/firmware/arm_scmi/power.c
+@@ -106,7 +106,7 @@ scmi_power_domain_attributes_get(const struct scmi_handle *handle, u32 domain,
+ dom_info->state_set_notify = SUPPORTS_STATE_SET_NOTIFY(flags);
+ dom_info->state_set_async = SUPPORTS_STATE_SET_ASYNC(flags);
+ dom_info->state_set_sync = SUPPORTS_STATE_SET_SYNC(flags);
+- memcpy(dom_info->name, attr->name, SCMI_MAX_STR_SIZE);
++ strlcpy(dom_info->name, attr->name, SCMI_MAX_STR_SIZE);
+ }
+
+ scmi_xfer_put(handle, t);
+diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c
+index 27f2092b9882..b53d5cc9c9f6 100644
+--- a/drivers/firmware/arm_scmi/sensors.c
++++ b/drivers/firmware/arm_scmi/sensors.c
+@@ -140,7 +140,7 @@ static int scmi_sensor_description_get(const struct scmi_handle *handle,
+ s = &si->sensors[desc_index + cnt];
+ s->id = le32_to_cpu(buf->desc[cnt].id);
+ s->type = SENSOR_TYPE(attrh);
+- memcpy(s->name, buf->desc[cnt].name, SCMI_MAX_STR_SIZE);
++ strlcpy(s->name, buf->desc[cnt].name, SCMI_MAX_STR_SIZE);
+ }
+
+ desc_index += num_returned;
+diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
+index fb8af5cb7c9b..ccefa84f7305 100644
+--- a/drivers/firmware/dell_rbu.c
++++ b/drivers/firmware/dell_rbu.c
+@@ -45,6 +45,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/firmware.h>
+ #include <linux/dma-mapping.h>
++#include <asm/set_memory.h>
+
+ MODULE_AUTHOR("Abhay Salunke <abhay_salunke@dell.com>");
+ MODULE_DESCRIPTION("Driver for updating BIOS image on DELL systems");
+@@ -181,6 +182,11 @@ static int create_packet(void *data, size_t length)
+ packet_data_temp_buf = NULL;
+ }
+ }
++ /*
++ * set to uncachable or it may never get written back before reboot
++ */
++ set_memory_uc((unsigned long)packet_data_temp_buf, 1 << ordernum);
++
+ spin_lock(&rbu_data.lock);
+
+ newpacket->data = packet_data_temp_buf;
+@@ -349,6 +355,8 @@ static void packet_empty_list(void)
+ * to make sure there are no stale RBU packets left in memory
+ */
+ memset(newpacket->data, 0, rbu_data.packetsize);
++ set_memory_wb((unsigned long)newpacket->data,
++ 1 << newpacket->ordernum);
+ free_pages((unsigned long) newpacket->data,
+ newpacket->ordernum);
+ kfree(newpacket);
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 565ab945698c..b81a27c7f89c 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2541,19 +2541,27 @@ EXPORT_SYMBOL_GPL(gpiochip_free_own_desc);
+ int gpiod_direction_input(struct gpio_desc *desc)
+ {
+ struct gpio_chip *chip;
+- int status = -EINVAL;
++ int status = 0;
+
+ VALIDATE_DESC(desc);
+ chip = desc->gdev->chip;
+
+- if (!chip->get || !chip->direction_input) {
++ if (!chip->get && chip->direction_input) {
+ gpiod_warn(desc,
+- "%s: missing get() or direction_input() operations\n",
++ "%s: missing get() and direction_input() operations\n",
+ __func__);
+ return -EIO;
+ }
+
+- status = chip->direction_input(chip, gpio_chip_hwgpio(desc));
++ if (chip->direction_input) {
++ status = chip->direction_input(chip, gpio_chip_hwgpio(desc));
++ } else if (chip->get_direction &&
++ (chip->get_direction(chip, gpio_chip_hwgpio(desc)) != 1)) {
++ gpiod_warn(desc,
++ "%s: missing direction_input() operation\n",
++ __func__);
++ return -EIO;
++ }
+ if (status == 0)
+ clear_bit(FLAG_IS_OUT, &desc->flags);
+
+@@ -2575,16 +2583,28 @@ static int gpiod_direction_output_raw_commit(struct gpio_desc *desc, int value)
+ {
+ struct gpio_chip *gc = desc->gdev->chip;
+ int val = !!value;
+- int ret;
++ int ret = 0;
+
+- if (!gc->set || !gc->direction_output) {
++ if (!gc->set && !gc->direction_output) {
+ gpiod_warn(desc,
+- "%s: missing set() or direction_output() operations\n",
++ "%s: missing set() and direction_output() operations\n",
+ __func__);
+ return -EIO;
+ }
+
+- ret = gc->direction_output(gc, gpio_chip_hwgpio(desc), val);
++ if (gc->direction_output) {
++ ret = gc->direction_output(gc, gpio_chip_hwgpio(desc), val);
++ } else {
++ if (gc->get_direction &&
++ gc->get_direction(gc, gpio_chip_hwgpio(desc))) {
++ gpiod_warn(desc,
++ "%s: missing direction_output() operation\n",
++ __func__);
++ return -EIO;
++ }
++ gc->set(gc, gpio_chip_hwgpio(desc), val);
++ }
++
+ if (!ret)
+ set_bit(FLAG_IS_OUT, &desc->flags);
+ trace_gpio_value(desc_to_gpio(desc), 0, val);
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
+index 2445e75cf7ea..d00f45eed03c 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.c
++++ b/drivers/gpu/drm/qxl/qxl_drv.c
+@@ -136,20 +136,11 @@ static int qxl_drm_freeze(struct drm_device *dev)
+ {
+ struct pci_dev *pdev = dev->pdev;
+ struct qxl_device *qdev = dev->dev_private;
+- struct drm_crtc *crtc;
+-
+- drm_kms_helper_poll_disable(dev);
+-
+- console_lock();
+- qxl_fbdev_set_suspend(qdev, 1);
+- console_unlock();
++ int ret;
+
+- /* unpin the front buffers */
+- list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+- const struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
+- if (crtc->enabled)
+- (*crtc_funcs->disable)(crtc);
+- }
++ ret = drm_mode_config_helper_suspend(dev);
++ if (ret)
++ return ret;
+
+ qxl_destroy_monitors_object(qdev);
+ qxl_surf_evict(qdev);
+@@ -175,14 +166,7 @@ static int qxl_drm_resume(struct drm_device *dev, bool thaw)
+ }
+
+ qxl_create_monitors_object(qdev);
+- drm_helper_resume_force_mode(dev);
+-
+- console_lock();
+- qxl_fbdev_set_suspend(qdev, 0);
+- console_unlock();
+-
+- drm_kms_helper_poll_enable(dev);
+- return 0;
++ return drm_mode_config_helper_resume(dev);
+ }
+
+ static int qxl_pm_suspend(struct device *dev)
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index fdb0f832fade..5e515533e9cd 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -91,11 +91,14 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ unsigned long flags;
+ int ret, err = 0;
+ struct page *page;
++ unsigned int order;
+
+ if (send_ringbuffer_size % PAGE_SIZE ||
+ recv_ringbuffer_size % PAGE_SIZE)
+ return -EINVAL;
+
++ order = get_order(send_ringbuffer_size + recv_ringbuffer_size);
++
+ spin_lock_irqsave(&newchannel->lock, flags);
+ if (newchannel->state == CHANNEL_OPEN_STATE) {
+ newchannel->state = CHANNEL_OPENING_STATE;
+@@ -110,21 +113,17 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+
+ /* Allocate the ring buffer */
+ page = alloc_pages_node(cpu_to_node(newchannel->target_cpu),
+- GFP_KERNEL|__GFP_ZERO,
+- get_order(send_ringbuffer_size +
+- recv_ringbuffer_size));
++ GFP_KERNEL|__GFP_ZERO, order);
+
+ if (!page)
+- page = alloc_pages(GFP_KERNEL|__GFP_ZERO,
+- get_order(send_ringbuffer_size +
+- recv_ringbuffer_size));
++ page = alloc_pages(GFP_KERNEL|__GFP_ZERO, order);
+
+ if (!page) {
+ err = -ENOMEM;
+ goto error_set_chnstate;
+ }
+
+- newchannel->ringbuffer_pages = page_address(page);
++ newchannel->ringbuffer_page = page;
+ newchannel->ringbuffer_pagecount = (send_ringbuffer_size +
+ recv_ringbuffer_size) >> PAGE_SHIFT;
+
+@@ -239,8 +238,7 @@ error_free_gpadl:
+ error_free_pages:
+ hv_ringbuffer_cleanup(&newchannel->outbound);
+ hv_ringbuffer_cleanup(&newchannel->inbound);
+- __free_pages(page,
+- get_order(send_ringbuffer_size + recv_ringbuffer_size));
++ __free_pages(page, order);
+ error_set_chnstate:
+ newchannel->state = CHANNEL_OPEN_STATE;
+ return err;
+@@ -666,8 +664,8 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
+ hv_ringbuffer_cleanup(&channel->outbound);
+ hv_ringbuffer_cleanup(&channel->inbound);
+
+- free_pages((unsigned long)channel->ringbuffer_pages,
+- get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
++ __free_pages(channel->ringbuffer_page,
++ get_order(channel->ringbuffer_pagecount << PAGE_SHIFT));
+
+ out:
+ return ret;
+diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
+index 8e923e70e594..12bc9fa21111 100644
+--- a/drivers/hv/hv.c
++++ b/drivers/hv/hv.c
+@@ -189,6 +189,17 @@ static void hv_init_clockevent_device(struct clock_event_device *dev, int cpu)
+ int hv_synic_alloc(void)
+ {
+ int cpu;
++ struct hv_per_cpu_context *hv_cpu;
++
++ /*
++ * First, zero all per-cpu memory areas so hv_synic_free() can
++ * detect what memory has been allocated and cleanup properly
++ * after any failures.
++ */
++ for_each_present_cpu(cpu) {
++ hv_cpu = per_cpu_ptr(hv_context.cpu_context, cpu);
++ memset(hv_cpu, 0, sizeof(*hv_cpu));
++ }
+
+ hv_context.hv_numa_map = kcalloc(nr_node_ids, sizeof(struct cpumask),
+ GFP_KERNEL);
+@@ -198,10 +209,8 @@ int hv_synic_alloc(void)
+ }
+
+ for_each_present_cpu(cpu) {
+- struct hv_per_cpu_context *hv_cpu
+- = per_cpu_ptr(hv_context.cpu_context, cpu);
++ hv_cpu = per_cpu_ptr(hv_context.cpu_context, cpu);
+
+- memset(hv_cpu, 0, sizeof(*hv_cpu));
+ tasklet_init(&hv_cpu->msg_dpc,
+ vmbus_on_msg_dpc, (unsigned long) hv_cpu);
+
+diff --git a/drivers/hwtracing/coresight/coresight-dynamic-replicator.c b/drivers/hwtracing/coresight/coresight-dynamic-replicator.c
+index f6d0571ab9dd..d31f1d8758b2 100644
+--- a/drivers/hwtracing/coresight/coresight-dynamic-replicator.c
++++ b/drivers/hwtracing/coresight/coresight-dynamic-replicator.c
+@@ -34,26 +34,42 @@ struct replicator_state {
+ struct coresight_device *csdev;
+ };
+
++/*
++ * replicator_reset : Reset the replicator configuration to sane values.
++ */
++static void replicator_reset(struct replicator_state *drvdata)
++{
++ CS_UNLOCK(drvdata->base);
++
++ writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER0);
++ writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER1);
++
++ CS_LOCK(drvdata->base);
++}
++
+ static int replicator_enable(struct coresight_device *csdev, int inport,
+ int outport)
+ {
++ u32 reg;
+ struct replicator_state *drvdata = dev_get_drvdata(csdev->dev.parent);
+
++ switch (outport) {
++ case 0:
++ reg = REPLICATOR_IDFILTER0;
++ break;
++ case 1:
++ reg = REPLICATOR_IDFILTER1;
++ break;
++ default:
++ WARN_ON(1);
++ return -EINVAL;
++ }
++
+ CS_UNLOCK(drvdata->base);
+
+- /*
+- * Ensure that the other port is disabled
+- * 0x00 - passing through the replicator unimpeded
+- * 0xff - disable (or impede) the flow of ATB data
+- */
+- if (outport == 0) {
+- writel_relaxed(0x00, drvdata->base + REPLICATOR_IDFILTER0);
+- writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER1);
+- } else {
+- writel_relaxed(0x00, drvdata->base + REPLICATOR_IDFILTER1);
+- writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER0);
+- }
+
++ /* Ensure that the outport is enabled. */
++ writel_relaxed(0x00, drvdata->base + reg);
+ CS_LOCK(drvdata->base);
+
+ dev_info(drvdata->dev, "REPLICATOR enabled\n");
+@@ -63,15 +79,25 @@ static int replicator_enable(struct coresight_device *csdev, int inport,
+ static void replicator_disable(struct coresight_device *csdev, int inport,
+ int outport)
+ {
++ u32 reg;
+ struct replicator_state *drvdata = dev_get_drvdata(csdev->dev.parent);
+
++ switch (outport) {
++ case 0:
++ reg = REPLICATOR_IDFILTER0;
++ break;
++ case 1:
++ reg = REPLICATOR_IDFILTER1;
++ break;
++ default:
++ WARN_ON(1);
++ return;
++ }
++
+ CS_UNLOCK(drvdata->base);
+
+ /* disable the flow of ATB data through port */
+- if (outport == 0)
+- writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER0);
+- else
+- writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER1);
++ writel_relaxed(0xff, drvdata->base + reg);
+
+ CS_LOCK(drvdata->base);
+
+@@ -156,7 +182,11 @@ static int replicator_probe(struct amba_device *adev, const struct amba_id *id)
+ desc.groups = replicator_groups;
+ drvdata->csdev = coresight_register(&desc);
+
+- return PTR_ERR_OR_ZERO(drvdata->csdev);
++ if (!IS_ERR(drvdata->csdev)) {
++ replicator_reset(drvdata);
++ return 0;
++ }
++ return PTR_ERR(drvdata->csdev);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
+index 0f5e03e4df22..c3c645201514 100644
+--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
+@@ -12,6 +12,7 @@
+ #include <linux/mm.h>
+ #include <linux/init.h>
+ #include <linux/perf_event.h>
++#include <linux/percpu-defs.h>
+ #include <linux/slab.h>
+ #include <linux/types.h>
+ #include <linux/workqueue.h>
+@@ -33,7 +34,7 @@ struct etm_event_data {
+ struct work_struct work;
+ cpumask_t mask;
+ void *snk_config;
+- struct list_head **path;
++ struct list_head * __percpu *path;
+ };
+
+ static DEFINE_PER_CPU(struct perf_output_handle, ctx_handle);
+@@ -61,6 +62,18 @@ static const struct attribute_group *etm_pmu_attr_groups[] = {
+ NULL,
+ };
+
++static inline struct list_head **
++etm_event_cpu_path_ptr(struct etm_event_data *data, int cpu)
++{
++ return per_cpu_ptr(data->path, cpu);
++}
++
++static inline struct list_head *
++etm_event_cpu_path(struct etm_event_data *data, int cpu)
++{
++ return *etm_event_cpu_path_ptr(data, cpu);
++}
++
+ static void etm_event_read(struct perf_event *event) {}
+
+ static int etm_addr_filters_alloc(struct perf_event *event)
+@@ -120,23 +133,26 @@ static void free_event_data(struct work_struct *work)
+ */
+ if (event_data->snk_config) {
+ cpu = cpumask_first(mask);
+- sink = coresight_get_sink(event_data->path[cpu]);
++ sink = coresight_get_sink(etm_event_cpu_path(event_data, cpu));
+ if (sink_ops(sink)->free_buffer)
+ sink_ops(sink)->free_buffer(event_data->snk_config);
+ }
+
+ for_each_cpu(cpu, mask) {
+- if (!(IS_ERR_OR_NULL(event_data->path[cpu])))
+- coresight_release_path(event_data->path[cpu]);
++ struct list_head **ppath;
++
++ ppath = etm_event_cpu_path_ptr(event_data, cpu);
++ if (!(IS_ERR_OR_NULL(*ppath)))
++ coresight_release_path(*ppath);
++ *ppath = NULL;
+ }
+
+- kfree(event_data->path);
++ free_percpu(event_data->path);
+ kfree(event_data);
+ }
+
+ static void *alloc_event_data(int cpu)
+ {
+- int size;
+ cpumask_t *mask;
+ struct etm_event_data *event_data;
+
+@@ -147,7 +163,6 @@ static void *alloc_event_data(int cpu)
+
+ /* Make sure nothing disappears under us */
+ get_online_cpus();
+- size = num_online_cpus();
+
+ mask = &event_data->mask;
+ if (cpu != -1)
+@@ -164,8 +179,8 @@ static void *alloc_event_data(int cpu)
+ * unused memory when dealing with single CPU trace scenarios is small
+ * compared to the cost of searching through an optimized array.
+ */
+- event_data->path = kcalloc(size,
+- sizeof(struct list_head *), GFP_KERNEL);
++ event_data->path = alloc_percpu(struct list_head *);
++
+ if (!event_data->path) {
+ kfree(event_data);
+ return NULL;
+@@ -213,6 +228,7 @@ static void *etm_setup_aux(struct perf_event *event, void **pages,
+
+ /* Setup the path for each CPU in a trace session */
+ for_each_cpu(cpu, mask) {
++ struct list_head *path;
+ struct coresight_device *csdev;
+
+ csdev = per_cpu(csdev_src, cpu);
+@@ -224,9 +240,11 @@ static void *etm_setup_aux(struct perf_event *event, void **pages,
+ * list of devices from source to sink that can be
+ * referenced later when the path is actually needed.
+ */
+- event_data->path[cpu] = coresight_build_path(csdev, sink);
+- if (IS_ERR(event_data->path[cpu]))
++ path = coresight_build_path(csdev, sink);
++ if (IS_ERR(path))
+ goto err;
++
++ *etm_event_cpu_path_ptr(event_data, cpu) = path;
+ }
+
+ if (!sink_ops(sink)->alloc_buffer)
+@@ -255,6 +273,7 @@ static void etm_event_start(struct perf_event *event, int flags)
+ struct etm_event_data *event_data;
+ struct perf_output_handle *handle = this_cpu_ptr(&ctx_handle);
+ struct coresight_device *sink, *csdev = per_cpu(csdev_src, cpu);
++ struct list_head *path;
+
+ if (!csdev)
+ goto fail;
+@@ -267,8 +286,9 @@ static void etm_event_start(struct perf_event *event, int flags)
+ if (!event_data)
+ goto fail;
+
++ path = etm_event_cpu_path(event_data, cpu);
+ /* We need a sink, no need to continue without one */
+- sink = coresight_get_sink(event_data->path[cpu]);
++ sink = coresight_get_sink(path);
+ if (WARN_ON_ONCE(!sink || !sink_ops(sink)->set_buffer))
+ goto fail_end_stop;
+
+@@ -278,7 +298,7 @@ static void etm_event_start(struct perf_event *event, int flags)
+ goto fail_end_stop;
+
+ /* Nothing will happen without a path */
+- if (coresight_enable_path(event_data->path[cpu], CS_MODE_PERF))
++ if (coresight_enable_path(path, CS_MODE_PERF))
+ goto fail_end_stop;
+
+ /* Tell the perf core the event is alive */
+@@ -286,11 +306,13 @@ static void etm_event_start(struct perf_event *event, int flags)
+
+ /* Finally enable the tracer */
+ if (source_ops(csdev)->enable(csdev, event, CS_MODE_PERF))
+- goto fail_end_stop;
++ goto fail_disable_path;
+
+ out:
+ return;
+
++fail_disable_path:
++ coresight_disable_path(path);
+ fail_end_stop:
+ perf_aux_output_flag(handle, PERF_AUX_FLAG_TRUNCATED);
+ perf_aux_output_end(handle, 0);
+@@ -306,6 +328,7 @@ static void etm_event_stop(struct perf_event *event, int mode)
+ struct coresight_device *sink, *csdev = per_cpu(csdev_src, cpu);
+ struct perf_output_handle *handle = this_cpu_ptr(&ctx_handle);
+ struct etm_event_data *event_data = perf_get_aux(handle);
++ struct list_head *path;
+
+ if (event->hw.state == PERF_HES_STOPPED)
+ return;
+@@ -313,7 +336,11 @@ static void etm_event_stop(struct perf_event *event, int mode)
+ if (!csdev)
+ return;
+
+- sink = coresight_get_sink(event_data->path[cpu]);
++ path = etm_event_cpu_path(event_data, cpu);
++ if (!path)
++ return;
++
++ sink = coresight_get_sink(path);
+ if (!sink)
+ return;
+
+@@ -344,7 +371,7 @@ static void etm_event_stop(struct perf_event *event, int mode)
+ }
+
+ /* Disabling the path make its elements available to other sessions */
+- coresight_disable_path(event_data->path[cpu]);
++ coresight_disable_path(path);
+ }
+
+ static int etm_event_add(struct perf_event *event, int mode)
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
+index e45b5ec2f451..b7bc08cf90c6 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x.c
+@@ -28,6 +28,7 @@
+ #include <linux/pm_runtime.h>
+ #include <asm/sections.h>
+ #include <asm/local.h>
++#include <asm/virt.h>
+
+ #include "coresight-etm4x.h"
+ #include "coresight-etm-perf.h"
+@@ -616,7 +617,7 @@ static void etm4_set_default_config(struct etmv4_config *config)
+ config->vinst_ctrl |= BIT(0);
+ }
+
+-static u64 etm4_get_access_type(struct etmv4_config *config)
++static u64 etm4_get_ns_access_type(struct etmv4_config *config)
+ {
+ u64 access_type = 0;
+
+@@ -627,17 +628,26 @@ static u64 etm4_get_access_type(struct etmv4_config *config)
+ * Bit[13] Exception level 1 - OS
+ * Bit[14] Exception level 2 - Hypervisor
+ * Bit[15] Never implemented
+- *
+- * Always stay away from hypervisor mode.
+ */
+- access_type = ETM_EXLEVEL_NS_HYP;
+-
+- if (config->mode & ETM_MODE_EXCL_KERN)
+- access_type |= ETM_EXLEVEL_NS_OS;
++ if (!is_kernel_in_hyp_mode()) {
++ /* Stay away from hypervisor mode for non-VHE */
++ access_type = ETM_EXLEVEL_NS_HYP;
++ if (config->mode & ETM_MODE_EXCL_KERN)
++ access_type |= ETM_EXLEVEL_NS_OS;
++ } else if (config->mode & ETM_MODE_EXCL_KERN) {
++ access_type = ETM_EXLEVEL_NS_HYP;
++ }
+
+ if (config->mode & ETM_MODE_EXCL_USER)
+ access_type |= ETM_EXLEVEL_NS_APP;
+
++ return access_type;
++}
++
++static u64 etm4_get_access_type(struct etmv4_config *config)
++{
++ u64 access_type = etm4_get_ns_access_type(config);
++
+ /*
+ * EXLEVEL_S, bits[11:8], don't trace anything happening
+ * in secure state.
+@@ -891,20 +901,10 @@ void etm4_config_trace_mode(struct etmv4_config *config)
+
+ addr_acc = config->addr_acc[ETM_DEFAULT_ADDR_COMP];
+ /* clear default config */
+- addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS);
++ addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS |
++ ETM_EXLEVEL_NS_HYP);
+
+- /*
+- * EXLEVEL_NS, bits[15:12]
+- * The Exception levels are:
+- * Bit[12] Exception level 0 - Application
+- * Bit[13] Exception level 1 - OS
+- * Bit[14] Exception level 2 - Hypervisor
+- * Bit[15] Never implemented
+- */
+- if (mode & ETM_MODE_EXCL_KERN)
+- addr_acc |= ETM_EXLEVEL_NS_OS;
+- else
+- addr_acc |= ETM_EXLEVEL_NS_APP;
++ addr_acc |= etm4_get_ns_access_type(config);
+
+ config->addr_acc[ETM_DEFAULT_ADDR_COMP] = addr_acc;
+ config->addr_acc[ETM_DEFAULT_ADDR_COMP + 1] = addr_acc;
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+index 0549249f4b39..e31061308e19 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+@@ -438,10 +438,10 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev,
+ case TMC_MEM_INTF_WIDTH_32BITS:
+ case TMC_MEM_INTF_WIDTH_64BITS:
+ case TMC_MEM_INTF_WIDTH_128BITS:
+- mask = GENMASK(31, 5);
++ mask = GENMASK(31, 4);
+ break;
+ case TMC_MEM_INTF_WIDTH_256BITS:
+- mask = GENMASK(31, 6);
++ mask = GENMASK(31, 5);
+ break;
+ }
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+index 2eda5de304c2..2d6f428176ff 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -536,7 +536,7 @@ tmc_init_etr_sg_table(struct device *dev, int node,
+ sg_table = tmc_alloc_sg_table(dev, node, nr_tpages, nr_dpages, pages);
+ if (IS_ERR(sg_table)) {
+ kfree(etr_table);
+- return ERR_PTR(PTR_ERR(sg_table));
++ return ERR_CAST(sg_table);
+ }
+
+ etr_table->sg_table = sg_table;
+@@ -895,10 +895,15 @@ static void tmc_sync_etr_buf(struct tmc_drvdata *drvdata)
+ tmc_etr_buf_insert_barrier_packet(etr_buf, etr_buf->offset);
+ }
+
+-static void tmc_etr_enable_hw(struct tmc_drvdata *drvdata)
++static void tmc_etr_enable_hw(struct tmc_drvdata *drvdata,
++ struct etr_buf *etr_buf)
+ {
+ u32 axictl, sts;
+- struct etr_buf *etr_buf = drvdata->etr_buf;
++
++ /* Callers should provide an appropriate buffer for use */
++ if (WARN_ON(!etr_buf || drvdata->etr_buf))
++ return;
++ drvdata->etr_buf = etr_buf;
+
+ /*
+ * If this ETR is connected to a CATU, enable it before we turn
+@@ -960,13 +965,16 @@ static void tmc_etr_enable_hw(struct tmc_drvdata *drvdata)
+ * also updating the @bufpp on where to find it. Since the trace data
+ * starts at anywhere in the buffer, depending on the RRP, we adjust the
+ * @len returned to handle buffer wrapping around.
++ *
++ * We are protected here by drvdata->reading != 0, which ensures the
++ * sysfs_buf stays alive.
+ */
+ ssize_t tmc_etr_get_sysfs_trace(struct tmc_drvdata *drvdata,
+ loff_t pos, size_t len, char **bufpp)
+ {
+ s64 offset;
+ ssize_t actual = len;
+- struct etr_buf *etr_buf = drvdata->etr_buf;
++ struct etr_buf *etr_buf = drvdata->sysfs_buf;
+
+ if (pos + actual > etr_buf->len)
+ actual = etr_buf->len - pos;
+@@ -996,7 +1004,14 @@ tmc_etr_free_sysfs_buf(struct etr_buf *buf)
+
+ static void tmc_etr_sync_sysfs_buf(struct tmc_drvdata *drvdata)
+ {
+- tmc_sync_etr_buf(drvdata);
++ struct etr_buf *etr_buf = drvdata->etr_buf;
++
++ if (WARN_ON(drvdata->sysfs_buf != etr_buf)) {
++ tmc_etr_free_sysfs_buf(drvdata->sysfs_buf);
++ drvdata->sysfs_buf = NULL;
++ } else {
++ tmc_sync_etr_buf(drvdata);
++ }
+ }
+
+ static void tmc_etr_disable_hw(struct tmc_drvdata *drvdata)
+@@ -1017,6 +1032,8 @@ static void tmc_etr_disable_hw(struct tmc_drvdata *drvdata)
+
+ /* Disable CATU device if this ETR is connected to one */
+ tmc_etr_disable_catu(drvdata);
++ /* Reset the ETR buf used by hardware */
++ drvdata->etr_buf = NULL;
+ }
+
+ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
+@@ -1024,7 +1041,7 @@ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
+ int ret = 0;
+ unsigned long flags;
+ struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+- struct etr_buf *new_buf = NULL, *free_buf = NULL;
++ struct etr_buf *sysfs_buf = NULL, *new_buf = NULL, *free_buf = NULL;
+
+ /*
+ * If we are enabling the ETR from disabled state, we need to make
+@@ -1035,7 +1052,8 @@ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
+ * with the lock released.
+ */
+ spin_lock_irqsave(&drvdata->spinlock, flags);
+- if (!drvdata->etr_buf || (drvdata->etr_buf->size != drvdata->size)) {
++ sysfs_buf = READ_ONCE(drvdata->sysfs_buf);
++ if (!sysfs_buf || (sysfs_buf->size != drvdata->size)) {
+ spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+ /* Allocate memory with the locks released */
+@@ -1064,14 +1082,14 @@ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
+ * If we don't have a buffer or it doesn't match the requested size,
+ * use the buffer allocated above. Otherwise reuse the existing buffer.
+ */
+- if (!drvdata->etr_buf ||
+- (new_buf && drvdata->etr_buf->size != new_buf->size)) {
+- free_buf = drvdata->etr_buf;
+- drvdata->etr_buf = new_buf;
++ sysfs_buf = READ_ONCE(drvdata->sysfs_buf);
++ if (!sysfs_buf || (new_buf && sysfs_buf->size != new_buf->size)) {
++ free_buf = sysfs_buf;
++ drvdata->sysfs_buf = new_buf;
+ }
+
+ drvdata->mode = CS_MODE_SYSFS;
+- tmc_etr_enable_hw(drvdata);
++ tmc_etr_enable_hw(drvdata, drvdata->sysfs_buf);
+ out:
+ spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+@@ -1156,13 +1174,13 @@ int tmc_read_prepare_etr(struct tmc_drvdata *drvdata)
+ goto out;
+ }
+
+- /* If drvdata::etr_buf is NULL the trace data has been read already */
+- if (drvdata->etr_buf == NULL) {
++ /* If sysfs_buf is NULL the trace data has been read already */
++ if (!drvdata->sysfs_buf) {
+ ret = -EINVAL;
+ goto out;
+ }
+
+- /* Disable the TMC if need be */
++ /* Disable the TMC if we are trying to read from a running session */
+ if (drvdata->mode == CS_MODE_SYSFS)
+ tmc_etr_disable_hw(drvdata);
+
+@@ -1176,7 +1194,7 @@ out:
+ int tmc_read_unprepare_etr(struct tmc_drvdata *drvdata)
+ {
+ unsigned long flags;
+- struct etr_buf *etr_buf = NULL;
++ struct etr_buf *sysfs_buf = NULL;
+
+ /* config types are set a boot time and never change */
+ if (WARN_ON_ONCE(drvdata->config_type != TMC_CONFIG_TYPE_ETR))
+@@ -1191,22 +1209,22 @@ int tmc_read_unprepare_etr(struct tmc_drvdata *drvdata)
+ * buffer. Since the tracer is still enabled drvdata::buf can't
+ * be NULL.
+ */
+- tmc_etr_enable_hw(drvdata);
++ tmc_etr_enable_hw(drvdata, drvdata->sysfs_buf);
+ } else {
+ /*
+ * The ETR is not tracing and the buffer was just read.
+ * As such prepare to free the trace buffer.
+ */
+- etr_buf = drvdata->etr_buf;
+- drvdata->etr_buf = NULL;
++ sysfs_buf = drvdata->sysfs_buf;
++ drvdata->sysfs_buf = NULL;
+ }
+
+ drvdata->reading = false;
+ spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+ /* Free allocated memory out side of the spinlock */
+- if (etr_buf)
+- tmc_free_etr_buf(etr_buf);
++ if (sysfs_buf)
++ tmc_etr_free_sysfs_buf(sysfs_buf);
+
+ return 0;
+ }
+diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h
+index 7027bd60c4cc..872f63e3651b 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc.h
++++ b/drivers/hwtracing/coresight/coresight-tmc.h
+@@ -170,6 +170,7 @@ struct etr_buf {
+ * @trigger_cntr: amount of words to store after a trigger.
+ * @etr_caps: Bitmask of capabilities of the TMC ETR, inferred from the
+ * device configuration register (DEVID)
++ * @sysfs_data: SYSFS buffer for ETR.
+ */
+ struct tmc_drvdata {
+ void __iomem *base;
+@@ -189,6 +190,7 @@ struct tmc_drvdata {
+ enum tmc_mem_intf_width memwidth;
+ u32 trigger_cntr;
+ u32 etr_caps;
++ struct etr_buf *sysfs_buf;
+ };
+
+ struct etr_buf_operations {
+diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
+index 3e07fd335f8c..c0dabbddc1e4 100644
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -132,12 +132,14 @@ static int coresight_enable_sink(struct coresight_device *csdev, u32 mode)
+ {
+ int ret;
+
+- if (!csdev->enable) {
+- if (sink_ops(csdev)->enable) {
+- ret = sink_ops(csdev)->enable(csdev, mode);
+- if (ret)
+- return ret;
+- }
++ /*
++ * We need to make sure the "new" session is compatible with the
++ * existing "mode" of operation.
++ */
++ if (sink_ops(csdev)->enable) {
++ ret = sink_ops(csdev)->enable(csdev, mode);
++ if (ret)
++ return ret;
+ csdev->enable = true;
+ }
+
+@@ -339,8 +341,14 @@ int coresight_enable_path(struct list_head *path, u32 mode)
+ switch (type) {
+ case CORESIGHT_DEV_TYPE_SINK:
+ ret = coresight_enable_sink(csdev, mode);
++ /*
++ * Sink is the first component turned on. If we
++ * failed to enable the sink, there are no components
++ * that need disabling. Disabling the path here
++ * would mean we could disrupt an existing session.
++ */
+ if (ret)
+- goto err;
++ goto out;
+ break;
+ case CORESIGHT_DEV_TYPE_SOURCE:
+ /* sources are enabled from either sysFS or Perf */
+diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c
+index a19fbff16861..d9401b519106 100644
+--- a/drivers/i2c/busses/i2c-aspeed.c
++++ b/drivers/i2c/busses/i2c-aspeed.c
+@@ -137,7 +137,8 @@ struct aspeed_i2c_bus {
+ /* Synchronizes I/O mem access to base. */
+ spinlock_t lock;
+ struct completion cmd_complete;
+- u32 (*get_clk_reg_val)(u32 divisor);
++ u32 (*get_clk_reg_val)(struct device *dev,
++ u32 divisor);
+ unsigned long parent_clk_frequency;
+ u32 bus_frequency;
+ /* Transaction state. */
+@@ -686,16 +687,27 @@ static const struct i2c_algorithm aspeed_i2c_algo = {
+ #endif /* CONFIG_I2C_SLAVE */
+ };
+
+-static u32 aspeed_i2c_get_clk_reg_val(u32 clk_high_low_max, u32 divisor)
++static u32 aspeed_i2c_get_clk_reg_val(struct device *dev,
++ u32 clk_high_low_mask,
++ u32 divisor)
+ {
+- u32 base_clk, clk_high, clk_low, tmp;
++ u32 base_clk_divisor, clk_high_low_max, clk_high, clk_low, tmp;
++
++ /*
++ * SCL_high and SCL_low represent a value 1 greater than what is stored
++ * since a zero divider is meaningless. Thus, the max value each can
++ * store is every bit set + 1. Since SCL_high and SCL_low are added
++ * together (see below), the max value of both is the max value of one
++ * them times two.
++ */
++ clk_high_low_max = (clk_high_low_mask + 1) * 2;
+
+ /*
+ * The actual clock frequency of SCL is:
+ * SCL_freq = APB_freq / (base_freq * (SCL_high + SCL_low))
+ * = APB_freq / divisor
+ * where base_freq is a programmable clock divider; its value is
+- * base_freq = 1 << base_clk
++ * base_freq = 1 << base_clk_divisor
+ * SCL_high is the number of base_freq clock cycles that SCL stays high
+ * and SCL_low is the number of base_freq clock cycles that SCL stays
+ * low for a period of SCL.
+@@ -705,47 +717,59 @@ static u32 aspeed_i2c_get_clk_reg_val(u32 clk_high_low_max, u32 divisor)
+ * SCL_low = clk_low + 1
+ * Thus,
+ * SCL_freq = APB_freq /
+- * ((1 << base_clk) * (clk_high + 1 + clk_low + 1))
++ * ((1 << base_clk_divisor) * (clk_high + 1 + clk_low + 1))
+ * The documentation recommends clk_high >= clk_high_max / 2 and
+ * clk_low >= clk_low_max / 2 - 1 when possible; this last constraint
+ * gives us the following solution:
+ */
+- base_clk = divisor > clk_high_low_max ?
++ base_clk_divisor = divisor > clk_high_low_max ?
+ ilog2((divisor - 1) / clk_high_low_max) + 1 : 0;
+- tmp = (divisor + (1 << base_clk) - 1) >> base_clk;
+- clk_low = tmp / 2;
+- clk_high = tmp - clk_low;
+
+- if (clk_high)
+- clk_high--;
++ if (base_clk_divisor > ASPEED_I2CD_TIME_BASE_DIVISOR_MASK) {
++ base_clk_divisor = ASPEED_I2CD_TIME_BASE_DIVISOR_MASK;
++ clk_low = clk_high_low_mask;
++ clk_high = clk_high_low_mask;
++ dev_err(dev,
++ "clamping clock divider: divider requested, %u, is greater than largest possible divider, %u.\n",
++ divisor, (1 << base_clk_divisor) * clk_high_low_max);
++ } else {
++ tmp = (divisor + (1 << base_clk_divisor) - 1)
++ >> base_clk_divisor;
++ clk_low = tmp / 2;
++ clk_high = tmp - clk_low;
++
++ if (clk_high)
++ clk_high--;
+
+- if (clk_low)
+- clk_low--;
++ if (clk_low)
++ clk_low--;
++ }
+
+
+ return ((clk_high << ASPEED_I2CD_TIME_SCL_HIGH_SHIFT)
+ & ASPEED_I2CD_TIME_SCL_HIGH_MASK)
+ | ((clk_low << ASPEED_I2CD_TIME_SCL_LOW_SHIFT)
+ & ASPEED_I2CD_TIME_SCL_LOW_MASK)
+- | (base_clk & ASPEED_I2CD_TIME_BASE_DIVISOR_MASK);
++ | (base_clk_divisor
++ & ASPEED_I2CD_TIME_BASE_DIVISOR_MASK);
+ }
+
+-static u32 aspeed_i2c_24xx_get_clk_reg_val(u32 divisor)
++static u32 aspeed_i2c_24xx_get_clk_reg_val(struct device *dev, u32 divisor)
+ {
+ /*
+ * clk_high and clk_low are each 3 bits wide, so each can hold a max
+ * value of 8 giving a clk_high_low_max of 16.
+ */
+- return aspeed_i2c_get_clk_reg_val(16, divisor);
++ return aspeed_i2c_get_clk_reg_val(dev, GENMASK(2, 0), divisor);
+ }
+
+-static u32 aspeed_i2c_25xx_get_clk_reg_val(u32 divisor)
++static u32 aspeed_i2c_25xx_get_clk_reg_val(struct device *dev, u32 divisor)
+ {
+ /*
+ * clk_high and clk_low are each 4 bits wide, so each can hold a max
+ * value of 16 giving a clk_high_low_max of 32.
+ */
+- return aspeed_i2c_get_clk_reg_val(32, divisor);
++ return aspeed_i2c_get_clk_reg_val(dev, GENMASK(3, 0), divisor);
+ }
+
+ /* precondition: bus.lock has been acquired. */
+@@ -758,7 +782,7 @@ static int aspeed_i2c_init_clk(struct aspeed_i2c_bus *bus)
+ clk_reg_val &= (ASPEED_I2CD_TIME_TBUF_MASK |
+ ASPEED_I2CD_TIME_THDSTA_MASK |
+ ASPEED_I2CD_TIME_TACST_MASK);
+- clk_reg_val |= bus->get_clk_reg_val(divisor);
++ clk_reg_val |= bus->get_clk_reg_val(bus->dev, divisor);
+ writel(clk_reg_val, bus->base + ASPEED_I2C_AC_TIMING_REG1);
+ writel(ASPEED_NO_TIMEOUT_CTRL, bus->base + ASPEED_I2C_AC_TIMING_REG2);
+
+@@ -874,7 +898,8 @@ static int aspeed_i2c_probe_bus(struct platform_device *pdev)
+ if (!match)
+ bus->get_clk_reg_val = aspeed_i2c_24xx_get_clk_reg_val;
+ else
+- bus->get_clk_reg_val = (u32 (*)(u32))match->data;
++ bus->get_clk_reg_val = (u32 (*)(struct device *, u32))
++ match->data;
+
+ /* Initialize the I2C adapter */
+ spin_lock_init(&bus->lock);
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index 1e57f58fcb00..a74ef76705e0 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -441,6 +441,8 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ u16 control_reg;
+ u16 restart_flag = 0;
+ u32 reg_4g_mode;
++ u8 *dma_rd_buf = NULL;
++ u8 *dma_wr_buf = NULL;
+ dma_addr_t rpaddr = 0;
+ dma_addr_t wpaddr = 0;
+ int ret;
+@@ -500,10 +502,18 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ if (i2c->op == I2C_MASTER_RD) {
+ writel(I2C_DMA_INT_FLAG_NONE, i2c->pdmabase + OFFSET_INT_FLAG);
+ writel(I2C_DMA_CON_RX, i2c->pdmabase + OFFSET_CON);
+- rpaddr = dma_map_single(i2c->dev, msgs->buf,
++
++ dma_rd_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
++ if (!dma_rd_buf)
++ return -ENOMEM;
++
++ rpaddr = dma_map_single(i2c->dev, dma_rd_buf,
+ msgs->len, DMA_FROM_DEVICE);
+- if (dma_mapping_error(i2c->dev, rpaddr))
++ if (dma_mapping_error(i2c->dev, rpaddr)) {
++ i2c_put_dma_safe_msg_buf(dma_rd_buf, msgs, false);
++
+ return -ENOMEM;
++ }
+
+ if (i2c->dev_comp->support_33bits) {
+ reg_4g_mode = mtk_i2c_set_4g_mode(rpaddr);
+@@ -515,10 +525,18 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ } else if (i2c->op == I2C_MASTER_WR) {
+ writel(I2C_DMA_INT_FLAG_NONE, i2c->pdmabase + OFFSET_INT_FLAG);
+ writel(I2C_DMA_CON_TX, i2c->pdmabase + OFFSET_CON);
+- wpaddr = dma_map_single(i2c->dev, msgs->buf,
++
++ dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
++ if (!dma_wr_buf)
++ return -ENOMEM;
++
++ wpaddr = dma_map_single(i2c->dev, dma_wr_buf,
+ msgs->len, DMA_TO_DEVICE);
+- if (dma_mapping_error(i2c->dev, wpaddr))
++ if (dma_mapping_error(i2c->dev, wpaddr)) {
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, false);
++
+ return -ENOMEM;
++ }
+
+ if (i2c->dev_comp->support_33bits) {
+ reg_4g_mode = mtk_i2c_set_4g_mode(wpaddr);
+@@ -530,16 +548,39 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ } else {
+ writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_INT_FLAG);
+ writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_CON);
+- wpaddr = dma_map_single(i2c->dev, msgs->buf,
++
++ dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
++ if (!dma_wr_buf)
++ return -ENOMEM;
++
++ wpaddr = dma_map_single(i2c->dev, dma_wr_buf,
+ msgs->len, DMA_TO_DEVICE);
+- if (dma_mapping_error(i2c->dev, wpaddr))
++ if (dma_mapping_error(i2c->dev, wpaddr)) {
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, false);
++
+ return -ENOMEM;
+- rpaddr = dma_map_single(i2c->dev, (msgs + 1)->buf,
++ }
++
++ dma_rd_buf = i2c_get_dma_safe_msg_buf((msgs + 1), 0);
++ if (!dma_rd_buf) {
++ dma_unmap_single(i2c->dev, wpaddr,
++ msgs->len, DMA_TO_DEVICE);
++
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, false);
++
++ return -ENOMEM;
++ }
++
++ rpaddr = dma_map_single(i2c->dev, dma_rd_buf,
+ (msgs + 1)->len,
+ DMA_FROM_DEVICE);
+ if (dma_mapping_error(i2c->dev, rpaddr)) {
+ dma_unmap_single(i2c->dev, wpaddr,
+ msgs->len, DMA_TO_DEVICE);
++
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, false);
++ i2c_put_dma_safe_msg_buf(dma_rd_buf, (msgs + 1), false);
++
+ return -ENOMEM;
+ }
+
+@@ -578,14 +619,21 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ if (i2c->op == I2C_MASTER_WR) {
+ dma_unmap_single(i2c->dev, wpaddr,
+ msgs->len, DMA_TO_DEVICE);
++
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, true);
+ } else if (i2c->op == I2C_MASTER_RD) {
+ dma_unmap_single(i2c->dev, rpaddr,
+ msgs->len, DMA_FROM_DEVICE);
++
++ i2c_put_dma_safe_msg_buf(dma_rd_buf, msgs, true);
+ } else {
+ dma_unmap_single(i2c->dev, wpaddr, msgs->len,
+ DMA_TO_DEVICE);
+ dma_unmap_single(i2c->dev, rpaddr, (msgs + 1)->len,
+ DMA_FROM_DEVICE);
++
++ i2c_put_dma_safe_msg_buf(dma_wr_buf, msgs, true);
++ i2c_put_dma_safe_msg_buf(dma_rd_buf, (msgs + 1), true);
+ }
+
+ if (ret == 0) {
+diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
+index 32affd3fa8bd..559c3b1284d7 100644
+--- a/drivers/i2c/i2c-core-acpi.c
++++ b/drivers/i2c/i2c-core-acpi.c
+@@ -43,6 +43,7 @@ struct i2c_acpi_lookup {
+ int index;
+ u32 speed;
+ u32 min_speed;
++ u32 force_speed;
+ };
+
+ static int i2c_acpi_fill_info(struct acpi_resource *ares, void *data)
+@@ -240,6 +241,19 @@ i2c_acpi_match_device(const struct acpi_device_id *matches,
+ return acpi_match_device(matches, &client->dev);
+ }
+
++static const struct acpi_device_id i2c_acpi_force_400khz_device_ids[] = {
++ /*
++ * These Silead touchscreen controllers only work at 400KHz, for
++ * some reason they do not work at 100KHz. On some devices the ACPI
++ * tables list another device at their bus as only being capable
++ * of 100KHz, testing has shown that these other devices work fine
++ * at 400KHz (as can be expected of any recent i2c hw) so we force
++ * the speed of the bus to 400 KHz if a Silead device is present.
++ */
++ { "MSSL1680", 0 },
++ {}
++};
++
+ static acpi_status i2c_acpi_lookup_speed(acpi_handle handle, u32 level,
+ void *data, void **return_value)
+ {
+@@ -258,6 +272,9 @@ static acpi_status i2c_acpi_lookup_speed(acpi_handle handle, u32 level,
+ if (lookup->speed <= lookup->min_speed)
+ lookup->min_speed = lookup->speed;
+
++ if (acpi_match_device_ids(adev, i2c_acpi_force_400khz_device_ids) == 0)
++ lookup->force_speed = 400000;
++
+ return AE_OK;
+ }
+
+@@ -295,7 +312,16 @@ u32 i2c_acpi_find_bus_speed(struct device *dev)
+ return 0;
+ }
+
+- return lookup.min_speed != UINT_MAX ? lookup.min_speed : 0;
++ if (lookup.force_speed) {
++ if (lookup.force_speed != lookup.min_speed)
++ dev_warn(dev, FW_BUG "DSDT uses known not-working I2C bus speed %d, forcing it to %d\n",
++ lookup.min_speed, lookup.force_speed);
++ return lookup.force_speed;
++ } else if (lookup.min_speed != UINT_MAX) {
++ return lookup.min_speed;
++ } else {
++ return 0;
++ }
+ }
+ EXPORT_SYMBOL_GPL(i2c_acpi_find_bus_speed);
+
+diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
+index 49c1956e6a67..0884435eec68 100644
+--- a/drivers/iio/adc/max9611.c
++++ b/drivers/iio/adc/max9611.c
+@@ -289,7 +289,7 @@ static int max9611_read_csa_voltage(struct max9611_dev *max9611,
+ return ret;
+
+ if (*adc_raw > 0) {
+- *csa_gain = gain_selectors[i];
++ *csa_gain = (enum max9611_csa_gain)gain_selectors[i];
+ return 0;
+ }
+ }
+diff --git a/drivers/iio/dac/mcp4922.c b/drivers/iio/dac/mcp4922.c
+index bf9aa3fc0534..b5190d1dae8e 100644
+--- a/drivers/iio/dac/mcp4922.c
++++ b/drivers/iio/dac/mcp4922.c
+@@ -94,17 +94,22 @@ static int mcp4922_write_raw(struct iio_dev *indio_dev,
+ long mask)
+ {
+ struct mcp4922_state *state = iio_priv(indio_dev);
++ int ret;
+
+ if (val2 != 0)
+ return -EINVAL;
+
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+- if (val > GENMASK(chan->scan_type.realbits-1, 0))
++ if (val < 0 || val > GENMASK(chan->scan_type.realbits - 1, 0))
+ return -EINVAL;
+ val <<= chan->scan_type.shift;
+- state->value[chan->channel] = val;
+- return mcp4922_spi_write(state, chan->channel, val);
++
++ ret = mcp4922_spi_write(state, chan->channel, val);
++ if (!ret)
++ state->value[chan->channel] = val;
++ return ret;
++
+ default:
+ return -EINVAL;
+ }
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 6d8ac51a39cc..6a585c3e2192 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -599,8 +599,8 @@ void ib_unregister_device(struct ib_device *device)
+ }
+ up_read(&lists_rwsem);
+
+- ib_device_unregister_rdmacg(device);
+ ib_device_unregister_sysfs(device);
++ ib_device_unregister_rdmacg(device);
+
+ mutex_unlock(&device_mutex);
+
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index 74aa3e651bc3..218411282069 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -223,30 +223,30 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ /* Validate parameters */
+ qpn = get_spl_qp_index(qp_type);
+ if (qpn == -1) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: invalid QP Type %d\n",
+- qp_type);
++ dev_dbg_ratelimited(&device->dev, "%s: invalid QP Type %d\n",
++ __func__, qp_type);
+ goto error1;
+ }
+
+ if (rmpp_version && rmpp_version != IB_MGMT_RMPP_VERSION) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: invalid RMPP Version %u\n",
+- rmpp_version);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: invalid RMPP Version %u\n",
++ __func__, rmpp_version);
+ goto error1;
+ }
+
+ /* Validate MAD registration request if supplied */
+ if (mad_reg_req) {
+ if (mad_reg_req->mgmt_class_version >= MAX_MGMT_VERSION) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: invalid Class Version %u\n",
+- mad_reg_req->mgmt_class_version);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: invalid Class Version %u\n",
++ __func__,
++ mad_reg_req->mgmt_class_version);
+ goto error1;
+ }
+ if (!recv_handler) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: no recv_handler\n");
++ dev_dbg_ratelimited(&device->dev,
++ "%s: no recv_handler\n", __func__);
+ goto error1;
+ }
+ if (mad_reg_req->mgmt_class >= MAX_MGMT_CLASS) {
+@@ -256,9 +256,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ */
+ if (mad_reg_req->mgmt_class !=
+ IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid Mgmt Class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid Mgmt Class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ } else if (mad_reg_req->mgmt_class == 0) {
+@@ -266,8 +266,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ * Class 0 is reserved in IBA and is used for
+ * aliasing of IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE
+ */
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid Mgmt Class 0\n");
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid Mgmt Class 0\n",
++ __func__);
+ goto error1;
+ } else if (is_vendor_class(mad_reg_req->mgmt_class)) {
+ /*
+@@ -275,18 +276,19 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ * ensure supplied OUI is not zero
+ */
+ if (!is_vendor_oui(mad_reg_req->oui)) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: No OUI specified for class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: No OUI specified for class 0x%x\n",
++ __func__,
++ mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ }
+ /* Make sure class supplied is consistent with RMPP */
+ if (!ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
+ if (rmpp_version) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: RMPP version for non-RMPP class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: RMPP version for non-RMPP class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ }
+@@ -297,9 +299,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ IB_MGMT_CLASS_SUBN_LID_ROUTED) &&
+ (mad_reg_req->mgmt_class !=
+ IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid SM QP type: class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid SM QP type: class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ } else {
+@@ -307,9 +309,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
+ (mad_reg_req->mgmt_class ==
+ IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid GS QP type: class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid GS QP type: class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ }
+@@ -324,18 +326,18 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ /* Validate device and port */
+ port_priv = ib_get_mad_port(device, port_num);
+ if (!port_priv) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid port %d\n",
+- port_num);
++ dev_dbg_ratelimited(&device->dev, "%s: Invalid port %d\n",
++ __func__, port_num);
+ ret = ERR_PTR(-ENODEV);
+ goto error1;
+ }
+
+- /* Verify the QP requested is supported. For example, Ethernet devices
+- * will not have QP0 */
++ /* Verify the QP requested is supported. For example, Ethernet devices
++ * will not have QP0.
++ */
+ if (!port_priv->qp_info[qpn].qp) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: QP %d not supported\n", qpn);
++ dev_dbg_ratelimited(&device->dev, "%s: QP %d not supported\n",
++ __func__, qpn);
+ ret = ERR_PTR(-EPROTONOSUPPORT);
+ goto error1;
+ }
+diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
+index 6d3042794094..1fd8798d91a7 100644
+--- a/drivers/infiniband/hw/cxgb4/cq.c
++++ b/drivers/infiniband/hw/cxgb4/cq.c
+@@ -161,7 +161,7 @@ static int create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
+ cq->gts = rdev->lldi.gts_reg;
+ cq->rdev = rdev;
+
+- cq->bar2_va = c4iw_bar2_addrs(rdev, cq->cqid, T4_BAR2_QTYPE_INGRESS,
++ cq->bar2_va = c4iw_bar2_addrs(rdev, cq->cqid, CXGB4_BAR2_QTYPE_INGRESS,
+ &cq->bar2_qid,
+ user ? &cq->bar2_pa : NULL);
+ if (user && !cq->bar2_pa) {
+diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
+index 347fe18b1a41..a9e3a11bea54 100644
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -279,12 +279,13 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
+
+ wq->db = rdev->lldi.db_reg;
+
+- wq->sq.bar2_va = c4iw_bar2_addrs(rdev, wq->sq.qid, T4_BAR2_QTYPE_EGRESS,
++ wq->sq.bar2_va = c4iw_bar2_addrs(rdev, wq->sq.qid,
++ CXGB4_BAR2_QTYPE_EGRESS,
+ &wq->sq.bar2_qid,
+ user ? &wq->sq.bar2_pa : NULL);
+ if (need_rq)
+ wq->rq.bar2_va = c4iw_bar2_addrs(rdev, wq->rq.qid,
+- T4_BAR2_QTYPE_EGRESS,
++ CXGB4_BAR2_QTYPE_EGRESS,
+ &wq->rq.bar2_qid,
+ user ? &wq->rq.bar2_pa : NULL);
+
+@@ -2572,7 +2573,7 @@ static int alloc_srq_queue(struct c4iw_srq *srq, struct c4iw_dev_ucontext *uctx,
+ memset(wq->queue, 0, wq->memsize);
+ pci_unmap_addr_set(wq, mapping, wq->dma_addr);
+
+- wq->bar2_va = c4iw_bar2_addrs(rdev, wq->qid, T4_BAR2_QTYPE_EGRESS,
++ wq->bar2_va = c4iw_bar2_addrs(rdev, wq->qid, CXGB4_BAR2_QTYPE_EGRESS,
+ &wq->bar2_qid,
+ user ? &wq->bar2_pa : NULL);
+
+diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
+index 6c967dde58e7..a8dd12e525f8 100644
+--- a/drivers/infiniband/hw/hfi1/pcie.c
++++ b/drivers/infiniband/hw/hfi1/pcie.c
+@@ -331,7 +331,9 @@ int pcie_speeds(struct hfi1_devdata *dd)
+ /*
+ * bus->max_bus_speed is set from the bridge's linkcap Max Link Speed
+ */
+- if (parent && dd->pcidev->bus->max_bus_speed != PCIE_SPEED_8_0GT) {
++ if (parent &&
++ (dd->pcidev->bus->max_bus_speed == PCIE_SPEED_2_5GT ||
++ dd->pcidev->bus->max_bus_speed == PCIE_SPEED_5_0GT)) {
+ dd_dev_info(dd, "Parent PCIe bridge does not support Gen3\n");
+ dd->link_gen3_capable = 0;
+ }
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index 64ab92f8a4a2..291c12f588b5 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -65,6 +65,7 @@
+ #define SDMA_DESCQ_CNT 2048
+ #define SDMA_DESC_INTR 64
+ #define INVALID_TAIL 0xffff
++#define SDMA_PAD max_t(size_t, MAX_16B_PADDING, sizeof(u32))
+
+ static uint sdma_descq_cnt = SDMA_DESCQ_CNT;
+ module_param(sdma_descq_cnt, uint, S_IRUGO);
+@@ -1280,7 +1281,7 @@ void sdma_clean(struct hfi1_devdata *dd, size_t num_engines)
+ struct sdma_engine *sde;
+
+ if (dd->sdma_pad_dma) {
+- dma_free_coherent(&dd->pcidev->dev, 4,
++ dma_free_coherent(&dd->pcidev->dev, SDMA_PAD,
+ (void *)dd->sdma_pad_dma,
+ dd->sdma_pad_phys);
+ dd->sdma_pad_dma = NULL;
+@@ -1481,7 +1482,7 @@ int sdma_init(struct hfi1_devdata *dd, u8 port)
+ /* Allocate memory for pad */
+ dd->sdma_pad_dma = dma_zalloc_coherent(
+ &dd->pcidev->dev,
+- sizeof(u32),
++ SDMA_PAD,
+ &dd->sdma_pad_phys,
+ GFP_KERNEL
+ );
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index cbff746d9e9d..684a298e1503 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -856,8 +856,10 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, unsigned maxpkts)
+
+ changes = set_txreq_header_ahg(req, tx,
+ datalen);
+- if (changes < 0)
++ if (changes < 0) {
++ ret = changes;
+ goto free_tx;
++ }
+ }
+ } else {
+ ret = sdma_txinit(&tx->txreq, 0, sizeof(req->hdr) +
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index 1ad38c8c1ef9..4e7b3c027901 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -149,9 +149,6 @@ static int pio_wait(struct rvt_qp *qp,
+ /* Length of buffer to create verbs txreq cache name */
+ #define TXREQ_NAME_LEN 24
+
+-/* 16B trailing buffer */
+-static const u8 trail_buf[MAX_16B_PADDING];
+-
+ static uint wss_threshold;
+ module_param(wss_threshold, uint, S_IRUGO);
+ MODULE_PARM_DESC(wss_threshold, "Percentage (1-100) of LLC to use as a threshold for a cacheless copy");
+@@ -893,8 +890,8 @@ static int build_verbs_tx_desc(
+
+ /* add icrc, lt byte, and padding to flit */
+ if (extra_bytes)
+- ret = sdma_txadd_kvaddr(sde->dd, &tx->txreq,
+- (void *)trail_buf, extra_bytes);
++ ret = sdma_txadd_daddr(sde->dd, &tx->txreq,
++ sde->dd->sdma_pad_phys, extra_bytes);
+
+ bail_txadd:
+ return ret;
+@@ -1151,7 +1148,8 @@ int hfi1_verbs_send_pio(struct rvt_qp *qp, struct hfi1_pkt_state *ps,
+ }
+ /* add icrc, lt byte, and padding to flit */
+ if (extra_bytes)
+- seg_pio_copy_mid(pbuf, trail_buf, extra_bytes);
++ seg_pio_copy_mid(pbuf, ppd->dd->sdma_pad_dma,
++ extra_bytes);
+
+ seg_pio_copy_end(pbuf);
+ }
+diff --git a/drivers/infiniband/hw/hns/Kconfig b/drivers/infiniband/hw/hns/Kconfig
+index fddb5fdf92de..21c2100b2ea9 100644
+--- a/drivers/infiniband/hw/hns/Kconfig
++++ b/drivers/infiniband/hw/hns/Kconfig
+@@ -1,6 +1,7 @@
+ config INFINIBAND_HNS
+ tristate "HNS RoCE Driver"
+ depends on NET_VENDOR_HISILICON
++ depends on INFINIBAND_USER_ACCESS || !INFINIBAND_USER_ACCESS
+ depends on ARM64 || (COMPILE_TEST && 64BIT)
+ ---help---
+ This is a RoCE/RDMA driver for the Hisilicon RoCE engine. The engine
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index cf878e1b71fc..3f8e13190aa7 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -5117,6 +5117,7 @@ static int hns_roce_v2_init_eq_table(struct hns_roce_dev *hr_dev)
+ create_singlethread_workqueue("hns_roce_irq_workqueue");
+ if (!hr_dev->irq_workq) {
+ dev_err(dev, "Create irq workqueue failed!\n");
++ ret = -ENOMEM;
+ goto err_request_irq_fail;
+ }
+
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+index 423818a7d333..771eb6bd0785 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+@@ -1689,7 +1689,7 @@ static enum i40iw_status_code i40iw_add_mqh_6(struct i40iw_device *iwdev,
+ unsigned long flags;
+
+ rtnl_lock();
+- for_each_netdev_rcu(&init_net, ip_dev) {
++ for_each_netdev(&init_net, ip_dev) {
+ if ((((rdma_vlan_dev_vlan_id(ip_dev) < I40IW_NO_VLAN) &&
+ (rdma_vlan_dev_real_dev(ip_dev) == iwdev->netdev)) ||
+ (ip_dev == iwdev->netdev)) && (ip_dev->flags & IFF_UP)) {
+diff --git a/drivers/infiniband/hw/mlx4/Kconfig b/drivers/infiniband/hw/mlx4/Kconfig
+index db4aa13ebae0..d1de3285fd88 100644
+--- a/drivers/infiniband/hw/mlx4/Kconfig
++++ b/drivers/infiniband/hw/mlx4/Kconfig
+@@ -1,6 +1,7 @@
+ config MLX4_INFINIBAND
+ tristate "Mellanox ConnectX HCA support"
+ depends on NETDEVICES && ETHERNET && PCI && INET
++ depends on INFINIBAND_USER_ACCESS || !INFINIBAND_USER_ACCESS
+ depends on MAY_USE_DEVLINK
+ select NET_VENDOR_MELLANOX
+ select MLX4_CORE
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index c05eae93170e..f4ffdc588ea0 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1823,6 +1823,14 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,
+ context->lib_caps = req.lib_caps;
+ print_lib_caps(dev, context->lib_caps);
+
++ if (mlx5_lag_is_active(dev->mdev)) {
++ u8 port = mlx5_core_native_port_num(dev->mdev);
++
++ atomic_set(&context->tx_port_affinity,
++ atomic_add_return(
++ 1, &dev->roce[port].tx_port_affinity));
++ }
++
+ return &context->ibucontext;
+
+ out_mdev:
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index 941d1df54631..6a060c84598f 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -139,6 +139,8 @@ struct mlx5_ib_ucontext {
+ u64 lib_caps;
+ DECLARE_BITMAP(dm_pages, MLX5_MAX_MEMIC_PAGES);
+ u16 devx_uid;
++ /* For RoCE LAG TX affinity */
++ atomic_t tx_port_affinity;
+ };
+
+ static inline struct mlx5_ib_ucontext *to_mucontext(struct ib_ucontext *ibucontext)
+@@ -700,7 +702,7 @@ struct mlx5_roce {
+ rwlock_t netdev_lock;
+ struct net_device *netdev;
+ struct notifier_block nb;
+- atomic_t next_port;
++ atomic_t tx_port_affinity;
+ enum ib_port_state last_port_state;
+ struct mlx5_ib_dev *dev;
+ u8 native_port_num;
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 900f85ce0fb0..ef0f710587ad 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -2910,6 +2910,37 @@ static int modify_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
+ return 0;
+ }
+
++static unsigned int get_tx_affinity(struct mlx5_ib_dev *dev,
++ struct mlx5_ib_pd *pd,
++ struct mlx5_ib_qp_base *qp_base,
++ u8 port_num)
++{
++ struct mlx5_ib_ucontext *ucontext = NULL;
++ unsigned int tx_port_affinity;
++
++ if (pd && pd->ibpd.uobject && pd->ibpd.uobject->context)
++ ucontext = to_mucontext(pd->ibpd.uobject->context);
++
++ if (ucontext) {
++ tx_port_affinity = (unsigned int)atomic_add_return(
++ 1, &ucontext->tx_port_affinity) %
++ MLX5_MAX_PORTS +
++ 1;
++ mlx5_ib_dbg(dev, "Set tx affinity 0x%x to qpn 0x%x ucontext %p\n",
++ tx_port_affinity, qp_base->mqp.qpn, ucontext);
++ } else {
++ tx_port_affinity =
++ (unsigned int)atomic_add_return(
++ 1, &dev->roce[port_num].tx_port_affinity) %
++ MLX5_MAX_PORTS +
++ 1;
++ mlx5_ib_dbg(dev, "Set tx affinity 0x%x to qpn 0x%x\n",
++ tx_port_affinity, qp_base->mqp.qpn);
++ }
++
++ return tx_port_affinity;
++}
++
+ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
+ const struct ib_qp_attr *attr, int attr_mask,
+ enum ib_qp_state cur_state, enum ib_qp_state new_state,
+@@ -2975,6 +3006,7 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
+ if (!context)
+ return -ENOMEM;
+
++ pd = get_pd(qp);
+ context->flags = cpu_to_be32(mlx5_st << 16);
+
+ if (!(attr_mask & IB_QP_PATH_MIG_STATE)) {
+@@ -3003,9 +3035,7 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
+ (ibqp->qp_type == IB_QPT_XRC_TGT)) {
+ if (mlx5_lag_is_active(dev->mdev)) {
+ u8 p = mlx5_core_native_port_num(dev->mdev);
+- tx_affinity = (unsigned int)atomic_add_return(1,
+- &dev->roce[p].next_port) %
+- MLX5_MAX_PORTS + 1;
++ tx_affinity = get_tx_affinity(dev, pd, base, p);
+ context->flags |= cpu_to_be32(tx_affinity << 24);
+ }
+ }
+@@ -3063,7 +3093,6 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
+ goto out;
+ }
+
+- pd = get_pd(qp);
+ get_cqs(qp->ibqp.qp_type, qp->ibqp.send_cq, qp->ibqp.recv_cq,
+ &send_cq, &recv_cq);
+
+@@ -4378,6 +4407,12 @@ static int _mlx5_ib_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ u8 next_fence = 0;
+ u8 fence;
+
++ if (unlikely(mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR &&
++ !drain)) {
++ *bad_wr = wr;
++ return -EIO;
++ }
++
+ if (unlikely(ibqp->qp_type == IB_QPT_GSI))
+ return mlx5_ib_gsi_post_send(ibqp, wr, bad_wr);
+
+@@ -4387,13 +4422,6 @@ static int _mlx5_ib_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+
+ spin_lock_irqsave(&qp->sq.lock, flags);
+
+- if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR && !drain) {
+- err = -EIO;
+- *bad_wr = wr;
+- nreq = 0;
+- goto out;
+- }
+-
+ for (nreq = 0; wr; nreq++, wr = wr->next) {
+ if (unlikely(wr->opcode >= ARRAY_SIZE(mlx5_ib_opcode))) {
+ mlx5_ib_warn(dev, "\n");
+@@ -4708,18 +4736,17 @@ static int _mlx5_ib_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr,
+ int ind;
+ int i;
+
++ if (unlikely(mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR &&
++ !drain)) {
++ *bad_wr = wr;
++ return -EIO;
++ }
++
+ if (unlikely(ibqp->qp_type == IB_QPT_GSI))
+ return mlx5_ib_gsi_post_recv(ibqp, wr, bad_wr);
+
+ spin_lock_irqsave(&qp->rq.lock, flags);
+
+- if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR && !drain) {
+- err = -EIO;
+- *bad_wr = wr;
+- nreq = 0;
+- goto out;
+- }
+-
+ ind = qp->rq.head & (qp->rq.wqe_cnt - 1);
+
+ for (nreq = 0; wr; nreq++, wr = wr->next) {
+diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
+index 83311dd07019..ea089cb091ad 100644
+--- a/drivers/infiniband/sw/rxe/rxe_comp.c
++++ b/drivers/infiniband/sw/rxe/rxe_comp.c
+@@ -191,6 +191,7 @@ static inline void reset_retry_counters(struct rxe_qp *qp)
+ {
+ qp->comp.retry_cnt = qp->attr.retry_cnt;
+ qp->comp.rnr_retry = qp->attr.rnr_retry;
++ qp->comp.started_retry = 0;
+ }
+
+ static inline enum comp_state check_psn(struct rxe_qp *qp,
+@@ -253,6 +254,17 @@ static inline enum comp_state check_ack(struct rxe_qp *qp,
+ case IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE:
+ if (pkt->opcode != IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE &&
+ pkt->opcode != IB_OPCODE_RC_RDMA_READ_RESPONSE_LAST) {
++ /* read retries of partial data may restart from
++ * read response first or response only.
++ */
++ if ((pkt->psn == wqe->first_psn &&
++ pkt->opcode ==
++ IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST) ||
++ (wqe->first_psn == wqe->last_psn &&
++ pkt->opcode ==
++ IB_OPCODE_RC_RDMA_READ_RESPONSE_ONLY))
++ break;
++
+ return COMPST_ERROR;
+ }
+ break;
+@@ -499,11 +511,11 @@ static inline enum comp_state complete_wqe(struct rxe_qp *qp,
+ struct rxe_pkt_info *pkt,
+ struct rxe_send_wqe *wqe)
+ {
+- qp->comp.opcode = -1;
+-
+- if (pkt) {
+- if (psn_compare(pkt->psn, qp->comp.psn) >= 0)
+- qp->comp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
++ if (pkt && wqe->state == wqe_state_pending) {
++ if (psn_compare(wqe->last_psn, qp->comp.psn) >= 0) {
++ qp->comp.psn = (wqe->last_psn + 1) & BTH_PSN_MASK;
++ qp->comp.opcode = -1;
++ }
+
+ if (qp->req.wait_psn) {
+ qp->req.wait_psn = 0;
+@@ -676,6 +688,20 @@ int rxe_completer(void *arg)
+ goto exit;
+ }
+
++ /* if we've started a retry, don't start another
++ * retry sequence, unless this is a timeout.
++ */
++ if (qp->comp.started_retry &&
++ !qp->comp.timeout_retry) {
++ if (pkt) {
++ rxe_drop_ref(pkt->qp);
++ kfree_skb(skb);
++ skb = NULL;
++ }
++
++ goto done;
++ }
++
+ if (qp->comp.retry_cnt > 0) {
+ if (qp->comp.retry_cnt != 7)
+ qp->comp.retry_cnt--;
+@@ -692,6 +718,7 @@ int rxe_completer(void *arg)
+ rxe_counter_inc(rxe,
+ RXE_CNT_COMP_RETRY);
+ qp->req.need_retry = 1;
++ qp->comp.started_retry = 1;
+ rxe_run_task(&qp->req.task, 1);
+ }
+
+@@ -701,7 +728,7 @@ int rxe_completer(void *arg)
+ skb = NULL;
+ }
+
+- goto exit;
++ goto done;
+
+ } else {
+ rxe_counter_inc(rxe, RXE_CNT_RETRY_EXCEEDED);
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index fa98a5279647..f7dd8de79941 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -73,9 +73,6 @@ static void req_retry(struct rxe_qp *qp)
+ int npsn;
+ int first = 1;
+
+- wqe = queue_head(qp->sq.queue);
+- npsn = (qp->comp.psn - wqe->first_psn) & BTH_PSN_MASK;
+-
+ qp->req.wqe_index = consumer_index(qp->sq.queue);
+ qp->req.psn = qp->comp.psn;
+ qp->req.opcode = -1;
+@@ -107,11 +104,17 @@ static void req_retry(struct rxe_qp *qp)
+ if (first) {
+ first = 0;
+
+- if (mask & WR_WRITE_OR_SEND_MASK)
++ if (mask & WR_WRITE_OR_SEND_MASK) {
++ npsn = (qp->comp.psn - wqe->first_psn) &
++ BTH_PSN_MASK;
+ retry_first_write_send(qp, wqe, mask, npsn);
++ }
+
+- if (mask & WR_READ_MASK)
++ if (mask & WR_READ_MASK) {
++ npsn = (wqe->dma.length - wqe->dma.resid) /
++ qp->mtu;
+ wqe->iova += npsn * qp->mtu;
++ }
+ }
+
+ wqe->state = wqe_state_posted;
+@@ -435,7 +438,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,
+ if (pkt->mask & RXE_RETH_MASK) {
+ reth_set_rkey(pkt, ibwr->wr.rdma.rkey);
+ reth_set_va(pkt, wqe->iova);
+- reth_set_len(pkt, wqe->dma.length);
++ reth_set_len(pkt, wqe->dma.resid);
+ }
+
+ if (pkt->mask & RXE_IMMDT_MASK)
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index 3b731c7682e5..a0ec28d2b71a 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -158,6 +158,7 @@ struct rxe_comp_info {
+ int opcode;
+ int timeout;
+ int timeout_retry;
++ int started_retry;
+ u32 retry_cnt;
+ u32 rnr_retry;
+ struct rxe_task task;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 78dd36daac00..d8cb5bbe6eb5 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -243,7 +243,8 @@ static int ipoib_change_mtu(struct net_device *dev, int new_mtu)
+ return 0;
+ }
+
+- if (new_mtu > IPOIB_UD_MTU(priv->max_ib_mtu))
++ if (new_mtu < (ETH_MIN_MTU + IPOIB_ENCAP_LEN) ||
++ new_mtu > IPOIB_UD_MTU(priv->max_ib_mtu))
+ return -EINVAL;
+
+ priv->admin_mtu = new_mtu;
+diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
+index 2f6388596f88..96af06cfe0af 100644
+--- a/drivers/infiniband/ulp/iser/iser_initiator.c
++++ b/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -589,13 +589,19 @@ void iser_login_rsp(struct ib_cq *cq, struct ib_wc *wc)
+ ib_conn->post_recv_buf_count--;
+ }
+
+-static inline void
++static inline int
+ iser_inv_desc(struct iser_fr_desc *desc, u32 rkey)
+ {
+- if (likely(rkey == desc->rsc.mr->rkey))
++ if (likely(rkey == desc->rsc.mr->rkey)) {
+ desc->rsc.mr_valid = 0;
+- else if (likely(rkey == desc->pi_ctx->sig_mr->rkey))
++ } else if (likely(desc->pi_ctx && rkey == desc->pi_ctx->sig_mr->rkey)) {
+ desc->pi_ctx->sig_mr_valid = 0;
++ } else {
++ iser_err("Bogus remote invalidation for rkey %#x\n", rkey);
++ return -EINVAL;
++ }
++
++ return 0;
+ }
+
+ static int
+@@ -623,12 +629,14 @@ iser_check_remote_inv(struct iser_conn *iser_conn,
+
+ if (iser_task->dir[ISER_DIR_IN]) {
+ desc = iser_task->rdma_reg[ISER_DIR_IN].mem_h;
+- iser_inv_desc(desc, rkey);
++ if (unlikely(iser_inv_desc(desc, rkey)))
++ return -EINVAL;
+ }
+
+ if (iser_task->dir[ISER_DIR_OUT]) {
+ desc = iser_task->rdma_reg[ISER_DIR_OUT].mem_h;
+- iser_inv_desc(desc, rkey);
++ if (unlikely(iser_inv_desc(desc, rkey)))
++ return -EINVAL;
+ }
+ } else {
+ iser_err("failed to get task for itt=%d\n", hdr->itt);
+diff --git a/drivers/input/ff-memless.c b/drivers/input/ff-memless.c
+index 2743ed4656e4..1cd23bf3236c 100644
+--- a/drivers/input/ff-memless.c
++++ b/drivers/input/ff-memless.c
+@@ -501,6 +501,15 @@ static void ml_ff_destroy(struct ff_device *ff)
+ {
+ struct ml_device *ml = ff->private;
+
++ /*
++ * Even though we stop all playing effects when tearing down
++ * an input device (via input_device_flush() that calls into
++ * input_ff_flush() that stops and erases all effects), we
++ * do not actually stop the timer, and therefore we should
++ * do it here.
++ */
++ del_timer_sync(&ml->timer);
++
+ kfree(ml->private);
+ }
+
+diff --git a/drivers/input/rmi4/rmi_f11.c b/drivers/input/rmi4/rmi_f11.c
+index 93901ebd122a..c8e07ea2422b 100644
+--- a/drivers/input/rmi4/rmi_f11.c
++++ b/drivers/input/rmi4/rmi_f11.c
+@@ -1287,8 +1287,8 @@ static irqreturn_t rmi_f11_attention(int irq, void *ctx)
+ valid_bytes = f11->sensor.attn_size;
+ memcpy(f11->sensor.data_pkt, drvdata->attn_data.data,
+ valid_bytes);
+- drvdata->attn_data.data += f11->sensor.attn_size;
+- drvdata->attn_data.size -= f11->sensor.attn_size;
++ drvdata->attn_data.data += valid_bytes;
++ drvdata->attn_data.size -= valid_bytes;
+ } else {
+ error = rmi_read_block(rmi_dev,
+ data_base_addr, f11->sensor.data_pkt,
+diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
+index 5c7f48915779..9066f2b70ff0 100644
+--- a/drivers/input/rmi4/rmi_f12.c
++++ b/drivers/input/rmi4/rmi_f12.c
+@@ -58,6 +58,9 @@ struct f12_data {
+
+ const struct rmi_register_desc_item *data15;
+ u16 data15_offset;
++
++ unsigned long *abs_mask;
++ unsigned long *rel_mask;
+ };
+
+ static int rmi_f12_read_sensor_tuning(struct f12_data *f12)
+@@ -214,8 +217,8 @@ static irqreturn_t rmi_f12_attention(int irq, void *ctx)
+ valid_bytes = sensor->attn_size;
+ memcpy(sensor->data_pkt, drvdata->attn_data.data,
+ valid_bytes);
+- drvdata->attn_data.data += sensor->attn_size;
+- drvdata->attn_data.size -= sensor->attn_size;
++ drvdata->attn_data.data += valid_bytes;
++ drvdata->attn_data.size -= valid_bytes;
+ } else {
+ retval = rmi_read_block(rmi_dev, f12->data_addr,
+ sensor->data_pkt, sensor->pkt_size);
+@@ -296,9 +299,18 @@ static int rmi_f12_write_control_regs(struct rmi_function *fn)
+ static int rmi_f12_config(struct rmi_function *fn)
+ {
+ struct rmi_driver *drv = fn->rmi_dev->driver;
++ struct f12_data *f12 = dev_get_drvdata(&fn->dev);
++ struct rmi_2d_sensor *sensor;
+ int ret;
+
+- drv->set_irq_bits(fn->rmi_dev, fn->irq_mask);
++ sensor = &f12->sensor;
++
++ if (!sensor->report_abs)
++ drv->clear_irq_bits(fn->rmi_dev, f12->abs_mask);
++ else
++ drv->set_irq_bits(fn->rmi_dev, f12->abs_mask);
++
++ drv->clear_irq_bits(fn->rmi_dev, f12->rel_mask);
+
+ ret = rmi_f12_write_control_regs(fn);
+ if (ret)
+@@ -320,9 +332,12 @@ static int rmi_f12_probe(struct rmi_function *fn)
+ struct rmi_device_platform_data *pdata = rmi_get_platform_data(rmi_dev);
+ struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev);
+ u16 data_offset = 0;
++ int mask_size;
+
+ rmi_dbg(RMI_DEBUG_FN, &fn->dev, "%s\n", __func__);
+
++ mask_size = BITS_TO_LONGS(drvdata->irq_count) * sizeof(unsigned long);
++
+ ret = rmi_read(fn->rmi_dev, query_addr, &buf);
+ if (ret < 0) {
+ dev_err(&fn->dev, "Failed to read general info register: %d\n",
+@@ -337,10 +352,19 @@ static int rmi_f12_probe(struct rmi_function *fn)
+ return -ENODEV;
+ }
+
+- f12 = devm_kzalloc(&fn->dev, sizeof(struct f12_data), GFP_KERNEL);
++ f12 = devm_kzalloc(&fn->dev, sizeof(struct f12_data) + mask_size * 2,
++ GFP_KERNEL);
+ if (!f12)
+ return -ENOMEM;
+
++ f12->abs_mask = (unsigned long *)((char *)f12
++ + sizeof(struct f12_data));
++ f12->rel_mask = (unsigned long *)((char *)f12
++ + sizeof(struct f12_data) + mask_size);
++
++ set_bit(fn->irq_pos, f12->abs_mask);
++ set_bit(fn->irq_pos + 1, f12->rel_mask);
++
+ f12->has_dribble = !!(buf & BIT(3));
+
+ if (fn->dev.of_node) {
+diff --git a/drivers/input/rmi4/rmi_f54.c b/drivers/input/rmi4/rmi_f54.c
+index a6f515bcab22..539a47425fcd 100644
+--- a/drivers/input/rmi4/rmi_f54.c
++++ b/drivers/input/rmi4/rmi_f54.c
+@@ -362,7 +362,7 @@ static const struct vb2_ops rmi_f54_queue_ops = {
+ static const struct vb2_queue rmi_f54_queue = {
+ .type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
+ .io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF | VB2_READ,
+- .buf_struct_size = sizeof(struct vb2_buffer),
++ .buf_struct_size = sizeof(struct vb2_v4l2_buffer),
+ .ops = &rmi_f54_queue_ops,
+ .mem_ops = &vb2_vmalloc_memops,
+ .timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC,
+@@ -614,7 +614,7 @@ static int rmi_f54_config(struct rmi_function *fn)
+ {
+ struct rmi_driver *drv = fn->rmi_dev->driver;
+
+- drv->set_irq_bits(fn->rmi_dev, fn->irq_mask);
++ drv->clear_irq_bits(fn->rmi_dev, fn->irq_mask);
+
+ return 0;
+ }
+@@ -742,6 +742,7 @@ static void rmi_f54_remove(struct rmi_function *fn)
+
+ video_unregister_device(&f54->vdev);
+ v4l2_device_unregister(&f54->v4l2);
++ destroy_workqueue(f54->workqueue);
+ }
+
+ struct rmi_function_handler rmi_f54_handler = {
+diff --git a/drivers/media/i2c/ov13858.c b/drivers/media/i2c/ov13858.c
+index a66f6201f53c..0e7a85c4996c 100644
+--- a/drivers/media/i2c/ov13858.c
++++ b/drivers/media/i2c/ov13858.c
+@@ -1230,7 +1230,7 @@ static int ov13858_set_ctrl(struct v4l2_ctrl *ctrl)
+ * Applying V4L2 control value only happens
+ * when power is up for streaming
+ */
+- if (pm_runtime_get_if_in_use(&client->dev) <= 0)
++ if (!pm_runtime_get_if_in_use(&client->dev))
+ return 0;
+
+ ret = 0;
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index f753a1c333ef..d8798fb714ba 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -568,10 +568,6 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
+ if (ret < 0)
+ return ret;
+
+- ret = ov2680_mode_restore(sensor);
+- if (ret < 0)
+- goto disable;
+-
+ sensor->is_enabled = true;
+
+ /* Set clock lane into LP-11 state */
+@@ -580,12 +576,6 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
+ ov2680_stream_disable(sensor);
+
+ return 0;
+-
+-disable:
+- dev_err(dev, "failed to enable sensor: %d\n", ret);
+- ov2680_power_off(sensor);
+-
+- return ret;
+ }
+
+ static int ov2680_s_power(struct v4l2_subdev *sd, int on)
+@@ -606,6 +596,8 @@ static int ov2680_s_power(struct v4l2_subdev *sd, int on)
+ ret = v4l2_ctrl_handler_setup(&sensor->ctrls.handler);
+ if (ret < 0)
+ return ret;
++
++ ret = ov2680_mode_restore(sensor);
+ }
+
+ return ret;
+@@ -1088,26 +1080,20 @@ static int ov2680_probe(struct i2c_client *client)
+
+ mutex_init(&sensor->lock);
+
+- ret = ov2680_v4l2_init(sensor);
++ ret = ov2680_check_id(sensor);
+ if (ret < 0)
+ goto lock_destroy;
+
+- ret = ov2680_check_id(sensor);
++ ret = ov2680_v4l2_init(sensor);
+ if (ret < 0)
+- goto error_cleanup;
++ goto lock_destroy;
+
+ dev_info(dev, "ov2680 init correctly\n");
+
+ return 0;
+
+-error_cleanup:
+- dev_err(dev, "ov2680 init fail: %d\n", ret);
+-
+- media_entity_cleanup(&sensor->sd.entity);
+- v4l2_async_unregister_subdev(&sensor->sd);
+- v4l2_ctrl_handler_free(&sensor->ctrls.handler);
+-
+ lock_destroy:
++ dev_err(dev, "ov2680 init fail: %d\n", ret);
+ mutex_destroy(&sensor->lock);
+
+ return ret;
+diff --git a/drivers/media/i2c/ov2685.c b/drivers/media/i2c/ov2685.c
+index 385c1886a947..98a1f2e312b5 100644
+--- a/drivers/media/i2c/ov2685.c
++++ b/drivers/media/i2c/ov2685.c
+@@ -549,7 +549,7 @@ static int ov2685_set_ctrl(struct v4l2_ctrl *ctrl)
+ break;
+ }
+
+- if (pm_runtime_get_if_in_use(&client->dev) <= 0)
++ if (!pm_runtime_get_if_in_use(&client->dev))
+ return 0;
+
+ switch (ctrl->id) {
+diff --git a/drivers/media/i2c/ov5670.c b/drivers/media/i2c/ov5670.c
+index 7b7c74d77370..53dd30d96e69 100644
+--- a/drivers/media/i2c/ov5670.c
++++ b/drivers/media/i2c/ov5670.c
+@@ -2016,7 +2016,7 @@ static int ov5670_set_ctrl(struct v4l2_ctrl *ctrl)
+ }
+
+ /* V4L2 controls values will be applied only when power is already up */
+- if (pm_runtime_get_if_in_use(&client->dev) <= 0)
++ if (!pm_runtime_get_if_in_use(&client->dev))
+ return 0;
+
+ switch (ctrl->id) {
+diff --git a/drivers/media/i2c/ov5695.c b/drivers/media/i2c/ov5695.c
+index 9a80decd93d3..5d107c53364d 100644
+--- a/drivers/media/i2c/ov5695.c
++++ b/drivers/media/i2c/ov5695.c
+@@ -1110,7 +1110,7 @@ static int ov5695_set_ctrl(struct v4l2_ctrl *ctrl)
+ break;
+ }
+
+- if (pm_runtime_get_if_in_use(&client->dev) <= 0)
++ if (!pm_runtime_get_if_in_use(&client->dev))
+ return 0;
+
+ switch (ctrl->id) {
+diff --git a/drivers/media/i2c/ov772x.c b/drivers/media/i2c/ov772x.c
+index 7158c31d8403..4eae5f2f7d31 100644
+--- a/drivers/media/i2c/ov772x.c
++++ b/drivers/media/i2c/ov772x.c
+@@ -896,6 +896,7 @@ static int ov772x_power_on(struct ov772x_priv *priv)
+ GPIOD_OUT_LOW);
+ if (IS_ERR(priv->rstb_gpio)) {
+ dev_info(&client->dev, "Unable to get GPIO \"reset\"");
++ clk_disable_unprepare(priv->clk);
+ return PTR_ERR(priv->rstb_gpio);
+ }
+
+diff --git a/drivers/media/i2c/ov7740.c b/drivers/media/i2c/ov7740.c
+index 8a6a7a5929aa..7804013934ab 100644
+--- a/drivers/media/i2c/ov7740.c
++++ b/drivers/media/i2c/ov7740.c
+@@ -510,7 +510,7 @@ static int ov7740_set_ctrl(struct v4l2_ctrl *ctrl)
+ int ret;
+ u8 val = 0;
+
+- if (pm_runtime_get_if_in_use(&client->dev) <= 0)
++ if (!pm_runtime_get_if_in_use(&client->dev))
+ return 0;
+
+ switch (ctrl->id) {
+diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c
+index 44936d6d7c39..1380474519f2 100644
+--- a/drivers/media/pci/ivtv/ivtv-yuv.c
++++ b/drivers/media/pci/ivtv/ivtv-yuv.c
+@@ -935,7 +935,7 @@ static void ivtv_yuv_init(struct ivtv *itv)
+ }
+
+ /* We need a buffer for blanking when Y plane is offset - non-fatal if we can't get one */
+- yi->blanking_ptr = kzalloc(720 * 16, GFP_KERNEL|__GFP_NOWARN);
++ yi->blanking_ptr = kzalloc(720 * 16, GFP_ATOMIC|__GFP_NOWARN);
+ if (yi->blanking_ptr) {
+ yi->blanking_dmaptr = pci_map_single(itv->pdev, yi->blanking_ptr, 720*16, PCI_DMA_TODEVICE);
+ } else {
+diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c
+index 8001d3e9134e..db2a7ad1e523 100644
+--- a/drivers/media/pci/meye/meye.c
++++ b/drivers/media/pci/meye/meye.c
+@@ -1460,7 +1460,7 @@ static int meye_mmap(struct file *file, struct vm_area_struct *vma)
+ unsigned long page, pos;
+
+ mutex_lock(&meye.lock);
+- if (size > gbuffers * gbufsize) {
++ if (size > gbuffers * gbufsize || offset > gbuffers * gbufsize - size) {
+ mutex_unlock(&meye.lock);
+ return -EINVAL;
+ }
+diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c
+index b0eb3d899eb4..6f8269352433 100644
+--- a/drivers/media/platform/davinci/vpbe_display.c
++++ b/drivers/media/platform/davinci/vpbe_display.c
+@@ -521,7 +521,7 @@ vpbe_disp_calculate_scale_factor(struct vpbe_display *disp_dev,
+ else if (v_scale == 4)
+ layer_info->v_zoom = ZOOM_X4;
+ if (v_exp)
+- layer_info->h_exp = V_EXP_6_OVER_5;
++ layer_info->v_exp = V_EXP_6_OVER_5;
+ } else {
+ /* no scaling, only cropping. Set display area to crop area */
+ cfg->ysize = expected_ysize;
+diff --git a/drivers/media/platform/vicodec/vicodec-codec.c b/drivers/media/platform/vicodec/vicodec-codec.c
+index 2d047646f614..d854b2344f12 100644
+--- a/drivers/media/platform/vicodec/vicodec-codec.c
++++ b/drivers/media/platform/vicodec/vicodec-codec.c
+@@ -588,8 +588,14 @@ static void fill_decoder_block(u8 *dst, const s16 *input, int stride)
+ int i, j;
+
+ for (i = 0; i < 8; i++) {
+- for (j = 0; j < 8; j++)
+- *dst++ = *input++;
++ for (j = 0; j < 8; j++, input++, dst++) {
++ if (*input < 0)
++ *dst = 0;
++ else if (*input > 255)
++ *dst = 255;
++ else
++ *dst = *input;
++ }
+ dst += stride - 8;
+ }
+ }
+diff --git a/drivers/media/platform/vsp1/vsp1_drm.c b/drivers/media/platform/vsp1/vsp1_drm.c
+index b9c0f695d002..8d86f618ec77 100644
+--- a/drivers/media/platform/vsp1/vsp1_drm.c
++++ b/drivers/media/platform/vsp1/vsp1_drm.c
+@@ -770,6 +770,7 @@ int vsp1_du_atomic_update(struct device *dev, unsigned int pipe_index,
+ struct vsp1_device *vsp1 = dev_get_drvdata(dev);
+ struct vsp1_drm_pipeline *drm_pipe = &vsp1->drm->pipe[pipe_index];
+ const struct vsp1_format_info *fmtinfo;
++ unsigned int chroma_hsub;
+ struct vsp1_rwpf *rpf;
+
+ if (rpf_index >= vsp1->info->rpf_count)
+@@ -810,10 +811,18 @@ int vsp1_du_atomic_update(struct device *dev, unsigned int pipe_index,
+ return -EINVAL;
+ }
+
++ /*
++ * Only formats with three planes can affect the chroma planes pitch.
++ * All formats with two planes have a horizontal subsampling value of 2,
++ * but combine U and V in a single chroma plane, which thus results in
++ * the luma plane and chroma plane having the same pitch.
++ */
++ chroma_hsub = (fmtinfo->planes == 3) ? fmtinfo->hsub : 1;
++
+ rpf->fmtinfo = fmtinfo;
+ rpf->format.num_planes = fmtinfo->planes;
+ rpf->format.plane_fmt[0].bytesperline = cfg->pitch;
+- rpf->format.plane_fmt[1].bytesperline = cfg->pitch;
++ rpf->format.plane_fmt[1].bytesperline = cfg->pitch / chroma_hsub;
+ rpf->alpha = cfg->alpha;
+
+ rpf->mem.addr[0] = cfg->mem[0];
+diff --git a/drivers/media/platform/vsp1/vsp1_regs.h b/drivers/media/platform/vsp1/vsp1_regs.h
+index 3738ff2f7b85..f6e4157095cc 100644
+--- a/drivers/media/platform/vsp1/vsp1_regs.h
++++ b/drivers/media/platform/vsp1/vsp1_regs.h
+@@ -1,4 +1,4 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
++/* SPDX-License-Identifier: GPL-2.0+ */
+ /*
+ * vsp1_regs.h -- R-Car VSP1 Registers Definitions
+ *
+diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
+index e3f63299f85c..07e3322bb182 100644
+--- a/drivers/media/usb/au0828/au0828-core.c
++++ b/drivers/media/usb/au0828/au0828-core.c
+@@ -632,7 +632,7 @@ static int au0828_usb_probe(struct usb_interface *interface,
+ /* Analog TV */
+ retval = au0828_analog_register(dev, interface);
+ if (retval) {
+- pr_err("%s() au0282_dev_register failed to register on V4L2\n",
++ pr_err("%s() au0828_analog_register failed to register on V4L2\n",
+ __func__);
+ mutex_unlock(&dev->lock);
+ goto done;
+@@ -641,7 +641,7 @@ static int au0828_usb_probe(struct usb_interface *interface,
+ /* Digital TV */
+ retval = au0828_dvb_register(dev);
+ if (retval)
+- pr_err("%s() au0282_dev_register failed\n",
++ pr_err("%s() au0828_dvb_register failed\n",
+ __func__);
+
+ /* Remote controller */
+diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
+index f68435df76d4..22301bba8c49 100644
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -298,7 +298,7 @@ static int genwqe_sgl_size(int num_pages)
+ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ void __user *user_addr, size_t user_size, int write)
+ {
+- int rc;
++ int ret = -ENOMEM;
+ struct pci_dev *pci_dev = cd->pci_dev;
+
+ sgl->fpage_offs = offset_in_page((unsigned long)user_addr);
+@@ -318,7 +318,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ if (get_order(sgl->sgl_size) > MAX_ORDER) {
+ dev_err(&pci_dev->dev,
+ "[%s] err: too much memory requested!\n", __func__);
+- return -ENOMEM;
++ return ret;
+ }
+
+ sgl->sgl = __genwqe_alloc_consistent(cd, sgl->sgl_size,
+@@ -326,7 +326,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ if (sgl->sgl == NULL) {
+ dev_err(&pci_dev->dev,
+ "[%s] err: no memory available!\n", __func__);
+- return -ENOMEM;
++ return ret;
+ }
+
+ /* Only use buffering on incomplete pages */
+@@ -339,7 +339,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ /* Sync with user memory */
+ if (copy_from_user(sgl->fpage + sgl->fpage_offs,
+ user_addr, sgl->fpage_size)) {
+- rc = -EFAULT;
++ ret = -EFAULT;
+ goto err_out;
+ }
+ }
+@@ -352,7 +352,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ /* Sync with user memory */
+ if (copy_from_user(sgl->lpage, user_addr + user_size -
+ sgl->lpage_size, sgl->lpage_size)) {
+- rc = -EFAULT;
++ ret = -EFAULT;
+ goto err_out2;
+ }
+ }
+@@ -374,7 +374,8 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ sgl->sgl = NULL;
+ sgl->sgl_dma_addr = 0;
+ sgl->sgl_size = 0;
+- return -ENOMEM;
++
++ return ret;
+ }
+
+ int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index eb4d90b7d99e..8b01257783dd 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -985,6 +985,12 @@ static void kgdbts_run_tests(void)
+ int nmi_sleep = 0;
+ int i;
+
++ verbose = 0;
++ if (strstr(config, "V1"))
++ verbose = 1;
++ if (strstr(config, "V2"))
++ verbose = 2;
++
+ ptr = strchr(config, 'F');
+ if (ptr)
+ fork_test = simple_strtol(ptr + 1, NULL, 10);
+@@ -1068,13 +1074,6 @@ static int kgdbts_option_setup(char *opt)
+ return -ENOSPC;
+ }
+ strcpy(config, opt);
+-
+- verbose = 0;
+- if (strstr(config, "V1"))
+- verbose = 1;
+- if (strstr(config, "V2"))
+- verbose = 2;
+-
+ return 0;
+ }
+
+@@ -1086,9 +1085,6 @@ static int configure_kgdbts(void)
+
+ if (!strlen(config) || isspace(config[0]))
+ goto noconfig;
+- err = kgdbts_option_setup(config);
+- if (err)
+- goto noconfig;
+
+ final_ack = 0;
+ run_plant_and_detach_test(1);
+diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
+index e284102c16e9..1ebcf0eb781e 100644
+--- a/drivers/mmc/host/sdhci-of-at91.c
++++ b/drivers/mmc/host/sdhci-of-at91.c
+@@ -366,7 +366,7 @@ static int sdhci_at91_probe(struct platform_device *pdev)
+ pm_runtime_use_autosuspend(&pdev->dev);
+
+ /* HS200 is broken at this moment */
+- host->quirks2 = SDHCI_QUIRK2_BROKEN_HS200;
++ host->quirks2 |= SDHCI_QUIRK2_BROKEN_HS200;
+
+ ret = sdhci_add_host(host);
+ if (ret)
+diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+index 24f59d0066af..7e7729df7827 100644
+--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+@@ -30,6 +30,7 @@
+ #include <linux/mtd/partitions.h>
+ #include <linux/mtd/nand_ecc.h>
+ #include <linux/fsl_ifc.h>
++#include <linux/iopoll.h>
+
+ #define ERR_BYTE 0xFF /* Value returned for read
+ bytes when read failed */
+@@ -761,7 +762,7 @@ static const struct nand_controller_ops fsl_ifc_controller_ops = {
+ .attach_chip = fsl_ifc_attach_chip,
+ };
+
+-static void fsl_ifc_sram_init(struct fsl_ifc_mtd *priv)
++static int fsl_ifc_sram_init(struct fsl_ifc_mtd *priv)
+ {
+ struct fsl_ifc_ctrl *ctrl = priv->ctrl;
+ struct fsl_ifc_runtime __iomem *ifc_runtime = ctrl->rregs;
+@@ -769,6 +770,27 @@ static void fsl_ifc_sram_init(struct fsl_ifc_mtd *priv)
+ uint32_t csor = 0, csor_8k = 0, csor_ext = 0;
+ uint32_t cs = priv->bank;
+
++ if (ctrl->version < FSL_IFC_VERSION_1_1_0)
++ return 0;
++
++ if (ctrl->version > FSL_IFC_VERSION_1_1_0) {
++ u32 ncfgr, status;
++ int ret;
++
++ /* Trigger auto initialization */
++ ncfgr = ifc_in32(&ifc_runtime->ifc_nand.ncfgr);
++ ifc_out32(ncfgr | IFC_NAND_NCFGR_SRAM_INIT_EN, &ifc_runtime->ifc_nand.ncfgr);
++
++ /* Wait until done */
++ ret = readx_poll_timeout(ifc_in32, &ifc_runtime->ifc_nand.ncfgr,
++ status, !(status & IFC_NAND_NCFGR_SRAM_INIT_EN),
++ 10, IFC_TIMEOUT_MSECS * 1000);
++ if (ret)
++ dev_err(priv->dev, "Failed to initialize SRAM!\n");
++
++ return ret;
++ }
++
+ /* Save CSOR and CSOR_ext */
+ csor = ifc_in32(&ifc_global->csor_cs[cs].csor);
+ csor_ext = ifc_in32(&ifc_global->csor_cs[cs].csor_ext);
+@@ -805,12 +827,16 @@ static void fsl_ifc_sram_init(struct fsl_ifc_mtd *priv)
+ wait_event_timeout(ctrl->nand_wait, ctrl->nand_stat,
+ msecs_to_jiffies(IFC_TIMEOUT_MSECS));
+
+- if (ctrl->nand_stat != IFC_NAND_EVTER_STAT_OPC)
++ if (ctrl->nand_stat != IFC_NAND_EVTER_STAT_OPC) {
+ pr_err("fsl-ifc: Failed to Initialise SRAM\n");
++ return -ETIMEDOUT;
++ }
+
+ /* Restore CSOR and CSOR_ext */
+ ifc_out32(csor, &ifc_global->csor_cs[cs].csor);
+ ifc_out32(csor_ext, &ifc_global->csor_cs[cs].csor_ext);
++
++ return 0;
+ }
+
+ static int fsl_ifc_chip_init(struct fsl_ifc_mtd *priv)
+@@ -821,6 +847,7 @@ static int fsl_ifc_chip_init(struct fsl_ifc_mtd *priv)
+ struct nand_chip *chip = &priv->chip;
+ struct mtd_info *mtd = nand_to_mtd(&priv->chip);
+ u32 csor;
++ int ret;
+
+ /* Fill in fsl_ifc_mtd structure */
+ mtd->dev.parent = priv->dev;
+@@ -914,8 +941,9 @@ static int fsl_ifc_chip_init(struct fsl_ifc_mtd *priv)
+ chip->ecc.algo = NAND_ECC_HAMMING;
+ }
+
+- if (ctrl->version >= FSL_IFC_VERSION_1_1_0)
+- fsl_ifc_sram_init(priv);
++ ret = fsl_ifc_sram_init(priv);
++ if (ret)
++ return ret;
+
+ /*
+ * As IFC version 2.0.0 has 16KB of internal SRAM as compared to older
+diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
+index 9c90695a885f..7a84a8f05b46 100644
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -2710,24 +2710,23 @@ static int marvell_nfc_init(struct marvell_nfc *nfc)
+ struct regmap *sysctrl_base =
+ syscon_regmap_lookup_by_phandle(np,
+ "marvell,system-controller");
+- u32 reg;
+
+ if (IS_ERR(sysctrl_base))
+ return PTR_ERR(sysctrl_base);
+
+- reg = GENCONF_SOC_DEVICE_MUX_NFC_EN |
+- GENCONF_SOC_DEVICE_MUX_ECC_CLK_RST |
+- GENCONF_SOC_DEVICE_MUX_ECC_CORE_RST |
+- GENCONF_SOC_DEVICE_MUX_NFC_INT_EN;
+- regmap_write(sysctrl_base, GENCONF_SOC_DEVICE_MUX, reg);
++ regmap_write(sysctrl_base, GENCONF_SOC_DEVICE_MUX,
++ GENCONF_SOC_DEVICE_MUX_NFC_EN |
++ GENCONF_SOC_DEVICE_MUX_ECC_CLK_RST |
++ GENCONF_SOC_DEVICE_MUX_ECC_CORE_RST |
++ GENCONF_SOC_DEVICE_MUX_NFC_INT_EN);
+
+- regmap_read(sysctrl_base, GENCONF_CLK_GATING_CTRL, ®);
+- reg |= GENCONF_CLK_GATING_CTRL_ND_GATE;
+- regmap_write(sysctrl_base, GENCONF_CLK_GATING_CTRL, reg);
++ regmap_update_bits(sysctrl_base, GENCONF_CLK_GATING_CTRL,
++ GENCONF_CLK_GATING_CTRL_ND_GATE,
++ GENCONF_CLK_GATING_CTRL_ND_GATE);
+
+- regmap_read(sysctrl_base, GENCONF_ND_CLK_CTRL, ®);
+- reg |= GENCONF_ND_CLK_CTRL_EN;
+- regmap_write(sysctrl_base, GENCONF_ND_CLK_CTRL, reg);
++ regmap_update_bits(sysctrl_base, GENCONF_ND_CLK_CTRL,
++ GENCONF_ND_CLK_CTRL_EN,
++ GENCONF_ND_CLK_CTRL_EN);
+ }
+
+ /* Configure the DMA if appropriate */
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index 880e75f63a19..07d8750313fd 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -23,7 +23,6 @@
+ #include <linux/of_device.h>
+ #include <linux/delay.h>
+ #include <linux/dma/qcom_bam_dma.h>
+-#include <linux/dma-direct.h> /* XXX: drivers shall never use this directly! */
+
+ /* NANDc reg offsets */
+ #define NAND_FLASH_CMD 0x00
+diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
+index aa97dbc797b6..5d338b2ac39e 100644
+--- a/drivers/net/can/slcan.c
++++ b/drivers/net/can/slcan.c
+@@ -613,6 +613,7 @@ err_free_chan:
+ sl->tty = NULL;
+ tty->disc_data = NULL;
+ clear_bit(SLF_INUSE, &sl->flags);
++ free_netdev(sl->dev);
+
+ err_exit:
+ rtnl_unlock();
+diff --git a/drivers/net/ethernet/amd/am79c961a.c b/drivers/net/ethernet/amd/am79c961a.c
+index 01d132c02ff9..265039c57023 100644
+--- a/drivers/net/ethernet/amd/am79c961a.c
++++ b/drivers/net/ethernet/amd/am79c961a.c
+@@ -440,7 +440,7 @@ static void am79c961_timeout(struct net_device *dev)
+ /*
+ * Transmit a packet
+ */
+-static int
++static netdev_tx_t
+ am79c961_sendpacket(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct dev_priv *priv = netdev_priv(dev);
+diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c
+index c5b81268c284..d3d44e07afbc 100644
+--- a/drivers/net/ethernet/amd/atarilance.c
++++ b/drivers/net/ethernet/amd/atarilance.c
+@@ -339,7 +339,8 @@ static unsigned long lance_probe1( struct net_device *dev, struct lance_addr
+ *init_rec );
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t lance_interrupt( int irq, void *dev_id );
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -769,7 +770,8 @@ static void lance_tx_timeout (struct net_device *dev)
+
+ /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t
++lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ struct lance_ioreg *IO = lp->iobase;
+diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c
+index 00332a1ea84b..9f23703dd509 100644
+--- a/drivers/net/ethernet/amd/declance.c
++++ b/drivers/net/ethernet/amd/declance.c
+@@ -894,7 +894,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ volatile struct lance_regs *ll = lp->ll;
+diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c
+index 77b1db267730..da7e3d4f4166 100644
+--- a/drivers/net/ethernet/amd/sun3lance.c
++++ b/drivers/net/ethernet/amd/sun3lance.c
+@@ -236,7 +236,8 @@ struct lance_private {
+ static int lance_probe( struct net_device *dev);
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t lance_interrupt( int irq, void *dev_id);
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -511,7 +512,8 @@ static void lance_init_ring( struct net_device *dev )
+ }
+
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t
++lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, len;
+diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
+index 19f89d9b1781..9d4899826823 100644
+--- a/drivers/net/ethernet/amd/sunlance.c
++++ b/drivers/net/ethernet/amd/sunlance.c
+@@ -1106,7 +1106,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, skblen, len;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 24f1053b8785..d96a84a62d78 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -2009,7 +2009,7 @@ static int xgbe_close(struct net_device *netdev)
+ return 0;
+ }
+
+-static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct xgbe_prv_data *pdata = netdev_priv(netdev);
+ struct xgbe_hw_if *hw_if = &pdata->hw_if;
+@@ -2018,7 +2018,7 @@ static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
+ struct xgbe_ring *ring;
+ struct xgbe_packet_data *packet;
+ struct netdev_queue *txq;
+- int ret;
++ netdev_tx_t ret;
+
+ DBGPR("-->xgbe_xmit: skb->len = %d\n", skb->len);
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+index 10ec5dc88e24..5502ec5f0f69 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+@@ -1468,3 +1468,11 @@ void hw_atl_reg_glb_cpu_scratch_scp_set(struct aq_hw_s *aq_hw,
+ aq_hw_write_reg(aq_hw, HW_ATL_GLB_CPU_SCRATCH_SCP_ADR(scratch_scp),
+ glb_cpu_scratch_scp);
+ }
++
++void hw_atl_mcp_up_force_intr_set(struct aq_hw_s *aq_hw, u32 up_force_intr)
++{
++ aq_hw_write_reg_bit(aq_hw, HW_ATL_MCP_UP_FORCE_INTERRUPT_ADR,
++ HW_ATL_MCP_UP_FORCE_INTERRUPT_MSK,
++ HW_ATL_MCP_UP_FORCE_INTERRUPT_SHIFT,
++ up_force_intr);
++}
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+index b3bf64b48b93..41f239928c15 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+@@ -701,4 +701,7 @@ void hw_atl_msm_reg_wr_strobe_set(struct aq_hw_s *aq_hw, u32 reg_wr_strobe);
+ /* set pci register reset disable */
+ void hw_atl_pci_pci_reg_res_dis_set(struct aq_hw_s *aq_hw, u32 pci_reg_res_dis);
+
++/* set uP Force Interrupt */
++void hw_atl_mcp_up_force_intr_set(struct aq_hw_s *aq_hw, u32 up_force_intr);
++
+ #endif /* HW_ATL_LLH_H */
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+index e2ecdb1c5a5c..a715fa317b1c 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+@@ -2405,4 +2405,17 @@
+ #define HW_ATL_GLB_CPU_SCRATCH_SCP_ADR(scratch_scp) \
+ (0x00000300u + (scratch_scp) * 0x4)
+
++/* register address for bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_ADR 0x00000404
++/* bitmask for bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_MSK 0x00000002
++/* inverted bitmask for bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_MSKN 0xFFFFFFFD
++/* lower bit position of bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_SHIFT 1
++/* width of bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_WIDTH 1
++/* default value of bitfield uP Force Interrupt */
++#define HW_ATL_MCP_UP_FORCE_INTERRUPT_DEFAULT 0x0
++
+ #endif /* HW_ATL_LLH_INTERNAL_H */
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+index 9939ccaeb125..096ec18e8f15 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+@@ -327,17 +327,31 @@ static int hw_atl_utils_fw_upload_dwords(struct aq_hw_s *self, u32 a, u32 *p,
+ err = -ETIME;
+ goto err_exit;
+ }
++ if (IS_CHIP_FEATURE(REVISION_B1)) {
++ u32 offset = 0;
++
++ for (; offset < cnt; ++offset) {
++ aq_hw_write_reg(self, 0x328, p[offset]);
++ aq_hw_write_reg(self, 0x32C,
++ (0x80000000 | (0xFFFF & (offset * 4))));
++ hw_atl_mcp_up_force_intr_set(self, 1);
++ /* 1000 times by 10us = 10ms */
++ AQ_HW_WAIT_FOR((aq_hw_read_reg(self,
++ 0x32C) & 0xF0000000) !=
++ 0x80000000,
++ 10, 1000);
++ }
++ } else {
++ u32 offset = 0;
+
+- aq_hw_write_reg(self, 0x00000208U, a);
+-
+- for (++cnt; --cnt;) {
+- u32 i = 0U;
++ aq_hw_write_reg(self, 0x208, a);
+
+- aq_hw_write_reg(self, 0x0000020CU, *(p++));
+- aq_hw_write_reg(self, 0x00000200U, 0xC000U);
++ for (; offset < cnt; ++offset) {
++ aq_hw_write_reg(self, 0x20C, p[offset]);
++ aq_hw_write_reg(self, 0x200, 0xC000);
+
+- for (i = 1024U;
+- (0x100U & aq_hw_read_reg(self, 0x00000200U)) && --i;) {
++ AQ_HW_WAIT_FOR((aq_hw_read_reg(self, 0x200U) &
++ 0x100) == 0, 10, 1000);
+ }
+ }
+
+@@ -401,7 +415,7 @@ struct aq_hw_atl_utils_fw_rpc_tid_s {
+
+ #define hw_atl_utils_fw_rpc_init(_H_) hw_atl_utils_fw_rpc_wait(_H_, NULL)
+
+-static int hw_atl_utils_fw_rpc_call(struct aq_hw_s *self, unsigned int rpc_size)
++int hw_atl_utils_fw_rpc_call(struct aq_hw_s *self, unsigned int rpc_size)
+ {
+ int err = 0;
+ struct aq_hw_atl_utils_fw_rpc_tid_s sw;
+@@ -425,8 +439,8 @@ err_exit:
+ return err;
+ }
+
+-static int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self,
+- struct hw_aq_atl_utils_fw_rpc **rpc)
++int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self,
++ struct hw_aq_atl_utils_fw_rpc **rpc)
+ {
+ int err = 0;
+ struct aq_hw_atl_utils_fw_rpc_tid_s sw;
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+index b875590efcbd..505c8a2abd9c 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+@@ -319,6 +319,11 @@ struct aq_stats_s *hw_atl_utils_get_hw_stats(struct aq_hw_s *self);
+ int hw_atl_utils_fw_downld_dwords(struct aq_hw_s *self, u32 a,
+ u32 *p, u32 cnt);
+
++int hw_atl_utils_fw_rpc_call(struct aq_hw_s *self, unsigned int rpc_size);
++
++int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self,
++ struct hw_aq_atl_utils_fw_rpc **rpc);
++
+ extern const struct aq_fw_ops aq_fw_1x_ops;
+ extern const struct aq_fw_ops aq_fw_2x_ops;
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
+index e37943760a58..6300d94c9ff0 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils_fw2x.c
+@@ -21,6 +21,7 @@
+
+ #define HW_ATL_FW2X_MPI_EFUSE_ADDR 0x364
+ #define HW_ATL_FW2X_MPI_MBOX_ADDR 0x360
++#define HW_ATL_FW2X_MPI_RPC_ADDR 0x334
+
+ #define HW_ATL_FW2X_MPI_CONTROL_ADDR 0x368
+ #define HW_ATL_FW2X_MPI_CONTROL2_ADDR 0x36C
+@@ -40,6 +41,10 @@ static int aq_fw2x_init(struct aq_hw_s *self)
+ AQ_HW_WAIT_FOR(0U != (self->mbox_addr =
+ aq_hw_read_reg(self, HW_ATL_FW2X_MPI_MBOX_ADDR)),
+ 1000U, 10U);
++ AQ_HW_WAIT_FOR(0U != (self->rpc_addr =
++ aq_hw_read_reg(self, HW_ATL_FW2X_MPI_RPC_ADDR)),
++ 1000U, 100U);
++
+ return err;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+index 897302adc38e..50f8a377596e 100644
+--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+@@ -568,12 +568,13 @@ static irqreturn_t bcm_enet_isr_dma(int irq, void *dev_id)
+ /*
+ * tx request callback
+ */
+-static int bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bcm_enet_priv *priv;
+ struct bcm_enet_desc *desc;
+ u32 len_stat;
+- int ret;
++ netdev_tx_t ret;
+
+ priv = netdev_priv(dev);
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 68c62e32e882..af57568c922e 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -3540,6 +3540,16 @@ static void bnx2x_drv_info_iscsi_stat(struct bnx2x *bp)
+ */
+ static void bnx2x_config_mf_bw(struct bnx2x *bp)
+ {
++ /* Workaround for MFW bug.
++ * MFW is not supposed to generate BW attention in
++ * single function mode.
++ */
++ if (!IS_MF(bp)) {
++ DP(BNX2X_MSG_MCP,
++ "Ignoring MF BW config in single function mode\n");
++ return;
++ }
++
+ if (bp->link_vars.link_up) {
+ bnx2x_cmng_fns_init(bp, true, CMNG_FNS_MINMAX);
+ bnx2x_link_sync_notify(bp);
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index 0d527fa5de61..b0592fd4135b 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -226,11 +226,10 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ * capabilities, use that knowledge to also configure the
+ * Reverse MII interface correctly.
+ */
+- if ((dev->phydev->supported & PHY_BASIC_FEATURES) ==
+- PHY_BASIC_FEATURES)
+- port_ctrl = PORT_MODE_EXT_RVMII_25;
+- else
++ if (dev->phydev->supported & PHY_1000BT_FEATURES)
+ port_ctrl = PORT_MODE_EXT_RVMII_50;
++ else
++ port_ctrl = PORT_MODE_EXT_RVMII_25;
+ bcmgenet_sys_writel(priv, port_ctrl, SYS_PORT_CTRL);
+ break;
+
+diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c
+index ef4a0c326736..7e3f9642ba6c 100644
+--- a/drivers/net/ethernet/broadcom/sb1250-mac.c
++++ b/drivers/net/ethernet/broadcom/sb1250-mac.c
+@@ -299,7 +299,7 @@ static enum sbmac_state sbmac_set_channel_state(struct sbmac_softc *,
+ static void sbmac_promiscuous_mode(struct sbmac_softc *sc, int onoff);
+ static uint64_t sbmac_addr2reg(unsigned char *ptr);
+ static irqreturn_t sbmac_intr(int irq, void *dev_instance);
+-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev);
+ static void sbmac_setmulti(struct sbmac_softc *sc);
+ static int sbmac_init(struct platform_device *pldev, long long base);
+ static int sbmac_set_speed(struct sbmac_softc *s, enum sbmac_speed speed);
+@@ -2028,7 +2028,7 @@ static irqreturn_t sbmac_intr(int irq,void *dev_instance)
+ * Return value:
+ * nothing
+ ********************************************************************* */
+-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct sbmac_softc *sc = netdev_priv(dev);
+ unsigned long flags;
+diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
+index 6fb13fa73b27..304e4b943627 100644
+--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
++++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
+@@ -2324,7 +2324,7 @@ static inline int send_nic_timestamp_pkt(struct octeon_device *oct,
+ * @returns whether the packet was transmitted to the device okay or not
+ * (NETDEV_TX_OK or NETDEV_TX_BUSY)
+ */
+-static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct lio *lio;
+ struct octnet_buf_free_info *finfo;
+diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
+index b77835724dc8..d83773bc0dd7 100644
+--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
++++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
+@@ -1390,7 +1390,7 @@ static int send_nic_timestamp_pkt(struct octeon_device *oct,
+ * @returns whether the packet was transmitted to the device okay or not
+ * (NETDEV_TX_OK or NETDEV_TX_BUSY)
+ */
+-static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct octnet_buf_free_info *finfo;
+ union octnic_cmd_setup cmdsetup;
+diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+index c99b59fe4c8f..a1bda1683ebf 100644
+--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
++++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+@@ -31,7 +31,8 @@
+
+ static int lio_vf_rep_open(struct net_device *ndev);
+ static int lio_vf_rep_stop(struct net_device *ndev);
+-static int lio_vf_rep_pkt_xmit(struct sk_buff *skb, struct net_device *ndev);
++static netdev_tx_t lio_vf_rep_pkt_xmit(struct sk_buff *skb,
++ struct net_device *ndev);
+ static void lio_vf_rep_tx_timeout(struct net_device *netdev);
+ static int lio_vf_rep_phys_port_name(struct net_device *dev,
+ char *buf, size_t len);
+@@ -382,7 +383,7 @@ lio_vf_rep_packet_sent_callback(struct octeon_device *oct,
+ netif_wake_queue(ndev);
+ }
+
+-static int
++static netdev_tx_t
+ lio_vf_rep_pkt_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct lio_vf_rep_desc *vf_rep = netdev_priv(ndev);
+diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_device.c b/drivers/net/ethernet/cavium/liquidio/octeon_device.c
+index f878a552fef3..d0ed6c4f9e1a 100644
+--- a/drivers/net/ethernet/cavium/liquidio/octeon_device.c
++++ b/drivers/net/ethernet/cavium/liquidio/octeon_device.c
+@@ -1450,8 +1450,9 @@ void lio_enable_irq(struct octeon_droq *droq, struct octeon_instr_queue *iq)
+ }
+ if (iq) {
+ spin_lock_bh(&iq->lock);
+- writel(iq->pkt_in_done, iq->inst_cnt_reg);
+- iq->pkt_in_done = 0;
++ writel(iq->pkts_processed, iq->inst_cnt_reg);
++ iq->pkt_in_done -= iq->pkts_processed;
++ iq->pkts_processed = 0;
+ /* this write needs to be flushed before we release the lock */
+ mmiowb();
+ spin_unlock_bh(&iq->lock);
+diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_iq.h b/drivers/net/ethernet/cavium/liquidio/octeon_iq.h
+index 2327062e8af6..aecd0d36d634 100644
+--- a/drivers/net/ethernet/cavium/liquidio/octeon_iq.h
++++ b/drivers/net/ethernet/cavium/liquidio/octeon_iq.h
+@@ -94,6 +94,8 @@ struct octeon_instr_queue {
+
+ u32 pkt_in_done;
+
++ u32 pkts_processed;
++
+ /** A spinlock to protect access to the input ring.*/
+ spinlock_t iq_flush_running_lock;
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/request_manager.c b/drivers/net/ethernet/cavium/liquidio/request_manager.c
+index 3deb3c07681f..1d9ab7f4a2fe 100644
+--- a/drivers/net/ethernet/cavium/liquidio/request_manager.c
++++ b/drivers/net/ethernet/cavium/liquidio/request_manager.c
+@@ -123,6 +123,7 @@ int octeon_init_instr_queue(struct octeon_device *oct,
+ iq->do_auto_flush = 1;
+ iq->db_timeout = (u32)conf->db_timeout;
+ atomic_set(&iq->instr_pending, 0);
++ iq->pkts_processed = 0;
+
+ /* Initialize the spinlock for this instruction queue */
+ spin_lock_init(&iq->lock);
+@@ -497,6 +498,7 @@ octeon_flush_iq(struct octeon_device *oct, struct octeon_instr_queue *iq,
+ lio_process_iq_request_list(oct, iq, 0);
+
+ if (inst_processed) {
++ iq->pkts_processed += inst_processed;
+ atomic_sub(inst_processed, &iq->instr_pending);
+ iq->stats.instr_processed += inst_processed;
+ }
+diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+index 592fb9e847b9..0957e735cdc4 100644
+--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
++++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+@@ -1268,12 +1268,13 @@ static int octeon_mgmt_stop(struct net_device *netdev)
+ return 0;
+ }
+
+-static int octeon_mgmt_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t
++octeon_mgmt_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct octeon_mgmt *p = netdev_priv(netdev);
+ union mgmt_port_ring_entry re;
+ unsigned long flags;
+- int rv = NETDEV_TX_BUSY;
++ netdev_tx_t rv = NETDEV_TX_BUSY;
+
+ re.d64 = 0;
+ re.s.tstamp = ((skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) != 0);
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index 5fe5d16dee72..8350c0c9b89d 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -3889,7 +3889,7 @@ int t4_fwcache(struct adapter *adap, enum fw_params_param_dev_fwcache op)
+ c.param[0].mnem =
+ cpu_to_be32(FW_PARAMS_MNEM_V(FW_PARAMS_MNEM_DEV) |
+ FW_PARAMS_PARAM_X_V(FW_PARAMS_PARAM_DEV_FWCACHE));
+- c.param[0].val = (__force __be32)op;
++ c.param[0].val = cpu_to_be32(op);
+
+ return t4_wr_mbox(adap, adap->mbox, &c, sizeof(c), NULL);
+ }
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index dfd1ad0b1cb9..4af78de0e077 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -2530,6 +2530,7 @@ static int gemini_ethernet_port_remove(struct platform_device *pdev)
+ struct gemini_ethernet_port *port = platform_get_drvdata(pdev);
+
+ gemini_port_remove(port);
++ free_netdev(port->netdev);
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
+index f6ed889bc36a..e4fc38cbe853 100644
+--- a/drivers/net/ethernet/faraday/ftgmac100.c
++++ b/drivers/net/ethernet/faraday/ftgmac100.c
+@@ -712,8 +712,8 @@ static bool ftgmac100_prep_tx_csum(struct sk_buff *skb, u32 *csum_vlan)
+ return skb_checksum_help(skb) == 0;
+ }
+
+-static int ftgmac100_hard_start_xmit(struct sk_buff *skb,
+- struct net_device *netdev)
++static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,
++ struct net_device *netdev)
+ {
+ struct ftgmac100 *priv = netdev_priv(netdev);
+ struct ftgmac100_txdes *txdes, *first;
+diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
+index 9015bd911bee..084f24daf2b5 100644
+--- a/drivers/net/ethernet/faraday/ftmac100.c
++++ b/drivers/net/ethernet/faraday/ftmac100.c
+@@ -634,8 +634,8 @@ static void ftmac100_tx_complete(struct ftmac100 *priv)
+ ;
+ }
+
+-static int ftmac100_xmit(struct ftmac100 *priv, struct sk_buff *skb,
+- dma_addr_t map)
++static netdev_tx_t ftmac100_xmit(struct ftmac100 *priv, struct sk_buff *skb,
++ dma_addr_t map)
+ {
+ struct net_device *netdev = priv->netdev;
+ struct ftmac100_txdes *txdes;
+@@ -1015,7 +1015,8 @@ static int ftmac100_stop(struct net_device *netdev)
+ return 0;
+ }
+
+-static int ftmac100_hard_start_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t
++ftmac100_hard_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct ftmac100 *priv = netdev_priv(netdev);
+ dma_addr_t map;
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index d7915cd68dc1..462bb8c4f80c 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2046,7 +2046,8 @@ static inline int dpaa_xmit(struct dpaa_priv *priv,
+ return 0;
+ }
+
+-static int dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
++static netdev_tx_t
++dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ {
+ const int queue_mapping = skb_get_queue_mapping(skb);
+ bool nonlinear = skb_is_nonlinear(skb);
+diff --git a/drivers/net/ethernet/freescale/fec_mpc52xx.c b/drivers/net/ethernet/freescale/fec_mpc52xx.c
+index 6d7269d87a85..b90bab72efdb 100644
+--- a/drivers/net/ethernet/freescale/fec_mpc52xx.c
++++ b/drivers/net/ethernet/freescale/fec_mpc52xx.c
+@@ -305,7 +305,8 @@ static int mpc52xx_fec_close(struct net_device *dev)
+ * invariant will hold if you make sure that the netif_*_queue()
+ * calls are done at the proper times.
+ */
+-static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct mpc52xx_fec_priv *priv = netdev_priv(dev);
+ struct bcom_fec_bd *bd;
+diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+index 2c2976a2dda6..7c548ed535da 100644
+--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
++++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+@@ -481,7 +481,8 @@ static struct sk_buff *tx_skb_align_workaround(struct net_device *dev,
+ }
+ #endif
+
+-static int fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct fs_enet_private *fep = netdev_priv(dev);
+ cbd_t __iomem *bdp;
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index f27f9bae1a4a..c97c4edfa31b 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -112,7 +112,7 @@
+ const char gfar_driver_version[] = "2.0";
+
+ static int gfar_enet_open(struct net_device *dev);
+-static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev);
+ static void gfar_reset_task(struct work_struct *work);
+ static void gfar_timeout(struct net_device *dev);
+ static int gfar_close(struct net_device *dev);
+@@ -2334,7 +2334,7 @@ static inline bool gfar_csum_errata_76(struct gfar_private *priv,
+ /* This is called by the kernel when a frame is ready for transmission.
+ * It is pointed to by the dev->hard_start_xmit function pointer
+ */
+-static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct gfar_private *priv = netdev_priv(dev);
+ struct gfar_priv_tx_q *tx_queue = NULL;
+diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
+index 1e2b53a934fb..a5bf02ae4bc5 100644
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -3085,7 +3085,8 @@ static int ucc_geth_startup(struct ucc_geth_private *ugeth)
+
+ /* This is called by the kernel when a frame is ready for transmission. */
+ /* It is pointed to by the dev->hard_start_xmit function pointer */
+-static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ucc_geth_private *ugeth = netdev_priv(dev);
+ #ifdef CONFIG_UGETH_TX_ON_DEMAND
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index 644ad78d0051..e8936ae46add 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -424,7 +424,8 @@ static void hip04_start_tx_timer(struct hip04_priv *priv)
+ ns, HRTIMER_MODE_REL);
+ }
+
+-static int hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct hip04_priv *priv = netdev_priv(ndev);
+ struct net_device_stats *stats = &ndev->stats;
+diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+index c5727003af8c..471805ea363b 100644
+--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+@@ -736,7 +736,7 @@ static int hix5hd2_fill_sg_desc(struct hix5hd2_priv *priv,
+ return 0;
+ }
+
+-static int hix5hd2_net_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t hix5hd2_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct hix5hd2_priv *priv = netdev_priv(dev);
+ struct hix5hd2_desc *desc;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+index 0594a6c3dccd..2097f92e14c5 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+@@ -29,8 +29,8 @@ static bool hnae3_client_match(enum hnae3_client_type client_type,
+ return false;
+ }
+
+-static void hnae3_set_client_init_flag(struct hnae3_client *client,
+- struct hnae3_ae_dev *ae_dev, int inited)
++void hnae3_set_client_init_flag(struct hnae3_client *client,
++ struct hnae3_ae_dev *ae_dev, int inited)
+ {
+ switch (client->type) {
+ case HNAE3_CLIENT_KNIC:
+@@ -46,6 +46,7 @@ static void hnae3_set_client_init_flag(struct hnae3_client *client,
+ break;
+ }
+ }
++EXPORT_SYMBOL(hnae3_set_client_init_flag);
+
+ static int hnae3_get_client_init_flag(struct hnae3_client *client,
+ struct hnae3_ae_dev *ae_dev)
+@@ -86,14 +87,11 @@ static int hnae3_match_n_instantiate(struct hnae3_client *client,
+ /* now, (un-)instantiate client by calling lower layer */
+ if (is_reg) {
+ ret = ae_dev->ops->init_client_instance(client, ae_dev);
+- if (ret) {
++ if (ret)
+ dev_err(&ae_dev->pdev->dev,
+ "fail to instantiate client, ret = %d\n", ret);
+- return ret;
+- }
+
+- hnae3_set_client_init_flag(client, ae_dev, 1);
+- return 0;
++ return ret;
+ }
+
+ if (hnae3_get_client_init_flag(client, ae_dev)) {
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index 67befff0bfc5..f5c7fc9c5e5c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -521,4 +521,7 @@ void hnae3_register_ae_algo(struct hnae3_ae_algo *ae_algo);
+
+ void hnae3_unregister_client(struct hnae3_client *client);
+ int hnae3_register_client(struct hnae3_client *client);
++
++void hnae3_set_client_init_flag(struct hnae3_client *client,
++ struct hnae3_ae_dev *ae_dev, int inited);
+ #endif
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+index 6a3c6b02a77c..0c34ea122358 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+@@ -100,41 +100,26 @@ static int hns3_lp_up(struct net_device *ndev, enum hnae3_loop loop_mode)
+ struct hnae3_handle *h = hns3_get_handle(ndev);
+ int ret;
+
+- if (!h->ae_algo->ops->start)
+- return -EOPNOTSUPP;
+-
+ ret = hns3_nic_reset_all_ring(h);
+ if (ret)
+ return ret;
+
+- ret = h->ae_algo->ops->start(h);
+- if (ret) {
+- netdev_err(ndev,
+- "hns3_lb_up ae start return error: %d\n", ret);
+- return ret;
+- }
+-
+ ret = hns3_lp_setup(ndev, loop_mode, true);
+ usleep_range(10000, 20000);
+
+- return ret;
++ return 0;
+ }
+
+ static int hns3_lp_down(struct net_device *ndev, enum hnae3_loop loop_mode)
+ {
+- struct hnae3_handle *h = hns3_get_handle(ndev);
+ int ret;
+
+- if (!h->ae_algo->ops->stop)
+- return -EOPNOTSUPP;
+-
+ ret = hns3_lp_setup(ndev, loop_mode, false);
+ if (ret) {
+ netdev_err(ndev, "lb_setup return error: %d\n", ret);
+ return ret;
+ }
+
+- h->ae_algo->ops->stop(h);
+ usleep_range(10000, 20000);
+
+ return 0;
+@@ -152,6 +137,7 @@ static void hns3_lp_setup_skb(struct sk_buff *skb)
+ packet = skb_put(skb, HNS3_NIC_LB_TEST_PACKET_SIZE);
+
+ memcpy(ethh->h_dest, ndev->dev_addr, ETH_ALEN);
++ ethh->h_dest[5] += 0x1f;
+ eth_zero_addr(ethh->h_source);
+ ethh->h_proto = htons(ETH_P_ARP);
+ skb_reset_mac_header(skb);
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 89ca69fa2b97..b04df79f393f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2367,7 +2367,7 @@ static int hclge_get_mac_phy_link(struct hclge_dev *hdev)
+ mac_state = hclge_get_mac_link_status(hdev);
+
+ if (hdev->hw.mac.phydev) {
+- if (!genphy_read_status(hdev->hw.mac.phydev))
++ if (hdev->hw.mac.phydev->state == PHY_RUNNING)
+ link_stat = mac_state &
+ hdev->hw.mac.phydev->link;
+ else
+@@ -3666,6 +3666,8 @@ static int hclge_set_mac_loopback(struct hclge_dev *hdev, bool en)
+ /* 2 Then setup the loopback flag */
+ loop_en = le32_to_cpu(req->txrx_pad_fcs_loop_en);
+ hnae3_set_bit(loop_en, HCLGE_MAC_APP_LP_B, en ? 1 : 0);
++ hnae3_set_bit(loop_en, HCLGE_MAC_TX_EN_B, en ? 1 : 0);
++ hnae3_set_bit(loop_en, HCLGE_MAC_RX_EN_B, en ? 1 : 0);
+
+ req->txrx_pad_fcs_loop_en = cpu_to_le32(loop_en);
+
+@@ -3726,15 +3728,36 @@ static int hclge_set_serdes_loopback(struct hclge_dev *hdev, bool en)
+ return -EIO;
+ }
+
++ hclge_cfg_mac_mode(hdev, en);
+ return 0;
+ }
+
++static int hclge_tqp_enable(struct hclge_dev *hdev, int tqp_id,
++ int stream_id, bool enable)
++{
++ struct hclge_desc desc;
++ struct hclge_cfg_com_tqp_queue_cmd *req =
++ (struct hclge_cfg_com_tqp_queue_cmd *)desc.data;
++ int ret;
++
++ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CFG_COM_TQP_QUEUE, false);
++ req->tqp_id = cpu_to_le16(tqp_id & HCLGE_RING_ID_MASK);
++ req->stream_id = cpu_to_le16(stream_id);
++ req->enable |= enable << HCLGE_TQP_ENABLE_B;
++
++ ret = hclge_cmd_send(&hdev->hw, &desc, 1);
++ if (ret)
++ dev_err(&hdev->pdev->dev,
++ "Tqp enable fail, status =%d.\n", ret);
++ return ret;
++}
++
+ static int hclge_set_loopback(struct hnae3_handle *handle,
+ enum hnae3_loop loop_mode, bool en)
+ {
+ struct hclge_vport *vport = hclge_get_vport(handle);
+ struct hclge_dev *hdev = vport->back;
+- int ret;
++ int i, ret;
+
+ switch (loop_mode) {
+ case HNAE3_MAC_INTER_LOOP_MAC:
+@@ -3750,27 +3773,13 @@ static int hclge_set_loopback(struct hnae3_handle *handle,
+ break;
+ }
+
+- return ret;
+-}
+-
+-static int hclge_tqp_enable(struct hclge_dev *hdev, int tqp_id,
+- int stream_id, bool enable)
+-{
+- struct hclge_desc desc;
+- struct hclge_cfg_com_tqp_queue_cmd *req =
+- (struct hclge_cfg_com_tqp_queue_cmd *)desc.data;
+- int ret;
+-
+- hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CFG_COM_TQP_QUEUE, false);
+- req->tqp_id = cpu_to_le16(tqp_id & HCLGE_RING_ID_MASK);
+- req->stream_id = cpu_to_le16(stream_id);
+- req->enable |= enable << HCLGE_TQP_ENABLE_B;
++ for (i = 0; i < vport->alloc_tqps; i++) {
++ ret = hclge_tqp_enable(hdev, i, 0, en);
++ if (ret)
++ return ret;
++ }
+
+- ret = hclge_cmd_send(&hdev->hw, &desc, 1);
+- if (ret)
+- dev_err(&hdev->pdev->dev,
+- "Tqp enable fail, status =%d.\n", ret);
+- return ret;
++ return 0;
+ }
+
+ static void hclge_reset_tqp_stats(struct hnae3_handle *handle)
+@@ -4374,7 +4383,7 @@ int hclge_add_mc_addr_common(struct hclge_vport *vport,
+ hnae3_set_bit(req.flags, HCLGE_MAC_VLAN_BIT0_EN_B, 1);
+ hnae3_set_bit(req.entry_type, HCLGE_MAC_VLAN_BIT0_EN_B, 0);
+ hnae3_set_bit(req.entry_type, HCLGE_MAC_VLAN_BIT1_EN_B, 1);
+- hnae3_set_bit(req.mc_mac_en, HCLGE_MAC_VLAN_BIT0_EN_B, 0);
++ hnae3_set_bit(req.mc_mac_en, HCLGE_MAC_VLAN_BIT0_EN_B, 1);
+ hclge_prepare_mac_addr(&req, addr);
+ status = hclge_lookup_mac_vlan_tbl(vport, &req, desc, true);
+ if (!status) {
+@@ -4441,7 +4450,7 @@ int hclge_rm_mc_addr_common(struct hclge_vport *vport,
+ hnae3_set_bit(req.flags, HCLGE_MAC_VLAN_BIT0_EN_B, 1);
+ hnae3_set_bit(req.entry_type, HCLGE_MAC_VLAN_BIT0_EN_B, 0);
+ hnae3_set_bit(req.entry_type, HCLGE_MAC_VLAN_BIT1_EN_B, 1);
+- hnae3_set_bit(req.mc_mac_en, HCLGE_MAC_VLAN_BIT0_EN_B, 0);
++ hnae3_set_bit(req.mc_mac_en, HCLGE_MAC_VLAN_BIT0_EN_B, 1);
+ hclge_prepare_mac_addr(&req, addr);
+ status = hclge_lookup_mac_vlan_tbl(vport, &req, desc, true);
+ if (!status) {
+@@ -4784,7 +4793,7 @@ static int hclge_set_vlan_filter_hw(struct hclge_dev *hdev, __be16 proto,
+ return -EINVAL;
+ }
+
+- for_each_set_bit(vport_idx, hdev->vlan_table[vlan_id], VLAN_N_VID)
++ for_each_set_bit(vport_idx, hdev->vlan_table[vlan_id], HCLGE_VPORT_NUM)
+ vport_num++;
+
+ if ((is_kill && vport_num == 0) || (!is_kill && vport_num == 1))
+@@ -5467,26 +5476,31 @@ static int hclge_init_client_instance(struct hnae3_client *client,
+ vport->nic.client = client;
+ ret = client->ops->init_instance(&vport->nic);
+ if (ret)
+- return ret;
++ goto clear_nic;
+
+ ret = hclge_init_instance_hw(hdev);
+ if (ret) {
+ client->ops->uninit_instance(&vport->nic,
+ 0);
+- return ret;
++ goto clear_nic;
+ }
+
++ hnae3_set_client_init_flag(client, ae_dev, 1);
++
+ if (hdev->roce_client &&
+ hnae3_dev_roce_supported(hdev)) {
+ struct hnae3_client *rc = hdev->roce_client;
+
+ ret = hclge_init_roce_base_info(vport);
+ if (ret)
+- return ret;
++ goto clear_roce;
+
+ ret = rc->ops->init_instance(&vport->roce);
+ if (ret)
+- return ret;
++ goto clear_roce;
++
++ hnae3_set_client_init_flag(hdev->roce_client,
++ ae_dev, 1);
+ }
+
+ break;
+@@ -5496,7 +5510,9 @@ static int hclge_init_client_instance(struct hnae3_client *client,
+
+ ret = client->ops->init_instance(&vport->nic);
+ if (ret)
+- return ret;
++ goto clear_nic;
++
++ hnae3_set_client_init_flag(client, ae_dev, 1);
+
+ break;
+ case HNAE3_CLIENT_ROCE:
+@@ -5508,16 +5524,27 @@ static int hclge_init_client_instance(struct hnae3_client *client,
+ if (hdev->roce_client && hdev->nic_client) {
+ ret = hclge_init_roce_base_info(vport);
+ if (ret)
+- return ret;
++ goto clear_roce;
+
+ ret = client->ops->init_instance(&vport->roce);
+ if (ret)
+- return ret;
++ goto clear_roce;
++
++ hnae3_set_client_init_flag(client, ae_dev, 1);
+ }
+ }
+ }
+
+ return 0;
++
++clear_nic:
++ hdev->nic_client = NULL;
++ vport->nic.client = NULL;
++ return ret;
++clear_roce:
++ hdev->roce_client = NULL;
++ vport->roce.client = NULL;
++ return ret;
+ }
+
+ static void hclge_uninit_client_instance(struct hnae3_client *client,
+@@ -5537,7 +5564,7 @@ static void hclge_uninit_client_instance(struct hnae3_client *client,
+ }
+ if (client->type == HNAE3_CLIENT_ROCE)
+ return;
+- if (client->ops->uninit_instance) {
++ if (hdev->nic_client && client->ops->uninit_instance) {
+ hclge_uninit_instance_hw(hdev);
+ client->ops->uninit_instance(&vport->nic, 0);
+ hdev->nic_client = NULL;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 11e9259ca040..0d45d045706c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -298,7 +298,7 @@ static int hclge_tm_qs_to_pri_map_cfg(struct hclge_dev *hdev,
+ }
+
+ static int hclge_tm_q_to_qs_map_cfg(struct hclge_dev *hdev,
+- u8 q_id, u16 qs_id)
++ u16 q_id, u16 qs_id)
+ {
+ struct hclge_nq_to_qs_link_cmd *map;
+ struct hclge_desc desc;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c
+index fb471fe2c494..d8c0cc8e04c9 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c
+@@ -132,8 +132,8 @@ static int hclgevf_init_cmd_queue(struct hclgevf_dev *hdev,
+ reg_val |= HCLGEVF_NIC_CMQ_ENABLE;
+ hclgevf_write_dev(hw, HCLGEVF_NIC_CSQ_DEPTH_REG, reg_val);
+
+- hclgevf_write_dev(hw, HCLGEVF_NIC_CSQ_TAIL_REG, 0);
+ hclgevf_write_dev(hw, HCLGEVF_NIC_CSQ_HEAD_REG, 0);
++ hclgevf_write_dev(hw, HCLGEVF_NIC_CSQ_TAIL_REG, 0);
+ break;
+ case HCLGEVF_TYPE_CRQ:
+ reg_val = (u32)ring->desc_dma_addr;
+@@ -145,8 +145,8 @@ static int hclgevf_init_cmd_queue(struct hclgevf_dev *hdev,
+ reg_val |= HCLGEVF_NIC_CMQ_ENABLE;
+ hclgevf_write_dev(hw, HCLGEVF_NIC_CRQ_DEPTH_REG, reg_val);
+
+- hclgevf_write_dev(hw, HCLGEVF_NIC_CRQ_TAIL_REG, 0);
+ hclgevf_write_dev(hw, HCLGEVF_NIC_CRQ_HEAD_REG, 0);
++ hclgevf_write_dev(hw, HCLGEVF_NIC_CRQ_TAIL_REG, 0);
+ break;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 5570fb5dc2eb..beae1e2cd59b 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1629,17 +1629,22 @@ static int hclgevf_init_client_instance(struct hnae3_client *client,
+
+ ret = client->ops->init_instance(&hdev->nic);
+ if (ret)
+- return ret;
++ goto clear_nic;
++
++ hnae3_set_client_init_flag(client, ae_dev, 1);
+
+ if (hdev->roce_client && hnae3_dev_roce_supported(hdev)) {
+ struct hnae3_client *rc = hdev->roce_client;
+
+ ret = hclgevf_init_roce_base_info(hdev);
+ if (ret)
+- return ret;
++ goto clear_roce;
+ ret = rc->ops->init_instance(&hdev->roce);
+ if (ret)
+- return ret;
++ goto clear_roce;
++
++ hnae3_set_client_init_flag(hdev->roce_client, ae_dev,
++ 1);
+ }
+ break;
+ case HNAE3_CLIENT_UNIC:
+@@ -1648,7 +1653,9 @@ static int hclgevf_init_client_instance(struct hnae3_client *client,
+
+ ret = client->ops->init_instance(&hdev->nic);
+ if (ret)
+- return ret;
++ goto clear_nic;
++
++ hnae3_set_client_init_flag(client, ae_dev, 1);
+ break;
+ case HNAE3_CLIENT_ROCE:
+ if (hnae3_dev_roce_supported(hdev)) {
+@@ -1659,15 +1666,26 @@ static int hclgevf_init_client_instance(struct hnae3_client *client,
+ if (hdev->roce_client && hdev->nic_client) {
+ ret = hclgevf_init_roce_base_info(hdev);
+ if (ret)
+- return ret;
++ goto clear_roce;
+
+ ret = client->ops->init_instance(&hdev->roce);
+ if (ret)
+- return ret;
++ goto clear_roce;
+ }
++
++ hnae3_set_client_init_flag(client, ae_dev, 1);
+ }
+
+ return 0;
++
++clear_nic:
++ hdev->nic_client = NULL;
++ hdev->nic.client = NULL;
++ return ret;
++clear_roce:
++ hdev->roce_client = NULL;
++ hdev->roce.client = NULL;
++ return ret;
+ }
+
+ static void hclgevf_uninit_client_instance(struct hnae3_client *client,
+@@ -1676,13 +1694,19 @@ static void hclgevf_uninit_client_instance(struct hnae3_client *client,
+ struct hclgevf_dev *hdev = ae_dev->priv;
+
+ /* un-init roce, if it exists */
+- if (hdev->roce_client)
++ if (hdev->roce_client) {
+ hdev->roce_client->ops->uninit_instance(&hdev->roce, 0);
++ hdev->roce_client = NULL;
++ hdev->roce.client = NULL;
++ }
+
+ /* un-init nic/unic, if this was not called by roce client */
+- if ((client->ops->uninit_instance) &&
+- (client->type != HNAE3_CLIENT_ROCE))
++ if (client->ops->uninit_instance && hdev->nic_client &&
++ client->type != HNAE3_CLIENT_ROCE) {
+ client->ops->uninit_instance(&hdev->nic, 0);
++ hdev->nic_client = NULL;
++ hdev->nic.client = NULL;
++ }
+ }
+
+ static int hclgevf_pci_init(struct hclgevf_dev *hdev)
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index 506f78322d74..e8ee69d4e4d3 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -2027,7 +2027,7 @@ static void ehea_xmit3(struct sk_buff *skb, struct net_device *dev,
+ dev_consume_skb_any(skb);
+ }
+
+-static int ehea_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t ehea_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ehea_port *port = netdev_priv(dev);
+ struct ehea_swqe *swqe;
+diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
+index 129f4e9f38da..a96f501813ff 100644
+--- a/drivers/net/ethernet/ibm/emac/core.c
++++ b/drivers/net/ethernet/ibm/emac/core.c
+@@ -1409,7 +1409,7 @@ static inline u16 emac_tx_csum(struct emac_instance *dev,
+ return 0;
+ }
+
+-static inline int emac_xmit_finish(struct emac_instance *dev, int len)
++static inline netdev_tx_t emac_xmit_finish(struct emac_instance *dev, int len)
+ {
+ struct emac_regs __iomem *p = dev->emacp;
+ struct net_device *ndev = dev->ndev;
+@@ -1436,7 +1436,7 @@ static inline int emac_xmit_finish(struct emac_instance *dev, int len)
+ }
+
+ /* Tx lock BH */
+-static int emac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t emac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct emac_instance *dev = netdev_priv(ndev);
+ unsigned int len = skb->len;
+@@ -1494,7 +1494,8 @@ static inline int emac_xmit_split(struct emac_instance *dev, int slot,
+ }
+
+ /* Tx lock BH disabled (SG version for TAH equipped EMACs) */
+-static int emac_start_xmit_sg(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++emac_start_xmit_sg(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct emac_instance *dev = netdev_priv(ndev);
+ int nr_frags = skb_shinfo(skb)->nr_frags;
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 8fa14736449b..8a1916443235 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1420,7 +1420,7 @@ static int ibmvnic_xmit_workarounds(struct sk_buff *skb,
+ return 0;
+ }
+
+-static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct ibmvnic_adapter *adapter = netdev_priv(netdev);
+ int queue_num = skb_get_queue_mapping(skb);
+@@ -1444,7 +1444,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ u64 *handle_array;
+ int index = 0;
+ u8 proto = 0;
+- int ret = 0;
++ netdev_tx_t ret = NETDEV_TX_OK;
+
+ if (adapter->resetting) {
+ if (!netif_subqueue_stopped(netdev, skb))
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 055562c930fb..1a66373184d6 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -6587,6 +6587,24 @@ static i40e_status i40e_force_link_state(struct i40e_pf *pf, bool is_up)
+ struct i40e_hw *hw = &pf->hw;
+ i40e_status err;
+ u64 mask;
++ u8 speed;
++
++ /* Card might've been put in an unstable state by other drivers
++ * and applications, which causes incorrect speed values being
++ * set on startup. In order to clear speed registers, we call
++ * get_phy_capabilities twice, once to get initial state of
++ * available speeds, and once to get current PHY config.
++ */
++ err = i40e_aq_get_phy_capabilities(hw, false, true, &abilities,
++ NULL);
++ if (err) {
++ dev_err(&pf->pdev->dev,
++ "failed to get phy cap., ret = %s last_status = %s\n",
++ i40e_stat_str(hw, err),
++ i40e_aq_str(hw, hw->aq.asq_last_status));
++ return err;
++ }
++ speed = abilities.link_speed;
+
+ /* Get the current phy config */
+ err = i40e_aq_get_phy_capabilities(hw, false, false, &abilities,
+@@ -6600,9 +6618,9 @@ static i40e_status i40e_force_link_state(struct i40e_pf *pf, bool is_up)
+ }
+
+ /* If link needs to go up, but was not forced to go down,
+- * no need for a flap
++ * and its speed values are OK, no need for a flap
+ */
+- if (is_up && abilities.phy_type != 0)
++ if (is_up && abilities.phy_type != 0 && abilities.link_speed != 0)
+ return I40E_SUCCESS;
+
+ /* To force link we need to set bits for all supported PHY types,
+@@ -6614,7 +6632,10 @@ static i40e_status i40e_force_link_state(struct i40e_pf *pf, bool is_up)
+ config.phy_type_ext = is_up ? (u8)((mask >> 32) & 0xff) : 0;
+ /* Copy the old settings, except of phy_type */
+ config.abilities = abilities.abilities;
+- config.link_speed = abilities.link_speed;
++ if (abilities.link_speed != 0)
++ config.link_speed = abilities.link_speed;
++ else
++ config.link_speed = speed;
+ config.eee_capability = abilities.eee_capability;
+ config.eeer = abilities.eeer_val;
+ config.low_power_ctrl = abilities.d3_lpan;
+@@ -14187,6 +14208,7 @@ static void i40e_remove(struct pci_dev *pdev)
+ mutex_destroy(&hw->aq.asq_mutex);
+
+ /* Clear all dynamic memory lists of rings, q_vectors, and VSIs */
++ rtnl_lock();
+ i40e_clear_interrupt_scheme(pf);
+ for (i = 0; i < pf->num_alloc_vsi; i++) {
+ if (pf->vsi[i]) {
+@@ -14195,6 +14217,7 @@ static void i40e_remove(struct pci_dev *pdev)
+ pf->vsi[i] = NULL;
+ }
+ }
++ rtnl_unlock();
+
+ for (i = 0; i < I40E_MAX_VEB; i++) {
+ kfree(pf->veb[i]);
+@@ -14406,7 +14429,13 @@ static void i40e_shutdown(struct pci_dev *pdev)
+ wr32(hw, I40E_PFPM_WUFC,
+ (pf->wol_en ? I40E_PFPM_WUFC_MAG_MASK : 0));
+
++ /* Since we're going to destroy queues during the
++ * i40e_clear_interrupt_scheme() we should hold the RTNL lock for this
++ * whole section
++ */
++ rtnl_lock();
+ i40e_clear_interrupt_scheme(pf);
++ rtnl_unlock();
+
+ if (system_state == SYSTEM_POWER_OFF) {
+ pci_wake_from_d3(pdev, pf->wol_en);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+index 35f2866b38c6..1199f0502d6d 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+@@ -694,7 +694,8 @@ static long i40e_ptp_create_clock(struct i40e_pf *pf)
+ if (!IS_ERR_OR_NULL(pf->ptp_clock))
+ return 0;
+
+- strncpy(pf->ptp_caps.name, i40e_driver_name, sizeof(pf->ptp_caps.name));
++ strncpy(pf->ptp_caps.name, i40e_driver_name,
++ sizeof(pf->ptp_caps.name) - 1);
+ pf->ptp_caps.owner = THIS_MODULE;
+ pf->ptp_caps.max_adj = 999999999;
+ pf->ptp_caps.n_ext_ts = 0;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index d86f3fa7aa6a..46a71d289bca 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2571,6 +2571,16 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
+ ret = I40E_ERR_INVALID_MAC_ADDR;
+ goto error_param;
+ }
++
++ if (vf->pf_set_mac &&
++ ether_addr_equal(al->list[i].addr,
++ vf->default_lan_addr.addr)) {
++ dev_err(&pf->pdev->dev,
++ "MAC addr %pM has been set by PF, cannot delete it for VF %d, reset VF to change MAC addr\n",
++ vf->default_lan_addr.addr, vf->vf_id);
++ ret = I40E_ERR_PARAM;
++ goto error_param;
++ }
+ }
+ vsi = pf->vsi[vf->lan_vsi_idx];
+
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+index fef6d892ed4c..f50c19b83368 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+@@ -3097,18 +3097,19 @@ static int i40evf_set_features(struct net_device *netdev,
+ {
+ struct i40evf_adapter *adapter = netdev_priv(netdev);
+
+- /* Don't allow changing VLAN_RX flag when VLAN is set for VF
+- * and return an error in this case
++ /* Don't allow changing VLAN_RX flag when adapter is not capable
++ * of VLAN offload
+ */
+- if (VLAN_ALLOWED(adapter)) {
++ if (!VLAN_ALLOWED(adapter)) {
++ if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX)
++ return -EINVAL;
++ } else if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX) {
+ if (features & NETIF_F_HW_VLAN_CTAG_RX)
+ adapter->aq_required |=
+ I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING;
+ else
+ adapter->aq_required |=
+ I40EVF_FLAG_AQ_DISABLE_VLAN_STRIPPING;
+- } else if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX) {
+- return -EINVAL;
+ }
+
+ return 0;
+@@ -3332,6 +3333,8 @@ int i40evf_process_config(struct i40evf_adapter *adapter)
+ if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)
+ netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+
++ netdev->priv_flags |= IFF_UNICAST_FLT;
++
+ /* Do not turn on offloads when they are requested to be turned off.
+ * TSO needs minimum 576 bytes to work correctly.
+ */
+@@ -3881,6 +3884,8 @@ static void i40evf_remove(struct pci_dev *pdev)
+ if (adapter->watchdog_timer.function)
+ del_timer_sync(&adapter->watchdog_timer);
+
++ cancel_work_sync(&adapter->adminq_task);
++
+ i40evf_free_rss(adapter);
+
+ if (hw->aq.asq.count)
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
+index 565677de5ba3..94dabc9d89f7 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
++++ b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
+@@ -153,6 +153,32 @@ int i40evf_send_vf_config_msg(struct i40evf_adapter *adapter)
+ NULL, 0);
+ }
+
++/**
++ * i40evf_validate_num_queues
++ * @adapter: adapter structure
++ *
++ * Validate that the number of queues the PF has sent in
++ * VIRTCHNL_OP_GET_VF_RESOURCES is not larger than the VF can handle.
++ **/
++static void i40evf_validate_num_queues(struct i40evf_adapter *adapter)
++{
++ if (adapter->vf_res->num_queue_pairs > I40EVF_MAX_REQ_QUEUES) {
++ struct virtchnl_vsi_resource *vsi_res;
++ int i;
++
++ dev_info(&adapter->pdev->dev, "Received %d queues, but can only have a max of %d\n",
++ adapter->vf_res->num_queue_pairs,
++ I40EVF_MAX_REQ_QUEUES);
++ dev_info(&adapter->pdev->dev, "Fixing by reducing queues to %d\n",
++ I40EVF_MAX_REQ_QUEUES);
++ adapter->vf_res->num_queue_pairs = I40EVF_MAX_REQ_QUEUES;
++ for (i = 0; i < adapter->vf_res->num_vsis; i++) {
++ vsi_res = &adapter->vf_res->vsi_res[i];
++ vsi_res->num_queue_pairs = I40EVF_MAX_REQ_QUEUES;
++ }
++ }
++}
++
+ /**
+ * i40evf_get_vf_config
+ * @adapter: private adapter structure
+@@ -195,6 +221,11 @@ int i40evf_get_vf_config(struct i40evf_adapter *adapter)
+ err = (i40e_status)le32_to_cpu(event.desc.cookie_low);
+ memcpy(adapter->vf_res, event.msg_buf, min(event.msg_len, len));
+
++ /* some PFs send more queues than we should have so validate that
++ * we aren't getting too many queues
++ */
++ if (!err)
++ i40evf_validate_num_queues(adapter);
+ i40e_vf_parse_hw_config(hw, adapter->vf_res);
+ out_alloc:
+ kfree(event.msg_buf);
+@@ -1329,6 +1360,7 @@ void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
+ I40E_MAX_VF_VSI *
+ sizeof(struct virtchnl_vsi_resource);
+ memcpy(adapter->vf_res, msg, min(msglen, len));
++ i40evf_validate_num_queues(adapter);
+ i40e_vf_parse_hw_config(&adapter->hw, adapter->vf_res);
+ /* restore current mac address */
+ ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr);
+diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
+index 661beea6af79..f8d00263d901 100644
+--- a/drivers/net/ethernet/intel/ice/ice_common.c
++++ b/drivers/net/ethernet/intel/ice/ice_common.c
+@@ -904,7 +904,22 @@ enum ice_status ice_aq_q_shutdown(struct ice_hw *hw, bool unloading)
+ * @timeout: the maximum time in ms that the driver may hold the resource
+ * @cd: pointer to command details structure or NULL
+ *
+- * requests common resource using the admin queue commands (0x0008)
++ * Requests common resource using the admin queue commands (0x0008).
++ * When attempting to acquire the Global Config Lock, the driver can
++ * learn of three states:
++ * 1) ICE_SUCCESS - acquired lock, and can perform download package
++ * 2) ICE_ERR_AQ_ERROR - did not get lock, driver should fail to load
++ * 3) ICE_ERR_AQ_NO_WORK - did not get lock, but another driver has
++ * successfully downloaded the package; the driver does
++ * not have to download the package and can continue
++ * loading
++ *
++ * Note that if the caller is in an acquire lock, perform action, release lock
++ * phase of operation, it is possible that the FW may detect a timeout and issue
++ * a CORER. In this case, the driver will receive a CORER interrupt and will
++ * have to determine its cause. The calling thread that is handling this flow
++ * will likely get an error propagated back to it indicating the Download
++ * Package, Update Package or the Release Resource AQ commands timed out.
+ */
+ static enum ice_status
+ ice_aq_req_res(struct ice_hw *hw, enum ice_aq_res_ids res,
+@@ -922,13 +937,43 @@ ice_aq_req_res(struct ice_hw *hw, enum ice_aq_res_ids res,
+ cmd_resp->res_id = cpu_to_le16(res);
+ cmd_resp->access_type = cpu_to_le16(access);
+ cmd_resp->res_number = cpu_to_le32(sdp_number);
++ cmd_resp->timeout = cpu_to_le32(*timeout);
++ *timeout = 0;
+
+ status = ice_aq_send_cmd(hw, &desc, NULL, 0, cd);
++
+ /* The completion specifies the maximum time in ms that the driver
+ * may hold the resource in the Timeout field.
+- * If the resource is held by someone else, the command completes with
+- * busy return value and the timeout field indicates the maximum time
+- * the current owner of the resource has to free it.
++ */
++
++ /* Global config lock response utilizes an additional status field.
++ *
++ * If the Global config lock resource is held by some other driver, the
++ * command completes with ICE_AQ_RES_GLBL_IN_PROG in the status field
++ * and the timeout field indicates the maximum time the current owner
++ * of the resource has to free it.
++ */
++ if (res == ICE_GLOBAL_CFG_LOCK_RES_ID) {
++ if (le16_to_cpu(cmd_resp->status) == ICE_AQ_RES_GLBL_SUCCESS) {
++ *timeout = le32_to_cpu(cmd_resp->timeout);
++ return 0;
++ } else if (le16_to_cpu(cmd_resp->status) ==
++ ICE_AQ_RES_GLBL_IN_PROG) {
++ *timeout = le32_to_cpu(cmd_resp->timeout);
++ return ICE_ERR_AQ_ERROR;
++ } else if (le16_to_cpu(cmd_resp->status) ==
++ ICE_AQ_RES_GLBL_DONE) {
++ return ICE_ERR_AQ_NO_WORK;
++ }
++
++ /* invalid FW response, force a timeout immediately */
++ *timeout = 0;
++ return ICE_ERR_AQ_ERROR;
++ }
++
++ /* If the resource is held by some other driver, the command completes
++ * with a busy return value and the timeout field indicates the maximum
++ * time the current owner of the resource has to free it.
+ */
+ if (!status || hw->adminq.sq_last_status == ICE_AQ_RC_EBUSY)
+ *timeout = le32_to_cpu(cmd_resp->timeout);
+@@ -967,30 +1012,28 @@ ice_aq_release_res(struct ice_hw *hw, enum ice_aq_res_ids res, u8 sdp_number,
+ * @hw: pointer to the HW structure
+ * @res: resource id
+ * @access: access type (read or write)
++ * @timeout: timeout in milliseconds
+ *
+ * This function will attempt to acquire the ownership of a resource.
+ */
+ enum ice_status
+ ice_acquire_res(struct ice_hw *hw, enum ice_aq_res_ids res,
+- enum ice_aq_res_access_type access)
++ enum ice_aq_res_access_type access, u32 timeout)
+ {
+ #define ICE_RES_POLLING_DELAY_MS 10
+ u32 delay = ICE_RES_POLLING_DELAY_MS;
++ u32 time_left = timeout;
+ enum ice_status status;
+- u32 time_left = 0;
+- u32 timeout;
+
+ status = ice_aq_req_res(hw, res, access, 0, &time_left, NULL);
+
+- /* An admin queue return code of ICE_AQ_RC_EEXIST means that another
+- * driver has previously acquired the resource and performed any
+- * necessary updates; in this case the caller does not obtain the
+- * resource and has no further work to do.
++ /* A return code of ICE_ERR_AQ_NO_WORK means that another driver has
++ * previously acquired the resource and performed any necessary updates;
++ * in this case the caller does not obtain the resource and has no
++ * further work to do.
+ */
+- if (hw->adminq.sq_last_status == ICE_AQ_RC_EEXIST) {
+- status = ICE_ERR_AQ_NO_WORK;
++ if (status == ICE_ERR_AQ_NO_WORK)
+ goto ice_acquire_res_exit;
+- }
+
+ if (status)
+ ice_debug(hw, ICE_DBG_RES,
+@@ -1003,11 +1046,9 @@ ice_acquire_res(struct ice_hw *hw, enum ice_aq_res_ids res,
+ timeout = (timeout > delay) ? timeout - delay : 0;
+ status = ice_aq_req_res(hw, res, access, 0, &time_left, NULL);
+
+- if (hw->adminq.sq_last_status == ICE_AQ_RC_EEXIST) {
++ if (status == ICE_ERR_AQ_NO_WORK)
+ /* lock free, but no work to do */
+- status = ICE_ERR_AQ_NO_WORK;
+ break;
+- }
+
+ if (!status)
+ /* lock acquired */
+diff --git a/drivers/net/ethernet/intel/ice/ice_common.h b/drivers/net/ethernet/intel/ice/ice_common.h
+index 9a5519130af1..6455b6952ec8 100644
+--- a/drivers/net/ethernet/intel/ice/ice_common.h
++++ b/drivers/net/ethernet/intel/ice/ice_common.h
+@@ -23,7 +23,7 @@ enum ice_status
+ ice_get_link_status(struct ice_port_info *pi, bool *link_up);
+ enum ice_status
+ ice_acquire_res(struct ice_hw *hw, enum ice_aq_res_ids res,
+- enum ice_aq_res_access_type access);
++ enum ice_aq_res_access_type access, u32 timeout);
+ void ice_release_res(struct ice_hw *hw, enum ice_aq_res_ids res);
+ enum ice_status ice_init_nvm(struct ice_hw *hw);
+ enum ice_status
+diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c
+index e783976c401d..89f18fe18fe3 100644
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
+@@ -814,6 +814,9 @@ ice_sq_send_cmd(struct ice_hw *hw, struct ice_ctl_q_info *cq,
+ u16 retval = 0;
+ u32 val = 0;
+
++ /* if reset is in progress return a soft error */
++ if (hw->reset_ongoing)
++ return ICE_ERR_RESET_ONGOING;
+ mutex_lock(&cq->sq_lock);
+
+ cq->sq_last_status = ICE_AQ_RC_OK;
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 875f97aba6e0..00c833cd2b3a 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -7,7 +7,7 @@
+
+ #include "ice.h"
+
+-#define DRV_VERSION "ice-0.7.0-k"
++#define DRV_VERSION "0.7.1-k"
+ #define DRV_SUMMARY "Intel(R) Ethernet Connection E800 Series Linux Driver"
+ const char ice_drv_ver[] = DRV_VERSION;
+ static const char ice_driver_string[] = DRV_SUMMARY;
+@@ -535,10 +535,13 @@ static void ice_reset_subtask(struct ice_pf *pf)
+ ice_prepare_for_reset(pf);
+
+ /* make sure we are ready to rebuild */
+- if (ice_check_reset(&pf->hw))
++ if (ice_check_reset(&pf->hw)) {
+ set_bit(__ICE_RESET_FAILED, pf->state);
+- else
++ } else {
++ /* done with reset. start rebuild */
++ pf->hw.reset_ongoing = false;
+ ice_rebuild(pf);
++ }
+ clear_bit(__ICE_RESET_RECOVERY_PENDING, pf->state);
+ goto unlock;
+ }
+@@ -1757,7 +1760,8 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data)
+ * We also make note of which reset happened so that peer
+ * devices/drivers can be informed.
+ */
+- if (!test_bit(__ICE_RESET_RECOVERY_PENDING, pf->state)) {
++ if (!test_and_set_bit(__ICE_RESET_RECOVERY_PENDING,
++ pf->state)) {
+ if (reset == ICE_RESET_CORER)
+ set_bit(__ICE_CORER_RECV, pf->state);
+ else if (reset == ICE_RESET_GLOBR)
+@@ -1765,7 +1769,20 @@ static irqreturn_t ice_misc_intr(int __always_unused irq, void *data)
+ else
+ set_bit(__ICE_EMPR_RECV, pf->state);
+
+- set_bit(__ICE_RESET_RECOVERY_PENDING, pf->state);
++ /* There are couple of different bits at play here.
++ * hw->reset_ongoing indicates whether the hardware is
++ * in reset. This is set to true when a reset interrupt
++ * is received and set back to false after the driver
++ * has determined that the hardware is out of reset.
++ *
++ * __ICE_RESET_RECOVERY_PENDING in pf->state indicates
++ * that a post reset rebuild is required before the
++ * driver is operational again. This is set above.
++ *
++ * As this is the start of the reset/rebuild cycle, set
++ * both to indicate that.
++ */
++ hw->reset_ongoing = true;
+ }
+ }
+
+@@ -4188,7 +4205,14 @@ static int ice_vsi_stop_tx_rings(struct ice_vsi *vsi)
+ }
+ status = ice_dis_vsi_txq(vsi->port_info, vsi->num_txq, q_ids, q_teids,
+ NULL);
+- if (status) {
++ /* if the disable queue command was exercised during an active reset
++ * flow, ICE_ERR_RESET_ONGOING is returned. This is not an error as
++ * the reset operation disables queues at the hardware level anyway.
++ */
++ if (status == ICE_ERR_RESET_ONGOING) {
++ dev_dbg(&pf->pdev->dev,
++ "Reset in progress. LAN Tx queues already disabled\n");
++ } else if (status) {
+ dev_err(&pf->pdev->dev,
+ "Failed to disable LAN Tx queues, error: %d\n",
+ status);
+diff --git a/drivers/net/ethernet/intel/ice/ice_nvm.c b/drivers/net/ethernet/intel/ice/ice_nvm.c
+index 295a8cd87fc1..3274c543283c 100644
+--- a/drivers/net/ethernet/intel/ice/ice_nvm.c
++++ b/drivers/net/ethernet/intel/ice/ice_nvm.c
+@@ -137,7 +137,7 @@ ice_acquire_nvm(struct ice_hw *hw, enum ice_aq_res_access_type access)
+ if (hw->nvm.blank_nvm_mode)
+ return 0;
+
+- return ice_acquire_res(hw, ICE_NVM_RES_ID, access);
++ return ice_acquire_res(hw, ICE_NVM_RES_ID, access, ICE_NVM_TIMEOUT);
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/intel/ice/ice_status.h b/drivers/net/ethernet/intel/ice/ice_status.h
+index 9a95c4ffd7d7..d2dae913d81e 100644
+--- a/drivers/net/ethernet/intel/ice/ice_status.h
++++ b/drivers/net/ethernet/intel/ice/ice_status.h
+@@ -20,6 +20,7 @@ enum ice_status {
+ ICE_ERR_ALREADY_EXISTS = -14,
+ ICE_ERR_DOES_NOT_EXIST = -15,
+ ICE_ERR_MAX_LIMIT = -17,
++ ICE_ERR_RESET_ONGOING = -18,
+ ICE_ERR_BUF_TOO_SHORT = -52,
+ ICE_ERR_NVM_BLANK_MODE = -53,
+ ICE_ERR_AQ_ERROR = -100,
+diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h
+index ba11b5898833..5ca9d684429d 100644
+--- a/drivers/net/ethernet/intel/ice/ice_type.h
++++ b/drivers/net/ethernet/intel/ice/ice_type.h
+@@ -34,10 +34,15 @@ static inline bool ice_is_tc_ena(u8 bitmap, u8 tc)
+ enum ice_aq_res_ids {
+ ICE_NVM_RES_ID = 1,
+ ICE_SPD_RES_ID,
+- ICE_GLOBAL_CFG_LOCK_RES_ID,
+- ICE_CHANGE_LOCK_RES_ID
++ ICE_CHANGE_LOCK_RES_ID,
++ ICE_GLOBAL_CFG_LOCK_RES_ID
+ };
+
++/* FW update timeout definitions are in milliseconds */
++#define ICE_NVM_TIMEOUT 180000
++#define ICE_CHANGE_LOCK_TIMEOUT 1000
++#define ICE_GLOBAL_CFG_LOCK_TIMEOUT 3000
++
+ enum ice_aq_res_access_type {
+ ICE_RES_READ = 1,
+ ICE_RES_WRITE
+@@ -288,6 +293,7 @@ struct ice_hw {
+ u8 sw_entry_point_layer;
+
+ u8 evb_veb; /* true for VEB, false for VEPA */
++ u8 reset_ongoing; /* true if hw is in reset, false otherwise */
+ struct ice_bus_info bus;
+ struct ice_nvm_info nvm;
+ struct ice_hw_dev_caps dev_caps; /* device capabilities */
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 28762314353f..4313bbb2396f 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -2394,7 +2394,7 @@ error:
+ }
+
+ /* Main tx processing */
+-static int mvneta_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t mvneta_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct mvneta_port *pp = netdev_priv(dev);
+ u16 txq_id = skb_get_queue_mapping(skb);
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+index 67b9e81b7c02..46911b67b039 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+@@ -253,7 +253,8 @@
+ #define MVPP2_ISR_ENABLE_INTERRUPT(mask) ((mask) & 0xffff)
+ #define MVPP2_ISR_DISABLE_INTERRUPT(mask) (((mask) << 16) & 0xffff0000)
+ #define MVPP2_ISR_RX_TX_CAUSE_REG(port) (0x5480 + 4 * (port))
+-#define MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK 0xffff
++#define MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK(version) \
++ ((version) == MVPP21 ? 0xffff : 0xff)
+ #define MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK 0xff0000
+ #define MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_OFFSET 16
+ #define MVPP2_CAUSE_RX_FIFO_OVERRUN_MASK BIT(24)
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 9b608d23ff7e..1cc0e8fda4d5 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -908,7 +908,7 @@ static void mvpp2_interrupts_unmask(void *arg)
+ u32 val;
+
+ val = MVPP2_CAUSE_MISC_SUM_MASK |
+- MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK;
++ MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK(port->priv->hw_version);
+ if (port->has_tx_irqs)
+ val |= MVPP2_CAUSE_TXQ_OCCUP_DESC_ALL_MASK;
+
+@@ -928,7 +928,7 @@ mvpp2_shared_interrupt_mask_unmask(struct mvpp2_port *port, bool mask)
+ if (mask)
+ val = 0;
+ else
+- val = MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK;
++ val = MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK(MVPP22);
+
+ for (i = 0; i < port->nqvecs; i++) {
+ struct mvpp2_queue_vector *v = port->qvecs + i;
+@@ -2901,7 +2901,7 @@ release:
+ }
+
+ /* Main tx processing */
+-static int mvpp2_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t mvpp2_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct mvpp2_port *port = netdev_priv(dev);
+ struct mvpp2_tx_queue *txq, *aggr_txq;
+@@ -3059,7 +3059,8 @@ static int mvpp2_poll(struct napi_struct *napi, int budget)
+ }
+
+ /* Process RX packets */
+- cause_rx = cause_rx_tx & MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK;
++ cause_rx = cause_rx_tx &
++ MVPP2_CAUSE_RXQ_OCCUP_DESC_ALL_MASK(port->priv->hw_version);
+ cause_rx <<= qv->first_rxq;
+ cause_rx |= qv->pending_cause_rx;
+ while (cause_rx && budget > 0) {
+diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
+index 3a9730612a70..ff2fea0f8b75 100644
+--- a/drivers/net/ethernet/marvell/pxa168_eth.c
++++ b/drivers/net/ethernet/marvell/pxa168_eth.c
+@@ -1260,7 +1260,8 @@ static int pxa168_rx_poll(struct napi_struct *napi, int budget)
+ return work_done;
+ }
+
+-static int pxa168_eth_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++pxa168_eth_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct pxa168_eth_private *pep = netdev_priv(dev);
+ struct net_device_stats *stats = &dev->stats;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index ccd9aca281b3..e498ee95baca 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -336,7 +336,10 @@ static int mlxsw_sp_fw_rev_validate(struct mlxsw_sp *mlxsw_sp)
+ return -EINVAL;
+ }
+ if (MLXSW_SP_FWREV_MINOR_TO_BRANCH(rev->minor) ==
+- MLXSW_SP_FWREV_MINOR_TO_BRANCH(req_rev->minor))
++ MLXSW_SP_FWREV_MINOR_TO_BRANCH(req_rev->minor) &&
++ (rev->minor > req_rev->minor ||
++ (rev->minor == req_rev->minor &&
++ rev->subminor >= req_rev->subminor)))
+ return 0;
+
+ dev_info(mlxsw_sp->bus_info->dev, "The firmware version %d.%d.%d is incompatible with the driver\n",
+@@ -2815,6 +2818,13 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
+ MLXSW_REG_QEEC_MAS_DIS);
+ if (err)
+ return err;
++
++ err = mlxsw_sp_port_ets_maxrate_set(mlxsw_sp_port,
++ MLXSW_REG_QEEC_HIERARCY_TC,
++ i + 8, i,
++ MLXSW_REG_QEEC_MAS_DIS);
++ if (err)
++ return err;
+ }
+
+ /* Map all priorities to traffic class 0. */
+diff --git a/drivers/net/ethernet/micrel/ks8695net.c b/drivers/net/ethernet/micrel/ks8695net.c
+index bd51e057e915..b881f5d4a7f9 100644
+--- a/drivers/net/ethernet/micrel/ks8695net.c
++++ b/drivers/net/ethernet/micrel/ks8695net.c
+@@ -1164,7 +1164,7 @@ ks8695_timeout(struct net_device *ndev)
+ * sk_buff and adds it to the TX ring. It then kicks the TX DMA
+ * engine to ensure transmission begins.
+ */
+-static int
++static netdev_tx_t
+ ks8695_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct ks8695_priv *ksp = netdev_priv(ndev);
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index 0e9719fbc624..35f8c9ef204d 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -1021,9 +1021,9 @@ static void ks_write_qmu(struct ks_net *ks, u8 *pdata, u16 len)
+ * spin_lock_irqsave is required because tx and rx should be mutual exclusive.
+ * So while tx is in-progress, prevent IRQ interrupt from happenning.
+ */
+-static int ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+- int retv = NETDEV_TX_OK;
++ netdev_tx_t retv = NETDEV_TX_OK;
+ struct ks_net *ks = netdev_priv(netdev);
+
+ disable_irq(netdev->irq);
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+index c6d29fdbb880..d288c7eebacd 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+@@ -2187,9 +2187,13 @@ nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
+
+ tx_ring->size = array_size(tx_ring->cnt, sizeof(*tx_ring->txds));
+ tx_ring->txds = dma_zalloc_coherent(dp->dev, tx_ring->size,
+- &tx_ring->dma, GFP_KERNEL);
+- if (!tx_ring->txds)
++ &tx_ring->dma,
++ GFP_KERNEL | __GFP_NOWARN);
++ if (!tx_ring->txds) {
++ netdev_warn(dp->netdev, "failed to allocate TX descriptor ring memory, requested descriptor count: %d, consider lowering descriptor count\n",
++ tx_ring->cnt);
+ goto err_alloc;
++ }
+
+ tx_ring->txbufs = kvcalloc(tx_ring->cnt, sizeof(*tx_ring->txbufs),
+ GFP_KERNEL);
+@@ -2341,9 +2345,13 @@ nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring)
+ rx_ring->cnt = dp->rxd_cnt;
+ rx_ring->size = array_size(rx_ring->cnt, sizeof(*rx_ring->rxds));
+ rx_ring->rxds = dma_zalloc_coherent(dp->dev, rx_ring->size,
+- &rx_ring->dma, GFP_KERNEL);
+- if (!rx_ring->rxds)
++ &rx_ring->dma,
++ GFP_KERNEL | __GFP_NOWARN);
++ if (!rx_ring->rxds) {
++ netdev_warn(dp->netdev, "failed to allocate RX descriptor ring memory, requested descriptor count: %d, consider lowering descriptor count\n",
++ rx_ring->cnt);
+ goto err_alloc;
++ }
+
+ rx_ring->rxbufs = kvcalloc(rx_ring->cnt, sizeof(*rx_ring->rxbufs),
+ GFP_KERNEL);
+diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
+index b1b53f6c452f..8355dfbb8ec3 100644
+--- a/drivers/net/ethernet/smsc/smc911x.c
++++ b/drivers/net/ethernet/smsc/smc911x.c
+@@ -513,7 +513,8 @@ static void smc911x_hardware_send_pkt(struct net_device *dev)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc911x_local *lp = netdev_priv(dev);
+ unsigned int free;
+diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
+index b944828f9ea3..8d6cff8bd162 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -638,7 +638,8 @@ done: if (!THROTTLE_TX_PKTS)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc_local *lp = netdev_priv(dev);
+ void __iomem *ioaddr = lp->base;
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index f0afb88d7bc2..ce4bfecc26c7 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -1786,7 +1786,8 @@ static int smsc911x_stop(struct net_device *dev)
+ }
+
+ /* Entry point for transmitting a packet */
+-static int smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smsc911x_data *pdata = netdev_priv(dev);
+ unsigned int freespace;
+diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
+index f27d67a4d304..09d25b87cf7c 100644
+--- a/drivers/net/ethernet/socionext/sni_ave.c
++++ b/drivers/net/ethernet/socionext/sni_ave.c
+@@ -906,11 +906,11 @@ static void ave_rxfifo_reset(struct net_device *ndev)
+
+ /* assert reset */
+ writel(AVE_GRR_RXFFR, priv->base + AVE_GRR);
+- usleep_range(40, 50);
++ udelay(50);
+
+ /* negate reset */
+ writel(0, priv->base + AVE_GRR);
+- usleep_range(10, 20);
++ udelay(20);
+
+ /* negate interrupt status */
+ writel(AVE_GI_RXOVF, priv->base + AVE_GISR);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index 79c91526f3ec..fea286e14add 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -1199,7 +1199,7 @@ static int sun8i_dwmac_probe(struct platform_device *pdev)
+ dwmac_mux:
+ sun8i_dwmac_unset_syscon(gmac);
+ dwmac_exit:
+- sun8i_dwmac_exit(pdev, plat_dat->bsp_priv);
++ stmmac_pltfr_remove(pdev);
+ return ret;
+ }
+
+diff --git a/drivers/net/ethernet/sun/ldmvsw.c b/drivers/net/ethernet/sun/ldmvsw.c
+index d42f47f6c632..644e42c181ee 100644
+--- a/drivers/net/ethernet/sun/ldmvsw.c
++++ b/drivers/net/ethernet/sun/ldmvsw.c
+@@ -113,7 +113,7 @@ static u16 vsw_select_queue(struct net_device *dev, struct sk_buff *skb,
+ }
+
+ /* Wrappers to common functions */
+-static int vsw_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t vsw_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ return sunvnet_start_xmit_common(skb, dev, vsw_tx_port_find);
+ }
+diff --git a/drivers/net/ethernet/sun/sunbmac.c b/drivers/net/ethernet/sun/sunbmac.c
+index f047b2797156..720b7ac77f3b 100644
+--- a/drivers/net/ethernet/sun/sunbmac.c
++++ b/drivers/net/ethernet/sun/sunbmac.c
+@@ -950,7 +950,8 @@ static void bigmac_tx_timeout(struct net_device *dev)
+ }
+
+ /* Put a packet on the wire. */
+-static int bigmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++bigmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bigmac *bp = netdev_priv(dev);
+ int len, entry;
+diff --git a/drivers/net/ethernet/sun/sunqe.c b/drivers/net/ethernet/sun/sunqe.c
+index 7fe0d5e33922..1468fa0a54e9 100644
+--- a/drivers/net/ethernet/sun/sunqe.c
++++ b/drivers/net/ethernet/sun/sunqe.c
+@@ -570,7 +570,7 @@ out:
+ }
+
+ /* Get a packet queued to go onto the wire. */
+-static int qe_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t qe_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct sunqe *qep = netdev_priv(dev);
+ struct sunqe_buffers *qbufs = qep->buffers;
+diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
+index 12539b357a78..590172818b92 100644
+--- a/drivers/net/ethernet/sun/sunvnet.c
++++ b/drivers/net/ethernet/sun/sunvnet.c
+@@ -247,7 +247,7 @@ static u16 vnet_select_queue(struct net_device *dev, struct sk_buff *skb,
+ }
+
+ /* Wrappers to common functions */
+-static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ return sunvnet_start_xmit_common(skb, dev, vnet_tx_port_find);
+ }
+diff --git a/drivers/net/ethernet/sun/sunvnet_common.c b/drivers/net/ethernet/sun/sunvnet_common.c
+index d8f4c3f28150..baa3088b475c 100644
+--- a/drivers/net/ethernet/sun/sunvnet_common.c
++++ b/drivers/net/ethernet/sun/sunvnet_common.c
+@@ -1216,9 +1216,10 @@ static inline struct sk_buff *vnet_skb_shape(struct sk_buff *skb, int ncookies)
+ return skb;
+ }
+
+-static int vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb,
+- struct vnet_port *(*vnet_tx_port)
+- (struct sk_buff *, struct net_device *))
++static netdev_tx_t
++vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb,
++ struct vnet_port *(*vnet_tx_port)
++ (struct sk_buff *, struct net_device *))
+ {
+ struct net_device *dev = VNET_PORT_TO_NET_DEVICE(port);
+ struct vio_dring_state *dr = &port->vio.drings[VIO_DRIVER_TX_RING];
+@@ -1321,9 +1322,10 @@ out_dropped:
+ return NETDEV_TX_OK;
+ }
+
+-int sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
+- struct vnet_port *(*vnet_tx_port)
+- (struct sk_buff *, struct net_device *))
++netdev_tx_t
++sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
++ struct vnet_port *(*vnet_tx_port)
++ (struct sk_buff *, struct net_device *))
+ {
+ struct vnet_port *port = NULL;
+ struct vio_dring_state *dr;
+diff --git a/drivers/net/ethernet/sun/sunvnet_common.h b/drivers/net/ethernet/sun/sunvnet_common.h
+index 1ea0b016580a..2b808d2482d6 100644
+--- a/drivers/net/ethernet/sun/sunvnet_common.h
++++ b/drivers/net/ethernet/sun/sunvnet_common.h
+@@ -136,9 +136,10 @@ int sunvnet_close_common(struct net_device *dev);
+ void sunvnet_set_rx_mode_common(struct net_device *dev, struct vnet *vp);
+ int sunvnet_set_mac_addr_common(struct net_device *dev, void *p);
+ void sunvnet_tx_timeout_common(struct net_device *dev);
+-int sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
+- struct vnet_port *(*vnet_tx_port)
+- (struct sk_buff *, struct net_device *));
++netdev_tx_t
++sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
++ struct vnet_port *(*vnet_tx_port)
++ (struct sk_buff *, struct net_device *));
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ void sunvnet_poll_controller_common(struct net_device *dev, struct vnet *vp);
+ #endif
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+index 88d74aef218a..75237c81c63d 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+@@ -845,9 +845,9 @@ static int gelic_card_kick_txdma(struct gelic_card *card,
+ * @skb: packet to send out
+ * @netdev: interface device structure
+ *
+- * returns 0 on success, <0 on failure
++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure
+ */
+-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct gelic_card *card = netdev_card(netdev);
+ struct gelic_descr *descr;
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+index 003d0452d9cb..fbbf9b54b173 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+@@ -370,7 +370,7 @@ void gelic_card_up(struct gelic_card *card);
+ void gelic_card_down(struct gelic_card *card);
+ int gelic_net_open(struct net_device *netdev);
+ int gelic_net_stop(struct net_device *netdev);
+-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
+ void gelic_net_set_multi(struct net_device *netdev);
+ void gelic_net_tx_timeout(struct net_device *netdev);
+ int gelic_net_setup_netdev(struct net_device *netdev, struct gelic_card *card);
+diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c
+index d925b8203996..23417266b7ec 100644
+--- a/drivers/net/ethernet/toshiba/spider_net.c
++++ b/drivers/net/ethernet/toshiba/spider_net.c
+@@ -880,9 +880,9 @@ out:
+ * @skb: packet to send out
+ * @netdev: interface device structure
+ *
+- * returns 0 on success, !0 on failure
++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure
+ */
+-static int
++static netdev_tx_t
+ spider_net_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ int cnt;
+diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c
+index 9146068979d2..03afc4d8c3ec 100644
+--- a/drivers/net/ethernet/toshiba/tc35815.c
++++ b/drivers/net/ethernet/toshiba/tc35815.c
+@@ -474,7 +474,8 @@ static void free_rxbuf_skb(struct pci_dev *hwdev, struct sk_buff *skb, dma_addr_
+ /* Index to functions, as function prototypes. */
+
+ static int tc35815_open(struct net_device *dev);
+-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t tc35815_send_packet(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t tc35815_interrupt(int irq, void *dev_id);
+ static int tc35815_rx(struct net_device *dev, int limit);
+ static int tc35815_poll(struct napi_struct *napi, int budget);
+@@ -1248,7 +1249,8 @@ tc35815_open(struct net_device *dev)
+ * invariant will hold if you make sure that the netif_*_queue()
+ * calls are done at the proper times.
+ */
+-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++tc35815_send_packet(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct tc35815_local *lp = netdev_priv(dev);
+ struct TxFD *txfd;
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index 60abc9250f56..2241f9897092 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -674,7 +674,8 @@ static inline int temac_check_tx_bd_space(struct temac_local *lp, int num_frag)
+ return 0;
+ }
+
+-static int temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct temac_local *lp = netdev_priv(ndev);
+ struct cdmac_bd *cur_p;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index 66b30ebd45ee..28764268a44f 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -657,7 +657,8 @@ static inline int axienet_check_tx_bd_space(struct axienet_local *lp,
+ * start the transmission. Additionally if checksum offloading is supported,
+ * it populates AXI Stream Control fields with appropriate values.
+ */
+-static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ u32 ii;
+ u32 num_frag;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+index 42f1f518dad6..c77c81eb7ab3 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+@@ -1020,9 +1020,10 @@ static int xemaclite_close(struct net_device *dev)
+ * deferred and the Tx queue is stopped so that the deferred socket buffer can
+ * be transmitted when the Emaclite device is free to transmit data.
+ *
+- * Return: 0, always.
++ * Return: NETDEV_TX_OK, always.
+ */
+-static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
++static netdev_tx_t
++xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ {
+ struct net_local *lp = netdev_priv(dev);
+ struct sk_buff *new_skb;
+@@ -1044,7 +1045,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ /* Take the time stamp now, since we can't do this in an ISR. */
+ skb_tx_timestamp(new_skb);
+ spin_unlock_irqrestore(&lp->reset_lock, flags);
+- return 0;
++ return NETDEV_TX_OK;
+ }
+ spin_unlock_irqrestore(&lp->reset_lock, flags);
+
+@@ -1053,7 +1054,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ dev->stats.tx_bytes += len;
+ dev_consume_skb_any(new_skb);
+
+- return 0;
++ return NETDEV_TX_OK;
+ }
+
+ /**
+diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c
+index 5a749dc25bec..beeb7eb76ca3 100644
+--- a/drivers/net/net_failover.c
++++ b/drivers/net/net_failover.c
+@@ -765,8 +765,10 @@ struct failover *net_failover_create(struct net_device *standby_dev)
+ netif_carrier_off(failover_dev);
+
+ failover = failover_register(failover_dev, &net_failover_ops);
+- if (IS_ERR(failover))
++ if (IS_ERR(failover)) {
++ err = PTR_ERR(failover);
+ goto err_failover_register;
++ }
+
+ return failover;
+
+diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c
+index 8d370667fa1b..df75efa96a7d 100644
+--- a/drivers/net/phy/mdio-bcm-unimac.c
++++ b/drivers/net/phy/mdio-bcm-unimac.c
+@@ -16,6 +16,7 @@
+ #include <linux/module.h>
+ #include <linux/io.h>
+ #include <linux/delay.h>
++#include <linux/clk.h>
+
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+@@ -45,6 +46,8 @@ struct unimac_mdio_priv {
+ void __iomem *base;
+ int (*wait_func) (void *wait_func_data);
+ void *wait_func_data;
++ struct clk *clk;
++ u32 clk_freq;
+ };
+
+ static inline u32 unimac_mdio_readl(struct unimac_mdio_priv *priv, u32 offset)
+@@ -189,6 +192,35 @@ static int unimac_mdio_reset(struct mii_bus *bus)
+ return 0;
+ }
+
++static void unimac_mdio_clk_set(struct unimac_mdio_priv *priv)
++{
++ unsigned long rate;
++ u32 reg, div;
++
++ /* Keep the hardware default values */
++ if (!priv->clk_freq)
++ return;
++
++ if (!priv->clk)
++ rate = 250000000;
++ else
++ rate = clk_get_rate(priv->clk);
++
++ div = (rate / (2 * priv->clk_freq)) - 1;
++ if (div & ~MDIO_CLK_DIV_MASK) {
++ pr_warn("Incorrect MDIO clock frequency, ignoring\n");
++ return;
++ }
++
++ /* The MDIO clock is the reference clock (typicaly 250Mhz) divided by
++ * 2 x (MDIO_CLK_DIV + 1)
++ */
++ reg = unimac_mdio_readl(priv, MDIO_CFG);
++ reg &= ~(MDIO_CLK_DIV_MASK << MDIO_CLK_DIV_SHIFT);
++ reg |= div << MDIO_CLK_DIV_SHIFT;
++ unimac_mdio_writel(priv, reg, MDIO_CFG);
++}
++
+ static int unimac_mdio_probe(struct platform_device *pdev)
+ {
+ struct unimac_mdio_pdata *pdata = pdev->dev.platform_data;
+@@ -217,9 +249,26 @@ static int unimac_mdio_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
++ priv->clk = devm_clk_get(&pdev->dev, NULL);
++ if (PTR_ERR(priv->clk) == -EPROBE_DEFER)
++ return PTR_ERR(priv->clk);
++ else
++ priv->clk = NULL;
++
++ ret = clk_prepare_enable(priv->clk);
++ if (ret)
++ return ret;
++
++ if (of_property_read_u32(np, "clock-frequency", &priv->clk_freq))
++ priv->clk_freq = 0;
++
++ unimac_mdio_clk_set(priv);
++
+ priv->mii_bus = mdiobus_alloc();
+- if (!priv->mii_bus)
+- return -ENOMEM;
++ if (!priv->mii_bus) {
++ ret = -ENOMEM;
++ goto out_clk_disable;
++ }
+
+ bus = priv->mii_bus;
+ bus->priv = priv;
+@@ -253,6 +302,8 @@ static int unimac_mdio_probe(struct platform_device *pdev)
+
+ out_mdio_free:
+ mdiobus_free(bus);
++out_clk_disable:
++ clk_disable_unprepare(priv->clk);
+ return ret;
+ }
+
+@@ -262,10 +313,37 @@ static int unimac_mdio_remove(struct platform_device *pdev)
+
+ mdiobus_unregister(priv->mii_bus);
+ mdiobus_free(priv->mii_bus);
++ clk_disable_unprepare(priv->clk);
++
++ return 0;
++}
++
++static int __maybe_unused unimac_mdio_suspend(struct device *d)
++{
++ struct unimac_mdio_priv *priv = dev_get_drvdata(d);
++
++ clk_disable_unprepare(priv->clk);
++
++ return 0;
++}
++
++static int __maybe_unused unimac_mdio_resume(struct device *d)
++{
++ struct unimac_mdio_priv *priv = dev_get_drvdata(d);
++ int ret;
++
++ ret = clk_prepare_enable(priv->clk);
++ if (ret)
++ return ret;
++
++ unimac_mdio_clk_set(priv);
+
+ return 0;
+ }
+
++static SIMPLE_DEV_PM_OPS(unimac_mdio_pm_ops,
++ unimac_mdio_suspend, unimac_mdio_resume);
++
+ static const struct of_device_id unimac_mdio_ids[] = {
+ { .compatible = "brcm,genet-mdio-v5", },
+ { .compatible = "brcm,genet-mdio-v4", },
+@@ -281,6 +359,7 @@ static struct platform_driver unimac_mdio_driver = {
+ .driver = {
+ .name = UNIMAC_MDIO_DRV_NAME,
+ .of_match_table = unimac_mdio_ids,
++ .pm = &unimac_mdio_pm_ops,
+ },
+ .probe = unimac_mdio_probe,
+ .remove = unimac_mdio_remove,
+diff --git a/drivers/net/phy/mscc.c b/drivers/net/phy/mscc.c
+index 84ca9ff40ae0..36647b70b9a3 100644
+--- a/drivers/net/phy/mscc.c
++++ b/drivers/net/phy/mscc.c
+@@ -111,8 +111,8 @@ struct vsc8531_private {
+
+ #ifdef CONFIG_OF_MDIO
+ struct vsc8531_edge_rate_table {
+- u16 vddmac;
+- u8 slowdown[8];
++ u32 vddmac;
++ u32 slowdown[8];
+ };
+
+ static const struct vsc8531_edge_rate_table edge_table[] = {
+@@ -375,8 +375,7 @@ out_unlock:
+ #ifdef CONFIG_OF_MDIO
+ static int vsc85xx_edge_rate_magic_get(struct phy_device *phydev)
+ {
+- u8 sd;
+- u16 vdd;
++ u32 vdd, sd;
+ int rc, i, j;
+ struct device *dev = &phydev->mdio.dev;
+ struct device_node *of_node = dev->of_node;
+@@ -385,11 +384,11 @@ static int vsc85xx_edge_rate_magic_get(struct phy_device *phydev)
+ if (!of_node)
+ return -ENODEV;
+
+- rc = of_property_read_u16(of_node, "vsc8531,vddmac", &vdd);
++ rc = of_property_read_u32(of_node, "vsc8531,vddmac", &vdd);
+ if (rc != 0)
+ vdd = MSCC_VDDMAC_3300;
+
+- rc = of_property_read_u8(of_node, "vsc8531,edge-slowdown", &sd);
++ rc = of_property_read_u32(of_node, "vsc8531,edge-slowdown", &sd);
+ if (rc != 0)
+ sd = 0;
+
+diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
+index b008266e91ea..a5874059da9d 100644
+--- a/drivers/net/slip/slip.c
++++ b/drivers/net/slip/slip.c
+@@ -855,6 +855,7 @@ err_free_chan:
+ sl->tty = NULL;
+ tty->disc_data = NULL;
+ clear_bit(SLF_INUSE, &sl->flags);
++ free_netdev(sl->dev);
+
+ err_exit:
+ rtnl_unlock();
+diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
+index 501576f53854..914cac55a7ae 100644
+--- a/drivers/net/usb/ax88172a.c
++++ b/drivers/net/usb/ax88172a.c
+@@ -208,7 +208,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
+
+ /* Get the MAC address */
+ ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
+- if (ret < 0) {
++ if (ret < ETH_ALEN) {
+ netdev_err(dev->net, "Failed to read MAC address: %d\n", ret);
+ goto free;
+ }
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 3a172fcb06fe..50bf4b2080d5 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2950,6 +2950,11 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
+ int i;
+
+ ret = lan78xx_get_endpoints(dev, intf);
++ if (ret) {
++ netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n",
++ ret);
++ return ret;
++ }
+
+ dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL);
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 9f037c50054d..b55fd76348f9 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1306,6 +1306,8 @@ static const struct usb_device_id products[] = {
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
+ {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */
+ {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */
++ {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */
++ {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/
+
+ /* 4. Gobi 1000 devices */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
+diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c
+index c9bd0e2b5db7..be90c9e9e5bc 100644
+--- a/drivers/net/wireless/ath/ath10k/ahb.c
++++ b/drivers/net/wireless/ath/ath10k/ahb.c
+@@ -655,10 +655,10 @@ static void ath10k_ahb_hif_stop(struct ath10k *ar)
+ ath10k_ahb_irq_disable(ar);
+ synchronize_irq(ar_ahb->irq);
+
+- ath10k_pci_flush(ar);
+-
+ napi_synchronize(&ar->napi);
+ napi_disable(&ar->napi);
++
++ ath10k_pci_flush(ar);
+ }
+
+ static int ath10k_ahb_hif_power_up(struct ath10k *ar)
+diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
+index 2791ef2fd716..436eac342b62 100644
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -91,6 +91,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .rx_ring_fill_level = HTT_RX_RING_FILL_LEVEL,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA988X_HW_2_0_VERSION,
+@@ -124,6 +125,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA9887_HW_1_0_VERSION,
+@@ -157,6 +159,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA6174_HW_2_1_VERSION,
+@@ -189,6 +192,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA6174_HW_2_1_VERSION,
+@@ -221,6 +225,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA6174_HW_3_0_VERSION,
+@@ -253,6 +258,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA6174_HW_3_2_VERSION,
+@@ -288,6 +294,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA99X0_HW_2_0_DEV_VERSION,
+@@ -326,6 +333,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA9984_HW_1_0_DEV_VERSION,
+@@ -369,6 +377,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA9888_HW_2_0_DEV_VERSION,
+@@ -411,6 +420,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA9377_HW_1_0_DEV_VERSION,
+@@ -443,6 +453,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA9377_HW_1_1_DEV_VERSION,
+@@ -477,6 +488,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = QCA4019_HW_1_0_DEV_VERSION,
+@@ -516,6 +528,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = false,
+ .shadow_reg_support = false,
+ .rri_on_ddr = false,
++ .hw_filter_reset_required = true,
+ },
+ {
+ .id = WCN3990_HW_1_0_DEV_VERSION,
+@@ -540,6 +553,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
+ .per_ce_irq = true,
+ .shadow_reg_support = true,
+ .rri_on_ddr = true,
++ .hw_filter_reset_required = false,
+ },
+ };
+
+@@ -2406,7 +2420,8 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode,
+ * possible to implicitly make it correct by creating a dummy vdev and
+ * then deleting it.
+ */
+- if (mode == ATH10K_FIRMWARE_MODE_NORMAL) {
++ if (ar->hw_params.hw_filter_reset_required &&
++ mode == ATH10K_FIRMWARE_MODE_NORMAL) {
+ status = ath10k_core_reset_rx_filter(ar);
+ if (status) {
+ ath10k_err(ar,
+diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
+index 977f79ebb4fd..fac58c3c576a 100644
+--- a/drivers/net/wireless/ath/ath10k/hw.h
++++ b/drivers/net/wireless/ath/ath10k/hw.h
+@@ -589,6 +589,11 @@ struct ath10k_hw_params {
+
+ /* Number of bytes to be the offset for each FFT sample */
+ int spectral_bin_offset;
++
++ /* targets which require hw filter reset during boot up,
++ * to avoid it sending spurious acks.
++ */
++ bool hw_filter_reset_required;
+ };
+
+ struct htt_rx_desc;
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 1419f9d1505f..9d033da46ec2 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -18,6 +18,7 @@
+
+ #include "mac.h"
+
++#include <net/cfg80211.h>
+ #include <net/mac80211.h>
+ #include <linux/etherdevice.h>
+ #include <linux/acpi.h>
+@@ -8363,6 +8364,7 @@ int ath10k_mac_register(struct ath10k *ar)
+ ar->hw->wiphy->bands[NL80211_BAND_5GHZ] = band;
+ }
+
++ wiphy_read_of_freq_limits(ar->hw->wiphy);
+ ath10k_mac_setup_ht_vht_cap(ar);
+
+ ar->hw->wiphy->interface_modes =
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index af2cf55c4c1e..97fa5c74f2fe 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -2068,9 +2068,9 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
+
+ ath10k_pci_irq_disable(ar);
+ ath10k_pci_irq_sync(ar);
+- ath10k_pci_flush(ar);
+ napi_synchronize(&ar->napi);
+ napi_disable(&ar->napi);
++ ath10k_pci_flush(ar);
+
+ spin_lock_irqsave(&ar_pci->ps_lock, flags);
+ WARN_ON(ar_pci->ps_wake_refcount > 0);
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 9f31b9a10850..40b36e73bb48 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -2487,7 +2487,8 @@ int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
+ status->freq, status->band, status->signal,
+ status->rate_idx);
+
+- ieee80211_rx(ar->hw, skb);
++ ieee80211_rx_ni(ar->hw, skb);
++
+ return 0;
+ }
+
+@@ -4785,6 +4786,13 @@ ath10k_wmi_tpc_final_get_rate(struct ath10k *ar,
+ }
+ }
+
++ if (pream == -1) {
++ ath10k_warn(ar, "unknown wmi tpc final index and frequency: %u, %u\n",
++ pream_idx, __le32_to_cpu(ev->chan_freq));
++ tpc = 0;
++ goto out;
++ }
++
+ if (pream == 4)
+ tpc = min_t(u8, ev->rates_array[rate_idx],
+ ev->max_reg_allow_pow[ch]);
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 1049773378f2..74f98bbaea88 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1252,7 +1252,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ struct ath_node *an = &avp->mcast_node;
+
+ mutex_lock(&sc->mutex);
+-
+ if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
+ if (sc->cur_chan->nvifs >= 1) {
+ mutex_unlock(&sc->mutex);
+diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
+index ce50d8f5835e..95544ce05acf 100644
+--- a/drivers/net/wireless/ath/ath9k/tx99.c
++++ b/drivers/net/wireless/ath/ath9k/tx99.c
+@@ -56,11 +56,6 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ struct sk_buff *skb;
+ struct ath_vif *avp;
+
+- if (!sc->tx99_vif)
+- return NULL;
+-
+- avp = (struct ath_vif *)sc->tx99_vif->drv_priv;
+-
+ skb = alloc_skb(len, GFP_KERNEL);
+ if (!skb)
+ return NULL;
+@@ -77,7 +72,10 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+ memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+
+- hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
++ if (sc->tx99_vif) {
++ avp = (struct ath_vif *) sc->tx99_vif->drv_priv;
++ hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
++ }
+
+ tx_info = IEEE80211_SKB_CB(skb);
+ memset(tx_info, 0, sizeof(*tx_info));
+diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
+index 51c3330bc316..ceace95b1595 100644
+--- a/drivers/net/wireless/ath/wil6210/debugfs.c
++++ b/drivers/net/wireless/ath/wil6210/debugfs.c
+@@ -1263,6 +1263,9 @@ static int wil_rx_buff_mgmt_debugfs_show(struct seq_file *s, void *data)
+ int num_active;
+ int num_free;
+
++ if (!rbm->buff_arr)
++ return -EINVAL;
++
+ seq_printf(s, " size = %zu\n", rbm->size);
+ seq_printf(s, " free_list_empty_cnt = %lu\n",
+ rbm->free_list_empty_cnt);
+diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
+index a0fe8cbad104..920cb233f4db 100644
+--- a/drivers/net/wireless/ath/wil6210/main.c
++++ b/drivers/net/wireless/ath/wil6210/main.c
+@@ -223,6 +223,7 @@ __acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
+ struct net_device *ndev = vif_to_ndev(vif);
+ struct wireless_dev *wdev = vif_to_wdev(vif);
+ struct wil_sta_info *sta = &wil->sta[cid];
++ int min_ring_id = wil_get_min_tx_ring_id(wil);
+
+ might_sleep();
+ wil_dbg_misc(wil, "disconnect_cid: CID %d, MID %d, status %d\n",
+@@ -273,7 +274,7 @@ __acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
+ memset(sta->tid_crypto_rx, 0, sizeof(sta->tid_crypto_rx));
+ memset(&sta->group_crypto_rx, 0, sizeof(sta->group_crypto_rx));
+ /* release vrings */
+- for (i = 0; i < ARRAY_SIZE(wil->ring_tx); i++) {
++ for (i = min_ring_id; i < ARRAY_SIZE(wil->ring_tx); i++) {
+ if (wil->ring2cid_tid[i][0] == cid)
+ wil_ring_fini_tx(wil, i);
+ }
+@@ -604,8 +605,10 @@ int wil_priv_init(struct wil6210_priv *wil)
+ wil->sta[i].mid = U8_MAX;
+ }
+
+- for (i = 0; i < WIL6210_MAX_TX_RINGS; i++)
++ for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
+ spin_lock_init(&wil->ring_tx_data[i].lock);
++ wil->ring2cid_tid[i][0] = WIL6210_MAX_CID;
++ }
+
+ mutex_init(&wil->mutex);
+ mutex_init(&wil->vif_mutex);
+@@ -653,8 +656,6 @@ int wil_priv_init(struct wil6210_priv *wil)
+
+ /* edma configuration can be updated via debugfs before allocation */
+ wil->num_rx_status_rings = WIL_DEFAULT_NUM_RX_STATUS_RINGS;
+- wil->use_compressed_rx_status = true;
+- wil->use_rx_hw_reordering = true;
+ wil->tx_status_ring_order = WIL_TX_SRING_SIZE_ORDER_DEFAULT;
+
+ /* Rx status ring size should be bigger than the number of RX buffers
+diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
+index 89119e7facd0..c8c6613371d1 100644
+--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
++++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
+@@ -108,6 +108,7 @@ int wil_set_capabilities(struct wil6210_priv *wil)
+ set_bit(hw_capa_no_flash, wil->hw_capa);
+ wil->use_enhanced_dma_hw = true;
+ wil->use_rx_hw_reordering = true;
++ wil->use_compressed_rx_status = true;
+ wil_fw_name = ftm_mode ? WIL_FW_NAME_FTM_TALYN :
+ WIL_FW_NAME_TALYN;
+ if (wil_fw_verify_file_exists(wil, wil_fw_name))
+diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
+index 1b1b58e0129a..73cdf54521f9 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx.c
++++ b/drivers/net/wireless/ath/wil6210/txrx.c
+@@ -77,8 +77,9 @@ bool wil_is_tx_idle(struct wil6210_priv *wil)
+ {
+ int i;
+ unsigned long data_comp_to;
++ int min_ring_id = wil_get_min_tx_ring_id(wil);
+
+- for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
++ for (i = min_ring_id; i < WIL6210_MAX_TX_RINGS; i++) {
+ struct wil_ring *vring = &wil->ring_tx[i];
+ int vring_index = vring - wil->ring_tx;
+ struct wil_ring_tx_data *txdata =
+@@ -766,7 +767,14 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
+ return;
+ }
+
+- if (wdev->iftype == NL80211_IFTYPE_AP && !vif->ap_isolate) {
++ if (wdev->iftype == NL80211_IFTYPE_STATION) {
++ if (mcast && ether_addr_equal(eth->h_source, ndev->dev_addr)) {
++ /* mcast packet looped back to us */
++ rc = GRO_DROP;
++ dev_kfree_skb(skb);
++ goto stats;
++ }
++ } else if (wdev->iftype == NL80211_IFTYPE_AP && !vif->ap_isolate) {
+ if (mcast) {
+ /* send multicast frames both to higher layers in
+ * local net stack and back to the wireless medium
+@@ -1938,6 +1946,7 @@ static inline void __wil_update_net_queues(struct wil6210_priv *wil,
+ bool check_stop)
+ {
+ int i;
++ int min_ring_id = wil_get_min_tx_ring_id(wil);
+
+ if (unlikely(!vif))
+ return;
+@@ -1970,7 +1979,7 @@ static inline void __wil_update_net_queues(struct wil6210_priv *wil,
+ return;
+
+ /* check wake */
+- for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
++ for (i = min_ring_id; i < WIL6210_MAX_TX_RINGS; i++) {
+ struct wil_ring *cur_ring = &wil->ring_tx[i];
+ struct wil_ring_tx_data *txdata = &wil->ring_tx_data[i];
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+index 27893af63ebc..8510d207ee87 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -296,9 +296,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
+ /* Replace all newline/linefeed characters with space
+ * character
+ */
+- ptr = clmver;
+- while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL)
+- *ptr = ' ';
++ strreplace(clmver, '\n', ' ');
+
+ brcmf_dbg(INFO, "CLM version = %s\n", clmver);
+ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+index 8347da632a5b..4c5a3995dc35 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -178,7 +178,7 @@ static void brcmf_feat_iovar_data_set(struct brcmf_if *ifp,
+ ifp->fwil_fwerr = false;
+ }
+
+-#define MAX_CAPS_BUFFER_SIZE 512
++#define MAX_CAPS_BUFFER_SIZE 768
+ static void brcmf_feat_firmware_capabilities(struct brcmf_if *ifp)
+ {
+ char caps[MAX_CAPS_BUFFER_SIZE];
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+index ecc89e718b9c..6255fb6d97a7 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+@@ -1578,10 +1578,10 @@ int brcms_ucode_init_buf(struct brcms_info *wl, void **pbuf, u32 idx)
+ if (le32_to_cpu(hdr->idx) == idx) {
+ pdata = wl->fw.fw_bin[i]->data +
+ le32_to_cpu(hdr->offset);
+- *pbuf = kmemdup(pdata, len, GFP_KERNEL);
++ *pbuf = kvmalloc(len, GFP_KERNEL);
+ if (*pbuf == NULL)
+ goto fail;
+-
++ memcpy(*pbuf, pdata, len);
+ return 0;
+ }
+ }
+@@ -1629,7 +1629,7 @@ int brcms_ucode_init_uint(struct brcms_info *wl, size_t *n_bytes, u32 idx)
+ */
+ void brcms_ucode_free_buf(void *p)
+ {
+- kfree(p);
++ kvfree(p);
+ }
+
+ /*
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+index b4347806a59e..a0de61aa0fef 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+@@ -143,7 +143,7 @@ static const struct iwl_ht_params iwl_22000_ht_params = {
+ .ucode_api_min = IWL_22000_UCODE_API_MIN, \
+ .led_mode = IWL_LED_RF_STATE, \
+ .nvm_hw_section_num = NVM_HW_SECTION_NUM_FAMILY_22000, \
+- .non_shared_ant = ANT_A, \
++ .non_shared_ant = ANT_B, \
+ .dccm_offset = IWL_22000_DCCM_OFFSET, \
+ .dccm_len = IWL_22000_DCCM_LEN, \
+ .dccm2_offset = IWL_22000_DCCM2_OFFSET, \
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h b/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h
+index 2f599353c885..2ba1401e5c0d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/rx.h
+@@ -574,6 +574,69 @@ struct iwl_rx_mpdu_desc {
+
+ #define IWL_RX_DESC_SIZE_V1 offsetofend(struct iwl_rx_mpdu_desc, v1)
+
++#define IWL_CD_STTS_OPTIMIZED_POS 0
++#define IWL_CD_STTS_OPTIMIZED_MSK 0x01
++#define IWL_CD_STTS_TRANSFER_STATUS_POS 1
++#define IWL_CD_STTS_TRANSFER_STATUS_MSK 0x0E
++#define IWL_CD_STTS_WIFI_STATUS_POS 4
++#define IWL_CD_STTS_WIFI_STATUS_MSK 0xF0
++
++/**
++ * enum iwl_completion_desc_transfer_status - transfer status (bits 1-3)
++ * @IWL_CD_STTS_UNUSED: unused
++ * @IWL_CD_STTS_UNUSED_2: unused
++ * @IWL_CD_STTS_END_TRANSFER: successful transfer complete.
++ * In sniffer mode, when split is used, set in last CD completion. (RX)
++ * @IWL_CD_STTS_OVERFLOW: In sniffer mode, when using split - used for
++ * all CD completion. (RX)
++ * @IWL_CD_STTS_ABORTED: CR abort / close flow. (RX)
++ * @IWL_CD_STTS_ERROR: general error (RX)
++ */
++enum iwl_completion_desc_transfer_status {
++ IWL_CD_STTS_UNUSED,
++ IWL_CD_STTS_UNUSED_2,
++ IWL_CD_STTS_END_TRANSFER,
++ IWL_CD_STTS_OVERFLOW,
++ IWL_CD_STTS_ABORTED,
++ IWL_CD_STTS_ERROR,
++};
++
++/**
++ * enum iwl_completion_desc_wifi_status - wifi status (bits 4-7)
++ * @IWL_CD_STTS_VALID: the packet is valid (RX)
++ * @IWL_CD_STTS_FCS_ERR: frame check sequence error (RX)
++ * @IWL_CD_STTS_SEC_KEY_ERR: error handling the security key of rx (RX)
++ * @IWL_CD_STTS_DECRYPTION_ERR: error decrypting the frame (RX)
++ * @IWL_CD_STTS_DUP: duplicate packet (RX)
++ * @IWL_CD_STTS_ICV_MIC_ERR: MIC error (RX)
++ * @IWL_CD_STTS_INTERNAL_SNAP_ERR: problems removing the snap (RX)
++ * @IWL_CD_STTS_SEC_PORT_FAIL: security port fail (RX)
++ * @IWL_CD_STTS_BA_OLD_SN: block ack received old SN (RX)
++ * @IWL_CD_STTS_QOS_NULL: QoS null packet (RX)
++ * @IWL_CD_STTS_MAC_HDR_ERR: MAC header conversion error (RX)
++ * @IWL_CD_STTS_MAX_RETRANS: reached max number of retransmissions (TX)
++ * @IWL_CD_STTS_EX_LIFETIME: exceeded lifetime (TX)
++ * @IWL_CD_STTS_NOT_USED: completed but not used (RX)
++ * @IWL_CD_STTS_REPLAY_ERR: pn check failed, replay error (RX)
++ */
++enum iwl_completion_desc_wifi_status {
++ IWL_CD_STTS_VALID,
++ IWL_CD_STTS_FCS_ERR,
++ IWL_CD_STTS_SEC_KEY_ERR,
++ IWL_CD_STTS_DECRYPTION_ERR,
++ IWL_CD_STTS_DUP,
++ IWL_CD_STTS_ICV_MIC_ERR,
++ IWL_CD_STTS_INTERNAL_SNAP_ERR,
++ IWL_CD_STTS_SEC_PORT_FAIL,
++ IWL_CD_STTS_BA_OLD_SN,
++ IWL_CD_STTS_QOS_NULL,
++ IWL_CD_STTS_MAC_HDR_ERR,
++ IWL_CD_STTS_MAX_RETRANS,
++ IWL_CD_STTS_EX_LIFETIME,
++ IWL_CD_STTS_NOT_USED,
++ IWL_CD_STTS_REPLAY_ERR,
++};
++
+ struct iwl_frame_release {
+ u8 baid;
+ u8 reserved;
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
+index 514b86123d3d..80853f6cbd6d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
+@@ -747,9 +747,9 @@ enum iwl_mvm_ba_resp_flags {
+ * @tfd_cnt: number of TFD-Q elements
+ * @ra_tid_cnt: number of RATID-Q elements
+ * @tfd: array of TFD queue status updates. See &iwl_mvm_compressed_ba_tfd
+- * for details.
++ * for details. Length in @tfd_cnt.
+ * @ra_tid: array of RA-TID queue status updates. For debug purposes only. See
+- * &iwl_mvm_compressed_ba_ratid for more details.
++ * &iwl_mvm_compressed_ba_ratid for more details. Length in @ra_tid_cnt.
+ */
+ struct iwl_mvm_compressed_ba_notif {
+ __le32 flags;
+@@ -766,7 +766,7 @@ struct iwl_mvm_compressed_ba_notif {
+ __le32 tx_rate;
+ __le16 tfd_cnt;
+ __le16 ra_tid_cnt;
+- struct iwl_mvm_compressed_ba_tfd tfd[1];
++ struct iwl_mvm_compressed_ba_tfd tfd[0];
+ struct iwl_mvm_compressed_ba_ratid ra_tid[0];
+ } __packed; /* COMPRESSED_BA_RES_API_S_VER_4 */
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index a31a42e673c4..3443cbdbab4a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -824,7 +824,7 @@ void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt)
+ }
+
+ /* We only dump the FIFOs if the FW is in error state */
+- if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status)) {
++ if (fifo_data_len) {
+ iwl_fw_dump_fifos(fwrt, &dump_data);
+ if (radio_len)
+ iwl_read_radio_regs(fwrt, &dump_data);
+@@ -1016,7 +1016,7 @@ int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
+ * If the loading of the FW completed successfully, the next step is to
+ * get the SMEM config data. Thus, if fwrt->smem_cfg.num_lmacs is non
+ * zero, the FW was already loaded successully. If the state is "NO_FW"
+- * in such a case - WARN and exit, since FW may be dead. Otherwise, we
++ * in such a case - exit, since FW may be dead. Otherwise, we
+ * can try to collect the data, since FW might just not be fully
+ * loaded (no "ALIVE" yet), and the debug data is accessible.
+ *
+@@ -1024,9 +1024,8 @@ int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
+ * config. In such a case, due to HW access problems, we might
+ * collect garbage.
+ */
+- if (WARN((fwrt->trans->state == IWL_TRANS_NO_FW) &&
+- fwrt->smem_cfg.num_lmacs,
+- "Can't collect dbg data when FW isn't alive\n"))
++ if (fwrt->trans->state == IWL_TRANS_NO_FW &&
++ fwrt->smem_cfg.num_lmacs)
+ return -EIO;
+
+ if (test_and_set_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status))
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+index 279dd7b7a3fb..0b8cf7f3af93 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+@@ -269,6 +269,7 @@ struct iwl_rx_cmd_buffer {
+ bool _page_stolen;
+ u32 _rx_page_order;
+ unsigned int truesize;
++ u8 status;
+ };
+
+ static inline void *rxb_addr(struct iwl_rx_cmd_buffer *r)
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+index b3fd20502abb..d90d58309bf0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+@@ -85,6 +85,10 @@ const u8 iwl_mvm_ac_to_gen2_tx_fifo[] = {
+ IWL_GEN2_EDCA_TX_FIFO_VI,
+ IWL_GEN2_EDCA_TX_FIFO_BE,
+ IWL_GEN2_EDCA_TX_FIFO_BK,
++ IWL_GEN2_TRIG_TX_FIFO_VO,
++ IWL_GEN2_TRIG_TX_FIFO_VI,
++ IWL_GEN2_TRIG_TX_FIFO_BE,
++ IWL_GEN2_TRIG_TX_FIFO_BK,
+ };
+
+ struct iwl_mvm_mac_iface_iterator_data {
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index 18db1ed92d9b..04ea516bddcc 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -3133,10 +3133,6 @@ static int __iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
+
+ switch (keyconf->cipher) {
+ case WLAN_CIPHER_SUITE_TKIP:
+- if (vif->type == NL80211_IFTYPE_AP) {
+- ret = -EINVAL;
+- break;
+- }
+ addr = iwl_mvm_get_mac_addr(mvm, vif, sta);
+ /* get phase 1 key from mac80211 */
+ ieee80211_get_key_rx_seq(keyconf, 0, &seq);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 5615ce55cef5..449e3d32811a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -778,6 +778,36 @@ iwl_mvm_tx_tso_segment(struct sk_buff *skb, unsigned int num_subframes,
+ return 0;
+ }
+
++static unsigned int iwl_mvm_max_amsdu_size(struct iwl_mvm *mvm,
++ struct ieee80211_sta *sta,
++ unsigned int tid)
++{
++ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
++ enum nl80211_band band = mvmsta->vif->bss_conf.chandef.chan->band;
++ u8 ac = tid_to_mac80211_ac[tid];
++ unsigned int txf;
++ int lmac = IWL_LMAC_24G_INDEX;
++
++ if (iwl_mvm_is_cdb_supported(mvm) &&
++ band == NL80211_BAND_5GHZ)
++ lmac = IWL_LMAC_5G_INDEX;
++
++ /* For HE redirect to trigger based fifos */
++ if (sta->he_cap.has_he && !WARN_ON(!iwl_mvm_has_new_tx_api(mvm)))
++ ac += 4;
++
++ txf = iwl_mvm_mac_ac_to_tx_fifo(mvm, ac);
++
++ /*
++ * Don't send an AMSDU that will be longer than the TXF.
++ * Add a security margin of 256 for the TX command + headers.
++ * We also want to have the start of the next packet inside the
++ * fifo to be able to send bursts.
++ */
++ return min_t(unsigned int, mvmsta->max_amsdu_len,
++ mvm->fwrt.smem_cfg.lmac[lmac].txfifo_size[txf] - 256);
++}
++
+ static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,
+ struct ieee80211_tx_info *info,
+ struct ieee80211_sta *sta,
+@@ -790,7 +820,7 @@ static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,
+ u16 snap_ip_tcp, pad;
+ unsigned int dbg_max_amsdu_len;
+ netdev_features_t netdev_flags = NETIF_F_CSUM_MASK | NETIF_F_SG;
+- u8 tid, txf;
++ u8 tid;
+
+ snap_ip_tcp = 8 + skb_transport_header(skb) - skb_network_header(skb) +
+ tcp_hdrlen(skb);
+@@ -829,20 +859,7 @@ static int iwl_mvm_tx_tso(struct iwl_mvm *mvm, struct sk_buff *skb,
+ !(mvmsta->amsdu_enabled & BIT(tid)))
+ return iwl_mvm_tx_tso_segment(skb, 1, netdev_flags, mpdus_skb);
+
+- max_amsdu_len = mvmsta->max_amsdu_len;
+-
+- /* the Tx FIFO to which this A-MSDU will be routed */
+- txf = iwl_mvm_mac_ac_to_tx_fifo(mvm, tid_to_mac80211_ac[tid]);
+-
+- /*
+- * Don't send an AMSDU that will be longer than the TXF.
+- * Add a security margin of 256 for the TX command + headers.
+- * We also want to have the start of the next packet inside the
+- * fifo to be able to send bursts.
+- */
+- max_amsdu_len = min_t(unsigned int, max_amsdu_len,
+- mvm->fwrt.smem_cfg.lmac[0].txfifo_size[txf] -
+- 256);
++ max_amsdu_len = iwl_mvm_max_amsdu_size(mvm, sta, tid);
+
+ if (unlikely(dbg_max_amsdu_len))
+ max_amsdu_len = min_t(unsigned int, max_amsdu_len,
+@@ -1438,6 +1455,14 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ break;
+ }
+
++ /*
++ * If we are freeing multiple frames, mark all the frames
++ * but the first one as acked, since they were acknowledged
++ * before
++ * */
++ if (skb_freed > 1)
++ info->flags |= IEEE80211_TX_STAT_ACK;
++
+ iwl_mvm_tx_status_check_trigger(mvm, status);
+
+ info->status.rates[0].count = tx_resp->failure_frame + 1;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+index 00f9566bcc21..e9d67ba3e56d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+@@ -102,66 +102,6 @@ struct isr_statistics {
+ u32 unhandled;
+ };
+
+-#define IWL_CD_STTS_OPTIMIZED_POS 0
+-#define IWL_CD_STTS_OPTIMIZED_MSK 0x01
+-#define IWL_CD_STTS_TRANSFER_STATUS_POS 1
+-#define IWL_CD_STTS_TRANSFER_STATUS_MSK 0x0E
+-#define IWL_CD_STTS_WIFI_STATUS_POS 4
+-#define IWL_CD_STTS_WIFI_STATUS_MSK 0xF0
+-
+-/**
+- * enum iwl_completion_desc_transfer_status - transfer status (bits 1-3)
+- * @IWL_CD_STTS_END_TRANSFER: successful transfer complete.
+- * In sniffer mode, when split is used, set in last CD completion. (RX)
+- * @IWL_CD_STTS_OVERFLOW: In sniffer mode, when using split - used for
+- * all CD completion. (RX)
+- * @IWL_CD_STTS_ABORTED: CR abort / close flow. (RX)
+- */
+-enum iwl_completion_desc_transfer_status {
+- IWL_CD_STTS_UNUSED,
+- IWL_CD_STTS_UNUSED_2,
+- IWL_CD_STTS_END_TRANSFER,
+- IWL_CD_STTS_OVERFLOW,
+- IWL_CD_STTS_ABORTED,
+- IWL_CD_STTS_ERROR,
+-};
+-
+-/**
+- * enum iwl_completion_desc_wifi_status - wifi status (bits 4-7)
+- * @IWL_CD_STTS_VALID: the packet is valid (RX)
+- * @IWL_CD_STTS_FCS_ERR: frame check sequence error (RX)
+- * @IWL_CD_STTS_SEC_KEY_ERR: error handling the security key of rx (RX)
+- * @IWL_CD_STTS_DECRYPTION_ERR: error decrypting the frame (RX)
+- * @IWL_CD_STTS_DUP: duplicate packet (RX)
+- * @IWL_CD_STTS_ICV_MIC_ERR: MIC error (RX)
+- * @IWL_CD_STTS_INTERNAL_SNAP_ERR: problems removing the snap (RX)
+- * @IWL_CD_STTS_SEC_PORT_FAIL: security port fail (RX)
+- * @IWL_CD_STTS_BA_OLD_SN: block ack received old SN (RX)
+- * @IWL_CD_STTS_QOS_NULL: QoS null packet (RX)
+- * @IWL_CD_STTS_MAC_HDR_ERR: MAC header conversion error (RX)
+- * @IWL_CD_STTS_MAX_RETRANS: reached max number of retransmissions (TX)
+- * @IWL_CD_STTS_EX_LIFETIME: exceeded lifetime (TX)
+- * @IWL_CD_STTS_NOT_USED: completed but not used (RX)
+- * @IWL_CD_STTS_REPLAY_ERR: pn check failed, replay error (RX)
+- */
+-enum iwl_completion_desc_wifi_status {
+- IWL_CD_STTS_VALID,
+- IWL_CD_STTS_FCS_ERR,
+- IWL_CD_STTS_SEC_KEY_ERR,
+- IWL_CD_STTS_DECRYPTION_ERR,
+- IWL_CD_STTS_DUP,
+- IWL_CD_STTS_ICV_MIC_ERR,
+- IWL_CD_STTS_INTERNAL_SNAP_ERR,
+- IWL_CD_STTS_SEC_PORT_FAIL,
+- IWL_CD_STTS_BA_OLD_SN,
+- IWL_CD_STTS_QOS_NULL,
+- IWL_CD_STTS_MAC_HDR_ERR,
+- IWL_CD_STTS_MAX_RETRANS,
+- IWL_CD_STTS_EX_LIFETIME,
+- IWL_CD_STTS_NOT_USED,
+- IWL_CD_STTS_REPLAY_ERR,
+-};
+-
+ #define IWL_RX_TD_TYPE_MSK 0xff000000
+ #define IWL_RX_TD_SIZE_MSK 0x00ffffff
+ #define IWL_RX_TD_SIZE_2K BIT(11)
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index 1d144985ea58..80a1a50f5da5 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1198,7 +1198,8 @@ static void iwl_pcie_rx_reuse_rbd(struct iwl_trans *trans,
+ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
+ struct iwl_rxq *rxq,
+ struct iwl_rx_mem_buffer *rxb,
+- bool emergency)
++ bool emergency,
++ int i)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+ struct iwl_txq *txq = trans_pcie->txq[trans_pcie->cmd_queue];
+@@ -1224,6 +1225,9 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
+ .truesize = max_len,
+ };
+
++ if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
++ rxcb.status = rxq->cd[i].status;
++
+ pkt = rxb_addr(&rxcb);
+
+ if (pkt->len_n_flags == cpu_to_le32(FH_RSCSR_FRAME_INVALID)) {
+@@ -1430,7 +1434,7 @@ restart:
+ goto out;
+
+ IWL_DEBUG_RX(trans, "Q %d: HW = %d, SW = %d\n", rxq->id, r, i);
+- iwl_pcie_rx_handle_rb(trans, rxq, rxb, emergency);
++ iwl_pcie_rx_handle_rb(trans, rxq, rxb, emergency, i);
+
+ i = (i + 1) & (rxq->queue_size - 1);
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 7d319b6863fe..954f932e9c88 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1830,18 +1830,30 @@ static u32 iwl_trans_pcie_read32(struct iwl_trans *trans, u32 ofs)
+ return readl(IWL_TRANS_GET_PCIE_TRANS(trans)->hw_base + ofs);
+ }
+
++static u32 iwl_trans_pcie_prph_msk(struct iwl_trans *trans)
++{
++ if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560)
++ return 0x00FFFFFF;
++ else
++ return 0x000FFFFF;
++}
++
+ static u32 iwl_trans_pcie_read_prph(struct iwl_trans *trans, u32 reg)
+ {
++ u32 mask = iwl_trans_pcie_prph_msk(trans);
++
+ iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_RADDR,
+- ((reg & 0x000FFFFF) | (3 << 24)));
++ ((reg & mask) | (3 << 24)));
+ return iwl_trans_pcie_read32(trans, HBUS_TARG_PRPH_RDAT);
+ }
+
+ static void iwl_trans_pcie_write_prph(struct iwl_trans *trans, u32 addr,
+ u32 val)
+ {
++ u32 mask = iwl_trans_pcie_prph_msk(trans);
++
+ iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_WADDR,
+- ((addr & 0x000FFFFF) | (3 << 24)));
++ ((addr & mask) | (3 << 24)));
+ iwl_trans_pcie_write32(trans, HBUS_TARG_PRPH_WDAT, val);
+ }
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+index b99f33ff9123..61ffa1d1a00d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+@@ -526,7 +526,12 @@ struct iwl_tfh_tfd *iwl_pcie_gen2_build_tfd(struct iwl_trans *trans,
+
+ hdr_len = ieee80211_hdrlen(hdr->frame_control);
+
+- if (amsdu)
++ /*
++ * Only build A-MSDUs here if doing so by GSO, otherwise it may be
++ * an A-MSDU for other reasons, e.g. NAN or an A-MSDU having been
++ * built in the higher layers already.
++ */
++ if (amsdu && skb_shinfo(skb)->gso_size)
+ return iwl_pcie_gen2_build_tx_amsdu(trans, txq, dev_cmd, skb,
+ out_meta, hdr_len, len);
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index 42fdb7970cfd..2fec394a988c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -1103,7 +1103,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
+
+ if (!iwl_queue_used(txq, last_to_free)) {
+ IWL_ERR(trans,
+- "%s: Read index for DMA queue txq id (%d), last_to_free %d is out of range [0-%d] %d %d.\n",
++ "%s: Read index for txq id (%d), last_to_free %d is out of range [0-%d] %d %d.\n",
+ __func__, txq_id, last_to_free,
+ trans->cfg->base_params->max_tfd_queue_size,
+ txq->write_ptr, txq->read_ptr);
+diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
+index 433c6a16870b..d445acc4786b 100644
+--- a/drivers/net/wireless/marvell/mwifiex/usb.c
++++ b/drivers/net/wireless/marvell/mwifiex/usb.c
+@@ -298,6 +298,19 @@ static int mwifiex_usb_submit_rx_urb(struct urb_context *ctx, int size)
+ struct mwifiex_adapter *adapter = ctx->adapter;
+ struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
+
++ if (test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
++ if (card->rx_cmd_ep == ctx->ep) {
++ mwifiex_dbg(adapter, INFO, "%s: free rx_cmd skb\n",
++ __func__);
++ dev_kfree_skb_any(ctx->skb);
++ ctx->skb = NULL;
++ }
++ mwifiex_dbg(adapter, ERROR,
++ "%s: card removed/suspended, EP %d rx_cmd URB submit skipped\n",
++ __func__, ctx->ep);
++ return -1;
++ }
++
+ if (card->rx_cmd_ep != ctx->ep) {
+ ctx->skb = dev_alloc_skb(size);
+ if (!ctx->skb) {
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/tx.c b/drivers/net/wireless/mediatek/mt76/mt76x0/tx.c
+index 751b49c28ae5..c45d05d5aab1 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/tx.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/tx.c
+@@ -166,7 +166,7 @@ void mt76x0_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
+ if (sta) {
+ msta = (struct mt76_sta *) sta->drv_priv;
+ wcid = &msta->wcid;
+- } else if (vif && (!info->control.hw_key && wcid->hw_key_idx != -1)) {
++ } else if (vif && (!info->control.hw_key && wcid->hw_key_idx != 0xff)) {
+ struct mt76_vif *mvif = (struct mt76_vif *)vif->drv_priv;
+
+ wcid = &mvif->group_wcid;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c b/drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c
+index 36afb166fa3f..c0ca0df84ed8 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_tx_common.c
+@@ -32,7 +32,7 @@ void mt76x2_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
+ msta = (struct mt76x2_sta *)control->sta->drv_priv;
+ wcid = &msta->wcid;
+ /* sw encrypted frames */
+- if (!info->control.hw_key && wcid->hw_key_idx != -1)
++ if (!info->control.hw_key && wcid->hw_key_idx != 0xff)
+ control->sta = NULL;
+ }
+
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
+index c2d5b495c179..c089540116fa 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
+@@ -146,7 +146,7 @@ static int rtl8187_register_led(struct ieee80211_hw *dev,
+ led->dev = dev;
+ led->ledpin = ledpin;
+ led->is_radio = is_radio;
+- strncpy(led->name, name, sizeof(led->name));
++ strlcpy(led->name, name, sizeof(led->name));
+
+ led->led_dev.name = led->name;
+ led->led_dev.default_trigger = default_trigger;
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index d32eba11c000..30c040786fde 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -692,7 +692,7 @@ static struct nvmem_device *nvmem_find(const char *name)
+ d = bus_find_device_by_name(&nvmem_bus_type, NULL, name);
+
+ if (!d)
+- return NULL;
++ return ERR_PTR(-ENOENT);
+
+ return to_nvmem_device(d);
+ }
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 3f21ea6a90dc..f0dbb7ad88cf 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -2066,7 +2066,7 @@ struct device_node *of_find_next_cache_node(const struct device_node *np)
+ /* OF on pmac has nodes instead of properties named "l2-cache"
+ * beneath CPU nodes.
+ */
+- if (!strcmp(np->type, "cpu"))
++ if (IS_ENABLED(CONFIG_PPC_PMAC) && !strcmp(np->type, "cpu"))
+ for_each_child_of_node(np, child)
+ if (!strcmp(child->type, "cache"))
+ return child;
+diff --git a/drivers/of/unittest-data/overlay_15.dts b/drivers/of/unittest-data/overlay_15.dts
+index b98f2514df4b..5728490474f6 100644
+--- a/drivers/of/unittest-data/overlay_15.dts
++++ b/drivers/of/unittest-data/overlay_15.dts
+@@ -20,8 +20,8 @@
+ #size-cells = <0>;
+ reg = <0>;
+
+- test-mux-dev {
+- reg = <32>;
++ test-mux-dev@20 {
++ reg = <0x20>;
+ compatible = "unittest-i2c-dev";
+ status = "okay";
+ };
+diff --git a/drivers/of/unittest-data/tests-overlay.dtsi b/drivers/of/unittest-data/tests-overlay.dtsi
+index 25cf397b8f6b..4ea024d908ee 100644
+--- a/drivers/of/unittest-data/tests-overlay.dtsi
++++ b/drivers/of/unittest-data/tests-overlay.dtsi
+@@ -103,8 +103,8 @@
+ #size-cells = <0>;
+ reg = <0>;
+
+- test-mux-dev {
+- reg = <32>;
++ test-mux-dev@20 {
++ reg = <0x20>;
+ compatible = "unittest-i2c-dev";
+ status = "okay";
+ };
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index f3433bf47b10..14d4ef594374 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -48,9 +48,14 @@ static struct opp_device *_find_opp_dev(const struct device *dev,
+ static struct opp_table *_find_opp_table_unlocked(struct device *dev)
+ {
+ struct opp_table *opp_table;
++ bool found;
+
+ list_for_each_entry(opp_table, &opp_tables, node) {
+- if (_find_opp_dev(dev, opp_table)) {
++ mutex_lock(&opp_table->lock);
++ found = !!_find_opp_dev(dev, opp_table);
++ mutex_unlock(&opp_table->lock);
++
++ if (found) {
+ _get_opp_table_kref(opp_table);
+
+ return opp_table;
+@@ -766,6 +771,8 @@ struct opp_device *_add_opp_dev(const struct device *dev,
+
+ /* Initialize opp-dev */
+ opp_dev->dev = dev;
++
++ mutex_lock(&opp_table->lock);
+ list_add(&opp_dev->node, &opp_table->dev_list);
+
+ /* Create debugfs entries for the opp_table */
+@@ -773,6 +780,7 @@ struct opp_device *_add_opp_dev(const struct device *dev,
+ if (ret)
+ dev_err(dev, "%s: Failed to register opp debugfs (%d)\n",
+ __func__, ret);
++ mutex_unlock(&opp_table->lock);
+
+ return opp_dev;
+ }
+@@ -791,6 +799,7 @@ static struct opp_table *_allocate_opp_table(struct device *dev)
+ if (!opp_table)
+ return NULL;
+
++ mutex_init(&opp_table->lock);
+ INIT_LIST_HEAD(&opp_table->dev_list);
+
+ opp_dev = _add_opp_dev(dev, opp_table);
+@@ -812,7 +821,6 @@ static struct opp_table *_allocate_opp_table(struct device *dev)
+
+ BLOCKING_INIT_NOTIFIER_HEAD(&opp_table->head);
+ INIT_LIST_HEAD(&opp_table->opp_list);
+- mutex_init(&opp_table->lock);
+ kref_init(&opp_table->kref);
+
+ /* Secure the device table modification */
+@@ -854,6 +862,10 @@ static void _opp_table_kref_release(struct kref *kref)
+ if (!IS_ERR(opp_table->clk))
+ clk_put(opp_table->clk);
+
++ /*
++ * No need to take opp_table->lock here as we are guaranteed that no
++ * references to the OPP table are taken at this point.
++ */
+ opp_dev = list_first_entry(&opp_table->dev_list, struct opp_device,
+ node);
+
+@@ -1719,6 +1731,9 @@ void _dev_pm_opp_remove_table(struct opp_table *opp_table, struct device *dev,
+ {
+ struct dev_pm_opp *opp, *tmp;
+
++ /* Protect dev_list */
++ mutex_lock(&opp_table->lock);
++
+ /* Find if opp_table manages a single device */
+ if (list_is_singular(&opp_table->dev_list)) {
+ /* Free static OPPs */
+@@ -1736,6 +1751,8 @@ void _dev_pm_opp_remove_table(struct opp_table *opp_table, struct device *dev,
+ } else {
+ _remove_opp_dev(_find_opp_dev(dev, opp_table), opp_table);
+ }
++
++ mutex_unlock(&opp_table->lock);
+ }
+
+ void _dev_pm_opp_find_and_remove_table(struct device *dev, bool remove_all)
+diff --git a/drivers/opp/cpu.c b/drivers/opp/cpu.c
+index 0c0910709435..2868a022a040 100644
+--- a/drivers/opp/cpu.c
++++ b/drivers/opp/cpu.c
+@@ -222,8 +222,10 @@ int dev_pm_opp_get_sharing_cpus(struct device *cpu_dev, struct cpumask *cpumask)
+ cpumask_clear(cpumask);
+
+ if (opp_table->shared_opp == OPP_TABLE_ACCESS_SHARED) {
++ mutex_lock(&opp_table->lock);
+ list_for_each_entry(opp_dev, &opp_table->dev_list, node)
+ cpumask_set_cpu(opp_dev->dev->id, cpumask);
++ mutex_unlock(&opp_table->lock);
+ } else {
+ cpumask_set_cpu(cpu_dev->id, cpumask);
+ }
+diff --git a/drivers/opp/opp.h b/drivers/opp/opp.h
+index 7c540fd063b2..e0866b1c1f1b 100644
+--- a/drivers/opp/opp.h
++++ b/drivers/opp/opp.h
+@@ -126,7 +126,7 @@ enum opp_table_access {
+ * @dev_list: list of devices that share these OPPs
+ * @opp_list: table of opps
+ * @kref: for reference count of the table.
+- * @lock: mutex protecting the opp_list.
++ * @lock: mutex protecting the opp_list and dev_list.
+ * @np: struct device_node pointer for opp's DT node.
+ * @clock_latency_ns_max: Max clock latency in nanoseconds.
+ * @shared_opp: OPP is shared between multiple devices.
+diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
+index c5ff6ca65eab..0d100f56cb88 100644
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -1120,7 +1120,9 @@ static int mtk_pcie_request_resources(struct mtk_pcie *pcie)
+ if (err < 0)
+ return err;
+
+- devm_pci_remap_iospace(dev, &pcie->pio, pcie->io.start);
++ err = devm_pci_remap_iospace(dev, &pcie->pio, pcie->io.start);
++ if (err)
++ return err;
+
+ return 0;
+ }
+diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
+index ec48c9433ae5..518c46f8e63b 100644
+--- a/drivers/pci/hotplug/pciehp_core.c
++++ b/drivers/pci/hotplug/pciehp_core.c
+@@ -348,7 +348,7 @@ static struct pcie_port_service_driver hpdriver_portdrv = {
+ #endif /* PM */
+ };
+
+-static int __init pcied_init(void)
++int __init pcie_hp_init(void)
+ {
+ int retval = 0;
+
+@@ -359,4 +359,3 @@ static int __init pcied_init(void)
+
+ return retval;
+ }
+-device_initcall(pcied_init);
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 2baf1f82f893..c9f51fc24563 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -35,6 +35,8 @@
+ #include <linux/aer.h>
+ #include "pci.h"
+
++DEFINE_MUTEX(pci_slot_mutex);
++
+ const char *pci_power_names[] = {
+ "error", "D0", "D1", "D2", "D3hot", "D3cold", "unknown",
+ };
+@@ -5191,6 +5193,41 @@ static int pci_bus_reset(struct pci_bus *bus, int probe)
+ return ret;
+ }
+
++/**
++ * pci_bus_error_reset - reset the bridge's subordinate bus
++ * @bridge: The parent device that connects to the bus to reset
++ *
++ * This function will first try to reset the slots on this bus if the method is
++ * available. If slot reset fails or is not available, this will fall back to a
++ * secondary bus reset.
++ */
++int pci_bus_error_reset(struct pci_dev *bridge)
++{
++ struct pci_bus *bus = bridge->subordinate;
++ struct pci_slot *slot;
++
++ if (!bus)
++ return -ENOTTY;
++
++ mutex_lock(&pci_slot_mutex);
++ if (list_empty(&bus->slots))
++ goto bus_reset;
++
++ list_for_each_entry(slot, &bus->slots, list)
++ if (pci_probe_reset_slot(slot))
++ goto bus_reset;
++
++ list_for_each_entry(slot, &bus->slots, list)
++ if (pci_slot_reset(slot, 0))
++ goto bus_reset;
++
++ mutex_unlock(&pci_slot_mutex);
++ return 0;
++bus_reset:
++ mutex_unlock(&pci_slot_mutex);
++ return pci_bus_reset(bridge->subordinate, 0);
++}
++
+ /**
+ * pci_probe_reset_bus - probe whether a PCI bus can be reset
+ * @bus: PCI bus to probe
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index ab25752f00d9..e9ede82ee2c2 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -35,6 +35,7 @@ int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vmai,
+
+ int pci_probe_reset_function(struct pci_dev *dev);
+ int pci_bridge_secondary_bus_reset(struct pci_dev *dev);
++int pci_bus_error_reset(struct pci_dev *dev);
+
+ /**
+ * struct pci_platform_pm_ops - Firmware PM callbacks
+@@ -136,6 +137,7 @@ static inline void pci_remove_legacy_files(struct pci_bus *bus) { return; }
+
+ /* Lock for read/write access to pci device and bus lists */
+ extern struct rw_semaphore pci_bus_sem;
++extern struct mutex pci_slot_mutex;
+
+ extern raw_spinlock_t pci_lock;
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index 83180edd6ed4..1563e22600ec 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -866,7 +866,7 @@ void cper_print_aer(struct pci_dev *dev, int aer_severity,
+ static int add_error_device(struct aer_err_info *e_info, struct pci_dev *dev)
+ {
+ if (e_info->error_dev_num < AER_MAX_MULTI_ERR_DEVICES) {
+- e_info->dev[e_info->error_dev_num] = dev;
++ e_info->dev[e_info->error_dev_num] = pci_dev_get(dev);
+ e_info->error_dev_num++;
+ return 0;
+ }
+@@ -1013,6 +1013,7 @@ static void handle_error_source(struct pci_dev *dev, struct aer_err_info *info)
+ pcie_do_nonfatal_recovery(dev);
+ else if (info->severity == AER_FATAL)
+ pcie_do_fatal_recovery(dev, PCIE_PORT_SERVICE_AER);
++ pci_dev_put(dev);
+ }
+
+ #ifdef CONFIG_ACPI_APEI_PCIEAER
+@@ -1115,8 +1116,9 @@ int aer_get_device_error_info(struct pci_dev *dev, struct aer_err_info *info)
+ &info->mask);
+ if (!(info->status & ~info->mask))
+ return 0;
+- } else if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE ||
+- info->severity == AER_NONFATAL) {
++ } else if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT ||
++ pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM ||
++ info->severity == AER_NONFATAL) {
+
+ /* Link is still healthy for IO reads */
+ pci_read_config_dword(dev, pos + PCI_ERR_UNCOR_STATUS,
+@@ -1526,7 +1528,7 @@ static pci_ers_result_t aer_root_reset(struct pci_dev *dev)
+ reg32 &= ~ROOT_PORT_INTR_ON_MESG_MASK;
+ pci_write_config_dword(dev, pos + PCI_ERR_ROOT_COMMAND, reg32);
+
+- rc = pci_bridge_secondary_bus_reset(dev);
++ rc = pci_bus_error_reset(dev);
+ pci_printk(KERN_DEBUG, dev, "Root Port link has been reset\n");
+
+ /* Clear Root Error Status */
+@@ -1569,10 +1571,9 @@ static struct pcie_port_service_driver aerdriver = {
+ *
+ * Invoked when AER root service driver is loaded.
+ */
+-static int __init aer_service_init(void)
++int __init pcie_aer_init(void)
+ {
+ if (!pci_aer_available() || aer_acpi_firmware_first())
+ return -ENXIO;
+ return pcie_port_service_register(&aerdriver);
+ }
+-device_initcall(aer_service_init);
+diff --git a/drivers/pci/pcie/dpc.c b/drivers/pci/pcie/dpc.c
+index 1908dd2978d3..118b5bcae42e 100644
+--- a/drivers/pci/pcie/dpc.c
++++ b/drivers/pci/pcie/dpc.c
+@@ -307,8 +307,7 @@ static struct pcie_port_service_driver dpcdriver = {
+ .reset_link = dpc_reset_link,
+ };
+
+-static int __init dpc_service_init(void)
++int __init pcie_dpc_init(void)
+ {
+ return pcie_port_service_register(&dpcdriver);
+ }
+-device_initcall(dpc_service_init);
+diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c
+index 708fd3a0d646..2c3b5bd59b18 100644
+--- a/drivers/pci/pcie/err.c
++++ b/drivers/pci/pcie/err.c
+@@ -63,30 +63,12 @@ static int report_error_detected(struct pci_dev *dev, void *data)
+ if (!dev->driver ||
+ !dev->driver->err_handler ||
+ !dev->driver->err_handler->error_detected) {
+- if (result_data->state == pci_channel_io_frozen &&
+- dev->hdr_type != PCI_HEADER_TYPE_BRIDGE) {
+- /*
+- * In case of fatal recovery, if one of down-
+- * stream device has no driver. We might be
+- * unable to recover because a later insmod
+- * of a driver for this device is unaware of
+- * its hw state.
+- */
+- pci_printk(KERN_DEBUG, dev, "device has %s\n",
+- dev->driver ?
+- "no AER-aware driver" : "no driver");
+- }
+-
+ /*
+- * If there's any device in the subtree that does not
+- * have an error_detected callback, returning
+- * PCI_ERS_RESULT_NO_AER_DRIVER prevents calling of
+- * the subsequent mmio_enabled/slot_reset/resume
+- * callbacks of "any" device in the subtree. All the
+- * devices in the subtree are left in the error state
+- * without recovery.
++ * If any device in the subtree does not have an error_detected
++ * callback, PCI_ERS_RESULT_NO_AER_DRIVER prevents subsequent
++ * error callbacks of "any" device in the subtree, and will
++ * exit in the disconnected error state.
+ */
+-
+ if (dev->hdr_type != PCI_HEADER_TYPE_BRIDGE)
+ vote = PCI_ERS_RESULT_NO_AER_DRIVER;
+ else
+@@ -177,41 +159,30 @@ static pci_ers_result_t default_reset_link(struct pci_dev *dev)
+ {
+ int rc;
+
+- rc = pci_bridge_secondary_bus_reset(dev);
++ rc = pci_bus_error_reset(dev);
+ pci_printk(KERN_DEBUG, dev, "downstream link has been reset\n");
+ return rc ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED;
+ }
+
+ static pci_ers_result_t reset_link(struct pci_dev *dev, u32 service)
+ {
+- struct pci_dev *udev;
+ pci_ers_result_t status;
+ struct pcie_port_service_driver *driver = NULL;
+
+- if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+- /* Reset this port for all subordinates */
+- udev = dev;
+- } else {
+- /* Reset the upstream component (likely downstream port) */
+- udev = dev->bus->self;
+- }
+-
+- /* Use the aer driver of the component firstly */
+- driver = pcie_port_find_service(udev, service);
+-
++ driver = pcie_port_find_service(dev, service);
+ if (driver && driver->reset_link) {
+- status = driver->reset_link(udev);
+- } else if (udev->has_secondary_link) {
+- status = default_reset_link(udev);
++ status = driver->reset_link(dev);
++ } else if (dev->has_secondary_link) {
++ status = default_reset_link(dev);
+ } else {
+ pci_printk(KERN_DEBUG, dev, "no link-reset support at upstream device %s\n",
+- pci_name(udev));
++ pci_name(dev));
+ return PCI_ERS_RESULT_DISCONNECT;
+ }
+
+ if (status != PCI_ERS_RESULT_RECOVERED) {
+ pci_printk(KERN_DEBUG, dev, "link reset at upstream device %s failed\n",
+- pci_name(udev));
++ pci_name(dev));
+ return PCI_ERS_RESULT_DISCONNECT;
+ }
+
+@@ -243,31 +214,7 @@ static pci_ers_result_t broadcast_error_message(struct pci_dev *dev,
+ else
+ result_data.result = PCI_ERS_RESULT_RECOVERED;
+
+- if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+- /*
+- * If the error is reported by a bridge, we think this error
+- * is related to the downstream link of the bridge, so we
+- * do error recovery on all subordinates of the bridge instead
+- * of the bridge and clear the error status of the bridge.
+- */
+- if (cb == report_error_detected)
+- dev->error_state = state;
+- pci_walk_bus(dev->subordinate, cb, &result_data);
+- if (cb == report_resume) {
+- pci_aer_clear_device_status(dev);
+- pci_cleanup_aer_uncorrect_error_status(dev);
+- dev->error_state = pci_channel_io_normal;
+- }
+- } else {
+- /*
+- * If the error is reported by an end point, we think this
+- * error is related to the upstream link of the end point.
+- * The error is non fatal so the bus is ok; just invoke
+- * the callback for the function that logged the error.
+- */
+- cb(dev, &result_data);
+- }
+-
++ pci_walk_bus(dev->subordinate, cb, &result_data);
+ return result_data.result;
+ }
+
+@@ -347,6 +294,14 @@ void pcie_do_nonfatal_recovery(struct pci_dev *dev)
+
+ state = pci_channel_io_normal;
+
++ /*
++ * Error recovery runs on all subordinates of the first downstream port.
++ * If the downstream port detected the error, it is cleared at the end.
++ */
++ if (!(pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT ||
++ pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM))
++ dev = dev->bus->self;
++
+ status = broadcast_error_message(dev,
+ state,
+ "error_detected",
+@@ -378,6 +333,8 @@ void pcie_do_nonfatal_recovery(struct pci_dev *dev)
+ "resume",
+ report_resume);
+
++ pci_aer_clear_device_status(dev);
++ pci_cleanup_aer_uncorrect_error_status(dev);
+ pci_info(dev, "AER: Device recovery successful\n");
+ return;
+
+diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c
+index 6ac17f0c4077..54d593d10396 100644
+--- a/drivers/pci/pcie/pme.c
++++ b/drivers/pci/pcie/pme.c
+@@ -455,8 +455,7 @@ static struct pcie_port_service_driver pcie_pme_driver = {
+ /**
+ * pcie_pme_service_init - Register the PCIe PME service driver.
+ */
+-static int __init pcie_pme_service_init(void)
++int __init pcie_pme_init(void)
+ {
+ return pcie_port_service_register(&pcie_pme_driver);
+ }
+-device_initcall(pcie_pme_service_init);
+diff --git a/drivers/pci/pcie/portdrv.h b/drivers/pci/pcie/portdrv.h
+index d59afa42fc14..2498b2d34009 100644
+--- a/drivers/pci/pcie/portdrv.h
++++ b/drivers/pci/pcie/portdrv.h
+@@ -23,6 +23,30 @@
+
+ #define PCIE_PORT_DEVICE_MAXSERVICES 4
+
++#ifdef CONFIG_PCIEAER
++int pcie_aer_init(void);
++#else
++static inline int pcie_aer_init(void) { return 0; }
++#endif
++
++#ifdef CONFIG_HOTPLUG_PCI_PCIE
++int pcie_hp_init(void);
++#else
++static inline int pcie_hp_init(void) { return 0; }
++#endif
++
++#ifdef CONFIG_PCIE_PME
++int pcie_pme_init(void);
++#else
++static inline int pcie_pme_init(void) { return 0; }
++#endif
++
++#ifdef CONFIG_PCIE_DPC
++int pcie_dpc_init(void);
++#else
++static inline int pcie_dpc_init(void) { return 0; }
++#endif
++
+ /* Port Type */
+ #define PCIE_ANY_PORT (~0)
+
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index eef22dc29140..23a5a0c2c3fe 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -226,11 +226,20 @@ static const struct dmi_system_id pcie_portdrv_dmi_table[] __initconst = {
+ {}
+ };
+
++static void __init pcie_init_services(void)
++{
++ pcie_aer_init();
++ pcie_pme_init();
++ pcie_dpc_init();
++ pcie_hp_init();
++}
++
+ static int __init pcie_portdrv_init(void)
+ {
+ if (pcie_ports_disabled)
+ return -EACCES;
+
++ pcie_init_services();
+ dmi_check_system(pcie_portdrv_dmi_table);
+
+ return pci_register_driver(&pcie_portdriver);
+diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
+index e634229ece89..a32897f83ee5 100644
+--- a/drivers/pci/slot.c
++++ b/drivers/pci/slot.c
+@@ -14,7 +14,6 @@
+
+ struct kset *pci_slots_kset;
+ EXPORT_SYMBOL_GPL(pci_slots_kset);
+-static DEFINE_MUTEX(pci_slot_mutex);
+
+ static ssize_t pci_slot_attr_show(struct kobject *kobj,
+ struct attribute *attr, char *buf)
+diff --git a/drivers/phy/broadcom/Kconfig b/drivers/phy/broadcom/Kconfig
+index 8786a9674471..aa917a61071d 100644
+--- a/drivers/phy/broadcom/Kconfig
++++ b/drivers/phy/broadcom/Kconfig
+@@ -60,7 +60,8 @@ config PHY_NS2_USB_DRD
+
+ config PHY_BRCM_SATA
+ tristate "Broadcom SATA PHY driver"
+- depends on ARCH_BRCMSTB || ARCH_BCM_IPROC || BMIPS_GENERIC || COMPILE_TEST
++ depends on ARCH_BRCMSTB || ARCH_BCM_IPROC || BMIPS_GENERIC || \
++ ARCH_BCM_63XX || COMPILE_TEST
+ depends on OF
+ select GENERIC_PHY
+ default ARCH_BCM_IPROC
+diff --git a/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c b/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c
+index 986224fca9e9..5a180f71d8d4 100644
+--- a/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c
++++ b/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c
+@@ -156,7 +156,6 @@ static int ltq_rcu_usb2_of_parse(struct ltq_rcu_usb2_priv *priv,
+ {
+ struct device *dev = priv->dev;
+ const __be32 *offset;
+- int ret;
+
+ priv->reg_bits = of_device_get_match_data(dev);
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+index 6fb2b6969590..d22b1ec2e58c 100644
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -199,7 +199,7 @@ static void rcar_gen3_init_from_a_peri_to_a_host(struct rcar_gen3_chan *ch)
+ val = readl(usb2_base + USB2_OBINTEN);
+ writel(val & ~USB2_OBINT_BITS, usb2_base + USB2_OBINTEN);
+
+- rcar_gen3_enable_vbus_ctrl(ch, 0);
++ rcar_gen3_enable_vbus_ctrl(ch, 1);
+ rcar_gen3_init_for_host(ch);
+
+ writel(val | USB2_OBINT_BITS, usb2_base + USB2_OBINTEN);
+diff --git a/drivers/phy/ti/phy-twl4030-usb.c b/drivers/phy/ti/phy-twl4030-usb.c
+index a44680d64f9b..c267afb68f07 100644
+--- a/drivers/phy/ti/phy-twl4030-usb.c
++++ b/drivers/phy/ti/phy-twl4030-usb.c
+@@ -144,6 +144,7 @@
+ #define PMBR1 0x0D
+ #define GPIO_USB_4PIN_ULPI_2430C (3 << 0)
+
++static irqreturn_t twl4030_usb_irq(int irq, void *_twl);
+ /*
+ * If VBUS is valid or ID is ground, then we know a
+ * cable is present and we need to be runtime-enabled
+@@ -395,6 +396,33 @@ static void __twl4030_phy_power(struct twl4030_usb *twl, int on)
+ WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);
+ }
+
++static int __maybe_unused twl4030_usb_suspend(struct device *dev)
++{
++ struct twl4030_usb *twl = dev_get_drvdata(dev);
++
++ /*
++ * we need enabled runtime on resume,
++ * so turn irq off here, so we do not get it early
++ * note: wakeup on usb plug works independently of this
++ */
++ dev_dbg(twl->dev, "%s\n", __func__);
++ disable_irq(twl->irq);
++
++ return 0;
++}
++
++static int __maybe_unused twl4030_usb_resume(struct device *dev)
++{
++ struct twl4030_usb *twl = dev_get_drvdata(dev);
++
++ dev_dbg(twl->dev, "%s\n", __func__);
++ enable_irq(twl->irq);
++ /* check whether cable status changed */
++ twl4030_usb_irq(0, twl);
++
++ return 0;
++}
++
+ static int __maybe_unused twl4030_usb_runtime_suspend(struct device *dev)
+ {
+ struct twl4030_usb *twl = dev_get_drvdata(dev);
+@@ -655,6 +683,7 @@ static const struct phy_ops ops = {
+ static const struct dev_pm_ops twl4030_usb_pm_ops = {
+ SET_RUNTIME_PM_OPS(twl4030_usb_runtime_suspend,
+ twl4030_usb_runtime_resume, NULL)
++ SET_SYSTEM_SLEEP_PM_OPS(twl4030_usb_suspend, twl4030_usb_resume)
+ };
+
+ static int twl4030_usb_probe(struct platform_device *pdev)
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index ef7ab208b951..9e2f3738bf3e 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -493,7 +493,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ unsigned num_pins, num_configs, reserve;
+ unsigned long *configs;
+ struct property *pins;
+- bool has_config;
+ u32 pinfunc;
+ int ret, i;
+
+@@ -509,9 +508,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ return ret;
+ }
+
+- if (num_configs)
+- has_config = true;
+-
+ num_pins = pins->length / sizeof(u32);
+ if (!num_pins) {
+ dev_err(pctldev->dev, "no pins found in node %pOF\n", np);
+@@ -524,7 +520,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ * map for each pin.
+ */
+ reserve = 1;
+- if (has_config && num_pins >= 1)
++ if (num_configs)
+ reserve++;
+ reserve *= num_pins;
+ ret = pinctrl_utils_reserve_map(pctldev, map, reserved_maps, num_maps,
+@@ -547,7 +543,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ pinctrl_utils_add_map_mux(pctldev, map, reserved_maps, num_maps,
+ group, func);
+
+- if (has_config) {
++ if (num_configs) {
+ ret = pinctrl_utils_add_map_configs(pctldev, map,
+ reserved_maps, num_maps, group,
+ configs, num_configs,
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index 50f0ec42c637..fad0e132ead8 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -1574,16 +1574,6 @@ void at91_pinctrl_gpio_resume(void)
+ #define gpio_irq_set_wake NULL
+ #endif /* CONFIG_PM */
+
+-static struct irq_chip gpio_irqchip = {
+- .name = "GPIO",
+- .irq_ack = gpio_irq_ack,
+- .irq_disable = gpio_irq_mask,
+- .irq_mask = gpio_irq_mask,
+- .irq_unmask = gpio_irq_unmask,
+- /* .irq_set_type is set dynamically */
+- .irq_set_wake = gpio_irq_set_wake,
+-};
+-
+ static void gpio_irq_handler(struct irq_desc *desc)
+ {
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+@@ -1624,12 +1614,22 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ struct gpio_chip *gpiochip_prev = NULL;
+ struct at91_gpio_chip *prev = NULL;
+ struct irq_data *d = irq_get_irq_data(at91_gpio->pioc_virq);
++ struct irq_chip *gpio_irqchip;
+ int ret, i;
+
++ gpio_irqchip = devm_kzalloc(&pdev->dev, sizeof(*gpio_irqchip), GFP_KERNEL);
++ if (!gpio_irqchip)
++ return -ENOMEM;
++
+ at91_gpio->pioc_hwirq = irqd_to_hwirq(d);
+
+- /* Setup proper .irq_set_type function */
+- gpio_irqchip.irq_set_type = at91_gpio->ops->irq_type;
++ gpio_irqchip->name = "GPIO";
++ gpio_irqchip->irq_ack = gpio_irq_ack;
++ gpio_irqchip->irq_disable = gpio_irq_mask;
++ gpio_irqchip->irq_mask = gpio_irq_mask;
++ gpio_irqchip->irq_unmask = gpio_irq_unmask;
++ gpio_irqchip->irq_set_wake = gpio_irq_set_wake,
++ gpio_irqchip->irq_set_type = at91_gpio->ops->irq_type;
+
+ /* Disable irqs of this PIO controller */
+ writel_relaxed(~0, at91_gpio->regbase + PIO_IDR);
+@@ -1640,7 +1640,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ * interrupt.
+ */
+ ret = gpiochip_irqchip_add(&at91_gpio->chip,
+- &gpio_irqchip,
++ gpio_irqchip,
+ 0,
+ handle_edge_irq,
+ IRQ_TYPE_NONE);
+@@ -1658,7 +1658,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ if (!gpiochip_prev) {
+ /* Then register the chain on the parent IRQ */
+ gpiochip_set_chained_irqchip(&at91_gpio->chip,
+- &gpio_irqchip,
++ gpio_irqchip,
+ at91_gpio->pioc_virq,
+ gpio_irq_handler);
+ return 0;
+diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c
+index 628817c40e3b..a5accffbc8c9 100644
+--- a/drivers/pinctrl/pinctrl-ingenic.c
++++ b/drivers/pinctrl/pinctrl-ingenic.c
+@@ -847,4 +847,4 @@ static int __init ingenic_pinctrl_drv_register(void)
+ {
+ return platform_driver_register(&ingenic_pinctrl_driver);
+ }
+-postcore_initcall(ingenic_pinctrl_drv_register);
++subsys_initcall(ingenic_pinctrl_drv_register);
+diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c
+index 0206cce328b3..d9493e893d64 100644
+--- a/drivers/power/reset/at91-sama5d2_shdwc.c
++++ b/drivers/power/reset/at91-sama5d2_shdwc.c
+@@ -246,6 +246,9 @@ static int __init at91_shdwc_probe(struct platform_device *pdev)
+ if (!pdev->dev.of_node)
+ return -ENODEV;
+
++ if (at91_shdwc)
++ return -EBUSY;
++
+ at91_shdwc = devm_kzalloc(&pdev->dev, sizeof(*at91_shdwc), GFP_KERNEL);
+ if (!at91_shdwc)
+ return -ENOMEM;
+diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
+index 02356f9b5f22..8bb89c697c1e 100644
+--- a/drivers/power/supply/ab8500_fg.c
++++ b/drivers/power/supply/ab8500_fg.c
+@@ -2433,17 +2433,14 @@ static ssize_t charge_full_store(struct ab8500_fg *di, const char *buf,
+ size_t count)
+ {
+ unsigned long charge_full;
+- ssize_t ret;
++ int ret;
+
+ ret = kstrtoul(buf, 10, &charge_full);
++ if (ret)
++ return ret;
+
+- dev_dbg(di->dev, "Ret %zd charge_full %lu", ret, charge_full);
+-
+- if (!ret) {
+- di->bat_cap.max_mah = (int) charge_full;
+- ret = count;
+- }
+- return ret;
++ di->bat_cap.max_mah = (int) charge_full;
++ return count;
+ }
+
+ static ssize_t charge_now_show(struct ab8500_fg *di, char *buf)
+@@ -2455,20 +2452,16 @@ static ssize_t charge_now_store(struct ab8500_fg *di, const char *buf,
+ size_t count)
+ {
+ unsigned long charge_now;
+- ssize_t ret;
++ int ret;
+
+ ret = kstrtoul(buf, 10, &charge_now);
++ if (ret)
++ return ret;
+
+- dev_dbg(di->dev, "Ret %zd charge_now %lu was %d",
+- ret, charge_now, di->bat_cap.prev_mah);
+-
+- if (!ret) {
+- di->bat_cap.user_mah = (int) charge_now;
+- di->flags.user_cap = true;
+- ret = count;
+- queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0);
+- }
+- return ret;
++ di->bat_cap.user_mah = (int) charge_now;
++ di->flags.user_cap = true;
++ queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0);
++ return count;
+ }
+
+ static struct ab8500_fg_sysfs_entry charge_full_attr =
+diff --git a/drivers/power/supply/max8998_charger.c b/drivers/power/supply/max8998_charger.c
+index cad7d1a8feec..aa65e6c36c55 100644
+--- a/drivers/power/supply/max8998_charger.c
++++ b/drivers/power/supply/max8998_charger.c
+@@ -86,7 +86,7 @@ static const struct power_supply_desc max8998_battery_desc = {
+ static int max8998_battery_probe(struct platform_device *pdev)
+ {
+ struct max8998_dev *iodev = dev_get_drvdata(pdev->dev.parent);
+- struct max8998_platform_data *pdata = dev_get_platdata(iodev->dev);
++ struct max8998_platform_data *pdata = iodev->pdata;
+ struct power_supply_config psy_cfg = {};
+ struct max8998_battery_data *max8998;
+ struct i2c_client *i2c;
+diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
+index b6a7d9f74cf3..0e202d4273fb 100644
+--- a/drivers/power/supply/twl4030_charger.c
++++ b/drivers/power/supply/twl4030_charger.c
+@@ -420,7 +420,8 @@ static void twl4030_current_worker(struct work_struct *data)
+
+ if (v < USB_MIN_VOLT) {
+ /* Back up and stop adjusting. */
+- bci->usb_cur -= USB_CUR_STEP;
++ if (bci->usb_cur >= USB_CUR_STEP)
++ bci->usb_cur -= USB_CUR_STEP;
+ bci->usb_cur_target = bci->usb_cur;
+ } else if (bci->usb_cur >= bci->usb_cur_target ||
+ bci->usb_cur + USB_CUR_STEP > USB_MAX_CURRENT) {
+@@ -439,6 +440,7 @@ static void twl4030_current_worker(struct work_struct *data)
+ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable)
+ {
+ int ret;
++ u32 reg;
+
+ if (bci->usb_mode == CHARGE_OFF)
+ enable = false;
+@@ -452,14 +454,38 @@ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable)
+ bci->usb_enabled = 1;
+ }
+
+- if (bci->usb_mode == CHARGE_AUTO)
++ if (bci->usb_mode == CHARGE_AUTO) {
++ /* Enable interrupts now. */
++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_ICHGEOC |
++ TWL4030_TBATOR2 | TWL4030_TBATOR1 |
++ TWL4030_BATSTS);
++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg,
++ TWL4030_INTERRUPTS_BCIIMR1A);
++ if (ret < 0) {
++ dev_err(bci->dev,
++ "failed to unmask interrupts: %d\n",
++ ret);
++ return ret;
++ }
+ /* forcing the field BCIAUTOUSB (BOOT_BCI[1]) to 1 */
+ ret = twl4030_clear_set_boot_bci(0, TWL4030_BCIAUTOUSB);
++ }
+
+ /* forcing USBFASTMCHG(BCIMFSTS4[2]) to 1 */
+ ret = twl4030_clear_set(TWL_MODULE_MAIN_CHARGE, 0,
+ TWL4030_USBFASTMCHG, TWL4030_BCIMFSTS4);
+ if (bci->usb_mode == CHARGE_LINEAR) {
++ /* Enable interrupts now. */
++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_TBATOR2 |
++ TWL4030_TBATOR1 | TWL4030_BATSTS);
++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg,
++ TWL4030_INTERRUPTS_BCIIMR1A);
++ if (ret < 0) {
++ dev_err(bci->dev,
++ "failed to unmask interrupts: %d\n",
++ ret);
++ return ret;
++ }
+ twl4030_clear_set_boot_bci(TWL4030_BCIAUTOAC|TWL4030_CVENAC, 0);
+ /* Watch dog key: WOVF acknowledge */
+ ret = twl_i2c_write_u8(TWL_MODULE_MAIN_CHARGE, 0x33,
+diff --git a/drivers/remoteproc/da8xx_remoteproc.c b/drivers/remoteproc/da8xx_remoteproc.c
+index e230bef71be1..d200334577f6 100644
+--- a/drivers/remoteproc/da8xx_remoteproc.c
++++ b/drivers/remoteproc/da8xx_remoteproc.c
+@@ -226,7 +226,7 @@ static int da8xx_rproc_get_internal_memories(struct platform_device *pdev,
+ res->start & DA8XX_RPROC_LOCAL_ADDRESS_MASK;
+ drproc->mem[i].size = resource_size(res);
+
+- dev_dbg(dev, "memory %8s: bus addr %pa size 0x%x va %p da 0x%x\n",
++ dev_dbg(dev, "memory %8s: bus addr %pa size 0x%zx va %p da 0x%x\n",
+ mem_names[i], &drproc->mem[i].bus_addr,
+ drproc->mem[i].size, drproc->mem[i].cpu_addr,
+ drproc->mem[i].dev_addr);
+diff --git a/drivers/rtc/rtc-armada38x.c b/drivers/rtc/rtc-armada38x.c
+index bde53c8ccee2..b74338d6dde6 100644
+--- a/drivers/rtc/rtc-armada38x.c
++++ b/drivers/rtc/rtc-armada38x.c
+@@ -514,7 +514,6 @@ MODULE_DEVICE_TABLE(of, armada38x_rtc_of_match_table);
+
+ static __init int armada38x_rtc_probe(struct platform_device *pdev)
+ {
+- const struct rtc_class_ops *ops;
+ struct resource *res;
+ struct armada38x_rtc *rtc;
+ const struct of_device_id *match;
+@@ -551,6 +550,11 @@ static __init int armada38x_rtc_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "no irq\n");
+ return rtc->irq;
+ }
++
++ rtc->rtc_dev = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(rtc->rtc_dev))
++ return PTR_ERR(rtc->rtc_dev);
++
+ if (devm_request_irq(&pdev->dev, rtc->irq, armada38x_rtc_alarm_irq,
+ 0, pdev->name, rtc) < 0) {
+ dev_warn(&pdev->dev, "Interrupt not available.\n");
+@@ -560,28 +564,24 @@ static __init int armada38x_rtc_probe(struct platform_device *pdev)
+
+ if (rtc->irq != -1) {
+ device_init_wakeup(&pdev->dev, 1);
+- ops = &armada38x_rtc_ops;
++ rtc->rtc_dev->ops = &armada38x_rtc_ops;
+ } else {
+ /*
+ * If there is no interrupt available then we can't
+ * use the alarm
+ */
+- ops = &armada38x_rtc_ops_noirq;
++ rtc->rtc_dev->ops = &armada38x_rtc_ops_noirq;
+ }
+ rtc->data = (struct armada38x_rtc_data *)match->data;
+
+-
+ /* Update RTC-MBUS bridge timing parameters */
+ rtc->data->update_mbus_timing(rtc);
+
+- rtc->rtc_dev = devm_rtc_device_register(&pdev->dev, pdev->name,
+- ops, THIS_MODULE);
+- if (IS_ERR(rtc->rtc_dev)) {
+- ret = PTR_ERR(rtc->rtc_dev);
++ ret = rtc_register_device(rtc->rtc_dev);
++ if (ret)
+ dev_err(&pdev->dev, "Failed to register RTC device: %d\n", ret);
+- return ret;
+- }
+- return 0;
++
++ return ret;
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/rtc/rtc-isl1208.c b/drivers/rtc/rtc-isl1208.c
+index ea18a8f4bce0..033f65aef578 100644
+--- a/drivers/rtc/rtc-isl1208.c
++++ b/drivers/rtc/rtc-isl1208.c
+@@ -518,7 +518,7 @@ static ssize_t timestamp0_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
+- struct i2c_client *client = dev_get_drvdata(dev);
++ struct i2c_client *client = to_i2c_client(dev->parent);
+ int sr;
+
+ sr = isl1208_i2c_get_sr(client);
+@@ -540,7 +540,7 @@ static ssize_t timestamp0_store(struct device *dev,
+ static ssize_t timestamp0_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- struct i2c_client *client = dev_get_drvdata(dev);
++ struct i2c_client *client = to_i2c_client(dev->parent);
+ u8 regs[ISL1219_EVT_SECTION_LEN] = { 0, };
+ struct rtc_time tm;
+ int sr;
+@@ -650,7 +650,7 @@ static ssize_t
+ isl1208_sysfs_show_atrim(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- int atr = isl1208_i2c_get_atr(to_i2c_client(dev));
++ int atr = isl1208_i2c_get_atr(to_i2c_client(dev->parent));
+ if (atr < 0)
+ return atr;
+
+@@ -663,7 +663,7 @@ static ssize_t
+ isl1208_sysfs_show_dtrim(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- int dtr = isl1208_i2c_get_dtr(to_i2c_client(dev));
++ int dtr = isl1208_i2c_get_dtr(to_i2c_client(dev->parent));
+ if (dtr < 0)
+ return dtr;
+
+@@ -676,7 +676,7 @@ static ssize_t
+ isl1208_sysfs_show_usr(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- int usr = isl1208_i2c_get_usr(to_i2c_client(dev));
++ int usr = isl1208_i2c_get_usr(to_i2c_client(dev->parent));
+ if (usr < 0)
+ return usr;
+
+@@ -701,7 +701,10 @@ isl1208_sysfs_store_usr(struct device *dev,
+ if (usr < 0 || usr > 0xffff)
+ return -EINVAL;
+
+- return isl1208_i2c_set_usr(to_i2c_client(dev), usr) ? -EIO : count;
++ if (isl1208_i2c_set_usr(to_i2c_client(dev->parent), usr))
++ return -EIO;
++
++ return count;
+ }
+
+ static DEVICE_ATTR(usr, S_IRUGO | S_IWUSR, isl1208_sysfs_show_usr,
+@@ -765,7 +768,6 @@ isl1208_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ rtc->ops = &isl1208_rtc_ops;
+
+ i2c_set_clientdata(client, rtc);
+- dev_set_drvdata(&rtc->dev, client);
+
+ rc = isl1208_i2c_get_sr(client);
+ if (rc < 0) {
+@@ -804,7 +806,7 @@ isl1208_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ evdet_irq = of_irq_get_byname(np, "evdet");
+ }
+
+- rc = sysfs_create_group(&client->dev.kobj, &isl1208_rtc_sysfs_files);
++ rc = rtc_add_group(rtc, &isl1208_rtc_sysfs_files);
+ if (rc)
+ return rc;
+
+@@ -821,14 +823,6 @@ isl1208_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ return rtc_register_device(rtc);
+ }
+
+-static int
+-isl1208_remove(struct i2c_client *client)
+-{
+- sysfs_remove_group(&client->dev.kobj, &isl1208_rtc_sysfs_files);
+-
+- return 0;
+-}
+-
+ static const struct i2c_device_id isl1208_id[] = {
+ { "isl1208", TYPE_ISL1208 },
+ { "isl1218", TYPE_ISL1218 },
+@@ -851,7 +845,6 @@ static struct i2c_driver isl1208_driver = {
+ .of_match_table = of_match_ptr(isl1208_of_match),
+ },
+ .probe = isl1208_probe,
+- .remove = isl1208_remove,
+ .id_table = isl1208_id,
+ };
+
+diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c
+index 385f8303bb41..e9a25ec4d434 100644
+--- a/drivers/rtc/rtc-mt6397.c
++++ b/drivers/rtc/rtc-mt6397.c
+@@ -332,6 +332,10 @@ static int mtk_rtc_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, rtc);
+
++ rtc->rtc_dev = devm_rtc_allocate_device(rtc->dev);
++ if (IS_ERR(rtc->rtc_dev))
++ return PTR_ERR(rtc->rtc_dev);
++
+ ret = request_threaded_irq(rtc->irq, NULL,
+ mtk_rtc_irq_handler_thread,
+ IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
+@@ -344,11 +348,11 @@ static int mtk_rtc_probe(struct platform_device *pdev)
+
+ device_init_wakeup(&pdev->dev, 1);
+
+- rtc->rtc_dev = rtc_device_register("mt6397-rtc", &pdev->dev,
+- &mtk_rtc_ops, THIS_MODULE);
+- if (IS_ERR(rtc->rtc_dev)) {
++ rtc->rtc_dev->ops = &mtk_rtc_ops;
++
++ ret = rtc_register_device(rtc->rtc_dev);
++ if (ret) {
+ dev_err(&pdev->dev, "register rtc device failed\n");
+- ret = PTR_ERR(rtc->rtc_dev);
+ goto out_free_irq;
+ }
+
+@@ -365,7 +369,6 @@ static int mtk_rtc_remove(struct platform_device *pdev)
+ {
+ struct mt6397_rtc *rtc = platform_get_drvdata(pdev);
+
+- rtc_device_unregister(rtc->rtc_dev);
+ free_irq(rtc->irq, rtc->rtc_dev);
+ irq_dispose_mapping(rtc->irq);
+
+diff --git a/drivers/rtc/rtc-pl030.c b/drivers/rtc/rtc-pl030.c
+index f85a1a93e669..343bb6ed1783 100644
+--- a/drivers/rtc/rtc-pl030.c
++++ b/drivers/rtc/rtc-pl030.c
+@@ -112,6 +112,13 @@ static int pl030_probe(struct amba_device *dev, const struct amba_id *id)
+ goto err_rtc;
+ }
+
++ rtc->rtc = devm_rtc_allocate_device(&dev->dev);
++ if (IS_ERR(rtc->rtc)) {
++ ret = PTR_ERR(rtc->rtc);
++ goto err_rtc;
++ }
++
++ rtc->rtc->ops = &pl030_ops;
+ rtc->base = ioremap(dev->res.start, resource_size(&dev->res));
+ if (!rtc->base) {
+ ret = -ENOMEM;
+@@ -128,12 +135,9 @@ static int pl030_probe(struct amba_device *dev, const struct amba_id *id)
+ if (ret)
+ goto err_irq;
+
+- rtc->rtc = rtc_device_register("pl030", &dev->dev, &pl030_ops,
+- THIS_MODULE);
+- if (IS_ERR(rtc->rtc)) {
+- ret = PTR_ERR(rtc->rtc);
++ ret = rtc_register_device(rtc->rtc);
++ if (ret)
+ goto err_reg;
+- }
+
+ return 0;
+
+@@ -154,7 +158,6 @@ static int pl030_remove(struct amba_device *dev)
+ writel(0, rtc->base + RTC_CR);
+
+ free_irq(dev->irq[0], rtc);
+- rtc_device_unregister(rtc->rtc);
+ iounmap(rtc->base);
+ amba_release_regions(dev);
+
+diff --git a/drivers/rtc/rtc-rv8803.c b/drivers/rtc/rtc-rv8803.c
+index 29fc3d210392..17ccef5d5db1 100644
+--- a/drivers/rtc/rtc-rv8803.c
++++ b/drivers/rtc/rtc-rv8803.c
+@@ -623,7 +623,7 @@ MODULE_DEVICE_TABLE(i2c, rv8803_id);
+ static const struct of_device_id rv8803_of_match[] = {
+ {
+ .compatible = "microcrystal,rv8803",
+- .data = (void *)rx_8900
++ .data = (void *)rv_8803
+ },
+ {
+ .compatible = "epson,rx8900",
+diff --git a/drivers/rtc/rtc-sysfs.c b/drivers/rtc/rtc-sysfs.c
+index f1ff30ade534..9746c32eee2e 100644
+--- a/drivers/rtc/rtc-sysfs.c
++++ b/drivers/rtc/rtc-sysfs.c
+@@ -338,8 +338,8 @@ int rtc_add_groups(struct rtc_device *rtc, const struct attribute_group **grps)
+
+ new_cnt = old_cnt + add_cnt + 1;
+ groups = devm_kcalloc(&rtc->dev, new_cnt, sizeof(*groups), GFP_KERNEL);
+- if (IS_ERR_OR_NULL(groups))
+- return PTR_ERR(groups);
++ if (!groups)
++ return -ENOMEM;
+ memcpy(groups, rtc->dev.groups, old_cnt * sizeof(*groups));
+ memcpy(groups + old_cnt, grps, add_cnt * sizeof(*groups));
+ groups[old_cnt + add_cnt] = NULL;
+diff --git a/drivers/rtc/rtc-tx4939.c b/drivers/rtc/rtc-tx4939.c
+index 08dbefc79520..61c110b2045f 100644
+--- a/drivers/rtc/rtc-tx4939.c
++++ b/drivers/rtc/rtc-tx4939.c
+@@ -253,9 +253,7 @@ static int __init tx4939_rtc_probe(struct platform_device *pdev)
+ struct resource *res;
+ int irq, ret;
+ struct nvmem_config nvmem_cfg = {
+- .name = "rv8803_nvram",
+- .word_size = 4,
+- .stride = 4,
++ .name = "tx4939_nvram",
+ .size = TX4939_RTC_REG_RAMSIZE,
+ .reg_read = tx4939_nvram_read,
+ .reg_write = tx4939_nvram_write,
+diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
+index 3be54651698a..027a53eec42a 100644
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -1223,11 +1223,10 @@ static struct bus_attribute *const ap_bus_attrs[] = {
+ };
+
+ /**
+- * ap_select_domain(): Select an AP domain.
+- *
+- * Pick one of the 16 AP domains.
++ * ap_select_domain(): Select an AP domain if possible and we haven't
++ * already done so before.
+ */
+-static int ap_select_domain(void)
++static void ap_select_domain(void)
+ {
+ int count, max_count, best_domain;
+ struct ap_queue_status status;
+@@ -1242,7 +1241,7 @@ static int ap_select_domain(void)
+ if (ap_domain_index >= 0) {
+ /* Domain has already been selected. */
+ spin_unlock_bh(&ap_domain_lock);
+- return 0;
++ return;
+ }
+ best_domain = -1;
+ max_count = 0;
+@@ -1269,11 +1268,8 @@ static int ap_select_domain(void)
+ if (best_domain >= 0) {
+ ap_domain_index = best_domain;
+ AP_DBF(DBF_DEBUG, "new ap_domain_index=%d\n", ap_domain_index);
+- spin_unlock_bh(&ap_domain_lock);
+- return 0;
+ }
+ spin_unlock_bh(&ap_domain_lock);
+- return -ENODEV;
+ }
+
+ /*
+@@ -1351,8 +1347,7 @@ static void ap_scan_bus(struct work_struct *unused)
+ AP_DBF(DBF_DEBUG, "%s running\n", __func__);
+
+ ap_query_configuration(ap_configuration);
+- if (ap_select_domain() != 0)
+- goto out;
++ ap_select_domain();
+
+ for (id = 0; id < AP_DEVICES; id++) {
+ /* check if device is registered */
+@@ -1468,12 +1463,11 @@ static void ap_scan_bus(struct work_struct *unused)
+ }
+ } /* end device loop */
+
+- if (defdomdevs < 1)
++ if (ap_domain_index >= 0 && defdomdevs < 1)
+ AP_DBF(DBF_INFO,
+ "no queue device with default domain %d available\n",
+ ap_domain_index);
+
+-out:
+ mod_timer(&ap_config_timer, jiffies + ap_config_time * HZ);
+ }
+
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 461afc276db7..81e2c591acb0 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -901,44 +901,6 @@ out:
+ qeth_release_buffer(channel, iob);
+ }
+
+-static int qeth_setup_channel(struct qeth_channel *channel, bool alloc_buffers)
+-{
+- int cnt;
+-
+- QETH_DBF_TEXT(SETUP, 2, "setupch");
+-
+- channel->ccw = kmalloc(sizeof(struct ccw1), GFP_KERNEL | GFP_DMA);
+- if (!channel->ccw)
+- return -ENOMEM;
+- channel->state = CH_STATE_DOWN;
+- atomic_set(&channel->irq_pending, 0);
+- init_waitqueue_head(&channel->wait_q);
+-
+- if (!alloc_buffers)
+- return 0;
+-
+- for (cnt = 0; cnt < QETH_CMD_BUFFER_NO; cnt++) {
+- channel->iob[cnt].data =
+- kzalloc(QETH_BUFSIZE, GFP_DMA|GFP_KERNEL);
+- if (channel->iob[cnt].data == NULL)
+- break;
+- channel->iob[cnt].state = BUF_STATE_FREE;
+- channel->iob[cnt].channel = channel;
+- channel->iob[cnt].callback = qeth_send_control_data_cb;
+- channel->iob[cnt].rc = 0;
+- }
+- if (cnt < QETH_CMD_BUFFER_NO) {
+- kfree(channel->ccw);
+- while (cnt-- > 0)
+- kfree(channel->iob[cnt].data);
+- return -ENOMEM;
+- }
+- channel->io_buf_no = 0;
+- spin_lock_init(&channel->iob_lock);
+-
+- return 0;
+-}
+-
+ static int qeth_set_thread_start_bit(struct qeth_card *card,
+ unsigned long thread)
+ {
+@@ -1339,14 +1301,61 @@ static void qeth_free_buffer_pool(struct qeth_card *card)
+
+ static void qeth_clean_channel(struct qeth_channel *channel)
+ {
++ struct ccw_device *cdev = channel->ccwdev;
+ int cnt;
+
+ QETH_DBF_TEXT(SETUP, 2, "freech");
++
++ spin_lock_irq(get_ccwdev_lock(cdev));
++ cdev->handler = NULL;
++ spin_unlock_irq(get_ccwdev_lock(cdev));
++
+ for (cnt = 0; cnt < QETH_CMD_BUFFER_NO; cnt++)
+ kfree(channel->iob[cnt].data);
+ kfree(channel->ccw);
+ }
+
++static int qeth_setup_channel(struct qeth_channel *channel, bool alloc_buffers)
++{
++ struct ccw_device *cdev = channel->ccwdev;
++ int cnt;
++
++ QETH_DBF_TEXT(SETUP, 2, "setupch");
++
++ channel->ccw = kmalloc(sizeof(struct ccw1), GFP_KERNEL | GFP_DMA);
++ if (!channel->ccw)
++ return -ENOMEM;
++ channel->state = CH_STATE_DOWN;
++ atomic_set(&channel->irq_pending, 0);
++ init_waitqueue_head(&channel->wait_q);
++
++ spin_lock_irq(get_ccwdev_lock(cdev));
++ cdev->handler = qeth_irq;
++ spin_unlock_irq(get_ccwdev_lock(cdev));
++
++ if (!alloc_buffers)
++ return 0;
++
++ for (cnt = 0; cnt < QETH_CMD_BUFFER_NO; cnt++) {
++ channel->iob[cnt].data =
++ kzalloc(QETH_BUFSIZE, GFP_DMA|GFP_KERNEL);
++ if (channel->iob[cnt].data == NULL)
++ break;
++ channel->iob[cnt].state = BUF_STATE_FREE;
++ channel->iob[cnt].channel = channel;
++ channel->iob[cnt].callback = qeth_send_control_data_cb;
++ channel->iob[cnt].rc = 0;
++ }
++ if (cnt < QETH_CMD_BUFFER_NO) {
++ qeth_clean_channel(channel);
++ return -ENOMEM;
++ }
++ channel->io_buf_no = 0;
++ spin_lock_init(&channel->iob_lock);
++
++ return 0;
++}
++
+ static void qeth_set_single_write_queues(struct qeth_card *card)
+ {
+ if ((atomic_read(&card->qdio.state) != QETH_QDIO_UNINITIALIZED) &&
+@@ -1498,7 +1507,7 @@ static void qeth_core_sl_print(struct seq_file *m, struct service_level *slr)
+ CARD_BUS_ID(card), card->info.mcl_level);
+ }
+
+-static struct qeth_card *qeth_alloc_card(void)
++static struct qeth_card *qeth_alloc_card(struct ccwgroup_device *gdev)
+ {
+ struct qeth_card *card;
+
+@@ -1507,6 +1516,11 @@ static struct qeth_card *qeth_alloc_card(void)
+ if (!card)
+ goto out;
+ QETH_DBF_HEX(SETUP, 2, &card, sizeof(void *));
++
++ card->gdev = gdev;
++ CARD_RDEV(card) = gdev->cdev[0];
++ CARD_WDEV(card) = gdev->cdev[1];
++ CARD_DDEV(card) = gdev->cdev[2];
+ if (qeth_setup_channel(&card->read, true))
+ goto out_ip;
+ if (qeth_setup_channel(&card->write, true))
+@@ -5745,7 +5759,7 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev)
+
+ QETH_DBF_TEXT_(SETUP, 2, "%s", dev_name(&gdev->dev));
+
+- card = qeth_alloc_card();
++ card = qeth_alloc_card(gdev);
+ if (!card) {
+ QETH_DBF_TEXT_(SETUP, 2, "1err%d", -ENOMEM);
+ rc = -ENOMEM;
+@@ -5761,15 +5775,7 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev)
+ goto err_card;
+ }
+
+- card->read.ccwdev = gdev->cdev[0];
+- card->write.ccwdev = gdev->cdev[1];
+- card->data.ccwdev = gdev->cdev[2];
+ dev_set_drvdata(&gdev->dev, card);
+- card->gdev = gdev;
+- gdev->cdev[0]->handler = qeth_irq;
+- gdev->cdev[1]->handler = qeth_irq;
+- gdev->cdev[2]->handler = qeth_irq;
+-
+ qeth_setup_card(card);
+ rc = qeth_update_from_chp_desc(card);
+ if (rc)
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index c1c35eccd5b6..95669d47c389 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -789,7 +789,10 @@ static int __qeth_l2_open(struct net_device *dev)
+
+ if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+ napi_enable(&card->napi);
++ local_bh_disable();
+ napi_schedule(&card->napi);
++ /* kick-start the NAPI softirq: */
++ local_bh_enable();
+ } else
+ rc = -EIO;
+ return rc;
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index 9c5e801b3f6c..52e0ae4dc724 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -2414,7 +2414,10 @@ static int __qeth_l3_open(struct net_device *dev)
+
+ if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+ napi_enable(&card->napi);
++ local_bh_disable();
+ napi_schedule(&card->napi);
++ /* kick-start the NAPI softirq: */
++ local_bh_enable();
+ } else
+ rc = -EIO;
+ return rc;
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 5160d6214a36..8ec68dcc0cc4 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -131,6 +131,7 @@
+
+ static int do_abort(struct Scsi_Host *);
+ static void do_reset(struct Scsi_Host *);
++static void bus_reset_cleanup(struct Scsi_Host *);
+
+ /**
+ * initialize_SCp - init the scsi pointer field
+@@ -513,16 +514,15 @@ static void complete_cmd(struct Scsi_Host *instance,
+
+ if (hostdata->sensing == cmd) {
+ /* Autosense processing ends here */
+- if ((cmd->result & 0xff) != SAM_STAT_GOOD) {
++ if (status_byte(cmd->result) != GOOD) {
+ scsi_eh_restore_cmnd(cmd, &hostdata->ses);
+- set_host_byte(cmd, DID_ERROR);
+- } else
++ } else {
+ scsi_eh_restore_cmnd(cmd, &hostdata->ses);
++ set_driver_byte(cmd, DRIVER_SENSE);
++ }
+ hostdata->sensing = NULL;
+ }
+
+- hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+-
+ cmd->scsi_done(cmd);
+ }
+
+@@ -886,7 +886,14 @@ static irqreturn_t __maybe_unused NCR5380_intr(int irq, void *dev_id)
+ /* Probably Bus Reset */
+ NCR5380_read(RESET_PARITY_INTERRUPT_REG);
+
+- dsprintk(NDEBUG_INTR, instance, "unknown interrupt\n");
++ if (sr & SR_RST) {
++ /* Certainly Bus Reset */
++ shost_printk(KERN_WARNING, instance,
++ "bus reset interrupt\n");
++ bus_reset_cleanup(instance);
++ } else {
++ dsprintk(NDEBUG_INTR, instance, "unknown interrupt\n");
++ }
+ #ifdef SUN3_SCSI_VME
+ dregs->csr |= CSR_DMA_ENABLE;
+ #endif
+@@ -904,20 +911,16 @@ static irqreturn_t __maybe_unused NCR5380_intr(int irq, void *dev_id)
+ return IRQ_RETVAL(handled);
+ }
+
+-/*
+- * Function : int NCR5380_select(struct Scsi_Host *instance,
+- * struct scsi_cmnd *cmd)
+- *
+- * Purpose : establishes I_T_L or I_T_L_Q nexus for new or existing command,
+- * including ARBITRATION, SELECTION, and initial message out for
+- * IDENTIFY and queue messages.
++/**
++ * NCR5380_select - attempt arbitration and selection for a given command
++ * @instance: the Scsi_Host instance
++ * @cmd: the scsi_cmnd to execute
+ *
+- * Inputs : instance - instantiation of the 5380 driver on which this
+- * target lives, cmd - SCSI command to execute.
++ * This routine establishes an I_T_L nexus for a SCSI command. This involves
++ * ARBITRATION, SELECTION and MESSAGE OUT phases and an IDENTIFY message.
+ *
+- * Returns cmd if selection failed but should be retried,
+- * NULL if selection failed and should not be retried, or
+- * NULL if selection succeeded (hostdata->connected == cmd).
++ * Returns true if the operation should be retried.
++ * Returns false if it should not be retried.
+ *
+ * Side effects :
+ * If bus busy, arbitration failed, etc, NCR5380_select() will exit
+@@ -925,16 +928,15 @@ static irqreturn_t __maybe_unused NCR5380_intr(int irq, void *dev_id)
+ * SELECT_ENABLE will be set appropriately, the NCR5380
+ * will cease to drive any SCSI bus signals.
+ *
+- * If successful : I_T_L or I_T_L_Q nexus will be established,
+- * instance->connected will be set to cmd.
++ * If successful : the I_T_L nexus will be established, and
++ * hostdata->connected will be set to cmd.
+ * SELECT interrupt will be disabled.
+ *
+ * If failed (no target) : cmd->scsi_done() will be called, and the
+ * cmd->result host byte set to DID_BAD_TARGET.
+ */
+
+-static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+- struct scsi_cmnd *cmd)
++static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)
+ __releases(&hostdata->lock) __acquires(&hostdata->lock)
+ {
+ struct NCR5380_hostdata *hostdata = shost_priv(instance);
+@@ -942,6 +944,9 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ unsigned char *data;
+ int len;
+ int err;
++ bool ret = true;
++ bool can_disconnect = instance->irq != NO_IRQ &&
++ cmd->cmnd[0] != REQUEST_SENSE;
+
+ NCR5380_dprint(NDEBUG_ARBITRATION, instance);
+ dsprintk(NDEBUG_ARBITRATION, instance, "starting arbitration, id = %d\n",
+@@ -950,7 +955,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ /*
+ * Arbitration and selection phases are slow and involve dropping the
+ * lock, so we have to watch out for EH. An exception handler may
+- * change 'selecting' to NULL. This function will then return NULL
++ * change 'selecting' to NULL. This function will then return false
+ * so that the caller will forget about 'cmd'. (During information
+ * transfer phases, EH may change 'connected' to NULL.)
+ */
+@@ -986,7 +991,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ if (!hostdata->selecting) {
+ /* Command was aborted */
+ NCR5380_write(MODE_REG, MR_BASE);
+- return NULL;
++ return false;
+ }
+ if (err < 0) {
+ NCR5380_write(MODE_REG, MR_BASE);
+@@ -1035,7 +1040,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ if (!hostdata->selecting) {
+ NCR5380_write(MODE_REG, MR_BASE);
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+- return NULL;
++ return false;
+ }
+
+ dsprintk(NDEBUG_ARBITRATION, instance, "won arbitration\n");
+@@ -1118,13 +1123,13 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+
+ /* Can't touch cmd if it has been reclaimed by the scsi ML */
+ if (!hostdata->selecting)
+- return NULL;
++ return false;
+
+ cmd->result = DID_BAD_TARGET << 16;
+ complete_cmd(instance, cmd);
+ dsprintk(NDEBUG_SELECTION, instance,
+ "target did not respond within 250ms\n");
+- cmd = NULL;
++ ret = false;
+ goto out;
+ }
+
+@@ -1156,12 +1161,12 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ }
+ if (!hostdata->selecting) {
+ do_abort(instance);
+- return NULL;
++ return false;
+ }
+
+ dsprintk(NDEBUG_SELECTION, instance, "target %d selected, going into MESSAGE OUT phase.\n",
+ scmd_id(cmd));
+- tmp[0] = IDENTIFY(((instance->irq == NO_IRQ) ? 0 : 1), cmd->device->lun);
++ tmp[0] = IDENTIFY(can_disconnect, cmd->device->lun);
+
+ len = 1;
+ data = tmp;
+@@ -1172,7 +1177,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ dsprintk(NDEBUG_SELECTION, instance, "IDENTIFY message transfer failed\n");
+- cmd = NULL;
++ ret = false;
+ goto out;
+ }
+
+@@ -1187,13 +1192,13 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+
+ initialize_SCp(cmd);
+
+- cmd = NULL;
++ ret = false;
+
+ out:
+ if (!hostdata->selecting)
+ return NULL;
+ hostdata->selecting = NULL;
+- return cmd;
++ return ret;
+ }
+
+ /*
+@@ -1712,6 +1717,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ return;
+ #endif
+ case PHASE_DATAIN:
+@@ -1794,6 +1800,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ cmd, scmd_id(cmd), cmd->device->lun);
+
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+
+ cmd->result &= ~0xffff;
+ cmd->result |= cmd->SCp.Status;
+@@ -1947,6 +1954,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ NCR5380_transfer_pio(instance, &phase, &len, &data);
+ if (msgout == ABORT) {
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ maybe_release_dma_irq(instance);
+@@ -2009,8 +2017,11 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ NCR5380_write(MODE_REG, MR_BASE);
+
+ target_mask = NCR5380_read(CURRENT_SCSI_DATA_REG) & ~(hostdata->id_mask);
+-
+- dsprintk(NDEBUG_RESELECTION, instance, "reselect\n");
++ if (!target_mask || target_mask & (target_mask - 1)) {
++ shost_printk(KERN_WARNING, instance,
++ "reselect: bad target_mask 0x%02x\n", target_mask);
++ return;
++ }
+
+ /*
+ * At this point, we have detected that our SCSI ID is on the bus,
+@@ -2024,6 +2035,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE | ICR_ASSERT_BSY);
+ if (NCR5380_poll_politely(hostdata,
+ STATUS_REG, SR_SEL, 0, 2 * HZ) < 0) {
++ shost_printk(KERN_ERR, instance, "reselect: !SEL timeout\n");
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+ return;
+ }
+@@ -2035,6 +2047,10 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+
+ if (NCR5380_poll_politely(hostdata,
+ STATUS_REG, SR_REQ, SR_REQ, 2 * HZ) < 0) {
++ if ((NCR5380_read(STATUS_REG) & (SR_BSY | SR_SEL)) == 0)
++ /* BUS FREE phase */
++ return;
++ shost_printk(KERN_ERR, instance, "reselect: REQ timeout\n");
+ do_abort(instance);
+ return;
+ }
+@@ -2096,13 +2112,16 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ dsprintk(NDEBUG_RESELECTION | NDEBUG_QUEUES, instance,
+ "reselect: removed %p from disconnected queue\n", tmp);
+ } else {
++ int target = ffs(target_mask) - 1;
++
+ shost_printk(KERN_ERR, instance, "target bitmask 0x%02x lun %d not in disconnected queue.\n",
+ target_mask, lun);
+ /*
+ * Since we have an established nexus that we can't do anything
+ * with, we must abort it.
+ */
+- do_abort(instance);
++ if (do_abort(instance) == 0)
++ hostdata->busy[target] &= ~(1 << lun);
+ return;
+ }
+
+@@ -2267,15 +2286,16 @@ static int NCR5380_abort(struct scsi_cmnd *cmd)
+ if (list_del_cmd(&hostdata->autosense, cmd)) {
+ dsprintk(NDEBUG_ABORT, instance,
+ "abort: removed %p from sense queue\n", cmd);
+- set_host_byte(cmd, DID_ERROR);
+ complete_cmd(instance, cmd);
+ }
+
+ out:
+ if (result == FAILED)
+ dsprintk(NDEBUG_ABORT, instance, "abort: failed to abort %p\n", cmd);
+- else
++ else {
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ dsprintk(NDEBUG_ABORT, instance, "abort: successfully aborted %p\n", cmd);
++ }
+
+ queue_work(hostdata->work_q, &hostdata->main_task);
+ maybe_release_dma_irq(instance);
+@@ -2285,31 +2305,12 @@ out:
+ }
+
+
+-/**
+- * NCR5380_host_reset - reset the SCSI host
+- * @cmd: SCSI command undergoing EH
+- *
+- * Returns SUCCESS
+- */
+-
+-static int NCR5380_host_reset(struct scsi_cmnd *cmd)
++static void bus_reset_cleanup(struct Scsi_Host *instance)
+ {
+- struct Scsi_Host *instance = cmd->device->host;
+ struct NCR5380_hostdata *hostdata = shost_priv(instance);
+ int i;
+- unsigned long flags;
+ struct NCR5380_cmd *ncmd;
+
+- spin_lock_irqsave(&hostdata->lock, flags);
+-
+-#if (NDEBUG & NDEBUG_ANY)
+- scmd_printk(KERN_INFO, cmd, __func__);
+-#endif
+- NCR5380_dprint(NDEBUG_ANY, instance);
+- NCR5380_dprint_phase(NDEBUG_ANY, instance);
+-
+- do_reset(instance);
+-
+ /* reset NCR registers */
+ NCR5380_write(MODE_REG, MR_BASE);
+ NCR5380_write(TARGET_COMMAND_REG, 0);
+@@ -2321,11 +2322,6 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+ * commands!
+ */
+
+- if (list_del_cmd(&hostdata->unissued, cmd)) {
+- cmd->result = DID_RESET << 16;
+- cmd->scsi_done(cmd);
+- }
+-
+ if (hostdata->selecting) {
+ hostdata->selecting->result = DID_RESET << 16;
+ complete_cmd(instance, hostdata->selecting);
+@@ -2343,7 +2339,6 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+ list_for_each_entry(ncmd, &hostdata->autosense, list) {
+ struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);
+
+- set_host_byte(cmd, DID_RESET);
+ cmd->scsi_done(cmd);
+ }
+ INIT_LIST_HEAD(&hostdata->autosense);
+@@ -2360,6 +2355,41 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+
+ queue_work(hostdata->work_q, &hostdata->main_task);
+ maybe_release_dma_irq(instance);
++}
++
++/**
++ * NCR5380_host_reset - reset the SCSI host
++ * @cmd: SCSI command undergoing EH
++ *
++ * Returns SUCCESS
++ */
++
++static int NCR5380_host_reset(struct scsi_cmnd *cmd)
++{
++ struct Scsi_Host *instance = cmd->device->host;
++ struct NCR5380_hostdata *hostdata = shost_priv(instance);
++ unsigned long flags;
++ struct NCR5380_cmd *ncmd;
++
++ spin_lock_irqsave(&hostdata->lock, flags);
++
++#if (NDEBUG & NDEBUG_ANY)
++ shost_printk(KERN_INFO, instance, __func__);
++#endif
++ NCR5380_dprint(NDEBUG_ANY, instance);
++ NCR5380_dprint_phase(NDEBUG_ANY, instance);
++
++ list_for_each_entry(ncmd, &hostdata->unissued, list) {
++ struct scsi_cmnd *scmd = NCR5380_to_scmd(ncmd);
++
++ scmd->result = DID_RESET << 16;
++ scmd->scsi_done(scmd);
++ }
++ INIT_LIST_HEAD(&hostdata->unissued);
++
++ do_reset(instance);
++ bus_reset_cleanup(instance);
++
+ spin_unlock_irqrestore(&hostdata->lock, flags);
+
+ return SUCCESS;
+diff --git a/drivers/scsi/NCR5380.h b/drivers/scsi/NCR5380.h
+index 8a6d002e6789..5935fd6d1a05 100644
+--- a/drivers/scsi/NCR5380.h
++++ b/drivers/scsi/NCR5380.h
+@@ -275,7 +275,7 @@ static irqreturn_t NCR5380_intr(int irq, void *dev_id);
+ static void NCR5380_main(struct work_struct *work);
+ static const char *NCR5380_info(struct Scsi_Host *instance);
+ static void NCR5380_reselect(struct Scsi_Host *instance);
+-static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *, struct scsi_cmnd *);
++static bool NCR5380_select(struct Scsi_Host *, struct scsi_cmnd *);
+ static int NCR5380_transfer_dma(struct Scsi_Host *instance, unsigned char *phase, int *count, unsigned char **data);
+ static int NCR5380_transfer_pio(struct Scsi_Host *instance, unsigned char *phase, int *count, unsigned char **data);
+ static int NCR5380_poll_politely2(struct NCR5380_hostdata *,
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index b141d1061f38..2ee9c4ec7a54 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -2062,14 +2062,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last)
+ return res;
+ }
+
+- /* delete the old link */
+- if (SAS_ADDR(phy->attached_sas_addr) &&
+- SAS_ADDR(sas_addr) != SAS_ADDR(phy->attached_sas_addr)) {
+- SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n",
+- SAS_ADDR(dev->sas_addr), phy_id,
+- SAS_ADDR(phy->attached_sas_addr));
+- sas_unregister_devs_sas_addr(dev, phy_id, last);
+- }
++ /* we always have to delete the old device when we went here */
++ SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n",
++ SAS_ADDR(dev->sas_addr), phy_id,
++ SAS_ADDR(phy->attached_sas_addr));
++ sas_unregister_devs_sas_addr(dev, phy_id, last);
+
+ return sas_discover_new(dev, phy_id);
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
+index d909d90035bb..384f5cd7c3c8 100644
+--- a/drivers/scsi/lpfc/lpfc_ct.c
++++ b/drivers/scsi/lpfc/lpfc_ct.c
+@@ -471,11 +471,6 @@ lpfc_prep_node_fc4type(struct lpfc_vport *vport, uint32_t Did, uint8_t fc4_type)
+ "Parse GID_FTrsp: did:x%x flg:x%x x%x",
+ Did, ndlp->nlp_flag, vport->fc_flag);
+
+- /* Don't assume the rport is always the previous
+- * FC4 type.
+- */
+- ndlp->nlp_fc4_type &= ~(NLP_FC4_FCP | NLP_FC4_NVME);
+-
+ /* By default, the driver expects to support FCP FC4 */
+ if (fc4_type == FC_TYPE_FCP)
+ ndlp->nlp_fc4_type |= NLP_FC4_FCP;
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index ccdd82b1123f..db183d1f34ab 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -4198,7 +4198,7 @@ lpfc_nlp_state_cleanup(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+
+ if (new_state == NLP_STE_MAPPED_NODE ||
+ new_state == NLP_STE_UNMAPPED_NODE) {
+- if (ndlp->nlp_fc4_type & NLP_FC4_FCP ||
++ if (ndlp->nlp_fc4_type ||
+ ndlp->nlp_DID == Fabric_DID ||
+ ndlp->nlp_DID == NameServer_DID ||
+ ndlp->nlp_DID == FDMI_DID) {
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index ae6301c79678..c15f3265eefe 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -2323,6 +2323,7 @@ lpfc_device_recov_unmap_node(struct lpfc_vport *vport,
+ lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE);
+ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag &= ~(NLP_NODEV_REMOVE | NLP_NPR_2B_DISC);
++ ndlp->nlp_fc4_type &= ~(NLP_FC4_FCP | NLP_FC4_NVME);
+ spin_unlock_irq(shost->host_lock);
+ lpfc_disc_set_adisc(vport, ndlp);
+
+@@ -2400,6 +2401,7 @@ lpfc_device_recov_mapped_node(struct lpfc_vport *vport,
+ lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE);
+ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag &= ~(NLP_NODEV_REMOVE | NLP_NPR_2B_DISC);
++ ndlp->nlp_fc4_type &= ~(NLP_FC4_FCP | NLP_FC4_NVME);
+ spin_unlock_irq(shost->host_lock);
+ lpfc_disc_set_adisc(vport, ndlp);
+ return ndlp->nlp_state;
+@@ -2657,6 +2659,7 @@ lpfc_device_recov_npr_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ lpfc_cancel_retry_delay_tmo(vport, ndlp);
+ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag &= ~(NLP_NODEV_REMOVE | NLP_NPR_2B_DISC);
++ ndlp->nlp_fc4_type &= ~(NLP_FC4_FCP | NLP_FC4_NVME);
+ spin_unlock_irq(shost->host_lock);
+ return ndlp->nlp_state;
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index 645ffb5332b4..8ee585e453dc 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -282,7 +282,7 @@ lpfc_nvme_delete_queue(struct nvme_fc_local_port *pnvme_lport,
+ vport = lport->vport;
+
+ lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME,
+- "6001 ENTER. lpfc_pnvme %p, qidx x%xi qhandle %p\n",
++ "6001 ENTER. lpfc_pnvme %p, qidx x%x qhandle %p\n",
+ lport, qidx, handle);
+ kfree(handle);
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index 22efefcc6cd8..768eba8c111d 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -1340,15 +1340,14 @@ lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
+ idx = 0;
+ }
+
+- infop = phba->sli4_hba.nvmet_ctx_info;
+- for (j = 0; j < phba->cfg_nvmet_mrq; j++) {
+- for (i = 0; i < phba->sli4_hba.num_present_cpu; i++) {
++ for (i = 0; i < phba->sli4_hba.num_present_cpu; i++) {
++ for (j = 0; j < phba->cfg_nvmet_mrq; j++) {
++ infop = lpfc_get_ctx_list(phba, i, j);
+ lpfc_printf_log(phba, KERN_INFO, LOG_NVME | LOG_INIT,
+ "6408 TOTAL NVMET ctx for CPU %d "
+ "MRQ %d: cnt %d nextcpu %p\n",
+ i, j, infop->nvmet_ctx_list_cnt,
+ infop->nvmet_ctx_next_cpu);
+- infop++;
+ }
+ }
+ return 0;
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index a490e63c94b6..e704297618e0 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -392,11 +392,7 @@ lpfc_sli4_if6_eq_clr_intr(struct lpfc_queue *q)
+ struct lpfc_register doorbell;
+
+ doorbell.word0 = 0;
+- bf_set(lpfc_eqcq_doorbell_eqci, &doorbell, 1);
+- bf_set(lpfc_eqcq_doorbell_qt, &doorbell, LPFC_QUEUE_TYPE_EVENT);
+- bf_set(lpfc_eqcq_doorbell_eqid_hi, &doorbell,
+- (q->queue_id >> LPFC_EQID_HI_FIELD_SHIFT));
+- bf_set(lpfc_eqcq_doorbell_eqid_lo, &doorbell, q->queue_id);
++ bf_set(lpfc_if6_eq_doorbell_eqid, &doorbell, q->queue_id);
+ writel(doorbell.word0, q->phba->sli4_hba.EQDBregaddr);
+ }
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 4dd6cad330e8..3e814c0469fb 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -1479,6 +1479,12 @@ u32 pm8001_mpi_msg_consume(struct pm8001_hba_info *pm8001_ha,
+ } else {
+ u32 producer_index;
+ void *pi_virt = circularQ->pi_virt;
++ /* spurious interrupt during setup if
++ * kexec-ing and driver doing a doorbell access
++ * with the pre-kexec oq interrupt setup
++ */
++ if (!pi_virt)
++ break;
+ /* Update the producer index from SPC */
+ producer_index = pm8001_read_32(pi_virt);
+ circularQ->producer_index = cpu_to_le32(producer_index);
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 947d6017d004..59feda261e08 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -374,6 +374,13 @@ static int pm8001_task_exec(struct sas_task *task,
+ return 0;
+ }
+ pm8001_ha = pm8001_find_ha_by_dev(task->dev);
++ if (pm8001_ha->controller_fatal_error) {
++ struct task_status_struct *ts = &t->task_status;
++
++ ts->resp = SAS_TASK_UNDELIVERED;
++ t->task_done(t);
++ return 0;
++ }
+ PM8001_IO_DBG(pm8001_ha, pm8001_printk("pm8001_task_exec device \n "));
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ do {
+@@ -466,7 +473,7 @@ err_out:
+ dev_printk(KERN_ERR, pm8001_ha->dev, "pm8001 exec failed[%d]!\n", rc);
+ if (!sas_protocol_ata(t->task_proto))
+ if (n_elem)
+- dma_unmap_sg(pm8001_ha->dev, t->scatter, n_elem,
++ dma_unmap_sg(pm8001_ha->dev, t->scatter, t->num_scatter,
+ t->data_dir);
+ out_done:
+ spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index 80b4dd6df0c2..1816e351071f 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -538,6 +538,7 @@ struct pm8001_hba_info {
+ u32 logging_level;
+ u32 fw_status;
+ u32 smp_exp_mode;
++ bool controller_fatal_error;
+ const struct firmware *fw_image;
+ struct isr_param irq_vector[PM8001_MAX_MSIX_VEC];
+ u32 reset_in_progress;
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 42f0405601ad..5021aed87f33 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -577,6 +577,9 @@ static void update_main_config_table(struct pm8001_hba_info *pm8001_ha)
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_size);
+ pm8001_mw32(address, MAIN_PCS_EVENT_LOG_OPTION,
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_severity);
++ /* Update Fatal error interrupt vector */
++ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt |=
++ ((pm8001_ha->number_of_intr - 1) << 8);
+ pm8001_mw32(address, MAIN_FATAL_ERROR_INTERRUPT,
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt);
+ pm8001_mw32(address, MAIN_EVENT_CRC_CHECK,
+@@ -1110,6 +1113,9 @@ static int pm80xx_chip_init(struct pm8001_hba_info *pm8001_ha)
+ return -EBUSY;
+ }
+
++ /* Initialize the controller fatal error flag */
++ pm8001_ha->controller_fatal_error = false;
++
+ /* Initialize pci space address eg: mpi offset */
+ init_pci_device_addresses(pm8001_ha);
+ init_default_table_values(pm8001_ha);
+@@ -1218,13 +1224,17 @@ pm80xx_chip_soft_rst(struct pm8001_hba_info *pm8001_ha)
+ u32 bootloader_state;
+ u32 ibutton0, ibutton1;
+
+- /* Check if MPI is in ready state to reset */
+- if (mpi_uninit_check(pm8001_ha) != 0) {
+- PM8001_FAIL_DBG(pm8001_ha,
+- pm8001_printk("MPI state is not ready\n"));
+- return -1;
++ /* Process MPI table uninitialization only if FW is ready */
++ if (!pm8001_ha->controller_fatal_error) {
++ /* Check if MPI is in ready state to reset */
++ if (mpi_uninit_check(pm8001_ha) != 0) {
++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk(
++ "MPI state is not ready scratch1 :0x%x\n",
++ regval));
++ return -1;
++ }
+ }
+-
+ /* checked for reset register normal state; 0x0 */
+ regval = pm8001_cr32(pm8001_ha, 0, SPC_REG_SOFT_RESET);
+ PM8001_INIT_DBG(pm8001_ha,
+@@ -3752,6 +3762,46 @@ static void process_one_iomb(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ }
+ }
+
++static void print_scratchpad_registers(struct pm8001_hba_info *pm8001_ha)
++{
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_0)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_1:0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_2: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_3: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_3)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_0)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_1: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_1)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_2: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_2)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_3: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_3)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_4: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_4)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_5: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_5)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_6)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_1: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_7)));
++}
++
+ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ {
+ struct outbound_queue_table *circularQ;
+@@ -3759,10 +3809,28 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ u8 uninitialized_var(bc);
+ u32 ret = MPI_IO_STATUS_FAIL;
+ unsigned long flags;
++ u32 regval;
+
++ if (vec == (pm8001_ha->number_of_intr - 1)) {
++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
++ if ((regval & SCRATCH_PAD_MIPSALL_READY) !=
++ SCRATCH_PAD_MIPSALL_READY) {
++ pm8001_ha->controller_fatal_error = true;
++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk(
++ "Firmware Fatal error! Regval:0x%x\n", regval));
++ print_scratchpad_registers(pm8001_ha);
++ return ret;
++ }
++ }
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ circularQ = &pm8001_ha->outbnd_q_tbl[vec];
+ do {
++ /* spurious interrupt during setup if kexec-ing and
++ * driver doing a doorbell access w/ the pre-kexec oq
++ * interrupt setup.
++ */
++ if (!circularQ->pi_virt)
++ break;
+ ret = pm8001_mpi_msg_consume(pm8001_ha, circularQ, &pMsg1, &bc);
+ if (MPI_IO_STATUS_SUCCESS == ret) {
+ /* process the outbound message */
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h
+index 889e69ce3689..7dd2699d0efb 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.h
++++ b/drivers/scsi/pm8001/pm80xx_hwi.h
+@@ -1384,6 +1384,9 @@ typedef struct SASProtocolTimerConfig SASProtocolTimerConfig_t;
+ #define SCRATCH_PAD_BOOT_LOAD_SUCCESS 0x0
+ #define SCRATCH_PAD_IOP0_READY 0xC00
+ #define SCRATCH_PAD_IOP1_READY 0x3000
++#define SCRATCH_PAD_MIPSALL_READY (SCRATCH_PAD_IOP1_READY | \
++ SCRATCH_PAD_IOP0_READY | \
++ SCRATCH_PAD_RAAE_READY)
+
+ /* boot loader state */
+ #define SCRATCH_PAD1_BOOTSTATE_MASK 0x70 /* Bit 4-6 */
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index 34ff4bbc8de1..b8d3403c3c85 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3277,7 +3277,7 @@ static void qla24xx_async_gpsc_sp_done(void *s, int res)
+ ql_dbg(ql_dbg_disc, vha, 0x2019,
+ "GPSC command unsupported, disabling query.\n");
+ ha->flags.gpsc_supported = 0;
+- res = QLA_SUCCESS;
++ goto done;
+ }
+ } else {
+ switch (be16_to_cpu(ct_rsp->rsp.gpsc.speed)) {
+@@ -3310,7 +3310,6 @@ static void qla24xx_async_gpsc_sp_done(void *s, int res)
+ be16_to_cpu(ct_rsp->rsp.gpsc.speeds),
+ be16_to_cpu(ct_rsp->rsp.gpsc.speed));
+ }
+-done:
+ memset(&ea, 0, sizeof(ea));
+ ea.event = FCME_GPSC_DONE;
+ ea.rc = res;
+@@ -3318,6 +3317,7 @@ done:
+ ea.sp = sp;
+ qla2x00_fcport_event_handler(vha, &ea);
+
++done:
+ sp->free(sp);
+ }
+
+@@ -3902,9 +3902,10 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ fc_port_t *fcport;
+ u32 i, rc;
+ bool found;
+- struct fab_scan_rp *rp;
++ struct fab_scan_rp *rp, *trp;
+ unsigned long flags;
+ u8 recheck = 0;
++ u16 dup = 0, dup_cnt = 0;
+
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s enter\n", __func__);
+@@ -3935,6 +3936,7 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+
+ for (i = 0; i < vha->hw->max_fibre_devices; i++) {
+ u64 wwn;
++ int k;
+
+ rp = &vha->scan.l[i];
+ found = false;
+@@ -3943,6 +3945,20 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ if (wwn == 0)
+ continue;
+
++ /* Remove duplicate NPORT ID entries from switch data base */
++ for (k = i + 1; k < vha->hw->max_fibre_devices; k++) {
++ trp = &vha->scan.l[k];
++ if (rp->id.b24 == trp->id.b24) {
++ dup = 1;
++ dup_cnt++;
++ ql_dbg(ql_dbg_disc + ql_dbg_verbose,
++ vha, 0xffff,
++ "Detected duplicate NPORT ID from switch data base: ID %06x WWN %8phN WWN %8phN\n",
++ rp->id.b24, rp->port_name, trp->port_name);
++ memset(trp, 0, sizeof(*trp));
++ }
++ }
++
+ if (!memcmp(rp->port_name, vha->port_name, WWN_SIZE))
+ continue;
+
+@@ -3982,6 +3998,12 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ }
+ }
+
++ if (dup) {
++ ql_log(ql_log_warn, vha, 0xffff,
++ "Detected %d duplicate NPORT ID(s) from switch data base\n",
++ dup_cnt);
++ }
++
+ /*
+ * Logout all previous fabric dev marked lost, except FCP2 devices.
+ */
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index bee9cfb29152..653d535e3052 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -1772,38 +1772,34 @@ int
+ qla24xx_async_abort_cmd(srb_t *cmd_sp, bool wait)
+ {
+ scsi_qla_host_t *vha = cmd_sp->vha;
+- fc_port_t *fcport = cmd_sp->fcport;
+ struct srb_iocb *abt_iocb;
+ srb_t *sp;
+ int rval = QLA_FUNCTION_FAILED;
+
+- sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
++ sp = qla2xxx_get_qpair_sp(cmd_sp->qpair, cmd_sp->fcport, GFP_KERNEL);
+ if (!sp)
+ goto done;
+
+ abt_iocb = &sp->u.iocb_cmd;
+ sp->type = SRB_ABT_CMD;
+ sp->name = "abort";
++ sp->qpair = cmd_sp->qpair;
+ if (wait)
+ sp->flags = SRB_WAKEUP_ON_COMP;
+
+ abt_iocb->timeout = qla24xx_abort_iocb_timeout;
+ init_completion(&abt_iocb->u.abt.comp);
+- qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha));
++ /* FW can send 2 x ABTS's timeout/20s */
++ qla2x00_init_timer(sp, 42);
+
+ abt_iocb->u.abt.cmd_hndl = cmd_sp->handle;
+-
+- if (vha->flags.qpairs_available && cmd_sp->qpair)
+- abt_iocb->u.abt.req_que_no =
+- cpu_to_le16(cmd_sp->qpair->req->id);
+- else
+- abt_iocb->u.abt.req_que_no = cpu_to_le16(vha->req->id);
++ abt_iocb->u.abt.req_que_no = cpu_to_le16(cmd_sp->qpair->req->id);
+
+ sp->done = qla24xx_abort_sp_done;
+
+ ql_dbg(ql_dbg_async, vha, 0x507c,
+- "Abort command issued - hdl=%x, target_id=%x\n",
+- cmd_sp->handle, fcport->tgt_id);
++ "Abort command issued - hdl=%x, type=%x\n",
++ cmd_sp->handle, cmd_sp->type);
+
+ rval = qla2x00_start_sp(sp);
+ if (rval != QLA_SUCCESS)
+@@ -4874,19 +4870,10 @@ qla2x00_configure_loop(scsi_qla_host_t *vha)
+ */
+ if (qla_tgt_mode_enabled(vha) ||
+ qla_dual_mode_enabled(vha)) {
+- if (IS_QLA27XX(ha) || IS_QLA83XX(ha)) {
+- spin_lock_irqsave(&ha->tgt.atio_lock,
+- flags);
+- qlt_24xx_process_atio_queue(vha, 0);
+- spin_unlock_irqrestore(
+- &ha->tgt.atio_lock, flags);
+- } else {
+- spin_lock_irqsave(&ha->hardware_lock,
+- flags);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(
+- &ha->hardware_lock, flags);
+- }
++ spin_lock_irqsave(&ha->tgt.atio_lock, flags);
++ qlt_24xx_process_atio_queue(vha, 0);
++ spin_unlock_irqrestore(&ha->tgt.atio_lock,
++ flags);
+ }
+ }
+ }
+@@ -6515,6 +6502,7 @@ qla2x00_abort_isp_cleanup(scsi_qla_host_t *vha)
+ if (!(IS_P3P_TYPE(ha)))
+ ha->isp_ops->reset_chip(vha);
+
++ ha->link_data_rate = PORT_SPEED_UNKNOWN;
+ SAVE_TOPO(ha);
+ ha->flags.rida_fmt2 = 0;
+ ha->flags.n2n_ae = 0;
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index 119927220299..c699bbb8485b 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -3297,19 +3297,21 @@ qla24xx_abort_iocb(srb_t *sp, struct abort_entry_24xx *abt_iocb)
+ {
+ struct srb_iocb *aio = &sp->u.iocb_cmd;
+ scsi_qla_host_t *vha = sp->vha;
+- struct req_que *req = vha->req;
++ struct req_que *req = sp->qpair->req;
+
+ memset(abt_iocb, 0, sizeof(struct abort_entry_24xx));
+ abt_iocb->entry_type = ABORT_IOCB_TYPE;
+ abt_iocb->entry_count = 1;
+ abt_iocb->handle = cpu_to_le32(MAKE_HANDLE(req->id, sp->handle));
+- abt_iocb->nport_handle = cpu_to_le16(sp->fcport->loop_id);
++ if (sp->fcport) {
++ abt_iocb->nport_handle = cpu_to_le16(sp->fcport->loop_id);
++ abt_iocb->port_id[0] = sp->fcport->d_id.b.al_pa;
++ abt_iocb->port_id[1] = sp->fcport->d_id.b.area;
++ abt_iocb->port_id[2] = sp->fcport->d_id.b.domain;
++ }
+ abt_iocb->handle_to_abort =
+ cpu_to_le32(MAKE_HANDLE(aio->u.abt.req_que_no,
+ aio->u.abt.cmd_hndl));
+- abt_iocb->port_id[0] = sp->fcport->d_id.b.al_pa;
+- abt_iocb->port_id[1] = sp->fcport->d_id.b.area;
+- abt_iocb->port_id[2] = sp->fcport->d_id.b.domain;
+ abt_iocb->vp_index = vha->vp_idx;
+ abt_iocb->req_que_no = cpu_to_le16(aio->u.abt.req_que_no);
+ /* Send the command to the firmware */
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 88d8acf86a2a..8fa7242dbb43 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -2837,6 +2837,7 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
+ case ELS_IOCB_TYPE:
+ case ABORT_IOCB_TYPE:
+ case MBX_IOCB_TYPE:
++ default:
+ sp = qla2x00_get_sp_from_handle(vha, func, req, pkt);
+ if (sp) {
+ sp->done(sp, res);
+@@ -2847,7 +2848,6 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
+ case ABTS_RESP_24XX:
+ case CTIO_TYPE7:
+ case CTIO_CRC2:
+- default:
+ return 1;
+ }
+ fatal:
+@@ -3121,6 +3121,7 @@ qla24xx_intr_handler(int irq, void *dev_id)
+ uint16_t mb[8];
+ struct rsp_que *rsp;
+ unsigned long flags;
++ bool process_atio = false;
+
+ rsp = (struct rsp_que *) dev_id;
+ if (!rsp) {
+@@ -3181,22 +3182,13 @@ qla24xx_intr_handler(int irq, void *dev_id)
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+ case INTR_ATIO_QUE_UPDATE_27XX:
+- case INTR_ATIO_QUE_UPDATE:{
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
++ case INTR_ATIO_QUE_UPDATE:
++ process_atio = true;
+ break;
+- }
+- case INTR_ATIO_RSP_QUE_UPDATE: {
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
+-
++ case INTR_ATIO_RSP_QUE_UPDATE:
++ process_atio = true;
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+- }
+ default:
+ ql_dbg(ql_dbg_async, vha, 0x504f,
+ "Unrecognized interrupt type (%d).\n", stat * 0xff);
+@@ -3210,6 +3202,12 @@ qla24xx_intr_handler(int irq, void *dev_id)
+ qla2x00_handle_mbx_completion(ha, status);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
++ if (process_atio) {
++ spin_lock_irqsave(&ha->tgt.atio_lock, flags);
++ qlt_24xx_process_atio_queue(vha, 0);
++ spin_unlock_irqrestore(&ha->tgt.atio_lock, flags);
++ }
++
+ return IRQ_HANDLED;
+ }
+
+@@ -3256,6 +3254,7 @@ qla24xx_msix_default(int irq, void *dev_id)
+ uint32_t hccr;
+ uint16_t mb[8];
+ unsigned long flags;
++ bool process_atio = false;
+
+ rsp = (struct rsp_que *) dev_id;
+ if (!rsp) {
+@@ -3312,22 +3311,13 @@ qla24xx_msix_default(int irq, void *dev_id)
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+ case INTR_ATIO_QUE_UPDATE_27XX:
+- case INTR_ATIO_QUE_UPDATE:{
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
++ case INTR_ATIO_QUE_UPDATE:
++ process_atio = true;
+ break;
+- }
+- case INTR_ATIO_RSP_QUE_UPDATE: {
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
+-
++ case INTR_ATIO_RSP_QUE_UPDATE:
++ process_atio = true;
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+- }
+ default:
+ ql_dbg(ql_dbg_async, vha, 0x5051,
+ "Unrecognized interrupt type (%d).\n", stat & 0xff);
+@@ -3338,6 +3328,12 @@ qla24xx_msix_default(int irq, void *dev_id)
+ qla2x00_handle_mbx_completion(ha, status);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
++ if (process_atio) {
++ spin_lock_irqsave(&ha->tgt.atio_lock, flags);
++ qlt_24xx_process_atio_queue(vha, 0);
++ spin_unlock_irqrestore(&ha->tgt.atio_lock, flags);
++ }
++
+ return IRQ_HANDLED;
+ }
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 18ee614fe07f..3e892e013658 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1744,6 +1744,7 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
+ !ha->flags.eeh_busy &&
+ (!test_bit(ABORT_ISP_ACTIVE,
+ &vha->dpc_flags)) &&
++ !qla2x00_isp_reg_stat(ha) &&
+ (sp->type == SRB_SCSI_CMD)) {
+ /*
+ * Don't abort commands in
+@@ -6059,12 +6060,27 @@ qla2x00_do_dpc(void *data)
+ if (test_and_clear_bit
+ (ISP_ABORT_NEEDED, &base_vha->dpc_flags) &&
+ !test_bit(UNLOADING, &base_vha->dpc_flags)) {
++ bool do_reset = true;
++
++ switch (ql2x_ini_mode) {
++ case QLA2XXX_INI_MODE_ENABLED:
++ break;
++ case QLA2XXX_INI_MODE_DISABLED:
++ if (!qla_tgt_mode_enabled(base_vha))
++ do_reset = false;
++ break;
++ case QLA2XXX_INI_MODE_DUAL:
++ if (!qla_dual_mode_enabled(base_vha))
++ do_reset = false;
++ break;
++ default:
++ break;
++ }
+
+- ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
+- "ISP abort scheduled.\n");
+- if (!(test_and_set_bit(ABORT_ISP_ACTIVE,
++ if (do_reset && !(test_and_set_bit(ABORT_ISP_ACTIVE,
+ &base_vha->dpc_flags))) {
+-
++ ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
++ "ISP abort scheduled.\n");
+ if (ha->isp_ops->abort_isp(base_vha)) {
+ /* failed. retry later */
+ set_bit(ISP_ABORT_NEEDED,
+@@ -6072,10 +6088,9 @@ qla2x00_do_dpc(void *data)
+ }
+ clear_bit(ABORT_ISP_ACTIVE,
+ &base_vha->dpc_flags);
++ ql_dbg(ql_dbg_dpc, base_vha, 0x4008,
++ "ISP abort end.\n");
+ }
+-
+- ql_dbg(ql_dbg_dpc, base_vha, 0x4008,
+- "ISP abort end.\n");
+ }
+
+ if (test_and_clear_bit(FCPORT_UPDATE_NEEDED,
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index d6dc320f81a7..078d12453324 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -4703,6 +4703,12 @@ static int qlt_handle_login(struct scsi_qla_host *vha,
+ sess = qlt_find_sess_invalidate_other(vha, wwn,
+ port_id, loop_id, &conflict_sess);
+ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
++ } else {
++ ql_dbg(ql_dbg_disc, vha, 0xffff,
++ "%s %d Term INOT due to WWN=0 lid=%d, NportID %06X ",
++ __func__, __LINE__, loop_id, port_id.b24);
++ qlt_send_term_imm_notif(vha, iocb, 1);
++ goto out;
+ }
+
+ if (IS_SW_RESV_ADDR(port_id)) {
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index abfcc2f924ce..c501fb5190a3 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -2371,7 +2371,8 @@ int scsi_mq_setup_tags(struct Scsi_Host *shost)
+ {
+ unsigned int cmd_size, sgl_size;
+
+- sgl_size = scsi_mq_sgl_size(shost);
++ sgl_size = max_t(unsigned int, sizeof(struct scatterlist),
++ scsi_mq_sgl_size(shost));
+ cmd_size = sizeof(struct scsi_cmnd) + shost->hostt->cmd_size + sgl_size;
+ if (scsi_host_get_prot(shost))
+ cmd_size += sizeof(struct scsi_data_buffer) + sgl_size;
+diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+index bd3f6e2d6834..0a2a54517b15 100644
+--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+@@ -4370,6 +4370,13 @@ static void sym_nego_rejected(struct sym_hcb *np, struct sym_tcb *tp, struct sym
+ OUTB(np, HS_PRT, HS_BUSY);
+ }
+
++#define sym_printk(lvl, tp, cp, fmt, v...) do { \
++ if (cp) \
++ scmd_printk(lvl, cp->cmd, fmt, ##v); \
++ else \
++ starget_printk(lvl, tp->starget, fmt, ##v); \
++} while (0)
++
+ /*
+ * chip exception handler for programmed interrupts.
+ */
+@@ -4415,7 +4422,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * been selected with ATN. We do not want to handle that.
+ */
+ case SIR_SEL_ATN_NO_MSG_OUT:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No MSG OUT phase after selection with ATN\n");
+ goto out_stuck;
+ /*
+@@ -4423,7 +4430,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * having reselected the initiator.
+ */
+ case SIR_RESEL_NO_MSG_IN:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No MSG IN phase after reselection\n");
+ goto out_stuck;
+ /*
+@@ -4431,7 +4438,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * an IDENTIFY.
+ */
+ case SIR_RESEL_NO_IDENTIFY:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No IDENTIFY after reselection\n");
+ goto out_stuck;
+ /*
+@@ -4460,7 +4467,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ case SIR_RESEL_ABORTED:
+ np->lastmsg = np->msgout[0];
+ np->msgout[0] = M_NOOP;
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "message %x sent on bad reselection\n", np->lastmsg);
+ goto out;
+ /*
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 4aaba3e03055..8bce755e0f5b 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1772,6 +1772,34 @@ out:
+ return count;
+ }
+
++static void ufshcd_init_clk_scaling(struct ufs_hba *hba)
++{
++ char wq_name[sizeof("ufs_clkscaling_00")];
++
++ if (!ufshcd_is_clkscaling_supported(hba))
++ return;
++
++ INIT_WORK(&hba->clk_scaling.suspend_work,
++ ufshcd_clk_scaling_suspend_work);
++ INIT_WORK(&hba->clk_scaling.resume_work,
++ ufshcd_clk_scaling_resume_work);
++
++ snprintf(wq_name, sizeof(wq_name), "ufs_clkscaling_%d",
++ hba->host->host_no);
++ hba->clk_scaling.workq = create_singlethread_workqueue(wq_name);
++
++ ufshcd_clkscaling_init_sysfs(hba);
++}
++
++static void ufshcd_exit_clk_scaling(struct ufs_hba *hba)
++{
++ if (!ufshcd_is_clkscaling_supported(hba))
++ return;
++
++ destroy_workqueue(hba->clk_scaling.workq);
++ ufshcd_devfreq_remove(hba);
++}
++
+ static void ufshcd_init_clk_gating(struct ufs_hba *hba)
+ {
+ char wq_name[sizeof("ufs_clk_gating_00")];
+@@ -6676,6 +6704,7 @@ out:
+ */
+ if (ret && !ufshcd_eh_in_progress(hba) && !hba->pm_op_in_progress) {
+ pm_runtime_put_sync(hba->dev);
++ ufshcd_exit_clk_scaling(hba);
+ ufshcd_hba_exit(hba);
+ }
+
+@@ -7223,12 +7252,9 @@ static void ufshcd_hba_exit(struct ufs_hba *hba)
+ ufshcd_variant_hba_exit(hba);
+ ufshcd_setup_vreg(hba, false);
+ ufshcd_suspend_clkscaling(hba);
+- if (ufshcd_is_clkscaling_supported(hba)) {
++ if (ufshcd_is_clkscaling_supported(hba))
+ if (hba->devfreq)
+ ufshcd_suspend_clkscaling(hba);
+- destroy_workqueue(hba->clk_scaling.workq);
+- ufshcd_devfreq_remove(hba);
+- }
+ ufshcd_setup_clocks(hba, false);
+ ufshcd_setup_hba_vreg(hba, false);
+ hba->is_powered = false;
+@@ -7908,6 +7934,7 @@ void ufshcd_remove(struct ufs_hba *hba)
+ ufshcd_disable_intr(hba, hba->intr_mask);
+ ufshcd_hba_stop(hba, true);
+
++ ufshcd_exit_clk_scaling(hba);
+ ufshcd_exit_clk_gating(hba);
+ if (ufshcd_is_clkscaling_supported(hba))
+ device_remove_file(hba->dev, &hba->clk_scaling.enable_attr);
+@@ -8079,6 +8106,8 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
+
+ ufshcd_init_clk_gating(hba);
+
++ ufshcd_init_clk_scaling(hba);
++
+ /*
+ * In order to avoid any spurious interrupt immediately after
+ * registering UFS controller interrupt handler, clear any pending UFS
+@@ -8117,21 +8146,6 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
+ goto out_remove_scsi_host;
+ }
+
+- if (ufshcd_is_clkscaling_supported(hba)) {
+- char wq_name[sizeof("ufs_clkscaling_00")];
+-
+- INIT_WORK(&hba->clk_scaling.suspend_work,
+- ufshcd_clk_scaling_suspend_work);
+- INIT_WORK(&hba->clk_scaling.resume_work,
+- ufshcd_clk_scaling_resume_work);
+-
+- snprintf(wq_name, sizeof(wq_name), "ufs_clkscaling_%d",
+- host->host_no);
+- hba->clk_scaling.workq = create_singlethread_workqueue(wq_name);
+-
+- ufshcd_clkscaling_init_sysfs(hba);
+- }
+-
+ /*
+ * Set the default power management level for runtime and system PM.
+ * Default power saving mode is to keep UFS link in Hibern8 state
+@@ -8169,6 +8183,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
+ out_remove_scsi_host:
+ scsi_remove_host(hba->host);
+ exit_gating:
++ ufshcd_exit_clk_scaling(hba);
+ ufshcd_exit_clk_gating(hba);
+ out_disable:
+ hba->is_irq_enabled = false;
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index f63d1b8a0933..d72f8eed2e8b 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1234,8 +1234,17 @@ static int qcom_slim_ngd_enable(struct qcom_slim_ngd_ctrl *ctrl, bool enable)
+ pm_runtime_resume(ctrl->dev);
+ pm_runtime_mark_last_busy(ctrl->dev);
+ pm_runtime_put(ctrl->dev);
++
++ ret = slim_register_controller(&ctrl->ctrl);
++ if (ret) {
++ dev_err(ctrl->dev, "error adding slim controller\n");
++ return ret;
++ }
++
++ dev_info(ctrl->dev, "SLIM controller Registered\n");
+ } else {
+ qcom_slim_qmi_exit(ctrl);
++ slim_unregister_controller(&ctrl->ctrl);
+ }
+
+ return 0;
+@@ -1346,7 +1355,6 @@ static int of_qcom_slim_ngd_register(struct device *parent,
+ ngd->base = ctrl->base + ngd->id * data->offset +
+ (ngd->id - 1) * data->size;
+ ctrl->ngd = ngd;
+- platform_driver_register(&qcom_slim_ngd_driver);
+
+ return 0;
+ }
+@@ -1361,11 +1369,6 @@ static int qcom_slim_ngd_probe(struct platform_device *pdev)
+ int ret;
+
+ ctrl->ctrl.dev = dev;
+- ret = slim_register_controller(&ctrl->ctrl);
+- if (ret) {
+- dev_err(dev, "error adding slim controller\n");
+- return ret;
+- }
+
+ pm_runtime_use_autosuspend(dev);
+ pm_runtime_set_autosuspend_delay(dev, QCOM_SLIM_NGD_AUTOSUSPEND);
+@@ -1375,7 +1378,7 @@ static int qcom_slim_ngd_probe(struct platform_device *pdev)
+ ret = qcom_slim_ngd_qmi_svc_event_init(ctrl);
+ if (ret) {
+ dev_err(&pdev->dev, "QMI service registration failed:%d", ret);
+- goto err;
++ return ret;
+ }
+
+ INIT_WORK(&ctrl->m_work, qcom_slim_ngd_master_worker);
+@@ -1387,14 +1390,12 @@ static int qcom_slim_ngd_probe(struct platform_device *pdev)
+ }
+
+ return 0;
+-err:
+- slim_unregister_controller(&ctrl->ctrl);
+ wq_err:
+ qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);
+ if (ctrl->mwq)
+ destroy_workqueue(ctrl->mwq);
+
+- return 0;
++ return ret;
+ }
+
+ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+@@ -1445,6 +1446,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ init_completion(&ctrl->reconf);
+ init_completion(&ctrl->qmi.qmi_comp);
+
++ platform_driver_register(&qcom_slim_ngd_driver);
+ return of_qcom_slim_ngd_register(dev, ctrl);
+ }
+
+@@ -1460,7 +1462,7 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+ pm_runtime_disable(&pdev->dev);
+- slim_unregister_controller(&ctrl->ctrl);
++ qcom_slim_ngd_enable(ctrl, false);
+ qcom_slim_ngd_exit_dma(ctrl);
+ qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);
+ if (ctrl->mwq)
+diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
+index b3da635970ea..d160fc2a7b7a 100644
+--- a/drivers/soc/imx/gpc.c
++++ b/drivers/soc/imx/gpc.c
+@@ -69,7 +69,7 @@ static int imx6_pm_domain_power_off(struct generic_pm_domain *genpd)
+ u32 val;
+
+ /* Read ISO and ISO2SW power down delays */
+- regmap_read(pd->regmap, pd->reg_offs + GPC_PGC_PUPSCR_OFFS, &val);
++ regmap_read(pd->regmap, pd->reg_offs + GPC_PGC_PDNSCR_OFFS, &val);
+ iso = val & 0x3f;
+ iso2sw = (val >> 8) & 0x3f;
+
+diff --git a/drivers/soc/qcom/apr.c b/drivers/soc/qcom/apr.c
+index 57af8a537332..ee9197f5aae9 100644
+--- a/drivers/soc/qcom/apr.c
++++ b/drivers/soc/qcom/apr.c
+@@ -219,9 +219,9 @@ static int apr_add_device(struct device *dev, struct device_node *np,
+ adev->domain_id = id->domain_id;
+ adev->version = id->svc_version;
+ if (np)
+- strncpy(adev->name, np->name, APR_NAME_SIZE);
++ strscpy(adev->name, np->name, APR_NAME_SIZE);
+ else
+- strncpy(adev->name, id->name, APR_NAME_SIZE);
++ strscpy(adev->name, id->name, APR_NAME_SIZE);
+
+ dev_set_name(&adev->dev, "aprsvc:%s:%x:%x", adev->name,
+ id->domain_id, id->svc_id);
+diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
+index feed3db21c10..ee89ffb6dde8 100644
+--- a/drivers/soc/qcom/qcom-geni-se.c
++++ b/drivers/soc/qcom/qcom-geni-se.c
+@@ -513,7 +513,7 @@ EXPORT_SYMBOL(geni_se_resources_on);
+ */
+ int geni_se_clk_tbl_get(struct geni_se *se, unsigned long **tbl)
+ {
+- unsigned long freq = 0;
++ long freq = 0;
+ int i;
+
+ if (se->clk_perf_tbl) {
+@@ -529,7 +529,7 @@ int geni_se_clk_tbl_get(struct geni_se *se, unsigned long **tbl)
+
+ for (i = 0; i < MAX_CLK_PERF_LEVEL; i++) {
+ freq = clk_round_rate(se->clk, freq + 1);
+- if (!freq || freq == se->clk_perf_tbl[i - 1])
++ if (freq <= 0 || freq == se->clk_perf_tbl[i - 1])
+ break;
+ se->clk_perf_tbl[i] = freq;
+ }
+@@ -544,16 +544,17 @@ EXPORT_SYMBOL(geni_se_clk_tbl_get);
+ * @se: Pointer to the concerned serial engine.
+ * @req_freq: Requested clock frequency.
+ * @index: Index of the resultant frequency in the table.
+- * @res_freq: Resultant frequency which matches or is closer to the
+- * requested frequency.
++ * @res_freq: Resultant frequency of the source clock.
+ * @exact: Flag to indicate exact multiple requirement of the requested
+ * frequency.
+ *
+- * This function is called by the protocol drivers to determine the matching
+- * or exact multiple of the requested frequency, as provided by the serial
+- * engine clock in order to meet the performance requirements. If there is
+- * no matching or exact multiple of the requested frequency found, then it
+- * selects the closest floor frequency, if exact flag is not set.
++ * This function is called by the protocol drivers to determine the best match
++ * of the requested frequency as provided by the serial engine clock in order
++ * to meet the performance requirements.
++ *
++ * If we return success:
++ * - if @exact is true then @res_freq / <an_integer> == @req_freq
++ * - if @exact is false then @res_freq / <an_integer> <= @req_freq
+ *
+ * Return: 0 on success, standard Linux error codes on failure.
+ */
+@@ -564,6 +565,9 @@ int geni_se_clk_freq_match(struct geni_se *se, unsigned long req_freq,
+ unsigned long *tbl;
+ int num_clk_levels;
+ int i;
++ unsigned long best_delta;
++ unsigned long new_delta;
++ unsigned int divider;
+
+ num_clk_levels = geni_se_clk_tbl_get(se, &tbl);
+ if (num_clk_levels < 0)
+@@ -572,18 +576,21 @@ int geni_se_clk_freq_match(struct geni_se *se, unsigned long req_freq,
+ if (num_clk_levels == 0)
+ return -EINVAL;
+
+- *res_freq = 0;
++ best_delta = ULONG_MAX;
+ for (i = 0; i < num_clk_levels; i++) {
+- if (!(tbl[i] % req_freq)) {
++ divider = DIV_ROUND_UP(tbl[i], req_freq);
++ new_delta = req_freq - tbl[i] / divider;
++ if (new_delta < best_delta) {
++ /* We have a new best! */
+ *index = i;
+ *res_freq = tbl[i];
+- return 0;
+- }
+
+- if (!(*res_freq) || ((tbl[i] > *res_freq) &&
+- (tbl[i] < req_freq))) {
+- *index = i;
+- *res_freq = tbl[i];
++ /* If the new best is exact then we're done */
++ if (new_delta == 0)
++ return 0;
++
++ /* Record how close we got */
++ best_delta = new_delta;
+ }
+ }
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index ee75da66d64b..75bd9a83aef0 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -121,6 +121,7 @@ static int tcs_invalidate(struct rsc_drv *drv, int type)
+ return -EAGAIN;
+ }
+ write_tcs_reg_sync(drv, RSC_DRV_CMD_ENABLE, m, 0);
++ write_tcs_reg_sync(drv, RSC_DRV_CMD_WAIT_FOR_CMPL, m, 0);
+ }
+ bitmap_zero(tcs->slots, MAX_TCS_SLOTS);
+ spin_unlock(&tcs->lock);
+@@ -239,6 +240,7 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
+ skip:
+ /* Reclaim the TCS */
+ write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0);
++ write_tcs_reg(drv, RSC_DRV_CMD_WAIT_FOR_CMPL, i, 0);
+ write_tcs_reg(drv, RSC_DRV_IRQ_CLEAR, 0, BIT(i));
+ spin_lock(&drv->lock);
+ clear_bit(i, drv->tcs_in_use);
+diff --git a/drivers/soc/qcom/wcnss_ctrl.c b/drivers/soc/qcom/wcnss_ctrl.c
+index df3ccb30bc2d..373400dd816d 100644
+--- a/drivers/soc/qcom/wcnss_ctrl.c
++++ b/drivers/soc/qcom/wcnss_ctrl.c
+@@ -281,7 +281,7 @@ struct rpmsg_endpoint *qcom_wcnss_open_channel(void *wcnss, const char *name, rp
+ struct rpmsg_channel_info chinfo;
+ struct wcnss_ctrl *_wcnss = wcnss;
+
+- strncpy(chinfo.name, name, sizeof(chinfo.name));
++ strscpy(chinfo.name, name, sizeof(chinfo.name));
+ chinfo.src = RPMSG_ADDR_ANY;
+ chinfo.dst = RPMSG_ADDR_ANY;
+
+diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
+index 4b452f36f054..f17a67815404 100644
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -65,6 +65,8 @@
+
+ #define PWRGATE_STATUS 0x38
+
++#define PMC_IMPL_E_33V_PWR 0x40
++
+ #define PMC_PWR_DET 0x48
+
+ #define PMC_SCRATCH0_MODE_RECOVERY BIT(31)
+@@ -154,6 +156,7 @@ struct tegra_pmc_soc {
+ bool has_tsense_reset;
+ bool has_gpu_clamps;
+ bool needs_mbist_war;
++ bool has_impl_33v_pwr;
+
+ const struct tegra_io_pad_soc *io_pads;
+ unsigned int num_io_pads;
+@@ -1067,20 +1070,31 @@ int tegra_io_pad_set_voltage(enum tegra_io_pad id,
+
+ mutex_lock(&pmc->powergates_lock);
+
+- /* write-enable PMC_PWR_DET_VALUE[pad->voltage] */
+- value = tegra_pmc_readl(PMC_PWR_DET);
+- value |= BIT(pad->voltage);
+- tegra_pmc_writel(value, PMC_PWR_DET);
++ if (pmc->soc->has_impl_33v_pwr) {
++ value = tegra_pmc_readl(PMC_IMPL_E_33V_PWR);
+
+- /* update I/O voltage */
+- value = tegra_pmc_readl(PMC_PWR_DET_VALUE);
++ if (voltage == TEGRA_IO_PAD_1800000UV)
++ value &= ~BIT(pad->voltage);
++ else
++ value |= BIT(pad->voltage);
+
+- if (voltage == TEGRA_IO_PAD_1800000UV)
+- value &= ~BIT(pad->voltage);
+- else
++ tegra_pmc_writel(value, PMC_IMPL_E_33V_PWR);
++ } else {
++ /* write-enable PMC_PWR_DET_VALUE[pad->voltage] */
++ value = tegra_pmc_readl(PMC_PWR_DET);
+ value |= BIT(pad->voltage);
++ tegra_pmc_writel(value, PMC_PWR_DET);
++
++ /* update I/O voltage */
++ value = tegra_pmc_readl(PMC_PWR_DET_VALUE);
+
+- tegra_pmc_writel(value, PMC_PWR_DET_VALUE);
++ if (voltage == TEGRA_IO_PAD_1800000UV)
++ value &= ~BIT(pad->voltage);
++ else
++ value |= BIT(pad->voltage);
++
++ tegra_pmc_writel(value, PMC_PWR_DET_VALUE);
++ }
+
+ mutex_unlock(&pmc->powergates_lock);
+
+@@ -1102,7 +1116,10 @@ int tegra_io_pad_get_voltage(enum tegra_io_pad id)
+ if (pad->voltage == UINT_MAX)
+ return -ENOTSUPP;
+
+- value = tegra_pmc_readl(PMC_PWR_DET_VALUE);
++ if (pmc->soc->has_impl_33v_pwr)
++ value = tegra_pmc_readl(PMC_IMPL_E_33V_PWR);
++ else
++ value = tegra_pmc_readl(PMC_PWR_DET_VALUE);
+
+ if ((value & BIT(pad->voltage)) == 0)
+ return TEGRA_IO_PAD_1800000UV;
+@@ -1561,6 +1578,7 @@ static const struct tegra_pmc_soc tegra30_pmc_soc = {
+ .cpu_powergates = tegra30_cpu_powergates,
+ .has_tsense_reset = true,
+ .has_gpu_clamps = false,
++ .has_impl_33v_pwr = false,
+ .num_io_pads = 0,
+ .io_pads = NULL,
+ .regs = &tegra20_pmc_regs,
+@@ -1603,6 +1621,7 @@ static const struct tegra_pmc_soc tegra114_pmc_soc = {
+ .cpu_powergates = tegra114_cpu_powergates,
+ .has_tsense_reset = true,
+ .has_gpu_clamps = false,
++ .has_impl_33v_pwr = false,
+ .num_io_pads = 0,
+ .io_pads = NULL,
+ .regs = &tegra20_pmc_regs,
+@@ -1683,6 +1702,7 @@ static const struct tegra_pmc_soc tegra124_pmc_soc = {
+ .cpu_powergates = tegra124_cpu_powergates,
+ .has_tsense_reset = true,
+ .has_gpu_clamps = true,
++ .has_impl_33v_pwr = false,
+ .num_io_pads = ARRAY_SIZE(tegra124_io_pads),
+ .io_pads = tegra124_io_pads,
+ .regs = &tegra20_pmc_regs,
+@@ -1772,6 +1792,7 @@ static const struct tegra_pmc_soc tegra210_pmc_soc = {
+ .cpu_powergates = tegra210_cpu_powergates,
+ .has_tsense_reset = true,
+ .has_gpu_clamps = true,
++ .has_impl_33v_pwr = false,
+ .needs_mbist_war = true,
+ .num_io_pads = ARRAY_SIZE(tegra210_io_pads),
+ .io_pads = tegra210_io_pads,
+@@ -1800,7 +1821,7 @@ static const struct tegra_io_pad_soc tegra186_io_pads[] = {
+ { .id = TEGRA_IO_PAD_HDMI_DP0, .dpd = 28, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_HDMI_DP1, .dpd = 29, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_PEX_CNTRL, .dpd = 32, .voltage = UINT_MAX },
+- { .id = TEGRA_IO_PAD_SDMMC2_HV, .dpd = 34, .voltage = UINT_MAX },
++ { .id = TEGRA_IO_PAD_SDMMC2_HV, .dpd = 34, .voltage = 5 },
+ { .id = TEGRA_IO_PAD_SDMMC4, .dpd = 36, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_CAM, .dpd = 38, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_DSIB, .dpd = 40, .voltage = UINT_MAX },
+@@ -1812,12 +1833,13 @@ static const struct tegra_io_pad_soc tegra186_io_pads[] = {
+ { .id = TEGRA_IO_PAD_CSIF, .dpd = 46, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_SPI, .dpd = 47, .voltage = UINT_MAX },
+ { .id = TEGRA_IO_PAD_UFS, .dpd = 49, .voltage = UINT_MAX },
+- { .id = TEGRA_IO_PAD_DMIC_HV, .dpd = 52, .voltage = UINT_MAX },
++ { .id = TEGRA_IO_PAD_DMIC_HV, .dpd = 52, .voltage = 2 },
+ { .id = TEGRA_IO_PAD_EDP, .dpd = 53, .voltage = UINT_MAX },
+- { .id = TEGRA_IO_PAD_SDMMC1_HV, .dpd = 55, .voltage = UINT_MAX },
+- { .id = TEGRA_IO_PAD_SDMMC3_HV, .dpd = 56, .voltage = UINT_MAX },
++ { .id = TEGRA_IO_PAD_SDMMC1_HV, .dpd = 55, .voltage = 4 },
++ { .id = TEGRA_IO_PAD_SDMMC3_HV, .dpd = 56, .voltage = 6 },
+ { .id = TEGRA_IO_PAD_CONN, .dpd = 60, .voltage = UINT_MAX },
+- { .id = TEGRA_IO_PAD_AUDIO_HV, .dpd = 61, .voltage = UINT_MAX },
++ { .id = TEGRA_IO_PAD_AUDIO_HV, .dpd = 61, .voltage = 1 },
++ { .id = TEGRA_IO_PAD_AO_HV, .dpd = UINT_MAX, .voltage = 0 },
+ };
+
+ static const struct tegra_pmc_regs tegra186_pmc_regs = {
+@@ -1870,6 +1892,7 @@ static const struct tegra_pmc_soc tegra186_pmc_soc = {
+ .cpu_powergates = NULL,
+ .has_tsense_reset = false,
+ .has_gpu_clamps = false,
++ .has_impl_33v_pwr = true,
+ .num_io_pads = ARRAY_SIZE(tegra186_io_pads),
+ .io_pads = tegra186_io_pads,
+ .regs = &tegra186_pmc_regs,
+diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
+index 83576810eee6..df172bf3925f 100644
+--- a/drivers/soundwire/bus.c
++++ b/drivers/soundwire/bus.c
+@@ -175,6 +175,7 @@ static inline int do_transfer_defer(struct sdw_bus *bus,
+
+ defer->msg = msg;
+ defer->length = msg->len;
++ init_completion(&defer->complete);
+
+ for (i = 0; i <= retry; i++) {
+ resp = bus->ops->xfer_msg_defer(bus, msg, defer);
+diff --git a/drivers/soundwire/intel_init.c b/drivers/soundwire/intel_init.c
+index d1ea6b4d0ad3..5c8a20d99878 100644
+--- a/drivers/soundwire/intel_init.c
++++ b/drivers/soundwire/intel_init.c
+@@ -151,7 +151,7 @@ static acpi_status sdw_intel_acpi_cb(acpi_handle handle, u32 level,
+ struct acpi_device *adev;
+
+ if (acpi_bus_get_device(handle, &adev)) {
+- dev_err(&adev->dev, "Couldn't find ACPI handle\n");
++ pr_err("%s: Couldn't find ACPI handle\n", __func__);
+ return AE_NOT_FOUND;
+ }
+
+diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
+index c23849f7aa7b..9a06ffdb73b8 100644
+--- a/drivers/spi/spi-bcm63xx-hsspi.c
++++ b/drivers/spi/spi-bcm63xx-hsspi.c
+@@ -101,6 +101,7 @@ struct bcm63xx_hsspi {
+
+ struct platform_device *pdev;
+ struct clk *clk;
++ struct clk *pll_clk;
+ void __iomem *regs;
+ u8 __iomem *fifo;
+
+@@ -332,7 +333,7 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)
+ struct resource *res_mem;
+ void __iomem *regs;
+ struct device *dev = &pdev->dev;
+- struct clk *clk;
++ struct clk *clk, *pll_clk = NULL;
+ int irq, ret;
+ u32 reg, rate, num_cs = HSSPI_SPI_MAX_CS;
+
+@@ -358,7 +359,7 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)
+
+ rate = clk_get_rate(clk);
+ if (!rate) {
+- struct clk *pll_clk = devm_clk_get(dev, "pll");
++ pll_clk = devm_clk_get(dev, "pll");
+
+ if (IS_ERR(pll_clk)) {
+ ret = PTR_ERR(pll_clk);
+@@ -373,19 +374,20 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)
+ clk_disable_unprepare(pll_clk);
+ if (!rate) {
+ ret = -EINVAL;
+- goto out_disable_clk;
++ goto out_disable_pll_clk;
+ }
+ }
+
+ master = spi_alloc_master(&pdev->dev, sizeof(*bs));
+ if (!master) {
+ ret = -ENOMEM;
+- goto out_disable_clk;
++ goto out_disable_pll_clk;
+ }
+
+ bs = spi_master_get_devdata(master);
+ bs->pdev = pdev;
+ bs->clk = clk;
++ bs->pll_clk = pll_clk;
+ bs->regs = regs;
+ bs->speed_hz = rate;
+ bs->fifo = (u8 __iomem *)(bs->regs + HSSPI_FIFO_REG(0));
+@@ -440,6 +442,8 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)
+
+ out_put_master:
+ spi_master_put(master);
++out_disable_pll_clk:
++ clk_disable_unprepare(pll_clk);
+ out_disable_clk:
+ clk_disable_unprepare(clk);
+ return ret;
+@@ -453,6 +457,7 @@ static int bcm63xx_hsspi_remove(struct platform_device *pdev)
+
+ /* reset the hardware and block queue progress */
+ __raw_writel(0, bs->regs + HSSPI_INT_MASK_REG);
++ clk_disable_unprepare(bs->pll_clk);
+ clk_disable_unprepare(bs->clk);
+
+ return 0;
+@@ -465,6 +470,7 @@ static int bcm63xx_hsspi_suspend(struct device *dev)
+ struct bcm63xx_hsspi *bs = spi_master_get_devdata(master);
+
+ spi_master_suspend(master);
++ clk_disable_unprepare(bs->pll_clk);
+ clk_disable_unprepare(bs->clk);
+
+ return 0;
+@@ -480,6 +486,12 @@ static int bcm63xx_hsspi_resume(struct device *dev)
+ if (ret)
+ return ret;
+
++ if (bs->pll_clk) {
++ ret = clk_prepare_enable(bs->pll_clk);
++ if (ret)
++ return ret;
++ }
++
+ spi_master_resume(master);
+
+ return 0;
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index 86bf45667a04..3dc31627c655 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -98,6 +98,7 @@ struct mtk_spi {
+ struct clk *parent_clk, *sel_clk, *spi_clk;
+ struct spi_transfer *cur_transfer;
+ u32 xfer_len;
++ u32 num_xfered;
+ struct scatterlist *tx_sgl, *rx_sgl;
+ u32 tx_sgl_len, rx_sgl_len;
+ const struct mtk_spi_compatible *dev_comp;
+@@ -385,6 +386,7 @@ static int mtk_spi_fifo_transfer(struct spi_master *master,
+
+ mdata->cur_transfer = xfer;
+ mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, xfer->len);
++ mdata->num_xfered = 0;
+ mtk_spi_prepare_transfer(master, xfer);
+ mtk_spi_setup_packet(master);
+
+@@ -415,6 +417,7 @@ static int mtk_spi_dma_transfer(struct spi_master *master,
+ mdata->tx_sgl_len = 0;
+ mdata->rx_sgl_len = 0;
+ mdata->cur_transfer = xfer;
++ mdata->num_xfered = 0;
+
+ mtk_spi_prepare_transfer(master, xfer);
+
+@@ -482,7 +485,7 @@ static int mtk_spi_setup(struct spi_device *spi)
+
+ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
+ {
+- u32 cmd, reg_val, cnt, remainder;
++ u32 cmd, reg_val, cnt, remainder, len;
+ struct spi_master *master = dev_id;
+ struct mtk_spi *mdata = spi_master_get_devdata(master);
+ struct spi_transfer *trans = mdata->cur_transfer;
+@@ -497,36 +500,38 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
+ if (trans->rx_buf) {
+ cnt = mdata->xfer_len / 4;
+ ioread32_rep(mdata->base + SPI_RX_DATA_REG,
+- trans->rx_buf, cnt);
++ trans->rx_buf + mdata->num_xfered, cnt);
+ remainder = mdata->xfer_len % 4;
+ if (remainder > 0) {
+ reg_val = readl(mdata->base + SPI_RX_DATA_REG);
+- memcpy(trans->rx_buf + (cnt * 4),
+- ®_val, remainder);
++ memcpy(trans->rx_buf +
++ mdata->num_xfered +
++ (cnt * 4),
++ ®_val,
++ remainder);
+ }
+ }
+
+- trans->len -= mdata->xfer_len;
+- if (!trans->len) {
++ mdata->num_xfered += mdata->xfer_len;
++ if (mdata->num_xfered == trans->len) {
+ spi_finalize_current_transfer(master);
+ return IRQ_HANDLED;
+ }
+
+- if (trans->tx_buf)
+- trans->tx_buf += mdata->xfer_len;
+- if (trans->rx_buf)
+- trans->rx_buf += mdata->xfer_len;
+-
+- mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, trans->len);
++ len = trans->len - mdata->num_xfered;
++ mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len);
+ mtk_spi_setup_packet(master);
+
+- cnt = trans->len / 4;
+- iowrite32_rep(mdata->base + SPI_TX_DATA_REG, trans->tx_buf, cnt);
++ cnt = len / 4;
++ iowrite32_rep(mdata->base + SPI_TX_DATA_REG,
++ trans->tx_buf + mdata->num_xfered, cnt);
+
+- remainder = trans->len % 4;
++ remainder = len % 4;
+ if (remainder > 0) {
+ reg_val = 0;
+- memcpy(®_val, trans->tx_buf + (cnt * 4), remainder);
++ memcpy(®_val,
++ trans->tx_buf + (cnt * 4) + mdata->num_xfered,
++ remainder);
+ writel(reg_val, mdata->base + SPI_TX_DATA_REG);
+ }
+
+diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c
+index f8a45af1fa9f..288002f6c613 100644
+--- a/drivers/spi/spi-pic32.c
++++ b/drivers/spi/spi-pic32.c
+@@ -320,7 +320,7 @@ static int pic32_spi_dma_transfer(struct pic32_spi *pic32s,
+ desc_rx = dmaengine_prep_slave_sg(master->dma_rx,
+ xfer->rx_sg.sgl,
+ xfer->rx_sg.nents,
+- DMA_FROM_DEVICE,
++ DMA_DEV_TO_MEM,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_rx) {
+ ret = -EINVAL;
+@@ -330,7 +330,7 @@ static int pic32_spi_dma_transfer(struct pic32_spi *pic32s,
+ desc_tx = dmaengine_prep_slave_sg(master->dma_tx,
+ xfer->tx_sg.sgl,
+ xfer->tx_sg.nents,
+- DMA_TO_DEVICE,
++ DMA_MEM_TO_DEV,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_tx) {
+ ret = -EINVAL;
+diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c
+index d17ce1fb4ef5..0f8fdc347091 100644
+--- a/drivers/staging/media/imx/imx-media-csi.c
++++ b/drivers/staging/media/imx/imx-media-csi.c
+@@ -166,6 +166,9 @@ static int csi_get_upstream_endpoint(struct csi_priv *priv,
+ struct v4l2_subdev *sd;
+ struct media_pad *pad;
+
++ if (!IS_ENABLED(CONFIG_OF))
++ return -ENXIO;
++
+ if (!priv->src_sd)
+ return -EPIPE;
+
+@@ -1072,7 +1075,7 @@ static int csi_link_validate(struct v4l2_subdev *sd,
+ struct v4l2_subdev_format *sink_fmt)
+ {
+ struct csi_priv *priv = v4l2_get_subdevdata(sd);
+- struct v4l2_fwnode_endpoint upstream_ep = {};
++ struct v4l2_fwnode_endpoint upstream_ep;
+ bool is_csi2;
+ int ret;
+
+diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
+index e1aafe842d66..34dce850067b 100644
+--- a/drivers/tee/optee/core.c
++++ b/drivers/tee/optee/core.c
+@@ -696,7 +696,7 @@ static int __init optee_driver_init(void)
+ return -ENODEV;
+
+ np = of_find_matching_node(fw_np, optee_match);
+- if (!np)
++ if (!np || !of_device_is_available(np))
+ return -ENODEV;
+
+ optee = optee_probe(np);
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 34acdf29713d..4c188f4079b3 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -1634,8 +1634,9 @@ static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s)
+
+ /*
+ * If something went wrong, rollback.
++ * Be careful: i may be unsigned.
+ */
+- while (err && (--i >= 0))
++ while (err && (i-- > 0))
+ if (irq[i] >= 0)
+ free_irq(irq[i], s);
+
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 5b96df4ad5b3..69b980bb8ac2 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -851,6 +851,23 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport)
+ {
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+ unsigned int rxstale = DEFAULT_BITS_PER_CHAR * STALE_TIMEOUT;
++ u32 proto;
++
++ if (uart_console(uport))
++ port->tx_bytes_pw = 1;
++ else
++ port->tx_bytes_pw = 4;
++ port->rx_bytes_pw = RX_BYTES_PW;
++
++ proto = geni_se_read_proto(&port->se);
++ if (proto != GENI_SE_UART) {
++ dev_err(uport->dev, "Invalid FW loaded, proto: %d\n", proto);
++ return -ENXIO;
++ }
++
++ qcom_geni_serial_stop_rx(uport);
++
++ get_tx_fifo_size(port);
+
+ set_rfr_wm(port);
+ writel_relaxed(rxstale, uport->membase + SE_UART_RX_STALE_CNT);
+@@ -874,30 +891,19 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport)
+ return -ENOMEM;
+ }
+ port->setup = true;
++
+ return 0;
+ }
+
+ static int qcom_geni_serial_startup(struct uart_port *uport)
+ {
+ int ret;
+- u32 proto;
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+
+ scnprintf(port->name, sizeof(port->name),
+ "qcom_serial_%s%d",
+ (uart_console(uport) ? "console" : "uart"), uport->line);
+
+- if (!uart_console(uport)) {
+- port->tx_bytes_pw = 4;
+- port->rx_bytes_pw = RX_BYTES_PW;
+- }
+- proto = geni_se_read_proto(&port->se);
+- if (proto != GENI_SE_UART) {
+- dev_err(uport->dev, "Invalid FW loaded, proto: %d\n", proto);
+- return -ENXIO;
+- }
+-
+- get_tx_fifo_size(port);
+ if (!port->setup) {
+ ret = qcom_geni_serial_port_setup(uport);
+ if (ret)
+@@ -1056,6 +1062,7 @@ static int __init qcom_geni_console_setup(struct console *co, char *options)
+ int bits = 8;
+ int parity = 'n';
+ int flow = 'n';
++ int ret;
+
+ if (co->index >= GENI_UART_CONS_PORTS || co->index < 0)
+ return -ENXIO;
+@@ -1071,21 +1078,10 @@ static int __init qcom_geni_console_setup(struct console *co, char *options)
+ if (unlikely(!uport->membase))
+ return -ENXIO;
+
+- if (geni_se_resources_on(&port->se)) {
+- dev_err(port->se.dev, "Error turning on resources\n");
+- return -ENXIO;
+- }
+-
+- if (unlikely(geni_se_read_proto(&port->se) != GENI_SE_UART)) {
+- geni_se_resources_off(&port->se);
+- return -ENXIO;
+- }
+-
+ if (!port->setup) {
+- port->tx_bytes_pw = 1;
+- port->rx_bytes_pw = RX_BYTES_PW;
+- qcom_geni_serial_stop_rx(uport);
+- qcom_geni_serial_port_setup(uport);
++ ret = qcom_geni_serial_port_setup(uport);
++ if (ret)
++ return ret;
+ }
+
+ if (options)
+@@ -1203,11 +1199,12 @@ static void qcom_geni_serial_pm(struct uart_port *uport,
+ {
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+
++ /* If we've never been called, treat it as off */
++ if (old_state == UART_PM_STATE_UNDEFINED)
++ old_state = UART_PM_STATE_OFF;
++
+ if (new_state == UART_PM_STATE_ON && old_state == UART_PM_STATE_OFF)
+ geni_se_resources_on(&port->se);
+- else if (!uart_console(uport) && (new_state == UART_PM_STATE_ON &&
+- old_state == UART_PM_STATE_UNDEFINED))
+- geni_se_resources_on(&port->se);
+ else if (new_state == UART_PM_STATE_OFF &&
+ old_state == UART_PM_STATE_ON)
+ geni_se_resources_off(&port->se);
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index c6058b52d5d5..2a49b6d876b8 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1944,7 +1944,11 @@ static int s3c24xx_serial_resume(struct device *dev)
+
+ if (port) {
+ clk_prepare_enable(ourport->clk);
++ if (!IS_ERR(ourport->baudclk))
++ clk_prepare_enable(ourport->baudclk);
+ s3c24xx_serial_resetport(port, s3c24xx_port_to_cfg(port));
++ if (!IS_ERR(ourport->baudclk))
++ clk_disable_unprepare(ourport->baudclk);
+ clk_disable_unprepare(ourport->clk);
+
+ uart_resume_port(&s3c24xx_uart_drv, port);
+@@ -1967,7 +1971,11 @@ static int s3c24xx_serial_resume_noirq(struct device *dev)
+ if (rx_enabled(port))
+ uintm &= ~S3C64XX_UINTM_RXD_MSK;
+ clk_prepare_enable(ourport->clk);
++ if (!IS_ERR(ourport->baudclk))
++ clk_prepare_enable(ourport->baudclk);
+ wr_regl(port, S3C64XX_UINTM, uintm);
++ if (!IS_ERR(ourport->baudclk))
++ clk_disable_unprepare(ourport->baudclk);
+ clk_disable_unprepare(ourport->clk);
+ }
+ }
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index 77efa0a43fe7..66d49d511885 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1279,24 +1279,11 @@ static struct uart_driver cdns_uart_uart_driver = {
+ static int cdns_uart_suspend(struct device *device)
+ {
+ struct uart_port *port = dev_get_drvdata(device);
+- struct tty_struct *tty;
+- struct device *tty_dev;
+- int may_wake = 0;
+-
+- /* Get the tty which could be NULL so don't assume it's valid */
+- tty = tty_port_tty_get(&port->state->port);
+- if (tty) {
+- tty_dev = tty->dev;
+- may_wake = device_may_wakeup(tty_dev);
+- tty_kref_put(tty);
+- }
++ int may_wake;
+
+- /*
+- * Call the API provided in serial_core.c file which handles
+- * the suspend.
+- */
+- uart_suspend_port(&cdns_uart_uart_driver, port);
+- if (!(console_suspend_enabled && !may_wake)) {
++ may_wake = device_may_wakeup(device);
++
++ if (console_suspend_enabled && may_wake) {
+ unsigned long flags = 0;
+
+ spin_lock_irqsave(&port->lock, flags);
+@@ -1311,7 +1298,11 @@ static int cdns_uart_suspend(struct device *device)
+ spin_unlock_irqrestore(&port->lock, flags);
+ }
+
+- return 0;
++ /*
++ * Call the API provided in serial_core.c file which handles
++ * the suspend.
++ */
++ return uart_suspend_port(&cdns_uart_uart_driver, port);
+ }
+
+ /**
+@@ -1325,17 +1316,9 @@ static int cdns_uart_resume(struct device *device)
+ struct uart_port *port = dev_get_drvdata(device);
+ unsigned long flags = 0;
+ u32 ctrl_reg;
+- struct tty_struct *tty;
+- struct device *tty_dev;
+- int may_wake = 0;
+-
+- /* Get the tty which could be NULL so don't assume it's valid */
+- tty = tty_port_tty_get(&port->state->port);
+- if (tty) {
+- tty_dev = tty->dev;
+- may_wake = device_may_wakeup(tty_dev);
+- tty_kref_put(tty);
+- }
++ int may_wake;
++
++ may_wake = device_may_wakeup(device);
+
+ if (console_suspend_enabled && !may_wake) {
+ struct cdns_uart *cdns_uart = port->private_data;
+diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c
+index e401be8321ab..170fa1f8f00e 100644
+--- a/drivers/uio/uio_hv_generic.c
++++ b/drivers/uio/uio_hv_generic.c
+@@ -131,11 +131,12 @@ static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj,
+ = container_of(kobj, struct vmbus_channel, kobj);
+ struct hv_device *dev = channel->primary_channel->device_obj;
+ u16 q_idx = channel->offermsg.offer.sub_channel_index;
++ void *ring_buffer = page_address(channel->ringbuffer_page);
+
+ dev_dbg(&dev->device, "mmap channel %u pages %#lx at %#lx\n",
+ q_idx, vma_pages(vma), vma->vm_pgoff);
+
+- return vm_iomap_memory(vma, virt_to_phys(channel->ringbuffer_pages),
++ return vm_iomap_memory(vma, virt_to_phys(ring_buffer),
+ channel->ringbuffer_pagecount << PAGE_SHIFT);
+ }
+
+@@ -224,7 +225,7 @@ hv_uio_probe(struct hv_device *dev,
+ /* mem resources */
+ pdata->info.mem[TXRX_RING_MAP].name = "txrx_rings";
+ pdata->info.mem[TXRX_RING_MAP].addr
+- = (uintptr_t)dev->channel->ringbuffer_pages;
++ = (uintptr_t)page_address(dev->channel->ringbuffer_page);
+ pdata->info.mem[TXRX_RING_MAP].size
+ = dev->channel->ringbuffer_pagecount << PAGE_SHIFT;
+ pdata->info.mem[TXRX_RING_MAP].memtype = UIO_MEM_LOGICAL;
+diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
+index db4ceffcf2a6..f25d4827fd49 100644
+--- a/drivers/usb/chipidea/otg.c
++++ b/drivers/usb/chipidea/otg.c
+@@ -203,14 +203,17 @@ static void ci_otg_work(struct work_struct *work)
+ }
+
+ pm_runtime_get_sync(ci->dev);
++
+ if (ci->id_event) {
+ ci->id_event = false;
+ ci_handle_id_switch(ci);
+- } else if (ci->b_sess_valid_event) {
++ }
++
++ if (ci->b_sess_valid_event) {
+ ci->b_sess_valid_event = false;
+ ci_handle_vbus_change(ci);
+- } else
+- dev_err(ci->dev, "unexpected event occurs at %s\n", __func__);
++ }
++
+ pm_runtime_put_sync(ci->dev);
+
+ enable_irq(ci->irq);
+diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
+index 34ad5bf8acd8..424ecb1f003f 100644
+--- a/drivers/usb/chipidea/usbmisc_imx.c
++++ b/drivers/usb/chipidea/usbmisc_imx.c
+@@ -343,6 +343,8 @@ static int usbmisc_imx6q_init(struct imx_usbmisc_data *data)
+ } else if (data->oc_polarity == 1) {
+ /* High active */
+ reg &= ~(MX6_BM_OVER_CUR_DIS | MX6_BM_OVER_CUR_POLARITY);
++ } else {
++ reg &= ~(MX6_BM_OVER_CUR_DIS);
+ }
+ writel(reg, usbmisc->base + data->index * 4);
+
+diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
+index 83ffa5a14c3d..e6a7c86b70f2 100644
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -342,7 +342,8 @@ exit:
+
+ }
+
+-static int usbtmc_ioctl_abort_bulk_out(struct usbtmc_device_data *data)
++static int usbtmc_ioctl_abort_bulk_out_tag(struct usbtmc_device_data *data,
++ u8 tag)
+ {
+ struct device *dev;
+ u8 *buffer;
+@@ -359,8 +360,8 @@ static int usbtmc_ioctl_abort_bulk_out(struct usbtmc_device_data *data)
+ usb_rcvctrlpipe(data->usb_dev, 0),
+ USBTMC_REQUEST_INITIATE_ABORT_BULK_OUT,
+ USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
+- data->bTag_last_write, data->bulk_out,
+- buffer, 2, USBTMC_TIMEOUT);
++ tag, data->bulk_out,
++ buffer, 2, USB_CTRL_GET_TIMEOUT);
+
+ if (rv < 0) {
+ dev_err(dev, "usb_control_msg returned %d\n", rv);
+@@ -379,12 +380,14 @@ static int usbtmc_ioctl_abort_bulk_out(struct usbtmc_device_data *data)
+ n = 0;
+
+ usbtmc_abort_bulk_out_check_status:
++ /* do not stress device with subsequent requests */
++ msleep(50);
+ rv = usb_control_msg(data->usb_dev,
+ usb_rcvctrlpipe(data->usb_dev, 0),
+ USBTMC_REQUEST_CHECK_ABORT_BULK_OUT_STATUS,
+ USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT,
+ 0, data->bulk_out, buffer, 0x08,
+- USBTMC_TIMEOUT);
++ USB_CTRL_GET_TIMEOUT);
+ n++;
+ if (rv < 0) {
+ dev_err(dev, "usb_control_msg returned %d\n", rv);
+@@ -418,6 +421,11 @@ exit:
+ return rv;
+ }
+
++static int usbtmc_ioctl_abort_bulk_out(struct usbtmc_device_data *data)
++{
++ return usbtmc_ioctl_abort_bulk_out_tag(data, data->bTag_last_write);
++}
++
+ static int usbtmc488_ioctl_read_stb(struct usbtmc_file_data *file_data,
+ void __user *arg)
+ {
+@@ -1008,6 +1016,7 @@ usbtmc_clear_check_status:
+ do {
+ dev_dbg(dev, "Reading from bulk in EP\n");
+
++ actual = 0;
+ rv = usb_bulk_msg(data->usb_dev,
+ usb_rcvbulkpipe(data->usb_dev,
+ data->bulk_in),
+diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
+index b51f0d278826..2e4c0391b583 100644
+--- a/drivers/usb/gadget/function/uvc_configfs.c
++++ b/drivers/usb/gadget/function/uvc_configfs.c
+@@ -9,6 +9,9 @@
+ *
+ * Author: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+ */
++
++#include <linux/sort.h>
++
+ #include "u_uvc.h"
+ #include "uvc_configfs.h"
+
+@@ -31,6 +34,14 @@ static struct configfs_attribute prefix##attr_##cname = { \
+ .show = prefix##cname##_show, \
+ }
+
++static int uvcg_config_compare_u32(const void *l, const void *r)
++{
++ u32 li = *(const u32 *)l;
++ u32 ri = *(const u32 *)r;
++
++ return li < ri ? -1 : li == ri ? 0 : 1;
++}
++
+ static inline struct f_uvc_opts *to_f_uvc_opts(struct config_item *item)
+ {
+ return container_of(to_config_group(item), struct f_uvc_opts,
+@@ -544,6 +555,7 @@ static int uvcg_control_class_allow_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -579,6 +591,7 @@ static void uvcg_control_class_drop_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ }
+
+@@ -764,6 +777,7 @@ static int uvcg_streaming_header_allow_link(struct config_item *src,
+ format_ptr->fmt = target_fmt;
+ list_add_tail(&format_ptr->entry, &src_hdr->formats);
+ ++src_hdr->num_fmt;
++ ++target_fmt->linked;
+
+ out:
+ mutex_unlock(&opts->lock);
+@@ -801,6 +815,8 @@ static void uvcg_streaming_header_drop_link(struct config_item *src,
+ break;
+ }
+
++ --target_fmt->linked;
++
+ out:
+ mutex_unlock(&opts->lock);
+ mutex_unlock(su_mutex);
+@@ -1129,6 +1145,8 @@ static ssize_t uvcg_frame_dw_frame_interval_store(struct config_item *item,
+ kfree(ch->dw_frame_interval);
+ ch->dw_frame_interval = frm_intrv;
+ ch->frame.b_frame_interval_type = n;
++ sort(ch->dw_frame_interval, n, sizeof(*ch->dw_frame_interval),
++ uvcg_config_compare_u32, NULL);
+ ret = len;
+
+ end:
+@@ -2038,6 +2056,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -2078,6 +2097,7 @@ static void uvcg_streaming_class_drop_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ }
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index d3567b90343a..2c9821ec836e 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -125,6 +125,21 @@ uvc_video_encode_isoc(struct usb_request *req, struct uvc_video *video,
+ * Request handling
+ */
+
++static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req)
++{
++ int ret;
++
++ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
++ if (ret < 0) {
++ printk(KERN_INFO "Failed to queue request (%d).\n", ret);
++ /* Isochronous endpoints can't be halted. */
++ if (usb_endpoint_xfer_bulk(video->ep->desc))
++ usb_ep_set_halt(video->ep);
++ }
++
++ return ret;
++}
++
+ /*
+ * I somehow feel that synchronisation won't be easy to achieve here. We have
+ * three events that control USB requests submission:
+@@ -189,14 +204,13 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
+
+ video->encode(req, video, buf);
+
+- if ((ret = usb_ep_queue(ep, req, GFP_ATOMIC)) < 0) {
+- printk(KERN_INFO "Failed to queue request (%d).\n", ret);
+- usb_ep_set_halt(ep);
+- spin_unlock_irqrestore(&video->queue.irqlock, flags);
++ ret = uvcg_video_ep_queue(video, req);
++ spin_unlock_irqrestore(&video->queue.irqlock, flags);
++
++ if (ret < 0) {
+ uvcg_queue_cancel(queue, 0);
+ goto requeue;
+ }
+- spin_unlock_irqrestore(&video->queue.irqlock, flags);
+
+ return;
+
+@@ -316,15 +330,13 @@ int uvcg_video_pump(struct uvc_video *video)
+ video->encode(req, video, buf);
+
+ /* Queue the USB request */
+- ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
++ ret = uvcg_video_ep_queue(video, req);
++ spin_unlock_irqrestore(&queue->irqlock, flags);
++
+ if (ret < 0) {
+- printk(KERN_INFO "Failed to queue request (%d)\n", ret);
+- usb_ep_set_halt(video->ep);
+- spin_unlock_irqrestore(&queue->irqlock, flags);
+ uvcg_queue_cancel(queue, 0);
+ break;
+ }
+- spin_unlock_irqrestore(&queue->irqlock, flags);
+ }
+
+ spin_lock_irqsave(&video->req_lock, flags);
+diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
+index fa33d6e5b1cb..d04fdd173ed2 100644
+--- a/drivers/usb/host/xhci-mtk-sch.c
++++ b/drivers/usb/host/xhci-mtk-sch.c
+@@ -113,7 +113,9 @@ static void setup_sch_info(struct usb_device *udev,
+ }
+
+ if (ep_type == ISOC_IN_EP || ep_type == ISOC_OUT_EP) {
+- if (esit_pkts <= sch_ep->esit)
++ if (sch_ep->esit == 1)
++ sch_ep->pkts = esit_pkts;
++ else if (esit_pkts <= sch_ep->esit)
+ sch_ep->pkts = 1;
+ else
+ sch_ep->pkts = roundup_pow_of_two(esit_pkts)
+diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
+index 48d10a61e271..860693520132 100644
+--- a/drivers/usb/mtu3/mtu3_core.c
++++ b/drivers/usb/mtu3/mtu3_core.c
+@@ -185,8 +185,8 @@ static void mtu3_intr_enable(struct mtu3 *mtu)
+
+ if (mtu->is_u3_ip) {
+ /* Enable U3 LTSSM interrupts */
+- value = HOT_RST_INTR | WARM_RST_INTR | VBUS_RISE_INTR |
+- VBUS_FALL_INTR | ENTER_U3_INTR | EXIT_U3_INTR;
++ value = HOT_RST_INTR | WARM_RST_INTR |
++ ENTER_U3_INTR | EXIT_U3_INTR;
+ mtu3_writel(mbase, U3D_LTSSM_INTR_ENABLE, value);
+ }
+
+diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
+index 5c60a8c5a0b5..bbcd3332471d 100644
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -585,6 +585,17 @@ static const struct usb_gadget_ops mtu3_gadget_ops = {
+ .udc_stop = mtu3_gadget_stop,
+ };
+
++static void mtu3_state_reset(struct mtu3 *mtu)
++{
++ mtu->address = 0;
++ mtu->ep0_state = MU3D_EP0_STATE_SETUP;
++ mtu->may_wakeup = 0;
++ mtu->u1_enable = 0;
++ mtu->u2_enable = 0;
++ mtu->delayed_status = false;
++ mtu->test_mode = false;
++}
++
+ static void init_hw_ep(struct mtu3 *mtu, struct mtu3_ep *mep,
+ u32 epnum, u32 is_in)
+ {
+@@ -702,6 +713,7 @@ void mtu3_gadget_disconnect(struct mtu3 *mtu)
+ spin_lock(&mtu->lock);
+ }
+
++ mtu3_state_reset(mtu);
+ usb_gadget_set_state(&mtu->g, USB_STATE_NOTATTACHED);
+ }
+
+@@ -712,12 +724,6 @@ void mtu3_gadget_reset(struct mtu3 *mtu)
+ /* report disconnect, if we didn't flush EP state */
+ if (mtu->g.speed != USB_SPEED_UNKNOWN)
+ mtu3_gadget_disconnect(mtu);
+-
+- mtu->address = 0;
+- mtu->ep0_state = MU3D_EP0_STATE_SETUP;
+- mtu->may_wakeup = 0;
+- mtu->u1_enable = 0;
+- mtu->u2_enable = 0;
+- mtu->delayed_status = false;
+- mtu->test_mode = false;
++ else
++ mtu3_state_reset(mtu);
+ }
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index a92c2868d902..0a6eb53e79fb 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -443,10 +443,14 @@ static int vfio_pci_get_irq_count(struct vfio_pci_device *vdev, int irq_type)
+ {
+ if (irq_type == VFIO_PCI_INTX_IRQ_INDEX) {
+ u8 pin;
++
++ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) ||
++ vdev->nointx || vdev->pdev->is_virtfn)
++ return 0;
++
+ pci_read_config_byte(vdev->pdev, PCI_INTERRUPT_PIN, &pin);
+- if (IS_ENABLED(CONFIG_VFIO_PCI_INTX) && !vdev->nointx && pin)
+- return 1;
+
++ return pin ? 1 : 0;
+ } else if (irq_type == VFIO_PCI_MSI_IRQ_INDEX) {
+ u8 pos;
+ u16 flags;
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index 115a36f6f403..423ea1f98441 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -1180,8 +1180,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos)
+ return -ENOMEM;
+
+ ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
+- if (ret)
++ if (ret) {
++ kfree(vdev->msi_perm);
+ return ret;
++ }
+
+ return len;
+ }
+@@ -1609,6 +1611,15 @@ static int vfio_ecap_init(struct vfio_pci_device *vdev)
+ return 0;
+ }
+
++/*
++ * Nag about hardware bugs, hopefully to have vendors fix them, but at least
++ * to collect a list of dependencies for the VF INTx pin quirk below.
++ */
++static const struct pci_device_id known_bogus_vf_intx_pin[] = {
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x270c) },
++ {}
++};
++
+ /*
+ * For each device we allocate a pci_config_map that indicates the
+ * capability occupying each dword and thus the struct perm_bits we
+@@ -1674,6 +1685,24 @@ int vfio_config_init(struct vfio_pci_device *vdev)
+ if (pdev->is_virtfn) {
+ *(__le16 *)&vconfig[PCI_VENDOR_ID] = cpu_to_le16(pdev->vendor);
+ *(__le16 *)&vconfig[PCI_DEVICE_ID] = cpu_to_le16(pdev->device);
++
++ /*
++ * Per SR-IOV spec rev 1.1, 3.4.1.18 the interrupt pin register
++ * does not apply to VFs and VFs must implement this register
++ * as read-only with value zero. Userspace is not readily able
++ * to identify whether a device is a VF and thus that the pin
++ * definition on the device is bogus should it violate this
++ * requirement. We already virtualize the pin register for
++ * other purposes, so we simply need to replace the bogus value
++ * and consider VFs when we determine INTx IRQ count.
++ */
++ if (vconfig[PCI_INTERRUPT_PIN] &&
++ !pci_match_id(known_bogus_vf_intx_pin, pdev))
++ pci_warn(pdev,
++ "Hardware bug: VF reports bogus INTx pin %d\n",
++ vconfig[PCI_INTERRUPT_PIN]);
++
++ vconfig[PCI_INTERRUPT_PIN] = 0; /* Gratuitous for good VFs */
+ }
+
+ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx)
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index f0f7bc5d2e4a..6f4598583f57 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -9700,6 +9700,18 @@ out_fail:
+ commit_transaction = true;
+ }
+ if (commit_transaction) {
++ /*
++ * We may have set commit_transaction when logging the new name
++ * in the destination root, in which case we left the source
++ * root context in the list of log contextes. So make sure we
++ * remove it to avoid invalid memory accesses, since the context
++ * was allocated in our stack frame.
++ */
++ if (sync_log_root) {
++ mutex_lock(&root->log_mutex);
++ list_del_init(&ctx_root.list);
++ mutex_unlock(&root->log_mutex);
++ }
+ ret = btrfs_commit_transaction(trans);
+ } else {
+ int ret2;
+@@ -9713,6 +9725,9 @@ out_notrans:
+ if (old_ino == BTRFS_FIRST_FREE_OBJECTID)
+ up_read(&fs_info->subvol_sem);
+
++ ASSERT(list_empty(&ctx_root.list));
++ ASSERT(list_empty(&ctx_dest.list));
++
+ return ret;
+ }
+
+diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
+index 8f08095ee54e..3a03f74a8cc4 100644
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -141,6 +141,7 @@ struct compat_video_event {
+ unsigned int frame_rate;
+ } u;
+ };
++#define VIDEO_GET_EVENT32 _IOR('o', 28, struct compat_video_event)
+
+ static int do_video_get_event(struct file *file,
+ unsigned int cmd, struct compat_video_event __user *up)
+@@ -152,7 +153,7 @@ static int do_video_get_event(struct file *file,
+ if (kevent == NULL)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long)kevent);
++ err = do_ioctl(file, VIDEO_GET_EVENT, (unsigned long)kevent);
+ if (!err) {
+ err = convert_in_user(&kevent->type, &up->type);
+ err |= convert_in_user(&kevent->timestamp, &up->timestamp);
+@@ -171,6 +172,7 @@ struct compat_video_still_picture {
+ compat_uptr_t iFrame;
+ int32_t size;
+ };
++#define VIDEO_STILLPICTURE32 _IOW('o', 30, struct compat_video_still_picture)
+
+ static int do_video_stillpicture(struct file *file,
+ unsigned int cmd, struct compat_video_still_picture __user *up)
+@@ -193,7 +195,7 @@ static int do_video_stillpicture(struct file *file,
+ if (err)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long) up_native);
++ err = do_ioctl(file, VIDEO_STILLPICTURE, (unsigned long) up_native);
+
+ return err;
+ }
+@@ -1302,9 +1304,9 @@ static long do_ioctl_trans(unsigned int cmd,
+ return rtc_ioctl(file, cmd, argp);
+
+ /* dvb */
+- case VIDEO_GET_EVENT:
++ case VIDEO_GET_EVENT32:
+ return do_video_get_event(file, cmd, argp);
+- case VIDEO_STILLPICTURE:
++ case VIDEO_STILLPICTURE32:
+ return do_video_stillpicture(file, cmd, argp);
+ }
+
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index 49121e5a8de2..6578a1cb4d39 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -325,9 +325,9 @@ static int ecryptfs_i_size_read(struct dentry *dentry, struct inode *inode)
+ static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
+ struct dentry *lower_dentry)
+ {
+- struct inode *inode, *lower_inode = d_inode(lower_dentry);
++ struct path *path = ecryptfs_dentry_to_lower_path(dentry->d_parent);
++ struct inode *inode, *lower_inode;
+ struct ecryptfs_dentry_info *dentry_info;
+- struct vfsmount *lower_mnt;
+ int rc = 0;
+
+ dentry_info = kmem_cache_alloc(ecryptfs_dentry_info_cache, GFP_KERNEL);
+@@ -336,16 +336,23 @@ static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
+ return ERR_PTR(-ENOMEM);
+ }
+
+- lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
+ fsstack_copy_attr_atime(d_inode(dentry->d_parent),
+- d_inode(lower_dentry->d_parent));
++ d_inode(path->dentry));
+ BUG_ON(!d_count(lower_dentry));
+
+ ecryptfs_set_dentry_private(dentry, dentry_info);
+- dentry_info->lower_path.mnt = lower_mnt;
++ dentry_info->lower_path.mnt = mntget(path->mnt);
+ dentry_info->lower_path.dentry = lower_dentry;
+
+- if (d_really_is_negative(lower_dentry)) {
++ /*
++ * negative dentry can go positive under us here - its parent is not
++ * locked. That's OK and that could happen just as we return from
++ * ecryptfs_lookup() anyway. Just need to be careful and fetch
++ * ->d_inode only once - it's not stable here.
++ */
++ lower_inode = READ_ONCE(lower_dentry->d_inode);
++
++ if (!lower_inode) {
+ /* We want to add because we couldn't find in lower */
+ d_add(dentry, NULL);
+ return NULL;
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 9511466bc785..3a2fd6676966 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -543,6 +543,8 @@ skip:
+ if (fio->in_list)
+ goto next;
+ out:
++ if (is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN))
++ __submit_merged_bio(io);
+ up_write(&io->io_rwsem);
+ }
+
+@@ -575,9 +577,6 @@ static struct bio *f2fs_grab_read_bio(struct inode *inode, block_t blkaddr,
+ ctx->bio = bio;
+ ctx->enabled_steps = post_read_steps;
+ bio->bi_private = ctx;
+-
+- /* wait the page to be moved by cleaning */
+- f2fs_wait_on_block_writeback(sbi, blkaddr);
+ }
+
+ return bio;
+@@ -592,6 +591,9 @@ static int f2fs_submit_page_read(struct inode *inode, struct page *page,
+ if (IS_ERR(bio))
+ return PTR_ERR(bio);
+
++ /* wait for GCed page writeback via META_MAPPING */
++ f2fs_wait_on_block_writeback(inode, blkaddr);
++
+ if (bio_add_page(bio, page, PAGE_SIZE, 0) < PAGE_SIZE) {
+ bio_put(bio);
+ return -EFAULT;
+@@ -887,7 +889,6 @@ static int __allocate_data_block(struct dnode_of_data *dn, int seg_type)
+ struct f2fs_summary sum;
+ struct node_info ni;
+ block_t old_blkaddr;
+- pgoff_t fofs;
+ blkcnt_t count = 1;
+ int err;
+
+@@ -916,12 +917,10 @@ alloc:
+ old_blkaddr, old_blkaddr);
+ f2fs_set_data_blkaddr(dn);
+
+- /* update i_size */
+- fofs = f2fs_start_bidx_of_node(ofs_of_node(dn->node_page), dn->inode) +
+- dn->ofs_in_node;
+- if (i_size_read(dn->inode) < ((loff_t)(fofs + 1) << PAGE_SHIFT))
+- f2fs_i_size_write(dn->inode,
+- ((loff_t)(fofs + 1) << PAGE_SHIFT));
++ /*
++ * i_size will be updated by direct_IO. Otherwise, we'll get stale
++ * data from unwritten block via dio_read.
++ */
+ return 0;
+ }
+
+@@ -1087,6 +1086,8 @@ next_block:
+ last_ofs_in_node = dn.ofs_in_node;
+ }
+ } else {
++ WARN_ON(flag != F2FS_GET_BLOCK_PRE_DIO &&
++ flag != F2FS_GET_BLOCK_DIO);
+ err = __allocate_data_block(&dn,
+ map->m_seg_type);
+ if (!err)
+@@ -1266,7 +1267,7 @@ static int get_data_block_dio(struct inode *inode, sector_t iblock,
+ struct buffer_head *bh_result, int create)
+ {
+ return __get_data_block(inode, iblock, bh_result, create,
+- F2FS_GET_BLOCK_DEFAULT, NULL,
++ F2FS_GET_BLOCK_DIO, NULL,
+ f2fs_rw_hint_to_seg_type(
+ inode->i_write_hint));
+ }
+@@ -1569,6 +1570,12 @@ submit_and_realloc:
+ }
+ }
+
++ /*
++ * If the page is under writeback, we need to wait for
++ * its completion to see the correct decrypted data.
++ */
++ f2fs_wait_on_block_writeback(inode, block_nr);
++
+ if (bio_add_page(bio, page, blocksize, 0) < blocksize)
+ goto submit_and_realloc;
+
+@@ -1637,7 +1644,7 @@ static int encrypt_one_page(struct f2fs_io_info *fio)
+ return 0;
+
+ /* wait for GCed page writeback via META_MAPPING */
+- f2fs_wait_on_block_writeback(fio->sbi, fio->old_blkaddr);
++ f2fs_wait_on_block_writeback(inode, fio->old_blkaddr);
+
+ retry_encrypt:
+ fio->encrypted_page = fscrypt_encrypt_page(inode, fio->page,
+@@ -2402,10 +2409,6 @@ repeat:
+
+ f2fs_wait_on_page_writeback(page, DATA, false);
+
+- /* wait for GCed page writeback via META_MAPPING */
+- if (f2fs_post_read_required(inode))
+- f2fs_wait_on_block_writeback(sbi, blkaddr);
+-
+ if (len == PAGE_SIZE || PageUptodate(page))
+ return 0;
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index fb216488d67a..2dc49a541907 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -600,6 +600,7 @@ enum {
+ F2FS_GET_BLOCK_DEFAULT,
+ F2FS_GET_BLOCK_FIEMAP,
+ F2FS_GET_BLOCK_BMAP,
++ F2FS_GET_BLOCK_DIO,
+ F2FS_GET_BLOCK_PRE_DIO,
+ F2FS_GET_BLOCK_PRE_AIO,
+ F2FS_GET_BLOCK_PRECACHE,
+@@ -2973,7 +2974,7 @@ void f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct page *page,
+ struct f2fs_io_info *fio, bool add_list);
+ void f2fs_wait_on_page_writeback(struct page *page,
+ enum page_type type, bool ordered);
+-void f2fs_wait_on_block_writeback(struct f2fs_sb_info *sbi, block_t blkaddr);
++void f2fs_wait_on_block_writeback(struct inode *inode, block_t blkaddr);
+ void f2fs_write_data_summaries(struct f2fs_sb_info *sbi, block_t start_blk);
+ void f2fs_write_node_summaries(struct f2fs_sb_info *sbi, block_t start_blk);
+ int f2fs_lookup_journal_in_cursum(struct f2fs_journal *journal, int type,
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 8d1eb8dec605..c7ea12299769 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -112,8 +112,7 @@ mapped:
+ f2fs_wait_on_page_writeback(page, DATA, false);
+
+ /* wait for GCed page writeback via META_MAPPING */
+- if (f2fs_post_read_required(inode))
+- f2fs_wait_on_block_writeback(sbi, dn.data_blkaddr);
++ f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
+
+ out_sem:
+ up_read(&F2FS_I(inode)->i_mmap_sem);
+@@ -2619,34 +2618,26 @@ static int f2fs_ioc_setproject(struct file *filp, __u32 projid)
+ if (projid_eq(kprojid, F2FS_I(inode)->i_projid))
+ return 0;
+
+- err = mnt_want_write_file(filp);
+- if (err)
+- return err;
+-
+ err = -EPERM;
+- inode_lock(inode);
+-
+ /* Is it quota file? Do not allow user to mess with it */
+ if (IS_NOQUOTA(inode))
+- goto out_unlock;
++ return err;
+
+ ipage = f2fs_get_node_page(sbi, inode->i_ino);
+- if (IS_ERR(ipage)) {
+- err = PTR_ERR(ipage);
+- goto out_unlock;
+- }
++ if (IS_ERR(ipage))
++ return PTR_ERR(ipage);
+
+ if (!F2FS_FITS_IN_INODE(F2FS_INODE(ipage), fi->i_extra_isize,
+ i_projid)) {
+ err = -EOVERFLOW;
+ f2fs_put_page(ipage, 1);
+- goto out_unlock;
++ return err;
+ }
+ f2fs_put_page(ipage, 1);
+
+ err = dquot_initialize(inode);
+ if (err)
+- goto out_unlock;
++ return err;
+
+ transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid));
+ if (!IS_ERR(transfer_to[PRJQUOTA])) {
+@@ -2660,9 +2651,6 @@ static int f2fs_ioc_setproject(struct file *filp, __u32 projid)
+ inode->i_ctime = current_time(inode);
+ out_dirty:
+ f2fs_mark_inode_dirty_sync(inode, true);
+-out_unlock:
+- inode_unlock(inode);
+- mnt_drop_write_file(filp);
+ return err;
+ }
+ #else
+@@ -2738,6 +2726,30 @@ static int f2fs_ioc_fsgetxattr(struct file *filp, unsigned long arg)
+ return 0;
+ }
+
++static int f2fs_ioctl_check_project(struct inode *inode, struct fsxattr *fa)
++{
++ /*
++ * Project Quota ID state is only allowed to change from within the init
++ * namespace. Enforce that restriction only if we are trying to change
++ * the quota ID state. Everything else is allowed in user namespaces.
++ */
++ if (current_user_ns() == &init_user_ns)
++ return 0;
++
++ if (__kprojid_val(F2FS_I(inode)->i_projid) != fa->fsx_projid)
++ return -EINVAL;
++
++ if (F2FS_I(inode)->i_flags & F2FS_PROJINHERIT_FL) {
++ if (!(fa->fsx_xflags & FS_XFLAG_PROJINHERIT))
++ return -EINVAL;
++ } else {
++ if (fa->fsx_xflags & FS_XFLAG_PROJINHERIT)
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ static int f2fs_ioc_fssetxattr(struct file *filp, unsigned long arg)
+ {
+ struct inode *inode = file_inode(filp);
+@@ -2765,19 +2777,20 @@ static int f2fs_ioc_fssetxattr(struct file *filp, unsigned long arg)
+ return err;
+
+ inode_lock(inode);
++ err = f2fs_ioctl_check_project(inode, &fa);
++ if (err)
++ goto out;
+ flags = (fi->i_flags & ~F2FS_FL_XFLAG_VISIBLE) |
+ (flags & F2FS_FL_XFLAG_VISIBLE);
+ err = __f2fs_ioc_setflags(inode, flags);
+- inode_unlock(inode);
+- mnt_drop_write_file(filp);
+ if (err)
+- return err;
++ goto out;
+
+ err = f2fs_ioc_setproject(filp, fa.fsx_projid);
+- if (err)
+- return err;
+-
+- return 0;
++out:
++ inode_unlock(inode);
++ mnt_drop_write_file(filp);
++ return err;
+ }
+
+ int f2fs_pin_file_control(struct inode *inode, bool inc)
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index aa8f19e1bdb3..e5d474681471 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -2367,8 +2367,9 @@ retry:
+ spin_unlock(&nm_i->nid_list_lock);
+
+ /* Let's scan nat pages and its caches to get free nids */
+- f2fs_build_free_nids(sbi, true, false);
+- goto retry;
++ if (!f2fs_build_free_nids(sbi, true, false))
++ goto retry;
++ return false;
+ }
+
+ /*
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 2c3be4c3c626..733f005b85d6 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -216,6 +216,21 @@ static void recover_inode(struct inode *inode, struct page *page)
+ char *name;
+
+ inode->i_mode = le16_to_cpu(raw->i_mode);
++ i_uid_write(inode, le32_to_cpu(raw->i_uid));
++ i_gid_write(inode, le32_to_cpu(raw->i_gid));
++
++ if (raw->i_inline & F2FS_EXTRA_ATTR) {
++ if (f2fs_sb_has_project_quota(F2FS_I_SB(inode)->sb) &&
++ F2FS_FITS_IN_INODE(raw, le16_to_cpu(raw->i_extra_isize),
++ i_projid)) {
++ projid_t i_projid;
++
++ i_projid = (projid_t)le32_to_cpu(raw->i_projid);
++ F2FS_I(inode)->i_projid =
++ make_kprojid(&init_user_ns, i_projid);
++ }
++ }
++
+ f2fs_i_size_write(inode, le64_to_cpu(raw->i_size));
+ inode->i_atime.tv_sec = le64_to_cpu(raw->i_atime);
+ inode->i_ctime.tv_sec = le64_to_cpu(raw->i_ctime);
+@@ -232,6 +247,8 @@ static void recover_inode(struct inode *inode, struct page *page)
+
+ recover_inline_flags(inode, raw);
+
++ f2fs_mark_inode_dirty_sync(inode, true);
++
+ if (file_enc_name(inode))
+ name = "<encrypted>";
+ else
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 10d5dcdb34be..d78009694f3f 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -3214,10 +3214,14 @@ void f2fs_wait_on_page_writeback(struct page *page,
+ }
+ }
+
+-void f2fs_wait_on_block_writeback(struct f2fs_sb_info *sbi, block_t blkaddr)
++void f2fs_wait_on_block_writeback(struct inode *inode, block_t blkaddr)
+ {
++ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct page *cpage;
+
++ if (!f2fs_post_read_required(inode))
++ return;
++
+ if (!is_valid_data_blkaddr(sbi, blkaddr))
+ return;
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index d9106bbe7df6..b05e10c332b7 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1336,7 +1336,8 @@ static int f2fs_show_options(struct seq_file *seq, struct dentry *root)
+ from_kgid_munged(&init_user_ns,
+ F2FS_OPTION(sbi).s_resgid));
+ if (F2FS_IO_SIZE_BITS(sbi))
+- seq_printf(seq, ",io_size=%uKB", F2FS_IO_SIZE_KB(sbi));
++ seq_printf(seq, ",io_bits=%u",
++ F2FS_OPTION(sbi).write_io_size_bits);
+ #ifdef CONFIG_F2FS_FAULT_INJECTION
+ if (test_opt(sbi, FAULT_INJECTION)) {
+ seq_printf(seq, ",fault_injection=%u",
+@@ -2516,8 +2517,12 @@ static int init_percpu_info(struct f2fs_sb_info *sbi)
+ if (err)
+ return err;
+
+- return percpu_counter_init(&sbi->total_valid_inode_count, 0,
++ err = percpu_counter_init(&sbi->total_valid_inode_count, 0,
+ GFP_KERNEL);
++ if (err)
++ percpu_counter_destroy(&sbi->alloc_valid_block_count);
++
++ return err;
+ }
+
+ #ifdef CONFIG_BLK_DEV_ZONED
+@@ -2929,7 +2934,7 @@ try_onemore:
+ GFP_KERNEL);
+ if (!sbi->write_io[i]) {
+ err = -ENOMEM;
+- goto free_options;
++ goto free_bio_info;
+ }
+
+ for (j = HOT; j < n; j++) {
+diff --git a/fs/fuse/control.c b/fs/fuse/control.c
+index 0b694655d988..acc35819aae6 100644
+--- a/fs/fuse/control.c
++++ b/fs/fuse/control.c
+@@ -107,7 +107,7 @@ static ssize_t fuse_conn_max_background_read(struct file *file,
+ if (!fc)
+ return 0;
+
+- val = fc->max_background;
++ val = READ_ONCE(fc->max_background);
+ fuse_conn_put(fc);
+
+ return fuse_conn_limit_read(file, buf, len, ppos, val);
+@@ -144,7 +144,7 @@ static ssize_t fuse_conn_congestion_threshold_read(struct file *file,
+ if (!fc)
+ return 0;
+
+- val = fc->congestion_threshold;
++ val = READ_ONCE(fc->congestion_threshold);
+ fuse_conn_put(fc);
+
+ return fuse_conn_limit_read(file, buf, len, ppos, val);
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 449d0cb45a84..63e5387c84d2 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1227,7 +1227,7 @@ static int update_rgrp_lvb(struct gfs2_rgrpd *rgd)
+ rl_flags = be32_to_cpu(rgd->rd_rgl->rl_flags);
+ rl_flags &= ~GFS2_RDF_MASK;
+ rgd->rd_flags &= GFS2_RDF_MASK;
+- rgd->rd_flags |= (rl_flags | GFS2_RDF_UPTODATE | GFS2_RDF_CHECK);
++ rgd->rd_flags |= (rl_flags | GFS2_RDF_CHECK);
+ if (rgd->rd_rgl->rl_unlinked == 0)
+ rgd->rd_flags &= ~GFS2_RDF_CHECK;
+ rgd->rd_free = be32_to_cpu(rgd->rd_rgl->rl_free);
+diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c
+index 305b220af45d..162f43b80c84 100644
+--- a/fs/kernfs/symlink.c
++++ b/fs/kernfs/symlink.c
+@@ -72,6 +72,9 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ if (base == kn)
+ break;
+
++ if ((s - path) + 3 >= PATH_MAX)
++ return -ENAMETOOLONG;
++
+ strcpy(s, "../");
+ s += 3;
+ base = base->parent;
+@@ -88,7 +91,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ if (len < 2)
+ return -EINVAL;
+ len--;
+- if ((s - path) + len > PATH_MAX)
++ if ((s - path) + len >= PATH_MAX)
+ return -ENAMETOOLONG;
+
+ /* reverse fillup of target string from target to base */
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index c495db7165ae..7af011dc9ae8 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -989,12 +989,62 @@ static struct udf_bitmap *udf_sb_alloc_bitmap(struct super_block *sb, u32 index)
+ return bitmap;
+ }
+
++static int check_partition_desc(struct super_block *sb,
++ struct partitionDesc *p,
++ struct udf_part_map *map)
++{
++ bool umap, utable, fmap, ftable;
++ struct partitionHeaderDesc *phd;
++
++ switch (le32_to_cpu(p->accessType)) {
++ case PD_ACCESS_TYPE_READ_ONLY:
++ case PD_ACCESS_TYPE_WRITE_ONCE:
++ case PD_ACCESS_TYPE_REWRITABLE:
++ case PD_ACCESS_TYPE_NONE:
++ goto force_ro;
++ }
++
++ /* No Partition Header Descriptor? */
++ if (strcmp(p->partitionContents.ident, PD_PARTITION_CONTENTS_NSR02) &&
++ strcmp(p->partitionContents.ident, PD_PARTITION_CONTENTS_NSR03))
++ goto force_ro;
++
++ phd = (struct partitionHeaderDesc *)p->partitionContentsUse;
++ utable = phd->unallocSpaceTable.extLength;
++ umap = phd->unallocSpaceBitmap.extLength;
++ ftable = phd->freedSpaceTable.extLength;
++ fmap = phd->freedSpaceBitmap.extLength;
++
++ /* No allocation info? */
++ if (!utable && !umap && !ftable && !fmap)
++ goto force_ro;
++
++ /* We don't support blocks that require erasing before overwrite */
++ if (ftable || fmap)
++ goto force_ro;
++ /* UDF 2.60: 2.3.3 - no mixing of tables & bitmaps, no VAT. */
++ if (utable && umap)
++ goto force_ro;
++
++ if (map->s_partition_type == UDF_VIRTUAL_MAP15 ||
++ map->s_partition_type == UDF_VIRTUAL_MAP20)
++ goto force_ro;
++
++ return 0;
++force_ro:
++ if (!sb_rdonly(sb))
++ return -EACCES;
++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT);
++ return 0;
++}
++
+ static int udf_fill_partdesc_info(struct super_block *sb,
+ struct partitionDesc *p, int p_index)
+ {
+ struct udf_part_map *map;
+ struct udf_sb_info *sbi = UDF_SB(sb);
+ struct partitionHeaderDesc *phd;
++ int err;
+
+ map = &sbi->s_partmaps[p_index];
+
+@@ -1014,8 +1064,16 @@ static int udf_fill_partdesc_info(struct super_block *sb,
+ p_index, map->s_partition_type,
+ map->s_partition_root, map->s_partition_len);
+
+- if (strcmp(p->partitionContents.ident, PD_PARTITION_CONTENTS_NSR02) &&
+- strcmp(p->partitionContents.ident, PD_PARTITION_CONTENTS_NSR03))
++ err = check_partition_desc(sb, p, map);
++ if (err)
++ return err;
++
++ /*
++ * Skip loading allocation info it we cannot ever write to the fs.
++ * This is a correctness thing as we may have decided to force ro mount
++ * to avoid allocation info we don't support.
++ */
++ if (UDF_QUERY_FLAG(sb, UDF_FLAG_RW_INCOMPAT))
+ return 0;
+
+ phd = (struct partitionHeaderDesc *)p->partitionContentsUse;
+@@ -1051,9 +1109,6 @@ static int udf_fill_partdesc_info(struct super_block *sb,
+ p_index, bitmap->s_extPosition);
+ }
+
+- if (phd->partitionIntegrityTable.extLength)
+- udf_debug("partitionIntegrityTable (part %d)\n", p_index);
+-
+ if (phd->freedSpaceTable.extLength) {
+ struct kernel_lb_addr loc = {
+ .logicalBlockNum = le32_to_cpu(
+diff --git a/include/crypto/chacha20.h b/include/crypto/chacha20.h
+index b83d66073db0..f76302d99e2b 100644
+--- a/include/crypto/chacha20.h
++++ b/include/crypto/chacha20.h
+@@ -13,13 +13,12 @@
+ #define CHACHA20_IV_SIZE 16
+ #define CHACHA20_KEY_SIZE 32
+ #define CHACHA20_BLOCK_SIZE 64
+-#define CHACHA20_BLOCK_WORDS (CHACHA20_BLOCK_SIZE / sizeof(u32))
+
+ struct chacha20_ctx {
+ u32 key[8];
+ };
+
+-void chacha20_block(u32 *state, u32 *stream);
++void chacha20_block(u32 *state, u8 *stream);
+ void crypto_chacha20_init(u32 *state, struct chacha20_ctx *ctx, u8 *iv);
+ int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
+ unsigned int keysize);
+diff --git a/include/linux/cpufeature.h b/include/linux/cpufeature.h
+index 986c06c88d81..84d3c81b5978 100644
+--- a/include/linux/cpufeature.h
++++ b/include/linux/cpufeature.h
+@@ -45,7 +45,7 @@
+ * 'asm/cpufeature.h' of your favorite architecture.
+ */
+ #define module_cpu_feature_match(x, __initfunc) \
+-static struct cpu_feature const cpu_feature_match_ ## x[] = \
++static struct cpu_feature const __maybe_unused cpu_feature_match_ ## x[] = \
+ { { .feature = cpu_feature(x) }, { } }; \
+ MODULE_DEVICE_TABLE(cpu, cpu_feature_match_ ## x); \
+ \
+diff --git a/include/linux/edac.h b/include/linux/edac.h
+index bffb97828ed6..958d69332c1d 100644
+--- a/include/linux/edac.h
++++ b/include/linux/edac.h
+@@ -17,6 +17,7 @@
+ #include <linux/completion.h>
+ #include <linux/workqueue.h>
+ #include <linux/debugfs.h>
++#include <linux/numa.h>
+
+ #define EDAC_DEVICE_NAME_LEN 31
+
+@@ -670,6 +671,6 @@ struct mem_ctl_info {
+ /*
+ * Maximum number of memory controllers in the coherent fabric.
+ */
+-#define EDAC_MAX_MCS 16
++#define EDAC_MAX_MCS 2 * MAX_NUMNODES
+
+ #endif
+diff --git a/include/linux/fsl_ifc.h b/include/linux/fsl_ifc.h
+index 3fdfede2f0f3..5f343b796ad9 100644
+--- a/include/linux/fsl_ifc.h
++++ b/include/linux/fsl_ifc.h
+@@ -274,6 +274,8 @@
+ */
+ /* Auto Boot Mode */
+ #define IFC_NAND_NCFGR_BOOT 0x80000000
++/* SRAM Initialization */
++#define IFC_NAND_NCFGR_SRAM_INIT_EN 0x20000000
+ /* Addressing Mode-ROW0+n/COL0 */
+ #define IFC_NAND_NCFGR_ADDR_MODE_RC0 0x00000000
+ /* Addressing Mode-ROW0+n/COL0+n */
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index bbde887ed393..c43e694fef7d 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -739,7 +739,7 @@ struct vmbus_channel {
+ u32 ringbuffer_gpadlhandle;
+
+ /* Allocated memory for ring buffer */
+- void *ringbuffer_pages;
++ struct page *ringbuffer_page;
+ u32 ringbuffer_pagecount;
+ struct hv_ring_buffer_info outbound; /* send to parent */
+ struct hv_ring_buffer_info inbound; /* receive from parent */
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index 28004d74ae04..b1b4411b4c6b 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -286,7 +286,8 @@ enum {
+ #define QI_DEV_IOTLB_SID(sid) ((u64)((sid) & 0xffff) << 32)
+ #define QI_DEV_IOTLB_QDEP(qdep) (((qdep) & 0x1f) << 16)
+ #define QI_DEV_IOTLB_ADDR(addr) ((u64)(addr) & VTD_PAGE_MASK)
+-#define QI_DEV_IOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | ((u64)(pfsid & 0xfff) << 52))
++#define QI_DEV_IOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \
++ ((u64)((pfsid >> 4) & 0xfff) << 52))
+ #define QI_DEV_IOTLB_SIZE 1
+ #define QI_DEV_IOTLB_MAX_INVS 32
+
+@@ -311,7 +312,8 @@ enum {
+ #define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32)
+ #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16)
+ #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4)
+-#define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | ((u64)(pfsid & 0xfff) << 52))
++#define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \
++ ((u64)((pfsid >> 4) & 0xfff) << 52))
+ #define QI_DEV_EIOTLB_MAX_INVS 32
+
+ #define QI_PGRP_IDX(idx) (((u64)(idx)) << 55)
+diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h
+index c6ac1fe7ec68..edb0f0c30904 100644
+--- a/include/linux/libfdt_env.h
++++ b/include/linux/libfdt_env.h
+@@ -2,6 +2,7 @@
+ #ifndef LIBFDT_ENV_H
+ #define LIBFDT_ENV_H
+
++#include <linux/kernel.h> /* For INT_MAX */
+ #include <linux/string.h>
+
+ #include <asm/byteorder.h>
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index e8b92dee5a72..ae64fced188d 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -163,10 +163,7 @@ enum mlx5_dcbx_oper_mode {
+ };
+
+ enum mlx5_dct_atomic_mode {
+- MLX5_ATOMIC_MODE_DCT_OFF = 20,
+- MLX5_ATOMIC_MODE_DCT_NONE = 0 << MLX5_ATOMIC_MODE_DCT_OFF,
+- MLX5_ATOMIC_MODE_DCT_IB_COMP = 1 << MLX5_ATOMIC_MODE_DCT_OFF,
+- MLX5_ATOMIC_MODE_DCT_CX = 2 << MLX5_ATOMIC_MODE_DCT_OFF,
++ MLX5_ATOMIC_MODE_DCT_CX = 2,
+ };
+
+ enum {
+diff --git a/include/linux/timekeeping32.h b/include/linux/timekeeping32.h
+index 8762c2f45f8b..479da36be8c8 100644
+--- a/include/linux/timekeeping32.h
++++ b/include/linux/timekeeping32.h
+@@ -6,8 +6,19 @@
+ * over time so we can remove the file here.
+ */
+
+-extern void do_gettimeofday(struct timeval *tv);
+-unsigned long get_seconds(void);
++static inline void do_gettimeofday(struct timeval *tv)
++{
++ struct timespec64 now;
++
++ ktime_get_real_ts64(&now);
++ tv->tv_sec = now.tv_sec;
++ tv->tv_usec = now.tv_nsec/1000;
++}
++
++static inline unsigned long get_seconds(void)
++{
++ return ktime_get_real_seconds();
++}
+
+ static inline struct timespec current_kernel_time(void)
+ {
+diff --git a/include/media/vsp1.h b/include/media/vsp1.h
+index 3093b9cb9067..5b383d01c84a 100644
+--- a/include/media/vsp1.h
++++ b/include/media/vsp1.h
+@@ -46,7 +46,7 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int pipe_index,
+ /**
+ * struct vsp1_du_atomic_config - VSP atomic configuration parameters
+ * @pixelformat: plane pixel format (V4L2 4CC)
+- * @pitch: line pitch in bytes, for all planes
++ * @pitch: line pitch in bytes for the first plane
+ * @mem: DMA memory address for each plane of the frame buffer
+ * @src: source rectangle in the frame buffer (integer coordinates)
+ * @dst: destination rectangle on the display (integer coordinates)
+diff --git a/include/net/llc.h b/include/net/llc.h
+index 890a87318014..df282d9b4017 100644
+--- a/include/net/llc.h
++++ b/include/net/llc.h
+@@ -66,6 +66,7 @@ struct llc_sap {
+ int sk_count;
+ struct hlist_nulls_head sk_laddr_hash[LLC_SK_LADDR_HASH_ENTRIES];
+ struct hlist_head sk_dev_hash[LLC_SK_DEV_HASH_ENTRIES];
++ struct rcu_head rcu;
+ };
+
+ static inline
+diff --git a/include/soc/tegra/pmc.h b/include/soc/tegra/pmc.h
+index c32bf91c23e6..445aa66514e9 100644
+--- a/include/soc/tegra/pmc.h
++++ b/include/soc/tegra/pmc.h
+@@ -134,6 +134,7 @@ enum tegra_io_pad {
+ TEGRA_IO_PAD_USB2,
+ TEGRA_IO_PAD_USB3,
+ TEGRA_IO_PAD_USB_BIAS,
++ TEGRA_IO_PAD_AO_HV,
+ };
+
+ /* deprecated, use TEGRA_IO_PAD_{HDMI,LVDS} instead */
+diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
+index 5e1a7578c9ed..9a4bdfadab07 100644
+--- a/include/trace/events/sched.h
++++ b/include/trace/events/sched.h
+@@ -169,9 +169,14 @@ TRACE_EVENT(sched_switch,
+
+ (__entry->prev_state & (TASK_REPORT_MAX - 1)) ?
+ __print_flags(__entry->prev_state & (TASK_REPORT_MAX - 1), "|",
+- { 0x01, "S" }, { 0x02, "D" }, { 0x04, "T" },
+- { 0x08, "t" }, { 0x10, "X" }, { 0x20, "Z" },
+- { 0x40, "P" }, { 0x80, "I" }) :
++ { TASK_INTERRUPTIBLE, "S" },
++ { TASK_UNINTERRUPTIBLE, "D" },
++ { __TASK_STOPPED, "T" },
++ { __TASK_TRACED, "t" },
++ { EXIT_DEAD, "X" },
++ { EXIT_ZOMBIE, "Z" },
++ { TASK_PARKED, "P" },
++ { TASK_DEAD, "I" }) :
+ "R",
+
+ __entry->prev_state & TASK_REPORT_MAX ? "+" : "",
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 578d4ac54484..c173e4131df8 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1858,7 +1858,7 @@ static void handle_trampoline(struct pt_regs *regs)
+
+ sigill:
+ uprobe_warn(current, "handle uretprobe, sending SIGILL.");
+- force_sig_info(SIGILL, SEND_SIG_FORCED, current);
++ force_sig(SIGILL, current);
+
+ }
+
+@@ -1974,7 +1974,7 @@ static void handle_singlestep(struct uprobe_task *utask, struct pt_regs *regs)
+
+ if (unlikely(err)) {
+ uprobe_warn(current, "execute the probed insn, sending SIGILL.");
+- force_sig_info(SIGILL, SEND_SIG_FORCED, current);
++ force_sig(SIGILL, current);
+ }
+ }
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index b8efca9dc2cb..aed90788db5c 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -544,8 +544,14 @@ static void do_free_cleaned_kprobes(void)
+ struct optimized_kprobe *op, *tmp;
+
+ list_for_each_entry_safe(op, tmp, &freeing_list, list) {
+- BUG_ON(!kprobe_unused(&op->kp));
+ list_del_init(&op->list);
++ if (WARN_ON_ONCE(!kprobe_unused(&op->kp))) {
++ /*
++ * This must not happen, but if there is a kprobe
++ * still in use, keep it on kprobes hash list.
++ */
++ continue;
++ }
+ free_aggr_kprobe(&op->kp);
+ }
+ }
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 62058fd6dcf6..94bec97bd5e2 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -1389,7 +1389,7 @@ static const_debug __maybe_unused unsigned int sysctl_sched_features =
+ 0;
+ #undef SCHED_FEAT
+
+-#define sched_feat(x) (sysctl_sched_features & (1UL << __SCHED_FEAT_##x))
++#define sched_feat(x) !!(sysctl_sched_features & (1UL << __SCHED_FEAT_##x))
+
+ #endif /* SCHED_DEBUG && CONFIG_JUMP_LABEL */
+
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 0e6bc3049427..7278302e3485 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -78,6 +78,10 @@ static bool sig_task_ignored(struct task_struct *t, int sig, bool force)
+
+ handler = sig_handler(t, sig);
+
++ /* SIGKILL and SIGSTOP may not be sent to the global init */
++ if (unlikely(is_global_init(t) && sig_kernel_only(sig)))
++ return true;
++
+ if (unlikely(t->signal->flags & SIGNAL_UNKILLABLE) &&
+ handler == SIG_DFL && !(force && sig_kernel_only(sig)))
+ return true;
+diff --git a/kernel/time/time.c b/kernel/time/time.c
+index be057d6579f1..f7d4fa5ddb9e 100644
+--- a/kernel/time/time.c
++++ b/kernel/time/time.c
+@@ -144,9 +144,11 @@ SYSCALL_DEFINE2(gettimeofday, struct timeval __user *, tv,
+ struct timezone __user *, tz)
+ {
+ if (likely(tv != NULL)) {
+- struct timeval ktv;
+- do_gettimeofday(&ktv);
+- if (copy_to_user(tv, &ktv, sizeof(ktv)))
++ struct timespec64 ts;
++
++ ktime_get_real_ts64(&ts);
++ if (put_user(ts.tv_sec, &tv->tv_sec) ||
++ put_user(ts.tv_nsec / 1000, &tv->tv_usec))
+ return -EFAULT;
+ }
+ if (unlikely(tz != NULL)) {
+@@ -227,10 +229,11 @@ COMPAT_SYSCALL_DEFINE2(gettimeofday, struct compat_timeval __user *, tv,
+ struct timezone __user *, tz)
+ {
+ if (tv) {
+- struct timeval ktv;
++ struct timespec64 ts;
+
+- do_gettimeofday(&ktv);
+- if (compat_put_timeval(&ktv, tv))
++ ktime_get_real_ts64(&ts);
++ if (put_user(ts.tv_sec, &tv->tv_sec) ||
++ put_user(ts.tv_nsec / 1000, &tv->tv_usec))
+ return -EFAULT;
+ }
+ if (tz) {
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index c2708e1f0c69..81ee5b83c920 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1214,22 +1214,6 @@ int get_device_system_crosststamp(int (*get_time_fn)
+ }
+ EXPORT_SYMBOL_GPL(get_device_system_crosststamp);
+
+-/**
+- * do_gettimeofday - Returns the time of day in a timeval
+- * @tv: pointer to the timeval to be set
+- *
+- * NOTE: Users should be converted to using getnstimeofday()
+- */
+-void do_gettimeofday(struct timeval *tv)
+-{
+- struct timespec64 now;
+-
+- getnstimeofday64(&now);
+- tv->tv_sec = now.tv_sec;
+- tv->tv_usec = now.tv_nsec/1000;
+-}
+-EXPORT_SYMBOL(do_gettimeofday);
+-
+ /**
+ * do_settimeofday64 - Sets the time of day.
+ * @ts: pointer to the timespec64 variable containing the new time
+@@ -2177,14 +2161,6 @@ void getboottime64(struct timespec64 *ts)
+ }
+ EXPORT_SYMBOL_GPL(getboottime64);
+
+-unsigned long get_seconds(void)
+-{
+- struct timekeeper *tk = &tk_core.timekeeper;
+-
+- return tk->xtime_sec;
+-}
+-EXPORT_SYMBOL(get_seconds);
+-
+ void ktime_get_coarse_real_ts64(struct timespec64 *ts)
+ {
+ struct timekeeper *tk = &tk_core.timekeeper;
+diff --git a/lib/chacha20.c b/lib/chacha20.c
+index c1cc50fb68c9..d907fec6a9ed 100644
+--- a/lib/chacha20.c
++++ b/lib/chacha20.c
+@@ -16,9 +16,9 @@
+ #include <asm/unaligned.h>
+ #include <crypto/chacha20.h>
+
+-void chacha20_block(u32 *state, u32 *stream)
++void chacha20_block(u32 *state, u8 *stream)
+ {
+- u32 x[16], *out = stream;
++ u32 x[16];
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(x); i++)
+@@ -67,7 +67,7 @@ void chacha20_block(u32 *state, u32 *stream)
+ }
+
+ for (i = 0; i < ARRAY_SIZE(x); i++)
+- out[i] = cpu_to_le32(x[i] + state[i]);
++ put_unaligned_le32(x[i] + state[i], &stream[i * sizeof(u32)]);
+
+ state[12]++;
+ }
+diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
+index 68c2f2f3c05b..7a93e1e439dd 100644
+--- a/mm/hugetlb_cgroup.c
++++ b/mm/hugetlb_cgroup.c
+@@ -196,7 +196,7 @@ int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages,
+ again:
+ rcu_read_lock();
+ h_cg = hugetlb_cgroup_from_task(current);
+- if (!css_tryget_online(&h_cg->css)) {
++ if (!css_tryget(&h_cg->css)) {
+ rcu_read_unlock();
+ goto again;
+ }
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index e0f7b94a4e9b..5af38d8a9afd 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -851,7 +851,7 @@ struct mem_cgroup *get_mem_cgroup_from_mm(struct mm_struct *mm)
+ if (unlikely(!memcg))
+ memcg = root_mem_cgroup;
+ }
+- } while (!css_tryget_online(&memcg->css));
++ } while (!css_tryget(&memcg->css));
+ rcu_read_unlock();
+ return memcg;
+ }
+diff --git a/mm/memfd.c b/mm/memfd.c
+index 5859705dafe1..9e68a4320a0e 100644
+--- a/mm/memfd.c
++++ b/mm/memfd.c
+@@ -41,7 +41,7 @@ static void memfd_tag_pins(struct address_space *mapping)
+
+ xa_lock_irq(&mapping->i_pages);
+ radix_tree_for_each_slot(slot, &mapping->i_pages, &iter, start) {
+- page = radix_tree_deref_slot(slot);
++ page = radix_tree_deref_slot_protected(slot, &mapping->i_pages.xa_lock);
+ if (!page || radix_tree_exception(page)) {
+ if (radix_tree_deref_retry(page)) {
+ slot = radix_tree_iter_retry(&iter);
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 70298b635b59..a4a1cab16c0f 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -666,7 +666,9 @@ static int queue_pages_test_walk(unsigned long start, unsigned long end,
+ * 1 - there is unmovable page, but MPOL_MF_MOVE* & MPOL_MF_STRICT were
+ * specified.
+ * 0 - queue pages successfully or no misplaced page.
+- * -EIO - there is misplaced page and only MPOL_MF_STRICT was specified.
++ * errno - i.e. misplaced pages with MPOL_MF_STRICT specified (-EIO) or
++ * memory range specified by nodemask and maxnode points outside
++ * your accessible address space (-EFAULT)
+ */
+ static int
+ queue_pages_range(struct mm_struct *mm, unsigned long start, unsigned long end,
+@@ -1273,7 +1275,7 @@ static long do_mbind(unsigned long start, unsigned long len,
+ flags | MPOL_MF_INVERT, &pagelist);
+
+ if (ret < 0) {
+- err = -EIO;
++ err = ret;
+ goto up_out;
+ }
+
+@@ -1292,10 +1294,12 @@ static long do_mbind(unsigned long start, unsigned long len,
+
+ if ((ret > 0) || (nr_failed && (flags & MPOL_MF_STRICT)))
+ err = -EIO;
+- } else
+- putback_movable_pages(&pagelist);
+-
++ } else {
+ up_out:
++ if (!list_empty(&pagelist))
++ putback_movable_pages(&pagelist);
++ }
++
+ up_write(&mm->mmap_sem);
+ mpol_out:
+ mpol_put(new);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 260ef5426e0c..974c1b8a689c 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -6819,6 +6819,16 @@ static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
+ chan->sdu_len = sdu_len;
+ chan->sdu_last_frag = skb;
+
++ /* Detect if remote is not able to use the selected MPS */
++ if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
++ u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
++
++ /* Adjust the number of credits */
++ BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
++ chan->mps = mps_len;
++ l2cap_chan_le_send_credits(chan);
++ }
++
+ return 0;
+ }
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 95768a9fca06..c0de73b12580 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -3268,13 +3268,13 @@ static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+ int idx;
+ int s_idx = cb->family;
++ int type = cb->nlh->nlmsg_type - RTM_BASE;
+
+ if (s_idx == 0)
+ s_idx = 1;
+
+ for (idx = 1; idx <= RTNL_FAMILY_MAX; idx++) {
+ struct rtnl_link **tab;
+- int type = cb->nlh->nlmsg_type-RTM_BASE;
+ struct rtnl_link *link;
+ rtnl_dumpit_func dumpit;
+
+diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
+index f21ea6125fc2..511b32ea2533 100644
+--- a/net/ipv4/gre_demux.c
++++ b/net/ipv4/gre_demux.c
+@@ -87,13 +87,14 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+
+ options = (__be32 *)(greh + 1);
+ if (greh->flags & GRE_CSUM) {
+- if (skb_checksum_simple_validate(skb)) {
++ if (!skb_checksum_simple_validate(skb)) {
++ skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
++ null_compute_pseudo);
++ } else if (csum_err) {
+ *csum_err = true;
+ return -EINVAL;
+ }
+
+- skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
+- null_compute_pseudo);
+ options++;
+ }
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 758a0f86d499..681276111310 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -232,13 +232,10 @@ static void gre_err(struct sk_buff *skb, u32 info)
+ const int type = icmp_hdr(skb)->type;
+ const int code = icmp_hdr(skb)->code;
+ struct tnl_ptk_info tpi;
+- bool csum_err = false;
+
+- if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP),
+- iph->ihl * 4) < 0) {
+- if (!csum_err) /* ignore csum errors. */
+- return;
+- }
++ if (gre_parse_header(skb, &tpi, NULL, htons(ETH_P_IP),
++ iph->ihl * 4) < 0)
++ return;
+
+ if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
+ ipv4_update_pmtu(skb, dev_net(skb->dev), info,
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index f6275aa19b6a..d235478d9ca3 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -2278,7 +2278,8 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
+ rcu_read_unlock();
+ return -ENODEV;
+ }
+- skb2 = skb_clone(skb, GFP_ATOMIC);
++
++ skb2 = skb_realloc_headroom(skb, sizeof(struct iphdr));
+ if (!skb2) {
+ read_unlock(&mrt_lock);
+ rcu_read_unlock();
+diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+index 4c7fcd32f8e6..41327bb99093 100644
+--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
++++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+@@ -104,12 +104,26 @@ static int masq_device_event(struct notifier_block *this,
+ return NOTIFY_DONE;
+ }
+
++static int inet_cmp(struct nf_conn *ct, void *ptr)
++{
++ struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
++ struct net_device *dev = ifa->ifa_dev->dev;
++ struct nf_conntrack_tuple *tuple;
++
++ if (!device_cmp(ct, (void *)(long)dev->ifindex))
++ return 0;
++
++ tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
++
++ return ifa->ifa_address == tuple->dst.u3.ip;
++}
++
+ static int masq_inet_event(struct notifier_block *this,
+ unsigned long event,
+ void *ptr)
+ {
+ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
+- struct netdev_notifier_info info;
++ struct net *net = dev_net(idev->dev);
+
+ /* The masq_dev_notifier will catch the case of the device going
+ * down. So if the inetdev is dead and being destroyed we have
+@@ -119,8 +133,10 @@ static int masq_inet_event(struct notifier_block *this,
+ if (idev->dead)
+ return NOTIFY_DONE;
+
+- netdev_notifier_info_init(&info, idev->dev);
+- return masq_device_event(this, event, &info);
++ if (event == NETDEV_DOWN)
++ nf_ct_iterate_cleanup_net(net, inet_cmp, ptr, 0, 0);
++
++ return NOTIFY_DONE;
+ }
+
+ static struct notifier_block masq_dev_notifier = {
+diff --git a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+index 37b1d413c825..0ad0da5a2600 100644
+--- a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
++++ b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+@@ -87,18 +87,30 @@ static struct notifier_block masq_dev_notifier = {
+ struct masq_dev_work {
+ struct work_struct work;
+ struct net *net;
++ struct in6_addr addr;
+ int ifindex;
+ };
+
++static int inet_cmp(struct nf_conn *ct, void *work)
++{
++ struct masq_dev_work *w = (struct masq_dev_work *)work;
++ struct nf_conntrack_tuple *tuple;
++
++ if (!device_cmp(ct, (void *)(long)w->ifindex))
++ return 0;
++
++ tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
++
++ return ipv6_addr_equal(&w->addr, &tuple->dst.u3.in6);
++}
++
+ static void iterate_cleanup_work(struct work_struct *work)
+ {
+ struct masq_dev_work *w;
+- long index;
+
+ w = container_of(work, struct masq_dev_work, work);
+
+- index = w->ifindex;
+- nf_ct_iterate_cleanup_net(w->net, device_cmp, (void *)index, 0, 0);
++ nf_ct_iterate_cleanup_net(w->net, inet_cmp, (void *)w, 0, 0);
+
+ put_net(w->net);
+ kfree(w);
+@@ -147,6 +159,7 @@ static int masq_inet6_event(struct notifier_block *this,
+ INIT_WORK(&w->work, iterate_cleanup_work);
+ w->ifindex = dev->ifindex;
+ w->net = net;
++ w->addr = ifa->addr;
+ schedule_work(&w->work);
+
+ return NOTIFY_DONE;
+diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
+index 260b3dc1b4a2..64d4bef04e73 100644
+--- a/net/llc/llc_core.c
++++ b/net/llc/llc_core.c
+@@ -127,9 +127,7 @@ void llc_sap_close(struct llc_sap *sap)
+ list_del_rcu(&sap->node);
+ spin_unlock_bh(&llc_sap_list_lock);
+
+- synchronize_rcu();
+-
+- kfree(sap);
++ kfree_rcu(sap, rcu);
+ }
+
+ static struct packet_type llc_packet_type __read_mostly = {
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 5c9dcafbc342..b0667467337d 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3255,19 +3255,16 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
+ }
+
+ if (bss_conf->he_support) {
+- u32 he_oper_params =
+- le32_to_cpu(elems.he_operation->he_oper_params);
++ bss_conf->bss_color =
++ le32_get_bits(elems.he_operation->he_oper_params,
++ IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
+
+- bss_conf->bss_color = he_oper_params &
+- IEEE80211_HE_OPERATION_BSS_COLOR_MASK;
+ bss_conf->htc_trig_based_pkt_ext =
+- (he_oper_params &
+- IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK) <<
+- IEEE80211_HE_OPERATION_DFLT_PE_DURATION_OFFSET;
++ le32_get_bits(elems.he_operation->he_oper_params,
++ IEEE80211_HE_OPERATION_DFLT_PE_DURATION_MASK);
+ bss_conf->frame_time_rts_th =
+- (he_oper_params &
+- IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK) <<
+- IEEE80211_HE_OPERATION_RTS_THRESHOLD_OFFSET;
++ le32_get_bits(elems.he_operation->he_oper_params,
++ IEEE80211_HE_OPERATION_RTS_THRESHOLD_MASK);
+
+ bss_conf->multi_sta_back_32bit =
+ sta->sta.he_cap.he_cap_elem.mac_cap_info[2] &
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 24fddf032279..289d079008ee 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1031,7 +1031,8 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
+
+ static void nf_tables_table_destroy(struct nft_ctx *ctx)
+ {
+- BUG_ON(ctx->table->use > 0);
++ if (WARN_ON(ctx->table->use > 0))
++ return;
+
+ rhltable_destroy(&ctx->table->chains_ht);
+ kfree(ctx->table->name);
+@@ -1446,7 +1447,8 @@ static void nf_tables_chain_destroy(struct nft_ctx *ctx)
+ {
+ struct nft_chain *chain = ctx->chain;
+
+- BUG_ON(chain->use > 0);
++ if (WARN_ON(chain->use > 0))
++ return;
+
+ /* no concurrent access possible anymore */
+ nf_tables_chain_free_chain_rules(chain);
+@@ -7253,7 +7255,8 @@ int __nft_release_basechain(struct nft_ctx *ctx)
+ {
+ struct nft_rule *rule, *nr;
+
+- BUG_ON(!nft_is_base_chain(ctx->chain));
++ if (WARN_ON(!nft_is_base_chain(ctx->chain)))
++ return 0;
+
+ nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
+ list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
+diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
+index fa90a8402845..79d48c1d06f4 100644
+--- a/net/netfilter/nft_cmp.c
++++ b/net/netfilter/nft_cmp.c
+@@ -79,7 +79,8 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+
+ err = nft_data_init(NULL, &priv->data, sizeof(priv->data), &desc,
+ tb[NFTA_CMP_DATA]);
+- BUG_ON(err < 0);
++ if (err < 0)
++ return err;
+
+ priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
+ err = nft_validate_register_load(priv->sreg, desc.len);
+@@ -129,7 +130,8 @@ static int nft_cmp_fast_init(const struct nft_ctx *ctx,
+
+ err = nft_data_init(NULL, &data, sizeof(data), &desc,
+ tb[NFTA_CMP_DATA]);
+- BUG_ON(err < 0);
++ if (err < 0)
++ return err;
+
+ priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
+ err = nft_validate_register_load(priv->sreg, desc.len);
+diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
+index 29f5bd2377b0..b48e58cceeb7 100644
+--- a/net/netfilter/nft_reject.c
++++ b/net/netfilter/nft_reject.c
+@@ -94,7 +94,8 @@ static u8 icmp_code_v4[NFT_REJECT_ICMPX_MAX + 1] = {
+
+ int nft_reject_icmp_code(u8 code)
+ {
+- BUG_ON(code > NFT_REJECT_ICMPX_MAX);
++ if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX))
++ return ICMP_NET_UNREACH;
+
+ return icmp_code_v4[code];
+ }
+@@ -111,7 +112,8 @@ static u8 icmp_code_v6[NFT_REJECT_ICMPX_MAX + 1] = {
+
+ int nft_reject_icmpv6_code(u8 code)
+ {
+- BUG_ON(code > NFT_REJECT_ICMPX_MAX);
++ if (WARN_ON_ONCE(code > NFT_REJECT_ICMPX_MAX))
++ return ICMPV6_NOROUTE;
+
+ return icmp_code_v6[code];
+ }
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index cccbf845079c..64841238df85 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -847,22 +847,36 @@ static bool valid_regdb(const u8 *data, unsigned int size)
+ return true;
+ }
+
+-static void set_wmm_rule(struct ieee80211_reg_rule *rrule,
+- struct fwdb_wmm_rule *wmm)
+-{
+- struct ieee80211_wmm_rule *rule = &rrule->wmm_rule;
+- unsigned int i;
++static void set_wmm_rule(const struct fwdb_header *db,
++ const struct fwdb_country *country,
++ const struct fwdb_rule *rule,
++ struct ieee80211_reg_rule *rrule)
++{
++ struct ieee80211_wmm_rule *wmm_rule = &rrule->wmm_rule;
++ struct fwdb_wmm_rule *wmm;
++ unsigned int i, wmm_ptr;
++
++ wmm_ptr = be16_to_cpu(rule->wmm_ptr) << 2;
++ wmm = (void *)((u8 *)db + wmm_ptr);
++
++ if (!valid_wmm(wmm)) {
++ pr_err("Invalid regulatory WMM rule %u-%u in domain %c%c\n",
++ be32_to_cpu(rule->start), be32_to_cpu(rule->end),
++ country->alpha2[0], country->alpha2[1]);
++ return;
++ }
+
+ for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+- rule->client[i].cw_min =
++ wmm_rule->client[i].cw_min =
+ ecw2cw((wmm->client[i].ecw & 0xf0) >> 4);
+- rule->client[i].cw_max = ecw2cw(wmm->client[i].ecw & 0x0f);
+- rule->client[i].aifsn = wmm->client[i].aifsn;
+- rule->client[i].cot = 1000 * be16_to_cpu(wmm->client[i].cot);
+- rule->ap[i].cw_min = ecw2cw((wmm->ap[i].ecw & 0xf0) >> 4);
+- rule->ap[i].cw_max = ecw2cw(wmm->ap[i].ecw & 0x0f);
+- rule->ap[i].aifsn = wmm->ap[i].aifsn;
+- rule->ap[i].cot = 1000 * be16_to_cpu(wmm->ap[i].cot);
++ wmm_rule->client[i].cw_max = ecw2cw(wmm->client[i].ecw & 0x0f);
++ wmm_rule->client[i].aifsn = wmm->client[i].aifsn;
++ wmm_rule->client[i].cot =
++ 1000 * be16_to_cpu(wmm->client[i].cot);
++ wmm_rule->ap[i].cw_min = ecw2cw((wmm->ap[i].ecw & 0xf0) >> 4);
++ wmm_rule->ap[i].cw_max = ecw2cw(wmm->ap[i].ecw & 0x0f);
++ wmm_rule->ap[i].aifsn = wmm->ap[i].aifsn;
++ wmm_rule->ap[i].cot = 1000 * be16_to_cpu(wmm->ap[i].cot);
+ }
+
+ rrule->has_wmm = true;
+@@ -870,7 +884,7 @@ static void set_wmm_rule(struct ieee80211_reg_rule *rrule,
+
+ static int __regdb_query_wmm(const struct fwdb_header *db,
+ const struct fwdb_country *country, int freq,
+- struct ieee80211_reg_rule *rule)
++ struct ieee80211_reg_rule *rrule)
+ {
+ unsigned int ptr = be16_to_cpu(country->coll_ptr) << 2;
+ struct fwdb_collection *coll = (void *)((u8 *)db + ptr);
+@@ -879,18 +893,14 @@ static int __regdb_query_wmm(const struct fwdb_header *db,
+ for (i = 0; i < coll->n_rules; i++) {
+ __be16 *rules_ptr = (void *)((u8 *)coll + ALIGN(coll->len, 2));
+ unsigned int rule_ptr = be16_to_cpu(rules_ptr[i]) << 2;
+- struct fwdb_rule *rrule = (void *)((u8 *)db + rule_ptr);
+- struct fwdb_wmm_rule *wmm;
+- unsigned int wmm_ptr;
++ struct fwdb_rule *rule = (void *)((u8 *)db + rule_ptr);
+
+- if (rrule->len < offsetofend(struct fwdb_rule, wmm_ptr))
++ if (rule->len < offsetofend(struct fwdb_rule, wmm_ptr))
+ continue;
+
+- if (freq >= KHZ_TO_MHZ(be32_to_cpu(rrule->start)) &&
+- freq <= KHZ_TO_MHZ(be32_to_cpu(rrule->end))) {
+- wmm_ptr = be16_to_cpu(rrule->wmm_ptr) << 2;
+- wmm = (void *)((u8 *)db + wmm_ptr);
+- set_wmm_rule(rule, wmm);
++ if (freq >= KHZ_TO_MHZ(be32_to_cpu(rule->start)) &&
++ freq <= KHZ_TO_MHZ(be32_to_cpu(rule->end))) {
++ set_wmm_rule(db, country, rule, rrule);
+ return 0;
+ }
+ }
+@@ -972,12 +982,8 @@ static int regdb_query_country(const struct fwdb_header *db,
+ if (rule->len >= offsetofend(struct fwdb_rule, cac_timeout))
+ rrule->dfs_cac_ms =
+ 1000 * be16_to_cpu(rule->cac_timeout);
+- if (rule->len >= offsetofend(struct fwdb_rule, wmm_ptr)) {
+- u32 wmm_ptr = be16_to_cpu(rule->wmm_ptr) << 2;
+- struct fwdb_wmm_rule *wmm = (void *)((u8 *)db + wmm_ptr);
+-
+- set_wmm_rule(rrule, wmm);
+- }
++ if (rule->len >= offsetofend(struct fwdb_rule, wmm_ptr))
++ set_wmm_rule(db, country, rule, rrule);
+ }
+
+ return reg_schedule_apply(regdom);
+@@ -3225,8 +3231,54 @@ static void restore_regulatory_settings(bool reset_user)
+ schedule_work(®_work);
+ }
+
++static bool is_wiphy_all_set_reg_flag(enum ieee80211_regulatory_flags flag)
++{
++ struct cfg80211_registered_device *rdev;
++ struct wireless_dev *wdev;
++
++ list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
++ list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
++ wdev_lock(wdev);
++ if (!(wdev->wiphy->regulatory_flags & flag)) {
++ wdev_unlock(wdev);
++ return false;
++ }
++ wdev_unlock(wdev);
++ }
++ }
++
++ return true;
++}
++
+ void regulatory_hint_disconnect(void)
+ {
++ /* Restore of regulatory settings is not required when wiphy(s)
++ * ignore IE from connected access point but clearance of beacon hints
++ * is required when wiphy(s) supports beacon hints.
++ */
++ if (is_wiphy_all_set_reg_flag(REGULATORY_COUNTRY_IE_IGNORE)) {
++ struct reg_beacon *reg_beacon, *btmp;
++
++ if (is_wiphy_all_set_reg_flag(REGULATORY_DISABLE_BEACON_HINTS))
++ return;
++
++ spin_lock_bh(®_pending_beacons_lock);
++ list_for_each_entry_safe(reg_beacon, btmp,
++ ®_pending_beacons, list) {
++ list_del(®_beacon->list);
++ kfree(reg_beacon);
++ }
++ spin_unlock_bh(®_pending_beacons_lock);
++
++ list_for_each_entry_safe(reg_beacon, btmp,
++ ®_beacon_list, list) {
++ list_del(®_beacon->list);
++ kfree(reg_beacon);
++ }
++
++ return;
++ }
++
+ pr_debug("All devices are disconnected, going to restore regulatory settings\n");
+ restore_regulatory_settings(false);
+ }
+diff --git a/samples/bpf/sockex2_kern.c b/samples/bpf/sockex2_kern.c
+index f58acfc92556..f2f9dbc021b0 100644
+--- a/samples/bpf/sockex2_kern.c
++++ b/samples/bpf/sockex2_kern.c
+@@ -14,7 +14,7 @@ struct vlan_hdr {
+ __be16 h_vlan_encapsulated_proto;
+ };
+
+-struct bpf_flow_keys {
++struct flow_key_record {
+ __be32 src;
+ __be32 dst;
+ union {
+@@ -59,7 +59,7 @@ static inline __u32 ipv6_addr_hash(struct __sk_buff *ctx, __u64 off)
+ }
+
+ static inline __u64 parse_ip(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
+- struct bpf_flow_keys *flow)
++ struct flow_key_record *flow)
+ {
+ __u64 verlen;
+
+@@ -83,7 +83,7 @@ static inline __u64 parse_ip(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto
+ }
+
+ static inline __u64 parse_ipv6(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
+- struct bpf_flow_keys *flow)
++ struct flow_key_record *flow)
+ {
+ *ip_proto = load_byte(skb,
+ nhoff + offsetof(struct ipv6hdr, nexthdr));
+@@ -96,7 +96,8 @@ static inline __u64 parse_ipv6(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_pro
+ return nhoff;
+ }
+
+-static inline bool flow_dissector(struct __sk_buff *skb, struct bpf_flow_keys *flow)
++static inline bool flow_dissector(struct __sk_buff *skb,
++ struct flow_key_record *flow)
+ {
+ __u64 nhoff = ETH_HLEN;
+ __u64 ip_proto;
+@@ -198,7 +199,7 @@ struct bpf_map_def SEC("maps") hash_map = {
+ SEC("socket2")
+ int bpf_prog2(struct __sk_buff *skb)
+ {
+- struct bpf_flow_keys flow = {};
++ struct flow_key_record flow = {};
+ struct pair *value;
+ u32 key;
+
+diff --git a/samples/bpf/sockex3_kern.c b/samples/bpf/sockex3_kern.c
+index 95907f8d2b17..c527b57d3ec8 100644
+--- a/samples/bpf/sockex3_kern.c
++++ b/samples/bpf/sockex3_kern.c
+@@ -61,7 +61,7 @@ struct vlan_hdr {
+ __be16 h_vlan_encapsulated_proto;
+ };
+
+-struct bpf_flow_keys {
++struct flow_key_record {
+ __be32 src;
+ __be32 dst;
+ union {
+@@ -88,7 +88,7 @@ static inline __u32 ipv6_addr_hash(struct __sk_buff *ctx, __u64 off)
+ }
+
+ struct globals {
+- struct bpf_flow_keys flow;
++ struct flow_key_record flow;
+ };
+
+ struct bpf_map_def SEC("maps") percpu_map = {
+@@ -114,14 +114,14 @@ struct pair {
+
+ struct bpf_map_def SEC("maps") hash_map = {
+ .type = BPF_MAP_TYPE_HASH,
+- .key_size = sizeof(struct bpf_flow_keys),
++ .key_size = sizeof(struct flow_key_record),
+ .value_size = sizeof(struct pair),
+ .max_entries = 1024,
+ };
+
+ static void update_stats(struct __sk_buff *skb, struct globals *g)
+ {
+- struct bpf_flow_keys key = g->flow;
++ struct flow_key_record key = g->flow;
+ struct pair *value;
+
+ value = bpf_map_lookup_elem(&hash_map, &key);
+diff --git a/samples/bpf/sockex3_user.c b/samples/bpf/sockex3_user.c
+index 5ba3ae9d180b..9d02e0404719 100644
+--- a/samples/bpf/sockex3_user.c
++++ b/samples/bpf/sockex3_user.c
+@@ -13,7 +13,7 @@
+ #define PARSE_IP_PROG_FD (prog_fd[0])
+ #define PROG_ARRAY_FD (map_fd[0])
+
+-struct bpf_flow_keys {
++struct flow_key_record {
+ __be32 src;
+ __be32 dst;
+ union {
+@@ -64,7 +64,7 @@ int main(int argc, char **argv)
+ (void) f;
+
+ for (i = 0; i < 5; i++) {
+- struct bpf_flow_keys key = {}, next_key;
++ struct flow_key_record key = {}, next_key;
+ struct pair value;
+
+ sleep(1);
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index 71571d992159..31cb2acf8afc 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->next) {
+ if (plugin->dst_frames)
+ frames = plugin->dst_frames(plugin, frames);
+- if (snd_BUG_ON(frames <= 0))
++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
+ return -ENXIO;
+ plugin = plugin->next;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->prev) {
+ if (plugin->src_frames)
+ frames = plugin->src_frames(plugin, frames);
+- if (snd_BUG_ON(frames <= 0))
++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
+ return -ENXIO;
+ plugin = plugin->prev;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+diff --git a/sound/core/seq/seq_system.c b/sound/core/seq/seq_system.c
+index 8ce1d0b40dce..ce1f1e4727ab 100644
+--- a/sound/core/seq/seq_system.c
++++ b/sound/core/seq/seq_system.c
+@@ -123,6 +123,7 @@ int __init snd_seq_system_client_init(void)
+ {
+ struct snd_seq_port_callback pcallbacks;
+ struct snd_seq_port_info *port;
++ int err;
+
+ port = kzalloc(sizeof(*port), GFP_KERNEL);
+ if (!port)
+@@ -144,7 +145,10 @@ int __init snd_seq_system_client_init(void)
+ port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT;
+ port->addr.client = sysclient;
+ port->addr.port = SNDRV_SEQ_PORT_SYSTEM_TIMER;
+- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port);
++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT,
++ port);
++ if (err < 0)
++ goto error_port;
+
+ /* register announcement port */
+ strcpy(port->name, "Announce");
+@@ -154,16 +158,24 @@ int __init snd_seq_system_client_init(void)
+ port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT;
+ port->addr.client = sysclient;
+ port->addr.port = SNDRV_SEQ_PORT_SYSTEM_ANNOUNCE;
+- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port);
++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT,
++ port);
++ if (err < 0)
++ goto error_port;
+ announce_port = port->addr.port;
+
+ kfree(port);
+ return 0;
++
++ error_port:
++ snd_seq_system_client_done();
++ kfree(port);
++ return err;
+ }
+
+
+ /* unregister our internal client */
+-void __exit snd_seq_system_client_done(void)
++void snd_seq_system_client_done(void)
+ {
+ int oldsysclient = sysclient;
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 3e978b75be9a..f2cabfdced05 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -31,6 +31,7 @@
+ #include <linux/types.h>
+ #include <linux/io.h>
+ #include <linux/pci.h>
++#include <asm/io.h>
+ #include <sound/core.h>
+ #include "hda_codec.h"
+ #include "hda_local.h"
+diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c
+index 943a726b1c1b..c84629190cba 100644
+--- a/sound/pci/intel8x0m.c
++++ b/sound/pci/intel8x0m.c
+@@ -1171,16 +1171,6 @@ static int snd_intel8x0m_create(struct snd_card *card,
+ }
+
+ port_inited:
+- if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED,
+- KBUILD_MODNAME, chip)) {
+- dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq);
+- snd_intel8x0m_free(chip);
+- return -EBUSY;
+- }
+- chip->irq = pci->irq;
+- pci_set_master(pci);
+- synchronize_irq(chip->irq);
+-
+ /* initialize offsets */
+ chip->bdbars_count = 2;
+ tbl = intel_regs;
+@@ -1224,11 +1214,21 @@ static int snd_intel8x0m_create(struct snd_card *card,
+ chip->int_sta_reg = ICH_REG_GLOB_STA;
+ chip->int_sta_mask = int_sta_masks;
+
++ pci_set_master(pci);
++
+ if ((err = snd_intel8x0m_chip_init(chip, 1)) < 0) {
+ snd_intel8x0m_free(chip);
+ return err;
+ }
+
++ if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED,
++ KBUILD_MODNAME, chip)) {
++ dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq);
++ snd_intel8x0m_free(chip);
++ return -EBUSY;
++ }
++ chip->irq = pci->irq;
++
+ if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) {
+ snd_intel8x0m_free(chip);
+ return err;
+diff --git a/sound/soc/amd/acp-da7219-max98357a.c b/sound/soc/amd/acp-da7219-max98357a.c
+index 8e3275a96a82..e53b54d77692 100644
+--- a/sound/soc/amd/acp-da7219-max98357a.c
++++ b/sound/soc/amd/acp-da7219-max98357a.c
+@@ -42,7 +42,7 @@
+ #include "../codecs/da7219.h"
+ #include "../codecs/da7219-aad.h"
+
+-#define CZ_PLAT_CLK 25000000
++#define CZ_PLAT_CLK 48000000
+ #define DUAL_CHANNEL 2
+
+ static struct snd_soc_jack cz_jack;
+diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
+index 098196610542..be2473166bfa 100644
+--- a/sound/soc/codecs/hdac_hdmi.c
++++ b/sound/soc/codecs/hdac_hdmi.c
+@@ -1410,6 +1410,12 @@ static int hdac_hdmi_create_dais(struct hdac_device *hdev,
+ if (ret)
+ return ret;
+
++ /* Filter out 44.1, 88.2 and 176.4Khz */
++ rates &= ~(SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_88200 |
++ SNDRV_PCM_RATE_176400);
++ if (!rates)
++ return -EINVAL;
++
+ sprintf(dai_name, "intel-hdmi-hifi%d", i+1);
+ hdmi_dais[i].name = devm_kstrdup(&hdev->dev,
+ dai_name, GFP_KERNEL);
+diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
+index 21e7c430baf7..7a78bb00f874 100644
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -68,6 +68,7 @@ struct rt5682_priv {
+
+ static const struct reg_sequence patch_list[] = {
+ {0x01c1, 0x1000},
++ {RT5682_DAC_ADC_DIG_VOL1, 0xa020},
+ };
+
+ static const struct reg_default rt5682_reg[] = {
+@@ -1457,6 +1458,8 @@ static int rt5682_hp_event(struct snd_soc_dapm_widget *w,
+ RT5682_NG2_EN_MASK, RT5682_NG2_EN);
+ snd_soc_component_update_bits(component,
+ RT5682_DEPOP_1, 0x60, 0x60);
++ snd_soc_component_update_bits(component,
++ RT5682_DAC_ADC_DIG_VOL1, 0x00c0, 0x0080);
+ break;
+
+ case SND_SOC_DAPM_POST_PMD:
+@@ -1464,6 +1467,8 @@ static int rt5682_hp_event(struct snd_soc_dapm_widget *w,
+ RT5682_DEPOP_1, 0x60, 0x0);
+ snd_soc_component_write(component,
+ RT5682_HP_CTRL_2, 0x0000);
++ snd_soc_component_update_bits(component,
++ RT5682_DAC_ADC_DIG_VOL1, 0x00c0, 0x0000);
+ break;
+
+ default:
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 64a52d495b1f..896412d11a31 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1387,7 +1387,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_component *component)
+ * Searching for a suitable index solving this formula:
+ * idx = 40 * log10(vag_val / lo_cagcntrl) + 15
+ */
+- vol_quot = (vag * 100) / lo_vag;
++ vol_quot = lo_vag ? (vag * 100) / lo_vag : 0;
+ lo_vol = 0;
+ for (i = 0; i < ARRAY_SIZE(vol_quot_table); i++) {
+ if (vol_quot >= vol_quot_table[i])
+diff --git a/sound/soc/meson/axg-fifo.c b/sound/soc/meson/axg-fifo.c
+index 30262550e37b..0e4f65e654c4 100644
+--- a/sound/soc/meson/axg-fifo.c
++++ b/sound/soc/meson/axg-fifo.c
+@@ -203,6 +203,8 @@ static int axg_fifo_pcm_open(struct snd_pcm_substream *ss)
+
+ ret = request_irq(fifo->irq, axg_fifo_pcm_irq_block, 0,
+ dev_name(dev), ss);
++ if (ret)
++ return ret;
+
+ /* Enable pclk to access registers and clock the fifo ip */
+ ret = clk_prepare_enable(fifo->pclk);
+diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
+index 8f7a0abfa751..f64c7058b258 100644
+--- a/sound/soc/sh/rcar/rsnd.h
++++ b/sound/soc/sh/rcar/rsnd.h
+@@ -438,6 +438,7 @@ struct rsnd_dai_stream {
+ char name[RSND_DAI_NAME_SIZE];
+ struct snd_pcm_substream *substream;
+ struct rsnd_mod *mod[RSND_MOD_MAX];
++ struct rsnd_mod *dma;
+ struct rsnd_dai *rdai;
+ struct device *dmac_dev; /* for IPMMU */
+ u32 parent_ssi_status;
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index 9410e0a9b14b..33dc8d6ad35b 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -72,7 +72,6 @@
+
+ struct rsnd_ssi {
+ struct rsnd_mod mod;
+- struct rsnd_mod *dma;
+
+ u32 flags;
+ u32 cr_own;
+@@ -873,7 +872,6 @@ static int rsnd_ssi_dma_probe(struct rsnd_mod *mod,
+ struct rsnd_dai_stream *io,
+ struct rsnd_priv *priv)
+ {
+- struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+ int ret;
+
+ /*
+@@ -888,7 +886,7 @@ static int rsnd_ssi_dma_probe(struct rsnd_mod *mod,
+ return ret;
+
+ /* SSI probe might be called many times in MUX multi path */
+- ret = rsnd_dma_attach(io, mod, &ssi->dma);
++ ret = rsnd_dma_attach(io, mod, &io->dma);
+
+ return ret;
+ }
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 4ce57510b623..7f0b48b36380 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3514,7 +3514,7 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm,
+ break;
+ case snd_soc_dapm_pinctrl:
+ w->pinctrl = devm_pinctrl_get(dapm->dev);
+- if (IS_ERR_OR_NULL(w->pinctrl)) {
++ if (IS_ERR(w->pinctrl)) {
+ ret = PTR_ERR(w->pinctrl);
+ if (ret == -EPROBE_DEFER)
+ return ERR_PTR(ret);
+@@ -3684,7 +3684,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
+ struct snd_pcm_hw_params *params = NULL;
+ struct snd_pcm_runtime *runtime = NULL;
+ unsigned int fmt;
+- int ret;
++ int ret = 0;
+
+ if (WARN_ON(!config) ||
+ WARN_ON(list_empty(&w->edges[SND_SOC_DAPM_DIR_OUT]) ||
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 6566c8831a96..551bfc581fc1 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1683,7 +1683,7 @@ static void dpcm_init_runtime_hw(struct snd_pcm_runtime *runtime,
+ struct snd_soc_pcm_stream *stream)
+ {
+ runtime->hw.rate_min = stream->rate_min;
+- runtime->hw.rate_max = stream->rate_max;
++ runtime->hw.rate_max = min_not_zero(stream->rate_max, UINT_MAX);
+ runtime->hw.channels_min = stream->channels_min;
+ runtime->hw.channels_max = stream->channels_max;
+ if (runtime->hw.formats)
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index d86be8bfe412..aeb74cc6ceff 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -401,6 +401,9 @@ static void snd_complete_urb(struct urb *urb)
+ }
+
+ prepare_outbound_urb(ep, ctx);
++ /* can be stopped during prepare callback */
++ if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags)))
++ goto exit_clear;
+ } else {
+ retire_inbound_urb(ep, ctx);
+ /* can be stopped during retire callback */
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index bb67131e6437..726cbd63a0c7 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1244,7 +1244,8 @@ static int get_min_max_with_quirks(struct usb_mixer_elem_info *cval,
+ if (cval->min + cval->res < cval->max) {
+ int last_valid_res = cval->res;
+ int saved, test, check;
+- get_cur_mix_raw(cval, minchn, &saved);
++ if (get_cur_mix_raw(cval, minchn, &saved) < 0)
++ goto no_res_check;
+ for (;;) {
+ test = saved;
+ if (test < cval->max)
+@@ -1264,6 +1265,7 @@ static int get_min_max_with_quirks(struct usb_mixer_elem_info *cval,
+ snd_usb_set_cur_mix_value(cval, minchn, 0, saved);
+ }
+
++no_res_check:
+ cval->initialized = 1;
+ }
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index ea253c97b8b9..052b4ada2d05 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -259,8 +259,8 @@ static int create_yamaha_midi_quirk(struct snd_usb_audio *chip,
+ NULL, USB_MS_MIDI_OUT_JACK);
+ if (!injd && !outjd)
+ return -ENODEV;
+- if (!(injd && snd_usb_validate_midi_desc(injd)) ||
+- !(outjd && snd_usb_validate_midi_desc(outjd)))
++ if ((injd && !snd_usb_validate_midi_desc(injd)) ||
++ (outjd && !snd_usb_validate_midi_desc(outjd)))
+ return -ENODEV;
+ if (injd && (injd->bLength < 5 ||
+ (injd->bJackType != USB_MS_EMBEDDED &&
+diff --git a/sound/usb/validate.c b/sound/usb/validate.c
+index a5e584b60dcd..389e8657434a 100644
+--- a/sound/usb/validate.c
++++ b/sound/usb/validate.c
+@@ -81,9 +81,9 @@ static bool validate_processing_unit(const void *p,
+ switch (v->protocol) {
+ case UAC_VERSION_1:
+ default:
+- /* bNrChannels, wChannelConfig, iChannelNames, bControlSize */
+- len += 1 + 2 + 1 + 1;
+- if (d->bLength < len) /* bControlSize */
++ /* bNrChannels, wChannelConfig, iChannelNames */
++ len += 1 + 2 + 1;
++ if (d->bLength < len + 1) /* bControlSize */
+ return false;
+ m = hdr[len];
+ len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */
+diff --git a/tools/testing/selftests/powerpc/tm/tm-unavailable.c b/tools/testing/selftests/powerpc/tm/tm-unavailable.c
+index 156c8e750259..09894f4ff62e 100644
+--- a/tools/testing/selftests/powerpc/tm/tm-unavailable.c
++++ b/tools/testing/selftests/powerpc/tm/tm-unavailable.c
+@@ -236,7 +236,8 @@ void *tm_una_ping(void *input)
+ }
+
+ /* Check if we were not expecting a failure and a it occurred. */
+- if (!expecting_failure() && is_failure(cr_)) {
++ if (!expecting_failure() && is_failure(cr_) &&
++ !failure_is_reschedule()) {
+ printf("\n\tUnexpected transaction failure 0x%02lx\n\t",
+ failure_code());
+ return (void *) -1;
+@@ -244,9 +245,11 @@ void *tm_una_ping(void *input)
+
+ /*
+ * Check if TM failed due to the cause we were expecting. 0xda is a
+- * TM_CAUSE_FAC_UNAV cause, otherwise it's an unexpected cause.
++ * TM_CAUSE_FAC_UNAV cause, otherwise it's an unexpected cause, unless
++ * it was caused by a reschedule.
+ */
+- if (is_failure(cr_) && !failure_is_unavailable()) {
++ if (is_failure(cr_) && !failure_is_unavailable() &&
++ !failure_is_reschedule()) {
+ printf("\n\tUnexpected failure cause 0x%02lx\n\t",
+ failure_code());
+ return (void *) -1;
+diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
+index df4204247d45..5518b1d4ef8b 100644
+--- a/tools/testing/selftests/powerpc/tm/tm.h
++++ b/tools/testing/selftests/powerpc/tm/tm.h
+@@ -52,6 +52,15 @@ static inline bool failure_is_unavailable(void)
+ return (failure_code() & TM_CAUSE_FAC_UNAV) == TM_CAUSE_FAC_UNAV;
+ }
+
++static inline bool failure_is_reschedule(void)
++{
++ if ((failure_code() & TM_CAUSE_RESCHED) == TM_CAUSE_RESCHED ||
++ (failure_code() & TM_CAUSE_KVM_RESCHED) == TM_CAUSE_KVM_RESCHED)
++ return true;
++
++ return false;
++}
++
+ static inline bool failure_is_nesting(void)
+ {
+ return (__builtin_get_texasru() & 0x400000);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-11-24 15:44 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-11-24 15:44 UTC (permalink / raw
To: gentoo-commits
commit: c80b40d79098833e09f11405179603a350680c8f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 24 15:43:40 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Nov 24 15:43:40 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c80b40d7
Linux patch 4.19.86
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1085_linux-4.19.86.patch | 8035 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 8039 insertions(+)
diff --git a/0000_README b/0000_README
index ebd08d7..89fef48 100644
--- a/0000_README
+++ b/0000_README
@@ -379,6 +379,10 @@ Patch: 1084_linux-4.19.85.patch
From: https://www.kernel.org
Desc: Linux 4.19.85
+Patch: 1085_linux-4.19.86.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.86
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1085_linux-4.19.86.patch b/1085_linux-4.19.86.patch
new file mode 100644
index 0000000..7237a30
--- /dev/null
+++ b/1085_linux-4.19.86.patch
@@ -0,0 +1,8035 @@
+diff --git a/Makefile b/Makefile
+index d6f7c5a323c0..feb0568e9535 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 85
++SUBLEVEL = 86
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
+index 3b1baa8605a7..2214bfe7aa20 100644
+--- a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
++++ b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
+@@ -92,13 +92,13 @@
+ reg = <0x40000 0xc0000>;
+ };
+
+- bootloaderenv@0x100000 {
+- label = "bootloader env";
++ bootloaderenvred@0x100000 {
++ label = "bootloader env redundant";
+ reg = <0x100000 0x40000>;
+ };
+
+- bootloaderenvred@0x140000 {
+- label = "bootloader env redundant";
++ bootloaderenv@0x140000 {
++ label = "bootloader env";
+ reg = <0x140000 0x40000>;
+ };
+
+diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+index 4b7c762d5f22..7d554b9ab27f 100644
+--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+@@ -252,7 +252,7 @@
+
+ rootfs@800000 {
+ label = "rootfs";
+- reg = <0x800000 0x0f800000>;
++ reg = <0x800000 0x1f800000>;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/at91sam9x5cm.dtsi b/arch/arm/boot/dts/at91sam9x5cm.dtsi
+index 4908ee07e628..993eabe1cf7a 100644
+--- a/arch/arm/boot/dts/at91sam9x5cm.dtsi
++++ b/arch/arm/boot/dts/at91sam9x5cm.dtsi
+@@ -100,7 +100,7 @@
+
+ rootfs@800000 {
+ label = "rootfs";
+- reg = <0x800000 0x1f800000>;
++ reg = <0x800000 0x0f800000>;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 9136b3cf9a2c..7ce24b282d42 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -336,6 +336,7 @@
+ <0 0 0 2 &pcie1_intc 2>,
+ <0 0 0 3 &pcie1_intc 3>,
+ <0 0 0 4 &pcie1_intc 4>;
++ ti,syscon-unaligned-access = <&scm_conf1 0x14 1>;
+ status = "disabled";
+ pcie1_intc: interrupt-controller {
+ interrupt-controller;
+@@ -387,6 +388,7 @@
+ <0 0 0 2 &pcie2_intc 2>,
+ <0 0 0 3 &pcie2_intc 3>,
+ <0 0 0 4 &pcie2_intc 4>;
++ ti,syscon-unaligned-access = <&scm_conf1 0x14 2>;
+ pcie2_intc: interrupt-controller {
+ interrupt-controller;
+ #address-cells = <0>;
+diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi
+index 8b8db9d8e912..61a06f6add3c 100644
+--- a/arch/arm/boot/dts/omap5-board-common.dtsi
++++ b/arch/arm/boot/dts/omap5-board-common.dtsi
+@@ -703,6 +703,11 @@
+ vbus-supply = <&smps10_out1_reg>;
+ };
+
++&dwc3 {
++ extcon = <&extcon_usb3>;
++ dr_mode = "otg";
++};
++
+ &mcspi1 {
+
+ };
+diff --git a/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts b/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
+index 30540dc8e0c5..bdda0d99128e 100644
+--- a/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
++++ b/arch/arm/boot/dts/sun8i-h3-bananapi-m2-plus.dts
+@@ -140,7 +140,7 @@
+ &external_mdio {
+ ext_rgmii_phy: ethernet-phy@1 {
+ compatible = "ethernet-phy-ieee802.3-c22";
+- reg = <0>;
++ reg = <1>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/sunxi-h3-h5.dtsi b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
+index fc6131315c47..4b1530ebe427 100644
+--- a/arch/arm/boot/dts/sunxi-h3-h5.dtsi
++++ b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
+@@ -816,7 +816,7 @@
+ clock-names = "apb", "ir";
+ resets = <&r_ccu RST_APB0_IR>;
+ interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
+- reg = <0x01f02000 0x40>;
++ reg = <0x01f02000 0x400>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
+index 746565a876dc..0465d65d23de 100644
+--- a/arch/arm/kernel/entry-common.S
++++ b/arch/arm/kernel/entry-common.S
+@@ -296,16 +296,15 @@ __sys_trace:
+ cmp scno, #-1 @ skip the syscall?
+ bne 2b
+ add sp, sp, #S_OFF @ restore stack
+- b ret_slow_syscall
+
+-__sys_trace_return:
+- str r0, [sp, #S_R0 + S_OFF]! @ save returned r0
++__sys_trace_return_nosave:
++ enable_irq_notrace
+ mov r0, sp
+ bl syscall_trace_exit
+ b ret_slow_syscall
+
+-__sys_trace_return_nosave:
+- enable_irq_notrace
++__sys_trace_return:
++ str r0, [sp, #S_R0 + S_OFF]! @ save returned r0
+ mov r0, sp
+ bl syscall_trace_exit
+ b ret_slow_syscall
+diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S
+index 21ba0b29621b..4374020c824a 100644
+--- a/arch/arm64/lib/clear_user.S
++++ b/arch/arm64/lib/clear_user.S
+@@ -57,5 +57,6 @@ ENDPROC(__arch_clear_user)
+ .section .fixup,"ax"
+ .align 2
+ 9: mov x0, x2 // return the original size
++ uaccess_disable_not_uao x2, x3
+ ret
+ .previous
+diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
+index 20305d485046..96b22c0fa343 100644
+--- a/arch/arm64/lib/copy_from_user.S
++++ b/arch/arm64/lib/copy_from_user.S
+@@ -75,5 +75,6 @@ ENDPROC(__arch_copy_from_user)
+ .section .fixup,"ax"
+ .align 2
+ 9998: sub x0, end, dst // bytes not copied
++ uaccess_disable_not_uao x3, x4
+ ret
+ .previous
+diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
+index 54b75deb1d16..e56c705f1f23 100644
+--- a/arch/arm64/lib/copy_in_user.S
++++ b/arch/arm64/lib/copy_in_user.S
+@@ -77,5 +77,6 @@ ENDPROC(__arch_copy_in_user)
+ .section .fixup,"ax"
+ .align 2
+ 9998: sub x0, end, dst // bytes not copied
++ uaccess_disable_not_uao x3, x4
+ ret
+ .previous
+diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
+index fda6172d6b88..6b99b939c50f 100644
+--- a/arch/arm64/lib/copy_to_user.S
++++ b/arch/arm64/lib/copy_to_user.S
+@@ -74,5 +74,6 @@ ENDPROC(__arch_copy_to_user)
+ .section .fixup,"ax"
+ .align 2
+ 9998: sub x0, end, dst // bytes not copied
++ uaccess_disable_not_uao x3, x4
+ ret
+ .previous
+diff --git a/arch/arm64/mm/numa.c b/arch/arm64/mm/numa.c
+index 146c04ceaa51..54529b4ed513 100644
+--- a/arch/arm64/mm/numa.c
++++ b/arch/arm64/mm/numa.c
+@@ -432,7 +432,7 @@ static int __init dummy_numa_init(void)
+ if (numa_off)
+ pr_info("NUMA disabled\n"); /* Forced off on command line. */
+ pr_info("Faking a node at [mem %#018Lx-%#018Lx]\n",
+- 0LLU, PFN_PHYS(max_pfn) - 1);
++ memblock_start_of_DRAM(), memblock_end_of_DRAM() - 1);
+
+ for_each_memblock(memory, mblk) {
+ ret = numa_add_memblk(0, mblk->base, mblk->base + mblk->size);
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index 70f145e02487..7707990c4c16 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -984,10 +984,14 @@ static void register_decrementer_clockevent(int cpu)
+ *dec = decrementer_clockevent;
+ dec->cpumask = cpumask_of(cpu);
+
++ clockevents_config_and_register(dec, ppc_tb_freq, 2, decrementer_max);
++
+ printk_once(KERN_DEBUG "clockevent: %s mult[%x] shift[%d] cpu[%d]\n",
+ dec->name, dec->mult, dec->shift, cpu);
+
+- clockevents_register_device(dec);
++ /* Set values for KVM, see kvm_emulate_dec() */
++ decrementer_clockevent.mult = dec->mult;
++ decrementer_clockevent.shift = dec->shift;
+ }
+
+ static void enable_large_decrementer(void)
+@@ -1035,18 +1039,7 @@ static void __init set_decrementer_max(void)
+
+ static void __init init_decrementer_clockevent(void)
+ {
+- int cpu = smp_processor_id();
+-
+- clockevents_calc_mult_shift(&decrementer_clockevent, ppc_tb_freq, 4);
+-
+- decrementer_clockevent.max_delta_ns =
+- clockevent_delta2ns(decrementer_max, &decrementer_clockevent);
+- decrementer_clockevent.max_delta_ticks = decrementer_max;
+- decrementer_clockevent.min_delta_ns =
+- clockevent_delta2ns(2, &decrementer_clockevent);
+- decrementer_clockevent.min_delta_ticks = 2;
+-
+- register_decrementer_clockevent(cpu);
++ register_decrementer_clockevent(smp_processor_id());
+ }
+
+ void secondary_cpu_time_init(void)
+diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c
+index 281f074581a3..cc05f346e042 100644
+--- a/arch/powerpc/kvm/book3s.c
++++ b/arch/powerpc/kvm/book3s.c
+@@ -78,8 +78,11 @@ void kvmppc_unfixup_split_real(struct kvm_vcpu *vcpu)
+ {
+ if (vcpu->arch.hflags & BOOK3S_HFLAG_SPLIT_HACK) {
+ ulong pc = kvmppc_get_pc(vcpu);
++ ulong lr = kvmppc_get_lr(vcpu);
+ if ((pc & SPLIT_HACK_MASK) == SPLIT_HACK_OFFS)
+ kvmppc_set_pc(vcpu, pc & ~SPLIT_HACK_MASK);
++ if ((lr & SPLIT_HACK_MASK) == SPLIT_HACK_OFFS)
++ kvmppc_set_lr(vcpu, lr & ~SPLIT_HACK_MASK);
+ vcpu->arch.hflags &= ~BOOK3S_HFLAG_SPLIT_HACK;
+ }
+ }
+diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
+index 07a8004c3c23..65486c3d029b 100644
+--- a/arch/powerpc/kvm/book3s_64_vio.c
++++ b/arch/powerpc/kvm/book3s_64_vio.c
+@@ -401,7 +401,7 @@ static long kvmppc_tce_iommu_do_unmap(struct kvm *kvm,
+ long ret;
+
+ if (WARN_ON_ONCE(iommu_tce_xchg(tbl, entry, &hpa, &dir)))
+- return H_HARDWARE;
++ return H_TOO_HARD;
+
+ if (dir == DMA_NONE)
+ return H_SUCCESS;
+@@ -449,15 +449,15 @@ long kvmppc_tce_iommu_do_map(struct kvm *kvm, struct iommu_table *tbl,
+ return H_TOO_HARD;
+
+ if (WARN_ON_ONCE(mm_iommu_ua_to_hpa(mem, ua, tbl->it_page_shift, &hpa)))
+- return H_HARDWARE;
++ return H_TOO_HARD;
+
+ if (mm_iommu_mapped_inc(mem))
+- return H_CLOSED;
++ return H_TOO_HARD;
+
+ ret = iommu_tce_xchg(tbl, entry, &hpa, &dir);
+ if (WARN_ON_ONCE(ret)) {
+ mm_iommu_mapped_dec(mem);
+- return H_HARDWARE;
++ return H_TOO_HARD;
+ }
+
+ if (dir != DMA_NONE)
+diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
+index eb8b11515a7f..d258ed4ef77c 100644
+--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
++++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
+@@ -300,10 +300,10 @@ static long kvmppc_rm_tce_iommu_do_map(struct kvm *kvm, struct iommu_table *tbl,
+
+ if (WARN_ON_ONCE_RM(mm_iommu_ua_to_hpa_rm(mem, ua, tbl->it_page_shift,
+ &hpa)))
+- return H_HARDWARE;
++ return H_TOO_HARD;
+
+ if (WARN_ON_ONCE_RM(mm_iommu_mapped_inc(mem)))
+- return H_CLOSED;
++ return H_TOO_HARD;
+
+ ret = iommu_tce_xchg_rm(kvm->mm, tbl, entry, &hpa, &dir);
+ if (ret) {
+@@ -501,7 +501,7 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu,
+
+ rmap = (void *) vmalloc_to_phys(rmap);
+ if (WARN_ON_ONCE_RM(!rmap))
+- return H_HARDWARE;
++ return H_TOO_HARD;
+
+ /*
+ * Synchronize with the MMU notifier callbacks in
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 62be0e5732b7..796ff5de26d0 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -429,6 +429,7 @@ static inline void _tlbiel_lpid_guest(unsigned long lpid, unsigned long ric)
+ __tlbiel_lpid_guest(lpid, set, RIC_FLUSH_TLB);
+
+ asm volatile("ptesync": : :"memory");
++ asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+ }
+
+
+diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c
+index 18014cdeb590..ef6595153642 100644
+--- a/arch/powerpc/platforms/pseries/dtl.c
++++ b/arch/powerpc/platforms/pseries/dtl.c
+@@ -149,7 +149,7 @@ static int dtl_start(struct dtl *dtl)
+
+ /* Register our dtl buffer with the hypervisor. The HV expects the
+ * buffer size to be passed in the second word of the buffer */
+- ((u32 *)dtl->buf)[1] = DISPATCH_LOG_BYTES;
++ ((u32 *)dtl->buf)[1] = cpu_to_be32(DISPATCH_LOG_BYTES);
+
+ hwcpu = get_hard_smp_processor_id(dtl->cpu);
+ addr = __pa(dtl->buf);
+@@ -184,7 +184,7 @@ static void dtl_stop(struct dtl *dtl)
+
+ static u64 dtl_current_index(struct dtl *dtl)
+ {
+- return lppaca_of(dtl->cpu).dtl_idx;
++ return be64_to_cpu(lppaca_of(dtl->cpu).dtl_idx);
+ }
+ #endif /* CONFIG_VIRT_CPU_ACCOUNTING_NATIVE */
+
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index 0b24b1031221..f3af53abd40f 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -1009,12 +1009,13 @@ static void xive_ipi_eoi(struct irq_data *d)
+ {
+ struct xive_cpu *xc = __this_cpu_read(xive_cpu);
+
+- DBG_VERBOSE("IPI eoi: irq=%d [0x%lx] (HW IRQ 0x%x) pending=%02x\n",
+- d->irq, irqd_to_hwirq(d), xc->hw_ipi, xc->pending_prio);
+-
+ /* Handle possible race with unplug and drop stale IPIs */
+ if (!xc)
+ return;
++
++ DBG_VERBOSE("IPI eoi: irq=%d [0x%lx] (HW IRQ 0x%x) pending=%02x\n",
++ d->irq, irqd_to_hwirq(d), xc->hw_ipi, xc->pending_prio);
++
+ xive_do_source_eoi(xc->hw_ipi, &xc->ipi_data);
+ xive_do_queue_eoi(xc);
+ }
+diff --git a/arch/s390/boot/Makefile b/arch/s390/boot/Makefile
+index 9e6668ee93de..f6a9b0c20355 100644
+--- a/arch/s390/boot/Makefile
++++ b/arch/s390/boot/Makefile
+@@ -6,6 +6,7 @@
+ KCOV_INSTRUMENT := n
+ GCOV_PROFILE := n
+ UBSAN_SANITIZE := n
++KASAN_SANITIZE := n
+
+ KBUILD_AFLAGS := $(KBUILD_AFLAGS_DECOMPRESSOR)
+ KBUILD_CFLAGS := $(KBUILD_CFLAGS_DECOMPRESSOR)
+diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile
+index b375c6c5ae7b..9b3d821e5b46 100644
+--- a/arch/s390/boot/compressed/Makefile
++++ b/arch/s390/boot/compressed/Makefile
+@@ -8,6 +8,7 @@
+ KCOV_INSTRUMENT := n
+ GCOV_PROFILE := n
+ UBSAN_SANITIZE := n
++KASAN_SANITIZE := n
+
+ obj-y := $(if $(CONFIG_KERNEL_UNCOMPRESSED),,head.o misc.o) piggy.o
+ targets := vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2
+diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
+index b205c0ff0b22..762fc45376ff 100644
+--- a/arch/s390/kernel/Makefile
++++ b/arch/s390/kernel/Makefile
+@@ -23,6 +23,8 @@ KCOV_INSTRUMENT_early_nobss.o := n
+ UBSAN_SANITIZE_early.o := n
+ UBSAN_SANITIZE_early_nobss.o := n
+
++KASAN_SANITIZE_early_nobss.o := n
++
+ #
+ # Passing null pointers is ok for smp code, since we access the lowcore here.
+ #
+diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile
+index 04dd3e2c3bd9..e76309fbbcb3 100644
+--- a/arch/s390/kernel/vdso32/Makefile
++++ b/arch/s390/kernel/vdso32/Makefile
+@@ -28,9 +28,10 @@ obj-y += vdso32_wrapper.o
+ extra-y += vdso32.lds
+ CPPFLAGS_vdso32.lds += -P -C -U$(ARCH)
+
+-# Disable gcov profiling and ubsan for VDSO code
++# Disable gcov profiling, ubsan and kasan for VDSO code
+ GCOV_PROFILE := n
+ UBSAN_SANITIZE := n
++KASAN_SANITIZE := n
+
+ # Force dependency (incbin is bad)
+ $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so
+diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
+index ddebc26cd949..f849ac61c5da 100644
+--- a/arch/s390/kernel/vdso64/Makefile
++++ b/arch/s390/kernel/vdso64/Makefile
+@@ -28,9 +28,10 @@ obj-y += vdso64_wrapper.o
+ extra-y += vdso64.lds
+ CPPFLAGS_vdso64.lds += -P -C -U$(ARCH)
+
+-# Disable gcov profiling and ubsan for VDSO code
++# Disable gcov profiling, ubsan and kasan for VDSO code
+ GCOV_PROFILE := n
+ UBSAN_SANITIZE := n
++KASAN_SANITIZE := n
+
+ # Force dependency (incbin is bad)
+ $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so
+diff --git a/arch/s390/lib/Makefile b/arch/s390/lib/Makefile
+index 57ab40188d4b..5418d10dc2a8 100644
+--- a/arch/s390/lib/Makefile
++++ b/arch/s390/lib/Makefile
+@@ -9,5 +9,9 @@ lib-$(CONFIG_SMP) += spinlock.o
+ lib-$(CONFIG_KPROBES) += probes.o
+ lib-$(CONFIG_UPROBES) += probes.o
+
++# Instrumenting memory accesses to __user data (in different address space)
++# produce false positives
++KASAN_SANITIZE_uaccess.o := n
++
+ chkbss := mem.o
+ include $(srctree)/arch/s390/scripts/Makefile.chkbss
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 5726b264036f..af35f5caadbe 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -2771,8 +2771,7 @@ config OLPC
+
+ config OLPC_XO1_PM
+ bool "OLPC XO-1 Power Management"
+- depends on OLPC && MFD_CS5535 && PM_SLEEP
+- select MFD_CORE
++ depends on OLPC && MFD_CS5535=y && PM_SLEEP
+ ---help---
+ Add support for poweroff and suspend of the OLPC XO-1 laptop.
+
+diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h
+index f327236f0fa7..5125fca472bb 100644
+--- a/arch/x86/include/asm/kexec.h
++++ b/arch/x86/include/asm/kexec.h
+@@ -67,7 +67,7 @@ struct kimage;
+
+ /* Memory to backup during crash kdump */
+ #define KEXEC_BACKUP_SRC_START (0UL)
+-#define KEXEC_BACKUP_SRC_END (640 * 1024UL) /* 640K */
++#define KEXEC_BACKUP_SRC_END (640 * 1024UL - 1) /* 640K */
+
+ /*
+ * CPU does not save ss and sp on stack if execution is already
+diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
+index abb71ac70443..cc43c5abd187 100644
+--- a/arch/x86/kernel/cpu/intel_rdt.c
++++ b/arch/x86/kernel/cpu/intel_rdt.c
+@@ -421,7 +421,7 @@ struct rdt_domain *rdt_find_domain(struct rdt_resource *r, int id,
+ struct list_head *l;
+
+ if (id < 0)
+- return ERR_PTR(id);
++ return ERR_PTR(-ENODEV);
+
+ list_for_each(l, &r->domains) {
+ d = list_entry(l, struct rdt_domain, list);
+diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+index 627e5c809b33..968ace3c6d73 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
++++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+@@ -459,7 +459,7 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg)
+
+ r = &rdt_resources_all[resid];
+ d = rdt_find_domain(r, domid, NULL);
+- if (!d) {
++ if (IS_ERR_OR_NULL(d)) {
+ ret = -ENOENT;
+ goto out;
+ }
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index 2013699a5c54..ad64031e82dc 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -965,7 +965,78 @@ static int rdtgroup_mode_show(struct kernfs_open_file *of,
+ }
+
+ /**
+- * rdtgroup_cbm_overlaps - Does CBM for intended closid overlap with other
++ * rdt_cdp_peer_get - Retrieve CDP peer if it exists
++ * @r: RDT resource to which RDT domain @d belongs
++ * @d: Cache instance for which a CDP peer is requested
++ * @r_cdp: RDT resource that shares hardware with @r (RDT resource peer)
++ * Used to return the result.
++ * @d_cdp: RDT domain that shares hardware with @d (RDT domain peer)
++ * Used to return the result.
++ *
++ * RDT resources are managed independently and by extension the RDT domains
++ * (RDT resource instances) are managed independently also. The Code and
++ * Data Prioritization (CDP) RDT resources, while managed independently,
++ * could refer to the same underlying hardware. For example,
++ * RDT_RESOURCE_L2CODE and RDT_RESOURCE_L2DATA both refer to the L2 cache.
++ *
++ * When provided with an RDT resource @r and an instance of that RDT
++ * resource @d rdt_cdp_peer_get() will return if there is a peer RDT
++ * resource and the exact instance that shares the same hardware.
++ *
++ * Return: 0 if a CDP peer was found, <0 on error or if no CDP peer exists.
++ * If a CDP peer was found, @r_cdp will point to the peer RDT resource
++ * and @d_cdp will point to the peer RDT domain.
++ */
++static int rdt_cdp_peer_get(struct rdt_resource *r, struct rdt_domain *d,
++ struct rdt_resource **r_cdp,
++ struct rdt_domain **d_cdp)
++{
++ struct rdt_resource *_r_cdp = NULL;
++ struct rdt_domain *_d_cdp = NULL;
++ int ret = 0;
++
++ switch (r->rid) {
++ case RDT_RESOURCE_L3DATA:
++ _r_cdp = &rdt_resources_all[RDT_RESOURCE_L3CODE];
++ break;
++ case RDT_RESOURCE_L3CODE:
++ _r_cdp = &rdt_resources_all[RDT_RESOURCE_L3DATA];
++ break;
++ case RDT_RESOURCE_L2DATA:
++ _r_cdp = &rdt_resources_all[RDT_RESOURCE_L2CODE];
++ break;
++ case RDT_RESOURCE_L2CODE:
++ _r_cdp = &rdt_resources_all[RDT_RESOURCE_L2DATA];
++ break;
++ default:
++ ret = -ENOENT;
++ goto out;
++ }
++
++ /*
++ * When a new CPU comes online and CDP is enabled then the new
++ * RDT domains (if any) associated with both CDP RDT resources
++ * are added in the same CPU online routine while the
++ * rdtgroup_mutex is held. It should thus not happen for one
++ * RDT domain to exist and be associated with its RDT CDP
++ * resource but there is no RDT domain associated with the
++ * peer RDT CDP resource. Hence the WARN.
++ */
++ _d_cdp = rdt_find_domain(_r_cdp, d->id, NULL);
++ if (WARN_ON(IS_ERR_OR_NULL(_d_cdp))) {
++ _r_cdp = NULL;
++ ret = -EINVAL;
++ }
++
++out:
++ *r_cdp = _r_cdp;
++ *d_cdp = _d_cdp;
++
++ return ret;
++}
++
++/**
++ * __rdtgroup_cbm_overlaps - Does CBM for intended closid overlap with other
+ * @r: Resource to which domain instance @d belongs.
+ * @d: The domain instance for which @closid is being tested.
+ * @cbm: Capacity bitmask being tested.
+@@ -984,8 +1055,8 @@ static int rdtgroup_mode_show(struct kernfs_open_file *of,
+ *
+ * Return: false if CBM does not overlap, true if it does.
+ */
+-bool rdtgroup_cbm_overlaps(struct rdt_resource *r, struct rdt_domain *d,
+- unsigned long cbm, int closid, bool exclusive)
++static bool __rdtgroup_cbm_overlaps(struct rdt_resource *r, struct rdt_domain *d,
++ unsigned long cbm, int closid, bool exclusive)
+ {
+ enum rdtgrp_mode mode;
+ unsigned long ctrl_b;
+@@ -1020,6 +1091,41 @@ bool rdtgroup_cbm_overlaps(struct rdt_resource *r, struct rdt_domain *d,
+ return false;
+ }
+
++/**
++ * rdtgroup_cbm_overlaps - Does CBM overlap with other use of hardware
++ * @r: Resource to which domain instance @d belongs.
++ * @d: The domain instance for which @closid is being tested.
++ * @cbm: Capacity bitmask being tested.
++ * @closid: Intended closid for @cbm.
++ * @exclusive: Only check if overlaps with exclusive resource groups
++ *
++ * Resources that can be allocated using a CBM can use the CBM to control
++ * the overlap of these allocations. rdtgroup_cmb_overlaps() is the test
++ * for overlap. Overlap test is not limited to the specific resource for
++ * which the CBM is intended though - when dealing with CDP resources that
++ * share the underlying hardware the overlap check should be performed on
++ * the CDP resource sharing the hardware also.
++ *
++ * Refer to description of __rdtgroup_cbm_overlaps() for the details of the
++ * overlap test.
++ *
++ * Return: true if CBM overlap detected, false if there is no overlap
++ */
++bool rdtgroup_cbm_overlaps(struct rdt_resource *r, struct rdt_domain *d,
++ unsigned long cbm, int closid, bool exclusive)
++{
++ struct rdt_resource *r_cdp;
++ struct rdt_domain *d_cdp;
++
++ if (__rdtgroup_cbm_overlaps(r, d, cbm, closid, exclusive))
++ return true;
++
++ if (rdt_cdp_peer_get(r, d, &r_cdp, &d_cdp) < 0)
++ return false;
++
++ return __rdtgroup_cbm_overlaps(r_cdp, d_cdp, cbm, closid, exclusive);
++}
++
+ /**
+ * rdtgroup_mode_test_exclusive - Test if this resource group can be exclusive
+ *
+diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
+index 516ec7586a5f..8d4d50645310 100644
+--- a/arch/x86/kernel/ptrace.c
++++ b/arch/x86/kernel/ptrace.c
+@@ -40,6 +40,7 @@
+ #include <asm/hw_breakpoint.h>
+ #include <asm/traps.h>
+ #include <asm/syscall.h>
++#include <asm/mmu_context.h>
+
+ #include "tls.h"
+
+@@ -343,6 +344,49 @@ static int set_segment_reg(struct task_struct *task,
+ return 0;
+ }
+
++static unsigned long task_seg_base(struct task_struct *task,
++ unsigned short selector)
++{
++ unsigned short idx = selector >> 3;
++ unsigned long base;
++
++ if (likely((selector & SEGMENT_TI_MASK) == 0)) {
++ if (unlikely(idx >= GDT_ENTRIES))
++ return 0;
++
++ /*
++ * There are no user segments in the GDT with nonzero bases
++ * other than the TLS segments.
++ */
++ if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
++ return 0;
++
++ idx -= GDT_ENTRY_TLS_MIN;
++ base = get_desc_base(&task->thread.tls_array[idx]);
++ } else {
++#ifdef CONFIG_MODIFY_LDT_SYSCALL
++ struct ldt_struct *ldt;
++
++ /*
++ * If performance here mattered, we could protect the LDT
++ * with RCU. This is a slow path, though, so we can just
++ * take the mutex.
++ */
++ mutex_lock(&task->mm->context.lock);
++ ldt = task->mm->context.ldt;
++ if (unlikely(idx >= ldt->nr_entries))
++ base = 0;
++ else
++ base = get_desc_base(ldt->entries + idx);
++ mutex_unlock(&task->mm->context.lock);
++#else
++ base = 0;
++#endif
++ }
++
++ return base;
++}
++
+ #endif /* CONFIG_X86_32 */
+
+ static unsigned long get_flags(struct task_struct *task)
+@@ -436,18 +480,16 @@ static unsigned long getreg(struct task_struct *task, unsigned long offset)
+
+ #ifdef CONFIG_X86_64
+ case offsetof(struct user_regs_struct, fs_base): {
+- /*
+- * XXX: This will not behave as expected if called on
+- * current or if fsindex != 0.
+- */
+- return task->thread.fsbase;
++ if (task->thread.fsindex == 0)
++ return task->thread.fsbase;
++ else
++ return task_seg_base(task, task->thread.fsindex);
+ }
+ case offsetof(struct user_regs_struct, gs_base): {
+- /*
+- * XXX: This will not behave as expected if called on
+- * current or if fsindex != 0.
+- */
+- return task->thread.gsbase;
++ if (task->thread.gsindex == 0)
++ return task->thread.gsbase;
++ else
++ return task_seg_base(task, task->thread.gsindex);
+ }
+ #endif
+ }
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index c05a818224bb..abcb8d00b014 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -19,7 +19,9 @@
+ #include <linux/sched.h>
+ #include <linux/seq_file.h>
+ #include <linux/highmem.h>
++#include <linux/pci.h>
+
++#include <asm/e820/types.h>
+ #include <asm/pgtable.h>
+
+ /*
+@@ -238,6 +240,29 @@ static unsigned long normalize_addr(unsigned long u)
+ return (signed long)(u << shift) >> shift;
+ }
+
++static void note_wx(struct pg_state *st)
++{
++ unsigned long npages;
++
++ npages = (st->current_address - st->start_address) / PAGE_SIZE;
++
++#ifdef CONFIG_PCI_BIOS
++ /*
++ * If PCI BIOS is enabled, the PCI BIOS area is forced to WX.
++ * Inform about it, but avoid the warning.
++ */
++ if (pcibios_enabled && st->start_address >= PAGE_OFFSET + BIOS_BEGIN &&
++ st->current_address <= PAGE_OFFSET + BIOS_END) {
++ pr_warn_once("x86/mm: PCI BIOS W+X mapping %lu pages\n", npages);
++ return;
++ }
++#endif
++ /* Account the WX pages */
++ st->wx_pages += npages;
++ WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %pS\n",
++ (void *)st->start_address);
++}
++
+ /*
+ * This function gets called on a break in a continuous series
+ * of PTE entries; the next one is different so we need to
+@@ -273,14 +298,8 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ unsigned long delta;
+ int width = sizeof(unsigned long) * 2;
+
+- if (st->check_wx && (eff & _PAGE_RW) && !(eff & _PAGE_NX)) {
+- WARN_ONCE(1,
+- "x86/mm: Found insecure W+X mapping at address %p/%pS\n",
+- (void *)st->start_address,
+- (void *)st->start_address);
+- st->wx_pages += (st->current_address -
+- st->start_address) / PAGE_SIZE;
+- }
++ if (st->check_wx && (eff & _PAGE_RW) && !(eff & _PAGE_NX))
++ note_wx(st);
+
+ /*
+ * Now print the actual finished series
+diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
+index 8f6cc71e0848..24d573bc550d 100644
+--- a/arch/x86/net/bpf_jit_comp32.c
++++ b/arch/x86/net/bpf_jit_comp32.c
+@@ -117,6 +117,8 @@ static bool is_simm32(s64 value)
+ #define IA32_JLE 0x7E
+ #define IA32_JG 0x7F
+
++#define COND_JMP_OPCODE_INVALID (0xFF)
++
+ /*
+ * Map eBPF registers to IA32 32bit registers or stack scratch space.
+ *
+@@ -698,19 +700,12 @@ static inline void emit_ia32_neg64(const u8 dst[], bool dstk, u8 **pprog)
+ STACK_VAR(dst_hi));
+ }
+
+- /* xor ecx,ecx */
+- EMIT2(0x31, add_2reg(0xC0, IA32_ECX, IA32_ECX));
+- /* sub dreg_lo,ecx */
+- EMIT2(0x2B, add_2reg(0xC0, dreg_lo, IA32_ECX));
+- /* mov dreg_lo,ecx */
+- EMIT2(0x89, add_2reg(0xC0, dreg_lo, IA32_ECX));
+-
+- /* xor ecx,ecx */
+- EMIT2(0x31, add_2reg(0xC0, IA32_ECX, IA32_ECX));
+- /* sbb dreg_hi,ecx */
+- EMIT2(0x19, add_2reg(0xC0, dreg_hi, IA32_ECX));
+- /* mov dreg_hi,ecx */
+- EMIT2(0x89, add_2reg(0xC0, dreg_hi, IA32_ECX));
++ /* neg dreg_lo */
++ EMIT2(0xF7, add_1reg(0xD8, dreg_lo));
++ /* adc dreg_hi,0x0 */
++ EMIT3(0x83, add_1reg(0xD0, dreg_hi), 0x00);
++ /* neg dreg_hi */
++ EMIT2(0xF7, add_1reg(0xD8, dreg_hi));
+
+ if (dstk) {
+ /* mov dword ptr [ebp+off],dreg_lo */
+@@ -729,9 +724,6 @@ static inline void emit_ia32_lsh_r64(const u8 dst[], const u8 src[],
+ {
+ u8 *prog = *pprog;
+ int cnt = 0;
+- static int jmp_label1 = -1;
+- static int jmp_label2 = -1;
+- static int jmp_label3 = -1;
+ u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
+ u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
+
+@@ -750,78 +742,22 @@ static inline void emit_ia32_lsh_r64(const u8 dst[], const u8 src[],
+ /* mov ecx,src_lo */
+ EMIT2(0x8B, add_2reg(0xC0, src_lo, IA32_ECX));
+
+- /* cmp ecx,32 */
+- EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
+- /* Jumps when >= 32 */
+- if (is_imm8(jmp_label(jmp_label1, 2)))
+- EMIT2(IA32_JAE, jmp_label(jmp_label1, 2));
+- else
+- EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label1, 6));
+-
+- /* < 32 */
+- /* shl dreg_hi,cl */
+- EMIT2(0xD3, add_1reg(0xE0, dreg_hi));
+- /* mov ebx,dreg_lo */
+- EMIT2(0x8B, add_2reg(0xC0, dreg_lo, IA32_EBX));
++ /* shld dreg_hi,dreg_lo,cl */
++ EMIT3(0x0F, 0xA5, add_2reg(0xC0, dreg_hi, dreg_lo));
+ /* shl dreg_lo,cl */
+ EMIT2(0xD3, add_1reg(0xE0, dreg_lo));
+
+- /* IA32_ECX = -IA32_ECX + 32 */
+- /* neg ecx */
+- EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
+- /* add ecx,32 */
+- EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
+-
+- /* shr ebx,cl */
+- EMIT2(0xD3, add_1reg(0xE8, IA32_EBX));
+- /* or dreg_hi,ebx */
+- EMIT2(0x09, add_2reg(0xC0, dreg_hi, IA32_EBX));
+-
+- /* goto out; */
+- if (is_imm8(jmp_label(jmp_label3, 2)))
+- EMIT2(0xEB, jmp_label(jmp_label3, 2));
+- else
+- EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
++ /* if ecx >= 32, mov dreg_lo into dreg_hi and clear dreg_lo */
+
+- /* >= 32 */
+- if (jmp_label1 == -1)
+- jmp_label1 = cnt;
+-
+- /* cmp ecx,64 */
+- EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 64);
+- /* Jumps when >= 64 */
+- if (is_imm8(jmp_label(jmp_label2, 2)))
+- EMIT2(IA32_JAE, jmp_label(jmp_label2, 2));
+- else
+- EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label2, 6));
++ /* cmp ecx,32 */
++ EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
++ /* skip the next two instructions (4 bytes) when < 32 */
++ EMIT2(IA32_JB, 4);
+
+- /* >= 32 && < 64 */
+- /* sub ecx,32 */
+- EMIT3(0x83, add_1reg(0xE8, IA32_ECX), 32);
+- /* shl dreg_lo,cl */
+- EMIT2(0xD3, add_1reg(0xE0, dreg_lo));
+ /* mov dreg_hi,dreg_lo */
+ EMIT2(0x89, add_2reg(0xC0, dreg_hi, dreg_lo));
+-
+- /* xor dreg_lo,dreg_lo */
+- EMIT2(0x33, add_2reg(0xC0, dreg_lo, dreg_lo));
+-
+- /* goto out; */
+- if (is_imm8(jmp_label(jmp_label3, 2)))
+- EMIT2(0xEB, jmp_label(jmp_label3, 2));
+- else
+- EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
+-
+- /* >= 64 */
+- if (jmp_label2 == -1)
+- jmp_label2 = cnt;
+ /* xor dreg_lo,dreg_lo */
+ EMIT2(0x33, add_2reg(0xC0, dreg_lo, dreg_lo));
+- /* xor dreg_hi,dreg_hi */
+- EMIT2(0x33, add_2reg(0xC0, dreg_hi, dreg_hi));
+-
+- if (jmp_label3 == -1)
+- jmp_label3 = cnt;
+
+ if (dstk) {
+ /* mov dword ptr [ebp+off],dreg_lo */
+@@ -841,9 +777,6 @@ static inline void emit_ia32_arsh_r64(const u8 dst[], const u8 src[],
+ {
+ u8 *prog = *pprog;
+ int cnt = 0;
+- static int jmp_label1 = -1;
+- static int jmp_label2 = -1;
+- static int jmp_label3 = -1;
+ u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
+ u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
+
+@@ -862,78 +795,22 @@ static inline void emit_ia32_arsh_r64(const u8 dst[], const u8 src[],
+ /* mov ecx,src_lo */
+ EMIT2(0x8B, add_2reg(0xC0, src_lo, IA32_ECX));
+
+- /* cmp ecx,32 */
+- EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
+- /* Jumps when >= 32 */
+- if (is_imm8(jmp_label(jmp_label1, 2)))
+- EMIT2(IA32_JAE, jmp_label(jmp_label1, 2));
+- else
+- EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label1, 6));
+-
+- /* < 32 */
+- /* lshr dreg_lo,cl */
+- EMIT2(0xD3, add_1reg(0xE8, dreg_lo));
+- /* mov ebx,dreg_hi */
+- EMIT2(0x8B, add_2reg(0xC0, dreg_hi, IA32_EBX));
+- /* ashr dreg_hi,cl */
++ /* shrd dreg_lo,dreg_hi,cl */
++ EMIT3(0x0F, 0xAD, add_2reg(0xC0, dreg_lo, dreg_hi));
++ /* sar dreg_hi,cl */
+ EMIT2(0xD3, add_1reg(0xF8, dreg_hi));
+
+- /* IA32_ECX = -IA32_ECX + 32 */
+- /* neg ecx */
+- EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
+- /* add ecx,32 */
+- EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
+-
+- /* shl ebx,cl */
+- EMIT2(0xD3, add_1reg(0xE0, IA32_EBX));
+- /* or dreg_lo,ebx */
+- EMIT2(0x09, add_2reg(0xC0, dreg_lo, IA32_EBX));
++ /* if ecx >= 32, mov dreg_hi to dreg_lo and set/clear dreg_hi depending on sign */
+
+- /* goto out; */
+- if (is_imm8(jmp_label(jmp_label3, 2)))
+- EMIT2(0xEB, jmp_label(jmp_label3, 2));
+- else
+- EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
+-
+- /* >= 32 */
+- if (jmp_label1 == -1)
+- jmp_label1 = cnt;
+-
+- /* cmp ecx,64 */
+- EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 64);
+- /* Jumps when >= 64 */
+- if (is_imm8(jmp_label(jmp_label2, 2)))
+- EMIT2(IA32_JAE, jmp_label(jmp_label2, 2));
+- else
+- EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label2, 6));
++ /* cmp ecx,32 */
++ EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
++ /* skip the next two instructions (5 bytes) when < 32 */
++ EMIT2(IA32_JB, 5);
+
+- /* >= 32 && < 64 */
+- /* sub ecx,32 */
+- EMIT3(0x83, add_1reg(0xE8, IA32_ECX), 32);
+- /* ashr dreg_hi,cl */
+- EMIT2(0xD3, add_1reg(0xF8, dreg_hi));
+ /* mov dreg_lo,dreg_hi */
+ EMIT2(0x89, add_2reg(0xC0, dreg_lo, dreg_hi));
+-
+- /* ashr dreg_hi,imm8 */
+- EMIT3(0xC1, add_1reg(0xF8, dreg_hi), 31);
+-
+- /* goto out; */
+- if (is_imm8(jmp_label(jmp_label3, 2)))
+- EMIT2(0xEB, jmp_label(jmp_label3, 2));
+- else
+- EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
+-
+- /* >= 64 */
+- if (jmp_label2 == -1)
+- jmp_label2 = cnt;
+- /* ashr dreg_hi,imm8 */
++ /* sar dreg_hi,31 */
+ EMIT3(0xC1, add_1reg(0xF8, dreg_hi), 31);
+- /* mov dreg_lo,dreg_hi */
+- EMIT2(0x89, add_2reg(0xC0, dreg_lo, dreg_hi));
+-
+- if (jmp_label3 == -1)
+- jmp_label3 = cnt;
+
+ if (dstk) {
+ /* mov dword ptr [ebp+off],dreg_lo */
+@@ -953,9 +830,6 @@ static inline void emit_ia32_rsh_r64(const u8 dst[], const u8 src[], bool dstk,
+ {
+ u8 *prog = *pprog;
+ int cnt = 0;
+- static int jmp_label1 = -1;
+- static int jmp_label2 = -1;
+- static int jmp_label3 = -1;
+ u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
+ u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
+
+@@ -974,77 +848,23 @@ static inline void emit_ia32_rsh_r64(const u8 dst[], const u8 src[], bool dstk,
+ /* mov ecx,src_lo */
+ EMIT2(0x8B, add_2reg(0xC0, src_lo, IA32_ECX));
+
+- /* cmp ecx,32 */
+- EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
+- /* Jumps when >= 32 */
+- if (is_imm8(jmp_label(jmp_label1, 2)))
+- EMIT2(IA32_JAE, jmp_label(jmp_label1, 2));
+- else
+- EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label1, 6));
+-
+- /* < 32 */
+- /* lshr dreg_lo,cl */
+- EMIT2(0xD3, add_1reg(0xE8, dreg_lo));
+- /* mov ebx,dreg_hi */
+- EMIT2(0x8B, add_2reg(0xC0, dreg_hi, IA32_EBX));
++ /* shrd dreg_lo,dreg_hi,cl */
++ EMIT3(0x0F, 0xAD, add_2reg(0xC0, dreg_lo, dreg_hi));
+ /* shr dreg_hi,cl */
+ EMIT2(0xD3, add_1reg(0xE8, dreg_hi));
+
+- /* IA32_ECX = -IA32_ECX + 32 */
+- /* neg ecx */
+- EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
+- /* add ecx,32 */
+- EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
+-
+- /* shl ebx,cl */
+- EMIT2(0xD3, add_1reg(0xE0, IA32_EBX));
+- /* or dreg_lo,ebx */
+- EMIT2(0x09, add_2reg(0xC0, dreg_lo, IA32_EBX));
++ /* if ecx >= 32, mov dreg_hi to dreg_lo and clear dreg_hi */
+
+- /* goto out; */
+- if (is_imm8(jmp_label(jmp_label3, 2)))
+- EMIT2(0xEB, jmp_label(jmp_label3, 2));
+- else
+- EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
+-
+- /* >= 32 */
+- if (jmp_label1 == -1)
+- jmp_label1 = cnt;
+- /* cmp ecx,64 */
+- EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 64);
+- /* Jumps when >= 64 */
+- if (is_imm8(jmp_label(jmp_label2, 2)))
+- EMIT2(IA32_JAE, jmp_label(jmp_label2, 2));
+- else
+- EMIT2_off32(0x0F, IA32_JAE + 0x10, jmp_label(jmp_label2, 6));
++ /* cmp ecx,32 */
++ EMIT3(0x83, add_1reg(0xF8, IA32_ECX), 32);
++ /* skip the next two instructions (4 bytes) when < 32 */
++ EMIT2(IA32_JB, 4);
+
+- /* >= 32 && < 64 */
+- /* sub ecx,32 */
+- EMIT3(0x83, add_1reg(0xE8, IA32_ECX), 32);
+- /* shr dreg_hi,cl */
+- EMIT2(0xD3, add_1reg(0xE8, dreg_hi));
+ /* mov dreg_lo,dreg_hi */
+ EMIT2(0x89, add_2reg(0xC0, dreg_lo, dreg_hi));
+ /* xor dreg_hi,dreg_hi */
+ EMIT2(0x33, add_2reg(0xC0, dreg_hi, dreg_hi));
+
+- /* goto out; */
+- if (is_imm8(jmp_label(jmp_label3, 2)))
+- EMIT2(0xEB, jmp_label(jmp_label3, 2));
+- else
+- EMIT1_off32(0xE9, jmp_label(jmp_label3, 5));
+-
+- /* >= 64 */
+- if (jmp_label2 == -1)
+- jmp_label2 = cnt;
+- /* xor dreg_lo,dreg_lo */
+- EMIT2(0x33, add_2reg(0xC0, dreg_lo, dreg_lo));
+- /* xor dreg_hi,dreg_hi */
+- EMIT2(0x33, add_2reg(0xC0, dreg_hi, dreg_hi));
+-
+- if (jmp_label3 == -1)
+- jmp_label3 = cnt;
+-
+ if (dstk) {
+ /* mov dword ptr [ebp+off],dreg_lo */
+ EMIT3(0x89, add_2reg(0x40, IA32_EBP, dreg_lo),
+@@ -1074,27 +894,10 @@ static inline void emit_ia32_lsh_i64(const u8 dst[], const u32 val,
+ }
+ /* Do LSH operation */
+ if (val < 32) {
+- /* shl dreg_hi,imm8 */
+- EMIT3(0xC1, add_1reg(0xE0, dreg_hi), val);
+- /* mov ebx,dreg_lo */
+- EMIT2(0x8B, add_2reg(0xC0, dreg_lo, IA32_EBX));
++ /* shld dreg_hi,dreg_lo,imm8 */
++ EMIT4(0x0F, 0xA4, add_2reg(0xC0, dreg_hi, dreg_lo), val);
+ /* shl dreg_lo,imm8 */
+ EMIT3(0xC1, add_1reg(0xE0, dreg_lo), val);
+-
+- /* IA32_ECX = 32 - val */
+- /* mov ecx,val */
+- EMIT2(0xB1, val);
+- /* movzx ecx,ecx */
+- EMIT3(0x0F, 0xB6, add_2reg(0xC0, IA32_ECX, IA32_ECX));
+- /* neg ecx */
+- EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
+- /* add ecx,32 */
+- EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
+-
+- /* shr ebx,cl */
+- EMIT2(0xD3, add_1reg(0xE8, IA32_EBX));
+- /* or dreg_hi,ebx */
+- EMIT2(0x09, add_2reg(0xC0, dreg_hi, IA32_EBX));
+ } else if (val >= 32 && val < 64) {
+ u32 value = val - 32;
+
+@@ -1140,27 +943,10 @@ static inline void emit_ia32_rsh_i64(const u8 dst[], const u32 val,
+
+ /* Do RSH operation */
+ if (val < 32) {
+- /* shr dreg_lo,imm8 */
+- EMIT3(0xC1, add_1reg(0xE8, dreg_lo), val);
+- /* mov ebx,dreg_hi */
+- EMIT2(0x8B, add_2reg(0xC0, dreg_hi, IA32_EBX));
++ /* shrd dreg_lo,dreg_hi,imm8 */
++ EMIT4(0x0F, 0xAC, add_2reg(0xC0, dreg_lo, dreg_hi), val);
+ /* shr dreg_hi,imm8 */
+ EMIT3(0xC1, add_1reg(0xE8, dreg_hi), val);
+-
+- /* IA32_ECX = 32 - val */
+- /* mov ecx,val */
+- EMIT2(0xB1, val);
+- /* movzx ecx,ecx */
+- EMIT3(0x0F, 0xB6, add_2reg(0xC0, IA32_ECX, IA32_ECX));
+- /* neg ecx */
+- EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
+- /* add ecx,32 */
+- EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
+-
+- /* shl ebx,cl */
+- EMIT2(0xD3, add_1reg(0xE0, IA32_EBX));
+- /* or dreg_lo,ebx */
+- EMIT2(0x09, add_2reg(0xC0, dreg_lo, IA32_EBX));
+ } else if (val >= 32 && val < 64) {
+ u32 value = val - 32;
+
+@@ -1205,27 +991,10 @@ static inline void emit_ia32_arsh_i64(const u8 dst[], const u32 val,
+ }
+ /* Do RSH operation */
+ if (val < 32) {
+- /* shr dreg_lo,imm8 */
+- EMIT3(0xC1, add_1reg(0xE8, dreg_lo), val);
+- /* mov ebx,dreg_hi */
+- EMIT2(0x8B, add_2reg(0xC0, dreg_hi, IA32_EBX));
++ /* shrd dreg_lo,dreg_hi,imm8 */
++ EMIT4(0x0F, 0xAC, add_2reg(0xC0, dreg_lo, dreg_hi), val);
+ /* ashr dreg_hi,imm8 */
+ EMIT3(0xC1, add_1reg(0xF8, dreg_hi), val);
+-
+- /* IA32_ECX = 32 - val */
+- /* mov ecx,val */
+- EMIT2(0xB1, val);
+- /* movzx ecx,ecx */
+- EMIT3(0x0F, 0xB6, add_2reg(0xC0, IA32_ECX, IA32_ECX));
+- /* neg ecx */
+- EMIT2(0xF7, add_1reg(0xD8, IA32_ECX));
+- /* add ecx,32 */
+- EMIT3(0x83, add_1reg(0xC0, IA32_ECX), 32);
+-
+- /* shl ebx,cl */
+- EMIT2(0xD3, add_1reg(0xE0, IA32_EBX));
+- /* or dreg_lo,ebx */
+- EMIT2(0x09, add_2reg(0xC0, dreg_lo, IA32_EBX));
+ } else if (val >= 32 && val < 64) {
+ u32 value = val - 32;
+
+@@ -1613,6 +1382,75 @@ static inline void emit_push_r64(const u8 src[], u8 **pprog)
+ *pprog = prog;
+ }
+
++static u8 get_cond_jmp_opcode(const u8 op, bool is_cmp_lo)
++{
++ u8 jmp_cond;
++
++ /* Convert BPF opcode to x86 */
++ switch (op) {
++ case BPF_JEQ:
++ jmp_cond = IA32_JE;
++ break;
++ case BPF_JSET:
++ case BPF_JNE:
++ jmp_cond = IA32_JNE;
++ break;
++ case BPF_JGT:
++ /* GT is unsigned '>', JA in x86 */
++ jmp_cond = IA32_JA;
++ break;
++ case BPF_JLT:
++ /* LT is unsigned '<', JB in x86 */
++ jmp_cond = IA32_JB;
++ break;
++ case BPF_JGE:
++ /* GE is unsigned '>=', JAE in x86 */
++ jmp_cond = IA32_JAE;
++ break;
++ case BPF_JLE:
++ /* LE is unsigned '<=', JBE in x86 */
++ jmp_cond = IA32_JBE;
++ break;
++ case BPF_JSGT:
++ if (!is_cmp_lo)
++ /* Signed '>', GT in x86 */
++ jmp_cond = IA32_JG;
++ else
++ /* GT is unsigned '>', JA in x86 */
++ jmp_cond = IA32_JA;
++ break;
++ case BPF_JSLT:
++ if (!is_cmp_lo)
++ /* Signed '<', LT in x86 */
++ jmp_cond = IA32_JL;
++ else
++ /* LT is unsigned '<', JB in x86 */
++ jmp_cond = IA32_JB;
++ break;
++ case BPF_JSGE:
++ if (!is_cmp_lo)
++ /* Signed '>=', GE in x86 */
++ jmp_cond = IA32_JGE;
++ else
++ /* GE is unsigned '>=', JAE in x86 */
++ jmp_cond = IA32_JAE;
++ break;
++ case BPF_JSLE:
++ if (!is_cmp_lo)
++ /* Signed '<=', LE in x86 */
++ jmp_cond = IA32_JLE;
++ else
++ /* LE is unsigned '<=', JBE in x86 */
++ jmp_cond = IA32_JBE;
++ break;
++ default: /* to silence GCC warning */
++ jmp_cond = COND_JMP_OPCODE_INVALID;
++ break;
++ }
++
++ return jmp_cond;
++}
++
+ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ int oldproglen, struct jit_context *ctx)
+ {
+@@ -2068,11 +1906,7 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ case BPF_JMP | BPF_JGT | BPF_X:
+ case BPF_JMP | BPF_JLT | BPF_X:
+ case BPF_JMP | BPF_JGE | BPF_X:
+- case BPF_JMP | BPF_JLE | BPF_X:
+- case BPF_JMP | BPF_JSGT | BPF_X:
+- case BPF_JMP | BPF_JSLE | BPF_X:
+- case BPF_JMP | BPF_JSLT | BPF_X:
+- case BPF_JMP | BPF_JSGE | BPF_X: {
++ case BPF_JMP | BPF_JLE | BPF_X: {
+ u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
+ u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
+ u8 sreg_lo = sstk ? IA32_ECX : src_lo;
+@@ -2099,6 +1933,40 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ EMIT2(0x39, add_2reg(0xC0, dreg_lo, sreg_lo));
+ goto emit_cond_jmp;
+ }
++ case BPF_JMP | BPF_JSGT | BPF_X:
++ case BPF_JMP | BPF_JSLE | BPF_X:
++ case BPF_JMP | BPF_JSLT | BPF_X:
++ case BPF_JMP | BPF_JSGE | BPF_X: {
++ u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
++ u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
++ u8 sreg_lo = sstk ? IA32_ECX : src_lo;
++ u8 sreg_hi = sstk ? IA32_EBX : src_hi;
++
++ if (dstk) {
++ EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EAX),
++ STACK_VAR(dst_lo));
++ EMIT3(0x8B,
++ add_2reg(0x40, IA32_EBP,
++ IA32_EDX),
++ STACK_VAR(dst_hi));
++ }
++
++ if (sstk) {
++ EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_ECX),
++ STACK_VAR(src_lo));
++ EMIT3(0x8B,
++ add_2reg(0x40, IA32_EBP,
++ IA32_EBX),
++ STACK_VAR(src_hi));
++ }
++
++ /* cmp dreg_hi,sreg_hi */
++ EMIT2(0x39, add_2reg(0xC0, dreg_hi, sreg_hi));
++ EMIT2(IA32_JNE, 10);
++ /* cmp dreg_lo,sreg_lo */
++ EMIT2(0x39, add_2reg(0xC0, dreg_lo, sreg_lo));
++ goto emit_cond_jmp_signed;
++ }
+ case BPF_JMP | BPF_JSET | BPF_X: {
+ u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
+ u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
+@@ -2159,11 +2027,7 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ case BPF_JMP | BPF_JGT | BPF_K:
+ case BPF_JMP | BPF_JLT | BPF_K:
+ case BPF_JMP | BPF_JGE | BPF_K:
+- case BPF_JMP | BPF_JLE | BPF_K:
+- case BPF_JMP | BPF_JSGT | BPF_K:
+- case BPF_JMP | BPF_JSLE | BPF_K:
+- case BPF_JMP | BPF_JSLT | BPF_K:
+- case BPF_JMP | BPF_JSGE | BPF_K: {
++ case BPF_JMP | BPF_JLE | BPF_K: {
+ u32 hi;
+ u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
+ u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
+@@ -2189,50 +2053,9 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ /* cmp dreg_lo,sreg_lo */
+ EMIT2(0x39, add_2reg(0xC0, dreg_lo, sreg_lo));
+
+-emit_cond_jmp: /* Convert BPF opcode to x86 */
+- switch (BPF_OP(code)) {
+- case BPF_JEQ:
+- jmp_cond = IA32_JE;
+- break;
+- case BPF_JSET:
+- case BPF_JNE:
+- jmp_cond = IA32_JNE;
+- break;
+- case BPF_JGT:
+- /* GT is unsigned '>', JA in x86 */
+- jmp_cond = IA32_JA;
+- break;
+- case BPF_JLT:
+- /* LT is unsigned '<', JB in x86 */
+- jmp_cond = IA32_JB;
+- break;
+- case BPF_JGE:
+- /* GE is unsigned '>=', JAE in x86 */
+- jmp_cond = IA32_JAE;
+- break;
+- case BPF_JLE:
+- /* LE is unsigned '<=', JBE in x86 */
+- jmp_cond = IA32_JBE;
+- break;
+- case BPF_JSGT:
+- /* Signed '>', GT in x86 */
+- jmp_cond = IA32_JG;
+- break;
+- case BPF_JSLT:
+- /* Signed '<', LT in x86 */
+- jmp_cond = IA32_JL;
+- break;
+- case BPF_JSGE:
+- /* Signed '>=', GE in x86 */
+- jmp_cond = IA32_JGE;
+- break;
+- case BPF_JSLE:
+- /* Signed '<=', LE in x86 */
+- jmp_cond = IA32_JLE;
+- break;
+- default: /* to silence GCC warning */
++emit_cond_jmp: jmp_cond = get_cond_jmp_opcode(BPF_OP(code), false);
++ if (jmp_cond == COND_JMP_OPCODE_INVALID)
+ return -EFAULT;
+- }
+ jmp_offset = addrs[i + insn->off] - addrs[i];
+ if (is_imm8(jmp_offset)) {
+ EMIT2(jmp_cond, jmp_offset);
+@@ -2242,7 +2065,66 @@ emit_cond_jmp: /* Convert BPF opcode to x86 */
+ pr_err("cond_jmp gen bug %llx\n", jmp_offset);
+ return -EFAULT;
+ }
++ break;
++ }
++ case BPF_JMP | BPF_JSGT | BPF_K:
++ case BPF_JMP | BPF_JSLE | BPF_K:
++ case BPF_JMP | BPF_JSLT | BPF_K:
++ case BPF_JMP | BPF_JSGE | BPF_K: {
++ u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
++ u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
++ u8 sreg_lo = IA32_ECX;
++ u8 sreg_hi = IA32_EBX;
++ u32 hi;
++
++ if (dstk) {
++ EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EAX),
++ STACK_VAR(dst_lo));
++ EMIT3(0x8B,
++ add_2reg(0x40, IA32_EBP,
++ IA32_EDX),
++ STACK_VAR(dst_hi));
++ }
++
++ /* mov ecx,imm32 */
++ EMIT2_off32(0xC7, add_1reg(0xC0, IA32_ECX), imm32);
++ hi = imm32 & (1 << 31) ? (u32)~0 : 0;
++ /* mov ebx,imm32 */
++ EMIT2_off32(0xC7, add_1reg(0xC0, IA32_EBX), hi);
++ /* cmp dreg_hi,sreg_hi */
++ EMIT2(0x39, add_2reg(0xC0, dreg_hi, sreg_hi));
++ EMIT2(IA32_JNE, 10);
++ /* cmp dreg_lo,sreg_lo */
++ EMIT2(0x39, add_2reg(0xC0, dreg_lo, sreg_lo));
++
++ /*
++ * For simplicity of branch offset computation,
++ * let's use fixed jump coding here.
++ */
++emit_cond_jmp_signed: /* Check the condition for low 32-bit comparison */
++ jmp_cond = get_cond_jmp_opcode(BPF_OP(code), true);
++ if (jmp_cond == COND_JMP_OPCODE_INVALID)
++ return -EFAULT;
++ jmp_offset = addrs[i + insn->off] - addrs[i] + 8;
++ if (is_simm32(jmp_offset)) {
++ EMIT2_off32(0x0F, jmp_cond + 0x10, jmp_offset);
++ } else {
++ pr_err("cond_jmp gen bug %llx\n", jmp_offset);
++ return -EFAULT;
++ }
++ EMIT2(0xEB, 6);
+
++ /* Check the condition for high 32-bit comparison */
++ jmp_cond = get_cond_jmp_opcode(BPF_OP(code), false);
++ if (jmp_cond == COND_JMP_OPCODE_INVALID)
++ return -EFAULT;
++ jmp_offset = addrs[i + insn->off] - addrs[i];
++ if (is_simm32(jmp_offset)) {
++ EMIT2_off32(0x0F, jmp_cond + 0x10, jmp_offset);
++ } else {
++ pr_err("cond_jmp gen bug %llx\n", jmp_offset);
++ return -EFAULT;
++ }
+ break;
+ }
+ case BPF_JMP | BPF_JA:
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index bd372e896557..527e69b12002 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -629,17 +629,11 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x8c10, quirk_apple_mbp_poweroff);
+ static void quirk_no_aersid(struct pci_dev *pdev)
+ {
+ /* VMD Domain */
+- if (is_vmd(pdev->bus))
++ if (is_vmd(pdev->bus) && pci_is_root_bus(pdev->bus))
+ pdev->bus->bus_flags |= PCI_BUS_FLAGS_NO_AERSID;
+ }
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2030, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2031, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2032, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2033, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334a, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334b, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334c, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334d, quirk_no_aersid);
++DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID,
++ PCI_CLASS_BRIDGE_PCI, 8, quirk_no_aersid);
+
+ static void quirk_intel_th_dnv(struct pci_dev *dev)
+ {
+diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
+index c9986041a5e1..6c3ec193a246 100644
+--- a/arch/x86/power/hibernate_64.c
++++ b/arch/x86/power/hibernate_64.c
+@@ -266,9 +266,9 @@ free_tfm:
+ return ret;
+ }
+
+-static void hibernation_e820_save(void *buf)
++static int hibernation_e820_save(void *buf)
+ {
+- get_e820_md5(e820_table_firmware, buf);
++ return get_e820_md5(e820_table_firmware, buf);
+ }
+
+ static bool hibernation_e820_mismatch(void *buf)
+@@ -288,8 +288,9 @@ static bool hibernation_e820_mismatch(void *buf)
+ return memcmp(result, buf, MD5_DIGEST_SIZE) ? true : false;
+ }
+ #else
+-static void hibernation_e820_save(void *buf)
++static int hibernation_e820_save(void *buf)
+ {
++ return 0;
+ }
+
+ static bool hibernation_e820_mismatch(void *buf)
+@@ -334,9 +335,7 @@ int arch_hibernation_header_save(void *addr, unsigned int max_size)
+
+ rdr->magic = RESTORE_MAGIC;
+
+- hibernation_e820_save(rdr->e820_digest);
+-
+- return 0;
++ return hibernation_e820_save(rdr->e820_digest);
+ }
+
+ /**
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 7eda27d43b48..b21c241aaab9 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -16,6 +16,7 @@
+ #include <linux/err.h>
+ #include <linux/io.h>
+ #include <linux/mutex.h>
++#include <linux/pci.h>
+ #include <linux/platform_device.h>
+ #include <linux/platform_data/clk-lpss.h>
+ #include <linux/platform_data/x86/pmc_atom.h>
+@@ -83,6 +84,7 @@ struct lpss_device_desc {
+ size_t prv_size_override;
+ struct property_entry *properties;
+ void (*setup)(struct lpss_private_data *pdata);
++ bool resume_from_noirq;
+ };
+
+ static const struct lpss_device_desc lpss_dma_desc = {
+@@ -292,12 +294,14 @@ static const struct lpss_device_desc byt_i2c_dev_desc = {
+ .flags = LPSS_CLK | LPSS_SAVE_CTX,
+ .prv_offset = 0x800,
+ .setup = byt_i2c_setup,
++ .resume_from_noirq = true,
+ };
+
+ static const struct lpss_device_desc bsw_i2c_dev_desc = {
+ .flags = LPSS_CLK | LPSS_SAVE_CTX | LPSS_NO_D3_DELAY,
+ .prv_offset = 0x800,
+ .setup = byt_i2c_setup,
++ .resume_from_noirq = true,
+ };
+
+ static const struct lpss_device_desc bsw_spi_dev_desc = {
+@@ -512,12 +516,18 @@ static int match_hid_uid(struct device *dev, void *data)
+
+ static struct device *acpi_lpss_find_device(const char *hid, const char *uid)
+ {
++ struct device *dev;
++
+ struct hid_uid data = {
+ .hid = hid,
+ .uid = uid,
+ };
+
+- return bus_find_device(&platform_bus_type, NULL, &data, match_hid_uid);
++ dev = bus_find_device(&platform_bus_type, NULL, &data, match_hid_uid);
++ if (dev)
++ return dev;
++
++ return bus_find_device(&pci_bus_type, NULL, &data, match_hid_uid);
+ }
+
+ static bool acpi_lpss_dep(struct acpi_device *adev, acpi_handle handle)
+@@ -1024,7 +1034,7 @@ static int acpi_lpss_resume(struct device *dev)
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+-static int acpi_lpss_suspend_late(struct device *dev)
++static int acpi_lpss_do_suspend_late(struct device *dev)
+ {
+ int ret;
+
+@@ -1035,12 +1045,62 @@ static int acpi_lpss_suspend_late(struct device *dev)
+ return ret ? ret : acpi_lpss_suspend(dev, device_may_wakeup(dev));
+ }
+
+-static int acpi_lpss_resume_early(struct device *dev)
++static int acpi_lpss_suspend_late(struct device *dev)
++{
++ struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++
++ if (pdata->dev_desc->resume_from_noirq)
++ return 0;
++
++ return acpi_lpss_do_suspend_late(dev);
++}
++
++static int acpi_lpss_suspend_noirq(struct device *dev)
++{
++ struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++ int ret;
++
++ if (pdata->dev_desc->resume_from_noirq) {
++ ret = acpi_lpss_do_suspend_late(dev);
++ if (ret)
++ return ret;
++ }
++
++ return acpi_subsys_suspend_noirq(dev);
++}
++
++static int acpi_lpss_do_resume_early(struct device *dev)
+ {
+ int ret = acpi_lpss_resume(dev);
+
+ return ret ? ret : pm_generic_resume_early(dev);
+ }
++
++static int acpi_lpss_resume_early(struct device *dev)
++{
++ struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++
++ if (pdata->dev_desc->resume_from_noirq)
++ return 0;
++
++ return acpi_lpss_do_resume_early(dev);
++}
++
++static int acpi_lpss_resume_noirq(struct device *dev)
++{
++ struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++ int ret;
++
++ ret = acpi_subsys_resume_noirq(dev);
++ if (ret)
++ return ret;
++
++ if (!dev_pm_may_skip_resume(dev) && pdata->dev_desc->resume_from_noirq)
++ ret = acpi_lpss_do_resume_early(dev);
++
++ return ret;
++}
++
+ #endif /* CONFIG_PM_SLEEP */
+
+ static int acpi_lpss_runtime_suspend(struct device *dev)
+@@ -1070,8 +1130,8 @@ static struct dev_pm_domain acpi_lpss_pm_domain = {
+ .complete = acpi_subsys_complete,
+ .suspend = acpi_subsys_suspend,
+ .suspend_late = acpi_lpss_suspend_late,
+- .suspend_noirq = acpi_subsys_suspend_noirq,
+- .resume_noirq = acpi_subsys_resume_noirq,
++ .suspend_noirq = acpi_lpss_suspend_noirq,
++ .resume_noirq = acpi_lpss_resume_noirq,
+ .resume_early = acpi_lpss_resume_early,
+ .freeze = acpi_subsys_freeze,
+ .freeze_late = acpi_subsys_freeze_late,
+@@ -1079,8 +1139,8 @@ static struct dev_pm_domain acpi_lpss_pm_domain = {
+ .thaw_noirq = acpi_subsys_thaw_noirq,
+ .poweroff = acpi_subsys_suspend,
+ .poweroff_late = acpi_lpss_suspend_late,
+- .poweroff_noirq = acpi_subsys_suspend_noirq,
+- .restore_noirq = acpi_subsys_resume_noirq,
++ .poweroff_noirq = acpi_lpss_suspend_noirq,
++ .restore_noirq = acpi_lpss_resume_noirq,
+ .restore_early = acpi_lpss_resume_early,
+ #endif
+ .runtime_suspend = acpi_lpss_runtime_suspend,
+diff --git a/drivers/acpi/acpica/acevents.h b/drivers/acpi/acpica/acevents.h
+index 298180bf7e3c..bfcc68b9f708 100644
+--- a/drivers/acpi/acpica/acevents.h
++++ b/drivers/acpi/acpica/acevents.h
+@@ -230,6 +230,8 @@ acpi_ev_default_region_setup(acpi_handle handle,
+
+ acpi_status acpi_ev_initialize_region(union acpi_operand_object *region_obj);
+
++u8 acpi_ev_is_pci_root_bridge(struct acpi_namespace_node *node);
++
+ /*
+ * evsci - SCI (System Control Interrupt) handling/dispatch
+ */
+diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
+index 0f28a38a43ea..99b0da899109 100644
+--- a/drivers/acpi/acpica/aclocal.h
++++ b/drivers/acpi/acpica/aclocal.h
+@@ -395,9 +395,9 @@ struct acpi_simple_repair_info {
+ /* Info for running the _REG methods */
+
+ struct acpi_reg_walk_info {
+- acpi_adr_space_type space_id;
+ u32 function;
+ u32 reg_run_count;
++ acpi_adr_space_type space_id;
+ };
+
+ /*****************************************************************************
+diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c
+index 70c2bd169f66..49decca4e08f 100644
+--- a/drivers/acpi/acpica/evregion.c
++++ b/drivers/acpi/acpica/evregion.c
+@@ -653,6 +653,19 @@ acpi_ev_execute_reg_methods(struct acpi_namespace_node *node,
+
+ ACPI_FUNCTION_TRACE(ev_execute_reg_methods);
+
++ /*
++ * These address spaces do not need a call to _REG, since the ACPI
++ * specification defines them as: "must always be accessible". Since
++ * they never change state (never become unavailable), no need to ever
++ * call _REG on them. Also, a data_table is not a "real" address space,
++ * so do not call _REG. September 2018.
++ */
++ if ((space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) ||
++ (space_id == ACPI_ADR_SPACE_SYSTEM_IO) ||
++ (space_id == ACPI_ADR_SPACE_DATA_TABLE)) {
++ return_VOID;
++ }
++
+ info.space_id = space_id;
+ info.function = function;
+ info.reg_run_count = 0;
+@@ -714,8 +727,8 @@ acpi_ev_reg_run(acpi_handle obj_handle,
+ }
+
+ /*
+- * We only care about regions.and objects that are allowed to have address
+- * space handlers
++ * We only care about regions and objects that are allowed to have
++ * address space handlers
+ */
+ if ((node->type != ACPI_TYPE_REGION) && (node != acpi_gbl_root_node)) {
+ return (AE_OK);
+diff --git a/drivers/acpi/acpica/evrgnini.c b/drivers/acpi/acpica/evrgnini.c
+index 39284deedd88..17df5dacd43c 100644
+--- a/drivers/acpi/acpica/evrgnini.c
++++ b/drivers/acpi/acpica/evrgnini.c
+@@ -16,9 +16,6 @@
+ #define _COMPONENT ACPI_EVENTS
+ ACPI_MODULE_NAME("evrgnini")
+
+-/* Local prototypes */
+-static u8 acpi_ev_is_pci_root_bridge(struct acpi_namespace_node *node);
+-
+ /*******************************************************************************
+ *
+ * FUNCTION: acpi_ev_system_memory_region_setup
+@@ -33,7 +30,6 @@ static u8 acpi_ev_is_pci_root_bridge(struct acpi_namespace_node *node);
+ * DESCRIPTION: Setup a system_memory operation region
+ *
+ ******************************************************************************/
+-
+ acpi_status
+ acpi_ev_system_memory_region_setup(acpi_handle handle,
+ u32 function,
+@@ -313,7 +309,7 @@ acpi_ev_pci_config_region_setup(acpi_handle handle,
+ *
+ ******************************************************************************/
+
+-static u8 acpi_ev_is_pci_root_bridge(struct acpi_namespace_node *node)
++u8 acpi_ev_is_pci_root_bridge(struct acpi_namespace_node *node)
+ {
+ acpi_status status;
+ struct acpi_pnp_device_id *hid;
+diff --git a/drivers/acpi/acpica/evxfregn.c b/drivers/acpi/acpica/evxfregn.c
+index 091415b14fbf..3b3a25d9f0e6 100644
+--- a/drivers/acpi/acpica/evxfregn.c
++++ b/drivers/acpi/acpica/evxfregn.c
+@@ -193,7 +193,6 @@ acpi_remove_address_space_handler(acpi_handle device,
+ */
+ region_obj =
+ handler_obj->address_space.region_list;
+-
+ }
+
+ /* Remove this Handler object from the list */
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index ed73f6fb0779..b48874b8e1ea 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -1132,6 +1132,7 @@ void acpi_os_wait_events_complete(void)
+ flush_workqueue(kacpid_wq);
+ flush_workqueue(kacpi_notify_wq);
+ }
++EXPORT_SYMBOL(acpi_os_wait_events_complete);
+
+ struct acpi_hp_work {
+ struct work_struct work;
+diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
+index 7a3431018e0a..5008ead4609a 100644
+--- a/drivers/acpi/sbshc.c
++++ b/drivers/acpi/sbshc.c
+@@ -196,6 +196,7 @@ int acpi_smbus_unregister_callback(struct acpi_smb_hc *hc)
+ hc->callback = NULL;
+ hc->context = NULL;
+ mutex_unlock(&hc->lock);
++ acpi_os_wait_events_complete();
+ return 0;
+ }
+
+@@ -292,6 +293,7 @@ static int acpi_smbus_hc_remove(struct acpi_device *device)
+
+ hc = acpi_driver_data(device);
+ acpi_ec_remove_query_handler(hc->ec, hc->query_bit);
++ acpi_os_wait_events_complete();
+ kfree(hc);
+ device->driver_data = NULL;
+ return 0;
+diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
+index 39b181d6bd0d..99698d7fe585 100644
+--- a/drivers/ata/Kconfig
++++ b/drivers/ata/Kconfig
+@@ -121,7 +121,8 @@ config SATA_AHCI_PLATFORM
+
+ config AHCI_BRCM
+ tristate "Broadcom AHCI SATA support"
+- depends on ARCH_BRCMSTB || BMIPS_GENERIC || ARCH_BCM_NSP
++ depends on ARCH_BRCMSTB || BMIPS_GENERIC || ARCH_BCM_NSP || \
++ ARCH_BCM_63XX
+ help
+ This option enables support for the AHCI SATA3 controller found on
+ Broadcom SoC's.
+diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
+index 0a550190955a..cc6d06c1b2c7 100644
+--- a/drivers/ata/pata_ep93xx.c
++++ b/drivers/ata/pata_ep93xx.c
+@@ -659,7 +659,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
+ * start of new transfer.
+ */
+ drv_data->dma_rx_data.port = EP93XX_DMA_IDE;
+- drv_data->dma_rx_data.direction = DMA_FROM_DEVICE;
++ drv_data->dma_rx_data.direction = DMA_DEV_TO_MEM;
+ drv_data->dma_rx_data.name = "ep93xx-pata-rx";
+ drv_data->dma_rx_channel = dma_request_channel(mask,
+ ep93xx_pata_dma_filter, &drv_data->dma_rx_data);
+@@ -667,7 +667,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
+ return;
+
+ drv_data->dma_tx_data.port = EP93XX_DMA_IDE;
+- drv_data->dma_tx_data.direction = DMA_TO_DEVICE;
++ drv_data->dma_tx_data.direction = DMA_MEM_TO_DEV;
+ drv_data->dma_tx_data.name = "ep93xx-pata-tx";
+ drv_data->dma_tx_channel = dma_request_channel(mask,
+ ep93xx_pata_dma_filter, &drv_data->dma_tx_data);
+@@ -678,7 +678,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
+
+ /* Configure receive channel direction and source address */
+ memset(&conf, 0, sizeof(conf));
+- conf.direction = DMA_FROM_DEVICE;
++ conf.direction = DMA_DEV_TO_MEM;
+ conf.src_addr = drv_data->udma_in_phys;
+ conf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ if (dmaengine_slave_config(drv_data->dma_rx_channel, &conf)) {
+@@ -689,7 +689,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
+
+ /* Configure transmit channel direction and destination address */
+ memset(&conf, 0, sizeof(conf));
+- conf.direction = DMA_TO_DEVICE;
++ conf.direction = DMA_MEM_TO_DEV;
+ conf.dst_addr = drv_data->udma_out_phys;
+ conf.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ if (dmaengine_slave_config(drv_data->dma_tx_channel, &conf)) {
+diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
+index a84c5573cabe..ed344eb717cc 100644
+--- a/drivers/clk/Makefile
++++ b/drivers/clk/Makefile
+@@ -73,6 +73,7 @@ obj-$(CONFIG_ARCH_HISI) += hisilicon/
+ obj-y += imgtec/
+ obj-$(CONFIG_ARCH_MXC) += imx/
+ obj-$(CONFIG_MACH_INGENIC) += ingenic/
++obj-$(CONFIG_ARCH_K3) += keystone/
+ obj-$(CONFIG_ARCH_KEYSTONE) += keystone/
+ obj-$(CONFIG_MACH_LOONGSON32) += loongson1/
+ obj-y += mediatek/
+diff --git a/drivers/clk/keystone/Kconfig b/drivers/clk/keystone/Kconfig
+index 7e9f0176578a..b04927d06cd1 100644
+--- a/drivers/clk/keystone/Kconfig
++++ b/drivers/clk/keystone/Kconfig
+@@ -7,7 +7,7 @@ config COMMON_CLK_KEYSTONE
+
+ config TI_SCI_CLK
+ tristate "TI System Control Interface clock drivers"
+- depends on (ARCH_KEYSTONE || COMPILE_TEST) && OF
++ depends on (ARCH_KEYSTONE || ARCH_K3 || COMPILE_TEST) && OF
+ depends on TI_SCI_PROTOCOL
+ default ARCH_KEYSTONE
+ ---help---
+diff --git a/drivers/clk/samsung/clk-cpu.c b/drivers/clk/samsung/clk-cpu.c
+index d2c99d8916b8..a5fddebbe530 100644
+--- a/drivers/clk/samsung/clk-cpu.c
++++ b/drivers/clk/samsung/clk-cpu.c
+@@ -152,7 +152,7 @@ static int exynos_cpuclk_pre_rate_change(struct clk_notifier_data *ndata,
+ struct exynos_cpuclk *cpuclk, void __iomem *base)
+ {
+ const struct exynos_cpuclk_cfg_data *cfg_data = cpuclk->cfg;
+- unsigned long alt_prate = clk_get_rate(cpuclk->alt_parent);
++ unsigned long alt_prate = clk_hw_get_rate(cpuclk->alt_parent);
+ unsigned long alt_div = 0, alt_div_mask = DIV_MASK;
+ unsigned long div0, div1 = 0, mux_reg;
+ unsigned long flags;
+@@ -280,7 +280,7 @@ static int exynos5433_cpuclk_pre_rate_change(struct clk_notifier_data *ndata,
+ struct exynos_cpuclk *cpuclk, void __iomem *base)
+ {
+ const struct exynos_cpuclk_cfg_data *cfg_data = cpuclk->cfg;
+- unsigned long alt_prate = clk_get_rate(cpuclk->alt_parent);
++ unsigned long alt_prate = clk_hw_get_rate(cpuclk->alt_parent);
+ unsigned long alt_div = 0, alt_div_mask = DIV_MASK;
+ unsigned long div0, div1 = 0, mux_reg;
+ unsigned long flags;
+@@ -432,7 +432,7 @@ int __init exynos_register_cpu_clock(struct samsung_clk_provider *ctx,
+ else
+ cpuclk->clk_nb.notifier_call = exynos_cpuclk_notifier_cb;
+
+- cpuclk->alt_parent = __clk_lookup(alt_parent);
++ cpuclk->alt_parent = __clk_get_hw(__clk_lookup(alt_parent));
+ if (!cpuclk->alt_parent) {
+ pr_err("%s: could not lookup alternate parent %s\n",
+ __func__, alt_parent);
+diff --git a/drivers/clk/samsung/clk-cpu.h b/drivers/clk/samsung/clk-cpu.h
+index d4b6b517fe1b..bd38c6aa3897 100644
+--- a/drivers/clk/samsung/clk-cpu.h
++++ b/drivers/clk/samsung/clk-cpu.h
+@@ -49,7 +49,7 @@ struct exynos_cpuclk_cfg_data {
+ */
+ struct exynos_cpuclk {
+ struct clk_hw hw;
+- struct clk *alt_parent;
++ struct clk_hw *alt_parent;
+ void __iomem *ctrl_base;
+ spinlock_t *lock;
+ const struct exynos_cpuclk_cfg_data *cfg;
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index d4f77c4eb277..ce30862617a6 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -634,6 +634,7 @@ static const struct samsung_div_clock exynos5420_div_clks[] __initconst = {
+ };
+
+ static const struct samsung_gate_clock exynos5420_gate_clks[] __initconst = {
++ GATE(CLK_SECKEY, "seckey", "aclk66_psgen", GATE_BUS_PERIS1, 1, 0, 0),
+ GATE(CLK_MAU_EPLL, "mau_epll", "mout_mau_epll_clk",
+ SRC_MASK_TOP7, 20, CLK_SET_RATE_PARENT, 0),
+ };
+@@ -1163,8 +1164,6 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
+ GATE(CLK_TMU, "tmu", "aclk66_psgen", GATE_IP_PERIS, 21, 0, 0),
+ GATE(CLK_TMU_GPU, "tmu_gpu", "aclk66_psgen", GATE_IP_PERIS, 22, 0, 0),
+
+- GATE(CLK_SECKEY, "seckey", "aclk66_psgen", GATE_BUS_PERIS1, 1, 0, 0),
+-
+ /* GEN Block */
+ GATE(CLK_ROTATOR, "rotator", "mout_user_aclk266", GATE_IP_GEN, 1, 0, 0),
+ GATE(CLK_JPEG, "jpeg", "aclk300_jpeg", GATE_IP_GEN, 2, 0, 0),
+diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
+index 162de44df099..426980514e67 100644
+--- a/drivers/clk/samsung/clk-exynos5433.c
++++ b/drivers/clk/samsung/clk-exynos5433.c
+@@ -5630,7 +5630,7 @@ static const struct of_device_id exynos5433_cmu_of_match[] = {
+ static const struct dev_pm_ops exynos5433_cmu_pm_ops = {
+ SET_RUNTIME_PM_OPS(exynos5433_cmu_suspend, exynos5433_cmu_resume,
+ NULL)
+- SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
++ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+ pm_runtime_force_resume)
+ };
+
+diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
+index bbbf37c471a3..cec90a4c79b3 100644
+--- a/drivers/clocksource/sh_cmt.c
++++ b/drivers/clocksource/sh_cmt.c
+@@ -78,18 +78,17 @@ struct sh_cmt_info {
+ unsigned int channels_mask;
+
+ unsigned long width; /* 16 or 32 bit version of hardware block */
+- unsigned long overflow_bit;
+- unsigned long clear_bits;
++ u32 overflow_bit;
++ u32 clear_bits;
+
+ /* callbacks for CMSTR and CMCSR access */
+- unsigned long (*read_control)(void __iomem *base, unsigned long offs);
++ u32 (*read_control)(void __iomem *base, unsigned long offs);
+ void (*write_control)(void __iomem *base, unsigned long offs,
+- unsigned long value);
++ u32 value);
+
+ /* callbacks for CMCNT and CMCOR access */
+- unsigned long (*read_count)(void __iomem *base, unsigned long offs);
+- void (*write_count)(void __iomem *base, unsigned long offs,
+- unsigned long value);
++ u32 (*read_count)(void __iomem *base, unsigned long offs);
++ void (*write_count)(void __iomem *base, unsigned long offs, u32 value);
+ };
+
+ struct sh_cmt_channel {
+@@ -103,13 +102,13 @@ struct sh_cmt_channel {
+
+ unsigned int timer_bit;
+ unsigned long flags;
+- unsigned long match_value;
+- unsigned long next_match_value;
+- unsigned long max_match_value;
++ u32 match_value;
++ u32 next_match_value;
++ u32 max_match_value;
+ raw_spinlock_t lock;
+ struct clock_event_device ced;
+ struct clocksource cs;
+- unsigned long total_cycles;
++ u64 total_cycles;
+ bool cs_enabled;
+ };
+
+@@ -160,24 +159,22 @@ struct sh_cmt_device {
+ #define SH_CMT32_CMCSR_CKS_RCLK1 (7 << 0)
+ #define SH_CMT32_CMCSR_CKS_MASK (7 << 0)
+
+-static unsigned long sh_cmt_read16(void __iomem *base, unsigned long offs)
++static u32 sh_cmt_read16(void __iomem *base, unsigned long offs)
+ {
+ return ioread16(base + (offs << 1));
+ }
+
+-static unsigned long sh_cmt_read32(void __iomem *base, unsigned long offs)
++static u32 sh_cmt_read32(void __iomem *base, unsigned long offs)
+ {
+ return ioread32(base + (offs << 2));
+ }
+
+-static void sh_cmt_write16(void __iomem *base, unsigned long offs,
+- unsigned long value)
++static void sh_cmt_write16(void __iomem *base, unsigned long offs, u32 value)
+ {
+ iowrite16(value, base + (offs << 1));
+ }
+
+-static void sh_cmt_write32(void __iomem *base, unsigned long offs,
+- unsigned long value)
++static void sh_cmt_write32(void __iomem *base, unsigned long offs, u32 value)
+ {
+ iowrite32(value, base + (offs << 2));
+ }
+@@ -242,7 +239,7 @@ static const struct sh_cmt_info sh_cmt_info[] = {
+ #define CMCNT 1 /* channel register */
+ #define CMCOR 2 /* channel register */
+
+-static inline unsigned long sh_cmt_read_cmstr(struct sh_cmt_channel *ch)
++static inline u32 sh_cmt_read_cmstr(struct sh_cmt_channel *ch)
+ {
+ if (ch->iostart)
+ return ch->cmt->info->read_control(ch->iostart, 0);
+@@ -250,8 +247,7 @@ static inline unsigned long sh_cmt_read_cmstr(struct sh_cmt_channel *ch)
+ return ch->cmt->info->read_control(ch->cmt->mapbase, 0);
+ }
+
+-static inline void sh_cmt_write_cmstr(struct sh_cmt_channel *ch,
+- unsigned long value)
++static inline void sh_cmt_write_cmstr(struct sh_cmt_channel *ch, u32 value)
+ {
+ if (ch->iostart)
+ ch->cmt->info->write_control(ch->iostart, 0, value);
+@@ -259,39 +255,35 @@ static inline void sh_cmt_write_cmstr(struct sh_cmt_channel *ch,
+ ch->cmt->info->write_control(ch->cmt->mapbase, 0, value);
+ }
+
+-static inline unsigned long sh_cmt_read_cmcsr(struct sh_cmt_channel *ch)
++static inline u32 sh_cmt_read_cmcsr(struct sh_cmt_channel *ch)
+ {
+ return ch->cmt->info->read_control(ch->ioctrl, CMCSR);
+ }
+
+-static inline void sh_cmt_write_cmcsr(struct sh_cmt_channel *ch,
+- unsigned long value)
++static inline void sh_cmt_write_cmcsr(struct sh_cmt_channel *ch, u32 value)
+ {
+ ch->cmt->info->write_control(ch->ioctrl, CMCSR, value);
+ }
+
+-static inline unsigned long sh_cmt_read_cmcnt(struct sh_cmt_channel *ch)
++static inline u32 sh_cmt_read_cmcnt(struct sh_cmt_channel *ch)
+ {
+ return ch->cmt->info->read_count(ch->ioctrl, CMCNT);
+ }
+
+-static inline void sh_cmt_write_cmcnt(struct sh_cmt_channel *ch,
+- unsigned long value)
++static inline void sh_cmt_write_cmcnt(struct sh_cmt_channel *ch, u32 value)
+ {
+ ch->cmt->info->write_count(ch->ioctrl, CMCNT, value);
+ }
+
+-static inline void sh_cmt_write_cmcor(struct sh_cmt_channel *ch,
+- unsigned long value)
++static inline void sh_cmt_write_cmcor(struct sh_cmt_channel *ch, u32 value)
+ {
+ ch->cmt->info->write_count(ch->ioctrl, CMCOR, value);
+ }
+
+-static unsigned long sh_cmt_get_counter(struct sh_cmt_channel *ch,
+- int *has_wrapped)
++static u32 sh_cmt_get_counter(struct sh_cmt_channel *ch, u32 *has_wrapped)
+ {
+- unsigned long v1, v2, v3;
+- int o1, o2;
++ u32 v1, v2, v3;
++ u32 o1, o2;
+
+ o1 = sh_cmt_read_cmcsr(ch) & ch->cmt->info->overflow_bit;
+
+@@ -311,7 +303,8 @@ static unsigned long sh_cmt_get_counter(struct sh_cmt_channel *ch,
+
+ static void sh_cmt_start_stop_ch(struct sh_cmt_channel *ch, int start)
+ {
+- unsigned long flags, value;
++ unsigned long flags;
++ u32 value;
+
+ /* start stop register shared by multiple timer channels */
+ raw_spin_lock_irqsave(&ch->cmt->lock, flags);
+@@ -418,11 +411,11 @@ static void sh_cmt_disable(struct sh_cmt_channel *ch)
+ static void sh_cmt_clock_event_program_verify(struct sh_cmt_channel *ch,
+ int absolute)
+ {
+- unsigned long new_match;
+- unsigned long value = ch->next_match_value;
+- unsigned long delay = 0;
+- unsigned long now = 0;
+- int has_wrapped;
++ u32 value = ch->next_match_value;
++ u32 new_match;
++ u32 delay = 0;
++ u32 now = 0;
++ u32 has_wrapped;
+
+ now = sh_cmt_get_counter(ch, &has_wrapped);
+ ch->flags |= FLAG_REPROGRAM; /* force reprogram */
+@@ -619,9 +612,10 @@ static struct sh_cmt_channel *cs_to_sh_cmt(struct clocksource *cs)
+ static u64 sh_cmt_clocksource_read(struct clocksource *cs)
+ {
+ struct sh_cmt_channel *ch = cs_to_sh_cmt(cs);
+- unsigned long flags, raw;
+- unsigned long value;
+- int has_wrapped;
++ unsigned long flags;
++ u32 has_wrapped;
++ u64 value;
++ u32 raw;
+
+ raw_spin_lock_irqsave(&ch->lock, flags);
+ value = ch->total_cycles;
+@@ -694,7 +688,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_channel *ch,
+ cs->disable = sh_cmt_clocksource_disable;
+ cs->suspend = sh_cmt_clocksource_suspend;
+ cs->resume = sh_cmt_clocksource_resume;
+- cs->mask = CLOCKSOURCE_MASK(sizeof(unsigned long) * 8);
++ cs->mask = CLOCKSOURCE_MASK(sizeof(u64) * 8);
+ cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
+
+ dev_info(&ch->cmt->pdev->dev, "ch%u: used as clock source\n",
+diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
+index e26a40971b26..6d7f6b9bb373 100644
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -512,6 +512,16 @@ static void menu_update(struct cpuidle_driver *drv, struct cpuidle_device *dev)
+ * duration predictor do a better job next time.
+ */
+ measured_us = 9 * MAX_INTERESTING / 10;
++ } else if ((drv->states[last_idx].flags & CPUIDLE_FLAG_POLLING) &&
++ dev->poll_time_limit) {
++ /*
++ * The CPU exited the "polling" state due to a time limit, so
++ * the idle duration prediction leading to the selection of that
++ * state was inaccurate. If a better prediction had been made,
++ * the CPU might have been woken up from idle by the next timer.
++ * Assume that to be the case.
++ */
++ measured_us = data->next_timer_us;
+ } else {
+ /* measured value */
+ measured_us = cpuidle_get_last_residency(dev);
+diff --git a/drivers/cpuidle/poll_state.c b/drivers/cpuidle/poll_state.c
+index 3f86d23c592e..36ff5a1d9422 100644
+--- a/drivers/cpuidle/poll_state.c
++++ b/drivers/cpuidle/poll_state.c
+@@ -17,6 +17,8 @@ static int __cpuidle poll_idle(struct cpuidle_device *dev,
+ {
+ u64 time_start = local_clock();
+
++ dev->poll_time_limit = false;
++
+ local_irq_enable();
+ if (!current_set_polling_and_test()) {
+ unsigned int loop_count = 0;
+@@ -27,8 +29,10 @@ static int __cpuidle poll_idle(struct cpuidle_device *dev,
+ continue;
+
+ loop_count = 0;
+- if (local_clock() - time_start > POLL_IDLE_TIME_LIMIT)
++ if (local_clock() - time_start > POLL_IDLE_TIME_LIMIT) {
++ dev->poll_time_limit = true;
+ break;
++ }
+ }
+ }
+ current_clr_polling();
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index 56bd28174f52..b926098f70ff 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -28,9 +28,24 @@
+
+ #define DCP_MAX_CHANS 4
+ #define DCP_BUF_SZ PAGE_SIZE
++#define DCP_SHA_PAY_SZ 64
+
+ #define DCP_ALIGNMENT 64
+
++/*
++ * Null hashes to align with hw behavior on imx6sl and ull
++ * these are flipped for consistency with hw output
++ */
++const uint8_t sha1_null_hash[] =
++ "\x09\x07\xd8\xaf\x90\x18\x60\x95\xef\xbf"
++ "\x55\x32\x0d\x4b\x6b\x5e\xee\xa3\x39\xda";
++
++const uint8_t sha256_null_hash[] =
++ "\x55\xb8\x52\x78\x1b\x99\x95\xa4"
++ "\x4c\x93\x9b\x64\xe4\x41\xae\x27"
++ "\x24\xb9\x6f\x99\xc8\xf4\xfb\x9a"
++ "\x14\x1c\xfc\x98\x42\xc4\xb0\xe3";
++
+ /* DCP DMA descriptor. */
+ struct dcp_dma_desc {
+ uint32_t next_cmd_addr;
+@@ -48,6 +63,7 @@ struct dcp_coherent_block {
+ uint8_t aes_in_buf[DCP_BUF_SZ];
+ uint8_t aes_out_buf[DCP_BUF_SZ];
+ uint8_t sha_in_buf[DCP_BUF_SZ];
++ uint8_t sha_out_buf[DCP_SHA_PAY_SZ];
+
+ uint8_t aes_key[2 * AES_KEYSIZE_128];
+
+@@ -209,6 +225,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
+ dma_addr_t dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf,
+ DCP_BUF_SZ, DMA_FROM_DEVICE);
+
++ if (actx->fill % AES_BLOCK_SIZE) {
++ dev_err(sdcp->dev, "Invalid block size!\n");
++ ret = -EINVAL;
++ goto aes_done_run;
++ }
++
+ /* Fill in the DMA descriptor. */
+ desc->control0 = MXS_DCP_CONTROL0_DECR_SEMAPHORE |
+ MXS_DCP_CONTROL0_INTERRUPT |
+@@ -238,6 +260,7 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
+
+ ret = mxs_dcp_start_dma(actx);
+
++aes_done_run:
+ dma_unmap_single(sdcp->dev, key_phys, 2 * AES_KEYSIZE_128,
+ DMA_TO_DEVICE);
+ dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
+@@ -264,13 +287,15 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+
+ uint8_t *out_tmp, *src_buf, *dst_buf = NULL;
+ uint32_t dst_off = 0;
++ uint32_t last_out_len = 0;
+
+ uint8_t *key = sdcp->coh->aes_key;
+
+ int ret = 0;
+ int split = 0;
+- unsigned int i, len, clen, rem = 0;
++ unsigned int i, len, clen, rem = 0, tlen = 0;
+ int init = 0;
++ bool limit_hit = false;
+
+ actx->fill = 0;
+
+@@ -289,6 +314,11 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ for_each_sg(req->src, src, nents, i) {
+ src_buf = sg_virt(src);
+ len = sg_dma_len(src);
++ tlen += len;
++ limit_hit = tlen > req->nbytes;
++
++ if (limit_hit)
++ len = req->nbytes - (tlen - len);
+
+ do {
+ if (actx->fill + len > out_off)
+@@ -305,13 +335,15 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ * If we filled the buffer or this is the last SG,
+ * submit the buffer.
+ */
+- if (actx->fill == out_off || sg_is_last(src)) {
++ if (actx->fill == out_off || sg_is_last(src) ||
++ limit_hit) {
+ ret = mxs_dcp_run_aes(actx, req, init);
+ if (ret)
+ return ret;
+ init = 0;
+
+ out_tmp = out_buf;
++ last_out_len = actx->fill;
+ while (dst && actx->fill) {
+ if (!split) {
+ dst_buf = sg_virt(dst);
+@@ -334,6 +366,19 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ }
+ }
+ } while (len);
++
++ if (limit_hit)
++ break;
++ }
++
++ /* Copy the IV for CBC for chaining */
++ if (!rctx->ecb) {
++ if (rctx->enc)
++ memcpy(req->info, out_buf+(last_out_len-AES_BLOCK_SIZE),
++ AES_BLOCK_SIZE);
++ else
++ memcpy(req->info, in_buf+(last_out_len-AES_BLOCK_SIZE),
++ AES_BLOCK_SIZE);
+ }
+
+ return ret;
+@@ -513,8 +558,6 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+ struct dcp_async_ctx *actx = crypto_ahash_ctx(tfm);
+ struct dcp_sha_req_ctx *rctx = ahash_request_ctx(req);
+- struct hash_alg_common *halg = crypto_hash_alg_common(tfm);
+-
+ struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];
+
+ dma_addr_t digest_phys = 0;
+@@ -536,10 +579,23 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
+ desc->payload = 0;
+ desc->status = 0;
+
++ /*
++ * Align driver with hw behavior when generating null hashes
++ */
++ if (rctx->init && rctx->fini && desc->size == 0) {
++ struct hash_alg_common *halg = crypto_hash_alg_common(tfm);
++ const uint8_t *sha_buf =
++ (actx->alg == MXS_DCP_CONTROL1_HASH_SELECT_SHA1) ?
++ sha1_null_hash : sha256_null_hash;
++ memcpy(sdcp->coh->sha_out_buf, sha_buf, halg->digestsize);
++ ret = 0;
++ goto done_run;
++ }
++
+ /* Set HASH_TERM bit for last transfer block. */
+ if (rctx->fini) {
+- digest_phys = dma_map_single(sdcp->dev, req->result,
+- halg->digestsize, DMA_FROM_DEVICE);
++ digest_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_out_buf,
++ DCP_SHA_PAY_SZ, DMA_FROM_DEVICE);
+ desc->control0 |= MXS_DCP_CONTROL0_HASH_TERM;
+ desc->payload = digest_phys;
+ }
+@@ -547,9 +603,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
+ ret = mxs_dcp_start_dma(actx);
+
+ if (rctx->fini)
+- dma_unmap_single(sdcp->dev, digest_phys, halg->digestsize,
++ dma_unmap_single(sdcp->dev, digest_phys, DCP_SHA_PAY_SZ,
+ DMA_FROM_DEVICE);
+
++done_run:
+ dma_unmap_single(sdcp->dev, buf_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
+
+ return ret;
+@@ -567,6 +624,7 @@ static int dcp_sha_req_to_buf(struct crypto_async_request *arq)
+ const int nents = sg_nents(req->src);
+
+ uint8_t *in_buf = sdcp->coh->sha_in_buf;
++ uint8_t *out_buf = sdcp->coh->sha_out_buf;
+
+ uint8_t *src_buf;
+
+@@ -621,11 +679,9 @@ static int dcp_sha_req_to_buf(struct crypto_async_request *arq)
+
+ actx->fill = 0;
+
+- /* For some reason, the result is flipped. */
+- for (i = 0; i < halg->digestsize / 2; i++) {
+- swap(req->result[i],
+- req->result[halg->digestsize - i - 1]);
+- }
++ /* For some reason the result is flipped */
++ for (i = 0; i < halg->digestsize; i++)
++ req->result[i] = out_buf[halg->digestsize - i - 1];
+ }
+
+ return 0;
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 4c49bb1330b5..e2ab46bfa666 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -11,6 +11,7 @@
+ */
+
+ #include <linux/kernel.h>
++#include <linux/kmod.h>
+ #include <linux/sched.h>
+ #include <linux/errno.h>
+ #include <linux/err.h>
+@@ -221,6 +222,49 @@ static struct devfreq_governor *find_devfreq_governor(const char *name)
+ return ERR_PTR(-ENODEV);
+ }
+
++/**
++ * try_then_request_governor() - Try to find the governor and request the
++ * module if is not found.
++ * @name: name of the governor
++ *
++ * Search the list of devfreq governors and request the module and try again
++ * if is not found. This can happen when both drivers (the governor driver
++ * and the driver that call devfreq_add_device) are built as modules.
++ * devfreq_list_lock should be held by the caller. Returns the matched
++ * governor's pointer or an error pointer.
++ */
++static struct devfreq_governor *try_then_request_governor(const char *name)
++{
++ struct devfreq_governor *governor;
++ int err = 0;
++
++ if (IS_ERR_OR_NULL(name)) {
++ pr_err("DEVFREQ: %s: Invalid parameters\n", __func__);
++ return ERR_PTR(-EINVAL);
++ }
++ WARN(!mutex_is_locked(&devfreq_list_lock),
++ "devfreq_list_lock must be locked.");
++
++ governor = find_devfreq_governor(name);
++ if (IS_ERR(governor)) {
++ mutex_unlock(&devfreq_list_lock);
++
++ if (!strncmp(name, DEVFREQ_GOV_SIMPLE_ONDEMAND,
++ DEVFREQ_NAME_LEN))
++ err = request_module("governor_%s", "simpleondemand");
++ else
++ err = request_module("governor_%s", name);
++ /* Restore previous state before return */
++ mutex_lock(&devfreq_list_lock);
++ if (err)
++ return ERR_PTR(err);
++
++ governor = find_devfreq_governor(name);
++ }
++
++ return governor;
++}
++
+ static int devfreq_notify_transition(struct devfreq *devfreq,
+ struct devfreq_freqs *freqs, unsigned int state)
+ {
+@@ -283,11 +327,11 @@ int update_devfreq(struct devfreq *devfreq)
+ max_freq = MIN(devfreq->scaling_max_freq, devfreq->max_freq);
+ min_freq = MAX(devfreq->scaling_min_freq, devfreq->min_freq);
+
+- if (min_freq && freq < min_freq) {
++ if (freq < min_freq) {
+ freq = min_freq;
+ flags &= ~DEVFREQ_FLAG_LEAST_UPPER_BOUND; /* Use GLB */
+ }
+- if (max_freq && freq > max_freq) {
++ if (freq > max_freq) {
+ freq = max_freq;
+ flags |= DEVFREQ_FLAG_LEAST_UPPER_BOUND; /* Use LUB */
+ }
+@@ -534,10 +578,6 @@ static void devfreq_dev_release(struct device *dev)
+ list_del(&devfreq->node);
+ mutex_unlock(&devfreq_list_lock);
+
+- if (devfreq->governor)
+- devfreq->governor->event_handler(devfreq,
+- DEVFREQ_GOV_STOP, NULL);
+-
+ if (devfreq->profile->exit)
+ devfreq->profile->exit(devfreq->dev.parent);
+
+@@ -646,9 +686,8 @@ struct devfreq *devfreq_add_device(struct device *dev,
+ mutex_unlock(&devfreq->lock);
+
+ mutex_lock(&devfreq_list_lock);
+- list_add(&devfreq->node, &devfreq_list);
+
+- governor = find_devfreq_governor(devfreq->governor_name);
++ governor = try_then_request_governor(devfreq->governor_name);
+ if (IS_ERR(governor)) {
+ dev_err(dev, "%s: Unable to find governor for the device\n",
+ __func__);
+@@ -664,15 +703,17 @@ struct devfreq *devfreq_add_device(struct device *dev,
+ __func__);
+ goto err_init;
+ }
++
++ list_add(&devfreq->node, &devfreq_list);
++
+ mutex_unlock(&devfreq_list_lock);
+
+ return devfreq;
+
+ err_init:
+- list_del(&devfreq->node);
+ mutex_unlock(&devfreq_list_lock);
+
+- device_unregister(&devfreq->dev);
++ devfreq_remove_device(devfreq);
+ devfreq = NULL;
+ err_dev:
+ if (devfreq)
+@@ -693,6 +734,9 @@ int devfreq_remove_device(struct devfreq *devfreq)
+ if (!devfreq)
+ return -EINVAL;
+
++ if (devfreq->governor)
++ devfreq->governor->event_handler(devfreq,
++ DEVFREQ_GOV_STOP, NULL);
+ device_unregister(&devfreq->dev);
+
+ return 0;
+@@ -991,7 +1035,7 @@ static ssize_t governor_store(struct device *dev, struct device_attribute *attr,
+ return -EINVAL;
+
+ mutex_lock(&devfreq_list_lock);
+- governor = find_devfreq_governor(str_governor);
++ governor = try_then_request_governor(str_governor);
+ if (IS_ERR(governor)) {
+ ret = PTR_ERR(governor);
+ goto out;
+@@ -1126,17 +1170,26 @@ static ssize_t min_freq_store(struct device *dev, struct device_attribute *attr,
+ struct devfreq *df = to_devfreq(dev);
+ unsigned long value;
+ int ret;
+- unsigned long max;
+
+ ret = sscanf(buf, "%lu", &value);
+ if (ret != 1)
+ return -EINVAL;
+
+ mutex_lock(&df->lock);
+- max = df->max_freq;
+- if (value && max && value > max) {
+- ret = -EINVAL;
+- goto unlock;
++
++ if (value) {
++ if (value > df->max_freq) {
++ ret = -EINVAL;
++ goto unlock;
++ }
++ } else {
++ unsigned long *freq_table = df->profile->freq_table;
++
++ /* Get minimum frequency according to sorting order */
++ if (freq_table[0] < freq_table[df->profile->max_state - 1])
++ value = freq_table[0];
++ else
++ value = freq_table[df->profile->max_state - 1];
+ }
+
+ df->min_freq = value;
+@@ -1161,17 +1214,26 @@ static ssize_t max_freq_store(struct device *dev, struct device_attribute *attr,
+ struct devfreq *df = to_devfreq(dev);
+ unsigned long value;
+ int ret;
+- unsigned long min;
+
+ ret = sscanf(buf, "%lu", &value);
+ if (ret != 1)
+ return -EINVAL;
+
+ mutex_lock(&df->lock);
+- min = df->min_freq;
+- if (value && min && value < min) {
+- ret = -EINVAL;
+- goto unlock;
++
++ if (value) {
++ if (value < df->min_freq) {
++ ret = -EINVAL;
++ goto unlock;
++ }
++ } else {
++ unsigned long *freq_table = df->profile->freq_table;
++
++ /* Get maximum frequency according to sorting order */
++ if (freq_table[0] < freq_table[df->profile->max_state - 1])
++ value = freq_table[df->profile->max_state - 1];
++ else
++ value = freq_table[0];
+ }
+
+ df->max_freq = value;
+diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
+index 21a5708985bc..0fec3c554fe3 100644
+--- a/drivers/dma/ioat/init.c
++++ b/drivers/dma/ioat/init.c
+@@ -129,7 +129,7 @@ static void
+ ioat_init_channel(struct ioatdma_device *ioat_dma,
+ struct ioatdma_chan *ioat_chan, int idx);
+ static void ioat_intr_quirk(struct ioatdma_device *ioat_dma);
+-static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma);
++static void ioat_enumerate_channels(struct ioatdma_device *ioat_dma);
+ static int ioat3_dma_self_test(struct ioatdma_device *ioat_dma);
+
+ static int ioat_dca_enabled = 1;
+@@ -575,7 +575,7 @@ static void ioat_dma_remove(struct ioatdma_device *ioat_dma)
+ * ioat_enumerate_channels - find and initialize the device's channels
+ * @ioat_dma: the ioat dma device to be enumerated
+ */
+-static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma)
++static void ioat_enumerate_channels(struct ioatdma_device *ioat_dma)
+ {
+ struct ioatdma_chan *ioat_chan;
+ struct device *dev = &ioat_dma->pdev->dev;
+@@ -594,7 +594,7 @@ static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma)
+ xfercap_log = readb(ioat_dma->reg_base + IOAT_XFERCAP_OFFSET);
+ xfercap_log &= 0x1f; /* bits [4:0] valid */
+ if (xfercap_log == 0)
+- return 0;
++ return;
+ dev_dbg(dev, "%s: xfercap = %d\n", __func__, 1 << xfercap_log);
+
+ for (i = 0; i < dma->chancnt; i++) {
+@@ -611,7 +611,6 @@ static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma)
+ }
+ }
+ dma->chancnt = i;
+- return i;
+ }
+
+ /**
+diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
+index 041ce864097e..80ff95f75199 100644
+--- a/drivers/dma/sh/rcar-dmac.c
++++ b/drivers/dma/sh/rcar-dmac.c
+@@ -198,6 +198,7 @@ struct rcar_dmac {
+ struct dma_device engine;
+ struct device *dev;
+ void __iomem *iomem;
++ struct device_dma_parameters parms;
+
+ unsigned int n_channels;
+ struct rcar_dmac_chan *channels;
+@@ -1814,6 +1815,8 @@ static int rcar_dmac_probe(struct platform_device *pdev)
+
+ dmac->dev = &pdev->dev;
+ platform_set_drvdata(pdev, dmac);
++ dmac->dev->dma_parms = &dmac->parms;
++ dma_set_max_seg_size(dmac->dev, RCAR_DMATCR_MASK);
+ dma_set_mask_and_coherent(dmac->dev, DMA_BIT_MASK(40));
+
+ ret = rcar_dmac_parse_of(&pdev->dev, dmac);
+diff --git a/drivers/dma/timb_dma.c b/drivers/dma/timb_dma.c
+index 395c698edb4d..fc0f9c8766a8 100644
+--- a/drivers/dma/timb_dma.c
++++ b/drivers/dma/timb_dma.c
+@@ -545,7 +545,7 @@ static struct dma_async_tx_descriptor *td_prep_slave_sg(struct dma_chan *chan,
+ }
+
+ dma_sync_single_for_device(chan2dmadev(chan), td_desc->txd.phys,
+- td_desc->desc_list_len, DMA_MEM_TO_DEV);
++ td_desc->desc_list_len, DMA_TO_DEVICE);
+
+ return &td_desc->txd;
+ }
+diff --git a/drivers/gpio/gpio-syscon.c b/drivers/gpio/gpio-syscon.c
+index 87c18a544513..7f3da34c7874 100644
+--- a/drivers/gpio/gpio-syscon.c
++++ b/drivers/gpio/gpio-syscon.c
+@@ -122,7 +122,7 @@ static int syscon_gpio_dir_out(struct gpio_chip *chip, unsigned offset, int val)
+ BIT(offs % SYSCON_REG_BITS));
+ }
+
+- priv->data->set(chip, offset, val);
++ chip->set(chip, offset, val);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+index 9acb9dfaf57e..9cde79a7335c 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+@@ -1140,7 +1140,7 @@ int a6xx_gmu_probe(struct a6xx_gpu *a6xx_gpu, struct device_node *node)
+
+ gmu->dev = &pdev->dev;
+
+- of_dma_configure(gmu->dev, node, false);
++ of_dma_configure(gmu->dev, node, true);
+
+ /* Fow now, don't do anything fancy until we get our feet under us */
+ gmu->idle_level = GMU_IDLE_STATE_ACTIVE;
+diff --git a/drivers/hwmon/ina3221.c b/drivers/hwmon/ina3221.c
+index e6b49500c52a..8c9555313fc3 100644
+--- a/drivers/hwmon/ina3221.c
++++ b/drivers/hwmon/ina3221.c
+@@ -38,9 +38,9 @@
+ #define INA3221_WARN3 0x0c
+ #define INA3221_MASK_ENABLE 0x0f
+
+-#define INA3221_CONFIG_MODE_SHUNT BIT(1)
+-#define INA3221_CONFIG_MODE_BUS BIT(2)
+-#define INA3221_CONFIG_MODE_CONTINUOUS BIT(3)
++#define INA3221_CONFIG_MODE_SHUNT BIT(0)
++#define INA3221_CONFIG_MODE_BUS BIT(1)
++#define INA3221_CONFIG_MODE_CONTINUOUS BIT(2)
+
+ #define INA3221_RSHUNT_DEFAULT 10000
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index bb15d7816a29..2cef0c37ff6f 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -325,8 +325,9 @@ static int k10temp_probe(struct pci_dev *pdev,
+
+ data->pdev = pdev;
+
+- if (boot_cpu_data.x86 == 0x15 && (boot_cpu_data.x86_model == 0x60 ||
+- boot_cpu_data.x86_model == 0x70)) {
++ if (boot_cpu_data.x86 == 0x15 &&
++ ((boot_cpu_data.x86_model & 0xf0) == 0x60 ||
++ (boot_cpu_data.x86_model & 0xf0) == 0x70)) {
+ data->read_htcreg = read_htcreg_nb_f15;
+ data->read_tempreg = read_tempreg_nb_f15;
+ } else if (boot_cpu_data.x86 == 0x17) {
+diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
+index eba692cddbde..559101a1c136 100644
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -704,10 +704,10 @@ static const char *const nct6795_temp_label[] = {
+ "PCH_CHIP_TEMP",
+ "PCH_CPU_TEMP",
+ "PCH_MCH_TEMP",
+- "PCH_DIM0_TEMP",
+- "PCH_DIM1_TEMP",
+- "PCH_DIM2_TEMP",
+- "PCH_DIM3_TEMP",
++ "Agent0 Dimm0",
++ "Agent0 Dimm1",
++ "Agent1 Dimm0",
++ "Agent1 Dimm1",
+ "BYTE_TEMP0",
+ "BYTE_TEMP1",
+ "PECI Agent 0 Calibration",
+@@ -742,10 +742,10 @@ static const char *const nct6796_temp_label[] = {
+ "PCH_CHIP_TEMP",
+ "PCH_CPU_TEMP",
+ "PCH_MCH_TEMP",
+- "PCH_DIM0_TEMP",
+- "PCH_DIM1_TEMP",
+- "PCH_DIM2_TEMP",
+- "PCH_DIM3_TEMP",
++ "Agent0 Dimm0",
++ "Agent0 Dimm1",
++ "Agent1 Dimm0",
++ "Agent1 Dimm1",
+ "BYTE_TEMP0",
+ "BYTE_TEMP1",
+ "PECI Agent 0 Calibration",
+diff --git a/drivers/hwmon/npcm750-pwm-fan.c b/drivers/hwmon/npcm750-pwm-fan.c
+index b998f9fbed41..979b579bc118 100644
+--- a/drivers/hwmon/npcm750-pwm-fan.c
++++ b/drivers/hwmon/npcm750-pwm-fan.c
+@@ -52,7 +52,7 @@
+
+ /* Define the Counter Register, value = 100 for match 100% */
+ #define NPCM7XX_PWM_COUNTER_DEFAULT_NUM 255
+-#define NPCM7XX_PWM_CMR_DEFAULT_NUM 127
++#define NPCM7XX_PWM_CMR_DEFAULT_NUM 255
+ #define NPCM7XX_PWM_CMR_MAX 255
+
+ /* default all PWM channels PRESCALE2 = 1 */
+diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
+index 7f01fad0d3e3..65de80bd63d8 100644
+--- a/drivers/hwmon/pwm-fan.c
++++ b/drivers/hwmon/pwm-fan.c
+@@ -221,8 +221,12 @@ static int pwm_fan_probe(struct platform_device *pdev)
+
+ ctx->pwm = devm_of_pwm_get(&pdev->dev, pdev->dev.of_node, NULL);
+ if (IS_ERR(ctx->pwm)) {
+- dev_err(&pdev->dev, "Could not get PWM\n");
+- return PTR_ERR(ctx->pwm);
++ ret = PTR_ERR(ctx->pwm);
++
++ if (ret != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "Could not get PWM: %d\n", ret);
++
++ return ret;
+ }
+
+ platform_set_drvdata(pdev, ctx);
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index 8f803812ea24..ee6dd1b84fac 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -433,12 +433,13 @@ config I2C_BCM_KONA
+ If you do not need KONA I2C interface, say N.
+
+ config I2C_BRCMSTB
+- tristate "BRCM Settop I2C controller"
+- depends on ARCH_BRCMSTB || BMIPS_GENERIC || COMPILE_TEST
++ tristate "BRCM Settop/DSL I2C controller"
++ depends on ARCH_BRCMSTB || BMIPS_GENERIC || ARCH_BCM_63XX || \
++ COMPILE_TEST
+ default y
+ help
+ If you say yes to this option, support will be included for the
+- I2C interface on the Broadcom Settop SoCs.
++ I2C interface on the Broadcom Settop/DSL SoCs.
+
+ If you do not need I2C interface, say N.
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index a74ef76705e0..2bb4d20ead32 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -503,7 +503,7 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ writel(I2C_DMA_INT_FLAG_NONE, i2c->pdmabase + OFFSET_INT_FLAG);
+ writel(I2C_DMA_CON_RX, i2c->pdmabase + OFFSET_CON);
+
+- dma_rd_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
++ dma_rd_buf = i2c_get_dma_safe_msg_buf(msgs, 1);
+ if (!dma_rd_buf)
+ return -ENOMEM;
+
+@@ -526,7 +526,7 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ writel(I2C_DMA_INT_FLAG_NONE, i2c->pdmabase + OFFSET_INT_FLAG);
+ writel(I2C_DMA_CON_TX, i2c->pdmabase + OFFSET_CON);
+
+- dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
++ dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 1);
+ if (!dma_wr_buf)
+ return -ENOMEM;
+
+@@ -549,7 +549,7 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_INT_FLAG);
+ writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_CON);
+
+- dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 0);
++ dma_wr_buf = i2c_get_dma_safe_msg_buf(msgs, 1);
+ if (!dma_wr_buf)
+ return -ENOMEM;
+
+@@ -561,7 +561,7 @@ static int mtk_i2c_do_transfer(struct mtk_i2c *i2c, struct i2c_msg *msgs,
+ return -ENOMEM;
+ }
+
+- dma_rd_buf = i2c_get_dma_safe_msg_buf((msgs + 1), 0);
++ dma_rd_buf = i2c_get_dma_safe_msg_buf((msgs + 1), 1);
+ if (!dma_rd_buf) {
+ dma_unmap_single(i2c->dev, wpaddr,
+ msgs->len, DMA_TO_DEVICE);
+diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
+index 2ac86096ddd9..cd9c65f3d404 100644
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -661,9 +661,6 @@ static int omap_i2c_xfer_msg(struct i2c_adapter *adap,
+ dev_dbg(omap->dev, "addr: 0x%04x, len: %d, flags: 0x%x, stop: %d\n",
+ msg->addr, msg->len, msg->flags, stop);
+
+- if (msg->len == 0)
+- return -EINVAL;
+-
+ omap->receiver = !!(msg->flags & I2C_M_RD);
+ omap_i2c_resize_fifo(omap, msg->len, omap->receiver);
+
+@@ -1179,6 +1176,10 @@ static const struct i2c_algorithm omap_i2c_algo = {
+ .functionality = omap_i2c_func,
+ };
+
++static const struct i2c_adapter_quirks omap_i2c_quirks = {
++ .flags = I2C_AQ_NO_ZERO_LEN,
++};
++
+ #ifdef CONFIG_OF
+ static struct omap_i2c_bus_platform_data omap2420_pdata = {
+ .rev = OMAP_I2C_IP_VERSION_1,
+@@ -1453,6 +1454,7 @@ omap_i2c_probe(struct platform_device *pdev)
+ adap->class = I2C_CLASS_DEPRECATED;
+ strlcpy(adap->name, "OMAP I2C adapter", sizeof(adap->name));
+ adap->algo = &omap_i2c_algo;
++ adap->quirks = &omap_i2c_quirks;
+ adap->dev.parent = &pdev->dev;
+ adap->dev.of_node = pdev->dev.of_node;
+ adap->bus_recovery_info = &omap_i2c_bus_recovery_info;
+diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
+index c86c3ae1318f..e09cd0775ae9 100644
+--- a/drivers/i2c/busses/i2c-qup.c
++++ b/drivers/i2c/busses/i2c-qup.c
+@@ -1088,11 +1088,6 @@ static int qup_i2c_xfer(struct i2c_adapter *adap,
+ writel(I2C_MINI_CORE | I2C_N_VAL, qup->base + QUP_CONFIG);
+
+ for (idx = 0; idx < num; idx++) {
+- if (msgs[idx].len == 0) {
+- ret = -EINVAL;
+- goto out;
+- }
+-
+ if (qup_i2c_poll_state_i2c_master(qup)) {
+ ret = -EIO;
+ goto out;
+@@ -1520,9 +1515,6 @@ qup_i2c_determine_mode_v2(struct qup_i2c_dev *qup,
+
+ /* All i2c_msgs should be transferred using either dma or cpu */
+ for (idx = 0; idx < num; idx++) {
+- if (msgs[idx].len == 0)
+- return -EINVAL;
+-
+ if (msgs[idx].flags & I2C_M_RD)
+ max_rx_len = max_t(unsigned int, max_rx_len,
+ msgs[idx].len);
+@@ -1636,9 +1628,14 @@ static const struct i2c_algorithm qup_i2c_algo_v2 = {
+ * which limits the possible read to 256 (QUP_READ_LIMIT) bytes.
+ */
+ static const struct i2c_adapter_quirks qup_i2c_quirks = {
++ .flags = I2C_AQ_NO_ZERO_LEN,
+ .max_read_len = QUP_READ_LIMIT,
+ };
+
++static const struct i2c_adapter_quirks qup_i2c_quirks_v2 = {
++ .flags = I2C_AQ_NO_ZERO_LEN,
++};
++
+ static void qup_i2c_enable_clocks(struct qup_i2c_dev *qup)
+ {
+ clk_prepare_enable(qup->clk);
+@@ -1701,6 +1698,7 @@ static int qup_i2c_probe(struct platform_device *pdev)
+ is_qup_v1 = true;
+ } else {
+ qup->adap.algo = &qup_i2c_algo_v2;
++ qup->adap.quirks = &qup_i2c_quirks_v2;
+ is_qup_v1 = false;
+ if (acpi_match_device(qup_i2c_acpi_match, qup->dev))
+ goto nodma;
+diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
+index ef13b6ce9d8d..47d196c026ba 100644
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -684,9 +684,6 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,
+
+ tegra_i2c_flush_fifos(i2c_dev);
+
+- if (msg->len == 0)
+- return -EINVAL;
+-
+ i2c_dev->msg_buf = msg->buf;
+ i2c_dev->msg_buf_remaining = msg->len;
+ i2c_dev->msg_err = I2C_ERR_NONE;
+@@ -831,6 +828,7 @@ static const struct i2c_algorithm tegra_i2c_algo = {
+
+ /* payload size is only 12 bit */
+ static const struct i2c_adapter_quirks tegra_i2c_quirks = {
++ .flags = I2C_AQ_NO_ZERO_LEN,
+ .max_read_len = 4096,
+ .max_write_len = 4096 - 12,
+ };
+diff --git a/drivers/i2c/busses/i2c-zx2967.c b/drivers/i2c/busses/i2c-zx2967.c
+index 48281c1b30c6..b8f9e020d80e 100644
+--- a/drivers/i2c/busses/i2c-zx2967.c
++++ b/drivers/i2c/busses/i2c-zx2967.c
+@@ -281,9 +281,6 @@ static int zx2967_i2c_xfer_msg(struct zx2967_i2c *i2c,
+ int ret;
+ int i;
+
+- if (msg->len == 0)
+- return -EINVAL;
+-
+ zx2967_i2c_flush_fifos(i2c);
+
+ i2c->cur_trans = msg->buf;
+@@ -498,6 +495,10 @@ static const struct i2c_algorithm zx2967_i2c_algo = {
+ .functionality = zx2967_i2c_func,
+ };
+
++static const struct i2c_adapter_quirks zx2967_i2c_quirks = {
++ .flags = I2C_AQ_NO_ZERO_LEN,
++};
++
+ static const struct of_device_id zx2967_i2c_of_match[] = {
+ { .compatible = "zte,zx296718-i2c", },
+ { },
+@@ -568,6 +569,7 @@ static int zx2967_i2c_probe(struct platform_device *pdev)
+ strlcpy(i2c->adap.name, "zx2967 i2c adapter",
+ sizeof(i2c->adap.name));
+ i2c->adap.algo = &zx2967_i2c_algo;
++ i2c->adap.quirks = &zx2967_i2c_quirks;
+ i2c->adap.nr = pdev->id;
+ i2c->adap.dev.parent = &pdev->dev;
+ i2c->adap.dev.of_node = pdev->dev.of_node;
+diff --git a/drivers/infiniband/hw/hfi1/mad.c b/drivers/infiniband/hw/hfi1/mad.c
+index f208a25d0e4f..1669548e91dc 100644
+--- a/drivers/infiniband/hw/hfi1/mad.c
++++ b/drivers/infiniband/hw/hfi1/mad.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright(c) 2015-2017 Intel Corporation.
++ * Copyright(c) 2015-2018 Intel Corporation.
+ *
+ * This file is provided under a dual BSD/GPLv2 license. When using or
+ * redistributing this file, you may do so under either license.
+@@ -4829,7 +4829,7 @@ static int hfi1_process_opa_mad(struct ib_device *ibdev, int mad_flags,
+ int ret;
+ int pkey_idx;
+ int local_mad = 0;
+- u32 resp_len = 0;
++ u32 resp_len = in_wc->byte_len - sizeof(*in_grh);
+ struct hfi1_ibport *ibp = to_iport(ibdev, port);
+
+ pkey_idx = hfi1_lookup_pkey_idx(ibp, LIM_MGMT_P_KEY);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index 9a24fd0ee3e7..ebfb0998bced 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -665,7 +665,9 @@ struct hns_roce_caps {
+ u32 max_sq_sg; /* 2 */
+ u32 max_sq_inline; /* 32 */
+ u32 max_rq_sg; /* 2 */
++ u32 max_extend_sg;
+ int num_qps; /* 256k */
++ int reserved_qps;
+ u32 max_wqes; /* 16k */
+ u32 max_sq_desc_sz; /* 64 */
+ u32 max_rq_desc_sz; /* 64 */
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 3f8e13190aa7..9e7923cf8577 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -121,6 +121,7 @@ static int set_rwqe_data_seg(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ }
+
+ if (wr->opcode == IB_WR_RDMA_READ) {
++ *bad_wr = wr;
+ dev_err(hr_dev->dev, "Not support inline data!\n");
+ return -EINVAL;
+ }
+@@ -1193,6 +1194,7 @@ static int hns_roce_v2_profile(struct hns_roce_dev *hr_dev)
+ caps->num_cqs = HNS_ROCE_V2_MAX_CQ_NUM;
+ caps->max_cqes = HNS_ROCE_V2_MAX_CQE_NUM;
+ caps->max_sq_sg = HNS_ROCE_V2_MAX_SQ_SGE_NUM;
++ caps->max_extend_sg = HNS_ROCE_V2_MAX_EXTEND_SGE_NUM;
+ caps->max_rq_sg = HNS_ROCE_V2_MAX_RQ_SGE_NUM;
+ caps->max_sq_inline = HNS_ROCE_V2_MAX_SQ_INLINE;
+ caps->num_uars = HNS_ROCE_V2_UAR_NUM;
+@@ -1222,6 +1224,7 @@ static int hns_roce_v2_profile(struct hns_roce_dev *hr_dev)
+ caps->reserved_mrws = 1;
+ caps->reserved_uars = 0;
+ caps->reserved_cqs = 0;
++ caps->reserved_qps = HNS_ROCE_V2_RSV_QPS;
+
+ caps->qpc_ba_pg_sz = 0;
+ caps->qpc_buf_pg_sz = 0;
+@@ -2266,6 +2269,7 @@ static int hns_roce_v2_poll_one(struct hns_roce_cq *hr_cq,
+ wc->src_qp = (u8)roce_get_field(cqe->byte_32,
+ V2_CQE_BYTE_32_RMT_QPN_M,
+ V2_CQE_BYTE_32_RMT_QPN_S);
++ wc->slid = 0;
+ wc->wc_flags |= (roce_get_bit(cqe->byte_32,
+ V2_CQE_BYTE_32_GRH_S) ?
+ IB_WC_GRH : 0);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+index 14aa308befef..2c3e600db9ce 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+@@ -50,6 +50,7 @@
+ #define HNS_ROCE_V2_MAX_CQE_NUM 0x10000
+ #define HNS_ROCE_V2_MAX_RQ_SGE_NUM 0x100
+ #define HNS_ROCE_V2_MAX_SQ_SGE_NUM 0xff
++#define HNS_ROCE_V2_MAX_EXTEND_SGE_NUM 0x200000
+ #define HNS_ROCE_V2_MAX_SQ_INLINE 0x20
+ #define HNS_ROCE_V2_UAR_NUM 256
+ #define HNS_ROCE_V2_PHY_UAR_NUM 1
+@@ -78,6 +79,7 @@
+ #define HNS_ROCE_INVALID_LKEY 0x100
+ #define HNS_ROCE_CMQ_TX_TIMEOUT 30000
+ #define HNS_ROCE_V2_UC_RC_SGE_NUM_IN_WQE 2
++#define HNS_ROCE_V2_RSV_QPS 8
+
+ #define HNS_ROCE_CONTEXT_HOP_NUM 1
+ #define HNS_ROCE_MTT_HOP_NUM 1
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 2fa4fb17f6d3..54d22868ffba 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -31,6 +31,7 @@
+ * SOFTWARE.
+ */
+
++#include <linux/pci.h>
+ #include <linux/platform_device.h>
+ #include <rdma/ib_addr.h>
+ #include <rdma/ib_umem.h>
+@@ -372,6 +373,16 @@ static int hns_roce_set_user_sq_size(struct hns_roce_dev *hr_dev,
+ if (hr_qp->sq.max_gs > 2)
+ hr_qp->sge.sge_cnt = roundup_pow_of_two(hr_qp->sq.wqe_cnt *
+ (hr_qp->sq.max_gs - 2));
++
++ if ((hr_qp->sq.max_gs > 2) && (hr_dev->pci_dev->revision == 0x20)) {
++ if (hr_qp->sge.sge_cnt > hr_dev->caps.max_extend_sg) {
++ dev_err(hr_dev->dev,
++ "The extended sge cnt error! sge_cnt=%d\n",
++ hr_qp->sge.sge_cnt);
++ return -EINVAL;
++ }
++ }
++
+ hr_qp->sge.sge_shift = 4;
+
+ /* Get buf size, SQ and RQ are aligned to page_szie */
+@@ -465,6 +476,14 @@ static int hns_roce_set_kernel_sq_size(struct hns_roce_dev *hr_dev,
+ hr_qp->sge.sge_shift = 4;
+ }
+
++ if ((hr_qp->sq.max_gs > 2) && hr_dev->pci_dev->revision == 0x20) {
++ if (hr_qp->sge.sge_cnt > hr_dev->caps.max_extend_sg) {
++ dev_err(dev, "The extended sge cnt error! sge_cnt=%d\n",
++ hr_qp->sge.sge_cnt);
++ return -EINVAL;
++ }
++ }
++
+ /* Get buf size, SQ and RQ are aligned to PAGE_SIZE */
+ page_size = 1 << (hr_dev->caps.mtt_buf_pg_sz + PAGE_SHIFT);
+ hr_qp->sq.offset = 0;
+@@ -1106,14 +1125,20 @@ int hns_roce_init_qp_table(struct hns_roce_dev *hr_dev)
+ {
+ struct hns_roce_qp_table *qp_table = &hr_dev->qp_table;
+ int reserved_from_top = 0;
++ int reserved_from_bot;
+ int ret;
+
+ spin_lock_init(&qp_table->lock);
+ INIT_RADIX_TREE(&hr_dev->qp_table_tree, GFP_ATOMIC);
+
+- /* A port include two SQP, six port total 12 */
++ /* In hw v1, a port include two SQP, six ports total 12 */
++ if (hr_dev->caps.max_sq_sg <= 2)
++ reserved_from_bot = SQP_NUM;
++ else
++ reserved_from_bot = hr_dev->caps.reserved_qps;
++
+ ret = hns_roce_bitmap_init(&qp_table->bitmap, hr_dev->caps.num_qps,
+- hr_dev->caps.num_qps - 1, SQP_NUM,
++ hr_dev->caps.num_qps - 1, reserved_from_bot,
+ reserved_from_top);
+ if (ret) {
+ dev_err(hr_dev->dev, "qp bitmap init failed!error=%d\n",
+diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
+index f3e80dec1334..af7f2083d4d1 100644
+--- a/drivers/infiniband/hw/mthca/mthca_main.c
++++ b/drivers/infiniband/hw/mthca/mthca_main.c
+@@ -986,7 +986,8 @@ static int __mthca_init_one(struct pci_dev *pdev, int hca_type)
+ goto err_free_dev;
+ }
+
+- if (mthca_cmd_init(mdev)) {
++ err = mthca_cmd_init(mdev);
++ if (err) {
+ mthca_err(mdev, "Failed to init command interface, aborting.\n");
+ goto err_free_dev;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c
+index 0d6c04ba7fc3..c41a5fee81f7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_srq.c
++++ b/drivers/infiniband/sw/rxe/rxe_srq.c
+@@ -31,6 +31,7 @@
+ * SOFTWARE.
+ */
+
++#include <linux/vmalloc.h>
+ #include "rxe.h"
+ #include "rxe_loc.h"
+ #include "rxe_queue.h"
+@@ -129,13 +130,18 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq,
+
+ err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, context, q->buf,
+ q->buf_size, &q->ip);
+- if (err)
++ if (err) {
++ vfree(q->buf);
++ kfree(q);
+ return err;
++ }
+
+ if (uresp) {
+ if (copy_to_user(&uresp->srq_num, &srq->srq_num,
+- sizeof(uresp->srq_num)))
++ sizeof(uresp->srq_num))) {
++ rxe_queue_cleanup(q);
+ return -EFAULT;
++ }
+ }
+
+ return 0;
+diff --git a/drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c b/drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c
+index 267da8215e08..31cd361416ac 100644
+--- a/drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c
++++ b/drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c
+@@ -351,7 +351,8 @@ static uint32_t opa_vnic_get_dlid(struct opa_vnic_adapter *adapter,
+ if (unlikely(!dlid))
+ v_warn("Null dlid in MAC address\n");
+ } else if (def_port != OPA_VNIC_INVALID_PORT) {
+- dlid = info->vesw.u_ucast_dlid[def_port];
++ if (def_port < OPA_VESW_MAX_NUM_DEF_PORT)
++ dlid = info->vesw.u_ucast_dlid[def_port];
+ }
+ }
+
+diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
+index e5c3b066bd2a..06f0eb04a8fd 100644
+--- a/drivers/input/touchscreen/silead.c
++++ b/drivers/input/touchscreen/silead.c
+@@ -558,20 +558,33 @@ static int __maybe_unused silead_ts_suspend(struct device *dev)
+ static int __maybe_unused silead_ts_resume(struct device *dev)
+ {
+ struct i2c_client *client = to_i2c_client(dev);
++ bool second_try = false;
+ int error, status;
+
+ silead_ts_set_power(client, SILEAD_POWER_ON);
+
++ retry:
+ error = silead_ts_reset(client);
+ if (error)
+ return error;
+
++ if (second_try) {
++ error = silead_ts_load_fw(client);
++ if (error)
++ return error;
++ }
++
+ error = silead_ts_startup(client);
+ if (error)
+ return error;
+
+ status = silead_ts_get_status(client);
+ if (status != SILEAD_STATUS_OK) {
++ if (!second_try) {
++ second_try = true;
++ dev_dbg(dev, "Reloading firmware after unsuccessful resume\n");
++ goto retry;
++ }
+ dev_err(dev, "Resume error, status: 0x%02x\n", status);
+ return -ENODEV;
+ }
+diff --git a/drivers/input/touchscreen/st1232.c b/drivers/input/touchscreen/st1232.c
+index d5dfa4053bbf..b71673911aac 100644
+--- a/drivers/input/touchscreen/st1232.c
++++ b/drivers/input/touchscreen/st1232.c
+@@ -195,6 +195,7 @@ static int st1232_ts_probe(struct i2c_client *client,
+ input_dev->id.bustype = BUS_I2C;
+ input_dev->dev.parent = &client->dev;
+
++ __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
+ __set_bit(EV_SYN, input_dev->evbit);
+ __set_bit(EV_KEY, input_dev->evbit);
+ __set_bit(EV_ABS, input_dev->evbit);
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index 40fbf20d69e5..2ab7100bcff1 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -567,7 +567,7 @@ struct arm_smmu_device {
+
+ int gerr_irq;
+ int combined_irq;
+- atomic_t sync_nr;
++ u32 sync_nr;
+
+ unsigned long ias; /* IPA */
+ unsigned long oas; /* PA */
+@@ -964,14 +964,13 @@ static int __arm_smmu_cmdq_issue_sync_msi(struct arm_smmu_device *smmu)
+ struct arm_smmu_cmdq_ent ent = {
+ .opcode = CMDQ_OP_CMD_SYNC,
+ .sync = {
+- .msidata = atomic_inc_return_relaxed(&smmu->sync_nr),
+ .msiaddr = virt_to_phys(&smmu->sync_count),
+ },
+ };
+
+- arm_smmu_cmdq_build_cmd(cmd, &ent);
+-
+ spin_lock_irqsave(&smmu->cmdq.lock, flags);
++ ent.sync.msidata = ++smmu->sync_nr;
++ arm_smmu_cmdq_build_cmd(cmd, &ent);
+ arm_smmu_cmdq_insert_cmd(smmu, cmd);
+ spin_unlock_irqrestore(&smmu->cmdq.lock, flags);
+
+@@ -2196,7 +2195,6 @@ static int arm_smmu_init_structures(struct arm_smmu_device *smmu)
+ {
+ int ret;
+
+- atomic_set(&smmu->sync_nr, 0);
+ ret = arm_smmu_init_queues(smmu);
+ if (ret)
+ return ret;
+diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
+index 88641b4560bc..2f79efd16a05 100644
+--- a/drivers/iommu/io-pgtable-arm.c
++++ b/drivers/iommu/io-pgtable-arm.c
+@@ -574,13 +574,12 @@ static size_t arm_lpae_split_blk_unmap(struct arm_lpae_io_pgtable *data,
+ return 0;
+
+ tablep = iopte_deref(pte, data);
++ } else if (unmap_idx >= 0) {
++ io_pgtable_tlb_add_flush(&data->iop, iova, size, size, true);
++ return size;
+ }
+
+- if (unmap_idx < 0)
+- return __arm_lpae_unmap(data, iova, size, lvl, tablep);
+-
+- io_pgtable_tlb_add_flush(&data->iop, iova, size, size, true);
+- return size;
++ return __arm_lpae_unmap(data, iova, size, lvl, tablep);
+ }
+
+ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data,
+diff --git a/drivers/irqchip/irq-mvebu-icu.c b/drivers/irqchip/irq-mvebu-icu.c
+index 13063339b416..a2a3acd74491 100644
+--- a/drivers/irqchip/irq-mvebu-icu.c
++++ b/drivers/irqchip/irq-mvebu-icu.c
+@@ -105,7 +105,7 @@ static int
+ mvebu_icu_irq_domain_translate(struct irq_domain *d, struct irq_fwspec *fwspec,
+ unsigned long *hwirq, unsigned int *type)
+ {
+- struct mvebu_icu *icu = d->host_data;
++ struct mvebu_icu *icu = platform_msi_get_host_data(d);
+ unsigned int icu_group;
+
+ /* Check the count of the parameters in dt */
+diff --git a/drivers/lightnvm/pblk-core.c b/drivers/lightnvm/pblk-core.c
+index 80710c62ac29..8dce31dbf2cb 100644
+--- a/drivers/lightnvm/pblk-core.c
++++ b/drivers/lightnvm/pblk-core.c
+@@ -893,10 +893,8 @@ static void pblk_setup_e_rq(struct pblk *pblk, struct nvm_rq *rqd,
+
+ static int pblk_blk_erase_sync(struct pblk *pblk, struct ppa_addr ppa)
+ {
+- struct nvm_rq rqd;
+- int ret = 0;
+-
+- memset(&rqd, 0, sizeof(struct nvm_rq));
++ struct nvm_rq rqd = {NULL};
++ int ret;
+
+ pblk_setup_e_rq(pblk, &rqd, ppa);
+
+@@ -904,19 +902,6 @@ static int pblk_blk_erase_sync(struct pblk *pblk, struct ppa_addr ppa)
+ * with writes. Thus, there is no need to take the LUN semaphore.
+ */
+ ret = pblk_submit_io_sync(pblk, &rqd);
+- if (ret) {
+- struct nvm_tgt_dev *dev = pblk->dev;
+- struct nvm_geo *geo = &dev->geo;
+-
+- pblk_err(pblk, "could not sync erase line:%d,blk:%d\n",
+- pblk_ppa_to_line(ppa),
+- pblk_ppa_to_pos(geo, ppa));
+-
+- rqd.error = ret;
+- goto out;
+- }
+-
+-out:
+ rqd.private = pblk;
+ __pblk_end_io_erase(pblk, &rqd);
+
+@@ -1788,6 +1773,17 @@ void pblk_line_close_meta(struct pblk *pblk, struct pblk_line *line)
+ wa->pad = cpu_to_le64(atomic64_read(&pblk->pad_wa));
+ wa->gc = cpu_to_le64(atomic64_read(&pblk->gc_wa));
+
++ if (le32_to_cpu(emeta_buf->header.identifier) != PBLK_MAGIC) {
++ emeta_buf->header.identifier = cpu_to_le32(PBLK_MAGIC);
++ memcpy(emeta_buf->header.uuid, pblk->instance_uuid, 16);
++ emeta_buf->header.id = cpu_to_le32(line->id);
++ emeta_buf->header.type = cpu_to_le16(line->type);
++ emeta_buf->header.version_major = EMETA_VERSION_MAJOR;
++ emeta_buf->header.version_minor = EMETA_VERSION_MINOR;
++ emeta_buf->header.crc = cpu_to_le32(
++ pblk_calc_meta_header_crc(pblk, &emeta_buf->header));
++ }
++
+ emeta_buf->nr_valid_lbas = cpu_to_le64(line->nr_valid_lbas);
+ emeta_buf->crc = cpu_to_le32(pblk_calc_emeta_crc(pblk, emeta_buf));
+
+@@ -1805,8 +1801,6 @@ void pblk_line_close_meta(struct pblk *pblk, struct pblk_line *line)
+ spin_unlock(&l_mg->close_lock);
+
+ pblk_line_should_sync_meta(pblk);
+-
+-
+ }
+
+ static void pblk_save_lba_list(struct pblk *pblk, struct pblk_line *line)
+diff --git a/drivers/lightnvm/pblk-init.c b/drivers/lightnvm/pblk-init.c
+index 537e98f2b24a..88b632787abd 100644
+--- a/drivers/lightnvm/pblk-init.c
++++ b/drivers/lightnvm/pblk-init.c
+@@ -181,7 +181,8 @@ static int pblk_rwb_init(struct pblk *pblk)
+ unsigned int power_size, power_seg_sz;
+ int pgs_in_buffer;
+
+- pgs_in_buffer = max(geo->mw_cunits, geo->ws_opt) * geo->all_luns;
++ pgs_in_buffer = (max(geo->mw_cunits, geo->ws_opt) + geo->ws_opt)
++ * geo->all_luns;
+
+ if (write_buffer_size && (write_buffer_size > pgs_in_buffer))
+ buffer_size = write_buffer_size;
+@@ -371,9 +372,11 @@ static int pblk_core_init(struct pblk *pblk)
+ atomic64_set(&pblk->nr_flush, 0);
+ pblk->nr_flush_rst = 0;
+
+- pblk->min_write_pgs = geo->ws_opt * (geo->csecs / PAGE_SIZE);
++ pblk->min_write_pgs = geo->ws_opt;
+ max_write_ppas = pblk->min_write_pgs * geo->all_luns;
+ pblk->max_write_pgs = min_t(int, max_write_ppas, NVM_MAX_VLBA);
++ pblk->max_write_pgs = min_t(int, pblk->max_write_pgs,
++ queue_max_hw_sectors(dev->q) / (geo->csecs >> SECTOR_SHIFT));
+ pblk_set_sec_per_write(pblk, pblk->min_write_pgs);
+
+ if (pblk->max_write_pgs > PBLK_MAX_REQ_ADDRS) {
+@@ -1083,7 +1086,8 @@ static int pblk_lines_init(struct pblk *pblk)
+
+ if (!nr_free_chks) {
+ pblk_err(pblk, "too many bad blocks prevent for sane instance\n");
+- return -EINTR;
++ ret = -EINTR;
++ goto fail_free_lines;
+ }
+
+ pblk_set_provision(pblk, nr_free_chks);
+diff --git a/drivers/lightnvm/pblk-sysfs.c b/drivers/lightnvm/pblk-sysfs.c
+index 8d2ed510c04b..bdc86ee4c779 100644
+--- a/drivers/lightnvm/pblk-sysfs.c
++++ b/drivers/lightnvm/pblk-sysfs.c
+@@ -343,7 +343,6 @@ static ssize_t pblk_get_write_amp(u64 user, u64 gc, u64 pad,
+ {
+ int sz;
+
+-
+ sz = snprintf(page, PAGE_SIZE,
+ "user:%lld gc:%lld pad:%lld WA:",
+ user, gc, pad);
+@@ -355,7 +354,7 @@ static ssize_t pblk_get_write_amp(u64 user, u64 gc, u64 pad,
+ u32 wa_frac;
+
+ wa_int = (user + gc + pad) * 100000;
+- wa_int = div_u64(wa_int, user);
++ wa_int = div64_u64(wa_int, user);
+ wa_int = div_u64_rem(wa_int, 100000, &wa_frac);
+
+ sz += snprintf(page + sz, PAGE_SIZE - sz, "%llu.%05u\n",
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 2321643974da..4998b4cae9c1 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -418,6 +418,7 @@ static int __uuid_write(struct cache_set *c)
+ {
+ BKEY_PADDED(key) k;
+ struct closure cl;
++ struct cache *ca;
+
+ closure_init_stack(&cl);
+ lockdep_assert_held(&bch_register_lock);
+@@ -429,6 +430,10 @@ static int __uuid_write(struct cache_set *c)
+ uuid_io(c, REQ_OP_WRITE, 0, &k.key, &cl);
+ closure_sync(&cl);
+
++ /* Only one bucket used for uuid write */
++ ca = PTR_CACHE(c, &k.key, 0);
++ atomic_long_add(ca->sb.bucket_size, &ca->meta_sectors_written);
++
+ bkey_copy(&c->uuid_bucket, &k.key);
+ bkey_put(c, &k.key);
+ return 0;
+@@ -1004,6 +1009,7 @@ static void cached_dev_detach_finish(struct work_struct *w)
+ bch_write_bdev_super(dc, &cl);
+ closure_sync(&cl);
+
++ calc_cached_dev_sectors(dc->disk.c);
+ bcache_device_detach(&dc->disk);
+ list_move(&dc->list, &uncached_devices);
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index a8fbaa384e9a..2fe4f93d1d7d 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -8778,6 +8778,18 @@ static void md_start_sync(struct work_struct *ws)
+ */
+ void md_check_recovery(struct mddev *mddev)
+ {
++ if (test_bit(MD_ALLOW_SB_UPDATE, &mddev->flags) && mddev->sb_flags) {
++ /* Write superblock - thread that called mddev_suspend()
++ * holds reconfig_mutex for us.
++ */
++ set_bit(MD_UPDATING_SB, &mddev->flags);
++ smp_mb__after_atomic();
++ if (test_bit(MD_ALLOW_SB_UPDATE, &mddev->flags))
++ md_update_sb(mddev, 0);
++ clear_bit_unlock(MD_UPDATING_SB, &mddev->flags);
++ wake_up(&mddev->sb_wait);
++ }
++
+ if (mddev->suspended)
+ return;
+
+@@ -8938,16 +8950,6 @@ void md_check_recovery(struct mddev *mddev)
+ unlock:
+ wake_up(&mddev->sb_wait);
+ mddev_unlock(mddev);
+- } else if (test_bit(MD_ALLOW_SB_UPDATE, &mddev->flags) && mddev->sb_flags) {
+- /* Write superblock - thread that called mddev_suspend()
+- * holds reconfig_mutex for us.
+- */
+- set_bit(MD_UPDATING_SB, &mddev->flags);
+- smp_mb__after_atomic();
+- if (test_bit(MD_ALLOW_SB_UPDATE, &mddev->flags))
+- md_update_sb(mddev, 0);
+- clear_bit_unlock(MD_UPDATING_SB, &mddev->flags);
+- wake_up(&mddev->sb_wait);
+ }
+ }
+ EXPORT_SYMBOL(md_check_recovery);
+diff --git a/drivers/media/cec/cec-pin.c b/drivers/media/cec/cec-pin.c
+index 0496d93b2b8f..8f987bc0dd88 100644
+--- a/drivers/media/cec/cec-pin.c
++++ b/drivers/media/cec/cec-pin.c
+@@ -936,6 +936,17 @@ static enum hrtimer_restart cec_pin_timer(struct hrtimer *timer)
+ /* Start bit, switch to receive state */
+ pin->ts = ts;
+ pin->state = CEC_ST_RX_START_BIT_LOW;
++ /*
++ * If a transmit is pending, then that transmit should
++ * use a signal free time of no more than
++ * CEC_SIGNAL_FREE_TIME_NEW_INITIATOR since it will
++ * have a new initiator due to the receive that is now
++ * starting.
++ */
++ if (pin->tx_msg.len && pin->tx_signal_free_time >
++ CEC_SIGNAL_FREE_TIME_NEW_INITIATOR)
++ pin->tx_signal_free_time =
++ CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
+ break;
+ }
+ if (ktime_to_ns(pin->ts) == 0)
+@@ -1158,6 +1169,15 @@ static int cec_pin_adap_transmit(struct cec_adapter *adap, u8 attempts,
+ {
+ struct cec_pin *pin = adap->pin;
+
++ /*
++ * If a receive is in progress, then this transmit should use
++ * a signal free time of max CEC_SIGNAL_FREE_TIME_NEW_INITIATOR
++ * since when it starts transmitting it will have a new initiator.
++ */
++ if (pin->state != CEC_ST_IDLE &&
++ signal_free_time > CEC_SIGNAL_FREE_TIME_NEW_INITIATOR)
++ signal_free_time = CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
++
+ pin->tx_signal_free_time = signal_free_time;
+ pin->tx_extra_bytes = 0;
+ pin->tx_msg = *msg;
+diff --git a/drivers/media/i2c/adv748x/adv748x-core.c b/drivers/media/i2c/adv748x/adv748x-core.c
+index 6ca88daa0ecd..65c3024c5f76 100644
+--- a/drivers/media/i2c/adv748x/adv748x-core.c
++++ b/drivers/media/i2c/adv748x/adv748x-core.c
+@@ -569,7 +569,8 @@ static int adv748x_parse_dt(struct adv748x_state *state)
+ {
+ struct device_node *ep_np = NULL;
+ struct of_endpoint ep;
+- bool found = false;
++ bool out_found = false;
++ bool in_found = false;
+
+ for_each_endpoint_of_node(state->dev->of_node, ep_np) {
+ of_graph_parse_endpoint(ep_np, &ep);
+@@ -592,10 +593,17 @@ static int adv748x_parse_dt(struct adv748x_state *state)
+ of_node_get(ep_np);
+ state->endpoints[ep.port] = ep_np;
+
+- found = true;
++ /*
++ * At least one input endpoint and one output endpoint shall
++ * be defined.
++ */
++ if (ep.port < ADV748X_PORT_TXA)
++ in_found = true;
++ else
++ out_found = true;
+ }
+
+- return found ? 0 : -ENODEV;
++ return in_found && out_found ? 0 : -ENODEV;
+ }
+
+ static void adv748x_dt_cleanup(struct adv748x_state *state)
+@@ -627,6 +635,17 @@ static int adv748x_probe(struct i2c_client *client,
+ state->i2c_clients[ADV748X_PAGE_IO] = client;
+ i2c_set_clientdata(client, state);
+
++ /*
++ * We can not use container_of to get back to the state with two TXs;
++ * Initialize the TXs's fields unconditionally on the endpoint
++ * presence to access them later.
++ */
++ state->txa.state = state->txb.state = state;
++ state->txa.page = ADV748X_PAGE_TXA;
++ state->txb.page = ADV748X_PAGE_TXB;
++ state->txa.port = ADV748X_PORT_TXA;
++ state->txb.port = ADV748X_PORT_TXB;
++
+ /* Discover and process ports declared by the Device tree endpoints */
+ ret = adv748x_parse_dt(state);
+ if (ret) {
+diff --git a/drivers/media/i2c/adv748x/adv748x-csi2.c b/drivers/media/i2c/adv748x/adv748x-csi2.c
+index 469be87a3761..556e13c911a6 100644
+--- a/drivers/media/i2c/adv748x/adv748x-csi2.c
++++ b/drivers/media/i2c/adv748x/adv748x-csi2.c
+@@ -266,19 +266,10 @@ static int adv748x_csi2_init_controls(struct adv748x_csi2 *tx)
+
+ int adv748x_csi2_init(struct adv748x_state *state, struct adv748x_csi2 *tx)
+ {
+- struct device_node *ep;
+ int ret;
+
+- /* We can not use container_of to get back to the state with two TXs */
+- tx->state = state;
+- tx->page = is_txa(tx) ? ADV748X_PAGE_TXA : ADV748X_PAGE_TXB;
+-
+- ep = state->endpoints[is_txa(tx) ? ADV748X_PORT_TXA : ADV748X_PORT_TXB];
+- if (!ep) {
+- adv_err(state, "No endpoint found for %s\n",
+- is_txa(tx) ? "txa" : "txb");
+- return -ENODEV;
+- }
++ if (!is_tx_enabled(tx))
++ return 0;
+
+ /* Initialise the virtual channel */
+ adv748x_csi2_set_virtual_channel(tx, 0);
+@@ -288,7 +279,7 @@ int adv748x_csi2_init(struct adv748x_state *state, struct adv748x_csi2 *tx)
+ is_txa(tx) ? "txa" : "txb");
+
+ /* Ensure that matching is based upon the endpoint fwnodes */
+- tx->sd.fwnode = of_fwnode_handle(ep);
++ tx->sd.fwnode = of_fwnode_handle(state->endpoints[tx->port]);
+
+ /* Register internal ops for incremental subdev registration */
+ tx->sd.internal_ops = &adv748x_csi2_internal_ops;
+@@ -321,6 +312,9 @@ err_free_media:
+
+ void adv748x_csi2_cleanup(struct adv748x_csi2 *tx)
+ {
++ if (!is_tx_enabled(tx))
++ return;
++
+ v4l2_async_unregister_subdev(&tx->sd);
+ media_entity_cleanup(&tx->sd.entity);
+ v4l2_ctrl_handler_free(&tx->ctrl_hdl);
+diff --git a/drivers/media/i2c/adv748x/adv748x.h b/drivers/media/i2c/adv748x/adv748x.h
+index 65f83741277e..1cf46c401664 100644
+--- a/drivers/media/i2c/adv748x/adv748x.h
++++ b/drivers/media/i2c/adv748x/adv748x.h
+@@ -82,6 +82,7 @@ struct adv748x_csi2 {
+ struct adv748x_state *state;
+ struct v4l2_mbus_framefmt format;
+ unsigned int page;
++ unsigned int port;
+
+ struct media_pad pads[ADV748X_CSI2_NR_PADS];
+ struct v4l2_ctrl_handler ctrl_hdl;
+@@ -91,6 +92,7 @@ struct adv748x_csi2 {
+
+ #define notifier_to_csi2(n) container_of(n, struct adv748x_csi2, notifier)
+ #define adv748x_sd_to_csi2(sd) container_of(sd, struct adv748x_csi2, sd)
++#define is_tx_enabled(_tx) ((_tx)->state->endpoints[(_tx)->port] != NULL)
+
+ enum adv748x_hdmi_pads {
+ ADV748X_HDMI_SINK,
+diff --git a/drivers/media/i2c/dw9714.c b/drivers/media/i2c/dw9714.c
+index 91fae01d052b..3dc2100470a1 100644
+--- a/drivers/media/i2c/dw9714.c
++++ b/drivers/media/i2c/dw9714.c
+@@ -169,7 +169,8 @@ static int dw9714_probe(struct i2c_client *client)
+ return 0;
+
+ err_cleanup:
+- dw9714_subdev_cleanup(dw9714_dev);
++ v4l2_ctrl_handler_free(&dw9714_dev->ctrls_vcm);
++ media_entity_cleanup(&dw9714_dev->sd.entity);
+ dev_err(&client->dev, "Probe failed: %d\n", rval);
+ return rval;
+ }
+diff --git a/drivers/media/i2c/dw9807-vcm.c b/drivers/media/i2c/dw9807-vcm.c
+index 8ba3920b6e2f..5477ba326d68 100644
+--- a/drivers/media/i2c/dw9807-vcm.c
++++ b/drivers/media/i2c/dw9807-vcm.c
+@@ -218,7 +218,8 @@ static int dw9807_probe(struct i2c_client *client)
+ return 0;
+
+ err_cleanup:
+- dw9807_subdev_cleanup(dw9807_dev);
++ v4l2_ctrl_handler_free(&dw9807_dev->ctrls_vcm);
++ media_entity_cleanup(&dw9807_dev->sd.entity);
+
+ return rval;
+ }
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index a3bbef682fb8..2023df14f828 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -2572,8 +2572,6 @@ static int ov5640_s_frame_interval(struct v4l2_subdev *sd,
+ if (frame_rate < 0)
+ frame_rate = OV5640_15_FPS;
+
+- sensor->current_fr = frame_rate;
+- sensor->frame_interval = fi->interval;
+ mode = ov5640_find_mode(sensor, frame_rate, mode->hact,
+ mode->vact, true);
+ if (!mode) {
+@@ -2581,7 +2579,10 @@ static int ov5640_s_frame_interval(struct v4l2_subdev *sd,
+ goto out;
+ }
+
+- if (mode != sensor->current_mode) {
++ if (mode != sensor->current_mode ||
++ frame_rate != sensor->current_fr) {
++ sensor->current_fr = frame_rate;
++ sensor->frame_interval = fi->interval;
+ sensor->current_mode = mode;
+ sensor->pending_mode_change = true;
+ }
+diff --git a/drivers/media/pci/cx18/cx18-driver.c b/drivers/media/pci/cx18/cx18-driver.c
+index 0c389a3fb4e5..e64f9093cd6d 100644
+--- a/drivers/media/pci/cx18/cx18-driver.c
++++ b/drivers/media/pci/cx18/cx18-driver.c
+@@ -1252,7 +1252,7 @@ static void cx18_cancel_out_work_orders(struct cx18 *cx)
+ {
+ int i;
+ for (i = 0; i < CX18_MAX_STREAMS; i++)
+- if (&cx->streams[i].video_dev)
++ if (cx->streams[i].video_dev.v4l2_dev)
+ cancel_work_sync(&cx->streams[i].out_work_order);
+ }
+
+diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
+index f924e76e2fbf..340f8218f54d 100644
+--- a/drivers/media/platform/davinci/isif.c
++++ b/drivers/media/platform/davinci/isif.c
+@@ -1100,7 +1100,8 @@ fail_nobase_res:
+
+ while (i >= 0) {
+ res = platform_get_resource(pdev, IORESOURCE_MEM, i);
+- release_mem_region(res->start, resource_size(res));
++ if (res)
++ release_mem_region(res->start, resource_size(res));
+ i--;
+ }
+ vpfe_unregister_ccdc_device(&isif_hw_dev);
+diff --git a/drivers/media/platform/pxa_camera.c b/drivers/media/platform/pxa_camera.c
+index b6e9e93bde7a..406ac673ad84 100644
+--- a/drivers/media/platform/pxa_camera.c
++++ b/drivers/media/platform/pxa_camera.c
+@@ -2397,7 +2397,7 @@ static int pxa_camera_probe(struct platform_device *pdev)
+ pcdev->res = res;
+
+ pcdev->pdata = pdev->dev.platform_data;
+- if (&pdev->dev.of_node && !pcdev->pdata) {
++ if (pdev->dev.of_node && !pcdev->pdata) {
+ err = pxa_camera_pdata_from_dt(&pdev->dev, pcdev, &pcdev->asd);
+ } else {
+ pcdev->platform_flags = pcdev->pdata->flags;
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index dfbbbf0f746f..e40fdf97b0f0 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -888,8 +888,7 @@ static void vdec_buf_done(struct venus_inst *inst, unsigned int buf_type,
+ unsigned int opb_sz = venus_helper_get_opb_size(inst);
+
+ vb = &vbuf->vb2_buf;
+- vb->planes[0].bytesused =
+- max_t(unsigned int, opb_sz, bytesused);
++ vb2_set_plane_payload(vb, 0, bytesused ? : opb_sz);
+ vb->planes[0].data_offset = data_offset;
+ vb->timestamp = timestamp_us * NSEC_PER_USEC;
+ vbuf->sequence = inst->sequence_cap++;
+diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c
+index e1085e3ab3cc..485fa3fa8b49 100644
+--- a/drivers/media/platform/rcar-vin/rcar-core.c
++++ b/drivers/media/platform/rcar-vin/rcar-core.c
+@@ -174,7 +174,6 @@ static int rvin_group_link_notify(struct media_link *link, u32 flags,
+
+ if (csi_id == -ENODEV) {
+ struct v4l2_subdev *sd;
+- unsigned int i;
+
+ /*
+ * Make sure the source entity subdevice is registered as
+diff --git a/drivers/media/rc/ir-rc6-decoder.c b/drivers/media/rc/ir-rc6-decoder.c
+index 68487ce9f79b..d96aed1343e4 100644
+--- a/drivers/media/rc/ir-rc6-decoder.c
++++ b/drivers/media/rc/ir-rc6-decoder.c
+@@ -40,6 +40,7 @@
+ #define RC6_6A_MCE_TOGGLE_MASK 0x8000 /* for the body bits */
+ #define RC6_6A_LCC_MASK 0xffff0000 /* RC6-6A-32 long customer code mask */
+ #define RC6_6A_MCE_CC 0x800f0000 /* MCE customer code */
++#define RC6_6A_KATHREIN_CC 0x80460000 /* Kathrein RCU-676 customer code */
+ #ifndef CHAR_BIT
+ #define CHAR_BIT 8 /* Normally in <limits.h> */
+ #endif
+@@ -242,13 +243,17 @@ again:
+ toggle = 0;
+ break;
+ case 32:
+- if ((scancode & RC6_6A_LCC_MASK) == RC6_6A_MCE_CC) {
++ switch (scancode & RC6_6A_LCC_MASK) {
++ case RC6_6A_MCE_CC:
++ case RC6_6A_KATHREIN_CC:
+ protocol = RC_PROTO_RC6_MCE;
+ toggle = !!(scancode & RC6_6A_MCE_TOGGLE_MASK);
+ scancode &= ~RC6_6A_MCE_TOGGLE_MASK;
+- } else {
++ break;
++ default:
+ protocol = RC_PROTO_RC6_6A_32;
+ toggle = 0;
++ break;
+ }
+ break;
+ default:
+diff --git a/drivers/media/usb/cx231xx/cx231xx-video.c b/drivers/media/usb/cx231xx/cx231xx-video.c
+index f7fcd733a2ca..963739fa8671 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-video.c
++++ b/drivers/media/usb/cx231xx/cx231xx-video.c
+@@ -1389,7 +1389,7 @@ int cx231xx_g_register(struct file *file, void *priv,
+ ret = cx231xx_read_ctrl_reg(dev, VRT_GET_REGISTER,
+ (u16)reg->reg, value, 4);
+ reg->val = value[0] | value[1] << 8 |
+- value[2] << 16 | value[3] << 24;
++ value[2] << 16 | (u32)value[3] << 24;
+ reg->size = 4;
+ break;
+ case 1: /* AFE - read byte */
+diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c
+index fe8d335a4d74..4660ad90ef55 100644
+--- a/drivers/mfd/ti_am335x_tscadc.c
++++ b/drivers/mfd/ti_am335x_tscadc.c
+@@ -295,11 +295,24 @@ static int ti_tscadc_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static int __maybe_unused ti_tscadc_can_wakeup(struct device *dev, void *data)
++{
++ return device_may_wakeup(dev);
++}
++
+ static int __maybe_unused tscadc_suspend(struct device *dev)
+ {
+ struct ti_tscadc_dev *tscadc = dev_get_drvdata(dev);
+
+ regmap_write(tscadc->regmap, REG_SE, 0x00);
++ if (device_for_each_child(dev, NULL, ti_tscadc_can_wakeup)) {
++ u32 ctrl;
++
++ regmap_read(tscadc->regmap, REG_CTRL, &ctrl);
++ ctrl &= ~(CNTRLREG_POWERDOWN);
++ ctrl |= CNTRLREG_TSCSSENB;
++ regmap_write(tscadc->regmap, REG_CTRL, ctrl);
++ }
+ pm_runtime_put_sync(dev);
+
+ return 0;
+diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c
+index b83a373e3a8d..08f4a512afad 100644
+--- a/drivers/misc/cxl/guest.c
++++ b/drivers/misc/cxl/guest.c
+@@ -1020,8 +1020,6 @@ err1:
+
+ void cxl_guest_remove_afu(struct cxl_afu *afu)
+ {
+- pr_devel("in %s - AFU(%d)\n", __func__, afu->slice);
+-
+ if (!afu)
+ return;
+
+diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
+index eb1a65cb878f..fa6268c0f123 100644
+--- a/drivers/mmc/host/mmci.c
++++ b/drivers/mmc/host/mmci.c
+@@ -895,14 +895,18 @@ static void
+ mmci_data_irq(struct mmci_host *host, struct mmc_data *data,
+ unsigned int status)
+ {
++ unsigned int status_err;
++
+ /* Make sure we have data to handle */
+ if (!data)
+ return;
+
+ /* First check for errors */
+- if (status & (MCI_DATACRCFAIL | MCI_DATATIMEOUT |
+- host->variant->start_err |
+- MCI_TXUNDERRUN | MCI_RXOVERRUN)) {
++ status_err = status & (host->variant->start_err |
++ MCI_DATACRCFAIL | MCI_DATATIMEOUT |
++ MCI_TXUNDERRUN | MCI_RXOVERRUN);
++
++ if (status_err) {
+ u32 remain, success;
+
+ /* Terminate the DMA transfer */
+@@ -922,18 +926,18 @@ mmci_data_irq(struct mmci_host *host, struct mmc_data *data,
+ success = data->blksz * data->blocks - remain;
+
+ dev_dbg(mmc_dev(host->mmc), "MCI ERROR IRQ, status 0x%08x at 0x%08x\n",
+- status, success);
+- if (status & MCI_DATACRCFAIL) {
++ status_err, success);
++ if (status_err & MCI_DATACRCFAIL) {
+ /* Last block was not successful */
+ success -= 1;
+ data->error = -EILSEQ;
+- } else if (status & MCI_DATATIMEOUT) {
++ } else if (status_err & MCI_DATATIMEOUT) {
+ data->error = -ETIMEDOUT;
+- } else if (status & MCI_STARTBITERR) {
++ } else if (status_err & MCI_STARTBITERR) {
+ data->error = -ECOMM;
+- } else if (status & MCI_TXUNDERRUN) {
++ } else if (status_err & MCI_TXUNDERRUN) {
+ data->error = -EIO;
+- } else if (status & MCI_RXOVERRUN) {
++ } else if (status_err & MCI_RXOVERRUN) {
+ if (success > host->variant->fifosize)
+ success -= host->variant->fifosize;
+ else
+@@ -1790,7 +1794,7 @@ static int mmci_probe(struct amba_device *dev,
+ goto clk_disable;
+ }
+
+- writel(MCI_IRQENABLE, host->base + MMCIMASK0);
++ writel(MCI_IRQENABLE | variant->start_err, host->base + MMCIMASK0);
+
+ amba_set_drvdata(dev, mmc);
+
+@@ -1877,7 +1881,8 @@ static void mmci_restore(struct mmci_host *host)
+ writel(host->datactrl_reg, host->base + MMCIDATACTRL);
+ writel(host->pwr_reg, host->base + MMCIPOWER);
+ }
+- writel(MCI_IRQENABLE, host->base + MMCIMASK0);
++ writel(MCI_IRQENABLE | host->variant->start_err,
++ host->base + MMCIMASK0);
+ mmci_reg_delay(host);
+
+ spin_unlock_irqrestore(&host->lock, flags);
+diff --git a/drivers/mmc/host/mmci.h b/drivers/mmc/host/mmci.h
+index 517591d219e9..613d37ab08d2 100644
+--- a/drivers/mmc/host/mmci.h
++++ b/drivers/mmc/host/mmci.h
+@@ -181,9 +181,9 @@
+ #define MMCIFIFO 0x080 /* to 0x0bc */
+
+ #define MCI_IRQENABLE \
+- (MCI_CMDCRCFAILMASK|MCI_DATACRCFAILMASK|MCI_CMDTIMEOUTMASK| \
+- MCI_DATATIMEOUTMASK|MCI_TXUNDERRUNMASK|MCI_RXOVERRUNMASK| \
+- MCI_CMDRESPENDMASK|MCI_CMDSENTMASK|MCI_STARTBITERRMASK)
++ (MCI_CMDCRCFAILMASK | MCI_DATACRCFAILMASK | MCI_CMDTIMEOUTMASK | \
++ MCI_DATATIMEOUTMASK | MCI_TXUNDERRUNMASK | MCI_RXOVERRUNMASK | \
++ MCI_CMDRESPENDMASK | MCI_CMDSENTMASK)
+
+ /* These interrupts are directed to IRQ1 when two IRQ lines are available */
+ #define MCI_IRQ1MASK \
+diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+index ca0b43973769..382172fb3da8 100644
+--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+@@ -298,6 +298,7 @@ static const struct soc_device_attribute gen3_soc_whitelist[] = {
+ { .soc_id = "r8a7796", .revision = "ES1.0",
+ .data = (void *)BIT(SDHI_INTERNAL_DMAC_ONE_RX_ONLY) },
+ /* generic ones */
++ { .soc_id = "r8a774a1" },
+ { .soc_id = "r8a7795" },
+ { .soc_id = "r8a7796" },
+ { .soc_id = "r8a77965" },
+@@ -309,12 +310,20 @@ static const struct soc_device_attribute gen3_soc_whitelist[] = {
+ static int renesas_sdhi_internal_dmac_probe(struct platform_device *pdev)
+ {
+ const struct soc_device_attribute *soc = soc_device_match(gen3_soc_whitelist);
++ struct device *dev = &pdev->dev;
+
+ if (!soc)
+ return -ENODEV;
+
+ global_flags |= (unsigned long)soc->data;
+
++ dev->dma_parms = devm_kzalloc(dev, sizeof(*dev->dma_parms), GFP_KERNEL);
++ if (!dev->dma_parms)
++ return -ENOMEM;
++
++ /* value is max of SD_SECCNT. Confirmed by HW engineers */
++ dma_set_max_seg_size(dev, 0xffffffff);
++
+ return renesas_sdhi_probe(pdev, &renesas_sdhi_internal_dmac_dma_ops);
+ }
+
+diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
+index 7d13ca9ea534..35630ccbe9e5 100644
+--- a/drivers/mmc/host/tmio_mmc_core.c
++++ b/drivers/mmc/host/tmio_mmc_core.c
+@@ -926,8 +926,9 @@ static void tmio_mmc_finish_request(struct tmio_mmc_host *host)
+ if (mrq->cmd->error || (mrq->data && mrq->data->error))
+ tmio_mmc_abort_dma(host);
+
+- if (host->check_scc_error)
+- host->check_scc_error(host);
++ /* SCC error means retune, but executed command was still successful */
++ if (host->check_scc_error && host->check_scc_error(host))
++ mmc_retune_needed(host->mmc);
+
+ /* If SET_BLOCK_COUNT, continue with main command */
+ if (host->mrq && !mrq->cmd->error) {
+diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
+index 270d3c9580c5..c4a1d04b8c80 100644
+--- a/drivers/mtd/devices/m25p80.c
++++ b/drivers/mtd/devices/m25p80.c
+@@ -90,7 +90,6 @@ static ssize_t m25p80_write(struct spi_nor *nor, loff_t to, size_t len,
+ SPI_MEM_OP_ADDR(nor->addr_width, to, 1),
+ SPI_MEM_OP_NO_DUMMY,
+ SPI_MEM_OP_DATA_OUT(len, buf, 1));
+- size_t remaining = len;
+ int ret;
+
+ /* get transfer protocols. */
+@@ -101,22 +100,16 @@ static ssize_t m25p80_write(struct spi_nor *nor, loff_t to, size_t len,
+ if (nor->program_opcode == SPINOR_OP_AAI_WP && nor->sst_write_second)
+ op.addr.nbytes = 0;
+
+- while (remaining) {
+- op.data.nbytes = remaining < UINT_MAX ? remaining : UINT_MAX;
+- ret = spi_mem_adjust_op_size(flash->spimem, &op);
+- if (ret)
+- return ret;
+-
+- ret = spi_mem_exec_op(flash->spimem, &op);
+- if (ret)
+- return ret;
++ ret = spi_mem_adjust_op_size(flash->spimem, &op);
++ if (ret)
++ return ret;
++ op.data.nbytes = len < op.data.nbytes ? len : op.data.nbytes;
+
+- op.addr.val += op.data.nbytes;
+- remaining -= op.data.nbytes;
+- op.data.buf.out += op.data.nbytes;
+- }
++ ret = spi_mem_exec_op(flash->spimem, &op);
++ if (ret)
++ return ret;
+
+- return len;
++ return op.data.nbytes;
+ }
+
+ /*
+diff --git a/drivers/mtd/maps/physmap_of_core.c b/drivers/mtd/maps/physmap_of_core.c
+index 4129535b8e46..ece605d78c21 100644
+--- a/drivers/mtd/maps/physmap_of_core.c
++++ b/drivers/mtd/maps/physmap_of_core.c
+@@ -31,7 +31,6 @@
+ struct of_flash_list {
+ struct mtd_info *mtd;
+ struct map_info map;
+- struct resource *res;
+ };
+
+ struct of_flash {
+@@ -56,18 +55,10 @@ static int of_flash_remove(struct platform_device *dev)
+ mtd_concat_destroy(info->cmtd);
+ }
+
+- for (i = 0; i < info->list_size; i++) {
++ for (i = 0; i < info->list_size; i++)
+ if (info->list[i].mtd)
+ map_destroy(info->list[i].mtd);
+
+- if (info->list[i].map.virt)
+- iounmap(info->list[i].map.virt);
+-
+- if (info->list[i].res) {
+- release_resource(info->list[i].res);
+- kfree(info->list[i].res);
+- }
+- }
+ return 0;
+ }
+
+@@ -215,10 +206,11 @@ static int of_flash_probe(struct platform_device *dev)
+
+ err = -EBUSY;
+ res_size = resource_size(&res);
+- info->list[i].res = request_mem_region(res.start, res_size,
+- dev_name(&dev->dev));
+- if (!info->list[i].res)
++ info->list[i].map.virt = devm_ioremap_resource(&dev->dev, &res);
++ if (IS_ERR(info->list[i].map.virt)) {
++ err = PTR_ERR(info->list[i].map.virt);
+ goto err_out;
++ }
+
+ err = -ENXIO;
+ width = of_get_property(dp, "bank-width", NULL);
+@@ -246,15 +238,6 @@ static int of_flash_probe(struct platform_device *dev)
+ if (err)
+ goto err_out;
+
+- err = -ENOMEM;
+- info->list[i].map.virt = ioremap(info->list[i].map.phys,
+- info->list[i].map.size);
+- if (!info->list[i].map.virt) {
+- dev_err(&dev->dev, "Failed to ioremap() flash"
+- " region\n");
+- goto err_out;
+- }
+-
+ simple_map_init(&info->list[i].map);
+
+ /*
+diff --git a/drivers/mtd/nand/raw/sh_flctl.c b/drivers/mtd/nand/raw/sh_flctl.c
+index bb8866e05ff7..1e7273263c4b 100644
+--- a/drivers/mtd/nand/raw/sh_flctl.c
++++ b/drivers/mtd/nand/raw/sh_flctl.c
+@@ -480,7 +480,7 @@ static void read_fiforeg(struct sh_flctl *flctl, int rlen, int offset)
+
+ /* initiate DMA transfer */
+ if (flctl->chan_fifo0_rx && rlen >= 32 &&
+- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_DEV_TO_MEM) > 0)
++ flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE) > 0)
+ goto convert; /* DMA success */
+
+ /* do polling transfer */
+@@ -539,7 +539,7 @@ static void write_ec_fiforeg(struct sh_flctl *flctl, int rlen,
+
+ /* initiate DMA transfer */
+ if (flctl->chan_fifo0_tx && rlen >= 32 &&
+- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_MEM_TO_DEV) > 0)
++ flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE) > 0)
+ return; /* DMA success */
+
+ /* do polling transfer */
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index 0806c7a81c0f..04cedd3a2bf6 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -972,7 +972,7 @@ static int cqspi_direct_read_execute(struct spi_nor *nor, u_char *buf,
+ return 0;
+ }
+
+- dma_dst = dma_map_single(nor->dev, buf, len, DMA_DEV_TO_MEM);
++ dma_dst = dma_map_single(nor->dev, buf, len, DMA_FROM_DEVICE);
+ if (dma_mapping_error(nor->dev, dma_dst)) {
+ dev_err(nor->dev, "dma mapping failed\n");
+ return -ENOMEM;
+@@ -1007,7 +1007,7 @@ static int cqspi_direct_read_execute(struct spi_nor *nor, u_char *buf,
+ }
+
+ err_unmap:
+- dma_unmap_single(nor->dev, dma_dst, len, DMA_DEV_TO_MEM);
++ dma_unmap_single(nor->dev, dma_dst, len, DMA_FROM_DEVICE);
+
+ return ret;
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+index 790c684f08ab..b178c2e9dc23 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+@@ -78,8 +78,12 @@ static int bnxt_hwrm_nvm_req(struct bnxt *bp, u32 param_id, void *msg,
+ memcpy(buf, data_addr, bytesize);
+
+ dma_free_coherent(&bp->pdev->dev, bytesize, data_addr, data_dma_addr);
+- if (rc)
++ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++ netdev_err(bp->dev, "PF does not have admin privileges to modify NVM config\n");
++ return -EACCES;
++ } else if (rc) {
+ return -EIO;
++ }
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+index b34f0f077a31..838692948c0b 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+@@ -273,8 +273,8 @@ void cxgb4_dcb_handle_fw_update(struct adapter *adap,
+ enum cxgb4_dcb_state_input input =
+ ((pcmd->u.dcb.control.all_syncd_pkd &
+ FW_PORT_CMD_ALL_SYNCD_F)
+- ? CXGB4_DCB_STATE_FW_ALLSYNCED
+- : CXGB4_DCB_STATE_FW_INCOMPLETE);
++ ? CXGB4_DCB_INPUT_FW_ALLSYNCED
++ : CXGB4_DCB_INPUT_FW_INCOMPLETE);
+
+ if (dcb->dcb_version != FW_PORT_DCB_VER_UNKNOWN) {
+ dcb_running_version = FW_PORT_CMD_DCB_VERSION_G(
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h
+index 02040b99c78a..484ee8290090 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h
+@@ -67,7 +67,7 @@
+ do { \
+ if ((__dcb)->dcb_version == FW_PORT_DCB_VER_IEEE) \
+ cxgb4_dcb_state_fsm((__dev), \
+- CXGB4_DCB_STATE_FW_ALLSYNCED); \
++ CXGB4_DCB_INPUT_FW_ALLSYNCED); \
+ } while (0)
+
+ /* States we can be in for a port's Data Center Bridging.
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 0ccfa6a84535..e11a7de20b8f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -195,8 +195,6 @@ void hns3_set_vector_coalesce_tx_gl(struct hns3_enet_tqp_vector *tqp_vector,
+ static void hns3_vector_gl_rl_init(struct hns3_enet_tqp_vector *tqp_vector,
+ struct hns3_nic_priv *priv)
+ {
+- struct hnae3_handle *h = priv->ae_handle;
+-
+ /* initialize the configuration for interrupt coalescing.
+ * 1. GL (Interrupt Gap Limiter)
+ * 2. RL (Interrupt Rate Limiter)
+@@ -209,9 +207,6 @@ static void hns3_vector_gl_rl_init(struct hns3_enet_tqp_vector *tqp_vector,
+ tqp_vector->tx_group.coal.int_gl = HNS3_INT_GL_50K;
+ tqp_vector->rx_group.coal.int_gl = HNS3_INT_GL_50K;
+
+- /* Default: disable RL */
+- h->kinfo.int_rl_setting = 0;
+-
+ tqp_vector->int_adapt_down = HNS3_INT_ADAPT_DOWN_START;
+ tqp_vector->rx_group.coal.flow_level = HNS3_FLOW_LOW;
+ tqp_vector->tx_group.coal.flow_level = HNS3_FLOW_LOW;
+@@ -1447,13 +1442,11 @@ static int hns3_nic_change_mtu(struct net_device *netdev, int new_mtu)
+ }
+
+ ret = h->ae_algo->ops->set_mtu(h, new_mtu);
+- if (ret) {
++ if (ret)
+ netdev_err(netdev, "failed to change MTU in hardware %d\n",
+ ret);
+- return ret;
+- }
+-
+- netdev->mtu = new_mtu;
++ else
++ netdev->mtu = new_mtu;
+
+ /* if the netdev was running earlier, bring it up again */
+ if (if_running && hns3_nic_net_open(netdev))
+@@ -2131,18 +2124,18 @@ static void hns3_rx_skb(struct hns3_enet_ring *ring, struct sk_buff *skb)
+ napi_gro_receive(&ring->tqp_vector->napi, skb);
+ }
+
+-static u16 hns3_parse_vlan_tag(struct hns3_enet_ring *ring,
+- struct hns3_desc *desc, u32 l234info)
++static bool hns3_parse_vlan_tag(struct hns3_enet_ring *ring,
++ struct hns3_desc *desc, u32 l234info,
++ u16 *vlan_tag)
+ {
+ struct pci_dev *pdev = ring->tqp->handle->pdev;
+- u16 vlan_tag;
+
+ if (pdev->revision == 0x20) {
+- vlan_tag = le16_to_cpu(desc->rx.ot_vlan_tag);
+- if (!(vlan_tag & VLAN_VID_MASK))
+- vlan_tag = le16_to_cpu(desc->rx.vlan_tag);
++ *vlan_tag = le16_to_cpu(desc->rx.ot_vlan_tag);
++ if (!(*vlan_tag & VLAN_VID_MASK))
++ *vlan_tag = le16_to_cpu(desc->rx.vlan_tag);
+
+- return vlan_tag;
++ return (*vlan_tag != 0);
+ }
+
+ #define HNS3_STRP_OUTER_VLAN 0x1
+@@ -2151,17 +2144,14 @@ static u16 hns3_parse_vlan_tag(struct hns3_enet_ring *ring,
+ switch (hnae3_get_field(l234info, HNS3_RXD_STRP_TAGP_M,
+ HNS3_RXD_STRP_TAGP_S)) {
+ case HNS3_STRP_OUTER_VLAN:
+- vlan_tag = le16_to_cpu(desc->rx.ot_vlan_tag);
+- break;
++ *vlan_tag = le16_to_cpu(desc->rx.ot_vlan_tag);
++ return true;
+ case HNS3_STRP_INNER_VLAN:
+- vlan_tag = le16_to_cpu(desc->rx.vlan_tag);
+- break;
++ *vlan_tag = le16_to_cpu(desc->rx.vlan_tag);
++ return true;
+ default:
+- vlan_tag = 0;
+- break;
++ return false;
+ }
+-
+- return vlan_tag;
+ }
+
+ static int hns3_handle_rx_bd(struct hns3_enet_ring *ring,
+@@ -2263,8 +2253,7 @@ static int hns3_handle_rx_bd(struct hns3_enet_ring *ring,
+ if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX) {
+ u16 vlan_tag;
+
+- vlan_tag = hns3_parse_vlan_tag(ring, desc, l234info);
+- if (vlan_tag & VLAN_VID_MASK)
++ if (hns3_parse_vlan_tag(ring, desc, l234info, &vlan_tag))
+ __vlan_hwaccel_put_tag(skb,
+ htons(ETH_P_8021Q),
+ vlan_tag);
+@@ -3425,6 +3414,31 @@ int hns3_nic_reset_all_ring(struct hnae3_handle *h)
+ return 0;
+ }
+
++static void hns3_store_coal(struct hns3_nic_priv *priv)
++{
++ /* ethtool only support setting and querying one coal
++ * configuation for now, so save the vector 0' coal
++ * configuation here in order to restore it.
++ */
++ memcpy(&priv->tx_coal, &priv->tqp_vector[0].tx_group.coal,
++ sizeof(struct hns3_enet_coalesce));
++ memcpy(&priv->rx_coal, &priv->tqp_vector[0].rx_group.coal,
++ sizeof(struct hns3_enet_coalesce));
++}
++
++static void hns3_restore_coal(struct hns3_nic_priv *priv)
++{
++ u16 vector_num = priv->vector_num;
++ int i;
++
++ for (i = 0; i < vector_num; i++) {
++ memcpy(&priv->tqp_vector[i].tx_group.coal, &priv->tx_coal,
++ sizeof(struct hns3_enet_coalesce));
++ memcpy(&priv->tqp_vector[i].rx_group.coal, &priv->rx_coal,
++ sizeof(struct hns3_enet_coalesce));
++ }
++}
++
+ static int hns3_reset_notify_down_enet(struct hnae3_handle *handle)
+ {
+ struct hnae3_knic_private_info *kinfo = &handle->kinfo;
+@@ -3471,6 +3485,8 @@ static int hns3_reset_notify_init_enet(struct hnae3_handle *handle)
+ /* Carrier off reporting is important to ethtool even BEFORE open */
+ netif_carrier_off(netdev);
+
++ hns3_restore_coal(priv);
++
+ ret = hns3_nic_init_vector_data(priv);
+ if (ret)
+ return ret;
+@@ -3498,6 +3514,8 @@ static int hns3_reset_notify_uninit_enet(struct hnae3_handle *handle)
+ return ret;
+ }
+
++ hns3_store_coal(priv);
++
+ ret = hns3_uninit_all_ring(priv);
+ if (ret)
+ netdev_err(netdev, "uninit ring error\n");
+@@ -3532,24 +3550,7 @@ static int hns3_reset_notify(struct hnae3_handle *handle,
+ return ret;
+ }
+
+-static void hns3_restore_coal(struct hns3_nic_priv *priv,
+- struct hns3_enet_coalesce *tx,
+- struct hns3_enet_coalesce *rx)
+-{
+- u16 vector_num = priv->vector_num;
+- int i;
+-
+- for (i = 0; i < vector_num; i++) {
+- memcpy(&priv->tqp_vector[i].tx_group.coal, tx,
+- sizeof(struct hns3_enet_coalesce));
+- memcpy(&priv->tqp_vector[i].rx_group.coal, rx,
+- sizeof(struct hns3_enet_coalesce));
+- }
+-}
+-
+-static int hns3_modify_tqp_num(struct net_device *netdev, u16 new_tqp_num,
+- struct hns3_enet_coalesce *tx,
+- struct hns3_enet_coalesce *rx)
++static int hns3_modify_tqp_num(struct net_device *netdev, u16 new_tqp_num)
+ {
+ struct hns3_nic_priv *priv = netdev_priv(netdev);
+ struct hnae3_handle *h = hns3_get_handle(netdev);
+@@ -3567,7 +3568,7 @@ static int hns3_modify_tqp_num(struct net_device *netdev, u16 new_tqp_num,
+ if (ret)
+ goto err_alloc_vector;
+
+- hns3_restore_coal(priv, tx, rx);
++ hns3_restore_coal(priv);
+
+ ret = hns3_nic_init_vector_data(priv);
+ if (ret)
+@@ -3599,7 +3600,6 @@ int hns3_set_channels(struct net_device *netdev,
+ struct hns3_nic_priv *priv = netdev_priv(netdev);
+ struct hnae3_handle *h = hns3_get_handle(netdev);
+ struct hnae3_knic_private_info *kinfo = &h->kinfo;
+- struct hns3_enet_coalesce tx_coal, rx_coal;
+ bool if_running = netif_running(netdev);
+ u32 new_tqp_num = ch->combined_count;
+ u16 org_tqp_num;
+@@ -3631,15 +3631,7 @@ int hns3_set_channels(struct net_device *netdev,
+ goto open_netdev;
+ }
+
+- /* Changing the tqp num may also change the vector num,
+- * ethtool only support setting and querying one coal
+- * configuation for now, so save the vector 0' coal
+- * configuation here in order to restore it.
+- */
+- memcpy(&tx_coal, &priv->tqp_vector[0].tx_group.coal,
+- sizeof(struct hns3_enet_coalesce));
+- memcpy(&rx_coal, &priv->tqp_vector[0].rx_group.coal,
+- sizeof(struct hns3_enet_coalesce));
++ hns3_store_coal(priv);
+
+ hns3_nic_dealloc_vector_data(priv);
+
+@@ -3647,10 +3639,9 @@ int hns3_set_channels(struct net_device *netdev,
+ hns3_put_ring_config(priv);
+
+ org_tqp_num = h->kinfo.num_tqps;
+- ret = hns3_modify_tqp_num(netdev, new_tqp_num, &tx_coal, &rx_coal);
++ ret = hns3_modify_tqp_num(netdev, new_tqp_num);
+ if (ret) {
+- ret = hns3_modify_tqp_num(netdev, org_tqp_num,
+- &tx_coal, &rx_coal);
++ ret = hns3_modify_tqp_num(netdev, org_tqp_num);
+ if (ret) {
+ /* If revert to old tqp failed, fatal error occurred */
+ dev_err(&netdev->dev,
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+index cb450d7ec8c1..94d7446811d5 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+@@ -541,6 +541,8 @@ struct hns3_nic_priv {
+ /* Vxlan/Geneve information */
+ struct hns3_udp_tunnel udp_tnl[HNS3_UDP_TNL_MAX];
+ unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
++ struct hns3_enet_coalesce tx_coal;
++ struct hns3_enet_coalesce rx_coal;
+ };
+
+ union l3_hdr_info {
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 46a71d289bca..6a677fd540d6 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -4211,7 +4211,7 @@ int i40e_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link)
+ vf->link_forced = true;
+ vf->link_up = true;
+ pfe.event_data.link_event.link_status = true;
+- pfe.event_data.link_event.link_speed = I40E_LINK_SPEED_40GB;
++ pfe.event_data.link_event.link_speed = VIRTCHNL_LINK_SPEED_40GB;
+ break;
+ case IFLA_VF_LINK_STATE_DISABLE:
+ vf->link_forced = true;
+diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c
+index 6b7ec2ae5ad6..4012adbab011 100644
+--- a/drivers/net/ethernet/intel/ice/ice_switch.c
++++ b/drivers/net/ethernet/intel/ice/ice_switch.c
+@@ -468,6 +468,7 @@ ice_fill_sw_rule(struct ice_hw *hw, struct ice_fltr_info *f_info,
+ void *daddr = NULL;
+ u32 act = 0;
+ __be16 *off;
++ u8 q_rgn;
+
+ if (opc == ice_aqc_opc_remove_sw_rules) {
+ s_rule->pdata.lkup_tx_rx.act = 0;
+@@ -503,14 +504,19 @@ ice_fill_sw_rule(struct ice_hw *hw, struct ice_fltr_info *f_info,
+ act |= (f_info->fwd_id.q_id << ICE_SINGLE_ACT_Q_INDEX_S) &
+ ICE_SINGLE_ACT_Q_INDEX_M;
+ break;
++ case ICE_DROP_PACKET:
++ act |= ICE_SINGLE_ACT_VSI_FORWARDING | ICE_SINGLE_ACT_DROP |
++ ICE_SINGLE_ACT_VALID_BIT;
++ break;
+ case ICE_FWD_TO_QGRP:
++ q_rgn = f_info->qgrp_size > 0 ?
++ (u8)ilog2(f_info->qgrp_size) : 0;
+ act |= ICE_SINGLE_ACT_TO_Q;
+- act |= (f_info->qgrp_size << ICE_SINGLE_ACT_Q_REGION_S) &
++ act |= (f_info->fwd_id.q_id << ICE_SINGLE_ACT_Q_INDEX_S) &
++ ICE_SINGLE_ACT_Q_INDEX_M;
++ act |= (q_rgn << ICE_SINGLE_ACT_Q_REGION_S) &
+ ICE_SINGLE_ACT_Q_REGION_M;
+ break;
+- case ICE_DROP_PACKET:
+- act |= ICE_SINGLE_ACT_VSI_FORWARDING | ICE_SINGLE_ACT_DROP;
+- break;
+ default:
+ return;
+ }
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 85280765d793..b45a6e2ed8d1 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -3582,12 +3582,18 @@ static void ixgbe_setup_mtqc(struct ixgbe_adapter *adapter)
+ else
+ mtqc |= IXGBE_MTQC_64VF;
+ } else {
+- if (tcs > 4)
++ if (tcs > 4) {
+ mtqc = IXGBE_MTQC_RT_ENA | IXGBE_MTQC_8TC_8TQ;
+- else if (tcs > 1)
++ } else if (tcs > 1) {
+ mtqc = IXGBE_MTQC_RT_ENA | IXGBE_MTQC_4TC_4TQ;
+- else
+- mtqc = IXGBE_MTQC_64Q_1PB;
++ } else {
++ u8 max_txq = adapter->num_tx_queues +
++ adapter->num_xdp_queues;
++ if (max_txq > 63)
++ mtqc = IXGBE_MTQC_RT_ENA | IXGBE_MTQC_4TC_4TQ;
++ else
++ mtqc = IXGBE_MTQC_64Q_1PB;
++ }
+ }
+
+ IXGBE_WRITE_REG(hw, IXGBE_MTQC, mtqc);
+@@ -5181,6 +5187,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+ struct ixgbe_hw *hw = &adapter->hw;
+ struct hlist_node *node2;
+ struct ixgbe_fdir_filter *filter;
++ u64 action;
+
+ spin_lock(&adapter->fdir_perfect_lock);
+
+@@ -5189,12 +5196,17 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+
+ hlist_for_each_entry_safe(filter, node2,
+ &adapter->fdir_filter_list, fdir_node) {
++ action = filter->action;
++ if (action != IXGBE_FDIR_DROP_QUEUE && action != 0)
++ action =
++ (action >> ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF) - 1;
++
+ ixgbe_fdir_write_perfect_filter_82599(hw,
+ &filter->filter,
+ filter->sw_idx,
+- (filter->action == IXGBE_FDIR_DROP_QUEUE) ?
++ (action == IXGBE_FDIR_DROP_QUEUE) ?
+ IXGBE_FDIR_DROP_QUEUE :
+- adapter->rx_ring[filter->action]->reg_idx);
++ adapter->rx_ring[action]->reg_idx);
+ }
+
+ spin_unlock(&adapter->fdir_perfect_lock);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index a4f237f815d1..8d556eb37b7a 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -2324,8 +2324,15 @@ static int mlxsw_sp_switchdev_event(struct notifier_block *unused,
+ struct net_device *dev = switchdev_notifier_info_to_dev(ptr);
+ struct mlxsw_sp_switchdev_event_work *switchdev_work;
+ struct switchdev_notifier_fdb_info *fdb_info = ptr;
++ struct net_device *br_dev;
+
+- if (!mlxsw_sp_port_dev_lower_find_rcu(dev))
++ /* Tunnel devices are not our uppers, so check their master instead */
++ br_dev = netdev_master_upper_dev_get_rcu(dev);
++ if (!br_dev)
++ return NOTIFY_DONE;
++ if (!netif_is_bridge_master(br_dev))
++ return NOTIFY_DONE;
++ if (!mlxsw_sp_port_dev_lower_find_rcu(br_dev))
+ return NOTIFY_DONE;
+
+ switchdev_work = kzalloc(sizeof(*switchdev_work), GFP_ATOMIC);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index 015de1e0addd..2847509a183d 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -796,7 +796,18 @@ qed_ooo_submit_tx_buffers(struct qed_hwfn *p_hwfn,
+ tx_pkt.vlan = p_buffer->vlan;
+ tx_pkt.bd_flags = bd_flags;
+ tx_pkt.l4_hdr_offset_w = l4_hdr_offset_w;
+- tx_pkt.tx_dest = p_ll2_conn->tx_dest;
++ switch (p_ll2_conn->tx_dest) {
++ case CORE_TX_DEST_NW:
++ tx_pkt.tx_dest = QED_LL2_TX_DEST_NW;
++ break;
++ case CORE_TX_DEST_LB:
++ tx_pkt.tx_dest = QED_LL2_TX_DEST_LB;
++ break;
++ case CORE_TX_DEST_DROP:
++ default:
++ tx_pkt.tx_dest = QED_LL2_TX_DEST_DROP;
++ break;
++ }
+ tx_pkt.first_frag = first_frag;
+ tx_pkt.first_frag_len = p_buffer->packet_length;
+ tx_pkt.cookie = p_buffer;
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index a57d82ef0f81..1f57a6a2b8a2 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -579,7 +579,7 @@ static void cdc_ncm_set_dgram_size(struct usbnet *dev, int new_size)
+ err = usbnet_read_cmd(dev, USB_CDC_GET_MAX_DATAGRAM_SIZE,
+ USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
+ 0, iface_no, &max_datagram_size, sizeof(max_datagram_size));
+- if (err < sizeof(max_datagram_size)) {
++ if (err != sizeof(max_datagram_size)) {
+ dev_dbg(&dev->intf->dev, "GET_MAX_DATAGRAM_SIZE failed\n");
+ goto out;
+ }
+diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
+index 9feea02e7d37..5c9fc4070fd2 100644
+--- a/drivers/net/wireless/ath/ath10k/core.h
++++ b/drivers/net/wireless/ath/ath10k/core.h
+@@ -1003,6 +1003,7 @@ struct ath10k {
+
+ struct completion install_key_done;
+
++ int last_wmi_vdev_start_status;
+ struct completion vdev_setup_done;
+
+ struct workqueue_struct *workqueue;
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 9d033da46ec2..d3d33cc2adfd 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -968,7 +968,7 @@ static inline int ath10k_vdev_setup_sync(struct ath10k *ar)
+ if (time_left == 0)
+ return -ETIMEDOUT;
+
+- return 0;
++ return ar->last_wmi_vdev_start_status;
+ }
+
+ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 40b36e73bb48..aefc92d2c09b 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -3248,18 +3248,31 @@ void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar, struct sk_buff *skb)
+ {
+ struct wmi_vdev_start_ev_arg arg = {};
+ int ret;
++ u32 status;
+
+ ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_START_RESP_EVENTID\n");
+
++ ar->last_wmi_vdev_start_status = 0;
++
+ ret = ath10k_wmi_pull_vdev_start(ar, skb, &arg);
+ if (ret) {
+ ath10k_warn(ar, "failed to parse vdev start event: %d\n", ret);
+- return;
++ ar->last_wmi_vdev_start_status = ret;
++ goto out;
+ }
+
+- if (WARN_ON(__le32_to_cpu(arg.status)))
+- return;
++ status = __le32_to_cpu(arg.status);
++ if (WARN_ON_ONCE(status)) {
++ ath10k_warn(ar, "vdev-start-response reports status error: %d (%s)\n",
++ status, (status == WMI_VDEV_START_CHAN_INVALID) ?
++ "chan-invalid" : "unknown");
++ /* Setup is done one way or another though, so we should still
++ * do the completion, so don't return here.
++ */
++ ar->last_wmi_vdev_start_status = -EINVAL;
++ }
+
++out:
+ complete(&ar->vdev_setup_done);
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
+index 36220258e3c7..e341cfb3fcc2 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -6642,11 +6642,17 @@ struct wmi_ch_info_ev_arg {
+ __le32 rx_frame_count;
+ };
+
++/* From 10.4 firmware, not sure all have the same values. */
++enum wmi_vdev_start_status {
++ WMI_VDEV_START_OK = 0,
++ WMI_VDEV_START_CHAN_INVALID,
++};
++
+ struct wmi_vdev_start_ev_arg {
+ __le32 vdev_id;
+ __le32 req_id;
+ __le32 resp_type; /* %WMI_VDEV_RESP_ */
+- __le32 status;
++ __le32 status; /* See wmi_vdev_start_status enum above */
+ };
+
+ struct wmi_peer_kick_ev_arg {
+diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c
+index 440e16e641e4..f75eb068e6cf 100644
+--- a/drivers/net/wireless/ath/ath9k/common-spectral.c
++++ b/drivers/net/wireless/ath/ath9k/common-spectral.c
+@@ -411,7 +411,7 @@ ath_cmn_process_ht20_40_fft(struct ath_rx_status *rs,
+
+ ath_dbg(common, SPECTRAL_SCAN,
+ "Calculated new upper max 0x%X at %i\n",
+- tmp_mag, i);
++ tmp_mag, fft_sample_40.upper_max_index);
+ } else
+ for (i = dc_pos; i < SPECTRAL_HT20_40_NUM_BINS; i++) {
+ if (fft_sample_40.data[i] == (upper_mag >> max_exp))
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+index 3e9c4f2f5dd1..456a1bf008b3 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -74,7 +74,7 @@
+ #define P2P_AF_MAX_WAIT_TIME msecs_to_jiffies(2000)
+ #define P2P_INVALID_CHANNEL -1
+ #define P2P_CHANNEL_SYNC_RETRY 5
+-#define P2P_AF_FRM_SCAN_MAX_WAIT msecs_to_jiffies(1500)
++#define P2P_AF_FRM_SCAN_MAX_WAIT msecs_to_jiffies(450)
+ #define P2P_DEFAULT_SLEEP_TIME_VSDB 200
+
+ /* WiFi P2P Public Action Frame OUI Subtypes */
+@@ -1134,7 +1134,6 @@ static s32 brcmf_p2p_af_searching_channel(struct brcmf_p2p_info *p2p)
+ {
+ struct afx_hdl *afx_hdl = &p2p->afx_hdl;
+ struct brcmf_cfg80211_vif *pri_vif;
+- unsigned long duration;
+ s32 retry;
+
+ brcmf_dbg(TRACE, "Enter\n");
+@@ -1150,7 +1149,6 @@ static s32 brcmf_p2p_af_searching_channel(struct brcmf_p2p_info *p2p)
+ * pending action frame tx is cancelled.
+ */
+ retry = 0;
+- duration = msecs_to_jiffies(P2P_AF_FRM_SCAN_MAX_WAIT);
+ while ((retry < P2P_CHANNEL_SYNC_RETRY) &&
+ (afx_hdl->peer_chan == P2P_INVALID_CHANNEL)) {
+ afx_hdl->is_listen = false;
+@@ -1158,7 +1156,8 @@ static s32 brcmf_p2p_af_searching_channel(struct brcmf_p2p_info *p2p)
+ retry);
+ /* search peer on peer's listen channel */
+ schedule_work(&afx_hdl->afx_work);
+- wait_for_completion_timeout(&afx_hdl->act_frm_scan, duration);
++ wait_for_completion_timeout(&afx_hdl->act_frm_scan,
++ P2P_AF_FRM_SCAN_MAX_WAIT);
+ if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) ||
+ (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
+ &p2p->status)))
+@@ -1171,7 +1170,7 @@ static s32 brcmf_p2p_af_searching_channel(struct brcmf_p2p_info *p2p)
+ afx_hdl->is_listen = true;
+ schedule_work(&afx_hdl->afx_work);
+ wait_for_completion_timeout(&afx_hdl->act_frm_scan,
+- duration);
++ P2P_AF_FRM_SCAN_MAX_WAIT);
+ }
+ if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) ||
+ (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
+@@ -1458,10 +1457,12 @@ int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,
+ return 0;
+
+ if (e->event_code == BRCMF_E_ACTION_FRAME_COMPLETE) {
+- if (e->status == BRCMF_E_STATUS_SUCCESS)
++ if (e->status == BRCMF_E_STATUS_SUCCESS) {
+ set_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED,
+ &p2p->status);
+- else {
++ if (!p2p->wait_for_offchan_complete)
++ complete(&p2p->send_af_done);
++ } else {
+ set_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
+ /* If there is no ack, we don't need to wait for
+ * WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE event
+@@ -1512,6 +1513,17 @@ static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p,
+ p2p->af_sent_channel = le32_to_cpu(af_params->channel);
+ p2p->af_tx_sent_jiffies = jiffies;
+
++ if (test_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status) &&
++ p2p->af_sent_channel ==
++ ieee80211_frequency_to_channel(p2p->remain_on_channel.center_freq))
++ p2p->wait_for_offchan_complete = false;
++ else
++ p2p->wait_for_offchan_complete = true;
++
++ brcmf_dbg(TRACE, "Waiting for %s tx completion event\n",
++ (p2p->wait_for_offchan_complete) ?
++ "off-channel" : "on-channel");
++
+ timeout = wait_for_completion_timeout(&p2p->send_af_done,
+ P2P_AF_MAX_WAIT_TIME);
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+index 0e8b34d2d85c..39f0d0218088 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+@@ -124,6 +124,7 @@ struct afx_hdl {
+ * @gon_req_action: about to send go negotiation requets frame.
+ * @block_gon_req_tx: drop tx go negotiation requets frame.
+ * @p2pdev_dynamically: is p2p device if created by module param or supplicant.
++ * @wait_for_offchan_complete: wait for off-channel tx completion event.
+ */
+ struct brcmf_p2p_info {
+ struct brcmf_cfg80211_info *cfg;
+@@ -144,6 +145,7 @@ struct brcmf_p2p_info {
+ bool gon_req_action;
+ bool block_gon_req_tx;
+ bool p2pdev_dynamically;
++ bool wait_for_offchan_complete;
+ };
+
+ s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+index 79bdae994822..868cb1195a74 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+@@ -731,8 +731,10 @@ int iwl_mvm_wowlan_config_key_params(struct iwl_mvm *mvm,
+ {
+ struct iwl_wowlan_kek_kck_material_cmd kek_kck_cmd = {};
+ struct iwl_wowlan_tkip_params_cmd tkip_cmd = {};
++ bool unified = fw_has_capa(&mvm->fw->ucode_capa,
++ IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
+ struct wowlan_key_data key_data = {
+- .configure_keys = !d0i3,
++ .configure_keys = !d0i3 && !unified,
+ .use_rsc_tsc = false,
+ .tkip = &tkip_cmd,
+ .use_tkip = false,
+diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
+index ade4a2029a24..1b5abd4816ed 100644
+--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
++++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
+@@ -548,6 +548,12 @@ mt76_check_ps(struct mt76_dev *dev, struct sk_buff *skb)
+ struct mt76_wcid *wcid = status->wcid;
+ bool ps;
+
++ if (ieee80211_is_pspoll(hdr->frame_control) && !wcid) {
++ sta = ieee80211_find_sta_by_ifaddr(dev->hw, hdr->addr2, NULL);
++ if (sta)
++ wcid = status->wcid = (struct mt76_wcid *) sta->drv_priv;
++ }
++
+ if (!wcid || !wcid->sta)
+ return;
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_init_common.c b/drivers/net/wireless/mediatek/mt76/mt76x2_init_common.c
+index 324b2a4b8b67..54a9e1dfaf7a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_init_common.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_init_common.c
+@@ -72,6 +72,9 @@ void mt76x2_reset_wlan(struct mt76x2_dev *dev, bool enable)
+ {
+ u32 val;
+
++ if (!enable)
++ goto out;
++
+ val = mt76_rr(dev, MT_WLAN_FUN_CTRL);
+
+ val &= ~MT_WLAN_FUN_CTRL_FRC_WL_ANT_SEL;
+@@ -87,6 +90,7 @@ void mt76x2_reset_wlan(struct mt76x2_dev *dev, bool enable)
+ mt76_wr(dev, MT_WLAN_FUN_CTRL, val);
+ udelay(20);
+
++out:
+ mt76x2_set_wlan_state(dev, enable);
+ }
+ EXPORT_SYMBOL_GPL(mt76x2_reset_wlan);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_pci.c b/drivers/net/wireless/mediatek/mt76/mt76x2_pci.c
+index e66f047ea448..26cfda24ce08 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_pci.c
+@@ -53,6 +53,7 @@ mt76pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ return -ENOMEM;
+
+ mt76_mmio_init(&dev->mt76, pcim_iomap_table(pdev)[0]);
++ mt76x2_reset_wlan(dev, false);
+
+ dev->mt76.rev = mt76_rr(dev, MT_ASIC_VERSION);
+ dev_info(dev->mt76.dev, "ASIC revision: %08x\n", dev->mt76.rev);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_phy_common.c b/drivers/net/wireless/mediatek/mt76/mt76x2_phy_common.c
+index 9fd6ab4cbb94..ca68dd184489 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_phy_common.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_phy_common.c
+@@ -232,9 +232,9 @@ void mt76x2_phy_set_txpower(struct mt76x2_dev *dev)
+ mt76_wr(dev, MT_TX_PWR_CFG_7,
+ mt76x2_tx_power_mask(t.ofdm[6], t.vht[8], t.ht[6], t.vht[8]));
+ mt76_wr(dev, MT_TX_PWR_CFG_8,
+- mt76x2_tx_power_mask(t.ht[14], t.vht[8], t.vht[8], 0));
++ mt76x2_tx_power_mask(t.ht[14], 0, t.vht[8], t.vht[8]));
+ mt76_wr(dev, MT_TX_PWR_CFG_9,
+- mt76x2_tx_power_mask(t.ht[6], t.vht[8], t.vht[8], 0));
++ mt76x2_tx_power_mask(t.ht[6], 0, t.vht[8], t.vht[8]));
+ }
+ EXPORT_SYMBOL_GPL(mt76x2_phy_set_txpower);
+
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+index 4aa332f4646b..ff8a46c9595e 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+@@ -521,9 +521,16 @@ static int qtnf_del_key(struct wiphy *wiphy, struct net_device *dev,
+ int ret;
+
+ ret = qtnf_cmd_send_del_key(vif, key_index, pairwise, mac_addr);
+- if (ret)
+- pr_err("VIF%u.%u: failed to delete key: idx=%u pw=%u\n",
+- vif->mac->macid, vif->vifid, key_index, pairwise);
++ if (ret) {
++ if (ret == -ENOENT) {
++ pr_debug("VIF%u.%u: key index %d out of bounds\n",
++ vif->mac->macid, vif->vifid, key_index);
++ } else {
++ pr_err("VIF%u.%u: failed to delete key: idx=%u pw=%u\n",
++ vif->mac->macid, vif->vifid,
++ key_index, pairwise);
++ }
++ }
+
+ return ret;
+ }
+@@ -1109,6 +1116,9 @@ int qtnf_wiphy_register(struct qtnf_hw_info *hw_info, struct qtnf_wmac *mac)
+ if (hw_info->hw_capab & QLINK_HW_CAPAB_SCAN_RANDOM_MAC_ADDR)
+ wiphy->features |= NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
+
++ if (!(hw_info->hw_capab & QLINK_HW_CAPAB_OBSS_SCAN))
++ wiphy->features |= NL80211_FEATURE_NEED_OBSS_SCAN;
++
+ #ifdef CONFIG_PM
+ if (macinfo->wowlan)
+ wiphy->wowlan = macinfo->wowlan;
+@@ -1123,6 +1133,15 @@ int qtnf_wiphy_register(struct qtnf_hw_info *hw_info, struct qtnf_wmac *mac)
+ wiphy->regulatory_flags |= REGULATORY_WIPHY_SELF_MANAGED;
+ }
+
++ if (mac->macinfo.extended_capabilities_len) {
++ wiphy->extended_capabilities =
++ mac->macinfo.extended_capabilities;
++ wiphy->extended_capabilities_mask =
++ mac->macinfo.extended_capabilities_mask;
++ wiphy->extended_capabilities_len =
++ mac->macinfo.extended_capabilities_len;
++ }
++
+ strlcpy(wiphy->fw_version, hw_info->fw_version,
+ sizeof(wiphy->fw_version));
+ wiphy->hw_version = hw_info->hw_version;
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c
+index ae9e77300533..734844b34c26 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c
+@@ -544,6 +544,9 @@ qtnf_sta_info_parse_rate(struct rate_info *rate_dst,
+ rate_dst->flags |= RATE_INFO_FLAGS_MCS;
+ else if (rate_src->flags & QLINK_STA_INFO_RATE_FLAG_VHT_MCS)
+ rate_dst->flags |= RATE_INFO_FLAGS_VHT_MCS;
++
++ if (rate_src->flags & QLINK_STA_INFO_RATE_FLAG_SHORT_GI)
++ rate_dst->flags |= RATE_INFO_FLAGS_SHORT_GI;
+ }
+
+ static void
+@@ -1353,8 +1356,7 @@ static int qtnf_parse_variable_mac_info(struct qtnf_wmac *mac,
+ ext_capa_mask = NULL;
+ }
+
+- kfree(mac->macinfo.extended_capabilities);
+- kfree(mac->macinfo.extended_capabilities_mask);
++ qtnf_mac_ext_caps_free(mac);
+ mac->macinfo.extended_capabilities = ext_capa;
+ mac->macinfo.extended_capabilities_mask = ext_capa_mask;
+ mac->macinfo.extended_capabilities_len = ext_capa_len;
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/core.c b/drivers/net/wireless/quantenna/qtnfmac/core.c
+index 19abbc4e23e0..08928d5e252d 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/core.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/core.c
+@@ -304,6 +304,19 @@ void qtnf_mac_iface_comb_free(struct qtnf_wmac *mac)
+ }
+ }
+
++void qtnf_mac_ext_caps_free(struct qtnf_wmac *mac)
++{
++ if (mac->macinfo.extended_capabilities_len) {
++ kfree(mac->macinfo.extended_capabilities);
++ mac->macinfo.extended_capabilities = NULL;
++
++ kfree(mac->macinfo.extended_capabilities_mask);
++ mac->macinfo.extended_capabilities_mask = NULL;
++
++ mac->macinfo.extended_capabilities_len = 0;
++ }
++}
++
+ static void qtnf_vif_reset_handler(struct work_struct *work)
+ {
+ struct qtnf_vif *vif = container_of(work, struct qtnf_vif, reset_work);
+@@ -493,8 +506,7 @@ static void qtnf_core_mac_detach(struct qtnf_bus *bus, unsigned int macid)
+ }
+
+ qtnf_mac_iface_comb_free(mac);
+- kfree(mac->macinfo.extended_capabilities);
+- kfree(mac->macinfo.extended_capabilities_mask);
++ qtnf_mac_ext_caps_free(mac);
+ kfree(mac->macinfo.wowlan);
+ wiphy_free(wiphy);
+ bus->mac[macid] = NULL;
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/core.h b/drivers/net/wireless/quantenna/qtnfmac/core.h
+index a1e338a1f055..ecb5c41c8ed7 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/core.h
++++ b/drivers/net/wireless/quantenna/qtnfmac/core.h
+@@ -151,6 +151,7 @@ struct qtnf_hw_info {
+ struct qtnf_vif *qtnf_mac_get_free_vif(struct qtnf_wmac *mac);
+ struct qtnf_vif *qtnf_mac_get_base_vif(struct qtnf_wmac *mac);
+ void qtnf_mac_iface_comb_free(struct qtnf_wmac *mac);
++void qtnf_mac_ext_caps_free(struct qtnf_wmac *mac);
+ struct wiphy *qtnf_wiphy_allocate(struct qtnf_bus *bus);
+ int qtnf_core_net_attach(struct qtnf_wmac *mac, struct qtnf_vif *priv,
+ const char *name, unsigned char name_assign_type);
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/qlink.h b/drivers/net/wireless/quantenna/qtnfmac/qlink.h
+index 99d37e3efba6..c5ae4ea9a47a 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/qlink.h
++++ b/drivers/net/wireless/quantenna/qtnfmac/qlink.h
+@@ -71,6 +71,7 @@ struct qlink_msg_header {
+ * @QLINK_HW_CAPAB_DFS_OFFLOAD: device implements DFS offload functionality
+ * @QLINK_HW_CAPAB_SCAN_RANDOM_MAC_ADDR: device supports MAC Address
+ * Randomization in probe requests.
++ * @QLINK_HW_CAPAB_OBSS_SCAN: device can perform OBSS scanning.
+ */
+ enum qlink_hw_capab {
+ QLINK_HW_CAPAB_REG_UPDATE = BIT(0),
+@@ -78,6 +79,7 @@ enum qlink_hw_capab {
+ QLINK_HW_CAPAB_DFS_OFFLOAD = BIT(2),
+ QLINK_HW_CAPAB_SCAN_RANDOM_MAC_ADDR = BIT(3),
+ QLINK_HW_CAPAB_PWR_MGMT = BIT(4),
++ QLINK_HW_CAPAB_OBSS_SCAN = BIT(5),
+ };
+
+ enum qlink_iface_type {
+diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
+index b026e80940a4..6fbf8845a2ab 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
+@@ -1324,13 +1324,13 @@ bool exhalbtc_initlize_variables_wifi_only(struct rtl_priv *rtlpriv)
+
+ switch (rtlpriv->rtlhal.interface) {
+ case INTF_PCI:
+- wifionly_cfg->chip_interface = BTC_INTF_PCI;
++ wifionly_cfg->chip_interface = WIFIONLY_INTF_PCI;
+ break;
+ case INTF_USB:
+- wifionly_cfg->chip_interface = BTC_INTF_USB;
++ wifionly_cfg->chip_interface = WIFIONLY_INTF_USB;
+ break;
+ default:
+- wifionly_cfg->chip_interface = BTC_INTF_UNKNOWN;
++ wifionly_cfg->chip_interface = WIFIONLY_INTF_UNKNOWN;
+ break;
+ }
+
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index 27b6b141cb71..4cafc31b98b7 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -173,7 +173,8 @@ static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb,
+ [skb_get_hash_raw(skb) % size];
+ }
+
+-static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct xenvif *vif = netdev_priv(dev);
+ struct xenvif_queue *queue = NULL;
+diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
+index 6fe5923c95d4..a69553e75f38 100644
+--- a/drivers/nvme/host/lightnvm.c
++++ b/drivers/nvme/host/lightnvm.c
+@@ -968,6 +968,9 @@ void nvme_nvm_update_nvm_info(struct nvme_ns *ns)
+ struct nvm_dev *ndev = ns->ndev;
+ struct nvm_geo *geo = &ndev->geo;
+
++ if (geo->version == NVM_OCSSD_SPEC_12)
++ return;
++
+ geo->csecs = 1 << ns->lba_shift;
+ geo->sos = ns->ms;
+ }
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 14d4ef594374..1e80f9ec1aa6 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -48,14 +48,9 @@ static struct opp_device *_find_opp_dev(const struct device *dev,
+ static struct opp_table *_find_opp_table_unlocked(struct device *dev)
+ {
+ struct opp_table *opp_table;
+- bool found;
+
+ list_for_each_entry(opp_table, &opp_tables, node) {
+- mutex_lock(&opp_table->lock);
+- found = !!_find_opp_dev(dev, opp_table);
+- mutex_unlock(&opp_table->lock);
+-
+- if (found) {
++ if (_find_opp_dev(dev, opp_table)) {
+ _get_opp_table_kref(opp_table);
+
+ return opp_table;
+@@ -318,7 +313,7 @@ int dev_pm_opp_get_opp_count(struct device *dev)
+ count = PTR_ERR(opp_table);
+ dev_dbg(dev, "%s: OPP table not found (%d)\n",
+ __func__, count);
+- return 0;
++ return count;
+ }
+
+ count = _get_opp_count(opp_table);
+@@ -771,8 +766,6 @@ struct opp_device *_add_opp_dev(const struct device *dev,
+
+ /* Initialize opp-dev */
+ opp_dev->dev = dev;
+-
+- mutex_lock(&opp_table->lock);
+ list_add(&opp_dev->node, &opp_table->dev_list);
+
+ /* Create debugfs entries for the opp_table */
+@@ -780,7 +773,6 @@ struct opp_device *_add_opp_dev(const struct device *dev,
+ if (ret)
+ dev_err(dev, "%s: Failed to register opp debugfs (%d)\n",
+ __func__, ret);
+- mutex_unlock(&opp_table->lock);
+
+ return opp_dev;
+ }
+@@ -799,7 +791,6 @@ static struct opp_table *_allocate_opp_table(struct device *dev)
+ if (!opp_table)
+ return NULL;
+
+- mutex_init(&opp_table->lock);
+ INIT_LIST_HEAD(&opp_table->dev_list);
+
+ opp_dev = _add_opp_dev(dev, opp_table);
+@@ -821,6 +812,7 @@ static struct opp_table *_allocate_opp_table(struct device *dev)
+
+ BLOCKING_INIT_NOTIFIER_HEAD(&opp_table->head);
+ INIT_LIST_HEAD(&opp_table->opp_list);
++ mutex_init(&opp_table->lock);
+ kref_init(&opp_table->kref);
+
+ /* Secure the device table modification */
+@@ -862,10 +854,6 @@ static void _opp_table_kref_release(struct kref *kref)
+ if (!IS_ERR(opp_table->clk))
+ clk_put(opp_table->clk);
+
+- /*
+- * No need to take opp_table->lock here as we are guaranteed that no
+- * references to the OPP table are taken at this point.
+- */
+ opp_dev = list_first_entry(&opp_table->dev_list, struct opp_device,
+ node);
+
+@@ -1731,9 +1719,6 @@ void _dev_pm_opp_remove_table(struct opp_table *opp_table, struct device *dev,
+ {
+ struct dev_pm_opp *opp, *tmp;
+
+- /* Protect dev_list */
+- mutex_lock(&opp_table->lock);
+-
+ /* Find if opp_table manages a single device */
+ if (list_is_singular(&opp_table->dev_list)) {
+ /* Free static OPPs */
+@@ -1751,8 +1736,6 @@ void _dev_pm_opp_remove_table(struct opp_table *opp_table, struct device *dev,
+ } else {
+ _remove_opp_dev(_find_opp_dev(dev, opp_table), opp_table);
+ }
+-
+- mutex_unlock(&opp_table->lock);
+ }
+
+ void _dev_pm_opp_find_and_remove_table(struct device *dev, bool remove_all)
+diff --git a/drivers/opp/cpu.c b/drivers/opp/cpu.c
+index 2868a022a040..0c0910709435 100644
+--- a/drivers/opp/cpu.c
++++ b/drivers/opp/cpu.c
+@@ -222,10 +222,8 @@ int dev_pm_opp_get_sharing_cpus(struct device *cpu_dev, struct cpumask *cpumask)
+ cpumask_clear(cpumask);
+
+ if (opp_table->shared_opp == OPP_TABLE_ACCESS_SHARED) {
+- mutex_lock(&opp_table->lock);
+ list_for_each_entry(opp_dev, &opp_table->dev_list, node)
+ cpumask_set_cpu(opp_dev->dev->id, cpumask);
+- mutex_unlock(&opp_table->lock);
+ } else {
+ cpumask_set_cpu(cpu_dev->id, cpumask);
+ }
+diff --git a/drivers/opp/opp.h b/drivers/opp/opp.h
+index e0866b1c1f1b..7c540fd063b2 100644
+--- a/drivers/opp/opp.h
++++ b/drivers/opp/opp.h
+@@ -126,7 +126,7 @@ enum opp_table_access {
+ * @dev_list: list of devices that share these OPPs
+ * @opp_list: table of opps
+ * @kref: for reference count of the table.
+- * @lock: mutex protecting the opp_list and dev_list.
++ * @lock: mutex protecting the opp_list.
+ * @np: struct device_node pointer for opp's DT node.
+ * @clock_latency_ns_max: Max clock latency in nanoseconds.
+ * @shared_opp: OPP is shared between multiple devices.
+diff --git a/drivers/pinctrl/pinctrl-gemini.c b/drivers/pinctrl/pinctrl-gemini.c
+index fa7d998e1d5a..3535f9841861 100644
+--- a/drivers/pinctrl/pinctrl-gemini.c
++++ b/drivers/pinctrl/pinctrl-gemini.c
+@@ -591,13 +591,16 @@ static const unsigned int tvc_3512_pins[] = {
+ 319, /* TVC_DATA[1] */
+ 301, /* TVC_DATA[2] */
+ 283, /* TVC_DATA[3] */
+- 265, /* TVC_CLK */
+ 320, /* TVC_DATA[4] */
+ 302, /* TVC_DATA[5] */
+ 284, /* TVC_DATA[6] */
+ 266, /* TVC_DATA[7] */
+ };
+
++static const unsigned int tvc_clk_3512_pins[] = {
++ 265, /* TVC_CLK */
++};
++
+ /* NAND flash pins */
+ static const unsigned int nflash_3512_pins[] = {
+ 199, 200, 201, 202, 216, 217, 218, 219, 220, 234, 235, 236, 237, 252,
+@@ -629,7 +632,7 @@ static const unsigned int pflash_3512_pins_extended[] = {
+ /* Serial flash pins CE0, CE1, DI, DO, CK */
+ static const unsigned int sflash_3512_pins[] = { 230, 231, 232, 233, 211 };
+
+-/* The GPIO0A (0) pin overlap with TVC and extended parallel flash */
++/* The GPIO0A (0) pin overlap with TVC CLK and extended parallel flash */
+ static const unsigned int gpio0a_3512_pins[] = { 265 };
+
+ /* The GPIO0B (1-4) pins overlap with TVC and ICE */
+@@ -823,7 +826,13 @@ static const struct gemini_pin_group gemini_3512_pin_groups[] = {
+ .num_pins = ARRAY_SIZE(tvc_3512_pins),
+ /* Conflict with character LCD and ICE */
+ .mask = LCD_PADS_ENABLE,
+- .value = TVC_PADS_ENABLE | TVC_CLK_PAD_ENABLE,
++ .value = TVC_PADS_ENABLE,
++ },
++ {
++ .name = "tvcclkgrp",
++ .pins = tvc_clk_3512_pins,
++ .num_pins = ARRAY_SIZE(tvc_clk_3512_pins),
++ .value = TVC_CLK_PAD_ENABLE,
+ },
+ /*
+ * The construction is done such that it is possible to use a serial
+@@ -860,8 +869,8 @@ static const struct gemini_pin_group gemini_3512_pin_groups[] = {
+ .name = "gpio0agrp",
+ .pins = gpio0a_3512_pins,
+ .num_pins = ARRAY_SIZE(gpio0a_3512_pins),
+- /* Conflict with TVC */
+- .mask = TVC_PADS_ENABLE,
++ /* Conflict with TVC CLK */
++ .mask = TVC_CLK_PAD_ENABLE,
+ },
+ {
+ .name = "gpio0bgrp",
+@@ -1531,13 +1540,16 @@ static const unsigned int tvc_3516_pins[] = {
+ 311, /* TVC_DATA[1] */
+ 394, /* TVC_DATA[2] */
+ 374, /* TVC_DATA[3] */
+- 333, /* TVC_CLK */
+ 354, /* TVC_DATA[4] */
+ 395, /* TVC_DATA[5] */
+ 312, /* TVC_DATA[6] */
+ 334, /* TVC_DATA[7] */
+ };
+
++static const unsigned int tvc_clk_3516_pins[] = {
++ 333, /* TVC_CLK */
++};
++
+ /* NAND flash pins */
+ static const unsigned int nflash_3516_pins[] = {
+ 243, 260, 261, 224, 280, 262, 281, 264, 300, 263, 282, 301, 320, 283,
+@@ -1570,7 +1582,7 @@ static const unsigned int pflash_3516_pins_extended[] = {
+ static const unsigned int sflash_3516_pins[] = { 296, 338, 295, 359, 339 };
+
+ /* The GPIO0A (0-4) pins overlap with TVC and extended parallel flash */
+-static const unsigned int gpio0a_3516_pins[] = { 333, 354, 395, 312, 334 };
++static const unsigned int gpio0a_3516_pins[] = { 354, 395, 312, 334 };
+
+ /* The GPIO0B (5-7) pins overlap with ICE */
+ static const unsigned int gpio0b_3516_pins[] = { 375, 396, 376 };
+@@ -1602,6 +1614,9 @@ static const unsigned int gpio0j_3516_pins[] = { 359, 339 };
+ /* The GPIO0K (30,31) pins overlap with NAND flash */
+ static const unsigned int gpio0k_3516_pins[] = { 275, 298 };
+
++/* The GPIO0L (0) pins overlap with TVC_CLK */
++static const unsigned int gpio0l_3516_pins[] = { 333 };
++
+ /* The GPIO1A (0-4) pins that overlap with IDE and parallel flash */
+ static const unsigned int gpio1a_3516_pins[] = { 221, 200, 222, 201, 220 };
+
+@@ -1761,7 +1776,13 @@ static const struct gemini_pin_group gemini_3516_pin_groups[] = {
+ .num_pins = ARRAY_SIZE(tvc_3516_pins),
+ /* Conflict with character LCD */
+ .mask = LCD_PADS_ENABLE,
+- .value = TVC_PADS_ENABLE | TVC_CLK_PAD_ENABLE,
++ .value = TVC_PADS_ENABLE,
++ },
++ {
++ .name = "tvcclkgrp",
++ .pins = tvc_clk_3516_pins,
++ .num_pins = ARRAY_SIZE(tvc_clk_3516_pins),
++ .value = TVC_CLK_PAD_ENABLE,
+ },
+ /*
+ * The construction is done such that it is possible to use a serial
+@@ -1872,6 +1893,13 @@ static const struct gemini_pin_group gemini_3516_pin_groups[] = {
+ /* Conflict with parallel and NAND flash */
+ .value = PFLASH_PADS_DISABLE | NAND_PADS_DISABLE,
+ },
++ {
++ .name = "gpio0lgrp",
++ .pins = gpio0l_3516_pins,
++ .num_pins = ARRAY_SIZE(gpio0l_3516_pins),
++ /* Conflict with TVE CLK */
++ .mask = TVC_CLK_PAD_ENABLE,
++ },
+ {
+ .name = "gpio1agrp",
+ .pins = gpio1a_3516_pins,
+@@ -2184,7 +2212,8 @@ static int gemini_pmx_set_mux(struct pinctrl_dev *pctldev,
+ func->name, grp->name);
+
+ regmap_read(pmx->map, GLOBAL_MISC_CTRL, &before);
+- regmap_update_bits(pmx->map, GLOBAL_MISC_CTRL, grp->mask,
++ regmap_update_bits(pmx->map, GLOBAL_MISC_CTRL,
++ grp->mask | grp->value,
+ grp->value);
+ regmap_read(pmx->map, GLOBAL_MISC_CTRL, &after);
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 742a0c217925..d17db140cb1f 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -575,7 +575,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_msn201x_items[] = {
+
+ static
+ struct mlxreg_core_hotplug_platform_data mlxplat_mlxcpld_msn201x_data = {
+- .items = mlxplat_mlxcpld_msn21xx_items,
++ .items = mlxplat_mlxcpld_msn201x_items,
+ .counter = ARRAY_SIZE(mlxplat_mlxcpld_msn201x_items),
+ .cell = MLXPLAT_CPLD_LPC_REG_AGGR_OFFSET,
+ .mask = MLXPLAT_CPLD_AGGR_MASK_DEF,
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 602af839421d..0d33e3079f0d 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -84,6 +84,7 @@ static irqreturn_t q6v5_fatal_interrupt(int irq, void *data)
+ else
+ dev_err(q6v5->dev, "fatal error without message\n");
+
++ q6v5->running = false;
+ rproc_report_crash(q6v5->rproc, RPROC_FATAL_ERROR);
+
+ return IRQ_HANDLED;
+@@ -150,8 +151,6 @@ int qcom_q6v5_request_stop(struct qcom_q6v5 *q6v5)
+ {
+ int ret;
+
+- q6v5->running = false;
+-
+ qcom_smem_state_update_bits(q6v5->state,
+ BIT(q6v5->stop_bit), BIT(q6v5->stop_bit));
+
+diff --git a/drivers/remoteproc/remoteproc_sysfs.c b/drivers/remoteproc/remoteproc_sysfs.c
+index 47be411400e5..3a4c3d7cafca 100644
+--- a/drivers/remoteproc/remoteproc_sysfs.c
++++ b/drivers/remoteproc/remoteproc_sysfs.c
+@@ -48,6 +48,11 @@ static ssize_t firmware_store(struct device *dev,
+ }
+
+ len = strcspn(buf, "\n");
++ if (!len) {
++ dev_err(dev, "can't provide a NULL firmware\n");
++ err = -EINVAL;
++ goto out;
++ }
+
+ p = kstrndup(buf, len, GFP_KERNEL);
+ if (!p) {
+diff --git a/drivers/reset/core.c b/drivers/reset/core.c
+index 225e34c56b94..d1887c0ed5d3 100644
+--- a/drivers/reset/core.c
++++ b/drivers/reset/core.c
+@@ -496,28 +496,29 @@ struct reset_control *__of_reset_control_get(struct device_node *node,
+ break;
+ }
+ }
+- of_node_put(args.np);
+
+ if (!rcdev) {
+- mutex_unlock(&reset_list_mutex);
+- return ERR_PTR(-EPROBE_DEFER);
++ rstc = ERR_PTR(-EPROBE_DEFER);
++ goto out;
+ }
+
+ if (WARN_ON(args.args_count != rcdev->of_reset_n_cells)) {
+- mutex_unlock(&reset_list_mutex);
+- return ERR_PTR(-EINVAL);
++ rstc = ERR_PTR(-EINVAL);
++ goto out;
+ }
+
+ rstc_id = rcdev->of_xlate(rcdev, &args);
+ if (rstc_id < 0) {
+- mutex_unlock(&reset_list_mutex);
+- return ERR_PTR(rstc_id);
++ rstc = ERR_PTR(rstc_id);
++ goto out;
+ }
+
+ /* reset_list_mutex also protects the rcdev's reset_control list */
+ rstc = __reset_control_get_internal(rcdev, rstc_id, shared);
+
++out:
+ mutex_unlock(&reset_list_mutex);
++ of_node_put(args.np);
+
+ return rstc;
+ }
+diff --git a/drivers/rpmsg/qcom_glink_smem.c b/drivers/rpmsg/qcom_glink_smem.c
+index 2b5cf2790954..7b6544348a3e 100644
+--- a/drivers/rpmsg/qcom_glink_smem.c
++++ b/drivers/rpmsg/qcom_glink_smem.c
+@@ -89,15 +89,11 @@ static void glink_smem_rx_peak(struct qcom_glink_pipe *np,
+ tail -= pipe->native.length;
+
+ len = min_t(size_t, count, pipe->native.length - tail);
+- if (len) {
+- __ioread32_copy(data, pipe->fifo + tail,
+- len / sizeof(u32));
+- }
++ if (len)
++ memcpy_fromio(data, pipe->fifo + tail, len);
+
+- if (len != count) {
+- __ioread32_copy(data + len, pipe->fifo,
+- (count - len) / sizeof(u32));
+- }
++ if (len != count)
++ memcpy_fromio(data + len, pipe->fifo, (count - len));
+ }
+
+ static void glink_smem_rx_advance(struct qcom_glink_pipe *np,
+diff --git a/drivers/s390/char/Makefile b/drivers/s390/char/Makefile
+index c6ab34f94b1b..3072b89785dd 100644
+--- a/drivers/s390/char/Makefile
++++ b/drivers/s390/char/Makefile
+@@ -11,6 +11,7 @@ endif
+ GCOV_PROFILE_sclp_early_core.o := n
+ KCOV_INSTRUMENT_sclp_early_core.o := n
+ UBSAN_SANITIZE_sclp_early_core.o := n
++KASAN_SANITIZE_sclp_early_core.o := n
+
+ CFLAGS_sclp_early_core.o += -D__NO_FORTIFY
+
+diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
+index 12316ef4c893..c75d4695f982 100644
+--- a/drivers/scsi/arcmsr/arcmsr_hba.c
++++ b/drivers/scsi/arcmsr/arcmsr_hba.c
+@@ -4135,9 +4135,9 @@ static void arcmsr_hardware_reset(struct AdapterControlBlock *acb)
+ pci_read_config_byte(acb->pdev, i, &value[i]);
+ }
+ /* hardware reset signal */
+- if ((acb->dev_id == 0x1680)) {
++ if (acb->dev_id == 0x1680) {
+ writel(ARCMSR_ARC1680_BUS_RESET, &pmuA->reserved1[0]);
+- } else if ((acb->dev_id == 0x1880)) {
++ } else if (acb->dev_id == 0x1880) {
+ do {
+ count++;
+ writel(0xF, &pmuC->write_sequence);
+@@ -4161,7 +4161,7 @@ static void arcmsr_hardware_reset(struct AdapterControlBlock *acb)
+ } while (((readl(&pmuE->host_diagnostic_3xxx) &
+ ARCMSR_ARC1884_DiagWrite_ENABLE) == 0) && (count < 5));
+ writel(ARCMSR_ARC188X_RESET_ADAPTER, &pmuE->host_diagnostic_3xxx);
+- } else if ((acb->dev_id == 0x1214)) {
++ } else if (acb->dev_id == 0x1214) {
+ writel(0x20, pmuD->reset_request);
+ } else {
+ pci_write_config_byte(acb->pdev, 0x84, 0x20);
+diff --git a/drivers/soc/fsl/qbman/bman_portal.c b/drivers/soc/fsl/qbman/bman_portal.c
+index 2f71f7df3465..f9edd28894fd 100644
+--- a/drivers/soc/fsl/qbman/bman_portal.c
++++ b/drivers/soc/fsl/qbman/bman_portal.c
+@@ -91,7 +91,15 @@ static int bman_portal_probe(struct platform_device *pdev)
+ struct device_node *node = dev->of_node;
+ struct bm_portal_config *pcfg;
+ struct resource *addr_phys[2];
+- int irq, cpu;
++ int irq, cpu, err;
++
++ err = bman_is_probed();
++ if (!err)
++ return -EPROBE_DEFER;
++ if (err < 0) {
++ dev_err(&pdev->dev, "failing probe due to bman probe error\n");
++ return -ENODEV;
++ }
+
+ pcfg = devm_kmalloc(dev, sizeof(*pcfg), GFP_KERNEL);
+ if (!pcfg)
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index e6d5cc6ab108..51670976faa3 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -276,7 +276,7 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi)
+
+ fsl_lpspi_set_watermark(fsl_lpspi);
+
+- temp = CFGR1_PCSCFG | CFGR1_MASTER | CFGR1_NOSTALL;
++ temp = CFGR1_PCSCFG | CFGR1_MASTER;
+ if (fsl_lpspi->config.mode & SPI_CS_HIGH)
+ temp |= CFGR1_PCSPOL;
+ writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1);
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index 3dc31627c655..0c2867deb36f 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -522,11 +522,11 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
+ mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len);
+ mtk_spi_setup_packet(master);
+
+- cnt = len / 4;
++ cnt = mdata->xfer_len / 4;
+ iowrite32_rep(mdata->base + SPI_TX_DATA_REG,
+ trans->tx_buf + mdata->num_xfered, cnt);
+
+- remainder = len % 4;
++ remainder = mdata->xfer_len % 4;
+ if (remainder > 0) {
+ reg_val = 0;
+ memcpy(®_val,
+diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
+index fdcf3076681b..185bbdce62b1 100644
+--- a/drivers/spi/spi-rockchip.c
++++ b/drivers/spi/spi-rockchip.c
+@@ -445,6 +445,9 @@ static int rockchip_spi_prepare_dma(struct rockchip_spi *rs)
+ struct dma_slave_config rxconf, txconf;
+ struct dma_async_tx_descriptor *rxdesc, *txdesc;
+
++ memset(&rxconf, 0, sizeof(rxconf));
++ memset(&txconf, 0, sizeof(txconf));
++
+ spin_lock_irqsave(&rs->lock, flags);
+ rs->state &= ~RXBUSY;
+ rs->state &= ~TXBUSY;
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index cda10719d1d1..c5fe08bc34a0 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -724,11 +724,9 @@ static int spidev_probe(struct spi_device *spi)
+ * compatible string, it is a Linux implementation thing
+ * rather than a description of the hardware.
+ */
+- if (spi->dev.of_node && !of_match_device(spidev_dt_ids, &spi->dev)) {
+- dev_err(&spi->dev, "buggy DT: spidev listed directly in DT\n");
+- WARN_ON(spi->dev.of_node &&
+- !of_match_device(spidev_dt_ids, &spi->dev));
+- }
++ WARN(spi->dev.of_node &&
++ of_device_is_compatible(spi->dev.of_node, "spidev"),
++ "%pOF: buggy DT: spidev listed directly in DT\n", spi->dev.of_node);
+
+ spidev_probe_acpi(spi);
+
+diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
+index 34dce850067b..2f254f957b0a 100644
+--- a/drivers/tee/optee/core.c
++++ b/drivers/tee/optee/core.c
+@@ -696,8 +696,10 @@ static int __init optee_driver_init(void)
+ return -ENODEV;
+
+ np = of_find_matching_node(fw_np, optee_match);
+- if (!np || !of_device_is_available(np))
++ if (!np || !of_device_is_available(np)) {
++ of_node_put(np);
+ return -ENODEV;
++ }
+
+ optee = optee_probe(np);
+ of_node_put(np);
+diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
+index dff2c6e8d797..a93415f33bf3 100644
+--- a/drivers/usb/dwc2/params.c
++++ b/drivers/usb/dwc2/params.c
+@@ -88,6 +88,7 @@ static void dwc2_set_rk_params(struct dwc2_hsotg *hsotg)
+ p->host_perio_tx_fifo_size = 256;
+ p->ahbcfg = GAHBCFG_HBSTLEN_INCR16 <<
+ GAHBCFG_HBSTLEN_SHIFT;
++ p->power_down = 0;
+ }
+
+ static void dwc2_set_ltq_params(struct dwc2_hsotg *hsotg)
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 8398c33d08e7..3e04004b4f1b 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -271,27 +271,36 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
+ const struct usb_endpoint_descriptor *desc = dep->endpoint.desc;
+ struct dwc3 *dwc = dep->dwc;
+ u32 timeout = 1000;
++ u32 saved_config = 0;
+ u32 reg;
+
+ int cmd_status = 0;
+- int susphy = false;
+ int ret = -EINVAL;
+
+ /*
+- * Synopsys Databook 2.60a states, on section 6.3.2.5.[1-8], that if
+- * we're issuing an endpoint command, we must check if
+- * GUSB2PHYCFG.SUSPHY bit is set. If it is, then we need to clear it.
++ * When operating in USB 2.0 speeds (HS/FS), if GUSB2PHYCFG.ENBLSLPM or
++ * GUSB2PHYCFG.SUSPHY is set, it must be cleared before issuing an
++ * endpoint command.
+ *
+- * We will also set SUSPHY bit to what it was before returning as stated
+- * by the same section on Synopsys databook.
++ * Save and clear both GUSB2PHYCFG.ENBLSLPM and GUSB2PHYCFG.SUSPHY
++ * settings. Restore them after the command is completed.
++ *
++ * DWC_usb3 3.30a and DWC_usb31 1.90a programming guide section 3.2.2
+ */
+ if (dwc->gadget.speed <= USB_SPEED_HIGH) {
+ reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+ if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) {
+- susphy = true;
++ saved_config |= DWC3_GUSB2PHYCFG_SUSPHY;
+ reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
+- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
+ }
++
++ if (reg & DWC3_GUSB2PHYCFG_ENBLSLPM) {
++ saved_config |= DWC3_GUSB2PHYCFG_ENBLSLPM;
++ reg &= ~DWC3_GUSB2PHYCFG_ENBLSLPM;
++ }
++
++ if (saved_config)
++ dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
+ }
+
+ if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) {
+@@ -380,9 +389,9 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
+ dwc3_gadget_ep_get_transfer_index(dep);
+ }
+
+- if (unlikely(susphy)) {
++ if (saved_config) {
+ reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+- reg |= DWC3_GUSB2PHYCFG_SUSPHY;
++ reg |= saved_config;
+ dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
+ }
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index 587c5037ff07..bc6abaea907d 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -741,7 +741,7 @@ static void fotg210_get_status(struct fotg210_udc *fotg210,
+ fotg210->ep0_req->length = 2;
+
+ spin_unlock(&fotg210->lock);
+- fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_KERNEL);
++ fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_ATOMIC);
+ spin_lock(&fotg210->lock);
+ }
+
+diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
+index e0035c023120..2c58649fd47a 100644
+--- a/drivers/usb/serial/cypress_m8.c
++++ b/drivers/usb/serial/cypress_m8.c
+@@ -769,7 +769,7 @@ send:
+
+ usb_fill_int_urb(port->interrupt_out_urb, port->serial->dev,
+ usb_sndintpipe(port->serial->dev, port->interrupt_out_endpointAddress),
+- port->interrupt_out_buffer, port->interrupt_out_size,
++ port->interrupt_out_buffer, actual_size,
+ cypress_write_int_callback, port, priv->write_urb_interval);
+ result = usb_submit_urb(port->interrupt_out_urb, GFP_ATOMIC);
+ if (result) {
+diff --git a/drivers/video/backlight/lm3639_bl.c b/drivers/video/backlight/lm3639_bl.c
+index cd50df5807ea..086611c7bc03 100644
+--- a/drivers/video/backlight/lm3639_bl.c
++++ b/drivers/video/backlight/lm3639_bl.c
+@@ -400,10 +400,8 @@ static int lm3639_remove(struct i2c_client *client)
+
+ regmap_write(pchip->regmap, REG_ENABLE, 0x00);
+
+- if (&pchip->cdev_torch)
+- led_classdev_unregister(&pchip->cdev_torch);
+- if (&pchip->cdev_flash)
+- led_classdev_unregister(&pchip->cdev_flash);
++ led_classdev_unregister(&pchip->cdev_torch);
++ led_classdev_unregister(&pchip->cdev_flash);
+ if (pchip->bled)
+ device_remove_file(&(pchip->bled->dev), &dev_attr_bled_mode);
+ return 0;
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index 591a13a59787..f99558d006bf 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -2,6 +2,18 @@
+ # fbdev configuration
+ #
+
++config FB_CMDLINE
++ bool
++
++config FB_NOTIFY
++ bool
++
++config FB_CLPS711X_OLD
++ tristate
++ select FB_CFB_FILLRECT
++ select FB_CFB_COPYAREA
++ select FB_CFB_IMAGEBLIT
++
+ menuconfig FB
+ tristate "Support for frame buffer devices"
+ select FB_CMDLINE
+@@ -54,12 +66,6 @@ config FIRMWARE_EDID
+ combination with certain motherboards and monitors are known to
+ suffer from this problem.
+
+-config FB_CMDLINE
+- bool
+-
+-config FB_NOTIFY
+- bool
+-
+ config FB_DDC
+ tristate
+ depends on FB
+@@ -329,12 +335,6 @@ config FB_ACORN
+ hardware found in Acorn RISC PCs and other ARM-based machines. If
+ unsure, say N.
+
+-config FB_CLPS711X_OLD
+- tristate
+- select FB_CFB_FILLRECT
+- select FB_CFB_COPYAREA
+- select FB_CFB_IMAGEBLIT
+-
+ config FB_CLPS711X
+ tristate "CLPS711X LCD support"
+ depends on FB && (ARCH_CLPS711X || COMPILE_TEST)
+@@ -1456,7 +1456,6 @@ if FB_VIA
+
+ config FB_VIA_DIRECT_PROCFS
+ bool "direct hardware access via procfs (DEPRECATED)(DANGEROUS)"
+- depends on FB_VIA
+ default n
+ help
+ Allow direct hardware access to some output registers via procfs.
+@@ -1466,7 +1465,6 @@ config FB_VIA_DIRECT_PROCFS
+
+ config FB_VIA_X_COMPATIBILITY
+ bool "X server compatibility"
+- depends on FB_VIA
+ default n
+ help
+ This option reduces the functionality (power saving, ...) of the
+@@ -2308,10 +2306,6 @@ config FB_SIMPLE
+ Configuration re: surface address, size, and format must be provided
+ through device tree, or plain old platform data.
+
+-source "drivers/video/fbdev/omap/Kconfig"
+-source "drivers/video/fbdev/omap2/Kconfig"
+-source "drivers/video/fbdev/mmp/Kconfig"
+-
+ config FB_SSD1307
+ tristate "Solomon SSD1307 framebuffer support"
+ depends on FB && I2C
+@@ -2341,3 +2335,7 @@ config FB_SM712
+ This driver is also available as a module. The module will be
+ called sm712fb. If you want to compile it as a module, say M
+ here and read <file:Documentation/kbuild/modules.txt>.
++
++source "drivers/video/fbdev/omap/Kconfig"
++source "drivers/video/fbdev/omap2/Kconfig"
++source "drivers/video/fbdev/mmp/Kconfig"
+diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
+index 076d24afbd72..4ed55e6bbb84 100644
+--- a/drivers/video/fbdev/atmel_lcdfb.c
++++ b/drivers/video/fbdev/atmel_lcdfb.c
+@@ -22,6 +22,7 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
++#include <video/of_videomode.h>
+ #include <video/of_display_timing.h>
+ #include <linux/regulator/consumer.h>
+ #include <video/videomode.h>
+@@ -1028,11 +1029,11 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
+ struct device *dev = &sinfo->pdev->dev;
+ struct device_node *np =dev->of_node;
+ struct device_node *display_np;
+- struct device_node *timings_np;
+- struct display_timings *timings;
+ struct atmel_lcdfb_power_ctrl_gpio *og;
+ bool is_gpio_power = false;
++ struct fb_videomode fb_vm;
+ struct gpio_desc *gpiod;
++ struct videomode vm;
+ int ret = -ENOENT;
+ int i;
+
+@@ -1105,44 +1106,18 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
+ pdata->lcdcon_is_backlight = of_property_read_bool(display_np, "atmel,lcdcon-backlight");
+ pdata->lcdcon_pol_negative = of_property_read_bool(display_np, "atmel,lcdcon-backlight-inverted");
+
+- timings = of_get_display_timings(display_np);
+- if (!timings) {
+- dev_err(dev, "failed to get display timings\n");
+- ret = -EINVAL;
++ ret = of_get_videomode(display_np, &vm, OF_USE_NATIVE_MODE);
++ if (ret) {
++ dev_err(dev, "failed to get videomode from DT\n");
+ goto put_display_node;
+ }
+
+- timings_np = of_get_child_by_name(display_np, "display-timings");
+- if (!timings_np) {
+- dev_err(dev, "failed to find display-timings node\n");
+- ret = -ENODEV;
++ ret = fb_videomode_from_videomode(&vm, &fb_vm);
++ if (ret < 0)
+ goto put_display_node;
+- }
+
+- for (i = 0; i < of_get_child_count(timings_np); i++) {
+- struct videomode vm;
+- struct fb_videomode fb_vm;
+-
+- ret = videomode_from_timings(timings, &vm, i);
+- if (ret < 0)
+- goto put_timings_node;
+- ret = fb_videomode_from_videomode(&vm, &fb_vm);
+- if (ret < 0)
+- goto put_timings_node;
+-
+- fb_add_videomode(&fb_vm, &info->modelist);
+- }
+-
+- /*
+- * FIXME: Make sure we are not referencing any fields in display_np
+- * and timings_np and drop our references to them before returning to
+- * avoid leaking the nodes on probe deferral and driver unbind.
+- */
+-
+- return 0;
++ fb_add_videomode(&fb_vm, &info->modelist);
+
+-put_timings_node:
+- of_node_put(timings_np);
+ put_display_node:
+ of_node_put(display_np);
+ return ret;
+diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
+index 852d86c1c527..8607439d6932 100644
+--- a/drivers/video/fbdev/core/fbmon.c
++++ b/drivers/video/fbdev/core/fbmon.c
+@@ -997,98 +997,6 @@ void fb_edid_to_monspecs(unsigned char *edid, struct fb_monspecs *specs)
+ DPRINTK("========================================\n");
+ }
+
+-/**
+- * fb_edid_add_monspecs() - add monitor video modes from E-EDID data
+- * @edid: 128 byte array with an E-EDID block
+- * @spacs: monitor specs to be extended
+- */
+-void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs)
+-{
+- unsigned char *block;
+- struct fb_videomode *m;
+- int num = 0, i;
+- u8 svd[64], edt[(128 - 4) / DETAILED_TIMING_DESCRIPTION_SIZE];
+- u8 pos = 4, svd_n = 0;
+-
+- if (!edid)
+- return;
+-
+- if (!edid_checksum(edid))
+- return;
+-
+- if (edid[0] != 0x2 ||
+- edid[2] < 4 || edid[2] > 128 - DETAILED_TIMING_DESCRIPTION_SIZE)
+- return;
+-
+- DPRINTK(" Short Video Descriptors\n");
+-
+- while (pos < edid[2]) {
+- u8 len = edid[pos] & 0x1f, type = (edid[pos] >> 5) & 7;
+- pr_debug("Data block %u of %u bytes\n", type, len);
+- if (type == 2) {
+- for (i = pos; i < pos + len; i++) {
+- u8 idx = edid[pos + i] & 0x7f;
+- svd[svd_n++] = idx;
+- pr_debug("N%sative mode #%d\n",
+- edid[pos + i] & 0x80 ? "" : "on-n", idx);
+- }
+- } else if (type == 3 && len >= 3) {
+- /* Check Vendor Specific Data Block. For HDMI,
+- it is always 00-0C-03 for HDMI Licensing, LLC. */
+- if (edid[pos + 1] == 3 && edid[pos + 2] == 0xc &&
+- edid[pos + 3] == 0)
+- specs->misc |= FB_MISC_HDMI;
+- }
+- pos += len + 1;
+- }
+-
+- block = edid + edid[2];
+-
+- DPRINTK(" Extended Detailed Timings\n");
+-
+- for (i = 0; i < (128 - edid[2]) / DETAILED_TIMING_DESCRIPTION_SIZE;
+- i++, block += DETAILED_TIMING_DESCRIPTION_SIZE)
+- if (PIXEL_CLOCK != 0)
+- edt[num++] = block - edid;
+-
+- /* Yikes, EDID data is totally useless */
+- if (!(num + svd_n))
+- return;
+-
+- m = kcalloc(specs->modedb_len + num + svd_n,
+- sizeof(struct fb_videomode),
+- GFP_KERNEL);
+-
+- if (!m)
+- return;
+-
+- memcpy(m, specs->modedb, specs->modedb_len * sizeof(struct fb_videomode));
+-
+- for (i = specs->modedb_len; i < specs->modedb_len + num; i++) {
+- get_detailed_timing(edid + edt[i - specs->modedb_len], &m[i]);
+- if (i == specs->modedb_len)
+- m[i].flag |= FB_MODE_IS_FIRST;
+- pr_debug("Adding %ux%u@%u\n", m[i].xres, m[i].yres, m[i].refresh);
+- }
+-
+- for (i = specs->modedb_len + num; i < specs->modedb_len + num + svd_n; i++) {
+- int idx = svd[i - specs->modedb_len - num];
+- if (!idx || idx >= ARRAY_SIZE(cea_modes)) {
+- pr_warn("Reserved SVD code %d\n", idx);
+- } else if (!cea_modes[idx].xres) {
+- pr_warn("Unimplemented SVD code %d\n", idx);
+- } else {
+- memcpy(&m[i], cea_modes + idx, sizeof(m[i]));
+- pr_debug("Adding SVD #%d: %ux%u@%u\n", idx,
+- m[i].xres, m[i].yres, m[i].refresh);
+- }
+- }
+-
+- kfree(specs->modedb);
+- specs->modedb = m;
+- specs->modedb_len = specs->modedb_len + num + svd_n;
+-}
+-
+ /*
+ * VESA Generalized Timing Formula (GTF)
+ */
+@@ -1498,9 +1406,6 @@ int fb_parse_edid(unsigned char *edid, struct fb_var_screeninfo *var)
+ void fb_edid_to_monspecs(unsigned char *edid, struct fb_monspecs *specs)
+ {
+ }
+-void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs)
+-{
+-}
+ void fb_destroy_modedb(struct fb_videomode *modedb)
+ {
+ }
+@@ -1608,7 +1513,6 @@ EXPORT_SYMBOL(fb_firmware_edid);
+
+ EXPORT_SYMBOL(fb_parse_edid);
+ EXPORT_SYMBOL(fb_edid_to_monspecs);
+-EXPORT_SYMBOL(fb_edid_add_monspecs);
+ EXPORT_SYMBOL(fb_get_mode);
+ EXPORT_SYMBOL(fb_validate_mode);
+ EXPORT_SYMBOL(fb_destroy_modedb);
+diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c
+index ac049871704d..6473e0dfe146 100644
+--- a/drivers/video/fbdev/core/modedb.c
++++ b/drivers/video/fbdev/core/modedb.c
+@@ -289,63 +289,6 @@ static const struct fb_videomode modedb[] = {
+ };
+
+ #ifdef CONFIG_FB_MODE_HELPERS
+-const struct fb_videomode cea_modes[65] = {
+- /* #1: 640x480p@59.94/60Hz */
+- [1] = {
+- NULL, 60, 640, 480, 39722, 48, 16, 33, 10, 96, 2, 0,
+- FB_VMODE_NONINTERLACED, 0,
+- },
+- /* #3: 720x480p@59.94/60Hz */
+- [3] = {
+- NULL, 60, 720, 480, 37037, 60, 16, 30, 9, 62, 6, 0,
+- FB_VMODE_NONINTERLACED, 0,
+- },
+- /* #5: 1920x1080i@59.94/60Hz */
+- [5] = {
+- NULL, 60, 1920, 1080, 13763, 148, 88, 15, 2, 44, 5,
+- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+- FB_VMODE_INTERLACED, 0,
+- },
+- /* #7: 720(1440)x480iH@59.94/60Hz */
+- [7] = {
+- NULL, 60, 1440, 480, 18554/*37108*/, 114, 38, 15, 4, 124, 3, 0,
+- FB_VMODE_INTERLACED, 0,
+- },
+- /* #9: 720(1440)x240pH@59.94/60Hz */
+- [9] = {
+- NULL, 60, 1440, 240, 18554, 114, 38, 16, 4, 124, 3, 0,
+- FB_VMODE_NONINTERLACED, 0,
+- },
+- /* #18: 720x576pH@50Hz */
+- [18] = {
+- NULL, 50, 720, 576, 37037, 68, 12, 39, 5, 64, 5, 0,
+- FB_VMODE_NONINTERLACED, 0,
+- },
+- /* #19: 1280x720p@50Hz */
+- [19] = {
+- NULL, 50, 1280, 720, 13468, 220, 440, 20, 5, 40, 5,
+- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+- FB_VMODE_NONINTERLACED, 0,
+- },
+- /* #20: 1920x1080i@50Hz */
+- [20] = {
+- NULL, 50, 1920, 1080, 13480, 148, 528, 15, 5, 528, 5,
+- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+- FB_VMODE_INTERLACED, 0,
+- },
+- /* #32: 1920x1080p@23.98/24Hz */
+- [32] = {
+- NULL, 24, 1920, 1080, 13468, 148, 638, 36, 4, 44, 5,
+- FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+- FB_VMODE_NONINTERLACED, 0,
+- },
+- /* #35: (2880)x480p4x@59.94/60Hz */
+- [35] = {
+- NULL, 60, 2880, 480, 9250, 240, 64, 30, 9, 248, 6, 0,
+- FB_VMODE_NONINTERLACED, 0,
+- },
+-};
+-
+ const struct fb_videomode vesa_modes[] = {
+ /* 0 640x350-85 VESA */
+ { NULL, 85, 640, 350, 31746, 96, 32, 60, 32, 64, 3,
+diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c
+index a436d44f1b7f..01a7110e61a7 100644
+--- a/drivers/video/fbdev/sbuslib.c
++++ b/drivers/video/fbdev/sbuslib.c
+@@ -106,11 +106,11 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
+ struct fbtype __user *f = (struct fbtype __user *) arg;
+
+ if (put_user(type, &f->fb_type) ||
+- __put_user(info->var.yres, &f->fb_height) ||
+- __put_user(info->var.xres, &f->fb_width) ||
+- __put_user(fb_depth, &f->fb_depth) ||
+- __put_user(0, &f->fb_cmsize) ||
+- __put_user(fb_size, &f->fb_cmsize))
++ put_user(info->var.yres, &f->fb_height) ||
++ put_user(info->var.xres, &f->fb_width) ||
++ put_user(fb_depth, &f->fb_depth) ||
++ put_user(0, &f->fb_cmsize) ||
++ put_user(fb_size, &f->fb_cmsize))
+ return -EFAULT;
+ return 0;
+ }
+@@ -125,10 +125,10 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
+ unsigned int index, count, i;
+
+ if (get_user(index, &c->index) ||
+- __get_user(count, &c->count) ||
+- __get_user(ured, &c->red) ||
+- __get_user(ugreen, &c->green) ||
+- __get_user(ublue, &c->blue))
++ get_user(count, &c->count) ||
++ get_user(ured, &c->red) ||
++ get_user(ugreen, &c->green) ||
++ get_user(ublue, &c->blue))
+ return -EFAULT;
+
+ cmap.len = 1;
+@@ -165,13 +165,13 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
+ u8 red, green, blue;
+
+ if (get_user(index, &c->index) ||
+- __get_user(count, &c->count) ||
+- __get_user(ured, &c->red) ||
+- __get_user(ugreen, &c->green) ||
+- __get_user(ublue, &c->blue))
++ get_user(count, &c->count) ||
++ get_user(ured, &c->red) ||
++ get_user(ugreen, &c->green) ||
++ get_user(ublue, &c->blue))
+ return -EFAULT;
+
+- if (index + count > cmap->len)
++ if (index > cmap->len || count > cmap->len - index)
+ return -EINVAL;
+
+ for (i = 0; i < count; i++) {
+diff --git a/drivers/watchdog/renesas_wdt.c b/drivers/watchdog/renesas_wdt.c
+index d01efd342dc0..62d9d3edcdf2 100644
+--- a/drivers/watchdog/renesas_wdt.c
++++ b/drivers/watchdog/renesas_wdt.c
+@@ -239,6 +239,7 @@ static int rwdt_probe(struct platform_device *pdev)
+ watchdog_set_drvdata(&priv->wdev, priv);
+ watchdog_set_nowayout(&priv->wdev, nowayout);
+ watchdog_set_restart_priority(&priv->wdev, 0);
++ watchdog_stop_on_unregister(&priv->wdev);
+
+ /* This overrides the default timeout only if DT configuration was found */
+ ret = watchdog_init_timeout(&priv->wdev, 0, &pdev->dev);
+diff --git a/drivers/watchdog/sama5d4_wdt.c b/drivers/watchdog/sama5d4_wdt.c
+index 255169916dbb..1e93c1b0e3cf 100644
+--- a/drivers/watchdog/sama5d4_wdt.c
++++ b/drivers/watchdog/sama5d4_wdt.c
+@@ -247,11 +247,7 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
+ }
+ }
+
+- ret = watchdog_init_timeout(wdd, wdt_timeout, &pdev->dev);
+- if (ret) {
+- dev_err(&pdev->dev, "unable to set timeout value\n");
+- return ret;
+- }
++ watchdog_init_timeout(wdd, wdt_timeout, &pdev->dev);
+
+ timeout = WDT_SEC2TICKS(wdd->timeout);
+
+diff --git a/drivers/watchdog/w83627hf_wdt.c b/drivers/watchdog/w83627hf_wdt.c
+index 7817836bff55..4b9365d4de7a 100644
+--- a/drivers/watchdog/w83627hf_wdt.c
++++ b/drivers/watchdog/w83627hf_wdt.c
+@@ -50,7 +50,7 @@ static int cr_wdt_csr; /* WDT control & status register */
+ enum chips { w83627hf, w83627s, w83697hf, w83697ug, w83637hf, w83627thf,
+ w83687thf, w83627ehf, w83627dhg, w83627uhg, w83667hg, w83627dhg_p,
+ w83667hg_b, nct6775, nct6776, nct6779, nct6791, nct6792, nct6793,
+- nct6795, nct6102 };
++ nct6795, nct6796, nct6102 };
+
+ static int timeout; /* in seconds */
+ module_param(timeout, int, 0);
+@@ -100,6 +100,7 @@ MODULE_PARM_DESC(early_disable, "Disable watchdog at boot time (default=0)");
+ #define NCT6792_ID 0xc9
+ #define NCT6793_ID 0xd1
+ #define NCT6795_ID 0xd3
++#define NCT6796_ID 0xd4 /* also NCT9697D, NCT9698D */
+
+ #define W83627HF_WDT_TIMEOUT 0xf6
+ #define W83697HF_WDT_TIMEOUT 0xf4
+@@ -209,6 +210,7 @@ static int w83627hf_init(struct watchdog_device *wdog, enum chips chip)
+ case nct6792:
+ case nct6793:
+ case nct6795:
++ case nct6796:
+ case nct6102:
+ /*
+ * These chips have a fixed WDTO# output pin (W83627UHG),
+@@ -407,6 +409,9 @@ static int wdt_find(int addr)
+ case NCT6795_ID:
+ ret = nct6795;
+ break;
++ case NCT6796_ID:
++ ret = nct6796;
++ break;
+ case NCT6102_ID:
+ ret = nct6102;
+ cr_wdt_timeout = NCT6102D_WDT_TIMEOUT;
+@@ -450,6 +455,7 @@ static int __init wdt_init(void)
+ "NCT6792",
+ "NCT6793",
+ "NCT6795",
++ "NCT6796",
+ "NCT6102",
+ };
+
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index ffbdc4642ea5..f6c24b22b37c 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -1019,16 +1019,16 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd)
+ old_wd_data = NULL;
+ }
+
+- mutex_lock(&wd_data->lock);
+- wd_data->wdd = NULL;
+- wdd->wd_data = NULL;
+- mutex_unlock(&wd_data->lock);
+-
+ if (watchdog_active(wdd) &&
+ test_bit(WDOG_STOP_ON_UNREGISTER, &wdd->status)) {
+ watchdog_stop(wdd);
+ }
+
++ mutex_lock(&wd_data->lock);
++ wd_data->wdd = NULL;
++ wdd->wd_data = NULL;
++ mutex_unlock(&wd_data->lock);
++
+ hrtimer_cancel(&wd_data->timer);
+ kthread_cancel_work_sync(&wd_data->work);
+
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 61dc1b0e4465..badbb8b4f0f1 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2284,7 +2284,7 @@ again:
+ dxroot->info.indirect_levels += 1;
+ dxtrace(printk(KERN_DEBUG
+ "Creating %d level index...\n",
+- info->indirect_levels));
++ dxroot->info.indirect_levels));
+ err = ext4_handle_dirty_dx_node(handle, dir, frame->bh);
+ if (err)
+ goto journal_error;
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index dd29a49143f5..8c4cb1eee10a 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -1244,7 +1244,7 @@ stop:
+
+ put_gc_inode(&gc_list);
+
+- if (sync)
++ if (sync && !ret)
+ ret = sec_freed ? 0 : -EAGAIN;
+ return ret;
+ }
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index b05e10c332b7..15779123d089 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1556,6 +1556,7 @@ skip:
+ (test_opt(sbi, POSIX_ACL) ? SB_POSIXACL : 0);
+
+ limit_reserve_root(sbi);
++ *flags = (*flags & ~SB_LAZYTIME) | (sb->s_flags & SB_LAZYTIME);
+ return 0;
+ restore_gc:
+ if (need_restart_gc) {
+diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
+index b96d39c28e17..5d72e8b66a26 100644
+--- a/fs/gfs2/incore.h
++++ b/fs/gfs2/incore.h
+@@ -623,6 +623,7 @@ enum {
+ SDF_RORECOVERY = 7, /* read only recovery */
+ SDF_SKIP_DLM_UNLOCK = 8,
+ SDF_FORCE_AIL_FLUSH = 9,
++ SDF_AIL1_IO_ERROR = 10,
+ };
+
+ enum gfs2_freeze_state {
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index cd85092723de..90b5c8d0c56a 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -108,7 +108,9 @@ __acquires(&sdp->sd_ail_lock)
+ gfs2_assert(sdp, bd->bd_tr == tr);
+
+ if (!buffer_busy(bh)) {
+- if (!buffer_uptodate(bh)) {
++ if (!buffer_uptodate(bh) &&
++ !test_and_set_bit(SDF_AIL1_IO_ERROR,
++ &sdp->sd_flags)) {
+ gfs2_io_error_bh(sdp, bh);
+ *withdraw = true;
+ }
+@@ -206,7 +208,8 @@ static void gfs2_ail1_empty_one(struct gfs2_sbd *sdp, struct gfs2_trans *tr,
+ gfs2_assert(sdp, bd->bd_tr == tr);
+ if (buffer_busy(bh))
+ continue;
+- if (!buffer_uptodate(bh)) {
++ if (!buffer_uptodate(bh) &&
++ !test_and_set_bit(SDF_AIL1_IO_ERROR, &sdp->sd_flags)) {
+ gfs2_io_error_bh(sdp, bh);
+ *withdraw = true;
+ }
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index c212893534ed..a971862b186e 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -854,10 +854,10 @@ static int gfs2_make_fs_ro(struct gfs2_sbd *sdp)
+ if (error && !test_bit(SDF_SHUTDOWN, &sdp->sd_flags))
+ return error;
+
++ flush_workqueue(gfs2_delete_workqueue);
+ kthread_stop(sdp->sd_quotad_process);
+ kthread_stop(sdp->sd_logd_process);
+
+- flush_workqueue(gfs2_delete_workqueue);
+ gfs2_quota_sync(sdp->sd_vfs, 0);
+ gfs2_statfs_sync(sdp->sd_vfs, 0);
+
+diff --git a/fs/gfs2/util.c b/fs/gfs2/util.c
+index 59c811de0dc7..6a02cc890daf 100644
+--- a/fs/gfs2/util.c
++++ b/fs/gfs2/util.c
+@@ -256,12 +256,13 @@ void gfs2_io_error_bh_i(struct gfs2_sbd *sdp, struct buffer_head *bh,
+ const char *function, char *file, unsigned int line,
+ bool withdraw)
+ {
+- fs_err(sdp,
+- "fatal: I/O error\n"
+- " block = %llu\n"
+- " function = %s, file = %s, line = %u\n",
+- (unsigned long long)bh->b_blocknr,
+- function, file, line);
++ if (!test_bit(SDF_SHUTDOWN, &sdp->sd_flags))
++ fs_err(sdp,
++ "fatal: I/O error\n"
++ " block = %llu\n"
++ " function = %s, file = %s, line = %u\n",
++ (unsigned long long)bh->b_blocknr,
++ function, file, line);
+ if (withdraw)
+ gfs2_lm_withdraw(sdp, NULL);
+ }
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index c5c3394148f7..74ff459b75ef 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -103,7 +103,7 @@ int nfs4_check_delegation(struct inode *inode, fmode_t flags)
+ return nfs4_do_check_delegation(inode, flags, false);
+ }
+
+-static int nfs_delegation_claim_locks(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid)
++static int nfs_delegation_claim_locks(struct nfs4_state *state, const nfs4_stateid *stateid)
+ {
+ struct inode *inode = state->inode;
+ struct file_lock *fl;
+@@ -118,7 +118,7 @@ static int nfs_delegation_claim_locks(struct nfs_open_context *ctx, struct nfs4_
+ spin_lock(&flctx->flc_lock);
+ restart:
+ list_for_each_entry(fl, list, fl_list) {
+- if (nfs_file_open_context(fl->fl_file) != ctx)
++ if (nfs_file_open_context(fl->fl_file)->state != state)
+ continue;
+ spin_unlock(&flctx->flc_lock);
+ status = nfs4_lock_delegation_recall(fl, state, stateid);
+@@ -165,7 +165,7 @@ again:
+ seq = raw_seqcount_begin(&sp->so_reclaim_seqcount);
+ err = nfs4_open_delegation_recall(ctx, state, stateid);
+ if (!err)
+- err = nfs_delegation_claim_locks(ctx, state, stateid);
++ err = nfs_delegation_claim_locks(state, stateid);
+ if (!err && read_seqcount_retry(&sp->so_reclaim_seqcount, seq))
+ err = -EAGAIN;
+ mutex_unlock(&sp->so_delegreturn_mutex);
+diff --git a/fs/orangefs/orangefs-sysfs.c b/fs/orangefs/orangefs-sysfs.c
+index dd28079f518c..19739aaee675 100644
+--- a/fs/orangefs/orangefs-sysfs.c
++++ b/fs/orangefs/orangefs-sysfs.c
+@@ -323,7 +323,7 @@ static ssize_t sysfs_service_op_show(struct kobject *kobj,
+ /* Can't do a service_operation if the client is not running... */
+ rc = is_daemon_in_service();
+ if (rc) {
+- pr_info("%s: Client not running :%d:\n",
++ pr_info_ratelimited("%s: Client not running :%d:\n",
+ __func__,
+ is_daemon_in_service());
+ goto out;
+diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
+index cbde728f8ac6..5c5f161763c8 100644
+--- a/fs/proc/vmcore.c
++++ b/fs/proc/vmcore.c
+@@ -176,6 +176,16 @@ int __weak remap_oldmem_pfn_range(struct vm_area_struct *vma,
+ return remap_pfn_range(vma, from, pfn, size, prot);
+ }
+
++/*
++ * Architectures which support memory encryption override this.
++ */
++ssize_t __weak
++copy_oldmem_page_encrypted(unsigned long pfn, char *buf, size_t csize,
++ unsigned long offset, int userbuf)
++{
++ return copy_oldmem_page(pfn, buf, csize, offset, userbuf);
++}
++
+ /*
+ * Copy to either kernel or user space
+ */
+diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
+index 4325d6fdde9b..317aecaed897 100644
+--- a/include/linux/cpuidle.h
++++ b/include/linux/cpuidle.h
+@@ -81,6 +81,7 @@ struct cpuidle_device {
+ unsigned int registered:1;
+ unsigned int enabled:1;
+ unsigned int use_deepest_state:1;
++ unsigned int poll_time_limit:1;
+ unsigned int cpu;
+
+ int last_residency;
+diff --git a/include/linux/fb.h b/include/linux/fb.h
+index 3e7e75383d32..7bfed8460c78 100644
+--- a/include/linux/fb.h
++++ b/include/linux/fb.h
+@@ -736,8 +736,6 @@ extern int fb_parse_edid(unsigned char *edid, struct fb_var_screeninfo *var);
+ extern const unsigned char *fb_firmware_edid(struct device *device);
+ extern void fb_edid_to_monspecs(unsigned char *edid,
+ struct fb_monspecs *specs);
+-extern void fb_edid_add_monspecs(unsigned char *edid,
+- struct fb_monspecs *specs);
+ extern void fb_destroy_modedb(struct fb_videomode *modedb);
+ extern int fb_find_mode_cvt(struct fb_videomode *mode, int margins, int rb);
+ extern unsigned char *fb_ddc_read(struct i2c_adapter *adapter);
+@@ -811,7 +809,6 @@ struct dmt_videomode {
+
+ extern const char *fb_mode_option;
+ extern const struct fb_videomode vesa_modes[];
+-extern const struct fb_videomode cea_modes[65];
+ extern const struct dmt_videomode dmt_modes[];
+
+ struct fb_modelist {
+diff --git a/include/linux/platform_data/dma-ep93xx.h b/include/linux/platform_data/dma-ep93xx.h
+index f8f1f6b952a6..eb9805bb3fe8 100644
+--- a/include/linux/platform_data/dma-ep93xx.h
++++ b/include/linux/platform_data/dma-ep93xx.h
+@@ -85,7 +85,7 @@ static inline enum dma_transfer_direction
+ ep93xx_dma_chan_direction(struct dma_chan *chan)
+ {
+ if (!ep93xx_dma_chan_is_m2p(chan))
+- return DMA_NONE;
++ return DMA_TRANS_NONE;
+
+ /* even channels are for TX, odd for RX */
+ return (chan->chan_id % 2 == 0) ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM;
+diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
+index 592653becd91..ad2e243f3f03 100644
+--- a/include/linux/sunrpc/sched.h
++++ b/include/linux/sunrpc/sched.h
+@@ -188,7 +188,6 @@ struct rpc_timer {
+ struct rpc_wait_queue {
+ spinlock_t lock;
+ struct list_head tasks[RPC_NR_PRIORITY]; /* task queue for each priority level */
+- pid_t owner; /* process id of last task serviced */
+ unsigned char maxpriority; /* maximum priority (0 if queue is not a priority queue) */
+ unsigned char priority; /* current priority */
+ unsigned char nr; /* # tasks remaining for cookie */
+@@ -204,7 +203,6 @@ struct rpc_wait_queue {
+ * from a single cookie. The aim is to improve
+ * performance of NFS operations such as read/write.
+ */
+-#define RPC_BATCH_COUNT 16
+ #define RPC_IS_PRIORITY(q) ((q)->maxpriority > 0)
+
+ /*
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index f3d475024d37..54e4d1fd21f8 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -1147,7 +1147,7 @@ struct ib_qp_init_attr {
+ struct ib_qp_cap cap;
+ enum ib_sig_type sq_sig_type;
+ enum ib_qp_type qp_type;
+- enum ib_qp_create_flags create_flags;
++ u32 create_flags;
+
+ /*
+ * Only needed for special QP types, or when using the RW API.
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 138f0302692e..378cef70341c 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -2114,6 +2114,9 @@ static int btf_parse_hdr(struct btf_verifier_env *env, void __user *btf_data,
+
+ hdr = &btf->hdr;
+
++ if (hdr->hdr_len != hdr_len)
++ return -EINVAL;
++
+ btf_verifier_log_hdr(env, btf_data_size);
+
+ if (hdr->magic != BTF_MAGIC) {
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 9bb57ce57d98..8d6b8b5493f9 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -375,6 +375,7 @@ void __init cpu_smt_disable(bool force)
+ pr_info("SMT: Force disabled\n");
+ cpu_smt_control = CPU_SMT_FORCE_DISABLED;
+ } else {
++ pr_info("SMT: disabled\n");
+ cpu_smt_control = CPU_SMT_DISABLED;
+ }
+ }
+diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
+index f50b90d0d1c2..faeec8255e7e 100644
+--- a/kernel/kexec_core.c
++++ b/kernel/kexec_core.c
+@@ -473,6 +473,10 @@ static struct page *kimage_alloc_crash_control_pages(struct kimage *image,
+ }
+ }
+
++ /* Ensure that these pages are decrypted if SME is enabled. */
++ if (pages)
++ arch_kexec_post_alloc_pages(page_address(pages), 1 << order, 0);
++
+ return pages;
+ }
+
+@@ -869,6 +873,7 @@ static int kimage_load_crash_segment(struct kimage *image,
+ result = -ENOMEM;
+ goto out;
+ }
++ arch_kexec_post_alloc_pages(page_address(page), 1, 0);
+ ptr = kmap(page);
+ ptr += maddr & ~PAGE_MASK;
+ mchunk = min_t(size_t, mbytes,
+@@ -886,6 +891,7 @@ static int kimage_load_crash_segment(struct kimage *image,
+ result = copy_from_user(ptr, buf, uchunk);
+ kexec_flush_icache_page(page);
+ kunmap(page);
++ arch_kexec_pre_free_pages(page_address(page), 1);
+ if (result) {
+ result = -EFAULT;
+ goto out;
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index d0d03223b45b..c7b3d5489937 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -423,6 +423,7 @@ static u32 log_next_idx;
+ /* the next printk record to write to the console */
+ static u64 console_seq;
+ static u32 console_idx;
++static u64 exclusive_console_stop_seq;
+
+ /* the next printk record to read after the last 'clear' command */
+ static u64 clear_seq;
+@@ -437,6 +438,7 @@ static u32 clear_idx;
+ /* record buffer */
+ #define LOG_ALIGN __alignof__(struct printk_log)
+ #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT)
++#define LOG_BUF_LEN_MAX (u32)(1 << 31)
+ static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN);
+ static char *log_buf = __log_buf;
+ static u32 log_buf_len = __LOG_BUF_LEN;
+@@ -1037,18 +1039,23 @@ void log_buf_vmcoreinfo_setup(void)
+ static unsigned long __initdata new_log_buf_len;
+
+ /* we practice scaling the ring buffer by powers of 2 */
+-static void __init log_buf_len_update(unsigned size)
++static void __init log_buf_len_update(u64 size)
+ {
++ if (size > (u64)LOG_BUF_LEN_MAX) {
++ size = (u64)LOG_BUF_LEN_MAX;
++ pr_err("log_buf over 2G is not supported.\n");
++ }
++
+ if (size)
+ size = roundup_pow_of_two(size);
+ if (size > log_buf_len)
+- new_log_buf_len = size;
++ new_log_buf_len = (unsigned long)size;
+ }
+
+ /* save requested log_buf_len since it's too early to process it */
+ static int __init log_buf_len_setup(char *str)
+ {
+- unsigned int size;
++ u64 size;
+
+ if (!str)
+ return -EINVAL;
+@@ -1118,7 +1125,7 @@ void __init setup_log_buf(int early)
+ }
+
+ if (unlikely(!new_log_buf)) {
+- pr_err("log_buf_len: %ld bytes not available\n",
++ pr_err("log_buf_len: %lu bytes not available\n",
+ new_log_buf_len);
+ return;
+ }
+@@ -1131,8 +1138,8 @@ void __init setup_log_buf(int early)
+ memcpy(log_buf, __log_buf, __LOG_BUF_LEN);
+ logbuf_unlock_irqrestore(flags);
+
+- pr_info("log_buf_len: %d bytes\n", log_buf_len);
+- pr_info("early log buf free: %d(%d%%)\n",
++ pr_info("log_buf_len: %u bytes\n", log_buf_len);
++ pr_info("early log buf free: %u(%u%%)\n",
+ free, (free * 100) / __LOG_BUF_LEN);
+ }
+
+@@ -2014,6 +2021,7 @@ static u64 syslog_seq;
+ static u32 syslog_idx;
+ static u64 console_seq;
+ static u32 console_idx;
++static u64 exclusive_console_stop_seq;
+ static u64 log_first_seq;
+ static u32 log_first_idx;
+ static u64 log_next_seq;
+@@ -2356,8 +2364,9 @@ again:
+ printk_safe_enter_irqsave(flags);
+ raw_spin_lock(&logbuf_lock);
+ if (console_seq < log_first_seq) {
+- len = sprintf(text, "** %u printk messages dropped **\n",
+- (unsigned)(log_first_seq - console_seq));
++ len = sprintf(text,
++ "** %llu printk messages dropped **\n",
++ log_first_seq - console_seq);
+
+ /* messages are gone, move to first one */
+ console_seq = log_first_seq;
+@@ -2381,6 +2390,12 @@ skip:
+ goto skip;
+ }
+
++ /* Output to all consoles once old messages replayed. */
++ if (unlikely(exclusive_console &&
++ console_seq >= exclusive_console_stop_seq)) {
++ exclusive_console = NULL;
++ }
++
+ len += msg_print_text(msg,
+ console_msg_format & MSG_FORMAT_SYSLOG,
+ text + len,
+@@ -2423,10 +2438,6 @@ skip:
+
+ console_locked = 0;
+
+- /* Release the exclusive_console once it is used */
+- if (unlikely(exclusive_console))
+- exclusive_console = NULL;
+-
+ raw_spin_unlock(&logbuf_lock);
+
+ up_console_sem();
+@@ -2704,13 +2715,18 @@ void register_console(struct console *newcon)
+ logbuf_lock_irqsave(flags);
+ console_seq = syslog_seq;
+ console_idx = syslog_idx;
+- logbuf_unlock_irqrestore(flags);
+ /*
+ * We're about to replay the log buffer. Only do this to the
+ * just-registered console to avoid excessive message spam to
+ * the already-registered consoles.
++ *
++ * Set exclusive_console with disabled interrupts to reduce
++ * race window with eventual console_flush_on_panic() that
++ * ignores console_lock.
+ */
+ exclusive_console = newcon;
++ exclusive_console_stop_seq = console_seq;
++ logbuf_unlock_irqrestore(flags);
+ }
+ console_unlock();
+ console_sysfs_notify();
+diff --git a/lib/idr.c b/lib/idr.c
+index fab2fd5bc326..61383564a6c5 100644
+--- a/lib/idr.c
++++ b/lib/idr.c
+@@ -231,11 +231,22 @@ void *idr_get_next(struct idr *idr, int *nextid)
+ {
+ struct radix_tree_iter iter;
+ void __rcu **slot;
++ void *entry = NULL;
+ unsigned long base = idr->idr_base;
+ unsigned long id = *nextid;
+
+ id = (id < base) ? 0 : id - base;
+- slot = radix_tree_iter_find(&idr->idr_rt, &iter, id);
++ radix_tree_for_each_slot(slot, &idr->idr_rt, &iter, id) {
++ entry = rcu_dereference_raw(*slot);
++ if (!entry)
++ continue;
++ if (!radix_tree_deref_retry(entry))
++ break;
++ if (slot != (void *)&idr->idr_rt.rnode &&
++ entry != (void *)RADIX_TREE_INTERNAL_NODE)
++ break;
++ slot = radix_tree_iter_retry(&iter);
++ }
+ if (!slot)
+ return NULL;
+ id = iter.index + base;
+@@ -244,7 +255,7 @@ void *idr_get_next(struct idr *idr, int *nextid)
+ return NULL;
+
+ *nextid = id;
+- return rcu_dereference_raw(*slot);
++ return entry;
+ }
+ EXPORT_SYMBOL(idr_get_next);
+
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index af6735562215..7965112eb063 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -437,70 +437,33 @@ static void shrink_zone_span(struct zone *zone, unsigned long start_pfn,
+ zone_span_writeunlock(zone);
+ }
+
+-static void shrink_pgdat_span(struct pglist_data *pgdat,
+- unsigned long start_pfn, unsigned long end_pfn)
++static void update_pgdat_span(struct pglist_data *pgdat)
+ {
+- unsigned long pgdat_start_pfn = pgdat->node_start_pfn;
+- unsigned long p = pgdat_end_pfn(pgdat); /* pgdat_end_pfn namespace clash */
+- unsigned long pgdat_end_pfn = p;
+- unsigned long pfn;
+- struct mem_section *ms;
+- int nid = pgdat->node_id;
+-
+- if (pgdat_start_pfn == start_pfn) {
+- /*
+- * If the section is smallest section in the pgdat, it need
+- * shrink pgdat->node_start_pfn and pgdat->node_spanned_pages.
+- * In this case, we find second smallest valid mem_section
+- * for shrinking zone.
+- */
+- pfn = find_smallest_section_pfn(nid, NULL, end_pfn,
+- pgdat_end_pfn);
+- if (pfn) {
+- pgdat->node_start_pfn = pfn;
+- pgdat->node_spanned_pages = pgdat_end_pfn - pfn;
+- }
+- } else if (pgdat_end_pfn == end_pfn) {
+- /*
+- * If the section is biggest section in the pgdat, it need
+- * shrink pgdat->node_spanned_pages.
+- * In this case, we find second biggest valid mem_section for
+- * shrinking zone.
+- */
+- pfn = find_biggest_section_pfn(nid, NULL, pgdat_start_pfn,
+- start_pfn);
+- if (pfn)
+- pgdat->node_spanned_pages = pfn - pgdat_start_pfn + 1;
+- }
++ unsigned long node_start_pfn = 0, node_end_pfn = 0;
++ struct zone *zone;
+
+- /*
+- * If the section is not biggest or smallest mem_section in the pgdat,
+- * it only creates a hole in the pgdat. So in this case, we need not
+- * change the pgdat.
+- * But perhaps, the pgdat has only hole data. Thus it check the pgdat
+- * has only hole or not.
+- */
+- pfn = pgdat_start_pfn;
+- for (; pfn < pgdat_end_pfn; pfn += PAGES_PER_SECTION) {
+- ms = __pfn_to_section(pfn);
++ for (zone = pgdat->node_zones;
++ zone < pgdat->node_zones + MAX_NR_ZONES; zone++) {
++ unsigned long zone_end_pfn = zone->zone_start_pfn +
++ zone->spanned_pages;
+
+- if (unlikely(!valid_section(ms)))
++ /* No need to lock the zones, they can't change. */
++ if (!zone->spanned_pages)
+ continue;
+-
+- if (pfn_to_nid(pfn) != nid)
+- continue;
+-
+- /* If the section is current section, it continues the loop */
+- if (start_pfn == pfn)
++ if (!node_end_pfn) {
++ node_start_pfn = zone->zone_start_pfn;
++ node_end_pfn = zone_end_pfn;
+ continue;
++ }
+
+- /* If we find valid section, we have nothing to do */
+- return;
++ if (zone_end_pfn > node_end_pfn)
++ node_end_pfn = zone_end_pfn;
++ if (zone->zone_start_pfn < node_start_pfn)
++ node_start_pfn = zone->zone_start_pfn;
+ }
+
+- /* The pgdat has no valid section */
+- pgdat->node_start_pfn = 0;
+- pgdat->node_spanned_pages = 0;
++ pgdat->node_start_pfn = node_start_pfn;
++ pgdat->node_spanned_pages = node_end_pfn - node_start_pfn;
+ }
+
+ static void __remove_zone(struct zone *zone, unsigned long start_pfn)
+@@ -511,7 +474,7 @@ static void __remove_zone(struct zone *zone, unsigned long start_pfn)
+
+ pgdat_resize_lock(zone->zone_pgdat, &flags);
+ shrink_zone_span(zone, start_pfn, start_pfn + nr_pages);
+- shrink_pgdat_span(pgdat, start_pfn, start_pfn + nr_pages);
++ update_pgdat_span(pgdat);
+ pgdat_resize_unlock(zone->zone_pgdat, &flags);
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 4a2ee1ce6c02..e96c88b1465d 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4296,6 +4296,9 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
+ struct netdev_rx_queue *rxqueue;
+ void *orig_data, *orig_data_end;
+ u32 metalen, act = XDP_DROP;
++ __be16 orig_eth_type;
++ struct ethhdr *eth;
++ bool orig_bcast;
+ int hlen, off;
+ u32 mac_len;
+
+@@ -4336,6 +4339,9 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
+ xdp->data_hard_start = skb->data - skb_headroom(skb);
+ orig_data_end = xdp->data_end;
+ orig_data = xdp->data;
++ eth = (struct ethhdr *)xdp->data;
++ orig_bcast = is_multicast_ether_addr_64bits(eth->h_dest);
++ orig_eth_type = eth->h_proto;
+
+ rxqueue = netif_get_rxqueue(skb);
+ xdp->rxq = &rxqueue->xdp_rxq;
+@@ -4359,6 +4365,14 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
+
+ }
+
++ /* check if XDP changed eth hdr such SKB needs update */
++ eth = (struct ethhdr *)xdp->data;
++ if ((orig_eth_type != eth->h_proto) ||
++ (orig_bcast != is_multicast_ether_addr_64bits(eth->h_dest))) {
++ __skb_push(skb, ETH_HLEN);
++ skb->protocol = eth_type_trans(skb, skb->dev);
++ }
++
+ switch (act) {
+ case XDP_REDIRECT:
+ case XDP_TX:
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 647ba447bf1a..a7a804bece7a 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3910,8 +3910,8 @@ void __init tcp_init(void)
+ init_net.ipv4.sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
+
+ init_net.ipv4.sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
+- init_net.ipv4.sysctl_tcp_rmem[1] = 87380;
+- init_net.ipv4.sysctl_tcp_rmem[2] = max(87380, max_rshare);
++ init_net.ipv4.sysctl_tcp_rmem[1] = 131072;
++ init_net.ipv4.sysctl_tcp_rmem[2] = max(131072, max_rshare);
+
+ pr_info("Hash tables configured (established %u bind %u)\n",
+ tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 14a6a489937c..57e8dad956ec 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -426,26 +426,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
+ }
+ }
+
+-/* 3. Tuning rcvbuf, when connection enters established state. */
+-static void tcp_fixup_rcvbuf(struct sock *sk)
+-{
+- u32 mss = tcp_sk(sk)->advmss;
+- int rcvmem;
+-
+- rcvmem = 2 * SKB_TRUESIZE(mss + MAX_TCP_HEADER) *
+- tcp_default_init_rwnd(mss);
+-
+- /* Dynamic Right Sizing (DRS) has 2 to 3 RTT latency
+- * Allow enough cushion so that sender is not limited by our window
+- */
+- if (sock_net(sk)->ipv4.sysctl_tcp_moderate_rcvbuf)
+- rcvmem <<= 2;
+-
+- if (sk->sk_rcvbuf < rcvmem)
+- sk->sk_rcvbuf = min(rcvmem, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
+-}
+-
+-/* 4. Try to fixup all. It is made immediately after connection enters
++/* 3. Try to fixup all. It is made immediately after connection enters
+ * established state.
+ */
+ void tcp_init_buffer_space(struct sock *sk)
+@@ -454,12 +435,10 @@ void tcp_init_buffer_space(struct sock *sk)
+ struct tcp_sock *tp = tcp_sk(sk);
+ int maxwin;
+
+- if (!(sk->sk_userlocks & SOCK_RCVBUF_LOCK))
+- tcp_fixup_rcvbuf(sk);
+ if (!(sk->sk_userlocks & SOCK_SNDBUF_LOCK))
+ tcp_sndbuf_expand(sk);
+
+- tp->rcvq_space.space = tp->rcv_wnd;
++ tp->rcvq_space.space = min_t(u32, tp->rcv_wnd, TCP_INIT_CWND * tp->advmss);
+ tcp_mstamp_refresh(tp);
+ tp->rcvq_space.time = tp->tcp_mstamp;
+ tp->rcvq_space.seq = tp->copied_seq;
+@@ -485,7 +464,7 @@ void tcp_init_buffer_space(struct sock *sk)
+ tp->snd_cwnd_stamp = tcp_jiffies32;
+ }
+
+-/* 5. Recalculate window clamp after socket hit its memory bounds. */
++/* 4. Recalculate window clamp after socket hit its memory bounds. */
+ static void tcp_clamp_window(struct sock *sk)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 2697e4397e46..53f910bb5508 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -179,21 +179,6 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts,
+ inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
+ }
+
+-
+-u32 tcp_default_init_rwnd(u32 mss)
+-{
+- /* Initial receive window should be twice of TCP_INIT_CWND to
+- * enable proper sending of new unsent data during fast recovery
+- * (RFC 3517, Section 4, NextSeg() rule (2)). Further place a
+- * limit when mss is larger than 1460.
+- */
+- u32 init_rwnd = TCP_INIT_CWND * 2;
+-
+- if (mss > 1460)
+- init_rwnd = max((1460 * init_rwnd) / mss, 2U);
+- return init_rwnd;
+-}
+-
+ /* Determine a window scaling and initial window to offer.
+ * Based on the assumption that the given amount of space
+ * will be offered. Store the results in the tp structure.
+@@ -228,7 +213,10 @@ void tcp_select_initial_window(const struct sock *sk, int __space, __u32 mss,
+ if (sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows)
+ (*rcv_wnd) = min(space, MAX_TCP_WINDOW);
+ else
+- (*rcv_wnd) = space;
++ (*rcv_wnd) = min_t(u32, space, U16_MAX);
++
++ if (init_rcv_wnd)
++ *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
+
+ (*rcv_wscale) = 0;
+ if (wscale_ok) {
+@@ -241,11 +229,6 @@ void tcp_select_initial_window(const struct sock *sk, int __space, __u32 mss,
+ (*rcv_wscale)++;
+ }
+ }
+-
+- if (!init_rcv_wnd) /* Use default unless specified otherwise */
+- init_rcv_wnd = tcp_default_init_rwnd(mss);
+- *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
+-
+ /* Set the clamp no higher than max representable value */
+ (*window_clamp) = min_t(__u32, U16_MAX << (*rcv_wscale), *window_clamp);
+ }
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index 67ebdeaffbbc..3d5520776655 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -129,7 +129,7 @@
+
+ #define CCK_GROUP \
+ [MINSTREL_CCK_GROUP] = { \
+- .streams = 0, \
++ .streams = 1, \
+ .flags = 0, \
+ .duration = { \
+ CCK_DURATION_LIST(false), \
+@@ -282,7 +282,8 @@ minstrel_ht_get_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+ break;
+
+ /* short preamble */
+- if (!(mi->supported[group] & BIT(idx)))
++ if ((mi->supported[group] & BIT(idx + 4)) &&
++ (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
+ idx += 4;
+ }
+ return &mi->groups[group].rates[idx];
+@@ -1077,18 +1078,23 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
+ return;
+
+ sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
++ sample_idx %= MCS_GROUP_RATES;
++
++ if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP] &&
++ (sample_idx >= 4) != txrc->short_preamble)
++ return;
++
+ info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+ rate->count = 1;
+
+- if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
++ if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP]) {
+ int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
+ rate->idx = mp->cck_rates[idx];
+ } else if (sample_group->flags & IEEE80211_TX_RC_VHT_MCS) {
+ ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
+ sample_group->streams);
+ } else {
+- rate->idx = sample_idx % MCS_GROUP_RATES +
+- (sample_group->streams - 1) * 8;
++ rate->idx = sample_idx + (sample_group->streams - 1) * 8;
+ }
+
+ rate->flags = sample_group->flags;
+@@ -1132,7 +1138,6 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
+ struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
+ u16 sta_cap = sta->ht_cap.cap;
+ struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
+- struct sta_info *sinfo = container_of(sta, struct sta_info, sta);
+ int use_vht;
+ int n_supported = 0;
+ int ack_dur;
+@@ -1258,8 +1263,7 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
+ if (!n_supported)
+ goto use_legacy;
+
+- if (test_sta_flag(sinfo, WLAN_STA_SHORT_PREAMBLE))
+- mi->cck_supported_short |= mi->cck_supported_short << 4;
++ mi->supported[MINSTREL_CCK_GROUP] |= mi->cck_supported_short << 4;
+
+ /* create an initial rate table with the lowest supported rates */
+ minstrel_ht_update_stats(mp, mi);
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 1245e02239d9..469f9da5073b 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -269,6 +269,24 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+ kfree(expr->ops);
+ }
+
++static int nft_extension_dump_info(struct sk_buff *skb, int attr,
++ const void *info,
++ unsigned int size, unsigned int user_size)
++{
++ unsigned int info_size, aligned_size = XT_ALIGN(size);
++ struct nlattr *nla;
++
++ nla = nla_reserve(skb, attr, aligned_size);
++ if (!nla)
++ return -1;
++
++ info_size = user_size ? : size;
++ memcpy(nla_data(nla), info, info_size);
++ memset(nla_data(nla) + info_size, 0, aligned_size - info_size);
++
++ return 0;
++}
++
+ static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ {
+ const struct xt_target *target = expr->ops->data;
+@@ -276,7 +294,8 @@ static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr)
+
+ if (nla_put_string(skb, NFTA_TARGET_NAME, target->name) ||
+ nla_put_be32(skb, NFTA_TARGET_REV, htonl(target->revision)) ||
+- nla_put(skb, NFTA_TARGET_INFO, XT_ALIGN(target->targetsize), info))
++ nft_extension_dump_info(skb, NFTA_TARGET_INFO, info,
++ target->targetsize, target->usersize))
+ goto nla_put_failure;
+
+ return 0;
+@@ -504,7 +523,8 @@ static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr,
+
+ if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) ||
+ nla_put_be32(skb, NFTA_MATCH_REV, htonl(match->revision)) ||
+- nla_put(skb, NFTA_MATCH_INFO, XT_ALIGN(match->matchsize), info))
++ nft_extension_dump_info(skb, NFTA_MATCH_INFO, info,
++ match->matchsize, match->usersize))
+ goto nla_put_failure;
+
+ return 0;
+diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
+index d2356a284646..3ebf8ba7c389 100644
+--- a/net/openvswitch/vport-internal_dev.c
++++ b/net/openvswitch/vport-internal_dev.c
+@@ -43,7 +43,8 @@ static struct internal_dev *internal_dev_priv(struct net_device *netdev)
+ }
+
+ /* Called with rcu_read_lock_bh. */
+-static int internal_dev_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t
++internal_dev_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ int len, err;
+
+@@ -62,7 +63,7 @@ static int internal_dev_xmit(struct sk_buff *skb, struct net_device *netdev)
+ } else {
+ netdev->stats.tx_errors++;
+ }
+- return 0;
++ return NETDEV_TX_OK;
+ }
+
+ static int internal_dev_open(struct net_device *netdev)
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 30e32df5f84a..8a4d01e427a2 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -577,6 +577,18 @@ struct Qdisc noop_qdisc = {
+ .dev_queue = &noop_netdev_queue,
+ .running = SEQCNT_ZERO(noop_qdisc.running),
+ .busylock = __SPIN_LOCK_UNLOCKED(noop_qdisc.busylock),
++ .gso_skb = {
++ .next = (struct sk_buff *)&noop_qdisc.gso_skb,
++ .prev = (struct sk_buff *)&noop_qdisc.gso_skb,
++ .qlen = 0,
++ .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.gso_skb.lock),
++ },
++ .skb_bad_txq = {
++ .next = (struct sk_buff *)&noop_qdisc.skb_bad_txq,
++ .prev = (struct sk_buff *)&noop_qdisc.skb_bad_txq,
++ .qlen = 0,
++ .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock),
++ },
+ };
+ EXPORT_SYMBOL(noop_qdisc);
+
+@@ -1253,8 +1265,6 @@ static void dev_init_scheduler_queue(struct net_device *dev,
+
+ rcu_assign_pointer(dev_queue->qdisc, qdisc);
+ dev_queue->qdisc_sleeping = qdisc;
+- __skb_queue_head_init(&qdisc->gso_skb);
+- __skb_queue_head_init(&qdisc->skb_bad_txq);
+ }
+
+ void dev_init_scheduler(struct net_device *dev)
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index 3fe5d60ab0e2..e2808586c9e6 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -99,64 +99,78 @@ __rpc_add_timer(struct rpc_wait_queue *queue, struct rpc_task *task)
+ list_add(&task->u.tk_wait.timer_list, &queue->timer_list.list);
+ }
+
+-static void rpc_rotate_queue_owner(struct rpc_wait_queue *queue)
+-{
+- struct list_head *q = &queue->tasks[queue->priority];
+- struct rpc_task *task;
+-
+- if (!list_empty(q)) {
+- task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
+- if (task->tk_owner == queue->owner)
+- list_move_tail(&task->u.tk_wait.list, q);
+- }
+-}
+-
+ static void rpc_set_waitqueue_priority(struct rpc_wait_queue *queue, int priority)
+ {
+ if (queue->priority != priority) {
+- /* Fairness: rotate the list when changing priority */
+- rpc_rotate_queue_owner(queue);
+ queue->priority = priority;
++ queue->nr = 1U << priority;
+ }
+ }
+
+-static void rpc_set_waitqueue_owner(struct rpc_wait_queue *queue, pid_t pid)
+-{
+- queue->owner = pid;
+- queue->nr = RPC_BATCH_COUNT;
+-}
+-
+ static void rpc_reset_waitqueue_priority(struct rpc_wait_queue *queue)
+ {
+ rpc_set_waitqueue_priority(queue, queue->maxpriority);
+- rpc_set_waitqueue_owner(queue, 0);
+ }
+
+ /*
+- * Add new request to a priority queue.
++ * Add a request to a queue list
+ */
+-static void __rpc_add_wait_queue_priority(struct rpc_wait_queue *queue,
+- struct rpc_task *task,
+- unsigned char queue_priority)
++static void
++__rpc_list_enqueue_task(struct list_head *q, struct rpc_task *task)
+ {
+- struct list_head *q;
+ struct rpc_task *t;
+
+- INIT_LIST_HEAD(&task->u.tk_wait.links);
+- if (unlikely(queue_priority > queue->maxpriority))
+- queue_priority = queue->maxpriority;
+- if (queue_priority > queue->priority)
+- rpc_set_waitqueue_priority(queue, queue_priority);
+- q = &queue->tasks[queue_priority];
+ list_for_each_entry(t, q, u.tk_wait.list) {
+ if (t->tk_owner == task->tk_owner) {
+- list_add_tail(&task->u.tk_wait.list, &t->u.tk_wait.links);
++ list_add_tail(&task->u.tk_wait.links,
++ &t->u.tk_wait.links);
++ /* Cache the queue head in task->u.tk_wait.list */
++ task->u.tk_wait.list.next = q;
++ task->u.tk_wait.list.prev = NULL;
+ return;
+ }
+ }
++ INIT_LIST_HEAD(&task->u.tk_wait.links);
+ list_add_tail(&task->u.tk_wait.list, q);
+ }
+
++/*
++ * Remove request from a queue list
++ */
++static void
++__rpc_list_dequeue_task(struct rpc_task *task)
++{
++ struct list_head *q;
++ struct rpc_task *t;
++
++ if (task->u.tk_wait.list.prev == NULL) {
++ list_del(&task->u.tk_wait.links);
++ return;
++ }
++ if (!list_empty(&task->u.tk_wait.links)) {
++ t = list_first_entry(&task->u.tk_wait.links,
++ struct rpc_task,
++ u.tk_wait.links);
++ /* Assume __rpc_list_enqueue_task() cached the queue head */
++ q = t->u.tk_wait.list.next;
++ list_add_tail(&t->u.tk_wait.list, q);
++ list_del(&task->u.tk_wait.links);
++ }
++ list_del(&task->u.tk_wait.list);
++}
++
++/*
++ * Add new request to a priority queue.
++ */
++static void __rpc_add_wait_queue_priority(struct rpc_wait_queue *queue,
++ struct rpc_task *task,
++ unsigned char queue_priority)
++{
++ if (unlikely(queue_priority > queue->maxpriority))
++ queue_priority = queue->maxpriority;
++ __rpc_list_enqueue_task(&queue->tasks[queue_priority], task);
++}
++
+ /*
+ * Add new request to wait queue.
+ *
+@@ -194,13 +208,7 @@ static void __rpc_add_wait_queue(struct rpc_wait_queue *queue,
+ */
+ static void __rpc_remove_wait_queue_priority(struct rpc_task *task)
+ {
+- struct rpc_task *t;
+-
+- if (!list_empty(&task->u.tk_wait.links)) {
+- t = list_entry(task->u.tk_wait.links.next, struct rpc_task, u.tk_wait.list);
+- list_move(&t->u.tk_wait.list, &task->u.tk_wait.list);
+- list_splice_init(&task->u.tk_wait.links, &t->u.tk_wait.links);
+- }
++ __rpc_list_dequeue_task(task);
+ }
+
+ /*
+@@ -212,7 +220,8 @@ static void __rpc_remove_wait_queue(struct rpc_wait_queue *queue, struct rpc_tas
+ __rpc_disable_timer(queue, task);
+ if (RPC_IS_PRIORITY(queue))
+ __rpc_remove_wait_queue_priority(task);
+- list_del(&task->u.tk_wait.list);
++ else
++ list_del(&task->u.tk_wait.list);
+ queue->qlen--;
+ dprintk("RPC: %5u removed from queue %p \"%s\"\n",
+ task->tk_pid, queue, rpc_qname(queue));
+@@ -493,17 +502,9 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
+ * Service a batch of tasks from a single owner.
+ */
+ q = &queue->tasks[queue->priority];
+- if (!list_empty(q)) {
+- task = list_entry(q->next, struct rpc_task, u.tk_wait.list);
+- if (queue->owner == task->tk_owner) {
+- if (--queue->nr)
+- goto out;
+- list_move_tail(&task->u.tk_wait.list, q);
+- }
+- /*
+- * Check if we need to switch queues.
+- */
+- goto new_owner;
++ if (!list_empty(q) && --queue->nr) {
++ task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
++ goto out;
+ }
+
+ /*
+@@ -515,7 +516,7 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
+ else
+ q = q - 1;
+ if (!list_empty(q)) {
+- task = list_entry(q->next, struct rpc_task, u.tk_wait.list);
++ task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
+ goto new_queue;
+ }
+ } while (q != &queue->tasks[queue->priority]);
+@@ -525,8 +526,6 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
+
+ new_queue:
+ rpc_set_waitqueue_priority(queue, (unsigned int)(q - &queue->tasks[0]));
+-new_owner:
+- rpc_set_waitqueue_owner(queue, task->tk_owner);
+ out:
+ return task;
+ }
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index 3581168e6b99..5e7c13aa66d0 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -796,17 +796,11 @@ void xprt_connect(struct rpc_task *task)
+
+ static void xprt_connect_status(struct rpc_task *task)
+ {
+- struct rpc_xprt *xprt = task->tk_rqstp->rq_xprt;
+-
+- if (task->tk_status == 0) {
+- xprt->stat.connect_count++;
+- xprt->stat.connect_time += (long)jiffies - xprt->stat.connect_start;
++ switch (task->tk_status) {
++ case 0:
+ dprintk("RPC: %5u xprt_connect_status: connection established\n",
+ task->tk_pid);
+- return;
+- }
+-
+- switch (task->tk_status) {
++ break;
+ case -ECONNREFUSED:
+ case -ECONNRESET:
+ case -ECONNABORTED:
+@@ -823,7 +817,7 @@ static void xprt_connect_status(struct rpc_task *task)
+ default:
+ dprintk("RPC: %5u xprt_connect_status: error %d connecting to "
+ "server %s\n", task->tk_pid, -task->tk_status,
+- xprt->servername);
++ task->tk_rqstp->rq_xprt->servername);
+ task->tk_status = -EIO;
+ }
+ }
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index 98cbc7b060ba..f56f36b4d742 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -242,8 +242,12 @@ rpcrdma_connect_worker(struct work_struct *work)
+
+ spin_lock_bh(&xprt->transport_lock);
+ if (ep->rep_connected > 0) {
+- if (!xprt_test_and_set_connected(xprt))
++ if (!xprt_test_and_set_connected(xprt)) {
++ xprt->stat.connect_count++;
++ xprt->stat.connect_time += (long)jiffies -
++ xprt->stat.connect_start;
+ xprt_wake_pending_tasks(xprt, 0);
++ }
+ } else {
+ if (xprt_test_and_clear_connected(xprt))
+ xprt_wake_pending_tasks(xprt, -ENOTCONN);
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 7d8cce1dfcad..c0d7875a64ff 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -1611,6 +1611,9 @@ static void xs_tcp_state_change(struct sock *sk)
+ clear_bit(XPRT_SOCK_CONNECTING, &transport->sock_state);
+ xprt_clear_connecting(xprt);
+
++ xprt->stat.connect_count++;
++ xprt->stat.connect_time += (long)jiffies -
++ xprt->stat.connect_start;
+ xprt_wake_pending_tasks(xprt, -EAGAIN);
+ }
+ spin_unlock(&xprt->transport_lock);
+@@ -2029,8 +2032,6 @@ static int xs_local_finish_connecting(struct rpc_xprt *xprt,
+ }
+
+ /* Tell the socket layer to start connecting... */
+- xprt->stat.connect_count++;
+- xprt->stat.connect_start = jiffies;
+ return kernel_connect(sock, xs_addr(xprt), xprt->addrlen, 0);
+ }
+
+@@ -2062,6 +2063,9 @@ static int xs_local_setup_socket(struct sock_xprt *transport)
+ case 0:
+ dprintk("RPC: xprt %p connected to %s\n",
+ xprt, xprt->address_strings[RPC_DISPLAY_ADDR]);
++ xprt->stat.connect_count++;
++ xprt->stat.connect_time += (long)jiffies -
++ xprt->stat.connect_start;
+ xprt_set_connected(xprt);
+ case -ENOBUFS:
+ break;
+@@ -2387,8 +2391,6 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
+ xs_set_memalloc(xprt);
+
+ /* Tell the socket layer to start connecting... */
+- xprt->stat.connect_count++;
+- xprt->stat.connect_start = jiffies;
+ set_bit(XPRT_SOCK_CONNECTING, &transport->sock_state);
+ ret = kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK);
+ switch (ret) {
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 2ef1f56504cb..5075fd293feb 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3396,7 +3396,7 @@ static void get_key_callback(void *c, struct key_params *params)
+ params->cipher)))
+ goto nla_put_failure;
+
+- if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
++ if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
+ goto nla_put_failure;
+
+ nla_nest_end(cookie->msg, key);
+diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
+index 8cab91c482ff..d9117ab035f7 100644
+--- a/net/xdp/xdp_umem.c
++++ b/net/xdp/xdp_umem.c
+@@ -32,14 +32,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
+ {
+ unsigned long flags;
+
+- if (xs->dev) {
+- spin_lock_irqsave(&umem->xsk_list_lock, flags);
+- list_del_rcu(&xs->list);
+- spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
+-
+- if (umem->zc)
+- synchronize_net();
+- }
++ spin_lock_irqsave(&umem->xsk_list_lock, flags);
++ list_del_rcu(&xs->list);
++ spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
+ }
+
+ int xdp_umem_query(struct net_device *dev, u16 queue_id)
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 661504042d30..ff15207036dc 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -343,12 +343,18 @@ static int xsk_release(struct socket *sock)
+ local_bh_enable();
+
+ if (xs->dev) {
++ struct net_device *dev = xs->dev;
++
+ /* Wait for driver to stop using the xdp socket. */
+- synchronize_net();
+- dev_put(xs->dev);
++ xdp_del_sk_umem(xs->umem, xs);
+ xs->dev = NULL;
++ synchronize_net();
++ dev_put(dev);
+ }
+
++ xskq_destroy(xs->rx);
++ xskq_destroy(xs->tx);
++
+ sock_orphan(sk);
+ sock->sk = NULL;
+
+@@ -707,9 +713,6 @@ static void xsk_destruct(struct sock *sk)
+ if (!sock_flag(sk, SOCK_DEAD))
+ return;
+
+- xskq_destroy(xs->rx);
+- xskq_destroy(xs->tx);
+- xdp_del_sk_umem(xs->umem, xs);
+ xdp_put_umem(xs->umem);
+
+ sk_refcnt_debug_dec(sk);
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index 790b514f86b6..d5635908587f 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -131,7 +131,7 @@ struct sec_path *secpath_dup(struct sec_path *src)
+ sp->len = 0;
+ sp->olen = 0;
+
+- memset(sp->ovec, 0, sizeof(sp->ovec[XFRM_MAX_OFFLOAD_DEPTH]));
++ memset(sp->ovec, 0, sizeof(sp->ovec));
+
+ if (src) {
+ int i;
+diff --git a/samples/mei/mei-amt-version.c b/samples/mei/mei-amt-version.c
+index bb9988914a56..32234481ad7d 100644
+--- a/samples/mei/mei-amt-version.c
++++ b/samples/mei/mei-amt-version.c
+@@ -370,7 +370,7 @@ static uint32_t amt_host_if_call(struct amt_host_if *acmd,
+ unsigned int expected_sz)
+ {
+ uint32_t in_buf_sz;
+- uint32_t out_buf_sz;
++ ssize_t out_buf_sz;
+ ssize_t written;
+ uint32_t status;
+ struct amt_host_if_resp_header *msg_hdr;
+diff --git a/sound/hda/ext/hdac_ext_controller.c b/sound/hda/ext/hdac_ext_controller.c
+index 5bc4a1d587d4..60cb00fd0c69 100644
+--- a/sound/hda/ext/hdac_ext_controller.c
++++ b/sound/hda/ext/hdac_ext_controller.c
+@@ -48,9 +48,11 @@ void snd_hdac_ext_bus_ppcap_enable(struct hdac_bus *bus, bool enable)
+ }
+
+ if (enable)
+- snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL, 0, AZX_PPCTL_GPROCEN);
++ snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL,
++ AZX_PPCTL_GPROCEN, AZX_PPCTL_GPROCEN);
+ else
+- snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL, AZX_PPCTL_GPROCEN, 0);
++ snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL,
++ AZX_PPCTL_GPROCEN, 0);
+ }
+ EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_ppcap_enable);
+
+@@ -68,9 +70,11 @@ void snd_hdac_ext_bus_ppcap_int_enable(struct hdac_bus *bus, bool enable)
+ }
+
+ if (enable)
+- snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL, 0, AZX_PPCTL_PIE);
++ snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL,
++ AZX_PPCTL_PIE, AZX_PPCTL_PIE);
+ else
+- snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL, AZX_PPCTL_PIE, 0);
++ snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL,
++ AZX_PPCTL_PIE, 0);
+ }
+ EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_ppcap_int_enable);
+
+@@ -194,7 +198,8 @@ static int check_hdac_link_power_active(struct hdac_ext_link *link, bool enable)
+ */
+ int snd_hdac_ext_bus_link_power_up(struct hdac_ext_link *link)
+ {
+- snd_hdac_updatel(link->ml_addr, AZX_REG_ML_LCTL, 0, AZX_MLCTL_SPA);
++ snd_hdac_updatel(link->ml_addr, AZX_REG_ML_LCTL,
++ AZX_MLCTL_SPA, AZX_MLCTL_SPA);
+
+ return check_hdac_link_power_active(link, true);
+ }
+@@ -222,8 +227,8 @@ int snd_hdac_ext_bus_link_power_up_all(struct hdac_bus *bus)
+ int ret;
+
+ list_for_each_entry(hlink, &bus->hlink_list, list) {
+- snd_hdac_updatel(hlink->ml_addr,
+- AZX_REG_ML_LCTL, 0, AZX_MLCTL_SPA);
++ snd_hdac_updatel(hlink->ml_addr, AZX_REG_ML_LCTL,
++ AZX_MLCTL_SPA, AZX_MLCTL_SPA);
+ ret = check_hdac_link_power_active(hlink, true);
+ if (ret < 0)
+ return ret;
+@@ -243,7 +248,8 @@ int snd_hdac_ext_bus_link_power_down_all(struct hdac_bus *bus)
+ int ret;
+
+ list_for_each_entry(hlink, &bus->hlink_list, list) {
+- snd_hdac_updatel(hlink->ml_addr, AZX_REG_ML_LCTL, AZX_MLCTL_SPA, 0);
++ snd_hdac_updatel(hlink->ml_addr, AZX_REG_ML_LCTL,
++ AZX_MLCTL_SPA, 0);
+ ret = check_hdac_link_power_active(hlink, false);
+ if (ret < 0)
+ return ret;
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index f2cabfdced05..6a9b89e05dae 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -4521,7 +4521,7 @@ static int ca0132_effects_set(struct hda_codec *codec, hda_nid_t nid, long val)
+ val = 0;
+
+ /* If Voice Focus on SBZ, set to two channel. */
+- if ((nid == VOICE_FOCUS) && (spec->quirk == QUIRK_SBZ)
++ if ((nid == VOICE_FOCUS) && (spec->use_pci_mmio)
+ && (spec->cur_mic_type != REAR_LINE_IN)) {
+ if (spec->effects_switch[CRYSTAL_VOICE -
+ EFFECT_START_NID]) {
+@@ -4540,7 +4540,7 @@ static int ca0132_effects_set(struct hda_codec *codec, hda_nid_t nid, long val)
+ * For SBZ noise reduction, there's an extra command
+ * to module ID 0x47. No clue why.
+ */
+- if ((nid == NOISE_REDUCTION) && (spec->quirk == QUIRK_SBZ)
++ if ((nid == NOISE_REDUCTION) && (spec->use_pci_mmio)
+ && (spec->cur_mic_type != REAR_LINE_IN)) {
+ if (spec->effects_switch[CRYSTAL_VOICE -
+ EFFECT_START_NID]) {
+@@ -5856,8 +5856,8 @@ static int ca0132_build_controls(struct hda_codec *codec)
+ */
+ num_fx = OUT_EFFECTS_COUNT + IN_EFFECTS_COUNT;
+ for (i = 0; i < num_fx; i++) {
+- /* SBZ and R3D break if Echo Cancellation is used. */
+- if (spec->quirk == QUIRK_SBZ || spec->quirk == QUIRK_R3D) {
++ /* Desktop cards break if Echo Cancellation is used. */
++ if (spec->use_pci_mmio) {
+ if (i == (ECHO_CANCELLATION - IN_EFFECT_START_NID +
+ OUT_EFFECTS_COUNT))
+ continue;
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 046705b4691a..d8168aa2cef3 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -77,6 +77,7 @@ enum {
+ STAC_DELL_M6_BOTH,
+ STAC_DELL_EQ,
+ STAC_ALIENWARE_M17X,
++ STAC_ELO_VUPOINT_15MX,
+ STAC_92HD89XX_HP_FRONT_JACK,
+ STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK,
+ STAC_92HD73XX_ASUS_MOBO,
+@@ -1879,6 +1880,18 @@ static void stac92hd73xx_fixup_no_jd(struct hda_codec *codec,
+ codec->no_jack_detect = 1;
+ }
+
++
++static void stac92hd73xx_disable_automute(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct sigmatel_spec *spec = codec->spec;
++
++ if (action != HDA_FIXUP_ACT_PRE_PROBE)
++ return;
++
++ spec->gen.suppress_auto_mute = 1;
++}
++
+ static const struct hda_fixup stac92hd73xx_fixups[] = {
+ [STAC_92HD73XX_REF] = {
+ .type = HDA_FIXUP_FUNC,
+@@ -1904,6 +1917,10 @@ static const struct hda_fixup stac92hd73xx_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = stac92hd73xx_fixup_alienware_m17x,
+ },
++ [STAC_ELO_VUPOINT_15MX] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = stac92hd73xx_disable_automute,
++ },
+ [STAC_92HD73XX_INTEL] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = intel_dg45id_pin_configs,
+@@ -1942,6 +1959,7 @@ static const struct hda_model_fixup stac92hd73xx_models[] = {
+ { .id = STAC_DELL_M6_BOTH, .name = "dell-m6" },
+ { .id = STAC_DELL_EQ, .name = "dell-eq" },
+ { .id = STAC_ALIENWARE_M17X, .name = "alienware" },
++ { .id = STAC_ELO_VUPOINT_15MX, .name = "elo-vupoint-15mx" },
+ { .id = STAC_92HD73XX_ASUS_MOBO, .name = "asus-mobo" },
+ {}
+ };
+@@ -1991,6 +2009,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = {
+ "Alienware M17x", STAC_ALIENWARE_M17X),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0490,
+ "Alienware M17x R3", STAC_DELL_EQ),
++ SND_PCI_QUIRK(0x1059, 0x1011,
++ "ELO VuPoint 15MX", STAC_ELO_VUPOINT_15MX),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1927,
+ "HP Z1 G2", STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x2b17,
+diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c
+index 9db9a2944ef2..c1a7d376a3fe 100644
+--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
++++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
+@@ -319,10 +319,11 @@ static int q6asm_dai_open(struct snd_pcm_substream *substream)
+ prtd->audio_client = q6asm_audio_client_alloc(dev,
+ (q6asm_cb)event_handler, prtd, stream_id,
+ LEGACY_PCM_MODE);
+- if (!prtd->audio_client) {
++ if (IS_ERR(prtd->audio_client)) {
+ pr_info("%s: Could not allocate memory\n", __func__);
++ ret = PTR_ERR(prtd->audio_client);
+ kfree(prtd);
+- return -ENOMEM;
++ return ret;
+ }
+
+ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+diff --git a/tools/pci/pcitest.c b/tools/pci/pcitest.c
+index af146bb03b4d..4c5be77c211f 100644
+--- a/tools/pci/pcitest.c
++++ b/tools/pci/pcitest.c
+@@ -23,7 +23,6 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <sys/ioctl.h>
+-#include <time.h>
+ #include <unistd.h>
+
+ #include <linux/pcitest.h>
+@@ -50,15 +49,13 @@ struct pci_test {
+
+ static int run_test(struct pci_test *test)
+ {
+- long ret;
++ int ret = -EINVAL;
+ int fd;
+- struct timespec start, end;
+- double time;
+
+ fd = open(test->device, O_RDWR);
+ if (fd < 0) {
+ perror("can't open PCI Endpoint Test device");
+- return fd;
++ return -ENODEV;
+ }
+
+ if (test->barnum >= 0 && test->barnum <= 5) {
+diff --git a/tools/testing/radix-tree/idr-test.c b/tools/testing/radix-tree/idr-test.c
+index 321ba92c70d2..235eef71f3d1 100644
+--- a/tools/testing/radix-tree/idr-test.c
++++ b/tools/testing/radix-tree/idr-test.c
+@@ -227,6 +227,57 @@ void idr_u32_test(int base)
+ idr_u32_test1(&idr, 0xffffffff);
+ }
+
++static inline void *idr_mk_value(unsigned long v)
++{
++ BUG_ON((long)v < 0);
++ return (void *)((v & 1) | 2 | (v << 1));
++}
++
++DEFINE_IDR(find_idr);
++
++static void *idr_throbber(void *arg)
++{
++ time_t start = time(NULL);
++ int id = *(int *)arg;
++
++ rcu_register_thread();
++ do {
++ idr_alloc(&find_idr, idr_mk_value(id), id, id + 1, GFP_KERNEL);
++ idr_remove(&find_idr, id);
++ } while (time(NULL) < start + 10);
++ rcu_unregister_thread();
++
++ return NULL;
++}
++
++void idr_find_test_1(int anchor_id, int throbber_id)
++{
++ pthread_t throbber;
++ time_t start = time(NULL);
++
++ pthread_create(&throbber, NULL, idr_throbber, &throbber_id);
++
++ BUG_ON(idr_alloc(&find_idr, idr_mk_value(anchor_id), anchor_id,
++ anchor_id + 1, GFP_KERNEL) != anchor_id);
++
++ do {
++ int id = 0;
++ void *entry = idr_get_next(&find_idr, &id);
++ BUG_ON(entry != idr_mk_value(id));
++ } while (time(NULL) < start + 11);
++
++ pthread_join(throbber, NULL);
++
++ idr_remove(&find_idr, anchor_id);
++ BUG_ON(!idr_is_empty(&find_idr));
++}
++
++void idr_find_test(void)
++{
++ idr_find_test_1(100000, 0);
++ idr_find_test_1(0, 100000);
++}
++
+ void idr_checks(void)
+ {
+ unsigned long i;
+@@ -307,6 +358,7 @@ void idr_checks(void)
+ idr_u32_test(4);
+ idr_u32_test(1);
+ idr_u32_test(0);
++ idr_find_test();
+ }
+
+ #define module_init(x)
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index ca53b539aa2d..08bac6cf1bb3 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -251,7 +251,7 @@ lldpad_app_wait_set()
+ {
+ local dev=$1; shift
+
+- while lldptool -t -i $dev -V APP -c app | grep -q pending; do
++ while lldptool -t -i $dev -V APP -c app | grep -Eq "pending|unknown"; do
+ echo "$dev: waiting for lldpad to push pending APP updates"
+ sleep 5
+ done
+diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c
+index 8fdfeafaf8c0..7549d39ccaff 100644
+--- a/tools/testing/selftests/net/tls.c
++++ b/tools/testing/selftests/net/tls.c
+@@ -288,7 +288,7 @@ TEST_F(tls, splice_from_pipe)
+ ASSERT_GE(pipe(p), 0);
+ EXPECT_GE(write(p[1], mem_send, send_len), 0);
+ EXPECT_GE(splice(p[0], NULL, self->fd, NULL, send_len, 0), 0);
+- EXPECT_GE(recv(self->cfd, mem_recv, send_len, 0), 0);
++ EXPECT_EQ(recv(self->cfd, mem_recv, send_len, MSG_WAITALL), send_len);
+ EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
+ }
+
+@@ -322,13 +322,13 @@ TEST_F(tls, send_and_splice)
+
+ ASSERT_GE(pipe(p), 0);
+ EXPECT_EQ(send(self->fd, test_str, send_len2, 0), send_len2);
+- EXPECT_NE(recv(self->cfd, buf, send_len2, 0), -1);
++ EXPECT_EQ(recv(self->cfd, buf, send_len2, MSG_WAITALL), send_len2);
+ EXPECT_EQ(memcmp(test_str, buf, send_len2), 0);
+
+ EXPECT_GE(write(p[1], mem_send, send_len), send_len);
+ EXPECT_GE(splice(p[0], NULL, self->fd, NULL, send_len, 0), send_len);
+
+- EXPECT_GE(recv(self->cfd, mem_recv, send_len, 0), 0);
++ EXPECT_EQ(recv(self->cfd, mem_recv, send_len, MSG_WAITALL), send_len);
+ EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0);
+ }
+
+@@ -516,17 +516,17 @@ TEST_F(tls, recv_peek_multiple_records)
+ len = strlen(test_str_second) + 1;
+ EXPECT_EQ(send(self->fd, test_str_second, len, 0), len);
+
+- len = sizeof(buf);
++ len = strlen(test_str_first);
+ memset(buf, 0, len);
+- EXPECT_NE(recv(self->cfd, buf, len, MSG_PEEK), -1);
++ EXPECT_EQ(recv(self->cfd, buf, len, MSG_PEEK | MSG_WAITALL), len);
+
+ /* MSG_PEEK can only peek into the current record. */
+- len = strlen(test_str_first) + 1;
++ len = strlen(test_str_first);
+ EXPECT_EQ(memcmp(test_str_first, buf, len), 0);
+
+- len = sizeof(buf);
++ len = strlen(test_str) + 1;
+ memset(buf, 0, len);
+- EXPECT_NE(recv(self->cfd, buf, len, 0), -1);
++ EXPECT_EQ(recv(self->cfd, buf, len, MSG_WAITALL), len);
+
+ /* Non-MSG_PEEK will advance strparser (and therefore record)
+ * however.
+@@ -543,9 +543,9 @@ TEST_F(tls, recv_peek_multiple_records)
+ len = strlen(test_str_second) + 1;
+ EXPECT_EQ(send(self->fd, test_str_second, len, 0), len);
+
+- len = sizeof(buf);
++ len = strlen(test_str) + 1;
+ memset(buf, 0, len);
+- EXPECT_NE(recv(self->cfd, buf, len, MSG_PEEK), -1);
++ EXPECT_EQ(recv(self->cfd, buf, len, MSG_PEEK | MSG_WAITALL), len);
+
+ len = strlen(test_str) + 1;
+ EXPECT_EQ(memcmp(test_str, buf, len), 0);
+diff --git a/tools/testing/selftests/tc-testing/bpf/Makefile b/tools/testing/selftests/tc-testing/bpf/Makefile
+new file mode 100644
+index 000000000000..dc92eb271d9a
+--- /dev/null
++++ b/tools/testing/selftests/tc-testing/bpf/Makefile
+@@ -0,0 +1,29 @@
++# SPDX-License-Identifier: GPL-2.0
++
++APIDIR := ../../../../include/uapi
++TEST_GEN_FILES = action.o
++
++top_srcdir = ../../../../..
++include ../../lib.mk
++
++CLANG ?= clang
++LLC ?= llc
++PROBE := $(shell $(LLC) -march=bpf -mcpu=probe -filetype=null /dev/null 2>&1)
++
++ifeq ($(PROBE),)
++ CPU ?= probe
++else
++ CPU ?= generic
++endif
++
++CLANG_SYS_INCLUDES := $(shell $(CLANG) -v -E - </dev/null 2>&1 \
++ | sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }')
++
++CLANG_FLAGS = -I. -I$(APIDIR) \
++ $(CLANG_SYS_INCLUDES) \
++ -Wno-compare-distinct-pointer-types
++
++$(OUTPUT)/%.o: %.c
++ $(CLANG) $(CLANG_FLAGS) \
++ -O2 -target bpf -emit-llvm -c $< -o - | \
++ $(LLC) -march=bpf -mcpu=$(CPU) $(LLC_FLAGS) -filetype=obj -o $@
+diff --git a/tools/testing/selftests/tc-testing/bpf/action.c b/tools/testing/selftests/tc-testing/bpf/action.c
+new file mode 100644
+index 000000000000..c32b99b80e19
+--- /dev/null
++++ b/tools/testing/selftests/tc-testing/bpf/action.c
+@@ -0,0 +1,23 @@
++/* SPDX-License-Identifier: GPL-2.0
++ * Copyright (c) 2018 Davide Caratti, Red Hat inc.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of version 2 of the GNU General Public
++ * License as published by the Free Software Foundation.
++ */
++
++#include <linux/bpf.h>
++#include <linux/pkt_cls.h>
++
++__attribute__((section("action-ok"),used)) int action_ok(struct __sk_buff *s)
++{
++ return TC_ACT_OK;
++}
++
++__attribute__((section("action-ko"),used)) int action_ko(struct __sk_buff *s)
++{
++ s->data = 0x0;
++ return TC_ACT_OK;
++}
++
++char _license[] __attribute__((section("license"),used)) = "GPL";
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json b/tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json
+index 6f289a49e5ec..1a9b282dd0be 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/bpf.json
+@@ -55,7 +55,7 @@
+ "bpf"
+ ],
+ "setup": [
+- "printf '#include <linux/bpf.h>\nchar l[] __attribute__((section(\"license\"),used))=\"GPL\"; __attribute__((section(\"action\"),used)) int m(struct __sk_buff *s) { return 2; }' | clang -O2 -x c -c - -target bpf -o _b.o",
++ "make -C bpf",
+ [
+ "$TC action flush action bpf",
+ 0,
+@@ -63,14 +63,14 @@
+ 255
+ ]
+ ],
+- "cmdUnderTest": "$TC action add action bpf object-file _b.o index 667",
++ "cmdUnderTest": "$TC action add action bpf object-file $EBPFDIR/action.o section action-ok index 667",
+ "expExitCode": "0",
+ "verifyCmd": "$TC action get action bpf index 667",
+- "matchPattern": "action order [0-9]*: bpf _b.o:\\[action\\] id [0-9]* tag 3b185187f1855c4c( jited)? default-action pipe.*index 667 ref",
++ "matchPattern": "action order [0-9]*: bpf action.o:\\[action-ok\\] id [0-9]* tag [0-9a-f]{16}( jited)? default-action pipe.*index 667 ref",
+ "matchCount": "1",
+ "teardown": [
+ "$TC action flush action bpf",
+- "rm -f _b.o"
++ "make -C bpf clean"
+ ]
+ },
+ {
+@@ -81,7 +81,7 @@
+ "bpf"
+ ],
+ "setup": [
+- "printf '#include <linux/bpf.h>\nchar l[] __attribute__((section(\"license\"),used))=\"GPL\"; __attribute__((section(\"action\"),used)) int m(struct __sk_buff *s) { s->data = 0x0; return 2; }' | clang -O2 -x c -c - -target bpf -o _c.o",
++ "make -C bpf",
+ [
+ "$TC action flush action bpf",
+ 0,
+@@ -89,10 +89,10 @@
+ 255
+ ]
+ ],
+- "cmdUnderTest": "$TC action add action bpf object-file _c.o index 667",
++ "cmdUnderTest": "$TC action add action bpf object-file $EBPFDIR/action.o section action-ko index 667",
+ "expExitCode": "255",
+ "verifyCmd": "$TC action get action bpf index 667",
+- "matchPattern": "action order [0-9]*: bpf _c.o:\\[action\\] id [0-9].*index 667 ref",
++ "matchPattern": "action order [0-9]*: bpf action.o:\\[action-ko\\] id [0-9].*index 667 ref",
+ "matchCount": "0",
+ "teardown": [
+ [
+@@ -101,7 +101,7 @@
+ 1,
+ 255
+ ],
+- "rm -f _c.o"
++ "make -C bpf clean"
+ ]
+ },
+ {
+diff --git a/tools/testing/selftests/tc-testing/tdc_config.py b/tools/testing/selftests/tc-testing/tdc_config.py
+index a023d0d62b25..d651bc1501bd 100644
+--- a/tools/testing/selftests/tc-testing/tdc_config.py
++++ b/tools/testing/selftests/tc-testing/tdc_config.py
+@@ -16,7 +16,9 @@ NAMES = {
+ 'DEV2': '',
+ 'BATCH_FILE': './batch.txt',
+ # Name of the namespace to use
+- 'NS': 'tcut'
++ 'NS': 'tcut',
++ # Directory containing eBPF test programs
++ 'EBPFDIR': './bpf'
+ }
+
+
+diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
+index 1344557a7085..bf330b493c1e 100644
+--- a/virt/kvm/arm/mmu.c
++++ b/virt/kvm/arm/mmu.c
+@@ -412,7 +412,8 @@ static void stage2_flush_memslot(struct kvm *kvm,
+ pgd = kvm->arch.pgd + stage2_pgd_index(addr);
+ do {
+ next = stage2_pgd_addr_end(addr, end);
+- stage2_flush_puds(kvm, pgd, addr, next);
++ if (!stage2_pgd_none(*pgd))
++ stage2_flush_puds(kvm, pgd, addr, next);
+ } while (pgd++, addr = next, addr != end);
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-12-01 14:06 Thomas Deutschmann
0 siblings, 0 replies; 332+ messages in thread
From: Thomas Deutschmann @ 2019-12-01 14:06 UTC (permalink / raw
To: gentoo-commits
commit: 84ccfd99c9438da3264cfbc161b7bafe5bbe3245
Author: Thomas Deutschmann <whissi <AT> whissi <DOT> de>
AuthorDate: Sun Dec 1 14:06:18 2019 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Sun Dec 1 14:06:18 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=84ccfd99
Linux patch 4.19.87
Signed-off-by: Thomas Deutschmann <whissi <AT> whissi.de>
1086_linux-4.19.87.patch | 11996 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 11996 insertions(+)
diff --git a/1086_linux-4.19.87.patch b/1086_linux-4.19.87.patch
new file mode 100644
index 0000000..2cc0d06
--- /dev/null
+++ b/1086_linux-4.19.87.patch
@@ -0,0 +1,11996 @@
+diff --git a/Documentation/admin-guide/hw-vuln/mds.rst b/Documentation/admin-guide/hw-vuln/mds.rst
+index e3a796c0d3a2..2d19c9f4c1fe 100644
+--- a/Documentation/admin-guide/hw-vuln/mds.rst
++++ b/Documentation/admin-guide/hw-vuln/mds.rst
+@@ -265,8 +265,11 @@ time with the option "mds=". The valid arguments for this option are:
+
+ ============ =============================================================
+
+-Not specifying this option is equivalent to "mds=full".
+-
++Not specifying this option is equivalent to "mds=full". For processors
++that are affected by both TAA (TSX Asynchronous Abort) and MDS,
++specifying just "mds=off" without an accompanying "tsx_async_abort=off"
++will have no effect as the same mitigation is used for both
++vulnerabilities.
+
+ Mitigation selection guide
+ --------------------------
+diff --git a/Documentation/admin-guide/hw-vuln/tsx_async_abort.rst b/Documentation/admin-guide/hw-vuln/tsx_async_abort.rst
+index fddbd7579c53..af6865b822d2 100644
+--- a/Documentation/admin-guide/hw-vuln/tsx_async_abort.rst
++++ b/Documentation/admin-guide/hw-vuln/tsx_async_abort.rst
+@@ -174,7 +174,10 @@ the option "tsx_async_abort=". The valid arguments for this option are:
+ CPU is not vulnerable to cross-thread TAA attacks.
+ ============ =============================================================
+
+-Not specifying this option is equivalent to "tsx_async_abort=full".
++Not specifying this option is equivalent to "tsx_async_abort=full". For
++processors that are affected by both TAA and MDS, specifying just
++"tsx_async_abort=off" without an accompanying "mds=off" will have no
++effect as the same mitigation is used for both vulnerabilities.
+
+ The kernel command line also allows to control the TSX feature using the
+ parameter "tsx=" on CPUs which support TSX control. MSR_IA32_TSX_CTRL is used
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 475ed980b25b..ce1af89dbbb8 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2359,6 +2359,12 @@
+ SMT on vulnerable CPUs
+ off - Unconditionally disable MDS mitigation
+
++ On TAA-affected machines, mds=off can be prevented by
++ an active TAA mitigation as both vulnerabilities are
++ mitigated with the same mechanism so in order to disable
++ this mitigation, you need to specify tsx_async_abort=off
++ too.
++
+ Not specifying this option is equivalent to
+ mds=full.
+
+@@ -4773,6 +4779,11 @@
+ vulnerable to cross-thread TAA attacks.
+ off - Unconditionally disable TAA mitigation
+
++ On MDS-affected machines, tsx_async_abort=off can be
++ prevented by an active MDS mitigation as both vulnerabilities
++ are mitigated with the same mechanism so in order to disable
++ this mitigation, you need to specify mds=off too.
++
+ Not specifying this option is equivalent to
+ tsx_async_abort=full. On CPUs which are MDS affected
+ and deploy MDS mitigation, TAA mitigation is not
+diff --git a/Documentation/devicetree/bindings/spi/spi-uniphier.txt b/Documentation/devicetree/bindings/spi/spi-uniphier.txt
+index 504a4ecfc7b1..b04e66a52de5 100644
+--- a/Documentation/devicetree/bindings/spi/spi-uniphier.txt
++++ b/Documentation/devicetree/bindings/spi/spi-uniphier.txt
+@@ -5,18 +5,20 @@ UniPhier SoCs have SCSSI which supports SPI single channel.
+ Required properties:
+ - compatible: should be "socionext,uniphier-scssi"
+ - reg: address and length of the spi master registers
+- - #address-cells: must be <1>, see spi-bus.txt
+- - #size-cells: must be <0>, see spi-bus.txt
+- - clocks: A phandle to the clock for the device.
+- - resets: A phandle to the reset control for the device.
++ - interrupts: a single interrupt specifier
++ - pinctrl-names: should be "default"
++ - pinctrl-0: pin control state for the default mode
++ - clocks: a phandle to the clock for the device
++ - resets: a phandle to the reset control for the device
+
+ Example:
+
+ spi0: spi@54006000 {
+ compatible = "socionext,uniphier-scssi";
+ reg = <0x54006000 0x100>;
+- #address-cells = <1>;
+- #size-cells = <0>;
++ interrupts = <0 39 4>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_spi0>;
+ clocks = <&peri_clk 11>;
+ resets = <&peri_rst 11>;
+ };
+diff --git a/Makefile b/Makefile
+index feb0568e9535..9240f36099de 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 86
++SUBLEVEL = 87
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/kernel/perf_event.c b/arch/arc/kernel/perf_event.c
+index 8aec462d90fb..30f66b123541 100644
+--- a/arch/arc/kernel/perf_event.c
++++ b/arch/arc/kernel/perf_event.c
+@@ -490,8 +490,8 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
+ /* loop thru all available h/w condition indexes */
+ for (j = 0; j < cc_bcr.c; j++) {
+ write_aux_reg(ARC_REG_CC_INDEX, j);
+- cc_name.indiv.word0 = read_aux_reg(ARC_REG_CC_NAME0);
+- cc_name.indiv.word1 = read_aux_reg(ARC_REG_CC_NAME1);
++ cc_name.indiv.word0 = le32_to_cpu(read_aux_reg(ARC_REG_CC_NAME0));
++ cc_name.indiv.word1 = le32_to_cpu(read_aux_reg(ARC_REG_CC_NAME1));
+
+ /* See if it has been mapped to a perf event_id */
+ for (i = 0; i < ARRAY_SIZE(arc_pmu_ev_hw_map); i++) {
+diff --git a/arch/arm/boot/dts/imx6sx-sdb.dtsi b/arch/arm/boot/dts/imx6sx-sdb.dtsi
+index f8f31872fa14..d6d517e4922f 100644
+--- a/arch/arm/boot/dts/imx6sx-sdb.dtsi
++++ b/arch/arm/boot/dts/imx6sx-sdb.dtsi
+@@ -115,7 +115,9 @@
+ regulator-name = "enet_3v3";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+- gpios = <&gpio2 6 GPIO_ACTIVE_LOW>;
++ gpio = <&gpio2 6 GPIO_ACTIVE_LOW>;
++ regulator-boot-on;
++ regulator-always-on;
+ };
+
+ reg_pcie_gpio: regulator-pcie-gpio {
+@@ -178,6 +180,7 @@
+ phy-supply = <®_enet_3v3>;
+ phy-mode = "rgmii";
+ phy-handle = <ðphy1>;
++ phy-reset-gpios = <&gpio2 7 GPIO_ACTIVE_LOW>;
+ status = "okay";
+
+ mdio {
+@@ -371,6 +374,8 @@
+ MX6SX_PAD_RGMII1_RD3__ENET1_RX_DATA_3 0x3081
+ MX6SX_PAD_RGMII1_RX_CTL__ENET1_RX_EN 0x3081
+ MX6SX_PAD_ENET2_RX_CLK__ENET2_REF_CLK_25M 0x91
++ /* phy reset */
++ MX6SX_PAD_ENET2_CRS__GPIO2_IO_7 0x10b0
+ >;
+ };
+
+diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
+index 70e560cf8ca0..d8cbe772f690 100644
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -1195,6 +1195,9 @@ void __init adjust_lowmem_bounds(void)
+ phys_addr_t block_start = reg->base;
+ phys_addr_t block_end = reg->base + reg->size;
+
++ if (memblock_is_nomap(reg))
++ continue;
++
+ if (reg->base < vmalloc_limit) {
+ if (block_end > lowmem_limit)
+ /*
+diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
+index 5d8787f0ca5f..9a5e28141211 100644
+--- a/arch/arm64/Makefile
++++ b/arch/arm64/Makefile
+@@ -148,6 +148,7 @@ archclean:
+ $(Q)$(MAKE) $(clean)=$(boot)
+ $(Q)$(MAKE) $(clean)=$(boot)/dts
+
++ifeq ($(KBUILD_EXTMOD),)
+ # We need to generate vdso-offsets.h before compiling certain files in kernel/.
+ # In order to do that, we should use the archprepare target, but we can't since
+ # asm-offsets.h is included in some files used to generate vdso-offsets.h, and
+@@ -157,6 +158,7 @@ archclean:
+ prepare: vdso_prepare
+ vdso_prepare: prepare0
+ $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso include/generated/vdso-offsets.h
++endif
+
+ define archhelp
+ echo '* Image.gz - Compressed kernel image (arch/$(ARCH)/boot/Image.gz)'
+diff --git a/arch/arm64/include/asm/string.h b/arch/arm64/include/asm/string.h
+index dd95d33a5bd5..03a6c256b7ec 100644
+--- a/arch/arm64/include/asm/string.h
++++ b/arch/arm64/include/asm/string.h
+@@ -16,6 +16,7 @@
+ #ifndef __ASM_STRING_H
+ #define __ASM_STRING_H
+
++#ifndef CONFIG_KASAN
+ #define __HAVE_ARCH_STRRCHR
+ extern char *strrchr(const char *, int c);
+
+@@ -34,6 +35,13 @@ extern __kernel_size_t strlen(const char *);
+ #define __HAVE_ARCH_STRNLEN
+ extern __kernel_size_t strnlen(const char *, __kernel_size_t);
+
++#define __HAVE_ARCH_MEMCMP
++extern int memcmp(const void *, const void *, size_t);
++
++#define __HAVE_ARCH_MEMCHR
++extern void *memchr(const void *, int, __kernel_size_t);
++#endif
++
+ #define __HAVE_ARCH_MEMCPY
+ extern void *memcpy(void *, const void *, __kernel_size_t);
+ extern void *__memcpy(void *, const void *, __kernel_size_t);
+@@ -42,16 +50,10 @@ extern void *__memcpy(void *, const void *, __kernel_size_t);
+ extern void *memmove(void *, const void *, __kernel_size_t);
+ extern void *__memmove(void *, const void *, __kernel_size_t);
+
+-#define __HAVE_ARCH_MEMCHR
+-extern void *memchr(const void *, int, __kernel_size_t);
+-
+ #define __HAVE_ARCH_MEMSET
+ extern void *memset(void *, int, __kernel_size_t);
+ extern void *__memset(void *, int, __kernel_size_t);
+
+-#define __HAVE_ARCH_MEMCMP
+-extern int memcmp(const void *, const void *, size_t);
+-
+ #ifdef CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE
+ #define __HAVE_ARCH_MEMCPY_FLUSHCACHE
+ void memcpy_flushcache(void *dst, const void *src, size_t cnt);
+diff --git a/arch/arm64/kernel/arm64ksyms.c b/arch/arm64/kernel/arm64ksyms.c
+index d894a20b70b2..72f63a59b008 100644
+--- a/arch/arm64/kernel/arm64ksyms.c
++++ b/arch/arm64/kernel/arm64ksyms.c
+@@ -44,20 +44,23 @@ EXPORT_SYMBOL(__arch_copy_in_user);
+ EXPORT_SYMBOL(memstart_addr);
+
+ /* string / mem functions */
++#ifndef CONFIG_KASAN
+ EXPORT_SYMBOL(strchr);
+ EXPORT_SYMBOL(strrchr);
+ EXPORT_SYMBOL(strcmp);
+ EXPORT_SYMBOL(strncmp);
+ EXPORT_SYMBOL(strlen);
+ EXPORT_SYMBOL(strnlen);
++EXPORT_SYMBOL(memcmp);
++EXPORT_SYMBOL(memchr);
++#endif
++
+ EXPORT_SYMBOL(memset);
+ EXPORT_SYMBOL(memcpy);
+ EXPORT_SYMBOL(memmove);
+ EXPORT_SYMBOL(__memset);
+ EXPORT_SYMBOL(__memcpy);
+ EXPORT_SYMBOL(__memmove);
+-EXPORT_SYMBOL(memchr);
+-EXPORT_SYMBOL(memcmp);
+
+ /* atomic bitops */
+ EXPORT_SYMBOL(set_bit);
+diff --git a/arch/arm64/lib/memchr.S b/arch/arm64/lib/memchr.S
+index 4444c1d25f4b..0f164a4baf52 100644
+--- a/arch/arm64/lib/memchr.S
++++ b/arch/arm64/lib/memchr.S
+@@ -30,7 +30,7 @@
+ * Returns:
+ * x0 - address of first occurrence of 'c' or 0
+ */
+-ENTRY(memchr)
++WEAK(memchr)
+ and w1, w1, #0xff
+ 1: subs x2, x2, #1
+ b.mi 2f
+diff --git a/arch/arm64/lib/memcmp.S b/arch/arm64/lib/memcmp.S
+index 2a4e239bd17a..fb295f52e9f8 100644
+--- a/arch/arm64/lib/memcmp.S
++++ b/arch/arm64/lib/memcmp.S
+@@ -58,7 +58,7 @@ pos .req x11
+ limit_wd .req x12
+ mask .req x13
+
+-ENTRY(memcmp)
++WEAK(memcmp)
+ cbz limit, .Lret0
+ eor tmp1, src1, src2
+ tst tmp1, #7
+diff --git a/arch/arm64/lib/strchr.S b/arch/arm64/lib/strchr.S
+index dae0cf5591f9..7c83091d1bcd 100644
+--- a/arch/arm64/lib/strchr.S
++++ b/arch/arm64/lib/strchr.S
+@@ -29,7 +29,7 @@
+ * Returns:
+ * x0 - address of first occurrence of 'c' or 0
+ */
+-ENTRY(strchr)
++WEAK(strchr)
+ and w1, w1, #0xff
+ 1: ldrb w2, [x0], #1
+ cmp w2, w1
+diff --git a/arch/arm64/lib/strcmp.S b/arch/arm64/lib/strcmp.S
+index 471fe61760ef..7d5d15398bfb 100644
+--- a/arch/arm64/lib/strcmp.S
++++ b/arch/arm64/lib/strcmp.S
+@@ -60,7 +60,7 @@ tmp3 .req x9
+ zeroones .req x10
+ pos .req x11
+
+-ENTRY(strcmp)
++WEAK(strcmp)
+ eor tmp1, src1, src2
+ mov zeroones, #REP8_01
+ tst tmp1, #7
+diff --git a/arch/arm64/lib/strlen.S b/arch/arm64/lib/strlen.S
+index 55ccc8e24c08..8e0b14205dcb 100644
+--- a/arch/arm64/lib/strlen.S
++++ b/arch/arm64/lib/strlen.S
+@@ -56,7 +56,7 @@ pos .req x12
+ #define REP8_7f 0x7f7f7f7f7f7f7f7f
+ #define REP8_80 0x8080808080808080
+
+-ENTRY(strlen)
++WEAK(strlen)
+ mov zeroones, #REP8_01
+ bic src, srcin, #15
+ ands tmp1, srcin, #15
+diff --git a/arch/arm64/lib/strncmp.S b/arch/arm64/lib/strncmp.S
+index e267044761c6..66bd145935d9 100644
+--- a/arch/arm64/lib/strncmp.S
++++ b/arch/arm64/lib/strncmp.S
+@@ -64,7 +64,7 @@ limit_wd .req x13
+ mask .req x14
+ endloop .req x15
+
+-ENTRY(strncmp)
++WEAK(strncmp)
+ cbz limit, .Lret0
+ eor tmp1, src1, src2
+ mov zeroones, #REP8_01
+diff --git a/arch/arm64/lib/strnlen.S b/arch/arm64/lib/strnlen.S
+index eae38da6e0bb..355be04441fe 100644
+--- a/arch/arm64/lib/strnlen.S
++++ b/arch/arm64/lib/strnlen.S
+@@ -59,7 +59,7 @@ limit_wd .req x14
+ #define REP8_7f 0x7f7f7f7f7f7f7f7f
+ #define REP8_80 0x8080808080808080
+
+-ENTRY(strnlen)
++WEAK(strnlen)
+ cbz limit, .Lhit_limit
+ mov zeroones, #REP8_01
+ bic src, srcin, #15
+diff --git a/arch/arm64/lib/strrchr.S b/arch/arm64/lib/strrchr.S
+index f8e2784d5752..ea84924d5990 100644
+--- a/arch/arm64/lib/strrchr.S
++++ b/arch/arm64/lib/strrchr.S
+@@ -29,7 +29,7 @@
+ * Returns:
+ * x0 - address of last occurrence of 'c' or 0
+ */
+-ENTRY(strrchr)
++WEAK(strrchr)
+ mov x3, #0
+ and w1, w1, #0xff
+ 1: ldrb w2, [x0], #1
+diff --git a/arch/m68k/kernel/uboot.c b/arch/m68k/kernel/uboot.c
+index b29c3b241e1b..107082877064 100644
+--- a/arch/m68k/kernel/uboot.c
++++ b/arch/m68k/kernel/uboot.c
+@@ -102,5 +102,5 @@ __init void process_uboot_commandline(char *commandp, int size)
+ }
+
+ parse_uboot_commandline(commandp, len);
+- commandp[size - 1] = 0;
++ commandp[len - 1] = 0;
+ }
+diff --git a/arch/nds32/include/asm/bitfield.h b/arch/nds32/include/asm/bitfield.h
+index 8e84fc385b94..19b2841219ad 100644
+--- a/arch/nds32/include/asm/bitfield.h
++++ b/arch/nds32/include/asm/bitfield.h
+@@ -692,8 +692,8 @@
+ #define PFM_CTL_offKU1 13 /* Enable user mode event counting for PFMC1 */
+ #define PFM_CTL_offKU2 14 /* Enable user mode event counting for PFMC2 */
+ #define PFM_CTL_offSEL0 15 /* The event selection for PFMC0 */
+-#define PFM_CTL_offSEL1 21 /* The event selection for PFMC1 */
+-#define PFM_CTL_offSEL2 27 /* The event selection for PFMC2 */
++#define PFM_CTL_offSEL1 16 /* The event selection for PFMC1 */
++#define PFM_CTL_offSEL2 22 /* The event selection for PFMC2 */
+ /* bit 28:31 reserved */
+
+ #define PFM_CTL_mskEN0 ( 0x01 << PFM_CTL_offEN0 )
+diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
+index 25e3184f11f7..7d5ddf53750c 100644
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -32,8 +32,8 @@ else
+ endif
+
+ BOOTCFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+- -fno-strict-aliasing -Os -msoft-float -pipe \
+- -fomit-frame-pointer -fno-builtin -fPIC -nostdinc \
++ -fno-strict-aliasing -Os -msoft-float -mno-altivec -mno-vsx \
++ -pipe -fomit-frame-pointer -fno-builtin -fPIC -nostdinc \
+ -D$(compress-y)
+
+ ifdef CONFIG_PPC64_BOOT_WRAPPER
+diff --git a/arch/powerpc/boot/opal.c b/arch/powerpc/boot/opal.c
+index 0272570d02de..dfb199ef5b94 100644
+--- a/arch/powerpc/boot/opal.c
++++ b/arch/powerpc/boot/opal.c
+@@ -13,8 +13,6 @@
+ #include <libfdt.h>
+ #include "../include/asm/opal-api.h"
+
+-#ifdef CONFIG_PPC64_BOOT_WRAPPER
+-
+ /* Global OPAL struct used by opal-call.S */
+ struct opal {
+ u64 base;
+@@ -101,9 +99,3 @@ int opal_console_init(void *devp, struct serial_console_data *scdp)
+
+ return 0;
+ }
+-#else
+-int opal_console_init(void *devp, struct serial_console_data *scdp)
+-{
+- return -1;
+-}
+-#endif /* __powerpc64__ */
+diff --git a/arch/powerpc/include/asm/asm-prototypes.h b/arch/powerpc/include/asm/asm-prototypes.h
+index e398173ae67d..d0609c116e4f 100644
+--- a/arch/powerpc/include/asm/asm-prototypes.h
++++ b/arch/powerpc/include/asm/asm-prototypes.h
+@@ -146,8 +146,11 @@ void _kvmppc_save_tm_pr(struct kvm_vcpu *vcpu, u64 guest_msr);
+ /* Patch sites */
+ extern s32 patch__call_flush_count_cache;
+ extern s32 patch__flush_count_cache_return;
++extern s32 patch__flush_link_stack_return;
++extern s32 patch__call_kvm_flush_link_stack;
+ extern s32 patch__memset_nocache, patch__memcpy_nocache;
+
+ extern long flush_count_cache;
++extern long kvm_flush_link_stack;
+
+ #endif /* _ASM_POWERPC_ASM_PROTOTYPES_H */
+diff --git a/arch/powerpc/include/asm/security_features.h b/arch/powerpc/include/asm/security_features.h
+index 759597bf0fd8..ccf44c135389 100644
+--- a/arch/powerpc/include/asm/security_features.h
++++ b/arch/powerpc/include/asm/security_features.h
+@@ -81,6 +81,9 @@ static inline bool security_ftr_enabled(unsigned long feature)
+ // Software required to flush count cache on context switch
+ #define SEC_FTR_FLUSH_COUNT_CACHE 0x0000000000000400ull
+
++// Software required to flush link stack on context switch
++#define SEC_FTR_FLUSH_LINK_STACK 0x0000000000001000ull
++
+
+ // Features enabled by default
+ #define SEC_FTR_DEFAULT \
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 110eba400de7..af1f3d5f9a0f 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -281,6 +281,10 @@ static void eeh_pe_report_edev(struct eeh_dev *edev, eeh_report_fn fn,
+ struct pci_driver *driver;
+ enum pci_ers_result new_result;
+
++ if (!edev->pdev) {
++ eeh_edev_info(edev, "no device");
++ return;
++ }
+ device_lock(&edev->pdev->dev);
+ if (eeh_edev_actionable(edev)) {
+ driver = eeh_pcid_get(edev->pdev);
+diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c
+index 1b238ecc553e..210d239a9395 100644
+--- a/arch/powerpc/kernel/eeh_pe.c
++++ b/arch/powerpc/kernel/eeh_pe.c
+@@ -379,7 +379,7 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
+ while (parent) {
+ if (!(parent->type & EEH_PE_INVALID))
+ break;
+- parent->type &= ~(EEH_PE_INVALID | EEH_PE_KEEP);
++ parent->type &= ~EEH_PE_INVALID;
+ parent = parent->parent;
+ }
+
+diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
+index 7a46e0e57a36..58b50967b3e5 100644
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -533,6 +533,7 @@ flush_count_cache:
+ /* Save LR into r9 */
+ mflr r9
+
++ // Flush the link stack
+ .rept 64
+ bl .+4
+ .endr
+@@ -542,6 +543,11 @@ flush_count_cache:
+ .balign 32
+ /* Restore LR */
+ 1: mtlr r9
++
++ // If we're just flushing the link stack, return here
++3: nop
++ patch_site 3b patch__flush_link_stack_return
++
+ li r9,0x7fff
+ mtctr r9
+
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 909c9407e392..02b69a68139c 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -575,12 +575,11 @@ void flush_all_to_thread(struct task_struct *tsk)
+ if (tsk->thread.regs) {
+ preempt_disable();
+ BUG_ON(tsk != current);
+- save_all(tsk);
+-
+ #ifdef CONFIG_SPE
+ if (tsk->thread.regs->msr & MSR_SPE)
+ tsk->thread.spefscr = mfspr(SPRN_SPEFSCR);
+ #endif
++ save_all(tsk);
+
+ preempt_enable();
+ }
+diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
+index 70568ccbd9fd..a5c5940d970a 100644
+--- a/arch/powerpc/kernel/security.c
++++ b/arch/powerpc/kernel/security.c
+@@ -24,11 +24,12 @@ enum count_cache_flush_type {
+ COUNT_CACHE_FLUSH_HW = 0x4,
+ };
+ static enum count_cache_flush_type count_cache_flush_type = COUNT_CACHE_FLUSH_NONE;
++static bool link_stack_flush_enabled;
+
+ bool barrier_nospec_enabled;
+ static bool no_nospec;
+ static bool btb_flush_enabled;
+-#ifdef CONFIG_PPC_FSL_BOOK3E
++#if defined(CONFIG_PPC_FSL_BOOK3E) || defined(CONFIG_PPC_BOOK3S_64)
+ static bool no_spectrev2;
+ #endif
+
+@@ -106,7 +107,7 @@ static __init int barrier_nospec_debugfs_init(void)
+ device_initcall(barrier_nospec_debugfs_init);
+ #endif /* CONFIG_DEBUG_FS */
+
+-#ifdef CONFIG_PPC_FSL_BOOK3E
++#if defined(CONFIG_PPC_FSL_BOOK3E) || defined(CONFIG_PPC_BOOK3S_64)
+ static int __init handle_nospectre_v2(char *p)
+ {
+ no_spectrev2 = true;
+@@ -114,6 +115,9 @@ static int __init handle_nospectre_v2(char *p)
+ return 0;
+ }
+ early_param("nospectre_v2", handle_nospectre_v2);
++#endif /* CONFIG_PPC_FSL_BOOK3E || CONFIG_PPC_BOOK3S_64 */
++
++#ifdef CONFIG_PPC_FSL_BOOK3E
+ void setup_spectre_v2(void)
+ {
+ if (no_spectrev2 || cpu_mitigations_off())
+@@ -201,11 +205,19 @@ ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, c
+
+ if (ccd)
+ seq_buf_printf(&s, "Indirect branch cache disabled");
++
++ if (link_stack_flush_enabled)
++ seq_buf_printf(&s, ", Software link stack flush");
++
+ } else if (count_cache_flush_type != COUNT_CACHE_FLUSH_NONE) {
+ seq_buf_printf(&s, "Mitigation: Software count cache flush");
+
+ if (count_cache_flush_type == COUNT_CACHE_FLUSH_HW)
+ seq_buf_printf(&s, " (hardware accelerated)");
++
++ if (link_stack_flush_enabled)
++ seq_buf_printf(&s, ", Software link stack flush");
++
+ } else if (btb_flush_enabled) {
+ seq_buf_printf(&s, "Mitigation: Branch predictor state flush");
+ } else {
+@@ -366,18 +378,49 @@ static __init int stf_barrier_debugfs_init(void)
+ device_initcall(stf_barrier_debugfs_init);
+ #endif /* CONFIG_DEBUG_FS */
+
++static void no_count_cache_flush(void)
++{
++ count_cache_flush_type = COUNT_CACHE_FLUSH_NONE;
++ pr_info("count-cache-flush: software flush disabled.\n");
++}
++
+ static void toggle_count_cache_flush(bool enable)
+ {
+- if (!enable || !security_ftr_enabled(SEC_FTR_FLUSH_COUNT_CACHE)) {
++ if (!security_ftr_enabled(SEC_FTR_FLUSH_COUNT_CACHE) &&
++ !security_ftr_enabled(SEC_FTR_FLUSH_LINK_STACK))
++ enable = false;
++
++ if (!enable) {
+ patch_instruction_site(&patch__call_flush_count_cache, PPC_INST_NOP);
+- count_cache_flush_type = COUNT_CACHE_FLUSH_NONE;
+- pr_info("count-cache-flush: software flush disabled.\n");
++#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
++ patch_instruction_site(&patch__call_kvm_flush_link_stack, PPC_INST_NOP);
++#endif
++ pr_info("link-stack-flush: software flush disabled.\n");
++ link_stack_flush_enabled = false;
++ no_count_cache_flush();
+ return;
+ }
+
++ // This enables the branch from _switch to flush_count_cache
+ patch_branch_site(&patch__call_flush_count_cache,
+ (u64)&flush_count_cache, BRANCH_SET_LINK);
+
++#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
++ // This enables the branch from guest_exit_cont to kvm_flush_link_stack
++ patch_branch_site(&patch__call_kvm_flush_link_stack,
++ (u64)&kvm_flush_link_stack, BRANCH_SET_LINK);
++#endif
++
++ pr_info("link-stack-flush: software flush enabled.\n");
++ link_stack_flush_enabled = true;
++
++ // If we just need to flush the link stack, patch an early return
++ if (!security_ftr_enabled(SEC_FTR_FLUSH_COUNT_CACHE)) {
++ patch_instruction_site(&patch__flush_link_stack_return, PPC_INST_BLR);
++ no_count_cache_flush();
++ return;
++ }
++
+ if (!security_ftr_enabled(SEC_FTR_BCCTR_FLUSH_ASSIST)) {
+ count_cache_flush_type = COUNT_CACHE_FLUSH_SW;
+ pr_info("count-cache-flush: full software flush sequence enabled.\n");
+@@ -391,7 +434,26 @@ static void toggle_count_cache_flush(bool enable)
+
+ void setup_count_cache_flush(void)
+ {
+- toggle_count_cache_flush(true);
++ bool enable = true;
++
++ if (no_spectrev2 || cpu_mitigations_off()) {
++ if (security_ftr_enabled(SEC_FTR_BCCTRL_SERIALISED) ||
++ security_ftr_enabled(SEC_FTR_COUNT_CACHE_DISABLED))
++ pr_warn("Spectre v2 mitigations not fully under software control, can't disable\n");
++
++ enable = false;
++ }
++
++ /*
++ * There's no firmware feature flag/hypervisor bit to tell us we need to
++ * flush the link stack on context switch. So we set it here if we see
++ * either of the Spectre v2 mitigations that aim to protect userspace.
++ */
++ if (security_ftr_enabled(SEC_FTR_COUNT_CACHE_DISABLED) ||
++ security_ftr_enabled(SEC_FTR_FLUSH_COUNT_CACHE))
++ security_ftr_set(SEC_FTR_FLUSH_LINK_STACK);
++
++ toggle_count_cache_flush(enable);
+ }
+
+ #ifdef CONFIG_DEBUG_FS
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index f1878e13dd56..7fe3077a1ef6 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -18,6 +18,7 @@
+ */
+
+ #include <asm/ppc_asm.h>
++#include <asm/code-patching-asm.h>
+ #include <asm/kvm_asm.h>
+ #include <asm/reg.h>
+ #include <asm/mmu.h>
+@@ -1559,6 +1560,10 @@ mc_cont:
+ 1:
+ #endif /* CONFIG_KVM_XICS */
+
++ /* Possibly flush the link stack here. */
++1: nop
++ patch_site 1b patch__call_kvm_flush_link_stack
++
+ /* For hash guest, read the guest SLB and save it away */
+ ld r5, VCPU_KVM(r9)
+ lbz r0, KVM_RADIX(r5)
+@@ -2107,6 +2112,29 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+ mtlr r0
+ blr
+
++.balign 32
++.global kvm_flush_link_stack
++kvm_flush_link_stack:
++ /* Save LR into r0 */
++ mflr r0
++
++ /* Flush the link stack. On Power8 it's up to 32 entries in size. */
++ .rept 32
++ bl .+4
++ .endr
++
++ /* And on Power9 it's up to 64. */
++BEGIN_FTR_SECTION
++ .rept 32
++ bl .+4
++ .endr
++END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
++
++ /* Restore LR */
++ mtlr r0
++ blr
++
++
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ /*
+ * Softpatch interrupt for transactional memory emulation cases
+diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
+index 3ea4c1f107d7..69caeb5bccb2 100644
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -294,15 +294,15 @@ retry:
+ }
+
+ if (split_text_mapping && (mapping_size == PUD_SIZE) &&
+- (addr <= __pa_symbol(__init_begin)) &&
+- (addr + mapping_size) >= __pa_symbol(_stext)) {
++ (addr < __pa_symbol(__init_begin)) &&
++ (addr + mapping_size) > __pa_symbol(__init_begin)) {
+ max_mapping_size = PMD_SIZE;
+ goto retry;
+ }
+
+ if (split_text_mapping && (mapping_size == PMD_SIZE) &&
+- (addr <= __pa_symbol(__init_begin)) &&
+- (addr + mapping_size) >= __pa_symbol(_stext)) {
++ (addr < __pa_symbol(__init_begin)) &&
++ (addr + mapping_size) > __pa_symbol(__init_begin)) {
+ mapping_size = PAGE_SIZE;
+ psize = mmu_virtual_psize;
+ }
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 796ff5de26d0..1749f15fc070 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -1072,7 +1072,6 @@ void radix__flush_tlb_collapsed_pmd(struct mm_struct *mm, unsigned long addr)
+ goto local;
+ }
+ _tlbie_va_range(addr, end, pid, PAGE_SIZE, mmu_virtual_psize, true);
+- goto local;
+ } else {
+ local:
+ _tlbiel_va_range(addr, end, pid, PAGE_SIZE, mmu_virtual_psize, true);
+diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c
+index 232bf5987f91..dd3cc4632b9a 100644
+--- a/arch/powerpc/platforms/powernv/memtrace.c
++++ b/arch/powerpc/platforms/powernv/memtrace.c
+@@ -244,9 +244,11 @@ static int memtrace_online(void)
+ * we need to online the memory ourselves.
+ */
+ if (!memhp_auto_online) {
++ lock_device_hotplug();
+ walk_memory_range(PFN_DOWN(ent->start),
+ PFN_UP(ent->start + ent->size - 1),
+ NULL, online_mem_block);
++ unlock_device_hotplug();
+ }
+
+ /*
+diff --git a/arch/powerpc/platforms/ps3/os-area.c b/arch/powerpc/platforms/ps3/os-area.c
+index cdbfc5cfd6f3..f5387ad82279 100644
+--- a/arch/powerpc/platforms/ps3/os-area.c
++++ b/arch/powerpc/platforms/ps3/os-area.c
+@@ -664,7 +664,7 @@ static int update_flash_db(void)
+ db_set_64(db, &os_area_db_id_rtc_diff, saved_params.rtc_diff);
+
+ count = os_area_flash_write(db, sizeof(struct os_area_db), pos);
+- if (count < sizeof(struct os_area_db)) {
++ if (count < 0 || count < sizeof(struct os_area_db)) {
+ pr_debug("%s: os_area_flash_write failed %zd\n", __func__,
+ count);
+ error = count < 0 ? count : -EIO;
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index 2f166136bb50..d93ff494e778 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -676,7 +676,7 @@ static int dlpar_add_lmb(struct drmem_lmb *lmb)
+ nid = memory_add_physaddr_to_nid(lmb->base_addr);
+
+ /* Add the memory */
+- rc = add_memory(nid, lmb->base_addr, block_sz);
++ rc = __add_memory(nid, lmb->base_addr, block_sz);
+ if (rc) {
+ invalidate_lmb_associativity_index(lmb);
+ return rc;
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index ea602f7f97ce..49e3a88b6a0c 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -48,6 +48,7 @@
+ #include <asm/kexec.h>
+ #include <asm/fadump.h>
+ #include <asm/asm-prototypes.h>
++#include <asm/debugfs.h>
+
+ #include "pseries.h"
+
+@@ -1032,3 +1033,56 @@ static int __init reserve_vrma_context_id(void)
+ return 0;
+ }
+ machine_device_initcall(pseries, reserve_vrma_context_id);
++
++#ifdef CONFIG_DEBUG_FS
++/* debugfs file interface for vpa data */
++static ssize_t vpa_file_read(struct file *filp, char __user *buf, size_t len,
++ loff_t *pos)
++{
++ int cpu = (long)filp->private_data;
++ struct lppaca *lppaca = &lppaca_of(cpu);
++
++ return simple_read_from_buffer(buf, len, pos, lppaca,
++ sizeof(struct lppaca));
++}
++
++static const struct file_operations vpa_fops = {
++ .open = simple_open,
++ .read = vpa_file_read,
++ .llseek = default_llseek,
++};
++
++static int __init vpa_debugfs_init(void)
++{
++ char name[16];
++ long i;
++ static struct dentry *vpa_dir;
++
++ if (!firmware_has_feature(FW_FEATURE_SPLPAR))
++ return 0;
++
++ vpa_dir = debugfs_create_dir("vpa", powerpc_debugfs_root);
++ if (!vpa_dir) {
++ pr_warn("%s: can't create vpa root dir\n", __func__);
++ return -ENOMEM;
++ }
++
++ /* set up the per-cpu vpa file*/
++ for_each_possible_cpu(i) {
++ struct dentry *d;
++
++ sprintf(name, "cpu-%ld", i);
++
++ d = debugfs_create_file(name, 0400, vpa_dir, (void *)i,
++ &vpa_fops);
++ if (!d) {
++ pr_warn("%s: can't create per-cpu vpa file\n",
++ __func__);
++ return -ENOMEM;
++ }
++ }
++
++ return 0;
++}
++machine_arch_initcall(pseries, vpa_debugfs_init);
++#endif /* CONFIG_DEBUG_FS */
+diff --git a/arch/powerpc/xmon/Makefile b/arch/powerpc/xmon/Makefile
+index 9d7d8e6d705c..9ba44e190e5e 100644
+--- a/arch/powerpc/xmon/Makefile
++++ b/arch/powerpc/xmon/Makefile
+@@ -13,6 +13,12 @@ UBSAN_SANITIZE := n
+ ORIG_CFLAGS := $(KBUILD_CFLAGS)
+ KBUILD_CFLAGS = $(subst $(CC_FLAGS_FTRACE),,$(ORIG_CFLAGS))
+
++ifdef CONFIG_CC_IS_CLANG
++# clang stores addresses on the stack causing the frame size to blow
++# out. See https://github.com/ClangBuiltLinux/linux/issues/252
++KBUILD_CFLAGS += -Wframe-larger-than=4096
++endif
++
+ ccflags-$(CONFIG_PPC64) := $(NO_MINIMAL_TOC)
+
+ obj-y += xmon.o nonstdio.o spr_access.o
+diff --git a/arch/riscv/mm/ioremap.c b/arch/riscv/mm/ioremap.c
+index 70ef2724cdf6..bd2f2db557cc 100644
+--- a/arch/riscv/mm/ioremap.c
++++ b/arch/riscv/mm/ioremap.c
+@@ -42,7 +42,7 @@ static void __iomem *__ioremap_caller(phys_addr_t addr, size_t size,
+
+ /* Page-align mappings */
+ offset = addr & (~PAGE_MASK);
+- addr &= PAGE_MASK;
++ addr -= offset;
+ size = PAGE_ALIGN(size + offset);
+
+ area = get_vm_area_caller(size, VM_IOREMAP, caller);
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index 44404836e9d1..df92c2af99b6 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -2045,14 +2045,17 @@ static int __init init_cpum_sampling_pmu(void)
+ }
+
+ sfdbg = debug_register(KMSG_COMPONENT, 2, 1, 80);
+- if (!sfdbg)
++ if (!sfdbg) {
+ pr_err("Registering for s390dbf failed\n");
++ return -ENOMEM;
++ }
+ debug_register_view(sfdbg, &debug_sprintf_view);
+
+ err = register_external_irq(EXT_IRQ_MEASURE_ALERT,
+ cpumf_measurement_alert);
+ if (err) {
+ pr_cpumsf_err(RS_INIT_FAILURE_ALRT);
++ debug_unregister(sfdbg);
+ goto out;
+ }
+
+@@ -2061,6 +2064,7 @@ static int __init init_cpum_sampling_pmu(void)
+ pr_cpumsf_err(RS_INIT_FAILURE_PERF);
+ unregister_external_irq(EXT_IRQ_MEASURE_ALERT,
+ cpumf_measurement_alert);
++ debug_unregister(sfdbg);
+ goto out;
+ }
+
+diff --git a/arch/sparc/include/asm/cmpxchg_64.h b/arch/sparc/include/asm/cmpxchg_64.h
+index f71ef3729888..316faa0130ba 100644
+--- a/arch/sparc/include/asm/cmpxchg_64.h
++++ b/arch/sparc/include/asm/cmpxchg_64.h
+@@ -52,7 +52,12 @@ static inline unsigned long xchg64(__volatile__ unsigned long *m, unsigned long
+ return val;
+ }
+
+-#define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
++#define xchg(ptr,x) \
++({ __typeof__(*(ptr)) __ret; \
++ __ret = (__typeof__(*(ptr))) \
++ __xchg((unsigned long)(x), (ptr), sizeof(*(ptr))); \
++ __ret; \
++})
+
+ void __xchg_called_with_bad_pointer(void);
+
+diff --git a/arch/sparc/include/asm/parport.h b/arch/sparc/include/asm/parport.h
+index 05df5f043053..3c5a1c620f0f 100644
+--- a/arch/sparc/include/asm/parport.h
++++ b/arch/sparc/include/asm/parport.h
+@@ -21,6 +21,7 @@
+ */
+ #define HAS_DMA
+
++#ifdef CONFIG_PARPORT_PC_FIFO
+ static DEFINE_SPINLOCK(dma_spin_lock);
+
+ #define claim_dma_lock() \
+@@ -31,6 +32,7 @@ static DEFINE_SPINLOCK(dma_spin_lock);
+
+ #define release_dma_lock(__flags) \
+ spin_unlock_irqrestore(&dma_spin_lock, __flags);
++#endif
+
+ static struct sparc_ebus_info {
+ struct ebus_dma_info info;
+diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
+index 8d80b27502e6..7e524efed584 100644
+--- a/arch/um/drivers/line.c
++++ b/arch/um/drivers/line.c
+@@ -261,7 +261,7 @@ static irqreturn_t line_write_interrupt(int irq, void *data)
+ if (err == 0) {
+ spin_unlock(&line->lock);
+ return IRQ_NONE;
+- } else if (err < 0) {
++ } else if ((err < 0) && (err != -EAGAIN)) {
+ line->head = line->buffer;
+ line->tail = line->buffer;
+ }
+@@ -284,7 +284,7 @@ int line_setup_irq(int fd, int input, int output, struct line *line, void *data)
+ if (err)
+ return err;
+ if (output)
+- err = um_request_irq(driver->write_irq, fd, IRQ_NONE,
++ err = um_request_irq(driver->write_irq, fd, IRQ_WRITE,
+ line_write_interrupt, IRQF_SHARED,
+ driver->write_irq_name, data);
+ return err;
+diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
+index 6de1fd3d0097..ee696efec99f 100644
+--- a/arch/x86/include/asm/ptrace.h
++++ b/arch/x86/include/asm/ptrace.h
+@@ -236,24 +236,52 @@ static inline int regs_within_kernel_stack(struct pt_regs *regs,
+ (kernel_stack_pointer(regs) & ~(THREAD_SIZE - 1)));
+ }
+
++/**
++ * regs_get_kernel_stack_nth_addr() - get the address of the Nth entry on stack
++ * @regs: pt_regs which contains kernel stack pointer.
++ * @n: stack entry number.
++ *
++ * regs_get_kernel_stack_nth() returns the address of the @n th entry of the
++ * kernel stack which is specified by @regs. If the @n th entry is NOT in
++ * the kernel stack, this returns NULL.
++ */
++static inline unsigned long *regs_get_kernel_stack_nth_addr(struct pt_regs *regs, unsigned int n)
++{
++ unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs);
++
++ addr += n;
++ if (regs_within_kernel_stack(regs, (unsigned long)addr))
++ return addr;
++ else
++ return NULL;
++}
++
++/* To avoid include hell, we can't include uaccess.h */
++extern long probe_kernel_read(void *dst, const void *src, size_t size);
++
+ /**
+ * regs_get_kernel_stack_nth() - get Nth entry of the stack
+ * @regs: pt_regs which contains kernel stack pointer.
+ * @n: stack entry number.
+ *
+ * regs_get_kernel_stack_nth() returns @n th entry of the kernel stack which
+- * is specified by @regs. If the @n th entry is NOT in the kernel stack,
++ * is specified by @regs. If the @n th entry is NOT in the kernel stack
+ * this returns 0.
+ */
+ static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs,
+ unsigned int n)
+ {
+- unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs);
+- addr += n;
+- if (regs_within_kernel_stack(regs, (unsigned long)addr))
+- return *addr;
+- else
+- return 0;
++ unsigned long *addr;
++ unsigned long val;
++ long ret;
++
++ addr = regs_get_kernel_stack_nth_addr(regs, n);
++ if (addr) {
++ ret = probe_kernel_read(&val, addr, sizeof(val));
++ if (!ret)
++ return val;
++ }
++ return 0;
+ }
+
+ #define arch_has_single_step() (1)
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 4684ad7ba793..2d23a448e72d 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -39,6 +39,7 @@ static void __init spectre_v2_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
+ static void __init mds_select_mitigation(void);
++static void __init mds_print_mitigation(void);
+ static void __init taa_select_mitigation(void);
+
+ /* The base value of the SPEC_CTRL MSR that always has to be preserved. */
+@@ -108,6 +109,12 @@ void __init check_bugs(void)
+ mds_select_mitigation();
+ taa_select_mitigation();
+
++ /*
++ * As MDS and TAA mitigations are inter-related, print MDS
++ * mitigation until after TAA mitigation selection is done.
++ */
++ mds_print_mitigation();
++
+ arch_smt_update();
+
+ #ifdef CONFIG_X86_32
+@@ -245,6 +252,12 @@ static void __init mds_select_mitigation(void)
+ (mds_nosmt || cpu_mitigations_auto_nosmt()))
+ cpu_smt_disable(false);
+ }
++}
++
++static void __init mds_print_mitigation(void)
++{
++ if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off())
++ return;
+
+ pr_info("%s\n", mds_strings[mds_mitigation]);
+ }
+@@ -304,8 +317,12 @@ static void __init taa_select_mitigation(void)
+ return;
+ }
+
+- /* TAA mitigation is turned off on the cmdline (tsx_async_abort=off) */
+- if (taa_mitigation == TAA_MITIGATION_OFF)
++ /*
++ * TAA mitigation via VERW is turned off if both
++ * tsx_async_abort=off and mds=off are specified.
++ */
++ if (taa_mitigation == TAA_MITIGATION_OFF &&
++ mds_mitigation == MDS_MITIGATION_OFF)
+ goto out;
+
+ if (boot_cpu_has(X86_FEATURE_MD_CLEAR))
+@@ -339,6 +356,15 @@ static void __init taa_select_mitigation(void)
+ if (taa_nosmt || cpu_mitigations_auto_nosmt())
+ cpu_smt_disable(false);
+
++ /*
++ * Update MDS mitigation, if necessary, as the mds_user_clear is
++ * now enabled for TAA mitigation.
++ */
++ if (mds_mitigation == MDS_MITIGATION_OFF &&
++ boot_cpu_has_bug(X86_BUG_MDS)) {
++ mds_mitigation = MDS_MITIGATION_FULL;
++ mds_select_mitigation();
++ }
+ out:
+ pr_info("%s\n", taa_strings[taa_mitigation]);
+ }
+diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
+index cc43c5abd187..b99a04da70f6 100644
+--- a/arch/x86/kernel/cpu/intel_rdt.c
++++ b/arch/x86/kernel/cpu/intel_rdt.c
+@@ -610,6 +610,13 @@ static void domain_remove_cpu(int cpu, struct rdt_resource *r)
+ cancel_delayed_work(&d->cqm_limbo);
+ }
+
++ /*
++ * rdt_domain "d" is going to be freed below, so clear
++ * its pointer from pseudo_lock_region struct.
++ */
++ if (d->plr)
++ d->plr->d = NULL;
++
+ kfree(d->ctrl_val);
+ kfree(d->mbps_val);
+ kfree(d->rmid_busy_llc);
+diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+index 968ace3c6d73..c8b72aff55e0 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
++++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+@@ -408,8 +408,16 @@ int rdtgroup_schemata_show(struct kernfs_open_file *of,
+ for_each_alloc_enabled_rdt_resource(r)
+ seq_printf(s, "%s:uninitialized\n", r->name);
+ } else if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) {
+- seq_printf(s, "%s:%d=%x\n", rdtgrp->plr->r->name,
+- rdtgrp->plr->d->id, rdtgrp->plr->cbm);
++ if (!rdtgrp->plr->d) {
++ rdt_last_cmd_clear();
++ rdt_last_cmd_puts("Cache domain offline\n");
++ ret = -ENODEV;
++ } else {
++ seq_printf(s, "%s:%d=%x\n",
++ rdtgrp->plr->r->name,
++ rdtgrp->plr->d->id,
++ rdtgrp->plr->cbm);
++ }
+ } else {
+ closid = rdtgrp->closid;
+ for_each_alloc_enabled_rdt_resource(r) {
+diff --git a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
+index 912d53939f4f..a999a58ca331 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
++++ b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c
+@@ -1116,6 +1116,11 @@ static int pseudo_lock_measure_cycles(struct rdtgroup *rdtgrp, int sel)
+ goto out;
+ }
+
++ if (!plr->d) {
++ ret = -ENODEV;
++ goto out;
++ }
++
+ plr->thread_done = 0;
+ cpu = cpumask_first(&plr->d->cpu_mask);
+ if (!cpu_online(cpu)) {
+@@ -1429,6 +1434,11 @@ static int pseudo_lock_dev_mmap(struct file *filp, struct vm_area_struct *vma)
+
+ plr = rdtgrp->plr;
+
++ if (!plr->d) {
++ mutex_unlock(&rdtgroup_mutex);
++ return -ENODEV;
++ }
++
+ /*
+ * Task is required to run with affinity to the cpus associated
+ * with the pseudo-locked region. If this is not the case the task
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index ad64031e82dc..a2d7e6646cce 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -268,17 +268,27 @@ static int rdtgroup_cpus_show(struct kernfs_open_file *of,
+ struct seq_file *s, void *v)
+ {
+ struct rdtgroup *rdtgrp;
++ struct cpumask *mask;
+ int ret = 0;
+
+ rdtgrp = rdtgroup_kn_lock_live(of->kn);
+
+ if (rdtgrp) {
+- if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED)
+- seq_printf(s, is_cpu_list(of) ? "%*pbl\n" : "%*pb\n",
+- cpumask_pr_args(&rdtgrp->plr->d->cpu_mask));
+- else
++ if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) {
++ if (!rdtgrp->plr->d) {
++ rdt_last_cmd_clear();
++ rdt_last_cmd_puts("Cache domain offline\n");
++ ret = -ENODEV;
++ } else {
++ mask = &rdtgrp->plr->d->cpu_mask;
++ seq_printf(s, is_cpu_list(of) ?
++ "%*pbl\n" : "%*pb\n",
++ cpumask_pr_args(mask));
++ }
++ } else {
+ seq_printf(s, is_cpu_list(of) ? "%*pbl\n" : "%*pb\n",
+ cpumask_pr_args(&rdtgrp->cpu_mask));
++ }
+ } else {
+ ret = -ENOENT;
+ }
+@@ -1286,6 +1296,7 @@ static int rdtgroup_size_show(struct kernfs_open_file *of,
+ struct rdt_resource *r;
+ struct rdt_domain *d;
+ unsigned int size;
++ int ret = 0;
+ bool sep;
+ u32 ctrl;
+
+@@ -1296,11 +1307,18 @@ static int rdtgroup_size_show(struct kernfs_open_file *of,
+ }
+
+ if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) {
+- seq_printf(s, "%*s:", max_name_width, rdtgrp->plr->r->name);
+- size = rdtgroup_cbm_to_size(rdtgrp->plr->r,
+- rdtgrp->plr->d,
+- rdtgrp->plr->cbm);
+- seq_printf(s, "%d=%u\n", rdtgrp->plr->d->id, size);
++ if (!rdtgrp->plr->d) {
++ rdt_last_cmd_clear();
++ rdt_last_cmd_puts("Cache domain offline\n");
++ ret = -ENODEV;
++ } else {
++ seq_printf(s, "%*s:", max_name_width,
++ rdtgrp->plr->r->name);
++ size = rdtgroup_cbm_to_size(rdtgrp->plr->r,
++ rdtgrp->plr->d,
++ rdtgrp->plr->cbm);
++ seq_printf(s, "%d=%u\n", rdtgrp->plr->d->id, size);
++ }
+ goto out;
+ }
+
+@@ -1330,7 +1348,7 @@ static int rdtgroup_size_show(struct kernfs_open_file *of,
+ out:
+ rdtgroup_kn_unlock(of->kn);
+
+- return 0;
++ return ret;
+ }
+
+ /* rdtgroup information files for one cache resource. */
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index d7db7608de5f..eddf91a0e363 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -3261,7 +3261,7 @@ static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
+ * here.
+ */
+ if (!is_error_noslot_pfn(pfn) && !kvm_is_reserved_pfn(pfn) &&
+- level == PT_PAGE_TABLE_LEVEL &&
++ !kvm_is_zone_device_pfn(pfn) && level == PT_PAGE_TABLE_LEVEL &&
+ PageTransCompoundMap(pfn_to_page(pfn)) &&
+ !mmu_gfn_lpage_is_disallowed(vcpu, gfn, PT_DIRECTORY_LEVEL)) {
+ unsigned long mask;
+@@ -5709,9 +5709,9 @@ restart:
+ * the guest, and the guest page table is using 4K page size
+ * mapping if the indirect sp has level = 1.
+ */
+- if (sp->role.direct &&
+- !kvm_is_reserved_pfn(pfn) &&
+- PageTransCompoundMap(pfn_to_page(pfn))) {
++ if (sp->role.direct && !kvm_is_reserved_pfn(pfn) &&
++ !kvm_is_zone_device_pfn(pfn) &&
++ PageTransCompoundMap(pfn_to_page(pfn))) {
+ drop_spte(kvm, sptep);
+ need_tlb_flush = 1;
+ goto restart;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 1ab4bb3d6a04..0b7559bf15ea 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2079,7 +2079,7 @@ static int __find_msr_index(struct vcpu_vmx *vmx, u32 msr)
+ return -1;
+ }
+
+-static inline void __invvpid(int ext, u16 vpid, gva_t gva)
++static inline void __invvpid(unsigned long ext, u16 vpid, gva_t gva)
+ {
+ struct {
+ u64 vpid : 16;
+@@ -2094,7 +2094,7 @@ static inline void __invvpid(int ext, u16 vpid, gva_t gva)
+ BUG_ON(error);
+ }
+
+-static inline void __invept(int ext, u64 eptp, gpa_t gpa)
++static inline void __invept(unsigned long ext, u64 eptp, gpa_t gpa)
+ {
+ struct {
+ u64 eptp, gpa;
+@@ -11013,6 +11013,10 @@ static void vmx_switch_vmcs(struct kvm_vcpu *vcpu, struct loaded_vmcs *vmcs)
+ vmx->loaded_vmcs = vmcs;
+ vmx_vcpu_load(vcpu, cpu);
+ put_cpu();
++
++ vm_entry_controls_reset_shadow(vmx);
++ vm_exit_controls_reset_shadow(vmx);
++ vmx_segment_cache_clear(vmx);
+ }
+
+ /*
+@@ -12690,6 +12694,9 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, u32 *exit_qual)
+ if (likely(!evaluate_pending_interrupts) && kvm_vcpu_apicv_active(vcpu))
+ evaluate_pending_interrupts |= vmx_has_apicv_interrupt(vcpu);
+
++ if (from_vmentry && check_vmentry_postreqs(vcpu, vmcs12, exit_qual))
++ return EXIT_REASON_INVALID_STATE;
++
+ enter_guest_mode(vcpu);
+
+ if (!(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS))
+@@ -12699,7 +12706,6 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, u32 *exit_qual)
+ vmx->nested.vmcs01_guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS);
+
+ vmx_switch_vmcs(vcpu, &vmx->nested.vmcs02);
+- vmx_segment_cache_clear(vmx);
+
+ if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
+ vcpu->arch.tsc_offset += vmcs12->tsc_offset;
+@@ -12833,13 +12839,6 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
+ */
+ skip_emulated_instruction(vcpu);
+
+- ret = check_vmentry_postreqs(vcpu, vmcs12, &exit_qual);
+- if (ret) {
+- nested_vmx_entry_failure(vcpu, vmcs12,
+- EXIT_REASON_INVALID_STATE, exit_qual);
+- return 1;
+- }
+-
+ /*
+ * We're finally done with prerequisite checking, and can start with
+ * the nested entry.
+@@ -13530,9 +13529,6 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+ }
+
+ vmx_switch_vmcs(vcpu, &vmx->vmcs01);
+- vm_entry_controls_reset_shadow(vmx);
+- vm_exit_controls_reset_shadow(vmx);
+- vmx_segment_cache_clear(vmx);
+
+ /* Update any VMCS fields that might have changed while L2 ran */
+ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr);
+diff --git a/arch/x86/tools/gen-insn-attr-x86.awk b/arch/x86/tools/gen-insn-attr-x86.awk
+index b02a36b2c14f..a42015b305f4 100644
+--- a/arch/x86/tools/gen-insn-attr-x86.awk
++++ b/arch/x86/tools/gen-insn-attr-x86.awk
+@@ -69,7 +69,7 @@ BEGIN {
+
+ lprefix1_expr = "\\((66|!F3)\\)"
+ lprefix2_expr = "\\(F3\\)"
+- lprefix3_expr = "\\((F2|!F3|66\\&F2)\\)"
++ lprefix3_expr = "\\((F2|!F3|66&F2)\\)"
+ lprefix_expr = "\\((66|F2|F3)\\)"
+ max_lprefix = 4
+
+@@ -257,7 +257,7 @@ function convert_operands(count,opnd, i,j,imm,mod)
+ return add_flags(imm, mod)
+ }
+
+-/^[0-9a-f]+\:/ {
++/^[0-9a-f]+:/ {
+ if (NR == 1)
+ next
+ # get index
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 074ae9376189..ea33d6abdcfc 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -784,6 +784,9 @@ void blk_cleanup_queue(struct request_queue *q)
+ * prevent that q->request_fn() gets invoked after draining finished.
+ */
+ blk_freeze_queue(q);
++
++ rq_qos_exit(q);
++
+ spin_lock_irq(lock);
+ queue_flag_set(QUEUE_FLAG_DEAD, q);
+ spin_unlock_irq(lock);
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 2e042190a4f1..1dced51de1c6 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -669,6 +669,31 @@ static void blk_account_io_merge(struct request *req)
+ part_stat_unlock();
+ }
+ }
++/*
++ * Two cases of handling DISCARD merge:
++ * If max_discard_segments > 1, the driver takes every bio
++ * as a range and send them to controller together. The ranges
++ * needn't to be contiguous.
++ * Otherwise, the bios/requests will be handled as same as
++ * others which should be contiguous.
++ */
++static inline bool blk_discard_mergable(struct request *req)
++{
++ if (req_op(req) == REQ_OP_DISCARD &&
++ queue_max_discard_segments(req->q) > 1)
++ return true;
++ return false;
++}
++
++enum elv_merge blk_try_req_merge(struct request *req, struct request *next)
++{
++ if (blk_discard_mergable(req))
++ return ELEVATOR_DISCARD_MERGE;
++ else if (blk_rq_pos(req) + blk_rq_sectors(req) == blk_rq_pos(next))
++ return ELEVATOR_BACK_MERGE;
++
++ return ELEVATOR_NO_MERGE;
++}
+
+ /*
+ * For non-mq, this has to be called with the request spinlock acquired.
+@@ -686,12 +711,6 @@ static struct request *attempt_merge(struct request_queue *q,
+ if (req_op(req) != req_op(next))
+ return NULL;
+
+- /*
+- * not contiguous
+- */
+- if (blk_rq_pos(req) + blk_rq_sectors(req) != blk_rq_pos(next))
+- return NULL;
+-
+ if (rq_data_dir(req) != rq_data_dir(next)
+ || req->rq_disk != next->rq_disk
+ || req_no_special_merge(next))
+@@ -715,11 +734,19 @@ static struct request *attempt_merge(struct request_queue *q,
+ * counts here. Handle DISCARDs separately, as they
+ * have separate settings.
+ */
+- if (req_op(req) == REQ_OP_DISCARD) {
++
++ switch (blk_try_req_merge(req, next)) {
++ case ELEVATOR_DISCARD_MERGE:
+ if (!req_attempt_discard_merge(q, req, next))
+ return NULL;
+- } else if (!ll_merge_requests_fn(q, req, next))
++ break;
++ case ELEVATOR_BACK_MERGE:
++ if (!ll_merge_requests_fn(q, req, next))
++ return NULL;
++ break;
++ default:
+ return NULL;
++ }
+
+ /*
+ * If failfast settings disagree or any of the two is already
+@@ -843,8 +870,7 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio)
+
+ enum elv_merge blk_try_merge(struct request *rq, struct bio *bio)
+ {
+- if (req_op(rq) == REQ_OP_DISCARD &&
+- queue_max_discard_segments(rq->q) > 1)
++ if (blk_discard_mergable(rq))
+ return ELEVATOR_DISCARD_MERGE;
+ else if (blk_rq_pos(rq) + blk_rq_sectors(rq) == bio->bi_iter.bi_sector)
+ return ELEVATOR_BACK_MERGE;
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index bab47a17b96f..8286640d4d66 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -997,8 +997,6 @@ void blk_unregister_queue(struct gendisk *disk)
+ kobject_del(&q->kobj);
+ blk_trace_remove_sysfs(disk_to_dev(disk));
+
+- rq_qos_exit(q);
+-
+ mutex_lock(&q->sysfs_lock);
+ if (q->request_fn || (q->mq_ops && q->elevator))
+ elv_unregister_queue(q);
+diff --git a/crypto/testmgr.c b/crypto/testmgr.c
+index 3664c26f4838..13cb2ea99d6a 100644
+--- a/crypto/testmgr.c
++++ b/crypto/testmgr.c
+@@ -1400,8 +1400,8 @@ static int test_comp(struct crypto_comp *tfm,
+ int ilen;
+ unsigned int dlen = COMP_BUF_SIZE;
+
+- memset(output, 0, sizeof(COMP_BUF_SIZE));
+- memset(decomp_output, 0, sizeof(COMP_BUF_SIZE));
++ memset(output, 0, COMP_BUF_SIZE);
++ memset(decomp_output, 0, COMP_BUF_SIZE);
+
+ ilen = ctemplate[i].inlen;
+ ret = crypto_comp_compress(tfm, ctemplate[i].input,
+@@ -1445,7 +1445,7 @@ static int test_comp(struct crypto_comp *tfm,
+ int ilen;
+ unsigned int dlen = COMP_BUF_SIZE;
+
+- memset(decomp_output, 0, sizeof(COMP_BUF_SIZE));
++ memset(decomp_output, 0, COMP_BUF_SIZE);
+
+ ilen = dtemplate[i].inlen;
+ ret = crypto_comp_decompress(tfm, dtemplate[i].input,
+diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
+index 6b0d3ef7309c..2ccfbb61ca89 100644
+--- a/drivers/acpi/acpi_memhotplug.c
++++ b/drivers/acpi/acpi_memhotplug.c
+@@ -228,7 +228,7 @@ static int acpi_memory_enable_device(struct acpi_memory_device *mem_device)
+ if (node < 0)
+ node = memory_add_physaddr_to_nid(info->start_addr);
+
+- result = add_memory(node, info->start_addr, info->length);
++ result = __add_memory(node, info->start_addr, info->length);
+
+ /*
+ * If the memory block has been used by the kernel, add_memory()
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index e1b6231cfa1c..1dcc48b9d33c 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -1550,6 +1550,7 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device)
+ */
+ static const struct acpi_device_id i2c_multi_instantiate_ids[] = {
+ {"BSG1160", },
++ {"INT33FE", },
+ {}
+ };
+
+diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
+index e89146ddede6..d5c76b50d357 100644
+--- a/drivers/atm/zatm.c
++++ b/drivers/atm/zatm.c
+@@ -126,7 +126,7 @@ static unsigned long dummy[2] = {0,0};
+ #define zin_n(r) inl(zatm_dev->base+r*4)
+ #define zin(r) inl(zatm_dev->base+uPD98401_##r*4)
+ #define zout(v,r) outl(v,zatm_dev->base+uPD98401_##r*4)
+-#define zwait while (zin(CMR) & uPD98401_BUSY)
++#define zwait() do {} while (zin(CMR) & uPD98401_BUSY)
+
+ /* RX0, RX1, TX0, TX1 */
+ static const int mbx_entries[NR_MBX] = { 1024,1024,1024,1024 };
+@@ -140,7 +140,7 @@ static const int mbx_esize[NR_MBX] = { 16,16,4,4 }; /* entry size in bytes */
+
+ static void zpokel(struct zatm_dev *zatm_dev,u32 value,u32 addr)
+ {
+- zwait;
++ zwait();
+ zout(value,CER);
+ zout(uPD98401_IND_ACC | uPD98401_IA_BALL |
+ (uPD98401_IA_TGT_CM << uPD98401_IA_TGT_SHIFT) | addr,CMR);
+@@ -149,10 +149,10 @@ static void zpokel(struct zatm_dev *zatm_dev,u32 value,u32 addr)
+
+ static u32 zpeekl(struct zatm_dev *zatm_dev,u32 addr)
+ {
+- zwait;
++ zwait();
+ zout(uPD98401_IND_ACC | uPD98401_IA_BALL | uPD98401_IA_RW |
+ (uPD98401_IA_TGT_CM << uPD98401_IA_TGT_SHIFT) | addr,CMR);
+- zwait;
++ zwait();
+ return zin(CER);
+ }
+
+@@ -241,7 +241,7 @@ static void refill_pool(struct atm_dev *dev,int pool)
+ }
+ if (first) {
+ spin_lock_irqsave(&zatm_dev->lock, flags);
+- zwait;
++ zwait();
+ zout(virt_to_bus(first),CER);
+ zout(uPD98401_ADD_BAT | (pool << uPD98401_POOL_SHIFT) | count,
+ CMR);
+@@ -508,9 +508,9 @@ static int open_rx_first(struct atm_vcc *vcc)
+ }
+ if (zatm_vcc->pool < 0) return -EMSGSIZE;
+ spin_lock_irqsave(&zatm_dev->lock, flags);
+- zwait;
++ zwait();
+ zout(uPD98401_OPEN_CHAN,CMR);
+- zwait;
++ zwait();
+ DPRINTK("0x%x 0x%x\n",zin(CMR),zin(CER));
+ chan = (zin(CMR) & uPD98401_CHAN_ADDR) >> uPD98401_CHAN_ADDR_SHIFT;
+ spin_unlock_irqrestore(&zatm_dev->lock, flags);
+@@ -571,21 +571,21 @@ static void close_rx(struct atm_vcc *vcc)
+ pos = vcc->vci >> 1;
+ shift = (1-(vcc->vci & 1)) << 4;
+ zpokel(zatm_dev,zpeekl(zatm_dev,pos) & ~(0xffff << shift),pos);
+- zwait;
++ zwait();
+ zout(uPD98401_NOP,CMR);
+- zwait;
++ zwait();
+ zout(uPD98401_NOP,CMR);
+ spin_unlock_irqrestore(&zatm_dev->lock, flags);
+ }
+ spin_lock_irqsave(&zatm_dev->lock, flags);
+- zwait;
++ zwait();
+ zout(uPD98401_DEACT_CHAN | uPD98401_CHAN_RT | (zatm_vcc->rx_chan <<
+ uPD98401_CHAN_ADDR_SHIFT),CMR);
+- zwait;
++ zwait();
+ udelay(10); /* why oh why ... ? */
+ zout(uPD98401_CLOSE_CHAN | uPD98401_CHAN_RT | (zatm_vcc->rx_chan <<
+ uPD98401_CHAN_ADDR_SHIFT),CMR);
+- zwait;
++ zwait();
+ if (!(zin(CMR) & uPD98401_CHAN_ADDR))
+ printk(KERN_CRIT DEV_LABEL "(itf %d): can't close RX channel "
+ "%d\n",vcc->dev->number,zatm_vcc->rx_chan);
+@@ -699,7 +699,7 @@ printk("NONONONOO!!!!\n");
+ skb_queue_tail(&zatm_vcc->tx_queue,skb);
+ DPRINTK("QRP=0x%08lx\n",zpeekl(zatm_dev,zatm_vcc->tx_chan*VC_SIZE/4+
+ uPD98401_TXVC_QRP));
+- zwait;
++ zwait();
+ zout(uPD98401_TX_READY | (zatm_vcc->tx_chan <<
+ uPD98401_CHAN_ADDR_SHIFT),CMR);
+ spin_unlock_irqrestore(&zatm_dev->lock, flags);
+@@ -891,12 +891,12 @@ static void close_tx(struct atm_vcc *vcc)
+ }
+ spin_lock_irqsave(&zatm_dev->lock, flags);
+ #if 0
+- zwait;
++ zwait();
+ zout(uPD98401_DEACT_CHAN | (chan << uPD98401_CHAN_ADDR_SHIFT),CMR);
+ #endif
+- zwait;
++ zwait();
+ zout(uPD98401_CLOSE_CHAN | (chan << uPD98401_CHAN_ADDR_SHIFT),CMR);
+- zwait;
++ zwait();
+ if (!(zin(CMR) & uPD98401_CHAN_ADDR))
+ printk(KERN_CRIT DEV_LABEL "(itf %d): can't close TX channel "
+ "%d\n",vcc->dev->number,chan);
+@@ -926,9 +926,9 @@ static int open_tx_first(struct atm_vcc *vcc)
+ zatm_vcc->tx_chan = 0;
+ if (vcc->qos.txtp.traffic_class == ATM_NONE) return 0;
+ spin_lock_irqsave(&zatm_dev->lock, flags);
+- zwait;
++ zwait();
+ zout(uPD98401_OPEN_CHAN,CMR);
+- zwait;
++ zwait();
+ DPRINTK("0x%x 0x%x\n",zin(CMR),zin(CER));
+ chan = (zin(CMR) & uPD98401_CHAN_ADDR) >> uPD98401_CHAN_ADDR_SHIFT;
+ spin_unlock_irqrestore(&zatm_dev->lock, flags);
+@@ -1557,7 +1557,7 @@ static void zatm_phy_put(struct atm_dev *dev,unsigned char value,
+ struct zatm_dev *zatm_dev;
+
+ zatm_dev = ZATM_DEV(dev);
+- zwait;
++ zwait();
+ zout(value,CER);
+ zout(uPD98401_IND_ACC | uPD98401_IA_B0 |
+ (uPD98401_IA_TGT_PHY << uPD98401_IA_TGT_SHIFT) | addr,CMR);
+@@ -1569,10 +1569,10 @@ static unsigned char zatm_phy_get(struct atm_dev *dev,unsigned long addr)
+ struct zatm_dev *zatm_dev;
+
+ zatm_dev = ZATM_DEV(dev);
+- zwait;
++ zwait();
+ zout(uPD98401_IND_ACC | uPD98401_IA_B0 | uPD98401_IA_RW |
+ (uPD98401_IA_TGT_PHY << uPD98401_IA_TGT_SHIFT) | addr,CMR);
+- zwait;
++ zwait();
+ return zin(CER) & 0xff;
+ }
+
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index 85ee64d0a44e..ac1574a69610 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -228,7 +228,6 @@ static bool pages_correctly_probed(unsigned long start_pfn)
+ /*
+ * MEMORY_HOTPLUG depends on SPARSEMEM in mm/Kconfig, so it is
+ * OK to have direct references to sparsemem variables in here.
+- * Must already be protected by mem_hotplug_begin().
+ */
+ static int
+ memory_block_action(unsigned long phys_index, unsigned long action, int online_type)
+@@ -294,7 +293,6 @@ static int memory_subsys_online(struct device *dev)
+ if (mem->online_type < 0)
+ mem->online_type = MMOP_ONLINE_KEEP;
+
+- /* Already under protection of mem_hotplug_begin() */
+ ret = memory_block_change_state(mem, MEM_ONLINE, MEM_OFFLINE);
+
+ /* clear online_type */
+@@ -341,19 +339,11 @@ store_mem_state(struct device *dev,
+ goto err;
+ }
+
+- /*
+- * Memory hotplug needs to hold mem_hotplug_begin() for probe to find
+- * the correct memory block to online before doing device_online(dev),
+- * which will take dev->mutex. Take the lock early to prevent an
+- * inversion, memory_subsys_online() callbacks will be implemented by
+- * assuming it's already protected.
+- */
+- mem_hotplug_begin();
+-
+ switch (online_type) {
+ case MMOP_ONLINE_KERNEL:
+ case MMOP_ONLINE_MOVABLE:
+ case MMOP_ONLINE_KEEP:
++ /* mem->online_type is protected by device_hotplug_lock */
+ mem->online_type = online_type;
+ ret = device_online(&mem->dev);
+ break;
+@@ -364,7 +354,6 @@ store_mem_state(struct device *dev,
+ ret = -EINVAL; /* should never happen */
+ }
+
+- mem_hotplug_done();
+ err:
+ unlock_device_hotplug();
+
+@@ -519,15 +508,20 @@ memory_probe_store(struct device *dev, struct device_attribute *attr,
+ if (phys_addr & ((pages_per_block << PAGE_SHIFT) - 1))
+ return -EINVAL;
+
++ ret = lock_device_hotplug_sysfs();
++ if (ret)
++ return ret;
++
+ nid = memory_add_physaddr_to_nid(phys_addr);
+- ret = add_memory(nid, phys_addr,
+- MIN_MEMORY_BLOCK_SIZE * sections_per_block);
++ ret = __add_memory(nid, phys_addr,
++ MIN_MEMORY_BLOCK_SIZE * sections_per_block);
+
+ if (ret)
+ goto out;
+
+ ret = count;
+ out:
++ unlock_device_hotplug();
+ return ret;
+ }
+
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index bf5be0bfaf77..52c292d0908a 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -467,6 +467,10 @@ static int genpd_power_off(struct generic_pm_domain *genpd, bool one_dev_on,
+ return -EAGAIN;
+ }
+
++ /* Default to shallowest state. */
++ if (!genpd->gov)
++ genpd->state_idx = 0;
++
+ if (genpd->power_off) {
+ int ret;
+
+@@ -1686,6 +1690,8 @@ int pm_genpd_init(struct generic_pm_domain *genpd,
+ ret = genpd_set_default_power_state(genpd);
+ if (ret)
+ return ret;
++ } else if (!gov) {
++ pr_warn("%s : no governor for states\n", genpd->name);
+ }
+
+ device_initialize(&genpd->dev);
+diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
+index 3aaf6af3ec23..2158e130744e 100644
+--- a/drivers/block/amiflop.c
++++ b/drivers/block/amiflop.c
+@@ -1701,11 +1701,41 @@ static const struct block_device_operations floppy_fops = {
+ .check_events = amiga_check_events,
+ };
+
++static struct gendisk *fd_alloc_disk(int drive)
++{
++ struct gendisk *disk;
++
++ disk = alloc_disk(1);
++ if (!disk)
++ goto out;
++
++ disk->queue = blk_init_queue(do_fd_request, &amiflop_lock);
++ if (IS_ERR(disk->queue)) {
++ disk->queue = NULL;
++ goto out_put_disk;
++ }
++
++ unit[drive].trackbuf = kmalloc(FLOPPY_MAX_SECTORS * 512, GFP_KERNEL);
++ if (!unit[drive].trackbuf)
++ goto out_cleanup_queue;
++
++ return disk;
++
++out_cleanup_queue:
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++out_put_disk:
++ put_disk(disk);
++out:
++ unit[drive].type->code = FD_NODRIVE;
++ return NULL;
++}
++
+ static int __init fd_probe_drives(void)
+ {
+ int drive,drives,nomem;
+
+- printk(KERN_INFO "FD: probing units\nfound ");
++ pr_info("FD: probing units\nfound");
+ drives=0;
+ nomem=0;
+ for(drive=0;drive<FD_MAX_UNITS;drive++) {
+@@ -1713,27 +1743,17 @@ static int __init fd_probe_drives(void)
+ fd_probe(drive);
+ if (unit[drive].type->code == FD_NODRIVE)
+ continue;
+- disk = alloc_disk(1);
++
++ disk = fd_alloc_disk(drive);
+ if (!disk) {
+- unit[drive].type->code = FD_NODRIVE;
++ pr_cont(" no mem for fd%d", drive);
++ nomem = 1;
+ continue;
+ }
+ unit[drive].gendisk = disk;
+-
+- disk->queue = blk_init_queue(do_fd_request, &amiflop_lock);
+- if (!disk->queue) {
+- unit[drive].type->code = FD_NODRIVE;
+- continue;
+- }
+-
+ drives++;
+- if ((unit[drive].trackbuf = kmalloc(FLOPPY_MAX_SECTORS * 512, GFP_KERNEL)) == NULL) {
+- printk("no mem for ");
+- unit[drive].type = &drive_types[num_dr_types - 1]; /* FD_NODRIVE */
+- drives--;
+- nomem = 1;
+- }
+- printk("fd%d ",drive);
++
++ pr_cont(" fd%d",drive);
+ disk->major = FLOPPY_MAJOR;
+ disk->first_minor = drive;
+ disk->fops = &floppy_fops;
+@@ -1744,11 +1764,11 @@ static int __init fd_probe_drives(void)
+ }
+ if ((drives > 0) || (nomem == 0)) {
+ if (drives == 0)
+- printk("no drives");
+- printk("\n");
++ pr_cont(" no drives");
++ pr_cont("\n");
+ return drives;
+ }
+- printk("\n");
++ pr_cont("\n");
+ return -ENOMEM;
+ }
+
+@@ -1831,30 +1851,6 @@ out_blkdev:
+ return ret;
+ }
+
+-#if 0 /* not safe to unload */
+-static int __exit amiga_floppy_remove(struct platform_device *pdev)
+-{
+- int i;
+-
+- for( i = 0; i < FD_MAX_UNITS; i++) {
+- if (unit[i].type->code != FD_NODRIVE) {
+- struct request_queue *q = unit[i].gendisk->queue;
+- del_gendisk(unit[i].gendisk);
+- put_disk(unit[i].gendisk);
+- kfree(unit[i].trackbuf);
+- if (q)
+- blk_cleanup_queue(q);
+- }
+- }
+- blk_unregister_region(MKDEV(FLOPPY_MAJOR, 0), 256);
+- free_irq(IRQ_AMIGA_CIAA_TB, NULL);
+- free_irq(IRQ_AMIGA_DSKBLK, NULL);
+- custom.dmacon = DMAF_DISK; /* disable DMA */
+- amiga_chip_free(raw_buf);
+- unregister_blkdev(FLOPPY_MAJOR, "fd");
+-}
+-#endif
+-
+ static struct platform_driver amiga_floppy_driver = {
+ .driver = {
+ .name = "amiga-floppy",
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 867841c56a6d..996b1ef5f076 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -945,6 +945,7 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
+ if (sock->ops->shutdown == sock_no_shutdown) {
+ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
+ *err = -EINVAL;
++ sockfd_put(sock);
+ return NULL;
+ }
+
+@@ -983,14 +984,15 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+ sockfd_put(sock);
+ return -ENOMEM;
+ }
++
++ config->socks = socks;
++
+ nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL);
+ if (!nsock) {
+ sockfd_put(sock);
+ return -ENOMEM;
+ }
+
+- config->socks = socks;
+-
+ nsock->fallback_index = -1;
+ nsock->dead = false;
+ mutex_init(&nsock->tx_lock);
+diff --git a/drivers/block/skd_main.c b/drivers/block/skd_main.c
+index 87b9e7fbf062..27323fa23997 100644
+--- a/drivers/block/skd_main.c
++++ b/drivers/block/skd_main.c
+@@ -1416,7 +1416,7 @@ static void skd_resolve_req_exception(struct skd_device *skdev,
+
+ case SKD_CHECK_STATUS_BUSY_IMMINENT:
+ skd_log_skreq(skdev, skreq, "retry(busy)");
+- blk_requeue_request(skdev->queue, req);
++ blk_mq_requeue_request(req, true);
+ dev_info(&skdev->pdev->dev, "drive BUSY imminent\n");
+ skdev->state = SKD_DRVR_STATE_BUSY_IMMINENT;
+ skdev->timer_countdown = SKD_TIMER_MINUTES(20);
+@@ -1426,7 +1426,7 @@ static void skd_resolve_req_exception(struct skd_device *skdev,
+ case SKD_CHECK_STATUS_REQUEUE_REQUEST:
+ if ((unsigned long) ++req->special < SKD_MAX_RETRIES) {
+ skd_log_skreq(skdev, skreq, "retry");
+- blk_requeue_request(skdev->queue, req);
++ blk_mq_requeue_request(req, true);
+ break;
+ }
+ /* fall through */
+diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
+index 66fe1e6dc631..27829273f3c9 100644
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -606,6 +606,7 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
+ if (*ptr == 0xc0) {
+ BT_ERR("Short BCSP packet");
+ kfree_skb(bcsp->rx_skb);
++ bcsp->rx_skb = NULL;
+ bcsp->rx_state = BCSP_W4_PKT_START;
+ bcsp->rx_count = 0;
+ } else
+@@ -621,6 +622,7 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
+ bcsp->rx_skb->data[2])) != bcsp->rx_skb->data[3]) {
+ BT_ERR("Error in BCSP hdr checksum");
+ kfree_skb(bcsp->rx_skb);
++ bcsp->rx_skb = NULL;
+ bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
+ bcsp->rx_count = 0;
+ continue;
+@@ -645,6 +647,7 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
+ bscp_get_crc(bcsp));
+
+ kfree_skb(bcsp->rx_skb);
++ bcsp->rx_skb = NULL;
+ bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
+ bcsp->rx_count = 0;
+ continue;
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index 27a82a559ab9..933268b8d6a5 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -411,10 +411,10 @@ static int cdrom_get_disc_info(struct cdrom_device_info *cdi,
+ * hack to have the capability flags defined const, while we can still
+ * change it here without gcc complaining at every line.
+ */
+-#define ENSURE(call, bits) \
+-do { \
+- if (cdo->call == NULL) \
+- *change_capability &= ~(bits); \
++#define ENSURE(cdo, call, bits) \
++do { \
++ if (cdo->call == NULL) \
++ WARN_ON_ONCE((cdo)->capability & (bits)); \
+ } while (0)
+
+ /*
+@@ -590,7 +590,6 @@ int register_cdrom(struct cdrom_device_info *cdi)
+ {
+ static char banner_printed;
+ const struct cdrom_device_ops *cdo = cdi->ops;
+- int *change_capability = (int *)&cdo->capability; /* hack */
+
+ cd_dbg(CD_OPEN, "entering register_cdrom\n");
+
+@@ -602,16 +601,16 @@ int register_cdrom(struct cdrom_device_info *cdi)
+ cdrom_sysctl_register();
+ }
+
+- ENSURE(drive_status, CDC_DRIVE_STATUS);
++ ENSURE(cdo, drive_status, CDC_DRIVE_STATUS);
+ if (cdo->check_events == NULL && cdo->media_changed == NULL)
+- *change_capability = ~(CDC_MEDIA_CHANGED | CDC_SELECT_DISC);
+- ENSURE(tray_move, CDC_CLOSE_TRAY | CDC_OPEN_TRAY);
+- ENSURE(lock_door, CDC_LOCK);
+- ENSURE(select_speed, CDC_SELECT_SPEED);
+- ENSURE(get_last_session, CDC_MULTI_SESSION);
+- ENSURE(get_mcn, CDC_MCN);
+- ENSURE(reset, CDC_RESET);
+- ENSURE(generic_packet, CDC_GENERIC_PACKET);
++ WARN_ON_ONCE(cdo->capability & (CDC_MEDIA_CHANGED | CDC_SELECT_DISC));
++ ENSURE(cdo, tray_move, CDC_CLOSE_TRAY | CDC_OPEN_TRAY);
++ ENSURE(cdo, lock_door, CDC_LOCK);
++ ENSURE(cdo, select_speed, CDC_SELECT_SPEED);
++ ENSURE(cdo, get_last_session, CDC_MULTI_SESSION);
++ ENSURE(cdo, get_mcn, CDC_MCN);
++ ENSURE(cdo, reset, CDC_RESET);
++ ENSURE(cdo, generic_packet, CDC_GENERIC_PACKET);
+ cdi->mc_flags = 0;
+ cdi->options = CDO_USE_FFLAGS;
+
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index c55f6aeb4227..b353a5e5f8b1 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -1349,24 +1349,24 @@ static void set_console_size(struct port *port, u16 rows, u16 cols)
+ port->cons.ws.ws_col = cols;
+ }
+
+-static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock)
++static int fill_queue(struct virtqueue *vq, spinlock_t *lock)
+ {
+ struct port_buffer *buf;
+- unsigned int nr_added_bufs;
++ int nr_added_bufs;
+ int ret;
+
+ nr_added_bufs = 0;
+ do {
+ buf = alloc_buf(vq->vdev, PAGE_SIZE, 0);
+ if (!buf)
+- break;
++ return -ENOMEM;
+
+ spin_lock_irq(lock);
+ ret = add_inbuf(vq, buf);
+ if (ret < 0) {
+ spin_unlock_irq(lock);
+ free_buf(buf, true);
+- break;
++ return ret;
+ }
+ nr_added_bufs++;
+ spin_unlock_irq(lock);
+@@ -1386,7 +1386,6 @@ static int add_port(struct ports_device *portdev, u32 id)
+ char debugfs_name[16];
+ struct port *port;
+ dev_t devt;
+- unsigned int nr_added_bufs;
+ int err;
+
+ port = kmalloc(sizeof(*port), GFP_KERNEL);
+@@ -1445,11 +1444,13 @@ static int add_port(struct ports_device *portdev, u32 id)
+ spin_lock_init(&port->outvq_lock);
+ init_waitqueue_head(&port->waitqueue);
+
+- /* Fill the in_vq with buffers so the host can send us data. */
+- nr_added_bufs = fill_queue(port->in_vq, &port->inbuf_lock);
+- if (!nr_added_bufs) {
++ /* We can safely ignore ENOSPC because it means
++ * the queue already has buffers. Buffers are removed
++ * only by virtcons_remove(), not by unplug_port()
++ */
++ err = fill_queue(port->in_vq, &port->inbuf_lock);
++ if (err < 0 && err != -ENOSPC) {
+ dev_err(port->dev, "Error allocating inbufs\n");
+- err = -ENOMEM;
+ goto free_device;
+ }
+
+@@ -2083,14 +2084,11 @@ static int virtcons_probe(struct virtio_device *vdev)
+ INIT_WORK(&portdev->control_work, &control_work_handler);
+
+ if (multiport) {
+- unsigned int nr_added_bufs;
+-
+ spin_lock_init(&portdev->c_ivq_lock);
+ spin_lock_init(&portdev->c_ovq_lock);
+
+- nr_added_bufs = fill_queue(portdev->c_ivq,
+- &portdev->c_ivq_lock);
+- if (!nr_added_bufs) {
++ err = fill_queue(portdev->c_ivq, &portdev->c_ivq_lock);
++ if (err < 0) {
+ dev_err(&vdev->dev,
+ "Error allocating buffers for control queue\n");
+ /*
+@@ -2101,7 +2099,7 @@ static int virtcons_probe(struct virtio_device *vdev)
+ VIRTIO_CONSOLE_DEVICE_READY, 0);
+ /* Device was functional: we need full cleanup. */
+ virtcons_remove(vdev);
+- return -ENOMEM;
++ return err;
+ }
+ } else {
+ /*
+diff --git a/drivers/clk/at91/clk-audio-pll.c b/drivers/clk/at91/clk-audio-pll.c
+index da7bafcfbe70..b3eaf654fac9 100644
+--- a/drivers/clk/at91/clk-audio-pll.c
++++ b/drivers/clk/at91/clk-audio-pll.c
+@@ -509,7 +509,7 @@ static void __init of_sama5d2_clk_audio_pll_pad_setup(struct device_node *np)
+
+ static void __init of_sama5d2_clk_audio_pll_pmc_setup(struct device_node *np)
+ {
+- struct clk_audio_pad *apmc_ck;
++ struct clk_audio_pmc *apmc_ck;
+ struct clk_init_data init = {};
+
+ apmc_ck = kzalloc(sizeof(*apmc_ck), GFP_KERNEL);
+diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
+index 0fc75c395957..d083b860f083 100644
+--- a/drivers/clk/mmp/clk-of-mmp2.c
++++ b/drivers/clk/mmp/clk-of-mmp2.c
+@@ -227,8 +227,8 @@ static struct mmp_param_gate_clk apmu_gate_clks[] = {
+ /* The gate clocks has mux parent. */
+ {MMP2_CLK_SDH0, "sdh0_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH0, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
+ {MMP2_CLK_SDH1, "sdh1_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH1, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
+- {MMP2_CLK_SDH1, "sdh2_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH2, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
+- {MMP2_CLK_SDH1, "sdh3_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH3, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
++ {MMP2_CLK_SDH2, "sdh2_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH2, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
++ {MMP2_CLK_SDH3, "sdh3_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH3, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
+ {MMP2_CLK_DISP0, "disp0_clk", "disp0_div", CLK_SET_RATE_PARENT, APMU_DISP0, 0x1b, 0x1b, 0x0, 0, &disp0_lock},
+ {MMP2_CLK_DISP0_SPHY, "disp0_sphy_clk", "disp0_sphy_div", CLK_SET_RATE_PARENT, APMU_DISP0, 0x1024, 0x1024, 0x0, 0, &disp0_lock},
+ {MMP2_CLK_DISP1, "disp1_clk", "disp1_div", CLK_SET_RATE_PARENT, APMU_DISP1, 0x1b, 0x1b, 0x0, 0, &disp1_lock},
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index ee9c12cf3f08..2a6098179921 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -158,7 +158,12 @@ static SUNXI_CCU_NM_WITH_FRAC_GATE_LOCK(pll_gpu_clk, "pll-gpu",
+ #define SUN50I_A64_PLL_MIPI_REG 0x040
+
+ static struct ccu_nkm pll_mipi_clk = {
+- .enable = BIT(31),
++ /*
++ * The bit 23 and 22 are called "LDO{1,2}_EN" on the SoC's
++ * user manual, and by experiments the PLL doesn't work without
++ * these bits toggled.
++ */
++ .enable = BIT(31) | BIT(23) | BIT(22),
+ .lock = BIT(28),
+ .n = _SUNXI_CCU_MULT(8, 4),
+ .k = _SUNXI_CCU_MULT_MIN(4, 2, 2),
+diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c
+index cc857d4d4a86..68551effb5ca 100644
+--- a/drivers/clk/tegra/clk-tegra20.c
++++ b/drivers/clk/tegra/clk-tegra20.c
+@@ -578,7 +578,6 @@ static struct tegra_clk tegra20_clks[tegra_clk_max] __initdata = {
+ [tegra_clk_afi] = { .dt_id = TEGRA20_CLK_AFI, .present = true },
+ [tegra_clk_fuse] = { .dt_id = TEGRA20_CLK_FUSE, .present = true },
+ [tegra_clk_kfuse] = { .dt_id = TEGRA20_CLK_KFUSE, .present = true },
+- [tegra_clk_emc] = { .dt_id = TEGRA20_CLK_EMC, .present = true },
+ };
+
+ static unsigned long tegra20_clk_measure_input_freq(void)
+@@ -799,6 +798,31 @@ static struct tegra_periph_init_data tegra_periph_nodiv_clk_list[] = {
+ TEGRA_INIT_DATA_NODIV("disp2", mux_pllpdc_clkm, CLK_SOURCE_DISP2, 30, 2, 26, 0, TEGRA20_CLK_DISP2),
+ };
+
++static void __init tegra20_emc_clk_init(void)
++{
++ struct clk *clk;
++
++ clk = clk_register_mux(NULL, "emc_mux", mux_pllmcp_clkm,
++ ARRAY_SIZE(mux_pllmcp_clkm),
++ CLK_SET_RATE_NO_REPARENT,
++ clk_base + CLK_SOURCE_EMC,
++ 30, 2, 0, &emc_lock);
++
++ clk = tegra_clk_register_mc("mc", "emc_mux", clk_base + CLK_SOURCE_EMC,
++ &emc_lock);
++ clks[TEGRA20_CLK_MC] = clk;
++
++ /*
++ * Note that 'emc_mux' source and 'emc' rate shouldn't be changed at
++ * the same time due to a HW bug, this won't happen because we're
++ * defining 'emc_mux' and 'emc' as distinct clocks.
++ */
++ clk = tegra_clk_register_divider("emc", "emc_mux",
++ clk_base + CLK_SOURCE_EMC, CLK_IS_CRITICAL,
++ TEGRA_DIVIDER_INT, 0, 8, 1, &emc_lock);
++ clks[TEGRA20_CLK_EMC] = clk;
++}
++
+ static void __init tegra20_periph_clk_init(void)
+ {
+ struct tegra_periph_init_data *data;
+@@ -812,15 +836,7 @@ static void __init tegra20_periph_clk_init(void)
+ clks[TEGRA20_CLK_AC97] = clk;
+
+ /* emc */
+- clk = clk_register_mux(NULL, "emc_mux", mux_pllmcp_clkm,
+- ARRAY_SIZE(mux_pllmcp_clkm),
+- CLK_SET_RATE_NO_REPARENT,
+- clk_base + CLK_SOURCE_EMC,
+- 30, 2, 0, &emc_lock);
+-
+- clk = tegra_clk_register_mc("mc", "emc_mux", clk_base + CLK_SOURCE_EMC,
+- &emc_lock);
+- clks[TEGRA20_CLK_MC] = clk;
++ tegra20_emc_clk_init();
+
+ /* dsi */
+ clk = tegra_clk_register_periph_gate("dsi", "pll_d", 0, clk_base, 0,
+diff --git a/drivers/clk/tegra/clk-tegra210.c b/drivers/clk/tegra/clk-tegra210.c
+index 080bfa24863e..7264e9731034 100644
+--- a/drivers/clk/tegra/clk-tegra210.c
++++ b/drivers/clk/tegra/clk-tegra210.c
+@@ -2603,7 +2603,7 @@ static struct tegra210_domain_mbist_war tegra210_pg_mbist_war[] = {
+ [TEGRA_POWERGATE_MPE] = {
+ .handle_lvl2_ovr = tegra210_generic_mbist_war,
+ .lvl2_offset = LVL2_CLK_GATE_OVRE,
+- .lvl2_mask = BIT(2),
++ .lvl2_mask = BIT(29),
+ },
+ [TEGRA_POWERGATE_SOR] = {
+ .handle_lvl2_ovr = tegra210_generic_mbist_war,
+@@ -2654,14 +2654,14 @@ static struct tegra210_domain_mbist_war tegra210_pg_mbist_war[] = {
+ .num_clks = ARRAY_SIZE(nvdec_slcg_clkids),
+ .clk_init_data = nvdec_slcg_clkids,
+ .handle_lvl2_ovr = tegra210_generic_mbist_war,
+- .lvl2_offset = LVL2_CLK_GATE_OVRC,
++ .lvl2_offset = LVL2_CLK_GATE_OVRE,
+ .lvl2_mask = BIT(9) | BIT(31),
+ },
+ [TEGRA_POWERGATE_NVJPG] = {
+ .num_clks = ARRAY_SIZE(nvjpg_slcg_clkids),
+ .clk_init_data = nvjpg_slcg_clkids,
+ .handle_lvl2_ovr = tegra210_generic_mbist_war,
+- .lvl2_offset = LVL2_CLK_GATE_OVRC,
++ .lvl2_offset = LVL2_CLK_GATE_OVRE,
+ .lvl2_mask = BIT(9) | BIT(31),
+ },
+ [TEGRA_POWERGATE_AUD] = {
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index ace5ec65e36f..9d8d64f706e0 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -909,6 +909,9 @@ static ssize_t show(struct kobject *kobj, struct attribute *attr, char *buf)
+ struct freq_attr *fattr = to_attr(attr);
+ ssize_t ret;
+
++ if (!fattr->show)
++ return -EIO;
++
+ down_read(&policy->rwsem);
+ ret = fattr->show(policy, buf);
+ up_read(&policy->rwsem);
+@@ -923,6 +926,9 @@ static ssize_t store(struct kobject *kobj, struct attribute *attr,
+ struct freq_attr *fattr = to_attr(attr);
+ ssize_t ret = -EINVAL;
+
++ if (!fattr->store)
++ return -EIO;
++
+ /*
+ * cpus_read_trylock() is used here to work around a circular lock
+ * dependency problem with respect to the cpufreq_register_driver().
+diff --git a/drivers/crypto/ccree/cc_hw_queue_defs.h b/drivers/crypto/ccree/cc_hw_queue_defs.h
+index a091ae57f902..45985b955d2c 100644
+--- a/drivers/crypto/ccree/cc_hw_queue_defs.h
++++ b/drivers/crypto/ccree/cc_hw_queue_defs.h
+@@ -449,8 +449,7 @@ static inline void set_flow_mode(struct cc_hw_desc *pdesc,
+ * @pdesc: pointer HW descriptor struct
+ * @mode: Any one of the modes defined in [CC7x-DESC]
+ */
+-static inline void set_cipher_mode(struct cc_hw_desc *pdesc,
+- enum drv_cipher_mode mode)
++static inline void set_cipher_mode(struct cc_hw_desc *pdesc, int mode)
+ {
+ pdesc->word[4] |= FIELD_PREP(WORD4_CIPHER_MODE, mode);
+ }
+@@ -461,8 +460,7 @@ static inline void set_cipher_mode(struct cc_hw_desc *pdesc,
+ * @pdesc: pointer HW descriptor struct
+ * @mode: Any one of the modes defined in [CC7x-DESC]
+ */
+-static inline void set_cipher_config0(struct cc_hw_desc *pdesc,
+- enum drv_crypto_direction mode)
++static inline void set_cipher_config0(struct cc_hw_desc *pdesc, int mode)
+ {
+ pdesc->word[4] |= FIELD_PREP(WORD4_CIPHER_CONF0, mode);
+ }
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index e2ab46bfa666..d350253d161a 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -257,7 +257,7 @@ static struct devfreq_governor *try_then_request_governor(const char *name)
+ /* Restore previous state before return */
+ mutex_lock(&devfreq_list_lock);
+ if (err)
+- return ERR_PTR(err);
++ return (err < 0) ? ERR_PTR(err) : ERR_PTR(-EINVAL);
+
+ governor = find_devfreq_governor(name);
+ }
+diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c
+index c009d94f40c5..34be60fe6892 100644
+--- a/drivers/edac/thunderx_edac.c
++++ b/drivers/edac/thunderx_edac.c
+@@ -1884,7 +1884,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)
+ default:
+ dev_err(&l2c->pdev->dev, "Unsupported device: %04x\n",
+ l2c->pdev->device);
+- return IRQ_NONE;
++ goto err_free;
+ }
+
+ while (CIRC_CNT(l2c->ring_head, l2c->ring_tail,
+@@ -1906,7 +1906,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)
+ l2c->ring_tail++;
+ }
+
+- return IRQ_HANDLED;
++ ret = IRQ_HANDLED;
+
+ err_free:
+ kfree(other);
+diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c
+index c8f169bf2e27..62337be07afc 100644
+--- a/drivers/firmware/google/gsmi.c
++++ b/drivers/firmware/google/gsmi.c
+@@ -480,11 +480,10 @@ static ssize_t eventlog_write(struct file *filp, struct kobject *kobj,
+ if (count < sizeof(u32))
+ return -EINVAL;
+ param.type = *(u32 *)buf;
+- count -= sizeof(u32);
+ buf += sizeof(u32);
+
+ /* The remaining buffer is the data payload */
+- if (count > gsmi_dev.data_buf->length)
++ if ((count - sizeof(u32)) > gsmi_dev.data_buf->length)
+ return -EINVAL;
+ param.data_len = count - sizeof(u32);
+
+@@ -504,7 +503,7 @@ static ssize_t eventlog_write(struct file *filp, struct kobject *kobj,
+
+ spin_unlock_irqrestore(&gsmi_dev.lock, flags);
+
+- return rc;
++ return (rc == 0) ? count : rc;
+
+ }
+
+diff --git a/drivers/gpio/gpio-max77620.c b/drivers/gpio/gpio-max77620.c
+index ac6c1c0548b6..78254ed93206 100644
+--- a/drivers/gpio/gpio-max77620.c
++++ b/drivers/gpio/gpio-max77620.c
+@@ -163,13 +163,13 @@ static int max77620_gpio_set_debounce(struct max77620_gpio *mgpio,
+ case 0:
+ val = MAX77620_CNFG_GPIO_DBNC_None;
+ break;
+- case 1000 ... 8000:
++ case 1 ... 8000:
+ val = MAX77620_CNFG_GPIO_DBNC_8ms;
+ break;
+- case 9000 ... 16000:
++ case 8001 ... 16000:
+ val = MAX77620_CNFG_GPIO_DBNC_16ms;
+ break;
+- case 17000 ... 32000:
++ case 16001 ... 32000:
+ val = MAX77620_CNFG_GPIO_DBNC_32ms;
+ break;
+ default:
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index c7c505095402..6bf032e81e39 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -3472,18 +3472,31 @@ static int smu7_get_pp_table_entry(struct pp_hwmgr *hwmgr,
+
+ static int smu7_get_gpu_power(struct pp_hwmgr *hwmgr, u32 *query)
+ {
++ struct amdgpu_device *adev = hwmgr->adev;
+ int i;
+ u32 tmp = 0;
+
+ if (!query)
+ return -EINVAL;
+
+- smum_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_GetCurrPkgPwr, 0);
+- tmp = cgs_read_register(hwmgr->device, mmSMC_MSG_ARG_0);
+- *query = tmp;
++ /*
++ * PPSMC_MSG_GetCurrPkgPwr is not supported on:
++ * - Hawaii
++ * - Bonaire
++ * - Fiji
++ * - Tonga
++ */
++ if ((adev->asic_type != CHIP_HAWAII) &&
++ (adev->asic_type != CHIP_BONAIRE) &&
++ (adev->asic_type != CHIP_FIJI) &&
++ (adev->asic_type != CHIP_TONGA)) {
++ smum_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_GetCurrPkgPwr, 0);
++ tmp = cgs_read_register(hwmgr->device, mmSMC_MSG_ARG_0);
++ *query = tmp;
+
+- if (tmp != 0)
+- return 0;
++ if (tmp != 0)
++ return 0;
++ }
+
+ smum_send_msg_to_smc(hwmgr, PPSMC_MSG_PmStatusLogStart);
+ cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC,
+diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
+index 2c9b284036d1..961abb6ea18e 100644
+--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
++++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
+@@ -691,8 +691,28 @@ i915_gem_userptr_put_pages(struct drm_i915_gem_object *obj,
+ i915_gem_gtt_finish_pages(obj, pages);
+
+ for_each_sgt_page(page, sgt_iter, pages) {
+- if (obj->mm.dirty)
++ if (obj->mm.dirty && trylock_page(page)) {
++ /*
++ * As this may not be anonymous memory (e.g. shmem)
++ * but exist on a real mapping, we have to lock
++ * the page in order to dirty it -- holding
++ * the page reference is not sufficient to
++ * prevent the inode from being truncated.
++ * Play safe and take the lock.
++ *
++ * However...!
++ *
++ * The mmu-notifier can be invalidated for a
++ * migrate_page, that is alreadying holding the lock
++ * on the page. Such a try_to_unmap() will result
++ * in us calling put_pages() and so recursively try
++ * to lock the page. We avoid that deadlock with
++ * a trylock_page() and in exchange we risk missing
++ * some page dirtying.
++ */
+ set_page_dirty(page);
++ unlock_page(page);
++ }
+
+ mark_page_accessed(page);
+ put_page(page);
+diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c
+index d6c8f8fdfda5..b7fda69342fc 100644
+--- a/drivers/gpu/drm/i915/i915_pmu.c
++++ b/drivers/gpu/drm/i915/i915_pmu.c
+@@ -827,8 +827,8 @@ create_event_attributes(struct drm_i915_private *i915)
+ const char *name;
+ const char *unit;
+ } events[] = {
+- __event(I915_PMU_ACTUAL_FREQUENCY, "actual-frequency", "MHz"),
+- __event(I915_PMU_REQUESTED_FREQUENCY, "requested-frequency", "MHz"),
++ __event(I915_PMU_ACTUAL_FREQUENCY, "actual-frequency", "M"),
++ __event(I915_PMU_REQUESTED_FREQUENCY, "requested-frequency", "M"),
+ __event(I915_PMU_INTERRUPTS, "interrupts", NULL),
+ __event(I915_PMU_RC6_RESIDENCY, "rc6-residency", "ns"),
+ };
+diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
+index bc26ec822e26..dd0687e36a47 100644
+--- a/drivers/i2c/busses/i2c-uniphier-f.c
++++ b/drivers/i2c/busses/i2c-uniphier-f.c
+@@ -98,6 +98,7 @@ struct uniphier_fi2c_priv {
+ unsigned int flags;
+ unsigned int busy_cnt;
+ unsigned int clk_cycle;
++ spinlock_t lock; /* IRQ synchronization */
+ };
+
+ static void uniphier_fi2c_fill_txfifo(struct uniphier_fi2c_priv *priv,
+@@ -142,9 +143,10 @@ static void uniphier_fi2c_set_irqs(struct uniphier_fi2c_priv *priv)
+ writel(priv->enabled_irqs, priv->membase + UNIPHIER_FI2C_IE);
+ }
+
+-static void uniphier_fi2c_clear_irqs(struct uniphier_fi2c_priv *priv)
++static void uniphier_fi2c_clear_irqs(struct uniphier_fi2c_priv *priv,
++ u32 mask)
+ {
+- writel(-1, priv->membase + UNIPHIER_FI2C_IC);
++ writel(mask, priv->membase + UNIPHIER_FI2C_IC);
+ }
+
+ static void uniphier_fi2c_stop(struct uniphier_fi2c_priv *priv)
+@@ -162,7 +164,10 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+ struct uniphier_fi2c_priv *priv = dev_id;
+ u32 irq_status;
+
++ spin_lock(&priv->lock);
++
+ irq_status = readl(priv->membase + UNIPHIER_FI2C_INT);
++ irq_status &= priv->enabled_irqs;
+
+ dev_dbg(&priv->adap.dev,
+ "interrupt: enabled_irqs=%04x, irq_status=%04x\n",
+@@ -207,7 +212,13 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+
+ if (irq_status & (UNIPHIER_FI2C_INT_RF | UNIPHIER_FI2C_INT_RB)) {
+ uniphier_fi2c_drain_rxfifo(priv);
+- if (!priv->len)
++ /*
++ * If the number of bytes to read is multiple of the FIFO size
++ * (msg->len == 8, 16, 24, ...), the INT_RF bit is set a little
++ * earlier than INT_RB. We wait for INT_RB to confirm the
++ * completion of the current message.
++ */
++ if (!priv->len && (irq_status & UNIPHIER_FI2C_INT_RB))
+ goto data_done;
+
+ if (unlikely(priv->flags & UNIPHIER_FI2C_MANUAL_NACK)) {
+@@ -230,6 +241,8 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+ goto handled;
+ }
+
++ spin_unlock(&priv->lock);
++
+ return IRQ_NONE;
+
+ data_done:
+@@ -244,7 +257,14 @@ complete:
+ }
+
+ handled:
+- uniphier_fi2c_clear_irqs(priv);
++ /*
++ * This controller makes a pause while any bit of the IRQ status is
++ * asserted. Clear the asserted bit to kick the controller just before
++ * exiting the handler.
++ */
++ uniphier_fi2c_clear_irqs(priv, irq_status);
++
++ spin_unlock(&priv->lock);
+
+ return IRQ_HANDLED;
+ }
+@@ -252,6 +272,8 @@ handled:
+ static void uniphier_fi2c_tx_init(struct uniphier_fi2c_priv *priv, u16 addr)
+ {
+ priv->enabled_irqs |= UNIPHIER_FI2C_INT_TE;
++ uniphier_fi2c_set_irqs(priv);
++
+ /* do not use TX byte counter */
+ writel(0, priv->membase + UNIPHIER_FI2C_TBC);
+ /* set slave address */
+@@ -284,6 +306,8 @@ static void uniphier_fi2c_rx_init(struct uniphier_fi2c_priv *priv, u16 addr)
+ priv->enabled_irqs |= UNIPHIER_FI2C_INT_RF;
+ }
+
++ uniphier_fi2c_set_irqs(priv);
++
+ /* set slave address with RD bit */
+ writel(UNIPHIER_FI2C_DTTX_CMD | UNIPHIER_FI2C_DTTX_RD | addr << 1,
+ priv->membase + UNIPHIER_FI2C_DTTX);
+@@ -307,14 +331,16 @@ static void uniphier_fi2c_recover(struct uniphier_fi2c_priv *priv)
+ }
+
+ static int uniphier_fi2c_master_xfer_one(struct i2c_adapter *adap,
+- struct i2c_msg *msg, bool stop)
++ struct i2c_msg *msg, bool repeat,
++ bool stop)
+ {
+ struct uniphier_fi2c_priv *priv = i2c_get_adapdata(adap);
+ bool is_read = msg->flags & I2C_M_RD;
+- unsigned long time_left;
++ unsigned long time_left, flags;
+
+- dev_dbg(&adap->dev, "%s: addr=0x%02x, len=%d, stop=%d\n",
+- is_read ? "receive" : "transmit", msg->addr, msg->len, stop);
++ dev_dbg(&adap->dev, "%s: addr=0x%02x, len=%d, repeat=%d, stop=%d\n",
++ is_read ? "receive" : "transmit", msg->addr, msg->len,
++ repeat, stop);
+
+ priv->len = msg->len;
+ priv->buf = msg->buf;
+@@ -326,22 +352,36 @@ static int uniphier_fi2c_master_xfer_one(struct i2c_adapter *adap,
+ priv->flags |= UNIPHIER_FI2C_STOP;
+
+ reinit_completion(&priv->comp);
+- uniphier_fi2c_clear_irqs(priv);
++ uniphier_fi2c_clear_irqs(priv, U32_MAX);
+ writel(UNIPHIER_FI2C_RST_TBRST | UNIPHIER_FI2C_RST_RBRST,
+ priv->membase + UNIPHIER_FI2C_RST); /* reset TX/RX FIFO */
+
++ spin_lock_irqsave(&priv->lock, flags);
++
+ if (is_read)
+ uniphier_fi2c_rx_init(priv, msg->addr);
+ else
+ uniphier_fi2c_tx_init(priv, msg->addr);
+
+- uniphier_fi2c_set_irqs(priv);
+-
+ dev_dbg(&adap->dev, "start condition\n");
+- writel(UNIPHIER_FI2C_CR_MST | UNIPHIER_FI2C_CR_STA,
+- priv->membase + UNIPHIER_FI2C_CR);
++ /*
++ * For a repeated START condition, writing a slave address to the FIFO
++ * kicks the controller. So, the UNIPHIER_FI2C_CR register should be
++ * written only for a non-repeated START condition.
++ */
++ if (!repeat)
++ writel(UNIPHIER_FI2C_CR_MST | UNIPHIER_FI2C_CR_STA,
++ priv->membase + UNIPHIER_FI2C_CR);
++
++ spin_unlock_irqrestore(&priv->lock, flags);
+
+ time_left = wait_for_completion_timeout(&priv->comp, adap->timeout);
++
++ spin_lock_irqsave(&priv->lock, flags);
++ priv->enabled_irqs = 0;
++ uniphier_fi2c_set_irqs(priv);
++ spin_unlock_irqrestore(&priv->lock, flags);
++
+ if (!time_left) {
+ dev_err(&adap->dev, "transaction timeout.\n");
+ uniphier_fi2c_recover(priv);
+@@ -394,6 +434,7 @@ static int uniphier_fi2c_master_xfer(struct i2c_adapter *adap,
+ struct i2c_msg *msgs, int num)
+ {
+ struct i2c_msg *msg, *emsg = msgs + num;
++ bool repeat = false;
+ int ret;
+
+ ret = uniphier_fi2c_check_bus_busy(adap);
+@@ -404,9 +445,11 @@ static int uniphier_fi2c_master_xfer(struct i2c_adapter *adap,
+ /* Emit STOP if it is the last message or I2C_M_STOP is set. */
+ bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP);
+
+- ret = uniphier_fi2c_master_xfer_one(adap, msg, stop);
++ ret = uniphier_fi2c_master_xfer_one(adap, msg, repeat, stop);
+ if (ret)
+ return ret;
++
++ repeat = !stop;
+ }
+
+ return num;
+@@ -546,6 +589,7 @@ static int uniphier_fi2c_probe(struct platform_device *pdev)
+
+ priv->clk_cycle = clk_rate / bus_speed;
+ init_completion(&priv->comp);
++ spin_lock_init(&priv->lock);
+ priv->adap.owner = THIS_MODULE;
+ priv->adap.algo = &uniphier_fi2c_algo;
+ priv->adap.dev.parent = dev;
+diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+index 96f76896488d..802942adea8e 100644
+--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
++++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+@@ -120,6 +120,8 @@ struct bnxt_re_dev {
+ #define BNXT_RE_FLAG_HAVE_L2_REF 3
+ #define BNXT_RE_FLAG_RCFW_CHANNEL_EN 4
+ #define BNXT_RE_FLAG_QOS_WORK_REG 5
++#define BNXT_RE_FLAG_RESOURCES_ALLOCATED 7
++#define BNXT_RE_FLAG_RESOURCES_INITIALIZED 8
+ #define BNXT_RE_FLAG_ISSUE_ROCE_STATS 29
+ struct net_device *netdev;
+ unsigned int version, major, minor;
+diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
+index 22bd9784fa2e..589b0d4677d5 100644
+--- a/drivers/infiniband/hw/bnxt_re/main.c
++++ b/drivers/infiniband/hw/bnxt_re/main.c
+@@ -864,10 +864,8 @@ static void bnxt_re_cleanup_res(struct bnxt_re_dev *rdev)
+ {
+ int i;
+
+- if (rdev->nq[0].hwq.max_elements) {
+- for (i = 1; i < rdev->num_msix; i++)
+- bnxt_qplib_disable_nq(&rdev->nq[i - 1]);
+- }
++ for (i = 1; i < rdev->num_msix; i++)
++ bnxt_qplib_disable_nq(&rdev->nq[i - 1]);
+
+ if (rdev->qplib_res.rcfw)
+ bnxt_qplib_cleanup_res(&rdev->qplib_res);
+@@ -876,6 +874,7 @@ static void bnxt_re_cleanup_res(struct bnxt_re_dev *rdev)
+ static int bnxt_re_init_res(struct bnxt_re_dev *rdev)
+ {
+ int rc = 0, i;
++ int num_vec_enabled = 0;
+
+ bnxt_qplib_init_res(&rdev->qplib_res);
+
+@@ -891,9 +890,13 @@ static int bnxt_re_init_res(struct bnxt_re_dev *rdev)
+ "Failed to enable NQ with rc = 0x%x", rc);
+ goto fail;
+ }
++ num_vec_enabled++;
+ }
+ return 0;
+ fail:
++ for (i = num_vec_enabled; i >= 0; i--)
++ bnxt_qplib_disable_nq(&rdev->nq[i]);
++
+ return rc;
+ }
+
+@@ -925,6 +928,7 @@ static void bnxt_re_free_res(struct bnxt_re_dev *rdev)
+ static int bnxt_re_alloc_res(struct bnxt_re_dev *rdev)
+ {
+ int rc = 0, i;
++ int num_vec_created = 0;
+
+ /* Configure and allocate resources for qplib */
+ rdev->qplib_res.rcfw = &rdev->rcfw;
+@@ -951,7 +955,7 @@ static int bnxt_re_alloc_res(struct bnxt_re_dev *rdev)
+ if (rc) {
+ dev_err(rdev_to_dev(rdev), "Alloc Failed NQ%d rc:%#x",
+ i, rc);
+- goto dealloc_dpi;
++ goto free_nq;
+ }
+ rc = bnxt_re_net_ring_alloc
+ (rdev, rdev->nq[i].hwq.pbl[PBL_LVL_0].pg_map_arr,
+@@ -964,14 +968,17 @@ static int bnxt_re_alloc_res(struct bnxt_re_dev *rdev)
+ dev_err(rdev_to_dev(rdev),
+ "Failed to allocate NQ fw id with rc = 0x%x",
+ rc);
++ bnxt_qplib_free_nq(&rdev->nq[i]);
+ goto free_nq;
+ }
++ num_vec_created++;
+ }
+ return 0;
+ free_nq:
+- for (i = 0; i < rdev->num_msix - 1; i++)
++ for (i = num_vec_created; i >= 0; i--) {
++ bnxt_re_net_ring_free(rdev, rdev->nq[i].ring_id);
+ bnxt_qplib_free_nq(&rdev->nq[i]);
+-dealloc_dpi:
++ }
+ bnxt_qplib_dealloc_dpi(&rdev->qplib_res,
+ &rdev->qplib_res.dpi_tbl,
+ &rdev->dpi_privileged);
+@@ -989,12 +996,17 @@ static void bnxt_re_dispatch_event(struct ib_device *ibdev, struct ib_qp *qp,
+ struct ib_event ib_event;
+
+ ib_event.device = ibdev;
+- if (qp)
++ if (qp) {
+ ib_event.element.qp = qp;
+- else
++ ib_event.event = event;
++ if (qp->event_handler)
++ qp->event_handler(&ib_event, qp->qp_context);
++
++ } else {
+ ib_event.element.port_num = port_num;
+- ib_event.event = event;
+- ib_dispatch_event(&ib_event);
++ ib_event.event = event;
++ ib_dispatch_event(&ib_event);
++ }
+ }
+
+ #define HWRM_QUEUE_PRI2COS_QCFG_INPUT_FLAGS_IVLAN 0x02
+@@ -1201,8 +1213,11 @@ static void bnxt_re_ib_unreg(struct bnxt_re_dev *rdev)
+ if (test_and_clear_bit(BNXT_RE_FLAG_QOS_WORK_REG, &rdev->flags))
+ cancel_delayed_work(&rdev->worker);
+
+- bnxt_re_cleanup_res(rdev);
+- bnxt_re_free_res(rdev);
++ if (test_and_clear_bit(BNXT_RE_FLAG_RESOURCES_INITIALIZED,
++ &rdev->flags))
++ bnxt_re_cleanup_res(rdev);
++ if (test_and_clear_bit(BNXT_RE_FLAG_RESOURCES_ALLOCATED, &rdev->flags))
++ bnxt_re_free_res(rdev);
+
+ if (test_and_clear_bit(BNXT_RE_FLAG_RCFW_CHANNEL_EN, &rdev->flags)) {
+ rc = bnxt_qplib_deinit_rcfw(&rdev->rcfw);
+@@ -1332,12 +1347,15 @@ static int bnxt_re_ib_reg(struct bnxt_re_dev *rdev)
+ pr_err("Failed to allocate resources: %#x\n", rc);
+ goto fail;
+ }
++ set_bit(BNXT_RE_FLAG_RESOURCES_ALLOCATED, &rdev->flags);
+ rc = bnxt_re_init_res(rdev);
+ if (rc) {
+ pr_err("Failed to initialize resources: %#x\n", rc);
+ goto fail;
+ }
+
++ set_bit(BNXT_RE_FLAG_RESOURCES_INITIALIZED, &rdev->flags);
++
+ if (!rdev->is_virtfn) {
+ rc = bnxt_re_setup_qos(rdev);
+ if (rc)
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+index 6637df77d236..8b3b5fdc19bb 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+@@ -614,13 +614,8 @@ void bnxt_qplib_disable_rcfw_channel(struct bnxt_qplib_rcfw *rcfw)
+
+ bnxt_qplib_rcfw_stop_irq(rcfw, true);
+
+- if (rcfw->cmdq_bar_reg_iomem)
+- iounmap(rcfw->cmdq_bar_reg_iomem);
+- rcfw->cmdq_bar_reg_iomem = NULL;
+-
+- if (rcfw->creq_bar_reg_iomem)
+- iounmap(rcfw->creq_bar_reg_iomem);
+- rcfw->creq_bar_reg_iomem = NULL;
++ iounmap(rcfw->cmdq_bar_reg_iomem);
++ iounmap(rcfw->creq_bar_reg_iomem);
+
+ indx = find_first_bit(rcfw->cmdq_bitmap, rcfw->bmap_size);
+ if (indx != rcfw->bmap_size)
+@@ -629,6 +624,8 @@ void bnxt_qplib_disable_rcfw_channel(struct bnxt_qplib_rcfw *rcfw)
+ kfree(rcfw->cmdq_bitmap);
+ rcfw->bmap_size = 0;
+
++ rcfw->cmdq_bar_reg_iomem = NULL;
++ rcfw->creq_bar_reg_iomem = NULL;
+ rcfw->aeq_handler = NULL;
+ rcfw->vector = 0;
+ }
+@@ -714,6 +711,8 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
+ dev_err(&rcfw->pdev->dev,
+ "QPLIB: CREQ BAR region %d mapping failed",
+ rcfw->creq_bar_reg);
++ iounmap(rcfw->cmdq_bar_reg_iomem);
++ rcfw->cmdq_bar_reg_iomem = NULL;
+ return -ENOMEM;
+ }
+ rcfw->creq_qp_event_processed = 0;
+diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c
+index 12d9e5f4beb1..58635b5f296f 100644
+--- a/drivers/isdn/mISDN/tei.c
++++ b/drivers/isdn/mISDN/tei.c
+@@ -1180,8 +1180,7 @@ static int
+ ctrl_teimanager(struct manager *mgr, void *arg)
+ {
+ /* currently we only have one option */
+- int *val = (int *)arg;
+- int ret = 0;
++ unsigned int *val = (unsigned int *)arg;
+
+ switch (val[0]) {
+ case IMCLEAR_L2:
+@@ -1197,9 +1196,9 @@ ctrl_teimanager(struct manager *mgr, void *arg)
+ test_and_clear_bit(OPTION_L1_HOLD, &mgr->options);
+ break;
+ default:
+- ret = -EINVAL;
++ return -EINVAL;
+ }
+- return ret;
++ return 0;
+ }
+
+ /* This function does create a L2 for fixed TEI in NT Mode */
+diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
+index da7f4fc1a51d..a0f61eb853c5 100644
+--- a/drivers/macintosh/windfarm_smu_sat.c
++++ b/drivers/macintosh/windfarm_smu_sat.c
+@@ -22,14 +22,6 @@
+
+ #define VERSION "1.0"
+
+-#define DEBUG
+-
+-#ifdef DEBUG
+-#define DBG(args...) printk(args)
+-#else
+-#define DBG(args...) do { } while(0)
+-#endif
+-
+ /* If the cache is older than 800ms we'll refetch it */
+ #define MAX_AGE msecs_to_jiffies(800)
+
+@@ -106,13 +98,10 @@ struct smu_sdbp_header *smu_sat_get_sdb_partition(unsigned int sat_id, int id,
+ buf[i+2] = data[3];
+ buf[i+3] = data[2];
+ }
+-#ifdef DEBUG
+- DBG(KERN_DEBUG "sat %d partition %x:", sat_id, id);
+- for (i = 0; i < len; ++i)
+- DBG(" %x", buf[i]);
+- DBG("\n");
+-#endif
+
++ printk(KERN_DEBUG "sat %d partition %x:", sat_id, id);
++ print_hex_dump(KERN_DEBUG, " ", DUMP_PREFIX_OFFSET,
++ 16, 1, buf, len, false);
+ if (size)
+ *size = len;
+ return (struct smu_sdbp_header *) buf;
+@@ -132,13 +121,13 @@ static int wf_sat_read_cache(struct wf_sat *sat)
+ if (err < 0)
+ return err;
+ sat->last_read = jiffies;
++
+ #ifdef LOTSA_DEBUG
+ {
+ int i;
+- DBG(KERN_DEBUG "wf_sat_get: data is");
+- for (i = 0; i < 16; ++i)
+- DBG(" %.2x", sat->cache[i]);
+- DBG("\n");
++ printk(KERN_DEBUG "wf_sat_get: data is");
++ print_hex_dump(KERN_DEBUG, " ", DUMP_PREFIX_OFFSET,
++ 16, 1, sat->cache, 16, false);
+ }
+ #endif
+ return 0;
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index b78a8a4d061c..6c9b54288261 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -2475,7 +2475,7 @@ static int super_validate(struct raid_set *rs, struct md_rdev *rdev)
+ }
+
+ /* Enable bitmap creation for RAID levels != 0 */
+- mddev->bitmap_info.offset = rt_is_raid0(rs->raid_type) ? 0 : to_sector(4096);
++ mddev->bitmap_info.offset = (rt_is_raid0(rs->raid_type) || rs->journal_dev.dev) ? 0 : to_sector(4096);
+ mddev->bitmap_info.default_offset = mddev->bitmap_info.offset;
+
+ if (!test_and_clear_bit(FirstUse, &rdev->flags)) {
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 25e97de36717..4cf3d8ad0b4a 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -229,7 +229,7 @@ static void * r10buf_pool_alloc(gfp_t gfp_flags, void *data)
+
+ out_free_pages:
+ while (--j >= 0)
+- resync_free_pages(&rps[j * 2]);
++ resync_free_pages(&rps[j]);
+
+ j = 0;
+ out_free_bio:
+diff --git a/drivers/media/i2c/ov13858.c b/drivers/media/i2c/ov13858.c
+index 0e7a85c4996c..afd66d243403 100644
+--- a/drivers/media/i2c/ov13858.c
++++ b/drivers/media/i2c/ov13858.c
+@@ -1612,7 +1612,8 @@ static int ov13858_init_controls(struct ov13858 *ov13858)
+ OV13858_NUM_OF_LINK_FREQS - 1,
+ 0,
+ link_freq_menu_items);
+- ov13858->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++ if (ov13858->link_freq)
++ ov13858->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+
+ pixel_rate_max = link_freq_to_pixel_rate(link_freq_menu_items[0]);
+ pixel_rate_min = link_freq_to_pixel_rate(link_freq_menu_items[1]);
+@@ -1635,7 +1636,8 @@ static int ov13858_init_controls(struct ov13858 *ov13858)
+ ov13858->hblank = v4l2_ctrl_new_std(
+ ctrl_hdlr, &ov13858_ctrl_ops, V4L2_CID_HBLANK,
+ hblank, hblank, 1, hblank);
+- ov13858->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++ if (ov13858->hblank)
++ ov13858->hblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+
+ exposure_max = mode->vts_def - 8;
+ ov13858->exposure = v4l2_ctrl_new_std(
+diff --git a/drivers/media/platform/vivid/vivid-kthread-cap.c b/drivers/media/platform/vivid/vivid-kthread-cap.c
+index 2a92e5aac9ed..ac17883a054f 100644
+--- a/drivers/media/platform/vivid/vivid-kthread-cap.c
++++ b/drivers/media/platform/vivid/vivid-kthread-cap.c
+@@ -765,7 +765,11 @@ static int vivid_thread_vid_cap(void *data)
+ if (kthread_should_stop())
+ break;
+
+- mutex_lock(&dev->mutex);
++ if (!mutex_trylock(&dev->mutex)) {
++ schedule_timeout_uninterruptible(1);
++ continue;
++ }
++
+ cur_jiffies = jiffies;
+ if (dev->cap_seq_resync) {
+ dev->jiffies_vid_cap = cur_jiffies;
+@@ -918,8 +922,6 @@ void vivid_stop_generating_vid_cap(struct vivid_dev *dev, bool *pstreaming)
+
+ /* shutdown control thread */
+ vivid_grab_controls(dev, false);
+- mutex_unlock(&dev->mutex);
+ kthread_stop(dev->kthread_vid_cap);
+ dev->kthread_vid_cap = NULL;
+- mutex_lock(&dev->mutex);
+ }
+diff --git a/drivers/media/platform/vivid/vivid-kthread-out.c b/drivers/media/platform/vivid/vivid-kthread-out.c
+index 488590594150..c5f466a73312 100644
+--- a/drivers/media/platform/vivid/vivid-kthread-out.c
++++ b/drivers/media/platform/vivid/vivid-kthread-out.c
+@@ -135,7 +135,11 @@ static int vivid_thread_vid_out(void *data)
+ if (kthread_should_stop())
+ break;
+
+- mutex_lock(&dev->mutex);
++ if (!mutex_trylock(&dev->mutex)) {
++ schedule_timeout_uninterruptible(1);
++ continue;
++ }
++
+ cur_jiffies = jiffies;
+ if (dev->out_seq_resync) {
+ dev->jiffies_vid_out = cur_jiffies;
+@@ -289,8 +293,6 @@ void vivid_stop_generating_vid_out(struct vivid_dev *dev, bool *pstreaming)
+
+ /* shutdown control thread */
+ vivid_grab_controls(dev, false);
+- mutex_unlock(&dev->mutex);
+ kthread_stop(dev->kthread_vid_out);
+ dev->kthread_vid_out = NULL;
+- mutex_lock(&dev->mutex);
+ }
+diff --git a/drivers/media/platform/vivid/vivid-sdr-cap.c b/drivers/media/platform/vivid/vivid-sdr-cap.c
+index cfb7cb4d37a8..e1794f8689d4 100644
+--- a/drivers/media/platform/vivid/vivid-sdr-cap.c
++++ b/drivers/media/platform/vivid/vivid-sdr-cap.c
+@@ -137,7 +137,11 @@ static int vivid_thread_sdr_cap(void *data)
+ if (kthread_should_stop())
+ break;
+
+- mutex_lock(&dev->mutex);
++ if (!mutex_trylock(&dev->mutex)) {
++ schedule_timeout_uninterruptible(1);
++ continue;
++ }
++
+ cur_jiffies = jiffies;
+ if (dev->sdr_cap_seq_resync) {
+ dev->jiffies_sdr_cap = cur_jiffies;
+@@ -297,10 +301,8 @@ static void sdr_cap_stop_streaming(struct vb2_queue *vq)
+ }
+
+ /* shutdown control thread */
+- mutex_unlock(&dev->mutex);
+ kthread_stop(dev->kthread_sdr_cap);
+ dev->kthread_sdr_cap = NULL;
+- mutex_lock(&dev->mutex);
+ }
+
+ const struct vb2_ops vivid_sdr_cap_qops = {
+diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
+index 2e273f4dfc29..c58ae489f39c 100644
+--- a/drivers/media/platform/vivid/vivid-vid-cap.c
++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
+@@ -222,9 +222,6 @@ static int vid_cap_start_streaming(struct vb2_queue *vq, unsigned count)
+ if (vb2_is_streaming(&dev->vb_vid_out_q))
+ dev->can_loop_video = vivid_vid_can_loop(dev);
+
+- if (dev->kthread_vid_cap)
+- return 0;
+-
+ dev->vid_cap_seq_count = 0;
+ dprintk(dev, 1, "%s\n", __func__);
+ for (i = 0; i < VIDEO_MAX_FRAME; i++)
+diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
+index 50248e2176a0..0f909500a0b8 100644
+--- a/drivers/media/platform/vivid/vivid-vid-out.c
++++ b/drivers/media/platform/vivid/vivid-vid-out.c
+@@ -146,9 +146,6 @@ static int vid_out_start_streaming(struct vb2_queue *vq, unsigned count)
+ if (vb2_is_streaming(&dev->vb_vid_cap_q))
+ dev->can_loop_video = vivid_vid_can_loop(dev);
+
+- if (dev->kthread_vid_out)
+- return 0;
+-
+ dev->vid_out_seq_count = 0;
+ dprintk(dev, 1, "%s\n", __func__);
+ if (dev->start_streaming_error) {
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index f23a220352f7..6b10363fb6f0 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -1607,8 +1607,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
+ spin_unlock_irqrestore(&ictx->kc_lock, flags);
+
+ /* send touchscreen events through input subsystem if touchpad data */
+- if (ictx->display_type == IMON_DISPLAY_TYPE_VGA && len == 8 &&
+- buf[7] == 0x86) {
++ if (ictx->touch && len == 8 && buf[7] == 0x86) {
+ imon_touch_event(ictx, buf);
+ return;
+
+diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
+index a8f3169e30b3..ac4fddfd0a43 100644
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -537,6 +537,9 @@ static int flexcop_usb_probe(struct usb_interface *intf,
+ struct flexcop_device *fc = NULL;
+ int ret;
+
++ if (intf->cur_altsetting->desc.bNumEndpoints < 1)
++ return -ENODEV;
++
+ if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
+ err("out of memory\n");
+ return -ENOMEM;
+diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
+index 5b51ed7d6243..5400ec99986f 100644
+--- a/drivers/media/usb/dvb-usb/cxusb.c
++++ b/drivers/media/usb/dvb-usb/cxusb.c
+@@ -457,7 +457,8 @@ static int cxusb_rc_query(struct dvb_usb_device *d)
+ {
+ u8 ircode[4];
+
+- cxusb_ctrl_msg(d, CMD_GET_IR_CODE, NULL, 0, ircode, 4);
++ if (cxusb_ctrl_msg(d, CMD_GET_IR_CODE, NULL, 0, ircode, 4) < 0)
++ return 0;
+
+ if (ircode[2] || ircode[3])
+ rc_keydown(d->rc_dev, RC_PROTO_NEC,
+diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
+index f29d1bef0293..cce29b604f4a 100644
+--- a/drivers/media/usb/usbvision/usbvision-video.c
++++ b/drivers/media/usb/usbvision/usbvision-video.c
+@@ -327,6 +327,10 @@ static int usbvision_v4l2_open(struct file *file)
+ if (mutex_lock_interruptible(&usbvision->v4l2_lock))
+ return -ERESTARTSYS;
+
++ if (usbvision->remove_pending) {
++ err_code = -ENODEV;
++ goto unlock;
++ }
+ if (usbvision->user) {
+ err_code = -EBUSY;
+ } else {
+@@ -390,6 +394,7 @@ unlock:
+ static int usbvision_v4l2_close(struct file *file)
+ {
+ struct usb_usbvision *usbvision = video_drvdata(file);
++ int r;
+
+ PDEBUG(DBG_IO, "close");
+
+@@ -404,9 +409,10 @@ static int usbvision_v4l2_close(struct file *file)
+ usbvision_scratch_free(usbvision);
+
+ usbvision->user--;
++ r = usbvision->remove_pending;
+ mutex_unlock(&usbvision->v4l2_lock);
+
+- if (usbvision->remove_pending) {
++ if (r) {
+ printk(KERN_INFO "%s: Final disconnect\n", __func__);
+ usbvision_release(usbvision);
+ return 0;
+@@ -1090,6 +1096,11 @@ static int usbvision_radio_open(struct file *file)
+
+ if (mutex_lock_interruptible(&usbvision->v4l2_lock))
+ return -ERESTARTSYS;
++
++ if (usbvision->remove_pending) {
++ err_code = -ENODEV;
++ goto out;
++ }
+ err_code = v4l2_fh_open(file);
+ if (err_code)
+ goto out;
+@@ -1122,6 +1133,7 @@ out:
+ static int usbvision_radio_close(struct file *file)
+ {
+ struct usb_usbvision *usbvision = video_drvdata(file);
++ int r;
+
+ PDEBUG(DBG_IO, "");
+
+@@ -1134,9 +1146,10 @@ static int usbvision_radio_close(struct file *file)
+ usbvision_audio_off(usbvision);
+ usbvision->radio = 0;
+ usbvision->user--;
++ r = usbvision->remove_pending;
+ mutex_unlock(&usbvision->v4l2_lock);
+
+- if (usbvision->remove_pending) {
++ if (r) {
+ printk(KERN_INFO "%s: Final disconnect\n", __func__);
+ v4l2_fh_release(file);
+ usbvision_release(usbvision);
+@@ -1562,6 +1575,7 @@ err_usb:
+ static void usbvision_disconnect(struct usb_interface *intf)
+ {
+ struct usb_usbvision *usbvision = to_usbvision(usb_get_intfdata(intf));
++ int u;
+
+ PDEBUG(DBG_PROBE, "");
+
+@@ -1578,13 +1592,14 @@ static void usbvision_disconnect(struct usb_interface *intf)
+ v4l2_device_disconnect(&usbvision->v4l2_dev);
+ usbvision_i2c_unregister(usbvision);
+ usbvision->remove_pending = 1; /* Now all ISO data will be ignored */
++ u = usbvision->user;
+
+ usb_put_dev(usbvision->dev);
+ usbvision->dev = NULL; /* USB device is no more */
+
+ mutex_unlock(&usbvision->v4l2_lock);
+
+- if (usbvision->user) {
++ if (u) {
+ printk(KERN_INFO "%s: In use, disconnect pending\n",
+ __func__);
+ wake_up_interruptible(&usbvision->wait_frame);
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index c3ddbf6c202a..cf4feff2a48c 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -2124,6 +2124,20 @@ static int uvc_probe(struct usb_interface *intf,
+ sizeof(dev->name) - len);
+ }
+
++ /* Initialize the media device. */
++#ifdef CONFIG_MEDIA_CONTROLLER
++ dev->mdev.dev = &intf->dev;
++ strscpy(dev->mdev.model, dev->name, sizeof(dev->mdev.model));
++ if (udev->serial)
++ strscpy(dev->mdev.serial, udev->serial,
++ sizeof(dev->mdev.serial));
++ usb_make_path(udev, dev->mdev.bus_info, sizeof(dev->mdev.bus_info));
++ dev->mdev.hw_revision = le16_to_cpu(udev->descriptor.bcdDevice);
++ media_device_init(&dev->mdev);
++
++ dev->vdev.mdev = &dev->mdev;
++#endif
++
+ /* Parse the Video Class control descriptor. */
+ if (uvc_parse_control(dev) < 0) {
+ uvc_trace(UVC_TRACE_PROBE, "Unable to parse UVC "
+@@ -2144,19 +2158,7 @@ static int uvc_probe(struct usb_interface *intf,
+ "linux-uvc-devel mailing list.\n");
+ }
+
+- /* Initialize the media device and register the V4L2 device. */
+-#ifdef CONFIG_MEDIA_CONTROLLER
+- dev->mdev.dev = &intf->dev;
+- strlcpy(dev->mdev.model, dev->name, sizeof(dev->mdev.model));
+- if (udev->serial)
+- strlcpy(dev->mdev.serial, udev->serial,
+- sizeof(dev->mdev.serial));
+- strcpy(dev->mdev.bus_info, udev->devpath);
+- dev->mdev.hw_revision = le16_to_cpu(udev->descriptor.bcdDevice);
+- media_device_init(&dev->mdev);
+-
+- dev->vdev.mdev = &dev->mdev;
+-#endif
++ /* Register the V4L2 device. */
+ if (v4l2_device_register(&intf->dev, &dev->vdev) < 0)
+ goto error;
+
+diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
+index 47d6d40f41cd..a4403a57ddc8 100644
+--- a/drivers/mfd/arizona-core.c
++++ b/drivers/mfd/arizona-core.c
+@@ -52,8 +52,10 @@ int arizona_clk32k_enable(struct arizona *arizona)
+ if (ret != 0)
+ goto err_ref;
+ ret = clk_prepare_enable(arizona->mclk[ARIZONA_MCLK1]);
+- if (ret != 0)
+- goto err_pm;
++ if (ret != 0) {
++ pm_runtime_put_sync(arizona->dev);
++ goto err_ref;
++ }
+ break;
+ case ARIZONA_32KZ_MCLK2:
+ ret = clk_prepare_enable(arizona->mclk[ARIZONA_MCLK2]);
+@@ -67,8 +69,6 @@ int arizona_clk32k_enable(struct arizona *arizona)
+ ARIZONA_CLK_32K_ENA);
+ }
+
+-err_pm:
+- pm_runtime_put_sync(arizona->dev);
+ err_ref:
+ if (ret != 0)
+ arizona->clk32k_ref--;
+diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c
+index 15bc052704a6..9ca1f8c015de 100644
+--- a/drivers/mfd/intel_soc_pmic_bxtwc.c
++++ b/drivers/mfd/intel_soc_pmic_bxtwc.c
+@@ -31,8 +31,8 @@
+
+ /* Interrupt Status Registers */
+ #define BXTWC_IRQLVL1 0x4E02
+-#define BXTWC_PWRBTNIRQ 0x4E03
+
++#define BXTWC_PWRBTNIRQ 0x4E03
+ #define BXTWC_THRM0IRQ 0x4E04
+ #define BXTWC_THRM1IRQ 0x4E05
+ #define BXTWC_THRM2IRQ 0x4E06
+@@ -47,10 +47,9 @@
+
+ /* Interrupt MASK Registers */
+ #define BXTWC_MIRQLVL1 0x4E0E
+-#define BXTWC_MPWRTNIRQ 0x4E0F
+-
+ #define BXTWC_MIRQLVL1_MCHGR BIT(5)
+
++#define BXTWC_MPWRBTNIRQ 0x4E0F
+ #define BXTWC_MTHRM0IRQ 0x4E12
+ #define BXTWC_MTHRM1IRQ 0x4E13
+ #define BXTWC_MTHRM2IRQ 0x4E14
+@@ -66,9 +65,7 @@
+ /* Whiskey Cove PMIC share same ACPI ID between different platforms */
+ #define BROXTON_PMIC_WC_HRV 4
+
+-/* Manage in two IRQ chips since mask registers are not consecutive */
+ enum bxtwc_irqs {
+- /* Level 1 */
+ BXTWC_PWRBTN_LVL1_IRQ = 0,
+ BXTWC_TMU_LVL1_IRQ,
+ BXTWC_THRM_LVL1_IRQ,
+@@ -77,9 +74,11 @@ enum bxtwc_irqs {
+ BXTWC_CHGR_LVL1_IRQ,
+ BXTWC_GPIO_LVL1_IRQ,
+ BXTWC_CRIT_LVL1_IRQ,
++};
+
+- /* Level 2 */
+- BXTWC_PWRBTN_IRQ,
++enum bxtwc_irqs_pwrbtn {
++ BXTWC_PWRBTN_IRQ = 0,
++ BXTWC_UIBTN_IRQ,
+ };
+
+ enum bxtwc_irqs_bcu {
+@@ -113,7 +112,10 @@ static const struct regmap_irq bxtwc_regmap_irqs[] = {
+ REGMAP_IRQ_REG(BXTWC_CHGR_LVL1_IRQ, 0, BIT(5)),
+ REGMAP_IRQ_REG(BXTWC_GPIO_LVL1_IRQ, 0, BIT(6)),
+ REGMAP_IRQ_REG(BXTWC_CRIT_LVL1_IRQ, 0, BIT(7)),
+- REGMAP_IRQ_REG(BXTWC_PWRBTN_IRQ, 1, 0x03),
++};
++
++static const struct regmap_irq bxtwc_regmap_irqs_pwrbtn[] = {
++ REGMAP_IRQ_REG(BXTWC_PWRBTN_IRQ, 0, 0x01),
+ };
+
+ static const struct regmap_irq bxtwc_regmap_irqs_bcu[] = {
+@@ -125,7 +127,7 @@ static const struct regmap_irq bxtwc_regmap_irqs_adc[] = {
+ };
+
+ static const struct regmap_irq bxtwc_regmap_irqs_chgr[] = {
+- REGMAP_IRQ_REG(BXTWC_USBC_IRQ, 0, BIT(5)),
++ REGMAP_IRQ_REG(BXTWC_USBC_IRQ, 0, 0x20),
+ REGMAP_IRQ_REG(BXTWC_CHGR0_IRQ, 0, 0x1f),
+ REGMAP_IRQ_REG(BXTWC_CHGR1_IRQ, 1, 0x1f),
+ };
+@@ -144,7 +146,16 @@ static struct regmap_irq_chip bxtwc_regmap_irq_chip = {
+ .mask_base = BXTWC_MIRQLVL1,
+ .irqs = bxtwc_regmap_irqs,
+ .num_irqs = ARRAY_SIZE(bxtwc_regmap_irqs),
+- .num_regs = 2,
++ .num_regs = 1,
++};
++
++static struct regmap_irq_chip bxtwc_regmap_irq_chip_pwrbtn = {
++ .name = "bxtwc_irq_chip_pwrbtn",
++ .status_base = BXTWC_PWRBTNIRQ,
++ .mask_base = BXTWC_MPWRBTNIRQ,
++ .irqs = bxtwc_regmap_irqs_pwrbtn,
++ .num_irqs = ARRAY_SIZE(bxtwc_regmap_irqs_pwrbtn),
++ .num_regs = 1,
+ };
+
+ static struct regmap_irq_chip bxtwc_regmap_irq_chip_tmu = {
+@@ -472,6 +483,16 @@ static int bxtwc_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
++ BXTWC_PWRBTN_LVL1_IRQ,
++ IRQF_ONESHOT,
++ &bxtwc_regmap_irq_chip_pwrbtn,
++ &pmic->irq_chip_data_pwrbtn);
++ if (ret) {
++ dev_err(&pdev->dev, "Failed to add PWRBTN IRQ chip\n");
++ return ret;
++ }
++
+ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
+ BXTWC_TMU_LVL1_IRQ,
+ IRQF_ONESHOT,
+diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c
+index 3f554c447521..d1495d76bf2c 100644
+--- a/drivers/mfd/max8997.c
++++ b/drivers/mfd/max8997.c
+@@ -153,12 +153,6 @@ static struct max8997_platform_data *max8997_i2c_parse_dt_pdata(
+
+ pd->ono = irq_of_parse_and_map(dev->of_node, 1);
+
+- /*
+- * ToDo: the 'wakeup' member in the platform data is more of a linux
+- * specfic information. Hence, there is no binding for that yet and
+- * not parsed here.
+- */
+-
+ return pd;
+ }
+
+@@ -246,7 +240,7 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
+ */
+
+ /* MAX8997 has a power button input. */
+- device_init_wakeup(max8997->dev, pdata->wakeup);
++ device_init_wakeup(max8997->dev, true);
+
+ return ret;
+
+diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
+index 234febfe6398..d0bf50e3568d 100644
+--- a/drivers/mfd/mc13xxx-core.c
++++ b/drivers/mfd/mc13xxx-core.c
+@@ -278,7 +278,8 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
+ if (ret)
+ goto out;
+
+- adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2;
++ adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2 |
++ MC13XXX_ADC0_CHRGRAWDIV;
+ adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC;
+
+ /*
+diff --git a/drivers/misc/mic/scif/scif_fence.c b/drivers/misc/mic/scif/scif_fence.c
+index cac3bcc308a7..7bb929f05d85 100644
+--- a/drivers/misc/mic/scif/scif_fence.c
++++ b/drivers/misc/mic/scif/scif_fence.c
+@@ -272,7 +272,7 @@ static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
+ dma_fail:
+ if (!x100)
+ dma_pool_free(ep->remote_dev->signal_pool, status,
+- status->src_dma_addr);
++ src - offsetof(struct scif_status, val));
+ alloc_fail:
+ return err;
+ }
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index f171cce5197d..673f6a9616cd 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -390,7 +390,6 @@ struct msdc_host {
+ struct clk *src_clk_cg; /* msdc source clock control gate */
+ u32 mclk; /* mmc subsystem clock frequency */
+ u32 src_clk_freq; /* source clock frequency */
+- u32 sclk; /* SD/MS bus clock frequency */
+ unsigned char timing;
+ bool vqmmc_enabled;
+ u32 latch_ck;
+@@ -635,10 +634,10 @@ static void msdc_set_timeout(struct msdc_host *host, u32 ns, u32 clks)
+
+ host->timeout_ns = ns;
+ host->timeout_clks = clks;
+- if (host->sclk == 0) {
++ if (host->mmc->actual_clock == 0) {
+ timeout = 0;
+ } else {
+- clk_ns = 1000000000UL / host->sclk;
++ clk_ns = 1000000000UL / host->mmc->actual_clock;
+ timeout = (ns + clk_ns - 1) / clk_ns + clks;
+ /* in 1048576 sclk cycle unit */
+ timeout = (timeout + (0x1 << 20) - 1) >> 20;
+@@ -683,6 +682,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
+ if (!hz) {
+ dev_dbg(host->dev, "set mclk to 0\n");
+ host->mclk = 0;
++ host->mmc->actual_clock = 0;
+ sdr_clr_bits(host->base + MSDC_CFG, MSDC_CFG_CKPDN);
+ return;
+ }
+@@ -761,7 +761,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
+ while (!(readl(host->base + MSDC_CFG) & MSDC_CFG_CKSTB))
+ cpu_relax();
+ sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_CKPDN);
+- host->sclk = sclk;
++ host->mmc->actual_clock = sclk;
+ host->mclk = hz;
+ host->timing = timing;
+ /* need because clk changed. */
+@@ -772,7 +772,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
+ * mmc_select_hs400() will drop to 50Mhz and High speed mode,
+ * tune result of hs200/200Mhz is not suitable for 50Mhz
+ */
+- if (host->sclk <= 52000000) {
++ if (host->mmc->actual_clock <= 52000000) {
+ writel(host->def_tune_para.iocon, host->base + MSDC_IOCON);
+ writel(host->def_tune_para.pad_tune, host->base + tune_reg);
+ } else {
+@@ -787,7 +787,8 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
+ sdr_set_field(host->base + tune_reg,
+ MSDC_PAD_TUNE_CMDRRDLY,
+ host->hs400_cmd_int_delay);
+- dev_dbg(host->dev, "sclk: %d, timing: %d\n", host->sclk, timing);
++ dev_dbg(host->dev, "sclk: %d, timing: %d\n", host->mmc->actual_clock,
++ timing);
+ }
+
+ static inline u32 msdc_cmd_find_resp(struct msdc_host *host,
+@@ -1055,6 +1056,7 @@ static void msdc_start_command(struct msdc_host *host,
+ WARN_ON(host->cmd);
+ host->cmd = cmd;
+
++ mod_delayed_work(system_wq, &host->req_timeout, DAT_TIMEOUT);
+ if (!msdc_cmd_is_ready(host, mrq, cmd))
+ return;
+
+@@ -1066,7 +1068,6 @@ static void msdc_start_command(struct msdc_host *host,
+
+ cmd->error = 0;
+ rawcmd = msdc_cmd_prepare_raw_cmd(host, mrq, cmd);
+- mod_delayed_work(system_wq, &host->req_timeout, DAT_TIMEOUT);
+
+ sdr_set_bits(host->base + MSDC_INTEN, cmd_ints_mask);
+ writel(cmd->arg, host->base + SDC_ARG);
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index ca3655d28e00..17cec68e56b4 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -1099,12 +1099,16 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++ bcm_sf2_gphy_enable_set(priv->dev->ds, true);
++
+ ret = bcm_sf2_mdio_register(ds);
+ if (ret) {
+ pr_err("failed to register MDIO bus\n");
+ return ret;
+ }
+
++ bcm_sf2_gphy_enable_set(priv->dev->ds, false);
++
+ ret = bcm_sf2_cfp_rst(priv);
+ if (ret) {
+ pr_err("failed to reset CFP\n");
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index d075f0f7a3de..411ae9961bf4 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3028,7 +3028,7 @@ static const struct mv88e6xxx_ops mv88e6141_ops = {
+ .port_set_link = mv88e6xxx_port_set_link,
+ .port_set_duplex = mv88e6xxx_port_set_duplex,
+ .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
+- .port_set_speed = mv88e6390_port_set_speed,
++ .port_set_speed = mv88e6341_port_set_speed,
+ .port_tag_remap = mv88e6095_port_tag_remap,
+ .port_set_frame_mode = mv88e6351_port_set_frame_mode,
+ .port_set_egress_floods = mv88e6352_port_set_egress_floods,
+@@ -3649,7 +3649,7 @@ static const struct mv88e6xxx_ops mv88e6341_ops = {
+ .port_set_link = mv88e6xxx_port_set_link,
+ .port_set_duplex = mv88e6xxx_port_set_duplex,
+ .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
+- .port_set_speed = mv88e6390_port_set_speed,
++ .port_set_speed = mv88e6341_port_set_speed,
+ .port_tag_remap = mv88e6095_port_tag_remap,
+ .port_set_frame_mode = mv88e6351_port_set_frame_mode,
+ .port_set_egress_floods = mv88e6352_port_set_egress_floods,
+diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
+index fdeddbfa829d..2f16a310c110 100644
+--- a/drivers/net/dsa/mv88e6xxx/port.c
++++ b/drivers/net/dsa/mv88e6xxx/port.c
+@@ -228,8 +228,11 @@ static int mv88e6xxx_port_set_speed(struct mv88e6xxx_chip *chip, int port,
+ ctrl = MV88E6XXX_PORT_MAC_CTL_SPEED_1000;
+ break;
+ case 2500:
+- ctrl = MV88E6390_PORT_MAC_CTL_SPEED_10000 |
+- MV88E6390_PORT_MAC_CTL_ALTSPEED;
++ if (alt_bit)
++ ctrl = MV88E6390_PORT_MAC_CTL_SPEED_10000 |
++ MV88E6390_PORT_MAC_CTL_ALTSPEED;
++ else
++ ctrl = MV88E6390_PORT_MAC_CTL_SPEED_10000;
+ break;
+ case 10000:
+ /* all bits set, fall through... */
+@@ -291,6 +294,24 @@ int mv88e6185_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed)
+ return mv88e6xxx_port_set_speed(chip, port, speed, false, false);
+ }
+
++/* Support 10, 100, 200, 1000, 2500 Mbps (e.g. 88E6341) */
++int mv88e6341_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed)
++{
++ if (speed == SPEED_MAX)
++ speed = port < 5 ? 1000 : 2500;
++
++ if (speed > 2500)
++ return -EOPNOTSUPP;
++
++ if (speed == 200 && port != 0)
++ return -EOPNOTSUPP;
++
++ if (speed == 2500 && port < 5)
++ return -EOPNOTSUPP;
++
++ return mv88e6xxx_port_set_speed(chip, port, speed, !port, true);
++}
++
+ /* Support 10, 100, 200, 1000 Mbps (e.g. 88E6352 family) */
+ int mv88e6352_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed)
+ {
+diff --git a/drivers/net/dsa/mv88e6xxx/port.h b/drivers/net/dsa/mv88e6xxx/port.h
+index 95b59f5eb393..cbb64a7683e2 100644
+--- a/drivers/net/dsa/mv88e6xxx/port.h
++++ b/drivers/net/dsa/mv88e6xxx/port.h
+@@ -280,6 +280,7 @@ int mv88e6xxx_port_set_duplex(struct mv88e6xxx_chip *chip, int port, int dup);
+
+ int mv88e6065_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
+ int mv88e6185_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
++int mv88e6341_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
+ int mv88e6352_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
+ int mv88e6390_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
+ int mv88e6390x_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
+diff --git a/drivers/net/ethernet/amazon/Kconfig b/drivers/net/ethernet/amazon/Kconfig
+index 99b30353541a..9e87d7b8360f 100644
+--- a/drivers/net/ethernet/amazon/Kconfig
++++ b/drivers/net/ethernet/amazon/Kconfig
+@@ -17,7 +17,7 @@ if NET_VENDOR_AMAZON
+
+ config ENA_ETHERNET
+ tristate "Elastic Network Adapter (ENA) support"
+- depends on (PCI_MSI && X86)
++ depends on PCI_MSI && !CPU_BIG_ENDIAN
+ ---help---
+ This driver supports Elastic Network Adapter (ENA)"
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index bb60104b4f80..338d22380434 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1169,7 +1169,7 @@ static int bcmgenet_power_down(struct bcmgenet_priv *priv,
+ break;
+ }
+
+- return 0;
++ return ret;
+ }
+
+ static void bcmgenet_power_up(struct bcmgenet_priv *priv,
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 74eeb3a985bf..f175b20ac510 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1721,7 +1721,7 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)
+ padlen = 0;
+ /* No room for FCS, need to reallocate skb. */
+ else
+- padlen = ETH_FCS_LEN - tailroom;
++ padlen = ETH_FCS_LEN;
+ } else {
+ /* Add room for FCS. */
+ padlen += ETH_FCS_LEN;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index e11a7de20b8f..3708f149d0a6 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -2547,7 +2547,7 @@ static int hns3_get_vector_ring_chain(struct hns3_enet_tqp_vector *tqp_vector,
+ chain = devm_kzalloc(&pdev->dev, sizeof(*chain),
+ GFP_KERNEL);
+ if (!chain)
+- return -ENOMEM;
++ goto err_free_chain;
+
+ cur_chain->next = chain;
+ chain->tqp_index = tx_ring->tqp->tqp_index;
+@@ -2577,7 +2577,7 @@ static int hns3_get_vector_ring_chain(struct hns3_enet_tqp_vector *tqp_vector,
+ while (rx_ring) {
+ chain = devm_kzalloc(&pdev->dev, sizeof(*chain), GFP_KERNEL);
+ if (!chain)
+- return -ENOMEM;
++ goto err_free_chain;
+
+ cur_chain->next = chain;
+ chain->tqp_index = rx_ring->tqp->tqp_index;
+@@ -2592,6 +2592,16 @@ static int hns3_get_vector_ring_chain(struct hns3_enet_tqp_vector *tqp_vector,
+ }
+
+ return 0;
++
++err_free_chain:
++ cur_chain = head->next;
++ while (cur_chain) {
++ chain = cur_chain->next;
++ devm_kfree(&pdev->dev, chain);
++ cur_chain = chain;
++ }
++
++ return -ENOMEM;
+ }
+
+ static void hns3_free_vector_ring_chain(struct hns3_enet_tqp_vector *tqp_vector,
+@@ -2836,8 +2846,10 @@ static int hns3_queue_to_ring(struct hnae3_queue *tqp,
+ return ret;
+
+ ret = hns3_ring_get_cfg(tqp, priv, HNAE3_RING_TYPE_RX);
+- if (ret)
++ if (ret) {
++ devm_kfree(priv->dev, priv->ring_data[tqp->tqp_index].ring);
+ return ret;
++ }
+
+ return 0;
+ }
+@@ -2864,6 +2876,12 @@ static int hns3_get_ring_config(struct hns3_nic_priv *priv)
+
+ return 0;
+ err:
++ while (i--) {
++ devm_kfree(priv->dev, priv->ring_data[i].ring);
++ devm_kfree(priv->dev,
++ priv->ring_data[i + h->kinfo.num_tqps].ring);
++ }
++
+ devm_kfree(&pdev->dev, priv->ring_data);
+ return ret;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+index 68026a5ad7e7..690f62ed87dc 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+@@ -24,15 +24,15 @@ static int hclge_ring_space(struct hclge_cmq_ring *ring)
+ return ring->desc_num - used - 1;
+ }
+
+-static int is_valid_csq_clean_head(struct hclge_cmq_ring *ring, int h)
++static int is_valid_csq_clean_head(struct hclge_cmq_ring *ring, int head)
+ {
+- int u = ring->next_to_use;
+- int c = ring->next_to_clean;
++ int ntu = ring->next_to_use;
++ int ntc = ring->next_to_clean;
+
+- if (unlikely(h >= ring->desc_num))
+- return 0;
++ if (ntu > ntc)
++ return head >= ntc && head <= ntu;
+
+- return u > c ? (h > c && h <= u) : (h > c || h <= u);
++ return head >= ntc || head <= ntu;
+ }
+
+ static int hclge_alloc_cmd_desc(struct hclge_cmq_ring *ring)
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index b04df79f393f..f8cc8d1f0b20 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2574,7 +2574,7 @@ static irqreturn_t hclge_misc_irq_handle(int irq, void *data)
+ }
+
+ /* clear the source of interrupt if it is not cause by reset */
+- if (event_cause != HCLGE_VECTOR0_EVENT_RST) {
++ if (event_cause == HCLGE_VECTOR0_EVENT_MBX) {
+ hclge_clear_event_cause(hdev, event_cause, clearval);
+ hclge_enable_vector(&hdev->misc_vector, true);
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
+index 398971a062f4..03491e8ebb73 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
+@@ -54,7 +54,7 @@ static int hclge_mdio_write(struct mii_bus *bus, int phyid, int regnum,
+ struct hclge_desc desc;
+ int ret;
+
+- if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
++ if (test_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state))
+ return 0;
+
+ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_MDIO_CONFIG, false);
+@@ -92,7 +92,7 @@ static int hclge_mdio_read(struct mii_bus *bus, int phyid, int regnum)
+ struct hclge_desc desc;
+ int ret;
+
+- if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
++ if (test_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state))
+ return 0;
+
+ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_MDIO_CONFIG, true);
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_iov.c b/drivers/net/ethernet/intel/fm10k/fm10k_iov.c
+index e707d717012f..618032612f52 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_iov.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_iov.c
+@@ -302,6 +302,28 @@ void fm10k_iov_suspend(struct pci_dev *pdev)
+ }
+ }
+
++static void fm10k_mask_aer_comp_abort(struct pci_dev *pdev)
++{
++ u32 err_mask;
++ int pos;
++
++ pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR);
++ if (!pos)
++ return;
++
++ /* Mask the completion abort bit in the ERR_UNCOR_MASK register,
++ * preventing the device from reporting these errors to the upstream
++ * PCIe root device. This avoids bringing down platforms which upgrade
++ * non-fatal completer aborts into machine check exceptions. Completer
++ * aborts can occur whenever a VF reads a queue it doesn't own.
++ */
++ pci_read_config_dword(pdev, pos + PCI_ERR_UNCOR_MASK, &err_mask);
++ err_mask |= PCI_ERR_UNC_COMP_ABORT;
++ pci_write_config_dword(pdev, pos + PCI_ERR_UNCOR_MASK, err_mask);
++
++ mmiowb();
++}
++
+ int fm10k_iov_resume(struct pci_dev *pdev)
+ {
+ struct fm10k_intfc *interface = pci_get_drvdata(pdev);
+@@ -317,6 +339,12 @@ int fm10k_iov_resume(struct pci_dev *pdev)
+ if (!iov_data)
+ return -ENOMEM;
+
++ /* Lower severity of completer abort error reporting as
++ * the VFs can trigger this any time they read a queue
++ * that they don't own.
++ */
++ fm10k_mask_aer_comp_abort(pdev);
++
+ /* allocate hardware resources for the VFs */
+ hw->iov.ops.assign_resources(hw, num_vfs, num_vfs);
+
+@@ -460,20 +488,6 @@ void fm10k_iov_disable(struct pci_dev *pdev)
+ fm10k_iov_free_data(pdev);
+ }
+
+-static void fm10k_disable_aer_comp_abort(struct pci_dev *pdev)
+-{
+- u32 err_sev;
+- int pos;
+-
+- pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR);
+- if (!pos)
+- return;
+-
+- pci_read_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, &err_sev);
+- err_sev &= ~PCI_ERR_UNC_COMP_ABORT;
+- pci_write_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, err_sev);
+-}
+-
+ int fm10k_iov_configure(struct pci_dev *pdev, int num_vfs)
+ {
+ int current_vfs = pci_num_vf(pdev);
+@@ -495,12 +509,6 @@ int fm10k_iov_configure(struct pci_dev *pdev, int num_vfs)
+
+ /* allocate VFs if not already allocated */
+ if (num_vfs && num_vfs != current_vfs) {
+- /* Disable completer abort error reporting as
+- * the VFs can trigger this any time they read a queue
+- * that they don't own.
+- */
+- fm10k_disable_aer_comp_abort(pdev);
+-
+ err = pci_enable_sriov(pdev, num_vfs);
+ if (err) {
+ dev_err(&pdev->dev,
+diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
+index 9f4d700e09df..29ced6b74d36 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
+@@ -51,9 +51,15 @@
+ *
+ * The 40 bit 82580 SYSTIM overflows every
+ * 2^40 * 10^-9 / 60 = 18.3 minutes.
++ *
++ * SYSTIM is converted to real time using a timecounter. As
++ * timecounter_cyc2time() allows old timestamps, the timecounter
++ * needs to be updated at least once per half of the SYSTIM interval.
++ * Scheduling of delayed work is not very accurate, so we aim for 8
++ * minutes to be sure the actual interval is shorter than 9.16 minutes.
+ */
+
+-#define IGB_SYSTIM_OVERFLOW_PERIOD (HZ * 60 * 9)
++#define IGB_SYSTIM_OVERFLOW_PERIOD (HZ * 60 * 8)
+ #define IGB_PTP_TX_TIMEOUT (HZ * 15)
+ #define INCPERIOD_82576 BIT(E1000_TIMINCA_16NS_SHIFT)
+ #define INCVALUE_82576_MASK GENMASK(E1000_TIMINCA_16NS_SHIFT - 1, 0)
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+index 94c59939a8cf..e639a365ac2d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -1745,6 +1745,7 @@ static int mlx4_en_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+ err = mlx4_en_get_flow(dev, cmd, cmd->fs.location);
+ break;
+ case ETHTOOL_GRXCLSRLALL:
++ cmd->data = MAX_NUM_OF_FS_RULES;
+ while ((!err || err == -ENOENT) && priority < cmd->rule_cnt) {
+ err = mlx4_en_get_flow(dev, cmd, i);
+ if (!err)
+@@ -1811,6 +1812,7 @@ static int mlx4_en_set_channels(struct net_device *dev,
+ struct mlx4_en_dev *mdev = priv->mdev;
+ struct mlx4_en_port_profile new_prof;
+ struct mlx4_en_priv *tmp;
++ int total_tx_count;
+ int port_up = 0;
+ int xdp_count;
+ int err = 0;
+@@ -1825,13 +1827,12 @@ static int mlx4_en_set_channels(struct net_device *dev,
+
+ mutex_lock(&mdev->state_lock);
+ xdp_count = priv->tx_ring_num[TX_XDP] ? channel->rx_count : 0;
+- if (channel->tx_count * priv->prof->num_up + xdp_count >
+- priv->mdev->profile.max_num_tx_rings_p_up * priv->prof->num_up) {
++ total_tx_count = channel->tx_count * priv->prof->num_up + xdp_count;
++ if (total_tx_count > MAX_TX_RINGS) {
+ err = -EINVAL;
+ en_err(priv,
+ "Total number of TX and XDP rings (%d) exceeds the maximum supported (%d)\n",
+- channel->tx_count * priv->prof->num_up + xdp_count,
+- MAX_TX_RINGS);
++ total_tx_count, MAX_TX_RINGS);
+ goto out;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 0d7fd3f043cf..5868ec11db1a 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -92,6 +92,7 @@ int mlx4_en_alloc_tx_queue_per_tc(struct net_device *dev, u8 tc)
+ struct mlx4_en_dev *mdev = priv->mdev;
+ struct mlx4_en_port_profile new_prof;
+ struct mlx4_en_priv *tmp;
++ int total_count;
+ int port_up = 0;
+ int err = 0;
+
+@@ -105,6 +106,14 @@ int mlx4_en_alloc_tx_queue_per_tc(struct net_device *dev, u8 tc)
+ MLX4_EN_NUM_UP_HIGH;
+ new_prof.tx_ring_num[TX] = new_prof.num_tx_rings_p_up *
+ new_prof.num_up;
++ total_count = new_prof.tx_ring_num[TX] + new_prof.tx_ring_num[TX_XDP];
++ if (total_count > MAX_TX_RINGS) {
++ err = -EINVAL;
++ en_err(priv,
++ "Total number of TX and XDP rings (%d) exceeds the maximum supported (%d)\n",
++ total_count, MAX_TX_RINGS);
++ goto out;
++ }
+ err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof, true);
+ if (err)
+ goto out;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index 55ccd90beeb0..7366033cd31c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1861,7 +1861,7 @@ int mlx5_eswitch_set_vport_state(struct mlx5_eswitch *esw,
+
+ unlock:
+ mutex_unlock(&esw->state_lock);
+- return 0;
++ return err;
+ }
+
+ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index c079f85593d6..82a53317285d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -520,7 +520,7 @@ static void del_sw_flow_group(struct fs_node *node)
+
+ rhashtable_destroy(&fg->ftes_hash);
+ ida_destroy(&fg->fte_allocator);
+- if (ft->autogroup.active)
++ if (ft->autogroup.active && fg->max_ftes == ft->autogroup.group_size)
+ ft->autogroup.num_groups--;
+ err = rhltable_remove(&ft->fgs_hash,
+ &fg->hash,
+@@ -1065,6 +1065,8 @@ mlx5_create_auto_grouped_flow_table(struct mlx5_flow_namespace *ns,
+
+ ft->autogroup.active = true;
+ ft->autogroup.required_groups = max_num_groups;
++ /* We save place for flow groups in addition to max types */
++ ft->autogroup.group_size = ft->max_fte / (max_num_groups + 1);
+
+ return ft;
+ }
+@@ -1270,8 +1272,7 @@ static struct mlx5_flow_group *alloc_auto_flow_group(struct mlx5_flow_table *ft
+ return ERR_PTR(-ENOENT);
+
+ if (ft->autogroup.num_groups < ft->autogroup.required_groups)
+- /* We save place for flow groups in addition to max types */
+- group_size = ft->max_fte / (ft->autogroup.required_groups + 1);
++ group_size = ft->autogroup.group_size;
+
+ /* ft->max_fte == ft->autogroup.max_types */
+ if (group_size == 0)
+@@ -1298,7 +1299,8 @@ static struct mlx5_flow_group *alloc_auto_flow_group(struct mlx5_flow_table *ft
+ if (IS_ERR(fg))
+ goto out;
+
+- ft->autogroup.num_groups++;
++ if (group_size == ft->autogroup.group_size)
++ ft->autogroup.num_groups++;
+
+ out:
+ return fg;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+index 32070e5d993d..ba62fbce23a2 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+@@ -121,6 +121,7 @@ struct mlx5_flow_table {
+ struct {
+ bool active;
+ unsigned int required_groups;
++ unsigned int group_size;
+ unsigned int num_groups;
+ } autogroup;
+ /* Protect fwd_rules */
+diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c
+index 2cf89126fb23..d765e7a69d6b 100644
+--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c
++++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c
+@@ -86,6 +86,8 @@ retry:
+ return err;
+
+ if (fsm_state_err != MLXFW_FSM_STATE_ERR_OK) {
++ fsm_state_err = min_t(enum mlxfw_fsm_state_err,
++ fsm_state_err, MLXFW_FSM_STATE_ERR_MAX);
+ pr_err("Firmware flash failed: %s\n",
+ mlxfw_fsm_state_err_str[fsm_state_err]);
+ return -EINVAL;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+index 2ab9cf25a08a..3f54b3ca38ba 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -970,7 +970,7 @@ u32 mlxsw_sp_ipip_dev_ul_tb_id(const struct net_device *ol_dev)
+ if (d)
+ return l3mdev_fib_table(d) ? : RT_TABLE_MAIN;
+ else
+- return l3mdev_fib_table(ol_dev) ? : RT_TABLE_MAIN;
++ return RT_TABLE_MAIN;
+ }
+
+ static struct mlxsw_sp_rif *
+@@ -1532,27 +1532,10 @@ static int mlxsw_sp_netdevice_ipip_ol_vrf_event(struct mlxsw_sp *mlxsw_sp,
+ {
+ struct mlxsw_sp_ipip_entry *ipip_entry =
+ mlxsw_sp_ipip_entry_find_by_ol_dev(mlxsw_sp, ol_dev);
+- enum mlxsw_sp_l3proto ul_proto;
+- union mlxsw_sp_l3addr saddr;
+- u32 ul_tb_id;
+
+ if (!ipip_entry)
+ return 0;
+
+- /* For flat configuration cases, moving overlay to a different VRF might
+- * cause local address conflict, and the conflicting tunnels need to be
+- * demoted.
+- */
+- ul_tb_id = mlxsw_sp_ipip_dev_ul_tb_id(ol_dev);
+- ul_proto = mlxsw_sp->router->ipip_ops_arr[ipip_entry->ipipt]->ul_proto;
+- saddr = mlxsw_sp_ipip_netdev_saddr(ul_proto, ol_dev);
+- if (mlxsw_sp_ipip_demote_tunnel_by_saddr(mlxsw_sp, ul_proto,
+- saddr, ul_tb_id,
+- ipip_entry)) {
+- mlxsw_sp_ipip_entry_demote_tunnel(mlxsw_sp, ipip_entry);
+- return 0;
+- }
+-
+ return __mlxsw_sp_ipip_entry_update_tunnel(mlxsw_sp, ipip_entry,
+ true, false, false, extack);
+ }
+diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.h b/drivers/net/ethernet/netronome/nfp/bpf/main.h
+index dbd00982fd2b..2134045e14c3 100644
+--- a/drivers/net/ethernet/netronome/nfp/bpf/main.h
++++ b/drivers/net/ethernet/netronome/nfp/bpf/main.h
+@@ -206,6 +206,11 @@ enum nfp_bpf_map_use {
+ NFP_MAP_USE_ATOMIC_CNT,
+ };
+
++struct nfp_bpf_map_word {
++ unsigned char type :4;
++ unsigned char non_zero_update :1;
++};
++
+ /**
+ * struct nfp_bpf_map - private per-map data attached to BPF maps for offload
+ * @offmap: pointer to the offloaded BPF map
+@@ -219,7 +224,7 @@ struct nfp_bpf_map {
+ struct nfp_app_bpf *bpf;
+ u32 tid;
+ struct list_head l;
+- enum nfp_bpf_map_use use_map[];
++ struct nfp_bpf_map_word use_map[];
+ };
+
+ struct nfp_bpf_neutral_map {
+diff --git a/drivers/net/ethernet/netronome/nfp/bpf/offload.c b/drivers/net/ethernet/netronome/nfp/bpf/offload.c
+index 1ccd6371a15b..6140e4650b71 100644
+--- a/drivers/net/ethernet/netronome/nfp/bpf/offload.c
++++ b/drivers/net/ethernet/netronome/nfp/bpf/offload.c
+@@ -299,10 +299,25 @@ static void nfp_map_bpf_byte_swap(struct nfp_bpf_map *nfp_map, void *value)
+ unsigned int i;
+
+ for (i = 0; i < DIV_ROUND_UP(nfp_map->offmap->map.value_size, 4); i++)
+- if (nfp_map->use_map[i] == NFP_MAP_USE_ATOMIC_CNT)
++ if (nfp_map->use_map[i].type == NFP_MAP_USE_ATOMIC_CNT)
+ word[i] = (__force u32)cpu_to_be32(word[i]);
+ }
+
++/* Mark value as unsafely initialized in case it becomes atomic later
++ * and we didn't byte swap something non-byte swap neutral.
++ */
++static void
++nfp_map_bpf_byte_swap_record(struct nfp_bpf_map *nfp_map, void *value)
++{
++ u32 *word = value;
++ unsigned int i;
++
++ for (i = 0; i < DIV_ROUND_UP(nfp_map->offmap->map.value_size, 4); i++)
++ if (nfp_map->use_map[i].type == NFP_MAP_UNUSED &&
++ word[i] != (__force u32)cpu_to_be32(word[i]))
++ nfp_map->use_map[i].non_zero_update = 1;
++}
++
+ static int
+ nfp_bpf_map_lookup_entry(struct bpf_offloaded_map *offmap,
+ void *key, void *value)
+@@ -322,6 +337,7 @@ nfp_bpf_map_update_entry(struct bpf_offloaded_map *offmap,
+ void *key, void *value, u64 flags)
+ {
+ nfp_map_bpf_byte_swap(offmap->dev_priv, value);
++ nfp_map_bpf_byte_swap_record(offmap->dev_priv, value);
+ return nfp_bpf_ctrl_update_entry(offmap, key, value, flags);
+ }
+
+diff --git a/drivers/net/ethernet/netronome/nfp/bpf/verifier.c b/drivers/net/ethernet/netronome/nfp/bpf/verifier.c
+index a6e9248669e1..db7e186dae56 100644
+--- a/drivers/net/ethernet/netronome/nfp/bpf/verifier.c
++++ b/drivers/net/ethernet/netronome/nfp/bpf/verifier.c
+@@ -108,6 +108,46 @@ exit_set_location:
+ nfp_prog->adjust_head_location = location;
+ }
+
++static bool nfp_bpf_map_update_value_ok(struct bpf_verifier_env *env)
++{
++ const struct bpf_reg_state *reg1 = cur_regs(env) + BPF_REG_1;
++ const struct bpf_reg_state *reg3 = cur_regs(env) + BPF_REG_3;
++ struct bpf_offloaded_map *offmap;
++ struct bpf_func_state *state;
++ struct nfp_bpf_map *nfp_map;
++ int off, i;
++
++ state = env->cur_state->frame[reg3->frameno];
++
++ /* We need to record each time update happens with non-zero words,
++ * in case such word is used in atomic operations.
++ * Implicitly depend on nfp_bpf_stack_arg_ok(reg3) being run before.
++ */
++
++ offmap = map_to_offmap(reg1->map_ptr);
++ nfp_map = offmap->dev_priv;
++ off = reg3->off + reg3->var_off.value;
++
++ for (i = 0; i < offmap->map.value_size; i++) {
++ struct bpf_stack_state *stack_entry;
++ unsigned int soff;
++
++ soff = -(off + i) - 1;
++ stack_entry = &state->stack[soff / BPF_REG_SIZE];
++ if (stack_entry->slot_type[soff % BPF_REG_SIZE] == STACK_ZERO)
++ continue;
++
++ if (nfp_map->use_map[i / 4].type == NFP_MAP_USE_ATOMIC_CNT) {
++ pr_vlog(env, "value at offset %d/%d may be non-zero, bpf_map_update_elem() is required to initialize atomic counters to zero to avoid offload endian issues\n",
++ i, soff);
++ return false;
++ }
++ nfp_map->use_map[i / 4].non_zero_update = 1;
++ }
++
++ return true;
++}
++
+ static int
+ nfp_bpf_stack_arg_ok(const char *fname, struct bpf_verifier_env *env,
+ const struct bpf_reg_state *reg,
+@@ -198,7 +238,8 @@ nfp_bpf_check_call(struct nfp_prog *nfp_prog, struct bpf_verifier_env *env,
+ bpf->helpers.map_update, reg1) ||
+ !nfp_bpf_stack_arg_ok("map_update", env, reg2,
+ meta->func_id ? &meta->arg2 : NULL) ||
+- !nfp_bpf_stack_arg_ok("map_update", env, reg3, NULL))
++ !nfp_bpf_stack_arg_ok("map_update", env, reg3, NULL) ||
++ !nfp_bpf_map_update_value_ok(env))
+ return -EOPNOTSUPP;
+ break;
+
+@@ -376,15 +417,22 @@ nfp_bpf_map_mark_used_one(struct bpf_verifier_env *env,
+ struct nfp_bpf_map *nfp_map,
+ unsigned int off, enum nfp_bpf_map_use use)
+ {
+- if (nfp_map->use_map[off / 4] != NFP_MAP_UNUSED &&
+- nfp_map->use_map[off / 4] != use) {
++ if (nfp_map->use_map[off / 4].type != NFP_MAP_UNUSED &&
++ nfp_map->use_map[off / 4].type != use) {
+ pr_vlog(env, "map value use type conflict %s vs %s off: %u\n",
+- nfp_bpf_map_use_name(nfp_map->use_map[off / 4]),
++ nfp_bpf_map_use_name(nfp_map->use_map[off / 4].type),
+ nfp_bpf_map_use_name(use), off);
+ return -EOPNOTSUPP;
+ }
+
+- nfp_map->use_map[off / 4] = use;
++ if (nfp_map->use_map[off / 4].non_zero_update &&
++ use == NFP_MAP_USE_ATOMIC_CNT) {
++ pr_vlog(env, "atomic counter in map value may already be initialized to non-zero value off: %u\n",
++ off);
++ return -EOPNOTSUPP;
++ }
++
++ nfp_map->use_map[off / 4].type = use;
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
+index a60e1c8d470a..32e786a3952b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed.h
++++ b/drivers/net/ethernet/qlogic/qed/qed.h
+@@ -914,7 +914,7 @@ u16 qed_get_cm_pq_idx_llt_mtc(struct qed_hwfn *p_hwfn, u8 tc);
+ /* Prototypes */
+ int qed_fill_dev_info(struct qed_dev *cdev,
+ struct qed_dev_info *dev_info);
+-void qed_link_update(struct qed_hwfn *hwfn);
++void qed_link_update(struct qed_hwfn *hwfn, struct qed_ptt *ptt);
+ u32 qed_unzip_data(struct qed_hwfn *p_hwfn,
+ u32 input_len, u8 *input_buf,
+ u32 max_size, u8 *unzip_buf);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
+index 637687b766ff..049a83b40e46 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -1462,6 +1462,7 @@ static int qed_get_link_data(struct qed_hwfn *hwfn,
+ }
+
+ static void qed_fill_link(struct qed_hwfn *hwfn,
++ struct qed_ptt *ptt,
+ struct qed_link_output *if_link)
+ {
+ struct qed_mcp_link_params params;
+@@ -1542,7 +1543,7 @@ static void qed_fill_link(struct qed_hwfn *hwfn,
+
+ /* TODO - fill duplex properly */
+ if_link->duplex = DUPLEX_FULL;
+- qed_mcp_get_media_type(hwfn->cdev, &media_type);
++ qed_mcp_get_media_type(hwfn, ptt, &media_type);
+ if_link->port = qed_get_port_type(media_type);
+
+ if_link->autoneg = params.speed.autoneg;
+@@ -1598,21 +1599,34 @@ static void qed_fill_link(struct qed_hwfn *hwfn,
+ static void qed_get_current_link(struct qed_dev *cdev,
+ struct qed_link_output *if_link)
+ {
++ struct qed_hwfn *hwfn;
++ struct qed_ptt *ptt;
+ int i;
+
+- qed_fill_link(&cdev->hwfns[0], if_link);
++ hwfn = &cdev->hwfns[0];
++ if (IS_PF(cdev)) {
++ ptt = qed_ptt_acquire(hwfn);
++ if (ptt) {
++ qed_fill_link(hwfn, ptt, if_link);
++ qed_ptt_release(hwfn, ptt);
++ } else {
++ DP_NOTICE(hwfn, "Failed to fill link; No PTT\n");
++ }
++ } else {
++ qed_fill_link(hwfn, NULL, if_link);
++ }
+
+ for_each_hwfn(cdev, i)
+ qed_inform_vf_link_state(&cdev->hwfns[i]);
+ }
+
+-void qed_link_update(struct qed_hwfn *hwfn)
++void qed_link_update(struct qed_hwfn *hwfn, struct qed_ptt *ptt)
+ {
+ void *cookie = hwfn->cdev->ops_cookie;
+ struct qed_common_cb_ops *op = hwfn->cdev->protocol_ops.common;
+ struct qed_link_output if_link;
+
+- qed_fill_link(hwfn, &if_link);
++ qed_fill_link(hwfn, ptt, &if_link);
+ qed_inform_vf_link_state(hwfn);
+
+ if (IS_LEAD_HWFN(hwfn) && cookie)
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+index 58c7eb9d8e1b..938ace333af1 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -1382,7 +1382,7 @@ static void qed_mcp_handle_link_change(struct qed_hwfn *p_hwfn,
+ if (p_hwfn->mcp_info->capabilities & FW_MB_PARAM_FEATURE_SUPPORT_EEE)
+ qed_mcp_read_eee_config(p_hwfn, p_ptt, p_link);
+
+- qed_link_update(p_hwfn);
++ qed_link_update(p_hwfn, p_ptt);
+ out:
+ spin_unlock_bh(&p_hwfn->mcp_info->link_lock);
+ }
+@@ -1849,12 +1849,10 @@ int qed_mcp_get_mbi_ver(struct qed_hwfn *p_hwfn,
+ return 0;
+ }
+
+-int qed_mcp_get_media_type(struct qed_dev *cdev, u32 *p_media_type)
++int qed_mcp_get_media_type(struct qed_hwfn *p_hwfn,
++ struct qed_ptt *p_ptt, u32 *p_media_type)
+ {
+- struct qed_hwfn *p_hwfn = &cdev->hwfns[0];
+- struct qed_ptt *p_ptt;
+-
+- if (IS_VF(cdev))
++ if (IS_VF(p_hwfn->cdev))
+ return -EINVAL;
+
+ if (!qed_mcp_is_init(p_hwfn)) {
+@@ -1862,16 +1860,15 @@ int qed_mcp_get_media_type(struct qed_dev *cdev, u32 *p_media_type)
+ return -EBUSY;
+ }
+
+- *p_media_type = MEDIA_UNSPECIFIED;
+-
+- p_ptt = qed_ptt_acquire(p_hwfn);
+- if (!p_ptt)
+- return -EBUSY;
+-
+- *p_media_type = qed_rd(p_hwfn, p_ptt, p_hwfn->mcp_info->port_addr +
+- offsetof(struct public_port, media_type));
++ if (!p_ptt) {
++ *p_media_type = MEDIA_UNSPECIFIED;
++ return -EINVAL;
++ }
+
+- qed_ptt_release(p_hwfn, p_ptt);
++ *p_media_type = qed_rd(p_hwfn, p_ptt,
++ p_hwfn->mcp_info->port_addr +
++ offsetof(struct public_port,
++ media_type));
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.h b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
+index 85e6b3989e7a..80a6b5d1ff33 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
+@@ -322,14 +322,15 @@ int qed_mcp_get_mbi_ver(struct qed_hwfn *p_hwfn,
+ * @brief Get media type value of the port.
+ *
+ * @param cdev - qed dev pointer
++ * @param p_ptt
+ * @param mfw_ver - media type value
+ *
+ * @return int -
+ * 0 - Operation was successul.
+ * -EBUSY - Operation failed
+ */
+-int qed_mcp_get_media_type(struct qed_dev *cdev,
+- u32 *media_type);
++int qed_mcp_get_media_type(struct qed_hwfn *p_hwfn,
++ struct qed_ptt *p_ptt, u32 *media_type);
+
+ /**
+ * @brief General function for sending commands to the MCP
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+index 6ab3fb008139..5dda547772c1 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+@@ -1698,7 +1698,7 @@ static void qed_handle_bulletin_change(struct qed_hwfn *hwfn)
+ ops->ports_update(cookie, vxlan_port, geneve_port);
+
+ /* Always update link configuration according to bulletin */
+- qed_link_update(hwfn);
++ qed_link_update(hwfn, NULL);
+ }
+
+ void qed_iov_vf_task(struct work_struct *work)
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+index 4b76c69fe86d..834208e55f7b 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+@@ -883,7 +883,7 @@ static u8 qlcnic_dcb_get_capability(struct net_device *netdev, int capid,
+ struct qlcnic_adapter *adapter = netdev_priv(netdev);
+
+ if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
+- return 0;
++ return 1;
+
+ switch (capid) {
+ case DCB_CAP_ATTR_PG:
+diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
+index f21661532ed3..cc8fbf398c0d 100644
+--- a/drivers/net/ethernet/sfc/ptp.c
++++ b/drivers/net/ethernet/sfc/ptp.c
+@@ -1534,7 +1534,8 @@ void efx_ptp_remove(struct efx_nic *efx)
+ (void)efx_ptp_disable(efx);
+
+ cancel_work_sync(&efx->ptp_data->work);
+- cancel_work_sync(&efx->ptp_data->pps_work);
++ if (efx->ptp_data->pps_workwq)
++ cancel_work_sync(&efx->ptp_data->pps_work);
+
+ skb_queue_purge(&efx->ptp_data->rxq);
+ skb_queue_purge(&efx->ptp_data->txq);
+diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
+index d2caeb9edc04..28d582c18afb 100644
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -274,6 +274,7 @@ struct netsec_priv {
+ struct clk *clk;
+ u32 msg_enable;
+ u32 freq;
++ u32 phy_addr;
+ bool rx_cksum_offload_flag;
+ };
+
+@@ -1346,11 +1347,11 @@ static int netsec_netdev_stop(struct net_device *ndev)
+ netsec_uninit_pkt_dring(priv, NETSEC_RING_TX);
+ netsec_uninit_pkt_dring(priv, NETSEC_RING_RX);
+
+- ret = netsec_reset_hardware(priv, false);
+-
+ phy_stop(ndev->phydev);
+ phy_disconnect(ndev->phydev);
+
++ ret = netsec_reset_hardware(priv, false);
++
+ pm_runtime_put_sync(priv->dev);
+
+ return ret;
+@@ -1360,6 +1361,7 @@ static int netsec_netdev_init(struct net_device *ndev)
+ {
+ struct netsec_priv *priv = netdev_priv(ndev);
+ int ret;
++ u16 data;
+
+ ret = netsec_alloc_dring(priv, NETSEC_RING_TX);
+ if (ret)
+@@ -1369,6 +1371,11 @@ static int netsec_netdev_init(struct net_device *ndev)
+ if (ret)
+ goto err1;
+
++ /* set phy power down */
++ data = netsec_phy_read(priv->mii_bus, priv->phy_addr, MII_BMCR) |
++ BMCR_PDOWN;
++ netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR, data);
++
+ ret = netsec_reset_hardware(priv, true);
+ if (ret)
+ goto err2;
+@@ -1418,7 +1425,7 @@ static const struct net_device_ops netsec_netdev_ops = {
+ };
+
+ static int netsec_of_probe(struct platform_device *pdev,
+- struct netsec_priv *priv)
++ struct netsec_priv *priv, u32 *phy_addr)
+ {
+ priv->phy_np = of_parse_phandle(pdev->dev.of_node, "phy-handle", 0);
+ if (!priv->phy_np) {
+@@ -1426,6 +1433,8 @@ static int netsec_of_probe(struct platform_device *pdev,
+ return -EINVAL;
+ }
+
++ *phy_addr = of_mdio_parse_addr(&pdev->dev, priv->phy_np);
++
+ priv->clk = devm_clk_get(&pdev->dev, NULL); /* get by 'phy_ref_clk' */
+ if (IS_ERR(priv->clk)) {
+ dev_err(&pdev->dev, "phy_ref_clk not found\n");
+@@ -1626,12 +1635,14 @@ static int netsec_probe(struct platform_device *pdev)
+ }
+
+ if (dev_of_node(&pdev->dev))
+- ret = netsec_of_probe(pdev, priv);
++ ret = netsec_of_probe(pdev, priv, &phy_addr);
+ else
+ ret = netsec_acpi_probe(pdev, priv, &phy_addr);
+ if (ret)
+ goto free_ndev;
+
++ priv->phy_addr = phy_addr;
++
+ if (!priv->freq) {
+ dev_err(&pdev->dev, "missing PHY reference clock frequency\n");
+ ret = -ENODEV;
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index 1afed85550c0..8417d4c17844 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -642,6 +642,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
+
+ /* Clear all mcast from ALE */
+ cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS, -1);
++ __dev_mc_unsync(ndev, NULL);
+
+ /* Flood All Unicast Packets to Host port */
+ cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 05115fb0c97a..10a8ef2d025a 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -2813,9 +2813,6 @@ static int macsec_dev_open(struct net_device *dev)
+ struct net_device *real_dev = macsec->real_dev;
+ int err;
+
+- if (!(real_dev->flags & IFF_UP))
+- return -ENETDOWN;
+-
+ err = dev_uc_add(real_dev, dev->dev_addr);
+ if (err < 0)
+ return err;
+@@ -3305,6 +3302,9 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ if (err < 0)
+ goto del_dev;
+
++ netif_stacked_transfer_operstate(real_dev, dev);
++ linkwatch_fire_event(dev);
++
+ macsec_generation++;
+
+ return 0;
+@@ -3489,6 +3489,20 @@ static int macsec_notify(struct notifier_block *this, unsigned long event,
+ return NOTIFY_DONE;
+
+ switch (event) {
++ case NETDEV_DOWN:
++ case NETDEV_UP:
++ case NETDEV_CHANGE: {
++ struct macsec_dev *m, *n;
++ struct macsec_rxh_data *rxd;
++
++ rxd = macsec_data_rtnl(real_dev);
++ list_for_each_entry_safe(m, n, &rxd->secys, secys) {
++ struct net_device *dev = m->secy.netdev;
++
++ netif_stacked_transfer_operstate(real_dev, dev);
++ }
++ break;
++ }
+ case NETDEV_UNREGISTER: {
+ struct macsec_dev *m, *n;
+ struct macsec_rxh_data *rxd;
+diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c
+index b12023bc2cab..df8d49ad48c3 100644
+--- a/drivers/net/ntb_netdev.c
++++ b/drivers/net/ntb_netdev.c
+@@ -236,7 +236,7 @@ static void ntb_netdev_tx_timer(struct timer_list *t)
+ struct net_device *ndev = dev->ndev;
+
+ if (ntb_transport_tx_free_entry(dev->qp) < tx_stop) {
+- mod_timer(&dev->tx_timer, jiffies + msecs_to_jiffies(tx_time));
++ mod_timer(&dev->tx_timer, jiffies + usecs_to_jiffies(tx_time));
+ } else {
+ /* Make sure anybody stopping the queue after this sees the new
+ * value of ntb_transport_tx_free_entry()
+diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
+index e4bf9e7d7583..eeadfde15940 100644
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -33,10 +33,18 @@
+
+ /* Extended Registers */
+ #define DP83867_CFG4 0x0031
++#define DP83867_CFG4_SGMII_ANEG_MASK (BIT(5) | BIT(6))
++#define DP83867_CFG4_SGMII_ANEG_TIMER_11MS (3 << 5)
++#define DP83867_CFG4_SGMII_ANEG_TIMER_800US (2 << 5)
++#define DP83867_CFG4_SGMII_ANEG_TIMER_2US (1 << 5)
++#define DP83867_CFG4_SGMII_ANEG_TIMER_16MS (0 << 5)
++
+ #define DP83867_RGMIICTL 0x0032
+ #define DP83867_STRAP_STS1 0x006E
+ #define DP83867_RGMIIDCTL 0x0086
+ #define DP83867_IO_MUX_CFG 0x0170
++#define DP83867_10M_SGMII_CFG 0x016F
++#define DP83867_10M_SGMII_RATE_ADAPT_MASK BIT(7)
+
+ #define DP83867_SW_RESET BIT(15)
+ #define DP83867_SW_RESTART BIT(14)
+@@ -294,6 +302,35 @@ static int dp83867_config_init(struct phy_device *phydev)
+ }
+ }
+
++ if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
++ /* For support SPEED_10 in SGMII mode
++ * DP83867_10M_SGMII_RATE_ADAPT bit
++ * has to be cleared by software. That
++ * does not affect SPEED_100 and
++ * SPEED_1000.
++ */
++ val = phy_read_mmd(phydev, DP83867_DEVADDR,
++ DP83867_10M_SGMII_CFG);
++ val &= ~DP83867_10M_SGMII_RATE_ADAPT_MASK;
++ ret = phy_write_mmd(phydev, DP83867_DEVADDR,
++ DP83867_10M_SGMII_CFG, val);
++
++ if (ret)
++ return ret;
++
++ /* After reset SGMII Autoneg timer is set to 2us (bits 6 and 5
++ * are 01). That is not enough to finalize autoneg on some
++ * devices. Increase this timer duration to maximum 16ms.
++ */
++ val = phy_read_mmd(phydev, DP83867_DEVADDR, DP83867_CFG4);
++ val &= ~DP83867_CFG4_SGMII_ANEG_MASK;
++ val |= DP83867_CFG4_SGMII_ANEG_TIMER_16MS;
++ ret = phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_CFG4, val);
++
++ if (ret)
++ return ret;
++ }
++
+ /* Enable Interrupt output INT_OE in CFG3 register */
+ if (phy_interrupt_is_valid(phydev)) {
+ val = phy_read(phydev, DP83867_CFG3);
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index 9f895083bc0a..7f5ee6bb4430 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -993,24 +993,23 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
+ struct sk_buff *skb)
+ {
+ int orig_iif = skb->skb_iif;
+- bool need_strict;
++ bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
++ bool is_ndisc = ipv6_ndisc_frame(skb);
+
+- /* loopback traffic; do not push through packet taps again.
+- * Reset pkt_type for upper layers to process skb
++ /* loopback, multicast & non-ND link-local traffic; do not push through
++ * packet taps again. Reset pkt_type for upper layers to process skb
+ */
+- if (skb->pkt_type == PACKET_LOOPBACK) {
++ if (skb->pkt_type == PACKET_LOOPBACK || (need_strict && !is_ndisc)) {
+ skb->dev = vrf_dev;
+ skb->skb_iif = vrf_dev->ifindex;
+ IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
+- skb->pkt_type = PACKET_HOST;
++ if (skb->pkt_type == PACKET_LOOPBACK)
++ skb->pkt_type = PACKET_HOST;
+ goto out;
+ }
+
+- /* if packet is NDISC or addressed to multicast or link-local
+- * then keep the ingress interface
+- */
+- need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
+- if (!ipv6_ndisc_frame(skb) && !need_strict) {
++ /* if packet is NDISC then keep the ingress interface */
++ if (!is_ndisc) {
+ vrf_rx_stats(vrf_dev, skb->len);
+ skb->dev = vrf_dev;
+ skb->skb_iif = vrf_dev->ifindex;
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index d3d33cc2adfd..613ca74f1b28 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -4686,6 +4686,14 @@ static int ath10k_start(struct ieee80211_hw *hw)
+ goto err_core_stop;
+ }
+
++ if (test_bit(WMI_SERVICE_SPOOF_MAC_SUPPORT, ar->wmi.svc_map)) {
++ ret = ath10k_wmi_scan_prob_req_oui(ar, ar->mac_addr);
++ if (ret) {
++ ath10k_err(ar, "failed to set prob req oui: %i\n", ret);
++ goto err_core_stop;
++ }
++ }
++
+ if (test_bit(WMI_SERVICE_ADAPTIVE_OCS, ar->wmi.svc_map)) {
+ ret = ath10k_wmi_adaptive_qcs(ar, true);
+ if (ret) {
+@@ -8551,12 +8559,6 @@ int ath10k_mac_register(struct ath10k *ar)
+ }
+
+ if (test_bit(WMI_SERVICE_SPOOF_MAC_SUPPORT, ar->wmi.svc_map)) {
+- ret = ath10k_wmi_scan_prob_req_oui(ar, ar->mac_addr);
+- if (ret) {
+- ath10k_err(ar, "failed to set prob req oui: %i\n", ret);
+- goto err_dfs_detector_exit;
+- }
+-
+ ar->hw->wiphy->features |=
+ NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
+ }
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index 97fa5c74f2fe..50a801a5d4f1 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -1054,10 +1054,9 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+ struct ath10k_ce *ce = ath10k_ce_priv(ar);
+ int ret = 0;
+ u32 *buf;
+- unsigned int completed_nbytes, orig_nbytes, remaining_bytes;
++ unsigned int completed_nbytes, alloc_nbytes, remaining_bytes;
+ struct ath10k_ce_pipe *ce_diag;
+ void *data_buf = NULL;
+- u32 ce_data; /* Host buffer address in CE space */
+ dma_addr_t ce_data_base = 0;
+ int i;
+
+@@ -1071,9 +1070,10 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+ * 1) 4-byte alignment
+ * 2) Buffer in DMA-able space
+ */
+- orig_nbytes = nbytes;
++ alloc_nbytes = min_t(unsigned int, nbytes, DIAG_TRANSFER_LIMIT);
++
+ data_buf = (unsigned char *)dma_alloc_coherent(ar->dev,
+- orig_nbytes,
++ alloc_nbytes,
+ &ce_data_base,
+ GFP_ATOMIC);
+ if (!data_buf) {
+@@ -1081,9 +1081,6 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+ goto done;
+ }
+
+- /* Copy caller's data to allocated DMA buf */
+- memcpy(data_buf, data, orig_nbytes);
+-
+ /*
+ * The address supplied by the caller is in the
+ * Target CPU virtual address space.
+@@ -1096,12 +1093,14 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+ */
+ address = ath10k_pci_targ_cpu_to_ce_addr(ar, address);
+
+- remaining_bytes = orig_nbytes;
+- ce_data = ce_data_base;
++ remaining_bytes = nbytes;
+ while (remaining_bytes) {
+ /* FIXME: check cast */
+ nbytes = min_t(int, remaining_bytes, DIAG_TRANSFER_LIMIT);
+
++ /* Copy caller's data to allocated DMA buf */
++ memcpy(data_buf, data, nbytes);
++
+ /* Set up to receive directly into Target(!) address */
+ ret = ce_diag->ops->ce_rx_post_buf(ce_diag, &address, address);
+ if (ret != 0)
+@@ -1111,7 +1110,7 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+ * Request CE to send caller-supplied data that
+ * was copied to bounce buffer to Target(!) address.
+ */
+- ret = ath10k_ce_send_nolock(ce_diag, NULL, (u32)ce_data,
++ ret = ath10k_ce_send_nolock(ce_diag, NULL, ce_data_base,
+ nbytes, 0, 0);
+ if (ret != 0)
+ goto done;
+@@ -1152,12 +1151,12 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+
+ remaining_bytes -= nbytes;
+ address += nbytes;
+- ce_data += nbytes;
++ data += nbytes;
+ }
+
+ done:
+ if (data_buf) {
+- dma_free_coherent(ar->dev, orig_nbytes, data_buf,
++ dma_free_coherent(ar->dev, alloc_nbytes, data_buf,
+ ce_data_base);
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c
+index fa1843a7e0fd..e2d78f77edb7 100644
+--- a/drivers/net/wireless/ath/ath10k/snoc.c
++++ b/drivers/net/wireless/ath/ath10k/snoc.c
+@@ -1190,7 +1190,7 @@ static int ath10k_wcn3990_clk_init(struct ath10k *ar)
+ return 0;
+
+ err_clock_config:
+- for (; i >= 0; i--) {
++ for (i = i - 1; i >= 0; i--) {
+ clk_info = &ar_snoc->clk[i];
+
+ if (!clk_info->handle)
+diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
+index f09a4ad2e9de..f9c79e21ab22 100644
+--- a/drivers/net/wireless/ath/ath10k/usb.c
++++ b/drivers/net/wireless/ath/ath10k/usb.c
+@@ -49,6 +49,10 @@ ath10k_usb_alloc_urb_from_pipe(struct ath10k_usb_pipe *pipe)
+ struct ath10k_urb_context *urb_context = NULL;
+ unsigned long flags;
+
++ /* bail if this pipe is not initialized */
++ if (!pipe->ar_usb)
++ return NULL;
++
+ spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags);
+ if (!list_empty(&pipe->urb_list_head)) {
+ urb_context = list_first_entry(&pipe->urb_list_head,
+@@ -66,6 +70,10 @@ static void ath10k_usb_free_urb_to_pipe(struct ath10k_usb_pipe *pipe,
+ {
+ unsigned long flags;
+
++ /* bail if this pipe is not initialized */
++ if (!pipe->ar_usb)
++ return;
++
+ spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags);
+
+ pipe->urb_cnt++;
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+index f019a20e5a1f..983e1abbd9e4 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -4183,7 +4183,7 @@ static void ar9003_hw_thermometer_apply(struct ath_hw *ah)
+
+ static void ar9003_hw_thermo_cal_apply(struct ath_hw *ah)
+ {
+- u32 data, ko, kg;
++ u32 data = 0, ko, kg;
+
+ if (!AR_SREV_9462_20_OR_LATER(ah))
+ return;
+diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
+index ceace95b1595..44296c015925 100644
+--- a/drivers/net/wireless/ath/wil6210/debugfs.c
++++ b/drivers/net/wireless/ath/wil6210/debugfs.c
+@@ -662,10 +662,10 @@ static ssize_t wil_read_file_ioblob(struct file *file, char __user *user_buf,
+ enum { max_count = 4096 };
+ struct wil_blob_wrapper *wil_blob = file->private_data;
+ struct wil6210_priv *wil = wil_blob->wil;
+- loff_t pos = *ppos;
++ loff_t aligned_pos, pos = *ppos;
+ size_t available = wil_blob->blob.size;
+ void *buf;
+- size_t ret;
++ size_t unaligned_bytes, aligned_count, ret;
+ int rc;
+
+ if (test_bit(wil_status_suspending, wil_blob->wil->status) ||
+@@ -683,7 +683,12 @@ static ssize_t wil_read_file_ioblob(struct file *file, char __user *user_buf,
+ if (count > max_count)
+ count = max_count;
+
+- buf = kmalloc(count, GFP_KERNEL);
++ /* set pos to 4 bytes aligned */
++ unaligned_bytes = pos % 4;
++ aligned_pos = pos - unaligned_bytes;
++ aligned_count = count + unaligned_bytes;
++
++ buf = kmalloc(aligned_count, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+@@ -694,9 +699,9 @@ static ssize_t wil_read_file_ioblob(struct file *file, char __user *user_buf,
+ }
+
+ wil_memcpy_fromio_32(buf, (const void __iomem *)
+- wil_blob->blob.data + pos, count);
++ wil_blob->blob.data + aligned_pos, aligned_count);
+
+- ret = copy_to_user(user_buf, buf, count);
++ ret = copy_to_user(user_buf, buf + unaligned_bytes, count);
+
+ wil_pm_runtime_put(wil);
+
+diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
+index 920cb233f4db..10673fa9388e 100644
+--- a/drivers/net/wireless/ath/wil6210/main.c
++++ b/drivers/net/wireless/ath/wil6210/main.c
+@@ -1397,8 +1397,15 @@ static void wil_pre_fw_config(struct wil6210_priv *wil)
+ wil6210_clear_irq(wil);
+ /* CAF_ICR - clear and mask */
+ /* it is W1C, clear by writing back same value */
+- wil_s(wil, RGF_CAF_ICR + offsetof(struct RGF_ICR, ICR), 0);
+- wil_w(wil, RGF_CAF_ICR + offsetof(struct RGF_ICR, IMV), ~0);
++ if (wil->hw_version < HW_VER_TALYN_MB) {
++ wil_s(wil, RGF_CAF_ICR + offsetof(struct RGF_ICR, ICR), 0);
++ wil_w(wil, RGF_CAF_ICR + offsetof(struct RGF_ICR, IMV), ~0);
++ } else {
++ wil_s(wil,
++ RGF_CAF_ICR_TALYN_MB + offsetof(struct RGF_ICR, ICR), 0);
++ wil_w(wil, RGF_CAF_ICR_TALYN_MB +
++ offsetof(struct RGF_ICR, IMV), ~0);
++ }
+ /* clear PAL_UNIT_ICR (potential D0->D3 leftover)
+ * In Talyn-MB host cannot access this register due to
+ * access control, hence PAL_UNIT_ICR is cleared by the FW
+diff --git a/drivers/net/wireless/ath/wil6210/txrx_edma.c b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+index 409a6fa8b6c8..5fa8d6ad6648 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx_edma.c
++++ b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+@@ -808,23 +808,24 @@ static int wil_rx_error_check_edma(struct wil6210_priv *wil,
+ wil_dbg_txrx(wil, "L2 RX error, l2_rx_status=0x%x\n",
+ l2_rx_status);
+ /* Due to HW issue, KEY error will trigger a MIC error */
+- if (l2_rx_status & WIL_RX_EDMA_ERROR_MIC) {
+- wil_dbg_txrx(wil,
+- "L2 MIC/KEY error, dropping packet\n");
++ if (l2_rx_status == WIL_RX_EDMA_ERROR_MIC) {
++ wil_err_ratelimited(wil,
++ "L2 MIC/KEY error, dropping packet\n");
+ stats->rx_mic_error++;
+ }
+- if (l2_rx_status & WIL_RX_EDMA_ERROR_KEY) {
+- wil_dbg_txrx(wil, "L2 KEY error, dropping packet\n");
++ if (l2_rx_status == WIL_RX_EDMA_ERROR_KEY) {
++ wil_err_ratelimited(wil,
++ "L2 KEY error, dropping packet\n");
+ stats->rx_key_error++;
+ }
+- if (l2_rx_status & WIL_RX_EDMA_ERROR_REPLAY) {
+- wil_dbg_txrx(wil,
+- "L2 REPLAY error, dropping packet\n");
++ if (l2_rx_status == WIL_RX_EDMA_ERROR_REPLAY) {
++ wil_err_ratelimited(wil,
++ "L2 REPLAY error, dropping packet\n");
+ stats->rx_replay++;
+ }
+- if (l2_rx_status & WIL_RX_EDMA_ERROR_AMSDU) {
+- wil_dbg_txrx(wil,
+- "L2 AMSDU error, dropping packet\n");
++ if (l2_rx_status == WIL_RX_EDMA_ERROR_AMSDU) {
++ wil_err_ratelimited(wil,
++ "L2 AMSDU error, dropping packet\n");
+ stats->rx_amsdu_error++;
+ }
+ return -EFAULT;
+diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
+index 17c294b1ead1..75fe1a3b7046 100644
+--- a/drivers/net/wireless/ath/wil6210/wil6210.h
++++ b/drivers/net/wireless/ath/wil6210/wil6210.h
+@@ -319,6 +319,7 @@ struct RGF_ICR {
+ /* MAC timer, usec, for packet lifetime */
+ #define RGF_MAC_MTRL_COUNTER_0 (0x886aa8)
+
++#define RGF_CAF_ICR_TALYN_MB (0x8893d4) /* struct RGF_ICR */
+ #define RGF_CAF_ICR (0x88946c) /* struct RGF_ICR */
+ #define RGF_CAF_OSC_CONTROL (0x88afa4)
+ #define BIT_CAF_OSC_XTAL_EN BIT(0)
+diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
+index 2010f771478d..8a603432f531 100644
+--- a/drivers/net/wireless/ath/wil6210/wmi.c
++++ b/drivers/net/wireless/ath/wil6210/wmi.c
+@@ -1639,16 +1639,17 @@ int wmi_call(struct wil6210_priv *wil, u16 cmdid, u8 mid, void *buf, u16 len,
+ {
+ int rc;
+ unsigned long remain;
++ ulong flags;
+
+ mutex_lock(&wil->wmi_mutex);
+
+- spin_lock(&wil->wmi_ev_lock);
++ spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+ wil->reply_id = reply_id;
+ wil->reply_mid = mid;
+ wil->reply_buf = reply;
+ wil->reply_size = reply_size;
+ reinit_completion(&wil->wmi_call);
+- spin_unlock(&wil->wmi_ev_lock);
++ spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
+
+ rc = __wmi_send(wil, cmdid, mid, buf, len);
+ if (rc)
+@@ -1668,12 +1669,12 @@ int wmi_call(struct wil6210_priv *wil, u16 cmdid, u8 mid, void *buf, u16 len,
+ }
+
+ out:
+- spin_lock(&wil->wmi_ev_lock);
++ spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+ wil->reply_id = 0;
+ wil->reply_mid = U8_MAX;
+ wil->reply_buf = NULL;
+ wil->reply_size = 0;
+- spin_unlock(&wil->wmi_ev_lock);
++ spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
+
+ mutex_unlock(&wil->wmi_mutex);
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+index 6255fb6d97a7..6188275b17e5 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+@@ -502,6 +502,7 @@ brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ }
+
+ spin_lock_bh(&wl->lock);
++ wl->wlc->vif = vif;
+ wl->mute_tx = false;
+ brcms_c_mute(wl->wlc, false);
+ if (vif->type == NL80211_IFTYPE_STATION)
+@@ -519,6 +520,11 @@ brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ static void
+ brcms_ops_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ {
++ struct brcms_info *wl = hw->priv;
++
++ spin_lock_bh(&wl->lock);
++ wl->wlc->vif = NULL;
++ spin_unlock_bh(&wl->lock);
+ }
+
+ static int brcms_ops_config(struct ieee80211_hw *hw, u32 changed)
+@@ -840,8 +846,8 @@ brcms_ops_ampdu_action(struct ieee80211_hw *hw,
+ status = brcms_c_aggregatable(wl->wlc, tid);
+ spin_unlock_bh(&wl->lock);
+ if (!status) {
+- brcms_err(wl->wlc->hw->d11core,
+- "START: tid %d is not agg\'able\n", tid);
++ brcms_dbg_ht(wl->wlc->hw->d11core,
++ "START: tid %d is not agg\'able\n", tid);
+ return -EINVAL;
+ }
+ ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+@@ -937,6 +943,25 @@ static void brcms_ops_set_tsf(struct ieee80211_hw *hw,
+ spin_unlock_bh(&wl->lock);
+ }
+
++static int brcms_ops_beacon_set_tim(struct ieee80211_hw *hw,
++ struct ieee80211_sta *sta, bool set)
++{
++ struct brcms_info *wl = hw->priv;
++ struct sk_buff *beacon = NULL;
++ u16 tim_offset = 0;
++
++ spin_lock_bh(&wl->lock);
++ if (wl->wlc->vif)
++ beacon = ieee80211_beacon_get_tim(hw, wl->wlc->vif,
++ &tim_offset, NULL);
++ if (beacon)
++ brcms_c_set_new_beacon(wl->wlc, beacon, tim_offset,
++ wl->wlc->vif->bss_conf.dtim_period);
++ spin_unlock_bh(&wl->lock);
++
++ return 0;
++}
++
+ static const struct ieee80211_ops brcms_ops = {
+ .tx = brcms_ops_tx,
+ .start = brcms_ops_start,
+@@ -955,6 +980,7 @@ static const struct ieee80211_ops brcms_ops = {
+ .flush = brcms_ops_flush,
+ .get_tsf = brcms_ops_get_tsf,
+ .set_tsf = brcms_ops_set_tsf,
++ .set_tim = brcms_ops_beacon_set_tim,
+ };
+
+ void brcms_dpc(unsigned long data)
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h
+index c4d135cff04a..9f76b880814e 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h
+@@ -563,6 +563,7 @@ struct brcms_c_info {
+
+ struct wiphy *wiphy;
+ struct scb pri_scb;
++ struct ieee80211_vif *vif;
+
+ struct sk_buff *beacon;
+ u16 beacon_tim_offset;
+diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
+index 04dd7a936593..5512c7f73fce 100644
+--- a/drivers/net/wireless/cisco/airo.c
++++ b/drivers/net/wireless/cisco/airo.c
+@@ -5462,7 +5462,7 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
+ we have to add a spin lock... */
+ rc = readBSSListRid(ai, doLoseSync, &BSSList_rid);
+ while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) {
+- ptr += sprintf(ptr, "%pM %*s rssi = %d",
++ ptr += sprintf(ptr, "%pM %.*s rssi = %d",
+ BSSList_rid.bssid,
+ (int)BSSList_rid.ssidLen,
+ BSSList_rid.ssid,
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 47ec5293c045..7b74ef71bef1 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -376,11 +376,20 @@ mwifiex_cfg80211_set_tx_power(struct wiphy *wiphy,
+ struct mwifiex_power_cfg power_cfg;
+ int dbm = MBM_TO_DBM(mbm);
+
+- if (type == NL80211_TX_POWER_FIXED) {
++ switch (type) {
++ case NL80211_TX_POWER_FIXED:
+ power_cfg.is_power_auto = 0;
++ power_cfg.is_power_fixed = 1;
+ power_cfg.power_level = dbm;
+- } else {
++ break;
++ case NL80211_TX_POWER_LIMITED:
++ power_cfg.is_power_auto = 0;
++ power_cfg.is_power_fixed = 0;
++ power_cfg.power_level = dbm;
++ break;
++ case NL80211_TX_POWER_AUTOMATIC:
+ power_cfg.is_power_auto = 1;
++ break;
+ }
+
+ priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
+diff --git a/drivers/net/wireless/marvell/mwifiex/ioctl.h b/drivers/net/wireless/marvell/mwifiex/ioctl.h
+index 48e154e1865d..0dd592ea6e83 100644
+--- a/drivers/net/wireless/marvell/mwifiex/ioctl.h
++++ b/drivers/net/wireless/marvell/mwifiex/ioctl.h
+@@ -267,6 +267,7 @@ struct mwifiex_ds_encrypt_key {
+
+ struct mwifiex_power_cfg {
+ u32 is_power_auto;
++ u32 is_power_fixed;
+ u32 power_level;
+ };
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+index 843d65bba181..74e50566db1f 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+@@ -688,6 +688,9 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
+ txp_cfg = (struct host_cmd_ds_txpwr_cfg *) buf;
+ txp_cfg->action = cpu_to_le16(HostCmd_ACT_GEN_SET);
+ if (!power_cfg->is_power_auto) {
++ u16 dbm_min = power_cfg->is_power_fixed ?
++ dbm : priv->min_tx_power_level;
++
+ txp_cfg->mode = cpu_to_le32(1);
+ pg_tlv = (struct mwifiex_types_power_group *)
+ (buf + sizeof(struct host_cmd_ds_txpwr_cfg));
+@@ -702,7 +705,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
+ pg->last_rate_code = 0x03;
+ pg->modulation_class = MOD_CLASS_HR_DSSS;
+ pg->power_step = 0;
+- pg->power_min = (s8) dbm;
++ pg->power_min = (s8) dbm_min;
+ pg->power_max = (s8) dbm;
+ pg++;
+ /* Power group for modulation class OFDM */
+@@ -710,7 +713,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
+ pg->last_rate_code = 0x07;
+ pg->modulation_class = MOD_CLASS_OFDM;
+ pg->power_step = 0;
+- pg->power_min = (s8) dbm;
++ pg->power_min = (s8) dbm_min;
+ pg->power_max = (s8) dbm;
+ pg++;
+ /* Power group for modulation class HTBW20 */
+@@ -718,7 +721,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
+ pg->last_rate_code = 0x20;
+ pg->modulation_class = MOD_CLASS_HT;
+ pg->power_step = 0;
+- pg->power_min = (s8) dbm;
++ pg->power_min = (s8) dbm_min;
+ pg->power_max = (s8) dbm;
+ pg->ht_bandwidth = HT_BW_20;
+ pg++;
+@@ -727,7 +730,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
+ pg->last_rate_code = 0x20;
+ pg->modulation_class = MOD_CLASS_HT;
+ pg->power_step = 0;
+- pg->power_min = (s8) dbm;
++ pg->power_min = (s8) dbm_min;
+ pg->power_max = (s8) dbm;
+ pg->ht_bandwidth = HT_BW_40;
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+index 14e8c575f6c3..924c761f34fd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c
+@@ -793,9 +793,8 @@ void mt76x0_phy_recalibrate_after_assoc(struct mt76x0_dev *dev)
+ mt76_wr(dev, MT_TX_ALC_CFG_0, 0);
+ usleep_range(500, 700);
+
+- reg_val = mt76_rr(dev, 0x2124);
+- reg_val &= 0xffffff7e;
+- mt76_wr(dev, 0x2124, reg_val);
++ reg_val = mt76_rr(dev, MT_BBP(IBI, 9));
++ mt76_wr(dev, MT_BBP(IBI, 9), 0xffffff7e);
+
+ mt76x0_mcu_calibrate(dev, MCU_CAL_RXDCOC, 0);
+
+@@ -806,7 +805,7 @@ void mt76x0_phy_recalibrate_after_assoc(struct mt76x0_dev *dev)
+ mt76x0_mcu_calibrate(dev, MCU_CAL_RXIQ, is_5ghz);
+ mt76x0_mcu_calibrate(dev, MCU_CAL_RX_GROUP_DELAY, is_5ghz);
+
+- mt76_wr(dev, 0x2124, reg_val);
++ mt76_wr(dev, MT_BBP(IBI, 9), reg_val);
+ mt76_wr(dev, MT_TX_ALC_CFG_0, tx_alc);
+ msleep(100);
+
+diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
+index 20447fdce4c3..227e5ebfe3dc 100644
+--- a/drivers/net/wireless/mediatek/mt76/tx.c
++++ b/drivers/net/wireless/mediatek/mt76/tx.c
+@@ -148,7 +148,8 @@ mt76_check_agg_ssn(struct mt76_txq *mtxq, struct sk_buff *skb)
+ {
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+
+- if (!ieee80211_is_data_qos(hdr->frame_control))
++ if (!ieee80211_is_data_qos(hdr->frame_control) ||
++ !ieee80211_is_data_present(hdr->frame_control))
+ return;
+
+ mtxq->agg_ssn = le16_to_cpu(hdr->seq_ctrl) + 0x10;
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 505ab1b055ff..2b4fcdf4ec5b 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -5691,6 +5691,7 @@ static int rtl8xxxu_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ break;
+ case WLAN_CIPHER_SUITE_TKIP:
+ key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
++ break;
+ default:
+ return -EOPNOTSUPP;
+ }
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c
+index 85cedd083d2b..75bfa9dfef4a 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c
+@@ -173,7 +173,7 @@ static int _rtl92d_fw_init(struct ieee80211_hw *hw)
+ rtl_read_byte(rtlpriv, FW_MAC1_READY));
+ }
+ RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG,
+- "Polling FW ready fail!! REG_MCUFWDL:0x%08ul\n",
++ "Polling FW ready fail!! REG_MCUFWDL:0x%08x\n",
+ rtl_read_dword(rtlpriv, REG_MCUFWDL));
+ return -1;
+ }
+diff --git a/drivers/net/wireless/ti/wlcore/vendor_cmd.c b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
+index dbe78d8491ef..7f34ec077ee5 100644
+--- a/drivers/net/wireless/ti/wlcore/vendor_cmd.c
++++ b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
+@@ -70,7 +70,7 @@ wlcore_vendor_cmd_smart_config_start(struct wiphy *wiphy,
+ out:
+ mutex_unlock(&wl->mutex);
+
+- return 0;
++ return ret;
+ }
+
+ static int
+diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
+index bb43cebda9dc..60ae382f50da 100644
+--- a/drivers/nfc/port100.c
++++ b/drivers/nfc/port100.c
+@@ -792,7 +792,7 @@ static int port100_send_frame_async(struct port100 *dev, struct sk_buff *out,
+
+ rc = port100_submit_urb_for_ack(dev, GFP_KERNEL);
+ if (rc)
+- usb_unlink_urb(dev->out_urb);
++ usb_kill_urb(dev->out_urb);
+
+ exit:
+ mutex_unlock(&dev->out_urb_lock);
+diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c
+index 6aa573227279..2ad263f708da 100644
+--- a/drivers/ntb/hw/intel/ntb_hw_gen1.c
++++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c
+@@ -265,7 +265,7 @@ static inline int ndev_db_clear_mask(struct intel_ntb_dev *ndev, u64 db_bits,
+ return 0;
+ }
+
+-static inline int ndev_vec_mask(struct intel_ntb_dev *ndev, int db_vector)
++static inline u64 ndev_vec_mask(struct intel_ntb_dev *ndev, int db_vector)
+ {
+ u64 shift, mask;
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 5d0f99bcc987..44da9fe5b27b 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3647,7 +3647,7 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
+ down_read(&ctrl->namespaces_rwsem);
+
+ /* Forcibly unquiesce queues to avoid blocking dispatch */
+- if (ctrl->admin_q)
++ if (ctrl->admin_q && !blk_queue_dying(ctrl->admin_q))
+ blk_mq_unquiesce_queue(ctrl->admin_q);
+
+ list_for_each_entry(ns, &ctrl->namespaces, list)
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index a64a8bca0d5b..124f41157173 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1652,6 +1652,9 @@ static void nvme_map_cmb(struct nvme_dev *dev)
+ struct pci_dev *pdev = to_pci_dev(dev->dev);
+ int bar;
+
++ if (dev->cmb_size)
++ return;
++
+ dev->cmbsz = readl(dev->bar + NVME_REG_CMBSZ);
+ if (!dev->cmbsz)
+ return;
+@@ -2136,7 +2139,6 @@ static void nvme_pci_disable(struct nvme_dev *dev)
+ {
+ struct pci_dev *pdev = to_pci_dev(dev->dev);
+
+- nvme_release_cmb(dev);
+ pci_free_irq_vectors(pdev);
+
+ if (pci_is_enabled(pdev)) {
+@@ -2583,19 +2585,19 @@ static void nvme_remove(struct pci_dev *pdev)
+ struct nvme_dev *dev = pci_get_drvdata(pdev);
+
+ nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DELETING);
+-
+- cancel_work_sync(&dev->ctrl.reset_work);
+ pci_set_drvdata(pdev, NULL);
+
+ if (!pci_device_is_present(pdev)) {
+ nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DEAD);
+ nvme_dev_disable(dev, true);
++ nvme_dev_remove_admin(dev);
+ }
+
+ flush_work(&dev->ctrl.reset_work);
+ nvme_stop_ctrl(&dev->ctrl);
+ nvme_remove_namespaces(&dev->ctrl);
+ nvme_dev_disable(dev, true);
++ nvme_release_cmb(dev);
+ nvme_free_host_mem(dev);
+ nvme_dev_remove_admin(dev);
+ nvme_free_queues(dev, 0);
+diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
+index 5251689a1d9a..291f4121f516 100644
+--- a/drivers/nvme/target/fcloop.c
++++ b/drivers/nvme/target/fcloop.c
+@@ -648,6 +648,7 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport,
+ break;
+
+ /* Fall-Thru to RSP handling */
++ /* FALLTHRU */
+
+ case NVMET_FCOP_RSP:
+ if (fcpreq) {
+diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
+index 81a9dc5290a8..39d972e2595f 100644
+--- a/drivers/nvme/target/io-cmd-file.c
++++ b/drivers/nvme/target/io-cmd-file.c
+@@ -246,7 +246,8 @@ static void nvmet_file_execute_discard(struct nvmet_req *req)
+ break;
+
+ offset = le64_to_cpu(range.slba) << req->ns->blksize_shift;
+- len = le32_to_cpu(range.nlb) << req->ns->blksize_shift;
++ len = le32_to_cpu(range.nlb);
++ len <<= req->ns->blksize_shift;
+ if (offset + len > req->ns->size) {
+ ret = NVME_SC_LBA_RANGE | NVME_SC_DNR;
+ break;
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index bac4b4bbc33d..68f52966bbc0 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -375,6 +375,7 @@ static void __init of_unittest_parse_phandle_with_args(void)
+ for (i = 0; i < 8; i++) {
+ bool passed = true;
+
++ memset(&args, 0, sizeof(args));
+ rc = of_parse_phandle_with_args(np, "phandle-list",
+ "#phandle-cells", i, &args);
+
+@@ -428,6 +429,7 @@ static void __init of_unittest_parse_phandle_with_args(void)
+ }
+
+ /* Check for missing list property */
++ memset(&args, 0, sizeof(args));
+ rc = of_parse_phandle_with_args(np, "phandle-list-missing",
+ "#phandle-cells", 0, &args);
+ unittest(rc == -ENOENT, "expected:%i got:%i\n", -ENOENT, rc);
+@@ -436,6 +438,7 @@ static void __init of_unittest_parse_phandle_with_args(void)
+ unittest(rc == -ENOENT, "expected:%i got:%i\n", -ENOENT, rc);
+
+ /* Check for missing cells property */
++ memset(&args, 0, sizeof(args));
+ rc = of_parse_phandle_with_args(np, "phandle-list",
+ "#phandle-cells-missing", 0, &args);
+ unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
+@@ -444,6 +447,7 @@ static void __init of_unittest_parse_phandle_with_args(void)
+ unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
+
+ /* Check for bad phandle in list */
++ memset(&args, 0, sizeof(args));
+ rc = of_parse_phandle_with_args(np, "phandle-list-bad-phandle",
+ "#phandle-cells", 0, &args);
+ unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
+@@ -452,6 +456,7 @@ static void __init of_unittest_parse_phandle_with_args(void)
+ unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
+
+ /* Check for incorrectly formed argument list */
++ memset(&args, 0, sizeof(args));
+ rc = of_parse_phandle_with_args(np, "phandle-list-bad-args",
+ "#phandle-cells", 1, &args);
+ unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
+@@ -502,6 +507,7 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ for (i = 0; i < 8; i++) {
+ bool passed = true;
+
++ memset(&args, 0, sizeof(args));
+ rc = of_parse_phandle_with_args_map(np, "phandle-list",
+ "phandle", i, &args);
+
+@@ -559,21 +565,25 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ }
+
+ /* Check for missing list property */
++ memset(&args, 0, sizeof(args));
+ rc = of_parse_phandle_with_args_map(np, "phandle-list-missing",
+ "phandle", 0, &args);
+ unittest(rc == -ENOENT, "expected:%i got:%i\n", -ENOENT, rc);
+
+ /* Check for missing cells,map,mask property */
++ memset(&args, 0, sizeof(args));
+ rc = of_parse_phandle_with_args_map(np, "phandle-list",
+ "phandle-missing", 0, &args);
+ unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
+
+ /* Check for bad phandle in list */
++ memset(&args, 0, sizeof(args));
+ rc = of_parse_phandle_with_args_map(np, "phandle-list-bad-phandle",
+ "phandle", 0, &args);
+ unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
+
+ /* Check for incorrectly formed argument list */
++ memset(&args, 0, sizeof(args));
+ rc = of_parse_phandle_with_args_map(np, "phandle-list-bad-args",
+ "phandle", 1, &args);
+ unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
+@@ -783,7 +793,7 @@ static void __init of_unittest_parse_interrupts(void)
+ for (i = 0; i < 4; i++) {
+ bool passed = true;
+
+- args.args_count = 0;
++ memset(&args, 0, sizeof(args));
+ rc = of_irq_parse_one(np, i, &args);
+
+ passed &= !rc;
+@@ -804,7 +814,7 @@ static void __init of_unittest_parse_interrupts(void)
+ for (i = 0; i < 4; i++) {
+ bool passed = true;
+
+- args.args_count = 0;
++ memset(&args, 0, sizeof(args));
+ rc = of_irq_parse_one(np, i, &args);
+
+ /* Test the values from tests-phandle.dtsi */
+@@ -860,6 +870,7 @@ static void __init of_unittest_parse_interrupts_extended(void)
+ for (i = 0; i < 7; i++) {
+ bool passed = true;
+
++ memset(&args, 0, sizeof(args));
+ rc = of_irq_parse_one(np, i, &args);
+
+ /* Test the values from tests-phandle.dtsi */
+@@ -1067,20 +1078,44 @@ static void __init of_unittest_platform_populate(void)
+ * of np into dup node (present in live tree) and
+ * updates parent of children of np to dup.
+ *
+- * @np: node already present in live tree
++ * @np: node whose properties are being added to the live tree
+ * @dup: node present in live tree to be updated
+ */
+ static void update_node_properties(struct device_node *np,
+ struct device_node *dup)
+ {
+ struct property *prop;
++ struct property *save_next;
+ struct device_node *child;
+-
+- for_each_property_of_node(np, prop)
+- of_add_property(dup, prop);
++ int ret;
+
+ for_each_child_of_node(np, child)
+ child->parent = dup;
++
++ /*
++ * "unittest internal error: unable to add testdata property"
++ *
++ * If this message reports a property in node '/__symbols__' then
++ * the respective unittest overlay contains a label that has the
++ * same name as a label in the live devicetree. The label will
++ * be in the live devicetree only if the devicetree source was
++ * compiled with the '-@' option. If you encounter this error,
++ * please consider renaming __all__ of the labels in the unittest
++ * overlay dts files with an odd prefix that is unlikely to be
++ * used in a real devicetree.
++ */
++
++ /*
++ * open code for_each_property_of_node() because of_add_property()
++ * sets prop->next to NULL
++ */
++ for (prop = np->properties; prop != NULL; prop = save_next) {
++ save_next = prop->next;
++ ret = of_add_property(dup, prop);
++ if (ret)
++ pr_err("unittest internal error: unable to add testdata property %pOF/%s",
++ np, prop->name);
++ }
+ }
+
+ /**
+@@ -1089,18 +1124,23 @@ static void update_node_properties(struct device_node *np,
+ *
+ * @np: Node to attach to live tree
+ */
+-static int attach_node_and_children(struct device_node *np)
++static void attach_node_and_children(struct device_node *np)
+ {
+ struct device_node *next, *dup, *child;
+ unsigned long flags;
+ const char *full_name;
+
+ full_name = kasprintf(GFP_KERNEL, "%pOF", np);
++
++ if (!strcmp(full_name, "/__local_fixups__") ||
++ !strcmp(full_name, "/__fixups__"))
++ return;
++
+ dup = of_find_node_by_path(full_name);
+ kfree(full_name);
+ if (dup) {
+ update_node_properties(np, dup);
+- return 0;
++ return;
+ }
+
+ child = np->child;
+@@ -1121,8 +1161,6 @@ static int attach_node_and_children(struct device_node *np)
+ attach_node_and_children(child);
+ child = next;
+ }
+-
+- return 0;
+ }
+
+ /**
+diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
+index 5e199e7d2d4f..765357b87ff6 100644
+--- a/drivers/pci/controller/dwc/pci-keystone.c
++++ b/drivers/pci/controller/dwc/pci-keystone.c
+@@ -36,6 +36,7 @@
+ #define PCIE_RC_K2HK 0xb008
+ #define PCIE_RC_K2E 0xb009
+ #define PCIE_RC_K2L 0xb00a
++#define PCIE_RC_K2G 0xb00b
+
+ #define to_keystone_pcie(x) dev_get_drvdata((x)->dev)
+
+@@ -50,6 +51,8 @@ static void quirk_limit_mrrs(struct pci_dev *dev)
+ .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },
+ { PCI_DEVICE(PCI_VENDOR_ID_TI, PCIE_RC_K2L),
+ .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },
++ { PCI_DEVICE(PCI_VENDOR_ID_TI, PCIE_RC_K2G),
++ .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },
+ { 0, },
+ };
+
+diff --git a/drivers/pci/controller/pcie-cadence-ep.c b/drivers/pci/controller/pcie-cadence-ep.c
+index 6692654798d4..c3a088910f48 100644
+--- a/drivers/pci/controller/pcie-cadence-ep.c
++++ b/drivers/pci/controller/pcie-cadence-ep.c
+@@ -355,7 +355,7 @@ static int cdns_pcie_ep_send_msi_irq(struct cdns_pcie_ep *ep, u8 fn,
+ ep->irq_pci_addr = (pci_addr & ~pci_addr_mask);
+ ep->irq_pci_fn = fn;
+ }
+- writew(data, ep->irq_cpu_addr + (pci_addr & pci_addr_mask));
++ writel(data, ep->irq_cpu_addr + (pci_addr & pci_addr_mask));
+
+ return 0;
+ }
+diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
+index 0d100f56cb88..1bfbceb9f445 100644
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -394,75 +394,6 @@ static struct pci_ops mtk_pcie_ops_v2 = {
+ .write = mtk_pcie_config_write,
+ };
+
+-static int mtk_pcie_startup_port_v2(struct mtk_pcie_port *port)
+-{
+- struct mtk_pcie *pcie = port->pcie;
+- struct resource *mem = &pcie->mem;
+- const struct mtk_pcie_soc *soc = port->pcie->soc;
+- u32 val;
+- size_t size;
+- int err;
+-
+- /* MT7622 platforms need to enable LTSSM and ASPM from PCIe subsys */
+- if (pcie->base) {
+- val = readl(pcie->base + PCIE_SYS_CFG_V2);
+- val |= PCIE_CSR_LTSSM_EN(port->slot) |
+- PCIE_CSR_ASPM_L1_EN(port->slot);
+- writel(val, pcie->base + PCIE_SYS_CFG_V2);
+- }
+-
+- /* Assert all reset signals */
+- writel(0, port->base + PCIE_RST_CTRL);
+-
+- /*
+- * Enable PCIe link down reset, if link status changed from link up to
+- * link down, this will reset MAC control registers and configuration
+- * space.
+- */
+- writel(PCIE_LINKDOWN_RST_EN, port->base + PCIE_RST_CTRL);
+-
+- /* De-assert PHY, PE, PIPE, MAC and configuration reset */
+- val = readl(port->base + PCIE_RST_CTRL);
+- val |= PCIE_PHY_RSTB | PCIE_PERSTB | PCIE_PIPE_SRSTB |
+- PCIE_MAC_SRSTB | PCIE_CRSTB;
+- writel(val, port->base + PCIE_RST_CTRL);
+-
+- /* Set up vendor ID and class code */
+- if (soc->need_fix_class_id) {
+- val = PCI_VENDOR_ID_MEDIATEK;
+- writew(val, port->base + PCIE_CONF_VEND_ID);
+-
+- val = PCI_CLASS_BRIDGE_HOST;
+- writew(val, port->base + PCIE_CONF_CLASS_ID);
+- }
+-
+- /* 100ms timeout value should be enough for Gen1/2 training */
+- err = readl_poll_timeout(port->base + PCIE_LINK_STATUS_V2, val,
+- !!(val & PCIE_PORT_LINKUP_V2), 20,
+- 100 * USEC_PER_MSEC);
+- if (err)
+- return -ETIMEDOUT;
+-
+- /* Set INTx mask */
+- val = readl(port->base + PCIE_INT_MASK);
+- val &= ~INTX_MASK;
+- writel(val, port->base + PCIE_INT_MASK);
+-
+- /* Set AHB to PCIe translation windows */
+- size = mem->end - mem->start;
+- val = lower_32_bits(mem->start) | AHB2PCIE_SIZE(fls(size));
+- writel(val, port->base + PCIE_AHB_TRANS_BASE0_L);
+-
+- val = upper_32_bits(mem->start);
+- writel(val, port->base + PCIE_AHB_TRANS_BASE0_H);
+-
+- /* Set PCIe to AXI translation memory space.*/
+- val = fls(0xffffffff) | WIN_ENABLE;
+- writel(val, port->base + PCIE_AXI_WINDOW0);
+-
+- return 0;
+-}
+-
+ static void mtk_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ {
+ struct mtk_pcie_port *port = irq_data_get_irq_chip_data(data);
+@@ -639,8 +570,6 @@ static int mtk_pcie_init_irq_domain(struct mtk_pcie_port *port,
+ ret = mtk_pcie_allocate_msi_domains(port);
+ if (ret)
+ return ret;
+-
+- mtk_pcie_enable_msi(port);
+ }
+
+ return 0;
+@@ -707,6 +636,78 @@ static int mtk_pcie_setup_irq(struct mtk_pcie_port *port,
+ return 0;
+ }
+
++static int mtk_pcie_startup_port_v2(struct mtk_pcie_port *port)
++{
++ struct mtk_pcie *pcie = port->pcie;
++ struct resource *mem = &pcie->mem;
++ const struct mtk_pcie_soc *soc = port->pcie->soc;
++ u32 val;
++ size_t size;
++ int err;
++
++ /* MT7622 platforms need to enable LTSSM and ASPM from PCIe subsys */
++ if (pcie->base) {
++ val = readl(pcie->base + PCIE_SYS_CFG_V2);
++ val |= PCIE_CSR_LTSSM_EN(port->slot) |
++ PCIE_CSR_ASPM_L1_EN(port->slot);
++ writel(val, pcie->base + PCIE_SYS_CFG_V2);
++ }
++
++ /* Assert all reset signals */
++ writel(0, port->base + PCIE_RST_CTRL);
++
++ /*
++ * Enable PCIe link down reset, if link status changed from link up to
++ * link down, this will reset MAC control registers and configuration
++ * space.
++ */
++ writel(PCIE_LINKDOWN_RST_EN, port->base + PCIE_RST_CTRL);
++
++ /* De-assert PHY, PE, PIPE, MAC and configuration reset */
++ val = readl(port->base + PCIE_RST_CTRL);
++ val |= PCIE_PHY_RSTB | PCIE_PERSTB | PCIE_PIPE_SRSTB |
++ PCIE_MAC_SRSTB | PCIE_CRSTB;
++ writel(val, port->base + PCIE_RST_CTRL);
++
++ /* Set up vendor ID and class code */
++ if (soc->need_fix_class_id) {
++ val = PCI_VENDOR_ID_MEDIATEK;
++ writew(val, port->base + PCIE_CONF_VEND_ID);
++
++ val = PCI_CLASS_BRIDGE_PCI;
++ writew(val, port->base + PCIE_CONF_CLASS_ID);
++ }
++
++ /* 100ms timeout value should be enough for Gen1/2 training */
++ err = readl_poll_timeout(port->base + PCIE_LINK_STATUS_V2, val,
++ !!(val & PCIE_PORT_LINKUP_V2), 20,
++ 100 * USEC_PER_MSEC);
++ if (err)
++ return -ETIMEDOUT;
++
++ /* Set INTx mask */
++ val = readl(port->base + PCIE_INT_MASK);
++ val &= ~INTX_MASK;
++ writel(val, port->base + PCIE_INT_MASK);
++
++ if (IS_ENABLED(CONFIG_PCI_MSI))
++ mtk_pcie_enable_msi(port);
++
++ /* Set AHB to PCIe translation windows */
++ size = mem->end - mem->start;
++ val = lower_32_bits(mem->start) | AHB2PCIE_SIZE(fls(size));
++ writel(val, port->base + PCIE_AHB_TRANS_BASE0_L);
++
++ val = upper_32_bits(mem->start);
++ writel(val, port->base + PCIE_AHB_TRANS_BASE0_H);
++
++ /* Set PCIe to AXI translation memory space.*/
++ val = fls(0xffffffff) | WIN_ENABLE;
++ writel(val, port->base + PCIE_AXI_WINDOW0);
++
++ return 0;
++}
++
+ static void __iomem *mtk_pcie_map_bus(struct pci_bus *bus,
+ unsigned int devfn, int where)
+ {
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index 65eaa6b61868..ab36e5ca1aca 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -818,12 +818,12 @@ static void vmd_remove(struct pci_dev *dev)
+ {
+ struct vmd_dev *vmd = pci_get_drvdata(dev);
+
+- vmd_detach_resources(vmd);
+ sysfs_remove_link(&vmd->dev->dev.kobj, "domain");
+ pci_stop_root_bus(vmd->bus);
+ pci_remove_root_bus(vmd->bus);
+ vmd_cleanup_srcu(vmd);
+ vmd_teardown_dma_ops(vmd);
++ vmd_detach_resources(vmd);
+ irq_domain_remove(vmd->irq_domain);
+ }
+
+diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+index 08925d24180b..1bd3c10ce189 100644
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -72,10 +72,8 @@
+ #define GPIO_REG_OFFSET(p) ((p) / 32)
+ #define GPIO_REG_SHIFT(p) ((p) % 32)
+
+-enum bcm2835_pinconf_param {
+- /* argument: bcm2835_pinconf_pull */
+- BCM2835_PINCONF_PARAM_PULL = (PIN_CONFIG_END + 1),
+-};
++/* argument: bcm2835_pinconf_pull */
++#define BCM2835_PINCONF_PARAM_PULL (PIN_CONFIG_END + 1)
+
+ struct bcm2835_pinctrl {
+ struct device *dev;
+diff --git a/drivers/pinctrl/cirrus/pinctrl-madera-core.c b/drivers/pinctrl/cirrus/pinctrl-madera-core.c
+index c4f4d904e4a6..618e04407ac8 100644
+--- a/drivers/pinctrl/cirrus/pinctrl-madera-core.c
++++ b/drivers/pinctrl/cirrus/pinctrl-madera-core.c
+@@ -608,7 +608,7 @@ static int madera_mux_set_mux(struct pinctrl_dev *pctldev,
+ unsigned int n_chip_groups = priv->chip->n_pin_groups;
+ const char *func_name = madera_mux_funcs[selector].name;
+ unsigned int reg;
+- int i, ret;
++ int i, ret = 0;
+
+ dev_dbg(priv->dev, "%s selecting %u (%s) for group %u (%s)\n",
+ __func__, selector, func_name, group,
+diff --git a/drivers/pinctrl/pinctrl-lpc18xx.c b/drivers/pinctrl/pinctrl-lpc18xx.c
+index 190f17e4bbda..1d3b88e6ab86 100644
+--- a/drivers/pinctrl/pinctrl-lpc18xx.c
++++ b/drivers/pinctrl/pinctrl-lpc18xx.c
+@@ -630,14 +630,8 @@ static const struct pinctrl_pin_desc lpc18xx_pins[] = {
+ LPC18XX_PIN(i2c0_sda, PIN_I2C0_SDA),
+ };
+
+-/**
+- * enum lpc18xx_pin_config_param - possible pin configuration parameters
+- * @PIN_CONFIG_GPIO_PIN_INT: route gpio to the gpio pin interrupt
+- * controller.
+- */
+-enum lpc18xx_pin_config_param {
+- PIN_CONFIG_GPIO_PIN_INT = PIN_CONFIG_END + 1,
+-};
++/* PIN_CONFIG_GPIO_PIN_INT: route gpio to the gpio pin interrupt controller */
++#define PIN_CONFIG_GPIO_PIN_INT (PIN_CONFIG_END + 1)
+
+ static const struct pinconf_generic_params lpc18xx_params[] = {
+ {"nxp,gpio-pin-interrupt", PIN_CONFIG_GPIO_PIN_INT, 0},
+diff --git a/drivers/pinctrl/pinctrl-zynq.c b/drivers/pinctrl/pinctrl-zynq.c
+index a0daf27042bd..90fd37e8207b 100644
+--- a/drivers/pinctrl/pinctrl-zynq.c
++++ b/drivers/pinctrl/pinctrl-zynq.c
+@@ -971,15 +971,12 @@ enum zynq_io_standards {
+ zynq_iostd_max
+ };
+
+-/**
+- * enum zynq_pin_config_param - possible pin configuration parameters
+- * @PIN_CONFIG_IOSTANDARD: if the pin can select an IO standard, the argument to
++/*
++ * PIN_CONFIG_IOSTANDARD: if the pin can select an IO standard, the argument to
+ * this parameter (on a custom format) tells the driver which alternative
+ * IO standard to use.
+ */
+-enum zynq_pin_config_param {
+- PIN_CONFIG_IOSTANDARD = PIN_CONFIG_END + 1,
+-};
++#define PIN_CONFIG_IOSTANDARD (PIN_CONFIG_END + 1)
+
+ static const struct pinconf_generic_params zynq_dt_params[] = {
+ {"io-standard", PIN_CONFIG_IOSTANDARD, zynq_iostd_lvcmos18},
+diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+index cf82db78e69e..0c30f5eb4c71 100644
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+@@ -1028,10 +1028,23 @@ static int pmic_gpio_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- ret = gpiochip_add_pin_range(&state->chip, dev_name(dev), 0, 0, npins);
+- if (ret) {
+- dev_err(dev, "failed to add pin range\n");
+- goto err_range;
++ /*
++ * For DeviceTree-supported systems, the gpio core checks the
++ * pinctrl's device node for the "gpio-ranges" property.
++ * If it is present, it takes care of adding the pin ranges
++ * for the driver. In this case the driver can skip ahead.
++ *
++ * In order to remain compatible with older, existing DeviceTree
++ * files which don't set the "gpio-ranges" property or systems that
++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
++ */
++ if (!of_property_read_bool(dev->of_node, "gpio-ranges")) {
++ ret = gpiochip_add_pin_range(&state->chip, dev_name(dev), 0, 0,
++ npins);
++ if (ret) {
++ dev_err(dev, "failed to add pin range\n");
++ goto err_range;
++ }
+ }
+
+ return 0;
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+index 26ebedc1f6d3..61aaaf58c599 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+@@ -1042,6 +1042,7 @@ static int sunxi_pinctrl_add_function(struct sunxi_pinctrl *pctl,
+ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+ {
+ struct sunxi_pinctrl *pctl = platform_get_drvdata(pdev);
++ void *ptr;
+ int i;
+
+ /*
+@@ -1108,13 +1109,15 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+ }
+
+ /* And now allocated and fill the array for real */
+- pctl->functions = krealloc(pctl->functions,
+- pctl->nfunctions * sizeof(*pctl->functions),
+- GFP_KERNEL);
+- if (!pctl->functions) {
++ ptr = krealloc(pctl->functions,
++ pctl->nfunctions * sizeof(*pctl->functions),
++ GFP_KERNEL);
++ if (!ptr) {
+ kfree(pctl->functions);
++ pctl->functions = NULL;
+ return -ENOMEM;
+ }
++ pctl->functions = ptr;
+
+ for (i = 0; i < pctl->desc->npins; i++) {
+ const struct sunxi_desc_pin *pin = pctl->desc->pins + i;
+diff --git a/drivers/platform/x86/intel_cht_int33fe.c b/drivers/platform/x86/intel_cht_int33fe.c
+index a26f410800c2..f40b1c192106 100644
+--- a/drivers/platform/x86/intel_cht_int33fe.c
++++ b/drivers/platform/x86/intel_cht_int33fe.c
+@@ -24,6 +24,7 @@
+ #include <linux/i2c.h>
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
++#include <linux/platform_device.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/slab.h>
+
+@@ -88,9 +89,9 @@ static const struct property_entry fusb302_props[] = {
+ { }
+ };
+
+-static int cht_int33fe_probe(struct i2c_client *client)
++static int cht_int33fe_probe(struct platform_device *pdev)
+ {
+- struct device *dev = &client->dev;
++ struct device *dev = &pdev->dev;
+ struct i2c_board_info board_info;
+ struct cht_int33fe_data *data;
+ struct i2c_client *max17047;
+@@ -207,7 +208,7 @@ static int cht_int33fe_probe(struct i2c_client *client)
+ if (!data->pi3usb30532)
+ goto out_unregister_fusb302;
+
+- i2c_set_clientdata(client, data);
++ platform_set_drvdata(pdev, data);
+
+ return 0;
+
+@@ -223,9 +224,9 @@ out_unregister_max17047:
+ return -EPROBE_DEFER; /* Wait for the i2c-adapter to load */
+ }
+
+-static int cht_int33fe_remove(struct i2c_client *i2c)
++static int cht_int33fe_remove(struct platform_device *pdev)
+ {
+- struct cht_int33fe_data *data = i2c_get_clientdata(i2c);
++ struct cht_int33fe_data *data = platform_get_drvdata(pdev);
+
+ i2c_unregister_device(data->pi3usb30532);
+ i2c_unregister_device(data->fusb302);
+@@ -237,29 +238,22 @@ static int cht_int33fe_remove(struct i2c_client *i2c)
+ return 0;
+ }
+
+-static const struct i2c_device_id cht_int33fe_i2c_id[] = {
+- { }
+-};
+-MODULE_DEVICE_TABLE(i2c, cht_int33fe_i2c_id);
+-
+ static const struct acpi_device_id cht_int33fe_acpi_ids[] = {
+ { "INT33FE", },
+ { }
+ };
+ MODULE_DEVICE_TABLE(acpi, cht_int33fe_acpi_ids);
+
+-static struct i2c_driver cht_int33fe_driver = {
++static struct platform_driver cht_int33fe_driver = {
+ .driver = {
+ .name = "Intel Cherry Trail ACPI INT33FE driver",
+ .acpi_match_table = ACPI_PTR(cht_int33fe_acpi_ids),
+ },
+- .probe_new = cht_int33fe_probe,
++ .probe = cht_int33fe_probe,
+ .remove = cht_int33fe_remove,
+- .id_table = cht_int33fe_i2c_id,
+- .disable_i2c_core_irq_mapping = true,
+ };
+
+-module_i2c_driver(cht_int33fe_driver);
++module_platform_driver(cht_int33fe_driver);
+
+ MODULE_DESCRIPTION("Intel Cherry Trail ACPI INT33FE pseudo device driver");
+ MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
+diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
+index 4721a264bac2..1e69c1c9ec09 100644
+--- a/drivers/pwm/pwm-lpss.c
++++ b/drivers/pwm/pwm-lpss.c
+@@ -97,7 +97,7 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
+ unsigned long long on_time_div;
+ unsigned long c = lpwm->info->clk_rate, base_unit_range;
+ unsigned long long base_unit, freq = NSEC_PER_SEC;
+- u32 ctrl;
++ u32 orig_ctrl, ctrl;
+
+ do_div(freq, period_ns);
+
+@@ -114,13 +114,17 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
+ do_div(on_time_div, period_ns);
+ on_time_div = 255ULL - on_time_div;
+
+- ctrl = pwm_lpss_read(pwm);
++ orig_ctrl = ctrl = pwm_lpss_read(pwm);
+ ctrl &= ~PWM_ON_TIME_DIV_MASK;
+ ctrl &= ~(base_unit_range << PWM_BASE_UNIT_SHIFT);
+ base_unit &= base_unit_range;
+ ctrl |= (u32) base_unit << PWM_BASE_UNIT_SHIFT;
+ ctrl |= on_time_div;
+- pwm_lpss_write(pwm, ctrl);
++
++ if (orig_ctrl != ctrl) {
++ pwm_lpss_write(pwm, ctrl);
++ pwm_lpss_write(pwm, ctrl | PWM_SW_UPDATE);
++ }
+ }
+
+ static inline void pwm_lpss_cond_enable(struct pwm_device *pwm, bool cond)
+@@ -144,7 +148,6 @@ static int pwm_lpss_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ return ret;
+ }
+ pwm_lpss_prepare(lpwm, pwm, state->duty_cycle, state->period);
+- pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
+ pwm_lpss_cond_enable(pwm, lpwm->info->bypass == false);
+ ret = pwm_lpss_wait_for_update(pwm);
+ if (ret) {
+@@ -157,7 +160,6 @@ static int pwm_lpss_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ if (ret)
+ return ret;
+ pwm_lpss_prepare(lpwm, pwm, state->duty_cycle, state->period);
+- pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
+ return pwm_lpss_wait_for_update(pwm);
+ }
+ } else if (pwm_is_enabled(pwm)) {
+diff --git a/drivers/rtc/rtc-s35390a.c b/drivers/rtc/rtc-s35390a.c
+index 77feb603cd4c..3c64dbb08109 100644
+--- a/drivers/rtc/rtc-s35390a.c
++++ b/drivers/rtc/rtc-s35390a.c
+@@ -108,7 +108,7 @@ static int s35390a_get_reg(struct s35390a *s35390a, int reg, char *buf, int len)
+
+ static int s35390a_init(struct s35390a *s35390a)
+ {
+- char buf;
++ u8 buf;
+ int ret;
+ unsigned initcount = 0;
+
+diff --git a/drivers/scsi/bfa/bfa_defs_svc.h b/drivers/scsi/bfa/bfa_defs_svc.h
+index 3d0c96a5c873..c19c26e0e405 100644
+--- a/drivers/scsi/bfa/bfa_defs_svc.h
++++ b/drivers/scsi/bfa/bfa_defs_svc.h
+@@ -1453,7 +1453,7 @@ union bfa_aen_data_u {
+ struct bfa_aen_entry_s {
+ struct list_head qe;
+ enum bfa_aen_category aen_category;
+- u32 aen_type;
++ int aen_type;
+ union bfa_aen_data_u aen_data;
+ u64 aen_tv_sec;
+ u64 aen_tv_usec;
+diff --git a/drivers/scsi/bfa/bfad_im.h b/drivers/scsi/bfa/bfad_im.h
+index e61ed8dad0b4..bd4ac187fd8e 100644
+--- a/drivers/scsi/bfa/bfad_im.h
++++ b/drivers/scsi/bfa/bfad_im.h
+@@ -143,7 +143,7 @@ struct bfad_im_s {
+ static inline void bfad_im_post_vendor_event(struct bfa_aen_entry_s *entry,
+ struct bfad_s *drv, int cnt,
+ enum bfa_aen_category cat,
+- enum bfa_ioc_aen_event evt)
++ int evt)
+ {
+ struct timespec64 ts;
+
+diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
+index 1ed2cd82129d..3943347ec3c7 100644
+--- a/drivers/scsi/dc395x.c
++++ b/drivers/scsi/dc395x.c
+@@ -1969,6 +1969,11 @@ static void sg_update_list(struct ScsiReqBlk *srb, u32 left)
+ xferred -= psge->length;
+ } else {
+ /* Partial SG entry done */
++ pci_dma_sync_single_for_cpu(srb->dcb->
++ acb->dev,
++ srb->sg_bus_addr,
++ SEGMENTX_LEN,
++ PCI_DMA_TODEVICE);
+ psge->length -= xferred;
+ psge->address += xferred;
+ srb->sg_index = idx;
+@@ -3447,14 +3452,12 @@ static void srb_done(struct AdapterCtlBlk *acb, struct DeviceCtlBlk *dcb,
+ }
+ }
+
+- if (dir != PCI_DMA_NONE && scsi_sg_count(cmd))
+- pci_dma_sync_sg_for_cpu(acb->dev, scsi_sglist(cmd),
+- scsi_sg_count(cmd), dir);
+-
+ ckc_only = 0;
+ /* Check Error Conditions */
+ ckc_e:
+
++ pci_unmap_srb(acb, srb);
++
+ if (cmd->cmnd[0] == INQUIRY) {
+ unsigned char *base = NULL;
+ struct ScsiInqData *ptr;
+@@ -3507,7 +3510,6 @@ static void srb_done(struct AdapterCtlBlk *acb, struct DeviceCtlBlk *dcb,
+ cmd, cmd->result);
+ srb_free_insert(acb, srb);
+ }
+- pci_unmap_srb(acb, srb);
+
+ cmd->scsi_done(cmd);
+ waiting_process_next(acb);
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
+index fd9d82c9033d..f478d1f50dfc 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -906,6 +906,9 @@ static void hisi_sas_phy_set_linkrate(struct hisi_hba *hisi_hba, int phy_no,
+ _r.maximum_linkrate = max;
+ _r.minimum_linkrate = min;
+
++ sas_phy->phy->maximum_linkrate = max;
++ sas_phy->phy->minimum_linkrate = min;
++
+ hisi_hba->hw->phy_disable(hisi_hba, phy_no);
+ msleep(100);
+ hisi_hba->hw->phy_set_linkrate(hisi_hba, phy_no, &_r);
+@@ -952,8 +955,7 @@ static int hisi_sas_control_phy(struct asd_sas_phy *sas_phy, enum phy_func func,
+
+ static void hisi_sas_task_done(struct sas_task *task)
+ {
+- if (!del_timer(&task->slow_task->timer))
+- return;
++ del_timer(&task->slow_task->timer);
+ complete(&task->slow_task->completion);
+ }
+
+@@ -962,13 +964,17 @@ static void hisi_sas_tmf_timedout(struct timer_list *t)
+ struct sas_task_slow *slow = from_timer(slow, t, timer);
+ struct sas_task *task = slow->task;
+ unsigned long flags;
++ bool is_completed = true;
+
+ spin_lock_irqsave(&task->task_state_lock, flags);
+- if (!(task->task_state_flags & SAS_TASK_STATE_DONE))
++ if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) {
+ task->task_state_flags |= SAS_TASK_STATE_ABORTED;
++ is_completed = false;
++ }
+ spin_unlock_irqrestore(&task->task_state_lock, flags);
+
+- complete(&task->slow_task->completion);
++ if (!is_completed)
++ complete(&task->slow_task->completion);
+ }
+
+ #define TASK_TIMEOUT 20
+@@ -1021,8 +1027,16 @@ static int hisi_sas_exec_internal_tmf_task(struct domain_device *device,
+ struct hisi_sas_slot *slot = task->lldd_task;
+
+ dev_err(dev, "abort tmf: TMF task timeout and not done\n");
+- if (slot)
++ if (slot) {
++ struct hisi_sas_cq *cq =
++ &hisi_hba->cq[slot->dlvry_queue];
++ /*
++ * flush tasklet to avoid free'ing task
++ * before using task in IO completion
++ */
++ tasklet_kill(&cq->tasklet);
+ slot->task = NULL;
++ }
+
+ goto ex_err;
+ } else
+@@ -1398,6 +1412,17 @@ static int hisi_sas_abort_task(struct sas_task *task)
+
+ spin_lock_irqsave(&task->task_state_lock, flags);
+ if (task->task_state_flags & SAS_TASK_STATE_DONE) {
++ struct hisi_sas_slot *slot = task->lldd_task;
++ struct hisi_sas_cq *cq;
++
++ if (slot) {
++ /*
++ * flush tasklet to avoid free'ing task
++ * before using task in IO completion
++ */
++ cq = &hisi_hba->cq[slot->dlvry_queue];
++ tasklet_kill(&cq->tasklet);
++ }
+ spin_unlock_irqrestore(&task->task_state_lock, flags);
+ rc = TMF_RESP_FUNC_COMPLETE;
+ goto out;
+@@ -1453,12 +1478,19 @@ static int hisi_sas_abort_task(struct sas_task *task)
+ /* SMP */
+ struct hisi_sas_slot *slot = task->lldd_task;
+ u32 tag = slot->idx;
++ struct hisi_sas_cq *cq = &hisi_hba->cq[slot->dlvry_queue];
+
+ rc = hisi_sas_internal_task_abort(hisi_hba, device,
+ HISI_SAS_INT_ABT_CMD, tag);
+ if (((rc < 0) || (rc == TMF_RESP_FUNC_FAILED)) &&
+- task->lldd_task)
+- hisi_sas_do_release_task(hisi_hba, task, slot);
++ task->lldd_task) {
++ /*
++ * flush tasklet to avoid free'ing task
++ * before using task in IO completion
++ */
++ tasklet_kill(&cq->tasklet);
++ slot->task = NULL;
++ }
+ }
+
+ out:
+@@ -1825,8 +1857,16 @@ hisi_sas_internal_task_abort(struct hisi_hba *hisi_hba,
+ if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) {
+ struct hisi_sas_slot *slot = task->lldd_task;
+
+- if (slot)
++ if (slot) {
++ struct hisi_sas_cq *cq =
++ &hisi_hba->cq[slot->dlvry_queue];
++ /*
++ * flush tasklet to avoid free'ing task
++ * before using task in IO completion
++ */
++ tasklet_kill(&cq->tasklet);
+ slot->task = NULL;
++ }
+ dev_err(dev, "internal task abort: timeout and not done.\n");
+ res = -EIO;
+ goto exit;
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+index 1c4ea58da1ae..c4774d63d5d0 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+@@ -2481,7 +2481,6 @@ slot_complete_v2_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot)
+ }
+
+ out:
+- hisi_sas_slot_task_free(hisi_hba, task, slot);
+ sts = ts->stat;
+ spin_lock_irqsave(&task->task_state_lock, flags);
+ if (task->task_state_flags & SAS_TASK_STATE_ABORTED) {
+@@ -2491,6 +2490,7 @@ out:
+ }
+ task->task_state_flags |= SAS_TASK_STATE_DONE;
+ spin_unlock_irqrestore(&task->task_state_lock, flags);
++ hisi_sas_slot_task_free(hisi_hba, task, slot);
+
+ if (!is_internal && (task->task_proto != SAS_PROTOCOL_SMP)) {
+ spin_lock_irqsave(&device->done_lock, flags);
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 3922b17e2ea3..fb2a5969181b 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -1749,7 +1749,6 @@ slot_complete_v3_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot)
+ }
+
+ out:
+- hisi_sas_slot_task_free(hisi_hba, task, slot);
+ sts = ts->stat;
+ spin_lock_irqsave(&task->task_state_lock, flags);
+ if (task->task_state_flags & SAS_TASK_STATE_ABORTED) {
+@@ -1759,6 +1758,7 @@ out:
+ }
+ task->task_state_flags |= SAS_TASK_STATE_DONE;
+ spin_unlock_irqrestore(&task->task_state_lock, flags);
++ hisi_sas_slot_task_free(hisi_hba, task, slot);
+
+ if (!is_internal && (task->task_proto != SAS_PROTOCOL_SMP)) {
+ spin_lock_irqsave(&device->done_lock, flags);
+diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
+index bd6ac6b5980a..fe587ef1741d 100644
+--- a/drivers/scsi/ips.c
++++ b/drivers/scsi/ips.c
+@@ -3485,6 +3485,7 @@ ips_send_cmd(ips_ha_t * ha, ips_scb_t * scb)
+
+ case START_STOP:
+ scb->scsi_cmd->result = DID_OK << 16;
++ break;
+
+ case TEST_UNIT_READY:
+ case INQUIRY:
+diff --git a/drivers/scsi/isci/host.c b/drivers/scsi/isci/host.c
+index 1ee3868ade07..7b5deae68d33 100644
+--- a/drivers/scsi/isci/host.c
++++ b/drivers/scsi/isci/host.c
+@@ -2717,9 +2717,9 @@ enum sci_status sci_controller_continue_io(struct isci_request *ireq)
+ * the task management request.
+ * @task_request: the handle to the task request object to start.
+ */
+-enum sci_task_status sci_controller_start_task(struct isci_host *ihost,
+- struct isci_remote_device *idev,
+- struct isci_request *ireq)
++enum sci_status sci_controller_start_task(struct isci_host *ihost,
++ struct isci_remote_device *idev,
++ struct isci_request *ireq)
+ {
+ enum sci_status status;
+
+@@ -2728,7 +2728,7 @@ enum sci_task_status sci_controller_start_task(struct isci_host *ihost,
+ "%s: SCIC Controller starting task from invalid "
+ "state\n",
+ __func__);
+- return SCI_TASK_FAILURE_INVALID_STATE;
++ return SCI_FAILURE_INVALID_STATE;
+ }
+
+ status = sci_remote_device_start_task(ihost, idev, ireq);
+diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h
+index b3539928073c..6bc3f022630a 100644
+--- a/drivers/scsi/isci/host.h
++++ b/drivers/scsi/isci/host.h
+@@ -489,7 +489,7 @@ enum sci_status sci_controller_start_io(
+ struct isci_remote_device *idev,
+ struct isci_request *ireq);
+
+-enum sci_task_status sci_controller_start_task(
++enum sci_status sci_controller_start_task(
+ struct isci_host *ihost,
+ struct isci_remote_device *idev,
+ struct isci_request *ireq);
+diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
+index ed197bc8e801..2f151708b59a 100644
+--- a/drivers/scsi/isci/request.c
++++ b/drivers/scsi/isci/request.c
+@@ -1626,9 +1626,9 @@ static enum sci_status atapi_d2h_reg_frame_handler(struct isci_request *ireq,
+
+ if (status == SCI_SUCCESS) {
+ if (ireq->stp.rsp.status & ATA_ERR)
+- status = SCI_IO_FAILURE_RESPONSE_VALID;
++ status = SCI_FAILURE_IO_RESPONSE_VALID;
+ } else {
+- status = SCI_IO_FAILURE_RESPONSE_VALID;
++ status = SCI_FAILURE_IO_RESPONSE_VALID;
+ }
+
+ if (status != SCI_SUCCESS) {
+diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
+index 6dcaed0c1fc8..fb6eba331ac6 100644
+--- a/drivers/scsi/isci/task.c
++++ b/drivers/scsi/isci/task.c
+@@ -258,7 +258,7 @@ static int isci_task_execute_tmf(struct isci_host *ihost,
+ struct isci_tmf *tmf, unsigned long timeout_ms)
+ {
+ DECLARE_COMPLETION_ONSTACK(completion);
+- enum sci_task_status status = SCI_TASK_FAILURE;
++ enum sci_status status = SCI_FAILURE;
+ struct isci_request *ireq;
+ int ret = TMF_RESP_FUNC_FAILED;
+ unsigned long flags;
+@@ -301,7 +301,7 @@ static int isci_task_execute_tmf(struct isci_host *ihost,
+ /* start the TMF io. */
+ status = sci_controller_start_task(ihost, idev, ireq);
+
+- if (status != SCI_TASK_SUCCESS) {
++ if (status != SCI_SUCCESS) {
+ dev_dbg(&ihost->pdev->dev,
+ "%s: start_io failed - status = 0x%x, request = %p\n",
+ __func__,
+diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
+index b025a0b74341..23354f206533 100644
+--- a/drivers/scsi/iscsi_tcp.c
++++ b/drivers/scsi/iscsi_tcp.c
+@@ -800,7 +800,8 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,
+ return rc;
+
+ return iscsi_conn_get_addr_param((struct sockaddr_storage *)
+- &addr, param, buf);
++ &addr,
++ (enum iscsi_param)param, buf);
+ default:
+ return iscsi_host_get_param(shost, param, buf);
+ }
+diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
+index 43732e8d1347..ebcfcbb8b4cc 100644
+--- a/drivers/scsi/lpfc/lpfc.h
++++ b/drivers/scsi/lpfc/lpfc.h
+@@ -490,6 +490,7 @@ struct lpfc_vport {
+ struct nvme_fc_local_port *localport;
+ uint8_t nvmei_support; /* driver supports NVME Initiator */
+ uint32_t last_fcp_wqidx;
++ uint32_t rcv_flogi_cnt; /* How many unsol FLOGIs ACK'd. */
+ };
+
+ struct hbq_s {
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index f3c6801c0b31..222fa9b7f478 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -1057,9 +1057,9 @@ stop_rr_fcf_flogi:
+ goto flogifail;
+
+ lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS,
+- "0150 FLOGI failure Status:x%x/x%x TMO:x%x\n",
++ "0150 FLOGI failure Status:x%x/x%x xri x%x TMO:x%x\n",
+ irsp->ulpStatus, irsp->un.ulpWord[4],
+- irsp->ulpTimeout);
++ cmdiocb->sli4_xritag, irsp->ulpTimeout);
+
+ /* FLOGI failed, so there is no fabric */
+ spin_lock_irq(shost->host_lock);
+@@ -1113,7 +1113,8 @@ stop_rr_fcf_flogi:
+ /* FLOGI completes successfully */
+ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
+ "0101 FLOGI completes successfully, I/O tag:x%x, "
+- "Data: x%x x%x x%x x%x x%x x%x\n", cmdiocb->iotag,
++ "xri x%x Data: x%x x%x x%x x%x x%x %x\n",
++ cmdiocb->iotag, cmdiocb->sli4_xritag,
+ irsp->un.ulpWord[4], sp->cmn.e_d_tov,
+ sp->cmn.w2.r_a_tov, sp->cmn.edtovResolution,
+ vport->port_state, vport->fc_flag);
+@@ -1157,6 +1158,7 @@ stop_rr_fcf_flogi:
+ phba->fcf.fcf_flag &= ~FCF_DISCOVERY;
+ phba->hba_flag &= ~(FCF_RR_INPROG | HBA_DEVLOSS_TMO);
+ spin_unlock_irq(&phba->hbalock);
++ phba->fcf.fcf_redisc_attempted = 0; /* reset */
+ goto out;
+ }
+ if (!rc) {
+@@ -1171,6 +1173,7 @@ stop_rr_fcf_flogi:
+ phba->fcf.fcf_flag &= ~FCF_DISCOVERY;
+ phba->hba_flag &= ~(FCF_RR_INPROG | HBA_DEVLOSS_TMO);
+ spin_unlock_irq(&phba->hbalock);
++ phba->fcf.fcf_redisc_attempted = 0; /* reset */
+ goto out;
+ }
+ }
+@@ -1553,8 +1556,10 @@ lpfc_plogi_confirm_nport(struct lpfc_hba *phba, uint32_t *prsp,
+ */
+ new_ndlp = lpfc_findnode_wwpn(vport, &sp->portName);
+
++ /* return immediately if the WWPN matches ndlp */
+ if (new_ndlp == ndlp && NLP_CHK_NODE_ACT(new_ndlp))
+ return ndlp;
++
+ if (phba->sli_rev == LPFC_SLI_REV4) {
+ active_rrqs_xri_bitmap = mempool_alloc(phba->active_rrq_pool,
+ GFP_KERNEL);
+@@ -1563,9 +1568,13 @@ lpfc_plogi_confirm_nport(struct lpfc_hba *phba, uint32_t *prsp,
+ phba->cfg_rrq_xri_bitmap_sz);
+ }
+
+- lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
+- "3178 PLOGI confirm: ndlp %p x%x: new_ndlp %p\n",
+- ndlp, ndlp->nlp_DID, new_ndlp);
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS | LOG_NODE,
++ "3178 PLOGI confirm: ndlp x%x x%x x%x: "
++ "new_ndlp x%x x%x x%x\n",
++ ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_fc4_type,
++ (new_ndlp ? new_ndlp->nlp_DID : 0),
++ (new_ndlp ? new_ndlp->nlp_flag : 0),
++ (new_ndlp ? new_ndlp->nlp_fc4_type : 0));
+
+ if (!new_ndlp) {
+ rc = memcmp(&ndlp->nlp_portname, name,
+@@ -1614,6 +1623,14 @@ lpfc_plogi_confirm_nport(struct lpfc_hba *phba, uint32_t *prsp,
+ phba->cfg_rrq_xri_bitmap_sz);
+ }
+
++ /* At this point in this routine, we know new_ndlp will be
++ * returned. however, any previous GID_FTs that were done
++ * would have updated nlp_fc4_type in ndlp, so we must ensure
++ * new_ndlp has the right value.
++ */
++ if (vport->fc_flag & FC_FABRIC)
++ new_ndlp->nlp_fc4_type = ndlp->nlp_fc4_type;
++
+ lpfc_unreg_rpi(vport, new_ndlp);
+ new_ndlp->nlp_DID = ndlp->nlp_DID;
+ new_ndlp->nlp_prev_state = ndlp->nlp_prev_state;
+@@ -1663,7 +1680,6 @@ lpfc_plogi_confirm_nport(struct lpfc_hba *phba, uint32_t *prsp,
+ if (ndlp->nrport) {
+ ndlp->nrport = NULL;
+ lpfc_nlp_put(ndlp);
+- new_ndlp->nlp_fc4_type = ndlp->nlp_fc4_type;
+ }
+
+ /* We shall actually free the ndlp with both nlp_DID and
+@@ -1737,6 +1753,12 @@ lpfc_plogi_confirm_nport(struct lpfc_hba *phba, uint32_t *prsp,
+ active_rrqs_xri_bitmap)
+ mempool_free(active_rrqs_xri_bitmap,
+ phba->active_rrq_pool);
++
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS | LOG_NODE,
++ "3173 PLOGI confirm exit: new_ndlp x%x x%x x%x\n",
++ new_ndlp->nlp_DID, new_ndlp->nlp_flag,
++ new_ndlp->nlp_fc4_type);
++
+ return new_ndlp;
+ }
+
+@@ -4264,14 +4286,6 @@ lpfc_els_rsp_acc(struct lpfc_vport *vport, uint32_t flag,
+ default:
+ return 1;
+ }
+- /* Xmit ELS ACC response tag <ulpIoTag> */
+- lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
+- "0128 Xmit ELS ACC response tag x%x, XRI: x%x, "
+- "DID: x%x, nlp_flag: x%x nlp_state: x%x RPI: x%x "
+- "fc_flag x%x\n",
+- elsiocb->iotag, elsiocb->iocb.ulpContext,
+- ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state,
+- ndlp->nlp_rpi, vport->fc_flag);
+ if (ndlp->nlp_flag & NLP_LOGO_ACC) {
+ spin_lock_irq(shost->host_lock);
+ if (!(ndlp->nlp_flag & NLP_RPI_REGISTERED ||
+@@ -4440,6 +4454,15 @@ lpfc_els_rsp_adisc_acc(struct lpfc_vport *vport, struct lpfc_iocbq *oldiocb,
+ lpfc_els_free_iocb(phba, elsiocb);
+ return 1;
+ }
++
++ /* Xmit ELS ACC response tag <ulpIoTag> */
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
++ "0128 Xmit ELS ACC response Status: x%x, IoTag: x%x, "
++ "XRI: x%x, DID: x%x, nlp_flag: x%x nlp_state: x%x "
++ "RPI: x%x, fc_flag x%x\n",
++ rc, elsiocb->iotag, elsiocb->sli4_xritag,
++ ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state,
++ ndlp->nlp_rpi, vport->fc_flag);
+ return 0;
+ }
+
+@@ -6450,6 +6473,11 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
+ port_state = vport->port_state;
+ vport->fc_flag |= FC_PT2PT;
+ vport->fc_flag &= ~(FC_FABRIC | FC_PUBLIC_LOOP);
++
++ /* Acking an unsol FLOGI. Count 1 for link bounce
++ * work-around.
++ */
++ vport->rcv_flogi_cnt++;
+ spin_unlock_irq(shost->host_lock);
+ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
+ "3311 Rcv Flogi PS x%x new PS x%x "
+@@ -7847,8 +7875,9 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
+ struct ls_rjt stat;
+ uint32_t *payload;
+ uint32_t cmd, did, newnode;
+- uint8_t rjt_exp, rjt_err = 0;
++ uint8_t rjt_exp, rjt_err = 0, init_link = 0;
+ IOCB_t *icmd = &elsiocb->iocb;
++ LPFC_MBOXQ_t *mbox;
+
+ if (!vport || !(elsiocb->context2))
+ goto dropit;
+@@ -7997,6 +8026,19 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
+ did, vport->port_state, ndlp->nlp_flag);
+
+ phba->fc_stat.elsRcvFLOGI++;
++
++ /* If the driver believes fabric discovery is done and is ready,
++ * bounce the link. There is some descrepancy.
++ */
++ if (vport->port_state >= LPFC_LOCAL_CFG_LINK &&
++ vport->fc_flag & FC_PT2PT &&
++ vport->rcv_flogi_cnt >= 1) {
++ rjt_err = LSRJT_LOGICAL_BSY;
++ rjt_exp = LSEXP_NOTHING_MORE;
++ init_link++;
++ goto lsrjt;
++ }
++
+ lpfc_els_rcv_flogi(vport, elsiocb, ndlp);
+ if (newnode)
+ lpfc_nlp_put(ndlp);
+@@ -8225,6 +8267,27 @@ lsrjt:
+
+ lpfc_nlp_put(elsiocb->context1);
+ elsiocb->context1 = NULL;
++
++ /* Special case. Driver received an unsolicited command that
++ * unsupportable given the driver's current state. Reset the
++ * link and start over.
++ */
++ if (init_link) {
++ mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
++ if (!mbox)
++ return;
++ lpfc_linkdown(phba);
++ lpfc_init_link(phba, mbox,
++ phba->cfg_topology,
++ phba->cfg_link_speed);
++ mbox->u.mb.un.varInitLnk.lipsr_AL_PA = 0;
++ mbox->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
++ mbox->vport = vport;
++ if (lpfc_sli_issue_mbox(phba, mbox, MBX_NOWAIT) ==
++ MBX_NOT_FINISHED)
++ mempool_free(mbox, phba->mbox_mem_pool);
++ }
++
+ return;
+
+ dropit:
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index db183d1f34ab..68f223882d96 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -952,6 +952,7 @@ lpfc_linkdown(struct lpfc_hba *phba)
+ }
+ spin_lock_irq(shost->host_lock);
+ phba->pport->fc_flag &= ~(FC_PT2PT | FC_PT2PT_PLOGI);
++ phba->pport->rcv_flogi_cnt = 0;
+ spin_unlock_irq(shost->host_lock);
+ }
+ return 0;
+@@ -1023,6 +1024,7 @@ lpfc_linkup(struct lpfc_hba *phba)
+ {
+ struct lpfc_vport **vports;
+ int i;
++ struct Scsi_Host *shost = lpfc_shost_from_vport(phba->pport);
+
+ phba->link_state = LPFC_LINK_UP;
+
+@@ -1036,6 +1038,13 @@ lpfc_linkup(struct lpfc_hba *phba)
+ lpfc_linkup_port(vports[i]);
+ lpfc_destroy_vport_work_array(phba, vports);
+
++ /* Clear the pport flogi counter in case the link down was
++ * absorbed without an ACQE. No lock here - in worker thread
++ * and discovery is synchronized.
++ */
++ spin_lock_irq(shost->host_lock);
++ phba->pport->rcv_flogi_cnt = 0;
++ spin_unlock_irq(shost->host_lock);
+ return 0;
+ }
+
+@@ -1997,6 +2006,26 @@ int lpfc_sli4_fcf_rr_next_proc(struct lpfc_vport *vport, uint16_t fcf_index)
+ "failover and change port state:x%x/x%x\n",
+ phba->pport->port_state, LPFC_VPORT_UNKNOWN);
+ phba->pport->port_state = LPFC_VPORT_UNKNOWN;
++
++ if (!phba->fcf.fcf_redisc_attempted) {
++ lpfc_unregister_fcf(phba);
++
++ rc = lpfc_sli4_redisc_fcf_table(phba);
++ if (!rc) {
++ lpfc_printf_log(phba, KERN_INFO, LOG_FIP,
++ "3195 Rediscover FCF table\n");
++ phba->fcf.fcf_redisc_attempted = 1;
++ lpfc_sli4_clear_fcf_rr_bmask(phba);
++ } else {
++ lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
++ "3196 Rediscover FCF table "
++ "failed. Status:x%x\n", rc);
++ }
++ } else {
++ lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
++ "3197 Already rediscover FCF table "
++ "attempted. No more retry\n");
++ }
+ goto stop_flogi_current_fcf;
+ } else {
+ lpfc_printf_log(phba, KERN_INFO, LOG_FIP | LOG_ELS,
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 9acb5b44ce4c..a7d3e532e0f5 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -5044,7 +5044,7 @@ lpfc_sli4_async_fip_evt(struct lpfc_hba *phba,
+ break;
+ }
+ /* If fast FCF failover rescan event is pending, do nothing */
+- if (phba->fcf.fcf_flag & FCF_REDISC_EVT) {
++ if (phba->fcf.fcf_flag & (FCF_REDISC_EVT | FCF_REDISC_PEND)) {
+ spin_unlock_irq(&phba->hbalock);
+ break;
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index c15f3265eefe..bd8dc6a2243c 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -2868,8 +2868,9 @@ lpfc_disc_state_machine(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ /* DSM in event <evt> on NPort <nlp_DID> in state <cur_state> */
+ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY,
+ "0211 DSM in event x%x on NPort x%x in "
+- "state %d Data: x%x\n",
+- evt, ndlp->nlp_DID, cur_state, ndlp->nlp_flag);
++ "state %d Data: x%x x%x\n",
++ evt, ndlp->nlp_DID, cur_state,
++ ndlp->nlp_flag, ndlp->nlp_fc4_type);
+
+ lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_DSM,
+ "DSM in: evt:%d ste:%d did:x%x",
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index e704297618e0..3361ae75578f 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -18431,15 +18431,8 @@ next_priority:
+ goto initial_priority;
+ lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
+ "2844 No roundrobin failover FCF available\n");
+- if (next_fcf_index >= LPFC_SLI4_FCF_TBL_INDX_MAX)
+- return LPFC_FCOE_FCF_NEXT_NONE;
+- else {
+- lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
+- "3063 Only FCF available idx %d, flag %x\n",
+- next_fcf_index,
+- phba->fcf.fcf_pri[next_fcf_index].fcf_rec.flag);
+- return next_fcf_index;
+- }
++
++ return LPFC_FCOE_FCF_NEXT_NONE;
+ }
+
+ if (next_fcf_index < LPFC_SLI4_FCF_TBL_INDX_MAX &&
+diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
+index 399c0015c546..3dcc6615a23b 100644
+--- a/drivers/scsi/lpfc/lpfc_sli4.h
++++ b/drivers/scsi/lpfc/lpfc_sli4.h
+@@ -279,6 +279,7 @@ struct lpfc_fcf {
+ #define FCF_REDISC_EVT 0x100 /* FCF rediscovery event to worker thread */
+ #define FCF_REDISC_FOV 0x200 /* Post FCF rediscovery fast failover */
+ #define FCF_REDISC_PROG (FCF_REDISC_PEND | FCF_REDISC_EVT)
++ uint16_t fcf_redisc_attempted;
+ uint32_t addr_mode;
+ uint32_t eligible_fcf_cnt;
+ struct lpfc_fcf_rec current_rec;
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index bc37666f998e..2f31d266339f 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3894,12 +3894,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
+ /*
+ * The cur_state should not last for more than max_wait secs
+ */
+- for (i = 0; i < (max_wait * 1000); i++) {
++ for (i = 0; i < max_wait; i++) {
+ curr_abs_state = instance->instancet->
+ read_fw_status_reg(instance->reg_set);
+
+ if (abs_state == curr_abs_state) {
+- msleep(1);
++ msleep(1000);
+ } else
+ break;
+ }
+@@ -5410,7 +5410,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ if (!instance->msix_vectors) {
+ i = pci_alloc_irq_vectors(instance->pdev, 1, 1, PCI_IRQ_LEGACY);
+ if (i < 0)
+- goto fail_setup_irqs;
++ goto fail_init_adapter;
+ }
+
+ megasas_setup_reply_map(instance);
+@@ -5619,9 +5619,8 @@ static int megasas_init_fw(struct megasas_instance *instance)
+
+ fail_get_ld_pd_list:
+ instance->instancet->disable_intr(instance);
+-fail_init_adapter:
+ megasas_destroy_irqs(instance);
+-fail_setup_irqs:
++fail_init_adapter:
+ if (instance->msix_vectors)
+ pci_free_irq_vectors(instance->pdev);
+ instance->msix_vectors = 0;
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index d2ab52026014..2c556c7fcf0d 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -4117,7 +4117,7 @@ _base_static_config_pages(struct MPT3SAS_ADAPTER *ioc)
+ * flag unset in NVDATA.
+ */
+ mpt3sas_config_get_manufacturing_pg11(ioc, &mpi_reply, &ioc->manu_pg11);
+- if (ioc->manu_pg11.EEDPTagMode == 0) {
++ if (!ioc->is_gen35_ioc && ioc->manu_pg11.EEDPTagMode == 0) {
+ pr_err("%s: overriding NVDATA EEDPTagMode setting\n",
+ ioc->name);
+ ioc->manu_pg11.EEDPTagMode &= ~0x3;
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_config.c b/drivers/scsi/mpt3sas/mpt3sas_config.c
+index d29a2dcc7d0e..9b01c5a7aebd 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_config.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_config.c
+@@ -692,10 +692,6 @@ mpt3sas_config_set_manufacturing_pg11(struct MPT3SAS_ADAPTER *ioc,
+ r = _config_request(ioc, &mpi_request, mpi_reply,
+ MPT3_CONFIG_PAGE_DEFAULT_TIMEOUT, config_page,
+ sizeof(*config_page));
+- mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_WRITE_NVRAM;
+- r = _config_request(ioc, &mpi_request, mpi_reply,
+- MPT3_CONFIG_PAGE_DEFAULT_TIMEOUT, config_page,
+- sizeof(*config_page));
+ out:
+ return r;
+ }
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index 73d661a0ecbb..d3c944d99703 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -3791,6 +3791,40 @@ _scsih_tm_tr_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
+ return _scsih_check_for_pending_tm(ioc, smid);
+ }
+
++/** _scsih_allow_scmd_to_device - check whether scmd needs to
++ * issue to IOC or not.
++ * @ioc: per adapter object
++ * @scmd: pointer to scsi command object
++ *
++ * Returns true if scmd can be issued to IOC otherwise returns false.
++ */
++inline bool _scsih_allow_scmd_to_device(struct MPT3SAS_ADAPTER *ioc,
++ struct scsi_cmnd *scmd)
++{
++
++ if (ioc->pci_error_recovery)
++ return false;
++
++ if (ioc->hba_mpi_version_belonged == MPI2_VERSION) {
++ if (ioc->remove_host)
++ return false;
++
++ return true;
++ }
++
++ if (ioc->remove_host) {
++
++ switch (scmd->cmnd[0]) {
++ case SYNCHRONIZE_CACHE:
++ case START_STOP:
++ return true;
++ default:
++ return false;
++ }
++ }
++
++ return true;
++}
+
+ /**
+ * _scsih_sas_control_complete - completion routine
+@@ -4623,7 +4657,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
+ return 0;
+ }
+
+- if (ioc->pci_error_recovery || ioc->remove_host) {
++ if (!(_scsih_allow_scmd_to_device(ioc, scmd))) {
+ scmd->result = DID_NO_CONNECT << 16;
+ scmd->scsi_done(scmd);
+ return 0;
+diff --git a/drivers/scsi/zorro_esp.c b/drivers/scsi/zorro_esp.c
+index bb70882e6b56..be79127db594 100644
+--- a/drivers/scsi/zorro_esp.c
++++ b/drivers/scsi/zorro_esp.c
+@@ -245,7 +245,7 @@ static int fastlane_esp_irq_pending(struct esp *esp)
+ static u32 zorro_esp_dma_length_limit(struct esp *esp, u32 dma_addr,
+ u32 dma_len)
+ {
+- return dma_len > 0xFFFFFF ? 0xFFFFFF : dma_len;
++ return dma_len > 0xFFFF ? 0xFFFF : dma_len;
+ }
+
+ static void zorro_esp_reset_dma(struct esp *esp)
+@@ -484,7 +484,6 @@ static void zorro_esp_send_blz1230_dma_cmd(struct esp *esp, u32 addr,
+ scsi_esp_cmd(esp, ESP_CMD_DMA);
+ zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
+ zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
+- zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
+
+ scsi_esp_cmd(esp, cmd);
+ }
+@@ -529,7 +528,6 @@ static void zorro_esp_send_blz1230II_dma_cmd(struct esp *esp, u32 addr,
+ scsi_esp_cmd(esp, ESP_CMD_DMA);
+ zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
+ zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
+- zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
+
+ scsi_esp_cmd(esp, cmd);
+ }
+@@ -574,7 +572,6 @@ static void zorro_esp_send_blz2060_dma_cmd(struct esp *esp, u32 addr,
+ scsi_esp_cmd(esp, ESP_CMD_DMA);
+ zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
+ zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
+- zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
+
+ scsi_esp_cmd(esp, cmd);
+ }
+@@ -599,7 +596,6 @@ static void zorro_esp_send_cyber_dma_cmd(struct esp *esp, u32 addr,
+
+ zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
+ zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
+- zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
+
+ if (write) {
+ /* DMA receive */
+@@ -649,7 +645,6 @@ static void zorro_esp_send_cyberII_dma_cmd(struct esp *esp, u32 addr,
+
+ zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
+ zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
+- zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
+
+ if (write) {
+ /* DMA receive */
+@@ -691,7 +686,6 @@ static void zorro_esp_send_fastlane_dma_cmd(struct esp *esp, u32 addr,
+
+ zorro_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
+ zorro_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
+- zorro_esp_write8(esp, (esp_count >> 16) & 0xff, ESP_TCHI);
+
+ if (write) {
+ /* DMA receive */
+diff --git a/drivers/soc/bcm/brcmstb/pm/pm-arm.c b/drivers/soc/bcm/brcmstb/pm/pm-arm.c
+index a5577dd5eb08..8ee06347447c 100644
+--- a/drivers/soc/bcm/brcmstb/pm/pm-arm.c
++++ b/drivers/soc/bcm/brcmstb/pm/pm-arm.c
+@@ -404,7 +404,7 @@ noinline int brcmstb_pm_s3_finish(void)
+ {
+ struct brcmstb_s3_params *params = ctrl.s3_params;
+ dma_addr_t params_pa = ctrl.s3_params_pa;
+- phys_addr_t reentry = virt_to_phys(&cpu_resume);
++ phys_addr_t reentry = virt_to_phys(&cpu_resume_arm);
+ enum bsp_initiate_command cmd;
+ u32 flags;
+
+diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
+index e2be7da74343..eb2d2de172af 100644
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -299,7 +299,7 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
+ struct omap2_mcspi_cs *cs = spi->controller_state;
+ struct omap2_mcspi *mcspi;
+ unsigned int wcnt;
+- int max_fifo_depth, fifo_depth, bytes_per_word;
++ int max_fifo_depth, bytes_per_word;
+ u32 chconf, xferlevel;
+
+ mcspi = spi_master_get_devdata(master);
+@@ -315,10 +315,6 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
+ else
+ max_fifo_depth = OMAP2_MCSPI_MAX_FIFODEPTH;
+
+- fifo_depth = gcd(t->len, max_fifo_depth);
+- if (fifo_depth < 2 || fifo_depth % bytes_per_word != 0)
+- goto disable_fifo;
+-
+ wcnt = t->len / bytes_per_word;
+ if (wcnt > OMAP2_MCSPI_MAX_FIFOWCNT)
+ goto disable_fifo;
+@@ -326,16 +322,17 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
+ xferlevel = wcnt << 16;
+ if (t->rx_buf != NULL) {
+ chconf |= OMAP2_MCSPI_CHCONF_FFER;
+- xferlevel |= (fifo_depth - 1) << 8;
++ xferlevel |= (bytes_per_word - 1) << 8;
+ }
++
+ if (t->tx_buf != NULL) {
+ chconf |= OMAP2_MCSPI_CHCONF_FFET;
+- xferlevel |= fifo_depth - 1;
++ xferlevel |= bytes_per_word - 1;
+ }
+
+ mcspi_write_reg(master, OMAP2_MCSPI_XFERLEVEL, xferlevel);
+ mcspi_write_chconf0(spi, chconf);
+- mcspi->fifo_depth = fifo_depth;
++ mcspi->fifo_depth = max_fifo_depth;
+
+ return;
+ }
+@@ -585,7 +582,6 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer)
+ struct dma_slave_config cfg;
+ enum dma_slave_buswidth width;
+ unsigned es;
+- u32 burst;
+ void __iomem *chstat_reg;
+ void __iomem *irqstat_reg;
+ int wait_res;
+@@ -605,22 +601,14 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer)
+ }
+
+ count = xfer->len;
+- burst = 1;
+-
+- if (mcspi->fifo_depth > 0) {
+- if (count > mcspi->fifo_depth)
+- burst = mcspi->fifo_depth / es;
+- else
+- burst = count / es;
+- }
+
+ memset(&cfg, 0, sizeof(cfg));
+ cfg.src_addr = cs->phys + OMAP2_MCSPI_RX0;
+ cfg.dst_addr = cs->phys + OMAP2_MCSPI_TX0;
+ cfg.src_addr_width = width;
+ cfg.dst_addr_width = width;
+- cfg.src_maxburst = burst;
+- cfg.dst_maxburst = burst;
++ cfg.src_maxburst = 1;
++ cfg.dst_maxburst = 1;
+
+ rx = xfer->rx_buf;
+ tx = xfer->tx_buf;
+diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
+index 101cd6aae2ea..30ea0a2068e0 100644
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -1343,8 +1343,8 @@ static int sh_msiof_spi_probe(struct platform_device *pdev)
+
+ i = platform_get_irq(pdev, 0);
+ if (i < 0) {
+- dev_err(&pdev->dev, "cannot get platform IRQ\n");
+- ret = -ENOENT;
++ dev_err(&pdev->dev, "cannot get IRQ\n");
++ ret = i;
+ goto err1;
+ }
+
+diff --git a/drivers/staging/comedi/drivers/usbduxfast.c b/drivers/staging/comedi/drivers/usbduxfast.c
+index e18c0723b760..0d38589c2600 100644
+--- a/drivers/staging/comedi/drivers/usbduxfast.c
++++ b/drivers/staging/comedi/drivers/usbduxfast.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ /*
+- * Copyright (C) 2004-2014 Bernd Porr, mail@berndporr.me.uk
++ * Copyright (C) 2004-2019 Bernd Porr, mail@berndporr.me.uk
+ */
+
+ /*
+@@ -8,7 +8,7 @@
+ * Description: University of Stirling USB DAQ & INCITE Technology Limited
+ * Devices: [ITL] USB-DUX-FAST (usbduxfast)
+ * Author: Bernd Porr <mail@berndporr.me.uk>
+- * Updated: 10 Oct 2014
++ * Updated: 16 Nov 2019
+ * Status: stable
+ */
+
+@@ -22,6 +22,7 @@
+ *
+ *
+ * Revision history:
++ * 1.0: Fixed a rounding error in usbduxfast_ai_cmdtest
+ * 0.9: Dropping the first data packet which seems to be from the last transfer.
+ * Buffer overflows in the FX2 are handed over to comedi.
+ * 0.92: Dropping now 4 packets. The quad buffer has to be emptied.
+@@ -350,6 +351,7 @@ static int usbduxfast_ai_cmdtest(struct comedi_device *dev,
+ struct comedi_cmd *cmd)
+ {
+ int err = 0;
++ int err2 = 0;
+ unsigned int steps;
+ unsigned int arg;
+
+@@ -399,11 +401,16 @@ static int usbduxfast_ai_cmdtest(struct comedi_device *dev,
+ */
+ steps = (cmd->convert_arg * 30) / 1000;
+ if (cmd->chanlist_len != 1)
+- err |= comedi_check_trigger_arg_min(&steps,
+- MIN_SAMPLING_PERIOD);
+- err |= comedi_check_trigger_arg_max(&steps, MAX_SAMPLING_PERIOD);
+- arg = (steps * 1000) / 30;
+- err |= comedi_check_trigger_arg_is(&cmd->convert_arg, arg);
++ err2 |= comedi_check_trigger_arg_min(&steps,
++ MIN_SAMPLING_PERIOD);
++ else
++ err2 |= comedi_check_trigger_arg_min(&steps, 1);
++ err2 |= comedi_check_trigger_arg_max(&steps, MAX_SAMPLING_PERIOD);
++ if (err2) {
++ err |= err2;
++ arg = (steps * 1000) / 30;
++ err |= comedi_check_trigger_arg_is(&cmd->convert_arg, arg);
++ }
+
+ if (cmd->stop_src == TRIG_COUNT)
+ err |= comedi_check_trigger_arg_min(&cmd->stop_arg, 1);
+diff --git a/drivers/thermal/armada_thermal.c b/drivers/thermal/armada_thermal.c
+index e16b3cb1808c..1c9830b2c84d 100644
+--- a/drivers/thermal/armada_thermal.c
++++ b/drivers/thermal/armada_thermal.c
+@@ -526,8 +526,8 @@ static int armada_thermal_probe_legacy(struct platform_device *pdev,
+
+ /* First memory region points towards the status register */
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- if (IS_ERR(res))
+- return PTR_ERR(res);
++ if (!res)
++ return -EIO;
+
+ /*
+ * Edit the resource start address and length to map over all the
+diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
+index 8df2ce94c28d..4dc30e7890f6 100644
+--- a/drivers/thermal/rcar_thermal.c
++++ b/drivers/thermal/rcar_thermal.c
+@@ -434,8 +434,8 @@ static irqreturn_t rcar_thermal_irq(int irq, void *data)
+ rcar_thermal_for_each_priv(priv, common) {
+ if (rcar_thermal_had_changed(priv, status)) {
+ rcar_thermal_irq_disable(priv);
+- schedule_delayed_work(&priv->work,
+- msecs_to_jiffies(300));
++ queue_delayed_work(system_freezable_wq, &priv->work,
++ msecs_to_jiffies(300));
+ }
+ }
+
+@@ -493,7 +493,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
+ pm_runtime_get_sync(dev);
+
+ for (i = 0; i < chip->nirqs; i++) {
+- irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
++ irq = platform_get_resource(pdev, IORESOURCE_IRQ, i);
+ if (!irq)
+ continue;
+ if (!common->base) {
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index 678406e0948b..00099a8439d2 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -28,6 +28,7 @@
+ #include <linux/mount.h>
+ #include <linux/file.h>
+ #include <linux/ioctl.h>
++#include <linux/compat.h>
+
+ #undef TTY_DEBUG_HANGUP
+ #ifdef TTY_DEBUG_HANGUP
+@@ -488,6 +489,7 @@ static int pty_bsd_ioctl(struct tty_struct *tty,
+ return -ENOIOCTLCMD;
+ }
+
++#ifdef CONFIG_COMPAT
+ static long pty_bsd_compat_ioctl(struct tty_struct *tty,
+ unsigned int cmd, unsigned long arg)
+ {
+@@ -495,8 +497,11 @@ static long pty_bsd_compat_ioctl(struct tty_struct *tty,
+ * PTY ioctls don't require any special translation between 32-bit and
+ * 64-bit userspace, they are already compatible.
+ */
+- return pty_bsd_ioctl(tty, cmd, arg);
++ return pty_bsd_ioctl(tty, cmd, (unsigned long)compat_ptr(arg));
+ }
++#else
++#define pty_bsd_compat_ioctl NULL
++#endif
+
+ static int legacy_count = CONFIG_LEGACY_PTY_COUNT;
+ /*
+@@ -676,6 +681,7 @@ static int pty_unix98_ioctl(struct tty_struct *tty,
+ return -ENOIOCTLCMD;
+ }
+
++#ifdef CONFIG_COMPAT
+ static long pty_unix98_compat_ioctl(struct tty_struct *tty,
+ unsigned int cmd, unsigned long arg)
+ {
+@@ -683,8 +689,12 @@ static long pty_unix98_compat_ioctl(struct tty_struct *tty,
+ * PTY ioctls don't require any special translation between 32-bit and
+ * 64-bit userspace, they are already compatible.
+ */
+- return pty_unix98_ioctl(tty, cmd, arg);
++ return pty_unix98_ioctl(tty, cmd,
++ cmd == TIOCSIG ? arg : (unsigned long)compat_ptr(arg));
+ }
++#else
++#define pty_unix98_compat_ioctl NULL
++#endif
+
+ /**
+ * ptm_unix98_lookup - find a pty master
+diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
+index a94086597ebd..b88ecf102764 100644
+--- a/drivers/tty/synclink_gt.c
++++ b/drivers/tty/synclink_gt.c
+@@ -1186,14 +1186,13 @@ static long slgt_compat_ioctl(struct tty_struct *tty,
+ unsigned int cmd, unsigned long arg)
+ {
+ struct slgt_info *info = tty->driver_data;
+- int rc = -ENOIOCTLCMD;
++ int rc;
+
+ if (sanity_check(info, tty->name, "compat_ioctl"))
+ return -ENODEV;
+ DBGINFO(("%s compat_ioctl() cmd=%08X\n", info->device_name, cmd));
+
+ switch (cmd) {
+-
+ case MGSL_IOCSPARAMS32:
+ rc = set_params32(info, compat_ptr(arg));
+ break;
+@@ -1213,18 +1212,11 @@ static long slgt_compat_ioctl(struct tty_struct *tty,
+ case MGSL_IOCWAITGPIO:
+ case MGSL_IOCGXSYNC:
+ case MGSL_IOCGXCTRL:
+- case MGSL_IOCSTXIDLE:
+- case MGSL_IOCTXENABLE:
+- case MGSL_IOCRXENABLE:
+- case MGSL_IOCTXABORT:
+- case TIOCMIWAIT:
+- case MGSL_IOCSIF:
+- case MGSL_IOCSXSYNC:
+- case MGSL_IOCSXCTRL:
+- rc = ioctl(tty, cmd, arg);
++ rc = ioctl(tty, cmd, (unsigned long)compat_ptr(arg));
+ break;
++ default:
++ rc = ioctl(tty, cmd, arg);
+ }
+-
+ DBGINFO(("%s compat_ioctl() cmd=%08X rc=%d\n", info->device_name, cmd, rc));
+ return rc;
+ }
+diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
+index 1c6da8d6cccf..718d692b07ac 100644
+--- a/drivers/usb/misc/appledisplay.c
++++ b/drivers/usb/misc/appledisplay.c
+@@ -148,8 +148,11 @@ static int appledisplay_bl_update_status(struct backlight_device *bd)
+ pdata->msgdata, 2,
+ ACD_USB_TIMEOUT);
+ mutex_unlock(&pdata->sysfslock);
+-
+- return retval;
++
++ if (retval < 0)
++ return retval;
++ else
++ return 0;
+ }
+
+ static int appledisplay_bl_get_brightness(struct backlight_device *bd)
+@@ -167,7 +170,12 @@ static int appledisplay_bl_get_brightness(struct backlight_device *bd)
+ 0,
+ pdata->msgdata, 2,
+ ACD_USB_TIMEOUT);
+- brightness = pdata->msgdata[1];
++ if (retval < 2) {
++ if (retval >= 0)
++ retval = -EMSGSIZE;
++ } else {
++ brightness = pdata->msgdata[1];
++ }
+ mutex_unlock(&pdata->sysfslock);
+
+ if (retval < 0)
+@@ -302,6 +310,7 @@ error:
+ if (pdata) {
+ if (pdata->urb) {
+ usb_kill_urb(pdata->urb);
++ cancel_delayed_work_sync(&pdata->work);
+ if (pdata->urbdata)
+ usb_free_coherent(pdata->udev, ACD_URB_BUFFER_LEN,
+ pdata->urbdata, pdata->urb->transfer_dma);
+diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
+index 34e6cd6f40d3..87067c3d6109 100644
+--- a/drivers/usb/misc/chaoskey.c
++++ b/drivers/usb/misc/chaoskey.c
+@@ -384,13 +384,17 @@ static int _chaoskey_fill(struct chaoskey *dev)
+ !dev->reading,
+ (started ? NAK_TIMEOUT : ALEA_FIRST_TIMEOUT) );
+
+- if (result < 0)
++ if (result < 0) {
++ usb_kill_urb(dev->urb);
+ goto out;
++ }
+
+- if (result == 0)
++ if (result == 0) {
+ result = -ETIMEDOUT;
+- else
++ usb_kill_urb(dev->urb);
++ } else {
+ result = dev->valid;
++ }
+ out:
+ /* Let the device go back to sleep eventually */
+ usb_autopm_put_interface(dev->interface);
+@@ -526,7 +530,21 @@ static int chaoskey_suspend(struct usb_interface *interface,
+
+ static int chaoskey_resume(struct usb_interface *interface)
+ {
++ struct chaoskey *dev;
++ struct usb_device *udev = interface_to_usbdev(interface);
++
+ usb_dbg(interface, "resume");
++ dev = usb_get_intfdata(interface);
++
++ /*
++ * We may have lost power.
++ * In that case the device that needs a long time
++ * for the first requests needs an extended timeout
++ * again
++ */
++ if (le16_to_cpu(udev->descriptor.idVendor) == ALEA_VENDOR_ID)
++ dev->reads_started = false;
++
+ return 0;
+ }
+ #else
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index e732949f6567..7ae121567098 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -125,6 +125,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
+ { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */
+ { USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */
++ { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */
+ { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */
+ { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
+ { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index e8f275a0326d..c0232b67a40f 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -1894,10 +1894,6 @@ static int mos7720_startup(struct usb_serial *serial)
+ product = le16_to_cpu(serial->dev->descriptor.idProduct);
+ dev = serial->dev;
+
+- /* setting configuration feature to one */
+- usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+- (__u8)0x03, 0x00, 0x01, 0x00, NULL, 0x00, 5000);
+-
+ if (product == MOSCHIP_DEVICE_ID_7715) {
+ struct urb *urb = serial->port[0]->interrupt_in_urb;
+
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index b42bad85097a..4a7bd26841af 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -118,11 +118,15 @@
+ /* This driver also supports
+ * ATEN UC2324 device using Moschip MCS7840
+ * ATEN UC2322 device using Moschip MCS7820
++ * MOXA UPort 2210 device using Moschip MCS7820
+ */
+ #define USB_VENDOR_ID_ATENINTL 0x0557
+ #define ATENINTL_DEVICE_ID_UC2324 0x2011
+ #define ATENINTL_DEVICE_ID_UC2322 0x7820
+
++#define USB_VENDOR_ID_MOXA 0x110a
++#define MOXA_DEVICE_ID_2210 0x2210
++
+ /* Interrupt Routine Defines */
+
+ #define SERIAL_IIR_RLS 0x06
+@@ -193,6 +197,7 @@ static const struct usb_device_id id_table[] = {
+ {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4)},
+ {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)},
+ {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)},
++ {USB_DEVICE(USB_VENDOR_ID_MOXA, MOXA_DEVICE_ID_2210)},
+ {} /* terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+@@ -2053,6 +2058,7 @@ static int mos7840_probe(struct usb_serial *serial,
+ const struct usb_device_id *id)
+ {
+ u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);
++ u16 vid = le16_to_cpu(serial->dev->descriptor.idVendor);
+ u8 *buf;
+ int device_type;
+
+@@ -2062,6 +2068,11 @@ static int mos7840_probe(struct usb_serial *serial,
+ goto out;
+ }
+
++ if (vid == USB_VENDOR_ID_MOXA && product == MOXA_DEVICE_ID_2210) {
++ device_type = MOSCHIP_DEVICE_ID_7820;
++ goto out;
++ }
++
+ buf = kzalloc(VENDOR_READ_LENGTH, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+@@ -2314,11 +2325,6 @@ out:
+ goto error;
+ } else
+ dev_dbg(&port->dev, "ZLP_REG5 Writing success status%d\n", status);
+-
+- /* setting configuration feature to one */
+- usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+- 0x03, 0x00, 0x01, 0x00, NULL, 0x00,
+- MOS_WDR_TIMEOUT);
+ }
+ return 0;
+ error:
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 3cc659a62782..2905274e3626 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -197,6 +197,7 @@ static void option_instat_callback(struct urb *urb);
+ #define DELL_PRODUCT_5804_MINICARD_ATT 0x819b /* Novatel E371 */
+
+ #define DELL_PRODUCT_5821E 0x81d7
++#define DELL_PRODUCT_5821E_ESIM 0x81e0
+
+ #define KYOCERA_VENDOR_ID 0x0c88
+ #define KYOCERA_PRODUCT_KPC650 0x17da
+@@ -1044,6 +1045,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5804_MINICARD_ATT, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E),
+ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
++ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E_ESIM),
++ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
+@@ -1990,6 +1993,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
++ { USB_DEVICE(0x0489, 0xe0b4), /* Foxconn T77W968 */
++ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
++ { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */
++ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */
+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+ { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index 819ae3b2bd7e..39cf19001239 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -3322,7 +3322,8 @@ static void run_state_machine(struct tcpm_port *port)
+ case SNK_HARD_RESET_SINK_OFF:
+ memset(&port->pps_data, 0, sizeof(port->pps_data));
+ tcpm_set_vconn(port, false);
+- tcpm_set_charge(port, false);
++ if (port->pd_capable)
++ tcpm_set_charge(port, false);
+ tcpm_set_roles(port, port->self_powered, TYPEC_SINK,
+ TYPEC_DEVICE);
+ /*
+@@ -3354,6 +3355,12 @@ static void run_state_machine(struct tcpm_port *port)
+ * Similar, dual-mode ports in source mode should transition
+ * to PE_SNK_Transition_to_default.
+ */
++ if (port->pd_capable) {
++ tcpm_set_current_limit(port,
++ tcpm_get_current_limit(port),
++ 5000);
++ tcpm_set_charge(port, true);
++ }
+ tcpm_set_attached_state(port, true);
+ tcpm_set_state(port, SNK_STARTUP, 0);
+ break;
+diff --git a/drivers/usb/usbip/Kconfig b/drivers/usb/usbip/Kconfig
+index a20b65cb6678..8276a20ecea7 100644
+--- a/drivers/usb/usbip/Kconfig
++++ b/drivers/usb/usbip/Kconfig
+@@ -2,6 +2,7 @@ config USBIP_CORE
+ tristate "USB/IP support"
+ depends on NET
+ select USB_COMMON
++ select SGL_ALLOC
+ ---help---
+ This enables pushing USB packets over IP to allow remote
+ machines direct access to USB devices. It provides the
+diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
+index 75d8756c6d27..8c55cd833098 100644
+--- a/drivers/usb/usbip/stub_rx.c
++++ b/drivers/usb/usbip/stub_rx.c
+@@ -470,18 +470,50 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
+ if (pipe == -1)
+ return;
+
++ /*
++ * Smatch reported the error case where use_sg is true and buf_len is 0.
++ * In this case, It adds SDEV_EVENT_ERROR_MALLOC and stub_priv will be
++ * released by stub event handler and connection will be shut down.
++ */
+ priv = stub_priv_alloc(sdev, pdu);
+ if (!priv)
+ return;
+
+ buf_len = (unsigned long long)pdu->u.cmd_submit.transfer_buffer_length;
+
++ if (use_sg && !buf_len) {
++ dev_err(&udev->dev, "sg buffer with zero length\n");
++ goto err_malloc;
++ }
++
+ /* allocate urb transfer buffer, if needed */
+ if (buf_len) {
+ if (use_sg) {
+ sgl = sgl_alloc(buf_len, GFP_KERNEL, &nents);
+ if (!sgl)
+ goto err_malloc;
++
++ /* Check if the server's HCD supports SG */
++ if (!udev->bus->sg_tablesize) {
++ /*
++ * If the server's HCD doesn't support SG, break
++ * a single SG request into several URBs and map
++ * each SG list entry to corresponding URB
++ * buffer. The previously allocated SG list is
++ * stored in priv->sgl (If the server's HCD
++ * support SG, SG list is stored only in
++ * urb->sg) and it is used as an indicator that
++ * the server split single SG request into
++ * several URBs. Later, priv->sgl is used by
++ * stub_complete() and stub_send_ret_submit() to
++ * reassemble the divied URBs.
++ */
++ support_sg = 0;
++ num_urbs = nents;
++ priv->completed_urbs = 0;
++ pdu->u.cmd_submit.transfer_flags &=
++ ~URB_DMA_MAP_SG;
++ }
+ } else {
+ buffer = kzalloc(buf_len, GFP_KERNEL);
+ if (!buffer)
+@@ -489,24 +521,6 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
+ }
+ }
+
+- /* Check if the server's HCD supports SG */
+- if (use_sg && !udev->bus->sg_tablesize) {
+- /*
+- * If the server's HCD doesn't support SG, break a single SG
+- * request into several URBs and map each SG list entry to
+- * corresponding URB buffer. The previously allocated SG
+- * list is stored in priv->sgl (If the server's HCD support SG,
+- * SG list is stored only in urb->sg) and it is used as an
+- * indicator that the server split single SG request into
+- * several URBs. Later, priv->sgl is used by stub_complete() and
+- * stub_send_ret_submit() to reassemble the divied URBs.
+- */
+- support_sg = 0;
+- num_urbs = nents;
+- priv->completed_urbs = 0;
+- pdu->u.cmd_submit.transfer_flags &= ~URB_DMA_MAP_SG;
+- }
+-
+ /* allocate urb array */
+ priv->num_urbs = num_urbs;
+ priv->urbs = kmalloc_array(num_urbs, sizeof(*priv->urbs), GFP_KERNEL);
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index bab495d73195..8dcee4faf701 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -103,7 +103,7 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
+ struct iov_iter iov_iter;
+ unsigned out, in;
+ size_t nbytes;
+- size_t len;
++ size_t iov_len, payload_len;
+ int head;
+
+ spin_lock_bh(&vsock->send_pkt_list_lock);
+@@ -148,8 +148,24 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
+ break;
+ }
+
+- len = iov_length(&vq->iov[out], in);
+- iov_iter_init(&iov_iter, READ, &vq->iov[out], in, len);
++ iov_len = iov_length(&vq->iov[out], in);
++ if (iov_len < sizeof(pkt->hdr)) {
++ virtio_transport_free_pkt(pkt);
++ vq_err(vq, "Buffer len [%zu] too small\n", iov_len);
++ break;
++ }
++
++ iov_iter_init(&iov_iter, READ, &vq->iov[out], in, iov_len);
++ payload_len = pkt->len - pkt->off;
++
++ /* If the packet is greater than the space available in the
++ * buffer, we split it using multiple buffers.
++ */
++ if (payload_len > iov_len - sizeof(pkt->hdr))
++ payload_len = iov_len - sizeof(pkt->hdr);
++
++ /* Set the correct length in the header */
++ pkt->hdr.len = cpu_to_le32(payload_len);
+
+ nbytes = copy_to_iter(&pkt->hdr, sizeof(pkt->hdr), &iov_iter);
+ if (nbytes != sizeof(pkt->hdr)) {
+@@ -158,33 +174,47 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
+ break;
+ }
+
+- nbytes = copy_to_iter(pkt->buf, pkt->len, &iov_iter);
+- if (nbytes != pkt->len) {
++ nbytes = copy_to_iter(pkt->buf + pkt->off, payload_len,
++ &iov_iter);
++ if (nbytes != payload_len) {
+ virtio_transport_free_pkt(pkt);
+ vq_err(vq, "Faulted on copying pkt buf\n");
+ break;
+ }
+
+- vhost_add_used(vq, head, sizeof(pkt->hdr) + pkt->len);
++ vhost_add_used(vq, head, sizeof(pkt->hdr) + payload_len);
+ added = true;
+
+- if (pkt->reply) {
+- int val;
+-
+- val = atomic_dec_return(&vsock->queued_replies);
+-
+- /* Do we have resources to resume tx processing? */
+- if (val + 1 == tx_vq->num)
+- restart_tx = true;
+- }
+-
+ /* Deliver to monitoring devices all correctly transmitted
+ * packets.
+ */
+ virtio_transport_deliver_tap_pkt(pkt);
+
+- total_len += pkt->len;
+- virtio_transport_free_pkt(pkt);
++ pkt->off += payload_len;
++ total_len += payload_len;
++
++ /* If we didn't send all the payload we can requeue the packet
++ * to send it with the next available buffer.
++ */
++ if (pkt->off < pkt->len) {
++ spin_lock_bh(&vsock->send_pkt_list_lock);
++ list_add(&pkt->list, &vsock->send_pkt_list);
++ spin_unlock_bh(&vsock->send_pkt_list_lock);
++ } else {
++ if (pkt->reply) {
++ int val;
++
++ val = atomic_dec_return(&vsock->queued_replies);
++
++ /* Do we have resources to resume tx
++ * processing?
++ */
++ if (val + 1 == tx_vq->num)
++ restart_tx = true;
++ }
++
++ virtio_transport_free_pkt(pkt);
++ }
+ } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len)));
+ if (added)
+ vhost_signal(&vsock->dev, vq);
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 9529e28e1822..6228b48d1e12 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -431,7 +431,7 @@ unmap_release:
+ kfree(desc);
+
+ END_USE(vq);
+- return -EIO;
++ return -ENOMEM;
+ }
+
+ /**
+diff --git a/drivers/w1/slaves/w1_ds2438.c b/drivers/w1/slaves/w1_ds2438.c
+index bf641a191d07..7c4e33dbee4d 100644
+--- a/drivers/w1/slaves/w1_ds2438.c
++++ b/drivers/w1/slaves/w1_ds2438.c
+@@ -186,8 +186,8 @@ static int w1_ds2438_change_config_bit(struct w1_slave *sl, u8 mask, u8 value)
+ return -1;
+ }
+
+-static uint16_t w1_ds2438_get_voltage(struct w1_slave *sl,
+- int adc_input, uint16_t *voltage)
++static int w1_ds2438_get_voltage(struct w1_slave *sl,
++ int adc_input, uint16_t *voltage)
+ {
+ unsigned int retries = W1_DS2438_RETRIES;
+ u8 w1_buf[DS2438_PAGE_SIZE + 1 /*for CRC*/];
+@@ -235,6 +235,25 @@ post_unlock:
+ return ret;
+ }
+
++static int w1_ds2438_get_current(struct w1_slave *sl, int16_t *voltage)
++{
++ u8 w1_buf[DS2438_PAGE_SIZE + 1 /*for CRC*/];
++ int ret;
++
++ mutex_lock(&sl->master->bus_mutex);
++
++ if (w1_ds2438_get_page(sl, 0, w1_buf) == 0) {
++ /* The voltage measured across current sense resistor RSENS. */
++ *voltage = (((int16_t) w1_buf[DS2438_CURRENT_MSB]) << 8) | ((int16_t) w1_buf[DS2438_CURRENT_LSB]);
++ ret = 0;
++ } else
++ ret = -1;
++
++ mutex_unlock(&sl->master->bus_mutex);
++
++ return ret;
++}
++
+ static ssize_t iad_write(struct file *filp, struct kobject *kobj,
+ struct bin_attribute *bin_attr, char *buf,
+ loff_t off, size_t count)
+@@ -257,6 +276,27 @@ static ssize_t iad_write(struct file *filp, struct kobject *kobj,
+ return ret;
+ }
+
++static ssize_t iad_read(struct file *filp, struct kobject *kobj,
++ struct bin_attribute *bin_attr, char *buf,
++ loff_t off, size_t count)
++{
++ struct w1_slave *sl = kobj_to_w1_slave(kobj);
++ int ret;
++ int16_t voltage;
++
++ if (off != 0)
++ return 0;
++ if (!buf)
++ return -EINVAL;
++
++ if (w1_ds2438_get_current(sl, &voltage) == 0) {
++ ret = snprintf(buf, count, "%i\n", voltage);
++ } else
++ ret = -EIO;
++
++ return ret;
++}
++
+ static ssize_t page0_read(struct file *filp, struct kobject *kobj,
+ struct bin_attribute *bin_attr, char *buf,
+ loff_t off, size_t count)
+@@ -272,9 +312,13 @@ static ssize_t page0_read(struct file *filp, struct kobject *kobj,
+
+ mutex_lock(&sl->master->bus_mutex);
+
++ /* Read no more than page0 size */
++ if (count > DS2438_PAGE_SIZE)
++ count = DS2438_PAGE_SIZE;
++
+ if (w1_ds2438_get_page(sl, 0, w1_buf) == 0) {
+- memcpy(buf, &w1_buf, DS2438_PAGE_SIZE);
+- ret = DS2438_PAGE_SIZE;
++ memcpy(buf, &w1_buf, count);
++ ret = count;
+ } else
+ ret = -EIO;
+
+@@ -289,7 +333,6 @@ static ssize_t temperature_read(struct file *filp, struct kobject *kobj,
+ {
+ struct w1_slave *sl = kobj_to_w1_slave(kobj);
+ int ret;
+- ssize_t c = PAGE_SIZE;
+ int16_t temp;
+
+ if (off != 0)
+@@ -298,8 +341,7 @@ static ssize_t temperature_read(struct file *filp, struct kobject *kobj,
+ return -EINVAL;
+
+ if (w1_ds2438_get_temperature(sl, &temp) == 0) {
+- c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", temp);
+- ret = PAGE_SIZE - c;
++ ret = snprintf(buf, count, "%i\n", temp);
+ } else
+ ret = -EIO;
+
+@@ -312,7 +354,6 @@ static ssize_t vad_read(struct file *filp, struct kobject *kobj,
+ {
+ struct w1_slave *sl = kobj_to_w1_slave(kobj);
+ int ret;
+- ssize_t c = PAGE_SIZE;
+ uint16_t voltage;
+
+ if (off != 0)
+@@ -321,8 +362,7 @@ static ssize_t vad_read(struct file *filp, struct kobject *kobj,
+ return -EINVAL;
+
+ if (w1_ds2438_get_voltage(sl, DS2438_ADC_INPUT_VAD, &voltage) == 0) {
+- c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", voltage);
+- ret = PAGE_SIZE - c;
++ ret = snprintf(buf, count, "%u\n", voltage);
+ } else
+ ret = -EIO;
+
+@@ -335,7 +375,6 @@ static ssize_t vdd_read(struct file *filp, struct kobject *kobj,
+ {
+ struct w1_slave *sl = kobj_to_w1_slave(kobj);
+ int ret;
+- ssize_t c = PAGE_SIZE;
+ uint16_t voltage;
+
+ if (off != 0)
+@@ -344,15 +383,14 @@ static ssize_t vdd_read(struct file *filp, struct kobject *kobj,
+ return -EINVAL;
+
+ if (w1_ds2438_get_voltage(sl, DS2438_ADC_INPUT_VDD, &voltage) == 0) {
+- c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", voltage);
+- ret = PAGE_SIZE - c;
++ ret = snprintf(buf, count, "%u\n", voltage);
+ } else
+ ret = -EIO;
+
+ return ret;
+ }
+
+-static BIN_ATTR(iad, S_IRUGO | S_IWUSR | S_IWGRP, NULL, iad_write, 1);
++static BIN_ATTR(iad, S_IRUGO | S_IWUSR | S_IWGRP, iad_read, iad_write, 0);
+ static BIN_ATTR_RO(page0, DS2438_PAGE_SIZE);
+ static BIN_ATTR_RO(temperature, 0/* real length varies */);
+ static BIN_ATTR_RO(vad, 0/* real length varies */);
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index d4e8b717ce2b..747a15acbce3 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -350,7 +350,10 @@ static enum bp_state reserve_additional_memory(void)
+ * callers drop the mutex before trying again.
+ */
+ mutex_unlock(&balloon_mutex);
++ /* add_memory_resource() requires the device_hotplug lock */
++ lock_device_hotplug();
+ rc = add_memory_resource(nid, resource, memhp_auto_online);
++ unlock_device_hotplug();
+ mutex_lock(&balloon_mutex);
+
+ if (rc) {
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 9fd383285f0e..fc764f350f05 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -3031,6 +3031,10 @@ int btrfs_search_old_slot(struct btrfs_root *root, const struct btrfs_key *key,
+
+ again:
+ b = get_old_root(root, time_seq);
++ if (!b) {
++ ret = -EIO;
++ goto done;
++ }
+ level = btrfs_header_level(b);
+ p->locks[level] = BTRFS_READ_LOCK;
+
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 7592beb53fc4..00ff4349b457 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1337,7 +1337,7 @@ again:
+
+ if (i_done != page_cnt) {
+ spin_lock(&BTRFS_I(inode)->lock);
+- BTRFS_I(inode)->outstanding_extents++;
++ btrfs_mod_outstanding_extents(BTRFS_I(inode), 1);
+ spin_unlock(&BTRFS_I(inode)->lock);
+ btrfs_delalloc_release_space(inode, data_reserved,
+ start_index << PAGE_SHIFT,
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 8888337a95b6..ddbad8d50949 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -1919,7 +1919,7 @@ restore:
+ }
+
+ /* Used to sort the devices by max_avail(descending sort) */
+-static int btrfs_cmp_device_free_bytes(const void *dev_info1,
++static inline int btrfs_cmp_device_free_bytes(const void *dev_info1,
+ const void *dev_info2)
+ {
+ if (((struct btrfs_device_info *)dev_info1)->max_avail >
+@@ -1948,8 +1948,8 @@ static inline void btrfs_descending_sort_devices(
+ * The helper to calc the free space on the devices that can be used to store
+ * file data.
+ */
+-static int btrfs_calc_avail_data_space(struct btrfs_fs_info *fs_info,
+- u64 *free_bytes)
++static inline int btrfs_calc_avail_data_space(struct btrfs_fs_info *fs_info,
++ u64 *free_bytes)
+ {
+ struct btrfs_device_info *devices_info;
+ struct btrfs_fs_devices *fs_devices = fs_info->fs_devices;
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 92ab20433682..91a7ad259bcf 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -1735,7 +1735,6 @@ static long ceph_fallocate(struct file *file, int mode,
+ struct ceph_file_info *fi = file->private_data;
+ struct inode *inode = file_inode(file);
+ struct ceph_inode_info *ci = ceph_inode(inode);
+- struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
+ struct ceph_cap_flush *prealloc_cf;
+ int want, got = 0;
+ int dirty;
+@@ -1743,10 +1742,7 @@ static long ceph_fallocate(struct file *file, int mode,
+ loff_t endoff = 0;
+ loff_t size;
+
+- if ((offset + length) > max(i_size_read(inode), fsc->max_file_size))
+- return -EFBIG;
+-
+- if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
++ if (mode != (FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+ return -EOPNOTSUPP;
+
+ if (!S_ISREG(inode->i_mode))
+@@ -1763,18 +1759,6 @@ static long ceph_fallocate(struct file *file, int mode,
+ goto unlock;
+ }
+
+- if (!(mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE)) &&
+- ceph_quota_is_max_bytes_exceeded(inode, offset + length)) {
+- ret = -EDQUOT;
+- goto unlock;
+- }
+-
+- if (ceph_osdmap_flag(&fsc->client->osdc, CEPH_OSDMAP_FULL) &&
+- !(mode & FALLOC_FL_PUNCH_HOLE)) {
+- ret = -ENOSPC;
+- goto unlock;
+- }
+-
+ if (ci->i_inline_version != CEPH_INLINE_NONE) {
+ ret = ceph_uninline_data(file, NULL);
+ if (ret < 0)
+@@ -1782,12 +1766,12 @@ static long ceph_fallocate(struct file *file, int mode,
+ }
+
+ size = i_size_read(inode);
+- if (!(mode & FALLOC_FL_KEEP_SIZE)) {
+- endoff = offset + length;
+- ret = inode_newsize_ok(inode, endoff);
+- if (ret)
+- goto unlock;
+- }
++
++ /* Are we punching a hole beyond EOF? */
++ if (offset >= size)
++ goto unlock;
++ if ((offset + length) > size)
++ length = size - offset;
+
+ if (fi->fmode & CEPH_FILE_MODE_LAZY)
+ want = CEPH_CAP_FILE_BUFFER | CEPH_CAP_FILE_LAZYIO;
+@@ -1798,16 +1782,8 @@ static long ceph_fallocate(struct file *file, int mode,
+ if (ret < 0)
+ goto unlock;
+
+- if (mode & FALLOC_FL_PUNCH_HOLE) {
+- if (offset < size)
+- ceph_zero_pagecache_range(inode, offset, length);
+- ret = ceph_zero_objects(inode, offset, length);
+- } else if (endoff > size) {
+- truncate_pagecache_range(inode, size, -1);
+- if (ceph_inode_set_size(inode, endoff))
+- ceph_check_caps(ceph_inode(inode),
+- CHECK_CAPS_AUTHONLY, NULL);
+- }
++ ceph_zero_pagecache_range(inode, offset, length);
++ ret = ceph_zero_objects(inode, offset, length);
+
+ if (!ret) {
+ spin_lock(&ci->i_ceph_lock);
+@@ -1817,9 +1793,6 @@ static long ceph_fallocate(struct file *file, int mode,
+ spin_unlock(&ci->i_ceph_lock);
+ if (dirty)
+ __mark_inode_dirty(inode, dirty);
+- if ((endoff > size) &&
+- ceph_quota_is_max_bytes_approaching(inode, endoff))
+- ceph_check_caps(ci, CHECK_CAPS_NODELAY, NULL);
+ }
+
+ ceph_put_cap_refs(ci, got);
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index acb70a6a82f0..1e438e0faf77 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1694,7 +1694,6 @@ retry_lookup:
+ if (IS_ERR(realdn)) {
+ err = PTR_ERR(realdn);
+ d_drop(dn);
+- dn = NULL;
+ goto next_item;
+ }
+ dn = realdn;
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index b1f5d0d28335..9194f17675c8 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2283,7 +2283,7 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
+ struct cifs_ses *ses = tcon->ses;
+ struct kvec iov[SMB2_CREATE_IOV_SIZE];
+ struct kvec rsp_iov = {NULL, 0};
+- int resp_buftype;
++ int resp_buftype = CIFS_NO_BUFFER;
+ int rc = 0;
+ int flags = 0;
+
+@@ -2570,7 +2570,7 @@ SMB2_close_flags(const unsigned int xid, struct cifs_tcon *tcon,
+ struct cifs_ses *ses = tcon->ses;
+ struct kvec iov[1];
+ struct kvec rsp_iov;
+- int resp_buftype;
++ int resp_buftype = CIFS_NO_BUFFER;
+ int rc = 0;
+
+ cifs_dbg(FYI, "Close\n");
+@@ -2723,7 +2723,7 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon,
+ struct kvec iov[1];
+ struct kvec rsp_iov;
+ int rc = 0;
+- int resp_buftype;
++ int resp_buftype = CIFS_NO_BUFFER;
+ struct cifs_ses *ses = tcon->ses;
+ int flags = 0;
+
+diff --git a/fs/dlm/member.c b/fs/dlm/member.c
+index 3fda3832cf6a..cad6d85911a8 100644
+--- a/fs/dlm/member.c
++++ b/fs/dlm/member.c
+@@ -680,7 +680,7 @@ int dlm_ls_start(struct dlm_ls *ls)
+
+ error = dlm_config_nodes(ls->ls_name, &nodes, &count);
+ if (error < 0)
+- goto fail;
++ goto fail_rv;
+
+ spin_lock(&ls->ls_recover_lock);
+
+@@ -712,8 +712,9 @@ int dlm_ls_start(struct dlm_ls *ls)
+ return 0;
+
+ fail:
+- kfree(rv);
+ kfree(nodes);
++ fail_rv:
++ kfree(rv);
+ return error;
+ }
+
+diff --git a/fs/dlm/user.c b/fs/dlm/user.c
+index 2a669390cd7f..13f29409600b 100644
+--- a/fs/dlm/user.c
++++ b/fs/dlm/user.c
+@@ -702,7 +702,7 @@ static int copy_result_to_user(struct dlm_user_args *ua, int compat,
+ result.version[0] = DLM_DEVICE_VERSION_MAJOR;
+ result.version[1] = DLM_DEVICE_VERSION_MINOR;
+ result.version[2] = DLM_DEVICE_VERSION_PATCH;
+- memcpy(&result.lksb, &ua->lksb, sizeof(struct dlm_lksb));
++ memcpy(&result.lksb, &ua->lksb, offsetof(struct dlm_lksb, sb_lvbptr));
+ result.user_lksb = ua->user_lksb;
+
+ /* FIXME: dlm1 provides for the user's bastparam/addr to not be updated
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 3a2fd6676966..a7436ad19458 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1782,6 +1782,7 @@ int f2fs_do_write_data_page(struct f2fs_io_info *fio)
+ /* This page is already truncated */
+ if (fio->old_blkaddr == NULL_ADDR) {
+ ClearPageUptodate(page);
++ clear_cold_data(page);
+ goto out_writepage;
+ }
+ got_it:
+@@ -1957,8 +1958,10 @@ done:
+
+ out:
+ inode_dec_dirty_pages(inode);
+- if (err)
++ if (err) {
+ ClearPageUptodate(page);
++ clear_cold_data(page);
++ }
+
+ if (wbc->for_reclaim) {
+ f2fs_submit_merged_write_cond(sbi, inode, 0, page->index, DATA);
+@@ -2573,6 +2576,8 @@ void f2fs_invalidate_page(struct page *page, unsigned int offset,
+ }
+ }
+
++ clear_cold_data(page);
++
+ /* This is atomic written page, keep Private */
+ if (IS_ATOMIC_WRITTEN_PAGE(page))
+ return f2fs_drop_inmem_page(inode, page);
+@@ -2591,6 +2596,7 @@ int f2fs_release_page(struct page *page, gfp_t wait)
+ if (IS_ATOMIC_WRITTEN_PAGE(page))
+ return 0;
+
++ clear_cold_data(page);
+ set_page_private(page, 0);
+ ClearPagePrivate(page);
+ return 1;
+diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
+index ecc3a4e2be96..cd611a57d04d 100644
+--- a/fs/f2fs/dir.c
++++ b/fs/f2fs/dir.c
+@@ -733,6 +733,7 @@ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
+ clear_page_dirty_for_io(page);
+ ClearPagePrivate(page);
+ ClearPageUptodate(page);
++ clear_cold_data(page);
+ inode_dec_dirty_pages(dir);
+ f2fs_remove_dirty_inode(dir);
+ }
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 2dc49a541907..34e48bcf5087 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3388,7 +3388,7 @@ static inline void f2fs_set_encrypted_inode(struct inode *inode)
+ {
+ #ifdef CONFIG_F2FS_FS_ENCRYPTION
+ file_set_encrypt(inode);
+- inode->i_flags |= S_ENCRYPTED;
++ f2fs_set_inode_flags(inode);
+ #endif
+ }
+
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index 1f67e389169f..6b23dcbf52f4 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -124,6 +124,8 @@ static struct inode *f2fs_new_inode(struct inode *dir, umode_t mode)
+ if (F2FS_I(inode)->i_flags & F2FS_PROJINHERIT_FL)
+ set_inode_flag(inode, FI_PROJ_INHERIT);
+
++ f2fs_set_inode_flags(inode);
++
+ trace_f2fs_new_inode(inode, 0);
+ return inode;
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index d78009694f3f..43a07514c357 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -277,8 +277,10 @@ retry:
+ }
+ next:
+ /* we don't need to invalidate this in the sccessful status */
+- if (drop || recover)
++ if (drop || recover) {
+ ClearPageUptodate(page);
++ clear_cold_data(page);
++ }
+ set_page_private(page, 0);
+ ClearPagePrivate(page);
+ f2fs_put_page(page, 1);
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 15779123d089..7a9cc64f5ca3 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1837,8 +1837,7 @@ static int f2fs_quota_on(struct super_block *sb, int type, int format_id,
+
+ inode_lock(inode);
+ F2FS_I(inode)->i_flags |= F2FS_NOATIME_FL | F2FS_IMMUTABLE_FL;
+- inode_set_flags(inode, S_NOATIME | S_IMMUTABLE,
+- S_NOATIME | S_IMMUTABLE);
++ f2fs_set_inode_flags(inode);
+ inode_unlock(inode);
+ f2fs_mark_inode_dirty_sync(inode, false);
+
+@@ -1863,7 +1862,7 @@ static int f2fs_quota_off(struct super_block *sb, int type)
+
+ inode_lock(inode);
+ F2FS_I(inode)->i_flags &= ~(F2FS_NOATIME_FL | F2FS_IMMUTABLE_FL);
+- inode_set_flags(inode, 0, S_NOATIME | S_IMMUTABLE);
++ f2fs_set_inode_flags(inode);
+ inode_unlock(inode);
+ f2fs_mark_inode_dirty_sync(inode, false);
+ out_put:
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 63e5387c84d2..c94c4ac1ae78 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -642,7 +642,10 @@ static void __rs_deltree(struct gfs2_blkreserv *rs)
+ RB_CLEAR_NODE(&rs->rs_node);
+
+ if (rs->rs_free) {
+- struct gfs2_bitmap *bi = rbm_bi(&rs->rs_rbm);
++ u64 last_block = gfs2_rbm_to_block(&rs->rs_rbm) +
++ rs->rs_free - 1;
++ struct gfs2_rbm last_rbm = { .rgd = rs->rs_rbm.rgd, };
++ struct gfs2_bitmap *start, *last;
+
+ /* return reserved blocks to the rgrp */
+ BUG_ON(rs->rs_rbm.rgd->rd_reserved < rs->rs_free);
+@@ -653,7 +656,13 @@ static void __rs_deltree(struct gfs2_blkreserv *rs)
+ it will force the number to be recalculated later. */
+ rgd->rd_extfail_pt += rs->rs_free;
+ rs->rs_free = 0;
+- clear_bit(GBF_FULL, &bi->bi_flags);
++ if (gfs2_rbm_from_block(&last_rbm, last_block))
++ return;
++ start = rbm_bi(&rs->rs_rbm);
++ last = rbm_bi(&last_rbm);
++ do
++ clear_bit(GBF_FULL, &start->bi_flags);
++ while (start++ != last);
+ }
+ }
+
+diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
+index da25c49203cc..896396554bcc 100644
+--- a/fs/hfs/brec.c
++++ b/fs/hfs/brec.c
+@@ -445,6 +445,7 @@ skip:
+ /* restore search_key */
+ hfs_bnode_read_key(node, fd->search_key, 14);
+ }
++ new_node = NULL;
+ }
+
+ if (!rec && node->parent)
+diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
+index 9bdff5e40626..19017d296173 100644
+--- a/fs/hfs/btree.c
++++ b/fs/hfs/btree.c
+@@ -220,25 +220,17 @@ static struct hfs_bnode *hfs_bmap_new_bmap(struct hfs_bnode *prev, u32 idx)
+ return node;
+ }
+
+-struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
++/* Make sure @tree has enough space for the @rsvd_nodes */
++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes)
+ {
+- struct hfs_bnode *node, *next_node;
+- struct page **pagep;
+- u32 nidx, idx;
+- unsigned off;
+- u16 off16;
+- u16 len;
+- u8 *data, byte, m;
+- int i;
+-
+- while (!tree->free_nodes) {
+- struct inode *inode = tree->inode;
+- u32 count;
+- int res;
++ struct inode *inode = tree->inode;
++ u32 count;
++ int res;
+
++ while (tree->free_nodes < rsvd_nodes) {
+ res = hfs_extend_file(inode);
+ if (res)
+- return ERR_PTR(res);
++ return res;
+ HFS_I(inode)->phys_size = inode->i_size =
+ (loff_t)HFS_I(inode)->alloc_blocks *
+ HFS_SB(tree->sb)->alloc_blksz;
+@@ -246,9 +238,26 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
+ tree->sb->s_blocksize_bits;
+ inode_set_bytes(inode, inode->i_size);
+ count = inode->i_size >> tree->node_size_shift;
+- tree->free_nodes = count - tree->node_count;
++ tree->free_nodes += count - tree->node_count;
+ tree->node_count = count;
+ }
++ return 0;
++}
++
++struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
++{
++ struct hfs_bnode *node, *next_node;
++ struct page **pagep;
++ u32 nidx, idx;
++ unsigned off;
++ u16 off16;
++ u16 len;
++ u8 *data, byte, m;
++ int i, res;
++
++ res = hfs_bmap_reserve(tree, 1);
++ if (res)
++ return ERR_PTR(res);
+
+ nidx = 0;
+ node = hfs_bnode_find(tree, nidx);
+diff --git a/fs/hfs/btree.h b/fs/hfs/btree.h
+index c8b252dbb26c..dcc2aab1b2c4 100644
+--- a/fs/hfs/btree.h
++++ b/fs/hfs/btree.h
+@@ -82,6 +82,7 @@ struct hfs_find_data {
+ extern struct hfs_btree *hfs_btree_open(struct super_block *, u32, btree_keycmp);
+ extern void hfs_btree_close(struct hfs_btree *);
+ extern void hfs_btree_write(struct hfs_btree *);
++extern int hfs_bmap_reserve(struct hfs_btree *, int);
+ extern struct hfs_bnode * hfs_bmap_alloc(struct hfs_btree *);
+ extern void hfs_bmap_free(struct hfs_bnode *node);
+
+diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c
+index 8a66405b0f8b..d365bf0b8c77 100644
+--- a/fs/hfs/catalog.c
++++ b/fs/hfs/catalog.c
+@@ -97,6 +97,14 @@ int hfs_cat_create(u32 cnid, struct inode *dir, const struct qstr *str, struct i
+ if (err)
+ return err;
+
++ /*
++ * Fail early and avoid ENOSPC during the btree operations. We may
++ * have to split the root node at most once.
++ */
++ err = hfs_bmap_reserve(fd.tree, 2 * fd.tree->depth);
++ if (err)
++ goto err2;
++
+ hfs_cat_build_key(sb, fd.search_key, cnid, NULL);
+ entry_size = hfs_cat_build_thread(sb, &entry, S_ISDIR(inode->i_mode) ?
+ HFS_CDR_THD : HFS_CDR_FTH,
+@@ -295,6 +303,14 @@ int hfs_cat_move(u32 cnid, struct inode *src_dir, const struct qstr *src_name,
+ return err;
+ dst_fd = src_fd;
+
++ /*
++ * Fail early and avoid ENOSPC during the btree operations. We may
++ * have to split the root node at most once.
++ */
++ err = hfs_bmap_reserve(src_fd.tree, 2 * src_fd.tree->depth);
++ if (err)
++ goto out;
++
+ /* find the old dir entry and read the data */
+ hfs_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name);
+ err = hfs_brec_find(&src_fd);
+diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c
+index 5d0182654580..263d5028d9d1 100644
+--- a/fs/hfs/extent.c
++++ b/fs/hfs/extent.c
+@@ -117,6 +117,10 @@ static int __hfs_ext_write_extent(struct inode *inode, struct hfs_find_data *fd)
+ if (HFS_I(inode)->flags & HFS_FLG_EXT_NEW) {
+ if (res != -ENOENT)
+ return res;
++ /* Fail early and avoid ENOSPC during the btree operation */
++ res = hfs_bmap_reserve(fd->tree, fd->tree->depth + 1);
++ if (res)
++ return res;
+ hfs_brec_insert(fd, HFS_I(inode)->cached_extents, sizeof(hfs_extent_rec));
+ HFS_I(inode)->flags &= ~(HFS_FLG_EXT_DIRTY|HFS_FLG_EXT_NEW);
+ } else {
+@@ -300,7 +304,7 @@ int hfs_free_fork(struct super_block *sb, struct hfs_cat_file *file, int type)
+ return 0;
+
+ blocks = 0;
+- for (i = 0; i < 3; extent++, i++)
++ for (i = 0; i < 3; i++)
+ blocks += be16_to_cpu(extent[i].count);
+
+ res = hfs_free_extents(sb, extent, blocks, blocks);
+@@ -341,7 +345,9 @@ int hfs_get_block(struct inode *inode, sector_t block,
+ ablock = (u32)block / HFS_SB(sb)->fs_div;
+
+ if (block >= HFS_I(inode)->fs_blocks) {
+- if (block > HFS_I(inode)->fs_blocks || !create)
++ if (!create)
++ return 0;
++ if (block > HFS_I(inode)->fs_blocks)
+ return -EIO;
+ if (ablock >= HFS_I(inode)->alloc_blocks) {
+ res = hfs_extend_file(inode);
+diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
+index a2dfa1b2a89c..da243c84e93b 100644
+--- a/fs/hfs/inode.c
++++ b/fs/hfs/inode.c
+@@ -642,6 +642,8 @@ int hfs_inode_setattr(struct dentry *dentry, struct iattr * attr)
+
+ truncate_setsize(inode, attr->ia_size);
+ hfs_file_truncate(inode);
++ inode->i_atime = inode->i_mtime = inode->i_ctime =
++ current_time(inode);
+ }
+
+ setattr_copy(inode, attr);
+diff --git a/fs/hfsplus/attributes.c b/fs/hfsplus/attributes.c
+index 2bab6b3cdba4..e6d554476db4 100644
+--- a/fs/hfsplus/attributes.c
++++ b/fs/hfsplus/attributes.c
+@@ -217,6 +217,11 @@ int hfsplus_create_attr(struct inode *inode,
+ if (err)
+ goto failed_init_create_attr;
+
++ /* Fail early and avoid ENOSPC during the btree operation */
++ err = hfs_bmap_reserve(fd.tree, fd.tree->depth + 1);
++ if (err)
++ goto failed_create_attr;
++
+ if (name) {
+ err = hfsplus_attr_build_key(sb, fd.search_key,
+ inode->i_ino, name);
+@@ -313,6 +318,11 @@ int hfsplus_delete_attr(struct inode *inode, const char *name)
+ if (err)
+ return err;
+
++ /* Fail early and avoid ENOSPC during the btree operation */
++ err = hfs_bmap_reserve(fd.tree, fd.tree->depth);
++ if (err)
++ goto out;
++
+ if (name) {
+ err = hfsplus_attr_build_key(sb, fd.search_key,
+ inode->i_ino, name);
+diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
+index aa17a392b414..1918544a7871 100644
+--- a/fs/hfsplus/brec.c
++++ b/fs/hfsplus/brec.c
+@@ -449,6 +449,7 @@ skip:
+ /* restore search_key */
+ hfs_bnode_read_key(node, fd->search_key, 14);
+ }
++ new_node = NULL;
+ }
+
+ if (!rec && node->parent)
+diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
+index 3de3bc4918b5..66774f4cb4fd 100644
+--- a/fs/hfsplus/btree.c
++++ b/fs/hfsplus/btree.c
+@@ -342,26 +342,21 @@ static struct hfs_bnode *hfs_bmap_new_bmap(struct hfs_bnode *prev, u32 idx)
+ return node;
+ }
+
+-struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
++/* Make sure @tree has enough space for the @rsvd_nodes */
++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes)
+ {
+- struct hfs_bnode *node, *next_node;
+- struct page **pagep;
+- u32 nidx, idx;
+- unsigned off;
+- u16 off16;
+- u16 len;
+- u8 *data, byte, m;
+- int i;
++ struct inode *inode = tree->inode;
++ struct hfsplus_inode_info *hip = HFSPLUS_I(inode);
++ u32 count;
++ int res;
+
+- while (!tree->free_nodes) {
+- struct inode *inode = tree->inode;
+- struct hfsplus_inode_info *hip = HFSPLUS_I(inode);
+- u32 count;
+- int res;
++ if (rsvd_nodes <= 0)
++ return 0;
+
++ while (tree->free_nodes < rsvd_nodes) {
+ res = hfsplus_file_extend(inode, hfs_bnode_need_zeroout(tree));
+ if (res)
+- return ERR_PTR(res);
++ return res;
+ hip->phys_size = inode->i_size =
+ (loff_t)hip->alloc_blocks <<
+ HFSPLUS_SB(tree->sb)->alloc_blksz_shift;
+@@ -369,9 +364,26 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
+ hip->alloc_blocks << HFSPLUS_SB(tree->sb)->fs_shift;
+ inode_set_bytes(inode, inode->i_size);
+ count = inode->i_size >> tree->node_size_shift;
+- tree->free_nodes = count - tree->node_count;
++ tree->free_nodes += count - tree->node_count;
+ tree->node_count = count;
+ }
++ return 0;
++}
++
++struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
++{
++ struct hfs_bnode *node, *next_node;
++ struct page **pagep;
++ u32 nidx, idx;
++ unsigned off;
++ u16 off16;
++ u16 len;
++ u8 *data, byte, m;
++ int i, res;
++
++ res = hfs_bmap_reserve(tree, 1);
++ if (res)
++ return ERR_PTR(res);
+
+ nidx = 0;
+ node = hfs_bnode_find(tree, nidx);
+diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
+index a196369ba779..35472cba750e 100644
+--- a/fs/hfsplus/catalog.c
++++ b/fs/hfsplus/catalog.c
+@@ -265,6 +265,14 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
+ if (err)
+ return err;
+
++ /*
++ * Fail early and avoid ENOSPC during the btree operations. We may
++ * have to split the root node at most once.
++ */
++ err = hfs_bmap_reserve(fd.tree, 2 * fd.tree->depth);
++ if (err)
++ goto err2;
++
+ hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
+ entry_size = hfsplus_fill_cat_thread(sb, &entry,
+ S_ISDIR(inode->i_mode) ?
+@@ -333,6 +341,14 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, const struct qstr *str)
+ if (err)
+ return err;
+
++ /*
++ * Fail early and avoid ENOSPC during the btree operations. We may
++ * have to split the root node at most once.
++ */
++ err = hfs_bmap_reserve(fd.tree, 2 * (int)fd.tree->depth - 2);
++ if (err)
++ goto out;
++
+ if (!str) {
+ int len;
+
+@@ -433,6 +449,14 @@ int hfsplus_rename_cat(u32 cnid,
+ return err;
+ dst_fd = src_fd;
+
++ /*
++ * Fail early and avoid ENOSPC during the btree operations. We may
++ * have to split the root node at most twice.
++ */
++ err = hfs_bmap_reserve(src_fd.tree, 4 * (int)src_fd.tree->depth - 1);
++ if (err)
++ goto out;
++
+ /* find the old dir entry and read the data */
+ err = hfsplus_cat_build_key(sb, src_fd.search_key,
+ src_dir->i_ino, src_name);
+diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
+index 8e0f59767694..a930ddd15681 100644
+--- a/fs/hfsplus/extents.c
++++ b/fs/hfsplus/extents.c
+@@ -100,6 +100,10 @@ static int __hfsplus_ext_write_extent(struct inode *inode,
+ if (hip->extent_state & HFSPLUS_EXT_NEW) {
+ if (res != -ENOENT)
+ return res;
++ /* Fail early and avoid ENOSPC during the btree operation */
++ res = hfs_bmap_reserve(fd->tree, fd->tree->depth + 1);
++ if (res)
++ return res;
+ hfs_brec_insert(fd, hip->cached_extents,
+ sizeof(hfsplus_extent_rec));
+ hip->extent_state &= ~(HFSPLUS_EXT_DIRTY | HFSPLUS_EXT_NEW);
+@@ -233,7 +237,9 @@ int hfsplus_get_block(struct inode *inode, sector_t iblock,
+ ablock = iblock >> sbi->fs_shift;
+
+ if (iblock >= hip->fs_blocks) {
+- if (iblock > hip->fs_blocks || !create)
++ if (!create)
++ return 0;
++ if (iblock > hip->fs_blocks)
+ return -EIO;
+ if (ablock >= hip->alloc_blocks) {
+ res = hfsplus_file_extend(inode, false);
+diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
+index 8e039435958a..dd7ad9f13e3a 100644
+--- a/fs/hfsplus/hfsplus_fs.h
++++ b/fs/hfsplus/hfsplus_fs.h
+@@ -311,6 +311,7 @@ static inline unsigned short hfsplus_min_io_size(struct super_block *sb)
+ #define hfs_btree_open hfsplus_btree_open
+ #define hfs_btree_close hfsplus_btree_close
+ #define hfs_btree_write hfsplus_btree_write
++#define hfs_bmap_reserve hfsplus_bmap_reserve
+ #define hfs_bmap_alloc hfsplus_bmap_alloc
+ #define hfs_bmap_free hfsplus_bmap_free
+ #define hfs_bnode_read hfsplus_bnode_read
+@@ -395,6 +396,7 @@ u32 hfsplus_calc_btree_clump_size(u32 block_size, u32 node_size, u64 sectors,
+ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id);
+ void hfs_btree_close(struct hfs_btree *tree);
+ int hfs_btree_write(struct hfs_btree *tree);
++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes);
+ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree);
+ void hfs_bmap_free(struct hfs_bnode *node);
+
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index 8e9427a42b81..d7ab9d8c4b67 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -261,6 +261,7 @@ static int hfsplus_setattr(struct dentry *dentry, struct iattr *attr)
+ }
+ truncate_setsize(inode, attr->ia_size);
+ hfsplus_file_truncate(inode);
++ inode->i_mtime = inode->i_ctime = current_time(inode);
+ }
+
+ setattr_copy(inode, attr);
+diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
+index 9f8250df99f1..f9b84f7a3e4b 100644
+--- a/fs/ocfs2/buffer_head_io.c
++++ b/fs/ocfs2/buffer_head_io.c
+@@ -99,25 +99,34 @@ out:
+ return ret;
+ }
+
++/* Caller must provide a bhs[] with all NULL or non-NULL entries, so it
++ * will be easier to handle read failure.
++ */
+ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
+ unsigned int nr, struct buffer_head *bhs[])
+ {
+ int status = 0;
+ unsigned int i;
+ struct buffer_head *bh;
++ int new_bh = 0;
+
+ trace_ocfs2_read_blocks_sync((unsigned long long)block, nr);
+
+ if (!nr)
+ goto bail;
+
++ /* Don't put buffer head and re-assign it to NULL if it is allocated
++ * outside since the caller can't be aware of this alternation!
++ */
++ new_bh = (bhs[0] == NULL);
++
+ for (i = 0 ; i < nr ; i++) {
+ if (bhs[i] == NULL) {
+ bhs[i] = sb_getblk(osb->sb, block++);
+ if (bhs[i] == NULL) {
+ status = -ENOMEM;
+ mlog_errno(status);
+- goto bail;
++ break;
+ }
+ }
+ bh = bhs[i];
+@@ -157,9 +166,26 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
+ submit_bh(REQ_OP_READ, 0, bh);
+ }
+
++read_failure:
+ for (i = nr; i > 0; i--) {
+ bh = bhs[i - 1];
+
++ if (unlikely(status)) {
++ if (new_bh && bh) {
++ /* If middle bh fails, let previous bh
++ * finish its read and then put it to
++ * aovoid bh leak
++ */
++ if (!buffer_jbd(bh))
++ wait_on_buffer(bh);
++ put_bh(bh);
++ bhs[i - 1] = NULL;
++ } else if (bh && buffer_uptodate(bh)) {
++ clear_buffer_uptodate(bh);
++ }
++ continue;
++ }
++
+ /* No need to wait on the buffer if it's managed by JBD. */
+ if (!buffer_jbd(bh))
+ wait_on_buffer(bh);
+@@ -169,8 +195,7 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
+ * so we can safely record this and loop back
+ * to cleanup the other buffers. */
+ status = -EIO;
+- put_bh(bh);
+- bhs[i - 1] = NULL;
++ goto read_failure;
+ }
+ }
+
+@@ -178,6 +203,9 @@ bail:
+ return status;
+ }
+
++/* Caller must provide a bhs[] with all NULL or non-NULL entries, so it
++ * will be easier to handle read failure.
++ */
+ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ struct buffer_head *bhs[], int flags,
+ int (*validate)(struct super_block *sb,
+@@ -187,6 +215,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ int i, ignore_cache = 0;
+ struct buffer_head *bh;
+ struct super_block *sb = ocfs2_metadata_cache_get_super(ci);
++ int new_bh = 0;
+
+ trace_ocfs2_read_blocks_begin(ci, (unsigned long long)block, nr, flags);
+
+@@ -212,6 +241,11 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ goto bail;
+ }
+
++ /* Don't put buffer head and re-assign it to NULL if it is allocated
++ * outside since the caller can't be aware of this alternation!
++ */
++ new_bh = (bhs[0] == NULL);
++
+ ocfs2_metadata_cache_io_lock(ci);
+ for (i = 0 ; i < nr ; i++) {
+ if (bhs[i] == NULL) {
+@@ -220,7 +254,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ ocfs2_metadata_cache_io_unlock(ci);
+ status = -ENOMEM;
+ mlog_errno(status);
+- goto bail;
++ /* Don't forget to put previous bh! */
++ break;
+ }
+ }
+ bh = bhs[i];
+@@ -314,16 +349,27 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ }
+ }
+
+- status = 0;
+-
++read_failure:
+ for (i = (nr - 1); i >= 0; i--) {
+ bh = bhs[i];
+
+ if (!(flags & OCFS2_BH_READAHEAD)) {
+- if (status) {
+- /* Clear the rest of the buffers on error */
+- put_bh(bh);
+- bhs[i] = NULL;
++ if (unlikely(status)) {
++ /* Clear the buffers on error including those
++ * ever succeeded in reading
++ */
++ if (new_bh && bh) {
++ /* If middle bh fails, let previous bh
++ * finish its read and then put it to
++ * aovoid bh leak
++ */
++ if (!buffer_jbd(bh))
++ wait_on_buffer(bh);
++ put_bh(bh);
++ bhs[i] = NULL;
++ } else if (bh && buffer_uptodate(bh)) {
++ clear_buffer_uptodate(bh);
++ }
+ continue;
+ }
+ /* We know this can't have changed as we hold the
+@@ -341,9 +387,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ * uptodate. */
+ status = -EIO;
+ clear_buffer_needs_validate(bh);
+- put_bh(bh);
+- bhs[i] = NULL;
+- continue;
++ goto read_failure;
+ }
+
+ if (buffer_needs_validate(bh)) {
+@@ -353,11 +397,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ BUG_ON(buffer_jbd(bh));
+ clear_buffer_needs_validate(bh);
+ status = validate(sb, bh);
+- if (status) {
+- put_bh(bh);
+- bhs[i] = NULL;
+- continue;
+- }
++ if (status)
++ goto read_failure;
+ }
+ }
+
+diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
+index 9b984cae4c4e..1d6dc8422899 100644
+--- a/fs/ocfs2/dlm/dlmdebug.c
++++ b/fs/ocfs2/dlm/dlmdebug.c
+@@ -329,7 +329,7 @@ void dlm_print_one_mle(struct dlm_master_list_entry *mle)
+ {
+ char *buf;
+
+- buf = (char *) get_zeroed_page(GFP_NOFS);
++ buf = (char *) get_zeroed_page(GFP_ATOMIC);
+ if (buf) {
+ dump_mle(mle, buf, PAGE_SIZE - 1);
+ free_page((unsigned long)buf);
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index 933aac5da193..178cb9e6772a 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -3603,7 +3603,7 @@ static int ocfs2_downconvert_lock(struct ocfs2_super *osb,
+ * we can recover correctly from node failure. Otherwise, we may get
+ * invalid LVB in LKB, but without DLM_SBF_VALNOTVALID being set.
+ */
+- if (!ocfs2_is_o2cb_active() &&
++ if (ocfs2_userspace_stack(osb) &&
+ lockres->l_ops->flags & LOCK_TYPE_USES_LVB)
+ lvb = 1;
+
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index a847fe52c56e..a3e077fcfeb9 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2389,7 +2389,7 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb,
+
+ written = __generic_file_write_iter(iocb, from);
+ /* buffered aio wouldn't have proper lock coverage today */
+- BUG_ON(written == -EIOCBQUEUED && !(iocb->ki_flags & IOCB_DIRECT));
++ BUG_ON(written == -EIOCBQUEUED && !direct_io);
+
+ /*
+ * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
+@@ -2509,7 +2509,7 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb,
+ trace_generic_file_read_iter_ret(ret);
+
+ /* buffered aio wouldn't have proper lock coverage today */
+- BUG_ON(ret == -EIOCBQUEUED && !(iocb->ki_flags & IOCB_DIRECT));
++ BUG_ON(ret == -EIOCBQUEUED && !direct_io);
+
+ /* see ocfs2_file_write_iter */
+ if (ret == -EIOCBQUEUED || !ocfs2_iocb_is_rw_locked(iocb)) {
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index c492cbb2410f..babb0ec76d67 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -1379,15 +1379,23 @@ static int __ocfs2_recovery_thread(void *arg)
+ int rm_quota_used = 0, i;
+ struct ocfs2_quota_recovery *qrec;
+
++ /* Whether the quota supported. */
++ int quota_enabled = OCFS2_HAS_RO_COMPAT_FEATURE(osb->sb,
++ OCFS2_FEATURE_RO_COMPAT_USRQUOTA)
++ || OCFS2_HAS_RO_COMPAT_FEATURE(osb->sb,
++ OCFS2_FEATURE_RO_COMPAT_GRPQUOTA);
++
+ status = ocfs2_wait_on_mount(osb);
+ if (status < 0) {
+ goto bail;
+ }
+
+- rm_quota = kcalloc(osb->max_slots, sizeof(int), GFP_NOFS);
+- if (!rm_quota) {
+- status = -ENOMEM;
+- goto bail;
++ if (quota_enabled) {
++ rm_quota = kcalloc(osb->max_slots, sizeof(int), GFP_NOFS);
++ if (!rm_quota) {
++ status = -ENOMEM;
++ goto bail;
++ }
+ }
+ restart:
+ status = ocfs2_super_lock(osb, 1);
+@@ -1423,9 +1431,14 @@ restart:
+ * then quota usage would be out of sync until some node takes
+ * the slot. So we remember which nodes need quota recovery
+ * and when everything else is done, we recover quotas. */
+- for (i = 0; i < rm_quota_used && rm_quota[i] != slot_num; i++);
+- if (i == rm_quota_used)
+- rm_quota[rm_quota_used++] = slot_num;
++ if (quota_enabled) {
++ for (i = 0; i < rm_quota_used
++ && rm_quota[i] != slot_num; i++)
++ ;
++
++ if (i == rm_quota_used)
++ rm_quota[rm_quota_used++] = slot_num;
++ }
+
+ status = ocfs2_recover_node(osb, node_num, slot_num);
+ skip_recovery:
+@@ -1453,16 +1466,19 @@ skip_recovery:
+ /* Now it is right time to recover quotas... We have to do this under
+ * superblock lock so that no one can start using the slot (and crash)
+ * before we recover it */
+- for (i = 0; i < rm_quota_used; i++) {
+- qrec = ocfs2_begin_quota_recovery(osb, rm_quota[i]);
+- if (IS_ERR(qrec)) {
+- status = PTR_ERR(qrec);
+- mlog_errno(status);
+- continue;
++ if (quota_enabled) {
++ for (i = 0; i < rm_quota_used; i++) {
++ qrec = ocfs2_begin_quota_recovery(osb, rm_quota[i]);
++ if (IS_ERR(qrec)) {
++ status = PTR_ERR(qrec);
++ mlog_errno(status);
++ continue;
++ }
++ ocfs2_queue_recovery_completion(osb->journal,
++ rm_quota[i],
++ NULL, NULL, qrec,
++ ORPHAN_NEED_TRUNCATE);
+ }
+- ocfs2_queue_recovery_completion(osb->journal, rm_quota[i],
+- NULL, NULL, qrec,
+- ORPHAN_NEED_TRUNCATE);
+ }
+
+ ocfs2_super_unlock(osb, 1);
+@@ -1484,7 +1500,8 @@ bail:
+
+ mutex_unlock(&osb->recovery_lock);
+
+- kfree(rm_quota);
++ if (quota_enabled)
++ kfree(rm_quota);
+
+ /* no one is callint kthread_stop() for us so the kthread() api
+ * requires that we call do_exit(). And it isn't exported, but
+diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
+index f55f82ca3425..1565dd8e8856 100644
+--- a/fs/ocfs2/move_extents.c
++++ b/fs/ocfs2/move_extents.c
+@@ -25,6 +25,7 @@
+ #include "ocfs2_ioctl.h"
+
+ #include "alloc.h"
++#include "localalloc.h"
+ #include "aops.h"
+ #include "dlmglue.h"
+ #include "extent_map.h"
+@@ -222,6 +223,7 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
+ struct ocfs2_refcount_tree *ref_tree = NULL;
+ u32 new_phys_cpos, new_len;
+ u64 phys_blkno = ocfs2_clusters_to_blocks(inode->i_sb, phys_cpos);
++ int need_free = 0;
+
+ if ((ext_flags & OCFS2_EXT_REFCOUNTED) && *len) {
+ BUG_ON(!ocfs2_is_refcount_inode(inode));
+@@ -312,6 +314,7 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
+ if (!partial) {
+ context->range->me_flags &= ~OCFS2_MOVE_EXT_FL_COMPLETE;
+ ret = -ENOSPC;
++ need_free = 1;
+ goto out_commit;
+ }
+ }
+@@ -336,6 +339,20 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
+ mlog_errno(ret);
+
+ out_commit:
++ if (need_free && context->data_ac) {
++ struct ocfs2_alloc_context *data_ac = context->data_ac;
++
++ if (context->data_ac->ac_which == OCFS2_AC_USE_LOCAL)
++ ocfs2_free_local_alloc_bits(osb, handle, data_ac,
++ new_phys_cpos, new_len);
++ else
++ ocfs2_free_clusters(handle,
++ data_ac->ac_inode,
++ data_ac->ac_bh,
++ ocfs2_clusters_to_blocks(osb->sb, new_phys_cpos),
++ new_len);
++ }
++
+ ocfs2_commit_trans(osb, handle);
+
+ out_unlock_mutex:
+diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
+index d6c350ba25b9..c4b029c43464 100644
+--- a/fs/ocfs2/stackglue.c
++++ b/fs/ocfs2/stackglue.c
+@@ -48,12 +48,6 @@ static char ocfs2_hb_ctl_path[OCFS2_MAX_HB_CTL_PATH] = "/sbin/ocfs2_hb_ctl";
+ */
+ static struct ocfs2_stack_plugin *active_stack;
+
+-inline int ocfs2_is_o2cb_active(void)
+-{
+- return !strcmp(active_stack->sp_name, OCFS2_STACK_PLUGIN_O2CB);
+-}
+-EXPORT_SYMBOL_GPL(ocfs2_is_o2cb_active);
+-
+ static struct ocfs2_stack_plugin *ocfs2_stack_lookup(const char *name)
+ {
+ struct ocfs2_stack_plugin *p;
+diff --git a/fs/ocfs2/stackglue.h b/fs/ocfs2/stackglue.h
+index e3036e1790e8..f2dce10fae54 100644
+--- a/fs/ocfs2/stackglue.h
++++ b/fs/ocfs2/stackglue.h
+@@ -298,9 +298,6 @@ void ocfs2_stack_glue_set_max_proto_version(struct ocfs2_protocol_version *max_p
+ int ocfs2_stack_glue_register(struct ocfs2_stack_plugin *plugin);
+ void ocfs2_stack_glue_unregister(struct ocfs2_stack_plugin *plugin);
+
+-/* In ocfs2_downconvert_lock(), we need to know which stack we are using */
+-int ocfs2_is_o2cb_active(void);
+-
+ extern struct kset *ocfs2_kset;
+
+ #endif /* STACKGLUE_H */
+diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
+index 0d80e0df6c24..c146e12a8601 100644
+--- a/fs/ocfs2/xattr.c
++++ b/fs/ocfs2/xattr.c
+@@ -1498,6 +1498,18 @@ static int ocfs2_xa_check_space(struct ocfs2_xa_loc *loc,
+ return loc->xl_ops->xlo_check_space(loc, xi);
+ }
+
++static void ocfs2_xa_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash)
++{
++ loc->xl_ops->xlo_add_entry(loc, name_hash);
++ loc->xl_entry->xe_name_hash = cpu_to_le32(name_hash);
++ /*
++ * We can't leave the new entry's xe_name_offset at zero or
++ * add_namevalue() will go nuts. We set it to the size of our
++ * storage so that it can never be less than any other entry.
++ */
++ loc->xl_entry->xe_name_offset = cpu_to_le16(loc->xl_size);
++}
++
+ static void ocfs2_xa_add_namevalue(struct ocfs2_xa_loc *loc,
+ struct ocfs2_xattr_info *xi)
+ {
+@@ -2129,31 +2141,29 @@ static int ocfs2_xa_prepare_entry(struct ocfs2_xa_loc *loc,
+ if (rc)
+ goto out;
+
+- if (!loc->xl_entry) {
+- rc = -EINVAL;
+- goto out;
+- }
+-
+- if (ocfs2_xa_can_reuse_entry(loc, xi)) {
+- orig_value_size = loc->xl_entry->xe_value_size;
+- rc = ocfs2_xa_reuse_entry(loc, xi, ctxt);
+- if (rc)
+- goto out;
+- goto alloc_value;
+- }
++ if (loc->xl_entry) {
++ if (ocfs2_xa_can_reuse_entry(loc, xi)) {
++ orig_value_size = loc->xl_entry->xe_value_size;
++ rc = ocfs2_xa_reuse_entry(loc, xi, ctxt);
++ if (rc)
++ goto out;
++ goto alloc_value;
++ }
+
+- if (!ocfs2_xattr_is_local(loc->xl_entry)) {
+- orig_clusters = ocfs2_xa_value_clusters(loc);
+- rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
+- if (rc) {
+- mlog_errno(rc);
+- ocfs2_xa_cleanup_value_truncate(loc,
+- "overwriting",
+- orig_clusters);
+- goto out;
++ if (!ocfs2_xattr_is_local(loc->xl_entry)) {
++ orig_clusters = ocfs2_xa_value_clusters(loc);
++ rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
++ if (rc) {
++ mlog_errno(rc);
++ ocfs2_xa_cleanup_value_truncate(loc,
++ "overwriting",
++ orig_clusters);
++ goto out;
++ }
+ }
+- }
+- ocfs2_xa_wipe_namevalue(loc);
++ ocfs2_xa_wipe_namevalue(loc);
++ } else
++ ocfs2_xa_add_entry(loc, name_hash);
+
+ /*
+ * If we get here, we have a blank entry. Fill it. We grow our
+diff --git a/fs/read_write.c b/fs/read_write.c
+index 5fb5ee5b8cd7..2195380620d0 100644
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -1715,6 +1715,34 @@ static int clone_verify_area(struct file *file, loff_t pos, u64 len, bool write)
+
+ return security_file_permission(file, write ? MAY_WRITE : MAY_READ);
+ }
++/*
++ * Ensure that we don't remap a partial EOF block in the middle of something
++ * else. Assume that the offsets have already been checked for block
++ * alignment.
++ *
++ * For deduplication we always scale down to the previous block because we
++ * can't meaningfully compare post-EOF contents.
++ *
++ * For clone we only link a partial EOF block above the destination file's EOF.
++ */
++static int generic_remap_check_len(struct inode *inode_in,
++ struct inode *inode_out,
++ loff_t pos_out,
++ u64 *len,
++ bool is_dedupe)
++{
++ u64 blkmask = i_blocksize(inode_in) - 1;
++
++ if ((*len & blkmask) == 0)
++ return 0;
++
++ if (is_dedupe)
++ *len &= ~blkmask;
++ else if (pos_out + *len < i_size_read(inode_out))
++ return -EINVAL;
++
++ return 0;
++}
+
+ /*
+ * Check that the two inodes are eligible for cloning, the ranges make
+@@ -1821,6 +1849,11 @@ int vfs_clone_file_prep_inodes(struct inode *inode_in, loff_t pos_in,
+ return -EBADE;
+ }
+
++ ret = generic_remap_check_len(inode_in, inode_out, pos_out, len,
++ is_dedupe);
++ if (ret)
++ return ret;
++
+ return 1;
+ }
+ EXPORT_SYMBOL(vfs_clone_file_prep_inodes);
+diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
+index e839907e8492..e36124546d0d 100644
+--- a/fs/xfs/xfs_buf.c
++++ b/fs/xfs/xfs_buf.c
+@@ -37,6 +37,32 @@ static kmem_zone_t *xfs_buf_zone;
+ #define xb_to_gfp(flags) \
+ ((((flags) & XBF_READ_AHEAD) ? __GFP_NORETRY : GFP_NOFS) | __GFP_NOWARN)
+
++/*
++ * Locking orders
++ *
++ * xfs_buf_ioacct_inc:
++ * xfs_buf_ioacct_dec:
++ * b_sema (caller holds)
++ * b_lock
++ *
++ * xfs_buf_stale:
++ * b_sema (caller holds)
++ * b_lock
++ * lru_lock
++ *
++ * xfs_buf_rele:
++ * b_lock
++ * pag_buf_lock
++ * lru_lock
++ *
++ * xfs_buftarg_wait_rele
++ * lru_lock
++ * b_lock (trylock due to inversion)
++ *
++ * xfs_buftarg_isolate
++ * lru_lock
++ * b_lock (trylock due to inversion)
++ */
+
+ static inline int
+ xfs_buf_is_vmapped(
+@@ -1006,8 +1032,18 @@ xfs_buf_rele(
+
+ ASSERT(atomic_read(&bp->b_hold) > 0);
+
+- release = atomic_dec_and_lock(&bp->b_hold, &pag->pag_buf_lock);
++ /*
++ * We grab the b_lock here first to serialise racing xfs_buf_rele()
++ * calls. The pag_buf_lock being taken on the last reference only
++ * serialises against racing lookups in xfs_buf_find(). IOWs, the second
++ * to last reference we drop here is not serialised against the last
++ * reference until we take bp->b_lock. Hence if we don't grab b_lock
++ * first, the last "release" reference can win the race to the lock and
++ * free the buffer before the second-to-last reference is processed,
++ * leading to a use-after-free scenario.
++ */
+ spin_lock(&bp->b_lock);
++ release = atomic_dec_and_lock(&bp->b_hold, &pag->pag_buf_lock);
+ if (!release) {
+ /*
+ * Drop the in-flight state if the buffer is already on the LRU
+@@ -1989,6 +2025,13 @@ xfs_buf_delwri_submit_buffers(
+ * is only safely useable for callers that can track I/O completion by higher
+ * level means, e.g. AIL pushing as the @buffer_list is consumed in this
+ * function.
++ *
++ * Note: this function will skip buffers it would block on, and in doing so
++ * leaves them on @buffer_list so they can be retried on a later pass. As such,
++ * it is up to the caller to ensure that the buffer list is fully submitted or
++ * cancelled appropriately when they are finished with the list. Failure to
++ * cancel or resubmit the list until it is empty will result in leaked buffers
++ * at unmount time.
+ */
+ int
+ xfs_buf_delwri_submit_nowait(
+diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
+index 55326f971cb3..d3a4e89bf4a0 100644
+--- a/fs/xfs/xfs_trans_ail.c
++++ b/fs/xfs/xfs_trans_ail.c
+@@ -531,17 +531,33 @@ xfsaild(
+ set_current_state(TASK_INTERRUPTIBLE);
+
+ /*
+- * Check kthread_should_stop() after we set the task state
+- * to guarantee that we either see the stop bit and exit or
+- * the task state is reset to runnable such that it's not
+- * scheduled out indefinitely and detects the stop bit at
+- * next iteration.
+- *
++ * Check kthread_should_stop() after we set the task state to
++ * guarantee that we either see the stop bit and exit or the
++ * task state is reset to runnable such that it's not scheduled
++ * out indefinitely and detects the stop bit at next iteration.
+ * A memory barrier is included in above task state set to
+ * serialize again kthread_stop().
+ */
+ if (kthread_should_stop()) {
+ __set_current_state(TASK_RUNNING);
++
++ /*
++ * The caller forces out the AIL before stopping the
++ * thread in the common case, which means the delwri
++ * queue is drained. In the shutdown case, the queue may
++ * still hold relogged buffers that haven't been
++ * submitted because they were pinned since added to the
++ * queue.
++ *
++ * Log I/O error processing stales the underlying buffer
++ * and clears the delwri state, expecting the buf to be
++ * removed on the next submission attempt. That won't
++ * happen if we're shutting down, so this is the last
++ * opportunity to release such buffers from the queue.
++ */
++ ASSERT(list_empty(&ailp->ail_buf_list) ||
++ XFS_FORCED_SHUTDOWN(ailp->ail_mount));
++ xfs_buf_delwri_cancel(&ailp->ail_buf_list);
+ break;
+ }
+
+diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
+index acf5e8df3504..b71a033c781e 100644
+--- a/include/linux/bitmap.h
++++ b/include/linux/bitmap.h
+@@ -204,8 +204,13 @@ extern int bitmap_print_to_pagebuf(bool list, char *buf,
+ #define BITMAP_FIRST_WORD_MASK(start) (~0UL << ((start) & (BITS_PER_LONG - 1)))
+ #define BITMAP_LAST_WORD_MASK(nbits) (~0UL >> (-(nbits) & (BITS_PER_LONG - 1)))
+
++/*
++ * The static inlines below do not handle constant nbits==0 correctly,
++ * so make such users (should any ever turn up) call the out-of-line
++ * versions.
++ */
+ #define small_const_nbits(nbits) \
+- (__builtin_constant_p(nbits) && (nbits) <= BITS_PER_LONG)
++ (__builtin_constant_p(nbits) && (nbits) <= BITS_PER_LONG && (nbits) > 0)
+
+ static inline void bitmap_zero(unsigned long *dst, unsigned int nbits)
+ {
+@@ -398,7 +403,7 @@ static __always_inline void bitmap_clear(unsigned long *map, unsigned int start,
+ }
+
+ static inline void bitmap_shift_right(unsigned long *dst, const unsigned long *src,
+- unsigned int shift, int nbits)
++ unsigned int shift, unsigned int nbits)
+ {
+ if (small_const_nbits(nbits))
+ *dst = (*src & BITMAP_LAST_WORD_MASK(nbits)) >> shift;
+diff --git a/include/linux/futex.h b/include/linux/futex.h
+index 821ae502d3d8..ccaef0097785 100644
+--- a/include/linux/futex.h
++++ b/include/linux/futex.h
+@@ -9,9 +9,6 @@ struct inode;
+ struct mm_struct;
+ struct task_struct;
+
+-extern int
+-handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi);
+-
+ /*
+ * Futexes are matched on equal values of this key.
+ * The key type depends on whether it's a shared or private mapping.
+@@ -55,11 +52,6 @@ extern void exit_robust_list(struct task_struct *curr);
+
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+ u32 __user *uaddr2, u32 val2, u32 val3);
+-#ifdef CONFIG_HAVE_FUTEX_CMPXCHG
+-#define futex_cmpxchg_enabled 1
+-#else
+-extern int futex_cmpxchg_enabled;
+-#endif
+ #else
+ static inline void exit_robust_list(struct task_struct *curr)
+ {
+diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
+index c759d1cbcedd..a64f21a97369 100644
+--- a/include/linux/inetdevice.h
++++ b/include/linux/inetdevice.h
+@@ -37,7 +37,9 @@ struct in_device {
+ unsigned long mr_v1_seen;
+ unsigned long mr_v2_seen;
+ unsigned long mr_maxdelay;
+- unsigned char mr_qrv;
++ unsigned long mr_qi; /* Query Interval */
++ unsigned long mr_qri; /* Query Response Interval */
++ unsigned char mr_qrv; /* Query Robustness Variable */
+ unsigned char mr_gq_running;
+ unsigned char mr_ifc_count;
+ struct timer_list mr_gq_timer; /* general query timer */
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 96207939d862..748016ae01e3 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -911,6 +911,7 @@ int kvm_cpu_has_pending_timer(struct kvm_vcpu *vcpu);
+ void kvm_vcpu_kick(struct kvm_vcpu *vcpu);
+
+ bool kvm_is_reserved_pfn(kvm_pfn_t pfn);
++bool kvm_is_zone_device_pfn(kvm_pfn_t pfn);
+
+ struct kvm_irq_ack_notifier {
+ struct hlist_node link;
+diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
+index 34a28227068d..16487052017d 100644
+--- a/include/linux/memory_hotplug.h
++++ b/include/linux/memory_hotplug.h
+@@ -322,6 +322,7 @@ static inline void remove_memory(int nid, u64 start, u64 size) {}
+ extern void __ref free_area_init_core_hotplug(int nid);
+ extern int walk_memory_range(unsigned long start_pfn, unsigned long end_pfn,
+ void *arg, int (*func)(struct memory_block *, void *));
++extern int __add_memory(int nid, u64 start, u64 size);
+ extern int add_memory(int nid, u64 start, u64 size);
+ extern int add_memory_resource(int nid, struct resource *resource, bool online);
+ extern int arch_add_memory(int nid, u64 start, u64 size,
+diff --git a/include/linux/mfd/intel_soc_pmic.h b/include/linux/mfd/intel_soc_pmic.h
+index 5aacdb017a9f..806a4f095312 100644
+--- a/include/linux/mfd/intel_soc_pmic.h
++++ b/include/linux/mfd/intel_soc_pmic.h
+@@ -25,6 +25,7 @@ struct intel_soc_pmic {
+ int irq;
+ struct regmap *regmap;
+ struct regmap_irq_chip_data *irq_chip_data;
++ struct regmap_irq_chip_data *irq_chip_data_pwrbtn;
+ struct regmap_irq_chip_data *irq_chip_data_tmu;
+ struct regmap_irq_chip_data *irq_chip_data_bcu;
+ struct regmap_irq_chip_data *irq_chip_data_adc;
+diff --git a/include/linux/mfd/max8997.h b/include/linux/mfd/max8997.h
+index cf815577bd68..3ae1fe743bc3 100644
+--- a/include/linux/mfd/max8997.h
++++ b/include/linux/mfd/max8997.h
+@@ -178,7 +178,6 @@ struct max8997_led_platform_data {
+ struct max8997_platform_data {
+ /* IRQ */
+ int ono;
+- int wakeup;
+
+ /* ---- PMIC ---- */
+ struct max8997_regulator_data *regulators;
+diff --git a/include/linux/mfd/mc13xxx.h b/include/linux/mfd/mc13xxx.h
+index 54a3cd808f9e..2ad9bdc0a5ec 100644
+--- a/include/linux/mfd/mc13xxx.h
++++ b/include/linux/mfd/mc13xxx.h
+@@ -249,6 +249,7 @@ struct mc13xxx_platform_data {
+ #define MC13XXX_ADC0_TSMOD0 (1 << 12)
+ #define MC13XXX_ADC0_TSMOD1 (1 << 13)
+ #define MC13XXX_ADC0_TSMOD2 (1 << 14)
++#define MC13XXX_ADC0_CHRGRAWDIV (1 << 15)
+ #define MC13XXX_ADC0_ADINC1 (1 << 16)
+ #define MC13XXX_ADC0_ADINC2 (1 << 17)
+
+diff --git a/kernel/Makefile b/kernel/Makefile
+index df5e3ca30acd..ad4b324d8906 100644
+--- a/kernel/Makefile
++++ b/kernel/Makefile
+@@ -50,9 +50,6 @@ obj-$(CONFIG_PROFILING) += profile.o
+ obj-$(CONFIG_STACKTRACE) += stacktrace.o
+ obj-y += time/
+ obj-$(CONFIG_FUTEX) += futex.o
+-ifeq ($(CONFIG_COMPAT),y)
+-obj-$(CONFIG_FUTEX) += futex_compat.o
+-endif
+ obj-$(CONFIG_GENERIC_ISA_DMA) += dma.o
+ obj-$(CONFIG_SMP) += smp.o
+ ifneq ($(CONFIG_SMP),y)
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index b2d1f043f17f..1513873e23bd 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -1107,7 +1107,7 @@ static void audit_log_execve_info(struct audit_context *context,
+ }
+
+ /* write as much as we can to the audit log */
+- if (len_buf > 0) {
++ if (len_buf >= 0) {
+ /* NOTE: some magic numbers here - basically if we
+ * can't fit a reasonable amount of data into the
+ * existing audit buffer, flush it and start with
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 378cef70341c..cfa27b7d1168 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -2067,50 +2067,44 @@ static int btf_check_sec_info(struct btf_verifier_env *env,
+ return 0;
+ }
+
+-static int btf_parse_hdr(struct btf_verifier_env *env, void __user *btf_data,
+- u32 btf_data_size)
++static int btf_parse_hdr(struct btf_verifier_env *env)
+ {
++ u32 hdr_len, hdr_copy, btf_data_size;
+ const struct btf_header *hdr;
+- u32 hdr_len, hdr_copy;
+- /*
+- * Minimal part of the "struct btf_header" that
+- * contains the hdr_len.
+- */
+- struct btf_min_header {
+- u16 magic;
+- u8 version;
+- u8 flags;
+- u32 hdr_len;
+- } __user *min_hdr;
+ struct btf *btf;
+ int err;
+
+ btf = env->btf;
+- min_hdr = btf_data;
++ btf_data_size = btf->data_size;
+
+- if (btf_data_size < sizeof(*min_hdr)) {
++ if (btf_data_size <
++ offsetof(struct btf_header, hdr_len) + sizeof(hdr->hdr_len)) {
+ btf_verifier_log(env, "hdr_len not found");
+ return -EINVAL;
+ }
+
+- if (get_user(hdr_len, &min_hdr->hdr_len))
+- return -EFAULT;
+-
++ hdr = btf->data;
++ hdr_len = hdr->hdr_len;
+ if (btf_data_size < hdr_len) {
+ btf_verifier_log(env, "btf_header not found");
+ return -EINVAL;
+ }
+
+- err = bpf_check_uarg_tail_zero(btf_data, sizeof(btf->hdr), hdr_len);
+- if (err) {
+- if (err == -E2BIG)
+- btf_verifier_log(env, "Unsupported btf_header");
+- return err;
++ /* Ensure the unsupported header fields are zero */
++ if (hdr_len > sizeof(btf->hdr)) {
++ u8 *expected_zero = btf->data + sizeof(btf->hdr);
++ u8 *end = btf->data + hdr_len;
++
++ for (; expected_zero < end; expected_zero++) {
++ if (*expected_zero) {
++ btf_verifier_log(env, "Unsupported btf_header");
++ return -E2BIG;
++ }
++ }
+ }
+
+ hdr_copy = min_t(u32, hdr_len, sizeof(btf->hdr));
+- if (copy_from_user(&btf->hdr, btf_data, hdr_copy))
+- return -EFAULT;
++ memcpy(&btf->hdr, btf->data, hdr_copy);
+
+ hdr = &btf->hdr;
+
+@@ -2186,10 +2180,6 @@ static struct btf *btf_parse(void __user *btf_data, u32 btf_data_size,
+ }
+ env->btf = btf;
+
+- err = btf_parse_hdr(env, btf_data, btf_data_size);
+- if (err)
+- goto errout;
+-
+ data = kvmalloc(btf_data_size, GFP_KERNEL | __GFP_NOWARN);
+ if (!data) {
+ err = -ENOMEM;
+@@ -2198,13 +2188,18 @@ static struct btf *btf_parse(void __user *btf_data, u32 btf_data_size,
+
+ btf->data = data;
+ btf->data_size = btf_data_size;
+- btf->nohdr_data = btf->data + btf->hdr.hdr_len;
+
+ if (copy_from_user(data, btf_data, btf_data_size)) {
+ err = -EFAULT;
+ goto errout;
+ }
+
++ err = btf_parse_hdr(env);
++ if (err)
++ goto errout;
++
++ btf->nohdr_data = btf->data + btf->hdr.hdr_len;
++
+ err = btf_parse_str_sec(env);
+ if (err)
+ goto errout;
+diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
+index fc500ca464d0..1defea4b2755 100644
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -520,8 +520,7 @@ static int dev_map_notification(struct notifier_block *notifier,
+ struct bpf_dtab_netdev *dev, *odev;
+
+ dev = READ_ONCE(dtab->netdev_map[i]);
+- if (!dev ||
+- dev->dev->ifindex != netdev->ifindex)
++ if (!dev || netdev != dev->dev)
+ continue;
+ odev = cmpxchg(&dtab->netdev_map[i], dev, NULL);
+ if (dev == odev)
+diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
+index 4f8a6dbf0b60..2a8c41f12d45 100644
+--- a/kernel/dma/swiotlb.c
++++ b/kernel/dma/swiotlb.c
+@@ -761,34 +761,6 @@ static bool swiotlb_free_buffer(struct device *dev, size_t size,
+ return true;
+ }
+
+-static void
+-swiotlb_full(struct device *dev, size_t size, enum dma_data_direction dir,
+- int do_panic)
+-{
+- if (swiotlb_force == SWIOTLB_NO_FORCE)
+- return;
+-
+- /*
+- * Ran out of IOMMU space for this operation. This is very bad.
+- * Unfortunately the drivers cannot handle this operation properly.
+- * unless they check for dma_mapping_error (most don't)
+- * When the mapping is small enough return a static buffer to limit
+- * the damage, or panic when the transfer is too big.
+- */
+- dev_err_ratelimited(dev, "DMA: Out of SW-IOMMU space for %zu bytes\n",
+- size);
+-
+- if (size <= io_tlb_overflow || !do_panic)
+- return;
+-
+- if (dir == DMA_BIDIRECTIONAL)
+- panic("DMA: Random memory could be DMA accessed\n");
+- if (dir == DMA_FROM_DEVICE)
+- panic("DMA: Random memory could be DMA written\n");
+- if (dir == DMA_TO_DEVICE)
+- panic("DMA: Random memory could be DMA read\n");
+-}
+-
+ /*
+ * Map a single buffer of the indicated size for DMA in streaming mode. The
+ * physical address to use is returned.
+@@ -817,10 +789,8 @@ dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
+
+ /* Oh well, have to allocate and map a bounce buffer. */
+ map = map_single(dev, phys, size, dir, attrs);
+- if (map == SWIOTLB_MAP_ERROR) {
+- swiotlb_full(dev, size, dir, 1);
++ if (map == SWIOTLB_MAP_ERROR)
+ return __phys_to_dma(dev, io_tlb_overflow_buffer);
+- }
+
+ dev_addr = __phys_to_dma(dev, map);
+
+@@ -954,7 +924,6 @@ swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl, int nelems,
+ if (map == SWIOTLB_MAP_ERROR) {
+ /* Don't panic here, we expect map_sg users
+ to do proper error handling. */
+- swiotlb_full(hwdev, sg->length, dir, 0);
+ attrs |= DMA_ATTR_SKIP_CPU_SYNC;
+ swiotlb_unmap_sg_attrs(hwdev, sgl, i, dir,
+ attrs);
+diff --git a/kernel/futex.c b/kernel/futex.c
+index afdc5eadce6e..e75ad30aa7bc 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -44,6 +44,7 @@
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
++#include <linux/compat.h>
+ #include <linux/slab.h>
+ #include <linux/poll.h>
+ #include <linux/fs.h>
+@@ -173,8 +174,10 @@
+ * double_lock_hb() and double_unlock_hb(), respectively.
+ */
+
+-#ifndef CONFIG_HAVE_FUTEX_CMPXCHG
+-int __read_mostly futex_cmpxchg_enabled;
++#ifdef CONFIG_HAVE_FUTEX_CMPXCHG
++#define futex_cmpxchg_enabled 1
++#else
++static int __read_mostly futex_cmpxchg_enabled;
+ #endif
+
+ /*
+@@ -3454,11 +3457,16 @@ err_unlock:
+ return ret;
+ }
+
++/* Constants for the pending_op argument of handle_futex_death */
++#define HANDLE_DEATH_PENDING true
++#define HANDLE_DEATH_LIST false
++
+ /*
+ * Process a futex-list entry, check whether it's owned by the
+ * dying task, and do notification if so:
+ */
+-int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi)
++static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr,
++ bool pi, bool pending_op)
+ {
+ u32 uval, uninitialized_var(nval), mval;
+ int err;
+@@ -3471,6 +3479,42 @@ retry:
+ if (get_user(uval, uaddr))
+ return -1;
+
++ /*
++ * Special case for regular (non PI) futexes. The unlock path in
++ * user space has two race scenarios:
++ *
++ * 1. The unlock path releases the user space futex value and
++ * before it can execute the futex() syscall to wake up
++ * waiters it is killed.
++ *
++ * 2. A woken up waiter is killed before it can acquire the
++ * futex in user space.
++ *
++ * In both cases the TID validation below prevents a wakeup of
++ * potential waiters which can cause these waiters to block
++ * forever.
++ *
++ * In both cases the following conditions are met:
++ *
++ * 1) task->robust_list->list_op_pending != NULL
++ * @pending_op == true
++ * 2) User space futex value == 0
++ * 3) Regular futex: @pi == false
++ *
++ * If these conditions are met, it is safe to attempt waking up a
++ * potential waiter without touching the user space futex value and
++ * trying to set the OWNER_DIED bit. The user space futex value is
++ * uncontended and the rest of the user space mutex state is
++ * consistent, so a woken waiter will just take over the
++ * uncontended futex. Setting the OWNER_DIED bit would create
++ * inconsistent state and malfunction of the user space owner died
++ * handling.
++ */
++ if (pending_op && !pi && !uval) {
++ futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY);
++ return 0;
++ }
++
+ if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr))
+ return 0;
+
+@@ -3590,10 +3634,11 @@ void exit_robust_list(struct task_struct *curr)
+ * A pending lock might already be on the list, so
+ * don't process it twice:
+ */
+- if (entry != pending)
++ if (entry != pending) {
+ if (handle_futex_death((void __user *)entry + futex_offset,
+- curr, pi))
++ curr, pi, HANDLE_DEATH_LIST))
+ return;
++ }
+ if (rc)
+ return;
+ entry = next_entry;
+@@ -3607,9 +3652,10 @@ void exit_robust_list(struct task_struct *curr)
+ cond_resched();
+ }
+
+- if (pending)
++ if (pending) {
+ handle_futex_death((void __user *)pending + futex_offset,
+- curr, pip);
++ curr, pip, HANDLE_DEATH_PENDING);
++ }
+ }
+
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+@@ -3707,6 +3753,193 @@ SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
+ return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
+ }
+
++#ifdef CONFIG_COMPAT
++/*
++ * Fetch a robust-list pointer. Bit 0 signals PI futexes:
++ */
++static inline int
++compat_fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
++ compat_uptr_t __user *head, unsigned int *pi)
++{
++ if (get_user(*uentry, head))
++ return -EFAULT;
++
++ *entry = compat_ptr((*uentry) & ~1);
++ *pi = (unsigned int)(*uentry) & 1;
++
++ return 0;
++}
++
++static void __user *futex_uaddr(struct robust_list __user *entry,
++ compat_long_t futex_offset)
++{
++ compat_uptr_t base = ptr_to_compat(entry);
++ void __user *uaddr = compat_ptr(base + futex_offset);
++
++ return uaddr;
++}
++
++/*
++ * Walk curr->robust_list (very carefully, it's a userspace list!)
++ * and mark any locks found there dead, and notify any waiters.
++ *
++ * We silently return on any sign of list-walking problem.
++ */
++void compat_exit_robust_list(struct task_struct *curr)
++{
++ struct compat_robust_list_head __user *head = curr->compat_robust_list;
++ struct robust_list __user *entry, *next_entry, *pending;
++ unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
++ unsigned int uninitialized_var(next_pi);
++ compat_uptr_t uentry, next_uentry, upending;
++ compat_long_t futex_offset;
++ int rc;
++
++ if (!futex_cmpxchg_enabled)
++ return;
++
++ /*
++ * Fetch the list head (which was registered earlier, via
++ * sys_set_robust_list()):
++ */
++ if (compat_fetch_robust_entry(&uentry, &entry, &head->list.next, &pi))
++ return;
++ /*
++ * Fetch the relative futex offset:
++ */
++ if (get_user(futex_offset, &head->futex_offset))
++ return;
++ /*
++ * Fetch any possibly pending lock-add first, and handle it
++ * if it exists:
++ */
++ if (compat_fetch_robust_entry(&upending, &pending,
++ &head->list_op_pending, &pip))
++ return;
++
++ next_entry = NULL; /* avoid warning with gcc */
++ while (entry != (struct robust_list __user *) &head->list) {
++ /*
++ * Fetch the next entry in the list before calling
++ * handle_futex_death:
++ */
++ rc = compat_fetch_robust_entry(&next_uentry, &next_entry,
++ (compat_uptr_t __user *)&entry->next, &next_pi);
++ /*
++ * A pending lock might already be on the list, so
++ * dont process it twice:
++ */
++ if (entry != pending) {
++ void __user *uaddr = futex_uaddr(entry, futex_offset);
++
++ if (handle_futex_death(uaddr, curr, pi,
++ HANDLE_DEATH_LIST))
++ return;
++ }
++ if (rc)
++ return;
++ uentry = next_uentry;
++ entry = next_entry;
++ pi = next_pi;
++ /*
++ * Avoid excessively long or circular lists:
++ */
++ if (!--limit)
++ break;
++
++ cond_resched();
++ }
++ if (pending) {
++ void __user *uaddr = futex_uaddr(pending, futex_offset);
++
++ handle_futex_death(uaddr, curr, pip, HANDLE_DEATH_PENDING);
++ }
++}
++
++COMPAT_SYSCALL_DEFINE2(set_robust_list,
++ struct compat_robust_list_head __user *, head,
++ compat_size_t, len)
++{
++ if (!futex_cmpxchg_enabled)
++ return -ENOSYS;
++
++ if (unlikely(len != sizeof(*head)))
++ return -EINVAL;
++
++ current->compat_robust_list = head;
++
++ return 0;
++}
++
++COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
++ compat_uptr_t __user *, head_ptr,
++ compat_size_t __user *, len_ptr)
++{
++ struct compat_robust_list_head __user *head;
++ unsigned long ret;
++ struct task_struct *p;
++
++ if (!futex_cmpxchg_enabled)
++ return -ENOSYS;
++
++ rcu_read_lock();
++
++ ret = -ESRCH;
++ if (!pid)
++ p = current;
++ else {
++ p = find_task_by_vpid(pid);
++ if (!p)
++ goto err_unlock;
++ }
++
++ ret = -EPERM;
++ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
++ goto err_unlock;
++
++ head = p->compat_robust_list;
++ rcu_read_unlock();
++
++ if (put_user(sizeof(*head), len_ptr))
++ return -EFAULT;
++ return put_user(ptr_to_compat(head), head_ptr);
++
++err_unlock:
++ rcu_read_unlock();
++
++ return ret;
++}
++
++COMPAT_SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
++ struct old_timespec32 __user *, utime, u32 __user *, uaddr2,
++ u32, val3)
++{
++ struct timespec ts;
++ ktime_t t, *tp = NULL;
++ int val2 = 0;
++ int cmd = op & FUTEX_CMD_MASK;
++
++ if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI ||
++ cmd == FUTEX_WAIT_BITSET ||
++ cmd == FUTEX_WAIT_REQUEUE_PI)) {
++ if (compat_get_timespec(&ts, utime))
++ return -EFAULT;
++ if (!timespec_valid(&ts))
++ return -EINVAL;
++
++ t = timespec_to_ktime(ts);
++ if (cmd == FUTEX_WAIT)
++ t = ktime_add_safe(ktime_get(), t);
++ tp = &t;
++ }
++ if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE ||
++ cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP)
++ val2 = (int) (unsigned long) utime;
++
++ return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
++}
++#endif /* CONFIG_COMPAT */
++
+ static void __init futex_detect_cmpxchg(void)
+ {
+ #ifndef CONFIG_HAVE_FUTEX_CMPXCHG
+diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
+deleted file mode 100644
+index 83f830acbb5f..000000000000
+--- a/kernel/futex_compat.c
++++ /dev/null
+@@ -1,202 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * linux/kernel/futex_compat.c
+- *
+- * Futex compatibililty routines.
+- *
+- * Copyright 2006, Red Hat, Inc., Ingo Molnar
+- */
+-
+-#include <linux/linkage.h>
+-#include <linux/compat.h>
+-#include <linux/nsproxy.h>
+-#include <linux/futex.h>
+-#include <linux/ptrace.h>
+-#include <linux/syscalls.h>
+-
+-#include <linux/uaccess.h>
+-
+-
+-/*
+- * Fetch a robust-list pointer. Bit 0 signals PI futexes:
+- */
+-static inline int
+-fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
+- compat_uptr_t __user *head, unsigned int *pi)
+-{
+- if (get_user(*uentry, head))
+- return -EFAULT;
+-
+- *entry = compat_ptr((*uentry) & ~1);
+- *pi = (unsigned int)(*uentry) & 1;
+-
+- return 0;
+-}
+-
+-static void __user *futex_uaddr(struct robust_list __user *entry,
+- compat_long_t futex_offset)
+-{
+- compat_uptr_t base = ptr_to_compat(entry);
+- void __user *uaddr = compat_ptr(base + futex_offset);
+-
+- return uaddr;
+-}
+-
+-/*
+- * Walk curr->robust_list (very carefully, it's a userspace list!)
+- * and mark any locks found there dead, and notify any waiters.
+- *
+- * We silently return on any sign of list-walking problem.
+- */
+-void compat_exit_robust_list(struct task_struct *curr)
+-{
+- struct compat_robust_list_head __user *head = curr->compat_robust_list;
+- struct robust_list __user *entry, *next_entry, *pending;
+- unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
+- unsigned int uninitialized_var(next_pi);
+- compat_uptr_t uentry, next_uentry, upending;
+- compat_long_t futex_offset;
+- int rc;
+-
+- if (!futex_cmpxchg_enabled)
+- return;
+-
+- /*
+- * Fetch the list head (which was registered earlier, via
+- * sys_set_robust_list()):
+- */
+- if (fetch_robust_entry(&uentry, &entry, &head->list.next, &pi))
+- return;
+- /*
+- * Fetch the relative futex offset:
+- */
+- if (get_user(futex_offset, &head->futex_offset))
+- return;
+- /*
+- * Fetch any possibly pending lock-add first, and handle it
+- * if it exists:
+- */
+- if (fetch_robust_entry(&upending, &pending,
+- &head->list_op_pending, &pip))
+- return;
+-
+- next_entry = NULL; /* avoid warning with gcc */
+- while (entry != (struct robust_list __user *) &head->list) {
+- /*
+- * Fetch the next entry in the list before calling
+- * handle_futex_death:
+- */
+- rc = fetch_robust_entry(&next_uentry, &next_entry,
+- (compat_uptr_t __user *)&entry->next, &next_pi);
+- /*
+- * A pending lock might already be on the list, so
+- * dont process it twice:
+- */
+- if (entry != pending) {
+- void __user *uaddr = futex_uaddr(entry, futex_offset);
+-
+- if (handle_futex_death(uaddr, curr, pi))
+- return;
+- }
+- if (rc)
+- return;
+- uentry = next_uentry;
+- entry = next_entry;
+- pi = next_pi;
+- /*
+- * Avoid excessively long or circular lists:
+- */
+- if (!--limit)
+- break;
+-
+- cond_resched();
+- }
+- if (pending) {
+- void __user *uaddr = futex_uaddr(pending, futex_offset);
+-
+- handle_futex_death(uaddr, curr, pip);
+- }
+-}
+-
+-COMPAT_SYSCALL_DEFINE2(set_robust_list,
+- struct compat_robust_list_head __user *, head,
+- compat_size_t, len)
+-{
+- if (!futex_cmpxchg_enabled)
+- return -ENOSYS;
+-
+- if (unlikely(len != sizeof(*head)))
+- return -EINVAL;
+-
+- current->compat_robust_list = head;
+-
+- return 0;
+-}
+-
+-COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid,
+- compat_uptr_t __user *, head_ptr,
+- compat_size_t __user *, len_ptr)
+-{
+- struct compat_robust_list_head __user *head;
+- unsigned long ret;
+- struct task_struct *p;
+-
+- if (!futex_cmpxchg_enabled)
+- return -ENOSYS;
+-
+- rcu_read_lock();
+-
+- ret = -ESRCH;
+- if (!pid)
+- p = current;
+- else {
+- p = find_task_by_vpid(pid);
+- if (!p)
+- goto err_unlock;
+- }
+-
+- ret = -EPERM;
+- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
+- goto err_unlock;
+-
+- head = p->compat_robust_list;
+- rcu_read_unlock();
+-
+- if (put_user(sizeof(*head), len_ptr))
+- return -EFAULT;
+- return put_user(ptr_to_compat(head), head_ptr);
+-
+-err_unlock:
+- rcu_read_unlock();
+-
+- return ret;
+-}
+-
+-COMPAT_SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
+- struct compat_timespec __user *, utime, u32 __user *, uaddr2,
+- u32, val3)
+-{
+- struct timespec ts;
+- ktime_t t, *tp = NULL;
+- int val2 = 0;
+- int cmd = op & FUTEX_CMD_MASK;
+-
+- if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI ||
+- cmd == FUTEX_WAIT_BITSET ||
+- cmd == FUTEX_WAIT_REQUEUE_PI)) {
+- if (compat_get_timespec(&ts, utime))
+- return -EFAULT;
+- if (!timespec_valid(&ts))
+- return -EINVAL;
+-
+- t = timespec_to_ktime(ts);
+- if (cmd == FUTEX_WAIT)
+- t = ktime_add_safe(ktime_get(), t);
+- tp = &t;
+- }
+- if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE ||
+- cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP)
+- val2 = (int) (unsigned long) utime;
+-
+- return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
+-}
+diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
+index 92337703ca9f..30cc217b8631 100644
+--- a/kernel/irq/matrix.c
++++ b/kernel/irq/matrix.c
+@@ -8,7 +8,7 @@
+ #include <linux/cpu.h>
+ #include <linux/irq.h>
+
+-#define IRQ_MATRIX_SIZE (BITS_TO_LONGS(IRQ_MATRIX_BITS) * sizeof(unsigned long))
++#define IRQ_MATRIX_SIZE (BITS_TO_LONGS(IRQ_MATRIX_BITS))
+
+ struct cpumap {
+ unsigned int available;
+diff --git a/kernel/panic.c b/kernel/panic.c
+index 72e001e3753e..8138a676fb7d 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -636,7 +636,7 @@ device_initcall(register_warn_debugfs);
+ */
+ __visible void __stack_chk_fail(void)
+ {
+- panic("stack-protector: Kernel stack is corrupted in: %pB\n",
++ panic("stack-protector: Kernel stack is corrupted in: %pB",
+ __builtin_return_address(0));
+ }
+ EXPORT_SYMBOL(__stack_chk_fail);
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index c7b3d5489937..845efadaf7ec 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -1105,7 +1105,7 @@ void __init setup_log_buf(int early)
+ {
+ unsigned long flags;
+ char *new_log_buf;
+- int free;
++ unsigned int free;
+
+ if (log_buf != __log_buf)
+ return;
+@@ -1901,8 +1901,9 @@ asmlinkage int vprintk_emit(int facility, int level,
+ const char *fmt, va_list args)
+ {
+ int printed_len;
+- bool in_sched = false;
++ bool in_sched = false, pending_output;
+ unsigned long flags;
++ u64 curr_log_seq;
+
+ if (level == LOGLEVEL_SCHED) {
+ level = LOGLEVEL_DEFAULT;
+@@ -1914,11 +1915,13 @@ asmlinkage int vprintk_emit(int facility, int level,
+
+ /* This stops the holder of console_sem just where we want him */
+ logbuf_lock_irqsave(flags);
++ curr_log_seq = log_next_seq;
+ printed_len = vprintk_store(facility, level, dict, dictlen, fmt, args);
++ pending_output = (curr_log_seq != log_next_seq);
+ logbuf_unlock_irqrestore(flags);
+
+ /* If called from the scheduler, we can not call up(). */
+- if (!in_sched) {
++ if (!in_sched && pending_output) {
+ /*
+ * Disable preemption to avoid being preempted while holding
+ * console_sem which would prevent anyone from printing to
+@@ -1935,7 +1938,8 @@ asmlinkage int vprintk_emit(int facility, int level,
+ preempt_enable();
+ }
+
+- wake_up_klogd();
++ if (pending_output)
++ wake_up_klogd();
+ return printed_len;
+ }
+ EXPORT_SYMBOL(vprintk_emit);
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index e5e8f6721872..f77fcd37b226 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -8819,13 +8819,22 @@ out_all_pinned:
+ sd->nr_balance_failed = 0;
+
+ out_one_pinned:
++ ld_moved = 0;
++
++ /*
++ * idle_balance() disregards balance intervals, so we could repeatedly
++ * reach this code, which would lead to balance_interval skyrocketting
++ * in a short amount of time. Skip the balance_interval increase logic
++ * to avoid that.
++ */
++ if (env.idle == CPU_NEWLY_IDLE)
++ goto out;
++
+ /* tune up the balancing interval */
+ if (((env.flags & LBF_ALL_PINNED) &&
+ sd->balance_interval < MAX_PINNED_INTERVAL) ||
+ (sd->balance_interval < sd->max_interval))
+ sd->balance_interval *= 2;
+-
+- ld_moved = 0;
+ out:
+ return ld_moved;
+ }
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index c0a751464971..74b694392f2f 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -1329,7 +1329,7 @@ void sched_init_numa(void)
+ int level = 0;
+ int i, j, k;
+
+- sched_domains_numa_distance = kzalloc(sizeof(int) * nr_node_ids, GFP_KERNEL);
++ sched_domains_numa_distance = kzalloc(sizeof(int) * (nr_node_ids + 1), GFP_KERNEL);
+ if (!sched_domains_numa_distance)
+ return;
+
+diff --git a/lib/bitmap.c b/lib/bitmap.c
+index 2fd07f6df0b8..c4ca9ceb09fe 100644
+--- a/lib/bitmap.c
++++ b/lib/bitmap.c
+@@ -13,6 +13,7 @@
+ #include <linux/bitops.h>
+ #include <linux/bug.h>
+ #include <linux/kernel.h>
++#include <linux/mm.h>
+ #include <linux/slab.h>
+ #include <linux/string.h>
+ #include <linux/uaccess.h>
+@@ -466,14 +467,15 @@ EXPORT_SYMBOL(bitmap_parse_user);
+ * ranges if list is specified or hex digits grouped into comma-separated
+ * sets of 8 digits/set. Returns the number of characters written to buf.
+ *
+- * It is assumed that @buf is a pointer into a PAGE_SIZE area and that
+- * sufficient storage remains at @buf to accommodate the
+- * bitmap_print_to_pagebuf() output.
++ * It is assumed that @buf is a pointer into a PAGE_SIZE, page-aligned
++ * area and that sufficient storage remains at @buf to accommodate the
++ * bitmap_print_to_pagebuf() output. Returns the number of characters
++ * actually printed to @buf, excluding terminating '\0'.
+ */
+ int bitmap_print_to_pagebuf(bool list, char *buf, const unsigned long *maskp,
+ int nmaskbits)
+ {
+- ptrdiff_t len = PTR_ALIGN(buf + PAGE_SIZE - 1, PAGE_SIZE) - buf;
++ ptrdiff_t len = PAGE_SIZE - offset_in_page(buf);
+ int n = 0;
+
+ if (len > 1)
+diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c
+index 7405c9d89d65..7e6f2d2dafb5 100644
+--- a/mm/gup_benchmark.c
++++ b/mm/gup_benchmark.c
+@@ -23,6 +23,9 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
+ int nr;
+ struct page **pages;
+
++ if (gup->size > ULONG_MAX)
++ return -EINVAL;
++
+ nr_pages = gup->size / PAGE_SIZE;
+ pages = kvcalloc(nr_pages, sizeof(void *), GFP_KERNEL);
+ if (!pages)
+diff --git a/mm/ksm.c b/mm/ksm.c
+index 5b0894b45ee5..b3ea0f0316eb 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -870,13 +870,13 @@ static int remove_stable_node(struct stable_node *stable_node)
+ return 0;
+ }
+
+- if (WARN_ON_ONCE(page_mapped(page))) {
+- /*
+- * This should not happen: but if it does, just refuse to let
+- * merge_across_nodes be switched - there is no need to panic.
+- */
+- err = -EBUSY;
+- } else {
++ /*
++ * Page could be still mapped if this races with __mmput() running in
++ * between ksm_exit() and exit_mmap(). Just refuse to let
++ * merge_across_nodes/max_page_sharing be switched.
++ */
++ err = -EBUSY;
++ if (!page_mapped(page)) {
+ /*
+ * The stable node did not yet appear stale to get_ksm_page(),
+ * since that allows for an unmapped ksm page to be recognized
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 5af38d8a9afd..3a3d109dce21 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -2678,7 +2678,7 @@ int memcg_kmem_charge(struct page *page, gfp_t gfp, int order)
+ struct mem_cgroup *memcg;
+ int ret = 0;
+
+- if (memcg_kmem_bypass())
++ if (mem_cgroup_disabled() || memcg_kmem_bypass())
+ return 0;
+
+ memcg = get_mem_cgroup_from_current();
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 7965112eb063..413f6709039a 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -321,12 +321,8 @@ static unsigned long find_smallest_section_pfn(int nid, struct zone *zone,
+ unsigned long start_pfn,
+ unsigned long end_pfn)
+ {
+- struct mem_section *ms;
+-
+ for (; start_pfn < end_pfn; start_pfn += PAGES_PER_SECTION) {
+- ms = __pfn_to_section(start_pfn);
+-
+- if (unlikely(!valid_section(ms)))
++ if (unlikely(!pfn_to_online_page(start_pfn)))
+ continue;
+
+ if (unlikely(pfn_to_nid(start_pfn) != nid))
+@@ -346,15 +342,12 @@ static unsigned long find_biggest_section_pfn(int nid, struct zone *zone,
+ unsigned long start_pfn,
+ unsigned long end_pfn)
+ {
+- struct mem_section *ms;
+ unsigned long pfn;
+
+ /* pfn is the end pfn of a memory section. */
+ pfn = end_pfn - 1;
+ for (; pfn >= start_pfn; pfn -= PAGES_PER_SECTION) {
+- ms = __pfn_to_section(pfn);
+-
+- if (unlikely(!valid_section(ms)))
++ if (unlikely(!pfn_to_online_page(pfn)))
+ continue;
+
+ if (unlikely(pfn_to_nid(pfn) != nid))
+@@ -376,7 +369,6 @@ static void shrink_zone_span(struct zone *zone, unsigned long start_pfn,
+ unsigned long z = zone_end_pfn(zone); /* zone_end_pfn namespace clash */
+ unsigned long zone_end_pfn = z;
+ unsigned long pfn;
+- struct mem_section *ms;
+ int nid = zone_to_nid(zone);
+
+ zone_span_writelock(zone);
+@@ -414,9 +406,7 @@ static void shrink_zone_span(struct zone *zone, unsigned long start_pfn,
+ */
+ pfn = zone_start_pfn;
+ for (; pfn < zone_end_pfn; pfn += PAGES_PER_SECTION) {
+- ms = __pfn_to_section(pfn);
+-
+- if (unlikely(!valid_section(ms)))
++ if (unlikely(!pfn_to_online_page(pfn)))
+ continue;
+
+ if (page_zone(pfn_to_page(pfn)) != zone)
+@@ -472,6 +462,16 @@ static void __remove_zone(struct zone *zone, unsigned long start_pfn)
+ int nr_pages = PAGES_PER_SECTION;
+ unsigned long flags;
+
++#ifdef CONFIG_ZONE_DEVICE
++ /*
++ * Zone shrinking code cannot properly deal with ZONE_DEVICE. So
++ * we will not try to shrink the zones - which is okay as
++ * set_zone_contiguous() cannot deal with ZONE_DEVICE either way.
++ */
++ if (zone_idx(zone) == ZONE_DEVICE)
++ return;
++#endif
++
+ pgdat_resize_lock(zone->zone_pgdat, &flags);
+ shrink_zone_span(zone, start_pfn, start_pfn + nr_pages);
+ update_pgdat_span(pgdat);
+@@ -846,7 +846,6 @@ static struct zone * __meminit move_pfn_range(int online_type, int nid,
+ return zone;
+ }
+
+-/* Must be protected by mem_hotplug_begin() or a device_lock */
+ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_type)
+ {
+ unsigned long flags;
+@@ -858,6 +857,8 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ
+ struct memory_notify arg;
+ struct memory_block *mem;
+
++ mem_hotplug_begin();
++
+ /*
+ * We can't use pfn_to_nid() because nid might be stored in struct page
+ * which is not yet initialized. Instead, we find nid from memory block.
+@@ -923,6 +924,7 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, int online_typ
+
+ if (onlined_pages)
+ memory_notify(MEM_ONLINE, &arg);
++ mem_hotplug_done();
+ return 0;
+
+ failed_addition:
+@@ -930,6 +932,7 @@ failed_addition:
+ (unsigned long long) pfn << PAGE_SHIFT,
+ (((unsigned long long) pfn + nr_pages) << PAGE_SHIFT) - 1);
+ memory_notify(MEM_CANCEL_ONLINE, &arg);
++ mem_hotplug_done();
+ return ret;
+ }
+ #endif /* CONFIG_MEMORY_HOTPLUG_SPARSE */
+@@ -1077,7 +1080,12 @@ static int online_memory_block(struct memory_block *mem, void *arg)
+ return device_online(&mem->dev);
+ }
+
+-/* we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG */
++/*
++ * NOTE: The caller must call lock_device_hotplug() to serialize hotplug
++ * and online/offline operations (triggered e.g. by sysfs).
++ *
++ * we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG
++ */
+ int __ref add_memory_resource(int nid, struct resource *res, bool online)
+ {
+ u64 start, size;
+@@ -1129,26 +1137,26 @@ int __ref add_memory_resource(int nid, struct resource *res, bool online)
+ /* create new memmap entry */
+ firmware_map_add_hotplug(start, start + size, "System RAM");
+
++ /* device_online() will take the lock when calling online_pages() */
++ mem_hotplug_done();
++
+ /* online pages if requested */
+ if (online)
+ walk_memory_range(PFN_DOWN(start), PFN_UP(start + size - 1),
+ NULL, online_memory_block);
+
+- goto out;
+-
++ return ret;
+ error:
+ /* rollback pgdat allocation and others */
+ if (new_node)
+ rollback_node_hotadd(nid);
+ memblock_remove(start, size);
+-
+-out:
+ mem_hotplug_done();
+ return ret;
+ }
+-EXPORT_SYMBOL_GPL(add_memory_resource);
+
+-int __ref add_memory(int nid, u64 start, u64 size)
++/* requires device_hotplug_lock, see add_memory_resource() */
++int __ref __add_memory(int nid, u64 start, u64 size)
+ {
+ struct resource *res;
+ int ret;
+@@ -1162,6 +1170,17 @@ int __ref add_memory(int nid, u64 start, u64 size)
+ release_memory_resource(res);
+ return ret;
+ }
++
++int add_memory(int nid, u64 start, u64 size)
++{
++ int rc;
++
++ lock_device_hotplug();
++ rc = __add_memory(nid, start, size);
++ unlock_device_hotplug();
++
++ return rc;
++}
+ EXPORT_SYMBOL_GPL(add_memory);
+
+ #ifdef CONFIG_MEMORY_HOTREMOVE
+@@ -1598,10 +1617,16 @@ static int __ref __offline_pages(unsigned long start_pfn,
+ return -EINVAL;
+ if (!IS_ALIGNED(end_pfn, pageblock_nr_pages))
+ return -EINVAL;
++
++ mem_hotplug_begin();
++
+ /* This makes hotplug much easier...and readable.
+ we assume this for now. .*/
+- if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end))
++ if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start,
++ &valid_end)) {
++ mem_hotplug_done();
+ return -EINVAL;
++ }
+
+ zone = page_zone(pfn_to_page(valid_start));
+ node = zone_to_nid(zone);
+@@ -1610,8 +1635,10 @@ static int __ref __offline_pages(unsigned long start_pfn,
+ /* set above range as isolated */
+ ret = start_isolate_page_range(start_pfn, end_pfn,
+ MIGRATE_MOVABLE, true);
+- if (ret)
++ if (ret) {
++ mem_hotplug_done();
+ return ret;
++ }
+
+ arg.start_pfn = start_pfn;
+ arg.nr_pages = nr_pages;
+@@ -1682,6 +1709,7 @@ repeat:
+ writeback_set_ratelimit();
+
+ memory_notify(MEM_OFFLINE, &arg);
++ mem_hotplug_done();
+ return 0;
+
+ failed_removal:
+@@ -1691,10 +1719,10 @@ failed_removal:
+ memory_notify(MEM_CANCEL_OFFLINE, &arg);
+ /* pushback to free area */
+ undo_isolate_page_range(start_pfn, end_pfn, MIGRATE_MOVABLE);
++ mem_hotplug_done();
+ return ret;
+ }
+
+-/* Must be protected by mem_hotplug_begin() or a device_lock */
+ int offline_pages(unsigned long start_pfn, unsigned long nr_pages)
+ {
+ return __offline_pages(start_pfn, start_pfn + nr_pages);
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 0c48191a9036..4d3588c01203 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -2048,15 +2048,26 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
+ entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
+
+ /*
+- * Clear the old entry under pagetable lock and establish the new PTE.
+- * Any parallel GUP will either observe the old page blocking on the
+- * page lock, block on the page table lock or observe the new page.
+- * The SetPageUptodate on the new page and page_add_new_anon_rmap
+- * guarantee the copy is visible before the pagetable update.
++ * Overwrite the old entry under pagetable lock and establish
++ * the new PTE. Any parallel GUP will either observe the old
++ * page blocking on the page lock, block on the page table
++ * lock or observe the new page. The SetPageUptodate on the
++ * new page and page_add_new_anon_rmap guarantee the copy is
++ * visible before the pagetable update.
+ */
+ flush_cache_range(vma, mmun_start, mmun_end);
+ page_add_anon_rmap(new_page, vma, mmun_start, true);
+- pmdp_huge_clear_flush_notify(vma, mmun_start, pmd);
++ /*
++ * At this point the pmd is numa/protnone (i.e. non present) and the TLB
++ * has already been flushed globally. So no TLB can be currently
++ * caching this non present pmd mapping. There's no need to clear the
++ * pmd before doing set_pmd_at(), nor to flush the TLB after
++ * set_pmd_at(). Clearing the pmd here would introduce a race
++ * condition against MADV_DONTNEED, because MADV_DONTNEED only holds the
++ * mmap_sem for reading. If the pmd is set to NULL at any given time,
++ * MADV_DONTNEED won't wait on the pmd lock and it'll skip clearing this
++ * pmd.
++ */
+ set_pmd_at(mm, mmun_start, pmd, entry);
+ update_mmu_cache_pmd(vma, address, &entry);
+
+@@ -2070,7 +2081,7 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
+ * No need to double call mmu_notifier->invalidate_range() callback as
+ * the above pmdp_huge_clear_flush_notify() did already call it.
+ */
+- mmu_notifier_invalidate_range_only_end(mm, mmun_start, mmun_end);
++ mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
+
+ /* Take an "isolate" reference and put new page on the LRU. */
+ get_page(new_page);
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index ea4fd3af3b4b..43df0c52e1cc 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -2149,6 +2149,13 @@ EXPORT_SYMBOL(tag_pages_for_writeback);
+ * not miss some pages (e.g., because some other process has cleared TOWRITE
+ * tag we set). The rule we follow is that TOWRITE tag can be cleared only
+ * by the process clearing the DIRTY tag (and submitting the page for IO).
++ *
++ * To avoid deadlocks between range_cyclic writeback and callers that hold
++ * pages in PageWriteback to aggregate IO until write_cache_pages() returns,
++ * we do not loop back to the start of the file. Doing so causes a page
++ * lock/page writeback access order inversion - we should only ever lock
++ * multiple pages in ascending page->index order, and looping back to the start
++ * of the file violates that rule and causes deadlocks.
+ */
+ int write_cache_pages(struct address_space *mapping,
+ struct writeback_control *wbc, writepage_t writepage,
+@@ -2163,7 +2170,6 @@ int write_cache_pages(struct address_space *mapping,
+ pgoff_t index;
+ pgoff_t end; /* Inclusive */
+ pgoff_t done_index;
+- int cycled;
+ int range_whole = 0;
+ int tag;
+
+@@ -2171,23 +2177,17 @@ int write_cache_pages(struct address_space *mapping,
+ if (wbc->range_cyclic) {
+ writeback_index = mapping->writeback_index; /* prev offset */
+ index = writeback_index;
+- if (index == 0)
+- cycled = 1;
+- else
+- cycled = 0;
+ end = -1;
+ } else {
+ index = wbc->range_start >> PAGE_SHIFT;
+ end = wbc->range_end >> PAGE_SHIFT;
+ if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
+ range_whole = 1;
+- cycled = 1; /* ignore range_cyclic tests */
+ }
+ if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
+ tag = PAGECACHE_TAG_TOWRITE;
+ else
+ tag = PAGECACHE_TAG_DIRTY;
+-retry:
+ if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
+ tag_pages_for_writeback(mapping, index, end);
+ done_index = index;
+@@ -2279,17 +2279,14 @@ continue_unlock:
+ pagevec_release(&pvec);
+ cond_resched();
+ }
+- if (!cycled && !done) {
+- /*
+- * range_cyclic:
+- * We hit the last page and there is more work to be done: wrap
+- * back to the start of the file
+- */
+- cycled = 1;
+- index = 0;
+- end = writeback_index - 1;
+- goto retry;
+- }
++
++ /*
++ * If we hit the last page and there is more work to be done: wrap
++ * back the index back to the start of the file for the next
++ * time we are called.
++ */
++ if (wbc->range_cyclic && !done)
++ done_index = 0;
+ if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
+ mapping->writeback_index = done_index;
+
+diff --git a/mm/page_io.c b/mm/page_io.c
+index aafd19ec1db4..08d2eae58fce 100644
+--- a/mm/page_io.c
++++ b/mm/page_io.c
+@@ -76,6 +76,7 @@ static void swap_slot_free_notify(struct page *page)
+ {
+ struct swap_info_struct *sis;
+ struct gendisk *disk;
++ swp_entry_t entry;
+
+ /*
+ * There is no guarantee that the page is in swap cache - the software
+@@ -107,11 +108,11 @@ static void swap_slot_free_notify(struct page *page)
+ * we again wish to reclaim it.
+ */
+ disk = sis->bdev->bd_disk;
+- if (disk->fops->swap_slot_free_notify) {
+- swp_entry_t entry;
++ entry.val = page_private(page);
++ if (disk->fops->swap_slot_free_notify &&
++ __swap_count(sis, entry) == 1) {
+ unsigned long offset;
+
+- entry.val = page_private(page);
+ offset = swp_offset(entry);
+
+ SetPageDirty(page);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index e96c88b1465d..91179febdeee 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3277,7 +3277,7 @@ struct sk_buff *dev_hard_start_xmit(struct sk_buff *first, struct net_device *de
+ }
+
+ skb = next;
+- if (netif_xmit_stopped(txq) && skb) {
++ if (netif_tx_queue_stopped(txq) && skb) {
+ rc = NETDEV_TX_BUSY;
+ break;
+ }
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index c0de73b12580..dbb3c0c7c132 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2126,6 +2126,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+ if (tb[IFLA_VF_MAC]) {
+ struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]);
+
++ if (ivm->vf >= INT_MAX)
++ return -EINVAL;
+ err = -EOPNOTSUPP;
+ if (ops->ndo_set_vf_mac)
+ err = ops->ndo_set_vf_mac(dev, ivm->vf,
+@@ -2137,6 +2139,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+ if (tb[IFLA_VF_VLAN]) {
+ struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]);
+
++ if (ivv->vf >= INT_MAX)
++ return -EINVAL;
+ err = -EOPNOTSUPP;
+ if (ops->ndo_set_vf_vlan)
+ err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan,
+@@ -2169,6 +2173,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+ if (len == 0)
+ return -EINVAL;
+
++ if (ivvl[0]->vf >= INT_MAX)
++ return -EINVAL;
+ err = ops->ndo_set_vf_vlan(dev, ivvl[0]->vf, ivvl[0]->vlan,
+ ivvl[0]->qos, ivvl[0]->vlan_proto);
+ if (err < 0)
+@@ -2179,6 +2185,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+ struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]);
+ struct ifla_vf_info ivf;
+
++ if (ivt->vf >= INT_MAX)
++ return -EINVAL;
+ err = -EOPNOTSUPP;
+ if (ops->ndo_get_vf_config)
+ err = ops->ndo_get_vf_config(dev, ivt->vf, &ivf);
+@@ -2197,6 +2205,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+ if (tb[IFLA_VF_RATE]) {
+ struct ifla_vf_rate *ivt = nla_data(tb[IFLA_VF_RATE]);
+
++ if (ivt->vf >= INT_MAX)
++ return -EINVAL;
+ err = -EOPNOTSUPP;
+ if (ops->ndo_set_vf_rate)
+ err = ops->ndo_set_vf_rate(dev, ivt->vf,
+@@ -2209,6 +2219,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+ if (tb[IFLA_VF_SPOOFCHK]) {
+ struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]);
+
++ if (ivs->vf >= INT_MAX)
++ return -EINVAL;
+ err = -EOPNOTSUPP;
+ if (ops->ndo_set_vf_spoofchk)
+ err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
+@@ -2220,6 +2232,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+ if (tb[IFLA_VF_LINK_STATE]) {
+ struct ifla_vf_link_state *ivl = nla_data(tb[IFLA_VF_LINK_STATE]);
+
++ if (ivl->vf >= INT_MAX)
++ return -EINVAL;
+ err = -EOPNOTSUPP;
+ if (ops->ndo_set_vf_link_state)
+ err = ops->ndo_set_vf_link_state(dev, ivl->vf,
+@@ -2233,6 +2247,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+
+ err = -EOPNOTSUPP;
+ ivrssq_en = nla_data(tb[IFLA_VF_RSS_QUERY_EN]);
++ if (ivrssq_en->vf >= INT_MAX)
++ return -EINVAL;
+ if (ops->ndo_set_vf_rss_query_en)
+ err = ops->ndo_set_vf_rss_query_en(dev, ivrssq_en->vf,
+ ivrssq_en->setting);
+@@ -2243,6 +2259,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+ if (tb[IFLA_VF_TRUST]) {
+ struct ifla_vf_trust *ivt = nla_data(tb[IFLA_VF_TRUST]);
+
++ if (ivt->vf >= INT_MAX)
++ return -EINVAL;
+ err = -EOPNOTSUPP;
+ if (ops->ndo_set_vf_trust)
+ err = ops->ndo_set_vf_trust(dev, ivt->vf, ivt->setting);
+@@ -2253,15 +2271,18 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+ if (tb[IFLA_VF_IB_NODE_GUID]) {
+ struct ifla_vf_guid *ivt = nla_data(tb[IFLA_VF_IB_NODE_GUID]);
+
++ if (ivt->vf >= INT_MAX)
++ return -EINVAL;
+ if (!ops->ndo_set_vf_guid)
+ return -EOPNOTSUPP;
+-
+ return handle_vf_guid(dev, ivt, IFLA_VF_IB_NODE_GUID);
+ }
+
+ if (tb[IFLA_VF_IB_PORT_GUID]) {
+ struct ifla_vf_guid *ivt = nla_data(tb[IFLA_VF_IB_PORT_GUID]);
+
++ if (ivt->vf >= INT_MAX)
++ return -EINVAL;
+ if (!ops->ndo_set_vf_guid)
+ return -EOPNOTSUPP;
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 6c1107821776..ba4f843cdd1d 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3347,6 +3347,7 @@ int sock_load_diag_module(int family, int protocol)
+
+ #ifdef CONFIG_INET
+ if (family == AF_INET &&
++ protocol != IPPROTO_RAW &&
+ !rcu_access_pointer(inet_protos[protocol]))
+ return -ENOENT;
+ #endif
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index b2240b7f225d..523d26f5e22e 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -111,13 +111,10 @@
+ #ifdef CONFIG_IP_MULTICAST
+ /* Parameter names and values are taken from igmp-v2-06 draft */
+
+-#define IGMP_V1_ROUTER_PRESENT_TIMEOUT (400*HZ)
+-#define IGMP_V2_ROUTER_PRESENT_TIMEOUT (400*HZ)
+ #define IGMP_V2_UNSOLICITED_REPORT_INTERVAL (10*HZ)
+ #define IGMP_V3_UNSOLICITED_REPORT_INTERVAL (1*HZ)
++#define IGMP_QUERY_INTERVAL (125*HZ)
+ #define IGMP_QUERY_RESPONSE_INTERVAL (10*HZ)
+-#define IGMP_QUERY_ROBUSTNESS_VARIABLE 2
+-
+
+ #define IGMP_INITIAL_REPORT_DELAY (1)
+
+@@ -953,13 +950,15 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+
+ max_delay = IGMP_QUERY_RESPONSE_INTERVAL;
+ in_dev->mr_v1_seen = jiffies +
+- IGMP_V1_ROUTER_PRESENT_TIMEOUT;
++ (in_dev->mr_qrv * in_dev->mr_qi) +
++ in_dev->mr_qri;
+ group = 0;
+ } else {
+ /* v2 router present */
+ max_delay = ih->code*(HZ/IGMP_TIMER_SCALE);
+ in_dev->mr_v2_seen = jiffies +
+- IGMP_V2_ROUTER_PRESENT_TIMEOUT;
++ (in_dev->mr_qrv * in_dev->mr_qi) +
++ in_dev->mr_qri;
+ }
+ /* cancel the interface change timer */
+ in_dev->mr_ifc_count = 0;
+@@ -999,8 +998,21 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ if (!max_delay)
+ max_delay = 1; /* can't mod w/ 0 */
+ in_dev->mr_maxdelay = max_delay;
+- if (ih3->qrv)
+- in_dev->mr_qrv = ih3->qrv;
++
++ /* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently
++ * received value was zero, use the default or statically
++ * configured value.
++ */
++ in_dev->mr_qrv = ih3->qrv ?: net->ipv4.sysctl_igmp_qrv;
++ in_dev->mr_qi = IGMPV3_QQIC(ih3->qqic)*HZ ?: IGMP_QUERY_INTERVAL;
++
++ /* RFC3376, 8.3. Query Response Interval:
++ * The number of seconds represented by the [Query Response
++ * Interval] must be less than the [Query Interval].
++ */
++ if (in_dev->mr_qri >= in_dev->mr_qi)
++ in_dev->mr_qri = (in_dev->mr_qi/HZ - 1)*HZ;
++
+ if (!group) { /* general query */
+ if (ih3->nsrcs)
+ return true; /* no sources allowed */
+@@ -1738,18 +1750,30 @@ void ip_mc_down(struct in_device *in_dev)
+ ip_mc_dec_group(in_dev, IGMP_ALL_HOSTS);
+ }
+
+-void ip_mc_init_dev(struct in_device *in_dev)
+-{
+ #ifdef CONFIG_IP_MULTICAST
++static void ip_mc_reset(struct in_device *in_dev)
++{
+ struct net *net = dev_net(in_dev->dev);
++
++ in_dev->mr_qi = IGMP_QUERY_INTERVAL;
++ in_dev->mr_qri = IGMP_QUERY_RESPONSE_INTERVAL;
++ in_dev->mr_qrv = net->ipv4.sysctl_igmp_qrv;
++}
++#else
++static void ip_mc_reset(struct in_device *in_dev)
++{
++}
+ #endif
++
++void ip_mc_init_dev(struct in_device *in_dev)
++{
+ ASSERT_RTNL();
+
+ #ifdef CONFIG_IP_MULTICAST
+ timer_setup(&in_dev->mr_gq_timer, igmp_gq_timer_expire, 0);
+ timer_setup(&in_dev->mr_ifc_timer, igmp_ifc_timer_expire, 0);
+- in_dev->mr_qrv = net->ipv4.sysctl_igmp_qrv;
+ #endif
++ ip_mc_reset(in_dev);
+
+ spin_lock_init(&in_dev->mc_tomb_lock);
+ }
+@@ -1759,15 +1783,10 @@ void ip_mc_init_dev(struct in_device *in_dev)
+ void ip_mc_up(struct in_device *in_dev)
+ {
+ struct ip_mc_list *pmc;
+-#ifdef CONFIG_IP_MULTICAST
+- struct net *net = dev_net(in_dev->dev);
+-#endif
+
+ ASSERT_RTNL();
+
+-#ifdef CONFIG_IP_MULTICAST
+- in_dev->mr_qrv = net->ipv4.sysctl_igmp_qrv;
+-#endif
++ ip_mc_reset(in_dev);
+ ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
+
+ for_each_pmc_rtnl(in_dev, pmc) {
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index b7a26120d552..82f341e84fae 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -1244,7 +1244,7 @@ int ip_setsockopt(struct sock *sk, int level,
+ return -ENOPROTOOPT;
+
+ err = do_ip_setsockopt(sk, level, optname, optval, optlen);
+-#ifdef CONFIG_BPFILTER
++#if IS_ENABLED(CONFIG_BPFILTER_UMH)
+ if (optname >= BPFILTER_IPT_SO_SET_REPLACE &&
+ optname < BPFILTER_IPT_SET_MAX)
+ err = bpfilter_ip_set_sockopt(sk, optname, optval, optlen);
+@@ -1557,7 +1557,7 @@ int ip_getsockopt(struct sock *sk, int level,
+ int err;
+
+ err = do_ip_getsockopt(sk, level, optname, optval, optlen, 0);
+-#ifdef CONFIG_BPFILTER
++#if IS_ENABLED(CONFIG_BPFILTER_UMH)
+ if (optname >= BPFILTER_IPT_SO_GET_INFO &&
+ optname < BPFILTER_IPT_GET_MAX)
+ err = bpfilter_ip_get_sockopt(sk, optname, optval, optlen);
+@@ -1594,7 +1594,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
+ err = do_ip_getsockopt(sk, level, optname, optval, optlen,
+ MSG_CMSG_COMPAT);
+
+-#ifdef CONFIG_BPFILTER
++#if IS_ENABLED(CONFIG_BPFILTER_UMH)
+ if (optname >= BPFILTER_IPT_SO_GET_INFO &&
+ optname < BPFILTER_IPT_GET_MAX)
+ err = bpfilter_ip_get_sockopt(sk, optname, optval, optlen);
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index e7cdfa92c382..9a117a79af65 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -734,6 +734,7 @@ static void tcp_v6_init_req(struct request_sock *req,
+ const struct sock *sk_listener,
+ struct sk_buff *skb)
+ {
++ bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags);
+ struct inet_request_sock *ireq = inet_rsk(req);
+ const struct ipv6_pinfo *np = inet6_sk(sk_listener);
+
+@@ -741,7 +742,7 @@ static void tcp_v6_init_req(struct request_sock *req,
+ ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
+
+ /* So that link locals have meaning */
+- if (!sk_listener->sk_bound_dev_if &&
++ if ((!sk_listener->sk_bound_dev_if || l3_slave) &&
+ ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
+ ireq->ir_iif = tcp_v6_iif(skb);
+
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 35ae64cbef33..46aa1aa51db4 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -1199,7 +1199,8 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
+ &info->labels.mask);
+ if (err)
+ return err;
+- } else if (labels_nonzero(&info->labels.mask)) {
++ } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
++ labels_nonzero(&info->labels.mask)) {
+ err = ovs_ct_set_labels(ct, key, &info->labels.value,
+ &info->labels.mask);
+ if (err)
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index 33c0cc5ef229..ce14fafb36a1 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -46,7 +46,7 @@ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,
+ int err = -EINVAL;
+ int rem;
+
+- if (!nla || !n)
++ if (!nla)
+ return NULL;
+
+ keys_ex = kcalloc(n, sizeof(*k), GFP_KERNEL);
+@@ -169,6 +169,10 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
+ }
+
+ parm = nla_data(pattr);
++ if (!parm->nkeys) {
++ NL_SET_ERR_MSG_MOD(extack, "Pedit requires keys to be passed");
++ return -EINVAL;
++ }
+ ksize = parm->nkeys * sizeof(struct tc_pedit_key);
+ if (nla_len(pattr) < sizeof(*parm) + ksize) {
+ NL_SET_ERR_MSG_ATTR(extack, pattr, "Length of TCA_PEDIT_PARMS or TCA_PEDIT_PARMS_EX pedit attribute is invalid");
+@@ -182,12 +186,6 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
+ index = parm->index;
+ err = tcf_idr_check_alloc(tn, &index, a, bind);
+ if (!err) {
+- if (!parm->nkeys) {
+- tcf_idr_cleanup(tn, index);
+- NL_SET_ERR_MSG_MOD(extack, "Pedit requires keys to be passed");
+- ret = -EINVAL;
+- goto out_free;
+- }
+ ret = tcf_idr_create(tn, index, est, a,
+ &act_pedit_ops, bind, false);
+ if (ret) {
+diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
+index 43309ff2b5dc..e4fc6b2bc29d 100644
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -137,6 +137,10 @@ static int tunnel_key_copy_opts(const struct nlattr *nla, u8 *dst,
+ if (opt_len < 0)
+ return opt_len;
+ opts_len += opt_len;
++ if (opts_len > IP_TUNNEL_OPTS_MAX) {
++ NL_SET_ERR_MSG(extack, "Tunnel options exceeds max size");
++ return -EINVAL;
++ }
+ if (dst) {
+ dst_len -= opt_len;
+ dst += opt_len;
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index c76631552722..e7a11cd7633f 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -83,7 +83,7 @@
+ #include <net/sctp/stream_sched.h>
+
+ /* Forward declarations for internal helper functions. */
+-static int sctp_writeable(struct sock *sk);
++static bool sctp_writeable(struct sock *sk);
+ static void sctp_wfree(struct sk_buff *skb);
+ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
+ size_t msg_len);
+@@ -119,25 +119,10 @@ static void sctp_enter_memory_pressure(struct sock *sk)
+ /* Get the sndbuf space available at the time on the association. */
+ static inline int sctp_wspace(struct sctp_association *asoc)
+ {
+- int amt;
++ struct sock *sk = asoc->base.sk;
+
+- if (asoc->ep->sndbuf_policy)
+- amt = asoc->sndbuf_used;
+- else
+- amt = sk_wmem_alloc_get(asoc->base.sk);
+-
+- if (amt >= asoc->base.sk->sk_sndbuf) {
+- if (asoc->base.sk->sk_userlocks & SOCK_SNDBUF_LOCK)
+- amt = 0;
+- else {
+- amt = sk_stream_wspace(asoc->base.sk);
+- if (amt < 0)
+- amt = 0;
+- }
+- } else {
+- amt = asoc->base.sk->sk_sndbuf - amt;
+- }
+- return amt;
++ return asoc->ep->sndbuf_policy ? sk->sk_sndbuf - asoc->sndbuf_used
++ : sk_stream_wspace(sk);
+ }
+
+ /* Increment the used sndbuf space count of the corresponding association by
+@@ -1928,10 +1913,10 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
+ asoc->pmtu_pending = 0;
+ }
+
+- if (sctp_wspace(asoc) < msg_len)
++ if (sctp_wspace(asoc) < (int)msg_len)
+ sctp_prsctp_prune(asoc, sinfo, msg_len - sctp_wspace(asoc));
+
+- if (!sctp_wspace(asoc)) {
++ if (sctp_wspace(asoc) <= 0) {
+ timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
+ err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
+ if (err)
+@@ -8516,7 +8501,7 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
+ goto do_error;
+ if (signal_pending(current))
+ goto do_interrupted;
+- if (msg_len <= sctp_wspace(asoc))
++ if ((int)msg_len <= sctp_wspace(asoc))
+ break;
+
+ /* Let another process have a go. Since we are going
+@@ -8591,14 +8576,9 @@ void sctp_write_space(struct sock *sk)
+ * UDP-style sockets or TCP-style sockets, this code should work.
+ * - Daisy
+ */
+-static int sctp_writeable(struct sock *sk)
++static bool sctp_writeable(struct sock *sk)
+ {
+- int amt = 0;
+-
+- amt = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
+- if (amt < 0)
+- amt = 0;
+- return amt;
++ return sk->sk_sndbuf > sk->sk_wmem_queued;
+ }
+
+ /* Wait for an association to go into ESTABLISHED state. If timeout is 0,
+diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
+index eaad9bc7a0bd..e1f0571843c8 100644
+--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
++++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
+@@ -63,6 +63,7 @@
+ #include <linux/sunrpc/gss_krb5.h>
+ #include <linux/random.h>
+ #include <linux/crypto.h>
++#include <linux/atomic.h>
+
+ #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
+ # define RPCDBG_FACILITY RPCDBG_AUTH
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index c0d7875a64ff..9dc059dea689 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -129,7 +129,7 @@ static struct ctl_table xs_tunables_table[] = {
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = &xprt_min_resvport_limit,
+- .extra2 = &xprt_max_resvport
++ .extra2 = &xprt_max_resvport_limit
+ },
+ {
+ .procname = "max_resvport",
+@@ -137,7 +137,7 @@ static struct ctl_table xs_tunables_table[] = {
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+- .extra1 = &xprt_min_resvport,
++ .extra1 = &xprt_min_resvport_limit,
+ .extra2 = &xprt_max_resvport_limit
+ },
+ {
+@@ -1776,11 +1776,17 @@ static void xs_udp_timer(struct rpc_xprt *xprt, struct rpc_task *task)
+ spin_unlock_bh(&xprt->transport_lock);
+ }
+
+-static unsigned short xs_get_random_port(void)
++static int xs_get_random_port(void)
+ {
+- unsigned short range = xprt_max_resvport - xprt_min_resvport + 1;
+- unsigned short rand = (unsigned short) prandom_u32() % range;
+- return rand + xprt_min_resvport;
++ unsigned short min = xprt_min_resvport, max = xprt_max_resvport;
++ unsigned short range;
++ unsigned short rand;
++
++ if (max < min)
++ return -EADDRINUSE;
++ range = max - min + 1;
++ rand = (unsigned short) prandom_u32() % range;
++ return rand + min;
+ }
+
+ /**
+@@ -1836,9 +1842,9 @@ static void xs_set_srcport(struct sock_xprt *transport, struct socket *sock)
+ transport->srcport = xs_sock_getport(sock);
+ }
+
+-static unsigned short xs_get_srcport(struct sock_xprt *transport)
++static int xs_get_srcport(struct sock_xprt *transport)
+ {
+- unsigned short port = transport->srcport;
++ int port = transport->srcport;
+
+ if (port == 0 && transport->xprt.resvport)
+ port = xs_get_random_port();
+@@ -1859,7 +1865,7 @@ static int xs_bind(struct sock_xprt *transport, struct socket *sock)
+ {
+ struct sockaddr_storage myaddr;
+ int err, nloop = 0;
+- unsigned short port = xs_get_srcport(transport);
++ int port = xs_get_srcport(transport);
+ unsigned short last;
+
+ /*
+@@ -1877,8 +1883,8 @@ static int xs_bind(struct sock_xprt *transport, struct socket *sock)
+ * transport->xprt.resvport == 1) xs_get_srcport above will
+ * ensure that port is non-zero and we will bind as needed.
+ */
+- if (port == 0)
+- return 0;
++ if (port <= 0)
++ return port;
+
+ memcpy(&myaddr, &transport->srcaddr, transport->xprt.addrlen);
+ do {
+@@ -3319,12 +3325,8 @@ static int param_set_uint_minmax(const char *val,
+
+ static int param_set_portnr(const char *val, const struct kernel_param *kp)
+ {
+- if (kp->arg == &xprt_min_resvport)
+- return param_set_uint_minmax(val, kp,
+- RPC_MIN_RESVPORT,
+- xprt_max_resvport);
+ return param_set_uint_minmax(val, kp,
+- xprt_min_resvport,
++ RPC_MIN_RESVPORT,
+ RPC_MAX_RESVPORT);
+ }
+
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 231b6c032d2c..d2d6ff0c6265 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -225,6 +225,8 @@ static inline void unix_release_addr(struct unix_address *addr)
+
+ static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned int *hashp)
+ {
++ *hashp = 0;
++
+ if (len <= sizeof(short) || len > sizeof(*sunaddr))
+ return -EINVAL;
+ if (!sunaddr || sunaddr->sun_family != AF_UNIX)
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 2a8651aa90c8..52242a148c70 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -92,8 +92,17 @@ static struct sk_buff *virtio_transport_build_skb(void *opaque)
+ struct virtio_vsock_pkt *pkt = opaque;
+ struct af_vsockmon_hdr *hdr;
+ struct sk_buff *skb;
++ size_t payload_len;
++ void *payload_buf;
+
+- skb = alloc_skb(sizeof(*hdr) + sizeof(pkt->hdr) + pkt->len,
++ /* A packet could be split to fit the RX buffer, so we can retrieve
++ * the payload length from the header and the buffer pointer taking
++ * care of the offset in the original packet.
++ */
++ payload_len = le32_to_cpu(pkt->hdr.len);
++ payload_buf = pkt->buf + pkt->off;
++
++ skb = alloc_skb(sizeof(*hdr) + sizeof(pkt->hdr) + payload_len,
+ GFP_ATOMIC);
+ if (!skb)
+ return NULL;
+@@ -133,8 +142,8 @@ static struct sk_buff *virtio_transport_build_skb(void *opaque)
+
+ skb_put_data(skb, &pkt->hdr, sizeof(pkt->hdr));
+
+- if (pkt->len) {
+- skb_put_data(skb, pkt->buf, pkt->len);
++ if (payload_len) {
++ skb_put_data(skb, payload_buf, payload_len);
+ }
+
+ return skb;
+diff --git a/net/wireless/ap.c b/net/wireless/ap.c
+index 882d97bdc6bf..550ac9d827fe 100644
+--- a/net/wireless/ap.c
++++ b/net/wireless/ap.c
+@@ -41,6 +41,8 @@ int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
+ cfg80211_sched_dfs_chan_update(rdev);
+ }
+
++ schedule_work(&cfg80211_disconnect_work);
++
+ return err;
+ }
+
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index 7f52ef569320..f5d58652108d 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -430,6 +430,8 @@ void cfg80211_process_wdev_events(struct wireless_dev *wdev);
+ bool cfg80211_does_bw_fit_range(const struct ieee80211_freq_range *freq_range,
+ u32 center_freq_khz, u32 bw_khz);
+
++extern struct work_struct cfg80211_disconnect_work;
++
+ /**
+ * cfg80211_chandef_dfs_usable - checks if chandef is DFS usable
+ * @wiphy: the wiphy to validate against
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index d536b07582f8..07c2196e9d57 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -642,11 +642,15 @@ static bool cfg80211_is_all_idle(void)
+ * All devices must be idle as otherwise if you are actively
+ * scanning some new beacon hints could be learned and would
+ * count as new regulatory hints.
++ * Also if there is any other active beaconing interface we
++ * need not issue a disconnect hint and reset any info such
++ * as chan dfs state, etc.
+ */
+ list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+ list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
+ wdev_lock(wdev);
+- if (wdev->conn || wdev->current_bss)
++ if (wdev->conn || wdev->current_bss ||
++ cfg80211_beaconing_iface_active(wdev))
+ is_all_idle = false;
+ wdev_unlock(wdev);
+ }
+@@ -663,7 +667,7 @@ static void disconnect_work(struct work_struct *work)
+ rtnl_unlock();
+ }
+
+-static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
++DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
+
+
+ /*
+diff --git a/sound/firewire/isight.c b/sound/firewire/isight.c
+index 30957477e005..0717ab9e48e3 100644
+--- a/sound/firewire/isight.c
++++ b/sound/firewire/isight.c
+@@ -640,7 +640,7 @@ static int isight_probe(struct fw_unit *unit,
+ if (!isight->audio_base) {
+ dev_err(&unit->device, "audio unit base not found\n");
+ err = -ENXIO;
+- goto err_unit;
++ goto error;
+ }
+ fw_iso_resources_init(&isight->resources, unit);
+
+@@ -669,12 +669,12 @@ static int isight_probe(struct fw_unit *unit,
+ dev_set_drvdata(&unit->device, isight);
+
+ return 0;
+-
+-err_unit:
+- fw_unit_put(isight->unit);
+- mutex_destroy(&isight->mutex);
+ error:
+ snd_card_free(card);
++
++ mutex_destroy(&isight->mutex);
++ fw_unit_put(isight->unit);
++
+ return err;
+ }
+
+diff --git a/sound/i2c/cs8427.c b/sound/i2c/cs8427.c
+index 2647309bc675..8afa2f888466 100644
+--- a/sound/i2c/cs8427.c
++++ b/sound/i2c/cs8427.c
+@@ -118,7 +118,7 @@ static int snd_cs8427_send_corudata(struct snd_i2c_device *device,
+ struct cs8427 *chip = device->private_data;
+ char *hw_data = udata ?
+ chip->playback.hw_udata : chip->playback.hw_status;
+- char data[32];
++ unsigned char data[32];
+ int err, idx;
+
+ if (!memcmp(hw_data, ndata, count))
+diff --git a/sound/soc/tegra/tegra_sgtl5000.c b/sound/soc/tegra/tegra_sgtl5000.c
+index 45a4aa9d2a47..901457da25ec 100644
+--- a/sound/soc/tegra/tegra_sgtl5000.c
++++ b/sound/soc/tegra/tegra_sgtl5000.c
+@@ -149,14 +149,14 @@ static int tegra_sgtl5000_driver_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev,
+ "Property 'nvidia,i2s-controller' missing/invalid\n");
+ ret = -EINVAL;
+- goto err;
++ goto err_put_codec_of_node;
+ }
+
+ tegra_sgtl5000_dai.platform_of_node = tegra_sgtl5000_dai.cpu_of_node;
+
+ ret = tegra_asoc_utils_init(&machine->util_data, &pdev->dev);
+ if (ret)
+- goto err;
++ goto err_put_cpu_of_node;
+
+ ret = snd_soc_register_card(card);
+ if (ret) {
+@@ -169,6 +169,13 @@ static int tegra_sgtl5000_driver_probe(struct platform_device *pdev)
+
+ err_fini_utils:
+ tegra_asoc_utils_fini(&machine->util_data);
++err_put_cpu_of_node:
++ of_node_put(tegra_sgtl5000_dai.cpu_of_node);
++ tegra_sgtl5000_dai.cpu_of_node = NULL;
++ tegra_sgtl5000_dai.platform_of_node = NULL;
++err_put_codec_of_node:
++ of_node_put(tegra_sgtl5000_dai.codec_of_node);
++ tegra_sgtl5000_dai.codec_of_node = NULL;
+ err:
+ return ret;
+ }
+@@ -183,6 +190,12 @@ static int tegra_sgtl5000_driver_remove(struct platform_device *pdev)
+
+ tegra_asoc_utils_fini(&machine->util_data);
+
++ of_node_put(tegra_sgtl5000_dai.cpu_of_node);
++ tegra_sgtl5000_dai.cpu_of_node = NULL;
++ tegra_sgtl5000_dai.platform_of_node = NULL;
++ of_node_put(tegra_sgtl5000_dai.codec_of_node);
++ tegra_sgtl5000_dai.codec_of_node = NULL;
++
+ return ret;
+ }
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 726cbd63a0c7..d7778f2bcbf8 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2949,6 +2949,9 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer,
+ continue;
+
+ iface = usb_ifnum_to_if(dev, intf);
++ if (!iface)
++ continue;
++
+ num = iface->num_altsetting;
+
+ if (num < 2)
+diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
+index 598066c40191..c2b6b2176f3b 100644
+--- a/tools/bpf/bpftool/bash-completion/bpftool
++++ b/tools/bpf/bpftool/bash-completion/bpftool
+@@ -143,7 +143,7 @@ _bpftool_map_update_map_type()
+ local type
+ type=$(bpftool -jp map show $keyword $ref | \
+ command sed -n 's/.*"type": "\(.*\)",$/\1/p')
+- printf $type
++ [[ -n $type ]] && printf $type
+ }
+
+ _bpftool_map_update_get_id()
+diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
+index be7aebff0c1e..158469f57461 100644
+--- a/tools/bpf/bpftool/common.c
++++ b/tools/bpf/bpftool/common.c
+@@ -130,16 +130,17 @@ static int mnt_bpffs(const char *target, char *buff, size_t bufflen)
+ return 0;
+ }
+
+-int open_obj_pinned(char *path)
++int open_obj_pinned(char *path, bool quiet)
+ {
+ int fd;
+
+ fd = bpf_obj_get(path);
+ if (fd < 0) {
+- p_err("bpf obj get (%s): %s", path,
+- errno == EACCES && !is_bpffs(dirname(path)) ?
+- "directory not in bpf file system (bpffs)" :
+- strerror(errno));
++ if (!quiet)
++ p_err("bpf obj get (%s): %s", path,
++ errno == EACCES && !is_bpffs(dirname(path)) ?
++ "directory not in bpf file system (bpffs)" :
++ strerror(errno));
+ return -1;
+ }
+
+@@ -151,7 +152,7 @@ int open_obj_pinned_any(char *path, enum bpf_obj_type exp_type)
+ enum bpf_obj_type type;
+ int fd;
+
+- fd = open_obj_pinned(path);
++ fd = open_obj_pinned(path, false);
+ if (fd < 0)
+ return -1;
+
+@@ -384,7 +385,7 @@ int build_pinned_obj_table(struct pinned_obj_table *tab,
+ while ((ftse = fts_read(fts))) {
+ if (!(ftse->fts_info & FTS_F))
+ continue;
+- fd = open_obj_pinned(ftse->fts_path);
++ fd = open_obj_pinned(ftse->fts_path, true);
+ if (fd < 0)
+ continue;
+
+diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
+index 238e734d75b3..057a227bdb9f 100644
+--- a/tools/bpf/bpftool/main.h
++++ b/tools/bpf/bpftool/main.h
+@@ -126,7 +126,7 @@ int cmd_select(const struct cmd *cmds, int argc, char **argv,
+ int get_fd_type(int fd);
+ const char *get_fd_type_name(enum bpf_obj_type type);
+ char *get_fdinfo(int fd, const char *key);
+-int open_obj_pinned(char *path);
++int open_obj_pinned(char *path, bool quiet);
+ int open_obj_pinned_any(char *path, enum bpf_obj_type exp_type);
+ int do_pin_any(int argc, char **argv, int (*get_fd_by_id)(__u32));
+ int do_pin_fd(int fd, const char *name);
+diff --git a/tools/gpio/Build b/tools/gpio/Build
+index 620c1937d957..4141f35837db 100644
+--- a/tools/gpio/Build
++++ b/tools/gpio/Build
+@@ -1,3 +1,4 @@
++gpio-utils-y += gpio-utils.o
+ lsgpio-y += lsgpio.o gpio-utils.o
+ gpio-hammer-y += gpio-hammer.o gpio-utils.o
+ gpio-event-mon-y += gpio-event-mon.o gpio-utils.o
+diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
+index f8bc8656a544..6a73c06e069c 100644
+--- a/tools/gpio/Makefile
++++ b/tools/gpio/Makefile
+@@ -35,11 +35,15 @@ $(OUTPUT)include/linux/gpio.h: ../../include/uapi/linux/gpio.h
+
+ prepare: $(OUTPUT)include/linux/gpio.h
+
++GPIO_UTILS_IN := $(output)gpio-utils-in.o
++$(GPIO_UTILS_IN): prepare FORCE
++ $(Q)$(MAKE) $(build)=gpio-utils
++
+ #
+ # lsgpio
+ #
+ LSGPIO_IN := $(OUTPUT)lsgpio-in.o
+-$(LSGPIO_IN): prepare FORCE
++$(LSGPIO_IN): prepare FORCE $(OUTPUT)gpio-utils-in.o
+ $(Q)$(MAKE) $(build)=lsgpio
+ $(OUTPUT)lsgpio: $(LSGPIO_IN)
+ $(QUIET_LINK)$(CC) $(CFLAGS) $(LDFLAGS) $< -o $@
+@@ -48,7 +52,7 @@ $(OUTPUT)lsgpio: $(LSGPIO_IN)
+ # gpio-hammer
+ #
+ GPIO_HAMMER_IN := $(OUTPUT)gpio-hammer-in.o
+-$(GPIO_HAMMER_IN): prepare FORCE
++$(GPIO_HAMMER_IN): prepare FORCE $(OUTPUT)gpio-utils-in.o
+ $(Q)$(MAKE) $(build)=gpio-hammer
+ $(OUTPUT)gpio-hammer: $(GPIO_HAMMER_IN)
+ $(QUIET_LINK)$(CC) $(CFLAGS) $(LDFLAGS) $< -o $@
+@@ -57,7 +61,7 @@ $(OUTPUT)gpio-hammer: $(GPIO_HAMMER_IN)
+ # gpio-event-mon
+ #
+ GPIO_EVENT_MON_IN := $(OUTPUT)gpio-event-mon-in.o
+-$(GPIO_EVENT_MON_IN): prepare FORCE
++$(GPIO_EVENT_MON_IN): prepare FORCE $(OUTPUT)gpio-utils-in.o
+ $(Q)$(MAKE) $(build)=gpio-event-mon
+ $(OUTPUT)gpio-event-mon: $(GPIO_EVENT_MON_IN)
+ $(QUIET_LINK)$(CC) $(CFLAGS) $(LDFLAGS) $< -o $@
+diff --git a/tools/objtool/arch/x86/tools/gen-insn-attr-x86.awk b/tools/objtool/arch/x86/tools/gen-insn-attr-x86.awk
+index b02a36b2c14f..a42015b305f4 100644
+--- a/tools/objtool/arch/x86/tools/gen-insn-attr-x86.awk
++++ b/tools/objtool/arch/x86/tools/gen-insn-attr-x86.awk
+@@ -69,7 +69,7 @@ BEGIN {
+
+ lprefix1_expr = "\\((66|!F3)\\)"
+ lprefix2_expr = "\\(F3\\)"
+- lprefix3_expr = "\\((F2|!F3|66\\&F2)\\)"
++ lprefix3_expr = "\\((F2|!F3|66&F2)\\)"
+ lprefix_expr = "\\((66|F2|F3)\\)"
+ max_lprefix = 4
+
+@@ -257,7 +257,7 @@ function convert_operands(count,opnd, i,j,imm,mod)
+ return add_flags(imm, mod)
+ }
+
+-/^[0-9a-f]+\:/ {
++/^[0-9a-f]+:/ {
+ if (NR == 1)
+ next
+ # get index
+diff --git a/tools/power/acpi/tools/acpidump/apmain.c b/tools/power/acpi/tools/acpidump/apmain.c
+index db213171f8d9..2d9b94b631cb 100644
+--- a/tools/power/acpi/tools/acpidump/apmain.c
++++ b/tools/power/acpi/tools/acpidump/apmain.c
+@@ -106,7 +106,7 @@ static int ap_insert_action(char *argument, u32 to_be_done)
+
+ current_action++;
+ if (current_action > AP_MAX_ACTIONS) {
+- fprintf(stderr, "Too many table options (max %u)\n",
++ fprintf(stderr, "Too many table options (max %d)\n",
+ AP_MAX_ACTIONS);
+ return (-1);
+ }
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 823bbc741ad7..02d123871ef9 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -1,6 +1,6 @@
+ /*
+ * turbostat -- show CPU frequency and C-state residency
+- * on modern Intel turbo-capable processors.
++ * on modern Intel and AMD processors.
+ *
+ * Copyright (c) 2013 Intel Corporation.
+ * Len Brown <len.brown@intel.com>
+@@ -71,6 +71,8 @@ unsigned int do_irtl_snb;
+ unsigned int do_irtl_hsw;
+ unsigned int units = 1000000; /* MHz etc */
+ unsigned int genuine_intel;
++unsigned int authentic_amd;
++unsigned int max_level, max_extended_level;
+ unsigned int has_invariant_tsc;
+ unsigned int do_nhm_platform_info;
+ unsigned int no_MSR_MISC_PWR_MGMT;
+@@ -1667,30 +1669,51 @@ int get_mp(int cpu, struct msr_counter *mp, unsigned long long *counterp)
+
+ void get_apic_id(struct thread_data *t)
+ {
+- unsigned int eax, ebx, ecx, edx, max_level;
++ unsigned int eax, ebx, ecx, edx;
+
+- eax = ebx = ecx = edx = 0;
++ if (DO_BIC(BIC_APIC)) {
++ eax = ebx = ecx = edx = 0;
++ __cpuid(1, eax, ebx, ecx, edx);
+
+- if (!genuine_intel)
++ t->apic_id = (ebx >> 24) & 0xff;
++ }
++
++ if (!DO_BIC(BIC_X2APIC))
+ return;
+
+- __cpuid(0, max_level, ebx, ecx, edx);
++ if (authentic_amd) {
++ unsigned int topology_extensions;
+
+- __cpuid(1, eax, ebx, ecx, edx);
+- t->apic_id = (ebx >> 24) & 0xf;
++ if (max_extended_level < 0x8000001e)
++ return;
+
+- if (max_level < 0xb)
++ eax = ebx = ecx = edx = 0;
++ __cpuid(0x80000001, eax, ebx, ecx, edx);
++ topology_extensions = ecx & (1 << 22);
++
++ if (topology_extensions == 0)
++ return;
++
++ eax = ebx = ecx = edx = 0;
++ __cpuid(0x8000001e, eax, ebx, ecx, edx);
++
++ t->x2apic_id = eax;
+ return;
++ }
+
+- if (!DO_BIC(BIC_X2APIC))
++ if (!genuine_intel)
++ return;
++
++ if (max_level < 0xb)
+ return;
+
+ ecx = 0;
+ __cpuid(0xb, eax, ebx, ecx, edx);
+ t->x2apic_id = edx;
+
+- if (debug && (t->apic_id != t->x2apic_id))
+- fprintf(outf, "cpu%d: apic 0x%x x2apic 0x%x\n", t->cpu_id, t->apic_id, t->x2apic_id);
++ if (debug && (t->apic_id != (t->x2apic_id & 0xff)))
++ fprintf(outf, "cpu%d: BIOS BUG: apic 0x%x x2apic 0x%x\n",
++ t->cpu_id, t->apic_id, t->x2apic_id);
+ }
+
+ /*
+@@ -4439,16 +4462,18 @@ void decode_c6_demotion_policy_msr(void)
+
+ void process_cpuid()
+ {
+- unsigned int eax, ebx, ecx, edx, max_level, max_extended_level;
+- unsigned int fms, family, model, stepping;
++ unsigned int eax, ebx, ecx, edx;
++ unsigned int fms, family, model, stepping, ecx_flags, edx_flags;
+ unsigned int has_turbo;
+
+ eax = ebx = ecx = edx = 0;
+
+ __cpuid(0, max_level, ebx, ecx, edx);
+
+- if (ebx == 0x756e6547 && edx == 0x49656e69 && ecx == 0x6c65746e)
++ if (ebx == 0x756e6547 && ecx == 0x6c65746e && edx == 0x49656e69)
+ genuine_intel = 1;
++ else if (ebx == 0x68747541 && ecx == 0x444d4163 && edx == 0x69746e65)
++ authentic_amd = 1;
+
+ if (!quiet)
+ fprintf(outf, "CPUID(0): %.4s%.4s%.4s ",
+@@ -4462,25 +4487,8 @@ void process_cpuid()
+ family += (fms >> 20) & 0xff;
+ if (family >= 6)
+ model += ((fms >> 16) & 0xf) << 4;
+-
+- if (!quiet) {
+- fprintf(outf, "%d CPUID levels; family:model:stepping 0x%x:%x:%x (%d:%d:%d)\n",
+- max_level, family, model, stepping, family, model, stepping);
+- fprintf(outf, "CPUID(1): %s %s %s %s %s %s %s %s %s %s\n",
+- ecx & (1 << 0) ? "SSE3" : "-",
+- ecx & (1 << 3) ? "MONITOR" : "-",
+- ecx & (1 << 6) ? "SMX" : "-",
+- ecx & (1 << 7) ? "EIST" : "-",
+- ecx & (1 << 8) ? "TM2" : "-",
+- edx & (1 << 4) ? "TSC" : "-",
+- edx & (1 << 5) ? "MSR" : "-",
+- edx & (1 << 22) ? "ACPI-TM" : "-",
+- edx & (1 << 28) ? "HT" : "-",
+- edx & (1 << 29) ? "TM" : "-");
+- }
+-
+- if (!(edx & (1 << 5)))
+- errx(1, "CPUID: no MSR");
++ ecx_flags = ecx;
++ edx_flags = edx;
+
+ /*
+ * check max extended function levels of CPUID.
+@@ -4490,6 +4498,25 @@ void process_cpuid()
+ ebx = ecx = edx = 0;
+ __cpuid(0x80000000, max_extended_level, ebx, ecx, edx);
+
++ if (!quiet) {
++ fprintf(outf, "0x%x CPUID levels; 0x%x xlevels; family:model:stepping 0x%x:%x:%x (%d:%d:%d)\n",
++ max_level, max_extended_level, family, model, stepping, family, model, stepping);
++ fprintf(outf, "CPUID(1): %s %s %s %s %s %s %s %s %s %s\n",
++ ecx_flags & (1 << 0) ? "SSE3" : "-",
++ ecx_flags & (1 << 3) ? "MONITOR" : "-",
++ ecx_flags & (1 << 6) ? "SMX" : "-",
++ ecx_flags & (1 << 7) ? "EIST" : "-",
++ ecx_flags & (1 << 8) ? "TM2" : "-",
++ edx_flags & (1 << 4) ? "TSC" : "-",
++ edx_flags & (1 << 5) ? "MSR" : "-",
++ edx_flags & (1 << 22) ? "ACPI-TM" : "-",
++ edx_flags & (1 << 28) ? "HT" : "-",
++ edx_flags & (1 << 29) ? "TM" : "-");
++ }
++
++ if (!(edx_flags & (1 << 5)))
++ errx(1, "CPUID: no MSR");
++
+ if (max_extended_level >= 0x80000007) {
+
+ /*
+diff --git a/tools/testing/selftests/bpf/test_libbpf.sh b/tools/testing/selftests/bpf/test_libbpf.sh
+index 8b1bc96d8e0c..2989b2e2d856 100755
+--- a/tools/testing/selftests/bpf/test_libbpf.sh
++++ b/tools/testing/selftests/bpf/test_libbpf.sh
+@@ -6,7 +6,7 @@ export TESTNAME=test_libbpf
+ # Determine selftest success via shell exit code
+ exit_handler()
+ {
+- if (( $? == 0 )); then
++ if [ $? -eq 0 ]; then
+ echo "selftests: $TESTNAME [PASS]";
+ else
+ echo "$TESTNAME: failed at file $LAST_LOADED" 1>&2
+diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
+index cf156b353679..82922f13dcd3 100644
+--- a/tools/testing/selftests/bpf/trace_helpers.c
++++ b/tools/testing/selftests/bpf/trace_helpers.c
+@@ -41,6 +41,7 @@ int load_kallsyms(void)
+ syms[i].name = strdup(func);
+ i++;
+ }
++ fclose(f);
+ sym_cnt = i;
+ qsort(syms, sym_cnt, sizeof(struct ksym), ksym_cmp);
+ return 0;
+diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
+index d026ff4e562f..92ffb3bd33d8 100644
+--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
+@@ -78,8 +78,11 @@ test_badarg "\$stackp" "\$stack0+10" "\$stack1-10"
+ echo "r ${PROBEFUNC} \$retval" > kprobe_events
+ ! echo "p ${PROBEFUNC} \$retval" > kprobe_events
+
++# $comm was introduced in 4.8, older kernels reject it.
++if grep -A1 "fetcharg:" README | grep -q '\$comm' ; then
+ : "Comm access"
+ test_goodarg "\$comm"
++fi
+
+ : "Indirect memory access"
+ test_goodarg "+0(${GOODREG})" "-0(${GOODREG})" "+10(\$stack)" \
+diff --git a/tools/testing/selftests/kvm/dirty_log_test.c b/tools/testing/selftests/kvm/dirty_log_test.c
+index 0c2cdc105f96..a9c4b5e21d7e 100644
+--- a/tools/testing/selftests/kvm/dirty_log_test.c
++++ b/tools/testing/selftests/kvm/dirty_log_test.c
+@@ -31,9 +31,9 @@
+ /* How many pages to dirty for each guest loop */
+ #define TEST_PAGES_PER_LOOP 1024
+ /* How many host loops to run (one KVM_GET_DIRTY_LOG for each loop) */
+-#define TEST_HOST_LOOP_N 32
++#define TEST_HOST_LOOP_N 32UL
+ /* Interval for each host loop (ms) */
+-#define TEST_HOST_LOOP_INTERVAL 10
++#define TEST_HOST_LOOP_INTERVAL 10UL
+
+ /*
+ * Guest variables. We use these variables to share data between host
+diff --git a/tools/testing/selftests/powerpc/cache_shape/Makefile b/tools/testing/selftests/powerpc/cache_shape/Makefile
+index ede4d3dae750..689f6c8ebcd8 100644
+--- a/tools/testing/selftests/powerpc/cache_shape/Makefile
++++ b/tools/testing/selftests/powerpc/cache_shape/Makefile
+@@ -1,12 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+-TEST_PROGS := cache_shape
+-
+-all: $(TEST_PROGS)
+-
+-$(TEST_PROGS): ../harness.c ../utils.c
++TEST_GEN_PROGS := cache_shape
+
+ top_srcdir = ../../../../..
+ include ../../lib.mk
+
+-clean:
+- rm -f $(TEST_PROGS) *.o
++$(TEST_GEN_PROGS): ../harness.c ../utils.c
+diff --git a/tools/testing/selftests/powerpc/ptrace/Makefile b/tools/testing/selftests/powerpc/ptrace/Makefile
+index 923d531265f8..9f9423430059 100644
+--- a/tools/testing/selftests/powerpc/ptrace/Makefile
++++ b/tools/testing/selftests/powerpc/ptrace/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
+-TEST_PROGS := ptrace-gpr ptrace-tm-gpr ptrace-tm-spd-gpr \
++TEST_GEN_PROGS := ptrace-gpr ptrace-tm-gpr ptrace-tm-spd-gpr \
+ ptrace-tar ptrace-tm-tar ptrace-tm-spd-tar ptrace-vsx ptrace-tm-vsx \
+ ptrace-tm-spd-vsx ptrace-tm-spr ptrace-hwbreak ptrace-pkey core-pkey \
+ perf-hwbreak
+@@ -7,14 +7,9 @@ TEST_PROGS := ptrace-gpr ptrace-tm-gpr ptrace-tm-spd-gpr \
+ top_srcdir = ../../../../..
+ include ../../lib.mk
+
+-all: $(TEST_PROGS)
+-
+ CFLAGS += -m64 -I../../../../../usr/include -I../tm -mhtm -fno-pie
+
+-ptrace-pkey core-pkey: child.h
+-ptrace-pkey core-pkey: LDLIBS += -pthread
+-
+-$(TEST_PROGS): ../harness.c ../utils.c ../lib/reg.S ptrace.h
++$(OUTPUT)/ptrace-pkey $(OUTPUT)/core-pkey: child.h
++$(OUTPUT)/ptrace-pkey $(OUTPUT)/core-pkey: LDLIBS += -pthread
+
+-clean:
+- rm -f $(TEST_PROGS) *.o
++$(TEST_GEN_PROGS): ../harness.c ../utils.c ../lib/reg.S ptrace.h
+diff --git a/tools/testing/selftests/powerpc/signal/Makefile b/tools/testing/selftests/powerpc/signal/Makefile
+index 1fca25c6ace0..209a958dca12 100644
+--- a/tools/testing/selftests/powerpc/signal/Makefile
++++ b/tools/testing/selftests/powerpc/signal/Makefile
+@@ -1,15 +1,10 @@
+ # SPDX-License-Identifier: GPL-2.0
+-TEST_PROGS := signal signal_tm
+-
+-all: $(TEST_PROGS)
+-
+-$(TEST_PROGS): ../harness.c ../utils.c signal.S
++TEST_GEN_PROGS := signal signal_tm
+
+ CFLAGS += -maltivec
+-signal_tm: CFLAGS += -mhtm
++$(OUTPUT)/signal_tm: CFLAGS += -mhtm
+
+ top_srcdir = ../../../../..
+ include ../../lib.mk
+
+-clean:
+- rm -f $(TEST_PROGS) *.o
++$(TEST_GEN_PROGS): ../harness.c ../utils.c signal.S
+diff --git a/tools/testing/selftests/powerpc/switch_endian/Makefile b/tools/testing/selftests/powerpc/switch_endian/Makefile
+index fcd2dcb8972b..bdc081afedb0 100644
+--- a/tools/testing/selftests/powerpc/switch_endian/Makefile
++++ b/tools/testing/selftests/powerpc/switch_endian/Makefile
+@@ -8,6 +8,7 @@ EXTRA_CLEAN = $(OUTPUT)/*.o $(OUTPUT)/check-reversed.S
+ top_srcdir = ../../../../..
+ include ../../lib.mk
+
++$(OUTPUT)/switch_endian_test: ASFLAGS += -I $(OUTPUT)
+ $(OUTPUT)/switch_endian_test: $(OUTPUT)/check-reversed.S
+
+ $(OUTPUT)/check-reversed.o: $(OUTPUT)/check.o
+diff --git a/tools/testing/selftests/proc/fd-001-lookup.c b/tools/testing/selftests/proc/fd-001-lookup.c
+index a2010dfb2110..60d7948e7124 100644
+--- a/tools/testing/selftests/proc/fd-001-lookup.c
++++ b/tools/testing/selftests/proc/fd-001-lookup.c
+@@ -14,7 +14,7 @@
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+ // Test /proc/*/fd lookup.
+-#define _GNU_SOURCE
++
+ #undef NDEBUG
+ #include <assert.h>
+ #include <dirent.h>
+diff --git a/tools/testing/selftests/proc/fd-003-kthread.c b/tools/testing/selftests/proc/fd-003-kthread.c
+index 1d659d55368c..dc591f97b63d 100644
+--- a/tools/testing/selftests/proc/fd-003-kthread.c
++++ b/tools/testing/selftests/proc/fd-003-kthread.c
+@@ -14,7 +14,7 @@
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+ // Test that /proc/$KERNEL_THREAD/fd/ is empty.
+-#define _GNU_SOURCE
++
+ #undef NDEBUG
+ #include <sys/syscall.h>
+ #include <assert.h>
+diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c
+index 9601bc24454d..17da711f26af 100644
+--- a/tools/testing/selftests/vm/gup_benchmark.c
++++ b/tools/testing/selftests/vm/gup_benchmark.c
+@@ -51,6 +51,7 @@ int main(int argc, char **argv)
+ break;
+ case 'w':
+ write = 1;
++ break;
+ default:
+ return -1;
+ }
+diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
+index 6e290874b70e..f1c6e025cbe5 100644
+--- a/tools/testing/selftests/watchdog/watchdog-test.c
++++ b/tools/testing/selftests/watchdog/watchdog-test.c
+@@ -89,7 +89,13 @@ int main(int argc, char *argv[])
+ fd = open("/dev/watchdog", O_WRONLY);
+
+ if (fd == -1) {
+- printf("Watchdog device not enabled.\n");
++ if (errno == ENOENT)
++ printf("Watchdog device not enabled.\n");
++ else if (errno == EACCES)
++ printf("Run watchdog as root.\n");
++ else
++ printf("Watchdog device open failed %s\n",
++ strerror(errno));
+ exit(-1);
+ }
+
+@@ -103,7 +109,7 @@ int main(int argc, char *argv[])
+ printf("Last boot is caused by: %s.\n", (flags != 0) ?
+ "Watchdog" : "Power-On-Reset");
+ else
+- printf("WDIOC_GETBOOTSTATUS errno '%s'\n", strerror(errno));
++ printf("WDIOC_GETBOOTSTATUS error '%s'\n", strerror(errno));
+ break;
+ case 'd':
+ flags = WDIOS_DISABLECARD;
+@@ -111,7 +117,7 @@ int main(int argc, char *argv[])
+ if (!ret)
+ printf("Watchdog card disabled.\n");
+ else
+- printf("WDIOS_DISABLECARD errno '%s'\n", strerror(errno));
++ printf("WDIOS_DISABLECARD error '%s'\n", strerror(errno));
+ break;
+ case 'e':
+ flags = WDIOS_ENABLECARD;
+@@ -119,7 +125,7 @@ int main(int argc, char *argv[])
+ if (!ret)
+ printf("Watchdog card enabled.\n");
+ else
+- printf("WDIOS_ENABLECARD errno '%s'\n", strerror(errno));
++ printf("WDIOS_ENABLECARD error '%s'\n", strerror(errno));
+ break;
+ case 'p':
+ ping_rate = strtoul(optarg, NULL, 0);
+@@ -133,7 +139,7 @@ int main(int argc, char *argv[])
+ if (!ret)
+ printf("Watchdog timeout set to %u seconds.\n", flags);
+ else
+- printf("WDIOC_SETTIMEOUT errno '%s'\n", strerror(errno));
++ printf("WDIOC_SETTIMEOUT error '%s'\n", strerror(errno));
+ break;
+ default:
+ usage(argv[0]);
+diff --git a/tools/usb/usbip/libsrc/usbip_host_common.c b/tools/usb/usbip/libsrc/usbip_host_common.c
+index dc93fadbee96..b0f7489d069d 100644
+--- a/tools/usb/usbip/libsrc/usbip_host_common.c
++++ b/tools/usb/usbip/libsrc/usbip_host_common.c
+@@ -43,7 +43,7 @@ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
+ int size;
+ int fd;
+ int length;
+- char status;
++ char status[2] = { 0 };
+ int value = 0;
+
+ size = snprintf(status_attr_path, sizeof(status_attr_path),
+@@ -61,15 +61,15 @@ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
+ return -1;
+ }
+
+- length = read(fd, &status, 1);
++ length = read(fd, status, 1);
+ if (length < 0) {
+ err("error reading attribute %s", status_attr_path);
+ close(fd);
+ return -1;
+ }
+
+- value = atoi(&status);
+-
++ value = atoi(status);
++ close(fd);
+ return value;
+ }
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 7a0d86d52230..df3fc0f214ec 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -147,10 +147,30 @@ __weak int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
+ return 0;
+ }
+
++bool kvm_is_zone_device_pfn(kvm_pfn_t pfn)
++{
++ /*
++ * The metadata used by is_zone_device_page() to determine whether or
++ * not a page is ZONE_DEVICE is guaranteed to be valid if and only if
++ * the device has been pinned, e.g. by get_user_pages(). WARN if the
++ * page_count() is zero to help detect bad usage of this helper.
++ */
++ if (!pfn_valid(pfn) || WARN_ON_ONCE(!page_count(pfn_to_page(pfn))))
++ return false;
++
++ return is_zone_device_page(pfn_to_page(pfn));
++}
++
+ bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
+ {
++ /*
++ * ZONE_DEVICE pages currently set PG_reserved, but from a refcounting
++ * perspective they are "normal" pages, albeit with slightly different
++ * usage rules.
++ */
+ if (pfn_valid(pfn))
+- return PageReserved(pfn_to_page(pfn));
++ return PageReserved(pfn_to_page(pfn)) &&
++ !kvm_is_zone_device_pfn(pfn);
+
+ return true;
+ }
+@@ -1727,7 +1747,7 @@ EXPORT_SYMBOL_GPL(kvm_release_pfn_dirty);
+
+ void kvm_set_pfn_dirty(kvm_pfn_t pfn)
+ {
+- if (!kvm_is_reserved_pfn(pfn)) {
++ if (!kvm_is_reserved_pfn(pfn) && !kvm_is_zone_device_pfn(pfn)) {
+ struct page *page = pfn_to_page(pfn);
+
+ if (!PageReserved(page))
+@@ -1738,7 +1758,7 @@ EXPORT_SYMBOL_GPL(kvm_set_pfn_dirty);
+
+ void kvm_set_pfn_accessed(kvm_pfn_t pfn)
+ {
+- if (!kvm_is_reserved_pfn(pfn))
++ if (!kvm_is_reserved_pfn(pfn) && !kvm_is_zone_device_pfn(pfn))
+ mark_page_accessed(pfn_to_page(pfn));
+ }
+ EXPORT_SYMBOL_GPL(kvm_set_pfn_accessed);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-12-05 12:03 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2019-12-05 12:03 UTC (permalink / raw
To: gentoo-commits
commit: ebb766182011641851104e6bf4dd7c1bc6639034
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Thu Dec 5 09:55:18 2019 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Thu Dec 5 12:03:05 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ebb76618
Linux patch 4.19.88
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 8 +
1087_linux-4.19.88.patch | 10961 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 10969 insertions(+)
diff --git a/0000_README b/0000_README
index 89fef48..a04c9e9 100644
--- a/0000_README
+++ b/0000_README
@@ -383,6 +383,14 @@ Patch: 1085_linux-4.19.86.patch
From: https://www.kernel.org
Desc: Linux 4.19.86
+Patch: 1086_linux-4.19.87.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.87
+
+Patch: 1087_linux-4.19.88.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.88
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1087_linux-4.19.88.patch b/1087_linux-4.19.88.patch
new file mode 100644
index 0000000..b5d6c80
--- /dev/null
+++ b/1087_linux-4.19.88.patch
@@ -0,0 +1,10961 @@
+diff --git a/Documentation/hid/uhid.txt b/Documentation/hid/uhid.txt
+index c8656dd029a9..958fff945304 100644
+--- a/Documentation/hid/uhid.txt
++++ b/Documentation/hid/uhid.txt
+@@ -160,7 +160,7 @@ them but you should handle them according to your needs.
+ UHID_OUTPUT:
+ This is sent if the HID device driver wants to send raw data to the I/O
+ device on the interrupt channel. You should read the payload and forward it to
+- the device. The payload is of type "struct uhid_data_req".
++ the device. The payload is of type "struct uhid_output_req".
+ This may be received even though you haven't received UHID_OPEN, yet.
+
+ UHID_GET_REPORT:
+diff --git a/Makefile b/Makefile
+index 9240f36099de..f9ebb74e8e43 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 87
++SUBLEVEL = 88
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index f6fcb8a79889..f95a90dfc282 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -1432,21 +1432,21 @@ config DEBUG_OMAP2PLUS_UART
+ depends on ARCH_OMAP2PLUS
+
+ config DEBUG_IMX_UART_PORT
+- int "i.MX Debug UART Port Selection" if DEBUG_IMX1_UART || \
+- DEBUG_IMX25_UART || \
+- DEBUG_IMX21_IMX27_UART || \
+- DEBUG_IMX31_UART || \
+- DEBUG_IMX35_UART || \
+- DEBUG_IMX50_UART || \
+- DEBUG_IMX51_UART || \
+- DEBUG_IMX53_UART || \
+- DEBUG_IMX6Q_UART || \
+- DEBUG_IMX6SL_UART || \
+- DEBUG_IMX6SX_UART || \
+- DEBUG_IMX6UL_UART || \
+- DEBUG_IMX7D_UART
++ int "i.MX Debug UART Port Selection"
++ depends on DEBUG_IMX1_UART || \
++ DEBUG_IMX25_UART || \
++ DEBUG_IMX21_IMX27_UART || \
++ DEBUG_IMX31_UART || \
++ DEBUG_IMX35_UART || \
++ DEBUG_IMX50_UART || \
++ DEBUG_IMX51_UART || \
++ DEBUG_IMX53_UART || \
++ DEBUG_IMX6Q_UART || \
++ DEBUG_IMX6SL_UART || \
++ DEBUG_IMX6SX_UART || \
++ DEBUG_IMX6UL_UART || \
++ DEBUG_IMX7D_UART
+ default 1
+- depends on ARCH_MXC
+ help
+ Choose UART port on which kernel low-level debug messages
+ should be output.
+diff --git a/arch/arm/boot/dts/gemini-sq201.dts b/arch/arm/boot/dts/gemini-sq201.dts
+index 3787cf3763c4..e9e4a8a02600 100644
+--- a/arch/arm/boot/dts/gemini-sq201.dts
++++ b/arch/arm/boot/dts/gemini-sq201.dts
+@@ -20,7 +20,7 @@
+ };
+
+ chosen {
+- bootargs = "console=ttyS0,115200n8";
++ bootargs = "console=ttyS0,115200n8 root=/dev/mtdblock2 rw rootfstype=squashfs,jffs2 rootwait";
+ stdout-path = &uart0;
+ };
+
+@@ -138,37 +138,10 @@
+ /* 16MB of flash */
+ reg = <0x30000000 0x01000000>;
+
+- partition@0 {
+- label = "RedBoot";
+- reg = <0x00000000 0x00120000>;
+- read-only;
+- };
+- partition@120000 {
+- label = "Kernel";
+- reg = <0x00120000 0x00200000>;
+- };
+- partition@320000 {
+- label = "Ramdisk";
+- reg = <0x00320000 0x00600000>;
+- };
+- partition@920000 {
+- label = "Application";
+- reg = <0x00920000 0x00600000>;
+- };
+- partition@f20000 {
+- label = "VCTL";
+- reg = <0x00f20000 0x00020000>;
+- read-only;
+- };
+- partition@f40000 {
+- label = "CurConf";
+- reg = <0x00f40000 0x000a0000>;
+- read-only;
+- };
+- partition@fe0000 {
+- label = "FIS directory";
+- reg = <0x00fe0000 0x00020000>;
+- read-only;
++ partitions {
++ compatible = "redboot-fis";
++ /* Eraseblock at 0xfe0000 */
++ fis-index-block = <0x1fc>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/imx1-ads.dts b/arch/arm/boot/dts/imx1-ads.dts
+index a1d81badb5c8..119b19ba53b6 100644
+--- a/arch/arm/boot/dts/imx1-ads.dts
++++ b/arch/arm/boot/dts/imx1-ads.dts
+@@ -21,6 +21,7 @@
+ };
+
+ memory@8000000 {
++ device_type = "memory";
+ reg = <0x08000000 0x04000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx1-apf9328.dts b/arch/arm/boot/dts/imx1-apf9328.dts
+index 11515c0cb195..ee4b1b106b1a 100644
+--- a/arch/arm/boot/dts/imx1-apf9328.dts
++++ b/arch/arm/boot/dts/imx1-apf9328.dts
+@@ -21,6 +21,7 @@
+ };
+
+ memory@8000000 {
++ device_type = "memory";
+ reg = <0x08000000 0x00800000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx1.dtsi b/arch/arm/boot/dts/imx1.dtsi
+index 3edc7b5550d8..2b6e77029de4 100644
+--- a/arch/arm/boot/dts/imx1.dtsi
++++ b/arch/arm/boot/dts/imx1.dtsi
+@@ -15,10 +15,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ gpio0 = &gpio1;
+diff --git a/arch/arm/boot/dts/imx23-evk.dts b/arch/arm/boot/dts/imx23-evk.dts
+index ad2ae25b7b4d..aca27aa2d44b 100644
+--- a/arch/arm/boot/dts/imx23-evk.dts
++++ b/arch/arm/boot/dts/imx23-evk.dts
+@@ -10,6 +10,7 @@
+ compatible = "fsl,imx23-evk", "fsl,imx23";
+
+ memory@40000000 {
++ device_type = "memory";
+ reg = <0x40000000 0x08000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx23-olinuxino.dts b/arch/arm/boot/dts/imx23-olinuxino.dts
+index e9351774c619..109f51603d45 100644
+--- a/arch/arm/boot/dts/imx23-olinuxino.dts
++++ b/arch/arm/boot/dts/imx23-olinuxino.dts
+@@ -20,6 +20,7 @@
+ compatible = "olimex,imx23-olinuxino", "fsl,imx23";
+
+ memory@40000000 {
++ device_type = "memory";
+ reg = <0x40000000 0x04000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx23-sansa.dts b/arch/arm/boot/dts/imx23-sansa.dts
+index 67de7863ad79..fa22fd9b2412 100644
+--- a/arch/arm/boot/dts/imx23-sansa.dts
++++ b/arch/arm/boot/dts/imx23-sansa.dts
+@@ -50,6 +50,7 @@
+ compatible = "sandisk,sansa_fuze_plus", "fsl,imx23";
+
+ memory@40000000 {
++ device_type = "memory";
+ reg = <0x40000000 0x04000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx23-stmp378x_devb.dts b/arch/arm/boot/dts/imx23-stmp378x_devb.dts
+index 95c7b918f6d6..aab029349420 100644
+--- a/arch/arm/boot/dts/imx23-stmp378x_devb.dts
++++ b/arch/arm/boot/dts/imx23-stmp378x_devb.dts
+@@ -17,6 +17,7 @@
+ compatible = "fsl,stmp378x-devb", "fsl,imx23";
+
+ memory@40000000 {
++ device_type = "memory";
+ reg = <0x40000000 0x04000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx23-xfi3.dts b/arch/arm/boot/dts/imx23-xfi3.dts
+index 9616e500b996..2b5df8dfd3ff 100644
+--- a/arch/arm/boot/dts/imx23-xfi3.dts
++++ b/arch/arm/boot/dts/imx23-xfi3.dts
+@@ -49,6 +49,7 @@
+ compatible = "creative,x-fi3", "fsl,imx23";
+
+ memory@40000000 {
++ device_type = "memory";
+ reg = <0x40000000 0x04000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
+index 71bfd2b15609..aaaa987d8eff 100644
+--- a/arch/arm/boot/dts/imx23.dtsi
++++ b/arch/arm/boot/dts/imx23.dtsi
+@@ -13,10 +13,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ gpio0 = &gpio0;
+diff --git a/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi b/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
+index e316fe08837a..e4d7da267532 100644
+--- a/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
++++ b/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
+@@ -18,6 +18,7 @@
+ compatible = "eukrea,cpuimx25", "fsl,imx25";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x4000000>; /* 64M */
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx25-karo-tx25.dts b/arch/arm/boot/dts/imx25-karo-tx25.dts
+index 5cb6967866c0..f37e9a75a3ca 100644
+--- a/arch/arm/boot/dts/imx25-karo-tx25.dts
++++ b/arch/arm/boot/dts/imx25-karo-tx25.dts
+@@ -37,6 +37,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x02000000 0x90000000 0x02000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx25-pdk.dts b/arch/arm/boot/dts/imx25-pdk.dts
+index a5626b46ac4e..f8544a9e4633 100644
+--- a/arch/arm/boot/dts/imx25-pdk.dts
++++ b/arch/arm/boot/dts/imx25-pdk.dts
+@@ -12,6 +12,7 @@
+ compatible = "fsl,imx25-pdk", "fsl,imx25";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x4000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
+index 85c15ee63272..8c8ad80de461 100644
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -12,10 +12,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+diff --git a/arch/arm/boot/dts/imx27-apf27.dts b/arch/arm/boot/dts/imx27-apf27.dts
+index 3eddd805a793..f635d5c5029c 100644
+--- a/arch/arm/boot/dts/imx27-apf27.dts
++++ b/arch/arm/boot/dts/imx27-apf27.dts
+@@ -20,6 +20,7 @@
+ compatible = "armadeus,imx27-apf27", "fsl,imx27";
+
+ memory@a0000000 {
++ device_type = "memory";
+ reg = <0xa0000000 0x04000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
+index 9c455dcbe6eb..c85f9d01768a 100644
+--- a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
++++ b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
+@@ -17,6 +17,7 @@
+ compatible = "eukrea,cpuimx27", "fsl,imx27";
+
+ memory@a0000000 {
++ device_type = "memory";
+ reg = <0xa0000000 0x04000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx27-pdk.dts b/arch/arm/boot/dts/imx27-pdk.dts
+index f9a882d99132..35123b7cb6b3 100644
+--- a/arch/arm/boot/dts/imx27-pdk.dts
++++ b/arch/arm/boot/dts/imx27-pdk.dts
+@@ -10,6 +10,7 @@
+ compatible = "fsl,imx27-pdk", "fsl,imx27";
+
+ memory@a0000000 {
++ device_type = "memory";
+ reg = <0xa0000000 0x08000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi b/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi
+index cbad7c88c58c..b0b4f7c00246 100644
+--- a/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi
++++ b/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi
+@@ -18,6 +18,7 @@
+ compatible = "phytec,imx27-pca100", "fsl,imx27";
+
+ memory@a0000000 {
++ device_type = "memory";
+ reg = <0xa0000000 0x08000000>; /* 128MB */
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi b/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
+index ec466b4bfd41..0935e1400e5d 100644
+--- a/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
++++ b/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
+@@ -17,6 +17,7 @@
+ compatible = "phytec,imx27-pcm038", "fsl,imx27";
+
+ memory@a0000000 {
++ device_type = "memory";
+ reg = <0xa0000000 0x08000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
+index 753d88df1627..39e75b997bdc 100644
+--- a/arch/arm/boot/dts/imx27.dtsi
++++ b/arch/arm/boot/dts/imx27.dtsi
+@@ -16,10 +16,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+diff --git a/arch/arm/boot/dts/imx31-bug.dts b/arch/arm/boot/dts/imx31-bug.dts
+index 6ee4ff8e4e8f..9eb960cc02cc 100644
+--- a/arch/arm/boot/dts/imx31-bug.dts
++++ b/arch/arm/boot/dts/imx31-bug.dts
+@@ -17,6 +17,7 @@
+ compatible = "buglabs,imx31-bug", "fsl,imx31";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x8000000>; /* 128M */
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx31-lite.dts b/arch/arm/boot/dts/imx31-lite.dts
+index db52ddccabc3..d17abdfb6330 100644
+--- a/arch/arm/boot/dts/imx31-lite.dts
++++ b/arch/arm/boot/dts/imx31-lite.dts
+@@ -18,6 +18,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x8000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx31.dtsi b/arch/arm/boot/dts/imx31.dtsi
+index ca1419ca303c..2fc64d2c7c88 100644
+--- a/arch/arm/boot/dts/imx31.dtsi
++++ b/arch/arm/boot/dts/imx31.dtsi
+@@ -10,10 +10,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ gpio0 = &gpio1;
+diff --git a/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi b/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi
+index ba39d938f289..5f8a47a9fcd4 100644
+--- a/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi
++++ b/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi
+@@ -18,6 +18,7 @@
+ compatible = "eukrea,cpuimx35", "fsl,imx35";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x8000000>; /* 128M */
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx35-pdk.dts b/arch/arm/boot/dts/imx35-pdk.dts
+index df613e88fd2c..ddce0a844758 100644
+--- a/arch/arm/boot/dts/imx35-pdk.dts
++++ b/arch/arm/boot/dts/imx35-pdk.dts
+@@ -11,6 +11,7 @@
+ compatible = "fsl,imx35-pdk", "fsl,imx35";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x8000000>,
+ <0x90000000 0x8000000>;
+ };
+diff --git a/arch/arm/boot/dts/imx35.dtsi b/arch/arm/boot/dts/imx35.dtsi
+index 1c50b785cad4..b36b97b655dd 100644
+--- a/arch/arm/boot/dts/imx35.dtsi
++++ b/arch/arm/boot/dts/imx35.dtsi
+@@ -13,10 +13,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts
+index 682a99783ee6..a25da415cb02 100644
+--- a/arch/arm/boot/dts/imx50-evk.dts
++++ b/arch/arm/boot/dts/imx50-evk.dts
+@@ -12,6 +12,7 @@
+ compatible = "fsl,imx50-evk", "fsl,imx50";
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x80000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx50.dtsi b/arch/arm/boot/dts/imx50.dtsi
+index ab522c2da6df..9e9e92acceb2 100644
+--- a/arch/arm/boot/dts/imx50.dtsi
++++ b/arch/arm/boot/dts/imx50.dtsi
+@@ -22,10 +22,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+diff --git a/arch/arm/boot/dts/imx51-apf51.dts b/arch/arm/boot/dts/imx51-apf51.dts
+index 79d80036f74d..1eddf2908b3f 100644
+--- a/arch/arm/boot/dts/imx51-apf51.dts
++++ b/arch/arm/boot/dts/imx51-apf51.dts
+@@ -22,6 +22,7 @@
+ compatible = "armadeus,imx51-apf51", "fsl,imx51";
+
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51-babbage.dts b/arch/arm/boot/dts/imx51-babbage.dts
+index ba60b0cb3cc1..99191466a808 100644
+--- a/arch/arm/boot/dts/imx51-babbage.dts
++++ b/arch/arm/boot/dts/imx51-babbage.dts
+@@ -15,6 +15,7 @@
+ };
+
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi b/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi
+index 5761a66e8a0d..82d8df097ef1 100644
+--- a/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi
++++ b/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi
+@@ -17,6 +17,7 @@
+ compatible = "digi,connectcore-ccxmx51-som", "fsl,imx51";
+
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0x08000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi b/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi
+index f8902a338e49..2e3125391bc4 100644
+--- a/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi
++++ b/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi
+@@ -23,6 +23,7 @@
+ compatible = "eukrea,cpuimx51", "fsl,imx51";
+
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0x10000000>; /* 256M */
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx51-ts4800.dts b/arch/arm/boot/dts/imx51-ts4800.dts
+index 39eb067904c3..4344632f7940 100644
+--- a/arch/arm/boot/dts/imx51-ts4800.dts
++++ b/arch/arm/boot/dts/imx51-ts4800.dts
+@@ -18,6 +18,7 @@
+ };
+
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0x10000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51-zii-rdu1.dts b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+index 3fb66ddfe93a..9235fd45a824 100644
+--- a/arch/arm/boot/dts/imx51-zii-rdu1.dts
++++ b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+@@ -53,6 +53,7 @@
+
+ /* Will be filled by the bootloader */
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts b/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts
+index 26cf08549df4..f5b2d768fe47 100644
+--- a/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts
++++ b/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts
+@@ -18,6 +18,7 @@
+
+ /* Will be filled by the bootloader */
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51-zii-scu3-esb.dts b/arch/arm/boot/dts/imx51-zii-scu3-esb.dts
+index e6ebac8f43e4..ad90d66ccca6 100644
+--- a/arch/arm/boot/dts/imx51-zii-scu3-esb.dts
++++ b/arch/arm/boot/dts/imx51-zii-scu3-esb.dts
+@@ -18,6 +18,7 @@
+
+ /* Will be filled by the bootloader */
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51.dtsi b/arch/arm/boot/dts/imx51.dtsi
+index ef2abc097843..81f60c96a2e4 100644
+--- a/arch/arm/boot/dts/imx51.dtsi
++++ b/arch/arm/boot/dts/imx51.dtsi
+@@ -16,10 +16,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+diff --git a/arch/arm/boot/dts/imx53-ard.dts b/arch/arm/boot/dts/imx53-ard.dts
+index 117bd002dd1d..7d5a48250f86 100644
+--- a/arch/arm/boot/dts/imx53-ard.dts
++++ b/arch/arm/boot/dts/imx53-ard.dts
+@@ -19,6 +19,7 @@
+ compatible = "fsl,imx53-ard", "fsl,imx53";
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-cx9020.dts b/arch/arm/boot/dts/imx53-cx9020.dts
+index cf70ebc4399a..c875e23ee45f 100644
+--- a/arch/arm/boot/dts/imx53-cx9020.dts
++++ b/arch/arm/boot/dts/imx53-cx9020.dts
+@@ -22,6 +22,7 @@
+ };
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x20000000>,
+ <0xb0000000 0x20000000>;
+ };
+diff --git a/arch/arm/boot/dts/imx53-m53.dtsi b/arch/arm/boot/dts/imx53-m53.dtsi
+index ce45f08e3051..db2e5bce9b6a 100644
+--- a/arch/arm/boot/dts/imx53-m53.dtsi
++++ b/arch/arm/boot/dts/imx53-m53.dtsi
+@@ -16,6 +16,7 @@
+ compatible = "aries,imx53-m53", "denx,imx53-m53", "fsl,imx53";
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x20000000>,
+ <0xb0000000 0x20000000>;
+ };
+diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi b/arch/arm/boot/dts/imx53-qsb-common.dtsi
+index 50dde84b72ed..f00dda334976 100644
+--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
++++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
+@@ -11,6 +11,7 @@
+ };
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x20000000>,
+ <0xb0000000 0x20000000>;
+ };
+diff --git a/arch/arm/boot/dts/imx53-smd.dts b/arch/arm/boot/dts/imx53-smd.dts
+index 462071c9ddd7..09071ca11c6c 100644
+--- a/arch/arm/boot/dts/imx53-smd.dts
++++ b/arch/arm/boot/dts/imx53-smd.dts
+@@ -12,6 +12,7 @@
+ compatible = "fsl,imx53-smd", "fsl,imx53";
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-tqma53.dtsi b/arch/arm/boot/dts/imx53-tqma53.dtsi
+index a72b8981fc3b..c77d58f06c94 100644
+--- a/arch/arm/boot/dts/imx53-tqma53.dtsi
++++ b/arch/arm/boot/dts/imx53-tqma53.dtsi
+@@ -17,6 +17,7 @@
+ compatible = "tq,tqma53", "fsl,imx53";
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x40000000>; /* Up to 1GiB */
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-tx53.dtsi b/arch/arm/boot/dts/imx53-tx53.dtsi
+index 54cf3e67069a..4ab135906949 100644
+--- a/arch/arm/boot/dts/imx53-tx53.dtsi
++++ b/arch/arm/boot/dts/imx53-tx53.dtsi
+@@ -51,6 +51,7 @@
+
+ /* Will be filled by the bootloader */
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-usbarmory.dts b/arch/arm/boot/dts/imx53-usbarmory.dts
+index f6268d0ded29..ee6263d1c2d3 100644
+--- a/arch/arm/boot/dts/imx53-usbarmory.dts
++++ b/arch/arm/boot/dts/imx53-usbarmory.dts
+@@ -58,6 +58,7 @@
+ };
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+index f83a8c62ea53..d595034f3f1b 100644
+--- a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
++++ b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+@@ -17,12 +17,8 @@
+
+ memory@70000000 {
+ device_type = "memory";
+- reg = <0x70000000 0x20000000>;
+- };
+-
+- memory@b0000000 {
+- device_type = "memory";
+- reg = <0xb0000000 0x20000000>;
++ reg = <0x70000000 0x20000000>,
++ <0xb0000000 0x20000000>;
+ };
+
+ regulators {
+diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
+index b6b0818343c4..8accbe16b758 100644
+--- a/arch/arm/boot/dts/imx53.dtsi
++++ b/arch/arm/boot/dts/imx53.dtsi
+@@ -23,10 +23,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+index 9f11f1fcc3e6..9d086a3b5ffc 100644
+--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+@@ -177,6 +177,8 @@
+ accelerometer@1c {
+ compatible = "fsl,mma8451";
+ reg = <0x1c>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_mma8451_int>;
+ interrupt-parent = <&gpio6>;
+ interrupts = <31 IRQ_TYPE_LEVEL_LOW>;
+ };
+@@ -522,6 +524,12 @@
+ >;
+ };
+
++ pinctrl_mma8451_int: mma8451intgrp {
++ fsl,pins = <
++ MX6QDL_PAD_EIM_BCLK__GPIO6_IO31 0xb0b1
++ >;
++ };
++
+ pinctrl_pwm3: pwm1grp {
+ fsl,pins = <
+ MX6QDL_PAD_SD4_DAT1__PWM3_OUT 0x1b0b1
+diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
+index 679b4482ab13..f7a48e4622e1 100644
+--- a/arch/arm/boot/dts/imx6sl-evk.dts
++++ b/arch/arm/boot/dts/imx6sl-evk.dts
+@@ -17,6 +17,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sl-warp.dts b/arch/arm/boot/dts/imx6sl-warp.dts
+index 404e602e6781..408da704c459 100644
+--- a/arch/arm/boot/dts/imx6sl-warp.dts
++++ b/arch/arm/boot/dts/imx6sl-warp.dts
+@@ -55,6 +55,7 @@
+ compatible = "warp,imx6sl-warp", "fsl,imx6sl";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
+index 2fa88c6f1882..55d1872aa81a 100644
+--- a/arch/arm/boot/dts/imx6sl.dtsi
++++ b/arch/arm/boot/dts/imx6sl.dtsi
+@@ -13,10 +13,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+diff --git a/arch/arm/boot/dts/imx6sll-evk.dts b/arch/arm/boot/dts/imx6sll-evk.dts
+index c8e115564ba2..0c2406ac8a63 100644
+--- a/arch/arm/boot/dts/imx6sll-evk.dts
++++ b/arch/arm/boot/dts/imx6sll-evk.dts
+@@ -20,6 +20,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x80000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts b/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts
+index adb5cc7d8ce2..832b5c5d7441 100644
+--- a/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts
++++ b/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts
+@@ -12,6 +12,7 @@
+ compatible = "boundary,imx6sx-nitrogen6sx", "fsl,imx6sx";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+index 841a27f3198f..48aede543612 100644
+--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
++++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+@@ -11,6 +11,7 @@
+ compatible = "fsl,imx6sx-sabreauto", "fsl,imx6sx";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x80000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sx-sdb.dtsi b/arch/arm/boot/dts/imx6sx-sdb.dtsi
+index d6d517e4922f..91f809ed1370 100644
+--- a/arch/arm/boot/dts/imx6sx-sdb.dtsi
++++ b/arch/arm/boot/dts/imx6sx-sdb.dtsi
+@@ -21,6 +21,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts b/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts
+index 252175b59247..2bc51623a806 100644
+--- a/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts
++++ b/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts
+@@ -21,6 +21,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts b/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts
+index 40ccdf43dffc..db0feb9b9f5d 100644
+--- a/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts
++++ b/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts
+@@ -49,6 +49,7 @@
+ compatible = "udoo,neobasic", "fsl,imx6sx";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts b/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts
+index 42bfc8f8f7f6..5c7a2bb9141c 100644
+--- a/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts
++++ b/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts
+@@ -49,6 +49,7 @@
+ compatible = "udoo,neoextended", "fsl,imx6sx";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts b/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts
+index c84c877f09d4..13dfe2afaba5 100644
+--- a/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts
++++ b/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts
+@@ -49,6 +49,7 @@
+ compatible = "udoo,neofull", "fsl,imx6sx";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
+index 7b62e6fb47eb..ae0728df542e 100644
+--- a/arch/arm/boot/dts/imx6sx.dtsi
++++ b/arch/arm/boot/dts/imx6sx.dtsi
+@@ -15,10 +15,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ can0 = &flexcan1;
+diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
+index 32a07232c034..818021126559 100644
+--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
++++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
+@@ -12,6 +12,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul-geam.dts b/arch/arm/boot/dts/imx6ul-geam.dts
+index d81d20f8fc8d..85cfad080f15 100644
+--- a/arch/arm/boot/dts/imx6ul-geam.dts
++++ b/arch/arm/boot/dts/imx6ul-geam.dts
+@@ -51,6 +51,7 @@
+ compatible = "engicam,imx6ul-geam", "fsl,imx6ul";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x08000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul-isiot.dtsi b/arch/arm/boot/dts/imx6ul-isiot.dtsi
+index cd9928551154..1cb52744f58a 100644
+--- a/arch/arm/boot/dts/imx6ul-isiot.dtsi
++++ b/arch/arm/boot/dts/imx6ul-isiot.dtsi
+@@ -46,6 +46,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul-litesom.dtsi b/arch/arm/boot/dts/imx6ul-litesom.dtsi
+index 8f775f6974d1..8d6893210842 100644
+--- a/arch/arm/boot/dts/imx6ul-litesom.dtsi
++++ b/arch/arm/boot/dts/imx6ul-litesom.dtsi
+@@ -48,6 +48,7 @@
+ compatible = "grinn,imx6ul-litesom", "fsl,imx6ul";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6ul-opos6ul.dtsi b/arch/arm/boot/dts/imx6ul-opos6ul.dtsi
+index a031bee311df..cf7faf4b9c47 100644
+--- a/arch/arm/boot/dts/imx6ul-opos6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul-opos6ul.dtsi
+@@ -49,6 +49,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0>; /* will be filled by U-Boot */
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul-pico-hobbit.dts b/arch/arm/boot/dts/imx6ul-pico-hobbit.dts
+index 0c09420f9951..797262d2f27f 100644
+--- a/arch/arm/boot/dts/imx6ul-pico-hobbit.dts
++++ b/arch/arm/boot/dts/imx6ul-pico-hobbit.dts
+@@ -53,6 +53,7 @@
+
+ /* Will be filled by the bootloader */
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul-tx6ul.dtsi b/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
+index 02b5ba42cd59..bb6dbfd5546b 100644
+--- a/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
+@@ -71,6 +71,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0>; /* will be filled by U-Boot */
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
+index 336cdead3da5..50834a43e5fb 100644
+--- a/arch/arm/boot/dts/imx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul.dtsi
+@@ -15,10 +15,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec1;
+diff --git a/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi b/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi
+index 10ab4697950f..fb213bec4654 100644
+--- a/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi
++++ b/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi
+@@ -7,6 +7,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x10000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
+index 183193e8580d..038d8c90f6df 100644
+--- a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
++++ b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
+@@ -7,6 +7,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
+index 584418f517a8..62d5e9a4a781 100644
+--- a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
++++ b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
+@@ -19,6 +19,7 @@
+ compatible = "compulab,cl-som-imx7", "fsl,imx7d";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x10000000>; /* 256 MB - minimal configuration */
+ };
+
+@@ -284,4 +285,4 @@
+ MX7D_PAD_LPSR_GPIO1_IO05__GPIO1_IO5 0x14 /* OTG PWREN */
+ >;
+ };
+-};
+\ No newline at end of file
++};
+diff --git a/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi b/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi
+index 04d24ee17b14..898f4b8d7421 100644
+--- a/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi
++++ b/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi
+@@ -8,6 +8,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx7d-colibri.dtsi b/arch/arm/boot/dts/imx7d-colibri.dtsi
+index d9f8fb69511b..e2e327f437e3 100644
+--- a/arch/arm/boot/dts/imx7d-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7d-colibri.dtsi
+@@ -45,6 +45,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx7d-nitrogen7.dts b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+index 177d21fdeb28..6b4acea1ef79 100644
+--- a/arch/arm/boot/dts/imx7d-nitrogen7.dts
++++ b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+@@ -12,6 +12,7 @@
+ compatible = "boundary,imx7d-nitrogen7", "fsl,imx7d";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx7d-pico.dtsi b/arch/arm/boot/dts/imx7d-pico.dtsi
+index f27b3849d3ff..934a019f341e 100644
+--- a/arch/arm/boot/dts/imx7d-pico.dtsi
++++ b/arch/arm/boot/dts/imx7d-pico.dtsi
+@@ -49,6 +49,7 @@
+ compatible = "technexion,imx7d-pico", "fsl,imx7d";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x80000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
+index c9b3c60b0eb2..317f1bcc56e2 100644
+--- a/arch/arm/boot/dts/imx7d-sdb.dts
++++ b/arch/arm/boot/dts/imx7d-sdb.dts
+@@ -15,6 +15,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x80000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx7s-colibri.dtsi b/arch/arm/boot/dts/imx7s-colibri.dtsi
+index fe8344cee864..1fb1ec5d3d70 100644
+--- a/arch/arm/boot/dts/imx7s-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7s-colibri.dtsi
+@@ -45,6 +45,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x10000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx7s-warp.dts b/arch/arm/boot/dts/imx7s-warp.dts
+index fa390da636de..97d5c711eb0c 100644
+--- a/arch/arm/boot/dts/imx7s-warp.dts
++++ b/arch/arm/boot/dts/imx7s-warp.dts
+@@ -51,6 +51,7 @@
+ compatible = "warp,imx7s-warp", "fsl,imx7s";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index 90f5bdfa9b3c..7eaf96b425be 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -17,10 +17,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ gpio0 = &gpio1;
+diff --git a/arch/arm/boot/dts/omap4-l4.dtsi b/arch/arm/boot/dts/omap4-l4.dtsi
+index 6eb26b837446..5059ecac4478 100644
+--- a/arch/arm/boot/dts/omap4-l4.dtsi
++++ b/arch/arm/boot/dts/omap4-l4.dtsi
+@@ -196,12 +196,12 @@
+ clock-names = "fck";
+ #address-cells = <1>;
+ #size-cells = <1>;
+- ranges = <0x0 0x58000 0x4000>;
++ ranges = <0x0 0x58000 0x5000>;
+
+ hsi: hsi@0 {
+ compatible = "ti,omap4-hsi";
+ reg = <0x0 0x4000>,
+- <0x4a05c000 0x1000>;
++ <0x5000 0x1000>;
+ reg-names = "sys", "gdd";
+
+ clocks = <&l3_init_clkctrl OMAP4_HSI_CLKCTRL 0>;
+diff --git a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+index 1537ce148cc1..49547a43cc90 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+@@ -171,6 +171,7 @@
+ vqmmc-supply = <®_dldo1>;
+ non-removable;
+ wakeup-source;
++ keep-power-in-suspend;
+ status = "okay";
+
+ brcmf: wifi@1 {
+diff --git a/arch/arm/mach-ks8695/board-acs5k.c b/arch/arm/mach-ks8695/board-acs5k.c
+index ef835d82cdb9..5783062224c3 100644
+--- a/arch/arm/mach-ks8695/board-acs5k.c
++++ b/arch/arm/mach-ks8695/board-acs5k.c
+@@ -100,7 +100,7 @@ static struct i2c_board_info acs5k_i2c_devs[] __initdata = {
+ },
+ };
+
+-static void acs5k_i2c_init(void)
++static void __init acs5k_i2c_init(void)
+ {
+ /* The gpio interface */
+ gpiod_add_lookup_table(&acs5k_i2c_gpiod_table);
+diff --git a/arch/arm/mach-omap1/Makefile b/arch/arm/mach-omap1/Makefile
+index e8ccf51c6f29..ec0235899de2 100644
+--- a/arch/arm/mach-omap1/Makefile
++++ b/arch/arm/mach-omap1/Makefile
+@@ -25,7 +25,7 @@ obj-y += $(i2c-omap-m) $(i2c-omap-y)
+
+ led-y := leds.o
+
+-usb-fs-$(CONFIG_USB) := usb.o
++usb-fs-$(CONFIG_USB_SUPPORT) := usb.o
+ obj-y += $(usb-fs-m) $(usb-fs-y)
+
+ # Specific board support
+diff --git a/arch/arm/mach-omap1/include/mach/usb.h b/arch/arm/mach-omap1/include/mach/usb.h
+index 77867778d4ec..5429d86c7190 100644
+--- a/arch/arm/mach-omap1/include/mach/usb.h
++++ b/arch/arm/mach-omap1/include/mach/usb.h
+@@ -11,7 +11,7 @@
+
+ #include <linux/platform_data/usb-omap1.h>
+
+-#if IS_ENABLED(CONFIG_USB)
++#if IS_ENABLED(CONFIG_USB_SUPPORT)
+ void omap1_usb_init(struct omap_usb_config *pdata);
+ #else
+ static inline void omap1_usb_init(struct omap_usb_config *pdata)
+diff --git a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
+index a8e8f2669d4c..1b8f19ee257f 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
+@@ -188,7 +188,7 @@
+ compatible = "adi,adv7180cp";
+ reg = <0x20>;
+
+- port {
++ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
+index 5a97ac853168..0c100506a29a 100644
+--- a/arch/arm64/include/asm/assembler.h
++++ b/arch/arm64/include/asm/assembler.h
+@@ -683,11 +683,9 @@ USER(\label, ic ivau, \tmp2) // invalidate I line PoU
+ .macro if_will_cond_yield_neon
+ #ifdef CONFIG_PREEMPT
+ get_thread_info x0
+- ldr w1, [x0, #TSK_TI_PREEMPT]
+- ldr x0, [x0, #TSK_TI_FLAGS]
+- cmp w1, #PREEMPT_DISABLE_OFFSET
+- csel x0, x0, xzr, eq
+- tbnz x0, #TIF_NEED_RESCHED, .Lyield_\@ // needs rescheduling?
++ ldr x0, [x0, #TSK_TI_PREEMPT]
++ sub x0, x0, #PREEMPT_DISABLE_OFFSET
++ cbz x0, .Lyield_\@
+ /* fall through to endif_yield_neon */
+ .subsection 1
+ .Lyield_\@ :
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 5f800384cb9a..bb6832353045 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -622,10 +622,8 @@ el1_irq:
+ irq_handler
+
+ #ifdef CONFIG_PREEMPT
+- ldr w24, [tsk, #TSK_TI_PREEMPT] // get preempt count
+- cbnz w24, 1f // preempt count != 0
+- ldr x0, [tsk, #TSK_TI_FLAGS] // get flags
+- tbz x0, #TIF_NEED_RESCHED, 1f // needs rescheduling?
++ ldr x24, [tsk, #TSK_TI_PREEMPT] // get preempt count
++ cbnz x24, 1f // preempt count != 0
+ bl el1_preempt
+ 1:
+ #endif
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index 77ca59598c8b..06058fba5f86 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -703,6 +703,7 @@ secondary_startup:
+ /*
+ * Common entry point for secondary CPUs.
+ */
++ bl __cpu_secondary_check52bitva
+ bl __cpu_setup // initialise processor
+ bl __enable_mmu
+ ldr x8, =__secondary_switched
+@@ -779,6 +780,31 @@ ENTRY(__enable_mmu)
+ ret
+ ENDPROC(__enable_mmu)
+
++ENTRY(__cpu_secondary_check52bitva)
++#ifdef CONFIG_ARM64_52BIT_VA
++ ldr_l x0, vabits_user
++ cmp x0, #52
++ b.ne 2f
++
++ mrs_s x0, SYS_ID_AA64MMFR2_EL1
++ and x0, x0, #(0xf << ID_AA64MMFR2_LVA_SHIFT)
++ cbnz x0, 2f
++
++ adr_l x0, va52mismatch
++ mov w1, #1
++ strb w1, [x0]
++ dmb sy
++ dc ivac, x0 // Invalidate potentially stale cache line
++
++ update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x0, x1
++1: wfe
++ wfi
++ b 1b
++
++#endif
++2: ret
++ENDPROC(__cpu_secondary_check52bitva)
++
+ __no_granule_support:
+ /* Indicate that this CPU can't boot and is stuck in the kernel */
+ update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x1, x2
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index 25fcd22a4bb2..52aa51f6310b 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -108,6 +108,7 @@ static int boot_secondary(unsigned int cpu, struct task_struct *idle)
+ }
+
+ static DECLARE_COMPLETION(cpu_running);
++bool va52mismatch __ro_after_init;
+
+ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ {
+@@ -137,10 +138,15 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+
+ if (!cpu_online(cpu)) {
+ pr_crit("CPU%u: failed to come online\n", cpu);
++
++ if (IS_ENABLED(CONFIG_ARM64_52BIT_VA) && va52mismatch)
++ pr_crit("CPU%u: does not support 52-bit VAs\n", cpu);
++
+ ret = -EIO;
+ }
+ } else {
+ pr_err("CPU%u: failed to boot: %d\n", cpu, ret);
++ return ret;
+ }
+
+ secondary_data.task = NULL;
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index 4f3ab5707265..548bac6c60f8 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -83,19 +83,21 @@ archclean:
+
+ linux.bin linux.bin.gz linux.bin.ub: vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ simpleImage.%: vmlinux
+- $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++ $(Q)$(MAKE) $(build)=$(boot) $(addprefix $(boot)/$@., ub unstrip strip)
++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ define archhelp
+ echo '* linux.bin - Create raw binary'
+ echo ' linux.bin.gz - Create compressed raw binary'
+ echo ' linux.bin.ub - Create U-Boot wrapped raw binary'
+- echo ' simpleImage.<dt> - ELF image with $(arch)/boot/dts/<dt>.dts linked in'
+- echo ' - stripped elf with fdt blob'
+- echo ' simpleImage.<dt>.unstrip - full ELF image with fdt blob'
+- echo ' *_defconfig - Select default config from arch/microblaze/configs'
+- echo ''
++ echo ' simpleImage.<dt> - Create the following images with <dt>.dtb linked in'
++ echo ' simpleImage.<dt> : raw image'
++ echo ' simpleImage.<dt>.ub : raw image with U-Boot header'
++ echo ' simpleImage.<dt>.unstrip: ELF (identical to vmlinux)'
++ echo ' simpleImage.<dt>.strip : stripped ELF'
+ echo ' Targets with <dt> embed a device tree blob inside the image'
+ echo ' These targets support board with firmware that does not'
+ echo ' support passing a device tree directly. Replace <dt> with the'
+diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile
+index 600e5a198bd2..cff570a71946 100644
+--- a/arch/microblaze/boot/Makefile
++++ b/arch/microblaze/boot/Makefile
+@@ -3,38 +3,33 @@
+ # arch/microblaze/boot/Makefile
+ #
+
+-targets := linux.bin linux.bin.gz linux.bin.ub simpleImage.%
++targets := linux.bin linux.bin.gz linux.bin.ub simpleImage.*
+
+ OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary
+
+ $(obj)/linux.bin: vmlinux FORCE
+ $(call if_changed,objcopy)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ $(obj)/linux.bin.ub: $(obj)/linux.bin FORCE
+ $(call if_changed,uimage)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE
+ $(call if_changed,gzip)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+-
+-quiet_cmd_cp = CP $< $@$2
+- cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
+
+ quiet_cmd_strip = STRIP $< $@$2
+ cmd_strip = $(STRIP) -K microblaze_start -K _end -K __log_buf \
+ -K _fdt_start $< -o $@$2
+
+ UIMAGE_LOADADDR = $(CONFIG_KERNEL_BASE_ADDR)
+-UIMAGE_IN = $@
+-UIMAGE_OUT = $@.ub
+
+-$(obj)/simpleImage.%: vmlinux FORCE
+- $(call if_changed,cp,.unstrip)
++$(obj)/simpleImage.$(DTB): vmlinux FORCE
+ $(call if_changed,objcopy)
++
++$(obj)/simpleImage.$(DTB).ub: $(obj)/simpleImage.$(DTB) FORCE
+ $(call if_changed,uimage)
+- $(call if_changed,strip,.strip)
+- @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')'
+
+-clean-files += simpleImage.*.unstrip linux.bin.ub
++$(obj)/simpleImage.$(DTB).unstrip: vmlinux FORCE
++ $(call if_changed,shipped)
++
++$(obj)/simpleImage.$(DTB).strip: vmlinux FORCE
++ $(call if_changed,strip)
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index 0c826ad6e994..ee6159d2ed22 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -240,7 +240,7 @@ handler: ;\
+ * occured. in fact they never do. if you need them use
+ * values saved on stack (for SPR_EPC, SPR_ESR) or content
+ * of r4 (for SPR_EEAR). for details look at EXCEPTION_HANDLE()
+- * in 'arch/or32/kernel/head.S'
++ * in 'arch/openrisc/kernel/head.S'
+ */
+
+ /* =====================================================[ exceptions] === */
+diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S
+index 9fc6b60140f0..31ed257ff061 100644
+--- a/arch/openrisc/kernel/head.S
++++ b/arch/openrisc/kernel/head.S
+@@ -1728,7 +1728,7 @@ _string_nl:
+
+ /*
+ * .data section should be page aligned
+- * (look into arch/or32/kernel/vmlinux.lds)
++ * (look into arch/openrisc/kernel/vmlinux.lds.S)
+ */
+ .section .data,"aw"
+ .align 8192
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index c4c03992ee82..dfcb698ec8f3 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -145,7 +145,14 @@ endif
+ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc))
+ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mno-pointers-to-nested-functions)
+
+-CFLAGS-$(CONFIG_PPC32) := -ffixed-r2 $(MULTIPLEWORD)
++# Clang unconditionally reserves r2 on ppc32 and does not support the flag
++# https://bugs.llvm.org/show_bug.cgi?id=39555
++CFLAGS-$(CONFIG_PPC32) := $(call cc-option, -ffixed-r2)
++
++# Clang doesn't support -mmultiple / -mno-multiple
++# https://bugs.llvm.org/show_bug.cgi?id=39556
++CFLAGS-$(CONFIG_PPC32) += $(call cc-option, $(MULTIPLEWORD))
++
+ CFLAGS-$(CONFIG_PPC32) += $(call cc-option,-mno-readonly-in-sdata)
+
+ ifdef CONFIG_PPC_BOOK3S_64
+diff --git a/arch/powerpc/boot/dts/bamboo.dts b/arch/powerpc/boot/dts/bamboo.dts
+index 538e42b1120d..b5861fa3836c 100644
+--- a/arch/powerpc/boot/dts/bamboo.dts
++++ b/arch/powerpc/boot/dts/bamboo.dts
+@@ -268,8 +268,10 @@
+ /* Outbound ranges, one memory and one IO,
+ * later cannot be changed. Chip supports a second
+ * IO range but we don't use it for now
++ * The chip also supports a larger memory range but
++ * it's not naturally aligned, so our code will break
+ */
+- ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x40000000
++ ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x20000000
+ 0x02000000 0x00000000 0x00000000 0x00000000 0xe0000000 0x00000000 0x00100000
+ 0x01000000 0x00000000 0x00000000 0x00000000 0xe8000000 0x00000000 0x00010000>;
+
+diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
+index 3ce690e5f345..59b35b93eade 100644
+--- a/arch/powerpc/include/asm/cputable.h
++++ b/arch/powerpc/include/asm/cputable.h
+@@ -44,6 +44,7 @@ extern int machine_check_e500(struct pt_regs *regs);
+ extern int machine_check_e200(struct pt_regs *regs);
+ extern int machine_check_47x(struct pt_regs *regs);
+ int machine_check_8xx(struct pt_regs *regs);
++int machine_check_83xx(struct pt_regs *regs);
+
+ extern void cpu_down_flush_e500v2(void);
+ extern void cpu_down_flush_e500mc(void);
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index 640a4d818772..af9971661512 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -768,6 +768,8 @@
+ #define SRR1_PROGTRAP 0x00020000 /* Trap */
+ #define SRR1_PROGADDR 0x00010000 /* SRR0 contains subsequent addr */
+
++#define SRR1_MCE_MCP 0x00080000 /* Machine check signal caused interrupt */
++
+ #define SPRN_HSRR0 0x13A /* Save/Restore Register 0 */
+ #define SPRN_HSRR1 0x13B /* Save/Restore Register 1 */
+ #define HSRR1_DENORM 0x00100000 /* Denorm exception */
+diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
+index 2da01340c84c..1eab54bc6ee9 100644
+--- a/arch/powerpc/kernel/cputable.c
++++ b/arch/powerpc/kernel/cputable.c
+@@ -1141,6 +1141,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .machine_check = machine_check_generic,
+ .platform = "ppc603",
+ },
++#ifdef CONFIG_PPC_83xx
+ { /* e300c1 (a 603e core, plus some) on 83xx */
+ .pvr_mask = 0x7fff0000,
+ .pvr_value = 0x00830000,
+@@ -1151,7 +1152,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .platform = "ppc603",
+ },
+ { /* e300c2 (an e300c1 core, plus some, minus FPU) on 83xx */
+@@ -1165,7 +1166,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .platform = "ppc603",
+ },
+ { /* e300c3 (e300c1, plus one IU, half cache size) on 83xx */
+@@ -1179,7 +1180,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .num_pmcs = 4,
+ .oprofile_cpu_type = "ppc/e300",
+ .oprofile_type = PPC_OPROFILE_FSL_EMB,
+@@ -1196,12 +1197,13 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .num_pmcs = 4,
+ .oprofile_cpu_type = "ppc/e300",
+ .oprofile_type = PPC_OPROFILE_FSL_EMB,
+ .platform = "ppc603",
+ },
++#endif
+ { /* default match, we assume split I/D cache & TB (non-601)... */
+ .pvr_mask = 0x00000000,
+ .pvr_value = 0x00000000,
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 90af86f143a9..e1dab9b1e447 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1123,7 +1123,7 @@ TRAMP_REAL_BEGIN(hmi_exception_early)
+ EXCEPTION_PROLOG_COMMON_2(PACA_EXGEN)
+ EXCEPTION_PROLOG_COMMON_3(0xe60)
+ addi r3,r1,STACK_FRAME_OVERHEAD
+- BRANCH_LINK_TO_FAR(hmi_exception_realmode) /* Function call ABI */
++ BRANCH_LINK_TO_FAR(DOTSYM(hmi_exception_realmode)) /* Function call ABI */
+ cmpdi cr0,r3,0
+
+ /* Windup the stack. */
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index c4d7078e5295..8e88f78e57db 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -129,7 +129,7 @@ static void __init move_device_tree(void)
+ p = __va(memblock_alloc(size, PAGE_SIZE));
+ memcpy(p, initial_boot_params, size);
+ initial_boot_params = p;
+- DBG("Moved device tree to 0x%p\n", p);
++ DBG("Moved device tree to 0x%px\n", p);
+ }
+
+ DBG("<- move_device_tree\n");
+@@ -689,7 +689,7 @@ void __init early_init_devtree(void *params)
+ {
+ phys_addr_t limit;
+
+- DBG(" -> early_init_devtree(%p)\n", params);
++ DBG(" -> early_init_devtree(%px)\n", params);
+
+ /* Too early to BUG_ON(), do it by hand */
+ if (!early_init_dt_verify(params))
+@@ -749,7 +749,7 @@ void __init early_init_devtree(void *params)
+ memblock_allow_resize();
+ memblock_dump_all();
+
+- DBG("Phys. mem: %llx\n", memblock_phys_mem_size());
++ DBG("Phys. mem: %llx\n", (unsigned long long)memblock_phys_mem_size());
+
+ /* We may need to relocate the flat tree, do it now.
+ * FIXME .. and the initrd too? */
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 365526ee29b8..6e0ff8b600ce 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -633,21 +633,22 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
+ switch (TRAP(regs)) {
+ case 0x300:
+ case 0x380:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "data at address 0x%08lx\n", regs->dar);
++ pr_alert("BUG: %s at 0x%08lx\n",
++ regs->dar < PAGE_SIZE ? "Kernel NULL pointer dereference" :
++ "Unable to handle kernel data access", regs->dar);
+ break;
+ case 0x400:
+ case 0x480:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "instruction fetch\n");
++ pr_alert("BUG: Unable to handle kernel instruction fetch%s",
++ regs->nip < PAGE_SIZE ? " (NULL pointer?)\n" : "\n");
+ break;
+ case 0x600:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "unaligned access at address 0x%08lx\n", regs->dar);
++ pr_alert("BUG: Unable to handle kernel unaligned access at 0x%08lx\n",
++ regs->dar);
+ break;
+ default:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "unknown fault\n");
++ pr_alert("BUG: Unable to handle unknown paging fault at 0x%08lx\n",
++ regs->dar);
+ break;
+ }
+ printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
+diff --git a/arch/powerpc/mm/ppc_mmu_32.c b/arch/powerpc/mm/ppc_mmu_32.c
+index bea6c544e38f..06783270a124 100644
+--- a/arch/powerpc/mm/ppc_mmu_32.c
++++ b/arch/powerpc/mm/ppc_mmu_32.c
+@@ -52,7 +52,7 @@ struct batrange { /* stores address ranges mapped by BATs */
+ phys_addr_t v_block_mapped(unsigned long va)
+ {
+ int b;
+- for (b = 0; b < 4; ++b)
++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ if (va >= bat_addrs[b].start && va < bat_addrs[b].limit)
+ return bat_addrs[b].phys + (va - bat_addrs[b].start);
+ return 0;
+@@ -64,7 +64,7 @@ phys_addr_t v_block_mapped(unsigned long va)
+ unsigned long p_block_mapped(phys_addr_t pa)
+ {
+ int b;
+- for (b = 0; b < 4; ++b)
++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ if (pa >= bat_addrs[b].phys
+ && pa < (bat_addrs[b].limit-bat_addrs[b].start)
+ +bat_addrs[b].phys)
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index 279a51bf94d0..7e3ab477f67f 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -949,6 +949,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
+ goto out_addrs;
+ }
+
++ /*
++ * If we have seen a tail call, we need a second pass.
++ * This is because bpf_jit_emit_common_epilogue() is called
++ * from bpf_jit_emit_tail_call() with a not yet stable ctx->seen.
++ */
++ if (cgctx.seen & SEEN_TAILCALL) {
++ cgctx.idx = 0;
++ if (bpf_jit_build_body(fp, 0, &cgctx, addrs, false)) {
++ fp = org_fp;
++ goto out_addrs;
++ }
++ }
++
+ /*
+ * Pretend to build prologue, given the features we've seen. This will
+ * update ctgtx.idx as it pretends to output instructions, then we can
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 6a2f65d3d088..053b8e9aa9e7 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -148,6 +148,14 @@ static bool is_thresh_cmp_valid(u64 event)
+ return true;
+ }
+
++static unsigned int dc_ic_rld_quad_l1_sel(u64 event)
++{
++ unsigned int cache;
++
++ cache = (event >> EVENT_CACHE_SEL_SHIFT) & MMCR1_DC_IC_QUAL_MASK;
++ return cache;
++}
++
+ static inline u64 isa207_find_source(u64 idx, u32 sub_idx)
+ {
+ u64 ret = PERF_MEM_NA;
+@@ -288,10 +296,10 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+ * have a cache selector of zero. The bank selector (bit 3) is
+ * irrelevant, as long as the rest of the value is 0.
+ */
+- if (cache & 0x7)
++ if (!cpu_has_feature(CPU_FTR_ARCH_300) && (cache & 0x7))
+ return -1;
+
+- } else if (event & EVENT_IS_L1) {
++ } else if (cpu_has_feature(CPU_FTR_ARCH_300) || (event & EVENT_IS_L1)) {
+ mask |= CNST_L1_QUAL_MASK;
+ value |= CNST_L1_QUAL_VAL(cache);
+ }
+@@ -394,11 +402,14 @@ int isa207_compute_mmcr(u64 event[], int n_ev,
+ /* In continuous sampling mode, update SDAR on TLB miss */
+ mmcra_sdar_mode(event[i], &mmcra);
+
+- if (event[i] & EVENT_IS_L1) {
+- cache = event[i] >> EVENT_CACHE_SEL_SHIFT;
+- mmcr1 |= (cache & 1) << MMCR1_IC_QUAL_SHIFT;
+- cache >>= 1;
+- mmcr1 |= (cache & 1) << MMCR1_DC_QUAL_SHIFT;
++ if (cpu_has_feature(CPU_FTR_ARCH_300)) {
++ cache = dc_ic_rld_quad_l1_sel(event[i]);
++ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT;
++ } else {
++ if (event[i] & EVENT_IS_L1) {
++ cache = dc_ic_rld_quad_l1_sel(event[i]);
++ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT;
++ }
+ }
+
+ if (is_event_marked(event[i])) {
+diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
+index 0028f4b9490d..e5a621699a6d 100644
+--- a/arch/powerpc/perf/isa207-common.h
++++ b/arch/powerpc/perf/isa207-common.h
+@@ -163,8 +163,8 @@
+ #define MMCR1_COMBINE_SHIFT(pmc) (35 - ((pmc) - 1))
+ #define MMCR1_PMCSEL_SHIFT(pmc) (24 - (((pmc) - 1)) * 8)
+ #define MMCR1_FAB_SHIFT 36
+-#define MMCR1_DC_QUAL_SHIFT 47
+-#define MMCR1_IC_QUAL_SHIFT 46
++#define MMCR1_DC_IC_QUAL_MASK 0x3
++#define MMCR1_DC_IC_QUAL_SHIFT 46
+
+ /* MMCR1 Combine bits macro for power9 */
+ #define p9_MMCR1_COMBINE_SHIFT(pmc) (38 - ((pmc - 1) * 2))
+diff --git a/arch/powerpc/platforms/83xx/misc.c b/arch/powerpc/platforms/83xx/misc.c
+index d75c9816a5c9..2b6589fe812d 100644
+--- a/arch/powerpc/platforms/83xx/misc.c
++++ b/arch/powerpc/platforms/83xx/misc.c
+@@ -14,6 +14,7 @@
+ #include <linux/of_platform.h>
+ #include <linux/pci.h>
+
++#include <asm/debug.h>
+ #include <asm/io.h>
+ #include <asm/hw_irq.h>
+ #include <asm/ipic.h>
+@@ -150,3 +151,19 @@ void __init mpc83xx_setup_arch(void)
+
+ mpc83xx_setup_pci();
+ }
++
++int machine_check_83xx(struct pt_regs *regs)
++{
++ u32 mask = 1 << (31 - IPIC_MCP_WDT);
++
++ if (!(regs->msr & SRR1_MCE_MCP) || !(ipic_get_mcp_status() & mask))
++ return machine_check_generic(regs);
++ ipic_clear_mcp_status(mask);
++
++ if (debugger_fault_handler(regs))
++ return 1;
++
++ die("Watchdog NMI Reset", regs, 0);
++
++ return 1;
++}
+diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
+index 3c1beae29f2d..9dd5b8909178 100644
+--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
++++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
+@@ -578,8 +578,8 @@ static void pnv_eeh_get_phb_diag(struct eeh_pe *pe)
+ static int pnv_eeh_get_phb_state(struct eeh_pe *pe)
+ {
+ struct pnv_phb *phb = pe->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ s64 rc;
+ int result = 0;
+
+@@ -617,8 +617,8 @@ static int pnv_eeh_get_phb_state(struct eeh_pe *pe)
+ static int pnv_eeh_get_pe_state(struct eeh_pe *pe)
+ {
+ struct pnv_phb *phb = pe->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ s64 rc;
+ int result;
+
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 326ca6288bb1..ee63749a2d47 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -605,8 +605,8 @@ static int pnv_ioda_unfreeze_pe(struct pnv_phb *phb, int pe_no, int opt)
+ static int pnv_ioda_get_pe_state(struct pnv_phb *phb, int pe_no)
+ {
+ struct pnv_ioda_pe *slave, *pe;
+- u8 fstate, state;
+- __be16 pcierr;
++ u8 fstate = 0, state;
++ __be16 pcierr = 0;
+ s64 rc;
+
+ /* Sanity check on PE number */
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index 13aef2323bbc..db230a35609b 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -602,8 +602,8 @@ static void pnv_pci_handle_eeh_config(struct pnv_phb *phb, u32 pe_no)
+ static void pnv_pci_config_check_eeh(struct pci_dn *pdn)
+ {
+ struct pnv_phb *phb = pdn->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ unsigned int pe_no;
+ s64 rc;
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index e3010b14aea5..c5ffcadab730 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -63,6 +63,10 @@ static struct property *dlpar_parse_cc_property(struct cc_workarea *ccwa)
+
+ name = (char *)ccwa + be32_to_cpu(ccwa->name_offset);
+ prop->name = kstrdup(name, GFP_KERNEL);
++ if (!prop->name) {
++ dlpar_free_cc_property(prop);
++ return NULL;
++ }
+
+ prop->length = be32_to_cpu(ccwa->prop_length);
+ value = (char *)ccwa + be32_to_cpu(ccwa->prop_offset);
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index d93ff494e778..7f86bc3eaade 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -202,6 +202,7 @@ static int update_lmb_associativity_index(struct drmem_lmb *lmb)
+
+ aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc);
+
++ of_node_put(dr_node);
+ dlpar_free_cc_nodes(lmb_node);
+
+ if (aa_index < 0) {
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index bb5db7bfd853..f0fa22e7d36c 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -3493,7 +3493,7 @@ void dump_segments(void)
+
+ printf("sr0-15 =");
+ for (i = 0; i < 16; ++i)
+- printf(" %x", mfsrin(i));
++ printf(" %x", mfsrin(i << 28));
+ printf("\n");
+ }
+ #endif
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 3c317bc6b799..db3196aebaa1 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -416,19 +416,30 @@ static void kvm_s390_cpu_feat_init(void)
+
+ int kvm_arch_init(void *opaque)
+ {
++ int rc;
++
+ kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long));
+ if (!kvm_s390_dbf)
+ return -ENOMEM;
+
+ if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) {
+- debug_unregister(kvm_s390_dbf);
+- return -ENOMEM;
++ rc = -ENOMEM;
++ goto out_debug_unreg;
+ }
+
+ kvm_s390_cpu_feat_init();
+
+ /* Register floating interrupt controller interface. */
+- return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++ rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++ if (rc) {
++ pr_err("Failed to register FLIC rc=%d\n", rc);
++ goto out_debug_unreg;
++ }
++ return 0;
++
++out_debug_unreg:
++ debug_unregister(kvm_s390_dbf);
++ return rc;
+ }
+
+ void kvm_arch_exit(void)
+diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c
+index 2809d11c7a28..9b5b866d8adf 100644
+--- a/arch/s390/mm/gup.c
++++ b/arch/s390/mm/gup.c
+@@ -39,7 +39,8 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
+ VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
+ page = pte_page(pte);
+ head = compound_head(page);
+- if (!page_cache_get_speculative(head))
++ if (unlikely(WARN_ON_ONCE(page_ref_count(head) < 0)
++ || !page_cache_get_speculative(head)))
+ return 0;
+ if (unlikely(pte_val(pte) != pte_val(*ptep))) {
+ put_page(head);
+@@ -77,7 +78,8 @@ static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
+ refs++;
+ } while (addr += PAGE_SIZE, addr != end);
+
+- if (!page_cache_add_speculative(head, refs)) {
++ if (unlikely(WARN_ON_ONCE(page_ref_count(head) < 0)
++ || !page_cache_add_speculative(head, refs))) {
+ *nr -= refs;
+ return 0;
+ }
+@@ -151,7 +153,8 @@ static int gup_huge_pud(pud_t *pudp, pud_t pud, unsigned long addr,
+ refs++;
+ } while (addr += PAGE_SIZE, addr != end);
+
+- if (!page_cache_add_speculative(head, refs)) {
++ if (unlikely(WARN_ON_ONCE(page_ref_count(head) < 0)
++ || !page_cache_add_speculative(head, refs))) {
+ *nr -= refs;
+ return 0;
+ }
+diff --git a/arch/um/Kconfig.debug b/arch/um/Kconfig.debug
+index 2014597605ea..85726eeec345 100644
+--- a/arch/um/Kconfig.debug
++++ b/arch/um/Kconfig.debug
+@@ -16,6 +16,7 @@ config GPROF
+ config GCOV
+ bool "Enable gcov support"
+ depends on DEBUG_INFO
++ depends on !KCOV
+ help
+ This option allows developers to retrieve coverage data from a UML
+ session.
+diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
+index 4d6a78e31089..00c4c2735a5f 100644
+--- a/arch/um/drivers/vector_user.c
++++ b/arch/um/drivers/vector_user.c
+@@ -30,6 +30,7 @@
+ #include <stdlib.h>
+ #include <os.h>
+ #include <um_malloc.h>
++#include <sys/uio.h>
+ #include "vector_user.h"
+
+ #define ID_GRE 0
+diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+index c8b72aff55e0..2052e1e6a11c 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
++++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+@@ -459,6 +459,10 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg)
+ int ret = 0;
+
+ rdtgrp = rdtgroup_kn_lock_live(of->kn);
++ if (!rdtgrp) {
++ ret = -ENOENT;
++ goto out;
++ }
+
+ md.priv = of->kn->priv;
+ resid = md.u.rid;
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index e83a057564d1..173e915e11d5 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -1140,6 +1140,12 @@ bool arch_within_kprobe_blacklist(unsigned long addr)
+ is_in_entry_trampoline_section;
+ }
+
++int __init arch_populate_kprobe_blacklist(void)
++{
++ return kprobe_add_area_blacklist((unsigned long)__entry_text_start,
++ (unsigned long)__entry_text_end);
++}
++
+ int __init arch_init_kprobes(void)
+ {
+ return 0;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 0b7559bf15ea..fa2abed1a14d 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3404,9 +3404,6 @@ static void setup_msrs(struct vcpu_vmx *vmx)
+ index = __find_msr_index(vmx, MSR_CSTAR);
+ if (index >= 0)
+ move_msr_up(vmx, index, save_nmsrs++);
+- index = __find_msr_index(vmx, MSR_TSC_AUX);
+- if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
+- move_msr_up(vmx, index, save_nmsrs++);
+ /*
+ * MSR_STAR is only needed on long mode guests, and only
+ * if efer.sce is enabled.
+@@ -3419,6 +3416,9 @@ static void setup_msrs(struct vcpu_vmx *vmx)
+ index = __find_msr_index(vmx, MSR_EFER);
+ if (index >= 0 && update_transition_efer(vmx, index))
+ move_msr_up(vmx, index, save_nmsrs++);
++ index = __find_msr_index(vmx, MSR_TSC_AUX);
++ if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
++ move_msr_up(vmx, index, save_nmsrs++);
+
+ vmx->save_nmsrs = save_nmsrs;
+ vmx->guest_msrs_dirty = true;
+@@ -11013,10 +11013,6 @@ static void vmx_switch_vmcs(struct kvm_vcpu *vcpu, struct loaded_vmcs *vmcs)
+ vmx->loaded_vmcs = vmcs;
+ vmx_vcpu_load(vcpu, cpu);
+ put_cpu();
+-
+- vm_entry_controls_reset_shadow(vmx);
+- vm_exit_controls_reset_shadow(vmx);
+- vmx_segment_cache_clear(vmx);
+ }
+
+ /*
+@@ -12694,9 +12690,6 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, u32 *exit_qual)
+ if (likely(!evaluate_pending_interrupts) && kvm_vcpu_apicv_active(vcpu))
+ evaluate_pending_interrupts |= vmx_has_apicv_interrupt(vcpu);
+
+- if (from_vmentry && check_vmentry_postreqs(vcpu, vmcs12, exit_qual))
+- return EXIT_REASON_INVALID_STATE;
+-
+ enter_guest_mode(vcpu);
+
+ if (!(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS))
+@@ -12706,6 +12699,7 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, u32 *exit_qual)
+ vmx->nested.vmcs01_guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS);
+
+ vmx_switch_vmcs(vcpu, &vmx->nested.vmcs02);
++ vmx_segment_cache_clear(vmx);
+
+ if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
+ vcpu->arch.tsc_offset += vmcs12->tsc_offset;
+@@ -12839,6 +12833,13 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
+ */
+ skip_emulated_instruction(vcpu);
+
++ ret = check_vmentry_postreqs(vcpu, vmcs12, &exit_qual);
++ if (ret) {
++ nested_vmx_entry_failure(vcpu, vmcs12,
++ EXIT_REASON_INVALID_STATE, exit_qual);
++ return 1;
++ }
++
+ /*
+ * We're finally done with prerequisite checking, and can start with
+ * the nested entry.
+@@ -13529,6 +13530,9 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+ }
+
+ vmx_switch_vmcs(vcpu, &vmx->vmcs01);
++ vm_entry_controls_reset_shadow(vmx);
++ vm_exit_controls_reset_shadow(vmx);
++ vmx_segment_cache_clear(vmx);
+
+ /* Update any VMCS fields that might have changed while L2 ran */
+ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr);
+diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
+index 3a6feed76dfc..a93d8a7cef26 100644
+--- a/arch/x86/xen/xen-asm_64.S
++++ b/arch/x86/xen/xen-asm_64.S
+@@ -12,6 +12,7 @@
+ #include <asm/segment.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
++#include <asm/asm.h>
+
+ #include <xen/interface/xen.h>
+
+@@ -24,6 +25,7 @@ ENTRY(xen_\name)
+ pop %r11
+ jmp \name
+ END(xen_\name)
++_ASM_NOKPROBE(xen_\name)
+ .endm
+
+ xen_pv_trap divide_error
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index 3cca814348a2..74cb166097cd 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -296,30 +296,33 @@ drop_alg:
+
+ static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+- struct crypto_alg *alg;
++ const size_t start_pos = cb->args[0];
++ size_t pos = 0;
+ struct crypto_dump_info info;
+- int err;
+-
+- if (cb->args[0])
+- goto out;
+-
+- cb->args[0] = 1;
++ struct crypto_alg *alg;
++ int res;
+
+ info.in_skb = cb->skb;
+ info.out_skb = skb;
+ info.nlmsg_seq = cb->nlh->nlmsg_seq;
+ info.nlmsg_flags = NLM_F_MULTI;
+
++ down_read(&crypto_alg_sem);
+ list_for_each_entry(alg, &crypto_alg_list, cra_list) {
+- err = crypto_report_alg(alg, &info);
+- if (err)
+- goto out_err;
++ if (pos >= start_pos) {
++ res = crypto_report_alg(alg, &info);
++ if (res == -EMSGSIZE)
++ break;
++ if (res)
++ goto out;
++ }
++ pos++;
+ }
+-
++ cb->args[0] = pos;
++ res = skb->len;
+ out:
+- return skb->len;
+-out_err:
+- return err;
++ up_read(&crypto_alg_sem);
++ return res;
+ }
+
+ static int crypto_dump_report_done(struct netlink_callback *cb)
+@@ -503,7 +506,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&
+ (nlh->nlmsg_flags & NLM_F_DUMP))) {
+ struct crypto_alg *alg;
+- u16 dump_alloc = 0;
++ unsigned long dump_alloc = 0;
+
+ if (link->dump == NULL)
+ return -EINVAL;
+@@ -511,16 +514,16 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+ down_read(&crypto_alg_sem);
+ list_for_each_entry(alg, &crypto_alg_list, cra_list)
+ dump_alloc += CRYPTO_REPORT_MAXSIZE;
++ up_read(&crypto_alg_sem);
+
+ {
+ struct netlink_dump_control c = {
+ .dump = link->dump,
+ .done = link->done,
+- .min_dump_alloc = dump_alloc,
++ .min_dump_alloc = min(dump_alloc, 65535UL),
+ };
+ err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
+ }
+- up_read(&crypto_alg_sem);
+
+ return err;
+ }
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index b21c241aaab9..30ccd94f87d2 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -665,12 +665,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
+ * have _PS0 and _PS3 without _PSC (and no power resources), so
+ * acpi_bus_init_power() will assume that the BIOS has put them into D0.
+ */
+- ret = acpi_device_fix_up_power(adev);
+- if (ret) {
+- /* Skip the device, but continue the namespace scan. */
+- ret = 0;
+- goto err_out;
+- }
++ acpi_device_fix_up_power(adev);
+
+ adev->driver_data = pdata;
+ pdev = acpi_create_platform_device(adev, dev_desc->properties);
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index f008ba7c9ced..73177b8a07bd 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -33,7 +33,6 @@
+ #include <linux/interrupt.h>
+ #include <linux/timer.h>
+ #include <linux/cper.h>
+-#include <linux/kdebug.h>
+ #include <linux/platform_device.h>
+ #include <linux/mutex.h>
+ #include <linux/ratelimit.h>
+@@ -171,40 +170,40 @@ static int ghes_estatus_pool_init(void)
+ return 0;
+ }
+
+-static void ghes_estatus_pool_free_chunk_page(struct gen_pool *pool,
++static void ghes_estatus_pool_free_chunk(struct gen_pool *pool,
+ struct gen_pool_chunk *chunk,
+ void *data)
+ {
+- free_page(chunk->start_addr);
++ vfree((void *)chunk->start_addr);
+ }
+
+ static void ghes_estatus_pool_exit(void)
+ {
+ gen_pool_for_each_chunk(ghes_estatus_pool,
+- ghes_estatus_pool_free_chunk_page, NULL);
++ ghes_estatus_pool_free_chunk, NULL);
+ gen_pool_destroy(ghes_estatus_pool);
+ }
+
+ static int ghes_estatus_pool_expand(unsigned long len)
+ {
+- unsigned long i, pages, size, addr;
+- int ret;
++ unsigned long size, addr;
+
+ ghes_estatus_pool_size_request += PAGE_ALIGN(len);
+ size = gen_pool_size(ghes_estatus_pool);
+ if (size >= ghes_estatus_pool_size_request)
+ return 0;
+- pages = (ghes_estatus_pool_size_request - size) / PAGE_SIZE;
+- for (i = 0; i < pages; i++) {
+- addr = __get_free_page(GFP_KERNEL);
+- if (!addr)
+- return -ENOMEM;
+- ret = gen_pool_add(ghes_estatus_pool, addr, PAGE_SIZE, -1);
+- if (ret)
+- return ret;
+- }
+
+- return 0;
++ addr = (unsigned long)vmalloc(PAGE_ALIGN(len));
++ if (!addr)
++ return -ENOMEM;
++
++ /*
++ * New allocation must be visible in all pgd before it can be found by
++ * an NMI allocating from the pool.
++ */
++ vmalloc_sync_all();
++
++ return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1);
+ }
+
+ static int map_gen_v2(struct ghes *ghes)
+@@ -949,7 +948,6 @@ static int ghes_notify_nmi(unsigned int cmd, struct pt_regs *regs)
+
+ sev = ghes_severity(ghes->estatus->error_severity);
+ if (sev >= GHES_SEV_PANIC) {
+- oops_begin();
+ ghes_print_queued_estatus();
+ __ghes_panic(ghes);
+ }
+diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c
+index f9cb51be38eb..a54214291481 100644
+--- a/drivers/ata/ahci_mvebu.c
++++ b/drivers/ata/ahci_mvebu.c
+@@ -28,6 +28,10 @@
+ #define AHCI_WINDOW_BASE(win) (0x64 + ((win) << 4))
+ #define AHCI_WINDOW_SIZE(win) (0x68 + ((win) << 4))
+
++struct ahci_mvebu_plat_data {
++ int (*plat_config)(struct ahci_host_priv *hpriv);
++};
++
+ static void ahci_mvebu_mbus_config(struct ahci_host_priv *hpriv,
+ const struct mbus_dram_target_info *dram)
+ {
+@@ -62,6 +66,22 @@ static void ahci_mvebu_regret_option(struct ahci_host_priv *hpriv)
+ writel(0x80, hpriv->mmio + AHCI_VENDOR_SPECIFIC_0_DATA);
+ }
+
++static int ahci_mvebu_armada_380_config(struct ahci_host_priv *hpriv)
++{
++ const struct mbus_dram_target_info *dram;
++ int rc = 0;
++
++ dram = mv_mbus_dram_info();
++ if (dram)
++ ahci_mvebu_mbus_config(hpriv, dram);
++ else
++ rc = -ENODEV;
++
++ ahci_mvebu_regret_option(hpriv);
++
++ return rc;
++}
++
+ /**
+ * ahci_mvebu_stop_engine
+ *
+@@ -126,13 +146,10 @@ static int ahci_mvebu_resume(struct platform_device *pdev)
+ {
+ struct ata_host *host = platform_get_drvdata(pdev);
+ struct ahci_host_priv *hpriv = host->private_data;
+- const struct mbus_dram_target_info *dram;
++ const struct ahci_mvebu_plat_data *pdata = hpriv->plat_data;
+
+- dram = mv_mbus_dram_info();
+- if (dram)
+- ahci_mvebu_mbus_config(hpriv, dram);
+-
+- ahci_mvebu_regret_option(hpriv);
++ if (pdata->plat_config)
++ pdata->plat_config(hpriv);
+
+ return ahci_platform_resume_host(&pdev->dev);
+ }
+@@ -154,28 +171,31 @@ static struct scsi_host_template ahci_platform_sht = {
+
+ static int ahci_mvebu_probe(struct platform_device *pdev)
+ {
++ const struct ahci_mvebu_plat_data *pdata;
+ struct ahci_host_priv *hpriv;
+- const struct mbus_dram_target_info *dram;
+ int rc;
+
++ pdata = of_device_get_match_data(&pdev->dev);
++ if (!pdata)
++ return -EINVAL;
++
+ hpriv = ahci_platform_get_resources(pdev, 0);
+ if (IS_ERR(hpriv))
+ return PTR_ERR(hpriv);
+
++ hpriv->plat_data = (void *)pdata;
++
+ rc = ahci_platform_enable_resources(hpriv);
+ if (rc)
+ return rc;
+
+ hpriv->stop_engine = ahci_mvebu_stop_engine;
+
+- if (of_device_is_compatible(pdev->dev.of_node,
+- "marvell,armada-380-ahci")) {
+- dram = mv_mbus_dram_info();
+- if (!dram)
+- return -ENODEV;
+-
+- ahci_mvebu_mbus_config(hpriv, dram);
+- ahci_mvebu_regret_option(hpriv);
++ pdata = hpriv->plat_data;
++ if (pdata->plat_config) {
++ rc = pdata->plat_config(hpriv);
++ if (rc)
++ goto disable_resources;
+ }
+
+ rc = ahci_platform_init_host(pdev, hpriv, &ahci_mvebu_port_info,
+@@ -190,9 +210,23 @@ disable_resources:
+ return rc;
+ }
+
++static const struct ahci_mvebu_plat_data ahci_mvebu_armada_380_plat_data = {
++ .plat_config = ahci_mvebu_armada_380_config,
++};
++
++static const struct ahci_mvebu_plat_data ahci_mvebu_armada_3700_plat_data = {
++ .plat_config = NULL,
++};
++
+ static const struct of_device_id ahci_mvebu_of_match[] = {
+- { .compatible = "marvell,armada-380-ahci", },
+- { .compatible = "marvell,armada-3700-ahci", },
++ {
++ .compatible = "marvell,armada-380-ahci",
++ .data = &ahci_mvebu_armada_380_plat_data,
++ },
++ {
++ .compatible = "marvell,armada-3700-ahci",
++ .data = &ahci_mvebu_armada_3700_plat_data,
++ },
+ { },
+ };
+ MODULE_DEVICE_TABLE(of, ahci_mvebu_of_match);
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index dff82a3c2caa..e9be1f56929a 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -26,6 +26,7 @@
+ #include <linux/clk/clk-conf.h>
+ #include <linux/limits.h>
+ #include <linux/property.h>
++#include <linux/kmemleak.h>
+
+ #include "base.h"
+ #include "power/power.h"
+@@ -525,6 +526,8 @@ struct platform_device *platform_device_register_full(
+ if (!pdev->dev.dma_mask)
+ goto err;
+
++ kmemleak_ignore(pdev->dev.dma_mask);
++
+ *pdev->dev.dma_mask = pdevinfo->dma_mask;
+ pdev->dev.coherent_dma_mask = pdevinfo->dma_mask;
+ }
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index ef8212a4b73e..a49a8d91a599 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -796,7 +796,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm
+
+ if (nc->tentative && connection->agreed_pro_version < 92) {
+ rcu_read_unlock();
+- mutex_unlock(&sock->mutex);
+ drbd_err(connection, "--dry-run is not supported by peer");
+ return -EOPNOTSUPP;
+ }
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index 319fabdd63a3..5b15ffd0c7f5 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -1515,6 +1515,30 @@ static void sanitize_disk_conf(struct drbd_device *device, struct disk_conf *dis
+ }
+ }
+
++static int disk_opts_check_al_size(struct drbd_device *device, struct disk_conf *dc)
++{
++ int err = -EBUSY;
++
++ if (device->act_log &&
++ device->act_log->nr_elements == dc->al_extents)
++ return 0;
++
++ drbd_suspend_io(device);
++ /* If IO completion is currently blocked, we would likely wait
++ * "forever" for the activity log to become unused. So we don't. */
++ if (atomic_read(&device->ap_bio_cnt))
++ goto out;
++
++ wait_event(device->al_wait, lc_try_lock(device->act_log));
++ drbd_al_shrink(device);
++ err = drbd_check_al_size(device, dc);
++ lc_unlock(device->act_log);
++ wake_up(&device->al_wait);
++out:
++ drbd_resume_io(device);
++ return err;
++}
++
+ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info)
+ {
+ struct drbd_config_context adm_ctx;
+@@ -1577,15 +1601,12 @@ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info)
+ }
+ }
+
+- drbd_suspend_io(device);
+- wait_event(device->al_wait, lc_try_lock(device->act_log));
+- drbd_al_shrink(device);
+- err = drbd_check_al_size(device, new_disk_conf);
+- lc_unlock(device->act_log);
+- wake_up(&device->al_wait);
+- drbd_resume_io(device);
+-
++ err = disk_opts_check_al_size(device, new_disk_conf);
+ if (err) {
++ /* Could be just "busy". Ignore?
++ * Introduce dedicated error code? */
++ drbd_msg_put_info(adm_ctx.reply_skb,
++ "Try again without changing current al-extents setting");
+ retcode = ERR_NOMEM;
+ goto fail_unlock;
+ }
+@@ -1935,9 +1956,9 @@ int drbd_adm_attach(struct sk_buff *skb, struct genl_info *info)
+ }
+ }
+
+- if (device->state.conn < C_CONNECTED &&
+- device->state.role == R_PRIMARY && device->ed_uuid &&
+- (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
++ if (device->state.pdsk != D_UP_TO_DATE && device->ed_uuid &&
++ (device->state.role == R_PRIMARY || device->state.peer == R_PRIMARY) &&
++ (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
+ drbd_err(device, "Can only attach to data with current UUID=%016llX\n",
+ (unsigned long long)device->ed_uuid);
+ retcode = ERR_DATA_NOT_CURRENT;
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index 3cdadf75c82d..cbb6ef719978 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -3980,6 +3980,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ struct o_qlim *o = (connection->agreed_features & DRBD_FF_WSAME) ? p->qlim : NULL;
+ enum determine_dev_size dd = DS_UNCHANGED;
+ sector_t p_size, p_usize, p_csize, my_usize;
++ sector_t new_size, cur_size;
+ int ldsc = 0; /* local disk size changed */
+ enum dds_flags ddsf;
+
+@@ -3987,6 +3988,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ if (!peer_device)
+ return config_unknown_volume(connection, pi);
+ device = peer_device->device;
++ cur_size = drbd_get_capacity(device->this_bdev);
+
+ p_size = be64_to_cpu(p->d_size);
+ p_usize = be64_to_cpu(p->u_size);
+@@ -3997,7 +3999,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ device->p_size = p_size;
+
+ if (get_ldev(device)) {
+- sector_t new_size, cur_size;
+ rcu_read_lock();
+ my_usize = rcu_dereference(device->ldev->disk_conf)->disk_size;
+ rcu_read_unlock();
+@@ -4015,7 +4016,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ /* Never shrink a device with usable data during connect.
+ But allow online shrinking if we are connected. */
+ new_size = drbd_new_dev_size(device, device->ldev, p_usize, 0);
+- cur_size = drbd_get_capacity(device->this_bdev);
+ if (new_size < cur_size &&
+ device->state.disk >= D_OUTDATED &&
+ device->state.conn < C_CONNECTED) {
+@@ -4080,9 +4080,36 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ *
+ * However, if he sends a zero current size,
+ * take his (user-capped or) backing disk size anyways.
++ *
++ * Unless of course he does not have a disk himself.
++ * In which case we ignore this completely.
+ */
++ sector_t new_size = p_csize ?: p_usize ?: p_size;
+ drbd_reconsider_queue_parameters(device, NULL, o);
+- drbd_set_my_capacity(device, p_csize ?: p_usize ?: p_size);
++ if (new_size == 0) {
++ /* Ignore, peer does not know nothing. */
++ } else if (new_size == cur_size) {
++ /* nothing to do */
++ } else if (cur_size != 0 && p_size == 0) {
++ drbd_warn(device, "Ignored diskless peer device size (peer:%llu != me:%llu sectors)!\n",
++ (unsigned long long)new_size, (unsigned long long)cur_size);
++ } else if (new_size < cur_size && device->state.role == R_PRIMARY) {
++ drbd_err(device, "The peer's device size is too small! (%llu < %llu sectors); demote me first!\n",
++ (unsigned long long)new_size, (unsigned long long)cur_size);
++ conn_request_state(peer_device->connection, NS(conn, C_DISCONNECTING), CS_HARD);
++ return -EIO;
++ } else {
++ /* I believe the peer, if
++ * - I don't have a current size myself
++ * - we agree on the size anyways
++ * - I do have a current size, am Secondary,
++ * and he has the only disk
++ * - I do have a current size, am Primary,
++ * and he has the only disk,
++ * which is larger than my current size
++ */
++ drbd_set_my_capacity(device, new_size);
++ }
+ }
+
+ if (get_ldev(device)) {
+@@ -4368,6 +4395,25 @@ static int receive_state(struct drbd_connection *connection, struct packet_info
+ if (peer_state.conn == C_AHEAD)
+ ns.conn = C_BEHIND;
+
++ /* TODO:
++ * if (primary and diskless and peer uuid != effective uuid)
++ * abort attach on peer;
++ *
++ * If this node does not have good data, was already connected, but
++ * the peer did a late attach only now, trying to "negotiate" with me,
++ * AND I am currently Primary, possibly frozen, with some specific
++ * "effective" uuid, this should never be reached, really, because
++ * we first send the uuids, then the current state.
++ *
++ * In this scenario, we already dropped the connection hard
++ * when we received the unsuitable uuids (receive_uuids().
++ *
++ * Should we want to change this, that is: not drop the connection in
++ * receive_uuids() already, then we would need to add a branch here
++ * that aborts the attach of "unsuitable uuids" on the peer in case
++ * this node is currently Diskless Primary.
++ */
++
+ if (device->p_uuid && peer_state.disk >= D_NEGOTIATING &&
+ get_ldev_if_state(device, D_NEGOTIATING)) {
+ int cr; /* consider resync */
+diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h
+index ea58301d0895..b2a390ba73a0 100644
+--- a/drivers/block/drbd/drbd_state.h
++++ b/drivers/block/drbd/drbd_state.h
+@@ -131,7 +131,7 @@ extern enum drbd_state_rv _drbd_set_state(struct drbd_device *, union drbd_state
+ enum chg_state_flags,
+ struct completion *done);
+ extern void print_st_err(struct drbd_device *, union drbd_state,
+- union drbd_state, int);
++ union drbd_state, enum drbd_state_rv);
+
+ enum drbd_state_rv
+ _conn_request_state(struct drbd_connection *connection, union drbd_state mask, union drbd_state val,
+diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
+index aa6b7ed9fdf1..59e5fc5eec8f 100644
+--- a/drivers/bluetooth/hci_bcm.c
++++ b/drivers/bluetooth/hci_bcm.c
+@@ -51,6 +51,12 @@
+ #define BCM_LM_DIAG_PKT 0x07
+ #define BCM_LM_DIAG_SIZE 63
+
++#define BCM_TYPE49_PKT 0x31
++#define BCM_TYPE49_SIZE 0
++
++#define BCM_TYPE52_PKT 0x34
++#define BCM_TYPE52_SIZE 0
++
+ #define BCM_AUTOSUSPEND_DELAY 5000 /* default autosleep delay */
+
+ /**
+@@ -564,12 +570,28 @@ finalize:
+ .lsize = 0, \
+ .maxlen = BCM_NULL_SIZE
+
++#define BCM_RECV_TYPE49 \
++ .type = BCM_TYPE49_PKT, \
++ .hlen = BCM_TYPE49_SIZE, \
++ .loff = 0, \
++ .lsize = 0, \
++ .maxlen = BCM_TYPE49_SIZE
++
++#define BCM_RECV_TYPE52 \
++ .type = BCM_TYPE52_PKT, \
++ .hlen = BCM_TYPE52_SIZE, \
++ .loff = 0, \
++ .lsize = 0, \
++ .maxlen = BCM_TYPE52_SIZE
++
+ static const struct h4_recv_pkt bcm_recv_pkts[] = {
+ { H4_RECV_ACL, .recv = hci_recv_frame },
+ { H4_RECV_SCO, .recv = hci_recv_frame },
+ { H4_RECV_EVENT, .recv = hci_recv_frame },
+ { BCM_RECV_LM_DIAG, .recv = hci_recv_diag },
+ { BCM_RECV_NULL, .recv = hci_recv_diag },
++ { BCM_RECV_TYPE49, .recv = hci_recv_diag },
++ { BCM_RECV_TYPE52, .recv = hci_recv_diag },
+ };
+
+ static int bcm_recv(struct hci_uart *hu, const void *data, int count)
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index e95b26319cd9..5b31131d0cba 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -91,6 +91,9 @@ struct sysc {
+ struct delayed_work idle_work;
+ };
+
++static void sysc_parse_dts_quirks(struct sysc *ddata, struct device_node *np,
++ bool is_child);
++
+ void sysc_write(struct sysc *ddata, int offset, u32 value)
+ {
+ writel_relaxed(value, ddata->module_va + offset);
+@@ -374,6 +377,7 @@ static int sysc_check_one_child(struct sysc *ddata,
+ dev_warn(ddata->dev, "really a child ti,hwmods property?");
+
+ sysc_check_quirk_stdout(ddata, np);
++ sysc_parse_dts_quirks(ddata, np, true);
+
+ return 0;
+ }
+@@ -1343,23 +1347,37 @@ static const struct sysc_dts_quirk sysc_dts_quirks[] = {
+ .mask = SYSC_QUIRK_NO_RESET_ON_INIT, },
+ };
+
+-static int sysc_init_dts_quirks(struct sysc *ddata)
++static void sysc_parse_dts_quirks(struct sysc *ddata, struct device_node *np,
++ bool is_child)
+ {
+- struct device_node *np = ddata->dev->of_node;
+ const struct property *prop;
+- int i, len, error;
+- u32 val;
+-
+- ddata->legacy_mode = of_get_property(np, "ti,hwmods", NULL);
++ int i, len;
+
+ for (i = 0; i < ARRAY_SIZE(sysc_dts_quirks); i++) {
+- prop = of_get_property(np, sysc_dts_quirks[i].name, &len);
++ const char *name = sysc_dts_quirks[i].name;
++
++ prop = of_get_property(np, name, &len);
+ if (!prop)
+ continue;
+
+ ddata->cfg.quirks |= sysc_dts_quirks[i].mask;
++ if (is_child) {
++ dev_warn(ddata->dev,
++ "dts flag should be at module level for %s\n",
++ name);
++ }
+ }
++}
++
++static int sysc_init_dts_quirks(struct sysc *ddata)
++{
++ struct device_node *np = ddata->dev->of_node;
++ int error;
++ u32 val;
++
++ ddata->legacy_mode = of_get_property(np, "ti,hwmods", NULL);
+
++ sysc_parse_dts_quirks(ddata, np, false);
+ error = of_property_read_u32(np, "ti,sysc-delay-us", &val);
+ if (!error) {
+ if (val > 255) {
+diff --git a/drivers/char/hw_random/stm32-rng.c b/drivers/char/hw_random/stm32-rng.c
+index 042860d97b15..37b338a76ba4 100644
+--- a/drivers/char/hw_random/stm32-rng.c
++++ b/drivers/char/hw_random/stm32-rng.c
+@@ -169,6 +169,13 @@ static int stm32_rng_probe(struct platform_device *ofdev)
+ return devm_hwrng_register(dev, &priv->rng);
+ }
+
++static int stm32_rng_remove(struct platform_device *ofdev)
++{
++ pm_runtime_disable(&ofdev->dev);
++
++ return 0;
++}
++
+ #ifdef CONFIG_PM
+ static int stm32_rng_runtime_suspend(struct device *dev)
+ {
+@@ -210,6 +217,7 @@ static struct platform_driver stm32_rng_driver = {
+ .of_match_table = stm32_rng_match,
+ },
+ .probe = stm32_rng_probe,
++ .remove = stm32_rng_remove,
+ };
+
+ module_platform_driver(stm32_rng_driver);
+diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c
+index 113152425a95..ea23002be4de 100644
+--- a/drivers/clk/at91/clk-generated.c
++++ b/drivers/clk/at91/clk-generated.c
+@@ -284,7 +284,7 @@ static void clk_generated_startup(struct clk_generated *gck)
+ static struct clk_hw * __init
+ at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock,
+ const char *name, const char **parent_names,
+- u8 num_parents, u8 id,
++ u8 num_parents, u8 id, bool pll_audio,
+ const struct clk_range *range)
+ {
+ struct clk_generated *gck;
+@@ -308,6 +308,7 @@ at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock,
+ gck->regmap = regmap;
+ gck->lock = lock;
+ gck->range = *range;
++ gck->audio_pll_allowed = pll_audio;
+
+ clk_generated_startup(gck);
+ hw = &gck->hw;
+@@ -333,7 +334,6 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np)
+ struct device_node *gcknp;
+ struct clk_range range = CLK_RANGE(0, 0);
+ struct regmap *regmap;
+- struct clk_generated *gck;
+
+ num_parents = of_clk_get_parent_count(np);
+ if (num_parents == 0 || num_parents > GENERATED_SOURCE_MAX)
+@@ -350,6 +350,8 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np)
+ return;
+
+ for_each_child_of_node(np, gcknp) {
++ bool pll_audio = false;
++
+ if (of_property_read_u32(gcknp, "reg", &id))
+ continue;
+
+@@ -362,24 +364,14 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np)
+ of_at91_get_clk_range(gcknp, "atmel,clk-output-range",
+ &range);
+
++ if (of_device_is_compatible(np, "atmel,sama5d2-clk-generated") &&
++ (id == GCK_ID_I2S0 || id == GCK_ID_I2S1 ||
++ id == GCK_ID_CLASSD))
++ pll_audio = true;
++
+ hw = at91_clk_register_generated(regmap, &pmc_pcr_lock, name,
+ parent_names, num_parents,
+- id, &range);
+-
+- gck = to_clk_generated(hw);
+-
+- if (of_device_is_compatible(np,
+- "atmel,sama5d2-clk-generated")) {
+- if (gck->id == GCK_ID_SSC0 || gck->id == GCK_ID_SSC1 ||
+- gck->id == GCK_ID_I2S0 || gck->id == GCK_ID_I2S1 ||
+- gck->id == GCK_ID_CLASSD)
+- gck->audio_pll_allowed = true;
+- else
+- gck->audio_pll_allowed = false;
+- } else {
+- gck->audio_pll_allowed = false;
+- }
+-
++ id, pll_audio, &range);
+ if (IS_ERR(hw))
+ continue;
+
+diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
+index 2f97a843d6d6..90988e7a5b47 100644
+--- a/drivers/clk/at91/clk-main.c
++++ b/drivers/clk/at91/clk-main.c
+@@ -162,7 +162,7 @@ at91_clk_register_main_osc(struct regmap *regmap,
+ if (bypass)
+ regmap_update_bits(regmap,
+ AT91_CKGR_MOR, MOR_KEY_MASK |
+- AT91_PMC_MOSCEN,
++ AT91_PMC_OSCBYPASS,
+ AT91_PMC_OSCBYPASS | AT91_PMC_KEY);
+
+ hw = &osc->hw;
+@@ -354,7 +354,10 @@ static int clk_main_probe_frequency(struct regmap *regmap)
+ regmap_read(regmap, AT91_CKGR_MCFR, &mcfr);
+ if (mcfr & AT91_PMC_MAINRDY)
+ return 0;
+- usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(MAINF_LOOP_MIN_WAIT);
++ else
++ usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
+ } while (time_before(prep_time, timeout));
+
+ return -ETIMEDOUT;
+diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c
+index ab6ecefc49ad..43ba2a8b03fa 100644
+--- a/drivers/clk/at91/sckc.c
++++ b/drivers/clk/at91/sckc.c
+@@ -74,7 +74,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw)
+
+ writel(tmp | AT91_SCKC_OSC32EN, sckcr);
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+
+ return 0;
+ }
+@@ -197,7 +200,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw)
+
+ writel(readl(sckcr) | AT91_SCKC_RCEN, sckcr);
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+
+ return 0;
+ }
+@@ -310,7 +316,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index)
+
+ writel(tmp, sckcr);
+
+- usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(SLOWCK_SW_TIME_USEC);
++ else
++ usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
+
+ return 0;
+ }
+@@ -443,7 +452,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw)
+ return 0;
+ }
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+ osc->prepared = true;
+
+ return 0;
+diff --git a/drivers/clk/clk-stm32mp1.c b/drivers/clk/clk-stm32mp1.c
+index a907555b2a3d..bf3b6a4c78d0 100644
+--- a/drivers/clk/clk-stm32mp1.c
++++ b/drivers/clk/clk-stm32mp1.c
+@@ -121,7 +121,7 @@ static const char * const cpu_src[] = {
+ };
+
+ static const char * const axi_src[] = {
+- "ck_hsi", "ck_hse", "pll2_p", "pll3_p"
++ "ck_hsi", "ck_hse", "pll2_p"
+ };
+
+ static const char * const per_src[] = {
+@@ -225,19 +225,19 @@ static const char * const usart6_src[] = {
+ };
+
+ static const char * const fdcan_src[] = {
+- "ck_hse", "pll3_q", "pll4_q"
++ "ck_hse", "pll3_q", "pll4_q", "pll4_r"
+ };
+
+ static const char * const sai_src[] = {
+- "pll4_q", "pll3_q", "i2s_ckin", "ck_per"
++ "pll4_q", "pll3_q", "i2s_ckin", "ck_per", "pll3_r"
+ };
+
+ static const char * const sai2_src[] = {
+- "pll4_q", "pll3_q", "i2s_ckin", "ck_per", "spdif_ck_symb"
++ "pll4_q", "pll3_q", "i2s_ckin", "ck_per", "spdif_ck_symb", "pll3_r"
+ };
+
+ static const char * const adc12_src[] = {
+- "pll4_q", "ck_per"
++ "pll4_r", "ck_per", "pll3_q"
+ };
+
+ static const char * const dsi_src[] = {
+@@ -269,7 +269,7 @@ static const struct clk_div_table axi_div_table[] = {
+ static const struct clk_div_table mcu_div_table[] = {
+ { 0, 1 }, { 1, 2 }, { 2, 4 }, { 3, 8 },
+ { 4, 16 }, { 5, 32 }, { 6, 64 }, { 7, 128 },
+- { 8, 512 }, { 9, 512 }, { 10, 512}, { 11, 512 },
++ { 8, 256 }, { 9, 512 }, { 10, 512}, { 11, 512 },
+ { 12, 512 }, { 13, 512 }, { 14, 512}, { 15, 512 },
+ { 0 },
+ };
+@@ -1286,10 +1286,11 @@ _clk_stm32_register_composite(struct device *dev,
+ MGATE_MP1(_id, _name, _parent, _flags, _mgate)
+
+ #define KCLK(_id, _name, _parents, _flags, _mgate, _mmux)\
+- COMPOSITE(_id, _name, _parents, CLK_OPS_PARENT_ENABLE | _flags,\
+- _MGATE_MP1(_mgate),\
+- _MMUX(_mmux),\
+- _NO_DIV)
++ COMPOSITE(_id, _name, _parents, CLK_OPS_PARENT_ENABLE |\
++ CLK_SET_RATE_NO_REPARENT | _flags,\
++ _MGATE_MP1(_mgate),\
++ _MMUX(_mmux),\
++ _NO_DIV)
+
+ enum {
+ G_SAI1,
+@@ -1655,8 +1656,8 @@ static const struct stm32_mux_cfg ker_mux_cfg[M_LAST] = {
+
+ static const struct clock_config stm32mp1_clock_cfg[] = {
+ /* Oscillator divider */
+- DIV(NO_ID, "clk-hsi-div", "clk-hsi", 0, RCC_HSICFGR, 0, 2,
+- CLK_DIVIDER_READ_ONLY),
++ DIV(NO_ID, "clk-hsi-div", "clk-hsi", CLK_DIVIDER_POWER_OF_TWO,
++ RCC_HSICFGR, 0, 2, CLK_DIVIDER_READ_ONLY),
+
+ /* External / Internal Oscillators */
+ GATE_MP1(CK_HSE, "ck_hse", "clk-hse", 0, RCC_OCENSETR, 8, 0),
+@@ -1952,7 +1953,8 @@ static const struct clock_config stm32mp1_clock_cfg[] = {
+ MGATE_MP1(GPU_K, "gpu_k", "pll2_q", 0, G_GPU),
+ MGATE_MP1(DAC12_K, "dac12_k", "ck_lsi", 0, G_DAC12),
+
+- COMPOSITE(ETHPTP_K, "ethptp_k", eth_src, CLK_OPS_PARENT_ENABLE,
++ COMPOSITE(ETHPTP_K, "ethptp_k", eth_src, CLK_OPS_PARENT_ENABLE |
++ CLK_SET_RATE_NO_REPARENT,
+ _NO_GATE,
+ _MMUX(M_ETHCK),
+ _DIV(RCC_ETHCKSELR, 4, 4, CLK_DIVIDER_ALLOW_ZERO, NULL)),
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 4d4f6d842c31..d94b65061b9f 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -836,6 +836,7 @@ static struct clk_regmap gxbb_sar_adc_clk_div = {
+ .ops = &clk_regmap_divider_ops,
+ .parent_names = (const char *[]){ "sar_adc_clk_sel" },
+ .num_parents = 1,
++ .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index ce30862617a6..d5af93721299 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -171,12 +171,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = {
+ GATE_BUS_CPU,
+ GATE_SCLK_CPU,
+ CLKOUT_CMU_CPU,
++ CPLL_CON0,
++ DPLL_CON0,
+ EPLL_CON0,
+ EPLL_CON1,
+ EPLL_CON2,
+ RPLL_CON0,
+ RPLL_CON1,
+ RPLL_CON2,
++ IPLL_CON0,
++ SPLL_CON0,
++ VPLL_CON0,
++ MPLL_CON0,
+ SRC_TOP0,
+ SRC_TOP1,
+ SRC_TOP2,
+diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
+index 426980514e67..302596dc79a2 100644
+--- a/drivers/clk/samsung/clk-exynos5433.c
++++ b/drivers/clk/samsung/clk-exynos5433.c
+@@ -16,6 +16,7 @@
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
++#include <linux/slab.h>
+
+ #include <dt-bindings/clock/exynos5433.h>
+
+@@ -5527,6 +5528,8 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
+
+ data->clk_save = samsung_clk_alloc_reg_dump(info->clk_regs,
+ info->nr_clk_regs);
++ if (!data->clk_save)
++ return -ENOMEM;
+ data->nr_clk_save = info->nr_clk_regs;
+ data->clk_suspend = info->suspend_regs;
+ data->nr_clk_suspend = info->nr_suspend_regs;
+@@ -5535,12 +5538,19 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
+ if (data->nr_pclks > 0) {
+ data->pclks = devm_kcalloc(dev, sizeof(struct clk *),
+ data->nr_pclks, GFP_KERNEL);
+-
++ if (!data->pclks) {
++ kfree(data->clk_save);
++ return -ENOMEM;
++ }
+ for (i = 0; i < data->nr_pclks; i++) {
+ struct clk *clk = of_clk_get(dev->of_node, i);
+
+- if (IS_ERR(clk))
++ if (IS_ERR(clk)) {
++ kfree(data->clk_save);
++ while (--i >= 0)
++ clk_put(data->pclks[i]);
+ return PTR_ERR(clk);
++ }
+ data->pclks[i] = clk;
+ }
+ }
+diff --git a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+index 8936ef87652c..c14bf782b2b3 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
++++ b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+@@ -1231,7 +1231,7 @@ static int sun9i_a80_ccu_probe(struct platform_device *pdev)
+
+ /* Enforce d1 = 0, d2 = 0 for Audio PLL */
+ val = readl(reg + SUN9I_A80_PLL_AUDIO_REG);
+- val &= (BIT(16) & BIT(18));
++ val &= ~(BIT(16) | BIT(18));
+ writel(val, reg + SUN9I_A80_PLL_AUDIO_REG);
+
+ /* Enforce P = 1 for both CPU cluster PLLs */
+diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
+index 012714d94b42..004b411b640b 100644
+--- a/drivers/clk/sunxi/clk-sunxi.c
++++ b/drivers/clk/sunxi/clk-sunxi.c
+@@ -1086,8 +1086,8 @@ static struct clk ** __init sunxi_divs_clk_setup(struct device_node *node,
+ rate_hw, rate_ops,
+ gate_hw, &clk_gate_ops,
+ clkflags |
+- data->div[i].critical ?
+- CLK_IS_CRITICAL : 0);
++ (data->div[i].critical ?
++ CLK_IS_CRITICAL : 0));
+
+ WARN_ON(IS_ERR(clk_data->clks[i]));
+ }
+diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
+index 148815470431..beb672a215b6 100644
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -174,7 +174,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
+ struct clk_init_data init = { NULL };
+ const char **parent_names = NULL;
+ struct clk *clk;
+- int ret;
+
+ clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL);
+ if (!clk_hw) {
+@@ -207,11 +206,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
+ clk = ti_clk_register(NULL, &clk_hw->hw, node->name);
+
+ if (!IS_ERR(clk)) {
+- ret = ti_clk_add_alias(NULL, clk, node->name);
+- if (ret) {
+- clk_unregister(clk);
+- goto cleanup;
+- }
+ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ kfree(parent_names);
+ return;
+diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
+index dfaa5aad0692..2c2564acad22 100644
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -100,11 +100,12 @@ static bool _omap4_is_timeout(union omap4_timeout *time, u32 timeout)
+ * can be from a timer that requires pm_runtime access, which
+ * will eventually bring us here with timekeeping_suspended,
+ * during both suspend entry and resume paths. This happens
+- * at least on am43xx platform.
++ * at least on am43xx platform. Account for flakeyness
++ * with udelay() by multiplying the timeout value by 2.
+ */
+ if (unlikely(_early_timeout || timekeeping_suspended)) {
+ if (time->cycles++ < timeout) {
+- udelay(1);
++ udelay(1 * 2);
+ return false;
+ }
+ } else {
+diff --git a/drivers/clocksource/timer-fttmr010.c b/drivers/clocksource/timer-fttmr010.c
+index cf93f6419b51..fadff7915dd9 100644
+--- a/drivers/clocksource/timer-fttmr010.c
++++ b/drivers/clocksource/timer-fttmr010.c
+@@ -21,7 +21,7 @@
+ #include <linux/delay.h>
+
+ /*
+- * Register definitions for the timers
++ * Register definitions common for all the timer variants.
+ */
+ #define TIMER1_COUNT (0x00)
+ #define TIMER1_LOAD (0x04)
+@@ -36,9 +36,10 @@
+ #define TIMER3_MATCH1 (0x28)
+ #define TIMER3_MATCH2 (0x2c)
+ #define TIMER_CR (0x30)
+-#define TIMER_INTR_STATE (0x34)
+-#define TIMER_INTR_MASK (0x38)
+
++/*
++ * Control register (TMC30) bit fields for fttmr010/gemini/moxart timers.
++ */
+ #define TIMER_1_CR_ENABLE BIT(0)
+ #define TIMER_1_CR_CLOCK BIT(1)
+ #define TIMER_1_CR_INT BIT(2)
+@@ -53,8 +54,9 @@
+ #define TIMER_3_CR_UPDOWN BIT(11)
+
+ /*
+- * The Aspeed AST2400 moves bits around in the control register
+- * and lacks bits for setting the timer to count upwards.
++ * Control register (TMC30) bit fields for aspeed ast2400/ast2500 timers.
++ * The aspeed timers move bits around in the control register and lacks
++ * bits for setting the timer to count upwards.
+ */
+ #define TIMER_1_CR_ASPEED_ENABLE BIT(0)
+ #define TIMER_1_CR_ASPEED_CLOCK BIT(1)
+@@ -66,6 +68,18 @@
+ #define TIMER_3_CR_ASPEED_CLOCK BIT(9)
+ #define TIMER_3_CR_ASPEED_INT BIT(10)
+
++/*
++ * Interrupt status/mask register definitions for fttmr010/gemini/moxart
++ * timers.
++ * The registers don't exist and they are not needed on aspeed timers
++ * because:
++ * - aspeed timer overflow interrupt is controlled by bits in Control
++ * Register (TMC30).
++ * - aspeed timers always generate interrupt when either one of the
++ * Match registers equals to Status register.
++ */
++#define TIMER_INTR_STATE (0x34)
++#define TIMER_INTR_MASK (0x38)
+ #define TIMER_1_INT_MATCH1 BIT(0)
+ #define TIMER_1_INT_MATCH2 BIT(1)
+ #define TIMER_1_INT_OVERFLOW BIT(2)
+@@ -80,7 +94,7 @@
+ struct fttmr010 {
+ void __iomem *base;
+ unsigned int tick_rate;
+- bool count_down;
++ bool is_aspeed;
+ u32 t1_enable_val;
+ struct clock_event_device clkevt;
+ #ifdef CONFIG_ARM
+@@ -130,7 +144,7 @@ static int fttmr010_timer_set_next_event(unsigned long cycles,
+ cr &= ~fttmr010->t1_enable_val;
+ writel(cr, fttmr010->base + TIMER_CR);
+
+- if (fttmr010->count_down) {
++ if (fttmr010->is_aspeed) {
+ /*
+ * ASPEED Timer Controller will load TIMER1_LOAD register
+ * into TIMER1_COUNT register when the timer is re-enabled.
+@@ -175,16 +189,17 @@ static int fttmr010_timer_set_oneshot(struct clock_event_device *evt)
+
+ /* Setup counter start from 0 or ~0 */
+ writel(0, fttmr010->base + TIMER1_COUNT);
+- if (fttmr010->count_down)
++ if (fttmr010->is_aspeed) {
+ writel(~0, fttmr010->base + TIMER1_LOAD);
+- else
++ } else {
+ writel(0, fttmr010->base + TIMER1_LOAD);
+
+- /* Enable interrupt */
+- cr = readl(fttmr010->base + TIMER_INTR_MASK);
+- cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2);
+- cr |= TIMER_1_INT_MATCH1;
+- writel(cr, fttmr010->base + TIMER_INTR_MASK);
++ /* Enable interrupt */
++ cr = readl(fttmr010->base + TIMER_INTR_MASK);
++ cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2);
++ cr |= TIMER_1_INT_MATCH1;
++ writel(cr, fttmr010->base + TIMER_INTR_MASK);
++ }
+
+ return 0;
+ }
+@@ -201,9 +216,8 @@ static int fttmr010_timer_set_periodic(struct clock_event_device *evt)
+ writel(cr, fttmr010->base + TIMER_CR);
+
+ /* Setup timer to fire at 1/HZ intervals. */
+- if (fttmr010->count_down) {
++ if (fttmr010->is_aspeed) {
+ writel(period, fttmr010->base + TIMER1_LOAD);
+- writel(0, fttmr010->base + TIMER1_MATCH1);
+ } else {
+ cr = 0xffffffff - (period - 1);
+ writel(cr, fttmr010->base + TIMER1_COUNT);
+@@ -281,23 +295,21 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ }
+
+ /*
+- * The Aspeed AST2400 moves bits around in the control register,
+- * otherwise it works the same.
++ * The Aspeed timers move bits around in the control register.
+ */
+ if (is_aspeed) {
+ fttmr010->t1_enable_val = TIMER_1_CR_ASPEED_ENABLE |
+ TIMER_1_CR_ASPEED_INT;
+- /* Downward not available */
+- fttmr010->count_down = true;
++ fttmr010->is_aspeed = true;
+ } else {
+ fttmr010->t1_enable_val = TIMER_1_CR_ENABLE | TIMER_1_CR_INT;
+- }
+
+- /*
+- * Reset the interrupt mask and status
+- */
+- writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK);
+- writel(0, fttmr010->base + TIMER_INTR_STATE);
++ /*
++ * Reset the interrupt mask and status
++ */
++ writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK);
++ writel(0, fttmr010->base + TIMER_INTR_STATE);
++ }
+
+ /*
+ * Enable timer 1 count up, timer 2 count up, except on Aspeed,
+@@ -306,9 +318,8 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ if (is_aspeed)
+ val = TIMER_2_CR_ASPEED_ENABLE;
+ else {
+- val = TIMER_2_CR_ENABLE;
+- if (!fttmr010->count_down)
+- val |= TIMER_1_CR_UPDOWN | TIMER_2_CR_UPDOWN;
++ val = TIMER_2_CR_ENABLE | TIMER_1_CR_UPDOWN |
++ TIMER_2_CR_UPDOWN;
+ }
+ writel(val, fttmr010->base + TIMER_CR);
+
+@@ -321,7 +332,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ writel(0, fttmr010->base + TIMER2_MATCH1);
+ writel(0, fttmr010->base + TIMER2_MATCH2);
+
+- if (fttmr010->count_down) {
++ if (fttmr010->is_aspeed) {
+ writel(~0, fttmr010->base + TIMER2_LOAD);
+ clocksource_mmio_init(fttmr010->base + TIMER2_COUNT,
+ "FTTMR010-TIMER2",
+@@ -371,7 +382,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+
+ #ifdef CONFIG_ARM
+ /* Also use this timer for delays */
+- if (fttmr010->count_down)
++ if (fttmr010->is_aspeed)
+ fttmr010->delay_timer.read_current_timer =
+ fttmr010_read_current_timer_down;
+ else
+diff --git a/drivers/clocksource/timer-mediatek.c b/drivers/clocksource/timer-mediatek.c
+index eb10321f8517..8e7894a026ac 100644
+--- a/drivers/clocksource/timer-mediatek.c
++++ b/drivers/clocksource/timer-mediatek.c
+@@ -277,15 +277,12 @@ static int __init mtk_syst_init(struct device_node *node)
+
+ ret = timer_of_init(node, &to);
+ if (ret)
+- goto err;
++ return ret;
+
+ clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
+ TIMER_SYNC_TICKS, 0xffffffff);
+
+ return 0;
+-err:
+- timer_of_cleanup(&to);
+- return ret;
+ }
+
+ static int __init mtk_gpt_init(struct device_node *node)
+@@ -302,7 +299,7 @@ static int __init mtk_gpt_init(struct device_node *node)
+
+ ret = timer_of_init(node, &to);
+ if (ret)
+- goto err;
++ return ret;
+
+ /* Configure clock source */
+ mtk_gpt_setup(&to, TIMER_CLK_SRC, GPT_CTRL_OP_FREERUN);
+@@ -320,9 +317,6 @@ static int __init mtk_gpt_init(struct device_node *node)
+ mtk_gpt_enable_irq(&to, TIMER_CLK_EVT);
+
+ return 0;
+-err:
+- timer_of_cleanup(&to);
+- return ret;
+ }
+ TIMER_OF_DECLARE(mtk_mt6577, "mediatek,mt6577-timer", mtk_gpt_init);
+ TIMER_OF_DECLARE(mtk_mt6765, "mediatek,mt6765-timer", mtk_syst_init);
+diff --git a/drivers/crypto/chelsio/chtls/chtls.h b/drivers/crypto/chelsio/chtls/chtls.h
+index 7725b6ee14ef..fcb6747ed29e 100644
+--- a/drivers/crypto/chelsio/chtls/chtls.h
++++ b/drivers/crypto/chelsio/chtls/chtls.h
+@@ -153,6 +153,11 @@ struct chtls_dev {
+ unsigned int cdev_state;
+ };
+
++struct chtls_listen {
++ struct chtls_dev *cdev;
++ struct sock *sk;
++};
++
+ struct chtls_hws {
+ struct sk_buff_head sk_recv_queue;
+ u8 txqid;
+diff --git a/drivers/crypto/chelsio/chtls/chtls_main.c b/drivers/crypto/chelsio/chtls/chtls_main.c
+index f59b044ebd25..2bf084afe9b5 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_main.c
++++ b/drivers/crypto/chelsio/chtls/chtls_main.c
+@@ -55,24 +55,19 @@ static void unregister_listen_notifier(struct notifier_block *nb)
+ static int listen_notify_handler(struct notifier_block *this,
+ unsigned long event, void *data)
+ {
+- struct chtls_dev *cdev;
+- struct sock *sk;
+- int ret;
++ struct chtls_listen *clisten;
++ int ret = NOTIFY_DONE;
+
+- sk = data;
+- ret = NOTIFY_DONE;
++ clisten = (struct chtls_listen *)data;
+
+ switch (event) {
+ case CHTLS_LISTEN_START:
++ ret = chtls_listen_start(clisten->cdev, clisten->sk);
++ kfree(clisten);
++ break;
+ case CHTLS_LISTEN_STOP:
+- mutex_lock(&cdev_list_lock);
+- list_for_each_entry(cdev, &cdev_list, list) {
+- if (event == CHTLS_LISTEN_START)
+- ret = chtls_listen_start(cdev, sk);
+- else
+- chtls_listen_stop(cdev, sk);
+- }
+- mutex_unlock(&cdev_list_lock);
++ chtls_listen_stop(clisten->cdev, clisten->sk);
++ kfree(clisten);
+ break;
+ }
+ return ret;
+@@ -90,8 +85,9 @@ static int listen_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+ return 0;
+ }
+
+-static int chtls_start_listen(struct sock *sk)
++static int chtls_start_listen(struct chtls_dev *cdev, struct sock *sk)
+ {
++ struct chtls_listen *clisten;
+ int err;
+
+ if (sk->sk_protocol != IPPROTO_TCP)
+@@ -102,21 +98,33 @@ static int chtls_start_listen(struct sock *sk)
+ return -EADDRNOTAVAIL;
+
+ sk->sk_backlog_rcv = listen_backlog_rcv;
++ clisten = kmalloc(sizeof(*clisten), GFP_KERNEL);
++ if (!clisten)
++ return -ENOMEM;
++ clisten->cdev = cdev;
++ clisten->sk = sk;
+ mutex_lock(¬ify_mutex);
+ err = raw_notifier_call_chain(&listen_notify_list,
+- CHTLS_LISTEN_START, sk);
++ CHTLS_LISTEN_START, clisten);
+ mutex_unlock(¬ify_mutex);
+ return err;
+ }
+
+-static void chtls_stop_listen(struct sock *sk)
++static void chtls_stop_listen(struct chtls_dev *cdev, struct sock *sk)
+ {
++ struct chtls_listen *clisten;
++
+ if (sk->sk_protocol != IPPROTO_TCP)
+ return;
+
++ clisten = kmalloc(sizeof(*clisten), GFP_KERNEL);
++ if (!clisten)
++ return;
++ clisten->cdev = cdev;
++ clisten->sk = sk;
+ mutex_lock(¬ify_mutex);
+ raw_notifier_call_chain(&listen_notify_list,
+- CHTLS_LISTEN_STOP, sk);
++ CHTLS_LISTEN_STOP, clisten);
+ mutex_unlock(¬ify_mutex);
+ }
+
+@@ -138,15 +146,19 @@ static int chtls_inline_feature(struct tls_device *dev)
+
+ static int chtls_create_hash(struct tls_device *dev, struct sock *sk)
+ {
++ struct chtls_dev *cdev = to_chtls_dev(dev);
++
+ if (sk->sk_state == TCP_LISTEN)
+- return chtls_start_listen(sk);
++ return chtls_start_listen(cdev, sk);
+ return 0;
+ }
+
+ static void chtls_destroy_hash(struct tls_device *dev, struct sock *sk)
+ {
++ struct chtls_dev *cdev = to_chtls_dev(dev);
++
+ if (sk->sk_state == TCP_LISTEN)
+- chtls_stop_listen(sk);
++ chtls_stop_listen(cdev, sk);
+ }
+
+ static void chtls_register_dev(struct chtls_dev *cdev)
+diff --git a/drivers/crypto/mxc-scc.c b/drivers/crypto/mxc-scc.c
+index e01c46387df8..519086730791 100644
+--- a/drivers/crypto/mxc-scc.c
++++ b/drivers/crypto/mxc-scc.c
+@@ -178,12 +178,12 @@ static int mxc_scc_get_data(struct mxc_scc_ctx *ctx,
+ else
+ from = scc->black_memory;
+
+- dev_dbg(scc->dev, "pcopy: from 0x%p %d bytes\n", from,
++ dev_dbg(scc->dev, "pcopy: from 0x%p %zu bytes\n", from,
+ ctx->dst_nents * 8);
+ len = sg_pcopy_from_buffer(ablkreq->dst, ctx->dst_nents,
+ from, ctx->size, ctx->offset);
+ if (!len) {
+- dev_err(scc->dev, "pcopy err from 0x%p (len=%d)\n", from, len);
++ dev_err(scc->dev, "pcopy err from 0x%p (len=%zu)\n", from, len);
+ return -EINVAL;
+ }
+
+@@ -274,7 +274,7 @@ static int mxc_scc_put_data(struct mxc_scc_ctx *ctx,
+ len = sg_pcopy_to_buffer(req->src, ctx->src_nents,
+ to, len, ctx->offset);
+ if (!len) {
+- dev_err(scc->dev, "pcopy err to 0x%p (len=%d)\n", to, len);
++ dev_err(scc->dev, "pcopy err to 0x%p (len=%zu)\n", to, len);
+ return -EINVAL;
+ }
+
+@@ -335,9 +335,9 @@ static void mxc_scc_ablkcipher_next(struct mxc_scc_ctx *ctx,
+ return;
+ }
+
+- dev_dbg(scc->dev, "Start encryption (0x%p/0x%p)\n",
+- (void *)readl(scc->base + SCC_SCM_RED_START),
+- (void *)readl(scc->base + SCC_SCM_BLACK_START));
++ dev_dbg(scc->dev, "Start encryption (0x%x/0x%x)\n",
++ readl(scc->base + SCC_SCM_RED_START),
++ readl(scc->base + SCC_SCM_BLACK_START));
+
+ /* clear interrupt control registers */
+ writel(SCC_SCM_INTR_CTRL_CLR_INTR,
+diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c
+index 590d7352837e..641b11077f47 100644
+--- a/drivers/crypto/stm32/stm32-hash.c
++++ b/drivers/crypto/stm32/stm32-hash.c
+@@ -365,7 +365,7 @@ static int stm32_hash_xmit_cpu(struct stm32_hash_dev *hdev,
+ return -ETIMEDOUT;
+
+ if ((hdev->flags & HASH_FLAGS_HMAC) &&
+- (hdev->flags & ~HASH_FLAGS_HMAC_KEY)) {
++ (!(hdev->flags & HASH_FLAGS_HMAC_KEY))) {
+ hdev->flags |= HASH_FLAGS_HMAC_KEY;
+ stm32_hash_write_key(hdev);
+ if (stm32_hash_wait_busy(hdev))
+diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c
+index 379e8d534e61..4903a408fc14 100644
+--- a/drivers/dma/stm32-dma.c
++++ b/drivers/dma/stm32-dma.c
+@@ -308,20 +308,12 @@ static bool stm32_dma_fifo_threshold_is_allowed(u32 burst, u32 threshold,
+
+ static bool stm32_dma_is_burst_possible(u32 buf_len, u32 threshold)
+ {
+- switch (threshold) {
+- case STM32_DMA_FIFO_THRESHOLD_FULL:
+- if (buf_len >= STM32_DMA_MAX_BURST)
+- return true;
+- else
+- return false;
+- case STM32_DMA_FIFO_THRESHOLD_HALFFULL:
+- if (buf_len >= STM32_DMA_MAX_BURST / 2)
+- return true;
+- else
+- return false;
+- default:
+- return false;
+- }
++ /*
++ * Buffer or period length has to be aligned on FIFO depth.
++ * Otherwise bytes may be stuck within FIFO at buffer or period
++ * length.
++ */
++ return ((buf_len % ((threshold + 1) * 4)) == 0);
+ }
+
+ static u32 stm32_dma_get_best_burst(u32 buf_len, u32 max_burst, u32 threshold,
+diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
+index 1ea71640fdc2..c64c7da73829 100644
+--- a/drivers/firmware/arm_sdei.c
++++ b/drivers/firmware/arm_sdei.c
+@@ -1009,7 +1009,6 @@ static struct platform_driver sdei_driver = {
+
+ static bool __init sdei_present_dt(void)
+ {
+- struct platform_device *pdev;
+ struct device_node *np, *fw_np;
+
+ fw_np = of_find_node_by_name(NULL, "firmware");
+@@ -1017,14 +1016,9 @@ static bool __init sdei_present_dt(void)
+ return false;
+
+ np = of_find_matching_node(fw_np, sdei_of_match);
+- of_node_put(fw_np);
+ if (!np)
+ return false;
+-
+- pdev = of_platform_device_create(np, sdei_driver.driver.name, NULL);
+ of_node_put(np);
+- if (!pdev)
+- return false;
+
+ return true;
+ }
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index e0657fc72d31..0232c25a1586 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -58,7 +58,7 @@
+ #define PCA_GPIO_MASK 0x00FF
+
+ #define PCAL_GPIO_MASK 0x1f
+-#define PCAL_PINCTRL_MASK 0xe0
++#define PCAL_PINCTRL_MASK 0x60
+
+ #define PCA_INT 0x0100
+ #define PCA_PCAL 0x0200
+diff --git a/drivers/gpio/gpio-raspberrypi-exp.c b/drivers/gpio/gpio-raspberrypi-exp.c
+index d6d36d537e37..b77ea16ffa03 100644
+--- a/drivers/gpio/gpio-raspberrypi-exp.c
++++ b/drivers/gpio/gpio-raspberrypi-exp.c
+@@ -206,6 +206,7 @@ static int rpi_exp_gpio_probe(struct platform_device *pdev)
+ }
+
+ fw = rpi_firmware_get(fw_node);
++ of_node_put(fw_node);
+ if (!fw)
+ return -EPROBE_DEFER;
+
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+index 04440064b9b7..e5b3ba73e661 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+@@ -382,7 +382,7 @@ atmel_hlcdc_plane_update_general_settings(struct atmel_hlcdc_plane *plane,
+ cfg |= ATMEL_HLCDC_LAYER_LAEN;
+ else
+ cfg |= ATMEL_HLCDC_LAYER_GAEN |
+- ATMEL_HLCDC_LAYER_GA(state->base.alpha >> 8);
++ ATMEL_HLCDC_LAYER_GA(state->base.alpha);
+ }
+
+ if (state->disc_h && state->disc_w)
+diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
+index 2f8db9d62551..4a28f3fbb0a2 100644
+--- a/drivers/gpu/ipu-v3/ipu-pre.c
++++ b/drivers/gpu/ipu-v3/ipu-pre.c
+@@ -106,6 +106,7 @@ struct ipu_pre {
+ void *buffer_virt;
+ bool in_use;
+ unsigned int safe_window_end;
++ unsigned int last_bufaddr;
+ };
+
+ static DEFINE_MUTEX(ipu_pre_list_mutex);
+@@ -185,6 +186,7 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width,
+
+ writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF);
+ writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
++ pre->last_bufaddr = bufaddr;
+
+ val = IPU_PRE_PREF_ENG_CTRL_INPUT_PIXEL_FORMAT(0) |
+ IPU_PRE_PREF_ENG_CTRL_INPUT_ACTIVE_BPP(active_bpp) |
+@@ -242,7 +244,11 @@ void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr)
+ unsigned short current_yblock;
+ u32 val;
+
++ if (bufaddr == pre->last_bufaddr)
++ return;
++
+ writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
++ pre->last_bufaddr = bufaddr;
+
+ do {
+ if (time_after(jiffies, timeout)) {
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 63a1628f7cf7..b0c8fae7f903 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -211,6 +211,18 @@ static unsigned hid_lookup_collection(struct hid_parser *parser, unsigned type)
+ return 0; /* we know nothing about this usage type */
+ }
+
++/*
++ * Concatenate usage which defines 16 bits or less with the
++ * currently defined usage page to form a 32 bit usage
++ */
++
++static void complete_usage(struct hid_parser *parser, unsigned int index)
++{
++ parser->local.usage[index] &= 0xFFFF;
++ parser->local.usage[index] |=
++ (parser->global.usage_page & 0xFFFF) << 16;
++}
++
+ /*
+ * Add a usage to the temporary parser table.
+ */
+@@ -222,6 +234,14 @@ static int hid_add_usage(struct hid_parser *parser, unsigned usage, u8 size)
+ return -1;
+ }
+ parser->local.usage[parser->local.usage_index] = usage;
++
++ /*
++ * If Usage item only includes usage id, concatenate it with
++ * currently defined usage page
++ */
++ if (size <= 2)
++ complete_usage(parser, parser->local.usage_index);
++
+ parser->local.usage_size[parser->local.usage_index] = size;
+ parser->local.collection_index[parser->local.usage_index] =
+ parser->collection_stack_ptr ?
+@@ -542,13 +562,32 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item)
+ * usage value."
+ */
+
+-static void hid_concatenate_usage_page(struct hid_parser *parser)
++static void hid_concatenate_last_usage_page(struct hid_parser *parser)
+ {
+ int i;
++ unsigned int usage_page;
++ unsigned int current_page;
+
+- for (i = 0; i < parser->local.usage_index; i++)
+- if (parser->local.usage_size[i] <= 2)
+- parser->local.usage[i] += parser->global.usage_page << 16;
++ if (!parser->local.usage_index)
++ return;
++
++ usage_page = parser->global.usage_page;
++
++ /*
++ * Concatenate usage page again only if last declared Usage Page
++ * has not been already used in previous usages concatenation
++ */
++ for (i = parser->local.usage_index - 1; i >= 0; i--) {
++ if (parser->local.usage_size[i] > 2)
++ /* Ignore extended usages */
++ continue;
++
++ current_page = parser->local.usage[i] >> 16;
++ if (current_page == usage_page)
++ break;
++
++ complete_usage(parser, i);
++ }
+ }
+
+ /*
+@@ -560,7 +599,7 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item)
+ __u32 data;
+ int ret;
+
+- hid_concatenate_usage_page(parser);
++ hid_concatenate_last_usage_page(parser);
+
+ data = item_udata(item);
+
+@@ -771,7 +810,7 @@ static int hid_scan_main(struct hid_parser *parser, struct hid_item *item)
+ __u32 data;
+ int i;
+
+- hid_concatenate_usage_page(parser);
++ hid_concatenate_last_usage_page(parser);
+
+ data = item_udata(item);
+
+diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c
+index cd23903ddcf1..e918d78e541c 100644
+--- a/drivers/hid/intel-ish-hid/ishtp-hid.c
++++ b/drivers/hid/intel-ish-hid/ishtp-hid.c
+@@ -222,7 +222,7 @@ int ishtp_hid_probe(unsigned int cur_hid_dev,
+ err_hid_device:
+ kfree(hid_data);
+ err_hid_data:
+- kfree(hid);
++ hid_destroy_device(hid);
+ return rv;
+ }
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+index 4097f3fa25c5..09e7d3dd3055 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+@@ -775,9 +775,8 @@ int bnxt_qplib_map_tc2cos(struct bnxt_qplib_res *res, u16 *cids)
+ req.cos0 = cpu_to_le16(cids[0]);
+ req.cos1 = cpu_to_le16(cids[1]);
+
+- bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp, NULL,
+- 0);
+- return 0;
++ return bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
++ NULL, 0);
+ }
+
+ int bnxt_qplib_get_roce_stats(struct bnxt_qplib_rcfw *rcfw,
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 9e7923cf8577..7021444f18b4 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -1776,6 +1776,9 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
+ struct hns_roce_v2_mpt_entry *mpt_entry = mb_buf;
+ int ret = 0;
+
++ roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_MPT_ST_M,
++ V2_MPT_BYTE_4_MPT_ST_S, V2_MPT_ST_VALID);
++
+ if (flags & IB_MR_REREG_PD) {
+ roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_PD_M,
+ V2_MPT_BYTE_4_PD_S, pdn);
+@@ -3443,7 +3446,7 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
+ struct device *dev = hr_dev->dev;
+ int ret = -EINVAL;
+
+- context = kcalloc(2, sizeof(*context), GFP_KERNEL);
++ context = kcalloc(2, sizeof(*context), GFP_ATOMIC);
+ if (!context)
+ return -ENOMEM;
+
+@@ -3503,13 +3506,16 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
+ roce_set_field(qpc_mask->byte_160_sq_ci_pi,
+ V2_QPC_BYTE_160_SQ_PRODUCER_IDX_M,
+ V2_QPC_BYTE_160_SQ_PRODUCER_IDX_S, 0);
+- roce_set_field(context->byte_84_rq_ci_pi,
++
++ if (!ibqp->srq) {
++ roce_set_field(context->byte_84_rq_ci_pi,
+ V2_QPC_BYTE_84_RQ_PRODUCER_IDX_M,
+ V2_QPC_BYTE_84_RQ_PRODUCER_IDX_S,
+ hr_qp->rq.head);
+- roce_set_field(qpc_mask->byte_84_rq_ci_pi,
++ roce_set_field(qpc_mask->byte_84_rq_ci_pi,
+ V2_QPC_BYTE_84_RQ_PRODUCER_IDX_M,
+ V2_QPC_BYTE_84_RQ_PRODUCER_IDX_S, 0);
++ }
+ }
+
+ if (attr_mask & IB_QP_AV) {
+@@ -3971,7 +3977,8 @@ static void hns_roce_set_qps_to_err(struct hns_roce_dev *hr_dev, u32 qpn)
+ if (hr_qp->ibqp.uobject) {
+ if (hr_qp->sdb_en == 1) {
+ hr_qp->sq.head = *(int *)(hr_qp->sdb.virt_addr);
+- hr_qp->rq.head = *(int *)(hr_qp->rdb.virt_addr);
++ if (hr_qp->rdb_en == 1)
++ hr_qp->rq.head = *(int *)(hr_qp->rdb.virt_addr);
+ } else {
+ dev_warn(hr_dev->dev, "flush cqe is unsupported in userspace!\n");
+ return;
+diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
+index 41a538d23b80..c68596d4e803 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
+@@ -1017,14 +1017,14 @@ struct ib_mr *hns_roce_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+ goto err_umem;
+ }
+ } else {
+- int pbl_size = 1;
++ u64 pbl_size = 1;
+
+ bt_size = (1 << (hr_dev->caps.pbl_ba_pg_sz + PAGE_SHIFT)) / 8;
+ for (i = 0; i < hr_dev->caps.pbl_hop_num; i++)
+ pbl_size *= bt_size;
+ if (n > pbl_size) {
+ dev_err(dev,
+- " MR len %lld err. MR page num is limited to %d!\n",
++ " MR len %lld err. MR page num is limited to %lld!\n",
+ length, pbl_size);
+ ret = -EINVAL;
+ goto err_umem;
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 54d22868ffba..af24698ff226 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -522,7 +522,8 @@ static int hns_roce_qp_has_sq(struct ib_qp_init_attr *attr)
+ static int hns_roce_qp_has_rq(struct ib_qp_init_attr *attr)
+ {
+ if (attr->qp_type == IB_QPT_XRC_INI ||
+- attr->qp_type == IB_QPT_XRC_TGT || attr->srq)
++ attr->qp_type == IB_QPT_XRC_TGT || attr->srq ||
++ !attr->cap.max_recv_wr)
+ return 0;
+
+ return 1;
+diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+index 505fa3648762..93b16237b767 100644
+--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c
++++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+@@ -492,6 +492,8 @@ int qedr_iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ int i;
+
+ qp = idr_find(&dev->qpidr.idr, conn_param->qpn);
++ if (unlikely(!qp))
++ return -EINVAL;
+
+ laddr = (struct sockaddr_in *)&cm_id->m_local_addr;
+ raddr = (struct sockaddr_in *)&cm_id->m_remote_addr;
+diff --git a/drivers/infiniband/hw/qib/qib_sdma.c b/drivers/infiniband/hw/qib/qib_sdma.c
+index d0723d4aef5c..7424e88b0d91 100644
+--- a/drivers/infiniband/hw/qib/qib_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_sdma.c
+@@ -576,8 +576,10 @@ retry:
+ dw = (len + 3) >> 2;
+ addr = dma_map_single(&ppd->dd->pcidev->dev, sge->vaddr,
+ dw << 2, DMA_TO_DEVICE);
+- if (dma_mapping_error(&ppd->dd->pcidev->dev, addr))
++ if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) {
++ ret = -ENOMEM;
+ goto unmap;
++ }
+ sdmadesc[0] = 0;
+ make_sdma_desc(ppd, sdmadesc, (u64) addr, dw, dwoffset);
+ /* SDmaUseLargeBuf has to be set in every descriptor */
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+index b65d10b0a875..f4cb5cf26006 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+@@ -555,7 +555,7 @@ struct ib_ah *pvrdma_create_ah(struct ib_pd *pd, struct rdma_ah_attr *ah_attr,
+ if (!atomic_add_unless(&dev->num_ahs, 1, dev->dsr->caps.max_ah))
+ return ERR_PTR(-ENOMEM);
+
+- ah = kzalloc(sizeof(*ah), GFP_KERNEL);
++ ah = kzalloc(sizeof(*ah), GFP_ATOMIC);
+ if (!ah) {
+ atomic_dec(&dev->num_ahs);
+ return ERR_PTR(-ENOMEM);
+diff --git a/drivers/infiniband/sw/rxe/rxe_hw_counters.c b/drivers/infiniband/sw/rxe/rxe_hw_counters.c
+index 6aeb7a165e46..ea4542a9d69e 100644
+--- a/drivers/infiniband/sw/rxe/rxe_hw_counters.c
++++ b/drivers/infiniband/sw/rxe/rxe_hw_counters.c
+@@ -59,7 +59,7 @@ int rxe_ib_get_hw_stats(struct ib_device *ibdev,
+ return -EINVAL;
+
+ for (cnt = 0; cnt < ARRAY_SIZE(rxe_counter_name); cnt++)
+- stats->value[cnt] = dev->stats_counters[cnt];
++ stats->value[cnt] = atomic64_read(&dev->stats_counters[cnt]);
+
+ return ARRAY_SIZE(rxe_counter_name);
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index a0ec28d2b71a..6a75f96b9096 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -409,16 +409,16 @@ struct rxe_dev {
+ spinlock_t mmap_offset_lock; /* guard mmap_offset */
+ int mmap_offset;
+
+- u64 stats_counters[RXE_NUM_OF_COUNTERS];
++ atomic64_t stats_counters[RXE_NUM_OF_COUNTERS];
+
+ struct rxe_port port;
+ struct list_head list;
+ struct crypto_shash *tfm;
+ };
+
+-static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters cnt)
++static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters index)
+ {
+- rxe->stats_counters[cnt]++;
++ atomic64_inc(&rxe->stats_counters[index]);
+ }
+
+ static inline struct rxe_dev *to_rdev(struct ib_device *dev)
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index bc6a44a16445..03ee53adaacd 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2357,6 +2357,7 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
+
+ if (srp_post_send(ch, iu, len)) {
+ shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n");
++ scmnd->result = DID_ERROR << 16;
+ goto err_unmap;
+ }
+
+diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
+index 49d8d53e50b7..96f9b5397367 100644
+--- a/drivers/input/serio/gscps2.c
++++ b/drivers/input/serio/gscps2.c
+@@ -381,9 +381,9 @@ static int __init gscps2_probe(struct parisc_device *dev)
+ goto fail;
+ #endif
+
+- printk(KERN_INFO "serio: %s port at 0x%p irq %d @ %s\n",
++ pr_info("serio: %s port at 0x%08lx irq %d @ %s\n",
+ ps2port->port->name,
+- ps2port->addr,
++ hpa,
+ ps2port->padev->irq,
+ ps2port->port->phys);
+
+diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
+index 0b8a25c58d02..654252361653 100644
+--- a/drivers/input/serio/hp_sdc.c
++++ b/drivers/input/serio/hp_sdc.c
+@@ -884,8 +884,8 @@ static int __init hp_sdc_init(void)
+ "HP SDC NMI", &hp_sdc))
+ goto err2;
+
+- printk(KERN_INFO PREFIX "HP SDC at 0x%p, IRQ %d (NMI IRQ %d)\n",
+- (void *)hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
++ pr_info(PREFIX "HP SDC at 0x%08lx, IRQ %d (NMI IRQ %d)\n",
++ hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
+
+ hp_sdc_status_in8();
+ hp_sdc_data_in8();
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 1f2ed44de243..fe18804a5008 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -139,10 +139,14 @@ static struct lock_class_key reserved_rbtree_key;
+ static inline int match_hid_uid(struct device *dev,
+ struct acpihid_map_entry *entry)
+ {
++ struct acpi_device *adev = ACPI_COMPANION(dev);
+ const char *hid, *uid;
+
+- hid = acpi_device_hid(ACPI_COMPANION(dev));
+- uid = acpi_device_uid(ACPI_COMPANION(dev));
++ if (!adev)
++ return -ENODEV;
++
++ hid = acpi_device_hid(adev);
++ uid = acpi_device_uid(adev);
+
+ if (!hid || !(*hid))
+ return -ENODEV;
+diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c
+index 58bfafc34bc4..129b3656c453 100644
+--- a/drivers/mailbox/mailbox-test.c
++++ b/drivers/mailbox/mailbox-test.c
+@@ -363,22 +363,24 @@ static int mbox_test_probe(struct platform_device *pdev)
+
+ /* It's okay for MMIO to be NULL */
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- size = resource_size(res);
+ tdev->tx_mmio = devm_ioremap_resource(&pdev->dev, res);
+- if (PTR_ERR(tdev->tx_mmio) == -EBUSY)
++ if (PTR_ERR(tdev->tx_mmio) == -EBUSY) {
+ /* if reserved area in SRAM, try just ioremap */
++ size = resource_size(res);
+ tdev->tx_mmio = devm_ioremap(&pdev->dev, res->start, size);
+- else if (IS_ERR(tdev->tx_mmio))
++ } else if (IS_ERR(tdev->tx_mmio)) {
+ tdev->tx_mmio = NULL;
++ }
+
+ /* If specified, second reg entry is Rx MMIO */
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+- size = resource_size(res);
+ tdev->rx_mmio = devm_ioremap_resource(&pdev->dev, res);
+- if (PTR_ERR(tdev->rx_mmio) == -EBUSY)
++ if (PTR_ERR(tdev->rx_mmio) == -EBUSY) {
++ size = resource_size(res);
+ tdev->rx_mmio = devm_ioremap(&pdev->dev, res->start, size);
+- else if (IS_ERR(tdev->rx_mmio))
++ } else if (IS_ERR(tdev->rx_mmio)) {
+ tdev->rx_mmio = tdev->tx_mmio;
++ }
+
+ tdev->tx_channel = mbox_test_request_channel(pdev, "tx");
+ tdev->rx_channel = mbox_test_request_channel(pdev, "rx");
+diff --git a/drivers/mailbox/stm32-ipcc.c b/drivers/mailbox/stm32-ipcc.c
+index ca1f993c0de3..e31322225e93 100644
+--- a/drivers/mailbox/stm32-ipcc.c
++++ b/drivers/mailbox/stm32-ipcc.c
+@@ -50,6 +50,7 @@ struct stm32_ipcc {
+ void __iomem *reg_base;
+ void __iomem *reg_proc;
+ struct clk *clk;
++ spinlock_t lock; /* protect access to IPCC registers */
+ int irqs[IPCC_IRQ_NUM];
+ int wkp;
+ u32 proc_id;
+@@ -58,14 +59,24 @@ struct stm32_ipcc {
+ u32 xmr;
+ };
+
+-static inline void stm32_ipcc_set_bits(void __iomem *reg, u32 mask)
++static inline void stm32_ipcc_set_bits(spinlock_t *lock, void __iomem *reg,
++ u32 mask)
+ {
++ unsigned long flags;
++
++ spin_lock_irqsave(lock, flags);
+ writel_relaxed(readl_relaxed(reg) | mask, reg);
++ spin_unlock_irqrestore(lock, flags);
+ }
+
+-static inline void stm32_ipcc_clr_bits(void __iomem *reg, u32 mask)
++static inline void stm32_ipcc_clr_bits(spinlock_t *lock, void __iomem *reg,
++ u32 mask)
+ {
++ unsigned long flags;
++
++ spin_lock_irqsave(lock, flags);
+ writel_relaxed(readl_relaxed(reg) & ~mask, reg);
++ spin_unlock_irqrestore(lock, flags);
+ }
+
+ static irqreturn_t stm32_ipcc_rx_irq(int irq, void *data)
+@@ -92,7 +103,7 @@ static irqreturn_t stm32_ipcc_rx_irq(int irq, void *data)
+
+ mbox_chan_received_data(&ipcc->controller.chans[chan], NULL);
+
+- stm32_ipcc_set_bits(ipcc->reg_proc + IPCC_XSCR,
++ stm32_ipcc_set_bits(&ipcc->lock, ipcc->reg_proc + IPCC_XSCR,
+ RX_BIT_CHAN(chan));
+
+ ret = IRQ_HANDLED;
+@@ -121,7 +132,7 @@ static irqreturn_t stm32_ipcc_tx_irq(int irq, void *data)
+ dev_dbg(dev, "%s: chan:%d tx\n", __func__, chan);
+
+ /* mask 'tx channel free' interrupt */
+- stm32_ipcc_set_bits(ipcc->reg_proc + IPCC_XMR,
++ stm32_ipcc_set_bits(&ipcc->lock, ipcc->reg_proc + IPCC_XMR,
+ TX_BIT_CHAN(chan));
+
+ mbox_chan_txdone(&ipcc->controller.chans[chan], 0);
+@@ -141,10 +152,12 @@ static int stm32_ipcc_send_data(struct mbox_chan *link, void *data)
+ dev_dbg(ipcc->controller.dev, "%s: chan:%d\n", __func__, chan);
+
+ /* set channel n occupied */
+- stm32_ipcc_set_bits(ipcc->reg_proc + IPCC_XSCR, TX_BIT_CHAN(chan));
++ stm32_ipcc_set_bits(&ipcc->lock, ipcc->reg_proc + IPCC_XSCR,
++ TX_BIT_CHAN(chan));
+
+ /* unmask 'tx channel free' interrupt */
+- stm32_ipcc_clr_bits(ipcc->reg_proc + IPCC_XMR, TX_BIT_CHAN(chan));
++ stm32_ipcc_clr_bits(&ipcc->lock, ipcc->reg_proc + IPCC_XMR,
++ TX_BIT_CHAN(chan));
+
+ return 0;
+ }
+@@ -163,7 +176,8 @@ static int stm32_ipcc_startup(struct mbox_chan *link)
+ }
+
+ /* unmask 'rx channel occupied' interrupt */
+- stm32_ipcc_clr_bits(ipcc->reg_proc + IPCC_XMR, RX_BIT_CHAN(chan));
++ stm32_ipcc_clr_bits(&ipcc->lock, ipcc->reg_proc + IPCC_XMR,
++ RX_BIT_CHAN(chan));
+
+ return 0;
+ }
+@@ -175,7 +189,7 @@ static void stm32_ipcc_shutdown(struct mbox_chan *link)
+ controller);
+
+ /* mask rx/tx interrupt */
+- stm32_ipcc_set_bits(ipcc->reg_proc + IPCC_XMR,
++ stm32_ipcc_set_bits(&ipcc->lock, ipcc->reg_proc + IPCC_XMR,
+ RX_BIT_CHAN(chan) | TX_BIT_CHAN(chan));
+
+ clk_disable_unprepare(ipcc->clk);
+@@ -208,6 +222,8 @@ static int stm32_ipcc_probe(struct platform_device *pdev)
+ if (!ipcc)
+ return -ENOMEM;
+
++ spin_lock_init(&ipcc->lock);
++
+ /* proc_id */
+ if (of_property_read_u32(np, "st,proc-id", &ipcc->proc_id)) {
+ dev_err(dev, "Missing st,proc-id\n");
+@@ -259,9 +275,10 @@ static int stm32_ipcc_probe(struct platform_device *pdev)
+ }
+
+ /* mask and enable rx/tx irq */
+- stm32_ipcc_set_bits(ipcc->reg_proc + IPCC_XMR,
++ stm32_ipcc_set_bits(&ipcc->lock, ipcc->reg_proc + IPCC_XMR,
+ RX_BIT_MASK | TX_BIT_MASK);
+- stm32_ipcc_set_bits(ipcc->reg_proc + IPCC_XCR, XCR_RXOIE | XCR_TXOIE);
++ stm32_ipcc_set_bits(&ipcc->lock, ipcc->reg_proc + IPCC_XCR,
++ XCR_RXOIE | XCR_TXOIE);
+
+ /* wakeup */
+ if (of_property_read_bool(np, "wakeup-source")) {
+diff --git a/drivers/md/bcache/debug.c b/drivers/md/bcache/debug.c
+index 06da66b2488a..8c53d874ada4 100644
+--- a/drivers/md/bcache/debug.c
++++ b/drivers/md/bcache/debug.c
+@@ -249,8 +249,7 @@ void bch_debug_init_cache_set(struct cache_set *c)
+
+ void bch_debug_exit(void)
+ {
+- if (!IS_ERR_OR_NULL(bcache_debug))
+- debugfs_remove_recursive(bcache_debug);
++ debugfs_remove_recursive(bcache_debug);
+ }
+
+ void __init bch_debug_init(struct kobject *kobj)
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 4998b4cae9c1..14d381cc6d74 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1491,8 +1491,7 @@ static void cache_set_free(struct closure *cl)
+ struct cache *ca;
+ unsigned int i;
+
+- if (!IS_ERR_OR_NULL(c->debug))
+- debugfs_remove(c->debug);
++ debugfs_remove(c->debug);
+
+ bch_open_buckets_free(c);
+ bch_btree_cache_free(c);
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index ba5395fd386d..b5fc3c6c7178 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -781,7 +781,7 @@ void bch_cached_dev_writeback_init(struct cached_dev *dc)
+ bch_keybuf_init(&dc->writeback_keys);
+
+ dc->writeback_metadata = true;
+- dc->writeback_running = true;
++ dc->writeback_running = false;
+ dc->writeback_percent = 10;
+ dc->writeback_delay = 30;
+ atomic_long_set(&dc->writeback_rate.rate, 1024);
+@@ -810,6 +810,7 @@ int bch_cached_dev_writeback_start(struct cached_dev *dc)
+ destroy_workqueue(dc->writeback_write_wq);
+ return PTR_ERR(dc->writeback_thread);
+ }
++ dc->writeback_running = true;
+
+ WARN_ON(test_and_set_bit(BCACHE_DEV_WB_RUNNING, &dc->disk.flags));
+ schedule_delayed_work(&dc->writeback_rate_update,
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index b86d2439ffc7..2fcf62fb2844 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -287,20 +287,31 @@ static void flakey_map_bio(struct dm_target *ti, struct bio *bio)
+
+ static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc)
+ {
+- unsigned bio_bytes = bio_cur_bytes(bio);
+- char *data = bio_data(bio);
++ unsigned int corrupt_bio_byte = fc->corrupt_bio_byte - 1;
++
++ struct bvec_iter iter;
++ struct bio_vec bvec;
++
++ if (!bio_has_data(bio))
++ return;
+
+ /*
+- * Overwrite the Nth byte of the data returned.
++ * Overwrite the Nth byte of the bio's data, on whichever page
++ * it falls.
+ */
+- if (data && bio_bytes >= fc->corrupt_bio_byte) {
+- data[fc->corrupt_bio_byte - 1] = fc->corrupt_bio_value;
+-
+- DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
+- "(rw=%c bi_opf=%u bi_sector=%llu cur_bytes=%u)\n",
+- bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
+- (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf,
+- (unsigned long long)bio->bi_iter.bi_sector, bio_bytes);
++ bio_for_each_segment(bvec, bio, iter) {
++ if (bio_iter_len(bio, iter) > corrupt_bio_byte) {
++ char *segment = (page_address(bio_iter_page(bio, iter))
++ + bio_iter_offset(bio, iter));
++ segment[corrupt_bio_byte] = fc->corrupt_bio_value;
++ DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
++ "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n",
++ bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
++ (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf,
++ (unsigned long long)bio->bi_iter.bi_sector, bio->bi_iter.bi_size);
++ break;
++ }
++ corrupt_bio_byte -= bio_iter_len(bio, iter);
+ }
+ }
+
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 6c9b54288261..23de59a692c5 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -3690,8 +3690,7 @@ static int raid_message(struct dm_target *ti, unsigned int argc, char **argv,
+ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+ md_reap_sync_thread(mddev);
+ }
+- } else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
+- test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
++ } else if (decipher_sync_action(mddev, mddev->recovery) != st_idle)
+ return -EBUSY;
+ else if (!strcasecmp(argv[0], "resync"))
+ ; /* MD_RECOVERY_NEEDED set below */
+diff --git a/drivers/media/platform/atmel/atmel-isc.c b/drivers/media/platform/atmel/atmel-isc.c
+index d89e14524d42..1fd078257670 100644
+--- a/drivers/media/platform/atmel/atmel-isc.c
++++ b/drivers/media/platform/atmel/atmel-isc.c
+@@ -1895,6 +1895,8 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
+ struct vb2_queue *q = &isc->vb2_vidq;
+ int ret;
+
++ INIT_WORK(&isc->awb_work, isc_awb_work);
++
+ ret = v4l2_device_register_subdev_nodes(&isc->v4l2_dev);
+ if (ret < 0) {
+ v4l2_err(&isc->v4l2_dev, "Failed to register subdev nodes\n");
+@@ -1948,8 +1950,6 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier)
+ return ret;
+ }
+
+- INIT_WORK(&isc->awb_work, isc_awb_work);
+-
+ /* Register video device */
+ strlcpy(vdev->name, ATMEL_ISC_NAME, sizeof(vdev->name));
+ vdev->release = video_device_release_empty;
+@@ -2062,8 +2062,11 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc)
+ break;
+ }
+
+- subdev_entity->asd = devm_kzalloc(dev,
+- sizeof(*subdev_entity->asd), GFP_KERNEL);
++ /* asd will be freed by the subsystem once it's added to the
++ * notifier list
++ */
++ subdev_entity->asd = kzalloc(sizeof(*subdev_entity->asd),
++ GFP_KERNEL);
+ if (!subdev_entity->asd) {
+ of_node_put(rem);
+ ret = -ENOMEM;
+@@ -2209,6 +2212,7 @@ static int atmel_isc_probe(struct platform_device *pdev)
+ &subdev_entity->notifier);
+ if (ret) {
+ dev_err(dev, "fail to register async notifier\n");
++ kfree(subdev_entity->asd);
+ goto cleanup_subdev;
+ }
+
+diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c
+index 1d9c028e52cb..18d0b5641789 100644
+--- a/drivers/media/platform/stm32/stm32-dcmi.c
++++ b/drivers/media/platform/stm32/stm32-dcmi.c
+@@ -164,6 +164,9 @@ struct stm32_dcmi {
+ int errors_count;
+ int overrun_count;
+ int buffers_count;
++
++ /* Ensure DMA operations atomicity */
++ struct mutex dma_lock;
+ };
+
+ static inline struct stm32_dcmi *notifier_to_dcmi(struct v4l2_async_notifier *n)
+@@ -314,6 +317,13 @@ static int dcmi_start_dma(struct stm32_dcmi *dcmi,
+ return ret;
+ }
+
++ /*
++ * Avoid call of dmaengine_terminate_all() between
++ * dmaengine_prep_slave_single() and dmaengine_submit()
++ * by locking the whole DMA submission sequence
++ */
++ mutex_lock(&dcmi->dma_lock);
++
+ /* Prepare a DMA transaction */
+ desc = dmaengine_prep_slave_single(dcmi->dma_chan, buf->paddr,
+ buf->size,
+@@ -322,6 +332,7 @@ static int dcmi_start_dma(struct stm32_dcmi *dcmi,
+ if (!desc) {
+ dev_err(dcmi->dev, "%s: DMA dmaengine_prep_slave_single failed for buffer phy=%pad size=%zu\n",
+ __func__, &buf->paddr, buf->size);
++ mutex_unlock(&dcmi->dma_lock);
+ return -EINVAL;
+ }
+
+@@ -333,9 +344,12 @@ static int dcmi_start_dma(struct stm32_dcmi *dcmi,
+ dcmi->dma_cookie = dmaengine_submit(desc);
+ if (dma_submit_error(dcmi->dma_cookie)) {
+ dev_err(dcmi->dev, "%s: DMA submission failed\n", __func__);
++ mutex_unlock(&dcmi->dma_lock);
+ return -ENXIO;
+ }
+
++ mutex_unlock(&dcmi->dma_lock);
++
+ dma_async_issue_pending(dcmi->dma_chan);
+
+ return 0;
+@@ -570,9 +584,9 @@ static int dcmi_start_streaming(struct vb2_queue *vq, unsigned int count)
+ int ret;
+
+ ret = pm_runtime_get_sync(dcmi->dev);
+- if (ret) {
+- dev_err(dcmi->dev, "%s: Failed to start streaming, cannot get sync\n",
+- __func__);
++ if (ret < 0) {
++ dev_err(dcmi->dev, "%s: Failed to start streaming, cannot get sync (%d)\n",
++ __func__, ret);
+ goto err_release_buffers;
+ }
+
+@@ -717,7 +731,9 @@ static void dcmi_stop_streaming(struct vb2_queue *vq)
+ spin_unlock_irq(&dcmi->irqlock);
+
+ /* Stop all pending DMA operations */
++ mutex_lock(&dcmi->dma_lock);
+ dmaengine_terminate_all(dcmi->dma_chan);
++ mutex_unlock(&dcmi->dma_lock);
+
+ pm_runtime_put(dcmi->dev);
+
+@@ -1719,6 +1735,7 @@ static int dcmi_probe(struct platform_device *pdev)
+
+ spin_lock_init(&dcmi->irqlock);
+ mutex_init(&dcmi->lock);
++ mutex_init(&dcmi->dma_lock);
+ init_completion(&dcmi->complete);
+ INIT_LIST_HEAD(&dcmi->buffers);
+
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
+index 0986572bbe88..f4ebff347d7a 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -1145,6 +1145,7 @@ void v4l2_ctrl_fill(u32 id, const char **name, enum v4l2_ctrl_type *type,
+ case V4L2_CID_FLASH_STROBE_STOP:
+ case V4L2_CID_AUTO_FOCUS_START:
+ case V4L2_CID_AUTO_FOCUS_STOP:
++ case V4L2_CID_DO_WHITE_BALANCE:
+ *type = V4L2_CTRL_TYPE_BUTTON;
+ *flags |= V4L2_CTRL_FLAG_WRITE_ONLY |
+ V4L2_CTRL_FLAG_EXECUTE_ON_WRITE;
+diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
+index c215287e80cf..1c6a7c16e0c1 100644
+--- a/drivers/memory/omap-gpmc.c
++++ b/drivers/memory/omap-gpmc.c
+@@ -21,6 +21,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/io.h>
+ #include <linux/gpio/driver.h>
++#include <linux/gpio/consumer.h> /* GPIO descriptor enum */
+ #include <linux/interrupt.h>
+ #include <linux/irqdomain.h>
+ #include <linux/platform_device.h>
+diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
+index c383322ec2ba..bb2e1387b119 100644
+--- a/drivers/misc/mei/bus.c
++++ b/drivers/misc/mei/bus.c
+@@ -883,15 +883,16 @@ static const struct device_type mei_cl_device_type = {
+
+ /**
+ * mei_cl_bus_set_name - set device name for me client device
++ * <controller>-<client device>
++ * Example: 0000:00:16.0-55213584-9a29-4916-badf-0fb7ed682aeb
+ *
+ * @cldev: me client device
+ */
+ static inline void mei_cl_bus_set_name(struct mei_cl_device *cldev)
+ {
+- dev_set_name(&cldev->dev, "mei:%s:%pUl:%02X",
+- cldev->name,
+- mei_me_cl_uuid(cldev->me_cl),
+- mei_me_cl_ver(cldev->me_cl));
++ dev_set_name(&cldev->dev, "%s-%pUl",
++ dev_name(cldev->bus->dev),
++ mei_me_cl_uuid(cldev->me_cl));
+ }
+
+ /**
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index f85aa3f4042d..9c4042420022 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -141,6 +141,7 @@
+
+ #define MEI_DEV_ID_CMP_LP 0x02e0 /* Comet Point LP */
+ #define MEI_DEV_ID_CMP_LP_3 0x02e4 /* Comet Point LP 3 (iTouch) */
++#define MEI_DEV_ID_CMP_V 0xA3BA /* Comet Point Lake V */
+
+ #define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
+
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index 28cdd87851cb..41a10e392839 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -107,6 +107,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP, MEI_ME_PCH12_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP_3, MEI_ME_PCH8_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_V, MEI_ME_PCH12_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index eee004fb3c3e..527ab15c421f 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2384,12 +2384,6 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
+ snprintf(md->disk->disk_name, sizeof(md->disk->disk_name),
+ "mmcblk%u%s", card->host->index, subname ? subname : "");
+
+- if (mmc_card_mmc(card))
+- blk_queue_logical_block_size(md->queue.queue,
+- card->ext_csd.data_sector_size);
+- else
+- blk_queue_logical_block_size(md->queue.queue, 512);
+-
+ set_capacity(md->disk, size);
+
+ if (mmc_host_cmd23(card->host)) {
+diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
+index 18aae28845ec..becc6594a8a4 100644
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -355,6 +355,7 @@ static void mmc_setup_queue(struct mmc_queue *mq, struct mmc_card *card)
+ {
+ struct mmc_host *host = card->host;
+ u64 limit = BLK_BOUNCE_HIGH;
++ unsigned block_size = 512;
+
+ if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
+ limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
+@@ -368,7 +369,13 @@ static void mmc_setup_queue(struct mmc_queue *mq, struct mmc_card *card)
+ blk_queue_max_hw_sectors(mq->queue,
+ min(host->max_blk_count, host->max_req_size / 512));
+ blk_queue_max_segments(mq->queue, host->max_segs);
+- blk_queue_max_segment_size(mq->queue, host->max_seg_size);
++
++ if (mmc_card_mmc(card))
++ block_size = card->ext_csd.data_sector_size;
++
++ blk_queue_logical_block_size(mq->queue, block_size);
++ blk_queue_max_segment_size(mq->queue,
++ round_down(host->max_seg_size, block_size));
+
+ INIT_WORK(&mq->recovery_work, mmc_mq_recovery_handler);
+ INIT_WORK(&mq->complete_work, mmc_blk_mq_complete_work);
+diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
+index ddd98cdd33bc..72f34a58928c 100644
+--- a/drivers/mmc/host/meson-gx-mmc.c
++++ b/drivers/mmc/host/meson-gx-mmc.c
+@@ -21,6 +21,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
++#include <linux/delay.h>
+ #include <linux/device.h>
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+@@ -90,9 +91,11 @@
+ #define CFG_CLK_ALWAYS_ON BIT(18)
+ #define CFG_CHK_DS BIT(20)
+ #define CFG_AUTO_CLK BIT(23)
++#define CFG_ERR_ABORT BIT(27)
+
+ #define SD_EMMC_STATUS 0x48
+ #define STATUS_BUSY BIT(31)
++#define STATUS_DESC_BUSY BIT(30)
+ #define STATUS_DATI GENMASK(23, 16)
+
+ #define SD_EMMC_IRQ_EN 0x4c
+@@ -930,6 +933,7 @@ static void meson_mmc_start_cmd(struct mmc_host *mmc, struct mmc_command *cmd)
+
+ cmd_cfg |= FIELD_PREP(CMD_CFG_CMD_INDEX_MASK, cmd->opcode);
+ cmd_cfg |= CMD_CFG_OWNER; /* owned by CPU */
++ cmd_cfg |= CMD_CFG_ERROR; /* stop in case of error */
+
+ meson_mmc_set_response_bits(cmd, &cmd_cfg);
+
+@@ -1024,6 +1028,17 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)
+ u32 irq_en, status, raw_status;
+ irqreturn_t ret = IRQ_NONE;
+
++ irq_en = readl(host->regs + SD_EMMC_IRQ_EN);
++ raw_status = readl(host->regs + SD_EMMC_STATUS);
++ status = raw_status & irq_en;
++
++ if (!status) {
++ dev_dbg(host->dev,
++ "Unexpected IRQ! irq_en 0x%08x - status 0x%08x\n",
++ irq_en, raw_status);
++ return IRQ_NONE;
++ }
++
+ if (WARN_ON(!host) || WARN_ON(!host->cmd))
+ return IRQ_NONE;
+
+@@ -1031,22 +1046,18 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)
+
+ cmd = host->cmd;
+ data = cmd->data;
+- irq_en = readl(host->regs + SD_EMMC_IRQ_EN);
+- raw_status = readl(host->regs + SD_EMMC_STATUS);
+- status = raw_status & irq_en;
+-
+ cmd->error = 0;
+ if (status & IRQ_CRC_ERR) {
+ dev_dbg(host->dev, "CRC Error - status 0x%08x\n", status);
+ cmd->error = -EILSEQ;
+- ret = IRQ_HANDLED;
++ ret = IRQ_WAKE_THREAD;
+ goto out;
+ }
+
+ if (status & IRQ_TIMEOUTS) {
+ dev_dbg(host->dev, "Timeout - status 0x%08x\n", status);
+ cmd->error = -ETIMEDOUT;
+- ret = IRQ_HANDLED;
++ ret = IRQ_WAKE_THREAD;
+ goto out;
+ }
+
+@@ -1071,17 +1082,49 @@ out:
+ /* ack all enabled interrupts */
+ writel(irq_en, host->regs + SD_EMMC_STATUS);
+
++ if (cmd->error) {
++ /* Stop desc in case of errors */
++ u32 start = readl(host->regs + SD_EMMC_START);
++
++ start &= ~START_DESC_BUSY;
++ writel(start, host->regs + SD_EMMC_START);
++ }
++
+ if (ret == IRQ_HANDLED)
+ meson_mmc_request_done(host->mmc, cmd->mrq);
+- else if (ret == IRQ_NONE)
+- dev_warn(host->dev,
+- "Unexpected IRQ! status=0x%08x, irq_en=0x%08x\n",
+- raw_status, irq_en);
+
+ spin_unlock(&host->lock);
+ return ret;
+ }
+
++static int meson_mmc_wait_desc_stop(struct meson_host *host)
++{
++ int loop;
++ u32 status;
++
++ /*
++ * It may sometimes take a while for it to actually halt. Here, we
++ * are giving it 5ms to comply
++ *
++ * If we don't confirm the descriptor is stopped, it might raise new
++ * IRQs after we have called mmc_request_done() which is bad.
++ */
++ for (loop = 50; loop; loop--) {
++ status = readl(host->regs + SD_EMMC_STATUS);
++ if (status & (STATUS_BUSY | STATUS_DESC_BUSY))
++ udelay(100);
++ else
++ break;
++ }
++
++ if (status & (STATUS_BUSY | STATUS_DESC_BUSY)) {
++ dev_err(host->dev, "Timed out waiting for host to stop\n");
++ return -ETIMEDOUT;
++ }
++
++ return 0;
++}
++
+ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id)
+ {
+ struct meson_host *host = dev_id;
+@@ -1092,6 +1135,13 @@ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id)
+ if (WARN_ON(!cmd))
+ return IRQ_NONE;
+
++ if (cmd->error) {
++ meson_mmc_wait_desc_stop(host);
++ meson_mmc_request_done(host->mmc, cmd->mrq);
++
++ return IRQ_HANDLED;
++ }
++
+ data = cmd->data;
+ if (meson_mmc_bounce_buf_read(data)) {
+ xfer_bytes = data->blksz * data->blocks;
+@@ -1132,6 +1182,9 @@ static void meson_mmc_cfg_init(struct meson_host *host)
+ cfg |= FIELD_PREP(CFG_RC_CC_MASK, ilog2(SD_EMMC_CFG_CMD_GAP));
+ cfg |= FIELD_PREP(CFG_BLK_LEN_MASK, ilog2(SD_EMMC_CFG_BLK_SIZE));
+
++ /* abort chain on R/W errors */
++ cfg |= CFG_ERR_ABORT;
++
+ writel(cfg, host->regs + SD_EMMC_CFG);
+ }
+
+diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h
+index 9887bda317cd..b31c868019ad 100644
+--- a/drivers/mtd/mtdcore.h
++++ b/drivers/mtd/mtdcore.h
+@@ -7,7 +7,7 @@
+ extern struct mutex mtd_table_mutex;
+
+ struct mtd_info *__mtd_next_device(int i);
+-int add_mtd_device(struct mtd_info *mtd);
++int __must_check add_mtd_device(struct mtd_info *mtd);
+ int del_mtd_device(struct mtd_info *mtd);
+ int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int);
+ int del_mtd_partitions(struct mtd_info *);
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index 0bbb23b014f1..10c53364aa70 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -612,10 +612,21 @@ int mtd_add_partition(struct mtd_info *parent, const char *name,
+ list_add(&new->list, &mtd_partitions);
+ mutex_unlock(&mtd_partitions_mutex);
+
+- add_mtd_device(&new->mtd);
++ ret = add_mtd_device(&new->mtd);
++ if (ret)
++ goto err_remove_part;
+
+ mtd_add_partition_attrs(new);
+
++ return 0;
++
++err_remove_part:
++ mutex_lock(&mtd_partitions_mutex);
++ list_del(&new->list);
++ mutex_unlock(&mtd_partitions_mutex);
++
++ free_partition(new);
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(mtd_add_partition);
+@@ -706,22 +717,31 @@ int add_mtd_partitions(struct mtd_info *master,
+ {
+ struct mtd_part *slave;
+ uint64_t cur_offset = 0;
+- int i;
++ int i, ret;
+
+ printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name);
+
+ for (i = 0; i < nbparts; i++) {
+ slave = allocate_partition(master, parts + i, i, cur_offset);
+ if (IS_ERR(slave)) {
+- del_mtd_partitions(master);
+- return PTR_ERR(slave);
++ ret = PTR_ERR(slave);
++ goto err_del_partitions;
+ }
+
+ mutex_lock(&mtd_partitions_mutex);
+ list_add(&slave->list, &mtd_partitions);
+ mutex_unlock(&mtd_partitions_mutex);
+
+- add_mtd_device(&slave->mtd);
++ ret = add_mtd_device(&slave->mtd);
++ if (ret) {
++ mutex_lock(&mtd_partitions_mutex);
++ list_del(&slave->list);
++ mutex_unlock(&mtd_partitions_mutex);
++
++ free_partition(slave);
++ goto err_del_partitions;
++ }
++
+ mtd_add_partition_attrs(slave);
+ /* Look for subpartitions */
+ parse_mtd_partitions(&slave->mtd, parts[i].types, NULL);
+@@ -730,6 +750,11 @@ int add_mtd_partitions(struct mtd_info *master,
+ }
+
+ return 0;
++
++err_del_partitions:
++ del_mtd_partitions(master);
++
++ return ret;
+ }
+
+ static DEFINE_SPINLOCK(part_parser_lock);
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index 32e95af486a2..ea022712edee 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -1826,7 +1826,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
+
+ ret = of_property_read_u32(np, "#size-cells", &val);
+ if (ret) {
+- dev_err(dev, "missing #address-cells property\n");
++ dev_err(dev, "missing #size-cells property\n");
+ return ret;
+ }
+
+diff --git a/drivers/mtd/nand/raw/atmel/pmecc.c b/drivers/mtd/nand/raw/atmel/pmecc.c
+index 555a74e15269..9d3997840889 100644
+--- a/drivers/mtd/nand/raw/atmel/pmecc.c
++++ b/drivers/mtd/nand/raw/atmel/pmecc.c
+@@ -876,23 +876,32 @@ static struct atmel_pmecc *atmel_pmecc_get_by_node(struct device *userdev,
+ {
+ struct platform_device *pdev;
+ struct atmel_pmecc *pmecc, **ptr;
++ int ret;
+
+ pdev = of_find_device_by_node(np);
+- if (!pdev || !platform_get_drvdata(pdev))
++ if (!pdev)
+ return ERR_PTR(-EPROBE_DEFER);
++ pmecc = platform_get_drvdata(pdev);
++ if (!pmecc) {
++ ret = -EPROBE_DEFER;
++ goto err_put_device;
++ }
+
+ ptr = devres_alloc(devm_atmel_pmecc_put, sizeof(*ptr), GFP_KERNEL);
+- if (!ptr)
+- return ERR_PTR(-ENOMEM);
+-
+- get_device(&pdev->dev);
+- pmecc = platform_get_drvdata(pdev);
++ if (!ptr) {
++ ret = -ENOMEM;
++ goto err_put_device;
++ }
+
+ *ptr = pmecc;
+
+ devres_add(userdev, ptr);
+
+ return pmecc;
++
++err_put_device:
++ put_device(&pdev->dev);
++ return ERR_PTR(ret);
+ }
+
+ static const int atmel_pmecc_strengths[] = { 2, 4, 8, 12, 24, 32 };
+diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
+index 1f0b7ee38df5..5b5f4d25a3e1 100644
+--- a/drivers/mtd/nand/raw/sunxi_nand.c
++++ b/drivers/mtd/nand/raw/sunxi_nand.c
+@@ -1397,7 +1397,7 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct mtd_info *mtd,
+ sunxi_nfc_randomizer_enable(mtd);
+
+ writel((NAND_CMD_RNDIN << 8) | NAND_CMD_PAGEPROG,
+- nfc->regs + NFC_REG_RCMD_SET);
++ nfc->regs + NFC_REG_WCMD_SET);
+
+ dma_async_issue_pending(nfc->dmac);
+
+diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
+index f028277fb1ce..2e183425facd 100644
+--- a/drivers/mtd/spi-nor/spi-nor.c
++++ b/drivers/mtd/spi-nor/spi-nor.c
+@@ -2459,7 +2459,7 @@ static int spi_nor_init_params(struct spi_nor *nor,
+ memset(params, 0, sizeof(*params));
+
+ /* Set SPI NOR sizes. */
+- params->size = info->sector_size * info->n_sectors;
++ params->size = (u64)info->sector_size * info->n_sectors;
+ params->page_size = info->page_size;
+
+ /* (Fast) Read settings. */
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index d2a726654ff1..c120c8761fcd 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -1101,10 +1101,10 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
+ ubi_wl_close(ubi);
+ ubi_free_internal_volumes(ubi);
+ vfree(ubi->vtbl);
+- put_mtd_device(ubi->mtd);
+ vfree(ubi->peb_buf);
+ vfree(ubi->fm_buf);
+ ubi_msg(ubi, "mtd%d is detached", ubi->mtd->index);
++ put_mtd_device(ubi->mtd);
+ put_device(&ubi->dev);
+ return 0;
+ }
+diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
+index e9e9ecbcedcc..0b8f0c46268d 100644
+--- a/drivers/mtd/ubi/kapi.c
++++ b/drivers/mtd/ubi/kapi.c
+@@ -227,9 +227,9 @@ out_unlock:
+ out_free:
+ kfree(desc);
+ out_put_ubi:
+- ubi_put_device(ubi);
+ ubi_err(ubi, "cannot open device %d, volume %d, error %d",
+ ubi_num, vol_id, err);
++ ubi_put_device(ubi);
+ return ERR_PTR(err);
+ }
+ EXPORT_SYMBOL_GPL(ubi_open_volume);
+diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
+index 619bf1498a66..0652caad57ec 100644
+--- a/drivers/net/Kconfig
++++ b/drivers/net/Kconfig
+@@ -197,9 +197,9 @@ config VXLAN
+
+ config GENEVE
+ tristate "Generic Network Virtualization Encapsulation"
+- depends on INET && NET_UDP_TUNNEL
++ depends on INET
+ depends on IPV6 || !IPV6
+- select NET_IP_TUNNEL
++ select NET_UDP_TUNNEL
+ select GRO_CELLS
+ ---help---
+ This allows one to create geneve virtual interfaces that provide
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 9b61bfbea6cd..24c6015f6c92 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -52,6 +52,7 @@
+ #define CONTROL_EX_PDR BIT(8)
+
+ /* control register */
++#define CONTROL_SWR BIT(15)
+ #define CONTROL_TEST BIT(7)
+ #define CONTROL_CCE BIT(6)
+ #define CONTROL_DISABLE_AR BIT(5)
+@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ IF_MCONT_RCV_EOB);
+ }
+
++static int c_can_software_reset(struct net_device *dev)
++{
++ struct c_can_priv *priv = netdev_priv(dev);
++ int retry = 0;
++
++ if (priv->type != BOSCH_D_CAN)
++ return 0;
++
++ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT);
++ while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) {
++ msleep(20);
++ if (retry++ > 100) {
++ netdev_err(dev, "CCTRL: software reset failed\n");
++ return -EIO;
++ }
++ }
++
++ return 0;
++}
++
+ /*
+ * Configure C_CAN chip:
+ * - enable/disable auto-retransmission
+@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ static int c_can_chip_config(struct net_device *dev)
+ {
+ struct c_can_priv *priv = netdev_priv(dev);
++ int err;
++
++ err = c_can_software_reset(dev);
++ if (err)
++ return err;
+
+ /* enable automatic retransmission */
+ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR);
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 581e84d8e2c8..bfe13c6627be 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -566,6 +566,7 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ struct can_frame *cf;
+ bool rx_errors = false, tx_errors = false;
+ u32 timestamp;
++ int err;
+
+ timestamp = priv->read(®s->timer) << 16;
+
+@@ -614,7 +615,9 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ if (tx_errors)
+ dev->stats.tx_errors++;
+
+- can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ if (err)
++ dev->stats.rx_fifo_errors++;
+ }
+
+ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+@@ -627,6 +630,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ int flt;
+ struct can_berr_counter bec;
+ u32 timestamp;
++ int err;
+
+ timestamp = priv->read(®s->timer) << 16;
+
+@@ -658,7 +662,9 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ if (unlikely(new_state == CAN_STATE_BUS_OFF))
+ can_bus_off(dev);
+
+- can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ if (err)
++ dev->stats.rx_fifo_errors++;
+ }
+
+ static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload)
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 6cf0d0bc1e8d..5f7e97d54733 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -116,37 +116,95 @@ static int can_rx_offload_compare(struct sk_buff *a, struct sk_buff *b)
+ return cb_b->timestamp - cb_a->timestamp;
+ }
+
+-static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
++/**
++ * can_rx_offload_offload_one() - Read one CAN frame from HW
++ * @offload: pointer to rx_offload context
++ * @n: number of mailbox to read
++ *
++ * The task of this function is to read a CAN frame from mailbox @n
++ * from the device and return the mailbox's content as a struct
++ * sk_buff.
++ *
++ * If the struct can_rx_offload::skb_queue exceeds the maximal queue
++ * length (struct can_rx_offload::skb_queue_len_max) or no skb can be
++ * allocated, the mailbox contents is discarded by reading it into an
++ * overflow buffer. This way the mailbox is marked as free by the
++ * driver.
++ *
++ * Return: A pointer to skb containing the CAN frame on success.
++ *
++ * NULL if the mailbox @n is empty.
++ *
++ * ERR_PTR() in case of an error
++ */
++static struct sk_buff *
++can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
+ {
+- struct sk_buff *skb = NULL;
++ struct sk_buff *skb = NULL, *skb_error = NULL;
+ struct can_rx_offload_cb *cb;
+ struct can_frame *cf;
+ int ret;
+
+- /* If queue is full or skb not available, read to discard mailbox */
+- if (likely(skb_queue_len(&offload->skb_queue) <=
+- offload->skb_queue_len_max))
++ if (likely(skb_queue_len(&offload->skb_queue) <
++ offload->skb_queue_len_max)) {
+ skb = alloc_can_skb(offload->dev, &cf);
++ if (unlikely(!skb))
++ skb_error = ERR_PTR(-ENOMEM); /* skb alloc failed */
++ } else {
++ skb_error = ERR_PTR(-ENOBUFS); /* skb_queue is full */
++ }
+
+- if (!skb) {
++ /* If queue is full or skb not available, drop by reading into
++ * overflow buffer.
++ */
++ if (unlikely(skb_error)) {
+ struct can_frame cf_overflow;
+ u32 timestamp;
+
+ ret = offload->mailbox_read(offload, &cf_overflow,
+ ×tamp, n);
+- if (ret)
+- offload->dev->stats.rx_dropped++;
+
+- return NULL;
++ /* Mailbox was empty. */
++ if (unlikely(!ret))
++ return NULL;
++
++ /* Mailbox has been read and we're dropping it or
++ * there was a problem reading the mailbox.
++ *
++ * Increment error counters in any case.
++ */
++ offload->dev->stats.rx_dropped++;
++ offload->dev->stats.rx_fifo_errors++;
++
++ /* There was a problem reading the mailbox, propagate
++ * error value.
++ */
++ if (unlikely(ret < 0))
++ return ERR_PTR(ret);
++
++ return skb_error;
+ }
+
+ cb = can_rx_offload_get_cb(skb);
+ ret = offload->mailbox_read(offload, cf, &cb->timestamp, n);
+- if (!ret) {
++
++ /* Mailbox was empty. */
++ if (unlikely(!ret)) {
+ kfree_skb(skb);
+ return NULL;
+ }
+
++ /* There was a problem reading the mailbox, propagate error value. */
++ if (unlikely(ret < 0)) {
++ kfree_skb(skb);
++
++ offload->dev->stats.rx_dropped++;
++ offload->dev->stats.rx_fifo_errors++;
++
++ return ERR_PTR(ret);
++ }
++
++ /* Mailbox was read. */
+ return skb;
+ }
+
+@@ -166,8 +224,8 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
+ continue;
+
+ skb = can_rx_offload_offload_one(offload, i);
+- if (!skb)
+- break;
++ if (IS_ERR_OR_NULL(skb))
++ continue;
+
+ __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
+ }
+@@ -197,7 +255,13 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
+ struct sk_buff *skb;
+ int received = 0;
+
+- while ((skb = can_rx_offload_offload_one(offload, 0))) {
++ while (1) {
++ skb = can_rx_offload_offload_one(offload, 0);
++ if (IS_ERR(skb))
++ continue;
++ if (!skb)
++ break;
++
+ skb_queue_tail(&offload->skb_queue, skb);
+ received++;
+ }
+@@ -261,8 +325,10 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+ struct sk_buff *skb)
+ {
+ if (skb_queue_len(&offload->skb_queue) >
+- offload->skb_queue_len_max)
+- return -ENOMEM;
++ offload->skb_queue_len_max) {
++ kfree_skb(skb);
++ return -ENOBUFS;
++ }
+
+ skb_queue_tail(&offload->skb_queue, skb);
+ can_rx_offload_schedule(offload);
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index de8d9dceb123..0b0dd3f096dc 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -773,6 +773,7 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
+ if (priv->after_suspend) {
+ mcp251x_hw_reset(spi);
+ mcp251x_setup(net, spi);
++ priv->force_quit = 0;
+ if (priv->after_suspend & AFTER_SUSPEND_RESTART) {
+ mcp251x_set_normal_mode(spi);
+ } else if (priv->after_suspend & AFTER_SUSPEND_UP) {
+@@ -784,7 +785,6 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
+ mcp251x_hw_sleep(spi);
+ }
+ priv->after_suspend = 0;
+- priv->force_quit = 0;
+ }
+
+ if (priv->restart_tx) {
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
+index 61f33c2fb1cd..215cd74800df 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
+@@ -444,8 +444,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+ if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) {
+ /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ new_state = CAN_STATE_ERROR_ACTIVE;
++ break;
+ }
+ break;
+
+@@ -468,9 +468,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+
+ if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) {
+- /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ /* no error (back to warning state) */
++ new_state = CAN_STATE_ERROR_WARNING;
++ break;
+ }
+ break;
+
+@@ -509,6 +509,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ mc->pdev->dev.can.can_stats.error_warning++;
+ break;
+
++ case CAN_STATE_ERROR_ACTIVE:
++ cf->can_id |= CAN_ERR_CRTL;
++ cf->data[1] = CAN_ERR_CRTL_ACTIVE;
++ break;
++
+ default:
+ /* CAN_STATE_MAX (trick to handle other errors) */
+ cf->can_id |= CAN_ERR_CRTL;
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 17cec68e56b4..02a4187d81bd 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -309,11 +309,10 @@ static int bcm_sf2_sw_mdio_write(struct mii_bus *bus, int addr, int regnum,
+ * send them to our master MDIO bus controller
+ */
+ if (addr == BRCM_PSEUDO_PHY_ADDR && priv->indir_phy_mask & BIT(addr))
+- bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val);
++ return bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val);
+ else
+- mdiobus_write_nested(priv->master_mii_bus, addr, regnum, val);
+-
+- return 0;
++ return mdiobus_write_nested(priv->master_mii_bus, addr,
++ regnum, val);
+ }
+
+ static irqreturn_t bcm_sf2_switch_0_isr(int irq, void *dev_id)
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+index 9dc6da039a6d..3164aad29bcf 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+@@ -473,7 +473,9 @@ static void atl1e_mdio_write(struct net_device *netdev, int phy_id,
+ {
+ struct atl1e_adapter *adapter = netdev_priv(netdev);
+
+- atl1e_write_phy_reg(&adapter->hw, reg_num & MDIO_REG_ADDR_MASK, val);
++ if (atl1e_write_phy_reg(&adapter->hw,
++ reg_num & MDIO_REG_ADDR_MASK, val))
++ netdev_err(netdev, "write phy register failed\n");
+ }
+
+ static int atl1e_mii_ioctl(struct net_device *netdev,
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index c54a74de7b08..2f61175f5655 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -7148,6 +7148,9 @@ static bool bnxt_drv_busy(struct bnxt *bp)
+ test_bit(BNXT_STATE_READ_STATS, &bp->state));
+ }
+
++static void bnxt_get_ring_stats(struct bnxt *bp,
++ struct rtnl_link_stats64 *stats);
++
+ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init,
+ bool link_re_init)
+ {
+@@ -7173,6 +7176,9 @@ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init,
+ del_timer_sync(&bp->timer);
+ bnxt_free_skbs(bp);
+
++ /* Save ring stats before shutdown */
++ if (bp->bnapi)
++ bnxt_get_ring_stats(bp, &bp->net_stats_prev);
+ if (irq_re_init) {
+ bnxt_free_irq(bp);
+ bnxt_del_napi(bp);
+@@ -7234,23 +7240,12 @@ static int bnxt_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ return -EOPNOTSUPP;
+ }
+
+-static void
+-bnxt_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
++static void bnxt_get_ring_stats(struct bnxt *bp,
++ struct rtnl_link_stats64 *stats)
+ {
+- u32 i;
+- struct bnxt *bp = netdev_priv(dev);
++ int i;
+
+- set_bit(BNXT_STATE_READ_STATS, &bp->state);
+- /* Make sure bnxt_close_nic() sees that we are reading stats before
+- * we check the BNXT_STATE_OPEN flag.
+- */
+- smp_mb__after_atomic();
+- if (!test_bit(BNXT_STATE_OPEN, &bp->state)) {
+- clear_bit(BNXT_STATE_READ_STATS, &bp->state);
+- return;
+- }
+
+- /* TODO check if we need to synchronize with bnxt_close path */
+ for (i = 0; i < bp->cp_nr_rings; i++) {
+ struct bnxt_napi *bnapi = bp->bnapi[i];
+ struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
+@@ -7279,6 +7274,40 @@ bnxt_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
+
+ stats->tx_dropped += le64_to_cpu(hw_stats->tx_drop_pkts);
+ }
++}
++
++static void bnxt_add_prev_stats(struct bnxt *bp,
++ struct rtnl_link_stats64 *stats)
++{
++ struct rtnl_link_stats64 *prev_stats = &bp->net_stats_prev;
++
++ stats->rx_packets += prev_stats->rx_packets;
++ stats->tx_packets += prev_stats->tx_packets;
++ stats->rx_bytes += prev_stats->rx_bytes;
++ stats->tx_bytes += prev_stats->tx_bytes;
++ stats->rx_missed_errors += prev_stats->rx_missed_errors;
++ stats->multicast += prev_stats->multicast;
++ stats->tx_dropped += prev_stats->tx_dropped;
++}
++
++static void
++bnxt_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
++{
++ struct bnxt *bp = netdev_priv(dev);
++
++ set_bit(BNXT_STATE_READ_STATS, &bp->state);
++ /* Make sure bnxt_close_nic() sees that we are reading stats before
++ * we check the BNXT_STATE_OPEN flag.
++ */
++ smp_mb__after_atomic();
++ if (!test_bit(BNXT_STATE_OPEN, &bp->state)) {
++ clear_bit(BNXT_STATE_READ_STATS, &bp->state);
++ *stats = bp->net_stats_prev;
++ return;
++ }
++
++ bnxt_get_ring_stats(bp, stats);
++ bnxt_add_prev_stats(bp, stats);
+
+ if (bp->flags & BNXT_FLAG_PORT_STATS) {
+ struct rx_port_stats *rx = bp->hw_rx_port_stats;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index cf2d4a6583d5..f9e253b705ec 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1302,6 +1302,7 @@ struct bnxt {
+ void *hwrm_cmd_resp_addr;
+ dma_addr_t hwrm_cmd_resp_dma_addr;
+
++ struct rtnl_link_stats64 net_stats_prev;
+ struct rx_port_stats *hw_rx_port_stats;
+ struct tx_port_stats *hw_tx_port_stats;
+ struct rx_port_stats_ext *hw_rx_port_stats_ext;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index da9b87689996..2240c23b0a4c 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1444,14 +1444,22 @@ static int bnxt_flash_nvram(struct net_device *dev,
+ rc = hwrm_send_message(bp, &req, sizeof(req), FLASH_NVRAM_TIMEOUT);
+ dma_free_coherent(&bp->pdev->dev, data_len, kmem, dma_handle);
+
++ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++ netdev_info(dev,
++ "PF does not have admin privileges to flash the device\n");
++ rc = -EACCES;
++ } else if (rc) {
++ rc = -EIO;
++ }
+ return rc;
+ }
+
+ static int bnxt_firmware_reset(struct net_device *dev,
+ u16 dir_type)
+ {
+- struct bnxt *bp = netdev_priv(dev);
+ struct hwrm_fw_reset_input req = {0};
++ struct bnxt *bp = netdev_priv(dev);
++ int rc;
+
+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FW_RESET, -1, -1);
+
+@@ -1491,7 +1499,15 @@ static int bnxt_firmware_reset(struct net_device *dev,
+ return -EINVAL;
+ }
+
+- return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++ netdev_info(dev,
++ "PF does not have admin privileges to reset the device\n");
++ rc = -EACCES;
++ } else if (rc) {
++ rc = -EIO;
++ }
++ return rc;
+ }
+
+ static int bnxt_flash_firmware(struct net_device *dev,
+@@ -1698,9 +1714,9 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ struct hwrm_nvm_install_update_output *resp = bp->hwrm_cmd_resp_addr;
+ struct hwrm_nvm_install_update_input install = {0};
+ const struct firmware *fw;
++ int rc, hwrm_err = 0;
+ u32 item_len;
+ u16 index;
+- int rc;
+
+ bnxt_hwrm_fw_set_time(bp);
+
+@@ -1743,15 +1759,16 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ memcpy(kmem, fw->data, fw->size);
+ modify.host_src_addr = cpu_to_le64(dma_handle);
+
+- rc = hwrm_send_message(bp, &modify, sizeof(modify),
+- FLASH_PACKAGE_TIMEOUT);
++ hwrm_err = hwrm_send_message(bp, &modify,
++ sizeof(modify),
++ FLASH_PACKAGE_TIMEOUT);
+ dma_free_coherent(&bp->pdev->dev, fw->size, kmem,
+ dma_handle);
+ }
+ }
+ release_firmware(fw);
+- if (rc)
+- return rc;
++ if (rc || hwrm_err)
++ goto err_exit;
+
+ if ((install_type & 0xffff) == 0)
+ install_type >>= 16;
+@@ -1759,12 +1776,10 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ install.install_type = cpu_to_le32(install_type);
+
+ mutex_lock(&bp->hwrm_cmd_lock);
+- rc = _hwrm_send_message(bp, &install, sizeof(install),
+- INSTALL_PACKAGE_TIMEOUT);
+- if (rc) {
+- rc = -EOPNOTSUPP;
++ hwrm_err = _hwrm_send_message(bp, &install, sizeof(install),
++ INSTALL_PACKAGE_TIMEOUT);
++ if (hwrm_err)
+ goto flash_pkg_exit;
+- }
+
+ if (resp->error_code) {
+ u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err;
+@@ -1772,12 +1787,11 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
+ install.flags |= cpu_to_le16(
+ NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG);
+- rc = _hwrm_send_message(bp, &install, sizeof(install),
+- INSTALL_PACKAGE_TIMEOUT);
+- if (rc) {
+- rc = -EOPNOTSUPP;
++ hwrm_err = _hwrm_send_message(bp, &install,
++ sizeof(install),
++ INSTALL_PACKAGE_TIMEOUT);
++ if (hwrm_err)
+ goto flash_pkg_exit;
+- }
+ }
+ }
+
+@@ -1788,6 +1802,14 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ }
+ flash_pkg_exit:
+ mutex_unlock(&bp->hwrm_cmd_lock);
++err_exit:
++ if (hwrm_err == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++ netdev_info(dev,
++ "PF does not have admin privileges to flash the device\n");
++ rc = -EACCES;
++ } else if (hwrm_err) {
++ rc = -EOPNOTSUPP;
++ }
+ return rc;
+ }
+
+@@ -2368,17 +2390,37 @@ static int bnxt_hwrm_mac_loopback(struct bnxt *bp, bool enable)
+ return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+ }
+
++static int bnxt_query_force_speeds(struct bnxt *bp, u16 *force_speeds)
++{
++ struct hwrm_port_phy_qcaps_output *resp = bp->hwrm_cmd_resp_addr;
++ struct hwrm_port_phy_qcaps_input req = {0};
++ int rc;
++
++ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_PORT_PHY_QCAPS, -1, -1);
++ mutex_lock(&bp->hwrm_cmd_lock);
++ rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ if (!rc)
++ *force_speeds = le16_to_cpu(resp->supported_speeds_force_mode);
++
++ mutex_unlock(&bp->hwrm_cmd_lock);
++ return rc;
++}
++
+ static int bnxt_disable_an_for_lpbk(struct bnxt *bp,
+ struct hwrm_port_phy_cfg_input *req)
+ {
+ struct bnxt_link_info *link_info = &bp->link_info;
+- u16 fw_advertising = link_info->advertising;
++ u16 fw_advertising;
+ u16 fw_speed;
+ int rc;
+
+ if (!link_info->autoneg)
+ return 0;
+
++ rc = bnxt_query_force_speeds(bp, &fw_advertising);
++ if (rc)
++ return rc;
++
+ fw_speed = PORT_PHY_CFG_REQ_FORCE_LINK_SPEED_1GB;
+ if (netif_carrier_ok(bp->dev))
+ fw_speed = bp->link_info.link_speed;
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 338d22380434..b7d75011cede 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1998,8 +1998,6 @@ static void reset_umac(struct bcmgenet_priv *priv)
+
+ /* issue soft reset with (rg)mii loopback to ensure a stable rxclk */
+ bcmgenet_umac_writel(priv, CMD_SW_RESET | CMD_LCL_LOOP_EN, UMAC_CMD);
+- udelay(2);
+- bcmgenet_umac_writel(priv, 0, UMAC_CMD);
+ }
+
+ static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
+@@ -2621,8 +2619,10 @@ static void bcmgenet_irq_task(struct work_struct *work)
+ spin_unlock_irq(&priv->lock);
+
+ if (status & UMAC_IRQ_PHY_DET_R &&
+- priv->dev->phydev->autoneg != AUTONEG_ENABLE)
++ priv->dev->phydev->autoneg != AUTONEG_ENABLE) {
+ phy_init_hw(priv->dev->phydev);
++ genphy_config_aneg(priv->dev->phydev);
++ }
+
+ /* Link UP/DOWN event */
+ if (status & UMAC_IRQ_LINK_EVENT)
+@@ -3675,6 +3675,7 @@ static int bcmgenet_resume(struct device *d)
+ phy_init_hw(dev->phydev);
+
+ /* Speed settings must be restored */
++ genphy_config_aneg(dev->phydev);
+ bcmgenet_mii_config(priv->dev, false);
+
+ bcmgenet_set_hw_addr(priv, dev->dev_addr);
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index b0592fd4135b..a5049d637791 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -184,8 +184,38 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ const char *phy_name = NULL;
+ u32 id_mode_dis = 0;
+ u32 port_ctrl;
++ int bmcr = -1;
++ int ret;
+ u32 reg;
+
++ /* MAC clocking workaround during reset of umac state machines */
++ reg = bcmgenet_umac_readl(priv, UMAC_CMD);
++ if (reg & CMD_SW_RESET) {
++ /* An MII PHY must be isolated to prevent TXC contention */
++ if (priv->phy_interface == PHY_INTERFACE_MODE_MII) {
++ ret = phy_read(phydev, MII_BMCR);
++ if (ret >= 0) {
++ bmcr = ret;
++ ret = phy_write(phydev, MII_BMCR,
++ bmcr | BMCR_ISOLATE);
++ }
++ if (ret) {
++ netdev_err(dev, "failed to isolate PHY\n");
++ return ret;
++ }
++ }
++ /* Switch MAC clocking to RGMII generated clock */
++ bcmgenet_sys_writel(priv, PORT_MODE_EXT_GPHY, SYS_PORT_CTRL);
++ /* Ensure 5 clks with Rx disabled
++ * followed by 5 clks with Reset asserted
++ */
++ udelay(4);
++ reg &= ~(CMD_SW_RESET | CMD_LCL_LOOP_EN);
++ bcmgenet_umac_writel(priv, reg, UMAC_CMD);
++ /* Ensure 5 more clocks before Rx is enabled */
++ udelay(2);
++ }
++
+ priv->ext_phy = !priv->internal_phy &&
+ (priv->phy_interface != PHY_INTERFACE_MODE_MOCA);
+
+@@ -217,6 +247,9 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ phydev->supported &= PHY_BASIC_FEATURES;
+ bcmgenet_sys_writel(priv,
+ PORT_MODE_EXT_EPHY, SYS_PORT_CTRL);
++ /* Restore the MII PHY after isolation */
++ if (bmcr >= 0)
++ phy_write(phydev, MII_BMCR, bmcr);
+ break;
+
+ case PHY_INTERFACE_MODE_REVMII:
+diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
+index 9bbaad9f3d63..efb44d5ab021 100644
+--- a/drivers/net/ethernet/cadence/macb.h
++++ b/drivers/net/ethernet/cadence/macb.h
+@@ -499,7 +499,11 @@
+
+ /* Bitfields in TISUBN */
+ #define GEM_SUBNSINCR_OFFSET 0
+-#define GEM_SUBNSINCR_SIZE 16
++#define GEM_SUBNSINCRL_OFFSET 24
++#define GEM_SUBNSINCRL_SIZE 8
++#define GEM_SUBNSINCRH_OFFSET 0
++#define GEM_SUBNSINCRH_SIZE 16
++#define GEM_SUBNSINCR_SIZE 24
+
+ /* Bitfields in TI */
+ #define GEM_NSINCR_OFFSET 0
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index f175b20ac510..c2eb18854794 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -860,7 +860,9 @@ static void macb_tx_interrupt(struct macb_queue *queue)
+
+ /* First, update TX stats if needed */
+ if (skb) {
+- if (gem_ptp_do_txstamp(queue, skb, desc) == 0) {
++ if (unlikely(skb_shinfo(skb)->tx_flags &
++ SKBTX_HW_TSTAMP) &&
++ gem_ptp_do_txstamp(queue, skb, desc) == 0) {
+ /* skb now belongs to timestamp buffer
+ * and will be removed later
+ */
+@@ -3328,7 +3330,7 @@ static int macb_clk_init(struct platform_device *pdev, struct clk **pclk,
+ if (!err)
+ err = -ENODEV;
+
+- dev_err(&pdev->dev, "failed to get macb_clk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to get macb_clk (%d)\n", err);
+ return err;
+ }
+
+@@ -3337,7 +3339,7 @@ static int macb_clk_init(struct platform_device *pdev, struct clk **pclk,
+ if (!err)
+ err = -ENODEV;
+
+- dev_err(&pdev->dev, "failed to get hclk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to get hclk (%d)\n", err);
+ return err;
+ }
+
+@@ -3351,25 +3353,25 @@ static int macb_clk_init(struct platform_device *pdev, struct clk **pclk,
+
+ err = clk_prepare_enable(*pclk);
+ if (err) {
+- dev_err(&pdev->dev, "failed to enable pclk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to enable pclk (%d)\n", err);
+ return err;
+ }
+
+ err = clk_prepare_enable(*hclk);
+ if (err) {
+- dev_err(&pdev->dev, "failed to enable hclk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to enable hclk (%d)\n", err);
+ goto err_disable_pclk;
+ }
+
+ err = clk_prepare_enable(*tx_clk);
+ if (err) {
+- dev_err(&pdev->dev, "failed to enable tx_clk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to enable tx_clk (%d)\n", err);
+ goto err_disable_hclk;
+ }
+
+ err = clk_prepare_enable(*rx_clk);
+ if (err) {
+- dev_err(&pdev->dev, "failed to enable rx_clk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to enable rx_clk (%d)\n", err);
+ goto err_disable_txclk;
+ }
+
+@@ -3839,7 +3841,7 @@ static int at91ether_clk_init(struct platform_device *pdev, struct clk **pclk,
+
+ err = clk_prepare_enable(*pclk);
+ if (err) {
+- dev_err(&pdev->dev, "failed to enable pclk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to enable pclk (%d)\n", err);
+ return err;
+ }
+
+@@ -4192,6 +4194,7 @@ static int macb_remove(struct platform_device *pdev)
+ mdiobus_free(bp->mii_bus);
+
+ unregister_netdev(dev);
++ tasklet_kill(&bp->hresp_err_tasklet);
+ clk_disable_unprepare(bp->tx_clk);
+ clk_disable_unprepare(bp->hclk);
+ clk_disable_unprepare(bp->pclk);
+diff --git a/drivers/net/ethernet/cadence/macb_ptp.c b/drivers/net/ethernet/cadence/macb_ptp.c
+index a6dc47edc4cf..8f912de44def 100644
+--- a/drivers/net/ethernet/cadence/macb_ptp.c
++++ b/drivers/net/ethernet/cadence/macb_ptp.c
+@@ -115,7 +115,10 @@ static int gem_tsu_incr_set(struct macb *bp, struct tsu_incr *incr_spec)
+ * to take effect.
+ */
+ spin_lock_irqsave(&bp->tsu_clk_lock, flags);
+- gem_writel(bp, TISUBN, GEM_BF(SUBNSINCR, incr_spec->sub_ns));
++ /* RegBit[15:0] = Subns[23:8]; RegBit[31:24] = Subns[7:0] */
++ gem_writel(bp, TISUBN, GEM_BF(SUBNSINCRL, incr_spec->sub_ns) |
++ GEM_BF(SUBNSINCRH, (incr_spec->sub_ns >>
++ GEM_SUBNSINCRL_SIZE)));
+ gem_writel(bp, TI, GEM_BF(NSINCR, incr_spec->ns));
+ spin_unlock_irqrestore(&bp->tsu_clk_lock, flags);
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 4cf80de4c471..296ae1e4c322 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3597,6 +3597,11 @@ fec_drv_remove(struct platform_device *pdev)
+ struct net_device *ndev = platform_get_drvdata(pdev);
+ struct fec_enet_private *fep = netdev_priv(ndev);
+ struct device_node *np = pdev->dev.of_node;
++ int ret;
++
++ ret = pm_runtime_get_sync(&pdev->dev);
++ if (ret < 0)
++ return ret;
+
+ cancel_work_sync(&fep->tx_timeout_work);
+ fec_ptp_stop(pdev);
+@@ -3604,13 +3609,17 @@ fec_drv_remove(struct platform_device *pdev)
+ fec_enet_mii_remove(fep);
+ if (fep->reg_phy)
+ regulator_disable(fep->reg_phy);
+- pm_runtime_put(&pdev->dev);
+- pm_runtime_disable(&pdev->dev);
++
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(fep->phy_node);
+ free_netdev(ndev);
+
++ clk_disable_unprepare(fep->clk_ahb);
++ clk_disable_unprepare(fep->clk_ipg);
++ pm_runtime_put_noidle(&pdev->dev);
++ pm_runtime_disable(&pdev->dev);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 3708f149d0a6..b2860087a7dc 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -2366,7 +2366,7 @@ static bool hns3_get_new_int_gl(struct hns3_enet_ring_group *ring_group)
+ u32 time_passed_ms;
+ u16 new_int_gl;
+
+- if (!ring_group->coal.int_gl || !tqp_vector->last_jiffies)
++ if (!tqp_vector->last_jiffies)
+ return false;
+
+ if (ring_group->total_packets == 0) {
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+index 690f62ed87dc..09a4d87429ce 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+@@ -260,6 +260,8 @@ int hclge_cmd_send(struct hclge_hw *hw, struct hclge_desc *desc, int num)
+
+ if (desc_ret == HCLGE_CMD_EXEC_SUCCESS)
+ retval = 0;
++ else if (desc_ret == HCLGE_CMD_NOT_SUPPORTED)
++ retval = -EOPNOTSUPP;
+ else
+ retval = -EIO;
+ hw->cmq.last_status = desc_ret;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index 821d4c2f84bd..d7520686509f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -39,7 +39,7 @@ struct hclge_cmq_ring {
+ enum hclge_cmd_return_status {
+ HCLGE_CMD_EXEC_SUCCESS = 0,
+ HCLGE_CMD_NO_AUTH = 1,
+- HCLGE_CMD_NOT_EXEC = 2,
++ HCLGE_CMD_NOT_SUPPORTED = 2,
+ HCLGE_CMD_QUEUE_FULL = 3,
+ };
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index 92f19384e258..a75d7c826fc2 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -245,6 +245,9 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)
+ hdev->flag & HCLGE_FLAG_MQPRIO_ENABLE)
+ return -EINVAL;
+
++ if (pfc->pfc_en == hdev->tm_info.pfc_en)
++ return 0;
++
+ prio_tc = hdev->tm_info.prio_tc;
+ pfc_map = 0;
+
+@@ -257,10 +260,8 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)
+ }
+ }
+
+- if (pfc_map == hdev->tm_info.hw_pfc_map)
+- return 0;
+-
+ hdev->tm_info.hw_pfc_map = pfc_map;
++ hdev->tm_info.pfc_en = pfc->pfc_en;
+
+ return hclge_pause_setup_hw(hdev);
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+index 1528fb3fa6be..260b1e779690 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+@@ -249,6 +249,7 @@ struct hclge_tm_info {
+ struct hclge_tc_info tc_info[HNAE3_MAX_TC];
+ enum hclge_fc_mode fc_mode;
+ u8 hw_pfc_map; /* Allow for packet drop or not on this TC */
++ u8 pfc_en; /* PFC enabled or not for user priority */
+ };
+
+ struct hclge_comm_stats_str {
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 0d45d045706c..3180ae452889 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -1162,7 +1162,7 @@ static int hclge_pfc_setup_hw(struct hclge_dev *hdev)
+ HCLGE_RX_MAC_PAUSE_EN_MSK;
+
+ return hclge_pfc_pause_en_cfg(hdev, enable_bitmap,
+- hdev->tm_info.hw_pfc_map);
++ hdev->tm_info.pfc_en);
+ }
+
+ /* Each Tc has a 1024 queue sets to backpress, it divides to
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index beae1e2cd59b..67db19709dea 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -26,7 +26,12 @@ MODULE_DEVICE_TABLE(pci, ae_algovf_pci_tbl);
+ static inline struct hclgevf_dev *hclgevf_ae_get_hdev(
+ struct hnae3_handle *handle)
+ {
+- return container_of(handle, struct hclgevf_dev, nic);
++ if (!handle->client)
++ return container_of(handle, struct hclgevf_dev, nic);
++ else if (handle->client->type == HNAE3_CLIENT_ROCE)
++ return container_of(handle, struct hclgevf_dev, roce);
++ else
++ return container_of(handle, struct hclgevf_dev, nic);
+ }
+
+ static int hclgevf_tqps_update_stats(struct hnae3_handle *handle)
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 1cc0e8fda4d5..a50977ce4076 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -5132,6 +5132,8 @@ static int mvpp2_probe(struct platform_device *pdev)
+ if (has_acpi_companion(&pdev->dev)) {
+ acpi_id = acpi_match_device(pdev->dev.driver->acpi_match_table,
+ &pdev->dev);
++ if (!acpi_id)
++ return -EINVAL;
+ priv->hw_version = (unsigned long)acpi_id->driver_data;
+ } else {
+ priv->hw_version =
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 231ed508c240..5fac00ea6245 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -859,11 +859,9 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
+
+ priv->numa_node = dev_to_node(&dev->pdev->dev);
+
+- priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root);
+- if (!priv->dbg_root) {
+- dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n");
+- return -ENOMEM;
+- }
++ if (mlx5_debugfs_root)
++ priv->dbg_root =
++ debugfs_create_dir(pci_name(pdev), mlx5_debugfs_root);
+
+ err = mlx5_pci_enable_device(dev);
+ if (err) {
+diff --git a/drivers/net/ethernet/mscc/ocelot.h b/drivers/net/ethernet/mscc/ocelot.h
+index 616bec30dfa3..3d8c6f38e76b 100644
+--- a/drivers/net/ethernet/mscc/ocelot.h
++++ b/drivers/net/ethernet/mscc/ocelot.h
+@@ -541,7 +541,7 @@ void __ocelot_write_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 offset);
+ #define ocelot_write_rix(ocelot, val, reg, ri) __ocelot_write_ix(ocelot, val, reg, reg##_RSZ * (ri))
+ #define ocelot_write(ocelot, val, reg) __ocelot_write_ix(ocelot, val, reg, 0)
+
+-void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 mask,
++void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 mask, u32 reg,
+ u32 offset);
+ #define ocelot_rmw_ix(ocelot, val, m, reg, gi, ri) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi) + reg##_RSZ * (ri))
+ #define ocelot_rmw_gix(ocelot, val, m, reg, gi) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi))
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 7eeac3d6cfe8..1f971d31ec30 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -6042,22 +6042,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = {
+ { NVRAM_PARTITION_TYPE_LICENSE, 0, 0, "sfc_license" },
+ { NVRAM_PARTITION_TYPE_PHY_MIN, 0xff, 0, "sfc_phy_fw" },
+ };
++#define EF10_NVRAM_PARTITION_COUNT ARRAY_SIZE(efx_ef10_nvram_types)
+
+ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ struct efx_mcdi_mtd_partition *part,
+- unsigned int type)
++ unsigned int type,
++ unsigned long *found)
+ {
+ MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN);
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX);
+ const struct efx_ef10_nvram_type_info *info;
+ size_t size, erase_size, outlen;
++ int type_idx = 0;
+ bool protected;
+ int rc;
+
+- for (info = efx_ef10_nvram_types; ; info++) {
+- if (info ==
+- efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types))
++ for (type_idx = 0; ; type_idx++) {
++ if (type_idx == EF10_NVRAM_PARTITION_COUNT)
+ return -ENODEV;
++ info = efx_ef10_nvram_types + type_idx;
+ if ((type & ~info->type_mask) == info->type)
+ break;
+ }
+@@ -6070,6 +6073,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ if (protected)
+ return -ENODEV; /* hide it */
+
++ /* If we've already exposed a partition of this type, hide this
++ * duplicate. All operations on MTDs are keyed by the type anyway,
++ * so we can't act on the duplicate.
++ */
++ if (__test_and_set_bit(type_idx, found))
++ return -EEXIST;
++
+ part->nvram_type = type;
+
+ MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type);
+@@ -6098,6 +6108,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 };
+ struct efx_mcdi_mtd_partition *parts;
+ size_t outlen, n_parts_total, i, n_parts;
+ unsigned int type;
+@@ -6126,11 +6137,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ for (i = 0; i < n_parts_total; i++) {
+ type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID,
+ i);
+- rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type);
+- if (rc == 0)
+- n_parts++;
+- else if (rc != -ENODEV)
++ rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type,
++ found);
++ if (rc == -EEXIST || rc == -ENODEV)
++ continue;
++ if (rc)
+ goto fail;
++ n_parts++;
+ }
+
+ rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+index d07520fb969e..62ccbd47c1db 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+@@ -59,7 +59,9 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
+ gmac->clk_enabled = 1;
+ } else {
+ clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
+- clk_prepare(gmac->tx_clk);
++ ret = clk_prepare(gmac->tx_clk);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
+index b96b93c686bf..4f644ac314fe 100644
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -572,7 +572,9 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs,
+ return ERR_CAST(cpts->refclk);
+ }
+
+- clk_prepare(cpts->refclk);
++ ret = clk_prepare(cpts->refclk);
++ if (ret)
++ return ERR_PTR(ret);
+
+ cpts->cc.read = cpts_systim_read;
+ cpts->cc.mask = CLOCKSOURCE_MASK(32);
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 6372cdc4a510..78789dfbe29e 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -363,10 +363,11 @@ static void macvlan_broadcast_enqueue(struct macvlan_port *port,
+ }
+ spin_unlock(&port->bc_queue.lock);
+
++ schedule_work(&port->bc_work);
++
+ if (err)
+ goto free_nskb;
+
+- schedule_work(&port->bc_work);
+ return;
+
+ free_nskb:
+diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
+index a5874059da9d..77207f936871 100644
+--- a/drivers/net/slip/slip.c
++++ b/drivers/net/slip/slip.c
+@@ -855,6 +855,7 @@ err_free_chan:
+ sl->tty = NULL;
+ tty->disc_data = NULL;
+ clear_bit(SLF_INUSE, &sl->flags);
++ sl_free_netdev(sl->dev);
+ free_netdev(sl->dev);
+
+ err_exit:
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 2a536f84d5f6..d8a56df3933f 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3213,6 +3213,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+ struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+ struct vxlan_dev *vxlan = netdev_priv(dev);
+ struct vxlan_fdb *f = NULL;
++ bool unregister = false;
+ int err;
+
+ err = vxlan_dev_configure(net, dev, conf, false, extack);
+@@ -3238,12 +3239,11 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+ err = register_netdevice(dev);
+ if (err)
+ goto errout;
++ unregister = true;
+
+ err = rtnl_configure_link(dev, NULL);
+- if (err) {
+- unregister_netdevice(dev);
++ if (err)
+ goto errout;
+- }
+
+ /* notify default fdb entry */
+ if (f)
+@@ -3251,9 +3251,16 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+
+ list_add(&vxlan->next, &vn->vxlan_list);
+ return 0;
++
+ errout:
++ /* unregister_netdevice() destroys the default FDB entry with deletion
++ * notification. But the addition notification was not sent yet, so
++ * destroy the entry by hand here.
++ */
+ if (f)
+ vxlan_fdb_destroy(vxlan, f, false);
++ if (unregister)
++ unregister_netdevice(dev);
+ return err;
+ }
+
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index 5f0366a125e2..0212f576a838 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -1113,7 +1113,6 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
+ if (register_hdlc_device(dev)) {
+ ret = -ENOBUFS;
+ pr_err("ucc_hdlc: unable to register hdlc device\n");
+- free_netdev(dev);
+ goto free_dev;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index e121187f371f..d7c626d9594e 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -939,7 +939,7 @@ static int ath6kl_set_probed_ssids(struct ath6kl *ar,
+ else
+ ssid_list[i].flag = ANY_SSID_FLAG;
+
+- if (n_match_ssid == 0)
++ if (ar->wiphy->max_match_sets != 0 && n_match_ssid == 0)
+ ssid_list[i].flag |= MATCH_SSID_FLAG;
+ }
+
+@@ -1093,7 +1093,7 @@ void ath6kl_cfg80211_scan_complete_event(struct ath6kl_vif *vif, bool aborted)
+ if (vif->scan_req->n_ssids && vif->scan_req->ssids[0].ssid_len) {
+ for (i = 0; i < vif->scan_req->n_ssids; i++) {
+ ath6kl_wmi_probedssid_cmd(ar->wmi, vif->fw_vif_idx,
+- i + 1, DISABLE_SSID_FLAG,
++ i, DISABLE_SSID_FLAG,
+ 0, NULL);
+ }
+ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index c7c520f327f2..bbdc6000afb9 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6314,6 +6314,16 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
+ .tx = 0xffff,
+ .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+ BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
++ },
++ [NL80211_IFTYPE_AP] = {
++ .tx = 0xffff,
++ .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
++ BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
++ BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
++ BIT(IEEE80211_STYPE_DISASSOC >> 4) |
++ BIT(IEEE80211_STYPE_AUTH >> 4) |
++ BIT(IEEE80211_STYPE_DEAUTH >> 4) |
++ BIT(IEEE80211_STYPE_ACTION >> 4)
+ }
+ };
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 53e4962ceb8a..abaed2fa2def 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -49,6 +49,10 @@
+ #define DCMD_RESP_TIMEOUT msecs_to_jiffies(2500)
+ #define CTL_DONE_TIMEOUT msecs_to_jiffies(2500)
+
++/* watermark expressed in number of words */
++#define DEFAULT_F2_WATERMARK 0x8
++#define CY_4373_F2_WATERMARK 0x40
++
+ #ifdef DEBUG
+
+ #define BRCMF_TRAP_INFO_SIZE 80
+@@ -138,6 +142,8 @@ struct rte_console {
+ /* 1: isolate internal sdio signals, put external pads in tri-state; requires
+ * sdio bus power cycle to clear (rev 9) */
+ #define SBSDIO_DEVCTL_PADS_ISO 0x08
++/* 1: enable F2 Watermark */
++#define SBSDIO_DEVCTL_F2WM_ENAB 0x10
+ /* Force SD->SB reset mapping (rev 11) */
+ #define SBSDIO_DEVCTL_SB_RST_CTL 0x30
+ /* Determined by CoreControl bit */
+@@ -4060,6 +4066,7 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ void *nvram;
+ u32 nvram_len;
+ u8 saveclk;
++ u8 devctl;
+
+ brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+
+@@ -4115,8 +4122,26 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ brcmf_sdiod_writel(sdiod, core->base + SD_REG(hostintmask),
+ bus->hostintmask, NULL);
+
+-
+- brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, 8, &err);
++ switch (sdiod->func1->device) {
++ case SDIO_DEVICE_ID_CYPRESS_4373:
++ brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
++ CY_4373_F2_WATERMARK);
++ brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++ CY_4373_F2_WATERMARK, &err);
++ devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
++ &err);
++ devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
++ brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
++ &err);
++ brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL,
++ CY_4373_F2_WATERMARK |
++ SBSDIO_MESBUSYCTRL_ENAB, &err);
++ break;
++ default:
++ brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++ DEFAULT_F2_WATERMARK, &err);
++ break;
++ }
+ } else {
+ /* Disable F2 again */
+ sdio_disable_func(sdiod->func2);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+index 7faed831f07d..34b031154da9 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -77,7 +77,7 @@
+ #define SBSDIO_GPIO_OUT 0x10006
+ /* gpio enable */
+ #define SBSDIO_GPIO_EN 0x10007
+-/* rev < 7, watermark for sdio device */
++/* rev < 7, watermark for sdio device TX path */
+ #define SBSDIO_WATERMARK 0x10008
+ /* control busy signal generation */
+ #define SBSDIO_DEVICE_CTL 0x10009
+@@ -104,6 +104,13 @@
+ #define SBSDIO_FUNC1_RFRAMEBCHI 0x1001C
+ /* MesBusyCtl (rev 11) */
+ #define SBSDIO_FUNC1_MESBUSYCTRL 0x1001D
++/* Watermark for sdio device RX path */
++#define SBSDIO_MESBUSY_RXFIFO_WM_MASK 0x7F
++#define SBSDIO_MESBUSY_RXFIFO_WM_SHIFT 0
++/* Enable busy capability for MES access */
++#define SBSDIO_MESBUSYCTRL_ENAB 0x80
++#define SBSDIO_MESBUSYCTRL_ENAB_SHIFT 7
++
+ /* Sdio Core Rev 12 */
+ #define SBSDIO_FUNC1_WAKEUPCTRL 0x1001E
+ #define SBSDIO_FUNC1_WCTRL_ALPWAIT_MASK 0x1
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+index 030482b357a3..06dd4e81b737 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+@@ -1227,6 +1227,23 @@ static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
+ return 0;
+ }
+
++static int iwl_nvm_check_version(struct iwl_nvm_data *data,
++ struct iwl_trans *trans)
++{
++ if (data->nvm_version >= trans->cfg->nvm_ver ||
++ data->calib_version >= trans->cfg->nvm_calib_ver) {
++ IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n",
++ data->nvm_version, data->calib_version);
++ return 0;
++ }
++
++ IWL_ERR(trans,
++ "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
++ data->nvm_version, trans->cfg->nvm_ver,
++ data->calib_version, trans->cfg->nvm_calib_ver);
++ return -EINVAL;
++}
++
+ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
+ const struct iwl_cfg *cfg,
+ const struct iwl_fw *fw,
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
+index a4c96215933b..a59bab8345f4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
+@@ -928,22 +928,3 @@ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
+ return NULL;
+ }
+ IWL_EXPORT_SYMBOL(iwl_parse_eeprom_data);
+-
+-/* helper functions */
+-int iwl_nvm_check_version(struct iwl_nvm_data *data,
+- struct iwl_trans *trans)
+-{
+- if (data->nvm_version >= trans->cfg->nvm_ver ||
+- data->calib_version >= trans->cfg->nvm_calib_ver) {
+- IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n",
+- data->nvm_version, data->calib_version);
+- return 0;
+- }
+-
+- IWL_ERR(trans,
+- "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
+- data->nvm_version, trans->cfg->nvm_ver,
+- data->calib_version, trans->cfg->nvm_calib_ver);
+- return -EINVAL;
+-}
+-IWL_EXPORT_SYMBOL(iwl_nvm_check_version);
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
+index 8be50ed12300..c59dd47cf15d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
+@@ -7,6 +7,7 @@
+ *
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
++ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -33,6 +34,7 @@
+ *
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
++ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -122,9 +124,6 @@ struct iwl_nvm_data *
+ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
+ const u8 *eeprom, size_t eeprom_size);
+
+-int iwl_nvm_check_version(struct iwl_nvm_data *data,
+- struct iwl_trans *trans);
+-
+ int iwl_init_sband_channels(struct iwl_nvm_data *data,
+ struct ieee80211_supported_band *sband,
+ int n_channels, enum nl80211_band band);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 2eba6d6f367f..9808d954dca2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -547,7 +547,9 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
+ if (mvm->nvm_file_name)
+ iwl_mvm_load_nvm_to_nic(mvm);
+
+- WARN_ON(iwl_nvm_check_version(mvm->nvm_data, mvm->trans));
++ WARN_ONCE(mvm->nvm_data->nvm_version < mvm->trans->cfg->nvm_ver,
++ "Too old NVM version (0x%0x, required = 0x%0x)",
++ mvm->nvm_data->nvm_version, mvm->trans->cfg->nvm_ver);
+
+ /*
+ * abort after reading the nvm in case RF Kill is on, we will complete
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+index 6a5349401aa9..00712205c05f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+@@ -1804,6 +1804,7 @@ void iwl_mvm_pause_tcm(struct iwl_mvm *mvm, bool with_cancel)
+ void iwl_mvm_resume_tcm(struct iwl_mvm *mvm)
+ {
+ int mac;
++ bool low_latency = false;
+
+ spin_lock_bh(&mvm->tcm.lock);
+ mvm->tcm.ts = jiffies;
+@@ -1815,10 +1816,23 @@ void iwl_mvm_resume_tcm(struct iwl_mvm *mvm)
+ memset(&mdata->tx.pkts, 0, sizeof(mdata->tx.pkts));
+ memset(&mdata->rx.airtime, 0, sizeof(mdata->rx.airtime));
+ memset(&mdata->tx.airtime, 0, sizeof(mdata->tx.airtime));
++
++ if (mvm->tcm.result.low_latency[mac])
++ low_latency = true;
+ }
+ /* The TCM data needs to be reset before "paused" flag changes */
+ smp_mb();
+ mvm->tcm.paused = false;
++
++ /*
++ * if the current load is not low or low latency is active, force
++ * re-evaluation to cover the case of no traffic.
++ */
++ if (mvm->tcm.result.global_load > IWL_MVM_TRAFFIC_LOW)
++ schedule_delayed_work(&mvm->tcm.work, MVM_TCM_PERIOD);
++ else if (low_latency)
++ schedule_delayed_work(&mvm->tcm.work, MVM_LL_PERIOD);
++
+ spin_unlock_bh(&mvm->tcm.lock);
+ }
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+index 61ffa1d1a00d..316e2ba0c34d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+@@ -560,18 +560,6 @@ int iwl_trans_pcie_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,
+
+ spin_lock(&txq->lock);
+
+- if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560) {
+- struct iwl_tx_cmd_gen3 *tx_cmd_gen3 =
+- (void *)dev_cmd->payload;
+-
+- cmd_len = le16_to_cpu(tx_cmd_gen3->len);
+- } else {
+- struct iwl_tx_cmd_gen2 *tx_cmd_gen2 =
+- (void *)dev_cmd->payload;
+-
+- cmd_len = le16_to_cpu(tx_cmd_gen2->len);
+- }
+-
+ if (iwl_queue_space(trans, txq) < txq->high_mark) {
+ iwl_stop_queue(trans, txq);
+
+@@ -609,6 +597,18 @@ int iwl_trans_pcie_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,
+ return -1;
+ }
+
++ if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560) {
++ struct iwl_tx_cmd_gen3 *tx_cmd_gen3 =
++ (void *)dev_cmd->payload;
++
++ cmd_len = le16_to_cpu(tx_cmd_gen3->len);
++ } else {
++ struct iwl_tx_cmd_gen2 *tx_cmd_gen2 =
++ (void *)dev_cmd->payload;
++
++ cmd_len = le16_to_cpu(tx_cmd_gen2->len);
++ }
++
+ /* Set up entry for this TFD in Tx byte-count array */
+ iwl_pcie_gen2_update_byte_tbl(trans_pcie, txq, cmd_len,
+ iwl_pcie_gen2_get_num_tbs(trans, tfd));
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index 2fec394a988c..b73582ec03a0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -1247,11 +1247,11 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
+
+ if (idx >= trans->cfg->base_params->max_tfd_queue_size ||
+ (!iwl_queue_used(txq, idx))) {
+- IWL_ERR(trans,
+- "%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
+- __func__, txq_id, idx,
+- trans->cfg->base_params->max_tfd_queue_size,
+- txq->write_ptr, txq->read_ptr);
++ WARN_ONCE(test_bit(txq_id, trans_pcie->queue_used),
++ "%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
++ __func__, txq_id, idx,
++ trans->cfg->base_params->max_tfd_queue_size,
++ txq->write_ptr, txq->read_ptr);
+ return;
+ }
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+index cce70252fd96..cbe4493b3266 100644
+--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c
++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+@@ -273,15 +273,13 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ "total samples = %d\n",
+ atomic_read(&phist_data->num_samples));
+
+- p += sprintf(p, "rx rates (in Mbps): 0=1M 1=2M");
+- p += sprintf(p, "2=5.5M 3=11M 4=6M 5=9M 6=12M\n");
+- p += sprintf(p, "7=18M 8=24M 9=36M 10=48M 11=54M");
+- p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
++ p += sprintf(p,
++ "rx rates (in Mbps): 0=1M 1=2M 2=5.5M 3=11M 4=6M 5=9M 6=12M\n"
++ "7=18M 8=24M 9=36M 10=48M 11=54M 12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
+
+ if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+- p += sprintf(p, "44-53=MCS0-9(VHT:BW20)");
+- p += sprintf(p, "54-63=MCS0-9(VHT:BW40)");
+- p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n");
++ p += sprintf(p,
++ "44-53=MCS0-9(VHT:BW20) 54-63=MCS0-9(VHT:BW40) 64-73=MCS0-9(VHT:BW80)\n\n");
+ } else {
+ p += sprintf(p, "\n");
+ }
+@@ -310,7 +308,7 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) {
+ value = atomic_read(&phist_data->noise_flr[i]);
+ if (value)
+- p += sprintf(p, "noise_flr[-%02ddBm] = %d\n",
++ p += sprintf(p, "noise_flr[%02ddBm] = %d\n",
+ (int)(i-128), value);
+ }
+ for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) {
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index ed27147efcb3..dd02bbd9544e 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -1906,15 +1906,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
+ ETH_ALEN))
+ mwifiex_update_curr_bss_params(priv,
+ bss);
+- cfg80211_put_bss(priv->wdev.wiphy, bss);
+- }
+
+- if ((chan->flags & IEEE80211_CHAN_RADAR) ||
+- (chan->flags & IEEE80211_CHAN_NO_IR)) {
+- mwifiex_dbg(adapter, INFO,
+- "radar or passive channel %d\n",
+- channel);
+- mwifiex_save_hidden_ssid_channels(priv, bss);
++ if ((chan->flags & IEEE80211_CHAN_RADAR) ||
++ (chan->flags & IEEE80211_CHAN_NO_IR)) {
++ mwifiex_dbg(adapter, INFO,
++ "radar or passive channel %d\n",
++ channel);
++ mwifiex_save_hidden_ssid_channels(priv,
++ bss);
++ }
++
++ cfg80211_put_bss(priv->wdev.wiphy, bss);
+ }
+ }
+ } else {
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+index 9a1d15b3ce45..518caaaf8a98 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+@@ -444,12 +444,13 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
+ skb_queue_tail(&priv->rx_queue, skb);
+ usb_anchor_urb(entry, &priv->anchored);
+ ret = usb_submit_urb(entry, GFP_KERNEL);
+- usb_put_urb(entry);
+ if (ret) {
+ skb_unlink(skb, &priv->rx_queue);
+ usb_unanchor_urb(entry);
++ usb_put_urb(entry);
+ goto err;
+ }
++ usb_put_urb(entry);
+ }
+ return ret;
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 44da9fe5b27b..c4ff4f079448 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -551,9 +551,19 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
+ struct nvme_dsm_range *range;
+ struct bio *bio;
+
+- range = kmalloc_array(segments, sizeof(*range), GFP_ATOMIC);
+- if (!range)
+- return BLK_STS_RESOURCE;
++ range = kmalloc_array(segments, sizeof(*range),
++ GFP_ATOMIC | __GFP_NOWARN);
++ if (!range) {
++ /*
++ * If we fail allocation our range, fallback to the controller
++ * discard page. If that's also busy, it's safe to return
++ * busy, as we know we can make progress once that's freed.
++ */
++ if (test_and_set_bit_lock(0, &ns->ctrl->discard_page_busy))
++ return BLK_STS_RESOURCE;
++
++ range = page_address(ns->ctrl->discard_page);
++ }
+
+ __rq_for_each_bio(bio, req) {
+ u64 slba = nvme_block_nr(ns, bio->bi_iter.bi_sector);
+@@ -568,7 +578,10 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
+ }
+
+ if (WARN_ON_ONCE(n != segments)) {
+- kfree(range);
++ if (virt_to_page(range) == ns->ctrl->discard_page)
++ clear_bit_unlock(0, &ns->ctrl->discard_page_busy);
++ else
++ kfree(range);
+ return BLK_STS_IOERR;
+ }
+
+@@ -653,8 +666,13 @@ void nvme_cleanup_cmd(struct request *req)
+ blk_rq_bytes(req) >> ns->lba_shift);
+ }
+ if (req->rq_flags & RQF_SPECIAL_PAYLOAD) {
+- kfree(page_address(req->special_vec.bv_page) +
+- req->special_vec.bv_offset);
++ struct nvme_ns *ns = req->rq_disk->private_data;
++ struct page *page = req->special_vec.bv_page;
++
++ if (page == ns->ctrl->discard_page)
++ clear_bit_unlock(0, &ns->ctrl->discard_page_busy);
++ else
++ kfree(page_address(page) + req->special_vec.bv_offset);
+ }
+ }
+ EXPORT_SYMBOL_GPL(nvme_cleanup_cmd);
+@@ -3551,6 +3569,7 @@ static void nvme_free_ctrl(struct device *dev)
+ ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+ kfree(ctrl->effects);
+ nvme_mpath_uninit(ctrl);
++ __free_page(ctrl->discard_page);
+
+ if (subsys) {
+ mutex_lock(&subsys->lock);
+@@ -3592,6 +3611,14 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
+ memset(&ctrl->ka_cmd, 0, sizeof(ctrl->ka_cmd));
+ ctrl->ka_cmd.common.opcode = nvme_admin_keep_alive;
+
++ BUILD_BUG_ON(NVME_DSM_MAX_RANGES * sizeof(struct nvme_dsm_range) >
++ PAGE_SIZE);
++ ctrl->discard_page = alloc_page(GFP_KERNEL);
++ if (!ctrl->discard_page) {
++ ret = -ENOMEM;
++ goto out;
++ }
++
+ ret = ida_simple_get(&nvme_instance_ida, 0, 0, GFP_KERNEL);
+ if (ret < 0)
+ goto out;
+@@ -3629,6 +3656,8 @@ out_free_name:
+ out_release_instance:
+ ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+ out:
++ if (ctrl->discard_page)
++ __free_page(ctrl->discard_page);
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(nvme_init_ctrl);
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index 2653e1f4196d..cc4273f11989 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -238,6 +238,9 @@ struct nvme_ctrl {
+ u16 maxcmd;
+ int nr_reconnects;
+ struct nvmf_ctrl_options *opts;
++
++ struct page *discard_page;
++ unsigned long discard_page_busy;
+ };
+
+ struct nvme_subsystem {
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index af24ed50a245..971dddf62374 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -1155,7 +1155,8 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ const struct irq_affinity *affd)
+ {
+ static const struct irq_affinity msi_default_affd;
+- int vecs = -ENOSPC;
++ int msix_vecs = -ENOSPC;
++ int msi_vecs = -ENOSPC;
+
+ if (flags & PCI_IRQ_AFFINITY) {
+ if (!affd)
+@@ -1166,16 +1167,17 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ }
+
+ if (flags & PCI_IRQ_MSIX) {
+- vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs,
+- affd);
+- if (vecs > 0)
+- return vecs;
++ msix_vecs = __pci_enable_msix_range(dev, NULL, min_vecs,
++ max_vecs, affd);
++ if (msix_vecs > 0)
++ return msix_vecs;
+ }
+
+ if (flags & PCI_IRQ_MSI) {
+- vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, affd);
+- if (vecs > 0)
+- return vecs;
++ msi_vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs,
++ affd);
++ if (msi_vecs > 0)
++ return msi_vecs;
+ }
+
+ /* use legacy irq if allowed */
+@@ -1186,7 +1188,9 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ }
+ }
+
+- return vecs;
++ if (msix_vecs == -ENOSPC)
++ return -ENOSPC;
++ return msi_vecs;
+ }
+ EXPORT_SYMBOL(pci_alloc_irq_vectors_affinity);
+
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index 9eab50839581..f16baf9b8696 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -157,6 +157,7 @@ struct chv_pin_context {
+ * @pctldesc: Pin controller description
+ * @pctldev: Pointer to the pin controller device
+ * @chip: GPIO chip in this pin controller
++ * @irqchip: IRQ chip in this pin controller
+ * @regs: MMIO registers
+ * @intr_lines: Stores mapping between 16 HW interrupt wires and GPIO
+ * offset (in GPIO number space)
+@@ -170,6 +171,7 @@ struct chv_pinctrl {
+ struct pinctrl_desc pctldesc;
+ struct pinctrl_dev *pctldev;
+ struct gpio_chip chip;
++ struct irq_chip irqchip;
+ void __iomem *regs;
+ unsigned intr_lines[16];
+ const struct chv_community *community;
+@@ -1477,16 +1479,6 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type)
+ return 0;
+ }
+
+-static struct irq_chip chv_gpio_irqchip = {
+- .name = "chv-gpio",
+- .irq_startup = chv_gpio_irq_startup,
+- .irq_ack = chv_gpio_irq_ack,
+- .irq_mask = chv_gpio_irq_mask,
+- .irq_unmask = chv_gpio_irq_unmask,
+- .irq_set_type = chv_gpio_irq_type,
+- .flags = IRQCHIP_SKIP_SET_WAKE,
+-};
+-
+ static void chv_gpio_irq_handler(struct irq_desc *desc)
+ {
+ struct gpio_chip *gc = irq_desc_get_handler_data(desc);
+@@ -1626,7 +1618,15 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ }
+ }
+
+- ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
++ pctrl->irqchip.name = "chv-gpio";
++ pctrl->irqchip.irq_startup = chv_gpio_irq_startup;
++ pctrl->irqchip.irq_ack = chv_gpio_irq_ack;
++ pctrl->irqchip.irq_mask = chv_gpio_irq_mask;
++ pctrl->irqchip.irq_unmask = chv_gpio_irq_unmask;
++ pctrl->irqchip.irq_set_type = chv_gpio_irq_type;
++ pctrl->irqchip.flags = IRQCHIP_SKIP_SET_WAKE;
++
++ ret = gpiochip_irqchip_add(chip, &pctrl->irqchip, 0,
+ handle_bad_irq, IRQ_TYPE_NONE);
+ if (ret) {
+ dev_err(pctrl->dev, "failed to add IRQ chip\n");
+@@ -1643,7 +1643,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ }
+ }
+
+- gpiochip_set_chained_irqchip(chip, &chv_gpio_irqchip, irq,
++ gpiochip_set_chained_irqchip(chip, &pctrl->irqchip, irq,
+ chv_gpio_irq_handler);
+ return 0;
+ }
+diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c
+index 93f8bd04e7fe..ae74b260b014 100644
+--- a/drivers/pinctrl/pinctrl-xway.c
++++ b/drivers/pinctrl/pinctrl-xway.c
+@@ -1746,14 +1746,6 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+ }
+ xway_pctrl_desc.pins = xway_info.pads;
+
+- /* register the gpio chip */
+- xway_chip.parent = &pdev->dev;
+- ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL);
+- if (ret) {
+- dev_err(&pdev->dev, "Failed to register gpio chip\n");
+- return ret;
+- }
+-
+ /* setup the data needed by pinctrl */
+ xway_pctrl_desc.name = dev_name(&pdev->dev);
+ xway_pctrl_desc.npins = xway_chip.ngpio;
+@@ -1775,10 +1767,33 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- /* finish with registering the gpio range in pinctrl */
+- xway_gpio_range.npins = xway_chip.ngpio;
+- xway_gpio_range.base = xway_chip.base;
+- pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range);
++ /* register the gpio chip */
++ xway_chip.parent = &pdev->dev;
++ xway_chip.owner = THIS_MODULE;
++ xway_chip.of_node = pdev->dev.of_node;
++ ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL);
++ if (ret) {
++ dev_err(&pdev->dev, "Failed to register gpio chip\n");
++ return ret;
++ }
++
++ /*
++ * For DeviceTree-supported systems, the gpio core checks the
++ * pinctrl's device node for the "gpio-ranges" property.
++ * If it is present, it takes care of adding the pin ranges
++ * for the driver. In this case the driver can skip ahead.
++ *
++ * In order to remain compatible with older, existing DeviceTree
++ * files which don't set the "gpio-ranges" property or systems that
++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
++ */
++ if (!of_property_read_bool(pdev->dev.of_node, "gpio-ranges")) {
++ /* finish with registering the gpio range in pinctrl */
++ xway_gpio_range.npins = xway_chip.ngpio;
++ xway_gpio_range.base = xway_chip.base;
++ pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range);
++ }
++
+ dev_info(&pdev->dev, "Init done\n");
+ return 0;
+ }
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
+index b81c807ac54d..d2fcf7f7b966 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
+@@ -395,7 +395,7 @@ FM(IP12_31_28) IP12_31_28 FM(IP13_31_28) IP13_31_28 FM(IP14_31_28) IP14_31_28 FM
+ #define MOD_SEL0_24 FM(SEL_HSCIF0_0) FM(SEL_HSCIF0_1)
+ #define MOD_SEL0_23 FM(SEL_HSCIF1_0) FM(SEL_HSCIF1_1)
+ #define MOD_SEL0_22 FM(SEL_HSCIF2_0) FM(SEL_HSCIF2_1)
+-#define MOD_SEL0_21_20 FM(SEL_I2C1_0) FM(SEL_I2C1_1) FM(SEL_I2C1_2) FM(SEL_I2C1_3) FM(SEL_I2C1_4) F_(0, 0) F_(0, 0) F_(0, 0)
++#define MOD_SEL0_21_20 FM(SEL_I2C1_0) FM(SEL_I2C1_1) FM(SEL_I2C1_2) FM(SEL_I2C1_3)
+ #define MOD_SEL0_19_18_17 FM(SEL_I2C2_0) FM(SEL_I2C2_1) FM(SEL_I2C2_2) FM(SEL_I2C2_3) FM(SEL_I2C2_4) F_(0, 0) F_(0, 0) F_(0, 0)
+ #define MOD_SEL0_16 FM(SEL_NDFC_0) FM(SEL_NDFC_1)
+ #define MOD_SEL0_15 FM(SEL_PWM0_0) FM(SEL_PWM0_1)
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+index 8070765311db..e1c34e19222e 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+@@ -1716,6 +1716,9 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ },
+
+ { PINMUX_CFG_REG("PFCR3", 0xfffe38a8, 16, 4) {
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ PF12MD_000, PF12MD_001, 0, PF12MD_011,
+ PF12MD_100, PF12MD_101, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0 }
+@@ -1759,8 +1762,10 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 0, 0, 0, 0, 0, 0, 0, 0,
+ PF1MD_000, PF1MD_001, PF1MD_010, PF1MD_011,
+ PF1MD_100, PF1MD_101, 0, 0,
+- 0, 0, 0, 0, 0, 0, 0, 0
+- }
++ 0, 0, 0, 0, 0, 0, 0, 0,
++ PF0MD_000, PF0MD_001, PF0MD_010, PF0MD_011,
++ PF0MD_100, PF0MD_101, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0 }
+ },
+
+ { PINMUX_CFG_REG("PFIOR0", 0xfffe38b2, 16, 1) {
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 6502e676d368..33232041ee86 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2213,22 +2213,22 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ /* IP10_22 [1] */
+ FN_CAN_CLK_A, FN_RX4_D,
+ /* IP10_21_19 [3] */
+- FN_AUDIO_CLKOUT, FN_TX1_E, FN_HRTS0_C, FN_FSE_B,
+- FN_LCD_M_DISP_B, 0, 0, 0,
++ FN_AUDIO_CLKOUT, FN_TX1_E, 0, FN_HRTS0_C, FN_FSE_B,
++ FN_LCD_M_DISP_B, 0, 0,
+ /* IP10_18_16 [3] */
+- FN_AUDIO_CLKC, FN_SCK1_E, FN_HCTS0_C, FN_FRB_B,
+- FN_LCD_VEPWC_B, 0, 0, 0,
++ FN_AUDIO_CLKC, FN_SCK1_E, 0, FN_HCTS0_C, FN_FRB_B,
++ FN_LCD_VEPWC_B, 0, 0,
+ /* IP10_15 [1] */
+ FN_AUDIO_CLKB_A, FN_LCD_CLK_B,
+ /* IP10_14_12 [3] */
+ FN_AUDIO_CLKA_A, FN_VI1_CLK_B, FN_SCK1_D, FN_IECLK_B,
+ FN_LCD_FLM_B, 0, 0, 0,
+ /* IP10_11_9 [3] */
+- FN_SSI_SDATA3, FN_VI1_7_B, FN_HTX0_C, FN_FWE_B,
+- FN_LCD_CL2_B, 0, 0, 0,
++ FN_SSI_SDATA3, FN_VI1_7_B, 0, FN_HTX0_C, FN_FWE_B,
++ FN_LCD_CL2_B, 0, 0,
+ /* IP10_8_6 [3] */
+- FN_SSI_SDATA2, FN_VI1_6_B, FN_HRX0_C, FN_FRE_B,
+- FN_LCD_CL1_B, 0, 0, 0,
++ FN_SSI_SDATA2, FN_VI1_6_B, 0, FN_HRX0_C, FN_FRE_B,
++ FN_LCD_CL1_B, 0, 0,
+ /* IP10_5_3 [3] */
+ FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
+ FN_LCD_DON_B, 0, 0, 0,
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index a9bec6e6fdd1..14dfbbd6c1c3 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -410,7 +410,7 @@ static int stm32_pctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ unsigned int num_configs;
+ bool has_config = 0;
+ unsigned reserve = 0;
+- int num_pins, num_funcs, maps_per_pin, i, err;
++ int num_pins, num_funcs, maps_per_pin, i, err = 0;
+
+ pctl = pinctrl_dev_get_drvdata(pctldev);
+
+@@ -437,41 +437,45 @@ static int stm32_pctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ if (has_config && num_pins >= 1)
+ maps_per_pin++;
+
+- if (!num_pins || !maps_per_pin)
+- return -EINVAL;
++ if (!num_pins || !maps_per_pin) {
++ err = -EINVAL;
++ goto exit;
++ }
+
+ reserve = num_pins * maps_per_pin;
+
+ err = pinctrl_utils_reserve_map(pctldev, map,
+ reserved_maps, num_maps, reserve);
+ if (err)
+- return err;
++ goto exit;
+
+ for (i = 0; i < num_pins; i++) {
+ err = of_property_read_u32_index(node, "pinmux",
+ i, &pinfunc);
+ if (err)
+- return err;
++ goto exit;
+
+ pin = STM32_GET_PIN_NO(pinfunc);
+ func = STM32_GET_PIN_FUNC(pinfunc);
+
+ if (!stm32_pctrl_is_function_valid(pctl, pin, func)) {
+ dev_err(pctl->dev, "invalid function.\n");
+- return -EINVAL;
++ err = -EINVAL;
++ goto exit;
+ }
+
+ grp = stm32_pctrl_find_group_by_pin(pctl, pin);
+ if (!grp) {
+ dev_err(pctl->dev, "unable to match pin %d to group\n",
+ pin);
+- return -EINVAL;
++ err = -EINVAL;
++ goto exit;
+ }
+
+ err = stm32_pctrl_dt_node_to_map_func(pctl, pin, func, grp, map,
+ reserved_maps, num_maps);
+ if (err)
+- return err;
++ goto exit;
+
+ if (has_config) {
+ err = pinctrl_utils_add_map_configs(pctldev, map,
+@@ -479,11 +483,13 @@ static int stm32_pctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ configs, num_configs,
+ PIN_MAP_TYPE_CONFIGS_GROUP);
+ if (err)
+- return err;
++ goto exit;
+ }
+ }
+
+- return 0;
++exit:
++ kfree(configs);
++ return err;
+ }
+
+ static int stm32_pctrl_dt_node_to_map(struct pinctrl_dev *pctldev,
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index b4224389febe..d0ffdd5d9199 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -78,7 +78,7 @@ struct bios_args {
+ u32 command;
+ u32 commandtype;
+ u32 datasize;
+- u32 data;
++ u8 data[128];
+ };
+
+ enum hp_wmi_commandtype {
+@@ -229,7 +229,7 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
+ .command = command,
+ .commandtype = query,
+ .datasize = insize,
+- .data = 0,
++ .data = { 0 },
+ };
+ struct acpi_buffer input = { sizeof(struct bios_args), &args };
+ struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+@@ -241,7 +241,7 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command,
+
+ if (WARN_ON(insize > sizeof(args.data)))
+ return -EINVAL;
+- memcpy(&args.data, buffer, insize);
++ memcpy(&args.data[0], buffer, insize);
+
+ wmi_evaluate_method(HPWMI_BIOS_GUID, 0, mid, &input, &output);
+
+@@ -393,7 +393,7 @@ static int hp_wmi_rfkill2_refresh(void)
+ int err, i;
+
+ err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state,
+- 0, sizeof(state));
++ sizeof(state), sizeof(state));
+ if (err)
+ return err;
+
+@@ -790,7 +790,7 @@ static int __init hp_wmi_rfkill2_setup(struct platform_device *device)
+ int err, i;
+
+ err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state,
+- 0, sizeof(state));
++ sizeof(state), sizeof(state));
+ if (err)
+ return err < 0 ? err : -EINVAL;
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index d17db140cb1f..69e28c12d591 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -1421,7 +1421,7 @@ static int __init mlxplat_dmi_msn201x_matched(const struct dmi_system_id *dmi)
+ mlxplat_hotplug = &mlxplat_mlxcpld_msn201x_data;
+ mlxplat_hotplug->deferred_nr =
+ mlxplat_default_channels[i - 1][MLXPLAT_CPLD_GRP_CHNL_NUM - 1];
+- mlxplat_led = &mlxplat_default_ng_led_data;
++ mlxplat_led = &mlxplat_msn21xx_led_data;
+ mlxplat_regs_io = &mlxplat_msn21xx_regs_io_data;
+
+ return 1;
+@@ -1439,7 +1439,7 @@ static int __init mlxplat_dmi_qmb7xx_matched(const struct dmi_system_id *dmi)
+ mlxplat_hotplug = &mlxplat_mlxcpld_default_ng_data;
+ mlxplat_hotplug->deferred_nr =
+ mlxplat_msn21xx_channels[MLXPLAT_CPLD_GRP_CHNL_NUM - 1];
+- mlxplat_led = &mlxplat_msn21xx_led_data;
++ mlxplat_led = &mlxplat_default_ng_led_data;
+ mlxplat_fan = &mlxplat_default_fan_data;
+
+ return 1;
+diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c
+index 1360a7fa542c..8760477d0e8a 100644
+--- a/drivers/power/avs/smartreflex.c
++++ b/drivers/power/avs/smartreflex.c
+@@ -1010,8 +1010,7 @@ static int omap_sr_remove(struct platform_device *pdev)
+
+ if (sr_info->autocomp_active)
+ sr_stop_vddautocomp(sr_info);
+- if (sr_info->dbg_dir)
+- debugfs_remove_recursive(sr_info->dbg_dir);
++ debugfs_remove_recursive(sr_info->dbg_dir);
+
+ pm_runtime_disable(&pdev->dev);
+ list_del(&sr_info->node);
+diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
+index c45e5719ba17..b1b74cfb1571 100644
+--- a/drivers/pwm/core.c
++++ b/drivers/pwm/core.c
+@@ -874,6 +874,7 @@ void pwm_put(struct pwm_device *pwm)
+ if (pwm->chip->ops->free)
+ pwm->chip->ops->free(pwm->chip, pwm);
+
++ pwm_set_chip_data(pwm, NULL);
+ pwm->label = NULL;
+
+ module_put(pwm->chip->ops->owner);
+diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
+index d961a8207b1c..31b01035d0ab 100644
+--- a/drivers/pwm/pwm-bcm-iproc.c
++++ b/drivers/pwm/pwm-bcm-iproc.c
+@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ static const struct pwm_ops iproc_pwm_ops = {
+ .apply = iproc_pwmc_apply,
+ .get_state = iproc_pwmc_get_state,
++ .owner = THIS_MODULE,
+ };
+
+ static int iproc_pwmc_probe(struct platform_device *pdev)
+diff --git a/drivers/pwm/pwm-berlin.c b/drivers/pwm/pwm-berlin.c
+index 7c8d6a168ceb..b91c477cc84b 100644
+--- a/drivers/pwm/pwm-berlin.c
++++ b/drivers/pwm/pwm-berlin.c
+@@ -84,7 +84,6 @@ static void berlin_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
+ {
+ struct berlin_pwm_channel *channel = pwm_get_chip_data(pwm);
+
+- pwm_set_chip_data(pwm, NULL);
+ kfree(channel);
+ }
+
+diff --git a/drivers/pwm/pwm-clps711x.c b/drivers/pwm/pwm-clps711x.c
+index 26ec24e457b1..7e16b7def0dc 100644
+--- a/drivers/pwm/pwm-clps711x.c
++++ b/drivers/pwm/pwm-clps711x.c
+@@ -48,7 +48,7 @@ static void clps711x_pwm_update_val(struct clps711x_chip *priv, u32 n, u32 v)
+ static unsigned int clps711x_get_duty(struct pwm_device *pwm, unsigned int v)
+ {
+ /* Duty cycle 0..15 max */
+- return DIV_ROUND_CLOSEST(v * 0xf, pwm_get_period(pwm));
++ return DIV_ROUND_CLOSEST(v * 0xf, pwm->args.period);
+ }
+
+ static int clps711x_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm)
+@@ -71,7 +71,7 @@ static int clps711x_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ struct clps711x_chip *priv = to_clps711x_chip(chip);
+ unsigned int duty;
+
+- if (period_ns != pwm_get_period(pwm))
++ if (period_ns != pwm->args.period)
+ return -EINVAL;
+
+ duty = clps711x_get_duty(pwm, duty_ns);
+diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
+index a7eaf962a95b..567f5e2771c4 100644
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -176,7 +176,6 @@ static void pca9685_pwm_gpio_free(struct gpio_chip *gpio, unsigned int offset)
+ pm_runtime_put(pca->chip.dev);
+ mutex_lock(&pca->lock);
+ pwm = &pca->chip.pwms[offset];
+- pwm_set_chip_data(pwm, NULL);
+ mutex_unlock(&pca->lock);
+ }
+
+diff --git a/drivers/pwm/pwm-samsung.c b/drivers/pwm/pwm-samsung.c
+index 062f2cfc45ec..3762432dd6a7 100644
+--- a/drivers/pwm/pwm-samsung.c
++++ b/drivers/pwm/pwm-samsung.c
+@@ -238,7 +238,6 @@ static int pwm_samsung_request(struct pwm_chip *chip, struct pwm_device *pwm)
+ static void pwm_samsung_free(struct pwm_chip *chip, struct pwm_device *pwm)
+ {
+ devm_kfree(chip->dev, pwm_get_chip_data(pwm));
+- pwm_set_chip_data(pwm, NULL);
+ }
+
+ static int pwm_samsung_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
+index bb5ab7d78895..c2cc392a27d4 100644
+--- a/drivers/regulator/palmas-regulator.c
++++ b/drivers/regulator/palmas-regulator.c
+@@ -443,13 +443,16 @@ static int palmas_ldo_write(struct palmas *palmas, unsigned int reg,
+ static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode)
+ {
+ int id = rdev_get_id(dev);
++ int ret;
+ struct palmas_pmic *pmic = rdev_get_drvdata(dev);
+ struct palmas_pmic_driver_data *ddata = pmic->palmas->pmic_ddata;
+ struct palmas_regs_info *rinfo = &ddata->palmas_regs_info[id];
+ unsigned int reg;
+ bool rail_enable = true;
+
+- palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®);
++ ret = palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®);
++ if (ret)
++ return ret;
+
+ reg &= ~PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+
+diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
+index 02ccdaa226a7..5ebb6ee73f07 100644
+--- a/drivers/regulator/tps65910-regulator.c
++++ b/drivers/regulator/tps65910-regulator.c
+@@ -1102,8 +1102,10 @@ static int tps65910_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, pmic);
+
+ /* Give control of all register to control port */
+- tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
++ err = tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
+ DEVCTRL_SR_CTL_I2C_SEL_MASK);
++ if (err < 0)
++ return err;
+
+ switch (tps65910_chip_id(tps65910)) {
+ case TPS65910:
+diff --git a/drivers/reset/core.c b/drivers/reset/core.c
+index d1887c0ed5d3..f7bf20493f23 100644
+--- a/drivers/reset/core.c
++++ b/drivers/reset/core.c
+@@ -607,6 +607,7 @@ static void reset_control_array_put(struct reset_control_array *resets)
+ for (i = 0; i < resets->num_rstcs; i++)
+ __reset_control_put_internal(resets->rstc[i]);
+ mutex_unlock(&reset_list_mutex);
++ kfree(resets);
+ }
+
+ /**
+diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
+index 0aa4b3ccc948..576ac08777c5 100644
+--- a/drivers/s390/crypto/ap_queue.c
++++ b/drivers/s390/crypto/ap_queue.c
+@@ -14,6 +14,9 @@
+ #include <asm/facility.h>
+
+ #include "ap_bus.h"
++#include "ap_debug.h"
++
++static void __ap_flush_queue(struct ap_queue *aq);
+
+ /**
+ * ap_queue_enable_interruption(): Enable interruption on an AP queue.
+@@ -541,7 +544,25 @@ static ssize_t reset_show(struct device *dev,
+ return rc;
+ }
+
+-static DEVICE_ATTR_RO(reset);
++static ssize_t reset_store(struct device *dev,
++ struct device_attribute *attr,
++ const char *buf, size_t count)
++{
++ struct ap_queue *aq = to_ap_queue(dev);
++
++ spin_lock_bh(&aq->lock);
++ __ap_flush_queue(aq);
++ aq->state = AP_STATE_RESET_START;
++ ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
++ spin_unlock_bh(&aq->lock);
++
++ AP_DBF(DBF_INFO, "reset queue=%02x.%04x triggered by user\n",
++ AP_QID_CARD(aq->qid), AP_QID_QUEUE(aq->qid));
++
++ return count;
++}
++
++static DEVICE_ATTR_RW(reset);
+
+ static ssize_t interrupt_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
+index ed2dae657964..1793981337dd 100644
+--- a/drivers/scsi/csiostor/csio_init.c
++++ b/drivers/scsi/csiostor/csio_init.c
+@@ -649,7 +649,7 @@ csio_shost_init(struct csio_hw *hw, struct device *dev,
+ if (csio_lnode_init(ln, hw, pln))
+ goto err_shost_put;
+
+- if (scsi_add_host(shost, dev))
++ if (scsi_add_host_with_dma(shost, dev, &hw->pdev->dev))
+ goto err_lnode_exit;
+
+ return ln;
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index fb2a5969181b..a7407d5376ba 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -1520,6 +1520,7 @@ static irqreturn_t fatal_axi_int_v3_hw(int irq_no, void *p)
+ u32 irq_value, irq_msk;
+ struct hisi_hba *hisi_hba = p;
+ struct device *dev = hisi_hba->dev;
++ struct pci_dev *pdev = hisi_hba->pci_dev;
+ int i;
+
+ irq_msk = hisi_sas_read32(hisi_hba, ENT_INT_SRC_MSK3);
+@@ -1551,6 +1552,17 @@ static irqreturn_t fatal_axi_int_v3_hw(int irq_no, void *p)
+ error->msg, irq_value);
+ queue_work(hisi_hba->wq, &hisi_hba->rst_work);
+ }
++
++ if (pdev->revision < 0x21) {
++ u32 reg_val;
++
++ reg_val = hisi_sas_read32(hisi_hba,
++ AXI_MASTER_CFG_BASE +
++ AM_CTRL_GLOBAL);
++ reg_val |= AM_CTRL_SHUTDOWN_REQ_MSK;
++ hisi_sas_write32(hisi_hba, AXI_MASTER_CFG_BASE +
++ AM_CTRL_GLOBAL, reg_val);
++ }
+ }
+
+ if (irq_value & BIT(ENT_INT_SRC3_ITC_INT_OFF)) {
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 2ee9c4ec7a54..3e74fe925761 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -614,7 +614,14 @@ int sas_smp_phy_control(struct domain_device *dev, int phy_id,
+ }
+
+ res = smp_execute_task(dev, pc_req, PC_REQ_SIZE, pc_resp,PC_RESP_SIZE);
+-
++ if (res) {
++ pr_err("ex %016llx phy%02d PHY control failed: %d\n",
++ SAS_ADDR(dev->sas_addr), phy_id, res);
++ } else if (pc_resp[2] != SMP_RESP_FUNC_ACC) {
++ pr_err("ex %016llx phy%02d PHY control failed: function result 0x%x\n",
++ SAS_ADDR(dev->sas_addr), phy_id, pc_resp[2]);
++ res = pc_resp[2];
++ }
+ kfree(pc_resp);
+ kfree(pc_req);
+ return res;
+@@ -817,6 +824,26 @@ static struct domain_device *sas_ex_discover_end_dev(
+
+ #ifdef CONFIG_SCSI_SAS_ATA
+ if ((phy->attached_tproto & SAS_PROTOCOL_STP) || phy->attached_sata_dev) {
++ if (child->linkrate > parent->min_linkrate) {
++ struct sas_phy_linkrates rates = {
++ .maximum_linkrate = parent->min_linkrate,
++ .minimum_linkrate = parent->min_linkrate,
++ };
++ int ret;
++
++ pr_notice("ex %016llx phy%02d SATA device linkrate > min pathway connection rate, attempting to lower device linkrate\n",
++ SAS_ADDR(child->sas_addr), phy_id);
++ ret = sas_smp_phy_control(parent, phy_id,
++ PHY_FUNC_LINK_RESET, &rates);
++ if (ret) {
++ pr_err("ex %016llx phy%02d SATA device could not set linkrate (%d)\n",
++ SAS_ADDR(child->sas_addr), phy_id, ret);
++ goto out_free;
++ }
++ pr_notice("ex %016llx phy%02d SATA device set linkrate successfully\n",
++ SAS_ADDR(child->sas_addr), phy_id);
++ child->linkrate = child->min_linkrate;
++ }
+ res = sas_get_ata_info(child, phy);
+ if (res)
+ goto out_free;
+diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
+index ebcfcbb8b4cc..a62e85cb62eb 100644
+--- a/drivers/scsi/lpfc/lpfc.h
++++ b/drivers/scsi/lpfc/lpfc.h
+@@ -1236,6 +1236,12 @@ lpfc_sli_read_hs(struct lpfc_hba *phba)
+ static inline struct lpfc_sli_ring *
+ lpfc_phba_elsring(struct lpfc_hba *phba)
+ {
++ /* Return NULL if sli_rev has become invalid due to bad fw */
++ if (phba->sli_rev != LPFC_SLI_REV4 &&
++ phba->sli_rev != LPFC_SLI_REV3 &&
++ phba->sli_rev != LPFC_SLI_REV2)
++ return NULL;
++
+ if (phba->sli_rev == LPFC_SLI_REV4) {
+ if (phba->sli4_hba.els_wq)
+ return phba->sli4_hba.els_wq->pring;
+diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
+index 55cd96e2469c..3f69a5e4e470 100644
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -1332,7 +1332,7 @@ lpfc_sli4_pdev_reg_request(struct lpfc_hba *phba, uint32_t opcode)
+ return -EACCES;
+
+ if ((phba->sli_rev < LPFC_SLI_REV4) ||
+- (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2))
+ return -EPERM;
+
+@@ -4264,7 +4264,7 @@ lpfc_link_speed_store(struct device *dev, struct device_attribute *attr,
+ uint32_t prev_val, if_type;
+
+ if_type = bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf);
+- if (if_type == LPFC_SLI_INTF_IF_TYPE_2 &&
++ if (if_type >= LPFC_SLI_INTF_IF_TYPE_2 &&
+ phba->hba_flag & HBA_FORCED_LINK_SPEED)
+ return -EPERM;
+
+diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
+index 90745feca808..99aea52e584b 100644
+--- a/drivers/scsi/lpfc/lpfc_bsg.c
++++ b/drivers/scsi/lpfc/lpfc_bsg.c
+@@ -2221,7 +2221,7 @@ lpfc_bsg_diag_loopback_mode(struct bsg_job *job)
+
+ if (phba->sli_rev < LPFC_SLI_REV4)
+ rc = lpfc_sli3_bsg_diag_loopback_mode(phba, job);
+- else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) ==
++ else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >=
+ LPFC_SLI_INTF_IF_TYPE_2)
+ rc = lpfc_sli4_bsg_diag_loopback_mode(phba, job);
+ else
+@@ -2261,7 +2261,7 @@ lpfc_sli4_bsg_diag_mode_end(struct bsg_job *job)
+
+ if (phba->sli_rev < LPFC_SLI_REV4)
+ return -ENODEV;
+- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2)
+ return -ENODEV;
+
+@@ -2353,7 +2353,7 @@ lpfc_sli4_bsg_link_diag_test(struct bsg_job *job)
+ rc = -ENODEV;
+ goto job_error;
+ }
+- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2) {
+ rc = -ENODEV;
+ goto job_error;
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 222fa9b7f478..4f4d1b3b3bbc 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -1343,6 +1343,8 @@ lpfc_els_abort_flogi(struct lpfc_hba *phba)
+ Fabric_DID);
+
+ pring = lpfc_phba_elsring(phba);
++ if (unlikely(!pring))
++ return -EIO;
+
+ /*
+ * Check the txcmplq for an iocb that matches the nport the driver is
+@@ -5557,7 +5559,7 @@ lpfc_els_rcv_rdp(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
+ struct ls_rjt stat;
+
+ if (phba->sli_rev < LPFC_SLI_REV4 ||
+- bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2) {
+ rjt_err = LSRJT_UNABLE_TPC;
+ rjt_expl = LSEXP_REQ_UNSUPPORTED;
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index 68f223882d96..b36b3da323a0 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -4780,7 +4780,7 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
+ if (phba->sli_rev == LPFC_SLI_REV4 &&
+ (!(vport->load_flag & FC_UNLOADING)) &&
+ (bf_get(lpfc_sli_intf_if_type,
+- &phba->sli4_hba.sli_intf) ==
++ &phba->sli4_hba.sli_intf) >=
+ LPFC_SLI_INTF_IF_TYPE_2) &&
+ (kref_read(&ndlp->kref) > 0)) {
+ mbox->context1 = lpfc_nlp_get(ndlp);
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index a7d3e532e0f5..da63c026ba46 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -1801,7 +1801,12 @@ lpfc_sli4_port_sta_fn_reset(struct lpfc_hba *phba, int mbx_action,
+ lpfc_offline(phba);
+ /* release interrupt for possible resource change */
+ lpfc_sli4_disable_intr(phba);
+- lpfc_sli_brdrestart(phba);
++ rc = lpfc_sli_brdrestart(phba);
++ if (rc) {
++ lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
++ "6309 Failed to restart board\n");
++ return rc;
++ }
+ /* request and enable interrupt */
+ intr_mode = lpfc_sli4_enable_intr(phba, phba->intr_mode);
+ if (intr_mode == LPFC_INTR_ERROR) {
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 666495f21c24..425b83618a2e 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -2732,6 +2732,7 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ int prot_group_type = 0;
+ int fcpdl;
++ struct lpfc_vport *vport = phba->pport;
+
+ /*
+ * Start the lpfc command prep by bumping the bpl beyond fcp_cmnd
+@@ -2837,6 +2838,14 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ */
+ iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+
++ /*
++ * For First burst, we may need to adjust the initial transfer
++ * length for DIF
++ */
++ if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++ (fcpdl < vport->cfg_first_burst_size))
++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ return 0;
+ err:
+ if (lpfc_cmd->seg_cnt)
+@@ -3401,6 +3410,7 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ int prot_group_type = 0;
+ int fcpdl;
++ struct lpfc_vport *vport = phba->pport;
+
+ /*
+ * Start the lpfc command prep by bumping the sgl beyond fcp_cmnd
+@@ -3516,6 +3526,14 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ */
+ iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+
++ /*
++ * For First burst, we may need to adjust the initial transfer
++ * length for DIF
++ */
++ if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++ (fcpdl < vport->cfg_first_burst_size))
++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ /*
+ * If the OAS driver feature is enabled and the lun is enabled for
+ * OAS, set the oas iocb related flags.
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 3361ae75578f..755803ff6cfe 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -4640,6 +4640,8 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba)
+ hba_aer_enabled = phba->hba_flag & HBA_AER_ENABLED;
+
+ rc = lpfc_sli4_brdreset(phba);
++ if (rc)
++ return rc;
+
+ spin_lock_irq(&phba->hbalock);
+ phba->pport->stopped = 0;
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index 15d493f30810..3e9c49b3184f 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -2161,6 +2161,8 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
+ test_bit(FCPORT_UPDATE_NEEDED, &vha->dpc_flags))
+ msleep(1000);
+
++ qla_nvme_delete(vha);
++
+ qla24xx_disable_vp(vha);
+ qla2x00_wait_for_sess_deletion(vha);
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 653d535e3052..f7dd289779b1 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -242,15 +242,13 @@ qla2x00_async_login(struct scsi_qla_host *vha, fc_port_t *fcport,
+ qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
+
+ sp->done = qla2x00_async_login_sp_done;
+- if (N2N_TOPO(fcport->vha->hw) && fcport_is_bigger(fcport)) {
++ if (N2N_TOPO(fcport->vha->hw) && fcport_is_bigger(fcport))
+ lio->u.logio.flags |= SRB_LOGIN_PRLI_ONLY;
+- } else {
++ else
+ lio->u.logio.flags |= SRB_LOGIN_COND_PLOGI;
+
+- if (fcport->fc4f_nvme)
+- lio->u.logio.flags |= SRB_LOGIN_SKIP_PRLI;
+-
+- }
++ if (fcport->fc4f_nvme)
++ lio->u.logio.flags |= SRB_LOGIN_SKIP_PRLI;
+
+ ql_dbg(ql_dbg_disc, vha, 0x2072,
+ "Async-login - %8phC hdl=%x, loopid=%x portid=%02x%02x%02x "
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index e6545cb9a2c1..5590d6e8b576 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -474,21 +474,10 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
+ int rval = -ENODEV;
+ srb_t *sp;
+ struct qla_qpair *qpair = hw_queue_handle;
+- struct nvme_private *priv;
++ struct nvme_private *priv = fd->private;
+ struct qla_nvme_rport *qla_rport = rport->private;
+
+- if (!fd || !qpair) {
+- ql_log(ql_log_warn, NULL, 0x2134,
+- "NO NVMe request or Queue Handle\n");
+- return rval;
+- }
+-
+- priv = fd->private;
+ fcport = qla_rport->fcport;
+- if (!fcport) {
+- ql_log(ql_log_warn, NULL, 0x210e, "No fcport ptr\n");
+- return rval;
+- }
+
+ vha = fcport->vha;
+
+@@ -517,6 +506,7 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
+ sp->name = "nvme_cmd";
+ sp->done = qla_nvme_sp_done;
+ sp->qpair = qpair;
++ sp->vha = vha;
+ nvme = &sp->u.iocb_cmd;
+ nvme->u.nvme.desc = fd;
+
+@@ -564,7 +554,7 @@ static void qla_nvme_remoteport_delete(struct nvme_fc_remote_port *rport)
+ schedule_work(&fcport->free_work);
+ }
+
+- fcport->nvme_flag &= ~(NVME_FLAG_REGISTERED | NVME_FLAG_DELETING);
++ fcport->nvme_flag &= ~NVME_FLAG_DELETING;
+ ql_log(ql_log_info, fcport->vha, 0x2110,
+ "remoteport_delete of %p completed.\n", fcport);
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 3e892e013658..183bfda8f5d1 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3538,6 +3538,8 @@ qla2x00_delete_all_vps(struct qla_hw_data *ha, scsi_qla_host_t *base_vha)
+ spin_unlock_irqrestore(&ha->vport_slock, flags);
+ mutex_unlock(&ha->vport_lock);
+
++ qla_nvme_delete(vha);
++
+ fc_vport_terminate(vha->fc_vport);
+ scsi_host_put(vha->host);
+
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index b8c1a739dfbd..654e1af7f542 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -926,38 +926,14 @@ static ssize_t tcm_qla2xxx_tpg_enable_show(struct config_item *item,
+ atomic_read(&tpg->lport_tpg_enabled));
+ }
+
+-static void tcm_qla2xxx_depend_tpg(struct work_struct *work)
+-{
+- struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+- struct tcm_qla2xxx_tpg, tpg_base_work);
+- struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+- if (!target_depend_item(&se_tpg->tpg_group.cg_item)) {
+- atomic_set(&base_tpg->lport_tpg_enabled, 1);
+- qlt_enable_vha(base_vha);
+- }
+- complete(&base_tpg->tpg_base_comp);
+-}
+-
+-static void tcm_qla2xxx_undepend_tpg(struct work_struct *work)
+-{
+- struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+- struct tcm_qla2xxx_tpg, tpg_base_work);
+- struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+- if (!qlt_stop_phase1(base_vha->vha_tgt.qla_tgt)) {
+- atomic_set(&base_tpg->lport_tpg_enabled, 0);
+- target_undepend_item(&se_tpg->tpg_group.cg_item);
+- }
+- complete(&base_tpg->tpg_base_comp);
+-}
+-
+ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ const char *page, size_t count)
+ {
+ struct se_portal_group *se_tpg = to_tpg(item);
++ struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
++ struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
++ struct tcm_qla2xxx_lport, lport_wwn);
++ struct scsi_qla_host *vha = lport->qla_vha;
+ struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
+ struct tcm_qla2xxx_tpg, se_tpg);
+ unsigned long op;
+@@ -976,24 +952,16 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ if (atomic_read(&tpg->lport_tpg_enabled))
+ return -EEXIST;
+
+- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_depend_tpg);
++ atomic_set(&tpg->lport_tpg_enabled, 1);
++ qlt_enable_vha(vha);
+ } else {
+ if (!atomic_read(&tpg->lport_tpg_enabled))
+ return count;
+
+- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_undepend_tpg);
++ atomic_set(&tpg->lport_tpg_enabled, 0);
++ qlt_stop_phase1(vha->vha_tgt.qla_tgt);
+ }
+- init_completion(&tpg->tpg_base_comp);
+- schedule_work(&tpg->tpg_base_work);
+- wait_for_completion(&tpg->tpg_base_comp);
+
+- if (op) {
+- if (!atomic_read(&tpg->lport_tpg_enabled))
+- return -ENODEV;
+- } else {
+- if (atomic_read(&tpg->lport_tpg_enabled))
+- return -EPERM;
+- }
+ return count;
+ }
+
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+index 7550ba2831c3..147cf6c90366 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+@@ -48,9 +48,6 @@ struct tcm_qla2xxx_tpg {
+ struct tcm_qla2xxx_tpg_attrib tpg_attrib;
+ /* Returned by tcm_qla2xxx_make_tpg() */
+ struct se_portal_group se_tpg;
+- /* Items for dealing with configfs_depend_item */
+- struct completion tpg_base_comp;
+- struct work_struct tpg_base_work;
+ };
+
+ struct tcm_qla2xxx_fc_loopid {
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+index d2605158546b..7cdced0b0581 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+@@ -1627,14 +1627,15 @@ static void _rtl92e_hard_data_xmit(struct sk_buff *skb, struct net_device *dev,
+ memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
+ skb_push(skb, priv->rtllib->tx_headroom);
+ ret = _rtl92e_tx(dev, skb);
+- if (ret != 0)
+- kfree_skb(skb);
+
+ if (queue_index != MGNT_QUEUE) {
+ priv->rtllib->stats.tx_bytes += (skb->len -
+ priv->rtllib->tx_headroom);
+ priv->rtllib->stats.tx_packets++;
+ }
++
++ if (ret != 0)
++ kfree_skb(skb);
+ }
+
+ static int _rtl92e_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+index 6d02904de63f..49ea780f9f42 100644
+--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+@@ -17,18 +17,13 @@
+ static const struct sdio_device_id sdio_ids[] =
+ {
+ { SDIO_DEVICE(0x024c, 0x0523), },
++ { SDIO_DEVICE(0x024c, 0x0525), },
+ { SDIO_DEVICE(0x024c, 0x0623), },
+ { SDIO_DEVICE(0x024c, 0x0626), },
+ { SDIO_DEVICE(0x024c, 0xb723), },
+ { /* end: all zeroes */ },
+ };
+-static const struct acpi_device_id acpi_ids[] = {
+- {"OBDA8723", 0x0000},
+- {}
+-};
+-
+ MODULE_DEVICE_TABLE(sdio, sdio_ids);
+-MODULE_DEVICE_TABLE(acpi, acpi_ids);
+
+ static int rtw_drv_init(struct sdio_func *func, const struct sdio_device_id *id);
+ static void rtw_dev_remove(struct sdio_func *func);
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 7159e8363b83..7ee0a75ce452 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -962,7 +962,7 @@ static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd)
+ * 0 success
+ * 1 internally queued to wait for ring memory to free.
+ */
+-static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err)
++static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err)
+ {
+ struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
+ struct se_cmd *se_cmd = tcmu_cmd->se_cmd;
+diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
+index bc7efa6e515d..678bf3365947 100644
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -167,7 +167,7 @@ static int nvm_validate_and_write(struct tb_switch *sw)
+
+ static int nvm_authenticate_host(struct tb_switch *sw)
+ {
+- int ret;
++ int ret = 0;
+
+ /*
+ * Root switch NVM upgrade requires that we disconnect the
+@@ -175,6 +175,8 @@ static int nvm_authenticate_host(struct tb_switch *sw)
+ * already).
+ */
+ if (!sw->safe_mode) {
++ u32 status;
++
+ ret = tb_domain_disconnect_all_paths(sw->tb);
+ if (ret)
+ return ret;
+@@ -183,7 +185,16 @@ static int nvm_authenticate_host(struct tb_switch *sw)
+ * everything goes well so getting timeout is expected.
+ */
+ ret = dma_port_flash_update_auth(sw->dma_port);
+- return ret == -ETIMEDOUT ? 0 : ret;
++ if (!ret || ret == -ETIMEDOUT)
++ return 0;
++
++ /*
++ * Any error from update auth operation requires power
++ * cycling of the host router.
++ */
++ tb_sw_warn(sw, "failed to authenticate NVM, power cycling\n");
++ if (dma_port_flash_update_auth_status(sw->dma_port, &status) > 0)
++ nvm_set_auth_status(sw, status);
+ }
+
+ /*
+@@ -191,7 +202,7 @@ static int nvm_authenticate_host(struct tb_switch *sw)
+ * switch.
+ */
+ dma_port_power_cycle(sw->dma_port);
+- return 0;
++ return ret;
+ }
+
+ static int nvm_authenticate_device(struct tb_switch *sw)
+@@ -199,8 +210,16 @@ static int nvm_authenticate_device(struct tb_switch *sw)
+ int ret, retries = 10;
+
+ ret = dma_port_flash_update_auth(sw->dma_port);
+- if (ret && ret != -ETIMEDOUT)
++ switch (ret) {
++ case 0:
++ case -ETIMEDOUT:
++ case -EACCES:
++ case -EINVAL:
++ /* Power cycle is required */
++ break;
++ default:
+ return ret;
++ }
+
+ /*
+ * Poll here for the authentication status. It takes some time
+@@ -937,8 +956,6 @@ static ssize_t nvm_authenticate_store(struct device *dev,
+ */
+ nvm_authenticate_start(sw);
+ ret = nvm_authenticate_host(sw);
+- if (ret)
+- nvm_authenticate_complete(sw);
+ } else {
+ ret = nvm_authenticate_device(sw);
+ }
+@@ -1332,13 +1349,16 @@ static int tb_switch_add_dma_port(struct tb_switch *sw)
+ int ret;
+
+ switch (sw->generation) {
+- case 3:
+- break;
+-
+ case 2:
+ /* Only root switch can be upgraded */
+ if (tb_route(sw))
+ return 0;
++
++ /* fallthrough */
++ case 3:
++ ret = tb_switch_set_uuid(sw);
++ if (ret)
++ return ret;
+ break;
+
+ default:
+@@ -1358,6 +1378,19 @@ static int tb_switch_add_dma_port(struct tb_switch *sw)
+ if (!sw->dma_port)
+ return 0;
+
++ /*
++ * If there is status already set then authentication failed
++ * when the dma_port_flash_update_auth() returned. Power cycling
++ * is not needed (it was done already) so only thing we do here
++ * is to unblock runtime PM of the root port.
++ */
++ nvm_get_auth_status(sw, &status);
++ if (status) {
++ if (!tb_route(sw))
++ nvm_authenticate_complete(sw);
++ return 0;
++ }
++
+ /*
+ * Check status of the previous flash authentication. If there
+ * is one we need to power cycle the switch in any case to make
+@@ -1373,9 +1406,6 @@ static int tb_switch_add_dma_port(struct tb_switch *sw)
+
+ if (status) {
+ tb_sw_info(sw, "switch flash authentication failed\n");
+- ret = tb_switch_set_uuid(sw);
+- if (ret)
+- return ret;
+ nvm_set_auth_status(sw, status);
+ }
+
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index 8fe3d0ed229e..69aaee5d7fe1 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -946,6 +946,21 @@ static struct uart_8250_port *serial8250_find_match_or_unused(struct uart_port *
+ return NULL;
+ }
+
++static void serial_8250_overrun_backoff_work(struct work_struct *work)
++{
++ struct uart_8250_port *up =
++ container_of(to_delayed_work(work), struct uart_8250_port,
++ overrun_backoff);
++ struct uart_port *port = &up->port;
++ unsigned long flags;
++
++ spin_lock_irqsave(&port->lock, flags);
++ up->ier |= UART_IER_RLSI | UART_IER_RDI;
++ up->port.read_status_mask |= UART_LSR_DR;
++ serial_out(up, UART_IER, up->ier);
++ spin_unlock_irqrestore(&port->lock, flags);
++}
++
+ /**
+ * serial8250_register_8250_port - register a serial port
+ * @up: serial port template
+@@ -1059,7 +1074,18 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+
+ ret = 0;
+ }
++
++ /* Initialise interrupt backoff work if required */
++ if (up->overrun_backoff_time_ms > 0) {
++ uart->overrun_backoff_time_ms =
++ up->overrun_backoff_time_ms;
++ INIT_DELAYED_WORK(&uart->overrun_backoff,
++ serial_8250_overrun_backoff_work);
++ } else {
++ uart->overrun_backoff_time_ms = 0;
++ }
+ }
++
+ mutex_unlock(&serial_mutex);
+
+ return ret;
+diff --git a/drivers/tty/serial/8250/8250_fsl.c b/drivers/tty/serial/8250/8250_fsl.c
+index 6640a4c7ddd1..bb9571eed275 100644
+--- a/drivers/tty/serial/8250/8250_fsl.c
++++ b/drivers/tty/serial/8250/8250_fsl.c
+@@ -45,8 +45,29 @@ int fsl8250_handle_irq(struct uart_port *port)
+
+ lsr = orig_lsr = up->port.serial_in(&up->port, UART_LSR);
+
+- if (lsr & (UART_LSR_DR | UART_LSR_BI))
++ /* Process incoming characters first */
++ if ((lsr & (UART_LSR_DR | UART_LSR_BI)) &&
++ (up->ier & (UART_IER_RLSI | UART_IER_RDI))) {
+ lsr = serial8250_rx_chars(up, lsr);
++ }
++
++ /* Stop processing interrupts on input overrun */
++ if ((orig_lsr & UART_LSR_OE) && (up->overrun_backoff_time_ms > 0)) {
++ unsigned long delay;
++
++ up->ier = port->serial_in(port, UART_IER);
++ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
++ port->ops->stop_rx(port);
++ } else {
++ /* Keep restarting the timer until
++ * the input overrun subsides.
++ */
++ cancel_delayed_work(&up->overrun_backoff);
++ }
++
++ delay = msecs_to_jiffies(up->overrun_backoff_time_ms);
++ schedule_delayed_work(&up->overrun_backoff, delay);
++ }
+
+ serial8250_modem_status(up);
+
+diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c
+index 98125de2f0a6..2488de1c4bc4 100644
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -244,6 +244,11 @@ static int of_platform_serial_probe(struct platform_device *ofdev)
+ if (of_property_read_bool(ofdev->dev.of_node, "auto-flow-control"))
+ port8250.capabilities |= UART_CAP_AFE;
+
++ if (of_property_read_u32(ofdev->dev.of_node,
++ "overrun-throttle-ms",
++ &port8250.overrun_backoff_time_ms) != 0)
++ port8250.overrun_backoff_time_ms = 0;
++
+ ret = serial8250_register_8250_port(&port8250);
+ if (ret < 0)
+ goto err_dispose;
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index bd3e6cf81af5..0c35c3c5e373 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -844,12 +844,9 @@ static void max310x_wq_proc(struct work_struct *ws)
+
+ static unsigned int max310x_tx_empty(struct uart_port *port)
+ {
+- unsigned int lvl, sts;
++ u8 lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+
+- lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+- sts = max310x_port_read(port, MAX310X_IRQSTS_REG);
+-
+- return ((sts & MAX310X_IRQ_TXEMPTY_BIT) && !lvl) ? TIOCSER_TEMT : 0;
++ return lvl ? 0 : TIOCSER_TEMT;
+ }
+
+ static unsigned int max310x_get_mctrl(struct uart_port *port)
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 5550289e6678..9e1a6af23ca2 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1359,7 +1359,7 @@ fail:
+ dmaengine_terminate_async(chan);
+ for (i = 0; i < 2; i++)
+ s->cookie_rx[i] = -EINVAL;
+- s->active_rx = -EINVAL;
++ s->active_rx = 0;
+ s->chan_rx = NULL;
+ sci_start_rx(port);
+ if (!port_lock_held)
+diff --git a/drivers/usb/dwc2/core.c b/drivers/usb/dwc2/core.c
+index 51d83f77dc04..633ba0123efb 100644
+--- a/drivers/usb/dwc2/core.c
++++ b/drivers/usb/dwc2/core.c
+@@ -524,7 +524,7 @@ int dwc2_core_reset(struct dwc2_hsotg *hsotg, bool skip_wait)
+ greset |= GRSTCTL_CSFTRST;
+ dwc2_writel(hsotg, greset, GRSTCTL);
+
+- if (dwc2_hsotg_wait_bit_clear(hsotg, GRSTCTL, GRSTCTL_CSFTRST, 50)) {
++ if (dwc2_hsotg_wait_bit_clear(hsotg, GRSTCTL, GRSTCTL_CSFTRST, 10000)) {
+ dev_warn(hsotg->dev, "%s: HANG! Soft Reset timeout GRSTCTL GRSTCTL_CSFTRST\n",
+ __func__);
+ return -EBUSY;
+diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
+index 7e4c13346a1e..7d20296cbe9f 100644
+--- a/drivers/usb/host/ehci-omap.c
++++ b/drivers/usb/host/ehci-omap.c
+@@ -159,11 +159,12 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+ /* get the PHY device */
+ phy = devm_usb_get_phy_by_phandle(dev, "phys", i);
+ if (IS_ERR(phy)) {
+- /* Don't bail out if PHY is not absolutely necessary */
+- if (pdata->port_mode[i] != OMAP_EHCI_PORT_MODE_PHY)
++ ret = PTR_ERR(phy);
++ if (ret == -ENODEV) { /* no PHY */
++ phy = NULL;
+ continue;
++ }
+
+- ret = PTR_ERR(phy);
+ if (ret != -EPROBE_DEFER)
+ dev_err(dev, "Can't get PHY for port %d: %d\n",
+ i, ret);
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index f06706efb7f1..3c0f38cd3a5a 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1023,6 +1023,9 @@ static const struct usb_device_id id_table_combined[] = {
+ /* Sienna devices */
+ { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) },
+ { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) },
++ /* U-Blox devices */
++ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
++ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 22d66217cb41..e8373528264c 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1558,3 +1558,10 @@
+ */
+ #define UNJO_VID 0x22B7
+ #define UNJO_ISODEBUG_V1_PID 0x150D
++
++/*
++ * U-Blox products (http://www.u-blox.com).
++ */
++#define UBLOX_VID 0x1546
++#define UBLOX_C099F9P_ZED_PID 0x0502
++#define UBLOX_C099F9P_ODIN_PID 0x0503
+diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
+index 96721b154454..ec53310f1613 100644
+--- a/drivers/vfio/vfio_iommu_spapr_tce.c
++++ b/drivers/vfio/vfio_iommu_spapr_tce.c
+@@ -371,6 +371,7 @@ static void tce_iommu_release(void *iommu_data)
+ {
+ struct tce_container *container = iommu_data;
+ struct tce_iommu_group *tcegrp;
++ struct tce_iommu_prereg *tcemem, *tmtmp;
+ long i;
+
+ while (tce_groups_attached(container)) {
+@@ -393,13 +394,8 @@ static void tce_iommu_release(void *iommu_data)
+ tce_iommu_free_table(container, tbl);
+ }
+
+- while (!list_empty(&container->prereg_list)) {
+- struct tce_iommu_prereg *tcemem;
+-
+- tcemem = list_first_entry(&container->prereg_list,
+- struct tce_iommu_prereg, next);
+- WARN_ON_ONCE(tce_iommu_prereg_free(container, tcemem));
+- }
++ list_for_each_entry_safe(tcemem, tmtmp, &container->prereg_list, next)
++ WARN_ON(tce_iommu_prereg_free(container, tcemem));
+
+ tce_iommu_disable(container);
+ if (container->mm)
+diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c
+index 69adeab3fde7..0a6672789640 100644
+--- a/drivers/watchdog/meson_gxbb_wdt.c
++++ b/drivers/watchdog/meson_gxbb_wdt.c
+@@ -89,8 +89,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev)
+
+ reg = readl(data->reg_base + GXBB_WDT_TCNT_REG);
+
+- return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) -
+- (reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000;
++ return ((reg & GXBB_WDT_TCNT_SETUP_MASK) -
++ (reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000;
+ }
+
+ static const struct watchdog_ops meson_gxbb_wdt_ops = {
+diff --git a/drivers/watchdog/sama5d4_wdt.c b/drivers/watchdog/sama5d4_wdt.c
+index 1e93c1b0e3cf..d4953365dd9a 100644
+--- a/drivers/watchdog/sama5d4_wdt.c
++++ b/drivers/watchdog/sama5d4_wdt.c
+@@ -111,9 +111,7 @@ static int sama5d4_wdt_set_timeout(struct watchdog_device *wdd,
+ u32 value = WDT_SEC2TICKS(timeout);
+
+ wdt->mr &= ~AT91_WDT_WDV;
+- wdt->mr &= ~AT91_WDT_WDD;
+ wdt->mr |= AT91_WDT_SET_WDV(value);
+- wdt->mr |= AT91_WDT_SET_WDD(value);
+
+ /*
+ * WDDIS has to be 0 when updating WDD/WDV. The datasheet states: When
+@@ -251,7 +249,7 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
+
+ timeout = WDT_SEC2TICKS(wdd->timeout);
+
+- wdt->mr |= AT91_WDT_SET_WDD(timeout);
++ wdt->mr |= AT91_WDT_SET_WDD(WDT_SEC2TICKS(MAX_WDT_TIMEOUT));
+ wdt->mr |= AT91_WDT_SET_WDV(timeout);
+
+ ret = sama5d4_wdt_init(wdt);
+diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
+index 59661db144e5..097410a7cdb7 100644
+--- a/drivers/xen/xen-pciback/pci_stub.c
++++ b/drivers/xen/xen-pciback/pci_stub.c
+@@ -106,7 +106,8 @@ static void pcistub_device_release(struct kref *kref)
+ * is called from "unbind" which takes a device_lock mutex.
+ */
+ __pci_reset_function_locked(dev);
+- if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
++ if (dev_data &&
++ pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
+ dev_info(&dev->dev, "Could not reload PCI state\n");
+ else
+ pci_restore_state(dev);
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 62ff545ba1f7..7e5c81e80e15 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -234,8 +234,6 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans,
+ ref->in_tree = 0;
+ btrfs_put_delayed_ref(ref);
+ atomic_dec(&delayed_refs->num_entries);
+- if (trans->delayed_ref_updates)
+- trans->delayed_ref_updates--;
+ }
+
+ static bool merge_ref(struct btrfs_trans_handle *trans,
+@@ -446,7 +444,6 @@ inserted:
+ if (ref->action == BTRFS_ADD_DELAYED_REF)
+ list_add_tail(&ref->add_list, &href->ref_add_list);
+ atomic_inc(&root->num_entries);
+- trans->delayed_ref_updates++;
+ spin_unlock(&href->lock);
+ return ret;
+ }
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index 23b13fbecdc2..96763805787e 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -810,16 +810,23 @@ int btrfs_dev_replace_cancel(struct btrfs_fs_info *fs_info)
+ btrfs_dev_replace_write_unlock(dev_replace);
+ break;
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED:
+- result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NO_ERROR;
+ tgt_device = dev_replace->tgtdev;
+ src_device = dev_replace->srcdev;
+ btrfs_dev_replace_write_unlock(dev_replace);
+- btrfs_scrub_cancel(fs_info);
+- /* btrfs_dev_replace_finishing() will handle the cleanup part */
+- btrfs_info_in_rcu(fs_info,
+- "dev_replace from %s (devid %llu) to %s canceled",
+- btrfs_dev_name(src_device), src_device->devid,
+- btrfs_dev_name(tgt_device));
++ ret = btrfs_scrub_cancel(fs_info);
++ if (ret < 0) {
++ result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NOT_STARTED;
++ } else {
++ result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NO_ERROR;
++ /*
++ * btrfs_dev_replace_finishing() will handle the
++ * cleanup part
++ */
++ btrfs_info_in_rcu(fs_info,
++ "dev_replace from %s (devid %llu) to %s canceled",
++ btrfs_dev_name(src_device), src_device->devid,
++ btrfs_dev_name(tgt_device));
++ }
+ break;
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED:
+ /*
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index b2dc613ebed2..96296dc7d2ea 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4350,6 +4350,8 @@ static int btrfs_destroy_pinned_extent(struct btrfs_fs_info *fs_info,
+ unpin = pinned_extents;
+ again:
+ while (1) {
++ struct extent_state *cached_state = NULL;
++
+ /*
+ * The btrfs_finish_extent_commit() may get the same range as
+ * ours between find_first_extent_bit and clear_extent_dirty.
+@@ -4358,13 +4360,14 @@ again:
+ */
+ mutex_lock(&fs_info->unused_bg_unpin_mutex);
+ ret = find_first_extent_bit(unpin, 0, &start, &end,
+- EXTENT_DIRTY, NULL);
++ EXTENT_DIRTY, &cached_state);
+ if (ret) {
+ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ break;
+ }
+
+- clear_extent_dirty(unpin, start, end);
++ clear_extent_dirty(unpin, start, end, &cached_state);
++ free_extent_state(cached_state);
+ btrfs_error_unpin_extent_range(fs_info, start, end);
+ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ cond_resched();
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 024dd336b20a..4bda5c09cdfe 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -6618,9 +6618,11 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans)
+ unpin = &fs_info->freed_extents[0];
+
+ while (!trans->aborted) {
++ struct extent_state *cached_state = NULL;
++
+ mutex_lock(&fs_info->unused_bg_unpin_mutex);
+ ret = find_first_extent_bit(unpin, 0, &start, &end,
+- EXTENT_DIRTY, NULL);
++ EXTENT_DIRTY, &cached_state);
+ if (ret) {
+ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ break;
+@@ -6630,9 +6632,10 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans)
+ ret = btrfs_discard_extent(fs_info, start,
+ end + 1 - start, NULL);
+
+- clear_extent_dirty(unpin, start, end);
++ clear_extent_dirty(unpin, start, end, &cached_state);
+ unpin_extent_range(fs_info, start, end, true);
+ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
++ free_extent_state(cached_state);
+ cond_resched();
+ }
+
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index ed27becd963c..a3598b24441e 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -348,11 +348,11 @@ static inline int set_extent_dirty(struct extent_io_tree *tree, u64 start,
+ }
+
+ static inline int clear_extent_dirty(struct extent_io_tree *tree, u64 start,
+- u64 end)
++ u64 end, struct extent_state **cached)
+ {
+ return clear_extent_bit(tree, start, end,
+ EXTENT_DIRTY | EXTENT_DELALLOC |
+- EXTENT_DO_ACCOUNTING, 0, 0, NULL);
++ EXTENT_DO_ACCOUNTING, 0, 0, cached);
+ }
+
+ int convert_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index a8297e7489d9..5bbcdcff68a9 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -96,7 +96,7 @@ const struct btrfs_raid_attr btrfs_raid_array[BTRFS_NR_RAID_TYPES] = {
+ .devs_min = 2,
+ .tolerated_failures = 1,
+ .devs_increment = 1,
+- .ncopies = 2,
++ .ncopies = 1,
+ .raid_name = "raid5",
+ .bg_flag = BTRFS_BLOCK_GROUP_RAID5,
+ .mindev_error = BTRFS_ERROR_DEV_RAID5_MIN_NOT_MET,
+@@ -108,7 +108,7 @@ const struct btrfs_raid_attr btrfs_raid_array[BTRFS_NR_RAID_TYPES] = {
+ .devs_min = 3,
+ .tolerated_failures = 2,
+ .devs_increment = 1,
+- .ncopies = 3,
++ .ncopies = 1,
+ .raid_name = "raid6",
+ .bg_flag = BTRFS_BLOCK_GROUP_RAID6,
+ .mindev_error = BTRFS_ERROR_DEV_RAID6_MIN_NOT_MET,
+@@ -6106,12 +6106,6 @@ static noinline void btrfs_schedule_bio(struct btrfs_device *device,
+ int should_queue = 1;
+ struct btrfs_pending_bios *pending_bios;
+
+- if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state) ||
+- !device->bdev) {
+- bio_io_error(bio);
+- return;
+- }
+-
+ /* don't bother with additional async steps for reads, right now */
+ if (bio_op(bio) == REQ_OP_READ) {
+ btrfsic_submit_bio(bio);
+@@ -6240,7 +6234,8 @@ blk_status_t btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
+
+ for (dev_nr = 0; dev_nr < total_devs; dev_nr++) {
+ dev = bbio->stripes[dev_nr].dev;
+- if (!dev || !dev->bdev ||
++ if (!dev || !dev->bdev || test_bit(BTRFS_DEV_STATE_MISSING,
++ &dev->dev_state) ||
+ (bio_op(first_bio) == REQ_OP_WRITE &&
+ !test_bit(BTRFS_DEV_STATE_WRITEABLE, &dev->dev_state))) {
+ bbio_error(bbio, first_bio, logical);
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index ccab249a37f6..2bd0b1ed9708 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -248,6 +248,7 @@ static int parse_fsopt_token(char *c, void *private)
+ return -ENOMEM;
+ break;
+ case Opt_fscache_uniq:
++#ifdef CONFIG_CEPH_FSCACHE
+ kfree(fsopt->fscache_uniq);
+ fsopt->fscache_uniq = kstrndup(argstr[0].from,
+ argstr[0].to-argstr[0].from,
+@@ -256,7 +257,10 @@ static int parse_fsopt_token(char *c, void *private)
+ return -ENOMEM;
+ fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
+ break;
+- /* misc */
++#else
++ pr_err("fscache support is disabled\n");
++ return -EINVAL;
++#endif
+ case Opt_wsize:
+ if (intval < (int)PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE)
+ return -EINVAL;
+@@ -328,10 +332,15 @@ static int parse_fsopt_token(char *c, void *private)
+ fsopt->flags &= ~CEPH_MOUNT_OPT_INO32;
+ break;
+ case Opt_fscache:
++#ifdef CONFIG_CEPH_FSCACHE
+ fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
+ kfree(fsopt->fscache_uniq);
+ fsopt->fscache_uniq = NULL;
+ break;
++#else
++ pr_err("fscache support is disabled\n");
++ return -EINVAL;
++#endif
+ case Opt_nofscache:
+ fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE;
+ kfree(fsopt->fscache_uniq);
+diff --git a/fs/exofs/super.c b/fs/exofs/super.c
+index 7d61e3fa378c..8fb98bb94237 100644
+--- a/fs/exofs/super.c
++++ b/fs/exofs/super.c
+@@ -705,21 +705,18 @@ out:
+ /*
+ * Read the superblock from the OSD and fill in the fields
+ */
+-static int exofs_fill_super(struct super_block *sb, void *data, int silent)
++static int exofs_fill_super(struct super_block *sb,
++ struct exofs_mountopt *opts,
++ struct exofs_sb_info *sbi,
++ int silent)
+ {
+ struct inode *root;
+- struct exofs_mountopt *opts = data;
+- struct exofs_sb_info *sbi; /*extended info */
+ struct osd_dev *od; /* Master device */
+ struct exofs_fscb fscb; /*on-disk superblock info */
+ struct ore_comp comp;
+ unsigned table_count;
+ int ret;
+
+- sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
+- if (!sbi)
+- return -ENOMEM;
+-
+ /* use mount options to fill superblock */
+ if (opts->is_osdname) {
+ struct osd_dev_info odi = {.systemid_len = 0};
+@@ -863,7 +860,9 @@ static struct dentry *exofs_mount(struct file_system_type *type,
+ int flags, const char *dev_name,
+ void *data)
+ {
++ struct super_block *s;
+ struct exofs_mountopt opts;
++ struct exofs_sb_info *sbi;
+ int ret;
+
+ ret = parse_options(data, &opts);
+@@ -872,9 +871,31 @@ static struct dentry *exofs_mount(struct file_system_type *type,
+ return ERR_PTR(ret);
+ }
+
++ sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
++ if (!sbi) {
++ kfree(opts.dev_name);
++ return ERR_PTR(-ENOMEM);
++ }
++
++ s = sget(type, NULL, set_anon_super, flags, NULL);
++
++ if (IS_ERR(s)) {
++ kfree(opts.dev_name);
++ kfree(sbi);
++ return ERR_CAST(s);
++ }
++
+ if (!opts.dev_name)
+ opts.dev_name = dev_name;
+- return mount_nodev(type, flags, &opts, exofs_fill_super);
++
++
++ ret = exofs_fill_super(s, &opts, sbi, flags & SB_SILENT ? 1 : 0);
++ if (ret) {
++ deactivate_locked_super(s);
++ return ERR_PTR(ret);
++ }
++ s->s_flags |= SB_ACTIVE;
++ return dget(s->s_root);
+ }
+
+ /*
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index a0c94c365a4c..f8a0af11a31e 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5904,8 +5904,23 @@ static int __ext4_expand_extra_isize(struct inode *inode,
+ {
+ struct ext4_inode *raw_inode;
+ struct ext4_xattr_ibody_header *header;
++ unsigned int inode_size = EXT4_INODE_SIZE(inode->i_sb);
++ struct ext4_inode_info *ei = EXT4_I(inode);
+ int error;
+
++ /* this was checked at iget time, but double check for good measure */
++ if ((EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > inode_size) ||
++ (ei->i_extra_isize & 3)) {
++ EXT4_ERROR_INODE(inode, "bad extra_isize %u (inode size %u)",
++ ei->i_extra_isize,
++ EXT4_INODE_SIZE(inode->i_sb));
++ return -EFSCORRUPTED;
++ }
++ if ((new_extra_isize < ei->i_extra_isize) ||
++ (new_extra_isize < 4) ||
++ (new_extra_isize > inode_size - EXT4_GOOD_OLD_INODE_SIZE))
++ return -EINVAL; /* Should never happen */
++
+ raw_inode = ext4_raw_inode(iloc);
+
+ header = IHDR(inode, raw_inode);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index a270391228af..1a8d57fe0b1a 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3517,12 +3517,15 @@ static void ext4_clamp_want_extra_isize(struct super_block *sb)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+ struct ext4_super_block *es = sbi->s_es;
++ unsigned def_extra_isize = sizeof(struct ext4_inode) -
++ EXT4_GOOD_OLD_INODE_SIZE;
+
+- /* determine the minimum size of new large inodes, if present */
+- if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE &&
+- sbi->s_want_extra_isize == 0) {
+- sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
+- EXT4_GOOD_OLD_INODE_SIZE;
++ if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) {
++ sbi->s_want_extra_isize = 0;
++ return;
++ }
++ if (sbi->s_want_extra_isize < 4) {
++ sbi->s_want_extra_isize = def_extra_isize;
+ if (ext4_has_feature_extra_isize(sb)) {
+ if (sbi->s_want_extra_isize <
+ le16_to_cpu(es->s_want_extra_isize))
+@@ -3535,10 +3538,10 @@ static void ext4_clamp_want_extra_isize(struct super_block *sb)
+ }
+ }
+ /* Check if enough inode space is available */
+- if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >
+- sbi->s_inode_size) {
+- sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
+- EXT4_GOOD_OLD_INODE_SIZE;
++ if ((sbi->s_want_extra_isize > sbi->s_inode_size) ||
++ (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >
++ sbi->s_inode_size)) {
++ sbi->s_want_extra_isize = def_extra_isize;
+ ext4_msg(sb, KERN_INFO,
+ "required extra inode space not available");
+ }
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index c7ea12299769..187bf7e260c9 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1667,7 +1667,7 @@ static int __f2fs_ioc_setflags(struct inode *inode, unsigned int flags)
+
+ inode->i_ctime = current_time(inode);
+ f2fs_set_inode_flags(inode);
+- f2fs_mark_inode_dirty_sync(inode, false);
++ f2fs_mark_inode_dirty_sync(inode, true);
+ return 0;
+ }
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 43a07514c357..a807a8d5e38f 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -1103,7 +1103,7 @@ submit:
+ list_move_tail(&dc->list, wait_list);
+
+ /* sanity check on discard range */
+- __check_sit_bitmap(sbi, start, start + len);
++ __check_sit_bitmap(sbi, lstart, lstart + len);
+
+ bio->bi_private = dc;
+ bio->bi_end_io = f2fs_submit_discard_endio;
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 52feccedd7a4..096b47972139 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -2122,6 +2122,8 @@ static int do_grow(struct inode *inode, u64 size)
+ }
+
+ error = gfs2_trans_begin(sdp, RES_DINODE + RES_STATFS + RES_RG_BIT +
++ (unstuff &&
++ gfs2_is_jdata(ip) ? RES_JDATA : 0) +
+ (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF ?
+ 0 : RES_QUOTA), 0);
+ if (error)
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index babb0ec76d67..fc1f209e5db0 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -1018,7 +1018,8 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ mlog_errno(status);
+ }
+
+- if (status == 0) {
++ /* Shutdown the kernel journal system */
++ if (!jbd2_journal_destroy(journal->j_journal) && !status) {
+ /*
+ * Do not toggle if flush was unsuccessful otherwise
+ * will leave dirty metadata in a "clean" journal
+@@ -1027,9 +1028,6 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ if (status < 0)
+ mlog_errno(status);
+ }
+-
+- /* Shutdown the kernel journal system */
+- jbd2_journal_destroy(journal->j_journal);
+ journal->j_journal = NULL;
+
+ OCFS2_I(inode)->ip_open_count--;
+diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c
+index bf17f58908ff..11dc3977fb64 100644
+--- a/fs/ubifs/sb.c
++++ b/fs/ubifs/sb.c
+@@ -63,6 +63,17 @@
+ /* Default time granularity in nanoseconds */
+ #define DEFAULT_TIME_GRAN 1000000000
+
++static int get_default_compressor(struct ubifs_info *c)
++{
++ if (ubifs_compr_present(c, UBIFS_COMPR_LZO))
++ return UBIFS_COMPR_LZO;
++
++ if (ubifs_compr_present(c, UBIFS_COMPR_ZLIB))
++ return UBIFS_COMPR_ZLIB;
++
++ return UBIFS_COMPR_NONE;
++}
++
+ /**
+ * create_default_filesystem - format empty UBI volume.
+ * @c: UBIFS file-system description object
+@@ -186,7 +197,7 @@ static int create_default_filesystem(struct ubifs_info *c)
+ if (c->mount_opts.override_compr)
+ sup->default_compr = cpu_to_le16(c->mount_opts.compr_type);
+ else
+- sup->default_compr = cpu_to_le16(UBIFS_COMPR_LZO);
++ sup->default_compr = cpu_to_le16(get_default_compressor(c));
+
+ generate_random_uuid(sup->uuid);
+
+diff --git a/fs/xfs/libxfs/xfs_symlink_remote.c b/fs/xfs/libxfs/xfs_symlink_remote.c
+index 95374ab2dee7..77d80106f989 100644
+--- a/fs/xfs/libxfs/xfs_symlink_remote.c
++++ b/fs/xfs/libxfs/xfs_symlink_remote.c
+@@ -199,7 +199,10 @@ xfs_symlink_local_to_remote(
+ ifp->if_bytes - 1);
+ }
+
+-/* Verify the consistency of an inline symlink. */
++/*
++ * Verify the in-memory consistency of an inline symlink data fork. This
++ * does not do on-disk format checks.
++ */
+ xfs_failaddr_t
+ xfs_symlink_shortform_verify(
+ struct xfs_inode *ip)
+@@ -215,9 +218,12 @@ xfs_symlink_shortform_verify(
+ size = ifp->if_bytes;
+ endp = sfp + size;
+
+- /* Zero length symlinks can exist while we're deleting a remote one. */
+- if (size == 0)
+- return NULL;
++ /*
++ * Zero length symlinks should never occur in memory as they are
++ * never alllowed to exist on disk.
++ */
++ if (!size)
++ return __this_address;
+
+ /* No negative sizes or overly long symlink targets. */
+ if (size < 0 || size > XFS_SYMLINK_MAXLEN)
+diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
+index e36124546d0d..c1f7c0d5d608 100644
+--- a/fs/xfs/xfs_buf.c
++++ b/fs/xfs/xfs_buf.c
+@@ -1506,8 +1506,7 @@ __xfs_buf_submit(
+ xfs_buf_ioerror(bp, -EIO);
+ bp->b_flags &= ~XBF_DONE;
+ xfs_buf_stale(bp);
+- if (bp->b_flags & XBF_ASYNC)
+- xfs_buf_ioend(bp);
++ xfs_buf_ioend(bp);
+ return -EIO;
+ }
+
+diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
+index fba115f4103a..b044f7d36782 100644
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -241,6 +241,32 @@ xfs_compat_ioc_bulkstat(
+ int done;
+ int error;
+
++ /*
++ * Output structure handling functions. Depending on the command,
++ * either the xfs_bstat and xfs_inogrp structures are written out
++ * to userpace memory via bulkreq.ubuffer. Normally the compat
++ * functions and structure size are the correct ones to use ...
++ */
++ inumbers_fmt_pf inumbers_func = xfs_inumbers_fmt_compat;
++ bulkstat_one_pf bs_one_func = xfs_bulkstat_one_compat;
++ size_t bs_one_size = sizeof(struct compat_xfs_bstat);
++
++#ifdef CONFIG_X86_X32
++ if (in_x32_syscall()) {
++ /*
++ * ... but on x32 the input xfs_fsop_bulkreq has pointers
++ * which must be handled in the "compat" (32-bit) way, while
++ * the xfs_bstat and xfs_inogrp structures follow native 64-
++ * bit layout convention. So adjust accordingly, otherwise
++ * the data written out in compat layout will not match what
++ * x32 userspace expects.
++ */
++ inumbers_func = xfs_inumbers_fmt;
++ bs_one_func = xfs_bulkstat_one;
++ bs_one_size = sizeof(struct xfs_bstat);
++ }
++#endif
++
+ /* done = 1 if there are more stats to get and if bulkstat */
+ /* should be called again (unused here, but used in dmapi) */
+
+@@ -272,15 +298,15 @@ xfs_compat_ioc_bulkstat(
+
+ if (cmd == XFS_IOC_FSINUMBERS_32) {
+ error = xfs_inumbers(mp, &inlast, &count,
+- bulkreq.ubuffer, xfs_inumbers_fmt_compat);
++ bulkreq.ubuffer, inumbers_func);
+ } else if (cmd == XFS_IOC_FSBULKSTAT_SINGLE_32) {
+ int res;
+
+- error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer,
+- sizeof(compat_xfs_bstat_t), NULL, &res);
++ error = bs_one_func(mp, inlast, bulkreq.ubuffer,
++ bs_one_size, NULL, &res);
+ } else if (cmd == XFS_IOC_FSBULKSTAT_32) {
+ error = xfs_bulkstat(mp, &inlast, &count,
+- xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t),
++ bs_one_func, bs_one_size,
+ bulkreq.ubuffer, &done);
+ } else
+ error = -EINVAL;
+@@ -336,6 +362,7 @@ xfs_compat_attrlist_by_handle(
+ {
+ int error;
+ attrlist_cursor_kern_t *cursor;
++ compat_xfs_fsop_attrlist_handlereq_t __user *p = arg;
+ compat_xfs_fsop_attrlist_handlereq_t al_hreq;
+ struct dentry *dentry;
+ char *kbuf;
+@@ -370,6 +397,11 @@ xfs_compat_attrlist_by_handle(
+ if (error)
+ goto out_kfree;
+
++ if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) {
++ error = -EFAULT;
++ goto out_kfree;
++ }
++
+ if (copy_to_user(compat_ptr(al_hreq.buffer), kbuf, al_hreq.buflen))
+ error = -EFAULT;
+
+diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
+index 926ed314ffba..484eb0adcefb 100644
+--- a/fs/xfs/xfs_rtalloc.c
++++ b/fs/xfs/xfs_rtalloc.c
+@@ -1198,13 +1198,11 @@ xfs_rtmount_inodes(
+ xfs_sb_t *sbp;
+
+ sbp = &mp->m_sb;
+- if (sbp->sb_rbmino == NULLFSINO)
+- return 0;
+ error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip);
+ if (error)
+ return error;
+ ASSERT(mp->m_rbmip != NULL);
+- ASSERT(sbp->sb_rsumino != NULLFSINO);
++
+ error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip);
+ if (error) {
+ xfs_irele(mp->m_rbmip);
+diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
+index a3e98c64b6e3..b2c1177c717f 100644
+--- a/fs/xfs/xfs_symlink.c
++++ b/fs/xfs/xfs_symlink.c
+@@ -192,6 +192,7 @@ xfs_symlink(
+ pathlen = strlen(target_path);
+ if (pathlen >= XFS_SYMLINK_MAXLEN) /* total string too long */
+ return -ENAMETOOLONG;
++ ASSERT(pathlen > 0);
+
+ udqp = gdqp = NULL;
+ prid = xfs_get_initial_prid(dp);
+@@ -378,6 +379,12 @@ out_release_inode:
+
+ /*
+ * Free a symlink that has blocks associated with it.
++ *
++ * Note: zero length symlinks are not allowed to exist. When we set the size to
++ * zero, also change it to a regular file so that it does not get written to
++ * disk as a zero length symlink. The inode is on the unlinked list already, so
++ * userspace cannot find this inode anymore, so this change is not user visible
++ * but allows us to catch corrupt zero-length symlinks in the verifiers.
+ */
+ STATIC int
+ xfs_inactive_symlink_rmt(
+@@ -412,13 +419,14 @@ xfs_inactive_symlink_rmt(
+ xfs_trans_ijoin(tp, ip, 0);
+
+ /*
+- * Lock the inode, fix the size, and join it to the transaction.
+- * Hold it so in the normal path, we still have it locked for
+- * the second transaction. In the error paths we need it
++ * Lock the inode, fix the size, turn it into a regular file and join it
++ * to the transaction. Hold it so in the normal path, we still have it
++ * locked for the second transaction. In the error paths we need it
+ * held so the cancel won't rele it, see below.
+ */
+ size = (int)ip->i_d.di_size;
+ ip->i_d.di_size = 0;
++ VFS_I(ip)->i_mode = (VFS_I(ip)->i_mode & ~S_IFMT) | S_IFREG;
+ xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+ /*
+ * Find the block(s) so we can inval and unmap them.
+@@ -494,17 +502,10 @@ xfs_inactive_symlink(
+ return -EIO;
+
+ xfs_ilock(ip, XFS_ILOCK_EXCL);
+-
+- /*
+- * Zero length symlinks _can_ exist.
+- */
+ pathlen = (int)ip->i_d.di_size;
+- if (!pathlen) {
+- xfs_iunlock(ip, XFS_ILOCK_EXCL);
+- return 0;
+- }
++ ASSERT(pathlen);
+
+- if (pathlen < 0 || pathlen > XFS_SYMLINK_MAXLEN) {
++ if (pathlen <= 0 || pathlen > XFS_SYMLINK_MAXLEN) {
+ xfs_alert(mp, "%s: inode (0x%llx) bad symlink length (%d)",
+ __func__, (unsigned long long)ip->i_ino, pathlen);
+ xfs_iunlock(ip, XFS_ILOCK_EXCL);
+@@ -512,12 +513,12 @@ xfs_inactive_symlink(
+ return -EFSCORRUPTED;
+ }
+
++ /*
++ * Inline fork state gets removed by xfs_difree() so we have nothing to
++ * do here in that case.
++ */
+ if (ip->i_df.if_flags & XFS_IFINLINE) {
+- if (ip->i_df.if_bytes > 0)
+- xfs_idata_realloc(ip, -(ip->i_df.if_bytes),
+- XFS_DATA_FORK);
+ xfs_iunlock(ip, XFS_ILOCK_EXCL);
+- ASSERT(ip->i_df.if_bytes == 0);
+ return 0;
+ }
+
+diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
+index 8804753805ac..7bb2d8de9f30 100644
+--- a/include/linux/blktrace_api.h
++++ b/include/linux/blktrace_api.h
+@@ -116,7 +116,13 @@ extern void blk_fill_rwbs(char *rwbs, unsigned int op, int bytes);
+
+ static inline sector_t blk_rq_trace_sector(struct request *rq)
+ {
+- return blk_rq_is_passthrough(rq) ? 0 : blk_rq_pos(rq);
++ /*
++ * Tracing should ignore starting sector for passthrough requests and
++ * requests where starting sector didn't get set.
++ */
++ if (blk_rq_is_passthrough(rq) || blk_rq_pos(rq) == (sector_t)-1)
++ return 0;
++ return blk_rq_pos(rq);
+ }
+
+ static inline unsigned int blk_rq_trace_nr_sectors(struct request *rq)
+diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h
+index 872f930f1b06..dd0a452373e7 100644
+--- a/include/linux/genalloc.h
++++ b/include/linux/genalloc.h
+@@ -51,7 +51,8 @@ typedef unsigned long (*genpool_algo_t)(unsigned long *map,
+ unsigned long size,
+ unsigned long start,
+ unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool,
++ unsigned long start_addr);
+
+ /*
+ * General purpose special memory pool descriptor.
+@@ -131,24 +132,24 @@ extern void gen_pool_set_algo(struct gen_pool *pool, genpool_algo_t algo,
+
+ extern unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool);
++ struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_fixed_alloc(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_first_fit_align(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+
+ extern unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool);
++ struct gen_pool *pool, unsigned long start_addr);
+
+
+ extern struct gen_pool *devm_gen_pool_create(struct device *dev,
+diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
+index 412098b24f58..8dfd8300d9c3 100644
+--- a/include/linux/gpio/consumer.h
++++ b/include/linux/gpio/consumer.h
+@@ -475,7 +475,7 @@ static inline int gpiod_set_consumer_name(struct gpio_desc *desc,
+
+ static inline struct gpio_desc *gpio_to_desc(unsigned gpio)
+ {
+- return ERR_PTR(-EINVAL);
++ return NULL;
+ }
+
+ static inline int desc_to_gpio(const struct gpio_desc *desc)
+diff --git a/include/linux/idr.h b/include/linux/idr.h
+index 3ec8628ce17f..b6c6151c7446 100644
+--- a/include/linux/idr.h
++++ b/include/linux/idr.h
+@@ -185,7 +185,7 @@ static inline void idr_preload_end(void)
+ * is convenient for a "not found" value.
+ */
+ #define idr_for_each_entry(idr, entry, id) \
+- for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; ++id)
++ for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; id += 1U)
+
+ /**
+ * idr_for_each_entry_ul() - Iterate over an IDR's elements of a given type.
+diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
+index 32cae0f35b9d..9adb92ad24d3 100644
+--- a/include/linux/kprobes.h
++++ b/include/linux/kprobes.h
+@@ -243,10 +243,13 @@ extern int arch_init_kprobes(void);
+ extern void show_registers(struct pt_regs *regs);
+ extern void kprobes_inc_nmissed_count(struct kprobe *p);
+ extern bool arch_within_kprobe_blacklist(unsigned long addr);
++extern int arch_populate_kprobe_blacklist(void);
+ extern bool arch_kprobe_on_func_entry(unsigned long offset);
+ extern bool kprobe_on_func_entry(kprobe_opcode_t *addr, const char *sym, unsigned long offset);
+
+ extern bool within_kprobe_blacklist(unsigned long addr);
++extern int kprobe_add_ksym_blacklist(unsigned long entry);
++extern int kprobe_add_area_blacklist(unsigned long start, unsigned long end);
+
+ struct kprobe_insn_cache {
+ struct mutex mutex;
+diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
+index 16487052017d..4915e6cd7fd5 100644
+--- a/include/linux/memory_hotplug.h
++++ b/include/linux/memory_hotplug.h
+@@ -21,14 +21,16 @@ struct vmem_altmap;
+ * walkers which rely on the fully initialized page->flags and others
+ * should use this rather than pfn_valid && pfn_to_page
+ */
+-#define pfn_to_online_page(pfn) \
+-({ \
+- struct page *___page = NULL; \
+- unsigned long ___nr = pfn_to_section_nr(pfn); \
+- \
+- if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr))\
+- ___page = pfn_to_page(pfn); \
+- ___page; \
++#define pfn_to_online_page(pfn) \
++({ \
++ struct page *___page = NULL; \
++ unsigned long ___pfn = pfn; \
++ unsigned long ___nr = pfn_to_section_nr(___pfn); \
++ \
++ if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr) && \
++ pfn_valid_within(___pfn)) \
++ ___page = pfn_to_page(___pfn); \
++ ___page; \
+ })
+
+ /*
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 8c2fec0bcb26..5ada5fd9652d 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3790,7 +3790,7 @@ static inline u32 netif_msg_init(int debug_value, int default_msg_enable_bits)
+ if (debug_value == 0) /* no output */
+ return 0;
+ /* set low N bits */
+- return (1 << debug_value) - 1;
++ return (1U << debug_value) - 1;
+ }
+
+ static inline void __netif_tx_lock(struct netdev_queue *txq, int cpu)
+diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h
+index 9326d671b6e6..8675ec64987b 100644
+--- a/include/linux/reset-controller.h
++++ b/include/linux/reset-controller.h
+@@ -7,7 +7,7 @@
+ struct reset_controller_dev;
+
+ /**
+- * struct reset_control_ops
++ * struct reset_control_ops - reset controller driver callbacks
+ *
+ * @reset: for self-deasserting resets, does all necessary
+ * things to reset the device
+diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
+index 108ede99e533..44c6f15800ff 100644
+--- a/include/linux/sched/task.h
++++ b/include/linux/sched/task.h
+@@ -39,6 +39,8 @@ void __noreturn do_task_dead(void);
+
+ extern void proc_caches_init(void);
+
++extern void fork_init(void);
++
+ extern void release_task(struct task_struct * p);
+
+ #ifdef CONFIG_HAVE_COPY_THREAD_TLS
+diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h
+index 18e21427bce4..5a655ba8d273 100644
+--- a/include/linux/serial_8250.h
++++ b/include/linux/serial_8250.h
+@@ -134,6 +134,10 @@ struct uart_8250_port {
+ void (*dl_write)(struct uart_8250_port *, int);
+
+ struct uart_8250_em485 *em485;
++
++ /* Serial port overrun backoff */
++ struct delayed_work overrun_backoff;
++ u32 overrun_backoff_time_ms;
+ };
+
+ static inline struct uart_8250_port *up_to_u8250p(struct uart_port *up)
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index 7bd0a6f2ac2b..ee8f9f554a9e 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -371,14 +371,8 @@ extern unsigned long vm_total_pages;
+ extern int node_reclaim_mode;
+ extern int sysctl_min_unmapped_ratio;
+ extern int sysctl_min_slab_ratio;
+-extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int);
+ #else
+ #define node_reclaim_mode 0
+-static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask,
+- unsigned int order)
+-{
+- return 0;
+-}
+ #endif
+
+ extern int page_evictable(struct page *page);
+diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
+index 78a010e19ed4..0643c083ed86 100644
+--- a/include/linux/trace_events.h
++++ b/include/linux/trace_events.h
+@@ -529,6 +529,8 @@ extern int trace_event_raw_init(struct trace_event_call *call);
+ extern int trace_define_field(struct trace_event_call *call, const char *type,
+ const char *name, int offset, int size,
+ int is_signed, int filter_type);
++extern int trace_add_event_call_nolock(struct trace_event_call *call);
++extern int trace_remove_event_call_nolock(struct trace_event_call *call);
+ extern int trace_add_event_call(struct trace_event_call *call);
+ extern int trace_remove_event_call(struct trace_event_call *call);
+ extern int trace_event_get_offsets(struct trace_event_call *call);
+diff --git a/include/net/fq_impl.h b/include/net/fq_impl.h
+index 89a012905ef0..4b3e18ff8e6f 100644
+--- a/include/net/fq_impl.h
++++ b/include/net/fq_impl.h
+@@ -312,7 +312,7 @@ static int fq_init(struct fq *fq, int flows_cnt)
+ fq->limit = 8192;
+ fq->memory_limit = 16 << 20; /* 16 MBytes */
+
+- fq->flows = kcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
++ fq->flows = kvcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
+ if (!fq->flows)
+ return -ENOMEM;
+
+@@ -330,7 +330,7 @@ static void fq_reset(struct fq *fq,
+ for (i = 0; i < fq->flows_cnt; i++)
+ fq_flow_reset(fq, &fq->flows[i], free_func);
+
+- kfree(fq->flows);
++ kvfree(fq->flows);
+ fq->flows = NULL;
+ }
+
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index feada358d872..19f8d5881b08 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -1247,6 +1247,9 @@ struct sctp_ep_common {
+ /* What socket does this endpoint belong to? */
+ struct sock *sk;
+
++ /* Cache netns and it won't change once set */
++ struct net *net;
++
+ /* This is where we receive inbound chunks. */
+ struct sctp_inq inqueue;
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 0252c0d00310..4545a9ecc219 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1272,7 +1272,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk)
+ percpu_counter_inc(sk->sk_prot->sockets_allocated);
+ }
+
+-static inline int
++static inline u64
+ sk_sockets_allocated_read_positive(struct sock *sk)
+ {
+ return percpu_counter_read_positive(sk->sk_prot->sockets_allocated);
+diff --git a/include/trace/events/rpcrdma.h b/include/trace/events/rpcrdma.h
+index 53df203b8057..4c91cadd1871 100644
+--- a/include/trace/events/rpcrdma.h
++++ b/include/trace/events/rpcrdma.h
+@@ -917,6 +917,34 @@ TRACE_EVENT(xprtrdma_cb_setup,
+ DEFINE_CB_EVENT(xprtrdma_cb_call);
+ DEFINE_CB_EVENT(xprtrdma_cb_reply);
+
++TRACE_EVENT(xprtrdma_leaked_rep,
++ TP_PROTO(
++ const struct rpc_rqst *rqst,
++ const struct rpcrdma_rep *rep
++ ),
++
++ TP_ARGS(rqst, rep),
++
++ TP_STRUCT__entry(
++ __field(unsigned int, task_id)
++ __field(unsigned int, client_id)
++ __field(u32, xid)
++ __field(const void *, rep)
++ ),
++
++ TP_fast_assign(
++ __entry->task_id = rqst->rq_task->tk_pid;
++ __entry->client_id = rqst->rq_task->tk_client->cl_clid;
++ __entry->xid = be32_to_cpu(rqst->rq_xid);
++ __entry->rep = rep;
++ ),
++
++ TP_printk("task:%u@%u xid=0x%08x rep=%p",
++ __entry->task_id, __entry->client_id, __entry->xid,
++ __entry->rep
++ )
++);
++
+ /**
+ ** Server-side RPC/RDMA events
+ **/
+diff --git a/init/main.c b/init/main.c
+index 020972fed117..38a603f62b7b 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -105,7 +105,6 @@
+ static int kernel_init(void *);
+
+ extern void init_IRQ(void);
+-extern void fork_init(void);
+ extern void radix_tree_init(void);
+
+ /*
+diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
+index 24aac0d0f412..3c18260403dd 100644
+--- a/kernel/bpf/cpumap.c
++++ b/kernel/bpf/cpumap.c
+@@ -162,10 +162,14 @@ static void cpu_map_kthread_stop(struct work_struct *work)
+ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
+ struct xdp_frame *xdpf)
+ {
++ unsigned int hard_start_headroom;
+ unsigned int frame_size;
+ void *pkt_data_start;
+ struct sk_buff *skb;
+
++ /* Part of headroom was reserved to xdpf */
++ hard_start_headroom = sizeof(struct xdp_frame) + xdpf->headroom;
++
+ /* build_skb need to place skb_shared_info after SKB end, and
+ * also want to know the memory "truesize". Thus, need to
+ * know the memory frame size backing xdp_buff.
+@@ -183,15 +187,15 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
+ * is not at a fixed memory location, with mixed length
+ * packets, which is bad for cache-line hotness.
+ */
+- frame_size = SKB_DATA_ALIGN(xdpf->len) + xdpf->headroom +
++ frame_size = SKB_DATA_ALIGN(xdpf->len + hard_start_headroom) +
+ SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+
+- pkt_data_start = xdpf->data - xdpf->headroom;
++ pkt_data_start = xdpf->data - hard_start_headroom;
+ skb = build_skb(pkt_data_start, frame_size);
+ if (!skb)
+ return NULL;
+
+- skb_reserve(skb, xdpf->headroom);
++ skb_reserve(skb, hard_start_headroom);
+ __skb_put(skb, xdpf->len);
+ if (xdpf->metasize)
+ skb_metadata_set(skb, xdpf->metasize);
+@@ -205,6 +209,9 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
+ * - RX ring dev queue index (skb_record_rx_queue)
+ */
+
++ /* Allow SKB to reuse area used by xdp_frame */
++ xdp_scrub_frame(xdpf);
++
+ return skb;
+ }
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 6e544e364821..596959288eb9 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -559,12 +559,12 @@ static int map_create(union bpf_attr *attr)
+ err = bpf_map_new_fd(map, f_flags);
+ if (err < 0) {
+ /* failed to allocate fd.
+- * bpf_map_put() is needed because the above
++ * bpf_map_put_with_uref() is needed because the above
+ * bpf_map_alloc_id() has published the map
+ * to the userspace and the userspace may
+ * have refcnt-ed it through BPF_MAP_GET_FD_BY_ID.
+ */
+- bpf_map_put(map);
++ bpf_map_put_with_uref(map);
+ return err;
+ }
+
+@@ -1887,7 +1887,7 @@ static int bpf_map_get_fd_by_id(const union bpf_attr *attr)
+
+ fd = bpf_map_new_fd(map, f_flags);
+ if (fd < 0)
+- bpf_map_put(map);
++ bpf_map_put_with_uref(map);
+
+ return fd;
+ }
+diff --git a/kernel/fork.c b/kernel/fork.c
+index aef1430bdce0..8cb5cd7c97e1 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -163,10 +163,6 @@ static inline void free_task_struct(struct task_struct *tsk)
+ }
+ #endif
+
+-void __weak arch_release_thread_stack(unsigned long *stack)
+-{
+-}
+-
+ #ifndef CONFIG_ARCH_THREAD_STACK_ALLOCATOR
+
+ /*
+@@ -376,7 +372,6 @@ static void release_task_stack(struct task_struct *tsk)
+ return; /* Better to leak the stack than to free prematurely */
+
+ account_kernel_stack(tsk, -1);
+- arch_release_thread_stack(tsk->stack);
+ free_thread_stack(tsk);
+ tsk->stack = NULL;
+ #ifdef CONFIG_VMAP_STACK
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index aed90788db5c..f4e4095ec7ea 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2096,6 +2096,47 @@ void dump_kprobe(struct kprobe *kp)
+ }
+ NOKPROBE_SYMBOL(dump_kprobe);
+
++int kprobe_add_ksym_blacklist(unsigned long entry)
++{
++ struct kprobe_blacklist_entry *ent;
++ unsigned long offset = 0, size = 0;
++
++ if (!kernel_text_address(entry) ||
++ !kallsyms_lookup_size_offset(entry, &size, &offset))
++ return -EINVAL;
++
++ ent = kmalloc(sizeof(*ent), GFP_KERNEL);
++ if (!ent)
++ return -ENOMEM;
++ ent->start_addr = entry;
++ ent->end_addr = entry + size;
++ INIT_LIST_HEAD(&ent->list);
++ list_add_tail(&ent->list, &kprobe_blacklist);
++
++ return (int)size;
++}
++
++/* Add all symbols in given area into kprobe blacklist */
++int kprobe_add_area_blacklist(unsigned long start, unsigned long end)
++{
++ unsigned long entry;
++ int ret = 0;
++
++ for (entry = start; entry < end; entry += ret) {
++ ret = kprobe_add_ksym_blacklist(entry);
++ if (ret < 0)
++ return ret;
++ if (ret == 0) /* In case of alias symbol */
++ ret = 1;
++ }
++ return 0;
++}
++
++int __init __weak arch_populate_kprobe_blacklist(void)
++{
++ return 0;
++}
++
+ /*
+ * Lookup and populate the kprobe_blacklist.
+ *
+@@ -2107,26 +2148,24 @@ NOKPROBE_SYMBOL(dump_kprobe);
+ static int __init populate_kprobe_blacklist(unsigned long *start,
+ unsigned long *end)
+ {
++ unsigned long entry;
+ unsigned long *iter;
+- struct kprobe_blacklist_entry *ent;
+- unsigned long entry, offset = 0, size = 0;
++ int ret;
+
+ for (iter = start; iter < end; iter++) {
+ entry = arch_deref_entry_point((void *)*iter);
+-
+- if (!kernel_text_address(entry) ||
+- !kallsyms_lookup_size_offset(entry, &size, &offset))
++ ret = kprobe_add_ksym_blacklist(entry);
++ if (ret == -EINVAL)
+ continue;
+-
+- ent = kmalloc(sizeof(*ent), GFP_KERNEL);
+- if (!ent)
+- return -ENOMEM;
+- ent->start_addr = entry;
+- ent->end_addr = entry + size;
+- INIT_LIST_HEAD(&ent->list);
+- list_add_tail(&ent->list, &kprobe_blacklist);
++ if (ret < 0)
++ return ret;
+ }
+- return 0;
++
++ /* Symbols in __kprobes_text are blacklisted */
++ ret = kprobe_add_area_blacklist((unsigned long)__kprobes_text_start,
++ (unsigned long)__kprobes_text_end);
++
++ return ret ? : arch_populate_kprobe_blacklist();
+ }
+
+ /* Module notifier call back, checking kprobes on the module */
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 7345f5f8f3fe..017f737237e6 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -2302,11 +2302,11 @@ __trace_early_add_new_event(struct trace_event_call *call,
+ struct ftrace_module_file_ops;
+ static void __add_event_to_tracers(struct trace_event_call *call);
+
+-/* Add an additional event_call dynamically */
+-int trace_add_event_call(struct trace_event_call *call)
++int trace_add_event_call_nolock(struct trace_event_call *call)
+ {
+ int ret;
+- mutex_lock(&event_mutex);
++ lockdep_assert_held(&event_mutex);
++
+ mutex_lock(&trace_types_lock);
+
+ ret = __register_event(call, NULL);
+@@ -2314,6 +2314,16 @@ int trace_add_event_call(struct trace_event_call *call)
+ __add_event_to_tracers(call);
+
+ mutex_unlock(&trace_types_lock);
++ return ret;
++}
++
++/* Add an additional event_call dynamically */
++int trace_add_event_call(struct trace_event_call *call)
++{
++ int ret;
++
++ mutex_lock(&event_mutex);
++ ret = trace_add_event_call_nolock(call);
+ mutex_unlock(&event_mutex);
+ return ret;
+ }
+@@ -2363,17 +2373,29 @@ static int probe_remove_event_call(struct trace_event_call *call)
+ return 0;
+ }
+
+-/* Remove an event_call */
+-int trace_remove_event_call(struct trace_event_call *call)
++/* no event_mutex version */
++int trace_remove_event_call_nolock(struct trace_event_call *call)
+ {
+ int ret;
+
+- mutex_lock(&event_mutex);
++ lockdep_assert_held(&event_mutex);
++
+ mutex_lock(&trace_types_lock);
+ down_write(&trace_event_sem);
+ ret = probe_remove_event_call(call);
+ up_write(&trace_event_sem);
+ mutex_unlock(&trace_types_lock);
++
++ return ret;
++}
++
++/* Remove an event_call */
++int trace_remove_event_call(struct trace_event_call *call)
++{
++ int ret;
++
++ mutex_lock(&event_mutex);
++ ret = trace_remove_event_call_nolock(call);
+ mutex_unlock(&event_mutex);
+
+ return ret;
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index dac518977e7d..11d952650fa7 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -914,7 +914,7 @@ static int register_synth_event(struct synth_event *event)
+ call->data = event;
+ call->tp = event->tp;
+
+- ret = trace_add_event_call(call);
++ ret = trace_add_event_call_nolock(call);
+ if (ret) {
+ pr_warn("Failed to register synthetic event: %s\n",
+ trace_event_name(call));
+@@ -938,7 +938,7 @@ static int unregister_synth_event(struct synth_event *event)
+ struct trace_event_call *call = &event->call;
+ int ret;
+
+- ret = trace_remove_event_call(call);
++ ret = trace_remove_event_call_nolock(call);
+
+ return ret;
+ }
+@@ -1015,12 +1015,10 @@ static void add_or_delete_synth_event(struct synth_event *event, int delete)
+ if (delete)
+ free_synth_event(event);
+ else {
+- mutex_lock(&synth_event_mutex);
+ if (!find_synth_event(event->name))
+ list_add(&event->list, &synth_event_list);
+ else
+ free_synth_event(event);
+- mutex_unlock(&synth_event_mutex);
+ }
+ }
+
+@@ -1032,6 +1030,7 @@ static int create_synth_event(int argc, char **argv)
+ int i, consumed = 0, n_fields = 0, ret = 0;
+ char *name;
+
++ mutex_lock(&event_mutex);
+ mutex_lock(&synth_event_mutex);
+
+ /*
+@@ -1104,8 +1103,6 @@ static int create_synth_event(int argc, char **argv)
+ goto err;
+ }
+ out:
+- mutex_unlock(&synth_event_mutex);
+-
+ if (event) {
+ if (delete_event) {
+ ret = unregister_synth_event(event);
+@@ -1115,10 +1112,13 @@ static int create_synth_event(int argc, char **argv)
+ add_or_delete_synth_event(event, ret);
+ }
+ }
++ mutex_unlock(&synth_event_mutex);
++ mutex_unlock(&event_mutex);
+
+ return ret;
+ err:
+ mutex_unlock(&synth_event_mutex);
++ mutex_unlock(&event_mutex);
+
+ for (i = 0; i < n_fields; i++)
+ free_synth_field(fields[i]);
+@@ -1129,12 +1129,10 @@ static int create_synth_event(int argc, char **argv)
+
+ static int release_all_synth_events(void)
+ {
+- struct list_head release_events;
+ struct synth_event *event, *e;
+ int ret = 0;
+
+- INIT_LIST_HEAD(&release_events);
+-
++ mutex_lock(&event_mutex);
+ mutex_lock(&synth_event_mutex);
+
+ list_for_each_entry(event, &synth_event_list, list) {
+@@ -1144,16 +1142,14 @@ static int release_all_synth_events(void)
+ }
+ }
+
+- list_splice_init(&event->list, &release_events);
+-
+- mutex_unlock(&synth_event_mutex);
+-
+- list_for_each_entry_safe(event, e, &release_events, list) {
++ list_for_each_entry_safe(event, e, &synth_event_list, list) {
+ list_del(&event->list);
+
+ ret = unregister_synth_event(event);
+ add_or_delete_synth_event(event, !ret);
+ }
++ mutex_unlock(&synth_event_mutex);
++ mutex_unlock(&event_mutex);
+
+ return ret;
+ }
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index ca06adc4f445..7e85d1e37a6e 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -35,6 +35,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/genalloc.h>
+ #include <linux/of_device.h>
++#include <linux/vmalloc.h>
+
+ static inline size_t chunk_size(const struct gen_pool_chunk *chunk)
+ {
+@@ -187,7 +188,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
+ int nbytes = sizeof(struct gen_pool_chunk) +
+ BITS_TO_LONGS(nbits) * sizeof(long);
+
+- chunk = kzalloc_node(nbytes, GFP_KERNEL, nid);
++ chunk = vzalloc_node(nbytes, nid);
+ if (unlikely(chunk == NULL))
+ return -ENOMEM;
+
+@@ -251,7 +252,7 @@ void gen_pool_destroy(struct gen_pool *pool)
+ bit = find_next_bit(chunk->bits, end_bit, 0);
+ BUG_ON(bit < end_bit);
+
+- kfree(chunk);
++ vfree(chunk);
+ }
+ kfree_const(pool->name);
+ kfree(pool);
+@@ -311,7 +312,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
+ end_bit = chunk_size(chunk) >> order;
+ retry:
+ start_bit = algo(chunk->bits, end_bit, start_bit,
+- nbits, data, pool);
++ nbits, data, pool, chunk->start_addr);
+ if (start_bit >= end_bit)
+ continue;
+ remain = bitmap_set_ll(chunk->bits, start_bit, nbits);
+@@ -525,7 +526,7 @@ EXPORT_SYMBOL(gen_pool_set_algo);
+ */
+ unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ return bitmap_find_next_zero_area(map, size, start, nr, 0);
+ }
+@@ -543,16 +544,19 @@ EXPORT_SYMBOL(gen_pool_first_fit);
+ */
+ unsigned long gen_pool_first_fit_align(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ struct genpool_data_align *alignment;
+- unsigned long align_mask;
++ unsigned long align_mask, align_off;
+ int order;
+
+ alignment = data;
+ order = pool->min_alloc_order;
+ align_mask = ((alignment->align + (1UL << order) - 1) >> order) - 1;
+- return bitmap_find_next_zero_area(map, size, start, nr, align_mask);
++ align_off = (start_addr & (alignment->align - 1)) >> order;
++
++ return bitmap_find_next_zero_area_off(map, size, start, nr,
++ align_mask, align_off);
+ }
+ EXPORT_SYMBOL(gen_pool_first_fit_align);
+
+@@ -567,7 +571,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_align);
+ */
+ unsigned long gen_pool_fixed_alloc(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ struct genpool_data_fixed *fixed_data;
+ int order;
+@@ -601,7 +605,8 @@ EXPORT_SYMBOL(gen_pool_fixed_alloc);
+ */
+ unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+ unsigned long size, unsigned long start,
+- unsigned int nr, void *data, struct gen_pool *pool)
++ unsigned int nr, void *data, struct gen_pool *pool,
++ unsigned long start_addr)
+ {
+ unsigned long align_mask = roundup_pow_of_two(nr) - 1;
+
+@@ -624,7 +629,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_order_align);
+ */
+ unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ unsigned long start_bit = size;
+ unsigned long len = size + 1;
+diff --git a/lib/radix-tree.c b/lib/radix-tree.c
+index bc03ecc4dfd2..e5cab5c4e383 100644
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -2172,7 +2172,7 @@ void __rcu **idr_get_free(struct radix_tree_root *root,
+ offset = radix_tree_find_next_bit(node, IDR_FREE,
+ offset + 1);
+ start = next_index(start, node, offset);
+- if (start > max)
++ if (start > max || start == 0)
+ return ERR_PTR(-ENOSPC);
+ while (offset == RADIX_TREE_MAP_SIZE) {
+ offset = node->offset + 1;
+diff --git a/mm/internal.h b/mm/internal.h
+index 87256ae1bef8..397183c8fe47 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -444,6 +444,16 @@ static inline void mminit_validate_memmodel_limits(unsigned long *start_pfn,
+ #define NODE_RECLAIM_SOME 0
+ #define NODE_RECLAIM_SUCCESS 1
+
++#ifdef CONFIG_NUMA
++extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int);
++#else
++static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask,
++ unsigned int order)
++{
++ return NODE_RECLAIM_NOSCAN;
++}
++#endif
++
+ extern int hwpoison_filter(struct page *p);
+
+ extern u32 hwpoison_filter_dev_major;
+diff --git a/mm/memblock.c b/mm/memblock.c
+index 237944479d25..bb4e32c6b19e 100644
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -1537,12 +1537,7 @@ void * __init memblock_virt_alloc_try_nid(
+ */
+ void __init __memblock_free_early(phys_addr_t base, phys_addr_t size)
+ {
+- phys_addr_t end = base + size - 1;
+-
+- memblock_dbg("%s: [%pa-%pa] %pF\n",
+- __func__, &base, &end, (void *)_RET_IP_);
+- kmemleak_free_part_phys(base, size);
+- memblock_remove_range(&memblock.reserved, base, size);
++ memblock_free(base, size);
+ }
+
+ /**
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index b34348a41bfe..74fb5c338e8f 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4451,16 +4451,19 @@ unsigned long get_zeroed_page(gfp_t gfp_mask)
+ }
+ EXPORT_SYMBOL(get_zeroed_page);
+
+-void __free_pages(struct page *page, unsigned int order)
++static inline void free_the_page(struct page *page, unsigned int order)
+ {
+- if (put_page_testzero(page)) {
+- if (order == 0)
+- free_unref_page(page);
+- else
+- __free_pages_ok(page, order);
+- }
++ if (order == 0) /* Via pcp? */
++ free_unref_page(page);
++ else
++ __free_pages_ok(page, order);
+ }
+
++void __free_pages(struct page *page, unsigned int order)
++{
++ if (put_page_testzero(page))
++ free_the_page(page, order);
++}
+ EXPORT_SYMBOL(__free_pages);
+
+ void free_pages(unsigned long addr, unsigned int order)
+@@ -4509,14 +4512,8 @@ void __page_frag_cache_drain(struct page *page, unsigned int count)
+ {
+ VM_BUG_ON_PAGE(page_ref_count(page) == 0, page);
+
+- if (page_ref_sub_and_test(page, count)) {
+- unsigned int order = compound_order(page);
+-
+- if (order == 0)
+- free_unref_page(page);
+- else
+- __free_pages_ok(page, order);
+- }
++ if (page_ref_sub_and_test(page, count))
++ free_the_page(page, compound_order(page));
+ }
+ EXPORT_SYMBOL(__page_frag_cache_drain);
+
+@@ -4582,7 +4579,7 @@ void page_frag_free(void *addr)
+ struct page *page = virt_to_head_page(addr);
+
+ if (unlikely(put_page_testzero(page)))
+- __free_pages_ok(page, compound_order(page));
++ free_the_page(page, compound_order(page));
+ }
+ EXPORT_SYMBOL(page_frag_free);
+
+diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
+index dfc86a0199da..1d8c834d9018 100644
+--- a/net/bridge/netfilter/ebt_dnat.c
++++ b/net/bridge/netfilter/ebt_dnat.c
+@@ -19,7 +19,6 @@ static unsigned int
+ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ {
+ const struct ebt_nat_info *info = par->targinfo;
+- struct net_device *dev;
+
+ if (!skb_make_writable(skb, 0))
+ return EBT_DROP;
+@@ -32,10 +31,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ else
+ skb->pkt_type = PACKET_MULTICAST;
+ } else {
+- if (xt_hooknum(par) != NF_BR_BROUTING)
+- dev = br_port_get_rcu(xt_in(par))->br->dev;
+- else
++ const struct net_device *dev;
++
++ switch (xt_hooknum(par)) {
++ case NF_BR_BROUTING:
+ dev = xt_in(par);
++ break;
++ case NF_BR_PRE_ROUTING:
++ dev = br_port_get_rcu(xt_in(par))->br->dev;
++ break;
++ default:
++ dev = NULL;
++ break;
++ }
++
++ if (!dev) /* NF_BR_LOCAL_OUT */
++ return info->target;
+
+ if (ether_addr_equal(info->mac, dev->dev_addr))
+ skb->pkt_type = PACKET_HOST;
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index c52d6e6b341c..7597afee7068 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -18,6 +18,7 @@
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+ #include <linux/slab.h>
++#include <linux/kmemleak.h>
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+@@ -363,12 +364,14 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
+ ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
+ if (!ret)
+ return NULL;
+- if (size <= PAGE_SIZE)
++ if (size <= PAGE_SIZE) {
+ buckets = kzalloc(size, GFP_ATOMIC);
+- else
++ } else {
+ buckets = (struct neighbour __rcu **)
+ __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
+ get_order(size));
++ kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
++ }
+ if (!buckets) {
+ kfree(ret);
+ return NULL;
+@@ -388,10 +391,12 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
+ size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
+ struct neighbour __rcu **buckets = nht->hash_buckets;
+
+- if (size <= PAGE_SIZE)
++ if (size <= PAGE_SIZE) {
+ kfree(buckets);
+- else
++ } else {
++ kmemleak_free(buckets);
+ free_pages((unsigned long)buckets, get_order(size));
++ }
+ kfree(nht);
+ }
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 6dab186d4b8f..c60123dff803 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -913,7 +913,8 @@ static int __init net_ns_init(void)
+ init_net_initialized = true;
+ up_write(&pernet_ops_rwsem);
+
+- register_pernet_subsys(&net_ns_ops);
++ if (register_pernet_subsys(&net_ns_ops))
++ panic("Could not register network namespace subsystems");
+
+ rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL,
+ RTNL_FLAG_DOIT_UNLOCKED);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index ba4f843cdd1d..bbde5f6a7dc9 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2435,7 +2435,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
+ }
+
+ if (sk_has_memory_pressure(sk)) {
+- int alloc;
++ u64 alloc;
+
+ if (!sk_under_memory_pressure(sk))
+ return 1;
+diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
+index bfd43e8f2c06..3235540f6adf 100644
+--- a/net/decnet/dn_dev.c
++++ b/net/decnet/dn_dev.c
+@@ -56,7 +56,7 @@
+ #include <net/dn_neigh.h>
+ #include <net/dn_fib.h>
+
+-#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn))
++#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn))
+
+ static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00};
+ static char dn_rt_all_rt_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x03,0x00,0x00};
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 681276111310..a3f77441f3e6 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -1466,9 +1466,23 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ struct ip_tunnel_parm *p = &t->parms;
+ __be16 o_flags = p->o_flags;
+
+- if ((t->erspan_ver == 1 || t->erspan_ver == 2) &&
+- !t->collect_md)
+- o_flags |= TUNNEL_KEY;
++ if (t->erspan_ver == 1 || t->erspan_ver == 2) {
++ if (!t->collect_md)
++ o_flags |= TUNNEL_KEY;
++
++ if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
++ goto nla_put_failure;
++
++ if (t->erspan_ver == 1) {
++ if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index))
++ goto nla_put_failure;
++ } else {
++ if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir))
++ goto nla_put_failure;
++ if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid))
++ goto nla_put_failure;
++ }
++ }
+
+ if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
+ nla_put_be16(skb, IFLA_GRE_IFLAGS,
+@@ -1504,19 +1518,6 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ goto nla_put_failure;
+ }
+
+- if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
+- goto nla_put_failure;
+-
+- if (t->erspan_ver == 1) {
+- if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index))
+- goto nla_put_failure;
+- } else if (t->erspan_ver == 2) {
+- if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir))
+- goto nla_put_failure;
+- if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid))
+- goto nla_put_failure;
+- }
+-
+ return 0;
+
+ nla_put_failure:
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index c4f5602308ed..054d01c16dc6 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -644,13 +644,19 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ dst = tnl_params->daddr;
+ if (dst == 0) {
+ /* NBMA tunnel */
++ struct ip_tunnel_info *tun_info;
+
+ if (!skb_dst(skb)) {
+ dev->stats.tx_fifo_errors++;
+ goto tx_error;
+ }
+
+- if (skb->protocol == htons(ETH_P_IP)) {
++ tun_info = skb_tunnel_info(skb);
++ if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX) &&
++ ip_tunnel_info_af(tun_info) == AF_INET &&
++ tun_info->key.u.ipv4.dst)
++ dst = tun_info->key.u.ipv4.dst;
++ else if (skb->protocol == htons(ETH_P_IP)) {
+ rt = skb_rtable(skb);
+ dst = rt_nexthop(rt, inner_iph->daddr);
+ }
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 9d775b8df57d..c719a41d2eba 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -443,10 +443,8 @@ void tcp_retransmit_timer(struct sock *sk)
+ */
+ return;
+ }
+- if (!tp->packets_out)
+- goto out;
+-
+- WARN_ON(tcp_rtx_queue_empty(sk));
++ if (!tp->packets_out || WARN_ON_ONCE(tcp_rtx_queue_empty(sk)))
++ return;
+
+ tp->tlp_high_seq = 0;
+
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index dee4113f21a9..8fd28edd6ac5 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -2135,9 +2135,23 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ struct __ip6_tnl_parm *p = &t->parms;
+ __be16 o_flags = p->o_flags;
+
+- if ((p->erspan_ver == 1 || p->erspan_ver == 2) &&
+- !p->collect_md)
+- o_flags |= TUNNEL_KEY;
++ if (p->erspan_ver == 1 || p->erspan_ver == 2) {
++ if (!p->collect_md)
++ o_flags |= TUNNEL_KEY;
++
++ if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver))
++ goto nla_put_failure;
++
++ if (p->erspan_ver == 1) {
++ if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
++ goto nla_put_failure;
++ } else {
++ if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir))
++ goto nla_put_failure;
++ if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid))
++ goto nla_put_failure;
++ }
++ }
+
+ if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
+ nla_put_be16(skb, IFLA_GRE_IFLAGS,
+@@ -2152,8 +2166,7 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ nla_put_u8(skb, IFLA_GRE_ENCAP_LIMIT, p->encap_limit) ||
+ nla_put_be32(skb, IFLA_GRE_FLOWINFO, p->flowinfo) ||
+ nla_put_u32(skb, IFLA_GRE_FLAGS, p->flags) ||
+- nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark) ||
+- nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
++ nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark))
+ goto nla_put_failure;
+
+ if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE,
+@@ -2171,19 +2184,6 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ goto nla_put_failure;
+ }
+
+- if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver))
+- goto nla_put_failure;
+-
+- if (p->erspan_ver == 1) {
+- if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
+- goto nla_put_failure;
+- } else if (p->erspan_ver == 2) {
+- if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir))
+- goto nla_put_failure;
+- if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid))
+- goto nla_put_failure;
+- }
+-
+ return 0;
+
+ nla_put_failure:
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index f34202242d24..507409e3fd39 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2356,7 +2356,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta)
+ {
+ struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta);
+
+- if (time_after(stats->last_rx, sta->status_stats.last_ack))
++ if (!sta->status_stats.last_ack ||
++ time_after(stats->last_rx, sta->status_stats.last_ack))
+ return stats->last_rx;
+ return sta->status_stats.last_ack;
+ }
+diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
+index 1f3086074981..aa1be643d7a0 100644
+--- a/net/netfilter/nf_nat_sip.c
++++ b/net/netfilter/nf_nat_sip.c
+@@ -18,6 +18,7 @@
+
+ #include <net/netfilter/nf_nat.h>
+ #include <net/netfilter/nf_nat_helper.h>
++#include <net/netfilter/nf_conntrack_core.h>
+ #include <net/netfilter/nf_conntrack_helper.h>
+ #include <net/netfilter/nf_conntrack_expect.h>
+ #include <net/netfilter/nf_conntrack_seqadj.h>
+@@ -316,6 +317,9 @@ static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
+ static void nf_nat_sip_expected(struct nf_conn *ct,
+ struct nf_conntrack_expect *exp)
+ {
++ struct nf_conn_help *help = nfct_help(ct->master);
++ struct nf_conntrack_expect *pair_exp;
++ int range_set_for_snat = 0;
+ struct nf_nat_range2 range;
+
+ /* This must be a fresh one. */
+@@ -327,15 +331,42 @@ static void nf_nat_sip_expected(struct nf_conn *ct,
+ range.min_addr = range.max_addr = exp->saved_addr;
+ nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
+
+- /* Change src to where master sends to, but only if the connection
+- * actually came from the same source. */
+- if (nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
++ /* Do media streams SRC manip according with the parameters
++ * found in the paired expectation.
++ */
++ if (exp->class != SIP_EXPECT_SIGNALLING) {
++ spin_lock_bh(&nf_conntrack_expect_lock);
++ hlist_for_each_entry(pair_exp, &help->expectations, lnode) {
++ if (pair_exp->tuple.src.l3num == nf_ct_l3num(ct) &&
++ pair_exp->tuple.dst.protonum == ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum &&
++ nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3, &pair_exp->saved_addr) &&
++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.all == pair_exp->saved_proto.all) {
++ range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
++ range.min_proto.all = range.max_proto.all = pair_exp->tuple.dst.u.all;
++ range.min_addr = range.max_addr = pair_exp->tuple.dst.u3;
++ range_set_for_snat = 1;
++ break;
++ }
++ }
++ spin_unlock_bh(&nf_conntrack_expect_lock);
++ }
++
++ /* When no paired expectation has been found, change src to
++ * where master sends to, but only if the connection actually came
++ * from the same source.
++ */
++ if (!range_set_for_snat &&
++ nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
+ &ct->master->tuplehash[exp->dir].tuple.src.u3)) {
+ range.flags = NF_NAT_RANGE_MAP_IPS;
+ range.min_addr = range.max_addr
+ = ct->master->tuplehash[!exp->dir].tuple.dst.u3;
+- nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
++ range_set_for_snat = 1;
+ }
++
++ /* Perform SRC manip. */
++ if (range_set_for_snat)
++ nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
+ }
+
+ static unsigned int nf_nat_sip_expect(struct sk_buff *skb, unsigned int protoff,
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 289d079008ee..ec0f8b5bde0a 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -5737,6 +5737,8 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
+ goto nla_put_failure;
+
+ nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
++ if (!nest)
++ goto nla_put_failure;
+ if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
+ nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
+ goto nla_put_failure;
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index c297fe8afdfe..f350faef044d 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -697,9 +697,13 @@ static size_t ovs_flow_cmd_msg_size(const struct sw_flow_actions *acts,
+ {
+ size_t len = NLMSG_ALIGN(sizeof(struct ovs_header));
+
+- /* OVS_FLOW_ATTR_UFID */
++ /* OVS_FLOW_ATTR_UFID, or unmasked flow key as fallback
++ * see ovs_nla_put_identifier()
++ */
+ if (sfid && ovs_identifier_is_ufid(sfid))
+ len += nla_total_size(sfid->ufid_len);
++ else
++ len += nla_total_size(ovs_key_attr_size());
+
+ /* OVS_FLOW_ATTR_KEY */
+ if (!sfid || should_fill_key(sfid, ufid_flags))
+@@ -875,7 +879,10 @@ static struct sk_buff *ovs_flow_cmd_build_info(const struct sw_flow *flow,
+ retval = ovs_flow_cmd_fill_info(flow, dp_ifindex, skb,
+ info->snd_portid, info->snd_seq, 0,
+ cmd, ufid_flags);
+- BUG_ON(retval < 0);
++ if (WARN_ON_ONCE(retval < 0)) {
++ kfree_skb(skb);
++ skb = ERR_PTR(retval);
++ }
+ return skb;
+ }
+
+@@ -1338,7 +1345,10 @@ static int ovs_flow_cmd_del(struct sk_buff *skb, struct genl_info *info)
+ OVS_FLOW_CMD_DEL,
+ ufid_flags);
+ rcu_read_unlock();
+- BUG_ON(err < 0);
++ if (WARN_ON_ONCE(err < 0)) {
++ kfree_skb(reply);
++ goto out_free;
++ }
+
+ ovs_notify(&dp_flow_genl_family, reply, info);
+ } else {
+@@ -1346,6 +1356,7 @@ static int ovs_flow_cmd_del(struct sk_buff *skb, struct genl_info *info)
+ }
+ }
+
++out_free:
+ ovs_flow_free(flow, true);
+ return 0;
+ unlock:
+diff --git a/net/psample/psample.c b/net/psample/psample.c
+index 4cea353221da..30e8239bd774 100644
+--- a/net/psample/psample.c
++++ b/net/psample/psample.c
+@@ -223,7 +223,7 @@ void psample_sample_packet(struct psample_group *group, struct sk_buff *skb,
+ data_len = PSAMPLE_MAX_PACKET_SIZE - meta_len - NLA_HDRLEN
+ - NLA_ALIGNTO;
+
+- nl_skb = genlmsg_new(meta_len + data_len, GFP_ATOMIC);
++ nl_skb = genlmsg_new(meta_len + nla_total_size(data_len), GFP_ATOMIC);
+ if (unlikely(!nl_skb))
+ return;
+
+diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
+index d6b8ae4ed7a3..15c6eb547684 100644
+--- a/net/sched/sch_mq.c
++++ b/net/sched/sch_mq.c
+@@ -242,7 +242,8 @@ static int mq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
+ struct netdev_queue *dev_queue = mq_queue_get(sch, cl);
+
+ sch = dev_queue->qdisc_sleeping;
+- if (gnet_stats_copy_basic(&sch->running, d, NULL, &sch->bstats) < 0 ||
++ if (gnet_stats_copy_basic(&sch->running, d, sch->cpu_bstats,
++ &sch->bstats) < 0 ||
+ gnet_stats_copy_queue(d, NULL, &sch->qstats, sch->q.qlen) < 0)
+ return -1;
+ return 0;
+diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
+index 0e9d761cdd80..68ce86cab63c 100644
+--- a/net/sched/sch_mqprio.c
++++ b/net/sched/sch_mqprio.c
+@@ -559,8 +559,8 @@ static int mqprio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
+ struct netdev_queue *dev_queue = mqprio_queue_get(sch, cl);
+
+ sch = dev_queue->qdisc_sleeping;
+- if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
+- d, NULL, &sch->bstats) < 0 ||
++ if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), d,
++ sch->cpu_bstats, &sch->bstats) < 0 ||
+ gnet_stats_copy_queue(d, NULL,
+ &sch->qstats, sch->q.qlen) < 0)
+ return -1;
+diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
+index 1da7ea8de0ad..1df78e361ef9 100644
+--- a/net/sched/sch_multiq.c
++++ b/net/sched/sch_multiq.c
+@@ -343,7 +343,7 @@ static int multiq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
+
+ cl_q = q->queues[cl - 1];
+ if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
+- d, NULL, &cl_q->bstats) < 0 ||
++ d, cl_q->cpu_bstats, &cl_q->bstats) < 0 ||
+ gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0)
+ return -1;
+
+diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
+index 222e53d3d27a..5672abede0cc 100644
+--- a/net/sched/sch_prio.c
++++ b/net/sched/sch_prio.c
+@@ -396,7 +396,7 @@ static int prio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
+
+ cl_q = q->queues[cl - 1];
+ if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
+- d, NULL, &cl_q->bstats) < 0 ||
++ d, cl_q->cpu_bstats, &cl_q->bstats) < 0 ||
+ gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0)
+ return -1;
+
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index 914750b819b2..f68ccd1f4860 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -80,6 +80,7 @@ static struct sctp_association *sctp_association_init(
+ /* Discarding const is appropriate here. */
+ asoc->ep = (struct sctp_endpoint *)ep;
+ asoc->base.sk = (struct sock *)sk;
++ asoc->base.net = sock_net(sk);
+
+ sctp_endpoint_hold(asoc->ep);
+ sock_hold(asoc->base.sk);
+diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
+index c99114eaf42e..8640dedcf64f 100644
+--- a/net/sctp/endpointola.c
++++ b/net/sctp/endpointola.c
+@@ -165,6 +165,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
+
+ /* Remember who we are attached to. */
+ ep->base.sk = sk;
++ ep->base.net = sock_net(sk);
+ sock_hold(ep->base.sk);
+
+ return ep;
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index 5c36a99882ed..bfe29158afcc 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -815,7 +815,7 @@ static inline int sctp_hash_cmp(struct rhashtable_compare_arg *arg,
+ if (!sctp_transport_hold(t))
+ return err;
+
+- if (!net_eq(sock_net(t->asoc->base.sk), x->net))
++ if (!net_eq(t->asoc->base.net, x->net))
+ goto out;
+ if (x->lport != htons(t->asoc->base.bind_addr.port))
+ goto out;
+@@ -830,7 +830,7 @@ static inline __u32 sctp_hash_obj(const void *data, u32 len, u32 seed)
+ {
+ const struct sctp_transport *t = data;
+ const union sctp_addr *paddr = &t->ipaddr;
+- const struct net *net = sock_net(t->asoc->base.sk);
++ const struct net *net = t->asoc->base.net;
+ __be16 lport = htons(t->asoc->base.bind_addr.port);
+ __u32 addr;
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 713a669d2058..559f09ac0b22 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -2175,8 +2175,10 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
+
+ /* Update socket peer label if first association. */
+ if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
+- chunk->skb))
++ chunk->skb)) {
++ sctp_association_free(new_asoc);
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++ }
+
+ /* Set temp so that it won't be added into hashtable */
+ new_asoc->temp = 1;
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c
+index 033696e6f74f..ad158d311ffa 100644
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -207,7 +207,8 @@ void sctp_transport_reset_hb_timer(struct sctp_transport *transport)
+
+ /* When a data chunk is sent, reset the heartbeat interval. */
+ expires = jiffies + sctp_transport_timeout(transport);
+- if (time_before(transport->hb_timer.expires, expires) &&
++ if ((time_before(transport->hb_timer.expires, expires) ||
++ !timer_pending(&transport->hb_timer)) &&
+ !mod_timer(&transport->hb_timer,
+ expires + prandom_u32_max(transport->rto)))
+ sctp_transport_hold(transport);
+diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
+index ed5dcf03fe0b..333e4353498f 100644
+--- a/net/smc/smc_cdc.c
++++ b/net/smc/smc_cdc.c
+@@ -96,6 +96,7 @@ int smc_cdc_msg_send(struct smc_connection *conn,
+ struct smc_wr_buf *wr_buf,
+ struct smc_cdc_tx_pend *pend)
+ {
++ union smc_host_cursor cfed;
+ struct smc_link *link;
+ int rc;
+
+@@ -105,12 +106,10 @@ int smc_cdc_msg_send(struct smc_connection *conn,
+
+ conn->tx_cdc_seq++;
+ conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
+- smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf,
+- &conn->local_tx_ctrl, conn);
++ smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf, conn, &cfed);
+ rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
+ if (!rc)
+- smc_curs_copy(&conn->rx_curs_confirmed,
+- &conn->local_tx_ctrl.cons, conn);
++ smc_curs_copy(&conn->rx_curs_confirmed, &cfed, conn);
+
+ return rc;
+ }
+diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
+index 934df4473a7c..34d2e1450320 100644
+--- a/net/smc/smc_cdc.h
++++ b/net/smc/smc_cdc.h
+@@ -135,7 +135,9 @@ static inline void smc_curs_copy_net(union smc_cdc_cursor *tgt,
+ #endif
+ }
+
+-/* calculate cursor difference between old and new, where old <= new */
++/* calculate cursor difference between old and new, where old <= new and
++ * difference cannot exceed size
++ */
+ static inline int smc_curs_diff(unsigned int size,
+ union smc_host_cursor *old,
+ union smc_host_cursor *new)
+@@ -160,28 +162,51 @@ static inline int smc_curs_comp(unsigned int size,
+ return smc_curs_diff(size, old, new);
+ }
+
++/* calculate cursor difference between old and new, where old <= new and
++ * difference may exceed size
++ */
++static inline int smc_curs_diff_large(unsigned int size,
++ union smc_host_cursor *old,
++ union smc_host_cursor *new)
++{
++ if (old->wrap < new->wrap)
++ return min_t(int,
++ (size - old->count) + new->count +
++ (new->wrap - old->wrap - 1) * size,
++ size);
++
++ if (old->wrap > new->wrap) /* wrap has switched from 0xffff to 0x0000 */
++ return min_t(int,
++ (size - old->count) + new->count +
++ (new->wrap + 0xffff - old->wrap) * size,
++ size);
++
++ return max_t(int, 0, (new->count - old->count));
++}
++
+ static inline void smc_host_cursor_to_cdc(union smc_cdc_cursor *peer,
+ union smc_host_cursor *local,
++ union smc_host_cursor *save,
+ struct smc_connection *conn)
+ {
+- union smc_host_cursor temp;
+-
+- smc_curs_copy(&temp, local, conn);
+- peer->count = htonl(temp.count);
+- peer->wrap = htons(temp.wrap);
++ smc_curs_copy(save, local, conn);
++ peer->count = htonl(save->count);
++ peer->wrap = htons(save->wrap);
+ /* peer->reserved = htons(0); must be ensured by caller */
+ }
+
+ static inline void smc_host_msg_to_cdc(struct smc_cdc_msg *peer,
+- struct smc_host_cdc_msg *local,
+- struct smc_connection *conn)
++ struct smc_connection *conn,
++ union smc_host_cursor *save)
+ {
++ struct smc_host_cdc_msg *local = &conn->local_tx_ctrl;
++
+ peer->common.type = local->common.type;
+ peer->len = local->len;
+ peer->seqno = htons(local->seqno);
+ peer->token = htonl(local->token);
+- smc_host_cursor_to_cdc(&peer->prod, &local->prod, conn);
+- smc_host_cursor_to_cdc(&peer->cons, &local->cons, conn);
++ smc_host_cursor_to_cdc(&peer->prod, &local->prod, save, conn);
++ smc_host_cursor_to_cdc(&peer->cons, &local->cons, save, conn);
+ peer->prod_flags = local->prod_flags;
+ peer->conn_state_flags = local->conn_state_flags;
+ }
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index 18daebcef181..2c9baf8bf118 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -128,6 +128,8 @@ static void smc_lgr_unregister_conn(struct smc_connection *conn)
+ {
+ struct smc_link_group *lgr = conn->lgr;
+
++ if (!lgr)
++ return;
+ write_lock_bh(&lgr->conns_lock);
+ if (conn->alert_token_local) {
+ __smc_lgr_unregister_conn(conn);
+@@ -612,6 +614,8 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
+ local_contact = SMC_REUSE_CONTACT;
+ conn->lgr = lgr;
+ smc_lgr_register_conn(conn); /* add smc conn to lgr */
++ if (delayed_work_pending(&lgr->free_work))
++ cancel_delayed_work(&lgr->free_work);
+ write_unlock_bh(&lgr->conns_lock);
+ break;
+ }
+diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
+index 28361aef9982..0ecbbdc337b8 100644
+--- a/net/smc/smc_tx.c
++++ b/net/smc/smc_tx.c
+@@ -163,12 +163,11 @@ int smc_tx_sendmsg(struct smc_sock *smc, struct msghdr *msg, size_t len)
+ conn->local_tx_ctrl.prod_flags.urg_data_pending = 1;
+
+ if (!atomic_read(&conn->sndbuf_space) || conn->urg_tx_pend) {
++ if (send_done)
++ return send_done;
+ rc = smc_tx_wait(smc, msg->msg_flags);
+- if (rc) {
+- if (send_done)
+- return send_done;
++ if (rc)
+ goto out_err;
+- }
+ continue;
+ }
+
+@@ -596,7 +595,8 @@ void smc_tx_consumer_update(struct smc_connection *conn, bool force)
+ if (to_confirm > conn->rmbe_update_limit) {
+ smc_curs_copy(&prod, &conn->local_rx_ctrl.prod, conn);
+ sender_free = conn->rmb_desc->len -
+- smc_curs_diff(conn->rmb_desc->len, &prod, &cfed);
++ smc_curs_diff_large(conn->rmb_desc->len,
++ &cfed, &prod);
+ }
+
+ if (conn->local_rx_ctrl.prod_flags.cons_curs_upd_req ||
+diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
+index c8ae983c6cc0..f2eaf264726b 100644
+--- a/net/sunrpc/xprtrdma/rpc_rdma.c
++++ b/net/sunrpc/xprtrdma/rpc_rdma.c
+@@ -1360,6 +1360,10 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
+ spin_unlock(&xprt->recv_lock);
+
+ req = rpcr_to_rdmar(rqst);
++ if (req->rl_reply) {
++ trace_xprtrdma_leaked_rep(rqst, req->rl_reply);
++ rpcrdma_recv_buffer_put(req->rl_reply);
++ }
+ req->rl_reply = rep;
+ rep->rr_rqst = rqst;
+ clear_bit(RPCRDMA_REQ_F_PENDING, &req->rl_flags);
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 6344aca4487b..0fbf8ea18ce0 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1114,7 +1114,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
+ default:
+ pr_warn("Dropping received illegal msg type\n");
+ kfree_skb(skb);
+- return false;
++ return true;
+ };
+ }
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 318c541970ec..29e684054abe 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -548,7 +548,7 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
+ if (len <= 0)
+ return -EINVAL;
+
+- len = min_t(int, len, TIPC_MAX_BEARER_NAME);
++ len = min_t(int, len, TIPC_MAX_LINK_NAME);
+ if (!string_is_valid(name, len))
+ return -EINVAL;
+
+@@ -830,7 +830,7 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
+ if (len <= 0)
+ return -EINVAL;
+
+- len = min_t(int, len, TIPC_MAX_BEARER_NAME);
++ len = min_t(int, len, TIPC_MAX_LINK_NAME);
+ if (!string_is_valid(name, len))
+ return -EINVAL;
+
+@@ -983,6 +983,10 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
+
+ hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
+ TIPC_NL_PUBL_GET);
++ if (!hdr) {
++ kfree_skb(args);
++ return -EMSGSIZE;
++ }
+
+ nest = nla_nest_start(args, TIPC_NLA_SOCK);
+ if (!nest) {
+@@ -1030,8 +1034,11 @@ static int tipc_nl_compat_sk_dump(struct tipc_nl_compat_msg *msg,
+ u32 node;
+ struct nlattr *con[TIPC_NLA_CON_MAX + 1];
+
+- nla_parse_nested(con, TIPC_NLA_CON_MAX,
+- sock[TIPC_NLA_SOCK_CON], NULL, NULL);
++ err = nla_parse_nested(con, TIPC_NLA_CON_MAX,
++ sock[TIPC_NLA_SOCK_CON], NULL, NULL);
++
++ if (err)
++ return err;
+
+ node = nla_get_u32(con[TIPC_NLA_CON_NODE]);
+ tipc_tlv_sprintf(msg->rep, " connected to <%u.%u.%u:%u>",
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index b2724fb06bbb..62ec9182f234 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -107,6 +107,7 @@
+ #include <linux/mutex.h>
+ #include <linux/net.h>
+ #include <linux/poll.h>
++#include <linux/random.h>
+ #include <linux/skbuff.h>
+ #include <linux/smp.h>
+ #include <linux/socket.h>
+@@ -480,9 +481,13 @@ out:
+ static int __vsock_bind_stream(struct vsock_sock *vsk,
+ struct sockaddr_vm *addr)
+ {
+- static u32 port = LAST_RESERVED_PORT + 1;
++ static u32 port = 0;
+ struct sockaddr_vm new_addr;
+
++ if (!port)
++ port = LAST_RESERVED_PORT + 1 +
++ prandom_u32_max(U32_MAX - LAST_RESERVED_PORT);
++
+ vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port);
+
+ if (addr->svm_port == VMADDR_PORT_ANY) {
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 11e09eb138d6..47a8ff972a2b 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -456,6 +456,8 @@ static void ___xfrm_state_destroy(struct xfrm_state *x)
+ x->type->destructor(x);
+ xfrm_put_type(x->type);
+ }
++ if (x->xfrag.page)
++ put_page(x->xfrag.page);
+ xfrm_dev_state_free(x);
+ security_xfrm_state_free(x);
+ xfrm_state_free(x);
+diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
+index 36f9f41d094b..75d4b48601aa 100644
+--- a/samples/bpf/Makefile
++++ b/samples/bpf/Makefile
+@@ -172,6 +172,7 @@ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/testing/selftests/bpf/
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/ -I$(srctree)/tools/include
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/perf
++KBUILD_HOSTCFLAGS += -DHAVE_ATTR_TEST=0
+
+ HOSTCFLAGS_bpf_load.o += -I$(objtree)/usr/include -Wno-unused-variable
+ HOSTCFLAGS_trace_helpers.o += -I$(srctree)/tools/lib/bpf/
+diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
+index 7abb79d8313d..f6732aa16bb1 100644
+--- a/samples/vfio-mdev/mtty.c
++++ b/samples/vfio-mdev/mtty.c
+@@ -171,7 +171,7 @@ static struct mdev_state *find_mdev_state_by_uuid(uuid_le uuid)
+ return NULL;
+ }
+
+-void dump_buffer(char *buf, uint32_t count)
++void dump_buffer(u8 *buf, uint32_t count)
+ {
+ #if defined(DEBUG)
+ int i;
+@@ -250,7 +250,7 @@ static void mtty_create_config_space(struct mdev_state *mdev_state)
+ }
+
+ static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset,
+- char *buf, u32 count)
++ u8 *buf, u32 count)
+ {
+ u32 cfg_addr, bar_mask, bar_index = 0;
+
+@@ -304,7 +304,7 @@ static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset,
+ }
+
+ static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state,
+- u16 offset, char *buf, u32 count)
++ u16 offset, u8 *buf, u32 count)
+ {
+ u8 data = *buf;
+
+@@ -475,7 +475,7 @@ static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state,
+ }
+
+ static void handle_bar_read(unsigned int index, struct mdev_state *mdev_state,
+- u16 offset, char *buf, u32 count)
++ u16 offset, u8 *buf, u32 count)
+ {
+ /* Handle read requests by guest */
+ switch (offset) {
+@@ -650,7 +650,7 @@ static void mdev_read_base(struct mdev_state *mdev_state)
+ }
+ }
+
+-static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
++static ssize_t mdev_access(struct mdev_device *mdev, u8 *buf, size_t count,
+ loff_t pos, bool is_write)
+ {
+ struct mdev_state *mdev_state;
+@@ -698,7 +698,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
+ #if defined(DEBUG_REGS)
+ pr_info("%s: BAR%d WR @0x%llx %s val:0x%02x dlab:%d\n",
+ __func__, index, offset, wr_reg[offset],
+- (u8)*buf, mdev_state->s[index].dlab);
++ *buf, mdev_state->s[index].dlab);
+ #endif
+ handle_bar_write(index, mdev_state, offset, buf, count);
+ } else {
+@@ -708,7 +708,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
+ #if defined(DEBUG_REGS)
+ pr_info("%s: BAR%d RD @0x%llx %s val:0x%02x dlab:%d\n",
+ __func__, index, offset, rd_reg[offset],
+- (u8)*buf, mdev_state->s[index].dlab);
++ *buf, mdev_state->s[index].dlab);
+ #endif
+ }
+ break;
+@@ -827,7 +827,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ if (count >= 4 && !(*ppos % 4)) {
+ u32 val;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, false);
+ if (ret <= 0)
+ goto read_err;
+@@ -839,7 +839,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ } else if (count >= 2 && !(*ppos % 2)) {
+ u16 val;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, false);
+ if (ret <= 0)
+ goto read_err;
+@@ -851,7 +851,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ } else {
+ u8 val;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, false);
+ if (ret <= 0)
+ goto read_err;
+@@ -889,7 +889,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ if (copy_from_user(&val, buf, sizeof(val)))
+ goto write_err;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, true);
+ if (ret <= 0)
+ goto write_err;
+@@ -901,7 +901,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ if (copy_from_user(&val, buf, sizeof(val)))
+ goto write_err;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, true);
+ if (ret <= 0)
+ goto write_err;
+@@ -913,7 +913,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ if (copy_from_user(&val, buf, sizeof(val)))
+ goto write_err;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, true);
+ if (ret <= 0)
+ goto write_err;
+diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
+index 004b0ac7fa72..4644f1a83b57 100644
+--- a/scripts/gdb/linux/symbols.py
++++ b/scripts/gdb/linux/symbols.py
+@@ -99,7 +99,8 @@ lx-symbols command."""
+ attrs[n]['name'].string(): attrs[n]['address']
+ for n in range(int(sect_attrs['nsections']))}
+ args = []
+- for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]:
++ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
++ ".text", ".text.hot", ".text.unlikely"]:
+ address = section_name_to_address.get(section_name)
+ if address:
+ args.append(" -s {name} {addr}".format(
+diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
+index 40e3a098f6fb..d95a7e41a29d 100644
+--- a/security/apparmor/apparmorfs.c
++++ b/security/apparmor/apparmorfs.c
+@@ -361,6 +361,7 @@ static void aafs_remove(struct dentry *dentry)
+ simple_rmdir(dir, dentry);
+ else
+ simple_unlink(dir, dentry);
++ d_delete(dentry);
+ dput(dentry);
+ }
+ inode_unlock(dir);
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 516ec3587325..509038d6bccd 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -529,7 +529,7 @@ static int snd_compress_check_input(struct snd_compr_params *params)
+ {
+ /* first let's check the buffer parameter's */
+ if (params->buffer.fragment_size == 0 ||
+- params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
++ params->buffer.fragments > U32_MAX / params->buffer.fragment_size ||
+ params->buffer.fragments == 0)
+ return -EINVAL;
+
+diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
+index b7cf7cce95fe..4f0497ab1aa8 100644
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -303,7 +303,7 @@ struct pm8916_wcd_analog_priv {
+ };
+
+ static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" };
+-static const char *const rdac2_mux_text[] = { "ZERO", "RX2", "RX1" };
++static const char *const rdac2_mux_text[] = { "RX1", "RX2" };
+ static const char *const hph_text[] = { "ZERO", "Switch", };
+
+ static const struct soc_enum hph_enum = SOC_ENUM_SINGLE_VIRT(
+@@ -318,7 +318,7 @@ static const struct soc_enum adc2_enum = SOC_ENUM_SINGLE_VIRT(
+
+ /* RDAC2 MUX */
+ static const struct soc_enum rdac2_mux_enum = SOC_ENUM_SINGLE(
+- CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 3, rdac2_mux_text);
++ CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 2, rdac2_mux_text);
+
+ static const struct snd_kcontrol_new spkr_switch[] = {
+ SOC_DAPM_SINGLE("Switch", CDC_A_SPKR_DAC_CTL, 7, 1, 0)
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index 1dc70f452c1b..f842db498c74 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3662,6 +3662,11 @@ static const struct rt5645_platform_data jd_mode3_platform_data = {
+ .jd_mode = 3,
+ };
+
++static const struct rt5645_platform_data lattepanda_board_platform_data = {
++ .jd_mode = 2,
++ .inv_jd1_1 = true
++};
++
+ static const struct dmi_system_id dmi_platform_data[] = {
+ {
+ .ident = "Chrome Buddy",
+@@ -3759,6 +3764,15 @@ static const struct dmi_system_id dmi_platform_data[] = {
+ },
+ .driver_data = (void *)&intel_braswell_platform_data,
+ },
++ {
++ .ident = "LattePanda board",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ DMI_EXACT_MATCH(DMI_BOARD_VERSION, "Default string"),
++ },
++ .driver_data = (void *)&lattepanda_board_platform_data,
++ },
+ { }
+ };
+
+diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
+index 9a2777b72dcd..4395bb7029a0 100644
+--- a/sound/soc/kirkwood/kirkwood-i2s.c
++++ b/sound/soc/kirkwood/kirkwood-i2s.c
+@@ -563,10 +563,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ return PTR_ERR(priv->clk);
+ }
+
+- err = clk_prepare_enable(priv->clk);
+- if (err < 0)
+- return err;
+-
+ priv->extclk = devm_clk_get(&pdev->dev, "extclk");
+ if (IS_ERR(priv->extclk)) {
+ if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
+@@ -582,6 +578,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ }
+ }
+
++ err = clk_prepare_enable(priv->clk);
++ if (err < 0)
++ return err;
++
+ /* Some sensible defaults - this reflects the powerup values */
+ priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24;
+ priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24;
+@@ -595,7 +595,7 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ priv->ctl_rec |= KIRKWOOD_RECCTL_BURST_128;
+ }
+
+- err = devm_snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
++ err = snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
+ soc_dai, 2);
+ if (err) {
+ dev_err(&pdev->dev, "snd_soc_register_component failed\n");
+@@ -618,6 +618,7 @@ static int kirkwood_i2s_dev_remove(struct platform_device *pdev)
+ {
+ struct kirkwood_dma_data *priv = dev_get_drvdata(&pdev->dev);
+
++ snd_soc_unregister_component(&pdev->dev);
+ if (!IS_ERR(priv->extclk))
+ clk_disable_unprepare(priv->extclk);
+ clk_disable_unprepare(priv->clk);
+diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
+index ce00fe2f6aae..d4bde4834ce5 100644
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -604,6 +604,7 @@ static int i2s_set_fmt(struct snd_soc_dai *dai,
+ unsigned int fmt)
+ {
+ struct i2s_dai *i2s = to_info(dai);
++ struct i2s_dai *other = get_other_dai(i2s);
+ int lrp_shift, sdf_shift, sdf_mask, lrp_rlow, mod_slave;
+ u32 mod, tmp = 0;
+ unsigned long flags;
+@@ -661,7 +662,8 @@ static int i2s_set_fmt(struct snd_soc_dai *dai,
+ * CLK_I2S_RCLK_SRC clock is not exposed so we ensure any
+ * clock configuration assigned in DT is not overwritten.
+ */
+- if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL)
++ if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL &&
++ other->clk_data.clks == NULL)
+ i2s_set_sysclk(dai, SAMSUNG_I2S_RCLKSRC_0,
+ 0, SND_SOC_CLOCK_IN);
+ break;
+@@ -699,6 +701,7 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
+ struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
+ {
+ struct i2s_dai *i2s = to_info(dai);
++ struct i2s_dai *other = get_other_dai(i2s);
+ u32 mod, mask = 0, val = 0;
+ struct clk *rclksrc;
+ unsigned long flags;
+@@ -784,6 +787,9 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
+ i2s->frmclk = params_rate(params);
+
+ rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
++ if (!rclksrc || IS_ERR(rclksrc))
++ rclksrc = other->clk_table[CLK_I2S_RCLK_SRC];
++
+ if (rclksrc && !IS_ERR(rclksrc))
+ i2s->rclk_srcrate = clk_get_rate(rclksrc);
+
+diff --git a/sound/soc/stm/stm32_i2s.c b/sound/soc/stm/stm32_i2s.c
+index 6d0bf78d114d..aa2b1196171a 100644
+--- a/sound/soc/stm/stm32_i2s.c
++++ b/sound/soc/stm/stm32_i2s.c
+@@ -246,8 +246,8 @@ static irqreturn_t stm32_i2s_isr(int irq, void *devid)
+ return IRQ_NONE;
+ }
+
+- regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG,
+- I2S_IFCR_MASK, flags);
++ regmap_write_bits(i2s->regmap, STM32_I2S_IFCR_REG,
++ I2S_IFCR_MASK, flags);
+
+ if (flags & I2S_SR_OVR) {
+ dev_dbg(&pdev->dev, "Overrun\n");
+@@ -276,7 +276,6 @@ static bool stm32_i2s_readable_reg(struct device *dev, unsigned int reg)
+ case STM32_I2S_CFG2_REG:
+ case STM32_I2S_IER_REG:
+ case STM32_I2S_SR_REG:
+- case STM32_I2S_IFCR_REG:
+ case STM32_I2S_TXDR_REG:
+ case STM32_I2S_RXDR_REG:
+ case STM32_I2S_CGFR_REG:
+@@ -488,7 +487,7 @@ static int stm32_i2s_configure(struct snd_soc_dai *cpu_dai,
+ {
+ struct stm32_i2s_data *i2s = snd_soc_dai_get_drvdata(cpu_dai);
+ int format = params_width(params);
+- u32 cfgr, cfgr_mask, cfg1, cfg1_mask;
++ u32 cfgr, cfgr_mask, cfg1;
+ unsigned int fthlv;
+ int ret;
+
+@@ -501,7 +500,7 @@ static int stm32_i2s_configure(struct snd_soc_dai *cpu_dai,
+ switch (format) {
+ case 16:
+ cfgr = I2S_CGFR_DATLEN_SET(I2S_I2SMOD_DATLEN_16);
+- cfgr_mask = I2S_CGFR_DATLEN_MASK;
++ cfgr_mask = I2S_CGFR_DATLEN_MASK | I2S_CGFR_CHLEN;
+ break;
+ case 32:
+ cfgr = I2S_CGFR_DATLEN_SET(I2S_I2SMOD_DATLEN_32) |
+@@ -529,15 +528,11 @@ static int stm32_i2s_configure(struct snd_soc_dai *cpu_dai,
+ if (ret < 0)
+ return ret;
+
+- cfg1 = I2S_CFG1_RXDMAEN | I2S_CFG1_TXDMAEN;
+- cfg1_mask = cfg1;
+-
+ fthlv = STM32_I2S_FIFO_SIZE * I2S_FIFO_TH_ONE_QUARTER / 4;
+- cfg1 |= I2S_CFG1_FTHVL_SET(fthlv - 1);
+- cfg1_mask |= I2S_CFG1_FTHVL_MASK;
++ cfg1 = I2S_CFG1_FTHVL_SET(fthlv - 1);
+
+ return regmap_update_bits(i2s->regmap, STM32_I2S_CFG1_REG,
+- cfg1_mask, cfg1);
++ I2S_CFG1_FTHVL_MASK, cfg1);
+ }
+
+ static int stm32_i2s_startup(struct snd_pcm_substream *substream,
+@@ -551,8 +546,8 @@ static int stm32_i2s_startup(struct snd_pcm_substream *substream,
+ i2s->refcount++;
+ spin_unlock(&i2s->lock_fd);
+
+- return regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG,
+- I2S_IFCR_MASK, I2S_IFCR_MASK);
++ return regmap_write_bits(i2s->regmap, STM32_I2S_IFCR_REG,
++ I2S_IFCR_MASK, I2S_IFCR_MASK);
+ }
+
+ static int stm32_i2s_hw_params(struct snd_pcm_substream *substream,
+@@ -589,6 +584,10 @@ static int stm32_i2s_trigger(struct snd_pcm_substream *substream, int cmd,
+ /* Enable i2s */
+ dev_dbg(cpu_dai->dev, "start I2S\n");
+
++ cfg1_mask = I2S_CFG1_RXDMAEN | I2S_CFG1_TXDMAEN;
++ regmap_update_bits(i2s->regmap, STM32_I2S_CFG1_REG,
++ cfg1_mask, cfg1_mask);
++
+ ret = regmap_update_bits(i2s->regmap, STM32_I2S_CR1_REG,
+ I2S_CR1_SPE, I2S_CR1_SPE);
+ if (ret < 0) {
+@@ -603,8 +602,8 @@ static int stm32_i2s_trigger(struct snd_pcm_substream *substream, int cmd,
+ return ret;
+ }
+
+- regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG,
+- I2S_IFCR_MASK, I2S_IFCR_MASK);
++ regmap_write_bits(i2s->regmap, STM32_I2S_IFCR_REG,
++ I2S_IFCR_MASK, I2S_IFCR_MASK);
+
+ if (playback_flg) {
+ ier = I2S_IER_UDRIE;
+diff --git a/sound/soc/stm/stm32_sai.c b/sound/soc/stm/stm32_sai.c
+index f22654253c43..540c4a00405c 100644
+--- a/sound/soc/stm/stm32_sai.c
++++ b/sound/soc/stm/stm32_sai.c
+@@ -112,16 +112,21 @@ static int stm32_sai_set_sync(struct stm32_sai_data *sai_client,
+ if (!sai_provider) {
+ dev_err(&sai_client->pdev->dev,
+ "SAI sync provider data not found\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out_put_dev;
+ }
+
+ /* Configure sync client */
+ ret = stm32_sai_sync_conf_client(sai_client, synci);
+ if (ret < 0)
+- return ret;
++ goto out_put_dev;
+
+ /* Configure sync provider */
+- return stm32_sai_sync_conf_provider(sai_provider, synco);
++ ret = stm32_sai_sync_conf_provider(sai_provider, synco);
++
++out_put_dev:
++ put_device(&pdev->dev);
++ return ret;
+ }
+
+ static int stm32_sai_probe(struct platform_device *pdev)
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index 2fb2b914e78b..6c2e69e32c86 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -994,6 +994,16 @@ static int stm32_sai_pcm_process_spdif(struct snd_pcm_substream *substream,
+ return 0;
+ }
+
++/* No support of mmap in S/PDIF mode */
++static const struct snd_pcm_hardware stm32_sai_pcm_hw_spdif = {
++ .info = SNDRV_PCM_INFO_INTERLEAVED,
++ .buffer_bytes_max = 8 * PAGE_SIZE,
++ .period_bytes_min = 1024,
++ .period_bytes_max = PAGE_SIZE,
++ .periods_min = 2,
++ .periods_max = 8,
++};
++
+ static const struct snd_pcm_hardware stm32_sai_pcm_hw = {
+ .info = SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_MMAP,
+ .buffer_bytes_max = 8 * PAGE_SIZE,
+@@ -1050,7 +1060,7 @@ static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config = {
+ };
+
+ static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config_spdif = {
+- .pcm_hardware = &stm32_sai_pcm_hw,
++ .pcm_hardware = &stm32_sai_pcm_hw_spdif,
+ .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
+ .process = stm32_sai_pcm_process_spdif,
+ };
+diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
+index 0c7d9e556b47..a7fc91bb9119 100644
+--- a/tools/testing/selftests/bpf/test_sockmap.c
++++ b/tools/testing/selftests/bpf/test_sockmap.c
+@@ -248,6 +248,10 @@ static int msg_loop_sendpage(int fd, int iov_length, int cnt,
+ int i, fp;
+
+ file = fopen(".sendpage_tst.tmp", "w+");
++ if (!file) {
++ perror("create file for sendpage");
++ return 1;
++ }
+ for (i = 0; i < iov_length * cnt; i++, k++)
+ fwrite(&k, sizeof(char), 1, file);
+ fflush(file);
+@@ -255,6 +259,11 @@ static int msg_loop_sendpage(int fd, int iov_length, int cnt,
+ fclose(file);
+
+ fp = open(".sendpage_tst.tmp", O_RDONLY);
++ if (fp < 0) {
++ perror("reopen file for sendpage");
++ return 1;
++ }
++
+ clock_gettime(CLOCK_MONOTONIC, &s->start);
+ for (i = 0; i < cnt; i++) {
+ int sent = sendfile(fd, fp, NULL, iov_length);
+diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
+index 37908a83ddc2..1ff3a6c0367b 100644
+--- a/tools/vm/page-types.c
++++ b/tools/vm/page-types.c
+@@ -701,7 +701,7 @@ static void walk_pfn(unsigned long voffset,
+ if (kpagecgroup_read(cgi, index, pages) != pages)
+ fatal("kpagecgroup returned fewer pages than expected");
+
+- if (kpagecount_read(cnt, index, batch) != pages)
++ if (kpagecount_read(cnt, index, pages) != pages)
+ fatal("kpagecount returned fewer pages than expected");
+
+ for (i = 0; i < pages; i++)
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index df3fc0f214ec..9502b1a44232 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -3990,7 +3990,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm)
+ }
+ add_uevent_var(env, "PID=%d", kvm->userspace_pid);
+
+- if (kvm->debugfs_dentry) {
++ if (!IS_ERR_OR_NULL(kvm->debugfs_dentry)) {
+ char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL);
+
+ if (p) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-12-13 12:35 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-12-13 12:35 UTC (permalink / raw
To: gentoo-commits
commit: cec555b10aaa9021172ca97c9c4f3a605f82ffb8
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 13 12:35:23 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Dec 13 12:35:23 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=cec555b1
Linux patch 4.19.89
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1088_linux-4.19.89.patch | 7703 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 7707 insertions(+)
diff --git a/0000_README b/0000_README
index a04c9e9..198a710 100644
--- a/0000_README
+++ b/0000_README
@@ -391,6 +391,10 @@ Patch: 1087_linux-4.19.88.patch
From: https://www.kernel.org
Desc: Linux 4.19.88
+Patch: 1088_linux-4.19.89.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.89
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1088_linux-4.19.89.patch b/1088_linux-4.19.89.patch
new file mode 100644
index 0000000..3850cd4
--- /dev/null
+++ b/1088_linux-4.19.89.patch
@@ -0,0 +1,7703 @@
+diff --git a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
+index be789685a1c2..18b892d010d8 100644
+--- a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
++++ b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
+@@ -27,4 +27,4 @@ and valid to enable charging:
+
+ - "abracon,tc-diode": should be "standard" (0.6V) or "schottky" (0.3V)
+ - "abracon,tc-resistor": should be <0>, <3>, <6> or <11>. 0 disables the output
+- resistor, the other values are in ohm.
++ resistor, the other values are in kOhm.
+diff --git a/Makefile b/Makefile
+index f9ebb74e8e43..805dbba940a7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 88
++SUBLEVEL = 89
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -1507,9 +1507,6 @@ else # KBUILD_EXTMOD
+
+ # We are always building modules
+ KBUILD_MODULES := 1
+-PHONY += crmodverdir
+-crmodverdir:
+- $(cmd_crmodverdir)
+
+ PHONY += $(objtree)/Module.symvers
+ $(objtree)/Module.symvers:
+@@ -1521,7 +1518,7 @@ $(objtree)/Module.symvers:
+
+ module-dirs := $(addprefix _module_,$(KBUILD_EXTMOD))
+ PHONY += $(module-dirs) modules
+-$(module-dirs): crmodverdir $(objtree)/Module.symvers
++$(module-dirs): prepare $(objtree)/Module.symvers
+ $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
+
+ modules: $(module-dirs)
+@@ -1562,7 +1559,8 @@ help:
+
+ # Dummies...
+ PHONY += prepare scripts
+-prepare: ;
++prepare:
++ $(cmd_crmodverdir)
+ scripts: ;
+ endif # KBUILD_EXTMOD
+
+@@ -1689,17 +1687,14 @@ endif
+
+ # Modules
+ /: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir)
+ # Make sure the latest headers are built for Documentation
+ Documentation/ samples/: headers_install
+ %/: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir)
+ %.ko: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir) $(@:.ko=.o)
+ $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
+diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
+index db681cf4959c..2ad77fb43639 100644
+--- a/arch/arc/include/asm/cache.h
++++ b/arch/arc/include/asm/cache.h
+@@ -124,7 +124,9 @@ extern unsigned long perip_base, perip_end;
+
+ /* IO coherency related Auxiliary registers */
+ #define ARC_REG_IO_COH_ENABLE 0x500
++#define ARC_IO_COH_ENABLE_BIT BIT(0)
+ #define ARC_REG_IO_COH_PARTIAL 0x501
++#define ARC_IO_COH_PARTIAL_BIT BIT(0)
+ #define ARC_REG_IO_COH_AP0_BASE 0x508
+ #define ARC_REG_IO_COH_AP0_SIZE 0x509
+
+diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
+index f2701c13a66b..cf9619d4efb4 100644
+--- a/arch/arc/mm/cache.c
++++ b/arch/arc/mm/cache.c
+@@ -1144,6 +1144,20 @@ noinline void __init arc_ioc_setup(void)
+ {
+ unsigned int ioc_base, mem_sz;
+
++ /*
++ * If IOC was already enabled (due to bootloader) it technically needs to
++ * be reconfigured with aperture base,size corresponding to Linux memory map
++ * which will certainly be different than uboot's. But disabling and
++ * reenabling IOC when DMA might be potentially active is tricky business.
++ * To avoid random memory issues later, just panic here and ask user to
++ * upgrade bootloader to one which doesn't enable IOC
++ */
++ if (read_aux_reg(ARC_REG_IO_COH_ENABLE) & ARC_IO_COH_ENABLE_BIT)
++ panic("IOC already enabled, please upgrade bootloader!\n");
++
++ if (!ioc_enable)
++ return;
++
+ /*
+ * As for today we don't support both IOC and ZONE_HIGHMEM enabled
+ * simultaneously. This happens because as of today IOC aperture covers
+@@ -1187,8 +1201,8 @@ noinline void __init arc_ioc_setup(void)
+ panic("IOC Aperture start must be aligned to the size of the aperture");
+
+ write_aux_reg(ARC_REG_IO_COH_AP0_BASE, ioc_base >> 12);
+- write_aux_reg(ARC_REG_IO_COH_PARTIAL, 1);
+- write_aux_reg(ARC_REG_IO_COH_ENABLE, 1);
++ write_aux_reg(ARC_REG_IO_COH_PARTIAL, ARC_IO_COH_PARTIAL_BIT);
++ write_aux_reg(ARC_REG_IO_COH_ENABLE, ARC_IO_COH_ENABLE_BIT);
+
+ /* Re-enable L1 dcache */
+ __dc_enable();
+@@ -1265,7 +1279,7 @@ void __init arc_cache_init_master(void)
+ if (is_isa_arcv2() && l2_line_sz && !slc_enable)
+ arc_slc_disable();
+
+- if (is_isa_arcv2() && ioc_enable)
++ if (is_isa_arcv2() && ioc_exists)
+ arc_ioc_setup();
+
+ if (is_isa_arcv2() && l2_line_sz && slc_enable) {
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index f95a90dfc282..bee0ba1d1cfb 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -1079,14 +1079,21 @@ choice
+ Say Y here if you want kernel low-level debugging support
+ on SOCFPGA(Cyclone 5 and Arria 5) based platforms.
+
+- config DEBUG_SOCFPGA_UART1
++ config DEBUG_SOCFPGA_ARRIA10_UART1
+ depends on ARCH_SOCFPGA
+- bool "Use SOCFPGA UART1 for low-level debug"
++ bool "Use SOCFPGA Arria10 UART1 for low-level debug"
+ select DEBUG_UART_8250
+ help
+ Say Y here if you want kernel low-level debugging support
+ on SOCFPGA(Arria 10) based platforms.
+
++ config DEBUG_SOCFPGA_CYCLONE5_UART1
++ depends on ARCH_SOCFPGA
++ bool "Use SOCFPGA Cyclone 5 UART1 for low-level debug"
++ select DEBUG_UART_8250
++ help
++ Say Y here if you want kernel low-level debugging support
++ on SOCFPGA(Cyclone 5 and Arria 5) based platforms.
+
+ config DEBUG_SUN9I_UART0
+ bool "Kernel low-level debugging messages via sun9i UART0"
+@@ -1647,7 +1654,8 @@ config DEBUG_UART_PHYS
+ default 0xfe800000 if ARCH_IOP32X
+ default 0xff690000 if DEBUG_RK32_UART2
+ default 0xffc02000 if DEBUG_SOCFPGA_UART0
+- default 0xffc02100 if DEBUG_SOCFPGA_UART1
++ default 0xffc02100 if DEBUG_SOCFPGA_ARRIA10_UART1
++ default 0xffc03000 if DEBUG_SOCFPGA_CYCLONE5_UART1
+ default 0xffd82340 if ARCH_IOP13XX
+ default 0xffe40000 if DEBUG_RCAR_GEN1_SCIF0
+ default 0xffe42000 if DEBUG_RCAR_GEN1_SCIF2
+@@ -1754,7 +1762,8 @@ config DEBUG_UART_VIRT
+ default 0xfeb30c00 if DEBUG_KEYSTONE_UART0
+ default 0xfeb31000 if DEBUG_KEYSTONE_UART1
+ default 0xfec02000 if DEBUG_SOCFPGA_UART0
+- default 0xfec02100 if DEBUG_SOCFPGA_UART1
++ default 0xfec02100 if DEBUG_SOCFPGA_ARRIA10_UART1
++ default 0xfec03000 if DEBUG_SOCFPGA_CYCLONE5_UART1
+ default 0xfec12000 if (DEBUG_MVEBU_UART0 || DEBUG_MVEBU_UART0_ALTERNATE) && ARCH_MVEBU
+ default 0xfec12100 if DEBUG_MVEBU_UART1_ALTERNATE
+ default 0xfec10000 if DEBUG_SIRFATLAS7_UART0
+@@ -1803,9 +1812,9 @@ config DEBUG_UART_8250_WORD
+ depends on DEBUG_LL_UART_8250 || DEBUG_UART_8250
+ depends on DEBUG_UART_8250_SHIFT >= 2
+ default y if DEBUG_PICOXCELL_UART || \
+- DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_UART1 || \
+- DEBUG_KEYSTONE_UART0 || DEBUG_KEYSTONE_UART1 || \
+- DEBUG_ALPINE_UART0 || \
++ DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_ARRIA10_UART1 || \
++ DEBUG_SOCFPGA_CYCLONE5_UART1 || DEBUG_KEYSTONE_UART0 || \
++ DEBUG_KEYSTONE_UART1 || DEBUG_ALPINE_UART0 || \
+ DEBUG_DAVINCI_DMx_UART0 || DEBUG_DAVINCI_DA8XX_UART1 || \
+ DEBUG_DAVINCI_DA8XX_UART2 || DEBUG_BCM_IPROC_UART3 || \
+ DEBUG_BCM_KONA_UART || DEBUG_RK32_UART2
+diff --git a/arch/arm/boot/dts/am335x-pdu001.dts b/arch/arm/boot/dts/am335x-pdu001.dts
+index 34fb63ef420f..f56798efddff 100644
+--- a/arch/arm/boot/dts/am335x-pdu001.dts
++++ b/arch/arm/boot/dts/am335x-pdu001.dts
+@@ -577,7 +577,7 @@
+ bus-width = <4>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc2_pins>;
+- cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
++ cd-gpios = <&gpio2 2 GPIO_ACTIVE_HIGH>;
+ };
+
+ &sham {
+diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts
+index f2a1d25eb6cf..83e0fbc4a1a1 100644
+--- a/arch/arm/boot/dts/arm-realview-pb1176.dts
++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts
+@@ -45,7 +45,7 @@
+ };
+
+ /* The voltage to the MMC card is hardwired at 3.3V */
+- vmmc: fixedregulator@0 {
++ vmmc: regulator-vmmc {
+ compatible = "regulator-fixed";
+ regulator-name = "vmmc";
+ regulator-min-microvolt = <3300000>;
+@@ -53,7 +53,7 @@
+ regulator-boot-on;
+ };
+
+- veth: fixedregulator@0 {
++ veth: regulator-veth {
+ compatible = "regulator-fixed";
+ regulator-name = "veth";
+ regulator-min-microvolt = <3300000>;
+diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+index 7f9cbdf33a51..2f6aa24a0b67 100644
+--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts
++++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+@@ -145,7 +145,7 @@
+ };
+
+ /* The voltage to the MMC card is hardwired at 3.3V */
+- vmmc: fixedregulator@0 {
++ vmmc: regulator-vmmc {
+ compatible = "regulator-fixed";
+ regulator-name = "vmmc";
+ regulator-min-microvolt = <3300000>;
+@@ -153,7 +153,7 @@
+ regulator-boot-on;
+ };
+
+- veth: fixedregulator@0 {
++ veth: regulator-veth {
+ compatible = "regulator-fixed";
+ regulator-name = "veth";
+ regulator-min-microvolt = <3300000>;
+diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+index a5676697ff3b..916a97734f84 100644
+--- a/arch/arm/boot/dts/arm-realview-pbx.dtsi
++++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+@@ -44,7 +44,7 @@
+ };
+
+ /* The voltage to the MMC card is hardwired at 3.3V */
+- vmmc: fixedregulator@0 {
++ vmmc: regulator-vmmc {
+ compatible = "regulator-fixed";
+ regulator-name = "vmmc";
+ regulator-min-microvolt = <3300000>;
+@@ -52,7 +52,7 @@
+ regulator-boot-on;
+ };
+
+- veth: fixedregulator@0 {
++ veth: regulator-veth {
+ compatible = "regulator-fixed";
+ regulator-name = "veth";
+ regulator-min-microvolt = <3300000>;
+@@ -567,4 +567,3 @@
+ };
+ };
+ };
+-
+diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi
+index 94efca78c42f..5892a9f7622f 100644
+--- a/arch/arm/boot/dts/exynos3250.dtsi
++++ b/arch/arm/boot/dts/exynos3250.dtsi
+@@ -360,7 +360,7 @@
+ };
+
+ hsotg: hsotg@12480000 {
+- compatible = "snps,dwc2";
++ compatible = "samsung,s3c6400-hsotg", "snps,dwc2";
+ reg = <0x12480000 0x20000>;
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cmu CLK_USBOTG>;
+diff --git a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+index 27214e6ebe4f..d476ba0f07b6 100644
+--- a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
++++ b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+@@ -224,7 +224,7 @@
+
+ ldo13_reg: LDO13 {
+ regulator-name = "vddq_mmc2";
+- regulator-min-microvolt = <2800000>;
++ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <2800000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+index 7fff3717cf7c..315d0e7615f3 100644
+--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+@@ -609,13 +609,14 @@
+ };
+
+ touchscreen@2a {
+- compatible = "eeti,egalax_ts";
++ compatible = "eeti,exc3000";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_ts>;
+ reg = <0x2a>;
+ interrupt-parent = <&gpio1>;
+ interrupts = <8 IRQ_TYPE_LEVEL_LOW>;
+- wakeup-gpios = <&gpio1 8 GPIO_ACTIVE_LOW>;
++ touchscreen-inverted-x;
++ touchscreen-swapped-x-y;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi
+index 47e5b63339d1..e95deed6a797 100644
+--- a/arch/arm/boot/dts/mmp2.dtsi
++++ b/arch/arm/boot/dts/mmp2.dtsi
+@@ -180,7 +180,7 @@
+ clocks = <&soc_clocks MMP2_CLK_GPIO>;
+ resets = <&soc_clocks MMP2_CLK_GPIO>;
+ interrupt-controller;
+- #interrupt-cells = <1>;
++ #interrupt-cells = <2>;
+ ranges;
+
+ gcb0: gpio@d4019000 {
+diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi
+index 3228ad5fb725..ccbecad9c5c7 100644
+--- a/arch/arm/boot/dts/pxa27x.dtsi
++++ b/arch/arm/boot/dts/pxa27x.dtsi
+@@ -35,7 +35,7 @@
+ clocks = <&clks CLK_NONE>;
+ };
+
+- pxa27x_ohci: usb@4c000000 {
++ usb0: usb@4c000000 {
+ compatible = "marvell,pxa-ohci";
+ reg = <0x4c000000 0x10000>;
+ interrupts = <3>;
+diff --git a/arch/arm/boot/dts/pxa2xx.dtsi b/arch/arm/boot/dts/pxa2xx.dtsi
+index a520b4c14ea9..0a0e837dc79c 100644
+--- a/arch/arm/boot/dts/pxa2xx.dtsi
++++ b/arch/arm/boot/dts/pxa2xx.dtsi
+@@ -117,13 +117,6 @@
+ status = "disabled";
+ };
+
+- usb0: ohci@4c000000 {
+- compatible = "marvell,pxa-ohci";
+- reg = <0x4c000000 0x10000>;
+- interrupts = <3>;
+- status = "disabled";
+- };
+-
+ mmc0: mmc@41100000 {
+ compatible = "marvell,pxa-mmc";
+ reg = <0x41100000 0x1000>;
+diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi
+index 3a8f0edc3af9..53009dbd3615 100644
+--- a/arch/arm/boot/dts/pxa3xx.dtsi
++++ b/arch/arm/boot/dts/pxa3xx.dtsi
+@@ -204,7 +204,7 @@
+ status = "disabled";
+ };
+
+- pxa3xx_ohci: usb@4c000000 {
++ usb0: usb@4c000000 {
+ compatible = "marvell,pxa-ohci";
+ reg = <0x4c000000 0x10000>;
+ interrupts = <3>;
+diff --git a/arch/arm/boot/dts/r8a7790-lager.dts b/arch/arm/boot/dts/r8a7790-lager.dts
+index 50312e752e2f..7b9508e83d46 100644
+--- a/arch/arm/boot/dts/r8a7790-lager.dts
++++ b/arch/arm/boot/dts/r8a7790-lager.dts
+@@ -489,8 +489,6 @@
+ };
+
+ &lvds1 {
+- status = "okay";
+-
+ ports {
+ port@1 {
+ lvds_connector: endpoint {
+diff --git a/arch/arm/boot/dts/r8a7791-koelsch.dts b/arch/arm/boot/dts/r8a7791-koelsch.dts
+index ce22db01fbba..e6580aa0cea3 100644
+--- a/arch/arm/boot/dts/r8a7791-koelsch.dts
++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts
+@@ -479,8 +479,6 @@
+ };
+
+ &lvds0 {
+- status = "okay";
+-
+ ports {
+ port@1 {
+ lvds_connector: endpoint {
+diff --git a/arch/arm/boot/dts/r8a7791-porter.dts b/arch/arm/boot/dts/r8a7791-porter.dts
+index f02036e5de01..fefdf8238bbe 100644
+--- a/arch/arm/boot/dts/r8a7791-porter.dts
++++ b/arch/arm/boot/dts/r8a7791-porter.dts
+@@ -482,8 +482,6 @@
+ };
+
+ &lvds0 {
+- status = "okay";
+-
+ ports {
+ port@1 {
+ lvds_connector: endpoint {
+diff --git a/arch/arm/boot/dts/rk3288-rock2-som.dtsi b/arch/arm/boot/dts/rk3288-rock2-som.dtsi
+index 50325489c0ce..32e1ab336662 100644
+--- a/arch/arm/boot/dts/rk3288-rock2-som.dtsi
++++ b/arch/arm/boot/dts/rk3288-rock2-som.dtsi
+@@ -25,7 +25,7 @@
+
+ vcc_flash: flash-regulator {
+ compatible = "regulator-fixed";
+- regulator-name = "vcc_sys";
++ regulator-name = "vcc_flash";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ startup-delay-us = <150>;
+diff --git a/arch/arm/boot/dts/rv1108.dtsi b/arch/arm/boot/dts/rv1108.dtsi
+index ed8f6ca52c5b..a9f053dfdc06 100644
+--- a/arch/arm/boot/dts/rv1108.dtsi
++++ b/arch/arm/boot/dts/rv1108.dtsi
+@@ -66,7 +66,7 @@
+
+ arm-pmu {
+ compatible = "arm,cortex-a7-pmu";
+- interrupts = <GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>;
+ };
+
+ timer {
+@@ -541,7 +541,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x20030000 0x100>;
+ interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO0_PMU>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+@@ -554,7 +554,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x10310000 0x100>;
+ interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO1>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+@@ -567,7 +567,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x10320000 0x100>;
+ interrupts = <GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO2>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+@@ -580,7 +580,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x10330000 0x100>;
+ interrupts = <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO3>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+diff --git a/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts b/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts
+index 221acd10f6c8..2f0d966f39ad 100644
+--- a/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts
++++ b/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts
+@@ -63,8 +63,6 @@
+ compatible = "gpio-keys-polled";
+ pinctrl-names = "default";
+ pinctrl-0 = <&key_pins_inet9f>;
+- #address-cells = <1>;
+- #size-cells = <0>;
+ poll-interval = <20>;
+
+ left-joystick-left {
+diff --git a/arch/arm/boot/dts/sun4i-a10-pcduino.dts b/arch/arm/boot/dts/sun4i-a10-pcduino.dts
+index b97a0f2f20b9..d82a604f3d9c 100644
+--- a/arch/arm/boot/dts/sun4i-a10-pcduino.dts
++++ b/arch/arm/boot/dts/sun4i-a10-pcduino.dts
+@@ -76,8 +76,6 @@
+
+ gpio-keys {
+ compatible = "gpio-keys";
+- #address-cells = <1>;
+- #size-cells = <0>;
+
+ back {
+ label = "Key Back";
+diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
+index 3d62a8950720..5d46bb0139fa 100644
+--- a/arch/arm/boot/dts/sun4i-a10.dtsi
++++ b/arch/arm/boot/dts/sun4i-a10.dtsi
+@@ -530,8 +530,6 @@
+ };
+
+ hdmi_out: port@1 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ reg = <1>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
+index 316cb8b2945b..a66d9f92f58f 100644
+--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
++++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
+@@ -104,8 +104,6 @@
+ };
+
+ hdmi_out: port@1 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ reg = <1>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
+index debc0bf22ea3..76924fa42bbc 100644
+--- a/arch/arm/boot/dts/sun6i-a31.dtsi
++++ b/arch/arm/boot/dts/sun6i-a31.dtsi
+@@ -201,7 +201,7 @@
+ };
+
+ pmu {
+- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu";
++ compatible = "arm,cortex-a7-pmu";
+ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
+diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
+index 9c52712af241..355619dce799 100644
+--- a/arch/arm/boot/dts/sun7i-a20.dtsi
++++ b/arch/arm/boot/dts/sun7i-a20.dtsi
+@@ -183,7 +183,7 @@
+ };
+
+ pmu {
+- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu";
++ compatible = "arm,cortex-a7-pmu";
+ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+ };
+@@ -639,8 +639,6 @@
+ };
+
+ hdmi_out: port@1 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ reg = <1>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/sun8i-h3.dtsi b/arch/arm/boot/dts/sun8i-h3.dtsi
+index f0096074a467..9233ba30a857 100644
+--- a/arch/arm/boot/dts/sun8i-h3.dtsi
++++ b/arch/arm/boot/dts/sun8i-h3.dtsi
+@@ -47,19 +47,19 @@
+ compatible = "operating-points-v2";
+ opp-shared;
+
+- opp@648000000 {
++ opp-648000000 {
+ opp-hz = /bits/ 64 <648000000>;
+ opp-microvolt = <1040000 1040000 1300000>;
+ clock-latency-ns = <244144>; /* 8 32k periods */
+ };
+
+- opp@816000000 {
++ opp-816000000 {
+ opp-hz = /bits/ 64 <816000000>;
+ opp-microvolt = <1100000 1100000 1300000>;
+ clock-latency-ns = <244144>; /* 8 32k periods */
+ };
+
+- opp@1008000000 {
++ opp-1008000000 {
+ opp-hz = /bits/ 64 <1008000000>;
+ opp-microvolt = <1200000 1200000 1300000>;
+ clock-latency-ns = <244144>; /* 8 32k periods */
+@@ -122,7 +122,7 @@
+ soc {
+ system-control@1c00000 {
+ compatible = "allwinner,sun8i-h3-system-control";
+- reg = <0x01c00000 0x30>;
++ reg = <0x01c00000 0x1000>;
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges;
+diff --git a/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts b/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts
+index 0dbdb29a8fff..ee7ce3752581 100644
+--- a/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts
++++ b/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts
+@@ -103,13 +103,13 @@
+ };
+
+ &cpu0_opp_table {
+- opp@1104000000 {
++ opp-1104000000 {
+ opp-hz = /bits/ 64 <1104000000>;
+ opp-microvolt = <1320000>;
+ clock-latency-ns = <244144>; /* 8 32k periods */
+ };
+
+- opp@1200000000 {
++ opp-1200000000 {
+ opp-hz = /bits/ 64 <1200000000>;
+ opp-microvolt = <1320000>;
+ clock-latency-ns = <244144>; /* 8 32k periods */
+diff --git a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts
+index 387fc2aa546d..333df90e8037 100644
+--- a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts
++++ b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts
+@@ -78,7 +78,7 @@
+ };
+
+ &mmc0 {
+- pinctrl-0 = <&mmc0_pins_a>;
++ pinctrl-0 = <&mmc0_pins>;
+ pinctrl-names = "default";
+ broken-cd;
+ bus-width = <4>;
+@@ -87,7 +87,7 @@
+ };
+
+ &uart0 {
+- pinctrl-0 = <&uart0_pins_a>;
++ pinctrl-0 = <&uart0_pb_pins>;
+ pinctrl-names = "default";
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi
+index 443b083c6adc..92fcb756a08a 100644
+--- a/arch/arm/boot/dts/sun8i-v3s.dtsi
++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi
+@@ -292,17 +292,17 @@
+ interrupt-controller;
+ #interrupt-cells = <3>;
+
+- i2c0_pins: i2c0 {
++ i2c0_pins: i2c0-pins {
+ pins = "PB6", "PB7";
+ function = "i2c0";
+ };
+
+- uart0_pins_a: uart0@0 {
++ uart0_pb_pins: uart0-pb-pins {
+ pins = "PB8", "PB9";
+ function = "uart0";
+ };
+
+- mmc0_pins_a: mmc0@0 {
++ mmc0_pins: mmc0-pins {
+ pins = "PF0", "PF1", "PF2", "PF3",
+ "PF4", "PF5";
+ function = "mmc0";
+@@ -310,7 +310,7 @@
+ bias-pull-up;
+ };
+
+- mmc1_pins: mmc1 {
++ mmc1_pins: mmc1-pins {
+ pins = "PG0", "PG1", "PG2", "PG3",
+ "PG4", "PG5";
+ function = "mmc1";
+@@ -318,7 +318,7 @@
+ bias-pull-up;
+ };
+
+- spi0_pins: spi0 {
++ spi0_pins: spi0-pins {
+ pins = "PC0", "PC1", "PC2", "PC3";
+ function = "spi0";
+ };
+diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
+index c136eef8f690..6390a40f16e7 100644
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -349,6 +349,13 @@ do { \
+ #define __get_user_asm_byte(x, addr, err) \
+ __get_user_asm(x, addr, err, ldrb)
+
++#if __LINUX_ARM_ARCH__ >= 6
++
++#define __get_user_asm_half(x, addr, err) \
++ __get_user_asm(x, addr, err, ldrh)
++
++#else
++
+ #ifndef __ARMEB__
+ #define __get_user_asm_half(x, __gu_addr, err) \
+ ({ \
+@@ -367,6 +374,8 @@ do { \
+ })
+ #endif
+
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ #define __get_user_asm_word(x, addr, err) \
+ __get_user_asm(x, addr, err, ldr)
+ #endif
+@@ -442,6 +451,13 @@ do { \
+ #define __put_user_asm_byte(x, __pu_addr, err) \
+ __put_user_asm(x, __pu_addr, err, strb)
+
++#if __LINUX_ARM_ARCH__ >= 6
++
++#define __put_user_asm_half(x, __pu_addr, err) \
++ __put_user_asm(x, __pu_addr, err, strh)
++
++#else
++
+ #ifndef __ARMEB__
+ #define __put_user_asm_half(x, __pu_addr, err) \
+ ({ \
+@@ -458,6 +474,8 @@ do { \
+ })
+ #endif
+
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ #define __put_user_asm_word(x, __pu_addr, err) \
+ __put_user_asm(x, __pu_addr, err, str)
+
+diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
+index 746e7801dcdf..b2e4bc3a635e 100644
+--- a/arch/arm/lib/getuser.S
++++ b/arch/arm/lib/getuser.S
+@@ -42,6 +42,12 @@ _ASM_NOKPROBE(__get_user_1)
+
+ ENTRY(__get_user_2)
+ check_uaccess r0, 2, r1, r2, __get_user_bad
++#if __LINUX_ARM_ARCH__ >= 6
++
++2: TUSER(ldrh) r2, [r0]
++
++#else
++
+ #ifdef CONFIG_CPU_USE_DOMAINS
+ rb .req ip
+ 2: ldrbt r2, [r0], #1
+@@ -56,6 +62,9 @@ rb .req r0
+ #else
+ orr r2, rb, r2, lsl #8
+ #endif
++
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ mov r0, #0
+ ret lr
+ ENDPROC(__get_user_2)
+@@ -145,7 +154,9 @@ _ASM_NOKPROBE(__get_user_bad8)
+ .pushsection __ex_table, "a"
+ .long 1b, __get_user_bad
+ .long 2b, __get_user_bad
++#if __LINUX_ARM_ARCH__ < 6
+ .long 3b, __get_user_bad
++#endif
+ .long 4b, __get_user_bad
+ .long 5b, __get_user_bad8
+ .long 6b, __get_user_bad8
+diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S
+index 38d660d3705f..515eeaa9975c 100644
+--- a/arch/arm/lib/putuser.S
++++ b/arch/arm/lib/putuser.S
+@@ -41,16 +41,13 @@ ENDPROC(__put_user_1)
+
+ ENTRY(__put_user_2)
+ check_uaccess r0, 2, r1, ip, __put_user_bad
+- mov ip, r2, lsr #8
+-#ifdef CONFIG_THUMB2_KERNEL
+-#ifndef __ARMEB__
+-2: TUSER(strb) r2, [r0]
+-3: TUSER(strb) ip, [r0, #1]
++#if __LINUX_ARM_ARCH__ >= 6
++
++2: TUSER(strh) r2, [r0]
++
+ #else
+-2: TUSER(strb) ip, [r0]
+-3: TUSER(strb) r2, [r0, #1]
+-#endif
+-#else /* !CONFIG_THUMB2_KERNEL */
++
++ mov ip, r2, lsr #8
+ #ifndef __ARMEB__
+ 2: TUSER(strb) r2, [r0], #1
+ 3: TUSER(strb) ip, [r0]
+@@ -58,7 +55,8 @@ ENTRY(__put_user_2)
+ 2: TUSER(strb) ip, [r0], #1
+ 3: TUSER(strb) r2, [r0]
+ #endif
+-#endif /* CONFIG_THUMB2_KERNEL */
++
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
+ mov r0, #0
+ ret lr
+ ENDPROC(__put_user_2)
+@@ -91,7 +89,9 @@ ENDPROC(__put_user_bad)
+ .pushsection __ex_table, "a"
+ .long 1b, __put_user_bad
+ .long 2b, __put_user_bad
++#if __LINUX_ARM_ARCH__ < 6
+ .long 3b, __put_user_bad
++#endif
+ .long 4b, __put_user_bad
+ .long 5b, __put_user_bad
+ .long 6b, __put_user_bad
+diff --git a/arch/arm/mach-omap1/id.c b/arch/arm/mach-omap1/id.c
+index 52de382fc804..7e49dfda3d2f 100644
+--- a/arch/arm/mach-omap1/id.c
++++ b/arch/arm/mach-omap1/id.c
+@@ -200,10 +200,10 @@ void __init omap_check_revision(void)
+ printk(KERN_INFO "Unknown OMAP cpu type: 0x%02x\n", cpu_type);
+ }
+
+- printk(KERN_INFO "OMAP%04x", omap_revision >> 16);
++ pr_info("OMAP%04x", omap_revision >> 16);
+ if ((omap_revision >> 8) & 0xff)
+- printk(KERN_INFO "%x", (omap_revision >> 8) & 0xff);
+- printk(KERN_INFO " revision %i handled as %02xxx id: %08x%08x\n",
++ pr_cont("%x", (omap_revision >> 8) & 0xff);
++ pr_cont(" revision %i handled as %02xxx id: %08x%08x\n",
+ die_rev, omap_revision & 0xff, system_serial_low,
+ system_serial_high);
+ }
+diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
+index 68ba5f472f6b..859c71c4e932 100644
+--- a/arch/arm/mach-omap2/id.c
++++ b/arch/arm/mach-omap2/id.c
+@@ -199,8 +199,8 @@ void __init omap2xxx_check_revision(void)
+
+ pr_info("%s", soc_name);
+ if ((omap_rev() >> 8) & 0x0f)
+- pr_info("%s", soc_rev);
+- pr_info("\n");
++ pr_cont("%s", soc_rev);
++ pr_cont("\n");
+ }
+
+ #define OMAP3_SHOW_FEATURE(feat) \
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+index cbe99bd4e06d..8cd50b75171d 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+@@ -191,7 +191,7 @@
+ pinctrl-names = "default";
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX", "UART RX", "Power Control", "Power Key In",
+ "VCCK En", "CON1 Header Pin31",
+ "I2S Header Pin6", "IR In", "I2S Header Pin7",
+@@ -201,7 +201,7 @@
+ "";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk",
+ "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2",
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+index 54954b314a45..00f7be6d83f7 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+@@ -187,7 +187,7 @@
+ pinctrl-names = "default";
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX", "UART RX", "VCCK En", "TF 3V3/1V8 En",
+ "USB HUB nRESET", "USB OTG Power En",
+ "J7 Header Pin2", "IR In", "J7 Header Pin4",
+@@ -197,7 +197,7 @@
+ "";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk",
+ "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2",
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+index d32cf3846370..864ef0111b01 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+@@ -112,7 +112,7 @@
+ linux,rc-map-name = "rc-geekbox";
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX",
+ "UART RX",
+ "Power Key In",
+@@ -127,7 +127,7 @@
+ "";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "", "", "", "", "", "", "",
+ "", "", "", "", "", "", "",
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+index 90a56af967a7..b4dfb9afdef8 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+@@ -163,7 +163,7 @@
+ };
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX",
+ "UART RX",
+ "Blue LED",
+@@ -178,7 +178,7 @@
+ "7J1 Header Pin15";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "", "", "", "", "", "", "",
+ "", "", "", "", "", "", "",
+diff --git a/arch/arm64/boot/dts/exynos/exynos5433.dtsi b/arch/arm64/boot/dts/exynos/exynos5433.dtsi
+index 2131f12364cb..6e20415b061e 100644
+--- a/arch/arm64/boot/dts/exynos/exynos5433.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos5433.dtsi
+@@ -18,8 +18,8 @@
+
+ / {
+ compatible = "samsung,exynos5433";
+- #address-cells = <1>;
+- #size-cells = <1>;
++ #address-cells = <2>;
++ #size-cells = <2>;
+
+ interrupt-parent = <&gic>;
+
+@@ -235,7 +235,7 @@
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+- ranges;
++ ranges = <0x0 0x0 0x0 0x18000000>;
+
+ arm_a53_pmu {
+ compatible = "arm,cortex-a53-pmu", "arm,armv8-pmuv3";
+diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+index 75ad724c487e..31b1a606cb66 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+@@ -12,8 +12,8 @@
+ / {
+ compatible = "samsung,exynos7";
+ interrupt-parent = <&gic>;
+- #address-cells = <1>;
+- #size-cells = <1>;
++ #address-cells = <2>;
++ #size-cells = <2>;
+
+ aliases {
+ pinctrl0 = &pinctrl_alive;
+@@ -70,7 +70,7 @@
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+- ranges;
++ ranges = <0 0 0 0x18000000>;
+
+ chipid@10000000 {
+ compatible = "samsung,exynos4210-chipid";
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
+index 9d5a0e6b2ca4..68af663757d0 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi
+@@ -1589,7 +1589,7 @@
+ regulator-name = "VDD_HDMI_5V0";
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+- gpio = <&exp1 12 GPIO_ACTIVE_LOW>;
++ gpio = <&exp1 12 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+ vin-supply = <&vdd_5v0_sys>;
+ };
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi
+index 9c09baca7dd7..306ad2157c98 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi
+@@ -58,13 +58,13 @@
+ clock-accuracy = <100>;
+ };
+
+- dpdma_clk: dpdma_clk {
++ dpdma_clk: dpdma-clk {
+ compatible = "fixed-clock";
+ #clock-cells = <0x0>;
+ clock-frequency = <533000000>;
+ };
+
+- drm_clock: drm_clock {
++ drm_clock: drm-clock {
+ compatible = "fixed-clock";
+ #clock-cells = <0x0>;
+ clock-frequency = <262750000>;
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts
+index 8954c8c6f547..14062b4535dd 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts
+@@ -82,7 +82,7 @@
+ linux,default-trigger = "bluetooth-power";
+ };
+
+- vbus_det { /* U5 USB5744 VBUS detection via MIO25 */
++ vbus-det { /* U5 USB5744 VBUS detection via MIO25 */
+ label = "vbus_det";
+ gpios = <&gpio 25 GPIO_ACTIVE_HIGH>;
+ default-state = "on";
+@@ -98,7 +98,7 @@
+ regulator-boot-on;
+ };
+
+- sdio_pwrseq: sdio_pwrseq {
++ sdio_pwrseq: sdio-pwrseq {
+ compatible = "mmc-pwrseq-simple";
+ reset-gpios = <&gpio 7 GPIO_ACTIVE_LOW>; /* WIFI_EN */
+ post-power-on-delay-ms = <10>;
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts
+index 25dd57485323..d3b8e1a9c076 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts
+@@ -53,7 +53,7 @@
+
+ leds {
+ compatible = "gpio-leds";
+- heartbeat_led {
++ heartbeat-led {
+ label = "heartbeat";
+ gpios = <&gpio 23 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+@@ -139,25 +139,25 @@
+ * 7, 10 - 17 - not connected
+ */
+
+- gtr_sel0 {
++ gtr-sel0 {
+ gpio-hog;
+ gpios = <0 0>;
+ output-low; /* PCIE = 0, DP = 1 */
+ line-name = "sel0";
+ };
+- gtr_sel1 {
++ gtr-sel1 {
+ gpio-hog;
+ gpios = <1 0>;
+ output-high; /* PCIE = 0, DP = 1 */
+ line-name = "sel1";
+ };
+- gtr_sel2 {
++ gtr-sel2 {
+ gpio-hog;
+ gpios = <2 0>;
+ output-high; /* PCIE = 0, USB0 = 1 */
+ line-name = "sel2";
+ };
+- gtr_sel3 {
++ gtr-sel3 {
+ gpio-hog;
+ gpios = <3 0>;
+ output-high; /* PCIE = 0, SATA = 1 */
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+index 259f21b0c001..28dee4dad82c 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+@@ -53,7 +53,7 @@
+
+ leds {
+ compatible = "gpio-leds";
+- heartbeat_led {
++ heartbeat-led {
+ label = "heartbeat";
+ gpios = <&gpio 23 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts
+index a61b3cc6f4c9..47b5989035e4 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts
+@@ -53,7 +53,7 @@
+
+ leds {
+ compatible = "gpio-leds";
+- heartbeat_led {
++ heartbeat-led {
+ label = "heartbeat";
+ gpios = <&gpio 23 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index 29ce23422acf..a516c0e01429 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -71,7 +71,7 @@
+ };
+ };
+
+- cpu_opp_table: cpu_opp_table {
++ cpu_opp_table: cpu-opp-table {
+ compatible = "operating-points-v2";
+ opp-shared;
+ opp00 {
+@@ -124,7 +124,7 @@
+ <1 10 0xf08>;
+ };
+
+- amba_apu: amba_apu@0 {
++ amba_apu: amba-apu@0 {
+ compatible = "simple-bus";
+ #address-cells = <2>;
+ #size-cells = <1>;
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 201caf226b47..a830a9701e50 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -806,6 +806,7 @@ config SIBYTE_LITTLESUR
+ select SYS_SUPPORTS_BIG_ENDIAN
+ select SYS_SUPPORTS_HIGHMEM
+ select SYS_SUPPORTS_LITTLE_ENDIAN
++ select ZONE_DMA32 if 64BIT
+
+ config SIBYTE_SENTOSA
+ bool "Sibyte BCM91250E-Sentosa"
+diff --git a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
+index 8241fc6aa17d..3839feba68f2 100644
+--- a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
++++ b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
+@@ -266,7 +266,7 @@ int cvmx_cmd_queue_length(cvmx_cmd_queue_id_t queue_id)
+ } else {
+ union cvmx_pko_mem_debug8 debug8;
+ debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8);
+- return debug8.cn58xx.doorbell;
++ return debug8.cn50xx.doorbell;
+ }
+ case CVMX_CMD_QUEUE_ZIP:
+ case CVMX_CMD_QUEUE_DFA:
+diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
+index 807cadaf554e..5ba181e87d2c 100644
+--- a/arch/mips/cavium-octeon/octeon-platform.c
++++ b/arch/mips/cavium-octeon/octeon-platform.c
+@@ -501,7 +501,7 @@ static void __init octeon_fdt_set_phy(int eth, int phy_addr)
+ if (phy_addr >= 256 && alt_phy > 0) {
+ const struct fdt_property *phy_prop;
+ struct fdt_property *alt_prop;
+- u32 phy_handle_name;
++ fdt32_t phy_handle_name;
+
+ /* Use the alt phy node instead.*/
+ phy_prop = fdt_get_property(initial_boot_params, eth, "phy-handle", NULL);
+diff --git a/arch/mips/include/asm/octeon/cvmx-pko.h b/arch/mips/include/asm/octeon/cvmx-pko.h
+index 5f47f76ed510..20eb9c46a75a 100644
+--- a/arch/mips/include/asm/octeon/cvmx-pko.h
++++ b/arch/mips/include/asm/octeon/cvmx-pko.h
+@@ -611,7 +611,7 @@ static inline void cvmx_pko_get_port_status(uint64_t port_num, uint64_t clear,
+ pko_reg_read_idx.s.index = cvmx_pko_get_base_queue(port_num);
+ cvmx_write_csr(CVMX_PKO_REG_READ_IDX, pko_reg_read_idx.u64);
+ debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8);
+- status->doorbell = debug8.cn58xx.doorbell;
++ status->doorbell = debug8.cn50xx.doorbell;
+ }
+ }
+
+diff --git a/arch/nds32/kernel/setup.c b/arch/nds32/kernel/setup.c
+index 63a1a5ef5219..87683583f206 100644
+--- a/arch/nds32/kernel/setup.c
++++ b/arch/nds32/kernel/setup.c
+@@ -71,8 +71,9 @@ static const char *hwcap_str[] = {
+ "div",
+ "mac",
+ "l2c",
+- "dx_regs",
++ "fpu_dp",
+ "v2",
++ "dx_regs",
+ NULL,
+ };
+
+diff --git a/arch/powerpc/include/asm/sfp-machine.h b/arch/powerpc/include/asm/sfp-machine.h
+index d89beaba26ff..8b957aabb826 100644
+--- a/arch/powerpc/include/asm/sfp-machine.h
++++ b/arch/powerpc/include/asm/sfp-machine.h
+@@ -213,30 +213,18 @@
+ * respectively. The result is placed in HIGH_SUM and LOW_SUM. Overflow
+ * (i.e. carry out) is not stored anywhere, and is lost.
+ */
+-#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
++#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+ do { \
+ if (__builtin_constant_p (bh) && (bh) == 0) \
+- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
+- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \
+- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
++ __asm__ ("add%I4c %1,%3,%4\n\taddze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \
++ __asm__ ("add%I4c %1,%3,%4\n\taddme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
+ else \
+- __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "r" ((USItype)(bh)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
++ __asm__ ("add%I5c %1,%4,%5\n\tadde %0,%2,%3" \
++ : "=r" (sh), "=&r" (sl) \
++ : "%r" (ah), "r" (bh), "%r" (al), "rI" (bl)); \
+ } while (0)
+
+ /* sub_ddmmss is used in op-2.h and udivmodti4.c and should be equivalent to
+@@ -248,44 +236,24 @@
+ * and LOW_DIFFERENCE. Overflow (i.e. carry out) is not stored anywhere,
+ * and is lost.
+ */
+-#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
++#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+ do { \
+ if (__builtin_constant_p (ah) && (ah) == 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
+- else if (__builtin_constant_p (ah) && (ah) ==~(USItype) 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
++ else if (__builtin_constant_p (ah) && (ah) == ~(USItype) 0) \
++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
+ else if (__builtin_constant_p (bh) && (bh) == 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
+- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I3c %1,%4,%3\n\taddme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \
++ __asm__ ("subf%I3c %1,%4,%3\n\taddze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
+ else \
+- __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I4c %1,%5,%4\n\tsubfe %0,%3,%2" \
++ : "=r" (sh), "=&r" (sl) \
++ : "r" (ah), "r" (bh), "rI" (al), "r" (bl)); \
+ } while (0)
+
+ /* asm fragments for mul and div */
+@@ -294,13 +262,10 @@
+ * UWtype integers MULTIPLER and MULTIPLICAND, and generates a two UWtype
+ * word product in HIGH_PROD and LOW_PROD.
+ */
+-#define umul_ppmm(ph, pl, m0, m1) \
++#define umul_ppmm(ph, pl, m0, m1) \
+ do { \
+ USItype __m0 = (m0), __m1 = (m1); \
+- __asm__ ("mulhwu %0,%1,%2" \
+- : "=r" ((USItype)(ph)) \
+- : "%r" (__m0), \
+- "r" (__m1)); \
++ __asm__ ("mulhwu %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1)); \
+ (pl) = __m0 * __m1; \
+ } while (0)
+
+@@ -312,9 +277,10 @@
+ * significant bit of DENOMINATOR must be 1, then the pre-processor symbol
+ * UDIV_NEEDS_NORMALIZATION is defined to 1.
+ */
+-#define udiv_qrnnd(q, r, n1, n0, d) \
++#define udiv_qrnnd(q, r, n1, n0, d) \
+ do { \
+- UWtype __d1, __d0, __q1, __q0, __r1, __r0, __m; \
++ UWtype __d1, __d0, __q1, __q0; \
++ UWtype __r1, __r0, __m; \
+ __d1 = __ll_highpart (d); \
+ __d0 = __ll_lowpart (d); \
+ \
+@@ -325,7 +291,7 @@
+ if (__r1 < __m) \
+ { \
+ __q1--, __r1 += (d); \
+- if (__r1 >= (d)) /* we didn't get carry when adding to __r1 */ \
++ if (__r1 >= (d)) /* i.e. we didn't get carry when adding to __r1 */\
+ if (__r1 < __m) \
+ __q1--, __r1 += (d); \
+ } \
+diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h
+index b162c23ae8c2..7a836d21ff0c 100644
+--- a/arch/sparc/include/asm/io_64.h
++++ b/arch/sparc/include/asm/io_64.h
+@@ -409,6 +409,7 @@ static inline void __iomem *ioremap(unsigned long offset, unsigned long size)
+ }
+
+ #define ioremap_nocache(X,Y) ioremap((X),(Y))
++#define ioremap_uc(X,Y) ioremap((X),(Y))
+ #define ioremap_wc(X,Y) ioremap((X),(Y))
+ #define ioremap_wt(X,Y) ioremap((X),(Y))
+
+diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c
+index 222785af550b..ec4da4dc98f1 100644
+--- a/arch/sparc/net/bpf_jit_comp_64.c
++++ b/arch/sparc/net/bpf_jit_comp_64.c
+@@ -1270,6 +1270,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp2 = bpf2sparc[TMP_REG_2];
+ u32 opcode = 0, rs2;
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ ctx->tmp_2_used = true;
+ emit_loadimm(imm, tmp2, ctx);
+
+@@ -1308,6 +1311,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp = bpf2sparc[TMP_REG_1];
+ u32 opcode = 0, rs2;
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ switch (BPF_SIZE(code)) {
+ case BPF_W:
+ opcode = ST32;
+@@ -1340,6 +1346,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp2 = bpf2sparc[TMP_REG_2];
+ const u8 tmp3 = bpf2sparc[TMP_REG_3];
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ ctx->tmp_1_used = true;
+ ctx->tmp_2_used = true;
+ ctx->tmp_3_used = true;
+@@ -1360,6 +1369,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp2 = bpf2sparc[TMP_REG_2];
+ const u8 tmp3 = bpf2sparc[TMP_REG_3];
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ ctx->tmp_1_used = true;
+ ctx->tmp_2_used = true;
+ ctx->tmp_3_used = true;
+@@ -1425,12 +1437,12 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+ struct bpf_prog *tmp, *orig_prog = prog;
+ struct sparc64_jit_data *jit_data;
+ struct bpf_binary_header *header;
++ u32 prev_image_size, image_size;
+ bool tmp_blinded = false;
+ bool extra_pass = false;
+ struct jit_ctx ctx;
+- u32 image_size;
+ u8 *image_ptr;
+- int pass;
++ int pass, i;
+
+ if (!prog->jit_requested)
+ return orig_prog;
+@@ -1461,61 +1473,82 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+ header = jit_data->header;
+ extra_pass = true;
+ image_size = sizeof(u32) * ctx.idx;
++ prev_image_size = image_size;
++ pass = 1;
+ goto skip_init_ctx;
+ }
+
+ memset(&ctx, 0, sizeof(ctx));
+ ctx.prog = prog;
+
+- ctx.offset = kcalloc(prog->len, sizeof(unsigned int), GFP_KERNEL);
++ ctx.offset = kmalloc_array(prog->len, sizeof(unsigned int), GFP_KERNEL);
+ if (ctx.offset == NULL) {
+ prog = orig_prog;
+ goto out_off;
+ }
+
+- /* Fake pass to detect features used, and get an accurate assessment
+- * of what the final image size will be.
++ /* Longest sequence emitted is for bswap32, 12 instructions. Pre-cook
++ * the offset array so that we converge faster.
+ */
+- if (build_body(&ctx)) {
+- prog = orig_prog;
+- goto out_off;
+- }
+- build_prologue(&ctx);
+- build_epilogue(&ctx);
++ for (i = 0; i < prog->len; i++)
++ ctx.offset[i] = i * (12 * 4);
+
+- /* Now we know the actual image size. */
+- image_size = sizeof(u32) * ctx.idx;
+- header = bpf_jit_binary_alloc(image_size, &image_ptr,
+- sizeof(u32), jit_fill_hole);
+- if (header == NULL) {
+- prog = orig_prog;
+- goto out_off;
+- }
+-
+- ctx.image = (u32 *)image_ptr;
+-skip_init_ctx:
+- for (pass = 1; pass < 3; pass++) {
++ prev_image_size = ~0U;
++ for (pass = 1; pass < 40; pass++) {
+ ctx.idx = 0;
+
+ build_prologue(&ctx);
+-
+ if (build_body(&ctx)) {
+- bpf_jit_binary_free(header);
+ prog = orig_prog;
+ goto out_off;
+ }
+-
+ build_epilogue(&ctx);
+
+ if (bpf_jit_enable > 1)
+- pr_info("Pass %d: shrink = %d, seen = [%c%c%c%c%c%c]\n", pass,
+- image_size - (ctx.idx * 4),
++ pr_info("Pass %d: size = %u, seen = [%c%c%c%c%c%c]\n", pass,
++ ctx.idx * 4,
+ ctx.tmp_1_used ? '1' : ' ',
+ ctx.tmp_2_used ? '2' : ' ',
+ ctx.tmp_3_used ? '3' : ' ',
+ ctx.saw_frame_pointer ? 'F' : ' ',
+ ctx.saw_call ? 'C' : ' ',
+ ctx.saw_tail_call ? 'T' : ' ');
++
++ if (ctx.idx * 4 == prev_image_size)
++ break;
++ prev_image_size = ctx.idx * 4;
++ cond_resched();
++ }
++
++ /* Now we know the actual image size. */
++ image_size = sizeof(u32) * ctx.idx;
++ header = bpf_jit_binary_alloc(image_size, &image_ptr,
++ sizeof(u32), jit_fill_hole);
++ if (header == NULL) {
++ prog = orig_prog;
++ goto out_off;
++ }
++
++ ctx.image = (u32 *)image_ptr;
++skip_init_ctx:
++ ctx.idx = 0;
++
++ build_prologue(&ctx);
++
++ if (build_body(&ctx)) {
++ bpf_jit_binary_free(header);
++ prog = orig_prog;
++ goto out_off;
++ }
++
++ build_epilogue(&ctx);
++
++ if (ctx.idx * 4 != prev_image_size) {
++ pr_err("bpf_jit: Failed to converge, prev_size=%u size=%d\n",
++ prev_image_size, ctx.idx * 4);
++ bpf_jit_binary_free(header);
++ prog = orig_prog;
++ goto out_off;
+ }
+
+ if (bpf_jit_enable > 1)
+diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
+index 970e261ef3e8..48c24d0e9e75 100644
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -420,7 +420,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+
+ r = -E2BIG;
+
+- if (*nent >= maxnent)
++ if (WARN_ON(*nent >= maxnent))
+ goto out;
+
+ do_cpuid_1_ent(entry, function, index);
+@@ -729,6 +729,9 @@ out:
+ static int do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 func,
+ u32 idx, int *nent, int maxnent, unsigned int type)
+ {
++ if (*nent >= maxnent)
++ return -E2BIG;
++
+ if (type == KVM_GET_EMULATED_CPUID)
+ return __do_cpuid_ent_emulated(entry, func, idx, nent, maxnent);
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 6cf8af022b21..353f63f3b262 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -290,13 +290,14 @@ int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask)
+ struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu);
+ int err;
+
+- if (((value ^ smsr->values[slot].curr) & mask) == 0)
++ value = (value & mask) | (smsr->values[slot].host & ~mask);
++ if (value == smsr->values[slot].curr)
+ return 0;
+- smsr->values[slot].curr = value;
+ err = wrmsrl_safe(shared_msrs_global.msrs[slot], value);
+ if (err)
+ return 1;
+
++ smsr->values[slot].curr = value;
+ if (!smsr->registered) {
+ smsr->urn.on_user_return = kvm_on_user_return;
+ user_return_notifier_register(&smsr->urn);
+@@ -1173,10 +1174,15 @@ u64 kvm_get_arch_capabilities(void)
+ * If TSX is disabled on the system, guests are also mitigated against
+ * TAA and clear CPU buffer mitigation is not required for guests.
+ */
+- if (boot_cpu_has_bug(X86_BUG_TAA) && boot_cpu_has(X86_FEATURE_RTM) &&
+- (data & ARCH_CAP_TSX_CTRL_MSR))
++ if (!boot_cpu_has(X86_FEATURE_RTM))
++ data &= ~ARCH_CAP_TAA_NO;
++ else if (!boot_cpu_has_bug(X86_BUG_TAA))
++ data |= ARCH_CAP_TAA_NO;
++ else if (data & ARCH_CAP_TSX_CTRL_MSR)
+ data &= ~ARCH_CAP_MDS_NO;
+
++ /* KVM does not emulate MSR_IA32_TSX_CTRL. */
++ data &= ~ARCH_CAP_TSX_CTRL_MSR;
+ return data;
+ }
+
+@@ -4111,6 +4117,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
+ case KVM_SET_NESTED_STATE: {
+ struct kvm_nested_state __user *user_kvm_nested_state = argp;
+ struct kvm_nested_state kvm_state;
++ int idx;
+
+ r = -EINVAL;
+ if (!kvm_x86_ops->set_nested_state)
+@@ -4132,7 +4139,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
+ if (kvm_state.flags == KVM_STATE_NESTED_RUN_PENDING)
+ break;
+
++ idx = srcu_read_lock(&vcpu->kvm->srcu);
+ r = kvm_x86_ops->set_nested_state(vcpu, user_kvm_nested_state, &kvm_state);
++ srcu_read_unlock(&vcpu->kvm->srcu, idx);
+ break;
+ }
+ default:
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 1bcb7242ad79..72e6fa1a913c 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -281,7 +281,7 @@ void vmalloc_sync_all(void)
+ return;
+
+ for (address = VMALLOC_START & PMD_MASK;
+- address >= TASK_SIZE_MAX && address < FIXADDR_TOP;
++ address >= TASK_SIZE_MAX && address < VMALLOC_END;
+ address += PMD_SIZE) {
+ struct page *page;
+
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index 527e69b12002..e723559c386a 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -588,6 +588,17 @@ static void pci_fixup_amd_ehci_pme(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x7808, pci_fixup_amd_ehci_pme);
+
++/*
++ * Device [1022:7914]
++ * When in D0, PME# doesn't get asserted when plugging USB 2.0 device.
++ */
++static void pci_fixup_amd_fch_xhci_pme(struct pci_dev *dev)
++{
++ dev_info(&dev->dev, "PME# does not work under D0, disabling it\n");
++ dev->pme_support &= ~(PCI_PM_CAP_PME_D0 >> PCI_PM_CAP_PME_SHIFT);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x7914, pci_fixup_amd_fch_xhci_pme);
++
+ /*
+ * Apple MacBook Pro: Avoid [mem 0x7fa00000-0x7fbfffff]
+ *
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index ec78a04eb136..ed643ce12278 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -1058,7 +1058,7 @@ void af_alg_async_cb(struct crypto_async_request *_req, int err)
+ af_alg_free_resources(areq);
+ sock_put(sk);
+
+- iocb->ki_complete(iocb, err ? err : resultlen, 0);
++ iocb->ki_complete(iocb, err ? err : (int)resultlen, 0);
+ }
+ EXPORT_SYMBOL_GPL(af_alg_async_cb);
+
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index 74cb166097cd..f847c181a39c 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -288,8 +288,10 @@ static int crypto_report(struct sk_buff *in_skb, struct nlmsghdr *in_nlh,
+ drop_alg:
+ crypto_mod_put(alg);
+
+- if (err)
++ if (err) {
++ kfree_skb(skb);
+ return err;
++ }
+
+ return nlmsg_unicast(crypto_nlsk, skb, NETLINK_CB(in_skb).portid);
+ }
+diff --git a/crypto/ecc.c b/crypto/ecc.c
+index adcce310f646..ad739255951f 100644
+--- a/crypto/ecc.c
++++ b/crypto/ecc.c
+@@ -906,36 +906,50 @@ static void ecc_point_mult(struct ecc_point *result,
+ static inline void ecc_swap_digits(const u64 *in, u64 *out,
+ unsigned int ndigits)
+ {
++ const __be64 *src = (__force __be64 *)in;
+ int i;
+
+ for (i = 0; i < ndigits; i++)
+- out[i] = __swab64(in[ndigits - 1 - i]);
++ out[i] = be64_to_cpu(src[ndigits - 1 - i]);
+ }
+
+-int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits,
+- const u64 *private_key, unsigned int private_key_len)
++static int __ecc_is_key_valid(const struct ecc_curve *curve,
++ const u64 *private_key, unsigned int ndigits)
+ {
+- int nbytes;
+- const struct ecc_curve *curve = ecc_get_curve(curve_id);
++ u64 one[ECC_MAX_DIGITS] = { 1, };
++ u64 res[ECC_MAX_DIGITS];
+
+ if (!private_key)
+ return -EINVAL;
+
+- nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+-
+- if (private_key_len != nbytes)
++ if (curve->g.ndigits != ndigits)
+ return -EINVAL;
+
+- if (vli_is_zero(private_key, ndigits))
++ /* Make sure the private key is in the range [2, n-3]. */
++ if (vli_cmp(one, private_key, ndigits) != -1)
+ return -EINVAL;
+-
+- /* Make sure the private key is in the range [1, n-1]. */
+- if (vli_cmp(curve->n, private_key, ndigits) != 1)
++ vli_sub(res, curve->n, one, ndigits);
++ vli_sub(res, res, one, ndigits);
++ if (vli_cmp(res, private_key, ndigits) != 1)
+ return -EINVAL;
+
+ return 0;
+ }
+
++int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits,
++ const u64 *private_key, unsigned int private_key_len)
++{
++ int nbytes;
++ const struct ecc_curve *curve = ecc_get_curve(curve_id);
++
++ nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
++
++ if (private_key_len != nbytes)
++ return -EINVAL;
++
++ return __ecc_is_key_valid(curve, private_key, ndigits);
++}
++
+ /*
+ * ECC private keys are generated using the method of extra random bits,
+ * equivalent to that described in FIPS 186-4, Appendix B.4.1.
+@@ -979,11 +993,8 @@ int ecc_gen_privkey(unsigned int curve_id, unsigned int ndigits, u64 *privkey)
+ if (err)
+ return err;
+
+- if (vli_is_zero(priv, ndigits))
+- return -EINVAL;
+-
+- /* Make sure the private key is in the range [1, n-1]. */
+- if (vli_cmp(curve->n, priv, ndigits) != 1)
++ /* Make sure the private key is in the valid range. */
++ if (__ecc_is_key_valid(curve, priv, ndigits))
+ return -EINVAL;
+
+ ecc_swap_digits(priv, privkey, ndigits);
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index a654ccfd1a22..c3fdd79c4082 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -295,8 +295,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
+ return 0;
+
+ free_range:
+- for (page_addr = end - PAGE_SIZE; page_addr >= start;
+- page_addr -= PAGE_SIZE) {
++ for (page_addr = end - PAGE_SIZE; 1; page_addr -= PAGE_SIZE) {
+ bool ret;
+ size_t index;
+
+@@ -309,6 +308,8 @@ free_range:
+ WARN_ON(!ret);
+
+ trace_binder_free_lru_end(alloc, index);
++ if (page_addr == start)
++ break;
+ continue;
+
+ err_vm_insert_page_failed:
+@@ -318,7 +319,8 @@ err_map_kernel_failed:
+ page->page_ptr = NULL;
+ err_alloc_page_failed:
+ err_page_ptr_cleared:
+- ;
++ if (page_addr == start)
++ break;
+ }
+ err_no_vma:
+ if (mm) {
+@@ -880,14 +882,20 @@ void binder_alloc_print_pages(struct seq_file *m,
+ int free = 0;
+
+ mutex_lock(&alloc->mutex);
+- for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
+- page = &alloc->pages[i];
+- if (!page->page_ptr)
+- free++;
+- else if (list_empty(&page->lru))
+- active++;
+- else
+- lru++;
++ /*
++ * Make sure the binder_alloc is fully initialized, otherwise we might
++ * read inconsistent state.
++ */
++ if (binder_alloc_get_vma(alloc) != NULL) {
++ for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
++ page = &alloc->pages[i];
++ if (!page->page_ptr)
++ free++;
++ else if (list_empty(&page->lru))
++ active++;
++ else
++ lru++;
++ }
+ }
+ mutex_unlock(&alloc->mutex);
+ seq_printf(m, " pages: %d:%d:%d\n", active, lru, free);
+diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
+index f2c631ce793c..14056dc45064 100644
+--- a/drivers/block/rsxx/core.c
++++ b/drivers/block/rsxx/core.c
+@@ -1014,8 +1014,10 @@ static void rsxx_pci_remove(struct pci_dev *dev)
+
+ cancel_work_sync(&card->event_work);
+
++ destroy_workqueue(card->event_wq);
+ rsxx_destroy_dev(card);
+ rsxx_dma_destroy(card);
++ destroy_workqueue(card->creg_ctrl.creg_wq);
+
+ spin_lock_irqsave(&card->irq_lock, flags);
+ rsxx_disable_ier_and_isr(card, CR_INTR_ALL);
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 5b31131d0cba..b6f63e762021 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -217,8 +217,13 @@ static int sysc_get_clocks(struct sysc *ddata)
+ if (!ddata->clocks)
+ return -ENOMEM;
+
+- for (i = 0; i < ddata->nr_clocks; i++) {
+- error = sysc_get_one_clock(ddata, ddata->clock_roles[i]);
++ for (i = 0; i < SYSC_MAX_CLOCKS; i++) {
++ const char *name = ddata->clock_roles[i];
++
++ if (!name)
++ continue;
++
++ error = sysc_get_one_clock(ddata, name);
+ if (error && error != -ENOENT)
+ return error;
+ }
+diff --git a/drivers/char/lp.c b/drivers/char/lp.c
+index 8c4dd1a3bb6a..767740d758dd 100644
+--- a/drivers/char/lp.c
++++ b/drivers/char/lp.c
+@@ -708,6 +708,10 @@ static int lp_set_timeout64(unsigned int minor, void __user *arg)
+ if (copy_from_user(karg, arg, sizeof(karg)))
+ return -EFAULT;
+
++ /* sparc64 suseconds_t is 32-bit only */
++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall())
++ karg[1] >>= 32;
++
+ return lp_set_timeout(minor, karg[0], karg[1]);
+ }
+
+diff --git a/drivers/clk/mediatek/clk-cpumux.c b/drivers/clk/mediatek/clk-cpumux.c
+index 16e56772d280..6c7eaa21e662 100644
+--- a/drivers/clk/mediatek/clk-cpumux.c
++++ b/drivers/clk/mediatek/clk-cpumux.c
+@@ -53,7 +53,7 @@ static const struct clk_ops clk_cpumux_ops = {
+ .set_parent = clk_cpumux_set_parent,
+ };
+
+-static struct clk __init *
++static struct clk *
+ mtk_clk_register_cpumux(const struct mtk_composite *mux,
+ struct regmap *regmap)
+ {
+@@ -84,9 +84,9 @@ mtk_clk_register_cpumux(const struct mtk_composite *mux,
+ return clk;
+ }
+
+-int __init mtk_clk_register_cpumuxes(struct device_node *node,
+- const struct mtk_composite *clks, int num,
+- struct clk_onecell_data *clk_data)
++int mtk_clk_register_cpumuxes(struct device_node *node,
++ const struct mtk_composite *clks, int num,
++ struct clk_onecell_data *clk_data)
+ {
+ int i;
+ struct clk *clk;
+diff --git a/drivers/clk/mediatek/clk-mt7622.c b/drivers/clk/mediatek/clk-mt7622.c
+index 92f7e32770c6..a8aecef1ba89 100644
+--- a/drivers/clk/mediatek/clk-mt7622.c
++++ b/drivers/clk/mediatek/clk-mt7622.c
+@@ -513,7 +513,7 @@ static const struct mtk_gate peri_clks[] = {
+ GATE_PERI1(CLK_PERI_IRTX_PD, "peri_irtx_pd", "irtx_sel", 2),
+ };
+
+-static struct mtk_composite infra_muxes[] __initdata = {
++static struct mtk_composite infra_muxes[] = {
+ MUX(CLK_INFRA_MUX1_SEL, "infra_mux1_sel", infra_mux1_parents,
+ 0x000, 2, 2),
+ };
+@@ -652,7 +652,7 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ return of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+ }
+
+-static int __init mtk_infrasys_init(struct platform_device *pdev)
++static int mtk_infrasys_init(struct platform_device *pdev)
+ {
+ struct device_node *node = pdev->dev.of_node;
+ struct clk_onecell_data *clk_data;
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index d94b65061b9f..b039909e03cf 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -295,6 +295,12 @@ static struct clk_regmap gxl_hdmi_pll = {
+ .shift = 9,
+ .width = 5,
+ },
++ /*
++ * On gxl, there is a register shift due to
++ * HHI_HDMI_PLL_CNTL1 which does not exist on gxbb,
++ * so we use the HHI_HDMI_PLL_CNTL2 define from GXBB
++ * instead which is defined at the same offset.
++ */
+ .frac = {
+ /*
+ * On gxl, there is a register shift due to
+@@ -304,7 +310,7 @@ static struct clk_regmap gxl_hdmi_pll = {
+ */
+ .reg_off = HHI_HDMI_PLL_CNTL + 4,
+ .shift = 0,
+- .width = 12,
++ .width = 10,
+ },
+ .od = {
+ .reg_off = HHI_HDMI_PLL_CNTL + 8,
+diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
+index 9d79ff857d83..e90af556ff90 100644
+--- a/drivers/clk/meson/meson8b.c
++++ b/drivers/clk/meson/meson8b.c
+@@ -144,7 +144,7 @@ static struct clk_regmap meson8b_vid_pll = {
+ },
+ .n = {
+ .reg_off = HHI_VID_PLL_CNTL,
+- .shift = 9,
++ .shift = 10,
+ .width = 5,
+ },
+ .od = {
+diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
+index cd937ce6aaaf..4e23973b6cd1 100644
+--- a/drivers/clk/qcom/gcc-msm8998.c
++++ b/drivers/clk/qcom/gcc-msm8998.c
+@@ -2402,7 +2402,7 @@ static struct clk_branch gcc_ufs_phy_aux_clk = {
+
+ static struct clk_branch gcc_ufs_rx_symbol_0_clk = {
+ .halt_reg = 0x75014,
+- .halt_check = BRANCH_HALT,
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x75014,
+ .enable_mask = BIT(0),
+@@ -2415,7 +2415,7 @@ static struct clk_branch gcc_ufs_rx_symbol_0_clk = {
+
+ static struct clk_branch gcc_ufs_rx_symbol_1_clk = {
+ .halt_reg = 0x7605c,
+- .halt_check = BRANCH_HALT,
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x7605c,
+ .enable_mask = BIT(0),
+@@ -2428,7 +2428,7 @@ static struct clk_branch gcc_ufs_rx_symbol_1_clk = {
+
+ static struct clk_branch gcc_ufs_tx_symbol_0_clk = {
+ .halt_reg = 0x75010,
+- .halt_check = BRANCH_HALT,
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x75010,
+ .enable_mask = BIT(0),
+@@ -2743,25 +2743,25 @@ static struct gdsc *gcc_msm8998_gdscs[] = {
+ };
+
+ static const struct qcom_reset_map gcc_msm8998_resets[] = {
+- [GCC_BLSP1_QUP1_BCR] = { 0x102400 },
+- [GCC_BLSP1_QUP2_BCR] = { 0x110592 },
+- [GCC_BLSP1_QUP3_BCR] = { 0x118784 },
+- [GCC_BLSP1_QUP4_BCR] = { 0x126976 },
+- [GCC_BLSP1_QUP5_BCR] = { 0x135168 },
+- [GCC_BLSP1_QUP6_BCR] = { 0x143360 },
+- [GCC_BLSP2_QUP1_BCR] = { 0x155648 },
+- [GCC_BLSP2_QUP2_BCR] = { 0x163840 },
+- [GCC_BLSP2_QUP3_BCR] = { 0x172032 },
+- [GCC_BLSP2_QUP4_BCR] = { 0x180224 },
+- [GCC_BLSP2_QUP5_BCR] = { 0x188416 },
+- [GCC_BLSP2_QUP6_BCR] = { 0x196608 },
+- [GCC_PCIE_0_BCR] = { 0x438272 },
+- [GCC_PDM_BCR] = { 0x208896 },
+- [GCC_SDCC2_BCR] = { 0x81920 },
+- [GCC_SDCC4_BCR] = { 0x90112 },
+- [GCC_TSIF_BCR] = { 0x221184 },
+- [GCC_UFS_BCR] = { 0x479232 },
+- [GCC_USB_30_BCR] = { 0x61440 },
++ [GCC_BLSP1_QUP1_BCR] = { 0x19000 },
++ [GCC_BLSP1_QUP2_BCR] = { 0x1b000 },
++ [GCC_BLSP1_QUP3_BCR] = { 0x1d000 },
++ [GCC_BLSP1_QUP4_BCR] = { 0x1f000 },
++ [GCC_BLSP1_QUP5_BCR] = { 0x21000 },
++ [GCC_BLSP1_QUP6_BCR] = { 0x23000 },
++ [GCC_BLSP2_QUP1_BCR] = { 0x26000 },
++ [GCC_BLSP2_QUP2_BCR] = { 0x28000 },
++ [GCC_BLSP2_QUP3_BCR] = { 0x2a000 },
++ [GCC_BLSP2_QUP4_BCR] = { 0x2c000 },
++ [GCC_BLSP2_QUP5_BCR] = { 0x2e000 },
++ [GCC_BLSP2_QUP6_BCR] = { 0x30000 },
++ [GCC_PCIE_0_BCR] = { 0x6b000 },
++ [GCC_PDM_BCR] = { 0x33000 },
++ [GCC_SDCC2_BCR] = { 0x14000 },
++ [GCC_SDCC4_BCR] = { 0x16000 },
++ [GCC_TSIF_BCR] = { 0x36000 },
++ [GCC_UFS_BCR] = { 0x75000 },
++ [GCC_USB_30_BCR] = { 0xf000 },
+ };
+
+ static const struct regmap_config gcc_msm8998_regmap_config = {
+diff --git a/drivers/clk/renesas/r8a77990-cpg-mssr.c b/drivers/clk/renesas/r8a77990-cpg-mssr.c
+index 9e14f1486fbb..81569767025c 100644
+--- a/drivers/clk/renesas/r8a77990-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a77990-cpg-mssr.c
+@@ -175,8 +175,8 @@ static const struct mssr_mod_clk r8a77990_mod_clks[] __initconst = {
+ DEF_MOD("ehci0", 703, R8A77990_CLK_S3D4),
+ DEF_MOD("hsusb", 704, R8A77990_CLK_S3D4),
+ DEF_MOD("csi40", 716, R8A77990_CLK_CSI0),
+- DEF_MOD("du1", 723, R8A77990_CLK_S2D1),
+- DEF_MOD("du0", 724, R8A77990_CLK_S2D1),
++ DEF_MOD("du1", 723, R8A77990_CLK_S1D1),
++ DEF_MOD("du0", 724, R8A77990_CLK_S1D1),
+ DEF_MOD("lvds", 727, R8A77990_CLK_S2D1),
+
+ DEF_MOD("vin5", 806, R8A77990_CLK_S1D2),
+diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c
+index ea4cafbe6e85..9e16931e6f28 100644
+--- a/drivers/clk/renesas/r8a77995-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c
+@@ -141,8 +141,8 @@ static const struct mssr_mod_clk r8a77995_mod_clks[] __initconst = {
+ DEF_MOD("vspbs", 627, R8A77995_CLK_S0D1),
+ DEF_MOD("ehci0", 703, R8A77995_CLK_S3D2),
+ DEF_MOD("hsusb", 704, R8A77995_CLK_S3D2),
+- DEF_MOD("du1", 723, R8A77995_CLK_S2D1),
+- DEF_MOD("du0", 724, R8A77995_CLK_S2D1),
++ DEF_MOD("du1", 723, R8A77995_CLK_S1D1),
++ DEF_MOD("du0", 724, R8A77995_CLK_S1D1),
+ DEF_MOD("lvds", 727, R8A77995_CLK_S2D1),
+ DEF_MOD("vin7", 804, R8A77995_CLK_S1D2),
+ DEF_MOD("vin6", 805, R8A77995_CLK_S1D2),
+diff --git a/drivers/clk/renesas/rcar-gen3-cpg.c b/drivers/clk/renesas/rcar-gen3-cpg.c
+index 628b63b85d3f..9ace7d39cd1b 100644
+--- a/drivers/clk/renesas/rcar-gen3-cpg.c
++++ b/drivers/clk/renesas/rcar-gen3-cpg.c
+@@ -361,7 +361,7 @@ static struct clk * __init cpg_sd_clk_register(const struct cpg_core_clk *core,
+ struct sd_clock *clock;
+ struct clk *clk;
+ unsigned int i;
+- u32 sd_fc;
++ u32 val;
+
+ clock = kzalloc(sizeof(*clock), GFP_KERNEL);
+ if (!clock)
+@@ -378,17 +378,9 @@ static struct clk * __init cpg_sd_clk_register(const struct cpg_core_clk *core,
+ clock->div_table = cpg_sd_div_table;
+ clock->div_num = ARRAY_SIZE(cpg_sd_div_table);
+
+- sd_fc = readl(clock->csn.reg) & CPG_SD_FC_MASK;
+- for (i = 0; i < clock->div_num; i++)
+- if (sd_fc == (clock->div_table[i].val & CPG_SD_FC_MASK))
+- break;
+-
+- if (WARN_ON(i >= clock->div_num)) {
+- kfree(clock);
+- return ERR_PTR(-EINVAL);
+- }
+-
+- clock->cur_div_idx = i;
++ val = readl(clock->csn.reg) & ~CPG_SD_FC_MASK;
++ val |= CPG_SD_STP_MASK | (clock->div_table[0].val & CPG_SD_FC_MASK);
++ writel(val, clock->csn.reg);
+
+ clock->div_max = clock->div_table[0].div;
+ clock->div_min = clock->div_max;
+diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
+index 69fb3afc970f..2ca7e2be2f09 100644
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -362,8 +362,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
+ RK2928_CLKGATE_CON(2), 5, GFLAGS),
+ MUX(SCLK_MAC, "sclk_macref", mux_sclk_macref_p, CLK_SET_RATE_PARENT,
+ RK2928_CLKSEL_CON(21), 4, 1, MFLAGS),
+- GATE(0, "sclk_mac_lbtest", "sclk_macref",
+- RK2928_CLKGATE_CON(2), 12, 0, GFLAGS),
++ GATE(0, "sclk_mac_lbtest", "sclk_macref", 0,
++ RK2928_CLKGATE_CON(2), 12, GFLAGS),
+
+ COMPOSITE(0, "hsadc_src", mux_pll_src_gpll_cpll_p, 0,
+ RK2928_CLKSEL_CON(22), 0, 1, MFLAGS, 8, 8, DFLAGS,
+@@ -391,8 +391,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
+ * Clock-Architecture Diagram 4
+ */
+
+- GATE(SCLK_SMC, "sclk_smc", "hclk_peri",
+- RK2928_CLKGATE_CON(2), 4, 0, GFLAGS),
++ GATE(SCLK_SMC, "sclk_smc", "hclk_peri", 0,
++ RK2928_CLKGATE_CON(2), 4, GFLAGS),
+
+ COMPOSITE_NOMUX(SCLK_SPI0, "sclk_spi0", "pclk_peri", 0,
+ RK2928_CLKSEL_CON(25), 0, 7, DFLAGS,
+diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c
+index ecbae8acd05b..f2f13b603ae9 100644
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -392,7 +392,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+ RK3328_CLKGATE_CON(1), 5, GFLAGS,
+ &rk3328_i2s1_fracmux),
+ GATE(SCLK_I2S1, "clk_i2s1", "i2s1_pre", CLK_SET_RATE_PARENT,
+- RK3328_CLKGATE_CON(0), 6, GFLAGS),
++ RK3328_CLKGATE_CON(1), 6, GFLAGS),
+ COMPOSITE_NODIV(SCLK_I2S1_OUT, "i2s1_out", mux_i2s1out_p, 0,
+ RK3328_CLKSEL_CON(8), 12, 1, MFLAGS,
+ RK3328_CLKGATE_CON(1), 7, GFLAGS),
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index 2a6098179921..dec4a130390a 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -582,7 +582,7 @@ static const char * const dsi_dphy_parents[] = { "pll-video0", "pll-periph0" };
+ static const u8 dsi_dphy_table[] = { 0, 2, };
+ static SUNXI_CCU_M_WITH_MUX_TABLE_GATE(dsi_dphy_clk, "dsi-dphy",
+ dsi_dphy_parents, dsi_dphy_table,
+- 0x168, 0, 4, 8, 2, BIT(31), CLK_SET_RATE_PARENT);
++ 0x168, 0, 4, 8, 2, BIT(15), CLK_SET_RATE_PARENT);
+
+ static SUNXI_CCU_M_WITH_GATE(gpu_clk, "gpu", "pll-gpu",
+ 0x1a0, 0, 3, BIT(31), CLK_SET_RATE_PARENT);
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+index 77ed0b0ba681..61e3ba12773e 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+@@ -475,7 +475,7 @@ static const char * const csi_sclk_parents[] = { "pll-periph0", "pll-periph1" };
+ static SUNXI_CCU_M_WITH_MUX_GATE(csi_sclk_clk, "csi-sclk", csi_sclk_parents,
+ 0x134, 16, 4, 24, 3, BIT(31), 0);
+
+-static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph0" };
++static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph1" };
+ static SUNXI_CCU_M_WITH_MUX_GATE(csi_mclk_clk, "csi-mclk", csi_mclk_parents,
+ 0x134, 0, 5, 8, 3, BIT(15), 0);
+
+diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
+index 6386e1784fe4..68d5ea818b6c 100644
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -373,12 +373,8 @@ static u32 crypto4xx_build_sdr(struct crypto4xx_device *dev)
+ dma_alloc_coherent(dev->core_dev->device,
+ PPC4XX_SD_BUFFER_SIZE * PPC4XX_NUM_SD,
+ &dev->scatter_buffer_pa, GFP_ATOMIC);
+- if (!dev->scatter_buffer_va) {
+- dma_free_coherent(dev->core_dev->device,
+- sizeof(struct ce_sd) * PPC4XX_NUM_SD,
+- dev->sdr, dev->sdr_pa);
++ if (!dev->scatter_buffer_va)
+ return -ENOMEM;
+- }
+
+ for (i = 0; i < PPC4XX_NUM_SD; i++) {
+ dev->sdr[i].ptr = dev->scatter_buffer_pa +
+diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
+index 801aeab5ab1e..f662914d87b8 100644
+--- a/drivers/crypto/atmel-aes.c
++++ b/drivers/crypto/atmel-aes.c
+@@ -493,6 +493,29 @@ static inline bool atmel_aes_is_encrypt(const struct atmel_aes_dev *dd)
+ static void atmel_aes_authenc_complete(struct atmel_aes_dev *dd, int err);
+ #endif
+
++static void atmel_aes_set_iv_as_last_ciphertext_block(struct atmel_aes_dev *dd)
++{
++ struct ablkcipher_request *req = ablkcipher_request_cast(dd->areq);
++ struct atmel_aes_reqctx *rctx = ablkcipher_request_ctx(req);
++ struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req);
++ unsigned int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
++
++ if (req->nbytes < ivsize)
++ return;
++
++ if (rctx->mode & AES_FLAGS_ENCRYPT) {
++ scatterwalk_map_and_copy(req->info, req->dst,
++ req->nbytes - ivsize, ivsize, 0);
++ } else {
++ if (req->src == req->dst)
++ memcpy(req->info, rctx->lastc, ivsize);
++ else
++ scatterwalk_map_and_copy(req->info, req->src,
++ req->nbytes - ivsize,
++ ivsize, 0);
++ }
++}
++
+ static inline int atmel_aes_complete(struct atmel_aes_dev *dd, int err)
+ {
+ #ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
+@@ -503,26 +526,8 @@ static inline int atmel_aes_complete(struct atmel_aes_dev *dd, int err)
+ clk_disable(dd->iclk);
+ dd->flags &= ~AES_FLAGS_BUSY;
+
+- if (!dd->ctx->is_aead) {
+- struct ablkcipher_request *req =
+- ablkcipher_request_cast(dd->areq);
+- struct atmel_aes_reqctx *rctx = ablkcipher_request_ctx(req);
+- struct crypto_ablkcipher *ablkcipher =
+- crypto_ablkcipher_reqtfm(req);
+- int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
+-
+- if (rctx->mode & AES_FLAGS_ENCRYPT) {
+- scatterwalk_map_and_copy(req->info, req->dst,
+- req->nbytes - ivsize, ivsize, 0);
+- } else {
+- if (req->src == req->dst) {
+- memcpy(req->info, rctx->lastc, ivsize);
+- } else {
+- scatterwalk_map_and_copy(req->info, req->src,
+- req->nbytes - ivsize, ivsize, 0);
+- }
+- }
+- }
++ if (!dd->ctx->is_aead)
++ atmel_aes_set_iv_as_last_ciphertext_block(dd);
+
+ if (dd->is_async)
+ dd->areq->complete(dd->areq, err);
+@@ -1128,10 +1133,12 @@ static int atmel_aes_crypt(struct ablkcipher_request *req, unsigned long mode)
+ rctx->mode = mode;
+
+ if (!(mode & AES_FLAGS_ENCRYPT) && (req->src == req->dst)) {
+- int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
++ unsigned int ivsize = crypto_ablkcipher_ivsize(ablkcipher);
+
+- scatterwalk_map_and_copy(rctx->lastc, req->src,
+- (req->nbytes - ivsize), ivsize, 0);
++ if (req->nbytes >= ivsize)
++ scatterwalk_map_and_copy(rctx->lastc, req->src,
++ req->nbytes - ivsize,
++ ivsize, 0);
+ }
+
+ return atmel_aes_handle_queue(dd, &req->base);
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index cd464637b0cb..49c0097fa474 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -4634,12 +4634,16 @@ static int spu_register_ahash(struct iproc_alg_s *driver_alg)
+ hash->halg.statesize = sizeof(struct spu_hash_export_s);
+
+ if (driver_alg->auth_info.mode != HASH_MODE_HMAC) {
+- hash->setkey = ahash_setkey;
+ hash->init = ahash_init;
+ hash->update = ahash_update;
+ hash->final = ahash_final;
+ hash->finup = ahash_finup;
+ hash->digest = ahash_digest;
++ if ((driver_alg->auth_info.alg == HASH_ALG_AES) &&
++ ((driver_alg->auth_info.mode == HASH_MODE_XCBC) ||
++ (driver_alg->auth_info.mode == HASH_MODE_CMAC))) {
++ hash->setkey = ahash_setkey;
++ }
+ } else {
+ hash->setkey = ahash_hmac_setkey;
+ hash->init = ahash_hmac_init;
+diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
+index 67155cb21636..a83588d6ba72 100644
+--- a/drivers/crypto/ccp/ccp-dmaengine.c
++++ b/drivers/crypto/ccp/ccp-dmaengine.c
+@@ -340,6 +340,7 @@ static struct ccp_dma_desc *ccp_alloc_dma_desc(struct ccp_dma_chan *chan,
+ desc->tx_desc.flags = flags;
+ desc->tx_desc.tx_submit = ccp_tx_submit;
+ desc->ccp = chan->ccp;
++ INIT_LIST_HEAD(&desc->entry);
+ INIT_LIST_HEAD(&desc->pending);
+ INIT_LIST_HEAD(&desc->active);
+ desc->status = DMA_IN_PROGRESS;
+diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c
+index da74fd74636b..cee78f9c4794 100644
+--- a/drivers/dma/coh901318.c
++++ b/drivers/dma/coh901318.c
+@@ -1797,13 +1797,10 @@ static struct dma_chan *coh901318_xlate(struct of_phandle_args *dma_spec,
+ static int coh901318_config(struct coh901318_chan *cohc,
+ struct coh901318_params *param)
+ {
+- unsigned long flags;
+ const struct coh901318_params *p;
+ int channel = cohc->id;
+ void __iomem *virtbase = cohc->base->virtbase;
+
+- spin_lock_irqsave(&cohc->lock, flags);
+-
+ if (param)
+ p = param;
+ else
+@@ -1823,8 +1820,6 @@ static int coh901318_config(struct coh901318_chan *cohc,
+ coh901318_set_conf(cohc, p->config);
+ coh901318_set_ctrl(cohc, p->ctrl_lli_last);
+
+- spin_unlock_irqrestore(&cohc->lock, flags);
+-
+ return 0;
+ }
+
+diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
+index 0f389e008ce6..055d83b6cb68 100644
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -160,12 +160,14 @@ static void dwc_initialize_chan_idma32(struct dw_dma_chan *dwc)
+
+ static void dwc_initialize_chan_dw(struct dw_dma_chan *dwc)
+ {
++ struct dw_dma *dw = to_dw_dma(dwc->chan.device);
+ u32 cfghi = DWC_CFGH_FIFO_MODE;
+ u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority);
+ bool hs_polarity = dwc->dws.hs_polarity;
+
+ cfghi |= DWC_CFGH_DST_PER(dwc->dws.dst_id);
+ cfghi |= DWC_CFGH_SRC_PER(dwc->dws.src_id);
++ cfghi |= DWC_CFGH_PROTCTL(dw->pdata->protctl);
+
+ /* Set polarity of handshake interface */
+ cfglo |= hs_polarity ? DWC_CFGL_HS_DST_POL | DWC_CFGL_HS_SRC_POL : 0;
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index f62dd0944908..c299ff181bb6 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -162,6 +162,12 @@ dw_dma_parse_dt(struct platform_device *pdev)
+ pdata->multi_block[tmp] = 1;
+ }
+
++ if (!of_property_read_u32(np, "snps,dma-protection-control", &tmp)) {
++ if (tmp > CHAN_PROTCTL_MASK)
++ return NULL;
++ pdata->protctl = tmp;
++ }
++
+ return pdata;
+ }
+ #else
+diff --git a/drivers/dma/dw/regs.h b/drivers/dma/dw/regs.h
+index 09e7dfdbb790..646c9c960c07 100644
+--- a/drivers/dma/dw/regs.h
++++ b/drivers/dma/dw/regs.h
+@@ -200,6 +200,10 @@ enum dw_dma_msize {
+ #define DWC_CFGH_FCMODE (1 << 0)
+ #define DWC_CFGH_FIFO_MODE (1 << 1)
+ #define DWC_CFGH_PROTCTL(x) ((x) << 2)
++#define DWC_CFGH_PROTCTL_DATA (0 << 2) /* data access - always set */
++#define DWC_CFGH_PROTCTL_PRIV (1 << 2) /* privileged -> AHB HPROT[1] */
++#define DWC_CFGH_PROTCTL_BUFFER (2 << 2) /* bufferable -> AHB HPROT[2] */
++#define DWC_CFGH_PROTCTL_CACHE (4 << 2) /* cacheable -> AHB HPROT[3] */
+ #define DWC_CFGH_DS_UPD_EN (1 << 5)
+ #define DWC_CFGH_SS_UPD_EN (1 << 6)
+ #define DWC_CFGH_SRC_PER(x) ((x) << 7)
+diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
+index 9f30f4929b72..7a767b66dd86 100644
+--- a/drivers/extcon/extcon-max8997.c
++++ b/drivers/extcon/extcon-max8997.c
+@@ -321,12 +321,10 @@ static int max8997_muic_handle_usb(struct max8997_muic_info *info,
+ {
+ int ret = 0;
+
+- if (usb_type == MAX8997_USB_HOST) {
+- ret = max8997_muic_set_path(info, info->path_usb, attached);
+- if (ret < 0) {
+- dev_err(info->dev, "failed to update muic register\n");
+- return ret;
+- }
++ ret = max8997_muic_set_path(info, info->path_usb, attached);
++ if (ret < 0) {
++ dev_err(info->dev, "failed to update muic register\n");
++ return ret;
+ }
+
+ switch (usb_type) {
+diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
+index a200a2174611..44eb99807e33 100644
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -14,6 +14,7 @@
+ #include <linux/module.h>
+ #include <linux/of_platform.h>
+ #include <linux/platform_device.h>
++#include <linux/slab.h>
+ #include <soc/bcm2835/raspberrypi-firmware.h>
+
+ #define MBOX_MSG(chan, data28) (((data28) & ~0xf) | ((chan) & 0xf))
+@@ -21,8 +22,6 @@
+ #define MBOX_DATA28(msg) ((msg) & ~0xf)
+ #define MBOX_CHAN_PROPERTY 8
+
+-#define MAX_RPI_FW_PROP_BUF_SIZE 32
+-
+ static struct platform_device *rpi_hwmon;
+
+ struct rpi_firmware {
+@@ -144,28 +143,30 @@ EXPORT_SYMBOL_GPL(rpi_firmware_property_list);
+ int rpi_firmware_property(struct rpi_firmware *fw,
+ u32 tag, void *tag_data, size_t buf_size)
+ {
+- /* Single tags are very small (generally 8 bytes), so the
+- * stack should be safe.
+- */
+- u8 data[sizeof(struct rpi_firmware_property_tag_header) +
+- MAX_RPI_FW_PROP_BUF_SIZE];
+- struct rpi_firmware_property_tag_header *header =
+- (struct rpi_firmware_property_tag_header *)data;
++ struct rpi_firmware_property_tag_header *header;
+ int ret;
+
+- if (WARN_ON(buf_size > sizeof(data) - sizeof(*header)))
+- return -EINVAL;
++ /* Some mailboxes can use over 1k bytes. Rather than checking
++ * size and using stack or kmalloc depending on requirements,
++ * just use kmalloc. Mailboxes don't get called enough to worry
++ * too much about the time taken in the allocation.
++ */
++ void *data = kmalloc(sizeof(*header) + buf_size, GFP_KERNEL);
+
++ if (!data)
++ return -ENOMEM;
++
++ header = data;
+ header->tag = tag;
+ header->buf_size = buf_size;
+ header->req_resp_size = 0;
+- memcpy(data + sizeof(struct rpi_firmware_property_tag_header),
+- tag_data, buf_size);
++ memcpy(data + sizeof(*header), tag_data, buf_size);
++
++ ret = rpi_firmware_property_list(fw, data, buf_size + sizeof(*header));
++
++ memcpy(tag_data, data + sizeof(*header), buf_size);
+
+- ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));
+- memcpy(tag_data,
+- data + sizeof(struct rpi_firmware_property_tag_header),
+- buf_size);
++ kfree(data);
+
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
+index 3b378936f575..a9b15001416a 100644
+--- a/drivers/gpu/drm/i810/i810_dma.c
++++ b/drivers/gpu/drm/i810/i810_dma.c
+@@ -721,7 +721,7 @@ static void i810_dma_dispatch_vertex(struct drm_device *dev,
+ if (nbox > I810_NR_SAREA_CLIPRECTS)
+ nbox = I810_NR_SAREA_CLIPRECTS;
+
+- if (used > 4 * 1024)
++ if (used < 0 || used > 4 * 1024)
+ used = 0;
+
+ if (sarea_priv->dirty)
+@@ -1041,7 +1041,7 @@ static void i810_dma_dispatch_mc(struct drm_device *dev, struct drm_buf *buf, in
+ if (u != I810_BUF_CLIENT)
+ DRM_DEBUG("MC found buffer that isn't mine!\n");
+
+- if (used > 4 * 1024)
++ if (used < 0 || used > 4 * 1024)
+ used = 0;
+
+ sarea_priv->dirty = 0x7f;
+diff --git a/drivers/gpu/drm/msm/msm_debugfs.c b/drivers/gpu/drm/msm/msm_debugfs.c
+index d756436c1fcd..989465e5f9d9 100644
+--- a/drivers/gpu/drm/msm/msm_debugfs.c
++++ b/drivers/gpu/drm/msm/msm_debugfs.c
+@@ -53,12 +53,8 @@ static int msm_gpu_release(struct inode *inode, struct file *file)
+ struct msm_gpu_show_priv *show_priv = m->private;
+ struct msm_drm_private *priv = show_priv->dev->dev_private;
+ struct msm_gpu *gpu = priv->gpu;
+- int ret;
+-
+- ret = mutex_lock_interruptible(&show_priv->dev->struct_mutex);
+- if (ret)
+- return ret;
+
++ mutex_lock(&show_priv->dev->struct_mutex);
+ gpu->funcs->gpu_state_put(show_priv->state);
+ mutex_unlock(&show_priv->dev->struct_mutex);
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+index 8c31c9ab06f8..fda1ae12069a 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -423,7 +423,7 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon,
+
+ WARN_ON(!tcon->quirks->has_channel_0);
+
+- tcon->dclk_min_div = 6;
++ tcon->dclk_min_div = 1;
+ tcon->dclk_max_div = 127;
+ sun4i_tcon0_mode_set_common(tcon, mode);
+
+diff --git a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h
+index 4457486c72b0..e599e15bf999 100644
+--- a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h
++++ b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h
+@@ -59,7 +59,7 @@ static inline u32 host1x_uclass_incr_syncpt_r(void)
+ host1x_uclass_incr_syncpt_r()
+ static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v)
+ {
+- return (v & 0xff) << 8;
++ return (v & 0xff) << 10;
+ }
+ #define HOST1X_UCLASS_INCR_SYNCPT_COND_F(v) \
+ host1x_uclass_incr_syncpt_cond_f(v)
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+index a0365e23678e..f5fb1e7a9c17 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+@@ -655,10 +655,13 @@ static ssize_t cyc_threshold_store(struct device *dev,
+
+ if (kstrtoul(buf, 16, &val))
+ return -EINVAL;
++
++ /* mask off max threshold before checking min value */
++ val &= ETM_CYC_THRESHOLD_MASK;
+ if (val < drvdata->ccitmin)
+ return -EINVAL;
+
+- config->ccctlr = val & ETM_CYC_THRESHOLD_MASK;
++ config->ccctlr = val;
+ return size;
+ }
+ static DEVICE_ATTR_RW(cyc_threshold);
+@@ -689,14 +692,16 @@ static ssize_t bb_ctrl_store(struct device *dev,
+ return -EINVAL;
+ if (!drvdata->nr_addr_cmp)
+ return -EINVAL;
++
+ /*
+- * Bit[7:0] selects which address range comparator is used for
+- * branch broadcast control.
++ * Bit[8] controls include(1) / exclude(0), bits[0-7] select
++ * individual range comparators. If include then at least 1
++ * range must be selected.
+ */
+- if (BMVAL(val, 0, 7) > drvdata->nr_addr_cmp)
++ if ((val & BIT(8)) && (BMVAL(val, 0, 7) == 0))
+ return -EINVAL;
+
+- config->bb_ctrl = val;
++ config->bb_ctrl = val & GENMASK(8, 0);
+ return size;
+ }
+ static DEVICE_ATTR_RW(bb_ctrl);
+@@ -1329,8 +1334,8 @@ static ssize_t seq_event_store(struct device *dev,
+
+ spin_lock(&drvdata->spinlock);
+ idx = config->seq_idx;
+- /* RST, bits[7:0] */
+- config->seq_ctrl[idx] = val & 0xFF;
++ /* Seq control has two masks B[15:8] F[7:0] */
++ config->seq_ctrl[idx] = val & 0xFFFF;
+ spin_unlock(&drvdata->spinlock);
+ return size;
+ }
+@@ -1585,7 +1590,7 @@ static ssize_t res_ctrl_store(struct device *dev,
+ if (idx % 2 != 0)
+ /* PAIRINV, bit[21] */
+ val &= ~BIT(21);
+- config->res_ctrl[idx] = val;
++ config->res_ctrl[idx] = val & GENMASK(21, 0);
+ spin_unlock(&drvdata->spinlock);
+ return size;
+ }
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index 7bd409eaf0ac..d4b72e4ffd71 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -1090,7 +1090,8 @@ static int i2c_imx_probe(struct platform_device *pdev)
+ /* Get I2C clock */
+ i2c_imx->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(i2c_imx->clk)) {
+- dev_err(&pdev->dev, "can't get I2C clock\n");
++ if (PTR_ERR(i2c_imx->clk) != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "can't get I2C clock\n");
+ return PTR_ERR(i2c_imx->clk);
+ }
+
+diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c
+index 0f01cdba9d2c..14d488499696 100644
+--- a/drivers/i2c/i2c-core-of.c
++++ b/drivers/i2c/i2c-core-of.c
+@@ -253,14 +253,14 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action,
+ }
+
+ client = of_i2c_register_device(adap, rd->dn);
+- put_device(&adap->dev);
+-
+ if (IS_ERR(client)) {
+ dev_err(&adap->dev, "failed to create client for '%pOF'\n",
+ rd->dn);
++ put_device(&adap->dev);
+ of_node_clear_flag(rd->dn, OF_POPULATED);
+ return notifier_from_errno(PTR_ERR(client));
+ }
++ put_device(&adap->dev);
+ break;
+ case OF_RECONFIG_CHANGE_REMOVE:
+ /* already depopulated? */
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index a5ff1f0f2073..4dcc92d11609 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2798,7 +2798,8 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
+ break;
+ case MPA_REQ_SENT:
+ (void)stop_ep_timer(ep);
+- if (mpa_rev == 1 || (mpa_rev == 2 && ep->tried_with_mpa_v1))
++ if (status != CPL_ERR_CONN_RESET || mpa_rev == 1 ||
++ (mpa_rev == 2 && ep->tried_with_mpa_v1))
+ connect_reply_upcall(ep, -ECONNRESET);
+ else {
+ /*
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 6aa5a8a242ff..6b8935361133 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -1074,6 +1074,8 @@ static void log_state_transition(struct hfi1_pportdata *ppd, u32 state);
+ static void log_physical_state(struct hfi1_pportdata *ppd, u32 state);
+ static int wait_physical_linkstate(struct hfi1_pportdata *ppd, u32 state,
+ int msecs);
++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd,
++ int msecs);
+ static void read_planned_down_reason_code(struct hfi1_devdata *dd, u8 *pdrrc);
+ static void read_link_down_reason(struct hfi1_devdata *dd, u8 *ldr);
+ static void handle_temp_err(struct hfi1_devdata *dd);
+@@ -10769,13 +10771,15 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
+ break;
+
+ ppd->port_error_action = 0;
+- ppd->host_link_state = HLS_DN_POLL;
+
+ if (quick_linkup) {
+ /* quick linkup does not go into polling */
+ ret = do_quick_linkup(dd);
+ } else {
+ ret1 = set_physical_link_state(dd, PLS_POLLING);
++ if (!ret1)
++ ret1 = wait_phys_link_out_of_offline(ppd,
++ 3000);
+ if (ret1 != HCMD_SUCCESS) {
+ dd_dev_err(dd,
+ "Failed to transition to Polling link state, return 0x%x\n",
+@@ -10783,6 +10787,14 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
+ ret = -EINVAL;
+ }
+ }
++
++ /*
++ * Change the host link state after requesting DC8051 to
++ * change its physical state so that we can ignore any
++ * interrupt with stale LNI(XX) error, which will not be
++ * cleared until DC8051 transitions to Polling state.
++ */
++ ppd->host_link_state = HLS_DN_POLL;
+ ppd->offline_disabled_reason =
+ HFI1_ODR_MASK(OPA_LINKDOWN_REASON_NONE);
+ /*
+@@ -12914,6 +12926,39 @@ static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd,
+ return read_state;
+ }
+
++/*
++ * wait_phys_link_out_of_offline - wait for any out of offline state
++ * @ppd: port device
++ * @msecs: the number of milliseconds to wait
++ *
++ * Wait up to msecs milliseconds for any out of offline physical link
++ * state change to occur.
++ * Returns 0 if at least one state is reached, otherwise -ETIMEDOUT.
++ */
++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd,
++ int msecs)
++{
++ u32 read_state;
++ unsigned long timeout;
++
++ timeout = jiffies + msecs_to_jiffies(msecs);
++ while (1) {
++ read_state = read_physical_state(ppd->dd);
++ if ((read_state & 0xF0) != PLS_OFFLINE)
++ break;
++ if (time_after(jiffies, timeout)) {
++ dd_dev_err(ppd->dd,
++ "timeout waiting for phy link out of offline. Read state 0x%x, %dms\n",
++ read_state, msecs);
++ return -ETIMEDOUT;
++ }
++ usleep_range(1950, 2050); /* sleep 2ms-ish */
++ }
++
++ log_state_transition(ppd, read_state);
++ return read_state;
++}
++
+ #define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \
+ (r &= ~SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK)
+
+diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+index c3c96c5869ed..718dcdef946e 100644
+--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c
++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+@@ -57,7 +57,6 @@
+
+ #define HFI1_VNIC_TXREQ_NAME_LEN 32
+ #define HFI1_VNIC_SDMA_DESC_WTRMRK 64
+-#define HFI1_VNIC_SDMA_RETRY_COUNT 1
+
+ /*
+ * struct vnic_txreq - VNIC transmit descriptor
+@@ -67,7 +66,6 @@
+ * @pad: pad buffer
+ * @plen: pad length
+ * @pbc_val: pbc value
+- * @retry_count: tx retry count
+ */
+ struct vnic_txreq {
+ struct sdma_txreq txreq;
+@@ -77,8 +75,6 @@ struct vnic_txreq {
+ unsigned char pad[HFI1_VNIC_MAX_PAD];
+ u16 plen;
+ __le64 pbc_val;
+-
+- u32 retry_count;
+ };
+
+ static void vnic_sdma_complete(struct sdma_txreq *txreq,
+@@ -196,7 +192,6 @@ int hfi1_vnic_send_dma(struct hfi1_devdata *dd, u8 q_idx,
+ ret = build_vnic_tx_desc(sde, tx, pbc);
+ if (unlikely(ret))
+ goto free_desc;
+- tx->retry_count = 0;
+
+ ret = sdma_send_txreq(sde, &vnic_sdma->wait, &tx->txreq,
+ vnic_sdma->pkts_sent);
+@@ -238,14 +233,14 @@ static int hfi1_vnic_sdma_sleep(struct sdma_engine *sde,
+ struct hfi1_vnic_sdma *vnic_sdma =
+ container_of(wait, struct hfi1_vnic_sdma, wait);
+ struct hfi1_ibdev *dev = &vnic_sdma->dd->verbs_dev;
+- struct vnic_txreq *tx = container_of(txreq, struct vnic_txreq, txreq);
+
+- if (sdma_progress(sde, seq, txreq))
+- if (tx->retry_count++ < HFI1_VNIC_SDMA_RETRY_COUNT)
+- return -EAGAIN;
++ write_seqlock(&dev->iowait_lock);
++ if (sdma_progress(sde, seq, txreq)) {
++ write_sequnlock(&dev->iowait_lock);
++ return -EAGAIN;
++ }
+
+ vnic_sdma->state = HFI1_VNIC_SDMA_Q_DEFERRED;
+- write_seqlock(&dev->iowait_lock);
+ if (list_empty(&vnic_sdma->wait.list))
+ iowait_queue(pkts_sent, wait, &sde->dmawait);
+ write_sequnlock(&dev->iowait_lock);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.h b/drivers/infiniband/hw/hns/hns_roce_hem.h
+index e8850d59e780..a94444db3045 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.h
+@@ -54,7 +54,7 @@ enum {
+
+ #define HNS_ROCE_HEM_CHUNK_LEN \
+ ((256 - sizeof(struct list_head) - 2 * sizeof(int)) / \
+- (sizeof(struct scatterlist)))
++ (sizeof(struct scatterlist) + sizeof(void *)))
+
+ #define check_whether_bt_num_3(type, hop_num) \
+ (type < HEM_TYPE_MTT && hop_num == 2)
+diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c
+index e219093d2764..d2da28d613f2 100644
+--- a/drivers/infiniband/hw/mlx4/sysfs.c
++++ b/drivers/infiniband/hw/mlx4/sysfs.c
+@@ -353,16 +353,12 @@ err:
+
+ static void get_name(struct mlx4_ib_dev *dev, char *name, int i, int max)
+ {
+- char base_name[9];
+-
+- /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n */
+- strlcpy(name, pci_name(dev->dev->persist->pdev), max);
+- strncpy(base_name, name, 8); /*till xxxx:yy:*/
+- base_name[8] = '\0';
+- /* with no ARI only 3 last bits are used so when the fn is higher than 8
++ /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n
++ * with no ARI only 3 last bits are used so when the fn is higher than 8
+ * need to add it to the dev num, so count in the last number will be
+ * modulo 8 */
+- sprintf(name, "%s%.2d.%d", base_name, (i/8), (i%8));
++ snprintf(name, max, "%.8s%.2d.%d", pci_name(dev->dev->persist->pdev),
++ i / 8, i % 8);
+ }
+
+ struct mlx4_port {
+diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c
+index ca2638d8f35e..d831f3e61ae8 100644
+--- a/drivers/infiniband/hw/qib/qib_sysfs.c
++++ b/drivers/infiniband/hw/qib/qib_sysfs.c
+@@ -301,6 +301,9 @@ static ssize_t qib_portattr_show(struct kobject *kobj,
+ struct qib_pportdata *ppd =
+ container_of(kobj, struct qib_pportdata, pport_kobj);
+
++ if (!pattr->show)
++ return -EIO;
++
+ return pattr->show(ppd, buf);
+ }
+
+@@ -312,6 +315,9 @@ static ssize_t qib_portattr_store(struct kobject *kobj,
+ struct qib_pportdata *ppd =
+ container_of(kobj, struct qib_pportdata, pport_kobj);
+
++ if (!pattr->store)
++ return -EIO;
++
+ return pattr->store(ppd, buf, len);
+ }
+
+diff --git a/drivers/input/joystick/psxpad-spi.c b/drivers/input/joystick/psxpad-spi.c
+index 28b473f6cbb6..092096ee06b9 100644
+--- a/drivers/input/joystick/psxpad-spi.c
++++ b/drivers/input/joystick/psxpad-spi.c
+@@ -292,7 +292,7 @@ static int psxpad_spi_probe(struct spi_device *spi)
+ if (!pad)
+ return -ENOMEM;
+
+- pdev = input_allocate_polled_device();
++ pdev = devm_input_allocate_polled_device(&spi->dev);
+ if (!pdev) {
+ dev_err(&spi->dev, "failed to allocate input device\n");
+ return -ENOMEM;
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 06cebde2422e..e8d1134943c4 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -175,6 +175,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0071", /* T480 */
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN0073", /* X1 Carbon G5 (Elantech) */
++ "LEN0091", /* X1 Carbon 6 */
+ "LEN0092", /* X1 Carbon 6 */
+ "LEN0093", /* T480 */
+ "LEN0096", /* X280 */
+diff --git a/drivers/input/rmi4/rmi_f34v7.c b/drivers/input/rmi4/rmi_f34v7.c
+index 3991d2943660..099dde68e332 100644
+--- a/drivers/input/rmi4/rmi_f34v7.c
++++ b/drivers/input/rmi4/rmi_f34v7.c
+@@ -1192,6 +1192,9 @@ int rmi_f34v7_do_reflash(struct f34_data *f34, const struct firmware *fw)
+ {
+ int ret;
+
++ f34->fn->rmi_dev->driver->set_irq_bits(f34->fn->rmi_dev,
++ f34->fn->irq_mask);
++
+ rmi_f34v7_read_queries_bl_version(f34);
+
+ f34->v7.image = fw->data;
+diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c
+index b6ccf39c6a7b..4b2466cf2fb1 100644
+--- a/drivers/input/rmi4/rmi_smbus.c
++++ b/drivers/input/rmi4/rmi_smbus.c
+@@ -166,7 +166,6 @@ static int rmi_smb_write_block(struct rmi_transport_dev *xport, u16 rmiaddr,
+ /* prepare to write next block of bytes */
+ cur_len -= SMB_MAX_COUNT;
+ databuff += SMB_MAX_COUNT;
+- rmiaddr += SMB_MAX_COUNT;
+ }
+ exit:
+ mutex_unlock(&rmi_smb->page_mutex);
+@@ -218,7 +217,6 @@ static int rmi_smb_read_block(struct rmi_transport_dev *xport, u16 rmiaddr,
+ /* prepare to read next block of bytes */
+ cur_len -= SMB_MAX_COUNT;
+ databuff += SMB_MAX_COUNT;
+- rmiaddr += SMB_MAX_COUNT;
+ }
+
+ retval = 0;
+diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
+index 727c3232517c..c84ee739a8d5 100644
+--- a/drivers/input/touchscreen/cyttsp4_core.c
++++ b/drivers/input/touchscreen/cyttsp4_core.c
+@@ -2000,11 +2000,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd)
+
+ /* get sysinfo */
+ md->si = &cd->sysinfo;
+- if (!md->si) {
+- dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n",
+- __func__, md->si);
+- goto error_get_sysinfo;
+- }
+
+ rc = cyttsp4_setup_input_device(cd);
+ if (rc)
+@@ -2014,8 +2009,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd)
+
+ error_init_input:
+ input_free_device(md->input);
+-error_get_sysinfo:
+- input_set_drvdata(md->input, NULL);
+ error_alloc_failed:
+ dev_err(dev, "%s failed.\n", __func__);
+ return rc;
+diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
+index f2d9c2c41885..b20ba6599273 100644
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -127,6 +127,15 @@ static const unsigned long goodix_irq_flags[] = {
+ */
+ static const struct dmi_system_id rotated_screen[] = {
+ #if defined(CONFIG_DMI) && defined(CONFIG_X86)
++ {
++ .ident = "Teclast X89",
++ .matches = {
++ /* tPAD is too generic, also match on bios date */
++ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"),
++ DMI_MATCH(DMI_BOARD_NAME, "tPAD"),
++ DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"),
++ },
++ },
+ {
+ .ident = "WinBook TW100",
+ .matches = {
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index fe18804a5008..9991386fb700 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -549,7 +549,7 @@ static void amd_iommu_report_page_fault(u16 devid, u16 domain_id,
+ dev_data = get_dev_data(&pdev->dev);
+
+ if (dev_data && __ratelimit(&dev_data->rs)) {
+- dev_err(&pdev->dev, "AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x%04x address=0x%016llx flags=0x%04x]\n",
++ dev_err(&pdev->dev, "Event logged [IO_PAGE_FAULT domain=0x%04x address=0x%016llx flags=0x%04x]\n",
+ domain_id, address, flags);
+ } else if (printk_ratelimit()) {
+ pr_err("AMD-Vi: Event logged [IO_PAGE_FAULT device=%02x:%02x.%x domain=0x%04x address=0x%016llx flags=0x%04x]\n",
+@@ -589,43 +589,41 @@ retry:
+ if (type == EVENT_TYPE_IO_FAULT) {
+ amd_iommu_report_page_fault(devid, pasid, address, flags);
+ return;
+- } else {
+- dev_err(dev, "AMD-Vi: Event logged [");
+ }
+
+ switch (type) {
+ case EVENT_TYPE_ILL_DEV:
+- dev_err(dev, "ILLEGAL_DEV_TABLE_ENTRY device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
++ dev_err(dev, "Event logged [ILLEGAL_DEV_TABLE_ENTRY device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ pasid, address, flags);
+ dump_dte_entry(devid);
+ break;
+ case EVENT_TYPE_DEV_TAB_ERR:
+- dev_err(dev, "DEV_TAB_HARDWARE_ERROR device=%02x:%02x.%x "
++ dev_err(dev, "Event logged [DEV_TAB_HARDWARE_ERROR device=%02x:%02x.%x "
+ "address=0x%016llx flags=0x%04x]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ address, flags);
+ break;
+ case EVENT_TYPE_PAGE_TAB_ERR:
+- dev_err(dev, "PAGE_TAB_HARDWARE_ERROR device=%02x:%02x.%x domain=0x%04x address=0x%016llx flags=0x%04x]\n",
++ dev_err(dev, "Event logged [PAGE_TAB_HARDWARE_ERROR device=%02x:%02x.%x domain=0x%04x address=0x%016llx flags=0x%04x]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ pasid, address, flags);
+ break;
+ case EVENT_TYPE_ILL_CMD:
+- dev_err(dev, "ILLEGAL_COMMAND_ERROR address=0x%016llx]\n", address);
++ dev_err(dev, "Event logged [ILLEGAL_COMMAND_ERROR address=0x%016llx]\n", address);
+ dump_command(address);
+ break;
+ case EVENT_TYPE_CMD_HARD_ERR:
+- dev_err(dev, "COMMAND_HARDWARE_ERROR address=0x%016llx flags=0x%04x]\n",
++ dev_err(dev, "Event logged [COMMAND_HARDWARE_ERROR address=0x%016llx flags=0x%04x]\n",
+ address, flags);
+ break;
+ case EVENT_TYPE_IOTLB_INV_TO:
+- dev_err(dev, "IOTLB_INV_TIMEOUT device=%02x:%02x.%x address=0x%016llx]\n",
++ dev_err(dev, "Event logged [IOTLB_INV_TIMEOUT device=%02x:%02x.%x address=0x%016llx]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ address);
+ break;
+ case EVENT_TYPE_INV_DEV_REQ:
+- dev_err(dev, "INVALID_DEVICE_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
++ dev_err(dev, "Event logged [INVALID_DEVICE_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ pasid, address, flags);
+ break;
+@@ -633,12 +631,12 @@ retry:
+ pasid = ((event[0] >> 16) & 0xFFFF)
+ | ((event[1] << 6) & 0xF0000);
+ tag = event[1] & 0x03FF;
+- dev_err(dev, "INVALID_PPR_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
++ dev_err(dev, "Event logged [INVALID_PPR_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ pasid, address, flags);
+ break;
+ default:
+- dev_err(dev, "UNKNOWN event[0]=0x%08x event[1]=0x%08x event[2]=0x%08x event[3]=0x%08x\n",
++ dev_err(dev, "Event logged [UNKNOWN event[0]=0x%08x event[1]=0x%08x event[2]=0x%08x event[3]=0x%08x\n",
+ event[0], event[1], event[2], event[3]);
+ }
+
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index 3cafbfd655f5..475e5f8b2287 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -620,7 +620,7 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio)
+ tmp_dev = map_sector(mddev, zone, sector, §or);
+ break;
+ default:
+- WARN("md/raid0:%s: Invalid layout\n", mdname(mddev));
++ WARN(1, "md/raid0:%s: Invalid layout\n", mdname(mddev));
+ bio_io_error(bio);
+ return true;
+ }
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index 4a15d53f659e..dd6f3e6ce006 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -1437,6 +1437,13 @@ configured:
+ las->log_addr[i],
+ cec_phys_addr_exp(adap->phys_addr));
+ cec_transmit_msg_fh(adap, &msg, NULL, false);
++
++ /* Report Vendor ID */
++ if (adap->log_addrs.vendor_id != CEC_VENDOR_ID_NONE) {
++ cec_msg_device_vendor_id(&msg,
++ adap->log_addrs.vendor_id);
++ cec_transmit_msg_fh(adap, &msg, NULL, false);
++ }
+ }
+ adap->kthread_config = NULL;
+ complete(&adap->config_completion);
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index 4b0220f40b42..fccc771d23a5 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -17,6 +17,7 @@
+ #include <linux/firmware.h>
+ #include <linux/gcd.h>
+ #include <linux/genalloc.h>
++#include <linux/idr.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+ #include <linux/irq.h>
+@@ -2101,17 +2102,6 @@ int coda_decoder_queue_init(void *priv, struct vb2_queue *src_vq,
+ return coda_queue_init(priv, dst_vq);
+ }
+
+-static int coda_next_free_instance(struct coda_dev *dev)
+-{
+- int idx = ffz(dev->instance_mask);
+-
+- if ((idx < 0) ||
+- (dev->devtype->product == CODA_DX6 && idx > CODADX6_MAX_INSTANCES))
+- return -EBUSY;
+-
+- return idx;
+-}
+-
+ /*
+ * File operations
+ */
+@@ -2120,7 +2110,8 @@ static int coda_open(struct file *file)
+ {
+ struct video_device *vdev = video_devdata(file);
+ struct coda_dev *dev = video_get_drvdata(vdev);
+- struct coda_ctx *ctx = NULL;
++ struct coda_ctx *ctx;
++ unsigned int max = ~0;
+ char *name;
+ int ret;
+ int idx;
+@@ -2129,12 +2120,13 @@ static int coda_open(struct file *file)
+ if (!ctx)
+ return -ENOMEM;
+
+- idx = coda_next_free_instance(dev);
++ if (dev->devtype->product == CODA_DX6)
++ max = CODADX6_MAX_INSTANCES - 1;
++ idx = ida_alloc_max(&dev->ida, max, GFP_KERNEL);
+ if (idx < 0) {
+ ret = idx;
+ goto err_coda_max;
+ }
+- set_bit(idx, &dev->instance_mask);
+
+ name = kasprintf(GFP_KERNEL, "context%d", idx);
+ if (!name) {
+@@ -2243,8 +2235,8 @@ err_clk_per:
+ err_pm_get:
+ v4l2_fh_del(&ctx->fh);
+ v4l2_fh_exit(&ctx->fh);
+- clear_bit(ctx->idx, &dev->instance_mask);
+ err_coda_name_init:
++ ida_free(&dev->ida, ctx->idx);
+ err_coda_max:
+ kfree(ctx);
+ return ret;
+@@ -2286,7 +2278,7 @@ static int coda_release(struct file *file)
+ pm_runtime_put_sync(&dev->plat_dev->dev);
+ v4l2_fh_del(&ctx->fh);
+ v4l2_fh_exit(&ctx->fh);
+- clear_bit(ctx->idx, &dev->instance_mask);
++ ida_free(&dev->ida, ctx->idx);
+ if (ctx->ops->release)
+ ctx->ops->release(ctx);
+ debugfs_remove_recursive(ctx->debugfs_entry);
+@@ -2747,6 +2739,7 @@ static int coda_probe(struct platform_device *pdev)
+
+ mutex_init(&dev->dev_mutex);
+ mutex_init(&dev->coda_mutex);
++ ida_init(&dev->ida);
+
+ dev->debugfs_root = debugfs_create_dir("coda", NULL);
+ if (!dev->debugfs_root)
+@@ -2834,6 +2827,7 @@ static int coda_remove(struct platform_device *pdev)
+ coda_free_aux_buf(dev, &dev->tempbuf);
+ coda_free_aux_buf(dev, &dev->workbuf);
+ debugfs_remove_recursive(dev->debugfs_root);
++ ida_destroy(&dev->ida);
+ return 0;
+ }
+
+diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h
+index 2469ca1dc598..8df02c32781e 100644
+--- a/drivers/media/platform/coda/coda.h
++++ b/drivers/media/platform/coda/coda.h
+@@ -16,6 +16,7 @@
+ #define __CODA_H__
+
+ #include <linux/debugfs.h>
++#include <linux/idr.h>
+ #include <linux/irqreturn.h>
+ #include <linux/mutex.h>
+ #include <linux/kfifo.h>
+@@ -95,7 +96,7 @@ struct coda_dev {
+ struct workqueue_struct *workqueue;
+ struct v4l2_m2m_dev *m2m_dev;
+ struct list_head instances;
+- unsigned long instance_mask;
++ struct ida ida;
+ struct dentry *debugfs_root;
+ };
+
+diff --git a/drivers/media/platform/vimc/vimc-common.c b/drivers/media/platform/vimc/vimc-common.c
+index 204aa6f554e4..fa8435ac2b1a 100644
+--- a/drivers/media/platform/vimc/vimc-common.c
++++ b/drivers/media/platform/vimc/vimc-common.c
+@@ -241,6 +241,8 @@ int vimc_pipeline_s_stream(struct media_entity *ent, int enable)
+
+ /* Start the stream in the subdevice direct connected */
+ pad = media_entity_remote_pad(&ent->pads[i]);
++ if (!pad)
++ continue;
+
+ if (!is_media_entity_v4l2_subdev(pad->entity))
+ return -EINVAL;
+diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c
+index 11ce5101e19f..c43730977f53 100644
+--- a/drivers/media/spi/cxd2880-spi.c
++++ b/drivers/media/spi/cxd2880-spi.c
+@@ -536,6 +536,7 @@ cxd2880_spi_probe(struct spi_device *spi)
+
+ if (!dvb_attach(cxd2880_attach, &dvb_spi->dvb_fe, &config)) {
+ pr_err("cxd2880_attach failed\n");
++ ret = -ENODEV;
+ goto fail_attach;
+ }
+
+diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+index 350635826aae..6e3bdd71e273 100644
+--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c
++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+@@ -585,7 +585,7 @@ unlock:
+ else
+ pulse8->config_pending = true;
+ mutex_unlock(&pulse8->config_lock);
+- return err;
++ return log_addr == CEC_LOG_ADDR_INVALID ? 0 : err;
+ }
+
+ static int pulse8_cec_adap_transmit(struct cec_adapter *adap, u8 attempts,
+diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
+index 6e3f234e790b..e33fa78ef98d 100644
+--- a/drivers/media/usb/stkwebcam/stk-webcam.c
++++ b/drivers/media/usb/stkwebcam/stk-webcam.c
+@@ -164,7 +164,11 @@ int stk_camera_read_reg(struct stk_camera *dev, u16 index, u8 *value)
+ *value = *buf;
+
+ kfree(buf);
+- return ret;
++
++ if (ret < 0)
++ return ret;
++ else
++ return 0;
+ }
+
+ static int stk_start_stream(struct stk_camera *dev)
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index cf4feff2a48c..063e229ead5e 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -390,6 +390,39 @@ static struct uvc_streaming *uvc_stream_by_id(struct uvc_device *dev, int id)
+ return NULL;
+ }
+
++/* ------------------------------------------------------------------------
++ * Streaming Object Management
++ */
++
++static void uvc_stream_delete(struct uvc_streaming *stream)
++{
++ mutex_destroy(&stream->mutex);
++
++ usb_put_intf(stream->intf);
++
++ kfree(stream->format);
++ kfree(stream->header.bmaControls);
++ kfree(stream);
++}
++
++static struct uvc_streaming *uvc_stream_new(struct uvc_device *dev,
++ struct usb_interface *intf)
++{
++ struct uvc_streaming *stream;
++
++ stream = kzalloc(sizeof(*stream), GFP_KERNEL);
++ if (stream == NULL)
++ return NULL;
++
++ mutex_init(&stream->mutex);
++
++ stream->dev = dev;
++ stream->intf = usb_get_intf(intf);
++ stream->intfnum = intf->cur_altsetting->desc.bInterfaceNumber;
++
++ return stream;
++}
++
+ /* ------------------------------------------------------------------------
+ * Descriptors parsing
+ */
+@@ -682,17 +715,12 @@ static int uvc_parse_streaming(struct uvc_device *dev,
+ return -EINVAL;
+ }
+
+- streaming = kzalloc(sizeof(*streaming), GFP_KERNEL);
++ streaming = uvc_stream_new(dev, intf);
+ if (streaming == NULL) {
+ usb_driver_release_interface(&uvc_driver.driver, intf);
+- return -EINVAL;
++ return -ENOMEM;
+ }
+
+- mutex_init(&streaming->mutex);
+- streaming->dev = dev;
+- streaming->intf = usb_get_intf(intf);
+- streaming->intfnum = intf->cur_altsetting->desc.bInterfaceNumber;
+-
+ /* The Pico iMage webcam has its class-specific interface descriptors
+ * after the endpoint descriptors.
+ */
+@@ -899,10 +927,7 @@ static int uvc_parse_streaming(struct uvc_device *dev,
+
+ error:
+ usb_driver_release_interface(&uvc_driver.driver, intf);
+- usb_put_intf(intf);
+- kfree(streaming->format);
+- kfree(streaming->header.bmaControls);
+- kfree(streaming);
++ uvc_stream_delete(streaming);
+ return ret;
+ }
+
+@@ -1818,7 +1843,7 @@ static int uvc_scan_device(struct uvc_device *dev)
+ * is released.
+ *
+ * As this function is called after or during disconnect(), all URBs have
+- * already been canceled by the USB core. There is no need to kill the
++ * already been cancelled by the USB core. There is no need to kill the
+ * interrupt URB manually.
+ */
+ static void uvc_delete(struct kref *kref)
+@@ -1856,10 +1881,7 @@ static void uvc_delete(struct kref *kref)
+ streaming = list_entry(p, struct uvc_streaming, list);
+ usb_driver_release_interface(&uvc_driver.driver,
+ streaming->intf);
+- usb_put_intf(streaming->intf);
+- kfree(streaming->format);
+- kfree(streaming->header.bmaControls);
+- kfree(streaming);
++ uvc_stream_delete(streaming);
+ }
+
+ kfree(dev);
+diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c
+index ef83a9078646..d2ed3b9728b7 100644
+--- a/drivers/misc/altera-stapl/altera.c
++++ b/drivers/misc/altera-stapl/altera.c
+@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 program_size,
+ key_ptr = &p[note_strings +
+ get_unaligned_be32(
+ &p[note_table + (8 * i)])];
+- if ((strncasecmp(key, key_ptr, strlen(key_ptr)) == 0) &&
+- (key != NULL)) {
++ if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) {
+ status = 0;
+
+ value_ptr = &p[note_strings +
+diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
+index 5d338b2ac39e..cf0769ad39cd 100644
+--- a/drivers/net/can/slcan.c
++++ b/drivers/net/can/slcan.c
+@@ -613,6 +613,7 @@ err_free_chan:
+ sl->tty = NULL;
+ tty->disc_data = NULL;
+ clear_bit(SLF_INUSE, &sl->flags);
++ slc_free_netdev(sl->dev);
+ free_netdev(sl->dev);
+
+ err_exit:
+diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c
+index c9fd83e8d947..43350f56e223 100644
+--- a/drivers/net/can/usb/ucan.c
++++ b/drivers/net/can/usb/ucan.c
+@@ -796,7 +796,7 @@ resubmit:
+ up);
+
+ usb_anchor_urb(urb, &up->rx_urbs);
+- ret = usb_submit_urb(urb, GFP_KERNEL);
++ ret = usb_submit_urb(urb, GFP_ATOMIC);
+
+ if (ret < 0) {
+ netdev_err(up->netdev,
+diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
+index 3df23487487f..b01c6da4dd81 100644
+--- a/drivers/net/can/xilinx_can.c
++++ b/drivers/net/can/xilinx_can.c
+@@ -612,7 +612,7 @@ static int xcan_start_xmit_mailbox(struct sk_buff *skb, struct net_device *ndev)
+ *
+ * Return: NETDEV_TX_OK on success and NETDEV_TX_BUSY when the tx queue is full
+ */
+-static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct xcan_priv *priv = netdev_priv(ndev);
+ int ret;
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 411ae9961bf4..43b00e8bcdcd 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2645,11 +2645,22 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg)
+ mutex_unlock(&chip->reg_lock);
+
+ if (reg == MII_PHYSID2) {
+- /* Some internal PHYS don't have a model number. Use
+- * the mv88e6390 family model number instead.
+- */
+- if (!(val & 0x3f0))
+- val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4;
++ /* Some internal PHYs don't have a model number. */
++ if (chip->info->family != MV88E6XXX_FAMILY_6165)
++ /* Then there is the 6165 family. It gets is
++ * PHYs correct. But it can also have two
++ * SERDES interfaces in the PHY address
++ * space. And these don't have a model
++ * number. But they are not PHYs, so we don't
++ * want to give them something a PHY driver
++ * will recognise.
++ *
++ * Use the mv88e6390 family model number
++ * instead, for anything which really could be
++ * a PHY,
++ */
++ if (!(val & 0x3f0))
++ val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4;
+ }
+
+ return err ? err : val;
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+index 91eb8910b1c9..90a0e1d0d622 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+@@ -42,8 +42,8 @@
+ #define AQ_CFG_IS_LRO_DEF 1U
+
+ /* RSS */
+-#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 128U
+-#define AQ_CFG_RSS_HASHKEY_SIZE 320U
++#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 64U
++#define AQ_CFG_RSS_HASHKEY_SIZE 40U
+
+ #define AQ_CFG_IS_RSS_DEF 1U
+ #define AQ_CFG_NUM_RSS_QUEUES_DEF AQ_CFG_VECS_DEF
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index 4f34808f1e06..8cc34b0bedc3 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -44,7 +44,7 @@ static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues)
+ struct aq_rss_parameters *rss_params = &cfg->aq_rss;
+ int i = 0;
+
+- static u8 rss_key[40] = {
++ static u8 rss_key[AQ_CFG_RSS_HASHKEY_SIZE] = {
+ 0x1e, 0xad, 0x71, 0x87, 0x65, 0xfc, 0x26, 0x7d,
+ 0x0d, 0x45, 0x67, 0x74, 0xcd, 0x06, 0x1a, 0x18,
+ 0xb6, 0xc1, 0xf0, 0xc7, 0xbb, 0x18, 0xbe, 0xf8,
+diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+index ff84791a0ff8..972dc7bd721d 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+@@ -722,6 +722,10 @@ static int adapter_up(struct adapter *adapter)
+
+ if (adapter->flags & USING_MSIX)
+ name_msix_vecs(adapter);
++
++ /* Initialize hash mac addr list*/
++ INIT_LIST_HEAD(&adapter->mac_hlist);
++
+ adapter->flags |= FULL_INIT_DONE;
+ }
+
+@@ -747,8 +751,6 @@ static int adapter_up(struct adapter *adapter)
+ enable_rx(adapter);
+ t4vf_sge_start(adapter);
+
+- /* Initialize hash mac addr list*/
+- INIT_LIST_HEAD(&adapter->mac_hlist);
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c
+index 13dfdfca49fc..edc1d19c9c02 100644
+--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c
++++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c
+@@ -767,6 +767,7 @@ static int ep93xx_eth_remove(struct platform_device *pdev)
+ {
+ struct net_device *dev;
+ struct ep93xx_priv *ep;
++ struct resource *mem;
+
+ dev = platform_get_drvdata(pdev);
+ if (dev == NULL)
+@@ -782,8 +783,8 @@ static int ep93xx_eth_remove(struct platform_device *pdev)
+ iounmap(ep->base_addr);
+
+ if (ep->res != NULL) {
+- release_resource(ep->res);
+- kfree(ep->res);
++ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ release_mem_region(mem->start, resource_size(mem));
+ }
+
+ free_netdev(dev);
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+index 4a8f82938ed5..2352046971a4 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+@@ -600,9 +600,6 @@ static int add_mac_addr(struct net_device *netdev, const u8 *addr)
+ u16 vid = 0;
+ int err;
+
+- if (!is_valid_ether_addr(addr))
+- return -EADDRNOTAVAIL;
+-
+ netif_info(nic_dev, drv, netdev, "set mac addr = %02x %02x %02x %02x %02x %02x\n",
+ addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+
+@@ -726,6 +723,7 @@ static void set_rx_mode(struct work_struct *work)
+ {
+ struct hinic_rx_mode_work *rx_mode_work = work_to_rx_mode_work(work);
+ struct hinic_dev *nic_dev = rx_mode_work_to_nic_dev(rx_mode_work);
++ struct netdev_hw_addr *ha;
+
+ netif_info(nic_dev, drv, nic_dev->netdev, "set rx mode work\n");
+
+@@ -733,6 +731,9 @@ static void set_rx_mode(struct work_struct *work)
+
+ __dev_uc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr);
+ __dev_mc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr);
++
++ netdev_for_each_mc_addr(ha, nic_dev->netdev)
++ add_mac_addr(nic_dev->netdev, ha->addr);
+ }
+
+ static void hinic_set_rx_mode(struct net_device *netdev)
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_rx.c b/drivers/net/ethernet/huawei/hinic/hinic_rx.c
+index 4c0f7eda1166..06b24a92ed7d 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_rx.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_rx.c
+@@ -207,9 +207,9 @@ skb_out:
+ wmb(); /* write all the wqes before update PI */
+
+ hinic_rq_update(rxq->rq, prod_idx);
++ tasklet_schedule(&rxq->rx_task);
+ }
+
+- tasklet_schedule(&rxq->rx_task);
+ return i;
+ }
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 5ff6caa83948..a6b0f605a7d8 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -1136,6 +1136,7 @@ static int i40e_set_pauseparam(struct net_device *netdev,
+ i40e_status status;
+ u8 aq_failures;
+ int err = 0;
++ u32 is_an;
+
+ /* Changing the port's flow control is not supported if this isn't the
+ * port's controlling PF
+@@ -1148,15 +1149,14 @@ static int i40e_set_pauseparam(struct net_device *netdev,
+ if (vsi != pf->vsi[pf->lan_vsi])
+ return -EOPNOTSUPP;
+
+- if (pause->autoneg != ((hw_link_info->an_info & I40E_AQ_AN_COMPLETED) ?
+- AUTONEG_ENABLE : AUTONEG_DISABLE)) {
++ is_an = hw_link_info->an_info & I40E_AQ_AN_COMPLETED;
++ if (pause->autoneg != is_an) {
+ netdev_info(netdev, "To change autoneg please use: ethtool -s <dev> autoneg <on|off>\n");
+ return -EOPNOTSUPP;
+ }
+
+ /* If we have link and don't have autoneg */
+- if (!test_bit(__I40E_DOWN, pf->state) &&
+- !(hw_link_info->an_info & I40E_AQ_AN_COMPLETED)) {
++ if (!test_bit(__I40E_DOWN, pf->state) && !is_an) {
+ /* Send message that it might not necessarily work*/
+ netdev_info(netdev, "Autoneg did not complete so changing settings may not result in an actual change.\n");
+ }
+@@ -1207,7 +1207,7 @@ static int i40e_set_pauseparam(struct net_device *netdev,
+ err = -EAGAIN;
+ }
+
+- if (!test_bit(__I40E_DOWN, pf->state)) {
++ if (!test_bit(__I40E_DOWN, pf->state) && is_an) {
+ /* Give it a little more time to try to come back */
+ msleep(75);
+ if (!test_bit(__I40E_DOWN, pf->state))
+diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+index a0614f472658..328d293bc3ff 100644
+--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+@@ -1056,10 +1056,10 @@ struct ice_aqc_nvm {
+ #define ICE_AQC_NVM_LAST_CMD BIT(0)
+ #define ICE_AQC_NVM_PCIR_REQ BIT(0) /* Used by NVM Update reply */
+ #define ICE_AQC_NVM_PRESERVATION_S 1
+-#define ICE_AQC_NVM_PRESERVATION_M (3 << CSR_AQ_NVM_PRESERVATION_S)
+-#define ICE_AQC_NVM_NO_PRESERVATION (0 << CSR_AQ_NVM_PRESERVATION_S)
++#define ICE_AQC_NVM_PRESERVATION_M (3 << ICE_AQC_NVM_PRESERVATION_S)
++#define ICE_AQC_NVM_NO_PRESERVATION (0 << ICE_AQC_NVM_PRESERVATION_S)
+ #define ICE_AQC_NVM_PRESERVE_ALL BIT(1)
+-#define ICE_AQC_NVM_PRESERVE_SELECTED (3 << CSR_AQ_NVM_PRESERVATION_S)
++#define ICE_AQC_NVM_PRESERVE_SELECTED (3 << ICE_AQC_NVM_PRESERVATION_S)
+ #define ICE_AQC_NVM_FLASH_ONLY BIT(7)
+ __le16 module_typeid;
+ __le16 length;
+diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c
+index 4012adbab011..1bfc59dff51f 100644
+--- a/drivers/net/ethernet/intel/ice/ice_switch.c
++++ b/drivers/net/ethernet/intel/ice/ice_switch.c
+@@ -1023,6 +1023,9 @@ ice_handle_vsi_list_mgmt(struct ice_hw *hw,
+ u16 vsi_id = new_fltr->fwd_id.vsi_id;
+ enum ice_adminq_opc opcode;
+
++ if (!m_entry->vsi_list_info)
++ return ICE_ERR_CFG;
++
+ /* A rule already exists with the new VSI being added */
+ if (test_bit(vsi_id, m_entry->vsi_list_info->vsi_map))
+ return 0;
+diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
+index 0c95c8f83432..1d84fedf1f64 100644
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
+@@ -1106,7 +1106,8 @@ int ice_napi_poll(struct napi_struct *napi, int budget)
+ napi_complete_done(napi, work_done);
+ if (test_bit(ICE_FLAG_MSIX_ENA, pf->flags))
+ ice_irq_dynamic_ena(&vsi->back->hw, vsi, q_vector);
+- return 0;
++
++ return min(work_done, budget - 1);
+ }
+
+ /* helper function for building cmd/type/offset */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index 6a046030e873..4afe56a6eedf 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -313,7 +313,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev,
+ for (i = 0; i < dev->caps.num_ports - 1; i++) {
+ if (port_type[i] != port_type[i + 1]) {
+ mlx4_err(dev, "Only same port types supported on this HCA, aborting\n");
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ }
+ }
+ }
+@@ -322,7 +322,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev,
+ if (!(port_type[i] & dev->caps.supported_type[i+1])) {
+ mlx4_err(dev, "Requested port type for port %d is not supported on this HCA\n",
+ i + 1);
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ }
+ }
+ return 0;
+@@ -1188,8 +1188,7 @@ static int __set_port_type(struct mlx4_port_info *info,
+ mlx4_err(mdev,
+ "Requested port type for port %d is not supported on this HCA\n",
+ info->port);
+- err = -EINVAL;
+- goto err_sup;
++ return -EOPNOTSUPP;
+ }
+
+ mlx4_stop_sense(mdev);
+@@ -1211,7 +1210,7 @@ static int __set_port_type(struct mlx4_port_info *info,
+ for (i = 1; i <= mdev->caps.num_ports; i++) {
+ if (mdev->caps.possible_type[i] == MLX4_PORT_TYPE_AUTO) {
+ mdev->caps.possible_type[i] = mdev->caps.port_type[i];
+- err = -EINVAL;
++ err = -EOPNOTSUPP;
+ }
+ }
+ }
+@@ -1237,7 +1236,7 @@ static int __set_port_type(struct mlx4_port_info *info,
+ out:
+ mlx4_start_sense(mdev);
+ mutex_unlock(&priv->port_mutex);
+-err_sup:
++
+ return err;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+index 4ca07bfb6b14..f33707ce8b6b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+@@ -132,7 +132,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type)
+ if (!is_event_type_allowed((rsn >> MLX5_USER_INDEX_LEN), event_type)) {
+ mlx5_core_warn(dev, "event 0x%.2x is not allowed on resource 0x%.8x\n",
+ event_type, rsn);
+- return;
++ goto out;
+ }
+
+ switch (common->res) {
+@@ -150,7 +150,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type)
+ default:
+ mlx5_core_warn(dev, "invalid resource type for 0x%x\n", rsn);
+ }
+-
++out:
+ mlx5_core_put_rsc(common);
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+index 3f54b3ca38ba..44b6c2ac5961 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -1215,15 +1215,12 @@ mlxsw_sp_ipip_entry_matches_decap(struct mlxsw_sp *mlxsw_sp,
+ {
+ u32 ul_tb_id = l3mdev_fib_table(ul_dev) ? : RT_TABLE_MAIN;
+ enum mlxsw_sp_ipip_type ipipt = ipip_entry->ipipt;
+- struct net_device *ipip_ul_dev;
+
+ if (mlxsw_sp->router->ipip_ops_arr[ipipt]->ul_proto != ul_proto)
+ return false;
+
+- ipip_ul_dev = __mlxsw_sp_ipip_netdev_ul_dev_get(ipip_entry->ol_dev);
+ return mlxsw_sp_ipip_entry_saddr_matches(mlxsw_sp, ul_proto, ul_dip,
+- ul_tb_id, ipip_entry) &&
+- (!ipip_ul_dev || ipip_ul_dev == ul_dev);
++ ul_tb_id, ipip_entry);
+ }
+
+ /* Given decap parameters, find the corresponding IPIP entry. */
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+index f66d1255e36a..4c476fac7835 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+@@ -301,10 +301,13 @@ static int rmnet_changelink(struct net_device *dev, struct nlattr *tb[],
+ struct rmnet_port *port;
+ u16 mux_id;
+
++ if (!dev)
++ return -ENODEV;
++
+ real_dev = __dev_get_by_index(dev_net(dev),
+ nla_get_u32(tb[IFLA_LINK]));
+
+- if (!real_dev || !dev || !rmnet_is_real_dev_registered(real_dev))
++ if (!real_dev || !rmnet_is_real_dev_registered(real_dev))
+ return -ENODEV;
+
+ port = rmnet_get_port_rtnl(real_dev);
+diff --git a/drivers/net/ethernet/renesas/ravb.h b/drivers/net/ethernet/renesas/ravb.h
+index 9b6bf557a2f5..e04af9546e52 100644
+--- a/drivers/net/ethernet/renesas/ravb.h
++++ b/drivers/net/ethernet/renesas/ravb.h
+@@ -1029,7 +1029,6 @@ struct ravb_private {
+ phy_interface_t phy_interface;
+ int msg_enable;
+ int speed;
+- int duplex;
+ int emac_irq;
+ enum ravb_chip_id chip_id;
+ int rx_irqs[NUM_RX_QUEUE];
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 5462d2e8a1b7..faaf74073a12 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -82,13 +82,6 @@ static int ravb_config(struct net_device *ndev)
+ return error;
+ }
+
+-static void ravb_set_duplex(struct net_device *ndev)
+-{
+- struct ravb_private *priv = netdev_priv(ndev);
+-
+- ravb_modify(ndev, ECMR, ECMR_DM, priv->duplex ? ECMR_DM : 0);
+-}
+-
+ static void ravb_set_rate(struct net_device *ndev)
+ {
+ struct ravb_private *priv = netdev_priv(ndev);
+@@ -398,13 +391,11 @@ error:
+ /* E-MAC init function */
+ static void ravb_emac_init(struct net_device *ndev)
+ {
+- struct ravb_private *priv = netdev_priv(ndev);
+-
+ /* Receive frame limit set register */
+ ravb_write(ndev, ndev->mtu + ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN, RFLR);
+
+ /* EMAC Mode: PAUSE prohibition; Duplex; RX Checksum; TX; RX */
+- ravb_write(ndev, ECMR_ZPF | (priv->duplex ? ECMR_DM : 0) |
++ ravb_write(ndev, ECMR_ZPF | ECMR_DM |
+ (ndev->features & NETIF_F_RXCSUM ? ECMR_RCSC : 0) |
+ ECMR_TE | ECMR_RE, ECMR);
+
+@@ -992,12 +983,6 @@ static void ravb_adjust_link(struct net_device *ndev)
+ ravb_rcv_snd_disable(ndev);
+
+ if (phydev->link) {
+- if (phydev->duplex != priv->duplex) {
+- new_state = true;
+- priv->duplex = phydev->duplex;
+- ravb_set_duplex(ndev);
+- }
+-
+ if (phydev->speed != priv->speed) {
+ new_state = true;
+ priv->speed = phydev->speed;
+@@ -1012,7 +997,6 @@ static void ravb_adjust_link(struct net_device *ndev)
+ new_state = true;
+ priv->link = 0;
+ priv->speed = 0;
+- priv->duplex = -1;
+ }
+
+ /* Enable TX and RX right over here, if E-MAC change is ignored */
+@@ -1042,7 +1026,6 @@ static int ravb_phy_init(struct net_device *ndev)
+
+ priv->link = 0;
+ priv->speed = 0;
+- priv->duplex = -1;
+
+ /* Try connecting to PHY */
+ pn = of_parse_phandle(np, "phy-handle", 0);
+diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
+index 4f644ac314fe..d7543811dfae 100644
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -119,9 +119,7 @@ static bool cpts_match_tx_ts(struct cpts *cpts, struct cpts_event *event)
+
+ if (time_after(jiffies, skb_cb->tmo)) {
+ /* timeout any expired skbs over 1s */
+- dev_dbg(cpts->dev,
+- "expiring tx timestamp mtype %u seqid %04x\n",
+- mtype, seqid);
++ dev_dbg(cpts->dev, "expiring tx timestamp from txq\n");
+ __skb_unlink(skb, &cpts->txq);
+ dev_consume_skb_any(skb);
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+index a0de61aa0fef..d7335fabd929 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+@@ -321,7 +321,6 @@ MODULE_FIRMWARE(IWL_22000_HR_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+-MODULE_FIRMWARE(IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+index 421a869633a3..2e512f6e9ebc 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+@@ -8,6 +8,7 @@
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 Intel Deutschland GmbH
++ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -35,6 +36,7 @@
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 Intel Deutschland GmbH
++ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -399,6 +401,7 @@ enum aux_misc_master1_en {
+ #define AUX_MISC_MASTER1_SMPHR_STATUS 0xA20800
+ #define RSA_ENABLE 0xA24B08
+ #define PREG_AUX_BUS_WPROT_0 0xA04CC0
++#define PREG_PRPH_WPROT_0 0xA04CE0
+ #define SB_CPU_1_STATUS 0xA01E30
+ #define SB_CPU_2_STATUS 0xA01E34
+ #define UMAG_SB_CPU_1_STATUS 0xA038C0
+@@ -425,4 +428,8 @@ enum {
+ #define UREG_CHICK (0xA05C00)
+ #define UREG_CHICK_MSI_ENABLE BIT(24)
+ #define UREG_CHICK_MSIX_ENABLE BIT(25)
++
++#define HPM_DEBUG 0xA03440
++#define PERSISTENCE_BIT BIT(12)
++#define PREG_WFPM_ACCESS BIT(12)
+ #endif /* __iwl_prph_h__ */
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 0f357e8c4f94..476c44db0e64 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -820,6 +820,21 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
+ !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
+ sta = NULL;
+
++ /* If there is no sta, and it's not offchannel - send through AP */
++ if (info->control.vif->type == NL80211_IFTYPE_STATION &&
++ info->hw_queue != IWL_MVM_OFFCHANNEL_QUEUE && !sta) {
++ struct iwl_mvm_vif *mvmvif =
++ iwl_mvm_vif_from_mac80211(info->control.vif);
++ u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id);
++
++ if (ap_sta_id < IWL_MVM_STATION_COUNT) {
++ /* mac80211 holds rcu read lock */
++ sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
++ if (IS_ERR_OR_NULL(sta))
++ goto drop;
++ }
++ }
++
+ if (sta) {
+ if (iwl_mvm_defer_tx(mvm, sta, skb))
+ return;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index 04ea516bddcc..e850aa504b60 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -440,6 +440,16 @@ static int iwl_mvm_remove_sta_queue_marking(struct iwl_mvm *mvm, int queue)
+
+ rcu_read_unlock();
+
++ /*
++ * The TX path may have been using this TXQ_ID from the tid_data,
++ * so make sure it's no longer running so that we can safely reuse
++ * this TXQ later. We've set all the TIDs to IWL_MVM_INVALID_QUEUE
++ * above, but nothing guarantees we've stopped using them. Thus,
++ * without this, we could get to iwl_mvm_disable_txq() and remove
++ * the queue while still sending frames to it.
++ */
++ synchronize_net();
++
+ return disable_agg_tids;
+ }
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 0982bd99b1c3..844a1009484f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -888,7 +888,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x34F0, 0x0040, iwl22000_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x34F0, 0x0070, iwl22000_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x34F0, 0x0078, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22000_2ac_cfg_jf)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22000_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x40C0, 0x0000, iwl22560_2ax_cfg_su_cdb)},
+ {IWL_PCI_DEVICE(0x40C0, 0x0010, iwl22560_2ax_cfg_su_cdb)},
+ {IWL_PCI_DEVICE(0x40c0, 0x0090, iwl22560_2ax_cfg_su_cdb)},
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 954f932e9c88..4f5571123f70 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1747,6 +1747,7 @@ static int iwl_pcie_init_msix_handler(struct pci_dev *pdev,
+ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++ u32 hpm;
+ int err;
+
+ lockdep_assert_held(&trans_pcie->mutex);
+@@ -1757,6 +1758,17 @@ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
+ return err;
+ }
+
++ hpm = iwl_trans_read_prph(trans, HPM_DEBUG);
++ if (hpm != 0xa5a5a5a0 && (hpm & PERSISTENCE_BIT)) {
++ if (iwl_trans_read_prph(trans, PREG_PRPH_WPROT_0) &
++ PREG_WFPM_ACCESS) {
++ IWL_ERR(trans,
++ "Error, can not clear persistence bit\n");
++ return -EPERM;
++ }
++ iwl_trans_write_prph(trans, HPM_DEBUG, hpm & ~PERSISTENCE_BIT);
++ }
++
+ iwl_trans_pcie_sw_reset(trans);
+
+ err = iwl_pcie_apm_init(trans);
+@@ -3403,8 +3415,26 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ #if IS_ENABLED(CONFIG_IWLMVM)
+ trans->hw_rf_id = iwl_read32(trans, CSR_HW_RF_ID);
+
+- if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
+- CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
++ if (cfg == &iwl22000_2ax_cfg_hr) {
++ if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
++ trans->cfg = &iwl22000_2ax_cfg_hr;
++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_JF)) {
++ trans->cfg = &iwl22000_2ax_cfg_jf;
++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HRCDB)) {
++ IWL_ERR(trans, "RF ID HRCDB is not supported\n");
++ ret = -EINVAL;
++ goto out_no_pci;
++ } else {
++ IWL_ERR(trans, "Unrecognized RF ID 0x%08x\n",
++ CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id));
++ ret = -EINVAL;
++ goto out_no_pci;
++ }
++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
+ u32 hw_status;
+
+ hw_status = iwl_read_prph(trans, UMAG_GEN_HW_STATUS);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+index 316e2ba0c34d..7b1dff92b709 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+@@ -242,27 +242,23 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
+ struct ieee80211_hdr *hdr = (void *)skb->data;
+ unsigned int snap_ip_tcp_hdrlen, ip_hdrlen, total_len, hdr_room;
+ unsigned int mss = skb_shinfo(skb)->gso_size;
+- u16 length, iv_len, amsdu_pad;
++ u16 length, amsdu_pad;
+ u8 *start_hdr;
+ struct iwl_tso_hdr_page *hdr_page;
+ struct page **page_ptr;
+ struct tso_t tso;
+
+- /* if the packet is protected, then it must be CCMP or GCMP */
+- iv_len = ieee80211_has_protected(hdr->frame_control) ?
+- IEEE80211_CCMP_HDR_LEN : 0;
+-
+ trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd),
+ &dev_cmd->hdr, start_len, 0);
+
+ ip_hdrlen = skb_transport_header(skb) - skb_network_header(skb);
+ snap_ip_tcp_hdrlen = 8 + ip_hdrlen + tcp_hdrlen(skb);
+- total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len - iv_len;
++ total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len;
+ amsdu_pad = 0;
+
+ /* total amount of header we may need for this A-MSDU */
+ hdr_room = DIV_ROUND_UP(total_len, mss) *
+- (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len;
++ (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr));
+
+ /* Our device supports 9 segments at most, it will fit in 1 page */
+ hdr_page = get_page_hdr(trans, hdr_room);
+@@ -273,14 +269,12 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
+ start_hdr = hdr_page->pos;
+ page_ptr = (void *)((u8 *)skb->cb + trans_pcie->page_offs);
+ *page_ptr = hdr_page->page;
+- memcpy(hdr_page->pos, skb->data + hdr_len, iv_len);
+- hdr_page->pos += iv_len;
+
+ /*
+- * Pull the ieee80211 header + IV to be able to use TSO core,
++ * Pull the ieee80211 header to be able to use TSO core,
+ * we will restore it for the tx_status flow.
+ */
+- skb_pull(skb, hdr_len + iv_len);
++ skb_pull(skb, hdr_len);
+
+ /*
+ * Remove the length of all the headers that we don't actually
+@@ -355,8 +349,8 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
+ }
+ }
+
+- /* re -add the WiFi header and IV */
+- skb_push(skb, hdr_len + iv_len);
++ /* re -add the WiFi header */
++ skb_push(skb, hdr_len);
+
+ return 0;
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
+index 20cee5c397fb..e48b47f42554 100644
+--- a/drivers/net/wireless/marvell/mwifiex/main.c
++++ b/drivers/net/wireless/marvell/mwifiex/main.c
+@@ -960,10 +960,10 @@ int mwifiex_set_mac_address(struct mwifiex_private *priv,
+
+ mac_addr = old_mac_addr;
+
+- if (priv->bss_type == MWIFIEX_BSS_TYPE_P2P)
++ if (priv->bss_type == MWIFIEX_BSS_TYPE_P2P) {
+ mac_addr |= BIT_ULL(MWIFIEX_MAC_LOCAL_ADMIN_BIT);
+-
+- if (mwifiex_get_intf_num(priv->adapter, priv->bss_type) > 1) {
++ mac_addr += priv->bss_num;
++ } else if (priv->adapter->priv[0] != priv) {
+ /* Set mac address based on bss_type/bss_num */
+ mac_addr ^= BIT_ULL(priv->bss_type + 8);
+ mac_addr += priv->bss_num;
+diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+index 1095df7d9573..1a3a5235cfb8 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+@@ -1583,6 +1583,7 @@ static int rsi_send_beacon(struct rsi_common *common)
+ skb_pull(skb, (64 - dword_align_bytes));
+ if (rsi_prepare_beacon(common, skb)) {
+ rsi_dbg(ERR_ZONE, "Failed to prepare beacon\n");
++ dev_kfree_skb(skb);
+ return -EINVAL;
+ }
+ skb_queue_tail(&common->tx_queue[MGMT_BEACON_Q], skb);
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index ba695e392c3b..0df745cad601 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -236,8 +236,10 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id)
+
+ if (r == -EREMOTEIO) {
+ phy->hard_fault = r;
+- skb = NULL;
+- } else if (r < 0) {
++ if (info->mode == NXP_NCI_MODE_FW)
++ nxp_nci_fw_recv_frame(phy->ndev, NULL);
++ }
++ if (r < 0) {
+ nfc_err(&client->dev, "Read failed with error %d\n", r);
+ goto exit_irq_handled;
+ }
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index c4ff4f079448..b2d9bd564960 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3652,7 +3652,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
+
+ return 0;
+ out_free_name:
+- kfree_const(dev->kobj.name);
++ kfree_const(ctrl->device->kobj.name);
+ out_release_instance:
+ ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+ out:
+diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+index 0e153bae322e..6bed433e5420 100644
+--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+@@ -762,12 +762,23 @@ static int pm8xxx_gpio_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- ret = gpiochip_add_pin_range(&pctrl->chip,
+- dev_name(pctrl->dev),
+- 0, 0, pctrl->chip.ngpio);
+- if (ret) {
+- dev_err(pctrl->dev, "failed to add pin range\n");
+- goto unregister_gpiochip;
++ /*
++ * For DeviceTree-supported systems, the gpio core checks the
++ * pinctrl's device node for the "gpio-ranges" property.
++ * If it is present, it takes care of adding the pin ranges
++ * for the driver. In this case the driver can skip ahead.
++ *
++ * In order to remain compatible with older, existing DeviceTree
++ * files which don't set the "gpio-ranges" property or systems that
++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
++ */
++ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) {
++ ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev),
++ 0, 0, pctrl->chip.ngpio);
++ if (ret) {
++ dev_err(pctrl->dev, "failed to add pin range\n");
++ goto unregister_gpiochip;
++ }
+ }
+
+ platform_set_drvdata(pdev, pctrl);
+diff --git a/drivers/rtc/rtc-max77686.c b/drivers/rtc/rtc-max77686.c
+index 8a60900d6b8b..4aff349ae301 100644
+--- a/drivers/rtc/rtc-max77686.c
++++ b/drivers/rtc/rtc-max77686.c
+@@ -360,7 +360,7 @@ static int max77686_rtc_read_time(struct device *dev, struct rtc_time *tm)
+
+ out:
+ mutex_unlock(&info->lock);
+- return 0;
++ return ret;
+ }
+
+ static int max77686_rtc_set_time(struct device *dev, struct rtc_time *tm)
+diff --git a/drivers/rtc/rtc-max8997.c b/drivers/rtc/rtc-max8997.c
+index 08c661a332ec..20e50d9fdf88 100644
+--- a/drivers/rtc/rtc-max8997.c
++++ b/drivers/rtc/rtc-max8997.c
+@@ -215,7 +215,7 @@ static int max8997_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+
+ out:
+ mutex_unlock(&info->lock);
+- return 0;
++ return ret;
+ }
+
+ static int max8997_rtc_stop_alarm(struct max8997_rtc_info *info)
+diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
+index 75c8c5033e08..58e03ac3578b 100644
+--- a/drivers/rtc/rtc-s3c.c
++++ b/drivers/rtc/rtc-s3c.c
+@@ -327,7 +327,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
+ struct rtc_time *tm = &alrm->time;
+ unsigned int alrm_en;
+ int ret;
+- int year = tm->tm_year - 100;
+
+ dev_dbg(dev, "s3c_rtc_setalarm: %d, %04d.%02d.%02d %02d:%02d:%02d\n",
+ alrm->enabled,
+@@ -356,11 +355,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
+ writeb(bin2bcd(tm->tm_hour), info->base + S3C2410_ALMHOUR);
+ }
+
+- if (year < 100 && year >= 0) {
+- alrm_en |= S3C2410_RTCALM_YEAREN;
+- writeb(bin2bcd(year), info->base + S3C2410_ALMYEAR);
+- }
+-
+ if (tm->tm_mon < 12 && tm->tm_mon >= 0) {
+ alrm_en |= S3C2410_RTCALM_MONEN;
+ writeb(bin2bcd(tm->tm_mon + 1), info->base + S3C2410_ALMMON);
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index 332701db7379..f602b42b8343 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -172,9 +172,6 @@ static int zfcp_erp_handle_failed(int want, struct zfcp_adapter *adapter,
+ adapter, ZFCP_STATUS_COMMON_ERP_FAILED);
+ }
+ break;
+- default:
+- need = 0;
+- break;
+ }
+
+ return need;
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index df888506e363..91aa4bfcf8d6 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -2104,11 +2104,8 @@ static void zfcp_fsf_fcp_handler_common(struct zfcp_fsf_req *req,
+ break;
+ case FSF_CMND_LENGTH_NOT_VALID:
+ dev_err(&req->adapter->ccw_device->dev,
+- "Incorrect CDB length %d, LUN 0x%016Lx on "
+- "port 0x%016Lx closed\n",
+- req->qtcb->bottom.io.fcp_cmnd_length,
+- (unsigned long long)zfcp_scsi_dev_lun(sdev),
+- (unsigned long long)zfcp_sdev->port->wwpn);
++ "Incorrect FCP_CMND length %d, FCP device closed\n",
++ req->qtcb->bottom.io.fcp_cmnd_length);
+ zfcp_erp_adapter_shutdown(req->adapter, 0, "fssfch4");
+ req->status |= ZFCP_STATUS_FSFREQ_ERROR;
+ break;
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index d72f8eed2e8b..9221ba7b7863 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1326,11 +1326,12 @@ static int of_qcom_slim_ngd_register(struct device *parent,
+ {
+ const struct ngd_reg_offset_data *data;
+ struct qcom_slim_ngd *ngd;
++ const struct of_device_id *match;
+ struct device_node *node;
+ u32 id;
+
+- data = of_match_node(qcom_slim_ngd_dt_match, parent->of_node)->data;
+-
++ match = of_match_node(qcom_slim_ngd_dt_match, parent->of_node);
++ data = match->data;
+ for_each_available_child_of_node(parent->of_node, node) {
+ if (of_property_read_u32(node, "reg", &id))
+ continue;
+diff --git a/drivers/soc/Makefile b/drivers/soc/Makefile
+index 113e884697fd..f0d46b16e08c 100644
+--- a/drivers/soc/Makefile
++++ b/drivers/soc/Makefile
+@@ -13,7 +13,7 @@ obj-$(CONFIG_ARCH_GEMINI) += gemini/
+ obj-$(CONFIG_ARCH_MXC) += imx/
+ obj-$(CONFIG_SOC_XWAY) += lantiq/
+ obj-y += mediatek/
+-obj-$(CONFIG_ARCH_MESON) += amlogic/
++obj-y += amlogic/
+ obj-y += qcom/
+ obj-y += renesas/
+ obj-$(CONFIG_ARCH_ROCKCHIP) += rockchip/
+diff --git a/drivers/soc/renesas/r8a77970-sysc.c b/drivers/soc/renesas/r8a77970-sysc.c
+index caf894f193ed..77422baa7a56 100644
+--- a/drivers/soc/renesas/r8a77970-sysc.c
++++ b/drivers/soc/renesas/r8a77970-sysc.c
+@@ -27,8 +27,8 @@ static const struct rcar_sysc_area r8a77970_areas[] __initconst = {
+ { "a3ir", 0x180, 0, R8A77970_PD_A3IR, R8A77970_PD_ALWAYS_ON },
+ { "a2ir0", 0x400, 0, R8A77970_PD_A2IR0, R8A77970_PD_A3IR },
+ { "a2ir1", 0x400, 1, R8A77970_PD_A2IR1, R8A77970_PD_A3IR },
+- { "a2ir2", 0x400, 2, R8A77970_PD_A2IR2, R8A77970_PD_A3IR },
+- { "a2ir3", 0x400, 3, R8A77970_PD_A2IR3, R8A77970_PD_A3IR },
++ { "a2dp", 0x400, 2, R8A77970_PD_A2DP, R8A77970_PD_A3IR },
++ { "a2cn", 0x400, 3, R8A77970_PD_A2CN, R8A77970_PD_A3IR },
+ { "a2sc0", 0x400, 4, R8A77970_PD_A2SC0, R8A77970_PD_A3IR },
+ { "a2sc1", 0x400, 5, R8A77970_PD_A2SC1, R8A77970_PD_A3IR },
+ };
+diff --git a/drivers/soc/renesas/r8a77980-sysc.c b/drivers/soc/renesas/r8a77980-sysc.c
+index 9265fb525ef3..a8dbe55e8ba8 100644
+--- a/drivers/soc/renesas/r8a77980-sysc.c
++++ b/drivers/soc/renesas/r8a77980-sysc.c
+@@ -38,12 +38,12 @@ static const struct rcar_sysc_area r8a77980_areas[] __initconst = {
+ { "a2sc2", 0x400, 8, R8A77980_PD_A2SC2, R8A77980_PD_A3IR },
+ { "a2sc3", 0x400, 9, R8A77980_PD_A2SC3, R8A77980_PD_A3IR },
+ { "a2sc4", 0x400, 10, R8A77980_PD_A2SC4, R8A77980_PD_A3IR },
+- { "a2pd0", 0x400, 11, R8A77980_PD_A2PD0, R8A77980_PD_A3IR },
+- { "a2pd1", 0x400, 12, R8A77980_PD_A2PD1, R8A77980_PD_A3IR },
++ { "a2dp0", 0x400, 11, R8A77980_PD_A2DP0, R8A77980_PD_A3IR },
++ { "a2dp1", 0x400, 12, R8A77980_PD_A2DP1, R8A77980_PD_A3IR },
+ { "a2cn", 0x400, 13, R8A77980_PD_A2CN, R8A77980_PD_A3IR },
+- { "a3vip", 0x2c0, 0, R8A77980_PD_A3VIP, R8A77980_PD_ALWAYS_ON },
+- { "a3vip1", 0x300, 0, R8A77980_PD_A3VIP1, R8A77980_PD_A3VIP },
+- { "a3vip2", 0x280, 0, R8A77980_PD_A3VIP2, R8A77980_PD_A3VIP },
++ { "a3vip0", 0x2c0, 0, R8A77980_PD_A3VIP0, R8A77980_PD_ALWAYS_ON },
++ { "a3vip1", 0x300, 0, R8A77980_PD_A3VIP1, R8A77980_PD_ALWAYS_ON },
++ { "a3vip2", 0x280, 0, R8A77980_PD_A3VIP2, R8A77980_PD_ALWAYS_ON },
+ };
+
+ const struct rcar_sysc_info r8a77980_sysc_info __initconst = {
+diff --git a/drivers/soc/renesas/r8a77990-sysc.c b/drivers/soc/renesas/r8a77990-sysc.c
+index 15579ebc5ed2..664b244eb1dd 100644
+--- a/drivers/soc/renesas/r8a77990-sysc.c
++++ b/drivers/soc/renesas/r8a77990-sysc.c
+@@ -28,19 +28,6 @@ static struct rcar_sysc_area r8a77990_areas[] __initdata = {
+ { "3dg-b", 0x100, 1, R8A77990_PD_3DG_B, R8A77990_PD_3DG_A },
+ };
+
+-static void __init rcar_sysc_fix_parent(struct rcar_sysc_area *areas,
+- unsigned int num_areas, u8 id,
+- int new_parent)
+-{
+- unsigned int i;
+-
+- for (i = 0; i < num_areas; i++)
+- if (areas[i].isr_bit == id) {
+- areas[i].parent = new_parent;
+- return;
+- }
+-}
+-
+ /* Fixups for R-Car E3 ES1.0 revision */
+ static const struct soc_device_attribute r8a77990[] __initconst = {
+ { .soc_id = "r8a77990", .revision = "ES1.0" },
+@@ -50,12 +37,10 @@ static const struct soc_device_attribute r8a77990[] __initconst = {
+ static int __init r8a77990_sysc_init(void)
+ {
+ if (soc_device_match(r8a77990)) {
+- rcar_sysc_fix_parent(r8a77990_areas,
+- ARRAY_SIZE(r8a77990_areas),
+- R8A77990_PD_3DG_A, R8A77990_PD_3DG_B);
+- rcar_sysc_fix_parent(r8a77990_areas,
+- ARRAY_SIZE(r8a77990_areas),
+- R8A77990_PD_3DG_B, R8A77990_PD_ALWAYS_ON);
++ /* Fix incorrect 3DG hierarchy */
++ swap(r8a77990_areas[7], r8a77990_areas[8]);
++ r8a77990_areas[7].parent = R8A77990_PD_ALWAYS_ON;
++ r8a77990_areas[8].parent = R8A77990_PD_3DG_B;
+ }
+
+ return 0;
+diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
+index 3f890d162934..2fb43c582559 100644
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -1193,10 +1193,8 @@ static int atmel_spi_setup(struct spi_device *spi)
+ as = spi_master_get_devdata(spi->master);
+
+ /* see notes above re chipselect */
+- if (!atmel_spi_is_v2(as)
+- && spi->chip_select == 0
+- && (spi->mode & SPI_CS_HIGH)) {
+- dev_dbg(&spi->dev, "setup: can't be active-high\n");
++ if (!as->use_cs_gpios && (spi->mode & SPI_CS_HIGH)) {
++ dev_warn(&spi->dev, "setup: non GPIO CS can't be active-high\n");
+ return -EINVAL;
+ }
+
+diff --git a/drivers/staging/iio/addac/adt7316-i2c.c b/drivers/staging/iio/addac/adt7316-i2c.c
+index f66dd3ebbab1..856bcfa60c6c 100644
+--- a/drivers/staging/iio/addac/adt7316-i2c.c
++++ b/drivers/staging/iio/addac/adt7316-i2c.c
+@@ -35,6 +35,8 @@ static int adt7316_i2c_read(void *client, u8 reg, u8 *data)
+ return ret;
+ }
+
++ *data = ret;
++
+ return 0;
+ }
+
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index be3eafc7682b..7b0ffc1c0ea9 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -296,7 +296,7 @@ static void thermal_zone_device_set_polling(struct thermal_zone_device *tz,
+ mod_delayed_work(system_freezable_wq, &tz->poll_queue,
+ msecs_to_jiffies(delay));
+ else
+- cancel_delayed_work_sync(&tz->poll_queue);
++ cancel_delayed_work(&tz->poll_queue);
+ }
+
+ static void monitor_thermal_zone(struct thermal_zone_device *tz)
+@@ -1349,7 +1349,7 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)
+
+ mutex_unlock(&thermal_list_lock);
+
+- thermal_zone_device_set_polling(tz, 0);
++ cancel_delayed_work_sync(&tz->poll_queue);
+
+ thermal_set_governor(tz, NULL);
+
+diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
+index c943716c019e..0636e10c76c7 100644
+--- a/drivers/tty/n_hdlc.c
++++ b/drivers/tty/n_hdlc.c
+@@ -613,7 +613,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
+ }
+
+ /* no data */
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ ret = -EAGAIN;
+ break;
+ }
+@@ -680,7 +680,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
+ if (tbuf)
+ break;
+
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ error = -EAGAIN;
+ break;
+ }
+diff --git a/drivers/tty/n_r3964.c b/drivers/tty/n_r3964.c
+index dbf1ab36758e..a3969b773cbe 100644
+--- a/drivers/tty/n_r3964.c
++++ b/drivers/tty/n_r3964.c
+@@ -1078,7 +1078,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
+ pMsg = remove_msg(pInfo, pClient);
+ if (pMsg == NULL) {
+ /* no messages available. */
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ ret = -EAGAIN;
+ goto unlock;
+ }
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 3ad460219fd6..5dc9686697cf 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -1702,7 +1702,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
+
+ down_read(&tty->termios_rwsem);
+
+- while (1) {
++ do {
+ /*
+ * When PARMRK is set, each input char may take up to 3 chars
+ * in the read buf; reduce the buffer space avail by 3x
+@@ -1744,7 +1744,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
+ fp += n;
+ count -= n;
+ rcvd += n;
+- }
++ } while (!test_bit(TTY_LDISC_CHANGING, &tty->flags));
+
+ tty->receive_room = room;
+
+@@ -2211,7 +2211,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
+ break;
+ if (!timeout)
+ break;
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ retval = -EAGAIN;
+ break;
+ }
+@@ -2365,7 +2365,7 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
+ }
+ if (!nr)
+ break;
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ retval = -EAGAIN;
+ break;
+ }
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index 89ade213a1a9..af21122dfade 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -813,10 +813,8 @@ __acquires(&uap->port.lock)
+ if (!uap->using_tx_dma)
+ return;
+
+- /* Avoid deadlock with the DMA engine callback */
+- spin_unlock(&uap->port.lock);
+- dmaengine_terminate_all(uap->dmatx.chan);
+- spin_lock(&uap->port.lock);
++ dmaengine_terminate_async(uap->dmatx.chan);
++
+ if (uap->dmatx.queued) {
+ dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1,
+ DMA_TO_DEVICE);
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 50b6746a8b5d..ee8a5cb61a5f 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -376,8 +376,8 @@ static void lpuart_dma_tx(struct lpuart_port *sport)
+ }
+
+ sport->dma_tx_desc = dmaengine_prep_slave_sg(sport->dma_tx_chan, sgl,
+- sport->dma_tx_nents,
+- DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT);
++ ret, DMA_MEM_TO_DEV,
++ DMA_PREP_INTERRUPT);
+ if (!sport->dma_tx_desc) {
+ dma_unmap_sg(dev, sgl, sport->dma_tx_nents, DMA_TO_DEVICE);
+ dev_err(dev, "Cannot prepare TX slave DMA!\n");
+diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c
+index ffefd218761e..31033d517e82 100644
+--- a/drivers/tty/serial/ifx6x60.c
++++ b/drivers/tty/serial/ifx6x60.c
+@@ -1230,6 +1230,9 @@ static int ifx_spi_spi_remove(struct spi_device *spi)
+ struct ifx_spi_device *ifx_dev = spi_get_drvdata(spi);
+ /* stop activity */
+ tasklet_kill(&ifx_dev->io_work_tasklet);
++
++ pm_runtime_disable(&spi->dev);
++
+ /* free irq */
+ free_irq(gpio_to_irq(ifx_dev->gpio.reset_out), ifx_dev);
+ free_irq(gpio_to_irq(ifx_dev->gpio.srdy), ifx_dev);
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 105de92b0b3b..989ca7d662f3 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -2071,7 +2071,7 @@ imx_uart_console_setup(struct console *co, char *options)
+
+ retval = clk_prepare(sport->clk_per);
+ if (retval)
+- clk_disable_unprepare(sport->clk_ipg);
++ clk_unprepare(sport->clk_ipg);
+
+ error_console:
+ return retval;
+diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
+index 310bbae515b0..c10d9cc553c6 100644
+--- a/drivers/tty/serial/msm_serial.c
++++ b/drivers/tty/serial/msm_serial.c
+@@ -980,6 +980,7 @@ static unsigned int msm_get_mctrl(struct uart_port *port)
+ static void msm_reset(struct uart_port *port)
+ {
+ struct msm_port *msm_port = UART_TO_MSM(port);
++ unsigned int mr;
+
+ /* reset everything */
+ msm_write(port, UART_CR_CMD_RESET_RX, UART_CR);
+@@ -987,7 +988,10 @@ static void msm_reset(struct uart_port *port)
+ msm_write(port, UART_CR_CMD_RESET_ERR, UART_CR);
+ msm_write(port, UART_CR_CMD_RESET_BREAK_INT, UART_CR);
+ msm_write(port, UART_CR_CMD_RESET_CTS, UART_CR);
+- msm_write(port, UART_CR_CMD_SET_RFR, UART_CR);
++ msm_write(port, UART_CR_CMD_RESET_RFR, UART_CR);
++ mr = msm_read(port, UART_MR1);
++ mr &= ~UART_MR1_RX_RDY_CTL;
++ msm_write(port, mr, UART_MR1);
+
+ /* Disable DM modes */
+ if (msm_port->is_uartdm)
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 69b980bb8ac2..b3f7d1a1e97f 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -113,6 +113,8 @@ struct qcom_geni_serial_port {
+ u32 *rx_fifo;
+ u32 loopback;
+ bool brk;
++
++ unsigned int tx_remaining;
+ };
+
+ static const struct uart_ops qcom_geni_console_pops;
+@@ -435,6 +437,7 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s,
+ struct qcom_geni_serial_port *port;
+ bool locked = true;
+ unsigned long flags;
++ u32 geni_status;
+
+ WARN_ON(co->index < 0 || co->index >= GENI_UART_CONS_PORTS);
+
+@@ -448,6 +451,8 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s,
+ else
+ spin_lock_irqsave(&uport->lock, flags);
+
++ geni_status = readl_relaxed(uport->membase + SE_GENI_STATUS);
++
+ /* Cancel the current write to log the fault */
+ if (!locked) {
+ geni_se_cancel_m_cmd(&port->se);
+@@ -461,9 +466,19 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s,
+ }
+ writel_relaxed(M_CMD_CANCEL_EN, uport->membase +
+ SE_GENI_M_IRQ_CLEAR);
++ } else if ((geni_status & M_GENI_CMD_ACTIVE) && !port->tx_remaining) {
++ /*
++ * It seems we can't interrupt existing transfers if all data
++ * has been sent, in which case we need to look for done first.
++ */
++ qcom_geni_serial_poll_tx_done(uport);
+ }
+
+ __qcom_geni_serial_console_write(uport, s, count);
++
++ if (port->tx_remaining)
++ qcom_geni_serial_setup_tx(uport, port->tx_remaining);
++
+ if (locked)
+ spin_unlock_irqrestore(&uport->lock, flags);
+ }
+@@ -694,40 +709,45 @@ static void qcom_geni_serial_handle_rx(struct uart_port *uport, bool drop)
+ port->handle_rx(uport, total_bytes, drop);
+ }
+
+-static void qcom_geni_serial_handle_tx(struct uart_port *uport)
++static void qcom_geni_serial_handle_tx(struct uart_port *uport, bool done,
++ bool active)
+ {
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+ struct circ_buf *xmit = &uport->state->xmit;
+ size_t avail;
+ size_t remaining;
++ size_t pending;
+ int i;
+ u32 status;
+ unsigned int chunk;
+ int tail;
+- u32 irq_en;
+
+- chunk = uart_circ_chars_pending(xmit);
+ status = readl_relaxed(uport->membase + SE_GENI_TX_FIFO_STATUS);
+- /* Both FIFO and framework buffer are drained */
+- if (!chunk && !status) {
++
++ /* Complete the current tx command before taking newly added data */
++ if (active)
++ pending = port->tx_remaining;
++ else
++ pending = uart_circ_chars_pending(xmit);
++
++ /* All data has been transmitted and acknowledged as received */
++ if (!pending && !status && done) {
+ qcom_geni_serial_stop_tx(uport);
+ goto out_write_wakeup;
+ }
+
+- if (!uart_console(uport)) {
+- irq_en = readl_relaxed(uport->membase + SE_GENI_M_IRQ_EN);
+- irq_en &= ~(M_TX_FIFO_WATERMARK_EN);
+- writel_relaxed(0, uport->membase + SE_GENI_TX_WATERMARK_REG);
+- writel_relaxed(irq_en, uport->membase + SE_GENI_M_IRQ_EN);
+- }
++ avail = port->tx_fifo_depth - (status & TX_FIFO_WC);
++ avail *= port->tx_bytes_pw;
+
+- avail = (port->tx_fifo_depth - port->tx_wm) * port->tx_bytes_pw;
+ tail = xmit->tail;
+- chunk = min3((size_t)chunk, (size_t)(UART_XMIT_SIZE - tail), avail);
++ chunk = min3(avail, pending, (size_t)(UART_XMIT_SIZE - tail));
+ if (!chunk)
+ goto out_write_wakeup;
+
+- qcom_geni_serial_setup_tx(uport, chunk);
++ if (!port->tx_remaining) {
++ qcom_geni_serial_setup_tx(uport, pending);
++ port->tx_remaining = pending;
++ }
+
+ remaining = chunk;
+ for (i = 0; i < chunk; ) {
+@@ -746,11 +766,10 @@ static void qcom_geni_serial_handle_tx(struct uart_port *uport)
+ tail += tx_bytes;
+ uport->icount.tx += tx_bytes;
+ remaining -= tx_bytes;
++ port->tx_remaining -= tx_bytes;
+ }
+
+ xmit->tail = tail & (UART_XMIT_SIZE - 1);
+- if (uart_console(uport))
+- qcom_geni_serial_poll_tx_done(uport);
+ out_write_wakeup:
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(uport);
+@@ -760,6 +779,7 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
+ {
+ unsigned int m_irq_status;
+ unsigned int s_irq_status;
++ unsigned int geni_status;
+ struct uart_port *uport = dev;
+ unsigned long flags;
+ unsigned int m_irq_en;
+@@ -773,6 +793,7 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
+ spin_lock_irqsave(&uport->lock, flags);
+ m_irq_status = readl_relaxed(uport->membase + SE_GENI_M_IRQ_STATUS);
+ s_irq_status = readl_relaxed(uport->membase + SE_GENI_S_IRQ_STATUS);
++ geni_status = readl_relaxed(uport->membase + SE_GENI_STATUS);
+ m_irq_en = readl_relaxed(uport->membase + SE_GENI_M_IRQ_EN);
+ writel_relaxed(m_irq_status, uport->membase + SE_GENI_M_IRQ_CLEAR);
+ writel_relaxed(s_irq_status, uport->membase + SE_GENI_S_IRQ_CLEAR);
+@@ -787,7 +808,8 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
+
+ if (m_irq_status & (M_TX_FIFO_WATERMARK_EN | M_CMD_DONE_EN) &&
+ m_irq_en & (M_TX_FIFO_WATERMARK_EN | M_CMD_DONE_EN))
+- qcom_geni_serial_handle_tx(uport);
++ qcom_geni_serial_handle_tx(uport, m_irq_status & M_CMD_DONE_EN,
++ geni_status & M_GENI_CMD_ACTIVE);
+
+ if (s_irq_status & S_GP_IRQ_0_EN || s_irq_status & S_GP_IRQ_1_EN) {
+ if (s_irq_status & S_GP_IRQ_0_EN)
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index fe9261ffe3db..dc56cddca6dc 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1112,7 +1112,7 @@ static int uart_break_ctl(struct tty_struct *tty, int break_state)
+ if (!uport)
+ goto out;
+
+- if (uport->type != PORT_UNKNOWN)
++ if (uport->type != PORT_UNKNOWN && uport->ops->break_ctl)
+ uport->ops->break_ctl(uport, break_state);
+ ret = 0;
+ out:
+diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
+index 53bb6d4e9e8d..245c9a51c2de 100644
+--- a/drivers/tty/tty_ldisc.c
++++ b/drivers/tty/tty_ldisc.c
+@@ -336,6 +336,11 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout)
+ {
+ int ret;
+
++ /* Kindly asking blocked readers to release the read side */
++ set_bit(TTY_LDISC_CHANGING, &tty->flags);
++ wake_up_interruptible_all(&tty->read_wait);
++ wake_up_interruptible_all(&tty->write_wait);
++
+ ret = __tty_ldisc_lock(tty, timeout);
+ if (!ret)
+ return -EBUSY;
+@@ -346,6 +351,8 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout)
+ void tty_ldisc_unlock(struct tty_struct *tty)
+ {
+ clear_bit(TTY_LDISC_HALTED, &tty->flags);
++ /* Can be cleared here - ldisc_unlock will wake up writers firstly */
++ clear_bit(TTY_LDISC_CHANGING, &tty->flags);
+ __tty_ldisc_unlock(tty);
+ }
+
+diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
+index 0617e87ab343..8d6074f8ba41 100644
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -1491,7 +1491,7 @@ static void kbd_event(struct input_handle *handle, unsigned int event_type,
+
+ if (event_type == EV_MSC && event_code == MSC_RAW && HW_RAW(handle->dev))
+ kbd_rawcode(value);
+- if (event_type == EV_KEY)
++ if (event_type == EV_KEY && event_code <= KEY_MAX)
+ kbd_keycode(event_code, value, HW_RAW(handle->dev));
+
+ spin_unlock(&kbd_event_lock);
+diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
+index 2384ea85ffaf..2fb509d57e88 100644
+--- a/drivers/tty/vt/vc_screen.c
++++ b/drivers/tty/vt/vc_screen.c
+@@ -437,6 +437,9 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
+ size_t ret;
+ char *con_buf;
+
++ if (use_unicode(inode))
++ return -EOPNOTSUPP;
++
+ con_buf = (char *) __get_free_page(GFP_KERNEL);
+ if (!con_buf)
+ return -ENOMEM;
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index aca7e7fa5e47..f52fcbc5c971 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1481,7 +1481,8 @@ static int dwc3_probe(struct platform_device *pdev)
+
+ ret = dwc3_core_init(dwc);
+ if (ret) {
+- dev_err(dev, "failed to initialize core\n");
++ if (ret != -EPROBE_DEFER)
++ dev_err(dev, "failed to initialize core: %d\n", ret);
+ goto err4;
+ }
+
+diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h
+index c66d216dcc30..4f75ab3505b7 100644
+--- a/drivers/usb/dwc3/debug.h
++++ b/drivers/usb/dwc3/debug.h
+@@ -116,6 +116,35 @@ dwc3_gadget_link_string(enum dwc3_link_state link_state)
+ }
+ }
+
++/**
++ * dwc3_gadget_hs_link_string - returns highspeed and below link name
++ * @link_state: link state code
++ */
++static inline const char *
++dwc3_gadget_hs_link_string(enum dwc3_link_state link_state)
++{
++ switch (link_state) {
++ case DWC3_LINK_STATE_U0:
++ return "On";
++ case DWC3_LINK_STATE_U2:
++ return "Sleep";
++ case DWC3_LINK_STATE_U3:
++ return "Suspend";
++ case DWC3_LINK_STATE_SS_DIS:
++ return "Disconnected";
++ case DWC3_LINK_STATE_RX_DET:
++ return "Early Suspend";
++ case DWC3_LINK_STATE_RECOV:
++ return "Recovery";
++ case DWC3_LINK_STATE_RESET:
++ return "Reset";
++ case DWC3_LINK_STATE_RESUME:
++ return "Resume";
++ default:
++ return "UNKNOWN link state\n";
++ }
++}
++
+ /**
+ * dwc3_trb_type_string - returns TRB type as a string
+ * @type: the type of the TRB
+diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c
+index df8e73ec3342..04ce7c01a09e 100644
+--- a/drivers/usb/dwc3/debugfs.c
++++ b/drivers/usb/dwc3/debugfs.c
+@@ -433,13 +433,17 @@ static int dwc3_link_state_show(struct seq_file *s, void *unused)
+ unsigned long flags;
+ enum dwc3_link_state state;
+ u32 reg;
++ u8 speed;
+
+ spin_lock_irqsave(&dwc->lock, flags);
+ reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ state = DWC3_DSTS_USBLNKST(reg);
+- spin_unlock_irqrestore(&dwc->lock, flags);
++ speed = reg & DWC3_DSTS_CONNECTSPD;
+
+- seq_printf(s, "%s\n", dwc3_gadget_link_string(state));
++ seq_printf(s, "%s\n", (speed >= DWC3_DSTS_SUPERSPEED) ?
++ dwc3_gadget_link_string(state) :
++ dwc3_gadget_hs_link_string(state));
++ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ return 0;
+ }
+@@ -457,6 +461,8 @@ static ssize_t dwc3_link_state_write(struct file *file,
+ unsigned long flags;
+ enum dwc3_link_state state = 0;
+ char buf[32];
++ u32 reg;
++ u8 speed;
+
+ if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
+ return -EFAULT;
+@@ -477,6 +483,15 @@ static ssize_t dwc3_link_state_write(struct file *file,
+ return -EINVAL;
+
+ spin_lock_irqsave(&dwc->lock, flags);
++ reg = dwc3_readl(dwc->regs, DWC3_DSTS);
++ speed = reg & DWC3_DSTS_CONNECTSPD;
++
++ if (speed < DWC3_DSTS_SUPERSPEED &&
++ state != DWC3_LINK_STATE_RECOV) {
++ spin_unlock_irqrestore(&dwc->lock, flags);
++ return -EINVAL;
++ }
++
+ dwc3_gadget_set_link_state(dwc, state);
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
+diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
+index 29436f75bbe0..d4d317db89df 100644
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -1246,8 +1246,10 @@ int gserial_alloc_line(unsigned char *line_num)
+ __func__, port_num, PTR_ERR(tty_dev));
+
+ ret = PTR_ERR(tty_dev);
++ mutex_lock(&ports[port_num].lock);
+ port = ports[port_num].port;
+ ports[port_num].port = NULL;
++ mutex_unlock(&ports[port_num].lock);
+ gserial_free_port(port);
+ goto err;
+ }
+diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c
+index ff62ba232177..326b40747128 100644
+--- a/drivers/usb/mtu3/mtu3_qmu.c
++++ b/drivers/usb/mtu3/mtu3_qmu.c
+@@ -427,7 +427,7 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum)
+ return;
+ }
+
+- dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, mreq);
++ dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, req);
+
+ mtu3_clrbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_DMAREQEN);
+
+diff --git a/drivers/usb/serial/f81534.c b/drivers/usb/serial/f81534.c
+index 4dfbff20bda4..db6c93c04b3c 100644
+--- a/drivers/usb/serial/f81534.c
++++ b/drivers/usb/serial/f81534.c
+@@ -45,14 +45,17 @@
+ #define F81534_CONFIG1_REG (0x09 + F81534_UART_BASE_ADDRESS)
+
+ #define F81534_DEF_CONF_ADDRESS_START 0x3000
+-#define F81534_DEF_CONF_SIZE 8
++#define F81534_DEF_CONF_SIZE 12
+
+ #define F81534_CUSTOM_ADDRESS_START 0x2f00
+ #define F81534_CUSTOM_DATA_SIZE 0x10
+ #define F81534_CUSTOM_NO_CUSTOM_DATA 0xff
+ #define F81534_CUSTOM_VALID_TOKEN 0xf0
+ #define F81534_CONF_OFFSET 1
+-#define F81534_CONF_GPIO_OFFSET 4
++#define F81534_CONF_INIT_GPIO_OFFSET 4
++#define F81534_CONF_WORK_GPIO_OFFSET 8
++#define F81534_CONF_GPIO_SHUTDOWN 7
++#define F81534_CONF_GPIO_RS232 1
+
+ #define F81534_MAX_DATA_BLOCK 64
+ #define F81534_MAX_BUS_RETRY 20
+@@ -1359,8 +1362,19 @@ static int f81534_set_port_output_pin(struct usb_serial_port *port)
+ serial_priv = usb_get_serial_data(serial);
+ port_priv = usb_get_serial_port_data(port);
+
+- idx = F81534_CONF_GPIO_OFFSET + port_priv->phy_num;
++ idx = F81534_CONF_INIT_GPIO_OFFSET + port_priv->phy_num;
+ value = serial_priv->conf_data[idx];
++ if (value >= F81534_CONF_GPIO_SHUTDOWN) {
++ /*
++ * Newer IC configure will make transceiver in shutdown mode on
++ * initial power on. We need enable it before using UARTs.
++ */
++ idx = F81534_CONF_WORK_GPIO_OFFSET + port_priv->phy_num;
++ value = serial_priv->conf_data[idx];
++ if (value >= F81534_CONF_GPIO_SHUTDOWN)
++ value = F81534_CONF_GPIO_RS232;
++ }
++
+ pins = &f81534_port_out_pins[port_priv->phy_num];
+
+ for (i = 0; i < ARRAY_SIZE(pins->pin); ++i) {
+diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c
+index ffde179a9bb2..d84d6cbd9697 100644
+--- a/drivers/watchdog/aspeed_wdt.c
++++ b/drivers/watchdog/aspeed_wdt.c
+@@ -207,11 +207,6 @@ static int aspeed_wdt_probe(struct platform_device *pdev)
+ if (IS_ERR(wdt->base))
+ return PTR_ERR(wdt->base);
+
+- /*
+- * The ast2400 wdt can run at PCLK, or 1MHz. The ast2500 only
+- * runs at 1MHz. We chose to always run at 1MHz, as there's no
+- * good reason to have a faster watchdog counter.
+- */
+ wdt->wdd.info = &aspeed_wdt_info;
+ wdt->wdd.ops = &aspeed_wdt_ops;
+ wdt->wdd.max_hw_heartbeat_ms = WDT_MAX_TIMEOUT_MS;
+@@ -227,7 +222,16 @@ static int aspeed_wdt_probe(struct platform_device *pdev)
+ return -EINVAL;
+ config = ofdid->data;
+
+- wdt->ctrl = WDT_CTRL_1MHZ_CLK;
++ /*
++ * On clock rates:
++ * - ast2400 wdt can run at PCLK, or 1MHz
++ * - ast2500 only runs at 1MHz, hard coding bit 4 to 1
++ * - ast2600 always runs at 1MHz
++ *
++ * Set the ast2400 to run at 1MHz as it simplifies the driver.
++ */
++ if (of_device_is_compatible(np, "aspeed,ast2400-wdt"))
++ wdt->ctrl = WDT_CTRL_1MHZ_CLK;
+
+ /*
+ * Control reset on a per-device basis to ensure the
+diff --git a/fs/autofs/expire.c b/fs/autofs/expire.c
+index 28d9c2b1b3bb..70e9afe589fb 100644
+--- a/fs/autofs/expire.c
++++ b/fs/autofs/expire.c
+@@ -501,9 +501,10 @@ static struct dentry *autofs_expire_indirect(struct super_block *sb,
+ */
+ how &= ~AUTOFS_EXP_LEAVES;
+ found = should_expire(expired, mnt, timeout, how);
+- if (!found || found != expired)
+- /* Something has changed, continue */
++ if (found != expired) { // something has changed, continue
++ dput(found);
+ goto next;
++ }
+
+ if (expired != dentry)
+ dput(dentry);
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index a8e2bc47dcf2..455d0282363f 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -312,9 +312,6 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ INIT_LIST_HEAD(&fdlocks->locks);
+ fdlocks->cfile = cfile;
+ cfile->llist = fdlocks;
+- cifs_down_write(&cinode->lock_sem);
+- list_add(&fdlocks->llist, &cinode->llist);
+- up_write(&cinode->lock_sem);
+
+ cfile->count = 1;
+ cfile->pid = current->tgid;
+@@ -338,6 +335,10 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ oplock = 0;
+ }
+
++ cifs_down_write(&cinode->lock_sem);
++ list_add(&fdlocks->llist, &cinode->llist);
++ up_write(&cinode->lock_sem);
++
+ spin_lock(&tcon->open_file_lock);
+ if (fid->pending_open->oplock != CIFS_OPLOCK_NO_CHANGE && oplock)
+ oplock = fid->pending_open->oplock;
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index e311f58dc1c8..449d1584ff72 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -673,10 +673,10 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ spin_lock(&cifs_tcp_ses_lock);
+ list_for_each(tmp, &server->smb_ses_list) {
+ ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
++
+ list_for_each(tmp1, &ses->tcon_list) {
+ tcon = list_entry(tmp1, struct cifs_tcon, tcon_list);
+
+- cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks);
+ spin_lock(&tcon->open_file_lock);
+ list_for_each(tmp2, &tcon->openFileList) {
+ cfile = list_entry(tmp2, struct cifsFileInfo,
+@@ -688,6 +688,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ continue;
+
+ cifs_dbg(FYI, "file id match, oplock break\n");
++ cifs_stats_inc(
++ &tcon->stats.cifs_stats.num_oplock_brks);
+ cinode = CIFS_I(d_inode(cfile->dentry));
+ spin_lock(&cfile->file_info_lock);
+ if (!CIFS_CACHE_WRITE(cinode) &&
+@@ -720,9 +722,6 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ return true;
+ }
+ spin_unlock(&tcon->open_file_lock);
+- spin_unlock(&cifs_tcp_ses_lock);
+- cifs_dbg(FYI, "No matching file for oplock break\n");
+- return true;
+ }
+ }
+ spin_unlock(&cifs_tcp_ses_lock);
+diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
+index 6a1529e478f3..f1261fa0af8a 100644
+--- a/fs/dlm/lockspace.c
++++ b/fs/dlm/lockspace.c
+@@ -807,6 +807,7 @@ static int release_lockspace(struct dlm_ls *ls, int force)
+
+ dlm_delete_debug_file(ls);
+
++ idr_destroy(&ls->ls_recover_idr);
+ kfree(ls->ls_recover_buf);
+
+ /*
+diff --git a/fs/dlm/member.c b/fs/dlm/member.c
+index cad6d85911a8..0bc43b35d2c5 100644
+--- a/fs/dlm/member.c
++++ b/fs/dlm/member.c
+@@ -671,7 +671,7 @@ int dlm_ls_stop(struct dlm_ls *ls)
+ int dlm_ls_start(struct dlm_ls *ls)
+ {
+ struct dlm_recover *rv, *rv_old;
+- struct dlm_config_node *nodes;
++ struct dlm_config_node *nodes = NULL;
+ int error, count;
+
+ rv = kzalloc(sizeof(*rv), GFP_NOFS);
+diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c
+index 7cd24bccd4fe..37be29f21d04 100644
+--- a/fs/dlm/memory.c
++++ b/fs/dlm/memory.c
+@@ -38,10 +38,8 @@ int __init dlm_memory_init(void)
+
+ void dlm_memory_exit(void)
+ {
+- if (lkb_cache)
+- kmem_cache_destroy(lkb_cache);
+- if (rsb_cache)
+- kmem_cache_destroy(rsb_cache);
++ kmem_cache_destroy(lkb_cache);
++ kmem_cache_destroy(rsb_cache);
+ }
+
+ char *dlm_allocate_lvb(struct dlm_ls *ls)
+@@ -86,8 +84,7 @@ void dlm_free_lkb(struct dlm_lkb *lkb)
+ struct dlm_user_args *ua;
+ ua = lkb->lkb_ua;
+ if (ua) {
+- if (ua->lksb.sb_lvbptr)
+- kfree(ua->lksb.sb_lvbptr);
++ kfree(ua->lksb.sb_lvbptr);
+ kfree(ua);
+ }
+ }
+diff --git a/fs/dlm/user.c b/fs/dlm/user.c
+index 13f29409600b..3c84c62dadb7 100644
+--- a/fs/dlm/user.c
++++ b/fs/dlm/user.c
+@@ -25,6 +25,7 @@
+ #include "lvb_table.h"
+ #include "user.h"
+ #include "ast.h"
++#include "config.h"
+
+ static const char name_prefix[] = "dlm";
+ static const struct file_operations device_fops;
+@@ -404,7 +405,7 @@ static int device_create_lockspace(struct dlm_lspace_params *params)
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+- error = dlm_new_lockspace(params->name, NULL, params->flags,
++ error = dlm_new_lockspace(params->name, dlm_config.ci_cluster_name, params->flags,
+ DLM_USER_LVB_LEN, NULL, NULL, NULL,
+ &lockspace);
+ if (error)
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index 63707abcbeb3..808cae6d5f50 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -517,26 +517,33 @@ struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid,
+ * inode is actually connected to the parent.
+ */
+ err = exportfs_get_name(mnt, target_dir, nbuf, result);
+- if (!err) {
+- inode_lock(target_dir->d_inode);
+- nresult = lookup_one_len(nbuf, target_dir,
+- strlen(nbuf));
+- inode_unlock(target_dir->d_inode);
+- if (!IS_ERR(nresult)) {
+- if (nresult->d_inode) {
+- dput(result);
+- result = nresult;
+- } else
+- dput(nresult);
+- }
++ if (err) {
++ dput(target_dir);
++ goto err_result;
+ }
+
++ inode_lock(target_dir->d_inode);
++ nresult = lookup_one_len(nbuf, target_dir, strlen(nbuf));
++ if (!IS_ERR(nresult)) {
++ if (unlikely(nresult->d_inode != result->d_inode)) {
++ dput(nresult);
++ nresult = ERR_PTR(-ESTALE);
++ }
++ }
++ inode_unlock(target_dir->d_inode);
+ /*
+ * At this point we are done with the parent, but it's pinned
+ * by the child dentry anyway.
+ */
+ dput(target_dir);
+
++ if (IS_ERR(nresult)) {
++ err = PTR_ERR(nresult);
++ goto err_result;
++ }
++ dput(result);
++ result = nresult;
++
+ /*
+ * And finally make sure the dentry is actually acceptable
+ * to NFSD.
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 187bf7e260c9..5eef2a8b29ab 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2143,7 +2143,7 @@ do_more:
+ }
+
+ ret = f2fs_gc(sbi, range.sync, true, GET_SEGNO(sbi, range.start));
+- range.start += sbi->blocks_per_seg;
++ range.start += BLKS_PER_SEC(sbi);
+ if (range.start <= end)
+ goto do_more;
+ out:
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 8c4cb1eee10a..700c39ec99f5 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -318,8 +318,7 @@ static int get_victim_by_default(struct f2fs_sb_info *sbi,
+ p.min_cost = get_max_cost(sbi, &p);
+
+ if (*result != NULL_SEGNO) {
+- if (IS_DATASEG(get_seg_entry(sbi, *result)->type) &&
+- get_valid_blocks(sbi, *result, false) &&
++ if (get_valid_blocks(sbi, *result, false) &&
+ !sec_usage_check(sbi, GET_SEC_FROM_SEG(sbi, *result)))
+ p.min_segno = *result;
+ goto out;
+@@ -1081,9 +1080,9 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
+ GET_SUM_BLOCK(sbi, segno));
+ f2fs_put_page(sum_page, 0);
+
+- if (get_valid_blocks(sbi, segno, false) == 0 ||
+- !PageUptodate(sum_page) ||
+- unlikely(f2fs_cp_error(sbi)))
++ if (get_valid_blocks(sbi, segno, false) == 0)
++ goto freed;
++ if (!PageUptodate(sum_page) || unlikely(f2fs_cp_error(sbi)))
+ goto next;
+
+ sum = page_address(sum_page);
+@@ -1110,6 +1109,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
+
+ stat_inc_seg_count(sbi, type, gc_type);
+
++freed:
+ if (gc_type == FG_GC &&
+ get_valid_blocks(sbi, segno, false) == 0)
+ seg_freed++;
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index a807a8d5e38f..0e3e590a250f 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -637,7 +637,9 @@ int f2fs_issue_flush(struct f2fs_sb_info *sbi, nid_t ino)
+ return 0;
+
+ if (!test_opt(sbi, FLUSH_MERGE)) {
++ atomic_inc(&fcc->issing_flush);
+ ret = submit_flush_wait(sbi, ino);
++ atomic_dec(&fcc->issing_flush);
+ atomic_inc(&fcc->issued_flush);
+ return ret;
+ }
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index e7a2a988533d..6244345a5745 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -234,7 +234,8 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
+ kfree(forget);
+ if (ret == -ENOMEM)
+ goto out;
+- if (ret || (outarg.attr.mode ^ inode->i_mode) & S_IFMT)
++ if (ret || fuse_invalid_attr(&outarg.attr) ||
++ (outarg.attr.mode ^ inode->i_mode) & S_IFMT)
+ goto invalid;
+
+ forget_all_cached_acls(inode);
+@@ -297,6 +298,12 @@ int fuse_valid_type(int m)
+ S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m);
+ }
+
++bool fuse_invalid_attr(struct fuse_attr *attr)
++{
++ return !fuse_valid_type(attr->mode) ||
++ attr->size > LLONG_MAX;
++}
++
+ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name,
+ struct fuse_entry_out *outarg, struct inode **inode)
+ {
+@@ -328,7 +335,7 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name
+ err = -EIO;
+ if (!outarg->nodeid)
+ goto out_put_forget;
+- if (!fuse_valid_type(outarg->attr.mode))
++ if (fuse_invalid_attr(&outarg->attr))
+ goto out_put_forget;
+
+ *inode = fuse_iget(sb, outarg->nodeid, outarg->generation,
+@@ -451,7 +458,8 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry,
+ goto out_free_ff;
+
+ err = -EIO;
+- if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid))
++ if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid) ||
++ fuse_invalid_attr(&outentry.attr))
+ goto out_free_ff;
+
+ ff->fh = outopen.fh;
+@@ -558,7 +566,7 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_args *args,
+ goto out_put_forget_req;
+
+ err = -EIO;
+- if (invalid_nodeid(outarg.nodeid))
++ if (invalid_nodeid(outarg.nodeid) || fuse_invalid_attr(&outarg.attr))
+ goto out_put_forget_req;
+
+ if ((outarg.attr.mode ^ mode) & S_IFMT)
+@@ -837,7 +845,8 @@ static int fuse_link(struct dentry *entry, struct inode *newdir,
+
+ spin_lock(&fc->lock);
+ fi->attr_version = ++fc->attr_version;
+- inc_nlink(inode);
++ if (likely(inode->i_nlink < UINT_MAX))
++ inc_nlink(inode);
+ spin_unlock(&fc->lock);
+ fuse_invalidate_attr(inode);
+ fuse_update_ctime(inode);
+@@ -917,7 +926,8 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat,
+ args.out.args[0].value = &outarg;
+ err = fuse_simple_request(fc, &args);
+ if (!err) {
+- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
++ if (fuse_invalid_attr(&outarg.attr) ||
++ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
+ make_bad_inode(inode);
+ err = -EIO;
+ } else {
+@@ -1229,7 +1239,7 @@ static int fuse_direntplus_link(struct file *file,
+
+ if (invalid_nodeid(o->nodeid))
+ return -EIO;
+- if (!fuse_valid_type(o->attr.mode))
++ if (fuse_invalid_attr(&o->attr))
+ return -EIO;
+
+ fc = get_fuse_conn(dir);
+@@ -1706,7 +1716,8 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,
+ goto error;
+ }
+
+- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
++ if (fuse_invalid_attr(&outarg.attr) ||
++ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
+ make_bad_inode(inode);
+ err = -EIO;
+ goto error;
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index 900bdcf79bfc..dbfc35efbefb 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -909,6 +909,8 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc);
+ */
+ int fuse_valid_type(int m);
+
++bool fuse_invalid_attr(struct fuse_attr *attr);
++
+ /**
+ * Is current process allowed to perform filesystem operation?
+ */
+diff --git a/fs/iomap.c b/fs/iomap.c
+index fac45206418a..03edf62633dc 100644
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -150,13 +150,14 @@ static void
+ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
+ loff_t *pos, loff_t length, unsigned *offp, unsigned *lenp)
+ {
++ loff_t orig_pos = *pos;
++ loff_t isize = i_size_read(inode);
+ unsigned block_bits = inode->i_blkbits;
+ unsigned block_size = (1 << block_bits);
+ unsigned poff = offset_in_page(*pos);
+ unsigned plen = min_t(loff_t, PAGE_SIZE - poff, length);
+ unsigned first = poff >> block_bits;
+ unsigned last = (poff + plen - 1) >> block_bits;
+- unsigned end = offset_in_page(i_size_read(inode)) >> block_bits;
+
+ /*
+ * If the block size is smaller than the page size we need to check the
+@@ -191,8 +192,12 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
+ * handle both halves separately so that we properly zero data in the
+ * page cache for blocks that are entirely outside of i_size.
+ */
+- if (first <= end && last > end)
+- plen -= (last - end) * block_size;
++ if (orig_pos <= isize && orig_pos + length > isize) {
++ unsigned end = offset_in_page(isize - 1) >> block_bits;
++
++ if (first <= end && last > end)
++ plen -= (last - end) * block_size;
++ }
+
+ *offp = poff;
+ *lenp = plen;
+@@ -1603,7 +1608,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
+ struct bio *bio;
+ bool need_zeroout = false;
+ bool use_fua = false;
+- int nr_pages, ret;
++ int nr_pages, ret = 0;
+ size_t copied = 0;
+
+ if ((pos | length | align) & ((1 << blkbits) - 1))
+@@ -1619,12 +1624,13 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
+
+ if (iomap->flags & IOMAP_F_NEW) {
+ need_zeroout = true;
+- } else {
++ } else if (iomap->type == IOMAP_MAPPED) {
+ /*
+- * Use a FUA write if we need datasync semantics, this
+- * is a pure data IO that doesn't require any metadata
+- * updates and the underlying device supports FUA. This
+- * allows us to avoid cache flushes on IO completion.
++ * Use a FUA write if we need datasync semantics, this is a pure
++ * data IO that doesn't require any metadata updates (including
++ * after IO completion such as unwritten extent conversion) and
++ * the underlying device supports FUA. This allows us to avoid
++ * cache flushes on IO completion.
+ */
+ if (!(iomap->flags & (IOMAP_F_SHARED|IOMAP_F_DIRTY)) &&
+ (dio->flags & IOMAP_DIO_WRITE_FUA) &&
+@@ -1667,8 +1673,14 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
+
+ ret = bio_iov_iter_get_pages(bio, &iter);
+ if (unlikely(ret)) {
++ /*
++ * We have to stop part way through an IO. We must fall
++ * through to the sub-block tail zeroing here, otherwise
++ * this short IO may expose stale data in the tail of
++ * the block we haven't written data to.
++ */
+ bio_put(bio);
+- return copied ? copied : ret;
++ goto zero_tail;
+ }
+
+ n = bio->bi_iter.bi_size;
+@@ -1699,13 +1711,21 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
+ dio->submit.cookie = submit_bio(bio);
+ } while (nr_pages);
+
+- if (need_zeroout) {
++ /*
++ * We need to zeroout the tail of a sub-block write if the extent type
++ * requires zeroing or the write extends beyond EOF. If we don't zero
++ * the block tail in the latter case, we can expose stale data via mmap
++ * reads of the EOF block.
++ */
++zero_tail:
++ if (need_zeroout ||
++ ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) {
+ /* zero out from the end of the write to the end of the block */
+ pad = pos & (fs_block_size - 1);
+ if (pad)
+ iomap_dio_zero(dio, iomap, pos, fs_block_size - pad);
+ }
+- return copied;
++ return copied ? copied : ret;
+ }
+
+ static loff_t
+@@ -1884,8 +1904,15 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
+ }
+ pos += ret;
+
+- if (iov_iter_rw(iter) == READ && pos >= dio->i_size)
++ if (iov_iter_rw(iter) == READ && pos >= dio->i_size) {
++ /*
++ * We only report that we've read data up to i_size.
++ * Revert iter to a state corresponding to that as
++ * some callers (such as splice code) rely on it.
++ */
++ iov_iter_revert(iter, pos - dio->i_size);
+ break;
++ }
+ } while ((count = iov_iter_count(iter)) > 0);
+ blk_finish_plug(&plug);
+
+diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
+index 853a69e493f5..a4a538abcaf9 100644
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -624,7 +624,6 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
+ {
+ struct kernfs_node *kn;
+ u32 gen;
+- int cursor;
+ int ret;
+
+ name = kstrdup_const(name, GFP_KERNEL);
+@@ -637,11 +636,11 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
+
+ idr_preload(GFP_KERNEL);
+ spin_lock(&kernfs_idr_lock);
+- cursor = idr_get_cursor(&root->ino_idr);
+ ret = idr_alloc_cyclic(&root->ino_idr, kn, 1, 0, GFP_ATOMIC);
+- if (ret >= 0 && ret < cursor)
++ if (ret >= 0 && ret < root->last_ino)
+ root->next_generation++;
+ gen = root->next_generation;
++ root->last_ino = ret;
+ spin_unlock(&kernfs_idr_lock);
+ idr_preload_end();
+ if (ret < 0)
+diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c
+index 00d5ef5f99f7..214a2fa1f1e3 100644
+--- a/fs/lockd/clnt4xdr.c
++++ b/fs/lockd/clnt4xdr.c
+@@ -128,24 +128,14 @@ static void encode_netobj(struct xdr_stream *xdr,
+ static int decode_netobj(struct xdr_stream *xdr,
+ struct xdr_netobj *obj)
+ {
+- u32 length;
+- __be32 *p;
++ ssize_t ret;
+
+- p = xdr_inline_decode(xdr, 4);
+- if (unlikely(p == NULL))
+- goto out_overflow;
+- length = be32_to_cpup(p++);
+- if (unlikely(length > XDR_MAX_NETOBJ))
+- goto out_size;
+- obj->len = length;
+- obj->data = (u8 *)p;
++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data,
++ XDR_MAX_NETOBJ);
++ if (unlikely(ret < 0))
++ return -EIO;
++ obj->len = ret;
+ return 0;
+-out_size:
+- dprintk("NFS: returned netobj was too long: %u\n", length);
+- return -EIO;
+-out_overflow:
+- print_overflow_msg(__func__, xdr);
+- return -EIO;
+ }
+
+ /*
+diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
+index 2c6176387143..747b9c8c940a 100644
+--- a/fs/lockd/clntxdr.c
++++ b/fs/lockd/clntxdr.c
+@@ -125,24 +125,14 @@ static void encode_netobj(struct xdr_stream *xdr,
+ static int decode_netobj(struct xdr_stream *xdr,
+ struct xdr_netobj *obj)
+ {
+- u32 length;
+- __be32 *p;
++ ssize_t ret;
+
+- p = xdr_inline_decode(xdr, 4);
+- if (unlikely(p == NULL))
+- goto out_overflow;
+- length = be32_to_cpup(p++);
+- if (unlikely(length > XDR_MAX_NETOBJ))
+- goto out_size;
+- obj->len = length;
+- obj->data = (u8 *)p;
++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data,
++ XDR_MAX_NETOBJ);
++ if (unlikely(ret < 0))
++ return -EIO;
++ obj->len = ret;
+ return 0;
+-out_size:
+- dprintk("NFS: returned netobj was too long: %u\n", length);
+- return -EIO;
+-out_overflow:
+- print_overflow_msg(__func__, xdr);
+- return -EIO;
+ }
+
+ /*
+diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
+index 9c247fa1e959..5188f9f70c78 100644
+--- a/fs/nfsd/nfs4recover.c
++++ b/fs/nfsd/nfs4recover.c
+@@ -662,7 +662,7 @@ struct cld_net {
+ struct cld_upcall {
+ struct list_head cu_list;
+ struct cld_net *cu_net;
+- struct task_struct *cu_task;
++ struct completion cu_done;
+ struct cld_msg cu_msg;
+ };
+
+@@ -671,23 +671,18 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg)
+ {
+ int ret;
+ struct rpc_pipe_msg msg;
++ struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_msg);
+
+ memset(&msg, 0, sizeof(msg));
+ msg.data = cmsg;
+ msg.len = sizeof(*cmsg);
+
+- /*
+- * Set task state before we queue the upcall. That prevents
+- * wake_up_process in the downcall from racing with schedule.
+- */
+- set_current_state(TASK_UNINTERRUPTIBLE);
+ ret = rpc_queue_upcall(pipe, &msg);
+ if (ret < 0) {
+- set_current_state(TASK_RUNNING);
+ goto out;
+ }
+
+- schedule();
++ wait_for_completion(&cup->cu_done);
+
+ if (msg.errno < 0)
+ ret = msg.errno;
+@@ -754,7 +749,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+ if (copy_from_user(&cup->cu_msg, src, mlen) != 0)
+ return -EFAULT;
+
+- wake_up_process(cup->cu_task);
++ complete(&cup->cu_done);
+ return mlen;
+ }
+
+@@ -769,7 +764,7 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg)
+ if (msg->errno >= 0)
+ return;
+
+- wake_up_process(cup->cu_task);
++ complete(&cup->cu_done);
+ }
+
+ static const struct rpc_pipe_ops cld_upcall_ops = {
+@@ -900,7 +895,7 @@ restart_search:
+ goto restart_search;
+ }
+ }
+- new->cu_task = current;
++ init_completion(&new->cu_done);
+ new->cu_msg.cm_vers = CLD_UPCALL_VERSION;
+ put_unaligned(cn->cn_xid++, &new->cu_msg.cm_xid);
+ new->cu_net = cn;
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index b53e76391e52..4fe8db314950 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -396,10 +396,23 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ bool get_write_count;
+ bool size_change = (iap->ia_valid & ATTR_SIZE);
+
+- if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
++ if (iap->ia_valid & ATTR_SIZE) {
+ accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
+- if (iap->ia_valid & ATTR_SIZE)
+ ftype = S_IFREG;
++ }
++
++ /*
++ * If utimes(2) and friends are called with times not NULL, we should
++ * not set NFSD_MAY_WRITE bit. Otherwise fh_verify->nfsd_permission
++ * will return EACCESS, when the caller's effective UID does not match
++ * the owner of the file, and the caller is not privileged. In this
++ * situation, we should return EPERM(notify_change will return this).
++ */
++ if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME)) {
++ accmode |= NFSD_MAY_OWNER_OVERRIDE;
++ if (!(iap->ia_valid & (ATTR_ATIME_SET | ATTR_MTIME_SET)))
++ accmode |= NFSD_MAY_WRITE;
++ }
+
+ /* Callers that do fh_verify should do the fh_want_write: */
+ get_write_count = !fhp->fh_dentry;
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 015d74ee31a0..631ae057ab53 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -301,6 +301,7 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record)
+ GFP_KERNEL);
+ if (!tmp_prz)
+ return -ENOMEM;
++ prz = tmp_prz;
+ free_prz = true;
+
+ while (cxt->ftrace_read_cnt < cxt->max_ftrace_cnt) {
+@@ -323,7 +324,6 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record)
+ goto out;
+ }
+ record->id = 0;
+- prz = tmp_prz;
+ }
+ }
+
+diff --git a/fs/splice.c b/fs/splice.c
+index 485e409ef841..8af8c318afd6 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -946,11 +946,16 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+ sd->flags &= ~SPLICE_F_NONBLOCK;
+ more = sd->flags & SPLICE_F_MORE;
+
++ WARN_ON_ONCE(pipe->nrbufs != 0);
++
+ while (len) {
+ size_t read_len;
+ loff_t pos = sd->pos, prev_pos = pos;
+
+- ret = do_splice_to(in, &pos, pipe, len, flags);
++ /* Don't try to read more the pipe has space for. */
++ read_len = min_t(size_t, len,
++ (pipe->buffers - pipe->nrbufs) << PAGE_SHIFT);
++ ret = do_splice_to(in, &pos, pipe, read_len, flags);
+ if (unlikely(ret <= 0))
+ goto out_release;
+
+diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
+index 41ad9eaab6ce..e638740f1681 100644
+--- a/fs/xfs/xfs_bmap_util.c
++++ b/fs/xfs/xfs_bmap_util.c
+@@ -1244,11 +1244,7 @@ xfs_prepare_shift(
+ * Writeback and invalidate cache for the remainder of the file as we're
+ * about to shift down every extent from offset to EOF.
+ */
+- error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping, offset, -1);
+- if (error)
+- return error;
+- error = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
+- offset >> PAGE_SHIFT, -1);
++ error = xfs_flush_unmap_range(ip, offset, XFS_ISIZE(ip));
+ if (error)
+ return error;
+
+diff --git a/include/dt-bindings/clock/rk3328-cru.h b/include/dt-bindings/clock/rk3328-cru.h
+index a82a0109faff..9d5f799469ee 100644
+--- a/include/dt-bindings/clock/rk3328-cru.h
++++ b/include/dt-bindings/clock/rk3328-cru.h
+@@ -178,7 +178,7 @@
+ #define HCLK_TSP 309
+ #define HCLK_GMAC 310
+ #define HCLK_I2S0_8CH 311
+-#define HCLK_I2S1_8CH 313
++#define HCLK_I2S1_8CH 312
+ #define HCLK_I2S2_2CH 313
+ #define HCLK_SPDIF_8CH 314
+ #define HCLK_VOP 315
+diff --git a/include/dt-bindings/power/r8a77970-sysc.h b/include/dt-bindings/power/r8a77970-sysc.h
+index bf54779d1625..9eaf824b1582 100644
+--- a/include/dt-bindings/power/r8a77970-sysc.h
++++ b/include/dt-bindings/power/r8a77970-sysc.h
+@@ -19,10 +19,10 @@
+ #define R8A77970_PD_CR7 13
+ #define R8A77970_PD_CA53_SCU 21
+ #define R8A77970_PD_A2IR0 23
+-#define R8A77970_PD_A3IR 24
++#define R8A77970_PD_A3IR 24
+ #define R8A77970_PD_A2IR1 27
+-#define R8A77970_PD_A2IR2 28
+-#define R8A77970_PD_A2IR3 29
++#define R8A77970_PD_A2DP 28
++#define R8A77970_PD_A2CN 29
+ #define R8A77970_PD_A2SC0 30
+ #define R8A77970_PD_A2SC1 31
+
+diff --git a/include/dt-bindings/power/r8a77980-sysc.h b/include/dt-bindings/power/r8a77980-sysc.h
+index 2c90c1237725..e12c8587b87e 100644
+--- a/include/dt-bindings/power/r8a77980-sysc.h
++++ b/include/dt-bindings/power/r8a77980-sysc.h
+@@ -15,14 +15,14 @@
+ #define R8A77980_PD_A2SC2 0
+ #define R8A77980_PD_A2SC3 1
+ #define R8A77980_PD_A2SC4 2
+-#define R8A77980_PD_A2PD0 3
+-#define R8A77980_PD_A2PD1 4
++#define R8A77980_PD_A2DP0 3
++#define R8A77980_PD_A2DP1 4
+ #define R8A77980_PD_CA53_CPU0 5
+ #define R8A77980_PD_CA53_CPU1 6
+ #define R8A77980_PD_CA53_CPU2 7
+ #define R8A77980_PD_CA53_CPU3 8
+ #define R8A77980_PD_A2CN 10
+-#define R8A77980_PD_A3VIP 11
++#define R8A77980_PD_A3VIP0 11
+ #define R8A77980_PD_A2IR5 12
+ #define R8A77980_PD_CR7 13
+ #define R8A77980_PD_A2IR4 15
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index 59a416dfcaaa..df1252e22dcf 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -101,7 +101,7 @@ static inline bool has_acpi_companion(struct device *dev)
+ static inline void acpi_preset_companion(struct device *dev,
+ struct acpi_device *parent, u64 addr)
+ {
+- ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, NULL));
++ ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, false));
+ }
+
+ static inline const char *acpi_dev_name(struct acpi_device *adev)
+diff --git a/include/linux/atalk.h b/include/linux/atalk.h
+index d5cfc0b15b76..f6034ba774be 100644
+--- a/include/linux/atalk.h
++++ b/include/linux/atalk.h
+@@ -108,7 +108,7 @@ static __inline__ struct elapaarp *aarp_hdr(struct sk_buff *skb)
+ #define AARP_RESOLVE_TIME (10 * HZ)
+
+ extern struct datalink_proto *ddp_dl, *aarp_dl;
+-extern void aarp_proto_init(void);
++extern int aarp_proto_init(void);
+
+ /* Inter module exports */
+
+diff --git a/include/linux/avf/virtchnl.h b/include/linux/avf/virtchnl.h
+index 212b3822d180..92d179fb6d59 100644
+--- a/include/linux/avf/virtchnl.h
++++ b/include/linux/avf/virtchnl.h
+@@ -798,8 +798,8 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
+ if (msglen >= valid_len) {
+ struct virtchnl_tc_info *vti =
+ (struct virtchnl_tc_info *)msg;
+- valid_len += vti->num_tc *
+- sizeof(struct virtchnl_channel_info);
++ valid_len += (vti->num_tc - 1) *
++ sizeof(struct virtchnl_channel_info);
+ if (vti->num_tc == 0)
+ err_msg_format = true;
+ }
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index 1db6a6b46d0d..669cde2fa872 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -674,8 +674,7 @@ static inline unsigned int dma_get_max_seg_size(struct device *dev)
+ return SZ_64K;
+ }
+
+-static inline unsigned int dma_set_max_seg_size(struct device *dev,
+- unsigned int size)
++static inline int dma_set_max_seg_size(struct device *dev, unsigned int size)
+ {
+ if (dev->dma_parms) {
+ dev->dma_parms->max_segment_size = size;
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index 1cf1b9b8e975..268f3000d1b3 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -1587,7 +1587,7 @@ static inline int jbd2_space_needed(journal_t *journal)
+ static inline unsigned long jbd2_log_space_left(journal_t *journal)
+ {
+ /* Allow for rounding errors */
+- unsigned long free = journal->j_free - 32;
++ long free = journal->j_free - 32;
+
+ if (journal->j_committing_transaction) {
+ unsigned long committing = atomic_read(&journal->
+@@ -1596,7 +1596,7 @@ static inline unsigned long jbd2_log_space_left(journal_t *journal)
+ /* Transaction + control blocks */
+ free -= committing + (committing >> JBD2_CONTROL_BLOCKS_SHIFT);
+ }
+- return free;
++ return max_t(long, free, 0);
+ }
+
+ /*
+diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h
+index 814643f7ee52..84e9358d605f 100644
+--- a/include/linux/kernfs.h
++++ b/include/linux/kernfs.h
+@@ -186,6 +186,7 @@ struct kernfs_root {
+
+ /* private fields, do not use outside kernfs proper */
+ struct idr ino_idr;
++ u32 last_ino;
+ u32 next_generation;
+ struct kernfs_syscall_ops *syscall_ops;
+
+diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
+index cd0be91bdefa..035d641e8847 100644
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -386,7 +386,7 @@ static inline struct device_node *mtd_get_of_node(struct mtd_info *mtd)
+ return dev_of_node(&mtd->dev);
+ }
+
+-static inline int mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops)
++static inline u32 mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops)
+ {
+ return ops->mode == MTD_OPS_AUTO_OOB ? mtd->oobavail : mtd->oobsize;
+ }
+diff --git a/include/linux/platform_data/dma-dw.h b/include/linux/platform_data/dma-dw.h
+index 896cb71a382c..1a1d58ebffbf 100644
+--- a/include/linux/platform_data/dma-dw.h
++++ b/include/linux/platform_data/dma-dw.h
+@@ -49,6 +49,7 @@ struct dw_dma_slave {
+ * @data_width: Maximum data width supported by hardware per AHB master
+ * (in bytes, power of 2)
+ * @multi_block: Multi block transfers supported by hardware per channel.
++ * @protctl: Protection control signals setting per channel.
+ */
+ struct dw_dma_platform_data {
+ unsigned int nr_channels;
+@@ -65,6 +66,11 @@ struct dw_dma_platform_data {
+ unsigned char nr_masters;
+ unsigned char data_width[DW_DMA_MAX_NR_MASTERS];
+ unsigned char multi_block[DW_DMA_MAX_NR_CHANNELS];
++#define CHAN_PROTCTL_PRIVILEGED BIT(0)
++#define CHAN_PROTCTL_BUFFERABLE BIT(1)
++#define CHAN_PROTCTL_CACHEABLE BIT(2)
++#define CHAN_PROTCTL_MASK GENMASK(2, 0)
++ unsigned char protctl;
+ };
+
+ #endif /* _PLATFORM_DATA_DMA_DW_H */
+diff --git a/include/linux/qcom_scm.h b/include/linux/qcom_scm.h
+index 5d65521260b3..116b81ac442a 100644
+--- a/include/linux/qcom_scm.h
++++ b/include/linux/qcom_scm.h
+@@ -65,6 +65,9 @@ extern int qcom_scm_iommu_secure_ptbl_init(u64 addr, u32 size, u32 spare);
+ extern int qcom_scm_io_readl(phys_addr_t addr, unsigned int *val);
+ extern int qcom_scm_io_writel(phys_addr_t addr, unsigned int val);
+ #else
++
++#include <linux/errno.h>
++
+ static inline
+ int qcom_scm_set_cold_boot_addr(void *entry, const cpumask_t *cpus)
+ {
+diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h
+index 25602afd4844..f3f76051e8b0 100644
+--- a/include/linux/regulator/consumer.h
++++ b/include/linux/regulator/consumer.h
+@@ -508,7 +508,7 @@ static inline int regulator_get_error_flags(struct regulator *regulator,
+
+ static inline int regulator_set_load(struct regulator *regulator, int load_uA)
+ {
+- return REGULATOR_MODE_NORMAL;
++ return 0;
+ }
+
+ static inline int regulator_allow_bypass(struct regulator *regulator,
+diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
+index 406edae44ca3..3460b15a2607 100644
+--- a/include/linux/serial_core.h
++++ b/include/linux/serial_core.h
+@@ -173,6 +173,7 @@ struct uart_port {
+ struct console *cons; /* struct console, if any */
+ #if defined(CONFIG_SERIAL_CORE_CONSOLE) || defined(SUPPORT_SYSRQ)
+ unsigned long sysrq; /* sysrq timeout */
++ unsigned int sysrq_ch; /* char for sysrq */
+ #endif
+
+ /* flags must be updated while holding port mutex */
+@@ -482,8 +483,42 @@ uart_handle_sysrq_char(struct uart_port *port, unsigned int ch)
+ }
+ return 0;
+ }
++static inline int
++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch)
++{
++ if (port->sysrq) {
++ if (ch && time_before(jiffies, port->sysrq)) {
++ port->sysrq_ch = ch;
++ port->sysrq = 0;
++ return 1;
++ }
++ port->sysrq = 0;
++ }
++ return 0;
++}
++static inline void
++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
++{
++ int sysrq_ch;
++
++ sysrq_ch = port->sysrq_ch;
++ port->sysrq_ch = 0;
++
++ spin_unlock_irqrestore(&port->lock, irqflags);
++
++ if (sysrq_ch)
++ handle_sysrq(sysrq_ch);
++}
+ #else
+-#define uart_handle_sysrq_char(port,ch) ({ (void)port; 0; })
++static inline int
++uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; }
++static inline int
++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; }
++static inline void
++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
++{
++ spin_unlock_irqrestore(&port->lock, irqflags);
++}
+ #endif
+
+ /*
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index 808fbfe86f85..76db046f09ab 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -366,6 +366,7 @@ struct tty_file_private {
+ #define TTY_NO_WRITE_SPLIT 17 /* Preserve write boundaries to driver */
+ #define TTY_HUPPED 18 /* Post driver->hangup() */
+ #define TTY_HUPPING 19 /* Hangup in progress */
++#define TTY_LDISC_CHANGING 20 /* Change pending - non-block IO */
+ #define TTY_LDISC_HALTED 22 /* Line discipline is halted */
+
+ /* Values for tty->flow_change */
+@@ -383,6 +384,12 @@ static inline void tty_set_flow_change(struct tty_struct *tty, int val)
+ smp_mb();
+ }
+
++static inline bool tty_io_nonblock(struct tty_struct *tty, struct file *file)
++{
++ return file->f_flags & O_NONBLOCK ||
++ test_bit(TTY_LDISC_CHANGING, &tty->flags);
++}
++
+ static inline bool tty_io_error(struct tty_struct *tty)
+ {
+ return test_bit(TTY_IO_ERROR, &tty->flags);
+diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h
+index 3f284bc03180..5650c1628383 100644
+--- a/include/math-emu/soft-fp.h
++++ b/include/math-emu/soft-fp.h
+@@ -138,7 +138,7 @@ do { \
+ _FP_FRAC_ADDI_##wc(X, _FP_WORK_ROUND); \
+ } while (0)
+
+-#define _FP_ROUND_ZERO(wc, X) 0
++#define _FP_ROUND_ZERO(wc, X) (void)0
+
+ #define _FP_ROUND_PINF(wc, X) \
+ do { \
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index ab9242e51d9e..2abbc15824af 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -620,4 +620,9 @@ static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
+ return false;
+ }
+
++static inline __u32 sctp_min_frag_point(struct sctp_sock *sp, __u16 datasize)
++{
++ return sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT, datasize);
++}
++
+ #endif /* __net_sctp_h__ */
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index abcf53a6db04..3f4223a550d9 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1353,7 +1353,7 @@ static inline int tcp_win_from_space(const struct sock *sk, int space)
+ /* Note: caller must be prepared to deal with negative returns */
+ static inline int tcp_space(const struct sock *sk)
+ {
+- return tcp_win_from_space(sk, sk->sk_rcvbuf -
++ return tcp_win_from_space(sk, sk->sk_rcvbuf - sk->sk_backlog.len -
+ atomic_read(&sk->sk_rmem_alloc));
+ }
+
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index 4ddd2b13ac8d..fb9b19a3b749 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1062,7 +1062,6 @@ struct xfrm_if_parms {
+ struct xfrm_if {
+ struct xfrm_if __rcu *next; /* next interface in list */
+ struct net_device *dev; /* virtual device associated with interface */
+- struct net_device *phydev; /* physical device */
+ struct net *net; /* netns for packet i/o */
+ struct xfrm_if_parms p; /* interface parms */
+
+diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
+index ea43181cde4a..04f59dfd3e71 100644
+--- a/kernel/audit_tree.c
++++ b/kernel/audit_tree.c
+@@ -24,6 +24,7 @@ struct audit_tree {
+
+ struct audit_chunk {
+ struct list_head hash;
++ unsigned long key;
+ struct fsnotify_mark mark;
+ struct list_head trees; /* with root here */
+ int dead;
+@@ -172,21 +173,6 @@ static unsigned long inode_to_key(const struct inode *inode)
+ return (unsigned long)&inode->i_fsnotify_marks;
+ }
+
+-/*
+- * Function to return search key in our hash from chunk. Key 0 is special and
+- * should never be present in the hash.
+- */
+-static unsigned long chunk_to_key(struct audit_chunk *chunk)
+-{
+- /*
+- * We have a reference to the mark so it should be attached to a
+- * connector.
+- */
+- if (WARN_ON_ONCE(!chunk->mark.connector))
+- return 0;
+- return (unsigned long)chunk->mark.connector->obj;
+-}
+-
+ static inline struct list_head *chunk_hash(unsigned long key)
+ {
+ unsigned long n = key / L1_CACHE_BYTES;
+@@ -196,12 +182,12 @@ static inline struct list_head *chunk_hash(unsigned long key)
+ /* hash_lock & entry->lock is held by caller */
+ static void insert_hash(struct audit_chunk *chunk)
+ {
+- unsigned long key = chunk_to_key(chunk);
+ struct list_head *list;
+
+ if (!(chunk->mark.flags & FSNOTIFY_MARK_FLAG_ATTACHED))
+ return;
+- list = chunk_hash(key);
++ WARN_ON_ONCE(!chunk->key);
++ list = chunk_hash(chunk->key);
+ list_add_rcu(&chunk->hash, list);
+ }
+
+@@ -213,7 +199,7 @@ struct audit_chunk *audit_tree_lookup(const struct inode *inode)
+ struct audit_chunk *p;
+
+ list_for_each_entry_rcu(p, list, hash) {
+- if (chunk_to_key(p) == key) {
++ if (p->key == key) {
+ atomic_long_inc(&p->refs);
+ return p;
+ }
+@@ -297,6 +283,7 @@ static void untag_chunk(struct node *p)
+
+ chunk->dead = 1;
+ spin_lock(&hash_lock);
++ new->key = chunk->key;
+ list_replace_init(&chunk->trees, &new->trees);
+ if (owner->root == chunk) {
+ list_del_init(&owner->same_root);
+@@ -378,6 +365,7 @@ static int create_chunk(struct inode *inode, struct audit_tree *tree)
+ tree->root = chunk;
+ list_add(&tree->same_root, &chunk->trees);
+ }
++ chunk->key = inode_to_key(inode);
+ insert_hash(chunk);
+ spin_unlock(&hash_lock);
+ spin_unlock(&entry->lock);
+@@ -462,6 +450,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
+ fsnotify_put_mark(old_entry);
+ return 0;
+ }
++ chunk->key = old->key;
+ list_replace_init(&old->trees, &chunk->trees);
+ for (n = 0, p = chunk->owners; n < old->count; n++, p++) {
+ struct audit_tree *s = old->owners[n].owner;
+@@ -661,7 +650,7 @@ void audit_trim_trees(void)
+ /* this could be NULL if the watch is dying else where... */
+ node->index |= 1U<<31;
+ if (iterate_mounts(compare_root,
+- (void *)chunk_to_key(chunk),
++ (void *)(chunk->key),
+ root_mnt))
+ node->index &= ~(1U<<31);
+ }
+diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
+index 787c7afdf829..4f7262eba73d 100644
+--- a/kernel/audit_watch.c
++++ b/kernel/audit_watch.c
+@@ -366,12 +366,12 @@ static int audit_get_nd(struct audit_watch *watch, struct path *parent)
+ struct dentry *d = kern_path_locked(watch->path, parent);
+ if (IS_ERR(d))
+ return PTR_ERR(d);
+- inode_unlock(d_backing_inode(parent->dentry));
+ if (d_is_positive(d)) {
+ /* update watch filter fields */
+ watch->dev = d->d_sb->s_dev;
+ watch->ino = d_backing_inode(d)->i_ino;
+ }
++ inode_unlock(d_backing_inode(parent->dentry));
+ dput(d);
+ return 0;
+ }
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index cfa27b7d1168..3e2413345e71 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -5,6 +5,7 @@
+ #include <uapi/linux/types.h>
+ #include <linux/seq_file.h>
+ #include <linux/compiler.h>
++#include <linux/ctype.h>
+ #include <linux/errno.h>
+ #include <linux/slab.h>
+ #include <linux/anon_inodes.h>
+@@ -426,6 +427,30 @@ static bool btf_name_offset_valid(const struct btf *btf, u32 offset)
+ offset < btf->hdr.str_len;
+ }
+
++/* Only C-style identifier is permitted. This can be relaxed if
++ * necessary.
++ */
++static bool btf_name_valid_identifier(const struct btf *btf, u32 offset)
++{
++ /* offset must be valid */
++ const char *src = &btf->strings[offset];
++ const char *src_limit;
++
++ if (!isalpha(*src) && *src != '_')
++ return false;
++
++ /* set a limit on identifier length */
++ src_limit = src + KSYM_NAME_LEN;
++ src++;
++ while (*src && src < src_limit) {
++ if (!isalnum(*src) && *src != '_')
++ return false;
++ src++;
++ }
++
++ return !*src;
++}
++
+ static const char *btf_name_by_offset(const struct btf *btf, u32 offset)
+ {
+ if (!offset)
+@@ -1143,6 +1168,22 @@ static int btf_ref_type_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* typedef type must have a valid name, and other ref types,
++ * volatile, const, restrict, should have a null name.
++ */
++ if (BTF_INFO_KIND(t->info) == BTF_KIND_TYPEDEF) {
++ if (!t->name_off ||
++ !btf_name_valid_identifier(env->btf, t->name_off)) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++ } else {
++ if (t->name_off) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++ }
++
+ btf_verifier_log_type(env, t, NULL);
+
+ return 0;
+@@ -1300,6 +1341,13 @@ static s32 btf_fwd_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* fwd type must have a valid name */
++ if (!t->name_off ||
++ !btf_name_valid_identifier(env->btf, t->name_off)) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++
+ btf_verifier_log_type(env, t, NULL);
+
+ return 0;
+@@ -1356,6 +1404,12 @@ static s32 btf_array_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* array type should not have a name */
++ if (t->name_off) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++
+ if (btf_type_vlen(t)) {
+ btf_verifier_log_type(env, t, "vlen != 0");
+ return -EINVAL;
+@@ -1532,6 +1586,13 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* struct type either no name or a valid one */
++ if (t->name_off &&
++ !btf_name_valid_identifier(env->btf, t->name_off)) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++
+ btf_verifier_log_type(env, t, NULL);
+
+ last_offset = 0;
+@@ -1543,6 +1604,12 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* struct member either no name or a valid one */
++ if (member->name_off &&
++ !btf_name_valid_identifier(btf, member->name_off)) {
++ btf_verifier_log_member(env, t, member, "Invalid name");
++ return -EINVAL;
++ }
+ /* A member cannot be in type void */
+ if (!member->type || !BTF_TYPE_ID_VALID(member->type)) {
+ btf_verifier_log_member(env, t, member,
+@@ -1730,6 +1797,13 @@ static s32 btf_enum_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* enum type either no name or a valid one */
++ if (t->name_off &&
++ !btf_name_valid_identifier(env->btf, t->name_off)) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++
+ btf_verifier_log_type(env, t, NULL);
+
+ for (i = 0; i < nr_enums; i++) {
+@@ -1739,6 +1813,14 @@ static s32 btf_enum_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* enum member must have a valid name */
++ if (!enums[i].name_off ||
++ !btf_name_valid_identifier(btf, enums[i].name_off)) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++
++
+ btf_verifier_log(env, "\t%s val=%d\n",
+ btf_name_by_offset(btf, enums[i].name_off),
+ enums[i].val);
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 625ba462e5bb..460d5fd3ec4e 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -11377,7 +11377,7 @@ inherit_event(struct perf_event *parent_event,
+ GFP_KERNEL);
+ if (!child_ctx->task_ctx_data) {
+ free_event(child_event);
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+ }
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 78ecdfae25b6..2befd2c4ce9e 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5413,10 +5413,11 @@ void init_idle(struct task_struct *idle, int cpu)
+ struct rq *rq = cpu_rq(cpu);
+ unsigned long flags;
+
++ __sched_fork(0, idle);
++
+ raw_spin_lock_irqsave(&idle->pi_lock, flags);
+ raw_spin_lock(&rq->lock);
+
+- __sched_fork(0, idle);
+ idle->state = TASK_RUNNING;
+ idle->se.exec_start = sched_clock();
+ idle->flags |= PF_IDLE;
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index f77fcd37b226..f0abb8fe0ae9 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4868,20 +4868,28 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)
+ if (++count > 3) {
+ u64 new, old = ktime_to_ns(cfs_b->period);
+
+- new = (old * 147) / 128; /* ~115% */
+- new = min(new, max_cfs_quota_period);
+-
+- cfs_b->period = ns_to_ktime(new);
+-
+- /* since max is 1s, this is limited to 1e9^2, which fits in u64 */
+- cfs_b->quota *= new;
+- cfs_b->quota = div64_u64(cfs_b->quota, old);
+-
+- pr_warn_ratelimited(
+- "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us %lld, cfs_quota_us = %lld)\n",
+- smp_processor_id(),
+- div_u64(new, NSEC_PER_USEC),
+- div_u64(cfs_b->quota, NSEC_PER_USEC));
++ /*
++ * Grow period by a factor of 2 to avoid losing precision.
++ * Precision loss in the quota/period ratio can cause __cfs_schedulable
++ * to fail.
++ */
++ new = old * 2;
++ if (new < max_cfs_quota_period) {
++ cfs_b->period = ns_to_ktime(new);
++ cfs_b->quota *= 2;
++
++ pr_warn_ratelimited(
++ "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us = %lld, cfs_quota_us = %lld)\n",
++ smp_processor_id(),
++ div_u64(new, NSEC_PER_USEC),
++ div_u64(cfs_b->quota, NSEC_PER_USEC));
++ } else {
++ pr_warn_ratelimited(
++ "cfs_period_timer[cpu%d]: period too short, but cannot scale up without losing precision (cfs_period_us = %lld, cfs_quota_us = %lld)\n",
++ smp_processor_id(),
++ div_u64(old, NSEC_PER_USEC),
++ div_u64(cfs_b->quota, NSEC_PER_USEC));
++ }
+
+ /* reset count so we don't come right back in here */
+ count = 0;
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index a2b2ea786c9b..ce81b0a7d018 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -1826,12 +1826,13 @@ static bool need_update(int cpu)
+
+ /*
+ * The fast way of checking if there are any vmstat diffs.
+- * This works because the diffs are byte sized items.
+ */
+- if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS))
++ if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS *
++ sizeof(p->vm_stat_diff[0])))
+ return true;
+ #ifdef CONFIG_NUMA
+- if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS))
++ if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS *
++ sizeof(p->vm_numa_stat_diff[0])))
+ return true;
+ #endif
+ }
+diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c
+index 49a16cee2aae..420a98bf79b5 100644
+--- a/net/appletalk/aarp.c
++++ b/net/appletalk/aarp.c
+@@ -879,15 +879,24 @@ static struct notifier_block aarp_notifier = {
+
+ static unsigned char aarp_snap_id[] = { 0x00, 0x00, 0x00, 0x80, 0xF3 };
+
+-void __init aarp_proto_init(void)
++int __init aarp_proto_init(void)
+ {
++ int rc;
++
+ aarp_dl = register_snap_client(aarp_snap_id, aarp_rcv);
+- if (!aarp_dl)
++ if (!aarp_dl) {
+ printk(KERN_CRIT "Unable to register AARP with SNAP.\n");
++ return -ENOMEM;
++ }
+ timer_setup(&aarp_timer, aarp_expire_timeout, 0);
+ aarp_timer.expires = jiffies + sysctl_aarp_expiry_time;
+ add_timer(&aarp_timer);
+- register_netdevice_notifier(&aarp_notifier);
++ rc = register_netdevice_notifier(&aarp_notifier);
++ if (rc) {
++ del_timer_sync(&aarp_timer);
++ unregister_snap_client(aarp_dl);
++ }
++ return rc;
+ }
+
+ /* Remove the AARP entries associated with a device. */
+diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
+index 9abb18fffbc3..2880ac470379 100644
+--- a/net/appletalk/ddp.c
++++ b/net/appletalk/ddp.c
+@@ -1909,9 +1909,6 @@ static unsigned char ddp_snap_id[] = { 0x08, 0x00, 0x07, 0x80, 0x9B };
+ EXPORT_SYMBOL(atrtr_get_dev);
+ EXPORT_SYMBOL(atalk_find_dev_addr);
+
+-static const char atalk_err_snap[] __initconst =
+- KERN_CRIT "Unable to register DDP with SNAP.\n";
+-
+ /* Called by proto.c on kernel start up */
+ static int __init atalk_init(void)
+ {
+@@ -1926,17 +1923,23 @@ static int __init atalk_init(void)
+ goto out_proto;
+
+ ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv);
+- if (!ddp_dl)
+- printk(atalk_err_snap);
++ if (!ddp_dl) {
++ pr_crit("Unable to register DDP with SNAP.\n");
++ rc = -ENOMEM;
++ goto out_sock;
++ }
+
+ dev_add_pack(<alk_packet_type);
+ dev_add_pack(&ppptalk_packet_type);
+
+ rc = register_netdevice_notifier(&ddp_notifier);
+ if (rc)
+- goto out_sock;
++ goto out_snap;
++
++ rc = aarp_proto_init();
++ if (rc)
++ goto out_dev;
+
+- aarp_proto_init();
+ rc = atalk_proc_init();
+ if (rc)
+ goto out_aarp;
+@@ -1950,11 +1953,13 @@ out_proc:
+ atalk_proc_exit();
+ out_aarp:
+ aarp_cleanup_module();
++out_dev:
+ unregister_netdevice_notifier(&ddp_notifier);
+-out_sock:
++out_snap:
+ dev_remove_pack(&ppptalk_packet_type);
+ dev_remove_pack(<alk_packet_type);
+ unregister_snap_client(ddp_dl);
++out_sock:
+ sock_unregister(PF_APPLETALK);
+ out_proto:
+ proto_unregister(&ddp_proto);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 53f910bb5508..8971cc15d278 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2919,7 +2919,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
+ TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS;
+ trace_tcp_retransmit_skb(sk, skb);
+ } else if (err != -EBUSY) {
+- NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
++ NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL, segs);
+ }
+ return err;
+ }
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index c719a41d2eba..681882a40968 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -378,7 +378,7 @@ static void tcp_probe_timer(struct sock *sk)
+ return;
+ }
+
+- if (icsk->icsk_probes_out > max_probes) {
++ if (icsk->icsk_probes_out >= max_probes) {
+ abort: tcp_write_err(sk);
+ } else {
+ /* Only send another probe if we didn't close things up. */
+@@ -482,11 +482,12 @@ void tcp_retransmit_timer(struct sock *sk)
+ goto out_reset_timer;
+ }
+
++ __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPTIMEOUTS);
+ if (tcp_write_timeout(sk))
+ goto out;
+
+ if (icsk->icsk_retransmits == 0) {
+- int mib_idx;
++ int mib_idx = 0;
+
+ if (icsk->icsk_ca_state == TCP_CA_Recovery) {
+ if (tcp_is_sack(tp))
+@@ -501,10 +502,9 @@ void tcp_retransmit_timer(struct sock *sk)
+ mib_idx = LINUX_MIB_TCPSACKFAILURES;
+ else
+ mib_idx = LINUX_MIB_TCPRENOFAILURES;
+- } else {
+- mib_idx = LINUX_MIB_TCPTIMEOUTS;
+ }
+- __NET_INC_STATS(sock_net(sk), mib_idx);
++ if (mib_idx)
++ __NET_INC_STATS(sock_net(sk), mib_idx);
+ }
+
+ tcp_enter_loss(sk);
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index d2968a79abea..ef309a26aba0 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -179,7 +179,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp);
+ static void addrconf_dad_work(struct work_struct *w);
+ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
+ bool send_na);
+-static void addrconf_dad_run(struct inet6_dev *idev);
++static void addrconf_dad_run(struct inet6_dev *idev, bool restart);
+ static void addrconf_rs_timer(struct timer_list *t);
+ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
+ static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
+@@ -3424,6 +3424,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
+ void *ptr)
+ {
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++ struct netdev_notifier_change_info *change_info;
+ struct netdev_notifier_changeupper_info *info;
+ struct inet6_dev *idev = __in6_dev_get(dev);
+ struct net *net = dev_net(dev);
+@@ -3498,7 +3499,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
+ break;
+ }
+
+- if (idev) {
++ if (!IS_ERR_OR_NULL(idev)) {
+ if (idev->if_flags & IF_READY) {
+ /* device is already configured -
+ * but resend MLD reports, we might
+@@ -3506,6 +3507,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
+ * multicast snooping switches
+ */
+ ipv6_mc_up(idev);
++ change_info = ptr;
++ if (change_info->flags_changed & IFF_NOARP)
++ addrconf_dad_run(idev, true);
+ rt6_sync_up(dev, RTNH_F_LINKDOWN);
+ break;
+ }
+@@ -3540,7 +3544,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
+
+ if (!IS_ERR_OR_NULL(idev)) {
+ if (run_pending)
+- addrconf_dad_run(idev);
++ addrconf_dad_run(idev, false);
+
+ /* Device has an address by now */
+ rt6_sync_up(dev, RTNH_F_DEAD);
+@@ -4158,16 +4162,19 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
+ addrconf_verify_rtnl();
+ }
+
+-static void addrconf_dad_run(struct inet6_dev *idev)
++static void addrconf_dad_run(struct inet6_dev *idev, bool restart)
+ {
+ struct inet6_ifaddr *ifp;
+
+ read_lock_bh(&idev->lock);
+ list_for_each_entry(ifp, &idev->addr_list, if_list) {
+ spin_lock(&ifp->lock);
+- if (ifp->flags & IFA_F_TENTATIVE &&
+- ifp->state == INET6_IFADDR_STATE_DAD)
++ if ((ifp->flags & IFA_F_TENTATIVE &&
++ ifp->state == INET6_IFADDR_STATE_DAD) || restart) {
++ if (restart)
++ ifp->state = INET6_IFADDR_STATE_PREDAD;
+ addrconf_dad_kick(ifp);
++ }
+ spin_unlock(&ifp->lock);
+ }
+ read_unlock_bh(&idev->lock);
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index ec0f8b5bde0a..0e1b1f7f4745 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2610,17 +2610,14 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
+
+ if (chain->use == UINT_MAX)
+ return -EOVERFLOW;
+- }
+-
+- if (nla[NFTA_RULE_POSITION]) {
+- if (!(nlh->nlmsg_flags & NLM_F_CREATE))
+- return -EOPNOTSUPP;
+
+- pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
+- old_rule = __nft_rule_lookup(chain, pos_handle);
+- if (IS_ERR(old_rule)) {
+- NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
+- return PTR_ERR(old_rule);
++ if (nla[NFTA_RULE_POSITION]) {
++ pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
++ old_rule = __nft_rule_lookup(chain, pos_handle);
++ if (IS_ERR(old_rule)) {
++ NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
++ return PTR_ERR(old_rule);
++ }
+ }
+ }
+
+diff --git a/net/qrtr/tun.c b/net/qrtr/tun.c
+index ccff1e544c21..e35869e81766 100644
+--- a/net/qrtr/tun.c
++++ b/net/qrtr/tun.c
+@@ -84,11 +84,14 @@ static ssize_t qrtr_tun_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ if (!kbuf)
+ return -ENOMEM;
+
+- if (!copy_from_iter_full(kbuf, len, from))
++ if (!copy_from_iter_full(kbuf, len, from)) {
++ kfree(kbuf);
+ return -EFAULT;
++ }
+
+ ret = qrtr_endpoint_post(&tun->ep, kbuf, len);
+
++ kfree(kbuf);
+ return ret < 0 ? ret : len;
+ }
+
+diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
+index ce8087846f05..d2048de86e7c 100644
+--- a/net/sctp/chunk.c
++++ b/net/sctp/chunk.c
+@@ -191,6 +191,12 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
+ * the packet
+ */
+ max_data = asoc->frag_point;
++ if (unlikely(!max_data)) {
++ max_data = sctp_min_frag_point(sctp_sk(asoc->base.sk),
++ sctp_datachk_len(&asoc->stream));
++ pr_warn_ratelimited("%s: asoc:%p frag_point is zero, forcing max_data to default minimum (%Zu)",
++ __func__, asoc, max_data);
++ }
+
+ /* If the the peer requested that we authenticate DATA chunks
+ * we need to account for bundling of the AUTH chunks along with
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index 08601223b0bf..025f48e14a91 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -399,25 +399,6 @@ finish:
+ return retval;
+ }
+
+-static void sctp_packet_release_owner(struct sk_buff *skb)
+-{
+- sk_free(skb->sk);
+-}
+-
+-static void sctp_packet_set_owner_w(struct sk_buff *skb, struct sock *sk)
+-{
+- skb_orphan(skb);
+- skb->sk = sk;
+- skb->destructor = sctp_packet_release_owner;
+-
+- /*
+- * The data chunks have already been accounted for in sctp_sendmsg(),
+- * therefore only reserve a single byte to keep socket around until
+- * the packet has been transmitted.
+- */
+- refcount_inc(&sk->sk_wmem_alloc);
+-}
+-
+ static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb)
+ {
+ if (SCTP_OUTPUT_CB(head)->last == head)
+@@ -429,6 +410,7 @@ static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb)
+ head->truesize += skb->truesize;
+ head->data_len += skb->len;
+ head->len += skb->len;
++ refcount_add(skb->truesize, &head->sk->sk_wmem_alloc);
+
+ __skb_header_release(skb);
+ }
+@@ -604,7 +586,7 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
+ if (!head)
+ goto out;
+ skb_reserve(head, packet->overhead + MAX_HEADER);
+- sctp_packet_set_owner_w(head, sk);
++ skb_set_owner_w(head, sk);
+
+ /* set sctp header */
+ sh = skb_push(head, sizeof(struct sctphdr));
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index e7a11cd7633f..95f9068b8549 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -3328,8 +3328,7 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned
+ __u16 datasize = asoc ? sctp_datachk_len(&asoc->stream) :
+ sizeof(struct sctp_data_chunk);
+
+- min_len = sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT,
+- datasize);
++ min_len = sctp_min_frag_point(sp, datasize);
+ max_len = SCTP_MAX_CHUNK_LEN - datasize;
+
+ if (val < min_len || val > max_len)
+diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
+index 3c458d279855..c2694750a6a8 100644
+--- a/net/smc/smc_wr.c
++++ b/net/smc/smc_wr.c
+@@ -215,12 +215,14 @@ int smc_wr_tx_put_slot(struct smc_link *link,
+
+ pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv);
+ if (pend->idx < link->wr_tx_cnt) {
++ u32 idx = pend->idx;
++
+ /* clear the full struct smc_wr_tx_pend including .priv */
+ memset(&link->wr_tx_pends[pend->idx], 0,
+ sizeof(link->wr_tx_pends[pend->idx]));
+ memset(&link->wr_tx_bufs[pend->idx], 0,
+ sizeof(link->wr_tx_bufs[pend->idx]));
+- test_and_clear_bit(pend->idx, link->wr_tx_mask);
++ test_and_clear_bit(idx, link->wr_tx_mask);
+ return 1;
+ }
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index f7f53f9ae7ef..20a511398389 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -100,7 +100,7 @@ int x25_parse_address_block(struct sk_buff *skb,
+ }
+
+ len = *skb->data;
+- needed = 1 + (len >> 4) + (len & 0x0f);
++ needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2;
+
+ if (!pskb_may_pull(skb, needed)) {
+ /* packet is too short to hold the addresses it claims
+@@ -288,7 +288,7 @@ static struct sock *x25_find_listener(struct x25_address *addr,
+ sk_for_each(s, &x25_list)
+ if ((!strcmp(addr->x25_addr,
+ x25_sk(s)->source_addr.x25_addr) ||
+- !strcmp(addr->x25_addr,
++ !strcmp(x25_sk(s)->source_addr.x25_addr,
+ null_x25_address.x25_addr)) &&
+ s->sk_state == TCP_LISTEN) {
+ /*
+@@ -685,11 +685,15 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ goto out;
+ }
+
+- len = strlen(addr->sx25_addr.x25_addr);
+- for (i = 0; i < len; i++) {
+- if (!isdigit(addr->sx25_addr.x25_addr[i])) {
+- rc = -EINVAL;
+- goto out;
++ /* check for the null_x25_address */
++ if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) {
++
++ len = strlen(addr->sx25_addr.x25_addr);
++ for (i = 0; i < len; i++) {
++ if (!isdigit(addr->sx25_addr.x25_addr[i])) {
++ rc = -EINVAL;
++ goto out;
++ }
+ }
+ }
+
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index d5635908587f..82b0a99ee1f4 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -246,6 +246,9 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+ else
+ XFRM_INC_STATS(net,
+ LINUX_MIB_XFRMINSTATEINVALID);
++
++ if (encap_type == -1)
++ dev_put(skb->dev);
+ goto drop;
+ }
+
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 555ee2aca6c0..d6a3cdf7885c 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -133,7 +133,7 @@ static void xfrmi_dev_free(struct net_device *dev)
+ free_percpu(dev->tstats);
+ }
+
+-static int xfrmi_create2(struct net_device *dev)
++static int xfrmi_create(struct net_device *dev)
+ {
+ struct xfrm_if *xi = netdev_priv(dev);
+ struct net *net = dev_net(dev);
+@@ -156,54 +156,7 @@ out:
+ return err;
+ }
+
+-static struct xfrm_if *xfrmi_create(struct net *net, struct xfrm_if_parms *p)
+-{
+- struct net_device *dev;
+- struct xfrm_if *xi;
+- char name[IFNAMSIZ];
+- int err;
+-
+- if (p->name[0]) {
+- strlcpy(name, p->name, IFNAMSIZ);
+- } else {
+- err = -EINVAL;
+- goto failed;
+- }
+-
+- dev = alloc_netdev(sizeof(*xi), name, NET_NAME_UNKNOWN, xfrmi_dev_setup);
+- if (!dev) {
+- err = -EAGAIN;
+- goto failed;
+- }
+-
+- dev_net_set(dev, net);
+-
+- xi = netdev_priv(dev);
+- xi->p = *p;
+- xi->net = net;
+- xi->dev = dev;
+- xi->phydev = dev_get_by_index(net, p->link);
+- if (!xi->phydev) {
+- err = -ENODEV;
+- goto failed_free;
+- }
+-
+- err = xfrmi_create2(dev);
+- if (err < 0)
+- goto failed_dev_put;
+-
+- return xi;
+-
+-failed_dev_put:
+- dev_put(xi->phydev);
+-failed_free:
+- free_netdev(dev);
+-failed:
+- return ERR_PTR(err);
+-}
+-
+-static struct xfrm_if *xfrmi_locate(struct net *net, struct xfrm_if_parms *p,
+- int create)
++static struct xfrm_if *xfrmi_locate(struct net *net, struct xfrm_if_parms *p)
+ {
+ struct xfrm_if __rcu **xip;
+ struct xfrm_if *xi;
+@@ -211,17 +164,11 @@ static struct xfrm_if *xfrmi_locate(struct net *net, struct xfrm_if_parms *p,
+
+ for (xip = &xfrmn->xfrmi[0];
+ (xi = rtnl_dereference(*xip)) != NULL;
+- xip = &xi->next) {
+- if (xi->p.if_id == p->if_id) {
+- if (create)
+- return ERR_PTR(-EEXIST);
+-
++ xip = &xi->next)
++ if (xi->p.if_id == p->if_id)
+ return xi;
+- }
+- }
+- if (!create)
+- return ERR_PTR(-ENODEV);
+- return xfrmi_create(net, p);
++
++ return NULL;
+ }
+
+ static void xfrmi_dev_uninit(struct net_device *dev)
+@@ -230,7 +177,6 @@ static void xfrmi_dev_uninit(struct net_device *dev)
+ struct xfrmi_net *xfrmn = net_generic(xi->net, xfrmi_net_id);
+
+ xfrmi_unlink(xfrmn, xi);
+- dev_put(xi->phydev);
+ dev_put(dev);
+ }
+
+@@ -417,7 +363,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
+ goto tx_err;
+ }
+
+- fl.flowi_oif = xi->phydev->ifindex;
++ fl.flowi_oif = xi->p.link;
+
+ ret = xfrmi_xmit2(skb, dev, &fl);
+ if (ret < 0)
+@@ -558,7 +504,7 @@ static int xfrmi_change(struct xfrm_if *xi, const struct xfrm_if_parms *p)
+
+ static int xfrmi_update(struct xfrm_if *xi, struct xfrm_if_parms *p)
+ {
+- struct net *net = dev_net(xi->dev);
++ struct net *net = xi->net;
+ struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
+ int err;
+
+@@ -606,7 +552,7 @@ static int xfrmi_get_iflink(const struct net_device *dev)
+ {
+ struct xfrm_if *xi = netdev_priv(dev);
+
+- return xi->phydev->ifindex;
++ return xi->p.link;
+ }
+
+
+@@ -632,12 +578,14 @@ static void xfrmi_dev_setup(struct net_device *dev)
+ dev->needs_free_netdev = true;
+ dev->priv_destructor = xfrmi_dev_free;
+ netif_keep_dst(dev);
++
++ eth_broadcast_addr(dev->broadcast);
+ }
+
+ static int xfrmi_dev_init(struct net_device *dev)
+ {
+ struct xfrm_if *xi = netdev_priv(dev);
+- struct net_device *phydev = xi->phydev;
++ struct net_device *phydev = __dev_get_by_index(xi->net, xi->p.link);
+ int err;
+
+ dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+@@ -652,13 +600,19 @@ static int xfrmi_dev_init(struct net_device *dev)
+
+ dev->features |= NETIF_F_LLTX;
+
+- dev->needed_headroom = phydev->needed_headroom;
+- dev->needed_tailroom = phydev->needed_tailroom;
++ if (phydev) {
++ dev->needed_headroom = phydev->needed_headroom;
++ dev->needed_tailroom = phydev->needed_tailroom;
+
+- if (is_zero_ether_addr(dev->dev_addr))
+- eth_hw_addr_inherit(dev, phydev);
+- if (is_zero_ether_addr(dev->broadcast))
+- memcpy(dev->broadcast, phydev->broadcast, dev->addr_len);
++ if (is_zero_ether_addr(dev->dev_addr))
++ eth_hw_addr_inherit(dev, phydev);
++ if (is_zero_ether_addr(dev->broadcast))
++ memcpy(dev->broadcast, phydev->broadcast,
++ dev->addr_len);
++ } else {
++ eth_hw_addr_random(dev);
++ eth_broadcast_addr(dev->broadcast);
++ }
+
+ return 0;
+ }
+@@ -689,21 +643,28 @@ static int xfrmi_newlink(struct net *src_net, struct net_device *dev,
+ struct netlink_ext_ack *extack)
+ {
+ struct net *net = dev_net(dev);
+- struct xfrm_if_parms *p;
++ struct xfrm_if_parms p;
+ struct xfrm_if *xi;
++ int err;
+
+- xi = netdev_priv(dev);
+- p = &xi->p;
+-
+- xfrmi_netlink_parms(data, p);
++ xfrmi_netlink_parms(data, &p);
+
+ if (!tb[IFLA_IFNAME])
+ return -EINVAL;
+
+- nla_strlcpy(p->name, tb[IFLA_IFNAME], IFNAMSIZ);
++ nla_strlcpy(p.name, tb[IFLA_IFNAME], IFNAMSIZ);
+
+- xi = xfrmi_locate(net, p, 1);
+- return PTR_ERR_OR_ZERO(xi);
++ xi = xfrmi_locate(net, &p);
++ if (xi)
++ return -EEXIST;
++
++ xi = netdev_priv(dev);
++ xi->p = p;
++ xi->net = net;
++ xi->dev = dev;
++
++ err = xfrmi_create(dev);
++ return err;
+ }
+
+ static void xfrmi_dellink(struct net_device *dev, struct list_head *head)
+@@ -716,20 +677,19 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[],
+ struct netlink_ext_ack *extack)
+ {
+ struct xfrm_if *xi = netdev_priv(dev);
+- struct net *net = dev_net(dev);
+-
+- xfrmi_netlink_parms(data, &xi->p);
++ struct net *net = xi->net;
++ struct xfrm_if_parms p;
+
+- xi = xfrmi_locate(net, &xi->p, 0);
+-
+- if (IS_ERR_OR_NULL(xi)) {
++ xfrmi_netlink_parms(data, &p);
++ xi = xfrmi_locate(net, &p);
++ if (!xi) {
+ xi = netdev_priv(dev);
+ } else {
+ if (xi->dev != dev)
+ return -EEXIST;
+ }
+
+- return xfrmi_update(xi, &xi->p);
++ return xfrmi_update(xi, &p);
+ }
+
+ static size_t xfrmi_get_size(const struct net_device *dev)
+@@ -760,7 +720,7 @@ struct net *xfrmi_get_link_net(const struct net_device *dev)
+ {
+ struct xfrm_if *xi = netdev_priv(dev);
+
+- return dev_net(xi->phydev);
++ return xi->net;
+ }
+
+ static const struct nla_policy xfrmi_policy[IFLA_XFRM_MAX + 1] = {
+diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
+index 61e596650ed3..a232741e3fd3 100644
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -252,6 +252,7 @@ DTC_FLAGS += -Wno-unit_address_vs_reg \
+ -Wno-alias_paths \
+ -Wno-graph_child_address \
+ -Wno-graph_port \
++ -Wno-simple_bus_reg \
+ -Wno-unique_unit_address \
+ -Wno-pci_device_reg
+ endif
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 858cbe56b100..91a80036c05d 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1163,6 +1163,14 @@ static const struct sectioncheck *section_mismatch(
+ * fromsec = text section
+ * refsymname = *.constprop.*
+ *
++ * Pattern 6:
++ * Hide section mismatch warnings for ELF local symbols. The goal
++ * is to eliminate false positive modpost warnings caused by
++ * compiler-generated ELF local symbol names such as ".LANCHOR1".
++ * Autogenerated symbol names bypass modpost's "Pattern 2"
++ * whitelisting, which relies on pattern-matching against symbol
++ * names to work. (One situation where gcc can autogenerate ELF
++ * local symbols is when "-fsection-anchors" is used.)
+ **/
+ static int secref_whitelist(const struct sectioncheck *mismatch,
+ const char *fromsec, const char *fromsym,
+@@ -1201,6 +1209,10 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
+ match(fromsym, optim_symbols))
+ return 0;
+
++ /* Check for pattern 6 */
++ if (strstarts(fromsym, ".L"))
++ return 0;
++
+ return 1;
+ }
+
+diff --git a/sound/core/oss/linear.c b/sound/core/oss/linear.c
+index 2045697f449d..797d838a2f9e 100644
+--- a/sound/core/oss/linear.c
++++ b/sound/core/oss/linear.c
+@@ -107,6 +107,8 @@ static snd_pcm_sframes_t linear_transfer(struct snd_pcm_plugin *plugin,
+ }
+ }
+ #endif
++ if (frames > dst_channels[0].frames)
++ frames = dst_channels[0].frames;
+ convert(plugin, src_channels, dst_channels, frames);
+ return frames;
+ }
+diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c
+index 7915564bd394..3788906421a7 100644
+--- a/sound/core/oss/mulaw.c
++++ b/sound/core/oss/mulaw.c
+@@ -269,6 +269,8 @@ static snd_pcm_sframes_t mulaw_transfer(struct snd_pcm_plugin *plugin,
+ }
+ }
+ #endif
++ if (frames > dst_channels[0].frames)
++ frames = dst_channels[0].frames;
+ data = (struct mulaw_priv *)plugin->extra_data;
+ data->func(plugin, src_channels, dst_channels, frames);
+ return frames;
+diff --git a/sound/core/oss/route.c b/sound/core/oss/route.c
+index c8171f5783c8..72dea04197ef 100644
+--- a/sound/core/oss/route.c
++++ b/sound/core/oss/route.c
+@@ -57,6 +57,8 @@ static snd_pcm_sframes_t route_transfer(struct snd_pcm_plugin *plugin,
+ return -ENXIO;
+ if (frames == 0)
+ return 0;
++ if (frames > dst_channels[0].frames)
++ frames = dst_channels[0].frames;
+
+ nsrcs = plugin->src_format.channels;
+ ndsts = plugin->dst_format.channels;
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 4e6110d778bd..ad52126d3d22 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1797,11 +1797,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
+ struct snd_pcm_runtime *runtime;
+ unsigned long flags;
+
+- if (PCM_RUNTIME_CHECK(substream))
++ if (snd_BUG_ON(!substream))
+ return;
+- runtime = substream->runtime;
+
+ snd_pcm_stream_lock_irqsave(substream, flags);
++ if (PCM_RUNTIME_CHECK(substream))
++ goto _unlock;
++ runtime = substream->runtime;
++
+ if (!snd_pcm_running(substream) ||
+ snd_pcm_update_hw_ptr0(substream, 1) < 0)
+ goto _end;
+@@ -1812,6 +1815,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
+ #endif
+ _end:
+ kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
++ _unlock:
+ snd_pcm_stream_unlock_irqrestore(substream, flags);
+ }
+ EXPORT_SYMBOL(snd_pcm_period_elapsed);
+diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
+index 8db1890605f6..c175b2cf63f7 100644
+--- a/sound/pci/hda/hda_bind.c
++++ b/sound/pci/hda/hda_bind.c
+@@ -42,6 +42,10 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev)
+ {
+ struct hda_codec *codec = container_of(dev, struct hda_codec, core);
+
++ /* ignore unsol events during shutdown */
++ if (codec->bus->shutdown)
++ return;
++
+ if (codec->patch_ops.unsol_event)
+ codec->patch_ops.unsol_event(codec, ev);
+ }
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 0b24c5ce2fd6..d63fea5d1c92 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1492,8 +1492,11 @@ static int azx_free(struct azx *chip)
+ static int azx_dev_disconnect(struct snd_device *device)
+ {
+ struct azx *chip = device->device_data;
++ struct hdac_bus *bus = azx_bus(chip);
+
+ chip->bus.shutdown = 1;
++ cancel_work_sync(&bus->unsol_work);
++
+ return 0;
+ }
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index ae8fde4c1a12..5500dd437b44 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -923,6 +923,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 7e86aeb3ec33..019dee96dbaa 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -379,9 +379,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0215:
+ case 0x10ec0233:
+ case 0x10ec0235:
+- case 0x10ec0236:
+ case 0x10ec0255:
+- case 0x10ec0256:
+ case 0x10ec0257:
+ case 0x10ec0282:
+ case 0x10ec0283:
+@@ -393,6 +391,11 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0300:
+ alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+ break;
++ case 0x10ec0236:
++ case 0x10ec0256:
++ alc_write_coef_idx(codec, 0x36, 0x5757);
++ alc_update_coef_idx(codec, 0x10, 1<<9, 0);
++ break;
+ case 0x10ec0275:
+ alc_update_coef_idx(codec, 0xe, 0, 1<<0);
+ break;
+@@ -5701,6 +5704,7 @@ enum {
+ ALC299_FIXUP_PREDATOR_SPK,
+ ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC,
+ ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE,
++ ALC294_FIXUP_ASUS_INTSPK_GPIO,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6764,6 +6768,13 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
+ },
++ [ALC294_FIXUP_ASUS_INTSPK_GPIO] = {
++ .type = HDA_FIXUP_FUNC,
++ /* The GPIO must be pulled to initialize the AMP */
++ .v.func = alc_fixup_gpio4,
++ .chained = true,
++ .chain_id = ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6923,7 +6934,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+ SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+- SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_INTSPK_GPIO),
+ SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
+@@ -7030,6 +7041,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
+ SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MBXP", ALC256_FIXUP_HUAWEI_MBXP_PINS),
+ SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
++ SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE),
+
+ #if 0
+diff --git a/sound/soc/codecs/max9867.c b/sound/soc/codecs/max9867.c
+index 4ea3287162ad..e51143df4702 100644
+--- a/sound/soc/codecs/max9867.c
++++ b/sound/soc/codecs/max9867.c
+@@ -248,17 +248,6 @@ static int max9867_dai_hw_params(struct snd_pcm_substream *substream,
+ return 0;
+ }
+
+-static int max9867_prepare(struct snd_pcm_substream *substream,
+- struct snd_soc_dai *dai)
+-{
+- struct snd_soc_component *component = dai->component;
+- struct max9867_priv *max9867 = snd_soc_component_get_drvdata(component);
+-
+- regmap_update_bits(max9867->regmap, MAX9867_PWRMAN,
+- MAX9867_SHTDOWN_MASK, MAX9867_SHTDOWN_MASK);
+- return 0;
+-}
+-
+ static int max9867_mute(struct snd_soc_dai *dai, int mute)
+ {
+ struct snd_soc_component *component = dai->component;
+@@ -361,7 +350,6 @@ static int max9867_dai_set_fmt(struct snd_soc_dai *codec_dai,
+ static const struct snd_soc_dai_ops max9867_dai_ops = {
+ .set_fmt = max9867_dai_set_fmt,
+ .set_sysclk = max9867_set_dai_sysclk,
+- .prepare = max9867_prepare,
+ .digital_mute = max9867_mute,
+ .hw_params = max9867_dai_hw_params,
+ };
+@@ -392,27 +380,59 @@ static struct snd_soc_dai_driver max9867_dai[] = {
+ }
+ };
+
+-#ifdef CONFIG_PM_SLEEP
+-static int max9867_suspend(struct device *dev)
++#ifdef CONFIG_PM
++static int max9867_suspend(struct snd_soc_component *component)
+ {
+- struct max9867_priv *max9867 = dev_get_drvdata(dev);
++ snd_soc_component_force_bias_level(component, SND_SOC_BIAS_OFF);
+
+- /* Drop down to power saving mode when system is suspended */
+- regmap_update_bits(max9867->regmap, MAX9867_PWRMAN,
+- MAX9867_SHTDOWN_MASK, ~MAX9867_SHTDOWN_MASK);
+ return 0;
+ }
+
+-static int max9867_resume(struct device *dev)
++static int max9867_resume(struct snd_soc_component *component)
+ {
+- struct max9867_priv *max9867 = dev_get_drvdata(dev);
++ snd_soc_component_force_bias_level(component, SND_SOC_BIAS_STANDBY);
+
+- regmap_update_bits(max9867->regmap, MAX9867_PWRMAN,
+- MAX9867_SHTDOWN_MASK, MAX9867_SHTDOWN_MASK);
+ return 0;
+ }
++#else
++#define max9867_suspend NULL
++#define max9867_resume NULL
+ #endif
+
++static int max9867_set_bias_level(struct snd_soc_component *component,
++ enum snd_soc_bias_level level)
++{
++ int err;
++ struct max9867_priv *max9867 = snd_soc_component_get_drvdata(component);
++
++ switch (level) {
++ case SND_SOC_BIAS_STANDBY:
++ if (snd_soc_component_get_bias_level(component) == SND_SOC_BIAS_OFF) {
++ err = regcache_sync(max9867->regmap);
++ if (err)
++ return err;
++
++ err = regmap_update_bits(max9867->regmap, MAX9867_PWRMAN,
++ MAX9867_SHTDOWN, MAX9867_SHTDOWN);
++ if (err)
++ return err;
++ }
++ break;
++ case SND_SOC_BIAS_OFF:
++ err = regmap_update_bits(max9867->regmap, MAX9867_PWRMAN,
++ MAX9867_SHTDOWN, 0);
++ if (err)
++ return err;
++
++ regcache_mark_dirty(max9867->regmap);
++ break;
++ default:
++ break;
++ }
++
++ return 0;
++}
++
+ static const struct snd_soc_component_driver max9867_component = {
+ .controls = max9867_snd_controls,
+ .num_controls = ARRAY_SIZE(max9867_snd_controls),
+@@ -420,6 +440,9 @@ static const struct snd_soc_component_driver max9867_component = {
+ .num_dapm_routes = ARRAY_SIZE(max9867_audio_map),
+ .dapm_widgets = max9867_dapm_widgets,
+ .num_dapm_widgets = ARRAY_SIZE(max9867_dapm_widgets),
++ .suspend = max9867_suspend,
++ .resume = max9867_resume,
++ .set_bias_level = max9867_set_bias_level,
+ .idle_bias_on = 1,
+ .use_pmdown_time = 1,
+ .endianness = 1,
+@@ -518,15 +541,10 @@ static const struct of_device_id max9867_of_match[] = {
+ };
+ MODULE_DEVICE_TABLE(of, max9867_of_match);
+
+-static const struct dev_pm_ops max9867_pm_ops = {
+- SET_SYSTEM_SLEEP_PM_OPS(max9867_suspend, max9867_resume)
+-};
+-
+ static struct i2c_driver max9867_i2c_driver = {
+ .driver = {
+ .name = "max9867",
+ .of_match_table = of_match_ptr(max9867_of_match),
+- .pm = &max9867_pm_ops,
+ },
+ .probe = max9867_i2c_probe,
+ .id_table = max9867_i2c_id,
+diff --git a/sound/soc/codecs/max9867.h b/sound/soc/codecs/max9867.h
+index 55cd9976ff47..d9170850c96e 100644
+--- a/sound/soc/codecs/max9867.h
++++ b/sound/soc/codecs/max9867.h
+@@ -67,7 +67,7 @@
+ #define MAX9867_MICCONFIG 0x15
+ #define MAX9867_MODECONFIG 0x16
+ #define MAX9867_PWRMAN 0x17
+-#define MAX9867_SHTDOWN_MASK (1<<7)
++#define MAX9867_SHTDOWN 0x80
+ #define MAX9867_REVISION 0xff
+
+ #define MAX9867_CACHEREGNUM 10
+diff --git a/sound/soc/codecs/nau8540.c b/sound/soc/codecs/nau8540.c
+index e3c8cd17daf2..4dd1a609756b 100644
+--- a/sound/soc/codecs/nau8540.c
++++ b/sound/soc/codecs/nau8540.c
+@@ -585,7 +585,7 @@ static int nau8540_calc_fll_param(unsigned int fll_in,
+ fvco_max = 0;
+ fvco_sel = ARRAY_SIZE(mclk_src_scaling);
+ for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) {
+- fvco = 256 * fs * 2 * mclk_src_scaling[i].param;
++ fvco = 256ULL * fs * 2 * mclk_src_scaling[i].param;
+ if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX &&
+ fvco_max < fvco) {
+ fvco_max = fvco;
+diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
+index 15a31820df16..4e6ecdc83ea9 100644
+--- a/sound/soc/sh/rcar/core.c
++++ b/sound/soc/sh/rcar/core.c
+@@ -1344,6 +1344,18 @@ int rsnd_kctrl_new(struct rsnd_mod *mod,
+ };
+ int ret;
+
++ /*
++ * 1) Avoid duplicate register for DVC with MIX case
++ * 2) Allow duplicate register for MIX
++ * 3) re-register if card was rebinded
++ */
++ list_for_each_entry(kctrl, &card->controls, list) {
++ struct rsnd_kctrl_cfg *c = kctrl->private_data;
++
++ if (c == cfg)
++ return 0;
++ }
++
+ if (size > RSND_MAX_CHANNELS)
+ return -EINVAL;
+
+diff --git a/sound/soc/sh/rcar/dvc.c b/sound/soc/sh/rcar/dvc.c
+index 2b16e0ce6bc5..024ece46bf68 100644
+--- a/sound/soc/sh/rcar/dvc.c
++++ b/sound/soc/sh/rcar/dvc.c
+@@ -40,11 +40,8 @@ struct rsnd_dvc {
+ struct rsnd_kctrl_cfg_s ren; /* Ramp Enable */
+ struct rsnd_kctrl_cfg_s rup; /* Ramp Rate Up */
+ struct rsnd_kctrl_cfg_s rdown; /* Ramp Rate Down */
+- u32 flags;
+ };
+
+-#define KCTRL_INITIALIZED (1 << 0)
+-
+ #define rsnd_dvc_get(priv, id) ((struct rsnd_dvc *)(priv->dvc) + id)
+ #define rsnd_dvc_nr(priv) ((priv)->dvc_nr)
+
+@@ -227,9 +224,6 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod,
+ int channels = rsnd_rdai_channels_get(rdai);
+ int ret;
+
+- if (rsnd_flags_has(dvc, KCTRL_INITIALIZED))
+- return 0;
+-
+ /* Volume */
+ ret = rsnd_kctrl_new_m(mod, io, rtd,
+ is_play ?
+@@ -285,8 +279,6 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod,
+ if (ret < 0)
+ return ret;
+
+- rsnd_flags_set(dvc, KCTRL_INITIALIZED);
+-
+ return 0;
+ }
+
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index 55bc512a1831..e4e6e2b3fd84 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -32,7 +32,7 @@ static void btf_dumper_ptr(const void *data, json_writer_t *jw,
+ }
+
+ static int btf_dumper_modifier(const struct btf_dumper *d, __u32 type_id,
+- const void *data)
++ __u8 bit_offset, const void *data)
+ {
+ int actual_type_id;
+
+@@ -40,7 +40,7 @@ static int btf_dumper_modifier(const struct btf_dumper *d, __u32 type_id,
+ if (actual_type_id < 0)
+ return actual_type_id;
+
+- return btf_dumper_do_type(d, actual_type_id, 0, data);
++ return btf_dumper_do_type(d, actual_type_id, bit_offset, data);
+ }
+
+ static void btf_dumper_enum(const void *data, json_writer_t *jw)
+@@ -237,7 +237,7 @@ static int btf_dumper_do_type(const struct btf_dumper *d, __u32 type_id,
+ case BTF_KIND_VOLATILE:
+ case BTF_KIND_CONST:
+ case BTF_KIND_RESTRICT:
+- return btf_dumper_modifier(d, type_id, data);
++ return btf_dumper_modifier(d, type_id, bit_offset, data);
+ default:
+ jsonw_printf(d->jw, "(unsupported-kind");
+ return -EINVAL;
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index a350f97e3a1a..a62be78fc07b 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -22,7 +22,9 @@
+ * License along with this program; if not, see <http://www.gnu.org/licenses>
+ */
+
++#ifndef _GNU_SOURCE
+ #define _GNU_SOURCE
++#endif
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <stdarg.h>
+diff --git a/tools/lib/bpf/libbpf_errno.c b/tools/lib/bpf/libbpf_errno.c
+index d9ba851bd7f9..d2d17226d9d6 100644
+--- a/tools/lib/bpf/libbpf_errno.c
++++ b/tools/lib/bpf/libbpf_errno.c
+@@ -20,6 +20,7 @@
+ * License along with this program; if not, see <http://www.gnu.org/licenses>
+ */
+
++#undef _GNU_SOURCE
+ #include <stdio.h>
+ #include <string.h>
+
+diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
+index d20f851796c5..a4c78499c838 100644
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -1037,7 +1037,7 @@ static int perf_sample__fprintf_brstackinsn(struct perf_sample *sample,
+ insn++;
+ }
+ }
+- if (off != (unsigned)len)
++ if (off != end - start)
+ printed += fprintf(fp, "\tmismatch of LBR data and executable\n");
+ }
+
+diff --git a/tools/testing/selftests/kvm/lib/assert.c b/tools/testing/selftests/kvm/lib/assert.c
+index cd01144d27c8..d30667706569 100644
+--- a/tools/testing/selftests/kvm/lib/assert.c
++++ b/tools/testing/selftests/kvm/lib/assert.c
+@@ -56,7 +56,7 @@ static void test_dump_stack(void)
+ #pragma GCC diagnostic pop
+ }
+
+-static pid_t gettid(void)
++static pid_t _gettid(void)
+ {
+ return syscall(SYS_gettid);
+ }
+@@ -73,7 +73,7 @@ test_assert(bool exp, const char *exp_str,
+ fprintf(stderr, "==== Test Assertion Failure ====\n"
+ " %s:%u: %s\n"
+ " pid=%d tid=%d - %s\n",
+- file, line, exp_str, getpid(), gettid(),
++ file, line, exp_str, getpid(), _gettid(),
+ strerror(errno));
+ test_dump_stack();
+ if (fmt) {
+diff --git a/tools/testing/selftests/powerpc/ptrace/core-pkey.c b/tools/testing/selftests/powerpc/ptrace/core-pkey.c
+index e23e2e199eb4..d5c64fee032d 100644
+--- a/tools/testing/selftests/powerpc/ptrace/core-pkey.c
++++ b/tools/testing/selftests/powerpc/ptrace/core-pkey.c
+@@ -352,10 +352,7 @@ static int write_core_pattern(const char *core_pattern)
+ FILE *f;
+
+ f = fopen(core_pattern_file, "w");
+- if (!f) {
+- perror("Error writing to core_pattern file");
+- return TEST_FAIL;
+- }
++ SKIP_IF_MSG(!f, "Try with root privileges");
+
+ ret = fwrite(core_pattern, 1, len, f);
+ fclose(f);
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c
+index 0b4ebcc2f485..ca29fafeed5d 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c
+@@ -31,7 +31,7 @@ void gpr(void)
+ ASM_LOAD_GPR_IMMED(gpr_1)
+ ASM_LOAD_FPR_SINGLE_PRECISION(flt_1)
+ :
+- : [gpr_1]"i"(GPR_1), [flt_1] "r" (&a)
++ : [gpr_1]"i"(GPR_1), [flt_1] "b" (&a)
+ : "memory", "r6", "r7", "r8", "r9", "r10",
+ "r11", "r12", "r13", "r14", "r15", "r16", "r17",
+ "r18", "r19", "r20", "r21", "r22", "r23", "r24",
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c
+index 59206b96e98a..a08a91594dbe 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c
+@@ -59,8 +59,8 @@ trans:
+ "3: ;"
+ : [res] "=r" (result), [texasr] "=r" (texasr)
+ : [gpr_1]"i"(GPR_1), [gpr_2]"i"(GPR_2),
+- [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "r" (&a),
+- [flt_2] "r" (&b), [cptr1] "r" (&cptr[1])
++ [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "b" (&a),
++ [flt_2] "b" (&b), [cptr1] "b" (&cptr[1])
+ : "memory", "r7", "r8", "r9", "r10",
+ "r11", "r12", "r13", "r14", "r15", "r16",
+ "r17", "r18", "r19", "r20", "r21", "r22",
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c
+index b3c061dc9512..f47174746231 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c
+@@ -72,7 +72,7 @@ trans:
+ "3: ;"
+
+ : [res] "=r" (result), [texasr] "=r" (texasr)
+- : [val] "r" (cptr[1]), [sprn_dscr]"i"(SPRN_DSCR),
++ : [sprn_dscr]"i"(SPRN_DSCR),
+ [sprn_tar]"i"(SPRN_TAR), [sprn_ppr]"i"(SPRN_PPR),
+ [sprn_texasr]"i"(SPRN_TEXASR), [tar_1]"i"(TAR_1),
+ [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2), [dscr_2]"i"(DSCR_2),
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c
+index 277dade1b382..18a685bf6a09 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c
+@@ -77,8 +77,7 @@ trans:
+
+ "3: ;"
+ : [res] "=r" (result), [texasr] "=r" (texasr)
+- : [fp_load] "r" (fp_load), [fp_load_ckpt] "r" (fp_load_ckpt),
+- [sprn_texasr] "i" (SPRN_TEXASR)
++ : [sprn_texasr] "i" (SPRN_TEXASR)
+ : "memory", "r0", "r1", "r3", "r4",
+ "r7", "r8", "r9", "r10", "r11"
+ );
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c
+index 51427a2465f6..ba04999254e3 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c
+@@ -74,7 +74,7 @@ trans:
+
+ "3: ;"
+ : [tfhar] "=r" (tfhar), [res] "=r" (result),
+- [texasr] "=r" (texasr), [cptr1] "=r" (cptr1)
++ [texasr] "=r" (texasr), [cptr1] "=b" (cptr1)
+ : [sprn_texasr] "i" (SPRN_TEXASR)
+ : "memory", "r0", "r8", "r31"
+ );
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c
+index 48b462f75023..f70023b25e6e 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c
+@@ -65,7 +65,7 @@ trans:
+ : [sprn_dscr]"i"(SPRN_DSCR), [sprn_tar]"i"(SPRN_TAR),
+ [sprn_ppr]"i"(SPRN_PPR), [sprn_texasr]"i"(SPRN_TEXASR),
+ [tar_1]"i"(TAR_1), [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2),
+- [dscr_2]"i"(DSCR_2), [cptr1] "r" (&cptr[1])
++ [dscr_2]"i"(DSCR_2), [cptr1] "b" (&cptr[1])
+ : "memory", "r0", "r1", "r3", "r4", "r5", "r6"
+ );
+
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c
+index 17c23cabac3e..dfba80058977 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c
+@@ -65,8 +65,7 @@ trans:
+
+ "3: ;"
+ : [res] "=r" (result), [texasr] "=r" (texasr)
+- : [fp_load] "r" (fp_load), [fp_load_ckpt] "r" (fp_load_ckpt),
+- [sprn_texasr] "i" (SPRN_TEXASR), [cptr1] "r" (&cptr[1])
++ : [sprn_texasr] "i" (SPRN_TEXASR), [cptr1] "b" (&cptr[1])
+ : "memory", "r0", "r1", "r3", "r4",
+ "r7", "r8", "r9", "r10", "r11"
+ );
+diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
+index 8b958ed05306..62a3a2f716bf 100644
+--- a/virt/kvm/arm/vgic/vgic-v3.c
++++ b/virt/kvm/arm/vgic/vgic-v3.c
+@@ -375,8 +375,8 @@ retry:
+ int vgic_v3_save_pending_tables(struct kvm *kvm)
+ {
+ struct vgic_dist *dist = &kvm->arch.vgic;
+- int last_byte_offset = -1;
+ struct vgic_irq *irq;
++ gpa_t last_ptr = ~(gpa_t)0;
+ int ret;
+ u8 val;
+
+@@ -396,11 +396,11 @@ int vgic_v3_save_pending_tables(struct kvm *kvm)
+ bit_nr = irq->intid % BITS_PER_BYTE;
+ ptr = pendbase + byte_offset;
+
+- if (byte_offset != last_byte_offset) {
++ if (ptr != last_ptr) {
+ ret = kvm_read_guest_lock(kvm, ptr, &val, 1);
+ if (ret)
+ return ret;
+- last_byte_offset = byte_offset;
++ last_ptr = ptr;
+ }
+
+ stored = val & (1U << bit_nr);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-12-17 21:56 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-12-17 21:56 UTC (permalink / raw
To: gentoo-commits
commit: 77141508ac64b164cfac8cbb958a4edb788040b4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 17 21:55:52 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Dec 17 21:55:52 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=77141508
Linux patch 4.19.90
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1089_linux-4.19.90.patch | 6073 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6077 insertions(+)
diff --git a/0000_README b/0000_README
index 198a710..aecec9f 100644
--- a/0000_README
+++ b/0000_README
@@ -395,6 +395,10 @@ Patch: 1088_linux-4.19.89.patch
From: https://www.kernel.org
Desc: Linux 4.19.89
+Patch: 1089_linux-4.19.90.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.90
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1089_linux-4.19.90.patch b/1089_linux-4.19.90.patch
new file mode 100644
index 0000000..20c2fe0
--- /dev/null
+++ b/1089_linux-4.19.90.patch
@@ -0,0 +1,6073 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index ce1af89dbbb8..2c0d6ae221a1 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -4941,13 +4941,13 @@
+ Flags is a set of characters, each corresponding
+ to a common usb-storage quirk flag as follows:
+ a = SANE_SENSE (collect more than 18 bytes
+- of sense data);
++ of sense data, not on uas);
+ b = BAD_SENSE (don't collect more than 18
+- bytes of sense data);
++ bytes of sense data, not on uas);
+ c = FIX_CAPACITY (decrease the reported
+ device capacity by one sector);
+ d = NO_READ_DISC_INFO (don't use
+- READ_DISC_INFO command);
++ READ_DISC_INFO command, not on uas);
+ e = NO_READ_CAPACITY_16 (don't use
+ READ_CAPACITY_16 command);
+ f = NO_REPORT_OPCODES (don't use report opcodes
+@@ -4962,17 +4962,18 @@
+ j = NO_REPORT_LUNS (don't use report luns
+ command, uas only);
+ l = NOT_LOCKABLE (don't try to lock and
+- unlock ejectable media);
++ unlock ejectable media, not on uas);
+ m = MAX_SECTORS_64 (don't transfer more
+- than 64 sectors = 32 KB at a time);
++ than 64 sectors = 32 KB at a time,
++ not on uas);
+ n = INITIAL_READ10 (force a retry of the
+- initial READ(10) command);
++ initial READ(10) command, not on uas);
+ o = CAPACITY_OK (accept the capacity
+- reported by the device);
++ reported by the device, not on uas);
+ p = WRITE_CACHE (the device cache is ON
+- by default);
++ by default, not on uas);
+ r = IGNORE_RESIDUE (the device reports
+- bogus residue values);
++ bogus residue values, not on uas);
+ s = SINGLE_LUN (the device has only one
+ Logical Unit);
+ t = NO_ATA_1X (don't allow ATA(12) and ATA(16)
+@@ -4981,7 +4982,8 @@
+ w = NO_WP_DETECT (don't test whether the
+ medium is write-protected).
+ y = ALWAYS_SYNC (issue a SYNCHRONIZE_CACHE
+- even if the device claims no cache)
++ even if the device claims no cache,
++ not on uas)
+ Example: quirks=0419:aaf5:rl,0421:0433:rc
+
+ user_debug= [KNL,ARM]
+diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
+index 06ac6dda9b34..0d0ecc7df260 100644
+--- a/Documentation/filesystems/proc.txt
++++ b/Documentation/filesystems/proc.txt
+@@ -425,6 +425,7 @@ SwapPss: 0 kB
+ KernelPageSize: 4 kB
+ MMUPageSize: 4 kB
+ Locked: 0 kB
++THPeligible: 0
+ VmFlags: rd ex mr mw me dw
+
+ the first of these lines shows the same information as is displayed for the
+@@ -462,6 +463,8 @@ replaced by copy-on-write) part of the underlying shmem object out on swap.
+ "SwapPss" shows proportional swap share of this mapping. Unlike "Swap", this
+ does not take into account swapped out page of underlying shmem objects.
+ "Locked" indicates whether the mapping is locked in memory or not.
++"THPeligible" indicates whether the mapping is eligible for THP pages - 1 if
++true, 0 otherwise.
+
+ "VmFlags" field deserves a separate description. This member represents the kernel
+ flags associated with the particular virtual memory area in two letter encoded
+diff --git a/Makefile b/Makefile
+index 805dbba940a7..39bdbafae517 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 89
++SUBLEVEL = 90
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/omap3-pandora-common.dtsi b/arch/arm/boot/dts/omap3-pandora-common.dtsi
+index 90c98f95b2b3..a51081de7144 100644
+--- a/arch/arm/boot/dts/omap3-pandora-common.dtsi
++++ b/arch/arm/boot/dts/omap3-pandora-common.dtsi
+@@ -229,6 +229,17 @@
+ gpio = <&gpio6 4 GPIO_ACTIVE_HIGH>; /* GPIO_164 */
+ };
+
++ /* wl1251 wifi+bt module */
++ wlan_en: fixed-regulator-wg7210_en {
++ compatible = "regulator-fixed";
++ regulator-name = "vwlan";
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ startup-delay-us = <50000>;
++ enable-active-high;
++ gpio = <&gpio1 23 GPIO_ACTIVE_HIGH>;
++ };
++
+ /* wg7210 (wifi+bt module) 32k clock buffer */
+ wg7210_32k: fixed-regulator-wg7210_32k {
+ compatible = "regulator-fixed";
+@@ -525,9 +536,30 @@
+ /*wp-gpios = <&gpio4 31 GPIO_ACTIVE_HIGH>;*/ /* GPIO_127 */
+ };
+
+-/* mmc3 is probed using pdata-quirks to pass wl1251 card data */
+ &mmc3 {
+- status = "disabled";
++ vmmc-supply = <&wlan_en>;
++
++ bus-width = <4>;
++ non-removable;
++ ti,non-removable;
++ cap-power-off-card;
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&mmc3_pins>;
++
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ wlan: wifi@1 {
++ compatible = "ti,wl1251";
++
++ reg = <1>;
++
++ interrupt-parent = <&gpio1>;
++ interrupts = <21 IRQ_TYPE_LEVEL_HIGH>; /* GPIO_21 */
++
++ ti,wl1251-has-eeprom;
++ };
+ };
+
+ /* bluetooth*/
+diff --git a/arch/arm/boot/dts/omap3-tao3530.dtsi b/arch/arm/boot/dts/omap3-tao3530.dtsi
+index 6f5bd027b717..7b4ec2c40042 100644
+--- a/arch/arm/boot/dts/omap3-tao3530.dtsi
++++ b/arch/arm/boot/dts/omap3-tao3530.dtsi
+@@ -225,7 +225,7 @@
+ pinctrl-0 = <&mmc1_pins>;
+ vmmc-supply = <&vmmc1>;
+ vqmmc-supply = <&vsim>;
+- cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_HIGH>;
++ cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_LOW>;
+ bus-width = <8>;
+ };
+
+diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
+index 7f02743edbe4..dae726228770 100644
+--- a/arch/arm/mach-omap2/pdata-quirks.c
++++ b/arch/arm/mach-omap2/pdata-quirks.c
+@@ -305,108 +305,15 @@ static void __init omap3_logicpd_torpedo_init(void)
+ }
+
+ /* omap3pandora legacy devices */
+-#define PANDORA_WIFI_IRQ_GPIO 21
+-#define PANDORA_WIFI_NRESET_GPIO 23
+
+ static struct platform_device pandora_backlight = {
+ .name = "pandora-backlight",
+ .id = -1,
+ };
+
+-static struct regulator_consumer_supply pandora_vmmc3_supply[] = {
+- REGULATOR_SUPPLY("vmmc", "omap_hsmmc.2"),
+-};
+-
+-static struct regulator_init_data pandora_vmmc3 = {
+- .constraints = {
+- .valid_ops_mask = REGULATOR_CHANGE_STATUS,
+- },
+- .num_consumer_supplies = ARRAY_SIZE(pandora_vmmc3_supply),
+- .consumer_supplies = pandora_vmmc3_supply,
+-};
+-
+-static struct fixed_voltage_config pandora_vwlan = {
+- .supply_name = "vwlan",
+- .microvolts = 1800000, /* 1.8V */
+- .gpio = PANDORA_WIFI_NRESET_GPIO,
+- .startup_delay = 50000, /* 50ms */
+- .enable_high = 1,
+- .init_data = &pandora_vmmc3,
+-};
+-
+-static struct platform_device pandora_vwlan_device = {
+- .name = "reg-fixed-voltage",
+- .id = 1,
+- .dev = {
+- .platform_data = &pandora_vwlan,
+- },
+-};
+-
+-static void pandora_wl1251_init_card(struct mmc_card *card)
+-{
+- /*
+- * We have TI wl1251 attached to MMC3. Pass this information to
+- * SDIO core because it can't be probed by normal methods.
+- */
+- if (card->type == MMC_TYPE_SDIO || card->type == MMC_TYPE_SD_COMBO) {
+- card->quirks |= MMC_QUIRK_NONSTD_SDIO;
+- card->cccr.wide_bus = 1;
+- card->cis.vendor = 0x104c;
+- card->cis.device = 0x9066;
+- card->cis.blksize = 512;
+- card->cis.max_dtr = 24000000;
+- card->ocr = 0x80;
+- }
+-}
+-
+-static struct omap2_hsmmc_info pandora_mmc3[] = {
+- {
+- .mmc = 3,
+- .caps = MMC_CAP_4_BIT_DATA | MMC_CAP_POWER_OFF_CARD,
+- .gpio_cd = -EINVAL,
+- .gpio_wp = -EINVAL,
+- .init_card = pandora_wl1251_init_card,
+- },
+- {} /* Terminator */
+-};
+-
+-static void __init pandora_wl1251_init(void)
+-{
+- struct wl1251_platform_data pandora_wl1251_pdata;
+- int ret;
+-
+- memset(&pandora_wl1251_pdata, 0, sizeof(pandora_wl1251_pdata));
+-
+- pandora_wl1251_pdata.power_gpio = -1;
+-
+- ret = gpio_request_one(PANDORA_WIFI_IRQ_GPIO, GPIOF_IN, "wl1251 irq");
+- if (ret < 0)
+- goto fail;
+-
+- pandora_wl1251_pdata.irq = gpio_to_irq(PANDORA_WIFI_IRQ_GPIO);
+- if (pandora_wl1251_pdata.irq < 0)
+- goto fail_irq;
+-
+- pandora_wl1251_pdata.use_eeprom = true;
+- ret = wl1251_set_platform_data(&pandora_wl1251_pdata);
+- if (ret < 0)
+- goto fail_irq;
+-
+- return;
+-
+-fail_irq:
+- gpio_free(PANDORA_WIFI_IRQ_GPIO);
+-fail:
+- pr_err("wl1251 board initialisation failed\n");
+-}
+-
+ static void __init omap3_pandora_legacy_init(void)
+ {
+ platform_device_register(&pandora_backlight);
+- platform_device_register(&pandora_vwlan_device);
+- omap_hsmmc_init(pandora_mmc3);
+- omap_hsmmc_late_init(pandora_mmc3);
+- pandora_wl1251_init();
+ }
+ #endif /* CONFIG_ARCH_OMAP3 */
+
+diff --git a/arch/powerpc/include/asm/vdso_datapage.h b/arch/powerpc/include/asm/vdso_datapage.h
+index bbc06bd72b1f..4333b9a473dc 100644
+--- a/arch/powerpc/include/asm/vdso_datapage.h
++++ b/arch/powerpc/include/asm/vdso_datapage.h
+@@ -86,6 +86,7 @@ struct vdso_data {
+ __s32 wtom_clock_nsec; /* Wall to monotonic clock nsec */
+ __s64 wtom_clock_sec; /* Wall to monotonic clock sec */
+ struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */
++ __u32 hrtimer_res; /* hrtimer resolution */
+ __u32 syscall_map_64[SYSCALL_MAP_SIZE]; /* map of syscalls */
+ __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */
+ };
+@@ -107,6 +108,7 @@ struct vdso_data {
+ __s32 wtom_clock_nsec;
+ struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */
+ __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */
++ __u32 hrtimer_res; /* hrtimer resolution */
+ __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */
+ __u32 dcache_block_size; /* L1 d-cache block size */
+ __u32 icache_block_size; /* L1 i-cache block size */
+diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
+index eac18790d1b1..d450280e5c29 100644
+--- a/arch/powerpc/kernel/Makefile
++++ b/arch/powerpc/kernel/Makefile
+@@ -5,8 +5,8 @@
+
+ CFLAGS_ptrace.o += -DUTS_MACHINE='"$(UTS_MACHINE)"'
+
+-# Disable clang warning for using setjmp without setjmp.h header
+-CFLAGS_crash.o += $(call cc-disable-warning, builtin-requires-header)
++# Avoid clang warnings around longjmp/setjmp declarations
++CFLAGS_crash.o += -ffreestanding
+
+ subdir-ccflags-$(CONFIG_PPC_WERROR) := -Werror
+
+diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
+index 7c3738d890e8..50400f213bbf 100644
+--- a/arch/powerpc/kernel/asm-offsets.c
++++ b/arch/powerpc/kernel/asm-offsets.c
+@@ -379,6 +379,7 @@ int main(void)
+ OFFSET(WTOM_CLOCK_NSEC, vdso_data, wtom_clock_nsec);
+ OFFSET(STAMP_XTIME, vdso_data, stamp_xtime);
+ OFFSET(STAMP_SEC_FRAC, vdso_data, stamp_sec_fraction);
++ OFFSET(CLOCK_HRTIMER_RES, vdso_data, hrtimer_res);
+ OFFSET(CFG_ICACHE_BLOCKSZ, vdso_data, icache_block_size);
+ OFFSET(CFG_DCACHE_BLOCKSZ, vdso_data, dcache_block_size);
+ OFFSET(CFG_ICACHE_LOGBLOCKSZ, vdso_data, icache_log_block_size);
+@@ -409,7 +410,6 @@ int main(void)
+ DEFINE(CLOCK_REALTIME_COARSE, CLOCK_REALTIME_COARSE);
+ DEFINE(CLOCK_MONOTONIC_COARSE, CLOCK_MONOTONIC_COARSE);
+ DEFINE(NSEC_PER_SEC, NSEC_PER_SEC);
+- DEFINE(CLOCK_REALTIME_RES, MONOTONIC_RES_NSEC);
+
+ #ifdef CONFIG_BUG
+ DEFINE(BUG_ENTRY_SIZE, sizeof(struct bug_entry));
+diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
+index 1bf6aaefd26a..facc02964ab3 100644
+--- a/arch/powerpc/kernel/misc_64.S
++++ b/arch/powerpc/kernel/misc_64.S
+@@ -87,7 +87,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE)
+ subf r8,r6,r4 /* compute length */
+ add r8,r8,r5 /* ensure we get enough */
+ lwz r9,DCACHEL1LOGBLOCKSIZE(r10) /* Get log-2 of cache block size */
+- srw. r8,r8,r9 /* compute line count */
++ srd. r8,r8,r9 /* compute line count */
+ beqlr /* nothing to do? */
+ mtctr r8
+ 1: dcbst 0,r6
+@@ -103,7 +103,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE)
+ subf r8,r6,r4 /* compute length */
+ add r8,r8,r5
+ lwz r9,ICACHEL1LOGBLOCKSIZE(r10) /* Get log-2 of Icache block size */
+- srw. r8,r8,r9 /* compute line count */
++ srd. r8,r8,r9 /* compute line count */
+ beqlr /* nothing to do? */
+ mtctr r8
+ 2: icbi 0,r6
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index 7707990c4c16..8487ad686462 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -929,6 +929,7 @@ void update_vsyscall(struct timekeeper *tk)
+ vdso_data->wtom_clock_nsec = tk->wall_to_monotonic.tv_nsec;
+ vdso_data->stamp_xtime = xt;
+ vdso_data->stamp_sec_fraction = frac_sec;
++ vdso_data->hrtimer_res = hrtimer_resolution;
+ smp_wmb();
+ ++(vdso_data->tb_update_count);
+ }
+diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
+index afd516b572f8..49eecd28aef1 100644
+--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
+@@ -160,12 +160,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres)
+ cror cr0*4+eq,cr0*4+eq,cr1*4+eq
+ bne cr0,99f
+
++ mflr r12
++ .cfi_register lr,r12
++ bl __get_datapage@local /* get data page */
++ lwz r5, CLOCK_HRTIMER_RES(r3)
++ mtlr r12
+ li r3,0
+ cmpli cr0,r4,0
+ crclr cr0*4+so
+ beqlr
+- lis r5,CLOCK_REALTIME_RES@h
+- ori r5,r5,CLOCK_REALTIME_RES@l
+ stw r3,TSPC32_TV_SEC(r4)
+ stw r5,TSPC32_TV_NSEC(r4)
+ blr
+diff --git a/arch/powerpc/kernel/vdso64/cacheflush.S b/arch/powerpc/kernel/vdso64/cacheflush.S
+index 69c5af2b3c96..228a4a2383d6 100644
+--- a/arch/powerpc/kernel/vdso64/cacheflush.S
++++ b/arch/powerpc/kernel/vdso64/cacheflush.S
+@@ -39,7 +39,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache)
+ subf r8,r6,r4 /* compute length */
+ add r8,r8,r5 /* ensure we get enough */
+ lwz r9,CFG_DCACHE_LOGBLOCKSZ(r10)
+- srw. r8,r8,r9 /* compute line count */
++ srd. r8,r8,r9 /* compute line count */
+ crclr cr0*4+so
+ beqlr /* nothing to do? */
+ mtctr r8
+@@ -56,7 +56,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache)
+ subf r8,r6,r4 /* compute length */
+ add r8,r8,r5
+ lwz r9,CFG_ICACHE_LOGBLOCKSZ(r10)
+- srw. r8,r8,r9 /* compute line count */
++ srd. r8,r8,r9 /* compute line count */
+ crclr cr0*4+so
+ beqlr /* nothing to do? */
+ mtctr r8
+diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
+index 1f324c28705b..020e90d1079d 100644
+--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
+@@ -190,12 +190,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres)
+ cror cr0*4+eq,cr0*4+eq,cr1*4+eq
+ bne cr0,99f
+
++ mflr r12
++ .cfi_register lr,r12
++ bl V_LOCAL_FUNC(__get_datapage)
++ lwz r5, CLOCK_HRTIMER_RES(r3)
++ mtlr r12
+ li r3,0
+ cmpldi cr0,r4,0
+ crclr cr0*4+so
+ beqlr
+- lis r5,CLOCK_REALTIME_RES@h
+- ori r5,r5,CLOCK_REALTIME_RES@l
+ std r3,TSPC64_TV_SEC(r4)
+ std r5,TSPC64_TV_NSEC(r4)
+ blr
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index f3af53abd40f..3c939b9de488 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -968,6 +968,15 @@ static int xive_irq_alloc_data(unsigned int virq, irq_hw_number_t hw)
+ xd->target = XIVE_INVALID_TARGET;
+ irq_set_handler_data(virq, xd);
+
++ /*
++ * Turn OFF by default the interrupt being mapped. A side
++ * effect of this check is the mapping the ESB page of the
++ * interrupt in the Linux address space. This prevents page
++ * fault issues in the crash handler which masks all
++ * interrupts.
++ */
++ xive_esb_read(xd, XIVE_ESB_SET_PQ_01);
++
+ return 0;
+ }
+
+diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
+index 575db3b06a6b..e3ebf6469392 100644
+--- a/arch/powerpc/sysdev/xive/spapr.c
++++ b/arch/powerpc/sysdev/xive/spapr.c
+@@ -359,20 +359,28 @@ static int xive_spapr_populate_irq_data(u32 hw_irq, struct xive_irq_data *data)
+ data->esb_shift = esb_shift;
+ data->trig_page = trig_page;
+
++ data->hw_irq = hw_irq;
++
+ /*
+ * No chip-id for the sPAPR backend. This has an impact how we
+ * pick a target. See xive_pick_irq_target().
+ */
+ data->src_chip = XIVE_INVALID_CHIP_ID;
+
++ /*
++ * When the H_INT_ESB flag is set, the H_INT_ESB hcall should
++ * be used for interrupt management. Skip the remapping of the
++ * ESB pages which are not available.
++ */
++ if (data->flags & XIVE_IRQ_FLAG_H_INT_ESB)
++ return 0;
++
+ data->eoi_mmio = ioremap(data->eoi_page, 1u << data->esb_shift);
+ if (!data->eoi_mmio) {
+ pr_err("Failed to map EOI page for irq 0x%x\n", hw_irq);
+ return -ENOMEM;
+ }
+
+- data->hw_irq = hw_irq;
+-
+ /* Full function page supports trigger */
+ if (flags & XIVE_SRC_TRIGGER) {
+ data->trig_mmio = data->eoi_mmio;
+diff --git a/arch/powerpc/xmon/Makefile b/arch/powerpc/xmon/Makefile
+index 9ba44e190e5e..365e711bebab 100644
+--- a/arch/powerpc/xmon/Makefile
++++ b/arch/powerpc/xmon/Makefile
+@@ -1,8 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Makefile for xmon
+
+-# Disable clang warning for using setjmp without setjmp.h header
+-subdir-ccflags-y := $(call cc-disable-warning, builtin-requires-header)
++# Avoid clang warnings around longjmp/setjmp declarations
++subdir-ccflags-y := -ffreestanding
+
+ subdir-ccflags-$(CONFIG_PPC_WERROR) += -Werror
+
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index de05466ce50c..0a326da1562f 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -1150,8 +1150,6 @@ void gmap_pmdp_idte_global(struct mm_struct *mm, unsigned long vmaddr);
+ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
+ pte_t *ptep, pte_t entry)
+ {
+- if (!MACHINE_HAS_NX)
+- pte_val(entry) &= ~_PAGE_NOEXEC;
+ if (pte_present(entry))
+ pte_val(entry) &= ~_PAGE_UNUSED;
+ if (mm_has_pgste(mm))
+@@ -1168,6 +1166,8 @@ static inline pte_t mk_pte_phys(unsigned long physpage, pgprot_t pgprot)
+ {
+ pte_t __pte;
+ pte_val(__pte) = physpage + pgprot_val(pgprot);
++ if (!MACHINE_HAS_NX)
++ pte_val(__pte) &= ~_PAGE_NOEXEC;
+ return pte_mkyoung(__pte);
+ }
+
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index da02f4087d61..df2413f26a8f 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -261,9 +261,12 @@ static void pcpu_prepare_secondary(struct pcpu *pcpu, int cpu)
+ lc->spinlock_index = 0;
+ lc->percpu_offset = __per_cpu_offset[cpu];
+ lc->kernel_asce = S390_lowcore.kernel_asce;
++ lc->user_asce = S390_lowcore.kernel_asce;
+ lc->machine_flags = S390_lowcore.machine_flags;
+ lc->user_timer = lc->system_timer = lc->steal_timer = 0;
+ __ctl_store(lc->cregs_save_area, 0, 15);
++ lc->cregs_save_area[1] = lc->kernel_asce;
++ lc->cregs_save_area[7] = lc->vdso_asce;
+ save_access_regs((unsigned int *) lc->access_regs_save_area);
+ memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list,
+ sizeof(lc->stfle_fac_list));
+@@ -810,6 +813,8 @@ static void smp_start_secondary(void *cpuvoid)
+ restore_access_regs(S390_lowcore.access_regs_save_area);
+ __ctl_load(S390_lowcore.cregs_save_area, 0, 15);
+ __load_psw_mask(PSW_KERNEL_BITS | PSW_MASK_DAT);
++ set_cpu_flag(CIF_ASCE_PRIMARY);
++ set_cpu_flag(CIF_ASCE_SECONDARY);
+ cpu_init();
+ preempt_disable();
+ init_cpu_timer();
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index fee118b3b69f..87ed8462a5c7 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -1631,36 +1631,6 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c)
+ if (c->x86 == 0x15 && c->x86_model <= 0xf)
+ mce_flags.overflow_recov = 1;
+
+- /*
+- * Turn off MC4_MISC thresholding banks on those models since
+- * they're not supported there.
+- */
+- if (c->x86 == 0x15 &&
+- (c->x86_model >= 0x10 && c->x86_model <= 0x1f)) {
+- int i;
+- u64 hwcr;
+- bool need_toggle;
+- u32 msrs[] = {
+- 0x00000413, /* MC4_MISC0 */
+- 0xc0000408, /* MC4_MISC1 */
+- };
+-
+- rdmsrl(MSR_K7_HWCR, hwcr);
+-
+- /* McStatusWrEn has to be set */
+- need_toggle = !(hwcr & BIT(18));
+-
+- if (need_toggle)
+- wrmsrl(MSR_K7_HWCR, hwcr | BIT(18));
+-
+- /* Clear CntP bit safely */
+- for (i = 0; i < ARRAY_SIZE(msrs); i++)
+- msr_clear_bit(msrs[i], 62);
+-
+- /* restore old settings */
+- if (need_toggle)
+- wrmsrl(MSR_K7_HWCR, hwcr);
+- }
+ }
+
+ if (c->x86_vendor == X86_VENDOR_INTEL) {
+diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+index 9f915a8791cc..5bdfe52b2c9d 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -545,6 +545,40 @@ out:
+ return offset;
+ }
+
++/*
++ * Turn off MC4_MISC thresholding banks on all family 0x15 models since
++ * they're not supported there.
++ */
++void disable_err_thresholding(struct cpuinfo_x86 *c)
++{
++ int i;
++ u64 hwcr;
++ bool need_toggle;
++ u32 msrs[] = {
++ 0x00000413, /* MC4_MISC0 */
++ 0xc0000408, /* MC4_MISC1 */
++ };
++
++ if (c->x86 != 0x15)
++ return;
++
++ rdmsrl(MSR_K7_HWCR, hwcr);
++
++ /* McStatusWrEn has to be set */
++ need_toggle = !(hwcr & BIT(18));
++
++ if (need_toggle)
++ wrmsrl(MSR_K7_HWCR, hwcr | BIT(18));
++
++ /* Clear CntP bit safely */
++ for (i = 0; i < ARRAY_SIZE(msrs); i++)
++ msr_clear_bit(msrs[i], 62);
++
++ /* restore old settings */
++ if (need_toggle)
++ wrmsrl(MSR_K7_HWCR, hwcr);
++}
++
+ /* cpu init entry point, called from mce.c with preempt off */
+ void mce_amd_feature_init(struct cpuinfo_x86 *c)
+ {
+@@ -552,6 +586,8 @@ void mce_amd_feature_init(struct cpuinfo_x86 *c)
+ unsigned int bank, block, cpu = smp_processor_id();
+ int offset = -1;
+
++ disable_err_thresholding(c);
++
+ for (bank = 0; bank < mca_cfg.banks; ++bank) {
+ if (mce_flags.smca)
+ smca_configure(bank, cpu);
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 1dced51de1c6..2776ee6c5c3d 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -774,7 +774,7 @@ static struct request *attempt_merge(struct request_queue *q,
+
+ req->__data_len += blk_rq_bytes(next);
+
+- if (req_op(req) != REQ_OP_DISCARD)
++ if (!blk_discard_mergable(req))
+ elv_merge_requests(q, req, next);
+
+ /*
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 0b7297a43ccd..5006a0d00990 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -151,20 +151,25 @@ static ssize_t blk_mq_hw_sysfs_nr_reserved_tags_show(struct blk_mq_hw_ctx *hctx,
+
+ static ssize_t blk_mq_hw_sysfs_cpus_show(struct blk_mq_hw_ctx *hctx, char *page)
+ {
++ const size_t size = PAGE_SIZE - 1;
+ unsigned int i, first = 1;
+- ssize_t ret = 0;
++ int ret = 0, pos = 0;
+
+ for_each_cpu(i, hctx->cpumask) {
+ if (first)
+- ret += sprintf(ret + page, "%u", i);
++ ret = snprintf(pos + page, size - pos, "%u", i);
+ else
+- ret += sprintf(ret + page, ", %u", i);
++ ret = snprintf(pos + page, size - pos, ", %u", i);
++
++ if (ret >= size - pos)
++ break;
+
+ first = 0;
++ pos += ret;
+ }
+
+- ret += sprintf(ret + page, "\n");
+- return ret;
++ ret = snprintf(pos + page, size + 1 - pos, "\n");
++ return pos + ret;
+ }
+
+ static struct attribute *default_ctx_attrs[] = {
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index d2e29a19890d..92a146861086 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -166,7 +166,7 @@ int acpi_bus_get_private_data(acpi_handle handle, void **data)
+ {
+ acpi_status status;
+
+- if (!*data)
++ if (!data)
+ return -EINVAL;
+
+ status = acpi_get_data(handle, acpi_bus_private_data_handler, data);
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index 1806260938e8..e0927c5fd282 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -1254,9 +1254,19 @@ static void acpi_dev_pm_detach(struct device *dev, bool power_off)
+ */
+ int acpi_dev_pm_attach(struct device *dev, bool power_on)
+ {
++ /*
++ * Skip devices whose ACPI companions match the device IDs below,
++ * because they require special power management handling incompatible
++ * with the generic ACPI PM domain.
++ */
++ static const struct acpi_device_id special_pm_ids[] = {
++ {"PNP0C0B", }, /* Generic ACPI fan */
++ {"INT3404", }, /* Fan */
++ {}
++ };
+ struct acpi_device *adev = ACPI_COMPANION(dev);
+
+- if (!adev)
++ if (!adev || !acpi_match_device_ids(adev, special_pm_ids))
+ return 0;
+
+ /*
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index b48874b8e1ea..226170365012 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -374,19 +374,21 @@ void *__ref acpi_os_map_memory(acpi_physical_address phys, acpi_size size)
+ }
+ EXPORT_SYMBOL_GPL(acpi_os_map_memory);
+
+-static void acpi_os_drop_map_ref(struct acpi_ioremap *map)
++/* Must be called with mutex_lock(&acpi_ioremap_lock) */
++static unsigned long acpi_os_drop_map_ref(struct acpi_ioremap *map)
+ {
+- if (!--map->refcount)
++ unsigned long refcount = --map->refcount;
++
++ if (!refcount)
+ list_del_rcu(&map->list);
++ return refcount;
+ }
+
+ static void acpi_os_map_cleanup(struct acpi_ioremap *map)
+ {
+- if (!map->refcount) {
+- synchronize_rcu_expedited();
+- acpi_unmap(map->phys, map->virt);
+- kfree(map);
+- }
++ synchronize_rcu_expedited();
++ acpi_unmap(map->phys, map->virt);
++ kfree(map);
+ }
+
+ /**
+@@ -406,6 +408,7 @@ static void acpi_os_map_cleanup(struct acpi_ioremap *map)
+ void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size)
+ {
+ struct acpi_ioremap *map;
++ unsigned long refcount;
+
+ if (!acpi_permanent_mmap) {
+ __acpi_unmap_table(virt, size);
+@@ -419,10 +422,11 @@ void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size)
+ WARN(true, PREFIX "%s: bad address %p\n", __func__, virt);
+ return;
+ }
+- acpi_os_drop_map_ref(map);
++ refcount = acpi_os_drop_map_ref(map);
+ mutex_unlock(&acpi_ioremap_lock);
+
+- acpi_os_map_cleanup(map);
++ if (!refcount)
++ acpi_os_map_cleanup(map);
+ }
+ EXPORT_SYMBOL_GPL(acpi_os_unmap_iomem);
+
+@@ -457,6 +461,7 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas)
+ {
+ u64 addr;
+ struct acpi_ioremap *map;
++ unsigned long refcount;
+
+ if (gas->space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY)
+ return;
+@@ -472,10 +477,11 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas)
+ mutex_unlock(&acpi_ioremap_lock);
+ return;
+ }
+- acpi_os_drop_map_ref(map);
++ refcount = acpi_os_drop_map_ref(map);
+ mutex_unlock(&acpi_ioremap_lock);
+
+- acpi_os_map_cleanup(map);
++ if (!refcount)
++ acpi_os_map_cleanup(map);
+ }
+ EXPORT_SYMBOL(acpi_os_unmap_generic_address);
+
+diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c
+index 0813c654c893..b452359b6aae 100644
+--- a/drivers/block/drbd/drbd_state.c
++++ b/drivers/block/drbd/drbd_state.c
+@@ -688,11 +688,9 @@ request_detach(struct drbd_device *device)
+ CS_VERBOSE | CS_ORDERED | CS_INHIBIT_MD_IO);
+ }
+
+-enum drbd_state_rv
+-drbd_request_detach_interruptible(struct drbd_device *device)
++int drbd_request_detach_interruptible(struct drbd_device *device)
+ {
+- enum drbd_state_rv rv;
+- int ret;
++ int ret, rv;
+
+ drbd_suspend_io(device); /* so no-one is stuck in drbd_al_begin_io */
+ wait_event_interruptible(device->state_wait,
+diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h
+index b2a390ba73a0..f87371e55e68 100644
+--- a/drivers/block/drbd/drbd_state.h
++++ b/drivers/block/drbd/drbd_state.h
+@@ -162,8 +162,7 @@ static inline int drbd_request_state(struct drbd_device *device,
+ }
+
+ /* for use in adm_detach() (drbd_adm_detach(), drbd_adm_down()) */
+-enum drbd_state_rv
+-drbd_request_detach_interruptible(struct drbd_device *device);
++int drbd_request_detach_interruptible(struct drbd_device *device);
+
+ enum drbd_role conn_highest_role(struct drbd_connection *connection);
+ enum drbd_role conn_highest_peer(struct drbd_connection *connection);
+diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
+index e9b6ac61fb7f..498825242634 100644
+--- a/drivers/char/hw_random/omap-rng.c
++++ b/drivers/char/hw_random/omap-rng.c
+@@ -66,6 +66,13 @@
+ #define OMAP4_RNG_OUTPUT_SIZE 0x8
+ #define EIP76_RNG_OUTPUT_SIZE 0x10
+
++/*
++ * EIP76 RNG takes approx. 700us to produce 16 bytes of output data
++ * as per testing results. And to account for the lack of udelay()'s
++ * reliability, we keep the timeout as 1000us.
++ */
++#define RNG_DATA_FILL_TIMEOUT 100
++
+ enum {
+ RNG_OUTPUT_0_REG = 0,
+ RNG_OUTPUT_1_REG,
+@@ -176,7 +183,7 @@ static int omap_rng_do_read(struct hwrng *rng, void *data, size_t max,
+ if (max < priv->pdata->data_size)
+ return 0;
+
+- for (i = 0; i < 20; i++) {
++ for (i = 0; i < RNG_DATA_FILL_TIMEOUT; i++) {
+ present = priv->pdata->data_present(priv);
+ if (present || !wait)
+ break;
+diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
+index 1ae77b41050a..51faafd310a2 100644
+--- a/drivers/char/ppdev.c
++++ b/drivers/char/ppdev.c
+@@ -623,20 +623,27 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ if (copy_from_user(time32, argp, sizeof(time32)))
+ return -EFAULT;
+
++ if ((time32[0] < 0) || (time32[1] < 0))
++ return -EINVAL;
++
+ return pp_set_timeout(pp->pdev, time32[0], time32[1]);
+
+ case PPSETTIME64:
+ if (copy_from_user(time64, argp, sizeof(time64)))
+ return -EFAULT;
+
++ if ((time64[0] < 0) || (time64[1] < 0))
++ return -EINVAL;
++
++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall())
++ time64[1] >>= 32;
++
+ return pp_set_timeout(pp->pdev, time64[0], time64[1]);
+
+ case PPGETTIME32:
+ jiffies_to_timespec64(pp->pdev->timeout, &ts);
+ time32[0] = ts.tv_sec;
+ time32[1] = ts.tv_nsec / NSEC_PER_USEC;
+- if ((time32[0] < 0) || (time32[1] < 0))
+- return -EINVAL;
+
+ if (copy_to_user(argp, time32, sizeof(time32)))
+ return -EFAULT;
+@@ -647,8 +654,9 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ jiffies_to_timespec64(pp->pdev->timeout, &ts);
+ time64[0] = ts.tv_sec;
+ time64[1] = ts.tv_nsec / NSEC_PER_USEC;
+- if ((time64[0] < 0) || (time64[1] < 0))
+- return -EINVAL;
++
++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall())
++ time64[1] <<= 32;
+
+ if (copy_to_user(argp, time64, sizeof(time64)))
+ return -EFAULT;
+diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
+index 3acf4fd4e5a5..ef381caf5f43 100644
+--- a/drivers/char/tpm/tpm2-cmd.c
++++ b/drivers/char/tpm/tpm2-cmd.c
+@@ -938,6 +938,10 @@ static int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip)
+
+ chip->cc_attrs_tbl = devm_kcalloc(&chip->dev, 4, nr_commands,
+ GFP_KERNEL);
++ if (!chip->cc_attrs_tbl) {
++ rc = -ENOMEM;
++ goto out;
++ }
+
+ rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
+ if (rc)
+diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
+index bf6519cf64bc..5fff39dae625 100644
+--- a/drivers/cpufreq/powernv-cpufreq.c
++++ b/drivers/cpufreq/powernv-cpufreq.c
+@@ -1042,9 +1042,14 @@ static struct cpufreq_driver powernv_cpufreq_driver = {
+
+ static int init_chip_info(void)
+ {
+- unsigned int chip[256];
++ unsigned int *chip;
+ unsigned int cpu, i;
+ unsigned int prev_chip_id = UINT_MAX;
++ int ret = 0;
++
++ chip = kcalloc(num_possible_cpus(), sizeof(*chip), GFP_KERNEL);
++ if (!chip)
++ return -ENOMEM;
+
+ for_each_possible_cpu(cpu) {
+ unsigned int id = cpu_to_chip_id(cpu);
+@@ -1056,8 +1061,10 @@ static int init_chip_info(void)
+ }
+
+ chips = kcalloc(nr_chips, sizeof(struct chip), GFP_KERNEL);
+- if (!chips)
+- return -ENOMEM;
++ if (!chips) {
++ ret = -ENOMEM;
++ goto free_and_return;
++ }
+
+ for (i = 0; i < nr_chips; i++) {
+ chips[i].id = chip[i];
+@@ -1067,7 +1074,9 @@ static int init_chip_info(void)
+ per_cpu(chip_info, cpu) = &chips[i];
+ }
+
+- return 0;
++free_and_return:
++ kfree(chip);
++ return ret;
+ }
+
+ static inline void clean_chip_info(void)
+diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c
+index dc32f34e68d9..01acd88c4193 100644
+--- a/drivers/cpuidle/driver.c
++++ b/drivers/cpuidle/driver.c
+@@ -62,24 +62,23 @@ static inline void __cpuidle_unset_driver(struct cpuidle_driver *drv)
+ * __cpuidle_set_driver - set per CPU driver variables for the given driver.
+ * @drv: a valid pointer to a struct cpuidle_driver
+ *
+- * For each CPU in the driver's cpumask, unset the registered driver per CPU
+- * to @drv.
+- *
+- * Returns 0 on success, -EBUSY if the CPUs have driver(s) already.
++ * Returns 0 on success, -EBUSY if any CPU in the cpumask have a driver
++ * different from drv already.
+ */
+ static inline int __cpuidle_set_driver(struct cpuidle_driver *drv)
+ {
+ int cpu;
+
+ for_each_cpu(cpu, drv->cpumask) {
++ struct cpuidle_driver *old_drv;
+
+- if (__cpuidle_get_cpu_driver(cpu)) {
+- __cpuidle_unset_driver(drv);
++ old_drv = __cpuidle_get_cpu_driver(cpu);
++ if (old_drv && old_drv != drv)
+ return -EBUSY;
+- }
++ }
+
++ for_each_cpu(cpu, drv->cpumask)
+ per_cpu(cpuidle_drivers, cpu) = drv;
+- }
+
+ return 0;
+ }
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index d350253d161a..61fbaa89d7b4 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -163,6 +163,7 @@ int devfreq_update_status(struct devfreq *devfreq, unsigned long freq)
+ int lev, prev_lev, ret = 0;
+ unsigned long cur_time;
+
++ lockdep_assert_held(&devfreq->lock);
+ cur_time = jiffies;
+
+ /* Immediately exit if previous_freq is not initialized yet. */
+@@ -1287,12 +1288,17 @@ static ssize_t trans_stat_show(struct device *dev,
+ int i, j;
+ unsigned int max_state = devfreq->profile->max_state;
+
+- if (!devfreq->stop_polling &&
+- devfreq_update_status(devfreq, devfreq->previous_freq))
+- return 0;
+ if (max_state == 0)
+ return sprintf(buf, "Not Supported.\n");
+
++ mutex_lock(&devfreq->lock);
++ if (!devfreq->stop_polling &&
++ devfreq_update_status(devfreq, devfreq->previous_freq)) {
++ mutex_unlock(&devfreq->lock);
++ return 0;
++ }
++ mutex_unlock(&devfreq->lock);
++
+ len = sprintf(buf, " From : To\n");
+ len += sprintf(buf + len, " :");
+ for (i = 0; i < max_state; i++)
+diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
+index 92f843eaf1e0..7a30952b463d 100644
+--- a/drivers/firmware/arm_scmi/bus.c
++++ b/drivers/firmware/arm_scmi/bus.c
+@@ -135,8 +135,10 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol)
+ return NULL;
+
+ id = ida_simple_get(&scmi_bus_id, 1, 0, GFP_KERNEL);
+- if (id < 0)
+- goto free_mem;
++ if (id < 0) {
++ kfree(scmi_dev);
++ return NULL;
++ }
+
+ scmi_dev->id = id;
+ scmi_dev->protocol_id = protocol;
+@@ -154,8 +156,6 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol)
+ put_dev:
+ put_device(&scmi_dev->dev);
+ ida_simple_remove(&scmi_bus_id, id);
+-free_mem:
+- kfree(scmi_dev);
+ return NULL;
+ }
+
+diff --git a/drivers/firmware/qcom_scm-64.c b/drivers/firmware/qcom_scm-64.c
+index 688525dd4aee..367e727a8f93 100644
+--- a/drivers/firmware/qcom_scm-64.c
++++ b/drivers/firmware/qcom_scm-64.c
+@@ -158,7 +158,7 @@ static int qcom_scm_call(struct device *dev, u32 svc_id, u32 cmd_id,
+ kfree(args_virt);
+ }
+
+- if (res->a0 < 0)
++ if ((long)res->a0 < 0)
+ return qcom_scm_remap_error(res->a0);
+
+ return 0;
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index cf2604e63599..8edbb3f0c101 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -1265,11 +1265,28 @@ late_initcall_sync(acpi_gpio_handle_deferred_request_irqs);
+
+ static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = {
+ {
++ /*
++ * The Minix Neo Z83-4 has a micro-USB-B id-pin handler for
++ * a non existing micro-USB-B connector which puts the HDMI
++ * DDC pins in GPIO mode, breaking HDMI support.
++ */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "MINIX"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"),
+ }
+ },
++ {
++ /*
++ * The Terra Pad 1061 has a micro-USB-B id-pin handler, which
++ * instead of controlling the actual micro-USB-B turns the 5V
++ * boost for its USB-A connector off. The actual micro-USB-B
++ * connector is wired for charging only.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"),
++ }
++ },
+ {} /* Terminating entry */
+ };
+
+diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
+index fc6b7f8b62fb..a8e750291643 100644
+--- a/drivers/hwtracing/intel_th/core.c
++++ b/drivers/hwtracing/intel_th/core.c
+@@ -629,10 +629,8 @@ intel_th_subdevice_alloc(struct intel_th *th,
+ }
+
+ err = intel_th_device_add_resources(thdev, res, subdev->nres);
+- if (err) {
+- put_device(&thdev->dev);
++ if (err)
+ goto fail_put_device;
+- }
+
+ if (subdev->type == INTEL_TH_OUTPUT) {
+ thdev->dev.devt = MKDEV(th->major, th->num_thdevs);
+@@ -646,10 +644,8 @@ intel_th_subdevice_alloc(struct intel_th *th,
+ }
+
+ err = device_add(&thdev->dev);
+- if (err) {
+- put_device(&thdev->dev);
++ if (err)
+ goto fail_free_res;
+- }
+
+ /* need switch driver to be loaded to enumerate the rest */
+ if (subdev->type == INTEL_TH_SWITCH && !req) {
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 8421009d3a9d..24ab3cb426a7 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -185,6 +185,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Ice Lake CPU */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x8a29),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
++ {
++ /* Tiger Lake CPU */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9a33),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ {
+ /* Tiger Lake PCH */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6),
+diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c
+index 066e05f92081..ff6666ac5d68 100644
+--- a/drivers/iio/humidity/hdc100x.c
++++ b/drivers/iio/humidity/hdc100x.c
+@@ -229,7 +229,7 @@ static int hdc100x_read_raw(struct iio_dev *indio_dev,
+ *val2 = 65536;
+ return IIO_VAL_FRACTIONAL;
+ } else {
+- *val = 100;
++ *val = 100000;
+ *val2 = 65536;
+ return IIO_VAL_FRACTIONAL;
+ }
+diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
+index d3af4f28cbbb..ea24701beb3e 100644
+--- a/drivers/iio/imu/adis16480.c
++++ b/drivers/iio/imu/adis16480.c
+@@ -727,6 +727,7 @@ static const struct iio_info adis16480_info = {
+ .read_raw = &adis16480_read_raw,
+ .write_raw = &adis16480_write_raw,
+ .update_scan_mode = adis_update_scan_mode,
++ .debugfs_reg_access = adis_debugfs_reg_access,
+ };
+
+ static int adis16480_stop_device(struct iio_dev *indio_dev)
+diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+index baba8e5459d0..6b560d99f385 100644
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+@@ -122,6 +122,7 @@ static const struct inv_mpu6050_hw hw_info[] = {
+ .reg = ®_set_6050,
+ .config = &chip_config_6050,
+ .fifo_size = 1024,
++ .temp = {INV_MPU6050_TEMP_OFFSET, INV_MPU6050_TEMP_SCALE},
+ },
+ {
+ .whoami = INV_MPU6500_WHOAMI_VALUE,
+@@ -129,6 +130,7 @@ static const struct inv_mpu6050_hw hw_info[] = {
+ .reg = ®_set_6500,
+ .config = &chip_config_6050,
+ .fifo_size = 512,
++ .temp = {INV_MPU6500_TEMP_OFFSET, INV_MPU6500_TEMP_SCALE},
+ },
+ {
+ .whoami = INV_MPU6515_WHOAMI_VALUE,
+@@ -136,6 +138,7 @@ static const struct inv_mpu6050_hw hw_info[] = {
+ .reg = ®_set_6500,
+ .config = &chip_config_6050,
+ .fifo_size = 512,
++ .temp = {INV_MPU6500_TEMP_OFFSET, INV_MPU6500_TEMP_SCALE},
+ },
+ {
+ .whoami = INV_MPU6000_WHOAMI_VALUE,
+@@ -143,6 +146,7 @@ static const struct inv_mpu6050_hw hw_info[] = {
+ .reg = ®_set_6050,
+ .config = &chip_config_6050,
+ .fifo_size = 1024,
++ .temp = {INV_MPU6050_TEMP_OFFSET, INV_MPU6050_TEMP_SCALE},
+ },
+ {
+ .whoami = INV_MPU9150_WHOAMI_VALUE,
+@@ -150,6 +154,7 @@ static const struct inv_mpu6050_hw hw_info[] = {
+ .reg = ®_set_6050,
+ .config = &chip_config_6050,
+ .fifo_size = 1024,
++ .temp = {INV_MPU6050_TEMP_OFFSET, INV_MPU6050_TEMP_SCALE},
+ },
+ {
+ .whoami = INV_MPU9250_WHOAMI_VALUE,
+@@ -157,6 +162,7 @@ static const struct inv_mpu6050_hw hw_info[] = {
+ .reg = ®_set_6500,
+ .config = &chip_config_6050,
+ .fifo_size = 512,
++ .temp = {INV_MPU6500_TEMP_OFFSET, INV_MPU6500_TEMP_SCALE},
+ },
+ {
+ .whoami = INV_MPU9255_WHOAMI_VALUE,
+@@ -164,6 +170,7 @@ static const struct inv_mpu6050_hw hw_info[] = {
+ .reg = ®_set_6500,
+ .config = &chip_config_6050,
+ .fifo_size = 512,
++ .temp = {INV_MPU6500_TEMP_OFFSET, INV_MPU6500_TEMP_SCALE},
+ },
+ {
+ .whoami = INV_ICM20608_WHOAMI_VALUE,
+@@ -171,6 +178,7 @@ static const struct inv_mpu6050_hw hw_info[] = {
+ .reg = ®_set_6500,
+ .config = &chip_config_6050,
+ .fifo_size = 512,
++ .temp = {INV_ICM20608_TEMP_OFFSET, INV_ICM20608_TEMP_SCALE},
+ },
+ {
+ .whoami = INV_ICM20602_WHOAMI_VALUE,
+@@ -178,6 +186,7 @@ static const struct inv_mpu6050_hw hw_info[] = {
+ .reg = ®_set_icm20602,
+ .config = &chip_config_6050,
+ .fifo_size = 1008,
++ .temp = {INV_ICM20608_TEMP_OFFSET, INV_ICM20608_TEMP_SCALE},
+ },
+ };
+
+@@ -478,12 +487,8 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev,
+
+ return IIO_VAL_INT_PLUS_MICRO;
+ case IIO_TEMP:
+- *val = 0;
+- if (st->chip_type == INV_ICM20602)
+- *val2 = INV_ICM20602_TEMP_SCALE;
+- else
+- *val2 = INV_MPU6050_TEMP_SCALE;
+-
++ *val = st->hw->temp.scale / 1000000;
++ *val2 = st->hw->temp.scale % 1000000;
+ return IIO_VAL_INT_PLUS_MICRO;
+ default:
+ return -EINVAL;
+@@ -491,11 +496,7 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev,
+ case IIO_CHAN_INFO_OFFSET:
+ switch (chan->type) {
+ case IIO_TEMP:
+- if (st->chip_type == INV_ICM20602)
+- *val = INV_ICM20602_TEMP_OFFSET;
+- else
+- *val = INV_MPU6050_TEMP_OFFSET;
+-
++ *val = st->hw->temp.offset;
+ return IIO_VAL_INT;
+ default:
+ return -EINVAL;
+@@ -859,6 +860,25 @@ static const struct iio_chan_spec inv_mpu_channels[] = {
+ INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_Z, INV_MPU6050_SCAN_ACCL_Z),
+ };
+
++static const unsigned long inv_mpu_scan_masks[] = {
++ /* 3-axis accel */
++ BIT(INV_MPU6050_SCAN_ACCL_X)
++ | BIT(INV_MPU6050_SCAN_ACCL_Y)
++ | BIT(INV_MPU6050_SCAN_ACCL_Z),
++ /* 3-axis gyro */
++ BIT(INV_MPU6050_SCAN_GYRO_X)
++ | BIT(INV_MPU6050_SCAN_GYRO_Y)
++ | BIT(INV_MPU6050_SCAN_GYRO_Z),
++ /* 6-axis accel + gyro */
++ BIT(INV_MPU6050_SCAN_ACCL_X)
++ | BIT(INV_MPU6050_SCAN_ACCL_Y)
++ | BIT(INV_MPU6050_SCAN_ACCL_Z)
++ | BIT(INV_MPU6050_SCAN_GYRO_X)
++ | BIT(INV_MPU6050_SCAN_GYRO_Y)
++ | BIT(INV_MPU6050_SCAN_GYRO_Z),
++ 0,
++};
++
+ static const struct iio_chan_spec inv_icm20602_channels[] = {
+ IIO_CHAN_SOFT_TIMESTAMP(INV_ICM20602_SCAN_TIMESTAMP),
+ {
+@@ -885,6 +905,28 @@ static const struct iio_chan_spec inv_icm20602_channels[] = {
+ INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_Z, INV_ICM20602_SCAN_ACCL_Z),
+ };
+
++static const unsigned long inv_icm20602_scan_masks[] = {
++ /* 3-axis accel + temp (mandatory) */
++ BIT(INV_ICM20602_SCAN_ACCL_X)
++ | BIT(INV_ICM20602_SCAN_ACCL_Y)
++ | BIT(INV_ICM20602_SCAN_ACCL_Z)
++ | BIT(INV_ICM20602_SCAN_TEMP),
++ /* 3-axis gyro + temp (mandatory) */
++ BIT(INV_ICM20602_SCAN_GYRO_X)
++ | BIT(INV_ICM20602_SCAN_GYRO_Y)
++ | BIT(INV_ICM20602_SCAN_GYRO_Z)
++ | BIT(INV_ICM20602_SCAN_TEMP),
++ /* 6-axis accel + gyro + temp (mandatory) */
++ BIT(INV_ICM20602_SCAN_ACCL_X)
++ | BIT(INV_ICM20602_SCAN_ACCL_Y)
++ | BIT(INV_ICM20602_SCAN_ACCL_Z)
++ | BIT(INV_ICM20602_SCAN_GYRO_X)
++ | BIT(INV_ICM20602_SCAN_GYRO_Y)
++ | BIT(INV_ICM20602_SCAN_GYRO_Z)
++ | BIT(INV_ICM20602_SCAN_TEMP),
++ 0,
++};
++
+ /*
+ * The user can choose any frequency between INV_MPU6050_MIN_FIFO_RATE and
+ * INV_MPU6050_MAX_FIFO_RATE, but only these frequencies are matched by the
+@@ -1089,9 +1131,11 @@ int inv_mpu_core_probe(struct regmap *regmap, int irq, const char *name,
+ if (chip_type == INV_ICM20602) {
+ indio_dev->channels = inv_icm20602_channels;
+ indio_dev->num_channels = ARRAY_SIZE(inv_icm20602_channels);
++ indio_dev->available_scan_masks = inv_icm20602_scan_masks;
+ } else {
+ indio_dev->channels = inv_mpu_channels;
+ indio_dev->num_channels = ARRAY_SIZE(inv_mpu_channels);
++ indio_dev->available_scan_masks = inv_mpu_scan_masks;
+ }
+
+ indio_dev->info = &mpu_info;
+diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
+index 6ef872f97c17..220eba58cfbb 100644
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
+@@ -109,6 +109,7 @@ struct inv_mpu6050_chip_config {
+ * @reg: register map of the chip.
+ * @config: configuration of the chip.
+ * @fifo_size: size of the FIFO in bytes.
++ * @temp: offset and scale to apply to raw temperature.
+ */
+ struct inv_mpu6050_hw {
+ u8 whoami;
+@@ -116,6 +117,10 @@ struct inv_mpu6050_hw {
+ const struct inv_mpu6050_reg_map *reg;
+ const struct inv_mpu6050_chip_config *config;
+ size_t fifo_size;
++ struct {
++ int offset;
++ int scale;
++ } temp;
+ };
+
+ /*
+@@ -224,16 +229,19 @@ struct inv_mpu6050_state {
+ #define INV_MPU6050_REG_UP_TIME_MIN 5000
+ #define INV_MPU6050_REG_UP_TIME_MAX 10000
+
+-#define INV_MPU6050_TEMP_OFFSET 12421
+-#define INV_MPU6050_TEMP_SCALE 2941
++#define INV_MPU6050_TEMP_OFFSET 12420
++#define INV_MPU6050_TEMP_SCALE 2941176
+ #define INV_MPU6050_MAX_GYRO_FS_PARAM 3
+ #define INV_MPU6050_MAX_ACCL_FS_PARAM 3
+ #define INV_MPU6050_THREE_AXIS 3
+ #define INV_MPU6050_GYRO_CONFIG_FSR_SHIFT 3
+ #define INV_MPU6050_ACCL_CONFIG_FSR_SHIFT 3
+
+-#define INV_ICM20602_TEMP_OFFSET 8170
+-#define INV_ICM20602_TEMP_SCALE 3060
++#define INV_MPU6500_TEMP_OFFSET 7011
++#define INV_MPU6500_TEMP_SCALE 2995178
++
++#define INV_ICM20608_TEMP_OFFSET 8170
++#define INV_ICM20608_TEMP_SCALE 3059976
+
+ /* 6 + 6 round up and plus 8 */
+ #define INV_MPU6050_OUTPUT_DATA_SIZE 24
+diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c
+index eade36dafa34..4c239f18240d 100644
+--- a/drivers/isdn/gigaset/usb-gigaset.c
++++ b/drivers/isdn/gigaset/usb-gigaset.c
+@@ -574,8 +574,7 @@ static int gigaset_initcshw(struct cardstate *cs)
+ {
+ struct usb_cardstate *ucs;
+
+- cs->hw.usb = ucs =
+- kmalloc(sizeof(struct usb_cardstate), GFP_KERNEL);
++ cs->hw.usb = ucs = kzalloc(sizeof(struct usb_cardstate), GFP_KERNEL);
+ if (!ucs) {
+ pr_err("out of memory\n");
+ return -ENOMEM;
+@@ -587,9 +586,6 @@ static int gigaset_initcshw(struct cardstate *cs)
+ ucs->bchars[3] = 0;
+ ucs->bchars[4] = 0x11;
+ ucs->bchars[5] = 0x13;
+- ucs->bulk_out_buffer = NULL;
+- ucs->bulk_out_urb = NULL;
+- ucs->read_urb = NULL;
+ tasklet_init(&cs->write_tasklet,
+ gigaset_modem_fill, (unsigned long) cs);
+
+@@ -688,6 +684,11 @@ static int gigaset_probe(struct usb_interface *interface,
+ return -ENODEV;
+ }
+
++ if (hostif->desc.bNumEndpoints < 2) {
++ dev_err(&interface->dev, "missing endpoints\n");
++ return -ENODEV;
++ }
++
+ dev_info(&udev->dev, "%s: Device matched ... !\n", __func__);
+
+ /* allocate memory for our device state and initialize it */
+@@ -707,6 +708,12 @@ static int gigaset_probe(struct usb_interface *interface,
+
+ endpoint = &hostif->endpoint[0].desc;
+
++ if (!usb_endpoint_is_bulk_out(endpoint)) {
++ dev_err(&interface->dev, "missing bulk-out endpoint\n");
++ retval = -ENODEV;
++ goto error;
++ }
++
+ buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
+ ucs->bulk_out_size = buffer_size;
+ ucs->bulk_out_epnum = usb_endpoint_num(endpoint);
+@@ -726,6 +733,12 @@ static int gigaset_probe(struct usb_interface *interface,
+
+ endpoint = &hostif->endpoint[1].desc;
+
++ if (!usb_endpoint_is_int_in(endpoint)) {
++ dev_err(&interface->dev, "missing int-in endpoint\n");
++ retval = -ENODEV;
++ goto error;
++ }
++
+ ucs->busy = 0;
+
+ ucs->read_urb = usb_alloc_urb(0, GFP_KERNEL);
+diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c
+index 136f86a1627d..d5e774d83021 100644
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -302,10 +302,12 @@ static int netdev_trig_notify(struct notifier_block *nb,
+ container_of(nb, struct led_netdev_data, notifier);
+
+ if (evt != NETDEV_UP && evt != NETDEV_DOWN && evt != NETDEV_CHANGE
+- && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER)
++ && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER
++ && evt != NETDEV_CHANGENAME)
+ return NOTIFY_DONE;
+
+ if (!(dev == trigger_data->net_dev ||
++ (evt == NETDEV_CHANGENAME && !strcmp(dev->name, trigger_data->device_name)) ||
+ (evt == NETDEV_REGISTER && !strcmp(dev->name, trigger_data->device_name))))
+ return NOTIFY_DONE;
+
+@@ -315,6 +317,7 @@ static int netdev_trig_notify(struct notifier_block *nb,
+
+ clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
+ switch (evt) {
++ case NETDEV_CHANGENAME:
+ case NETDEV_REGISTER:
+ if (trigger_data->net_dev)
+ dev_put(trigger_data->net_dev);
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index 5f1f80d424dd..503c4265ecbe 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -1223,7 +1223,8 @@ bio_copy:
+ }
+ } while (bio->bi_iter.bi_size);
+
+- if (unlikely(wc->uncommitted_blocks >= wc->autocommit_blocks))
++ if (unlikely(bio->bi_opf & REQ_FUA ||
++ wc->uncommitted_blocks >= wc->autocommit_blocks))
+ writecache_flush(wc);
+ else
+ writecache_schedule_autocommit(wc);
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index 7e8d7fc99410..c2c17149d968 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -552,6 +552,7 @@ static struct dmz_mblock *dmz_get_mblock(struct dmz_metadata *zmd,
+ TASK_UNINTERRUPTIBLE);
+ if (test_bit(DMZ_META_ERROR, &mblk->state)) {
+ dmz_release_mblock(zmd, mblk);
++ dmz_check_bdev(zmd->dev);
+ return ERR_PTR(-EIO);
+ }
+
+@@ -623,6 +624,8 @@ static int dmz_rdwr_block(struct dmz_metadata *zmd, int op, sector_t block,
+ ret = submit_bio_wait(bio);
+ bio_put(bio);
+
++ if (ret)
++ dmz_check_bdev(zmd->dev);
+ return ret;
+ }
+
+@@ -689,6 +692,7 @@ static int dmz_write_dirty_mblocks(struct dmz_metadata *zmd,
+ TASK_UNINTERRUPTIBLE);
+ if (test_bit(DMZ_META_ERROR, &mblk->state)) {
+ clear_bit(DMZ_META_ERROR, &mblk->state);
++ dmz_check_bdev(zmd->dev);
+ ret = -EIO;
+ }
+ nr_mblks_submitted--;
+@@ -766,7 +770,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
+ /* If there are no dirty metadata blocks, just flush the device cache */
+ if (list_empty(&write_list)) {
+ ret = blkdev_issue_flush(zmd->dev->bdev, GFP_NOIO, NULL);
+- goto out;
++ goto err;
+ }
+
+ /*
+@@ -776,7 +780,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
+ */
+ ret = dmz_log_dirty_mblocks(zmd, &write_list);
+ if (ret)
+- goto out;
++ goto err;
+
+ /*
+ * The log is on disk. It is now safe to update in place
+@@ -784,11 +788,11 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
+ */
+ ret = dmz_write_dirty_mblocks(zmd, &write_list, zmd->mblk_primary);
+ if (ret)
+- goto out;
++ goto err;
+
+ ret = dmz_write_sb(zmd, zmd->mblk_primary);
+ if (ret)
+- goto out;
++ goto err;
+
+ while (!list_empty(&write_list)) {
+ mblk = list_first_entry(&write_list, struct dmz_mblock, link);
+@@ -803,16 +807,20 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
+
+ zmd->sb_gen++;
+ out:
+- if (ret && !list_empty(&write_list)) {
+- spin_lock(&zmd->mblk_lock);
+- list_splice(&write_list, &zmd->mblk_dirty_list);
+- spin_unlock(&zmd->mblk_lock);
+- }
+-
+ dmz_unlock_flush(zmd);
+ up_write(&zmd->mblk_sem);
+
+ return ret;
++
++err:
++ if (!list_empty(&write_list)) {
++ spin_lock(&zmd->mblk_lock);
++ list_splice(&write_list, &zmd->mblk_dirty_list);
++ spin_unlock(&zmd->mblk_lock);
++ }
++ if (!dmz_check_bdev(zmd->dev))
++ ret = -EIO;
++ goto out;
+ }
+
+ /*
+@@ -1235,6 +1243,7 @@ static int dmz_update_zone(struct dmz_metadata *zmd, struct dm_zone *zone)
+ if (ret) {
+ dmz_dev_err(zmd->dev, "Get zone %u report failed",
+ dmz_id(zmd, zone));
++ dmz_check_bdev(zmd->dev);
+ return ret;
+ }
+
+diff --git a/drivers/md/dm-zoned-reclaim.c b/drivers/md/dm-zoned-reclaim.c
+index 9470b8f77a33..84ac671acd2e 100644
+--- a/drivers/md/dm-zoned-reclaim.c
++++ b/drivers/md/dm-zoned-reclaim.c
+@@ -81,6 +81,7 @@ static int dmz_reclaim_align_wp(struct dmz_reclaim *zrc, struct dm_zone *zone,
+ "Align zone %u wp %llu to %llu (wp+%u) blocks failed %d",
+ dmz_id(zmd, zone), (unsigned long long)wp_block,
+ (unsigned long long)block, nr_blocks, ret);
++ dmz_check_bdev(zrc->dev);
+ return ret;
+ }
+
+@@ -488,12 +489,7 @@ static void dmz_reclaim_work(struct work_struct *work)
+ ret = dmz_do_reclaim(zrc);
+ if (ret) {
+ dmz_dev_debug(zrc->dev, "Reclaim error %d\n", ret);
+- if (ret == -EIO)
+- /*
+- * LLD might be performing some error handling sequence
+- * at the underlying device. To not interfere, do not
+- * attempt to schedule the next reclaim run immediately.
+- */
++ if (!dmz_check_bdev(zrc->dev))
+ return;
+ }
+
+diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
+index 3dd668f69405..971a2da43cbf 100644
+--- a/drivers/md/dm-zoned-target.c
++++ b/drivers/md/dm-zoned-target.c
+@@ -79,6 +79,8 @@ static inline void dmz_bio_endio(struct bio *bio, blk_status_t status)
+
+ if (status != BLK_STS_OK && bio->bi_status == BLK_STS_OK)
+ bio->bi_status = status;
++ if (bio->bi_status != BLK_STS_OK)
++ bioctx->target->dev->flags |= DMZ_CHECK_BDEV;
+
+ if (atomic_dec_and_test(&bioctx->ref)) {
+ struct dm_zone *zone = bioctx->zone;
+@@ -564,31 +566,51 @@ out:
+ }
+
+ /*
+- * Check the backing device availability. If it's on the way out,
++ * Check if the backing device is being removed. If it's on the way out,
+ * start failing I/O. Reclaim and metadata components also call this
+ * function to cleanly abort operation in the event of such failure.
+ */
+ bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev)
+ {
+- struct gendisk *disk;
++ if (dmz_dev->flags & DMZ_BDEV_DYING)
++ return true;
+
+- if (!(dmz_dev->flags & DMZ_BDEV_DYING)) {
+- disk = dmz_dev->bdev->bd_disk;
+- if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) {
+- dmz_dev_warn(dmz_dev, "Backing device queue dying");
+- dmz_dev->flags |= DMZ_BDEV_DYING;
+- } else if (disk->fops->check_events) {
+- if (disk->fops->check_events(disk, 0) &
+- DISK_EVENT_MEDIA_CHANGE) {
+- dmz_dev_warn(dmz_dev, "Backing device offline");
+- dmz_dev->flags |= DMZ_BDEV_DYING;
+- }
+- }
++ if (dmz_dev->flags & DMZ_CHECK_BDEV)
++ return !dmz_check_bdev(dmz_dev);
++
++ if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) {
++ dmz_dev_warn(dmz_dev, "Backing device queue dying");
++ dmz_dev->flags |= DMZ_BDEV_DYING;
+ }
+
+ return dmz_dev->flags & DMZ_BDEV_DYING;
+ }
+
++/*
++ * Check the backing device availability. This detects such events as
++ * backing device going offline due to errors, media removals, etc.
++ * This check is less efficient than dmz_bdev_is_dying() and should
++ * only be performed as a part of error handling.
++ */
++bool dmz_check_bdev(struct dmz_dev *dmz_dev)
++{
++ struct gendisk *disk;
++
++ dmz_dev->flags &= ~DMZ_CHECK_BDEV;
++
++ if (dmz_bdev_is_dying(dmz_dev))
++ return false;
++
++ disk = dmz_dev->bdev->bd_disk;
++ if (disk->fops->check_events &&
++ disk->fops->check_events(disk, 0) & DISK_EVENT_MEDIA_CHANGE) {
++ dmz_dev_warn(dmz_dev, "Backing device offline");
++ dmz_dev->flags |= DMZ_BDEV_DYING;
++ }
++
++ return !(dmz_dev->flags & DMZ_BDEV_DYING);
++}
++
+ /*
+ * Process a new BIO.
+ */
+@@ -902,8 +924,8 @@ static int dmz_prepare_ioctl(struct dm_target *ti, struct block_device **bdev)
+ {
+ struct dmz_target *dmz = ti->private;
+
+- if (dmz_bdev_is_dying(dmz->dev))
+- return -ENODEV;
++ if (!dmz_check_bdev(dmz->dev))
++ return -EIO;
+
+ *bdev = dmz->dev->bdev;
+
+diff --git a/drivers/md/dm-zoned.h b/drivers/md/dm-zoned.h
+index 93a64529f219..2662746ba8b9 100644
+--- a/drivers/md/dm-zoned.h
++++ b/drivers/md/dm-zoned.h
+@@ -71,6 +71,7 @@ struct dmz_dev {
+
+ /* Device flags. */
+ #define DMZ_BDEV_DYING (1 << 0)
++#define DMZ_CHECK_BDEV (2 << 0)
+
+ /*
+ * Zone descriptor.
+@@ -254,5 +255,6 @@ void dmz_schedule_reclaim(struct dmz_reclaim *zrc);
+ * Functions defined in dm-zoned-target.c
+ */
+ bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev);
++bool dmz_check_bdev(struct dmz_dev *dmz_dev);
+
+ #endif /* DM_ZONED_H */
+diff --git a/drivers/md/md-linear.c b/drivers/md/md-linear.c
+index d45c697c0ebe..9a60231b844b 100644
+--- a/drivers/md/md-linear.c
++++ b/drivers/md/md-linear.c
+@@ -252,10 +252,9 @@ static bool linear_make_request(struct mddev *mddev, struct bio *bio)
+ sector_t start_sector, end_sector, data_offset;
+ sector_t bio_sector = bio->bi_iter.bi_sector;
+
+- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) {
+- md_flush_request(mddev, bio);
++ if (unlikely(bio->bi_opf & REQ_PREFLUSH)
++ && md_flush_request(mddev, bio))
+ return true;
+- }
+
+ tmp_dev = which_dev(mddev, bio_sector);
+ start_sector = tmp_dev->end_sector - tmp_dev->rdev->sectors;
+diff --git a/drivers/md/md-multipath.c b/drivers/md/md-multipath.c
+index 881487de1e25..80c35bfd11b8 100644
+--- a/drivers/md/md-multipath.c
++++ b/drivers/md/md-multipath.c
+@@ -112,10 +112,9 @@ static bool multipath_make_request(struct mddev *mddev, struct bio * bio)
+ struct multipath_bh * mp_bh;
+ struct multipath_info *multipath;
+
+- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) {
+- md_flush_request(mddev, bio);
++ if (unlikely(bio->bi_opf & REQ_PREFLUSH)
++ && md_flush_request(mddev, bio))
+ return true;
+- }
+
+ mp_bh = mempool_alloc(&conf->pool, GFP_NOIO);
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 2fe4f93d1d7d..62f214d43e15 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -487,7 +487,13 @@ static void md_submit_flush_data(struct work_struct *ws)
+ }
+ }
+
+-void md_flush_request(struct mddev *mddev, struct bio *bio)
++/*
++ * Manages consolidation of flushes and submitting any flushes needed for
++ * a bio with REQ_PREFLUSH. Returns true if the bio is finished or is
++ * being finished in another context. Returns false if the flushing is
++ * complete but still needs the I/O portion of the bio to be processed.
++ */
++bool md_flush_request(struct mddev *mddev, struct bio *bio)
+ {
+ ktime_t start = ktime_get_boottime();
+ spin_lock_irq(&mddev->lock);
+@@ -512,9 +518,10 @@ void md_flush_request(struct mddev *mddev, struct bio *bio)
+ bio_endio(bio);
+ else {
+ bio->bi_opf &= ~REQ_PREFLUSH;
+- mddev->pers->make_request(mddev, bio);
++ return false;
+ }
+ }
++ return true;
+ }
+ EXPORT_SYMBOL(md_flush_request);
+
+diff --git a/drivers/md/md.h b/drivers/md/md.h
+index 4f89463e0b01..cce62bbc2bcb 100644
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -532,7 +532,7 @@ struct md_personality
+ int level;
+ struct list_head list;
+ struct module *owner;
+- bool (*make_request)(struct mddev *mddev, struct bio *bio);
++ bool __must_check (*make_request)(struct mddev *mddev, struct bio *bio);
+ /*
+ * start up works that do NOT require md_thread. tasks that
+ * requires md_thread should go into start()
+@@ -684,7 +684,7 @@ extern void md_error(struct mddev *mddev, struct md_rdev *rdev);
+ extern void md_finish_reshape(struct mddev *mddev);
+
+ extern int mddev_congested(struct mddev *mddev, int bits);
+-extern void md_flush_request(struct mddev *mddev, struct bio *bio);
++extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio);
+ extern void md_super_write(struct mddev *mddev, struct md_rdev *rdev,
+ sector_t sector, int size, struct page *page);
+ extern int md_super_wait(struct mddev *mddev);
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index 475e5f8b2287..2e7140507f93 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -580,10 +580,9 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio)
+ unsigned chunk_sects;
+ unsigned sectors;
+
+- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) {
+- md_flush_request(mddev, bio);
++ if (unlikely(bio->bi_opf & REQ_PREFLUSH)
++ && md_flush_request(mddev, bio))
+ return true;
+- }
+
+ if (unlikely((bio_op(bio) == REQ_OP_DISCARD))) {
+ raid0_handle_discard(mddev, bio);
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 6929d110d804..6800dcd50a11 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1537,10 +1537,9 @@ static bool raid1_make_request(struct mddev *mddev, struct bio *bio)
+ {
+ sector_t sectors;
+
+- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) {
+- md_flush_request(mddev, bio);
++ if (unlikely(bio->bi_opf & REQ_PREFLUSH)
++ && md_flush_request(mddev, bio))
+ return true;
+- }
+
+ /*
+ * There is a limit to the maximum size, but
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 4cf3d8ad0b4a..02c5e390f89f 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1562,10 +1562,9 @@ static bool raid10_make_request(struct mddev *mddev, struct bio *bio)
+ int chunk_sects = chunk_mask + 1;
+ int sectors = bio_sectors(bio);
+
+- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) {
+- md_flush_request(mddev, bio);
++ if (unlikely(bio->bi_opf & REQ_PREFLUSH)
++ && md_flush_request(mddev, bio))
+ return true;
+- }
+
+ if (!md_write_start(mddev, bio))
+ return false;
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 4a5aad26ded7..01021382131b 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -5590,8 +5590,8 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi)
+ if (ret == 0)
+ return true;
+ if (ret == -ENODEV) {
+- md_flush_request(mddev, bi);
+- return true;
++ if (md_flush_request(mddev, bi))
++ return true;
+ }
+ /* ret == -EAGAIN, fallback */
+ /*
+@@ -5724,7 +5724,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi)
+ do_flush = false;
+ }
+
+- if (!sh->batch_head)
++ if (!sh->batch_head || sh == sh->batch_head)
+ set_bit(STRIPE_HANDLE, &sh->state);
+ clear_bit(STRIPE_DELAYED, &sh->state);
+ if ((!sh->batch_head || sh == sh->batch_head) &&
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index e40fdf97b0f0..e3972dbf4c9a 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -1115,9 +1115,6 @@ static const struct v4l2_file_operations vdec_fops = {
+ .unlocked_ioctl = video_ioctl2,
+ .poll = v4l2_m2m_fop_poll,
+ .mmap = v4l2_m2m_fop_mmap,
+-#ifdef CONFIG_COMPAT
+- .compat_ioctl32 = v4l2_compat_ioctl32,
+-#endif
+ };
+
+ static int vdec_probe(struct platform_device *pdev)
+diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
+index 41249d1443fa..420897241248 100644
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -1220,9 +1220,6 @@ static const struct v4l2_file_operations venc_fops = {
+ .unlocked_ioctl = video_ioctl2,
+ .poll = v4l2_m2m_fop_poll,
+ .mmap = v4l2_m2m_fop_mmap,
+-#ifdef CONFIG_COMPAT
+- .compat_ioctl32 = v4l2_compat_ioctl32,
+-#endif
+ };
+
+ static int venc_probe(struct platform_device *pdev)
+diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+index 66b64096f5de..40c4eef71c34 100644
+--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+@@ -651,8 +651,7 @@ static int bdisp_release(struct file *file)
+
+ dev_dbg(bdisp->dev, "%s\n", __func__);
+
+- if (mutex_lock_interruptible(&bdisp->lock))
+- return -ERESTARTSYS;
++ mutex_lock(&bdisp->lock);
+
+ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+
+diff --git a/drivers/media/platform/vimc/vimc-core.c b/drivers/media/platform/vimc/vimc-core.c
+index 27db8835c241..8548fa93bcf6 100644
+--- a/drivers/media/platform/vimc/vimc-core.c
++++ b/drivers/media/platform/vimc/vimc-core.c
+@@ -243,10 +243,7 @@ static void vimc_comp_unbind(struct device *master)
+
+ static int vimc_comp_compare(struct device *comp, void *data)
+ {
+- const struct platform_device *pdev = to_platform_device(comp);
+- const char *name = data;
+-
+- return !strcmp(pdev->dev.platform_data, name);
++ return comp == data;
+ }
+
+ static struct component_match *vimc_add_subdevs(struct vimc_device *vimc)
+@@ -276,7 +273,7 @@ static struct component_match *vimc_add_subdevs(struct vimc_device *vimc)
+ }
+
+ component_match_add(&vimc->pdev.dev, &match, vimc_comp_compare,
+- (void *)vimc->pipe_cfg->ents[i].name);
++ &vimc->subdevs[i]->dev);
+ }
+
+ return match;
+diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c
+index 11aa94f189cb..500026974dee 100644
+--- a/drivers/media/radio/radio-wl1273.c
++++ b/drivers/media/radio/radio-wl1273.c
+@@ -1156,8 +1156,7 @@ static int wl1273_fm_fops_release(struct file *file)
+ if (radio->rds_users > 0) {
+ radio->rds_users--;
+ if (radio->rds_users == 0) {
+- if (mutex_lock_interruptible(&core->lock))
+- return -EINTR;
++ mutex_lock(&core->lock);
+
+ radio->irq_flags &= ~WL1273_RDS_EVENT;
+
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index b23c57e07f36..0135693afa15 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -1661,6 +1661,36 @@ static void omap_hsmmc_init_card(struct mmc_host *mmc, struct mmc_card *card)
+
+ if (mmc_pdata(host)->init_card)
+ mmc_pdata(host)->init_card(card);
++ else if (card->type == MMC_TYPE_SDIO ||
++ card->type == MMC_TYPE_SD_COMBO) {
++ struct device_node *np = mmc_dev(mmc)->of_node;
++
++ /*
++ * REVISIT: should be moved to sdio core and made more
++ * general e.g. by expanding the DT bindings of child nodes
++ * to provide a mechanism to provide this information:
++ * Documentation/devicetree/bindings/mmc/mmc-card.txt
++ */
++
++ np = of_get_compatible_child(np, "ti,wl1251");
++ if (np) {
++ /*
++ * We have TI wl1251 attached to MMC3. Pass this
++ * information to the SDIO core because it can't be
++ * probed by normal methods.
++ */
++
++ dev_info(host->dev, "found wl1251\n");
++ card->quirks |= MMC_QUIRK_NONSTD_SDIO;
++ card->cccr.wide_bus = 1;
++ card->cis.vendor = 0x104c;
++ card->cis.device = 0x9066;
++ card->cis.blksize = 512;
++ card->cis.max_dtr = 24000000;
++ card->ocr = 0x80;
++ of_node_put(np);
++ }
++ }
+ }
+
+ static void omap_hsmmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
+diff --git a/drivers/mtd/devices/spear_smi.c b/drivers/mtd/devices/spear_smi.c
+index 986f81d2f93e..47ad0766affa 100644
+--- a/drivers/mtd/devices/spear_smi.c
++++ b/drivers/mtd/devices/spear_smi.c
+@@ -592,6 +592,26 @@ static int spear_mtd_read(struct mtd_info *mtd, loff_t from, size_t len,
+ return 0;
+ }
+
++/*
++ * The purpose of this function is to ensure a memcpy_toio() with byte writes
++ * only. Its structure is inspired from the ARM implementation of _memcpy_toio()
++ * which also does single byte writes but cannot be used here as this is just an
++ * implementation detail and not part of the API. Not mentioning the comment
++ * stating that _memcpy_toio() should be optimized.
++ */
++static void spear_smi_memcpy_toio_b(volatile void __iomem *dest,
++ const void *src, size_t len)
++{
++ const unsigned char *from = src;
++
++ while (len) {
++ len--;
++ writeb(*from, dest);
++ from++;
++ dest++;
++ }
++}
++
+ static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank,
+ void __iomem *dest, const void *src, size_t len)
+ {
+@@ -614,7 +634,23 @@ static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank,
+ ctrlreg1 = readl(dev->io_base + SMI_CR1);
+ writel((ctrlreg1 | WB_MODE) & ~SW_MODE, dev->io_base + SMI_CR1);
+
+- memcpy_toio(dest, src, len);
++ /*
++ * In Write Burst mode (WB_MODE), the specs states that writes must be:
++ * - incremental
++ * - of the same size
++ * The ARM implementation of memcpy_toio() will optimize the number of
++ * I/O by using as much 4-byte writes as possible, surrounded by
++ * 2-byte/1-byte access if:
++ * - the destination is not 4-byte aligned
++ * - the length is not a multiple of 4-byte.
++ * Avoid this alternance of write access size by using our own 'byte
++ * access' helper if at least one of the two conditions above is true.
++ */
++ if (IS_ALIGNED(len, sizeof(u32)) &&
++ IS_ALIGNED((uintptr_t)dest, sizeof(u32)))
++ memcpy_toio(dest, src, len);
++ else
++ spear_smi_memcpy_toio_b(dest, src, len);
+
+ writel(ctrlreg1, dev->io_base + SMI_CR1);
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+index 2097f92e14c5..f9259e568fa0 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+@@ -173,8 +173,12 @@ void hnae3_register_ae_algo(struct hnae3_ae_algo *ae_algo)
+ if (!id)
+ continue;
+
+- /* ae_dev init should set flag */
++ if (!ae_algo->ops) {
++ dev_err(&ae_dev->pdev->dev, "ae_algo ops are null\n");
++ continue;
++ }
+ ae_dev->ops = ae_algo->ops;
++
+ ret = ae_algo->ops->init_ae_dev(ae_dev);
+ if (ret) {
+ dev_err(&ae_dev->pdev->dev,
+@@ -182,6 +186,7 @@ void hnae3_register_ae_algo(struct hnae3_ae_algo *ae_algo)
+ continue;
+ }
+
++ /* ae_dev init should set flag */
+ hnae3_set_bit(ae_dev->flag, HNAE3_DEV_INITED_B, 1);
+
+ /* check the client list for the match with this ae_dev type and
+@@ -239,7 +244,7 @@ EXPORT_SYMBOL(hnae3_unregister_ae_algo);
+ * @ae_dev: the AE device
+ * NOTE: the duplicated name will not be checked
+ */
+-void hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev)
++int hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev)
+ {
+ const struct pci_device_id *id;
+ struct hnae3_ae_algo *ae_algo;
+@@ -256,14 +261,13 @@ void hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev)
+ if (!id)
+ continue;
+
+- ae_dev->ops = ae_algo->ops;
+-
+- if (!ae_dev->ops) {
+- dev_err(&ae_dev->pdev->dev, "ae_dev ops are null\n");
++ if (!ae_algo->ops) {
++ dev_err(&ae_dev->pdev->dev, "ae_algo ops are null\n");
++ ret = -EOPNOTSUPP;
+ goto out_err;
+ }
++ ae_dev->ops = ae_algo->ops;
+
+- /* ae_dev init should set flag */
+ ret = ae_dev->ops->init_ae_dev(ae_dev);
+ if (ret) {
+ dev_err(&ae_dev->pdev->dev,
+@@ -271,6 +275,7 @@ void hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev)
+ goto out_err;
+ }
+
++ /* ae_dev init should set flag */
+ hnae3_set_bit(ae_dev->flag, HNAE3_DEV_INITED_B, 1);
+ break;
+ }
+@@ -286,8 +291,15 @@ void hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev)
+ ret);
+ }
+
++ mutex_unlock(&hnae3_common_lock);
++
++ return 0;
++
+ out_err:
++ list_del(&ae_dev->node);
+ mutex_unlock(&hnae3_common_lock);
++
++ return ret;
+ }
+ EXPORT_SYMBOL(hnae3_register_ae_dev);
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index f5c7fc9c5e5c..5e1a7ab06c63 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -513,7 +513,7 @@ struct hnae3_handle {
+ #define hnae3_get_bit(origin, shift) \
+ hnae3_get_field((origin), (0x1 << (shift)), (shift))
+
+-void hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev);
++int hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev);
+ void hnae3_unregister_ae_dev(struct hnae3_ae_dev *ae_dev);
+
+ void hnae3_unregister_ae_algo(struct hnae3_ae_algo *ae_algo);
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index b2860087a7dc..0788e78747d9 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1604,9 +1604,13 @@ static int hns3_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ ae_dev->dev_type = HNAE3_DEV_KNIC;
+ pci_set_drvdata(pdev, ae_dev);
+
+- hnae3_register_ae_dev(ae_dev);
++ ret = hnae3_register_ae_dev(ae_dev);
++ if (ret) {
++ devm_kfree(&pdev->dev, ae_dev);
++ pci_set_drvdata(pdev, NULL);
++ }
+
+- return 0;
++ return ret;
+ }
+
+ /* hns3_remove - Device removal routine
+@@ -1620,6 +1624,7 @@ static void hns3_remove(struct pci_dev *pdev)
+ hns3_disable_sriov(pdev);
+
+ hnae3_unregister_ae_dev(ae_dev);
++ pci_set_drvdata(pdev, NULL);
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
+index 27d5f27163d2..78b44d787638 100644
+--- a/drivers/net/ethernet/intel/e100.c
++++ b/drivers/net/ethernet/intel/e100.c
+@@ -1345,8 +1345,8 @@ static inline int e100_load_ucode_wait(struct nic *nic)
+
+ fw = e100_request_firmware(nic);
+ /* If it's NULL, then no ucode is required */
+- if (!fw || IS_ERR(fw))
+- return PTR_ERR(fw);
++ if (IS_ERR_OR_NULL(fw))
++ return PTR_ERR_OR_ZERO(fw);
+
+ if ((err = e100_exec_cb(nic, (void *)fw, e100_setup_ucode)))
+ netif_err(nic, probe, nic->netdev,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 10d72c83714d..a383276eb816 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1320,7 +1320,7 @@ static int mlx5e_get_module_info(struct net_device *netdev,
+ break;
+ case MLX5_MODULE_ID_SFP:
+ modinfo->type = ETH_MODULE_SFF_8472;
+- modinfo->eeprom_len = MLX5_EEPROM_PAGE_LENGTH;
++ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
+ break;
+ default:
+ netdev_err(priv->netdev, "%s: cable type not recognized:0x%x\n",
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+index 44b6c2ac5961..76960d3adfc0 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -2228,7 +2228,7 @@ static void mlxsw_sp_router_probe_unresolved_nexthops(struct work_struct *work)
+ static void
+ mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp *mlxsw_sp,
+ struct mlxsw_sp_neigh_entry *neigh_entry,
+- bool removing);
++ bool removing, bool dead);
+
+ static enum mlxsw_reg_rauht_op mlxsw_sp_rauht_op(bool adding)
+ {
+@@ -2359,7 +2359,8 @@ static void mlxsw_sp_router_neigh_event_work(struct work_struct *work)
+
+ memcpy(neigh_entry->ha, ha, ETH_ALEN);
+ mlxsw_sp_neigh_entry_update(mlxsw_sp, neigh_entry, entry_connected);
+- mlxsw_sp_nexthop_neigh_update(mlxsw_sp, neigh_entry, !entry_connected);
++ mlxsw_sp_nexthop_neigh_update(mlxsw_sp, neigh_entry, !entry_connected,
++ dead);
+
+ if (!neigh_entry->connected && list_empty(&neigh_entry->nexthop_list))
+ mlxsw_sp_neigh_entry_destroy(mlxsw_sp, neigh_entry);
+@@ -3323,13 +3324,79 @@ static void __mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp_nexthop *nh,
+ nh->update = 1;
+ }
+
++static int
++mlxsw_sp_nexthop_dead_neigh_replace(struct mlxsw_sp *mlxsw_sp,
++ struct mlxsw_sp_neigh_entry *neigh_entry)
++{
++ struct neighbour *n, *old_n = neigh_entry->key.n;
++ struct mlxsw_sp_nexthop *nh;
++ bool entry_connected;
++ u8 nud_state, dead;
++ int err;
++
++ nh = list_first_entry(&neigh_entry->nexthop_list,
++ struct mlxsw_sp_nexthop, neigh_list_node);
++
++ n = neigh_lookup(nh->nh_grp->neigh_tbl, &nh->gw_addr, nh->rif->dev);
++ if (!n) {
++ n = neigh_create(nh->nh_grp->neigh_tbl, &nh->gw_addr,
++ nh->rif->dev);
++ if (IS_ERR(n))
++ return PTR_ERR(n);
++ neigh_event_send(n, NULL);
++ }
++
++ mlxsw_sp_neigh_entry_remove(mlxsw_sp, neigh_entry);
++ neigh_entry->key.n = n;
++ err = mlxsw_sp_neigh_entry_insert(mlxsw_sp, neigh_entry);
++ if (err)
++ goto err_neigh_entry_insert;
++
++ read_lock_bh(&n->lock);
++ nud_state = n->nud_state;
++ dead = n->dead;
++ read_unlock_bh(&n->lock);
++ entry_connected = nud_state & NUD_VALID && !dead;
++
++ list_for_each_entry(nh, &neigh_entry->nexthop_list,
++ neigh_list_node) {
++ neigh_release(old_n);
++ neigh_clone(n);
++ __mlxsw_sp_nexthop_neigh_update(nh, !entry_connected);
++ mlxsw_sp_nexthop_group_refresh(mlxsw_sp, nh->nh_grp);
++ }
++
++ neigh_release(n);
++
++ return 0;
++
++err_neigh_entry_insert:
++ neigh_entry->key.n = old_n;
++ mlxsw_sp_neigh_entry_insert(mlxsw_sp, neigh_entry);
++ neigh_release(n);
++ return err;
++}
++
+ static void
+ mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp *mlxsw_sp,
+ struct mlxsw_sp_neigh_entry *neigh_entry,
+- bool removing)
++ bool removing, bool dead)
+ {
+ struct mlxsw_sp_nexthop *nh;
+
++ if (list_empty(&neigh_entry->nexthop_list))
++ return;
++
++ if (dead) {
++ int err;
++
++ err = mlxsw_sp_nexthop_dead_neigh_replace(mlxsw_sp,
++ neigh_entry);
++ if (err)
++ dev_err(mlxsw_sp->bus_info->dev, "Failed to replace dead neigh\n");
++ return;
++ }
++
+ list_for_each_entry(nh, &neigh_entry->nexthop_list,
+ neigh_list_node) {
+ __mlxsw_sp_nexthop_neigh_update(nh, removing);
+diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
+index b94759daeacc..da2d179430ca 100644
+--- a/drivers/net/wireless/ath/ar5523/ar5523.c
++++ b/drivers/net/wireless/ath/ar5523/ar5523.c
+@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata,
+
+ if (flags & AR5523_CMD_FLAG_MAGIC)
+ hdr->magic = cpu_to_be32(1 << 24);
+- memcpy(hdr + 1, idata, ilen);
++ if (ilen)
++ memcpy(hdr + 1, idata, ilen);
+
+ cmd->odata = odata;
+ cmd->olen = olen;
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index 50a801a5d4f1..2a503aacf0c6 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -2052,6 +2052,11 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
+
+ ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif stop\n");
+
++ ath10k_pci_irq_disable(ar);
++ ath10k_pci_irq_sync(ar);
++ napi_synchronize(&ar->napi);
++ napi_disable(&ar->napi);
++
+ /* Most likely the device has HTT Rx ring configured. The only way to
+ * prevent the device from accessing (and possible corrupting) host
+ * memory is to reset the chip now.
+@@ -2065,10 +2070,6 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
+ */
+ ath10k_pci_safe_chip_reset(ar);
+
+- ath10k_pci_irq_disable(ar);
+- ath10k_pci_irq_sync(ar);
+- napi_synchronize(&ar->napi);
+- napi_disable(&ar->napi);
+ ath10k_pci_flush(ar);
+
+ spin_lock_irqsave(&ar_pci->ps_lock, flags);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c
+index 80123fd97221..ee5ff7255090 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c
+@@ -1198,6 +1198,7 @@ void rtl92de_enable_interrupt(struct ieee80211_hw *hw)
+
+ rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
+ rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
++ rtlpci->irq_enabled = true;
+ }
+
+ void rtl92de_disable_interrupt(struct ieee80211_hw *hw)
+@@ -1207,7 +1208,7 @@ void rtl92de_disable_interrupt(struct ieee80211_hw *hw)
+
+ rtl_write_dword(rtlpriv, REG_HIMR, IMR8190_DISABLED);
+ rtl_write_dword(rtlpriv, REG_HIMRE, IMR8190_DISABLED);
+- synchronize_irq(rtlpci->pdev->irq);
++ rtlpci->irq_enabled = false;
+ }
+
+ static void _rtl92de_poweroff_adapter(struct ieee80211_hw *hw)
+@@ -1373,7 +1374,7 @@ void rtl92de_set_beacon_related_registers(struct ieee80211_hw *hw)
+
+ bcn_interval = mac->beacon_interval;
+ atim_window = 2;
+- /*rtl92de_disable_interrupt(hw); */
++ rtl92de_disable_interrupt(hw);
+ rtl_write_word(rtlpriv, REG_ATIMWND, atim_window);
+ rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval);
+ rtl_write_word(rtlpriv, REG_BCNTCFG, 0x660f);
+@@ -1393,9 +1394,9 @@ void rtl92de_set_beacon_interval(struct ieee80211_hw *hw)
+
+ RT_TRACE(rtlpriv, COMP_BEACON, DBG_DMESG,
+ "beacon_interval:%d\n", bcn_interval);
+- /* rtl92de_disable_interrupt(hw); */
++ rtl92de_disable_interrupt(hw);
+ rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval);
+- /* rtl92de_enable_interrupt(hw); */
++ rtl92de_enable_interrupt(hw);
+ }
+
+ void rtl92de_update_interrupt_mask(struct ieee80211_hw *hw,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
+index d5ba2bace79b..2b0c0308d281 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
+@@ -238,6 +238,7 @@ static struct rtl_hal_ops rtl8192de_hal_ops = {
+ .led_control = rtl92de_led_control,
+ .set_desc = rtl92de_set_desc,
+ .get_desc = rtl92de_get_desc,
++ .is_tx_desc_closed = rtl92de_is_tx_desc_closed,
+ .tx_polling = rtl92de_tx_polling,
+ .enable_hw_sec = rtl92de_enable_hw_security_config,
+ .set_key = rtl92de_set_key,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c
+index d7b023cf7400..76f12247184a 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c
+@@ -840,13 +840,15 @@ u64 rtl92de_get_desc(struct ieee80211_hw *hw,
+ break;
+ }
+ } else {
+- struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc;
+ switch (desc_name) {
+ case HW_DESC_OWN:
+- ret = GET_RX_DESC_OWN(pdesc);
++ ret = GET_RX_DESC_OWN(p_desc);
+ break;
+ case HW_DESC_RXPKT_LEN:
+- ret = GET_RX_DESC_PKT_LEN(pdesc);
++ ret = GET_RX_DESC_PKT_LEN(p_desc);
++ break;
++ case HW_DESC_RXBUFF_ADDR:
++ ret = GET_RX_DESC_BUFF_ADDR(p_desc);
+ break;
+ default:
+ WARN_ONCE(true, "rtl8192de: ERR rxdesc :%d not processed\n",
+@@ -857,6 +859,23 @@ u64 rtl92de_get_desc(struct ieee80211_hw *hw,
+ return ret;
+ }
+
++bool rtl92de_is_tx_desc_closed(struct ieee80211_hw *hw,
++ u8 hw_queue, u16 index)
++{
++ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
++ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
++ u8 *entry = (u8 *)(&ring->desc[ring->idx]);
++ u8 own = (u8)rtl92de_get_desc(hw, entry, true, HW_DESC_OWN);
++
++ /* a beacon packet will only use the first
++ * descriptor by defaut, and the own bit may not
++ * be cleared by the hardware
++ */
++ if (own)
++ return false;
++ return true;
++}
++
+ void rtl92de_tx_polling(struct ieee80211_hw *hw, u8 hw_queue)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h
+index f7f776539438..3d026e518c02 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h
+@@ -737,6 +737,8 @@ void rtl92de_set_desc(struct ieee80211_hw *hw, u8 *pdesc, bool istx,
+ u8 desc_name, u8 *val);
+ u64 rtl92de_get_desc(struct ieee80211_hw *hw,
+ u8 *p_desc, bool istx, u8 desc_name);
++bool rtl92de_is_tx_desc_closed(struct ieee80211_hw *hw,
++ u8 hw_queue, u16 index);
+ void rtl92de_tx_polling(struct ieee80211_hw *hw, u8 hw_queue);
+ void rtl92de_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
+ bool b_firstseg, bool b_lastseg,
+diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
+index 2edb59039b5f..514528b3566f 100644
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -305,7 +305,6 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
+ {
+ struct property *new_prop = NULL, *prop;
+ int ret = 0;
+- bool check_for_non_overlay_node = false;
+
+ if (target->in_livetree)
+ if (!of_prop_cmp(overlay_prop->name, "name") ||
+@@ -318,6 +317,25 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
+ else
+ prop = NULL;
+
++ if (prop) {
++ if (!of_prop_cmp(prop->name, "#address-cells")) {
++ if (!of_prop_val_eq(prop, overlay_prop)) {
++ pr_err("ERROR: changing value of #address-cells is not allowed in %pOF\n",
++ target->np);
++ ret = -EINVAL;
++ }
++ return ret;
++
++ } else if (!of_prop_cmp(prop->name, "#size-cells")) {
++ if (!of_prop_val_eq(prop, overlay_prop)) {
++ pr_err("ERROR: changing value of #size-cells is not allowed in %pOF\n",
++ target->np);
++ ret = -EINVAL;
++ }
++ return ret;
++ }
++ }
++
+ if (is_symbols_prop) {
+ if (prop)
+ return -EINVAL;
+@@ -330,33 +348,18 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
+ return -ENOMEM;
+
+ if (!prop) {
+- check_for_non_overlay_node = true;
+ if (!target->in_livetree) {
+ new_prop->next = target->np->deadprops;
+ target->np->deadprops = new_prop;
+ }
+ ret = of_changeset_add_property(&ovcs->cset, target->np,
+ new_prop);
+- } else if (!of_prop_cmp(prop->name, "#address-cells")) {
+- if (!of_prop_val_eq(prop, new_prop)) {
+- pr_err("ERROR: changing value of #address-cells is not allowed in %pOF\n",
+- target->np);
+- ret = -EINVAL;
+- }
+- } else if (!of_prop_cmp(prop->name, "#size-cells")) {
+- if (!of_prop_val_eq(prop, new_prop)) {
+- pr_err("ERROR: changing value of #size-cells is not allowed in %pOF\n",
+- target->np);
+- ret = -EINVAL;
+- }
+ } else {
+- check_for_non_overlay_node = true;
+ ret = of_changeset_update_property(&ovcs->cset, target->np,
+ new_prop);
+ }
+
+- if (check_for_non_overlay_node &&
+- !of_node_check_flag(target->np, OF_OVERLAY))
++ if (!of_node_check_flag(target->np, OF_OVERLAY))
+ pr_err("WARNING: memory leak will occur if overlay removed, property: %pOF/%s\n",
+ target->np, new_prop->name);
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 68f52966bbc0..808571f7f6ef 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -1133,8 +1133,10 @@ static void attach_node_and_children(struct device_node *np)
+ full_name = kasprintf(GFP_KERNEL, "%pOF", np);
+
+ if (!strcmp(full_name, "/__local_fixups__") ||
+- !strcmp(full_name, "/__fixups__"))
++ !strcmp(full_name, "/__fixups__")) {
++ kfree(full_name);
+ return;
++ }
+
+ dup = of_find_node_by_path(full_name);
+ kfree(full_name);
+diff --git a/drivers/pci/controller/pcie-rcar.c b/drivers/pci/controller/pcie-rcar.c
+index 9b9c677ad3a0..333ab6092f17 100644
+--- a/drivers/pci/controller/pcie-rcar.c
++++ b/drivers/pci/controller/pcie-rcar.c
+@@ -93,8 +93,11 @@
+ #define LINK_SPEED_2_5GTS (1 << 16)
+ #define LINK_SPEED_5_0GTS (2 << 16)
+ #define MACCTLR 0x011058
++#define MACCTLR_NFTS_MASK GENMASK(23, 16) /* The name is from SH7786 */
+ #define SPEED_CHANGE BIT(24)
+ #define SCRAMBLE_DISABLE BIT(27)
++#define LTSMDIS BIT(31)
++#define MACCTLR_INIT_VAL (LTSMDIS | MACCTLR_NFTS_MASK)
+ #define PMSR 0x01105c
+ #define MACS2R 0x011078
+ #define MACCGSPSETR 0x011084
+@@ -615,6 +618,8 @@ static int rcar_pcie_hw_init(struct rcar_pcie *pcie)
+ if (IS_ENABLED(CONFIG_PCI_MSI))
+ rcar_pci_write_reg(pcie, 0x801f0000, PCIEMSITXR);
+
++ rcar_pci_write_reg(pcie, MACCTLR_INIT_VAL, MACCTLR);
++
+ /* Finish initialization - establish a PCI Express link */
+ rcar_pci_write_reg(pcie, CFINIT, PCIETCTLR);
+
+@@ -1237,6 +1242,7 @@ static int rcar_pcie_resume_noirq(struct device *dev)
+ return 0;
+
+ /* Re-establish the PCIe link */
++ rcar_pci_write_reg(pcie, MACCTLR_INIT_VAL, MACCTLR);
+ rcar_pci_write_reg(pcie, CFINIT, PCIETCTLR);
+ return rcar_pcie_wait_for_dl(pcie);
+ }
+diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
+index 12afa7fdf77e..c94c13525447 100644
+--- a/drivers/pci/hotplug/acpiphp_glue.c
++++ b/drivers/pci/hotplug/acpiphp_glue.c
+@@ -449,8 +449,15 @@ static void acpiphp_native_scan_bridge(struct pci_dev *bridge)
+
+ /* Scan non-hotplug bridges that need to be reconfigured */
+ for_each_pci_bridge(dev, bus) {
+- if (!hotplug_is_native(dev))
+- max = pci_scan_bridge(bus, dev, max, 1);
++ if (hotplug_is_native(dev))
++ continue;
++
++ max = pci_scan_bridge(bus, dev, max, 1);
++ if (dev->subordinate) {
++ pcibios_resource_survey_bus(dev->subordinate);
++ pci_bus_size_bridges(dev->subordinate);
++ pci_bus_assign_resources(dev->subordinate);
++ }
+ }
+ }
+
+@@ -480,7 +487,6 @@ static void enable_slot(struct acpiphp_slot *slot, bool bridge)
+ if (PCI_SLOT(dev->devfn) == slot->device)
+ acpiphp_native_scan_bridge(dev);
+ }
+- pci_assign_unassigned_bridge_resources(bus->self);
+ } else {
+ LIST_HEAD(add_list);
+ int max, pass;
+diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+index d22b1ec2e58c..50cdf2032f1b 100644
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -23,6 +23,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/regulator/consumer.h>
++#include <linux/string.h>
+ #include <linux/usb/of.h>
+ #include <linux/workqueue.h>
+
+@@ -241,9 +242,9 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr,
+ if (!ch->has_otg_pins || !ch->phy->init_count)
+ return -EIO;
+
+- if (!strncmp(buf, "host", strlen("host")))
++ if (sysfs_streq(buf, "host"))
+ new_mode = PHY_MODE_USB_HOST;
+- else if (!strncmp(buf, "peripheral", strlen("peripheral")))
++ else if (sysfs_streq(buf, "peripheral"))
+ new_mode = PHY_MODE_USB_DEVICE;
+ else
+ return -EINVAL;
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index 3aac640596ad..d76ac6b4b40d 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -592,10 +592,10 @@ static int armada_37xx_irq_set_type(struct irq_data *d, unsigned int type)
+ regmap_read(info->regmap, in_reg, &in_val);
+
+ /* Set initial polarity based on current input level. */
+- if (in_val & d->mask)
+- val |= d->mask; /* falling */
++ if (in_val & BIT(d->hwirq % GPIO_PER_REG))
++ val |= BIT(d->hwirq % GPIO_PER_REG); /* falling */
+ else
+- val &= ~d->mask; /* rising */
++ val &= ~(BIT(d->hwirq % GPIO_PER_REG)); /* rising */
+ break;
+ }
+ default:
+diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c
+index f49ea3d92aa1..e87ee43efa16 100644
+--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
+@@ -494,8 +494,10 @@ int exynos_eint_wkup_init(struct samsung_pinctrl_drv_data *d)
+ if (match) {
+ irq_chip = kmemdup(match->data,
+ sizeof(*irq_chip), GFP_KERNEL);
+- if (!irq_chip)
++ if (!irq_chip) {
++ of_node_put(np);
+ return -ENOMEM;
++ }
+ wkup_np = np;
+ break;
+ }
+@@ -512,6 +514,7 @@ int exynos_eint_wkup_init(struct samsung_pinctrl_drv_data *d)
+ bank->nr_pins, &exynos_eint_irqd_ops, bank);
+ if (!bank->irq_domain) {
+ dev_err(dev, "wkup irq domain add failed\n");
++ of_node_put(wkup_np);
+ return -ENXIO;
+ }
+
+@@ -526,8 +529,10 @@ int exynos_eint_wkup_init(struct samsung_pinctrl_drv_data *d)
+ weint_data = devm_kcalloc(dev,
+ bank->nr_pins, sizeof(*weint_data),
+ GFP_KERNEL);
+- if (!weint_data)
++ if (!weint_data) {
++ of_node_put(wkup_np);
+ return -ENOMEM;
++ }
+
+ for (idx = 0; idx < bank->nr_pins; ++idx) {
+ irq = irq_of_parse_and_map(bank->of_node, idx);
+@@ -544,10 +549,13 @@ int exynos_eint_wkup_init(struct samsung_pinctrl_drv_data *d)
+ }
+ }
+
+- if (!muxed_banks)
++ if (!muxed_banks) {
++ of_node_put(wkup_np);
+ return 0;
++ }
+
+ irq = irq_of_parse_and_map(wkup_np, 0);
++ of_node_put(wkup_np);
+ if (!irq) {
+ dev_err(dev, "irq number for muxed EINTs not found\n");
+ return 0;
+diff --git a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
+index 7e824e4d20f4..9bd0a3de101d 100644
+--- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
++++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
+@@ -490,8 +490,10 @@ static int s3c24xx_eint_init(struct samsung_pinctrl_drv_data *d)
+ return -ENODEV;
+
+ eint_data = devm_kzalloc(dev, sizeof(*eint_data), GFP_KERNEL);
+- if (!eint_data)
++ if (!eint_data) {
++ of_node_put(eint_np);
+ return -ENOMEM;
++ }
+
+ eint_data->drvdata = d;
+
+@@ -503,12 +505,14 @@ static int s3c24xx_eint_init(struct samsung_pinctrl_drv_data *d)
+ irq = irq_of_parse_and_map(eint_np, i);
+ if (!irq) {
+ dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i);
++ of_node_put(eint_np);
+ return -ENXIO;
+ }
+
+ eint_data->parents[i] = irq;
+ irq_set_chained_handler_and_data(irq, handlers[i], eint_data);
+ }
++ of_node_put(eint_np);
+
+ bank = d->pin_banks;
+ for (i = 0; i < d->nr_banks; ++i, ++bank) {
+diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
+index c399f0932af5..f97f8179f2b1 100644
+--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
++++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
+@@ -704,8 +704,10 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d)
+ return -ENODEV;
+
+ data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
+- if (!data)
++ if (!data) {
++ of_node_put(eint0_np);
+ return -ENOMEM;
++ }
+ data->drvdata = d;
+
+ for (i = 0; i < NUM_EINT0_IRQ; ++i) {
+@@ -714,6 +716,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d)
+ irq = irq_of_parse_and_map(eint0_np, i);
+ if (!irq) {
+ dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i);
++ of_node_put(eint0_np);
+ return -ENXIO;
+ }
+
+@@ -721,6 +724,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d)
+ s3c64xx_eint0_handlers[i],
+ data);
+ }
++ of_node_put(eint0_np);
+
+ bank = d->pin_banks;
+ for (i = 0; i < d->nr_banks; ++i, ++bank) {
+diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
+index 698c7d8c9a08..c05217edcb0e 100644
+--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
+@@ -272,6 +272,7 @@ static int samsung_dt_node_to_map(struct pinctrl_dev *pctldev,
+ &reserved_maps, num_maps);
+ if (ret < 0) {
+ samsung_dt_free_map(pctldev, *map, *num_maps);
++ of_node_put(np);
+ return ret;
+ }
+ }
+@@ -785,8 +786,10 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions(
+ if (!of_get_child_count(cfg_np)) {
+ ret = samsung_pinctrl_create_function(dev, drvdata,
+ cfg_np, func);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(cfg_np);
+ return ERR_PTR(ret);
++ }
+ if (ret > 0) {
+ ++func;
+ ++func_cnt;
+@@ -797,8 +800,11 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions(
+ for_each_child_of_node(cfg_np, func_np) {
+ ret = samsung_pinctrl_create_function(dev, drvdata,
+ func_np, func);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(func_np);
++ of_node_put(cfg_np);
+ return ERR_PTR(ret);
++ }
+ if (ret > 0) {
+ ++func;
+ ++func_cnt;
+diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c
+index 3bae02380bb2..e183a22de715 100644
+--- a/drivers/power/supply/cpcap-battery.c
++++ b/drivers/power/supply/cpcap-battery.c
+@@ -82,7 +82,7 @@ struct cpcap_battery_config {
+ };
+
+ struct cpcap_coulomb_counter_data {
+- s32 sample; /* 24-bits */
++ s32 sample; /* 24 or 32 bits */
+ s32 accumulator;
+ s16 offset; /* 10-bits */
+ };
+@@ -213,7 +213,7 @@ static int cpcap_battery_get_current(struct cpcap_battery_ddata *ddata)
+ * TI or ST coulomb counter in the PMIC.
+ */
+ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata,
+- u32 sample, s32 accumulator,
++ s32 sample, s32 accumulator,
+ s16 offset, u32 divider)
+ {
+ s64 acc;
+@@ -224,7 +224,6 @@ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata,
+ if (!divider)
+ return 0;
+
+- sample &= 0xffffff; /* 24-bits, unsigned */
+ offset &= 0x7ff; /* 10-bits, signed */
+
+ switch (ddata->vendor) {
+@@ -259,7 +258,7 @@ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata,
+
+ /* 3600000μAms = 1μAh */
+ static int cpcap_battery_cc_to_uah(struct cpcap_battery_ddata *ddata,
+- u32 sample, s32 accumulator,
++ s32 sample, s32 accumulator,
+ s16 offset)
+ {
+ return cpcap_battery_cc_raw_div(ddata, sample,
+@@ -268,7 +267,7 @@ static int cpcap_battery_cc_to_uah(struct cpcap_battery_ddata *ddata,
+ }
+
+ static int cpcap_battery_cc_to_ua(struct cpcap_battery_ddata *ddata,
+- u32 sample, s32 accumulator,
++ s32 sample, s32 accumulator,
+ s16 offset)
+ {
+ return cpcap_battery_cc_raw_div(ddata, sample,
+@@ -312,6 +311,8 @@ cpcap_battery_read_accumulated(struct cpcap_battery_ddata *ddata,
+ /* Sample value CPCAP_REG_CCS1 & 2 */
+ ccd->sample = (buf[1] & 0x0fff) << 16;
+ ccd->sample |= buf[0];
++ if (ddata->vendor == CPCAP_VENDOR_TI)
++ ccd->sample = sign_extend32(24, ccd->sample);
+
+ /* Accumulator value CPCAP_REG_CCA1 & 2 */
+ ccd->accumulator = ((s16)buf[3]) << 16;
+diff --git a/drivers/regulator/88pm800-regulator.c b/drivers/regulator/88pm800-regulator.c
+new file mode 100644
+index 000000000000..89bbd6e8bad1
+--- /dev/null
++++ b/drivers/regulator/88pm800-regulator.c
+@@ -0,0 +1,305 @@
++/*
++ * Regulators driver for Marvell 88PM800
++ *
++ * Copyright (C) 2012 Marvell International Ltd.
++ * Joseph(Yossi) Hanin <yhanin@marvell.com>
++ * Yi Zhang <yizhang@marvell.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/init.h>
++#include <linux/err.h>
++#include <linux/regmap.h>
++#include <linux/regulator/driver.h>
++#include <linux/regulator/machine.h>
++#include <linux/mfd/88pm80x.h>
++#include <linux/delay.h>
++#include <linux/io.h>
++#include <linux/of.h>
++#include <linux/regulator/of_regulator.h>
++
++/* LDO1 with DVC[0..3] */
++#define PM800_LDO1_VOUT (0x08) /* VOUT1 */
++#define PM800_LDO1_VOUT_2 (0x09)
++#define PM800_LDO1_VOUT_3 (0x0A)
++#define PM800_LDO2_VOUT (0x0B)
++#define PM800_LDO3_VOUT (0x0C)
++#define PM800_LDO4_VOUT (0x0D)
++#define PM800_LDO5_VOUT (0x0E)
++#define PM800_LDO6_VOUT (0x0F)
++#define PM800_LDO7_VOUT (0x10)
++#define PM800_LDO8_VOUT (0x11)
++#define PM800_LDO9_VOUT (0x12)
++#define PM800_LDO10_VOUT (0x13)
++#define PM800_LDO11_VOUT (0x14)
++#define PM800_LDO12_VOUT (0x15)
++#define PM800_LDO13_VOUT (0x16)
++#define PM800_LDO14_VOUT (0x17)
++#define PM800_LDO15_VOUT (0x18)
++#define PM800_LDO16_VOUT (0x19)
++#define PM800_LDO17_VOUT (0x1A)
++#define PM800_LDO18_VOUT (0x1B)
++#define PM800_LDO19_VOUT (0x1C)
++
++/* BUCK1 with DVC[0..3] */
++#define PM800_BUCK1 (0x3C)
++#define PM800_BUCK1_1 (0x3D)
++#define PM800_BUCK1_2 (0x3E)
++#define PM800_BUCK1_3 (0x3F)
++#define PM800_BUCK2 (0x40)
++#define PM800_BUCK3 (0x41)
++#define PM800_BUCK4 (0x42)
++#define PM800_BUCK4_1 (0x43)
++#define PM800_BUCK4_2 (0x44)
++#define PM800_BUCK4_3 (0x45)
++#define PM800_BUCK5 (0x46)
++
++#define PM800_BUCK_ENA (0x50)
++#define PM800_LDO_ENA1_1 (0x51)
++#define PM800_LDO_ENA1_2 (0x52)
++#define PM800_LDO_ENA1_3 (0x53)
++
++#define PM800_LDO_ENA2_1 (0x56)
++#define PM800_LDO_ENA2_2 (0x57)
++#define PM800_LDO_ENA2_3 (0x58)
++
++#define PM800_BUCK1_MISC1 (0x78)
++#define PM800_BUCK3_MISC1 (0x7E)
++#define PM800_BUCK4_MISC1 (0x81)
++#define PM800_BUCK5_MISC1 (0x84)
++
++struct pm800_regulator_info {
++ struct regulator_desc desc;
++ int max_ua;
++};
++
++struct pm800_regulators {
++ struct pm80x_chip *chip;
++ struct regmap *map;
++};
++
++/*
++ * vreg - the buck regs string.
++ * ereg - the string for the enable register.
++ * ebit - the bit number in the enable register.
++ * amax - the current
++ * Buck has 2 kinds of voltage steps. It is easy to find voltage by ranges,
++ * not the constant voltage table.
++ * n_volt - Number of available selectors
++ */
++#define PM800_BUCK(match, vreg, ereg, ebit, amax, volt_ranges, n_volt) \
++{ \
++ .desc = { \
++ .name = #vreg, \
++ .of_match = of_match_ptr(#match), \
++ .regulators_node = of_match_ptr("regulators"), \
++ .ops = &pm800_volt_range_ops, \
++ .type = REGULATOR_VOLTAGE, \
++ .id = PM800_ID_##vreg, \
++ .owner = THIS_MODULE, \
++ .n_voltages = n_volt, \
++ .linear_ranges = volt_ranges, \
++ .n_linear_ranges = ARRAY_SIZE(volt_ranges), \
++ .vsel_reg = PM800_##vreg, \
++ .vsel_mask = 0x7f, \
++ .enable_reg = PM800_##ereg, \
++ .enable_mask = 1 << (ebit), \
++ }, \
++ .max_ua = (amax), \
++}
++
++/*
++ * vreg - the LDO regs string
++ * ereg - the string for the enable register.
++ * ebit - the bit number in the enable register.
++ * amax - the current
++ * volt_table - the LDO voltage table
++ * For all the LDOes, there are too many ranges. Using volt_table will be
++ * simpler and faster.
++ */
++#define PM800_LDO(match, vreg, ereg, ebit, amax, ldo_volt_table) \
++{ \
++ .desc = { \
++ .name = #vreg, \
++ .of_match = of_match_ptr(#match), \
++ .regulators_node = of_match_ptr("regulators"), \
++ .ops = &pm800_volt_table_ops, \
++ .type = REGULATOR_VOLTAGE, \
++ .id = PM800_ID_##vreg, \
++ .owner = THIS_MODULE, \
++ .n_voltages = ARRAY_SIZE(ldo_volt_table), \
++ .vsel_reg = PM800_##vreg##_VOUT, \
++ .vsel_mask = 0xf, \
++ .enable_reg = PM800_##ereg, \
++ .enable_mask = 1 << (ebit), \
++ .volt_table = ldo_volt_table, \
++ }, \
++ .max_ua = (amax), \
++}
++
++/* Ranges are sorted in ascending order. */
++static const struct regulator_linear_range buck1_volt_range[] = {
++ REGULATOR_LINEAR_RANGE(600000, 0, 0x4f, 12500),
++ REGULATOR_LINEAR_RANGE(1600000, 0x50, 0x54, 50000),
++};
++
++/* BUCK 2~5 have same ranges. */
++static const struct regulator_linear_range buck2_5_volt_range[] = {
++ REGULATOR_LINEAR_RANGE(600000, 0, 0x4f, 12500),
++ REGULATOR_LINEAR_RANGE(1600000, 0x50, 0x72, 50000),
++};
++
++static const unsigned int ldo1_volt_table[] = {
++ 600000, 650000, 700000, 750000, 800000, 850000, 900000, 950000,
++ 1000000, 1050000, 1100000, 1150000, 1200000, 1300000, 1400000, 1500000,
++};
++
++static const unsigned int ldo2_volt_table[] = {
++ 1700000, 1800000, 1900000, 2000000, 2100000, 2500000, 2700000, 2800000,
++};
++
++/* LDO 3~17 have same voltage table. */
++static const unsigned int ldo3_17_volt_table[] = {
++ 1200000, 1250000, 1700000, 1800000, 1850000, 1900000, 2500000, 2600000,
++ 2700000, 2750000, 2800000, 2850000, 2900000, 3000000, 3100000, 3300000,
++};
++
++/* LDO 18~19 have same voltage table. */
++static const unsigned int ldo18_19_volt_table[] = {
++ 1700000, 1800000, 1900000, 2500000, 2800000, 2900000, 3100000, 3300000,
++};
++
++static int pm800_get_current_limit(struct regulator_dev *rdev)
++{
++ struct pm800_regulator_info *info = rdev_get_drvdata(rdev);
++
++ return info->max_ua;
++}
++
++static const struct regulator_ops pm800_volt_range_ops = {
++ .list_voltage = regulator_list_voltage_linear_range,
++ .map_voltage = regulator_map_voltage_linear_range,
++ .set_voltage_sel = regulator_set_voltage_sel_regmap,
++ .get_voltage_sel = regulator_get_voltage_sel_regmap,
++ .enable = regulator_enable_regmap,
++ .disable = regulator_disable_regmap,
++ .is_enabled = regulator_is_enabled_regmap,
++ .get_current_limit = pm800_get_current_limit,
++};
++
++static const struct regulator_ops pm800_volt_table_ops = {
++ .list_voltage = regulator_list_voltage_table,
++ .map_voltage = regulator_map_voltage_iterate,
++ .set_voltage_sel = regulator_set_voltage_sel_regmap,
++ .get_voltage_sel = regulator_get_voltage_sel_regmap,
++ .enable = regulator_enable_regmap,
++ .disable = regulator_disable_regmap,
++ .is_enabled = regulator_is_enabled_regmap,
++ .get_current_limit = pm800_get_current_limit,
++};
++
++/* The array is indexed by id(PM800_ID_XXX) */
++static struct pm800_regulator_info pm800_regulator_info[] = {
++ PM800_BUCK(buck1, BUCK1, BUCK_ENA, 0, 3000000, buck1_volt_range, 0x55),
++ PM800_BUCK(buck2, BUCK2, BUCK_ENA, 1, 1200000, buck2_5_volt_range, 0x73),
++ PM800_BUCK(buck3, BUCK3, BUCK_ENA, 2, 1200000, buck2_5_volt_range, 0x73),
++ PM800_BUCK(buck4, BUCK4, BUCK_ENA, 3, 1200000, buck2_5_volt_range, 0x73),
++ PM800_BUCK(buck5, BUCK5, BUCK_ENA, 4, 1200000, buck2_5_volt_range, 0x73),
++
++ PM800_LDO(ldo1, LDO1, LDO_ENA1_1, 0, 200000, ldo1_volt_table),
++ PM800_LDO(ldo2, LDO2, LDO_ENA1_1, 1, 10000, ldo2_volt_table),
++ PM800_LDO(ldo3, LDO3, LDO_ENA1_1, 2, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo4, LDO4, LDO_ENA1_1, 3, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo5, LDO5, LDO_ENA1_1, 4, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo6, LDO6, LDO_ENA1_1, 5, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo7, LDO7, LDO_ENA1_1, 6, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo8, LDO8, LDO_ENA1_1, 7, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo9, LDO9, LDO_ENA1_2, 0, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo10, LDO10, LDO_ENA1_2, 1, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo11, LDO11, LDO_ENA1_2, 2, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo12, LDO12, LDO_ENA1_2, 3, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo13, LDO13, LDO_ENA1_2, 4, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo14, LDO14, LDO_ENA1_2, 5, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo15, LDO15, LDO_ENA1_2, 6, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo16, LDO16, LDO_ENA1_2, 7, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo17, LDO17, LDO_ENA1_3, 0, 300000, ldo3_17_volt_table),
++ PM800_LDO(ldo18, LDO18, LDO_ENA1_3, 1, 200000, ldo18_19_volt_table),
++ PM800_LDO(ldo19, LDO19, LDO_ENA1_3, 2, 200000, ldo18_19_volt_table),
++};
++
++static int pm800_regulator_probe(struct platform_device *pdev)
++{
++ struct pm80x_chip *chip = dev_get_drvdata(pdev->dev.parent);
++ struct pm80x_platform_data *pdata = dev_get_platdata(pdev->dev.parent);
++ struct pm800_regulators *pm800_data;
++ struct regulator_config config = { };
++ struct regulator_init_data *init_data;
++ int i, ret;
++
++ if (pdata && pdata->num_regulators) {
++ unsigned int count = 0;
++
++ /* Check whether num_regulator is valid. */
++ for (i = 0; i < ARRAY_SIZE(pdata->regulators); i++) {
++ if (pdata->regulators[i])
++ count++;
++ }
++ if (count != pdata->num_regulators)
++ return -EINVAL;
++ }
++
++ pm800_data = devm_kzalloc(&pdev->dev, sizeof(*pm800_data),
++ GFP_KERNEL);
++ if (!pm800_data)
++ return -ENOMEM;
++
++ pm800_data->map = chip->subchip->regmap_power;
++ pm800_data->chip = chip;
++
++ platform_set_drvdata(pdev, pm800_data);
++
++ config.dev = chip->dev;
++ config.regmap = pm800_data->map;
++ for (i = 0; i < PM800_ID_RG_MAX; i++) {
++ struct regulator_dev *regulator;
++
++ if (pdata && pdata->num_regulators) {
++ init_data = pdata->regulators[i];
++ if (!init_data)
++ continue;
++
++ config.init_data = init_data;
++ }
++
++ config.driver_data = &pm800_regulator_info[i];
++
++ regulator = devm_regulator_register(&pdev->dev,
++ &pm800_regulator_info[i].desc, &config);
++ if (IS_ERR(regulator)) {
++ ret = PTR_ERR(regulator);
++ dev_err(&pdev->dev, "Failed to register %s\n",
++ pm800_regulator_info[i].desc.name);
++ return ret;
++ }
++ }
++
++ return 0;
++}
++
++static struct platform_driver pm800_regulator_driver = {
++ .driver = {
++ .name = "88pm80x-regulator",
++ },
++ .probe = pm800_regulator_probe,
++};
++
++module_platform_driver(pm800_regulator_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Joseph(Yossi) Hanin <yhanin@marvell.com>");
++MODULE_DESCRIPTION("Regulator Driver for Marvell 88PM800 PMIC");
++MODULE_ALIAS("platform:88pm800-regulator");
+diff --git a/drivers/regulator/88pm800.c b/drivers/regulator/88pm800.c
+deleted file mode 100644
+index 89bbd6e8bad1..000000000000
+--- a/drivers/regulator/88pm800.c
++++ /dev/null
+@@ -1,305 +0,0 @@
+-/*
+- * Regulators driver for Marvell 88PM800
+- *
+- * Copyright (C) 2012 Marvell International Ltd.
+- * Joseph(Yossi) Hanin <yhanin@marvell.com>
+- * Yi Zhang <yizhang@marvell.com>
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2 as
+- * published by the Free Software Foundation.
+- */
+-#include <linux/module.h>
+-#include <linux/moduleparam.h>
+-#include <linux/init.h>
+-#include <linux/err.h>
+-#include <linux/regmap.h>
+-#include <linux/regulator/driver.h>
+-#include <linux/regulator/machine.h>
+-#include <linux/mfd/88pm80x.h>
+-#include <linux/delay.h>
+-#include <linux/io.h>
+-#include <linux/of.h>
+-#include <linux/regulator/of_regulator.h>
+-
+-/* LDO1 with DVC[0..3] */
+-#define PM800_LDO1_VOUT (0x08) /* VOUT1 */
+-#define PM800_LDO1_VOUT_2 (0x09)
+-#define PM800_LDO1_VOUT_3 (0x0A)
+-#define PM800_LDO2_VOUT (0x0B)
+-#define PM800_LDO3_VOUT (0x0C)
+-#define PM800_LDO4_VOUT (0x0D)
+-#define PM800_LDO5_VOUT (0x0E)
+-#define PM800_LDO6_VOUT (0x0F)
+-#define PM800_LDO7_VOUT (0x10)
+-#define PM800_LDO8_VOUT (0x11)
+-#define PM800_LDO9_VOUT (0x12)
+-#define PM800_LDO10_VOUT (0x13)
+-#define PM800_LDO11_VOUT (0x14)
+-#define PM800_LDO12_VOUT (0x15)
+-#define PM800_LDO13_VOUT (0x16)
+-#define PM800_LDO14_VOUT (0x17)
+-#define PM800_LDO15_VOUT (0x18)
+-#define PM800_LDO16_VOUT (0x19)
+-#define PM800_LDO17_VOUT (0x1A)
+-#define PM800_LDO18_VOUT (0x1B)
+-#define PM800_LDO19_VOUT (0x1C)
+-
+-/* BUCK1 with DVC[0..3] */
+-#define PM800_BUCK1 (0x3C)
+-#define PM800_BUCK1_1 (0x3D)
+-#define PM800_BUCK1_2 (0x3E)
+-#define PM800_BUCK1_3 (0x3F)
+-#define PM800_BUCK2 (0x40)
+-#define PM800_BUCK3 (0x41)
+-#define PM800_BUCK4 (0x42)
+-#define PM800_BUCK4_1 (0x43)
+-#define PM800_BUCK4_2 (0x44)
+-#define PM800_BUCK4_3 (0x45)
+-#define PM800_BUCK5 (0x46)
+-
+-#define PM800_BUCK_ENA (0x50)
+-#define PM800_LDO_ENA1_1 (0x51)
+-#define PM800_LDO_ENA1_2 (0x52)
+-#define PM800_LDO_ENA1_3 (0x53)
+-
+-#define PM800_LDO_ENA2_1 (0x56)
+-#define PM800_LDO_ENA2_2 (0x57)
+-#define PM800_LDO_ENA2_3 (0x58)
+-
+-#define PM800_BUCK1_MISC1 (0x78)
+-#define PM800_BUCK3_MISC1 (0x7E)
+-#define PM800_BUCK4_MISC1 (0x81)
+-#define PM800_BUCK5_MISC1 (0x84)
+-
+-struct pm800_regulator_info {
+- struct regulator_desc desc;
+- int max_ua;
+-};
+-
+-struct pm800_regulators {
+- struct pm80x_chip *chip;
+- struct regmap *map;
+-};
+-
+-/*
+- * vreg - the buck regs string.
+- * ereg - the string for the enable register.
+- * ebit - the bit number in the enable register.
+- * amax - the current
+- * Buck has 2 kinds of voltage steps. It is easy to find voltage by ranges,
+- * not the constant voltage table.
+- * n_volt - Number of available selectors
+- */
+-#define PM800_BUCK(match, vreg, ereg, ebit, amax, volt_ranges, n_volt) \
+-{ \
+- .desc = { \
+- .name = #vreg, \
+- .of_match = of_match_ptr(#match), \
+- .regulators_node = of_match_ptr("regulators"), \
+- .ops = &pm800_volt_range_ops, \
+- .type = REGULATOR_VOLTAGE, \
+- .id = PM800_ID_##vreg, \
+- .owner = THIS_MODULE, \
+- .n_voltages = n_volt, \
+- .linear_ranges = volt_ranges, \
+- .n_linear_ranges = ARRAY_SIZE(volt_ranges), \
+- .vsel_reg = PM800_##vreg, \
+- .vsel_mask = 0x7f, \
+- .enable_reg = PM800_##ereg, \
+- .enable_mask = 1 << (ebit), \
+- }, \
+- .max_ua = (amax), \
+-}
+-
+-/*
+- * vreg - the LDO regs string
+- * ereg - the string for the enable register.
+- * ebit - the bit number in the enable register.
+- * amax - the current
+- * volt_table - the LDO voltage table
+- * For all the LDOes, there are too many ranges. Using volt_table will be
+- * simpler and faster.
+- */
+-#define PM800_LDO(match, vreg, ereg, ebit, amax, ldo_volt_table) \
+-{ \
+- .desc = { \
+- .name = #vreg, \
+- .of_match = of_match_ptr(#match), \
+- .regulators_node = of_match_ptr("regulators"), \
+- .ops = &pm800_volt_table_ops, \
+- .type = REGULATOR_VOLTAGE, \
+- .id = PM800_ID_##vreg, \
+- .owner = THIS_MODULE, \
+- .n_voltages = ARRAY_SIZE(ldo_volt_table), \
+- .vsel_reg = PM800_##vreg##_VOUT, \
+- .vsel_mask = 0xf, \
+- .enable_reg = PM800_##ereg, \
+- .enable_mask = 1 << (ebit), \
+- .volt_table = ldo_volt_table, \
+- }, \
+- .max_ua = (amax), \
+-}
+-
+-/* Ranges are sorted in ascending order. */
+-static const struct regulator_linear_range buck1_volt_range[] = {
+- REGULATOR_LINEAR_RANGE(600000, 0, 0x4f, 12500),
+- REGULATOR_LINEAR_RANGE(1600000, 0x50, 0x54, 50000),
+-};
+-
+-/* BUCK 2~5 have same ranges. */
+-static const struct regulator_linear_range buck2_5_volt_range[] = {
+- REGULATOR_LINEAR_RANGE(600000, 0, 0x4f, 12500),
+- REGULATOR_LINEAR_RANGE(1600000, 0x50, 0x72, 50000),
+-};
+-
+-static const unsigned int ldo1_volt_table[] = {
+- 600000, 650000, 700000, 750000, 800000, 850000, 900000, 950000,
+- 1000000, 1050000, 1100000, 1150000, 1200000, 1300000, 1400000, 1500000,
+-};
+-
+-static const unsigned int ldo2_volt_table[] = {
+- 1700000, 1800000, 1900000, 2000000, 2100000, 2500000, 2700000, 2800000,
+-};
+-
+-/* LDO 3~17 have same voltage table. */
+-static const unsigned int ldo3_17_volt_table[] = {
+- 1200000, 1250000, 1700000, 1800000, 1850000, 1900000, 2500000, 2600000,
+- 2700000, 2750000, 2800000, 2850000, 2900000, 3000000, 3100000, 3300000,
+-};
+-
+-/* LDO 18~19 have same voltage table. */
+-static const unsigned int ldo18_19_volt_table[] = {
+- 1700000, 1800000, 1900000, 2500000, 2800000, 2900000, 3100000, 3300000,
+-};
+-
+-static int pm800_get_current_limit(struct regulator_dev *rdev)
+-{
+- struct pm800_regulator_info *info = rdev_get_drvdata(rdev);
+-
+- return info->max_ua;
+-}
+-
+-static const struct regulator_ops pm800_volt_range_ops = {
+- .list_voltage = regulator_list_voltage_linear_range,
+- .map_voltage = regulator_map_voltage_linear_range,
+- .set_voltage_sel = regulator_set_voltage_sel_regmap,
+- .get_voltage_sel = regulator_get_voltage_sel_regmap,
+- .enable = regulator_enable_regmap,
+- .disable = regulator_disable_regmap,
+- .is_enabled = regulator_is_enabled_regmap,
+- .get_current_limit = pm800_get_current_limit,
+-};
+-
+-static const struct regulator_ops pm800_volt_table_ops = {
+- .list_voltage = regulator_list_voltage_table,
+- .map_voltage = regulator_map_voltage_iterate,
+- .set_voltage_sel = regulator_set_voltage_sel_regmap,
+- .get_voltage_sel = regulator_get_voltage_sel_regmap,
+- .enable = regulator_enable_regmap,
+- .disable = regulator_disable_regmap,
+- .is_enabled = regulator_is_enabled_regmap,
+- .get_current_limit = pm800_get_current_limit,
+-};
+-
+-/* The array is indexed by id(PM800_ID_XXX) */
+-static struct pm800_regulator_info pm800_regulator_info[] = {
+- PM800_BUCK(buck1, BUCK1, BUCK_ENA, 0, 3000000, buck1_volt_range, 0x55),
+- PM800_BUCK(buck2, BUCK2, BUCK_ENA, 1, 1200000, buck2_5_volt_range, 0x73),
+- PM800_BUCK(buck3, BUCK3, BUCK_ENA, 2, 1200000, buck2_5_volt_range, 0x73),
+- PM800_BUCK(buck4, BUCK4, BUCK_ENA, 3, 1200000, buck2_5_volt_range, 0x73),
+- PM800_BUCK(buck5, BUCK5, BUCK_ENA, 4, 1200000, buck2_5_volt_range, 0x73),
+-
+- PM800_LDO(ldo1, LDO1, LDO_ENA1_1, 0, 200000, ldo1_volt_table),
+- PM800_LDO(ldo2, LDO2, LDO_ENA1_1, 1, 10000, ldo2_volt_table),
+- PM800_LDO(ldo3, LDO3, LDO_ENA1_1, 2, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo4, LDO4, LDO_ENA1_1, 3, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo5, LDO5, LDO_ENA1_1, 4, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo6, LDO6, LDO_ENA1_1, 5, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo7, LDO7, LDO_ENA1_1, 6, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo8, LDO8, LDO_ENA1_1, 7, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo9, LDO9, LDO_ENA1_2, 0, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo10, LDO10, LDO_ENA1_2, 1, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo11, LDO11, LDO_ENA1_2, 2, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo12, LDO12, LDO_ENA1_2, 3, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo13, LDO13, LDO_ENA1_2, 4, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo14, LDO14, LDO_ENA1_2, 5, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo15, LDO15, LDO_ENA1_2, 6, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo16, LDO16, LDO_ENA1_2, 7, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo17, LDO17, LDO_ENA1_3, 0, 300000, ldo3_17_volt_table),
+- PM800_LDO(ldo18, LDO18, LDO_ENA1_3, 1, 200000, ldo18_19_volt_table),
+- PM800_LDO(ldo19, LDO19, LDO_ENA1_3, 2, 200000, ldo18_19_volt_table),
+-};
+-
+-static int pm800_regulator_probe(struct platform_device *pdev)
+-{
+- struct pm80x_chip *chip = dev_get_drvdata(pdev->dev.parent);
+- struct pm80x_platform_data *pdata = dev_get_platdata(pdev->dev.parent);
+- struct pm800_regulators *pm800_data;
+- struct regulator_config config = { };
+- struct regulator_init_data *init_data;
+- int i, ret;
+-
+- if (pdata && pdata->num_regulators) {
+- unsigned int count = 0;
+-
+- /* Check whether num_regulator is valid. */
+- for (i = 0; i < ARRAY_SIZE(pdata->regulators); i++) {
+- if (pdata->regulators[i])
+- count++;
+- }
+- if (count != pdata->num_regulators)
+- return -EINVAL;
+- }
+-
+- pm800_data = devm_kzalloc(&pdev->dev, sizeof(*pm800_data),
+- GFP_KERNEL);
+- if (!pm800_data)
+- return -ENOMEM;
+-
+- pm800_data->map = chip->subchip->regmap_power;
+- pm800_data->chip = chip;
+-
+- platform_set_drvdata(pdev, pm800_data);
+-
+- config.dev = chip->dev;
+- config.regmap = pm800_data->map;
+- for (i = 0; i < PM800_ID_RG_MAX; i++) {
+- struct regulator_dev *regulator;
+-
+- if (pdata && pdata->num_regulators) {
+- init_data = pdata->regulators[i];
+- if (!init_data)
+- continue;
+-
+- config.init_data = init_data;
+- }
+-
+- config.driver_data = &pm800_regulator_info[i];
+-
+- regulator = devm_regulator_register(&pdev->dev,
+- &pm800_regulator_info[i].desc, &config);
+- if (IS_ERR(regulator)) {
+- ret = PTR_ERR(regulator);
+- dev_err(&pdev->dev, "Failed to register %s\n",
+- pm800_regulator_info[i].desc.name);
+- return ret;
+- }
+- }
+-
+- return 0;
+-}
+-
+-static struct platform_driver pm800_regulator_driver = {
+- .driver = {
+- .name = "88pm80x-regulator",
+- },
+- .probe = pm800_regulator_probe,
+-};
+-
+-module_platform_driver(pm800_regulator_driver);
+-
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Joseph(Yossi) Hanin <yhanin@marvell.com>");
+-MODULE_DESCRIPTION("Regulator Driver for Marvell 88PM800 PMIC");
+-MODULE_ALIAS("platform:88pm800-regulator");
+diff --git a/drivers/regulator/Makefile b/drivers/regulator/Makefile
+index 801d9a34a203..bba9c4851faf 100644
+--- a/drivers/regulator/Makefile
++++ b/drivers/regulator/Makefile
+@@ -11,7 +11,7 @@ obj-$(CONFIG_REGULATOR_VIRTUAL_CONSUMER) += virtual.o
+ obj-$(CONFIG_REGULATOR_USERSPACE_CONSUMER) += userspace-consumer.o
+
+ obj-$(CONFIG_REGULATOR_88PG86X) += 88pg86x.o
+-obj-$(CONFIG_REGULATOR_88PM800) += 88pm800.o
++obj-$(CONFIG_REGULATOR_88PM800) += 88pm800-regulator.o
+ obj-$(CONFIG_REGULATOR_88PM8607) += 88pm8607.o
+ obj-$(CONFIG_REGULATOR_CPCAP) += cpcap-regulator.o
+ obj-$(CONFIG_REGULATOR_AAT2870) += aat2870-regulator.o
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index 3d577e259e91..ce051f91829f 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -127,7 +127,7 @@ EXPORT_SYMBOL_GPL(rtc_read_time);
+
+ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm)
+ {
+- int err;
++ int err, uie;
+
+ err = rtc_valid_tm(tm);
+ if (err != 0)
+@@ -139,6 +139,17 @@ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm)
+
+ rtc_subtract_offset(rtc, tm);
+
++#ifdef CONFIG_RTC_INTF_DEV_UIE_EMUL
++ uie = rtc->uie_rtctimer.enabled || rtc->uie_irq_active;
++#else
++ uie = rtc->uie_rtctimer.enabled;
++#endif
++ if (uie) {
++ err = rtc_update_irq_enable(rtc, 0);
++ if (err)
++ return err;
++ }
++
+ err = mutex_lock_interruptible(&rtc->ops_lock);
+ if (err)
+ return err;
+@@ -162,6 +173,12 @@ int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm)
+ /* A timer might have just expired */
+ schedule_work(&rtc->irqwork);
+
++ if (uie) {
++ err = rtc_update_irq_enable(rtc, 1);
++ if (err)
++ return err;
++ }
++
+ trace_rtc_set_time(rtc_tm_to_time64(tm), err);
+ return err;
+ }
+diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
+index 3b368fcf13f4..946380f0d719 100644
+--- a/drivers/s390/scsi/zfcp_dbf.c
++++ b/drivers/s390/scsi/zfcp_dbf.c
+@@ -94,11 +94,9 @@ void zfcp_dbf_hba_fsf_res(char *tag, int level, struct zfcp_fsf_req *req)
+ memcpy(rec->u.res.fsf_status_qual, &q_head->fsf_status_qual,
+ FSF_STATUS_QUALIFIER_SIZE);
+
+- if (req->fsf_command != FSF_QTCB_FCP_CMND) {
+- rec->pl_len = q_head->log_length;
+- zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start,
+- rec->pl_len, "fsf_res", req->req_id);
+- }
++ rec->pl_len = q_head->log_length;
++ zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start,
++ rec->pl_len, "fsf_res", req->req_id);
+
+ debug_event(dbf->hba, level, rec, sizeof(*rec));
+ spin_unlock_irqrestore(&dbf->hba_lock, flags);
+diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h
+index 6c7d2e201abe..d499c4466166 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas.h
++++ b/drivers/scsi/hisi_sas/hisi_sas.h
+@@ -220,7 +220,7 @@ struct hisi_sas_hw {
+ int (*slot_index_alloc)(struct hisi_hba *hisi_hba, int *slot_idx,
+ struct domain_device *device);
+ struct hisi_sas_device *(*alloc_dev)(struct domain_device *device);
+- void (*sl_notify)(struct hisi_hba *hisi_hba, int phy_no);
++ void (*sl_notify_ssp)(struct hisi_hba *hisi_hba, int phy_no);
+ int (*get_free_slot)(struct hisi_hba *hisi_hba, struct hisi_sas_dq *dq);
+ void (*start_delivery)(struct hisi_sas_dq *dq);
+ void (*prep_ssp)(struct hisi_hba *hisi_hba,
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
+index f478d1f50dfc..f35c56217694 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -716,7 +716,8 @@ static void hisi_sas_phyup_work(struct work_struct *work)
+ struct asd_sas_phy *sas_phy = &phy->sas_phy;
+ int phy_no = sas_phy->id;
+
+- hisi_hba->hw->sl_notify(hisi_hba, phy_no); /* This requires a sleep */
++ if (phy->identify.target_port_protocols == SAS_PROTOCOL_SSP)
++ hisi_hba->hw->sl_notify_ssp(hisi_hba, phy_no);
+ hisi_sas_bytes_dmaed(hisi_hba, phy_no);
+ }
+
+@@ -885,7 +886,7 @@ static int hisi_sas_queue_command(struct sas_task *task, gfp_t gfp_flags)
+ return hisi_sas_task_exec(task, gfp_flags, 0, NULL);
+ }
+
+-static void hisi_sas_phy_set_linkrate(struct hisi_hba *hisi_hba, int phy_no,
++static int hisi_sas_phy_set_linkrate(struct hisi_hba *hisi_hba, int phy_no,
+ struct sas_phy_linkrates *r)
+ {
+ struct sas_phy_linkrates _r;
+@@ -894,6 +895,9 @@ static void hisi_sas_phy_set_linkrate(struct hisi_hba *hisi_hba, int phy_no,
+ struct asd_sas_phy *sas_phy = &phy->sas_phy;
+ enum sas_linkrate min, max;
+
++ if (r->minimum_linkrate > SAS_LINK_RATE_1_5_GBPS)
++ return -EINVAL;
++
+ if (r->maximum_linkrate == SAS_LINK_RATE_UNKNOWN) {
+ max = sas_phy->phy->maximum_linkrate;
+ min = r->minimum_linkrate;
+@@ -901,7 +905,7 @@ static void hisi_sas_phy_set_linkrate(struct hisi_hba *hisi_hba, int phy_no,
+ max = r->maximum_linkrate;
+ min = sas_phy->phy->minimum_linkrate;
+ } else
+- return;
++ return -EINVAL;
+
+ _r.maximum_linkrate = max;
+ _r.minimum_linkrate = min;
+@@ -913,6 +917,8 @@ static void hisi_sas_phy_set_linkrate(struct hisi_hba *hisi_hba, int phy_no,
+ msleep(100);
+ hisi_hba->hw->phy_set_linkrate(hisi_hba, phy_no, &_r);
+ hisi_hba->hw->phy_start(hisi_hba, phy_no);
++
++ return 0;
+ }
+
+ static int hisi_sas_control_phy(struct asd_sas_phy *sas_phy, enum phy_func func,
+@@ -938,8 +944,7 @@ static int hisi_sas_control_phy(struct asd_sas_phy *sas_phy, enum phy_func func,
+ break;
+
+ case PHY_FUNC_SET_LINK_RATE:
+- hisi_sas_phy_set_linkrate(hisi_hba, phy_no, funcdata);
+- break;
++ return hisi_sas_phy_set_linkrate(hisi_hba, phy_no, funcdata);
+ case PHY_FUNC_GET_EVENTS:
+ if (hisi_hba->hw->get_events) {
+ hisi_hba->hw->get_events(hisi_hba, phy_no);
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+index 410eccf0bc5e..8aa3222fe486 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+@@ -834,7 +834,7 @@ static void phys_init_v1_hw(struct hisi_hba *hisi_hba)
+ mod_timer(timer, jiffies + HZ);
+ }
+
+-static void sl_notify_v1_hw(struct hisi_hba *hisi_hba, int phy_no)
++static void sl_notify_ssp_v1_hw(struct hisi_hba *hisi_hba, int phy_no)
+ {
+ u32 sl_control;
+
+@@ -1822,7 +1822,7 @@ static struct scsi_host_template sht_v1_hw = {
+ static const struct hisi_sas_hw hisi_sas_v1_hw = {
+ .hw_init = hisi_sas_v1_init,
+ .setup_itct = setup_itct_v1_hw,
+- .sl_notify = sl_notify_v1_hw,
++ .sl_notify_ssp = sl_notify_ssp_v1_hw,
+ .clear_itct = clear_itct_v1_hw,
+ .prep_smp = prep_smp_v1_hw,
+ .prep_ssp = prep_ssp_v1_hw,
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+index c4774d63d5d0..ebc984ffe6a2 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+@@ -1584,7 +1584,7 @@ static void phys_init_v2_hw(struct hisi_hba *hisi_hba)
+ }
+ }
+
+-static void sl_notify_v2_hw(struct hisi_hba *hisi_hba, int phy_no)
++static void sl_notify_ssp_v2_hw(struct hisi_hba *hisi_hba, int phy_no)
+ {
+ u32 sl_control;
+
+@@ -3575,7 +3575,7 @@ static const struct hisi_sas_hw hisi_sas_v2_hw = {
+ .setup_itct = setup_itct_v2_hw,
+ .slot_index_alloc = slot_index_alloc_quirk_v2_hw,
+ .alloc_dev = alloc_dev_quirk_v2_hw,
+- .sl_notify = sl_notify_v2_hw,
++ .sl_notify_ssp = sl_notify_ssp_v2_hw,
+ .get_wideport_bitmap = get_wideport_bitmap_v2_hw,
+ .clear_itct = clear_itct_v2_hw,
+ .free_device = free_device_v2_hw,
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index a7407d5376ba..ce2f232b3df3 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -827,7 +827,7 @@ static void phys_init_v3_hw(struct hisi_hba *hisi_hba)
+ }
+ }
+
+-static void sl_notify_v3_hw(struct hisi_hba *hisi_hba, int phy_no)
++static void sl_notify_ssp_v3_hw(struct hisi_hba *hisi_hba, int phy_no)
+ {
+ u32 sl_control;
+
+@@ -2127,7 +2127,7 @@ static const struct hisi_sas_hw hisi_sas_v3_hw = {
+ .get_wideport_bitmap = get_wideport_bitmap_v3_hw,
+ .complete_hdr_size = sizeof(struct hisi_sas_complete_v3_hdr),
+ .clear_itct = clear_itct_v3_hw,
+- .sl_notify = sl_notify_v3_hw,
++ .sl_notify_ssp = sl_notify_ssp_v3_hw,
+ .prep_ssp = prep_ssp_v3_hw,
+ .prep_smp = prep_smp_v3_hw,
+ .prep_stp = prep_ata_v3_hw,
+diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
+index a62e85cb62eb..706aca3f7c25 100644
+--- a/drivers/scsi/lpfc/lpfc.h
++++ b/drivers/scsi/lpfc/lpfc.h
+@@ -966,7 +966,8 @@ struct lpfc_hba {
+ struct list_head port_list;
+ struct lpfc_vport *pport; /* physical lpfc_vport pointer */
+ uint16_t max_vpi; /* Maximum virtual nports */
+-#define LPFC_MAX_VPI 0xFFFF /* Max number of VPI supported */
++#define LPFC_MAX_VPI 0xFF /* Max number VPI supported 0 - 0xff */
++#define LPFC_MAX_VPORTS 0x100 /* Max vports per port, with pport */
+ uint16_t max_vports; /*
+ * For IOV HBAs max_vpi can change
+ * after a reset. max_vports is max
+diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
+index 3f69a5e4e470..fe084d47ed9e 100644
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -1632,6 +1632,9 @@ lpfc_get_hba_info(struct lpfc_hba *phba,
+ max_vpi = (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) > 0) ?
+ (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) - 1) : 0;
+
++ /* Limit the max we support */
++ if (max_vpi > LPFC_MAX_VPI)
++ max_vpi = LPFC_MAX_VPI;
+ if (mvpi)
+ *mvpi = max_vpi;
+ if (avpi)
+@@ -1647,8 +1650,13 @@ lpfc_get_hba_info(struct lpfc_hba *phba,
+ *axri = pmb->un.varRdConfig.avail_xri;
+ if (mvpi)
+ *mvpi = pmb->un.varRdConfig.max_vpi;
+- if (avpi)
+- *avpi = pmb->un.varRdConfig.avail_vpi;
++ if (avpi) {
++ /* avail_vpi is only valid if link is up and ready */
++ if (phba->link_state == LPFC_HBA_READY)
++ *avpi = pmb->un.varRdConfig.avail_vpi;
++ else
++ *avpi = pmb->un.varRdConfig.max_vpi;
++ }
+ }
+
+ mempool_free(pmboxq, phba->mbox_mem_pool);
+@@ -3841,8 +3849,9 @@ lpfc_topology_store(struct device *dev, struct device_attribute *attr,
+ val);
+ return -EINVAL;
+ }
+- if (phba->pcidev->device == PCI_DEVICE_ID_LANCER_G6_FC &&
+- val == 4) {
++ if ((phba->pcidev->device == PCI_DEVICE_ID_LANCER_G6_FC ||
++ phba->pcidev->device == PCI_DEVICE_ID_LANCER_G7_FC) &&
++ val == 4) {
+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT,
+ "3114 Loop mode not supported\n");
+ return -EINVAL;
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index da63c026ba46..57510a831735 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -7766,6 +7766,9 @@ lpfc_sli4_read_config(struct lpfc_hba *phba)
+ bf_get(lpfc_mbx_rd_conf_xri_base, rd_config);
+ phba->sli4_hba.max_cfg_param.max_vpi =
+ bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config);
++ /* Limit the max we support */
++ if (phba->sli4_hba.max_cfg_param.max_vpi > LPFC_MAX_VPORTS)
++ phba->sli4_hba.max_cfg_param.max_vpi = LPFC_MAX_VPORTS;
+ phba->sli4_hba.max_cfg_param.vpi_base =
+ bf_get(lpfc_mbx_rd_conf_vpi_base, rd_config);
+ phba->sli4_hba.max_cfg_param.max_rpi =
+diff --git a/drivers/scsi/lpfc/lpfc_mbox.c b/drivers/scsi/lpfc/lpfc_mbox.c
+index deb094fdbb79..e6bf5e8bc767 100644
+--- a/drivers/scsi/lpfc/lpfc_mbox.c
++++ b/drivers/scsi/lpfc/lpfc_mbox.c
+@@ -513,9 +513,9 @@ lpfc_init_link(struct lpfc_hba * phba,
+ break;
+ }
+
+- if (phba->pcidev->device == PCI_DEVICE_ID_LANCER_G6_FC &&
+- mb->un.varInitLnk.link_flags & FLAGS_TOPOLOGY_MODE_LOOP) {
+- /* Failover is not tried for Lancer G6 */
++ if ((phba->pcidev->device == PCI_DEVICE_ID_LANCER_G6_FC ||
++ phba->pcidev->device == PCI_DEVICE_ID_LANCER_G7_FC) &&
++ mb->un.varInitLnk.link_flags & FLAGS_TOPOLOGY_MODE_LOOP) {
+ mb->un.varInitLnk.link_flags = FLAGS_TOPOLOGY_MODE_PT_PT;
+ phba->cfg_topology = FLAGS_TOPOLOGY_MODE_PT_PT;
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index 8ee585e453dc..f73726e55e44 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -1856,7 +1856,6 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport,
+ bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG);
+
+ /* word 7 */
+- bf_set(wqe_ct, &abts_wqe->abort_cmd.wqe_com, 0);
+ bf_set(wqe_cmnd, &abts_wqe->abort_cmd.wqe_com, CMD_ABORT_XRI_CX);
+ bf_set(wqe_class, &abts_wqe->abort_cmd.wqe_com,
+ nvmereq_wqe->iocb.ulpClass);
+@@ -1871,7 +1870,6 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport,
+ abts_buf->iotag);
+
+ /* word 10 */
+- bf_set(wqe_wqid, &abts_wqe->abort_cmd.wqe_com, nvmereq_wqe->hba_wqidx);
+ bf_set(wqe_qosd, &abts_wqe->abort_cmd.wqe_com, 1);
+ bf_set(wqe_lenloc, &abts_wqe->abort_cmd.wqe_com, LPFC_WQE_LENLOC_NONE);
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 755803ff6cfe..f459fd62e493 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -10989,19 +10989,12 @@ lpfc_sli4_abort_nvme_io(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
+
+ /* Complete prepping the abort wqe and issue to the FW. */
+ abts_wqe = &abtsiocbp->wqe;
+- bf_set(abort_cmd_ia, &abts_wqe->abort_cmd, 0);
+- bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG);
+-
+- /* Explicitly set reserved fields to zero.*/
+- abts_wqe->abort_cmd.rsrvd4 = 0;
+- abts_wqe->abort_cmd.rsrvd5 = 0;
+
+- /* WQE Common - word 6. Context is XRI tag. Set 0. */
+- bf_set(wqe_xri_tag, &abts_wqe->abort_cmd.wqe_com, 0);
+- bf_set(wqe_ctxt_tag, &abts_wqe->abort_cmd.wqe_com, 0);
++ /* Clear any stale WQE contents */
++ memset(abts_wqe, 0, sizeof(union lpfc_wqe));
++ bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG);
+
+ /* word 7 */
+- bf_set(wqe_ct, &abts_wqe->abort_cmd.wqe_com, 0);
+ bf_set(wqe_cmnd, &abts_wqe->abort_cmd.wqe_com, CMD_ABORT_XRI_CX);
+ bf_set(wqe_class, &abts_wqe->abort_cmd.wqe_com,
+ cmdiocb->iocb.ulpClass);
+@@ -11016,7 +11009,6 @@ lpfc_sli4_abort_nvme_io(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
+ abtsiocbp->iotag);
+
+ /* word 10 */
+- bf_set(wqe_wqid, &abts_wqe->abort_cmd.wqe_com, cmdiocb->hba_wqidx);
+ bf_set(wqe_qosd, &abts_wqe->abort_cmd.wqe_com, 1);
+ bf_set(wqe_lenloc, &abts_wqe->abort_cmd.wqe_com, LPFC_WQE_LENLOC_NONE);
+
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index 3e9c49b3184f..b008d583dd6e 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -655,7 +655,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj,
+ break;
+ } else {
+ /* Make sure FC side is not in reset */
+- qla2x00_wait_for_hba_online(vha);
++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(vha) !=
++ QLA_SUCCESS);
+
+ /* Issue MPI reset */
+ scsi_block_requests(vha->host);
+diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
+index 85b03a7f473c..47f062e96e62 100644
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -342,6 +342,8 @@ qla2x00_process_els(struct bsg_job *bsg_job)
+ dma_map_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list,
+ bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE);
+ if (!req_sg_cnt) {
++ dma_unmap_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list,
++ bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE);
+ rval = -ENOMEM;
+ goto done_free_fcport;
+ }
+@@ -349,6 +351,8 @@ qla2x00_process_els(struct bsg_job *bsg_job)
+ rsp_sg_cnt = dma_map_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list,
+ bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
+ if (!rsp_sg_cnt) {
++ dma_unmap_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list,
++ bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
+ rval = -ENOMEM;
+ goto done_free_fcport;
+ }
+@@ -1775,8 +1779,8 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job)
+ uint16_t nextlid = 0;
+ uint32_t tot_dsds;
+ srb_t *sp = NULL;
+- uint32_t req_data_len = 0;
+- uint32_t rsp_data_len = 0;
++ uint32_t req_data_len;
++ uint32_t rsp_data_len;
+
+ /* Check the type of the adapter */
+ if (!IS_BIDI_CAPABLE(ha)) {
+@@ -1881,6 +1885,9 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job)
+ goto done_unmap_sg;
+ }
+
++ req_data_len = bsg_job->request_payload.payload_len;
++ rsp_data_len = bsg_job->reply_payload.payload_len;
++
+ if (req_data_len != rsp_data_len) {
+ rval = EXT_STATUS_BUSY;
+ ql_log(ql_log_warn, vha, 0x70aa,
+@@ -1888,10 +1895,6 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job)
+ goto done_unmap_sg;
+ }
+
+- req_data_len = bsg_job->request_payload.payload_len;
+- rsp_data_len = bsg_job->reply_payload.payload_len;
+-
+-
+ /* Alloc SRB structure */
+ sp = qla2x00_get_sp(vha, &(vha->bidir_fcport), GFP_KERNEL);
+ if (!sp) {
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index b8d3403c3c85..f621cb55ccfb 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3264,7 +3264,7 @@ static void qla24xx_async_gpsc_sp_done(void *s, int res)
+ fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+
+ if (res == QLA_FUNCTION_TIMEOUT)
+- return;
++ goto done;
+
+ if (res == (DID_ERROR << 16)) {
+ /* entry status error */
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index f7dd289779b1..d734dcf517b9 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -291,9 +291,6 @@ qla2x00_async_logout(struct scsi_qla_host *vha, fc_port_t *fcport)
+ struct srb_iocb *lio;
+ int rval = QLA_FUNCTION_FAILED;
+
+- if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT))
+- return rval;
+-
+ fcport->flags |= FCF_ASYNC_SENT;
+ sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
+ if (!sp)
+@@ -436,6 +433,7 @@ int qla_post_els_plogi_work(struct scsi_qla_host *vha, fc_port_t *fcport)
+
+ e->u.fcport.fcport = fcport;
+ fcport->flags |= FCF_ASYNC_ACTIVE;
++ fcport->disc_state = DSC_LOGIN_PEND;
+ return qla2x00_post_work(vha, e);
+ }
+
+@@ -985,13 +983,11 @@ void qla24xx_async_gpdb_sp_done(void *s, int res)
+ "Async done-%s res %x, WWPN %8phC mb[1]=%x mb[2]=%x \n",
+ sp->name, res, fcport->port_name, mb[1], mb[2]);
+
+- if (res == QLA_FUNCTION_TIMEOUT) {
+- dma_pool_free(sp->vha->hw->s_dma_pool, sp->u.iocb_cmd.u.mbx.in,
+- sp->u.iocb_cmd.u.mbx.in_dma);
+- return;
+- }
+-
+ fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
++
++ if (res == QLA_FUNCTION_TIMEOUT)
++ goto done;
++
+ memset(&ea, 0, sizeof(ea));
+ ea.event = FCME_GPDB_DONE;
+ ea.fcport = fcport;
+@@ -999,6 +995,7 @@ void qla24xx_async_gpdb_sp_done(void *s, int res)
+
+ qla2x00_fcport_event_handler(vha, &ea);
+
++done:
+ dma_pool_free(ha->s_dma_pool, sp->u.iocb_cmd.u.mbx.in,
+ sp->u.iocb_cmd.u.mbx.in_dma);
+
+@@ -8725,8 +8722,6 @@ int qla2xxx_delete_qpair(struct scsi_qla_host *vha, struct qla_qpair *qpair)
+ struct qla_hw_data *ha = qpair->hw;
+
+ qpair->delete_in_progress = 1;
+- while (atomic_read(&qpair->ref_count))
+- msleep(500);
+
+ ret = qla25xx_delete_req_que(vha, qpair->req);
+ if (ret != QLA_SUCCESS)
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 8fa7242dbb43..afe15b3e45fb 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -3418,10 +3418,8 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
+ ha->msix_count, ret);
+ goto msix_out;
+ } else if (ret < ha->msix_count) {
+- ql_log(ql_log_warn, vha, 0x00c6,
+- "MSI-X: Failed to enable support "
+- "with %d vectors, using %d vectors.\n",
+- ha->msix_count, ret);
++ ql_log(ql_log_info, vha, 0x00c6,
++ "MSI-X: Using %d vectors\n", ret);
+ ha->msix_count = ret;
+ /* Recalculate queue values */
+ if (ha->mqiobase && (ql2xmqsupport || ql2xnvmeenable)) {
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 128fcff24f1b..b01f69dd4b28 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -6131,17 +6131,13 @@ int qla24xx_send_mb_cmd(struct scsi_qla_host *vha, mbx_cmd_t *mcp)
+ case QLA_SUCCESS:
+ ql_dbg(ql_dbg_mbx, vha, 0x119d, "%s: %s done.\n",
+ __func__, sp->name);
+- sp->free(sp);
+ break;
+ default:
+ ql_dbg(ql_dbg_mbx, vha, 0x119e, "%s: %s Failed. %x.\n",
+ __func__, sp->name, rval);
+- sp->free(sp);
+ break;
+ }
+
+- return rval;
+-
+ done_free_sp:
+ sp->free(sp);
+ done:
+diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
+index d620f4bebcd0..516fccdbcebd 100644
+--- a/drivers/scsi/qla2xxx/qla_mid.c
++++ b/drivers/scsi/qla2xxx/qla_mid.c
+@@ -931,7 +931,7 @@ int qla24xx_control_vp(scsi_qla_host_t *vha, int cmd)
+
+ sp = qla2x00_get_sp(base_vha, NULL, GFP_KERNEL);
+ if (!sp)
+- goto done;
++ return rval;
+
+ sp->type = SRB_CTRL_VP;
+ sp->name = "ctrl_vp";
+@@ -946,7 +946,7 @@ int qla24xx_control_vp(scsi_qla_host_t *vha, int cmd)
+ ql_dbg(ql_dbg_async, vha, 0xffff,
+ "%s: %s Failed submission. %x.\n",
+ __func__, sp->name, rval);
+- goto done_free_sp;
++ goto done;
+ }
+
+ ql_dbg(ql_dbg_vport, vha, 0x113f, "%s hndl %x submitted\n",
+@@ -962,16 +962,13 @@ int qla24xx_control_vp(scsi_qla_host_t *vha, int cmd)
+ case QLA_SUCCESS:
+ ql_dbg(ql_dbg_vport, vha, 0xffff, "%s: %s done.\n",
+ __func__, sp->name);
+- goto done_free_sp;
++ break;
+ default:
+ ql_dbg(ql_dbg_vport, vha, 0xffff, "%s: %s Failed. %x.\n",
+ __func__, sp->name, rval);
+- goto done_free_sp;
++ break;
+ }
+ done:
+- return rval;
+-
+-done_free_sp:
+ sp->free(sp);
+ return rval;
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 183bfda8f5d1..bb20a4a228cf 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1029,7 +1029,7 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd,
+ ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x3078,
+ "Start scsi failed rval=%d for cmd=%p.\n", rval, cmd);
+ if (rval == QLA_INTERFACE_ERROR)
+- goto qc24_fail_command;
++ goto qc24_free_sp_fail_command;
+ goto qc24_host_busy_free_sp;
+ }
+
+@@ -1044,6 +1044,11 @@ qc24_host_busy:
+ qc24_target_busy:
+ return SCSI_MLQUEUE_TARGET_BUSY;
+
++qc24_free_sp_fail_command:
++ sp->free(sp);
++ CMD_SP(cmd) = NULL;
++ qla2xxx_rel_qpair_sp(sp->qpair, sp);
++
+ qc24_fail_command:
+ cmd->scsi_done(cmd);
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 078d12453324..210ce294038d 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -6062,7 +6062,6 @@ static void qlt_abort_work(struct qla_tgt *tgt,
+ struct qla_hw_data *ha = vha->hw;
+ struct fc_port *sess = NULL;
+ unsigned long flags = 0, flags2 = 0;
+- uint32_t be_s_id;
+ uint8_t s_id[3];
+ int rc;
+
+@@ -6075,8 +6074,7 @@ static void qlt_abort_work(struct qla_tgt *tgt,
+ s_id[1] = prm->abts.fcp_hdr_le.s_id[1];
+ s_id[2] = prm->abts.fcp_hdr_le.s_id[0];
+
+- sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha,
+- (unsigned char *)&be_s_id);
++ sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha, s_id);
+ if (!sess) {
+ spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
+
+@@ -6545,7 +6543,8 @@ qlt_enable_vha(struct scsi_qla_host *vha)
+ } else {
+ set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags);
+ qla2xxx_wake_dpc(base_vha);
+- qla2x00_wait_for_hba_online(base_vha);
++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(base_vha) !=
++ QLA_SUCCESS);
+ }
+ }
+ EXPORT_SYMBOL(qlt_enable_vha);
+@@ -6575,7 +6574,9 @@ static void qlt_disable_vha(struct scsi_qla_host *vha)
+
+ set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+ qla2xxx_wake_dpc(vha);
+- qla2x00_wait_for_hba_online(vha);
++ if (qla2x00_wait_for_hba_online(vha) != QLA_SUCCESS)
++ ql_dbg(ql_dbg_tgt, vha, 0xe081,
++ "qla2x00_wait_for_hba_online() failed\n");
+ }
+
+ /*
+diff --git a/drivers/scsi/zorro_esp.c b/drivers/scsi/zorro_esp.c
+index be79127db594..6a5b547eae59 100644
+--- a/drivers/scsi/zorro_esp.c
++++ b/drivers/scsi/zorro_esp.c
+@@ -245,7 +245,14 @@ static int fastlane_esp_irq_pending(struct esp *esp)
+ static u32 zorro_esp_dma_length_limit(struct esp *esp, u32 dma_addr,
+ u32 dma_len)
+ {
+- return dma_len > 0xFFFF ? 0xFFFF : dma_len;
++ return dma_len > (1U << 16) ? (1U << 16) : dma_len;
++}
++
++static u32 fastlane_esp_dma_length_limit(struct esp *esp, u32 dma_addr,
++ u32 dma_len)
++{
++ /* The old driver used 0xfffc as limit, so do that here too */
++ return dma_len > 0xfffc ? 0xfffc : dma_len;
+ }
+
+ static void zorro_esp_reset_dma(struct esp *esp)
+@@ -818,7 +825,7 @@ static const struct esp_driver_ops fastlane_esp_ops = {
+ .unmap_single = zorro_esp_unmap_single,
+ .unmap_sg = zorro_esp_unmap_sg,
+ .irq_pending = fastlane_esp_irq_pending,
+- .dma_length_limit = zorro_esp_dma_length_limit,
++ .dma_length_limit = fastlane_esp_dma_length_limit,
+ .reset_dma = zorro_esp_reset_dma,
+ .dma_drain = zorro_esp_dma_drain,
+ .dma_invalidate = fastlane_esp_dma_invalidate,
+diff --git a/drivers/staging/erofs/xattr.c b/drivers/staging/erofs/xattr.c
+index 2db99cff3c99..d48687ca2199 100644
+--- a/drivers/staging/erofs/xattr.c
++++ b/drivers/staging/erofs/xattr.c
+@@ -638,6 +638,8 @@ ssize_t erofs_listxattr(struct dentry *dentry,
+ struct listxattr_iter it;
+
+ ret = init_inode_xattrs(d_inode(dentry));
++ if (ret == -ENOATTR)
++ return 0;
+ if (ret)
+ return ret;
+
+diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+index 8ef7b44b6abc..55952dd88359 100644
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -70,7 +70,7 @@ static struct dvobj_priv *usb_dvobj_init(struct usb_interface *usb_intf)
+ phost_conf = pusbd->actconfig;
+ pconf_desc = &phost_conf->desc;
+
+- phost_iface = &usb_intf->altsetting[0];
++ phost_iface = usb_intf->cur_altsetting;
+ piface_desc = &phost_iface->desc;
+
+ pdvobjpriv->NumInterfaces = pconf_desc->bNumInterfaces;
+diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
+index 85eadddfaf06..5e2cdc25401b 100644
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -275,7 +275,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter)
+
+ pdvobjpriv->padapter = padapter;
+ padapter->EepromAddressSize = 6;
+- phost_iface = &pintf->altsetting[0];
++ phost_iface = pintf->cur_altsetting;
+ piface_desc = &phost_iface->desc;
+ pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints;
+ if (pusbd->speed == USB_SPEED_HIGH) {
+diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c
+index 2754b4ce7136..60e292ce04f7 100644
+--- a/drivers/usb/atm/ueagle-atm.c
++++ b/drivers/usb/atm/ueagle-atm.c
+@@ -2168,10 +2168,11 @@ resubmit:
+ /*
+ * Start the modem : init the data and start kernel thread
+ */
+-static int uea_boot(struct uea_softc *sc)
++static int uea_boot(struct uea_softc *sc, struct usb_interface *intf)
+ {
+- int ret, size;
+ struct intr_pkt *intr;
++ int ret = -ENOMEM;
++ int size;
+
+ uea_enters(INS_TO_USBDEV(sc));
+
+@@ -2196,6 +2197,11 @@ static int uea_boot(struct uea_softc *sc)
+ if (UEA_CHIP_VERSION(sc) == ADI930)
+ load_XILINX_firmware(sc);
+
++ if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
++ ret = -ENODEV;
++ goto err0;
++ }
++
+ intr = kmalloc(size, GFP_KERNEL);
+ if (!intr)
+ goto err0;
+@@ -2207,8 +2213,7 @@ static int uea_boot(struct uea_softc *sc)
+ usb_fill_int_urb(sc->urb_int, sc->usb_dev,
+ usb_rcvintpipe(sc->usb_dev, UEA_INTR_PIPE),
+ intr, size, uea_intr, sc,
+- sc->usb_dev->actconfig->interface[0]->altsetting[0].
+- endpoint[0].desc.bInterval);
++ intf->cur_altsetting->endpoint[0].desc.bInterval);
+
+ ret = usb_submit_urb(sc->urb_int, GFP_KERNEL);
+ if (ret < 0) {
+@@ -2223,6 +2228,7 @@ static int uea_boot(struct uea_softc *sc)
+ sc->kthread = kthread_create(uea_kthread, sc, "ueagle-atm");
+ if (IS_ERR(sc->kthread)) {
+ uea_err(INS_TO_USBDEV(sc), "failed to create thread\n");
++ ret = PTR_ERR(sc->kthread);
+ goto err2;
+ }
+
+@@ -2237,7 +2243,7 @@ err1:
+ kfree(intr);
+ err0:
+ uea_leaves(INS_TO_USBDEV(sc));
+- return -ENOMEM;
++ return ret;
+ }
+
+ /*
+@@ -2598,7 +2604,7 @@ static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf,
+ if (ret < 0)
+ goto error;
+
+- ret = uea_boot(sc);
++ ret = uea_boot(sc, intf);
+ if (ret < 0)
+ goto error_rm_grp;
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index d5fbd36cf462..b33ec768404b 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5740,7 +5740,7 @@ re_enumerate_no_bos:
+
+ /**
+ * usb_reset_device - warn interface drivers and perform a USB port reset
+- * @udev: device to reset (not in SUSPENDED or NOTATTACHED state)
++ * @udev: device to reset (not in NOTATTACHED state)
+ *
+ * Warns all drivers bound to registered interfaces (using their pre_reset
+ * method), performs the port reset, and then lets the drivers know that
+@@ -5768,8 +5768,7 @@ int usb_reset_device(struct usb_device *udev)
+ struct usb_host_config *config = udev->actconfig;
+ struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent);
+
+- if (udev->state == USB_STATE_NOTATTACHED ||
+- udev->state == USB_STATE_SUSPENDED) {
++ if (udev->state == USB_STATE_NOTATTACHED) {
+ dev_dbg(&udev->dev, "device reset not allowed in state %d\n",
+ udev->state);
+ return -EINVAL;
+diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
+index f51750bcd152..5e844097a9e3 100644
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -45,6 +45,7 @@ void usb_init_urb(struct urb *urb)
+ if (urb) {
+ memset(urb, 0, sizeof(*urb));
+ kref_init(&urb->kref);
++ INIT_LIST_HEAD(&urb->urb_list);
+ INIT_LIST_HEAD(&urb->anchor_list);
+ }
+ }
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index b4e42d597211..8fa39e664940 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -29,7 +29,8 @@
+ #define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa
+ #define PCI_DEVICE_ID_INTEL_APL 0x5aaa
+ #define PCI_DEVICE_ID_INTEL_KBP 0xa2b0
+-#define PCI_DEVICE_ID_INTEL_CMLH 0x02ee
++#define PCI_DEVICE_ID_INTEL_CMLLP 0x02ee
++#define PCI_DEVICE_ID_INTEL_CMLH 0x06ee
+ #define PCI_DEVICE_ID_INTEL_GLK 0x31aa
+ #define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee
+ #define PCI_DEVICE_ID_INTEL_CNPH 0xa36e
+@@ -306,6 +307,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MRFLD),
+ (kernel_ulong_t) &dwc3_pci_mrfld_properties, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLLP),
++ (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLH),
+ (kernel_ulong_t) &dwc3_pci_intel_properties, },
+
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index 8efde178eef4..2fb02f877401 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -1110,6 +1110,9 @@ static void dwc3_ep0_xfernotready(struct dwc3 *dwc,
+ void dwc3_ep0_interrupt(struct dwc3 *dwc,
+ const struct dwc3_event_depevt *event)
+ {
++ struct dwc3_ep *dep = dwc->eps[event->endpoint_number];
++ u8 cmd;
++
+ switch (event->endpoint_event) {
+ case DWC3_DEPEVT_XFERCOMPLETE:
+ dwc3_ep0_xfer_complete(dwc, event);
+@@ -1122,7 +1125,12 @@ void dwc3_ep0_interrupt(struct dwc3 *dwc,
+ case DWC3_DEPEVT_XFERINPROGRESS:
+ case DWC3_DEPEVT_RXTXFIFOEVT:
+ case DWC3_DEPEVT_STREAMEVT:
++ break;
+ case DWC3_DEPEVT_EPCMDCMPLT:
++ cmd = DEPEVT_PARAMETER_CMD(event->parameters);
++
++ if (cmd == DWC3_DEPCMD_ENDTRANSFER)
++ dep->flags &= ~DWC3_EP_TRANSFER_STARTED;
+ break;
+ }
+ }
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 3e04004b4f1b..3a24230bb89a 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2295,7 +2295,7 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+
+ req->request.actual = req->request.length - req->remaining;
+
+- if (!dwc3_gadget_ep_request_completed(req) &&
++ if (!dwc3_gadget_ep_request_completed(req) ||
+ req->num_pending_sgs) {
+ __dwc3_gadget_kick_transfer(dep);
+ goto out;
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 33852c2b29d1..ab9ac48a751a 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1544,6 +1544,7 @@ static struct config_group *gadgets_make(
+ gi->composite.resume = NULL;
+ gi->composite.max_speed = USB_SPEED_SUPER;
+
++ spin_lock_init(&gi->spinlock);
+ mutex_init(&gi->lock);
+ INIT_LIST_HEAD(&gi->string_list);
+ INIT_LIST_HEAD(&gi->available_func);
+diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
+index afaea11ec771..991184b8bb41 100644
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -1520,7 +1520,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
+ td = phys_to_virt(addr);
+ addr2 = (dma_addr_t)td->next;
+ dma_pool_free(dev->data_requests, td, addr);
+- td->next = 0x00;
+ addr = addr2;
+ }
+ req->chain_len = 1;
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 333f9202ec8b..02843c16f9c7 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -831,7 +831,7 @@ static u32 xhci_get_ext_port_status(u32 raw_port_status, u32 port_li)
+ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ struct xhci_bus_state *bus_state,
+ u16 wIndex, u32 raw_port_status,
+- unsigned long flags)
++ unsigned long *flags)
+ __releases(&xhci->lock)
+ __acquires(&xhci->lock)
+ {
+@@ -917,12 +917,12 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ xhci_test_and_clear_bit(xhci, port, PORT_PLC);
+ xhci_set_link_state(xhci, port, XDEV_U0);
+
+- spin_unlock_irqrestore(&xhci->lock, flags);
++ spin_unlock_irqrestore(&xhci->lock, *flags);
+ time_left = wait_for_completion_timeout(
+ &bus_state->rexit_done[wIndex],
+ msecs_to_jiffies(
+ XHCI_MAX_REXIT_TIMEOUT_MS));
+- spin_lock_irqsave(&xhci->lock, flags);
++ spin_lock_irqsave(&xhci->lock, *flags);
+
+ if (time_left) {
+ slot_id = xhci_find_slot_id_by_port(hcd,
+@@ -1076,7 +1076,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ }
+ trace_xhci_get_port_status(wIndex, temp);
+ status = xhci_get_port_status(hcd, bus_state, wIndex, temp,
+- flags);
++ &flags);
+ if (status == 0xffffffff)
+ goto error;
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index b1f27aa38b10..82ce6d8b708d 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1909,13 +1909,17 @@ no_bw:
+ xhci->usb3_rhub.num_ports = 0;
+ xhci->num_active_eps = 0;
+ kfree(xhci->usb2_rhub.ports);
++ kfree(xhci->usb2_rhub.psi);
+ kfree(xhci->usb3_rhub.ports);
++ kfree(xhci->usb3_rhub.psi);
+ kfree(xhci->hw_ports);
+ kfree(xhci->rh_bw);
+ kfree(xhci->ext_caps);
+
+ xhci->usb2_rhub.ports = NULL;
++ xhci->usb2_rhub.psi = NULL;
+ xhci->usb3_rhub.ports = NULL;
++ xhci->usb3_rhub.psi = NULL;
+ xhci->hw_ports = NULL;
+ xhci->rh_bw = NULL;
+ xhci->ext_caps = NULL;
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 1493d0fdf5ad..74aeaa61f5c6 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -495,6 +495,18 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
+ }
+ #endif /* CONFIG_PM */
+
++static void xhci_pci_shutdown(struct usb_hcd *hcd)
++{
++ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
++
++ xhci_shutdown(hcd);
++
++ /* Yet another workaround for spurious wakeups at shutdown with HSW */
++ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
++ pci_set_power_state(pdev, PCI_D3hot);
++}
++
+ /*-------------------------------------------------------------------------*/
+
+ /* PCI driver selection metadata; PCI hotplugging uses this */
+@@ -530,6 +542,7 @@ static int __init xhci_pci_init(void)
+ #ifdef CONFIG_PM
+ xhci_pci_hc_driver.pci_suspend = xhci_pci_suspend;
+ xhci_pci_hc_driver.pci_resume = xhci_pci_resume;
++ xhci_pci_hc_driver.shutdown = xhci_pci_shutdown;
+ #endif
+ return pci_register_driver(&xhci_pci_driver);
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 9d79824ab5b6..b03974958a28 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2330,7 +2330,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ case COMP_SUCCESS:
+ if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
+ break;
+- if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
++ if (xhci->quirks & XHCI_TRUST_TX_LENGTH ||
++ ep_ring->last_td_was_short)
+ trb_comp_code = COMP_SHORT_PACKET;
+ else
+ xhci_warn_ratelimited(xhci,
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 36865d50171f..65cc362717fc 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -769,7 +769,7 @@ static void xhci_stop(struct usb_hcd *hcd)
+ *
+ * This will only ever be called with the main usb_hcd (the USB3 roothub).
+ */
+-static void xhci_shutdown(struct usb_hcd *hcd)
++void xhci_shutdown(struct usb_hcd *hcd)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+
+@@ -788,11 +788,8 @@ static void xhci_shutdown(struct usb_hcd *hcd)
+ xhci_dbg_trace(xhci, trace_xhci_dbg_init,
+ "xhci_shutdown completed - status = %x",
+ readl(&xhci->op_regs->status));
+-
+- /* Yet another workaround for spurious wakeups at shutdown with HSW */
+- if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+- pci_set_power_state(to_pci_dev(hcd->self.sysdev), PCI_D3hot);
+ }
++EXPORT_SYMBOL_GPL(xhci_shutdown);
+
+ #ifdef CONFIG_PM
+ static void xhci_save_registers(struct xhci_hcd *xhci)
+@@ -963,7 +960,7 @@ static bool xhci_pending_portevent(struct xhci_hcd *xhci)
+ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
+ {
+ int rc = 0;
+- unsigned int delay = XHCI_MAX_HALT_USEC;
++ unsigned int delay = XHCI_MAX_HALT_USEC * 2;
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ u32 command;
+ u32 res;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 761b341d27b0..9b33031cf6fc 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -2052,6 +2052,7 @@ int xhci_start(struct xhci_hcd *xhci);
+ int xhci_reset(struct xhci_hcd *xhci);
+ int xhci_run(struct usb_hcd *hcd);
+ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks);
++void xhci_shutdown(struct usb_hcd *hcd);
+ void xhci_init_driver(struct hc_driver *drv,
+ const struct xhci_driver_overrides *over);
+ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id);
+diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
+index 9a51760df026..b8073f36ffdc 100644
+--- a/drivers/usb/misc/adutux.c
++++ b/drivers/usb/misc/adutux.c
+@@ -671,7 +671,7 @@ static int adu_probe(struct usb_interface *interface,
+ init_waitqueue_head(&dev->read_wait);
+ init_waitqueue_head(&dev->write_wait);
+
+- res = usb_find_common_endpoints_reverse(&interface->altsetting[0],
++ res = usb_find_common_endpoints_reverse(interface->cur_altsetting,
+ NULL, NULL,
+ &dev->interrupt_in_endpoint,
+ &dev->interrupt_out_endpoint);
+diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
+index 20b0f91a5d9b..bb24527f3c70 100644
+--- a/drivers/usb/misc/idmouse.c
++++ b/drivers/usb/misc/idmouse.c
+@@ -337,7 +337,7 @@ static int idmouse_probe(struct usb_interface *interface,
+ int result;
+
+ /* check if we have gotten the data or the hid interface */
+- iface_desc = &interface->altsetting[0];
++ iface_desc = interface->cur_altsetting;
+ if (iface_desc->desc.bInterfaceClass != 0x0A)
+ return -ENODEV;
+
+diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
+index ac2b4fcc265f..f48a23adbc35 100644
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -1039,12 +1039,18 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg
+
+ mutex_lock(&rp->fetch_lock);
+ spin_lock_irqsave(&rp->b_lock, flags);
+- mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE);
+- kfree(rp->b_vec);
+- rp->b_vec = vec;
+- rp->b_size = size;
+- rp->b_read = rp->b_in = rp->b_out = rp->b_cnt = 0;
+- rp->cnt_lost = 0;
++ if (rp->mmap_active) {
++ mon_free_buff(vec, size/CHUNK_SIZE);
++ kfree(vec);
++ ret = -EBUSY;
++ } else {
++ mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE);
++ kfree(rp->b_vec);
++ rp->b_vec = vec;
++ rp->b_size = size;
++ rp->b_read = rp->b_in = rp->b_out = rp->b_cnt = 0;
++ rp->cnt_lost = 0;
++ }
+ spin_unlock_irqrestore(&rp->b_lock, flags);
+ mutex_unlock(&rp->fetch_lock);
+ }
+@@ -1216,13 +1222,21 @@ mon_bin_poll(struct file *file, struct poll_table_struct *wait)
+ static void mon_bin_vma_open(struct vm_area_struct *vma)
+ {
+ struct mon_reader_bin *rp = vma->vm_private_data;
++ unsigned long flags;
++
++ spin_lock_irqsave(&rp->b_lock, flags);
+ rp->mmap_active++;
++ spin_unlock_irqrestore(&rp->b_lock, flags);
+ }
+
+ static void mon_bin_vma_close(struct vm_area_struct *vma)
+ {
++ unsigned long flags;
++
+ struct mon_reader_bin *rp = vma->vm_private_data;
++ spin_lock_irqsave(&rp->b_lock, flags);
+ rp->mmap_active--;
++ spin_unlock_irqrestore(&rp->b_lock, flags);
+ }
+
+ /*
+@@ -1234,16 +1248,12 @@ static vm_fault_t mon_bin_vma_fault(struct vm_fault *vmf)
+ unsigned long offset, chunk_idx;
+ struct page *pageptr;
+
+- mutex_lock(&rp->fetch_lock);
+ offset = vmf->pgoff << PAGE_SHIFT;
+- if (offset >= rp->b_size) {
+- mutex_unlock(&rp->fetch_lock);
++ if (offset >= rp->b_size)
+ return VM_FAULT_SIGBUS;
+- }
+ chunk_idx = offset / CHUNK_SIZE;
+ pageptr = rp->b_vec[chunk_idx].pg;
+ get_page(pageptr);
+- mutex_unlock(&rp->fetch_lock);
+ vmf->page = pageptr;
+ return 0;
+ }
+diff --git a/drivers/usb/roles/class.c b/drivers/usb/roles/class.c
+index 99116af07f1d..1dd492e89719 100644
+--- a/drivers/usb/roles/class.c
++++ b/drivers/usb/roles/class.c
+@@ -130,8 +130,8 @@ EXPORT_SYMBOL_GPL(usb_role_switch_get);
+ void usb_role_switch_put(struct usb_role_switch *sw)
+ {
+ if (!IS_ERR_OR_NULL(sw)) {
+- put_device(&sw->dev);
+ module_put(sw->dev.parent->driver->owner);
++ put_device(&sw->dev);
+ }
+ }
+ EXPORT_SYMBOL_GPL(usb_role_switch_put);
+diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
+index 97c69d373ca6..97eb738b058f 100644
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -2919,16 +2919,18 @@ static int edge_startup(struct usb_serial *serial)
+ response = 0;
+
+ if (edge_serial->is_epic) {
++ struct usb_host_interface *alt;
++
++ alt = serial->interface->cur_altsetting;
++
+ /* EPIC thing, set up our interrupt polling now and our read
+ * urb, so that the device knows it really is connected. */
+ interrupt_in_found = bulk_in_found = bulk_out_found = false;
+- for (i = 0; i < serial->interface->altsetting[0]
+- .desc.bNumEndpoints; ++i) {
++ for (i = 0; i < alt->desc.bNumEndpoints; ++i) {
+ struct usb_endpoint_descriptor *endpoint;
+ int buffer_size;
+
+- endpoint = &serial->interface->altsetting[0].
+- endpoint[i].desc;
++ endpoint = &alt->endpoint[i].desc;
+ buffer_size = usb_endpoint_maxp(endpoint);
+ if (!interrupt_in_found &&
+ (usb_endpoint_is_int_in(endpoint))) {
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index bad391da4b8e..1c6eb3a8741e 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -832,6 +832,10 @@ static int uas_slave_configure(struct scsi_device *sdev)
+ sdev->wce_default_on = 1;
+ }
+
++ /* Some disks cannot handle READ_CAPACITY_16 */
++ if (devinfo->flags & US_FL_NO_READ_CAPACITY_16)
++ sdev->no_read_capacity_16 = 1;
++
+ /*
+ * Some disks return the total number of blocks in response
+ * to READ CAPACITY rather than the highest block number.
+@@ -840,6 +844,12 @@ static int uas_slave_configure(struct scsi_device *sdev)
+ if (devinfo->flags & US_FL_FIX_CAPACITY)
+ sdev->fix_capacity = 1;
+
++ /*
++ * in some cases we have to guess
++ */
++ if (devinfo->flags & US_FL_CAPACITY_HEURISTICS)
++ sdev->guess_capacity = 1;
++
+ /*
+ * Some devices don't like MODE SENSE with page=0x3f,
+ * which is the command used for checking if a device
+diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
+index 00141e05bc72..1916ee1600b4 100644
+--- a/drivers/usb/typec/class.c
++++ b/drivers/usb/typec/class.c
+@@ -1589,14 +1589,16 @@ struct typec_port *typec_register_port(struct device *parent,
+
+ port->sw = typec_switch_get(&port->dev);
+ if (IS_ERR(port->sw)) {
++ ret = PTR_ERR(port->sw);
+ put_device(&port->dev);
+- return ERR_CAST(port->sw);
++ return ERR_PTR(ret);
+ }
+
+ port->mux = typec_mux_get(&port->dev, "typec-mux");
+ if (IS_ERR(port->mux)) {
++ ret = PTR_ERR(port->mux);
+ put_device(&port->dev);
+- return ERR_CAST(port->mux);
++ return ERR_PTR(ret);
+ }
+
+ ret = device_add(&port->dev);
+diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c
+index 8a3e8f61b991..164564b45b66 100644
+--- a/drivers/video/hdmi.c
++++ b/drivers/video/hdmi.c
+@@ -1039,12 +1039,12 @@ static int hdmi_avi_infoframe_unpack(struct hdmi_avi_infoframe *frame,
+ if (ptr[0] & 0x10)
+ frame->active_aspect = ptr[1] & 0xf;
+ if (ptr[0] & 0x8) {
+- frame->top_bar = (ptr[5] << 8) + ptr[6];
+- frame->bottom_bar = (ptr[7] << 8) + ptr[8];
++ frame->top_bar = (ptr[6] << 8) | ptr[5];
++ frame->bottom_bar = (ptr[8] << 8) | ptr[7];
+ }
+ if (ptr[0] & 0x4) {
+- frame->left_bar = (ptr[9] << 8) + ptr[10];
+- frame->right_bar = (ptr[11] << 8) + ptr[12];
++ frame->left_bar = (ptr[10] << 8) | ptr[9];
++ frame->right_bar = (ptr[12] << 8) | ptr[11];
+ }
+ frame->scan_mode = ptr[0] & 0x3;
+
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index d1c1f6283729..14ac36ca8fbd 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -468,6 +468,17 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info,
+
+ get_page(newpage); /* balloon reference */
+
++ /*
++ * When we migrate a page to a different zone and adjusted the
++ * managed page count when inflating, we have to fixup the count of
++ * both involved zones.
++ */
++ if (!virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM) &&
++ page_zone(page) != page_zone(newpage)) {
++ adjust_managed_page_count(page, 1);
++ adjust_managed_page_count(newpage, -1);
++ }
++
+ /* balloon's page migration 1st step -- inflate "newpage" */
+ spin_lock_irqsave(&vb_dev_info->pages_lock, flags);
+ balloon_page_insert(vb_dev_info, newpage);
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 3a144eecb6a7..d7438fdc5706 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -504,8 +504,10 @@ static int __write_ring(struct pvcalls_data_intf *intf,
+ virt_mb();
+
+ size = pvcalls_queued(prod, cons, array_size);
+- if (size >= array_size)
++ if (size > array_size)
+ return -EINVAL;
++ if (size == array_size)
++ return 0;
+ if (len > array_size - size)
+ len = array_size - size;
+
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index f51b509f2d9b..e9522f2f25cc 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -1939,12 +1939,19 @@ void btrfs_kill_all_delayed_nodes(struct btrfs_root *root)
+ }
+
+ inode_id = delayed_nodes[n - 1]->inode_id + 1;
+-
+- for (i = 0; i < n; i++)
+- refcount_inc(&delayed_nodes[i]->refs);
++ for (i = 0; i < n; i++) {
++ /*
++ * Don't increase refs in case the node is dead and
++ * about to be removed from the tree in the loop below
++ */
++ if (!refcount_inc_not_zero(&delayed_nodes[i]->refs))
++ delayed_nodes[i] = NULL;
++ }
+ spin_unlock(&root->inode_lock);
+
+ for (i = 0; i < n; i++) {
++ if (!delayed_nodes[i])
++ continue;
+ __btrfs_kill_delayed_node(delayed_nodes[i]);
+ btrfs_release_delayed_node(delayed_nodes[i]);
+ }
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index cb598eb4f3bd..88fc5a0c573f 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -3956,7 +3956,7 @@ retry:
+ for (i = 0; i < nr_pages; i++) {
+ struct page *page = pvec.pages[i];
+
+- done_index = page->index;
++ done_index = page->index + 1;
+ /*
+ * At this point we hold neither the i_pages lock nor
+ * the page lock: the page may be truncated or
+@@ -3993,16 +3993,6 @@ retry:
+ ret = 0;
+ }
+ if (ret < 0) {
+- /*
+- * done_index is set past this page,
+- * so media errors will not choke
+- * background writeout for the entire
+- * file. This has consequences for
+- * range_cyclic semantics (ie. it may
+- * not be suitable for data integrity
+- * writeout).
+- */
+- done_index = page->index + 1;
+ done = 1;
+ break;
+ }
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index a456801e0cd5..d9d90f0b66d2 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1636,6 +1636,7 @@ static noinline ssize_t btrfs_buffered_write(struct kiocb *iocb,
+ break;
+ }
+
++ only_release_metadata = false;
+ sector_offset = pos & (fs_info->sectorsize - 1);
+ reserve_bytes = round_up(write_bytes + sector_offset,
+ fs_info->sectorsize);
+@@ -1791,7 +1792,6 @@ again:
+ set_extent_bit(&BTRFS_I(inode)->io_tree, lockstart,
+ lockend, EXTENT_NORESERVE, NULL,
+ NULL, GFP_NOFS);
+- only_release_metadata = false;
+ }
+
+ btrfs_drop_pages(pages, num_pages);
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index ec01bd38d675..c9965e89097f 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -382,6 +382,12 @@ static int io_ctl_prepare_pages(struct btrfs_io_ctl *io_ctl, struct inode *inode
+ if (uptodate && !PageUptodate(page)) {
+ btrfs_readpage(NULL, page);
+ lock_page(page);
++ if (page->mapping != inode->i_mapping) {
++ btrfs_err(BTRFS_I(inode)->root->fs_info,
++ "free space cache page truncated");
++ io_ctl_drop_pages(io_ctl);
++ return -EIO;
++ }
+ if (!PageUptodate(page)) {
+ btrfs_err(BTRFS_I(inode)->root->fs_info,
+ "error reading free space cache");
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 6f4598583f57..7fd4458cf0a7 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -2161,12 +2161,16 @@ again:
+ mapping_set_error(page->mapping, ret);
+ end_extent_writepage(page, ret, page_start, page_end);
+ ClearPageChecked(page);
+- goto out;
++ goto out_reserved;
+ }
+
+ ClearPageChecked(page);
+ set_page_dirty(page);
++out_reserved:
+ btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE);
++ if (ret)
++ btrfs_delalloc_release_space(inode, data_reserved, page_start,
++ PAGE_SIZE, true);
+ out:
+ unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end,
+ &cached_state);
+@@ -9506,6 +9510,9 @@ static int btrfs_rename_exchange(struct inode *old_dir,
+ goto out_notrans;
+ }
+
++ if (dest != root)
++ btrfs_record_root_in_trans(trans, dest);
++
+ /*
+ * We need to find a free sequence number both in the source and
+ * in the destination directory for the exchange.
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 48ddbc187e58..10532463e92a 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -24,6 +24,14 @@
+ #include "transaction.h"
+ #include "compression.h"
+
++/*
++ * Maximum number of references an extent can have in order for us to attempt to
++ * issue clone operations instead of write operations. This currently exists to
++ * avoid hitting limitations of the backreference walking code (taking a lot of
++ * time and using too much memory for extents with large number of references).
++ */
++#define SEND_MAX_EXTENT_REFS 64
++
+ /*
+ * A fs_path is a helper to dynamically build path names with unknown size.
+ * It reallocates the internal buffer on demand.
+@@ -1303,6 +1311,7 @@ static int find_extent_clone(struct send_ctx *sctx,
+ struct clone_root *cur_clone_root;
+ struct btrfs_key found_key;
+ struct btrfs_path *tmp_path;
++ struct btrfs_extent_item *ei;
+ int compressed;
+ u32 i;
+
+@@ -1352,7 +1361,6 @@ static int find_extent_clone(struct send_ctx *sctx,
+ ret = extent_from_logical(fs_info, disk_byte, tmp_path,
+ &found_key, &flags);
+ up_read(&fs_info->commit_root_sem);
+- btrfs_release_path(tmp_path);
+
+ if (ret < 0)
+ goto out;
+@@ -1361,6 +1369,21 @@ static int find_extent_clone(struct send_ctx *sctx,
+ goto out;
+ }
+
++ ei = btrfs_item_ptr(tmp_path->nodes[0], tmp_path->slots[0],
++ struct btrfs_extent_item);
++ /*
++ * Backreference walking (iterate_extent_inodes() below) is currently
++ * too expensive when an extent has a large number of references, both
++ * in time spent and used memory. So for now just fallback to write
++ * operations instead of clone operations when an extent has more than
++ * a certain amount of references.
++ */
++ if (btrfs_extent_refs(tmp_path->nodes[0], ei) > SEND_MAX_EXTENT_REFS) {
++ ret = -ENOENT;
++ goto out;
++ }
++ btrfs_release_path(tmp_path);
++
+ /*
+ * Setup the clone roots.
+ */
+diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
+index c0e3015b1bac..ac703b15d679 100644
+--- a/fs/btrfs/volumes.h
++++ b/fs/btrfs/volumes.h
+@@ -304,7 +304,6 @@ struct btrfs_bio {
+ u64 map_type; /* get from map_lookup->type */
+ bio_end_io_t *end_io;
+ struct bio *orig_bio;
+- unsigned long flags;
+ void *private;
+ atomic_t error;
+ int max_errors;
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 9194f17675c8..4563699bbe6c 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -168,7 +168,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon)
+ if (tcon == NULL)
+ return 0;
+
+- if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL)
++ if (smb2_command == SMB2_TREE_CONNECT)
+ return 0;
+
+ if (tcon->tidStatus == CifsExiting) {
+@@ -335,16 +335,9 @@ fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, void *buf,
+ * SMB information in the SMB header. If the return code is zero, this
+ * function must have filled in request_buf pointer.
+ */
+-static int
+-smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon,
+- void **request_buf, unsigned int *total_len)
++static int __smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon,
++ void **request_buf, unsigned int *total_len)
+ {
+- int rc;
+-
+- rc = smb2_reconnect(smb2_command, tcon);
+- if (rc)
+- return rc;
+-
+ /* BB eventually switch this to SMB2 specific small buf size */
+ if (smb2_command == SMB2_SET_INFO)
+ *request_buf = cifs_buf_get();
+@@ -365,7 +358,31 @@ smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon,
+ cifs_stats_inc(&tcon->num_smbs_sent);
+ }
+
+- return rc;
++ return 0;
++}
++
++static int smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon,
++ void **request_buf, unsigned int *total_len)
++{
++ int rc;
++
++ rc = smb2_reconnect(smb2_command, tcon);
++ if (rc)
++ return rc;
++
++ return __smb2_plain_req_init(smb2_command, tcon, request_buf,
++ total_len);
++}
++
++static int smb2_ioctl_req_init(u32 opcode, struct cifs_tcon *tcon,
++ void **request_buf, unsigned int *total_len)
++{
++ /* Skip reconnect only for FSCTL_VALIDATE_NEGOTIATE_INFO IOCTLs */
++ if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) {
++ return __smb2_plain_req_init(SMB2_IOCTL, tcon, request_buf,
++ total_len);
++ }
++ return smb2_plain_req_init(SMB2_IOCTL, tcon, request_buf, total_len);
+ }
+
+
+@@ -2386,7 +2403,7 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
+ if (!ses || !(ses->server))
+ return -EIO;
+
+- rc = smb2_plain_req_init(SMB2_IOCTL, tcon, (void **) &req, &total_len);
++ rc = smb2_ioctl_req_init(opcode, tcon, (void **) &req, &total_len);
+ if (rc)
+ return rc;
+
+diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
+index e4bb9386c045..36a2ab6f6150 100644
+--- a/fs/ext2/inode.c
++++ b/fs/ext2/inode.c
+@@ -699,10 +699,13 @@ static int ext2_get_blocks(struct inode *inode,
+ if (!partial) {
+ count++;
+ mutex_unlock(&ei->truncate_mutex);
+- if (err)
+- goto cleanup;
+ goto got_it;
+ }
++
++ if (err) {
++ mutex_unlock(&ei->truncate_mutex);
++ goto cleanup;
++ }
+ }
+
+ /*
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index f8a0af11a31e..ab16b7c6068c 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -196,7 +196,12 @@ void ext4_evict_inode(struct inode *inode)
+ {
+ handle_t *handle;
+ int err;
+- int extra_credits = 3;
++ /*
++ * Credits for final inode cleanup and freeing:
++ * sb + inode (ext4_orphan_del()), block bitmap, group descriptor
++ * (xattr block freeing), bitmap, group descriptor (inode freeing)
++ */
++ int extra_credits = 6;
+ struct ext4_xattr_inode_array *ea_inode_array = NULL;
+
+ trace_ext4_evict_inode(inode);
+@@ -252,8 +257,12 @@ void ext4_evict_inode(struct inode *inode)
+ if (!IS_NOQUOTA(inode))
+ extra_credits += EXT4_MAXQUOTAS_DEL_BLOCKS(inode->i_sb);
+
++ /*
++ * Block bitmap, group descriptor, and inode are accounted in both
++ * ext4_blocks_for_truncate() and extra_credits. So subtract 3.
++ */
+ handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE,
+- ext4_blocks_for_truncate(inode)+extra_credits);
++ ext4_blocks_for_truncate(inode) + extra_credits - 3);
+ if (IS_ERR(handle)) {
+ ext4_std_error(inode->i_sb, PTR_ERR(handle));
+ /*
+@@ -5450,11 +5459,15 @@ static void ext4_wait_for_tail_page_commit(struct inode *inode)
+
+ offset = inode->i_size & (PAGE_SIZE - 1);
+ /*
+- * All buffers in the last page remain valid? Then there's nothing to
+- * do. We do the check mainly to optimize the common PAGE_SIZE ==
+- * blocksize case
++ * If the page is fully truncated, we don't need to wait for any commit
++ * (and we even should not as __ext4_journalled_invalidatepage() may
++ * strip all buffers from the page but keep the page dirty which can then
++ * confuse e.g. concurrent ext4_writepage() seeing dirty page without
++ * buffers). Also we don't need to wait for any commit if all buffers in
++ * the page remain valid. This is most beneficial for the common case of
++ * blocksize == PAGESIZE.
+ */
+- if (offset > PAGE_SIZE - i_blocksize(inode))
++ if (!offset || offset > (PAGE_SIZE - i_blocksize(inode)))
+ return;
+ while (1) {
+ page = find_lock_page(inode->i_mapping,
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index badbb8b4f0f1..f56d6f1950b9 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -3056,18 +3056,17 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry)
+ if (IS_DIRSYNC(dir))
+ ext4_handle_sync(handle);
+
+- if (inode->i_nlink == 0) {
+- ext4_warning_inode(inode, "Deleting file '%.*s' with no links",
+- dentry->d_name.len, dentry->d_name.name);
+- set_nlink(inode, 1);
+- }
+ retval = ext4_delete_entry(handle, dir, de, bh);
+ if (retval)
+ goto end_unlink;
+ dir->i_ctime = dir->i_mtime = current_time(dir);
+ ext4_update_dx_flag(dir);
+ ext4_mark_inode_dirty(handle, dir);
+- drop_nlink(inode);
++ if (inode->i_nlink == 0)
++ ext4_warning_inode(inode, "Deleting file '%.*s' with no links",
++ dentry->d_name.len, dentry->d_name.name);
++ else
++ drop_nlink(inode);
+ if (!inode->i_nlink)
+ ext4_orphan_add(handle, inode);
+ inode->i_ctime = current_time(inode);
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index 90b5c8d0c56a..d3f0612e3347 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -613,6 +613,14 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
+ list_add(&bd->bd_list, &sdp->sd_log_le_revoke);
+ }
+
++void gfs2_glock_remove_revoke(struct gfs2_glock *gl)
++{
++ if (atomic_dec_return(&gl->gl_revokes) == 0) {
++ clear_bit(GLF_LFLUSH, &gl->gl_flags);
++ gfs2_glock_queue_put(gl);
++ }
++}
++
+ void gfs2_write_revokes(struct gfs2_sbd *sdp)
+ {
+ struct gfs2_trans *tr;
+diff --git a/fs/gfs2/log.h b/fs/gfs2/log.h
+index 20241436126d..015766cd1f5d 100644
+--- a/fs/gfs2/log.h
++++ b/fs/gfs2/log.h
+@@ -80,6 +80,7 @@ extern void gfs2_ail1_flush(struct gfs2_sbd *sdp, struct writeback_control *wbc)
+ extern void gfs2_log_shutdown(struct gfs2_sbd *sdp);
+ extern int gfs2_logd(void *data);
+ extern void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd);
++extern void gfs2_glock_remove_revoke(struct gfs2_glock *gl);
+ extern void gfs2_write_revokes(struct gfs2_sbd *sdp);
+
+ #endif /* __LOG_DOT_H__ */
+diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
+index 8f99b395d7bf..2b3b755ee34c 100644
+--- a/fs/gfs2/lops.c
++++ b/fs/gfs2/lops.c
+@@ -662,10 +662,7 @@ static void revoke_lo_after_commit(struct gfs2_sbd *sdp, struct gfs2_trans *tr)
+ bd = list_entry(head->next, struct gfs2_bufdata, bd_list);
+ list_del_init(&bd->bd_list);
+ gl = bd->bd_gl;
+- if (atomic_dec_return(&gl->gl_revokes) == 0) {
+- clear_bit(GLF_LFLUSH, &gl->gl_flags);
+- gfs2_glock_queue_put(gl);
+- }
++ gfs2_glock_remove_revoke(gl);
+ kmem_cache_free(gfs2_bufdata_cachep, bd);
+ }
+ }
+diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c
+index 064c9a0ef046..812b5d5978b2 100644
+--- a/fs/gfs2/trans.c
++++ b/fs/gfs2/trans.c
+@@ -266,6 +266,8 @@ void gfs2_trans_add_unrevoke(struct gfs2_sbd *sdp, u64 blkno, unsigned int len)
+ list_del_init(&bd->bd_list);
+ gfs2_assert_withdraw(sdp, sdp->sd_log_num_revoke);
+ sdp->sd_log_num_revoke--;
++ if (bd->bd_gl)
++ gfs2_glock_remove_revoke(bd->bd_gl);
+ kmem_cache_free(gfs2_bufdata_cachep, bd);
+ tr->tr_num_revoke_rm++;
+ if (--n == 0)
+diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
+index 7a922190a8c7..eda83487c9ec 100644
+--- a/fs/ocfs2/quota_global.c
++++ b/fs/ocfs2/quota_global.c
+@@ -728,7 +728,7 @@ static int ocfs2_release_dquot(struct dquot *dquot)
+
+ mutex_lock(&dquot->dq_lock);
+ /* Check whether we are not racing with some other dqget() */
+- if (atomic_read(&dquot->dq_count) > 1)
++ if (dquot_is_busy(dquot))
+ goto out;
+ /* Running from downconvert thread? Postpone quota processing to wq */
+ if (current == osb->dc_task) {
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 336f04da80ed..800bcad67325 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -1174,7 +1174,7 @@ static int ovl_rename(struct inode *olddir, struct dentry *old,
+ if (newdentry == trap)
+ goto out_dput;
+
+- if (WARN_ON(olddentry->d_inode == newdentry->d_inode))
++ if (olddentry->d_inode == newdentry->d_inode)
+ goto out_dput;
+
+ err = 0;
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index 4f4964eeb086..a138bb3bc2a5 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -203,8 +203,14 @@ int ovl_getattr(const struct path *path, struct kstat *stat,
+ if (ovl_test_flag(OVL_INDEX, d_inode(dentry)) ||
+ (!ovl_verify_lower(dentry->d_sb) &&
+ (is_dir || lowerstat.nlink == 1))) {
+- stat->ino = lowerstat.ino;
+ lower_layer = ovl_layer_lower(dentry);
++ /*
++ * Cannot use origin st_dev;st_ino because
++ * origin inode content may differ from overlay
++ * inode content.
++ */
++ if (samefs || lower_layer->fsid)
++ stat->ino = lowerstat.ino;
+ }
+
+ /*
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index 71aba44c4fa6..efa6273c0006 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -800,6 +800,8 @@ static int show_smap(struct seq_file *m, void *v)
+
+ __show_smap(m, &mss);
+
++ seq_printf(m, "THPeligible: %d\n", transparent_hugepage_enabled(vma));
++
+ if (arch_pkeys_enabled())
+ seq_printf(m, "ProtectionKey: %8u\n", vma_pkey(vma));
+ show_smap_vma_flags(m, vma);
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index dd1783ea7003..59b00d8db22c 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -491,7 +491,7 @@ int dquot_release(struct dquot *dquot)
+
+ mutex_lock(&dquot->dq_lock);
+ /* Check whether we are not racing with some other dqget() */
+- if (atomic_read(&dquot->dq_count) > 1)
++ if (dquot_is_busy(dquot))
+ goto out_dqlock;
+ if (dqopt->ops[dquot->dq_id.type]->release_dqblk) {
+ ret = dqopt->ops[dquot->dq_id.type]->release_dqblk(dquot);
+@@ -617,7 +617,7 @@ EXPORT_SYMBOL(dquot_scan_active);
+ /* Write all dquot structures to quota files */
+ int dquot_writeback_dquots(struct super_block *sb, int type)
+ {
+- struct list_head *dirty;
++ struct list_head dirty;
+ struct dquot *dquot;
+ struct quota_info *dqopt = sb_dqopt(sb);
+ int cnt;
+@@ -631,9 +631,10 @@ int dquot_writeback_dquots(struct super_block *sb, int type)
+ if (!sb_has_quota_active(sb, cnt))
+ continue;
+ spin_lock(&dq_list_lock);
+- dirty = &dqopt->info[cnt].dqi_dirty_list;
+- while (!list_empty(dirty)) {
+- dquot = list_first_entry(dirty, struct dquot,
++ /* Move list away to avoid livelock. */
++ list_replace_init(&dqopt->info[cnt].dqi_dirty_list, &dirty);
++ while (!list_empty(&dirty)) {
++ dquot = list_first_entry(&dirty, struct dquot,
+ dq_dirty);
+
+ WARN_ON(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags));
+diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
+index 132ec4406ed0..6419e6dacc39 100644
+--- a/fs/reiserfs/inode.c
++++ b/fs/reiserfs/inode.c
+@@ -2097,6 +2097,15 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
+ goto out_inserted_sd;
+ }
+
++ /*
++ * Mark it private if we're creating the privroot
++ * or something under it.
++ */
++ if (IS_PRIVATE(dir) || dentry == REISERFS_SB(sb)->priv_root) {
++ inode->i_flags |= S_PRIVATE;
++ inode->i_opflags &= ~IOP_XATTR;
++ }
++
+ if (reiserfs_posixacl(inode->i_sb)) {
+ reiserfs_write_unlock(inode->i_sb);
+ retval = reiserfs_inherit_default_acl(th, dir, dentry, inode);
+@@ -2111,8 +2120,7 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
+ reiserfs_warning(inode->i_sb, "jdm-13090",
+ "ACLs aren't enabled in the fs, "
+ "but vfs thinks they are!");
+- } else if (IS_PRIVATE(dir))
+- inode->i_flags |= S_PRIVATE;
++ }
+
+ if (security->name) {
+ reiserfs_write_unlock(inode->i_sb);
+diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
+index 97f3fc4fdd79..959a066b7bb0 100644
+--- a/fs/reiserfs/namei.c
++++ b/fs/reiserfs/namei.c
+@@ -377,10 +377,13 @@ static struct dentry *reiserfs_lookup(struct inode *dir, struct dentry *dentry,
+
+ /*
+ * Propagate the private flag so we know we're
+- * in the priv tree
++ * in the priv tree. Also clear IOP_XATTR
++ * since we don't have xattrs on xattr files.
+ */
+- if (IS_PRIVATE(dir))
++ if (IS_PRIVATE(dir)) {
+ inode->i_flags |= S_PRIVATE;
++ inode->i_opflags &= ~IOP_XATTR;
++ }
+ }
+ reiserfs_write_unlock(dir->i_sb);
+ if (retval == IO_ERROR) {
+diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h
+index e5ca9ed79e54..726580114d55 100644
+--- a/fs/reiserfs/reiserfs.h
++++ b/fs/reiserfs/reiserfs.h
+@@ -1168,6 +1168,8 @@ static inline int bmap_would_wrap(unsigned bmap_nr)
+ return bmap_nr > ((1LL << 16) - 1);
+ }
+
++extern const struct xattr_handler *reiserfs_xattr_handlers[];
++
+ /*
+ * this says about version of key of all items (but stat data) the
+ * object consists of
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index 1fc934d24459..a3507490be6e 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -2052,6 +2052,8 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
+ if (replay_only(s))
+ goto error_unlocked;
+
++ s->s_xattr = reiserfs_xattr_handlers;
++
+ if (bdev_read_only(s->s_bdev) && !sb_rdonly(s)) {
+ SWARN(silent, s, "clm-7000",
+ "Detected readonly device, marking FS readonly");
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index 32d8986c26fb..2c5c45927b2f 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -122,13 +122,13 @@ static struct dentry *open_xa_root(struct super_block *sb, int flags)
+ struct dentry *xaroot;
+
+ if (d_really_is_negative(privroot))
+- return ERR_PTR(-ENODATA);
++ return ERR_PTR(-EOPNOTSUPP);
+
+ inode_lock_nested(d_inode(privroot), I_MUTEX_XATTR);
+
+ xaroot = dget(REISERFS_SB(sb)->xattr_root);
+ if (!xaroot)
+- xaroot = ERR_PTR(-ENODATA);
++ xaroot = ERR_PTR(-EOPNOTSUPP);
+ else if (d_really_is_negative(xaroot)) {
+ int err = -ENODATA;
+
+@@ -610,6 +610,10 @@ int reiserfs_xattr_set(struct inode *inode, const char *name,
+ int error, error2;
+ size_t jbegin_count = reiserfs_xattr_nblocks(inode, buffer_size);
+
++ /* Check before we start a transaction and then do nothing. */
++ if (!d_really_is_positive(REISERFS_SB(inode->i_sb)->priv_root))
++ return -EOPNOTSUPP;
++
+ if (!(flags & XATTR_REPLACE))
+ jbegin_count += reiserfs_xattr_jcreate_nblocks(inode);
+
+@@ -832,8 +836,7 @@ ssize_t reiserfs_listxattr(struct dentry * dentry, char *buffer, size_t size)
+ if (d_really_is_negative(dentry))
+ return -EINVAL;
+
+- if (!dentry->d_sb->s_xattr ||
+- get_inode_sd_version(d_inode(dentry)) == STAT_DATA_V1)
++ if (get_inode_sd_version(d_inode(dentry)) == STAT_DATA_V1)
+ return -EOPNOTSUPP;
+
+ dir = open_xa_dir(d_inode(dentry), XATTR_REPLACE);
+@@ -873,6 +876,7 @@ static int create_privroot(struct dentry *dentry)
+ }
+
+ d_inode(dentry)->i_flags |= S_PRIVATE;
++ d_inode(dentry)->i_opflags &= ~IOP_XATTR;
+ reiserfs_info(dentry->d_sb, "Created %s - reserved for xattr "
+ "storage.\n", PRIVROOT_NAME);
+
+@@ -886,7 +890,7 @@ static int create_privroot(struct dentry *dentry) { return 0; }
+ #endif
+
+ /* Actual operations that are exported to VFS-land */
+-static const struct xattr_handler *reiserfs_xattr_handlers[] = {
++const struct xattr_handler *reiserfs_xattr_handlers[] = {
+ #ifdef CONFIG_REISERFS_FS_XATTR
+ &reiserfs_xattr_user_handler,
+ &reiserfs_xattr_trusted_handler,
+@@ -957,8 +961,10 @@ int reiserfs_lookup_privroot(struct super_block *s)
+ if (!IS_ERR(dentry)) {
+ REISERFS_SB(s)->priv_root = dentry;
+ d_set_d_op(dentry, &xattr_lookup_poison_ops);
+- if (d_really_is_positive(dentry))
++ if (d_really_is_positive(dentry)) {
+ d_inode(dentry)->i_flags |= S_PRIVATE;
++ d_inode(dentry)->i_opflags &= ~IOP_XATTR;
++ }
+ } else
+ err = PTR_ERR(dentry);
+ inode_unlock(d_inode(s->s_root));
+@@ -987,7 +993,6 @@ int reiserfs_xattr_init(struct super_block *s, int mount_flags)
+ }
+
+ if (d_really_is_positive(privroot)) {
+- s->s_xattr = reiserfs_xattr_handlers;
+ inode_lock(d_inode(privroot));
+ if (!REISERFS_SB(s)->xattr_root) {
+ struct dentry *dentry;
+diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
+index aa9380bac196..05f666794561 100644
+--- a/fs/reiserfs/xattr_acl.c
++++ b/fs/reiserfs/xattr_acl.c
+@@ -320,10 +320,8 @@ reiserfs_inherit_default_acl(struct reiserfs_transaction_handle *th,
+ * would be useless since permissions are ignored, and a pain because
+ * it introduces locking cycles
+ */
+- if (IS_PRIVATE(dir)) {
+- inode->i_flags |= S_PRIVATE;
++ if (IS_PRIVATE(inode))
+ goto apply_umask;
+- }
+
+ err = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl);
+ if (err)
+diff --git a/fs/splice.c b/fs/splice.c
+index 8af8c318afd6..fd28c7da3c83 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -949,12 +949,13 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+ WARN_ON_ONCE(pipe->nrbufs != 0);
+
+ while (len) {
++ unsigned int pipe_pages;
+ size_t read_len;
+ loff_t pos = sd->pos, prev_pos = pos;
+
+ /* Don't try to read more the pipe has space for. */
+- read_len = min_t(size_t, len,
+- (pipe->buffers - pipe->nrbufs) << PAGE_SHIFT);
++ pipe_pages = pipe->buffers - pipe->nrbufs;
++ read_len = min(len, (size_t)pipe_pages << PAGE_SHIFT);
+ ret = do_splice_to(in, &pos, pipe, read_len, flags);
+ if (unlikely(ret <= 0))
+ goto out_release;
+@@ -1175,8 +1176,15 @@ static long do_splice(struct file *in, loff_t __user *off_in,
+
+ pipe_lock(opipe);
+ ret = wait_for_space(opipe, flags);
+- if (!ret)
++ if (!ret) {
++ unsigned int pipe_pages;
++
++ /* Don't try to read more the pipe has space for. */
++ pipe_pages = opipe->buffers - opipe->nrbufs;
++ len = min(len, (size_t)pipe_pages << PAGE_SHIFT);
++
+ ret = do_splice_to(in, &offset, opipe, len, flags);
++ }
+ pipe_unlock(opipe);
+ if (ret > 0)
+ wakeup_pipe_readers(opipe);
+diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
+index 77227224ca88..e375f2249f52 100644
+--- a/include/linux/huge_mm.h
++++ b/include/linux/huge_mm.h
+@@ -91,7 +91,11 @@ extern bool is_vma_temporary_stack(struct vm_area_struct *vma);
+
+ extern unsigned long transparent_hugepage_flags;
+
+-static inline bool transparent_hugepage_enabled(struct vm_area_struct *vma)
++/*
++ * to be used on vmas which are known to support THP.
++ * Use transparent_hugepage_enabled otherwise
++ */
++static inline bool __transparent_hugepage_enabled(struct vm_area_struct *vma)
+ {
+ if (vma->vm_flags & VM_NOHUGEPAGE)
+ return false;
+@@ -115,6 +119,8 @@ static inline bool transparent_hugepage_enabled(struct vm_area_struct *vma)
+ return false;
+ }
+
++bool transparent_hugepage_enabled(struct vm_area_struct *vma);
++
+ #define transparent_hugepage_use_zero_page() \
+ (transparent_hugepage_flags & \
+ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG))
+@@ -255,6 +261,11 @@ static inline bool thp_migration_supported(void)
+
+ #define hpage_nr_pages(x) 1
+
++static inline bool __transparent_hugepage_enabled(struct vm_area_struct *vma)
++{
++ return false;
++}
++
+ static inline bool transparent_hugepage_enabled(struct vm_area_struct *vma)
+ {
+ return false;
+diff --git a/include/linux/mfd/rk808.h b/include/linux/mfd/rk808.h
+index d3156594674c..338e0f6e2226 100644
+--- a/include/linux/mfd/rk808.h
++++ b/include/linux/mfd/rk808.h
+@@ -443,7 +443,7 @@ enum {
+ enum {
+ RK805_ID = 0x8050,
+ RK808_ID = 0x0000,
+- RK818_ID = 0x8181,
++ RK818_ID = 0x8180,
+ };
+
+ struct rk808 {
+diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
+index 185d94829701..91e0b7624053 100644
+--- a/include/linux/quotaops.h
++++ b/include/linux/quotaops.h
+@@ -54,6 +54,16 @@ static inline struct dquot *dqgrab(struct dquot *dquot)
+ atomic_inc(&dquot->dq_count);
+ return dquot;
+ }
++
++static inline bool dquot_is_busy(struct dquot *dquot)
++{
++ if (test_bit(DQ_MOD_B, &dquot->dq_flags))
++ return true;
++ if (atomic_read(&dquot->dq_count) > 1)
++ return true;
++ return false;
++}
++
+ void dqput(struct dquot *dquot);
+ int dquot_scan_active(struct super_block *sb,
+ int (*fn)(struct dquot *dquot, unsigned long priv),
+diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h
+index 3094af68b6e7..d6ba68880cef 100644
+--- a/include/uapi/linux/cec.h
++++ b/include/uapi/linux/cec.h
+@@ -767,8 +767,8 @@ struct cec_event {
+ #define CEC_MSG_SELECT_DIGITAL_SERVICE 0x93
+ #define CEC_MSG_TUNER_DEVICE_STATUS 0x07
+ /* Recording Flag Operand (rec_flag) */
+-#define CEC_OP_REC_FLAG_USED 0
+-#define CEC_OP_REC_FLAG_NOT_USED 1
++#define CEC_OP_REC_FLAG_NOT_USED 0
++#define CEC_OP_REC_FLAG_USED 1
+ /* Tuner Display Info Operand (tuner_display_info) */
+ #define CEC_OP_TUNER_DISPLAY_INFO_DIGITAL 0
+ #define CEC_OP_TUNER_DISPLAY_INFO_NONE 1
+diff --git a/kernel/cgroup/pids.c b/kernel/cgroup/pids.c
+index c9960baaa14f..940d2e8db776 100644
+--- a/kernel/cgroup/pids.c
++++ b/kernel/cgroup/pids.c
+@@ -48,7 +48,7 @@ struct pids_cgroup {
+ * %PIDS_MAX = (%PID_MAX_LIMIT + 1).
+ */
+ atomic64_t counter;
+- int64_t limit;
++ atomic64_t limit;
+
+ /* Handle for "pids.events" */
+ struct cgroup_file events_file;
+@@ -76,8 +76,8 @@ pids_css_alloc(struct cgroup_subsys_state *parent)
+ if (!pids)
+ return ERR_PTR(-ENOMEM);
+
+- pids->limit = PIDS_MAX;
+ atomic64_set(&pids->counter, 0);
++ atomic64_set(&pids->limit, PIDS_MAX);
+ atomic64_set(&pids->events_limit, 0);
+ return &pids->css;
+ }
+@@ -149,13 +149,14 @@ static int pids_try_charge(struct pids_cgroup *pids, int num)
+
+ for (p = pids; parent_pids(p); p = parent_pids(p)) {
+ int64_t new = atomic64_add_return(num, &p->counter);
++ int64_t limit = atomic64_read(&p->limit);
+
+ /*
+ * Since new is capped to the maximum number of pid_t, if
+ * p->limit is %PIDS_MAX then we know that this test will never
+ * fail.
+ */
+- if (new > p->limit)
++ if (new > limit)
+ goto revert;
+ }
+
+@@ -280,7 +281,7 @@ set_limit:
+ * Limit updates don't need to be mutex'd, since it isn't
+ * critical that any racing fork()s follow the new limit.
+ */
+- pids->limit = limit;
++ atomic64_set(&pids->limit, limit);
+ return nbytes;
+ }
+
+@@ -288,7 +289,7 @@ static int pids_max_show(struct seq_file *sf, void *v)
+ {
+ struct cgroup_subsys_state *css = seq_css(sf);
+ struct pids_cgroup *pids = css_pids(css);
+- int64_t limit = pids->limit;
++ int64_t limit = atomic64_read(&pids->limit);
+
+ if (limit >= PIDS_MAX)
+ seq_printf(sf, "%s\n", PIDS_MAX_STR);
+diff --git a/kernel/module.c b/kernel/module.c
+index 8257110bf599..d3aaec62c142 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1021,6 +1021,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
+ strlcpy(last_unloaded_module, mod->name, sizeof(last_unloaded_module));
+
+ free_module(mod);
++ /* someone could wait for the module in add_unformed_module() */
++ wake_up_all(&module_wq);
+ return 0;
+ out:
+ mutex_unlock(&module_mutex);
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index cd8b61bded78..493908464b9e 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -2413,8 +2413,14 @@ repeat:
+ */
+ if (need_to_create_worker(pool)) {
+ spin_lock(&wq_mayday_lock);
+- get_pwq(pwq);
+- list_move_tail(&pwq->mayday_node, &wq->maydays);
++ /*
++ * Queue iff we aren't racing destruction
++ * and somebody else hasn't queued it already.
++ */
++ if (wq->rescuer && list_empty(&pwq->mayday_node)) {
++ get_pwq(pwq);
++ list_add_tail(&pwq->mayday_node, &wq->maydays);
++ }
+ spin_unlock(&wq_mayday_lock);
+ }
+ }
+@@ -4154,9 +4160,29 @@ void destroy_workqueue(struct workqueue_struct *wq)
+ struct pool_workqueue *pwq;
+ int node;
+
++ /*
++ * Remove it from sysfs first so that sanity check failure doesn't
++ * lead to sysfs name conflicts.
++ */
++ workqueue_sysfs_unregister(wq);
++
+ /* drain it before proceeding with destruction */
+ drain_workqueue(wq);
+
++ /* kill rescuer, if sanity checks fail, leave it w/o rescuer */
++ if (wq->rescuer) {
++ struct worker *rescuer = wq->rescuer;
++
++ /* this prevents new queueing */
++ spin_lock_irq(&wq_mayday_lock);
++ wq->rescuer = NULL;
++ spin_unlock_irq(&wq_mayday_lock);
++
++ /* rescuer will empty maydays list before exiting */
++ kthread_stop(rescuer->task);
++ kfree(rescuer);
++ }
++
+ /* sanity checks */
+ mutex_lock(&wq->mutex);
+ for_each_pwq(pwq, wq) {
+@@ -4188,11 +4214,6 @@ void destroy_workqueue(struct workqueue_struct *wq)
+ list_del_rcu(&wq->list);
+ mutex_unlock(&wq_pool_mutex);
+
+- workqueue_sysfs_unregister(wq);
+-
+- if (wq->rescuer)
+- kthread_stop(wq->rescuer->task);
+-
+ if (!(wq->flags & WQ_UNBOUND)) {
+ /*
+ * The base ref is never dropped on per-cpu pwqs. Directly
+@@ -4464,7 +4485,8 @@ static void show_pwq(struct pool_workqueue *pwq)
+ pr_info(" pwq %d:", pool->id);
+ pr_cont_pool_info(pool);
+
+- pr_cont(" active=%d/%d%s\n", pwq->nr_active, pwq->max_active,
++ pr_cont(" active=%d/%d refcnt=%d%s\n",
++ pwq->nr_active, pwq->max_active, pwq->refcnt,
+ !list_empty(&pwq->mayday_node) ? " MAYDAY" : "");
+
+ hash_for_each(pool->busy_hash, bkt, worker, hentry) {
+diff --git a/lib/idr.c b/lib/idr.c
+index 61383564a6c5..6ff3b1c36e0a 100644
+--- a/lib/idr.c
++++ b/lib/idr.c
+@@ -218,7 +218,7 @@ int idr_for_each(const struct idr *idr,
+ EXPORT_SYMBOL(idr_for_each);
+
+ /**
+- * idr_get_next() - Find next populated entry.
++ * idr_get_next_ul() - Find next populated entry.
+ * @idr: IDR handle.
+ * @nextid: Pointer to an ID.
+ *
+@@ -227,7 +227,7 @@ EXPORT_SYMBOL(idr_for_each);
+ * to the ID of the found value. To use in a loop, the value pointed to by
+ * nextid must be incremented by the user.
+ */
+-void *idr_get_next(struct idr *idr, int *nextid)
++void *idr_get_next_ul(struct idr *idr, unsigned long *nextid)
+ {
+ struct radix_tree_iter iter;
+ void __rcu **slot;
+@@ -249,18 +249,14 @@ void *idr_get_next(struct idr *idr, int *nextid)
+ }
+ if (!slot)
+ return NULL;
+- id = iter.index + base;
+-
+- if (WARN_ON_ONCE(id > INT_MAX))
+- return NULL;
+
+- *nextid = id;
++ *nextid = iter.index + base;
+ return entry;
+ }
+-EXPORT_SYMBOL(idr_get_next);
++EXPORT_SYMBOL(idr_get_next_ul);
+
+ /**
+- * idr_get_next_ul() - Find next populated entry.
++ * idr_get_next() - Find next populated entry.
+ * @idr: IDR handle.
+ * @nextid: Pointer to an ID.
+ *
+@@ -269,22 +265,17 @@ EXPORT_SYMBOL(idr_get_next);
+ * to the ID of the found value. To use in a loop, the value pointed to by
+ * nextid must be incremented by the user.
+ */
+-void *idr_get_next_ul(struct idr *idr, unsigned long *nextid)
++void *idr_get_next(struct idr *idr, int *nextid)
+ {
+- struct radix_tree_iter iter;
+- void __rcu **slot;
+- unsigned long base = idr->idr_base;
+ unsigned long id = *nextid;
++ void *entry = idr_get_next_ul(idr, &id);
+
+- id = (id < base) ? 0 : id - base;
+- slot = radix_tree_iter_find(&idr->idr_rt, &iter, id);
+- if (!slot)
++ if (WARN_ON_ONCE(id > INT_MAX))
+ return NULL;
+-
+- *nextid = iter.index + base;
+- return rcu_dereference_raw(*slot);
++ *nextid = id;
++ return entry;
+ }
+-EXPORT_SYMBOL(idr_get_next_ul);
++EXPORT_SYMBOL(idr_get_next);
+
+ /**
+ * idr_replace() - replace pointer for given ID.
+diff --git a/lib/raid6/unroll.awk b/lib/raid6/unroll.awk
+index c6aa03631df8..0809805a7e23 100644
+--- a/lib/raid6/unroll.awk
++++ b/lib/raid6/unroll.awk
+@@ -13,7 +13,7 @@ BEGIN {
+ for (i = 0; i < rep; ++i) {
+ tmp = $0
+ gsub(/\$\$/, i, tmp)
+- gsub(/\$\#/, n, tmp)
++ gsub(/\$#/, n, tmp)
+ gsub(/\$\*/, "$", tmp)
+ print tmp
+ }
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 09ce8528bbdd..5a1771bd5d04 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -63,6 +63,16 @@ static struct shrinker deferred_split_shrinker;
+ static atomic_t huge_zero_refcount;
+ struct page *huge_zero_page __read_mostly;
+
++bool transparent_hugepage_enabled(struct vm_area_struct *vma)
++{
++ if (vma_is_anonymous(vma))
++ return __transparent_hugepage_enabled(vma);
++ if (vma_is_shmem(vma) && shmem_huge_enabled(vma))
++ return __transparent_hugepage_enabled(vma);
++
++ return false;
++}
++
+ static struct page *get_huge_zero_page(void)
+ {
+ struct page *zero_page;
+@@ -1329,7 +1339,7 @@ vm_fault_t do_huge_pmd_wp_page(struct vm_fault *vmf, pmd_t orig_pmd)
+ get_page(page);
+ spin_unlock(vmf->ptl);
+ alloc:
+- if (transparent_hugepage_enabled(vma) &&
++ if (__transparent_hugepage_enabled(vma) &&
+ !transparent_hugepage_debug_cow()) {
+ huge_gfp = alloc_hugepage_direct_gfpmask(vma);
+ new_page = alloc_hugepage_vma(huge_gfp, vma, haddr, HPAGE_PMD_ORDER);
+diff --git a/mm/memory.c b/mm/memory.c
+index fb5655b518c9..bbf0cc4066c8 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -4106,7 +4106,7 @@ static vm_fault_t __handle_mm_fault(struct vm_area_struct *vma,
+ vmf.pud = pud_alloc(mm, p4d, address);
+ if (!vmf.pud)
+ return VM_FAULT_OOM;
+- if (pud_none(*vmf.pud) && transparent_hugepage_enabled(vma)) {
++ if (pud_none(*vmf.pud) && __transparent_hugepage_enabled(vma)) {
+ ret = create_huge_pud(&vmf);
+ if (!(ret & VM_FAULT_FALLBACK))
+ return ret;
+@@ -4132,7 +4132,7 @@ static vm_fault_t __handle_mm_fault(struct vm_area_struct *vma,
+ vmf.pmd = pmd_alloc(mm, vmf.pud, address);
+ if (!vmf.pmd)
+ return VM_FAULT_OOM;
+- if (pmd_none(*vmf.pmd) && transparent_hugepage_enabled(vma)) {
++ if (pmd_none(*vmf.pmd) && __transparent_hugepage_enabled(vma)) {
+ ret = create_huge_pmd(&vmf);
+ if (!(ret & VM_FAULT_FALLBACK))
+ return ret;
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 3c8742655756..650ef56dc790 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2692,7 +2692,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
+ }
+
+ shmem_falloc.waitq = &shmem_falloc_waitq;
+- shmem_falloc.start = unmap_start >> PAGE_SHIFT;
++ shmem_falloc.start = (u64)unmap_start >> PAGE_SHIFT;
+ shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT;
+ spin_lock(&inode->i_lock);
+ inode->i_private = &shmem_falloc;
+diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
+index 511b32ea2533..0eb4bfa2332c 100644
+--- a/net/ipv4/gre_demux.c
++++ b/net/ipv4/gre_demux.c
+@@ -132,7 +132,7 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ if (!pskb_may_pull(skb, nhs + hdr_len + sizeof(*ershdr)))
+ return -EINVAL;
+
+- ershdr = (struct erspan_base_hdr *)options;
++ ershdr = (struct erspan_base_hdr *)(skb->data + nhs + hdr_len);
+ tpi->key = cpu_to_be32(get_session_id(ershdr));
+ }
+
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index 9fd37d91b5ed..e4cf72b0675e 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -1666,7 +1666,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ if (skb_is_gso(skb) && q->rate_flags & CAKE_FLAG_SPLIT_GSO) {
+ struct sk_buff *segs, *nskb;
+ netdev_features_t features = netif_skb_features(skb);
+- unsigned int slen = 0;
++ unsigned int slen = 0, numsegs = 0;
+
+ segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
+ if (IS_ERR_OR_NULL(segs))
+@@ -1682,6 +1682,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ flow_queue_add(flow, segs);
+
+ sch->q.qlen++;
++ numsegs++;
+ slen += segs->len;
+ q->buffer_used += segs->truesize;
+ b->packets++;
+@@ -1695,7 +1696,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ sch->qstats.backlog += slen;
+ q->avg_window_bytes += slen;
+
+- qdisc_tree_reduce_backlog(sch, 1, len);
++ qdisc_tree_reduce_backlog(sch, 1-numsegs, len-slen);
+ consume_skb(skb);
+ } else {
+ /* not splitting */
+diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
+index 0ecbbdc337b8..62885a2781c9 100644
+--- a/net/smc/smc_tx.c
++++ b/net/smc/smc_tx.c
+@@ -486,25 +486,23 @@ static int smcr_tx_sndbuf_nonempty(struct smc_connection *conn)
+ struct smc_wr_buf *wr_buf;
+ int rc;
+
+- spin_lock_bh(&conn->send_lock);
+ rc = smc_cdc_get_free_slot(conn, &wr_buf, &pend);
+ if (rc < 0) {
+ if (rc == -EBUSY) {
+ struct smc_sock *smc =
+ container_of(conn, struct smc_sock, conn);
+
+- if (smc->sk.sk_err == ECONNABORTED) {
+- rc = sock_error(&smc->sk);
+- goto out_unlock;
+- }
++ if (smc->sk.sk_err == ECONNABORTED)
++ return sock_error(&smc->sk);
+ rc = 0;
+ if (conn->alert_token_local) /* connection healthy */
+ mod_delayed_work(system_wq, &conn->tx_work,
+ SMC_TX_WORK_DELAY);
+ }
+- goto out_unlock;
++ return rc;
+ }
+
++ spin_lock_bh(&conn->send_lock);
+ if (!conn->local_tx_ctrl.prod_flags.urg_data_present) {
+ rc = smc_tx_rdma_writes(conn);
+ if (rc) {
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index 214440c5b14e..3a28e150b2dc 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -54,9 +54,6 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail)
+ h->last_refresh = now;
+ }
+
+-static inline int cache_is_valid(struct cache_head *h);
+-static void cache_fresh_locked(struct cache_head *head, time_t expiry,
+- struct cache_detail *detail);
+ static void cache_fresh_unlocked(struct cache_head *head,
+ struct cache_detail *detail);
+
+@@ -101,9 +98,6 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
+ if (cache_is_expired(detail, tmp)) {
+ hlist_del_init(&tmp->cache_list);
+ detail->entries --;
+- if (cache_is_valid(tmp) == -EAGAIN)
+- set_bit(CACHE_NEGATIVE, &tmp->flags);
+- cache_fresh_locked(tmp, 0, detail);
+ freeme = tmp;
+ break;
+ }
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index f842db498c74..7e3b47eeea04 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3307,6 +3307,9 @@ static void rt5645_jack_detect_work(struct work_struct *work)
+ snd_soc_jack_report(rt5645->mic_jack,
+ report, SND_JACK_MICROPHONE);
+ return;
++ case 4:
++ val = snd_soc_component_read32(rt5645->component, RT5645_A_JD_CTRL1) & 0x0020;
++ break;
+ default: /* read rt5645 jd1_1 status */
+ val = snd_soc_component_read32(rt5645->component, RT5645_INT_IRQ_ST) & 0x1000;
+ break;
+@@ -3634,7 +3637,7 @@ static const struct rt5645_platform_data intel_braswell_platform_data = {
+ static const struct rt5645_platform_data buddy_platform_data = {
+ .dmic1_data_pin = RT5645_DMIC_DATA_GPIO5,
+ .dmic2_data_pin = RT5645_DMIC_DATA_IN2P,
+- .jd_mode = 3,
++ .jd_mode = 4,
+ .level_trigger_irq = true,
+ };
+
+@@ -4030,6 +4033,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
+ RT5645_JD1_MODE_1);
+ break;
+ case 3:
++ case 4:
+ regmap_update_bits(rt5645->regmap, RT5645_A_JD_CTRL1,
+ RT5645_JD1_MODE_MASK,
+ RT5645_JD1_MODE_2);
+diff --git a/sound/soc/soc-jack.c b/sound/soc/soc-jack.c
+index c7b990abdbaa..2a528e73bad2 100644
+--- a/sound/soc/soc-jack.c
++++ b/sound/soc/soc-jack.c
+@@ -100,10 +100,9 @@ void snd_soc_jack_report(struct snd_soc_jack *jack, int status, int mask)
+ unsigned int sync = 0;
+ int enable;
+
+- trace_snd_soc_jack_report(jack, mask, status);
+-
+ if (!jack)
+ return;
++ trace_snd_soc_jack_report(jack, mask, status);
+
+ dapm = &jack->card->dapm;
+
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index 003b70daf0bf..21f867a543e0 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -2276,7 +2276,7 @@ static int thread__resolve_callchain_sample(struct thread *thread,
+ }
+
+ check_calls:
+- if (callchain_param.order != ORDER_CALLEE) {
++ if (chain && callchain_param.order != ORDER_CALLEE) {
+ err = find_prev_cpumode(chain, thread, cursor, parent, root_al,
+ &cpumode, chain->nr - first_call);
+ if (err)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-12-21 15:03 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-12-21 15:03 UTC (permalink / raw
To: gentoo-commits
commit: 96ffa6fb8e2e9fb0a95fec61d517ba8eb1ba9d2a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 21 15:03:02 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Dec 21 15:03:02 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=96ffa6fb
Linux patch 4.19.91
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1090_linux-4.19.91.patch | 1527 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1531 insertions(+)
diff --git a/0000_README b/0000_README
index aecec9f..304b54d 100644
--- a/0000_README
+++ b/0000_README
@@ -399,6 +399,10 @@ Patch: 1089_linux-4.19.90.patch
From: https://www.kernel.org
Desc: Linux 4.19.90
+Patch: 1090_linux-4.19.91.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.91
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1090_linux-4.19.91.patch b/1090_linux-4.19.91.patch
new file mode 100644
index 0000000..4880cbe
--- /dev/null
+++ b/1090_linux-4.19.91.patch
@@ -0,0 +1,1527 @@
+diff --git a/Makefile b/Makefile
+index 39bdbafae517..4e07d786bec2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 90
++SUBLEVEL = 91
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts
+index 0e159c884f97..1aeac33b0d34 100644
+--- a/arch/arm/boot/dts/s3c6410-mini6410.dts
++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts
+@@ -165,6 +165,10 @@
+ };
+ };
+
++&clocks {
++ clocks = <&fin_pll>;
++};
++
+ &sdhci0 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>;
+diff --git a/arch/arm/boot/dts/s3c6410-smdk6410.dts b/arch/arm/boot/dts/s3c6410-smdk6410.dts
+index a9a5689dc462..3bf6c450a26e 100644
+--- a/arch/arm/boot/dts/s3c6410-smdk6410.dts
++++ b/arch/arm/boot/dts/s3c6410-smdk6410.dts
+@@ -69,6 +69,10 @@
+ };
+ };
+
++&clocks {
++ clocks = <&fin_pll>;
++};
++
+ &sdhci0 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>;
+diff --git a/arch/arm/mach-tegra/reset-handler.S b/arch/arm/mach-tegra/reset-handler.S
+index 805f306fa6f7..e31f167a8199 100644
+--- a/arch/arm/mach-tegra/reset-handler.S
++++ b/arch/arm/mach-tegra/reset-handler.S
+@@ -56,16 +56,16 @@ ENTRY(tegra_resume)
+ cmp r6, #TEGRA20
+ beq 1f @ Yes
+ /* Clear the flow controller flags for this CPU. */
+- cpu_to_csr_reg r1, r0
++ cpu_to_csr_reg r3, r0
+ mov32 r2, TEGRA_FLOW_CTRL_BASE
+- ldr r1, [r2, r1]
++ ldr r1, [r2, r3]
+ /* Clear event & intr flag */
+ orr r1, r1, \
+ #FLOW_CTRL_CSR_INTR_FLAG | FLOW_CTRL_CSR_EVENT_FLAG
+ movw r0, #0x3FFD @ enable, cluster_switch, immed, bitmaps
+ @ & ext flags for CPU power mgnt
+ bic r1, r1, r0
+- str r1, [r2]
++ str r1, [r2, r3]
+ 1:
+
+ mov32 r9, 0xc09
+diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
+index 0c100506a29a..5a97ac853168 100644
+--- a/arch/arm64/include/asm/assembler.h
++++ b/arch/arm64/include/asm/assembler.h
+@@ -683,9 +683,11 @@ USER(\label, ic ivau, \tmp2) // invalidate I line PoU
+ .macro if_will_cond_yield_neon
+ #ifdef CONFIG_PREEMPT
+ get_thread_info x0
+- ldr x0, [x0, #TSK_TI_PREEMPT]
+- sub x0, x0, #PREEMPT_DISABLE_OFFSET
+- cbz x0, .Lyield_\@
++ ldr w1, [x0, #TSK_TI_PREEMPT]
++ ldr x0, [x0, #TSK_TI_FLAGS]
++ cmp w1, #PREEMPT_DISABLE_OFFSET
++ csel x0, x0, xzr, eq
++ tbnz x0, #TIF_NEED_RESCHED, .Lyield_\@ // needs rescheduling?
+ /* fall through to endif_yield_neon */
+ .subsection 1
+ .Lyield_\@ :
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index bb6832353045..5f800384cb9a 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -622,8 +622,10 @@ el1_irq:
+ irq_handler
+
+ #ifdef CONFIG_PREEMPT
+- ldr x24, [tsk, #TSK_TI_PREEMPT] // get preempt count
+- cbnz x24, 1f // preempt count != 0
++ ldr w24, [tsk, #TSK_TI_PREEMPT] // get preempt count
++ cbnz w24, 1f // preempt count != 0
++ ldr x0, [tsk, #TSK_TI_FLAGS] // get flags
++ tbz x0, #TIF_NEED_RESCHED, 1f // needs rescheduling?
+ bl el1_preempt
+ 1:
+ #endif
+diff --git a/arch/xtensa/mm/tlb.c b/arch/xtensa/mm/tlb.c
+index 59153d0aa890..b43f03620843 100644
+--- a/arch/xtensa/mm/tlb.c
++++ b/arch/xtensa/mm/tlb.c
+@@ -216,6 +216,8 @@ static int check_tlb_entry(unsigned w, unsigned e, bool dtlb)
+ unsigned tlbidx = w | (e << PAGE_SHIFT);
+ unsigned r0 = dtlb ?
+ read_dtlb_virtual(tlbidx) : read_itlb_virtual(tlbidx);
++ unsigned r1 = dtlb ?
++ read_dtlb_translation(tlbidx) : read_itlb_translation(tlbidx);
+ unsigned vpn = (r0 & PAGE_MASK) | (e << PAGE_SHIFT);
+ unsigned pte = get_pte_for_vaddr(vpn);
+ unsigned mm_asid = (get_rasid_register() >> 8) & ASID_MASK;
+@@ -231,8 +233,6 @@ static int check_tlb_entry(unsigned w, unsigned e, bool dtlb)
+ }
+
+ if (tlb_asid == mm_asid) {
+- unsigned r1 = dtlb ? read_dtlb_translation(tlbidx) :
+- read_itlb_translation(tlbidx);
+ if ((pte ^ r1) & PAGE_MASK) {
+ pr_err("%cTLB: way: %u, entry: %u, mapping: %08x->%08x, PTE: %08x\n",
+ dtlb ? 'D' : 'I', w, e, r0, r1, pte);
+diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
+index 35dd06479867..91d620994123 100644
+--- a/drivers/dma-buf/sync_file.c
++++ b/drivers/dma-buf/sync_file.c
+@@ -230,7 +230,7 @@ static struct sync_file *sync_file_merge(const char *name, struct sync_file *a,
+ a_fences = get_fences(a, &a_num_fences);
+ b_fences = get_fences(b, &b_num_fences);
+ if (a_num_fences > INT_MAX - b_num_fences)
+- return NULL;
++ goto err;
+
+ num_fences = a_num_fences + b_num_fences;
+
+diff --git a/drivers/gpu/drm/meson/meson_venc_cvbs.c b/drivers/gpu/drm/meson/meson_venc_cvbs.c
+index f7945bae3b4a..e1760140e3c2 100644
+--- a/drivers/gpu/drm/meson/meson_venc_cvbs.c
++++ b/drivers/gpu/drm/meson/meson_venc_cvbs.c
+@@ -75,6 +75,25 @@ struct meson_cvbs_mode meson_cvbs_modes[MESON_CVBS_MODES_COUNT] = {
+ },
+ };
+
++static const struct meson_cvbs_mode *
++meson_cvbs_get_mode(const struct drm_display_mode *req_mode)
++{
++ int i;
++
++ for (i = 0; i < MESON_CVBS_MODES_COUNT; ++i) {
++ struct meson_cvbs_mode *meson_mode = &meson_cvbs_modes[i];
++
++ if (drm_mode_match(req_mode, &meson_mode->mode,
++ DRM_MODE_MATCH_TIMINGS |
++ DRM_MODE_MATCH_CLOCK |
++ DRM_MODE_MATCH_FLAGS |
++ DRM_MODE_MATCH_3D_FLAGS))
++ return meson_mode;
++ }
++
++ return NULL;
++}
++
+ /* Connector */
+
+ static void meson_cvbs_connector_destroy(struct drm_connector *connector)
+@@ -147,14 +166,8 @@ static int meson_venc_cvbs_encoder_atomic_check(struct drm_encoder *encoder,
+ struct drm_crtc_state *crtc_state,
+ struct drm_connector_state *conn_state)
+ {
+- int i;
+-
+- for (i = 0; i < MESON_CVBS_MODES_COUNT; ++i) {
+- struct meson_cvbs_mode *meson_mode = &meson_cvbs_modes[i];
+-
+- if (drm_mode_equal(&crtc_state->mode, &meson_mode->mode))
+- return 0;
+- }
++ if (meson_cvbs_get_mode(&crtc_state->mode))
++ return 0;
+
+ return -EINVAL;
+ }
+@@ -192,24 +205,17 @@ static void meson_venc_cvbs_encoder_mode_set(struct drm_encoder *encoder,
+ struct drm_display_mode *mode,
+ struct drm_display_mode *adjusted_mode)
+ {
++ const struct meson_cvbs_mode *meson_mode = meson_cvbs_get_mode(mode);
+ struct meson_venc_cvbs *meson_venc_cvbs =
+ encoder_to_meson_venc_cvbs(encoder);
+ struct meson_drm *priv = meson_venc_cvbs->priv;
+- int i;
+
+- for (i = 0; i < MESON_CVBS_MODES_COUNT; ++i) {
+- struct meson_cvbs_mode *meson_mode = &meson_cvbs_modes[i];
++ if (meson_mode) {
++ meson_venci_cvbs_mode_set(priv, meson_mode->enci);
+
+- if (drm_mode_equal(mode, &meson_mode->mode)) {
+- meson_venci_cvbs_mode_set(priv,
+- meson_mode->enci);
+-
+- /* Setup 27MHz vclk2 for ENCI and VDAC */
+- meson_vclk_setup(priv, MESON_VCLK_TARGET_CVBS,
+- MESON_VCLK_CVBS, MESON_VCLK_CVBS,
+- MESON_VCLK_CVBS, true);
+- break;
+- }
++ /* Setup 27MHz vclk2 for ENCI and VDAC */
++ meson_vclk_setup(priv, MESON_VCLK_TARGET_CVBS, MESON_VCLK_CVBS,
++ MESON_VCLK_CVBS, MESON_VCLK_CVBS, true);
+ }
+ }
+
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index 7d39ed63e5be..b24401f21e93 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -1820,8 +1820,8 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
+ track->textures[i].use_pitch = 1;
+ } else {
+ track->textures[i].use_pitch = 0;
+- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK);
+- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK);
++ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT);
++ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT);
+ }
+ if (idx_value & RADEON_TXFORMAT_CUBIC_MAP_ENABLE)
+ track->textures[i].tex_coord_type = 2;
+diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
+index c22321cc5a41..c2b506c707a2 100644
+--- a/drivers/gpu/drm/radeon/r200.c
++++ b/drivers/gpu/drm/radeon/r200.c
+@@ -476,8 +476,8 @@ int r200_packet0_check(struct radeon_cs_parser *p,
+ track->textures[i].use_pitch = 1;
+ } else {
+ track->textures[i].use_pitch = 0;
+- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK);
+- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK);
++ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT);
++ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT);
+ }
+ if (idx_value & R200_TXFORMAT_LOOKUP_DISABLE)
+ track->textures[i].lookup_disable = true;
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 481e54ded9dc..def4f6ec290b 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -609,45 +609,10 @@ static struct pgpath *__map_bio(struct multipath *m, struct bio *bio)
+ return pgpath;
+ }
+
+-static struct pgpath *__map_bio_fast(struct multipath *m, struct bio *bio)
+-{
+- struct pgpath *pgpath;
+- unsigned long flags;
+-
+- /* Do we need to select a new pgpath? */
+- /*
+- * FIXME: currently only switching path if no path (due to failure, etc)
+- * - which negates the point of using a path selector
+- */
+- pgpath = READ_ONCE(m->current_pgpath);
+- if (!pgpath)
+- pgpath = choose_pgpath(m, bio->bi_iter.bi_size);
+-
+- if (!pgpath) {
+- if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
+- /* Queue for the daemon to resubmit */
+- spin_lock_irqsave(&m->lock, flags);
+- bio_list_add(&m->queued_bios, bio);
+- spin_unlock_irqrestore(&m->lock, flags);
+- queue_work(kmultipathd, &m->process_queued_bios);
+-
+- return ERR_PTR(-EAGAIN);
+- }
+- return NULL;
+- }
+-
+- return pgpath;
+-}
+-
+ static int __multipath_map_bio(struct multipath *m, struct bio *bio,
+ struct dm_mpath_io *mpio)
+ {
+- struct pgpath *pgpath;
+-
+- if (!m->hw_handler_name)
+- pgpath = __map_bio_fast(m, bio);
+- else
+- pgpath = __map_bio(m, bio);
++ struct pgpath *pgpath = __map_bio(m, bio);
+
+ if (IS_ERR(pgpath))
+ return DM_MAPIO_SUBMITTED;
+diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
+index 21ea537bd55e..eff04fa23dfa 100644
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -203,7 +203,13 @@ static void __rebalance2(struct dm_btree_info *info, struct btree_node *parent,
+ struct btree_node *right = r->n;
+ uint32_t nr_left = le32_to_cpu(left->header.nr_entries);
+ uint32_t nr_right = le32_to_cpu(right->header.nr_entries);
+- unsigned threshold = 2 * merge_threshold(left) + 1;
++ /*
++ * Ensure the number of entries in each child will be greater
++ * than or equal to (max_entries / 3 + 1), so no matter which
++ * child is used for removal, the number will still be not
++ * less than (max_entries / 3).
++ */
++ unsigned int threshold = 2 * (merge_threshold(left) + 1);
+
+ if (nr_left + nr_right < threshold) {
+ /*
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 527ab15c421f..60eac66dc9f0 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -409,38 +409,6 @@ static int mmc_blk_ioctl_copy_to_user(struct mmc_ioc_cmd __user *ic_ptr,
+ return 0;
+ }
+
+-static int ioctl_rpmb_card_status_poll(struct mmc_card *card, u32 *status,
+- u32 retries_max)
+-{
+- int err;
+- u32 retry_count = 0;
+-
+- if (!status || !retries_max)
+- return -EINVAL;
+-
+- do {
+- err = __mmc_send_status(card, status, 5);
+- if (err)
+- break;
+-
+- if (!R1_STATUS(*status) &&
+- (R1_CURRENT_STATE(*status) != R1_STATE_PRG))
+- break; /* RPMB programming operation complete */
+-
+- /*
+- * Rechedule to give the MMC device a chance to continue
+- * processing the previous command without being polled too
+- * frequently.
+- */
+- usleep_range(1000, 5000);
+- } while (++retry_count < retries_max);
+-
+- if (retry_count == retries_max)
+- err = -EPERM;
+-
+- return err;
+-}
+-
+ static int ioctl_do_sanitize(struct mmc_card *card)
+ {
+ int err;
+@@ -469,6 +437,58 @@ out:
+ return err;
+ }
+
++static inline bool mmc_blk_in_tran_state(u32 status)
++{
++ /*
++ * Some cards mishandle the status bits, so make sure to check both the
++ * busy indication and the card state.
++ */
++ return status & R1_READY_FOR_DATA &&
++ (R1_CURRENT_STATE(status) == R1_STATE_TRAN);
++}
++
++static int card_busy_detect(struct mmc_card *card, unsigned int timeout_ms,
++ u32 *resp_errs)
++{
++ unsigned long timeout = jiffies + msecs_to_jiffies(timeout_ms);
++ int err = 0;
++ u32 status;
++
++ do {
++ bool done = time_after(jiffies, timeout);
++
++ err = __mmc_send_status(card, &status, 5);
++ if (err) {
++ dev_err(mmc_dev(card->host),
++ "error %d requesting status\n", err);
++ return err;
++ }
++
++ /* Accumulate any response error bits seen */
++ if (resp_errs)
++ *resp_errs |= status;
++
++ /*
++ * Timeout if the device never becomes ready for data and never
++ * leaves the program state.
++ */
++ if (done) {
++ dev_err(mmc_dev(card->host),
++ "Card stuck in wrong state! %s status: %#x\n",
++ __func__, status);
++ return -ETIMEDOUT;
++ }
++
++ /*
++ * Some cards mishandle the status bits,
++ * so make sure to check both the busy
++ * indication and the card state.
++ */
++ } while (!mmc_blk_in_tran_state(status));
++
++ return err;
++}
++
+ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ struct mmc_blk_ioc_data *idata)
+ {
+@@ -478,7 +498,6 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ struct scatterlist sg;
+ int err;
+ unsigned int target_part;
+- u32 status = 0;
+
+ if (!card || !md || !idata)
+ return -EINVAL;
+@@ -612,16 +631,12 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+
+ memcpy(&(idata->ic.response), cmd.resp, sizeof(cmd.resp));
+
+- if (idata->rpmb) {
++ if (idata->rpmb || (cmd.flags & MMC_RSP_R1B)) {
+ /*
+- * Ensure RPMB command has completed by polling CMD13
++ * Ensure RPMB/R1B command has completed by polling CMD13
+ * "Send Status".
+ */
+- err = ioctl_rpmb_card_status_poll(card, &status, 5);
+- if (err)
+- dev_err(mmc_dev(card->host),
+- "%s: Card Status=0x%08X, error %d\n",
+- __func__, status, err);
++ err = card_busy_detect(card, MMC_BLK_TIMEOUT_MS, NULL);
+ }
+
+ return err;
+@@ -971,58 +986,6 @@ static unsigned int mmc_blk_data_timeout_ms(struct mmc_host *host,
+ return ms;
+ }
+
+-static inline bool mmc_blk_in_tran_state(u32 status)
+-{
+- /*
+- * Some cards mishandle the status bits, so make sure to check both the
+- * busy indication and the card state.
+- */
+- return status & R1_READY_FOR_DATA &&
+- (R1_CURRENT_STATE(status) == R1_STATE_TRAN);
+-}
+-
+-static int card_busy_detect(struct mmc_card *card, unsigned int timeout_ms,
+- struct request *req, u32 *resp_errs)
+-{
+- unsigned long timeout = jiffies + msecs_to_jiffies(timeout_ms);
+- int err = 0;
+- u32 status;
+-
+- do {
+- bool done = time_after(jiffies, timeout);
+-
+- err = __mmc_send_status(card, &status, 5);
+- if (err) {
+- pr_err("%s: error %d requesting status\n",
+- req->rq_disk->disk_name, err);
+- return err;
+- }
+-
+- /* Accumulate any response error bits seen */
+- if (resp_errs)
+- *resp_errs |= status;
+-
+- /*
+- * Timeout if the device never becomes ready for data and never
+- * leaves the program state.
+- */
+- if (done) {
+- pr_err("%s: Card stuck in wrong state! %s %s status: %#x\n",
+- mmc_hostname(card->host),
+- req->rq_disk->disk_name, __func__, status);
+- return -ETIMEDOUT;
+- }
+-
+- /*
+- * Some cards mishandle the status bits,
+- * so make sure to check both the busy
+- * indication and the card state.
+- */
+- } while (!mmc_blk_in_tran_state(status));
+-
+- return err;
+-}
+-
+ static int mmc_blk_reset(struct mmc_blk_data *md, struct mmc_host *host,
+ int type)
+ {
+@@ -1678,7 +1641,7 @@ static int mmc_blk_fix_state(struct mmc_card *card, struct request *req)
+
+ mmc_blk_send_stop(card, timeout);
+
+- err = card_busy_detect(card, timeout, req, NULL);
++ err = card_busy_detect(card, timeout, NULL);
+
+ mmc_retune_release(card->host);
+
+@@ -1902,7 +1865,7 @@ static int mmc_blk_card_busy(struct mmc_card *card, struct request *req)
+ if (mmc_host_is_spi(card->host) || rq_data_dir(req) == READ)
+ return 0;
+
+- err = card_busy_detect(card, MMC_BLK_TIMEOUT_MS, req, &status);
++ err = card_busy_detect(card, MMC_BLK_TIMEOUT_MS, &status);
+
+ /*
+ * Do not assume data transferred correctly if there are any error bits
+diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+index e337da6ba2a4..8ae28f82aafd 100644
+--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+@@ -1118,7 +1118,7 @@ static int bgx_lmac_enable(struct bgx *bgx, u8 lmacid)
+ phy_interface_mode(lmac->lmac_type)))
+ return -ENODEV;
+
+- phy_start_aneg(lmac->phydev);
++ phy_start(lmac->phydev);
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+index 4ab0d030b544..28d56e44ed9d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+@@ -155,8 +155,11 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
+ }
+
+ if (port_buffer->buffer[i].size <
+- (xoff + max_mtu + (1 << MLX5E_BUFFER_CELL_SHIFT)))
++ (xoff + max_mtu + (1 << MLX5E_BUFFER_CELL_SHIFT))) {
++ pr_err("buffer_size[%d]=%d is not enough for lossless buffer\n",
++ i, port_buffer->buffer[i].size);
+ return -ENOMEM;
++ }
+
+ port_buffer->buffer[i].xoff = port_buffer->buffer[i].size - xoff;
+ port_buffer->buffer[i].xon =
+@@ -232,6 +235,26 @@ static int update_buffer_lossy(unsigned int max_mtu,
+ return 0;
+ }
+
++static int fill_pfc_en(struct mlx5_core_dev *mdev, u8 *pfc_en)
++{
++ u32 g_rx_pause, g_tx_pause;
++ int err;
++
++ err = mlx5_query_port_pause(mdev, &g_rx_pause, &g_tx_pause);
++ if (err)
++ return err;
++
++ /* If global pause enabled, set all active buffers to lossless.
++ * Otherwise, check PFC setting.
++ */
++ if (g_rx_pause || g_tx_pause)
++ *pfc_en = 0xff;
++ else
++ err = mlx5_query_port_pfc(mdev, pfc_en, NULL);
++
++ return err;
++}
++
+ #define MINIMUM_MAX_MTU 9216
+ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ u32 change, unsigned int mtu,
+@@ -277,7 +300,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+
+ if (change & MLX5E_PORT_BUFFER_PRIO2BUFFER) {
+ update_prio2buffer = true;
+- err = mlx5_query_port_pfc(priv->mdev, &curr_pfc_en, NULL);
++ err = fill_pfc_en(priv->mdev, &curr_pfc_en);
+ if (err)
+ return err;
+
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index 8417d4c17844..0b7a3eb06a65 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -954,8 +954,8 @@ static irqreturn_t cpsw_rx_interrupt(int irq, void *dev_id)
+ {
+ struct cpsw_common *cpsw = dev_id;
+
+- cpdma_ctlr_eoi(cpsw->dma, CPDMA_EOI_RX);
+ writel(0, &cpsw->wr_regs->rx_en);
++ cpdma_ctlr_eoi(cpsw->dma, CPDMA_EOI_RX);
+
+ if (cpsw->quirk_irq) {
+ disable_irq_nosync(cpsw->irqs_table[0]);
+diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
+index 811cf83f956d..ef6071807072 100644
+--- a/drivers/pci/hotplug/pciehp.h
++++ b/drivers/pci/hotplug/pciehp.h
+@@ -106,6 +106,7 @@ struct slot {
+ * that has not yet been cleared by the user
+ * @pending_events: used by the IRQ handler to save events retrieved from the
+ * Slot Status register for later consumption by the IRQ thread
++ * @ist_running: flag to keep user request waiting while IRQ thread is running
+ * @request_result: result of last user request submitted to the IRQ thread
+ * @requester: wait queue to wake up on completion of user request,
+ * used for synchronous slot enable/disable request via sysfs
+@@ -125,6 +126,7 @@ struct controller {
+ unsigned int notification_enabled:1;
+ unsigned int power_fault_detected;
+ atomic_t pending_events;
++ unsigned int ist_running;
+ int request_result;
+ wait_queue_head_t requester;
+ };
+diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
+index 9c397fa8704c..c71964e29b01 100644
+--- a/drivers/pci/hotplug/pciehp_ctrl.c
++++ b/drivers/pci/hotplug/pciehp_ctrl.c
+@@ -383,7 +383,8 @@ int pciehp_sysfs_enable_slot(struct slot *p_slot)
+ ctrl->request_result = -ENODEV;
+ pciehp_request(ctrl, PCI_EXP_SLTSTA_PDC);
+ wait_event(ctrl->requester,
+- !atomic_read(&ctrl->pending_events));
++ !atomic_read(&ctrl->pending_events) &&
++ !ctrl->ist_running);
+ return ctrl->request_result;
+ case POWERON_STATE:
+ ctrl_info(ctrl, "Slot(%s): Already in powering on state\n",
+@@ -416,7 +417,8 @@ int pciehp_sysfs_disable_slot(struct slot *p_slot)
+ mutex_unlock(&p_slot->lock);
+ pciehp_request(ctrl, DISABLE_SLOT);
+ wait_event(ctrl->requester,
+- !atomic_read(&ctrl->pending_events));
++ !atomic_read(&ctrl->pending_events) &&
++ !ctrl->ist_running);
+ return ctrl->request_result;
+ case POWEROFF_STATE:
+ ctrl_info(ctrl, "Slot(%s): Already in powering off state\n",
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index a938abdb41ce..c3e3f5358b3b 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -620,6 +620,7 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
+ irqreturn_t ret;
+ u32 events;
+
++ ctrl->ist_running = true;
+ pci_config_pm_runtime_get(pdev);
+
+ /* rerun pciehp_isr() if the port was inaccessible on interrupt */
+@@ -666,6 +667,7 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
+ up_read(&ctrl->reset_lock);
+
+ pci_config_pm_runtime_put(pdev);
++ ctrl->ist_running = false;
+ wake_up(&ctrl->requester);
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index 971dddf62374..23a363fd4c59 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -211,7 +211,7 @@ u32 __pci_msix_desc_mask_irq(struct msi_desc *desc, u32 flag)
+ return 0;
+
+ mask_bits &= ~PCI_MSIX_ENTRY_CTRL_MASKBIT;
+- if (flag)
++ if (flag & PCI_MSIX_ENTRY_CTRL_MASKBIT)
+ mask_bits |= PCI_MSIX_ENTRY_CTRL_MASKBIT;
+ writel(mask_bits, pci_msix_desc_addr(desc) + PCI_MSIX_ENTRY_VECTOR_CTRL);
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index ec317bcb1bca..bc1ff41ce3d3 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1042,17 +1042,22 @@ static int pci_pm_thaw_noirq(struct device *dev)
+ return error;
+ }
+
+- if (pci_has_legacy_pm_support(pci_dev))
+- return pci_legacy_resume_early(dev);
+-
+ /*
+- * pci_restore_state() requires the device to be in D0 (because of MSI
+- * restoration among other things), so force it into D0 in case the
+- * driver's "freeze" callbacks put it into a low-power state directly.
++ * Both the legacy ->resume_early() and the new pm->thaw_noirq()
++ * callbacks assume the device has been returned to D0 and its
++ * config state has been restored.
++ *
++ * In addition, pci_restore_state() restores MSI-X state in MMIO
++ * space, which requires the device to be in D0, so return it to D0
++ * in case the driver's "freeze" callbacks put it into a low-power
++ * state.
+ */
+ pci_set_power_state(pci_dev, PCI_D0);
+ pci_restore_state(pci_dev);
+
++ if (pci_has_legacy_pm_support(pci_dev))
++ return pci_legacy_resume_early(dev);
++
+ if (drv && drv->pm && drv->pm->thaw_noirq)
+ error = drv->pm->thaw_noirq(dev);
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 64933994f772..20a57a48ae1e 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4219,15 +4219,21 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags)
+
+ static bool pci_quirk_cavium_acs_match(struct pci_dev *dev)
+ {
++ if (!pci_is_pcie(dev) || pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT)
++ return false;
++
++ switch (dev->device) {
+ /*
+- * Effectively selects all downstream ports for whole ThunderX 1
+- * family by 0xf800 mask (which represents 8 SoCs), while the lower
+- * bits of device ID are used to indicate which subdevice is used
+- * within the SoC.
++ * Effectively selects all downstream ports for whole ThunderX1
++ * (which represents 8 SoCs).
+ */
+- return (pci_is_pcie(dev) &&
+- (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) &&
+- ((dev->device & 0xf800) == 0xa000));
++ case 0xa000 ... 0xa7ff: /* ThunderX1 */
++ case 0xaf84: /* ThunderX2 */
++ case 0xb884: /* ThunderX3 */
++ return true;
++ default:
++ return false;
++ }
+ }
+
+ static int pci_quirk_cavium_acs(struct pci_dev *dev, u16 acs_flags)
+@@ -4576,7 +4582,7 @@ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags)
+ #define INTEL_BSPR_REG_BPPD (1 << 9)
+
+ /* Upstream Peer Decode Configuration Register */
+-#define INTEL_UPDCR_REG 0x1114
++#define INTEL_UPDCR_REG 0x1014
+ /* 5:0 Peer Decode Enable bits */
+ #define INTEL_UPDCR_REG_MASK 0x3f
+
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index e2ce4e638258..25c394a7077b 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -241,10 +241,31 @@ static void qcom_glink_channel_release(struct kref *ref)
+ {
+ struct glink_channel *channel = container_of(ref, struct glink_channel,
+ refcount);
++ struct glink_core_rx_intent *intent;
++ struct glink_core_rx_intent *tmp;
+ unsigned long flags;
++ int iid;
++
++ /* cancel pending rx_done work */
++ cancel_work_sync(&channel->intent_work);
+
+ spin_lock_irqsave(&channel->intent_lock, flags);
++ /* Free all non-reuse intents pending rx_done work */
++ list_for_each_entry_safe(intent, tmp, &channel->done_intents, node) {
++ if (!intent->reuse) {
++ kfree(intent->data);
++ kfree(intent);
++ }
++ }
++
++ idr_for_each_entry(&channel->liids, tmp, iid) {
++ kfree(tmp->data);
++ kfree(tmp);
++ }
+ idr_destroy(&channel->liids);
++
++ idr_for_each_entry(&channel->riids, tmp, iid)
++ kfree(tmp);
+ idr_destroy(&channel->riids);
+ spin_unlock_irqrestore(&channel->intent_lock, flags);
+
+@@ -1097,13 +1118,12 @@ static int qcom_glink_create_remote(struct qcom_glink *glink,
+ close_link:
+ /*
+ * Send a close request to "undo" our open-ack. The close-ack will
+- * release the last reference.
++ * release qcom_glink_send_open_req() reference and the last reference
++ * will be relesed after receiving remote_close or transport unregister
++ * by calling qcom_glink_native_remove().
+ */
+ qcom_glink_send_close_req(glink, channel);
+
+- /* Release qcom_glink_send_open_req() reference */
+- kref_put(&channel->refcount, qcom_glink_channel_release);
+-
+ return ret;
+ }
+
+@@ -1418,15 +1438,13 @@ static int qcom_glink_rx_open(struct qcom_glink *glink, unsigned int rcid,
+
+ ret = rpmsg_register_device(rpdev);
+ if (ret)
+- goto free_rpdev;
++ goto rcid_remove;
+
+ channel->rpdev = rpdev;
+ }
+
+ return 0;
+
+-free_rpdev:
+- kfree(rpdev);
+ rcid_remove:
+ spin_lock_irqsave(&glink->idr_lock, flags);
+ idr_remove(&glink->rcids, channel->rcid);
+@@ -1547,6 +1565,18 @@ static void qcom_glink_work(struct work_struct *work)
+ }
+ }
+
++static void qcom_glink_cancel_rx_work(struct qcom_glink *glink)
++{
++ struct glink_defer_cmd *dcmd;
++ struct glink_defer_cmd *tmp;
++
++ /* cancel any pending deferred rx_work */
++ cancel_work_sync(&glink->rx_work);
++
++ list_for_each_entry_safe(dcmd, tmp, &glink->rx_queue, node)
++ kfree(dcmd);
++}
++
+ struct qcom_glink *qcom_glink_native_probe(struct device *dev,
+ unsigned long features,
+ struct qcom_glink_pipe *rx,
+@@ -1622,23 +1652,24 @@ void qcom_glink_native_remove(struct qcom_glink *glink)
+ struct glink_channel *channel;
+ int cid;
+ int ret;
+- unsigned long flags;
+
+ disable_irq(glink->irq);
+- cancel_work_sync(&glink->rx_work);
++ qcom_glink_cancel_rx_work(glink);
+
+ ret = device_for_each_child(glink->dev, NULL, qcom_glink_remove_device);
+ if (ret)
+ dev_warn(glink->dev, "Can't remove GLINK devices: %d\n", ret);
+
+- spin_lock_irqsave(&glink->idr_lock, flags);
+ /* Release any defunct local channels, waiting for close-ack */
+ idr_for_each_entry(&glink->lcids, channel, cid)
+ kref_put(&channel->refcount, qcom_glink_channel_release);
+
++ /* Release any defunct local channels, waiting for close-req */
++ idr_for_each_entry(&glink->rcids, channel, cid)
++ kref_put(&channel->refcount, qcom_glink_channel_release);
++
+ idr_destroy(&glink->lcids);
+ idr_destroy(&glink->rcids);
+- spin_unlock_irqrestore(&glink->idr_lock, flags);
+ mbox_free_channel(glink->mbox_chan);
+ }
+ EXPORT_SYMBOL_GPL(qcom_glink_native_remove);
+diff --git a/drivers/rpmsg/qcom_glink_smem.c b/drivers/rpmsg/qcom_glink_smem.c
+index 7b6544348a3e..bbd5759cc38e 100644
+--- a/drivers/rpmsg/qcom_glink_smem.c
++++ b/drivers/rpmsg/qcom_glink_smem.c
+@@ -105,7 +105,7 @@ static void glink_smem_rx_advance(struct qcom_glink_pipe *np,
+ tail = le32_to_cpu(*pipe->tail);
+
+ tail += count;
+- if (tail > pipe->native.length)
++ if (tail >= pipe->native.length)
+ tail -= pipe->native.length;
+
+ *pipe->tail = cpu_to_le32(tail);
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 4ad61cfa69c0..7a05c7271766 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -1983,7 +1983,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc)
+
+ ISCSI_DBG_EH(session, "scsi cmd %p timedout\n", sc);
+
+- spin_lock(&session->frwd_lock);
++ spin_lock_bh(&session->frwd_lock);
+ task = (struct iscsi_task *)sc->SCp.ptr;
+ if (!task) {
+ /*
+@@ -2110,7 +2110,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc)
+ done:
+ if (task)
+ task->last_timeout = jiffies;
+- spin_unlock(&session->frwd_lock);
++ spin_unlock_bh(&session->frwd_lock);
+ ISCSI_DBG_EH(session, "return %s\n", rc == BLK_EH_RESET_TIMER ?
+ "timer reset" : "shutdown or nh");
+ return rc;
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index d734dcf517b9..4512aaa16f78 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -966,6 +966,7 @@ int qla24xx_post_gnl_work(struct scsi_qla_host *vha, fc_port_t *fcport)
+
+ e->u.fcport.fcport = fcport;
+ fcport->flags |= FCF_ASYNC_ACTIVE;
++ fcport->disc_state = DSC_LOGIN_PEND;
+ return qla2x00_post_work(vha, e);
+ }
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 02843c16f9c7..8f180bf7561a 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -868,6 +868,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ status |= USB_PORT_STAT_C_BH_RESET << 16;
+ if ((raw_port_status & PORT_CEC))
+ status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
++
++ /* USB3 remote wake resume signaling completed */
++ if (bus_state->port_remote_wakeup & (1 << wIndex) &&
++ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME &&
++ (raw_port_status & PORT_PLS_MASK) != XDEV_RECOVERY) {
++ bus_state->port_remote_wakeup &= ~(1 << wIndex);
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
++ }
+ }
+
+ if (hcd->speed < HCD_USB3) {
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index b03974958a28..98b67605d3cf 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1609,7 +1609,6 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ slot_id = xhci_find_slot_id_by_port(hcd, xhci, hcd_portnum + 1);
+ if (slot_id && xhci->devs[slot_id])
+ xhci->devs[slot_id]->flags |= VDEV_PORT_ERROR;
+- bus_state->port_remote_wakeup &= ~(1 << hcd_portnum);
+ }
+
+ if ((portsc & PORT_PLC) && (portsc & PORT_PLS_MASK) == XDEV_RESUME) {
+@@ -1630,6 +1629,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ bus_state->port_remote_wakeup |= 1 << hcd_portnum;
+ xhci_test_and_clear_bit(xhci, port, PORT_PLC);
+ xhci_set_link_state(xhci, port, XDEV_U0);
++ usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
+ /* Need to wait until the next link state change
+ * indicates the device is actually in U0.
+ */
+@@ -1669,7 +1669,6 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ if (slot_id && xhci->devs[slot_id])
+ xhci_ring_device(xhci, slot_id);
+ if (bus_state->port_remote_wakeup & (1 << hcd_portnum)) {
+- bus_state->port_remote_wakeup &= ~(1 << hcd_portnum);
+ xhci_test_and_clear_bit(xhci, port, PORT_PLC);
+ usb_wakeup_notification(hcd->self.root_hub,
+ hcd_portnum + 1);
+diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
+index 1c46045b0e7f..94594dc63c41 100644
+--- a/drivers/vfio/pci/vfio_pci_intrs.c
++++ b/drivers/vfio/pci/vfio_pci_intrs.c
+@@ -297,8 +297,8 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,
+ irq = pci_irq_vector(pdev, vector);
+
+ if (vdev->ctx[vector].trigger) {
+- free_irq(irq, vdev->ctx[vector].trigger);
+ irq_bypass_unregister_producer(&vdev->ctx[vector].producer);
++ free_irq(irq, vdev->ctx[vector].trigger);
+ kfree(vdev->ctx[vector].name);
+ eventfd_ctx_put(vdev->ctx[vector].trigger);
+ vdev->ctx[vector].trigger = NULL;
+diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
+index 06576797cf31..a85aeff90df8 100644
+--- a/fs/cifs/cifs_debug.c
++++ b/fs/cifs/cifs_debug.c
+@@ -210,6 +210,11 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
+ if (!server->rdma)
+ goto skip_rdma;
+
++ if (!server->smbd_conn) {
++ seq_printf(m, "\nSMBDirect transport not available");
++ goto skip_rdma;
++ }
++
+ seq_printf(m, "\nSMBDirect (in hex) protocol version: %x "
+ "transport status: %x",
+ server->smbd_conn->protocol,
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 455d0282363f..ad93b063f866 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -726,6 +726,13 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush)
+ if (backup_cred(cifs_sb))
+ create_options |= CREATE_OPEN_BACKUP_INTENT;
+
++ /* O_SYNC also has bit for O_DSYNC so following check picks up either */
++ if (cfile->f_flags & O_SYNC)
++ create_options |= CREATE_WRITE_THROUGH;
++
++ if (cfile->f_flags & O_DIRECT)
++ create_options |= CREATE_NO_BUFFER;
++
+ if (server->ops->get_lease_key)
+ server->ops->get_lease_key(inode, &cfile->fid);
+
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 449d1584ff72..766974fe637a 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -743,36 +743,67 @@ smb2_cancelled_close_fid(struct work_struct *work)
+ kfree(cancelled);
+ }
+
++/* Caller should already has an extra reference to @tcon */
++static int
++__smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid,
++ __u64 volatile_fid)
++{
++ struct close_cancelled_open *cancelled;
++
++ cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL);
++ if (!cancelled)
++ return -ENOMEM;
++
++ cancelled->fid.persistent_fid = persistent_fid;
++ cancelled->fid.volatile_fid = volatile_fid;
++ cancelled->tcon = tcon;
++ INIT_WORK(&cancelled->work, smb2_cancelled_close_fid);
++ WARN_ON(queue_work(cifsiod_wq, &cancelled->work) == false);
++
++ return 0;
++}
++
++int
++smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid,
++ __u64 volatile_fid)
++{
++ int rc;
++
++ cifs_dbg(FYI, "%s: tc_count=%d\n", __func__, tcon->tc_count);
++ spin_lock(&cifs_tcp_ses_lock);
++ tcon->tc_count++;
++ spin_unlock(&cifs_tcp_ses_lock);
++
++ rc = __smb2_handle_cancelled_close(tcon, persistent_fid, volatile_fid);
++ if (rc)
++ cifs_put_tcon(tcon);
++
++ return rc;
++}
++
+ int
+ smb2_handle_cancelled_mid(char *buffer, struct TCP_Server_Info *server)
+ {
+ struct smb2_sync_hdr *sync_hdr = (struct smb2_sync_hdr *)buffer;
+ struct smb2_create_rsp *rsp = (struct smb2_create_rsp *)buffer;
+ struct cifs_tcon *tcon;
+- struct close_cancelled_open *cancelled;
++ int rc;
+
+ if (sync_hdr->Command != SMB2_CREATE ||
+ sync_hdr->Status != STATUS_SUCCESS)
+ return 0;
+
+- cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL);
+- if (!cancelled)
+- return -ENOMEM;
+-
+ tcon = smb2_find_smb_tcon(server, sync_hdr->SessionId,
+ sync_hdr->TreeId);
+- if (!tcon) {
+- kfree(cancelled);
++ if (!tcon)
+ return -ENOENT;
+- }
+
+- cancelled->fid.persistent_fid = rsp->PersistentFileId;
+- cancelled->fid.volatile_fid = rsp->VolatileFileId;
+- cancelled->tcon = tcon;
+- INIT_WORK(&cancelled->work, smb2_cancelled_close_fid);
+- queue_work(cifsiod_wq, &cancelled->work);
++ rc = __smb2_handle_cancelled_close(tcon, rsp->PersistentFileId,
++ rsp->VolatileFileId);
++ if (rc)
++ cifs_put_tcon(tcon);
+
+- return 0;
++ return rc;
+ }
+
+ /**
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 4563699bbe6c..43f29621e51f 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2629,7 +2629,21 @@ int
+ SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
+ u64 persistent_fid, u64 volatile_fid)
+ {
+- return SMB2_close_flags(xid, tcon, persistent_fid, volatile_fid, 0);
++ int rc;
++ int tmp_rc;
++
++ rc = SMB2_close_flags(xid, tcon, persistent_fid, volatile_fid, 0);
++
++ /* retry close in a worker thread if this one is interrupted */
++ if (rc == -EINTR) {
++ tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid,
++ volatile_fid);
++ if (tmp_rc)
++ cifs_dbg(VFS, "handle cancelled close fid 0x%llx returned error %d\n",
++ persistent_fid, tmp_rc);
++ }
++
++ return rc;
+ }
+
+ int
+diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
+index b4076577eeb7..c66d7da80330 100644
+--- a/fs/cifs/smb2proto.h
++++ b/fs/cifs/smb2proto.h
+@@ -204,6 +204,9 @@ extern int SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
+ extern int SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
+ const u64 persistent_fid, const u64 volatile_fid,
+ const __u8 oplock_level);
++extern int smb2_handle_cancelled_close(struct cifs_tcon *tcon,
++ __u64 persistent_fid,
++ __u64 volatile_fid);
+ extern int smb2_handle_cancelled_mid(char *buffer,
+ struct TCP_Server_Info *server);
+ void smb2_cancelled_close_fid(struct work_struct *work);
+diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
+index 1959931e14c1..784628ec4bc4 100644
+--- a/fs/cifs/smbdirect.c
++++ b/fs/cifs/smbdirect.c
+@@ -1164,7 +1164,7 @@ static int smbd_post_send_data(
+
+ if (n_vec > SMBDIRECT_MAX_SGE) {
+ cifs_dbg(VFS, "Can't fit data to SGL, n_vec=%d\n", n_vec);
+- return -ENOMEM;
++ return -EINVAL;
+ }
+
+ sg_init_table(sgl, n_vec);
+@@ -1491,6 +1491,7 @@ void smbd_destroy(struct smbd_connection *info)
+ info->transport_status == SMBD_DESTROYED);
+
+ destroy_workqueue(info->workqueue);
++ log_rdma_event(INFO, "rdma session destroyed\n");
+ kfree(info);
+ }
+
+@@ -1528,8 +1529,9 @@ create_conn:
+ log_rdma_event(INFO, "creating rdma session\n");
+ server->smbd_conn = smbd_get_connection(
+ server, (struct sockaddr *) &server->dstaddr);
+- log_rdma_event(INFO, "created rdma session info=%p\n",
+- server->smbd_conn);
++
++ if (server->smbd_conn)
++ cifs_dbg(VFS, "RDMA transport re-established\n");
+
+ return server->smbd_conn ? 0 : -ENOENT;
+ }
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index fe77f41bff9f..0c4df56c825a 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -286,8 +286,11 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
+ int val = 1;
+ __be32 rfc1002_marker;
+
+- if (cifs_rdma_enabled(server) && server->smbd_conn) {
+- rc = smbd_send(server, num_rqst, rqst);
++ if (cifs_rdma_enabled(server)) {
++ /* return -EAGAIN when connecting or reconnecting */
++ rc = -EAGAIN;
++ if (server->smbd_conn)
++ rc = smbd_send(server, num_rqst, rqst);
+ goto smbd_done;
+ }
+ if (ssocket == NULL)
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 5ada5fd9652d..9dfa0ae173ac 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1834,6 +1834,11 @@ struct net_device {
+ unsigned char if_port;
+ unsigned char dma;
+
++ /* Note : dev->mtu is often read without holding a lock.
++ * Writers usually hold RTNL.
++ * It is recommended to use READ_ONCE() to annotate the reads,
++ * and to use WRITE_ONCE() to annotate the writes.
++ */
+ unsigned int mtu;
+ unsigned int min_mtu;
+ unsigned int max_mtu;
+diff --git a/include/linux/time.h b/include/linux/time.h
+index 27d83fd2ae61..5f3e49978837 100644
+--- a/include/linux/time.h
++++ b/include/linux/time.h
+@@ -96,4 +96,17 @@ static inline bool itimerspec64_valid(const struct itimerspec64 *its)
+ */
+ #define time_after32(a, b) ((s32)((u32)(b) - (u32)(a)) < 0)
+ #define time_before32(b, a) time_after32(a, b)
++
++/**
++ * time_between32 - check if a 32-bit timestamp is within a given time range
++ * @t: the time which may be within [l,h]
++ * @l: the lower bound of the range
++ * @h: the higher bound of the range
++ *
++ * time_before32(t, l, h) returns true if @l <= @t <= @h. All operands are
++ * treated as 32-bit integers.
++ *
++ * Equivalent to !(time_before32(@t, @l) || time_after32(@t, @h)).
++ */
++#define time_between32(t, l, h) ((u32)(h) - (u32)(l) >= (u32)(t) - (u32)(l))
+ #endif
+diff --git a/include/net/ip.h b/include/net/ip.h
+index cfc3dd5ff085..5b29f357862d 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -692,4 +692,9 @@ int ip_misc_proc_init(void);
+ int rtm_getroute_parse_ip_proto(struct nlattr *attr, u8 *ip_proto, u8 family,
+ struct netlink_ext_ack *extack);
+
++static inline bool inetdev_valid_mtu(unsigned int mtu)
++{
++ return likely(mtu >= IPV4_MIN_MTU);
++}
++
+ #endif /* _IP_H */
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 3f4223a550d9..ac4ffe8013d8 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -485,15 +485,16 @@ static inline void tcp_synq_overflow(const struct sock *sk)
+ reuse = rcu_dereference(sk->sk_reuseport_cb);
+ if (likely(reuse)) {
+ last_overflow = READ_ONCE(reuse->synq_overflow_ts);
+- if (time_after32(now, last_overflow + HZ))
++ if (!time_between32(now, last_overflow,
++ last_overflow + HZ))
+ WRITE_ONCE(reuse->synq_overflow_ts, now);
+ return;
+ }
+ }
+
+- last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp;
+- if (time_after32(now, last_overflow + HZ))
+- tcp_sk(sk)->rx_opt.ts_recent_stamp = now;
++ last_overflow = READ_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp);
++ if (!time_between32(now, last_overflow, last_overflow + HZ))
++ WRITE_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp, now);
+ }
+
+ /* syncookies: no recent synqueue overflow on this listening socket? */
+@@ -508,13 +509,23 @@ static inline bool tcp_synq_no_recent_overflow(const struct sock *sk)
+ reuse = rcu_dereference(sk->sk_reuseport_cb);
+ if (likely(reuse)) {
+ last_overflow = READ_ONCE(reuse->synq_overflow_ts);
+- return time_after32(now, last_overflow +
+- TCP_SYNCOOKIE_VALID);
++ return !time_between32(now, last_overflow - HZ,
++ last_overflow +
++ TCP_SYNCOOKIE_VALID);
+ }
+ }
+
+- last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp;
+- return time_after32(now, last_overflow + TCP_SYNCOOKIE_VALID);
++ last_overflow = READ_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp);
++
++ /* If last_overflow <= jiffies <= last_overflow + TCP_SYNCOOKIE_VALID,
++ * then we're under synflood. However, we have to use
++ * 'last_overflow - HZ' as lower bound. That's because a concurrent
++ * tcp_synq_overflow() could update .ts_recent_stamp after we read
++ * jiffies but before we store .ts_recent_stamp into last_overflow,
++ * which could lead to rejecting a valid syncookie.
++ */
++ return !time_between32(now, last_overflow - HZ,
++ last_overflow + TCP_SYNCOOKIE_VALID);
+ }
+
+ static inline u32 tcp_cookie_time(void)
+diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
+index e682a668ce57..9ce661e2590d 100644
+--- a/net/bridge/br_device.c
++++ b/net/bridge/br_device.c
+@@ -246,6 +246,12 @@ static int br_set_mac_address(struct net_device *dev, void *p)
+ if (!is_valid_ether_addr(addr->sa_data))
+ return -EADDRNOTAVAIL;
+
++ /* dev_set_mac_addr() can be called by a master device on bridge's
++ * NETDEV_UNREGISTER, but since it's being destroyed do nothing
++ */
++ if (dev->reg_state != NETREG_REGISTERED)
++ return -EBUSY;
++
+ spin_lock_bh(&br->lock);
+ if (!ether_addr_equal(dev->dev_addr, addr->sa_data)) {
+ /* Mac address will be changed in br_stp_change_bridge_id(). */
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 91179febdeee..8ff21d461f08 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -7595,7 +7595,8 @@ int __dev_set_mtu(struct net_device *dev, int new_mtu)
+ if (ops->ndo_change_mtu)
+ return ops->ndo_change_mtu(dev, new_mtu);
+
+- dev->mtu = new_mtu;
++ /* Pairs with all the lockless reads of dev->mtu in the stack */
++ WRITE_ONCE(dev->mtu, new_mtu);
+ return 0;
+ }
+ EXPORT_SYMBOL(__dev_set_mtu);
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index 4362ffe9b5ef..994dd1520f07 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -630,9 +630,10 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
+ nhoff = skb_network_offset(skb);
+ hlen = skb_headlen(skb);
+ #if IS_ENABLED(CONFIG_NET_DSA)
+- if (unlikely(skb->dev && netdev_uses_dsa(skb->dev))) {
++ if (unlikely(skb->dev && netdev_uses_dsa(skb->dev) &&
++ proto == htons(ETH_P_XDSA))) {
+ const struct dsa_device_ops *ops;
+- int offset;
++ int offset = 0;
+
+ ops = skb->dev->dsa_ptr->tag_ops;
+ if (ops->flow_dissect &&
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index d23746143cd2..fabece4b8997 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -1441,11 +1441,6 @@ skip:
+ }
+ }
+
+-static bool inetdev_valid_mtu(unsigned int mtu)
+-{
+- return mtu >= IPV4_MIN_MTU;
+-}
+-
+ static void inetdev_send_gratuitous_arp(struct net_device *dev,
+ struct in_device *in_dev)
+
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 73894ed12a70..d63091812342 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1142,15 +1142,18 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
+ cork->addr = ipc->addr;
+ }
+
+- /*
+- * We steal reference to this route, caller should not release it
+- */
+- *rtp = NULL;
+ cork->fragsize = ip_sk_use_pmtu(sk) ?
+- dst_mtu(&rt->dst) : rt->dst.dev->mtu;
++ dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu);
++
++ if (!inetdev_valid_mtu(cork->fragsize))
++ return -ENETUNREACH;
+
+ cork->gso_size = ipc->gso_size;
++
+ cork->dst = &rt->dst;
++ /* We stole this route, caller should not release it. */
++ *rtp = NULL;
++
+ cork->length = 0;
+ cork->ttl = ipc->ttl;
+ cork->tos = ipc->tos;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 8971cc15d278..ad787e7882f7 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -740,8 +740,9 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
+ min_t(unsigned int, eff_sacks,
+ (remaining - TCPOLEN_SACK_BASE_ALIGNED) /
+ TCPOLEN_SACK_PERBLOCK);
+- size += TCPOLEN_SACK_BASE_ALIGNED +
+- opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK;
++ if (likely(opts->num_sack_blocks))
++ size += TCPOLEN_SACK_BASE_ALIGNED +
++ opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK;
+ }
+
+ return size;
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 46aa1aa51db4..6dcb59f272e1 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -897,6 +897,17 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
+ }
+ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype);
+
++ if (err == NF_ACCEPT &&
++ ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) {
++ if (maniptype == NF_NAT_MANIP_SRC)
++ maniptype = NF_NAT_MANIP_DST;
++ else
++ maniptype = NF_NAT_MANIP_SRC;
++
++ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
++ maniptype);
++ }
++
+ /* Mark NAT done if successful and update the flow key. */
+ if (err == NF_ACCEPT)
+ ovs_nat_update_key(key, skb, maniptype);
+diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
+index 15c6eb547684..c008a316e943 100644
+--- a/net/sched/sch_mq.c
++++ b/net/sched/sch_mq.c
+@@ -158,6 +158,7 @@ static int mq_dump(struct Qdisc *sch, struct sk_buff *skb)
+ __gnet_stats_copy_queue(&sch->qstats,
+ qdisc->cpu_qstats,
+ &qdisc->qstats, qlen);
++ sch->q.qlen += qlen;
+ } else {
+ sch->q.qlen += qdisc->q.qlen;
+ sch->bstats.bytes += qdisc->bstats.bytes;
+diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
+index 68ce86cab63c..008db8d59ace 100644
+--- a/net/sched/sch_mqprio.c
++++ b/net/sched/sch_mqprio.c
+@@ -413,6 +413,7 @@ static int mqprio_dump(struct Qdisc *sch, struct sk_buff *skb)
+ __gnet_stats_copy_queue(&sch->qstats,
+ qdisc->cpu_qstats,
+ &qdisc->qstats, qlen);
++ sch->q.qlen += qlen;
+ } else {
+ sch->q.qlen += qdisc->q.qlen;
+ sch->bstats.bytes += qdisc->bstats.bytes;
+@@ -435,7 +436,7 @@ static int mqprio_dump(struct Qdisc *sch, struct sk_buff *skb)
+ opt.offset[tc] = dev->tc_to_txq[tc].offset;
+ }
+
+- if (nla_put(skb, TCA_OPTIONS, NLA_ALIGN(sizeof(opt)), &opt))
++ if (nla_put(skb, TCA_OPTIONS, sizeof(opt), &opt))
+ goto nla_put_failure;
+
+ if ((priv->flags & TC_MQPRIO_F_MODE) &&
+diff --git a/net/tipc/core.c b/net/tipc/core.c
+index eb0f701f9bf1..49bb9fc0aa06 100644
+--- a/net/tipc/core.c
++++ b/net/tipc/core.c
+@@ -120,14 +120,6 @@ static int __init tipc_init(void)
+ sysctl_tipc_rmem[1] = RCVBUF_DEF;
+ sysctl_tipc_rmem[2] = RCVBUF_MAX;
+
+- err = tipc_netlink_start();
+- if (err)
+- goto out_netlink;
+-
+- err = tipc_netlink_compat_start();
+- if (err)
+- goto out_netlink_compat;
+-
+ err = tipc_register_sysctl();
+ if (err)
+ goto out_sysctl;
+@@ -148,8 +140,21 @@ static int __init tipc_init(void)
+ if (err)
+ goto out_bearer;
+
++ err = tipc_netlink_start();
++ if (err)
++ goto out_netlink;
++
++ err = tipc_netlink_compat_start();
++ if (err)
++ goto out_netlink_compat;
++
+ pr_info("Started in single node mode\n");
+ return 0;
++
++out_netlink_compat:
++ tipc_netlink_stop();
++out_netlink:
++ tipc_bearer_cleanup();
+ out_bearer:
+ unregister_pernet_device(&tipc_topsrv_net_ops);
+ out_pernet_topsrv:
+@@ -159,22 +164,18 @@ out_socket:
+ out_pernet:
+ tipc_unregister_sysctl();
+ out_sysctl:
+- tipc_netlink_compat_stop();
+-out_netlink_compat:
+- tipc_netlink_stop();
+-out_netlink:
+ pr_err("Unable to start in single node mode\n");
+ return err;
+ }
+
+ static void __exit tipc_exit(void)
+ {
++ tipc_netlink_compat_stop();
++ tipc_netlink_stop();
+ tipc_bearer_cleanup();
+ unregister_pernet_device(&tipc_topsrv_net_ops);
+ tipc_socket_stop();
+ unregister_pernet_device(&tipc_net_ops);
+- tipc_netlink_stop();
+- tipc_netlink_compat_stop();
+ tipc_unregister_sysctl();
+
+ pr_info("Deactivated\n");
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2019-12-31 17:46 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2019-12-31 17:46 UTC (permalink / raw
To: gentoo-commits
commit: 631919c872608f1b997f2023d125b191f0b807d2
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 31 17:45:49 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Dec 31 17:45:49 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=631919c8
Linux patch 4.19.92
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1091_linux-4.19.92.patch | 6138 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6142 insertions(+)
diff --git a/0000_README b/0000_README
index 304b54d..af10ce2 100644
--- a/0000_README
+++ b/0000_README
@@ -403,6 +403,10 @@ Patch: 1090_linux-4.19.91.patch
From: https://www.kernel.org
Desc: Linux 4.19.91
+Patch: 1091_linux-4.19.92.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.92
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1091_linux-4.19.92.patch b/1091_linux-4.19.92.patch
new file mode 100644
index 0000000..76c22e3
--- /dev/null
+++ b/1091_linux-4.19.92.patch
@@ -0,0 +1,6138 @@
+diff --git a/Makefile b/Makefile
+index 4e07d786bec2..080232ef6716 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 91
++SUBLEVEL = 92
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c
+index e8edbf13302a..3856d51c645b 100644
+--- a/arch/arm64/kernel/psci.c
++++ b/arch/arm64/kernel/psci.c
+@@ -84,7 +84,8 @@ static void cpu_psci_cpu_die(unsigned int cpu)
+
+ static int cpu_psci_cpu_kill(unsigned int cpu)
+ {
+- int err, i;
++ int err;
++ unsigned long start, end;
+
+ if (!psci_ops.affinity_info)
+ return 0;
+@@ -94,16 +95,18 @@ static int cpu_psci_cpu_kill(unsigned int cpu)
+ * while it is dying. So, try again a few times.
+ */
+
+- for (i = 0; i < 10; i++) {
++ start = jiffies;
++ end = start + msecs_to_jiffies(100);
++ do {
+ err = psci_ops.affinity_info(cpu_logical_map(cpu), 0);
+ if (err == PSCI_0_2_AFFINITY_LEVEL_OFF) {
+- pr_info("CPU%d killed.\n", cpu);
++ pr_info("CPU%d killed (polled %d ms)\n", cpu,
++ jiffies_to_msecs(jiffies - start));
+ return 0;
+ }
+
+- msleep(10);
+- pr_info("Retrying again to check for CPU kill\n");
+- }
++ usleep_range(100, 1000);
++ } while (time_before(jiffies, end));
+
+ pr_warn("CPU%d may not have shut down cleanly (AFFINITY_INFO reports %d)\n",
+ cpu, err);
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+index 6da2bbdb9648..0c073f3ca122 100644
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -2174,8 +2174,11 @@ static const struct sys_reg_desc *index_to_sys_reg_desc(struct kvm_vcpu *vcpu,
+ if ((id & KVM_REG_ARM_COPROC_MASK) != KVM_REG_ARM64_SYSREG)
+ return NULL;
+
++ if (!index_to_params(id, ¶ms))
++ return NULL;
++
+ table = get_target_table(vcpu->arch.target, true, &num);
+- r = find_reg_by_id(id, ¶ms, table, num);
++ r = find_reg(¶ms, table, num);
+ if (!r)
+ r = find_reg(¶ms, sys_reg_descs, ARRAY_SIZE(sys_reg_descs));
+
+diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h
+index 93a9dce31f25..813dfe5f45a5 100644
+--- a/arch/mips/include/asm/pgtable-64.h
++++ b/arch/mips/include/asm/pgtable-64.h
+@@ -18,10 +18,12 @@
+ #include <asm/fixmap.h>
+
+ #define __ARCH_USE_5LEVEL_HACK
+-#if defined(CONFIG_PAGE_SIZE_64KB) && !defined(CONFIG_MIPS_VA_BITS_48)
++#if CONFIG_PGTABLE_LEVELS == 2
+ #include <asm-generic/pgtable-nopmd.h>
+-#elif !(defined(CONFIG_PAGE_SIZE_4KB) && defined(CONFIG_MIPS_VA_BITS_48))
++#elif CONFIG_PGTABLE_LEVELS == 3
+ #include <asm-generic/pgtable-nopud.h>
++#else
++#include <asm-generic/5level-fixup.h>
+ #endif
+
+ /*
+@@ -216,6 +218,9 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd)
+ return pgd_val(pgd);
+ }
+
++#define pgd_phys(pgd) virt_to_phys((void *)pgd_val(pgd))
++#define pgd_page(pgd) (pfn_to_page(pgd_phys(pgd) >> PAGE_SHIFT))
++
+ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
+ {
+ return (pud_t *)pgd_page_vaddr(*pgd) + pud_index(address);
+diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h
+index 685c72310f5d..bfaf175db54d 100644
+--- a/arch/powerpc/include/asm/spinlock.h
++++ b/arch/powerpc/include/asm/spinlock.h
+@@ -53,10 +53,12 @@
+ #endif
+
+ #ifdef CONFIG_PPC_PSERIES
++DECLARE_STATIC_KEY_FALSE(shared_processor);
++
+ #define vcpu_is_preempted vcpu_is_preempted
+ static inline bool vcpu_is_preempted(int cpu)
+ {
+- if (!firmware_has_feature(FW_FEATURE_SPLPAR))
++ if (!static_branch_unlikely(&shared_processor))
+ return false;
+ return !!(be32_to_cpu(lppaca_of(cpu).yield_count) & 1);
+ }
+diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
+index 916ddc4aac44..d37704ebccdb 100644
+--- a/arch/powerpc/kernel/irq.c
++++ b/arch/powerpc/kernel/irq.c
+@@ -634,8 +634,6 @@ void __do_irq(struct pt_regs *regs)
+
+ trace_irq_entry(regs);
+
+- check_stack_overflow();
+-
+ /*
+ * Query the platform PIC for the interrupt & ack it.
+ *
+@@ -667,6 +665,8 @@ void do_IRQ(struct pt_regs *regs)
+ irqtp = hardirq_ctx[raw_smp_processor_id()];
+ sirqtp = softirq_ctx[raw_smp_processor_id()];
+
++ check_stack_overflow();
++
+ /* Already there ? */
+ if (unlikely(curtp == irqtp || curtp == sirqtp)) {
+ __do_irq(regs);
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index 67f49159ea70..c2d318d1df02 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -75,6 +75,9 @@
+ #include "pseries.h"
+ #include "../../../../drivers/pci/pci.h"
+
++DEFINE_STATIC_KEY_FALSE(shared_processor);
++EXPORT_SYMBOL_GPL(shared_processor);
++
+ int CMO_PrPSP = -1;
+ int CMO_SecPSP = -1;
+ unsigned long CMO_PageSize = (ASM_CONST(1) << IOMMU_PAGE_SHIFT_4K);
+@@ -761,6 +764,10 @@ static void __init pSeries_setup_arch(void)
+
+ if (firmware_has_feature(FW_FEATURE_LPAR)) {
+ vpa_init(boot_cpuid);
++
++ if (lppaca_shared_proc(get_lppaca()))
++ static_branch_enable(&shared_processor);
++
+ ppc_md.power_save = pseries_lpar_idle;
+ ppc_md.enable_pmcs = pseries_lpar_enable_pmcs;
+ #ifdef CONFIG_PCI_IOV
+diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h
+index 5ee733720a57..67838df3f3f9 100644
+--- a/arch/s390/include/asm/pgalloc.h
++++ b/arch/s390/include/asm/pgalloc.h
+@@ -56,7 +56,12 @@ static inline p4d_t *p4d_alloc_one(struct mm_struct *mm, unsigned long address)
+ crst_table_init(table, _REGION2_ENTRY_EMPTY);
+ return (p4d_t *) table;
+ }
+-#define p4d_free(mm, p4d) crst_table_free(mm, (unsigned long *) p4d)
++
++static inline void p4d_free(struct mm_struct *mm, p4d_t *p4d)
++{
++ if (!mm_p4d_folded(mm))
++ crst_table_free(mm, (unsigned long *) p4d);
++}
+
+ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address)
+ {
+@@ -65,7 +70,12 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address)
+ crst_table_init(table, _REGION3_ENTRY_EMPTY);
+ return (pud_t *) table;
+ }
+-#define pud_free(mm, pud) crst_table_free(mm, (unsigned long *) pud)
++
++static inline void pud_free(struct mm_struct *mm, pud_t *pud)
++{
++ if (!mm_pud_folded(mm))
++ crst_table_free(mm, (unsigned long *) pud);
++}
+
+ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr)
+ {
+@@ -83,6 +93,8 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr)
+
+ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+ {
++ if (mm_pmd_folded(mm))
++ return;
+ pgtable_pmd_page_dtor(virt_to_page(pmd));
+ crst_table_free(mm, (unsigned long *) pmd);
+ }
+diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
+index 64539c221672..2dc9eb4e1acc 100644
+--- a/arch/s390/include/asm/timex.h
++++ b/arch/s390/include/asm/timex.h
+@@ -10,8 +10,9 @@
+ #ifndef _ASM_S390_TIMEX_H
+ #define _ASM_S390_TIMEX_H
+
+-#include <asm/lowcore.h>
++#include <linux/preempt.h>
+ #include <linux/time64.h>
++#include <asm/lowcore.h>
+
+ /* The value of the TOD clock for 1.1.1970. */
+ #define TOD_UNIX_EPOCH 0x7d91048bca000000ULL
+@@ -186,15 +187,18 @@ extern unsigned char tod_clock_base[16] __aligned(8);
+ /**
+ * get_clock_monotonic - returns current time in clock rate units
+ *
+- * The caller must ensure that preemption is disabled.
+ * The clock and tod_clock_base get changed via stop_machine.
+- * Therefore preemption must be disabled when calling this
+- * function, otherwise the returned value is not guaranteed to
+- * be monotonic.
++ * Therefore preemption must be disabled, otherwise the returned
++ * value is not guaranteed to be monotonic.
+ */
+ static inline unsigned long long get_tod_clock_monotonic(void)
+ {
+- return get_tod_clock() - *(unsigned long long *) &tod_clock_base[1];
++ unsigned long long tod;
++
++ preempt_disable_notrace();
++ tod = get_tod_clock() - *(unsigned long long *) &tod_clock_base[1];
++ preempt_enable_notrace();
++ return tod;
+ }
+
+ /**
+diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
+index b2c68fbf2634..41925f220694 100644
+--- a/arch/s390/kernel/dis.c
++++ b/arch/s390/kernel/dis.c
+@@ -462,10 +462,11 @@ static int print_insn(char *buffer, unsigned char *code, unsigned long addr)
+ ptr += sprintf(ptr, "%%c%i", value);
+ else if (operand->flags & OPERAND_VR)
+ ptr += sprintf(ptr, "%%v%i", value);
+- else if (operand->flags & OPERAND_PCREL)
+- ptr += sprintf(ptr, "%lx", (signed int) value
+- + addr);
+- else if (operand->flags & OPERAND_SIGNED)
++ else if (operand->flags & OPERAND_PCREL) {
++ void *pcrel = (void *)((int)value + addr);
++
++ ptr += sprintf(ptr, "%px", pcrel);
++ } else if (operand->flags & OPERAND_SIGNED)
+ ptr += sprintf(ptr, "%i", value);
+ else
+ ptr += sprintf(ptr, "%u", value);
+@@ -537,7 +538,7 @@ void show_code(struct pt_regs *regs)
+ else
+ *ptr++ = ' ';
+ addr = regs->psw.addr + start - 32;
+- ptr += sprintf(ptr, "%016lx: ", addr);
++ ptr += sprintf(ptr, "%px: ", (void *)addr);
+ if (start + opsize >= end)
+ break;
+ for (i = 0; i < opsize; i++)
+@@ -565,7 +566,7 @@ void print_fn_code(unsigned char *code, unsigned long len)
+ opsize = insn_length(*code);
+ if (opsize > len)
+ break;
+- ptr += sprintf(ptr, "%p: ", code);
++ ptr += sprintf(ptr, "%px: ", code);
+ for (i = 0; i < opsize; i++)
+ ptr += sprintf(ptr, "%02x", code[i]);
+ *ptr++ = '\t';
+diff --git a/arch/sh/include/cpu-sh4/cpu/sh7734.h b/arch/sh/include/cpu-sh4/cpu/sh7734.h
+index 96f0246ad2f2..82b63208135a 100644
+--- a/arch/sh/include/cpu-sh4/cpu/sh7734.h
++++ b/arch/sh/include/cpu-sh4/cpu/sh7734.h
+@@ -134,7 +134,7 @@ enum {
+ GPIO_FN_EX_WAIT1, GPIO_FN_SD1_DAT0_A, GPIO_FN_DREQ2, GPIO_FN_CAN1_TX_C,
+ GPIO_FN_ET0_LINK_C, GPIO_FN_ET0_ETXD5_A,
+ GPIO_FN_EX_WAIT0, GPIO_FN_TCLK1_B,
+- GPIO_FN_RD_WR, GPIO_FN_TCLK0,
++ GPIO_FN_RD_WR, GPIO_FN_TCLK0, GPIO_FN_CAN_CLK_B, GPIO_FN_ET0_ETXD4,
+ GPIO_FN_EX_CS5, GPIO_FN_SD1_CMD_A, GPIO_FN_ATADIR, GPIO_FN_QSSL_B,
+ GPIO_FN_ET0_ETXD3_A,
+ GPIO_FN_EX_CS4, GPIO_FN_SD1_WP_A, GPIO_FN_ATAWR, GPIO_FN_QMI_QIO1_B,
+diff --git a/arch/x86/include/asm/crash.h b/arch/x86/include/asm/crash.h
+index a7adb2bfbf0b..6b8ad6fa3979 100644
+--- a/arch/x86/include/asm/crash.h
++++ b/arch/x86/include/asm/crash.h
+@@ -2,6 +2,8 @@
+ #ifndef _ASM_X86_CRASH_H
+ #define _ASM_X86_CRASH_H
+
++struct kimage;
++
+ int crash_load_segments(struct kimage *image);
+ int crash_copy_backup_region(struct kimage *image);
+ int crash_setup_memmap_entries(struct kimage *image,
+diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
+index 6390bd8c141b..5e12b2319d7a 100644
+--- a/arch/x86/include/asm/fixmap.h
++++ b/arch/x86/include/asm/fixmap.h
+@@ -159,7 +159,7 @@ extern pte_t *kmap_pte;
+ extern pte_t *pkmap_page_table;
+
+ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte);
+-void native_set_fixmap(enum fixed_addresses idx,
++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx,
+ phys_addr_t phys, pgprot_t flags);
+
+ #ifndef CONFIG_PARAVIRT
+diff --git a/arch/x86/include/asm/syscall_wrapper.h b/arch/x86/include/asm/syscall_wrapper.h
+index e046a405743d..90eb70df0b18 100644
+--- a/arch/x86/include/asm/syscall_wrapper.h
++++ b/arch/x86/include/asm/syscall_wrapper.h
+@@ -48,12 +48,13 @@
+ * To keep the naming coherent, re-define SYSCALL_DEFINE0 to create an alias
+ * named __ia32_sys_*()
+ */
+-#define SYSCALL_DEFINE0(sname) \
+- SYSCALL_METADATA(_##sname, 0); \
+- asmlinkage long __x64_sys_##sname(void); \
+- ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \
+- SYSCALL_ALIAS(__ia32_sys_##sname, __x64_sys_##sname); \
+- asmlinkage long __x64_sys_##sname(void)
++
++#define SYSCALL_DEFINE0(sname) \
++ SYSCALL_METADATA(_##sname, 0); \
++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused);\
++ ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \
++ SYSCALL_ALIAS(__ia32_sys_##sname, __x64_sys_##sname); \
++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused)
+
+ #define COND_SYSCALL(name) \
+ cond_syscall(__x64_sys_##name); \
+@@ -181,11 +182,11 @@
+ * macros to work correctly.
+ */
+ #ifndef SYSCALL_DEFINE0
+-#define SYSCALL_DEFINE0(sname) \
+- SYSCALL_METADATA(_##sname, 0); \
+- asmlinkage long __x64_sys_##sname(void); \
+- ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \
+- asmlinkage long __x64_sys_##sname(void)
++#define SYSCALL_DEFINE0(sname) \
++ SYSCALL_METADATA(_##sname, 0); \
++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused);\
++ ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO); \
++ asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused)
+ #endif
+
+ #ifndef COND_SYSCALL
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index ab22eded61d2..fa3b85b222e3 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -1724,9 +1724,10 @@ static bool io_apic_level_ack_pending(struct mp_chip_data *data)
+
+ static inline bool ioapic_irqd_mask(struct irq_data *data)
+ {
+- /* If we are moving the irq we need to mask it */
++ /* If we are moving the IRQ we need to mask it */
+ if (unlikely(irqd_is_setaffinity_pending(data))) {
+- mask_ioapic_irq(data);
++ if (!irqd_irq_masked(data))
++ mask_ioapic_irq(data);
+ return true;
+ }
+ return false;
+@@ -1763,7 +1764,9 @@ static inline void ioapic_irqd_unmask(struct irq_data *data, bool masked)
+ */
+ if (!io_apic_level_ack_pending(data->chip_data))
+ irq_move_masked_irq(data);
+- unmask_ioapic_irq(data);
++ /* If the IRQ is masked in the core, leave it: */
++ if (!irqd_irq_masked(data))
++ unmask_ioapic_irq(data);
+ }
+ }
+ #else
+diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+index 5bdfe52b2c9d..da0b6967349a 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -228,10 +228,10 @@ static void smca_configure(unsigned int bank, unsigned int cpu)
+ }
+
+ /* Return early if this bank was already initialized. */
+- if (smca_banks[bank].hwid)
++ if (smca_banks[bank].hwid && smca_banks[bank].hwid->hwid_mcatype != 0)
+ return;
+
+- if (rdmsr_safe_on_cpu(cpu, MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) {
++ if (rdmsr_safe(MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) {
+ pr_warn("Failed to read MCA_IPID for bank %d\n", bank);
+ return;
+ }
+diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
+index ee229ceee745..ec6a07b04fdb 100644
+--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
+@@ -185,7 +185,7 @@ static void therm_throt_process(bool new_event, int event, int level)
+ /* if we just entered the thermal event */
+ if (new_event) {
+ if (event == THERMAL_THROTTLING_EVENT)
+- pr_crit("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n",
++ pr_warn("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n",
+ this_cpu,
+ level == CORE_LEVEL ? "Core" : "Package",
+ state->count);
+diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
+index e0b85930dd77..0a0e9112f284 100644
+--- a/arch/x86/lib/x86-opcode-map.txt
++++ b/arch/x86/lib/x86-opcode-map.txt
+@@ -333,7 +333,7 @@ AVXcode: 1
+ 06: CLTS
+ 07: SYSRET (o64)
+ 08: INVD
+-09: WBINVD
++09: WBINVD | WBNOINVD (F3)
+ 0a:
+ 0b: UD2 (1B)
+ 0c:
+@@ -364,7 +364,7 @@ AVXcode: 1
+ # a ModR/M byte.
+ 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev
+ 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv
+-1c:
++1c: Grp20 (1A),(1C)
+ 1d:
+ 1e:
+ 1f: NOP Ev
+@@ -792,6 +792,8 @@ f3: Grp17 (1A)
+ f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v)
+ f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v)
+ f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v)
++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3)
++f9: MOVDIRI My,Gy
+ EndTable
+
+ Table: 3-byte opcode 2 (0x0f 0x3a)
+@@ -943,9 +945,9 @@ GrpTable: Grp6
+ EndTable
+
+ GrpTable: Grp7
+-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B)
+-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B)
+-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B)
++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B)
++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B)
++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B)
+ 3: LIDT Ms
+ 4: SMSW Mw/Rv
+ 5: rdpkru (110),(11B) | wrpkru (111),(11B)
+@@ -1020,7 +1022,7 @@ GrpTable: Grp15
+ 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B)
+ 4: XSAVE | ptwrite Ey (F3),(11B)
+ 5: XRSTOR | lfence (11B)
+-6: XSAVEOPT | clwb (66) | mfence (11B)
++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B)
+ 7: clflush | clflushopt (66) | sfence (11B)
+ EndTable
+
+@@ -1051,6 +1053,10 @@ GrpTable: Grp19
+ 6: vscatterpf1qps/d Wx (66),(ev)
+ EndTable
+
++GrpTable: Grp20
++0: cldemote Mb
++EndTable
++
+ # AMD's Prefetch Group
+ GrpTable: GrpP
+ 0: PREFETCH
+diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
+index 59274e2c1ac4..bf52106ab9c4 100644
+--- a/arch/x86/mm/pgtable.c
++++ b/arch/x86/mm/pgtable.c
+@@ -660,8 +660,8 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte)
+ fixmaps_set++;
+ }
+
+-void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys,
+- pgprot_t flags)
++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx,
++ phys_addr_t phys, pgprot_t flags)
+ {
+ /* Sanitize 'prot' against any unsupported bits: */
+ pgprot_val(flags) &= __default_kernel_pte_mask;
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index a19ff3977ac4..870eb5c7516a 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -91,6 +91,17 @@ static const struct dmi_system_id lid_blacklst[] = {
+ DMI_MATCH(DMI_BIOS_VERSION, "BYT70A.YNCHENG.WIN.007"),
+ },
+ },
++ {
++ /*
++ * Medion Akoya E2215T, notification of the LID device only
++ * happens on close, not on open and _LID always returns closed.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "E2215T MD60198"),
++ },
++ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
++ },
+ {}
+ };
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 133fed8e4a8b..85ee6c35d8e0 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6726,6 +6726,9 @@ void ata_host_detach(struct ata_host *host)
+ {
+ int i;
+
++ /* Ensure ata_port probe has completed */
++ async_synchronize_full();
++
+ for (i = 0; i < host->n_ports; i++)
+ ata_port_detach(host->ports[i]);
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 126c2c514673..9cd231a27328 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -416,18 +416,20 @@ out_free_page:
+ return ret;
+ }
+
+-static int lo_discard(struct loop_device *lo, struct request *rq, loff_t pos)
++static int lo_fallocate(struct loop_device *lo, struct request *rq, loff_t pos,
++ int mode)
+ {
+ /*
+- * We use punch hole to reclaim the free space used by the
+- * image a.k.a. discard. However we do not support discard if
+- * encryption is enabled, because it may give an attacker
+- * useful information.
++ * We use fallocate to manipulate the space mappings used by the image
++ * a.k.a. discard/zerorange. However we do not support this if
++ * encryption is enabled, because it may give an attacker useful
++ * information.
+ */
+ struct file *file = lo->lo_backing_file;
+- int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE;
+ int ret;
+
++ mode |= FALLOC_FL_KEEP_SIZE;
++
+ if ((!file->f_op->fallocate) || lo->lo_encrypt_key_size) {
+ ret = -EOPNOTSUPP;
+ goto out;
+@@ -596,9 +598,17 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq)
+ switch (req_op(rq)) {
+ case REQ_OP_FLUSH:
+ return lo_req_flush(lo, rq);
+- case REQ_OP_DISCARD:
+ case REQ_OP_WRITE_ZEROES:
+- return lo_discard(lo, rq, pos);
++ /*
++ * If the caller doesn't want deallocation, call zeroout to
++ * write zeroes the range. Otherwise, punch them out.
++ */
++ return lo_fallocate(lo, rq, pos,
++ (rq->cmd_flags & REQ_NOUNMAP) ?
++ FALLOC_FL_ZERO_RANGE :
++ FALLOC_FL_PUNCH_HOLE);
++ case REQ_OP_DISCARD:
++ return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE);
+ case REQ_OP_WRITE:
+ if (lo->transfer)
+ return lo_write_transfer(lo, rq, pos);
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 996b1ef5f076..b9d321bdaa8a 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1247,10 +1247,10 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
+ mutex_unlock(&nbd->config_lock);
+ ret = wait_event_interruptible(config->recv_wq,
+ atomic_read(&config->recv_threads) == 0);
+- if (ret) {
++ if (ret)
+ sock_shutdown(nbd);
+- flush_workqueue(nbd->recv_workq);
+- }
++ flush_workqueue(nbd->recv_workq);
++
+ mutex_lock(&nbd->config_lock);
+ nbd_bdev_reset(bdev);
+ /* user requested, ignore socket errors */
+diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c
+index 38b719017186..648e39ce6bd9 100644
+--- a/drivers/char/hw_random/omap3-rom-rng.c
++++ b/drivers/char/hw_random/omap3-rom-rng.c
+@@ -121,7 +121,8 @@ static int omap3_rom_rng_remove(struct platform_device *pdev)
+ {
+ cancel_delayed_work_sync(&idle_work);
+ hwrng_unregister(&omap3_rom_rng_ops);
+- clk_disable_unprepare(rng_clk);
++ if (!rng_idle)
++ clk_disable_unprepare(rng_clk);
+ return 0;
+ }
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 84c17f936c09..91f2d9219489 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -447,6 +447,8 @@ enum ipmi_stat_indexes {
+
+ #define IPMI_IPMB_NUM_SEQ 64
+ struct ipmi_smi {
++ struct module *owner;
++
+ /* What interface number are we? */
+ int intf_num;
+
+@@ -1139,6 +1141,11 @@ int ipmi_create_user(unsigned int if_num,
+ if (rv)
+ goto out_kfree;
+
++ if (!try_module_get(intf->owner)) {
++ rv = -ENODEV;
++ goto out_kfree;
++ }
++
+ /* Note that each existing user holds a refcount to the interface. */
+ kref_get(&intf->refcount);
+
+@@ -1269,6 +1276,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
+ }
+
+ kref_put(&intf->refcount, intf_free);
++ module_put(intf->owner);
+ }
+
+ int ipmi_destroy_user(struct ipmi_user *user)
+@@ -2384,7 +2392,7 @@ static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc)
+ * been recently fetched, this will just use the cached data. Otherwise
+ * it will run a new fetch.
+ *
+- * Except for the first time this is called (in ipmi_register_smi()),
++ * Except for the first time this is called (in ipmi_add_smi()),
+ * this will always return good data;
+ */
+ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+@@ -3304,10 +3312,11 @@ static void redo_bmc_reg(struct work_struct *work)
+ kref_put(&intf->refcount, intf_free);
+ }
+
+-int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
+- void *send_info,
+- struct device *si_dev,
+- unsigned char slave_addr)
++int ipmi_add_smi(struct module *owner,
++ const struct ipmi_smi_handlers *handlers,
++ void *send_info,
++ struct device *si_dev,
++ unsigned char slave_addr)
+ {
+ int i, j;
+ int rv;
+@@ -3333,7 +3342,7 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
+ return rv;
+ }
+
+-
++ intf->owner = owner;
+ intf->bmc = &intf->tmp_bmc;
+ INIT_LIST_HEAD(&intf->bmc->intfs);
+ mutex_init(&intf->bmc->dyn_mutex);
+@@ -3440,7 +3449,7 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
+
+ return rv;
+ }
+-EXPORT_SYMBOL(ipmi_register_smi);
++EXPORT_SYMBOL(ipmi_add_smi);
+
+ static void deliver_smi_err_response(struct ipmi_smi *intf,
+ struct ipmi_smi_msg *msg,
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 9d8d64f706e0..e35c397b1259 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -2480,6 +2480,13 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
+ if (cpufreq_disabled())
+ return -ENODEV;
+
++ /*
++ * The cpufreq core depends heavily on the availability of device
++ * structure, make sure they are available before proceeding further.
++ */
++ if (!get_cpu_device(0))
++ return -EPROBE_DEFER;
++
+ if (!driver_data || !driver_data->verify || !driver_data->init ||
+ !(driver_data->setpolicy || driver_data->target_index ||
+ driver_data->target) ||
+diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
+index f662914d87b8..53a78035381d 100644
+--- a/drivers/crypto/atmel-aes.c
++++ b/drivers/crypto/atmel-aes.c
+@@ -148,7 +148,7 @@ struct atmel_aes_xts_ctx {
+ u32 key2[AES_KEYSIZE_256 / sizeof(u32)];
+ };
+
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ struct atmel_aes_authenc_ctx {
+ struct atmel_aes_base_ctx base;
+ struct atmel_sha_authenc_ctx *auth;
+@@ -160,7 +160,7 @@ struct atmel_aes_reqctx {
+ u32 lastc[AES_BLOCK_SIZE / sizeof(u32)];
+ };
+
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ struct atmel_aes_authenc_reqctx {
+ struct atmel_aes_reqctx base;
+
+@@ -489,7 +489,7 @@ static inline bool atmel_aes_is_encrypt(const struct atmel_aes_dev *dd)
+ return (dd->flags & AES_FLAGS_ENCRYPT);
+ }
+
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ static void atmel_aes_authenc_complete(struct atmel_aes_dev *dd, int err);
+ #endif
+
+@@ -518,7 +518,7 @@ static void atmel_aes_set_iv_as_last_ciphertext_block(struct atmel_aes_dev *dd)
+
+ static inline int atmel_aes_complete(struct atmel_aes_dev *dd, int err)
+ {
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ if (dd->ctx->is_aead)
+ atmel_aes_authenc_complete(dd, err);
+ #endif
+@@ -1983,7 +1983,7 @@ static struct crypto_alg aes_xts_alg = {
+ }
+ };
+
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ /* authenc aead functions */
+
+ static int atmel_aes_authenc_start(struct atmel_aes_dev *dd);
+@@ -2470,7 +2470,7 @@ static void atmel_aes_unregister_algs(struct atmel_aes_dev *dd)
+ {
+ int i;
+
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ if (dd->caps.has_authenc)
+ for (i = 0; i < ARRAY_SIZE(aes_authenc_algs); i++)
+ crypto_unregister_aead(&aes_authenc_algs[i]);
+@@ -2517,7 +2517,7 @@ static int atmel_aes_register_algs(struct atmel_aes_dev *dd)
+ goto err_aes_xts_alg;
+ }
+
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ if (dd->caps.has_authenc) {
+ for (i = 0; i < ARRAY_SIZE(aes_authenc_algs); i++) {
+ err = crypto_register_aead(&aes_authenc_algs[i]);
+@@ -2529,7 +2529,7 @@ static int atmel_aes_register_algs(struct atmel_aes_dev *dd)
+
+ return 0;
+
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ /* i = ARRAY_SIZE(aes_authenc_algs); */
+ err_aes_authenc_alg:
+ for (j = 0; j < i; j++)
+@@ -2720,7 +2720,7 @@ static int atmel_aes_probe(struct platform_device *pdev)
+
+ atmel_aes_get_cap(aes_dd);
+
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ if (aes_dd->caps.has_authenc && !atmel_sha_authenc_is_ready()) {
+ err = -EPROBE_DEFER;
+ goto iclk_unprepare;
+diff --git a/drivers/crypto/atmel-authenc.h b/drivers/crypto/atmel-authenc.h
+index 2a60d1224143..7f6742d35dd5 100644
+--- a/drivers/crypto/atmel-authenc.h
++++ b/drivers/crypto/atmel-authenc.h
+@@ -23,7 +23,7 @@
+ #ifndef __ATMEL_AUTHENC_H__
+ #define __ATMEL_AUTHENC_H__
+
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+
+ #include <crypto/authenc.h>
+ #include <crypto/hash.h>
+diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c
+index 8a19df2fba6a..ef125d4be8fc 100644
+--- a/drivers/crypto/atmel-sha.c
++++ b/drivers/crypto/atmel-sha.c
+@@ -2215,7 +2215,7 @@ static struct ahash_alg sha_hmac_algs[] = {
+ },
+ };
+
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ /* authenc functions */
+
+ static int atmel_sha_authenc_init2(struct atmel_sha_dev *dd);
+diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+index 5cf64746731a..22e491857925 100644
+--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+@@ -81,7 +81,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq)
+ oi = 0;
+ oo = 0;
+ do {
+- todo = min3(rx_cnt, ileft, (mi.length - oi) / 4);
++ todo = min(rx_cnt, ileft);
++ todo = min_t(size_t, todo, (mi.length - oi) / 4);
+ if (todo) {
+ ileft -= todo;
+ writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo);
+@@ -96,7 +97,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq)
+ rx_cnt = SS_RXFIFO_SPACES(spaces);
+ tx_cnt = SS_TXFIFO_SPACES(spaces);
+
+- todo = min3(tx_cnt, oleft, (mo.length - oo) / 4);
++ todo = min(tx_cnt, oleft);
++ todo = min_t(size_t, todo, (mo.length - oo) / 4);
+ if (todo) {
+ oleft -= todo;
+ readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo);
+@@ -220,7 +222,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ * todo is the number of consecutive 4byte word that we
+ * can read from current SG
+ */
+- todo = min3(rx_cnt, ileft / 4, (mi.length - oi) / 4);
++ todo = min(rx_cnt, ileft / 4);
++ todo = min_t(size_t, todo, (mi.length - oi) / 4);
+ if (todo && !ob) {
+ writesl(ss->base + SS_RXFIFO, mi.addr + oi,
+ todo);
+@@ -234,8 +237,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ * we need to be able to write all buf in one
+ * pass, so it is why we min() with rx_cnt
+ */
+- todo = min3(rx_cnt * 4 - ob, ileft,
+- mi.length - oi);
++ todo = min(rx_cnt * 4 - ob, ileft);
++ todo = min_t(size_t, todo, mi.length - oi);
+ memcpy(buf + ob, mi.addr + oi, todo);
+ ileft -= todo;
+ oi += todo;
+@@ -255,7 +258,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ spaces = readl(ss->base + SS_FCSR);
+ rx_cnt = SS_RXFIFO_SPACES(spaces);
+ tx_cnt = SS_TXFIFO_SPACES(spaces);
+- dev_dbg(ss->dev, "%x %u/%u %u/%u cnt=%u %u/%u %u/%u cnt=%u %u\n",
++ dev_dbg(ss->dev,
++ "%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n",
+ mode,
+ oi, mi.length, ileft, areq->cryptlen, rx_cnt,
+ oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob);
+@@ -263,7 +267,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ if (!tx_cnt)
+ continue;
+ /* todo in 4bytes word */
+- todo = min3(tx_cnt, oleft / 4, (mo.length - oo) / 4);
++ todo = min(tx_cnt, oleft / 4);
++ todo = min_t(size_t, todo, (mo.length - oo) / 4);
+ if (todo) {
+ readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo);
+ oleft -= todo * 4;
+@@ -287,7 +292,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ * no more than remaining buffer
+ * no need to test against oleft
+ */
+- todo = min(mo.length - oo, obl - obo);
++ todo = min_t(size_t,
++ mo.length - oo, obl - obo);
+ memcpy(mo.addr + oo, bufo + obo, todo);
+ oleft -= todo;
+ obo += todo;
+diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
+index f6936bb3b7be..1a724263761b 100644
+--- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
++++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
+@@ -276,8 +276,8 @@ static int sun4i_hash(struct ahash_request *areq)
+ */
+ while (op->len < 64 && i < end) {
+ /* how many bytes we can read from current SG */
+- in_r = min3(mi.length - in_i, end - i,
+- 64 - op->len);
++ in_r = min(end - i, 64 - op->len);
++ in_r = min_t(size_t, mi.length - in_i, in_r);
+ memcpy(op->buf + op->len, mi.addr + in_i, in_r);
+ op->len += in_r;
+ i += in_r;
+@@ -297,8 +297,8 @@ static int sun4i_hash(struct ahash_request *areq)
+ }
+ if (mi.length - in_i > 3 && i < end) {
+ /* how many bytes we can read from current SG */
+- in_r = min3(mi.length - in_i, areq->nbytes - i,
+- ((mi.length - in_i) / 4) * 4);
++ in_r = min_t(size_t, mi.length - in_i, areq->nbytes - i);
++ in_r = min_t(size_t, ((mi.length - in_i) / 4) * 4, in_r);
+ /* how many bytes we can write in the device*/
+ todo = min3((u32)(end - i) / 4, rx_cnt, (u32)in_r / 4);
+ writesl(ss->base + SS_RXFIFO, mi.addr + in_i, todo);
+@@ -324,8 +324,8 @@ static int sun4i_hash(struct ahash_request *areq)
+ if ((areq->nbytes - i) < 64) {
+ while (i < areq->nbytes && in_i < mi.length && op->len < 64) {
+ /* how many bytes we can read from current SG */
+- in_r = min3(mi.length - in_i, areq->nbytes - i,
+- 64 - op->len);
++ in_r = min(areq->nbytes - i, 64 - op->len);
++ in_r = min_t(size_t, mi.length - in_i, in_r);
+ memcpy(op->buf + op->len, mi.addr + in_i, in_r);
+ op->len += in_r;
+ i += in_r;
+diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c
+index 2c573d1aaa64..523b712770ac 100644
+--- a/drivers/crypto/virtio/virtio_crypto_algs.c
++++ b/drivers/crypto/virtio/virtio_crypto_algs.c
+@@ -117,8 +117,6 @@ virtio_crypto_alg_validate_key(int key_len, uint32_t *alg)
+ *alg = VIRTIO_CRYPTO_CIPHER_AES_CBC;
+ break;
+ default:
+- pr_err("virtio_crypto: Unsupported key length: %d\n",
+- key_len);
+ return -EINVAL;
+ }
+ return 0;
+@@ -498,6 +496,11 @@ static int virtio_crypto_ablkcipher_encrypt(struct ablkcipher_request *req)
+ /* Use the first data virtqueue as default */
+ struct data_queue *data_vq = &vcrypto->data_vq[0];
+
++ if (!req->nbytes)
++ return 0;
++ if (req->nbytes % AES_BLOCK_SIZE)
++ return -EINVAL;
++
+ vc_req->dataq = data_vq;
+ vc_req->alg_cb = virtio_crypto_dataq_sym_callback;
+ vc_sym_req->ablkcipher_ctx = ctx;
+@@ -518,6 +521,11 @@ static int virtio_crypto_ablkcipher_decrypt(struct ablkcipher_request *req)
+ /* Use the first data virtqueue as default */
+ struct data_queue *data_vq = &vcrypto->data_vq[0];
+
++ if (!req->nbytes)
++ return 0;
++ if (req->nbytes % AES_BLOCK_SIZE)
++ return -EINVAL;
++
+ vc_req->dataq = data_vq;
+ vc_req->alg_cb = virtio_crypto_dataq_sym_callback;
+ vc_sym_req->ablkcipher_ctx = ctx;
+diff --git a/drivers/crypto/vmx/Makefile b/drivers/crypto/vmx/Makefile
+index cab32cfec9c4..709670d2b553 100644
+--- a/drivers/crypto/vmx/Makefile
++++ b/drivers/crypto/vmx/Makefile
+@@ -3,13 +3,13 @@ obj-$(CONFIG_CRYPTO_DEV_VMX_ENCRYPT) += vmx-crypto.o
+ vmx-crypto-objs := vmx.o aesp8-ppc.o ghashp8-ppc.o aes.o aes_cbc.o aes_ctr.o aes_xts.o ghash.o
+
+ ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y)
+-TARGET := linux-ppc64le
++override flavour := linux-ppc64le
+ else
+-TARGET := linux-ppc64
++override flavour := linux-ppc64
+ endif
+
+ quiet_cmd_perl = PERL $@
+- cmd_perl = $(PERL) $(<) $(TARGET) > $(@)
++ cmd_perl = $(PERL) $(<) $(flavour) > $(@)
+
+ targets += aesp8-ppc.S ghashp8-ppc.S
+
+diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c
+index 574bce603337..78c339da19b5 100644
+--- a/drivers/edac/ghes_edac.c
++++ b/drivers/edac/ghes_edac.c
+@@ -210,6 +210,7 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err)
+ /* Cleans the error report buffer */
+ memset(e, 0, sizeof (*e));
+ e->error_count = 1;
++ e->grain = 1;
+ strcpy(e->label, "unknown label");
+ e->msg = pvt->msg;
+ e->other_detail = pvt->other_detail;
+@@ -305,7 +306,7 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err)
+
+ /* Error grain */
+ if (mem_err->validation_bits & CPER_MEM_VALID_PA_MASK)
+- e->grain = ~(mem_err->physical_addr_mask & ~PAGE_MASK);
++ e->grain = ~mem_err->physical_addr_mask + 1;
+
+ /* Memory error location, mapped on e->location */
+ p = e->location;
+@@ -412,8 +413,13 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err)
+ if (p > pvt->other_detail)
+ *(p - 1) = '\0';
+
++ /* Sanity-check driver-supplied grain value. */
++ if (WARN_ON_ONCE(!e->grain))
++ e->grain = 1;
++
++ grain_bits = fls_long(e->grain - 1);
++
+ /* Generate the trace event */
+- grain_bits = fls_long(e->grain);
+ snprintf(pvt->detail_location, sizeof(pvt->detail_location),
+ "APEI location: %s %s", e->location, e->other_detail);
+ trace_mc_event(type, e->msg, e->label, e->error_count,
+diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c
+index 0cfb5a3efdf6..2efcd94f74fc 100644
+--- a/drivers/extcon/extcon-sm5502.c
++++ b/drivers/extcon/extcon-sm5502.c
+@@ -69,6 +69,10 @@ struct sm5502_muic_info {
+ /* Default value of SM5502 register to bring up MUIC device. */
+ static struct reg_data sm5502_reg_data[] = {
+ {
++ .reg = SM5502_REG_RESET,
++ .val = SM5502_REG_RESET_MASK,
++ .invert = true,
++ }, {
+ .reg = SM5502_REG_CONTROL,
+ .val = SM5502_REG_CONTROL_MASK_INT_MASK,
+ .invert = false,
+diff --git a/drivers/extcon/extcon-sm5502.h b/drivers/extcon/extcon-sm5502.h
+index 974b53222f56..12f8b01e5753 100644
+--- a/drivers/extcon/extcon-sm5502.h
++++ b/drivers/extcon/extcon-sm5502.h
+@@ -241,6 +241,8 @@ enum sm5502_reg {
+ #define DM_DP_SWITCH_UART ((DM_DP_CON_SWITCH_UART <<SM5502_REG_MANUAL_SW1_DP_SHIFT) \
+ | (DM_DP_CON_SWITCH_UART <<SM5502_REG_MANUAL_SW1_DM_SHIFT))
+
++#define SM5502_REG_RESET_MASK (0x1)
++
+ /* SM5502 Interrupts */
+ enum sm5502_irq {
+ /* INT1 */
+diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c
+index 2c31563fdcae..c6fa9b393e84 100644
+--- a/drivers/fsi/fsi-core.c
++++ b/drivers/fsi/fsi-core.c
+@@ -552,6 +552,31 @@ static int fsi_slave_scan(struct fsi_slave *slave)
+ return 0;
+ }
+
++static unsigned long aligned_access_size(size_t offset, size_t count)
++{
++ unsigned long offset_unit, count_unit;
++
++ /* Criteria:
++ *
++ * 1. Access size must be less than or equal to the maximum access
++ * width or the highest power-of-two factor of offset
++ * 2. Access size must be less than or equal to the amount specified by
++ * count
++ *
++ * The access width is optimal if we can calculate 1 to be strictly
++ * equal while still satisfying 2.
++ */
++
++ /* Find 1 by the bottom bit of offset (with a 4 byte access cap) */
++ offset_unit = BIT(__builtin_ctzl(offset | 4));
++
++ /* Find 2 by the top bit of count */
++ count_unit = BIT(8 * sizeof(unsigned long) - 1 - __builtin_clzl(count));
++
++ /* Constrain the maximum access width to the minimum of both criteria */
++ return BIT(__builtin_ctzl(offset_unit | count_unit));
++}
++
+ static ssize_t fsi_slave_sysfs_raw_read(struct file *file,
+ struct kobject *kobj, struct bin_attribute *attr, char *buf,
+ loff_t off, size_t count)
+@@ -567,8 +592,7 @@ static ssize_t fsi_slave_sysfs_raw_read(struct file *file,
+ return -EINVAL;
+
+ for (total_len = 0; total_len < count; total_len += read_len) {
+- read_len = min_t(size_t, count, 4);
+- read_len -= off & 0x3;
++ read_len = aligned_access_size(off, count - total_len);
+
+ rc = fsi_slave_read(slave, off, buf + total_len, read_len);
+ if (rc)
+@@ -595,8 +619,7 @@ static ssize_t fsi_slave_sysfs_raw_write(struct file *file,
+ return -EINVAL;
+
+ for (total_len = 0; total_len < count; total_len += write_len) {
+- write_len = min_t(size_t, count, 4);
+- write_len -= off & 0x3;
++ write_len = aligned_access_size(off, count - total_len);
+
+ rc = fsi_slave_write(slave, off, buf + total_len, write_len);
+ if (rc)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
+index 8904e62dca7a..41d3142ef3cf 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
+@@ -138,6 +138,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev)
+ }
+
+ dma_fence_put(fence);
++ fence = NULL;
+
+ r = amdgpu_bo_kmap(vram_obj, &vram_map);
+ if (r) {
+@@ -183,6 +184,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev)
+ }
+
+ dma_fence_put(fence);
++ fence = NULL;
+
+ r = amdgpu_bo_kmap(gtt_obj[i], >t_map);
+ if (r) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index 49fe5084c53d..f67c332b16a4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -700,10 +700,8 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_
+ id->oa_base != job->oa_base ||
+ id->oa_size != job->oa_size);
+ bool vm_flush_needed = job->vm_needs_flush;
+- bool pasid_mapping_needed = id->pasid != job->pasid ||
+- !id->pasid_mapping ||
+- !dma_fence_is_signaled(id->pasid_mapping);
+ struct dma_fence *fence = NULL;
++ bool pasid_mapping_needed = false;
+ unsigned patch_offset = 0;
+ int r;
+
+@@ -713,6 +711,12 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_
+ pasid_mapping_needed = true;
+ }
+
++ mutex_lock(&id_mgr->lock);
++ if (id->pasid != job->pasid || !id->pasid_mapping ||
++ !dma_fence_is_signaled(id->pasid_mapping))
++ pasid_mapping_needed = true;
++ mutex_unlock(&id_mgr->lock);
++
+ gds_switch_needed &= !!ring->funcs->emit_gds_switch;
+ vm_flush_needed &= !!ring->funcs->emit_vm_flush &&
+ job->vm_pd_addr != AMDGPU_BO_INVALID_OFFSET;
+@@ -752,9 +756,11 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_
+ }
+
+ if (pasid_mapping_needed) {
++ mutex_lock(&id_mgr->lock);
+ id->pasid = job->pasid;
+ dma_fence_put(id->pasid_mapping);
+ id->pasid_mapping = dma_fence_get(fence);
++ mutex_unlock(&id_mgr->lock);
+ }
+ dma_fence_put(fence);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 782411649816..28794b1b15c1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -2187,7 +2187,8 @@ static void gfx_v9_0_init_pg(struct amdgpu_device *adev)
+ * And it's needed by gfxoff feature.
+ */
+ if (adev->gfx.rlc.is_rlc_v2_1) {
+- gfx_v9_1_init_rlc_save_restore_list(adev);
++ if (adev->asic_type == CHIP_VEGA12)
++ gfx_v9_1_init_rlc_save_restore_list(adev);
+ gfx_v9_0_enable_save_restore_machine(adev);
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/si_ih.c b/drivers/gpu/drm/amd/amdgpu/si_ih.c
+index 60dad63098a2..e40a3fbc3e76 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/si_ih.c
+@@ -62,7 +62,8 @@ static int si_ih_irq_init(struct amdgpu_device *adev)
+ u64 wptr_off;
+
+ si_ih_disable_interrupts(adev);
+- WREG32(INTERRUPT_CNTL2, adev->irq.ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, adev->dummy_page_addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ interrupt_cntl &= ~IH_DUMMY_RD_OVERRIDE;
+ interrupt_cntl &= ~IH_REQ_NONSNOOP_EN;
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c
+index c56ac47cd318..bc47f6a44456 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c
+@@ -62,6 +62,11 @@ int kfd_interrupt_init(struct kfd_dev *kfd)
+ }
+
+ kfd->ih_wq = alloc_workqueue("KFD IH", WQ_HIGHPRI, 1);
++ if (unlikely(!kfd->ih_wq)) {
++ kfifo_free(&kfd->ih_fifo);
++ dev_err(kfd_chardev(), "Failed to allocate KFD IH workqueue\n");
++ return -ENOMEM;
++ }
+ spin_lock_init(&kfd->interrupt_lock);
+
+ INIT_WORK(&kfd->interrupt_work, interrupt_wq);
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 23a7ef97afdd..c6f7c1344a9b 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -1950,7 +1950,7 @@ static bool dp_active_dongle_validate_timing(
+ break;
+ }
+
+- if (dongle_caps->dongle_type != DISPLAY_DONGLE_DP_HDMI_CONVERTER ||
++ if (dpcd_caps->dongle_type != DISPLAY_DONGLE_DP_HDMI_CONVERTER ||
+ dongle_caps->extendedCapValid == false)
+ return true;
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index 05840f5bddd5..122249da03ab 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -2172,6 +2172,7 @@ static void get_active_converter_info(
+ uint8_t data, struct dc_link *link)
+ {
+ union dp_downstream_port_present ds_port = { .byte = data };
++ memset(&link->dpcd_caps.dongle_caps, 0, sizeof(link->dpcd_caps.dongle_caps));
+
+ /* decode converter info*/
+ if (!ds_port.fields.PORT_PRESENT) {
+diff --git a/drivers/gpu/drm/bridge/analogix-anx78xx.c b/drivers/gpu/drm/bridge/analogix-anx78xx.c
+index f8433c93f463..cc820e9aea1d 100644
+--- a/drivers/gpu/drm/bridge/analogix-anx78xx.c
++++ b/drivers/gpu/drm/bridge/analogix-anx78xx.c
+@@ -725,7 +725,9 @@ static int anx78xx_init_pdata(struct anx78xx *anx78xx)
+ /* 1.0V digital core power regulator */
+ pdata->dvdd10 = devm_regulator_get(dev, "dvdd10");
+ if (IS_ERR(pdata->dvdd10)) {
+- DRM_ERROR("DVDD10 regulator not found\n");
++ if (PTR_ERR(pdata->dvdd10) != -EPROBE_DEFER)
++ DRM_ERROR("DVDD10 regulator not found\n");
++
+ return PTR_ERR(pdata->dvdd10);
+ }
+
+@@ -1341,7 +1343,9 @@ static int anx78xx_i2c_probe(struct i2c_client *client,
+
+ err = anx78xx_init_pdata(anx78xx);
+ if (err) {
+- DRM_ERROR("Failed to initialize pdata: %d\n", err);
++ if (err != -EPROBE_DEFER)
++ DRM_ERROR("Failed to initialize pdata: %d\n", err);
++
+ return err;
+ }
+
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+index 5971976284bf..2a0a1654d3ce 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+@@ -39,6 +39,7 @@
+
+ #include <media/cec-notifier.h>
+
++#define DDC_CI_ADDR 0x37
+ #define DDC_SEGMENT_ADDR 0x30
+
+ #define HDMI_EDID_LEN 512
+@@ -320,6 +321,15 @@ static int dw_hdmi_i2c_xfer(struct i2c_adapter *adap,
+ u8 addr = msgs[0].addr;
+ int i, ret = 0;
+
++ if (addr == DDC_CI_ADDR)
++ /*
++ * The internal I2C controller does not support the multi-byte
++ * read and write operations needed for DDC/CI.
++ * TOFIX: Blacklist the DDC/CI address until we filter out
++ * unsupported I2C operations.
++ */
++ return -EOPNOTSUPP;
++
+ dev_dbg(hdmi->dev, "xfer: num: %d, addr: %#x\n", num, addr);
+
+ for (i = 0; i < num; i++) {
+@@ -1747,7 +1757,7 @@ static int dw_hdmi_setup(struct dw_hdmi *hdmi, struct drm_display_mode *mode)
+
+ /* HDMI Initialization Step E - Configure audio */
+ hdmi_clk_regenerator_update_pixel_clock(hdmi);
+- hdmi_enable_audio_clk(hdmi, true);
++ hdmi_enable_audio_clk(hdmi, hdmi->audio_enable);
+ }
+
+ /* not for DVI mode */
+diff --git a/drivers/gpu/drm/drm_vblank.c b/drivers/gpu/drm/drm_vblank.c
+index d1859bcc7ccb..33a72a84361e 100644
+--- a/drivers/gpu/drm/drm_vblank.c
++++ b/drivers/gpu/drm/drm_vblank.c
+@@ -1572,7 +1572,7 @@ int drm_wait_vblank_ioctl(struct drm_device *dev, void *data,
+ unsigned int flags, pipe, high_pipe;
+
+ if (!dev->irq_enabled)
+- return -EINVAL;
++ return -EOPNOTSUPP;
+
+ if (vblwait->request.type & _DRM_VBLANK_SIGNAL)
+ return -EINVAL;
+@@ -1813,7 +1813,7 @@ int drm_crtc_get_sequence_ioctl(struct drm_device *dev, void *data,
+ return -EINVAL;
+
+ if (!dev->irq_enabled)
+- return -EINVAL;
++ return -EOPNOTSUPP;
+
+ crtc = drm_crtc_find(dev, file_priv, get_seq->crtc_id);
+ if (!crtc)
+@@ -1871,7 +1871,7 @@ int drm_crtc_queue_sequence_ioctl(struct drm_device *dev, void *data,
+ return -EINVAL;
+
+ if (!dev->irq_enabled)
+- return -EINVAL;
++ return -EOPNOTSUPP;
+
+ crtc = drm_crtc_find(dev, file_priv, queue_seq->crtc_id);
+ if (!crtc)
+diff --git a/drivers/gpu/drm/gma500/oaktrail_crtc.c b/drivers/gpu/drm/gma500/oaktrail_crtc.c
+index 1b7fd6a9d8a5..f73a02a2a5b3 100644
+--- a/drivers/gpu/drm/gma500/oaktrail_crtc.c
++++ b/drivers/gpu/drm/gma500/oaktrail_crtc.c
+@@ -139,6 +139,7 @@ static bool mrst_sdvo_find_best_pll(const struct gma_limit_t *limit,
+ s32 freq_error, min_error = 100000;
+
+ memset(best_clock, 0, sizeof(*best_clock));
++ memset(&clock, 0, sizeof(clock));
+
+ for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) {
+ for (clock.n = limit->n.min; clock.n <= limit->n.max;
+@@ -195,6 +196,7 @@ static bool mrst_lvds_find_best_pll(const struct gma_limit_t *limit,
+ int err = target;
+
+ memset(best_clock, 0, sizeof(*best_clock));
++ memset(&clock, 0, sizeof(clock));
+
+ for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) {
+ for (clock.p1 = limit->p1.min; clock.p1 <= limit->p1.max;
+diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+index 9a2cb8aeab3a..aab6a70ece7f 100644
+--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+@@ -427,6 +427,7 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
+ return PTR_ERR(ts->dsi);
+ }
+
++ drm_panel_init(&ts->base);
+ ts->base.dev = dev;
+ ts->base.funcs = &rpi_touchscreen_funcs;
+
+diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
+index 74284e5afc5d..89fa17877b33 100644
+--- a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
++++ b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
+@@ -380,6 +380,7 @@ static int st7789v_probe(struct spi_device *spi)
+ spi_set_drvdata(spi, ctx);
+ ctx->spi = spi;
+
++ drm_panel_init(&ctx->panel);
+ ctx->panel.dev = &spi->dev;
+ ctx->panel.funcs = &st7789v_drm_funcs;
+
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index d7fe9f15def1..89cb70da2bfe 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -2922,6 +2922,11 @@ static int tegra_sor_parse_dt(struct tegra_sor *sor)
+ * earlier
+ */
+ sor->pad = TEGRA_IO_PAD_HDMI_DP0 + sor->index;
++ } else {
++ if (sor->soc->supports_edp)
++ sor->index = 0;
++ else
++ sor->index = 1;
+ }
+
+ return 0;
+diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
+index 527a1cddb14f..916b2355e11a 100644
+--- a/drivers/gpu/host1x/job.c
++++ b/drivers/gpu/host1x/job.c
+@@ -447,7 +447,8 @@ out:
+ return err;
+ }
+
+-static inline int copy_gathers(struct host1x_job *job, struct device *dev)
++static inline int copy_gathers(struct device *host, struct host1x_job *job,
++ struct device *dev)
+ {
+ struct host1x_firewall fw;
+ size_t size = 0;
+@@ -470,12 +471,12 @@ static inline int copy_gathers(struct host1x_job *job, struct device *dev)
+ * Try a non-blocking allocation from a higher priority pools first,
+ * as awaiting for the allocation here is a major performance hit.
+ */
+- job->gather_copy_mapped = dma_alloc_wc(dev, size, &job->gather_copy,
++ job->gather_copy_mapped = dma_alloc_wc(host, size, &job->gather_copy,
+ GFP_NOWAIT);
+
+ /* the higher priority allocation failed, try the generic-blocking */
+ if (!job->gather_copy_mapped)
+- job->gather_copy_mapped = dma_alloc_wc(dev, size,
++ job->gather_copy_mapped = dma_alloc_wc(host, size,
+ &job->gather_copy,
+ GFP_KERNEL);
+ if (!job->gather_copy_mapped)
+@@ -523,7 +524,7 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev)
+ goto out;
+
+ if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) {
+- err = copy_gathers(job, dev);
++ err = copy_gathers(host->dev, job, dev);
+ if (err)
+ goto out;
+ }
+@@ -584,7 +585,7 @@ void host1x_job_unpin(struct host1x_job *job)
+ job->num_unpins = 0;
+
+ if (job->gather_copy_size)
+- dma_free_wc(job->channel->dev, job->gather_copy_size,
++ dma_free_wc(host->dev, job->gather_copy_size,
+ job->gather_copy_mapped, job->gather_copy);
+ }
+ EXPORT_SYMBOL(host1x_job_unpin);
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 24ab3cb426a7..e63a0c24e76b 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -180,6 +180,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x06a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Comet Lake PCH-V */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa3a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ {
+ /* Ice Lake NNPI */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5),
+@@ -205,6 +210,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Elkhart Lake */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ { 0 },
+ };
+
+diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c
+index c64c6675cae6..4ab052d76d9f 100644
+--- a/drivers/iio/adc/dln2-adc.c
++++ b/drivers/iio/adc/dln2-adc.c
+@@ -527,6 +527,10 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev)
+ u16 conflict;
+ unsigned int trigger_chan;
+
++ ret = iio_triggered_buffer_postenable(indio_dev);
++ if (ret)
++ return ret;
++
+ mutex_lock(&dln2->mutex);
+
+ /* Enable ADC */
+@@ -540,6 +544,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev)
+ (int)conflict);
+ ret = -EBUSY;
+ }
++ iio_triggered_buffer_predisable(indio_dev);
+ return ret;
+ }
+
+@@ -553,6 +558,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev)
+ mutex_unlock(&dln2->mutex);
+ if (ret < 0) {
+ dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__);
++ iio_triggered_buffer_predisable(indio_dev);
+ return ret;
+ }
+ } else {
+@@ -560,12 +566,12 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev)
+ mutex_unlock(&dln2->mutex);
+ }
+
+- return iio_triggered_buffer_postenable(indio_dev);
++ return 0;
+ }
+
+ static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev)
+ {
+- int ret;
++ int ret, ret2;
+ struct dln2_adc *dln2 = iio_priv(indio_dev);
+
+ mutex_lock(&dln2->mutex);
+@@ -580,12 +586,14 @@ static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev)
+ ret = dln2_adc_set_port_enabled(dln2, false, NULL);
+
+ mutex_unlock(&dln2->mutex);
+- if (ret < 0) {
++ if (ret < 0)
+ dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__);
+- return ret;
+- }
+
+- return iio_triggered_buffer_predisable(indio_dev);
++ ret2 = iio_triggered_buffer_predisable(indio_dev);
++ if (ret == 0)
++ ret = ret2;
++
++ return ret;
+ }
+
+ static const struct iio_buffer_setup_ops dln2_adc_buffer_setup_ops = {
+diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c
+index 311c1a89c329..0939eb0384f1 100644
+--- a/drivers/iio/adc/max1027.c
++++ b/drivers/iio/adc/max1027.c
+@@ -460,6 +460,14 @@ static int max1027_probe(struct spi_device *spi)
+ goto fail_dev_register;
+ }
+
++ /* Internal reset */
++ st->reg = MAX1027_RST_REG;
++ ret = spi_write(st->spi, &st->reg, 1);
++ if (ret < 0) {
++ dev_err(&indio_dev->dev, "Failed to reset the ADC\n");
++ return ret;
++ }
++
+ /* Disable averaging */
+ st->reg = MAX1027_AVG_REG;
+ ret = spi_write(st->spi, &st->reg, 1);
+diff --git a/drivers/iio/dac/Kconfig b/drivers/iio/dac/Kconfig
+index 80beb64e9e0c..69f4cfa6494b 100644
+--- a/drivers/iio/dac/Kconfig
++++ b/drivers/iio/dac/Kconfig
+@@ -59,8 +59,8 @@ config AD5446
+ help
+ Say yes here to build support for Analog Devices AD5300, AD5301, AD5310,
+ AD5311, AD5320, AD5321, AD5444, AD5446, AD5450, AD5451, AD5452, AD5453,
+- AD5512A, AD5541A, AD5542A, AD5543, AD5553, AD5601, AD5602, AD5611, AD5612,
+- AD5620, AD5621, AD5622, AD5640, AD5641, AD5660, AD5662 DACs
++ AD5512A, AD5541A, AD5542A, AD5543, AD5553, AD5600, AD5601, AD5602, AD5611,
++ AD5612, AD5620, AD5621, AD5622, AD5640, AD5641, AD5660, AD5662 DACs
+ as well as Texas Instruments DAC081S101, DAC101S101, DAC121S101.
+
+ To compile this driver as a module, choose M here: the
+diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c
+index fd26a4272fc5..d3ce5def4f65 100644
+--- a/drivers/iio/dac/ad5446.c
++++ b/drivers/iio/dac/ad5446.c
+@@ -328,6 +328,7 @@ enum ad5446_supported_spi_device_ids {
+ ID_AD5541A,
+ ID_AD5512A,
+ ID_AD5553,
++ ID_AD5600,
+ ID_AD5601,
+ ID_AD5611,
+ ID_AD5621,
+@@ -382,6 +383,10 @@ static const struct ad5446_chip_info ad5446_spi_chip_info[] = {
+ .channel = AD5446_CHANNEL(14, 16, 0),
+ .write = ad5446_write,
+ },
++ [ID_AD5600] = {
++ .channel = AD5446_CHANNEL(16, 16, 0),
++ .write = ad5446_write,
++ },
+ [ID_AD5601] = {
+ .channel = AD5446_CHANNEL_POWERDOWN(8, 16, 6),
+ .write = ad5446_write,
+@@ -449,6 +454,7 @@ static const struct spi_device_id ad5446_spi_ids[] = {
+ {"ad5542a", ID_AD5541A}, /* ad5541a and ad5542a are compatible */
+ {"ad5543", ID_AD5541A}, /* ad5541a and ad5543 are compatible */
+ {"ad5553", ID_AD5553},
++ {"ad5600", ID_AD5600},
+ {"ad5601", ID_AD5601},
+ {"ad5611", ID_AD5611},
+ {"ad5621", ID_AD5621},
+diff --git a/drivers/iio/light/bh1750.c b/drivers/iio/light/bh1750.c
+index a814828e69f5..5f5d54ce882b 100644
+--- a/drivers/iio/light/bh1750.c
++++ b/drivers/iio/light/bh1750.c
+@@ -62,9 +62,9 @@ struct bh1750_chip_info {
+
+ u16 int_time_low_mask;
+ u16 int_time_high_mask;
+-}
++};
+
+-static const bh1750_chip_info_tbl[] = {
++static const struct bh1750_chip_info bh1750_chip_info_tbl[] = {
+ [BH1710] = { 140, 1022, 300, 400, 250000000, 2, 0x001F, 0x03E0 },
+ [BH1721] = { 140, 1020, 300, 400, 250000000, 2, 0x0010, 0x03E0 },
+ [BH1750] = { 31, 254, 69, 1740, 57500000, 1, 0x001F, 0x00E0 },
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 8cc3df24e04e..9167a1c40bcf 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -1701,6 +1701,14 @@ static void qedr_cleanup_user(struct qedr_dev *dev, struct qedr_qp *qp)
+ if (qp->urq.umem)
+ ib_umem_release(qp->urq.umem);
+ qp->urq.umem = NULL;
++
++ if (rdma_protocol_roce(&dev->ibdev, 1)) {
++ qedr_free_pbl(dev, &qp->usq.pbl_info, qp->usq.pbl_tbl);
++ qedr_free_pbl(dev, &qp->urq.pbl_info, qp->urq.pbl_tbl);
++ } else {
++ kfree(qp->usq.pbl_tbl);
++ kfree(qp->urq.pbl_tbl);
++ }
+ }
+
+ static int qedr_create_user_qp(struct qedr_dev *dev,
+@@ -2809,8 +2817,8 @@ int qedr_dereg_mr(struct ib_mr *ib_mr)
+
+ dev->ops->rdma_free_tid(dev->rdma_ctx, mr->hw_mr.itid);
+
+- if ((mr->type != QEDR_MR_DMA) && (mr->type != QEDR_MR_FRMR))
+- qedr_free_pbl(dev, &mr->info.pbl_info, mr->info.pbl_table);
++ if (mr->type != QEDR_MR_DMA)
++ free_mr_info(dev, &mr->info);
+
+ /* it could be user registered memory. */
+ if (mr->umem)
+diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
+index 3fecd87c9f2b..b4e0ae024575 100644
+--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
++++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
+@@ -646,6 +646,7 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep,
+ if (ib_conn->pi_support) {
+ u32 sig_caps = ib_conn->device->ib_device->attrs.sig_prot_cap;
+
++ shost->sg_prot_tablesize = shost->sg_tablesize;
+ scsi_host_set_prot(shost, iser_dif_prot_caps(sig_caps));
+ scsi_host_set_guard(shost, SHOST_DIX_GUARD_IP |
+ SHOST_DIX_GUARD_CRC);
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index 9c3beb1e382b..46794cac167e 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -377,7 +377,10 @@ retry_invalidate:
+ if (!fifo_full(&ca->free_inc))
+ goto retry_invalidate;
+
+- bch_prio_write(ca);
++ if (bch_prio_write(ca, false) < 0) {
++ ca->invalidate_needs_gc = 1;
++ wake_up_gc(ca->set);
++ }
+ }
+ }
+ out:
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index 83f0b91aeb90..4677b18ac281 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -959,7 +959,7 @@ bool bch_cached_dev_error(struct cached_dev *dc);
+ __printf(2, 3)
+ bool bch_cache_set_error(struct cache_set *c, const char *fmt, ...);
+
+-void bch_prio_write(struct cache *ca);
++int bch_prio_write(struct cache *ca, bool wait);
+ void bch_write_bdev_super(struct cached_dev *dc, struct closure *parent);
+
+ extern struct workqueue_struct *bcache_wq;
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 14d381cc6d74..c45d9ad01077 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -525,12 +525,29 @@ static void prio_io(struct cache *ca, uint64_t bucket, int op,
+ closure_sync(cl);
+ }
+
+-void bch_prio_write(struct cache *ca)
++int bch_prio_write(struct cache *ca, bool wait)
+ {
+ int i;
+ struct bucket *b;
+ struct closure cl;
+
++ pr_debug("free_prio=%zu, free_none=%zu, free_inc=%zu",
++ fifo_used(&ca->free[RESERVE_PRIO]),
++ fifo_used(&ca->free[RESERVE_NONE]),
++ fifo_used(&ca->free_inc));
++
++ /*
++ * Pre-check if there are enough free buckets. In the non-blocking
++ * scenario it's better to fail early rather than starting to allocate
++ * buckets and do a cleanup later in case of failure.
++ */
++ if (!wait) {
++ size_t avail = fifo_used(&ca->free[RESERVE_PRIO]) +
++ fifo_used(&ca->free[RESERVE_NONE]);
++ if (prio_buckets(ca) > avail)
++ return -ENOMEM;
++ }
++
+ closure_init_stack(&cl);
+
+ lockdep_assert_held(&ca->set->bucket_lock);
+@@ -540,9 +557,6 @@ void bch_prio_write(struct cache *ca)
+ atomic_long_add(ca->sb.bucket_size * prio_buckets(ca),
+ &ca->meta_sectors_written);
+
+- //pr_debug("free %zu, free_inc %zu, unused %zu", fifo_used(&ca->free),
+- // fifo_used(&ca->free_inc), fifo_used(&ca->unused));
+-
+ for (i = prio_buckets(ca) - 1; i >= 0; --i) {
+ long bucket;
+ struct prio_set *p = ca->disk_buckets;
+@@ -560,7 +574,7 @@ void bch_prio_write(struct cache *ca)
+ p->magic = pset_magic(&ca->sb);
+ p->csum = bch_crc64(&p->magic, bucket_bytes(ca) - 8);
+
+- bucket = bch_bucket_alloc(ca, RESERVE_PRIO, true);
++ bucket = bch_bucket_alloc(ca, RESERVE_PRIO, wait);
+ BUG_ON(bucket == -1);
+
+ mutex_unlock(&ca->set->bucket_lock);
+@@ -589,6 +603,7 @@ void bch_prio_write(struct cache *ca)
+
+ ca->prio_last_buckets[i] = ca->prio_buckets[i];
+ }
++ return 0;
+ }
+
+ static void prio_read(struct cache *ca, uint64_t bucket)
+@@ -747,20 +762,28 @@ static inline int idx_to_first_minor(int idx)
+
+ static void bcache_device_free(struct bcache_device *d)
+ {
++ struct gendisk *disk = d->disk;
++
+ lockdep_assert_held(&bch_register_lock);
+
+- pr_info("%s stopped", d->disk->disk_name);
++ if (disk)
++ pr_info("%s stopped", disk->disk_name);
++ else
++ pr_err("bcache device (NULL gendisk) stopped");
+
+ if (d->c)
+ bcache_device_detach(d);
+- if (d->disk && d->disk->flags & GENHD_FL_UP)
+- del_gendisk(d->disk);
+- if (d->disk && d->disk->queue)
+- blk_cleanup_queue(d->disk->queue);
+- if (d->disk) {
++
++ if (disk) {
++ if (disk->flags & GENHD_FL_UP)
++ del_gendisk(disk);
++
++ if (disk->queue)
++ blk_cleanup_queue(disk->queue);
++
+ ida_simple_remove(&bcache_device_idx,
+- first_minor_to_idx(d->disk->first_minor));
+- put_disk(d->disk);
++ first_minor_to_idx(disk->first_minor));
++ put_disk(disk);
+ }
+
+ bioset_exit(&d->bio_split);
+@@ -1876,7 +1899,7 @@ static int run_cache_set(struct cache_set *c)
+
+ mutex_lock(&c->bucket_lock);
+ for_each_cache(ca, c, i)
+- bch_prio_write(ca);
++ bch_prio_write(ca, true);
+ mutex_unlock(&c->bucket_lock);
+
+ err = "cannot allocate new UUID bucket";
+diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
+index 2fc8c113977f..fd8607124bdb 100644
+--- a/drivers/md/md-bitmap.c
++++ b/drivers/md/md-bitmap.c
+@@ -2132,6 +2132,7 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+ memcpy(page_address(store.sb_page),
+ page_address(bitmap->storage.sb_page),
+ sizeof(bitmap_super_t));
++ spin_lock_irq(&bitmap->counts.lock);
+ md_bitmap_file_unmap(&bitmap->storage);
+ bitmap->storage = store;
+
+@@ -2147,7 +2148,6 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+ blocks = min(old_counts.chunks << old_counts.chunkshift,
+ chunks << chunkshift);
+
+- spin_lock_irq(&bitmap->counts.lock);
+ /* For cluster raid, need to pre-allocate bitmap */
+ if (mddev_is_clustered(bitmap->mddev)) {
+ unsigned long page;
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index e6a8b5669b9c..4b6be3b0fd52 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -419,10 +419,14 @@ static struct sensor_register ov2659_720p[] = {
+ { REG_TIMING_YINC, 0x11 },
+ { REG_TIMING_VERT_FORMAT, 0x80 },
+ { REG_TIMING_HORIZ_FORMAT, 0x00 },
++ { 0x370a, 0x12 },
+ { 0x3a03, 0xe8 },
+ { 0x3a09, 0x6f },
+ { 0x3a0b, 0x5d },
+ { 0x3a15, 0x9a },
++ { REG_VFIFO_READ_START_H, 0x00 },
++ { REG_VFIFO_READ_START_L, 0x80 },
++ { REG_ISP_CTRL02, 0x00 },
+ { REG_NULL, 0x00 },
+ };
+
+@@ -1203,11 +1207,15 @@ static int ov2659_s_stream(struct v4l2_subdev *sd, int on)
+ goto unlock;
+ }
+
+- ov2659_set_pixel_clock(ov2659);
+- ov2659_set_frame_size(ov2659);
+- ov2659_set_format(ov2659);
+- ov2659_set_streaming(ov2659, 1);
+- ov2659->streaming = on;
++ ret = ov2659_set_pixel_clock(ov2659);
++ if (!ret)
++ ret = ov2659_set_frame_size(ov2659);
++ if (!ret)
++ ret = ov2659_set_format(ov2659);
++ if (!ret) {
++ ov2659_set_streaming(ov2659, 1);
++ ov2659->streaming = on;
++ }
+
+ unlock:
+ mutex_unlock(&ov2659->lock);
+diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
+index edded869d792..c5aadd8dd23f 100644
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -469,38 +469,39 @@ static int ov6650_set_selection(struct v4l2_subdev *sd,
+ {
+ struct i2c_client *client = v4l2_get_subdevdata(sd);
+ struct ov6650 *priv = to_ov6650(client);
+- struct v4l2_rect rect = sel->r;
+ int ret;
+
+ if (sel->which != V4L2_SUBDEV_FORMAT_ACTIVE ||
+ sel->target != V4L2_SEL_TGT_CROP)
+ return -EINVAL;
+
+- v4l_bound_align_image(&rect.width, 2, W_CIF, 1,
+- &rect.height, 2, H_CIF, 1, 0);
+- v4l_bound_align_image(&rect.left, DEF_HSTRT << 1,
+- (DEF_HSTRT << 1) + W_CIF - (__s32)rect.width, 1,
+- &rect.top, DEF_VSTRT << 1,
+- (DEF_VSTRT << 1) + H_CIF - (__s32)rect.height, 1,
+- 0);
++ v4l_bound_align_image(&sel->r.width, 2, W_CIF, 1,
++ &sel->r.height, 2, H_CIF, 1, 0);
++ v4l_bound_align_image(&sel->r.left, DEF_HSTRT << 1,
++ (DEF_HSTRT << 1) + W_CIF - (__s32)sel->r.width, 1,
++ &sel->r.top, DEF_VSTRT << 1,
++ (DEF_VSTRT << 1) + H_CIF - (__s32)sel->r.height,
++ 1, 0);
+
+- ret = ov6650_reg_write(client, REG_HSTRT, rect.left >> 1);
++ ret = ov6650_reg_write(client, REG_HSTRT, sel->r.left >> 1);
+ if (!ret) {
+- priv->rect.left = rect.left;
++ priv->rect.width += priv->rect.left - sel->r.left;
++ priv->rect.left = sel->r.left;
+ ret = ov6650_reg_write(client, REG_HSTOP,
+- (rect.left + rect.width) >> 1);
++ (sel->r.left + sel->r.width) >> 1);
+ }
+ if (!ret) {
+- priv->rect.width = rect.width;
+- ret = ov6650_reg_write(client, REG_VSTRT, rect.top >> 1);
++ priv->rect.width = sel->r.width;
++ ret = ov6650_reg_write(client, REG_VSTRT, sel->r.top >> 1);
+ }
+ if (!ret) {
+- priv->rect.top = rect.top;
++ priv->rect.height += priv->rect.top - sel->r.top;
++ priv->rect.top = sel->r.top;
+ ret = ov6650_reg_write(client, REG_VSTOP,
+- (rect.top + rect.height) >> 1);
++ (sel->r.top + sel->r.height) >> 1);
+ }
+ if (!ret)
+- priv->rect.height = rect.height;
++ priv->rect.height = sel->r.height;
+
+ return ret;
+ }
+@@ -614,7 +615,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ dev_err(&client->dev, "Pixel format not handled: 0x%x\n", code);
+ return -EINVAL;
+ }
+- priv->code = code;
+
+ if (code == MEDIA_BUS_FMT_Y8_1X8 ||
+ code == MEDIA_BUS_FMT_SBGGR8_1X8) {
+@@ -640,7 +640,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ dev_dbg(&client->dev, "max resolution: CIF\n");
+ coma_mask |= COMA_QCIF;
+ }
+- priv->half_scale = half_scale;
+
+ clkrc = CLKRC_12MHz;
+ mclk = 12000000;
+@@ -658,8 +657,13 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ ret = ov6650_reg_rmw(client, REG_COMA, coma_set, coma_mask);
+ if (!ret)
+ ret = ov6650_reg_write(client, REG_CLKRC, clkrc);
+- if (!ret)
++ if (!ret) {
++ priv->half_scale = half_scale;
++
+ ret = ov6650_reg_rmw(client, REG_COML, coml_set, coml_mask);
++ }
++ if (!ret)
++ priv->code = code;
+
+ if (!ret) {
+ mf->colorspace = priv->colorspace;
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index 1236683da8f7..4731e1c72f96 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -3108,19 +3108,23 @@ static int smiapp_probe(struct i2c_client *client,
+ if (rval < 0)
+ goto out_media_entity_cleanup;
+
+- rval = v4l2_async_register_subdev_sensor_common(&sensor->src->sd);
+- if (rval < 0)
+- goto out_media_entity_cleanup;
+-
+ pm_runtime_set_active(&client->dev);
+ pm_runtime_get_noresume(&client->dev);
+ pm_runtime_enable(&client->dev);
++
++ rval = v4l2_async_register_subdev_sensor_common(&sensor->src->sd);
++ if (rval < 0)
++ goto out_disable_runtime_pm;
++
+ pm_runtime_set_autosuspend_delay(&client->dev, 1000);
+ pm_runtime_use_autosuspend(&client->dev);
+ pm_runtime_put_autosuspend(&client->dev);
+
+ return 0;
+
++out_disable_runtime_pm:
++ pm_runtime_disable(&client->dev);
++
+ out_media_entity_cleanup:
+ media_entity_cleanup(&sensor->src->sd.entity);
+
+diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
+index 7b113bad70d2..248fb3b6833c 100644
+--- a/drivers/media/pci/cx88/cx88-video.c
++++ b/drivers/media/pci/cx88/cx88-video.c
+@@ -1312,7 +1312,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev,
+ core = cx88_core_get(dev->pci);
+ if (!core) {
+ err = -EINVAL;
+- goto fail_free;
++ goto fail_disable;
+ }
+ dev->core = core;
+
+@@ -1358,7 +1358,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev,
+ cc->step, cc->default_value);
+ if (!vc) {
+ err = core->audio_hdl.error;
+- goto fail_core;
++ goto fail_irq;
+ }
+ vc->priv = (void *)cc;
+ }
+@@ -1372,7 +1372,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev,
+ cc->step, cc->default_value);
+ if (!vc) {
+ err = core->video_hdl.error;
+- goto fail_core;
++ goto fail_irq;
+ }
+ vc->priv = (void *)cc;
+ if (vc->id == V4L2_CID_CHROMA_AGC)
+@@ -1535,11 +1535,14 @@ static int cx8800_initdev(struct pci_dev *pci_dev,
+
+ fail_unreg:
+ cx8800_unregister_video(dev);
+- free_irq(pci_dev->irq, dev);
+ mutex_unlock(&core->lock);
++fail_irq:
++ free_irq(pci_dev->irq, dev);
+ fail_core:
+ core->v4ldev = NULL;
+ cx88_core_put(core, dev->pci);
++fail_disable:
++ pci_disable_device(pci_dev);
+ fail_free:
+ kfree(dev);
+ return err;
+diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c
+index b05738a95e55..809320decdeb 100644
+--- a/drivers/media/platform/am437x/am437x-vpfe.c
++++ b/drivers/media/platform/am437x/am437x-vpfe.c
+@@ -1848,6 +1848,10 @@ static int vpfe_s_std(struct file *file, void *priv, v4l2_std_id std_id)
+ if (!(sdinfo->inputs[0].capabilities & V4L2_IN_CAP_STD))
+ return -ENODATA;
+
++ /* if trying to set the same std then nothing to do */
++ if (vpfe_standards[vpfe->std_index].std_id == std_id)
++ return 0;
++
+ /* If streaming is started, return error */
+ if (vb2_is_busy(&vpfe->buffer_queue)) {
+ vpfe_err(vpfe, "%s device busy\n", __func__);
+diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
+index 5b8350e87e75..60069869596c 100644
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -430,10 +430,11 @@ static const struct venus_resources msm8916_res = {
+ };
+
+ static const struct freq_tbl msm8996_freq_table[] = {
+- { 1944000, 490000000 }, /* 4k UHD @ 60 */
+- { 972000, 320000000 }, /* 4k UHD @ 30 */
+- { 489600, 150000000 }, /* 1080p @ 60 */
+- { 244800, 75000000 }, /* 1080p @ 30 */
++ { 1944000, 520000000 }, /* 4k UHD @ 60 (decode only) */
++ { 972000, 520000000 }, /* 4k UHD @ 30 */
++ { 489600, 346666667 }, /* 1080p @ 60 */
++ { 244800, 150000000 }, /* 1080p @ 30 */
++ { 108000, 75000000 }, /* 720p @ 30 */
+ };
+
+ static const struct reg_val msm8996_reg_preset[] = {
+diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c
+index 124085556b94..fbcc67c10993 100644
+--- a/drivers/media/platform/qcom/venus/hfi_venus.c
++++ b/drivers/media/platform/qcom/venus/hfi_venus.c
+@@ -1484,6 +1484,7 @@ static int venus_suspend_3xx(struct venus_core *core)
+ {
+ struct venus_hfi_device *hdev = to_hfi_priv(core);
+ struct device *dev = core->dev;
++ u32 ctrl_status;
+ bool val;
+ int ret;
+
+@@ -1499,6 +1500,10 @@ static int venus_suspend_3xx(struct venus_core *core)
+ return -EINVAL;
+ }
+
++ ctrl_status = venus_readl(hdev, CPU_CS_SCIACMDARG0);
++ if (ctrl_status & CPU_CS_SCIACMDARG0_PC_READY)
++ goto power_off;
++
+ /*
+ * Power collapse sequence for Venus 3xx and 4xx versions:
+ * 1. Check for ARM9 and video core to be idle by checking WFI bit
+@@ -1523,6 +1528,7 @@ static int venus_suspend_3xx(struct venus_core *core)
+ if (ret)
+ return ret;
+
++power_off:
+ mutex_lock(&hdev->lock);
+
+ ret = venus_power_off(hdev);
+diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c
+index 81413ab52475..b677d014e7ba 100644
+--- a/drivers/media/platform/rcar_drif.c
++++ b/drivers/media/platform/rcar_drif.c
+@@ -912,6 +912,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv,
+ {
+ struct rcar_drif_sdr *sdr = video_drvdata(file);
+
++ memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved));
+ f->fmt.sdr.pixelformat = sdr->fmt->pixelformat;
+ f->fmt.sdr.buffersize = sdr->fmt->buffersize;
+
+diff --git a/drivers/media/platform/ti-vpe/vpdma.h b/drivers/media/platform/ti-vpe/vpdma.h
+index 7e611501c291..f29074c84915 100644
+--- a/drivers/media/platform/ti-vpe/vpdma.h
++++ b/drivers/media/platform/ti-vpe/vpdma.h
+@@ -60,6 +60,7 @@ struct vpdma_data_format {
+ * line stride of source and dest
+ * buffers should be 16 byte aligned
+ */
++#define VPDMA_MAX_STRIDE 65520 /* Max line stride 16 byte aligned */
+ #define VPDMA_DTD_DESC_SIZE 32 /* 8 words */
+ #define VPDMA_CFD_CTD_DESC_SIZE 16 /* 4 words */
+
+diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
+index d70871d0ad2d..a285b9db7ee8 100644
+--- a/drivers/media/platform/ti-vpe/vpe.c
++++ b/drivers/media/platform/ti-vpe/vpe.c
+@@ -352,20 +352,25 @@ enum {
+ };
+
+ /* find our format description corresponding to the passed v4l2_format */
+-static struct vpe_fmt *find_format(struct v4l2_format *f)
++static struct vpe_fmt *__find_format(u32 fourcc)
+ {
+ struct vpe_fmt *fmt;
+ unsigned int k;
+
+ for (k = 0; k < ARRAY_SIZE(vpe_formats); k++) {
+ fmt = &vpe_formats[k];
+- if (fmt->fourcc == f->fmt.pix.pixelformat)
++ if (fmt->fourcc == fourcc)
+ return fmt;
+ }
+
+ return NULL;
+ }
+
++static struct vpe_fmt *find_format(struct v4l2_format *f)
++{
++ return __find_format(f->fmt.pix.pixelformat);
++}
++
+ /*
+ * there is one vpe_dev structure in the driver, it is shared by
+ * all instances.
+@@ -1027,11 +1032,14 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port)
+ dma_addr_t dma_addr;
+ u32 flags = 0;
+ u32 offset = 0;
++ u32 stride;
+
+ if (port == VPE_PORT_MV_OUT) {
+ vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV];
+ dma_addr = ctx->mv_buf_dma[mv_buf_selector];
+ q_data = &ctx->q_data[Q_DATA_SRC];
++ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3,
++ VPDMA_STRIDE_ALIGN);
+ } else {
+ /* to incorporate interleaved formats */
+ int plane = fmt->coplanar ? p_data->vb_part : 0;
+@@ -1058,6 +1066,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port)
+ }
+ /* Apply the offset */
+ dma_addr += offset;
++ stride = q_data->bytesperline[VPE_LUMA];
+ }
+
+ if (q_data->flags & Q_DATA_FRAME_1D)
+@@ -1069,7 +1078,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port)
+ MAX_W, MAX_H);
+
+ vpdma_add_out_dtd(&ctx->desc_list, q_data->width,
+- q_data->bytesperline[VPE_LUMA], &q_data->c_rect,
++ stride, &q_data->c_rect,
+ vpdma_fmt, dma_addr, MAX_OUT_WIDTH_REG1,
+ MAX_OUT_HEIGHT_REG1, p_data->channel, flags);
+ }
+@@ -1088,10 +1097,13 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port)
+ dma_addr_t dma_addr;
+ u32 flags = 0;
+ u32 offset = 0;
++ u32 stride;
+
+ if (port == VPE_PORT_MV_IN) {
+ vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV];
+ dma_addr = ctx->mv_buf_dma[mv_buf_selector];
++ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3,
++ VPDMA_STRIDE_ALIGN);
+ } else {
+ /* to incorporate interleaved formats */
+ int plane = fmt->coplanar ? p_data->vb_part : 0;
+@@ -1118,6 +1130,7 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port)
+ }
+ /* Apply the offset */
+ dma_addr += offset;
++ stride = q_data->bytesperline[VPE_LUMA];
+
+ if (q_data->flags & Q_DATA_INTERLACED_SEQ_TB) {
+ /*
+@@ -1153,10 +1166,10 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port)
+ if (p_data->vb_part && fmt->fourcc == V4L2_PIX_FMT_NV12)
+ frame_height /= 2;
+
+- vpdma_add_in_dtd(&ctx->desc_list, q_data->width,
+- q_data->bytesperline[VPE_LUMA], &q_data->c_rect,
+- vpdma_fmt, dma_addr, p_data->channel, field, flags, frame_width,
+- frame_height, 0, 0);
++ vpdma_add_in_dtd(&ctx->desc_list, q_data->width, stride,
++ &q_data->c_rect, vpdma_fmt, dma_addr,
++ p_data->channel, field, flags, frame_width,
++ frame_height, 0, 0);
+ }
+
+ /*
+@@ -1405,9 +1418,6 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data)
+ /* the previous dst mv buffer becomes the next src mv buffer */
+ ctx->src_mv_buf_selector = !ctx->src_mv_buf_selector;
+
+- if (ctx->aborting)
+- goto finished;
+-
+ s_vb = ctx->src_vbs[0];
+ d_vb = ctx->dst_vb;
+
+@@ -1418,6 +1428,7 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data)
+ d_vb->timecode = s_vb->timecode;
+
+ d_vb->sequence = ctx->sequence;
++ s_vb->sequence = ctx->sequence;
+
+ d_q_data = &ctx->q_data[Q_DATA_DST];
+ if (d_q_data->flags & Q_IS_INTERLACED) {
+@@ -1471,6 +1482,9 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data)
+ ctx->src_vbs[0] = NULL;
+ ctx->dst_vb = NULL;
+
++ if (ctx->aborting)
++ goto finished;
++
+ ctx->bufs_completed++;
+ if (ctx->bufs_completed < ctx->bufs_per_job && job_ready(ctx)) {
+ device_run(ctx);
+@@ -1583,9 +1597,9 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f,
+ unsigned int stride = 0;
+
+ if (!fmt || !(fmt->types & type)) {
+- vpe_err(ctx->dev, "Fourcc format (0x%08x) invalid.\n",
++ vpe_dbg(ctx->dev, "Fourcc format (0x%08x) invalid.\n",
+ pix->pixelformat);
+- return -EINVAL;
++ fmt = __find_format(V4L2_PIX_FMT_YUYV);
+ }
+
+ if (pix->field != V4L2_FIELD_NONE && pix->field != V4L2_FIELD_ALTERNATE
+@@ -1632,7 +1646,7 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f,
+ &pix->height, MIN_H, MAX_H, H_ALIGN,
+ S_ALIGN);
+
+- if (!pix->num_planes)
++ if (!pix->num_planes || pix->num_planes > 2)
+ pix->num_planes = fmt->coplanar ? 2 : 1;
+ else if (pix->num_planes > 1 && !fmt->coplanar)
+ pix->num_planes = 1;
+@@ -1671,6 +1685,10 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f,
+ if (stride > plane_fmt->bytesperline)
+ plane_fmt->bytesperline = stride;
+
++ plane_fmt->bytesperline = clamp_t(u32, plane_fmt->bytesperline,
++ stride,
++ VPDMA_MAX_STRIDE);
++
+ plane_fmt->bytesperline = ALIGN(plane_fmt->bytesperline,
+ VPDMA_STRIDE_ALIGN);
+
+@@ -2291,7 +2309,7 @@ static int vpe_open(struct file *file)
+ v4l2_ctrl_handler_setup(hdl);
+
+ s_q_data = &ctx->q_data[Q_DATA_SRC];
+- s_q_data->fmt = &vpe_formats[2];
++ s_q_data->fmt = __find_format(V4L2_PIX_FMT_YUYV);
+ s_q_data->width = 1920;
+ s_q_data->height = 1080;
+ s_q_data->nplanes = 1;
+@@ -2369,6 +2387,12 @@ static int vpe_release(struct file *file)
+
+ mutex_lock(&dev->dev_mutex);
+ free_mv_buffers(ctx);
++
++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->desc_list.buf);
++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->mmr_adb);
++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_h);
++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_v);
++
+ vpdma_free_desc_list(&ctx->desc_list);
+ vpdma_free_desc_buf(&ctx->mmr_adb);
+
+diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
+index e3b3ecd14a4d..ae7540b765e1 100644
+--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
+@@ -485,6 +485,8 @@ static int si470x_i2c_remove(struct i2c_client *client)
+ video_unregister_device(&radio->videodev);
+ kfree(radio);
+
++ v4l2_ctrl_handler_free(&radio->hdl);
++ v4l2_device_unregister(&radio->v4l2_dev);
+ return 0;
+ }
+
+diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
+index ac4fddfd0a43..f1807c16438d 100644
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -503,7 +503,13 @@ urb_error:
+ static int flexcop_usb_init(struct flexcop_usb *fc_usb)
+ {
+ /* use the alternate setting with the larges buffer */
+- usb_set_interface(fc_usb->udev,0,1);
++ int ret = usb_set_interface(fc_usb->udev, 0, 1);
++
++ if (ret) {
++ err("set interface failed.");
++ return ret;
++ }
++
+ switch (fc_usb->udev->speed) {
+ case USB_SPEED_LOW:
+ err("cannot handle USB speed because it is too slow.");
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+index e53a80b589a1..04d334152eae 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+@@ -916,8 +916,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp)
+ pvr2_v4l2_dev_disassociate_parent(vp->dev_video);
+ pvr2_v4l2_dev_disassociate_parent(vp->dev_radio);
+ if (!list_empty(&vp->dev_video->devbase.fh_list) ||
+- !list_empty(&vp->dev_radio->devbase.fh_list))
++ (vp->dev_radio &&
++ !list_empty(&vp->dev_radio->devbase.fh_list))) {
++ pvr2_trace(PVR2_TRACE_STRUCT,
++ "pvr2_v4l2 internal_check exit-empty id=%p", vp);
+ return;
++ }
+ pvr2_v4l2_destroy_no_lock(vp);
+ }
+
+@@ -953,7 +957,8 @@ static int pvr2_v4l2_release(struct file *file)
+ kfree(fhp);
+ if (vp->channel.mc_head->disconnect_flag &&
+ list_empty(&vp->dev_video->devbase.fh_list) &&
+- list_empty(&vp->dev_radio->devbase.fh_list)) {
++ (!vp->dev_radio ||
++ list_empty(&vp->dev_radio->devbase.fh_list))) {
+ pvr2_v4l2_destroy_no_lock(vp);
+ }
+ return 0;
+diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
+index a4d3e94a400c..7675b645db2e 100644
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1415,10 +1415,26 @@ static int v4l_enum_fmt(const struct v4l2_ioctl_ops *ops,
+ return ret;
+ }
+
++static void v4l_pix_format_touch(struct v4l2_pix_format *p)
++{
++ /*
++ * The v4l2_pix_format structure contains fields that make no sense for
++ * touch. Set them to default values in this case.
++ */
++
++ p->field = V4L2_FIELD_NONE;
++ p->colorspace = V4L2_COLORSPACE_RAW;
++ p->flags = 0;
++ p->ycbcr_enc = 0;
++ p->quantization = 0;
++ p->xfer_func = 0;
++}
++
+ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops,
+ struct file *file, void *fh, void *arg)
+ {
+ struct v4l2_format *p = arg;
++ struct video_device *vfd = video_devdata(file);
+ int ret = check_fmt(file, p->type);
+
+ if (ret)
+@@ -1456,6 +1472,8 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops,
+ ret = ops->vidioc_g_fmt_vid_cap(file, fh, arg);
+ /* just in case the driver zeroed it again */
+ p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC;
++ if (vfd->vfl_type == VFL_TYPE_TOUCH)
++ v4l_pix_format_touch(&p->fmt.pix);
+ return ret;
+ case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
+ return ops->vidioc_g_fmt_vid_cap_mplane(file, fh, arg);
+@@ -1491,21 +1509,6 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops,
+ return -EINVAL;
+ }
+
+-static void v4l_pix_format_touch(struct v4l2_pix_format *p)
+-{
+- /*
+- * The v4l2_pix_format structure contains fields that make no sense for
+- * touch. Set them to default values in this case.
+- */
+-
+- p->field = V4L2_FIELD_NONE;
+- p->colorspace = V4L2_COLORSPACE_RAW;
+- p->flags = 0;
+- p->ycbcr_enc = 0;
+- p->quantization = 0;
+- p->xfer_func = 0;
+-}
+-
+ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops,
+ struct file *file, void *fh, void *arg)
+ {
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index 673f6a9616cd..9ecf86ba4bb0 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -228,6 +228,7 @@
+ #define MSDC_PATCH_BIT_SPCPUSH (0x1 << 29) /* RW */
+ #define MSDC_PATCH_BIT_DECRCTMO (0x1 << 30) /* RW */
+
++#define MSDC_PATCH_BIT1_CMDTA (0x7 << 3) /* RW */
+ #define MSDC_PATCH_BIT1_STOP_DLY (0xf << 8) /* RW */
+
+ #define MSDC_PATCH_BIT2_CFGRESP (0x1 << 15) /* RW */
+@@ -1673,6 +1674,7 @@ static int hs400_tune_response(struct mmc_host *mmc, u32 opcode)
+
+ /* select EMMC50 PAD CMD tune */
+ sdr_set_bits(host->base + PAD_CMD_TUNE, BIT(0));
++ sdr_set_field(host->base + MSDC_PATCH_BIT1, MSDC_PATCH_BIT1_CMDTA, 2);
+
+ if (mmc->ios.timing == MMC_TIMING_MMC_HS200 ||
+ mmc->ios.timing == MMC_TIMING_UHS_SDR104)
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index ad0275191d91..17b2054d9b62 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -108,7 +108,7 @@
+
+ #define CORE_PWRSAVE_DLL BIT(3)
+
+-#define DDR_CONFIG_POR_VAL 0x80040853
++#define DDR_CONFIG_POR_VAL 0x80040873
+
+
+ #define INVALID_TUNING_PHASE -1
+@@ -157,8 +157,9 @@ struct sdhci_msm_offset {
+ u32 core_ddr_200_cfg;
+ u32 core_vendor_spec3;
+ u32 core_dll_config_2;
++ u32 core_dll_config_3;
++ u32 core_ddr_config_old; /* Applicable to sdcc minor ver < 0x49 */
+ u32 core_ddr_config;
+- u32 core_ddr_config_2;
+ };
+
+ static const struct sdhci_msm_offset sdhci_msm_v5_offset = {
+@@ -186,8 +187,8 @@ static const struct sdhci_msm_offset sdhci_msm_v5_offset = {
+ .core_ddr_200_cfg = 0x224,
+ .core_vendor_spec3 = 0x250,
+ .core_dll_config_2 = 0x254,
+- .core_ddr_config = 0x258,
+- .core_ddr_config_2 = 0x25c,
++ .core_dll_config_3 = 0x258,
++ .core_ddr_config = 0x25c,
+ };
+
+ static const struct sdhci_msm_offset sdhci_msm_mci_offset = {
+@@ -216,8 +217,8 @@ static const struct sdhci_msm_offset sdhci_msm_mci_offset = {
+ .core_ddr_200_cfg = 0x184,
+ .core_vendor_spec3 = 0x1b0,
+ .core_dll_config_2 = 0x1b4,
+- .core_ddr_config = 0x1b8,
+- .core_ddr_config_2 = 0x1bc,
++ .core_ddr_config_old = 0x1b8,
++ .core_ddr_config = 0x1bc,
+ };
+
+ struct sdhci_msm_variant_ops {
+@@ -260,6 +261,7 @@ struct sdhci_msm_host {
+ const struct sdhci_msm_offset *offset;
+ bool use_cdr;
+ u32 transfer_mode;
++ bool updated_ddr_cfg;
+ };
+
+ static const struct sdhci_msm_offset *sdhci_priv_msm_offset(struct sdhci_host *host)
+@@ -931,8 +933,10 @@ out:
+ static int sdhci_msm_cm_dll_sdc4_calibration(struct sdhci_host *host)
+ {
+ struct mmc_host *mmc = host->mmc;
+- u32 dll_status, config;
++ u32 dll_status, config, ddr_cfg_offset;
+ int ret;
++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++ struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
+ const struct sdhci_msm_offset *msm_offset =
+ sdhci_priv_msm_offset(host);
+
+@@ -945,8 +949,11 @@ static int sdhci_msm_cm_dll_sdc4_calibration(struct sdhci_host *host)
+ * bootloaders. In the future, if this changes, then the desired
+ * values will need to be programmed appropriately.
+ */
+- writel_relaxed(DDR_CONFIG_POR_VAL, host->ioaddr +
+- msm_offset->core_ddr_config);
++ if (msm_host->updated_ddr_cfg)
++ ddr_cfg_offset = msm_offset->core_ddr_config;
++ else
++ ddr_cfg_offset = msm_offset->core_ddr_config_old;
++ writel_relaxed(DDR_CONFIG_POR_VAL, host->ioaddr + ddr_cfg_offset);
+
+ if (mmc->ios.enhanced_strobe) {
+ config = readl_relaxed(host->ioaddr +
+@@ -1862,6 +1869,9 @@ static int sdhci_msm_probe(struct platform_device *pdev)
+ msm_offset->core_vendor_spec_capabilities0);
+ }
+
++ if (core_major == 1 && core_minor >= 0x49)
++ msm_host->updated_ddr_cfg = true;
++
+ /*
+ * Power on reset state may trigger power irq if previous status of
+ * PWRCTL was either BUS_ON or IO_HIGH_V. So before enabling pwr irq
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index 6627523e728b..2c9110fee1cc 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -648,9 +648,6 @@ static void esdhc_reset(struct sdhci_host *host, u8 mask)
+ sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
+ sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
+
+- if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc"))
+- mdelay(5);
+-
+ if (mask & SDHCI_RESET_ALL) {
+ val = sdhci_readl(host, ESDHC_TBCTL);
+ val &= ~ESDHC_TB_EN;
+@@ -926,8 +923,8 @@ static int sdhci_esdhc_probe(struct platform_device *pdev)
+ host->quirks &= ~SDHCI_QUIRK_NO_BUSY_IRQ;
+
+ if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) {
+- host->quirks2 |= SDHCI_QUIRK_RESET_AFTER_REQUEST;
+- host->quirks2 |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
++ host->quirks |= SDHCI_QUIRK_RESET_AFTER_REQUEST;
++ host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
+ }
+
+ if (of_device_is_compatible(np, "fsl,p5040-esdhc") ||
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index 71794391f48f..65985dc3e1a7 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -30,6 +30,7 @@
+ #include <linux/mmc/slot-gpio.h>
+ #include <linux/mmc/sdhci-pci-data.h>
+ #include <linux/acpi.h>
++#include <linux/dmi.h>
+
+ #include "cqhci.h"
+
+@@ -732,11 +733,18 @@ static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot)
+ return 0;
+ }
+
++static bool glk_broken_cqhci(struct sdhci_pci_slot *slot)
++{
++ return slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC &&
++ dmi_match(DMI_BIOS_VENDOR, "LENOVO");
++}
++
+ static int glk_emmc_probe_slot(struct sdhci_pci_slot *slot)
+ {
+ int ret = byt_emmc_probe_slot(slot);
+
+- slot->host->mmc->caps2 |= MMC_CAP2_CQE;
++ if (!glk_broken_cqhci(slot))
++ slot->host->mmc->caps2 |= MMC_CAP2_CQE;
+
+ if (slot->chip->pdev->device != PCI_DEVICE_ID_INTEL_GLK_EMMC) {
+ slot->host->mmc->caps2 |= MMC_CAP2_HS400_ES,
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index e99d5632d8fa..369817a29c22 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1713,9 +1713,7 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR104;
+ else if (timing == MMC_TIMING_UHS_SDR12)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR12;
+- else if (timing == MMC_TIMING_SD_HS ||
+- timing == MMC_TIMING_MMC_HS ||
+- timing == MMC_TIMING_UHS_SDR25)
++ else if (timing == MMC_TIMING_UHS_SDR25)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR25;
+ else if (timing == MMC_TIMING_UHS_SDR50)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR50;
+@@ -2246,8 +2244,8 @@ static void __sdhci_execute_tuning(struct sdhci_host *host, u32 opcode)
+ sdhci_send_tuning(host, opcode);
+
+ if (!host->tuning_done) {
+- pr_info("%s: Tuning timeout, falling back to fixed sampling clock\n",
+- mmc_hostname(host->mmc));
++ pr_debug("%s: Tuning timeout, falling back to fixed sampling clock\n",
++ mmc_hostname(host->mmc));
+ sdhci_abort_tuning(host, opcode);
+ return;
+ }
+@@ -3551,6 +3549,9 @@ int sdhci_setup_host(struct sdhci_host *host)
+ mmc_hostname(mmc), host->version);
+ }
+
++ if (host->quirks & SDHCI_QUIRK_BROKEN_CQE)
++ mmc->caps2 &= ~MMC_CAP2_CQE;
++
+ if (host->quirks & SDHCI_QUIRK_FORCE_DMA)
+ host->flags |= SDHCI_USE_SDMA;
+ else if (!(host->caps & SDHCI_CAN_DO_SDMA))
+diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
+index 0f8c4f3ccafc..c0372e3443fd 100644
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -391,6 +391,8 @@ struct sdhci_host {
+ #define SDHCI_QUIRK_BROKEN_CARD_DETECTION (1<<15)
+ /* Controller reports inverted write-protect state */
+ #define SDHCI_QUIRK_INVERTED_WRITE_PROTECT (1<<16)
++/* Controller has unusable command queue engine */
++#define SDHCI_QUIRK_BROKEN_CQE (1<<17)
+ /* Controller does not like fast PIO transfers */
+ #define SDHCI_QUIRK_PIO_NEEDS_DELAY (1<<18)
+ /* Controller has to be forced to use block size of 2048 bytes */
+diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
+index 35630ccbe9e5..33c9ca8f14a9 100644
+--- a/drivers/mmc/host/tmio_mmc_core.c
++++ b/drivers/mmc/host/tmio_mmc_core.c
+@@ -1267,7 +1267,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host)
+ return ret;
+ }
+
+- mmc->caps |= MMC_CAP_4_BIT_DATA | pdata->capabilities;
++ mmc->caps |= MMC_CAP_ERASE | MMC_CAP_4_BIT_DATA | pdata->capabilities;
+ mmc->caps2 |= pdata->capabilities2;
+ mmc->max_segs = pdata->max_segs ? : 32;
+ mmc->max_blk_size = 512;
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+index 07d2f3aa2c02..ae4c37e1bb75 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -608,7 +608,7 @@ static int kvaser_usb_leaf_simple_cmd_async(struct kvaser_usb_net_priv *priv,
+ struct kvaser_cmd *cmd;
+ int err;
+
+- cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
++ cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
+ if (!cmd)
+ return -ENOMEM;
+
+@@ -1140,7 +1140,7 @@ static int kvaser_usb_leaf_set_opt_mode(const struct kvaser_usb_net_priv *priv)
+ struct kvaser_cmd *cmd;
+ int rc;
+
+- cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+ if (!cmd)
+ return -ENOMEM;
+
+@@ -1206,7 +1206,7 @@ static int kvaser_usb_leaf_flush_queue(struct kvaser_usb_net_priv *priv)
+ struct kvaser_cmd *cmd;
+ int rc;
+
+- cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+ if (!cmd)
+ return -ENOMEM;
+
+diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig
+index d3ce1e4cb4d3..dbfb6ad80fac 100644
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -66,6 +66,7 @@ config NET_DSA_REALTEK_SMI
+ config NET_DSA_SMSC_LAN9303
+ tristate
+ select NET_DSA_TAG_LAN9303
++ select REGMAP
+ ---help---
+ This enables support for the SMSC/Microchip LAN9303 3 port ethernet
+ switch chips.
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+index 62da46537734..ab60f4f9cc24 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+@@ -2394,15 +2394,21 @@ static int bnx2x_set_pf_tx_switching(struct bnx2x *bp, bool enable)
+ /* send the ramrod on all the queues of the PF */
+ for_each_eth_queue(bp, i) {
+ struct bnx2x_fastpath *fp = &bp->fp[i];
++ int tx_idx;
+
+ /* Set the appropriate Queue object */
+ q_params.q_obj = &bnx2x_sp_obj(bp, fp).q_obj;
+
+- /* Update the Queue state */
+- rc = bnx2x_queue_state_change(bp, &q_params);
+- if (rc) {
+- BNX2X_ERR("Failed to configure Tx switching\n");
+- return rc;
++ for (tx_idx = FIRST_TX_COS_INDEX;
++ tx_idx < fp->max_cos; tx_idx++) {
++ q_params.params.update.cid_index = tx_idx;
++
++ /* Update the Queue state */
++ rc = bnx2x_queue_state_change(bp, &q_params);
++ if (rc) {
++ BNX2X_ERR("Failed to configure Tx switching\n");
++ return rc;
++ }
+ }
+ }
+
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index 4af78de0e077..01a212097836 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -577,6 +577,8 @@ static int gmac_setup_txqs(struct net_device *netdev)
+
+ if (port->txq_dma_base & ~DMA_Q_BASE_MASK) {
+ dev_warn(geth->dev, "TX queue base is not aligned\n");
++ dma_free_coherent(geth->dev, len * sizeof(*desc_ring),
++ desc_ring, port->txq_dma_base);
+ kfree(skb_tab);
+ return -ENOMEM;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index e8936ae46add..718afa4be2a0 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -456,9 +456,9 @@ hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ skb_tx_timestamp(skb);
+
+ hip04_set_xmit_desc(priv, phys);
+- priv->tx_head = TX_NEXT(tx_head);
+ count++;
+ netdev_sent_queue(ndev, skb->len);
++ priv->tx_head = TX_NEXT(tx_head);
+
+ stats->tx_bytes += skb->len;
+ stats->tx_packets++;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 0788e78747d9..1aaf6e2a3b39 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1474,6 +1474,9 @@ static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev)
+ time_after(jiffies,
+ (trans_start + ndev->watchdog_timeo))) {
+ timeout_queue = i;
++ netdev_info(ndev, "queue state: 0x%lx, delta msecs: %u\n",
++ q->state,
++ jiffies_to_msecs(jiffies - trans_start));
+ break;
+ }
+ }
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 1a66373184d6..23b31b2ff5cc 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -3441,14 +3441,14 @@ static void i40e_vsi_configure_msix(struct i40e_vsi *vsi)
+ q_vector->rx.target_itr =
+ ITR_TO_REG(vsi->rx_rings[i]->itr_setting);
+ wr32(hw, I40E_PFINT_ITRN(I40E_RX_ITR, vector - 1),
+- q_vector->rx.target_itr);
++ q_vector->rx.target_itr >> 1);
+ q_vector->rx.current_itr = q_vector->rx.target_itr;
+
+ q_vector->tx.next_update = jiffies + 1;
+ q_vector->tx.target_itr =
+ ITR_TO_REG(vsi->tx_rings[i]->itr_setting);
+ wr32(hw, I40E_PFINT_ITRN(I40E_TX_ITR, vector - 1),
+- q_vector->tx.target_itr);
++ q_vector->tx.target_itr >> 1);
+ q_vector->tx.current_itr = q_vector->tx.target_itr;
+
+ wr32(hw, I40E_PFINT_RATEN(vector - 1),
+@@ -3553,11 +3553,11 @@ static void i40e_configure_msi_and_legacy(struct i40e_vsi *vsi)
+ /* set the ITR configuration */
+ q_vector->rx.next_update = jiffies + 1;
+ q_vector->rx.target_itr = ITR_TO_REG(vsi->rx_rings[0]->itr_setting);
+- wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.target_itr);
++ wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.target_itr >> 1);
+ q_vector->rx.current_itr = q_vector->rx.target_itr;
+ q_vector->tx.next_update = jiffies + 1;
+ q_vector->tx.target_itr = ITR_TO_REG(vsi->tx_rings[0]->itr_setting);
+- wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.target_itr);
++ wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.target_itr >> 1);
+ q_vector->tx.current_itr = q_vector->tx.target_itr;
+
+ i40e_enable_misc_int_causes(pf);
+@@ -10735,7 +10735,7 @@ static int i40e_setup_misc_vector(struct i40e_pf *pf)
+
+ /* associate no queues to the misc vector */
+ wr32(hw, I40E_PFINT_LNKLST0, I40E_QUEUE_END_OF_LIST);
+- wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), I40E_ITR_8K);
++ wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), I40E_ITR_8K >> 1);
+
+ i40e_flush(hw);
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c
+index 89f18fe18fe3..921cc0c9a30d 100644
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
+@@ -911,7 +911,7 @@ ice_sq_send_cmd(struct ice_hw *hw, struct ice_ctl_q_info *cq,
+ if (ice_sq_done(hw, cq))
+ break;
+
+- mdelay(1);
++ udelay(ICE_CTL_Q_SQ_CMD_USEC);
+ total_delay++;
+ } while (total_delay < cq->sq_cmd_timeout);
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.h b/drivers/net/ethernet/intel/ice/ice_controlq.h
+index ea02b89243e2..0f2cdb06e6ef 100644
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.h
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.h
+@@ -30,8 +30,9 @@ enum ice_ctl_q {
+ ICE_CTL_Q_ADMIN,
+ };
+
+-/* Control Queue default settings */
+-#define ICE_CTL_Q_SQ_CMD_TIMEOUT 250 /* msecs */
++/* Control Queue timeout settings - max delay 250ms */
++#define ICE_CTL_Q_SQ_CMD_TIMEOUT 2500 /* Count 2500 times */
++#define ICE_CTL_Q_SQ_CMD_USEC 100 /* Check every 100usec */
+
+ struct ice_ctl_q_ring {
+ void *dma_head; /* Virtual address to dma head */
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index b45a6e2ed8d1..de65ca1e6558 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -8551,7 +8551,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
+
+ if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+ adapter->ptp_clock) {
+- if (!test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
++ if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
++ !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
+ &adapter->state)) {
+ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+ tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c
+index b16ce7d93caf..c3d5d40afec0 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c
+@@ -1230,7 +1230,7 @@ qede_configure_mcast_filtering(struct net_device *ndev,
+ netif_addr_lock_bh(ndev);
+
+ mc_count = netdev_mc_count(ndev);
+- if (mc_count < 64) {
++ if (mc_count <= 64) {
+ netdev_for_each_mc_addr(ha, ndev) {
+ ether_addr_copy(temp, ha->addr);
+ temp += ETH_ALEN;
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
+index 630b13a9c3d5..0d8e39ffbcd1 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
+@@ -1362,6 +1362,7 @@ static int qede_alloc_mem_rxq(struct qede_dev *edev, struct qede_rx_queue *rxq)
+ rxq->rx_buf_seg_size = roundup_pow_of_two(size);
+ } else {
+ rxq->rx_buf_seg_size = PAGE_SIZE;
++ edev->ndev->features &= ~NETIF_F_GRO_HW;
+ }
+
+ /* Allocate the parallel driver ring for Rx buffers */
+@@ -1406,6 +1407,7 @@ static int qede_alloc_mem_rxq(struct qede_dev *edev, struct qede_rx_queue *rxq)
+ }
+ }
+
++ edev->gro_disable = !(edev->ndev->features & NETIF_F_GRO_HW);
+ if (!edev->gro_disable)
+ qede_set_tpa_param(rxq);
+ err:
+@@ -1606,8 +1608,6 @@ static void qede_init_fp(struct qede_dev *edev)
+ snprintf(fp->name, sizeof(fp->name), "%s-fp-%d",
+ edev->ndev->name, queue_id);
+ }
+-
+- edev->gro_disable = !(edev->ndev->features & NETIF_F_GRO_HW);
+ }
+
+ static int qede_set_real_num_queues(struct qede_dev *edev)
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
+index 783ee6a32b5d..1b5e098b2367 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -2757,6 +2757,9 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev)
+ int err;
+
+ for (i = 0; i < qdev->num_large_buffers; i++) {
++ lrg_buf_cb = &qdev->lrg_buf[i];
++ memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb));
++
+ skb = netdev_alloc_skb(qdev->ndev,
+ qdev->lrg_buffer_len);
+ if (unlikely(!skb)) {
+@@ -2767,11 +2770,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev)
+ ql_free_large_buffers(qdev);
+ return -ENOMEM;
+ } else {
+-
+- lrg_buf_cb = &qdev->lrg_buf[i];
+- memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb));
+ lrg_buf_cb->index = i;
+- lrg_buf_cb->skb = skb;
+ /*
+ * We save some space to copy the ethhdr from first
+ * buffer
+@@ -2793,6 +2792,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev)
+ return -ENOMEM;
+ }
+
++ lrg_buf_cb->skb = skb;
+ dma_unmap_addr_set(lrg_buf_cb, mapaddr, map);
+ dma_unmap_len_set(lrg_buf_cb, maplen,
+ qdev->lrg_buffer_len -
+diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
+index 5766225a4ce1..c245629a38c7 100644
+--- a/drivers/net/ethernet/ti/cpsw_ale.c
++++ b/drivers/net/ethernet/ti/cpsw_ale.c
+@@ -793,6 +793,7 @@ EXPORT_SYMBOL_GPL(cpsw_ale_start);
+ void cpsw_ale_stop(struct cpsw_ale *ale)
+ {
+ del_timer_sync(&ale->timer);
++ cpsw_ale_control_set(ale, 0, ALE_CLEAR, 1);
+ cpsw_ale_control_set(ale, 0, ALE_ENABLE, 0);
+ }
+ EXPORT_SYMBOL_GPL(cpsw_ale_stop);
+@@ -877,6 +878,7 @@ struct cpsw_ale *cpsw_ale_create(struct cpsw_ale_params *params)
+ ALE_UNKNOWNVLAN_FORCE_UNTAG_EGRESS;
+ }
+
++ cpsw_ale_control_set(ale, 0, ALE_CLEAR, 1);
+ return ale;
+ }
+ EXPORT_SYMBOL_GPL(cpsw_ale_create);
+diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
+index 61a9843346ad..1979f8f8dac7 100644
+--- a/drivers/net/fjes/fjes_main.c
++++ b/drivers/net/fjes/fjes_main.c
+@@ -181,6 +181,9 @@ static int fjes_acpi_add(struct acpi_device *device)
+ /* create platform_device */
+ plat_dev = platform_device_register_simple(DRV_NAME, 0, fjes_resource,
+ ARRAY_SIZE(fjes_resource));
++ if (IS_ERR(plat_dev))
++ return PTR_ERR(plat_dev);
++
+ device->driver_data = plat_dev;
+
+ return 0;
+diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
+index eeadfde15940..879096d3ff41 100644
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -86,6 +86,10 @@
+ #define DP83867_IO_MUX_CFG_CLK_O_SEL_MASK (0x1f << 8)
+ #define DP83867_IO_MUX_CFG_CLK_O_SEL_SHIFT 8
+
++/* CFG3 bits */
++#define DP83867_CFG3_INT_OE BIT(7)
++#define DP83867_CFG3_ROBUST_AUTO_MDIX BIT(9)
++
+ /* CFG4 bits */
+ #define DP83867_CFG4_PORT_MIRROR_EN BIT(0)
+
+@@ -331,12 +335,13 @@ static int dp83867_config_init(struct phy_device *phydev)
+ return ret;
+ }
+
++ val = phy_read(phydev, DP83867_CFG3);
+ /* Enable Interrupt output INT_OE in CFG3 register */
+- if (phy_interrupt_is_valid(phydev)) {
+- val = phy_read(phydev, DP83867_CFG3);
+- val |= BIT(7);
+- phy_write(phydev, DP83867_CFG3, val);
+- }
++ if (phy_interrupt_is_valid(phydev))
++ val |= DP83867_CFG3_INT_OE;
++
++ val |= DP83867_CFG3_ROBUST_AUTO_MDIX;
++ phy_write(phydev, DP83867_CFG3, val);
+
+ if (dp83867->port_mirroring != DP83867_PORT_MIRROING_KEEP)
+ dp83867_config_port_mirroring(phydev);
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 6144146aec29..43c4f358eeb8 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -420,8 +420,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
+ mdiodev->device_free = phy_mdio_device_free;
+ mdiodev->device_remove = phy_mdio_device_remove;
+
+- dev->speed = 0;
+- dev->duplex = -1;
++ dev->speed = SPEED_UNKNOWN;
++ dev->duplex = DUPLEX_UNKNOWN;
+ dev->pause = 0;
+ dev->asym_pause = 0;
+ dev->link = 0;
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index e1ac1c57089f..bbd92221c6ca 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -319,8 +319,8 @@ static void tun_napi_init(struct tun_struct *tun, struct tun_file *tfile,
+ tfile->napi_enabled = napi_en;
+ tfile->napi_frags_enabled = napi_en && napi_frags;
+ if (napi_en) {
+- netif_napi_add(tun->dev, &tfile->napi, tun_napi_poll,
+- NAPI_POLL_WEIGHT);
++ netif_tx_napi_add(tun->dev, &tfile->napi, tun_napi_poll,
++ NAPI_POLL_WEIGHT);
+ napi_enable(&tfile->napi);
+ }
+ }
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 50bf4b2080d5..6dd24a1ca10d 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1823,6 +1823,7 @@ static int lan78xx_mdio_init(struct lan78xx_net *dev)
+ dev->mdiobus->read = lan78xx_mdiobus_read;
+ dev->mdiobus->write = lan78xx_mdiobus_write;
+ dev->mdiobus->name = "lan78xx-mdiobus";
++ dev->mdiobus->parent = &dev->udev->dev;
+
+ snprintf(dev->mdiobus->id, MII_BUS_ID_SIZE, "usb-%03d:%03d",
+ dev->udev->bus->busnum, dev->udev->devnum);
+diff --git a/drivers/net/wireless/ath/ath10k/coredump.c b/drivers/net/wireless/ath/ath10k/coredump.c
+index 4d28063052fe..385b84f24322 100644
+--- a/drivers/net/wireless/ath/ath10k/coredump.c
++++ b/drivers/net/wireless/ath/ath10k/coredump.c
+@@ -1105,9 +1105,11 @@ static struct ath10k_dump_file_data *ath10k_coredump_build(struct ath10k *ar)
+ dump_tlv = (struct ath10k_tlv_dump_data *)(buf + sofar);
+ dump_tlv->type = cpu_to_le32(ATH10K_FW_CRASH_DUMP_RAM_DATA);
+ dump_tlv->tlv_len = cpu_to_le32(crash_data->ramdump_buf_len);
+- memcpy(dump_tlv->tlv_data, crash_data->ramdump_buf,
+- crash_data->ramdump_buf_len);
+- sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len;
++ if (crash_data->ramdump_buf_len) {
++ memcpy(dump_tlv->tlv_data, crash_data->ramdump_buf,
++ crash_data->ramdump_buf_len);
++ sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len;
++ }
+ }
+
+ spin_unlock_bh(&ar->data_lock);
+@@ -1154,6 +1156,9 @@ int ath10k_coredump_register(struct ath10k *ar)
+ if (test_bit(ATH10K_FW_CRASH_DUMP_RAM_DATA, &ath10k_coredump_mask)) {
+ crash_data->ramdump_buf_len = ath10k_coredump_get_ramdump_size(ar);
+
++ if (!crash_data->ramdump_buf_len)
++ return 0;
++
+ crash_data->ramdump_buf = vzalloc(crash_data->ramdump_buf_len);
+ if (!crash_data->ramdump_buf)
+ return -ENOMEM;
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 613ca74f1b28..448e3a8c33a6 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -3651,7 +3651,7 @@ static int ath10k_mac_tx(struct ath10k *ar,
+ struct ieee80211_vif *vif,
+ enum ath10k_hw_txrx_mode txmode,
+ enum ath10k_mac_tx_path txpath,
+- struct sk_buff *skb)
++ struct sk_buff *skb, bool noque_offchan)
+ {
+ struct ieee80211_hw *hw = ar->hw;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+@@ -3679,10 +3679,10 @@ static int ath10k_mac_tx(struct ath10k *ar,
+ }
+ }
+
+- if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
++ if (!noque_offchan && info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
+ if (!ath10k_mac_tx_frm_has_freq(ar)) {
+- ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %pK\n",
+- skb);
++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac queued offchannel skb %pK len %d\n",
++ skb, skb->len);
+
+ skb_queue_tail(&ar->offchan_tx_queue, skb);
+ ieee80211_queue_work(hw, &ar->offchan_tx_work);
+@@ -3744,8 +3744,8 @@ void ath10k_offchan_tx_work(struct work_struct *work)
+
+ mutex_lock(&ar->conf_mutex);
+
+- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK\n",
+- skb);
++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK len %d\n",
++ skb, skb->len);
+
+ hdr = (struct ieee80211_hdr *)skb->data;
+ peer_addr = ieee80211_get_DA(hdr);
+@@ -3791,7 +3791,7 @@ void ath10k_offchan_tx_work(struct work_struct *work)
+ txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
+ txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
+
+- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb);
++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, true);
+ if (ret) {
+ ath10k_warn(ar, "failed to transmit offchannel frame: %d\n",
+ ret);
+@@ -3801,8 +3801,8 @@ void ath10k_offchan_tx_work(struct work_struct *work)
+ time_left =
+ wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ);
+ if (time_left == 0)
+- ath10k_warn(ar, "timed out waiting for offchannel skb %pK\n",
+- skb);
++ ath10k_warn(ar, "timed out waiting for offchannel skb %pK, len: %d\n",
++ skb, skb->len);
+
+ if (!peer && tmp_peer_created) {
+ ret = ath10k_peer_delete(ar, vdev_id, peer_addr);
+@@ -3844,8 +3844,10 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
+ ar->running_fw->fw_file.fw_features)) {
+ paddr = dma_map_single(ar->dev, skb->data,
+ skb->len, DMA_TO_DEVICE);
+- if (!paddr)
++ if (dma_mapping_error(ar->dev, paddr)) {
++ ieee80211_free_txskb(ar->hw, skb);
+ continue;
++ }
+ ret = ath10k_wmi_mgmt_tx_send(ar, skb, paddr);
+ if (ret) {
+ ath10k_warn(ar, "failed to transmit management frame by ref via WMI: %d\n",
+@@ -3998,7 +4000,7 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw,
+ spin_unlock_bh(&ar->htt.tx_lock);
+ }
+
+- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb);
++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false);
+ if (unlikely(ret)) {
+ ath10k_warn(ar, "failed to push frame: %d\n", ret);
+
+@@ -4280,7 +4282,7 @@ static void ath10k_mac_op_tx(struct ieee80211_hw *hw,
+ spin_unlock_bh(&ar->htt.tx_lock);
+ }
+
+- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb);
++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false);
+ if (ret) {
+ ath10k_warn(ar, "failed to transmit frame: %d\n", ret);
+ if (is_htt) {
+diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
+index 6f62ddc0494c..6c47e4b6aa6c 100644
+--- a/drivers/net/wireless/ath/ath10k/txrx.c
++++ b/drivers/net/wireless/ath/ath10k/txrx.c
+@@ -101,6 +101,8 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt,
+
+ info = IEEE80211_SKB_CB(msdu);
+ memset(&info->status, 0, sizeof(info->status));
++ info->status.rates[0].idx = -1;
++
+ trace_ath10k_txrx_tx_unref(ar, tx_done->msdu_id);
+
+ if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+index 0f56be13c7ad..584e05fdca6a 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1246,6 +1246,11 @@ void brcmf_detach(struct device *dev)
+
+ brcmf_proto_detach_pre_delif(drvr);
+
++ if (drvr->mon_if) {
++ brcmf_net_detach(drvr->mon_if->ndev, false);
++ drvr->mon_if = NULL;
++ }
++
+ /* make sure primary interface removed last */
+ for (i = BRCMF_MAX_IFS-1; i > -1; i--)
+ brcmf_remove_interface(drvr->iflist[i], false);
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/led.c b/drivers/net/wireless/intel/iwlwifi/dvm/led.c
+index 1bbd17ada974..20e16c423990 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/led.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/led.c
+@@ -185,6 +185,9 @@ void iwl_leds_init(struct iwl_priv *priv)
+
+ priv->led.name = kasprintf(GFP_KERNEL, "%s-led",
+ wiphy_name(priv->hw->wiphy));
++ if (!priv->led.name)
++ return;
++
+ priv->led.brightness_set = iwl_led_brightness_set;
+ priv->led.blink_set = iwl_led_blink_set;
+ priv->led.max_brightness = 1;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/led.c b/drivers/net/wireless/intel/iwlwifi/mvm/led.c
+index b27269504a62..072f80c90ce4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/led.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/led.c
+@@ -131,6 +131,9 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm)
+
+ mvm->led.name = kasprintf(GFP_KERNEL, "%s-led",
+ wiphy_name(mvm->hw->wiphy));
++ if (!mvm->led.name)
++ return -ENOMEM;
++
+ mvm->led.brightness_set = iwl_led_brightness_set;
+ mvm->led.max_brightness = 1;
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+index bfb163419c67..e6a67bc02209 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+@@ -62,6 +62,7 @@
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
++#include <asm/unaligned.h>
+ #include <linux/etherdevice.h>
+ #include <linux/skbuff.h>
+ #include "iwl-trans.h"
+@@ -360,7 +361,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
+ rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data;
+ hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res));
+ len = le16_to_cpu(rx_res->byte_count);
+- rx_pkt_status = le32_to_cpup((__le32 *)
++ rx_pkt_status = get_unaligned_le32((__le32 *)
+ (pkt->data + sizeof(*rx_res) + len));
+
+ /* Dont use dev_alloc_skb(), we'll have enough headroom once
+diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c
+index 39bf85d0ade0..c7f8a29d2606 100644
+--- a/drivers/net/wireless/marvell/libertas/if_sdio.c
++++ b/drivers/net/wireless/marvell/libertas/if_sdio.c
+@@ -1183,6 +1183,10 @@ static int if_sdio_probe(struct sdio_func *func,
+
+ spin_lock_init(&card->lock);
+ card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0);
++ if (unlikely(!card->workqueue)) {
++ ret = -ENOMEM;
++ goto err_queue;
++ }
+ INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker);
+ init_waitqueue_head(&card->pwron_waitq);
+
+@@ -1234,6 +1238,7 @@ err_activate_card:
+ lbs_remove_card(priv);
+ free:
+ destroy_workqueue(card->workqueue);
++err_queue:
+ while (card->packets) {
+ packet = card->packets;
+ card->packets = card->packets->next;
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
+index 3fe81b2a929a..918c69936540 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -691,8 +691,11 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)
+ skb_put(skb, MAX_EVENT_SIZE);
+
+ if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE,
+- PCI_DMA_FROMDEVICE))
++ PCI_DMA_FROMDEVICE)) {
++ kfree_skb(skb);
++ kfree(card->evtbd_ring_vbase);
+ return -1;
++ }
+
+ buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+index 8828baf26e7b..47c2bfe06d03 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+@@ -1349,6 +1349,7 @@ struct rtl8xxxu_fileops {
+ u8 has_s0s1:1;
+ u8 has_tx_report:1;
+ u8 gen2_thermal_meter:1;
++ u8 needs_full_init:1;
+ u32 adda_1t_init;
+ u32 adda_1t_path_on;
+ u32 adda_2t_path_on_a;
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
+index 26b674aca125..14e207f2466c 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
+@@ -1673,6 +1673,7 @@ struct rtl8xxxu_fileops rtl8723bu_fops = {
+ .has_s0s1 = 1,
+ .has_tx_report = 1,
+ .gen2_thermal_meter = 1,
++ .needs_full_init = 1,
+ .adda_1t_init = 0x01c00014,
+ .adda_1t_path_on = 0x01c00014,
+ .adda_2t_path_on_a = 0x01c00014,
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 2b4fcdf4ec5b..66c6ee70f00a 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -3905,6 +3905,9 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
+ else
+ macpower = true;
+
++ if (fops->needs_full_init)
++ macpower = false;
++
+ ret = fops->power_on(priv);
+ if (ret < 0) {
+ dev_warn(dev, "%s: Failed power on\n", __func__);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
+index 1e60f70481f5..8c60a84941d5 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
+@@ -1556,6 +1556,8 @@ static bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb)
+ * This is maybe necessary:
+ * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb);
+ */
++ dev_kfree_skb(skb);
++
+ return true;
+ }
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 5adb939afee8..1181b725f503 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1050,8 +1050,10 @@ int rtl_usb_probe(struct usb_interface *intf,
+ rtlpriv->hw = hw;
+ rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32),
+ GFP_KERNEL);
+- if (!rtlpriv->usb_data)
++ if (!rtlpriv->usb_data) {
++ ieee80211_free_hw(hw);
+ return -ENOMEM;
++ }
+
+ /* this spin lock must be initialized early */
+ spin_lock_init(&rtlpriv->locks.usb_lock);
+@@ -1112,6 +1114,7 @@ error_out2:
+ _rtl_usb_io_handler_release(hw);
+ usb_put_dev(udev);
+ complete(&rtlpriv->firmware_loading_complete);
++ kfree(rtlpriv->usb_data);
+ return -ENODEV;
+ }
+ EXPORT_SYMBOL(rtl_usb_probe);
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index b2d9bd564960..b7bd89b3b2f9 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -551,8 +551,14 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
+ struct nvme_dsm_range *range;
+ struct bio *bio;
+
+- range = kmalloc_array(segments, sizeof(*range),
+- GFP_ATOMIC | __GFP_NOWARN);
++ /*
++ * Some devices do not consider the DSM 'Number of Ranges' field when
++ * determining how much data to DMA. Always allocate memory for maximum
++ * number of segments to prevent device reading beyond end of buffer.
++ */
++ static const size_t alloc_size = sizeof(*range) * NVME_DSM_MAX_RANGES;
++
++ range = kzalloc(alloc_size, GFP_ATOMIC | __GFP_NOWARN);
+ if (!range) {
+ /*
+ * If we fail allocation our range, fallback to the controller
+@@ -593,7 +599,7 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
+
+ req->special_vec.bv_page = virt_to_page(range);
+ req->special_vec.bv_offset = offset_in_page(range);
+- req->special_vec.bv_len = sizeof(*range) * segments;
++ req->special_vec.bv_len = alloc_size;
+ req->rq_flags |= RQF_SPECIAL_PAYLOAD;
+
+ return BLK_STS_OK;
+diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
+index afb429a417fe..926d9cc080cf 100644
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -466,6 +466,10 @@ static int imx_ocotp_probe(struct platform_device *pdev)
+ if (IS_ERR(priv->clk))
+ return PTR_ERR(priv->clk);
+
++ clk_prepare_enable(priv->clk);
++ imx_ocotp_clr_err_if_set(priv->base);
++ clk_disable_unprepare(priv->clk);
++
+ priv->params = of_device_get_match_data(&pdev->dev);
+ imx_ocotp_nvmem_config.size = 4 * priv->params->nregs;
+ imx_ocotp_nvmem_config.dev = dev;
+diff --git a/drivers/parport/share.c b/drivers/parport/share.c
+index 7b4ee33c1935..15c81cffd2de 100644
+--- a/drivers/parport/share.c
++++ b/drivers/parport/share.c
+@@ -230,6 +230,18 @@ static int port_check(struct device *dev, void *dev_drv)
+ return 0;
+ }
+
++/*
++ * Iterates through all the devices connected to the bus and return 1
++ * if the device is a parallel port.
++ */
++
++static int port_detect(struct device *dev, void *dev_drv)
++{
++ if (is_parport(dev))
++ return 1;
++ return 0;
++}
++
+ /**
+ * parport_register_driver - register a parallel port device driver
+ * @drv: structure describing the driver
+@@ -282,6 +294,15 @@ int __parport_register_driver(struct parport_driver *drv, struct module *owner,
+ if (ret)
+ return ret;
+
++ /*
++ * check if bus has any parallel port registered, if
++ * none is found then load the lowlevel driver.
++ */
++ ret = bus_for_each_dev(&parport_bus_type, NULL, NULL,
++ port_detect);
++ if (!ret)
++ get_lowlevel_driver();
++
+ mutex_lock(®istration_lock);
+ if (drv->match_port)
+ bus_for_each_dev(&parport_bus_type, NULL, drv,
+diff --git a/drivers/phy/qualcomm/phy-qcom-usb-hs.c b/drivers/phy/qualcomm/phy-qcom-usb-hs.c
+index abbbe75070da..5629d56a6257 100644
+--- a/drivers/phy/qualcomm/phy-qcom-usb-hs.c
++++ b/drivers/phy/qualcomm/phy-qcom-usb-hs.c
+@@ -160,8 +160,8 @@ static int qcom_usb_hs_phy_power_on(struct phy *phy)
+ /* setup initial state */
+ qcom_usb_hs_phy_vbus_notifier(&uphy->vbus_notify, state,
+ uphy->vbus_edev);
+- ret = devm_extcon_register_notifier(&ulpi->dev, uphy->vbus_edev,
+- EXTCON_USB, &uphy->vbus_notify);
++ ret = extcon_register_notifier(uphy->vbus_edev, EXTCON_USB,
++ &uphy->vbus_notify);
+ if (ret)
+ goto err_ulpi;
+ }
+@@ -182,6 +182,9 @@ static int qcom_usb_hs_phy_power_off(struct phy *phy)
+ {
+ struct qcom_usb_hs_phy *uphy = phy_get_drvdata(phy);
+
++ if (uphy->vbus_edev)
++ extcon_unregister_notifier(uphy->vbus_edev, EXTCON_USB,
++ &uphy->vbus_notify);
+ regulator_disable(uphy->v3p3);
+ regulator_disable(uphy->v1p8);
+ clk_disable_unprepare(uphy->sleep_clk);
+diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
+index 2969ff3162c3..177ee1136e34 100644
+--- a/drivers/pinctrl/devicetree.c
++++ b/drivers/pinctrl/devicetree.c
+@@ -40,6 +40,13 @@ struct pinctrl_dt_map {
+ static void dt_free_map(struct pinctrl_dev *pctldev,
+ struct pinctrl_map *map, unsigned num_maps)
+ {
++ int i;
++
++ for (i = 0; i < num_maps; ++i) {
++ kfree_const(map[i].dev_name);
++ map[i].dev_name = NULL;
++ }
++
+ if (pctldev) {
+ const struct pinctrl_ops *ops = pctldev->desc->pctlops;
+ if (ops->dt_free_map)
+@@ -74,7 +81,13 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename,
+
+ /* Initialize common mapping table entry fields */
+ for (i = 0; i < num_maps; i++) {
+- map[i].dev_name = dev_name(p->dev);
++ const char *devname;
++
++ devname = kstrdup_const(dev_name(p->dev), GFP_KERNEL);
++ if (!devname)
++ goto err_free_map;
++
++ map[i].dev_name = devname;
+ map[i].name = statename;
+ if (pctldev)
+ map[i].ctrl_dev_name = dev_name(pctldev->dev);
+@@ -82,10 +95,8 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename,
+
+ /* Remember the converted mapping table entries */
+ dt_map = kzalloc(sizeof(*dt_map), GFP_KERNEL);
+- if (!dt_map) {
+- dt_free_map(pctldev, map, num_maps);
+- return -ENOMEM;
+- }
++ if (!dt_map)
++ goto err_free_map;
+
+ dt_map->pctldev = pctldev;
+ dt_map->map = map;
+@@ -93,6 +104,10 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename,
+ list_add_tail(&dt_map->node, &p->dt_maps);
+
+ return pinctrl_register_map(map, num_maps, false);
++
++err_free_map:
++ dt_free_map(pctldev, map, num_maps);
++ return -ENOMEM;
+ }
+
+ struct pinctrl_dev *of_pinctrl_get(struct device_node *np)
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index cd7a5d95b499..b1ffdd3f6d07 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -544,7 +544,8 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
+ irqreturn_t ret = IRQ_NONE;
+ unsigned int i, irqnr;
+ unsigned long flags;
+- u32 *regs, regval;
++ u32 __iomem *regs;
++ u32 regval;
+ u64 status, mask;
+
+ /* Read the wake status */
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 33232041ee86..3eccc9b3ca84 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -1453,7 +1453,7 @@ static const struct pinmux_func pinmux_func_gpios[] = {
+ GPIO_FN(ET0_ETXD2_A),
+ GPIO_FN(EX_CS5), GPIO_FN(SD1_CMD_A), GPIO_FN(ATADIR), GPIO_FN(QSSL_B),
+ GPIO_FN(ET0_ETXD3_A),
+- GPIO_FN(RD_WR), GPIO_FN(TCLK1_B),
++ GPIO_FN(RD_WR), GPIO_FN(TCLK0), GPIO_FN(CAN_CLK_B), GPIO_FN(ET0_ETXD4),
+ GPIO_FN(EX_WAIT0), GPIO_FN(TCLK1_B),
+ GPIO_FN(EX_WAIT1), GPIO_FN(SD1_DAT0_A), GPIO_FN(DREQ2),
+ GPIO_FN(CAN1_TX_C), GPIO_FN(ET0_LINK_C), GPIO_FN(ET0_ETXD5_A),
+@@ -1949,7 +1949,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ /* IP3_20 [1] */
+ FN_EX_WAIT0, FN_TCLK1_B,
+ /* IP3_19_18 [2] */
+- FN_RD_WR, FN_TCLK1_B, 0, 0,
++ FN_RD_WR, FN_TCLK0, FN_CAN_CLK_B, FN_ET0_ETXD4,
+ /* IP3_17_15 [3] */
+ FN_EX_CS5, FN_SD1_CMD_A, FN_ATADIR, FN_QSSL_B,
+ FN_ET0_ETXD3_A, 0, 0, 0,
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index d0ffdd5d9199..06a3c1ef8eee 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -313,7 +313,7 @@ static int __init hp_wmi_bios_2008_later(void)
+
+ static int __init hp_wmi_bios_2009_later(void)
+ {
+- int state = 0;
++ u8 state[128];
+ int ret = hp_wmi_perform_query(HPWMI_FEATURE2_QUERY, HPWMI_READ, &state,
+ sizeof(state), sizeof(state));
+ if (!ret)
+diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c
+index 860400d2cd85..a8f2f07239fb 100644
+--- a/drivers/regulator/max8907-regulator.c
++++ b/drivers/regulator/max8907-regulator.c
+@@ -299,7 +299,10 @@ static int max8907_regulator_probe(struct platform_device *pdev)
+ memcpy(pmic->desc, max8907_regulators, sizeof(pmic->desc));
+
+ /* Backwards compatibility with MAX8907B; SD1 uses different voltages */
+- regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val);
++ ret = regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val);
++ if (ret)
++ return ret;
++
+ if ((val & MAX8907_II2RR_VERSION_MASK) ==
+ MAX8907_II2RR_VERSION_REV_B) {
+ pmic->desc[MAX8907_SD1].min_uV = 637500;
+@@ -336,14 +339,20 @@ static int max8907_regulator_probe(struct platform_device *pdev)
+ }
+
+ if (pmic->desc[i].ops == &max8907_ldo_ops) {
+- regmap_read(config.regmap, pmic->desc[i].enable_reg,
++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg,
+ &val);
++ if (ret)
++ return ret;
++
+ if ((val & MAX8907_MASK_LDO_SEQ) !=
+ MAX8907_MASK_LDO_SEQ)
+ pmic->desc[i].ops = &max8907_ldo_hwctl_ops;
+ } else if (pmic->desc[i].ops == &max8907_out5v_ops) {
+- regmap_read(config.regmap, pmic->desc[i].enable_reg,
++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg,
+ &val);
++ if (ret)
++ return ret;
++
+ if ((val & (MAX8907_MASK_OUT5V_VINEN |
+ MAX8907_MASK_OUT5V_ENSRC)) !=
+ MAX8907_MASK_OUT5V_ENSRC)
+diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
+index 29bc99c4a7b6..e49d3c810677 100644
+--- a/drivers/soundwire/intel.c
++++ b/drivers/soundwire/intel.c
+@@ -352,7 +352,10 @@ intel_pdi_shim_configure(struct sdw_intel *sdw, struct sdw_cdns_pdi *pdi)
+ unsigned int link_id = sdw->instance;
+ int pdi_conf = 0;
+
+- pdi->intel_alh_id = (link_id * 16) + pdi->num + 5;
++ /* the Bulk and PCM streams are not contiguous */
++ pdi->intel_alh_id = (link_id * 16) + pdi->num + 3;
++ if (pdi->num >= 2)
++ pdi->intel_alh_id += 2;
+
+ /*
+ * Program stream parameters to stream SHIM register
+@@ -381,7 +384,10 @@ intel_pdi_alh_configure(struct sdw_intel *sdw, struct sdw_cdns_pdi *pdi)
+ unsigned int link_id = sdw->instance;
+ unsigned int conf;
+
+- pdi->intel_alh_id = (link_id * 16) + pdi->num + 5;
++ /* the Bulk and PCM streams are not contiguous */
++ pdi->intel_alh_id = (link_id * 16) + pdi->num + 3;
++ if (pdi->num >= 2)
++ pdi->intel_alh_id += 2;
+
+ /* Program Stream config ALH register */
+ conf = intel_readl(alh, SDW_ALH_STRMZCFG(pdi->intel_alh_id));
+diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
+index e6eb979f1b8a..e4b31d6e6e33 100644
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -676,6 +676,8 @@ static int img_spfi_probe(struct platform_device *pdev)
+ dma_release_channel(spfi->tx_ch);
+ if (spfi->rx_ch)
+ dma_release_channel(spfi->rx_ch);
++ spfi->tx_ch = NULL;
++ spfi->rx_ch = NULL;
+ dev_warn(spfi->dev, "Failed to get DMA channels, falling back to PIO mode\n");
+ } else {
+ master->dma_tx = spfi->tx_ch;
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index f41333817c50..525388126e26 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1470,7 +1470,13 @@ pxa2xx_spi_init_pdata(struct platform_device *pdev)
+ }
+
+ ssp->clk = devm_clk_get(&pdev->dev, NULL);
++ if (IS_ERR(ssp->clk))
++ return NULL;
++
+ ssp->irq = platform_get_irq(pdev, 0);
++ if (ssp->irq < 0)
++ return NULL;
++
+ ssp->type = type;
+ ssp->pdev = pdev;
+ ssp->port_id = pxa2xx_spi_get_port_id(adev);
+diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
+index df5960bddfe6..f1fc2bde6ef3 100644
+--- a/drivers/spi/spi-sprd-adi.c
++++ b/drivers/spi/spi-sprd-adi.c
+@@ -367,6 +367,9 @@ static int sprd_adi_restart_handler(struct notifier_block *this,
+ val |= BIT_WDG_RUN | BIT_WDG_RST;
+ sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_CTRL, val);
+
++ /* Lock the watchdog */
++ sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOCK, ~WDG_UNLOCK_KEY);
++
+ mdelay(1000);
+
+ dev_emerg(sadi->dev, "Unable to restart system\n");
+diff --git a/drivers/spi/spi-st-ssc4.c b/drivers/spi/spi-st-ssc4.c
+index a4e43fc19ece..5df01ffdef46 100644
+--- a/drivers/spi/spi-st-ssc4.c
++++ b/drivers/spi/spi-st-ssc4.c
+@@ -385,6 +385,7 @@ static int spi_st_probe(struct platform_device *pdev)
+ return 0;
+
+ clk_disable:
++ pm_runtime_disable(&pdev->dev);
+ clk_disable_unprepare(spi_st->clk);
+ put_master:
+ spi_master_put(master);
+@@ -396,6 +397,8 @@ static int spi_st_remove(struct platform_device *pdev)
+ struct spi_master *master = platform_get_drvdata(pdev);
+ struct spi_st *spi_st = spi_master_get_devdata(master);
+
++ pm_runtime_disable(&pdev->dev);
++
+ clk_disable_unprepare(spi_st->clk);
+
+ pinctrl_pm_select_sleep_state(&pdev->dev);
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index 1427f343b39a..d1187317bb5d 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -1078,7 +1078,7 @@ static int tegra_slink_probe(struct platform_device *pdev)
+ ret = clk_enable(tspi->clk);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Clock enable failed %d\n", ret);
+- goto exit_free_master;
++ goto exit_clk_unprepare;
+ }
+
+ spi_irq = platform_get_irq(pdev, 0);
+@@ -1151,6 +1151,8 @@ exit_free_irq:
+ free_irq(spi_irq, tspi);
+ exit_clk_disable:
+ clk_disable(tspi->clk);
++exit_clk_unprepare:
++ clk_unprepare(tspi->clk);
+ exit_free_master:
+ spi_master_put(master);
+ return ret;
+@@ -1164,6 +1166,7 @@ static int tegra_slink_remove(struct platform_device *pdev)
+ free_irq(tspi->irq, tspi);
+
+ clk_disable(tspi->clk);
++ clk_unprepare(tspi->clk);
+
+ if (tspi->tx_dma_chan)
+ tegra_slink_deinit_dma_param(tspi, false);
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index c5fe08bc34a0..028725573e63 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -634,6 +634,9 @@ static int spidev_release(struct inode *inode, struct file *filp)
+ if (dofree)
+ kfree(spidev);
+ }
++#ifdef CONFIG_SPI_SLAVE
++ spi_slave_abort(spidev->spi);
++#endif
+ mutex_unlock(&device_list_lock);
+
+ return 0;
+diff --git a/drivers/staging/comedi/drivers/gsc_hpdi.c b/drivers/staging/comedi/drivers/gsc_hpdi.c
+index 4bdf44d82879..dc62db1ee1dd 100644
+--- a/drivers/staging/comedi/drivers/gsc_hpdi.c
++++ b/drivers/staging/comedi/drivers/gsc_hpdi.c
+@@ -623,6 +623,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev,
+ dma_alloc_coherent(&pcidev->dev, DMA_BUFFER_SIZE,
+ &devpriv->dio_buffer_phys_addr[i],
+ GFP_KERNEL);
++ if (!devpriv->dio_buffer[i]) {
++ dev_warn(dev->class_dev,
++ "failed to allocate DMA buffer\n");
++ return -ENOMEM;
++ }
+ }
+ /* allocate dma descriptors */
+ devpriv->dma_desc = dma_alloc_coherent(&pcidev->dev,
+@@ -630,6 +635,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev,
+ NUM_DMA_DESCRIPTORS,
+ &devpriv->dma_desc_phys_addr,
+ GFP_KERNEL);
++ if (!devpriv->dma_desc) {
++ dev_warn(dev->class_dev,
++ "failed to allocate DMA descriptors\n");
++ return -ENOMEM;
++ }
+ if (devpriv->dma_desc_phys_addr & 0xf) {
+ dev_warn(dev->class_dev,
+ " dma descriptors not quad-word aligned (bug)\n");
+diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c
+index 16fcf633e60f..3fe4738720ea 100644
+--- a/drivers/staging/fbtft/fbtft-core.c
++++ b/drivers/staging/fbtft/fbtft-core.c
+@@ -771,7 +771,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,
+ fbdefio->deferred_io = fbtft_deferred_io;
+ fb_deferred_io_init(info);
+
+- strncpy(info->fix.id, dev->driver->name, 16);
++ snprintf(info->fix.id, sizeof(info->fix.id), "%s", dev->driver->name);
+ info->fix.type = FB_TYPE_PACKED_PIXELS;
+ info->fix.visual = FB_VISUAL_TRUECOLOR;
+ info->fix.xpanstep = 0;
+diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c
+index dd9b02d316f3..c6a5b62cb363 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c
++++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c
+@@ -778,7 +778,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr
+ memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN);
+ memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN);
+
+- if (psta->qos_option)
++ if (psta && psta->qos_option)
+ qos_option = true;
+ } else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
+ check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
+@@ -786,7 +786,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr
+ memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+ memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
+
+- if (psta->qos_option)
++ if (psta && psta->qos_option)
+ qos_option = true;
+ } else {
+ RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv)));
+diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
+index e218b5c20642..2066a1d9bc84 100644
+--- a/drivers/staging/rtl8192u/r8192U_core.c
++++ b/drivers/staging/rtl8192u/r8192U_core.c
+@@ -1467,7 +1467,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
+ (struct tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN);
+ struct usb_device *udev = priv->udev;
+ int pend;
+- int status;
++ int status, rt = -1;
+ struct urb *tx_urb = NULL, *tx_urb_zero = NULL;
+ unsigned int idx_pipe;
+
+@@ -1611,8 +1611,10 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
+ }
+ if (bSend0Byte) {
+ tx_urb_zero = usb_alloc_urb(0, GFP_ATOMIC);
+- if (!tx_urb_zero)
+- return -ENOMEM;
++ if (!tx_urb_zero) {
++ rt = -ENOMEM;
++ goto error;
++ }
+ usb_fill_bulk_urb(tx_urb_zero, udev,
+ usb_sndbulkpipe(udev, idx_pipe),
+ &zero, 0, tx_zero_isr, dev);
+@@ -1622,7 +1624,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
+ "Error TX URB for zero byte %d, error %d",
+ atomic_read(&priv->tx_pending[tcb_desc->queue_index]),
+ status);
+- return -1;
++ goto error;
+ }
+ }
+ netif_trans_update(dev);
+@@ -1633,7 +1635,12 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
+ RT_TRACE(COMP_ERR, "Error TX URB %d, error %d",
+ atomic_read(&priv->tx_pending[tcb_desc->queue_index]),
+ status);
+- return -1;
++
++error:
++ dev_kfree_skb_any(skb);
++ usb_free_urb(tx_urb);
++ usb_free_urb(tx_urb_zero);
++ return rt;
+ }
+
+ static short rtl8192_usb_initendpoints(struct net_device *dev)
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 29c6414f48f1..00204824bffd 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -739,8 +739,15 @@ static int claimintf(struct usb_dev_state *ps, unsigned int ifnum)
+ intf = usb_ifnum_to_if(dev, ifnum);
+ if (!intf)
+ err = -ENOENT;
+- else
++ else {
++ unsigned int old_suppress;
++
++ /* suppress uevents while claiming interface */
++ old_suppress = dev_get_uevent_suppress(&intf->dev);
++ dev_set_uevent_suppress(&intf->dev, 1);
+ err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
++ dev_set_uevent_suppress(&intf->dev, old_suppress);
++ }
+ if (err == 0)
+ set_bit(ifnum, &ps->ifclaimed);
+ return err;
+@@ -760,7 +767,13 @@ static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum)
+ if (!intf)
+ err = -ENOENT;
+ else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
++ unsigned int old_suppress;
++
++ /* suppress uevents while releasing interface */
++ old_suppress = dev_get_uevent_suppress(&intf->dev);
++ dev_set_uevent_suppress(&intf->dev, 1);
+ usb_driver_release_interface(&usbfs_driver, intf);
++ dev_set_uevent_suppress(&intf->dev, old_suppress);
+ err = 0;
+ }
+ return err;
+diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
+index 327630405695..f643603c8de6 100644
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -27,6 +27,10 @@
+
+ /*-------------------------------------------------------------------------*/
+
++/* PID Codes that are used here, from EHCI specification, Table 3-16. */
++#define PID_CODE_IN 1
++#define PID_CODE_SETUP 2
++
+ /* fill a qtd, returning how much of the buffer we were able to queue up */
+
+ static int
+@@ -190,7 +194,7 @@ static int qtd_copy_status (
+ int status = -EINPROGRESS;
+
+ /* count IN/OUT bytes, not SETUP (even short packets) */
+- if (likely (QTD_PID (token) != 2))
++ if (likely(QTD_PID(token) != PID_CODE_SETUP))
+ urb->actual_length += length - QTD_LENGTH (token);
+
+ /* don't modify error codes */
+@@ -206,6 +210,13 @@ static int qtd_copy_status (
+ if (token & QTD_STS_BABBLE) {
+ /* FIXME "must" disable babbling device's port too */
+ status = -EOVERFLOW;
++ /*
++ * When MMF is active and PID Code is IN, queue is halted.
++ * EHCI Specification, Table 4-13.
++ */
++ } else if ((token & QTD_STS_MMF) &&
++ (QTD_PID(token) == PID_CODE_IN)) {
++ status = -EPROTO;
+ /* CERR nonzero + halt --> stall */
+ } else if (QTD_CERR(token)) {
+ status = -EPIPE;
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 74aeaa61f5c6..075c49cfe60f 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -493,7 +493,6 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
+ retval = xhci_resume(xhci, hibernated);
+ return retval;
+ }
+-#endif /* CONFIG_PM */
+
+ static void xhci_pci_shutdown(struct usb_hcd *hcd)
+ {
+@@ -506,6 +505,7 @@ static void xhci_pci_shutdown(struct usb_hcd *hcd)
+ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+ pci_set_power_state(pdev, PCI_D3hot);
+ }
++#endif /* CONFIG_PM */
+
+ /*-------------------------------------------------------------------------*/
+
+diff --git a/drivers/usb/renesas_usbhs/common.h b/drivers/usb/renesas_usbhs/common.h
+index c47b721b8bca..63a75fd9fa0c 100644
+--- a/drivers/usb/renesas_usbhs/common.h
++++ b/drivers/usb/renesas_usbhs/common.h
+@@ -157,11 +157,12 @@ struct usbhs_priv;
+ #define VBSTS (1 << 7) /* VBUS_0 and VBUSIN_0 Input Status */
+ #define VALID (1 << 3) /* USB Request Receive */
+
+-#define DVSQ_MASK (0x3 << 4) /* Device State */
++#define DVSQ_MASK (0x7 << 4) /* Device State */
+ #define POWER_STATE (0 << 4)
+ #define DEFAULT_STATE (1 << 4)
+ #define ADDRESS_STATE (2 << 4)
+ #define CONFIGURATION_STATE (3 << 4)
++#define SUSPENDED_STATE (4 << 4)
+
+ #define CTSQ_MASK (0x7) /* Control Transfer Stage */
+ #define IDLE_SETUP_STAGE 0 /* Idle stage or setup stage */
+diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
+index 7feac4128a2d..f36248e9387d 100644
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -456,12 +456,18 @@ static int usbhsg_irq_dev_state(struct usbhs_priv *priv,
+ {
+ struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv);
+ struct device *dev = usbhsg_gpriv_to_dev(gpriv);
++ int state = usbhs_status_get_device_state(irq_state);
+
+ gpriv->gadget.speed = usbhs_bus_get_speed(priv);
+
+- dev_dbg(dev, "state = %x : speed : %d\n",
+- usbhs_status_get_device_state(irq_state),
+- gpriv->gadget.speed);
++ dev_dbg(dev, "state = %x : speed : %d\n", state, gpriv->gadget.speed);
++
++ if (gpriv->gadget.speed != USB_SPEED_UNKNOWN &&
++ (state & SUSPENDED_STATE)) {
++ if (gpriv->driver && gpriv->driver->suspend)
++ gpriv->driver->suspend(&gpriv->gadget);
++ usb_gadget_set_state(&gpriv->gadget, USB_STATE_SUSPENDED);
++ }
+
+ return 0;
+ }
+diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
+index d88a5b15f073..88eaf3c45dd5 100644
+--- a/drivers/usb/usbip/usbip_common.c
++++ b/drivers/usb/usbip/usbip_common.c
+@@ -727,6 +727,9 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
+
+ copy -= recv;
+ ret += recv;
++
++ if (!copy)
++ break;
+ }
+
+ if (ret != size)
+diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c
+index 33f8972ba842..00fc98741c5d 100644
+--- a/drivers/usb/usbip/vhci_rx.c
++++ b/drivers/usb/usbip/vhci_rx.c
+@@ -77,16 +77,21 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
+ usbip_pack_pdu(pdu, urb, USBIP_RET_SUBMIT, 0);
+
+ /* recv transfer buffer */
+- if (usbip_recv_xbuff(ud, urb) < 0)
+- return;
++ if (usbip_recv_xbuff(ud, urb) < 0) {
++ urb->status = -EPROTO;
++ goto error;
++ }
+
+ /* recv iso_packet_descriptor */
+- if (usbip_recv_iso(ud, urb) < 0)
+- return;
++ if (usbip_recv_iso(ud, urb) < 0) {
++ urb->status = -EPROTO;
++ goto error;
++ }
+
+ /* restore the padding in iso packets */
+ usbip_pad_iso(ud, urb);
+
++error:
+ if (usbip_dbg_flag_vhci_rx)
+ usbip_dump_urb(urb);
+
+diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
+index 90d387b50ab7..0505eeb593b5 100644
+--- a/drivers/xen/Kconfig
++++ b/drivers/xen/Kconfig
+@@ -158,7 +158,8 @@ config XEN_GNTDEV
+
+ config XEN_GNTDEV_DMABUF
+ bool "Add support for dma-buf grant access device driver extension"
+- depends on XEN_GNTDEV && XEN_GRANT_DMA_ALLOC && DMA_SHARED_BUFFER
++ depends on XEN_GNTDEV && XEN_GRANT_DMA_ALLOC
++ select DMA_SHARED_BUFFER
+ help
+ Allows userspace processes and kernel modules to use Xen backed
+ dma-buf implementation. With this extension grant references to
+diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
+index d522494698fa..02e4e903dfe9 100644
+--- a/fs/btrfs/async-thread.c
++++ b/fs/btrfs/async-thread.c
+@@ -252,16 +252,17 @@ out:
+ }
+ }
+
+-static void run_ordered_work(struct __btrfs_workqueue *wq)
++static void run_ordered_work(struct __btrfs_workqueue *wq,
++ struct btrfs_work *self)
+ {
+ struct list_head *list = &wq->ordered_list;
+ struct btrfs_work *work;
+ spinlock_t *lock = &wq->list_lock;
+ unsigned long flags;
++ void *wtag;
++ bool free_self = false;
+
+ while (1) {
+- void *wtag;
+-
+ spin_lock_irqsave(lock, flags);
+ if (list_empty(list))
+ break;
+@@ -287,16 +288,47 @@ static void run_ordered_work(struct __btrfs_workqueue *wq)
+ list_del(&work->ordered_list);
+ spin_unlock_irqrestore(lock, flags);
+
+- /*
+- * We don't want to call the ordered free functions with the
+- * lock held though. Save the work as tag for the trace event,
+- * because the callback could free the structure.
+- */
+- wtag = work;
+- work->ordered_free(work);
+- trace_btrfs_all_work_done(wq->fs_info, wtag);
++ if (work == self) {
++ /*
++ * This is the work item that the worker is currently
++ * executing.
++ *
++ * The kernel workqueue code guarantees non-reentrancy
++ * of work items. I.e., if a work item with the same
++ * address and work function is queued twice, the second
++ * execution is blocked until the first one finishes. A
++ * work item may be freed and recycled with the same
++ * work function; the workqueue code assumes that the
++ * original work item cannot depend on the recycled work
++ * item in that case (see find_worker_executing_work()).
++ *
++ * Note that the work of one Btrfs filesystem may depend
++ * on the work of another Btrfs filesystem via, e.g., a
++ * loop device. Therefore, we must not allow the current
++ * work item to be recycled until we are really done,
++ * otherwise we break the above assumption and can
++ * deadlock.
++ */
++ free_self = true;
++ } else {
++ /*
++ * We don't want to call the ordered free functions with
++ * the lock held though. Save the work as tag for the
++ * trace event, because the callback could free the
++ * structure.
++ */
++ wtag = work;
++ work->ordered_free(work);
++ trace_btrfs_all_work_done(wq->fs_info, wtag);
++ }
+ }
+ spin_unlock_irqrestore(lock, flags);
++
++ if (free_self) {
++ wtag = self;
++ self->ordered_free(self);
++ trace_btrfs_all_work_done(wq->fs_info, wtag);
++ }
+ }
+
+ static void normal_work_helper(struct btrfs_work *work)
+@@ -324,7 +356,7 @@ static void normal_work_helper(struct btrfs_work *work)
+ work->func(work);
+ if (need_order) {
+ set_bit(WORK_DONE_BIT, &work->flags);
+- run_ordered_work(wq);
++ run_ordered_work(wq, work);
+ }
+ if (!need_order)
+ trace_btrfs_all_work_done(wq->fs_info, wtag);
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index fc764f350f05..84ff398ae70b 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -390,7 +390,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info,
+ for (node = rb_first(tm_root); node; node = next) {
+ next = rb_next(node);
+ tm = rb_entry(node, struct tree_mod_elem, node);
+- if (tm->seq > min_seq)
++ if (tm->seq >= min_seq)
+ continue;
+ rb_erase(node, tm_root);
+ kfree(tm);
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index cc2d268e2cd7..d24ecbf938b6 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -3101,7 +3101,7 @@ int btrfs_find_name_in_ext_backref(struct extent_buffer *leaf, int slot,
+ /* file-item.c */
+ struct btrfs_dio_private;
+ int btrfs_del_csums(struct btrfs_trans_handle *trans,
+- struct btrfs_fs_info *fs_info, u64 bytenr, u64 len);
++ struct btrfs_root *root, u64 bytenr, u64 len);
+ blk_status_t btrfs_lookup_bio_sums(struct inode *inode, struct bio *bio, u32 *dst);
+ blk_status_t btrfs_lookup_bio_sums_dio(struct inode *inode, struct bio *bio,
+ u64 logical_offset);
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 96296dc7d2ea..e12c37f457e0 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1660,8 +1660,8 @@ static void end_workqueue_fn(struct btrfs_work *work)
+ bio->bi_status = end_io_wq->status;
+ bio->bi_private = end_io_wq->private;
+ bio->bi_end_io = end_io_wq->end_io;
+- kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq);
+ bio_endio(bio);
++ kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq);
+ }
+
+ static int cleaner_kthread(void *arg)
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 4bda5c09cdfe..47ca1ebda056 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2492,8 +2492,8 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
+ btrfs_pin_extent(fs_info, head->bytenr,
+ head->num_bytes, 1);
+ if (head->is_data) {
+- ret = btrfs_del_csums(trans, fs_info, head->bytenr,
+- head->num_bytes);
++ ret = btrfs_del_csums(trans, fs_info->csum_root,
++ head->bytenr, head->num_bytes);
+ }
+ }
+
+@@ -6880,7 +6880,8 @@ static int __btrfs_free_extent(struct btrfs_trans_handle *trans,
+ btrfs_release_path(path);
+
+ if (is_data) {
+- ret = btrfs_del_csums(trans, info, bytenr, num_bytes);
++ ret = btrfs_del_csums(trans, info->csum_root, bytenr,
++ num_bytes);
+ if (ret) {
+ btrfs_abort_transaction(trans, ret);
+ goto out;
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 88fc5a0c573f..fed44390c049 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -4888,12 +4888,14 @@ struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info,
+ return eb;
+ eb = alloc_dummy_extent_buffer(fs_info, start);
+ if (!eb)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ eb->fs_info = fs_info;
+ again:
+ ret = radix_tree_preload(GFP_NOFS);
+- if (ret)
++ if (ret) {
++ exists = ERR_PTR(ret);
+ goto free_eb;
++ }
+ spin_lock(&fs_info->buffer_lock);
+ ret = radix_tree_insert(&fs_info->buffer_radix,
+ start >> PAGE_SHIFT, eb);
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index ba74827beb32..4cf2817ab120 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -577,9 +577,9 @@ static noinline void truncate_one_csum(struct btrfs_fs_info *fs_info,
+ * range of bytes.
+ */
+ int btrfs_del_csums(struct btrfs_trans_handle *trans,
+- struct btrfs_fs_info *fs_info, u64 bytenr, u64 len)
++ struct btrfs_root *root, u64 bytenr, u64 len)
+ {
+- struct btrfs_root *root = fs_info->csum_root;
++ struct btrfs_fs_info *fs_info = trans->fs_info;
+ struct btrfs_path *path;
+ struct btrfs_key key;
+ u64 end_byte = bytenr + len;
+@@ -589,6 +589,9 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
+ u16 csum_size = btrfs_super_csum_size(fs_info->super_copy);
+ int blocksize_bits = fs_info->sb->s_blocksize_bits;
+
++ ASSERT(root == fs_info->csum_root ||
++ root->root_key.objectid == BTRFS_TREE_LOG_OBJECTID);
++
+ path = btrfs_alloc_path();
+ if (!path)
+ return -ENOMEM;
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 7fd4458cf0a7..70085e98d372 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -5665,7 +5665,6 @@ static void inode_tree_add(struct inode *inode)
+
+ static void inode_tree_del(struct inode *inode)
+ {
+- struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
+ struct btrfs_root *root = BTRFS_I(inode)->root;
+ int empty = 0;
+
+@@ -5678,7 +5677,6 @@ static void inode_tree_del(struct inode *inode)
+ spin_unlock(&root->inode_lock);
+
+ if (empty && btrfs_root_refs(&root->root_item) == 0) {
+- synchronize_srcu(&fs_info->subvol_srcu);
+ spin_lock(&root->inode_lock);
+ empty = RB_EMPTY_ROOT(&root->inode_tree);
+ spin_unlock(&root->inode_lock);
+@@ -9491,9 +9489,8 @@ static int btrfs_rename_exchange(struct inode *old_dir,
+ btrfs_init_log_ctx(&ctx_dest, new_inode);
+
+ /* close the race window with snapshot create/destroy ioctl */
+- if (old_ino == BTRFS_FIRST_FREE_OBJECTID)
+- down_read(&fs_info->subvol_sem);
+- if (new_ino == BTRFS_FIRST_FREE_OBJECTID)
++ if (old_ino == BTRFS_FIRST_FREE_OBJECTID ||
++ new_ino == BTRFS_FIRST_FREE_OBJECTID)
+ down_read(&fs_info->subvol_sem);
+
+ /*
+@@ -9727,9 +9724,8 @@ out_fail:
+ ret = ret ? ret : ret2;
+ }
+ out_notrans:
+- if (new_ino == BTRFS_FIRST_FREE_OBJECTID)
+- up_read(&fs_info->subvol_sem);
+- if (old_ino == BTRFS_FIRST_FREE_OBJECTID)
++ if (new_ino == BTRFS_FIRST_FREE_OBJECTID ||
++ old_ino == BTRFS_FIRST_FREE_OBJECTID)
+ up_read(&fs_info->subvol_sem);
+
+ ASSERT(list_empty(&ctx_root.list));
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 00ff4349b457..199c70b8f7d8 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -709,11 +709,17 @@ static noinline int create_subvol(struct inode *dir,
+
+ btrfs_i_size_write(BTRFS_I(dir), dir->i_size + namelen * 2);
+ ret = btrfs_update_inode(trans, root, dir);
+- BUG_ON(ret);
++ if (ret) {
++ btrfs_abort_transaction(trans, ret);
++ goto fail;
++ }
+
+ ret = btrfs_add_root_ref(trans, objectid, root->root_key.objectid,
+ btrfs_ino(BTRFS_I(dir)), index, name, namelen);
+- BUG_ON(ret);
++ if (ret) {
++ btrfs_abort_transaction(trans, ret);
++ goto fail;
++ }
+
+ ret = btrfs_uuid_tree_add(trans, root_item->uuid,
+ BTRFS_UUID_KEY_SUBVOL, objectid);
+diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
+index 859274e38417..4c81ffe12385 100644
+--- a/fs/btrfs/reada.c
++++ b/fs/btrfs/reada.c
+@@ -720,21 +720,19 @@ static int reada_start_machine_dev(struct btrfs_device *dev)
+ static void reada_start_machine_worker(struct btrfs_work *work)
+ {
+ struct reada_machine_work *rmw;
+- struct btrfs_fs_info *fs_info;
+ int old_ioprio;
+
+ rmw = container_of(work, struct reada_machine_work, work);
+- fs_info = rmw->fs_info;
+-
+- kfree(rmw);
+
+ old_ioprio = IOPRIO_PRIO_VALUE(task_nice_ioclass(current),
+ task_nice_ioprio(current));
+ set_task_ioprio(current, BTRFS_IOPRIO_READA);
+- __reada_start_machine(fs_info);
++ __reada_start_machine(rmw->fs_info);
+ set_task_ioprio(current, old_ioprio);
+
+- atomic_dec(&fs_info->reada_works_cnt);
++ atomic_dec(&rmw->fs_info->reada_works_cnt);
++
++ kfree(rmw);
+ }
+
+ static void __reada_start_machine(struct btrfs_fs_info *fs_info)
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index b4958f724ce5..f98913061a40 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -4474,6 +4474,7 @@ int btrfs_recover_relocation(struct btrfs_root *root)
+ fs_root = read_fs_root(fs_info, reloc_root->root_key.offset);
+ if (IS_ERR(fs_root)) {
+ err = PTR_ERR(fs_root);
++ list_add_tail(&reloc_root->root_list, &reloc_roots);
+ goto out_free;
+ }
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index 916c39770467..6b6008db3e03 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -2145,14 +2145,13 @@ static void scrub_missing_raid56_worker(struct btrfs_work *work)
+ scrub_write_block_to_dev_replace(sblock);
+ }
+
+- scrub_block_put(sblock);
+-
+ if (sctx->is_dev_replace && sctx->flush_all_writes) {
+ mutex_lock(&sctx->wr_lock);
+ scrub_wr_submit(sctx);
+ mutex_unlock(&sctx->wr_lock);
+ }
+
++ scrub_block_put(sblock);
+ scrub_pending_bio_dec(sctx);
+ }
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 10532463e92a..931a7d1ddc95 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -6638,12 +6638,6 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg)
+ send_root->send_in_progress++;
+ spin_unlock(&send_root->root_item_lock);
+
+- /*
+- * This is done when we lookup the root, it should already be complete
+- * by the time we get here.
+- */
+- WARN_ON(send_root->orphan_cleanup_state != ORPHAN_CLEANUP_DONE);
+-
+ /*
+ * Userspace tools do the checks and warn the user if it's
+ * not RO.
+diff --git a/fs/btrfs/tests/free-space-tree-tests.c b/fs/btrfs/tests/free-space-tree-tests.c
+index 89346da890cf..de8fef91ac48 100644
+--- a/fs/btrfs/tests/free-space-tree-tests.c
++++ b/fs/btrfs/tests/free-space-tree-tests.c
+@@ -462,9 +462,9 @@ static int run_test(test_func_t test_func, int bitmaps, u32 sectorsize,
+ root->fs_info->tree_root = root;
+
+ root->node = alloc_test_extent_buffer(root->fs_info, nodesize);
+- if (!root->node) {
++ if (IS_ERR(root->node)) {
+ test_err("couldn't allocate dummy buffer");
+- ret = -ENOMEM;
++ ret = PTR_ERR(root->node);
+ goto out;
+ }
+ btrfs_set_header_level(root->node, 0);
+diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c
+index 412b910b04cc..d07dd26194b1 100644
+--- a/fs/btrfs/tests/qgroup-tests.c
++++ b/fs/btrfs/tests/qgroup-tests.c
+@@ -484,9 +484,9 @@ int btrfs_test_qgroups(u32 sectorsize, u32 nodesize)
+ * *cough*backref walking code*cough*
+ */
+ root->node = alloc_test_extent_buffer(root->fs_info, nodesize);
+- if (!root->node) {
++ if (IS_ERR(root->node)) {
+ test_err("couldn't allocate dummy buffer");
+- ret = -ENOMEM;
++ ret = PTR_ERR(root->node);
+ goto out;
+ }
+ btrfs_set_header_level(root->node, 0);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 4d4f57f0f08c..fe7165c9d875 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -795,7 +795,8 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ struct btrfs_ordered_sum,
+ list);
+ if (!ret)
+- ret = btrfs_del_csums(trans, fs_info,
++ ret = btrfs_del_csums(trans,
++ fs_info->csum_root,
+ sums->bytenr,
+ sums->len);
+ if (!ret)
+@@ -3866,6 +3867,28 @@ static int log_inode_item(struct btrfs_trans_handle *trans,
+ return 0;
+ }
+
++static int log_csums(struct btrfs_trans_handle *trans,
++ struct btrfs_root *log_root,
++ struct btrfs_ordered_sum *sums)
++{
++ int ret;
++
++ /*
++ * Due to extent cloning, we might have logged a csum item that covers a
++ * subrange of a cloned extent, and later we can end up logging a csum
++ * item for a larger subrange of the same extent or the entire range.
++ * This would leave csum items in the log tree that cover the same range
++ * and break the searches for checksums in the log tree, resulting in
++ * some checksums missing in the fs/subvolume tree. So just delete (or
++ * trim and adjust) any existing csum items in the log for this range.
++ */
++ ret = btrfs_del_csums(trans, log_root, sums->bytenr, sums->len);
++ if (ret)
++ return ret;
++
++ return btrfs_csum_file_blocks(trans, log_root, sums);
++}
++
+ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ struct btrfs_inode *inode,
+ struct btrfs_path *dst_path,
+@@ -4011,7 +4034,7 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ struct btrfs_ordered_sum,
+ list);
+ if (!ret)
+- ret = btrfs_csum_file_blocks(trans, log, sums);
++ ret = log_csums(trans, log, sums);
+ list_del(&sums->list);
+ kfree(sums);
+ }
+@@ -4231,7 +4254,7 @@ static int log_extent_csums(struct btrfs_trans_handle *trans,
+ struct btrfs_ordered_sum,
+ list);
+ if (!ret)
+- ret = btrfs_csum_file_blocks(trans, log_root, sums);
++ ret = log_csums(trans, log_root, sums);
+ list_del(&sums->list);
+ kfree(sums);
+ }
+@@ -5997,9 +6020,28 @@ again:
+ wc.replay_dest = btrfs_read_fs_root_no_name(fs_info, &tmp_key);
+ if (IS_ERR(wc.replay_dest)) {
+ ret = PTR_ERR(wc.replay_dest);
++
++ /*
++ * We didn't find the subvol, likely because it was
++ * deleted. This is ok, simply skip this log and go to
++ * the next one.
++ *
++ * We need to exclude the root because we can't have
++ * other log replays overwriting this log as we'll read
++ * it back in a few more times. This will keep our
++ * block from being modified, and we'll just bail for
++ * each subsequent pass.
++ */
++ if (ret == -ENOENT)
++ ret = btrfs_pin_extent_for_log_replay(fs_info,
++ log->node->start,
++ log->node->len);
+ free_extent_buffer(log->node);
+ free_extent_buffer(log->commit_root);
+ kfree(log);
++
++ if (!ret)
++ goto next;
+ btrfs_handle_fs_error(fs_info, ret,
+ "Couldn't read target root for tree log recovery.");
+ goto error;
+@@ -6031,7 +6073,6 @@ again:
+ &root->highest_objectid);
+ }
+
+- key.offset = found_key.offset - 1;
+ wc.replay_dest->log_root = NULL;
+ free_extent_buffer(log->node);
+ free_extent_buffer(log->commit_root);
+@@ -6039,9 +6080,10 @@ again:
+
+ if (ret)
+ goto error;
+-
++next:
+ if (found_key.offset == 0)
+ break;
++ key.offset = found_key.offset - 1;
+ }
+ btrfs_release_path(path);
+
+diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c
+index 3b2ae342e649..5bbb977b5189 100644
+--- a/fs/btrfs/uuid-tree.c
++++ b/fs/btrfs/uuid-tree.c
+@@ -324,6 +324,8 @@ again_search_slot:
+ }
+ if (ret < 0 && ret != -ENOENT)
+ goto out;
++ key.offset++;
++ goto again_search_slot;
+ }
+ item_size -= sizeof(subid_le);
+ offset += sizeof(subid_le);
+diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
+index 46d5c40f2835..d947c5e439cf 100644
+--- a/fs/ext4/dir.c
++++ b/fs/ext4/dir.c
+@@ -77,6 +77,11 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
+ error_msg = "rec_len is too small for name_len";
+ else if (unlikely(((char *) de - buf) + rlen > size))
+ error_msg = "directory entry overrun";
++ else if (unlikely(((char *) de - buf) + rlen >
++ size - EXT4_DIR_REC_LEN(1) &&
++ ((char *) de - buf) + rlen != size)) {
++ error_msg = "directory entry too close to block end";
++ }
+ else if (unlikely(le32_to_cpu(de->inode) >
+ le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count)))
+ error_msg = "inode out of bounds";
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index ab16b7c6068c..215802cbc42b 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -6027,7 +6027,7 @@ int ext4_expand_extra_isize(struct inode *inode,
+ error = ext4_journal_get_write_access(handle, iloc->bh);
+ if (error) {
+ brelse(iloc->bh);
+- goto out_stop;
++ goto out_unlock;
+ }
+
+ error = __ext4_expand_extra_isize(inode, new_extra_isize, iloc,
+@@ -6037,8 +6037,8 @@ int ext4_expand_extra_isize(struct inode *inode,
+ if (!error)
+ error = rc;
+
++out_unlock:
+ ext4_write_unlock_xattr(inode, &no_expand);
+-out_stop:
+ ext4_journal_stop(handle);
+ return error;
+ }
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index f56d6f1950b9..43dcb91d63f4 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2693,7 +2693,7 @@ bool ext4_empty_dir(struct inode *inode)
+ {
+ unsigned int offset;
+ struct buffer_head *bh;
+- struct ext4_dir_entry_2 *de, *de1;
++ struct ext4_dir_entry_2 *de;
+ struct super_block *sb;
+
+ if (ext4_has_inline_data(inode)) {
+@@ -2718,19 +2718,25 @@ bool ext4_empty_dir(struct inode *inode)
+ return true;
+
+ de = (struct ext4_dir_entry_2 *) bh->b_data;
+- de1 = ext4_next_entry(de, sb->s_blocksize);
+- if (le32_to_cpu(de->inode) != inode->i_ino ||
+- le32_to_cpu(de1->inode) == 0 ||
+- strcmp(".", de->name) || strcmp("..", de1->name)) {
+- ext4_warning_inode(inode, "directory missing '.' and/or '..'");
++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size,
++ 0) ||
++ le32_to_cpu(de->inode) != inode->i_ino || strcmp(".", de->name)) {
++ ext4_warning_inode(inode, "directory missing '.'");
++ brelse(bh);
++ return true;
++ }
++ offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize);
++ de = ext4_next_entry(de, sb->s_blocksize);
++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size,
++ offset) ||
++ le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) {
++ ext4_warning_inode(inode, "directory missing '..'");
+ brelse(bh);
+ return true;
+ }
+- offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize) +
+- ext4_rec_len_from_disk(de1->rec_len, sb->s_blocksize);
+- de = ext4_next_entry(de1, sb->s_blocksize);
++ offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize);
+ while (offset < inode->i_size) {
+- if ((void *) de >= (void *) (bh->b_data+sb->s_blocksize)) {
++ if (!(offset & (sb->s_blocksize - 1))) {
+ unsigned int lblock;
+ brelse(bh);
+ lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb);
+@@ -2741,12 +2747,11 @@ bool ext4_empty_dir(struct inode *inode)
+ }
+ if (IS_ERR(bh))
+ return true;
+- de = (struct ext4_dir_entry_2 *) bh->b_data;
+ }
++ de = (struct ext4_dir_entry_2 *) (bh->b_data +
++ (offset & (sb->s_blocksize - 1)));
+ if (ext4_check_dir_entry(inode, NULL, de, bh,
+ bh->b_data, bh->b_size, offset)) {
+- de = (struct ext4_dir_entry_2 *)(bh->b_data +
+- sb->s_blocksize);
+ offset = (offset | (sb->s_blocksize - 1)) + 1;
+ continue;
+ }
+@@ -2755,7 +2760,6 @@ bool ext4_empty_dir(struct inode *inode)
+ return false;
+ }
+ offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize);
+- de = ext4_next_entry(de, sb->s_blocksize);
+ }
+ brelse(bh);
+ return true;
+diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h
+index 7f78d26a0766..0f7439f0bb2f 100644
+--- a/include/drm/drm_dp_mst_helper.h
++++ b/include/drm/drm_dp_mst_helper.h
+@@ -313,7 +313,7 @@ struct drm_dp_resource_status_notify {
+
+ struct drm_dp_query_payload_ack_reply {
+ u8 port_number;
+- u8 allocated_pbn;
++ u16 allocated_pbn;
+ };
+
+ struct drm_dp_sideband_msg_req_body {
+diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
+index 72f59e8321e7..3361663144a1 100644
+--- a/include/linux/cpufreq.h
++++ b/include/linux/cpufreq.h
+@@ -563,17 +563,6 @@ struct governor_attr {
+ size_t count);
+ };
+
+-static inline bool cpufreq_this_cpu_can_update(struct cpufreq_policy *policy)
+-{
+- /*
+- * Allow remote callbacks if:
+- * - dvfs_possible_from_any_cpu flag is set
+- * - the local and remote CPUs share cpufreq policy
+- */
+- return policy->dvfs_possible_from_any_cpu ||
+- cpumask_test_cpu(smp_processor_id(), policy->cpus);
+-}
+-
+ /*********************************************************************
+ * FREQUENCY TABLE HELPERS *
+ *********************************************************************/
+diff --git a/include/linux/ipmi_smi.h b/include/linux/ipmi_smi.h
+index 7d5fd38d5282..1995ce146789 100644
+--- a/include/linux/ipmi_smi.h
++++ b/include/linux/ipmi_smi.h
+@@ -211,10 +211,14 @@ static inline int ipmi_demangle_device_id(uint8_t netfn, uint8_t cmd,
+ * is called, and the lower layer must get the interface from that
+ * call.
+ */
+-int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
+- void *send_info,
+- struct device *dev,
+- unsigned char slave_addr);
++int ipmi_add_smi(struct module *owner,
++ const struct ipmi_smi_handlers *handlers,
++ void *send_info,
++ struct device *dev,
++ unsigned char slave_addr);
++
++#define ipmi_register_smi(handlers, send_info, dev, slave_addr) \
++ ipmi_add_smi(THIS_MODULE, handlers, send_info, dev, slave_addr)
+
+ /*
+ * Remove a low-level interface from the IPMI driver. This will
+diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
+index 3247a3dc7934..b06b75776a32 100644
+--- a/include/linux/miscdevice.h
++++ b/include/linux/miscdevice.h
+@@ -57,6 +57,7 @@
+ #define UHID_MINOR 239
+ #define USERIO_MINOR 240
+ #define VHOST_VSOCK_MINOR 241
++#define RFKILL_MINOR 242
+ #define MISC_DYNAMIC_MINOR 255
+
+ struct device;
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index 01797cb4587e..867db9b9384c 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -551,9 +551,9 @@ struct platform_device_id {
+ #define MDIO_NAME_SIZE 32
+ #define MDIO_MODULE_PREFIX "mdio:"
+
+-#define MDIO_ID_FMT "%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d"
++#define MDIO_ID_FMT "%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u"
+ #define MDIO_ID_ARGS(_id) \
+- (_id)>>31, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \
++ ((_id)>>31) & 1, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \
+ ((_id)>>27) & 1, ((_id)>>26) & 1, ((_id)>>25) & 1, ((_id)>>24) & 1, \
+ ((_id)>>23) & 1, ((_id)>>22) & 1, ((_id)>>21) & 1, ((_id)>>20) & 1, \
+ ((_id)>>19) & 1, ((_id)>>18) & 1, ((_id)>>17) & 1, ((_id)>>16) & 1, \
+diff --git a/include/linux/sched/cpufreq.h b/include/linux/sched/cpufreq.h
+index 59667444669f..a4530d782353 100644
+--- a/include/linux/sched/cpufreq.h
++++ b/include/linux/sched/cpufreq.h
+@@ -12,6 +12,8 @@
+ #define SCHED_CPUFREQ_MIGRATION (1U << 1)
+
+ #ifdef CONFIG_CPU_FREQ
++struct cpufreq_policy;
++
+ struct update_util_data {
+ void (*func)(struct update_util_data *data, u64 time, unsigned int flags);
+ };
+@@ -20,6 +22,7 @@ void cpufreq_add_update_util_hook(int cpu, struct update_util_data *data,
+ void (*func)(struct update_util_data *data, u64 time,
+ unsigned int flags));
+ void cpufreq_remove_update_util_hook(int cpu);
++bool cpufreq_this_cpu_can_update(struct cpufreq_policy *policy);
+ #endif /* CONFIG_CPU_FREQ */
+
+ #endif /* _LINUX_SCHED_CPUFREQ_H */
+diff --git a/include/net/dst.h b/include/net/dst.h
+index ffc8ee0ea5e5..851cf1124240 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -93,7 +93,7 @@ struct dst_entry {
+ struct dst_metrics {
+ u32 metrics[RTAX_MAX];
+ refcount_t refcnt;
+-};
++} __aligned(4); /* Low pointer bits contain DST_METRICS_FLAGS */
+ extern const struct dst_metrics dst_default_metrics;
+
+ u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
+diff --git a/include/trace/events/wbt.h b/include/trace/events/wbt.h
+index b048694070e2..37342a13c9cb 100644
+--- a/include/trace/events/wbt.h
++++ b/include/trace/events/wbt.h
+@@ -33,7 +33,8 @@ TRACE_EVENT(wbt_stat,
+ ),
+
+ TP_fast_assign(
+- strncpy(__entry->name, dev_name(bdi->dev), 32);
++ strlcpy(__entry->name, dev_name(bdi->dev),
++ ARRAY_SIZE(__entry->name));
+ __entry->rmean = stat[0].mean;
+ __entry->rmin = stat[0].min;
+ __entry->rmax = stat[0].max;
+@@ -67,7 +68,8 @@ TRACE_EVENT(wbt_lat,
+ ),
+
+ TP_fast_assign(
+- strncpy(__entry->name, dev_name(bdi->dev), 32);
++ strlcpy(__entry->name, dev_name(bdi->dev),
++ ARRAY_SIZE(__entry->name));
+ __entry->lat = div_u64(lat, 1000);
+ ),
+
+@@ -103,7 +105,8 @@ TRACE_EVENT(wbt_step,
+ ),
+
+ TP_fast_assign(
+- strncpy(__entry->name, dev_name(bdi->dev), 32);
++ strlcpy(__entry->name, dev_name(bdi->dev),
++ ARRAY_SIZE(__entry->name));
+ __entry->msg = msg;
+ __entry->step = step;
+ __entry->window = div_u64(window, 1000);
+@@ -138,7 +141,8 @@ TRACE_EVENT(wbt_timer,
+ ),
+
+ TP_fast_assign(
+- strncpy(__entry->name, dev_name(bdi->dev), 32);
++ strlcpy(__entry->name, dev_name(bdi->dev),
++ ARRAY_SIZE(__entry->name));
+ __entry->status = status;
+ __entry->step = step;
+ __entry->inflight = inflight;
+diff --git a/include/uapi/linux/cec-funcs.h b/include/uapi/linux/cec-funcs.h
+index 8997d5068c08..4511b85c84df 100644
+--- a/include/uapi/linux/cec-funcs.h
++++ b/include/uapi/linux/cec-funcs.h
+@@ -923,7 +923,8 @@ static inline void cec_msg_give_deck_status(struct cec_msg *msg,
+ msg->len = 3;
+ msg->msg[1] = CEC_MSG_GIVE_DECK_STATUS;
+ msg->msg[2] = status_req;
+- msg->reply = reply ? CEC_MSG_DECK_STATUS : 0;
++ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ?
++ CEC_MSG_DECK_STATUS : 0;
+ }
+
+ static inline void cec_ops_give_deck_status(const struct cec_msg *msg,
+@@ -1027,7 +1028,8 @@ static inline void cec_msg_give_tuner_device_status(struct cec_msg *msg,
+ msg->len = 3;
+ msg->msg[1] = CEC_MSG_GIVE_TUNER_DEVICE_STATUS;
+ msg->msg[2] = status_req;
+- msg->reply = reply ? CEC_MSG_TUNER_DEVICE_STATUS : 0;
++ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ?
++ CEC_MSG_TUNER_DEVICE_STATUS : 0;
+ }
+
+ static inline void cec_ops_give_tuner_device_status(const struct cec_msg *msg,
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index 7cb7a7f98a37..55fff5e6d983 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -292,7 +292,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
+ bool irq_work_busy = false;
+ struct stack_map_irq_work *work = NULL;
+
+- if (in_nmi()) {
++ if (irqs_disabled()) {
+ work = this_cpu_ptr(&up_read_work);
+ if (work->irq_work.flags & IRQ_WORK_BUSY)
+ /* cannot queue more up_read, fallback */
+@@ -300,8 +300,9 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
+ }
+
+ /*
+- * We cannot do up_read() in nmi context. To do build_id lookup
+- * in nmi context, we need to run up_read() in irq_work. We use
++ * We cannot do up_read() when the irq is disabled, because of
++ * risk to deadlock with rq_lock. To do build_id lookup when the
++ * irqs are disabled, we need to run up_read() in irq_work. We use
+ * a percpu variable to do the irq_work. If the irq_work is
+ * already used by another lookup, we fall back to report ips.
+ *
+diff --git a/kernel/sched/cpufreq.c b/kernel/sched/cpufreq.c
+index 5e54cbcae673..42ce32a1abad 100644
+--- a/kernel/sched/cpufreq.c
++++ b/kernel/sched/cpufreq.c
+@@ -8,6 +8,8 @@
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
++#include <linux/cpufreq.h>
++
+ #include "sched.h"
+
+ DEFINE_PER_CPU(struct update_util_data *, cpufreq_update_util_data);
+@@ -60,3 +62,19 @@ void cpufreq_remove_update_util_hook(int cpu)
+ rcu_assign_pointer(per_cpu(cpufreq_update_util_data, cpu), NULL);
+ }
+ EXPORT_SYMBOL_GPL(cpufreq_remove_update_util_hook);
++
++/**
++ * cpufreq_this_cpu_can_update - Check if cpufreq policy can be updated.
++ * @policy: cpufreq policy to check.
++ *
++ * Return 'true' if:
++ * - the local and remote CPUs share @policy,
++ * - dvfs_possible_from_any_cpu is set in @policy and the local CPU is not going
++ * offline (in which case it is not expected to run cpufreq updates any more).
++ */
++bool cpufreq_this_cpu_can_update(struct cpufreq_policy *policy)
++{
++ return cpumask_test_cpu(smp_processor_id(), policy->cpus) ||
++ (policy->dvfs_possible_from_any_cpu &&
++ rcu_dereference_sched(*this_cpu_ptr(&cpufreq_update_util_data)));
++}
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index 54fcff656ecd..1b7ec822dc75 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -83,12 +83,10 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
+ * by the hardware, as calculating the frequency is pointless if
+ * we cannot in fact act on it.
+ *
+- * For the slow switching platforms, the kthread is always scheduled on
+- * the right set of CPUs and any CPU can find the next frequency and
+- * schedule the kthread.
++ * This is needed on the slow switching platforms too to prevent CPUs
++ * going offline from leaving stale IRQ work items behind.
+ */
+- if (sg_policy->policy->fast_switch_enabled &&
+- !cpufreq_this_cpu_can_update(sg_policy->policy))
++ if (!cpufreq_this_cpu_can_update(sg_policy->policy))
+ return false;
+
+ if (unlikely(sg_policy->limits_changed)) {
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index bdd7f3d78724..b6ff2f84df17 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4389,7 +4389,7 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
+
+ if (mask == TRACE_ITER_RECORD_TGID) {
+ if (!tgid_map)
+- tgid_map = kcalloc(PID_MAX_DEFAULT + 1,
++ tgid_map = kvcalloc(PID_MAX_DEFAULT + 1,
+ sizeof(*tgid_map),
+ GFP_KERNEL);
+ if (!tgid_map) {
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index f9a0cd094b81..c61b2b0a99e9 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -519,11 +519,10 @@ disable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
+
+ #if defined(CONFIG_KPROBES_ON_FTRACE) && \
+ !defined(CONFIG_KPROBE_EVENTS_ON_NOTRACE)
+-static bool within_notrace_func(struct trace_kprobe *tk)
++static bool __within_notrace_func(unsigned long addr)
+ {
+- unsigned long offset, size, addr;
++ unsigned long offset, size;
+
+- addr = trace_kprobe_address(tk);
+ if (!addr || !kallsyms_lookup_size_offset(addr, &size, &offset))
+ return false;
+
+@@ -536,6 +535,28 @@ static bool within_notrace_func(struct trace_kprobe *tk)
+ */
+ return !ftrace_location_range(addr, addr + size - 1);
+ }
++
++static bool within_notrace_func(struct trace_kprobe *tk)
++{
++ unsigned long addr = addr = trace_kprobe_address(tk);
++ char symname[KSYM_NAME_LEN], *p;
++
++ if (!__within_notrace_func(addr))
++ return false;
++
++ /* Check if the address is on a suffixed-symbol */
++ if (!lookup_symbol_name(addr, symname)) {
++ p = strchr(symname, '.');
++ if (!p)
++ return true;
++ *p = '\0';
++ addr = (unsigned long)kprobe_lookup_name(symname, 0);
++ if (addr)
++ return __within_notrace_func(addr);
++ }
++
++ return true;
++}
+ #else
+ #define within_notrace_func(tk) (false)
+ #endif
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 15d1cb5aee18..f5c27065ad44 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -931,6 +931,14 @@ static void hci_req_directed_advertising(struct hci_request *req,
+ return;
+
+ memset(&cp, 0, sizeof(cp));
++
++ /* Some controllers might reject command if intervals are not
++ * within range for undirected advertising.
++ * BCM20702A0 is known to be affected by this.
++ */
++ cp.min_interval = cpu_to_le16(0x0020);
++ cp.max_interval = cpu_to_le16(0x0020);
++
+ cp.type = LE_ADV_DIRECT_IND;
+ cp.own_address_type = own_addr_type;
+ cp.direct_addr_type = conn->dst_type;
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 5afd67ef797a..e03faca84919 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -841,8 +841,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt)
+ if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
+ struct hci_cp_le_write_def_data_len cp;
+
+- cp.tx_len = hdev->le_max_tx_len;
+- cp.tx_time = hdev->le_max_tx_time;
++ cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
++ cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
+ hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
+ }
+
+@@ -4330,7 +4330,14 @@ static void hci_rx_work(struct work_struct *work)
+ hci_send_to_sock(hdev, skb);
+ }
+
+- if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
++ /* If the device has been opened in HCI_USER_CHANNEL,
++ * the userspace has exclusive access to device.
++ * When device is HCI_INIT, we still need to process
++ * the data packets to the driver in order
++ * to complete its setup().
++ */
++ if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
++ !test_bit(HCI_INIT, &hdev->flags)) {
+ kfree_skb(skb);
+ continue;
+ }
+diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
+index 9448ebd3780a..a8ddd211e94c 100644
+--- a/net/bluetooth/hci_request.c
++++ b/net/bluetooth/hci_request.c
+@@ -1258,6 +1258,14 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
+
+ instance_flags = get_adv_instance_flags(hdev, instance);
+
++ /* If instance already has the flags set skip adding it once
++ * again.
++ */
++ if (adv_instance && eir_get_data(adv_instance->adv_data,
++ adv_instance->adv_data_len, EIR_FLAGS,
++ NULL))
++ goto skip_flags;
++
+ /* The Add Advertising command allows userspace to set both the general
+ * and limited discoverable flags.
+ */
+@@ -1290,6 +1298,7 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
+ }
+ }
+
++skip_flags:
+ if (adv_instance) {
+ memcpy(ptr, adv_instance->adv_data,
+ adv_instance->adv_data_len);
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index 534a604b75c2..f895c656407b 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -867,7 +867,8 @@ static void __ieee80211_tx_status(struct ieee80211_hw *hw,
+ I802_DEBUG_INC(local->dot11FailedCount);
+ }
+
+- if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) &&
++ if ((ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) &&
++ ieee80211_has_pm(fc) &&
+ ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
+ !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
+ local->ps_sdata && !(local->scanning)) {
+diff --git a/net/nfc/nci/uart.c b/net/nfc/nci/uart.c
+index a66f102c6c01..040576dd73bb 100644
+--- a/net/nfc/nci/uart.c
++++ b/net/nfc/nci/uart.c
+@@ -348,7 +348,7 @@ static int nci_uart_default_recv_buf(struct nci_uart *nu, const u8 *data,
+ nu->rx_packet_len = -1;
+ nu->rx_skb = nci_skb_alloc(nu->ndev,
+ NCI_MAX_PACKET_SIZE,
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ if (!nu->rx_skb)
+ return -ENOMEM;
+ }
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 7204e7bbebb0..ac65e66d1d72 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -552,7 +552,8 @@ static int prb_calc_retire_blk_tmo(struct packet_sock *po,
+ msec = 1;
+ div = ecmd.base.speed / 1000;
+ }
+- }
++ } else
++ return DEFAULT_PRB_RETIRE_TOV;
+
+ mbits = (blk_size_in_bytes * 8) / (1024 * 1024);
+
+diff --git a/net/rfkill/core.c b/net/rfkill/core.c
+index 1355f5ca8d22..7fbc8314f626 100644
+--- a/net/rfkill/core.c
++++ b/net/rfkill/core.c
+@@ -1328,10 +1328,12 @@ static const struct file_operations rfkill_fops = {
+ .llseek = no_llseek,
+ };
+
++#define RFKILL_NAME "rfkill"
++
+ static struct miscdevice rfkill_miscdev = {
+- .name = "rfkill",
+ .fops = &rfkill_fops,
+- .minor = MISC_DYNAMIC_MINOR,
++ .name = RFKILL_NAME,
++ .minor = RFKILL_MINOR,
+ };
+
+ static int __init rfkill_init(void)
+@@ -1383,3 +1385,6 @@ static void __exit rfkill_exit(void)
+ class_unregister(&rfkill_class);
+ }
+ module_exit(rfkill_exit);
++
++MODULE_ALIAS_MISCDEV(RFKILL_MINOR);
++MODULE_ALIAS("devname:" RFKILL_NAME);
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index 6d36f74ad295..269b528e50b9 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -242,6 +242,7 @@ static void sctp_v4_from_skb(union sctp_addr *addr, struct sk_buff *skb,
+ sa->sin_port = sh->dest;
+ sa->sin_addr.s_addr = ip_hdr(skb)->daddr;
+ }
++ memset(sa->sin_zero, 0, sizeof(sa->sin_zero));
+ }
+
+ /* Initialize an sctp_addr from a socket. */
+@@ -250,6 +251,7 @@ static void sctp_v4_from_sk(union sctp_addr *addr, struct sock *sk)
+ addr->v4.sin_family = AF_INET;
+ addr->v4.sin_port = 0;
+ addr->v4.sin_addr.s_addr = inet_sk(sk)->inet_rcv_saddr;
++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
+ }
+
+ /* Initialize sk->sk_rcv_saddr from sctp_addr. */
+@@ -272,6 +274,7 @@ static void sctp_v4_from_addr_param(union sctp_addr *addr,
+ addr->v4.sin_family = AF_INET;
+ addr->v4.sin_port = port;
+ addr->v4.sin_addr.s_addr = param->v4.addr.s_addr;
++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
+ }
+
+ /* Initialize an address parameter from a sctp_addr and return the length
+@@ -296,6 +299,7 @@ static void sctp_v4_dst_saddr(union sctp_addr *saddr, struct flowi4 *fl4,
+ saddr->v4.sin_family = AF_INET;
+ saddr->v4.sin_port = port;
+ saddr->v4.sin_addr.s_addr = fl4->saddr;
++ memset(saddr->v4.sin_zero, 0, sizeof(saddr->v4.sin_zero));
+ }
+
+ /* Compare two addresses exactly. */
+@@ -318,6 +322,7 @@ static void sctp_v4_inaddr_any(union sctp_addr *addr, __be16 port)
+ addr->v4.sin_family = AF_INET;
+ addr->v4.sin_addr.s_addr = htonl(INADDR_ANY);
+ addr->v4.sin_port = port;
++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
+ }
+
+ /* Is this a wildcard address? */
+diff --git a/samples/pktgen/functions.sh b/samples/pktgen/functions.sh
+index f8bb3cd0f4ce..7d928571b25c 100644
+--- a/samples/pktgen/functions.sh
++++ b/samples/pktgen/functions.sh
+@@ -5,6 +5,8 @@
+ # Author: Jesper Dangaaard Brouer
+ # License: GPL
+
++set -o errexit
++
+ ## -- General shell logging cmds --
+ function err() {
+ local exitcode=$1
+@@ -58,6 +60,7 @@ function pg_set() {
+ function proc_cmd() {
+ local result
+ local proc_file=$1
++ local status=0
+ # after shift, the remaining args are contained in $@
+ shift
+ local proc_ctrl=${PROC_DIR}/$proc_file
+@@ -73,13 +76,13 @@ function proc_cmd() {
+ echo "cmd: $@ > $proc_ctrl"
+ fi
+ # Quoting of "$@" is important for space expansion
+- echo "$@" > "$proc_ctrl"
+- local status=$?
++ echo "$@" > "$proc_ctrl" || status=$?
+
+- result=$(grep "Result: OK:" $proc_ctrl)
+- # Due to pgctrl, cannot use exit code $? from grep
+- if [[ "$result" == "" ]]; then
+- grep "Result:" $proc_ctrl >&2
++ if [[ "$proc_file" != "pgctrl" ]]; then
++ result=$(grep "Result: OK:" $proc_ctrl) || true
++ if [[ "$result" == "" ]]; then
++ grep "Result:" $proc_ctrl >&2
++ fi
+ fi
+ if (( $status != 0 )); then
+ err 5 "Write error($status) occurred cmd: \"$@ > $proc_ctrl\""
+@@ -105,6 +108,8 @@ function pgset() {
+ fi
+ }
+
++[[ $EUID -eq 0 ]] && trap 'pg_ctrl "reset"' EXIT
++
+ ## -- General shell tricks --
+
+ function root_check_run_with_sudo() {
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index e08c6c6ca029..f03ceaff75b5 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -752,6 +752,10 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
+ while (runtime->boundary * 2 <= LONG_MAX - runtime->buffer_size)
+ runtime->boundary *= 2;
+
++ /* clear the buffer for avoiding possible kernel info leaks */
++ if (runtime->dma_area && !substream->ops->copy_user)
++ memset(runtime->dma_area, 0, runtime->dma_bytes);
++
+ snd_pcm_timer_resolution_change(substream);
+ snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP);
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 86a31e69fc7d..b5dc51030316 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -88,6 +88,9 @@ static LIST_HEAD(snd_timer_slave_list);
+ /* lock for slave active lists */
+ static DEFINE_SPINLOCK(slave_active_lock);
+
++#define MAX_SLAVE_INSTANCES 1000
++static int num_slaves;
++
+ static DEFINE_MUTEX(register_mutex);
+
+ static int snd_timer_free(struct snd_timer *timer);
+@@ -266,6 +269,10 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ err = -EINVAL;
+ goto unlock;
+ }
++ if (num_slaves >= MAX_SLAVE_INSTANCES) {
++ err = -EBUSY;
++ goto unlock;
++ }
+ timeri = snd_timer_instance_new(owner, NULL);
+ if (!timeri) {
+ err = -ENOMEM;
+@@ -275,6 +282,7 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ timeri->slave_id = tid->device;
+ timeri->flags |= SNDRV_TIMER_IFLG_SLAVE;
+ list_add_tail(&timeri->open_list, &snd_timer_slave_list);
++ num_slaves++;
+ err = snd_timer_check_slave(timeri);
+ if (err < 0) {
+ snd_timer_close_locked(timeri, &card_dev_to_put);
+@@ -364,6 +372,8 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri,
+ struct snd_timer_instance *slave, *tmp;
+
+ list_del(&timeri->open_list);
++ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
++ num_slaves--;
+
+ /* force to stop the timer */
+ snd_timer_stop(timeri);
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 6a9b89e05dae..bc4edc5607c7 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -1683,13 +1683,14 @@ struct scp_msg {
+
+ static void dspio_clear_response_queue(struct hda_codec *codec)
+ {
++ unsigned long timeout = jiffies + msecs_to_jiffies(1000);
+ unsigned int dummy = 0;
+- int status = -1;
++ int status;
+
+ /* clear all from the response queue */
+ do {
+ status = dspio_read(codec, &dummy);
+- } while (status == 0);
++ } while (status == 0 && time_before(jiffies, timeout));
+ }
+
+ static int dspio_get_response_data(struct hda_codec *codec)
+@@ -6754,12 +6755,14 @@ static void ca0132_process_dsp_response(struct hda_codec *codec,
+ struct ca0132_spec *spec = codec->spec;
+
+ codec_dbg(codec, "ca0132_process_dsp_response\n");
++ snd_hda_power_up_pm(codec);
+ if (spec->wait_scp) {
+ if (dspio_get_response_data(codec) >= 0)
+ spec->wait_scp = 0;
+ }
+
+ dspio_clear_response_queue(codec);
++ snd_hda_power_down_pm(codec);
+ }
+
+ static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
+@@ -6770,11 +6773,10 @@ static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
+ /* Delay enabling the HP amp, to let the mic-detection
+ * state machine run.
+ */
+- cancel_delayed_work(&spec->unsol_hp_work);
+- schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500));
+ tbl = snd_hda_jack_tbl_get(codec, cb->nid);
+ if (tbl)
+ tbl->block_report = 1;
++ schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500));
+ }
+
+ static void amic_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
+@@ -7408,12 +7410,25 @@ static void ca0132_reboot_notify(struct hda_codec *codec)
+ codec->patch_ops.free(codec);
+ }
+
++#ifdef CONFIG_PM
++static int ca0132_suspend(struct hda_codec *codec)
++{
++ struct ca0132_spec *spec = codec->spec;
++
++ cancel_delayed_work_sync(&spec->unsol_hp_work);
++ return 0;
++}
++#endif
++
+ static const struct hda_codec_ops ca0132_patch_ops = {
+ .build_controls = ca0132_build_controls,
+ .build_pcms = ca0132_build_pcms,
+ .init = ca0132_init,
+ .free = ca0132_free,
+ .unsol_event = snd_hda_jack_unsol_event,
++#ifdef CONFIG_PM
++ .suspend = ca0132_suspend,
++#endif
+ .reboot_notify = ca0132_reboot_notify,
+ };
+
+diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
+index 9b7a1833d331..71b7b881df39 100644
+--- a/sound/soc/codecs/rt5677.c
++++ b/sound/soc/codecs/rt5677.c
+@@ -297,6 +297,7 @@ static bool rt5677_volatile_register(struct device *dev, unsigned int reg)
+ case RT5677_I2C_MASTER_CTRL7:
+ case RT5677_I2C_MASTER_CTRL8:
+ case RT5677_HAP_GENE_CTRL2:
++ case RT5677_PWR_ANLG2: /* Modified by DSP firmware */
+ case RT5677_PWR_DSP_ST:
+ case RT5677_PRIV_DATA:
+ case RT5677_ASRC_22:
+diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c
+index deff65161504..0a3b746fb909 100644
+--- a/sound/soc/codecs/wm2200.c
++++ b/sound/soc/codecs/wm2200.c
+@@ -2413,6 +2413,8 @@ static int wm2200_i2c_probe(struct i2c_client *i2c,
+
+ err_pm_runtime:
+ pm_runtime_disable(&i2c->dev);
++ if (i2c->irq)
++ free_irq(i2c->irq, wm2200);
+ err_reset:
+ if (wm2200->pdata.reset)
+ gpio_set_value_cansleep(wm2200->pdata.reset, 0);
+@@ -2429,12 +2431,15 @@ static int wm2200_i2c_remove(struct i2c_client *i2c)
+ {
+ struct wm2200_priv *wm2200 = i2c_get_clientdata(i2c);
+
++ pm_runtime_disable(&i2c->dev);
+ if (i2c->irq)
+ free_irq(i2c->irq, wm2200);
+ if (wm2200->pdata.reset)
+ gpio_set_value_cansleep(wm2200->pdata.reset, 0);
+ if (wm2200->pdata.ldo_ena)
+ gpio_set_value_cansleep(wm2200->pdata.ldo_ena, 0);
++ regulator_bulk_disable(ARRAY_SIZE(wm2200->core_supplies),
++ wm2200->core_supplies);
+
+ return 0;
+ }
+diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
+index ba89d9d711f7..b793701aafcd 100644
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -2620,6 +2620,7 @@ static int wm5100_i2c_probe(struct i2c_client *i2c,
+ return ret;
+
+ err_reset:
++ pm_runtime_disable(&i2c->dev);
+ if (i2c->irq)
+ free_irq(i2c->irq, wm5100);
+ wm5100_free_gpio(i2c);
+@@ -2643,6 +2644,7 @@ static int wm5100_i2c_remove(struct i2c_client *i2c)
+ {
+ struct wm5100_priv *wm5100 = i2c_get_clientdata(i2c);
+
++ pm_runtime_disable(&i2c->dev);
+ if (i2c->irq)
+ free_irq(i2c->irq, wm5100);
+ wm5100_free_gpio(i2c);
+diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
+index 1965635ec07c..d14e851b9160 100644
+--- a/sound/soc/codecs/wm8904.c
++++ b/sound/soc/codecs/wm8904.c
+@@ -1902,6 +1902,7 @@ static int wm8904_set_bias_level(struct snd_soc_component *component,
+ snd_soc_component_update_bits(component, WM8904_BIAS_CONTROL_0,
+ WM8904_BIAS_ENA, 0);
+
++ snd_soc_component_write(component, WM8904_SW_RESET_AND_ID, 0);
+ regcache_cache_only(wm8904->regmap, true);
+ regcache_mark_dirty(wm8904->regmap);
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index b6dc524830b2..6acd5dd599dc 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -414,10 +414,12 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"),
+ },
+- .driver_data = (void *)(BYT_RT5640_IN1_MAP |
+- BYT_RT5640_MCLK_EN |
+- BYT_RT5640_SSP0_AIF1),
+-
++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
+ },
+ {
+ .matches = {
+diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+index b8a03f58ac8c..f36e33a14728 100644
+--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+@@ -423,6 +423,9 @@ static int kabylake_dmic_startup(struct snd_pcm_substream *substream)
+ snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+ dmic_constraints);
+
++ runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
++ snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
++
+ return snd_pcm_hw_constraint_list(substream->runtime, 0,
+ SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
+ }
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index a62be78fc07b..249fa8d7376e 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1073,16 +1073,22 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd)
+ return -errno;
+
+ new_fd = open("/", O_RDONLY | O_CLOEXEC);
+- if (new_fd < 0)
++ if (new_fd < 0) {
++ err = -errno;
+ goto err_free_new_name;
++ }
+
+ new_fd = dup3(fd, new_fd, O_CLOEXEC);
+- if (new_fd < 0)
++ if (new_fd < 0) {
++ err = -errno;
+ goto err_close_new_fd;
++ }
+
+ err = zclose(map->fd);
+- if (err)
++ if (err) {
++ err = -errno;
+ goto err_close_new_fd;
++ }
+ free(map->name);
+
+ map->fd = new_fd;
+@@ -1101,7 +1107,7 @@ err_close_new_fd:
+ close(new_fd);
+ err_free_new_name:
+ free(new_name);
+- return -errno;
++ return err;
+ }
+
+ static int
+diff --git a/tools/lib/subcmd/Makefile b/tools/lib/subcmd/Makefile
+index 5b2cd5e58df0..5dbb0dde208c 100644
+--- a/tools/lib/subcmd/Makefile
++++ b/tools/lib/subcmd/Makefile
+@@ -28,7 +28,9 @@ ifeq ($(DEBUG),0)
+ endif
+ endif
+
+-ifeq ($(CC_NO_CLANG), 0)
++ifeq ($(DEBUG),1)
++ CFLAGS += -O0
++else ifeq ($(CC_NO_CLANG), 0)
+ CFLAGS += -O3
+ else
+ CFLAGS += -O6
+diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c
+index e76154c02ee7..2700f1f17876 100644
+--- a/tools/lib/traceevent/parse-filter.c
++++ b/tools/lib/traceevent/parse-filter.c
+@@ -1475,8 +1475,10 @@ static int copy_filter_type(struct event_filter *filter,
+ if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) {
+ /* Add trivial event */
+ arg = allocate_arg();
+- if (arg == NULL)
++ if (arg == NULL) {
++ free(str);
+ return -1;
++ }
+
+ arg->type = FILTER_ARG_BOOLEAN;
+ if (strcmp(str, "TRUE") == 0)
+@@ -1485,8 +1487,11 @@ static int copy_filter_type(struct event_filter *filter,
+ arg->boolean.value = 0;
+
+ filter_type = add_filter_type(filter, event->id);
+- if (filter_type == NULL)
++ if (filter_type == NULL) {
++ free(str);
++ free_arg(arg);
+ return -1;
++ }
+
+ filter_type->filter = arg;
+
+diff --git a/tools/objtool/arch/x86/lib/x86-opcode-map.txt b/tools/objtool/arch/x86/lib/x86-opcode-map.txt
+index e0b85930dd77..0a0e9112f284 100644
+--- a/tools/objtool/arch/x86/lib/x86-opcode-map.txt
++++ b/tools/objtool/arch/x86/lib/x86-opcode-map.txt
+@@ -333,7 +333,7 @@ AVXcode: 1
+ 06: CLTS
+ 07: SYSRET (o64)
+ 08: INVD
+-09: WBINVD
++09: WBINVD | WBNOINVD (F3)
+ 0a:
+ 0b: UD2 (1B)
+ 0c:
+@@ -364,7 +364,7 @@ AVXcode: 1
+ # a ModR/M byte.
+ 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev
+ 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv
+-1c:
++1c: Grp20 (1A),(1C)
+ 1d:
+ 1e:
+ 1f: NOP Ev
+@@ -792,6 +792,8 @@ f3: Grp17 (1A)
+ f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v)
+ f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v)
+ f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v)
++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3)
++f9: MOVDIRI My,Gy
+ EndTable
+
+ Table: 3-byte opcode 2 (0x0f 0x3a)
+@@ -943,9 +945,9 @@ GrpTable: Grp6
+ EndTable
+
+ GrpTable: Grp7
+-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B)
+-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B)
+-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B)
++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B)
++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B)
++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B)
+ 3: LIDT Ms
+ 4: SMSW Mw/Rv
+ 5: rdpkru (110),(11B) | wrpkru (111),(11B)
+@@ -1020,7 +1022,7 @@ GrpTable: Grp15
+ 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B)
+ 4: XSAVE | ptwrite Ey (F3),(11B)
+ 5: XRSTOR | lfence (11B)
+-6: XSAVEOPT | clwb (66) | mfence (11B)
++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B)
+ 7: clflush | clflushopt (66) | sfence (11B)
+ EndTable
+
+@@ -1051,6 +1053,10 @@ GrpTable: Grp19
+ 6: vscatterpf1qps/d Wx (66),(ev)
+ EndTable
+
++GrpTable: Grp20
++0: cldemote Mb
++EndTable
++
+ # AMD's Prefetch Group
+ GrpTable: GrpP
+ 0: PREFETCH
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index b2188e623e22..2f94f7ad65bd 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -383,6 +383,13 @@ static int report__setup_sample_type(struct report *rep)
+ PERF_SAMPLE_BRANCH_ANY))
+ rep->nonany_branch_mode = true;
+
++#ifndef HAVE_LIBUNWIND_SUPPORT
++ if (dwarf_callchain_users) {
++ ui__warning("Please install libunwind development packages "
++ "during the perf build.\n");
++ }
++#endif
++
+ return 0;
+ }
+
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index 6cd9623ebc93..38b5888ef7b3 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -754,6 +754,7 @@ static int process_mapfile(FILE *outfp, char *fpath)
+ char *line, *p;
+ int line_num;
+ char *tblname;
++ int ret = 0;
+
+ pr_info("%s: Processing mapfile %s\n", prog, fpath);
+
+@@ -765,6 +766,7 @@ static int process_mapfile(FILE *outfp, char *fpath)
+ if (!mapfp) {
+ pr_info("%s: Error %s opening %s\n", prog, strerror(errno),
+ fpath);
++ free(line);
+ return -1;
+ }
+
+@@ -791,7 +793,8 @@ static int process_mapfile(FILE *outfp, char *fpath)
+ /* TODO Deal with lines longer than 16K */
+ pr_info("%s: Mapfile %s: line %d too long, aborting\n",
+ prog, fpath, line_num);
+- return -1;
++ ret = -1;
++ goto out;
+ }
+ line[strlen(line)-1] = '\0';
+
+@@ -821,7 +824,9 @@ static int process_mapfile(FILE *outfp, char *fpath)
+
+ out:
+ print_mapping_table_suffix(outfp);
+- return 0;
++ fclose(mapfp);
++ free(line);
++ return ret;
+ }
+
+ /*
+@@ -1118,6 +1123,7 @@ int main(int argc, char *argv[])
+ goto empty_map;
+ } else if (rc < 0) {
+ /* Make build fail */
++ fclose(eventsfp);
+ free_arch_std_events();
+ return 1;
+ } else if (rc) {
+@@ -1130,6 +1136,7 @@ int main(int argc, char *argv[])
+ goto empty_map;
+ } else if (rc < 0) {
+ /* Make build fail */
++ fclose(eventsfp);
+ free_arch_std_events();
+ return 1;
+ } else if (rc) {
+@@ -1147,6 +1154,8 @@ int main(int argc, char *argv[])
+ if (process_mapfile(eventsfp, mapfile)) {
+ pr_info("%s: Error processing mapfile %s\n", prog, mapfile);
+ /* Make build fail */
++ fclose(eventsfp);
++ free_arch_std_events();
+ return 1;
+ }
+
+diff --git a/tools/perf/tests/bp_signal.c b/tools/perf/tests/bp_signal.c
+index 910e25e64188..6cf00650602e 100644
+--- a/tools/perf/tests/bp_signal.c
++++ b/tools/perf/tests/bp_signal.c
+@@ -48,14 +48,6 @@ asm (
+ "__test_function:\n"
+ "incq (%rdi)\n"
+ "ret\n");
+-#elif defined (__aarch64__)
+-extern void __test_function(volatile long *ptr);
+-asm (
+- ".globl __test_function\n"
+- "__test_function:\n"
+- "str x30, [x0]\n"
+- "ret\n");
+-
+ #else
+ static void __test_function(volatile long *ptr)
+ {
+@@ -301,10 +293,15 @@ bool test__bp_signal_is_supported(void)
+ * stepping into the SIGIO handler and getting stuck on the
+ * breakpointed instruction.
+ *
++ * Since arm64 has the same issue with arm for the single-step
++ * handling, this case also gets suck on the breakpointed
++ * instruction.
++ *
+ * Just disable the test for these architectures until these
+ * issues are resolved.
+ */
+-#if defined(__powerpc__) || defined(__s390x__) || defined(__arm__)
++#if defined(__powerpc__) || defined(__s390x__) || defined(__arm__) || \
++ defined(__aarch64__)
+ return false;
+ #else
+ return true;
+diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
+index e92fa6029ac7..788b0805d2f1 100644
+--- a/tools/perf/tests/task-exit.c
++++ b/tools/perf/tests/task-exit.c
+@@ -105,6 +105,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused
+ if (perf_evlist__mmap(evlist, 128) < 0) {
+ pr_debug("failed to mmap events: %d (%s)\n", errno,
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ err = -1;
+ goto out_delete_evlist;
+ }
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 7eb7de5aee44..29e75c051d04 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -320,21 +320,51 @@ bool die_is_func_def(Dwarf_Die *dw_die)
+ dwarf_attr(dw_die, DW_AT_declaration, &attr) == NULL);
+ }
+
++/**
++ * die_entrypc - Returns entry PC (the lowest address) of a DIE
++ * @dw_die: a DIE
++ * @addr: where to store entry PC
++ *
++ * Since dwarf_entrypc() does not return entry PC if the DIE has only address
++ * range, we have to use this to retrieve the lowest address from the address
++ * range attribute.
++ */
++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
++{
++ Dwarf_Addr base, end;
++
++ if (!addr)
++ return -EINVAL;
++
++ if (dwarf_entrypc(dw_die, addr) == 0)
++ return 0;
++
++ return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0;
++}
++
+ /**
+ * die_is_func_instance - Ensure that this DIE is an instance of a subprogram
+ * @dw_die: a DIE
+ *
+ * Ensure that this DIE is an instance (which has an entry address).
+- * This returns true if @dw_die is a function instance. If not, you need to
+- * call die_walk_instances() to find actual instances.
++ * This returns true if @dw_die is a function instance. If not, the @dw_die
++ * must be a prototype. You can use die_walk_instances() to find actual
++ * instances.
+ **/
+ bool die_is_func_instance(Dwarf_Die *dw_die)
+ {
+ Dwarf_Addr tmp;
++ Dwarf_Attribute attr_mem;
++ int tag = dwarf_tag(dw_die);
+
+- /* Actually gcc optimizes non-inline as like as inlined */
+- return !dwarf_func_inline(dw_die) && dwarf_entrypc(dw_die, &tmp) == 0;
++ if (tag != DW_TAG_subprogram &&
++ tag != DW_TAG_inlined_subroutine)
++ return false;
++
++ return dwarf_entrypc(dw_die, &tmp) == 0 ||
++ dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL;
+ }
++
+ /**
+ * die_get_data_member_location - Get the data-member offset
+ * @mb_die: a DIE of a member of a data structure
+@@ -611,6 +641,9 @@ static int __die_walk_instances_cb(Dwarf_Die *inst, void *data)
+ Dwarf_Die *origin;
+ int tmp;
+
++ if (!die_is_func_instance(inst))
++ return DIE_FIND_CB_CONTINUE;
++
+ attr = dwarf_attr(inst, DW_AT_abstract_origin, &attr_mem);
+ if (attr == NULL)
+ return DIE_FIND_CB_CONTINUE;
+@@ -682,15 +715,14 @@ static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data)
+ if (dwarf_tag(in_die) == DW_TAG_inlined_subroutine) {
+ fname = die_get_call_file(in_die);
+ lineno = die_get_call_lineno(in_die);
+- if (fname && lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) {
++ if (fname && lineno > 0 && die_entrypc(in_die, &addr) == 0) {
+ lw->retval = lw->callback(fname, lineno, addr, lw->data);
+ if (lw->retval != 0)
+ return DIE_FIND_CB_END;
+ }
++ if (!lw->recursive)
++ return DIE_FIND_CB_SIBLING;
+ }
+- if (!lw->recursive)
+- /* Don't need to search recursively */
+- return DIE_FIND_CB_SIBLING;
+
+ if (addr) {
+ fname = dwarf_decl_file(in_die);
+@@ -723,7 +755,7 @@ static int __die_walk_funclines(Dwarf_Die *sp_die, bool recursive,
+ /* Handle function declaration line */
+ fname = dwarf_decl_file(sp_die);
+ if (fname && dwarf_decl_line(sp_die, &lineno) == 0 &&
+- dwarf_entrypc(sp_die, &addr) == 0) {
++ die_entrypc(sp_die, &addr) == 0) {
+ lw.retval = callback(fname, lineno, addr, data);
+ if (lw.retval != 0)
+ goto done;
+@@ -737,6 +769,10 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data)
+ {
+ struct __line_walk_param *lw = data;
+
++ /*
++ * Since inlined function can include another inlined function in
++ * the same file, we need to walk in it recursively.
++ */
+ lw->retval = __die_walk_funclines(sp_die, true, lw->callback, lw->data);
+ if (lw->retval != 0)
+ return DWARF_CB_ABORT;
+@@ -761,11 +797,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
+ Dwarf_Lines *lines;
+ Dwarf_Line *line;
+ Dwarf_Addr addr;
+- const char *fname, *decf = NULL;
++ const char *fname, *decf = NULL, *inf = NULL;
+ int lineno, ret = 0;
+ int decl = 0, inl;
+ Dwarf_Die die_mem, *cu_die;
+ size_t nlines, i;
++ bool flag;
+
+ /* Get the CU die */
+ if (dwarf_tag(rt_die) != DW_TAG_compile_unit) {
+@@ -796,6 +833,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
+ "Possible error in debuginfo.\n");
+ continue;
+ }
++ /* Skip end-of-sequence */
++ if (dwarf_lineendsequence(line, &flag) != 0 || flag)
++ continue;
++ /* Skip Non statement line-info */
++ if (dwarf_linebeginstatement(line, &flag) != 0 || !flag)
++ continue;
+ /* Filter lines based on address */
+ if (rt_die != cu_die) {
+ /*
+@@ -805,13 +848,21 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
+ */
+ if (!dwarf_haspc(rt_die, addr))
+ continue;
++
+ if (die_find_inlinefunc(rt_die, addr, &die_mem)) {
++ /* Call-site check */
++ inf = die_get_call_file(&die_mem);
++ if ((inf && !strcmp(inf, decf)) &&
++ die_get_call_lineno(&die_mem) == lineno)
++ goto found;
++
+ dwarf_decl_line(&die_mem, &inl);
+ if (inl != decl ||
+ decf != dwarf_decl_file(&die_mem))
+ continue;
+ }
+ }
++found:
+ /* Get source line */
+ fname = dwarf_linesrc(line, NULL, NULL);
+
+@@ -826,8 +877,9 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
+ */
+ if (rt_die != cu_die)
+ /*
+- * Don't need walk functions recursively, because nested
+- * inlined functions don't have lines of the specified DIE.
++ * Don't need walk inlined functions recursively, because
++ * inner inlined functions don't have the lines of the
++ * specified function.
+ */
+ ret = __die_walk_funclines(rt_die, false, callback, data);
+ else {
+@@ -1002,7 +1054,7 @@ static int die_get_var_innermost_scope(Dwarf_Die *sp_die, Dwarf_Die *vr_die,
+ bool first = true;
+ const char *name;
+
+- ret = dwarf_entrypc(sp_die, &entry);
++ ret = die_entrypc(sp_die, &entry);
+ if (ret)
+ return ret;
+
+@@ -1065,7 +1117,7 @@ int die_get_var_range(Dwarf_Die *sp_die, Dwarf_Die *vr_die, struct strbuf *buf)
+ bool first = true;
+ const char *name;
+
+- ret = dwarf_entrypc(sp_die, &entry);
++ ret = die_entrypc(sp_die, &entry);
+ if (ret)
+ return ret;
+
+diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h
+index 8ac53bf1ec4e..ee15fac4e1d0 100644
+--- a/tools/perf/util/dwarf-aux.h
++++ b/tools/perf/util/dwarf-aux.h
+@@ -41,6 +41,9 @@ int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr,
+ /* Get DW_AT_linkage_name (should be NULL for C binary) */
+ const char *die_get_linkage_name(Dwarf_Die *dw_die);
+
++/* Get the lowest PC in DIE (including range list) */
++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr);
++
+ /* Ensure that this DIE is a subprogram and definition (not declaration) */
+ bool die_is_func_def(Dwarf_Die *dw_die);
+
+diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
+index 1a7c76d2baa8..95043cae5774 100644
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -1282,8 +1282,15 @@ int parse_events_add_pmu(struct parse_events_state *parse_state,
+ if (get_config_terms(head_config, &config_terms))
+ return -ENOMEM;
+
+- if (perf_pmu__config(pmu, &attr, head_config, parse_state->error))
++ if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) {
++ struct perf_evsel_config_term *pos, *tmp;
++
++ list_for_each_entry_safe(pos, tmp, &config_terms, list) {
++ list_del_init(&pos->list);
++ free(pos);
++ }
+ return -EINVAL;
++ }
+
+ evsel = __add_event(list, &parse_state->idx, &attr,
+ get_config_name(head_config), pmu,
+@@ -1843,15 +1850,20 @@ int parse_events(struct perf_evlist *evlist, const char *str,
+
+ ret = parse_events__scanner(str, &parse_state, PE_START_EVENTS);
+ perf_pmu__parse_cleanup();
++
++ if (!ret && list_empty(&parse_state.list)) {
++ WARN_ONCE(true, "WARNING: event parser found nothing\n");
++ return -1;
++ }
++
++ /*
++ * Add list to the evlist even with errors to allow callers to clean up.
++ */
++ perf_evlist__splice_list_tail(evlist, &parse_state.list);
++
+ if (!ret) {
+ struct perf_evsel *last;
+
+- if (list_empty(&parse_state.list)) {
+- WARN_ONCE(true, "WARNING: event parser found nothing\n");
+- return -1;
+- }
+-
+- perf_evlist__splice_list_tail(evlist, &parse_state.list);
+ evlist->nr_groups += parse_state.nr_groups;
+ last = perf_evlist__last(evlist);
+ last->cmdline_group_boundary = true;
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index c37fbef1711d..7ccabb891e5a 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -764,6 +764,16 @@ static int find_best_scope_cb(Dwarf_Die *fn_die, void *data)
+ return 0;
+ }
+
++/* Return innermost DIE */
++static int find_inner_scope_cb(Dwarf_Die *fn_die, void *data)
++{
++ struct find_scope_param *fsp = data;
++
++ memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die));
++ fsp->found = true;
++ return 1;
++}
++
+ /* Find an appropriate scope fits to given conditions */
+ static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem)
+ {
+@@ -775,8 +785,13 @@ static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem)
+ .die_mem = die_mem,
+ .found = false,
+ };
++ int ret;
+
+- cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, &fsp);
++ ret = cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb,
++ &fsp);
++ if (!ret && !fsp.found)
++ cu_walk_functions_at(&pf->cu_die, pf->addr,
++ find_inner_scope_cb, &fsp);
+
+ return fsp.found ? die_mem : NULL;
+ }
+@@ -950,7 +965,7 @@ static int probe_point_inline_cb(Dwarf_Die *in_die, void *data)
+ ret = find_probe_point_lazy(in_die, pf);
+ else {
+ /* Get probe address */
+- if (dwarf_entrypc(in_die, &addr) != 0) {
++ if (die_entrypc(in_die, &addr) != 0) {
+ pr_warning("Failed to get entry address of %s.\n",
+ dwarf_diename(in_die));
+ return -ENOENT;
+@@ -1002,7 +1017,7 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data)
+ param->retval = find_probe_point_by_line(pf);
+ } else if (die_is_func_instance(sp_die)) {
+ /* Instances always have the entry address */
+- dwarf_entrypc(sp_die, &pf->addr);
++ die_entrypc(sp_die, &pf->addr);
+ /* But in some case the entry address is 0 */
+ if (pf->addr == 0) {
+ pr_debug("%s has no entry PC. Skipped\n",
+@@ -1414,6 +1429,18 @@ error:
+ return DIE_FIND_CB_END;
+ }
+
++static bool available_var_finder_overlap(struct available_var_finder *af)
++{
++ int i;
++
++ for (i = 0; i < af->nvls; i++) {
++ if (af->pf.addr == af->vls[i].point.address)
++ return true;
++ }
++ return false;
++
++}
++
+ /* Add a found vars into available variables list */
+ static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf)
+ {
+@@ -1424,6 +1451,14 @@ static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf)
+ Dwarf_Die die_mem;
+ int ret;
+
++ /*
++ * For some reason (e.g. different column assigned to same address),
++ * this callback can be called with the address which already passed.
++ * Ignore it first.
++ */
++ if (available_var_finder_overlap(af))
++ return 0;
++
+ /* Check number of tevs */
+ if (af->nvls == af->max_vls) {
+ pr_warning("Too many( > %d) probe point found.\n", af->max_vls);
+@@ -1567,7 +1602,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr,
+ /* Get function entry information */
+ func = basefunc = dwarf_diename(&spdie);
+ if (!func ||
+- dwarf_entrypc(&spdie, &baseaddr) != 0 ||
++ die_entrypc(&spdie, &baseaddr) != 0 ||
+ dwarf_decl_line(&spdie, &baseline) != 0) {
+ lineno = 0;
+ goto post;
+@@ -1584,7 +1619,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr,
+ while (die_find_top_inlinefunc(&spdie, (Dwarf_Addr)addr,
+ &indie)) {
+ /* There is an inline function */
+- if (dwarf_entrypc(&indie, &_addr) == 0 &&
++ if (die_entrypc(&indie, &_addr) == 0 &&
+ _addr == addr) {
+ /*
+ * addr is at an inline function entry.
+diff --git a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c
+index f794d6bbb7e9..3e4ff4a1cdf4 100644
+--- a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c
++++ b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c
+@@ -40,7 +40,6 @@ static cstate_t hsw_ext_cstates[HSW_EXT_CSTATE_COUNT] = {
+ {
+ .name = "PC9",
+ .desc = N_("Processor Package C9"),
+- .desc = N_("Processor Package C2"),
+ .id = PC9,
+ .range = RANGE_PACKAGE,
+ .get_count_percent = hsw_ext_get_count_percent,
+diff --git a/tools/testing/selftests/bpf/cgroup_helpers.c b/tools/testing/selftests/bpf/cgroup_helpers.c
+index cf16948aad4a..6af24f9a780d 100644
+--- a/tools/testing/selftests/bpf/cgroup_helpers.c
++++ b/tools/testing/selftests/bpf/cgroup_helpers.c
+@@ -44,7 +44,7 @@
+ */
+ int setup_cgroup_environment(void)
+ {
+- char cgroup_workdir[PATH_MAX + 1];
++ char cgroup_workdir[PATH_MAX - 24];
+
+ format_cgroup_path(cgroup_workdir, "");
+
+diff --git a/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh b/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh
+index fef88eb4b873..fa6a88c50750 100755
+--- a/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh
++++ b/tools/testing/selftests/net/forwarding/router_bridge_vlan.sh
+@@ -36,7 +36,7 @@ h2_destroy()
+ {
+ ip -6 route del 2001:db8:1::/64 vrf v$h2
+ ip -4 route del 192.0.2.0/28 vrf v$h2
+- simple_if_fini $h2 192.0.2.130/28
++ simple_if_fini $h2 192.0.2.130/28 2001:db8:2::2/64
+ }
+
+ router_create()
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-01-04 19:50 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-01-04 19:50 UTC (permalink / raw
To: gentoo-commits
commit: 5881359b6134a81ccf0e7b0fd4ad9387926c6f5f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Jan 4 19:50:36 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Jan 4 19:50:36 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5881359b
Linux patch 4.19.93
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1092_linux-4.19.93.patch | 4103 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4107 insertions(+)
diff --git a/0000_README b/0000_README
index af10ce2..bedb928 100644
--- a/0000_README
+++ b/0000_README
@@ -407,6 +407,10 @@ Patch: 1091_linux-4.19.92.patch
From: https://www.kernel.org
Desc: Linux 4.19.92
+Patch: 1092_linux-4.19.93.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.93
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1092_linux-4.19.93.patch b/1092_linux-4.19.93.patch
new file mode 100644
index 0000000..c512142
--- /dev/null
+++ b/1092_linux-4.19.93.patch
@@ -0,0 +1,4103 @@
+diff --git a/Makefile b/Makefile
+index 080232ef6716..b3b166c93125 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 92
++SUBLEVEL = 93
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h
+index b36c0289a308..6a0f1f524466 100644
+--- a/arch/arm/boot/compressed/libfdt_env.h
++++ b/arch/arm/boot/compressed/libfdt_env.h
+@@ -2,11 +2,13 @@
+ #ifndef _ARM_LIBFDT_ENV_H
+ #define _ARM_LIBFDT_ENV_H
+
++#include <linux/limits.h>
+ #include <linux/types.h>
+ #include <linux/string.h>
+ #include <asm/byteorder.h>
+
+-#define INT_MAX ((int)(~0U>>1))
++#define INT32_MAX S32_MAX
++#define UINT32_MAX U32_MAX
+
+ typedef __be16 fdt16_t;
+ typedef __be32 fdt32_t;
+diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c
+index 9a07916af8dd..a6554fdb56c5 100644
+--- a/arch/arm/mm/proc-v7-bugs.c
++++ b/arch/arm/mm/proc-v7-bugs.c
+@@ -65,6 +65,9 @@ static void cpu_v7_spectre_init(void)
+ break;
+
+ #ifdef CONFIG_ARM_PSCI
++ case ARM_CPU_PART_BRAHMA_B53:
++ /* Requires no workaround */
++ break;
+ default:
+ /* Other ARM CPUs require no workaround */
+ if (read_cpuid_implementor() == ARM_CPU_IMP_ARM)
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index dfcb698ec8f3..e43321f46a3b 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -90,11 +90,13 @@ MULTIPLEWORD := -mmultiple
+ endif
+
+ ifdef CONFIG_PPC64
++ifndef CONFIG_CC_IS_CLANG
+ cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1)
+ cflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mcall-aixdesc)
+ aflags-$(CONFIG_CPU_BIG_ENDIAN) += $(call cc-option,-mabi=elfv1)
+ aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mabi=elfv2
+ endif
++endif
+
+ ifneq ($(cc-name),clang)
+ cflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mno-strict-align
+@@ -134,6 +136,7 @@ endif
+ endif
+
+ CFLAGS-$(CONFIG_PPC64) := $(call cc-option,-mtraceback=no)
++ifndef CONFIG_CC_IS_CLANG
+ ifdef CONFIG_CPU_LITTLE_ENDIAN
+ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2,$(call cc-option,-mcall-aixdesc))
+ AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv2)
+@@ -142,6 +145,7 @@ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1)
+ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcall-aixdesc)
+ AFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mabi=elfv1)
+ endif
++endif
+ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc))
+ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mno-pointers-to-nested-functions)
+
+diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h
+index 2abc8e83b95e..9757d4f6331e 100644
+--- a/arch/powerpc/boot/libfdt_env.h
++++ b/arch/powerpc/boot/libfdt_env.h
+@@ -6,6 +6,8 @@
+ #include <string.h>
+
+ #define INT_MAX ((int)(~0U>>1))
++#define UINT32_MAX ((u32)~0U)
++#define INT32_MAX ((s32)(UINT32_MAX >> 1))
+
+ #include "of.h"
+
+diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h
+index bfaf175db54d..685c72310f5d 100644
+--- a/arch/powerpc/include/asm/spinlock.h
++++ b/arch/powerpc/include/asm/spinlock.h
+@@ -53,12 +53,10 @@
+ #endif
+
+ #ifdef CONFIG_PPC_PSERIES
+-DECLARE_STATIC_KEY_FALSE(shared_processor);
+-
+ #define vcpu_is_preempted vcpu_is_preempted
+ static inline bool vcpu_is_preempted(int cpu)
+ {
+- if (!static_branch_unlikely(&shared_processor))
++ if (!firmware_has_feature(FW_FEATURE_SPLPAR))
+ return false;
+ return !!(be32_to_cpu(lppaca_of(cpu).yield_count) & 1);
+ }
+diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
+index a5c5940d970a..6a3dde9587cc 100644
+--- a/arch/powerpc/kernel/security.c
++++ b/arch/powerpc/kernel/security.c
+@@ -134,32 +134,33 @@ ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, cha
+
+ thread_priv = security_ftr_enabled(SEC_FTR_L1D_THREAD_PRIV);
+
+- if (rfi_flush || thread_priv) {
++ if (rfi_flush) {
+ struct seq_buf s;
+ seq_buf_init(&s, buf, PAGE_SIZE - 1);
+
+- seq_buf_printf(&s, "Mitigation: ");
+-
+- if (rfi_flush)
+- seq_buf_printf(&s, "RFI Flush");
+-
+- if (rfi_flush && thread_priv)
+- seq_buf_printf(&s, ", ");
+-
++ seq_buf_printf(&s, "Mitigation: RFI Flush");
+ if (thread_priv)
+- seq_buf_printf(&s, "L1D private per thread");
++ seq_buf_printf(&s, ", L1D private per thread");
+
+ seq_buf_printf(&s, "\n");
+
+ return s.len;
+ }
+
++ if (thread_priv)
++ return sprintf(buf, "Vulnerable: L1D private per thread\n");
++
+ if (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) &&
+ !security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR))
+ return sprintf(buf, "Not affected\n");
+
+ return sprintf(buf, "Vulnerable\n");
+ }
++
++ssize_t cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ return cpu_show_meltdown(dev, attr, buf);
++}
+ #endif
+
+ ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf)
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index 8487ad686462..5449e76cf2df 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -235,7 +235,7 @@ static u64 scan_dispatch_log(u64 stop_tb)
+ * Accumulate stolen time by scanning the dispatch trace log.
+ * Called on entry from user mode.
+ */
+-void accumulate_stolen_time(void)
++void notrace accumulate_stolen_time(void)
+ {
+ u64 sst, ust;
+ unsigned long save_irq_soft_mask = irq_soft_mask_return();
+diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
+index b1007e9a31ba..8894c8f300ea 100644
+--- a/arch/powerpc/mm/hash_utils_64.c
++++ b/arch/powerpc/mm/hash_utils_64.c
+@@ -296,10 +296,18 @@ int htab_bolt_mapping(unsigned long vstart, unsigned long vend,
+ ret = mmu_hash_ops.hpte_insert(hpteg, vpn, paddr, tprot,
+ HPTE_V_BOLTED, psize, psize,
+ ssize);
+-
++ if (ret == -1) {
++ /* Try to remove a non bolted entry */
++ ret = mmu_hash_ops.hpte_remove(hpteg);
++ if (ret != -1)
++ ret = mmu_hash_ops.hpte_insert(hpteg, vpn, paddr, tprot,
++ HPTE_V_BOLTED, psize, psize,
++ ssize);
++ }
+ if (ret < 0)
+ break;
+
++ cond_resched();
+ #ifdef CONFIG_DEBUG_PAGEALLOC
+ if (debug_pagealloc_enabled() &&
+ (paddr >> PAGE_SHIFT) < linear_map_hash_count)
+diff --git a/arch/powerpc/platforms/pseries/cmm.c b/arch/powerpc/platforms/pseries/cmm.c
+index 25427a48feae..502ebcc6c3cb 100644
+--- a/arch/powerpc/platforms/pseries/cmm.c
++++ b/arch/powerpc/platforms/pseries/cmm.c
+@@ -425,6 +425,10 @@ static struct bus_type cmm_subsys = {
+ .dev_name = "cmm",
+ };
+
++static void cmm_release_device(struct device *dev)
++{
++}
++
+ /**
+ * cmm_sysfs_register - Register with sysfs
+ *
+@@ -440,6 +444,7 @@ static int cmm_sysfs_register(struct device *dev)
+
+ dev->id = 0;
+ dev->bus = &cmm_subsys;
++ dev->release = cmm_release_device;
+
+ if ((rc = device_register(dev)))
+ goto subsys_unregister;
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index c2d318d1df02..67f49159ea70 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -75,9 +75,6 @@
+ #include "pseries.h"
+ #include "../../../../drivers/pci/pci.h"
+
+-DEFINE_STATIC_KEY_FALSE(shared_processor);
+-EXPORT_SYMBOL_GPL(shared_processor);
+-
+ int CMO_PrPSP = -1;
+ int CMO_SecPSP = -1;
+ unsigned long CMO_PageSize = (ASM_CONST(1) << IOMMU_PAGE_SHIFT_4K);
+@@ -764,10 +761,6 @@ static void __init pSeries_setup_arch(void)
+
+ if (firmware_has_feature(FW_FEATURE_LPAR)) {
+ vpa_init(boot_cpuid);
+-
+- if (lppaca_shared_proc(get_lppaca()))
+- static_branch_enable(&shared_processor);
+-
+ ppc_md.power_save = pseries_lpar_idle;
+ ppc_md.enable_pmcs = pseries_lpar_enable_pmcs;
+ #ifdef CONFIG_PCI_IOV
+diff --git a/arch/powerpc/tools/relocs_check.sh b/arch/powerpc/tools/relocs_check.sh
+index ec2d5c835170..d6c16e7faa38 100755
+--- a/arch/powerpc/tools/relocs_check.sh
++++ b/arch/powerpc/tools/relocs_check.sh
+@@ -23,7 +23,7 @@ objdump="$1"
+ vmlinux="$2"
+
+ bad_relocs=$(
+-"$objdump" -R "$vmlinux" |
++$objdump -R "$vmlinux" |
+ # Only look at relocation lines.
+ grep -E '\<R_' |
+ # These relocations are okay
+diff --git a/arch/powerpc/tools/unrel_branch_check.sh b/arch/powerpc/tools/unrel_branch_check.sh
+index 1e972df3107e..77114755dc6f 100755
+--- a/arch/powerpc/tools/unrel_branch_check.sh
++++ b/arch/powerpc/tools/unrel_branch_check.sh
+@@ -18,14 +18,14 @@ vmlinux="$2"
+ #__end_interrupts should be located within the first 64K
+
+ end_intr=0x$(
+-"$objdump" -R "$vmlinux" -d --start-address=0xc000000000000000 \
++$objdump -R "$vmlinux" -d --start-address=0xc000000000000000 \
+ --stop-address=0xc000000000010000 |
+ grep '\<__end_interrupts>:' |
+ awk '{print $1}'
+ )
+
+ BRANCHES=$(
+-"$objdump" -R "$vmlinux" -D --start-address=0xc000000000000000 \
++$objdump -R "$vmlinux" -D --start-address=0xc000000000000000 \
+ --stop-address=${end_intr} |
+ grep -e "^c[0-9a-f]*:[[:space:]]*\([0-9a-f][0-9a-f][[:space:]]\)\{4\}[[:space:]]*b" |
+ grep -v '\<__start_initialization_multiplatform>' |
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index df92c2af99b6..5c3fd9032b74 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -193,7 +193,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb,
+ unsigned long num_sdb, gfp_t gfp_flags)
+ {
+ int i, rc;
+- unsigned long *new, *tail;
++ unsigned long *new, *tail, *tail_prev = NULL;
+
+ if (!sfb->sdbt || !sfb->tail)
+ return -EINVAL;
+@@ -232,6 +232,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb,
+ sfb->num_sdbt++;
+ /* Link current page to tail of chain */
+ *tail = (unsigned long)(void *) new + 1;
++ tail_prev = tail;
+ tail = new;
+ }
+
+@@ -241,10 +242,22 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb,
+ * issue, a new realloc call (if required) might succeed.
+ */
+ rc = alloc_sample_data_block(tail, gfp_flags);
+- if (rc)
++ if (rc) {
++ /* Undo last SDBT. An SDBT with no SDB at its first
++ * entry but with an SDBT entry instead can not be
++ * handled by the interrupt handler code.
++ * Avoid this situation.
++ */
++ if (tail_prev) {
++ sfb->num_sdbt--;
++ free_page((unsigned long) new);
++ tail = tail_prev;
++ }
+ break;
++ }
+ sfb->num_sdb++;
+ tail++;
++ tail_prev = new = NULL; /* Allocated at least one SBD */
+ }
+
+ /* Link sampling buffer to its origin */
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 87ed8462a5c7..1f69b12d5bb8 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -812,8 +812,8 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
+ if (quirk_no_way_out)
+ quirk_no_way_out(i, m, regs);
+
++ m->bank = i;
+ if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) {
+- m->bank = i;
+ mce_read_aux(m, i);
+ *msg = tmp;
+ return 1;
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index 933268b8d6a5..d3947388a3ef 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -996,6 +996,12 @@ static void cdrom_count_tracks(struct cdrom_device_info *cdi, tracktype *tracks)
+ tracks->xa = 0;
+ tracks->error = 0;
+ cd_dbg(CD_COUNT_TRACKS, "entering cdrom_count_tracks\n");
++
++ if (!CDROM_CAN(CDC_PLAY_AUDIO)) {
++ tracks->error = CDS_NO_INFO;
++ return;
++ }
++
+ /* Grab the TOC header so we can see how many tracks there are */
+ ret = cdi->ops->audio_ioctl(cdi, CDROMREADTOCHDR, &header);
+ if (ret) {
+@@ -1162,7 +1168,8 @@ int cdrom_open(struct cdrom_device_info *cdi, struct block_device *bdev,
+ ret = open_for_data(cdi);
+ if (ret)
+ goto err;
+- cdrom_mmc3_profile(cdi);
++ if (CDROM_CAN(CDC_GENERIC_PACKET))
++ cdrom_mmc3_profile(cdi);
+ if (mode & FMODE_WRITE) {
+ ret = -EROFS;
+ if (cdrom_open_write(cdi))
+@@ -2882,6 +2889,9 @@ int cdrom_get_last_written(struct cdrom_device_info *cdi, long *last_written)
+ it doesn't give enough information or fails. then we return
+ the toc contents. */
+ use_toc:
++ if (!CDROM_CAN(CDC_PLAY_AUDIO))
++ return -ENOSYS;
++
+ toc.cdte_format = CDROM_MSF;
+ toc.cdte_track = CDROM_LEADOUT;
+ if ((ret = cdi->ops->audio_ioctl(cdi, CDROMREADTOCENTRY, &toc)))
+diff --git a/drivers/clk/clk-gpio.c b/drivers/clk/clk-gpio.c
+index 40af4fbab4d2..af9cc00d2d92 100644
+--- a/drivers/clk/clk-gpio.c
++++ b/drivers/clk/clk-gpio.c
+@@ -248,7 +248,7 @@ static int gpio_clk_driver_probe(struct platform_device *pdev)
+ else
+ clk = clk_register_gpio_gate(&pdev->dev, node->name,
+ parent_names ? parent_names[0] : NULL, gpiod,
+- 0);
++ CLK_SET_RATE_PARENT);
+ if (IS_ERR(clk))
+ return PTR_ERR(clk);
+
+diff --git a/drivers/clk/pxa/clk-pxa27x.c b/drivers/clk/pxa/clk-pxa27x.c
+index d40b63e7bbce..b44c4cf8011a 100644
+--- a/drivers/clk/pxa/clk-pxa27x.c
++++ b/drivers/clk/pxa/clk-pxa27x.c
+@@ -463,6 +463,7 @@ struct dummy_clk {
+ };
+ static struct dummy_clk dummy_clks[] __initdata = {
+ DUMMY_CLK(NULL, "pxa27x-gpio", "osc_32_768khz"),
++ DUMMY_CLK(NULL, "pxa-rtc", "osc_32_768khz"),
+ DUMMY_CLK(NULL, "sa1100-rtc", "osc_32_768khz"),
+ DUMMY_CLK("UARTCLK", "pxa2xx-ir", "STUART"),
+ };
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index 52208d4165f4..51b2388d80ac 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -206,6 +206,8 @@ static int _freq_tbl_determine_rate(struct clk_hw *hw, const struct freq_tbl *f,
+ if (clk_flags & CLK_SET_RATE_PARENT) {
+ rate = f->freq;
+ if (f->pre_div) {
++ if (!rate)
++ rate = req->rate;
+ rate /= 2;
+ rate *= f->pre_div + 1;
+ }
+diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c
+index db9b2471ac40..bfb6d6065a90 100644
+--- a/drivers/clk/qcom/common.c
++++ b/drivers/clk/qcom/common.c
+@@ -29,6 +29,9 @@ struct freq_tbl *qcom_find_freq(const struct freq_tbl *f, unsigned long rate)
+ if (!f)
+ return NULL;
+
++ if (!f->freq)
++ return f;
++
+ for (; f->freq; f++)
+ if (rate <= f->freq)
+ return f;
+diff --git a/drivers/clocksource/asm9260_timer.c b/drivers/clocksource/asm9260_timer.c
+index 38cd2feb87c4..0ce760776406 100644
+--- a/drivers/clocksource/asm9260_timer.c
++++ b/drivers/clocksource/asm9260_timer.c
+@@ -198,6 +198,10 @@ static int __init asm9260_timer_init(struct device_node *np)
+ }
+
+ clk = of_clk_get(np, 0);
++ if (IS_ERR(clk)) {
++ pr_err("Failed to get clk!\n");
++ return PTR_ERR(clk);
++ }
+
+ ret = clk_prepare_enable(clk);
+ if (ret) {
+diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
+index 06ed88a2a8a0..6e2cb3693ed8 100644
+--- a/drivers/clocksource/timer-of.c
++++ b/drivers/clocksource/timer-of.c
+@@ -199,7 +199,7 @@ int __init timer_of_init(struct device_node *np, struct timer_of *to)
+ }
+
+ if (!to->clkevt.name)
+- to->clkevt.name = np->name;
++ to->clkevt.name = np->full_name;
+
+ to->np = np;
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index 8aec137b4fca..d56b6b0e22a8 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -1427,6 +1427,7 @@ static int xilinx_dma_reset(struct xilinx_dma_chan *chan)
+
+ chan->err = false;
+ chan->idle = true;
++ chan->desc_pendingcount = 0;
+ chan->desc_submitcount = 0;
+
+ return err;
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index c8673a5d9412..3f10f9599f2c 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -348,7 +348,8 @@ static int mpc8xxx_probe(struct platform_device *pdev)
+ * It's assumed that only a single type of gpio controller is available
+ * on the current machine, so overwriting global data is fine.
+ */
+- mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type;
++ if (devtype->irq_set_type)
++ mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type;
+
+ if (devtype->gpio_dir_out)
+ gc->direction_output = devtype->gpio_dir_out;
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index b0c8fae7f903..3a359716fb38 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -780,6 +780,10 @@ static void hid_scan_feature_usage(struct hid_parser *parser, u32 usage)
+ if (usage == 0xff0000c5 && parser->global.report_count == 256 &&
+ parser->global.report_size == 8)
+ parser->scan_flags |= HID_SCAN_FLAG_MT_WIN_8;
++
++ if (usage == 0xff0000c6 && parser->global.report_count == 1 &&
++ parser->global.report_size == 8)
++ parser->scan_flags |= HID_SCAN_FLAG_MT_WIN_8;
+ }
+
+ static void hid_scan_collection(struct hid_parser *parser, unsigned type)
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 02c263a4c083..1949d6fca53e 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -563,6 +563,7 @@
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A 0x094a
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941 0x0941
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641 0x0641
++#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_1f4a 0x1f4a
+
+ #define USB_VENDOR_ID_HUION 0x256c
+ #define USB_DEVICE_ID_HUION_TABLET 0x006e
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 034c883e57fa..504e8917b06f 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -978,6 +978,9 @@ static int hidpp20_batterylevel_get_battery_capacity(struct hidpp_device *hidpp,
+ ret = hidpp_send_fap_command_sync(hidpp, feature_index,
+ CMD_BATTERY_LEVEL_STATUS_GET_BATTERY_LEVEL_STATUS,
+ NULL, 0, &response);
++ /* Ignore these intermittent errors */
++ if (ret == HIDPP_ERROR_RESOURCE_ERROR)
++ return -EIO;
+ if (ret > 0) {
+ hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n",
+ __func__, ret);
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index a407fd2399ff..57d6fe9ed416 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -96,6 +96,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641), HID_QUIRK_ALWAYS_POLL },
++ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_1f4a), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X), HID_QUIRK_MULTI_INPUT },
+diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
+index 9e33165250a3..a5b6b2be9cda 100644
+--- a/drivers/hid/hid-rmi.c
++++ b/drivers/hid/hid-rmi.c
+@@ -737,7 +737,8 @@ static void rmi_remove(struct hid_device *hdev)
+ {
+ struct rmi_data *hdata = hid_get_drvdata(hdev);
+
+- if (hdata->device_flags & RMI_DEVICE) {
++ if ((hdata->device_flags & RMI_DEVICE)
++ && test_bit(RMI_STARTED, &hdata->flags)) {
+ clear_bit(RMI_STARTED, &hdata->flags);
+ cancel_work_sync(&hdata->reset_work);
+ rmi_unregister_transport_device(&hdata->xport);
+diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
+index a7ace07e179e..e8f98de60df3 100644
+--- a/drivers/input/touchscreen/atmel_mxt_ts.c
++++ b/drivers/input/touchscreen/atmel_mxt_ts.c
+@@ -3162,6 +3162,8 @@ static int __maybe_unused mxt_suspend(struct device *dev)
+
+ mutex_unlock(&input_dev->mutex);
+
++ disable_irq(data->irq);
++
+ return 0;
+ }
+
+@@ -3174,6 +3176,8 @@ static int __maybe_unused mxt_resume(struct device *dev)
+ if (!input_dev)
+ return 0;
+
++ enable_irq(data->irq);
++
+ mutex_lock(&input_dev->mutex);
+
+ if (input_dev->users)
+diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
+index ad3e2b97469e..140b287e886c 100644
+--- a/drivers/iommu/rockchip-iommu.c
++++ b/drivers/iommu/rockchip-iommu.c
+@@ -977,13 +977,13 @@ static struct iommu_domain *rk_iommu_domain_alloc(unsigned type)
+ if (!dma_dev)
+ return NULL;
+
+- rk_domain = devm_kzalloc(dma_dev, sizeof(*rk_domain), GFP_KERNEL);
++ rk_domain = kzalloc(sizeof(*rk_domain), GFP_KERNEL);
+ if (!rk_domain)
+ return NULL;
+
+ if (type == IOMMU_DOMAIN_DMA &&
+ iommu_get_dma_cookie(&rk_domain->domain))
+- return NULL;
++ goto err_free_domain;
+
+ /*
+ * rk32xx iommus use a 2 level pagetable.
+@@ -1018,6 +1018,8 @@ err_free_dt:
+ err_put_cookie:
+ if (type == IOMMU_DOMAIN_DMA)
+ iommu_put_dma_cookie(&rk_domain->domain);
++err_free_domain:
++ kfree(rk_domain);
+
+ return NULL;
+ }
+@@ -1046,6 +1048,7 @@ static void rk_iommu_domain_free(struct iommu_domain *domain)
+
+ if (domain->type == IOMMU_DOMAIN_DMA)
+ iommu_put_dma_cookie(&rk_domain->domain);
++ kfree(rk_domain);
+ }
+
+ static int rk_iommu_add_device(struct device *dev)
+diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
+index 121d3cb7ddd1..fa0ecb5e6380 100644
+--- a/drivers/iommu/tegra-smmu.c
++++ b/drivers/iommu/tegra-smmu.c
+@@ -164,9 +164,9 @@ static bool smmu_dma_addr_valid(struct tegra_smmu *smmu, dma_addr_t addr)
+ return (addr & smmu->pfn_mask) == addr;
+ }
+
+-static dma_addr_t smmu_pde_to_dma(u32 pde)
++static dma_addr_t smmu_pde_to_dma(struct tegra_smmu *smmu, u32 pde)
+ {
+- return pde << 12;
++ return (dma_addr_t)(pde & smmu->pfn_mask) << 12;
+ }
+
+ static void smmu_flush_ptc_all(struct tegra_smmu *smmu)
+@@ -551,6 +551,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova,
+ dma_addr_t *dmap)
+ {
+ unsigned int pd_index = iova_pd_index(iova);
++ struct tegra_smmu *smmu = as->smmu;
+ struct page *pt_page;
+ u32 *pd;
+
+@@ -559,7 +560,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova,
+ return NULL;
+
+ pd = page_address(as->pd);
+- *dmap = smmu_pde_to_dma(pd[pd_index]);
++ *dmap = smmu_pde_to_dma(smmu, pd[pd_index]);
+
+ return tegra_smmu_pte_offset(pt_page, iova);
+ }
+@@ -601,7 +602,7 @@ static u32 *as_get_pte(struct tegra_smmu_as *as, dma_addr_t iova,
+ } else {
+ u32 *pd = page_address(as->pd);
+
+- *dmap = smmu_pde_to_dma(pd[pde]);
++ *dmap = smmu_pde_to_dma(smmu, pd[pde]);
+ }
+
+ return tegra_smmu_pte_offset(as->pts[pde], iova);
+@@ -626,7 +627,7 @@ static void tegra_smmu_pte_put_use(struct tegra_smmu_as *as, unsigned long iova)
+ if (--as->count[pde] == 0) {
+ struct tegra_smmu *smmu = as->smmu;
+ u32 *pd = page_address(as->pd);
+- dma_addr_t pte_dma = smmu_pde_to_dma(pd[pde]);
++ dma_addr_t pte_dma = smmu_pde_to_dma(smmu, pd[pde]);
+
+ tegra_smmu_set_pde(as, iova, 0);
+
+diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
+index 0f6e30e9009d..f53dfc5aa7c5 100644
+--- a/drivers/irqchip/irq-bcm7038-l1.c
++++ b/drivers/irqchip/irq-bcm7038-l1.c
+@@ -284,6 +284,10 @@ static int __init bcm7038_l1_init_one(struct device_node *dn,
+ pr_err("failed to map parent interrupt %d\n", parent_irq);
+ return -EINVAL;
+ }
++
++ if (of_property_read_bool(dn, "brcm,irq-can-wake"))
++ enable_irq_wake(parent_irq);
++
+ irq_set_chained_handler_and_data(parent_irq, bcm7038_l1_irq_handle,
+ intc);
+
+diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c
+index 2ff08986b536..be6923abf9a4 100644
+--- a/drivers/irqchip/irq-ingenic.c
++++ b/drivers/irqchip/irq-ingenic.c
+@@ -117,6 +117,14 @@ static int __init ingenic_intc_of_init(struct device_node *node,
+ goto out_unmap_irq;
+ }
+
++ domain = irq_domain_add_legacy(node, num_chips * 32,
++ JZ4740_IRQ_BASE, 0,
++ &irq_domain_simple_ops, NULL);
++ if (!domain) {
++ err = -ENOMEM;
++ goto out_unmap_base;
++ }
++
+ for (i = 0; i < num_chips; i++) {
+ /* Mask all irqs */
+ writel(0xffffffff, intc->base + (i * CHIP_SIZE) +
+@@ -143,14 +151,11 @@ static int __init ingenic_intc_of_init(struct device_node *node,
+ IRQ_NOPROBE | IRQ_LEVEL);
+ }
+
+- domain = irq_domain_add_legacy(node, num_chips * 32, JZ4740_IRQ_BASE, 0,
+- &irq_domain_simple_ops, NULL);
+- if (!domain)
+- pr_warn("unable to register IRQ domain\n");
+-
+ setup_irq(parent_irq, &intc_cascade_action);
+ return 0;
+
++out_unmap_base:
++ iounmap(intc->base);
+ out_unmap_irq:
+ irq_dispose_mapping(parent_irq);
+ out_free:
+diff --git a/drivers/leds/leds-lm3692x.c b/drivers/leds/leds-lm3692x.c
+index 4f413a7c5f05..d79a66a73169 100644
+--- a/drivers/leds/leds-lm3692x.c
++++ b/drivers/leds/leds-lm3692x.c
+@@ -337,9 +337,18 @@ static int lm3692x_probe_dt(struct lm3692x_led *led)
+ return ret;
+ }
+
+- led->regulator = devm_regulator_get(&led->client->dev, "vled");
+- if (IS_ERR(led->regulator))
++ led->regulator = devm_regulator_get_optional(&led->client->dev, "vled");
++ if (IS_ERR(led->regulator)) {
++ ret = PTR_ERR(led->regulator);
++ if (ret != -ENODEV) {
++ if (ret != -EPROBE_DEFER)
++ dev_err(&led->client->dev,
++ "Failed to get vled regulator: %d\n",
++ ret);
++ return ret;
++ }
+ led->regulator = NULL;
++ }
+
+ child = device_get_next_child_node(&led->client->dev, child);
+ if (!child) {
+diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c
+index 363d35d5e49d..2f47023cab2b 100644
+--- a/drivers/mailbox/imx-mailbox.c
++++ b/drivers/mailbox/imx-mailbox.c
+@@ -214,8 +214,10 @@ static void imx_mu_shutdown(struct mbox_chan *chan)
+ struct imx_mu_priv *priv = to_imx_mu_priv(chan->mbox);
+ struct imx_mu_con_priv *cp = chan->con_priv;
+
+- if (cp->type == IMX_MU_TYPE_TXDB)
++ if (cp->type == IMX_MU_TYPE_TXDB) {
+ tasklet_kill(&cp->txdb_tasklet);
++ return;
++ }
+
+ imx_mu_xcr_rmw(priv, 0,
+ IMX_MU_xCR_TIEn(cp->idx) | IMX_MU_xCR_RIEn(cp->idx));
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 45f684689c35..bb40bd66a10e 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -713,6 +713,8 @@ static unsigned long bch_mca_scan(struct shrinker *shrink,
+ * IO can always make forward progress:
+ */
+ nr /= c->btree_pages;
++ if (nr == 0)
++ nr = 1;
+ nr = min_t(unsigned long, nr, mca_can_free(c));
+
+ i = 0;
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 9b8143dca512..f57b86f1373d 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2223,9 +2223,6 @@ static void bond_miimon_commit(struct bonding *bond)
+ } else if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) {
+ /* make it immediately active */
+ bond_set_active_slave(slave);
+- } else if (slave != primary) {
+- /* prevent it from being the active one */
+- bond_set_backup_slave(slave);
+ }
+
+ netdev_info(bond->dev, "link status definitely up for interface %s, %u Mbps %s duplex\n",
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index b5d72815776c..e26c195fec83 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -1197,8 +1197,8 @@ static int ena_io_poll(struct napi_struct *napi, int budget)
+ struct ena_napi *ena_napi = container_of(napi, struct ena_napi, napi);
+ struct ena_ring *tx_ring, *rx_ring;
+
+- u32 tx_work_done;
+- u32 rx_work_done;
++ int tx_work_done;
++ int rx_work_done = 0;
+ int tx_budget;
+ int napi_comp_call = 0;
+ int ret;
+@@ -1215,7 +1215,11 @@ static int ena_io_poll(struct napi_struct *napi, int budget)
+ }
+
+ tx_work_done = ena_clean_tx_irq(tx_ring, tx_budget);
+- rx_work_done = ena_clean_rx_irq(rx_ring, napi, budget);
++ /* On netpoll the budget is zero and the handler should only clean the
++ * tx completions.
++ */
++ if (likely(budget))
++ rx_work_done = ena_clean_rx_irq(rx_ring, napi, budget);
+
+ /* If the device is about to reset or down, avoid unmask
+ * the interrupt and return 0 so NAPI won't reschedule
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index a50977ce4076..04bee450eb3d 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -3341,7 +3341,7 @@ static int mvpp2_open(struct net_device *dev)
+ valid = true;
+ }
+
+- if (priv->hw_version == MVPP22 && port->link_irq && !port->phylink) {
++ if (priv->hw_version == MVPP22 && port->link_irq) {
+ err = request_irq(port->link_irq, mvpp2_link_status_isr, 0,
+ dev->name, port);
+ if (err) {
+diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c
+index 993cb5ba934e..b99169a386eb 100644
+--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c
++++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c
+@@ -37,6 +37,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/netlink.h>
++#include <linux/vmalloc.h>
+ #include <linux/xz.h>
+ #include "mlxfw_mfa2.h"
+ #include "mlxfw_mfa2_file.h"
+@@ -579,7 +580,7 @@ mlxfw_mfa2_file_component_get(const struct mlxfw_mfa2_file *mfa2_file,
+ comp_size = be32_to_cpu(comp->size);
+ comp_buf_size = comp_size + mlxfw_mfa2_comp_magic_len;
+
+- comp_data = kmalloc(sizeof(*comp_data) + comp_buf_size, GFP_KERNEL);
++ comp_data = vzalloc(sizeof(*comp_data) + comp_buf_size);
+ if (!comp_data)
+ return ERR_PTR(-ENOMEM);
+ comp_data->comp.data_size = comp_size;
+@@ -601,7 +602,7 @@ mlxfw_mfa2_file_component_get(const struct mlxfw_mfa2_file *mfa2_file,
+ comp_data->comp.data = comp_data->buff + mlxfw_mfa2_comp_magic_len;
+ return &comp_data->comp;
+ err_out:
+- kfree(comp_data);
++ vfree(comp_data);
+ return ERR_PTR(err);
+ }
+
+@@ -610,7 +611,7 @@ void mlxfw_mfa2_file_component_put(struct mlxfw_mfa2_component *comp)
+ const struct mlxfw_mfa2_comp_data *comp_data;
+
+ comp_data = container_of(comp, struct mlxfw_mfa2_comp_data, comp);
+- kfree(comp_data);
++ vfree(comp_data);
+ }
+
+ void mlxfw_mfa2_file_fini(struct mlxfw_mfa2_file *mfa2_file)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+index c5979569fd60..94b46258e8ff 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+@@ -118,6 +118,14 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac)
+ struct device *dev = dwmac->dev;
+ const char *parent_name, *mux_parent_names[MUX_CLK_NUM_PARENTS];
+ struct meson8b_dwmac_clk_configs *clk_configs;
++ static const struct clk_div_table div_table[] = {
++ { .div = 2, .val = 2, },
++ { .div = 3, .val = 3, },
++ { .div = 4, .val = 4, },
++ { .div = 5, .val = 5, },
++ { .div = 6, .val = 6, },
++ { .div = 7, .val = 7, },
++ };
+
+ clk_configs = devm_kzalloc(dev, sizeof(*clk_configs), GFP_KERNEL);
+ if (!clk_configs)
+@@ -152,9 +160,9 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac)
+ clk_configs->m250_div.reg = dwmac->regs + PRG_ETH0;
+ clk_configs->m250_div.shift = PRG_ETH0_CLK_M250_DIV_SHIFT;
+ clk_configs->m250_div.width = PRG_ETH0_CLK_M250_DIV_WIDTH;
+- clk_configs->m250_div.flags = CLK_DIVIDER_ONE_BASED |
+- CLK_DIVIDER_ALLOW_ZERO |
+- CLK_DIVIDER_ROUND_CLOSEST;
++ clk_configs->m250_div.table = div_table;
++ clk_configs->m250_div.flags = CLK_DIVIDER_ALLOW_ZERO |
++ CLK_DIVIDER_ROUND_CLOSEST;
+ clk = meson8b_dwmac_register_clk(dwmac, "m250_div", &parent_name, 1,
+ &clk_divider_ops,
+ &clk_configs->m250_div.hw);
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index d178d5bad7e4..494f00b9c5ef 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -42,7 +42,6 @@ struct pdp_ctx {
+ struct hlist_node hlist_addr;
+
+ union {
+- u64 tid;
+ struct {
+ u64 tid;
+ u16 flow;
+@@ -545,7 +544,7 @@ static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev,
+ mtu = dst_mtu(&rt->dst);
+ }
+
+- rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu);
++ rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu, false);
+
+ if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) &&
+ mtu < ntohs(iph->tot_len)) {
+@@ -645,9 +644,16 @@ static void gtp_link_setup(struct net_device *dev)
+ }
+
+ static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize);
+-static void gtp_hashtable_free(struct gtp_dev *gtp);
+ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]);
+
++static void gtp_destructor(struct net_device *dev)
++{
++ struct gtp_dev *gtp = netdev_priv(dev);
++
++ kfree(gtp->addr_hash);
++ kfree(gtp->tid_hash);
++}
++
+ static int gtp_newlink(struct net *src_net, struct net_device *dev,
+ struct nlattr *tb[], struct nlattr *data[],
+ struct netlink_ext_ack *extack)
+@@ -665,10 +671,13 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
+ if (err < 0)
+ return err;
+
+- if (!data[IFLA_GTP_PDP_HASHSIZE])
++ if (!data[IFLA_GTP_PDP_HASHSIZE]) {
+ hashsize = 1024;
+- else
++ } else {
+ hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]);
++ if (!hashsize)
++ hashsize = 1024;
++ }
+
+ err = gtp_hashtable_new(gtp, hashsize);
+ if (err < 0)
+@@ -682,13 +691,15 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
+
+ gn = net_generic(dev_net(dev), gtp_net_id);
+ list_add_rcu(>p->list, &gn->gtp_dev_list);
++ dev->priv_destructor = gtp_destructor;
+
+ netdev_dbg(dev, "registered new GTP interface\n");
+
+ return 0;
+
+ out_hashtable:
+- gtp_hashtable_free(gtp);
++ kfree(gtp->addr_hash);
++ kfree(gtp->tid_hash);
+ out_encap:
+ gtp_encap_disable(gtp);
+ return err;
+@@ -697,9 +708,14 @@ out_encap:
+ static void gtp_dellink(struct net_device *dev, struct list_head *head)
+ {
+ struct gtp_dev *gtp = netdev_priv(dev);
++ struct pdp_ctx *pctx;
++ int i;
++
++ for (i = 0; i < gtp->hash_size; i++)
++ hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid)
++ pdp_context_delete(pctx);
+
+ gtp_encap_disable(gtp);
+- gtp_hashtable_free(gtp);
+ list_del_rcu(>p->list);
+ unregister_netdevice_queue(dev, head);
+ }
+@@ -777,20 +793,6 @@ err1:
+ return -ENOMEM;
+ }
+
+-static void gtp_hashtable_free(struct gtp_dev *gtp)
+-{
+- struct pdp_ctx *pctx;
+- int i;
+-
+- for (i = 0; i < gtp->hash_size; i++)
+- hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid)
+- pdp_context_delete(pctx);
+-
+- synchronize_rcu();
+- kfree(gtp->addr_hash);
+- kfree(gtp->tid_hash);
+-}
+-
+ static struct sock *gtp_encap_enable_socket(int fd, int type,
+ struct gtp_dev *gtp)
+ {
+@@ -931,24 +933,31 @@ static void ipv4_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info)
+ }
+ }
+
+-static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk,
+- struct genl_info *info)
++static int gtp_pdp_add(struct gtp_dev *gtp, struct sock *sk,
++ struct genl_info *info)
+ {
++ struct pdp_ctx *pctx, *pctx_tid = NULL;
+ struct net_device *dev = gtp->dev;
+ u32 hash_ms, hash_tid = 0;
+- struct pdp_ctx *pctx;
++ unsigned int version;
+ bool found = false;
+ __be32 ms_addr;
+
+ ms_addr = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]);
+ hash_ms = ipv4_hashfn(ms_addr) % gtp->hash_size;
++ version = nla_get_u32(info->attrs[GTPA_VERSION]);
+
+- hlist_for_each_entry_rcu(pctx, >p->addr_hash[hash_ms], hlist_addr) {
+- if (pctx->ms_addr_ip4.s_addr == ms_addr) {
+- found = true;
+- break;
+- }
+- }
++ pctx = ipv4_pdp_find(gtp, ms_addr);
++ if (pctx)
++ found = true;
++ if (version == GTP_V0)
++ pctx_tid = gtp0_pdp_find(gtp,
++ nla_get_u64(info->attrs[GTPA_TID]));
++ else if (version == GTP_V1)
++ pctx_tid = gtp1_pdp_find(gtp,
++ nla_get_u32(info->attrs[GTPA_I_TEI]));
++ if (pctx_tid)
++ found = true;
+
+ if (found) {
+ if (info->nlhdr->nlmsg_flags & NLM_F_EXCL)
+@@ -956,6 +965,11 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk,
+ if (info->nlhdr->nlmsg_flags & NLM_F_REPLACE)
+ return -EOPNOTSUPP;
+
++ if (pctx && pctx_tid)
++ return -EEXIST;
++ if (!pctx)
++ pctx = pctx_tid;
++
+ ipv4_pdp_fill(pctx, info);
+
+ if (pctx->gtp_version == GTP_V0)
+@@ -1079,7 +1093,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
+ goto out_unlock;
+ }
+
+- err = ipv4_pdp_add(gtp, sk, info);
++ err = gtp_pdp_add(gtp, sk, info);
+
+ out_unlock:
+ rcu_read_unlock();
+@@ -1237,43 +1251,46 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb,
+ struct netlink_callback *cb)
+ {
+ struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp;
++ int i, j, bucket = cb->args[0], skip = cb->args[1];
+ struct net *net = sock_net(skb->sk);
+- struct gtp_net *gn = net_generic(net, gtp_net_id);
+- unsigned long tid = cb->args[1];
+- int i, k = cb->args[0], ret;
+ struct pdp_ctx *pctx;
++ struct gtp_net *gn;
++
++ gn = net_generic(net, gtp_net_id);
+
+ if (cb->args[4])
+ return 0;
+
++ rcu_read_lock();
+ list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) {
+ if (last_gtp && last_gtp != gtp)
+ continue;
+ else
+ last_gtp = NULL;
+
+- for (i = k; i < gtp->hash_size; i++) {
+- hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) {
+- if (tid && tid != pctx->u.tid)
+- continue;
+- else
+- tid = 0;
+-
+- ret = gtp_genl_fill_info(skb,
+- NETLINK_CB(cb->skb).portid,
+- cb->nlh->nlmsg_seq,
+- cb->nlh->nlmsg_type, pctx);
+- if (ret < 0) {
++ for (i = bucket; i < gtp->hash_size; i++) {
++ j = 0;
++ hlist_for_each_entry_rcu(pctx, >p->tid_hash[i],
++ hlist_tid) {
++ if (j >= skip &&
++ gtp_genl_fill_info(skb,
++ NETLINK_CB(cb->skb).portid,
++ cb->nlh->nlmsg_seq,
++ cb->nlh->nlmsg_type, pctx)) {
+ cb->args[0] = i;
+- cb->args[1] = pctx->u.tid;
++ cb->args[1] = j;
+ cb->args[2] = (unsigned long)gtp;
+ goto out;
+ }
++ j++;
+ }
++ skip = 0;
+ }
++ bucket = 0;
+ }
+ cb->args[4] = 1;
+ out:
++ rcu_read_unlock();
+ return skb->len;
+ }
+
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 54e63ec04907..8c636c493227 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -654,10 +654,10 @@ static void sixpack_close(struct tty_struct *tty)
+ {
+ struct sixpack *sp;
+
+- write_lock_bh(&disc_data_lock);
++ write_lock_irq(&disc_data_lock);
+ sp = tty->disc_data;
+ tty->disc_data = NULL;
+- write_unlock_bh(&disc_data_lock);
++ write_unlock_irq(&disc_data_lock);
+ if (!sp)
+ return;
+
+diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
+index 13e4c1eff353..3b14e6e281d4 100644
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -783,10 +783,10 @@ static void mkiss_close(struct tty_struct *tty)
+ {
+ struct mkiss *ax;
+
+- write_lock_bh(&disc_data_lock);
++ write_lock_irq(&disc_data_lock);
+ ax = tty->disc_data;
+ tty->disc_data = NULL;
+- write_unlock_bh(&disc_data_lock);
++ write_unlock_irq(&disc_data_lock);
+
+ if (!ax)
+ return;
+diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
+index 0360c015f658..75ae2c508a04 100644
+--- a/drivers/nvdimm/btt.c
++++ b/drivers/nvdimm/btt.c
+@@ -1260,11 +1260,11 @@ static int btt_read_pg(struct btt *btt, struct bio_integrity_payload *bip,
+
+ ret = btt_data_read(arena, page, off, postmap, cur_len);
+ if (ret) {
+- int rc;
+-
+ /* Media error - set the e_flag */
+- rc = btt_map_write(arena, premap, postmap, 0, 1,
+- NVDIMM_IO_ATOMIC);
++ if (btt_map_write(arena, premap, postmap, 0, 1, NVDIMM_IO_ATOMIC))
++ dev_warn_ratelimited(to_dev(arena),
++ "Error persistently tracking bad blocks at %#x\n",
++ premap);
+ goto out_rtt;
+ }
+
+diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c
+index cc860c5f7d26..a306cad70470 100644
+--- a/drivers/pci/hotplug/rpaphp_core.c
++++ b/drivers/pci/hotplug/rpaphp_core.c
+@@ -154,11 +154,11 @@ static enum pci_bus_speed get_max_bus_speed(struct slot *slot)
+ return speed;
+ }
+
+-static int get_children_props(struct device_node *dn, const int **drc_indexes,
+- const int **drc_names, const int **drc_types,
+- const int **drc_power_domains)
++static int get_children_props(struct device_node *dn, const __be32 **drc_indexes,
++ const __be32 **drc_names, const __be32 **drc_types,
++ const __be32 **drc_power_domains)
+ {
+- const int *indexes, *names, *types, *domains;
++ const __be32 *indexes, *names, *types, *domains;
+
+ indexes = of_get_property(dn, "ibm,drc-indexes", NULL);
+ names = of_get_property(dn, "ibm,drc-names", NULL);
+@@ -194,8 +194,8 @@ static int rpaphp_check_drc_props_v1(struct device_node *dn, char *drc_name,
+ char *drc_type, unsigned int my_index)
+ {
+ char *name_tmp, *type_tmp;
+- const int *indexes, *names;
+- const int *types, *domains;
++ const __be32 *indexes, *names;
++ const __be32 *types, *domains;
+ int i, rc;
+
+ rc = get_children_props(dn->parent, &indexes, &names, &types, &domains);
+@@ -208,7 +208,7 @@ static int rpaphp_check_drc_props_v1(struct device_node *dn, char *drc_name,
+
+ /* Iterate through parent properties, looking for my-drc-index */
+ for (i = 0; i < be32_to_cpu(indexes[0]); i++) {
+- if ((unsigned int) indexes[i + 1] == my_index)
++ if (be32_to_cpu(indexes[i + 1]) == my_index)
+ break;
+
+ name_tmp += (strlen(name_tmp) + 1);
+@@ -239,6 +239,8 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,
+ value = of_prop_next_u32(info, NULL, &entries);
+ if (!value)
+ return -EINVAL;
++ else
++ value++;
+
+ for (j = 0; j < entries; j++) {
+ of_read_drc_info_cell(&info, &value, &drc);
+@@ -246,9 +248,10 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,
+ /* Should now know end of current entry */
+
+ /* Found it */
+- if (my_index <= drc.last_drc_index) {
++ if (my_index >= drc.drc_index_start && my_index <= drc.last_drc_index) {
++ int index = my_index - drc.drc_index_start;
+ sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix,
+- my_index);
++ drc.drc_name_suffix_start + index);
+ break;
+ }
+ }
+@@ -265,7 +268,7 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,
+ int rpaphp_check_drc_props(struct device_node *dn, char *drc_name,
+ char *drc_type)
+ {
+- const unsigned int *my_index;
++ const __be32 *my_index;
+
+ my_index = of_get_property(dn, "ibm,my-drc-index", NULL);
+ if (!my_index) {
+@@ -273,12 +276,12 @@ int rpaphp_check_drc_props(struct device_node *dn, char *drc_name,
+ return -EINVAL;
+ }
+
+- if (firmware_has_feature(FW_FEATURE_DRC_INFO))
++ if (of_find_property(dn->parent, "ibm,drc-info", NULL))
+ return rpaphp_check_drc_props_v2(dn, drc_name, drc_type,
+- *my_index);
++ be32_to_cpu(*my_index));
+ else
+ return rpaphp_check_drc_props_v1(dn, drc_name, drc_type,
+- *my_index);
++ be32_to_cpu(*my_index));
+ }
+ EXPORT_SYMBOL_GPL(rpaphp_check_drc_props);
+
+@@ -309,10 +312,11 @@ static int is_php_type(char *drc_type)
+ * for built-in pci slots (even when the built-in slots are
+ * dlparable.)
+ */
+-static int is_php_dn(struct device_node *dn, const int **indexes,
+- const int **names, const int **types, const int **power_domains)
++static int is_php_dn(struct device_node *dn, const __be32 **indexes,
++ const __be32 **names, const __be32 **types,
++ const __be32 **power_domains)
+ {
+- const int *drc_types;
++ const __be32 *drc_types;
+ int rc;
+
+ rc = get_children_props(dn, indexes, names, &drc_types, power_domains);
+@@ -347,7 +351,7 @@ int rpaphp_add_slot(struct device_node *dn)
+ struct slot *slot;
+ int retval = 0;
+ int i;
+- const int *indexes, *names, *types, *power_domains;
++ const __be32 *indexes, *names, *types, *power_domains;
+ char *name, *type;
+
+ if (!dn->name || strcmp(dn->name, "pci"))
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index f38d596efa05..021e28ff1194 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -196,7 +196,6 @@ struct byt_gpio {
+ struct platform_device *pdev;
+ struct pinctrl_dev *pctl_dev;
+ struct pinctrl_desc pctl_desc;
+- raw_spinlock_t lock;
+ const struct byt_pinctrl_soc_data *soc_data;
+ struct byt_community *communities_copy;
+ struct byt_gpio_pin_context *saved_context;
+@@ -707,6 +706,8 @@ static const struct byt_pinctrl_soc_data *byt_soc_data[] = {
+ NULL,
+ };
+
++static DEFINE_RAW_SPINLOCK(byt_lock);
++
+ static struct byt_community *byt_get_community(struct byt_gpio *vg,
+ unsigned int pin)
+ {
+@@ -848,7 +849,7 @@ static void byt_set_group_simple_mux(struct byt_gpio *vg,
+ unsigned long flags;
+ int i;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+
+ for (i = 0; i < group.npins; i++) {
+ void __iomem *padcfg0;
+@@ -868,7 +869,7 @@ static void byt_set_group_simple_mux(struct byt_gpio *vg,
+ writel(value, padcfg0);
+ }
+
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ }
+
+ static void byt_set_group_mixed_mux(struct byt_gpio *vg,
+@@ -878,7 +879,7 @@ static void byt_set_group_mixed_mux(struct byt_gpio *vg,
+ unsigned long flags;
+ int i;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+
+ for (i = 0; i < group.npins; i++) {
+ void __iomem *padcfg0;
+@@ -898,7 +899,7 @@ static void byt_set_group_mixed_mux(struct byt_gpio *vg,
+ writel(value, padcfg0);
+ }
+
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ }
+
+ static int byt_set_mux(struct pinctrl_dev *pctldev, unsigned int func_selector,
+@@ -947,11 +948,11 @@ static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned int offset)
+ unsigned long flags;
+ u32 value;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+ value = readl(reg);
+ value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
+ writel(value, reg);
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ }
+
+ static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev,
+@@ -963,7 +964,7 @@ static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev,
+ u32 value, gpio_mux;
+ unsigned long flags;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+
+ /*
+ * In most cases, func pin mux 000 means GPIO function.
+@@ -985,7 +986,7 @@ static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev,
+ "pin %u forcibly re-configured as GPIO\n", offset);
+ }
+
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+
+ pm_runtime_get(&vg->pdev->dev);
+
+@@ -1013,7 +1014,7 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev,
+ unsigned long flags;
+ u32 value;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+
+ value = readl(val_reg);
+ value &= ~BYT_DIR_MASK;
+@@ -1030,7 +1031,7 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev,
+ "Potential Error: Setting GPIO with direct_irq_en to output");
+ writel(value, val_reg);
+
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+
+ return 0;
+ }
+@@ -1099,11 +1100,11 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset,
+ u32 conf, pull, val, debounce;
+ u16 arg = 0;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+ conf = readl(conf_reg);
+ pull = conf & BYT_PULL_ASSIGN_MASK;
+ val = readl(val_reg);
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+
+ switch (param) {
+ case PIN_CONFIG_BIAS_DISABLE:
+@@ -1130,9 +1131,9 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset,
+ if (!(conf & BYT_DEBOUNCE_EN))
+ return -EINVAL;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+ debounce = readl(db_reg);
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+
+ switch (debounce & BYT_DEBOUNCE_PULSE_MASK) {
+ case BYT_DEBOUNCE_PULSE_375US:
+@@ -1184,7 +1185,7 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
+ u32 conf, val, debounce;
+ int i, ret = 0;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+
+ conf = readl(conf_reg);
+ val = readl(val_reg);
+@@ -1292,7 +1293,7 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
+ if (!ret)
+ writel(conf, conf_reg);
+
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+
+ return ret;
+ }
+@@ -1317,9 +1318,9 @@ static int byt_gpio_get(struct gpio_chip *chip, unsigned offset)
+ unsigned long flags;
+ u32 val;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+ val = readl(reg);
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+
+ return !!(val & BYT_LEVEL);
+ }
+@@ -1334,13 +1335,13 @@ static void byt_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
+ if (!reg)
+ return;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+ old_val = readl(reg);
+ if (value)
+ writel(old_val | BYT_LEVEL, reg);
+ else
+ writel(old_val & ~BYT_LEVEL, reg);
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ }
+
+ static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+@@ -1353,9 +1354,9 @@ static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+ if (!reg)
+ return -EINVAL;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+ value = readl(reg);
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+
+ if (!(value & BYT_OUTPUT_EN))
+ return GPIOF_DIR_OUT;
+@@ -1398,14 +1399,14 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
+ const char *label;
+ unsigned int pin;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+ pin = vg->soc_data->pins[i].number;
+ reg = byt_gpio_reg(vg, pin, BYT_CONF0_REG);
+ if (!reg) {
+ seq_printf(s,
+ "Could not retrieve pin %i conf0 reg\n",
+ pin);
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ continue;
+ }
+ conf0 = readl(reg);
+@@ -1414,11 +1415,11 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
+ if (!reg) {
+ seq_printf(s,
+ "Could not retrieve pin %i val reg\n", pin);
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ continue;
+ }
+ val = readl(reg);
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+
+ comm = byt_get_community(vg, pin);
+ if (!comm) {
+@@ -1502,9 +1503,9 @@ static void byt_irq_ack(struct irq_data *d)
+ if (!reg)
+ return;
+
+- raw_spin_lock(&vg->lock);
++ raw_spin_lock(&byt_lock);
+ writel(BIT(offset % 32), reg);
+- raw_spin_unlock(&vg->lock);
++ raw_spin_unlock(&byt_lock);
+ }
+
+ static void byt_irq_mask(struct irq_data *d)
+@@ -1528,7 +1529,7 @@ static void byt_irq_unmask(struct irq_data *d)
+ if (!reg)
+ return;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+ value = readl(reg);
+
+ switch (irqd_get_trigger_type(d)) {
+@@ -1551,7 +1552,7 @@ static void byt_irq_unmask(struct irq_data *d)
+
+ writel(value, reg);
+
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ }
+
+ static int byt_irq_type(struct irq_data *d, unsigned int type)
+@@ -1565,7 +1566,7 @@ static int byt_irq_type(struct irq_data *d, unsigned int type)
+ if (!reg || offset >= vg->chip.ngpio)
+ return -EINVAL;
+
+- raw_spin_lock_irqsave(&vg->lock, flags);
++ raw_spin_lock_irqsave(&byt_lock, flags);
+ value = readl(reg);
+
+ WARN(value & BYT_DIRECT_IRQ_EN,
+@@ -1587,7 +1588,7 @@ static int byt_irq_type(struct irq_data *d, unsigned int type)
+ else if (type & IRQ_TYPE_LEVEL_MASK)
+ irq_set_handler_locked(d, handle_level_irq);
+
+- raw_spin_unlock_irqrestore(&vg->lock, flags);
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+
+ return 0;
+ }
+@@ -1623,9 +1624,9 @@ static void byt_gpio_irq_handler(struct irq_desc *desc)
+ continue;
+ }
+
+- raw_spin_lock(&vg->lock);
++ raw_spin_lock(&byt_lock);
+ pending = readl(reg);
+- raw_spin_unlock(&vg->lock);
++ raw_spin_unlock(&byt_lock);
+ for_each_set_bit(pin, &pending, 32) {
+ virq = irq_find_mapping(vg->chip.irq.domain, base + pin);
+ generic_handle_irq(virq);
+@@ -1828,8 +1829,6 @@ static int byt_pinctrl_probe(struct platform_device *pdev)
+ return PTR_ERR(vg->pctl_dev);
+ }
+
+- raw_spin_lock_init(&vg->lock);
+-
+ ret = byt_gpio_probe(vg);
+ if (ret)
+ return ret;
+@@ -1845,8 +1844,11 @@ static int byt_gpio_suspend(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct byt_gpio *vg = platform_get_drvdata(pdev);
++ unsigned long flags;
+ int i;
+
++ raw_spin_lock_irqsave(&byt_lock, flags);
++
+ for (i = 0; i < vg->soc_data->npins; i++) {
+ void __iomem *reg;
+ u32 value;
+@@ -1867,6 +1869,7 @@ static int byt_gpio_suspend(struct device *dev)
+ vg->saved_context[i].val = value;
+ }
+
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ return 0;
+ }
+
+@@ -1874,8 +1877,11 @@ static int byt_gpio_resume(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct byt_gpio *vg = platform_get_drvdata(pdev);
++ unsigned long flags;
+ int i;
+
++ raw_spin_lock_irqsave(&byt_lock, flags);
++
+ for (i = 0; i < vg->soc_data->npins; i++) {
+ void __iomem *reg;
+ u32 value;
+@@ -1913,6 +1919,7 @@ static int byt_gpio_resume(struct device *dev)
+ }
+ }
+
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ return 0;
+ }
+ #endif
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index c64903a5978f..b818f65480c1 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -175,9 +175,9 @@ static struct posix_clock_operations ptp_clock_ops = {
+ .read = ptp_read,
+ };
+
+-static void delete_ptp_clock(struct posix_clock *pc)
++static void ptp_clock_release(struct device *dev)
+ {
+- struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock);
++ struct ptp_clock *ptp = container_of(dev, struct ptp_clock, dev);
+
+ mutex_destroy(&ptp->tsevq_mux);
+ mutex_destroy(&ptp->pincfg_mux);
+@@ -222,7 +222,6 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
+ }
+
+ ptp->clock.ops = ptp_clock_ops;
+- ptp->clock.release = delete_ptp_clock;
+ ptp->info = info;
+ ptp->devid = MKDEV(major, index);
+ ptp->index = index;
+@@ -249,15 +248,6 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
+ if (err)
+ goto no_pin_groups;
+
+- /* Create a new device in our class. */
+- ptp->dev = device_create_with_groups(ptp_class, parent, ptp->devid,
+- ptp, ptp->pin_attr_groups,
+- "ptp%d", ptp->index);
+- if (IS_ERR(ptp->dev)) {
+- err = PTR_ERR(ptp->dev);
+- goto no_device;
+- }
+-
+ /* Register a new PPS source. */
+ if (info->pps) {
+ struct pps_source_info pps;
+@@ -273,8 +263,18 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
+ }
+ }
+
+- /* Create a posix clock. */
+- err = posix_clock_register(&ptp->clock, ptp->devid);
++ /* Initialize a new device of our class in our clock structure. */
++ device_initialize(&ptp->dev);
++ ptp->dev.devt = ptp->devid;
++ ptp->dev.class = ptp_class;
++ ptp->dev.parent = parent;
++ ptp->dev.groups = ptp->pin_attr_groups;
++ ptp->dev.release = ptp_clock_release;
++ dev_set_drvdata(&ptp->dev, ptp);
++ dev_set_name(&ptp->dev, "ptp%d", ptp->index);
++
++ /* Create a posix clock and link it to the device. */
++ err = posix_clock_register(&ptp->clock, &ptp->dev);
+ if (err) {
+ pr_err("failed to create posix clock\n");
+ goto no_clock;
+@@ -286,8 +286,6 @@ no_clock:
+ if (ptp->pps_source)
+ pps_unregister_source(ptp->pps_source);
+ no_pps:
+- device_destroy(ptp_class, ptp->devid);
+-no_device:
+ ptp_cleanup_pin_groups(ptp);
+ no_pin_groups:
+ if (ptp->kworker)
+@@ -317,7 +315,6 @@ int ptp_clock_unregister(struct ptp_clock *ptp)
+ if (ptp->pps_source)
+ pps_unregister_source(ptp->pps_source);
+
+- device_destroy(ptp_class, ptp->devid);
+ ptp_cleanup_pin_groups(ptp);
+
+ posix_clock_unregister(&ptp->clock);
+diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
+index c7c62b782cb9..05f6b6a9bbd5 100644
+--- a/drivers/ptp/ptp_private.h
++++ b/drivers/ptp/ptp_private.h
+@@ -41,7 +41,7 @@ struct timestamp_event_queue {
+
+ struct ptp_clock {
+ struct posix_clock clock;
+- struct device *dev;
++ struct device dev;
+ struct ptp_clock_info *info;
+ dev_t devid;
+ int index; /* index into clocks.map */
+diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h
+index 2e1a27bd97d1..2126f4cc6d37 100644
+--- a/drivers/s390/crypto/zcrypt_error.h
++++ b/drivers/s390/crypto/zcrypt_error.h
+@@ -62,6 +62,7 @@ struct error_hdr {
+ #define REP82_ERROR_EVEN_MOD_IN_OPND 0x85
+ #define REP82_ERROR_RESERVED_FIELD 0x88
+ #define REP82_ERROR_INVALID_DOMAIN_PENDING 0x8A
++#define REP82_ERROR_FILTERED_BY_HYPERVISOR 0x8B
+ #define REP82_ERROR_TRANSPORT_FAIL 0x90
+ #define REP82_ERROR_PACKET_TRUNCATED 0xA0
+ #define REP82_ERROR_ZERO_BUFFER_LEN 0xB0
+@@ -92,6 +93,7 @@ static inline int convert_error(struct zcrypt_queue *zq,
+ case REP82_ERROR_INVALID_DOMAIN_PRECHECK:
+ case REP82_ERROR_INVALID_DOMAIN_PENDING:
+ case REP82_ERROR_INVALID_SPECIAL_CMD:
++ case REP82_ERROR_FILTERED_BY_HYPERVISOR:
+ // REP88_ERROR_INVALID_KEY // '82' CEX2A
+ // REP88_ERROR_OPERAND // '84' CEX2A
+ // REP88_ERROR_OPERAND_EVEN_MOD // '85' CEX2A
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 8ec68dcc0cc4..95a3e3bf2b43 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -129,6 +129,9 @@
+ #define NCR5380_release_dma_irq(x)
+ #endif
+
++static unsigned int disconnect_mask = ~0;
++module_param(disconnect_mask, int, 0444);
++
+ static int do_abort(struct Scsi_Host *);
+ static void do_reset(struct Scsi_Host *);
+ static void bus_reset_cleanup(struct Scsi_Host *);
+@@ -946,7 +949,8 @@ static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)
+ int err;
+ bool ret = true;
+ bool can_disconnect = instance->irq != NO_IRQ &&
+- cmd->cmnd[0] != REQUEST_SENSE;
++ cmd->cmnd[0] != REQUEST_SENSE &&
++ (disconnect_mask & BIT(scmd_id(cmd)));
+
+ NCR5380_dprint(NDEBUG_ARBITRATION, instance);
+ dsprintk(NDEBUG_ARBITRATION, instance, "starting arbitration, id = %d\n",
+diff --git a/drivers/scsi/atari_scsi.c b/drivers/scsi/atari_scsi.c
+index 89f5154c40b6..764c46d7333e 100644
+--- a/drivers/scsi/atari_scsi.c
++++ b/drivers/scsi/atari_scsi.c
+@@ -742,7 +742,7 @@ static int __init atari_scsi_probe(struct platform_device *pdev)
+ atari_scsi_template.sg_tablesize = SG_ALL;
+ } else {
+ atari_scsi_template.can_queue = 1;
+- atari_scsi_template.sg_tablesize = SG_NONE;
++ atari_scsi_template.sg_tablesize = 1;
+ }
+
+ if (setup_can_queue > 0)
+@@ -751,8 +751,8 @@ static int __init atari_scsi_probe(struct platform_device *pdev)
+ if (setup_cmd_per_lun > 0)
+ atari_scsi_template.cmd_per_lun = setup_cmd_per_lun;
+
+- /* Leave sg_tablesize at 0 on a Falcon! */
+- if (ATARIHW_PRESENT(TT_SCSI) && setup_sg_tablesize >= 0)
++ /* Don't increase sg_tablesize on Falcon! */
++ if (ATARIHW_PRESENT(TT_SCSI) && setup_sg_tablesize > 0)
+ atari_scsi_template.sg_tablesize = setup_sg_tablesize;
+
+ if (setup_hostid >= 0) {
+diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c
+index cc5611efc7a9..a8e29e3d3572 100644
+--- a/drivers/scsi/csiostor/csio_lnode.c
++++ b/drivers/scsi/csiostor/csio_lnode.c
+@@ -301,6 +301,7 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ struct fc_fdmi_port_name *port_name;
+ uint8_t buf[64];
+ uint8_t *fc4_type;
++ unsigned long flags;
+
+ if (fdmi_req->wr_status != FW_SUCCESS) {
+ csio_ln_dbg(ln, "WR error:%x in processing fdmi rhba cmd\n",
+@@ -385,13 +386,13 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ len = (uint32_t)(pld - (uint8_t *)cmd);
+
+ /* Submit FDMI RPA request */
+- spin_lock_irq(&hw->lock);
++ spin_lock_irqsave(&hw->lock, flags);
+ if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_done,
+ FCOE_CT, &fdmi_req->dma_buf, len)) {
+ CSIO_INC_STATS(ln, n_fdmi_err);
+ csio_ln_dbg(ln, "Failed to issue fdmi rpa req\n");
+ }
+- spin_unlock_irq(&hw->lock);
++ spin_unlock_irqrestore(&hw->lock, flags);
+ }
+
+ /*
+@@ -412,6 +413,7 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ struct fc_fdmi_rpl *reg_pl;
+ struct fs_fdmi_attrs *attrib_blk;
+ uint8_t buf[64];
++ unsigned long flags;
+
+ if (fdmi_req->wr_status != FW_SUCCESS) {
+ csio_ln_dbg(ln, "WR error:%x in processing fdmi dprt cmd\n",
+@@ -491,13 +493,13 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ attrib_blk->numattrs = htonl(numattrs);
+
+ /* Submit FDMI RHBA request */
+- spin_lock_irq(&hw->lock);
++ spin_lock_irqsave(&hw->lock, flags);
+ if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_rhba_cbfn,
+ FCOE_CT, &fdmi_req->dma_buf, len)) {
+ CSIO_INC_STATS(ln, n_fdmi_err);
+ csio_ln_dbg(ln, "Failed to issue fdmi rhba req\n");
+ }
+- spin_unlock_irq(&hw->lock);
++ spin_unlock_irqrestore(&hw->lock, flags);
+ }
+
+ /*
+@@ -512,6 +514,7 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ void *cmd;
+ struct fc_fdmi_port_name *port_name;
+ uint32_t len;
++ unsigned long flags;
+
+ if (fdmi_req->wr_status != FW_SUCCESS) {
+ csio_ln_dbg(ln, "WR error:%x in processing fdmi dhba cmd\n",
+@@ -542,13 +545,13 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ len += sizeof(*port_name);
+
+ /* Submit FDMI request */
+- spin_lock_irq(&hw->lock);
++ spin_lock_irqsave(&hw->lock, flags);
+ if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_dprt_cbfn,
+ FCOE_CT, &fdmi_req->dma_buf, len)) {
+ CSIO_INC_STATS(ln, n_fdmi_err);
+ csio_ln_dbg(ln, "Failed to issue fdmi dprt req\n");
+ }
+- spin_unlock_irq(&hw->lock);
++ spin_unlock_irqrestore(&hw->lock, flags);
+ }
+
+ /**
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
+index f35c56217694..33191673249c 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -485,7 +485,13 @@ static int hisi_sas_task_exec(struct sas_task *task, gfp_t gfp_flags,
+ struct hisi_sas_dq *dq = NULL;
+
+ if (unlikely(test_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags))) {
+- if (in_softirq())
++ /*
++ * For IOs from upper layer, it may already disable preempt
++ * in the IO path, if disable preempt again in down(),
++ * function schedule() will report schedule_bug(), so check
++ * preemptible() before goto down().
++ */
++ if (!preemptible())
+ return -EINVAL;
+
+ down(&hisi_hba->sem);
+diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
+index 23354f206533..55181d28291e 100644
+--- a/drivers/scsi/iscsi_tcp.c
++++ b/drivers/scsi/iscsi_tcp.c
+@@ -374,8 +374,16 @@ static int iscsi_sw_tcp_pdu_xmit(struct iscsi_task *task)
+ {
+ struct iscsi_conn *conn = task->conn;
+ unsigned int noreclaim_flag;
++ struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
++ struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data;
+ int rc = 0;
+
++ if (!tcp_sw_conn->sock) {
++ iscsi_conn_printk(KERN_ERR, conn,
++ "Transport not bound to socket!\n");
++ return -EINVAL;
++ }
++
+ noreclaim_flag = memalloc_noreclaim_save();
+
+ while (iscsi_sw_tcp_xmit_qlen(conn)) {
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 4f4d1b3b3bbc..7398350b08b4 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -4110,7 +4110,7 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ mempool_free(mbox, phba->mbox_mem_pool);
+ }
+ out:
+- if (ndlp && NLP_CHK_NODE_ACT(ndlp)) {
++ if (ndlp && NLP_CHK_NODE_ACT(ndlp) && shost) {
+ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI);
+ spin_unlock_irq(shost->host_lock);
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index b36b3da323a0..5d657178c2b9 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -5231,9 +5231,14 @@ lpfc_setup_disc_node(struct lpfc_vport *vport, uint32_t did)
+ /* If we've already received a PLOGI from this NPort
+ * we don't need to try to discover it again.
+ */
+- if (ndlp->nlp_flag & NLP_RCV_PLOGI)
++ if (ndlp->nlp_flag & NLP_RCV_PLOGI &&
++ !(ndlp->nlp_type &
++ (NLP_FCP_TARGET | NLP_NVME_TARGET)))
+ return NULL;
+
++ ndlp->nlp_prev_state = ndlp->nlp_state;
++ lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE);
++
+ spin_lock_irq(shost->host_lock);
+ ndlp->nlp_flag |= NLP_NPR_2B_DISC;
+ spin_unlock_irq(shost->host_lock);
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index bd8dc6a2243c..3dfed191252c 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -483,8 +483,10 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ * single discovery thread, this will cause a huge delay in
+ * discovery. Also this will cause multiple state machines
+ * running in parallel for this node.
++ * This only applies to a fabric environment.
+ */
+- if (ndlp->nlp_state == NLP_STE_PLOGI_ISSUE) {
++ if ((ndlp->nlp_state == NLP_STE_PLOGI_ISSUE) &&
++ (vport->fc_flag & FC_FABRIC)) {
+ /* software abort outstanding PLOGI */
+ lpfc_els_abort(phba, ndlp);
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index f459fd62e493..a801917d3c19 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -12928,13 +12928,19 @@ send_current_mbox:
+ phba->sli.sli_flag &= ~LPFC_SLI_MBOX_ACTIVE;
+ /* Setting active mailbox pointer need to be in sync to flag clear */
+ phba->sli.mbox_active = NULL;
++ if (bf_get(lpfc_trailer_consumed, mcqe))
++ lpfc_sli4_mq_release(phba->sli4_hba.mbx_wq);
+ spin_unlock_irqrestore(&phba->hbalock, iflags);
+ /* Wake up worker thread to post the next pending mailbox command */
+ lpfc_worker_wake_up(phba);
++ return workposted;
++
+ out_no_mqe_complete:
++ spin_lock_irqsave(&phba->hbalock, iflags);
+ if (bf_get(lpfc_trailer_consumed, mcqe))
+ lpfc_sli4_mq_release(phba->sli4_hba.mbx_wq);
+- return workposted;
++ spin_unlock_irqrestore(&phba->hbalock, iflags);
++ return false;
+ }
+
+ /**
+@@ -17861,6 +17867,13 @@ lpfc_sli4_alloc_rpi(struct lpfc_hba *phba)
+ static void
+ __lpfc_sli4_free_rpi(struct lpfc_hba *phba, int rpi)
+ {
++ /*
++ * if the rpi value indicates a prior unreg has already
++ * been done, skip the unreg.
++ */
++ if (rpi == LPFC_RPI_ALLOC_ERROR)
++ return;
++
+ if (test_and_clear_bit(rpi, phba->sli4_hba.rpi_bmask)) {
+ phba->sli4_hba.rpi_count--;
+ phba->sli4_hba.max_cfg_param.rpi_used--;
+diff --git a/drivers/scsi/mac_scsi.c b/drivers/scsi/mac_scsi.c
+index 643321fc152d..b5050c2ede00 100644
+--- a/drivers/scsi/mac_scsi.c
++++ b/drivers/scsi/mac_scsi.c
+@@ -429,7 +429,7 @@ static int __init mac_scsi_probe(struct platform_device *pdev)
+ mac_scsi_template.can_queue = setup_can_queue;
+ if (setup_cmd_per_lun > 0)
+ mac_scsi_template.cmd_per_lun = setup_cmd_per_lun;
+- if (setup_sg_tablesize >= 0)
++ if (setup_sg_tablesize > 0)
+ mac_scsi_template.sg_tablesize = setup_sg_tablesize;
+ if (setup_hostid >= 0)
+ mac_scsi_template.this_id = setup_hostid & 7;
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
+index 5e8c059ce2c9..07345016fd9c 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
+@@ -1597,7 +1597,8 @@ _ctl_diag_register_2(struct MPT3SAS_ADAPTER *ioc,
+ " for diag buffers, requested size(%d)\n",
+ ioc->name, __func__, request_data_sz);
+ mpt3sas_base_free_smid(ioc, smid);
+- return -ENOMEM;
++ rc = -ENOMEM;
++ goto out;
+ }
+ ioc->diag_buffer[buffer_type] = request_data;
+ ioc->diag_buffer_sz[buffer_type] = request_data_sz;
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 5021aed87f33..8627feb80261 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -2382,6 +2382,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ pm8001_printk("task 0x%p done with io_status 0x%x"
+ " resp 0x%x stat 0x%x but aborted by upper layer!\n",
+ t, status, ts->resp, ts->stat));
++ if (t->slow_task)
++ complete(&t->slow_task->completion);
+ pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+ } else {
+ spin_unlock_irqrestore(&t->task_state_lock, flags);
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index 65305b3848bc..a1dbae806fde 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -5351,6 +5351,11 @@ static int __init scsi_debug_init(void)
+ return -EINVAL;
+ }
+
++ if (sdebug_num_tgts < 0) {
++ pr_err("num_tgts must be >= 0\n");
++ return -EINVAL;
++ }
++
+ if (sdebug_guard > 1) {
+ pr_err("guard must be 0 or 1\n");
+ return -EINVAL;
+diff --git a/drivers/scsi/scsi_trace.c b/drivers/scsi/scsi_trace.c
+index 0ff083bbf5b1..617a60737590 100644
+--- a/drivers/scsi/scsi_trace.c
++++ b/drivers/scsi/scsi_trace.c
+@@ -30,15 +30,18 @@ static const char *
+ scsi_trace_rw6(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p);
+- sector_t lba = 0, txlen = 0;
++ u32 lba = 0, txlen;
+
+ lba |= ((cdb[1] & 0x1F) << 16);
+ lba |= (cdb[2] << 8);
+ lba |= cdb[3];
+- txlen = cdb[4];
++ /*
++ * From SBC-2: a TRANSFER LENGTH field set to zero specifies that 256
++ * logical blocks shall be read (READ(6)) or written (WRITE(6)).
++ */
++ txlen = cdb[4] ? cdb[4] : 256;
+
+- trace_seq_printf(p, "lba=%llu txlen=%llu",
+- (unsigned long long)lba, (unsigned long long)txlen);
++ trace_seq_printf(p, "lba=%u txlen=%u", lba, txlen);
+ trace_seq_putc(p, 0);
+
+ return ret;
+diff --git a/drivers/scsi/sun3_scsi.c b/drivers/scsi/sun3_scsi.c
+index 9492638296c8..af8a7ef9c858 100644
+--- a/drivers/scsi/sun3_scsi.c
++++ b/drivers/scsi/sun3_scsi.c
+@@ -498,7 +498,7 @@ static struct scsi_host_template sun3_scsi_template = {
+ .eh_host_reset_handler = sun3scsi_host_reset,
+ .can_queue = 16,
+ .this_id = 7,
+- .sg_tablesize = SG_NONE,
++ .sg_tablesize = 1,
+ .cmd_per_lun = 2,
+ .use_clustering = DISABLE_CLUSTERING,
+ .cmd_size = NCR5380_CMD_SIZE,
+@@ -520,7 +520,7 @@ static int __init sun3_scsi_probe(struct platform_device *pdev)
+ sun3_scsi_template.can_queue = setup_can_queue;
+ if (setup_cmd_per_lun > 0)
+ sun3_scsi_template.cmd_per_lun = setup_cmd_per_lun;
+- if (setup_sg_tablesize >= 0)
++ if (setup_sg_tablesize > 0)
+ sun3_scsi_template.sg_tablesize = setup_sg_tablesize;
+ if (setup_hostid >= 0)
+ sun3_scsi_template.this_id = setup_hostid & 7;
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 8bce755e0f5b..3601e770da16 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -3011,10 +3011,10 @@ static int __ufshcd_query_descriptor(struct ufs_hba *hba,
+ goto out_unlock;
+ }
+
+- hba->dev_cmd.query.descriptor = NULL;
+ *buf_len = be16_to_cpu(response->upiu_res.length);
+
+ out_unlock:
++ hba->dev_cmd.query.descriptor = NULL;
+ mutex_unlock(&hba->dev_cmd.lock);
+ out:
+ ufshcd_release(hba);
+@@ -3875,15 +3875,24 @@ static int __ufshcd_uic_hibern8_enter(struct ufs_hba *hba)
+ ktime_to_us(ktime_sub(ktime_get(), start)), ret);
+
+ if (ret) {
++ int err;
++
+ dev_err(hba->dev, "%s: hibern8 enter failed. ret = %d\n",
+ __func__, ret);
+
+ /*
+- * If link recovery fails then return error so that caller
+- * don't retry the hibern8 enter again.
++ * If link recovery fails then return error code returned from
++ * ufshcd_link_recovery().
++ * If link recovery succeeds then return -EAGAIN to attempt
++ * hibern8 enter retry again.
+ */
+- if (ufshcd_link_recovery(hba))
+- ret = -ENOLINK;
++ err = ufshcd_link_recovery(hba);
++ if (err) {
++ dev_err(hba->dev, "%s: link recovery failed", __func__);
++ ret = err;
++ } else {
++ ret = -EAGAIN;
++ }
+ } else
+ ufshcd_vops_hibern8_notify(hba, UIC_CMD_DME_HIBER_ENTER,
+ POST_CHANGE);
+@@ -3897,7 +3906,7 @@ static int ufshcd_uic_hibern8_enter(struct ufs_hba *hba)
+
+ for (retries = UIC_HIBERN8_ENTER_RETRIES; retries > 0; retries--) {
+ ret = __ufshcd_uic_hibern8_enter(hba);
+- if (!ret || ret == -ENOLINK)
++ if (!ret)
+ goto out;
+ }
+ out:
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 8f2e97857e8b..8b79e36fab21 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -832,9 +832,9 @@ static int of_fsl_spi_probe(struct platform_device *ofdev)
+ if (ret)
+ goto err;
+
+- irq = irq_of_parse_and_map(np, 0);
+- if (!irq) {
+- ret = -EINVAL;
++ irq = platform_get_irq(ofdev, 0);
++ if (irq < 0) {
++ ret = irq;
+ goto err;
+ }
+
+@@ -847,7 +847,6 @@ static int of_fsl_spi_probe(struct platform_device *ofdev)
+ return 0;
+
+ err:
+- irq_dispose_mapping(irq);
+ if (type == TYPE_FSL)
+ of_fsl_spi_free_chipselects(dev);
+ return ret;
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 03e9cb156df9..317d0f3f7a14 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1157,7 +1157,9 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ hdr->cmdsn, be32_to_cpu(hdr->data_length), payload_length,
+ conn->cid);
+
+- target_get_sess_cmd(&cmd->se_cmd, true);
++ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0)
++ return iscsit_add_reject_cmd(cmd,
++ ISCSI_REASON_WAITING_FOR_LOGOUT, buf);
+
+ cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd,
+ scsilun_to_int(&hdr->lun));
+@@ -1998,7 +2000,9 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ conn->sess->se_sess, 0, DMA_NONE,
+ TCM_SIMPLE_TAG, cmd->sense_buffer + 2);
+
+- target_get_sess_cmd(&cmd->se_cmd, true);
++ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0)
++ return iscsit_add_reject_cmd(cmd,
++ ISCSI_REASON_WAITING_FOR_LOGOUT, buf);
+
+ /*
+ * TASK_REASSIGN for ERL=2 / connection stays inside of
+@@ -4204,6 +4208,8 @@ int iscsit_close_connection(
+ * must wait until they have completed.
+ */
+ iscsit_check_conn_usage_count(conn);
++ target_sess_cmd_list_set_waiting(sess->se_sess);
++ target_wait_for_sess_cmds(sess->se_sess);
+
+ ahash_request_free(conn->conn_tx_hash);
+ if (conn->conn_rx_hash) {
+diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
+index e2fa3a3bc81d..b6bf605fa5c1 100644
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -78,7 +78,7 @@ static int chap_check_algorithm(const char *a_str)
+ if (!token)
+ goto out;
+
+- if (!strncmp(token, "5", 1)) {
++ if (!strcmp(token, "5")) {
+ pr_debug("Selected MD5 Algorithm\n");
+ kfree(orig);
+ return CHAP_DIGEST_MD5;
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index dd8949e8fcd7..f34520e9ad6e 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -2154,27 +2154,6 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
+ mode |= ATMEL_US_USMODE_NORMAL;
+ }
+
+- /* set the mode, clock divisor, parity, stop bits and data size */
+- atmel_uart_writel(port, ATMEL_US_MR, mode);
+-
+- /*
+- * when switching the mode, set the RTS line state according to the
+- * new mode, otherwise keep the former state
+- */
+- if ((old_mode & ATMEL_US_USMODE) != (mode & ATMEL_US_USMODE)) {
+- unsigned int rts_state;
+-
+- if ((mode & ATMEL_US_USMODE) == ATMEL_US_USMODE_HWHS) {
+- /* let the hardware control the RTS line */
+- rts_state = ATMEL_US_RTSDIS;
+- } else {
+- /* force RTS line to low level */
+- rts_state = ATMEL_US_RTSEN;
+- }
+-
+- atmel_uart_writel(port, ATMEL_US_CR, rts_state);
+- }
+-
+ /*
+ * Set the baud rate:
+ * Fractional baudrate allows to setup output frequency more
+@@ -2200,6 +2179,28 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
+ quot = cd | fp << ATMEL_US_FP_OFFSET;
+
+ atmel_uart_writel(port, ATMEL_US_BRGR, quot);
++
++ /* set the mode, clock divisor, parity, stop bits and data size */
++ atmel_uart_writel(port, ATMEL_US_MR, mode);
++
++ /*
++ * when switching the mode, set the RTS line state according to the
++ * new mode, otherwise keep the former state
++ */
++ if ((old_mode & ATMEL_US_USMODE) != (mode & ATMEL_US_USMODE)) {
++ unsigned int rts_state;
++
++ if ((mode & ATMEL_US_USMODE) == ATMEL_US_USMODE_HWHS) {
++ /* let the hardware control the RTS line */
++ rts_state = ATMEL_US_RTSDIS;
++ } else {
++ /* force RTS line to low level */
++ rts_state = ATMEL_US_RTSEN;
++ }
++
++ atmel_uart_writel(port, ATMEL_US_CR, rts_state);
++ }
++
+ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA | ATMEL_US_RSTRX);
+ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN | ATMEL_US_RXEN);
+ atmel_port->tx_stopped = false;
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 8dcee4faf701..5f5c5de31f10 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -436,7 +436,9 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
+ virtio_transport_deliver_tap_pkt(pkt);
+
+ /* Only accept correctly addressed packets */
+- if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid)
++ if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid &&
++ le64_to_cpu(pkt->hdr.dst_cid) ==
++ vhost_transport_get_local_cid())
+ virtio_transport_recv_pkt(pkt);
+ else
+ virtio_transport_free_pkt(pkt);
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index f6c24b22b37c..4b89333e8eb4 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -38,7 +38,6 @@
+ #include <linux/init.h> /* For __init/__exit/... */
+ #include <linux/hrtimer.h> /* For hrtimers */
+ #include <linux/kernel.h> /* For printk/panic/... */
+-#include <linux/kref.h> /* For data references */
+ #include <linux/kthread.h> /* For kthread_work */
+ #include <linux/miscdevice.h> /* For handling misc devices */
+ #include <linux/module.h> /* For module stuff/... */
+@@ -56,14 +55,14 @@
+
+ /*
+ * struct watchdog_core_data - watchdog core internal data
+- * @kref: Reference count.
++ * @dev: The watchdog's internal device
+ * @cdev: The watchdog's Character device.
+ * @wdd: Pointer to watchdog device.
+ * @lock: Lock for watchdog core.
+ * @status: Watchdog core internal status bits.
+ */
+ struct watchdog_core_data {
+- struct kref kref;
++ struct device dev;
+ struct cdev cdev;
+ struct watchdog_device *wdd;
+ struct mutex lock;
+@@ -822,7 +821,7 @@ static int watchdog_open(struct inode *inode, struct file *file)
+ file->private_data = wd_data;
+
+ if (!hw_running)
+- kref_get(&wd_data->kref);
++ get_device(&wd_data->dev);
+
+ /* dev/watchdog is a virtual (and thus non-seekable) filesystem */
+ return nonseekable_open(inode, file);
+@@ -834,11 +833,11 @@ out_clear:
+ return err;
+ }
+
+-static void watchdog_core_data_release(struct kref *kref)
++static void watchdog_core_data_release(struct device *dev)
+ {
+ struct watchdog_core_data *wd_data;
+
+- wd_data = container_of(kref, struct watchdog_core_data, kref);
++ wd_data = container_of(dev, struct watchdog_core_data, dev);
+
+ kfree(wd_data);
+ }
+@@ -898,7 +897,7 @@ done:
+ */
+ if (!running) {
+ module_put(wd_data->cdev.owner);
+- kref_put(&wd_data->kref, watchdog_core_data_release);
++ put_device(&wd_data->dev);
+ }
+ return 0;
+ }
+@@ -917,17 +916,22 @@ static struct miscdevice watchdog_miscdev = {
+ .fops = &watchdog_fops,
+ };
+
++static struct class watchdog_class = {
++ .name = "watchdog",
++ .owner = THIS_MODULE,
++ .dev_groups = wdt_groups,
++};
++
+ /*
+ * watchdog_cdev_register: register watchdog character device
+ * @wdd: watchdog device
+- * @devno: character device number
+ *
+ * Register a watchdog character device including handling the legacy
+ * /dev/watchdog node. /dev/watchdog is actually a miscdevice and
+ * thus we set it up like that.
+ */
+
+-static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)
++static int watchdog_cdev_register(struct watchdog_device *wdd)
+ {
+ struct watchdog_core_data *wd_data;
+ int err;
+@@ -935,7 +939,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)
+ wd_data = kzalloc(sizeof(struct watchdog_core_data), GFP_KERNEL);
+ if (!wd_data)
+ return -ENOMEM;
+- kref_init(&wd_data->kref);
+ mutex_init(&wd_data->lock);
+
+ wd_data->wdd = wdd;
+@@ -964,23 +967,33 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)
+ }
+ }
+
++ device_initialize(&wd_data->dev);
++ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
++ wd_data->dev.class = &watchdog_class;
++ wd_data->dev.parent = wdd->parent;
++ wd_data->dev.groups = wdd->groups;
++ wd_data->dev.release = watchdog_core_data_release;
++ dev_set_drvdata(&wd_data->dev, wdd);
++ dev_set_name(&wd_data->dev, "watchdog%d", wdd->id);
++
+ /* Fill in the data structures */
+ cdev_init(&wd_data->cdev, &watchdog_fops);
+- wd_data->cdev.owner = wdd->ops->owner;
+
+ /* Add the device */
+- err = cdev_add(&wd_data->cdev, devno, 1);
++ err = cdev_device_add(&wd_data->cdev, &wd_data->dev);
+ if (err) {
+ pr_err("watchdog%d unable to add device %d:%d\n",
+ wdd->id, MAJOR(watchdog_devt), wdd->id);
+ if (wdd->id == 0) {
+ misc_deregister(&watchdog_miscdev);
+ old_wd_data = NULL;
+- kref_put(&wd_data->kref, watchdog_core_data_release);
++ put_device(&wd_data->dev);
+ }
+ return err;
+ }
+
++ wd_data->cdev.owner = wdd->ops->owner;
++
+ /* Record time of most recent heartbeat as 'just before now'. */
+ wd_data->last_hw_keepalive = ktime_sub(ktime_get(), 1);
+
+@@ -990,7 +1003,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)
+ */
+ if (watchdog_hw_running(wdd)) {
+ __module_get(wdd->ops->owner);
+- kref_get(&wd_data->kref);
++ get_device(&wd_data->dev);
+ if (handle_boot_enabled)
+ hrtimer_start(&wd_data->timer, 0, HRTIMER_MODE_REL);
+ else
+@@ -1013,7 +1026,7 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd)
+ {
+ struct watchdog_core_data *wd_data = wdd->wd_data;
+
+- cdev_del(&wd_data->cdev);
++ cdev_device_del(&wd_data->cdev, &wd_data->dev);
+ if (wdd->id == 0) {
+ misc_deregister(&watchdog_miscdev);
+ old_wd_data = NULL;
+@@ -1032,15 +1045,9 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd)
+ hrtimer_cancel(&wd_data->timer);
+ kthread_cancel_work_sync(&wd_data->work);
+
+- kref_put(&wd_data->kref, watchdog_core_data_release);
++ put_device(&wd_data->dev);
+ }
+
+-static struct class watchdog_class = {
+- .name = "watchdog",
+- .owner = THIS_MODULE,
+- .dev_groups = wdt_groups,
+-};
+-
+ static int watchdog_reboot_notifier(struct notifier_block *nb,
+ unsigned long code, void *data)
+ {
+@@ -1071,27 +1078,14 @@ static int watchdog_reboot_notifier(struct notifier_block *nb,
+
+ int watchdog_dev_register(struct watchdog_device *wdd)
+ {
+- struct device *dev;
+- dev_t devno;
+ int ret;
+
+- devno = MKDEV(MAJOR(watchdog_devt), wdd->id);
+-
+- ret = watchdog_cdev_register(wdd, devno);
++ ret = watchdog_cdev_register(wdd);
+ if (ret)
+ return ret;
+
+- dev = device_create_with_groups(&watchdog_class, wdd->parent,
+- devno, wdd, wdd->groups,
+- "watchdog%d", wdd->id);
+- if (IS_ERR(dev)) {
+- watchdog_cdev_unregister(wdd);
+- return PTR_ERR(dev);
+- }
+-
+ ret = watchdog_register_pretimeout(wdd);
+ if (ret) {
+- device_destroy(&watchdog_class, devno);
+ watchdog_cdev_unregister(wdd);
+ return ret;
+ }
+@@ -1099,7 +1093,8 @@ int watchdog_dev_register(struct watchdog_device *wdd)
+ if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
+ wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
+
+- ret = devm_register_reboot_notifier(dev, &wdd->reboot_nb);
++ ret = devm_register_reboot_notifier(&wdd->wd_data->dev,
++ &wdd->reboot_nb);
+ if (ret) {
+ pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
+ wdd->id, ret);
+@@ -1121,7 +1116,6 @@ int watchdog_dev_register(struct watchdog_device *wdd)
+ void watchdog_dev_unregister(struct watchdog_device *wdd)
+ {
+ watchdog_unregister_pretimeout(wdd);
+- device_destroy(&watchdog_class, wdd->wd_data->cdev.dev);
+ watchdog_cdev_unregister(wdd);
+ }
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 215802cbc42b..950e3dcff7b0 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -3544,8 +3544,14 @@ retry:
+ return ret;
+ }
+
++ /*
++ * Writes that span EOF might trigger an I/O size update on completion,
++ * so consider them to be dirty for the purposes of O_DSYNC, even if
++ * there is no other metadata changes being made or are pending here.
++ */
+ iomap->flags = 0;
+- if (ext4_inode_datasync_dirty(inode))
++ if (ext4_inode_datasync_dirty(inode) ||
++ offset + length > i_size_read(inode))
+ iomap->flags |= IOMAP_F_DIRTY;
+ iomap->bdev = inode->i_sb->s_bdev;
+ iomap->dax_dev = sbi->s_daxdev;
+@@ -3848,7 +3854,13 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter)
+ * writes & truncates and since we take care of writing back page cache,
+ * we are protected against page writeback as well.
+ */
+- inode_lock_shared(inode);
++ if (iocb->ki_flags & IOCB_NOWAIT) {
++ if (!inode_trylock_shared(inode))
++ return -EAGAIN;
++ } else {
++ inode_lock_shared(inode);
++ }
++
+ ret = filemap_write_and_wait_range(mapping, iocb->ki_pos,
+ iocb->ki_pos + count - 1);
+ if (ret)
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 34e48bcf5087..72d154e71bb5 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -2578,6 +2578,20 @@ static inline void clear_file(struct inode *inode, int type)
+ f2fs_mark_inode_dirty_sync(inode, true);
+ }
+
++static inline bool f2fs_is_time_consistent(struct inode *inode)
++{
++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time, &inode->i_atime))
++ return false;
++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 1, &inode->i_ctime))
++ return false;
++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 2, &inode->i_mtime))
++ return false;
++ if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 3,
++ &F2FS_I(inode)->i_crtime))
++ return false;
++ return true;
++}
++
+ static inline bool f2fs_skip_inode_update(struct inode *inode, int dsync)
+ {
+ bool ret;
+@@ -2595,14 +2609,7 @@ static inline bool f2fs_skip_inode_update(struct inode *inode, int dsync)
+ i_size_read(inode) & ~PAGE_MASK)
+ return false;
+
+- if (!timespec64_equal(F2FS_I(inode)->i_disk_time, &inode->i_atime))
+- return false;
+- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 1, &inode->i_ctime))
+- return false;
+- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 2, &inode->i_mtime))
+- return false;
+- if (!timespec64_equal(F2FS_I(inode)->i_disk_time + 3,
+- &F2FS_I(inode)->i_crtime))
++ if (!f2fs_is_time_consistent(inode))
+ return false;
+
+ down_read(&F2FS_I(inode)->i_sem);
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index 540d45759621..a01be7d8db86 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -614,7 +614,11 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc)
+ inode->i_ino == F2FS_META_INO(sbi))
+ return 0;
+
+- if (!is_inode_flag_set(inode, FI_DIRTY_INODE))
++ /*
++ * atime could be updated without dirtying f2fs inode in lazytime mode
++ */
++ if (f2fs_is_time_consistent(inode) &&
++ !is_inode_flag_set(inode, FI_DIRTY_INODE))
+ return 0;
+
+ /*
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index 6b23dcbf52f4..0ace2c2e3de9 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -948,7 +948,8 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ if (!old_dir_entry || whiteout)
+ file_lost_pino(old_inode);
+ else
+- F2FS_I(old_inode)->i_pino = new_dir->i_ino;
++ /* adjust dir's i_pino to pass fsck check */
++ f2fs_i_pino_write(old_inode, new_dir->i_ino);
+ up_write(&F2FS_I(old_inode)->i_sem);
+
+ old_inode->i_ctime = current_time(old_inode);
+@@ -1103,7 +1104,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
+ f2fs_set_link(old_dir, old_entry, old_page, new_inode);
+
+ down_write(&F2FS_I(old_inode)->i_sem);
+- file_lost_pino(old_inode);
++ if (!old_dir_entry)
++ file_lost_pino(old_inode);
++ else
++ /* adjust dir's i_pino to pass fsck check */
++ f2fs_i_pino_write(old_inode, new_dir->i_ino);
+ up_write(&F2FS_I(old_inode)->i_sem);
+
+ old_dir->i_ctime = current_time(old_dir);
+@@ -1118,7 +1123,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
+ f2fs_set_link(new_dir, new_entry, new_page, old_inode);
+
+ down_write(&F2FS_I(new_inode)->i_sem);
+- file_lost_pino(new_inode);
++ if (!new_dir_entry)
++ file_lost_pino(new_inode);
++ else
++ /* adjust dir's i_pino to pass fsck check */
++ f2fs_i_pino_write(new_inode, old_dir->i_ino);
+ up_write(&F2FS_I(new_inode)->i_sem);
+
+ new_dir->i_ctime = current_time(new_dir);
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 24f86ffe11d7..020bd7a0d8e0 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -724,7 +724,6 @@ start_journal_io:
+ submit_bh(REQ_OP_WRITE, REQ_SYNC, bh);
+ }
+ cond_resched();
+- stats.run.rs_blocks_logged += bufs;
+
+ /* Force a new descriptor to be generated next
+ time round the loop. */
+@@ -811,6 +810,7 @@ start_journal_io:
+ if (unlikely(!buffer_uptodate(bh)))
+ err = -EIO;
+ jbd2_unfile_log_bh(bh);
++ stats.run.rs_blocks_logged++;
+
+ /*
+ * The list contains temporary buffer heads created by
+@@ -856,6 +856,7 @@ start_journal_io:
+ BUFFER_TRACE(bh, "ph5: control buffer writeout done: unfile");
+ clear_buffer_jwrite(bh);
+ jbd2_unfile_log_bh(bh);
++ stats.run.rs_blocks_logged++;
+ __brelse(bh); /* One for getblk */
+ /* AKPM: bforget here */
+ }
+@@ -877,6 +878,7 @@ start_journal_io:
+ }
+ if (cbh)
+ err = journal_wait_on_commit_record(journal, cbh);
++ stats.run.rs_blocks_logged++;
+ if (jbd2_has_feature_async_commit(journal) &&
+ journal->j_flags & JBD2_BARRIER) {
+ blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL);
+diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
+index 917fadca8a7b..b73b78771915 100644
+--- a/fs/ocfs2/acl.c
++++ b/fs/ocfs2/acl.c
+@@ -335,8 +335,8 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh)
+ down_read(&OCFS2_I(inode)->ip_xattr_sem);
+ acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh);
+ up_read(&OCFS2_I(inode)->ip_xattr_sem);
+- if (IS_ERR(acl) || !acl)
+- return PTR_ERR(acl);
++ if (IS_ERR_OR_NULL(acl))
++ return PTR_ERR_OR_ZERO(acl);
+ ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode);
+ if (ret)
+ return ret;
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 59b00d8db22c..154f175066b3 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -2853,68 +2853,73 @@ EXPORT_SYMBOL(dquot_quotactl_sysfile_ops);
+ static int do_proc_dqstats(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+- unsigned int type = (int *)table->data - dqstats.stat;
++ unsigned int type = (unsigned long *)table->data - dqstats.stat;
++ s64 value = percpu_counter_sum(&dqstats.counter[type]);
++
++ /* Filter negative values for non-monotonic counters */
++ if (value < 0 && (type == DQST_ALLOC_DQUOTS ||
++ type == DQST_FREE_DQUOTS))
++ value = 0;
+
+ /* Update global table */
+- dqstats.stat[type] =
+- percpu_counter_sum_positive(&dqstats.counter[type]);
+- return proc_dointvec(table, write, buffer, lenp, ppos);
++ dqstats.stat[type] = value;
++ return proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
+ }
+
+ static struct ctl_table fs_dqstats_table[] = {
+ {
+ .procname = "lookups",
+ .data = &dqstats.stat[DQST_LOOKUPS],
+- .maxlen = sizeof(int),
++ .maxlen = sizeof(unsigned long),
+ .mode = 0444,
+ .proc_handler = do_proc_dqstats,
+ },
+ {
+ .procname = "drops",
+ .data = &dqstats.stat[DQST_DROPS],
+- .maxlen = sizeof(int),
++ .maxlen = sizeof(unsigned long),
+ .mode = 0444,
+ .proc_handler = do_proc_dqstats,
+ },
+ {
+ .procname = "reads",
+ .data = &dqstats.stat[DQST_READS],
+- .maxlen = sizeof(int),
++ .maxlen = sizeof(unsigned long),
+ .mode = 0444,
+ .proc_handler = do_proc_dqstats,
+ },
+ {
+ .procname = "writes",
+ .data = &dqstats.stat[DQST_WRITES],
+- .maxlen = sizeof(int),
++ .maxlen = sizeof(unsigned long),
+ .mode = 0444,
+ .proc_handler = do_proc_dqstats,
+ },
+ {
+ .procname = "cache_hits",
+ .data = &dqstats.stat[DQST_CACHE_HITS],
+- .maxlen = sizeof(int),
++ .maxlen = sizeof(unsigned long),
+ .mode = 0444,
+ .proc_handler = do_proc_dqstats,
+ },
+ {
+ .procname = "allocated_dquots",
+ .data = &dqstats.stat[DQST_ALLOC_DQUOTS],
+- .maxlen = sizeof(int),
++ .maxlen = sizeof(unsigned long),
+ .mode = 0444,
+ .proc_handler = do_proc_dqstats,
+ },
+ {
+ .procname = "free_dquots",
+ .data = &dqstats.stat[DQST_FREE_DQUOTS],
+- .maxlen = sizeof(int),
++ .maxlen = sizeof(unsigned long),
+ .mode = 0444,
+ .proc_handler = do_proc_dqstats,
+ },
+ {
+ .procname = "syncs",
+ .data = &dqstats.stat[DQST_SYNCS],
+- .maxlen = sizeof(int),
++ .maxlen = sizeof(unsigned long),
+ .mode = 0444,
+ .proc_handler = do_proc_dqstats,
+ },
+diff --git a/fs/readdir.c b/fs/readdir.c
+index d97f548e6323..443270f635f4 100644
+--- a/fs/readdir.c
++++ b/fs/readdir.c
+@@ -64,6 +64,40 @@ out:
+ }
+ EXPORT_SYMBOL(iterate_dir);
+
++/*
++ * POSIX says that a dirent name cannot contain NULL or a '/'.
++ *
++ * It's not 100% clear what we should really do in this case.
++ * The filesystem is clearly corrupted, but returning a hard
++ * error means that you now don't see any of the other names
++ * either, so that isn't a perfect alternative.
++ *
++ * And if you return an error, what error do you use? Several
++ * filesystems seem to have decided on EUCLEAN being the error
++ * code for EFSCORRUPTED, and that may be the error to use. Or
++ * just EIO, which is perhaps more obvious to users.
++ *
++ * In order to see the other file names in the directory, the
++ * caller might want to make this a "soft" error: skip the
++ * entry, and return the error at the end instead.
++ *
++ * Note that this should likely do a "memchr(name, 0, len)"
++ * check too, since that would be filesystem corruption as
++ * well. However, that case can't actually confuse user space,
++ * which has to do a strlen() on the name anyway to find the
++ * filename length, and the above "soft error" worry means
++ * that it's probably better left alone until we have that
++ * issue clarified.
++ */
++static int verify_dirent_name(const char *name, int len)
++{
++ if (!len)
++ return -EIO;
++ if (memchr(name, '/', len))
++ return -EIO;
++ return 0;
++}
++
+ /*
+ * Traditional linux readdir() handling..
+ *
+@@ -173,6 +207,9 @@ static int filldir(struct dir_context *ctx, const char *name, int namlen,
+ int reclen = ALIGN(offsetof(struct linux_dirent, d_name) + namlen + 2,
+ sizeof(long));
+
++ buf->error = verify_dirent_name(name, namlen);
++ if (unlikely(buf->error))
++ return buf->error;
+ buf->error = -EINVAL; /* only used if we fail.. */
+ if (reclen > buf->count)
+ return -EINVAL;
+@@ -259,6 +296,9 @@ static int filldir64(struct dir_context *ctx, const char *name, int namlen,
+ int reclen = ALIGN(offsetof(struct linux_dirent64, d_name) + namlen + 1,
+ sizeof(u64));
+
++ buf->error = verify_dirent_name(name, namlen);
++ if (unlikely(buf->error))
++ return buf->error;
+ buf->error = -EINVAL; /* only used if we fail.. */
+ if (reclen > buf->count)
+ return -EINVAL;
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index 9c2955f67f70..d269d1139f7f 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -1833,13 +1833,12 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
+ if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api)))
+ goto out;
+ features = uffdio_api.features;
+- if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES)) {
+- memset(&uffdio_api, 0, sizeof(uffdio_api));
+- if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
+- goto out;
+- ret = -EINVAL;
+- goto out;
+- }
++ ret = -EINVAL;
++ if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES))
++ goto err_out;
++ ret = -EPERM;
++ if ((features & UFFD_FEATURE_EVENT_FORK) && !capable(CAP_SYS_PTRACE))
++ goto err_out;
+ /* report all available features and ioctls to userland */
+ uffdio_api.features = UFFD_API_FEATURES;
+ uffdio_api.ioctls = UFFD_API_IOCTLS;
+@@ -1852,6 +1851,11 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
+ ret = 0;
+ out:
+ return ret;
++err_out:
++ memset(&uffdio_api, 0, sizeof(uffdio_api));
++ if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
++ ret = -EFAULT;
++ goto out;
+ }
+
+ static long userfaultfd_ioctl(struct file *file, unsigned cmd,
+diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
+index 3892e9c8b2de..542b4fa2cda9 100644
+--- a/include/linux/hrtimer.h
++++ b/include/linux/hrtimer.h
+@@ -430,12 +430,18 @@ extern u64 hrtimer_next_event_without(const struct hrtimer *exclude);
+
+ extern bool hrtimer_active(const struct hrtimer *timer);
+
+-/*
+- * Helper function to check, whether the timer is on one of the queues
++/**
++ * hrtimer_is_queued = check, whether the timer is on one of the queues
++ * @timer: Timer to check
++ *
++ * Returns: True if the timer is queued, false otherwise
++ *
++ * The function can be used lockless, but it gives only a current snapshot.
+ */
+-static inline int hrtimer_is_queued(struct hrtimer *timer)
++static inline bool hrtimer_is_queued(struct hrtimer *timer)
+ {
+- return timer->state & HRTIMER_STATE_ENQUEUED;
++ /* The READ_ONCE pairs with the update functions of timer->state */
++ return !!(READ_ONCE(timer->state) & HRTIMER_STATE_ENQUEUED);
+ }
+
+ /*
+diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h
+index edb0f0c30904..1adf54aad2df 100644
+--- a/include/linux/libfdt_env.h
++++ b/include/linux/libfdt_env.h
+@@ -7,6 +7,9 @@
+
+ #include <asm/byteorder.h>
+
++#define INT32_MAX S32_MAX
++#define UINT32_MAX U32_MAX
++
+ typedef __be16 fdt16_t;
+ typedef __be32 fdt32_t;
+ typedef __be64 fdt64_t;
+diff --git a/include/linux/posix-clock.h b/include/linux/posix-clock.h
+index 3a3bc71017d5..03cb1f21b0e0 100644
+--- a/include/linux/posix-clock.h
++++ b/include/linux/posix-clock.h
+@@ -82,29 +82,32 @@ struct posix_clock_operations {
+ *
+ * @ops: Functional interface to the clock
+ * @cdev: Character device instance for this clock
+- * @kref: Reference count.
++ * @dev: Pointer to the clock's device.
+ * @rwsem: Protects the 'zombie' field from concurrent access.
+ * @zombie: If 'zombie' is true, then the hardware has disappeared.
+- * @release: A function to free the structure when the reference count reaches
+- * zero. May be NULL if structure is statically allocated.
+ *
+ * Drivers should embed their struct posix_clock within a private
+ * structure, obtaining a reference to it during callbacks using
+ * container_of().
++ *
++ * Drivers should supply an initialized but not exposed struct device
++ * to posix_clock_register(). It is used to manage lifetime of the
++ * driver's private structure. It's 'release' field should be set to
++ * a release function for this private structure.
+ */
+ struct posix_clock {
+ struct posix_clock_operations ops;
+ struct cdev cdev;
+- struct kref kref;
++ struct device *dev;
+ struct rw_semaphore rwsem;
+ bool zombie;
+- void (*release)(struct posix_clock *clk);
+ };
+
+ /**
+ * posix_clock_register() - register a new clock
+- * @clk: Pointer to the clock. Caller must provide 'ops' and 'release'
+- * @devid: Allocated device id
++ * @clk: Pointer to the clock. Caller must provide 'ops' field
++ * @dev: Pointer to the initialized device. Caller must provide
++ * 'release' field
+ *
+ * A clock driver calls this function to register itself with the
+ * clock device subsystem. If 'clk' points to dynamically allocated
+@@ -113,7 +116,7 @@ struct posix_clock {
+ *
+ * Returns zero on success, non-zero otherwise.
+ */
+-int posix_clock_register(struct posix_clock *clk, dev_t devid);
++int posix_clock_register(struct posix_clock *clk, struct device *dev);
+
+ /**
+ * posix_clock_unregister() - unregister a clock
+diff --git a/include/linux/quota.h b/include/linux/quota.h
+index f32dd270b8e3..27aab84fcbaa 100644
+--- a/include/linux/quota.h
++++ b/include/linux/quota.h
+@@ -263,7 +263,7 @@ enum {
+ };
+
+ struct dqstats {
+- int stat[_DQST_DQSTAT_LAST];
++ unsigned long stat[_DQST_DQSTAT_LAST];
+ struct percpu_counter counter[_DQST_DQSTAT_LAST];
+ };
+
+diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
+index bc8206a8f30e..61974c4c566b 100644
+--- a/include/linux/rculist_nulls.h
++++ b/include/linux/rculist_nulls.h
+@@ -100,6 +100,43 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n,
+ first->pprev = &n->next;
+ }
+
++/**
++ * hlist_nulls_add_tail_rcu
++ * @n: the element to add to the hash list.
++ * @h: the list to add to.
++ *
++ * Description:
++ * Adds the specified element to the specified hlist_nulls,
++ * while permitting racing traversals.
++ *
++ * The caller must take whatever precautions are necessary
++ * (such as holding appropriate locks) to avoid racing
++ * with another list-mutation primitive, such as hlist_nulls_add_head_rcu()
++ * or hlist_nulls_del_rcu(), running on this same list.
++ * However, it is perfectly legal to run concurrently with
++ * the _rcu list-traversal primitives, such as
++ * hlist_nulls_for_each_entry_rcu(), used to prevent memory-consistency
++ * problems on Alpha CPUs. Regardless of the type of CPU, the
++ * list-traversal primitive must be guarded by rcu_read_lock().
++ */
++static inline void hlist_nulls_add_tail_rcu(struct hlist_nulls_node *n,
++ struct hlist_nulls_head *h)
++{
++ struct hlist_nulls_node *i, *last = NULL;
++
++ /* Note: write side code, so rcu accessors are not needed. */
++ for (i = h->first; !is_a_nulls(i); i = i->next)
++ last = i;
++
++ if (last) {
++ n->next = last->next;
++ n->pprev = &last->next;
++ rcu_assign_pointer(hlist_next_rcu(last), n);
++ } else {
++ hlist_nulls_add_head_rcu(n, h);
++ }
++}
++
+ /**
+ * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type
+ * @tpos: the type * to use as a loop cursor.
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 80c3da1aa8b1..25407c206e73 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1669,7 +1669,7 @@ static inline struct sk_buff *skb_peek_next(struct sk_buff *skb,
+ */
+ static inline struct sk_buff *skb_peek_tail(const struct sk_buff_head *list_)
+ {
+- struct sk_buff *skb = list_->prev;
++ struct sk_buff *skb = READ_ONCE(list_->prev);
+
+ if (skb == (struct sk_buff *)list_)
+ skb = NULL;
+@@ -1737,7 +1737,9 @@ static inline void __skb_insert(struct sk_buff *newsk,
+ struct sk_buff *prev, struct sk_buff *next,
+ struct sk_buff_head *list)
+ {
+- /* see skb_queue_empty_lockless() for the opposite READ_ONCE() */
++ /* See skb_queue_empty_lockless() and skb_peek_tail()
++ * for the opposite READ_ONCE()
++ */
+ WRITE_ONCE(newsk->next, next);
+ WRITE_ONCE(newsk->prev, prev);
+ WRITE_ONCE(next->prev, newsk);
+diff --git a/include/net/dst.h b/include/net/dst.h
+index 851cf1124240..35ae45fa0758 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -527,7 +527,16 @@ static inline void skb_dst_update_pmtu(struct sk_buff *skb, u32 mtu)
+ struct dst_entry *dst = skb_dst(skb);
+
+ if (dst && dst->ops->update_pmtu)
+- dst->ops->update_pmtu(dst, NULL, skb, mtu);
++ dst->ops->update_pmtu(dst, NULL, skb, mtu, true);
++}
++
++/* update dst pmtu but not do neighbor confirm */
++static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu)
++{
++ struct dst_entry *dst = skb_dst(skb);
++
++ if (dst && dst->ops->update_pmtu)
++ dst->ops->update_pmtu(dst, NULL, skb, mtu, false);
+ }
+
+ static inline void skb_tunnel_check_pmtu(struct sk_buff *skb,
+@@ -537,7 +546,7 @@ static inline void skb_tunnel_check_pmtu(struct sk_buff *skb,
+ u32 encap_mtu = dst_mtu(encap_dst);
+
+ if (skb->len > encap_mtu - headroom)
+- skb_dst_update_pmtu(skb, encap_mtu - headroom);
++ skb_dst_update_pmtu_no_confirm(skb, encap_mtu - headroom);
+ }
+
+ #endif /* _NET_DST_H */
+diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
+index 5ec645f27ee3..443863c7b8da 100644
+--- a/include/net/dst_ops.h
++++ b/include/net/dst_ops.h
+@@ -27,7 +27,8 @@ struct dst_ops {
+ struct dst_entry * (*negative_advice)(struct dst_entry *);
+ void (*link_failure)(struct sk_buff *);
+ void (*update_pmtu)(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu);
++ struct sk_buff *skb, u32 mtu,
++ bool confirm_neigh);
+ void (*redirect)(struct dst_entry *dst, struct sock *sk,
+ struct sk_buff *skb);
+ int (*local_out)(struct net *net, struct sock *sk, struct sk_buff *skb);
+diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
+index 9141e95529e7..b875dcef173c 100644
+--- a/include/net/inet_hashtables.h
++++ b/include/net/inet_hashtables.h
+@@ -106,13 +106,19 @@ struct inet_bind_hashbucket {
+ struct hlist_head chain;
+ };
+
+-/*
+- * Sockets can be hashed in established or listening table
++/* Sockets can be hashed in established or listening table.
++ * We must use different 'nulls' end-of-chain value for all hash buckets :
++ * A socket might transition from ESTABLISH to LISTEN state without
++ * RCU grace period. A lookup in ehash table needs to handle this case.
+ */
++#define LISTENING_NULLS_BASE (1U << 29)
+ struct inet_listen_hashbucket {
+ spinlock_t lock;
+ unsigned int count;
+- struct hlist_head head;
++ union {
++ struct hlist_head head;
++ struct hlist_nulls_head nulls_head;
++ };
+ };
+
+ /* This is for listening sockets, thus all sockets which possess wildcards. */
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 4545a9ecc219..f359e5c94762 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -721,6 +721,11 @@ static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_h
+ hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
+ }
+
++static inline void __sk_nulls_add_node_tail_rcu(struct sock *sk, struct hlist_nulls_head *list)
++{
++ hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list);
++}
++
+ static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
+ {
+ sock_hold(sk);
+diff --git a/include/scsi/iscsi_proto.h b/include/scsi/iscsi_proto.h
+index df156f1d50b2..f0a01a54bd15 100644
+--- a/include/scsi/iscsi_proto.h
++++ b/include/scsi/iscsi_proto.h
+@@ -638,6 +638,7 @@ struct iscsi_reject {
+ #define ISCSI_REASON_BOOKMARK_INVALID 9
+ #define ISCSI_REASON_BOOKMARK_NO_RESOURCES 10
+ #define ISCSI_REASON_NEGOTIATION_RESET 11
++#define ISCSI_REASON_WAITING_FOR_LOGOUT 12
+
+ /* Max. number of Key=Value pairs in a text message */
+ #define MAX_KEY_VALUE_PAIRS 8192
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index c007d25bee09..3a2397444076 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -442,6 +442,7 @@ void debug_dma_dump_mappings(struct device *dev)
+ }
+
+ spin_unlock_irqrestore(&bucket->lock, flags);
++ cond_resched();
+ }
+ }
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index f8576509c7be..4c4fd4339d33 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -1411,7 +1411,7 @@ static struct ctl_table vm_table[] = {
+ .procname = "drop_caches",
+ .data = &sysctl_drop_caches,
+ .maxlen = sizeof(int),
+- .mode = 0644,
++ .mode = 0200,
+ .proc_handler = drop_caches_sysctl_handler,
+ .extra1 = &one,
+ .extra2 = &four,
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index e1a549c9e399..7362554416fd 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -955,7 +955,8 @@ static int enqueue_hrtimer(struct hrtimer *timer,
+
+ base->cpu_base->active_bases |= 1 << base->index;
+
+- timer->state = HRTIMER_STATE_ENQUEUED;
++ /* Pairs with the lockless read in hrtimer_is_queued() */
++ WRITE_ONCE(timer->state, HRTIMER_STATE_ENQUEUED);
+
+ return timerqueue_add(&base->active, &timer->node);
+ }
+@@ -977,7 +978,8 @@ static void __remove_hrtimer(struct hrtimer *timer,
+ struct hrtimer_cpu_base *cpu_base = base->cpu_base;
+ u8 state = timer->state;
+
+- timer->state = newstate;
++ /* Pairs with the lockless read in hrtimer_is_queued() */
++ WRITE_ONCE(timer->state, newstate);
+ if (!(state & HRTIMER_STATE_ENQUEUED))
+ return;
+
+@@ -1002,8 +1004,9 @@ static void __remove_hrtimer(struct hrtimer *timer,
+ static inline int
+ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart)
+ {
+- if (hrtimer_is_queued(timer)) {
+- u8 state = timer->state;
++ u8 state = timer->state;
++
++ if (state & HRTIMER_STATE_ENQUEUED) {
+ int reprogram;
+
+ /*
+diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
+index fe56c4e06c51..c8a8501fae5b 100644
+--- a/kernel/time/posix-clock.c
++++ b/kernel/time/posix-clock.c
+@@ -27,8 +27,6 @@
+
+ #include "posix-timers.h"
+
+-static void delete_clock(struct kref *kref);
+-
+ /*
+ * Returns NULL if the posix_clock instance attached to 'fp' is old and stale.
+ */
+@@ -138,7 +136,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp)
+ err = 0;
+
+ if (!err) {
+- kref_get(&clk->kref);
++ get_device(clk->dev);
+ fp->private_data = clk;
+ }
+ out:
+@@ -154,7 +152,7 @@ static int posix_clock_release(struct inode *inode, struct file *fp)
+ if (clk->ops.release)
+ err = clk->ops.release(clk);
+
+- kref_put(&clk->kref, delete_clock);
++ put_device(clk->dev);
+
+ fp->private_data = NULL;
+
+@@ -174,38 +172,35 @@ static const struct file_operations posix_clock_file_operations = {
+ #endif
+ };
+
+-int posix_clock_register(struct posix_clock *clk, dev_t devid)
++int posix_clock_register(struct posix_clock *clk, struct device *dev)
+ {
+ int err;
+
+- kref_init(&clk->kref);
+ init_rwsem(&clk->rwsem);
+
+ cdev_init(&clk->cdev, &posix_clock_file_operations);
++ err = cdev_device_add(&clk->cdev, dev);
++ if (err) {
++ pr_err("%s unable to add device %d:%d\n",
++ dev_name(dev), MAJOR(dev->devt), MINOR(dev->devt));
++ return err;
++ }
+ clk->cdev.owner = clk->ops.owner;
+- err = cdev_add(&clk->cdev, devid, 1);
++ clk->dev = dev;
+
+- return err;
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(posix_clock_register);
+
+-static void delete_clock(struct kref *kref)
+-{
+- struct posix_clock *clk = container_of(kref, struct posix_clock, kref);
+-
+- if (clk->release)
+- clk->release(clk);
+-}
+-
+ void posix_clock_unregister(struct posix_clock *clk)
+ {
+- cdev_del(&clk->cdev);
++ cdev_device_del(&clk->cdev, clk->dev);
+
+ down_write(&clk->rwsem);
+ clk->zombie = true;
+ up_write(&clk->rwsem);
+
+- kref_put(&clk->kref, delete_clock);
++ put_device(clk->dev);
+ }
+ EXPORT_SYMBOL_GPL(posix_clock_unregister);
+
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index 212c184c1eee..ccab290c14d4 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -646,6 +646,9 @@ static unsigned int br_nf_forward_arp(void *priv,
+ nf_bridge_pull_encap_header(skb);
+ }
+
++ if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr))))
++ return NF_DROP;
++
+ if (arp_hdr(skb)->ar_pln != 4) {
+ if (IS_VLAN_ARP(skb))
+ nf_bridge_push_encap_header(skb);
+diff --git a/net/bridge/br_nf_core.c b/net/bridge/br_nf_core.c
+index 8e2d7cfa4e16..d88e724d5755 100644
+--- a/net/bridge/br_nf_core.c
++++ b/net/bridge/br_nf_core.c
+@@ -26,7 +26,8 @@
+ #endif
+
+ static void fake_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu)
++ struct sk_buff *skb, u32 mtu,
++ bool confirm_neigh)
+ {
+ }
+
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 7d249afa1466..785e19afd6aa 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -1876,7 +1876,7 @@ static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
+ }
+
+ static int ebt_buf_add(struct ebt_entries_buf_state *state,
+- void *data, unsigned int sz)
++ const void *data, unsigned int sz)
+ {
+ if (state->buf_kern_start == NULL)
+ goto count_only;
+@@ -1910,7 +1910,7 @@ enum compat_mwt {
+ EBT_COMPAT_TARGET,
+ };
+
+-static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
++static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt,
+ enum compat_mwt compat_mwt,
+ struct ebt_entries_buf_state *state,
+ const unsigned char *base)
+@@ -1988,22 +1988,23 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
+ /* return size of all matches, watchers or target, including necessary
+ * alignment and padding.
+ */
+-static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
++static int ebt_size_mwt(const struct compat_ebt_entry_mwt *match32,
+ unsigned int size_left, enum compat_mwt type,
+ struct ebt_entries_buf_state *state, const void *base)
+ {
++ const char *buf = (const char *)match32;
+ int growth = 0;
+- char *buf;
+
+ if (size_left == 0)
+ return 0;
+
+- buf = (char *) match32;
+-
+- while (size_left >= sizeof(*match32)) {
++ do {
+ struct ebt_entry_match *match_kern;
+ int ret;
+
++ if (size_left < sizeof(*match32))
++ return -EINVAL;
++
+ match_kern = (struct ebt_entry_match *) state->buf_kern_start;
+ if (match_kern) {
+ char *tmp;
+@@ -2040,22 +2041,18 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
+ if (match_kern)
+ match_kern->match_size = ret;
+
+- /* rule should have no remaining data after target */
+- if (type == EBT_COMPAT_TARGET && size_left)
+- return -EINVAL;
+-
+ match32 = (struct compat_ebt_entry_mwt *) buf;
+- }
++ } while (size_left);
+
+ return growth;
+ }
+
+ /* called for all ebt_entry structures. */
+-static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
++static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *base,
+ unsigned int *total,
+ struct ebt_entries_buf_state *state)
+ {
+- unsigned int i, j, startoff, new_offset = 0;
++ unsigned int i, j, startoff, next_expected_off, new_offset = 0;
+ /* stores match/watchers/targets & offset of next struct ebt_entry: */
+ unsigned int offsets[4];
+ unsigned int *offsets_update = NULL;
+@@ -2141,11 +2138,13 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
+ return ret;
+ }
+
+- startoff = state->buf_user_offset - startoff;
++ next_expected_off = state->buf_user_offset - startoff;
++ if (next_expected_off != entry->next_offset)
++ return -EINVAL;
+
+- if (WARN_ON(*total < startoff))
++ if (*total < entry->next_offset)
+ return -EINVAL;
+- *total -= startoff;
++ *total -= entry->next_offset;
+ return 0;
+ }
+
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index d67ec17f2cc8..6cec08cd0bb9 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -281,6 +281,7 @@ static int proc_dointvec_minmax_bpf_enable(struct ctl_table *table, int write,
+ return ret;
+ }
+
++# ifdef CONFIG_HAVE_EBPF_JIT
+ static int
+ proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp,
+@@ -291,6 +292,7 @@ proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write,
+
+ return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+ }
++# endif /* CONFIG_HAVE_EBPF_JIT */
+
+ static int
+ proc_dolongvec_minmax_bpf_restricted(struct ctl_table *table, int write,
+diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
+index 1c002c0fb712..658191fba94e 100644
+--- a/net/decnet/dn_route.c
++++ b/net/decnet/dn_route.c
+@@ -118,7 +118,8 @@ static void dn_dst_ifdown(struct dst_entry *, struct net_device *dev, int how);
+ static struct dst_entry *dn_dst_negative_advice(struct dst_entry *);
+ static void dn_dst_link_failure(struct sk_buff *);
+ static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb , u32 mtu);
++ struct sk_buff *skb , u32 mtu,
++ bool confirm_neigh);
+ static void dn_dst_redirect(struct dst_entry *dst, struct sock *sk,
+ struct sk_buff *skb);
+ static struct neighbour *dn_dst_neigh_lookup(const struct dst_entry *dst,
+@@ -259,7 +260,8 @@ static int dn_dst_gc(struct dst_ops *ops)
+ * advertise to the other end).
+ */
+ static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu)
++ struct sk_buff *skb, u32 mtu,
++ bool confirm_neigh)
+ {
+ struct dn_route *rt = (struct dn_route *) dst;
+ struct neighbour *n = rt->n;
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index 0167e23d1c8f..4efa5e33513e 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -254,10 +254,11 @@ bool icmp_global_allow(void)
+ bool rc = false;
+
+ /* Check if token bucket is empty and cannot be refilled
+- * without taking the spinlock.
++ * without taking the spinlock. The READ_ONCE() are paired
++ * with the following WRITE_ONCE() in this same function.
+ */
+- if (!icmp_global.credit) {
+- delta = min_t(u32, now - icmp_global.stamp, HZ);
++ if (!READ_ONCE(icmp_global.credit)) {
++ delta = min_t(u32, now - READ_ONCE(icmp_global.stamp), HZ);
+ if (delta < HZ / 50)
+ return false;
+ }
+@@ -267,14 +268,14 @@ bool icmp_global_allow(void)
+ if (delta >= HZ / 50) {
+ incr = sysctl_icmp_msgs_per_sec * delta / HZ ;
+ if (incr)
+- icmp_global.stamp = now;
++ WRITE_ONCE(icmp_global.stamp, now);
+ }
+ credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
+ if (credit) {
+ credit--;
+ rc = true;
+ }
+- icmp_global.credit = credit;
++ WRITE_ONCE(icmp_global.credit, credit);
+ spin_unlock(&icmp_global.lock);
+ return rc;
+ }
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 15e7f7915a21..636a11c56cf5 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -1089,7 +1089,7 @@ struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu)
+ if (!dst)
+ goto out;
+ }
+- dst->ops->update_pmtu(dst, sk, NULL, mtu);
++ dst->ops->update_pmtu(dst, sk, NULL, mtu, true);
+
+ dst = __sk_dst_check(sk, 0);
+ if (!dst)
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 5731670c560b..9742b37afe1d 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -918,11 +918,12 @@ void inet_diag_dump_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *skb,
+
+ for (i = s_i; i < INET_LHTABLE_SIZE; i++) {
+ struct inet_listen_hashbucket *ilb;
++ struct hlist_nulls_node *node;
+
+ num = 0;
+ ilb = &hashinfo->listening_hash[i];
+ spin_lock(&ilb->lock);
+- sk_for_each(sk, &ilb->head) {
++ sk_nulls_for_each(sk, node, &ilb->nulls_head) {
+ struct inet_sock *inet = inet_sk(sk);
+
+ if (!net_eq(sock_net(sk), net))
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index 7be966a60801..b53da2691adb 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -308,6 +308,7 @@ struct sock *__inet_lookup_listener(struct net *net,
+ bool exact_dif = inet_exact_dif_match(net, skb);
+ struct inet_listen_hashbucket *ilb2;
+ struct sock *sk, *result = NULL;
++ struct hlist_nulls_node *node;
+ int score, hiscore = 0;
+ unsigned int hash2;
+ u32 phash = 0;
+@@ -343,7 +344,7 @@ struct sock *__inet_lookup_listener(struct net *net,
+ goto done;
+
+ port_lookup:
+- sk_for_each_rcu(sk, &ilb->head) {
++ sk_nulls_for_each_rcu(sk, node, &ilb->nulls_head) {
+ score = compute_score(sk, net, hnum, daddr,
+ dif, sdif, exact_dif);
+ if (score > hiscore) {
+@@ -560,10 +561,11 @@ static int inet_reuseport_add_sock(struct sock *sk,
+ struct inet_listen_hashbucket *ilb)
+ {
+ struct inet_bind_bucket *tb = inet_csk(sk)->icsk_bind_hash;
++ const struct hlist_nulls_node *node;
+ struct sock *sk2;
+ kuid_t uid = sock_i_uid(sk);
+
+- sk_for_each_rcu(sk2, &ilb->head) {
++ sk_nulls_for_each_rcu(sk2, node, &ilb->nulls_head) {
+ if (sk2 != sk &&
+ sk2->sk_family == sk->sk_family &&
+ ipv6_only_sock(sk2) == ipv6_only_sock(sk) &&
+@@ -599,9 +601,9 @@ int __inet_hash(struct sock *sk, struct sock *osk)
+ }
+ if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport &&
+ sk->sk_family == AF_INET6)
+- hlist_add_tail_rcu(&sk->sk_node, &ilb->head);
++ __sk_nulls_add_node_tail_rcu(sk, &ilb->nulls_head);
+ else
+- hlist_add_head_rcu(&sk->sk_node, &ilb->head);
++ __sk_nulls_add_node_rcu(sk, &ilb->nulls_head);
+ inet_hash2(hashinfo, sk);
+ ilb->count++;
+ sock_set_flag(sk, SOCK_RCU_FREE);
+@@ -650,11 +652,9 @@ void inet_unhash(struct sock *sk)
+ reuseport_detach_sock(sk);
+ if (ilb) {
+ inet_unhash2(hashinfo, sk);
+- __sk_del_node_init(sk);
+- ilb->count--;
+- } else {
+- __sk_nulls_del_node_init_rcu(sk);
++ ilb->count--;
+ }
++ __sk_nulls_del_node_init_rcu(sk);
+ sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+ unlock:
+ spin_unlock_bh(lock);
+@@ -790,7 +790,8 @@ void inet_hashinfo_init(struct inet_hashinfo *h)
+
+ for (i = 0; i < INET_LHTABLE_SIZE; i++) {
+ spin_lock_init(&h->listening_hash[i].lock);
+- INIT_HLIST_HEAD(&h->listening_hash[i].head);
++ INIT_HLIST_NULLS_HEAD(&h->listening_hash[i].nulls_head,
++ i + LISTENING_NULLS_BASE);
+ h->listening_hash[i].count = 0;
+ }
+
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index be778599bfed..ff327a62c9ce 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -160,7 +160,12 @@ static void inet_peer_gc(struct inet_peer_base *base,
+ base->total / inet_peer_threshold * HZ;
+ for (i = 0; i < gc_cnt; i++) {
+ p = gc_stack[i];
+- delta = (__u32)jiffies - p->dtime;
++
++ /* The READ_ONCE() pairs with the WRITE_ONCE()
++ * in inet_putpeer()
++ */
++ delta = (__u32)jiffies - READ_ONCE(p->dtime);
++
+ if (delta < ttl || !refcount_dec_if_one(&p->refcnt))
+ gc_stack[i] = NULL;
+ }
+@@ -237,7 +242,10 @@ EXPORT_SYMBOL_GPL(inet_getpeer);
+
+ void inet_putpeer(struct inet_peer *p)
+ {
+- p->dtime = (__u32)jiffies;
++ /* The WRITE_ONCE() pairs with itself (we run lockless)
++ * and the READ_ONCE() in inet_peer_gc()
++ */
++ WRITE_ONCE(p->dtime, (__u32)jiffies);
+
+ if (refcount_dec_and_test(&p->refcnt))
+ call_rcu(&p->rcu, inetpeer_free_rcu);
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 054d01c16dc6..420e891ac59d 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -513,7 +513,7 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+ else
+ mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
+
+- skb_dst_update_pmtu(skb, mtu);
++ skb_dst_update_pmtu_no_confirm(skb, mtu);
+
+ if (skb->protocol == htons(ETH_P_IP)) {
+ if (!skb_is_gso(skb) &&
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index 808f8d15c519..960f4faaf294 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -235,7 +235,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
+
+ mtu = dst_mtu(dst);
+ if (skb->len > mtu) {
+- skb_dst_update_pmtu(skb, mtu);
++ skb_dst_update_pmtu_no_confirm(skb, mtu);
+ if (skb->protocol == htons(ETH_P_IP)) {
+ icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+ htonl(mtu));
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 69127f6039b2..4590af506244 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -142,7 +142,8 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst);
+ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
+ static void ipv4_link_failure(struct sk_buff *skb);
+ static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu);
++ struct sk_buff *skb, u32 mtu,
++ bool confirm_neigh);
+ static void ip_do_redirect(struct dst_entry *dst, struct sock *sk,
+ struct sk_buff *skb);
+ static void ipv4_dst_destroy(struct dst_entry *dst);
+@@ -1035,7 +1036,8 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
+ }
+
+ static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu)
++ struct sk_buff *skb, u32 mtu,
++ bool confirm_neigh)
+ {
+ struct rtable *rt = (struct rtable *) dst;
+ struct flowi4 fl4;
+@@ -2559,7 +2561,8 @@ static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst)
+ }
+
+ static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu)
++ struct sk_buff *skb, u32 mtu,
++ bool confirm_neigh)
+ {
+ }
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index bfec48849735..5553f6a833f3 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -2020,13 +2020,14 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
+ struct tcp_iter_state *st = seq->private;
+ struct net *net = seq_file_net(seq);
+ struct inet_listen_hashbucket *ilb;
++ struct hlist_nulls_node *node;
+ struct sock *sk = cur;
+
+ if (!sk) {
+ get_head:
+ ilb = &tcp_hashinfo.listening_hash[st->bucket];
+ spin_lock(&ilb->lock);
+- sk = sk_head(&ilb->head);
++ sk = sk_nulls_head(&ilb->nulls_head);
+ st->offset = 0;
+ goto get_sk;
+ }
+@@ -2034,9 +2035,9 @@ get_head:
+ ++st->num;
+ ++st->offset;
+
+- sk = sk_next(sk);
++ sk = sk_nulls_next(sk);
+ get_sk:
+- sk_for_each_from(sk) {
++ sk_nulls_for_each_from(sk, node) {
+ if (!net_eq(sock_net(sk), net))
+ continue;
+ if (sk->sk_family == afinfo->family)
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index ad787e7882f7..1cc20edf4762 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -60,6 +60,9 @@ static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
+ __skb_unlink(skb, &sk->sk_write_queue);
+ tcp_rbtree_insert(&sk->tcp_rtx_queue, skb);
+
++ if (tp->highest_sack == NULL)
++ tp->highest_sack = skb;
++
+ tp->packets_out += tcp_skb_pcount(skb);
+ if (!prior_packets || icsk->icsk_pending == ICSK_TIME_LOSS_PROBE)
+ tcp_rearm_rto(sk);
+@@ -2373,6 +2376,14 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
+ if (tcp_small_queue_check(sk, skb, 0))
+ break;
+
++ /* Argh, we hit an empty skb(), presumably a thread
++ * is sleeping in sendmsg()/sk_stream_wait_memory().
++ * We do not want to send a pure-ack packet and have
++ * a strange looking rtx queue with empty packet(s).
++ */
++ if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq)
++ break;
++
+ if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp)))
+ break;
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 8877bd140a0d..2eeae0455b14 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1412,7 +1412,7 @@ int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb)
+ * queue contains some other skb
+ */
+ rmem = atomic_add_return(size, &sk->sk_rmem_alloc);
+- if (rmem > (size + sk->sk_rcvbuf))
++ if (rmem > (size + (unsigned int)sk->sk_rcvbuf))
+ goto uncharge_drop;
+
+ spin_lock(&list->lock);
+diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
+index 2b144b92ae46..1e5e2e4be0b2 100644
+--- a/net/ipv4/xfrm4_policy.c
++++ b/net/ipv4/xfrm4_policy.c
+@@ -222,12 +222,13 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
+ }
+
+ static void xfrm4_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu)
++ struct sk_buff *skb, u32 mtu,
++ bool confirm_neigh)
+ {
+ struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
+ struct dst_entry *path = xdst->route;
+
+- path->ops->update_pmtu(path, sk, skb, mtu);
++ path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh);
+ }
+
+ static void xfrm4_redirect(struct dst_entry *dst, struct sock *sk,
+diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
+index 9a31d13bf180..890adadcda16 100644
+--- a/net/ipv6/inet6_connection_sock.c
++++ b/net/ipv6/inet6_connection_sock.c
+@@ -150,7 +150,7 @@ struct dst_entry *inet6_csk_update_pmtu(struct sock *sk, u32 mtu)
+
+ if (IS_ERR(dst))
+ return NULL;
+- dst->ops->update_pmtu(dst, sk, NULL, mtu);
++ dst->ops->update_pmtu(dst, sk, NULL, mtu, true);
+
+ dst = inet6_csk_route_socket(sk, &fl6);
+ return IS_ERR(dst) ? NULL : dst;
+diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
+index 91d6ea937ffb..d9e2575dad94 100644
+--- a/net/ipv6/inet6_hashtables.c
++++ b/net/ipv6/inet6_hashtables.c
+@@ -171,6 +171,7 @@ struct sock *inet6_lookup_listener(struct net *net,
+ bool exact_dif = inet6_exact_dif_match(net, skb);
+ struct inet_listen_hashbucket *ilb2;
+ struct sock *sk, *result = NULL;
++ struct hlist_nulls_node *node;
+ int score, hiscore = 0;
+ unsigned int hash2;
+ u32 phash = 0;
+@@ -206,7 +207,7 @@ struct sock *inet6_lookup_listener(struct net *net,
+ goto done;
+
+ port_lookup:
+- sk_for_each(sk, &ilb->head) {
++ sk_nulls_for_each(sk, node, &ilb->nulls_head) {
+ score = compute_score(sk, net, hnum, daddr, dif, sdif, exact_dif);
+ if (score > hiscore) {
+ if (sk->sk_reuseport) {
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 8fd28edd6ac5..b3515a4f1303 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1060,7 +1060,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+
+ /* TooBig packet may have updated dst->dev's mtu */
+ if (!t->parms.collect_md && dst && dst_mtu(dst) > dst->dev->mtu)
+- dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu);
++ dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu, false);
+
+ err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
+ NEXTHDR_GRE);
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index d0ad85b8650d..e3b4237b2832 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -645,7 +645,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ if (rel_info > dst_mtu(skb_dst(skb2)))
+ goto out;
+
+- skb_dst_update_pmtu(skb2, rel_info);
++ skb_dst_update_pmtu_no_confirm(skb2, rel_info);
+ }
+
+ icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
+@@ -1137,7 +1137,7 @@ route_lookup:
+ mtu = max(mtu, skb->protocol == htons(ETH_P_IPV6) ?
+ IPV6_MIN_MTU : IPV4_MIN_MTU);
+
+- skb_dst_update_pmtu(skb, mtu);
++ skb_dst_update_pmtu_no_confirm(skb, mtu);
+ if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) {
+ *pmtu = mtu;
+ err = -EMSGSIZE;
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 8b6eefff2f7e..bfd39db3398a 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -483,7 +483,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+
+ mtu = dst_mtu(dst);
+ if (skb->len > mtu) {
+- skb_dst_update_pmtu(skb, mtu);
++ skb_dst_update_pmtu_no_confirm(skb, mtu);
+
+ if (skb->protocol == htons(ETH_P_IPV6)) {
+ if (mtu < IPV6_MIN_MTU)
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 076c21f6a645..f8fe4c9ead4d 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -99,7 +99,8 @@ static int ip6_pkt_prohibit(struct sk_buff *skb);
+ static int ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb);
+ static void ip6_link_failure(struct sk_buff *skb);
+ static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu);
++ struct sk_buff *skb, u32 mtu,
++ bool confirm_neigh);
+ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk,
+ struct sk_buff *skb);
+ static int rt6_score_route(struct fib6_info *rt, int oif, int strict);
+@@ -266,7 +267,8 @@ static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst)
+ }
+
+ static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu)
++ struct sk_buff *skb, u32 mtu,
++ bool confirm_neigh)
+ {
+ }
+
+@@ -2352,7 +2354,8 @@ static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt)
+ }
+
+ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
+- const struct ipv6hdr *iph, u32 mtu)
++ const struct ipv6hdr *iph, u32 mtu,
++ bool confirm_neigh)
+ {
+ const struct in6_addr *daddr, *saddr;
+ struct rt6_info *rt6 = (struct rt6_info *)dst;
+@@ -2370,7 +2373,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
+ daddr = NULL;
+ saddr = NULL;
+ }
+- dst_confirm_neigh(dst, daddr);
++
++ if (confirm_neigh)
++ dst_confirm_neigh(dst, daddr);
++
+ mtu = max_t(u32, mtu, IPV6_MIN_MTU);
+ if (mtu >= dst_mtu(dst))
+ return;
+@@ -2401,9 +2407,11 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
+ }
+
+ static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu)
++ struct sk_buff *skb, u32 mtu,
++ bool confirm_neigh)
+ {
+- __ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu);
++ __ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu,
++ confirm_neigh);
+ }
+
+ void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
+@@ -2423,7 +2431,7 @@ void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
+
+ dst = ip6_route_output(net, NULL, &fl6);
+ if (!dst->error)
+- __ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu));
++ __ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu), true);
+ dst_release(dst);
+ }
+ EXPORT_SYMBOL_GPL(ip6_update_pmtu);
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 41b3fe8ac3bc..bfed7508ba19 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -943,7 +943,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
+ }
+
+ if (tunnel->parms.iph.daddr)
+- skb_dst_update_pmtu(skb, mtu);
++ skb_dst_update_pmtu_no_confirm(skb, mtu);
+
+ if (skb->len > mtu && !skb_is_gso(skb)) {
+ icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
+index d35bcf92969c..30232591cf2b 100644
+--- a/net/ipv6/xfrm6_policy.c
++++ b/net/ipv6/xfrm6_policy.c
+@@ -221,12 +221,13 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
+ }
+
+ static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu)
++ struct sk_buff *skb, u32 mtu,
++ bool confirm_neigh)
+ {
+ struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
+ struct dst_entry *path = xdst->route;
+
+- path->ops->update_pmtu(path, sk, skb, mtu);
++ path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh);
+ }
+
+ static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk,
+diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
+index 473cce2a5231..3f75cd947045 100644
+--- a/net/netfilter/ipvs/ip_vs_xmit.c
++++ b/net/netfilter/ipvs/ip_vs_xmit.c
+@@ -209,7 +209,7 @@ static inline void maybe_update_pmtu(int skb_af, struct sk_buff *skb, int mtu)
+ struct rtable *ort = skb_rtable(skb);
+
+ if (!skb->dev && sk && sk_fullsock(sk))
+- ort->dst.ops->update_pmtu(&ort->dst, sk, NULL, mtu);
++ ort->dst.ops->update_pmtu(&ort->dst, sk, NULL, mtu, true);
+ }
+
+ static inline bool ensure_mtu_is_adequate(struct netns_ipvs *ipvs, int skb_af,
+diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
+index a96a8c16baf9..ee6d98355081 100644
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -174,7 +174,7 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
+ goto err;
+ }
+
+- if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) {
++ if (skb_dst(skb) && !skb_dst_force(skb)) {
+ status = -ENETDOWN;
+ goto err;
+ }
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c
+index ad158d311ffa..c0d55ed62d2e 100644
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -278,7 +278,7 @@ bool sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
+
+ pf->af->from_sk(&addr, sk);
+ pf->to_sk_daddr(&t->ipaddr, sk);
+- dst->ops->update_pmtu(dst, sk, NULL, pmtu);
++ dst->ops->update_pmtu(dst, sk, NULL, pmtu, true);
+ pf->to_sk_daddr(&addr, sk);
+
+ dst = sctp_transport_dst_check(t);
+diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
+index 31ed7f3f0e15..4b2711c23f4e 100644
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -491,6 +491,8 @@ static void build_initial_tok_table(void)
+ table[pos] = table[i];
+ learn_symbol(table[pos].sym, table[pos].len);
+ pos++;
++ } else {
++ free(table[i].sym);
+ }
+ }
+ table_cnt = pos;
+diff --git a/security/apparmor/label.c b/security/apparmor/label.c
+index ba11bdf9043a..2469549842d2 100644
+--- a/security/apparmor/label.c
++++ b/security/apparmor/label.c
+@@ -1462,11 +1462,13 @@ static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
+ /* helper macro for snprint routines */
+ #define update_for_len(total, len, size, str) \
+ do { \
++ size_t ulen = len; \
++ \
+ AA_BUG(len < 0); \
+- total += len; \
+- len = min(len, size); \
+- size -= len; \
+- str += len; \
++ total += ulen; \
++ ulen = min(ulen, size); \
++ size -= ulen; \
++ str += ulen; \
+ } while (0)
+
+ /**
+@@ -1601,7 +1603,7 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
+ struct aa_ns *prev_ns = NULL;
+ struct label_it i;
+ int count = 0, total = 0;
+- size_t len;
++ ssize_t len;
+
+ AA_BUG(!str && size != 0);
+ AA_BUG(!label);
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index 8fcb421193e0..fa261b27d858 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -883,7 +883,7 @@ static int azx_rirb_get_response(struct hdac_bus *bus, unsigned int addr,
+ return -EAGAIN; /* give a chance to retry */
+ }
+
+- dev_WARN(chip->card->dev,
++ dev_err(chip->card->dev,
+ "azx_get_response timeout, switching to single_cmd mode: last cmd=0x%08x\n",
+ bus->last_cmd[addr]);
+ chip->single_cmd = 1;
+diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
+index a4c78499c838..1200973c77cb 100644
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -428,7 +428,7 @@ static int perf_evsel__check_attr(struct perf_evsel *evsel,
+ "selected. Hence, no address to lookup the source line number.\n");
+ return -EINVAL;
+ }
+- if (PRINT_FIELD(BRSTACKINSN) &&
++ if (PRINT_FIELD(BRSTACKINSN) && !allow_user_set &&
+ !(perf_evlist__combined_branch_type(session->evlist) &
+ PERF_SAMPLE_BRANCH_ANY)) {
+ pr_err("Display of branch stack assembler requested, but non all-branch filter set\n"
+diff --git a/tools/perf/util/perf_regs.h b/tools/perf/util/perf_regs.h
+index c9319f8d17a6..f732e3af2bd4 100644
+--- a/tools/perf/util/perf_regs.h
++++ b/tools/perf/util/perf_regs.h
+@@ -34,7 +34,7 @@ int perf_reg_value(u64 *valp, struct regs_dump *regs, int id);
+
+ static inline const char *perf_reg_name(int id __maybe_unused)
+ {
+- return NULL;
++ return "unknown";
+ }
+
+ static inline int perf_reg_value(u64 *valp __maybe_unused,
+diff --git a/tools/perf/util/strbuf.c b/tools/perf/util/strbuf.c
+index 9005fbe0780e..23092fd6451d 100644
+--- a/tools/perf/util/strbuf.c
++++ b/tools/perf/util/strbuf.c
+@@ -109,7 +109,6 @@ static int strbuf_addv(struct strbuf *sb, const char *fmt, va_list ap)
+ return ret;
+ }
+ len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap_saved);
+- va_end(ap_saved);
+ if (len > strbuf_avail(sb)) {
+ pr_debug("this should not happen, your vsnprintf is broken");
+ va_end(ap_saved);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-01-09 11:15 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-01-09 11:15 UTC (permalink / raw
To: gentoo-commits
commit: 754b21641176c91012ec25b458b4d7d40efab80b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jan 9 11:15:33 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jan 9 11:15:33 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=754b2164
Linux patch 4.19.94
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1093_linux-4.19.94.patch | 4602 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4606 insertions(+)
diff --git a/0000_README b/0000_README
index bedb928..a11cb8a 100644
--- a/0000_README
+++ b/0000_README
@@ -411,6 +411,10 @@ Patch: 1092_linux-4.19.93.patch
From: https://www.kernel.org
Desc: Linux 4.19.93
+Patch: 1093_linux-4.19.94.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.94
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1093_linux-4.19.94.patch b/1093_linux-4.19.94.patch
new file mode 100644
index 0000000..34de981
--- /dev/null
+++ b/1093_linux-4.19.94.patch
@@ -0,0 +1,4602 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 2c0d6ae221a1..e6b6ec974eeb 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -113,7 +113,7 @@
+ the GPE dispatcher.
+ This facility can be used to prevent such uncontrolled
+ GPE floodings.
+- Format: <int>
++ Format: <byte>
+
+ acpi_no_auto_serialize [HW,ACPI]
+ Disable auto-serialization of AML methods
+diff --git a/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt b/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt
+index e96e085271c1..83f6c6a7c41c 100644
+--- a/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt
++++ b/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt
+@@ -46,7 +46,7 @@ Required properties:
+ Example (R-Car H3):
+
+ usb2_clksel: clock-controller@e6590630 {
+- compatible = "renesas,r8a77950-rcar-usb2-clock-sel",
++ compatible = "renesas,r8a7795-rcar-usb2-clock-sel",
+ "renesas,rcar-gen3-usb2-clock-sel";
+ reg = <0 0xe6590630 0 0x02>;
+ clocks = <&cpg CPG_MOD 703>, <&usb_extal>, <&usb_xtal>;
+diff --git a/Makefile b/Makefile
+index b3b166c93125..3c892a77194f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 93
++SUBLEVEL = 94
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+index 00f7be6d83f7..09a27e066d8e 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+@@ -293,7 +293,7 @@
+ };
+
+ &usb0_phy {
+- status = "okay";
++ status = "disabled";
+ phy-supply = <&usb_otg_pwr>;
+ };
+
+@@ -303,7 +303,7 @@
+ };
+
+ &usb0 {
+- status = "okay";
++ status = "disabled";
+ };
+
+ &usb1 {
+diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h
+index e060c2746f36..5be015e2133a 100644
+--- a/arch/arm64/include/asm/pgtable-prot.h
++++ b/arch/arm64/include/asm/pgtable-prot.h
+@@ -96,13 +96,12 @@
+ #define PAGE_SHARED_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_WRITE)
+ #define PAGE_READONLY __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN)
+ #define PAGE_READONLY_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN)
+-#define PAGE_EXECONLY __pgprot(_PAGE_DEFAULT | PTE_RDONLY | PTE_NG | PTE_PXN)
+
+ #define __P000 PAGE_NONE
+ #define __P001 PAGE_READONLY
+ #define __P010 PAGE_READONLY
+ #define __P011 PAGE_READONLY
+-#define __P100 PAGE_EXECONLY
++#define __P100 PAGE_READONLY_EXEC
+ #define __P101 PAGE_READONLY_EXEC
+ #define __P110 PAGE_READONLY_EXEC
+ #define __P111 PAGE_READONLY_EXEC
+@@ -111,7 +110,7 @@
+ #define __S001 PAGE_READONLY
+ #define __S010 PAGE_SHARED
+ #define __S011 PAGE_SHARED
+-#define __S100 PAGE_EXECONLY
++#define __S100 PAGE_READONLY_EXEC
+ #define __S101 PAGE_READONLY_EXEC
+ #define __S110 PAGE_SHARED_EXEC
+ #define __S111 PAGE_SHARED_EXEC
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 7ae553c15b9a..291fed0a9df8 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -105,12 +105,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ #define pte_dirty(pte) (pte_sw_dirty(pte) || pte_hw_dirty(pte))
+
+ #define pte_valid(pte) (!!(pte_val(pte) & PTE_VALID))
+-/*
+- * Execute-only user mappings do not have the PTE_USER bit set. All valid
+- * kernel mappings have the PTE_UXN bit set.
+- */
+ #define pte_valid_not_user(pte) \
+- ((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN))
++ ((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID)
+ #define pte_valid_young(pte) \
+ ((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF))
+ #define pte_valid_user(pte) \
+@@ -126,8 +122,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+
+ /*
+ * p??_access_permitted() is true for valid user mappings (subject to the
+- * write permission check) other than user execute-only which do not have the
+- * PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set.
++ * write permission check). PROT_NONE mappings do not have the PTE_VALID bit
++ * set.
+ */
+ #define pte_access_permitted(pte, write) \
+ (pte_valid_user(pte) && (!(write) || pte_write(pte)))
+diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
+index 88cf0a0cb616..b046006a387f 100644
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -428,7 +428,7 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
+ struct mm_struct *mm;
+ struct siginfo si;
+ vm_fault_t fault, major = 0;
+- unsigned long vm_flags = VM_READ | VM_WRITE;
++ unsigned long vm_flags = VM_READ | VM_WRITE | VM_EXEC;
+ unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+
+ if (notify_page_fault(regs, esr))
+diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
+index 4993db40482c..ee26f9a4575d 100644
+--- a/arch/mips/include/asm/thread_info.h
++++ b/arch/mips/include/asm/thread_info.h
+@@ -49,8 +49,26 @@ struct thread_info {
+ .addr_limit = KERNEL_DS, \
+ }
+
+-/* How to get the thread information struct from C. */
++/*
++ * A pointer to the struct thread_info for the currently executing thread is
++ * held in register $28/$gp.
++ *
++ * We declare __current_thread_info as a global register variable rather than a
++ * local register variable within current_thread_info() because clang doesn't
++ * support explicit local register variables.
++ *
++ * When building the VDSO we take care not to declare the global register
++ * variable because this causes GCC to not preserve the value of $28/$gp in
++ * functions that change its value (which is common in the PIC VDSO when
++ * accessing the GOT). Since the VDSO shouldn't be accessing
++ * __current_thread_info anyway we declare it extern in order to cause a link
++ * failure if it's referenced.
++ */
++#ifdef __VDSO__
++extern struct thread_info *__current_thread_info;
++#else
+ register struct thread_info *__current_thread_info __asm__("$28");
++#endif
+
+ static inline struct thread_info *current_thread_info(void)
+ {
+diff --git a/arch/powerpc/include/asm/kvm_ppc.h b/arch/powerpc/include/asm/kvm_ppc.h
+index e991821dd7fa..a061c3d48c48 100644
+--- a/arch/powerpc/include/asm/kvm_ppc.h
++++ b/arch/powerpc/include/asm/kvm_ppc.h
+@@ -458,9 +458,100 @@ static inline u32 kvmppc_get_xics_latch(void)
+ return xirr;
+ }
+
+-static inline void kvmppc_set_host_ipi(int cpu, u8 host_ipi)
++/*
++ * To avoid the need to unnecessarily exit fully to the host kernel, an IPI to
++ * a CPU thread that's running/napping inside of a guest is by default regarded
++ * as a request to wake the CPU (if needed) and continue execution within the
++ * guest, potentially to process new state like externally-generated
++ * interrupts or IPIs sent from within the guest itself (e.g. H_PROD/H_IPI).
++ *
++ * To force an exit to the host kernel, kvmppc_set_host_ipi() must be called
++ * prior to issuing the IPI to set the corresponding 'host_ipi' flag in the
++ * target CPU's PACA. To avoid unnecessary exits to the host, this flag should
++ * be immediately cleared via kvmppc_clear_host_ipi() by the IPI handler on
++ * the receiving side prior to processing the IPI work.
++ *
++ * NOTE:
++ *
++ * We currently issue an smp_mb() at the beginning of kvmppc_set_host_ipi().
++ * This is to guard against sequences such as the following:
++ *
++ * CPU
++ * X: smp_muxed_ipi_set_message():
++ * X: smp_mb()
++ * X: message[RESCHEDULE] = 1
++ * X: doorbell_global_ipi(42):
++ * X: kvmppc_set_host_ipi(42)
++ * X: ppc_msgsnd_sync()/smp_mb()
++ * X: ppc_msgsnd() -> 42
++ * 42: doorbell_exception(): // from CPU X
++ * 42: ppc_msgsync()
++ * 105: smp_muxed_ipi_set_message():
++ * 105: smb_mb()
++ * // STORE DEFERRED DUE TO RE-ORDERING
++ * --105: message[CALL_FUNCTION] = 1
++ * | 105: doorbell_global_ipi(42):
++ * | 105: kvmppc_set_host_ipi(42)
++ * | 42: kvmppc_clear_host_ipi(42)
++ * | 42: smp_ipi_demux_relaxed()
++ * | 42: // returns to executing guest
++ * | // RE-ORDERED STORE COMPLETES
++ * ->105: message[CALL_FUNCTION] = 1
++ * 105: ppc_msgsnd_sync()/smp_mb()
++ * 105: ppc_msgsnd() -> 42
++ * 42: local_paca->kvm_hstate.host_ipi == 0 // IPI ignored
++ * 105: // hangs waiting on 42 to process messages/call_single_queue
++ *
++ * We also issue an smp_mb() at the end of kvmppc_clear_host_ipi(). This is
++ * to guard against sequences such as the following (as well as to create
++ * a read-side pairing with the barrier in kvmppc_set_host_ipi()):
++ *
++ * CPU
++ * X: smp_muxed_ipi_set_message():
++ * X: smp_mb()
++ * X: message[RESCHEDULE] = 1
++ * X: doorbell_global_ipi(42):
++ * X: kvmppc_set_host_ipi(42)
++ * X: ppc_msgsnd_sync()/smp_mb()
++ * X: ppc_msgsnd() -> 42
++ * 42: doorbell_exception(): // from CPU X
++ * 42: ppc_msgsync()
++ * // STORE DEFERRED DUE TO RE-ORDERING
++ * -- 42: kvmppc_clear_host_ipi(42)
++ * | 42: smp_ipi_demux_relaxed()
++ * | 105: smp_muxed_ipi_set_message():
++ * | 105: smb_mb()
++ * | 105: message[CALL_FUNCTION] = 1
++ * | 105: doorbell_global_ipi(42):
++ * | 105: kvmppc_set_host_ipi(42)
++ * | // RE-ORDERED STORE COMPLETES
++ * -> 42: kvmppc_clear_host_ipi(42)
++ * 42: // returns to executing guest
++ * 105: ppc_msgsnd_sync()/smp_mb()
++ * 105: ppc_msgsnd() -> 42
++ * 42: local_paca->kvm_hstate.host_ipi == 0 // IPI ignored
++ * 105: // hangs waiting on 42 to process messages/call_single_queue
++ */
++static inline void kvmppc_set_host_ipi(int cpu)
+ {
+- paca_ptrs[cpu]->kvm_hstate.host_ipi = host_ipi;
++ /*
++ * order stores of IPI messages vs. setting of host_ipi flag
++ *
++ * pairs with the barrier in kvmppc_clear_host_ipi()
++ */
++ smp_mb();
++ paca_ptrs[cpu]->kvm_hstate.host_ipi = 1;
++}
++
++static inline void kvmppc_clear_host_ipi(int cpu)
++{
++ paca_ptrs[cpu]->kvm_hstate.host_ipi = 0;
++ /*
++ * order clearing of host_ipi flag vs. processing of IPI messages
++ *
++ * pairs with the barrier in kvmppc_set_host_ipi()
++ */
++ smp_mb();
+ }
+
+ static inline void kvmppc_fast_vcpu_kick(struct kvm_vcpu *vcpu)
+@@ -489,7 +580,10 @@ static inline u32 kvmppc_get_xics_latch(void)
+ return 0;
+ }
+
+-static inline void kvmppc_set_host_ipi(int cpu, u8 host_ipi)
++static inline void kvmppc_set_host_ipi(int cpu)
++{}
++
++static inline void kvmppc_clear_host_ipi(int cpu)
+ {}
+
+ static inline void kvmppc_fast_vcpu_kick(struct kvm_vcpu *vcpu)
+diff --git a/arch/powerpc/kernel/dbell.c b/arch/powerpc/kernel/dbell.c
+index b6fe883b1016..5828144555af 100644
+--- a/arch/powerpc/kernel/dbell.c
++++ b/arch/powerpc/kernel/dbell.c
+@@ -36,7 +36,7 @@ void doorbell_global_ipi(int cpu)
+ {
+ u32 tag = get_hard_smp_processor_id(cpu);
+
+- kvmppc_set_host_ipi(cpu, 1);
++ kvmppc_set_host_ipi(cpu);
+ /* Order previous accesses vs. msgsnd, which is treated as a store */
+ ppc_msgsnd_sync();
+ ppc_msgsnd(PPC_DBELL_MSGTYPE, 0, tag);
+@@ -51,7 +51,7 @@ void doorbell_core_ipi(int cpu)
+ {
+ u32 tag = cpu_thread_in_core(cpu);
+
+- kvmppc_set_host_ipi(cpu, 1);
++ kvmppc_set_host_ipi(cpu);
+ /* Order previous accesses vs. msgsnd, which is treated as a store */
+ ppc_msgsnd_sync();
+ ppc_msgsnd(PPC_DBELL_MSGTYPE, 0, tag);
+@@ -86,7 +86,7 @@ void doorbell_exception(struct pt_regs *regs)
+
+ may_hard_irq_enable();
+
+- kvmppc_set_host_ipi(smp_processor_id(), 0);
++ kvmppc_clear_host_ipi(smp_processor_id());
+ __this_cpu_inc(irq_stat.doorbell_irqs);
+
+ smp_ipi_demux_relaxed(); /* already performed the barrier */
+diff --git a/arch/powerpc/kvm/book3s_hv_rm_xics.c b/arch/powerpc/kvm/book3s_hv_rm_xics.c
+index 758d1d23215e..aaafb9f080d5 100644
+--- a/arch/powerpc/kvm/book3s_hv_rm_xics.c
++++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c
+@@ -61,7 +61,7 @@ static inline void icp_send_hcore_msg(int hcore, struct kvm_vcpu *vcpu)
+ hcpu = hcore << threads_shift;
+ kvmppc_host_rm_ops_hv->rm_core[hcore].rm_data = vcpu;
+ smp_muxed_ipi_set_message(hcpu, PPC_MSG_RM_HOST_ACTION);
+- kvmppc_set_host_ipi(hcpu, 1);
++ kvmppc_set_host_ipi(hcpu);
+ smp_mb();
+ kvmhv_rm_send_ipi(hcpu);
+ }
+diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
+index fdd9577d1798..3d3c989e44dd 100644
+--- a/arch/powerpc/platforms/powernv/smp.c
++++ b/arch/powerpc/platforms/powernv/smp.c
+@@ -223,7 +223,7 @@ static void pnv_smp_cpu_kill_self(void)
+ * for coming online, which are handled via
+ * generic_check_cpu_restart() calls.
+ */
+- kvmppc_set_host_ipi(cpu, 0);
++ kvmppc_clear_host_ipi(cpu);
+
+ srr1 = pnv_cpu_offline(cpu);
+
+diff --git a/arch/powerpc/platforms/pseries/hvconsole.c b/arch/powerpc/platforms/pseries/hvconsole.c
+index 74da18de853a..73ec15cd2708 100644
+--- a/arch/powerpc/platforms/pseries/hvconsole.c
++++ b/arch/powerpc/platforms/pseries/hvconsole.c
+@@ -62,7 +62,7 @@ EXPORT_SYMBOL(hvc_get_chars);
+ * @vtermno: The vtermno or unit_address of the adapter from which the data
+ * originated.
+ * @buf: The character buffer that contains the character data to send to
+- * firmware.
++ * firmware. Must be at least 16 bytes, even if count is less than 16.
+ * @count: Send this number of characters.
+ */
+ int hvc_put_chars(uint32_t vtermno, const char *buf, int count)
+diff --git a/arch/powerpc/sysdev/xics/icp-native.c b/arch/powerpc/sysdev/xics/icp-native.c
+index 37bfbc54aacb..340de58a15bd 100644
+--- a/arch/powerpc/sysdev/xics/icp-native.c
++++ b/arch/powerpc/sysdev/xics/icp-native.c
+@@ -145,7 +145,7 @@ static unsigned int icp_native_get_irq(void)
+
+ static void icp_native_cause_ipi(int cpu)
+ {
+- kvmppc_set_host_ipi(cpu, 1);
++ kvmppc_set_host_ipi(cpu);
+ icp_native_set_qirr(cpu, IPI_PRIORITY);
+ }
+
+@@ -184,7 +184,7 @@ void icp_native_flush_interrupt(void)
+ if (vec == XICS_IPI) {
+ /* Clear pending IPI */
+ int cpu = smp_processor_id();
+- kvmppc_set_host_ipi(cpu, 0);
++ kvmppc_clear_host_ipi(cpu);
+ icp_native_set_qirr(cpu, 0xff);
+ } else {
+ pr_err("XICS: hw interrupt 0x%x to offline cpu, disabling\n",
+@@ -205,7 +205,7 @@ static irqreturn_t icp_native_ipi_action(int irq, void *dev_id)
+ {
+ int cpu = smp_processor_id();
+
+- kvmppc_set_host_ipi(cpu, 0);
++ kvmppc_clear_host_ipi(cpu);
+ icp_native_set_qirr(cpu, 0xff);
+
+ return smp_ipi_demux();
+diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
+index c71d2ea42627..e3e52cf035a9 100644
+--- a/arch/powerpc/sysdev/xics/icp-opal.c
++++ b/arch/powerpc/sysdev/xics/icp-opal.c
+@@ -130,7 +130,7 @@ static void icp_opal_cause_ipi(int cpu)
+ {
+ int hw_cpu = get_hard_smp_processor_id(cpu);
+
+- kvmppc_set_host_ipi(cpu, 1);
++ kvmppc_set_host_ipi(cpu);
+ opal_int_set_mfrr(hw_cpu, IPI_PRIORITY);
+ }
+
+@@ -138,7 +138,7 @@ static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id)
+ {
+ int cpu = smp_processor_id();
+
+- kvmppc_set_host_ipi(cpu, 0);
++ kvmppc_clear_host_ipi(cpu);
+ opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
+
+ return smp_ipi_demux();
+@@ -161,7 +161,7 @@ void icp_opal_flush_interrupt(void)
+ if (vec == XICS_IPI) {
+ /* Clear pending IPI */
+ int cpu = smp_processor_id();
+- kvmppc_set_host_ipi(cpu, 0);
++ kvmppc_clear_host_ipi(cpu);
+ opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
+ } else {
+ pr_err("XICS: hw interrupt 0x%x to offline cpu, "
+diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c
+index a840b7d074f7..6d39f64e4dce 100644
+--- a/arch/riscv/kernel/ftrace.c
++++ b/arch/riscv/kernel/ftrace.c
+@@ -142,7 +142,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+ */
+ old = *parent;
+
+- if (function_graph_enter(old, self_addr, frame_pointer, parent))
++ if (!function_graph_enter(old, self_addr, frame_pointer, parent))
+ *parent = return_hooker;
+ }
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index 5c3fd9032b74..5bfb1ce129f4 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -1261,18 +1261,28 @@ static void hw_perf_event_update(struct perf_event *event, int flush_all)
+ */
+ if (flush_all && done)
+ break;
+-
+- /* If an event overflow happened, discard samples by
+- * processing any remaining sample-data-blocks.
+- */
+- if (event_overflow)
+- flush_all = 1;
+ }
+
+ /* Account sample overflows in the event hardware structure */
+ if (sampl_overflow)
+ OVERFLOW_REG(hwc) = DIV_ROUND_UP(OVERFLOW_REG(hwc) +
+ sampl_overflow, 1 + num_sdb);
++
++ /* Perf_event_overflow() and perf_event_account_interrupt() limit
++ * the interrupt rate to an upper limit. Roughly 1000 samples per
++ * task tick.
++ * Hitting this limit results in a large number
++ * of throttled REF_REPORT_THROTTLE entries and the samples
++ * are dropped.
++ * Slightly increase the interval to avoid hitting this limit.
++ */
++ if (event_overflow) {
++ SAMPL_RATE(hwc) += DIV_ROUND_UP(SAMPL_RATE(hwc), 10);
++ debug_sprintf_event(sfdbg, 1, "%s: rate adjustment %ld\n",
++ __func__,
++ DIV_ROUND_UP(SAMPL_RATE(hwc), 10));
++ }
++
+ if (sampl_overflow || event_overflow)
+ debug_sprintf_event(sfdbg, 4, "hw_perf_event_update: "
+ "overflow stats: sample=%llu event=%llu\n",
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index df2413f26a8f..ecd24711f3aa 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -715,39 +715,67 @@ static void __ref smp_get_core_info(struct sclp_core_info *info, int early)
+
+ static int smp_add_present_cpu(int cpu);
+
+-static int __smp_rescan_cpus(struct sclp_core_info *info, int sysfs_add)
++static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail,
++ bool configured, bool early)
+ {
+ struct pcpu *pcpu;
+- cpumask_t avail;
+- int cpu, nr, i, j;
++ int cpu, nr, i;
+ u16 address;
+
+ nr = 0;
+- cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask);
+- cpu = cpumask_first(&avail);
+- for (i = 0; (i < info->combined) && (cpu < nr_cpu_ids); i++) {
+- if (sclp.has_core_type && info->core[i].type != boot_core_type)
++ if (sclp.has_core_type && core->type != boot_core_type)
++ return nr;
++ cpu = cpumask_first(avail);
++ address = core->core_id << smp_cpu_mt_shift;
++ for (i = 0; (i <= smp_cpu_mtid) && (cpu < nr_cpu_ids); i++) {
++ if (pcpu_find_address(cpu_present_mask, address + i))
+ continue;
+- address = info->core[i].core_id << smp_cpu_mt_shift;
+- for (j = 0; j <= smp_cpu_mtid; j++) {
+- if (pcpu_find_address(cpu_present_mask, address + j))
+- continue;
+- pcpu = pcpu_devices + cpu;
+- pcpu->address = address + j;
+- pcpu->state =
+- (cpu >= info->configured*(smp_cpu_mtid + 1)) ?
+- CPU_STATE_STANDBY : CPU_STATE_CONFIGURED;
+- smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
+- set_cpu_present(cpu, true);
+- if (sysfs_add && smp_add_present_cpu(cpu) != 0)
+- set_cpu_present(cpu, false);
+- else
+- nr++;
+- cpu = cpumask_next(cpu, &avail);
+- if (cpu >= nr_cpu_ids)
++ pcpu = pcpu_devices + cpu;
++ pcpu->address = address + i;
++ if (configured)
++ pcpu->state = CPU_STATE_CONFIGURED;
++ else
++ pcpu->state = CPU_STATE_STANDBY;
++ smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
++ set_cpu_present(cpu, true);
++ if (!early && smp_add_present_cpu(cpu) != 0)
++ set_cpu_present(cpu, false);
++ else
++ nr++;
++ cpumask_clear_cpu(cpu, avail);
++ cpu = cpumask_next(cpu, avail);
++ }
++ return nr;
++}
++
++static int __smp_rescan_cpus(struct sclp_core_info *info, bool early)
++{
++ struct sclp_core_entry *core;
++ cpumask_t avail;
++ bool configured;
++ u16 core_id;
++ int nr, i;
++
++ nr = 0;
++ cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask);
++ /*
++ * Add IPL core first (which got logical CPU number 0) to make sure
++ * that all SMT threads get subsequent logical CPU numbers.
++ */
++ if (early) {
++ core_id = pcpu_devices[0].address >> smp_cpu_mt_shift;
++ for (i = 0; i < info->configured; i++) {
++ core = &info->core[i];
++ if (core->core_id == core_id) {
++ nr += smp_add_core(core, &avail, true, early);
+ break;
++ }
+ }
+ }
++ for (i = 0; i < info->combined; i++) {
++ configured = i < info->configured;
++ nr += smp_add_core(&info->core[i], &avail, configured, early);
++ }
+ return nr;
+ }
+
+@@ -793,7 +821,7 @@ void __init smp_detect_cpus(void)
+
+ /* Add CPUs present at boot */
+ get_online_cpus();
+- __smp_rescan_cpus(info, 0);
++ __smp_rescan_cpus(info, true);
+ put_online_cpus();
+ memblock_free_early((unsigned long)info, sizeof(*info));
+ }
+@@ -1145,7 +1173,7 @@ int __ref smp_rescan_cpus(void)
+ smp_get_core_info(info, 0);
+ get_online_cpus();
+ mutex_lock(&smp_cpu_state_mutex);
+- nr = __smp_rescan_cpus(info, 1);
++ nr = __smp_rescan_cpus(info, false);
+ mutex_unlock(&smp_cpu_state_mutex);
+ put_online_cpus();
+ kfree(info);
+diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
+index 7139f6bf27ad..510f9461407e 100644
+--- a/arch/x86/events/intel/bts.c
++++ b/arch/x86/events/intel/bts.c
+@@ -71,9 +71,17 @@ struct bts_buffer {
+
+ static struct pmu bts_pmu;
+
++static int buf_nr_pages(struct page *page)
++{
++ if (!PagePrivate(page))
++ return 1;
++
++ return 1 << page_private(page);
++}
++
+ static size_t buf_size(struct page *page)
+ {
+- return 1 << (PAGE_SHIFT + page_private(page));
++ return buf_nr_pages(page) * PAGE_SIZE;
+ }
+
+ static void *
+@@ -91,9 +99,7 @@ bts_buffer_setup_aux(struct perf_event *event, void **pages,
+ /* count all the high order buffers */
+ for (pg = 0, nbuf = 0; pg < nr_pages;) {
+ page = virt_to_page(pages[pg]);
+- if (WARN_ON_ONCE(!PagePrivate(page) && nr_pages > 1))
+- return NULL;
+- pg += 1 << page_private(page);
++ pg += buf_nr_pages(page);
+ nbuf++;
+ }
+
+@@ -117,7 +123,7 @@ bts_buffer_setup_aux(struct perf_event *event, void **pages,
+ unsigned int __nr_pages;
+
+ page = virt_to_page(pages[pg]);
+- __nr_pages = PagePrivate(page) ? 1 << page_private(page) : 1;
++ __nr_pages = buf_nr_pages(page);
+ buf->buf[nbuf].page = page;
+ buf->buf[nbuf].offset = offset;
+ buf->buf[nbuf].displacement = (pad ? BTS_RECORD_SIZE - pad : 0);
+diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
+index 6ca015f92766..6490b2759bcb 100644
+--- a/block/compat_ioctl.c
++++ b/block/compat_ioctl.c
+@@ -6,6 +6,7 @@
+ #include <linux/compat.h>
+ #include <linux/elevator.h>
+ #include <linux/hdreg.h>
++#include <linux/pr.h>
+ #include <linux/slab.h>
+ #include <linux/syscalls.h>
+ #include <linux/types.h>
+@@ -354,6 +355,8 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+ * but we call blkdev_ioctl, which gets the lock for us
+ */
+ case BLKRRPART:
++ case BLKREPORTZONE:
++ case BLKRESETZONE:
+ return blkdev_ioctl(bdev, mode, cmd,
+ (unsigned long)compat_ptr(arg));
+ case BLKBSZSET_32:
+@@ -401,6 +404,14 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+ case BLKTRACETEARDOWN: /* compatible */
+ ret = blk_trace_ioctl(bdev, cmd, compat_ptr(arg));
+ return ret;
++ case IOC_PR_REGISTER:
++ case IOC_PR_RESERVE:
++ case IOC_PR_RELEASE:
++ case IOC_PR_PREEMPT:
++ case IOC_PR_PREEMPT_ABORT:
++ case IOC_PR_CLEAR:
++ return blkdev_ioctl(bdev, mode, cmd,
++ (unsigned long)compat_ptr(arg));
+ default:
+ if (disk->fops->compat_ioctl)
+ ret = disk->fops->compat_ioctl(bdev, mode, cmd, arg);
+diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
+index 41324f0b1bee..f8150c7bfe88 100644
+--- a/drivers/acpi/sysfs.c
++++ b/drivers/acpi/sysfs.c
+@@ -816,14 +816,14 @@ end:
+ * interface:
+ * echo unmask > /sys/firmware/acpi/interrupts/gpe00
+ */
+-#define ACPI_MASKABLE_GPE_MAX 0xFF
++#define ACPI_MASKABLE_GPE_MAX 0x100
+ static DECLARE_BITMAP(acpi_masked_gpes_map, ACPI_MASKABLE_GPE_MAX) __initdata;
+
+ static int __init acpi_gpe_set_masked_gpes(char *val)
+ {
+ u8 gpe;
+
+- if (kstrtou8(val, 0, &gpe) || gpe > ACPI_MASKABLE_GPE_MAX)
++ if (kstrtou8(val, 0, &gpe))
+ return -EINVAL;
+ set_bit(gpe, acpi_masked_gpes_map);
+
+@@ -835,7 +835,7 @@ void __init acpi_gpe_apply_masked_gpes(void)
+ {
+ acpi_handle handle;
+ acpi_status status;
+- u8 gpe;
++ u16 gpe;
+
+ for_each_set_bit(gpe, acpi_masked_gpes_map, ACPI_MASKABLE_GPE_MAX) {
+ status = acpi_get_gpe_device(gpe, &handle);
+diff --git a/drivers/ata/ahci_brcm.c b/drivers/ata/ahci_brcm.c
+index f3d557777d82..0192cab1b862 100644
+--- a/drivers/ata/ahci_brcm.c
++++ b/drivers/ata/ahci_brcm.c
+@@ -25,6 +25,7 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
++#include <linux/reset.h>
+ #include <linux/string.h>
+
+ #include "ahci.h"
+@@ -84,8 +85,7 @@ enum brcm_ahci_version {
+ };
+
+ enum brcm_ahci_quirks {
+- BRCM_AHCI_QUIRK_NO_NCQ = BIT(0),
+- BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE = BIT(1),
++ BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE = BIT(0),
+ };
+
+ struct brcm_ahci_priv {
+@@ -94,6 +94,7 @@ struct brcm_ahci_priv {
+ u32 port_mask;
+ u32 quirks;
+ enum brcm_ahci_version version;
++ struct reset_control *rcdev;
+ };
+
+ static inline u32 brcm_sata_readreg(void __iomem *addr)
+@@ -220,19 +221,12 @@ static void brcm_sata_phys_disable(struct brcm_ahci_priv *priv)
+ brcm_sata_phy_disable(priv, i);
+ }
+
+-static u32 brcm_ahci_get_portmask(struct platform_device *pdev,
++static u32 brcm_ahci_get_portmask(struct ahci_host_priv *hpriv,
+ struct brcm_ahci_priv *priv)
+ {
+- void __iomem *ahci;
+- struct resource *res;
+ u32 impl;
+
+- res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "ahci");
+- ahci = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(ahci))
+- return 0;
+-
+- impl = readl(ahci + HOST_PORTS_IMPL);
++ impl = readl(hpriv->mmio + HOST_PORTS_IMPL);
+
+ if (fls(impl) > SATA_TOP_MAX_PHYS)
+ dev_warn(priv->dev, "warning: more ports than PHYs (%#x)\n",
+@@ -240,9 +234,6 @@ static u32 brcm_ahci_get_portmask(struct platform_device *pdev,
+ else if (!impl)
+ dev_info(priv->dev, "no ports found\n");
+
+- devm_iounmap(&pdev->dev, ahci);
+- devm_release_mem_region(&pdev->dev, res->start, resource_size(res));
+-
+ return impl;
+ }
+
+@@ -292,6 +283,13 @@ static unsigned int brcm_ahci_read_id(struct ata_device *dev,
+ /* Perform the SATA PHY reset sequence */
+ brcm_sata_phy_disable(priv, ap->port_no);
+
++ /* Reset the SATA clock */
++ ahci_platform_disable_clks(hpriv);
++ msleep(10);
++
++ ahci_platform_enable_clks(hpriv);
++ msleep(10);
++
+ /* Bring the PHY back on */
+ brcm_sata_phy_enable(priv, ap->port_no);
+
+@@ -354,11 +352,10 @@ static int brcm_ahci_suspend(struct device *dev)
+ struct ata_host *host = dev_get_drvdata(dev);
+ struct ahci_host_priv *hpriv = host->private_data;
+ struct brcm_ahci_priv *priv = hpriv->plat_data;
+- int ret;
+
+- ret = ahci_platform_suspend(dev);
+ brcm_sata_phys_disable(priv);
+- return ret;
++
++ return ahci_platform_suspend(dev);
+ }
+
+ static int brcm_ahci_resume(struct device *dev)
+@@ -366,11 +363,44 @@ static int brcm_ahci_resume(struct device *dev)
+ struct ata_host *host = dev_get_drvdata(dev);
+ struct ahci_host_priv *hpriv = host->private_data;
+ struct brcm_ahci_priv *priv = hpriv->plat_data;
++ int ret;
++
++ /* Make sure clocks are turned on before re-configuration */
++ ret = ahci_platform_enable_clks(hpriv);
++ if (ret)
++ return ret;
+
+ brcm_sata_init(priv);
+ brcm_sata_phys_enable(priv);
+ brcm_sata_alpm_init(hpriv);
+- return ahci_platform_resume(dev);
++
++ /* Since we had to enable clocks earlier on, we cannot use
++ * ahci_platform_resume() as-is since a second call to
++ * ahci_platform_enable_resources() would bump up the resources
++ * (regulators, clocks, PHYs) count artificially so we copy the part
++ * after ahci_platform_enable_resources().
++ */
++ ret = ahci_platform_enable_phys(hpriv);
++ if (ret)
++ goto out_disable_phys;
++
++ ret = ahci_platform_resume_host(dev);
++ if (ret)
++ goto out_disable_platform_phys;
++
++ /* We resumed so update PM runtime state */
++ pm_runtime_disable(dev);
++ pm_runtime_set_active(dev);
++ pm_runtime_enable(dev);
++
++ return 0;
++
++out_disable_platform_phys:
++ ahci_platform_disable_phys(hpriv);
++out_disable_phys:
++ brcm_sata_phys_disable(priv);
++ ahci_platform_disable_clks(hpriv);
++ return ret;
+ }
+ #endif
+
+@@ -411,44 +441,76 @@ static int brcm_ahci_probe(struct platform_device *pdev)
+ if (IS_ERR(priv->top_ctrl))
+ return PTR_ERR(priv->top_ctrl);
+
+- if ((priv->version == BRCM_SATA_BCM7425) ||
+- (priv->version == BRCM_SATA_NSP)) {
+- priv->quirks |= BRCM_AHCI_QUIRK_NO_NCQ;
++ /* Reset is optional depending on platform */
++ priv->rcdev = devm_reset_control_get(&pdev->dev, "ahci");
++ if (!IS_ERR_OR_NULL(priv->rcdev))
++ reset_control_deassert(priv->rcdev);
++
++ hpriv = ahci_platform_get_resources(pdev, 0);
++ if (IS_ERR(hpriv)) {
++ ret = PTR_ERR(hpriv);
++ goto out_reset;
++ }
++
++ hpriv->plat_data = priv;
++ hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP | AHCI_HFLAG_NO_WRITE_TO_RO;
++
++ switch (priv->version) {
++ case BRCM_SATA_BCM7425:
++ hpriv->flags |= AHCI_HFLAG_DELAY_ENGINE;
++ /* fall through */
++ case BRCM_SATA_NSP:
++ hpriv->flags |= AHCI_HFLAG_NO_NCQ;
+ priv->quirks |= BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE;
++ break;
++ default:
++ break;
+ }
+
++ ret = ahci_platform_enable_clks(hpriv);
++ if (ret)
++ goto out_reset;
++
++ /* Must be first so as to configure endianness including that
++ * of the standard AHCI register space.
++ */
+ brcm_sata_init(priv);
+
+- priv->port_mask = brcm_ahci_get_portmask(pdev, priv);
+- if (!priv->port_mask)
+- return -ENODEV;
++ /* Initializes priv->port_mask which is used below */
++ priv->port_mask = brcm_ahci_get_portmask(hpriv, priv);
++ if (!priv->port_mask) {
++ ret = -ENODEV;
++ goto out_disable_clks;
++ }
+
++ /* Must be done before ahci_platform_enable_phys() */
+ brcm_sata_phys_enable(priv);
+
+- hpriv = ahci_platform_get_resources(pdev, 0);
+- if (IS_ERR(hpriv))
+- return PTR_ERR(hpriv);
+- hpriv->plat_data = priv;
+- hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP;
+-
+ brcm_sata_alpm_init(hpriv);
+
+- ret = ahci_platform_enable_resources(hpriv);
++ ret = ahci_platform_enable_phys(hpriv);
+ if (ret)
+- return ret;
+-
+- if (priv->quirks & BRCM_AHCI_QUIRK_NO_NCQ)
+- hpriv->flags |= AHCI_HFLAG_NO_NCQ;
+- hpriv->flags |= AHCI_HFLAG_NO_WRITE_TO_RO;
++ goto out_disable_phys;
+
+ ret = ahci_platform_init_host(pdev, hpriv, &ahci_brcm_port_info,
+ &ahci_platform_sht);
+ if (ret)
+- return ret;
++ goto out_disable_platform_phys;
+
+ dev_info(dev, "Broadcom AHCI SATA3 registered\n");
+
+ return 0;
++
++out_disable_platform_phys:
++ ahci_platform_disable_phys(hpriv);
++out_disable_phys:
++ brcm_sata_phys_disable(priv);
++out_disable_clks:
++ ahci_platform_disable_clks(hpriv);
++out_reset:
++ if (!IS_ERR_OR_NULL(priv->rcdev))
++ reset_control_assert(priv->rcdev);
++ return ret;
+ }
+
+ static int brcm_ahci_remove(struct platform_device *pdev)
+@@ -458,12 +520,12 @@ static int brcm_ahci_remove(struct platform_device *pdev)
+ struct brcm_ahci_priv *priv = hpriv->plat_data;
+ int ret;
+
++ brcm_sata_phys_disable(priv);
++
+ ret = ata_platform_remove_one(pdev);
+ if (ret)
+ return ret;
+
+- brcm_sata_phys_disable(priv);
+-
+ return 0;
+ }
+
+diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
+index 5bece9752ed6..522b543f718d 100644
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -47,7 +47,7 @@ EXPORT_SYMBOL_GPL(ahci_platform_ops);
+ * RETURNS:
+ * 0 on success otherwise a negative error code
+ */
+-static int ahci_platform_enable_phys(struct ahci_host_priv *hpriv)
++int ahci_platform_enable_phys(struct ahci_host_priv *hpriv)
+ {
+ int rc, i;
+
+@@ -72,6 +72,7 @@ disable_phys:
+ }
+ return rc;
+ }
++EXPORT_SYMBOL_GPL(ahci_platform_enable_phys);
+
+ /**
+ * ahci_platform_disable_phys - Disable PHYs
+@@ -79,7 +80,7 @@ disable_phys:
+ *
+ * This function disables all PHYs found in hpriv->phys.
+ */
+-static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv)
++void ahci_platform_disable_phys(struct ahci_host_priv *hpriv)
+ {
+ int i;
+
+@@ -88,6 +89,7 @@ static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv)
+ phy_exit(hpriv->phys[i]);
+ }
+ }
++EXPORT_SYMBOL_GPL(ahci_platform_disable_phys);
+
+ /**
+ * ahci_platform_enable_clks - Enable platform clocks
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 85ee6c35d8e0..b45b6f7722ce 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -5343,6 +5343,30 @@ void ata_qc_complete(struct ata_queued_cmd *qc)
+ }
+ }
+
++/**
++ * ata_qc_get_active - get bitmask of active qcs
++ * @ap: port in question
++ *
++ * LOCKING:
++ * spin_lock_irqsave(host lock)
++ *
++ * RETURNS:
++ * Bitmask of active qcs
++ */
++u64 ata_qc_get_active(struct ata_port *ap)
++{
++ u64 qc_active = ap->qc_active;
++
++ /* ATA_TAG_INTERNAL is sent to hw as tag 0 */
++ if (qc_active & (1ULL << ATA_TAG_INTERNAL)) {
++ qc_active |= (1 << 0);
++ qc_active &= ~(1ULL << ATA_TAG_INTERNAL);
++ }
++
++ return qc_active;
++}
++EXPORT_SYMBOL_GPL(ata_qc_get_active);
++
+ /**
+ * ata_qc_complete_multiple - Complete multiple qcs successfully
+ * @ap: port in question
+diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
+index 4dc528bf8e85..ae52a45fab5f 100644
+--- a/drivers/ata/sata_fsl.c
++++ b/drivers/ata/sata_fsl.c
+@@ -1283,7 +1283,7 @@ static void sata_fsl_host_intr(struct ata_port *ap)
+ i, ioread32(hcr_base + CC),
+ ioread32(hcr_base + CA));
+ }
+- ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask);
++ ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask);
+ return;
+
+ } else if ((ap->qc_active & (1ULL << ATA_TAG_INTERNAL))) {
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index 73ba8e134ca9..ab2e9f62ddc1 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -2840,7 +2840,7 @@ static void mv_process_crpb_entries(struct ata_port *ap, struct mv_port_priv *pp
+ }
+
+ if (work_done) {
+- ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask);
++ ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask);
+
+ /* Update the software queue position index in hardware */
+ writelfl((pp->crpb_dma & EDMA_RSP_Q_BASE_LO_MASK) |
+diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
+index 72c9b922a77b..761577d57ff3 100644
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -1000,7 +1000,7 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
+ check_commands = 0;
+ check_commands &= ~(1 << pos);
+ }
+- ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask);
++ ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask);
+ }
+ }
+
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index fd1e19f1a49f..3666afa639d1 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -936,6 +936,8 @@ next:
+ out_of_memory:
+ pr_alert("%s: out of memory\n", __func__);
+ put_free_pages(ring, pages_to_gnt, segs_to_map);
++ for (i = last_map; i < num; i++)
++ pages[i]->handle = BLKBACK_INVALID_HANDLE;
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
+index 55869b362fdf..25c41ce070a7 100644
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -179,6 +179,15 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid)
+ blkif->domid = domid;
+ atomic_set(&blkif->refcnt, 1);
+ init_completion(&blkif->drain_complete);
++
++ /*
++ * Because freeing back to the cache may be deferred, it is not
++ * safe to unload the module (and hence destroy the cache) until
++ * this has completed. To prevent premature unloading, take an
++ * extra module reference here and release only when the object
++ * has been freed back to the cache.
++ */
++ __module_get(THIS_MODULE);
+ INIT_WORK(&blkif->free_work, xen_blkif_deferred_free);
+
+ return blkif;
+@@ -328,6 +337,7 @@ static void xen_blkif_free(struct xen_blkif *blkif)
+
+ /* Make sure everything is drained before shutting down */
+ kmem_cache_free(xen_blkif_cachep, blkif);
++ module_put(THIS_MODULE);
+ }
+
+ int __init xen_blkif_interface_init(void)
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 08936bf696d3..1b0adf5c2376 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1138,7 +1138,7 @@ static int btusb_open(struct hci_dev *hdev)
+ if (data->setup_on_usb) {
+ err = data->setup_on_usb(hdev);
+ if (err < 0)
+- return err;
++ goto setup_fail;
+ }
+
+ data->intf->needs_remote_wakeup = 1;
+@@ -1170,6 +1170,7 @@ done:
+
+ failed:
+ clear_bit(BTUSB_INTR_RUNNING, &data->flags);
++setup_fail:
+ usb_autopm_put_interface(data->intf);
+ return err;
+ }
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 61fbaa89d7b4..1229bfb3180e 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -538,26 +538,30 @@ static int devfreq_notifier_call(struct notifier_block *nb, unsigned long type,
+ void *devp)
+ {
+ struct devfreq *devfreq = container_of(nb, struct devfreq, nb);
+- int ret;
++ int err = -EINVAL;
+
+ mutex_lock(&devfreq->lock);
+
+ devfreq->scaling_min_freq = find_available_min_freq(devfreq);
+- if (!devfreq->scaling_min_freq) {
+- mutex_unlock(&devfreq->lock);
+- return -EINVAL;
+- }
++ if (!devfreq->scaling_min_freq)
++ goto out;
+
+ devfreq->scaling_max_freq = find_available_max_freq(devfreq);
+ if (!devfreq->scaling_max_freq) {
+- mutex_unlock(&devfreq->lock);
+- return -EINVAL;
++ devfreq->scaling_max_freq = ULONG_MAX;
++ goto out;
+ }
+
+- ret = update_devfreq(devfreq);
++ err = update_devfreq(devfreq);
++
++out:
+ mutex_unlock(&devfreq->lock);
++ if (err)
++ dev_err(devfreq->dev.parent,
++ "failed to update frequency from OPP notifier (%d)\n",
++ err);
+
+- return ret;
++ return NOTIFY_OK;
+ }
+
+ /**
+@@ -571,11 +575,6 @@ static void devfreq_dev_release(struct device *dev)
+ struct devfreq *devfreq = to_devfreq(dev);
+
+ mutex_lock(&devfreq_list_lock);
+- if (IS_ERR(find_device_devfreq(devfreq->dev.parent))) {
+- mutex_unlock(&devfreq_list_lock);
+- dev_warn(&devfreq->dev, "releasing devfreq which doesn't exist\n");
+- return;
+- }
+ list_del(&devfreq->node);
+ mutex_unlock(&devfreq_list_lock);
+
+@@ -630,6 +629,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
+ devfreq->dev.parent = dev;
+ devfreq->dev.class = devfreq_class;
+ devfreq->dev.release = devfreq_dev_release;
++ INIT_LIST_HEAD(&devfreq->node);
+ devfreq->profile = profile;
+ strncpy(devfreq->governor_name, governor_name, DEVFREQ_NAME_LEN);
+ devfreq->previous_freq = profile->initial_freq;
+@@ -1086,7 +1086,7 @@ static ssize_t available_governors_show(struct device *d,
+ * The devfreq with immutable governor (e.g., passive) shows
+ * only own governor.
+ */
+- if (df->governor->immutable) {
++ if (df->governor && df->governor->immutable) {
+ count = scnprintf(&buf[count], DEVFREQ_NAME_LEN,
+ "%s ", df->governor_name);
+ /*
+diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
+index 82ba110d9d1a..bbabfca812bb 100644
+--- a/drivers/firewire/net.c
++++ b/drivers/firewire/net.c
+@@ -249,7 +249,11 @@ static int fwnet_header_cache(const struct neighbour *neigh,
+ h = (struct fwnet_header *)((u8 *)hh->hh_data + HH_DATA_OFF(sizeof(*h)));
+ h->h_proto = type;
+ memcpy(h->h_dest, neigh->ha, net->addr_len);
+- hh->hh_len = FWNET_HLEN;
++
++ /* Pairs with the READ_ONCE() in neigh_resolve_output(),
++ * neigh_hh_output() and neigh_update_hhs().
++ */
++ smp_store_release(&hh->hh_len, FWNET_HLEN);
+
+ return 0;
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index b81a27c7f89c..a24f13df42f4 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -217,6 +217,14 @@ int gpiod_get_direction(struct gpio_desc *desc)
+ chip = gpiod_to_chip(desc);
+ offset = gpio_chip_hwgpio(desc);
+
++ /*
++ * Open drain emulation using input mode may incorrectly report
++ * input here, fix that up.
++ */
++ if (test_bit(FLAG_OPEN_DRAIN, &desc->flags) &&
++ test_bit(FLAG_IS_OUT, &desc->flags))
++ return 0;
++
+ if (!chip->get_direction)
+ return status;
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/df_v3_6.c b/drivers/gpu/drm/amd/amdgpu/df_v3_6.c
+index d5ebe566809b..a1c941229f4b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/df_v3_6.c
++++ b/drivers/gpu/drm/amd/amdgpu/df_v3_6.c
+@@ -75,23 +75,29 @@ static void df_v3_6_update_medium_grain_clock_gating(struct amdgpu_device *adev,
+ {
+ u32 tmp;
+
+- /* Put DF on broadcast mode */
+- adev->df_funcs->enable_broadcast_mode(adev, true);
+-
+- if (enable && (adev->cg_flags & AMD_CG_SUPPORT_DF_MGCG)) {
+- tmp = RREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater);
+- tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK;
+- tmp |= DF_V3_6_MGCG_ENABLE_15_CYCLE_DELAY;
+- WREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater, tmp);
+- } else {
+- tmp = RREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater);
+- tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK;
+- tmp |= DF_V3_6_MGCG_DISABLE;
+- WREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater, tmp);
++ if (adev->cg_flags & AMD_CG_SUPPORT_DF_MGCG) {
++ /* Put DF on broadcast mode */
++ adev->df_funcs->enable_broadcast_mode(adev, true);
++
++ if (enable) {
++ tmp = RREG32_SOC15(DF, 0,
++ mmDF_PIE_AON0_DfGlobalClkGater);
++ tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK;
++ tmp |= DF_V3_6_MGCG_ENABLE_15_CYCLE_DELAY;
++ WREG32_SOC15(DF, 0,
++ mmDF_PIE_AON0_DfGlobalClkGater, tmp);
++ } else {
++ tmp = RREG32_SOC15(DF, 0,
++ mmDF_PIE_AON0_DfGlobalClkGater);
++ tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK;
++ tmp |= DF_V3_6_MGCG_DISABLE;
++ WREG32_SOC15(DF, 0,
++ mmDF_PIE_AON0_DfGlobalClkGater, tmp);
++ }
++
++ /* Exit broadcast mode */
++ adev->df_funcs->enable_broadcast_mode(adev, false);
+ }
+-
+- /* Exit broadcast mode */
+- adev->df_funcs->enable_broadcast_mode(adev, false);
+ }
+
+ static void df_v3_6_get_clockgating_state(struct amdgpu_device *adev,
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+index 5a9534a82d40..e1cb7fa89e4d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -6405,7 +6405,23 @@ static void gfx_v8_0_ring_emit_fence_gfx(struct amdgpu_ring *ring, u64 addr,
+ bool write64bit = flags & AMDGPU_FENCE_FLAG_64BIT;
+ bool int_sel = flags & AMDGPU_FENCE_FLAG_INT;
+
+- /* EVENT_WRITE_EOP - flush caches, send int */
++ /* Workaround for cache flush problems. First send a dummy EOP
++ * event down the pipe with seq one below.
++ */
++ amdgpu_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4));
++ amdgpu_ring_write(ring, (EOP_TCL1_ACTION_EN |
++ EOP_TC_ACTION_EN |
++ EOP_TC_WB_ACTION_EN |
++ EVENT_TYPE(CACHE_FLUSH_AND_INV_TS_EVENT) |
++ EVENT_INDEX(5)));
++ amdgpu_ring_write(ring, addr & 0xfffffffc);
++ amdgpu_ring_write(ring, (upper_32_bits(addr) & 0xffff) |
++ DATA_SEL(1) | INT_SEL(0));
++ amdgpu_ring_write(ring, lower_32_bits(seq - 1));
++ amdgpu_ring_write(ring, upper_32_bits(seq - 1));
++
++ /* Then send the real EOP event down the pipe:
++ * EVENT_WRITE_EOP - flush caches, send int */
+ amdgpu_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4));
+ amdgpu_ring_write(ring, (EOP_TCL1_ACTION_EN |
+ EOP_TC_ACTION_EN |
+@@ -7154,7 +7170,7 @@ static const struct amdgpu_ring_funcs gfx_v8_0_ring_funcs_gfx = {
+ 5 + /* COND_EXEC */
+ 7 + /* PIPELINE_SYNC */
+ VI_FLUSH_GPU_TLB_NUM_WREG * 5 + 9 + /* VM_FLUSH */
+- 8 + /* FENCE for VM_FLUSH */
++ 12 + /* FENCE for VM_FLUSH */
+ 20 + /* GDS switch */
+ 4 + /* double SWITCH_BUFFER,
+ the first COND_EXEC jump to the place just
+@@ -7166,7 +7182,7 @@ static const struct amdgpu_ring_funcs gfx_v8_0_ring_funcs_gfx = {
+ 31 + /* DE_META */
+ 3 + /* CNTX_CTRL */
+ 5 + /* HDP_INVL */
+- 8 + 8 + /* FENCE x2 */
++ 12 + 12 + /* FENCE x2 */
+ 2, /* SWITCH_BUFFER */
+ .emit_ib_size = 4, /* gfx_v8_0_ring_emit_ib_gfx */
+ .emit_ib = gfx_v8_0_ring_emit_ib_gfx,
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index c6f7c1344a9b..2f42964fb9f4 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -348,7 +348,7 @@ bool dc_link_is_dp_sink_present(struct dc_link *link)
+
+ if (GPIO_RESULT_OK != dal_ddc_open(
+ ddc, GPIO_MODE_INPUT, GPIO_DDC_CONFIG_TYPE_MODE_I2C)) {
+- dal_gpio_destroy_ddc(&ddc);
++ dal_ddc_close(ddc);
+
+ return present;
+ }
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 65f58e23e03d..77347a258f6c 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1582,7 +1582,11 @@ static void process_single_up_tx_qlock(struct drm_dp_mst_topology_mgr *mgr,
+ if (ret != 1)
+ DRM_DEBUG_KMS("failed to send msg in q %d\n", ret);
+
+- txmsg->dst->tx_slots[txmsg->seqno] = NULL;
++ if (txmsg->seqno != -1) {
++ WARN_ON((unsigned int)txmsg->seqno >
++ ARRAY_SIZE(txmsg->dst->tx_slots));
++ txmsg->dst->tx_slots[txmsg->seqno] = NULL;
++ }
+ }
+
+ static void drm_dp_queue_down_tx(struct drm_dp_mst_topology_mgr *mgr,
+diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
+index cdb10f885a4f..69dfed57c2f8 100644
+--- a/drivers/gpu/drm/drm_property.c
++++ b/drivers/gpu/drm/drm_property.c
+@@ -556,7 +556,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
+ struct drm_property_blob *blob;
+ int ret;
+
+- if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
++ if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
+ return ERR_PTR(-EINVAL);
+
+ blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
+diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
+index 52a2146dc1f2..5e6c78ea3a3f 100644
+--- a/drivers/gpu/drm/msm/msm_gpu.c
++++ b/drivers/gpu/drm/msm/msm_gpu.c
+@@ -25,6 +25,7 @@
+ #include <linux/pm_opp.h>
+ #include <linux/devfreq.h>
+ #include <linux/devcoredump.h>
++#include <linux/sched/task.h>
+
+ /*
+ * Power Management:
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.h b/drivers/gpu/drm/nouveau/nouveau_connector.h
+index dc7454e7f19a..b46e99f7641e 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.h
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.h
+@@ -29,6 +29,7 @@
+
+ #include <nvif/notify.h>
+
++#include <drm/drm_crtc.h>
+ #include <drm/drm_edid.h>
+ #include <drm/drm_encoder.h>
+ #include <drm/drm_dp_helper.h>
+@@ -37,6 +38,60 @@
+
+ struct nvkm_i2c_port;
+
++#define nouveau_conn_atom(p) \
++ container_of((p), struct nouveau_conn_atom, state)
++
++struct nouveau_conn_atom {
++ struct drm_connector_state state;
++
++ struct {
++ /* The enum values specifically defined here match nv50/gf119
++ * hw values, and the code relies on this.
++ */
++ enum {
++ DITHERING_MODE_OFF = 0x00,
++ DITHERING_MODE_ON = 0x01,
++ DITHERING_MODE_DYNAMIC2X2 = 0x10 | DITHERING_MODE_ON,
++ DITHERING_MODE_STATIC2X2 = 0x18 | DITHERING_MODE_ON,
++ DITHERING_MODE_TEMPORAL = 0x20 | DITHERING_MODE_ON,
++ DITHERING_MODE_AUTO
++ } mode;
++ enum {
++ DITHERING_DEPTH_6BPC = 0x00,
++ DITHERING_DEPTH_8BPC = 0x02,
++ DITHERING_DEPTH_AUTO
++ } depth;
++ } dither;
++
++ struct {
++ int mode; /* DRM_MODE_SCALE_* */
++ struct {
++ enum {
++ UNDERSCAN_OFF,
++ UNDERSCAN_ON,
++ UNDERSCAN_AUTO,
++ } mode;
++ u32 hborder;
++ u32 vborder;
++ } underscan;
++ bool full;
++ } scaler;
++
++ struct {
++ int color_vibrance;
++ int vibrant_hue;
++ } procamp;
++
++ union {
++ struct {
++ bool dither:1;
++ bool scaler:1;
++ bool procamp:1;
++ };
++ u8 mask;
++ } set;
++};
++
+ struct nouveau_connector {
+ struct drm_connector base;
+ enum dcb_connector_type type;
+@@ -111,61 +166,6 @@ extern int nouveau_ignorelid;
+ extern int nouveau_duallink;
+ extern int nouveau_hdmimhz;
+
+-#include <drm/drm_crtc.h>
+-#define nouveau_conn_atom(p) \
+- container_of((p), struct nouveau_conn_atom, state)
+-
+-struct nouveau_conn_atom {
+- struct drm_connector_state state;
+-
+- struct {
+- /* The enum values specifically defined here match nv50/gf119
+- * hw values, and the code relies on this.
+- */
+- enum {
+- DITHERING_MODE_OFF = 0x00,
+- DITHERING_MODE_ON = 0x01,
+- DITHERING_MODE_DYNAMIC2X2 = 0x10 | DITHERING_MODE_ON,
+- DITHERING_MODE_STATIC2X2 = 0x18 | DITHERING_MODE_ON,
+- DITHERING_MODE_TEMPORAL = 0x20 | DITHERING_MODE_ON,
+- DITHERING_MODE_AUTO
+- } mode;
+- enum {
+- DITHERING_DEPTH_6BPC = 0x00,
+- DITHERING_DEPTH_8BPC = 0x02,
+- DITHERING_DEPTH_AUTO
+- } depth;
+- } dither;
+-
+- struct {
+- int mode; /* DRM_MODE_SCALE_* */
+- struct {
+- enum {
+- UNDERSCAN_OFF,
+- UNDERSCAN_ON,
+- UNDERSCAN_AUTO,
+- } mode;
+- u32 hborder;
+- u32 vborder;
+- } underscan;
+- bool full;
+- } scaler;
+-
+- struct {
+- int color_vibrance;
+- int vibrant_hue;
+- } procamp;
+-
+- union {
+- struct {
+- bool dither:1;
+- bool scaler:1;
+- bool procamp:1;
+- };
+- u8 mask;
+- } set;
+-};
+-
+ void nouveau_conn_attach_properties(struct drm_connector *);
+ void nouveau_conn_reset(struct drm_connector *);
+ struct drm_connector_state *
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+index 416da5376701..8ad36f574df8 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+@@ -651,8 +651,6 @@ static void sun4i_hdmi_unbind(struct device *dev, struct device *master,
+ struct sun4i_hdmi *hdmi = dev_get_drvdata(dev);
+
+ cec_unregister_adapter(hdmi->cec_adap);
+- drm_connector_cleanup(&hdmi->connector);
+- drm_encoder_cleanup(&hdmi->encoder);
+ i2c_del_adapter(hdmi->i2c);
+ clk_disable_unprepare(hdmi->mod_clk);
+ clk_disable_unprepare(hdmi->bus_clk);
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 2f940c1de616..0a39e444e308 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -51,6 +51,7 @@
+ #define I2C_HID_QUIRK_NO_RUNTIME_PM BIT(2)
+ #define I2C_HID_QUIRK_DELAY_AFTER_SLEEP BIT(3)
+ #define I2C_HID_QUIRK_BOGUS_IRQ BIT(4)
++#define I2C_HID_QUIRK_RESET_ON_RESUME BIT(5)
+
+ /* flags */
+ #define I2C_HID_STARTED 0
+@@ -182,6 +183,8 @@ static const struct i2c_hid_quirks {
+ I2C_HID_QUIRK_NO_RUNTIME_PM },
+ { USB_VENDOR_ID_ELAN, HID_ANY_ID,
+ I2C_HID_QUIRK_BOGUS_IRQ },
++ { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID,
++ I2C_HID_QUIRK_RESET_ON_RESUME },
+ { 0, 0 }
+ };
+
+@@ -1290,8 +1293,15 @@ static int i2c_hid_resume(struct device *dev)
+ * solves "incomplete reports" on Raydium devices 2386:3118 and
+ * 2386:4B33 and fixes various SIS touchscreens no longer sending
+ * data after a suspend/resume.
++ *
++ * However some ALPS touchpads generate IRQ storm without reset, so
++ * let's still reset them here.
+ */
+- ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
++ if (ihid->quirks & I2C_HID_QUIRK_RESET_ON_RESUME)
++ ret = i2c_hid_hwreset(client);
++ else
++ ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
++
+ if (ret)
+ return ret;
+
+diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
+index 0884435eec68..9f1a5ef0b444 100644
+--- a/drivers/iio/adc/max9611.c
++++ b/drivers/iio/adc/max9611.c
+@@ -92,6 +92,12 @@
+ #define MAX9611_TEMP_SCALE_NUM 1000000
+ #define MAX9611_TEMP_SCALE_DIV 2083
+
++/*
++ * Conversion time is 2 ms (typically) at Ta=25 degreeC
++ * No maximum value is known, so play it safe.
++ */
++#define MAX9611_CONV_TIME_US_RANGE 3000, 3300
++
+ struct max9611_dev {
+ struct device *dev;
+ struct i2c_client *i2c_client;
+@@ -239,11 +245,9 @@ static int max9611_read_single(struct max9611_dev *max9611,
+ return ret;
+ }
+
+- /*
+- * need a delay here to make register configuration
+- * stabilize. 1 msec at least, from empirical testing.
+- */
+- usleep_range(1000, 2000);
++ /* need a delay here to make register configuration stabilize. */
++
++ usleep_range(MAX9611_CONV_TIME_US_RANGE);
+
+ ret = i2c_smbus_read_word_swapped(max9611->i2c_client, reg_addr);
+ if (ret < 0) {
+@@ -510,7 +514,7 @@ static int max9611_init(struct max9611_dev *max9611)
+ MAX9611_REG_CTRL2, 0);
+ return ret;
+ }
+- usleep_range(1000, 2000);
++ usleep_range(MAX9611_CONV_TIME_US_RANGE);
+
+ return 0;
+ }
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 1f373ba573b6..319bfef00a4a 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -4658,6 +4658,7 @@ static int __init cma_init(void)
+ err:
+ unregister_netdevice_notifier(&cma_nb);
+ ib_sa_unregister_client(&sa_client);
++ unregister_pernet_subsys(&cma_pernet_operations);
+ err_wq:
+ destroy_workqueue(cma_wq);
+ return ret;
+diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
+index 0bbeaaae47e0..9386bb57b3d7 100644
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -3069,16 +3069,17 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr)
+ ibdev->ib_active = false;
+ flush_workqueue(wq);
+
+- mlx4_ib_close_sriov(ibdev);
+- mlx4_ib_mad_cleanup(ibdev);
+- ib_unregister_device(&ibdev->ib_dev);
+- mlx4_ib_diag_cleanup(ibdev);
+ if (ibdev->iboe.nb.notifier_call) {
+ if (unregister_netdevice_notifier(&ibdev->iboe.nb))
+ pr_warn("failure unregistering notifier\n");
+ ibdev->iboe.nb.notifier_call = NULL;
+ }
+
++ mlx4_ib_close_sriov(ibdev);
++ mlx4_ib_mad_cleanup(ibdev);
++ ib_unregister_device(&ibdev->ib_dev);
++ mlx4_ib_diag_cleanup(ibdev);
++
+ mlx4_qp_release_range(dev, ibdev->steer_qpn_base,
+ ibdev->steer_qpn_count);
+ kfree(ibdev->ib_uc_qpns_bitmap);
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index f4ffdc588ea0..df5be462dd28 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -3286,10 +3286,6 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev,
+ }
+
+ INIT_LIST_HEAD(&handler->list);
+- if (dst) {
+- memcpy(&dest_arr[0], dst, sizeof(*dst));
+- dest_num++;
+- }
+
+ for (spec_index = 0; spec_index < flow_attr->num_of_specs; spec_index++) {
+ err = parse_flow_attr(dev->mdev, spec->match_criteria,
+@@ -3303,6 +3299,11 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev,
+ ib_flow += ((union ib_flow_spec *)ib_flow)->size;
+ }
+
++ if (dst && !(flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DROP)) {
++ memcpy(&dest_arr[0], dst, sizeof(*dst));
++ dest_num++;
++ }
++
+ if (!flow_is_multicast_only(flow_attr))
+ set_underlay_qp(dev, spec, underlay_qpn);
+
+@@ -3340,10 +3341,8 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev,
+ }
+
+ if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DROP) {
+- if (!(flow_act.action & MLX5_FLOW_CONTEXT_ACTION_COUNT)) {
++ if (!dest_num)
+ rule_dst = NULL;
+- dest_num = 0;
+- }
+ } else {
+ if (is_egress)
+ flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_ALLOW;
+diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
+index d30dbac24583..695a607e2d14 100644
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -391,7 +391,7 @@ void rxe_rcv(struct sk_buff *skb)
+
+ calc_icrc = rxe_icrc_hdr(pkt, skb);
+ calc_icrc = rxe_crc32(rxe, calc_icrc, (u8 *)payload_addr(pkt),
+- payload_size(pkt));
++ payload_size(pkt) + bth_pad(pkt));
+ calc_icrc = (__force u32)cpu_to_be32(~calc_icrc);
+ if (unlikely(calc_icrc != pack_icrc)) {
+ if (skb->protocol == htons(ETH_P_IPV6))
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index f7dd8de79941..1c1eae0ef8c2 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -500,6 +500,12 @@ static int fill_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ if (err)
+ return err;
+ }
++ if (bth_pad(pkt)) {
++ u8 *pad = payload_addr(pkt) + paylen;
++
++ memset(pad, 0, bth_pad(pkt));
++ crc = rxe_crc32(rxe, crc, pad, bth_pad(pkt));
++ }
+ }
+ p = payload_addr(pkt) + paylen + bth_pad(pkt);
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 681d8e0913d0..9078cfd3b8bd 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -737,6 +737,13 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ if (err)
+ pr_err("Failed copying memory\n");
+
++ if (bth_pad(&ack_pkt)) {
++ struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
++ u8 *pad = payload_addr(&ack_pkt) + payload;
++
++ memset(pad, 0, bth_pad(&ack_pkt));
++ icrc = rxe_crc32(rxe, icrc, pad, bth_pad(&ack_pkt));
++ }
+ p = payload_addr(&ack_pkt) + payload + bth_pad(&ack_pkt);
+ *p = ~icrc;
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 6800dcd50a11..abcb4c3a76c1 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -2756,7 +2756,7 @@ static sector_t raid1_sync_request(struct mddev *mddev, sector_t sector_nr,
+ write_targets++;
+ }
+ }
+- if (bio->bi_end_io) {
++ if (rdev && bio->bi_end_io) {
+ atomic_inc(&rdev->nr_pending);
+ bio->bi_iter.bi_sector = sector_nr + rdev->data_offset;
+ bio_set_dev(bio, rdev->bdev);
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index dd6f3e6ce006..ba7e976bf6dc 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -365,7 +365,8 @@ static void cec_data_cancel(struct cec_data *data, u8 tx_status)
+ } else {
+ list_del_init(&data->list);
+ if (!(data->msg.tx_status & CEC_TX_STATUS_OK))
+- data->adap->transmit_queue_sz--;
++ if (!WARN_ON(!data->adap->transmit_queue_sz))
++ data->adap->transmit_queue_sz--;
+ }
+
+ if (data->msg.tx_status & CEC_TX_STATUS_OK) {
+@@ -417,6 +418,14 @@ static void cec_flush(struct cec_adapter *adap)
+ * need to do anything special in that case.
+ */
+ }
++ /*
++ * If something went wrong and this counter isn't what it should
++ * be, then this will reset it back to 0. Warn if it is not 0,
++ * since it indicates a bug, either in this framework or in a
++ * CEC driver.
++ */
++ if (WARN_ON(adap->transmit_queue_sz))
++ adap->transmit_queue_sz = 0;
+ }
+
+ /*
+@@ -441,7 +450,7 @@ int cec_thread_func(void *_adap)
+ bool timeout = false;
+ u8 attempts;
+
+- if (adap->transmitting) {
++ if (adap->transmit_in_progress) {
+ int err;
+
+ /*
+@@ -476,7 +485,7 @@ int cec_thread_func(void *_adap)
+ goto unlock;
+ }
+
+- if (adap->transmitting && timeout) {
++ if (adap->transmit_in_progress && timeout) {
+ /*
+ * If we timeout, then log that. Normally this does
+ * not happen and it is an indication of a faulty CEC
+@@ -485,14 +494,18 @@ int cec_thread_func(void *_adap)
+ * so much traffic on the bus that the adapter was
+ * unable to transmit for CEC_XFER_TIMEOUT_MS (2.1s).
+ */
+- pr_warn("cec-%s: message %*ph timed out\n", adap->name,
+- adap->transmitting->msg.len,
+- adap->transmitting->msg.msg);
++ if (adap->transmitting) {
++ pr_warn("cec-%s: message %*ph timed out\n", adap->name,
++ adap->transmitting->msg.len,
++ adap->transmitting->msg.msg);
++ /* Just give up on this. */
++ cec_data_cancel(adap->transmitting,
++ CEC_TX_STATUS_TIMEOUT);
++ } else {
++ pr_warn("cec-%s: transmit timed out\n", adap->name);
++ }
+ adap->transmit_in_progress = false;
+ adap->tx_timeouts++;
+- /* Just give up on this. */
+- cec_data_cancel(adap->transmitting,
+- CEC_TX_STATUS_TIMEOUT);
+ goto unlock;
+ }
+
+@@ -507,7 +520,8 @@ int cec_thread_func(void *_adap)
+ data = list_first_entry(&adap->transmit_queue,
+ struct cec_data, list);
+ list_del_init(&data->list);
+- adap->transmit_queue_sz--;
++ if (!WARN_ON(!data->adap->transmit_queue_sz))
++ adap->transmit_queue_sz--;
+
+ /* Make this the current transmitting message */
+ adap->transmitting = data;
+@@ -1038,11 +1052,11 @@ void cec_received_msg_ts(struct cec_adapter *adap,
+ valid_la = false;
+ else if (!cec_msg_is_broadcast(msg) && !(dir_fl & DIRECTED))
+ valid_la = false;
+- else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST1_4))
++ else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST))
+ valid_la = false;
+ else if (cec_msg_is_broadcast(msg) &&
+- adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0 &&
+- !(dir_fl & BCAST2_0))
++ adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0 &&
++ !(dir_fl & BCAST1_4))
+ valid_la = false;
+ }
+ if (valid_la && min_len) {
+diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
+index f1807c16438d..427cda457af6 100644
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -294,7 +294,7 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c,
+
+ mutex_unlock(&fc_usb->data_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ /* actual bus specific access functions,
+diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
+index 16e946e01d2c..25871979123f 100644
+--- a/drivers/media/usb/dvb-usb/af9005.c
++++ b/drivers/media/usb/dvb-usb/af9005.c
+@@ -985,8 +985,9 @@ static int af9005_identify_state(struct usb_device *udev,
+ else if (reply == 0x02)
+ *cold = 0;
+ else
+- return -EIO;
+- deb_info("Identify state cold = %d\n", *cold);
++ ret = -EIO;
++ if (!ret)
++ deb_info("Identify state cold = %d\n", *cold);
+
+ err:
+ kfree(buf);
+diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+index 6e3bdd71e273..f5899321e5a3 100644
+--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c
++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+@@ -121,6 +121,7 @@ struct pulse8 {
+ unsigned int vers;
+ struct completion cmd_done;
+ struct work_struct work;
++ u8 work_result;
+ struct delayed_work ping_eeprom_work;
+ struct cec_msg rx_msg;
+ u8 data[DATA_SIZE];
+@@ -142,8 +143,10 @@ static void pulse8_irq_work_handler(struct work_struct *work)
+ {
+ struct pulse8 *pulse8 =
+ container_of(work, struct pulse8, work);
++ u8 result = pulse8->work_result;
+
+- switch (pulse8->data[0] & 0x3f) {
++ pulse8->work_result = 0;
++ switch (result & 0x3f) {
+ case MSGCODE_FRAME_DATA:
+ cec_received_msg(pulse8->adap, &pulse8->rx_msg);
+ break;
+@@ -177,12 +180,12 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data,
+ pulse8->escape = false;
+ } else if (data == MSGEND) {
+ struct cec_msg *msg = &pulse8->rx_msg;
++ u8 msgcode = pulse8->buf[0];
+
+ if (debug)
+ dev_info(pulse8->dev, "received: %*ph\n",
+ pulse8->idx, pulse8->buf);
+- pulse8->data[0] = pulse8->buf[0];
+- switch (pulse8->buf[0] & 0x3f) {
++ switch (msgcode & 0x3f) {
+ case MSGCODE_FRAME_START:
+ msg->len = 1;
+ msg->msg[0] = pulse8->buf[1];
+@@ -191,14 +194,20 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data,
+ if (msg->len == CEC_MAX_MSG_SIZE)
+ break;
+ msg->msg[msg->len++] = pulse8->buf[1];
+- if (pulse8->buf[0] & MSGCODE_FRAME_EOM)
++ if (msgcode & MSGCODE_FRAME_EOM) {
++ WARN_ON(pulse8->work_result);
++ pulse8->work_result = msgcode;
+ schedule_work(&pulse8->work);
++ break;
++ }
+ break;
+ case MSGCODE_TRANSMIT_SUCCEEDED:
+ case MSGCODE_TRANSMIT_FAILED_LINE:
+ case MSGCODE_TRANSMIT_FAILED_ACK:
+ case MSGCODE_TRANSMIT_FAILED_TIMEOUT_DATA:
+ case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE:
++ WARN_ON(pulse8->work_result);
++ pulse8->work_result = msgcode;
+ schedule_work(&pulse8->work);
+ break;
+ case MSGCODE_HIGH_ERROR:
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index 799010ed04e0..b5d7ef4da17f 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -973,6 +973,8 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
+ struct ath_htc_rx_status *rxstatus;
+ struct ath_rx_status rx_stats;
+ bool decrypt_error = false;
++ __be16 rs_datalen;
++ bool is_phyerr;
+
+ if (skb->len < HTC_RX_FRAME_HEADER_SIZE) {
+ ath_err(common, "Corrupted RX frame, dropping (len: %d)\n",
+@@ -982,11 +984,24 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
+
+ rxstatus = (struct ath_htc_rx_status *)skb->data;
+
+- if (be16_to_cpu(rxstatus->rs_datalen) -
+- (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0) {
++ rs_datalen = be16_to_cpu(rxstatus->rs_datalen);
++ if (unlikely(rs_datalen -
++ (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0)) {
+ ath_err(common,
+ "Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n",
+- rxstatus->rs_datalen, skb->len);
++ rs_datalen, skb->len);
++ goto rx_next;
++ }
++
++ is_phyerr = rxstatus->rs_status & ATH9K_RXERR_PHY;
++ /*
++ * Discard zero-length packets and packets smaller than an ACK
++ * which are not PHY_ERROR (short radar pulses have a length of 3)
++ */
++ if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) {
++ ath_warn(common,
++ "Short RX data len, dropping (dlen: %d)\n",
++ rs_datalen);
+ goto rx_next;
+ }
+
+@@ -1011,7 +1026,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
+ * Process PHY errors and return so that the packet
+ * can be dropped.
+ */
+- if (rx_stats.rs_status & ATH9K_RXERR_PHY) {
++ if (unlikely(is_phyerr)) {
+ /* TODO: Not using DFS processing now. */
+ if (ath_cmn_process_fft(&priv->spec_priv, hdr,
+ &rx_stats, rx_status->mactime)) {
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 565bddcfd130..1875f6b8a907 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -342,7 +342,8 @@ nvme_fc_register_localport(struct nvme_fc_port_info *pinfo,
+ !template->ls_req || !template->fcp_io ||
+ !template->ls_abort || !template->fcp_abort ||
+ !template->max_hw_queues || !template->max_sgl_segments ||
+- !template->max_dif_sgl_segments || !template->dma_boundary) {
++ !template->max_dif_sgl_segments || !template->dma_boundary ||
++ !template->module) {
+ ret = -EINVAL;
+ goto out_reghost_failed;
+ }
+@@ -1986,6 +1987,7 @@ nvme_fc_ctrl_free(struct kref *ref)
+ {
+ struct nvme_fc_ctrl *ctrl =
+ container_of(ref, struct nvme_fc_ctrl, ref);
++ struct nvme_fc_lport *lport = ctrl->lport;
+ unsigned long flags;
+
+ if (ctrl->ctrl.tagset) {
+@@ -2011,6 +2013,7 @@ nvme_fc_ctrl_free(struct kref *ref)
+ if (ctrl->ctrl.opts)
+ nvmf_free_options(ctrl->ctrl.opts);
+ kfree(ctrl);
++ module_put(lport->ops->module);
+ }
+
+ static void
+@@ -2891,10 +2894,22 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
+ static void
+ __nvme_fc_terminate_io(struct nvme_fc_ctrl *ctrl)
+ {
+- nvme_stop_keep_alive(&ctrl->ctrl);
++ /*
++ * if state is connecting - the error occurred as part of a
++ * reconnect attempt. The create_association error paths will
++ * clean up any outstanding io.
++ *
++ * if it's a different state - ensure all pending io is
++ * terminated. Given this can delay while waiting for the
++ * aborted io to return, we recheck adapter state below
++ * before changing state.
++ */
++ if (ctrl->ctrl.state != NVME_CTRL_CONNECTING) {
++ nvme_stop_keep_alive(&ctrl->ctrl);
+
+- /* will block will waiting for io to terminate */
+- nvme_fc_delete_association(ctrl);
++ /* will block will waiting for io to terminate */
++ nvme_fc_delete_association(ctrl);
++ }
+
+ if (ctrl->ctrl.state != NVME_CTRL_CONNECTING &&
+ !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
+@@ -3040,10 +3055,15 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
+ goto out_fail;
+ }
+
++ if (!try_module_get(lport->ops->module)) {
++ ret = -EUNATCH;
++ goto out_free_ctrl;
++ }
++
+ idx = ida_simple_get(&nvme_fc_ctrl_cnt, 0, 0, GFP_KERNEL);
+ if (idx < 0) {
+ ret = -ENOSPC;
+- goto out_free_ctrl;
++ goto out_mod_put;
+ }
+
+ ctrl->ctrl.opts = opts;
+@@ -3185,6 +3205,8 @@ out_free_queues:
+ out_free_ida:
+ put_device(ctrl->dev);
+ ida_simple_remove(&nvme_fc_ctrl_cnt, ctrl->cnum);
++out_mod_put:
++ module_put(lport->ops->module);
+ out_free_ctrl:
+ kfree(ctrl);
+ out_fail:
+diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
+index 291f4121f516..f0536d341f2f 100644
+--- a/drivers/nvme/target/fcloop.c
++++ b/drivers/nvme/target/fcloop.c
+@@ -825,6 +825,7 @@ fcloop_targetport_delete(struct nvmet_fc_target_port *targetport)
+ #define FCLOOP_DMABOUND_4G 0xFFFFFFFF
+
+ static struct nvme_fc_port_template fctemplate = {
++ .module = THIS_MODULE,
+ .localport_delete = fcloop_localport_delete,
+ .remoteport_delete = fcloop_remoteport_delete,
+ .create_queue = fcloop_create_queue,
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index 429166e6ec9e..9c94ebb251cb 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -452,6 +452,14 @@ static const struct dmi_system_id critclk_systems[] = {
+ DMI_MATCH(DMI_PRODUCT_VERSION, "6ES7647-8B"),
+ },
+ },
++ {
++ .ident = "CONNECT X300",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SIEMENS AG"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "A5E45074588"),
++ },
++ },
++
+ { /*sentinel*/ }
+ };
+
+diff --git a/drivers/regulator/ab8500.c b/drivers/regulator/ab8500.c
+index 83dba3fbfe0c..60578820432d 100644
+--- a/drivers/regulator/ab8500.c
++++ b/drivers/regulator/ab8500.c
+@@ -956,23 +956,6 @@ static struct ab8500_regulator_info
+ .update_val_idle = 0x82,
+ .update_val_normal = 0x02,
+ },
+- [AB8505_LDO_USB] = {
+- .desc = {
+- .name = "LDO-USB",
+- .ops = &ab8500_regulator_mode_ops,
+- .type = REGULATOR_VOLTAGE,
+- .id = AB8505_LDO_USB,
+- .owner = THIS_MODULE,
+- .n_voltages = 1,
+- .volt_table = fixed_3300000_voltage,
+- },
+- .update_bank = 0x03,
+- .update_reg = 0x82,
+- .update_mask = 0x03,
+- .update_val = 0x01,
+- .update_val_idle = 0x03,
+- .update_val_normal = 0x01,
+- },
+ [AB8505_LDO_AUDIO] = {
+ .desc = {
+ .name = "LDO-AUDIO",
+diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
+index 0148ae62a52a..e320534310b1 100644
+--- a/drivers/scsi/libsas/sas_discover.c
++++ b/drivers/scsi/libsas/sas_discover.c
+@@ -97,12 +97,21 @@ static int sas_get_port_device(struct asd_sas_port *port)
+ else
+ dev->dev_type = SAS_SATA_DEV;
+ dev->tproto = SAS_PROTOCOL_SATA;
+- } else {
++ } else if (port->oob_mode == SAS_OOB_MODE) {
+ struct sas_identify_frame *id =
+ (struct sas_identify_frame *) dev->frame_rcvd;
+ dev->dev_type = id->dev_type;
+ dev->iproto = id->initiator_bits;
+ dev->tproto = id->target_bits;
++ } else {
++ /* If the oob mode is OOB_NOT_CONNECTED, the port is
++ * disconnected due to race with PHY down. We cannot
++ * continue to discover this port
++ */
++ sas_put_device(dev);
++ pr_warn("Port %016llx is disconnected when discovering\n",
++ SAS_ADDR(port->attached_sas_addr));
++ return -ENODEV;
+ }
+
+ sas_init_dev(dev);
+diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
+index 99aea52e584b..21f104c5eab6 100644
+--- a/drivers/scsi/lpfc/lpfc_bsg.c
++++ b/drivers/scsi/lpfc/lpfc_bsg.c
+@@ -4419,12 +4419,6 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job,
+ phba->mbox_ext_buf_ctx.seqNum++;
+ nemb_tp = phba->mbox_ext_buf_ctx.nembType;
+
+- dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
+- if (!dd_data) {
+- rc = -ENOMEM;
+- goto job_error;
+- }
+-
+ pbuf = (uint8_t *)dmabuf->virt;
+ size = job->request_payload.payload_len;
+ sg_copy_to_buffer(job->request_payload.sg_list,
+@@ -4461,6 +4455,13 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job,
+ "2968 SLI_CONFIG ext-buffer wr all %d "
+ "ebuffers received\n",
+ phba->mbox_ext_buf_ctx.numBuf);
++
++ dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
++ if (!dd_data) {
++ rc = -ENOMEM;
++ goto job_error;
++ }
++
+ /* mailbox command structure for base driver */
+ pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
+ if (!pmboxq) {
+@@ -4509,6 +4510,8 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job,
+ return SLI_CONFIG_HANDLED;
+
+ job_error:
++ if (pmboxq)
++ mempool_free(pmboxq, phba->mbox_mem_pool);
+ lpfc_bsg_dma_page_free(phba, dmabuf);
+ kfree(dd_data);
+
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index f73726e55e44..6c355d87c709 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -1903,6 +1903,8 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport,
+
+ /* Declare and initialization an instance of the FC NVME template. */
+ static struct nvme_fc_port_template lpfc_nvme_template = {
++ .module = THIS_MODULE,
++
+ /* initiator-based functions */
+ .localport_delete = lpfc_nvme_localport_delete,
+ .remoteport_delete = lpfc_nvme_remoteport_delete,
+diff --git a/drivers/scsi/qedf/qedf_els.c b/drivers/scsi/qedf/qedf_els.c
+index 04f0c4d2e256..5178cd03666a 100644
+--- a/drivers/scsi/qedf/qedf_els.c
++++ b/drivers/scsi/qedf/qedf_els.c
+@@ -23,8 +23,6 @@ static int qedf_initiate_els(struct qedf_rport *fcport, unsigned int op,
+ int rc = 0;
+ uint32_t did, sid;
+ uint16_t xid;
+- uint32_t start_time = jiffies / HZ;
+- uint32_t current_time;
+ struct fcoe_wqe *sqe;
+ unsigned long flags;
+ u16 sqe_idx;
+@@ -59,18 +57,12 @@ static int qedf_initiate_els(struct qedf_rport *fcport, unsigned int op,
+ goto els_err;
+ }
+
+-retry_els:
+ els_req = qedf_alloc_cmd(fcport, QEDF_ELS);
+ if (!els_req) {
+- current_time = jiffies / HZ;
+- if ((current_time - start_time) > 10) {
+- QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_ELS,
+- "els: Failed els 0x%x\n", op);
+- rc = -ENOMEM;
+- goto els_err;
+- }
+- mdelay(20 * USEC_PER_MSEC);
+- goto retry_els;
++ QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_ELS,
++ "Failed to alloc ELS request 0x%x\n", op);
++ rc = -ENOMEM;
++ goto els_err;
+ }
+
+ QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_ELS, "initiate_els els_req = "
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 4512aaa16f78..851f75b12216 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -4815,14 +4815,8 @@ qla2x00_configure_loop(scsi_qla_host_t *vha)
+ set_bit(RSCN_UPDATE, &flags);
+ clear_bit(LOCAL_LOOP_UPDATE, &flags);
+
+- } else if (ha->current_topology == ISP_CFG_N) {
+- clear_bit(RSCN_UPDATE, &flags);
+- if (qla_tgt_mode_enabled(vha)) {
+- /* allow the other side to start the login */
+- clear_bit(LOCAL_LOOP_UPDATE, &flags);
+- set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
+- }
+- } else if (ha->current_topology == ISP_CFG_NL) {
++ } else if (ha->current_topology == ISP_CFG_NL ||
++ ha->current_topology == ISP_CFG_N) {
+ clear_bit(RSCN_UPDATE, &flags);
+ set_bit(LOCAL_LOOP_UPDATE, &flags);
+ } else if (!vha->flags.online ||
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index c699bbb8485b..7e47321e003c 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -2537,7 +2537,8 @@ qla24xx_els_logo_iocb(srb_t *sp, struct els_entry_24xx *els_iocb)
+ ql_dbg(ql_dbg_io + ql_dbg_buffer, vha, 0x3073,
+ "PLOGI ELS IOCB:\n");
+ ql_dump_buffer(ql_log_info, vha, 0x0109,
+- (uint8_t *)els_iocb, 0x70);
++ (uint8_t *)els_iocb,
++ sizeof(*els_iocb));
+ } else {
+ els_iocb->tx_byte_count = sizeof(struct els_logo_payload);
+ els_iocb->tx_address[0] =
+@@ -2703,7 +2704,8 @@ qla24xx_els_dcmd2_iocb(scsi_qla_host_t *vha, int els_opcode,
+
+ ql_dbg(ql_dbg_disc + ql_dbg_buffer, vha, 0x3073, "PLOGI buffer:\n");
+ ql_dump_buffer(ql_dbg_disc + ql_dbg_buffer, vha, 0x0109,
+- (uint8_t *)elsio->u.els_plogi.els_plogi_pyld, 0x70);
++ (uint8_t *)elsio->u.els_plogi.els_plogi_pyld,
++ sizeof(*elsio->u.els_plogi.els_plogi_pyld));
+
+ rval = qla2x00_start_sp(sp);
+ if (rval != QLA_SUCCESS) {
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index afe15b3e45fb..e6d162945f5d 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -1049,8 +1049,6 @@ global_port_update:
+ ql_dbg(ql_dbg_async, vha, 0x5011,
+ "Asynchronous PORT UPDATE ignored %04x/%04x/%04x.\n",
+ mb[1], mb[2], mb[3]);
+-
+- qlt_async_event(mb[0], vha, mb);
+ break;
+ }
+
+@@ -1067,8 +1065,6 @@ global_port_update:
+ set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+ set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
+ set_bit(VP_CONFIG_OK, &vha->vp_flags);
+-
+- qlt_async_event(mb[0], vha, mb);
+ break;
+
+ case MBA_RSCN_UPDATE: /* State Change Registration */
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index b01f69dd4b28..abef3b29fa10 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -3871,6 +3871,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ vha->d_id.b24 = 0;
+ vha->d_id.b.al_pa = 1;
+ ha->flags.n2n_bigger = 1;
++ ha->flags.n2n_ae = 0;
+
+ id.b.al_pa = 2;
+ ql_dbg(ql_dbg_async, vha, 0x5075,
+@@ -3881,6 +3882,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ "Format 1: Remote login - Waiting for WWPN %8phC.\n",
+ rptid_entry->u.f1.port_name);
+ ha->flags.n2n_bigger = 0;
++ ha->flags.n2n_ae = 1;
+ }
+ qla24xx_post_newsess_work(vha, &id,
+ rptid_entry->u.f1.port_name,
+@@ -3892,7 +3894,6 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ /* if our portname is higher then initiate N2N login */
+
+ set_bit(N2N_LOGIN_NEEDED, &vha->dpc_flags);
+- ha->flags.n2n_ae = 1;
+ return;
+ break;
+ case TOPO_FL:
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 5590d6e8b576..db367e428095 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -560,6 +560,7 @@ static void qla_nvme_remoteport_delete(struct nvme_fc_remote_port *rport)
+ }
+
+ static struct nvme_fc_port_template qla_nvme_fc_transport = {
++ .module = THIS_MODULE,
+ .localport_delete = qla_nvme_localport_delete,
+ .remoteport_delete = qla_nvme_remoteport_delete,
+ .create_queue = qla_nvme_alloc_queue,
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 210ce294038d..e9545411ec5a 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1261,7 +1261,6 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
+ "Scheduling sess %p for deletion %8phC\n",
+ sess, sess->port_name);
+
+- INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn);
+ WARN_ON(!queue_work(sess->vha->hw->wq, &sess->del_work));
+ }
+
+@@ -4780,6 +4779,7 @@ static int qlt_handle_login(struct scsi_qla_host *vha,
+
+ switch (sess->disc_state) {
+ case DSC_DELETED:
++ case DSC_LOGIN_PEND:
+ qlt_plogi_ack_unref(vha, pla);
+ break;
+
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index 25c8ce54a976..f8acf101af3d 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -4280,7 +4280,6 @@ static int qla4xxx_mem_alloc(struct scsi_qla_host *ha)
+ return QLA_SUCCESS;
+
+ mem_alloc_error_exit:
+- qla4xxx_mem_free(ha);
+ return QLA_ERROR;
+ }
+
+diff --git a/drivers/tty/hvc/hvc_vio.c b/drivers/tty/hvc/hvc_vio.c
+index 59eaa620bf13..80fd06fbd712 100644
+--- a/drivers/tty/hvc/hvc_vio.c
++++ b/drivers/tty/hvc/hvc_vio.c
+@@ -107,6 +107,14 @@ static int hvterm_raw_get_chars(uint32_t vtermno, char *buf, int count)
+ return got;
+ }
+
++/**
++ * hvterm_raw_put_chars: send characters to firmware for given vterm adapter
++ * @vtermno: The virtual terminal number.
++ * @buf: The characters to send. Because of the underlying hypercall in
++ * hvc_put_chars(), this buffer must be at least 16 bytes long, even if
++ * you are sending fewer chars.
++ * @count: number of chars to send.
++ */
+ static int hvterm_raw_put_chars(uint32_t vtermno, const char *buf, int count)
+ {
+ struct hvterm_priv *pv = hvterm_privs[vtermno];
+@@ -219,6 +227,7 @@ static const struct hv_ops hvterm_hvsi_ops = {
+ static void udbg_hvc_putc(char c)
+ {
+ int count = -1;
++ unsigned char bounce_buffer[16];
+
+ if (!hvterm_privs[0])
+ return;
+@@ -229,7 +238,12 @@ static void udbg_hvc_putc(char c)
+ do {
+ switch(hvterm_privs[0]->proto) {
+ case HV_PROTOCOL_RAW:
+- count = hvterm_raw_put_chars(0, &c, 1);
++ /*
++ * hvterm_raw_put_chars requires at least a 16-byte
++ * buffer, so go via the bounce buffer
++ */
++ bounce_buffer[0] = c;
++ count = hvterm_raw_put_chars(0, bounce_buffer, 1);
+ break;
+ case HV_PROTOCOL_HVSI:
+ count = hvterm_hvsi_put_chars(0, &c, 1);
+diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
+index c10d9cc553c6..4caeca67fd14 100644
+--- a/drivers/tty/serial/msm_serial.c
++++ b/drivers/tty/serial/msm_serial.c
+@@ -1580,6 +1580,7 @@ static void __msm_console_write(struct uart_port *port, const char *s,
+ int num_newlines = 0;
+ bool replaced = false;
+ void __iomem *tf;
++ int locked = 1;
+
+ if (is_uartdm)
+ tf = port->membase + UARTDM_TF;
+@@ -1592,7 +1593,13 @@ static void __msm_console_write(struct uart_port *port, const char *s,
+ num_newlines++;
+ count += num_newlines;
+
+- spin_lock(&port->lock);
++ if (port->sysrq)
++ locked = 0;
++ else if (oops_in_progress)
++ locked = spin_trylock(&port->lock);
++ else
++ spin_lock(&port->lock);
++
+ if (is_uartdm)
+ msm_reset_dm_count(port, count);
+
+@@ -1628,7 +1635,9 @@ static void __msm_console_write(struct uart_port *port, const char *s,
+ iowrite32_rep(tf, buf, 1);
+ i += num_chars;
+ }
+- spin_unlock(&port->lock);
++
++ if (locked)
++ spin_unlock(&port->lock);
+ }
+
+ static void msm_console_write(struct console *co, const char *s,
+diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c
+index 6ce044008cf6..460d5d7c984f 100644
+--- a/drivers/usb/gadget/function/f_ecm.c
++++ b/drivers/usb/gadget/function/f_ecm.c
+@@ -621,8 +621,12 @@ static void ecm_disable(struct usb_function *f)
+
+ DBG(cdev, "ecm deactivated\n");
+
+- if (ecm->port.in_ep->enabled)
++ if (ecm->port.in_ep->enabled) {
+ gether_disconnect(&ecm->port);
++ } else {
++ ecm->port.in_ep->desc = NULL;
++ ecm->port.out_ep->desc = NULL;
++ }
+
+ usb_ep_disable(ecm->notify);
+ ecm->notify->desc = NULL;
+diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
+index d48df36622b7..0d8e4a364ca6 100644
+--- a/drivers/usb/gadget/function/f_rndis.c
++++ b/drivers/usb/gadget/function/f_rndis.c
+@@ -618,6 +618,7 @@ static void rndis_disable(struct usb_function *f)
+ gether_disconnect(&rndis->port);
+
+ usb_ep_disable(rndis->notify);
++ rndis->notify->desc = NULL;
+ }
+
+ /*-------------------------------------------------------------------------*/
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index 747a15acbce3..6fa7209f24f4 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -395,7 +395,8 @@ static struct notifier_block xen_memory_nb = {
+ #else
+ static enum bp_state reserve_additional_memory(void)
+ {
+- balloon_stats.target_pages = balloon_stats.current_pages;
++ balloon_stats.target_pages = balloon_stats.current_pages +
++ balloon_stats.target_unpopulated;
+ return BP_ECANCELED;
+ }
+ #endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */
+diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
+index f29c6dade7f6..069273a2483f 100644
+--- a/fs/afs/dynroot.c
++++ b/fs/afs/dynroot.c
+@@ -145,6 +145,9 @@ static struct dentry *afs_dynroot_lookup(struct inode *dir, struct dentry *dentr
+
+ ASSERTCMP(d_inode(dentry), ==, NULL);
+
++ if (flags & LOOKUP_CREATE)
++ return ERR_PTR(-EOPNOTSUPP);
++
+ if (dentry->d_name.len >= AFSNAMEMAX) {
+ _leave(" = -ENAMETOOLONG");
+ return ERR_PTR(-ENAMETOOLONG);
+diff --git a/fs/afs/server.c b/fs/afs/server.c
+index 1d329e6981d5..2c7f6211c360 100644
+--- a/fs/afs/server.c
++++ b/fs/afs/server.c
+@@ -34,18 +34,11 @@ static void afs_dec_servers_outstanding(struct afs_net *net)
+ struct afs_server *afs_find_server(struct afs_net *net,
+ const struct sockaddr_rxrpc *srx)
+ {
+- const struct sockaddr_in6 *a = &srx->transport.sin6, *b;
+ const struct afs_addr_list *alist;
+ struct afs_server *server = NULL;
+ unsigned int i;
+- bool ipv6 = true;
+ int seq = 0, diff;
+
+- if (srx->transport.sin6.sin6_addr.s6_addr32[0] == 0 ||
+- srx->transport.sin6.sin6_addr.s6_addr32[1] == 0 ||
+- srx->transport.sin6.sin6_addr.s6_addr32[2] == htonl(0xffff))
+- ipv6 = false;
+-
+ rcu_read_lock();
+
+ do {
+@@ -54,7 +47,8 @@ struct afs_server *afs_find_server(struct afs_net *net,
+ server = NULL;
+ read_seqbegin_or_lock(&net->fs_addr_lock, &seq);
+
+- if (ipv6) {
++ if (srx->transport.family == AF_INET6) {
++ const struct sockaddr_in6 *a = &srx->transport.sin6, *b;
+ hlist_for_each_entry_rcu(server, &net->fs_addresses6, addr6_link) {
+ alist = rcu_dereference(server->addresses);
+ for (i = alist->nr_ipv4; i < alist->nr_addrs; i++) {
+@@ -70,15 +64,16 @@ struct afs_server *afs_find_server(struct afs_net *net,
+ }
+ }
+ } else {
++ const struct sockaddr_in *a = &srx->transport.sin, *b;
+ hlist_for_each_entry_rcu(server, &net->fs_addresses4, addr4_link) {
+ alist = rcu_dereference(server->addresses);
+ for (i = 0; i < alist->nr_ipv4; i++) {
+- b = &alist->addrs[i].transport.sin6;
+- diff = ((u16 __force)a->sin6_port -
+- (u16 __force)b->sin6_port);
++ b = &alist->addrs[i].transport.sin;
++ diff = ((u16 __force)a->sin_port -
++ (u16 __force)b->sin_port);
+ if (diff == 0)
+- diff = ((u32 __force)a->sin6_addr.s6_addr32[3] -
+- (u32 __force)b->sin6_addr.s6_addr32[3]);
++ diff = ((u32 __force)a->sin_addr.s_addr -
++ (u32 __force)b->sin_addr.s_addr);
+ if (diff == 0)
+ goto found;
+ }
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index 4d3e274207fb..bd2608297473 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -404,7 +404,6 @@ static int afs_fill_super(struct super_block *sb,
+ /* allocate the root inode and dentry */
+ if (as->dyn_root) {
+ inode = afs_iget_pseudo_dir(sb, true);
+- sb->s_flags |= SB_RDONLY;
+ } else {
+ sprintf(sb->s_id, "%u", as->volume->vid);
+ afs_activate_volume(as->volume);
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 1c25dae083a8..c158bad9a075 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1328,11 +1328,7 @@ static void flush_disk(struct block_device *bdev, bool kill_dirty)
+ "resized disk %s\n",
+ bdev->bd_disk ? bdev->bd_disk->disk_name : "");
+ }
+-
+- if (!bdev->bd_disk)
+- return;
+- if (disk_part_scan_enabled(bdev->bd_disk))
+- bdev->bd_invalidated = 1;
++ bdev->bd_invalidated = 1;
+ }
+
+ /**
+@@ -1430,6 +1426,19 @@ EXPORT_SYMBOL(bd_set_size);
+
+ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part);
+
++static void bdev_disk_changed(struct block_device *bdev, bool invalidate)
++{
++ if (disk_part_scan_enabled(bdev->bd_disk)) {
++ if (invalidate)
++ invalidate_partitions(bdev->bd_disk, bdev);
++ else
++ rescan_partitions(bdev->bd_disk, bdev);
++ } else {
++ check_disk_size_change(bdev->bd_disk, bdev, !invalidate);
++ bdev->bd_invalidated = 0;
++ }
++}
++
+ /*
+ * bd_mutex locking:
+ *
+@@ -1512,12 +1521,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ * The latter is necessary to prevent ghost
+ * partitions on a removed medium.
+ */
+- if (bdev->bd_invalidated) {
+- if (!ret)
+- rescan_partitions(disk, bdev);
+- else if (ret == -ENOMEDIUM)
+- invalidate_partitions(disk, bdev);
+- }
++ if (bdev->bd_invalidated &&
++ (!ret || ret == -ENOMEDIUM))
++ bdev_disk_changed(bdev, ret == -ENOMEDIUM);
+
+ if (ret)
+ goto out_clear;
+@@ -1550,12 +1556,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ if (bdev->bd_disk->fops->open)
+ ret = bdev->bd_disk->fops->open(bdev, mode);
+ /* the same as first opener case, read comment there */
+- if (bdev->bd_invalidated) {
+- if (!ret)
+- rescan_partitions(bdev->bd_disk, bdev);
+- else if (ret == -ENOMEDIUM)
+- invalidate_partitions(bdev->bd_disk, bdev);
+- }
++ if (bdev->bd_invalidated &&
++ (!ret || ret == -ENOMEDIUM))
++ bdev_disk_changed(bdev, ret == -ENOMEDIUM);
+ if (ret)
+ goto out_unlock_bdev;
+ }
+diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
+index 3a03f74a8cc4..c6fe9914440e 100644
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -1401,10 +1401,11 @@ COMPAT_SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd,
+ #endif
+
+ case FICLONE:
++ goto do_ioctl;
+ case FICLONERANGE:
+ case FIDEDUPERANGE:
+ case FS_IOC_FIEMAP:
+- goto do_ioctl;
++ goto found_handler;
+
+ case FIBMAP:
+ case FIGETBSZ:
+diff --git a/fs/locks.c b/fs/locks.c
+index 2ecb4db8c840..28270e74be34 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -2678,7 +2678,7 @@ static void lock_get_status(struct seq_file *f, struct file_lock *fl,
+ }
+ if (inode) {
+ /* userspace relies on this representation of dev_t */
+- seq_printf(f, "%d %02x:%02x:%ld ", fl_pid,
++ seq_printf(f, "%d %02x:%02x:%lu ", fl_pid,
+ MAJOR(inode->i_sb->s_dev),
+ MINOR(inode->i_sb->s_dev), inode->i_ino);
+ } else {
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 5f62007140cf..c8ce128e0054 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3072,12 +3072,17 @@ static bool replay_matches_cache(struct svc_rqst *rqstp,
+ (bool)seq->cachethis)
+ return false;
+ /*
+- * If there's an error than the reply can have fewer ops than
+- * the call. But if we cached a reply with *more* ops than the
+- * call you're sending us now, then this new call is clearly not
+- * really a replay of the old one:
++ * If there's an error then the reply can have fewer ops than
++ * the call.
+ */
+- if (slot->sl_opcnt < argp->opcnt)
++ if (slot->sl_opcnt < argp->opcnt && !slot->sl_status)
++ return false;
++ /*
++ * But if we cached a reply with *more* ops than the call you're
++ * sending us now, then this new call is clearly not really a
++ * replay of the old one:
++ */
++ if (slot->sl_opcnt > argp->opcnt)
+ return false;
+ /* This is the only check explicitly called by spec: */
+ if (!same_creds(&rqstp->rq_cred, &slot->sl_cred))
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 631ae057ab53..bafbab2dd039 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -437,6 +437,17 @@ static int notrace ramoops_pstore_write(struct pstore_record *record)
+
+ prz = cxt->dprzs[cxt->dump_write_cnt];
+
++ /*
++ * Since this is a new crash dump, we need to reset the buffer in
++ * case it still has an old dump present. Without this, the new dump
++ * will get appended, which would seriously confuse anything trying
++ * to check dump file contents. Specifically, ramoops_read_kmsg_hdr()
++ * expects to find a dump header in the beginning of buffer data, so
++ * we must to reset the buffer values, in order to ensure that the
++ * header will be written to the beginning of the buffer.
++ */
++ persistent_ram_zap(prz);
++
+ /* Build header and append record contents. */
+ hlen = ramoops_write_kmsg_hdr(prz, record);
+ size = record->size;
+diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
+index dba87d09b989..95630f9f40dd 100644
+--- a/fs/ubifs/tnc_commit.c
++++ b/fs/ubifs/tnc_commit.c
+@@ -219,7 +219,7 @@ static int is_idx_node_in_use(struct ubifs_info *c, union ubifs_key *key,
+ /**
+ * layout_leb_in_gaps - layout index nodes using in-the-gaps method.
+ * @c: UBIFS file-system description object
+- * @p: return LEB number here
++ * @p: return LEB number in @c->gap_lebs[p]
+ *
+ * This function lays out new index nodes for dirty znodes using in-the-gaps
+ * method of TNC commit.
+@@ -228,7 +228,7 @@ static int is_idx_node_in_use(struct ubifs_info *c, union ubifs_key *key,
+ * This function returns the number of index nodes written into the gaps, or a
+ * negative error code on failure.
+ */
+-static int layout_leb_in_gaps(struct ubifs_info *c, int *p)
++static int layout_leb_in_gaps(struct ubifs_info *c, int p)
+ {
+ struct ubifs_scan_leb *sleb;
+ struct ubifs_scan_node *snod;
+@@ -243,7 +243,7 @@ static int layout_leb_in_gaps(struct ubifs_info *c, int *p)
+ * filled, however we do not check there at present.
+ */
+ return lnum; /* Error code */
+- *p = lnum;
++ c->gap_lebs[p] = lnum;
+ dbg_gc("LEB %d", lnum);
+ /*
+ * Scan the index LEB. We use the generic scan for this even though
+@@ -362,7 +362,7 @@ static int get_leb_cnt(struct ubifs_info *c, int cnt)
+ */
+ static int layout_in_gaps(struct ubifs_info *c, int cnt)
+ {
+- int err, leb_needed_cnt, written, *p;
++ int err, leb_needed_cnt, written, p = 0, old_idx_lebs, *gap_lebs;
+
+ dbg_gc("%d znodes to write", cnt);
+
+@@ -371,9 +371,9 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
+ if (!c->gap_lebs)
+ return -ENOMEM;
+
+- p = c->gap_lebs;
++ old_idx_lebs = c->lst.idx_lebs;
+ do {
+- ubifs_assert(c, p < c->gap_lebs + c->lst.idx_lebs);
++ ubifs_assert(c, p < c->lst.idx_lebs);
+ written = layout_leb_in_gaps(c, p);
+ if (written < 0) {
+ err = written;
+@@ -399,9 +399,29 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
+ leb_needed_cnt = get_leb_cnt(c, cnt);
+ dbg_gc("%d znodes remaining, need %d LEBs, have %d", cnt,
+ leb_needed_cnt, c->ileb_cnt);
++ /*
++ * Dynamically change the size of @c->gap_lebs to prevent
++ * oob, because @c->lst.idx_lebs could be increased by
++ * function @get_idx_gc_leb (called by layout_leb_in_gaps->
++ * ubifs_find_dirty_idx_leb) during loop. Only enlarge
++ * @c->gap_lebs when needed.
++ *
++ */
++ if (leb_needed_cnt > c->ileb_cnt && p >= old_idx_lebs &&
++ old_idx_lebs < c->lst.idx_lebs) {
++ old_idx_lebs = c->lst.idx_lebs;
++ gap_lebs = krealloc(c->gap_lebs, sizeof(int) *
++ (old_idx_lebs + 1), GFP_NOFS);
++ if (!gap_lebs) {
++ kfree(c->gap_lebs);
++ c->gap_lebs = NULL;
++ return -ENOMEM;
++ }
++ c->gap_lebs = gap_lebs;
++ }
+ } while (leb_needed_cnt > c->ileb_cnt);
+
+- *p = -1;
++ c->gap_lebs[p] = -1;
+ return 0;
+ }
+
+diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
+index 38dc0b43c366..0b7145fdb8aa 100644
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -5239,7 +5239,7 @@ __xfs_bunmapi(
+ * Make sure we don't touch multiple AGF headers out of order
+ * in a single transaction, as that could cause AB-BA deadlocks.
+ */
+- if (!wasdel) {
++ if (!wasdel && !isrt) {
+ agno = XFS_FSB_TO_AGNO(mp, del.br_startblock);
+ if (prev_agno != NULLAGNUMBER && prev_agno > agno)
+ break;
+diff --git a/fs/xfs/scrub/common.h b/fs/xfs/scrub/common.h
+index 2d4324d12f9a..51ea2ab124b7 100644
+--- a/fs/xfs/scrub/common.h
++++ b/fs/xfs/scrub/common.h
+@@ -14,8 +14,15 @@
+ static inline bool
+ xchk_should_terminate(
+ struct xfs_scrub *sc,
+- int *error)
++ int *error)
+ {
++ /*
++ * If preemption is disabled, we need to yield to the scheduler every
++ * few seconds so that we don't run afoul of the soft lockup watchdog
++ * or RCU stall detector.
++ */
++ cond_resched();
++
+ if (fatal_signal_pending(current)) {
+ if (*error == 0)
+ *error = -EAGAIN;
+diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
+index c3b610b687d1..7bba551cbf90 100644
+--- a/fs/xfs/xfs_log.c
++++ b/fs/xfs/xfs_log.c
+@@ -1578,6 +1578,8 @@ out_free_iclog:
+ if (iclog->ic_bp)
+ xfs_buf_free(iclog->ic_bp);
+ kmem_free(iclog);
++ if (prev_iclog == log->l_iclog)
++ break;
+ }
+ spinlock_destroy(&log->l_icloglock);
+ xfs_buf_free(log->l_xbuf);
+diff --git a/include/linux/ahci_platform.h b/include/linux/ahci_platform.h
+index eaedca5fe6fc..345c3b510045 100644
+--- a/include/linux/ahci_platform.h
++++ b/include/linux/ahci_platform.h
+@@ -23,6 +23,8 @@ struct ahci_host_priv;
+ struct platform_device;
+ struct scsi_host_template;
+
++int ahci_platform_enable_phys(struct ahci_host_priv *hpriv);
++void ahci_platform_disable_phys(struct ahci_host_priv *hpriv);
+ int ahci_platform_enable_clks(struct ahci_host_priv *hpriv);
+ void ahci_platform_disable_clks(struct ahci_host_priv *hpriv);
+ int ahci_platform_enable_regulators(struct ahci_host_priv *hpriv);
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index d49ec5c31944..0647f436f88c 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -1373,8 +1373,11 @@ static inline int dma_get_slave_caps(struct dma_chan *chan,
+ static inline int dmaengine_desc_set_reuse(struct dma_async_tx_descriptor *tx)
+ {
+ struct dma_slave_caps caps;
++ int ret;
+
+- dma_get_slave_caps(tx->chan, &caps);
++ ret = dma_get_slave_caps(tx->chan, &caps);
++ if (ret)
++ return ret;
+
+ if (caps.descriptor_reuse) {
+ tx->flags |= DMA_CTRL_REUSE;
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 38c95d66ab12..aff09d0b3545 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -1190,6 +1190,7 @@ extern unsigned int ata_do_dev_read_id(struct ata_device *dev,
+ struct ata_taskfile *tf, u16 *id);
+ extern void ata_qc_complete(struct ata_queued_cmd *qc);
+ extern int ata_qc_complete_multiple(struct ata_port *ap, u64 qc_active);
++extern u64 ata_qc_get_active(struct ata_port *ap);
+ extern void ata_scsi_simulate(struct ata_device *dev, struct scsi_cmnd *cmd);
+ extern int ata_std_bios_param(struct scsi_device *sdev,
+ struct block_device *bdev,
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 9dfa0ae173ac..d5527e3828d1 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1619,6 +1619,8 @@ enum netdev_priv_flags {
+ * @perm_addr: Permanent hw address
+ * @addr_assign_type: Hw address assignment type
+ * @addr_len: Hardware address length
++ * @upper_level: Maximum depth level of upper devices.
++ * @lower_level: Maximum depth level of lower devices.
+ * @neigh_priv_len: Used in neigh_alloc()
+ * @dev_id: Used to differentiate devices that share
+ * the same link layer address
+@@ -1853,6 +1855,8 @@ struct net_device {
+ unsigned char perm_addr[MAX_ADDR_LEN];
+ unsigned char addr_assign_type;
+ unsigned char addr_len;
++ unsigned char upper_level;
++ unsigned char lower_level;
+ unsigned short neigh_priv_len;
+ unsigned short dev_id;
+ unsigned short dev_port;
+diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h
+index 496ff759f84c..2f3ae41c212d 100644
+--- a/include/linux/nvme-fc-driver.h
++++ b/include/linux/nvme-fc-driver.h
+@@ -282,6 +282,8 @@ struct nvme_fc_remote_port {
+ *
+ * Host/Initiator Transport Entrypoints/Parameters:
+ *
++ * @module: The LLDD module using the interface
++ *
+ * @localport_delete: The LLDD initiates deletion of a localport via
+ * nvme_fc_deregister_localport(). However, the teardown is
+ * asynchronous. This routine is called upon the completion of the
+@@ -395,6 +397,8 @@ struct nvme_fc_remote_port {
+ * Value is Mandatory. Allowed to be zero.
+ */
+ struct nvme_fc_port_template {
++ struct module *module;
++
+ /* initiator-based functions */
+ void (*localport_delete)(struct nvme_fc_local_port *);
+ void (*remoteport_delete)(struct nvme_fc_remote_port *);
+diff --git a/include/linux/regulator/ab8500.h b/include/linux/regulator/ab8500.h
+index 6d46f962685d..06978ce01302 100644
+--- a/include/linux/regulator/ab8500.h
++++ b/include/linux/regulator/ab8500.h
+@@ -38,7 +38,6 @@ enum ab8505_regulator_id {
+ AB8505_LDO_AUX6,
+ AB8505_LDO_INTCORE,
+ AB8505_LDO_ADC,
+- AB8505_LDO_USB,
+ AB8505_LDO_AUDIO,
+ AB8505_LDO_ANAMIC1,
+ AB8505_LDO_ANAMIC2,
+diff --git a/include/net/neighbour.h b/include/net/neighbour.h
+index c84807c1c5bd..5ce035984a4d 100644
+--- a/include/net/neighbour.h
++++ b/include/net/neighbour.h
+@@ -459,7 +459,7 @@ static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb
+
+ do {
+ seq = read_seqbegin(&hh->hh_lock);
+- hh_len = hh->hh_len;
++ hh_len = READ_ONCE(hh->hh_len);
+ if (likely(hh_len <= HH_DATA_MOD)) {
+ hh_alen = HH_DATA_MOD;
+
+diff --git a/kernel/cred.c b/kernel/cred.c
+index 5ab1f7ec946e..a9f0f8b21d8c 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -220,7 +220,7 @@ struct cred *cred_alloc_blank(void)
+ new->magic = CRED_MAGIC;
+ #endif
+
+- if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
++ if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0)
+ goto error;
+
+ return new;
+@@ -279,7 +279,7 @@ struct cred *prepare_creds(void)
+ new->security = NULL;
+ #endif
+
+- if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
++ if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
+ goto error;
+ validate_creds(new);
+ return new;
+@@ -654,7 +654,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
+ #ifdef CONFIG_SECURITY
+ new->security = NULL;
+ #endif
+- if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
++ if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
+ goto error;
+
+ put_cred(old);
+diff --git a/kernel/exit.c b/kernel/exit.c
+index e10de9836dd7..54c3269b8dda 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -578,10 +578,6 @@ static struct task_struct *find_child_reaper(struct task_struct *father,
+ }
+
+ write_unlock_irq(&tasklist_lock);
+- if (unlikely(pid_ns == &init_pid_ns)) {
+- panic("Attempted to kill init! exitcode=0x%08x\n",
+- father->signal->group_exit_code ?: father->exit_code);
+- }
+
+ list_for_each_entry_safe(p, n, dead, ptrace_entry) {
+ list_del_init(&p->ptrace_entry);
+@@ -845,6 +841,14 @@ void __noreturn do_exit(long code)
+ acct_update_integrals(tsk);
+ group_dead = atomic_dec_and_test(&tsk->signal->live);
+ if (group_dead) {
++ /*
++ * If the last thread of global init has exited, panic
++ * immediately to get a useable coredump.
++ */
++ if (unlikely(is_global_init(tsk)))
++ panic("Attempted to kill init! exitcode=0x%08x\n",
++ tsk->signal->group_exit_code ?: (int)code);
++
+ #ifdef CONFIG_POSIX_TIMERS
+ hrtimer_cancel(&tsk->signal->real_timer);
+ exit_itimers(tsk->signal);
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 3d37c279c090..f2635fc751d9 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -736,8 +736,15 @@ zone_found:
+ * We have found the zone. Now walk the radix tree to find the leaf node
+ * for our PFN.
+ */
++
++ /*
++ * If the zone we wish to scan is the the current zone and the
++ * pfn falls into the current node then we do not need to walk
++ * the tree.
++ */
+ node = bm->cur.node;
+- if (((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn)
++ if (zone == bm->cur.zone &&
++ ((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn)
+ goto node_found;
+
+ node = zone->rtree;
+diff --git a/kernel/taskstats.c b/kernel/taskstats.c
+index 4e62a4a8fa91..82393952683c 100644
+--- a/kernel/taskstats.c
++++ b/kernel/taskstats.c
+@@ -564,25 +564,33 @@ static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
+ static struct taskstats *taskstats_tgid_alloc(struct task_struct *tsk)
+ {
+ struct signal_struct *sig = tsk->signal;
+- struct taskstats *stats;
++ struct taskstats *stats_new, *stats;
+
+- if (sig->stats || thread_group_empty(tsk))
+- goto ret;
++ /* Pairs with smp_store_release() below. */
++ stats = smp_load_acquire(&sig->stats);
++ if (stats || thread_group_empty(tsk))
++ return stats;
+
+ /* No problem if kmem_cache_zalloc() fails */
+- stats = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL);
++ stats_new = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL);
+
+ spin_lock_irq(&tsk->sighand->siglock);
+- if (!sig->stats) {
+- sig->stats = stats;
+- stats = NULL;
++ stats = sig->stats;
++ if (!stats) {
++ /*
++ * Pairs with smp_store_release() above and order the
++ * kmem_cache_zalloc().
++ */
++ smp_store_release(&sig->stats, stats_new);
++ stats = stats_new;
++ stats_new = NULL;
+ }
+ spin_unlock_irq(&tsk->sighand->siglock);
+
+- if (stats)
+- kmem_cache_free(taskstats_cache, stats);
+-ret:
+- return sig->stats;
++ if (stats_new)
++ kmem_cache_free(taskstats_cache, stats_new);
++
++ return stats;
+ }
+
+ /* Send pid data out on exit */
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index b84eb9659e95..37a435bac161 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -554,8 +554,7 @@ static int function_stat_show(struct seq_file *m, void *v)
+ }
+
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+- avg = rec->time;
+- do_div(avg, rec->counter);
++ avg = div64_ul(rec->time, rec->counter);
+ if (tracing_thresh && (avg < tracing_thresh))
+ goto out;
+ #endif
+@@ -581,7 +580,8 @@ static int function_stat_show(struct seq_file *m, void *v)
+ * Divide only 1000 for ns^2 -> us^2 conversion.
+ * trace_print_graph_duration will divide 1000 again.
+ */
+- do_div(stddev, rec->counter * (rec->counter - 1) * 1000);
++ stddev = div64_ul(stddev,
++ rec->counter * (rec->counter - 1) * 1000);
+ }
+
+ trace_seq_init(&s);
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index b6ff2f84df17..e61aa1c68e99 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4370,6 +4370,10 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
+
+ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
+ {
++ if ((mask == TRACE_ITER_RECORD_TGID) ||
++ (mask == TRACE_ITER_RECORD_CMD))
++ lockdep_assert_held(&event_mutex);
++
+ /* do nothing if flag is already set */
+ if (!!(tr->trace_flags & mask) == !!enabled)
+ return 0;
+@@ -4435,6 +4439,7 @@ static int trace_set_options(struct trace_array *tr, char *option)
+ cmp += 2;
+ }
+
++ mutex_lock(&event_mutex);
+ mutex_lock(&trace_types_lock);
+
+ ret = match_string(trace_options, -1, cmp);
+@@ -4445,6 +4450,7 @@ static int trace_set_options(struct trace_array *tr, char *option)
+ ret = set_tracer_flag(tr, 1 << ret, !neg);
+
+ mutex_unlock(&trace_types_lock);
++ mutex_unlock(&event_mutex);
+
+ /*
+ * If the first trailing whitespace is replaced with '\0' by strstrip,
+@@ -7457,9 +7463,11 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt,
+ if (val != 0 && val != 1)
+ return -EINVAL;
+
++ mutex_lock(&event_mutex);
+ mutex_lock(&trace_types_lock);
+ ret = set_tracer_flag(tr, 1 << index, val);
+ mutex_unlock(&trace_types_lock);
++ mutex_unlock(&event_mutex);
+
+ if (ret < 0)
+ return ret;
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 017f737237e6..ec340e1cbffc 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -327,7 +327,8 @@ void trace_event_enable_cmd_record(bool enable)
+ struct trace_event_file *file;
+ struct trace_array *tr;
+
+- mutex_lock(&event_mutex);
++ lockdep_assert_held(&event_mutex);
++
+ do_for_each_event_file(tr, file) {
+
+ if (!(file->flags & EVENT_FILE_FL_ENABLED))
+@@ -341,7 +342,6 @@ void trace_event_enable_cmd_record(bool enable)
+ clear_bit(EVENT_FILE_FL_RECORDED_CMD_BIT, &file->flags);
+ }
+ } while_for_each_event_file();
+- mutex_unlock(&event_mutex);
+ }
+
+ void trace_event_enable_tgid_record(bool enable)
+@@ -349,7 +349,8 @@ void trace_event_enable_tgid_record(bool enable)
+ struct trace_event_file *file;
+ struct trace_array *tr;
+
+- mutex_lock(&event_mutex);
++ lockdep_assert_held(&event_mutex);
++
+ do_for_each_event_file(tr, file) {
+ if (!(file->flags & EVENT_FILE_FL_ENABLED))
+ continue;
+@@ -363,7 +364,6 @@ void trace_event_enable_tgid_record(bool enable)
+ &file->flags);
+ }
+ } while_for_each_event_file();
+- mutex_unlock(&event_mutex);
+ }
+
+ static int __ftrace_event_enable_disable(struct trace_event_file *file,
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 2fb78467582b..b949c3917c67 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1642,7 +1642,7 @@ static int process_system_preds(struct trace_subsystem_dir *dir,
+ parse_error(pe, FILT_ERR_BAD_SUBSYS_FILTER, 0);
+ return -EINVAL;
+ fail_mem:
+- kfree(filter);
++ __free_filter(filter);
+ /* If any call succeeded, we still need to sync */
+ if (!fail)
+ tracepoint_synchronize_unregister();
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 11d952650fa7..0fb92d0c7b20 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -665,7 +665,26 @@ static notrace void trace_event_raw_event_synth(void *__data,
+ strscpy(str_field, str_val, STR_VAR_LEN_MAX);
+ n_u64 += STR_VAR_LEN_MAX / sizeof(u64);
+ } else {
+- entry->fields[n_u64] = var_ref_vals[var_ref_idx + i];
++ struct synth_field *field = event->fields[i];
++ u64 val = var_ref_vals[var_ref_idx + i];
++
++ switch (field->size) {
++ case 1:
++ *(u8 *)&entry->fields[n_u64] = (u8)val;
++ break;
++
++ case 2:
++ *(u16 *)&entry->fields[n_u64] = (u16)val;
++ break;
++
++ case 4:
++ *(u32 *)&entry->fields[n_u64] = (u32)val;
++ break;
++
++ default:
++ entry->fields[n_u64] = val;
++ break;
++ }
+ n_u64++;
+ }
+ }
+diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
+index 9a1c22310323..9e31bfc818ff 100644
+--- a/kernel/trace/tracing_map.c
++++ b/kernel/trace/tracing_map.c
+@@ -148,8 +148,8 @@ static int tracing_map_cmp_atomic64(void *val_a, void *val_b)
+ #define DEFINE_TRACING_MAP_CMP_FN(type) \
+ static int tracing_map_cmp_##type(void *val_a, void *val_b) \
+ { \
+- type a = *(type *)val_a; \
+- type b = *(type *)val_b; \
++ type a = (type)(*(u64 *)val_a); \
++ type b = (type)(*(u64 *)val_b); \
+ \
+ return (a > b) ? 1 : ((a < b) ? -1 : 0); \
+ }
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 4d3588c01203..593557c107d2 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -1508,9 +1508,11 @@ static int do_move_pages_to_node(struct mm_struct *mm,
+ /*
+ * Resolves the given address to a struct page, isolates it from the LRU and
+ * puts it to the given pagelist.
+- * Returns -errno if the page cannot be found/isolated or 0 when it has been
+- * queued or the page doesn't need to be migrated because it is already on
+- * the target node
++ * Returns:
++ * errno - if the page cannot be found/isolated
++ * 0 - when it doesn't have to be migrated because it is already on the
++ * target node
++ * 1 - when it has been queued
+ */
+ static int add_page_for_migration(struct mm_struct *mm, unsigned long addr,
+ int node, struct list_head *pagelist, bool migrate_all)
+@@ -1549,7 +1551,7 @@ static int add_page_for_migration(struct mm_struct *mm, unsigned long addr,
+ if (PageHuge(page)) {
+ if (PageHead(page)) {
+ isolate_huge_page(page, pagelist);
+- err = 0;
++ err = 1;
+ }
+ } else {
+ struct page *head;
+@@ -1559,7 +1561,7 @@ static int add_page_for_migration(struct mm_struct *mm, unsigned long addr,
+ if (err)
+ goto out_putpage;
+
+- err = 0;
++ err = 1;
+ list_add_tail(&head->lru, pagelist);
+ mod_node_page_state(page_pgdat(head),
+ NR_ISOLATED_ANON + page_is_file_cache(head),
+@@ -1636,8 +1638,17 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
+ */
+ err = add_page_for_migration(mm, addr, current_node,
+ &pagelist, flags & MPOL_MF_MOVE_ALL);
+- if (!err)
++
++ if (!err) {
++ /* The page is already on the target node */
++ err = store_status(status, i, current_node, 1);
++ if (err)
++ goto out_flush;
+ continue;
++ } else if (err > 0) {
++ /* The page is successfully queued for migration */
++ continue;
++ }
+
+ err = store_status(status, i, err, 1);
+ if (err)
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 1480880ff814..a98f09b83019 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -89,12 +89,6 @@ static void unmap_region(struct mm_struct *mm,
+ * MAP_PRIVATE r: (no) no r: (yes) yes r: (no) yes r: (no) yes
+ * w: (no) no w: (no) no w: (copy) copy w: (no) no
+ * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
+- *
+- * On arm64, PROT_EXEC has the following behaviour for both MAP_SHARED and
+- * MAP_PRIVATE:
+- * r: (no) no
+- * w: (no) no
+- * x: (yes) yes
+ */
+ pgprot_t protection_map[16] __ro_after_init = {
+ __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index 4b9063d12b93..85cc29c93d93 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -2092,6 +2092,11 @@ static int zs_page_migrate(struct address_space *mapping, struct page *newpage,
+ zs_pool_dec_isolated(pool);
+ }
+
++ if (page_zone(newpage) != page_zone(page)) {
++ dec_zone_page_state(page, NR_ZSPAGES);
++ inc_zone_page_state(newpage, NR_ZSPAGES);
++ }
++
+ reset_page(page);
+ put_page(page);
+ page = newpage;
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index f5c27065ad44..db735d0d931e 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1173,8 +1173,10 @@ struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
+ if (!conn)
+ return ERR_PTR(-ENOMEM);
+
+- if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0)
++ if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
++ hci_conn_del(conn);
+ return ERR_PTR(-EBUSY);
++ }
+
+ conn->state = BT_CONNECT;
+ set_bit(HCI_CONN_SCANNING, &conn->flags);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 974c1b8a689c..0d84d1f820d4 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -4918,10 +4918,8 @@ void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
+ BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
+ chan, result, local_amp_id, remote_amp_id);
+
+- if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {
+- l2cap_chan_unlock(chan);
++ if (chan->state == BT_DISCONN || chan->state == BT_CLOSED)
+ return;
+- }
+
+ if (chan->state != BT_CONNECTED) {
+ l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 8ff21d461f08..a26d87073f71 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -149,6 +149,7 @@
+ #include "net-sysfs.h"
+
+ #define MAX_GRO_SKBS 8
++#define MAX_NEST_DEV 8
+
+ /* This should be increased if a protocol with a bigger head is added. */
+ #define GRO_MAX_HEAD (MAX_HEADER + 128)
+@@ -6542,6 +6543,21 @@ struct net_device *netdev_upper_get_next_dev_rcu(struct net_device *dev,
+ }
+ EXPORT_SYMBOL(netdev_upper_get_next_dev_rcu);
+
++static struct net_device *netdev_next_upper_dev(struct net_device *dev,
++ struct list_head **iter)
++{
++ struct netdev_adjacent *upper;
++
++ upper = list_entry((*iter)->next, struct netdev_adjacent, list);
++
++ if (&upper->list == &dev->adj_list.upper)
++ return NULL;
++
++ *iter = &upper->list;
++
++ return upper->dev;
++}
++
+ static struct net_device *netdev_next_upper_dev_rcu(struct net_device *dev,
+ struct list_head **iter)
+ {
+@@ -6559,28 +6575,93 @@ static struct net_device *netdev_next_upper_dev_rcu(struct net_device *dev,
+ return upper->dev;
+ }
+
++static int netdev_walk_all_upper_dev(struct net_device *dev,
++ int (*fn)(struct net_device *dev,
++ void *data),
++ void *data)
++{
++ struct net_device *udev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
++ struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
++ int ret, cur = 0;
++
++ now = dev;
++ iter = &dev->adj_list.upper;
++
++ while (1) {
++ if (now != dev) {
++ ret = fn(now, data);
++ if (ret)
++ return ret;
++ }
++
++ next = NULL;
++ while (1) {
++ udev = netdev_next_upper_dev(now, &iter);
++ if (!udev)
++ break;
++
++ next = udev;
++ niter = &udev->adj_list.upper;
++ dev_stack[cur] = now;
++ iter_stack[cur++] = iter;
++ break;
++ }
++
++ if (!next) {
++ if (!cur)
++ return 0;
++ next = dev_stack[--cur];
++ niter = iter_stack[cur];
++ }
++
++ now = next;
++ iter = niter;
++ }
++
++ return 0;
++}
++
+ int netdev_walk_all_upper_dev_rcu(struct net_device *dev,
+ int (*fn)(struct net_device *dev,
+ void *data),
+ void *data)
+ {
+- struct net_device *udev;
+- struct list_head *iter;
+- int ret;
++ struct net_device *udev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
++ struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
++ int ret, cur = 0;
+
+- for (iter = &dev->adj_list.upper,
+- udev = netdev_next_upper_dev_rcu(dev, &iter);
+- udev;
+- udev = netdev_next_upper_dev_rcu(dev, &iter)) {
+- /* first is the upper device itself */
+- ret = fn(udev, data);
+- if (ret)
+- return ret;
++ now = dev;
++ iter = &dev->adj_list.upper;
+
+- /* then look at all of its upper devices */
+- ret = netdev_walk_all_upper_dev_rcu(udev, fn, data);
+- if (ret)
+- return ret;
++ while (1) {
++ if (now != dev) {
++ ret = fn(now, data);
++ if (ret)
++ return ret;
++ }
++
++ next = NULL;
++ while (1) {
++ udev = netdev_next_upper_dev_rcu(now, &iter);
++ if (!udev)
++ break;
++
++ next = udev;
++ niter = &udev->adj_list.upper;
++ dev_stack[cur] = now;
++ iter_stack[cur++] = iter;
++ break;
++ }
++
++ if (!next) {
++ if (!cur)
++ return 0;
++ next = dev_stack[--cur];
++ niter = iter_stack[cur];
++ }
++
++ now = next;
++ iter = niter;
+ }
+
+ return 0;
+@@ -6688,23 +6769,42 @@ int netdev_walk_all_lower_dev(struct net_device *dev,
+ void *data),
+ void *data)
+ {
+- struct net_device *ldev;
+- struct list_head *iter;
+- int ret;
++ struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
++ struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
++ int ret, cur = 0;
+
+- for (iter = &dev->adj_list.lower,
+- ldev = netdev_next_lower_dev(dev, &iter);
+- ldev;
+- ldev = netdev_next_lower_dev(dev, &iter)) {
+- /* first is the lower device itself */
+- ret = fn(ldev, data);
+- if (ret)
+- return ret;
++ now = dev;
++ iter = &dev->adj_list.lower;
+
+- /* then look at all of its lower devices */
+- ret = netdev_walk_all_lower_dev(ldev, fn, data);
+- if (ret)
+- return ret;
++ while (1) {
++ if (now != dev) {
++ ret = fn(now, data);
++ if (ret)
++ return ret;
++ }
++
++ next = NULL;
++ while (1) {
++ ldev = netdev_next_lower_dev(now, &iter);
++ if (!ldev)
++ break;
++
++ next = ldev;
++ niter = &ldev->adj_list.lower;
++ dev_stack[cur] = now;
++ iter_stack[cur++] = iter;
++ break;
++ }
++
++ if (!next) {
++ if (!cur)
++ return 0;
++ next = dev_stack[--cur];
++ niter = iter_stack[cur];
++ }
++
++ now = next;
++ iter = niter;
+ }
+
+ return 0;
+@@ -6725,28 +6825,93 @@ static struct net_device *netdev_next_lower_dev_rcu(struct net_device *dev,
+ return lower->dev;
+ }
+
+-int netdev_walk_all_lower_dev_rcu(struct net_device *dev,
+- int (*fn)(struct net_device *dev,
+- void *data),
+- void *data)
++static u8 __netdev_upper_depth(struct net_device *dev)
++{
++ struct net_device *udev;
++ struct list_head *iter;
++ u8 max_depth = 0;
++
++ for (iter = &dev->adj_list.upper,
++ udev = netdev_next_upper_dev(dev, &iter);
++ udev;
++ udev = netdev_next_upper_dev(dev, &iter)) {
++ if (max_depth < udev->upper_level)
++ max_depth = udev->upper_level;
++ }
++
++ return max_depth;
++}
++
++static u8 __netdev_lower_depth(struct net_device *dev)
+ {
+ struct net_device *ldev;
+ struct list_head *iter;
+- int ret;
++ u8 max_depth = 0;
+
+ for (iter = &dev->adj_list.lower,
+- ldev = netdev_next_lower_dev_rcu(dev, &iter);
++ ldev = netdev_next_lower_dev(dev, &iter);
+ ldev;
+- ldev = netdev_next_lower_dev_rcu(dev, &iter)) {
+- /* first is the lower device itself */
+- ret = fn(ldev, data);
+- if (ret)
+- return ret;
++ ldev = netdev_next_lower_dev(dev, &iter)) {
++ if (max_depth < ldev->lower_level)
++ max_depth = ldev->lower_level;
++ }
+
+- /* then look at all of its lower devices */
+- ret = netdev_walk_all_lower_dev_rcu(ldev, fn, data);
+- if (ret)
+- return ret;
++ return max_depth;
++}
++
++static int __netdev_update_upper_level(struct net_device *dev, void *data)
++{
++ dev->upper_level = __netdev_upper_depth(dev) + 1;
++ return 0;
++}
++
++static int __netdev_update_lower_level(struct net_device *dev, void *data)
++{
++ dev->lower_level = __netdev_lower_depth(dev) + 1;
++ return 0;
++}
++
++int netdev_walk_all_lower_dev_rcu(struct net_device *dev,
++ int (*fn)(struct net_device *dev,
++ void *data),
++ void *data)
++{
++ struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
++ struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
++ int ret, cur = 0;
++
++ now = dev;
++ iter = &dev->adj_list.lower;
++
++ while (1) {
++ if (now != dev) {
++ ret = fn(now, data);
++ if (ret)
++ return ret;
++ }
++
++ next = NULL;
++ while (1) {
++ ldev = netdev_next_lower_dev_rcu(now, &iter);
++ if (!ldev)
++ break;
++
++ next = ldev;
++ niter = &ldev->adj_list.lower;
++ dev_stack[cur] = now;
++ iter_stack[cur++] = iter;
++ break;
++ }
++
++ if (!next) {
++ if (!cur)
++ return 0;
++ next = dev_stack[--cur];
++ niter = iter_stack[cur];
++ }
++
++ now = next;
++ iter = niter;
+ }
+
+ return 0;
+@@ -7003,6 +7168,9 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ if (netdev_has_upper_dev(upper_dev, dev))
+ return -EBUSY;
+
++ if ((dev->lower_level + upper_dev->upper_level) > MAX_NEST_DEV)
++ return -EMLINK;
++
+ if (!master) {
+ if (netdev_has_upper_dev(dev, upper_dev))
+ return -EEXIST;
+@@ -7029,6 +7197,12 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ if (ret)
+ goto rollback;
+
++ __netdev_update_upper_level(dev, NULL);
++ netdev_walk_all_lower_dev(dev, __netdev_update_upper_level, NULL);
++
++ __netdev_update_lower_level(upper_dev, NULL);
++ netdev_walk_all_upper_dev(upper_dev, __netdev_update_lower_level, NULL);
++
+ return 0;
+
+ rollback:
+@@ -7111,6 +7285,12 @@ void netdev_upper_dev_unlink(struct net_device *dev,
+
+ call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
+ &changeupper_info.info);
++
++ __netdev_update_upper_level(dev, NULL);
++ netdev_walk_all_lower_dev(dev, __netdev_update_upper_level, NULL);
++
++ __netdev_update_lower_level(upper_dev, NULL);
++ netdev_walk_all_upper_dev(upper_dev, __netdev_update_lower_level, NULL);
+ }
+ EXPORT_SYMBOL(netdev_upper_dev_unlink);
+
+@@ -8978,6 +9158,8 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
+
+ dev->gso_max_size = GSO_MAX_SIZE;
+ dev->gso_max_segs = GSO_MAX_SEGS;
++ dev->upper_level = 1;
++ dev->lower_level = 1;
+
+ INIT_LIST_HEAD(&dev->napi_list);
+ INIT_LIST_HEAD(&dev->unreg_list);
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 7597afee7068..e260d44ebdca 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1097,7 +1097,7 @@ static void neigh_update_hhs(struct neighbour *neigh)
+
+ if (update) {
+ hh = &neigh->hh;
+- if (hh->hh_len) {
++ if (READ_ONCE(hh->hh_len)) {
+ write_seqlock_bh(&hh->hh_lock);
+ update(hh, neigh->dev, neigh->ha);
+ write_sequnlock_bh(&hh->hh_lock);
+@@ -1360,7 +1360,7 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
+ struct net_device *dev = neigh->dev;
+ unsigned int seq;
+
+- if (dev->header_ops->cache && !neigh->hh.hh_len)
++ if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len))
+ neigh_hh_init(neigh);
+
+ do {
+diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
+index fd8faa0dfa61..ca06e9a53d15 100644
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -239,7 +239,12 @@ int eth_header_cache(const struct neighbour *neigh, struct hh_cache *hh, __be16
+ eth->h_proto = type;
+ memcpy(eth->h_source, dev->dev_addr, ETH_ALEN);
+ memcpy(eth->h_dest, neigh->ha, ETH_ALEN);
+- hh->hh_len = ETH_HLEN;
++
++ /* Pairs with READ_ONCE() in neigh_resolve_output(),
++ * neigh_hh_output() and neigh_update_hhs().
++ */
++ smp_store_release(&hh->hh_len, ETH_HLEN);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(eth_header_cache);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index a7a804bece7a..7561fa1bcc3e 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -488,7 +488,7 @@ static void tcp_tx_timestamp(struct sock *sk, u16 tsflags)
+ static inline bool tcp_stream_is_readable(const struct tcp_sock *tp,
+ int target, struct sock *sk)
+ {
+- return (tp->rcv_nxt - tp->copied_seq >= target) ||
++ return (READ_ONCE(tp->rcv_nxt) - tp->copied_seq >= target) ||
+ (sk->sk_prot->stream_memory_read ?
+ sk->sk_prot->stream_memory_read(sk) : false);
+ }
+@@ -2866,7 +2866,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ else if (tp->repair_queue == TCP_SEND_QUEUE)
+ tp->write_seq = val;
+ else if (tp->repair_queue == TCP_RECV_QUEUE)
+- tp->rcv_nxt = val;
++ WRITE_ONCE(tp->rcv_nxt, val);
+ else
+ err = -EINVAL;
+ break;
+diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
+index 81148f7a2323..c9e97f304f98 100644
+--- a/net/ipv4/tcp_diag.c
++++ b/net/ipv4/tcp_diag.c
+@@ -30,7 +30,7 @@ static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
+ } else if (sk->sk_type == SOCK_STREAM) {
+ const struct tcp_sock *tp = tcp_sk(sk);
+
+- r->idiag_rqueue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
++ r->idiag_rqueue = max_t(int, READ_ONCE(tp->rcv_nxt) - tp->copied_seq, 0);
+ r->idiag_wqueue = tp->write_seq - tp->snd_una;
+ }
+ if (info)
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 57e8dad956ec..3a08ee81cbc3 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3348,7 +3348,7 @@ static void tcp_rcv_nxt_update(struct tcp_sock *tp, u32 seq)
+
+ sock_owned_by_me((struct sock *)tp);
+ tp->bytes_received += delta;
+- tp->rcv_nxt = seq;
++ WRITE_ONCE(tp->rcv_nxt, seq);
+ }
+
+ /* Update our send window.
+@@ -5829,7 +5829,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
+ /* Ok.. it's good. Set up sequence numbers and
+ * move to established.
+ */
+- tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
++ WRITE_ONCE(tp->rcv_nxt, TCP_SKB_CB(skb)->seq + 1);
+ tp->rcv_wup = TCP_SKB_CB(skb)->seq + 1;
+
+ /* RFC1323: The window in SYN & SYN/ACK segments is
+@@ -5932,7 +5932,7 @@ discard:
+ tp->tcp_header_len = sizeof(struct tcphdr);
+ }
+
+- tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
++ WRITE_ONCE(tp->rcv_nxt, TCP_SKB_CB(skb)->seq + 1);
+ tp->copied_seq = tp->rcv_nxt;
+ tp->rcv_wup = TCP_SKB_CB(skb)->seq + 1;
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 5553f6a833f3..6da393016c11 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -2330,7 +2330,8 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
+ /* Because we don't lock the socket,
+ * we might find a transient negative value.
+ */
+- rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
++ rx_queue = max_t(int, READ_ONCE(tp->rcv_nxt) -
++ tp->copied_seq, 0);
+
+ seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
+ "%08X %5u %8d %lu %d %pK %lu %lu %u %u %d",
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 12affb7864d9..7ba8a90772b0 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -454,6 +454,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
+ struct tcp_request_sock *treq = tcp_rsk(req);
+ struct inet_connection_sock *newicsk;
+ struct tcp_sock *oldtp, *newtp;
++ u32 seq;
+
+ if (!newsk)
+ return NULL;
+@@ -467,8 +468,10 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
+ /* Now setup tcp_sock */
+ newtp->pred_flags = 0;
+
+- newtp->rcv_wup = newtp->copied_seq =
+- newtp->rcv_nxt = treq->rcv_isn + 1;
++ seq = treq->rcv_isn + 1;
++ newtp->rcv_wup = seq;
++ newtp->copied_seq = seq;
++ WRITE_ONCE(newtp->rcv_nxt, seq);
+ newtp->segs_in = 1;
+
+ newtp->snd_sml = newtp->snd_una =
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 9a117a79af65..c5f4e89b6ff3 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1839,7 +1839,8 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
+ /* Because we don't lock the socket,
+ * we might find a transient negative value.
+ */
+- rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
++ rx_queue = max_t(int, READ_ONCE(tp->rcv_nxt) -
++ tp->copied_seq, 0);
+
+ seq_printf(seq,
+ "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
+diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c
+index f92a82c73880..95980154ef02 100644
+--- a/net/netfilter/nft_tproxy.c
++++ b/net/netfilter/nft_tproxy.c
+@@ -50,7 +50,7 @@ static void nft_tproxy_eval_v4(const struct nft_expr *expr,
+ taddr = nf_tproxy_laddr4(skb, taddr, iph->daddr);
+
+ if (priv->sreg_port)
+- tport = regs->data[priv->sreg_port];
++ tport = nft_reg_load16(®s->data[priv->sreg_port]);
+ if (!tport)
+ tport = hp->dest;
+
+@@ -117,7 +117,7 @@ static void nft_tproxy_eval_v6(const struct nft_expr *expr,
+ taddr = *nf_tproxy_laddr6(skb, &taddr, &iph->daddr);
+
+ if (priv->sreg_port)
+- tport = regs->data[priv->sreg_port];
++ tport = nft_reg_load16(®s->data[priv->sreg_port]);
+ if (!tport)
+ tport = hp->dest;
+
+diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
+index dc7fdaf20445..42582a9ff81d 100644
+--- a/net/rxrpc/peer_event.c
++++ b/net/rxrpc/peer_event.c
+@@ -153,6 +153,9 @@ void rxrpc_error_report(struct sock *sk)
+ struct rxrpc_peer *peer;
+ struct sk_buff *skb;
+
++ if (unlikely(!local))
++ return;
++
+ _enter("%p{%d}", sk, local->debug_id);
+
+ skb = sock_dequeue_err_skb(sk);
+diff --git a/net/socket.c b/net/socket.c
+index 18d27b8c2511..1290aad5d1c3 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -867,7 +867,7 @@ static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ .msg_iocb = iocb};
+ ssize_t res;
+
+- if (file->f_flags & O_NONBLOCK)
++ if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
+ msg.msg_flags = MSG_DONTWAIT;
+
+ if (iocb->ki_pos != 0)
+@@ -892,7 +892,7 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ if (iocb->ki_pos != 0)
+ return -ESPIPE;
+
+- if (file->f_flags & O_NONBLOCK)
++ if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
+ msg.msg_flags = MSG_DONTWAIT;
+
+ if (sock->type == SOCK_SEQPACKET)
+diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
+index d95a7e41a29d..0a57d105cc5b 100644
+--- a/security/apparmor/apparmorfs.c
++++ b/security/apparmor/apparmorfs.c
+@@ -593,7 +593,7 @@ static __poll_t ns_revision_poll(struct file *file, poll_table *pt)
+
+ void __aa_bump_ns_revision(struct aa_ns *ns)
+ {
+- ns->revision++;
++ WRITE_ONCE(ns->revision, ns->revision + 1);
+ wake_up_interruptible(&ns->wait);
+ }
+
+diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
+index 11975ec8d566..bdf9e4cefe25 100644
+--- a/security/apparmor/domain.c
++++ b/security/apparmor/domain.c
+@@ -321,6 +321,7 @@ static int aa_xattrs_match(const struct linux_binprm *bprm,
+
+ if (!bprm || !profile->xattr_count)
+ return 0;
++ might_sleep();
+
+ /* transition from exec match to xattr set */
+ state = aa_dfa_null_transition(profile->xmatch, state);
+@@ -365,10 +366,11 @@ out:
+ }
+
+ /**
+- * __attach_match_ - find an attachment match
++ * find_attach - do attachment search for unconfined processes
+ * @bprm - binprm structure of transitioning task
+- * @name - to match against (NOT NULL)
++ * @ns: the current namespace (NOT NULL)
+ * @head - profile list to walk (NOT NULL)
++ * @name - to match against (NOT NULL)
+ * @info - info message if there was an error (NOT NULL)
+ *
+ * Do a linear search on the profiles in the list. There is a matching
+@@ -378,12 +380,11 @@ out:
+ *
+ * Requires: @head not be shared or have appropriate locks held
+ *
+- * Returns: profile or NULL if no match found
++ * Returns: label or NULL if no match found
+ */
+-static struct aa_profile *__attach_match(const struct linux_binprm *bprm,
+- const char *name,
+- struct list_head *head,
+- const char **info)
++static struct aa_label *find_attach(const struct linux_binprm *bprm,
++ struct aa_ns *ns, struct list_head *head,
++ const char *name, const char **info)
+ {
+ int candidate_len = 0, candidate_xattrs = 0;
+ bool conflict = false;
+@@ -392,6 +393,8 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm,
+ AA_BUG(!name);
+ AA_BUG(!head);
+
++ rcu_read_lock();
++restart:
+ list_for_each_entry_rcu(profile, head, base.list) {
+ if (profile->label.flags & FLAG_NULL &&
+ &profile->label == ns_unconfined(profile->ns))
+@@ -417,16 +420,32 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm,
+ perm = dfa_user_allow(profile->xmatch, state);
+ /* any accepting state means a valid match. */
+ if (perm & MAY_EXEC) {
+- int ret;
++ int ret = 0;
+
+ if (count < candidate_len)
+ continue;
+
+- ret = aa_xattrs_match(bprm, profile, state);
+- /* Fail matching if the xattrs don't match */
+- if (ret < 0)
+- continue;
+-
++ if (bprm && profile->xattr_count) {
++ long rev = READ_ONCE(ns->revision);
++
++ if (!aa_get_profile_not0(profile))
++ goto restart;
++ rcu_read_unlock();
++ ret = aa_xattrs_match(bprm, profile,
++ state);
++ rcu_read_lock();
++ aa_put_profile(profile);
++ if (rev !=
++ READ_ONCE(ns->revision))
++ /* policy changed */
++ goto restart;
++ /*
++ * Fail matching if the xattrs don't
++ * match
++ */
++ if (ret < 0)
++ continue;
++ }
+ /*
+ * TODO: allow for more flexible best match
+ *
+@@ -449,43 +468,28 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm,
+ candidate_xattrs = ret;
+ conflict = false;
+ }
+- } else if (!strcmp(profile->base.name, name))
++ } else if (!strcmp(profile->base.name, name)) {
+ /*
+ * old exact non-re match, without conditionals such
+ * as xattrs. no more searching required
+ */
+- return profile;
++ candidate = profile;
++ goto out;
++ }
+ }
+
+- if (conflict) {
+- *info = "conflicting profile attachments";
++ if (!candidate || conflict) {
++ if (conflict)
++ *info = "conflicting profile attachments";
++ rcu_read_unlock();
+ return NULL;
+ }
+
+- return candidate;
+-}
+-
+-/**
+- * find_attach - do attachment search for unconfined processes
+- * @bprm - binprm structure of transitioning task
+- * @ns: the current namespace (NOT NULL)
+- * @list: list to search (NOT NULL)
+- * @name: the executable name to match against (NOT NULL)
+- * @info: info message if there was an error
+- *
+- * Returns: label or NULL if no match found
+- */
+-static struct aa_label *find_attach(const struct linux_binprm *bprm,
+- struct aa_ns *ns, struct list_head *list,
+- const char *name, const char **info)
+-{
+- struct aa_profile *profile;
+-
+- rcu_read_lock();
+- profile = aa_get_profile(__attach_match(bprm, name, list, info));
++out:
++ candidate = aa_get_newest_profile(candidate);
+ rcu_read_unlock();
+
+- return profile ? &profile->label : NULL;
++ return &candidate->label;
+ }
+
+ static const char *next_name(int xtype, const char *name)
+diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
+index 1590e2de4e84..3a4293c46ad5 100644
+--- a/security/apparmor/policy.c
++++ b/security/apparmor/policy.c
+@@ -1126,8 +1126,8 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj,
+ if (!name) {
+ /* remove namespace - can only happen if fqname[0] == ':' */
+ mutex_lock_nested(&ns->parent->lock, ns->level);
+- __aa_remove_ns(ns);
+ __aa_bump_ns_revision(ns);
++ __aa_remove_ns(ns);
+ mutex_unlock(&ns->parent->lock);
+ } else {
+ /* remove profile */
+@@ -1139,9 +1139,9 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj,
+ goto fail_ns_lock;
+ }
+ name = profile->base.hname;
++ __aa_bump_ns_revision(ns);
+ __remove_profile(profile);
+ __aa_labelset_update_subtree(ns);
+- __aa_bump_ns_revision(ns);
+ mutex_unlock(&ns->lock);
+ }
+
+diff --git a/sound/firewire/motu/motu-proc.c b/sound/firewire/motu/motu-proc.c
+index ab6830a6d242..015b4ec2763f 100644
+--- a/sound/firewire/motu/motu-proc.c
++++ b/sound/firewire/motu/motu-proc.c
+@@ -17,7 +17,7 @@ static const char *const clock_names[] = {
+ [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT] = "S/PDIF on optical interface",
+ [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT_A] = "S/PDIF on optical interface A",
+ [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT_B] = "S/PDIF on optical interface B",
+- [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_COAX] = "S/PCIF on coaxial interface",
++ [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_COAX] = "S/PDIF on coaxial interface",
+ [SND_MOTU_CLOCK_SOURCE_AESEBU_ON_XLR] = "AESEBU on XLR interface",
+ [SND_MOTU_CLOCK_SOURCE_WORD_ON_BNC] = "Word clock on BNC interface",
+ };
+diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c
+index 70559e59d18f..7d4e18cb6351 100644
+--- a/sound/isa/cs423x/cs4236.c
++++ b/sound/isa/cs423x/cs4236.c
+@@ -293,7 +293,8 @@ static int snd_cs423x_pnp_init_mpu(int dev, struct pnp_dev *pdev)
+ } else {
+ mpu_port[dev] = pnp_port_start(pdev, 0);
+ if (mpu_irq[dev] >= 0 &&
+- pnp_irq_valid(pdev, 0) && pnp_irq(pdev, 0) >= 0) {
++ pnp_irq_valid(pdev, 0) &&
++ pnp_irq(pdev, 0) != (resource_size_t)-1) {
+ mpu_irq[dev] = pnp_irq(pdev, 0);
+ } else {
+ mpu_irq[dev] = -1; /* disable interrupt */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 019dee96dbaa..1f6a036627e8 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -513,6 +513,7 @@ static void alc_shutup_pins(struct hda_codec *codec)
+ struct alc_spec *spec = codec->spec;
+
+ switch (codec->core.vendor_id) {
++ case 0x10ec0283:
+ case 0x10ec0286:
+ case 0x10ec0288:
+ case 0x10ec0298:
+@@ -5441,6 +5442,16 @@ static void alc295_fixup_disable_dac3(struct hda_codec *codec,
+ }
+ }
+
++/* force NID 0x17 (Bass Speaker) to DAC1 to share it with the main speaker */
++static void alc285_fixup_speaker2_to_dac1(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ hda_nid_t conn[1] = { 0x02 };
++ snd_hda_override_conn_list(codec, 0x17, 1, conn);
++ }
++}
++
+ /* Hook to update amp GPIO4 for automute */
+ static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
+ struct hda_jack_callback *jack)
+@@ -5661,6 +5672,7 @@ enum {
+ ALC225_FIXUP_DISABLE_MIC_VREF,
+ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC295_FIXUP_DISABLE_DAC3,
++ ALC285_FIXUP_SPEAKER2_TO_DAC1,
+ ALC280_FIXUP_HP_HEADSET_MIC,
+ ALC221_FIXUP_HP_FRONT_MIC,
+ ALC292_FIXUP_TPT460,
+@@ -5702,9 +5714,12 @@ enum {
+ ALC256_FIXUP_ASUS_HEADSET_MIC,
+ ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+ ALC299_FIXUP_PREDATOR_SPK,
+- ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC,
+ ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE,
+- ALC294_FIXUP_ASUS_INTSPK_GPIO,
++ ALC289_FIXUP_DELL_SPK2,
++ ALC289_FIXUP_DUAL_SPK,
++ ALC294_FIXUP_SPK2_TO_DAC1,
++ ALC294_FIXUP_ASUS_DUAL_SPK,
++
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6441,6 +6456,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc295_fixup_disable_dac3,
+ },
++ [ALC285_FIXUP_SPEAKER2_TO_DAC1] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc285_fixup_speaker2_to_dac1,
++ },
+ [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -6748,33 +6767,45 @@ static const struct hda_fixup alc269_fixups[] = {
+ { }
+ }
+ },
+- [ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC] = {
++ [ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+- { 0x14, 0x411111f0 }, /* disable confusing internal speaker */
+- { 0x19, 0x04a11150 }, /* use as headset mic, without its own jack detect */
++ { 0x19, 0x04a11040 },
++ { 0x21, 0x04211020 },
+ { }
+ },
+ .chained = true,
+- .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
++ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
+ },
+- [ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE] = {
++ [ALC289_FIXUP_DELL_SPK2] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+- { 0x19, 0x04a11040 },
+- { 0x21, 0x04211020 },
++ { 0x17, 0x90170130 }, /* bass spk */
+ { }
+ },
+ .chained = true,
+- .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
++ .chain_id = ALC269_FIXUP_DELL4_MIC_NO_PRESENCE
+ },
+- [ALC294_FIXUP_ASUS_INTSPK_GPIO] = {
++ [ALC289_FIXUP_DUAL_SPK] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc285_fixup_speaker2_to_dac1,
++ .chained = true,
++ .chain_id = ALC289_FIXUP_DELL_SPK2
++ },
++ [ALC294_FIXUP_SPK2_TO_DAC1] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc285_fixup_speaker2_to_dac1,
++ .chained = true,
++ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
++ },
++ [ALC294_FIXUP_ASUS_DUAL_SPK] = {
+ .type = HDA_FIXUP_FUNC,
+ /* The GPIO must be pulled to initialize the AMP */
+ .v.func = alc_fixup_gpio4,
+ .chained = true,
+- .chain_id = ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC
++ .chain_id = ALC294_FIXUP_SPK2_TO_DAC1
+ },
++
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6847,6 +6878,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
++ SND_PCI_QUIRK(0x1028, 0x097e, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
++ SND_PCI_QUIRK(0x1028, 0x097d, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
+@@ -6934,7 +6967,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+ SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+- SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_INTSPK_GPIO),
++ SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK),
+ SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
+@@ -7006,6 +7039,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x17aa, 0x2293, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1),
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+@@ -7189,6 +7223,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"},
+ {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc225-dell1"},
+ {.id = ALC295_FIXUP_DISABLE_DAC3, .name = "alc295-disable-dac3"},
++ {.id = ALC285_FIXUP_SPEAKER2_TO_DAC1, .name = "alc285-speaker2-to-dac1"},
+ {.id = ALC280_FIXUP_HP_HEADSET_MIC, .name = "alc280-hp-headset"},
+ {.id = ALC221_FIXUP_HP_FRONT_MIC, .name = "alc221-hp-mic"},
+ {.id = ALC298_FIXUP_SPK_VOLUME, .name = "alc298-spk-volume"},
+diff --git a/sound/pci/ice1712/ice1724.c b/sound/pci/ice1712/ice1724.c
+index 057c2f394ea7..41ea8e7b389a 100644
+--- a/sound/pci/ice1712/ice1724.c
++++ b/sound/pci/ice1712/ice1724.c
+@@ -661,6 +661,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate,
+ unsigned long flags;
+ unsigned char mclk_change;
+ unsigned int i, old_rate;
++ bool call_set_rate = false;
+
+ if (rate > ice->hw_rates->list[ice->hw_rates->count - 1])
+ return -EINVAL;
+@@ -684,7 +685,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate,
+ * setting clock rate for internal clock mode */
+ old_rate = ice->get_rate(ice);
+ if (force || (old_rate != rate))
+- ice->set_rate(ice, rate);
++ call_set_rate = true;
+ else if (rate == ice->cur_rate) {
+ spin_unlock_irqrestore(&ice->reg_lock, flags);
+ return 0;
+@@ -692,12 +693,14 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate,
+ }
+
+ ice->cur_rate = rate;
++ spin_unlock_irqrestore(&ice->reg_lock, flags);
++
++ if (call_set_rate)
++ ice->set_rate(ice, rate);
+
+ /* setting master clock */
+ mclk_change = ice->set_mclk(ice, rate);
+
+- spin_unlock_irqrestore(&ice->reg_lock, flags);
+-
+ if (mclk_change && ice->gpio.i2s_mclk_changed)
+ ice->gpio.i2s_mclk_changed(ice);
+ if (ice->gpio.set_pro_rate)
+diff --git a/sound/usb/card.h b/sound/usb/card.h
+index ac785d15ced4..7f11655bde50 100644
+--- a/sound/usb/card.h
++++ b/sound/usb/card.h
+@@ -142,6 +142,7 @@ struct snd_usb_substream {
+ struct snd_usb_endpoint *sync_endpoint;
+ unsigned long flags;
+ bool need_setup_ep; /* (re)configure EP at prepare? */
++ bool need_setup_fmt; /* (re)configure fmt after resume? */
+ unsigned int speed; /* USB_SPEED_XXX */
+
+ u64 formats; /* format bitmasks (all or'ed) */
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 1828225ba882..9de4221de730 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -513,15 +513,15 @@ static int set_format(struct snd_usb_substream *subs, struct audioformat *fmt)
+ if (WARN_ON(!iface))
+ return -EINVAL;
+ alts = usb_altnum_to_altsetting(iface, fmt->altsetting);
+- altsd = get_iface_desc(alts);
+- if (WARN_ON(altsd->bAlternateSetting != fmt->altsetting))
++ if (WARN_ON(!alts))
+ return -EINVAL;
++ altsd = get_iface_desc(alts);
+
+- if (fmt == subs->cur_audiofmt)
++ if (fmt == subs->cur_audiofmt && !subs->need_setup_fmt)
+ return 0;
+
+ /* close the old interface */
+- if (subs->interface >= 0 && subs->interface != fmt->iface) {
++ if (subs->interface >= 0 && (subs->interface != fmt->iface || subs->need_setup_fmt)) {
+ if (!subs->stream->chip->keep_iface) {
+ err = usb_set_interface(subs->dev, subs->interface, 0);
+ if (err < 0) {
+@@ -535,6 +535,9 @@ static int set_format(struct snd_usb_substream *subs, struct audioformat *fmt)
+ subs->altset_idx = 0;
+ }
+
++ if (subs->need_setup_fmt)
++ subs->need_setup_fmt = false;
++
+ /* set interface */
+ if (iface->cur_altsetting != alts) {
+ err = snd_usb_select_mode_quirk(subs, fmt);
+@@ -1722,6 +1725,13 @@ static int snd_usb_substream_playback_trigger(struct snd_pcm_substream *substrea
+ subs->data_endpoint->retire_data_urb = retire_playback_urb;
+ subs->running = 0;
+ return 0;
++ case SNDRV_PCM_TRIGGER_SUSPEND:
++ if (subs->stream->chip->setup_fmt_after_resume_quirk) {
++ stop_endpoints(subs, true);
++ subs->need_setup_fmt = true;
++ return 0;
++ }
++ break;
+ }
+
+ return -EINVAL;
+@@ -1754,6 +1764,13 @@ static int snd_usb_substream_capture_trigger(struct snd_pcm_substream *substream
+ subs->data_endpoint->retire_data_urb = retire_capture_urb;
+ subs->running = 1;
+ return 0;
++ case SNDRV_PCM_TRIGGER_SUSPEND:
++ if (subs->stream->chip->setup_fmt_after_resume_quirk) {
++ stop_endpoints(subs, true);
++ subs->need_setup_fmt = true;
++ return 0;
++ }
++ break;
+ }
+
+ return -EINVAL;
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 57c6209a4ccb..65f9c4ba62ee 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3400,7 +3400,8 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ .vendor_name = "Dell",
+ .product_name = "WD19 Dock",
+ .profile_name = "Dell-WD15-Dock",
+- .ifnum = QUIRK_NO_INTERFACE
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_SETUP_FMT_AFTER_RESUME
+ }
+ },
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 052b4ada2d05..bc70212031df 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -519,6 +519,16 @@ static int create_standard_mixer_quirk(struct snd_usb_audio *chip,
+ return snd_usb_create_mixer(chip, quirk->ifnum, 0);
+ }
+
++
++static int setup_fmt_after_resume_quirk(struct snd_usb_audio *chip,
++ struct usb_interface *iface,
++ struct usb_driver *driver,
++ const struct snd_usb_audio_quirk *quirk)
++{
++ chip->setup_fmt_after_resume_quirk = 1;
++ return 1; /* Continue with creating streams and mixer */
++}
++
+ /*
+ * audio-interface quirks
+ *
+@@ -557,6 +567,7 @@ int snd_usb_create_quirk(struct snd_usb_audio *chip,
+ [QUIRK_AUDIO_EDIROL_UAXX] = create_uaxx_quirk,
+ [QUIRK_AUDIO_ALIGN_TRANSFER] = create_align_transfer_quirk,
+ [QUIRK_AUDIO_STANDARD_MIXER] = create_standard_mixer_quirk,
++ [QUIRK_SETUP_FMT_AFTER_RESUME] = setup_fmt_after_resume_quirk,
+ };
+
+ if (quirk->type < QUIRK_TYPE_COUNT) {
+diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
+index b9faeca645fd..4a0a5a071d51 100644
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -44,7 +44,7 @@ struct snd_usb_audio {
+ wait_queue_head_t shutdown_wait;
+ unsigned int txfr_quirk:1; /* Subframe boundaries on transfers */
+ unsigned int tx_length_quirk:1; /* Put length specifier in transfers */
+-
++ unsigned int setup_fmt_after_resume_quirk:1; /* setup the format to interface after resume */
+ int num_interfaces;
+ int num_suspended_intf;
+ int sample_rate_read_error;
+@@ -107,6 +107,7 @@ enum quirk_type {
+ QUIRK_AUDIO_EDIROL_UAXX,
+ QUIRK_AUDIO_ALIGN_TRANSFER,
+ QUIRK_AUDIO_STANDARD_MIXER,
++ QUIRK_SETUP_FMT_AFTER_RESUME,
+
+ QUIRK_TYPE_COUNT
+ };
+diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh
+index e101af52d1d6..ff665de788ef 100755
+--- a/tools/testing/selftests/net/rtnetlink.sh
++++ b/tools/testing/selftests/net/rtnetlink.sh
+@@ -234,6 +234,26 @@ kci_test_route_get()
+ echo "PASS: route get"
+ }
+
++kci_test_addrlft()
++{
++ for i in $(seq 10 100) ;do
++ lft=$(((RANDOM%3) + 1))
++ ip addr add 10.23.11.$i/32 dev "$devdummy" preferred_lft $lft valid_lft $((lft+1))
++ check_err $?
++ done
++
++ sleep 5
++
++ ip addr show dev "$devdummy" | grep "10.23.11."
++ if [ $? -eq 0 ]; then
++ echo "FAIL: preferred_lft addresses remaining"
++ check_err 1
++ return
++ fi
++
++ echo "PASS: preferred_lft addresses have expired"
++}
++
+ kci_test_addrlabel()
+ {
+ ret=0
+@@ -965,6 +985,7 @@ kci_test_rtnl()
+
+ kci_test_polrouting
+ kci_test_route_get
++ kci_test_addrlft
+ kci_test_tc
+ kci_test_gre
+ kci_test_gretap
+diff --git a/tools/testing/selftests/rseq/param_test.c b/tools/testing/selftests/rseq/param_test.c
+index eec2663261f2..e8a657a5f48a 100644
+--- a/tools/testing/selftests/rseq/param_test.c
++++ b/tools/testing/selftests/rseq/param_test.c
+@@ -15,7 +15,7 @@
+ #include <errno.h>
+ #include <stddef.h>
+
+-static inline pid_t gettid(void)
++static inline pid_t rseq_gettid(void)
+ {
+ return syscall(__NR_gettid);
+ }
+@@ -373,11 +373,12 @@ void *test_percpu_spinlock_thread(void *arg)
+ rseq_percpu_unlock(&data->lock, cpu);
+ #ifndef BENCHMARK
+ if (i != 0 && !(i % (reps / 10)))
+- printf_verbose("tid %d: count %lld\n", (int) gettid(), i);
++ printf_verbose("tid %d: count %lld\n",
++ (int) rseq_gettid(), i);
+ #endif
+ }
+ printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n",
+- (int) gettid(), nr_abort, signals_delivered);
++ (int) rseq_gettid(), nr_abort, signals_delivered);
+ if (!opt_disable_rseq && thread_data->reg &&
+ rseq_unregister_current_thread())
+ abort();
+@@ -454,11 +455,12 @@ void *test_percpu_inc_thread(void *arg)
+ } while (rseq_unlikely(ret));
+ #ifndef BENCHMARK
+ if (i != 0 && !(i % (reps / 10)))
+- printf_verbose("tid %d: count %lld\n", (int) gettid(), i);
++ printf_verbose("tid %d: count %lld\n",
++ (int) rseq_gettid(), i);
+ #endif
+ }
+ printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n",
+- (int) gettid(), nr_abort, signals_delivered);
++ (int) rseq_gettid(), nr_abort, signals_delivered);
+ if (!opt_disable_rseq && thread_data->reg &&
+ rseq_unregister_current_thread())
+ abort();
+@@ -605,7 +607,7 @@ void *test_percpu_list_thread(void *arg)
+ }
+
+ printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n",
+- (int) gettid(), nr_abort, signals_delivered);
++ (int) rseq_gettid(), nr_abort, signals_delivered);
+ if (!opt_disable_rseq && rseq_unregister_current_thread())
+ abort();
+
+@@ -796,7 +798,7 @@ void *test_percpu_buffer_thread(void *arg)
+ }
+
+ printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n",
+- (int) gettid(), nr_abort, signals_delivered);
++ (int) rseq_gettid(), nr_abort, signals_delivered);
+ if (!opt_disable_rseq && rseq_unregister_current_thread())
+ abort();
+
+@@ -1011,7 +1013,7 @@ void *test_percpu_memcpy_buffer_thread(void *arg)
+ }
+
+ printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n",
+- (int) gettid(), nr_abort, signals_delivered);
++ (int) rseq_gettid(), nr_abort, signals_delivered);
+ if (!opt_disable_rseq && rseq_unregister_current_thread())
+ abort();
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-01-12 15:00 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-01-12 15:00 UTC (permalink / raw
To: gentoo-commits
commit: cab08459b025d6855858e1f44b879ffc446a00e9
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 12 15:00:01 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jan 12 15:00:01 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=cab08459
Linux patch 4.19.95
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1094_linux-4.19.95.patch | 2671 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2675 insertions(+)
diff --git a/0000_README b/0000_README
index a11cb8a..ca89dab 100644
--- a/0000_README
+++ b/0000_README
@@ -415,6 +415,10 @@ Patch: 1093_linux-4.19.94.patch
From: https://www.kernel.org
Desc: Linux 4.19.94
+Patch: 1094_linux-4.19.95.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.95
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1094_linux-4.19.95.patch b/1094_linux-4.19.95.patch
new file mode 100644
index 0000000..2b45c5e
--- /dev/null
+++ b/1094_linux-4.19.95.patch
@@ -0,0 +1,2671 @@
+diff --git a/Makefile b/Makefile
+index 3c892a77194f..386ab98e2f58 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 94
++SUBLEVEL = 95
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am437x-gp-evm.dts b/arch/arm/boot/dts/am437x-gp-evm.dts
+index 5b97c20c5ed4..8a17eca2bc97 100644
+--- a/arch/arm/boot/dts/am437x-gp-evm.dts
++++ b/arch/arm/boot/dts/am437x-gp-evm.dts
+@@ -83,7 +83,7 @@
+ };
+
+ lcd0: display {
+- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi";
++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi";
+ label = "lcd";
+
+ backlight = <&lcd_bl>;
+diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
+index 6502d3397653..12735cf9674b 100644
+--- a/arch/arm/boot/dts/am43x-epos-evm.dts
++++ b/arch/arm/boot/dts/am43x-epos-evm.dts
+@@ -45,7 +45,7 @@
+ };
+
+ lcd0: display {
+- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi";
++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi";
+ label = "lcd";
+
+ backlight = <&lcd_bl>;
+diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi
+index 253df7170a4e..887a60c317e9 100644
+--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
+@@ -169,8 +169,8 @@
+ mdio: mdio@18002000 {
+ compatible = "brcm,iproc-mdio";
+ reg = <0x18002000 0x8>;
+- #size-cells = <1>;
+- #address-cells = <0>;
++ #size-cells = <0>;
++ #address-cells = <1>;
+ status = "disabled";
+
+ gphy0: ethernet-phy@0 {
+diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
+index 31b29646b14c..c9322a56300d 100644
+--- a/arch/arm/boot/dts/bcm283x.dtsi
++++ b/arch/arm/boot/dts/bcm283x.dtsi
+@@ -39,7 +39,7 @@
+
+ trips {
+ cpu-crit {
+- temperature = <80000>;
++ temperature = <90000>;
+ hysteresis = <0>;
+ type = "critical";
+ };
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index bc607d11eef8..a678fb7c9e3b 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -350,8 +350,8 @@
+ mdio: mdio@18003000 {
+ compatible = "brcm,iproc-mdio";
+ reg = <0x18003000 0x8>;
+- #size-cells = <1>;
+- #address-cells = <0>;
++ #size-cells = <0>;
++ #address-cells = <1>;
+ };
+
+ mdio-bus-mux {
+diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
+index 818021126559..695303435003 100644
+--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
++++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
+@@ -175,7 +175,7 @@
+ flash0: n25q256a@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "micron,n25q256a";
++ compatible = "micron,n25q256a", "jedec,spi-nor";
+ spi-max-frequency = <29000000>;
+ reg = <0>;
+ };
+diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
+index 50834a43e5fb..adecd6e08468 100644
+--- a/arch/arm/boot/dts/imx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul.dtsi
+@@ -87,6 +87,8 @@
+ "pll1_sys";
+ arm-supply = <®_arm>;
+ soc-supply = <®_soc>;
++ nvmem-cells = <&cpu_speed_grade>;
++ nvmem-cell-names = "speed_grade";
+ };
+ };
+
+@@ -930,6 +932,10 @@
+ tempmon_temp_grade: temp-grade@20 {
+ reg = <0x20 4>;
+ };
++
++ cpu_speed_grade: speed-grade@10 {
++ reg = <0x10 4>;
++ };
+ };
+
+ lcdif: lcdif@21c8000 {
+diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c
+index 0f5381d13494..55bbbc3b328f 100644
+--- a/arch/arm/mach-vexpress/spc.c
++++ b/arch/arm/mach-vexpress/spc.c
+@@ -551,8 +551,9 @@ static struct clk *ve_spc_clk_register(struct device *cpu_dev)
+
+ static int __init ve_spc_clk_init(void)
+ {
+- int cpu;
++ int cpu, cluster;
+ struct clk *clk;
++ bool init_opp_table[MAX_CLUSTERS] = { false };
+
+ if (!info)
+ return 0; /* Continue only if SPC is initialised */
+@@ -578,8 +579,17 @@ static int __init ve_spc_clk_init(void)
+ continue;
+ }
+
++ cluster = topology_physical_package_id(cpu_dev->id);
++ if (init_opp_table[cluster])
++ continue;
++
+ if (ve_init_opp_table(cpu_dev))
+ pr_warn("failed to initialise cpu%d opp table\n", cpu);
++ else if (dev_pm_opp_set_sharing_cpus(cpu_dev,
++ topology_core_cpumask(cpu_dev->id)))
++ pr_warn("failed to mark OPPs shared for cpu%d\n", cpu);
++ else
++ init_opp_table[cluster] = true;
+ }
+
+ platform_device_register_simple("vexpress-spc-cpufreq", -1, NULL, 0);
+diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
+index 9bda82ed75eb..3832c4628608 100644
+--- a/arch/mips/net/ebpf_jit.c
++++ b/arch/mips/net/ebpf_jit.c
+@@ -586,6 +586,7 @@ static void emit_const_to_reg(struct jit_ctx *ctx, int dst, u64 value)
+ static int emit_bpf_tail_call(struct jit_ctx *ctx, int this_idx)
+ {
+ int off, b_off;
++ int tcc_reg;
+
+ ctx->flags |= EBPF_SEEN_TC;
+ /*
+@@ -598,14 +599,14 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx, int this_idx)
+ b_off = b_imm(this_idx + 1, ctx);
+ emit_instr(ctx, bne, MIPS_R_AT, MIPS_R_ZERO, b_off);
+ /*
+- * if (--TCC < 0)
++ * if (TCC-- < 0)
+ * goto out;
+ */
+ /* Delay slot */
+- emit_instr(ctx, daddiu, MIPS_R_T5,
+- (ctx->flags & EBPF_TCC_IN_V1) ? MIPS_R_V1 : MIPS_R_S4, -1);
++ tcc_reg = (ctx->flags & EBPF_TCC_IN_V1) ? MIPS_R_V1 : MIPS_R_S4;
++ emit_instr(ctx, daddiu, MIPS_R_T5, tcc_reg, -1);
+ b_off = b_imm(this_idx + 1, ctx);
+- emit_instr(ctx, bltz, MIPS_R_T5, b_off);
++ emit_instr(ctx, bltz, tcc_reg, b_off);
+ /*
+ * prog = array->ptrs[index];
+ * if (prog == NULL)
+diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h
+index f627c37dad9c..ab5c215cf46c 100644
+--- a/arch/parisc/include/asm/cmpxchg.h
++++ b/arch/parisc/include/asm/cmpxchg.h
+@@ -44,8 +44,14 @@ __xchg(unsigned long x, __volatile__ void *ptr, int size)
+ ** if (((unsigned long)p & 0xf) == 0)
+ ** return __ldcw(p);
+ */
+-#define xchg(ptr, x) \
+- ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr))))
++#define xchg(ptr, x) \
++({ \
++ __typeof__(*(ptr)) __ret; \
++ __typeof__(*(ptr)) _x_ = (x); \
++ __ret = (__typeof__(*(ptr))) \
++ __xchg((unsigned long)_x_, (ptr), sizeof(*(ptr))); \
++ __ret; \
++})
+
+ /* bug catcher for when unsupported size is used - won't link */
+ extern void __cmpxchg_called_with_bad_pointer(void);
+diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
+index 5eb979d04b90..a1a5e4c59e6b 100644
+--- a/arch/parisc/kernel/drivers.c
++++ b/arch/parisc/kernel/drivers.c
+@@ -789,7 +789,7 @@ EXPORT_SYMBOL(device_to_hwpath);
+ static void walk_native_bus(unsigned long io_io_low, unsigned long io_io_high,
+ struct device *parent);
+
+-static void walk_lower_bus(struct parisc_device *dev)
++static void __init walk_lower_bus(struct parisc_device *dev)
+ {
+ unsigned long io_io_low, io_io_high;
+
+diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h
+index 685c72310f5d..3198dde87d4d 100644
+--- a/arch/powerpc/include/asm/spinlock.h
++++ b/arch/powerpc/include/asm/spinlock.h
+@@ -19,6 +19,7 @@
+ *
+ * (the type definitions are in asm/spinlock_types.h)
+ */
++#include <linux/jump_label.h>
+ #include <linux/irqflags.h>
+ #ifdef CONFIG_PPC64
+ #include <asm/paca.h>
+@@ -53,10 +54,12 @@
+ #endif
+
+ #ifdef CONFIG_PPC_PSERIES
++DECLARE_STATIC_KEY_FALSE(shared_processor);
++
+ #define vcpu_is_preempted vcpu_is_preempted
+ static inline bool vcpu_is_preempted(int cpu)
+ {
+- if (!firmware_has_feature(FW_FEATURE_SPLPAR))
++ if (!static_branch_unlikely(&shared_processor))
+ return false;
+ return !!(be32_to_cpu(lppaca_of(cpu).yield_count) & 1);
+ }
+diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
+index 04ccb274a620..9a6afd9f3f9b 100644
+--- a/arch/powerpc/mm/mem.c
++++ b/arch/powerpc/mm/mem.c
+@@ -344,6 +344,14 @@ void __init mem_init(void)
+ BUILD_BUG_ON(MMU_PAGE_COUNT > 16);
+
+ #ifdef CONFIG_SWIOTLB
++ /*
++ * Some platforms (e.g. 85xx) limit DMA-able memory way below
++ * 4G. We force memblock to bottom-up mode to ensure that the
++ * memory allocated in swiotlb_init() is DMA-able.
++ * As it's the last memblock allocation, no need to reset it
++ * back to to-down.
++ */
++ memblock_set_bottom_up(true);
+ swiotlb_init(0);
+ #endif
+
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index 67f49159ea70..c2d318d1df02 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -75,6 +75,9 @@
+ #include "pseries.h"
+ #include "../../../../drivers/pci/pci.h"
+
++DEFINE_STATIC_KEY_FALSE(shared_processor);
++EXPORT_SYMBOL_GPL(shared_processor);
++
+ int CMO_PrPSP = -1;
+ int CMO_SecPSP = -1;
+ unsigned long CMO_PageSize = (ASM_CONST(1) << IOMMU_PAGE_SHIFT_4K);
+@@ -761,6 +764,10 @@ static void __init pSeries_setup_arch(void)
+
+ if (firmware_has_feature(FW_FEATURE_LPAR)) {
+ vpa_init(boot_cpuid);
++
++ if (lppaca_shared_proc(get_lppaca()))
++ static_branch_enable(&shared_processor);
++
+ ppc_md.power_save = pseries_lpar_idle;
+ ppc_md.enable_pmcs = pseries_lpar_enable_pmcs;
+ #ifdef CONFIG_PCI_IOV
+diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
+index ce6a3f75065b..fdccb7689bb9 100644
+--- a/arch/s390/purgatory/Makefile
++++ b/arch/s390/purgatory/Makefile
+@@ -13,8 +13,10 @@ $(obj)/sha256.o: $(srctree)/lib/sha256.c FORCE
+ $(obj)/mem.o: $(srctree)/arch/s390/lib/mem.S FORCE
+ $(call if_changed_rule,as_o_S)
+
+-$(obj)/string.o: $(srctree)/arch/s390/lib/string.c FORCE
+- $(call if_changed_rule,cc_o_c)
++KCOV_INSTRUMENT := n
++GCOV_PROFILE := n
++UBSAN_SANITIZE := n
++KASAN_SANITIZE := n
+
+ LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined -nostdlib
+ LDFLAGS_purgatory.ro += -z nodefaultlib
+diff --git a/arch/s390/purgatory/string.c b/arch/s390/purgatory/string.c
+new file mode 100644
+index 000000000000..c98c22a72db7
+--- /dev/null
++++ b/arch/s390/purgatory/string.c
+@@ -0,0 +1,3 @@
++// SPDX-License-Identifier: GPL-2.0
++#define __HAVE_ARCH_MEMCMP /* arch function */
++#include "../lib/string.c"
+diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
+index c9625bff4328..429389489eed 100644
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -375,7 +375,7 @@ int x86_add_exclusive(unsigned int what)
+ * LBR and BTS are still mutually exclusive.
+ */
+ if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
+- return 0;
++ goto out;
+
+ if (!atomic_inc_not_zero(&x86_pmu.lbr_exclusive[what])) {
+ mutex_lock(&pmc_reserve_mutex);
+@@ -387,6 +387,7 @@ int x86_add_exclusive(unsigned int what)
+ mutex_unlock(&pmc_reserve_mutex);
+ }
+
++out:
+ atomic_inc(&active_events);
+ return 0;
+
+@@ -397,11 +398,15 @@ fail_unlock:
+
+ void x86_del_exclusive(unsigned int what)
+ {
++ atomic_dec(&active_events);
++
++ /*
++ * See the comment in x86_add_exclusive().
++ */
+ if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
+ return;
+
+ atomic_dec(&x86_pmu.lbr_exclusive[what]);
+- atomic_dec(&active_events);
+ }
+
+ int x86_setup_perfctr(struct perf_event *event)
+diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
+index 844d31cb8a0c..c9873c9168ad 100644
+--- a/arch/x86/platform/efi/quirks.c
++++ b/arch/x86/platform/efi/quirks.c
+@@ -259,10 +259,6 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size)
+ return;
+ }
+
+- /* No need to reserve regions that will never be freed. */
+- if (md.attribute & EFI_MEMORY_RUNTIME)
+- return;
+-
+ size += addr % EFI_PAGE_SIZE;
+ size = round_up(size, EFI_PAGE_SIZE);
+ addr = round_down(addr, EFI_PAGE_SIZE);
+@@ -292,6 +288,8 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size)
+ early_memunmap(new, new_size);
+
+ efi_memmap_install(new_phys, num_entries);
++ e820__range_update(addr, size, E820_TYPE_RAM, E820_TYPE_RESERVED);
++ e820__update_table(e820_table);
+ }
+
+ /*
+diff --git a/block/blk-map.c b/block/blk-map.c
+index db9373bd31ac..9d8627acc2f5 100644
+--- a/block/blk-map.c
++++ b/block/blk-map.c
+@@ -145,7 +145,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
+ return 0;
+
+ unmap_rq:
+- __blk_rq_unmap_user(bio);
++ blk_rq_unmap_user(bio);
+ fail:
+ rq->bio = NULL;
+ return ret;
+diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
+index f4880a4f865b..d8c3595e9023 100644
+--- a/drivers/cpufreq/imx6q-cpufreq.c
++++ b/drivers/cpufreq/imx6q-cpufreq.c
+@@ -12,6 +12,7 @@
+ #include <linux/cpu_cooling.h>
+ #include <linux/err.h>
+ #include <linux/module.h>
++#include <linux/nvmem-consumer.h>
+ #include <linux/of.h>
+ #include <linux/of_address.h>
+ #include <linux/pm_opp.h>
+@@ -295,20 +296,32 @@ put_node:
+ #define OCOTP_CFG3_6ULL_SPEED_792MHZ 0x2
+ #define OCOTP_CFG3_6ULL_SPEED_900MHZ 0x3
+
+-static void imx6ul_opp_check_speed_grading(struct device *dev)
++static int imx6ul_opp_check_speed_grading(struct device *dev)
+ {
+- struct device_node *np;
+- void __iomem *base;
+ u32 val;
++ int ret = 0;
+
+- np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-ocotp");
+- if (!np)
+- return;
++ if (of_find_property(dev->of_node, "nvmem-cells", NULL)) {
++ ret = nvmem_cell_read_u32(dev, "speed_grade", &val);
++ if (ret)
++ return ret;
++ } else {
++ struct device_node *np;
++ void __iomem *base;
++
++ np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-ocotp");
++ if (!np)
++ return -ENOENT;
++
++ base = of_iomap(np, 0);
++ of_node_put(np);
++ if (!base) {
++ dev_err(dev, "failed to map ocotp\n");
++ return -EFAULT;
++ }
+
+- base = of_iomap(np, 0);
+- if (!base) {
+- dev_err(dev, "failed to map ocotp\n");
+- goto put_node;
++ val = readl_relaxed(base + OCOTP_CFG3);
++ iounmap(base);
+ }
+
+ /*
+@@ -319,7 +332,6 @@ static void imx6ul_opp_check_speed_grading(struct device *dev)
+ * 2b'11: 900000000Hz on i.MX6ULL only;
+ * We need to set the max speed of ARM according to fuse map.
+ */
+- val = readl_relaxed(base + OCOTP_CFG3);
+ val >>= OCOTP_CFG3_SPEED_SHIFT;
+ val &= 0x3;
+
+@@ -339,9 +351,7 @@ static void imx6ul_opp_check_speed_grading(struct device *dev)
+ dev_warn(dev, "failed to disable 900MHz OPP\n");
+ }
+
+- iounmap(base);
+-put_node:
+- of_node_put(np);
++ return ret;
+ }
+
+ static int imx6q_cpufreq_probe(struct platform_device *pdev)
+@@ -399,10 +409,18 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
+ }
+
+ if (of_machine_is_compatible("fsl,imx6ul") ||
+- of_machine_is_compatible("fsl,imx6ull"))
+- imx6ul_opp_check_speed_grading(cpu_dev);
+- else
++ of_machine_is_compatible("fsl,imx6ull")) {
++ ret = imx6ul_opp_check_speed_grading(cpu_dev);
++ if (ret == -EPROBE_DEFER)
++ return ret;
++ if (ret) {
++ dev_err(cpu_dev, "failed to read ocotp: %d\n",
++ ret);
++ return ret;
++ }
++ } else {
+ imx6q_opp_check_speed_grading(cpu_dev);
++ }
+
+ /* Because we have added the OPPs here, we must free them */
+ free_opp = true;
+diff --git a/drivers/firmware/efi/libstub/gop.c b/drivers/firmware/efi/libstub/gop.c
+index 24c461dea7af..fd8053f9556e 100644
+--- a/drivers/firmware/efi/libstub/gop.c
++++ b/drivers/firmware/efi/libstub/gop.c
+@@ -85,30 +85,6 @@ setup_pixel_info(struct screen_info *si, u32 pixels_per_scan_line,
+ }
+ }
+
+-static efi_status_t
+-__gop_query32(efi_system_table_t *sys_table_arg,
+- struct efi_graphics_output_protocol_32 *gop32,
+- struct efi_graphics_output_mode_info **info,
+- unsigned long *size, u64 *fb_base)
+-{
+- struct efi_graphics_output_protocol_mode_32 *mode;
+- efi_graphics_output_protocol_query_mode query_mode;
+- efi_status_t status;
+- unsigned long m;
+-
+- m = gop32->mode;
+- mode = (struct efi_graphics_output_protocol_mode_32 *)m;
+- query_mode = (void *)(unsigned long)gop32->query_mode;
+-
+- status = __efi_call_early(query_mode, (void *)gop32, mode->mode, size,
+- info);
+- if (status != EFI_SUCCESS)
+- return status;
+-
+- *fb_base = mode->frame_buffer_base;
+- return status;
+-}
+-
+ static efi_status_t
+ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ efi_guid_t *proto, unsigned long size, void **gop_handle)
+@@ -121,7 +97,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ u64 fb_base;
+ struct efi_pixel_bitmask pixel_info;
+ int pixel_format;
+- efi_status_t status = EFI_NOT_FOUND;
++ efi_status_t status;
+ u32 *handles = (u32 *)(unsigned long)gop_handle;
+ int i;
+
+@@ -130,6 +106,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+
+ nr_gops = size / sizeof(u32);
+ for (i = 0; i < nr_gops; i++) {
++ struct efi_graphics_output_protocol_mode_32 *mode;
+ struct efi_graphics_output_mode_info *info = NULL;
+ efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID;
+ bool conout_found = false;
+@@ -147,9 +124,11 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ if (status == EFI_SUCCESS)
+ conout_found = true;
+
+- status = __gop_query32(sys_table_arg, gop32, &info, &size,
+- ¤t_fb_base);
+- if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
++ mode = (void *)(unsigned long)gop32->mode;
++ info = (void *)(unsigned long)mode->info;
++ current_fb_base = mode->frame_buffer_base;
++
++ if ((!first_gop || conout_found) &&
+ info->pixel_format != PIXEL_BLT_ONLY) {
+ /*
+ * Systems that use the UEFI Console Splitter may
+@@ -177,7 +156,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+
+ /* Did we find any GOPs? */
+ if (!first_gop)
+- goto out;
++ return EFI_NOT_FOUND;
+
+ /* EFI framebuffer */
+ si->orig_video_isVGA = VIDEO_TYPE_EFI;
+@@ -199,32 +178,8 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ si->lfb_size = si->lfb_linelength * si->lfb_height;
+
+ si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS;
+-out:
+- return status;
+-}
+-
+-static efi_status_t
+-__gop_query64(efi_system_table_t *sys_table_arg,
+- struct efi_graphics_output_protocol_64 *gop64,
+- struct efi_graphics_output_mode_info **info,
+- unsigned long *size, u64 *fb_base)
+-{
+- struct efi_graphics_output_protocol_mode_64 *mode;
+- efi_graphics_output_protocol_query_mode query_mode;
+- efi_status_t status;
+- unsigned long m;
+-
+- m = gop64->mode;
+- mode = (struct efi_graphics_output_protocol_mode_64 *)m;
+- query_mode = (void *)(unsigned long)gop64->query_mode;
+-
+- status = __efi_call_early(query_mode, (void *)gop64, mode->mode, size,
+- info);
+- if (status != EFI_SUCCESS)
+- return status;
+
+- *fb_base = mode->frame_buffer_base;
+- return status;
++ return EFI_SUCCESS;
+ }
+
+ static efi_status_t
+@@ -239,7 +194,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ u64 fb_base;
+ struct efi_pixel_bitmask pixel_info;
+ int pixel_format;
+- efi_status_t status = EFI_NOT_FOUND;
++ efi_status_t status;
+ u64 *handles = (u64 *)(unsigned long)gop_handle;
+ int i;
+
+@@ -248,6 +203,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+
+ nr_gops = size / sizeof(u64);
+ for (i = 0; i < nr_gops; i++) {
++ struct efi_graphics_output_protocol_mode_64 *mode;
+ struct efi_graphics_output_mode_info *info = NULL;
+ efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID;
+ bool conout_found = false;
+@@ -265,9 +221,11 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ if (status == EFI_SUCCESS)
+ conout_found = true;
+
+- status = __gop_query64(sys_table_arg, gop64, &info, &size,
+- ¤t_fb_base);
+- if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
++ mode = (void *)(unsigned long)gop64->mode;
++ info = (void *)(unsigned long)mode->info;
++ current_fb_base = mode->frame_buffer_base;
++
++ if ((!first_gop || conout_found) &&
+ info->pixel_format != PIXEL_BLT_ONLY) {
+ /*
+ * Systems that use the UEFI Console Splitter may
+@@ -295,7 +253,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+
+ /* Did we find any GOPs? */
+ if (!first_gop)
+- goto out;
++ return EFI_NOT_FOUND;
+
+ /* EFI framebuffer */
+ si->orig_video_isVGA = VIDEO_TYPE_EFI;
+@@ -317,8 +275,8 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ si->lfb_size = si->lfb_linelength * si->lfb_height;
+
+ si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS;
+-out:
+- return status;
++
++ return EFI_SUCCESS;
+ }
+
+ /*
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+index 7ba414b52faa..d71188b982cb 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+@@ -1292,6 +1292,7 @@ static int gsc_remove(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+
++ component_del(dev, &gsc_component_ops);
+ pm_runtime_dont_use_autosuspend(dev);
+ pm_runtime_disable(dev);
+
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index da4516fbf542..34c058c24b9d 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -236,7 +236,7 @@ static DEFINE_MUTEX(iova_cache_mutex);
+
+ struct iova *alloc_iova_mem(void)
+ {
+- return kmem_cache_alloc(iova_cache, GFP_ATOMIC);
++ return kmem_cache_zalloc(iova_cache, GFP_ATOMIC);
+ }
+ EXPORT_SYMBOL(alloc_iova_mem);
+
+diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c
+index 38e399e0f30e..8298d6743c57 100644
+--- a/drivers/net/dsa/mv88e6xxx/global1.c
++++ b/drivers/net/dsa/mv88e6xxx/global1.c
+@@ -371,6 +371,11 @@ int mv88e6390_g1_set_cpu_port(struct mv88e6xxx_chip *chip, int port)
+ {
+ u16 ptr = MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST;
+
++ /* Use the default high priority for management frames sent to
++ * the CPU.
++ */
++ port |= MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST_MGMTPRI;
++
+ return mv88e6390_g1_monitor_write(chip, ptr, port);
+ }
+
+diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h
+index bef01331266f..70b870c7cf1d 100644
+--- a/drivers/net/dsa/mv88e6xxx/global1.h
++++ b/drivers/net/dsa/mv88e6xxx/global1.h
+@@ -197,6 +197,7 @@
+ #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_INGRESS_DEST 0x2000
+ #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_EGRESS_DEST 0x2100
+ #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST 0x3000
++#define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST_MGMTPRI 0x00e0
+ #define MV88E6390_G1_MONITOR_MGMT_CTL_DATA_MASK 0x00ff
+
+ /* Offset 0x1C: Global Control 2 */
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+index ee5159ef837e..df5e8c2e8eaf 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+@@ -1113,7 +1113,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp)
+ for (i = 0; i < E1H_FUNC_MAX / 2; i++) {
+ u32 func_config =
+ MF_CFG_RD(bp,
+- func_mf_config[BP_PORT(bp) + 2 * i].
++ func_mf_config[BP_PATH(bp) + 2 * i].
+ config);
+ func_num +=
+ ((func_config & FUNC_MF_CFG_FUNC_HIDE) ? 0 : 1);
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index af57568c922e..df4f77ad95c4 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -9995,10 +9995,18 @@ static void bnx2x_recovery_failed(struct bnx2x *bp)
+ */
+ static void bnx2x_parity_recover(struct bnx2x *bp)
+ {
+- bool global = false;
+ u32 error_recovered, error_unrecovered;
+- bool is_parity;
++ bool is_parity, global = false;
++#ifdef CONFIG_BNX2X_SRIOV
++ int vf_idx;
++
++ for (vf_idx = 0; vf_idx < bp->requested_nr_virtfn; vf_idx++) {
++ struct bnx2x_virtf *vf = BP_VF(bp, vf_idx);
+
++ if (vf)
++ vf->state = VF_LOST;
++ }
++#endif
+ DP(NETIF_MSG_HW, "Handling parity\n");
+ while (1) {
+ switch (bp->recovery_state) {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+index eb814c65152f..4dc34de1a09a 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+@@ -139,6 +139,7 @@ struct bnx2x_virtf {
+ #define VF_ACQUIRED 1 /* VF acquired, but not initialized */
+ #define VF_ENABLED 2 /* VF Enabled */
+ #define VF_RESET 3 /* VF FLR'd, pending cleanup */
++#define VF_LOST 4 /* Recovery while VFs are loaded */
+
+ bool flr_clnup_stage; /* true during flr cleanup */
+ bool malicious; /* true if FW indicated so, until FLR */
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+index 8e0a317b31f7..152758a45150 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+@@ -2114,6 +2114,18 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf,
+ {
+ int i;
+
++ if (vf->state == VF_LOST) {
++ /* Just ack the FW and return if VFs are lost
++ * in case of parity error. VFs are supposed to be timedout
++ * on waiting for PF response.
++ */
++ DP(BNX2X_MSG_IOV,
++ "VF 0x%x lost, not handling the request\n", vf->abs_vfid);
++
++ storm_memset_vf_mbx_ack(bp, vf->abs_vfid);
++ return;
++ }
++
+ /* check if tlv type is known */
+ if (bnx2x_tlv_supported(mbx->first_tlv.tl.type)) {
+ /* Lock the per vf op mutex and note the locker's identity.
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 2240c23b0a4c..0a409ba4012a 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -2778,8 +2778,15 @@ static int bnxt_hwrm_dbg_dma_data(struct bnxt *bp, void *msg, int msg_len,
+ }
+ }
+
+- if (info->dest_buf)
+- memcpy(info->dest_buf + off, dma_buf, len);
++ if (info->dest_buf) {
++ if ((info->seg_start + off + len) <=
++ BNXT_COREDUMP_BUF_LEN(info->buf_len)) {
++ memcpy(info->dest_buf + off, dma_buf, len);
++ } else {
++ rc = -ENOBUFS;
++ break;
++ }
++ }
+
+ if (cmn_req->req_type ==
+ cpu_to_le16(HWRM_DBG_COREDUMP_RETRIEVE))
+@@ -2833,7 +2840,7 @@ static int bnxt_hwrm_dbg_coredump_initiate(struct bnxt *bp, u16 component_id,
+
+ static int bnxt_hwrm_dbg_coredump_retrieve(struct bnxt *bp, u16 component_id,
+ u16 segment_id, u32 *seg_len,
+- void *buf, u32 offset)
++ void *buf, u32 buf_len, u32 offset)
+ {
+ struct hwrm_dbg_coredump_retrieve_input req = {0};
+ struct bnxt_hwrm_dbg_dma_info info = {NULL};
+@@ -2848,8 +2855,11 @@ static int bnxt_hwrm_dbg_coredump_retrieve(struct bnxt *bp, u16 component_id,
+ seq_no);
+ info.data_len_off = offsetof(struct hwrm_dbg_coredump_retrieve_output,
+ data_len);
+- if (buf)
++ if (buf) {
+ info.dest_buf = buf + offset;
++ info.buf_len = buf_len;
++ info.seg_start = offset;
++ }
+
+ rc = bnxt_hwrm_dbg_dma_data(bp, &req, sizeof(req), &info);
+ if (!rc)
+@@ -2939,14 +2949,17 @@ bnxt_fill_coredump_record(struct bnxt *bp, struct bnxt_coredump_record *record,
+ static int bnxt_get_coredump(struct bnxt *bp, void *buf, u32 *dump_len)
+ {
+ u32 ver_get_resp_len = sizeof(struct hwrm_ver_get_output);
++ u32 offset = 0, seg_hdr_len, seg_record_len, buf_len = 0;
+ struct coredump_segment_record *seg_record = NULL;
+- u32 offset = 0, seg_hdr_len, seg_record_len;
+ struct bnxt_coredump_segment_hdr seg_hdr;
+ struct bnxt_coredump coredump = {NULL};
+ time64_t start_time;
+ u16 start_utc;
+ int rc = 0, i;
+
++ if (buf)
++ buf_len = *dump_len;
++
+ start_time = ktime_get_real_seconds();
+ start_utc = sys_tz.tz_minuteswest * 60;
+ seg_hdr_len = sizeof(seg_hdr);
+@@ -2979,6 +2992,12 @@ static int bnxt_get_coredump(struct bnxt *bp, void *buf, u32 *dump_len)
+ u32 duration = 0, seg_len = 0;
+ unsigned long start, end;
+
++ if (buf && ((offset + seg_hdr_len) >
++ BNXT_COREDUMP_BUF_LEN(buf_len))) {
++ rc = -ENOBUFS;
++ goto err;
++ }
++
+ start = jiffies;
+
+ rc = bnxt_hwrm_dbg_coredump_initiate(bp, comp_id, seg_id);
+@@ -2991,9 +3010,11 @@ static int bnxt_get_coredump(struct bnxt *bp, void *buf, u32 *dump_len)
+
+ /* Write segment data into the buffer */
+ rc = bnxt_hwrm_dbg_coredump_retrieve(bp, comp_id, seg_id,
+- &seg_len, buf,
++ &seg_len, buf, buf_len,
+ offset + seg_hdr_len);
+- if (rc)
++ if (rc && rc == -ENOBUFS)
++ goto err;
++ else if (rc)
+ netdev_err(bp->dev,
+ "Failed to retrieve coredump for seg = %d\n",
+ seg_record->segment_id);
+@@ -3023,7 +3044,8 @@ err:
+ rc);
+ kfree(coredump.data);
+ *dump_len += sizeof(struct bnxt_coredump_record);
+-
++ if (rc == -ENOBUFS)
++ netdev_err(bp->dev, "Firmware returned large coredump buffer");
+ return rc;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h
+index b5b65b3f8534..3998f6e809a9 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.h
+@@ -31,6 +31,8 @@ struct bnxt_coredump {
+ u16 total_segs;
+ };
+
++#define BNXT_COREDUMP_BUF_LEN(len) ((len) - sizeof(struct bnxt_coredump_record))
++
+ struct bnxt_hwrm_dbg_dma_info {
+ void *dest_buf;
+ int dest_buf_size;
+@@ -38,6 +40,8 @@ struct bnxt_hwrm_dbg_dma_info {
+ u16 seq_off;
+ u16 data_len_off;
+ u16 segs;
++ u32 seg_start;
++ u32 buf_len;
+ };
+
+ struct hwrm_dbg_cmn_input {
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+index b429b726b987..d320e9afab88 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+@@ -3035,6 +3035,9 @@ static int sge_queue_entries(const struct adapter *adap)
+ int tot_uld_entries = 0;
+ int i;
+
++ if (!is_uld(adap))
++ goto lld_only;
++
+ mutex_lock(&uld_mutex);
+ for (i = 0; i < CXGB4_TX_MAX; i++)
+ tot_uld_entries += sge_qinfo_uld_txq_entries(adap, i);
+@@ -3045,6 +3048,7 @@ static int sge_queue_entries(const struct adapter *adap)
+ }
+ mutex_unlock(&uld_mutex);
+
++lld_only:
+ return DIV_ROUND_UP(adap->sge.ethqsets, 4) +
+ tot_uld_entries +
+ DIV_ROUND_UP(MAX_CTRL_QUEUES, 4) + 1;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
+index bdf53cf350f6..720514b5c006 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
+@@ -650,6 +650,13 @@ mlxsw_sp_qdisc_prio_graft(struct mlxsw_sp_port *mlxsw_sp_port,
+ mlxsw_sp_port->tclass_qdiscs[tclass_num].handle == p->child_handle)
+ return 0;
+
++ if (!p->child_handle) {
++ /* This is an invisible FIFO replacing the original Qdisc.
++ * Ignore it--the original Qdisc's destroy will follow.
++ */
++ return 0;
++ }
++
+ /* See if the grafted qdisc is already offloaded on any tclass. If so,
+ * unoffload it.
+ */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index fea286e14add..ef13a462c36d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -946,6 +946,9 @@ static int sun8i_dwmac_set_syscon(struct stmmac_priv *priv)
+ /* default */
+ break;
+ case PHY_INTERFACE_MODE_RGMII:
++ case PHY_INTERFACE_MODE_RGMII_ID:
++ case PHY_INTERFACE_MODE_RGMII_RXID:
++ case PHY_INTERFACE_MODE_RGMII_TXID:
+ reg |= SYSCON_EPIT | SYSCON_ETCS_INT_GMII;
+ break;
+ case PHY_INTERFACE_MODE_RMII:
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+index 62ccbd47c1db..fc1fa0f9f338 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+@@ -53,7 +53,7 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
+ * rate, which then uses the auto-reparenting feature of the
+ * clock driver, and enabling/disabling the clock.
+ */
+- if (gmac->interface == PHY_INTERFACE_MODE_RGMII) {
++ if (phy_interface_mode_is_rgmii(gmac->interface)) {
+ clk_set_rate(gmac->tx_clk, SUN7I_GMAC_GMII_RGMII_RATE);
+ clk_prepare_enable(gmac->tx_clk);
+ gmac->clk_enabled = 1;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+index 0a80fa25afe3..209745294751 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+@@ -169,6 +169,8 @@
+ #define XGMAC_DMA_CH_RX_CONTROL(x) (0x00003108 + (0x80 * (x)))
+ #define XGMAC_RxPBL GENMASK(21, 16)
+ #define XGMAC_RxPBL_SHIFT 16
++#define XGMAC_RBSZ GENMASK(14, 1)
++#define XGMAC_RBSZ_SHIFT 1
+ #define XGMAC_RXST BIT(0)
+ #define XGMAC_DMA_CH_TxDESC_LADDR(x) (0x00003114 + (0x80 * (x)))
+ #define XGMAC_DMA_CH_RxDESC_LADDR(x) (0x0000311c + (0x80 * (x)))
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+index 1c3930527444..27942c53b567 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+@@ -379,7 +379,8 @@ static void dwxgmac2_set_bfsize(void __iomem *ioaddr, int bfsize, u32 chan)
+ u32 value;
+
+ value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+- value |= bfsize << 1;
++ value &= ~XGMAC_RBSZ;
++ value |= bfsize << XGMAC_RBSZ_SHIFT;
+ writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 014fe93ed2d8..7ee0e46539c0 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -54,7 +54,7 @@
+ #include "dwxgmac2.h"
+ #include "hwif.h"
+
+-#define STMMAC_ALIGN(x) __ALIGN_KERNEL(x, SMP_CACHE_BYTES)
++#define STMMAC_ALIGN(x) ALIGN(ALIGN(x, SMP_CACHE_BYTES), 16)
+ #define TSO_MAX_BUFF_SIZE (SZ_16K - 1)
+
+ /* Module parameters */
+@@ -2997,6 +2997,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc));
+ stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue);
++ stmmac_tx_timer_arm(priv, queue);
+
+ return NETDEV_TX_OK;
+
+@@ -3210,6 +3211,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc));
+ stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue);
++ stmmac_tx_timer_arm(priv, queue);
+
+ return NETDEV_TX_OK;
+
+@@ -3604,12 +3606,24 @@ static void stmmac_set_rx_mode(struct net_device *dev)
+ static int stmmac_change_mtu(struct net_device *dev, int new_mtu)
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
++ int txfifosz = priv->plat->tx_fifo_size;
++
++ if (txfifosz == 0)
++ txfifosz = priv->dma_cap.tx_fifo_size;
++
++ txfifosz /= priv->plat->tx_queues_to_use;
+
+ if (netif_running(dev)) {
+ netdev_err(priv->dev, "must be stopped to change its MTU\n");
+ return -EBUSY;
+ }
+
++ new_mtu = STMMAC_ALIGN(new_mtu);
++
++ /* If condition true, FIFO is too small or MTU too large */
++ if ((txfifosz < new_mtu) || (new_mtu > BUF_SIZE_16KiB))
++ return -EINVAL;
++
+ dev->mtu = new_mtu;
+
+ netdev_update_features(dev);
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index 494f00b9c5ef..6571cac6e786 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -818,7 +818,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
+ lock_sock(sock->sk);
+ if (sock->sk->sk_user_data) {
+ sk = ERR_PTR(-EBUSY);
+- goto out_sock;
++ goto out_rel_sock;
+ }
+
+ sk = sock->sk;
+@@ -831,8 +831,9 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
+
+ setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg);
+
+-out_sock:
++out_rel_sock:
+ release_sock(sock->sk);
++out_sock:
+ sockfd_put(sock);
+ return sk;
+ }
+diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
+index 31d8d83c25ac..50709c76b672 100644
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -181,7 +181,6 @@ struct rndis_device {
+
+ u8 hw_mac_adr[ETH_ALEN];
+ u8 rss_key[NETVSC_HASH_KEYLEN];
+- u16 rx_table[ITAB_NUM];
+ };
+
+
+@@ -933,6 +932,8 @@ struct net_device_context {
+
+ u32 tx_table[VRSS_SEND_TAB_SIZE];
+
++ u16 rx_table[ITAB_NUM];
++
+ /* Ethtool settings */
+ u8 duplex;
+ u32 speed;
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index b7a71c203aa3..1f9f7fcdb0eb 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -1688,7 +1688,7 @@ static int netvsc_get_rxfh(struct net_device *dev, u32 *indir, u8 *key,
+ rndis_dev = ndev->extension;
+ if (indir) {
+ for (i = 0; i < ITAB_NUM; i++)
+- indir[i] = rndis_dev->rx_table[i];
++ indir[i] = ndc->rx_table[i];
+ }
+
+ if (key)
+@@ -1718,7 +1718,7 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir,
+ return -EINVAL;
+
+ for (i = 0; i < ITAB_NUM; i++)
+- rndis_dev->rx_table[i] = indir[i];
++ ndc->rx_table[i] = indir[i];
+ }
+
+ if (!key) {
+diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
+index 53c6039bffb6..f47e36ac42a7 100644
+--- a/drivers/net/hyperv/rndis_filter.c
++++ b/drivers/net/hyperv/rndis_filter.c
+@@ -719,6 +719,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev,
+ const u8 *rss_key, u16 flag)
+ {
+ struct net_device *ndev = rdev->ndev;
++ struct net_device_context *ndc = netdev_priv(ndev);
+ struct rndis_request *request;
+ struct rndis_set_request *set;
+ struct rndis_set_complete *set_complete;
+@@ -758,7 +759,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev,
+ /* Set indirection table entries */
+ itab = (u32 *)(rssp + 1);
+ for (i = 0; i < ITAB_NUM; i++)
+- itab[i] = rdev->rx_table[i];
++ itab[i] = ndc->rx_table[i];
+
+ /* Set hask key values */
+ keyp = (u8 *)((unsigned long)rssp + rssp->hashkey_offset);
+@@ -1244,6 +1245,7 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
+ struct netvsc_device_info *device_info)
+ {
+ struct net_device *net = hv_get_drvdata(dev);
++ struct net_device_context *ndc = netdev_priv(net);
+ struct netvsc_device *net_device;
+ struct rndis_device *rndis_device;
+ struct ndis_recv_scale_cap rsscap;
+@@ -1330,9 +1332,11 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
+ /* We will use the given number of channels if available. */
+ net_device->num_chn = min(net_device->max_chn, device_info->num_chn);
+
+- for (i = 0; i < ITAB_NUM; i++)
+- rndis_device->rx_table[i] = ethtool_rxfh_indir_default(
++ if (!netif_is_rxfh_configured(net)) {
++ for (i = 0; i < ITAB_NUM; i++)
++ ndc->rx_table[i] = ethtool_rxfh_indir_default(
+ i, net_device->num_chn);
++ }
+
+ atomic_set(&net_device->open_chn, 1);
+ vmbus_set_sc_create_callback(dev->channel, netvsc_sc_open);
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 78789dfbe29e..41c0a3b55bfb 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -263,7 +263,7 @@ static void macvlan_broadcast(struct sk_buff *skb,
+ struct net_device *src,
+ enum macvlan_mode mode)
+ {
+- const struct ethhdr *eth = eth_hdr(skb);
++ const struct ethhdr *eth = skb_eth_hdr(skb);
+ const struct macvlan_dev *vlan;
+ struct sk_buff *nskb;
+ unsigned int i;
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 6dd24a1ca10d..42715520c070 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -522,7 +522,7 @@ static int lan78xx_read_stats(struct lan78xx_net *dev,
+ }
+ } else {
+ netdev_warn(dev->net,
+- "Failed to read stat ret = 0x%x", ret);
++ "Failed to read stat ret = %d", ret);
+ }
+
+ kfree(stats);
+@@ -2736,11 +2736,6 @@ static int lan78xx_stop(struct net_device *net)
+ return 0;
+ }
+
+-static int lan78xx_linearize(struct sk_buff *skb)
+-{
+- return skb_linearize(skb);
+-}
+-
+ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev,
+ struct sk_buff *skb, gfp_t flags)
+ {
+@@ -2751,8 +2746,10 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev,
+ return NULL;
+ }
+
+- if (lan78xx_linearize(skb) < 0)
++ if (skb_linearize(skb)) {
++ dev_kfree_skb_any(skb);
+ return NULL;
++ }
+
+ tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN_MASK_) | TX_CMD_A_FCS_;
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index d8a56df3933f..613f36681853 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2217,7 +2217,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ ndst = &rt->dst;
+ skb_tunnel_check_pmtu(skb, ndst, VXLAN_HEADROOM);
+
+- tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
++ tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb);
+ ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
+ err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
+ vni, md, flags, udp_sum);
+@@ -2254,7 +2254,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+
+ skb_tunnel_check_pmtu(skb, ndst, VXLAN6_HEADROOM);
+
+- tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
++ tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb);
+ ttl = ttl ? : ip6_dst_hoplimit(ndst);
+ skb_scrub_packet(skb, xnet);
+ err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr),
+diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c
+index 27779d7317fd..6058c48d56dc 100644
+--- a/drivers/net/wireless/marvell/mwifiex/tdls.c
++++ b/drivers/net/wireless/marvell/mwifiex/tdls.c
+@@ -956,59 +956,117 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
+
+ switch (*pos) {
+ case WLAN_EID_SUPP_RATES:
++ if (pos[1] > 32)
++ return;
+ sta_ptr->tdls_cap.rates_len = pos[1];
+ for (i = 0; i < pos[1]; i++)
+ sta_ptr->tdls_cap.rates[i] = pos[i + 2];
+ break;
+
+ case WLAN_EID_EXT_SUPP_RATES:
++ if (pos[1] > 32)
++ return;
+ basic = sta_ptr->tdls_cap.rates_len;
++ if (pos[1] > 32 - basic)
++ return;
+ for (i = 0; i < pos[1]; i++)
+ sta_ptr->tdls_cap.rates[basic + i] = pos[i + 2];
+ sta_ptr->tdls_cap.rates_len += pos[1];
+ break;
+ case WLAN_EID_HT_CAPABILITY:
+- memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos,
++ if (pos > end - sizeof(struct ieee80211_ht_cap) - 2)
++ return;
++ if (pos[1] != sizeof(struct ieee80211_ht_cap))
++ return;
++ /* copy the ie's value into ht_capb*/
++ memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos + 2,
+ sizeof(struct ieee80211_ht_cap));
+ sta_ptr->is_11n_enabled = 1;
+ break;
+ case WLAN_EID_HT_OPERATION:
+- memcpy(&sta_ptr->tdls_cap.ht_oper, pos,
++ if (pos > end -
++ sizeof(struct ieee80211_ht_operation) - 2)
++ return;
++ if (pos[1] != sizeof(struct ieee80211_ht_operation))
++ return;
++ /* copy the ie's value into ht_oper*/
++ memcpy(&sta_ptr->tdls_cap.ht_oper, pos + 2,
+ sizeof(struct ieee80211_ht_operation));
+ break;
+ case WLAN_EID_BSS_COEX_2040:
++ if (pos > end - 3)
++ return;
++ if (pos[1] != 1)
++ return;
+ sta_ptr->tdls_cap.coex_2040 = pos[2];
+ break;
+ case WLAN_EID_EXT_CAPABILITY:
++ if (pos > end - sizeof(struct ieee_types_header))
++ return;
++ if (pos[1] < sizeof(struct ieee_types_header))
++ return;
++ if (pos[1] > 8)
++ return;
+ memcpy((u8 *)&sta_ptr->tdls_cap.extcap, pos,
+ sizeof(struct ieee_types_header) +
+ min_t(u8, pos[1], 8));
+ break;
+ case WLAN_EID_RSN:
++ if (pos > end - sizeof(struct ieee_types_header))
++ return;
++ if (pos[1] < sizeof(struct ieee_types_header))
++ return;
++ if (pos[1] > IEEE_MAX_IE_SIZE -
++ sizeof(struct ieee_types_header))
++ return;
+ memcpy((u8 *)&sta_ptr->tdls_cap.rsn_ie, pos,
+ sizeof(struct ieee_types_header) +
+ min_t(u8, pos[1], IEEE_MAX_IE_SIZE -
+ sizeof(struct ieee_types_header)));
+ break;
+ case WLAN_EID_QOS_CAPA:
++ if (pos > end - 3)
++ return;
++ if (pos[1] != 1)
++ return;
+ sta_ptr->tdls_cap.qos_info = pos[2];
+ break;
+ case WLAN_EID_VHT_OPERATION:
+- if (priv->adapter->is_hw_11ac_capable)
+- memcpy(&sta_ptr->tdls_cap.vhtoper, pos,
++ if (priv->adapter->is_hw_11ac_capable) {
++ if (pos > end -
++ sizeof(struct ieee80211_vht_operation) - 2)
++ return;
++ if (pos[1] !=
++ sizeof(struct ieee80211_vht_operation))
++ return;
++ /* copy the ie's value into vhtoper*/
++ memcpy(&sta_ptr->tdls_cap.vhtoper, pos + 2,
+ sizeof(struct ieee80211_vht_operation));
++ }
+ break;
+ case WLAN_EID_VHT_CAPABILITY:
+ if (priv->adapter->is_hw_11ac_capable) {
+- memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos,
++ if (pos > end -
++ sizeof(struct ieee80211_vht_cap) - 2)
++ return;
++ if (pos[1] != sizeof(struct ieee80211_vht_cap))
++ return;
++ /* copy the ie's value into vhtcap*/
++ memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos + 2,
+ sizeof(struct ieee80211_vht_cap));
+ sta_ptr->is_11ac_enabled = 1;
+ }
+ break;
+ case WLAN_EID_AID:
+- if (priv->adapter->is_hw_11ac_capable)
++ if (priv->adapter->is_hw_11ac_capable) {
++ if (pos > end - 4)
++ return;
++ if (pos[1] != 2)
++ return;
+ sta_ptr->tdls_cap.aid =
+ get_unaligned_le16((pos + 2));
++ }
++ break;
+ default:
+ break;
+ }
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index 72db2e0ebced..5aaa4ce04ec3 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -13,7 +13,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/poll.h>
+ #include <linux/wait.h>
+-
++#include <linux/io-64-nonatomic-lo-hi.h>
+ #include <linux/nospec.h>
+
+ MODULE_DESCRIPTION("Microsemi Switchtec(tm) PCIe Management Driver");
+@@ -633,7 +633,7 @@ static int ioctl_event_summary(struct switchtec_dev *stdev,
+ u32 reg;
+
+ s.global = ioread32(&stdev->mmio_sw_event->global_summary);
+- s.part_bitmap = ioread32(&stdev->mmio_sw_event->part_event_bitmap);
++ s.part_bitmap = readq(&stdev->mmio_sw_event->part_event_bitmap);
+ s.local_part = ioread32(&stdev->mmio_part_cfg->part_event_summary);
+
+ for (i = 0; i < stdev->partition_count; i++) {
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index f312764660e6..4bab758d14b1 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1724,8 +1724,8 @@ struct regulator *_regulator_get(struct device *dev, const char *id,
+ regulator = create_regulator(rdev, dev, id);
+ if (regulator == NULL) {
+ regulator = ERR_PTR(-ENOMEM);
+- put_device(&rdev->dev);
+ module_put(rdev->owner);
++ put_device(&rdev->dev);
+ return regulator;
+ }
+
+@@ -1851,13 +1851,13 @@ static void _regulator_put(struct regulator *regulator)
+
+ rdev->open_count--;
+ rdev->exclusive = 0;
+- put_device(&rdev->dev);
+ regulator_unlock(rdev);
+
+ kfree_const(regulator->supply_name);
+ kfree(regulator);
+
+ module_put(rdev->owner);
++ put_device(&rdev->dev);
+ }
+
+ /**
+diff --git a/drivers/regulator/rn5t618-regulator.c b/drivers/regulator/rn5t618-regulator.c
+index 790a4a73ea2c..40b74648bd31 100644
+--- a/drivers/regulator/rn5t618-regulator.c
++++ b/drivers/regulator/rn5t618-regulator.c
+@@ -154,6 +154,7 @@ static struct platform_driver rn5t618_regulator_driver = {
+
+ module_platform_driver(rn5t618_regulator_driver);
+
++MODULE_ALIAS("platform:rn5t618-regulator");
+ MODULE_AUTHOR("Beniamino Galvani <b.galvani@gmail.com>");
+ MODULE_DESCRIPTION("RN5T618 regulator driver");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index f89f9d02e788..a2e34c853ca9 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -1135,7 +1135,8 @@ static u32 get_fcx_max_data(struct dasd_device *device)
+ {
+ struct dasd_eckd_private *private = device->private;
+ int fcx_in_css, fcx_in_gneq, fcx_in_features;
+- int tpm, mdc;
++ unsigned int mdc;
++ int tpm;
+
+ if (dasd_nofcx)
+ return 0;
+@@ -1149,7 +1150,7 @@ static u32 get_fcx_max_data(struct dasd_device *device)
+ return 0;
+
+ mdc = ccw_device_get_mdc(device->cdev, 0);
+- if (mdc < 0) {
++ if (mdc == 0) {
+ dev_warn(&device->cdev->dev, "Detecting the maximum supported data size for zHPF requests failed\n");
+ return 0;
+ } else {
+@@ -1160,12 +1161,12 @@ static u32 get_fcx_max_data(struct dasd_device *device)
+ static int verify_fcx_max_data(struct dasd_device *device, __u8 lpm)
+ {
+ struct dasd_eckd_private *private = device->private;
+- int mdc;
++ unsigned int mdc;
+ u32 fcx_max_data;
+
+ if (private->fcx_max_data) {
+ mdc = ccw_device_get_mdc(device->cdev, lpm);
+- if ((mdc < 0)) {
++ if (mdc == 0) {
+ dev_warn(&device->cdev->dev,
+ "Detecting the maximum data size for zHPF "
+ "requests failed (rc=%d) for a new path %x\n",
+@@ -1769,7 +1770,7 @@ out_err2:
+ dasd_free_block(device->block);
+ device->block = NULL;
+ out_err1:
+- kfree(private->conf_data);
++ dasd_eckd_clear_conf_data(device);
+ kfree(device->private);
+ device->private = NULL;
+ return rc;
+@@ -1778,7 +1779,6 @@ out_err1:
+ static void dasd_eckd_uncheck_device(struct dasd_device *device)
+ {
+ struct dasd_eckd_private *private = device->private;
+- int i;
+
+ if (!private)
+ return;
+@@ -1788,21 +1788,7 @@ static void dasd_eckd_uncheck_device(struct dasd_device *device)
+ private->sneq = NULL;
+ private->vdsneq = NULL;
+ private->gneq = NULL;
+- private->conf_len = 0;
+- for (i = 0; i < 8; i++) {
+- kfree(device->path[i].conf_data);
+- if ((__u8 *)device->path[i].conf_data ==
+- private->conf_data) {
+- private->conf_data = NULL;
+- private->conf_len = 0;
+- }
+- device->path[i].conf_data = NULL;
+- device->path[i].cssid = 0;
+- device->path[i].ssid = 0;
+- device->path[i].chpid = 0;
+- }
+- kfree(private->conf_data);
+- private->conf_data = NULL;
++ dasd_eckd_clear_conf_data(device);
+ }
+
+ static struct dasd_ccw_req *
+diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
+index 4435ae0b3027..f0cae1973f78 100644
+--- a/drivers/s390/cio/device_ops.c
++++ b/drivers/s390/cio/device_ops.c
+@@ -624,7 +624,7 @@ EXPORT_SYMBOL(ccw_device_tm_start_timeout);
+ * @mask: mask of paths to use
+ *
+ * Return the number of 64K-bytes blocks all paths at least support
+- * for a transport command. Return values <= 0 indicate failures.
++ * for a transport command. Return value 0 indicates failure.
+ */
+ int ccw_device_get_mdc(struct ccw_device *cdev, u8 mask)
+ {
+diff --git a/drivers/spi/spi-cavium-thunderx.c b/drivers/spi/spi-cavium-thunderx.c
+index 877937706240..828fbbebc3c4 100644
+--- a/drivers/spi/spi-cavium-thunderx.c
++++ b/drivers/spi/spi-cavium-thunderx.c
+@@ -81,6 +81,7 @@ static int thunderx_spi_probe(struct pci_dev *pdev,
+
+ error:
+ clk_disable_unprepare(p->clk);
++ pci_release_regions(pdev);
+ spi_master_put(master);
+ return ret;
+ }
+@@ -95,6 +96,7 @@ static void thunderx_spi_remove(struct pci_dev *pdev)
+ return;
+
+ clk_disable_unprepare(p->clk);
++ pci_release_regions(pdev);
+ /* Put everything in a known state. */
+ writeq(0, p->register_base + OCTEON_SPI_CFG(p));
+ }
+diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
+index b9fb6493cd6b..95c28abaa027 100644
+--- a/drivers/spi/spi-ti-qspi.c
++++ b/drivers/spi/spi-ti-qspi.c
+@@ -69,6 +69,7 @@ struct ti_qspi {
+ u32 dc;
+
+ bool mmap_enabled;
++ int current_cs;
+ };
+
+ #define QSPI_PID (0x0)
+@@ -494,6 +495,7 @@ static void ti_qspi_enable_memory_map(struct spi_device *spi)
+ MEM_CS_EN(spi->chip_select));
+ }
+ qspi->mmap_enabled = true;
++ qspi->current_cs = spi->chip_select;
+ }
+
+ static void ti_qspi_disable_memory_map(struct spi_device *spi)
+@@ -505,6 +507,7 @@ static void ti_qspi_disable_memory_map(struct spi_device *spi)
+ regmap_update_bits(qspi->ctrl_base, qspi->ctrl_reg,
+ MEM_CS_MASK, 0);
+ qspi->mmap_enabled = false;
++ qspi->current_cs = -1;
+ }
+
+ static void ti_qspi_setup_mmap_read(struct spi_device *spi, u8 opcode,
+@@ -550,7 +553,7 @@ static int ti_qspi_exec_mem_op(struct spi_mem *mem,
+
+ mutex_lock(&qspi->list_lock);
+
+- if (!qspi->mmap_enabled)
++ if (!qspi->mmap_enabled || qspi->current_cs != mem->spi->chip_select)
+ ti_qspi_enable_memory_map(mem->spi);
+ ti_qspi_setup_mmap_read(mem->spi, op->cmd.opcode, op->data.buswidth,
+ op->addr.nbytes, op->dummy.nbytes);
+@@ -807,6 +810,7 @@ no_dma:
+ }
+ }
+ qspi->mmap_enabled = false;
++ qspi->current_cs = -1;
+
+ ret = devm_spi_register_master(&pdev->dev, master);
+ if (!ret)
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 1eb72be75fb7..9fa70894179c 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -203,9 +203,58 @@ static const unsigned short super_speed_maxpacket_maxes[4] = {
+ [USB_ENDPOINT_XFER_INT] = 1024,
+ };
+
+-static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+- int asnum, struct usb_host_interface *ifp, int num_ep,
+- unsigned char *buffer, int size)
++static bool endpoint_is_duplicate(struct usb_endpoint_descriptor *e1,
++ struct usb_endpoint_descriptor *e2)
++{
++ if (e1->bEndpointAddress == e2->bEndpointAddress)
++ return true;
++
++ if (usb_endpoint_xfer_control(e1) || usb_endpoint_xfer_control(e2)) {
++ if (usb_endpoint_num(e1) == usb_endpoint_num(e2))
++ return true;
++ }
++
++ return false;
++}
++
++/*
++ * Check for duplicate endpoint addresses in other interfaces and in the
++ * altsetting currently being parsed.
++ */
++static bool config_endpoint_is_duplicate(struct usb_host_config *config,
++ int inum, int asnum, struct usb_endpoint_descriptor *d)
++{
++ struct usb_endpoint_descriptor *epd;
++ struct usb_interface_cache *intfc;
++ struct usb_host_interface *alt;
++ int i, j, k;
++
++ for (i = 0; i < config->desc.bNumInterfaces; ++i) {
++ intfc = config->intf_cache[i];
++
++ for (j = 0; j < intfc->num_altsetting; ++j) {
++ alt = &intfc->altsetting[j];
++
++ if (alt->desc.bInterfaceNumber == inum &&
++ alt->desc.bAlternateSetting != asnum)
++ continue;
++
++ for (k = 0; k < alt->desc.bNumEndpoints; ++k) {
++ epd = &alt->endpoint[k].desc;
++
++ if (endpoint_is_duplicate(epd, d))
++ return true;
++ }
++ }
++ }
++
++ return false;
++}
++
++static int usb_parse_endpoint(struct device *ddev, int cfgno,
++ struct usb_host_config *config, int inum, int asnum,
++ struct usb_host_interface *ifp, int num_ep,
++ unsigned char *buffer, int size)
+ {
+ unsigned char *buffer0 = buffer;
+ struct usb_endpoint_descriptor *d;
+@@ -242,13 +291,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ goto skip_to_next_endpoint_or_interface_descriptor;
+
+ /* Check for duplicate endpoint addresses */
+- for (i = 0; i < ifp->desc.bNumEndpoints; ++i) {
+- if (ifp->endpoint[i].desc.bEndpointAddress ==
+- d->bEndpointAddress) {
+- dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
+- cfgno, inum, asnum, d->bEndpointAddress);
+- goto skip_to_next_endpoint_or_interface_descriptor;
+- }
++ if (config_endpoint_is_duplicate(config, inum, asnum, d)) {
++ dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
++ cfgno, inum, asnum, d->bEndpointAddress);
++ goto skip_to_next_endpoint_or_interface_descriptor;
+ }
+
+ endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
+@@ -522,8 +568,8 @@ static int usb_parse_interface(struct device *ddev, int cfgno,
+ if (((struct usb_descriptor_header *) buffer)->bDescriptorType
+ == USB_DT_INTERFACE)
+ break;
+- retval = usb_parse_endpoint(ddev, cfgno, inum, asnum, alt,
+- num_ep, buffer, size);
++ retval = usb_parse_endpoint(ddev, cfgno, config, inum, asnum,
++ alt, num_ep, buffer, size);
+ if (retval < 0)
+ return retval;
+ ++n;
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index b33ec768404b..adc8e3a0138f 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2657,7 +2657,7 @@ static unsigned hub_is_wusb(struct usb_hub *hub)
+ #define SET_ADDRESS_TRIES 2
+ #define GET_DESCRIPTOR_TRIES 2
+ #define SET_CONFIG_TRIES (2 * (use_both_schemes + 1))
+-#define USE_NEW_SCHEME(i, scheme) ((i) / 2 == (int)scheme)
++#define USE_NEW_SCHEME(i, scheme) ((i) / 2 == (int)(scheme))
+
+ #define HUB_ROOT_RESET_TIME 60 /* times are in msec */
+ #define HUB_SHORT_RESET_TIME 10
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 3a24230bb89a..a6e682a000fc 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2271,6 +2271,13 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep,
+
+ static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req)
+ {
++ /*
++ * For OUT direction, host may send less than the setup
++ * length. Return true for all OUT requests.
++ */
++ if (!req->direction)
++ return true;
++
+ return req->request.actual == req->request.length;
+ }
+
+diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
+index 1505e554d245..d0248c58dcb6 100644
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -1335,7 +1335,7 @@ static int dummy_perform_transfer(struct urb *urb, struct dummy_request *req,
+ u32 this_sg;
+ bool next_sg;
+
+- to_host = usb_pipein(urb->pipe);
++ to_host = usb_urb_dir_in(urb);
+ rbuf = req->req.buf + req->req.actual;
+
+ if (!urb->num_sgs) {
+@@ -1423,7 +1423,7 @@ top:
+
+ /* FIXME update emulated data toggle too */
+
+- to_host = usb_pipein(urb->pipe);
++ to_host = usb_urb_dir_in(urb);
+ if (unlikely(len == 0))
+ is_short = 1;
+ else {
+@@ -1844,7 +1844,7 @@ restart:
+
+ /* find the gadget's ep for this request (if configured) */
+ address = usb_pipeendpoint (urb->pipe);
+- if (usb_pipein(urb->pipe))
++ if (usb_urb_dir_in(urb))
+ address |= USB_DIR_IN;
+ ep = find_endpoint(dum, address);
+ if (!ep) {
+@@ -2399,7 +2399,7 @@ static inline ssize_t show_urb(char *buf, size_t size, struct urb *urb)
+ s = "?";
+ break;
+ } s; }),
+- ep, ep ? (usb_pipein(urb->pipe) ? "in" : "out") : "",
++ ep, ep ? (usb_urb_dir_in(urb) ? "in" : "out") : "",
+ ({ char *s; \
+ switch (usb_pipetype(urb->pipe)) { \
+ case PIPE_CONTROL: \
+@@ -2739,7 +2739,7 @@ static struct platform_driver dummy_hcd_driver = {
+ };
+
+ /*-------------------------------------------------------------------------*/
+-#define MAX_NUM_UDC 2
++#define MAX_NUM_UDC 32
+ static struct platform_device *the_udc_pdev[MAX_NUM_UDC];
+ static struct platform_device *the_hcd_pdev[MAX_NUM_UDC];
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 2905274e3626..553adab174bf 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1172,6 +1172,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff), /* Telit ME910 (ECM) */
+ .driver_info = NCTRL(0) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110a, 0xff), /* Telit ME910G1 */
++ .driver_info = NCTRL(0) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index cdd6d5021000..7916f711daf5 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2862,12 +2862,12 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid,
+ if (!(fs_info->qgroup_flags &
+ BTRFS_QGROUP_STATUS_FLAG_RESCAN)) {
+ btrfs_warn(fs_info,
+- "qgroup rescan init failed, qgroup is not enabled");
++ "qgroup rescan init failed, qgroup rescan is not queued");
+ ret = -EINVAL;
+ } else if (!(fs_info->qgroup_flags &
+ BTRFS_QGROUP_STATUS_FLAG_ON)) {
+ btrfs_warn(fs_info,
+- "qgroup rescan init failed, qgroup rescan is not queued");
++ "qgroup rescan init failed, qgroup is not enabled");
+ ret = -EINVAL;
+ }
+
+diff --git a/fs/drop_caches.c b/fs/drop_caches.c
+index d31b6c72b476..dc1a1d5d825b 100644
+--- a/fs/drop_caches.c
++++ b/fs/drop_caches.c
+@@ -35,11 +35,11 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
+ spin_unlock(&inode->i_lock);
+ spin_unlock(&sb->s_inode_list_lock);
+
+- cond_resched();
+ invalidate_mapping_pages(inode->i_mapping, 0, -1);
+ iput(toput_inode);
+ toput_inode = inode;
+
++ cond_resched();
+ spin_lock(&sb->s_inode_list_lock);
+ }
+ spin_unlock(&sb->s_inode_list_lock);
+diff --git a/fs/inode.c b/fs/inode.c
+index 5c63693326bb..9c50521c9fe4 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -660,6 +660,7 @@ int invalidate_inodes(struct super_block *sb, bool kill_dirty)
+ struct inode *inode, *next;
+ LIST_HEAD(dispose);
+
++again:
+ spin_lock(&sb->s_inode_list_lock);
+ list_for_each_entry_safe(inode, next, &sb->s_inodes, i_sb_list) {
+ spin_lock(&inode->i_lock);
+@@ -682,6 +683,12 @@ int invalidate_inodes(struct super_block *sb, bool kill_dirty)
+ inode_lru_list_del(inode);
+ spin_unlock(&inode->i_lock);
+ list_add(&inode->i_lru, &dispose);
++ if (need_resched()) {
++ spin_unlock(&sb->s_inode_list_lock);
++ cond_resched();
++ dispose_list(&dispose);
++ goto again;
++ }
+ }
+ spin_unlock(&sb->s_inode_list_lock);
+
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index 170a733454f7..e8ee4263d7b2 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -90,6 +90,7 @@ void fsnotify_unmount_inodes(struct super_block *sb)
+
+ iput_inode = inode;
+
++ cond_resched();
+ spin_lock(&sb->s_inode_list_lock);
+ }
+ spin_unlock(&sb->s_inode_list_lock);
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 154f175066b3..1d1d393f4208 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -980,6 +980,7 @@ static int add_dquot_ref(struct super_block *sb, int type)
+ * later.
+ */
+ old_inode = inode;
++ cond_resched();
+ spin_lock(&sb->s_inode_list_lock);
+ }
+ spin_unlock(&sb->s_inode_list_lock);
+diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
+index 548fd535fd02..d433f5e292c9 100644
+--- a/include/linux/if_ether.h
++++ b/include/linux/if_ether.h
+@@ -28,6 +28,14 @@ static inline struct ethhdr *eth_hdr(const struct sk_buff *skb)
+ return (struct ethhdr *)skb_mac_header(skb);
+ }
+
++/* Prefer this version in TX path, instead of
++ * skb_reset_mac_header() + eth_hdr()
++ */
++static inline struct ethhdr *skb_eth_hdr(const struct sk_buff *skb)
++{
++ return (struct ethhdr *)skb->data;
++}
++
+ static inline struct ethhdr *inner_eth_hdr(const struct sk_buff *skb)
+ {
+ return (struct ethhdr *)skb_inner_mac_header(skb);
+diff --git a/include/uapi/linux/netfilter/xt_sctp.h b/include/uapi/linux/netfilter/xt_sctp.h
+index 4bc6d1a08781..b4d804a9fccb 100644
+--- a/include/uapi/linux/netfilter/xt_sctp.h
++++ b/include/uapi/linux/netfilter/xt_sctp.h
+@@ -41,19 +41,19 @@ struct xt_sctp_info {
+ #define SCTP_CHUNKMAP_SET(chunkmap, type) \
+ do { \
+ (chunkmap)[type / bytes(__u32)] |= \
+- 1 << (type % bytes(__u32)); \
++ 1u << (type % bytes(__u32)); \
+ } while (0)
+
+ #define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
+ do { \
+ (chunkmap)[type / bytes(__u32)] &= \
+- ~(1 << (type % bytes(__u32))); \
++ ~(1u << (type % bytes(__u32))); \
+ } while (0)
+
+ #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
+ ({ \
+ ((chunkmap)[type / bytes (__u32)] & \
+- (1 << (type % bytes (__u32)))) ? 1: 0; \
++ (1u << (type % bytes (__u32)))) ? 1: 0; \
+ })
+
+ #define SCTP_CHUNKMAP_RESET(chunkmap) \
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 1dff5f7323cc..9e72b2f8c3dd 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -4272,6 +4272,7 @@ static bool may_access_skb(enum bpf_prog_type type)
+ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ {
+ struct bpf_reg_state *regs = cur_regs(env);
++ static const int ctx_reg = BPF_REG_6;
+ u8 mode = BPF_MODE(insn->code);
+ int i, err;
+
+@@ -4305,11 +4306,11 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ }
+
+ /* check whether implicit source operand (register R6) is readable */
+- err = check_reg_arg(env, BPF_REG_6, SRC_OP);
++ err = check_reg_arg(env, ctx_reg, SRC_OP);
+ if (err)
+ return err;
+
+- if (regs[BPF_REG_6].type != PTR_TO_CTX) {
++ if (regs[ctx_reg].type != PTR_TO_CTX) {
+ verbose(env,
+ "at the time of BPF_LD_ABS|IND R6 != pointer to skb\n");
+ return -EINVAL;
+@@ -4322,6 +4323,10 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ return err;
+ }
+
++ err = check_ctx_reg(env, ®s[ctx_reg], ctx_reg);
++ if (err < 0)
++ return err;
++
+ /* reset caller saved regs to unreadable */
+ for (i = 0; i < CALLER_SAVED_REGS; i++) {
+ mark_reg_not_init(env, regs, caller_saved[i]);
+diff --git a/kernel/locking/spinlock_debug.c b/kernel/locking/spinlock_debug.c
+index 9aa0fccd5d43..03595c29c566 100644
+--- a/kernel/locking/spinlock_debug.c
++++ b/kernel/locking/spinlock_debug.c
+@@ -51,19 +51,19 @@ EXPORT_SYMBOL(__rwlock_init);
+
+ static void spin_dump(raw_spinlock_t *lock, const char *msg)
+ {
+- struct task_struct *owner = NULL;
++ struct task_struct *owner = READ_ONCE(lock->owner);
+
+- if (lock->owner && lock->owner != SPINLOCK_OWNER_INIT)
+- owner = lock->owner;
++ if (owner == SPINLOCK_OWNER_INIT)
++ owner = NULL;
+ printk(KERN_EMERG "BUG: spinlock %s on CPU#%d, %s/%d\n",
+ msg, raw_smp_processor_id(),
+ current->comm, task_pid_nr(current));
+ printk(KERN_EMERG " lock: %pS, .magic: %08x, .owner: %s/%d, "
+ ".owner_cpu: %d\n",
+- lock, lock->magic,
++ lock, READ_ONCE(lock->magic),
+ owner ? owner->comm : "<none>",
+ owner ? task_pid_nr(owner) : -1,
+- lock->owner_cpu);
++ READ_ONCE(lock->owner_cpu));
+ dump_stack();
+ }
+
+@@ -80,16 +80,16 @@ static void spin_bug(raw_spinlock_t *lock, const char *msg)
+ static inline void
+ debug_spin_lock_before(raw_spinlock_t *lock)
+ {
+- SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic");
+- SPIN_BUG_ON(lock->owner == current, lock, "recursion");
+- SPIN_BUG_ON(lock->owner_cpu == raw_smp_processor_id(),
++ SPIN_BUG_ON(READ_ONCE(lock->magic) != SPINLOCK_MAGIC, lock, "bad magic");
++ SPIN_BUG_ON(READ_ONCE(lock->owner) == current, lock, "recursion");
++ SPIN_BUG_ON(READ_ONCE(lock->owner_cpu) == raw_smp_processor_id(),
+ lock, "cpu recursion");
+ }
+
+ static inline void debug_spin_lock_after(raw_spinlock_t *lock)
+ {
+- lock->owner_cpu = raw_smp_processor_id();
+- lock->owner = current;
++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id());
++ WRITE_ONCE(lock->owner, current);
+ }
+
+ static inline void debug_spin_unlock(raw_spinlock_t *lock)
+@@ -99,8 +99,8 @@ static inline void debug_spin_unlock(raw_spinlock_t *lock)
+ SPIN_BUG_ON(lock->owner != current, lock, "wrong owner");
+ SPIN_BUG_ON(lock->owner_cpu != raw_smp_processor_id(),
+ lock, "wrong CPU");
+- lock->owner = SPINLOCK_OWNER_INIT;
+- lock->owner_cpu = -1;
++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT);
++ WRITE_ONCE(lock->owner_cpu, -1);
+ }
+
+ /*
+@@ -183,8 +183,8 @@ static inline void debug_write_lock_before(rwlock_t *lock)
+
+ static inline void debug_write_lock_after(rwlock_t *lock)
+ {
+- lock->owner_cpu = raw_smp_processor_id();
+- lock->owner = current;
++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id());
++ WRITE_ONCE(lock->owner, current);
+ }
+
+ static inline void debug_write_unlock(rwlock_t *lock)
+@@ -193,8 +193,8 @@ static inline void debug_write_unlock(rwlock_t *lock)
+ RWLOCK_BUG_ON(lock->owner != current, lock, "wrong owner");
+ RWLOCK_BUG_ON(lock->owner_cpu != raw_smp_processor_id(),
+ lock, "wrong CPU");
+- lock->owner = SPINLOCK_OWNER_INIT;
+- lock->owner_cpu = -1;
++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT);
++ WRITE_ONCE(lock->owner_cpu, -1);
+ }
+
+ void do_raw_write_lock(rwlock_t *lock)
+diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
+index 44df1c3df02d..e9cd8ef2a245 100644
+--- a/net/8021q/vlan.h
++++ b/net/8021q/vlan.h
+@@ -114,6 +114,7 @@ int vlan_check_real_dev(struct net_device *real_dev,
+ void vlan_setup(struct net_device *dev);
+ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack);
+ void unregister_vlan_dev(struct net_device *dev, struct list_head *head);
++void vlan_dev_uninit(struct net_device *dev);
+ bool vlan_dev_inherit_address(struct net_device *dev,
+ struct net_device *real_dev);
+
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index fce3b7eebffb..84ef83772114 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -612,7 +612,8 @@ static int vlan_dev_init(struct net_device *dev)
+ return 0;
+ }
+
+-static void vlan_dev_uninit(struct net_device *dev)
++/* Note: this function might be called multiple times for the same device. */
++void vlan_dev_uninit(struct net_device *dev)
+ {
+ struct vlan_priority_tci_mapping *pm;
+ struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
+diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
+index 9b60c1e399e2..74042b9d7f73 100644
+--- a/net/8021q/vlan_netlink.c
++++ b/net/8021q/vlan_netlink.c
+@@ -110,11 +110,13 @@ static int vlan_changelink(struct net_device *dev, struct nlattr *tb[],
+ struct ifla_vlan_flags *flags;
+ struct ifla_vlan_qos_mapping *m;
+ struct nlattr *attr;
+- int rem;
++ int rem, err;
+
+ if (data[IFLA_VLAN_FLAGS]) {
+ flags = nla_data(data[IFLA_VLAN_FLAGS]);
+- vlan_dev_change_flags(dev, flags->flags, flags->mask);
++ err = vlan_dev_change_flags(dev, flags->flags, flags->mask);
++ if (err)
++ return err;
+ }
+ if (data[IFLA_VLAN_INGRESS_QOS]) {
+ nla_for_each_nested(attr, data[IFLA_VLAN_INGRESS_QOS], rem) {
+@@ -125,7 +127,9 @@ static int vlan_changelink(struct net_device *dev, struct nlattr *tb[],
+ if (data[IFLA_VLAN_EGRESS_QOS]) {
+ nla_for_each_nested(attr, data[IFLA_VLAN_EGRESS_QOS], rem) {
+ m = nla_data(attr);
+- vlan_dev_set_egress_priority(dev, m->from, m->to);
++ err = vlan_dev_set_egress_priority(dev, m->from, m->to);
++ if (err)
++ return err;
+ }
+ }
+ return 0;
+@@ -181,10 +185,11 @@ static int vlan_newlink(struct net *src_net, struct net_device *dev,
+ return -EINVAL;
+
+ err = vlan_changelink(dev, tb, data, extack);
+- if (err < 0)
+- return err;
+-
+- return register_vlan_dev(dev, extack);
++ if (!err)
++ err = register_vlan_dev(dev, extack);
++ if (err)
++ vlan_dev_uninit(dev);
++ return err;
+ }
+
+ static inline size_t vlan_qos_map_size(unsigned int n)
+diff --git a/net/core/filter.c b/net/core/filter.c
+index e6fa88506c00..91b950261975 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2007,6 +2007,7 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb)
+ }
+
+ skb->dev = dev;
++ skb->tstamp = 0;
+
+ __this_cpu_inc(xmit_recursion);
+ ret = dev_queue_xmit(skb);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 3a08ee81cbc3..578b65e6e65b 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -1716,8 +1716,11 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
+ }
+
+ /* Ignore very old stuff early */
+- if (!after(sp[used_sacks].end_seq, prior_snd_una))
++ if (!after(sp[used_sacks].end_seq, prior_snd_una)) {
++ if (i == 0)
++ first_sack_index = -1;
+ continue;
++ }
+
+ used_sacks++;
+ }
+diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
+index 204a8351efff..c29170e767a8 100644
+--- a/net/llc/llc_station.c
++++ b/net/llc/llc_station.c
+@@ -32,7 +32,7 @@ static int llc_stat_ev_rx_null_dsap_xid_c(struct sk_buff *skb)
+ return LLC_PDU_IS_CMD(pdu) && /* command PDU */
+ LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */
+ LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_XID &&
+- !pdu->dsap ? 0 : 1; /* NULL DSAP value */
++ !pdu->dsap; /* NULL DSAP value */
+ }
+
+ static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb)
+@@ -42,7 +42,7 @@ static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb)
+ return LLC_PDU_IS_CMD(pdu) && /* command PDU */
+ LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */
+ LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_TEST &&
+- !pdu->dsap ? 0 : 1; /* NULL DSAP */
++ !pdu->dsap; /* NULL DSAP */
+ }
+
+ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 47e5a076522d..7ba9ea55816a 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -3576,6 +3576,9 @@ static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list)
+
+ list_for_each_entry(net, net_exit_list, exit_list)
+ ctnetlink_net_exit(net);
++
++ /* wait for other cpus until they are done with ctnl_notifiers */
++ synchronize_rcu();
+ }
+
+ static struct pernet_operations ctnetlink_net_ops = {
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 0e1b1f7f4745..4711a8b56f32 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4117,8 +4117,10 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ return err;
+
+ err = -EINVAL;
+- if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
++ if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) {
++ nft_data_release(&elem.key.val, desc.type);
+ return err;
++ }
+
+ priv = set->ops->get(ctx->net, set, &elem, flags);
+ if (IS_ERR(priv))
+@@ -4351,14 +4353,20 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ if (nla[NFTA_SET_ELEM_DATA] == NULL &&
+ !(flags & NFT_SET_ELEM_INTERVAL_END))
+ return -EINVAL;
+- if (nla[NFTA_SET_ELEM_DATA] != NULL &&
+- flags & NFT_SET_ELEM_INTERVAL_END)
+- return -EINVAL;
+ } else {
+ if (nla[NFTA_SET_ELEM_DATA] != NULL)
+ return -EINVAL;
+ }
+
++ if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
++ (nla[NFTA_SET_ELEM_DATA] ||
++ nla[NFTA_SET_ELEM_OBJREF] ||
++ nla[NFTA_SET_ELEM_TIMEOUT] ||
++ nla[NFTA_SET_ELEM_EXPIRATION] ||
++ nla[NFTA_SET_ELEM_USERDATA] ||
++ nla[NFTA_SET_ELEM_EXPR]))
++ return -EINVAL;
++
+ timeout = 0;
+ if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
+ if (!(set->flags & NFT_SET_TIMEOUT))
+diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
+index fff8073e2a56..058ee84ea531 100644
+--- a/net/netfilter/nft_bitwise.c
++++ b/net/netfilter/nft_bitwise.c
+@@ -83,7 +83,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
+ tb[NFTA_BITWISE_MASK]);
+ if (err < 0)
+ return err;
+- if (d1.len != priv->len) {
++ if (d1.type != NFT_DATA_VALUE || d1.len != priv->len) {
+ err = -EINVAL;
+ goto err1;
+ }
+@@ -92,7 +92,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
+ tb[NFTA_BITWISE_XOR]);
+ if (err < 0)
+ goto err1;
+- if (d2.len != priv->len) {
++ if (d2.type != NFT_DATA_VALUE || d2.len != priv->len) {
+ err = -EINVAL;
+ goto err2;
+ }
+diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
+index 79d48c1d06f4..7007045c0849 100644
+--- a/net/netfilter/nft_cmp.c
++++ b/net/netfilter/nft_cmp.c
+@@ -82,6 +82,12 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ if (err < 0)
+ return err;
+
++ if (desc.type != NFT_DATA_VALUE) {
++ err = -EINVAL;
++ nft_data_release(&priv->data, desc.type);
++ return err;
++ }
++
+ priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
+ err = nft_validate_register_load(priv->sreg, desc.len);
+ if (err < 0)
+diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
+index cedb96c3619f..2e1d2ec2f52a 100644
+--- a/net/netfilter/nft_range.c
++++ b/net/netfilter/nft_range.c
+@@ -70,11 +70,21 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr
+ if (err < 0)
+ return err;
+
++ if (desc_from.type != NFT_DATA_VALUE) {
++ err = -EINVAL;
++ goto err1;
++ }
++
+ err = nft_data_init(NULL, &priv->data_to, sizeof(priv->data_to),
+ &desc_to, tb[NFTA_RANGE_TO_DATA]);
+ if (err < 0)
+ goto err1;
+
++ if (desc_to.type != NFT_DATA_VALUE) {
++ err = -EINVAL;
++ goto err2;
++ }
++
+ if (desc_from.len != desc_to.len) {
+ err = -EINVAL;
+ goto err2;
+diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
+index b3e75f9cb686..0221510328d4 100644
+--- a/net/netfilter/nft_set_rbtree.c
++++ b/net/netfilter/nft_set_rbtree.c
+@@ -77,8 +77,13 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set
+ parent = rcu_dereference_raw(parent->rb_left);
+ continue;
+ }
+- if (nft_rbtree_interval_end(rbe))
+- goto out;
++ if (nft_rbtree_interval_end(rbe)) {
++ if (nft_set_is_anonymous(set))
++ return false;
++ parent = rcu_dereference_raw(parent->rb_left);
++ interval = NULL;
++ continue;
++ }
+
+ *ext = &rbe->ext;
+ return true;
+@@ -91,7 +96,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set
+ *ext = &interval->ext;
+ return true;
+ }
+-out:
++
+ return false;
+ }
+
+@@ -139,8 +144,10 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set,
+ } else if (d > 0) {
+ parent = rcu_dereference_raw(parent->rb_right);
+ } else {
+- if (!nft_set_elem_active(&rbe->ext, genmask))
++ if (!nft_set_elem_active(&rbe->ext, genmask)) {
+ parent = rcu_dereference_raw(parent->rb_left);
++ continue;
++ }
+
+ if (!nft_set_ext_exists(&rbe->ext, NFT_SET_EXT_FLAGS) ||
+ (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END) ==
+@@ -148,7 +155,11 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set,
+ *elem = rbe;
+ return true;
+ }
+- return false;
++
++ if (nft_rbtree_interval_end(rbe))
++ interval = NULL;
++
++ parent = rcu_dereference_raw(parent->rb_left);
+ }
+ }
+
+diff --git a/net/rfkill/core.c b/net/rfkill/core.c
+index 7fbc8314f626..d6467cbf5c4f 100644
+--- a/net/rfkill/core.c
++++ b/net/rfkill/core.c
+@@ -1014,10 +1014,13 @@ static void rfkill_sync_work(struct work_struct *work)
+ int __must_check rfkill_register(struct rfkill *rfkill)
+ {
+ static unsigned long rfkill_no;
+- struct device *dev = &rfkill->dev;
++ struct device *dev;
+ int error;
+
+- BUG_ON(!rfkill);
++ if (!rfkill)
++ return -EINVAL;
++
++ dev = &rfkill->dev;
+
+ mutex_lock(&rfkill_global_mutex);
+
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index e4cf72b0675e..824e3c37e5dd 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -1758,7 +1758,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ q->avg_window_begin));
+ u64 b = q->avg_window_bytes * (u64)NSEC_PER_SEC;
+
+- do_div(b, window_interval);
++ b = div64_u64(b, window_interval);
+ q->avg_peak_bandwidth =
+ cake_ewma(q->avg_peak_bandwidth, b,
+ b > q->avg_peak_bandwidth ? 2 : 8);
+diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
+index 4808713c73b9..1ee2b77f607b 100644
+--- a/net/sched/sch_fq.c
++++ b/net/sched/sch_fq.c
+@@ -735,10 +735,12 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt,
+ if (tb[TCA_FQ_QUANTUM]) {
+ u32 quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]);
+
+- if (quantum > 0)
++ if (quantum > 0 && quantum <= (1 << 20)) {
+ q->quantum = quantum;
+- else
++ } else {
++ NL_SET_ERR_MSG_MOD(extack, "invalid quantum");
+ err = -EINVAL;
++ }
+ }
+
+ if (tb[TCA_FQ_INITIAL_QUANTUM])
+diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
+index 5672abede0cc..1cbbd8c31405 100644
+--- a/net/sched/sch_prio.c
++++ b/net/sched/sch_prio.c
+@@ -314,8 +314,14 @@ static int prio_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+ bool any_qdisc_is_offloaded;
+ int err;
+
+- if (new == NULL)
+- new = &noop_qdisc;
++ if (!new) {
++ new = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
++ TC_H_MAKE(sch->handle, arg), extack);
++ if (!new)
++ new = &noop_qdisc;
++ else
++ qdisc_hash_add(new, true);
++ }
+
+ *old = qdisc_replace(sch, new, &q->queues[band]);
+
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index de8a82bc6b42..0234a64b3b19 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -1373,8 +1373,10 @@ static int sctp_cmd_interpreter(enum sctp_event event_type,
+ /* Generate an INIT ACK chunk. */
+ new_obj = sctp_make_init_ack(asoc, chunk, GFP_ATOMIC,
+ 0);
+- if (!new_obj)
+- goto nomem;
++ if (!new_obj) {
++ error = -ENOMEM;
++ break;
++ }
+
+ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
+ SCTP_CHUNK(new_obj));
+@@ -1396,7 +1398,8 @@ static int sctp_cmd_interpreter(enum sctp_event event_type,
+ if (!new_obj) {
+ if (cmd->obj.chunk)
+ sctp_chunk_free(cmd->obj.chunk);
+- goto nomem;
++ error = -ENOMEM;
++ break;
+ }
+ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
+ SCTP_CHUNK(new_obj));
+@@ -1443,8 +1446,10 @@ static int sctp_cmd_interpreter(enum sctp_event event_type,
+
+ /* Generate a SHUTDOWN chunk. */
+ new_obj = sctp_make_shutdown(asoc, chunk);
+- if (!new_obj)
+- goto nomem;
++ if (!new_obj) {
++ error = -ENOMEM;
++ break;
++ }
+ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
+ SCTP_CHUNK(new_obj));
+ break;
+@@ -1780,11 +1785,17 @@ static int sctp_cmd_interpreter(enum sctp_event event_type,
+ break;
+ }
+
+- if (error)
++ if (error) {
++ cmd = sctp_next_cmd(commands);
++ while (cmd) {
++ if (cmd->verb == SCTP_CMD_REPLY)
++ sctp_chunk_free(cmd->obj.chunk);
++ cmd = sctp_next_cmd(commands);
++ }
+ break;
++ }
+ }
+
+-out:
+ /* If this is in response to a received chunk, wait until
+ * we are done with the packet to open the queue so that we don't
+ * send multiple packets in response to a single request.
+@@ -1799,7 +1810,4 @@ out:
+ sp->data_ready_signalled = 0;
+
+ return error;
+-nomem:
+- error = -ENOMEM;
+- goto out;
+ }
+diff --git a/samples/bpf/syscall_tp_kern.c b/samples/bpf/syscall_tp_kern.c
+index 9149c524d279..8833aacb9c8c 100644
+--- a/samples/bpf/syscall_tp_kern.c
++++ b/samples/bpf/syscall_tp_kern.c
+@@ -50,13 +50,27 @@ static __always_inline void count(void *map)
+ SEC("tracepoint/syscalls/sys_enter_open")
+ int trace_enter_open(struct syscalls_enter_open_args *ctx)
+ {
+- count((void *)&enter_open_map);
++ count(&enter_open_map);
++ return 0;
++}
++
++SEC("tracepoint/syscalls/sys_enter_openat")
++int trace_enter_open_at(struct syscalls_enter_open_args *ctx)
++{
++ count(&enter_open_map);
+ return 0;
+ }
+
+ SEC("tracepoint/syscalls/sys_exit_open")
+ int trace_enter_exit(struct syscalls_exit_open_args *ctx)
+ {
+- count((void *)&exit_open_map);
++ count(&exit_open_map);
++ return 0;
++}
++
++SEC("tracepoint/syscalls/sys_exit_openat")
++int trace_enter_exit_at(struct syscalls_exit_open_args *ctx)
++{
++ count(&exit_open_map);
+ return 0;
+ }
+diff --git a/samples/bpf/trace_event_user.c b/samples/bpf/trace_event_user.c
+index d08046ab81f0..d33022447d6b 100644
+--- a/samples/bpf/trace_event_user.c
++++ b/samples/bpf/trace_event_user.c
+@@ -35,9 +35,9 @@ static void print_ksym(__u64 addr)
+ return;
+ sym = ksym_search(addr);
+ printf("%s;", sym->name);
+- if (!strcmp(sym->name, "sys_read"))
++ if (!strstr(sym->name, "sys_read"))
+ sys_read_seen = true;
+- else if (!strcmp(sym->name, "sys_write"))
++ else if (!strstr(sym->name, "sys_write"))
+ sys_write_seen = true;
+ }
+
+diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c
+index e1a39e90841d..7e38070ee523 100644
+--- a/scripts/kconfig/expr.c
++++ b/scripts/kconfig/expr.c
+@@ -252,6 +252,13 @@ static int expr_eq(struct expr *e1, struct expr *e2)
+ {
+ int res, old_count;
+
++ /*
++ * A NULL expr is taken to be yes, but there's also a different way to
++ * represent yes. expr_is_yes() checks for either representation.
++ */
++ if (!e1 || !e2)
++ return expr_is_yes(e1) && expr_is_yes(e2);
++
+ if (e1->type != e2->type)
+ return 0;
+ switch (e1->type) {
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index c3b28b2f4b10..89b6e187ac23 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -2121,10 +2121,8 @@ static void max98090_pll_det_disable_work(struct work_struct *work)
+ M98090_IULK_MASK, 0);
+ }
+
+-static void max98090_pll_work(struct work_struct *work)
++static void max98090_pll_work(struct max98090_priv *max98090)
+ {
+- struct max98090_priv *max98090 =
+- container_of(work, struct max98090_priv, pll_work);
+ struct snd_soc_component *component = max98090->component;
+
+ if (!snd_soc_component_is_active(component))
+@@ -2277,7 +2275,7 @@ static irqreturn_t max98090_interrupt(int irq, void *data)
+
+ if (active & M98090_ULK_MASK) {
+ dev_dbg(component->dev, "M98090_ULK_MASK\n");
+- schedule_work(&max98090->pll_work);
++ max98090_pll_work(max98090);
+ }
+
+ if (active & M98090_JDET_MASK) {
+@@ -2440,7 +2438,6 @@ static int max98090_probe(struct snd_soc_component *component)
+ max98090_pll_det_enable_work);
+ INIT_WORK(&max98090->pll_det_disable_work,
+ max98090_pll_det_disable_work);
+- INIT_WORK(&max98090->pll_work, max98090_pll_work);
+
+ /* Enable jack detection */
+ snd_soc_component_write(component, M98090_REG_JACK_DETECT,
+@@ -2493,7 +2490,6 @@ static void max98090_remove(struct snd_soc_component *component)
+ cancel_delayed_work_sync(&max98090->jack_work);
+ cancel_delayed_work_sync(&max98090->pll_det_enable_work);
+ cancel_work_sync(&max98090->pll_det_disable_work);
+- cancel_work_sync(&max98090->pll_work);
+ max98090->component = NULL;
+ }
+
+diff --git a/sound/soc/codecs/max98090.h b/sound/soc/codecs/max98090.h
+index b1572a2d19da..388d2f74674b 100644
+--- a/sound/soc/codecs/max98090.h
++++ b/sound/soc/codecs/max98090.h
+@@ -1533,7 +1533,6 @@ struct max98090_priv {
+ struct delayed_work jack_work;
+ struct delayed_work pll_det_enable_work;
+ struct work_struct pll_det_disable_work;
+- struct work_struct pll_work;
+ struct snd_soc_jack *jack;
+ unsigned int dai_fmt;
+ int tdm_slots;
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index efd8910b1ff7..dde015fd70a4 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -2792,7 +2792,7 @@ static int fll_factors(struct _fll_div *fll_div, unsigned int Fref,
+
+ if (target % Fref == 0) {
+ fll_div->theta = 0;
+- fll_div->lambda = 0;
++ fll_div->lambda = 1;
+ } else {
+ gcd_fll = gcd(target, fratio * Fref);
+
+@@ -2862,7 +2862,7 @@ static int wm8962_set_fll(struct snd_soc_component *component, int fll_id, int s
+ return -EINVAL;
+ }
+
+- if (fll_div.theta || fll_div.lambda)
++ if (fll_div.theta)
+ fll1 |= WM8962_FLL_FRAC;
+
+ /* Stop the FLL while we reconfigure */
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 6acd5dd599dc..e58240e18b30 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -677,13 +677,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_MCLK_EN),
+ },
+ {
++ /* Teclast X89 */
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"),
+ DMI_MATCH(DMI_BOARD_NAME, "tPAD"),
+ },
+ .driver_data = (void *)(BYT_RT5640_IN3_MAP |
+- BYT_RT5640_MCLK_EN |
+- BYT_RT5640_SSP0_AIF1),
++ BYT_RT5640_JD_SRC_JD1_IN4P |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_1P0 |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
+ },
+ { /* Toshiba Satellite Click Mini L9W-B */
+ .matches = {
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 88a7e860b175..069f38fbf07b 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1890,6 +1890,7 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg,
+ int count = hdr->count;
+ int i;
+ bool abi_match;
++ int ret;
+
+ if (tplg->pass != SOC_TPLG_PASS_PCM_DAI)
+ return 0;
+@@ -1926,7 +1927,12 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg,
+ }
+
+ /* create the FE DAIs and DAI links */
+- soc_tplg_pcm_create(tplg, _pcm);
++ ret = soc_tplg_pcm_create(tplg, _pcm);
++ if (ret < 0) {
++ if (!abi_match)
++ kfree(_pcm);
++ return ret;
++ }
+
+ /* offset by version-specific struct size and
+ * real priv data size
+diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
+index bca0c9e5452c..05f8a0f27121 100644
+--- a/tools/lib/traceevent/Makefile
++++ b/tools/lib/traceevent/Makefile
+@@ -115,6 +115,7 @@ EVENT_PARSE_VERSION = $(EP_VERSION).$(EP_PATCHLEVEL).$(EP_EXTRAVERSION)
+
+ LIB_TARGET = libtraceevent.a libtraceevent.so.$(EVENT_PARSE_VERSION)
+ LIB_INSTALL = libtraceevent.a libtraceevent.so*
++LIB_INSTALL := $(addprefix $(OUTPUT),$(LIB_INSTALL))
+
+ INCLUDES = -I. -I $(srctree)/tools/include $(CONFIG_INCLUDES)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
+index ce361b9d62cf..da298f191086 100644
+--- a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
++++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
+@@ -25,9 +25,9 @@ while read i; do
+ test $N -eq 256 && break
+ done
+
+-L=`wc -l kprobe_events`
+-if [ $L -ne $N ]; then
+- echo "The number of kprobes events ($L) is not $N"
++L=`cat kprobe_events | wc -l`
++if [ $L -ne 256 ]; then
++ echo "The number of kprobes events ($L) is not 256"
+ exit_fail
+ fi
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-01-14 22:30 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-01-14 22:30 UTC (permalink / raw
To: gentoo-commits
commit: 77e9fc831971cce0cf2803f374eec3b66e2a9d8c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jan 14 22:30:40 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jan 14 22:30:40 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=77e9fc83
Linux patch 4.19.96
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1095_linux-4.19.96.patch | 1484 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1488 insertions(+)
diff --git a/0000_README b/0000_README
index ca89dab..b06ab83 100644
--- a/0000_README
+++ b/0000_README
@@ -419,6 +419,10 @@ Patch: 1094_linux-4.19.95.patch
From: https://www.kernel.org
Desc: Linux 4.19.95
+Patch: 1095_linux-4.19.96.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.96
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1095_linux-4.19.96.patch b/1095_linux-4.19.96.patch
new file mode 100644
index 0000000..5ffd663
--- /dev/null
+++ b/1095_linux-4.19.96.patch
@@ -0,0 +1,1484 @@
+diff --git a/Makefile b/Makefile
+index 386ab98e2f58..3b836cc8b22d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 95
++SUBLEVEL = 96
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 8edbb3f0c101..d872dc82725e 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -24,11 +24,19 @@
+
+ #include "gpiolib.h"
+
++#define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l
++#define QUIRK_NO_WAKEUP 0x02l
++
+ static int run_edge_events_on_boot = -1;
+ module_param(run_edge_events_on_boot, int, 0444);
+ MODULE_PARM_DESC(run_edge_events_on_boot,
+ "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto");
+
++static int honor_wakeup = -1;
++module_param(honor_wakeup, int, 0444);
++MODULE_PARM_DESC(honor_wakeup,
++ "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto");
++
+ /**
+ * struct acpi_gpio_event - ACPI GPIO event handler data
+ *
+@@ -278,7 +286,7 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares,
+ event->handle = evt_handle;
+ event->handler = handler;
+ event->irq = irq;
+- event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE;
++ event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE;
+ event->pin = pin;
+ event->desc = desc;
+
+@@ -1263,7 +1271,7 @@ static int acpi_gpio_handle_deferred_request_irqs(void)
+ /* We must use _sync so that this runs after the first deferred_probe run */
+ late_initcall_sync(acpi_gpio_handle_deferred_request_irqs);
+
+-static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = {
++static const struct dmi_system_id gpiolib_acpi_quirks[] = {
+ {
+ /*
+ * The Minix Neo Z83-4 has a micro-USB-B id-pin handler for
+@@ -1273,7 +1281,8 @@ static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "MINIX"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"),
+- }
++ },
++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT,
+ },
+ {
+ /*
+@@ -1285,20 +1294,52 @@ static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"),
+- }
++ },
++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT,
++ },
++ {
++ /*
++ * Various HP X2 10 Cherry Trail models use an external
++ * embedded-controller connected via I2C + an ACPI GPIO
++ * event handler. The embedded controller generates various
++ * spurious wakeup events when suspended. So disable wakeup
++ * for its handler (it uses the only ACPI GPIO event handler).
++ * This breaks wakeup when opening the lid, the user needs
++ * to press the power-button to wakeup the system. The
++ * alternative is suspend simply not working, which is worse.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"),
++ },
++ .driver_data = (void *)QUIRK_NO_WAKEUP,
+ },
+ {} /* Terminating entry */
+ };
+
+ static int acpi_gpio_setup_params(void)
+ {
++ const struct dmi_system_id *id;
++ long quirks = 0;
++
++ id = dmi_first_match(gpiolib_acpi_quirks);
++ if (id)
++ quirks = (long)id->driver_data;
++
+ if (run_edge_events_on_boot < 0) {
+- if (dmi_check_system(run_edge_events_on_boot_blacklist))
++ if (quirks & QUIRK_NO_EDGE_EVENTS_ON_BOOT)
+ run_edge_events_on_boot = 0;
+ else
+ run_edge_events_on_boot = 1;
+ }
+
++ if (honor_wakeup < 0) {
++ if (quirks & QUIRK_NO_WAKEUP)
++ honor_wakeup = 0;
++ else
++ honor_wakeup = 1;
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 77347a258f6c..4d7715845306 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -274,7 +274,7 @@ static void drm_dp_encode_sideband_req(struct drm_dp_sideband_msg_req_body *req,
+ memcpy(&buf[idx], req->u.i2c_read.transactions[i].bytes, req->u.i2c_read.transactions[i].num_bytes);
+ idx += req->u.i2c_read.transactions[i].num_bytes;
+
+- buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 5;
++ buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 4;
+ buf[idx] |= (req->u.i2c_read.transactions[i].i2c_transaction_delay & 0xf);
+ idx++;
+ }
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 8b546fde139d..f57fc1450b61 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1702,7 +1702,7 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
+ * Changes struct fb_var_screeninfo are currently not pushed back
+ * to KMS, hence fail if different settings are requested.
+ */
+- if (var->bits_per_pixel != fb->format->cpp[0] * 8 ||
++ if (var->bits_per_pixel > fb->format->cpp[0] * 8 ||
+ var->xres > fb->width || var->yres > fb->height ||
+ var->xres_virtual > fb->width || var->yres_virtual > fb->height) {
+ DRM_DEBUG("fb requested width/height/bpp can't fit in current fb "
+@@ -1727,6 +1727,11 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
+ drm_fb_helper_fill_pixel_fmt(var, fb->format->depth);
+ }
+
++ /*
++ * Likewise, bits_per_pixel should be rounded up to a supported value.
++ */
++ var->bits_per_pixel = fb->format->cpp[0] * 8;
++
+ /*
+ * drm fbdev emulation doesn't support changing the pixel format at all,
+ * so reject all pixel format changing requests.
+diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
+index 6937ef0b4bfc..13e97faabaa7 100644
+--- a/drivers/gpu/drm/i915/intel_lrc.c
++++ b/drivers/gpu/drm/i915/intel_lrc.c
+@@ -1562,6 +1562,15 @@ static u32 *gen9_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch)
+ /* WaFlushCoherentL3CacheLinesAtContextSwitch:skl,bxt,glk */
+ batch = gen8_emit_flush_coherentl3_wa(engine, batch);
+
++ /* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */
++ batch = gen8_emit_pipe_control(batch,
++ PIPE_CONTROL_FLUSH_L3 |
++ PIPE_CONTROL_GLOBAL_GTT_IVB |
++ PIPE_CONTROL_CS_STALL |
++ PIPE_CONTROL_QW_WRITE,
++ i915_ggtt_offset(engine->scratch) +
++ 2 * CACHELINE_BYTES);
++
+ batch = emit_lri(batch, lri, ARRAY_SIZE(lri));
+
+ /* WaClearSlmSpaceAtContextSwitch:kbl */
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+index fda1ae12069a..113c032a2720 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -423,7 +423,7 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon,
+
+ WARN_ON(!tcon->quirks->has_channel_0);
+
+- tcon->dclk_min_div = 1;
++ tcon->dclk_min_div = tcon->quirks->dclk_min_div;
+ tcon->dclk_max_div = 127;
+ sun4i_tcon0_mode_set_common(tcon, mode);
+
+@@ -1249,12 +1249,14 @@ static int sun6i_tcon_set_mux(struct sun4i_tcon *tcon,
+ static const struct sun4i_tcon_quirks sun4i_a10_quirks = {
+ .has_channel_0 = true,
+ .has_channel_1 = true,
++ .dclk_min_div = 4,
+ .set_mux = sun4i_a10_tcon_set_mux,
+ };
+
+ static const struct sun4i_tcon_quirks sun5i_a13_quirks = {
+ .has_channel_0 = true,
+ .has_channel_1 = true,
++ .dclk_min_div = 4,
+ .set_mux = sun5i_a13_tcon_set_mux,
+ };
+
+@@ -1263,6 +1265,7 @@ static const struct sun4i_tcon_quirks sun6i_a31_quirks = {
+ .has_channel_1 = true,
+ .has_lvds_alt = true,
+ .needs_de_be_mux = true,
++ .dclk_min_div = 1,
+ .set_mux = sun6i_tcon_set_mux,
+ };
+
+@@ -1270,11 +1273,13 @@ static const struct sun4i_tcon_quirks sun6i_a31s_quirks = {
+ .has_channel_0 = true,
+ .has_channel_1 = true,
+ .needs_de_be_mux = true,
++ .dclk_min_div = 1,
+ };
+
+ static const struct sun4i_tcon_quirks sun7i_a20_quirks = {
+ .has_channel_0 = true,
+ .has_channel_1 = true,
++ .dclk_min_div = 4,
+ /* Same display pipeline structure as A10 */
+ .set_mux = sun4i_a10_tcon_set_mux,
+ };
+@@ -1282,11 +1287,13 @@ static const struct sun4i_tcon_quirks sun7i_a20_quirks = {
+ static const struct sun4i_tcon_quirks sun8i_a33_quirks = {
+ .has_channel_0 = true,
+ .has_lvds_alt = true,
++ .dclk_min_div = 1,
+ };
+
+ static const struct sun4i_tcon_quirks sun8i_a83t_lcd_quirks = {
+ .supports_lvds = true,
+ .has_channel_0 = true,
++ .dclk_min_div = 1,
+ };
+
+ static const struct sun4i_tcon_quirks sun8i_a83t_tv_quirks = {
+@@ -1295,11 +1302,13 @@ static const struct sun4i_tcon_quirks sun8i_a83t_tv_quirks = {
+
+ static const struct sun4i_tcon_quirks sun8i_v3s_quirks = {
+ .has_channel_0 = true,
++ .dclk_min_div = 1,
+ };
+
+ static const struct sun4i_tcon_quirks sun9i_a80_tcon_lcd_quirks = {
+- .has_channel_0 = true,
+- .needs_edp_reset = true,
++ .has_channel_0 = true,
++ .needs_edp_reset = true,
++ .dclk_min_div = 1,
+ };
+
+ static const struct sun4i_tcon_quirks sun9i_a80_tcon_tv_quirks = {
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h
+index f6a071cd5a6f..e05db6b19453 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h
+@@ -224,6 +224,7 @@ struct sun4i_tcon_quirks {
+ bool needs_de_be_mux; /* sun6i needs mux to select backend */
+ bool needs_edp_reset; /* a80 edp reset needed for tcon0 access */
+ bool supports_lvds; /* Does the TCON support an LVDS output? */
++ u8 dclk_min_div; /* minimum divider for TCON0 DCLK */
+
+ /* callback to handle tcon muxing options */
+ int (*set_mux)(struct sun4i_tcon *, const struct drm_encoder *);
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 3a359716fb38..e723156057a6 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -288,6 +288,12 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
+ offset = report->size;
+ report->size += parser->global.report_size * parser->global.report_count;
+
++ /* Total size check: Allow for possible report index byte */
++ if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) {
++ hid_err(parser->device, "report is too long\n");
++ return -1;
++ }
++
+ if (!parser->local.usage_index) /* Ignore padding fields */
+ return 0;
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 01bed2f6862e..dbb0cbe65fc9 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -1125,9 +1125,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ }
+
+ mapped:
+- if (device->driver->input_mapped && device->driver->input_mapped(device,
+- hidinput, field, usage, &bit, &max) < 0)
+- goto ignore;
++ if (device->driver->input_mapped &&
++ device->driver->input_mapped(device, hidinput, field, usage,
++ &bit, &max) < 0) {
++ /*
++ * The driver indicated that no further generic handling
++ * of the usage is desired.
++ */
++ return;
++ }
+
+ set_bit(usage->type, input->evbit);
+
+@@ -1208,9 +1214,11 @@ mapped:
+ set_bit(MSC_SCAN, input->mscbit);
+ }
+
+-ignore:
+ return;
+
++ignore:
++ usage->type = 0;
++ usage->code = 0;
+ }
+
+ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value)
+diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
+index 840634e0f1e3..8508dbac2657 100644
+--- a/drivers/hid/uhid.c
++++ b/drivers/hid/uhid.c
+@@ -775,7 +775,7 @@ static __poll_t uhid_char_poll(struct file *file, poll_table *wait)
+ if (uhid->head != uhid->tail)
+ return EPOLLIN | EPOLLRDNORM;
+
+- return 0;
++ return EPOLLOUT | EPOLLWRNORM;
+ }
+
+ static const struct file_operations uhid_fops = {
+diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
+index 5a949ca42b1d..da000195b79a 100644
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -254,12 +254,51 @@ static int hiddev_release(struct inode * inode, struct file * file)
+ return 0;
+ }
+
++static int __hiddev_open(struct hiddev *hiddev, struct file *file)
++{
++ struct hiddev_list *list;
++ int error;
++
++ lockdep_assert_held(&hiddev->existancelock);
++
++ list = vzalloc(sizeof(*list));
++ if (!list)
++ return -ENOMEM;
++
++ mutex_init(&list->thread_lock);
++ list->hiddev = hiddev;
++
++ if (!hiddev->open++) {
++ error = hid_hw_power(hiddev->hid, PM_HINT_FULLON);
++ if (error < 0)
++ goto err_drop_count;
++
++ error = hid_hw_open(hiddev->hid);
++ if (error < 0)
++ goto err_normal_power;
++ }
++
++ spin_lock_irq(&hiddev->list_lock);
++ list_add_tail(&list->node, &hiddev->list);
++ spin_unlock_irq(&hiddev->list_lock);
++
++ file->private_data = list;
++
++ return 0;
++
++err_normal_power:
++ hid_hw_power(hiddev->hid, PM_HINT_NORMAL);
++err_drop_count:
++ hiddev->open--;
++ vfree(list);
++ return error;
++}
++
+ /*
+ * open file op
+ */
+ static int hiddev_open(struct inode *inode, struct file *file)
+ {
+- struct hiddev_list *list;
+ struct usb_interface *intf;
+ struct hid_device *hid;
+ struct hiddev *hiddev;
+@@ -268,66 +307,14 @@ static int hiddev_open(struct inode *inode, struct file *file)
+ intf = usbhid_find_interface(iminor(inode));
+ if (!intf)
+ return -ENODEV;
++
+ hid = usb_get_intfdata(intf);
+ hiddev = hid->hiddev;
+
+- if (!(list = vzalloc(sizeof(struct hiddev_list))))
+- return -ENOMEM;
+- mutex_init(&list->thread_lock);
+- list->hiddev = hiddev;
+- file->private_data = list;
+-
+- /*
+- * no need for locking because the USB major number
+- * is shared which usbcore guards against disconnect
+- */
+- if (list->hiddev->exist) {
+- if (!list->hiddev->open++) {
+- res = hid_hw_open(hiddev->hid);
+- if (res < 0)
+- goto bail;
+- }
+- } else {
+- res = -ENODEV;
+- goto bail;
+- }
+-
+- spin_lock_irq(&list->hiddev->list_lock);
+- list_add_tail(&list->node, &hiddev->list);
+- spin_unlock_irq(&list->hiddev->list_lock);
+-
+ mutex_lock(&hiddev->existancelock);
+- /*
+- * recheck exist with existance lock held to
+- * avoid opening a disconnected device
+- */
+- if (!list->hiddev->exist) {
+- res = -ENODEV;
+- goto bail_unlock;
+- }
+- if (!list->hiddev->open++)
+- if (list->hiddev->exist) {
+- struct hid_device *hid = hiddev->hid;
+- res = hid_hw_power(hid, PM_HINT_FULLON);
+- if (res < 0)
+- goto bail_unlock;
+- res = hid_hw_open(hid);
+- if (res < 0)
+- goto bail_normal_power;
+- }
+- mutex_unlock(&hiddev->existancelock);
+- return 0;
+-bail_normal_power:
+- hid_hw_power(hid, PM_HINT_NORMAL);
+-bail_unlock:
++ res = hiddev->exist ? __hiddev_open(hiddev, file) : -ENODEV;
+ mutex_unlock(&hiddev->existancelock);
+
+- spin_lock_irq(&list->hiddev->list_lock);
+- list_del(&list->node);
+- spin_unlock_irq(&list->hiddev->list_lock);
+-bail:
+- file->private_data = NULL;
+- vfree(list);
+ return res;
+ }
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 1de10e5c70d7..f225bef1e043 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -194,10 +194,11 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap)
+ * If we can set SDA, we will always create a STOP to ensure additional
+ * pulses will do no harm. This is achieved by letting SDA follow SCL
+ * half a cycle later. Check the 'incomplete_write_byte' fault injector
+- * for details.
++ * for details. Note that we must honour tsu:sto, 4us, but lets use 5us
++ * here for simplicity.
+ */
+ bri->set_scl(adap, scl);
+- ndelay(RECOVERY_NDELAY / 2);
++ ndelay(RECOVERY_NDELAY);
+ if (bri->set_sda)
+ bri->set_sda(adap, scl);
+ ndelay(RECOVERY_NDELAY / 2);
+@@ -219,7 +220,13 @@ int i2c_generic_scl_recovery(struct i2c_adapter *adap)
+ scl = !scl;
+ bri->set_scl(adap, scl);
+ /* Creating STOP again, see above */
+- ndelay(RECOVERY_NDELAY / 2);
++ if (scl) {
++ /* Honour minimum tsu:sto */
++ ndelay(RECOVERY_NDELAY);
++ } else {
++ /* Honour minimum tf and thd:dat */
++ ndelay(RECOVERY_NDELAY / 2);
++ }
+ if (bri->set_sda)
+ bri->set_sda(adap, scl);
+ ndelay(RECOVERY_NDELAY / 2);
+diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
+index f48369d6f3a0..4263e905cafb 100644
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -241,13 +241,13 @@ static void __pass_event(struct evdev_client *client,
+ */
+ client->tail = (client->head - 2) & (client->bufsize - 1);
+
+- client->buffer[client->tail].input_event_sec =
+- event->input_event_sec;
+- client->buffer[client->tail].input_event_usec =
+- event->input_event_usec;
+- client->buffer[client->tail].type = EV_SYN;
+- client->buffer[client->tail].code = SYN_DROPPED;
+- client->buffer[client->tail].value = 0;
++ client->buffer[client->tail] = (struct input_event) {
++ .input_event_sec = event->input_event_sec,
++ .input_event_usec = event->input_event_usec,
++ .type = EV_SYN,
++ .code = SYN_DROPPED,
++ .value = 0,
++ };
+
+ client->packet_head = client->tail;
+ }
+diff --git a/drivers/input/input.c b/drivers/input/input.c
+index 3304aaaffe87..a0d90022fcf7 100644
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -858,16 +858,18 @@ static int input_default_setkeycode(struct input_dev *dev,
+ }
+ }
+
+- __clear_bit(*old_keycode, dev->keybit);
+- __set_bit(ke->keycode, dev->keybit);
+-
+- for (i = 0; i < dev->keycodemax; i++) {
+- if (input_fetch_keycode(dev, i) == *old_keycode) {
+- __set_bit(*old_keycode, dev->keybit);
+- break; /* Setting the bit twice is useless, so break */
++ if (*old_keycode <= KEY_MAX) {
++ __clear_bit(*old_keycode, dev->keybit);
++ for (i = 0; i < dev->keycodemax; i++) {
++ if (input_fetch_keycode(dev, i) == *old_keycode) {
++ __set_bit(*old_keycode, dev->keybit);
++ /* Setting the bit twice is useless, so break */
++ break;
++ }
+ }
+ }
+
++ __set_bit(ke->keycode, dev->keybit);
+ return 0;
+ }
+
+@@ -923,9 +925,13 @@ int input_set_keycode(struct input_dev *dev,
+ * Simulate keyup event if keycode is not present
+ * in the keymap anymore
+ */
+- if (test_bit(EV_KEY, dev->evbit) &&
+- !is_event_supported(old_keycode, dev->keybit, KEY_MAX) &&
+- __test_and_clear_bit(old_keycode, dev->key)) {
++ if (old_keycode > KEY_MAX) {
++ dev_warn(dev->dev.parent ?: &dev->dev,
++ "%s: got too big old keycode %#x\n",
++ __func__, old_keycode);
++ } else if (test_bit(EV_KEY, dev->evbit) &&
++ !is_event_supported(old_keycode, dev->keybit, KEY_MAX) &&
++ __test_and_clear_bit(old_keycode, dev->key)) {
+ struct input_value vals[] = {
+ { EV_KEY, old_keycode, 0 },
+ input_value_sync
+diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
+index 83d1499fe021..e746920872a4 100644
+--- a/drivers/input/misc/uinput.c
++++ b/drivers/input/misc/uinput.c
+@@ -87,12 +87,16 @@ static int uinput_dev_event(struct input_dev *dev,
+ struct uinput_device *udev = input_get_drvdata(dev);
+ struct timespec64 ts;
+
+- udev->buff[udev->head].type = type;
+- udev->buff[udev->head].code = code;
+- udev->buff[udev->head].value = value;
+ ktime_get_ts64(&ts);
+- udev->buff[udev->head].input_event_sec = ts.tv_sec;
+- udev->buff[udev->head].input_event_usec = ts.tv_nsec / NSEC_PER_USEC;
++
++ udev->buff[udev->head] = (struct input_event) {
++ .input_event_sec = ts.tv_sec,
++ .input_event_usec = ts.tv_nsec / NSEC_PER_USEC,
++ .type = type,
++ .code = code,
++ .value = value,
++ };
++
+ udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
+
+ wake_up_interruptible(&udev->waitq);
+diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c
+index acb708fc1463..0a7d818a06f3 100644
+--- a/drivers/net/can/mscan/mscan.c
++++ b/drivers/net/can/mscan/mscan.c
+@@ -392,13 +392,12 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota)
+ struct net_device *dev = napi->dev;
+ struct mscan_regs __iomem *regs = priv->reg_base;
+ struct net_device_stats *stats = &dev->stats;
+- int npackets = 0;
+- int ret = 1;
++ int work_done = 0;
+ struct sk_buff *skb;
+ struct can_frame *frame;
+ u8 canrflg;
+
+- while (npackets < quota) {
++ while (work_done < quota) {
+ canrflg = in_8(®s->canrflg);
+ if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF)))
+ break;
+@@ -419,18 +418,18 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota)
+
+ stats->rx_packets++;
+ stats->rx_bytes += frame->can_dlc;
+- npackets++;
++ work_done++;
+ netif_receive_skb(skb);
+ }
+
+- if (!(in_8(®s->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) {
+- napi_complete(&priv->napi);
+- clear_bit(F_RX_PROGRESS, &priv->flags);
+- if (priv->can.state < CAN_STATE_BUS_OFF)
+- out_8(®s->canrier, priv->shadow_canrier);
+- ret = 0;
++ if (work_done < quota) {
++ if (likely(napi_complete_done(&priv->napi, work_done))) {
++ clear_bit(F_RX_PROGRESS, &priv->flags);
++ if (priv->can.state < CAN_STATE_BUS_OFF)
++ out_8(®s->canrier, priv->shadow_canrier);
++ }
+ }
+- return ret;
++ return work_done;
+ }
+
+ static irqreturn_t mscan_isr(int irq, void *dev_id)
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index 3a39f51a9e24..cc2e224661b3 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -926,7 +926,7 @@ static int gs_usb_probe(struct usb_interface *intf,
+ GS_USB_BREQ_HOST_FORMAT,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+ 1,
+- intf->altsetting[0].desc.bInterfaceNumber,
++ intf->cur_altsetting->desc.bInterfaceNumber,
+ hconf,
+ sizeof(*hconf),
+ 1000);
+@@ -949,7 +949,7 @@ static int gs_usb_probe(struct usb_interface *intf,
+ GS_USB_BREQ_DEVICE_CONFIG,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+ 1,
+- intf->altsetting[0].desc.bInterfaceNumber,
++ intf->cur_altsetting->desc.bInterfaceNumber,
+ dconf,
+ sizeof(*dconf),
+ 1000);
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index 5fc0be564274..7ab87a758754 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -1590,7 +1590,7 @@ static int kvaser_usb_hydra_setup_endpoints(struct kvaser_usb *dev)
+ struct usb_endpoint_descriptor *ep;
+ int i;
+
+- iface_desc = &dev->intf->altsetting[0];
++ iface_desc = dev->intf->cur_altsetting;
+
+ for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
+ ep = &iface_desc->endpoint[i].desc;
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+index ae4c37e1bb75..1b9957f12459 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -1310,7 +1310,7 @@ static int kvaser_usb_leaf_setup_endpoints(struct kvaser_usb *dev)
+ struct usb_endpoint_descriptor *endpoint;
+ int i;
+
+- iface_desc = &dev->intf->altsetting[0];
++ iface_desc = dev->intf->cur_altsetting;
+
+ for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
+ endpoint = &iface_desc->endpoint[i].desc;
+diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
+index f9c79e21ab22..c64a03f164c0 100644
+--- a/drivers/net/wireless/ath/ath10k/usb.c
++++ b/drivers/net/wireless/ath/ath10k/usb.c
+@@ -454,6 +454,7 @@ static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
+ ath10k_dbg(ar, ATH10K_DBG_USB_BULK,
+ "usb bulk transmit failed: %d\n", ret);
+ usb_unanchor_urb(urb);
++ usb_free_urb(urb);
+ ret = -EINVAL;
+ goto err_free_urb_to_pipe;
+ }
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
+index 918c69936540..991b9cc18000 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -1036,8 +1036,10 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter)
+ }
+ skb_put(skb, MWIFIEX_UPLD_SIZE);
+ if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
+- PCI_DMA_FROMDEVICE))
++ PCI_DMA_FROMDEVICE)) {
++ kfree_skb(skb);
+ return -1;
++ }
+
+ card->cmdrsp_buf = skb;
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+index 74e50566db1f..6dd835f1efc2 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+@@ -229,6 +229,14 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
+ "11D: skip setting domain info in FW\n");
+ return 0;
+ }
++
++ if (country_ie_len >
++ (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) {
++ mwifiex_dbg(priv->adapter, ERROR,
++ "11D: country_ie_len overflow!, deauth AP\n");
++ return -EINVAL;
++ }
++
+ memcpy(priv->adapter->country_code, &country_ie[2], 2);
+
+ domain_info->country_code[0] = country_ie[2];
+@@ -272,8 +280,9 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
+ priv->scan_block = false;
+
+ if (bss) {
+- if (adapter->region_code == 0x00)
+- mwifiex_process_country_ie(priv, bss);
++ if (adapter->region_code == 0x00 &&
++ mwifiex_process_country_ie(priv, bss))
++ return -EINVAL;
+
+ /* Allocate and fill new bss descriptor */
+ bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor),
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 66c6ee70f00a..b2e1523b4dc1 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -5453,6 +5453,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)
+ ret = usb_submit_urb(urb, GFP_KERNEL);
+ if (ret) {
+ usb_unanchor_urb(urb);
++ usb_free_urb(urb);
+ goto error;
+ }
+
+diff --git a/drivers/phy/motorola/phy-cpcap-usb.c b/drivers/phy/motorola/phy-cpcap-usb.c
+index 6601ad0dfb3a..4ba3634009af 100644
+--- a/drivers/phy/motorola/phy-cpcap-usb.c
++++ b/drivers/phy/motorola/phy-cpcap-usb.c
+@@ -207,6 +207,19 @@ static int cpcap_phy_get_ints_state(struct cpcap_phy_ddata *ddata,
+ static int cpcap_usb_set_uart_mode(struct cpcap_phy_ddata *ddata);
+ static int cpcap_usb_set_usb_mode(struct cpcap_phy_ddata *ddata);
+
++static void cpcap_usb_try_musb_mailbox(struct cpcap_phy_ddata *ddata,
++ enum musb_vbus_id_status status)
++{
++ int error;
++
++ error = musb_mailbox(status);
++ if (!error)
++ return;
++
++ dev_dbg(ddata->dev, "%s: musb_mailbox failed: %i\n",
++ __func__, error);
++}
++
+ static void cpcap_usb_detect(struct work_struct *work)
+ {
+ struct cpcap_phy_ddata *ddata;
+@@ -226,9 +239,7 @@ static void cpcap_usb_detect(struct work_struct *work)
+ if (error)
+ goto out_err;
+
+- error = musb_mailbox(MUSB_ID_GROUND);
+- if (error)
+- goto out_err;
++ cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND);
+
+ error = regmap_update_bits(ddata->reg, CPCAP_REG_USBC3,
+ CPCAP_BIT_VBUSSTBY_EN,
+@@ -255,9 +266,7 @@ static void cpcap_usb_detect(struct work_struct *work)
+ error = cpcap_usb_set_usb_mode(ddata);
+ if (error)
+ goto out_err;
+- error = musb_mailbox(MUSB_ID_GROUND);
+- if (error)
+- goto out_err;
++ cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND);
+
+ return;
+ }
+@@ -267,22 +276,18 @@ static void cpcap_usb_detect(struct work_struct *work)
+ error = cpcap_usb_set_usb_mode(ddata);
+ if (error)
+ goto out_err;
+- error = musb_mailbox(MUSB_VBUS_VALID);
+- if (error)
+- goto out_err;
++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_VALID);
+
+ return;
+ }
+
++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF);
++
+ /* Default to debug UART mode */
+ error = cpcap_usb_set_uart_mode(ddata);
+ if (error)
+ goto out_err;
+
+- error = musb_mailbox(MUSB_VBUS_OFF);
+- if (error)
+- goto out_err;
+-
+ dev_dbg(ddata->dev, "set UART mode\n");
+
+ return;
+@@ -647,9 +652,7 @@ static int cpcap_usb_phy_remove(struct platform_device *pdev)
+ if (error)
+ dev_err(ddata->dev, "could not set UART mode\n");
+
+- error = musb_mailbox(MUSB_VBUS_OFF);
+- if (error)
+- dev_err(ddata->dev, "could not set mailbox\n");
++ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF);
+
+ usb_remove_phy(&ddata->phy);
+ cancel_delayed_work_sync(&ddata->detect_work);
+diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c
+index 26b0fa4e90b5..3b84290cf0a7 100644
+--- a/drivers/scsi/bfa/bfad_attr.c
++++ b/drivers/scsi/bfa/bfad_attr.c
+@@ -283,8 +283,10 @@ bfad_im_get_stats(struct Scsi_Host *shost)
+ rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa),
+ fcstats, bfad_hcb_comp, &fcomp);
+ spin_unlock_irqrestore(&bfad->bfad_lock, flags);
+- if (rc != BFA_STATUS_OK)
++ if (rc != BFA_STATUS_OK) {
++ kfree(fcstats);
+ return NULL;
++ }
+
+ wait_for_completion(&fcomp.comp);
+
+diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
+index 6a93b04f1fdf..c1c3b18793d5 100644
+--- a/drivers/staging/comedi/drivers/adv_pci1710.c
++++ b/drivers/staging/comedi/drivers/adv_pci1710.c
+@@ -46,8 +46,8 @@
+ #define PCI171X_RANGE_UNI BIT(4)
+ #define PCI171X_RANGE_GAIN(x) (((x) & 0x7) << 0)
+ #define PCI171X_MUX_REG 0x04 /* W: A/D multiplexor control */
+-#define PCI171X_MUX_CHANH(x) (((x) & 0xf) << 8)
+-#define PCI171X_MUX_CHANL(x) (((x) & 0xf) << 0)
++#define PCI171X_MUX_CHANH(x) (((x) & 0xff) << 8)
++#define PCI171X_MUX_CHANL(x) (((x) & 0xff) << 0)
+ #define PCI171X_MUX_CHAN(x) (PCI171X_MUX_CHANH(x) | PCI171X_MUX_CHANL(x))
+ #define PCI171X_STATUS_REG 0x06 /* R: status register */
+ #define PCI171X_STATUS_IRQ BIT(11) /* 1=IRQ occurred */
+diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+index 55952dd88359..4b363112fa97 100644
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -37,6 +37,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
+ {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+ {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
+ {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
++ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */
+ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
+ {} /* Terminating entry */
+diff --git a/drivers/staging/vt6656/device.h b/drivers/staging/vt6656/device.h
+index a2feeb916836..cabdda259de2 100644
+--- a/drivers/staging/vt6656/device.h
++++ b/drivers/staging/vt6656/device.h
+@@ -259,6 +259,7 @@ struct vnt_private {
+ u8 mac_hw;
+ /* netdev */
+ struct usb_device *usb;
++ struct usb_interface *intf;
+
+ u64 tsf_time;
+ u8 rx_rate;
+diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
+index 70433f756d8e..ff9cf0f9e7de 100644
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -955,6 +955,7 @@ vt6656_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ priv = hw->priv;
+ priv->hw = hw;
+ priv->usb = udev;
++ priv->intf = intf;
+
+ vnt_set_options(priv);
+
+diff --git a/drivers/staging/vt6656/wcmd.c b/drivers/staging/vt6656/wcmd.c
+index 3eb2f11a5de1..2c5250ca2801 100644
+--- a/drivers/staging/vt6656/wcmd.c
++++ b/drivers/staging/vt6656/wcmd.c
+@@ -99,6 +99,7 @@ void vnt_run_command(struct work_struct *work)
+ if (vnt_init(priv)) {
+ /* If fail all ends TODO retry */
+ dev_err(&priv->usb->dev, "failed to start\n");
++ usb_set_intfdata(priv->intf, NULL);
+ ieee80211_free_hw(priv->hw);
+ return;
+ }
+diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c
+index 9db93f500b4e..c66a04d24f1d 100644
+--- a/drivers/tty/serdev/core.c
++++ b/drivers/tty/serdev/core.c
+@@ -526,6 +526,12 @@ static acpi_status acpi_serdev_register_device(struct serdev_controller *ctrl,
+ return AE_OK;
+ }
+
++static const struct acpi_device_id serdev_acpi_devices_blacklist[] = {
++ { "INT3511", 0 },
++ { "INT3512", 0 },
++ { },
++};
++
+ static acpi_status acpi_serdev_add_device(acpi_handle handle, u32 level,
+ void *data, void **return_value)
+ {
+@@ -535,6 +541,10 @@ static acpi_status acpi_serdev_add_device(acpi_handle handle, u32 level,
+ if (acpi_bus_get_device(handle, &adev))
+ return AE_OK;
+
++ /* Skip if black listed */
++ if (!acpi_match_device_ids(adev, serdev_acpi_devices_blacklist))
++ return AE_OK;
++
+ return acpi_serdev_register_device(ctrl, adev);
+ }
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index dc56cddca6dc..2a5bf4c14fb8 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2786,6 +2786,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport)
+ if (uport->cons && uport->dev)
+ of_console_check(uport->dev->of_node, uport->cons->name, uport->line);
+
++ tty_port_link_device(port, drv->tty_driver, uport->line);
+ uart_configure_port(drv, state, uport);
+
+ port->console = uart_console(uport);
+diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
+index 4638d9b066be..71b26d0d19fd 100644
+--- a/drivers/usb/chipidea/host.c
++++ b/drivers/usb/chipidea/host.c
+@@ -25,6 +25,7 @@ static int (*orig_bus_suspend)(struct usb_hcd *hcd);
+
+ struct ehci_ci_priv {
+ struct regulator *reg_vbus;
++ bool enabled;
+ };
+
+ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable)
+@@ -36,7 +37,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable)
+ int ret = 0;
+ int port = HCS_N_PORTS(ehci->hcs_params);
+
+- if (priv->reg_vbus) {
++ if (priv->reg_vbus && enable != priv->enabled) {
+ if (port > 1) {
+ dev_warn(dev,
+ "Not support multi-port regulator control\n");
+@@ -52,6 +53,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable)
+ enable ? "enable" : "disable", ret);
+ return ret;
+ }
++ priv->enabled = enable;
+ }
+
+ if (enable && (ci->platdata->phy_mode == USBPHY_INTERFACE_MODE_HSIC)) {
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 9fa70894179c..0bf0e62bede3 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -392,12 +392,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
+ endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
+ }
+
+- /* Validate the wMaxPacketSize field */
++ /*
++ * Validate the wMaxPacketSize field.
++ * Some devices have isochronous endpoints in altsetting 0;
++ * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0
++ * (see the end of section 5.6.3), so don't warn about them.
++ */
+ maxp = usb_endpoint_maxp(&endpoint->desc);
+- if (maxp == 0) {
+- dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n",
++ if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) {
++ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n",
+ cfgno, inum, asnum, d->bEndpointAddress);
+- goto skip_to_next_endpoint_or_interface_descriptor;
+ }
+
+ /* Find the highest legal maxpacket size for this endpoint */
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index b7d56272f9d1..b6b4f99a399c 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1842,6 +1842,9 @@ static const struct attribute_group musb_attr_group = {
+ #define MUSB_QUIRK_B_INVALID_VBUS_91 (MUSB_DEVCTL_BDEVICE | \
+ (2 << MUSB_DEVCTL_VBUS_SHIFT) | \
+ MUSB_DEVCTL_SESSION)
++#define MUSB_QUIRK_B_DISCONNECT_99 (MUSB_DEVCTL_BDEVICE | \
++ (3 << MUSB_DEVCTL_VBUS_SHIFT) | \
++ MUSB_DEVCTL_SESSION)
+ #define MUSB_QUIRK_A_DISCONNECT_19 ((3 << MUSB_DEVCTL_VBUS_SHIFT) | \
+ MUSB_DEVCTL_SESSION)
+
+@@ -1864,6 +1867,11 @@ static void musb_pm_runtime_check_session(struct musb *musb)
+ s = MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV |
+ MUSB_DEVCTL_HR;
+ switch (devctl & ~s) {
++ case MUSB_QUIRK_B_DISCONNECT_99:
++ musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n");
++ schedule_delayed_work(&musb->irq_work,
++ msecs_to_jiffies(1000));
++ break;
+ case MUSB_QUIRK_B_INVALID_VBUS_91:
+ if (musb->quirk_retries && !musb->flush_irq_work) {
+ musb_dbg(musb,
+@@ -2316,6 +2324,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
+ musb_disable_interrupts(musb);
+ musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
+
++ /* MUSB_POWER_SOFTCONN might be already set, JZ4740 does this. */
++ musb_writeb(musb->mregs, MUSB_POWER, 0);
++
+ /* Init IRQ workqueue before request_irq */
+ INIT_DELAYED_WORK(&musb->irq_work, musb_irq_work);
+ INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset);
+diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
+index 5fc6825745f2..2d3751d885b4 100644
+--- a/drivers/usb/musb/musbhsdma.c
++++ b/drivers/usb/musb/musbhsdma.c
+@@ -425,7 +425,7 @@ struct dma_controller *musbhs_dma_controller_create(struct musb *musb,
+ controller->controller.channel_abort = dma_channel_abort;
+
+ if (request_irq(irq, dma_controller_irq, 0,
+- dev_name(musb->controller), &controller->controller)) {
++ dev_name(musb->controller), controller)) {
+ dev_err(dev, "request_irq %d failed!\n", irq);
+ musb_dma_controller_destroy(&controller->controller);
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 553adab174bf..a157784e2059 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -567,6 +567,9 @@ static void option_instat_callback(struct urb *urb);
+ /* Interface must have two endpoints */
+ #define NUMEP2 BIT(16)
+
++/* Device needs ZLP */
++#define ZLP BIT(17)
++
+
+ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+@@ -1198,6 +1201,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
+ .driver_info = NCTRL(0) },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */
++ .driver_info = NCTRL(0) | ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) },
+@@ -2098,6 +2103,9 @@ static int option_attach(struct usb_serial *serial)
+ if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
+ data->use_send_setup = 1;
+
++ if (device_flags & ZLP)
++ data->use_zlp = 1;
++
+ spin_lock_init(&data->susp_lock);
+
+ usb_set_serial_data(serial, data);
+diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h
+index d28dab4b9eff..9879773fb39e 100644
+--- a/drivers/usb/serial/usb-wwan.h
++++ b/drivers/usb/serial/usb-wwan.h
+@@ -36,6 +36,7 @@ struct usb_wwan_intf_private {
+ spinlock_t susp_lock;
+ unsigned int suspended:1;
+ unsigned int use_send_setup:1;
++ unsigned int use_zlp:1;
+ int in_flight;
+ unsigned int open_ports;
+ void *private;
+diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
+index 912472f26e4f..35406cb4a726 100644
+--- a/drivers/usb/serial/usb_wwan.c
++++ b/drivers/usb/serial/usb_wwan.c
+@@ -490,6 +490,7 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port,
+ void (*callback) (struct urb *))
+ {
+ struct usb_serial *serial = port->serial;
++ struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial);
+ struct urb *urb;
+
+ urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */
+@@ -500,6 +501,9 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port,
+ usb_sndbulkpipe(serial->dev, endpoint) | dir,
+ buf, len, callback, ctx);
+
++ if (intfdata->use_zlp && dir == USB_DIR_OUT)
++ urb->transfer_flags |= URB_ZERO_PACKET;
++
+ return urb;
+ }
+
+diff --git a/fs/char_dev.c b/fs/char_dev.c
+index 8a63cfa29005..5fffd5050fb7 100644
+--- a/fs/char_dev.c
++++ b/fs/char_dev.c
+@@ -361,7 +361,7 @@ static struct kobject *cdev_get(struct cdev *p)
+
+ if (owner && !try_module_get(owner))
+ return NULL;
+- kobj = kobject_get(&p->kobj);
++ kobj = kobject_get_unless_zero(&p->kobj);
+ if (!kobj)
+ module_put(owner);
+ return kobj;
+diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
+index f01623aef2f7..73199facd5a4 100644
+--- a/include/linux/can/dev.h
++++ b/include/linux/can/dev.h
+@@ -18,6 +18,7 @@
+ #include <linux/can/error.h>
+ #include <linux/can/led.h>
+ #include <linux/can/netlink.h>
++#include <linux/can/skb.h>
+ #include <linux/netdevice.h>
+
+ /*
+@@ -91,6 +92,36 @@ struct can_priv {
+ #define get_can_dlc(i) (min_t(__u8, (i), CAN_MAX_DLC))
+ #define get_canfd_dlc(i) (min_t(__u8, (i), CANFD_MAX_DLC))
+
++/* Check for outgoing skbs that have not been created by the CAN subsystem */
++static inline bool can_skb_headroom_valid(struct net_device *dev,
++ struct sk_buff *skb)
++{
++ /* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */
++ if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv)))
++ return false;
++
++ /* af_packet does not apply CAN skb specific settings */
++ if (skb->ip_summed == CHECKSUM_NONE) {
++ /* init headroom */
++ can_skb_prv(skb)->ifindex = dev->ifindex;
++ can_skb_prv(skb)->skbcnt = 0;
++
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
++
++ /* preform proper loopback on capable devices */
++ if (dev->flags & IFF_ECHO)
++ skb->pkt_type = PACKET_LOOPBACK;
++ else
++ skb->pkt_type = PACKET_HOST;
++
++ skb_reset_mac_header(skb);
++ skb_reset_network_header(skb);
++ skb_reset_transport_header(skb);
++ }
++
++ return true;
++}
++
+ /* Drop a given socketbuffer if it does not contain a valid CAN frame. */
+ static inline bool can_dropped_invalid_skb(struct net_device *dev,
+ struct sk_buff *skb)
+@@ -108,6 +139,9 @@ static inline bool can_dropped_invalid_skb(struct net_device *dev,
+ } else
+ goto inval_skb;
+
++ if (!can_skb_headroom_valid(dev, skb))
++ goto inval_skb;
++
+ return false;
+
+ inval_skb:
+diff --git a/include/trace/events/preemptirq.h b/include/trace/events/preemptirq.h
+index 9a0d4ceeb166..ccb37d0dcff9 100644
+--- a/include/trace/events/preemptirq.h
++++ b/include/trace/events/preemptirq.h
+@@ -18,13 +18,13 @@ DECLARE_EVENT_CLASS(preemptirq_template,
+ TP_ARGS(ip, parent_ip),
+
+ TP_STRUCT__entry(
+- __field(u32, caller_offs)
+- __field(u32, parent_offs)
++ __field(s32, caller_offs)
++ __field(s32, parent_offs)
+ ),
+
+ TP_fast_assign(
+- __entry->caller_offs = (u32)(ip - (unsigned long)_stext);
+- __entry->parent_offs = (u32)(parent_ip - (unsigned long)_stext);
++ __entry->caller_offs = (s32)(ip - (unsigned long)_stext);
++ __entry->parent_offs = (s32)(parent_ip - (unsigned long)_stext);
+ ),
+
+ TP_printk("caller=%pF parent=%pF",
+diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
+index f056b2a00d5c..9a61c28ed3ae 100644
+--- a/include/uapi/linux/input.h
++++ b/include/uapi/linux/input.h
+@@ -34,6 +34,7 @@ struct input_event {
+ __kernel_ulong_t __sec;
+ #if defined(__sparc__) && defined(__arch64__)
+ unsigned int __usec;
++ unsigned int __pad;
+ #else
+ __kernel_ulong_t __usec;
+ #endif
+diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
+index 7d04b9890755..11f4dbd9526b 100644
+--- a/kernel/trace/trace_sched_wakeup.c
++++ b/kernel/trace/trace_sched_wakeup.c
+@@ -640,7 +640,7 @@ static void start_wakeup_tracer(struct trace_array *tr)
+ if (ret) {
+ pr_info("wakeup trace: Couldn't activate tracepoint"
+ " probe to kernel_sched_migrate_task\n");
+- return;
++ goto fail_deprobe_sched_switch;
+ }
+
+ wakeup_reset(tr);
+@@ -658,6 +658,8 @@ static void start_wakeup_tracer(struct trace_array *tr)
+ printk(KERN_ERR "failed to start wakeup tracer\n");
+
+ return;
++fail_deprobe_sched_switch:
++ unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL);
+ fail_deprobe_wake_new:
+ unregister_trace_sched_wakeup_new(probe_wakeup, NULL);
+ fail_deprobe:
+diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
+index 4237eba4ef20..40337094085c 100644
+--- a/kernel/trace/trace_stack.c
++++ b/kernel/trace/trace_stack.c
+@@ -196,6 +196,11 @@ check_stack(unsigned long ip, unsigned long *stack)
+ local_irq_restore(flags);
+ }
+
++/* Some archs may not define MCOUNT_INSN_SIZE */
++#ifndef MCOUNT_INSN_SIZE
++# define MCOUNT_INSN_SIZE 0
++#endif
++
+ static void
+ stack_trace_call(unsigned long ip, unsigned long parent_ip,
+ struct ftrace_ops *op, struct pt_regs *pt_regs)
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index 2dc83de53f94..f1b7293c6023 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -383,10 +383,11 @@ next: ;
+ return 1;
+ }
+
+-static inline int check_target(struct arpt_entry *e, const char *name)
++static int check_target(struct arpt_entry *e, struct net *net, const char *name)
+ {
+ struct xt_entry_target *t = arpt_get_target(e);
+ struct xt_tgchk_param par = {
++ .net = net,
+ .table = name,
+ .entryinfo = e,
+ .target = t->u.kernel.target,
+@@ -398,8 +399,9 @@ static inline int check_target(struct arpt_entry *e, const char *name)
+ return xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false);
+ }
+
+-static inline int
+-find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
++static int
++find_check_entry(struct arpt_entry *e, struct net *net, const char *name,
++ unsigned int size,
+ struct xt_percpu_counter_alloc_state *alloc_state)
+ {
+ struct xt_entry_target *t;
+@@ -418,7 +420,7 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
+ }
+ t->u.kernel.target = target;
+
+- ret = check_target(e, name);
++ ret = check_target(e, net, name);
+ if (ret)
+ goto err;
+ return 0;
+@@ -511,7 +513,9 @@ static inline void cleanup_entry(struct arpt_entry *e)
+ /* Checks and translates the user-supplied table segment (held in
+ * newinfo).
+ */
+-static int translate_table(struct xt_table_info *newinfo, void *entry0,
++static int translate_table(struct net *net,
++ struct xt_table_info *newinfo,
++ void *entry0,
+ const struct arpt_replace *repl)
+ {
+ struct xt_percpu_counter_alloc_state alloc_state = { 0 };
+@@ -568,7 +572,7 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0,
+ /* Finally, each sanity check must pass */
+ i = 0;
+ xt_entry_foreach(iter, entry0, newinfo->size) {
+- ret = find_check_entry(iter, repl->name, repl->size,
++ ret = find_check_entry(iter, net, repl->name, repl->size,
+ &alloc_state);
+ if (ret != 0)
+ break;
+@@ -973,7 +977,7 @@ static int do_replace(struct net *net, const void __user *user,
+ goto free_newinfo;
+ }
+
+- ret = translate_table(newinfo, loc_cpu_entry, &tmp);
++ ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
+ if (ret != 0)
+ goto free_newinfo;
+
+@@ -1148,7 +1152,8 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr,
+ }
+ }
+
+-static int translate_compat_table(struct xt_table_info **pinfo,
++static int translate_compat_table(struct net *net,
++ struct xt_table_info **pinfo,
+ void **pentry0,
+ const struct compat_arpt_replace *compatr)
+ {
+@@ -1216,7 +1221,7 @@ static int translate_compat_table(struct xt_table_info **pinfo,
+ repl.num_counters = 0;
+ repl.counters = NULL;
+ repl.size = newinfo->size;
+- ret = translate_table(newinfo, entry1, &repl);
++ ret = translate_table(net, newinfo, entry1, &repl);
+ if (ret)
+ goto free_newinfo;
+
+@@ -1269,7 +1274,7 @@ static int compat_do_replace(struct net *net, void __user *user,
+ goto free_newinfo;
+ }
+
+- ret = translate_compat_table(&newinfo, &loc_cpu_entry, &tmp);
++ ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp);
+ if (ret != 0)
+ goto free_newinfo;
+
+@@ -1545,7 +1550,7 @@ int arpt_register_table(struct net *net,
+ loc_cpu_entry = newinfo->entries;
+ memcpy(loc_cpu_entry, repl->entries, repl->size);
+
+- ret = translate_table(newinfo, loc_cpu_entry, repl);
++ ret = translate_table(net, newinfo, loc_cpu_entry, repl);
+ if (ret != 0)
+ goto out_free;
+
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index 1566261b6b5a..21eb53f6d4fe 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -1666,6 +1666,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb,
+ struct ip_set *set;
+ struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {};
+ int ret = 0;
++ u32 lineno;
+
+ if (unlikely(protocol_failed(attr) ||
+ !attr[IPSET_ATTR_SETNAME] ||
+@@ -1682,7 +1683,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb,
+ return -IPSET_ERR_PROTOCOL;
+
+ rcu_read_lock_bh();
+- ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0);
++ ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, 0, 0);
+ rcu_read_unlock_bh();
+ /* Userspace can't trigger element to be re-added */
+ if (ret == -EAGAIN)
+diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
+index f3f91ed2c21a..e24c436d913e 100644
+--- a/net/netfilter/nf_conntrack_proto_dccp.c
++++ b/net/netfilter/nf_conntrack_proto_dccp.c
+@@ -687,6 +687,9 @@ static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[],
+ unsigned int *timeouts = data;
+ int i;
+
++ if (!timeouts)
++ timeouts = dn->dccp_timeout;
++
+ /* set default DCCP timeouts. */
+ for (i=0; i<CT_DCCP_MAX; i++)
+ timeouts[i] = dn->dccp_timeout[i];
+diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
+index e4d738d34cd0..7d7e30ea0ecf 100644
+--- a/net/netfilter/nf_conntrack_proto_sctp.c
++++ b/net/netfilter/nf_conntrack_proto_sctp.c
+@@ -603,6 +603,9 @@ static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[],
+ struct nf_sctp_net *sn = sctp_pernet(net);
+ int i;
+
++ if (!timeouts)
++ timeouts = sn->timeouts;
++
+ /* set default SCTP timeouts. */
+ for (i=0; i<SCTP_CONNTRACK_MAX; i++)
+ timeouts[i] = sn->timeouts[i];
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1f6a036627e8..ae735bcb9a2c 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -424,6 +424,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0672:
+ alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */
+ break;
++ case 0x10ec0222:
+ case 0x10ec0623:
+ alc_update_coef_idx(codec, 0x19, 1<<13, 0);
+ break;
+@@ -442,6 +443,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ break;
+ case 0x10ec0899:
+ case 0x10ec0900:
++ case 0x10ec0b00:
+ case 0x10ec1168:
+ case 0x10ec1220:
+ alc_update_coef_idx(codec, 0x7, 1<<1, 0);
+@@ -2521,6 +2523,7 @@ static int patch_alc882(struct hda_codec *codec)
+ case 0x10ec0882:
+ case 0x10ec0885:
+ case 0x10ec0900:
++ case 0x10ec0b00:
+ case 0x10ec1220:
+ break;
+ default:
+@@ -7039,6 +7042,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x17aa, 0x2292, "Thinkpad X1 Yoga 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1),
+ SND_PCI_QUIRK(0x17aa, 0x2293, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1),
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+@@ -8989,6 +8993,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662),
+ HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882),
+ HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882),
++ HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882),
+ HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882),
+ HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882),
+ {} /* terminator */
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index bc70212031df..49f6f6129857 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1177,6 +1177,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+ case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
+ case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
++ case USB_ID(0x05a7, 0x1020): /* Bose Companion 5 */
+ case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
+ case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */
+ case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-01-17 19:56 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-01-17 19:56 UTC (permalink / raw
To: gentoo-commits
commit: 6297eafc599697a6a71fc3383dff04ee594cb8b8
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 17 19:55:45 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jan 17 19:55:45 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6297eafc
Linux patch 4.19.97
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1096_linux-4.19.97.patch | 2435 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2439 insertions(+)
diff --git a/0000_README b/0000_README
index b06ab83..af58b77 100644
--- a/0000_README
+++ b/0000_README
@@ -423,6 +423,10 @@ Patch: 1095_linux-4.19.96.patch
From: https://www.kernel.org
Desc: Linux 4.19.96
+Patch: 1096_linux-4.19.97.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.97
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1096_linux-4.19.97.patch b/1096_linux-4.19.97.patch
new file mode 100644
index 0000000..607c977
--- /dev/null
+++ b/1096_linux-4.19.97.patch
@@ -0,0 +1,2435 @@
+diff --git a/Documentation/ABI/testing/sysfs-bus-mei b/Documentation/ABI/testing/sysfs-bus-mei
+index 6bd45346ac7e..3f8701e8fa24 100644
+--- a/Documentation/ABI/testing/sysfs-bus-mei
++++ b/Documentation/ABI/testing/sysfs-bus-mei
+@@ -4,7 +4,7 @@ KernelVersion: 3.10
+ Contact: Samuel Ortiz <sameo@linux.intel.com>
+ linux-mei@linux.intel.com
+ Description: Stores the same MODALIAS value emitted by uevent
+- Format: mei:<mei device name>:<device uuid>:
++ Format: mei:<mei device name>:<device uuid>:<protocol version>
+
+ What: /sys/bus/mei/devices/.../name
+ Date: May 2015
+diff --git a/Makefile b/Makefile
+index 3b836cc8b22d..3499df8936a1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 96
++SUBLEVEL = 97
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
+index 0ef90c6554a9..9b41d77aa39b 100644
+--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
+@@ -580,6 +580,8 @@
+ l21 {
+ regulator-min-microvolt = <2950000>;
+ regulator-max-microvolt = <2950000>;
++ regulator-allow-set-load;
++ regulator-system-load = <200000>;
+ };
+ l22 {
+ regulator-min-microvolt = <3300000>;
+diff --git a/arch/hexagon/include/asm/atomic.h b/arch/hexagon/include/asm/atomic.h
+index 311b9894ccc8..15cca7f1fded 100644
+--- a/arch/hexagon/include/asm/atomic.h
++++ b/arch/hexagon/include/asm/atomic.h
+@@ -105,7 +105,7 @@ static inline void atomic_##op(int i, atomic_t *v) \
+ "1: %0 = memw_locked(%1);\n" \
+ " %0 = "#op "(%0,%2);\n" \
+ " memw_locked(%1,P3)=%0;\n" \
+- " if !P3 jump 1b;\n" \
++ " if (!P3) jump 1b;\n" \
+ : "=&r" (output) \
+ : "r" (&v->counter), "r" (i) \
+ : "memory", "p3" \
+@@ -121,7 +121,7 @@ static inline int atomic_##op##_return(int i, atomic_t *v) \
+ "1: %0 = memw_locked(%1);\n" \
+ " %0 = "#op "(%0,%2);\n" \
+ " memw_locked(%1,P3)=%0;\n" \
+- " if !P3 jump 1b;\n" \
++ " if (!P3) jump 1b;\n" \
+ : "=&r" (output) \
+ : "r" (&v->counter), "r" (i) \
+ : "memory", "p3" \
+@@ -138,7 +138,7 @@ static inline int atomic_fetch_##op(int i, atomic_t *v) \
+ "1: %0 = memw_locked(%2);\n" \
+ " %1 = "#op "(%0,%3);\n" \
+ " memw_locked(%2,P3)=%1;\n" \
+- " if !P3 jump 1b;\n" \
++ " if (!P3) jump 1b;\n" \
+ : "=&r" (output), "=&r" (val) \
+ : "r" (&v->counter), "r" (i) \
+ : "memory", "p3" \
+@@ -187,7 +187,7 @@ static inline int atomic_fetch_add_unless(atomic_t *v, int a, int u)
+ " }"
+ " memw_locked(%2, p3) = %1;"
+ " {"
+- " if !p3 jump 1b;"
++ " if (!p3) jump 1b;"
+ " }"
+ "2:"
+ : "=&r" (__oldval), "=&r" (tmp)
+diff --git a/arch/hexagon/include/asm/bitops.h b/arch/hexagon/include/asm/bitops.h
+index 2691a1857d20..634306cda006 100644
+--- a/arch/hexagon/include/asm/bitops.h
++++ b/arch/hexagon/include/asm/bitops.h
+@@ -52,7 +52,7 @@ static inline int test_and_clear_bit(int nr, volatile void *addr)
+ "1: R12 = memw_locked(R10);\n"
+ " { P0 = tstbit(R12,R11); R12 = clrbit(R12,R11); }\n"
+ " memw_locked(R10,P1) = R12;\n"
+- " {if !P1 jump 1b; %0 = mux(P0,#1,#0);}\n"
++ " {if (!P1) jump 1b; %0 = mux(P0,#1,#0);}\n"
+ : "=&r" (oldval)
+ : "r" (addr), "r" (nr)
+ : "r10", "r11", "r12", "p0", "p1", "memory"
+@@ -76,7 +76,7 @@ static inline int test_and_set_bit(int nr, volatile void *addr)
+ "1: R12 = memw_locked(R10);\n"
+ " { P0 = tstbit(R12,R11); R12 = setbit(R12,R11); }\n"
+ " memw_locked(R10,P1) = R12;\n"
+- " {if !P1 jump 1b; %0 = mux(P0,#1,#0);}\n"
++ " {if (!P1) jump 1b; %0 = mux(P0,#1,#0);}\n"
+ : "=&r" (oldval)
+ : "r" (addr), "r" (nr)
+ : "r10", "r11", "r12", "p0", "p1", "memory"
+@@ -102,7 +102,7 @@ static inline int test_and_change_bit(int nr, volatile void *addr)
+ "1: R12 = memw_locked(R10);\n"
+ " { P0 = tstbit(R12,R11); R12 = togglebit(R12,R11); }\n"
+ " memw_locked(R10,P1) = R12;\n"
+- " {if !P1 jump 1b; %0 = mux(P0,#1,#0);}\n"
++ " {if (!P1) jump 1b; %0 = mux(P0,#1,#0);}\n"
+ : "=&r" (oldval)
+ : "r" (addr), "r" (nr)
+ : "r10", "r11", "r12", "p0", "p1", "memory"
+@@ -237,7 +237,7 @@ static inline int ffs(int x)
+ int r;
+
+ asm("{ P0 = cmp.eq(%1,#0); %0 = ct0(%1);}\n"
+- "{ if P0 %0 = #0; if !P0 %0 = add(%0,#1);}\n"
++ "{ if (P0) %0 = #0; if (!P0) %0 = add(%0,#1);}\n"
+ : "=&r" (r)
+ : "r" (x)
+ : "p0");
+diff --git a/arch/hexagon/include/asm/cmpxchg.h b/arch/hexagon/include/asm/cmpxchg.h
+index a6e34e2acbba..db258424059f 100644
+--- a/arch/hexagon/include/asm/cmpxchg.h
++++ b/arch/hexagon/include/asm/cmpxchg.h
+@@ -44,7 +44,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr,
+ __asm__ __volatile__ (
+ "1: %0 = memw_locked(%1);\n" /* load into retval */
+ " memw_locked(%1,P0) = %2;\n" /* store into memory */
+- " if !P0 jump 1b;\n"
++ " if (!P0) jump 1b;\n"
+ : "=&r" (retval)
+ : "r" (ptr), "r" (x)
+ : "memory", "p0"
+diff --git a/arch/hexagon/include/asm/futex.h b/arch/hexagon/include/asm/futex.h
+index c889f5993ecd..e8e5e47afb37 100644
+--- a/arch/hexagon/include/asm/futex.h
++++ b/arch/hexagon/include/asm/futex.h
+@@ -16,7 +16,7 @@
+ /* For example: %1 = %4 */ \
+ insn \
+ "2: memw_locked(%3,p2) = %1;\n" \
+- " if !p2 jump 1b;\n" \
++ " if (!p2) jump 1b;\n" \
+ " %1 = #0;\n" \
+ "3:\n" \
+ ".section .fixup,\"ax\"\n" \
+@@ -84,10 +84,10 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, u32 oldval,
+ "1: %1 = memw_locked(%3)\n"
+ " {\n"
+ " p2 = cmp.eq(%1,%4)\n"
+- " if !p2.new jump:NT 3f\n"
++ " if (!p2.new) jump:NT 3f\n"
+ " }\n"
+ "2: memw_locked(%3,p2) = %5\n"
+- " if !p2 jump 1b\n"
++ " if (!p2) jump 1b\n"
+ "3:\n"
+ ".section .fixup,\"ax\"\n"
+ "4: %0 = #%6\n"
+diff --git a/arch/hexagon/include/asm/spinlock.h b/arch/hexagon/include/asm/spinlock.h
+index 48020863f53a..e090f6a151c2 100644
+--- a/arch/hexagon/include/asm/spinlock.h
++++ b/arch/hexagon/include/asm/spinlock.h
+@@ -44,9 +44,9 @@ static inline void arch_read_lock(arch_rwlock_t *lock)
+ __asm__ __volatile__(
+ "1: R6 = memw_locked(%0);\n"
+ " { P3 = cmp.ge(R6,#0); R6 = add(R6,#1);}\n"
+- " { if !P3 jump 1b; }\n"
++ " { if (!P3) jump 1b; }\n"
+ " memw_locked(%0,P3) = R6;\n"
+- " { if !P3 jump 1b; }\n"
++ " { if (!P3) jump 1b; }\n"
+ :
+ : "r" (&lock->lock)
+ : "memory", "r6", "p3"
+@@ -60,7 +60,7 @@ static inline void arch_read_unlock(arch_rwlock_t *lock)
+ "1: R6 = memw_locked(%0);\n"
+ " R6 = add(R6,#-1);\n"
+ " memw_locked(%0,P3) = R6\n"
+- " if !P3 jump 1b;\n"
++ " if (!P3) jump 1b;\n"
+ :
+ : "r" (&lock->lock)
+ : "memory", "r6", "p3"
+@@ -75,7 +75,7 @@ static inline int arch_read_trylock(arch_rwlock_t *lock)
+ __asm__ __volatile__(
+ " R6 = memw_locked(%1);\n"
+ " { %0 = #0; P3 = cmp.ge(R6,#0); R6 = add(R6,#1);}\n"
+- " { if !P3 jump 1f; }\n"
++ " { if (!P3) jump 1f; }\n"
+ " memw_locked(%1,P3) = R6;\n"
+ " { %0 = P3 }\n"
+ "1:\n"
+@@ -92,9 +92,9 @@ static inline void arch_write_lock(arch_rwlock_t *lock)
+ __asm__ __volatile__(
+ "1: R6 = memw_locked(%0)\n"
+ " { P3 = cmp.eq(R6,#0); R6 = #-1;}\n"
+- " { if !P3 jump 1b; }\n"
++ " { if (!P3) jump 1b; }\n"
+ " memw_locked(%0,P3) = R6;\n"
+- " { if !P3 jump 1b; }\n"
++ " { if (!P3) jump 1b; }\n"
+ :
+ : "r" (&lock->lock)
+ : "memory", "r6", "p3"
+@@ -108,7 +108,7 @@ static inline int arch_write_trylock(arch_rwlock_t *lock)
+ __asm__ __volatile__(
+ " R6 = memw_locked(%1)\n"
+ " { %0 = #0; P3 = cmp.eq(R6,#0); R6 = #-1;}\n"
+- " { if !P3 jump 1f; }\n"
++ " { if (!P3) jump 1f; }\n"
+ " memw_locked(%1,P3) = R6;\n"
+ " %0 = P3;\n"
+ "1:\n"
+@@ -131,9 +131,9 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
+ __asm__ __volatile__(
+ "1: R6 = memw_locked(%0);\n"
+ " P3 = cmp.eq(R6,#0);\n"
+- " { if !P3 jump 1b; R6 = #1; }\n"
++ " { if (!P3) jump 1b; R6 = #1; }\n"
+ " memw_locked(%0,P3) = R6;\n"
+- " { if !P3 jump 1b; }\n"
++ " { if (!P3) jump 1b; }\n"
+ :
+ : "r" (&lock->lock)
+ : "memory", "r6", "p3"
+@@ -153,7 +153,7 @@ static inline unsigned int arch_spin_trylock(arch_spinlock_t *lock)
+ __asm__ __volatile__(
+ " R6 = memw_locked(%1);\n"
+ " P3 = cmp.eq(R6,#0);\n"
+- " { if !P3 jump 1f; R6 = #1; %0 = #0; }\n"
++ " { if (!P3) jump 1f; R6 = #1; %0 = #0; }\n"
+ " memw_locked(%1,P3) = R6;\n"
+ " %0 = P3;\n"
+ "1:\n"
+diff --git a/arch/hexagon/kernel/stacktrace.c b/arch/hexagon/kernel/stacktrace.c
+index 41866a06adf7..ec4ef682923d 100644
+--- a/arch/hexagon/kernel/stacktrace.c
++++ b/arch/hexagon/kernel/stacktrace.c
+@@ -24,8 +24,6 @@
+ #include <linux/thread_info.h>
+ #include <linux/module.h>
+
+-register unsigned long current_frame_pointer asm("r30");
+-
+ struct stackframe {
+ unsigned long fp;
+ unsigned long rets;
+@@ -43,7 +41,7 @@ void save_stack_trace(struct stack_trace *trace)
+
+ low = (unsigned long)task_stack_page(current);
+ high = low + THREAD_SIZE;
+- fp = current_frame_pointer;
++ fp = (unsigned long)__builtin_frame_address(0);
+
+ while (fp >= low && fp <= (high - sizeof(*frame))) {
+ frame = (struct stackframe *)fp;
+diff --git a/arch/hexagon/kernel/vm_entry.S b/arch/hexagon/kernel/vm_entry.S
+index 67c6ccc14770..9f4a73ff7203 100644
+--- a/arch/hexagon/kernel/vm_entry.S
++++ b/arch/hexagon/kernel/vm_entry.S
+@@ -382,7 +382,7 @@ ret_from_fork:
+ R26.L = #LO(do_work_pending);
+ R0 = #VM_INT_DISABLE;
+ }
+- if P0 jump check_work_pending
++ if (P0) jump check_work_pending
+ {
+ R0 = R25;
+ callr R24
+diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
+index 172801ed35b8..d859f079b771 100644
+--- a/arch/mips/boot/compressed/Makefile
++++ b/arch/mips/boot/compressed/Makefile
+@@ -29,6 +29,9 @@ KBUILD_AFLAGS := $(KBUILD_AFLAGS) -D__ASSEMBLY__ \
+ -DBOOT_HEAP_SIZE=$(BOOT_HEAP_SIZE) \
+ -DKERNEL_ENTRY=$(VMLINUX_ENTRY_ADDRESS)
+
++# Prevents link failures: __sanitizer_cov_trace_pc() is not linked in.
++KCOV_INSTRUMENT := n
++
+ # decompressor objects (linked with vmlinuz)
+ vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o
+
+diff --git a/arch/mips/kernel/cacheinfo.c b/arch/mips/kernel/cacheinfo.c
+index 428ef2189203..3ea95568ece4 100644
+--- a/arch/mips/kernel/cacheinfo.c
++++ b/arch/mips/kernel/cacheinfo.c
+@@ -61,6 +61,25 @@ static int __init_cache_level(unsigned int cpu)
+ return 0;
+ }
+
++static void fill_cpumask_siblings(int cpu, cpumask_t *cpu_map)
++{
++ int cpu1;
++
++ for_each_possible_cpu(cpu1)
++ if (cpus_are_siblings(cpu, cpu1))
++ cpumask_set_cpu(cpu1, cpu_map);
++}
++
++static void fill_cpumask_cluster(int cpu, cpumask_t *cpu_map)
++{
++ int cpu1;
++ int cluster = cpu_cluster(&cpu_data[cpu]);
++
++ for_each_possible_cpu(cpu1)
++ if (cpu_cluster(&cpu_data[cpu1]) == cluster)
++ cpumask_set_cpu(cpu1, cpu_map);
++}
++
+ static int __populate_cache_leaves(unsigned int cpu)
+ {
+ struct cpuinfo_mips *c = ¤t_cpu_data;
+@@ -68,14 +87,20 @@ static int __populate_cache_leaves(unsigned int cpu)
+ struct cacheinfo *this_leaf = this_cpu_ci->info_list;
+
+ if (c->icache.waysize) {
++ /* L1 caches are per core */
++ fill_cpumask_siblings(cpu, &this_leaf->shared_cpu_map);
+ populate_cache(dcache, this_leaf, 1, CACHE_TYPE_DATA);
++ fill_cpumask_siblings(cpu, &this_leaf->shared_cpu_map);
+ populate_cache(icache, this_leaf, 1, CACHE_TYPE_INST);
+ } else {
+ populate_cache(dcache, this_leaf, 1, CACHE_TYPE_UNIFIED);
+ }
+
+- if (c->scache.waysize)
++ if (c->scache.waysize) {
++ /* L2 cache is per cluster */
++ fill_cpumask_cluster(cpu, &this_leaf->shared_cpu_map);
+ populate_cache(scache, this_leaf, 2, CACHE_TYPE_UNIFIED);
++ }
+
+ if (c->tcache.waysize)
+ populate_cache(tcache, this_leaf, 3, CACHE_TYPE_UNIFIED);
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index db230a35609b..c846300b7836 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -1095,6 +1095,23 @@ void __init pnv_pci_init(void)
+ if (!firmware_has_feature(FW_FEATURE_OPAL))
+ return;
+
++#ifdef CONFIG_PCIEPORTBUS
++ /*
++ * On PowerNV PCIe devices are (currently) managed in cooperation
++ * with firmware. This isn't *strictly* required, but there's enough
++ * assumptions baked into both firmware and the platform code that
++ * it's unwise to allow the portbus services to be used.
++ *
++ * We need to fix this eventually, but for now set this flag to disable
++ * the portbus driver. The AER service isn't required since that AER
++ * events are handled via EEH. The pciehp hotplug driver can't work
++ * without kernel changes (and portbus binding breaks pnv_php). The
++ * other services also require some thinking about how we're going
++ * to integrate them.
++ */
++ pcie_ports_disabled = true;
++#endif
++
+ /* Look for IODA IO-Hubs. */
+ for_each_compatible_node(np, NULL, "ibm,ioda-hub") {
+ pnv_pci_init_ioda_hub(np);
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index d5af93721299..6473af8903c5 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -171,6 +171,8 @@ static const unsigned long exynos5x_clk_regs[] __initconst = {
+ GATE_BUS_CPU,
+ GATE_SCLK_CPU,
+ CLKOUT_CMU_CPU,
++ APLL_CON0,
++ KPLL_CON0,
+ CPLL_CON0,
+ DPLL_CON0,
+ EPLL_CON0,
+diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c
+index 523b712770ac..38432721069f 100644
+--- a/drivers/crypto/virtio/virtio_crypto_algs.c
++++ b/drivers/crypto/virtio/virtio_crypto_algs.c
+@@ -449,6 +449,11 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req,
+ goto free;
+ }
+ memcpy(iv, req->info, ivsize);
++ if (!vc_sym_req->encrypt)
++ scatterwalk_map_and_copy(req->info, req->src,
++ req->nbytes - AES_BLOCK_SIZE,
++ AES_BLOCK_SIZE, 0);
++
+ sg_init_one(&iv_sg, iv, ivsize);
+ sgs[num_out++] = &iv_sg;
+ vc_sym_req->iv = iv;
+@@ -585,6 +590,10 @@ static void virtio_crypto_ablkcipher_finalize_req(
+ struct ablkcipher_request *req,
+ int err)
+ {
++ if (vc_sym_req->encrypt)
++ scatterwalk_map_and_copy(req->info, req->dst,
++ req->nbytes - AES_BLOCK_SIZE,
++ AES_BLOCK_SIZE, 0);
+ crypto_finalize_ablkcipher_request(vc_sym_req->base.dataq->engine,
+ req, err);
+ kzfree(vc_sym_req->iv);
+diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
+index 23fb2fa04000..b94cece58b98 100644
+--- a/drivers/dma/ioat/dma.c
++++ b/drivers/dma/ioat/dma.c
+@@ -388,10 +388,11 @@ ioat_alloc_ring(struct dma_chan *c, int order, gfp_t flags)
+
+ descs->virt = dma_alloc_coherent(to_dev(ioat_chan),
+ SZ_2M, &descs->hw, flags);
+- if (!descs->virt && (i > 0)) {
++ if (!descs->virt) {
+ int idx;
+
+ for (idx = 0; idx < i; idx++) {
++ descs = &ioat_chan->descs[idx];
+ dma_free_coherent(to_dev(ioat_chan), SZ_2M,
+ descs->virt, descs->hw);
+ descs->virt = NULL;
+diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c
+index 6bfa217ed6d0..ba3c3791f9dc 100644
+--- a/drivers/dma/k3dma.c
++++ b/drivers/dma/k3dma.c
+@@ -222,9 +222,11 @@ static irqreturn_t k3_dma_int_handler(int irq, void *dev_id)
+ c = p->vchan;
+ if (c && (tc1 & BIT(i))) {
+ spin_lock_irqsave(&c->vc.lock, flags);
+- vchan_cookie_complete(&p->ds_run->vd);
+- p->ds_done = p->ds_run;
+- p->ds_run = NULL;
++ if (p->ds_run != NULL) {
++ vchan_cookie_complete(&p->ds_run->vd);
++ p->ds_done = p->ds_run;
++ p->ds_run = NULL;
++ }
+ spin_unlock_irqrestore(&c->vc.lock, flags);
+ }
+ if (c && (tc2 & BIT(i))) {
+@@ -264,6 +266,10 @@ static int k3_dma_start_txd(struct k3_dma_chan *c)
+ if (BIT(c->phy->idx) & k3_dma_get_chan_stat(d))
+ return -EAGAIN;
+
++ /* Avoid losing track of ds_run if a transaction is in flight */
++ if (c->phy->ds_run)
++ return -EAGAIN;
++
+ if (vd) {
+ struct k3_dma_desc_sw *ds =
+ container_of(vd, struct k3_dma_desc_sw, vd);
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index 3f10f9599f2c..1899d172590b 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -317,6 +317,7 @@ static int mpc8xxx_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ gc = &mpc8xxx_gc->gc;
++ gc->parent = &pdev->dev;
+
+ if (of_property_read_bool(np, "little-endian")) {
+ ret = bgpio_init(gc, &pdev->dev, 4,
+diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
+index 3f5fcdd5a429..a9238fb15013 100644
+--- a/drivers/gpio/gpio-zynq.c
++++ b/drivers/gpio/gpio-zynq.c
+@@ -639,6 +639,8 @@ static void zynq_gpio_restore_context(struct zynq_gpio *gpio)
+ unsigned int bank_num;
+
+ for (bank_num = 0; bank_num < gpio->p_data->max_bank; bank_num++) {
++ writel_relaxed(ZYNQ_GPIO_IXR_DISABLE_ALL, gpio->base_addr +
++ ZYNQ_GPIO_INTDIS_OFFSET(bank_num));
+ writel_relaxed(gpio->context.datalsw[bank_num],
+ gpio->base_addr +
+ ZYNQ_GPIO_DATA_LSW_OFFSET(bank_num));
+@@ -648,9 +650,6 @@ static void zynq_gpio_restore_context(struct zynq_gpio *gpio)
+ writel_relaxed(gpio->context.dirm[bank_num],
+ gpio->base_addr +
+ ZYNQ_GPIO_DIRM_OFFSET(bank_num));
+- writel_relaxed(gpio->context.int_en[bank_num],
+- gpio->base_addr +
+- ZYNQ_GPIO_INTEN_OFFSET(bank_num));
+ writel_relaxed(gpio->context.int_type[bank_num],
+ gpio->base_addr +
+ ZYNQ_GPIO_INTTYPE_OFFSET(bank_num));
+@@ -660,6 +659,9 @@ static void zynq_gpio_restore_context(struct zynq_gpio *gpio)
+ writel_relaxed(gpio->context.int_any[bank_num],
+ gpio->base_addr +
+ ZYNQ_GPIO_INTANY_OFFSET(bank_num));
++ writel_relaxed(~(gpio->context.int_en[bank_num]),
++ gpio->base_addr +
++ ZYNQ_GPIO_INTEN_OFFSET(bank_num));
+ }
+ }
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index a24f13df42f4..12472b84a71c 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -3757,8 +3757,9 @@ static struct gpio_desc *gpiod_find(struct device *dev, const char *con_id,
+
+ if (chip->ngpio <= p->chip_hwnum) {
+ dev_err(dev,
+- "requested GPIO %d is out of range [0..%d] for chip %s\n",
+- idx, chip->ngpio, chip->label);
++ "requested GPIO %u (%u) is out of range [0..%u] for chip %s\n",
++ idx, p->chip_hwnum, chip->ngpio - 1,
++ chip->label);
+ return ERR_PTR(-EINVAL);
+ }
+
+diff --git a/drivers/gpu/drm/arm/malidp_mw.c b/drivers/gpu/drm/arm/malidp_mw.c
+index 91472e5e0c8b..7266d3c8b8f4 100644
+--- a/drivers/gpu/drm/arm/malidp_mw.c
++++ b/drivers/gpu/drm/arm/malidp_mw.c
+@@ -55,7 +55,7 @@ malidp_mw_connector_mode_valid(struct drm_connector *connector,
+ return MODE_OK;
+ }
+
+-const struct drm_connector_helper_funcs malidp_mw_connector_helper_funcs = {
++static const struct drm_connector_helper_funcs malidp_mw_connector_helper_funcs = {
+ .get_modes = malidp_mw_connector_get_modes,
+ .mode_valid = malidp_mw_connector_mode_valid,
+ };
+diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
+index 7a0e6dbbad2e..ef383fd42988 100644
+--- a/drivers/gpu/drm/i915/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/i915_gem_context.c
+@@ -770,18 +770,19 @@ int i915_gem_context_destroy_ioctl(struct drm_device *dev, void *data,
+ if (args->ctx_id == DEFAULT_CONTEXT_HANDLE)
+ return -ENOENT;
+
++ ret = i915_mutex_lock_interruptible(dev);
++ if (ret)
++ return ret;
++
+ ctx = i915_gem_context_lookup(file_priv, args->ctx_id);
+- if (!ctx)
++ if (!ctx) {
++ mutex_unlock(&dev->struct_mutex);
+ return -ENOENT;
+-
+- ret = mutex_lock_interruptible(&dev->struct_mutex);
+- if (ret)
+- goto out;
++ }
+
+ __destroy_hw_context(ctx, file_priv);
+ mutex_unlock(&dev->struct_mutex);
+
+-out:
+ i915_gem_context_put(ctx);
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+index f77c81db161b..627f8dc91d0e 100644
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -732,8 +732,8 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags,
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ if (!(flags & TTM_PAGE_FLAG_DMA32) &&
+ (npages - i) >= HPAGE_PMD_NR) {
+- for (j = 0; j < HPAGE_PMD_NR; ++j)
+- if (p++ != pages[i + j])
++ for (j = 1; j < HPAGE_PMD_NR; ++j)
++ if (++p != pages[i + j])
+ break;
+
+ if (j == HPAGE_PMD_NR)
+@@ -767,8 +767,8 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags,
+ if (!p)
+ break;
+
+- for (j = 0; j < HPAGE_PMD_NR; ++j)
+- if (p++ != pages[i + j])
++ for (j = 1; j < HPAGE_PMD_NR; ++j)
++ if (++p != pages[i + j])
+ break;
+
+ if (j != HPAGE_PMD_NR)
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index c7cff929b419..c4ba2d28dd73 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -257,13 +257,14 @@ out:
+ static __poll_t hidraw_poll(struct file *file, poll_table *wait)
+ {
+ struct hidraw_list *list = file->private_data;
++ __poll_t mask = EPOLLOUT | EPOLLWRNORM; /* hidraw is always writable */
+
+ poll_wait(file, &list->hidraw->wait, wait);
+ if (list->head != list->tail)
+- return EPOLLIN | EPOLLRDNORM;
++ mask |= EPOLLIN | EPOLLRDNORM;
+ if (!list->hidraw->exist)
+- return EPOLLERR | EPOLLHUP;
+- return 0;
++ mask |= EPOLLERR | EPOLLHUP;
++ return mask;
+ }
+
+ static int hidraw_open(struct inode *inode, struct file *file)
+diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
+index 8508dbac2657..29e63330c1b5 100644
+--- a/drivers/hid/uhid.c
++++ b/drivers/hid/uhid.c
+@@ -769,13 +769,14 @@ unlock:
+ static __poll_t uhid_char_poll(struct file *file, poll_table *wait)
+ {
+ struct uhid_device *uhid = file->private_data;
++ __poll_t mask = EPOLLOUT | EPOLLWRNORM; /* uhid is always writable */
+
+ poll_wait(file, &uhid->waitq, wait);
+
+ if (uhid->head != uhid->tail)
+- return EPOLLIN | EPOLLRDNORM;
++ mask |= EPOLLIN | EPOLLRDNORM;
+
+- return EPOLLOUT | EPOLLWRNORM;
++ return mask;
+ }
+
+ static const struct file_operations uhid_fops = {
+diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
+index ea24701beb3e..186f71927006 100644
+--- a/drivers/iio/imu/adis16480.c
++++ b/drivers/iio/imu/adis16480.c
+@@ -376,12 +376,14 @@ static int adis16480_get_calibbias(struct iio_dev *indio_dev,
+ case IIO_MAGN:
+ case IIO_PRESSURE:
+ ret = adis_read_reg_16(&st->adis, reg, &val16);
+- *bias = sign_extend32(val16, 15);
++ if (ret == 0)
++ *bias = sign_extend32(val16, 15);
+ break;
+ case IIO_ANGL_VEL:
+ case IIO_ACCEL:
+ ret = adis_read_reg_32(&st->adis, reg, &val32);
+- *bias = sign_extend32(val32, 31);
++ if (ret == 0)
++ *bias = sign_extend32(val32, 31);
+ break;
+ default:
+ ret = -EINVAL;
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index bc2b9e038439..a69632f1fab0 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -1446,7 +1446,7 @@ struct ib_srq *bnxt_re_create_srq(struct ib_pd *ib_pd,
+ dev_err(rdev_to_dev(rdev), "SRQ copy to udata failed!");
+ bnxt_qplib_destroy_srq(&rdev->qplib_res,
+ &srq->qplib_srq);
+- goto exit;
++ goto fail;
+ }
+ }
+ if (nq)
+@@ -3368,8 +3368,10 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
+ int rc;
+
+ rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
+- if (rc)
++ if (rc) {
+ dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc);
++ return rc;
++ }
+
+ if (mr->pages) {
+ rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index 249efa0a6aba..c15335dc8f61 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -2273,13 +2273,13 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
+ /* Add qp to flush list of the CQ */
+ bnxt_qplib_add_flush_qp(qp);
+ } else {
++ /* Before we complete, do WA 9060 */
++ if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
++ cqe_sq_cons)) {
++ *lib_qp = qp;
++ goto out;
++ }
+ if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
+- /* Before we complete, do WA 9060 */
+- if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
+- cqe_sq_cons)) {
+- *lib_qp = qp;
+- goto out;
+- }
+ cqe->status = CQ_REQ_STATUS_OK;
+ cqe++;
+ (*budget)--;
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index bd1fdadf7ba0..18fd9aa6510f 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -457,7 +457,7 @@ struct mlx5_ib_mr *mlx5_mr_cache_alloc(struct mlx5_ib_dev *dev, int entry)
+
+ if (entry < 0 || entry >= MAX_MR_CACHE_ENTRIES) {
+ mlx5_ib_err(dev, "cache entry %d is out of range\n", entry);
+- return NULL;
++ return ERR_PTR(-EINVAL);
+ }
+
+ ent = &cache->ent[entry];
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index ea4afdeb06a4..bc979a85a505 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1324,9 +1324,11 @@ static int srpt_build_cmd_rsp(struct srpt_rdma_ch *ch,
+ struct srpt_send_ioctx *ioctx, u64 tag,
+ int status)
+ {
++ struct se_cmd *cmd = &ioctx->cmd;
+ struct srp_rsp *srp_rsp;
+ const u8 *sense_data;
+ int sense_data_len, max_sense_len;
++ u32 resid = cmd->residual_count;
+
+ /*
+ * The lowest bit of all SAM-3 status codes is zero (see also
+@@ -1348,6 +1350,28 @@ static int srpt_build_cmd_rsp(struct srpt_rdma_ch *ch,
+ srp_rsp->tag = tag;
+ srp_rsp->status = status;
+
++ if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
++ if (cmd->data_direction == DMA_TO_DEVICE) {
++ /* residual data from an underflow write */
++ srp_rsp->flags = SRP_RSP_FLAG_DOUNDER;
++ srp_rsp->data_out_res_cnt = cpu_to_be32(resid);
++ } else if (cmd->data_direction == DMA_FROM_DEVICE) {
++ /* residual data from an underflow read */
++ srp_rsp->flags = SRP_RSP_FLAG_DIUNDER;
++ srp_rsp->data_in_res_cnt = cpu_to_be32(resid);
++ }
++ } else if (cmd->se_cmd_flags & SCF_OVERFLOW_BIT) {
++ if (cmd->data_direction == DMA_TO_DEVICE) {
++ /* residual data from an overflow write */
++ srp_rsp->flags = SRP_RSP_FLAG_DOOVER;
++ srp_rsp->data_out_res_cnt = cpu_to_be32(resid);
++ } else if (cmd->data_direction == DMA_FROM_DEVICE) {
++ /* residual data from an overflow read */
++ srp_rsp->flags = SRP_RSP_FLAG_DIOVER;
++ srp_rsp->data_in_res_cnt = cpu_to_be32(resid);
++ }
++ }
++
+ if (sense_data_len) {
+ BUILD_BUG_ON(MIN_MAX_RSP_SIZE <= sizeof(*srp_rsp));
+ max_sense_len = ch->max_ti_iu_len - sizeof(*srp_rsp);
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index bc14825edc9c..ee25ec22778e 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -650,6 +650,7 @@ err_put_group:
+ mutex_unlock(&group->mutex);
+ dev->iommu_group = NULL;
+ kobject_put(group->devices_kobj);
++ sysfs_remove_link(group->devices_kobj, device->name);
+ err_free_name:
+ kfree(device->name);
+ err_remove_link:
+diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
+index f9f69f7111a9..154cf44439cb 100644
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -394,7 +394,7 @@ static size_t mtk_iommu_unmap(struct iommu_domain *domain,
+
+ static void mtk_iommu_iotlb_sync(struct iommu_domain *domain)
+ {
+- mtk_iommu_tlb_sync(mtk_iommu_get_m4u_data());
++ mtk_iommu_tlb_flush_all(mtk_iommu_get_m4u_data());
+ }
+
+ static phys_addr_t mtk_iommu_iova_to_phys(struct iommu_domain *domain,
+diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
+index c5aadd8dd23f..33a67a3685e6 100644
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -203,7 +203,6 @@ struct ov6650 {
+ unsigned long pclk_max; /* from resolution and format */
+ struct v4l2_fract tpf; /* as requested with s_frame_interval */
+ u32 code;
+- enum v4l2_colorspace colorspace;
+ };
+
+
+@@ -216,6 +215,17 @@ static u32 ov6650_codes[] = {
+ MEDIA_BUS_FMT_Y8_1X8,
+ };
+
++static const struct v4l2_mbus_framefmt ov6650_def_fmt = {
++ .width = W_CIF,
++ .height = H_CIF,
++ .code = MEDIA_BUS_FMT_SBGGR8_1X8,
++ .colorspace = V4L2_COLORSPACE_SRGB,
++ .field = V4L2_FIELD_NONE,
++ .ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT,
++ .quantization = V4L2_QUANTIZATION_DEFAULT,
++ .xfer_func = V4L2_XFER_FUNC_DEFAULT,
++};
++
+ /* read a register */
+ static int ov6650_reg_read(struct i2c_client *client, u8 reg, u8 *val)
+ {
+@@ -517,12 +527,20 @@ static int ov6650_get_fmt(struct v4l2_subdev *sd,
+ if (format->pad)
+ return -EINVAL;
+
+- mf->width = priv->rect.width >> priv->half_scale;
+- mf->height = priv->rect.height >> priv->half_scale;
+- mf->code = priv->code;
+- mf->colorspace = priv->colorspace;
+- mf->field = V4L2_FIELD_NONE;
++ /* initialize response with default media bus frame format */
++ *mf = ov6650_def_fmt;
+
++ /* update media bus format code and frame size */
++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++ mf->width = cfg->try_fmt.width;
++ mf->height = cfg->try_fmt.height;
++ mf->code = cfg->try_fmt.code;
++
++ } else {
++ mf->width = priv->rect.width >> priv->half_scale;
++ mf->height = priv->rect.height >> priv->half_scale;
++ mf->code = priv->code;
++ }
+ return 0;
+ }
+
+@@ -627,11 +645,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ priv->pclk_max = 8000000;
+ }
+
+- if (code == MEDIA_BUS_FMT_SBGGR8_1X8)
+- priv->colorspace = V4L2_COLORSPACE_SRGB;
+- else if (code != 0)
+- priv->colorspace = V4L2_COLORSPACE_JPEG;
+-
+ if (half_scale) {
+ dev_dbg(&client->dev, "max resolution: QCIF\n");
+ coma_set |= COMA_QCIF;
+@@ -665,11 +678,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ if (!ret)
+ priv->code = code;
+
+- if (!ret) {
+- mf->colorspace = priv->colorspace;
+- mf->width = priv->rect.width >> half_scale;
+- mf->height = priv->rect.height >> half_scale;
+- }
+ return ret;
+ }
+
+@@ -688,8 +696,6 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ v4l_bound_align_image(&mf->width, 2, W_CIF, 1,
+ &mf->height, 2, H_CIF, 1, 0);
+
+- mf->field = V4L2_FIELD_NONE;
+-
+ switch (mf->code) {
+ case MEDIA_BUS_FMT_Y10_1X10:
+ mf->code = MEDIA_BUS_FMT_Y8_1X8;
+@@ -699,20 +705,39 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ case MEDIA_BUS_FMT_YUYV8_2X8:
+ case MEDIA_BUS_FMT_VYUY8_2X8:
+ case MEDIA_BUS_FMT_UYVY8_2X8:
+- mf->colorspace = V4L2_COLORSPACE_JPEG;
+ break;
+ default:
+ mf->code = MEDIA_BUS_FMT_SBGGR8_1X8;
+ /* fall through */
+ case MEDIA_BUS_FMT_SBGGR8_1X8:
+- mf->colorspace = V4L2_COLORSPACE_SRGB;
+ break;
+ }
+
+- if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE)
+- return ov6650_s_fmt(sd, mf);
+- cfg->try_fmt = *mf;
++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++ /* store media bus format code and frame size in pad config */
++ cfg->try_fmt.width = mf->width;
++ cfg->try_fmt.height = mf->height;
++ cfg->try_fmt.code = mf->code;
+
++ /* return default mbus frame format updated with pad config */
++ *mf = ov6650_def_fmt;
++ mf->width = cfg->try_fmt.width;
++ mf->height = cfg->try_fmt.height;
++ mf->code = cfg->try_fmt.code;
++
++ } else {
++ /* apply new media bus format code and frame size */
++ int ret = ov6650_s_fmt(sd, mf);
++
++ if (ret)
++ return ret;
++
++ /* return default format updated with active size and code */
++ *mf = ov6650_def_fmt;
++ mf->width = priv->rect.width >> priv->half_scale;
++ mf->height = priv->rect.height >> priv->half_scale;
++ mf->code = priv->code;
++ }
+ return 0;
+ }
+
+@@ -1006,7 +1031,6 @@ static int ov6650_probe(struct i2c_client *client,
+ priv->rect.height = H_CIF;
+ priv->half_scale = false;
+ priv->code = MEDIA_BUS_FMT_YUYV8_2X8;
+- priv->colorspace = V4L2_COLORSPACE_JPEG;
+
+ ret = ov6650_video_probe(client);
+ if (ret)
+diff --git a/drivers/media/platform/cadence/cdns-csi2rx.c b/drivers/media/platform/cadence/cdns-csi2rx.c
+index 43e43c7b3e98..6f64703d2c7c 100644
+--- a/drivers/media/platform/cadence/cdns-csi2rx.c
++++ b/drivers/media/platform/cadence/cdns-csi2rx.c
+@@ -129,7 +129,7 @@ static int csi2rx_start(struct csi2rx_priv *csi2rx)
+ */
+ for (i = csi2rx->num_lanes; i < csi2rx->max_lanes; i++) {
+ unsigned int idx = find_first_zero_bit(&lanes_used,
+- sizeof(lanes_used));
++ csi2rx->max_lanes);
+ set_bit(idx, &lanes_used);
+ reg |= CSI2RX_STATIC_CFG_DLANE_MAP(i, i + 1);
+ }
+diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c
+index a920164f53f1..39340abefd14 100644
+--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c
++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c
+@@ -316,7 +316,7 @@ static int isp_video_release(struct file *file)
+ ivc->streaming = 0;
+ }
+
+- vb2_fop_release(file);
++ _vb2_fop_release(file, NULL);
+
+ if (v4l2_fh_is_singular_file(file)) {
+ fimc_pipeline_call(&ivc->ve, close);
+diff --git a/drivers/media/platform/rcar-vin/rcar-v4l2.c b/drivers/media/platform/rcar-vin/rcar-v4l2.c
+index 5a54779cfc27..1236e6e8228c 100644
+--- a/drivers/media/platform/rcar-vin/rcar-v4l2.c
++++ b/drivers/media/platform/rcar-vin/rcar-v4l2.c
+@@ -196,6 +196,7 @@ static int rvin_try_format(struct rvin_dev *vin, u32 which,
+ ret = v4l2_subdev_call(sd, pad, set_fmt, pad_cfg, &format);
+ if (ret < 0 && ret != -ENOIOCTLCMD)
+ goto done;
++ ret = 0;
+
+ v4l2_fill_pix_format(pix, &format.format);
+
+@@ -230,7 +231,7 @@ static int rvin_try_format(struct rvin_dev *vin, u32 which,
+ done:
+ v4l2_subdev_free_pad_config(pad_cfg);
+
+- return 0;
++ return ret;
+ }
+
+ static int rvin_querycap(struct file *file, void *priv,
+diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c
+index b8886102c5ed..501030bb2e7d 100644
+--- a/drivers/media/usb/zr364xx/zr364xx.c
++++ b/drivers/media/usb/zr364xx/zr364xx.c
+@@ -703,7 +703,8 @@ static int zr364xx_vidioc_querycap(struct file *file, void *priv,
+ struct zr364xx_camera *cam = video_drvdata(file);
+
+ strlcpy(cap->driver, DRIVER_DESC, sizeof(cap->driver));
+- strlcpy(cap->card, cam->udev->product, sizeof(cap->card));
++ if (cam->udev->product)
++ strlcpy(cap->card, cam->udev->product, sizeof(cap->card));
+ strlcpy(cap->bus_info, dev_name(&cam->udev->dev),
+ sizeof(cap->bus_info));
+ cap->device_caps = V4L2_CAP_VIDEO_CAPTURE |
+diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
+index 5a17bfeb80d3..471263ffd9c9 100644
+--- a/drivers/misc/enclosure.c
++++ b/drivers/misc/enclosure.c
+@@ -419,10 +419,9 @@ int enclosure_remove_device(struct enclosure_device *edev, struct device *dev)
+ cdev = &edev->component[i];
+ if (cdev->dev == dev) {
+ enclosure_remove_links(cdev);
+- device_del(&cdev->cdev);
+ put_device(dev);
+ cdev->dev = NULL;
+- return device_add(&cdev->cdev);
++ return 0;
+ }
+ }
+ return -ENODEV;
+diff --git a/drivers/mtd/nand/onenand/omap2.c b/drivers/mtd/nand/onenand/omap2.c
+index 321137158ff3..a1ae05ddfeab 100644
+--- a/drivers/mtd/nand/onenand/omap2.c
++++ b/drivers/mtd/nand/onenand/omap2.c
+@@ -341,7 +341,8 @@ static inline int omap2_onenand_dma_transfer(struct omap2_onenand *c,
+ struct dma_async_tx_descriptor *tx;
+ dma_cookie_t cookie;
+
+- tx = dmaengine_prep_dma_memcpy(c->dma_chan, dst, src, count, 0);
++ tx = dmaengine_prep_dma_memcpy(c->dma_chan, dst, src, count,
++ DMA_CTRL_ACK | DMA_PREP_INTERRUPT);
+ if (!tx) {
+ dev_err(&c->pdev->dev, "Failed to prepare DMA memcpy\n");
+ return -EIO;
+diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
+index 2e183425facd..ff641c06003a 100644
+--- a/drivers/mtd/spi-nor/spi-nor.c
++++ b/drivers/mtd/spi-nor/spi-nor.c
+@@ -1294,7 +1294,7 @@ static int spi_nor_read(struct mtd_info *mtd, loff_t from, size_t len,
+ size_t *retlen, u_char *buf)
+ {
+ struct spi_nor *nor = mtd_to_spi_nor(mtd);
+- int ret;
++ ssize_t ret;
+
+ dev_dbg(nor->dev, "from 0x%08x, len %zd\n", (u32)from, len);
+
+@@ -1523,7 +1523,7 @@ static int macronix_quad_enable(struct spi_nor *nor)
+ */
+ static int write_sr_cr(struct spi_nor *nor, u8 *sr_cr)
+ {
+- int ret;
++ ssize_t ret;
+
+ write_enable(nor);
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index 3443cbdbab4a..d6fca00ecb88 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -547,6 +547,7 @@ static struct scatterlist *alloc_sgtable(int size)
+ if (new_page)
+ __free_page(new_page);
+ }
++ kfree(table);
+ return NULL;
+ }
+ alloc_size = min_t(int, size, PAGE_SIZE);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+index 64d976d872b8..6783b20d9681 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+@@ -102,13 +102,9 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+
+ /* allocate ucode sections in dram and set addresses */
+ ret = iwl_pcie_init_fw_sec(trans, fw, &prph_scratch->dram);
+- if (ret) {
+- dma_free_coherent(trans->dev,
+- sizeof(*prph_scratch),
+- prph_scratch,
+- trans_pcie->prph_scratch_dma_addr);
+- return ret;
+- }
++ if (ret)
++ goto err_free_prph_scratch;
++
+
+ /* Allocate prph information
+ * currently we don't assign to the prph info anything, but it would get
+@@ -116,16 +112,20 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+ prph_info = dma_alloc_coherent(trans->dev, sizeof(*prph_info),
+ &trans_pcie->prph_info_dma_addr,
+ GFP_KERNEL);
+- if (!prph_info)
+- return -ENOMEM;
++ if (!prph_info) {
++ ret = -ENOMEM;
++ goto err_free_prph_scratch;
++ }
+
+ /* Allocate context info */
+ ctxt_info_gen3 = dma_alloc_coherent(trans->dev,
+ sizeof(*ctxt_info_gen3),
+ &trans_pcie->ctxt_info_dma_addr,
+ GFP_KERNEL);
+- if (!ctxt_info_gen3)
+- return -ENOMEM;
++ if (!ctxt_info_gen3) {
++ ret = -ENOMEM;
++ goto err_free_prph_info;
++ }
+
+ ctxt_info_gen3->prph_info_base_addr =
+ cpu_to_le64(trans_pcie->prph_info_dma_addr);
+@@ -176,6 +176,20 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+ iwl_set_bit(trans, CSR_GP_CNTRL, CSR_AUTO_FUNC_INIT);
+
+ return 0;
++
++err_free_prph_info:
++ dma_free_coherent(trans->dev,
++ sizeof(*prph_info),
++ prph_info,
++ trans_pcie->prph_info_dma_addr);
++
++err_free_prph_scratch:
++ dma_free_coherent(trans->dev,
++ sizeof(*prph_scratch),
++ prph_scratch,
++ trans_pcie->prph_scratch_dma_addr);
++ return ret;
++
+ }
+
+ void iwl_pcie_ctxt_info_gen3_free(struct iwl_trans *trans)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/regd.c b/drivers/net/wireless/realtek/rtlwifi/regd.c
+index 1bf3eb25c1da..72ca370331fb 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/regd.c
++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c
+@@ -427,7 +427,7 @@ int rtl_regd_init(struct ieee80211_hw *hw,
+ struct wiphy *wiphy = hw->wiphy;
+ struct country_code_to_enum_rd *country = NULL;
+
+- if (wiphy == NULL || &rtlpriv->regd == NULL)
++ if (!wiphy)
+ return -EINVAL;
+
+ /* init country_code from efuse channel plan */
+diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
+index b57ee79f6d69..6d4ef0101ef6 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -78,7 +78,8 @@ static struct msi_domain_info dw_pcie_msi_domain_info = {
+ irqreturn_t dw_handle_msi_irq(struct pcie_port *pp)
+ {
+ int i, pos, irq;
+- u32 val, num_ctrls;
++ unsigned long val;
++ u32 status, num_ctrls;
+ irqreturn_t ret = IRQ_NONE;
+
+ num_ctrls = pp->num_vectors / MAX_MSI_IRQS_PER_CTRL;
+@@ -86,14 +87,14 @@ irqreturn_t dw_handle_msi_irq(struct pcie_port *pp)
+ for (i = 0; i < num_ctrls; i++) {
+ dw_pcie_rd_own_conf(pp, PCIE_MSI_INTR0_STATUS +
+ (i * MSI_REG_CTRL_BLOCK_SIZE),
+- 4, &val);
+- if (!val)
++ 4, &status);
++ if (!status)
+ continue;
+
+ ret = IRQ_HANDLED;
++ val = status;
+ pos = 0;
+- while ((pos = find_next_bit((unsigned long *) &val,
+- MAX_MSI_IRQS_PER_CTRL,
++ while ((pos = find_next_bit(&val, MAX_MSI_IRQS_PER_CTRL,
+ pos)) != MAX_MSI_IRQS_PER_CTRL) {
+ irq = irq_find_mapping(pp->irq_domain,
+ (i * MAX_MSI_IRQS_PER_CTRL) +
+diff --git a/drivers/pci/pcie/ptm.c b/drivers/pci/pcie/ptm.c
+index 98cfa30f3fae..9361f3aa26ab 100644
+--- a/drivers/pci/pcie/ptm.c
++++ b/drivers/pci/pcie/ptm.c
+@@ -21,7 +21,7 @@ static void pci_ptm_info(struct pci_dev *dev)
+ snprintf(clock_desc, sizeof(clock_desc), ">254ns");
+ break;
+ default:
+- snprintf(clock_desc, sizeof(clock_desc), "%udns",
++ snprintf(clock_desc, sizeof(clock_desc), "%uns",
+ dev->ptm_granularity);
+ break;
+ }
+diff --git a/drivers/pinctrl/intel/pinctrl-lewisburg.c b/drivers/pinctrl/intel/pinctrl-lewisburg.c
+index 99894647eddd..dc32c22bf19f 100644
+--- a/drivers/pinctrl/intel/pinctrl-lewisburg.c
++++ b/drivers/pinctrl/intel/pinctrl-lewisburg.c
+@@ -31,6 +31,7 @@
+ .npins = ((e) - (s) + 1), \
+ }
+
++/* Lewisburg */
+ static const struct pinctrl_pin_desc lbg_pins[] = {
+ /* GPP_A */
+ PINCTRL_PIN(0, "RCINB"),
+@@ -70,7 +71,7 @@ static const struct pinctrl_pin_desc lbg_pins[] = {
+ PINCTRL_PIN(33, "SRCCLKREQB_4"),
+ PINCTRL_PIN(34, "SRCCLKREQB_5"),
+ PINCTRL_PIN(35, "GPP_B_11"),
+- PINCTRL_PIN(36, "GLB_RST_WARN_N"),
++ PINCTRL_PIN(36, "SLP_S0B"),
+ PINCTRL_PIN(37, "PLTRSTB"),
+ PINCTRL_PIN(38, "SPKR"),
+ PINCTRL_PIN(39, "GPP_B_15"),
+@@ -183,96 +184,96 @@ static const struct pinctrl_pin_desc lbg_pins[] = {
+ PINCTRL_PIN(141, "GBE_PCI_DIS"),
+ PINCTRL_PIN(142, "GBE_LAN_DIS"),
+ PINCTRL_PIN(143, "GPP_I_10"),
+- PINCTRL_PIN(144, "GPIO_RCOMP_3P3"),
+ /* GPP_J */
+- PINCTRL_PIN(145, "GBE_LED_0_0"),
+- PINCTRL_PIN(146, "GBE_LED_0_1"),
+- PINCTRL_PIN(147, "GBE_LED_1_0"),
+- PINCTRL_PIN(148, "GBE_LED_1_1"),
+- PINCTRL_PIN(149, "GBE_LED_2_0"),
+- PINCTRL_PIN(150, "GBE_LED_2_1"),
+- PINCTRL_PIN(151, "GBE_LED_3_0"),
+- PINCTRL_PIN(152, "GBE_LED_3_1"),
+- PINCTRL_PIN(153, "GBE_SCL_0"),
+- PINCTRL_PIN(154, "GBE_SDA_0"),
+- PINCTRL_PIN(155, "GBE_SCL_1"),
+- PINCTRL_PIN(156, "GBE_SDA_1"),
+- PINCTRL_PIN(157, "GBE_SCL_2"),
+- PINCTRL_PIN(158, "GBE_SDA_2"),
+- PINCTRL_PIN(159, "GBE_SCL_3"),
+- PINCTRL_PIN(160, "GBE_SDA_3"),
+- PINCTRL_PIN(161, "GBE_SDP_0_0"),
+- PINCTRL_PIN(162, "GBE_SDP_0_1"),
+- PINCTRL_PIN(163, "GBE_SDP_1_0"),
+- PINCTRL_PIN(164, "GBE_SDP_1_1"),
+- PINCTRL_PIN(165, "GBE_SDP_2_0"),
+- PINCTRL_PIN(166, "GBE_SDP_2_1"),
+- PINCTRL_PIN(167, "GBE_SDP_3_0"),
+- PINCTRL_PIN(168, "GBE_SDP_3_1"),
++ PINCTRL_PIN(144, "GBE_LED_0_0"),
++ PINCTRL_PIN(145, "GBE_LED_0_1"),
++ PINCTRL_PIN(146, "GBE_LED_1_0"),
++ PINCTRL_PIN(147, "GBE_LED_1_1"),
++ PINCTRL_PIN(148, "GBE_LED_2_0"),
++ PINCTRL_PIN(149, "GBE_LED_2_1"),
++ PINCTRL_PIN(150, "GBE_LED_3_0"),
++ PINCTRL_PIN(151, "GBE_LED_3_1"),
++ PINCTRL_PIN(152, "GBE_SCL_0"),
++ PINCTRL_PIN(153, "GBE_SDA_0"),
++ PINCTRL_PIN(154, "GBE_SCL_1"),
++ PINCTRL_PIN(155, "GBE_SDA_1"),
++ PINCTRL_PIN(156, "GBE_SCL_2"),
++ PINCTRL_PIN(157, "GBE_SDA_2"),
++ PINCTRL_PIN(158, "GBE_SCL_3"),
++ PINCTRL_PIN(159, "GBE_SDA_3"),
++ PINCTRL_PIN(160, "GBE_SDP_0_0"),
++ PINCTRL_PIN(161, "GBE_SDP_0_1"),
++ PINCTRL_PIN(162, "GBE_SDP_1_0"),
++ PINCTRL_PIN(163, "GBE_SDP_1_1"),
++ PINCTRL_PIN(164, "GBE_SDP_2_0"),
++ PINCTRL_PIN(165, "GBE_SDP_2_1"),
++ PINCTRL_PIN(166, "GBE_SDP_3_0"),
++ PINCTRL_PIN(167, "GBE_SDP_3_1"),
+ /* GPP_K */
+- PINCTRL_PIN(169, "GBE_RMIICLK"),
+- PINCTRL_PIN(170, "GBE_RMII_TXD_0"),
+- PINCTRL_PIN(171, "GBE_RMII_TXD_1"),
++ PINCTRL_PIN(168, "GBE_RMIICLK"),
++ PINCTRL_PIN(169, "GBE_RMII_RXD_0"),
++ PINCTRL_PIN(170, "GBE_RMII_RXD_1"),
++ PINCTRL_PIN(171, "GBE_RMII_CRS_DV"),
+ PINCTRL_PIN(172, "GBE_RMII_TX_EN"),
+- PINCTRL_PIN(173, "GBE_RMII_CRS_DV"),
+- PINCTRL_PIN(174, "GBE_RMII_RXD_0"),
+- PINCTRL_PIN(175, "GBE_RMII_RXD_1"),
+- PINCTRL_PIN(176, "GBE_RMII_RX_ER"),
+- PINCTRL_PIN(177, "GBE_RMII_ARBIN"),
+- PINCTRL_PIN(178, "GBE_RMII_ARB_OUT"),
+- PINCTRL_PIN(179, "PE_RST_N"),
+- PINCTRL_PIN(180, "GPIO_RCOMP_1P8_3P3"),
++ PINCTRL_PIN(173, "GBE_RMII_TXD_0"),
++ PINCTRL_PIN(174, "GBE_RMII_TXD_1"),
++ PINCTRL_PIN(175, "GBE_RMII_RX_ER"),
++ PINCTRL_PIN(176, "GBE_RMII_ARBIN"),
++ PINCTRL_PIN(177, "GBE_RMII_ARB_OUT"),
++ PINCTRL_PIN(178, "PE_RST_N"),
+ /* GPP_G */
+- PINCTRL_PIN(181, "FAN_TACH_0"),
+- PINCTRL_PIN(182, "FAN_TACH_1"),
+- PINCTRL_PIN(183, "FAN_TACH_2"),
+- PINCTRL_PIN(184, "FAN_TACH_3"),
+- PINCTRL_PIN(185, "FAN_TACH_4"),
+- PINCTRL_PIN(186, "FAN_TACH_5"),
+- PINCTRL_PIN(187, "FAN_TACH_6"),
+- PINCTRL_PIN(188, "FAN_TACH_7"),
+- PINCTRL_PIN(189, "FAN_PWM_0"),
+- PINCTRL_PIN(190, "FAN_PWM_1"),
+- PINCTRL_PIN(191, "FAN_PWM_2"),
+- PINCTRL_PIN(192, "FAN_PWM_3"),
+- PINCTRL_PIN(193, "GSXDOUT"),
+- PINCTRL_PIN(194, "GSXSLOAD"),
+- PINCTRL_PIN(195, "GSXDIN"),
+- PINCTRL_PIN(196, "GSXSRESETB"),
+- PINCTRL_PIN(197, "GSXCLK"),
+- PINCTRL_PIN(198, "ADR_COMPLETE"),
+- PINCTRL_PIN(199, "NMIB"),
+- PINCTRL_PIN(200, "SMIB"),
+- PINCTRL_PIN(201, "SSATA_DEVSLP_0"),
+- PINCTRL_PIN(202, "SSATA_DEVSLP_1"),
+- PINCTRL_PIN(203, "SSATA_DEVSLP_2"),
+- PINCTRL_PIN(204, "SSATAXPCIE0_SSATAGP0"),
++ PINCTRL_PIN(179, "FAN_TACH_0"),
++ PINCTRL_PIN(180, "FAN_TACH_1"),
++ PINCTRL_PIN(181, "FAN_TACH_2"),
++ PINCTRL_PIN(182, "FAN_TACH_3"),
++ PINCTRL_PIN(183, "FAN_TACH_4"),
++ PINCTRL_PIN(184, "FAN_TACH_5"),
++ PINCTRL_PIN(185, "FAN_TACH_6"),
++ PINCTRL_PIN(186, "FAN_TACH_7"),
++ PINCTRL_PIN(187, "FAN_PWM_0"),
++ PINCTRL_PIN(188, "FAN_PWM_1"),
++ PINCTRL_PIN(189, "FAN_PWM_2"),
++ PINCTRL_PIN(190, "FAN_PWM_3"),
++ PINCTRL_PIN(191, "GSXDOUT"),
++ PINCTRL_PIN(192, "GSXSLOAD"),
++ PINCTRL_PIN(193, "GSXDIN"),
++ PINCTRL_PIN(194, "GSXSRESETB"),
++ PINCTRL_PIN(195, "GSXCLK"),
++ PINCTRL_PIN(196, "ADR_COMPLETE"),
++ PINCTRL_PIN(197, "NMIB"),
++ PINCTRL_PIN(198, "SMIB"),
++ PINCTRL_PIN(199, "SSATA_DEVSLP_0"),
++ PINCTRL_PIN(200, "SSATA_DEVSLP_1"),
++ PINCTRL_PIN(201, "SSATA_DEVSLP_2"),
++ PINCTRL_PIN(202, "SSATAXPCIE0_SSATAGP0"),
+ /* GPP_H */
+- PINCTRL_PIN(205, "SRCCLKREQB_6"),
+- PINCTRL_PIN(206, "SRCCLKREQB_7"),
+- PINCTRL_PIN(207, "SRCCLKREQB_8"),
+- PINCTRL_PIN(208, "SRCCLKREQB_9"),
+- PINCTRL_PIN(209, "SRCCLKREQB_10"),
+- PINCTRL_PIN(210, "SRCCLKREQB_11"),
+- PINCTRL_PIN(211, "SRCCLKREQB_12"),
+- PINCTRL_PIN(212, "SRCCLKREQB_13"),
+- PINCTRL_PIN(213, "SRCCLKREQB_14"),
+- PINCTRL_PIN(214, "SRCCLKREQB_15"),
+- PINCTRL_PIN(215, "SML2CLK"),
+- PINCTRL_PIN(216, "SML2DATA"),
+- PINCTRL_PIN(217, "SML2ALERTB"),
+- PINCTRL_PIN(218, "SML3CLK"),
+- PINCTRL_PIN(219, "SML3DATA"),
+- PINCTRL_PIN(220, "SML3ALERTB"),
+- PINCTRL_PIN(221, "SML4CLK"),
+- PINCTRL_PIN(222, "SML4DATA"),
+- PINCTRL_PIN(223, "SML4ALERTB"),
+- PINCTRL_PIN(224, "SSATAXPCIE1_SSATAGP1"),
+- PINCTRL_PIN(225, "SSATAXPCIE2_SSATAGP2"),
+- PINCTRL_PIN(226, "SSATAXPCIE3_SSATAGP3"),
+- PINCTRL_PIN(227, "SSATAXPCIE4_SSATAGP4"),
+- PINCTRL_PIN(228, "SSATAXPCIE5_SSATAGP5"),
++ PINCTRL_PIN(203, "SRCCLKREQB_6"),
++ PINCTRL_PIN(204, "SRCCLKREQB_7"),
++ PINCTRL_PIN(205, "SRCCLKREQB_8"),
++ PINCTRL_PIN(206, "SRCCLKREQB_9"),
++ PINCTRL_PIN(207, "SRCCLKREQB_10"),
++ PINCTRL_PIN(208, "SRCCLKREQB_11"),
++ PINCTRL_PIN(209, "SRCCLKREQB_12"),
++ PINCTRL_PIN(210, "SRCCLKREQB_13"),
++ PINCTRL_PIN(211, "SRCCLKREQB_14"),
++ PINCTRL_PIN(212, "SRCCLKREQB_15"),
++ PINCTRL_PIN(213, "SML2CLK"),
++ PINCTRL_PIN(214, "SML2DATA"),
++ PINCTRL_PIN(215, "SML2ALERTB"),
++ PINCTRL_PIN(216, "SML3CLK"),
++ PINCTRL_PIN(217, "SML3DATA"),
++ PINCTRL_PIN(218, "SML3ALERTB"),
++ PINCTRL_PIN(219, "SML4CLK"),
++ PINCTRL_PIN(220, "SML4DATA"),
++ PINCTRL_PIN(221, "SML4ALERTB"),
++ PINCTRL_PIN(222, "SSATAXPCIE1_SSATAGP1"),
++ PINCTRL_PIN(223, "SSATAXPCIE2_SSATAGP2"),
++ PINCTRL_PIN(224, "SSATAXPCIE3_SSATAGP3"),
++ PINCTRL_PIN(225, "SSATAXPCIE4_SSATAGP4"),
++ PINCTRL_PIN(226, "SSATAXPCIE5_SSATAGP5"),
+ /* GPP_L */
++ PINCTRL_PIN(227, "GPP_L_0"),
++ PINCTRL_PIN(228, "EC_CSME_INTR_OUT"),
+ PINCTRL_PIN(229, "VISA2CH0_D0"),
+ PINCTRL_PIN(230, "VISA2CH0_D1"),
+ PINCTRL_PIN(231, "VISA2CH0_D2"),
+diff --git a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
+index 8782c348ebe9..4eda888b4d04 100644
+--- a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
++++ b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
+@@ -496,7 +496,7 @@ static int ti_iodelay_dt_node_to_map(struct pinctrl_dev *pctldev,
+ return -EINVAL;
+
+ rows = pinctrl_count_index_with_args(np, name);
+- if (rows == -EINVAL)
++ if (rows < 0)
+ return rows;
+
+ *map = devm_kzalloc(iod->dev, sizeof(**map), GFP_KERNEL);
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index 22eac449d3a3..339b753ba447 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -463,13 +463,7 @@ static void kbd_led_update(struct work_struct *work)
+
+ asus = container_of(work, struct asus_wmi, kbd_led_work);
+
+- /*
+- * bits 0-2: level
+- * bit 7: light on/off
+- */
+- if (asus->kbd_led_wk > 0)
+- ctrl_param = 0x80 | (asus->kbd_led_wk & 0x7F);
+-
++ ctrl_param = 0x80 | (asus->kbd_led_wk & 0x7F);
+ asus_wmi_set_devstate(ASUS_WMI_DEVID_KBD_BACKLIGHT, ctrl_param, NULL);
+ led_classdev_notify_brightness_hw_changed(&asus->kbd_led, asus->kbd_led_wk);
+ }
+diff --git a/drivers/platform/x86/gpd-pocket-fan.c b/drivers/platform/x86/gpd-pocket-fan.c
+index be85ed966bf3..73eb1572b966 100644
+--- a/drivers/platform/x86/gpd-pocket-fan.c
++++ b/drivers/platform/x86/gpd-pocket-fan.c
+@@ -16,17 +16,27 @@
+
+ #define MAX_SPEED 3
+
+-static int temp_limits[3] = { 55000, 60000, 65000 };
++#define TEMP_LIMIT0_DEFAULT 55000
++#define TEMP_LIMIT1_DEFAULT 60000
++#define TEMP_LIMIT2_DEFAULT 65000
++
++#define HYSTERESIS_DEFAULT 3000
++
++#define SPEED_ON_AC_DEFAULT 2
++
++static int temp_limits[3] = {
++ TEMP_LIMIT0_DEFAULT, TEMP_LIMIT1_DEFAULT, TEMP_LIMIT2_DEFAULT,
++};
+ module_param_array(temp_limits, int, NULL, 0444);
+ MODULE_PARM_DESC(temp_limits,
+ "Millicelsius values above which the fan speed increases");
+
+-static int hysteresis = 3000;
++static int hysteresis = HYSTERESIS_DEFAULT;
+ module_param(hysteresis, int, 0444);
+ MODULE_PARM_DESC(hysteresis,
+ "Hysteresis in millicelsius before lowering the fan speed");
+
+-static int speed_on_ac = 2;
++static int speed_on_ac = SPEED_ON_AC_DEFAULT;
+ module_param(speed_on_ac, int, 0444);
+ MODULE_PARM_DESC(speed_on_ac,
+ "minimum fan speed to allow when system is powered by AC");
+@@ -120,18 +130,21 @@ static int gpd_pocket_fan_probe(struct platform_device *pdev)
+ if (temp_limits[i] < 40000 || temp_limits[i] > 70000) {
+ dev_err(&pdev->dev, "Invalid temp-limit %d (must be between 40000 and 70000)\n",
+ temp_limits[i]);
+- return -EINVAL;
++ temp_limits[0] = TEMP_LIMIT0_DEFAULT;
++ temp_limits[1] = TEMP_LIMIT1_DEFAULT;
++ temp_limits[2] = TEMP_LIMIT2_DEFAULT;
++ break;
+ }
+ }
+ if (hysteresis < 1000 || hysteresis > 10000) {
+ dev_err(&pdev->dev, "Invalid hysteresis %d (must be between 1000 and 10000)\n",
+ hysteresis);
+- return -EINVAL;
++ hysteresis = HYSTERESIS_DEFAULT;
+ }
+ if (speed_on_ac < 0 || speed_on_ac > MAX_SPEED) {
+ dev_err(&pdev->dev, "Invalid speed_on_ac %d (must be between 0 and 3)\n",
+ speed_on_ac);
+- return -EINVAL;
++ speed_on_ac = SPEED_ON_AC_DEFAULT;
+ }
+
+ fan = devm_kzalloc(&pdev->dev, sizeof(*fan), GFP_KERNEL);
+diff --git a/drivers/rtc/rtc-brcmstb-waketimer.c b/drivers/rtc/rtc-brcmstb-waketimer.c
+index f4010a75f2be..1abc8397850a 100644
+--- a/drivers/rtc/rtc-brcmstb-waketimer.c
++++ b/drivers/rtc/rtc-brcmstb-waketimer.c
+@@ -287,6 +287,7 @@ static int brcmstb_waketmr_remove(struct platform_device *pdev)
+ struct brcmstb_waketmr *timer = dev_get_drvdata(&pdev->dev);
+
+ unregister_reboot_notifier(&timer->reboot_notifier);
++ clk_disable_unprepare(timer->clk);
+
+ return 0;
+ }
+diff --git a/drivers/rtc/rtc-msm6242.c b/drivers/rtc/rtc-msm6242.c
+index 0c72a2e8ec67..6aace9319fe9 100644
+--- a/drivers/rtc/rtc-msm6242.c
++++ b/drivers/rtc/rtc-msm6242.c
+@@ -132,7 +132,8 @@ static int msm6242_read_time(struct device *dev, struct rtc_time *tm)
+ msm6242_read(priv, MSM6242_SECOND1);
+ tm->tm_min = msm6242_read(priv, MSM6242_MINUTE10) * 10 +
+ msm6242_read(priv, MSM6242_MINUTE1);
+- tm->tm_hour = (msm6242_read(priv, MSM6242_HOUR10 & 3)) * 10 +
++ tm->tm_hour = (msm6242_read(priv, MSM6242_HOUR10) &
++ MSM6242_HOUR10_HR_MASK) * 10 +
+ msm6242_read(priv, MSM6242_HOUR1);
+ tm->tm_mday = msm6242_read(priv, MSM6242_DAY10) * 10 +
+ msm6242_read(priv, MSM6242_DAY1);
+diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c
+index e9a25ec4d434..f85f1fc29e32 100644
+--- a/drivers/rtc/rtc-mt6397.c
++++ b/drivers/rtc/rtc-mt6397.c
+@@ -55,6 +55,14 @@
+
+ #define RTC_AL_SEC 0x0018
+
++#define RTC_AL_SEC_MASK 0x003f
++#define RTC_AL_MIN_MASK 0x003f
++#define RTC_AL_HOU_MASK 0x001f
++#define RTC_AL_DOM_MASK 0x001f
++#define RTC_AL_DOW_MASK 0x0007
++#define RTC_AL_MTH_MASK 0x000f
++#define RTC_AL_YEA_MASK 0x007f
++
+ #define RTC_PDN2 0x002e
+ #define RTC_PDN2_PWRON_ALARM BIT(4)
+
+@@ -111,7 +119,7 @@ static irqreturn_t mtk_rtc_irq_handler_thread(int irq, void *data)
+ irqen = irqsta & ~RTC_IRQ_EN_AL;
+ mutex_lock(&rtc->lock);
+ if (regmap_write(rtc->regmap, rtc->addr_base + RTC_IRQ_EN,
+- irqen) < 0)
++ irqen) == 0)
+ mtk_rtc_write_trigger(rtc);
+ mutex_unlock(&rtc->lock);
+
+@@ -233,12 +241,12 @@ static int mtk_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alm)
+ alm->pending = !!(pdn2 & RTC_PDN2_PWRON_ALARM);
+ mutex_unlock(&rtc->lock);
+
+- tm->tm_sec = data[RTC_OFFSET_SEC];
+- tm->tm_min = data[RTC_OFFSET_MIN];
+- tm->tm_hour = data[RTC_OFFSET_HOUR];
+- tm->tm_mday = data[RTC_OFFSET_DOM];
+- tm->tm_mon = data[RTC_OFFSET_MTH];
+- tm->tm_year = data[RTC_OFFSET_YEAR];
++ tm->tm_sec = data[RTC_OFFSET_SEC] & RTC_AL_SEC_MASK;
++ tm->tm_min = data[RTC_OFFSET_MIN] & RTC_AL_MIN_MASK;
++ tm->tm_hour = data[RTC_OFFSET_HOUR] & RTC_AL_HOU_MASK;
++ tm->tm_mday = data[RTC_OFFSET_DOM] & RTC_AL_DOM_MASK;
++ tm->tm_mon = data[RTC_OFFSET_MTH] & RTC_AL_MTH_MASK;
++ tm->tm_year = data[RTC_OFFSET_YEAR] & RTC_AL_YEA_MASK;
+
+ tm->tm_year += RTC_MIN_YEAR_OFFSET;
+ tm->tm_mon--;
+@@ -259,14 +267,25 @@ static int mtk_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alm)
+ tm->tm_year -= RTC_MIN_YEAR_OFFSET;
+ tm->tm_mon++;
+
+- data[RTC_OFFSET_SEC] = tm->tm_sec;
+- data[RTC_OFFSET_MIN] = tm->tm_min;
+- data[RTC_OFFSET_HOUR] = tm->tm_hour;
+- data[RTC_OFFSET_DOM] = tm->tm_mday;
+- data[RTC_OFFSET_MTH] = tm->tm_mon;
+- data[RTC_OFFSET_YEAR] = tm->tm_year;
+-
+ mutex_lock(&rtc->lock);
++ ret = regmap_bulk_read(rtc->regmap, rtc->addr_base + RTC_AL_SEC,
++ data, RTC_OFFSET_COUNT);
++ if (ret < 0)
++ goto exit;
++
++ data[RTC_OFFSET_SEC] = ((data[RTC_OFFSET_SEC] & ~(RTC_AL_SEC_MASK)) |
++ (tm->tm_sec & RTC_AL_SEC_MASK));
++ data[RTC_OFFSET_MIN] = ((data[RTC_OFFSET_MIN] & ~(RTC_AL_MIN_MASK)) |
++ (tm->tm_min & RTC_AL_MIN_MASK));
++ data[RTC_OFFSET_HOUR] = ((data[RTC_OFFSET_HOUR] & ~(RTC_AL_HOU_MASK)) |
++ (tm->tm_hour & RTC_AL_HOU_MASK));
++ data[RTC_OFFSET_DOM] = ((data[RTC_OFFSET_DOM] & ~(RTC_AL_DOM_MASK)) |
++ (tm->tm_mday & RTC_AL_DOM_MASK));
++ data[RTC_OFFSET_MTH] = ((data[RTC_OFFSET_MTH] & ~(RTC_AL_MTH_MASK)) |
++ (tm->tm_mon & RTC_AL_MTH_MASK));
++ data[RTC_OFFSET_YEAR] = ((data[RTC_OFFSET_YEAR] & ~(RTC_AL_YEA_MASK)) |
++ (tm->tm_year & RTC_AL_YEA_MASK));
++
+ if (alm->enabled) {
+ ret = regmap_bulk_write(rtc->regmap,
+ rtc->addr_base + RTC_AL_SEC,
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 95669d47c389..c238b190b3c9 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -2285,8 +2285,7 @@ int qeth_l2_vnicc_get_timeout(struct qeth_card *card, u32 *timeout)
+ /* check if VNICC is currently enabled */
+ bool qeth_l2_vnicc_is_in_use(struct qeth_card *card)
+ {
+- /* if everything is turned off, VNICC is not active */
+- if (!card->options.vnicc.cur_chars)
++ if (!card->options.vnicc.sup_chars)
+ return false;
+ /* default values are only OK if rx_bcast was not enabled by user
+ * or the card is offline.
+@@ -2367,7 +2366,6 @@ static void qeth_l2_vnicc_init(struct qeth_card *card)
+ error = qeth_l2_vnicc_recover_timeout(card, QETH_VNICC_LEARNING,
+ timeout);
+ chars_tmp = card->options.vnicc.wanted_chars ^ QETH_VNICC_DEFAULT;
+- chars_tmp |= QETH_VNICC_BRIDGE_INVISIBLE;
+ chars_len = sizeof(card->options.vnicc.wanted_chars) * BITS_PER_BYTE;
+ for_each_set_bit(i, &chars_tmp, chars_len) {
+ vnicc = BIT(i);
+diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
+index cd2c247d6d0c..559d8bda4cca 100644
+--- a/drivers/scsi/cxgbi/libcxgbi.c
++++ b/drivers/scsi/cxgbi/libcxgbi.c
+@@ -121,7 +121,8 @@ static inline void cxgbi_device_destroy(struct cxgbi_device *cdev)
+ "cdev 0x%p, p# %u.\n", cdev, cdev->nports);
+ cxgbi_hbas_remove(cdev);
+ cxgbi_device_portmap_cleanup(cdev);
+- cxgbi_ppm_release(cdev->cdev2ppm(cdev));
++ if (cdev->cdev2ppm)
++ cxgbi_ppm_release(cdev->cdev2ppm(cdev));
+ if (cdev->pmap.max_connect)
+ cxgbi_free_big_mem(cdev->pmap.port_csk);
+ kfree(cdev);
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index f8a09e6678d4..7d868d37ab5f 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1685,20 +1685,30 @@ static void sd_rescan(struct device *dev)
+ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
+ unsigned int cmd, unsigned long arg)
+ {
+- struct scsi_device *sdev = scsi_disk(bdev->bd_disk)->device;
++ struct gendisk *disk = bdev->bd_disk;
++ struct scsi_disk *sdkp = scsi_disk(disk);
++ struct scsi_device *sdev = sdkp->device;
++ void __user *p = compat_ptr(arg);
+ int error;
+
++ error = scsi_verify_blk_ioctl(bdev, cmd);
++ if (error < 0)
++ return error;
++
+ error = scsi_ioctl_block_when_processing_errors(sdev, cmd,
+ (mode & FMODE_NDELAY) != 0);
+ if (error)
+ return error;
++
++ if (is_sed_ioctl(cmd))
++ return sed_ioctl(sdkp->opal_dev, cmd, p);
+
+ /*
+ * Let the static ioctl translation table take care of it.
+ */
+ if (!sdev->host->hostt->compat_ioctl)
+ return -ENOIOCTLCMD;
+- return sdev->host->hostt->compat_ioctl(sdev, cmd, (void __user *)arg);
++ return sdev->host->hostt->compat_ioctl(sdev, cmd, p);
+ }
+ #endif
+
+@@ -2195,8 +2205,10 @@ static int sd_read_protection_type(struct scsi_disk *sdkp, unsigned char *buffer
+ u8 type;
+ int ret = 0;
+
+- if (scsi_device_protection(sdp) == 0 || (buffer[12] & 1) == 0)
++ if (scsi_device_protection(sdp) == 0 || (buffer[12] & 1) == 0) {
++ sdkp->protection_type = 0;
+ return ret;
++ }
+
+ type = ((buffer[12] >> 1) & 7) + 1; /* P_TYPE 0 = Type 1 */
+
+diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
+index 2fb43c582559..5a9d7e252a77 100644
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -305,7 +305,6 @@ struct atmel_spi {
+ bool use_cs_gpios;
+
+ bool keep_cs;
+- bool cs_active;
+
+ u32 fifo_size;
+ };
+@@ -1381,11 +1380,9 @@ static int atmel_spi_one_transfer(struct spi_master *master,
+ &msg->transfers)) {
+ as->keep_cs = true;
+ } else {
+- as->cs_active = !as->cs_active;
+- if (as->cs_active)
+- cs_activate(as, msg->spi);
+- else
+- cs_deactivate(as, msg->spi);
++ cs_deactivate(as, msg->spi);
++ udelay(10);
++ cs_activate(as, msg->spi);
+ }
+ }
+
+@@ -1408,7 +1405,6 @@ static int atmel_spi_transfer_one_message(struct spi_master *master,
+ atmel_spi_lock(as);
+ cs_activate(as, spi);
+
+- as->cs_active = true;
+ as->keep_cs = false;
+
+ msg->status = 0;
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 989ca7d662f3..672e97978279 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -624,7 +624,7 @@ static void imx_uart_dma_tx(struct imx_port *sport)
+ dev_err(dev, "DMA mapping error for TX.\n");
+ return;
+ }
+- desc = dmaengine_prep_slave_sg(chan, sgl, sport->dma_tx_nents,
++ desc = dmaengine_prep_slave_sg(chan, sgl, ret,
+ DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT);
+ if (!desc) {
+ dma_unmap_sg(dev, sgl, sport->dma_tx_nents,
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index cb85002a10d8..3245cdbf9116 100644
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -235,6 +235,7 @@ struct eg20t_port {
+ struct dma_chan *chan_rx;
+ struct scatterlist *sg_tx_p;
+ int nent;
++ int orig_nent;
+ struct scatterlist sg_rx;
+ int tx_dma_use;
+ void *rx_buf_virt;
+@@ -789,9 +790,10 @@ static void pch_dma_tx_complete(void *arg)
+ }
+ xmit->tail &= UART_XMIT_SIZE - 1;
+ async_tx_ack(priv->desc_tx);
+- dma_unmap_sg(port->dev, sg, priv->nent, DMA_TO_DEVICE);
++ dma_unmap_sg(port->dev, sg, priv->orig_nent, DMA_TO_DEVICE);
+ priv->tx_dma_use = 0;
+ priv->nent = 0;
++ priv->orig_nent = 0;
+ kfree(priv->sg_tx_p);
+ pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_TX_INT);
+ }
+@@ -1015,6 +1017,7 @@ static unsigned int dma_handle_tx(struct eg20t_port *priv)
+ dev_err(priv->port.dev, "%s:dma_map_sg Failed\n", __func__);
+ return 0;
+ }
++ priv->orig_nent = num;
+ priv->nent = nent;
+
+ for (i = 0; i < nent; i++, sg++) {
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index bd2608297473..18b9b7ca20c9 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -356,6 +356,7 @@ static int afs_test_super(struct super_block *sb, void *data)
+ return (as->net_ns == as1->net_ns &&
+ as->volume &&
+ as->volume->vid == as1->volume->vid &&
++ as->cell == as1->cell &&
+ !as->dyn_root);
+ }
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index d9d90f0b66d2..78490e544c91 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1903,9 +1903,10 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
+ (iocb->ki_flags & IOCB_NOWAIT))
+ return -EOPNOTSUPP;
+
+- if (!inode_trylock(inode)) {
+- if (iocb->ki_flags & IOCB_NOWAIT)
++ if (iocb->ki_flags & IOCB_NOWAIT) {
++ if (!inode_trylock(inode))
+ return -EAGAIN;
++ } else {
+ inode_lock(inode);
+ }
+
+diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
+index 9168b2266e4f..9e2e120e163e 100644
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -67,7 +67,7 @@ smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms,
+ goto out;
+
+
+- if (oparms->tcon->use_resilient) {
++ if (oparms->tcon->use_resilient) {
+ nr_ioctl_req.Timeout = 0; /* use server default (120 seconds) */
+ nr_ioctl_req.Reserved = 0;
+ rc = SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid,
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index a7436ad19458..c81a1f3f0a10 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1857,7 +1857,7 @@ static int __write_data_page(struct page *page, bool *submitted,
+ loff_t i_size = i_size_read(inode);
+ const pgoff_t end_index = ((unsigned long long) i_size)
+ >> PAGE_SHIFT;
+- loff_t psize = (page->index + 1) << PAGE_SHIFT;
++ loff_t psize = (loff_t)(page->index + 1) << PAGE_SHIFT;
+ unsigned offset = 0;
+ bool need_balance_fs = false;
+ int err = 0;
+diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
+index cd611a57d04d..0d3d848d186b 100644
+--- a/fs/f2fs/dir.c
++++ b/fs/f2fs/dir.c
+@@ -785,6 +785,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
+ struct f2fs_dir_entry *de = NULL;
+ struct fscrypt_str de_name = FSTR_INIT(NULL, 0);
+ struct f2fs_sb_info *sbi = F2FS_I_SB(d->inode);
++ int err = 0;
+
+ bit_pos = ((unsigned long)ctx->pos % d->max);
+
+@@ -805,9 +806,20 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
+ de_name.name = d->filename[bit_pos];
+ de_name.len = le16_to_cpu(de->name_len);
+
++ /* check memory boundary before moving forward */
++ bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
++ if (unlikely(bit_pos > d->max ||
++ le16_to_cpu(de->name_len) > F2FS_NAME_LEN)) {
++ f2fs_msg(sbi->sb, KERN_WARNING,
++ "%s: corrupted namelen=%d, run fsck to fix.",
++ __func__, le16_to_cpu(de->name_len));
++ set_sbi_flag(sbi, SBI_NEED_FSCK);
++ err = -EINVAL;
++ goto out;
++ }
++
+ if (f2fs_encrypted_inode(d->inode)) {
+ int save_len = fstr->len;
+- int err;
+
+ err = fscrypt_fname_disk_to_usr(d->inode,
+ (u32)de->hash_code, 0,
+@@ -826,10 +838,10 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
+ if (sbi->readdir_ra == 1)
+ f2fs_ra_node_page(sbi, le32_to_cpu(de->ino));
+
+- bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len));
+ ctx->pos = start_pos + bit_pos;
+ }
+- return 0;
++out:
++ return err;
+ }
+
+ static int f2fs_readdir(struct file *file, struct dir_context *ctx)
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 5eef2a8b29ab..59b5c0b032bb 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1101,7 +1101,7 @@ static int __clone_blkaddrs(struct inode *src_inode, struct inode *dst_inode,
+ }
+ dn.ofs_in_node++;
+ i++;
+- new_size = (dst + i) << PAGE_SHIFT;
++ new_size = (loff_t)(dst + i) << PAGE_SHIFT;
+ if (dst_inode->i_size < new_size)
+ f2fs_i_size_write(dst_inode, new_size);
+ } while (--ilen && (do_replace[i] || blkaddr[i] == NULL_ADDR));
+diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
+index 350675e3ed47..040a05f0e61e 100644
+--- a/fs/nfs/nfs2xdr.c
++++ b/fs/nfs/nfs2xdr.c
+@@ -385,7 +385,7 @@ static void encode_sattr(struct xdr_stream *xdr, const struct iattr *attr)
+ } else
+ p = xdr_time_not_set(p);
+ if (attr->ia_valid & ATTR_MTIME_SET) {
+- ts = timespec64_to_timespec(attr->ia_atime);
++ ts = timespec64_to_timespec(attr->ia_mtime);
+ xdr_encode_time(p, &ts);
+ } else if (attr->ia_valid & ATTR_MTIME) {
+ ts = timespec64_to_timespec(attr->ia_mtime);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 792f8821b5d6..7834b325394f 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -6103,8 +6103,10 @@ static void nfs4_delegreturn_prepare(struct rpc_task *task, void *data)
+
+ d_data = (struct nfs4_delegreturndata *)data;
+
+- if (!d_data->lr.roc && nfs4_wait_on_layoutreturn(d_data->inode, task))
++ if (!d_data->lr.roc && nfs4_wait_on_layoutreturn(d_data->inode, task)) {
++ nfs4_sequence_done(task, &d_data->res.seq_res);
+ return;
++ }
+
+ lo = d_data->args.lr_args ? d_data->args.lr_args->layout : NULL;
+ if (lo && !pnfs_layout_is_valid(lo)) {
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index fc1f209e5db0..c27d8ef47392 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -1080,6 +1080,14 @@ int ocfs2_journal_load(struct ocfs2_journal *journal, int local, int replayed)
+
+ ocfs2_clear_journal_error(osb->sb, journal->j_journal, osb->slot_num);
+
++ if (replayed) {
++ jbd2_journal_lock_updates(journal->j_journal);
++ status = jbd2_journal_flush(journal->j_journal);
++ jbd2_journal_unlock_updates(journal->j_journal);
++ if (status < 0)
++ mlog_errno(status);
++ }
++
+ status = ocfs2_journal_toggle_dirty(osb, 1, replayed);
+ if (status < 0) {
+ mlog_errno(status);
+diff --git a/include/linux/poll.h b/include/linux/poll.h
+index 7e0fdcf905d2..1cdc32b1f1b0 100644
+--- a/include/linux/poll.h
++++ b/include/linux/poll.h
+@@ -16,7 +16,11 @@
+ extern struct ctl_table epoll_table[]; /* for sysctl */
+ /* ~832 bytes of stack space used max in sys_select/sys_poll before allocating
+ additional memory. */
++#ifdef __clang__
++#define MAX_STACK_ALLOC 768
++#else
+ #define MAX_STACK_ALLOC 832
++#endif
+ #define FRONTEND_STACK_ALLOC 256
+ #define SELECT_STACK_ALLOC FRONTEND_STACK_ALLOC
+ #define POLL_STACK_ALLOC FRONTEND_STACK_ALLOC
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 468deae5d603..1fa2e72ff7a6 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4733,6 +4733,17 @@ static inline const u8 *cfg80211_find_ext_ie(u8 ext_eid, const u8 *ies, int len)
+ const u8 *cfg80211_find_vendor_ie(unsigned int oui, int oui_type,
+ const u8 *ies, int len);
+
++/**
++ * cfg80211_send_layer2_update - send layer 2 update frame
++ *
++ * @dev: network device
++ * @addr: STA MAC address
++ *
++ * Wireless drivers can use this function to update forwarding tables in bridge
++ * devices upon STA association.
++ */
++void cfg80211_send_layer2_update(struct net_device *dev, const u8 *addr);
++
+ /**
+ * DOC: Regulatory enforcement infrastructure
+ *
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 09d828a6a173..1011625a0ca4 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -2413,9 +2413,10 @@ static int ethtool_set_tunable(struct net_device *dev, void __user *useraddr)
+ return ret;
+ }
+
+-static int ethtool_get_per_queue_coalesce(struct net_device *dev,
+- void __user *useraddr,
+- struct ethtool_per_queue_op *per_queue_opt)
++static noinline_for_stack int
++ethtool_get_per_queue_coalesce(struct net_device *dev,
++ void __user *useraddr,
++ struct ethtool_per_queue_op *per_queue_opt)
+ {
+ u32 bit;
+ int ret;
+@@ -2443,9 +2444,10 @@ static int ethtool_get_per_queue_coalesce(struct net_device *dev,
+ return 0;
+ }
+
+-static int ethtool_set_per_queue_coalesce(struct net_device *dev,
+- void __user *useraddr,
+- struct ethtool_per_queue_op *per_queue_opt)
++static noinline_for_stack int
++ethtool_set_per_queue_coalesce(struct net_device *dev,
++ void __user *useraddr,
++ struct ethtool_per_queue_op *per_queue_opt)
+ {
+ u32 bit;
+ int i, ret = 0;
+@@ -2499,7 +2501,7 @@ roll_back:
+ return ret;
+ }
+
+-static int ethtool_set_per_queue(struct net_device *dev,
++static int noinline_for_stack ethtool_set_per_queue(struct net_device *dev,
+ void __user *useraddr, u32 sub_cmd)
+ {
+ struct ethtool_per_queue_op per_queue_opt;
+diff --git a/net/dccp/feat.c b/net/dccp/feat.c
+index f227f002c73d..db87d9f58019 100644
+--- a/net/dccp/feat.c
++++ b/net/dccp/feat.c
+@@ -738,7 +738,12 @@ static int __feat_register_sp(struct list_head *fn, u8 feat, u8 is_local,
+ if (dccp_feat_clone_sp_val(&fval, sp_val, sp_len))
+ return -ENOMEM;
+
+- return dccp_feat_push_change(fn, feat, is_local, mandatory, &fval);
++ if (dccp_feat_push_change(fn, feat, is_local, mandatory, &fval)) {
++ kfree(fval.sp.vec);
++ return -ENOMEM;
++ }
++
++ return 0;
+ }
+
+ /**
+diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
+index a97bf326b231..c27577af32e3 100644
+--- a/net/hsr/hsr_device.c
++++ b/net/hsr/hsr_device.c
+@@ -281,6 +281,8 @@ static void send_hsr_supervision_frame(struct hsr_port *master,
+ skb->dev->dev_addr, skb->len) <= 0)
+ goto out;
+ skb_reset_mac_header(skb);
++ skb_reset_network_header(skb);
++ skb_reset_transport_header(skb);
+
+ if (hsrVer > 0) {
+ hsr_tag = skb_put(skb, sizeof(struct hsr_tag));
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index a48e83b19cfa..e46944500cfa 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1096,50 +1096,6 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
+ return 0;
+ }
+
+-/* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
+-struct iapp_layer2_update {
+- u8 da[ETH_ALEN]; /* broadcast */
+- u8 sa[ETH_ALEN]; /* STA addr */
+- __be16 len; /* 6 */
+- u8 dsap; /* 0 */
+- u8 ssap; /* 0 */
+- u8 control;
+- u8 xid_info[3];
+-} __packed;
+-
+-static void ieee80211_send_layer2_update(struct sta_info *sta)
+-{
+- struct iapp_layer2_update *msg;
+- struct sk_buff *skb;
+-
+- /* Send Level 2 Update Frame to update forwarding tables in layer 2
+- * bridge devices */
+-
+- skb = dev_alloc_skb(sizeof(*msg));
+- if (!skb)
+- return;
+- msg = skb_put(skb, sizeof(*msg));
+-
+- /* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
+- * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
+-
+- eth_broadcast_addr(msg->da);
+- memcpy(msg->sa, sta->sta.addr, ETH_ALEN);
+- msg->len = htons(6);
+- msg->dsap = 0;
+- msg->ssap = 0x01; /* NULL LSAP, CR Bit: Response */
+- msg->control = 0xaf; /* XID response lsb.1111F101.
+- * F=0 (no poll command; unsolicited frame) */
+- msg->xid_info[0] = 0x81; /* XID format identifier */
+- msg->xid_info[1] = 1; /* LLC types/classes: Type 1 LLC */
+- msg->xid_info[2] = 0; /* XID sender's receive window size (RW) */
+-
+- skb->dev = sta->sdata->dev;
+- skb->protocol = eth_type_trans(skb, sta->sdata->dev);
+- memset(skb->cb, 0, sizeof(skb->cb));
+- netif_rx_ni(skb);
+-}
+-
+ static int sta_apply_auth_flags(struct ieee80211_local *local,
+ struct sta_info *sta,
+ u32 mask, u32 set)
+@@ -1454,7 +1410,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+ struct sta_info *sta;
+ struct ieee80211_sub_if_data *sdata;
+ int err;
+- int layer2_update;
+
+ if (params->vlan) {
+ sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
+@@ -1498,18 +1453,12 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+ test_sta_flag(sta, WLAN_STA_ASSOC))
+ rate_control_rate_init(sta);
+
+- layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+- sdata->vif.type == NL80211_IFTYPE_AP;
+-
+ err = sta_info_insert_rcu(sta);
+ if (err) {
+ rcu_read_unlock();
+ return err;
+ }
+
+- if (layer2_update)
+- ieee80211_send_layer2_update(sta);
+-
+ rcu_read_unlock();
+
+ return 0;
+@@ -1607,10 +1556,11 @@ static int ieee80211_change_station(struct wiphy *wiphy,
+ sta->sdata = vlansdata;
+ ieee80211_check_fast_xmit(sta);
+
+- if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
++ if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
+ ieee80211_vif_inc_num_mcast(sta->sdata);
+-
+- ieee80211_send_layer2_update(sta);
++ cfg80211_send_layer2_update(sta->sdata->dev,
++ sta->sta.addr);
++ }
+ }
+
+ err = sta_apply_parameters(local, sta, params);
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 507409e3fd39..0c80a59ef914 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1906,6 +1906,10 @@ int sta_info_move_state(struct sta_info *sta,
+ ieee80211_check_fast_xmit(sta);
+ ieee80211_check_fast_rx(sta);
+ }
++ if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
++ sta->sdata->vif.type == NL80211_IFTYPE_AP)
++ cfg80211_send_layer2_update(sta->sdata->dev,
++ sta->sta.addr);
+ break;
+ default:
+ break;
+diff --git a/net/socket.c b/net/socket.c
+index 1290aad5d1c3..1030a612423b 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -3240,6 +3240,7 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
+ case SIOCSARP:
+ case SIOCGARP:
+ case SIOCDARP:
++ case SIOCOUTQNSD:
+ case SIOCATMARK:
+ return sock_do_ioctl(net, sock, cmd, arg);
+ }
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 5ddbf227e7c6..90ec322dbbc0 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -248,6 +248,7 @@ rpcrdma_conn_upcall(struct rdma_cm_id *id, struct rdma_cm_event *event)
+ ia->ri_device->name,
+ rpcrdma_addrstr(xprt), rpcrdma_portstr(xprt));
+ #endif
++ init_completion(&ia->ri_remove_done);
+ set_bit(RPCRDMA_IAF_REMOVING, &ia->ri_flags);
+ ep->rep_connected = -ENODEV;
+ xprt_force_disconnect(&xprt->rx_xprt);
+@@ -306,7 +307,6 @@ rpcrdma_create_id(struct rpcrdma_xprt *xprt, struct rpcrdma_ia *ia)
+ trace_xprtrdma_conn_start(xprt);
+
+ init_completion(&ia->ri_done);
+- init_completion(&ia->ri_remove_done);
+
+ id = rdma_create_id(xprt->rx_xprt.xprt_net, rpcrdma_conn_upcall,
+ xprt, RDMA_PS_TCP, IB_QPT_RC);
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index d2d6ff0c6265..2318e2e2748f 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -649,6 +649,9 @@ static __poll_t unix_poll(struct file *, struct socket *, poll_table *);
+ static __poll_t unix_dgram_poll(struct file *, struct socket *,
+ poll_table *);
+ static int unix_ioctl(struct socket *, unsigned int, unsigned long);
++#ifdef CONFIG_COMPAT
++static int unix_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
++#endif
+ static int unix_shutdown(struct socket *, int);
+ static int unix_stream_sendmsg(struct socket *, struct msghdr *, size_t);
+ static int unix_stream_recvmsg(struct socket *, struct msghdr *, size_t, int);
+@@ -690,6 +693,9 @@ static const struct proto_ops unix_stream_ops = {
+ .getname = unix_getname,
+ .poll = unix_poll,
+ .ioctl = unix_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = unix_compat_ioctl,
++#endif
+ .listen = unix_listen,
+ .shutdown = unix_shutdown,
+ .setsockopt = sock_no_setsockopt,
+@@ -713,6 +719,9 @@ static const struct proto_ops unix_dgram_ops = {
+ .getname = unix_getname,
+ .poll = unix_dgram_poll,
+ .ioctl = unix_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = unix_compat_ioctl,
++#endif
+ .listen = sock_no_listen,
+ .shutdown = unix_shutdown,
+ .setsockopt = sock_no_setsockopt,
+@@ -735,6 +744,9 @@ static const struct proto_ops unix_seqpacket_ops = {
+ .getname = unix_getname,
+ .poll = unix_dgram_poll,
+ .ioctl = unix_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = unix_compat_ioctl,
++#endif
+ .listen = unix_listen,
+ .shutdown = unix_shutdown,
+ .setsockopt = sock_no_setsockopt,
+@@ -2646,6 +2658,13 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ return err;
+ }
+
++#ifdef CONFIG_COMPAT
++static int unix_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
++{
++ return unix_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
++}
++#endif
++
+ static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wait)
+ {
+ struct sock *sk = sock->sk;
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index d641d81da759..8857f7b0ed48 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1919,3 +1919,48 @@ bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
+ return false;
+ }
+ EXPORT_SYMBOL(cfg80211_iftype_allowed);
++
++/* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
++struct iapp_layer2_update {
++ u8 da[ETH_ALEN]; /* broadcast */
++ u8 sa[ETH_ALEN]; /* STA addr */
++ __be16 len; /* 6 */
++ u8 dsap; /* 0 */
++ u8 ssap; /* 0 */
++ u8 control;
++ u8 xid_info[3];
++} __packed;
++
++void cfg80211_send_layer2_update(struct net_device *dev, const u8 *addr)
++{
++ struct iapp_layer2_update *msg;
++ struct sk_buff *skb;
++
++ /* Send Level 2 Update Frame to update forwarding tables in layer 2
++ * bridge devices */
++
++ skb = dev_alloc_skb(sizeof(*msg));
++ if (!skb)
++ return;
++ msg = skb_put(skb, sizeof(*msg));
++
++ /* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
++ * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
++
++ eth_broadcast_addr(msg->da);
++ ether_addr_copy(msg->sa, addr);
++ msg->len = htons(6);
++ msg->dsap = 0;
++ msg->ssap = 0x01; /* NULL LSAP, CR Bit: Response */
++ msg->control = 0xaf; /* XID response lsb.1111F101.
++ * F=0 (no poll command; unsolicited frame) */
++ msg->xid_info[0] = 0x81; /* XID format identifier */
++ msg->xid_info[1] = 1; /* LLC types/classes: Type 1 LLC */
++ msg->xid_info[2] = 0; /* XID sender's receive window size (RW) */
++
++ skb->dev = dev;
++ skb->protocol = eth_type_trans(skb, dev);
++ memset(skb->cb, 0, sizeof(skb->cb));
++ netif_rx_ni(skb);
++}
++EXPORT_SYMBOL(cfg80211_send_layer2_update);
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 62aa320c2070..e45dfcb62b6a 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1921,6 +1921,8 @@ static void soc_check_tplg_fes(struct snd_soc_card *card)
+
+ /* convert non BE into BE */
+ dai_link->no_pcm = 1;
++ dai_link->dpcm_playback = 1;
++ dai_link->dpcm_capture = 1;
+
+ /* override any BE fixups */
+ dai_link->be_hw_params_fixup =
+diff --git a/sound/soc/stm/stm32_spdifrx.c b/sound/soc/stm/stm32_spdifrx.c
+index 373df4f24be1..07082f7efdfa 100644
+--- a/sound/soc/stm/stm32_spdifrx.c
++++ b/sound/soc/stm/stm32_spdifrx.c
+@@ -213,6 +213,7 @@
+ * @slave_config: dma slave channel runtime config pointer
+ * @phys_addr: SPDIFRX registers physical base address
+ * @lock: synchronization enabling lock
++ * @irq_lock: prevent race condition with IRQ on stream state
+ * @cs: channel status buffer
+ * @ub: user data buffer
+ * @irq: SPDIFRX interrupt line
+@@ -233,6 +234,7 @@ struct stm32_spdifrx_data {
+ struct dma_slave_config slave_config;
+ dma_addr_t phys_addr;
+ spinlock_t lock; /* Sync enabling lock */
++ spinlock_t irq_lock; /* Prevent race condition on stream state */
+ unsigned char cs[SPDIFRX_CS_BYTES_NB];
+ unsigned char ub[SPDIFRX_UB_BYTES_NB];
+ int irq;
+@@ -313,6 +315,7 @@ static void stm32_spdifrx_dma_ctrl_stop(struct stm32_spdifrx_data *spdifrx)
+ static int stm32_spdifrx_start_sync(struct stm32_spdifrx_data *spdifrx)
+ {
+ int cr, cr_mask, imr, ret;
++ unsigned long flags;
+
+ /* Enable IRQs */
+ imr = SPDIFRX_IMR_IFEIE | SPDIFRX_IMR_SYNCDIE | SPDIFRX_IMR_PERRIE;
+@@ -320,7 +323,7 @@ static int stm32_spdifrx_start_sync(struct stm32_spdifrx_data *spdifrx)
+ if (ret)
+ return ret;
+
+- spin_lock(&spdifrx->lock);
++ spin_lock_irqsave(&spdifrx->lock, flags);
+
+ spdifrx->refcount++;
+
+@@ -353,7 +356,7 @@ static int stm32_spdifrx_start_sync(struct stm32_spdifrx_data *spdifrx)
+ "Failed to start synchronization\n");
+ }
+
+- spin_unlock(&spdifrx->lock);
++ spin_unlock_irqrestore(&spdifrx->lock, flags);
+
+ return ret;
+ }
+@@ -361,11 +364,12 @@ static int stm32_spdifrx_start_sync(struct stm32_spdifrx_data *spdifrx)
+ static void stm32_spdifrx_stop(struct stm32_spdifrx_data *spdifrx)
+ {
+ int cr, cr_mask, reg;
++ unsigned long flags;
+
+- spin_lock(&spdifrx->lock);
++ spin_lock_irqsave(&spdifrx->lock, flags);
+
+ if (--spdifrx->refcount) {
+- spin_unlock(&spdifrx->lock);
++ spin_unlock_irqrestore(&spdifrx->lock, flags);
+ return;
+ }
+
+@@ -384,7 +388,7 @@ static void stm32_spdifrx_stop(struct stm32_spdifrx_data *spdifrx)
+ regmap_read(spdifrx->regmap, STM32_SPDIFRX_DR, ®);
+ regmap_read(spdifrx->regmap, STM32_SPDIFRX_CSR, ®);
+
+- spin_unlock(&spdifrx->lock);
++ spin_unlock_irqrestore(&spdifrx->lock, flags);
+ }
+
+ static int stm32_spdifrx_dma_ctrl_register(struct device *dev,
+@@ -643,7 +647,6 @@ static const struct regmap_config stm32_h7_spdifrx_regmap_conf = {
+ static irqreturn_t stm32_spdifrx_isr(int irq, void *devid)
+ {
+ struct stm32_spdifrx_data *spdifrx = (struct stm32_spdifrx_data *)devid;
+- struct snd_pcm_substream *substream = spdifrx->substream;
+ struct platform_device *pdev = spdifrx->pdev;
+ unsigned int cr, mask, sr, imr;
+ unsigned int flags;
+@@ -711,14 +714,19 @@ static irqreturn_t stm32_spdifrx_isr(int irq, void *devid)
+ regmap_update_bits(spdifrx->regmap, STM32_SPDIFRX_CR,
+ SPDIFRX_CR_SPDIFEN_MASK, cr);
+
+- if (substream)
+- snd_pcm_stop(substream, SNDRV_PCM_STATE_DISCONNECTED);
++ spin_lock(&spdifrx->irq_lock);
++ if (spdifrx->substream)
++ snd_pcm_stop(spdifrx->substream,
++ SNDRV_PCM_STATE_DISCONNECTED);
++ spin_unlock(&spdifrx->irq_lock);
+
+ return IRQ_HANDLED;
+ }
+
+- if (err_xrun && substream)
+- snd_pcm_stop_xrun(substream);
++ spin_lock(&spdifrx->irq_lock);
++ if (err_xrun && spdifrx->substream)
++ snd_pcm_stop_xrun(spdifrx->substream);
++ spin_unlock(&spdifrx->irq_lock);
+
+ return IRQ_HANDLED;
+ }
+@@ -727,9 +735,12 @@ static int stm32_spdifrx_startup(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *cpu_dai)
+ {
+ struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
++ unsigned long flags;
+ int ret;
+
++ spin_lock_irqsave(&spdifrx->irq_lock, flags);
+ spdifrx->substream = substream;
++ spin_unlock_irqrestore(&spdifrx->irq_lock, flags);
+
+ ret = clk_prepare_enable(spdifrx->kclk);
+ if (ret)
+@@ -805,8 +816,12 @@ static void stm32_spdifrx_shutdown(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *cpu_dai)
+ {
+ struct stm32_spdifrx_data *spdifrx = snd_soc_dai_get_drvdata(cpu_dai);
++ unsigned long flags;
+
++ spin_lock_irqsave(&spdifrx->irq_lock, flags);
+ spdifrx->substream = NULL;
++ spin_unlock_irqrestore(&spdifrx->irq_lock, flags);
++
+ clk_disable_unprepare(spdifrx->kclk);
+ }
+
+@@ -910,6 +925,7 @@ static int stm32_spdifrx_probe(struct platform_device *pdev)
+ spdifrx->pdev = pdev;
+ init_completion(&spdifrx->cs_completion);
+ spin_lock_init(&spdifrx->lock);
++ spin_lock_init(&spdifrx->irq_lock);
+
+ platform_set_drvdata(pdev, spdifrx);
+
+diff --git a/tools/testing/selftests/firmware/fw_lib.sh b/tools/testing/selftests/firmware/fw_lib.sh
+index 1cbb12e284a6..8a853ace55a2 100755
+--- a/tools/testing/selftests/firmware/fw_lib.sh
++++ b/tools/testing/selftests/firmware/fw_lib.sh
+@@ -28,6 +28,12 @@ test_modprobe()
+
+ check_mods()
+ {
++ local uid=$(id -u)
++ if [ $uid -ne 0 ]; then
++ echo "skip all tests: must be run as root" >&2
++ exit $ksft_skip
++ fi
++
+ trap "test_modprobe" EXIT
+ if [ ! -d $DIR ]; then
+ modprobe test_firmware
+diff --git a/tools/testing/selftests/rseq/settings b/tools/testing/selftests/rseq/settings
+new file mode 100644
+index 000000000000..e7b9417537fb
+--- /dev/null
++++ b/tools/testing/selftests/rseq/settings
+@@ -0,0 +1 @@
++timeout=0
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-01-23 11:07 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-01-23 11:07 UTC (permalink / raw
To: gentoo-commits
commit: 4929a7928d984c928d59e11572961f7736acd0bd
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jan 23 11:07:22 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jan 23 11:07:22 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4929a792
Linux patch 4.19.98
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1097_linux-4.19.98.patch | 3748 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3752 insertions(+)
diff --git a/0000_README b/0000_README
index af58b77..b2dcc20 100644
--- a/0000_README
+++ b/0000_README
@@ -427,6 +427,10 @@ Patch: 1096_linux-4.19.97.patch
From: https://www.kernel.org
Desc: Linux 4.19.97
+Patch: 1097_linux-4.19.98.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.98
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1097_linux-4.19.98.patch b/1097_linux-4.19.98.patch
new file mode 100644
index 0000000..223579d
--- /dev/null
+++ b/1097_linux-4.19.98.patch
@@ -0,0 +1,3748 @@
+diff --git a/Makefile b/Makefile
+index 3499df8936a1..48dbafb790ff 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 97
++SUBLEVEL = 98
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am571x-idk.dts b/arch/arm/boot/dts/am571x-idk.dts
+index 6bebedfc0f35..bf4163eb6b2a 100644
+--- a/arch/arm/boot/dts/am571x-idk.dts
++++ b/arch/arm/boot/dts/am571x-idk.dts
+@@ -90,7 +90,7 @@
+
+ &pcie1_rc {
+ status = "okay";
+- gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
++ gpios = <&gpio5 18 GPIO_ACTIVE_HIGH>;
+ };
+
+ &pcie1_ep {
+diff --git a/arch/arm/boot/dts/imx6dl-icore-mipi.dts b/arch/arm/boot/dts/imx6dl-icore-mipi.dts
+index bf53f0552aa1..f88ad5e993ed 100644
+--- a/arch/arm/boot/dts/imx6dl-icore-mipi.dts
++++ b/arch/arm/boot/dts/imx6dl-icore-mipi.dts
+@@ -8,7 +8,7 @@
+ /dts-v1/;
+
+ #include "imx6dl.dtsi"
+-#include "imx6qdl-icore.dtsi"
++#include "imx6qdl-icore-1.5.dtsi"
+
+ / {
+ model = "Engicam i.CoreM6 DualLite/Solo MIPI Starter Kit";
+diff --git a/arch/arm/boot/dts/imx6q-dhcom-pdk2.dts b/arch/arm/boot/dts/imx6q-dhcom-pdk2.dts
+index 9c61e3be2d9a..1c46df6827f5 100644
+--- a/arch/arm/boot/dts/imx6q-dhcom-pdk2.dts
++++ b/arch/arm/boot/dts/imx6q-dhcom-pdk2.dts
+@@ -55,7 +55,7 @@
+ #sound-dai-cells = <0>;
+ clocks = <&clk_ext_audio_codec>;
+ VDDA-supply = <®_3p3v>;
+- VDDIO-supply = <®_3p3v>;
++ VDDIO-supply = <&sw2_reg>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+index bbba0671f0f4..5b4d78999f80 100644
+--- a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
++++ b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+@@ -205,7 +205,7 @@
+ };
+
+ rtc@56 {
+- compatible = "rv3029c2";
++ compatible = "microcrystal,rv3029";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_rtc_hw300>;
+ reg = <0x56>;
+diff --git a/arch/arm/boot/dts/imx6qdl-icore-1.5.dtsi b/arch/arm/boot/dts/imx6qdl-icore-1.5.dtsi
+new file mode 100644
+index 000000000000..d91d46b5898f
+--- /dev/null
++++ b/arch/arm/boot/dts/imx6qdl-icore-1.5.dtsi
+@@ -0,0 +1,34 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright (C) 2018 Jacopo Mondi <jacopo@jmondi.org>
++ */
++
++#include "imx6qdl-icore.dtsi"
++
++&iomuxc {
++ pinctrl_enet: enetgrp {
++ fsl,pins = <
++ MX6QDL_PAD_ENET_CRS_DV__ENET_RX_EN 0x1b0b0
++ MX6QDL_PAD_GPIO_16__ENET_REF_CLK 0x4001b0b0
++ MX6QDL_PAD_ENET_TX_EN__ENET_TX_EN 0x1b0b0
++ MX6QDL_PAD_ENET_RXD1__ENET_RX_DATA1 0x1b0b0
++ MX6QDL_PAD_ENET_RXD0__ENET_RX_DATA0 0x1b0b0
++ MX6QDL_PAD_ENET_TXD1__ENET_TX_DATA1 0x1b0b0
++ MX6QDL_PAD_ENET_TXD0__ENET_TX_DATA0 0x1b0b0
++ MX6QDL_PAD_ENET_MDC__ENET_MDC 0x1b0b0
++ MX6QDL_PAD_ENET_MDIO__ENET_MDIO 0x1b0b0
++ MX6QDL_PAD_GPIO_17__GPIO7_IO12 0x1b0b0
++ >;
++ };
++};
++
++&fec {
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_enet>;
++ phy-reset-gpios = <&gpio7 12 GPIO_ACTIVE_LOW>;
++ clocks = <&clks IMX6QDL_CLK_ENET>,
++ <&clks IMX6QDL_CLK_ENET>,
++ <&clks IMX6QDL_CLK_ENET_REF>;
++ phy-mode = "rmii";
++ status = "okay";
++};
+diff --git a/arch/arm/boot/dts/imx7s-colibri.dtsi b/arch/arm/boot/dts/imx7s-colibri.dtsi
+index 1fb1ec5d3d70..6d16e32aed89 100644
+--- a/arch/arm/boot/dts/imx7s-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7s-colibri.dtsi
+@@ -49,3 +49,7 @@
+ reg = <0x80000000 0x10000000>;
+ };
+ };
++
++&gpmi {
++ status = "okay";
++};
+diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi
+index 7162e0ca05b0..ba78170e7027 100644
+--- a/arch/arm/boot/dts/meson8.dtsi
++++ b/arch/arm/boot/dts/meson8.dtsi
+@@ -139,7 +139,7 @@
+ &aobus {
+ pmu: pmu@e0 {
+ compatible = "amlogic,meson8-pmu", "syscon";
+- reg = <0xe0 0x8>;
++ reg = <0xe0 0x18>;
+ };
+
+ pinctrl_aobus: pinctrl@84 {
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
+index b3f186434f36..185913de774d 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
+@@ -77,7 +77,7 @@
+ &mmc1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc1_pins>;
+- vmmc-supply = <®_aldo2>;
++ vmmc-supply = <®_dcdc1>;
+ vqmmc-supply = <®_dldo4>;
+ mmc-pwrseq = <&wifi_pwrseq>;
+ bus-width = <4>;
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+index 9a1ea8a46405..85fffe03b96b 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+@@ -59,10 +59,10 @@
+
+ pmu {
+ compatible = "arm,armv8-pmuv3";
+- interrupts = <0 120 8>,
+- <0 121 8>,
+- <0 122 8>,
+- <0 123 8>;
++ interrupts = <0 170 4>,
++ <0 171 4>,
++ <0 172 4>,
++ <0 173 4>;
+ interrupt-affinity = <&cpu0>,
+ <&cpu1>,
+ <&cpu2>,
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+index 864ef0111b01..9d858eb193ca 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+@@ -33,11 +33,9 @@
+
+ gpio-keys-polled {
+ compatible = "gpio-keys-polled";
+- #address-cells = <1>;
+- #size-cells = <0>;
+ poll-interval = <100>;
+
+- button@0 {
++ power-button {
+ label = "power";
+ linux,code = <KEY_POWER>;
+ gpios = <&gpio_ao GPIOAO_2 GPIO_ACTIVE_LOW>;
+diff --git a/arch/arm64/boot/dts/arm/juno-base.dtsi b/arch/arm64/boot/dts/arm/juno-base.dtsi
+index ce56a4acda4f..b6f486737589 100644
+--- a/arch/arm64/boot/dts/arm/juno-base.dtsi
++++ b/arch/arm64/boot/dts/arm/juno-base.dtsi
+@@ -6,7 +6,6 @@
+ /*
+ * Devices shared by all Juno boards
+ */
+- dma-ranges = <0 0 0 0 0x100 0>;
+
+ memtimer: timer@2a810000 {
+ compatible = "arm,armv7-timer-mem";
+diff --git a/arch/arm64/boot/dts/marvell/armada-cp110.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110.dtsi
+index 840c8454d03e..571bede7bdf6 100644
+--- a/arch/arm64/boot/dts/marvell/armada-cp110.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-cp110.dtsi
+@@ -359,10 +359,10 @@
+
+ CP110_LABEL(nand_controller): nand@720000 {
+ /*
+- * Due to the limitation of the pins available
+- * this controller is only usable on the CPM
+- * for A7K and on the CPS for A8K.
+- */
++ * Due to the limitation of the pins available
++ * this controller is only usable on the CPM
++ * for A7K and on the CPS for A8K.
++ */
+ compatible = "marvell,armada-8k-nand-controller",
+ "marvell,armada370-nand-controller";
+ reg = <0x720000 0x54>;
+diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
+index f62e347862cc..4eaa724afce3 100644
+--- a/arch/x86/boot/compressed/head_64.S
++++ b/arch/x86/boot/compressed/head_64.S
+@@ -244,6 +244,11 @@ ENTRY(efi32_stub_entry)
+ leal efi32_config(%ebp), %eax
+ movl %eax, efi_config(%ebp)
+
++ /* Disable paging */
++ movl %cr0, %eax
++ btrl $X86_CR0_PG_BIT, %eax
++ movl %eax, %cr0
++
+ jmp startup_32
+ ENDPROC(efi32_stub_entry)
+ #endif
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index f86f912ce215..75715fa0e822 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -609,9 +609,9 @@ static void early_detect_mem_encrypt(struct cpuinfo_x86 *c)
+ return;
+
+ clear_all:
+- clear_cpu_cap(c, X86_FEATURE_SME);
++ setup_clear_cpu_cap(X86_FEATURE_SME);
+ clear_sev:
+- clear_cpu_cap(c, X86_FEATURE_SEV);
++ setup_clear_cpu_cap(X86_FEATURE_SEV);
+ }
+ }
+
+diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
+index b99a04da70f6..1c92cd08c3b4 100644
+--- a/arch/x86/kernel/cpu/intel_rdt.c
++++ b/arch/x86/kernel/cpu/intel_rdt.c
+@@ -595,7 +595,7 @@ static void domain_remove_cpu(int cpu, struct rdt_resource *r)
+ if (static_branch_unlikely(&rdt_mon_enable_key))
+ rmdir_mondata_subdir_allrdtgrp(r, d->id);
+ list_del(&d->list);
+- if (is_mbm_enabled())
++ if (r->mon_capable && is_mbm_enabled())
+ cancel_delayed_work(&d->mbm_over);
+ if (is_llc_occupancy_enabled() && has_busy_rmid(r, d)) {
+ /*
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index a2d7e6646cce..841a0246eb89 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -1749,9 +1749,6 @@ static int set_cache_qos_cfg(int level, bool enable)
+ struct rdt_domain *d;
+ int cpu;
+
+- if (!zalloc_cpumask_var(&cpu_mask, GFP_KERNEL))
+- return -ENOMEM;
+-
+ if (level == RDT_RESOURCE_L3)
+ update = l3_qos_cfg_update;
+ else if (level == RDT_RESOURCE_L2)
+@@ -1759,6 +1756,9 @@ static int set_cache_qos_cfg(int level, bool enable)
+ else
+ return -EINVAL;
+
++ if (!zalloc_cpumask_var(&cpu_mask, GFP_KERNEL))
++ return -ENOMEM;
++
+ r_l = &rdt_resources_all[level];
+ list_for_each_entry(d, &r_l->domains, list) {
+ /* Pick one CPU from each domain instance to update MSR */
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index ffd459969689..be9b39caadbd 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -379,7 +379,7 @@ EXPORT_SYMBOL(blk_queue_max_segment_size);
+ * storage device can address. The default of 512 covers most
+ * hardware.
+ **/
+-void blk_queue_logical_block_size(struct request_queue *q, unsigned short size)
++void blk_queue_logical_block_size(struct request_queue *q, unsigned int size)
+ {
+ q->limits.logical_block_size = size;
+
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 5830d9417886..9a57af79f330 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1113,8 +1113,8 @@ static int xlvbd_alloc_gendisk(blkif_sector_t capacity,
+ if (!VDEV_IS_EXTENDED(info->vdevice)) {
+ err = xen_translate_vdev(info->vdevice, &minor, &offset);
+ if (err)
+- return err;
+- nr_parts = PARTS_PER_DISK;
++ return err;
++ nr_parts = PARTS_PER_DISK;
+ } else {
+ minor = BLKIF_MINOR_EXT(info->vdevice);
+ nr_parts = PARTS_PER_EXT_DISK;
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 5413ffaf02e2..71621a171f8a 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3066,11 +3066,17 @@ static int __clk_core_init(struct clk_core *core)
+ if (core->flags & CLK_IS_CRITICAL) {
+ unsigned long flags;
+
+- clk_core_prepare(core);
++ ret = clk_core_prepare(core);
++ if (ret)
++ goto out;
+
+ flags = clk_enable_lock();
+- clk_core_enable(core);
++ ret = clk_core_enable(core);
+ clk_enable_unlock(flags);
++ if (ret) {
++ clk_core_unprepare(core);
++ goto out;
++ }
+ }
+
+ /*
+diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
+index ada3e4aeb38f..6bd96ddadbe3 100644
+--- a/drivers/clk/qcom/gcc-sdm845.c
++++ b/drivers/clk/qcom/gcc-sdm845.c
+@@ -3150,6 +3150,7 @@ static struct gdsc hlos1_vote_aggre_noc_mmu_audio_tbu_gdsc = {
+ .name = "hlos1_vote_aggre_noc_mmu_audio_tbu_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .flags = VOTABLE,
+ };
+
+ static struct gdsc hlos1_vote_aggre_noc_mmu_pcie_tbu_gdsc = {
+@@ -3158,6 +3159,7 @@ static struct gdsc hlos1_vote_aggre_noc_mmu_pcie_tbu_gdsc = {
+ .name = "hlos1_vote_aggre_noc_mmu_pcie_tbu_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .flags = VOTABLE,
+ };
+
+ static struct gdsc hlos1_vote_aggre_noc_mmu_tbu1_gdsc = {
+@@ -3166,6 +3168,7 @@ static struct gdsc hlos1_vote_aggre_noc_mmu_tbu1_gdsc = {
+ .name = "hlos1_vote_aggre_noc_mmu_tbu1_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .flags = VOTABLE,
+ };
+
+ static struct gdsc hlos1_vote_aggre_noc_mmu_tbu2_gdsc = {
+@@ -3174,6 +3177,7 @@ static struct gdsc hlos1_vote_aggre_noc_mmu_tbu2_gdsc = {
+ .name = "hlos1_vote_aggre_noc_mmu_tbu2_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .flags = VOTABLE,
+ };
+
+ static struct gdsc hlos1_vote_mmnoc_mmu_tbu_hf0_gdsc = {
+@@ -3182,6 +3186,7 @@ static struct gdsc hlos1_vote_mmnoc_mmu_tbu_hf0_gdsc = {
+ .name = "hlos1_vote_mmnoc_mmu_tbu_hf0_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .flags = VOTABLE,
+ };
+
+ static struct gdsc hlos1_vote_mmnoc_mmu_tbu_hf1_gdsc = {
+@@ -3190,6 +3195,7 @@ static struct gdsc hlos1_vote_mmnoc_mmu_tbu_hf1_gdsc = {
+ .name = "hlos1_vote_mmnoc_mmu_tbu_hf1_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .flags = VOTABLE,
+ };
+
+ static struct gdsc hlos1_vote_mmnoc_mmu_tbu_sf_gdsc = {
+@@ -3198,6 +3204,7 @@ static struct gdsc hlos1_vote_mmnoc_mmu_tbu_sf_gdsc = {
+ .name = "hlos1_vote_mmnoc_mmu_tbu_sf_gdsc",
+ },
+ .pwrsts = PWRSTS_OFF_ON,
++ .flags = VOTABLE,
+ };
+
+ static struct clk_regmap *gcc_sdm845_clocks[] = {
+diff --git a/drivers/clk/sprd/common.c b/drivers/clk/sprd/common.c
+index 8bdab1c3013b..c9b777592b2c 100644
+--- a/drivers/clk/sprd/common.c
++++ b/drivers/clk/sprd/common.c
+@@ -45,7 +45,7 @@ int sprd_clk_regmap_init(struct platform_device *pdev,
+
+ if (of_find_property(node, "sprd,syscon", NULL)) {
+ regmap = syscon_regmap_lookup_by_phandle(node, "sprd,syscon");
+- if (IS_ERR_OR_NULL(regmap)) {
++ if (IS_ERR(regmap)) {
+ pr_err("%s: failed to get syscon regmap\n", __func__);
+ return PTR_ERR(regmap);
+ }
+diff --git a/drivers/gpu/drm/i915/selftests/i915_random.h b/drivers/gpu/drm/i915/selftests/i915_random.h
+index 7dffedc501ca..faaa3507fdee 100644
+--- a/drivers/gpu/drm/i915/selftests/i915_random.h
++++ b/drivers/gpu/drm/i915/selftests/i915_random.h
+@@ -25,6 +25,7 @@
+ #ifndef __I915_SELFTESTS_RANDOM_H__
+ #define __I915_SELFTESTS_RANDOM_H__
+
++#include <linux/math64.h>
+ #include <linux/random.h>
+
+ #include "../i915_selftest.h"
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c
+index a3ba7f50198b..a3dcb09a40ee 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c
+@@ -94,6 +94,8 @@ gf100_bar_oneinit_bar(struct gf100_bar *bar, struct gf100_barN *bar_vm,
+ return ret;
+
+ bar_len = device->func->resource_size(device, bar_nr);
++ if (!bar_len)
++ return -ENOMEM;
+ if (bar_nr == 3 && bar->bar2_halve)
+ bar_len >>= 1;
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c
+index 38c9c086754b..f23a0ccc2bec 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/nv50.c
+@@ -174,6 +174,8 @@ nv50_bar_oneinit(struct nvkm_bar *base)
+
+ ret = nvkm_vmm_new(device, start, limit-- - start, NULL, 0,
+ &bar1_lock, "bar1", &bar->bar1_vmm);
++ if (ret)
++ return ret;
+
+ atomic_inc(&bar->bar1_vmm->engref[NVKM_SUBDEV_BAR]);
+ bar->bar1_vmm->debug = bar->base.subdev.debug;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
+index 7459def78d50..5f8b8b399b97 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c
+@@ -1423,7 +1423,7 @@ nvkm_vmm_get(struct nvkm_vmm *vmm, u8 page, u64 size, struct nvkm_vma **pvma)
+ void
+ nvkm_vmm_part(struct nvkm_vmm *vmm, struct nvkm_memory *inst)
+ {
+- if (inst && vmm->func->part) {
++ if (inst && vmm && vmm->func->part) {
+ mutex_lock(&vmm->mutex);
+ vmm->func->part(vmm, inst);
+ mutex_unlock(&vmm->mutex);
+diff --git a/drivers/hwmon/pmbus/ibm-cffps.c b/drivers/hwmon/pmbus/ibm-cffps.c
+index 93d9a9ea112b..edc70ac7d2d0 100644
+--- a/drivers/hwmon/pmbus/ibm-cffps.c
++++ b/drivers/hwmon/pmbus/ibm-cffps.c
+@@ -269,8 +269,8 @@ static int ibm_cffps_read_word_data(struct i2c_client *client, int page,
+ return rc;
+ }
+
+-static void ibm_cffps_led_brightness_set(struct led_classdev *led_cdev,
+- enum led_brightness brightness)
++static int ibm_cffps_led_brightness_set(struct led_classdev *led_cdev,
++ enum led_brightness brightness)
+ {
+ int rc;
+ struct ibm_cffps *psu = container_of(led_cdev, struct ibm_cffps, led);
+@@ -286,9 +286,11 @@ static void ibm_cffps_led_brightness_set(struct led_classdev *led_cdev,
+ rc = i2c_smbus_write_byte_data(psu->client, CFFPS_SYS_CONFIG_CMD,
+ psu->led_state);
+ if (rc < 0)
+- return;
++ return rc;
+
+ led_cdev->brightness = brightness;
++
++ return 0;
+ }
+
+ static int ibm_cffps_led_blink_set(struct led_classdev *led_cdev,
+@@ -324,7 +326,7 @@ static void ibm_cffps_create_led_class(struct ibm_cffps *psu)
+ client->addr);
+ psu->led.name = psu->led_name;
+ psu->led.max_brightness = LED_FULL;
+- psu->led.brightness_set = ibm_cffps_led_brightness_set;
++ psu->led.brightness_set_blocking = ibm_cffps_led_brightness_set;
+ psu->led.blink_set = ibm_cffps_led_blink_set;
+
+ rc = devm_led_classdev_register(dev, &psu->led);
+diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
+index dadd921a4a30..a0d089afa1a2 100644
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -570,7 +570,7 @@ static int iio_compute_scan_bytes(struct iio_dev *indio_dev,
+ const unsigned long *mask, bool timestamp)
+ {
+ unsigned bytes = 0;
+- int length, i;
++ int length, i, largest = 0;
+
+ /* How much space will the demuxed element take? */
+ for_each_set_bit(i, mask,
+@@ -578,13 +578,17 @@ static int iio_compute_scan_bytes(struct iio_dev *indio_dev,
+ length = iio_storage_bytes_for_si(indio_dev, i);
+ bytes = ALIGN(bytes, length);
+ bytes += length;
++ largest = max(largest, length);
+ }
+
+ if (timestamp) {
+ length = iio_storage_bytes_for_timestamp(indio_dev);
+ bytes = ALIGN(bytes, length);
+ bytes += length;
++ largest = max(largest, length);
+ }
++
++ bytes = ALIGN(bytes, largest);
+ return bytes;
+ }
+
+diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
+index 383e7b70221d..8cb6800dbdfb 100644
+--- a/drivers/irqchip/Kconfig
++++ b/drivers/irqchip/Kconfig
+@@ -371,8 +371,6 @@ config QCOM_PDC
+ Power Domain Controller driver to manage and configure wakeup
+ IRQs for Qualcomm Technologies Inc (QTI) mobile chips.
+
+-endmenu
+-
+ config SIFIVE_PLIC
+ bool "SiFive Platform-Level Interrupt Controller"
+ depends on RISCV
+@@ -384,3 +382,5 @@ config SIFIVE_PLIC
+ interrupt sources are subordinate to the PLIC.
+
+ If you don't know what to do here, say Y.
++
++endmenu
+diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
+index 3c50c4e4da8f..963d3774c93e 100644
+--- a/drivers/md/dm-snap-persistent.c
++++ b/drivers/md/dm-snap-persistent.c
+@@ -17,7 +17,7 @@
+ #include <linux/dm-bufio.h>
+
+ #define DM_MSG_PREFIX "persistent snapshot"
+-#define DM_CHUNK_SIZE_DEFAULT_SECTORS 32 /* 16KB */
++#define DM_CHUNK_SIZE_DEFAULT_SECTORS 32U /* 16KB */
+
+ #define DM_PREFETCH_CHUNKS 12
+
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index 2e7140507f93..efa9df2336da 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -94,7 +94,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ char b[BDEVNAME_SIZE];
+ char b2[BDEVNAME_SIZE];
+ struct r0conf *conf = kzalloc(sizeof(*conf), GFP_KERNEL);
+- unsigned short blksize = 512;
++ unsigned blksize = 512;
+
+ *private_conf = ERR_PTR(-ENOMEM);
+ if (!conf)
+diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
+index 8d22d6134a89..a0a42bdc3028 100644
+--- a/drivers/message/fusion/mptctl.c
++++ b/drivers/message/fusion/mptctl.c
+@@ -100,19 +100,19 @@ struct buflist {
+ * Function prototypes. Called from OS entry point mptctl_ioctl.
+ * arg contents specific to function.
+ */
+-static int mptctl_fw_download(unsigned long arg);
+-static int mptctl_getiocinfo(unsigned long arg, unsigned int cmd);
+-static int mptctl_gettargetinfo(unsigned long arg);
+-static int mptctl_readtest(unsigned long arg);
+-static int mptctl_mpt_command(unsigned long arg);
+-static int mptctl_eventquery(unsigned long arg);
+-static int mptctl_eventenable(unsigned long arg);
+-static int mptctl_eventreport(unsigned long arg);
+-static int mptctl_replace_fw(unsigned long arg);
+-
+-static int mptctl_do_reset(unsigned long arg);
+-static int mptctl_hp_hostinfo(unsigned long arg, unsigned int cmd);
+-static int mptctl_hp_targetinfo(unsigned long arg);
++static int mptctl_fw_download(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_getiocinfo(MPT_ADAPTER *iocp, unsigned long arg, unsigned int cmd);
++static int mptctl_gettargetinfo(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_readtest(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_mpt_command(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_eventquery(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_eventenable(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_eventreport(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_replace_fw(MPT_ADAPTER *iocp, unsigned long arg);
++
++static int mptctl_do_reset(MPT_ADAPTER *iocp, unsigned long arg);
++static int mptctl_hp_hostinfo(MPT_ADAPTER *iocp, unsigned long arg, unsigned int cmd);
++static int mptctl_hp_targetinfo(MPT_ADAPTER *iocp, unsigned long arg);
+
+ static int mptctl_probe(struct pci_dev *, const struct pci_device_id *);
+ static void mptctl_remove(struct pci_dev *);
+@@ -123,8 +123,8 @@ static long compat_mpctl_ioctl(struct file *f, unsigned cmd, unsigned long arg);
+ /*
+ * Private function calls.
+ */
+-static int mptctl_do_mpt_command(struct mpt_ioctl_command karg, void __user *mfPtr);
+-static int mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen);
++static int mptctl_do_mpt_command(MPT_ADAPTER *iocp, struct mpt_ioctl_command karg, void __user *mfPtr);
++static int mptctl_do_fw_download(MPT_ADAPTER *iocp, char __user *ufwbuf, size_t fwlen);
+ static MptSge_t *kbuf_alloc_2_sgl(int bytes, u32 dir, int sge_offset, int *frags,
+ struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc);
+ static void kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma,
+@@ -656,19 +656,19 @@ __mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ * by TM and FW reloads.
+ */
+ if ((cmd & ~IOCSIZE_MASK) == (MPTIOCINFO & ~IOCSIZE_MASK)) {
+- return mptctl_getiocinfo(arg, _IOC_SIZE(cmd));
++ return mptctl_getiocinfo(iocp, arg, _IOC_SIZE(cmd));
+ } else if (cmd == MPTTARGETINFO) {
+- return mptctl_gettargetinfo(arg);
++ return mptctl_gettargetinfo(iocp, arg);
+ } else if (cmd == MPTTEST) {
+- return mptctl_readtest(arg);
++ return mptctl_readtest(iocp, arg);
+ } else if (cmd == MPTEVENTQUERY) {
+- return mptctl_eventquery(arg);
++ return mptctl_eventquery(iocp, arg);
+ } else if (cmd == MPTEVENTENABLE) {
+- return mptctl_eventenable(arg);
++ return mptctl_eventenable(iocp, arg);
+ } else if (cmd == MPTEVENTREPORT) {
+- return mptctl_eventreport(arg);
++ return mptctl_eventreport(iocp, arg);
+ } else if (cmd == MPTFWREPLACE) {
+- return mptctl_replace_fw(arg);
++ return mptctl_replace_fw(iocp, arg);
+ }
+
+ /* All of these commands require an interrupt or
+@@ -678,15 +678,15 @@ __mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ return ret;
+
+ if (cmd == MPTFWDOWNLOAD)
+- ret = mptctl_fw_download(arg);
++ ret = mptctl_fw_download(iocp, arg);
+ else if (cmd == MPTCOMMAND)
+- ret = mptctl_mpt_command(arg);
++ ret = mptctl_mpt_command(iocp, arg);
+ else if (cmd == MPTHARDRESET)
+- ret = mptctl_do_reset(arg);
++ ret = mptctl_do_reset(iocp, arg);
+ else if ((cmd & ~IOCSIZE_MASK) == (HP_GETHOSTINFO & ~IOCSIZE_MASK))
+- ret = mptctl_hp_hostinfo(arg, _IOC_SIZE(cmd));
++ ret = mptctl_hp_hostinfo(iocp, arg, _IOC_SIZE(cmd));
+ else if (cmd == HP_GETTARGETINFO)
+- ret = mptctl_hp_targetinfo(arg);
++ ret = mptctl_hp_targetinfo(iocp, arg);
+ else
+ ret = -EINVAL;
+
+@@ -705,11 +705,10 @@ mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ return ret;
+ }
+
+-static int mptctl_do_reset(unsigned long arg)
++static int mptctl_do_reset(MPT_ADAPTER *iocp, unsigned long arg)
+ {
+ struct mpt_ioctl_diag_reset __user *urinfo = (void __user *) arg;
+ struct mpt_ioctl_diag_reset krinfo;
+- MPT_ADAPTER *iocp;
+
+ if (copy_from_user(&krinfo, urinfo, sizeof(struct mpt_ioctl_diag_reset))) {
+ printk(KERN_ERR MYNAM "%s@%d::mptctl_do_reset - "
+@@ -718,12 +717,6 @@ static int mptctl_do_reset(unsigned long arg)
+ return -EFAULT;
+ }
+
+- if (mpt_verify_adapter(krinfo.hdr.iocnum, &iocp) < 0) {
+- printk(KERN_DEBUG MYNAM "%s@%d::mptctl_do_reset - ioc%d not found!\n",
+- __FILE__, __LINE__, krinfo.hdr.iocnum);
+- return -ENODEV; /* (-6) No such device or address */
+- }
+-
+ dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "mptctl_do_reset called.\n",
+ iocp->name));
+
+@@ -754,7 +747,7 @@ static int mptctl_do_reset(unsigned long arg)
+ * -ENOMSG if FW upload returned bad status
+ */
+ static int
+-mptctl_fw_download(unsigned long arg)
++mptctl_fw_download(MPT_ADAPTER *iocp, unsigned long arg)
+ {
+ struct mpt_fw_xfer __user *ufwdl = (void __user *) arg;
+ struct mpt_fw_xfer kfwdl;
+@@ -766,7 +759,7 @@ mptctl_fw_download(unsigned long arg)
+ return -EFAULT;
+ }
+
+- return mptctl_do_fw_download(kfwdl.iocnum, kfwdl.bufp, kfwdl.fwlen);
++ return mptctl_do_fw_download(iocp, kfwdl.bufp, kfwdl.fwlen);
+ }
+
+ /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+@@ -784,11 +777,10 @@ mptctl_fw_download(unsigned long arg)
+ * -ENOMSG if FW upload returned bad status
+ */
+ static int
+-mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
++mptctl_do_fw_download(MPT_ADAPTER *iocp, char __user *ufwbuf, size_t fwlen)
+ {
+ FWDownload_t *dlmsg;
+ MPT_FRAME_HDR *mf;
+- MPT_ADAPTER *iocp;
+ FWDownloadTCSGE_t *ptsge;
+ MptSge_t *sgl, *sgIn;
+ char *sgOut;
+@@ -808,17 +800,10 @@ mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
+ pFWDownloadReply_t ReplyMsg = NULL;
+ unsigned long timeleft;
+
+- if (mpt_verify_adapter(ioc, &iocp) < 0) {
+- printk(KERN_DEBUG MYNAM "ioctl_fwdl - ioc%d not found!\n",
+- ioc);
+- return -ENODEV; /* (-6) No such device or address */
+- } else {
+-
+- /* Valid device. Get a message frame and construct the FW download message.
+- */
+- if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
+- return -EAGAIN;
+- }
++ /* Valid device. Get a message frame and construct the FW download message.
++ */
++ if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
++ return -EAGAIN;
+
+ dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT
+ "mptctl_do_fwdl called. mptctl_id = %xh.\n", iocp->name, mptctl_id));
+@@ -826,8 +811,6 @@ mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
+ iocp->name, ufwbuf));
+ dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.fwlen = %d\n",
+ iocp->name, (int)fwlen));
+- dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.ioc = %04xh\n",
+- iocp->name, ioc));
+
+ dlmsg = (FWDownload_t*) mf;
+ ptsge = (FWDownloadTCSGE_t *) &dlmsg->SGL;
+@@ -1238,13 +1221,11 @@ kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma, struct buflist *buflist, MPT_ADAPTE
+ * -ENODEV if no such device/adapter
+ */
+ static int
+-mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
++mptctl_getiocinfo (MPT_ADAPTER *ioc, unsigned long arg, unsigned int data_size)
+ {
+ struct mpt_ioctl_iocinfo __user *uarg = (void __user *) arg;
+ struct mpt_ioctl_iocinfo *karg;
+- MPT_ADAPTER *ioc;
+ struct pci_dev *pdev;
+- int iocnum;
+ unsigned int port;
+ int cim_rev;
+ struct scsi_device *sdev;
+@@ -1272,14 +1253,6 @@ mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
+ return PTR_ERR(karg);
+ }
+
+- if (((iocnum = mpt_verify_adapter(karg->hdr.iocnum, &ioc)) < 0) ||
+- (ioc == NULL)) {
+- printk(KERN_DEBUG MYNAM "%s::mptctl_getiocinfo() @%d - ioc%d not found!\n",
+- __FILE__, __LINE__, iocnum);
+- kfree(karg);
+- return -ENODEV;
+- }
+-
+ /* Verify the data transfer size is correct. */
+ if (karg->hdr.maxDataSize != data_size) {
+ printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
+@@ -1385,15 +1358,13 @@ mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
+ * -ENODEV if no such device/adapter
+ */
+ static int
+-mptctl_gettargetinfo (unsigned long arg)
++mptctl_gettargetinfo (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ struct mpt_ioctl_targetinfo __user *uarg = (void __user *) arg;
+ struct mpt_ioctl_targetinfo karg;
+- MPT_ADAPTER *ioc;
+ VirtDevice *vdevice;
+ char *pmem;
+ int *pdata;
+- int iocnum;
+ int numDevices = 0;
+ int lun;
+ int maxWordsLeft;
+@@ -1408,13 +1379,6 @@ mptctl_gettargetinfo (unsigned long arg)
+ return -EFAULT;
+ }
+
+- if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+- (ioc == NULL)) {
+- printk(KERN_DEBUG MYNAM "%s::mptctl_gettargetinfo() @%d - ioc%d not found!\n",
+- __FILE__, __LINE__, iocnum);
+- return -ENODEV;
+- }
+-
+ dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_gettargetinfo called.\n",
+ ioc->name));
+ /* Get the port number and set the maximum number of bytes
+@@ -1510,12 +1474,10 @@ mptctl_gettargetinfo (unsigned long arg)
+ * -ENODEV if no such device/adapter
+ */
+ static int
+-mptctl_readtest (unsigned long arg)
++mptctl_readtest (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ struct mpt_ioctl_test __user *uarg = (void __user *) arg;
+ struct mpt_ioctl_test karg;
+- MPT_ADAPTER *ioc;
+- int iocnum;
+
+ if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_test))) {
+ printk(KERN_ERR MYNAM "%s@%d::mptctl_readtest - "
+@@ -1524,13 +1486,6 @@ mptctl_readtest (unsigned long arg)
+ return -EFAULT;
+ }
+
+- if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+- (ioc == NULL)) {
+- printk(KERN_DEBUG MYNAM "%s::mptctl_readtest() @%d - ioc%d not found!\n",
+- __FILE__, __LINE__, iocnum);
+- return -ENODEV;
+- }
+-
+ dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_readtest called.\n",
+ ioc->name));
+ /* Fill in the data and return the structure to the calling
+@@ -1571,12 +1526,10 @@ mptctl_readtest (unsigned long arg)
+ * -ENODEV if no such device/adapter
+ */
+ static int
+-mptctl_eventquery (unsigned long arg)
++mptctl_eventquery (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ struct mpt_ioctl_eventquery __user *uarg = (void __user *) arg;
+ struct mpt_ioctl_eventquery karg;
+- MPT_ADAPTER *ioc;
+- int iocnum;
+
+ if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventquery))) {
+ printk(KERN_ERR MYNAM "%s@%d::mptctl_eventquery - "
+@@ -1585,13 +1538,6 @@ mptctl_eventquery (unsigned long arg)
+ return -EFAULT;
+ }
+
+- if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+- (ioc == NULL)) {
+- printk(KERN_DEBUG MYNAM "%s::mptctl_eventquery() @%d - ioc%d not found!\n",
+- __FILE__, __LINE__, iocnum);
+- return -ENODEV;
+- }
+-
+ dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventquery called.\n",
+ ioc->name));
+ karg.eventEntries = MPTCTL_EVENT_LOG_SIZE;
+@@ -1610,12 +1556,10 @@ mptctl_eventquery (unsigned long arg)
+
+ /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+ static int
+-mptctl_eventenable (unsigned long arg)
++mptctl_eventenable (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ struct mpt_ioctl_eventenable __user *uarg = (void __user *) arg;
+ struct mpt_ioctl_eventenable karg;
+- MPT_ADAPTER *ioc;
+- int iocnum;
+
+ if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventenable))) {
+ printk(KERN_ERR MYNAM "%s@%d::mptctl_eventenable - "
+@@ -1624,13 +1568,6 @@ mptctl_eventenable (unsigned long arg)
+ return -EFAULT;
+ }
+
+- if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+- (ioc == NULL)) {
+- printk(KERN_DEBUG MYNAM "%s::mptctl_eventenable() @%d - ioc%d not found!\n",
+- __FILE__, __LINE__, iocnum);
+- return -ENODEV;
+- }
+-
+ dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventenable called.\n",
+ ioc->name));
+ if (ioc->events == NULL) {
+@@ -1658,12 +1595,10 @@ mptctl_eventenable (unsigned long arg)
+
+ /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+ static int
+-mptctl_eventreport (unsigned long arg)
++mptctl_eventreport (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ struct mpt_ioctl_eventreport __user *uarg = (void __user *) arg;
+ struct mpt_ioctl_eventreport karg;
+- MPT_ADAPTER *ioc;
+- int iocnum;
+ int numBytes, maxEvents, max;
+
+ if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventreport))) {
+@@ -1673,12 +1608,6 @@ mptctl_eventreport (unsigned long arg)
+ return -EFAULT;
+ }
+
+- if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+- (ioc == NULL)) {
+- printk(KERN_DEBUG MYNAM "%s::mptctl_eventreport() @%d - ioc%d not found!\n",
+- __FILE__, __LINE__, iocnum);
+- return -ENODEV;
+- }
+ dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventreport called.\n",
+ ioc->name));
+
+@@ -1712,12 +1641,10 @@ mptctl_eventreport (unsigned long arg)
+
+ /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+ static int
+-mptctl_replace_fw (unsigned long arg)
++mptctl_replace_fw (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ struct mpt_ioctl_replace_fw __user *uarg = (void __user *) arg;
+ struct mpt_ioctl_replace_fw karg;
+- MPT_ADAPTER *ioc;
+- int iocnum;
+ int newFwSize;
+
+ if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_replace_fw))) {
+@@ -1727,13 +1654,6 @@ mptctl_replace_fw (unsigned long arg)
+ return -EFAULT;
+ }
+
+- if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+- (ioc == NULL)) {
+- printk(KERN_DEBUG MYNAM "%s::mptctl_replace_fw() @%d - ioc%d not found!\n",
+- __FILE__, __LINE__, iocnum);
+- return -ENODEV;
+- }
+-
+ dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_replace_fw called.\n",
+ ioc->name));
+ /* If caching FW, Free the old FW image
+@@ -1780,12 +1700,10 @@ mptctl_replace_fw (unsigned long arg)
+ * -ENOMEM if memory allocation error
+ */
+ static int
+-mptctl_mpt_command (unsigned long arg)
++mptctl_mpt_command (MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ struct mpt_ioctl_command __user *uarg = (void __user *) arg;
+ struct mpt_ioctl_command karg;
+- MPT_ADAPTER *ioc;
+- int iocnum;
+ int rc;
+
+
+@@ -1796,14 +1714,7 @@ mptctl_mpt_command (unsigned long arg)
+ return -EFAULT;
+ }
+
+- if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+- (ioc == NULL)) {
+- printk(KERN_DEBUG MYNAM "%s::mptctl_mpt_command() @%d - ioc%d not found!\n",
+- __FILE__, __LINE__, iocnum);
+- return -ENODEV;
+- }
+-
+- rc = mptctl_do_mpt_command (karg, &uarg->MF);
++ rc = mptctl_do_mpt_command (ioc, karg, &uarg->MF);
+
+ return rc;
+ }
+@@ -1821,9 +1732,8 @@ mptctl_mpt_command (unsigned long arg)
+ * -EPERM if SCSI I/O and target is untagged
+ */
+ static int
+-mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
++mptctl_do_mpt_command (MPT_ADAPTER *ioc, struct mpt_ioctl_command karg, void __user *mfPtr)
+ {
+- MPT_ADAPTER *ioc;
+ MPT_FRAME_HDR *mf = NULL;
+ MPIHeader_t *hdr;
+ char *psge;
+@@ -1832,7 +1742,7 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
+ dma_addr_t dma_addr_in;
+ dma_addr_t dma_addr_out;
+ int sgSize = 0; /* Num SG elements */
+- int iocnum, flagsLength;
++ int flagsLength;
+ int sz, rc = 0;
+ int msgContext;
+ u16 req_idx;
+@@ -1847,13 +1757,6 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
+ bufIn.kptr = bufOut.kptr = NULL;
+ bufIn.len = bufOut.len = 0;
+
+- if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+- (ioc == NULL)) {
+- printk(KERN_DEBUG MYNAM "%s::mptctl_do_mpt_command() @%d - ioc%d not found!\n",
+- __FILE__, __LINE__, iocnum);
+- return -ENODEV;
+- }
+-
+ spin_lock_irqsave(&ioc->taskmgmt_lock, flags);
+ if (ioc->ioc_reset_in_progress) {
+ spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
+@@ -2418,17 +2321,15 @@ done_free_mem:
+ * -ENOMEM if memory allocation error
+ */
+ static int
+-mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
++mptctl_hp_hostinfo(MPT_ADAPTER *ioc, unsigned long arg, unsigned int data_size)
+ {
+ hp_host_info_t __user *uarg = (void __user *) arg;
+- MPT_ADAPTER *ioc;
+ struct pci_dev *pdev;
+ char *pbuf=NULL;
+ dma_addr_t buf_dma;
+ hp_host_info_t karg;
+ CONFIGPARMS cfg;
+ ConfigPageHeader_t hdr;
+- int iocnum;
+ int rc, cim_rev;
+ ToolboxIstwiReadWriteRequest_t *IstwiRWRequest;
+ MPT_FRAME_HDR *mf = NULL;
+@@ -2452,12 +2353,6 @@ mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
+ return -EFAULT;
+ }
+
+- if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+- (ioc == NULL)) {
+- printk(KERN_DEBUG MYNAM "%s::mptctl_hp_hostinfo() @%d - ioc%d not found!\n",
+- __FILE__, __LINE__, iocnum);
+- return -ENODEV;
+- }
+ dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": mptctl_hp_hostinfo called.\n",
+ ioc->name));
+
+@@ -2659,15 +2554,13 @@ retry_wait:
+ * -ENOMEM if memory allocation error
+ */
+ static int
+-mptctl_hp_targetinfo(unsigned long arg)
++mptctl_hp_targetinfo(MPT_ADAPTER *ioc, unsigned long arg)
+ {
+ hp_target_info_t __user *uarg = (void __user *) arg;
+ SCSIDevicePage0_t *pg0_alloc;
+ SCSIDevicePage3_t *pg3_alloc;
+- MPT_ADAPTER *ioc;
+ MPT_SCSI_HOST *hd = NULL;
+ hp_target_info_t karg;
+- int iocnum;
+ int data_sz;
+ dma_addr_t page_dma;
+ CONFIGPARMS cfg;
+@@ -2681,12 +2574,6 @@ mptctl_hp_targetinfo(unsigned long arg)
+ return -EFAULT;
+ }
+
+- if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
+- (ioc == NULL)) {
+- printk(KERN_DEBUG MYNAM "%s::mptctl_hp_targetinfo() @%d - ioc%d not found!\n",
+- __FILE__, __LINE__, iocnum);
+- return -ENODEV;
+- }
+ if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
+ return -EINVAL;
+ dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
+@@ -2854,7 +2741,7 @@ compat_mptfwxfer_ioctl(struct file *filp, unsigned int cmd,
+ kfw.fwlen = kfw32.fwlen;
+ kfw.bufp = compat_ptr(kfw32.bufp);
+
+- ret = mptctl_do_fw_download(kfw.iocnum, kfw.bufp, kfw.fwlen);
++ ret = mptctl_do_fw_download(iocp, kfw.bufp, kfw.fwlen);
+
+ mutex_unlock(&iocp->ioctl_cmds.mutex);
+
+@@ -2908,7 +2795,7 @@ compat_mpt_command(struct file *filp, unsigned int cmd,
+
+ /* Pass new structure to do_mpt_command
+ */
+- ret = mptctl_do_mpt_command (karg, &uarg->MF);
++ ret = mptctl_do_mpt_command (iocp, karg, &uarg->MF);
+
+ mutex_unlock(&iocp->ioctl_cmds.mutex);
+
+diff --git a/drivers/mtd/devices/mchp23k256.c b/drivers/mtd/devices/mchp23k256.c
+index 75f71d166fd6..c2f52aed80b9 100644
+--- a/drivers/mtd/devices/mchp23k256.c
++++ b/drivers/mtd/devices/mchp23k256.c
+@@ -68,15 +68,17 @@ static int mchp23k256_write(struct mtd_info *mtd, loff_t to, size_t len,
+ struct spi_transfer transfer[2] = {};
+ struct spi_message message;
+ unsigned char command[MAX_CMD_SIZE];
+- int ret;
++ int ret, cmd_len;
+
+ spi_message_init(&message);
+
++ cmd_len = mchp23k256_cmdsz(flash);
++
+ command[0] = MCHP23K256_CMD_WRITE;
+ mchp23k256_addr2cmd(flash, to, command);
+
+ transfer[0].tx_buf = command;
+- transfer[0].len = mchp23k256_cmdsz(flash);
++ transfer[0].len = cmd_len;
+ spi_message_add_tail(&transfer[0], &message);
+
+ transfer[1].tx_buf = buf;
+@@ -92,8 +94,8 @@ static int mchp23k256_write(struct mtd_info *mtd, loff_t to, size_t len,
+ if (ret)
+ return ret;
+
+- if (retlen && message.actual_length > sizeof(command))
+- *retlen += message.actual_length - sizeof(command);
++ if (retlen && message.actual_length > cmd_len)
++ *retlen += message.actual_length - cmd_len;
+
+ return 0;
+ }
+@@ -105,16 +107,18 @@ static int mchp23k256_read(struct mtd_info *mtd, loff_t from, size_t len,
+ struct spi_transfer transfer[2] = {};
+ struct spi_message message;
+ unsigned char command[MAX_CMD_SIZE];
+- int ret;
++ int ret, cmd_len;
+
+ spi_message_init(&message);
+
++ cmd_len = mchp23k256_cmdsz(flash);
++
+ memset(&transfer, 0, sizeof(transfer));
+ command[0] = MCHP23K256_CMD_READ;
+ mchp23k256_addr2cmd(flash, from, command);
+
+ transfer[0].tx_buf = command;
+- transfer[0].len = mchp23k256_cmdsz(flash);
++ transfer[0].len = cmd_len;
+ spi_message_add_tail(&transfer[0], &message);
+
+ transfer[1].rx_buf = buf;
+@@ -130,8 +134,8 @@ static int mchp23k256_read(struct mtd_info *mtd, loff_t from, size_t len,
+ if (ret)
+ return ret;
+
+- if (retlen && message.actual_length > sizeof(command))
+- *retlen += message.actual_length - sizeof(command);
++ if (retlen && message.actual_length > cmd_len)
++ *retlen += message.actual_length - cmd_len;
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 7f8cf809e02b..024b08fafd3b 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -569,7 +569,6 @@ static int hns_nic_poll_rx_skb(struct hns_nic_ring_data *ring_data,
+ skb = *out_skb = napi_alloc_skb(&ring_data->napi,
+ HNS_RX_HEAD_SIZE);
+ if (unlikely(!skb)) {
+- netdev_err(ndev, "alloc rx skb fail\n");
+ ring->stats.sw_err_cnt++;
+ return -ENOMEM;
+ }
+@@ -1060,7 +1059,6 @@ static int hns_nic_common_poll(struct napi_struct *napi, int budget)
+ container_of(napi, struct hns_nic_ring_data, napi);
+ struct hnae_ring *ring = ring_data->ring;
+
+-try_again:
+ clean_complete += ring_data->poll_one(
+ ring_data, budget - clean_complete,
+ ring_data->ex_process);
+@@ -1070,7 +1068,7 @@ try_again:
+ napi_complete(napi);
+ ring->q->handle->dev->ops->toggle_ring_irq(ring, 0);
+ } else {
+- goto try_again;
++ return budget;
+ }
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index e498ee95baca..30ef318b3d68 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -1061,6 +1061,9 @@ static void update_stats_cache(struct work_struct *work)
+ periodic_hw_stats.update_dw.work);
+
+ if (!netif_carrier_ok(mlxsw_sp_port->dev))
++ /* Note: mlxsw_sp_port_down_wipe_counters() clears the cache as
++ * necessary when port goes down.
++ */
+ goto out;
+
+ mlxsw_sp_port_get_hw_stats(mlxsw_sp_port->dev,
+@@ -3309,6 +3312,15 @@ static int mlxsw_sp_port_unsplit(struct mlxsw_core *mlxsw_core, u8 local_port,
+ return 0;
+ }
+
++static void
++mlxsw_sp_port_down_wipe_counters(struct mlxsw_sp_port *mlxsw_sp_port)
++{
++ int i;
++
++ for (i = 0; i < TC_MAX_QUEUE; i++)
++ mlxsw_sp_port->periodic_hw_stats.xstats.backlog[i] = 0;
++}
++
+ static void mlxsw_sp_pude_event_func(const struct mlxsw_reg_info *reg,
+ char *pude_pl, void *priv)
+ {
+@@ -3329,6 +3341,7 @@ static void mlxsw_sp_pude_event_func(const struct mlxsw_reg_info *reg,
+ } else {
+ netdev_info(mlxsw_sp_port->dev, "link down\n");
+ netif_carrier_off(mlxsw_sp_port->dev);
++ mlxsw_sp_port_down_wipe_counters(mlxsw_sp_port);
+ }
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
+index 720514b5c006..dc63583c4948 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
+@@ -195,6 +195,20 @@ mlxsw_sp_qdisc_get_xstats(struct mlxsw_sp_port *mlxsw_sp_port,
+ return -EOPNOTSUPP;
+ }
+
++static u64
++mlxsw_sp_xstats_backlog(struct mlxsw_sp_port_xstats *xstats, int tclass_num)
++{
++ return xstats->backlog[tclass_num] +
++ xstats->backlog[tclass_num + 8];
++}
++
++static u64
++mlxsw_sp_xstats_tail_drop(struct mlxsw_sp_port_xstats *xstats, int tclass_num)
++{
++ return xstats->tail_drop[tclass_num] +
++ xstats->tail_drop[tclass_num + 8];
++}
++
+ static void
+ mlxsw_sp_qdisc_bstats_per_priority_get(struct mlxsw_sp_port_xstats *xstats,
+ u8 prio_bitmap, u64 *tx_packets,
+@@ -269,7 +283,7 @@ mlxsw_sp_setup_tc_qdisc_red_clean_stats(struct mlxsw_sp_port *mlxsw_sp_port,
+ &stats_base->tx_bytes);
+ red_base->prob_mark = xstats->ecn;
+ red_base->prob_drop = xstats->wred_drop[tclass_num];
+- red_base->pdrop = xstats->tail_drop[tclass_num];
++ red_base->pdrop = mlxsw_sp_xstats_tail_drop(xstats, tclass_num);
+
+ stats_base->overlimits = red_base->prob_drop + red_base->prob_mark;
+ stats_base->drops = red_base->prob_drop + red_base->pdrop;
+@@ -369,7 +383,8 @@ mlxsw_sp_qdisc_get_red_xstats(struct mlxsw_sp_port *mlxsw_sp_port,
+
+ early_drops = xstats->wred_drop[tclass_num] - xstats_base->prob_drop;
+ marks = xstats->ecn - xstats_base->prob_mark;
+- pdrops = xstats->tail_drop[tclass_num] - xstats_base->pdrop;
++ pdrops = mlxsw_sp_xstats_tail_drop(xstats, tclass_num) -
++ xstats_base->pdrop;
+
+ res->pdrop += pdrops;
+ res->prob_drop += early_drops;
+@@ -402,9 +417,10 @@ mlxsw_sp_qdisc_get_red_stats(struct mlxsw_sp_port *mlxsw_sp_port,
+
+ overlimits = xstats->wred_drop[tclass_num] + xstats->ecn -
+ stats_base->overlimits;
+- drops = xstats->wred_drop[tclass_num] + xstats->tail_drop[tclass_num] -
++ drops = xstats->wred_drop[tclass_num] +
++ mlxsw_sp_xstats_tail_drop(xstats, tclass_num) -
+ stats_base->drops;
+- backlog = xstats->backlog[tclass_num];
++ backlog = mlxsw_sp_xstats_backlog(xstats, tclass_num);
+
+ _bstats_update(stats_ptr->bstats, tx_bytes, tx_packets);
+ stats_ptr->qstats->overlimits += overlimits;
+@@ -575,9 +591,9 @@ mlxsw_sp_qdisc_get_prio_stats(struct mlxsw_sp_port *mlxsw_sp_port,
+ tx_packets = stats->tx_packets - stats_base->tx_packets;
+
+ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+- drops += xstats->tail_drop[i];
++ drops += mlxsw_sp_xstats_tail_drop(xstats, i);
+ drops += xstats->wred_drop[i];
+- backlog += xstats->backlog[i];
++ backlog += mlxsw_sp_xstats_backlog(xstats, i);
+ }
+ drops = drops - stats_base->drops;
+
+@@ -613,7 +629,7 @@ mlxsw_sp_setup_tc_qdisc_prio_clean_stats(struct mlxsw_sp_port *mlxsw_sp_port,
+
+ stats_base->drops = 0;
+ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+- stats_base->drops += xstats->tail_drop[i];
++ stats_base->drops += mlxsw_sp_xstats_tail_drop(xstats, i);
+ stats_base->drops += xstats->wred_drop[i];
+ }
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 5e3e6e262ba3..6068e96f5ac1 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2184,24 +2184,28 @@ static size_t __sh_eth_get_regs(struct net_device *ndev, u32 *buf)
+ if (cd->tsu) {
+ add_tsu_reg(ARSTR);
+ add_tsu_reg(TSU_CTRST);
+- add_tsu_reg(TSU_FWEN0);
+- add_tsu_reg(TSU_FWEN1);
+- add_tsu_reg(TSU_FCM);
+- add_tsu_reg(TSU_BSYSL0);
+- add_tsu_reg(TSU_BSYSL1);
+- add_tsu_reg(TSU_PRISL0);
+- add_tsu_reg(TSU_PRISL1);
+- add_tsu_reg(TSU_FWSL0);
+- add_tsu_reg(TSU_FWSL1);
++ if (cd->dual_port) {
++ add_tsu_reg(TSU_FWEN0);
++ add_tsu_reg(TSU_FWEN1);
++ add_tsu_reg(TSU_FCM);
++ add_tsu_reg(TSU_BSYSL0);
++ add_tsu_reg(TSU_BSYSL1);
++ add_tsu_reg(TSU_PRISL0);
++ add_tsu_reg(TSU_PRISL1);
++ add_tsu_reg(TSU_FWSL0);
++ add_tsu_reg(TSU_FWSL1);
++ }
+ add_tsu_reg(TSU_FWSLC);
+- add_tsu_reg(TSU_QTAGM0);
+- add_tsu_reg(TSU_QTAGM1);
+- add_tsu_reg(TSU_FWSR);
+- add_tsu_reg(TSU_FWINMK);
+- add_tsu_reg(TSU_ADQT0);
+- add_tsu_reg(TSU_ADQT1);
+- add_tsu_reg(TSU_VTAG0);
+- add_tsu_reg(TSU_VTAG1);
++ if (cd->dual_port) {
++ add_tsu_reg(TSU_QTAGM0);
++ add_tsu_reg(TSU_QTAGM1);
++ add_tsu_reg(TSU_FWSR);
++ add_tsu_reg(TSU_FWINMK);
++ add_tsu_reg(TSU_ADQT0);
++ add_tsu_reg(TSU_ADQT1);
++ add_tsu_reg(TSU_VTAG0);
++ add_tsu_reg(TSU_VTAG1);
++ }
+ add_tsu_reg(TSU_ADSBSY);
+ add_tsu_reg(TSU_TEN);
+ add_tsu_reg(TSU_POST1);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
+index b069b3a2453b..c3c0c8ca082c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -363,9 +363,8 @@ struct dma_features {
+ unsigned int frpes;
+ };
+
+-/* GMAC TX FIFO is 8K, Rx FIFO is 16K */
+-#define BUF_SIZE_16KiB 16384
+-/* RX Buffer size must be < 8191 and multiple of 4/8/16 bytes */
++/* RX Buffer size must be multiple of 4/8/16 bytes */
++#define BUF_SIZE_16KiB 16368
+ #define BUF_SIZE_8KiB 8188
+ #define BUF_SIZE_4KiB 4096
+ #define BUF_SIZE_2KiB 2048
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 7ee0e46539c0..f069adfc2b35 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -1082,7 +1082,9 @@ static int stmmac_set_bfsize(int mtu, int bufsize)
+ {
+ int ret = bufsize;
+
+- if (mtu >= BUF_SIZE_4KiB)
++ if (mtu >= BUF_SIZE_8KiB)
++ ret = BUF_SIZE_16KiB;
++ else if (mtu >= BUF_SIZE_4KiB)
+ ret = BUF_SIZE_8KiB;
+ else if (mtu >= BUF_SIZE_2KiB)
+ ret = BUF_SIZE_4KiB;
+diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
+index f47e36ac42a7..dd91834f841d 100644
+--- a/drivers/net/hyperv/rndis_filter.c
++++ b/drivers/net/hyperv/rndis_filter.c
+@@ -1375,8 +1375,6 @@ void rndis_filter_device_remove(struct hv_device *dev,
+ /* Halt and release the rndis device */
+ rndis_filter_halt_device(net_dev, rndis_dev);
+
+- net_dev->extension = NULL;
+-
+ netvsc_device_remove(dev);
+ }
+
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 41c0a3b55bfb..277bbff53cff 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -263,7 +263,7 @@ static void macvlan_broadcast(struct sk_buff *skb,
+ struct net_device *src,
+ enum macvlan_mode mode)
+ {
+- const struct ethhdr *eth = skb_eth_hdr(skb);
++ const struct ethhdr *eth = eth_hdr(skb);
+ const struct macvlan_dev *vlan;
+ struct sk_buff *nskb;
+ unsigned int i;
+@@ -517,10 +517,11 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+ const struct macvlan_dev *dest;
+
+ if (vlan->mode == MACVLAN_MODE_BRIDGE) {
+- const struct ethhdr *eth = (void *)skb->data;
++ const struct ethhdr *eth = skb_eth_hdr(skb);
+
+ /* send to other bridge ports directly */
+ if (is_multicast_ether_addr(eth->h_dest)) {
++ skb_reset_mac_header(skb);
+ macvlan_broadcast(skb, port, dev, MACVLAN_MODE_BRIDGE);
+ goto xmit_world;
+ }
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 42715520c070..7d708aeb4576 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -3769,6 +3769,7 @@ static int lan78xx_probe(struct usb_interface *intf,
+
+ /* MTU range: 68 - 9000 */
+ netdev->max_mtu = MAX_SINGLE_PACKET_SIZE;
++ netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
+
+ dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;
+ dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 91d47a714afd..db817d3c2bb8 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -5167,6 +5167,9 @@ static int rtl8152_probe(struct usb_interface *intf,
+ return -ENODEV;
+ }
+
++ if (intf->cur_altsetting->desc.bNumEndpoints < 3)
++ return -ENODEV;
++
+ usb_reset_device(udev);
+ netdev = alloc_etherdev(sizeof(struct r8152));
+ if (!netdev) {
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index 0212f576a838..daeab33f623e 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -76,7 +76,7 @@ static struct ucc_tdm_info utdm_primary_info = {
+ },
+ };
+
+-static struct ucc_tdm_info utdm_info[MAX_HDLC_NUM];
++static struct ucc_tdm_info utdm_info[UCC_MAX_NUM];
+
+ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ {
+diff --git a/drivers/net/wireless/st/cw1200/fwio.c b/drivers/net/wireless/st/cw1200/fwio.c
+index 30e7646d04af..16be7fa82a23 100644
+--- a/drivers/net/wireless/st/cw1200/fwio.c
++++ b/drivers/net/wireless/st/cw1200/fwio.c
+@@ -323,12 +323,12 @@ int cw1200_load_firmware(struct cw1200_common *priv)
+ goto out;
+ }
+
+- priv->hw_type = cw1200_get_hw_type(val32, &major_revision);
+- if (priv->hw_type < 0) {
++ ret = cw1200_get_hw_type(val32, &major_revision);
++ if (ret < 0) {
+ pr_err("Can't deduce hardware type.\n");
+- ret = -ENOTSUPP;
+ goto out;
+ }
++ priv->hw_type = ret;
+
+ /* Set DPLL Reg value, and read back to confirm writes work */
+ ret = cw1200_reg_write_32(priv, ST90TDS_TSET_GEN_R_W_REG_ID,
+diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c
+index fcb57d64d97e..a2c9b3f3bc23 100644
+--- a/drivers/nfc/pn533/usb.c
++++ b/drivers/nfc/pn533/usb.c
+@@ -403,7 +403,7 @@ static int pn533_acr122_poweron_rdr(struct pn533_usb_phy *phy)
+ cmd, sizeof(cmd), false);
+
+ rc = usb_bulk_msg(phy->udev, phy->out_urb->pipe, buffer, sizeof(cmd),
+- &transferred, 0);
++ &transferred, 5000);
+ kfree(buffer);
+ if (rc || (transferred != sizeof(cmd))) {
+ nfc_err(&phy->udev->dev,
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index b818f65480c1..e232233beb8f 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -179,6 +179,7 @@ static void ptp_clock_release(struct device *dev)
+ {
+ struct ptp_clock *ptp = container_of(dev, struct ptp_clock, dev);
+
++ ptp_cleanup_pin_groups(ptp);
+ mutex_destroy(&ptp->tsevq_mux);
+ mutex_destroy(&ptp->pincfg_mux);
+ ida_simple_remove(&ptp_clocks_map, ptp->index);
+@@ -315,9 +316,8 @@ int ptp_clock_unregister(struct ptp_clock *ptp)
+ if (ptp->pps_source)
+ pps_unregister_source(ptp->pps_source);
+
+- ptp_cleanup_pin_groups(ptp);
+-
+ posix_clock_unregister(&ptp->clock);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(ptp_clock_unregister);
+diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+index de0a507577ef..718a0335cfbb 100644
+--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+@@ -915,12 +915,12 @@ void bnx2i_free_hba(struct bnx2i_hba *hba)
+ INIT_LIST_HEAD(&hba->ep_ofld_list);
+ INIT_LIST_HEAD(&hba->ep_active_list);
+ INIT_LIST_HEAD(&hba->ep_destroy_list);
+- pci_dev_put(hba->pcidev);
+
+ if (hba->regview) {
+ pci_iounmap(hba->pcidev, hba->regview);
+ hba->regview = NULL;
+ }
++ pci_dev_put(hba->pcidev);
+ bnx2i_free_mp_bdt(hba);
+ bnx2i_release_free_cid_que(hba);
+ iscsi_host_free(shost);
+diff --git a/drivers/scsi/esas2r/esas2r_flash.c b/drivers/scsi/esas2r/esas2r_flash.c
+index 7bd376d95ed5..b02ac389e6c6 100644
+--- a/drivers/scsi/esas2r/esas2r_flash.c
++++ b/drivers/scsi/esas2r/esas2r_flash.c
+@@ -1197,6 +1197,7 @@ bool esas2r_nvram_read_direct(struct esas2r_adapter *a)
+ if (!esas2r_read_flash_block(a, a->nvram, FLS_OFFSET_NVR,
+ sizeof(struct esas2r_sas_nvram))) {
+ esas2r_hdebug("NVRAM read failed, using defaults");
++ up(&a->nvram_semaphore);
+ return false;
+ }
+
+diff --git a/drivers/scsi/fnic/vnic_dev.c b/drivers/scsi/fnic/vnic_dev.c
+index ba69d6112fa1..c5b89a003d2a 100644
+--- a/drivers/scsi/fnic/vnic_dev.c
++++ b/drivers/scsi/fnic/vnic_dev.c
+@@ -445,26 +445,26 @@ int vnic_dev_soft_reset_done(struct vnic_dev *vdev, int *done)
+
+ int vnic_dev_hang_notify(struct vnic_dev *vdev)
+ {
+- u64 a0, a1;
++ u64 a0 = 0, a1 = 0;
+ int wait = 1000;
+ return vnic_dev_cmd(vdev, CMD_HANG_NOTIFY, &a0, &a1, wait);
+ }
+
+ int vnic_dev_mac_addr(struct vnic_dev *vdev, u8 *mac_addr)
+ {
+- u64 a0, a1;
++ u64 a[2] = {};
+ int wait = 1000;
+ int err, i;
+
+ for (i = 0; i < ETH_ALEN; i++)
+ mac_addr[i] = 0;
+
+- err = vnic_dev_cmd(vdev, CMD_MAC_ADDR, &a0, &a1, wait);
++ err = vnic_dev_cmd(vdev, CMD_MAC_ADDR, &a[0], &a[1], wait);
+ if (err)
+ return err;
+
+ for (i = 0; i < ETH_ALEN; i++)
+- mac_addr[i] = ((u8 *)&a0)[i];
++ mac_addr[i] = ((u8 *)&a)[i];
+
+ return 0;
+ }
+@@ -489,30 +489,30 @@ void vnic_dev_packet_filter(struct vnic_dev *vdev, int directed, int multicast,
+
+ void vnic_dev_add_addr(struct vnic_dev *vdev, u8 *addr)
+ {
+- u64 a0 = 0, a1 = 0;
++ u64 a[2] = {};
+ int wait = 1000;
+ int err;
+ int i;
+
+ for (i = 0; i < ETH_ALEN; i++)
+- ((u8 *)&a0)[i] = addr[i];
++ ((u8 *)&a)[i] = addr[i];
+
+- err = vnic_dev_cmd(vdev, CMD_ADDR_ADD, &a0, &a1, wait);
++ err = vnic_dev_cmd(vdev, CMD_ADDR_ADD, &a[0], &a[1], wait);
+ if (err)
+ pr_err("Can't add addr [%pM], %d\n", addr, err);
+ }
+
+ void vnic_dev_del_addr(struct vnic_dev *vdev, u8 *addr)
+ {
+- u64 a0 = 0, a1 = 0;
++ u64 a[2] = {};
+ int wait = 1000;
+ int err;
+ int i;
+
+ for (i = 0; i < ETH_ALEN; i++)
+- ((u8 *)&a0)[i] = addr[i];
++ ((u8 *)&a)[i] = addr[i];
+
+- err = vnic_dev_cmd(vdev, CMD_ADDR_DEL, &a0, &a1, wait);
++ err = vnic_dev_cmd(vdev, CMD_ADDR_DEL, &a[0], &a[1], wait);
+ if (err)
+ pr_err("Can't del addr [%pM], %d\n", addr, err);
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 851f75b12216..f45759b353be 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -5710,8 +5710,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha)
+ if (test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags))
+ break;
+
+- if ((fcport->flags & FCF_FABRIC_DEVICE) == 0 ||
+- (fcport->flags & FCF_LOGIN_NEEDED) == 0)
++ if ((fcport->flags & FCF_FABRIC_DEVICE) == 0)
+ continue;
+
+ if (fcport->scan_state == QLA_FCPORT_SCAN) {
+@@ -5734,7 +5733,8 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha)
+ }
+ }
+
+- if (fcport->scan_state == QLA_FCPORT_FOUND)
++ if (fcport->scan_state == QLA_FCPORT_FOUND &&
++ (fcport->flags & FCF_LOGIN_NEEDED) != 0)
+ qla24xx_fcport_handle_login(vha, fcport);
+ }
+ return (rval);
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index e6d162945f5d..01ded6c6ad38 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -3573,7 +3573,7 @@ qla2x00_request_irqs(struct qla_hw_data *ha, struct rsp_que *rsp)
+ skip_msix:
+
+ ql_log(ql_log_info, vha, 0x0037,
+- "Falling back-to MSI mode -%d.\n", ret);
++ "Falling back-to MSI mode -- ret=%d.\n", ret);
+
+ if (!IS_QLA24XX(ha) && !IS_QLA2532(ha) && !IS_QLA8432(ha) &&
+ !IS_QLA8001(ha) && !IS_P3P_TYPE(ha) && !IS_QLAFX00(ha) &&
+@@ -3581,13 +3581,13 @@ skip_msix:
+ goto skip_msi;
+
+ ret = pci_alloc_irq_vectors(ha->pdev, 1, 1, PCI_IRQ_MSI);
+- if (!ret) {
++ if (ret > 0) {
+ ql_dbg(ql_dbg_init, vha, 0x0038,
+ "MSI: Enabled.\n");
+ ha->flags.msi_enabled = 1;
+ } else
+ ql_log(ql_log_warn, vha, 0x0039,
+- "Falling back-to INTa mode -- %d.\n", ret);
++ "Falling back-to INTa mode -- ret=%d.\n", ret);
+ skip_msi:
+
+ /* Skip INTx on ISP82xx. */
+diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
+index 5d56904687b9..c81de7732359 100644
+--- a/drivers/scsi/qla4xxx/ql4_mbx.c
++++ b/drivers/scsi/qla4xxx/ql4_mbx.c
+@@ -640,9 +640,6 @@ int qla4xxx_initialize_fw_cb(struct scsi_qla_host * ha)
+
+ if (qla4xxx_get_ifcb(ha, &mbox_cmd[0], &mbox_sts[0], init_fw_cb_dma) !=
+ QLA_SUCCESS) {
+- dma_free_coherent(&ha->pdev->dev,
+- sizeof(struct addr_ctrl_blk),
+- init_fw_cb, init_fw_cb_dma);
+ goto exit_init_fw_cb;
+ }
+
+diff --git a/drivers/scsi/scsi_trace.c b/drivers/scsi/scsi_trace.c
+index 617a60737590..22472d140ef7 100644
+--- a/drivers/scsi/scsi_trace.c
++++ b/drivers/scsi/scsi_trace.c
+@@ -21,7 +21,7 @@
+ #include <trace/events/scsi.h>
+
+ #define SERVICE_ACTION16(cdb) (cdb[1] & 0x1f)
+-#define SERVICE_ACTION32(cdb) ((cdb[8] << 8) | cdb[9])
++#define SERVICE_ACTION32(cdb) (get_unaligned_be16(&cdb[8]))
+
+ static const char *
+ scsi_trace_misc(struct trace_seq *, unsigned char *, int);
+@@ -51,17 +51,12 @@ static const char *
+ scsi_trace_rw10(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p);
+- sector_t lba = 0, txlen = 0;
++ u32 lba, txlen;
+
+- lba |= (cdb[2] << 24);
+- lba |= (cdb[3] << 16);
+- lba |= (cdb[4] << 8);
+- lba |= cdb[5];
+- txlen |= (cdb[7] << 8);
+- txlen |= cdb[8];
++ lba = get_unaligned_be32(&cdb[2]);
++ txlen = get_unaligned_be16(&cdb[7]);
+
+- trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+- (unsigned long long)lba, (unsigned long long)txlen,
++ trace_seq_printf(p, "lba=%u txlen=%u protect=%u", lba, txlen,
+ cdb[1] >> 5);
+
+ if (cdb[0] == WRITE_SAME)
+@@ -76,19 +71,12 @@ static const char *
+ scsi_trace_rw12(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p);
+- sector_t lba = 0, txlen = 0;
+-
+- lba |= (cdb[2] << 24);
+- lba |= (cdb[3] << 16);
+- lba |= (cdb[4] << 8);
+- lba |= cdb[5];
+- txlen |= (cdb[6] << 24);
+- txlen |= (cdb[7] << 16);
+- txlen |= (cdb[8] << 8);
+- txlen |= cdb[9];
+-
+- trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+- (unsigned long long)lba, (unsigned long long)txlen,
++ u32 lba, txlen;
++
++ lba = get_unaligned_be32(&cdb[2]);
++ txlen = get_unaligned_be32(&cdb[6]);
++
++ trace_seq_printf(p, "lba=%u txlen=%u protect=%u", lba, txlen,
+ cdb[1] >> 5);
+ trace_seq_putc(p, 0);
+
+@@ -99,23 +87,13 @@ static const char *
+ scsi_trace_rw16(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p);
+- sector_t lba = 0, txlen = 0;
+-
+- lba |= ((u64)cdb[2] << 56);
+- lba |= ((u64)cdb[3] << 48);
+- lba |= ((u64)cdb[4] << 40);
+- lba |= ((u64)cdb[5] << 32);
+- lba |= (cdb[6] << 24);
+- lba |= (cdb[7] << 16);
+- lba |= (cdb[8] << 8);
+- lba |= cdb[9];
+- txlen |= (cdb[10] << 24);
+- txlen |= (cdb[11] << 16);
+- txlen |= (cdb[12] << 8);
+- txlen |= cdb[13];
+-
+- trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+- (unsigned long long)lba, (unsigned long long)txlen,
++ u64 lba;
++ u32 txlen;
++
++ lba = get_unaligned_be64(&cdb[2]);
++ txlen = get_unaligned_be32(&cdb[10]);
++
++ trace_seq_printf(p, "lba=%llu txlen=%u protect=%u", lba, txlen,
+ cdb[1] >> 5);
+
+ if (cdb[0] == WRITE_SAME_16)
+@@ -130,8 +108,8 @@ static const char *
+ scsi_trace_rw32(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p), *cmd;
+- sector_t lba = 0, txlen = 0;
+- u32 ei_lbrt = 0;
++ u64 lba;
++ u32 ei_lbrt, txlen;
+
+ switch (SERVICE_ACTION32(cdb)) {
+ case READ_32:
+@@ -151,26 +129,12 @@ scsi_trace_rw32(struct trace_seq *p, unsigned char *cdb, int len)
+ goto out;
+ }
+
+- lba |= ((u64)cdb[12] << 56);
+- lba |= ((u64)cdb[13] << 48);
+- lba |= ((u64)cdb[14] << 40);
+- lba |= ((u64)cdb[15] << 32);
+- lba |= (cdb[16] << 24);
+- lba |= (cdb[17] << 16);
+- lba |= (cdb[18] << 8);
+- lba |= cdb[19];
+- ei_lbrt |= (cdb[20] << 24);
+- ei_lbrt |= (cdb[21] << 16);
+- ei_lbrt |= (cdb[22] << 8);
+- ei_lbrt |= cdb[23];
+- txlen |= (cdb[28] << 24);
+- txlen |= (cdb[29] << 16);
+- txlen |= (cdb[30] << 8);
+- txlen |= cdb[31];
+-
+- trace_seq_printf(p, "%s_32 lba=%llu txlen=%llu protect=%u ei_lbrt=%u",
+- cmd, (unsigned long long)lba,
+- (unsigned long long)txlen, cdb[10] >> 5, ei_lbrt);
++ lba = get_unaligned_be64(&cdb[12]);
++ ei_lbrt = get_unaligned_be32(&cdb[20]);
++ txlen = get_unaligned_be32(&cdb[28]);
++
++ trace_seq_printf(p, "%s_32 lba=%llu txlen=%u protect=%u ei_lbrt=%u",
++ cmd, lba, txlen, cdb[10] >> 5, ei_lbrt);
+
+ if (SERVICE_ACTION32(cdb) == WRITE_SAME_32)
+ trace_seq_printf(p, " unmap=%u", cdb[10] >> 3 & 1);
+@@ -185,7 +149,7 @@ static const char *
+ scsi_trace_unmap(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p);
+- unsigned int regions = cdb[7] << 8 | cdb[8];
++ unsigned int regions = get_unaligned_be16(&cdb[7]);
+
+ trace_seq_printf(p, "regions=%u", (regions - 8) / 16);
+ trace_seq_putc(p, 0);
+@@ -197,8 +161,8 @@ static const char *
+ scsi_trace_service_action_in(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p), *cmd;
+- sector_t lba = 0;
+- u32 alloc_len = 0;
++ u64 lba;
++ u32 alloc_len;
+
+ switch (SERVICE_ACTION16(cdb)) {
+ case SAI_READ_CAPACITY_16:
+@@ -212,21 +176,10 @@ scsi_trace_service_action_in(struct trace_seq *p, unsigned char *cdb, int len)
+ goto out;
+ }
+
+- lba |= ((u64)cdb[2] << 56);
+- lba |= ((u64)cdb[3] << 48);
+- lba |= ((u64)cdb[4] << 40);
+- lba |= ((u64)cdb[5] << 32);
+- lba |= (cdb[6] << 24);
+- lba |= (cdb[7] << 16);
+- lba |= (cdb[8] << 8);
+- lba |= cdb[9];
+- alloc_len |= (cdb[10] << 24);
+- alloc_len |= (cdb[11] << 16);
+- alloc_len |= (cdb[12] << 8);
+- alloc_len |= cdb[13];
+-
+- trace_seq_printf(p, "%s lba=%llu alloc_len=%u", cmd,
+- (unsigned long long)lba, alloc_len);
++ lba = get_unaligned_be64(&cdb[2]);
++ alloc_len = get_unaligned_be32(&cdb[10]);
++
++ trace_seq_printf(p, "%s lba=%llu alloc_len=%u", cmd, lba, alloc_len);
+
+ out:
+ trace_seq_putc(p, 0);
+diff --git a/drivers/target/target_core_fabric_lib.c b/drivers/target/target_core_fabric_lib.c
+index 71a80257a052..10fae26b44ad 100644
+--- a/drivers/target/target_core_fabric_lib.c
++++ b/drivers/target/target_core_fabric_lib.c
+@@ -131,7 +131,7 @@ static int srp_get_pr_transport_id(
+ memset(buf + 8, 0, leading_zero_bytes);
+ rc = hex2bin(buf + 8 + leading_zero_bytes, p, count);
+ if (rc < 0) {
+- pr_debug("hex2bin failed for %s: %d\n", __func__, rc);
++ pr_debug("hex2bin failed for %s: %d\n", p, rc);
+ return rc;
+ }
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index adc8e3a0138f..6ab4ca1d9ae1 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1165,6 +1165,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ * PORT_OVER_CURRENT is not. So check for any of them.
+ */
+ if (udev || (portstatus & USB_PORT_STAT_CONNECTION) ||
++ (portchange & USB_PORT_STAT_C_CONNECTION) ||
+ (portstatus & USB_PORT_STAT_OVERCURRENT) ||
+ (portchange & USB_PORT_STAT_C_OVERCURRENT))
+ set_bit(port1, hub->change_bits);
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index 3bb1fff02bed..955ab97b9b22 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -589,9 +589,13 @@ static int ch341_tiocmget(struct tty_struct *tty)
+ static int ch341_reset_resume(struct usb_serial *serial)
+ {
+ struct usb_serial_port *port = serial->port[0];
+- struct ch341_private *priv = usb_get_serial_port_data(port);
++ struct ch341_private *priv;
+ int ret;
+
++ priv = usb_get_serial_port_data(port);
++ if (!priv)
++ return 0;
++
+ /* reconfigure ch341 serial port after bus-reset */
+ ch341_configure(serial->dev, priv);
+
+diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
+index 97eb738b058f..5d101b022e71 100644
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -716,7 +716,7 @@ static void edge_interrupt_callback(struct urb *urb)
+ if (txCredits) {
+ port = edge_serial->serial->port[portNumber];
+ edge_port = usb_get_serial_port_data(port);
+- if (edge_port->open) {
++ if (edge_port && edge_port->open) {
+ spin_lock_irqsave(&edge_port->ep_lock,
+ flags);
+ edge_port->txCredits += txCredits;
+@@ -1734,7 +1734,8 @@ static void edge_break(struct tty_struct *tty, int break_state)
+ static void process_rcvd_data(struct edgeport_serial *edge_serial,
+ unsigned char *buffer, __u16 bufferLength)
+ {
+- struct device *dev = &edge_serial->serial->dev->dev;
++ struct usb_serial *serial = edge_serial->serial;
++ struct device *dev = &serial->dev->dev;
+ struct usb_serial_port *port;
+ struct edgeport_port *edge_port;
+ __u16 lastBufferLength;
+@@ -1839,11 +1840,10 @@ static void process_rcvd_data(struct edgeport_serial *edge_serial,
+
+ /* spit this data back into the tty driver if this
+ port is open */
+- if (rxLen) {
+- port = edge_serial->serial->port[
+- edge_serial->rxPort];
++ if (rxLen && edge_serial->rxPort < serial->num_ports) {
++ port = serial->port[edge_serial->rxPort];
+ edge_port = usb_get_serial_port_data(port);
+- if (edge_port->open) {
++ if (edge_port && edge_port->open) {
+ dev_dbg(dev, "%s - Sending %d bytes to TTY for port %d\n",
+ __func__, rxLen,
+ edge_serial->rxPort);
+@@ -1851,8 +1851,8 @@ static void process_rcvd_data(struct edgeport_serial *edge_serial,
+ rxLen);
+ edge_port->port->icount.rx += rxLen;
+ }
+- buffer += rxLen;
+ }
++ buffer += rxLen;
+ break;
+
+ case EXPECT_HDR3: /* Expect 3rd byte of status header */
+@@ -1887,6 +1887,8 @@ static void process_rcvd_status(struct edgeport_serial *edge_serial,
+ __u8 code = edge_serial->rxStatusCode;
+
+ /* switch the port pointer to the one being currently talked about */
++ if (edge_serial->rxPort >= edge_serial->serial->num_ports)
++ return;
+ port = edge_serial->serial->port[edge_serial->rxPort];
+ edge_port = usb_get_serial_port_data(port);
+ if (edge_port == NULL) {
+diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
+index e66a59ef43a1..aa3dbce22cfb 100644
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -1058,6 +1058,8 @@ static void usa49_glocont_callback(struct urb *urb)
+ for (i = 0; i < serial->num_ports; ++i) {
+ port = serial->port[i];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ continue;
+
+ if (p_priv->resend_cont) {
+ dev_dbg(&port->dev, "%s - sending setup\n", __func__);
+@@ -1459,6 +1461,8 @@ static void usa67_glocont_callback(struct urb *urb)
+ for (i = 0; i < serial->num_ports; ++i) {
+ port = serial->port[i];
+ p_priv = usb_get_serial_port_data(port);
++ if (!p_priv)
++ continue;
+
+ if (p_priv->resend_cont) {
+ dev_dbg(&port->dev, "%s - sending setup\n", __func__);
+diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
+index caa0746326fd..5abe46d9f578 100644
+--- a/drivers/usb/serial/opticon.c
++++ b/drivers/usb/serial/opticon.c
+@@ -113,7 +113,7 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype,
+ retval = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+ requesttype,
+ USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE,
+- 0, 0, buffer, 1, 0);
++ 0, 0, buffer, 1, USB_CTRL_SET_TIMEOUT);
+ kfree(buffer);
+
+ if (retval < 0)
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index a157784e2059..5b2e246f99da 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -248,6 +248,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_BG96 0x0296
+ #define QUECTEL_PRODUCT_EP06 0x0306
+ #define QUECTEL_PRODUCT_EM12 0x0512
++#define QUECTEL_PRODUCT_RM500Q 0x0800
+
+ #define CMOTECH_VENDOR_ID 0x16d8
+ #define CMOTECH_PRODUCT_6001 0x6001
+@@ -1104,6 +1105,11 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
++ .driver_info = ZLP },
++
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
+index b61c2a9b6b11..9ae57a961027 100644
+--- a/drivers/usb/serial/quatech2.c
++++ b/drivers/usb/serial/quatech2.c
+@@ -864,7 +864,10 @@ static void qt2_update_msr(struct usb_serial_port *port, unsigned char *ch)
+ u8 newMSR = (u8) *ch;
+ unsigned long flags;
+
++ /* May be called from qt2_process_read_urb() for an unbound port. */
+ port_priv = usb_get_serial_port_data(port);
++ if (!port_priv)
++ return;
+
+ spin_lock_irqsave(&port_priv->lock, flags);
+ port_priv->shadowMSR = newMSR;
+@@ -892,7 +895,10 @@ static void qt2_update_lsr(struct usb_serial_port *port, unsigned char *ch)
+ unsigned long flags;
+ u8 newLSR = (u8) *ch;
+
++ /* May be called from qt2_process_read_urb() for an unbound port. */
+ port_priv = usb_get_serial_port_data(port);
++ if (!port_priv)
++ return;
+
+ if (newLSR & UART_LSR_BI)
+ newLSR &= (u8) (UART_LSR_OE | UART_LSR_BI);
+diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
+index edbbb13d6de6..bd23a7cb1be2 100644
+--- a/drivers/usb/serial/usb-serial-simple.c
++++ b/drivers/usb/serial/usb-serial-simple.c
+@@ -86,6 +86,8 @@ DEVICE(moto_modem, MOTO_IDS);
+ #define MOTOROLA_TETRA_IDS() \
+ { USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \
+ { USB_DEVICE(0x0cad, 0x9012) }, /* MTP6550 */ \
++ { USB_DEVICE(0x0cad, 0x9013) }, /* MTP3xxx */ \
++ { USB_DEVICE(0x0cad, 0x9015) }, /* MTP85xx */ \
+ { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */
+ DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS);
+
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 434153790982..b1f0aa12ba39 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1294,6 +1294,9 @@ static int usb_serial_register(struct usb_serial_driver *driver)
+ return -EINVAL;
+ }
+
++ /* Prevent individual ports from being unbound. */
++ driver->driver.suppress_bind_attrs = true;
++
+ usb_serial_operations_init(driver);
+
+ /* Add this device to our list of devices */
+diff --git a/firmware/Makefile b/firmware/Makefile
+index 29641383e136..d3d7578e2c45 100644
+--- a/firmware/Makefile
++++ b/firmware/Makefile
+@@ -19,7 +19,7 @@ quiet_cmd_fwbin = MK_FW $@
+ PROGBITS=$(if $(CONFIG_ARM),%,@)progbits; \
+ echo "/* Generated by firmware/Makefile */" > $@;\
+ echo " .section .rodata" >>$@;\
+- echo " .p2align $${ASM_ALIGN}" >>$@;\
++ echo " .p2align 4" >>$@;\
+ echo "_fw_$${FWSTR}_bin:" >>$@;\
+ echo " .incbin \"$(2)\"" >>$@;\
+ echo "_fw_end:" >>$@;\
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 70085e98d372..4ea9dd93a545 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -4120,18 +4120,30 @@ out:
+ }
+
+ static int btrfs_unlink_subvol(struct btrfs_trans_handle *trans,
+- struct inode *dir, u64 objectid,
+- const char *name, int name_len)
++ struct inode *dir, struct dentry *dentry)
+ {
+ struct btrfs_root *root = BTRFS_I(dir)->root;
++ struct btrfs_inode *inode = BTRFS_I(d_inode(dentry));
+ struct btrfs_path *path;
+ struct extent_buffer *leaf;
+ struct btrfs_dir_item *di;
+ struct btrfs_key key;
++ const char *name = dentry->d_name.name;
++ int name_len = dentry->d_name.len;
+ u64 index;
+ int ret;
++ u64 objectid;
+ u64 dir_ino = btrfs_ino(BTRFS_I(dir));
+
++ if (btrfs_ino(inode) == BTRFS_FIRST_FREE_OBJECTID) {
++ objectid = inode->root->root_key.objectid;
++ } else if (btrfs_ino(inode) == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID) {
++ objectid = inode->location.objectid;
++ } else {
++ WARN_ON(1);
++ return -EINVAL;
++ }
++
+ path = btrfs_alloc_path();
+ if (!path)
+ return -ENOMEM;
+@@ -4156,13 +4168,16 @@ static int btrfs_unlink_subvol(struct btrfs_trans_handle *trans,
+ }
+ btrfs_release_path(path);
+
+- ret = btrfs_del_root_ref(trans, objectid, root->root_key.objectid,
+- dir_ino, &index, name, name_len);
+- if (ret < 0) {
+- if (ret != -ENOENT) {
+- btrfs_abort_transaction(trans, ret);
+- goto out;
+- }
++ /*
++ * This is a placeholder inode for a subvolume we didn't have a
++ * reference to at the time of the snapshot creation. In the meantime
++ * we could have renamed the real subvol link into our snapshot, so
++ * depending on btrfs_del_root_ref to return -ENOENT here is incorret.
++ * Instead simply lookup the dir_index_item for this entry so we can
++ * remove it. Otherwise we know we have a ref to the root and we can
++ * call btrfs_del_root_ref, and it _shouldn't_ fail.
++ */
++ if (btrfs_ino(inode) == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID) {
+ di = btrfs_search_dir_index_item(root, path, dir_ino,
+ name, name_len);
+ if (IS_ERR_OR_NULL(di)) {
+@@ -4177,8 +4192,16 @@ static int btrfs_unlink_subvol(struct btrfs_trans_handle *trans,
+ leaf = path->nodes[0];
+ btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
+ index = key.offset;
++ btrfs_release_path(path);
++ } else {
++ ret = btrfs_del_root_ref(trans, objectid,
++ root->root_key.objectid, dir_ino,
++ &index, name, name_len);
++ if (ret) {
++ btrfs_abort_transaction(trans, ret);
++ goto out;
++ }
+ }
+- btrfs_release_path(path);
+
+ ret = btrfs_delete_delayed_dir_index(trans, BTRFS_I(dir), index);
+ if (ret) {
+@@ -4373,8 +4396,7 @@ int btrfs_delete_subvolume(struct inode *dir, struct dentry *dentry)
+
+ btrfs_record_snapshot_destroy(trans, BTRFS_I(dir));
+
+- ret = btrfs_unlink_subvol(trans, dir, dest->root_key.objectid,
+- dentry->d_name.name, dentry->d_name.len);
++ ret = btrfs_unlink_subvol(trans, dir, dentry);
+ if (ret) {
+ err = ret;
+ btrfs_abort_transaction(trans, ret);
+@@ -4469,10 +4491,7 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
+ return PTR_ERR(trans);
+
+ if (unlikely(btrfs_ino(BTRFS_I(inode)) == BTRFS_EMPTY_SUBVOL_DIR_OBJECTID)) {
+- err = btrfs_unlink_subvol(trans, dir,
+- BTRFS_I(inode)->location.objectid,
+- dentry->d_name.name,
+- dentry->d_name.len);
++ err = btrfs_unlink_subvol(trans, dir, dentry);
+ goto out;
+ }
+
+@@ -9471,7 +9490,6 @@ static int btrfs_rename_exchange(struct inode *old_dir,
+ u64 new_ino = btrfs_ino(BTRFS_I(new_inode));
+ u64 old_idx = 0;
+ u64 new_idx = 0;
+- u64 root_objectid;
+ int ret;
+ bool root_log_pinned = false;
+ bool dest_log_pinned = false;
+@@ -9577,10 +9595,7 @@ static int btrfs_rename_exchange(struct inode *old_dir,
+
+ /* src is a subvolume */
+ if (old_ino == BTRFS_FIRST_FREE_OBJECTID) {
+- root_objectid = BTRFS_I(old_inode)->root->root_key.objectid;
+- ret = btrfs_unlink_subvol(trans, old_dir, root_objectid,
+- old_dentry->d_name.name,
+- old_dentry->d_name.len);
++ ret = btrfs_unlink_subvol(trans, old_dir, old_dentry);
+ } else { /* src is an inode */
+ ret = __btrfs_unlink_inode(trans, root, BTRFS_I(old_dir),
+ BTRFS_I(old_dentry->d_inode),
+@@ -9596,10 +9611,7 @@ static int btrfs_rename_exchange(struct inode *old_dir,
+
+ /* dest is a subvolume */
+ if (new_ino == BTRFS_FIRST_FREE_OBJECTID) {
+- root_objectid = BTRFS_I(new_inode)->root->root_key.objectid;
+- ret = btrfs_unlink_subvol(trans, new_dir, root_objectid,
+- new_dentry->d_name.name,
+- new_dentry->d_name.len);
++ ret = btrfs_unlink_subvol(trans, new_dir, new_dentry);
+ } else { /* dest is an inode */
+ ret = __btrfs_unlink_inode(trans, dest, BTRFS_I(new_dir),
+ BTRFS_I(new_dentry->d_inode),
+@@ -9797,7 +9809,6 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ struct inode *new_inode = d_inode(new_dentry);
+ struct inode *old_inode = d_inode(old_dentry);
+ u64 index = 0;
+- u64 root_objectid;
+ int ret;
+ u64 old_ino = btrfs_ino(BTRFS_I(old_inode));
+ bool log_pinned = false;
+@@ -9905,10 +9916,7 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ BTRFS_I(old_inode), 1);
+
+ if (unlikely(old_ino == BTRFS_FIRST_FREE_OBJECTID)) {
+- root_objectid = BTRFS_I(old_inode)->root->root_key.objectid;
+- ret = btrfs_unlink_subvol(trans, old_dir, root_objectid,
+- old_dentry->d_name.name,
+- old_dentry->d_name.len);
++ ret = btrfs_unlink_subvol(trans, old_dir, old_dentry);
+ } else {
+ ret = __btrfs_unlink_inode(trans, root, BTRFS_I(old_dir),
+ BTRFS_I(d_inode(old_dentry)),
+@@ -9927,10 +9935,7 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ new_inode->i_ctime = current_time(new_inode);
+ if (unlikely(btrfs_ino(BTRFS_I(new_inode)) ==
+ BTRFS_EMPTY_SUBVOL_DIR_OBJECTID)) {
+- root_objectid = BTRFS_I(new_inode)->location.objectid;
+- ret = btrfs_unlink_subvol(trans, new_dir, root_objectid,
+- new_dentry->d_name.name,
+- new_dentry->d_name.len);
++ ret = btrfs_unlink_subvol(trans, new_dir, new_dentry);
+ BUG_ON(new_inode->i_nlink == 0);
+ } else {
+ ret = btrfs_unlink_inode(trans, dest, BTRFS_I(new_dir),
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 7916f711daf5..0cd043f03081 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2055,8 +2055,12 @@ int btrfs_qgroup_account_extent(struct btrfs_trans_handle *trans, u64 bytenr,
+ u64 nr_old_roots = 0;
+ int ret = 0;
+
++ /*
++ * If quotas get disabled meanwhile, the resouces need to be freed and
++ * we can't just exit here.
++ */
+ if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
+- return 0;
++ goto out_free;
+
+ if (new_roots) {
+ if (!maybe_fs_roots(new_roots))
+diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
+index 3228d3b3084a..b309f298d17f 100644
+--- a/fs/btrfs/root-tree.c
++++ b/fs/btrfs/root-tree.c
+@@ -370,11 +370,13 @@ again:
+ leaf = path->nodes[0];
+ ref = btrfs_item_ptr(leaf, path->slots[0],
+ struct btrfs_root_ref);
+-
+- WARN_ON(btrfs_root_ref_dirid(leaf, ref) != dirid);
+- WARN_ON(btrfs_root_ref_name_len(leaf, ref) != name_len);
+ ptr = (unsigned long)(ref + 1);
+- WARN_ON(memcmp_extent_buffer(leaf, name, ptr, name_len));
++ if ((btrfs_root_ref_dirid(leaf, ref) != dirid) ||
++ (btrfs_root_ref_name_len(leaf, ref) != name_len) ||
++ memcmp_extent_buffer(leaf, name, ptr, name_len)) {
++ err = -ENOENT;
++ goto out;
++ }
+ *sequence = btrfs_root_ref_sequence(leaf, ref);
+
+ ret = btrfs_del_item(trans, tree_root, path);
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index 2c5c45927b2f..ee216925a709 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -319,8 +319,12 @@ static int reiserfs_for_each_xattr(struct inode *inode,
+ out_dir:
+ dput(dir);
+ out:
+- /* -ENODATA isn't an error */
+- if (err == -ENODATA)
++ /*
++ * -ENODATA: this object doesn't have any xattrs
++ * -EOPNOTSUPP: this file system doesn't have xattrs enabled on disk.
++ * Neither are errors
++ */
++ if (err == -ENODATA || err == -EOPNOTSUPP)
+ err = 0;
+ return err;
+ }
+diff --git a/include/dt-bindings/reset/amlogic,meson8b-reset.h b/include/dt-bindings/reset/amlogic,meson8b-reset.h
+index 614aff2c7aff..a03e86fe2c57 100644
+--- a/include/dt-bindings/reset/amlogic,meson8b-reset.h
++++ b/include/dt-bindings/reset/amlogic,meson8b-reset.h
+@@ -95,9 +95,9 @@
+ #define RESET_VD_RMEM 64
+ #define RESET_AUDIN 65
+ #define RESET_DBLK 66
+-#define RESET_PIC_DC 66
+-#define RESET_PSC 66
+-#define RESET_NAND 66
++#define RESET_PIC_DC 67
++#define RESET_PSC 68
++#define RESET_NAND 69
+ #define RESET_GE2D 70
+ #define RESET_PARSER_REG 71
+ #define RESET_PARSER_FETCH 72
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index d51e10f50e75..6e67aeb56928 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -372,6 +372,7 @@ struct queue_limits {
+ unsigned int max_sectors;
+ unsigned int max_segment_size;
+ unsigned int physical_block_size;
++ unsigned int logical_block_size;
+ unsigned int alignment_offset;
+ unsigned int io_min;
+ unsigned int io_opt;
+@@ -382,7 +383,6 @@ struct queue_limits {
+ unsigned int discard_granularity;
+ unsigned int discard_alignment;
+
+- unsigned short logical_block_size;
+ unsigned short max_segments;
+ unsigned short max_integrity_segments;
+ unsigned short max_discard_segments;
+@@ -1212,7 +1212,7 @@ extern void blk_queue_max_write_same_sectors(struct request_queue *q,
+ unsigned int max_write_same_sectors);
+ extern void blk_queue_max_write_zeroes_sectors(struct request_queue *q,
+ unsigned int max_write_same_sectors);
+-extern void blk_queue_logical_block_size(struct request_queue *, unsigned short);
++extern void blk_queue_logical_block_size(struct request_queue *, unsigned int);
+ extern void blk_queue_physical_block_size(struct request_queue *, unsigned int);
+ extern void blk_queue_alignment_offset(struct request_queue *q,
+ unsigned int alignment);
+@@ -1473,7 +1473,7 @@ static inline unsigned int queue_max_segment_size(struct request_queue *q)
+ return q->limits.max_segment_size;
+ }
+
+-static inline unsigned short queue_logical_block_size(struct request_queue *q)
++static inline unsigned queue_logical_block_size(struct request_queue *q)
+ {
+ int retval = 512;
+
+@@ -1483,7 +1483,7 @@ static inline unsigned short queue_logical_block_size(struct request_queue *q)
+ return retval;
+ }
+
+-static inline unsigned short bdev_logical_block_size(struct block_device *bdev)
++static inline unsigned int bdev_logical_block_size(struct block_device *bdev)
+ {
+ return queue_logical_block_size(bdev_get_queue(bdev));
+ }
+diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
+index 97a020c616ad..3833c871fd45 100644
+--- a/include/linux/lsm_hooks.h
++++ b/include/linux/lsm_hooks.h
+@@ -1270,7 +1270,7 @@
+ * @cred contains the credentials to use.
+ * @ns contains the user namespace we want the capability in
+ * @cap contains the capability <include/linux/capability.h>.
+- * @audit contains whether to write an audit message or not
++ * @opts contains options for the capable check <include/linux/security.h>
+ * Return 0 if the capability is granted for @tsk.
+ * @syslog:
+ * Check permission before accessing the kernel message ring or changing
+@@ -1446,8 +1446,10 @@ union security_list_options {
+ const kernel_cap_t *effective,
+ const kernel_cap_t *inheritable,
+ const kernel_cap_t *permitted);
+- int (*capable)(const struct cred *cred, struct user_namespace *ns,
+- int cap, int audit);
++ int (*capable)(const struct cred *cred,
++ struct user_namespace *ns,
++ int cap,
++ unsigned int opts);
+ int (*quotactl)(int cmds, int type, int id, struct super_block *sb);
+ int (*quota_on)(struct dentry *dentry);
+ int (*syslog)(int type);
+diff --git a/include/linux/regulator/ab8500.h b/include/linux/regulator/ab8500.h
+index 06978ce01302..d48ab3e66d0b 100644
+--- a/include/linux/regulator/ab8500.h
++++ b/include/linux/regulator/ab8500.h
+@@ -43,8 +43,6 @@ enum ab8505_regulator_id {
+ AB8505_LDO_ANAMIC2,
+ AB8505_LDO_AUX8,
+ AB8505_LDO_ANA,
+- AB8505_SYSCLKREQ_2,
+- AB8505_SYSCLKREQ_4,
+ AB8505_NUM_REGULATORS,
+ };
+
+diff --git a/include/linux/security.h b/include/linux/security.h
+index 75f4156c84d7..d2240605edc4 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -54,9 +54,12 @@ struct xattr;
+ struct xfrm_sec_ctx;
+ struct mm_struct;
+
++/* Default (no) options for the capable function */
++#define CAP_OPT_NONE 0x0
+ /* If capable should audit the security request */
+-#define SECURITY_CAP_NOAUDIT 0
+-#define SECURITY_CAP_AUDIT 1
++#define CAP_OPT_NOAUDIT BIT(1)
++/* If capable is being called by a setid function */
++#define CAP_OPT_INSETID BIT(2)
+
+ /* LSM Agnostic defines for sb_set_mnt_opts */
+ #define SECURITY_LSM_NATIVE_LABELS 1
+@@ -72,7 +75,7 @@ enum lsm_event {
+
+ /* These functions are in security/commoncap.c */
+ extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
+- int cap, int audit);
++ int cap, unsigned int opts);
+ extern int cap_settime(const struct timespec64 *ts, const struct timezone *tz);
+ extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);
+ extern int cap_ptrace_traceme(struct task_struct *parent);
+@@ -233,10 +236,10 @@ int security_capset(struct cred *new, const struct cred *old,
+ const kernel_cap_t *effective,
+ const kernel_cap_t *inheritable,
+ const kernel_cap_t *permitted);
+-int security_capable(const struct cred *cred, struct user_namespace *ns,
+- int cap);
+-int security_capable_noaudit(const struct cred *cred, struct user_namespace *ns,
+- int cap);
++int security_capable(const struct cred *cred,
++ struct user_namespace *ns,
++ int cap,
++ unsigned int opts);
+ int security_quotactl(int cmds, int type, int id, struct super_block *sb);
+ int security_quota_on(struct dentry *dentry);
+ int security_syslog(int type);
+@@ -492,14 +495,11 @@ static inline int security_capset(struct cred *new,
+ }
+
+ static inline int security_capable(const struct cred *cred,
+- struct user_namespace *ns, int cap)
++ struct user_namespace *ns,
++ int cap,
++ unsigned int opts)
+ {
+- return cap_capable(cred, ns, cap, SECURITY_CAP_AUDIT);
+-}
+-
+-static inline int security_capable_noaudit(const struct cred *cred,
+- struct user_namespace *ns, int cap) {
+- return cap_capable(cred, ns, cap, SECURITY_CAP_NOAUDIT);
++ return cap_capable(cred, ns, cap, opts);
+ }
+
+ static inline int security_quotactl(int cmds, int type, int id,
+diff --git a/include/linux/tnum.h b/include/linux/tnum.h
+index c7dc2b5902c0..06b9c20cc77e 100644
+--- a/include/linux/tnum.h
++++ b/include/linux/tnum.h
+@@ -26,7 +26,7 @@ struct tnum tnum_lshift(struct tnum a, u8 shift);
+ /* Shift (rsh) a tnum right (by a fixed shift) */
+ struct tnum tnum_rshift(struct tnum a, u8 shift);
+ /* Shift (arsh) a tnum right (by a fixed min_shift) */
+-struct tnum tnum_arshift(struct tnum a, u8 min_shift);
++struct tnum tnum_arshift(struct tnum a, u8 min_shift, u8 insn_bitness);
+ /* Add two tnums, return @a + @b */
+ struct tnum tnum_add(struct tnum a, struct tnum b);
+ /* Subtract two tnums, return @a - @b */
+diff --git a/kernel/bpf/tnum.c b/kernel/bpf/tnum.c
+index 938d41211be7..84984c0fc3d3 100644
+--- a/kernel/bpf/tnum.c
++++ b/kernel/bpf/tnum.c
+@@ -43,14 +43,19 @@ struct tnum tnum_rshift(struct tnum a, u8 shift)
+ return TNUM(a.value >> shift, a.mask >> shift);
+ }
+
+-struct tnum tnum_arshift(struct tnum a, u8 min_shift)
++struct tnum tnum_arshift(struct tnum a, u8 min_shift, u8 insn_bitness)
+ {
+ /* if a.value is negative, arithmetic shifting by minimum shift
+ * will have larger negative offset compared to more shifting.
+ * If a.value is nonnegative, arithmetic shifting by minimum shift
+ * will have larger positive offset compare to more shifting.
+ */
+- return TNUM((s64)a.value >> min_shift, (s64)a.mask >> min_shift);
++ if (insn_bitness == 32)
++ return TNUM((u32)(((s32)a.value) >> min_shift),
++ (u32)(((s32)a.mask) >> min_shift));
++ else
++ return TNUM((s64)a.value >> min_shift,
++ (s64)a.mask >> min_shift);
+ }
+
+ struct tnum tnum_add(struct tnum a, struct tnum b)
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 9e72b2f8c3dd..9bbfb1ff4ac9 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -3309,9 +3309,16 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ /* Upon reaching here, src_known is true and
+ * umax_val is equal to umin_val.
+ */
+- dst_reg->smin_value >>= umin_val;
+- dst_reg->smax_value >>= umin_val;
+- dst_reg->var_off = tnum_arshift(dst_reg->var_off, umin_val);
++ if (insn_bitness == 32) {
++ dst_reg->smin_value = (u32)(((s32)dst_reg->smin_value) >> umin_val);
++ dst_reg->smax_value = (u32)(((s32)dst_reg->smax_value) >> umin_val);
++ } else {
++ dst_reg->smin_value >>= umin_val;
++ dst_reg->smax_value >>= umin_val;
++ }
++
++ dst_reg->var_off = tnum_arshift(dst_reg->var_off, umin_val,
++ insn_bitness);
+
+ /* blow away the dst_reg umin_value/umax_value and rely on
+ * dst_reg var_off to refine the result.
+diff --git a/kernel/capability.c b/kernel/capability.c
+index 1e1c0236f55b..7718d7dcadc7 100644
+--- a/kernel/capability.c
++++ b/kernel/capability.c
+@@ -299,7 +299,7 @@ bool has_ns_capability(struct task_struct *t,
+ int ret;
+
+ rcu_read_lock();
+- ret = security_capable(__task_cred(t), ns, cap);
++ ret = security_capable(__task_cred(t), ns, cap, CAP_OPT_NONE);
+ rcu_read_unlock();
+
+ return (ret == 0);
+@@ -340,7 +340,7 @@ bool has_ns_capability_noaudit(struct task_struct *t,
+ int ret;
+
+ rcu_read_lock();
+- ret = security_capable_noaudit(__task_cred(t), ns, cap);
++ ret = security_capable(__task_cred(t), ns, cap, CAP_OPT_NOAUDIT);
+ rcu_read_unlock();
+
+ return (ret == 0);
+@@ -363,7 +363,9 @@ bool has_capability_noaudit(struct task_struct *t, int cap)
+ return has_ns_capability_noaudit(t, &init_user_ns, cap);
+ }
+
+-static bool ns_capable_common(struct user_namespace *ns, int cap, bool audit)
++static bool ns_capable_common(struct user_namespace *ns,
++ int cap,
++ unsigned int opts)
+ {
+ int capable;
+
+@@ -372,8 +374,7 @@ static bool ns_capable_common(struct user_namespace *ns, int cap, bool audit)
+ BUG();
+ }
+
+- capable = audit ? security_capable(current_cred(), ns, cap) :
+- security_capable_noaudit(current_cred(), ns, cap);
++ capable = security_capable(current_cred(), ns, cap, opts);
+ if (capable == 0) {
+ current->flags |= PF_SUPERPRIV;
+ return true;
+@@ -394,7 +395,7 @@ static bool ns_capable_common(struct user_namespace *ns, int cap, bool audit)
+ */
+ bool ns_capable(struct user_namespace *ns, int cap)
+ {
+- return ns_capable_common(ns, cap, true);
++ return ns_capable_common(ns, cap, CAP_OPT_NONE);
+ }
+ EXPORT_SYMBOL(ns_capable);
+
+@@ -412,7 +413,7 @@ EXPORT_SYMBOL(ns_capable);
+ */
+ bool ns_capable_noaudit(struct user_namespace *ns, int cap)
+ {
+- return ns_capable_common(ns, cap, false);
++ return ns_capable_common(ns, cap, CAP_OPT_NOAUDIT);
+ }
+ EXPORT_SYMBOL(ns_capable_noaudit);
+
+@@ -448,10 +449,11 @@ EXPORT_SYMBOL(capable);
+ bool file_ns_capable(const struct file *file, struct user_namespace *ns,
+ int cap)
+ {
++
+ if (WARN_ON_ONCE(!cap_valid(cap)))
+ return false;
+
+- if (security_capable(file->f_cred, ns, cap) == 0)
++ if (security_capable(file->f_cred, ns, cap, CAP_OPT_NONE) == 0)
+ return true;
+
+ return false;
+@@ -500,10 +502,12 @@ bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns)
+ {
+ int ret = 0; /* An absent tracer adds no restrictions */
+ const struct cred *cred;
++
+ rcu_read_lock();
+ cred = rcu_dereference(tsk->ptracer_cred);
+ if (cred)
+- ret = security_capable_noaudit(cred, ns, CAP_SYS_PTRACE);
++ ret = security_capable(cred, ns, CAP_SYS_PTRACE,
++ CAP_OPT_NOAUDIT);
+ rcu_read_unlock();
+ return (ret == 0);
+ }
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index fed682a01a75..b93eb4eaf7ac 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -258,12 +258,17 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
+ return ret;
+ }
+
+-static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
++static bool ptrace_has_cap(const struct cred *cred, struct user_namespace *ns,
++ unsigned int mode)
+ {
++ int ret;
++
+ if (mode & PTRACE_MODE_NOAUDIT)
+- return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE);
++ ret = security_capable(cred, ns, CAP_SYS_PTRACE, CAP_OPT_NOAUDIT);
+ else
+- return has_ns_capability(current, ns, CAP_SYS_PTRACE);
++ ret = security_capable(cred, ns, CAP_SYS_PTRACE, CAP_OPT_NONE);
++
++ return ret == 0;
+ }
+
+ /* Returns 0 on success, -errno on denial. */
+@@ -315,7 +320,7 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ gid_eq(caller_gid, tcred->sgid) &&
+ gid_eq(caller_gid, tcred->gid))
+ goto ok;
+- if (ptrace_has_cap(tcred->user_ns, mode))
++ if (ptrace_has_cap(cred, tcred->user_ns, mode))
+ goto ok;
+ rcu_read_unlock();
+ return -EPERM;
+@@ -334,7 +339,7 @@ ok:
+ mm = task->mm;
+ if (mm &&
+ ((get_dumpable(mm) != SUID_DUMP_USER) &&
+- !ptrace_has_cap(mm->user_ns, mode)))
++ !ptrace_has_cap(cred, mm->user_ns, mode)))
+ return -EPERM;
+
+ return security_ptrace_access_check(task, mode);
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index fd023ac24e10..56e69203b658 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -383,8 +383,8 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
+ * behavior of privileged children.
+ */
+ if (!task_no_new_privs(current) &&
+- security_capable_noaudit(current_cred(), current_user_ns(),
+- CAP_SYS_ADMIN) != 0)
++ security_capable(current_cred(), current_user_ns(),
++ CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) != 0)
+ return ERR_PTR(-EACCES);
+
+ /* Allocate a new seccomp_filter */
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 5b33e2f5c0ed..48403fb653c2 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -61,8 +61,9 @@ static void tick_do_update_jiffies64(ktime_t now)
+
+ /*
+ * Do a quick check without holding jiffies_lock:
++ * The READ_ONCE() pairs with two updates done later in this function.
+ */
+- delta = ktime_sub(now, last_jiffies_update);
++ delta = ktime_sub(now, READ_ONCE(last_jiffies_update));
+ if (delta < tick_period)
+ return;
+
+@@ -73,8 +74,9 @@ static void tick_do_update_jiffies64(ktime_t now)
+ if (delta >= tick_period) {
+
+ delta = ktime_sub(delta, tick_period);
+- last_jiffies_update = ktime_add(last_jiffies_update,
+- tick_period);
++ /* Pairs with the lockless read in this function. */
++ WRITE_ONCE(last_jiffies_update,
++ ktime_add(last_jiffies_update, tick_period));
+
+ /* Slow path for long timeouts */
+ if (unlikely(delta >= tick_period)) {
+@@ -82,8 +84,10 @@ static void tick_do_update_jiffies64(ktime_t now)
+
+ ticks = ktime_divns(delta, incr);
+
+- last_jiffies_update = ktime_add_ns(last_jiffies_update,
+- incr * ticks);
++ /* Pairs with the lockless read in this function. */
++ WRITE_ONCE(last_jiffies_update,
++ ktime_add_ns(last_jiffies_update,
++ incr * ticks));
+ }
+ do_timer(++ticks);
+
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 5a1771bd5d04..5bb93cf18009 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -509,13 +509,13 @@ void prep_transhuge_page(struct page *page)
+ set_compound_page_dtor(page, TRANSHUGE_PAGE_DTOR);
+ }
+
+-unsigned long __thp_get_unmapped_area(struct file *filp, unsigned long len,
++static unsigned long __thp_get_unmapped_area(struct file *filp,
++ unsigned long addr, unsigned long len,
+ loff_t off, unsigned long flags, unsigned long size)
+ {
+- unsigned long addr;
+ loff_t off_end = off + len;
+ loff_t off_align = round_up(off, size);
+- unsigned long len_pad;
++ unsigned long len_pad, ret;
+
+ if (off_end <= off_align || (off_end - off_align) < size)
+ return 0;
+@@ -524,30 +524,40 @@ unsigned long __thp_get_unmapped_area(struct file *filp, unsigned long len,
+ if (len_pad < len || (off + len_pad) < off)
+ return 0;
+
+- addr = current->mm->get_unmapped_area(filp, 0, len_pad,
++ ret = current->mm->get_unmapped_area(filp, addr, len_pad,
+ off >> PAGE_SHIFT, flags);
+- if (IS_ERR_VALUE(addr))
++
++ /*
++ * The failure might be due to length padding. The caller will retry
++ * without the padding.
++ */
++ if (IS_ERR_VALUE(ret))
+ return 0;
+
+- addr += (off - addr) & (size - 1);
+- return addr;
++ /*
++ * Do not try to align to THP boundary if allocation at the address
++ * hint succeeds.
++ */
++ if (ret == addr)
++ return addr;
++
++ ret += (off - ret) & (size - 1);
++ return ret;
+ }
+
+ unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr,
+ unsigned long len, unsigned long pgoff, unsigned long flags)
+ {
++ unsigned long ret;
+ loff_t off = (loff_t)pgoff << PAGE_SHIFT;
+
+- if (addr)
+- goto out;
+ if (!IS_DAX(filp->f_mapping->host) || !IS_ENABLED(CONFIG_FS_DAX_PMD))
+ goto out;
+
+- addr = __thp_get_unmapped_area(filp, len, off, flags, PMD_SIZE);
+- if (addr)
+- return addr;
+-
+- out:
++ ret = __thp_get_unmapped_area(filp, addr, len, off, flags, PMD_SIZE);
++ if (ret)
++ return ret;
++out:
+ return current->mm->get_unmapped_area(filp, addr, len, pgoff, flags);
+ }
+ EXPORT_SYMBOL_GPL(thp_get_unmapped_area);
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 43df0c52e1cc..078f1461e074 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -200,11 +200,11 @@ static void wb_min_max_ratio(struct bdi_writeback *wb,
+ if (this_bw < tot_bw) {
+ if (min) {
+ min *= this_bw;
+- do_div(min, tot_bw);
++ min = div64_ul(min, tot_bw);
+ }
+ if (max < 100) {
+ max *= this_bw;
+- do_div(max, tot_bw);
++ max = div64_ul(max, tot_bw);
+ }
+ }
+
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 650ef56dc790..a6fc82a1ab6b 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2072,9 +2072,10 @@ unsigned long shmem_get_unmapped_area(struct file *file,
+ /*
+ * Our priority is to support MAP_SHARED mapped hugely;
+ * and support MAP_PRIVATE mapped hugely too, until it is COWed.
+- * But if caller specified an address hint, respect that as before.
++ * But if caller specified an address hint and we allocated area there
++ * successfully, respect that as before.
+ */
+- if (uaddr)
++ if (uaddr == addr)
+ return addr;
+
+ if (shmem_huge != SHMEM_HUGE_FORCE) {
+@@ -2108,7 +2109,7 @@ unsigned long shmem_get_unmapped_area(struct file *file,
+ if (inflated_len < len)
+ return addr;
+
+- inflated_addr = get_area(NULL, 0, inflated_len, 0, flags);
++ inflated_addr = get_area(NULL, uaddr, inflated_len, 0, flags);
+ if (IS_ERR_VALUE(inflated_addr))
+ return addr;
+ if (inflated_addr & ~PAGE_MASK)
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index 4d3c2e76d1ba..39e382acb0b8 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -850,7 +850,8 @@ static void flush_memcg_workqueue(struct kmem_cache *s)
+ * deactivates the memcg kmem_caches through workqueue. Make sure all
+ * previous workitems on workqueue are processed.
+ */
+- flush_workqueue(memcg_kmem_cache_wq);
++ if (likely(memcg_kmem_cache_wq))
++ flush_workqueue(memcg_kmem_cache_wq);
+ }
+ #else
+ static inline int shutdown_memcg_caches(struct kmem_cache *s)
+diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
+index 2895e3b26e93..f2dc7499d266 100644
+--- a/net/batman-adv/distributed-arp-table.c
++++ b/net/batman-adv/distributed-arp-table.c
+@@ -251,6 +251,7 @@ static u32 batadv_hash_dat(const void *data, u32 size)
+ u32 hash = 0;
+ const struct batadv_dat_entry *dat = data;
+ const unsigned char *key;
++ __be16 vid;
+ u32 i;
+
+ key = (const unsigned char *)&dat->ip;
+@@ -260,7 +261,8 @@ static u32 batadv_hash_dat(const void *data, u32 size)
+ hash ^= (hash >> 6);
+ }
+
+- key = (const unsigned char *)&dat->vid;
++ vid = htons(dat->vid);
++ key = (__force const unsigned char *)&vid;
+ for (i = 0; i < sizeof(dat->vid); i++) {
+ hash += key[i];
+ hash += (hash << 10);
+diff --git a/net/dsa/tag_qca.c b/net/dsa/tag_qca.c
+index 613f4ee97771..66a952118dfd 100644
+--- a/net/dsa/tag_qca.c
++++ b/net/dsa/tag_qca.c
+@@ -41,9 +41,6 @@ static struct sk_buff *qca_tag_xmit(struct sk_buff *skb, struct net_device *dev)
+ struct dsa_port *dp = dsa_slave_to_port(dev);
+ u16 *phdr, hdr;
+
+- dev->stats.tx_packets++;
+- dev->stats.tx_bytes += skb->len;
+-
+ if (skb_cow_head(skb, 0) < 0)
+ return NULL;
+
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index f1b7293c6023..10d8f95eb771 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -495,12 +495,13 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
+ return 0;
+ }
+
+-static inline void cleanup_entry(struct arpt_entry *e)
++static void cleanup_entry(struct arpt_entry *e, struct net *net)
+ {
+ struct xt_tgdtor_param par;
+ struct xt_entry_target *t;
+
+ t = arpt_get_target(e);
++ par.net = net;
+ par.target = t->u.kernel.target;
+ par.targinfo = t->data;
+ par.family = NFPROTO_ARP;
+@@ -583,7 +584,7 @@ static int translate_table(struct net *net,
+ xt_entry_foreach(iter, entry0, newinfo->size) {
+ if (i-- == 0)
+ break;
+- cleanup_entry(iter);
++ cleanup_entry(iter, net);
+ }
+ return ret;
+ }
+@@ -926,7 +927,7 @@ static int __do_replace(struct net *net, const char *name,
+ /* Decrease module usage counts and free resource */
+ loc_cpu_old_entry = oldinfo->entries;
+ xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
+- cleanup_entry(iter);
++ cleanup_entry(iter, net);
+
+ xt_free_table_info(oldinfo);
+ if (copy_to_user(counters_ptr, counters,
+@@ -989,7 +990,7 @@ static int do_replace(struct net *net, const void __user *user,
+
+ free_newinfo_untrans:
+ xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+- cleanup_entry(iter);
++ cleanup_entry(iter, net);
+ free_newinfo:
+ xt_free_table_info(newinfo);
+ return ret;
+@@ -1286,7 +1287,7 @@ static int compat_do_replace(struct net *net, void __user *user,
+
+ free_newinfo_untrans:
+ xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+- cleanup_entry(iter);
++ cleanup_entry(iter, net);
+ free_newinfo:
+ xt_free_table_info(newinfo);
+ return ret;
+@@ -1513,7 +1514,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
+ return ret;
+ }
+
+-static void __arpt_unregister_table(struct xt_table *table)
++static void __arpt_unregister_table(struct net *net, struct xt_table *table)
+ {
+ struct xt_table_info *private;
+ void *loc_cpu_entry;
+@@ -1525,7 +1526,7 @@ static void __arpt_unregister_table(struct xt_table *table)
+ /* Decrease module usage counts and free resources */
+ loc_cpu_entry = private->entries;
+ xt_entry_foreach(iter, loc_cpu_entry, private->size)
+- cleanup_entry(iter);
++ cleanup_entry(iter, net);
+ if (private->number > private->initial_entries)
+ module_put(table_owner);
+ xt_free_table_info(private);
+@@ -1565,7 +1566,7 @@ int arpt_register_table(struct net *net,
+
+ ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
+ if (ret != 0) {
+- __arpt_unregister_table(new_table);
++ __arpt_unregister_table(net, new_table);
+ *res = NULL;
+ }
+
+@@ -1580,7 +1581,7 @@ void arpt_unregister_table(struct net *net, struct xt_table *table,
+ const struct nf_hook_ops *ops)
+ {
+ nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
+- __arpt_unregister_table(table);
++ __arpt_unregister_table(net, table);
+ }
+
+ /* The built-in targets: standard (NULL) and error. */
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 7561fa1bcc3e..cd8a92e7a39e 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1077,8 +1077,7 @@ do_error:
+ goto out;
+ out_err:
+ /* make sure we wake any epoll edge trigger waiter */
+- if (unlikely(skb_queue_len(&sk->sk_write_queue) == 0 &&
+- err == -EAGAIN)) {
++ if (unlikely(tcp_rtx_and_write_queues_empty(sk) && err == -EAGAIN)) {
+ sk->sk_write_space(sk);
+ tcp_chrono_stop(sk, TCP_CHRONO_SNDBUF_LIMITED);
+ }
+@@ -1437,8 +1436,7 @@ out_err:
+ sock_zerocopy_put_abort(uarg);
+ err = sk_stream_error(sk, flags, err);
+ /* make sure we wake any epoll edge trigger waiter */
+- if (unlikely(skb_queue_len(&sk->sk_write_queue) == 0 &&
+- err == -EAGAIN)) {
++ if (unlikely(tcp_rtx_and_write_queues_empty(sk) && err == -EAGAIN)) {
+ sk->sk_write_space(sk);
+ tcp_chrono_stop(sk, TCP_CHRONO_SNDBUF_LIMITED);
+ }
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 578b65e6e65b..e286a9647a73 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -901,9 +901,10 @@ static void tcp_check_sack_reordering(struct sock *sk, const u32 low_seq,
+ /* This must be called before lost_out is incremented */
+ static void tcp_verify_retransmit_hint(struct tcp_sock *tp, struct sk_buff *skb)
+ {
+- if (!tp->retransmit_skb_hint ||
+- before(TCP_SKB_CB(skb)->seq,
+- TCP_SKB_CB(tp->retransmit_skb_hint)->seq))
++ if ((!tp->retransmit_skb_hint && tp->retrans_out >= tp->lost_out) ||
++ (tp->retransmit_skb_hint &&
++ before(TCP_SKB_CB(skb)->seq,
++ TCP_SKB_CB(tp->retransmit_skb_hint)->seq)))
+ tp->retransmit_skb_hint = skb;
+ }
+
+diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h
+index 257ca393e6f2..af480ffefaf3 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_gen.h
++++ b/net/netfilter/ipset/ip_set_bitmap_gen.h
+@@ -64,9 +64,9 @@ mtype_destroy(struct ip_set *set)
+ if (SET_WITH_TIMEOUT(set))
+ del_timer_sync(&map->gc);
+
+- ip_set_free(map->members);
+ if (set->dsize && set->extensions & IPSET_EXT_DESTROY)
+ mtype_ext_cleanup(set);
++ ip_set_free(map->members);
+ ip_set_free(map);
+
+ set->data = NULL;
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 4711a8b56f32..7f0d3ffd5469 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -24,6 +24,8 @@
+ #include <net/net_namespace.h>
+ #include <net/sock.h>
+
++#define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
++
+ static LIST_HEAD(nf_tables_expressions);
+ static LIST_HEAD(nf_tables_objects);
+ static LIST_HEAD(nf_tables_flowtables);
+@@ -483,33 +485,34 @@ __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
+ }
+
+ /*
+- * Loading a module requires dropping mutex that guards the
+- * transaction.
+- * We first need to abort any pending transactions as once
+- * mutex is unlocked a different client could start a new
+- * transaction. It must not see any 'future generation'
+- * changes * as these changes will never happen.
++ * Loading a module requires dropping mutex that guards the transaction.
++ * A different client might race to start a new transaction meanwhile. Zap the
++ * list of pending transaction and then restore it once the mutex is grabbed
++ * again. Users of this function return EAGAIN which implicitly triggers the
++ * transaction abort path to clean up the list of pending transactions.
+ */
+ #ifdef CONFIG_MODULES
+-static int __nf_tables_abort(struct net *net);
+-
+ static void nft_request_module(struct net *net, const char *fmt, ...)
+ {
+ char module_name[MODULE_NAME_LEN];
++ LIST_HEAD(commit_list);
+ va_list args;
+ int ret;
+
+- __nf_tables_abort(net);
++ list_splice_init(&net->nft.commit_list, &commit_list);
+
+ va_start(args, fmt);
+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
+ va_end(args);
+- if (WARN(ret >= MODULE_NAME_LEN, "truncated: '%s' (len %d)", module_name, ret))
++ if (ret >= MODULE_NAME_LEN)
+ return;
+
+ mutex_unlock(&net->nft.commit_mutex);
+ request_module("%s", module_name);
+ mutex_lock(&net->nft.commit_mutex);
++
++ WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
++ list_splice(&commit_list, &net->nft.commit_list);
+ }
+ #endif
+
+@@ -933,12 +936,18 @@ static int nft_flush_table(struct nft_ctx *ctx)
+ }
+
+ list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
++ if (!nft_is_active_next(ctx->net, flowtable))
++ continue;
++
+ err = nft_delflowtable(ctx, flowtable);
+ if (err < 0)
+ goto out;
+ }
+
+ list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
++ if (!nft_is_active_next(ctx->net, obj))
++ continue;
++
+ err = nft_delobj(ctx, obj);
+ if (err < 0)
+ goto out;
+@@ -1129,7 +1138,8 @@ static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
+ .len = NFT_CHAIN_MAXNAMELEN - 1 },
+ [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
+ [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
+- [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
++ [NFTA_CHAIN_TYPE] = { .type = NLA_STRING,
++ .len = NFT_MODULE_AUTOLOAD_LIMIT },
+ [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
+ };
+
+@@ -2012,7 +2022,8 @@ static const struct nft_expr_type *nft_expr_type_get(struct net *net,
+ }
+
+ static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
+- [NFTA_EXPR_NAME] = { .type = NLA_STRING },
++ [NFTA_EXPR_NAME] = { .type = NLA_STRING,
++ .len = NFT_MODULE_AUTOLOAD_LIMIT },
+ [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
+ };
+
+@@ -3796,7 +3807,8 @@ static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
+ [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
+ .len = NFT_USERDATA_MAXLEN },
+ [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
+- [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
++ [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING,
++ .len = NFT_OBJ_MAXNAMELEN - 1 },
+ };
+
+ static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index 3a15f219e4e7..09441bbb0166 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -56,7 +56,7 @@ static int nft_tunnel_get_init(const struct nft_ctx *ctx,
+ struct nft_tunnel *priv = nft_expr_priv(expr);
+ u32 len;
+
+- if (!tb[NFTA_TUNNEL_KEY] &&
++ if (!tb[NFTA_TUNNEL_KEY] ||
+ !tb[NFTA_TUNNEL_DREG])
+ return -EINVAL;
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 5075fd293feb..823dea187691 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -10305,6 +10305,7 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
+ if (err)
+ return err;
+
++ cfg80211_sinfo_release_content(&sinfo);
+ if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
+ wdev->cqm_config->last_rssi_event_value =
+ (s8) sinfo.rx_beacon_signal_avg;
+diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
+index 364f5d67f05b..4cff76f33d45 100644
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -537,6 +537,10 @@ static inline int
+ rdev_set_wiphy_params(struct cfg80211_registered_device *rdev, u32 changed)
+ {
+ int ret;
++
++ if (!rdev->ops->set_wiphy_params)
++ return -EOPNOTSUPP;
++
+ trace_rdev_set_wiphy_params(&rdev->wiphy, changed);
+ ret = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
+ trace_rdev_return_int(&rdev->wiphy, ret);
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index 07c2196e9d57..f455b9af6815 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -1281,14 +1281,14 @@ void cfg80211_autodisconnect_wk(struct work_struct *work)
+ if (wdev->conn_owner_nlportid) {
+ switch (wdev->iftype) {
+ case NL80211_IFTYPE_ADHOC:
+- cfg80211_leave_ibss(rdev, wdev->netdev, false);
++ __cfg80211_leave_ibss(rdev, wdev->netdev, false);
+ break;
+ case NL80211_IFTYPE_AP:
+ case NL80211_IFTYPE_P2P_GO:
+- cfg80211_stop_ap(rdev, wdev->netdev, false);
++ __cfg80211_stop_ap(rdev, wdev->netdev, false);
+ break;
+ case NL80211_IFTYPE_MESH_POINT:
+- cfg80211_leave_mesh(rdev, wdev->netdev);
++ __cfg80211_leave_mesh(rdev, wdev->netdev);
+ break;
+ case NL80211_IFTYPE_STATION:
+ case NL80211_IFTYPE_P2P_CLIENT:
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 8857f7b0ed48..1a878b84cbd0 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -537,7 +537,7 @@ __frame_add_frag(struct sk_buff *skb, struct page *page,
+ struct skb_shared_info *sh = skb_shinfo(skb);
+ int page_offset;
+
+- page_ref_inc(page);
++ get_page(page);
+ page_offset = ptr - page_address(page);
+ skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);
+ }
+diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c
+index 253ef6e9d445..752f73980e30 100644
+--- a/security/apparmor/capability.c
++++ b/security/apparmor/capability.c
+@@ -110,13 +110,13 @@ static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile,
+ * profile_capable - test if profile allows use of capability @cap
+ * @profile: profile being enforced (NOT NULL, NOT unconfined)
+ * @cap: capability to test if allowed
+- * @audit: whether an audit record should be generated
++ * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated
+ * @sa: audit data (MAY BE NULL indicating no auditing)
+ *
+ * Returns: 0 if allowed else -EPERM
+ */
+-static int profile_capable(struct aa_profile *profile, int cap, int audit,
+- struct common_audit_data *sa)
++static int profile_capable(struct aa_profile *profile, int cap,
++ unsigned int opts, struct common_audit_data *sa)
+ {
+ int error;
+
+@@ -126,7 +126,7 @@ static int profile_capable(struct aa_profile *profile, int cap, int audit,
+ else
+ error = -EPERM;
+
+- if (audit == SECURITY_CAP_NOAUDIT) {
++ if (opts & CAP_OPT_NOAUDIT) {
+ if (!COMPLAIN_MODE(profile))
+ return error;
+ /* audit the cap request in complain mode but note that it
+@@ -142,13 +142,13 @@ static int profile_capable(struct aa_profile *profile, int cap, int audit,
+ * aa_capable - test permission to use capability
+ * @label: label being tested for capability (NOT NULL)
+ * @cap: capability to be tested
+- * @audit: whether an audit record should be generated
++ * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated
+ *
+ * Look up capability in profile capability set.
+ *
+ * Returns: 0 on success, or else an error code.
+ */
+-int aa_capable(struct aa_label *label, int cap, int audit)
++int aa_capable(struct aa_label *label, int cap, unsigned int opts)
+ {
+ struct aa_profile *profile;
+ int error = 0;
+@@ -156,7 +156,7 @@ int aa_capable(struct aa_label *label, int cap, int audit)
+
+ sa.u.cap = cap;
+ error = fn_for_each_confined(label, profile,
+- profile_capable(profile, cap, audit, &sa));
++ profile_capable(profile, cap, opts, &sa));
+
+ return error;
+ }
+diff --git a/security/apparmor/include/capability.h b/security/apparmor/include/capability.h
+index e0304e2aeb7f..1b3663b6ab12 100644
+--- a/security/apparmor/include/capability.h
++++ b/security/apparmor/include/capability.h
+@@ -40,7 +40,7 @@ struct aa_caps {
+
+ extern struct aa_sfs_entry aa_sfs_entry_caps[];
+
+-int aa_capable(struct aa_label *label, int cap, int audit);
++int aa_capable(struct aa_label *label, int cap, unsigned int opts);
+
+ static inline void aa_free_cap_rules(struct aa_caps *caps)
+ {
+diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c
+index 527ea1557120..aacd1e95cb59 100644
+--- a/security/apparmor/ipc.c
++++ b/security/apparmor/ipc.c
+@@ -107,7 +107,8 @@ static int profile_tracer_perm(struct aa_profile *tracer,
+ aad(sa)->label = &tracer->label;
+ aad(sa)->peer = tracee;
+ aad(sa)->request = 0;
+- aad(sa)->error = aa_capable(&tracer->label, CAP_SYS_PTRACE, 1);
++ aad(sa)->error = aa_capable(&tracer->label, CAP_SYS_PTRACE,
++ CAP_OPT_NONE);
+
+ return aa_audit(AUDIT_APPARMOR_AUTO, tracer, sa, audit_ptrace_cb);
+ }
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index 8b8b70620bbe..590ca7d8fae5 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -174,14 +174,14 @@ static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
+ }
+
+ static int apparmor_capable(const struct cred *cred, struct user_namespace *ns,
+- int cap, int audit)
++ int cap, unsigned int opts)
+ {
+ struct aa_label *label;
+ int error = 0;
+
+ label = aa_get_newest_cred_label(cred);
+ if (!unconfined(label))
+- error = aa_capable(label, cap, audit);
++ error = aa_capable(label, cap, opts);
+ aa_put_label(label);
+
+ return error;
+diff --git a/security/apparmor/resource.c b/security/apparmor/resource.c
+index 95fd26d09757..552ed09cb47e 100644
+--- a/security/apparmor/resource.c
++++ b/security/apparmor/resource.c
+@@ -124,7 +124,7 @@ int aa_task_setrlimit(struct aa_label *label, struct task_struct *task,
+ */
+
+ if (label != peer &&
+- aa_capable(label, CAP_SYS_RESOURCE, SECURITY_CAP_NOAUDIT) != 0)
++ aa_capable(label, CAP_SYS_RESOURCE, CAP_OPT_NOAUDIT) != 0)
+ error = fn_for_each(label, profile,
+ audit_resource(profile, resource,
+ new_rlim->rlim_max, peer,
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 2e489d6a3ac8..3023b4ad38a7 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -69,7 +69,7 @@ static void warn_setuid_and_fcaps_mixed(const char *fname)
+ * kernel's capable() and has_capability() returns 1 for this case.
+ */
+ int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
+- int cap, int audit)
++ int cap, unsigned int opts)
+ {
+ struct user_namespace *ns = targ_ns;
+
+@@ -223,12 +223,11 @@ int cap_capget(struct task_struct *target, kernel_cap_t *effective,
+ */
+ static inline int cap_inh_is_capped(void)
+ {
+-
+ /* they are so limited unless the current task has the CAP_SETPCAP
+ * capability
+ */
+ if (cap_capable(current_cred(), current_cred()->user_ns,
+- CAP_SETPCAP, SECURITY_CAP_AUDIT) == 0)
++ CAP_SETPCAP, CAP_OPT_NONE) == 0)
+ return 0;
+ return 1;
+ }
+@@ -1212,8 +1211,9 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
+ || ((old->securebits & SECURE_ALL_LOCKS & ~arg2)) /*[2]*/
+ || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS)) /*[3]*/
+ || (cap_capable(current_cred(),
+- current_cred()->user_ns, CAP_SETPCAP,
+- SECURITY_CAP_AUDIT) != 0) /*[4]*/
++ current_cred()->user_ns,
++ CAP_SETPCAP,
++ CAP_OPT_NONE) != 0) /*[4]*/
+ /*
+ * [1] no changing of bits that are locked
+ * [2] no unlocking of locks
+@@ -1308,9 +1308,10 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
+ {
+ int cap_sys_admin = 0;
+
+- if (cap_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
+- SECURITY_CAP_NOAUDIT) == 0)
++ if (cap_capable(current_cred(), &init_user_ns,
++ CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) == 0)
+ cap_sys_admin = 1;
++
+ return cap_sys_admin;
+ }
+
+@@ -1329,7 +1330,7 @@ int cap_mmap_addr(unsigned long addr)
+
+ if (addr < dac_mmap_min_addr) {
+ ret = cap_capable(current_cred(), &init_user_ns, CAP_SYS_RAWIO,
+- SECURITY_CAP_AUDIT);
++ CAP_OPT_NONE);
+ /* set PF_SUPERPRIV if it turns out we allow the low mmap */
+ if (ret == 0)
+ current->flags |= PF_SUPERPRIV;
+diff --git a/security/security.c b/security/security.c
+index 5ce2448f3a45..9478444bf93f 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -283,16 +283,12 @@ int security_capset(struct cred *new, const struct cred *old,
+ effective, inheritable, permitted);
+ }
+
+-int security_capable(const struct cred *cred, struct user_namespace *ns,
+- int cap)
++int security_capable(const struct cred *cred,
++ struct user_namespace *ns,
++ int cap,
++ unsigned int opts)
+ {
+- return call_int_hook(capable, 0, cred, ns, cap, SECURITY_CAP_AUDIT);
+-}
+-
+-int security_capable_noaudit(const struct cred *cred, struct user_namespace *ns,
+- int cap)
+-{
+- return call_int_hook(capable, 0, cred, ns, cap, SECURITY_CAP_NOAUDIT);
++ return call_int_hook(capable, 0, cred, ns, cap, opts);
+ }
+
+ int security_quotactl(int cmds, int type, int id, struct super_block *sb)
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 109ab510bdb1..040c843968dc 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1794,7 +1794,7 @@ static inline u32 signal_to_av(int sig)
+
+ /* Check whether a task is allowed to use a capability. */
+ static int cred_has_capability(const struct cred *cred,
+- int cap, int audit, bool initns)
++ int cap, unsigned int opts, bool initns)
+ {
+ struct common_audit_data ad;
+ struct av_decision avd;
+@@ -1821,7 +1821,7 @@ static int cred_has_capability(const struct cred *cred,
+
+ rc = avc_has_perm_noaudit(&selinux_state,
+ sid, sid, sclass, av, 0, &avd);
+- if (audit == SECURITY_CAP_AUDIT) {
++ if (!(opts & CAP_OPT_NOAUDIT)) {
+ int rc2 = avc_audit(&selinux_state,
+ sid, sid, sclass, av, &avd, rc, &ad, 0);
+ if (rc2)
+@@ -2341,9 +2341,9 @@ static int selinux_capset(struct cred *new, const struct cred *old,
+ */
+
+ static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
+- int cap, int audit)
++ int cap, unsigned int opts)
+ {
+- return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
++ return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
+ }
+
+ static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
+@@ -2417,7 +2417,7 @@ static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
+ int rc, cap_sys_admin = 0;
+
+ rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
+- SECURITY_CAP_NOAUDIT, true);
++ CAP_OPT_NOAUDIT, true);
+ if (rc == 0)
+ cap_sys_admin = 1;
+
+@@ -3272,11 +3272,11 @@ static int selinux_inode_getattr(const struct path *path)
+ static bool has_cap_mac_admin(bool audit)
+ {
+ const struct cred *cred = current_cred();
+- int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
++ unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
+
+- if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
++ if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
+ return false;
+- if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
++ if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
+ return false;
+ return true;
+ }
+@@ -3680,7 +3680,7 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
+ case KDSKBENT:
+ case KDSKBSENT:
+ error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
+- SECURITY_CAP_AUDIT, true);
++ CAP_OPT_NONE, true);
+ break;
+
+ /* default case assumes that the command will go
+diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
+index c071c356a963..a7855c61c05c 100644
+--- a/security/smack/smack_access.c
++++ b/security/smack/smack_access.c
+@@ -640,7 +640,7 @@ bool smack_privileged_cred(int cap, const struct cred *cred)
+ struct smack_known_list_elem *sklep;
+ int rc;
+
+- rc = cap_capable(cred, &init_user_ns, cap, SECURITY_CAP_AUDIT);
++ rc = cap_capable(cred, &init_user_ns, cap, CAP_OPT_NONE);
+ if (rc)
+ return false;
+
+diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
+index f587d0e27476..aed8e1c1f02f 100644
+--- a/sound/core/seq/seq_timer.c
++++ b/sound/core/seq/seq_timer.c
+@@ -480,15 +480,19 @@ void snd_seq_info_timer_read(struct snd_info_entry *entry,
+ q = queueptr(idx);
+ if (q == NULL)
+ continue;
+- if ((tmr = q->timer) == NULL ||
+- (ti = tmr->timeri) == NULL) {
+- queuefree(q);
+- continue;
+- }
++ mutex_lock(&q->timer_mutex);
++ tmr = q->timer;
++ if (!tmr)
++ goto unlock;
++ ti = tmr->timeri;
++ if (!ti)
++ goto unlock;
+ snd_iprintf(buffer, "Timer for queue %i : %s\n", q->queue, ti->timer->name);
+ resolution = snd_timer_resolution(ti) * tmr->ticks;
+ snd_iprintf(buffer, " Period time : %lu.%09lu\n", resolution / 1000000000, resolution % 1000000000);
+ snd_iprintf(buffer, " Skew : %u / %u\n", tmr->skew, tmr->skew_base);
++unlock:
++ mutex_unlock(&q->timer_mutex);
+ queuefree(q);
+ }
+ }
+diff --git a/sound/firewire/dice/dice-extension.c b/sound/firewire/dice/dice-extension.c
+index a63fcbc875ad..02f4a8318e38 100644
+--- a/sound/firewire/dice/dice-extension.c
++++ b/sound/firewire/dice/dice-extension.c
+@@ -159,8 +159,11 @@ int snd_dice_detect_extension_formats(struct snd_dice *dice)
+ int j;
+
+ for (j = i + 1; j < 9; ++j) {
+- if (pointers[i * 2] == pointers[j * 2])
++ if (pointers[i * 2] == pointers[j * 2]) {
++ // Fallback to limited functionality.
++ err = -ENXIO;
+ goto end;
++ }
+ }
+ }
+
+diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
+index 4f0497ab1aa8..cbdb6d4bb91e 100644
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -388,9 +388,6 @@ static int pm8916_wcd_analog_enable_micbias_int(struct snd_soc_component
+
+ switch (event) {
+ case SND_SOC_DAPM_PRE_PMU:
+- snd_soc_component_update_bits(component, CDC_A_MICB_1_INT_RBIAS,
+- MICB_1_INT_TX2_INT_RBIAS_EN_MASK,
+- MICB_1_INT_TX2_INT_RBIAS_EN_ENABLE);
+ snd_soc_component_update_bits(component, reg, MICB_1_EN_PULL_DOWN_EN_MASK, 0);
+ snd_soc_component_update_bits(component, CDC_A_MICB_1_EN,
+ MICB_1_EN_OPA_STG2_TAIL_CURR_MASK,
+@@ -440,6 +437,14 @@ static int pm8916_wcd_analog_enable_micbias_int1(struct
+ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+ struct pm8916_wcd_analog_priv *wcd = snd_soc_component_get_drvdata(component);
+
++ switch (event) {
++ case SND_SOC_DAPM_PRE_PMU:
++ snd_soc_component_update_bits(component, CDC_A_MICB_1_INT_RBIAS,
++ MICB_1_INT_TX1_INT_RBIAS_EN_MASK,
++ MICB_1_INT_TX1_INT_RBIAS_EN_ENABLE);
++ break;
++ }
++
+ return pm8916_wcd_analog_enable_micbias_int(component, event, w->reg,
+ wcd->micbias1_cap_mode);
+ }
+@@ -550,6 +555,11 @@ static int pm8916_wcd_analog_enable_micbias_int2(struct
+ struct pm8916_wcd_analog_priv *wcd = snd_soc_component_get_drvdata(component);
+
+ switch (event) {
++ case SND_SOC_DAPM_PRE_PMU:
++ snd_soc_component_update_bits(component, CDC_A_MICB_1_INT_RBIAS,
++ MICB_1_INT_TX2_INT_RBIAS_EN_MASK,
++ MICB_1_INT_TX2_INT_RBIAS_EN_ENABLE);
++ break;
+ case SND_SOC_DAPM_POST_PMU:
+ pm8916_mbhc_configure_bias(wcd, true);
+ break;
+@@ -885,10 +895,10 @@ static const struct snd_soc_dapm_widget pm8916_wcd_analog_dapm_widgets[] = {
+
+ SND_SOC_DAPM_SUPPLY("MIC BIAS External1", CDC_A_MICB_1_EN, 7, 0,
+ pm8916_wcd_analog_enable_micbias_ext1,
+- SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
++ SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_SUPPLY("MIC BIAS External2", CDC_A_MICB_2_EN, 7, 0,
+ pm8916_wcd_analog_enable_micbias_ext2,
+- SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
++ SND_SOC_DAPM_POST_PMU),
+
+ SND_SOC_DAPM_ADC_E("ADC1", NULL, CDC_A_TX_1_EN, 7, 0,
+ pm8916_wcd_analog_enable_adc,
+diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c
+index 3063dedd21cf..6de2ab6f9706 100644
+--- a/sound/soc/codecs/msm8916-wcd-digital.c
++++ b/sound/soc/codecs/msm8916-wcd-digital.c
+@@ -357,6 +357,12 @@ static int msm8916_wcd_digital_enable_interpolator(
+ snd_soc_component_write(component, rx_gain_reg[w->shift],
+ snd_soc_component_read32(component, rx_gain_reg[w->shift]));
+ break;
++ case SND_SOC_DAPM_POST_PMD:
++ snd_soc_component_update_bits(component, LPASS_CDC_CLK_RX_RESET_CTL,
++ 1 << w->shift, 1 << w->shift);
++ snd_soc_component_update_bits(component, LPASS_CDC_CLK_RX_RESET_CTL,
++ 1 << w->shift, 0x0);
++ break;
+ }
+ return 0;
+ }
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 9de4221de730..8b91be394407 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -377,7 +377,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ add_sync_ep_from_ifnum:
+ iface = usb_ifnum_to_if(dev, ifnum);
+
+- if (!iface || iface->num_altsetting == 0)
++ if (!iface || iface->num_altsetting < 2)
+ return -EINVAL;
+
+ alts = &iface->altsetting[1];
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index 2f94f7ad65bd..b2b6a9672544 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -961,6 +961,7 @@ int cmd_report(int argc, const char **argv)
+ struct stat st;
+ bool has_br_stack = false;
+ int branch_mode = -1;
++ int last_key = 0;
+ bool branch_call_mode = false;
+ #define CALLCHAIN_DEFAULT_OPT "graph,0.5,caller,function,percent"
+ const char report_callchain_help[] = "Display call graph (stack chain/backtrace):\n\n"
+@@ -1292,7 +1293,8 @@ repeat:
+ else
+ use_browser = 0;
+
+- if (setup_sorting(session->evlist) < 0) {
++ if ((last_key != K_SWITCH_INPUT_DATA) &&
++ (setup_sorting(session->evlist) < 0)) {
+ if (sort_order)
+ parse_options_usage(report_usage, options, "s", 1);
+ if (field_order)
+@@ -1390,6 +1392,7 @@ repeat:
+ ret = __cmd_report(&report);
+ if (ret == K_SWITCH_INPUT_DATA) {
+ perf_session__delete(session);
++ last_key = K_SWITCH_INPUT_DATA;
+ goto repeat;
+ } else
+ ret = 0;
+diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
+index 3badd7f1e1b8..7173e1f41093 100644
+--- a/tools/perf/util/hist.h
++++ b/tools/perf/util/hist.h
+@@ -324,10 +324,10 @@ static inline void perf_hpp__prepend_sort_field(struct perf_hpp_fmt *format)
+ list_for_each_entry_safe(format, tmp, &(_list)->sorts, sort_list)
+
+ #define hists__for_each_format(hists, format) \
+- perf_hpp_list__for_each_format((hists)->hpp_list, fmt)
++ perf_hpp_list__for_each_format((hists)->hpp_list, format)
+
+ #define hists__for_each_sort_list(hists, format) \
+- perf_hpp_list__for_each_sort_list((hists)->hpp_list, fmt)
++ perf_hpp_list__for_each_sort_list((hists)->hpp_list, format)
+
+ extern struct perf_hpp_fmt perf_hpp__format[];
+
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index 7ccabb891e5a..a6aaac24ce05 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -612,38 +612,26 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwfl_Module *mod,
+ const char *function,
+ struct probe_trace_point *tp)
+ {
+- Dwarf_Addr eaddr, highaddr;
++ Dwarf_Addr eaddr;
+ GElf_Sym sym;
+ const char *symbol;
+
+ /* Verify the address is correct */
+- if (dwarf_entrypc(sp_die, &eaddr) != 0) {
+- pr_warning("Failed to get entry address of %s\n",
+- dwarf_diename(sp_die));
+- return -ENOENT;
+- }
+- if (dwarf_highpc(sp_die, &highaddr) != 0) {
+- pr_warning("Failed to get end address of %s\n",
+- dwarf_diename(sp_die));
+- return -ENOENT;
+- }
+- if (paddr > highaddr) {
+- pr_warning("Offset specified is greater than size of %s\n",
++ if (!dwarf_haspc(sp_die, paddr)) {
++ pr_warning("Specified offset is out of %s\n",
+ dwarf_diename(sp_die));
+ return -EINVAL;
+ }
+
+- symbol = dwarf_diename(sp_die);
++ /* Try to get actual symbol name from symtab */
++ symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL);
+ if (!symbol) {
+- /* Try to get the symbol name from symtab */
+- symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL);
+- if (!symbol) {
+- pr_warning("Failed to find symbol at 0x%lx\n",
+- (unsigned long)paddr);
+- return -ENOENT;
+- }
+- eaddr = sym.st_value;
++ pr_warning("Failed to find symbol at 0x%lx\n",
++ (unsigned long)paddr);
++ return -ENOENT;
+ }
++ eaddr = sym.st_value;
++
+ tp->offset = (unsigned long)(paddr - eaddr);
+ tp->address = (unsigned long)paddr;
+ tp->symbol = strdup(symbol);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-01-27 14:25 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-01-27 14:25 UTC (permalink / raw
To: gentoo-commits
commit: 6fac29ab3b07663ad8abad37e43b857ad95a2261
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Jan 27 14:25:03 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Jan 27 14:25:03 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6fac29ab
Linux patch 4.19.99
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1098_linux-4.19.99.patch | 20747 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 20751 insertions(+)
diff --git a/0000_README b/0000_README
index b2dcc20..cae3438 100644
--- a/0000_README
+++ b/0000_README
@@ -431,6 +431,10 @@ Patch: 1097_linux-4.19.98.patch
From: https://www.kernel.org
Desc: Linux 4.19.98
+Patch: 1098_linux-4.19.99.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.99
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1098_linux-4.19.99.patch b/1098_linux-4.19.99.patch
new file mode 100644
index 0000000..4c7a117
--- /dev/null
+++ b/1098_linux-4.19.99.patch
@@ -0,0 +1,20747 @@
+diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
+index a5b4f223641d..8127a08e366d 100644
+--- a/Documentation/ABI/testing/sysfs-bus-iio
++++ b/Documentation/ABI/testing/sysfs-bus-iio
+@@ -199,7 +199,7 @@ Description:
+
+ What: /sys/bus/iio/devices/iio:deviceX/in_positionrelative_x_raw
+ What: /sys/bus/iio/devices/iio:deviceX/in_positionrelative_y_raw
+-KernelVersion: 4.18
++KernelVersion: 4.19
+ Contact: linux-iio@vger.kernel.org
+ Description:
+ Relative position in direction x or y on a pad (may be
+diff --git a/Documentation/devicetree/bindings/bus/ti-sysc.txt b/Documentation/devicetree/bindings/bus/ti-sysc.txt
+index 91dc2333af01..85a23f551f02 100644
+--- a/Documentation/devicetree/bindings/bus/ti-sysc.txt
++++ b/Documentation/devicetree/bindings/bus/ti-sysc.txt
+@@ -35,6 +35,7 @@ Required standard properties:
+ "ti,sysc-omap3-sham"
+ "ti,sysc-omap-aes"
+ "ti,sysc-mcasp"
++ "ti,sysc-dra7-mcasp"
+ "ti,sysc-usb-host-fs"
+ "ti,sysc-dra7-mcan"
+
+diff --git a/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt b/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt
+new file mode 100644
+index 000000000000..f315c9723bd2
+--- /dev/null
++++ b/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt
+@@ -0,0 +1,27 @@
++OMAP ROM RNG driver binding
++
++Secure SoCs may provide RNG via secure ROM calls like Nokia N900 does. The
++implementation can depend on the SoC secure ROM used.
++
++- compatible:
++ Usage: required
++ Value type: <string>
++ Definition: must be "nokia,n900-rom-rng"
++
++- clocks:
++ Usage: required
++ Value type: <prop-encoded-array>
++ Definition: reference to the the RNG interface clock
++
++- clock-names:
++ Usage: required
++ Value type: <stringlist>
++ Definition: must be "ick"
++
++Example:
++
++ rom_rng: rng {
++ compatible = "nokia,n900-rom-rng";
++ clocks = <&rng_ick>;
++ clock-names = "ick";
++ };
+diff --git a/Makefile b/Makefile
+index 48dbafb790ff..a2be0c79eeb8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 98
++SUBLEVEL = 99
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -964,6 +964,7 @@ ifdef CONFIG_STACK_VALIDATION
+ endif
+ endif
+
++PHONY += prepare0
+
+ ifeq ($(KBUILD_EXTMOD),)
+ core-y += kernel/ certs/ mm/ fs/ ipc/ security/ crypto/ block/
+@@ -1072,8 +1073,7 @@ scripts: scripts_basic asm-generic gcc-plugins $(autoksyms_h)
+ # archprepare is used in arch Makefiles and when processed asm symlink,
+ # version.h and scripts_basic is processed / created.
+
+-# Listed in dependency order
+-PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3
++PHONY += prepare archprepare prepare1 prepare2 prepare3
+
+ # prepare3 is used to check if we are building in a separate output directory,
+ # and if so do:
+diff --git a/arch/arm/boot/dts/aspeed-g5.dtsi b/arch/arm/boot/dts/aspeed-g5.dtsi
+index d107459fc0f8..f2e1015d75ab 100644
+--- a/arch/arm/boot/dts/aspeed-g5.dtsi
++++ b/arch/arm/boot/dts/aspeed-g5.dtsi
+@@ -247,7 +247,7 @@
+ compatible = "aspeed,ast2500-gpio";
+ reg = <0x1e780000 0x1000>;
+ interrupts = <20>;
+- gpio-ranges = <&pinctrl 0 0 220>;
++ gpio-ranges = <&pinctrl 0 0 232>;
+ clocks = <&syscon ASPEED_CLK_APB>;
+ interrupt-controller;
+ };
+diff --git a/arch/arm/boot/dts/at91-nattis-2-natte-2.dts b/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
+index af9f38456d04..4308a07b792e 100644
+--- a/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
++++ b/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
+@@ -38,14 +38,16 @@
+ atmel,pins =
+ <AT91_PIOA 21
+ AT91_PERIPH_GPIO
+- AT91_PINCTRL_OUTPUT_VAL(0)>;
++ (AT91_PINCTRL_OUTPUT |
++ AT91_PINCTRL_OUTPUT_VAL(0))>;
+ };
+
+ pinctrl_lcd_hipow0: lcd_hipow0 {
+ atmel,pins =
+ <AT91_PIOA 23
+ AT91_PERIPH_GPIO
+- AT91_PINCTRL_OUTPUT_VAL(0)>;
++ (AT91_PINCTRL_OUTPUT |
++ AT91_PINCTRL_OUTPUT_VAL(0))>;
+ };
+ };
+ };
+@@ -219,6 +221,7 @@
+ reg = <0>;
+ bus-width = <4>;
+ cd-gpios = <&pioD 5 GPIO_ACTIVE_HIGH>;
++ cd-inverted;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
+index cb2d6d78a7fb..c481eab1bd7c 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
++++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
+@@ -32,7 +32,7 @@
+
+ mailbox@7e00b840 {
+ compatible = "brcm,bcm2835-vchiq";
+- reg = <0x7e00b840 0xf>;
++ reg = <0x7e00b840 0x3c>;
+ interrupts = <0 2>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/iwg20d-q7-common.dtsi b/arch/arm/boot/dts/iwg20d-q7-common.dtsi
+index 5cae74eb6cdd..a2c9a1e88c1a 100644
+--- a/arch/arm/boot/dts/iwg20d-q7-common.dtsi
++++ b/arch/arm/boot/dts/iwg20d-q7-common.dtsi
+@@ -87,7 +87,7 @@
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <3300000>;
+
+- gpios = <&gpio2 30 GPIO_ACTIVE_LOW>;
++ gpios = <&gpio2 30 GPIO_ACTIVE_HIGH>;
+ gpios-states = <1>;
+ states = <3300000 1
+ 1800000 0>;
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+index 4990ed90dcea..3e39b9a1f35d 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+@@ -153,7 +153,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc1_pins>;
+ wp-gpios = <&gpio4 30 GPIO_ACTIVE_HIGH>; /* gpio_126 */
+- cd-gpios = <&gpio4 14 IRQ_TYPE_LEVEL_LOW>; /* gpio_110 */
++ cd-gpios = <&gpio4 14 GPIO_ACTIVE_LOW>; /* gpio_110 */
+ vmmc-supply = <&vmmc1>;
+ bus-width = <4>;
+ cap-power-off-card;
+diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+index 98b682a8080c..c5d54c4d3747 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+@@ -232,6 +232,20 @@
+ >;
+ };
+
++ i2c2_pins: pinmux_i2c2_pins {
++ pinctrl-single,pins = <
++ OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT | MUX_MODE0) /* i2c2_scl */
++ OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT | MUX_MODE0) /* i2c2_sda */
++ >;
++ };
++
++ i2c3_pins: pinmux_i2c3_pins {
++ pinctrl-single,pins = <
++ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0) /* i2c3_scl */
++ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0) /* i2c3_sda */
++ >;
++ };
++
+ tsc2004_pins: pinmux_tsc2004_pins {
+ pinctrl-single,pins = <
+ OMAP3_CORE1_IOPAD(0x2186, PIN_INPUT | MUX_MODE4) /* mcbsp4_dr.gpio_153 */
+@@ -253,18 +267,6 @@
+ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */
+ >;
+ };
+- i2c2_pins: pinmux_i2c2_pins {
+- pinctrl-single,pins = <
+- OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT | MUX_MODE0) /* i2c2_scl */
+- OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT | MUX_MODE0) /* i2c2_sda */
+- >;
+- };
+- i2c3_pins: pinmux_i2c3_pins {
+- pinctrl-single,pins = <
+- OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0) /* i2c3_scl */
+- OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0) /* i2c3_sda */
+- >;
+- };
+ };
+
+ &omap3_pmx_core2 {
+diff --git a/arch/arm/boot/dts/lpc3250-phy3250.dts b/arch/arm/boot/dts/lpc3250-phy3250.dts
+index 1e1c2f517a82..ffcf78631b22 100644
+--- a/arch/arm/boot/dts/lpc3250-phy3250.dts
++++ b/arch/arm/boot/dts/lpc3250-phy3250.dts
+@@ -49,8 +49,8 @@
+ sd_reg: regulator@2 {
+ compatible = "regulator-fixed";
+ regulator-name = "sd_reg";
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
+ gpio = <&gpio 5 5 0>;
+ enable-active-high;
+ };
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index ed0d6fb20122..9ad3df11db0d 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -139,11 +139,11 @@
+ };
+
+ clcd: clcd@31040000 {
+- compatible = "arm,pl110", "arm,primecell";
++ compatible = "arm,pl111", "arm,primecell";
+ reg = <0x31040000 0x1000>;
+ interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clk LPC32XX_CLK_LCD>;
+- clock-names = "apb_pclk";
++ clocks = <&clk LPC32XX_CLK_LCD>, <&clk LPC32XX_CLK_LCD>;
++ clock-names = "clcdclk", "apb_pclk";
+ status = "disabled";
+ };
+
+@@ -462,7 +462,9 @@
+ key: key@40050000 {
+ compatible = "nxp,lpc3220-key";
+ reg = <0x40050000 0x1000>;
+- interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
++ clocks = <&clk LPC32XX_CLK_KEY>;
++ interrupt-parent = <&sic1>;
++ interrupts = <22 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts
+index f0c949d74833..ec5afad3efd8 100644
+--- a/arch/arm/boot/dts/ls1021a-twr.dts
++++ b/arch/arm/boot/dts/ls1021a-twr.dts
+@@ -143,7 +143,7 @@
+ };
+
+ &enet0 {
+- tbi-handle = <&tbi1>;
++ tbi-handle = <&tbi0>;
+ phy-handle = <&sgmii_phy2>;
+ phy-connection-type = "sgmii";
+ status = "okay";
+@@ -222,6 +222,13 @@
+ sgmii_phy2: ethernet-phy@2 {
+ reg = <0x2>;
+ };
++ tbi0: tbi-phy@1f {
++ reg = <0x1f>;
++ device_type = "tbi-phy";
++ };
++};
++
++&mdio1 {
+ tbi1: tbi-phy@1f {
+ reg = <0x1f>;
+ device_type = "tbi-phy";
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index f18490548c78..7e22309bccac 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -584,7 +584,7 @@
+ };
+
+ mdio0: mdio@2d24000 {
+- compatible = "gianfar";
++ compatible = "fsl,etsec2-mdio";
+ device_type = "mdio";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -592,6 +592,15 @@
+ <0x0 0x2d10030 0x0 0x4>;
+ };
+
++ mdio1: mdio@2d64000 {
++ compatible = "fsl,etsec2-mdio";
++ device_type = "mdio";
++ #address-cells = <1>;
++ #size-cells = <0>;
++ reg = <0x0 0x2d64000 0x0 0x4000>,
++ <0x0 0x2d50030 0x0 0x4>;
++ };
++
+ ptp_clock@2d10e00 {
+ compatible = "fsl,etsec-ptp";
+ reg = <0x0 0x2d10e00 0x0 0xb0>;
+diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
+index 182a53991c90..37785e7d1238 100644
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -158,6 +158,12 @@
+ pwms = <&pwm9 0 26316 0>; /* 38000 Hz */
+ };
+
++ rom_rng: rng {
++ compatible = "nokia,n900-rom-rng";
++ clocks = <&rng_ick>;
++ clock-names = "ick";
++ };
++
+ /* controlled (enabled/disabled) directly by bcm2048 and wl1251 */
+ vctcxo: vctcxo {
+ compatible = "fixed-clock";
+diff --git a/arch/arm/boot/dts/r8a7743.dtsi b/arch/arm/boot/dts/r8a7743.dtsi
+index 24715f74ae08..5015e2273d82 100644
+--- a/arch/arm/boot/dts/r8a7743.dtsi
++++ b/arch/arm/boot/dts/r8a7743.dtsi
+@@ -565,9 +565,7 @@
+ /* doesn't need pinmux */
+ #address-cells = <1>;
+ #size-cells = <0>;
+- compatible = "renesas,iic-r8a7743",
+- "renesas,rcar-gen2-iic",
+- "renesas,rmobile-iic";
++ compatible = "renesas,iic-r8a7743";
+ reg = <0 0xe60b0000 0 0x425>;
+ interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cpg CPG_MOD 926>;
+diff --git a/arch/arm/boot/dts/stm32h743i-eval.dts b/arch/arm/boot/dts/stm32h743i-eval.dts
+index 3f8e0c4a998d..5bf64e63cdf3 100644
+--- a/arch/arm/boot/dts/stm32h743i-eval.dts
++++ b/arch/arm/boot/dts/stm32h743i-eval.dts
+@@ -79,6 +79,7 @@
+ };
+
+ &adc_12 {
++ vdda-supply = <&vdda>;
+ vref-supply = <&vdda>;
+ status = "okay";
+ adc1: adc@0 {
+diff --git a/arch/arm/boot/dts/sun8i-a23-a33.dtsi b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+index c16ffcc4db7d..1efad1a6bcfd 100644
+--- a/arch/arm/boot/dts/sun8i-a23-a33.dtsi
++++ b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+@@ -155,6 +155,21 @@
+ #dma-cells = <1>;
+ };
+
++ nfc: nand@1c03000 {
++ compatible = "allwinner,sun4i-a10-nand";
++ reg = <0x01c03000 0x1000>;
++ interrupts = <GIC_SPI 70 IRQ_TYPE_LEVEL_HIGH>;
++ clocks = <&ccu CLK_BUS_NAND>, <&ccu CLK_NAND>;
++ clock-names = "ahb", "mod";
++ resets = <&ccu RST_BUS_NAND>;
++ reset-names = "ahb";
++ pinctrl-names = "default";
++ pinctrl-0 = <&nand_pins &nand_pins_cs0 &nand_pins_rb0>;
++ status = "disabled";
++ #address-cells = <1>;
++ #size-cells = <0>;
++ };
++
+ mmc0: mmc@1c0f000 {
+ compatible = "allwinner,sun7i-a20-mmc";
+ reg = <0x01c0f000 0x1000>;
+@@ -212,21 +227,6 @@
+ #size-cells = <0>;
+ };
+
+- nfc: nand@1c03000 {
+- compatible = "allwinner,sun4i-a10-nand";
+- reg = <0x01c03000 0x1000>;
+- interrupts = <GIC_SPI 70 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&ccu CLK_BUS_NAND>, <&ccu CLK_NAND>;
+- clock-names = "ahb", "mod";
+- resets = <&ccu RST_BUS_NAND>;
+- reset-names = "ahb";
+- pinctrl-names = "default";
+- pinctrl-0 = <&nand_pins &nand_pins_cs0 &nand_pins_rb0>;
+- status = "disabled";
+- #address-cells = <1>;
+- #size-cells = <0>;
+- };
+-
+ usb_otg: usb@1c19000 {
+ /* compatible gets set in SoC specific dtsi file */
+ reg = <0x01c19000 0x0400>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+index 25540b7694d5..6523d81dd9c4 100644
+--- a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
++++ b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+@@ -90,6 +90,8 @@
+ wifi_pwrseq: wifi_pwrseq {
+ compatible = "mmc-pwrseq-simple";
+ reset-gpios = <&r_pio 0 7 GPIO_ACTIVE_LOW>; /* PL7 */
++ clocks = <&rtc 1>;
++ clock-names = "ext_clock";
+ };
+
+ sound_spdif {
+@@ -155,6 +157,8 @@
+
+ &mmc1 {
+ vmmc-supply = <®_vcc3v3>;
++ vqmmc-supply = <®_vcc3v3>;
++ mmc-pwrseq = <&wifi_pwrseq>;
+ bus-width = <4>;
+ non-removable;
+ status = "okay";
+diff --git a/arch/arm/boot/dts/sun9i-a80-optimus.dts b/arch/arm/boot/dts/sun9i-a80-optimus.dts
+index 58a199b0e494..d1e58a6a4343 100644
+--- a/arch/arm/boot/dts/sun9i-a80-optimus.dts
++++ b/arch/arm/boot/dts/sun9i-a80-optimus.dts
+@@ -82,7 +82,7 @@
+
+ reg_usb1_vbus: usb1-vbus {
+ compatible = "regulator-fixed";
+- pinctrl-names = "default";
++ regulator-name = "usb1-vbus";
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+ enable-active-high;
+@@ -91,7 +91,7 @@
+
+ reg_usb3_vbus: usb3-vbus {
+ compatible = "regulator-fixed";
+- pinctrl-names = "default";
++ regulator-name = "usb3-vbus";
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+ enable-active-high;
+diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
+index ad574d20415c..1b1b82b37ce0 100644
+--- a/arch/arm/common/mcpm_entry.c
++++ b/arch/arm/common/mcpm_entry.c
+@@ -381,7 +381,7 @@ static int __init nocache_trampoline(unsigned long _arg)
+ unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
+ phys_reset_t phys_reset;
+
+- mcpm_set_entry_vector(cpu, cluster, cpu_resume);
++ mcpm_set_entry_vector(cpu, cluster, cpu_resume_no_hyp);
+ setup_mm_for_reboot();
+
+ __mcpm_cpu_going_down(cpu, cluster);
+diff --git a/arch/arm/configs/qcom_defconfig b/arch/arm/configs/qcom_defconfig
+index 6aa7046fb91f..bd6440f23493 100644
+--- a/arch/arm/configs/qcom_defconfig
++++ b/arch/arm/configs/qcom_defconfig
+@@ -207,6 +207,7 @@ CONFIG_MSM_MMCC_8974=y
+ CONFIG_MSM_IOMMU=y
+ CONFIG_HWSPINLOCK=y
+ CONFIG_HWSPINLOCK_QCOM=y
++CONFIG_MAILBOX=y
+ CONFIG_REMOTEPROC=y
+ CONFIG_QCOM_ADSP_PIL=y
+ CONFIG_QCOM_Q6V5_PIL=y
+diff --git a/arch/arm/include/asm/suspend.h b/arch/arm/include/asm/suspend.h
+index 452bbdcbcc83..506314265c6f 100644
+--- a/arch/arm/include/asm/suspend.h
++++ b/arch/arm/include/asm/suspend.h
+@@ -10,6 +10,7 @@ struct sleep_save_sp {
+ };
+
+ extern void cpu_resume(void);
++extern void cpu_resume_no_hyp(void);
+ extern void cpu_resume_arm(void);
+ extern int cpu_suspend(unsigned long, int (*)(unsigned long));
+
+diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
+index 326a97aa3ea0..22efcf48604c 100644
+--- a/arch/arm/kernel/head-nommu.S
++++ b/arch/arm/kernel/head-nommu.S
+@@ -441,8 +441,8 @@ M_CLASS(str r6, [r12, #PMSAv8_RLAR_A(3)])
+ str r5, [r12, #PMSAv8_RBAR_A(0)]
+ str r6, [r12, #PMSAv8_RLAR_A(0)]
+ #else
+- mcr p15, 0, r5, c6, c10, 1 @ PRBAR4
+- mcr p15, 0, r6, c6, c10, 2 @ PRLAR4
++ mcr p15, 0, r5, c6, c10, 0 @ PRBAR4
++ mcr p15, 0, r6, c6, c10, 1 @ PRLAR4
+ #endif
+ #endif
+ ret lr
+diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
+index 60146e32619a..82a942894fc0 100644
+--- a/arch/arm/kernel/hyp-stub.S
++++ b/arch/arm/kernel/hyp-stub.S
+@@ -180,8 +180,8 @@ ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE
+ @ Check whether GICv3 system registers are available
+ mrc p15, 0, r7, c0, c1, 1 @ ID_PFR1
+ ubfx r7, r7, #28, #4
+- cmp r7, #1
+- bne 2f
++ teq r7, #0
++ beq 2f
+
+ @ Enable system register accesses
+ mrc p15, 4, r7, c12, c9, 5 @ ICC_HSRE
+diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
+index a8257fc9cf2a..5dc8b80bb693 100644
+--- a/arch/arm/kernel/sleep.S
++++ b/arch/arm/kernel/sleep.S
+@@ -120,6 +120,14 @@ ENDPROC(cpu_resume_after_mmu)
+ .text
+ .align
+
++#ifdef CONFIG_MCPM
++ .arm
++THUMB( .thumb )
++ENTRY(cpu_resume_no_hyp)
++ARM_BE8(setend be) @ ensure we are in BE mode
++ b no_hyp
++#endif
++
+ #ifdef CONFIG_MMU
+ .arm
+ ENTRY(cpu_resume_arm)
+@@ -135,6 +143,7 @@ ARM_BE8(setend be) @ ensure we are in BE mode
+ bl __hyp_stub_install_secondary
+ #endif
+ safe_svcmode_maskall r1
++no_hyp:
+ mov r1, #0
+ ALT_SMP(mrc p15, 0, r0, c0, c0, 5)
+ ALT_UP_B(1f)
+@@ -163,6 +172,9 @@ ENDPROC(cpu_resume)
+
+ #ifdef CONFIG_MMU
+ ENDPROC(cpu_resume_arm)
++#endif
++#ifdef CONFIG_MCPM
++ENDPROC(cpu_resume_no_hyp)
+ #endif
+
+ .align 2
+diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c
+index f4dd7f9663c1..e8cda5e02b4e 100644
+--- a/arch/arm/kernel/vdso.c
++++ b/arch/arm/kernel/vdso.c
+@@ -205,7 +205,6 @@ static int __init vdso_init(void)
+ }
+
+ text_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
+- pr_debug("vdso: %i text pages at base %p\n", text_pages, vdso_start);
+
+ /* Allocate the VDSO text pagelist */
+ vdso_text_pagelist = kcalloc(text_pages, sizeof(struct page *),
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index ec3789ba17b8..a8269f0a87ce 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2430,7 +2430,7 @@ static void _setup_iclk_autoidle(struct omap_hwmod *oh)
+ */
+ static int _setup_reset(struct omap_hwmod *oh)
+ {
+- int r;
++ int r = 0;
+
+ if (oh->_state != _HWMOD_STATE_INITIALIZED)
+ return -EINVAL;
+diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
+index dae726228770..b57faa2310a2 100644
+--- a/arch/arm/mach-omap2/pdata-quirks.c
++++ b/arch/arm/mach-omap2/pdata-quirks.c
+@@ -263,14 +263,6 @@ static void __init am3517_evm_legacy_init(void)
+ am35xx_emac_reset();
+ }
+
+-static struct platform_device omap3_rom_rng_device = {
+- .name = "omap3-rom-rng",
+- .id = -1,
+- .dev = {
+- .platform_data = rx51_secure_rng_call,
+- },
+-};
+-
+ static void __init nokia_n900_legacy_init(void)
+ {
+ hsmmc2_internal_input_clk();
+@@ -286,9 +278,6 @@ static void __init nokia_n900_legacy_init(void)
+ pr_warn("RX-51: Not enabling ARM errata 430973 workaround\n");
+ pr_warn("Thumb binaries may crash randomly without this workaround\n");
+ }
+-
+- pr_info("RX-51: Registering OMAP3 HWRNG device\n");
+- platform_device_register(&omap3_rom_rng_device);
+ }
+ }
+
+@@ -466,6 +455,7 @@ static struct of_dev_auxdata omap_auxdata_lookup[] = {
+ OF_DEV_AUXDATA("ti,davinci_mdio", 0x5c030000, "davinci_mdio.0", NULL),
+ OF_DEV_AUXDATA("ti,am3517-emac", 0x5c000000, "davinci_emac.0",
+ &am35xx_emac_pdata),
++ OF_DEV_AUXDATA("nokia,n900-rom-rng", 0, NULL, rx51_secure_rng_call),
+ /* McBSP modules with sidetone core */
+ #if IS_ENABLED(CONFIG_SND_OMAP_SOC_MCBSP)
+ OF_DEV_AUXDATA("ti,omap3-mcbsp", 0x49022000, "49022000.mcbsp", &mcbsp_pdata),
+diff --git a/arch/arm/mach-rpc/irq.c b/arch/arm/mach-rpc/irq.c
+index b8a61cb11207..7f0f40178634 100644
+--- a/arch/arm/mach-rpc/irq.c
++++ b/arch/arm/mach-rpc/irq.c
+@@ -118,7 +118,7 @@ extern unsigned char rpc_default_fiq_start, rpc_default_fiq_end;
+
+ void __init rpc_init_irq(void)
+ {
+- unsigned int irq, clr, set = 0;
++ unsigned int irq, clr, set;
+
+ iomd_writeb(0, IOMD_IRQMASKA);
+ iomd_writeb(0, IOMD_IRQMASKB);
+@@ -130,6 +130,7 @@ void __init rpc_init_irq(void)
+
+ for (irq = 0; irq < NR_IRQS; irq++) {
+ clr = IRQ_NOREQUEST;
++ set = 0;
+
+ if (irq <= 6 || (irq >= 9 && irq <= 15))
+ clr |= IRQ_NOPROBE;
+diff --git a/arch/arm/mach-stm32/Kconfig b/arch/arm/mach-stm32/Kconfig
+index 713c068b953f..adca4368d67c 100644
+--- a/arch/arm/mach-stm32/Kconfig
++++ b/arch/arm/mach-stm32/Kconfig
+@@ -1,5 +1,6 @@
+ menuconfig ARCH_STM32
+- bool "STMicroelectronics STM32 family" if ARM_SINGLE_ARMV7M || ARCH_MULTI_V7
++ bool "STMicroelectronics STM32 family"
++ depends on ARM_SINGLE_ARMV7M || ARCH_MULTI_V7
+ select ARMV7M_SYSTICK if ARM_SINGLE_ARMV7M
+ select HAVE_ARM_ARCH_TIMER if ARCH_MULTI_V7
+ select ARM_GIC if ARCH_MULTI_V7
+diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
+index f51919974183..bf25f780c1c9 100644
+--- a/arch/arm/plat-pxa/ssp.c
++++ b/arch/arm/plat-pxa/ssp.c
+@@ -183,18 +183,12 @@ static int pxa_ssp_probe(struct platform_device *pdev)
+
+ static int pxa_ssp_remove(struct platform_device *pdev)
+ {
+- struct resource *res;
+ struct ssp_device *ssp;
+
+ ssp = platform_get_drvdata(pdev);
+ if (ssp == NULL)
+ return -ENODEV;
+
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- release_mem_region(res->start, resource_size(res));
+-
+- clk_put(ssp->clk);
+-
+ mutex_lock(&ssp_lock);
+ list_del(&ssp->node);
+ mutex_unlock(&ssp_lock);
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index d3daf90a8715..7abc4ea30541 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -366,7 +366,8 @@
+ interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&ccu 58>;
++ clocks = <&ccu 58>, <&osc24M>, <&rtc 0>;
++ clock-names = "apb", "hosc", "losc";
+ gpio-controller;
+ #gpio-cells = <3>;
+ interrupt-controller;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+index 48daec7f78ba..6c3a47d90c79 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+@@ -176,6 +176,8 @@
+ pcf8563: rtc@51 {
+ compatible = "nxp,pcf8563";
+ reg = <0x51>;
++ interrupt-parent = <&r_intc>;
++ interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
+ #clock-cells = <0>;
+ };
+ };
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index cfa5fffcf62b..72813e7aefb8 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -101,17 +101,6 @@
+ #reset-cells = <1>;
+ };
+
+- gic: interrupt-controller@3021000 {
+- compatible = "arm,gic-400";
+- reg = <0x03021000 0x1000>,
+- <0x03022000 0x2000>,
+- <0x03024000 0x2000>,
+- <0x03026000 0x2000>;
+- interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+- interrupt-controller;
+- #interrupt-cells = <3>;
+- };
+-
+ pio: pinctrl@300b000 {
+ compatible = "allwinner,sun50i-h6-pinctrl";
+ reg = <0x0300b000 0x400>;
+@@ -149,6 +138,17 @@
+ };
+ };
+
++ gic: interrupt-controller@3021000 {
++ compatible = "arm,gic-400";
++ reg = <0x03021000 0x1000>,
++ <0x03022000 0x2000>,
++ <0x03024000 0x2000>,
++ <0x03026000 0x2000>;
++ interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
++ interrupt-controller;
++ #interrupt-cells = <3>;
++ };
++
+ mmc0: mmc@4020000 {
+ compatible = "allwinner,sun50i-h6-mmc",
+ "allwinner,sun50i-a64-mmc";
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+index 765247bc4f24..e14e0ce7e89f 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+@@ -125,6 +125,7 @@
+ status = "okay";
+ pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
+ pinctrl-names = "default";
++ hdmi-supply = <&hdmi_5v>;
+ };
+
+ &hdmi_tx_tmds_port {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+index 9d858eb193ca..062e12aa4677 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+@@ -76,6 +76,7 @@
+ status = "okay";
+ pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
+ pinctrl-names = "default";
++ hdmi-supply = <&hdmi_5v>;
+ };
+
+ &hdmi_tx_tmds_port {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+index b4dfb9afdef8..daad007fac1f 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+@@ -155,6 +155,7 @@
+ status = "okay";
+ pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
+ pinctrl-names = "default";
++ hdmi-supply = <&hdmi_5v>;
+ };
+
+ &hdmi_tx_tmds_port {
+@@ -255,7 +256,6 @@
+ cap-mmc-highspeed;
+ mmc-ddr-3_3v;
+ max-frequency = <50000000>;
+- non-removable;
+ disable-wp;
+
+ mmc-pwrseq = <&emmc_pwrseq>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts
+index 5896e8a5d86b..2602940c2077 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts
+@@ -51,6 +51,7 @@
+ status = "okay";
+ pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
+ pinctrl-names = "default";
++ hdmi-supply = <&hdmi_5v>;
+ };
+
+ &hdmi_tx_tmds_port {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+index 313f88f8759e..bdf7c6c5983c 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+@@ -18,7 +18,6 @@
+
+ aliases {
+ serial0 = &uart_AO;
+- serial1 = &uart_A;
+ serial2 = &uart_AO_B;
+ };
+
+@@ -63,11 +62,9 @@
+
+ gpio-keys-polled {
+ compatible = "gpio-keys-polled";
+- #address-cells = <1>;
+- #size-cells = <0>;
+ poll-interval = <100>;
+
+- button@0 {
++ power-button {
+ label = "power";
+ linux,code = <KEY_POWER>;
+ gpios = <&gpio_ao GPIOAO_2 GPIO_ACTIVE_LOW>;
+@@ -271,6 +268,7 @@
+ status = "okay";
+ pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
+ pinctrl-names = "default";
++ hdmi-supply = <&hdmi_5v>;
+ };
+
+ &hdmi_tx_tmds_port {
+@@ -408,8 +406,17 @@
+ /* This one is connected to the Bluetooth module */
+ &uart_A {
+ status = "okay";
+- pinctrl-0 = <&uart_a_pins>;
++ pinctrl-0 = <&uart_a_pins>, <&uart_a_cts_rts_pins>;
+ pinctrl-names = "default";
++ uart-has-rtscts;
++
++ bluetooth {
++ compatible = "brcm,bcm43438-bt";
++ shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>;
++ max-speed = <2000000>;
++ clocks = <&wifi32k>;
++ clock-names = "lpo";
++ };
+ };
+
+ /* This is brought out on the Linux_RX (18) and Linux_TX (19) pins: */
+diff --git a/arch/arm64/boot/dts/arm/juno-clocks.dtsi b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+index e5e265dfa902..2870b5eeb198 100644
+--- a/arch/arm64/boot/dts/arm/juno-clocks.dtsi
++++ b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+@@ -8,10 +8,10 @@
+ */
+ / {
+ /* SoC fixed clocks */
+- soc_uartclk: refclk7273800hz {
++ soc_uartclk: refclk7372800hz {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+- clock-frequency = <7273800>;
++ clock-frequency = <7372800>;
+ clock-output-names = "juno:uartclk";
+ };
+
+diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+index 78ce3979ef09..f38b815e696d 100644
+--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+@@ -630,6 +630,8 @@
+ l11 {
+ regulator-min-microvolt = <1750000>;
+ regulator-max-microvolt = <3337000>;
++ regulator-allow-set-load;
++ regulator-system-load = <200000>;
+ };
+
+ l12 {
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 7b32b8990d62..8011e564a234 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -114,7 +114,7 @@
+ next-level-cache = <&L2_0>;
+ enable-method = "psci";
+ cpu-idle-states = <&CPU_SPC>;
+- clocks = <&apcs 0>;
++ clocks = <&apcs>;
+ operating-points-v2 = <&cpu_opp_table>;
+ #cooling-cells = <2>;
+ };
+@@ -126,7 +126,7 @@
+ next-level-cache = <&L2_0>;
+ enable-method = "psci";
+ cpu-idle-states = <&CPU_SPC>;
+- clocks = <&apcs 0>;
++ clocks = <&apcs>;
+ operating-points-v2 = <&cpu_opp_table>;
+ #cooling-cells = <2>;
+ };
+@@ -138,7 +138,7 @@
+ next-level-cache = <&L2_0>;
+ enable-method = "psci";
+ cpu-idle-states = <&CPU_SPC>;
+- clocks = <&apcs 0>;
++ clocks = <&apcs>;
+ operating-points-v2 = <&cpu_opp_table>;
+ #cooling-cells = <2>;
+ };
+@@ -150,7 +150,7 @@
+ next-level-cache = <&L2_0>;
+ enable-method = "psci";
+ cpu-idle-states = <&CPU_SPC>;
+- clocks = <&apcs 0>;
++ clocks = <&apcs>;
+ operating-points-v2 = <&cpu_opp_table>;
+ #cooling-cells = <2>;
+ };
+diff --git a/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi b/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi
+index 7b2fbaec9aef..3dc61b7e1d08 100644
+--- a/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi
+@@ -28,6 +28,7 @@
+ compatible = "renesas,ipmmu-r8a7795";
+ reg = <0 0xec680000 0 0x1000>;
+ renesas,ipmmu-main = <&ipmmu_mm 5>;
++ power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
+ #iommu-cells = <1>;
+ };
+
+@@ -35,6 +36,7 @@
+ compatible = "renesas,ipmmu-r8a7795";
+ reg = <0 0xe7730000 0 0x1000>;
+ renesas,ipmmu-main = <&ipmmu_mm 8>;
++ power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
+ #iommu-cells = <1>;
+ };
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
+index 2bc3a4884b00..470c2a35a5af 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
+@@ -33,7 +33,6 @@
+ &avb {
+ pinctrl-0 = <&avb_pins>;
+ pinctrl-names = "default";
+- renesas,no-ether-link;
+ phy-handle = <&phy0>;
+ phy-mode = "rgmii-txid";
+ status = "okay";
+diff --git a/arch/arm64/boot/dts/renesas/r8a77995.dtsi b/arch/arm64/boot/dts/renesas/r8a77995.dtsi
+index fe77bc43c447..fb3ecb2c385d 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77995.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77995.dtsi
+@@ -938,7 +938,7 @@
+
+ du: display@feb00000 {
+ compatible = "renesas,du-r8a77995";
+- reg = <0 0xfeb00000 0 0x80000>;
++ reg = <0 0xfeb00000 0 0x40000>;
+ interrupts = <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 268 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cpg CPG_MOD 724>,
+diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
+index db8d364f8476..1a4f8b67bbe8 100644
+--- a/arch/arm64/configs/defconfig
++++ b/arch/arm64/configs/defconfig
+@@ -365,6 +365,7 @@ CONFIG_THERMAL_EMULATION=y
+ CONFIG_ROCKCHIP_THERMAL=m
+ CONFIG_RCAR_GEN3_THERMAL=y
+ CONFIG_ARMADA_THERMAL=y
++CONFIG_BCM2835_THERMAL=m
+ CONFIG_BRCMSTB_THERMAL=m
+ CONFIG_EXYNOS_THERMAL=y
+ CONFIG_TEGRA_BPMP_THERMAL=m
+diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
+index 9859e1178e6b..dbeeeffdb9c9 100644
+--- a/arch/arm64/kernel/hibernate.c
++++ b/arch/arm64/kernel/hibernate.c
+@@ -202,6 +202,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
+ gfp_t mask)
+ {
+ int rc = 0;
++ pgd_t *trans_pgd;
+ pgd_t *pgdp;
+ pud_t *pudp;
+ pmd_t *pmdp;
+@@ -216,7 +217,13 @@ static int create_safe_exec_page(void *src_start, size_t length,
+ memcpy((void *)dst, src_start, length);
+ __flush_icache_range(dst, dst + length);
+
+- pgdp = pgd_offset_raw(allocator(mask), dst_addr);
++ trans_pgd = allocator(mask);
++ if (!trans_pgd) {
++ rc = -ENOMEM;
++ goto out;
++ }
++
++ pgdp = pgd_offset_raw(trans_pgd, dst_addr);
+ if (pgd_none(READ_ONCE(*pgdp))) {
+ pudp = allocator(mask);
+ if (!pudp) {
+diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
+index ec0bb588d755..42b7082029e1 100644
+--- a/arch/arm64/kernel/vdso.c
++++ b/arch/arm64/kernel/vdso.c
+@@ -146,8 +146,6 @@ static int __init vdso_init(void)
+ }
+
+ vdso_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
+- pr_info("vdso: %ld pages (%ld code @ %p, %ld data @ %p)\n",
+- vdso_pages + 1, vdso_pages, vdso_start, 1L, vdso_data);
+
+ /* Allocate the vDSO pagelist, plus a page for the data. */
+ vdso_pagelist = kcalloc(vdso_pages + 1, sizeof(struct page *),
+diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
+index d1234a5ba4c5..9a960829a01d 100644
+--- a/arch/ia64/kernel/signal.c
++++ b/arch/ia64/kernel/signal.c
+@@ -110,7 +110,6 @@ ia64_rt_sigreturn (struct sigscratch *scr)
+ {
+ extern char ia64_strace_leave_kernel, ia64_leave_kernel;
+ struct sigcontext __user *sc;
+- struct siginfo si;
+ sigset_t set;
+ long retval;
+
+@@ -153,14 +152,7 @@ ia64_rt_sigreturn (struct sigscratch *scr)
+ return retval;
+
+ give_sigsegv:
+- clear_siginfo(&si);
+- si.si_signo = SIGSEGV;
+- si.si_errno = 0;
+- si.si_code = SI_KERNEL;
+- si.si_pid = task_pid_vnr(current);
+- si.si_uid = from_kuid_munged(current_user_ns(), current_uid());
+- si.si_addr = sc;
+- force_sig_info(SIGSEGV, &si, current);
++ force_sig(SIGSEGV, current);
+ return retval;
+ }
+
+@@ -231,37 +223,6 @@ rbs_on_sig_stack (unsigned long bsp)
+ return (bsp - current->sas_ss_sp < current->sas_ss_size);
+ }
+
+-static long
+-force_sigsegv_info (int sig, void __user *addr)
+-{
+- unsigned long flags;
+- struct siginfo si;
+-
+- clear_siginfo(&si);
+- if (sig == SIGSEGV) {
+- /*
+- * Acquiring siglock around the sa_handler-update is almost
+- * certainly overkill, but this isn't a
+- * performance-critical path and I'd rather play it safe
+- * here than having to debug a nasty race if and when
+- * something changes in kernel/signal.c that would make it
+- * no longer safe to modify sa_handler without holding the
+- * lock.
+- */
+- spin_lock_irqsave(¤t->sighand->siglock, flags);
+- current->sighand->action[sig - 1].sa.sa_handler = SIG_DFL;
+- spin_unlock_irqrestore(¤t->sighand->siglock, flags);
+- }
+- si.si_signo = SIGSEGV;
+- si.si_errno = 0;
+- si.si_code = SI_KERNEL;
+- si.si_pid = task_pid_vnr(current);
+- si.si_uid = from_kuid_munged(current_user_ns(), current_uid());
+- si.si_addr = addr;
+- force_sig_info(SIGSEGV, &si, current);
+- return 1;
+-}
+-
+ static long
+ setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
+ {
+@@ -295,15 +256,18 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
+ * instead so we will die with SIGSEGV.
+ */
+ check_sp = (new_sp - sizeof(*frame)) & -STACK_ALIGN;
+- if (!likely(on_sig_stack(check_sp)))
+- return force_sigsegv_info(ksig->sig, (void __user *)
+- check_sp);
++ if (!likely(on_sig_stack(check_sp))) {
++ force_sigsegv(ksig->sig, current);
++ return 1;
++ }
+ }
+ }
+ frame = (void __user *) ((new_sp - sizeof(*frame)) & -STACK_ALIGN);
+
+- if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
+- return force_sigsegv_info(ksig->sig, frame);
++ if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame))) {
++ force_sigsegv(ksig->sig, current);
++ return 1;
++ }
+
+ err = __put_user(ksig->sig, &frame->arg0);
+ err |= __put_user(&frame->info, &frame->arg1);
+@@ -317,8 +281,10 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
+ err |= __save_altstack(&frame->sc.sc_stack, scr->pt.r12);
+ err |= setup_sigcontext(&frame->sc, set, scr);
+
+- if (unlikely(err))
+- return force_sigsegv_info(ksig->sig, frame);
++ if (unlikely(err)) {
++ force_sigsegv(ksig->sig, current);
++ return 1;
++ }
+
+ scr->pt.r12 = (unsigned long) frame - 16; /* new stack pointer */
+ scr->pt.ar_fpsr = FPSR_DEFAULT; /* reset fpsr for signal handler */
+diff --git a/arch/m68k/amiga/cia.c b/arch/m68k/amiga/cia.c
+index 2081b8cd5591..b9aee983e6f4 100644
+--- a/arch/m68k/amiga/cia.c
++++ b/arch/m68k/amiga/cia.c
+@@ -88,10 +88,19 @@ static irqreturn_t cia_handler(int irq, void *dev_id)
+ struct ciabase *base = dev_id;
+ int mach_irq;
+ unsigned char ints;
++ unsigned long flags;
+
++ /* Interrupts get disabled while the timer irq flag is cleared and
++ * the timer interrupt serviced.
++ */
+ mach_irq = base->cia_irq;
++ local_irq_save(flags);
+ ints = cia_set_irq(base, CIA_ICR_ALL);
+ amiga_custom.intreq = base->int_mask;
++ if (ints & 1)
++ generic_handle_irq(mach_irq);
++ local_irq_restore(flags);
++ mach_irq++, ints >>= 1;
+ for (; ints; mach_irq++, ints >>= 1) {
+ if (ints & 1)
+ generic_handle_irq(mach_irq);
+diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c
+index 3d2b63bedf05..56f02ea2c248 100644
+--- a/arch/m68k/atari/ataints.c
++++ b/arch/m68k/atari/ataints.c
+@@ -142,7 +142,7 @@ struct mfptimerbase {
+ .name = "MFP Timer D"
+ };
+
+-static irqreturn_t mfptimer_handler(int irq, void *dev_id)
++static irqreturn_t mfp_timer_d_handler(int irq, void *dev_id)
+ {
+ struct mfptimerbase *base = dev_id;
+ int mach_irq;
+@@ -344,7 +344,7 @@ void __init atari_init_IRQ(void)
+ st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 0xf0) | 0x6;
+
+ /* request timer D dispatch handler */
+- if (request_irq(IRQ_MFP_TIMD, mfptimer_handler, IRQF_SHARED,
++ if (request_irq(IRQ_MFP_TIMD, mfp_timer_d_handler, IRQF_SHARED,
+ stmfp_base.name, &stmfp_base))
+ pr_err("Couldn't register %s interrupt\n", stmfp_base.name);
+
+diff --git a/arch/m68k/atari/time.c b/arch/m68k/atari/time.c
+index 9cca64286464..fafa20f75ab9 100644
+--- a/arch/m68k/atari/time.c
++++ b/arch/m68k/atari/time.c
+@@ -24,6 +24,18 @@
+ DEFINE_SPINLOCK(rtc_lock);
+ EXPORT_SYMBOL_GPL(rtc_lock);
+
++static irqreturn_t mfp_timer_c_handler(int irq, void *dev_id)
++{
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
++
++ local_irq_save(flags);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
++ return IRQ_HANDLED;
++}
++
+ void __init
+ atari_sched_init(irq_handler_t timer_routine)
+ {
+@@ -32,7 +44,8 @@ atari_sched_init(irq_handler_t timer_routine)
+ /* start timer C, div = 1:100 */
+ st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 15) | 0x60;
+ /* install interrupt service routine for MFP Timer C */
+- if (request_irq(IRQ_MFP_TIMC, timer_routine, 0, "timer", timer_routine))
++ if (request_irq(IRQ_MFP_TIMC, mfp_timer_c_handler, 0, "timer",
++ timer_routine))
+ pr_err("Couldn't register timer interrupt\n");
+ }
+
+diff --git a/arch/m68k/bvme6000/config.c b/arch/m68k/bvme6000/config.c
+index 143ee9fa3893..0e5efed4da86 100644
+--- a/arch/m68k/bvme6000/config.c
++++ b/arch/m68k/bvme6000/config.c
+@@ -44,11 +44,6 @@ extern int bvme6000_hwclk (int, struct rtc_time *);
+ extern void bvme6000_reset (void);
+ void bvme6000_set_vectors (void);
+
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/timer/timekeeping.c, called via bvme6000_process_int() */
+-
+-static irq_handler_t tick_handler;
+-
+
+ int __init bvme6000_parse_bootinfo(const struct bi_record *bi)
+ {
+@@ -157,12 +152,18 @@ irqreturn_t bvme6000_abort_int (int irq, void *dev_id)
+
+ static irqreturn_t bvme6000_timer_int (int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
+ volatile RtcPtr_t rtc = (RtcPtr_t)BVME_RTC_BASE;
+- unsigned char msr = rtc->msr & 0xc0;
++ unsigned char msr;
+
++ local_irq_save(flags);
++ msr = rtc->msr & 0xc0;
+ rtc->msr = msr | 0x20; /* Ack the interrupt */
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
+
+- return tick_handler(irq, dev_id);
++ return IRQ_HANDLED;
+ }
+
+ /*
+@@ -181,9 +182,8 @@ void bvme6000_sched_init (irq_handler_t timer_routine)
+
+ rtc->msr = 0; /* Ensure timer registers accessible */
+
+- tick_handler = timer_routine;
+- if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0,
+- "timer", bvme6000_timer_int))
++ if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0, "timer",
++ timer_routine))
+ panic ("Couldn't register timer int");
+
+ rtc->t1cr_omr = 0x04; /* Mode 2, ext clk */
+diff --git a/arch/m68k/hp300/time.c b/arch/m68k/hp300/time.c
+index 289d928a46cb..d30b03ea93a2 100644
+--- a/arch/m68k/hp300/time.c
++++ b/arch/m68k/hp300/time.c
+@@ -38,13 +38,19 @@
+
+ static irqreturn_t hp300_tick(int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
+ unsigned long tmp;
+- irq_handler_t vector = dev_id;
++
++ local_irq_save(flags);
+ in_8(CLOCKBASE + CLKSR);
+ asm volatile ("movpw %1@(5),%0" : "=d" (tmp) : "a" (CLOCKBASE));
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
+ /* Turn off the network and SCSI leds */
+ blinken_leds(0, 0xe0);
+- return vector(irq, NULL);
++ return IRQ_HANDLED;
+ }
+
+ u32 hp300_gettimeoffset(void)
+diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
+index acdabbeecfd2..038d5a1c4d48 100644
+--- a/arch/m68k/mac/via.c
++++ b/arch/m68k/mac/via.c
+@@ -54,16 +54,6 @@ static __u8 rbv_clear;
+
+ static int gIER,gIFR,gBufA,gBufB;
+
+-/*
+- * Timer defs.
+- */
+-
+-#define TICK_SIZE 10000
+-#define MAC_CLOCK_TICK (783300/HZ) /* ticks per HZ */
+-#define MAC_CLOCK_LOW (MAC_CLOCK_TICK&0xFF)
+-#define MAC_CLOCK_HIGH (MAC_CLOCK_TICK>>8)
+-
+-
+ /*
+ * On Macs with a genuine VIA chip there is no way to mask an individual slot
+ * interrupt. This limitation also seems to apply to VIA clone logic cores in
+@@ -267,22 +257,6 @@ void __init via_init(void)
+ }
+ }
+
+-/*
+- * Start the 100 Hz clock
+- */
+-
+-void __init via_init_clock(irq_handler_t func)
+-{
+- via1[vACR] |= 0x40;
+- via1[vT1LL] = MAC_CLOCK_LOW;
+- via1[vT1LH] = MAC_CLOCK_HIGH;
+- via1[vT1CL] = MAC_CLOCK_LOW;
+- via1[vT1CH] = MAC_CLOCK_HIGH;
+-
+- if (request_irq(IRQ_MAC_TIMER_1, func, 0, "timer", func))
+- pr_err("Couldn't register %s interrupt\n", "timer");
+-}
+-
+ /*
+ * Debugging dump, used in various places to see what's going on.
+ */
+@@ -310,29 +284,6 @@ void via_debug_dump(void)
+ }
+ }
+
+-/*
+- * This is always executed with interrupts disabled.
+- *
+- * TBI: get time offset between scheduling timer ticks
+- */
+-
+-u32 mac_gettimeoffset(void)
+-{
+- unsigned long ticks, offset = 0;
+-
+- /* read VIA1 timer 2 current value */
+- ticks = via1[vT1CL] | (via1[vT1CH] << 8);
+- /* The probability of underflow is less than 2% */
+- if (ticks > MAC_CLOCK_TICK - MAC_CLOCK_TICK / 50)
+- /* Check for pending timer interrupt in VIA1 IFR */
+- if (via1[vIFR] & 0x40) offset = TICK_SIZE;
+-
+- ticks = MAC_CLOCK_TICK - ticks;
+- ticks = ticks * 10000L / MAC_CLOCK_TICK;
+-
+- return (ticks + offset) * 1000;
+-}
+-
+ /*
+ * Flush the L2 cache on Macs that have it by flipping
+ * the system into 24-bit mode for an instant.
+@@ -436,6 +387,8 @@ void via_nubus_irq_shutdown(int irq)
+ * via6522.c :-), disable/pending masks added.
+ */
+
++#define VIA_TIMER_1_INT BIT(6)
++
+ void via1_irq(struct irq_desc *desc)
+ {
+ int irq_num;
+@@ -445,6 +398,21 @@ void via1_irq(struct irq_desc *desc)
+ if (!events)
+ return;
+
++ irq_num = IRQ_MAC_TIMER_1;
++ irq_bit = VIA_TIMER_1_INT;
++ if (events & irq_bit) {
++ unsigned long flags;
++
++ local_irq_save(flags);
++ via1[vIFR] = irq_bit;
++ generic_handle_irq(irq_num);
++ local_irq_restore(flags);
++
++ events &= ~irq_bit;
++ if (!events)
++ return;
++ }
++
+ irq_num = VIA1_SOURCE_BASE;
+ irq_bit = 1;
+ do {
+@@ -601,3 +569,56 @@ int via2_scsi_drq_pending(void)
+ return via2[gIFR] & (1 << IRQ_IDX(IRQ_MAC_SCSIDRQ));
+ }
+ EXPORT_SYMBOL(via2_scsi_drq_pending);
++
++/* timer and clock source */
++
++#define VIA_CLOCK_FREQ 783360 /* VIA "phase 2" clock in Hz */
++#define VIA_TIMER_INTERVAL (1000000 / HZ) /* microseconds per jiffy */
++#define VIA_TIMER_CYCLES (VIA_CLOCK_FREQ / HZ) /* clock cycles per jiffy */
++
++#define VIA_TC (VIA_TIMER_CYCLES - 2) /* including 0 and -1 */
++#define VIA_TC_LOW (VIA_TC & 0xFF)
++#define VIA_TC_HIGH (VIA_TC >> 8)
++
++void __init via_init_clock(irq_handler_t timer_routine)
++{
++ if (request_irq(IRQ_MAC_TIMER_1, timer_routine, 0, "timer", NULL)) {
++ pr_err("Couldn't register %s interrupt\n", "timer");
++ return;
++ }
++
++ via1[vT1LL] = VIA_TC_LOW;
++ via1[vT1LH] = VIA_TC_HIGH;
++ via1[vT1CL] = VIA_TC_LOW;
++ via1[vT1CH] = VIA_TC_HIGH;
++ via1[vACR] |= 0x40;
++}
++
++u32 mac_gettimeoffset(void)
++{
++ unsigned long flags;
++ u8 count_high;
++ u16 count, offset = 0;
++
++ /*
++ * Timer counter wrap-around is detected with the timer interrupt flag
++ * but reading the counter low byte (vT1CL) would reset the flag.
++ * Also, accessing both counter registers is essentially a data race.
++ * These problems are avoided by ignoring the low byte. Clock accuracy
++ * is 256 times worse (error can reach 0.327 ms) but CPU overhead is
++ * reduced by avoiding slow VIA register accesses.
++ */
++
++ local_irq_save(flags);
++ count_high = via1[vT1CH];
++ if (count_high == 0xFF)
++ count_high = 0;
++ if (count_high > 0 && (via1[vIFR] & VIA_TIMER_1_INT))
++ offset = VIA_TIMER_CYCLES;
++ local_irq_restore(flags);
++
++ count = count_high << 8;
++ count = VIA_TIMER_CYCLES - count + offset;
++
++ return ((count * VIA_TIMER_INTERVAL) / VIA_TIMER_CYCLES) * 1000;
++}
+diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
+index adea549d240e..93c68d2b8e0e 100644
+--- a/arch/m68k/mvme147/config.c
++++ b/arch/m68k/mvme147/config.c
+@@ -45,11 +45,6 @@ extern void mvme147_reset (void);
+
+ static int bcd2int (unsigned char b);
+
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/time/timekeeping.c, called via mvme147_process_int() */
+-
+-irq_handler_t tick_handler;
+-
+
+ int __init mvme147_parse_bootinfo(const struct bi_record *bi)
+ {
+@@ -104,16 +99,23 @@ void __init config_mvme147(void)
+
+ static irqreturn_t mvme147_timer_int (int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
++
++ local_irq_save(flags);
+ m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR;
+ m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1;
+- return tick_handler(irq, dev_id);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
++ return IRQ_HANDLED;
+ }
+
+
+ void mvme147_sched_init (irq_handler_t timer_routine)
+ {
+- tick_handler = timer_routine;
+- if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1", NULL))
++ if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1",
++ timer_routine))
+ pr_err("Couldn't register timer interrupt\n");
+
+ /* Init the clock with a value */
+diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
+index 6ee36a5b528d..5feb3ab484d0 100644
+--- a/arch/m68k/mvme16x/config.c
++++ b/arch/m68k/mvme16x/config.c
+@@ -50,11 +50,6 @@ extern void mvme16x_reset (void);
+
+ int bcd2int (unsigned char b);
+
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/time/timekeeping.c, called via mvme16x_process_int() */
+-
+-static irq_handler_t tick_handler;
+-
+
+ unsigned short mvme16x_config;
+ EXPORT_SYMBOL(mvme16x_config);
+@@ -352,8 +347,15 @@ static irqreturn_t mvme16x_abort_int (int irq, void *dev_id)
+
+ static irqreturn_t mvme16x_timer_int (int irq, void *dev_id)
+ {
+- *(volatile unsigned char *)0xfff4201b |= 8;
+- return tick_handler(irq, dev_id);
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
++
++ local_irq_save(flags);
++ *(volatile unsigned char *)0xfff4201b |= 8;
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
++ return IRQ_HANDLED;
+ }
+
+ void mvme16x_sched_init (irq_handler_t timer_routine)
+@@ -361,14 +363,13 @@ void mvme16x_sched_init (irq_handler_t timer_routine)
+ uint16_t brdno = be16_to_cpu(mvme_bdid.brdno);
+ int irq;
+
+- tick_handler = timer_routine;
+ /* Using PCCchip2 or MC2 chip tick timer 1 */
+ *(volatile unsigned long *)0xfff42008 = 0;
+ *(volatile unsigned long *)0xfff42004 = 10000; /* 10ms */
+ *(volatile unsigned char *)0xfff42017 |= 3;
+ *(volatile unsigned char *)0xfff4201b = 0x16;
+- if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0,
+- "timer", mvme16x_timer_int))
++ if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0, "timer",
++ timer_routine))
+ panic ("Couldn't register timer int");
+
+ if (brdno == 0x0162 || brdno == 0x172)
+diff --git a/arch/m68k/q40/q40ints.c b/arch/m68k/q40/q40ints.c
+index 3e7603202977..1c696906c159 100644
+--- a/arch/m68k/q40/q40ints.c
++++ b/arch/m68k/q40/q40ints.c
+@@ -127,10 +127,10 @@ void q40_mksound(unsigned int hz, unsigned int ticks)
+ sound_ticks = ticks << 1;
+ }
+
+-static irq_handler_t q40_timer_routine;
+-
+-static irqreturn_t q40_timer_int (int irq, void * dev)
++static irqreturn_t q40_timer_int(int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++
+ ql_ticks = ql_ticks ? 0 : 1;
+ if (sound_ticks) {
+ unsigned char sval=(sound_ticks & 1) ? 128-SVOL : 128+SVOL;
+@@ -139,8 +139,13 @@ static irqreturn_t q40_timer_int (int irq, void * dev)
+ *DAC_RIGHT=sval;
+ }
+
+- if (!ql_ticks)
+- q40_timer_routine(irq, dev);
++ if (!ql_ticks) {
++ unsigned long flags;
++
++ local_irq_save(flags);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++ }
+ return IRQ_HANDLED;
+ }
+
+@@ -148,11 +153,9 @@ void q40_sched_init (irq_handler_t timer_routine)
+ {
+ int timer_irq;
+
+- q40_timer_routine = timer_routine;
+ timer_irq = Q40_IRQ_FRAME;
+
+- if (request_irq(timer_irq, q40_timer_int, 0,
+- "timer", q40_timer_int))
++ if (request_irq(timer_irq, q40_timer_int, 0, "timer", timer_routine))
+ panic("Couldn't register timer int");
+
+ master_outb(-1, FRAME_CLEAR_REG);
+diff --git a/arch/m68k/sun3/sun3ints.c b/arch/m68k/sun3/sun3ints.c
+index 6bbca30c9188..a5824abb4a39 100644
+--- a/arch/m68k/sun3/sun3ints.c
++++ b/arch/m68k/sun3/sun3ints.c
+@@ -61,8 +61,10 @@ static irqreturn_t sun3_int7(int irq, void *dev_id)
+
+ static irqreturn_t sun3_int5(int irq, void *dev_id)
+ {
++ unsigned long flags;
+ unsigned int cnt;
+
++ local_irq_save(flags);
+ #ifdef CONFIG_SUN3
+ intersil_clear();
+ #endif
+@@ -76,6 +78,7 @@ static irqreturn_t sun3_int5(int irq, void *dev_id)
+ cnt = kstat_irqs_cpu(irq, 0);
+ if (!(cnt % 20))
+ sun3_leds(led_pattern[cnt % 160 / 20]);
++ local_irq_restore(flags);
+ return IRQ_HANDLED;
+ }
+
+diff --git a/arch/m68k/sun3x/time.c b/arch/m68k/sun3x/time.c
+index 047e2bcee3d7..3c8a86d08508 100644
+--- a/arch/m68k/sun3x/time.c
++++ b/arch/m68k/sun3x/time.c
+@@ -80,15 +80,19 @@ u32 sun3x_gettimeoffset(void)
+ }
+
+ #if 0
+-static void sun3x_timer_tick(int irq, void *dev_id, struct pt_regs *regs)
++static irqreturn_t sun3x_timer_tick(int irq, void *dev_id)
+ {
+- void (*vector)(int, void *, struct pt_regs *) = dev_id;
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
+
+- /* Clear the pending interrupt - pulse the enable line low */
+- disable_irq(5);
+- enable_irq(5);
++ local_irq_save(flags);
++ /* Clear the pending interrupt - pulse the enable line low */
++ disable_irq(5);
++ enable_irq(5);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
+
+- vector(irq, NULL, regs);
++ return IRQ_HANDLED;
+ }
+ #endif
+
+diff --git a/arch/mips/bcm63xx/Makefile b/arch/mips/bcm63xx/Makefile
+index c69f297fc1df..d89651e538f6 100644
+--- a/arch/mips/bcm63xx/Makefile
++++ b/arch/mips/bcm63xx/Makefile
+@@ -1,8 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-y += clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
+- setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
+- dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
+- dev-wdt.o dev-usb-usbd.o
++ setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
++ dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
++ dev-usb-usbd.o
+ obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
+
+ obj-y += boards/
+diff --git a/arch/mips/bcm63xx/boards/board_bcm963xx.c b/arch/mips/bcm63xx/boards/board_bcm963xx.c
+index b2097c0d2ed7..36ec3dc2c999 100644
+--- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
++++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
+@@ -23,7 +23,6 @@
+ #include <bcm63xx_nvram.h>
+ #include <bcm63xx_dev_pci.h>
+ #include <bcm63xx_dev_enet.h>
+-#include <bcm63xx_dev_dsp.h>
+ #include <bcm63xx_dev_flash.h>
+ #include <bcm63xx_dev_hsspi.h>
+ #include <bcm63xx_dev_pcmcia.h>
+@@ -289,14 +288,6 @@ static struct board_info __initdata board_96348gw_10 = {
+ .has_pccard = 1,
+ .has_ehci0 = 1,
+
+- .has_dsp = 1,
+- .dsp = {
+- .gpio_rst = 6,
+- .gpio_int = 34,
+- .cs = 2,
+- .ext_irq = 2,
+- },
+-
+ .leds = {
+ {
+ .name = "adsl-fail",
+@@ -401,14 +392,6 @@ static struct board_info __initdata board_96348gw = {
+
+ .has_ohci0 = 1,
+
+- .has_dsp = 1,
+- .dsp = {
+- .gpio_rst = 6,
+- .gpio_int = 34,
+- .ext_irq = 2,
+- .cs = 2,
+- },
+-
+ .leds = {
+ {
+ .name = "adsl-fail",
+@@ -898,9 +881,6 @@ int __init board_register_devices(void)
+ if (board.has_usbd)
+ bcm63xx_usbd_register(&board.usbd);
+
+- if (board.has_dsp)
+- bcm63xx_dsp_register(&board.dsp);
+-
+ /* Generate MAC address for WLAN and register our SPROM,
+ * do this after registering enet devices
+ */
+diff --git a/arch/mips/bcm63xx/dev-dsp.c b/arch/mips/bcm63xx/dev-dsp.c
+deleted file mode 100644
+index 5bb5b154c9bd..000000000000
+--- a/arch/mips/bcm63xx/dev-dsp.c
++++ /dev/null
+@@ -1,56 +0,0 @@
+-/*
+- * Broadcom BCM63xx VoIP DSP registration
+- *
+- * This file is subject to the terms and conditions of the GNU General Public
+- * License. See the file "COPYING" in the main directory of this archive
+- * for more details.
+- *
+- * Copyright (C) 2009 Florian Fainelli <florian@openwrt.org>
+- */
+-
+-#include <linux/init.h>
+-#include <linux/kernel.h>
+-#include <linux/platform_device.h>
+-
+-#include <bcm63xx_cpu.h>
+-#include <bcm63xx_dev_dsp.h>
+-#include <bcm63xx_regs.h>
+-#include <bcm63xx_io.h>
+-
+-static struct resource voip_dsp_resources[] = {
+- {
+- .start = -1, /* filled at runtime */
+- .end = -1, /* filled at runtime */
+- .flags = IORESOURCE_MEM,
+- },
+- {
+- .start = -1, /* filled at runtime */
+- .flags = IORESOURCE_IRQ,
+- },
+-};
+-
+-static struct platform_device bcm63xx_voip_dsp_device = {
+- .name = "bcm63xx-voip-dsp",
+- .id = -1,
+- .num_resources = ARRAY_SIZE(voip_dsp_resources),
+- .resource = voip_dsp_resources,
+-};
+-
+-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd)
+-{
+- struct bcm63xx_dsp_platform_data *dpd;
+- u32 val;
+-
+- /* Get the memory window */
+- val = bcm_mpi_readl(MPI_CSBASE_REG(pd->cs - 1));
+- val &= MPI_CSBASE_BASE_MASK;
+- voip_dsp_resources[0].start = val;
+- voip_dsp_resources[0].end = val + 0xFFFFFFF;
+- voip_dsp_resources[1].start = pd->ext_irq;
+-
+- /* copy given platform data */
+- dpd = bcm63xx_voip_dsp_device.dev.platform_data;
+- memcpy(dpd, pd, sizeof (*pd));
+-
+- return platform_device_register(&bcm63xx_voip_dsp_device);
+-}
+diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
+index 54c730aed327..df1eaa365279 100644
+--- a/arch/mips/include/asm/io.h
++++ b/arch/mips/include/asm/io.h
+@@ -62,21 +62,11 @@
+ * instruction, so the lower 16 bits must be zero. Should be true on
+ * on any sane architecture; generic code does not use this assumption.
+ */
+-extern const unsigned long mips_io_port_base;
++extern unsigned long mips_io_port_base;
+
+-/*
+- * Gcc will generate code to load the value of mips_io_port_base after each
+- * function call which may be fairly wasteful in some cases. So we don't
+- * play quite by the book. We tell gcc mips_io_port_base is a long variable
+- * which solves the code generation issue. Now we need to violate the
+- * aliasing rules a little to make initialization possible and finally we
+- * will need the barrier() to fight side effects of the aliasing chat.
+- * This trickery will eventually collapse under gcc's optimizer. Oh well.
+- */
+ static inline void set_io_port_base(unsigned long base)
+ {
+- * (unsigned long *) &mips_io_port_base = base;
+- barrier();
++ mips_io_port_base = base;
+ }
+
+ /*
+diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
+deleted file mode 100644
+index 4e4970787371..000000000000
+--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
++++ /dev/null
+@@ -1,14 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef __BCM63XX_DSP_H
+-#define __BCM63XX_DSP_H
+-
+-struct bcm63xx_dsp_platform_data {
+- unsigned gpio_rst;
+- unsigned gpio_int;
+- unsigned cs;
+- unsigned ext_irq;
+-};
+-
+-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd);
+-
+-#endif /* __BCM63XX_DSP_H */
+diff --git a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+index 5e5b1bc4a324..830f53f28e3f 100644
+--- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
++++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+@@ -7,7 +7,6 @@
+ #include <linux/leds.h>
+ #include <bcm63xx_dev_enet.h>
+ #include <bcm63xx_dev_usb_usbd.h>
+-#include <bcm63xx_dev_dsp.h>
+
+ /*
+ * flash mapping
+@@ -31,7 +30,6 @@ struct board_info {
+ unsigned int has_ohci0:1;
+ unsigned int has_ehci0:1;
+ unsigned int has_usbd:1;
+- unsigned int has_dsp:1;
+ unsigned int has_uart0:1;
+ unsigned int has_uart1:1;
+
+@@ -43,9 +41,6 @@ struct board_info {
+ /* USB config */
+ struct bcm63xx_usbd_platform_data usbd;
+
+- /* DSP config */
+- struct bcm63xx_dsp_platform_data dsp;
+-
+ /* GPIO LEDs */
+ struct gpio_led leds[5];
+
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index 8aaaa42f91ed..e87c98b8a72c 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -76,7 +76,7 @@ static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
+ * mips_io_port_base is the begin of the address space to which x86 style
+ * I/O ports are mapped.
+ */
+-const unsigned long mips_io_port_base = -1;
++unsigned long mips_io_port_base = -1;
+ EXPORT_SYMBOL(mips_io_port_base);
+
+ static struct resource code_resource = { .name = "Kernel code", };
+diff --git a/arch/nios2/kernel/nios2_ksyms.c b/arch/nios2/kernel/nios2_ksyms.c
+index bf2f55d10a4d..4e704046a150 100644
+--- a/arch/nios2/kernel/nios2_ksyms.c
++++ b/arch/nios2/kernel/nios2_ksyms.c
+@@ -9,12 +9,20 @@
+ #include <linux/export.h>
+ #include <linux/string.h>
+
++#include <asm/cacheflush.h>
++#include <asm/pgtable.h>
++
+ /* string functions */
+
+ EXPORT_SYMBOL(memcpy);
+ EXPORT_SYMBOL(memset);
+ EXPORT_SYMBOL(memmove);
+
++/* memory management */
++
++EXPORT_SYMBOL(empty_zero_page);
++EXPORT_SYMBOL(flush_icache_range);
++
+ /*
+ * libgcc functions - functions that are used internally by the
+ * compiler... (prototypes are not correct though, but that
+@@ -31,3 +39,7 @@ DECLARE_EXPORT(__udivsi3);
+ DECLARE_EXPORT(__umoddi3);
+ DECLARE_EXPORT(__umodsi3);
+ DECLARE_EXPORT(__muldi3);
++DECLARE_EXPORT(__ucmpdi2);
++DECLARE_EXPORT(__lshrdi3);
++DECLARE_EXPORT(__ashldi3);
++DECLARE_EXPORT(__ashrdi3);
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index e43321f46a3b..8954108df457 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -412,7 +412,9 @@ vdso_install:
+ ifdef CONFIG_PPC64
+ $(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso64 $@
+ endif
++ifdef CONFIG_VDSO32
+ $(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso32 $@
++endif
+
+ archclean:
+ $(Q)$(MAKE) $(clean)=$(boot)
+diff --git a/arch/powerpc/include/asm/archrandom.h b/arch/powerpc/include/asm/archrandom.h
+index 9c63b596e6ce..a09595f00cab 100644
+--- a/arch/powerpc/include/asm/archrandom.h
++++ b/arch/powerpc/include/asm/archrandom.h
+@@ -28,7 +28,7 @@ static inline int arch_get_random_seed_int(unsigned int *v)
+ unsigned long val;
+ int rc;
+
+- rc = arch_get_random_long(&val);
++ rc = arch_get_random_seed_long(&val);
+ if (rc)
+ *v = val;
+
+diff --git a/arch/powerpc/include/asm/kgdb.h b/arch/powerpc/include/asm/kgdb.h
+index 9db24e77b9f4..a9e098a3b881 100644
+--- a/arch/powerpc/include/asm/kgdb.h
++++ b/arch/powerpc/include/asm/kgdb.h
+@@ -26,9 +26,12 @@
+ #define BREAK_INSTR_SIZE 4
+ #define BUFMAX ((NUMREGBYTES * 2) + 512)
+ #define OUTBUFMAX ((NUMREGBYTES * 2) + 512)
++
++#define BREAK_INSTR 0x7d821008 /* twge r2, r2 */
++
+ static inline void arch_kgdb_breakpoint(void)
+ {
+- asm(".long 0x7d821008"); /* twge r2, r2 */
++ asm(stringify_in_c(.long BREAK_INSTR));
+ }
+ #define CACHE_FLUSH_IS_SAFE 1
+ #define DBG_MAX_REG_NUM 70
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index a8f20e5928e1..9edb45430133 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -865,4 +865,25 @@ void cacheinfo_cpu_offline(unsigned int cpu_id)
+ if (cache)
+ cache_cpu_clear(cache, cpu_id);
+ }
++
++void cacheinfo_teardown(void)
++{
++ unsigned int cpu;
++
++ lockdep_assert_cpus_held();
++
++ for_each_online_cpu(cpu)
++ cacheinfo_cpu_offline(cpu);
++}
++
++void cacheinfo_rebuild(void)
++{
++ unsigned int cpu;
++
++ lockdep_assert_cpus_held();
++
++ for_each_online_cpu(cpu)
++ cacheinfo_cpu_online(cpu);
++}
++
+ #endif /* (CONFIG_PPC_PSERIES && CONFIG_SUSPEND) || CONFIG_HOTPLUG_CPU */
+diff --git a/arch/powerpc/kernel/cacheinfo.h b/arch/powerpc/kernel/cacheinfo.h
+index 955f5e999f1b..52bd3fc6642d 100644
+--- a/arch/powerpc/kernel/cacheinfo.h
++++ b/arch/powerpc/kernel/cacheinfo.h
+@@ -6,4 +6,8 @@
+ extern void cacheinfo_cpu_online(unsigned int cpu_id);
+ extern void cacheinfo_cpu_offline(unsigned int cpu_id);
+
++/* Allow migration/suspend to tear down and rebuild the hierarchy. */
++extern void cacheinfo_teardown(void);
++extern void cacheinfo_rebuild(void);
++
+ #endif /* _PPC_CACHEINFO_H */
+diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
+index c6f41907f0d7..a4b31e17492d 100644
+--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
+@@ -666,8 +666,10 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
+ m = &dt_cpu_feature_match_table[i];
+ if (!strcmp(f->name, m->name)) {
+ known = true;
+- if (m->enable(f))
++ if (m->enable(f)) {
++ cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask;
+ break;
++ }
+
+ pr_info("not enabling: %s (disabled or unsupported by kernel)\n",
+ f->name);
+@@ -675,17 +677,12 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
+ }
+ }
+
+- if (!known && enable_unknown) {
+- if (!feat_try_enable_unknown(f)) {
+- pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
+- f->name);
+- return false;
+- }
++ if (!known && (!enable_unknown || !feat_try_enable_unknown(f))) {
++ pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
++ f->name);
++ return false;
+ }
+
+- if (m->cpu_ftr_bit_mask)
+- cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask;
+-
+ if (known)
+ pr_debug("enabling: %s\n", f->name);
+ else
+diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
+index 35e240a0a408..59c578f865aa 100644
+--- a/arch/powerpc/kernel/kgdb.c
++++ b/arch/powerpc/kernel/kgdb.c
+@@ -24,6 +24,7 @@
+ #include <asm/processor.h>
+ #include <asm/machdep.h>
+ #include <asm/debug.h>
++#include <asm/code-patching.h>
+ #include <linux/slab.h>
+
+ /*
+@@ -144,7 +145,7 @@ static int kgdb_handle_breakpoint(struct pt_regs *regs)
+ if (kgdb_handle_exception(1, SIGTRAP, 0, regs) != 0)
+ return 0;
+
+- if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
++ if (*(u32 *)regs->nip == BREAK_INSTR)
+ regs->nip += BREAK_INSTR_SIZE;
+
+ return 1;
+@@ -441,16 +442,42 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
+ return -1;
+ }
+
++int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
++{
++ int err;
++ unsigned int instr;
++ unsigned int *addr = (unsigned int *)bpt->bpt_addr;
++
++ err = probe_kernel_address(addr, instr);
++ if (err)
++ return err;
++
++ err = patch_instruction(addr, BREAK_INSTR);
++ if (err)
++ return -EFAULT;
++
++ *(unsigned int *)bpt->saved_instr = instr;
++
++ return 0;
++}
++
++int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
++{
++ int err;
++ unsigned int instr = *(unsigned int *)bpt->saved_instr;
++ unsigned int *addr = (unsigned int *)bpt->bpt_addr;
++
++ err = patch_instruction(addr, instr);
++ if (err)
++ return -EFAULT;
++
++ return 0;
++}
++
+ /*
+ * Global data
+ */
+-struct kgdb_arch arch_kgdb_ops = {
+-#ifdef __LITTLE_ENDIAN__
+- .gdb_bpt_instr = {0x08, 0x10, 0x82, 0x7d},
+-#else
+- .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
+-#endif
+-};
++struct kgdb_arch arch_kgdb_ops;
+
+ static int kgdb_not_implemented(struct pt_regs *regs)
+ {
+diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
+index 37a110b8e7e1..ecb375040637 100644
+--- a/arch/powerpc/kernel/mce_power.c
++++ b/arch/powerpc/kernel/mce_power.c
+@@ -40,7 +40,7 @@ static unsigned long addr_to_pfn(struct pt_regs *regs, unsigned long addr)
+ {
+ pte_t *ptep;
+ unsigned int shift;
+- unsigned long flags;
++ unsigned long pfn, flags;
+ struct mm_struct *mm;
+
+ if (user_mode(regs))
+@@ -50,18 +50,22 @@ static unsigned long addr_to_pfn(struct pt_regs *regs, unsigned long addr)
+
+ local_irq_save(flags);
+ ptep = __find_linux_pte(mm->pgd, addr, NULL, &shift);
+- local_irq_restore(flags);
+
+- if (!ptep || pte_special(*ptep))
+- return ULONG_MAX;
++ if (!ptep || pte_special(*ptep)) {
++ pfn = ULONG_MAX;
++ goto out;
++ }
+
+- if (shift > PAGE_SHIFT) {
++ if (shift <= PAGE_SHIFT)
++ pfn = pte_pfn(*ptep);
++ else {
+ unsigned long rpnmask = (1ul << shift) - PAGE_SIZE;
+-
+- return pte_pfn(__pte(pte_val(*ptep) | (addr & rpnmask)));
++ pfn = pte_pfn(__pte(pte_val(*ptep) | (addr & rpnmask)));
+ }
+
+- return pte_pfn(*ptep);
++out:
++ local_irq_restore(flags);
++ return pfn;
+ }
+
+ /* flush SLBs and reload */
+diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
+index 9b38a2e5dd35..af1e38febe49 100644
+--- a/arch/powerpc/kernel/prom_init.c
++++ b/arch/powerpc/kernel/prom_init.c
+@@ -904,7 +904,7 @@ struct ibm_arch_vec __cacheline_aligned ibm_architecture_vec = {
+ .reserved2 = 0,
+ .reserved3 = 0,
+ .subprocessors = 1,
+- .byte22 = OV5_FEAT(OV5_DRMEM_V2),
++ .byte22 = OV5_FEAT(OV5_DRMEM_V2) | OV5_FEAT(OV5_DRC_INFO),
+ .intarch = 0,
+ .mmu = 0,
+ .hash_ext = 0,
+diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
+index 65486c3d029b..26b03af71abd 100644
+--- a/arch/powerpc/kvm/book3s_64_vio.c
++++ b/arch/powerpc/kvm/book3s_64_vio.c
+@@ -133,7 +133,6 @@ extern void kvm_spapr_tce_release_iommu_group(struct kvm *kvm,
+ continue;
+
+ kref_put(&stit->kref, kvm_spapr_tce_liobn_put);
+- return;
+ }
+ }
+ }
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 3ae3e8d141e3..dbfe32327212 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -2993,25 +2993,26 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
+ }
+ }
+
+- /*
+- * Interrupts will be enabled once we get into the guest,
+- * so tell lockdep that we're about to enable interrupts.
+- */
+- trace_hardirqs_on();
+-
+ guest_enter_irqoff();
+
+ srcu_idx = srcu_read_lock(&vc->kvm->srcu);
+
+ this_cpu_disable_ftrace();
+
++ /*
++ * Interrupts will be enabled once we get into the guest,
++ * so tell lockdep that we're about to enable interrupts.
++ */
++ trace_hardirqs_on();
++
+ trap = __kvmppc_vcore_entry();
+
++ trace_hardirqs_off();
++
+ this_cpu_enable_ftrace();
+
+ srcu_read_unlock(&vc->kvm->srcu, srcu_idx);
+
+- trace_hardirqs_off();
+ set_irq_happened(trap);
+
+ spin_lock(&vc->lock);
+diff --git a/arch/powerpc/mm/dump_hashpagetable.c b/arch/powerpc/mm/dump_hashpagetable.c
+index 869294695048..b430e4e08af6 100644
+--- a/arch/powerpc/mm/dump_hashpagetable.c
++++ b/arch/powerpc/mm/dump_hashpagetable.c
+@@ -342,7 +342,7 @@ static unsigned long hpte_find(struct pg_state *st, unsigned long ea, int psize)
+
+ /* Look in secondary table */
+ if (slot == -1)
+- slot = base_hpte_find(ea, psize, true, &v, &r);
++ slot = base_hpte_find(ea, psize, false, &v, &r);
+
+ /* No entry found */
+ if (slot == -1)
+diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
+index 69caeb5bccb2..5404a631d583 100644
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -717,8 +717,8 @@ static int __meminit stop_machine_change_mapping(void *data)
+
+ spin_unlock(&init_mm.page_table_lock);
+ pte_clear(&init_mm, params->aligned_start, params->pte);
+- create_physical_mapping(params->aligned_start, params->start, -1);
+- create_physical_mapping(params->end, params->aligned_end, -1);
++ create_physical_mapping(__pa(params->aligned_start), __pa(params->start), -1);
++ create_physical_mapping(__pa(params->end), __pa(params->aligned_end), -1);
+ spin_lock(&init_mm.page_table_lock);
+ return 0;
+ }
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index 7f86bc3eaade..62d3c72cd931 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -101,11 +101,12 @@ static struct property *dlpar_clone_property(struct property *prop,
+ return new_prop;
+ }
+
+-static u32 find_aa_index(struct device_node *dr_node,
+- struct property *ala_prop, const u32 *lmb_assoc)
++static bool find_aa_index(struct device_node *dr_node,
++ struct property *ala_prop,
++ const u32 *lmb_assoc, u32 *aa_index)
+ {
+- u32 *assoc_arrays;
+- u32 aa_index;
++ u32 *assoc_arrays, new_prop_size;
++ struct property *new_prop;
+ int aa_arrays, aa_array_entries, aa_array_sz;
+ int i, index;
+
+@@ -121,46 +122,39 @@ static u32 find_aa_index(struct device_node *dr_node,
+ aa_array_entries = be32_to_cpu(assoc_arrays[1]);
+ aa_array_sz = aa_array_entries * sizeof(u32);
+
+- aa_index = -1;
+ for (i = 0; i < aa_arrays; i++) {
+ index = (i * aa_array_entries) + 2;
+
+ if (memcmp(&assoc_arrays[index], &lmb_assoc[1], aa_array_sz))
+ continue;
+
+- aa_index = i;
+- break;
++ *aa_index = i;
++ return true;
+ }
+
+- if (aa_index == -1) {
+- struct property *new_prop;
+- u32 new_prop_size;
+-
+- new_prop_size = ala_prop->length + aa_array_sz;
+- new_prop = dlpar_clone_property(ala_prop, new_prop_size);
+- if (!new_prop)
+- return -1;
+-
+- assoc_arrays = new_prop->value;
++ new_prop_size = ala_prop->length + aa_array_sz;
++ new_prop = dlpar_clone_property(ala_prop, new_prop_size);
++ if (!new_prop)
++ return false;
+
+- /* increment the number of entries in the lookup array */
+- assoc_arrays[0] = cpu_to_be32(aa_arrays + 1);
++ assoc_arrays = new_prop->value;
+
+- /* copy the new associativity into the lookup array */
+- index = aa_arrays * aa_array_entries + 2;
+- memcpy(&assoc_arrays[index], &lmb_assoc[1], aa_array_sz);
++ /* increment the number of entries in the lookup array */
++ assoc_arrays[0] = cpu_to_be32(aa_arrays + 1);
+
+- of_update_property(dr_node, new_prop);
++ /* copy the new associativity into the lookup array */
++ index = aa_arrays * aa_array_entries + 2;
++ memcpy(&assoc_arrays[index], &lmb_assoc[1], aa_array_sz);
+
+- /*
+- * The associativity lookup array index for this lmb is
+- * number of entries - 1 since we added its associativity
+- * to the end of the lookup array.
+- */
+- aa_index = be32_to_cpu(assoc_arrays[0]) - 1;
+- }
++ of_update_property(dr_node, new_prop);
+
+- return aa_index;
++ /*
++ * The associativity lookup array index for this lmb is
++ * number of entries - 1 since we added its associativity
++ * to the end of the lookup array.
++ */
++ *aa_index = be32_to_cpu(assoc_arrays[0]) - 1;
++ return true;
+ }
+
+ static int update_lmb_associativity_index(struct drmem_lmb *lmb)
+@@ -169,6 +163,7 @@ static int update_lmb_associativity_index(struct drmem_lmb *lmb)
+ struct property *ala_prop;
+ const u32 *lmb_assoc;
+ u32 aa_index;
++ bool found;
+
+ parent = of_find_node_by_path("/");
+ if (!parent)
+@@ -200,12 +195,12 @@ static int update_lmb_associativity_index(struct drmem_lmb *lmb)
+ return -ENODEV;
+ }
+
+- aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc);
++ found = find_aa_index(dr_node, ala_prop, lmb_assoc, &aa_index);
+
+ of_node_put(dr_node);
+ dlpar_free_cc_nodes(lmb_node);
+
+- if (aa_index < 0) {
++ if (!found) {
+ pr_err("Could not find LMB associativity\n");
+ return -1;
+ }
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index e4ea71383383..70744b4fbd9e 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -24,6 +24,7 @@
+ #include <asm/machdep.h>
+ #include <asm/rtas.h>
+ #include "pseries.h"
++#include "../../kernel/cacheinfo.h"
+
+ static struct kobject *mobility_kobj;
+
+@@ -360,11 +361,20 @@ void post_mobility_fixup(void)
+ */
+ cpus_read_lock();
+
++ /*
++ * It's common for the destination firmware to replace cache
++ * nodes. Release all of the cacheinfo hierarchy's references
++ * before updating the device tree.
++ */
++ cacheinfo_teardown();
++
+ rc = pseries_devicetree_update(MIGRATION_SCOPE);
+ if (rc)
+ printk(KERN_ERR "Post-mobility device tree update "
+ "failed: %d\n", rc);
+
++ cacheinfo_rebuild();
++
+ cpus_read_unlock();
+
+ /* Possibly switch to a new RFI flush type */
+diff --git a/arch/s390/kernel/kexec_elf.c b/arch/s390/kernel/kexec_elf.c
+index 602e7cc26d11..5cf340b778f1 100644
+--- a/arch/s390/kernel/kexec_elf.c
++++ b/arch/s390/kernel/kexec_elf.c
+@@ -58,7 +58,7 @@ static int kexec_file_add_elf_kernel(struct kimage *image,
+ if (ret)
+ return ret;
+
+- data->memsz += buf.memsz;
++ data->memsz = ALIGN(data->memsz, phdr->p_align) + buf.memsz;
+ }
+
+ return 0;
+diff --git a/arch/sh/boards/mach-migor/setup.c b/arch/sh/boards/mach-migor/setup.c
+index 254f2c662703..6cd3cd468047 100644
+--- a/arch/sh/boards/mach-migor/setup.c
++++ b/arch/sh/boards/mach-migor/setup.c
+@@ -5,6 +5,7 @@
+ * Copyright (C) 2008 Magnus Damm
+ */
+ #include <linux/clkdev.h>
++#include <linux/dma-mapping.h>
+ #include <linux/init.h>
+ #include <linux/platform_device.h>
+ #include <linux/interrupt.h>
+diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
+index 05588f9466c7..13ba195f9c9c 100644
+--- a/arch/um/drivers/chan_kern.c
++++ b/arch/um/drivers/chan_kern.c
+@@ -171,19 +171,55 @@ int enable_chan(struct line *line)
+ return err;
+ }
+
++/* Items are added in IRQ context, when free_irq can't be called, and
++ * removed in process context, when it can.
++ * This handles interrupt sources which disappear, and which need to
++ * be permanently disabled. This is discovered in IRQ context, but
++ * the freeing of the IRQ must be done later.
++ */
++static DEFINE_SPINLOCK(irqs_to_free_lock);
++static LIST_HEAD(irqs_to_free);
++
++void free_irqs(void)
++{
++ struct chan *chan;
++ LIST_HEAD(list);
++ struct list_head *ele;
++ unsigned long flags;
++
++ spin_lock_irqsave(&irqs_to_free_lock, flags);
++ list_splice_init(&irqs_to_free, &list);
++ spin_unlock_irqrestore(&irqs_to_free_lock, flags);
++
++ list_for_each(ele, &list) {
++ chan = list_entry(ele, struct chan, free_list);
++
++ if (chan->input && chan->enabled)
++ um_free_irq(chan->line->driver->read_irq, chan);
++ if (chan->output && chan->enabled)
++ um_free_irq(chan->line->driver->write_irq, chan);
++ chan->enabled = 0;
++ }
++}
++
+ static void close_one_chan(struct chan *chan, int delay_free_irq)
+ {
++ unsigned long flags;
++
+ if (!chan->opened)
+ return;
+
+- /* we can safely call free now - it will be marked
+- * as free and freed once the IRQ stopped processing
+- */
+- if (chan->input && chan->enabled)
+- um_free_irq(chan->line->driver->read_irq, chan);
+- if (chan->output && chan->enabled)
+- um_free_irq(chan->line->driver->write_irq, chan);
+- chan->enabled = 0;
++ if (delay_free_irq) {
++ spin_lock_irqsave(&irqs_to_free_lock, flags);
++ list_add(&chan->free_list, &irqs_to_free);
++ spin_unlock_irqrestore(&irqs_to_free_lock, flags);
++ } else {
++ if (chan->input && chan->enabled)
++ um_free_irq(chan->line->driver->read_irq, chan);
++ if (chan->output && chan->enabled)
++ um_free_irq(chan->line->driver->write_irq, chan);
++ chan->enabled = 0;
++ }
+ if (chan->ops->close != NULL)
+ (*chan->ops->close)(chan->fd, chan->data);
+
+diff --git a/arch/um/include/asm/irq.h b/arch/um/include/asm/irq.h
+index 49ed3e35b35a..ce7a78c3bcf2 100644
+--- a/arch/um/include/asm/irq.h
++++ b/arch/um/include/asm/irq.h
+@@ -23,7 +23,7 @@
+ #define VECTOR_BASE_IRQ 15
+ #define VECTOR_IRQ_SPACE 8
+
+-#define LAST_IRQ (VECTOR_IRQ_SPACE + VECTOR_BASE_IRQ)
++#define LAST_IRQ (VECTOR_IRQ_SPACE + VECTOR_BASE_IRQ - 1)
+
+ #else
+
+diff --git a/arch/um/kernel/irq.c b/arch/um/kernel/irq.c
+index 6b7f3827d6e4..2753718d31b9 100644
+--- a/arch/um/kernel/irq.c
++++ b/arch/um/kernel/irq.c
+@@ -21,6 +21,8 @@
+ #include <irq_user.h>
+
+
++extern void free_irqs(void);
++
+ /* When epoll triggers we do not know why it did so
+ * we can also have different IRQs for read and write.
+ * This is why we keep a small irq_fd array for each fd -
+@@ -100,6 +102,8 @@ void sigio_handler(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs)
+ }
+ }
+ }
++
++ free_irqs();
+ }
+
+ static int assign_epoll_events_to_irq(struct irq_entry *irq_entry)
+diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
+index 7d68f0c7cfb1..687cd1a213d5 100644
+--- a/arch/x86/Kconfig.debug
++++ b/arch/x86/Kconfig.debug
+@@ -181,7 +181,7 @@ config HAVE_MMIOTRACE_SUPPORT
+
+ config X86_DECODER_SELFTEST
+ bool "x86 instruction decoder selftest"
+- depends on DEBUG_KERNEL && KPROBES
++ depends on DEBUG_KERNEL && INSTRUCTION_DECODER
+ depends on !COMPILE_TEST
+ ---help---
+ Perform x86 instruction decoder selftests at build time.
+diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
+index 8f4c98fdd03c..f03100bc5fd1 100644
+--- a/arch/x86/events/intel/pt.c
++++ b/arch/x86/events/intel/pt.c
+@@ -1213,7 +1213,8 @@ static int pt_event_addr_filters_validate(struct list_head *filters)
+ static void pt_event_addr_filters_sync(struct perf_event *event)
+ {
+ struct perf_addr_filters_head *head = perf_event_addr_filters(event);
+- unsigned long msr_a, msr_b, *offs = event->addr_filters_offs;
++ unsigned long msr_a, msr_b;
++ struct perf_addr_filter_range *fr = event->addr_filter_ranges;
+ struct pt_filters *filters = event->hw.addr_filters;
+ struct perf_addr_filter *filter;
+ int range = 0;
+@@ -1222,12 +1223,12 @@ static void pt_event_addr_filters_sync(struct perf_event *event)
+ return;
+
+ list_for_each_entry(filter, &head->list, entry) {
+- if (filter->path.dentry && !offs[range]) {
++ if (filter->path.dentry && !fr[range].start) {
+ msr_a = msr_b = 0;
+ } else {
+ /* apply the offset */
+- msr_a = filter->offset + offs[range];
+- msr_b = filter->size + msr_a - 1;
++ msr_a = fr[range].start;
++ msr_b = msr_a + fr[range].size - 1;
+ }
+
+ filters->filter[range].msr_a = msr_a;
+diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
+index b3ec519e3982..71e1df860176 100644
+--- a/arch/x86/include/asm/pgtable_32.h
++++ b/arch/x86/include/asm/pgtable_32.h
+@@ -106,6 +106,6 @@ do { \
+ * with only a host target support using a 32-bit type for internal
+ * representation.
+ */
+-#define LOWMEM_PAGES ((((2<<31) - __PAGE_OFFSET) >> PAGE_SHIFT))
++#define LOWMEM_PAGES ((((_ULL(2)<<31) - __PAGE_OFFSET) >> PAGE_SHIFT))
+
+ #endif /* _ASM_X86_PGTABLE_32_H */
+diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
+index 8e36f249646e..904e18bb38c5 100644
+--- a/arch/x86/kernel/kgdb.c
++++ b/arch/x86/kernel/kgdb.c
+@@ -438,7 +438,7 @@ static void kgdb_disable_hw_debug(struct pt_regs *regs)
+ */
+ void kgdb_roundup_cpus(unsigned long flags)
+ {
+- apic->send_IPI_allbutself(APIC_DM_NMI);
++ apic->send_IPI_allbutself(NMI_VECTOR);
+ }
+ #endif
+
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index a6836ab0fcc7..b72296bd04a2 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -664,9 +664,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
+ * that UV should be updated so that smp_call_function_many(),
+ * etc, are optimal on UV.
+ */
+- unsigned int cpu;
+-
+- cpu = smp_processor_id();
+ cpumask = uv_flush_tlb_others(cpumask, info);
+ if (cpumask)
+ smp_call_function_many(cpumask, flush_tlb_func_remote,
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 2776ee6c5c3d..7efa8c3e2b72 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -309,13 +309,7 @@ void blk_recalc_rq_segments(struct request *rq)
+
+ void blk_recount_segments(struct request_queue *q, struct bio *bio)
+ {
+- unsigned short seg_cnt;
+-
+- /* estimate segment number by bi_vcnt for non-cloned bio */
+- if (bio_flagged(bio, BIO_CLONED))
+- seg_cnt = bio_segments(bio);
+- else
+- seg_cnt = bio->bi_vcnt;
++ unsigned short seg_cnt = bio_segments(bio);
+
+ if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags) &&
+ (seg_cnt < queue_max_segments(q)))
+diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
+index f8ec3d4ba4a8..a5718c0a3dc4 100644
+--- a/crypto/pcrypt.c
++++ b/crypto/pcrypt.c
+@@ -394,7 +394,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
+ int ret;
+
+ pinst->kobj.kset = pcrypt_kset;
+- ret = kobject_add(&pinst->kobj, NULL, name);
++ ret = kobject_add(&pinst->kobj, NULL, "%s", name);
+ if (!ret)
+ kobject_uevent(&pinst->kobj, KOBJ_ADD);
+
+diff --git a/crypto/tgr192.c b/crypto/tgr192.c
+index 022d3dd76c3b..f8e1d9f9938f 100644
+--- a/crypto/tgr192.c
++++ b/crypto/tgr192.c
+@@ -25,8 +25,9 @@
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/mm.h>
+-#include <asm/byteorder.h>
+ #include <linux/types.h>
++#include <asm/byteorder.h>
++#include <asm/unaligned.h>
+
+ #define TGR192_DIGEST_SIZE 24
+ #define TGR160_DIGEST_SIZE 20
+@@ -468,10 +469,9 @@ static void tgr192_transform(struct tgr192_ctx *tctx, const u8 * data)
+ u64 a, b, c, aa, bb, cc;
+ u64 x[8];
+ int i;
+- const __le64 *ptr = (const __le64 *)data;
+
+ for (i = 0; i < 8; i++)
+- x[i] = le64_to_cpu(ptr[i]);
++ x[i] = get_unaligned_le64(data + i * sizeof(__le64));
+
+ /* save */
+ a = aa = tctx->a;
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 30ccd94f87d2..ded6c5c17fd7 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -1056,6 +1056,13 @@ static int acpi_lpss_suspend_noirq(struct device *dev)
+ int ret;
+
+ if (pdata->dev_desc->resume_from_noirq) {
++ /*
++ * The driver's ->suspend_late callback will be invoked by
++ * acpi_lpss_do_suspend_late(), with the assumption that the
++ * driver really wanted to run that code in ->suspend_noirq, but
++ * it could not run after acpi_dev_suspend() and the driver
++ * expected the latter to be called in the "late" phase.
++ */
+ ret = acpi_lpss_do_suspend_late(dev);
+ if (ret)
+ return ret;
+@@ -1086,16 +1093,99 @@ static int acpi_lpss_resume_noirq(struct device *dev)
+ struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
+ int ret;
+
+- ret = acpi_subsys_resume_noirq(dev);
++ /* Follow acpi_subsys_resume_noirq(). */
++ if (dev_pm_may_skip_resume(dev))
++ return 0;
++
++ if (dev_pm_smart_suspend_and_suspended(dev))
++ pm_runtime_set_active(dev);
++
++ ret = pm_generic_resume_noirq(dev);
+ if (ret)
+ return ret;
+
+- if (!dev_pm_may_skip_resume(dev) && pdata->dev_desc->resume_from_noirq)
+- ret = acpi_lpss_do_resume_early(dev);
++ if (!pdata->dev_desc->resume_from_noirq)
++ return 0;
+
+- return ret;
++ /*
++ * The driver's ->resume_early callback will be invoked by
++ * acpi_lpss_do_resume_early(), with the assumption that the driver
++ * really wanted to run that code in ->resume_noirq, but it could not
++ * run before acpi_dev_resume() and the driver expected the latter to be
++ * called in the "early" phase.
++ */
++ return acpi_lpss_do_resume_early(dev);
++}
++
++static int acpi_lpss_do_restore_early(struct device *dev)
++{
++ int ret = acpi_lpss_resume(dev);
++
++ return ret ? ret : pm_generic_restore_early(dev);
+ }
+
++static int acpi_lpss_restore_early(struct device *dev)
++{
++ struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++
++ if (pdata->dev_desc->resume_from_noirq)
++ return 0;
++
++ return acpi_lpss_do_restore_early(dev);
++}
++
++static int acpi_lpss_restore_noirq(struct device *dev)
++{
++ struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++ int ret;
++
++ ret = pm_generic_restore_noirq(dev);
++ if (ret)
++ return ret;
++
++ if (!pdata->dev_desc->resume_from_noirq)
++ return 0;
++
++ /* This is analogous to what happens in acpi_lpss_resume_noirq(). */
++ return acpi_lpss_do_restore_early(dev);
++}
++
++static int acpi_lpss_do_poweroff_late(struct device *dev)
++{
++ int ret = pm_generic_poweroff_late(dev);
++
++ return ret ? ret : acpi_lpss_suspend(dev, device_may_wakeup(dev));
++}
++
++static int acpi_lpss_poweroff_late(struct device *dev)
++{
++ struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++
++ if (dev_pm_smart_suspend_and_suspended(dev))
++ return 0;
++
++ if (pdata->dev_desc->resume_from_noirq)
++ return 0;
++
++ return acpi_lpss_do_poweroff_late(dev);
++}
++
++static int acpi_lpss_poweroff_noirq(struct device *dev)
++{
++ struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++
++ if (dev_pm_smart_suspend_and_suspended(dev))
++ return 0;
++
++ if (pdata->dev_desc->resume_from_noirq) {
++ /* This is analogous to the acpi_lpss_suspend_noirq() case. */
++ int ret = acpi_lpss_do_poweroff_late(dev);
++ if (ret)
++ return ret;
++ }
++
++ return pm_generic_poweroff_noirq(dev);
++}
+ #endif /* CONFIG_PM_SLEEP */
+
+ static int acpi_lpss_runtime_suspend(struct device *dev)
+@@ -1129,14 +1219,11 @@ static struct dev_pm_domain acpi_lpss_pm_domain = {
+ .resume_noirq = acpi_lpss_resume_noirq,
+ .resume_early = acpi_lpss_resume_early,
+ .freeze = acpi_subsys_freeze,
+- .freeze_late = acpi_subsys_freeze_late,
+- .freeze_noirq = acpi_subsys_freeze_noirq,
+- .thaw_noirq = acpi_subsys_thaw_noirq,
+- .poweroff = acpi_subsys_suspend,
+- .poweroff_late = acpi_lpss_suspend_late,
+- .poweroff_noirq = acpi_lpss_suspend_noirq,
+- .restore_noirq = acpi_lpss_resume_noirq,
+- .restore_early = acpi_lpss_resume_early,
++ .poweroff = acpi_subsys_poweroff,
++ .poweroff_late = acpi_lpss_poweroff_late,
++ .poweroff_noirq = acpi_lpss_poweroff_noirq,
++ .restore_noirq = acpi_lpss_restore_noirq,
++ .restore_early = acpi_lpss_restore_early,
+ #endif
+ .runtime_suspend = acpi_lpss_runtime_suspend,
+ .runtime_resume = acpi_lpss_runtime_resume,
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index 870eb5c7516a..a25d77b3a16a 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -467,8 +467,11 @@ static int acpi_button_resume(struct device *dev)
+ struct acpi_button *button = acpi_driver_data(device);
+
+ button->suspended = false;
+- if (button->type == ACPI_BUTTON_TYPE_LID && button->input->users)
++ if (button->type == ACPI_BUTTON_TYPE_LID && button->input->users) {
++ button->last_state = !!acpi_lid_evaluate_state(device);
++ button->last_time = ktime_get();
+ acpi_lid_initialize_state(device);
++ }
+ return 0;
+ }
+ #endif
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index e0927c5fd282..54b6547d32b2 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -1077,7 +1077,7 @@ EXPORT_SYMBOL_GPL(acpi_subsys_suspend_noirq);
+ * acpi_subsys_resume_noirq - Run the device driver's "noirq" resume callback.
+ * @dev: Device to handle.
+ */
+-int acpi_subsys_resume_noirq(struct device *dev)
++static int acpi_subsys_resume_noirq(struct device *dev)
+ {
+ if (dev_pm_may_skip_resume(dev))
+ return 0;
+@@ -1092,7 +1092,6 @@ int acpi_subsys_resume_noirq(struct device *dev)
+
+ return pm_generic_resume_noirq(dev);
+ }
+-EXPORT_SYMBOL_GPL(acpi_subsys_resume_noirq);
+
+ /**
+ * acpi_subsys_resume_early - Resume device using ACPI.
+@@ -1102,12 +1101,11 @@ EXPORT_SYMBOL_GPL(acpi_subsys_resume_noirq);
+ * generic early resume procedure for it during system transition into the
+ * working state.
+ */
+-int acpi_subsys_resume_early(struct device *dev)
++static int acpi_subsys_resume_early(struct device *dev)
+ {
+ int ret = acpi_dev_resume(dev);
+ return ret ? ret : pm_generic_resume_early(dev);
+ }
+-EXPORT_SYMBOL_GPL(acpi_subsys_resume_early);
+
+ /**
+ * acpi_subsys_freeze - Run the device driver's freeze callback.
+@@ -1116,65 +1114,81 @@ EXPORT_SYMBOL_GPL(acpi_subsys_resume_early);
+ int acpi_subsys_freeze(struct device *dev)
+ {
+ /*
+- * This used to be done in acpi_subsys_prepare() for all devices and
+- * some drivers may depend on it, so do it here. Ideally, however,
+- * runtime-suspended devices should not be touched during freeze/thaw
+- * transitions.
++ * Resume all runtime-suspended devices before creating a snapshot
++ * image of system memory, because the restore kernel generally cannot
++ * be expected to always handle them consistently and they need to be
++ * put into the runtime-active metastate during system resume anyway,
++ * so it is better to ensure that the state saved in the image will be
++ * always consistent with that.
+ */
+- if (!dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND))
+- pm_runtime_resume(dev);
++ pm_runtime_resume(dev);
+
+ return pm_generic_freeze(dev);
+ }
+ EXPORT_SYMBOL_GPL(acpi_subsys_freeze);
+
+ /**
+- * acpi_subsys_freeze_late - Run the device driver's "late" freeze callback.
+- * @dev: Device to handle.
++ * acpi_subsys_restore_early - Restore device using ACPI.
++ * @dev: Device to restore.
+ */
+-int acpi_subsys_freeze_late(struct device *dev)
++int acpi_subsys_restore_early(struct device *dev)
+ {
++ int ret = acpi_dev_resume(dev);
++ return ret ? ret : pm_generic_restore_early(dev);
++}
++EXPORT_SYMBOL_GPL(acpi_subsys_restore_early);
+
+- if (dev_pm_smart_suspend_and_suspended(dev))
+- return 0;
++/**
++ * acpi_subsys_poweroff - Run the device driver's poweroff callback.
++ * @dev: Device to handle.
++ *
++ * Follow PCI and resume devices from runtime suspend before running their
++ * system poweroff callbacks, unless the driver can cope with runtime-suspended
++ * devices during system suspend and there are no ACPI-specific reasons for
++ * resuming them.
++ */
++int acpi_subsys_poweroff(struct device *dev)
++{
++ if (!dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND) ||
++ acpi_dev_needs_resume(dev, ACPI_COMPANION(dev)))
++ pm_runtime_resume(dev);
+
+- return pm_generic_freeze_late(dev);
++ return pm_generic_poweroff(dev);
+ }
+-EXPORT_SYMBOL_GPL(acpi_subsys_freeze_late);
++EXPORT_SYMBOL_GPL(acpi_subsys_poweroff);
+
+ /**
+- * acpi_subsys_freeze_noirq - Run the device driver's "noirq" freeze callback.
++ * acpi_subsys_poweroff_late - Run the device driver's poweroff callback.
+ * @dev: Device to handle.
++ *
++ * Carry out the generic late poweroff procedure for @dev and use ACPI to put
++ * it into a low-power state during system transition into a sleep state.
+ */
+-int acpi_subsys_freeze_noirq(struct device *dev)
++static int acpi_subsys_poweroff_late(struct device *dev)
+ {
++ int ret;
+
+ if (dev_pm_smart_suspend_and_suspended(dev))
+ return 0;
+
+- return pm_generic_freeze_noirq(dev);
++ ret = pm_generic_poweroff_late(dev);
++ if (ret)
++ return ret;
++
++ return acpi_dev_suspend(dev, device_may_wakeup(dev));
+ }
+-EXPORT_SYMBOL_GPL(acpi_subsys_freeze_noirq);
+
+ /**
+- * acpi_subsys_thaw_noirq - Run the device driver's "noirq" thaw callback.
+- * @dev: Device to handle.
++ * acpi_subsys_poweroff_noirq - Run the driver's "noirq" poweroff callback.
++ * @dev: Device to suspend.
+ */
+-int acpi_subsys_thaw_noirq(struct device *dev)
++static int acpi_subsys_poweroff_noirq(struct device *dev)
+ {
+- /*
+- * If the device is in runtime suspend, the "thaw" code may not work
+- * correctly with it, so skip the driver callback and make the PM core
+- * skip all of the subsequent "thaw" callbacks for the device.
+- */
+- if (dev_pm_smart_suspend_and_suspended(dev)) {
+- dev_pm_skip_next_resume_phases(dev);
++ if (dev_pm_smart_suspend_and_suspended(dev))
+ return 0;
+- }
+
+- return pm_generic_thaw_noirq(dev);
++ return pm_generic_poweroff_noirq(dev);
+ }
+-EXPORT_SYMBOL_GPL(acpi_subsys_thaw_noirq);
+ #endif /* CONFIG_PM_SLEEP */
+
+ static struct dev_pm_domain acpi_general_pm_domain = {
+@@ -1190,14 +1204,10 @@ static struct dev_pm_domain acpi_general_pm_domain = {
+ .resume_noirq = acpi_subsys_resume_noirq,
+ .resume_early = acpi_subsys_resume_early,
+ .freeze = acpi_subsys_freeze,
+- .freeze_late = acpi_subsys_freeze_late,
+- .freeze_noirq = acpi_subsys_freeze_noirq,
+- .thaw_noirq = acpi_subsys_thaw_noirq,
+- .poweroff = acpi_subsys_suspend,
+- .poweroff_late = acpi_subsys_suspend_late,
+- .poweroff_noirq = acpi_subsys_suspend_noirq,
+- .restore_noirq = acpi_subsys_resume_noirq,
+- .restore_early = acpi_subsys_resume_early,
++ .poweroff = acpi_subsys_poweroff,
++ .poweroff_late = acpi_subsys_poweroff_late,
++ .poweroff_noirq = acpi_subsys_poweroff_noirq,
++ .restore_early = acpi_subsys_restore_early,
+ #endif
+ },
+ };
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index b5f57c69c487..2bdb250a2142 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -191,7 +191,6 @@ struct ata_port_operations ahci_pmp_retry_srst_ops = {
+ EXPORT_SYMBOL_GPL(ahci_pmp_retry_srst_ops);
+
+ static bool ahci_em_messages __read_mostly = true;
+-EXPORT_SYMBOL_GPL(ahci_em_messages);
+ module_param(ahci_em_messages, bool, 0444);
+ /* add other LED protocol types when they become supported */
+ MODULE_PARM_DESC(ahci_em_messages,
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 985ccced33a2..742bc60e9cca 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -179,10 +179,14 @@ void device_pm_move_to_tail(struct device *dev)
+ * of the link. If DL_FLAG_PM_RUNTIME is not set, DL_FLAG_RPM_ACTIVE will be
+ * ignored.
+ *
+- * If the DL_FLAG_AUTOREMOVE_CONSUMER is set, the link will be removed
+- * automatically when the consumer device driver unbinds from it.
+- * The combination of both DL_FLAG_AUTOREMOVE_CONSUMER and DL_FLAG_STATELESS
+- * set is invalid and will cause NULL to be returned.
++ * If the DL_FLAG_AUTOREMOVE_CONSUMER flag is set, the link will be removed
++ * automatically when the consumer device driver unbinds from it. Analogously,
++ * if DL_FLAG_AUTOREMOVE_SUPPLIER is set in @flags, the link will be removed
++ * automatically when the supplier device driver unbinds from it.
++ *
++ * The combination of DL_FLAG_STATELESS and either DL_FLAG_AUTOREMOVE_CONSUMER
++ * or DL_FLAG_AUTOREMOVE_SUPPLIER set in @flags at the same time is invalid and
++ * will cause NULL to be returned upfront.
+ *
+ * A side effect of the link creation is re-ordering of dpm_list and the
+ * devices_kset list by moving the consumer device and all devices depending
+@@ -199,10 +203,17 @@ struct device_link *device_link_add(struct device *consumer,
+ struct device_link *link;
+
+ if (!consumer || !supplier ||
+- ((flags & DL_FLAG_STATELESS) &&
+- (flags & DL_FLAG_AUTOREMOVE_CONSUMER)))
++ (flags & DL_FLAG_STATELESS &&
++ flags & (DL_FLAG_AUTOREMOVE_CONSUMER | DL_FLAG_AUTOREMOVE_SUPPLIER)))
+ return NULL;
+
++ if (flags & DL_FLAG_PM_RUNTIME && flags & DL_FLAG_RPM_ACTIVE) {
++ if (pm_runtime_get_sync(supplier) < 0) {
++ pm_runtime_put_noidle(supplier);
++ return NULL;
++ }
++ }
++
+ device_links_write_lock();
+ device_pm_lock();
+
+@@ -217,35 +228,51 @@ struct device_link *device_link_add(struct device *consumer,
+ goto out;
+ }
+
+- list_for_each_entry(link, &supplier->links.consumers, s_node)
+- if (link->consumer == consumer) {
+- kref_get(&link->kref);
++ list_for_each_entry(link, &supplier->links.consumers, s_node) {
++ if (link->consumer != consumer)
++ continue;
++
++ /*
++ * Don't return a stateless link if the caller wants a stateful
++ * one and vice versa.
++ */
++ if (WARN_ON((flags & DL_FLAG_STATELESS) != (link->flags & DL_FLAG_STATELESS))) {
++ link = NULL;
+ goto out;
+ }
+
++ if (flags & DL_FLAG_AUTOREMOVE_CONSUMER)
++ link->flags |= DL_FLAG_AUTOREMOVE_CONSUMER;
++
++ if (flags & DL_FLAG_AUTOREMOVE_SUPPLIER)
++ link->flags |= DL_FLAG_AUTOREMOVE_SUPPLIER;
++
++ if (flags & DL_FLAG_PM_RUNTIME) {
++ if (!(link->flags & DL_FLAG_PM_RUNTIME)) {
++ pm_runtime_new_link(consumer);
++ link->flags |= DL_FLAG_PM_RUNTIME;
++ }
++ if (flags & DL_FLAG_RPM_ACTIVE)
++ refcount_inc(&link->rpm_active);
++ }
++
++ kref_get(&link->kref);
++ goto out;
++ }
++
+ link = kzalloc(sizeof(*link), GFP_KERNEL);
+ if (!link)
+ goto out;
+
++ refcount_set(&link->rpm_active, 1);
++
+ if (flags & DL_FLAG_PM_RUNTIME) {
+- if (flags & DL_FLAG_RPM_ACTIVE) {
+- if (pm_runtime_get_sync(supplier) < 0) {
+- pm_runtime_put_noidle(supplier);
+- kfree(link);
+- link = NULL;
+- goto out;
+- }
+- link->rpm_active = true;
+- }
++ if (flags & DL_FLAG_RPM_ACTIVE)
++ refcount_inc(&link->rpm_active);
++
+ pm_runtime_new_link(consumer);
+- /*
+- * If the link is being added by the consumer driver at probe
+- * time, balance the decrementation of the supplier's runtime PM
+- * usage counter after consumer probe in driver_probe_device().
+- */
+- if (consumer->links.status == DL_DEV_PROBING)
+- pm_runtime_get_noresume(supplier);
+ }
++
+ get_device(supplier);
+ link->supplier = supplier;
+ INIT_LIST_HEAD(&link->s_node);
+@@ -307,12 +334,19 @@ struct device_link *device_link_add(struct device *consumer,
+ out:
+ device_pm_unlock();
+ device_links_write_unlock();
++
++ if ((flags & DL_FLAG_PM_RUNTIME && flags & DL_FLAG_RPM_ACTIVE) && !link)
++ pm_runtime_put(supplier);
++
+ return link;
+ }
+ EXPORT_SYMBOL_GPL(device_link_add);
+
+ static void device_link_free(struct device_link *link)
+ {
++ while (refcount_dec_not_one(&link->rpm_active))
++ pm_runtime_put(link->supplier);
++
+ put_device(link->consumer);
+ put_device(link->supplier);
+ kfree(link);
+@@ -539,11 +573,11 @@ void device_links_no_driver(struct device *dev)
+ */
+ void device_links_driver_cleanup(struct device *dev)
+ {
+- struct device_link *link;
++ struct device_link *link, *ln;
+
+ device_links_write_lock();
+
+- list_for_each_entry(link, &dev->links.consumers, s_node) {
++ list_for_each_entry_safe(link, ln, &dev->links.consumers, s_node) {
+ if (link->flags & DL_FLAG_STATELESS)
+ continue;
+
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index beb85c31f3fa..303ce7d54a30 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -268,11 +268,8 @@ static int rpm_get_suppliers(struct device *dev)
+ list_for_each_entry_rcu(link, &dev->links.suppliers, c_node) {
+ int retval;
+
+- if (!(link->flags & DL_FLAG_PM_RUNTIME))
+- continue;
+-
+- if (READ_ONCE(link->status) == DL_STATE_SUPPLIER_UNBIND ||
+- link->rpm_active)
++ if (!(link->flags & DL_FLAG_PM_RUNTIME) ||
++ READ_ONCE(link->status) == DL_STATE_SUPPLIER_UNBIND)
+ continue;
+
+ retval = pm_runtime_get_sync(link->supplier);
+@@ -281,7 +278,7 @@ static int rpm_get_suppliers(struct device *dev)
+ pm_runtime_put_noidle(link->supplier);
+ return retval;
+ }
+- link->rpm_active = true;
++ refcount_inc(&link->rpm_active);
+ }
+ return 0;
+ }
+@@ -290,12 +287,13 @@ static void rpm_put_suppliers(struct device *dev)
+ {
+ struct device_link *link;
+
+- list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
+- if (link->rpm_active &&
+- READ_ONCE(link->status) != DL_STATE_SUPPLIER_UNBIND) {
++ list_for_each_entry_rcu(link, &dev->links.suppliers, c_node) {
++ if (READ_ONCE(link->status) == DL_STATE_SUPPLIER_UNBIND)
++ continue;
++
++ while (refcount_dec_not_one(&link->rpm_active))
+ pm_runtime_put(link->supplier);
+- link->rpm_active = false;
+- }
++ }
+ }
+
+ /**
+@@ -1531,7 +1529,7 @@ void pm_runtime_remove(struct device *dev)
+ *
+ * Check links from this device to any consumers and if any of them have active
+ * runtime PM references to the device, drop the usage counter of the device
+- * (once per link).
++ * (as many times as needed).
+ *
+ * Links with the DL_FLAG_STATELESS flag set are ignored.
+ *
+@@ -1553,10 +1551,8 @@ void pm_runtime_clean_up_links(struct device *dev)
+ if (link->flags & DL_FLAG_STATELESS)
+ continue;
+
+- if (link->rpm_active) {
++ while (refcount_dec_not_one(&link->rpm_active))
+ pm_runtime_put_noidle(dev);
+- link->rpm_active = false;
+- }
+ }
+
+ device_links_read_unlock(idx);
+@@ -1574,8 +1570,11 @@ void pm_runtime_get_suppliers(struct device *dev)
+ idx = device_links_read_lock();
+
+ list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
+- if (link->flags & DL_FLAG_PM_RUNTIME)
++ if (link->flags & DL_FLAG_PM_RUNTIME) {
++ link->supplier_preactivated = true;
++ refcount_inc(&link->rpm_active);
+ pm_runtime_get_sync(link->supplier);
++ }
+
+ device_links_read_unlock(idx);
+ }
+@@ -1592,8 +1591,11 @@ void pm_runtime_put_suppliers(struct device *dev)
+ idx = device_links_read_lock();
+
+ list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
+- if (link->flags & DL_FLAG_PM_RUNTIME)
+- pm_runtime_put(link->supplier);
++ if (link->supplier_preactivated) {
++ link->supplier_preactivated = false;
++ if (refcount_dec_not_one(&link->rpm_active))
++ pm_runtime_put(link->supplier);
++ }
+
+ device_links_read_unlock(idx);
+ }
+@@ -1607,8 +1609,6 @@ void pm_runtime_new_link(struct device *dev)
+
+ void pm_runtime_drop_link(struct device *dev)
+ {
+- rpm_put_suppliers(dev);
+-
+ spin_lock_irq(&dev->power.lock);
+ WARN_ON(dev->power.links_count == 0);
+ dev->power.links_count--;
+diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
+index 7c84f64c74f7..2dfa2e048745 100644
+--- a/drivers/base/power/wakeup.c
++++ b/drivers/base/power/wakeup.c
+@@ -875,7 +875,7 @@ EXPORT_SYMBOL_GPL(pm_system_wakeup);
+
+ void pm_system_cancel_wakeup(void)
+ {
+- atomic_dec(&pm_abort_suspend);
++ atomic_dec_if_positive(&pm_abort_suspend);
+ }
+
+ void pm_wakeup_clear(bool reset)
+diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
+index f499a469e66d..12b2cc9a3fbe 100644
+--- a/drivers/bcma/driver_pci.c
++++ b/drivers/bcma/driver_pci.c
+@@ -78,7 +78,7 @@ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u16 device, u8 address)
+ v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ }
+
+- v = BCMA_CORE_PCI_MDIODATA_START;
++ v |= BCMA_CORE_PCI_MDIODATA_START;
+ v |= BCMA_CORE_PCI_MDIODATA_READ;
+ v |= BCMA_CORE_PCI_MDIODATA_TA;
+
+@@ -121,7 +121,7 @@ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u16 device,
+ v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ }
+
+- v = BCMA_CORE_PCI_MDIODATA_START;
++ v |= BCMA_CORE_PCI_MDIODATA_START;
+ v |= BCMA_CORE_PCI_MDIODATA_WRITE;
+ v |= BCMA_CORE_PCI_MDIODATA_TA;
+ v |= data;
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index a49a8d91a599..5e3885f5729b 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -334,6 +334,8 @@ static int drbd_thread_setup(void *arg)
+ thi->name[0],
+ resource->name);
+
++ allow_kernel_signal(DRBD_SIGKILL);
++ allow_kernel_signal(SIGXCPU);
+ restart:
+ retval = thi->function(thi);
+
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 585378bc988c..b942f4c8cea8 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2506,6 +2506,7 @@ again:
+ ret = rbd_obj_issue_copyup(obj_req, obj_req->xferred);
+ if (ret) {
+ obj_req->result = ret;
++ obj_req->xferred = 0;
+ return true;
+ }
+ return false;
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index b6f63e762021..54c8c8644df2 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -888,10 +888,10 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
+ SYSC_QUIRK("smartreflex", 0, -1, 0x38, -1, 0x00000000, 0xffffffff,
+ SYSC_QUIRK_LEGACY_IDLE),
+ SYSC_QUIRK("timer", 0, 0, 0x10, 0x14, 0x00000015, 0xffffffff,
+- SYSC_QUIRK_LEGACY_IDLE),
++ 0),
+ /* Some timers on omap4 and later */
+ SYSC_QUIRK("timer", 0, 0, 0x10, -1, 0x4fff1301, 0xffffffff,
+- SYSC_QUIRK_LEGACY_IDLE),
++ 0),
+ SYSC_QUIRK("uart", 0, 0x50, 0x54, 0x58, 0x00000052, 0xffffffff,
+ SYSC_QUIRK_LEGACY_IDLE),
+ /* Uarts on omap4 and later */
+@@ -1400,6 +1400,9 @@ static void sysc_unprepare(struct sysc *ddata)
+ {
+ int i;
+
++ if (!ddata->clocks)
++ return;
++
+ for (i = 0; i < SYSC_MAX_CLOCKS; i++) {
+ if (!IS_ERR_OR_NULL(ddata->clocks[i]))
+ clk_unprepare(ddata->clocks[i]);
+@@ -1593,6 +1596,16 @@ static const struct sysc_regbits sysc_regbits_omap4_mcasp = {
+ static const struct sysc_capabilities sysc_omap4_mcasp = {
+ .type = TI_SYSC_OMAP4_MCASP,
+ .regbits = &sysc_regbits_omap4_mcasp,
++ .mod_quirks = SYSC_QUIRK_OPT_CLKS_NEEDED,
++};
++
++/*
++ * McASP found on dra7 and later
++ */
++static const struct sysc_capabilities sysc_dra7_mcasp = {
++ .type = TI_SYSC_OMAP4_SIMPLE,
++ .regbits = &sysc_regbits_omap4_simple,
++ .mod_quirks = SYSC_QUIRK_OPT_CLKS_NEEDED,
+ };
+
+ /*
+@@ -1821,6 +1834,7 @@ static const struct of_device_id sysc_match[] = {
+ { .compatible = "ti,sysc-omap3-sham", .data = &sysc_omap3_sham, },
+ { .compatible = "ti,sysc-omap-aes", .data = &sysc_omap3_aes, },
+ { .compatible = "ti,sysc-mcasp", .data = &sysc_omap4_mcasp, },
++ { .compatible = "ti,sysc-dra7-mcasp", .data = &sysc_dra7_mcasp, },
+ { .compatible = "ti,sysc-usb-host-fs",
+ .data = &sysc_omap4_usb_host_fs, },
+ { .compatible = "ti,sysc-dra7-mcan", .data = &sysc_dra7_mcan, },
+diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c
+index 6767d965c36c..19bde680aee1 100644
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -171,14 +171,16 @@ static int bcm2835_rng_probe(struct platform_device *pdev)
+ priv->rng.read = bcm2835_rng_read;
+ priv->rng.cleanup = bcm2835_rng_cleanup;
+
+- rng_id = of_match_node(bcm2835_rng_of_match, np);
+- if (!rng_id)
+- return -EINVAL;
+-
+- /* Check for rng init function, execute it */
+- of_data = rng_id->data;
+- if (of_data)
+- priv->mask_interrupts = of_data->mask_interrupts;
++ if (dev_of_node(dev)) {
++ rng_id = of_match_node(bcm2835_rng_of_match, np);
++ if (!rng_id)
++ return -EINVAL;
++
++ /* Check for rng init function, execute it */
++ of_data = rng_id->data;
++ if (of_data)
++ priv->mask_interrupts = of_data->mask_interrupts;
++ }
+
+ /* register driver */
+ err = devm_hwrng_register(dev, &priv->rng);
+diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c
+index 648e39ce6bd9..8df3cad7c97a 100644
+--- a/drivers/char/hw_random/omap3-rom-rng.c
++++ b/drivers/char/hw_random/omap3-rom-rng.c
+@@ -20,6 +20,8 @@
+ #include <linux/workqueue.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
+ #include <linux/platform_device.h>
+
+ #define RNG_RESET 0x01
+@@ -86,14 +88,18 @@ static int omap3_rom_rng_read(struct hwrng *rng, void *data, size_t max, bool w)
+
+ static struct hwrng omap3_rom_rng_ops = {
+ .name = "omap3-rom",
+- .read = omap3_rom_rng_read,
+ };
+
+ static int omap3_rom_rng_probe(struct platform_device *pdev)
+ {
+ int ret = 0;
+
+- pr_info("initializing\n");
++ omap3_rom_rng_ops.read = of_device_get_match_data(&pdev->dev);
++ if (!omap3_rom_rng_ops.read) {
++ dev_err(&pdev->dev, "missing rom code handler\n");
++
++ return -ENODEV;
++ }
+
+ omap3_rom_rng_call = pdev->dev.platform_data;
+ if (!omap3_rom_rng_call) {
+@@ -126,9 +132,16 @@ static int omap3_rom_rng_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static const struct of_device_id omap_rom_rng_match[] = {
++ { .compatible = "nokia,n900-rom-rng", .data = omap3_rom_rng_read, },
++ { /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, omap_rom_rng_match);
++
+ static struct platform_driver omap3_rom_rng_driver = {
+ .driver = {
+ .name = "omap3-rom-rng",
++ .of_match_table = omap_rom_rng_match,
+ },
+ .probe = omap3_rom_rng_probe,
+ .remove = omap3_rom_rng_remove,
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 91f2d9219489..980eb7c60952 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -2965,8 +2965,11 @@ static int __ipmi_bmc_register(struct ipmi_smi *intf,
+ bmc->pdev.name = "ipmi_bmc";
+
+ rv = ida_simple_get(&ipmi_bmc_ida, 0, 0, GFP_KERNEL);
+- if (rv < 0)
++ if (rv < 0) {
++ kfree(bmc);
+ goto out;
++ }
++
+ bmc->pdev.dev.driver = &ipmidriver.driver;
+ bmc->pdev.id = rv;
+ bmc->pdev.dev.release = release_bmc_device;
+diff --git a/drivers/char/ipmi/kcs_bmc.c b/drivers/char/ipmi/kcs_bmc.c
+index e6124bd548df..ed4dc3b1843e 100644
+--- a/drivers/char/ipmi/kcs_bmc.c
++++ b/drivers/char/ipmi/kcs_bmc.c
+@@ -440,12 +440,13 @@ struct kcs_bmc *kcs_bmc_alloc(struct device *dev, int sizeof_priv, u32 channel)
+ kcs_bmc->data_in = devm_kmalloc(dev, KCS_MSG_BUFSIZ, GFP_KERNEL);
+ kcs_bmc->data_out = devm_kmalloc(dev, KCS_MSG_BUFSIZ, GFP_KERNEL);
+ kcs_bmc->kbuffer = devm_kmalloc(dev, KCS_MSG_BUFSIZ, GFP_KERNEL);
+- if (!kcs_bmc->data_in || !kcs_bmc->data_out || !kcs_bmc->kbuffer)
+- return NULL;
+
+ kcs_bmc->miscdev.minor = MISC_DYNAMIC_MINOR;
+ kcs_bmc->miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "%s%u",
+ DEVICE_NAME, channel);
++ if (!kcs_bmc->data_in || !kcs_bmc->data_out || !kcs_bmc->kbuffer ||
++ !kcs_bmc->miscdev.name)
++ return NULL;
+ kcs_bmc->miscdev.fops = &kcs_bmc_fops;
+
+ return kcs_bmc;
+diff --git a/drivers/clk/actions/owl-factor.c b/drivers/clk/actions/owl-factor.c
+index 317d4a9e112e..f15e2621fa18 100644
+--- a/drivers/clk/actions/owl-factor.c
++++ b/drivers/clk/actions/owl-factor.c
+@@ -64,11 +64,10 @@ static unsigned int _get_table_val(const struct clk_factor_table *table,
+ return val;
+ }
+
+-static int clk_val_best(struct clk_hw *hw, unsigned long rate,
++static int owl_clk_val_best(const struct owl_factor_hw *factor_hw,
++ struct clk_hw *hw, unsigned long rate,
+ unsigned long *best_parent_rate)
+ {
+- struct owl_factor *factor = hw_to_owl_factor(hw);
+- struct owl_factor_hw *factor_hw = &factor->factor_hw;
+ const struct clk_factor_table *clkt = factor_hw->table;
+ unsigned long parent_rate, try_parent_rate, best = 0, cur_rate;
+ unsigned long parent_rate_saved = *best_parent_rate;
+@@ -126,7 +125,7 @@ long owl_factor_helper_round_rate(struct owl_clk_common *common,
+ const struct clk_factor_table *clkt = factor_hw->table;
+ unsigned int val, mul = 0, div = 1;
+
+- val = clk_val_best(&common->hw, rate, parent_rate);
++ val = owl_clk_val_best(factor_hw, &common->hw, rate, parent_rate);
+ _get_table_div_mul(clkt, val, &mul, &div);
+
+ return *parent_rate * mul / div;
+diff --git a/drivers/clk/clk-highbank.c b/drivers/clk/clk-highbank.c
+index 727ed8e1bb72..8e4581004695 100644
+--- a/drivers/clk/clk-highbank.c
++++ b/drivers/clk/clk-highbank.c
+@@ -293,6 +293,7 @@ static __init struct clk *hb_clk_init(struct device_node *node, const struct clk
+ /* Map system registers */
+ srnp = of_find_compatible_node(NULL, NULL, "calxeda,hb-sregs");
+ hb_clk->reg = of_iomap(srnp, 0);
++ of_node_put(srnp);
+ BUG_ON(!hb_clk->reg);
+ hb_clk->reg += reg;
+
+diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
+index 8abc5c8cb8b8..a0713b2a12f3 100644
+--- a/drivers/clk/clk-qoriq.c
++++ b/drivers/clk/clk-qoriq.c
+@@ -1389,6 +1389,7 @@ static void __init clockgen_init(struct device_node *np)
+ pr_err("%s: Couldn't map %pOF regs\n", __func__,
+ guts);
+ }
++ of_node_put(guts);
+ }
+
+ }
+diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
+index c509324f6338..8ddf9b1f1677 100644
+--- a/drivers/clk/imx/clk-imx6q.c
++++ b/drivers/clk/imx/clk-imx6q.c
+@@ -424,6 +424,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-anatop");
+ anatop_base = base = of_iomap(np, 0);
+ WARN_ON(!base);
++ of_node_put(np);
+
+ /* Audio/video PLL post dividers do not work on i.MX6q revision 1.0 */
+ if (clk_on_imx6q() && imx_get_soc_revision() == IMX_CHIP_REVISION_1_0) {
+diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c
+index d9f2890ffe62..57ab96a47775 100644
+--- a/drivers/clk/imx/clk-imx6sx.c
++++ b/drivers/clk/imx/clk-imx6sx.c
+@@ -151,6 +151,7 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx6sx-anatop");
+ base = of_iomap(np, 0);
+ WARN_ON(!base);
++ of_node_put(np);
+
+ clks[IMX6SX_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+ clks[IMX6SX_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
+index 881b772c4ac9..83412bc36ebf 100644
+--- a/drivers/clk/imx/clk-imx7d.c
++++ b/drivers/clk/imx/clk-imx7d.c
+@@ -413,6 +413,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx7d-anatop");
+ base = of_iomap(np, 0);
+ WARN_ON(!base);
++ of_node_put(np);
+
+ clks[IMX7D_PLL_ARM_MAIN_SRC] = imx_clk_mux("pll_arm_main_src", base + 0x60, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
+ clks[IMX7D_PLL_DRAM_MAIN_SRC] = imx_clk_mux("pll_dram_main_src", base + 0x70, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
+diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c
+index 6dae54325a91..a334667c450a 100644
+--- a/drivers/clk/imx/clk-vf610.c
++++ b/drivers/clk/imx/clk-vf610.c
+@@ -203,6 +203,7 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop");
+ anatop_base = of_iomap(np, 0);
+ BUG_ON(!anatop_base);
++ of_node_put(np);
+
+ np = ccm_node;
+ ccm_base = of_iomap(np, 0);
+diff --git a/drivers/clk/ingenic/jz4740-cgu.c b/drivers/clk/ingenic/jz4740-cgu.c
+index 4479c102e899..b86edd328249 100644
+--- a/drivers/clk/ingenic/jz4740-cgu.c
++++ b/drivers/clk/ingenic/jz4740-cgu.c
+@@ -165,7 +165,7 @@ static const struct ingenic_cgu_clk_info jz4740_cgu_clocks[] = {
+ .parents = { JZ4740_CLK_EXT, JZ4740_CLK_PLL_HALF, -1, -1 },
+ .mux = { CGU_REG_CPCCR, 29, 1 },
+ .div = { CGU_REG_CPCCR, 23, 1, 6, -1, -1, -1 },
+- .gate = { CGU_REG_SCR, 6 },
++ .gate = { CGU_REG_SCR, 6, true },
+ },
+
+ /* Gate-only clocks */
+diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
+index 02229d051d77..4e7dac24948b 100644
+--- a/drivers/clk/meson/axg.c
++++ b/drivers/clk/meson/axg.c
+@@ -461,11 +461,6 @@ static struct clk_regmap axg_mpll0_div = {
+ .shift = 16,
+ .width = 9,
+ },
+- .ssen = {
+- .reg_off = HHI_MPLL_CNTL,
+- .shift = 25,
+- .width = 1,
+- },
+ .misc = {
+ .reg_off = HHI_PLL_TOP_MISC,
+ .shift = 0,
+@@ -560,6 +555,11 @@ static struct clk_regmap axg_mpll2_div = {
+ .shift = 16,
+ .width = 9,
+ },
++ .ssen = {
++ .reg_off = HHI_MPLL_CNTL,
++ .shift = 25,
++ .width = 1,
++ },
+ .misc = {
+ .reg_off = HHI_PLL_TOP_MISC,
+ .shift = 2,
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index b039909e03cf..38ffa51a5bad 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -650,11 +650,6 @@ static struct clk_regmap gxbb_mpll0_div = {
+ .shift = 16,
+ .width = 9,
+ },
+- .ssen = {
+- .reg_off = HHI_MPLL_CNTL,
+- .shift = 25,
+- .width = 1,
+- },
+ .lock = &meson_clk_lock,
+ },
+ .hw.init = &(struct clk_init_data){
+diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
+index 2c7c1085f883..8fdfa97900cd 100644
+--- a/drivers/clk/mvebu/armada-370.c
++++ b/drivers/clk/mvebu/armada-370.c
+@@ -177,8 +177,10 @@ static void __init a370_clk_init(struct device_node *np)
+
+ mvebu_coreclk_setup(np, &a370_coreclks);
+
+- if (cgnp)
++ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, a370_gating_desc);
++ of_node_put(cgnp);
++ }
+ }
+ CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
+
+diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
+index 0ec44ae9a2a2..df529982adc9 100644
+--- a/drivers/clk/mvebu/armada-xp.c
++++ b/drivers/clk/mvebu/armada-xp.c
+@@ -228,7 +228,9 @@ static void __init axp_clk_init(struct device_node *np)
+
+ mvebu_coreclk_setup(np, &axp_coreclks);
+
+- if (cgnp)
++ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, axp_gating_desc);
++ of_node_put(cgnp);
++ }
+ }
+ CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
+diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c
+index 59fad9546c84..5f258c9bb68b 100644
+--- a/drivers/clk/mvebu/dove.c
++++ b/drivers/clk/mvebu/dove.c
+@@ -190,10 +190,14 @@ static void __init dove_clk_init(struct device_node *np)
+
+ mvebu_coreclk_setup(np, &dove_coreclks);
+
+- if (ddnp)
++ if (ddnp) {
+ dove_divider_clk_init(ddnp);
++ of_node_put(ddnp);
++ }
+
+- if (cgnp)
++ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, dove_gating_desc);
++ of_node_put(cgnp);
++ }
+ }
+ CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init);
+diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
+index a2a8d614039d..890ebf623261 100644
+--- a/drivers/clk/mvebu/kirkwood.c
++++ b/drivers/clk/mvebu/kirkwood.c
+@@ -333,6 +333,8 @@ static void __init kirkwood_clk_init(struct device_node *np)
+ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
+ kirkwood_clk_muxing_setup(cgnp, kirkwood_mux_desc);
++
++ of_node_put(cgnp);
+ }
+ }
+ CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
+diff --git a/drivers/clk/mvebu/mv98dx3236.c b/drivers/clk/mvebu/mv98dx3236.c
+index 6e203af73cac..c8a0d03d2cd6 100644
+--- a/drivers/clk/mvebu/mv98dx3236.c
++++ b/drivers/clk/mvebu/mv98dx3236.c
+@@ -174,7 +174,9 @@ static void __init mv98dx3236_clk_init(struct device_node *np)
+
+ mvebu_coreclk_setup(np, &mv98dx3236_core_clocks);
+
+- if (cgnp)
++ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, mv98dx3236_gating_desc);
++ of_node_put(cgnp);
++ }
+ }
+ CLK_OF_DECLARE(mv98dx3236_clk, "marvell,mv98dx3236-core-clock", mv98dx3236_clk_init);
+diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
+index 9a3290fdd01b..bea55c461cee 100644
+--- a/drivers/clk/qcom/gcc-msm8996.c
++++ b/drivers/clk/qcom/gcc-msm8996.c
+@@ -138,22 +138,6 @@ static const char * const gcc_xo_gpll0_gpll4_gpll0_early_div[] = {
+ "gpll0_early_div"
+ };
+
+-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] = {
+- { P_XO, 0 },
+- { P_GPLL0, 1 },
+- { P_GPLL2, 2 },
+- { P_GPLL3, 3 },
+- { P_GPLL0_EARLY_DIV, 6 }
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = {
+- "xo",
+- "gpll0",
+- "gpll2",
+- "gpll3",
+- "gpll0_early_div"
+-};
+-
+ static const struct parent_map gcc_xo_gpll0_gpll1_early_div_gpll1_gpll4_gpll0_early_div_map[] = {
+ { P_XO, 0 },
+ { P_GPLL0, 1 },
+@@ -192,26 +176,6 @@ static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll2_early_gpll0_early
+ "gpll0_early_div"
+ };
+
+-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = {
+- { P_XO, 0 },
+- { P_GPLL0, 1 },
+- { P_GPLL2, 2 },
+- { P_GPLL3, 3 },
+- { P_GPLL1, 4 },
+- { P_GPLL4, 5 },
+- { P_GPLL0_EARLY_DIV, 6 }
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = {
+- "xo",
+- "gpll0",
+- "gpll2",
+- "gpll3",
+- "gpll1",
+- "gpll4",
+- "gpll0_early_div"
+-};
+-
+ static struct clk_fixed_factor xo = {
+ .mult = 1,
+ .div = 1,
+diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
+index 4e23973b6cd1..772a08101ddf 100644
+--- a/drivers/clk/qcom/gcc-msm8998.c
++++ b/drivers/clk/qcom/gcc-msm8998.c
+@@ -2144,7 +2144,7 @@ static struct clk_branch gcc_pcie_0_mstr_axi_clk = {
+
+ static struct clk_branch gcc_pcie_0_pipe_clk = {
+ .halt_reg = 0x6b018,
+- .halt_check = BRANCH_HALT,
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x6b018,
+ .enable_mask = BIT(0),
+diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
+index 0421960eb963..442309b56920 100644
+--- a/drivers/clk/samsung/clk-exynos4.c
++++ b/drivers/clk/samsung/clk-exynos4.c
+@@ -1226,6 +1226,7 @@ static unsigned long __init exynos4_get_xom(void)
+ xom = readl(chipid_base + 8);
+
+ iounmap(chipid_base);
++ of_node_put(np);
+ }
+
+ return xom;
+diff --git a/drivers/clk/socfpga/clk-pll-a10.c b/drivers/clk/socfpga/clk-pll-a10.c
+index 35fabe1a32c3..269467e8e07e 100644
+--- a/drivers/clk/socfpga/clk-pll-a10.c
++++ b/drivers/clk/socfpga/clk-pll-a10.c
+@@ -95,6 +95,7 @@ static struct clk * __init __socfpga_pll_init(struct device_node *node,
+
+ clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+ clk_mgr_a10_base_addr = of_iomap(clkmgr_np, 0);
++ of_node_put(clkmgr_np);
+ BUG_ON(!clk_mgr_a10_base_addr);
+ pll_clk->hw.reg = clk_mgr_a10_base_addr + reg;
+
+diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
+index c7f463172e4b..b4b44e9b5901 100644
+--- a/drivers/clk/socfpga/clk-pll.c
++++ b/drivers/clk/socfpga/clk-pll.c
+@@ -100,6 +100,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
+
+ clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+ clk_mgr_base_addr = of_iomap(clkmgr_np, 0);
++ of_node_put(clkmgr_np);
+ BUG_ON(!clk_mgr_base_addr);
+ pll_clk->hw.reg = clk_mgr_base_addr + reg;
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
+index 27554eaf6929..8d05d4f1f8a1 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
+@@ -104,7 +104,7 @@ static SUNXI_CCU_GATE(r_apb2_i2c_clk, "r-apb2-i2c", "r-apb2",
+ static SUNXI_CCU_GATE(r_apb1_ir_clk, "r-apb1-ir", "r-apb1",
+ 0x1cc, BIT(0), 0);
+ static SUNXI_CCU_GATE(r_apb1_w1_clk, "r-apb1-w1", "r-apb1",
+- 0x1cc, BIT(0), 0);
++ 0x1ec, BIT(0), 0);
+
+ /* Information of IR(RX) mod clock is gathered from BSP source code */
+ static const char * const r_mod0_default_parents[] = { "osc32k", "osc24M" };
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+index a4fa2945f230..4b5f8f4e4ab8 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+@@ -144,7 +144,7 @@ static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_mipi_clk, "pll-mipi",
+ 8, 4, /* N */
+ 4, 2, /* K */
+ 0, 4, /* M */
+- BIT(31), /* gate */
++ BIT(31) | BIT(23) | BIT(22), /* gate */
+ BIT(28), /* lock */
+ CLK_SET_RATE_UNGATE);
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+index 9e3f4088724b..c7f9d974b10d 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+@@ -84,7 +84,7 @@ static SUNXI_CCU_NM_WITH_FRAC_GATE_LOCK(pll_ve_clk, "pll-ve",
+ BIT(28), /* lock */
+ 0);
+
+-static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_ddr_clk, "pll-ddr",
++static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_ddr0_clk, "pll-ddr0",
+ "osc24M", 0x020,
+ 8, 5, /* N */
+ 4, 2, /* K */
+@@ -123,6 +123,14 @@ static SUNXI_CCU_NK_WITH_GATE_LOCK_POSTDIV(pll_periph1_clk, "pll-periph1",
+ 2, /* post-div */
+ 0);
+
++static SUNXI_CCU_NM_WITH_GATE_LOCK(pll_ddr1_clk, "pll-ddr1",
++ "osc24M", 0x04c,
++ 8, 7, /* N */
++ 0, 2, /* M */
++ BIT(31), /* gate */
++ BIT(28), /* lock */
++ 0);
++
+ static const char * const cpu_parents[] = { "osc32k", "osc24M",
+ "pll-cpu", "pll-cpu" };
+ static SUNXI_CCU_MUX(cpu_clk, "cpu", cpu_parents,
+@@ -310,7 +318,8 @@ static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M",
+ static SUNXI_CCU_GATE(usb_ohci0_clk, "usb-ohci0", "osc24M",
+ 0x0cc, BIT(16), 0);
+
+-static const char * const dram_parents[] = { "pll-ddr", "pll-periph0-2x" };
++static const char * const dram_parents[] = { "pll-ddr0", "pll-ddr1",
++ "pll-periph0-2x" };
+ static SUNXI_CCU_M_WITH_MUX(dram_clk, "dram", dram_parents,
+ 0x0f4, 0, 4, 20, 2, CLK_IS_CRITICAL);
+
+@@ -369,10 +378,11 @@ static struct ccu_common *sun8i_v3s_ccu_clks[] = {
+ &pll_audio_base_clk.common,
+ &pll_video_clk.common,
+ &pll_ve_clk.common,
+- &pll_ddr_clk.common,
++ &pll_ddr0_clk.common,
+ &pll_periph0_clk.common,
+ &pll_isp_clk.common,
+ &pll_periph1_clk.common,
++ &pll_ddr1_clk.common,
+ &cpu_clk.common,
+ &axi_clk.common,
+ &ahb1_clk.common,
+@@ -457,11 +467,12 @@ static struct clk_hw_onecell_data sun8i_v3s_hw_clks = {
+ [CLK_PLL_AUDIO_8X] = &pll_audio_8x_clk.hw,
+ [CLK_PLL_VIDEO] = &pll_video_clk.common.hw,
+ [CLK_PLL_VE] = &pll_ve_clk.common.hw,
+- [CLK_PLL_DDR] = &pll_ddr_clk.common.hw,
++ [CLK_PLL_DDR0] = &pll_ddr0_clk.common.hw,
+ [CLK_PLL_PERIPH0] = &pll_periph0_clk.common.hw,
+ [CLK_PLL_PERIPH0_2X] = &pll_periph0_2x_clk.hw,
+ [CLK_PLL_ISP] = &pll_isp_clk.common.hw,
+ [CLK_PLL_PERIPH1] = &pll_periph1_clk.common.hw,
++ [CLK_PLL_DDR1] = &pll_ddr1_clk.common.hw,
+ [CLK_CPU] = &cpu_clk.common.hw,
+ [CLK_AXI] = &axi_clk.common.hw,
+ [CLK_AHB1] = &ahb1_clk.common.hw,
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
+index 4a4d36fdad96..a091b7217dfd 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
+@@ -29,7 +29,7 @@
+ #define CLK_PLL_AUDIO_8X 5
+ #define CLK_PLL_VIDEO 6
+ #define CLK_PLL_VE 7
+-#define CLK_PLL_DDR 8
++#define CLK_PLL_DDR0 8
+ #define CLK_PLL_PERIPH0 9
+ #define CLK_PLL_PERIPH0_2X 10
+ #define CLK_PLL_ISP 11
+@@ -58,6 +58,8 @@
+
+ /* And the GPU module clock is exported */
+
+-#define CLK_NUMBER (CLK_MIPI_CSI + 1)
++#define CLK_PLL_DDR1 74
++
++#define CLK_NUMBER (CLK_PLL_DDR1 + 1)
+
+ #endif /* _CCU_SUN8I_H3_H_ */
+diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c
+index 27e0979b3158..0cc87c6ae91c 100644
+--- a/drivers/clk/ti/clk.c
++++ b/drivers/clk/ti/clk.c
+@@ -188,9 +188,13 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
+ clkdev_add(&c->lk);
+ } else {
+ if (num_args && !has_clkctrl_data) {
+- if (of_find_compatible_node(NULL, NULL,
+- "ti,clkctrl")) {
++ struct device_node *np;
++
++ np = of_find_compatible_node(NULL, NULL,
++ "ti,clkctrl");
++ if (np) {
+ has_clkctrl_data = true;
++ of_node_put(np);
+ } else {
+ clkctrl_nodes_missing = true;
+
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index aaf5bfa9bd9c..e3ae041ac30e 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -563,7 +563,19 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem *
+ return 0;
+
+ out_irq:
+- free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
++ if (mct_int_type == MCT_INT_PPI) {
++ free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
++ } else {
++ for_each_possible_cpu(cpu) {
++ struct mct_clock_event_device *pcpu_mevt =
++ per_cpu_ptr(&percpu_mct_tick, cpu);
++
++ if (pcpu_mevt->evt.irq != -1) {
++ free_irq(pcpu_mevt->evt.irq, pcpu_mevt);
++ pcpu_mevt->evt.irq = -1;
++ }
++ }
++ }
+ return err;
+ }
+
+diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
+index 3b56ea3f52af..552c5254390c 100644
+--- a/drivers/clocksource/timer-sun5i.c
++++ b/drivers/clocksource/timer-sun5i.c
+@@ -202,6 +202,11 @@ static int __init sun5i_setup_clocksource(struct device_node *node,
+ }
+
+ rate = clk_get_rate(clk);
++ if (!rate) {
++ pr_err("Couldn't get parent clock rate\n");
++ ret = -EINVAL;
++ goto err_disable_clk;
++ }
+
+ cs->timer.base = base;
+ cs->timer.clk = clk;
+@@ -275,6 +280,11 @@ static int __init sun5i_setup_clockevent(struct device_node *node, void __iomem
+ }
+
+ rate = clk_get_rate(clk);
++ if (!rate) {
++ pr_err("Couldn't get parent clock rate\n");
++ ret = -EINVAL;
++ goto err_disable_clk;
++ }
+
+ ce->timer.base = base;
+ ce->timer.ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c
+index 3ecf84706640..23414dddc3ba 100644
+--- a/drivers/clocksource/timer-ti-dm.c
++++ b/drivers/clocksource/timer-ti-dm.c
+@@ -868,7 +868,6 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
+ timer->pdev = pdev;
+
+ pm_runtime_enable(dev);
+- pm_runtime_irq_safe(dev);
+
+ if (!timer->reserved) {
+ ret = pm_runtime_get_sync(dev);
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index e6f9cbe5835f..77b0e5d0fb13 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -384,12 +384,12 @@ static int brcm_avs_set_pstate(struct private_data *priv, unsigned int pstate)
+ return __issue_avs_command(priv, AVS_CMD_SET_PSTATE, true, args);
+ }
+
+-static unsigned long brcm_avs_get_voltage(void __iomem *base)
++static u32 brcm_avs_get_voltage(void __iomem *base)
+ {
+ return readl(base + AVS_MBOX_VOLTAGE1);
+ }
+
+-static unsigned long brcm_avs_get_frequency(void __iomem *base)
++static u32 brcm_avs_get_frequency(void __iomem *base)
+ {
+ return readl(base + AVS_MBOX_FREQUENCY) * 1000; /* in kHz */
+ }
+@@ -446,8 +446,8 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv)
+ rc = brcm_avs_get_pmap(priv, NULL);
+ magic = readl(priv->base + AVS_MBOX_MAGIC);
+
+- return (magic == AVS_FIRMWARE_MAGIC) && (rc != -ENOTSUPP) &&
+- (rc != -EINVAL);
++ return (magic == AVS_FIRMWARE_MAGIC) && ((rc != -ENOTSUPP) ||
++ (rc != -EINVAL));
+ }
+
+ static unsigned int brcm_avs_cpufreq_get(unsigned int cpu)
+@@ -653,14 +653,14 @@ static ssize_t show_brcm_avs_voltage(struct cpufreq_policy *policy, char *buf)
+ {
+ struct private_data *priv = policy->driver_data;
+
+- return sprintf(buf, "0x%08lx\n", brcm_avs_get_voltage(priv->base));
++ return sprintf(buf, "0x%08x\n", brcm_avs_get_voltage(priv->base));
+ }
+
+ static ssize_t show_brcm_avs_frequency(struct cpufreq_policy *policy, char *buf)
+ {
+ struct private_data *priv = policy->driver_data;
+
+- return sprintf(buf, "0x%08lx\n", brcm_avs_get_frequency(priv->base));
++ return sprintf(buf, "0x%08x\n", brcm_avs_get_frequency(priv->base));
+ }
+
+ cpufreq_freq_attr_ro(brcm_avs_pstate);
+diff --git a/drivers/crypto/amcc/crypto4xx_trng.h b/drivers/crypto/amcc/crypto4xx_trng.h
+index 931d22531f51..7bbda51b7337 100644
+--- a/drivers/crypto/amcc/crypto4xx_trng.h
++++ b/drivers/crypto/amcc/crypto4xx_trng.h
+@@ -26,9 +26,9 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev);
+ void ppc4xx_trng_remove(struct crypto4xx_core_device *core_dev);
+ #else
+ static inline void ppc4xx_trng_probe(
+- struct crypto4xx_device *dev __maybe_unused) { }
++ struct crypto4xx_core_device *dev __maybe_unused) { }
+ static inline void ppc4xx_trng_remove(
+- struct crypto4xx_device *dev __maybe_unused) { }
++ struct crypto4xx_core_device *dev __maybe_unused) { }
+ #endif
+
+ #endif
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index 49c0097fa474..0b1fc5664b1d 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -717,7 +717,7 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx)
+ */
+ unsigned int new_data_len;
+
+- unsigned int chunk_start = 0;
++ unsigned int __maybe_unused chunk_start = 0;
+ u32 db_size; /* Length of data field, incl gcm and hash padding */
+ int pad_len = 0; /* total pad len, including gcm, hash, stat padding */
+ u32 data_pad_len = 0; /* length of GCM/CCM padding */
+@@ -1675,8 +1675,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg)
+ struct spu_hw *spu = &iproc_priv.spu;
+ struct brcm_message *mssg = msg;
+ struct iproc_reqctx_s *rctx;
+- struct iproc_ctx_s *ctx;
+- struct crypto_async_request *areq;
+ int err = 0;
+
+ rctx = mssg->ctx;
+@@ -1686,8 +1684,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg)
+ err = -EFAULT;
+ goto cb_finish;
+ }
+- areq = rctx->parent;
+- ctx = rctx->ctx;
+
+ /* process the SPU status */
+ err = spu->spu_status_process(rctx->msg_buf.rx_stat);
+diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
+index fde07d4ff019..ff6718a11e9e 100644
+--- a/drivers/crypto/caam/caamrng.c
++++ b/drivers/crypto/caam/caamrng.c
+@@ -353,7 +353,10 @@ static int __init caam_rng_init(void)
+ goto free_rng_ctx;
+
+ dev_info(dev, "registering rng-caam\n");
+- return hwrng_register(&caam_rng);
++
++ err = hwrng_register(&caam_rng);
++ if (!err)
++ return err;
+
+ free_rng_ctx:
+ kfree(rng_ctx);
+diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
+index 8da88beb1abb..832ba2afdcd5 100644
+--- a/drivers/crypto/caam/error.c
++++ b/drivers/crypto/caam/error.c
+@@ -22,7 +22,7 @@ void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
+ size_t len;
+ void *buf;
+
+- for (it = sg; it && tlen > 0 ; it = sg_next(sg)) {
++ for (it = sg; it && tlen > 0 ; it = sg_next(it)) {
+ /*
+ * make sure the scatterlist's page
+ * has a valid virtual memory mapping
+diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c
+index 89291c15015c..3f768699332b 100644
+--- a/drivers/crypto/ccp/ccp-crypto-aes.c
++++ b/drivers/crypto/ccp/ccp-crypto-aes.c
+@@ -1,7 +1,8 @@
++// SPDX-License-Identifier: GPL-2.0
+ /*
+ * AMD Cryptographic Coprocessor (CCP) AES crypto API support
+ *
+- * Copyright (C) 2013,2016 Advanced Micro Devices, Inc.
++ * Copyright (C) 2013-2019 Advanced Micro Devices, Inc.
+ *
+ * Author: Tom Lendacky <thomas.lendacky@amd.com>
+ *
+@@ -79,8 +80,7 @@ static int ccp_aes_crypt(struct ablkcipher_request *req, bool encrypt)
+ return -EINVAL;
+
+ if (((ctx->u.aes.mode == CCP_AES_MODE_ECB) ||
+- (ctx->u.aes.mode == CCP_AES_MODE_CBC) ||
+- (ctx->u.aes.mode == CCP_AES_MODE_CFB)) &&
++ (ctx->u.aes.mode == CCP_AES_MODE_CBC)) &&
+ (req->nbytes & (AES_BLOCK_SIZE - 1)))
+ return -EINVAL;
+
+@@ -291,7 +291,7 @@ static struct ccp_aes_def aes_algs[] = {
+ .version = CCP_VERSION(3, 0),
+ .name = "cfb(aes)",
+ .driver_name = "cfb-aes-ccp",
+- .blocksize = AES_BLOCK_SIZE,
++ .blocksize = 1,
+ .ivsize = AES_BLOCK_SIZE,
+ .alg_defaults = &ccp_aes_defaults,
+ },
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 1e2e42106dee..330853a2702f 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -458,8 +458,8 @@ static int ccp_copy_from_sb(struct ccp_cmd_queue *cmd_q,
+ return ccp_copy_to_from_sb(cmd_q, wa, jobid, sb, byte_swap, true);
+ }
+
+-static int ccp_run_aes_cmac_cmd(struct ccp_cmd_queue *cmd_q,
+- struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_aes_cmac_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_aes_engine *aes = &cmd->u.aes;
+ struct ccp_dm_workarea key, ctx;
+@@ -614,8 +614,8 @@ e_key:
+ return ret;
+ }
+
+-static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+- struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_aes_engine *aes = &cmd->u.aes;
+ struct ccp_dm_workarea key, ctx, final_wa, tag;
+@@ -897,7 +897,8 @@ e_key:
+ return ret;
+ }
+
+-static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_aes_engine *aes = &cmd->u.aes;
+ struct ccp_dm_workarea key, ctx;
+@@ -907,12 +908,6 @@ static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ bool in_place = false;
+ int ret;
+
+- if (aes->mode == CCP_AES_MODE_CMAC)
+- return ccp_run_aes_cmac_cmd(cmd_q, cmd);
+-
+- if (aes->mode == CCP_AES_MODE_GCM)
+- return ccp_run_aes_gcm_cmd(cmd_q, cmd);
+-
+ if (!((aes->key_len == AES_KEYSIZE_128) ||
+ (aes->key_len == AES_KEYSIZE_192) ||
+ (aes->key_len == AES_KEYSIZE_256)))
+@@ -1080,8 +1075,8 @@ e_key:
+ return ret;
+ }
+
+-static int ccp_run_xts_aes_cmd(struct ccp_cmd_queue *cmd_q,
+- struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_xts_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_xts_aes_engine *xts = &cmd->u.xts;
+ struct ccp_dm_workarea key, ctx;
+@@ -1280,7 +1275,8 @@ e_key:
+ return ret;
+ }
+
+-static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_des3_engine *des3 = &cmd->u.des3;
+
+@@ -1293,6 +1289,9 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ int ret;
+
+ /* Error checks */
++ if (cmd_q->ccp->vdata->version < CCP_VERSION(5, 0))
++ return -EINVAL;
++
+ if (!cmd_q->ccp->vdata->perform->des3)
+ return -EINVAL;
+
+@@ -1375,8 +1374,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ * passthru option to convert from big endian to little endian.
+ */
+ if (des3->mode != CCP_DES3_MODE_ECB) {
+- u32 load_mode;
+-
+ op.sb_ctx = cmd_q->sb_ctx;
+
+ ret = ccp_init_dm_workarea(&ctx, cmd_q,
+@@ -1392,12 +1389,8 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ if (ret)
+ goto e_ctx;
+
+- if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
+- load_mode = CCP_PASSTHRU_BYTESWAP_NOOP;
+- else
+- load_mode = CCP_PASSTHRU_BYTESWAP_256BIT;
+ ret = ccp_copy_to_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
+- load_mode);
++ CCP_PASSTHRU_BYTESWAP_256BIT);
+ if (ret) {
+ cmd->engine_error = cmd_q->cmd_error;
+ goto e_ctx;
+@@ -1459,10 +1452,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ }
+
+ /* ...but we only need the last DES3_EDE_BLOCK_SIZE bytes */
+- if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
+- dm_offset = CCP_SB_BYTES - des3->iv_len;
+- else
+- dm_offset = 0;
+ ccp_get_dm_area(&ctx, dm_offset, des3->iv, 0,
+ DES3_EDE_BLOCK_SIZE);
+ }
+@@ -1483,7 +1472,8 @@ e_key:
+ return ret;
+ }
+
+-static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_sha_engine *sha = &cmd->u.sha;
+ struct ccp_dm_workarea ctx;
+@@ -1827,7 +1817,8 @@ e_ctx:
+ return ret;
+ }
+
+-static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_rsa_engine *rsa = &cmd->u.rsa;
+ struct ccp_dm_workarea exp, src, dst;
+@@ -1958,8 +1949,8 @@ e_sb:
+ return ret;
+ }
+
+-static int ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q,
+- struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_passthru_engine *pt = &cmd->u.passthru;
+ struct ccp_dm_workarea mask;
+@@ -2090,7 +2081,8 @@ e_mask:
+ return ret;
+ }
+
+-static int ccp_run_passthru_nomap_cmd(struct ccp_cmd_queue *cmd_q,
++static noinline_for_stack int
++ccp_run_passthru_nomap_cmd(struct ccp_cmd_queue *cmd_q,
+ struct ccp_cmd *cmd)
+ {
+ struct ccp_passthru_nomap_engine *pt = &cmd->u.passthru_nomap;
+@@ -2431,7 +2423,8 @@ e_src:
+ return ret;
+ }
+
+-static int ccp_run_ecc_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_ecc_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_ecc_engine *ecc = &cmd->u.ecc;
+
+@@ -2468,7 +2461,17 @@ int ccp_run_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+
+ switch (cmd->engine) {
+ case CCP_ENGINE_AES:
+- ret = ccp_run_aes_cmd(cmd_q, cmd);
++ switch (cmd->u.aes.mode) {
++ case CCP_AES_MODE_CMAC:
++ ret = ccp_run_aes_cmac_cmd(cmd_q, cmd);
++ break;
++ case CCP_AES_MODE_GCM:
++ ret = ccp_run_aes_gcm_cmd(cmd_q, cmd);
++ break;
++ default:
++ ret = ccp_run_aes_cmd(cmd_q, cmd);
++ break;
++ }
+ break;
+ case CCP_ENGINE_XTS_AES_128:
+ ret = ccp_run_xts_aes_cmd(cmd_q, cmd);
+diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c
+index 54a39164aab8..28a5b8b38fa2 100644
+--- a/drivers/crypto/ccree/cc_cipher.c
++++ b/drivers/crypto/ccree/cc_cipher.c
+@@ -306,7 +306,6 @@ static int cc_cipher_setkey(struct crypto_skcipher *sktfm, const u8 *key,
+ struct crypto_tfm *tfm = crypto_skcipher_tfm(sktfm);
+ struct cc_cipher_ctx *ctx_p = crypto_tfm_ctx(tfm);
+ struct device *dev = drvdata_to_dev(ctx_p->drvdata);
+- u32 tmp[DES3_EDE_EXPKEY_WORDS];
+ struct cc_crypto_alg *cc_alg =
+ container_of(tfm->__crt_alg, struct cc_crypto_alg,
+ skcipher_alg.base);
+@@ -332,6 +331,7 @@ static int cc_cipher_setkey(struct crypto_skcipher *sktfm, const u8 *key,
+ * HW does the expansion on its own.
+ */
+ if (ctx_p->flow_mode == S_DIN_to_DES) {
++ u32 tmp[DES3_EDE_EXPKEY_WORDS];
+ if (keylen == DES3_EDE_KEY_SIZE &&
+ __des3_ede_setkey(tmp, &tfm->crt_flags, key,
+ DES3_EDE_KEY_SIZE)) {
+diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c
+index db2983c51f1e..bf9658800bda 100644
+--- a/drivers/crypto/hisilicon/sec/sec_algs.c
++++ b/drivers/crypto/hisilicon/sec/sec_algs.c
+@@ -153,6 +153,24 @@ static void sec_alg_skcipher_init_context(struct crypto_skcipher *atfm,
+ ctx->cipher_alg);
+ }
+
++static void sec_free_hw_sgl(struct sec_hw_sgl *hw_sgl,
++ dma_addr_t psec_sgl, struct sec_dev_info *info)
++{
++ struct sec_hw_sgl *sgl_current, *sgl_next;
++ dma_addr_t sgl_next_dma;
++
++ sgl_current = hw_sgl;
++ while (sgl_current) {
++ sgl_next = sgl_current->next;
++ sgl_next_dma = sgl_current->next_sgl;
++
++ dma_pool_free(info->hw_sgl_pool, sgl_current, psec_sgl);
++
++ sgl_current = sgl_next;
++ psec_sgl = sgl_next_dma;
++ }
++}
++
+ static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl,
+ dma_addr_t *psec_sgl,
+ struct scatterlist *sgl,
+@@ -199,36 +217,12 @@ static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl,
+ return 0;
+
+ err_free_hw_sgls:
+- sgl_current = *sec_sgl;
+- while (sgl_current) {
+- sgl_next = sgl_current->next;
+- dma_pool_free(info->hw_sgl_pool, sgl_current,
+- sgl_current->next_sgl);
+- sgl_current = sgl_next;
+- }
++ sec_free_hw_sgl(*sec_sgl, *psec_sgl, info);
+ *psec_sgl = 0;
+
+ return ret;
+ }
+
+-static void sec_free_hw_sgl(struct sec_hw_sgl *hw_sgl,
+- dma_addr_t psec_sgl, struct sec_dev_info *info)
+-{
+- struct sec_hw_sgl *sgl_current, *sgl_next;
+- dma_addr_t sgl_next_dma;
+-
+- sgl_current = hw_sgl;
+- while (sgl_current) {
+- sgl_next = sgl_current->next;
+- sgl_next_dma = sgl_current->next_sgl;
+-
+- dma_pool_free(info->hw_sgl_pool, sgl_current, psec_sgl);
+-
+- sgl_current = sgl_next;
+- psec_sgl = sgl_next_dma;
+- }
+-}
+-
+ static int sec_alg_skcipher_setkey(struct crypto_skcipher *tfm,
+ const u8 *key, unsigned int keylen,
+ enum sec_cipher_alg alg)
+diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
+index ac9282c1a5ec..f3b02c00b784 100644
+--- a/drivers/crypto/inside-secure/safexcel_hash.c
++++ b/drivers/crypto/inside-secure/safexcel_hash.c
+@@ -50,10 +50,12 @@ struct safexcel_ahash_req {
+
+ static inline u64 safexcel_queued_len(struct safexcel_ahash_req *req)
+ {
+- if (req->len[1] > req->processed[1])
+- return 0xffffffff - (req->len[0] - req->processed[0]);
++ u64 len, processed;
+
+- return req->len[0] - req->processed[0];
++ len = (0xffffffff * req->len[1]) + req->len[0];
++ processed = (0xffffffff * req->processed[1]) + req->processed[0];
++
++ return len - processed;
+ }
+
+ static void safexcel_hash_token(struct safexcel_command_desc *cdesc,
+@@ -486,7 +488,7 @@ static int safexcel_ahash_exit_inv(struct crypto_tfm *tfm)
+ struct safexcel_inv_result result = {};
+ int ring = ctx->base.ring;
+
+- memset(req, 0, sizeof(struct ahash_request));
++ memset(req, 0, EIP197_AHASH_REQ_SIZE);
+
+ /* create invalidation request */
+ init_completion(&result.completion);
+diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
+index 1a724263761b..2d178e013535 100644
+--- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
++++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
+@@ -179,7 +179,7 @@ static int sun4i_hash(struct ahash_request *areq)
+ */
+ unsigned int i = 0, end, fill, min_fill, nwait, nbw = 0, j = 0, todo;
+ unsigned int in_i = 0;
+- u32 spaces, rx_cnt = SS_RX_DEFAULT, bf[32] = {0}, wb = 0, v, ivmode = 0;
++ u32 spaces, rx_cnt = SS_RX_DEFAULT, bf[32] = {0}, v, ivmode = 0;
+ struct sun4i_req_ctx *op = ahash_request_ctx(areq);
+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
+ struct sun4i_tfm_ctx *tfmctx = crypto_ahash_ctx(tfm);
+@@ -188,6 +188,7 @@ static int sun4i_hash(struct ahash_request *areq)
+ struct sg_mapping_iter mi;
+ int in_r, err = 0;
+ size_t copied = 0;
++ __le32 wb = 0;
+
+ dev_dbg(ss->dev, "%s %s bc=%llu len=%u mode=%x wl=%u h0=%0x",
+ __func__, crypto_tfm_alg_name(areq->base.tfm),
+@@ -399,7 +400,7 @@ hash_final:
+
+ nbw = op->len - 4 * nwait;
+ if (nbw) {
+- wb = *(u32 *)(op->buf + nwait * 4);
++ wb = cpu_to_le32(*(u32 *)(op->buf + nwait * 4));
+ wb &= GENMASK((nbw * 8) - 1, 0);
+
+ op->byte_count += nbw;
+@@ -408,7 +409,7 @@ hash_final:
+
+ /* write the remaining bytes of the nbw buffer */
+ wb |= ((1 << 7) << (nbw * 8));
+- bf[j++] = wb;
++ bf[j++] = le32_to_cpu(wb);
+
+ /*
+ * number of space to pad to obtain 64o minus 8(size) minus 4 (final 1)
+@@ -427,13 +428,13 @@ hash_final:
+
+ /* write the length of data */
+ if (op->mode == SS_OP_SHA1) {
+- __be64 bits = cpu_to_be64(op->byte_count << 3);
+- bf[j++] = lower_32_bits(bits);
+- bf[j++] = upper_32_bits(bits);
++ __be64 *bits = (__be64 *)&bf[j];
++ *bits = cpu_to_be64(op->byte_count << 3);
++ j += 2;
+ } else {
+- __le64 bits = op->byte_count << 3;
+- bf[j++] = lower_32_bits(bits);
+- bf[j++] = upper_32_bits(bits);
++ __le64 *bits = (__le64 *)&bf[j];
++ *bits = cpu_to_le64(op->byte_count << 3);
++ j += 2;
+ }
+ writesl(ss->base + SS_RXFIFO, bf, j);
+
+@@ -475,7 +476,7 @@ hash_final:
+ }
+ } else {
+ for (i = 0; i < 4; i++) {
+- v = readl(ss->base + SS_MD0 + i * 4);
++ v = cpu_to_le32(readl(ss->base + SS_MD0 + i * 4));
+ memcpy(areq->result + i * 4, &v, 4);
+ }
+ }
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 634ae487c372..db5f939f5aa3 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -974,8 +974,8 @@ static void ipsec_esp_unmap(struct device *dev,
+ DMA_FROM_DEVICE);
+ unmap_single_talitos_ptr(dev, civ_ptr, DMA_TO_DEVICE);
+
+- talitos_sg_unmap(dev, edesc, areq->src, areq->dst, cryptlen,
+- areq->assoclen);
++ talitos_sg_unmap(dev, edesc, areq->src, areq->dst,
++ cryptlen + authsize, areq->assoclen);
+
+ if (edesc->dma_len)
+ dma_unmap_single(dev, edesc->dma_link_tbl, edesc->dma_len,
+@@ -996,30 +996,15 @@ static void ipsec_esp_encrypt_done(struct device *dev,
+ struct talitos_desc *desc, void *context,
+ int err)
+ {
+- struct talitos_private *priv = dev_get_drvdata(dev);
+- bool is_sec1 = has_ftr_sec1(priv);
+ struct aead_request *areq = context;
+ struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
+- unsigned int authsize = crypto_aead_authsize(authenc);
+ unsigned int ivsize = crypto_aead_ivsize(authenc);
+ struct talitos_edesc *edesc;
+- void *icvdata;
+
+ edesc = container_of(desc, struct talitos_edesc, desc);
+
+ ipsec_esp_unmap(dev, edesc, areq, true);
+
+- /* copy the generated ICV to dst */
+- if (edesc->icv_ool) {
+- if (is_sec1)
+- icvdata = edesc->buf + areq->assoclen + areq->cryptlen;
+- else
+- icvdata = &edesc->link_tbl[edesc->src_nents +
+- edesc->dst_nents + 2];
+- sg_pcopy_from_buffer(areq->dst, edesc->dst_nents ? : 1, icvdata,
+- authsize, areq->assoclen + areq->cryptlen);
+- }
+-
+ dma_unmap_single(dev, edesc->iv_dma, ivsize, DMA_TO_DEVICE);
+
+ kfree(edesc);
+@@ -1036,39 +1021,15 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
+ unsigned int authsize = crypto_aead_authsize(authenc);
+ struct talitos_edesc *edesc;
+ char *oicv, *icv;
+- struct talitos_private *priv = dev_get_drvdata(dev);
+- bool is_sec1 = has_ftr_sec1(priv);
+
+ edesc = container_of(desc, struct talitos_edesc, desc);
+
+ ipsec_esp_unmap(dev, edesc, req, false);
+
+ if (!err) {
+- char icvdata[SHA512_DIGEST_SIZE];
+- int nents = edesc->dst_nents ? : 1;
+- unsigned int len = req->assoclen + req->cryptlen;
+-
+ /* auth check */
+- if (nents > 1) {
+- sg_pcopy_to_buffer(req->dst, nents, icvdata, authsize,
+- len - authsize);
+- icv = icvdata;
+- } else {
+- icv = (char *)sg_virt(req->dst) + len - authsize;
+- }
+-
+- if (edesc->dma_len) {
+- if (is_sec1)
+- oicv = (char *)&edesc->dma_link_tbl +
+- req->assoclen + req->cryptlen;
+- else
+- oicv = (char *)
+- &edesc->link_tbl[edesc->src_nents +
+- edesc->dst_nents + 2];
+- if (edesc->icv_ool)
+- icv = oicv + authsize;
+- } else
+- oicv = (char *)&edesc->link_tbl[0];
++ oicv = edesc->buf + edesc->dma_len;
++ icv = oicv - authsize;
+
+ err = crypto_memneq(oicv, icv, authsize) ? -EBADMSG : 0;
+ }
+@@ -1104,11 +1065,12 @@ static void ipsec_esp_decrypt_hwauth_done(struct device *dev,
+ * stop at cryptlen bytes
+ */
+ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
+- unsigned int offset, int cryptlen,
++ unsigned int offset, int datalen, int elen,
+ struct talitos_ptr *link_tbl_ptr)
+ {
+- int n_sg = sg_count;
++ int n_sg = elen ? sg_count + 1 : sg_count;
+ int count = 0;
++ int cryptlen = datalen + elen;
+
+ while (cryptlen && sg && n_sg--) {
+ unsigned int len = sg_dma_len(sg);
+@@ -1123,11 +1085,20 @@ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
+ if (len > cryptlen)
+ len = cryptlen;
+
++ if (datalen > 0 && len > datalen) {
++ to_talitos_ptr(link_tbl_ptr + count,
++ sg_dma_address(sg) + offset, datalen, 0);
++ to_talitos_ptr_ext_set(link_tbl_ptr + count, 0, 0);
++ count++;
++ len -= datalen;
++ offset += datalen;
++ }
+ to_talitos_ptr(link_tbl_ptr + count,
+ sg_dma_address(sg) + offset, len, 0);
+ to_talitos_ptr_ext_set(link_tbl_ptr + count, 0, 0);
+ count++;
+ cryptlen -= len;
++ datalen -= len;
+ offset = 0;
+
+ next:
+@@ -1137,7 +1108,7 @@ next:
+ /* tag end of link table */
+ if (count > 0)
+ to_talitos_ptr_ext_set(link_tbl_ptr + count - 1,
+- DESC_PTR_LNKTBL_RETURN, 0);
++ DESC_PTR_LNKTBL_RET, 0);
+
+ return count;
+ }
+@@ -1145,7 +1116,8 @@ next:
+ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ unsigned int len, struct talitos_edesc *edesc,
+ struct talitos_ptr *ptr, int sg_count,
+- unsigned int offset, int tbl_off, int elen)
++ unsigned int offset, int tbl_off, int elen,
++ bool force)
+ {
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
+@@ -1155,7 +1127,7 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ return 1;
+ }
+ to_talitos_ptr_ext_set(ptr, elen, is_sec1);
+- if (sg_count == 1) {
++ if (sg_count == 1 && !force) {
+ to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1);
+ return sg_count;
+ }
+@@ -1163,9 +1135,9 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, len, is_sec1);
+ return sg_count;
+ }
+- sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len + elen,
++ sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len, elen,
+ &edesc->link_tbl[tbl_off]);
+- if (sg_count == 1) {
++ if (sg_count == 1 && !force) {
+ /* Only one segment now, so no link tbl needed*/
+ copy_talitos_ptr(ptr, &edesc->link_tbl[tbl_off], is_sec1);
+ return sg_count;
+@@ -1183,7 +1155,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
+ unsigned int offset, int tbl_off)
+ {
+ return talitos_sg_map_ext(dev, src, len, edesc, ptr, sg_count, offset,
+- tbl_off, 0);
++ tbl_off, 0, false);
+ }
+
+ /*
+@@ -1211,6 +1183,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ bool is_ipsec_esp = desc->hdr & DESC_HDR_TYPE_IPSEC_ESP;
+ struct talitos_ptr *civ_ptr = &desc->ptr[is_ipsec_esp ? 2 : 3];
+ struct talitos_ptr *ckey_ptr = &desc->ptr[is_ipsec_esp ? 3 : 2];
++ dma_addr_t dma_icv = edesc->dma_link_tbl + edesc->dma_len - authsize;
+
+ /* hmac key */
+ to_talitos_ptr(&desc->ptr[0], ctx->dma_key, ctx->authkeylen, is_sec1);
+@@ -1250,7 +1223,8 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ elen = authsize;
+
+ ret = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[4],
+- sg_count, areq->assoclen, tbl_off, elen);
++ sg_count, areq->assoclen, tbl_off, elen,
++ false);
+
+ if (ret > 1) {
+ tbl_off += ret;
+@@ -1264,55 +1238,35 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ dma_map_sg(dev, areq->dst, sg_count, DMA_FROM_DEVICE);
+ }
+
+- ret = talitos_sg_map(dev, areq->dst, cryptlen, edesc, &desc->ptr[5],
+- sg_count, areq->assoclen, tbl_off);
+-
+- if (is_ipsec_esp)
+- to_talitos_ptr_ext_or(&desc->ptr[5], authsize, is_sec1);
++ if (is_ipsec_esp && encrypt)
++ elen = authsize;
++ else
++ elen = 0;
++ ret = talitos_sg_map_ext(dev, areq->dst, cryptlen, edesc, &desc->ptr[5],
++ sg_count, areq->assoclen, tbl_off, elen,
++ is_ipsec_esp && !encrypt);
++ tbl_off += ret;
+
+ /* ICV data */
+- if (ret > 1) {
+- tbl_off += ret;
+- edesc->icv_ool = true;
+- sync_needed = true;
++ edesc->icv_ool = !encrypt;
+
+- if (is_ipsec_esp) {
+- struct talitos_ptr *tbl_ptr = &edesc->link_tbl[tbl_off];
+- int offset = (edesc->src_nents + edesc->dst_nents + 2) *
+- sizeof(struct talitos_ptr) + authsize;
++ if (!encrypt && is_ipsec_esp) {
++ struct talitos_ptr *tbl_ptr = &edesc->link_tbl[tbl_off];
+
+- /* Add an entry to the link table for ICV data */
+- to_talitos_ptr_ext_set(tbl_ptr - 1, 0, is_sec1);
+- to_talitos_ptr_ext_set(tbl_ptr, DESC_PTR_LNKTBL_RETURN,
+- is_sec1);
++ /* Add an entry to the link table for ICV data */
++ to_talitos_ptr_ext_set(tbl_ptr - 1, 0, is_sec1);
++ to_talitos_ptr_ext_set(tbl_ptr, DESC_PTR_LNKTBL_RET, is_sec1);
+
+- /* icv data follows link tables */
+- to_talitos_ptr(tbl_ptr, edesc->dma_link_tbl + offset,
+- authsize, is_sec1);
+- } else {
+- dma_addr_t addr = edesc->dma_link_tbl;
+-
+- if (is_sec1)
+- addr += areq->assoclen + cryptlen;
+- else
+- addr += sizeof(struct talitos_ptr) * tbl_off;
+-
+- to_talitos_ptr(&desc->ptr[6], addr, authsize, is_sec1);
+- }
++ /* icv data follows link tables */
++ to_talitos_ptr(tbl_ptr, dma_icv, authsize, is_sec1);
++ to_talitos_ptr_ext_or(&desc->ptr[5], authsize, is_sec1);
++ sync_needed = true;
++ } else if (!encrypt) {
++ to_talitos_ptr(&desc->ptr[6], dma_icv, authsize, is_sec1);
++ sync_needed = true;
+ } else if (!is_ipsec_esp) {
+- ret = talitos_sg_map(dev, areq->dst, authsize, edesc,
+- &desc->ptr[6], sg_count, areq->assoclen +
+- cryptlen,
+- tbl_off);
+- if (ret > 1) {
+- tbl_off += ret;
+- edesc->icv_ool = true;
+- sync_needed = true;
+- } else {
+- edesc->icv_ool = false;
+- }
+- } else {
+- edesc->icv_ool = false;
++ talitos_sg_map(dev, areq->dst, authsize, edesc, &desc->ptr[6],
++ sg_count, areq->assoclen + cryptlen, tbl_off);
+ }
+
+ /* iv out */
+@@ -1395,18 +1349,18 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
+ * and space for two sets of ICVs (stashed and generated)
+ */
+ alloc_len = sizeof(struct talitos_edesc);
+- if (src_nents || dst_nents) {
++ if (src_nents || dst_nents || !encrypt) {
+ if (is_sec1)
+ dma_len = (src_nents ? src_len : 0) +
+- (dst_nents ? dst_len : 0);
++ (dst_nents ? dst_len : 0) + authsize;
+ else
+ dma_len = (src_nents + dst_nents + 2) *
+- sizeof(struct talitos_ptr) + authsize * 2;
++ sizeof(struct talitos_ptr) + authsize;
+ alloc_len += dma_len;
+ } else {
+ dma_len = 0;
+- alloc_len += icv_stashing ? authsize : 0;
+ }
++ alloc_len += icv_stashing ? authsize : 0;
+
+ /* if its a ahash, add space for a second desc next to the first one */
+ if (is_sec1 && !dst)
+@@ -1500,11 +1454,7 @@ static int aead_decrypt(struct aead_request *req)
+ edesc->desc.hdr = ctx->desc_hdr_template | DESC_HDR_DIR_INBOUND;
+
+ /* stash incoming ICV for later cmp with ICV generated by the h/w */
+- if (edesc->dma_len)
+- icvdata = (char *)&edesc->link_tbl[edesc->src_nents +
+- edesc->dst_nents + 2];
+- else
+- icvdata = &edesc->link_tbl[0];
++ icvdata = edesc->buf + edesc->dma_len;
+
+ sg_pcopy_to_buffer(req->src, edesc->src_nents ? : 1, icvdata, authsize,
+ req->assoclen + req->cryptlen - authsize);
+diff --git a/drivers/crypto/talitos.h b/drivers/crypto/talitos.h
+index 979f6a61e545..cb0137e131cc 100644
+--- a/drivers/crypto/talitos.h
++++ b/drivers/crypto/talitos.h
+@@ -442,5 +442,5 @@ static inline bool has_ftr_sec1(struct talitos_private *priv)
+
+ /* link table extent field bits */
+ #define DESC_PTR_LNKTBL_JUMP 0x80
+-#define DESC_PTR_LNKTBL_RETURN 0x02
++#define DESC_PTR_LNKTBL_RET 0x02
+ #define DESC_PTR_LNKTBL_NEXT 0x01
+diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
+index 15b2453d2647..b2c755b74bea 100644
+--- a/drivers/dma/dma-axi-dmac.c
++++ b/drivers/dma/dma-axi-dmac.c
+@@ -486,7 +486,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
+
+ if (chan->hw_2d) {
+ if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
+- !axi_dmac_check_len(chan, xt->numf))
++ xt->numf == 0)
+ return NULL;
+ if (xt->sgl[0].size + dst_icg > chan->max_length ||
+ xt->sgl[0].size + src_icg > chan->max_length)
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index c299ff181bb6..62218ea0894c 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -87,13 +87,20 @@ static void dw_dma_acpi_controller_register(struct dw_dma *dw)
+ dma_cap_set(DMA_SLAVE, info->dma_cap);
+ info->filter_fn = dw_dma_acpi_filter;
+
+- ret = devm_acpi_dma_controller_register(dev, acpi_dma_simple_xlate,
+- info);
++ ret = acpi_dma_controller_register(dev, acpi_dma_simple_xlate, info);
+ if (ret)
+ dev_err(dev, "could not register acpi_dma_controller\n");
+ }
++
++static void dw_dma_acpi_controller_free(struct dw_dma *dw)
++{
++ struct device *dev = dw->dma.dev;
++
++ acpi_dma_controller_free(dev);
++}
+ #else /* !CONFIG_ACPI */
+ static inline void dw_dma_acpi_controller_register(struct dw_dma *dw) {}
++static inline void dw_dma_acpi_controller_free(struct dw_dma *dw) {}
+ #endif /* !CONFIG_ACPI */
+
+ #ifdef CONFIG_OF
+@@ -249,6 +256,9 @@ static int dw_remove(struct platform_device *pdev)
+ {
+ struct dw_dma_chip *chip = platform_get_drvdata(pdev);
+
++ if (ACPI_HANDLE(&pdev->dev))
++ dw_dma_acpi_controller_free(chip->dw);
++
+ if (pdev->dev.of_node)
+ of_dma_controller_free(pdev->dev.of_node);
+
+diff --git a/drivers/dma/hsu/hsu.c b/drivers/dma/hsu/hsu.c
+index 202ffa9f7611..18f155a974db 100644
+--- a/drivers/dma/hsu/hsu.c
++++ b/drivers/dma/hsu/hsu.c
+@@ -64,10 +64,10 @@ static void hsu_dma_chan_start(struct hsu_dma_chan *hsuc)
+
+ if (hsuc->direction == DMA_MEM_TO_DEV) {
+ bsr = config->dst_maxburst;
+- mtsr = config->src_addr_width;
++ mtsr = config->dst_addr_width;
+ } else if (hsuc->direction == DMA_DEV_TO_MEM) {
+ bsr = config->src_maxburst;
+- mtsr = config->dst_addr_width;
++ mtsr = config->src_addr_width;
+ }
+
+ hsu_chan_disable(hsuc);
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index 3f5a01cb4ab4..ceb82e74f5b4 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -1662,6 +1662,14 @@ static void sdma_add_scripts(struct sdma_engine *sdma,
+ if (!sdma->script_number)
+ sdma->script_number = SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V1;
+
++ if (sdma->script_number > sizeof(struct sdma_script_start_addrs)
++ / sizeof(s32)) {
++ dev_err(sdma->dev,
++ "SDMA script number %d not match with firmware.\n",
++ sdma->script_number);
++ return;
++ }
++
+ for (i = 0; i < sdma->script_number; i++)
+ if (addr_arr[i] > 0)
+ saddr_arr[i] = addr_arr[i];
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index 969534c1a6c6..abc8d3e0487b 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -1059,6 +1059,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ mv_chan->op_in_desc = XOR_MODE_IN_DESC;
+
+ dma_dev = &mv_chan->dmadev;
++ dma_dev->dev = &pdev->dev;
+ mv_chan->xordev = xordev;
+
+ /*
+@@ -1091,7 +1092,6 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ dma_dev->device_free_chan_resources = mv_xor_free_chan_resources;
+ dma_dev->device_tx_status = mv_xor_status;
+ dma_dev->device_issue_pending = mv_xor_issue_pending;
+- dma_dev->dev = &pdev->dev;
+
+ /* set prep routines based on capability */
+ if (dma_has_cap(DMA_INTERRUPT, dma_dev->cap_mask))
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index 09b6756366c3..4f4733d831a1 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -98,6 +98,7 @@ struct tegra_adma_chan_regs {
+ unsigned int src_addr;
+ unsigned int trg_addr;
+ unsigned int fifo_ctrl;
++ unsigned int cmd;
+ unsigned int tc;
+ };
+
+@@ -127,6 +128,7 @@ struct tegra_adma_chan {
+ enum dma_transfer_direction sreq_dir;
+ unsigned int sreq_index;
+ bool sreq_reserved;
++ struct tegra_adma_chan_regs ch_regs;
+
+ /* Transfer count and position info */
+ unsigned int tx_buf_count;
+@@ -635,8 +637,30 @@ static struct dma_chan *tegra_dma_of_xlate(struct of_phandle_args *dma_spec,
+ static int tegra_adma_runtime_suspend(struct device *dev)
+ {
+ struct tegra_adma *tdma = dev_get_drvdata(dev);
++ struct tegra_adma_chan_regs *ch_reg;
++ struct tegra_adma_chan *tdc;
++ int i;
+
+ tdma->global_cmd = tdma_read(tdma, ADMA_GLOBAL_CMD);
++ if (!tdma->global_cmd)
++ goto clk_disable;
++
++ for (i = 0; i < tdma->nr_channels; i++) {
++ tdc = &tdma->channels[i];
++ ch_reg = &tdc->ch_regs;
++ ch_reg->cmd = tdma_ch_read(tdc, ADMA_CH_CMD);
++ /* skip if channel is not active */
++ if (!ch_reg->cmd)
++ continue;
++ ch_reg->tc = tdma_ch_read(tdc, ADMA_CH_TC);
++ ch_reg->src_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_SRC_ADDR);
++ ch_reg->trg_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_TRG_ADDR);
++ ch_reg->ctrl = tdma_ch_read(tdc, ADMA_CH_CTRL);
++ ch_reg->fifo_ctrl = tdma_ch_read(tdc, ADMA_CH_FIFO_CTRL);
++ ch_reg->config = tdma_ch_read(tdc, ADMA_CH_CONFIG);
++ }
++
++clk_disable:
+ clk_disable_unprepare(tdma->ahub_clk);
+
+ return 0;
+@@ -645,7 +669,9 @@ static int tegra_adma_runtime_suspend(struct device *dev)
+ static int tegra_adma_runtime_resume(struct device *dev)
+ {
+ struct tegra_adma *tdma = dev_get_drvdata(dev);
+- int ret;
++ struct tegra_adma_chan_regs *ch_reg;
++ struct tegra_adma_chan *tdc;
++ int ret, i;
+
+ ret = clk_prepare_enable(tdma->ahub_clk);
+ if (ret) {
+@@ -654,6 +680,24 @@ static int tegra_adma_runtime_resume(struct device *dev)
+ }
+ tdma_write(tdma, ADMA_GLOBAL_CMD, tdma->global_cmd);
+
++ if (!tdma->global_cmd)
++ return 0;
++
++ for (i = 0; i < tdma->nr_channels; i++) {
++ tdc = &tdma->channels[i];
++ ch_reg = &tdc->ch_regs;
++ /* skip if channel was not active earlier */
++ if (!ch_reg->cmd)
++ continue;
++ tdma_ch_write(tdc, ADMA_CH_TC, ch_reg->tc);
++ tdma_ch_write(tdc, ADMA_CH_LOWER_SRC_ADDR, ch_reg->src_addr);
++ tdma_ch_write(tdc, ADMA_CH_LOWER_TRG_ADDR, ch_reg->trg_addr);
++ tdma_ch_write(tdc, ADMA_CH_CTRL, ch_reg->ctrl);
++ tdma_ch_write(tdc, ADMA_CH_FIFO_CTRL, ch_reg->fifo_ctrl);
++ tdma_ch_write(tdc, ADMA_CH_CONFIG, ch_reg->config);
++ tdma_ch_write(tdc, ADMA_CH_CMD, ch_reg->cmd);
++ }
++
+ return 0;
+ }
+
+@@ -700,16 +744,6 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ return PTR_ERR(tdma->ahub_clk);
+ }
+
+- pm_runtime_enable(&pdev->dev);
+-
+- ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0)
+- goto rpm_disable;
+-
+- ret = tegra_adma_init(tdma);
+- if (ret)
+- goto rpm_put;
+-
+ INIT_LIST_HEAD(&tdma->dma_dev.channels);
+ for (i = 0; i < tdma->nr_channels; i++) {
+ struct tegra_adma_chan *tdc = &tdma->channels[i];
+@@ -727,6 +761,16 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ tdc->tdma = tdma;
+ }
+
++ pm_runtime_enable(&pdev->dev);
++
++ ret = pm_runtime_get_sync(&pdev->dev);
++ if (ret < 0)
++ goto rpm_disable;
++
++ ret = tegra_adma_init(tdma);
++ if (ret)
++ goto rpm_put;
++
+ dma_cap_set(DMA_SLAVE, tdma->dma_dev.cap_mask);
+ dma_cap_set(DMA_PRIVATE, tdma->dma_dev.cap_mask);
+ dma_cap_set(DMA_CYCLIC, tdma->dma_dev.cap_mask);
+@@ -768,13 +812,13 @@ static int tegra_adma_probe(struct platform_device *pdev)
+
+ dma_remove:
+ dma_async_device_unregister(&tdma->dma_dev);
+-irq_dispose:
+- while (--i >= 0)
+- irq_dispose_mapping(tdma->channels[i].irq);
+ rpm_put:
+ pm_runtime_put_sync(&pdev->dev);
+ rpm_disable:
+ pm_runtime_disable(&pdev->dev);
++irq_dispose:
++ while (--i >= 0)
++ irq_dispose_mapping(tdma->channels[i].irq);
+
+ return ret;
+ }
+diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
+index 982631d4e1f8..44158fa85973 100644
+--- a/drivers/dma/ti/edma.c
++++ b/drivers/dma/ti/edma.c
+@@ -2345,8 +2345,10 @@ static int edma_probe(struct platform_device *pdev)
+
+ ecc->tc_list = devm_kcalloc(dev, ecc->num_tc,
+ sizeof(*ecc->tc_list), GFP_KERNEL);
+- if (!ecc->tc_list)
+- return -ENOMEM;
++ if (!ecc->tc_list) {
++ ret = -ENOMEM;
++ goto err_reg1;
++ }
+
+ for (i = 0;; i++) {
+ ret = of_parse_phandle_with_fixed_args(node, "ti,tptcs",
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index f59511bd9926..fd440b35d76e 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -681,22 +681,18 @@ static int del_mc_from_global_list(struct mem_ctl_info *mci)
+
+ struct mem_ctl_info *edac_mc_find(int idx)
+ {
+- struct mem_ctl_info *mci = NULL;
++ struct mem_ctl_info *mci;
+ struct list_head *item;
+
+ mutex_lock(&mem_ctls_mutex);
+
+ list_for_each(item, &mc_devices) {
+ mci = list_entry(item, struct mem_ctl_info, link);
+-
+- if (mci->mc_idx >= idx) {
+- if (mci->mc_idx == idx) {
+- goto unlock;
+- }
+- break;
+- }
++ if (mci->mc_idx == idx)
++ goto unlock;
+ }
+
++ mci = NULL;
+ unlock:
+ mutex_unlock(&mem_ctls_mutex);
+ return mci;
+diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c
+index 30fc04e28431..0a194af92438 100644
+--- a/drivers/firmware/arm_scmi/clock.c
++++ b/drivers/firmware/arm_scmi/clock.c
+@@ -185,6 +185,8 @@ scmi_clock_describe_rates_get(const struct scmi_handle *handle, u32 clk_id,
+ if (rate_discrete)
+ clk->list.num_rates = tot_rate_cnt;
+
++ clk->rate_discrete = rate_discrete;
++
+ err:
+ scmi_xfer_put(handle, t);
+ return ret;
+diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
+index 09119e3f5c01..effc4c17e0fb 100644
+--- a/drivers/firmware/arm_scmi/driver.c
++++ b/drivers/firmware/arm_scmi/driver.c
+@@ -662,9 +662,7 @@ static int scmi_xfer_info_init(struct scmi_info *sinfo)
+
+ static int scmi_mailbox_check(struct device_node *np)
+ {
+- struct of_phandle_args arg;
+-
+- return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, &arg);
++ return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, NULL);
+ }
+
+ static int scmi_mbox_free_channel(int id, void *p, void *data)
+diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c
+index b53d5cc9c9f6..c00287b5f2c2 100644
+--- a/drivers/firmware/arm_scmi/sensors.c
++++ b/drivers/firmware/arm_scmi/sensors.c
+@@ -30,10 +30,10 @@ struct scmi_msg_resp_sensor_description {
+ __le32 id;
+ __le32 attributes_low;
+ #define SUPPORTS_ASYNC_READ(x) ((x) & BIT(31))
+-#define NUM_TRIP_POINTS(x) (((x) >> 4) & 0xff)
++#define NUM_TRIP_POINTS(x) ((x) & 0xff)
+ __le32 attributes_high;
+ #define SENSOR_TYPE(x) ((x) & 0xff)
+-#define SENSOR_SCALE(x) (((x) >> 11) & 0x3f)
++#define SENSOR_SCALE(x) (((x) >> 11) & 0x1f)
+ #define SENSOR_UPDATE_SCALE(x) (((x) >> 22) & 0x1f)
+ #define SENSOR_UPDATE_BASE(x) (((x) >> 27) & 0x1f)
+ u8 name[SCMI_MAX_STR_SIZE];
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index f2483548cde9..0dc0c78f1fdb 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -407,7 +407,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
+ bytes = ~0ull;
+ else if (size & 0x8000)
+ bytes = (u64)(size & 0x7fff) << 10;
+- else if (size != 0x7fff)
++ else if (size != 0x7fff || dm->length < 0x20)
+ bytes = (u64)size << 20;
+ else
+ bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20;
+diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
+index 1606abead22c..b0aeffd4e269 100644
+--- a/drivers/firmware/efi/runtime-wrappers.c
++++ b/drivers/firmware/efi/runtime-wrappers.c
+@@ -95,7 +95,7 @@ struct efi_runtime_work {
+ efi_rts_work.status = EFI_ABORTED; \
+ \
+ init_completion(&efi_rts_work.efi_rts_comp); \
+- INIT_WORK(&efi_rts_work.work, efi_call_rts); \
++ INIT_WORK_ONSTACK(&efi_rts_work.work, efi_call_rts); \
+ efi_rts_work.arg1 = _arg1; \
+ efi_rts_work.arg2 = _arg2; \
+ efi_rts_work.arg3 = _arg3; \
+diff --git a/drivers/firmware/google/coreboot_table-of.c b/drivers/firmware/google/coreboot_table-of.c
+index f15bf404c579..9b90c0fa4a0b 100644
+--- a/drivers/firmware/google/coreboot_table-of.c
++++ b/drivers/firmware/google/coreboot_table-of.c
+@@ -19,7 +19,6 @@
+ #include <linux/io.h>
+ #include <linux/module.h>
+ #include <linux/of_address.h>
+-#include <linux/of_platform.h>
+ #include <linux/platform_device.h>
+
+ #include "coreboot_table.h"
+@@ -30,7 +29,6 @@ static int coreboot_table_of_probe(struct platform_device *pdev)
+ void __iomem *ptr;
+
+ ptr = of_iomap(fw_dn, 0);
+- of_node_put(fw_dn);
+ if (!ptr)
+ return -ENOMEM;
+
+@@ -44,8 +42,9 @@ static int coreboot_table_of_remove(struct platform_device *pdev)
+
+ static const struct of_device_id coreboot_of_match[] = {
+ { .compatible = "coreboot" },
+- {},
++ {}
+ };
++MODULE_DEVICE_TABLE(of, coreboot_of_match);
+
+ static struct platform_driver coreboot_table_of_driver = {
+ .probe = coreboot_table_of_probe,
+@@ -55,28 +54,7 @@ static struct platform_driver coreboot_table_of_driver = {
+ .of_match_table = coreboot_of_match,
+ },
+ };
+-
+-static int __init platform_coreboot_table_of_init(void)
+-{
+- struct platform_device *pdev;
+- struct device_node *of_node;
+-
+- /* Limit device creation to the presence of /firmware/coreboot node */
+- of_node = of_find_node_by_path("/firmware/coreboot");
+- if (!of_node)
+- return -ENODEV;
+-
+- if (!of_match_node(coreboot_of_match, of_node))
+- return -ENODEV;
+-
+- pdev = of_platform_device_create(of_node, "coreboot_table_of", NULL);
+- if (!pdev)
+- return -ENODEV;
+-
+- return platform_driver_register(&coreboot_table_of_driver);
+-}
+-
+-module_init(platform_coreboot_table_of_init);
++module_platform_driver(coreboot_table_of_driver);
+
+ MODULE_AUTHOR("Google, Inc.");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c
+index c6fa9b393e84..bd62236d3f97 100644
+--- a/drivers/fsi/fsi-core.c
++++ b/drivers/fsi/fsi-core.c
+@@ -1060,6 +1060,14 @@ static int fsi_slave_init(struct fsi_master *master, int link, uint8_t id)
+
+ }
+
++ rc = fsi_slave_set_smode(slave);
++ if (rc) {
++ dev_warn(&master->dev,
++ "can't set smode on slave:%02x:%02x %d\n",
++ link, id, rc);
++ goto err_free;
++ }
++
+ /* Allocate a minor in the FSI space */
+ rc = __fsi_get_new_minor(slave, fsi_dev_cfam, &slave->dev.devt,
+ &slave->cdev_idx);
+@@ -1071,17 +1079,14 @@ static int fsi_slave_init(struct fsi_master *master, int link, uint8_t id)
+ rc = cdev_device_add(&slave->cdev, &slave->dev);
+ if (rc) {
+ dev_err(&slave->dev, "Error %d creating slave device\n", rc);
+- goto err_free;
++ goto err_free_ida;
+ }
+
+- rc = fsi_slave_set_smode(slave);
+- if (rc) {
+- dev_warn(&master->dev,
+- "can't set smode on slave:%02x:%02x %d\n",
+- link, id, rc);
+- kfree(slave);
+- return -ENODEV;
+- }
++ /* Now that we have the cdev registered with the core, any fatal
++ * failures beyond this point will need to clean up through
++ * cdev_device_del(). Fortunately though, nothing past here is fatal.
++ */
++
+ if (master->link_config)
+ master->link_config(master, link,
+ slave->t_send_delay,
+@@ -1098,10 +1103,13 @@ static int fsi_slave_init(struct fsi_master *master, int link, uint8_t id)
+ dev_dbg(&master->dev, "failed during slave scan with: %d\n",
+ rc);
+
+- return rc;
++ return 0;
+
+- err_free:
+- put_device(&slave->dev);
++err_free_ida:
++ fsi_free_minor(slave->dev.devt);
++err_free:
++ of_node_put(slave->dev.of_node);
++ kfree(slave);
+ return rc;
+ }
+
+diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
+index ae861342626e..9fa3959e0855 100644
+--- a/drivers/fsi/fsi-sbefifo.c
++++ b/drivers/fsi/fsi-sbefifo.c
+@@ -289,11 +289,11 @@ static int sbefifo_check_sbe_state(struct sbefifo *sbefifo)
+ switch ((sbm & CFAM_SBM_SBE_STATE_MASK) >> CFAM_SBM_SBE_STATE_SHIFT) {
+ case SBE_STATE_UNKNOWN:
+ return -ESHUTDOWN;
++ case SBE_STATE_DMT:
++ return -EBUSY;
+ case SBE_STATE_IPLING:
+ case SBE_STATE_ISTEP:
+ case SBE_STATE_MPIPL:
+- case SBE_STATE_DMT:
+- return -EBUSY;
+ case SBE_STATE_RUNTIME:
+ case SBE_STATE_DUMP: /* Not sure about that one */
+ break;
+diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
+index b696ec35efb3..e627e0e9001a 100644
+--- a/drivers/gpio/gpio-aspeed.c
++++ b/drivers/gpio/gpio-aspeed.c
+@@ -1199,7 +1199,7 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev)
+ gpio->chip.irq.need_valid_mask = true;
+
+ /* Allocate a cache of the output registers */
+- banks = gpio->config->nr_gpios >> 5;
++ banks = DIV_ROUND_UP(gpio->config->nr_gpios, 32);
+ gpio->dcache = devm_kcalloc(&pdev->dev,
+ banks, sizeof(u32), GFP_KERNEL);
+ if (!gpio->dcache)
+diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c
+index f973d287696a..da5abf24f59f 100644
+--- a/drivers/gpu/drm/drm_context.c
++++ b/drivers/gpu/drm/drm_context.c
+@@ -361,23 +361,26 @@ int drm_legacy_addctx(struct drm_device *dev, void *data,
+ {
+ struct drm_ctx_list *ctx_entry;
+ struct drm_ctx *ctx = data;
++ int tmp_handle;
+
+ if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) &&
+ !drm_core_check_feature(dev, DRIVER_LEGACY))
+ return -EINVAL;
+
+- ctx->handle = drm_legacy_ctxbitmap_next(dev);
+- if (ctx->handle == DRM_KERNEL_CONTEXT) {
++ tmp_handle = drm_legacy_ctxbitmap_next(dev);
++ if (tmp_handle == DRM_KERNEL_CONTEXT) {
+ /* Skip kernel's context and get a new one. */
+- ctx->handle = drm_legacy_ctxbitmap_next(dev);
++ tmp_handle = drm_legacy_ctxbitmap_next(dev);
+ }
+- DRM_DEBUG("%d\n", ctx->handle);
+- if (ctx->handle < 0) {
++ DRM_DEBUG("%d\n", tmp_handle);
++ if (tmp_handle < 0) {
+ DRM_DEBUG("Not enough free contexts.\n");
+ /* Should this return -EBUSY instead? */
+- return -ENOMEM;
++ return tmp_handle;
+ }
+
++ ctx->handle = tmp_handle;
++
+ ctx_entry = kmalloc(sizeof(*ctx_entry), GFP_KERNEL);
+ if (!ctx_entry) {
+ DRM_DEBUG("out of memory\n");
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 4d7715845306..58fe3945494c 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1022,9 +1022,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
+ static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
+ {
+ struct drm_dp_mst_port *rport = NULL;
++
+ mutex_lock(&mgr->lock);
+- if (mgr->mst_primary)
+- rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
++ /*
++ * Port may or may not be 'valid' but we don't care about that when
++ * destroying the port and we are guaranteed that the port pointer
++ * will be valid until we've finished
++ */
++ if (current_work() == &mgr->destroy_connector_work) {
++ kref_get(&port->kref);
++ rport = port;
++ } else if (mgr->mst_primary) {
++ rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
++ port);
++ }
+ mutex_unlock(&mgr->lock);
+ return rport;
+ }
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index f57fc1450b61..da9a381d6b57 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -2979,18 +2979,16 @@ static int drm_fbdev_fb_release(struct fb_info *info, int user)
+ return 0;
+ }
+
+-/*
+- * fb_ops.fb_destroy is called by the last put_fb_info() call at the end of
+- * unregister_framebuffer() or fb_release().
+- */
+-static void drm_fbdev_fb_destroy(struct fb_info *info)
++static void drm_fbdev_cleanup(struct drm_fb_helper *fb_helper)
+ {
+- struct drm_fb_helper *fb_helper = info->par;
+ struct fb_info *fbi = fb_helper->fbdev;
+ struct fb_ops *fbops = NULL;
+ void *shadow = NULL;
+
+- if (fbi->fbdefio) {
++ if (!fb_helper->dev)
++ return;
++
++ if (fbi && fbi->fbdefio) {
+ fb_deferred_io_cleanup(fbi);
+ shadow = fbi->screen_buffer;
+ fbops = fbi->fbops;
+@@ -3004,6 +3002,12 @@ static void drm_fbdev_fb_destroy(struct fb_info *info)
+ }
+
+ drm_client_framebuffer_delete(fb_helper->buffer);
++}
++
++static void drm_fbdev_release(struct drm_fb_helper *fb_helper)
++{
++ drm_fbdev_cleanup(fb_helper);
++
+ /*
+ * FIXME:
+ * Remove conditional when all CMA drivers have been moved over to using
+@@ -3015,6 +3019,15 @@ static void drm_fbdev_fb_destroy(struct fb_info *info)
+ }
+ }
+
++/*
++ * fb_ops.fb_destroy is called by the last put_fb_info() call at the end of
++ * unregister_framebuffer() or fb_release().
++ */
++static void drm_fbdev_fb_destroy(struct fb_info *info)
++{
++ drm_fbdev_release(info->par);
++}
++
+ static int drm_fbdev_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
+ {
+ struct drm_fb_helper *fb_helper = info->par;
+@@ -3065,7 +3078,6 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
+ struct drm_framebuffer *fb;
+ struct fb_info *fbi;
+ u32 format;
+- int ret;
+
+ DRM_DEBUG_KMS("surface width(%d), height(%d) and bpp(%d)\n",
+ sizes->surface_width, sizes->surface_height,
+@@ -3082,10 +3094,8 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
+ fb = buffer->fb;
+
+ fbi = drm_fb_helper_alloc_fbi(fb_helper);
+- if (IS_ERR(fbi)) {
+- ret = PTR_ERR(fbi);
+- goto err_free_buffer;
+- }
++ if (IS_ERR(fbi))
++ return PTR_ERR(fbi);
+
+ fbi->par = fb_helper;
+ fbi->fbops = &drm_fbdev_fb_ops;
+@@ -3116,8 +3126,7 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
+ if (!fbops || !shadow) {
+ kfree(fbops);
+ vfree(shadow);
+- ret = -ENOMEM;
+- goto err_fb_info_destroy;
++ return -ENOMEM;
+ }
+
+ *fbops = *fbi->fbops;
+@@ -3129,13 +3138,6 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
+ }
+
+ return 0;
+-
+-err_fb_info_destroy:
+- drm_fb_helper_fini(fb_helper);
+-err_free_buffer:
+- drm_client_framebuffer_delete(buffer);
+-
+- return ret;
+ }
+ EXPORT_SYMBOL(drm_fb_helper_generic_probe);
+
+@@ -3147,18 +3149,11 @@ static void drm_fbdev_client_unregister(struct drm_client_dev *client)
+ {
+ struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
+
+- if (fb_helper->fbdev) {
+- drm_fb_helper_unregister_fbi(fb_helper);
++ if (fb_helper->fbdev)
+ /* drm_fbdev_fb_destroy() takes care of cleanup */
+- return;
+- }
+-
+- /* Did drm_fb_helper_fbdev_setup() run? */
+- if (fb_helper->dev)
+- drm_fb_helper_fini(fb_helper);
+-
+- drm_client_release(client);
+- kfree(fb_helper);
++ drm_fb_helper_unregister_fbi(fb_helper);
++ else
++ drm_fbdev_release(fb_helper);
+ }
+
+ static int drm_fbdev_client_restore(struct drm_client_dev *client)
+@@ -3174,7 +3169,7 @@ static int drm_fbdev_client_hotplug(struct drm_client_dev *client)
+ struct drm_device *dev = client->dev;
+ int ret;
+
+- /* If drm_fb_helper_fbdev_setup() failed, we only try once */
++ /* Setup is not retried if it has failed */
+ if (!fb_helper->dev && fb_helper->funcs)
+ return 0;
+
+@@ -3184,15 +3179,34 @@ static int drm_fbdev_client_hotplug(struct drm_client_dev *client)
+ if (!dev->mode_config.num_connector)
+ return 0;
+
+- ret = drm_fb_helper_fbdev_setup(dev, fb_helper, &drm_fb_helper_generic_funcs,
+- fb_helper->preferred_bpp, 0);
+- if (ret) {
+- fb_helper->dev = NULL;
+- fb_helper->fbdev = NULL;
+- return ret;
+- }
++ drm_fb_helper_prepare(dev, fb_helper, &drm_fb_helper_generic_funcs);
++
++ ret = drm_fb_helper_init(dev, fb_helper, dev->mode_config.num_connector);
++ if (ret)
++ goto err;
++
++ ret = drm_fb_helper_single_add_all_connectors(fb_helper);
++ if (ret)
++ goto err_cleanup;
++
++ if (!drm_drv_uses_atomic_modeset(dev))
++ drm_helper_disable_unused_functions(dev);
++
++ ret = drm_fb_helper_initial_config(fb_helper, fb_helper->preferred_bpp);
++ if (ret)
++ goto err_cleanup;
+
+ return 0;
++
++err_cleanup:
++ drm_fbdev_cleanup(fb_helper);
++err:
++ fb_helper->dev = NULL;
++ fb_helper->fbdev = NULL;
++
++ DRM_DEV_ERROR(dev->dev, "fbdev: Failed to setup generic emulation (ret=%d)\n", ret);
++
++ return ret;
+ }
+
+ static const struct drm_client_funcs drm_fbdev_client_funcs = {
+@@ -3243,12 +3257,16 @@ int drm_fbdev_generic_setup(struct drm_device *dev, unsigned int preferred_bpp)
+ return ret;
+ }
+
+- drm_client_add(&fb_helper->client);
+-
++ if (!preferred_bpp)
++ preferred_bpp = dev->mode_config.preferred_depth;
++ if (!preferred_bpp)
++ preferred_bpp = 32;
+ fb_helper->preferred_bpp = preferred_bpp;
+
+ drm_fbdev_client_hotplug(&fb_helper->client);
+
++ drm_client_add(&fb_helper->client);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(drm_fbdev_generic_setup);
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+index 468dff2f7904..9d839b4fd8f7 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+@@ -217,7 +217,7 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
+ mutex_lock(&obj->lock);
+ pages = etnaviv_gem_get_pages(obj);
+ mutex_unlock(&obj->lock);
+- if (pages) {
++ if (!IS_ERR(pages)) {
+ int j;
+
+ iter.hdr->data[0] = bomap - bomap_start;
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+index 0566171f8df2..f21529e635e3 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+@@ -15,7 +15,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj)
+ int npages = obj->size >> PAGE_SHIFT;
+
+ if (WARN_ON(!etnaviv_obj->pages)) /* should have already pinned! */
+- return NULL;
++ return ERR_PTR(-EINVAL);
+
+ return drm_prime_pages_to_sg(etnaviv_obj->pages, npages);
+ }
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
+index 9980d81a26e3..4227a4006c34 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
+@@ -113,7 +113,7 @@ static const struct etnaviv_pm_domain doms_3d[] = {
+ .name = "PE",
+ .profile_read = VIVS_MC_PROFILE_PE_READ,
+ .profile_config = VIVS_MC_PROFILE_CONFIG0,
+- .nr_signals = 5,
++ .nr_signals = 4,
+ .signal = (const struct etnaviv_pm_signal[]) {
+ {
+ "PIXEL_COUNT_KILLED_BY_COLOR_PIPE",
+@@ -435,7 +435,7 @@ int etnaviv_pm_query_sig(struct etnaviv_gpu *gpu,
+
+ dom = meta->domains + signal->domain;
+
+- if (signal->iter > dom->nr_signals)
++ if (signal->iter >= dom->nr_signals)
+ return -EINVAL;
+
+ sig = &dom->signal[signal->iter];
+@@ -461,7 +461,7 @@ int etnaviv_pm_req_validate(const struct drm_etnaviv_gem_submit_pmr *r,
+
+ dom = meta->domains + r->domain;
+
+- if (r->signal > dom->nr_signals)
++ if (r->signal >= dom->nr_signals)
+ return -EINVAL;
+
+ return 0;
+diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+index 8bd29075ae4e..edcca1761500 100644
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+@@ -71,7 +71,6 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
+ DRM_DEBUG_DRIVER("surface width(%d), height(%d) and bpp(%d)\n",
+ sizes->surface_width, sizes->surface_height,
+ sizes->surface_bpp);
+- sizes->surface_depth = 32;
+
+ bytes_per_pixel = DIV_ROUND_UP(sizes->surface_bpp, 8);
+
+diff --git a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+index 669c2d4b070d..5c068301d817 100644
+--- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+@@ -395,19 +395,17 @@ static const unsigned int a3xx_registers[] = {
+ 0x2200, 0x2212, 0x2214, 0x2217, 0x221a, 0x221a, 0x2240, 0x227e,
+ 0x2280, 0x228b, 0x22c0, 0x22c0, 0x22c4, 0x22ce, 0x22d0, 0x22d8,
+ 0x22df, 0x22e6, 0x22e8, 0x22e9, 0x22ec, 0x22ec, 0x22f0, 0x22f7,
+- 0x22ff, 0x22ff, 0x2340, 0x2343, 0x2348, 0x2349, 0x2350, 0x2356,
+- 0x2360, 0x2360, 0x2440, 0x2440, 0x2444, 0x2444, 0x2448, 0x244d,
+- 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470, 0x2472, 0x2472,
+- 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3, 0x24e4, 0x24ef,
+- 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e, 0x2510, 0x2511,
+- 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea, 0x25ec, 0x25ed,
+- 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617, 0x261a, 0x261a,
+- 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0, 0x26c4, 0x26ce,
+- 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9, 0x26ec, 0x26ec,
+- 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743, 0x2748, 0x2749,
+- 0x2750, 0x2756, 0x2760, 0x2760, 0x300c, 0x300e, 0x301c, 0x301d,
+- 0x302a, 0x302a, 0x302c, 0x302d, 0x3030, 0x3031, 0x3034, 0x3036,
+- 0x303c, 0x303c, 0x305e, 0x305f,
++ 0x22ff, 0x22ff, 0x2340, 0x2343, 0x2440, 0x2440, 0x2444, 0x2444,
++ 0x2448, 0x244d, 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470,
++ 0x2472, 0x2472, 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3,
++ 0x24e4, 0x24ef, 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e,
++ 0x2510, 0x2511, 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea,
++ 0x25ec, 0x25ed, 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617,
++ 0x261a, 0x261a, 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0,
++ 0x26c4, 0x26ce, 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9,
++ 0x26ec, 0x26ec, 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743,
++ 0x300c, 0x300e, 0x301c, 0x301d, 0x302a, 0x302a, 0x302c, 0x302d,
++ 0x3030, 0x3031, 0x3034, 0x3036, 0x303c, 0x303c, 0x305e, 0x305f,
+ ~0 /* sentinel */
+ };
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+index 06be7cf7ce50..79bafea66354 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+@@ -310,7 +310,7 @@ static void dpu_hw_ctl_setup_blendstage(struct dpu_hw_ctl *ctx,
+ u32 mixercfg = 0, mixercfg_ext = 0, mix, ext;
+ u32 mixercfg_ext2 = 0, mixercfg_ext3 = 0;
+ int i, j;
+- u8 stages;
++ int stages;
+ int pipes_per_stage;
+
+ stages = _mixer_stages(ctx->mixer_hw_caps, ctx->mixer_count, lm);
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
+index 824067d2d427..42f0ecb0cf35 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
+@@ -635,7 +635,7 @@ fail:
+ if (cfg_handler)
+ mdp5_cfg_destroy(cfg_handler);
+
+- return NULL;
++ return ERR_PTR(ret);
+ }
+
+ static struct mdp5_cfg_platform *mdp5_get_config(struct platform_device *dev)
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index cc4ea5502d6c..3b78bca0bb4d 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -34,6 +34,8 @@
+ #include "dsi_cfg.h"
+ #include "msm_kms.h"
+
++#define DSI_RESET_TOGGLE_DELAY_MS 20
++
+ static int dsi_get_version(const void __iomem *base, u32 *major, u32 *minor)
+ {
+ u32 ver;
+@@ -994,7 +996,7 @@ static void dsi_sw_reset(struct msm_dsi_host *msm_host)
+ wmb(); /* clocks need to be enabled before reset */
+
+ dsi_write(msm_host, REG_DSI_RESET, 1);
+- wmb(); /* make sure reset happen */
++ msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
+ dsi_write(msm_host, REG_DSI_RESET, 0);
+ }
+
+@@ -1402,7 +1404,7 @@ static void dsi_sw_reset_restore(struct msm_dsi_host *msm_host)
+
+ /* dsi controller can only be reset while clocks are running */
+ dsi_write(msm_host, REG_DSI_RESET, 1);
+- wmb(); /* make sure reset happen */
++ msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
+ dsi_write(msm_host, REG_DSI_RESET, 0);
+ wmb(); /* controller out of reset */
+ dsi_write(msm_host, REG_DSI_CTRL, data0);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
+index e67a471331b5..6ec745873bc5 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
++++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
+@@ -214,6 +214,7 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
+ WARN_ON(1);
+ break;
+ }
++ break;
+ case NOUVEAU_GETPARAM_FB_SIZE:
+ getparam->value = drm->gem.vram_available;
+ break;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+index 60ece0a8a2e1..1d2d6bae73cd 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+@@ -87,7 +87,7 @@ nvkm_gddr3_calc(struct nvkm_ram *ram)
+ WR = (ram->next->bios.timing[2] & 0x007f0000) >> 16;
+ /* XXX: Get these values from the VBIOS instead */
+ DLL = !(ram->mr[1] & 0x1);
+- RON = !(ram->mr[1] & 0x300) >> 8;
++ RON = !((ram->mr[1] & 0x300) >> 8);
+ break;
+ default:
+ return -ENOSYS;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+index 11b28b086a06..7b052879af72 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+@@ -88,10 +88,10 @@ nvkm_memx_fini(struct nvkm_memx **pmemx, bool exec)
+ if (exec) {
+ nvkm_pmu_send(pmu, reply, PROC_MEMX, MEMX_MSG_EXEC,
+ memx->base, finish);
++ nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
++ reply[0], reply[1]);
+ }
+
+- nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
+- reply[0], reply[1]);
+ kfree(memx);
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/panel/panel-lvds.c b/drivers/gpu/drm/panel/panel-lvds.c
+index 8a1687887ae9..bd704a36c5d0 100644
+--- a/drivers/gpu/drm/panel/panel-lvds.c
++++ b/drivers/gpu/drm/panel/panel-lvds.c
+@@ -199,7 +199,6 @@ static int panel_lvds_parse_dt(struct panel_lvds *lvds)
+ static int panel_lvds_probe(struct platform_device *pdev)
+ {
+ struct panel_lvds *lvds;
+- struct device_node *np;
+ int ret;
+
+ lvds = devm_kzalloc(&pdev->dev, sizeof(*lvds), GFP_KERNEL);
+@@ -245,14 +244,9 @@ static int panel_lvds_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- np = of_parse_phandle(lvds->dev->of_node, "backlight", 0);
+- if (np) {
+- lvds->backlight = of_find_backlight_by_node(np);
+- of_node_put(np);
+-
+- if (!lvds->backlight)
+- return -EPROBE_DEFER;
+- }
++ lvds->backlight = devm_of_find_backlight(lvds->dev);
++ if (IS_ERR(lvds->backlight))
++ return PTR_ERR(lvds->backlight);
+
+ /*
+ * TODO: Handle all power supplies specified in the DT node in a generic
+@@ -268,14 +262,10 @@ static int panel_lvds_probe(struct platform_device *pdev)
+
+ ret = drm_panel_add(&lvds->panel);
+ if (ret < 0)
+- goto error;
++ return ret;
+
+ dev_set_drvdata(lvds->dev, lvds);
+ return 0;
+-
+-error:
+- put_device(&lvds->backlight->dev);
+- return ret;
+ }
+
+ static int panel_lvds_remove(struct platform_device *pdev)
+@@ -286,9 +276,6 @@ static int panel_lvds_remove(struct platform_device *pdev)
+
+ panel_lvds_disable(&lvds->panel);
+
+- if (lvds->backlight)
+- put_device(&lvds->backlight->dev);
+-
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index ebce4601a305..827d551962d9 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -6965,8 +6965,8 @@ static int cik_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* XXX this should actually be a bus address, not an MC address. same on older asics */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index e06e2d8feab3..a724bb87cfad 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3690,8 +3690,8 @@ int r600_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* set dummy read address to ring address */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 85c604d29235..639f0698f961 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -5993,8 +5993,8 @@ static int si_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* set dummy read address to ring address */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+index 15dc9caa128b..212e5e11e4b7 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+@@ -837,7 +837,7 @@ unlock:
+ drm_modeset_drop_locks(&ctx);
+ drm_modeset_acquire_fini(&ctx);
+
+- return 0;
++ return ret;
+ }
+
+ static const struct drm_crtc_funcs crtc_funcs_gen2 = {
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+index 0386b454e221..6a9578159c2b 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+@@ -544,7 +544,7 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu)
+ * Initialize vertical blanking interrupts handling. Start with vblank
+ * disabled for all CRTCs.
+ */
+- ret = drm_vblank_init(dev, (1 << rcdu->num_crtcs) - 1);
++ ret = drm_vblank_init(dev, rcdu->num_crtcs);
+ if (ret < 0)
+ return ret;
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_lvds.c b/drivers/gpu/drm/rcar-du/rcar_lvds.c
+index 4c39de3f4f0f..b6dc91cdff68 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_lvds.c
++++ b/drivers/gpu/drm/rcar-du/rcar_lvds.c
+@@ -59,11 +59,11 @@ struct rcar_lvds {
+ enum rcar_lvds_mode mode;
+ };
+
+-#define bridge_to_rcar_lvds(bridge) \
+- container_of(bridge, struct rcar_lvds, bridge)
++#define bridge_to_rcar_lvds(b) \
++ container_of(b, struct rcar_lvds, bridge)
+
+-#define connector_to_rcar_lvds(connector) \
+- container_of(connector, struct rcar_lvds, connector)
++#define connector_to_rcar_lvds(c) \
++ container_of(c, struct rcar_lvds, connector)
+
+ static void rcar_lvds_write(struct rcar_lvds *lvds, u32 reg, u32 data)
+ {
+diff --git a/drivers/gpu/drm/shmobile/shmob_drm_drv.c b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
+index 592572554eb0..58d8a98c749b 100644
+--- a/drivers/gpu/drm/shmobile/shmob_drm_drv.c
++++ b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
+@@ -233,8 +233,8 @@ static int shmob_drm_probe(struct platform_device *pdev)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ sdev->mmio = devm_ioremap_resource(&pdev->dev, res);
+- if (sdev->mmio == NULL)
+- return -ENOMEM;
++ if (IS_ERR(sdev->mmio))
++ return PTR_ERR(sdev->mmio);
+
+ ret = shmob_drm_setup_clocks(sdev, pdata->clk_source);
+ if (ret < 0)
+diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
+index 49438337f70d..19b9b5ed1297 100644
+--- a/drivers/gpu/drm/sti/sti_hda.c
++++ b/drivers/gpu/drm/sti/sti_hda.c
+@@ -721,7 +721,6 @@ static int sti_hda_bind(struct device *dev, struct device *master, void *data)
+ return 0;
+
+ err_sysfs:
+- drm_bridge_remove(bridge);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
+index 34cdc4644435..ccf718404a1c 100644
+--- a/drivers/gpu/drm/sti/sti_hdmi.c
++++ b/drivers/gpu/drm/sti/sti_hdmi.c
+@@ -1315,7 +1315,6 @@ static int sti_hdmi_bind(struct device *dev, struct device *master, void *data)
+ return 0;
+
+ err_sysfs:
+- drm_bridge_remove(bridge);
+ hdmi->drm_connector = NULL;
+ return -EINVAL;
+ }
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
+index 3ecffa52c814..a74adec6c5dc 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
+@@ -52,7 +52,7 @@ static unsigned long sun4i_tmds_calc_divider(unsigned long rate,
+ (rate - tmp_rate) < (rate - best_rate)) {
+ best_rate = tmp_rate;
+ best_m = m;
+- is_double = d;
++ is_double = (d == 2) ? true : false;
+ }
+ }
+ }
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index c8a581b1f4c4..608906f06ced 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -650,11 +650,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ {
+ struct virtio_gpu_get_capset *cmd_p;
+ struct virtio_gpu_vbuffer *vbuf;
+- int max_size = vgdev->capsets[idx].max_size;
++ int max_size;
+ struct virtio_gpu_drv_cap_cache *cache_ent;
+ void *resp_buf;
+
+- if (idx > vgdev->num_capsets)
++ if (idx >= vgdev->num_capsets)
+ return -EINVAL;
+
+ if (version > vgdev->capsets[idx].max_version)
+@@ -664,6 +664,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ if (!cache_ent)
+ return -ENOMEM;
+
++ max_size = vgdev->capsets[idx].max_size;
+ cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL);
+ if (!cache_ent->caps_cache) {
+ kfree(cache_ent);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
+index e7e4655d3f36..ce1ad7cd7899 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
+@@ -511,17 +511,14 @@ static void vmw_cmdbuf_work_func(struct work_struct *work)
+ container_of(work, struct vmw_cmdbuf_man, work);
+ struct vmw_cmdbuf_header *entry, *next;
+ uint32_t dummy;
+- bool restart[SVGA_CB_CONTEXT_MAX];
+ bool send_fence = false;
+ struct list_head restart_head[SVGA_CB_CONTEXT_MAX];
+ int i;
+ struct vmw_cmdbuf_context *ctx;
+ bool global_block = false;
+
+- for_each_cmdbuf_ctx(man, i, ctx) {
++ for_each_cmdbuf_ctx(man, i, ctx)
+ INIT_LIST_HEAD(&restart_head[i]);
+- restart[i] = false;
+- }
+
+ mutex_lock(&man->error_mutex);
+ spin_lock(&man->lock);
+@@ -533,7 +530,6 @@ static void vmw_cmdbuf_work_func(struct work_struct *work)
+ const char *cmd_name;
+
+ list_del_init(&entry->list);
+- restart[entry->cb_context] = true;
+ global_block = true;
+
+ if (!vmw_cmd_describe(header, &error_cmd_size, &cmd_name)) {
+diff --git a/drivers/gpu/drm/xen/xen_drm_front_gem.c b/drivers/gpu/drm/xen/xen_drm_front_gem.c
+index c85bfe7571cb..802662839e7e 100644
+--- a/drivers/gpu/drm/xen/xen_drm_front_gem.c
++++ b/drivers/gpu/drm/xen/xen_drm_front_gem.c
+@@ -236,8 +236,14 @@ static int gem_mmap_obj(struct xen_gem_object *xen_obj,
+ vma->vm_flags &= ~VM_PFNMAP;
+ vma->vm_flags |= VM_MIXEDMAP;
+ vma->vm_pgoff = 0;
+- vma->vm_page_prot =
+- pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
++ /*
++ * According to Xen on ARM ABI (xen/include/public/arch-arm.h):
++ * all memory which is shared with other entities in the system
++ * (including the hypervisor and other guests) must reside in memory
++ * which is mapped as Normal Inner Write-Back Outer Write-Back
++ * Inner-Shareable.
++ */
++ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+
+ /*
+ * vm_operations_struct.fault handler will be called if CPU access
+@@ -283,8 +289,9 @@ void *xen_drm_front_gem_prime_vmap(struct drm_gem_object *gem_obj)
+ if (!xen_obj->pages)
+ return NULL;
+
++ /* Please see comment in gem_mmap_obj on mapping and attributes. */
+ return vmap(xen_obj->pages, xen_obj->num_pages,
+- VM_MAP, pgprot_writecombine(PAGE_KERNEL));
++ VM_MAP, PAGE_KERNEL);
+ }
+
+ void xen_drm_front_gem_prime_vunmap(struct drm_gem_object *gem_obj,
+diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c
+index 49f4b33a5685..7f28912c9abc 100644
+--- a/drivers/hwmon/lm75.c
++++ b/drivers/hwmon/lm75.c
+@@ -165,7 +165,7 @@ static int lm75_write(struct device *dev, enum hwmon_sensor_types type,
+ temp = DIV_ROUND_CLOSEST(temp << (resolution - 8),
+ 1000) << (16 - resolution);
+
+- return regmap_write(data->regmap, reg, temp);
++ return regmap_write(data->regmap, reg, (u16)temp);
+ }
+
+ static umode_t lm75_is_visible(const void *data, enum hwmon_sensor_types type,
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 85b515cd9df0..2bc352c5357f 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -80,7 +80,14 @@ static struct pmbus_driver_info tps53679_info = {
+ static int tps53679_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+- return pmbus_do_probe(client, id, &tps53679_info);
++ struct pmbus_driver_info *info;
++
++ info = devm_kmemdup(&client->dev, &tps53679_info, sizeof(*info),
++ GFP_KERNEL);
++ if (!info)
++ return -ENOMEM;
++
++ return pmbus_do_probe(client, id, info);
+ }
+
+ static const struct i2c_device_id tps53679_id[] = {
+diff --git a/drivers/hwmon/shtc1.c b/drivers/hwmon/shtc1.c
+index decd7df995ab..2a18539591ea 100644
+--- a/drivers/hwmon/shtc1.c
++++ b/drivers/hwmon/shtc1.c
+@@ -38,7 +38,7 @@ static const unsigned char shtc1_cmd_read_id_reg[] = { 0xef, 0xc8 };
+
+ /* constants for reading the ID register */
+ #define SHTC1_ID 0x07
+-#define SHTC1_ID_REG_MASK 0x1f
++#define SHTC1_ID_REG_MASK 0x3f
+
+ /* delays for non-blocking i2c commands, both in us */
+ #define SHTC1_NONBLOCKING_WAIT_TIME_HPM 14400
+diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
+index 8ac89d0781cc..a575e1cdb81a 100644
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data *sio, int ld)
+ outb(ld, sio->sioaddr + 1);
+ }
+
+-static inline void
++static inline int
+ superio_enter(struct w83627hf_sio_data *sio)
+ {
++ if (!request_muxed_region(sio->sioaddr, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x87, sio->sioaddr);
+ outb(0x87, sio->sioaddr);
++
++ return 0;
+ }
+
+ static inline void
+ superio_exit(struct w83627hf_sio_data *sio)
+ {
+ outb(0xAA, sio->sioaddr);
++ release_region(sio->sioaddr, 2);
+ }
+
+ #define W627_DEVID 0x52
+@@ -1278,7 +1284,7 @@ static DEVICE_ATTR_RO(name);
+ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ struct w83627hf_sio_data *sio_data)
+ {
+- int err = -ENODEV;
++ int err;
+ u16 val;
+
+ static __initconst char *const names[] = {
+@@ -1290,7 +1296,11 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ };
+
+ sio_data->sioaddr = sioaddr;
+- superio_enter(sio_data);
++ err = superio_enter(sio_data);
++ if (err)
++ return err;
++
++ err = -ENODEV;
+ val = force_id ? force_id : superio_inb(sio_data, DEVID);
+ switch (val) {
+ case W627_DEVID:
+@@ -1644,9 +1654,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
+ struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ int res = 0xff, sel;
+
+- superio_enter(sio_data);
++ if (superio_enter(sio_data)) {
++ /*
++ * Some other driver reserved the address space for itself.
++ * We don't want to fail driver instantiation because of that,
++ * so display a warning and keep going.
++ */
++ dev_warn(&pdev->dev,
++ "Can not read VID data: Failed to enable SuperIO access\n");
++ return res;
++ }
++
+ superio_select(sio_data, W83627HF_LD_GPIO5);
+
++ res = 0xff;
++
+ /* Make sure these GPIO pins are enabled */
+ if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
+ dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
+@@ -1677,7 +1699,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
+ struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ int res = 0xff;
+
+- superio_enter(sio_data);
++ if (superio_enter(sio_data)) {
++ /*
++ * Some other driver reserved the address space for itself.
++ * We don't want to fail driver instantiation because of that,
++ * so display a warning and keep going.
++ */
++ dev_warn(&pdev->dev,
++ "Can not read VID data: Failed to enable SuperIO access\n");
++ return res;
++ }
++
+ superio_select(sio_data, W83627HF_LD_HWM);
+
+ /* Make sure these GPIO pins are enabled */
+diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h
+index 1b281f0dcccc..1d2ad183fd92 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.h
++++ b/drivers/hwtracing/coresight/coresight-catu.h
+@@ -109,11 +109,6 @@ static inline bool coresight_is_catu_device(struct coresight_device *csdev)
+ return true;
+ }
+
+-#ifdef CONFIG_CORESIGHT_CATU
+ extern const struct etr_buf_operations etr_catu_buf_ops;
+-#else
+-/* Dummy declaration for the CATU ops */
+-static const struct etr_buf_operations etr_catu_buf_ops;
+-#endif
+
+ #endif
+diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
+index c3c645201514..567f46ca2599 100644
+--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
+@@ -437,15 +437,16 @@ static int etm_addr_filters_validate(struct list_head *filters)
+ static void etm_addr_filters_sync(struct perf_event *event)
+ {
+ struct perf_addr_filters_head *head = perf_event_addr_filters(event);
+- unsigned long start, stop, *offs = event->addr_filters_offs;
++ unsigned long start, stop;
++ struct perf_addr_filter_range *fr = event->addr_filter_ranges;
+ struct etm_filters *filters = event->hw.addr_filters;
+ struct etm_filter *etm_filter;
+ struct perf_addr_filter *filter;
+ int i = 0;
+
+ list_for_each_entry(filter, &head->list, entry) {
+- start = filter->offset + offs[i];
+- stop = start + filter->size;
++ start = fr[i].start;
++ stop = start + fr[i].size;
+ etm_filter = &filters->etm_filter[i];
+
+ switch (filter->action) {
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+index 2d6f428176ff..3b684687b5a7 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -747,7 +747,8 @@ static inline void tmc_etr_disable_catu(struct tmc_drvdata *drvdata)
+ static const struct etr_buf_operations *etr_buf_ops[] = {
+ [ETR_MODE_FLAT] = &etr_flat_buf_ops,
+ [ETR_MODE_ETR_SG] = &etr_sg_buf_ops,
+- [ETR_MODE_CATU] = &etr_catu_buf_ops,
++ [ETR_MODE_CATU] = IS_ENABLED(CONFIG_CORESIGHT_CATU)
++ ? &etr_catu_buf_ops : NULL,
+ };
+
+ static inline int tmc_etr_mode_alloc_buf(int mode,
+@@ -761,7 +762,7 @@ static inline int tmc_etr_mode_alloc_buf(int mode,
+ case ETR_MODE_FLAT:
+ case ETR_MODE_ETR_SG:
+ case ETR_MODE_CATU:
+- if (etr_buf_ops[mode]->alloc)
++ if (etr_buf_ops[mode] && etr_buf_ops[mode]->alloc)
+ rc = etr_buf_ops[mode]->alloc(drvdata, etr_buf,
+ node, pages);
+ if (!rc)
+diff --git a/drivers/i2c/busses/i2c-stm32.c b/drivers/i2c/busses/i2c-stm32.c
+index d75fbcbf02ef..667f8032f8ef 100644
+--- a/drivers/i2c/busses/i2c-stm32.c
++++ b/drivers/i2c/busses/i2c-stm32.c
+@@ -21,13 +21,13 @@ struct stm32_i2c_dma *stm32_i2c_dma_request(struct device *dev,
+
+ dma = devm_kzalloc(dev, sizeof(*dma), GFP_KERNEL);
+ if (!dma)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ /* Request and configure I2C TX dma channel */
+- dma->chan_tx = dma_request_slave_channel(dev, "tx");
+- if (!dma->chan_tx) {
++ dma->chan_tx = dma_request_chan(dev, "tx");
++ if (IS_ERR(dma->chan_tx)) {
+ dev_dbg(dev, "can't request DMA tx channel\n");
+- ret = -EINVAL;
++ ret = PTR_ERR(dma->chan_tx);
+ goto fail_al;
+ }
+
+@@ -43,10 +43,10 @@ struct stm32_i2c_dma *stm32_i2c_dma_request(struct device *dev,
+ }
+
+ /* Request and configure I2C RX dma channel */
+- dma->chan_rx = dma_request_slave_channel(dev, "rx");
+- if (!dma->chan_rx) {
++ dma->chan_rx = dma_request_chan(dev, "rx");
++ if (IS_ERR(dma->chan_rx)) {
+ dev_err(dev, "can't request DMA rx channel\n");
+- ret = -EINVAL;
++ ret = PTR_ERR(dma->chan_rx);
+ goto fail_tx;
+ }
+
+@@ -76,7 +76,7 @@ fail_al:
+ devm_kfree(dev, dma);
+ dev_info(dev, "can't use DMA\n");
+
+- return NULL;
++ return ERR_PTR(ret);
+ }
+
+ void stm32_i2c_dma_free(struct stm32_i2c_dma *dma)
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index f4e3613f9361..eb7e533b0dd4 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -1252,8 +1252,8 @@ static int stm32f7_i2c_get_free_slave_id(struct stm32f7_i2c_dev *i2c_dev,
+ * slave[0] supports 7-bit and 10-bit slave address
+ * slave[1] supports 7-bit slave address only
+ */
+- for (i = 0; i < STM32F7_I2C_MAX_SLAVE; i++) {
+- if (i == 1 && (slave->flags & I2C_CLIENT_PEC))
++ for (i = STM32F7_I2C_MAX_SLAVE - 1; i >= 0; i--) {
++ if (i == 1 && (slave->flags & I2C_CLIENT_TEN))
+ continue;
+ if (!i2c_dev->slave[i]) {
+ *id = i;
+@@ -1914,6 +1914,15 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
+ i2c_dev->dma = stm32_i2c_dma_request(i2c_dev->dev, phy_addr,
+ STM32F7_I2C_TXDR,
+ STM32F7_I2C_RXDR);
++ if (PTR_ERR(i2c_dev->dma) == -ENODEV)
++ i2c_dev->dma = NULL;
++ else if (IS_ERR(i2c_dev->dma)) {
++ ret = PTR_ERR(i2c_dev->dma);
++ if (ret != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "Failed to request dma error %i\n", ret);
++ goto clk_free;
++ }
+
+ ret = i2c_add_adapter(adap);
+ if (ret)
+diff --git a/drivers/iio/dac/ad5380.c b/drivers/iio/dac/ad5380.c
+index 873c2bf637c0..617c9f7fe59a 100644
+--- a/drivers/iio/dac/ad5380.c
++++ b/drivers/iio/dac/ad5380.c
+@@ -221,7 +221,7 @@ static int ad5380_read_raw(struct iio_dev *indio_dev,
+ if (ret)
+ return ret;
+ *val >>= chan->scan_type.shift;
+- val -= (1 << chan->scan_type.realbits) / 2;
++ *val -= (1 << chan->scan_type.realbits) / 2;
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_SCALE:
+ *val = 2 * st->vref;
+diff --git a/drivers/iio/light/tsl2772.c b/drivers/iio/light/tsl2772.c
+index df5b2a0da96c..f2e308c6d6d7 100644
+--- a/drivers/iio/light/tsl2772.c
++++ b/drivers/iio/light/tsl2772.c
+@@ -716,6 +716,13 @@ static int tsl2772_chip_off(struct iio_dev *indio_dev)
+ return tsl2772_write_control_reg(chip, 0x00);
+ }
+
++static void tsl2772_chip_off_action(void *data)
++{
++ struct iio_dev *indio_dev = data;
++
++ tsl2772_chip_off(indio_dev);
++}
++
+ /**
+ * tsl2772_invoke_change - power cycle the device to implement the user
+ * parameters
+@@ -1711,9 +1718,14 @@ static int tsl2772_probe(struct i2c_client *clientp,
+ if (ret < 0)
+ return ret;
+
++ ret = devm_add_action_or_reset(&clientp->dev,
++ tsl2772_chip_off_action,
++ indio_dev);
++ if (ret < 0)
++ return ret;
++
+ ret = iio_device_register(indio_dev);
+ if (ret) {
+- tsl2772_chip_off(indio_dev);
+ dev_err(&clientp->dev,
+ "%s: iio registration failed\n", __func__);
+ return ret;
+@@ -1740,8 +1752,6 @@ static int tsl2772_remove(struct i2c_client *client)
+ {
+ struct iio_dev *indio_dev = i2c_get_clientdata(client);
+
+- tsl2772_chip_off(indio_dev);
+-
+ iio_device_unregister(indio_dev);
+
+ return 0;
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 319bfef00a4a..e16872e0724f 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2889,7 +2889,7 @@ static void addr_handler(int status, struct sockaddr *src_addr,
+ if (status)
+ pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to acquire device. status %d\n",
+ status);
+- } else {
++ } else if (status) {
+ pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to resolve IP. status %d\n", status);
+ }
+
+diff --git a/drivers/infiniband/core/uverbs_uapi.c b/drivers/infiniband/core/uverbs_uapi.c
+index be854628a7c6..959a3418a192 100644
+--- a/drivers/infiniband/core/uverbs_uapi.c
++++ b/drivers/infiniband/core/uverbs_uapi.c
+@@ -17,6 +17,8 @@ static void *uapi_add_elm(struct uverbs_api *uapi, u32 key, size_t alloc_size)
+ return ERR_PTR(-EOVERFLOW);
+
+ elm = kzalloc(alloc_size, GFP_KERNEL);
++ if (!elm)
++ return ERR_PTR(-ENOMEM);
+ rc = radix_tree_insert(&uapi->radix, key, elm);
+ if (rc) {
+ kfree(elm);
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index a69632f1fab0..c9af2d139f5c 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -2664,6 +2664,7 @@ struct ib_cq *bnxt_re_create_cq(struct ib_device *ibdev,
+ nq->budget++;
+
+ atomic_inc(&rdev->cq_count);
++ spin_lock_init(&cq->cq_lock);
+
+ if (context) {
+ struct bnxt_re_cq_resp resp;
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index c15335dc8f61..60f2fb7e7dbf 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -1970,6 +1970,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
+ INIT_LIST_HEAD(&cq->sqf_head);
+ INIT_LIST_HEAD(&cq->rqf_head);
+ spin_lock_init(&cq->compl_lock);
++ spin_lock_init(&cq->flush_lock);
+
+ bnxt_qplib_arm_cq_enable(cq);
+ return 0;
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 4dcc92d11609..16145b0a1458 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2076,7 +2076,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
+ } else {
+ pdev = get_real_dev(n->dev);
+ ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
+- n, pdev, 0);
++ n, pdev, rt_tos2priority(tos));
+ if (!ep->l2t)
+ goto out;
+ ep->mtu = dst_mtu(dst);
+@@ -2166,7 +2166,8 @@ static int c4iw_reconnect(struct c4iw_ep *ep)
+ laddr6->sin6_addr.s6_addr,
+ raddr6->sin6_addr.s6_addr,
+ laddr6->sin6_port,
+- raddr6->sin6_port, 0,
++ raddr6->sin6_port,
++ ep->com.cm_id->tos,
+ raddr6->sin6_scope_id);
+ iptype = 6;
+ ra = (__u8 *)&raddr6->sin6_addr;
+@@ -2947,15 +2948,18 @@ static int terminate(struct c4iw_dev *dev, struct sk_buff *skb)
+
+ ep = get_ep_from_tid(dev, tid);
+
+- if (ep && ep->com.qp) {
+- pr_warn("TERM received tid %u qpid %u\n",
+- tid, ep->com.qp->wq.sq.qid);
+- attrs.next_state = C4IW_QP_STATE_TERMINATE;
+- c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+- C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
++ if (ep) {
++ if (ep->com.qp) {
++ pr_warn("TERM received tid %u qpid %u\n", tid,
++ ep->com.qp->wq.sq.qid);
++ attrs.next_state = C4IW_QP_STATE_TERMINATE;
++ c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
++ C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
++ }
++
++ c4iw_put_ep(&ep->com);
+ } else
+ pr_warn("TERM received tid %u no ep/qp\n", tid);
+- c4iw_put_ep(&ep->com);
+
+ return 0;
+ }
+@@ -3323,7 +3327,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ laddr6->sin6_addr.s6_addr,
+ raddr6->sin6_addr.s6_addr,
+ laddr6->sin6_port,
+- raddr6->sin6_port, 0,
++ raddr6->sin6_port, cm_id->tos,
+ raddr6->sin6_scope_id);
+ }
+ if (!ep->dst) {
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 6b8935361133..b09a4b1cf397 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -10580,12 +10580,29 @@ void set_link_down_reason(struct hfi1_pportdata *ppd, u8 lcl_reason,
+ }
+ }
+
+-/*
+- * Verify if BCT for data VLs is non-zero.
++/**
++ * data_vls_operational() - Verify if data VL BCT credits and MTU
++ * are both set.
++ * @ppd: pointer to hfi1_pportdata structure
++ *
++ * Return: true - Ok, false -otherwise.
+ */
+ static inline bool data_vls_operational(struct hfi1_pportdata *ppd)
+ {
+- return !!ppd->actual_vls_operational;
++ int i;
++ u64 reg;
++
++ if (!ppd->actual_vls_operational)
++ return false;
++
++ for (i = 0; i < ppd->vls_supported; i++) {
++ reg = read_csr(ppd->dd, SEND_CM_CREDIT_VL + (8 * i));
++ if ((reg && !ppd->dd->vld[i].mtu) ||
++ (!reg && ppd->dd->vld[i].mtu))
++ return false;
++ }
++
++ return true;
+ }
+
+ /*
+@@ -10698,7 +10715,8 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
+
+ if (!data_vls_operational(ppd)) {
+ dd_dev_err(dd,
+- "%s: data VLs not operational\n", __func__);
++ "%s: Invalid data VL credits or mtu\n",
++ __func__);
+ ret = -EINVAL;
+ break;
+ }
+diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
+index a41f85558312..d5277c23cba6 100644
+--- a/drivers/infiniband/hw/hfi1/driver.c
++++ b/drivers/infiniband/hw/hfi1/driver.c
+@@ -430,40 +430,60 @@ static const hfi1_handle_cnp hfi1_handle_cnp_tbl[2] = {
+ [HFI1_PKT_TYPE_16B] = &return_cnp_16B
+ };
+
+-void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
+- bool do_cnp)
++/**
++ * hfi1_process_ecn_slowpath - Process FECN or BECN bits
++ * @qp: The packet's destination QP
++ * @pkt: The packet itself.
++ * @prescan: Is the caller the RXQ prescan
++ *
++ * Process the packet's FECN or BECN bits. By now, the packet
++ * has already been evaluated whether processing of those bit should
++ * be done.
++ * The significance of the @prescan argument is that if the caller
++ * is the RXQ prescan, a CNP will be send out instead of waiting for the
++ * normal packet processing to send an ACK with BECN set (or a CNP).
++ */
++bool hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
++ bool prescan)
+ {
+ struct hfi1_ibport *ibp = to_iport(qp->ibqp.device, qp->port_num);
+ struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
+ struct ib_other_headers *ohdr = pkt->ohdr;
+ struct ib_grh *grh = pkt->grh;
+- u32 rqpn = 0, bth1;
++ u32 rqpn = 0;
+ u16 pkey;
+ u32 rlid, slid, dlid = 0;
+- u8 hdr_type, sc, svc_type;
+- bool is_mcast = false;
++ u8 hdr_type, sc, svc_type, opcode;
++ bool is_mcast = false, ignore_fecn = false, do_cnp = false,
++ fecn, becn;
+
+ /* can be called from prescan */
+ if (pkt->etype == RHF_RCV_TYPE_BYPASS) {
+- is_mcast = hfi1_is_16B_mcast(dlid);
+ pkey = hfi1_16B_get_pkey(pkt->hdr);
+ sc = hfi1_16B_get_sc(pkt->hdr);
+ dlid = hfi1_16B_get_dlid(pkt->hdr);
+ slid = hfi1_16B_get_slid(pkt->hdr);
++ is_mcast = hfi1_is_16B_mcast(dlid);
++ opcode = ib_bth_get_opcode(ohdr);
+ hdr_type = HFI1_PKT_TYPE_16B;
++ fecn = hfi1_16B_get_fecn(pkt->hdr);
++ becn = hfi1_16B_get_becn(pkt->hdr);
+ } else {
+- is_mcast = (dlid > be16_to_cpu(IB_MULTICAST_LID_BASE)) &&
+- (dlid != be16_to_cpu(IB_LID_PERMISSIVE));
+ pkey = ib_bth_get_pkey(ohdr);
+ sc = hfi1_9B_get_sc5(pkt->hdr, pkt->rhf);
+- dlid = ib_get_dlid(pkt->hdr);
++ dlid = qp->ibqp.qp_type != IB_QPT_UD ? ib_get_dlid(pkt->hdr) :
++ ppd->lid;
+ slid = ib_get_slid(pkt->hdr);
++ is_mcast = (dlid > be16_to_cpu(IB_MULTICAST_LID_BASE)) &&
++ (dlid != be16_to_cpu(IB_LID_PERMISSIVE));
++ opcode = ib_bth_get_opcode(ohdr);
+ hdr_type = HFI1_PKT_TYPE_9B;
++ fecn = ib_bth_get_fecn(ohdr);
++ becn = ib_bth_get_becn(ohdr);
+ }
+
+ switch (qp->ibqp.qp_type) {
+ case IB_QPT_UD:
+- dlid = ppd->lid;
+ rlid = slid;
+ rqpn = ib_get_sqpn(pkt->ohdr);
+ svc_type = IB_CC_SVCTYPE_UD;
+@@ -485,22 +505,31 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
+ svc_type = IB_CC_SVCTYPE_RC;
+ break;
+ default:
+- return;
++ return false;
+ }
+
+- bth1 = be32_to_cpu(ohdr->bth[1]);
++ ignore_fecn = is_mcast || (opcode == IB_OPCODE_CNP) ||
++ (opcode == IB_OPCODE_RC_ACKNOWLEDGE);
++ /*
++ * ACKNOWLEDGE packets do not get a CNP but this will be
++ * guarded by ignore_fecn above.
++ */
++ do_cnp = prescan ||
++ (opcode >= IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST &&
++ opcode <= IB_OPCODE_RC_ATOMIC_ACKNOWLEDGE);
++
+ /* Call appropriate CNP handler */
+- if (do_cnp && (bth1 & IB_FECN_SMASK))
++ if (!ignore_fecn && do_cnp && fecn)
+ hfi1_handle_cnp_tbl[hdr_type](ibp, qp, rqpn, pkey,
+ dlid, rlid, sc, grh);
+
+- if (!is_mcast && (bth1 & IB_BECN_SMASK)) {
+- u32 lqpn = bth1 & RVT_QPN_MASK;
++ if (becn) {
++ u32 lqpn = be32_to_cpu(ohdr->bth[1]) & RVT_QPN_MASK;
+ u8 sl = ibp->sc_to_sl[sc];
+
+ process_becn(ppd, sl, rlid, lqpn, rqpn, svc_type);
+ }
+-
++ return !ignore_fecn && fecn;
+ }
+
+ struct ps_mdata {
+@@ -599,7 +628,6 @@ static void __prescan_rxq(struct hfi1_packet *packet)
+ struct rvt_dev_info *rdi = &rcd->dd->verbs_dev.rdi;
+ u64 rhf = rhf_to_cpu(rhf_addr);
+ u32 etype = rhf_rcv_type(rhf), qpn, bth1;
+- int is_ecn = 0;
+ u8 lnh;
+
+ if (ps_done(&mdata, rhf, rcd))
+@@ -625,12 +653,10 @@ static void __prescan_rxq(struct hfi1_packet *packet)
+ goto next; /* just in case */
+ }
+
+- bth1 = be32_to_cpu(packet->ohdr->bth[1]);
+- is_ecn = !!(bth1 & (IB_FECN_SMASK | IB_BECN_SMASK));
+-
+- if (!is_ecn)
++ if (!hfi1_may_ecn(packet))
+ goto next;
+
++ bth1 = be32_to_cpu(packet->ohdr->bth[1]);
+ qpn = bth1 & RVT_QPN_MASK;
+ rcu_read_lock();
+ qp = rvt_lookup_qpn(rdi, &ibp->rvp, qpn);
+@@ -640,7 +666,7 @@ static void __prescan_rxq(struct hfi1_packet *packet)
+ goto next;
+ }
+
+- process_ecn(qp, packet, true);
++ hfi1_process_ecn_slowpath(qp, packet, true);
+ rcu_read_unlock();
+
+ /* turn off BECN, FECN */
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index 2ea42c04cfd2..232fc4b59a98 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1797,13 +1797,20 @@ static inline struct hfi1_ibport *rcd_to_iport(struct hfi1_ctxtdata *rcd)
+ return &rcd->ppd->ibport_data;
+ }
+
+-void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
+- bool do_cnp);
+-static inline bool process_ecn(struct rvt_qp *qp, struct hfi1_packet *pkt,
+- bool do_cnp)
++/**
++ * hfi1_may_ecn - Check whether FECN or BECN processing should be done
++ * @pkt: the packet to be evaluated
++ *
++ * Check whether the FECN or BECN bits in the packet's header are
++ * enabled, depending on packet type.
++ *
++ * This function only checks for FECN and BECN bits. Additional checks
++ * are done in the slowpath (hfi1_process_ecn_slowpath()) in order to
++ * ensure correct handling.
++ */
++static inline bool hfi1_may_ecn(struct hfi1_packet *pkt)
+ {
+- bool becn;
+- bool fecn;
++ bool fecn, becn;
+
+ if (pkt->etype == RHF_RCV_TYPE_BYPASS) {
+ fecn = hfi1_16B_get_fecn(pkt->hdr);
+@@ -1812,10 +1819,18 @@ static inline bool process_ecn(struct rvt_qp *qp, struct hfi1_packet *pkt,
+ fecn = ib_bth_get_fecn(pkt->ohdr);
+ becn = ib_bth_get_becn(pkt->ohdr);
+ }
+- if (unlikely(fecn || becn)) {
+- hfi1_process_ecn_slowpath(qp, pkt, do_cnp);
+- return fecn;
+- }
++ return fecn || becn;
++}
++
++bool hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
++ bool prescan);
++static inline bool process_ecn(struct rvt_qp *qp, struct hfi1_packet *pkt)
++{
++ bool do_work;
++
++ do_work = hfi1_may_ecn(pkt);
++ if (unlikely(do_work))
++ return hfi1_process_ecn_slowpath(qp, pkt, false);
+ return false;
+ }
+
+diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
+index 752057647f09..3fcbf56f8be2 100644
+--- a/drivers/infiniband/hw/hfi1/pio.c
++++ b/drivers/infiniband/hw/hfi1/pio.c
+@@ -1434,7 +1434,8 @@ void sc_stop(struct send_context *sc, int flag)
+ * @cb: optional callback to call when the buffer is finished sending
+ * @arg: argument for cb
+ *
+- * Return a pointer to a PIO buffer if successful, NULL if not enough room.
++ * Return a pointer to a PIO buffer, NULL if not enough room, -ECOMM
++ * when link is down.
+ */
+ struct pio_buf *sc_buffer_alloc(struct send_context *sc, u32 dw_len,
+ pio_release_cb cb, void *arg)
+@@ -1450,7 +1451,7 @@ struct pio_buf *sc_buffer_alloc(struct send_context *sc, u32 dw_len,
+ spin_lock_irqsave(&sc->alloc_lock, flags);
+ if (!(sc->flags & SCF_ENABLED)) {
+ spin_unlock_irqrestore(&sc->alloc_lock, flags);
+- goto done;
++ return ERR_PTR(-ECOMM);
+ }
+
+ retry:
+diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
+index 770c78c65730..7ed6fb407a68 100644
+--- a/drivers/infiniband/hw/hfi1/rc.c
++++ b/drivers/infiniband/hw/hfi1/rc.c
+@@ -914,7 +914,7 @@ void hfi1_send_rc_ack(struct hfi1_packet *packet, bool is_fecn)
+ pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps,
+ sc_to_vlt(ppd->dd, sc5), plen);
+ pbuf = sc_buffer_alloc(rcd->sc, plen, NULL, NULL);
+- if (!pbuf) {
++ if (IS_ERR_OR_NULL(pbuf)) {
+ /*
+ * We have no room to send at the moment. Pass
+ * responsibility for sending the ACK to the send engine
+@@ -2049,8 +2049,7 @@ void hfi1_rc_rcv(struct hfi1_packet *packet)
+ struct ib_reth *reth;
+ unsigned long flags;
+ int ret;
+- bool is_fecn = false;
+- bool copy_last = false;
++ bool copy_last = false, fecn;
+ u32 rkey;
+ u8 extra_bytes = pad + packet->extra_byte + (SIZE_OF_CRC << 2);
+
+@@ -2059,7 +2058,7 @@ void hfi1_rc_rcv(struct hfi1_packet *packet)
+ if (hfi1_ruc_check_hdr(ibp, packet))
+ return;
+
+- is_fecn = process_ecn(qp, packet, false);
++ fecn = process_ecn(qp, packet);
+
+ /*
+ * Process responses (ACKs) before anything else. Note that the
+@@ -2070,8 +2069,6 @@ void hfi1_rc_rcv(struct hfi1_packet *packet)
+ if (opcode >= OP(RDMA_READ_RESPONSE_FIRST) &&
+ opcode <= OP(ATOMIC_ACKNOWLEDGE)) {
+ rc_rcv_resp(packet);
+- if (is_fecn)
+- goto send_ack;
+ return;
+ }
+
+@@ -2347,11 +2344,11 @@ send_last:
+
+ /* Schedule the send engine. */
+ qp->s_flags |= RVT_S_RESP_PENDING;
++ if (fecn)
++ qp->s_flags |= RVT_S_ECN;
+ hfi1_schedule_send(qp);
+
+ spin_unlock_irqrestore(&qp->s_lock, flags);
+- if (is_fecn)
+- goto send_ack;
+ return;
+ }
+
+@@ -2413,11 +2410,11 @@ send_last:
+
+ /* Schedule the send engine. */
+ qp->s_flags |= RVT_S_RESP_PENDING;
++ if (fecn)
++ qp->s_flags |= RVT_S_ECN;
+ hfi1_schedule_send(qp);
+
+ spin_unlock_irqrestore(&qp->s_lock, flags);
+- if (is_fecn)
+- goto send_ack;
+ return;
+ }
+
+@@ -2430,16 +2427,9 @@ send_last:
+ qp->r_ack_psn = psn;
+ qp->r_nak_state = 0;
+ /* Send an ACK if requested or required. */
+- if (psn & IB_BTH_REQ_ACK) {
+- if (packet->numpkt == 0) {
+- rc_cancel_ack(qp);
+- goto send_ack;
+- }
+- if (qp->r_adefered >= HFI1_PSN_CREDIT) {
+- rc_cancel_ack(qp);
+- goto send_ack;
+- }
+- if (unlikely(is_fecn)) {
++ if (psn & IB_BTH_REQ_ACK || fecn) {
++ if (packet->numpkt == 0 || fecn ||
++ qp->r_adefered >= HFI1_PSN_CREDIT) {
+ rc_cancel_ack(qp);
+ goto send_ack;
+ }
+@@ -2480,7 +2470,7 @@ nack_acc:
+ qp->r_nak_state = IB_NAK_REMOTE_ACCESS_ERROR;
+ qp->r_ack_psn = qp->r_psn;
+ send_ack:
+- hfi1_send_rc_ack(packet, is_fecn);
++ hfi1_send_rc_ack(packet, fecn);
+ }
+
+ void hfi1_rc_hdrerr(
+diff --git a/drivers/infiniband/hw/hfi1/uc.c b/drivers/infiniband/hw/hfi1/uc.c
+index e254dcec6f64..4121d1a93b1b 100644
+--- a/drivers/infiniband/hw/hfi1/uc.c
++++ b/drivers/infiniband/hw/hfi1/uc.c
+@@ -321,7 +321,7 @@ void hfi1_uc_rcv(struct hfi1_packet *packet)
+ if (hfi1_ruc_check_hdr(ibp, packet))
+ return;
+
+- process_ecn(qp, packet, true);
++ process_ecn(qp, packet);
+
+ psn = ib_bth_get_psn(ohdr);
+ /* Compare the PSN verses the expected PSN. */
+diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
+index 54eb69564264..839593641e3f 100644
+--- a/drivers/infiniband/hw/hfi1/ud.c
++++ b/drivers/infiniband/hw/hfi1/ud.c
+@@ -51,6 +51,7 @@
+ #include "hfi.h"
+ #include "mad.h"
+ #include "verbs_txreq.h"
++#include "trace_ibhdrs.h"
+ #include "qp.h"
+
+ /* We support only two types - 9B and 16B for now */
+@@ -656,18 +657,19 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
+ u32 bth0, plen, vl, hwords = 7;
+ u16 len;
+ u8 l4;
+- struct hfi1_16b_header hdr;
++ struct hfi1_opa_header hdr;
+ struct ib_other_headers *ohdr;
+ struct pio_buf *pbuf;
+ struct send_context *ctxt = qp_to_send_context(qp, sc5);
+ struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
+ u32 nwords;
+
++ hdr.hdr_type = HFI1_PKT_TYPE_16B;
+ /* Populate length */
+ nwords = ((hfi1_get_16b_padding(hwords << 2, 0) +
+ SIZE_OF_LT) >> 2) + SIZE_OF_CRC;
+ if (old_grh) {
+- struct ib_grh *grh = &hdr.u.l.grh;
++ struct ib_grh *grh = &hdr.opah.u.l.grh;
+
+ grh->version_tclass_flow = old_grh->version_tclass_flow;
+ grh->paylen = cpu_to_be16(
+@@ -675,11 +677,11 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
+ grh->hop_limit = 0xff;
+ grh->sgid = old_grh->dgid;
+ grh->dgid = old_grh->sgid;
+- ohdr = &hdr.u.l.oth;
++ ohdr = &hdr.opah.u.l.oth;
+ l4 = OPA_16B_L4_IB_GLOBAL;
+ hwords += sizeof(struct ib_grh) / sizeof(u32);
+ } else {
+- ohdr = &hdr.u.oth;
++ ohdr = &hdr.opah.u.oth;
+ l4 = OPA_16B_L4_IB_LOCAL;
+ }
+
+@@ -693,7 +695,7 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
+
+ /* Convert dwords to flits */
+ len = (hwords + nwords) >> 1;
+- hfi1_make_16b_hdr(&hdr, slid, dlid, len, pkey, 1, 0, l4, sc5);
++ hfi1_make_16b_hdr(&hdr.opah, slid, dlid, len, pkey, 1, 0, l4, sc5);
+
+ plen = 2 /* PBC */ + hwords + nwords;
+ pbc_flags |= PBC_PACKET_BYPASS | PBC_INSERT_BYPASS_ICRC;
+@@ -701,9 +703,11 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
+ pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps, vl, plen);
+ if (ctxt) {
+ pbuf = sc_buffer_alloc(ctxt, plen, NULL, NULL);
+- if (pbuf)
++ if (!IS_ERR_OR_NULL(pbuf)) {
++ trace_pio_output_ibhdr(ppd->dd, &hdr, sc5);
+ ppd->dd->pio_inline_send(ppd->dd, pbuf, pbc,
+ &hdr, hwords);
++ }
+ }
+ }
+
+@@ -715,14 +719,15 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
+ u32 bth0, plen, vl, hwords = 5;
+ u16 lrh0;
+ u8 sl = ibp->sc_to_sl[sc5];
+- struct ib_header hdr;
++ struct hfi1_opa_header hdr;
+ struct ib_other_headers *ohdr;
+ struct pio_buf *pbuf;
+ struct send_context *ctxt = qp_to_send_context(qp, sc5);
+ struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
+
++ hdr.hdr_type = HFI1_PKT_TYPE_9B;
+ if (old_grh) {
+- struct ib_grh *grh = &hdr.u.l.grh;
++ struct ib_grh *grh = &hdr.ibh.u.l.grh;
+
+ grh->version_tclass_flow = old_grh->version_tclass_flow;
+ grh->paylen = cpu_to_be16(
+@@ -730,11 +735,11 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
+ grh->hop_limit = 0xff;
+ grh->sgid = old_grh->dgid;
+ grh->dgid = old_grh->sgid;
+- ohdr = &hdr.u.l.oth;
++ ohdr = &hdr.ibh.u.l.oth;
+ lrh0 = HFI1_LRH_GRH;
+ hwords += sizeof(struct ib_grh) / sizeof(u32);
+ } else {
+- ohdr = &hdr.u.oth;
++ ohdr = &hdr.ibh.u.oth;
+ lrh0 = HFI1_LRH_BTH;
+ }
+
+@@ -746,16 +751,18 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
+ ohdr->bth[1] = cpu_to_be32(remote_qpn | (1 << IB_BECN_SHIFT));
+ ohdr->bth[2] = 0; /* PSN 0 */
+
+- hfi1_make_ib_hdr(&hdr, lrh0, hwords + SIZE_OF_CRC, dlid, slid);
++ hfi1_make_ib_hdr(&hdr.ibh, lrh0, hwords + SIZE_OF_CRC, dlid, slid);
+ plen = 2 /* PBC */ + hwords;
+ pbc_flags |= (ib_is_sc5(sc5) << PBC_DC_INFO_SHIFT);
+ vl = sc_to_vlt(ppd->dd, sc5);
+ pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps, vl, plen);
+ if (ctxt) {
+ pbuf = sc_buffer_alloc(ctxt, plen, NULL, NULL);
+- if (pbuf)
++ if (!IS_ERR_OR_NULL(pbuf)) {
++ trace_pio_output_ibhdr(ppd->dd, &hdr, sc5);
+ ppd->dd->pio_inline_send(ppd->dd, pbuf, pbc,
+ &hdr, hwords);
++ }
+ }
+ }
+
+@@ -912,7 +919,7 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
+ src_qp = hfi1_16B_get_src_qpn(packet->mgmt);
+ }
+
+- process_ecn(qp, packet, (opcode != IB_OPCODE_CNP));
++ process_ecn(qp, packet);
+ /*
+ * Get the number of bytes the message was padded by
+ * and drop incomplete packets.
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index 4e7b3c027901..90e12f9433a3 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -1096,10 +1096,10 @@ int hfi1_verbs_send_pio(struct rvt_qp *qp, struct hfi1_pkt_state *ps,
+ if (cb)
+ iowait_pio_inc(&priv->s_iowait);
+ pbuf = sc_buffer_alloc(sc, plen, cb, qp);
+- if (unlikely(!pbuf)) {
++ if (unlikely(IS_ERR_OR_NULL(pbuf))) {
+ if (cb)
+ verbs_pio_complete(qp, 0);
+- if (ppd->host_link_state != HLS_UP_ACTIVE) {
++ if (IS_ERR(pbuf)) {
+ /*
+ * If we have filled the PIO buffers to capacity and are
+ * not in an active state this request is not going to
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index a73d388b7093..31b9b99f81cb 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -54,12 +54,13 @@ bool hns_roce_check_whether_mhop(struct hns_roce_dev *hr_dev, u32 type)
+ EXPORT_SYMBOL_GPL(hns_roce_check_whether_mhop);
+
+ static bool hns_roce_check_hem_null(struct hns_roce_hem **hem, u64 start_idx,
+- u32 bt_chunk_num)
++ u32 bt_chunk_num, u64 hem_max_num)
+ {
+- int i;
++ u64 check_max_num = start_idx + bt_chunk_num;
++ u64 i;
+
+- for (i = 0; i < bt_chunk_num; i++)
+- if (hem[start_idx + i])
++ for (i = start_idx; (i < check_max_num) && (i < hem_max_num); i++)
++ if (hem[i])
+ return false;
+
+ return true;
+@@ -413,6 +414,12 @@ static int hns_roce_table_mhop_get(struct hns_roce_dev *hr_dev,
+ return -EINVAL;
+ }
+
++ if (unlikely(hem_idx >= table->num_hem)) {
++ dev_err(dev, "Table %d exceed hem limt idx = %llu,max = %lu!\n",
++ table->type, hem_idx, table->num_hem);
++ return -EINVAL;
++ }
++
+ mutex_lock(&table->mutex);
+
+ if (table->hem[hem_idx]) {
+@@ -649,7 +656,7 @@ static void hns_roce_table_mhop_put(struct hns_roce_dev *hr_dev,
+ if (check_whether_bt_num_2(table->type, hop_num)) {
+ start_idx = mhop.l0_idx * chunk_ba_num;
+ if (hns_roce_check_hem_null(table->hem, start_idx,
+- chunk_ba_num)) {
++ chunk_ba_num, table->num_hem)) {
+ if (table->type < HEM_TYPE_MTT &&
+ hr_dev->hw->clear_hem(hr_dev, table, obj, 0))
+ dev_warn(dev, "Clear HEM base address failed.\n");
+@@ -663,7 +670,7 @@ static void hns_roce_table_mhop_put(struct hns_roce_dev *hr_dev,
+ start_idx = mhop.l0_idx * chunk_ba_num * chunk_ba_num +
+ mhop.l1_idx * chunk_ba_num;
+ if (hns_roce_check_hem_null(table->hem, start_idx,
+- chunk_ba_num)) {
++ chunk_ba_num, table->num_hem)) {
+ if (hr_dev->hw->clear_hem(hr_dev, table, obj, 1))
+ dev_warn(dev, "Clear HEM base address failed.\n");
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 7021444f18b4..417de7ac0d5e 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4833,7 +4833,8 @@ static int hns_roce_mhop_alloc_eq(struct hns_roce_dev *hr_dev,
+ break;
+ }
+ eq->cur_eqe_ba = eq->buf_dma[0];
+- eq->nxt_eqe_ba = eq->buf_dma[1];
++ if (ba_num > 1)
++ eq->nxt_eqe_ba = eq->buf_dma[1];
+
+ } else if (mhop_num == 2) {
+ /* alloc L1 BT and buf */
+@@ -4875,7 +4876,8 @@ static int hns_roce_mhop_alloc_eq(struct hns_roce_dev *hr_dev,
+ break;
+ }
+ eq->cur_eqe_ba = eq->buf_dma[0];
+- eq->nxt_eqe_ba = eq->buf_dma[1];
++ if (ba_num > 1)
++ eq->nxt_eqe_ba = eq->buf_dma[1];
+ }
+
+ eq->l0_last_num = i + 1;
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index af24698ff226..3012d7eb4ccb 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -262,7 +262,6 @@ void hns_roce_qp_free(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
+ hns_roce_table_put(hr_dev, &qp_table->trrl_table,
+ hr_qp->qpn);
+ hns_roce_table_put(hr_dev, &qp_table->irrl_table, hr_qp->qpn);
+- hns_roce_table_put(hr_dev, &qp_table->qp_table, hr_qp->qpn);
+ }
+ }
+ EXPORT_SYMBOL_GPL(hns_roce_qp_free);
+diff --git a/drivers/infiniband/hw/mlx5/ib_rep.c b/drivers/infiniband/hw/mlx5/ib_rep.c
+index 35a0e04c38f2..b841589c27c9 100644
+--- a/drivers/infiniband/hw/mlx5/ib_rep.c
++++ b/drivers/infiniband/hw/mlx5/ib_rep.c
+@@ -69,8 +69,10 @@ mlx5_ib_vport_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep)
+ ibdev->mdev = dev;
+ ibdev->num_ports = max(MLX5_CAP_GEN(dev, num_ports),
+ MLX5_CAP_GEN(dev, num_vhca_ports));
+- if (!__mlx5_ib_add(ibdev, &rep_profile))
++ if (!__mlx5_ib_add(ibdev, &rep_profile)) {
++ ib_dealloc_device(&ibdev->ib_dev);
+ return -EINVAL;
++ }
+
+ rep->rep_if[REP_IB].priv = ibdev;
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index df5be462dd28..2db34f7b5ced 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -2390,10 +2390,29 @@ static u8 get_match_criteria_enable(u32 *match_criteria)
+ return match_criteria_enable;
+ }
+
+-static void set_proto(void *outer_c, void *outer_v, u8 mask, u8 val)
++static int set_proto(void *outer_c, void *outer_v, u8 mask, u8 val)
+ {
+- MLX5_SET(fte_match_set_lyr_2_4, outer_c, ip_protocol, mask);
+- MLX5_SET(fte_match_set_lyr_2_4, outer_v, ip_protocol, val);
++ u8 entry_mask;
++ u8 entry_val;
++ int err = 0;
++
++ if (!mask)
++ goto out;
++
++ entry_mask = MLX5_GET(fte_match_set_lyr_2_4, outer_c,
++ ip_protocol);
++ entry_val = MLX5_GET(fte_match_set_lyr_2_4, outer_v,
++ ip_protocol);
++ if (!entry_mask) {
++ MLX5_SET(fte_match_set_lyr_2_4, outer_c, ip_protocol, mask);
++ MLX5_SET(fte_match_set_lyr_2_4, outer_v, ip_protocol, val);
++ goto out;
++ }
++ /* Don't override existing ip protocol */
++ if (mask != entry_mask || val != entry_val)
++ err = -EINVAL;
++out:
++ return err;
+ }
+
+ static void set_flow_label(void *misc_c, void *misc_v, u32 mask, u32 val,
+@@ -2597,8 +2616,10 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
+ set_tos(headers_c, headers_v,
+ ib_spec->ipv4.mask.tos, ib_spec->ipv4.val.tos);
+
+- set_proto(headers_c, headers_v,
+- ib_spec->ipv4.mask.proto, ib_spec->ipv4.val.proto);
++ if (set_proto(headers_c, headers_v,
++ ib_spec->ipv4.mask.proto,
++ ib_spec->ipv4.val.proto))
++ return -EINVAL;
+ break;
+ case IB_FLOW_SPEC_IPV6:
+ if (FIELDS_NOT_SUPPORTED(ib_spec->ipv6.mask, LAST_IPV6_FIELD))
+@@ -2637,9 +2658,10 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
+ ib_spec->ipv6.mask.traffic_class,
+ ib_spec->ipv6.val.traffic_class);
+
+- set_proto(headers_c, headers_v,
+- ib_spec->ipv6.mask.next_hdr,
+- ib_spec->ipv6.val.next_hdr);
++ if (set_proto(headers_c, headers_v,
++ ib_spec->ipv6.mask.next_hdr,
++ ib_spec->ipv6.val.next_hdr))
++ return -EINVAL;
+
+ set_flow_label(misc_params_c, misc_params_v,
+ ntohl(ib_spec->ipv6.mask.flow_label),
+@@ -2660,10 +2682,8 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
+ LAST_TCP_UDP_FIELD))
+ return -EOPNOTSUPP;
+
+- MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_protocol,
+- 0xff);
+- MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol,
+- IPPROTO_TCP);
++ if (set_proto(headers_c, headers_v, 0xff, IPPROTO_TCP))
++ return -EINVAL;
+
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, tcp_sport,
+ ntohs(ib_spec->tcp_udp.mask.src_port));
+@@ -2680,10 +2700,8 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
+ LAST_TCP_UDP_FIELD))
+ return -EOPNOTSUPP;
+
+- MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_protocol,
+- 0xff);
+- MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol,
+- IPPROTO_UDP);
++ if (set_proto(headers_c, headers_v, 0xff, IPPROTO_UDP))
++ return -EINVAL;
+
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, udp_sport,
+ ntohs(ib_spec->tcp_udp.mask.src_port));
+@@ -2699,6 +2717,9 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
+ if (ib_spec->gre.mask.c_ks_res0_ver)
+ return -EOPNOTSUPP;
+
++ if (set_proto(headers_c, headers_v, 0xff, IPPROTO_GRE))
++ return -EINVAL;
++
+ MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_protocol,
+ 0xff);
+ MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol,
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index ef0f710587ad..4c0f0ce02d2f 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -2598,6 +2598,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX |
+ MLX5_QP_OPTPAR_Q_KEY |
+ MLX5_QP_OPTPAR_PRI_PORT,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_PKEY_INDEX |
++ MLX5_QP_OPTPAR_PRI_PORT,
+ },
+ [MLX5_QP_STATE_RTR] = {
+ [MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
+@@ -2631,6 +2636,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ MLX5_QP_OPTPAR_RWE |
+ MLX5_QP_OPTPAR_PM_STATE,
+ [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
++ MLX5_QP_OPTPAR_RRE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_PM_STATE |
++ MLX5_QP_OPTPAR_RNR_TIMEOUT,
+ },
+ },
+ [MLX5_QP_STATE_RTS] = {
+@@ -2647,6 +2658,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY |
+ MLX5_QP_OPTPAR_SRQN |
+ MLX5_QP_OPTPAR_CQN_RCV,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_RNR_TIMEOUT |
++ MLX5_QP_OPTPAR_PM_STATE |
++ MLX5_QP_OPTPAR_ALT_ADDR_PATH,
+ },
+ },
+ [MLX5_QP_STATE_SQER] = {
+@@ -2658,6 +2675,10 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ MLX5_QP_OPTPAR_RWE |
+ MLX5_QP_OPTPAR_RAE |
+ MLX5_QP_OPTPAR_RRE,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RNR_TIMEOUT |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RRE,
+ },
+ },
+ };
+diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+index c158ca9fde6d..08271fce0b9e 100644
+--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+@@ -55,7 +55,7 @@
+
+ int ocrdma_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
+ {
+- if (index > 1)
++ if (index > 0)
+ return -EINVAL;
+
+ *pkey = 0xffff;
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 9167a1c40bcf..38fe2f741375 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -67,7 +67,7 @@ static inline int qedr_ib_copy_to_udata(struct ib_udata *udata, void *src,
+
+ int qedr_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
+ {
+- if (index > QEDR_ROCE_PKEY_TABLE_LEN)
++ if (index >= QEDR_ROCE_PKEY_TABLE_LEN)
+ return -EINVAL;
+
+ *pkey = QEDR_ROCE_PKEY_DEFAULT;
+@@ -158,54 +158,47 @@ int qedr_query_device(struct ib_device *ibdev,
+ return 0;
+ }
+
+-#define QEDR_SPEED_SDR (1)
+-#define QEDR_SPEED_DDR (2)
+-#define QEDR_SPEED_QDR (4)
+-#define QEDR_SPEED_FDR10 (8)
+-#define QEDR_SPEED_FDR (16)
+-#define QEDR_SPEED_EDR (32)
+-
+ static inline void get_link_speed_and_width(int speed, u8 *ib_speed,
+ u8 *ib_width)
+ {
+ switch (speed) {
+ case 1000:
+- *ib_speed = QEDR_SPEED_SDR;
++ *ib_speed = IB_SPEED_SDR;
+ *ib_width = IB_WIDTH_1X;
+ break;
+ case 10000:
+- *ib_speed = QEDR_SPEED_QDR;
++ *ib_speed = IB_SPEED_QDR;
+ *ib_width = IB_WIDTH_1X;
+ break;
+
+ case 20000:
+- *ib_speed = QEDR_SPEED_DDR;
++ *ib_speed = IB_SPEED_DDR;
+ *ib_width = IB_WIDTH_4X;
+ break;
+
+ case 25000:
+- *ib_speed = QEDR_SPEED_EDR;
++ *ib_speed = IB_SPEED_EDR;
+ *ib_width = IB_WIDTH_1X;
+ break;
+
+ case 40000:
+- *ib_speed = QEDR_SPEED_QDR;
++ *ib_speed = IB_SPEED_QDR;
+ *ib_width = IB_WIDTH_4X;
+ break;
+
+ case 50000:
+- *ib_speed = QEDR_SPEED_QDR;
+- *ib_width = IB_WIDTH_4X;
++ *ib_speed = IB_SPEED_HDR;
++ *ib_width = IB_WIDTH_1X;
+ break;
+
+ case 100000:
+- *ib_speed = QEDR_SPEED_EDR;
++ *ib_speed = IB_SPEED_EDR;
+ *ib_width = IB_WIDTH_4X;
+ break;
+
+ default:
+ /* Unsupported */
+- *ib_speed = QEDR_SPEED_SDR;
++ *ib_speed = IB_SPEED_SDR;
+ *ib_width = IB_WIDTH_1X;
+ }
+ }
+diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+index 3db232429630..e611f133aa97 100644
+--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+@@ -447,7 +447,7 @@ struct net_device *usnic_get_netdev(struct ib_device *device, u8 port_num)
+ int usnic_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
+ u16 *pkey)
+ {
+- if (index > 1)
++ if (index > 0)
+ return -EINVAL;
+
+ *pkey = 0xffff;
+diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
+index 2ee4b08b00ea..a57276f2cb84 100644
+--- a/drivers/infiniband/sw/rxe/rxe_cq.c
++++ b/drivers/infiniband/sw/rxe/rxe_cq.c
+@@ -30,7 +30,7 @@
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+-
++#include <linux/vmalloc.h>
+ #include "rxe.h"
+ #include "rxe_loc.h"
+ #include "rxe_queue.h"
+@@ -97,7 +97,7 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
+ err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, context,
+ cq->queue->buf, cq->queue->buf_size, &cq->queue->ip);
+ if (err) {
+- kvfree(cq->queue->buf);
++ vfree(cq->queue->buf);
+ kfree(cq->queue);
+ return err;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
+index 8094cbaa54a9..54add70c22b5 100644
+--- a/drivers/infiniband/sw/rxe/rxe_net.c
++++ b/drivers/infiniband/sw/rxe/rxe_net.c
+@@ -533,8 +533,9 @@ struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av,
+ if (unlikely(!skb))
+ goto out;
+
+- skb_reserve(skb, hdr_len + LL_RESERVED_SPACE(rxe->ndev));
++ skb_reserve(skb, hdr_len + LL_RESERVED_SPACE(ndev));
+
++ /* FIXME: hold reference to this netdev until life of this skb. */
+ skb->dev = ndev;
+ if (av->network_type == RDMA_NETWORK_IPV4)
+ skb->protocol = htons(ETH_P_IP);
+diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c
+index b4a8acc7bb7d..0e2425f28233 100644
+--- a/drivers/infiniband/sw/rxe/rxe_pool.c
++++ b/drivers/infiniband/sw/rxe/rxe_pool.c
+@@ -112,6 +112,18 @@ static inline struct kmem_cache *pool_cache(struct rxe_pool *pool)
+ return rxe_type_info[pool->type].cache;
+ }
+
++static void rxe_cache_clean(size_t cnt)
++{
++ int i;
++ struct rxe_type_info *type;
++
++ for (i = 0; i < cnt; i++) {
++ type = &rxe_type_info[i];
++ kmem_cache_destroy(type->cache);
++ type->cache = NULL;
++ }
++}
++
+ int rxe_cache_init(void)
+ {
+ int err;
+@@ -136,24 +148,14 @@ int rxe_cache_init(void)
+ return 0;
+
+ err1:
+- while (--i >= 0) {
+- kmem_cache_destroy(type->cache);
+- type->cache = NULL;
+- }
++ rxe_cache_clean(i);
+
+ return err;
+ }
+
+ void rxe_cache_exit(void)
+ {
+- int i;
+- struct rxe_type_info *type;
+-
+- for (i = 0; i < RXE_NUM_TYPES; i++) {
+- type = &rxe_type_info[i];
+- kmem_cache_destroy(type->cache);
+- type->cache = NULL;
+- }
++ rxe_cache_clean(RXE_NUM_TYPES);
+ }
+
+ static int rxe_pool_init_index(struct rxe_pool *pool, u32 max, u32 min)
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index c58452daffc7..230697fa31fe 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -34,6 +34,7 @@
+ #include <linux/skbuff.h>
+ #include <linux/delay.h>
+ #include <linux/sched.h>
++#include <linux/vmalloc.h>
+
+ #include "rxe.h"
+ #include "rxe_loc.h"
+@@ -247,7 +248,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
+ &qp->sq.queue->ip);
+
+ if (err) {
+- kvfree(qp->sq.queue->buf);
++ vfree(qp->sq.queue->buf);
+ kfree(qp->sq.queue);
+ return err;
+ }
+@@ -300,7 +301,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
+ qp->rq.queue->buf, qp->rq.queue->buf_size,
+ &qp->rq.queue->ip);
+ if (err) {
+- kvfree(qp->rq.queue->buf);
++ vfree(qp->rq.queue->buf);
+ kfree(qp->rq.queue);
+ return err;
+ }
+diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
+index 120b40829560..a7aeaa0c6fbc 100644
+--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
++++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
+@@ -197,7 +197,7 @@ struct iser_data_buf {
+ struct scatterlist *sg;
+ int size;
+ unsigned long data_len;
+- unsigned int dma_nents;
++ int dma_nents;
+ };
+
+ /* fwd declarations */
+diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
+index 009be8889d71..379bc0dfc388 100644
+--- a/drivers/infiniband/ulp/iser/iser_memory.c
++++ b/drivers/infiniband/ulp/iser/iser_memory.c
+@@ -240,8 +240,8 @@ int iser_fast_reg_fmr(struct iscsi_iser_task *iser_task,
+ page_vec->npages = 0;
+ page_vec->fake_mr.page_size = SIZE_4K;
+ plen = ib_sg_to_pages(&page_vec->fake_mr, mem->sg,
+- mem->size, NULL, iser_set_page);
+- if (unlikely(plen < mem->size)) {
++ mem->dma_nents, NULL, iser_set_page);
++ if (unlikely(plen < mem->dma_nents)) {
+ iser_err("page vec too short to hold this SG\n");
+ iser_data_buf_dump(mem, device->ib_device);
+ iser_dump_page_vec(page_vec);
+@@ -451,10 +451,10 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
+
+ ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
+
+- n = ib_map_mr_sg(mr, mem->sg, mem->size, NULL, SIZE_4K);
+- if (unlikely(n != mem->size)) {
++ n = ib_map_mr_sg(mr, mem->sg, mem->dma_nents, NULL, SIZE_4K);
++ if (unlikely(n != mem->dma_nents)) {
+ iser_err("failed to map sg (%d/%d)\n",
+- n, mem->size);
++ n, mem->dma_nents);
+ return n < 0 ? n : -EINVAL;
+ }
+
+diff --git a/drivers/input/keyboard/nomadik-ske-keypad.c b/drivers/input/keyboard/nomadik-ske-keypad.c
+index 8567ee47761e..ae3b04557074 100644
+--- a/drivers/input/keyboard/nomadik-ske-keypad.c
++++ b/drivers/input/keyboard/nomadik-ske-keypad.c
+@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(struct ske_keypad *keypad)
+ while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--)
+ cpu_relax();
+
+- if (!timeout)
++ if (timeout == -1)
+ return -EINVAL;
+
+ /*
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 9991386fb700..bea19aa33758 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2153,6 +2153,8 @@ skip_ats_check:
+ */
+ domain_flush_tlb_pde(domain);
+
++ domain_flush_complete(domain);
++
+ return ret;
+ }
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 1e9a5da562f0..465f28a7844c 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -422,6 +422,9 @@ static void iommu_enable(struct amd_iommu *iommu)
+
+ static void iommu_disable(struct amd_iommu *iommu)
+ {
++ if (!iommu->mmio_base)
++ return;
++
+ /* Disable command buffer */
+ iommu_feature_disable(iommu, CONTROL_CMDBUF_EN);
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index b9af2419006f..9df3b8441227 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -387,7 +387,6 @@ struct dmar_rmrr_unit {
+ u64 end_address; /* reserved end address */
+ struct dmar_dev_scope *devices; /* target devices */
+ int devices_cnt; /* target device count */
+- struct iommu_resv_region *resv; /* reserved region handle */
+ };
+
+ struct dmar_atsr_unit {
+@@ -3387,9 +3386,12 @@ static int __init init_dmars(void)
+ iommu_identity_mapping |= IDENTMAP_ALL;
+
+ #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
+- iommu_identity_mapping |= IDENTMAP_GFX;
++ dmar_map_gfx = 0;
+ #endif
+
++ if (!dmar_map_gfx)
++ iommu_identity_mapping |= IDENTMAP_GFX;
++
+ check_tylersburg_isoch();
+
+ if (iommu_identity_mapping) {
+@@ -4182,7 +4184,6 @@ static inline void init_iommu_pm_ops(void) {}
+ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
+ {
+ struct acpi_dmar_reserved_memory *rmrr;
+- int prot = DMA_PTE_READ|DMA_PTE_WRITE;
+ struct dmar_rmrr_unit *rmrru;
+ size_t length;
+
+@@ -4196,22 +4197,16 @@ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
+ rmrru->end_address = rmrr->end_address;
+
+ length = rmrr->end_address - rmrr->base_address + 1;
+- rmrru->resv = iommu_alloc_resv_region(rmrr->base_address, length, prot,
+- IOMMU_RESV_DIRECT);
+- if (!rmrru->resv)
+- goto free_rmrru;
+
+ rmrru->devices = dmar_alloc_dev_scope((void *)(rmrr + 1),
+ ((void *)rmrr) + rmrr->header.length,
+ &rmrru->devices_cnt);
+ if (rmrru->devices_cnt && rmrru->devices == NULL)
+- goto free_all;
++ goto free_rmrru;
+
+ list_add(&rmrru->list, &dmar_rmrr_units);
+
+ return 0;
+-free_all:
+- kfree(rmrru->resv);
+ free_rmrru:
+ kfree(rmrru);
+ out:
+@@ -4429,7 +4424,6 @@ static void intel_iommu_free_dmars(void)
+ list_for_each_entry_safe(rmrru, rmrr_n, &dmar_rmrr_units, list) {
+ list_del(&rmrru->list);
+ dmar_free_dev_scope(&rmrru->devices, &rmrru->devices_cnt);
+- kfree(rmrru->resv);
+ kfree(rmrru);
+ }
+
+@@ -5203,22 +5197,33 @@ static void intel_iommu_remove_device(struct device *dev)
+ static void intel_iommu_get_resv_regions(struct device *device,
+ struct list_head *head)
+ {
++ int prot = DMA_PTE_READ | DMA_PTE_WRITE;
+ struct iommu_resv_region *reg;
+ struct dmar_rmrr_unit *rmrr;
+ struct device *i_dev;
+ int i;
+
+- rcu_read_lock();
++ down_read(&dmar_global_lock);
+ for_each_rmrr_units(rmrr) {
+ for_each_active_dev_scope(rmrr->devices, rmrr->devices_cnt,
+ i, i_dev) {
++ struct iommu_resv_region *resv;
++ size_t length;
++
+ if (i_dev != device)
+ continue;
+
+- list_add_tail(&rmrr->resv->list, head);
++ length = rmrr->end_address - rmrr->base_address + 1;
++ resv = iommu_alloc_resv_region(rmrr->base_address,
++ length, prot,
++ IOMMU_RESV_DIRECT);
++ if (!resv)
++ break;
++
++ list_add_tail(&resv->list, head);
+ }
+ }
+- rcu_read_unlock();
++ up_read(&dmar_global_lock);
+
+ reg = iommu_alloc_resv_region(IOAPIC_RANGE_START,
+ IOAPIC_RANGE_END - IOAPIC_RANGE_START + 1,
+@@ -5233,10 +5238,8 @@ static void intel_iommu_put_resv_regions(struct device *dev,
+ {
+ struct iommu_resv_region *entry, *next;
+
+- list_for_each_entry_safe(entry, next, head, list) {
+- if (entry->type == IOMMU_RESV_MSI)
+- kfree(entry);
+- }
++ list_for_each_entry_safe(entry, next, head, list)
++ kfree(entry);
+ }
+
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index 188f4eaed6e5..fd8730b2cd46 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -293,7 +293,7 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_
+ int pasid_max;
+ int ret;
+
+- if (!iommu)
++ if (!iommu || dmar_disabled)
+ return -EINVAL;
+
+ if (dev_is_pci(dev)) {
+diff --git a/drivers/iommu/iommu-debugfs.c b/drivers/iommu/iommu-debugfs.c
+index 3b1bf88fd1b0..f03548942096 100644
+--- a/drivers/iommu/iommu-debugfs.c
++++ b/drivers/iommu/iommu-debugfs.c
+@@ -12,6 +12,7 @@
+ #include <linux/debugfs.h>
+
+ struct dentry *iommu_debugfs_dir;
++EXPORT_SYMBOL_GPL(iommu_debugfs_dir);
+
+ /**
+ * iommu_debugfs_setup - create the top-level iommu directory in debugfs
+@@ -23,9 +24,9 @@ struct dentry *iommu_debugfs_dir;
+ * Emit a strong warning at boot time to indicate that this feature is
+ * enabled.
+ *
+- * This function is called from iommu_init; drivers may then call
+- * iommu_debugfs_new_driver_dir() to instantiate a vendor-specific
+- * directory to be used to expose internal data.
++ * This function is called from iommu_init; drivers may then use
++ * iommu_debugfs_dir to instantiate a vendor-specific directory to be used
++ * to expose internal data.
+ */
+ void iommu_debugfs_setup(void)
+ {
+@@ -48,19 +49,3 @@ void iommu_debugfs_setup(void)
+ pr_warn("*************************************************************\n");
+ }
+ }
+-
+-/**
+- * iommu_debugfs_new_driver_dir - create a vendor directory under debugfs/iommu
+- * @vendor: name of the vendor-specific subdirectory to create
+- *
+- * This function is called by an IOMMU driver to create the top-level debugfs
+- * directory for that driver.
+- *
+- * Return: upon success, a pointer to the dentry for the new directory.
+- * NULL in case of failure.
+- */
+-struct dentry *iommu_debugfs_new_driver_dir(const char *vendor)
+-{
+- return debugfs_create_dir(vendor, iommu_debugfs_dir);
+-}
+-EXPORT_SYMBOL_GPL(iommu_debugfs_new_driver_dir);
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index ee25ec22778e..00e1c908cd8e 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -317,7 +317,7 @@ static ssize_t iommu_group_show_type(struct iommu_group *group,
+ type = "unmanaged\n";
+ break;
+ case IOMMU_DOMAIN_DMA:
+- type = "DMA";
++ type = "DMA\n";
+ break;
+ }
+ }
+@@ -1900,9 +1900,9 @@ int iommu_request_dm_for_dev(struct device *dev)
+ int ret;
+
+ /* Device must already be in a group before calling this function */
+- group = iommu_group_get_for_dev(dev);
+- if (IS_ERR(group))
+- return PTR_ERR(group);
++ group = iommu_group_get(dev);
++ if (!group)
++ return -EINVAL;
+
+ mutex_lock(&group->mutex);
+
+diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
+index 154cf44439cb..8e75f34ac886 100644
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -115,6 +115,30 @@ struct mtk_iommu_domain {
+
+ static struct iommu_ops mtk_iommu_ops;
+
++/*
++ * In M4U 4GB mode, the physical address is remapped as below:
++ *
++ * CPU Physical address:
++ * ====================
++ *
++ * 0 1G 2G 3G 4G 5G
++ * |---A---|---B---|---C---|---D---|---E---|
++ * +--I/O--+------------Memory-------------+
++ *
++ * IOMMU output physical address:
++ * =============================
++ *
++ * 4G 5G 6G 7G 8G
++ * |---E---|---B---|---C---|---D---|
++ * +------------Memory-------------+
++ *
++ * The Region 'A'(I/O) can NOT be mapped by M4U; For Region 'B'/'C'/'D', the
++ * bit32 of the CPU physical address always is needed to set, and for Region
++ * 'E', the CPU physical address keep as is.
++ * Additionally, The iommu consumers always use the CPU phyiscal address.
++ */
++#define MTK_IOMMU_4GB_MODE_REMAP_BASE 0x40000000
++
+ static LIST_HEAD(m4ulist); /* List all the M4U HWs */
+
+ #define for_each_m4u(data) list_for_each_entry(data, &m4ulist, list)
+@@ -409,7 +433,7 @@ static phys_addr_t mtk_iommu_iova_to_phys(struct iommu_domain *domain,
+ pa = dom->iop->iova_to_phys(dom->iop, iova);
+ spin_unlock_irqrestore(&dom->pgtlock, flags);
+
+- if (data->enable_4GB)
++ if (data->enable_4GB && pa < MTK_IOMMU_4GB_MODE_REMAP_BASE)
+ pa |= BIT_ULL(32);
+
+ return pa;
+diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c
+index e4cb3811e82a..005b839f6eb9 100644
+--- a/drivers/leds/led-triggers.c
++++ b/drivers/leds/led-triggers.c
+@@ -171,11 +171,11 @@ err_add_groups:
+ trig->deactivate(led_cdev);
+ err_activate:
+
+- led_cdev->trigger = NULL;
+- led_cdev->trigger_data = NULL;
+ write_lock_irqsave(&led_cdev->trigger->leddev_list_lock, flags);
+ list_del(&led_cdev->trig_list);
+ write_unlock_irqrestore(&led_cdev->trigger->leddev_list_lock, flags);
++ led_cdev->trigger = NULL;
++ led_cdev->trigger_data = NULL;
+ led_set_brightness(led_cdev, LED_OFF);
+ kfree(event);
+
+diff --git a/drivers/lightnvm/pblk-rb.c b/drivers/lightnvm/pblk-rb.c
+index f6eec0212dfc..d22c13b55622 100644
+--- a/drivers/lightnvm/pblk-rb.c
++++ b/drivers/lightnvm/pblk-rb.c
+@@ -784,8 +784,8 @@ int pblk_rb_tear_down_check(struct pblk_rb *rb)
+ }
+
+ out:
+- spin_unlock(&rb->w_lock);
+ spin_unlock_irq(&rb->s_lock);
++ spin_unlock(&rb->w_lock);
+
+ return ret;
+ }
+diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
+index aec46d5d3506..f7cc29c00302 100644
+--- a/drivers/mailbox/mtk-cmdq-mailbox.c
++++ b/drivers/mailbox/mtk-cmdq-mailbox.c
+@@ -363,6 +363,9 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)
+ WARN_ON(cmdq->suspended);
+
+ task = kzalloc(sizeof(*task), GFP_ATOMIC);
++ if (!task)
++ return -ENOMEM;
++
+ task->cmdq = cmdq;
+ INIT_LIST_HEAD(&task->list_entry);
+ task->pa_base = pkt->pa_base;
+diff --git a/drivers/mailbox/qcom-apcs-ipc-mailbox.c b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
+index 5255dcb551a7..d8b4f08f613b 100644
+--- a/drivers/mailbox/qcom-apcs-ipc-mailbox.c
++++ b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
+@@ -36,7 +36,7 @@ static const struct regmap_config apcs_regmap_config = {
+ .reg_bits = 32,
+ .reg_stride = 4,
+ .val_bits = 32,
+- .max_register = 0x1000,
++ .max_register = 0xFFC,
+ .fast_io = true,
+ };
+
+diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c
+index 5bceafbf6699..01e9e462512b 100644
+--- a/drivers/mailbox/ti-msgmgr.c
++++ b/drivers/mailbox/ti-msgmgr.c
+@@ -547,7 +547,7 @@ static struct mbox_chan *ti_msgmgr_of_xlate(struct mbox_controller *mbox,
+ }
+
+ if (d->is_sproxy) {
+- if (req_pid > d->num_valid_queues)
++ if (req_pid >= d->num_valid_queues)
+ goto err;
+ qinst = &inst->qinsts[req_pid];
+ return qinst->chan;
+diff --git a/drivers/md/bcache/debug.c b/drivers/md/bcache/debug.c
+index 8c53d874ada4..f6b60d5908f7 100644
+--- a/drivers/md/bcache/debug.c
++++ b/drivers/md/bcache/debug.c
+@@ -178,10 +178,9 @@ static ssize_t bch_dump_read(struct file *file, char __user *buf,
+ while (size) {
+ struct keybuf_key *w;
+ unsigned int bytes = min(i->bytes, size);
+- int err = copy_to_user(buf, i->buf, bytes);
+
+- if (err)
+- return err;
++ if (copy_to_user(buf, i->buf, bytes))
++ return -EFAULT;
+
+ ret += bytes;
+ buf += bytes;
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index 4b6be3b0fd52..5cdda9d6ca31 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -1136,7 +1136,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
+ mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+ *mf = fmt->format;
+ #else
+- return -ENOTTY;
++ ret = -ENOTTY;
+ #endif
+ } else {
+ s64 val;
+diff --git a/drivers/media/i2c/tw9910.c b/drivers/media/i2c/tw9910.c
+index a54548cc4285..c7321a70e3ed 100644
+--- a/drivers/media/i2c/tw9910.c
++++ b/drivers/media/i2c/tw9910.c
+@@ -1000,7 +1000,7 @@ static int tw9910_remove(struct i2c_client *client)
+ if (priv->pdn_gpio)
+ gpiod_put(priv->pdn_gpio);
+ clk_put(priv->clk);
+- v4l2_device_unregister_subdev(&priv->subdev);
++ v4l2_async_unregister_subdev(&priv->subdev);
+
+ return 0;
+ }
+diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
+index a3f44e30f821..88c2f3bea2b6 100644
+--- a/drivers/media/pci/cx18/cx18-fileops.c
++++ b/drivers/media/pci/cx18/cx18-fileops.c
+@@ -484,7 +484,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
+
+ CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
+index 7d52173073d6..bafcb3982274 100644
+--- a/drivers/media/pci/cx23885/cx23885-dvb.c
++++ b/drivers/media/pci/cx23885/cx23885-dvb.c
+@@ -1474,8 +1474,9 @@ static int dvb_register(struct cx23885_tsport *port)
+ if (fe0->dvb.frontend != NULL) {
+ struct i2c_adapter *tun_i2c;
+
+- fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
+- memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
++ fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
++ if (!fe0->dvb.frontend->sec_priv)
++ return -ENOMEM;
+ tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
+ if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
+ return -ENODEV;
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index 6196daae4b3e..043ac0ae9ed0 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
+
+ IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+diff --git a/drivers/media/pci/pt1/pt1.c b/drivers/media/pci/pt1/pt1.c
+index 7f878fc41b7e..93fecffb36ee 100644
+--- a/drivers/media/pci/pt1/pt1.c
++++ b/drivers/media/pci/pt1/pt1.c
+@@ -200,16 +200,10 @@ static const u8 va1j5jf8007t_25mhz_configs[][2] = {
+ static int config_demod(struct i2c_client *cl, enum pt1_fe_clk clk)
+ {
+ int ret;
+- u8 buf[2] = {0x01, 0x80};
+ bool is_sat;
+ const u8 (*cfg_data)[2];
+ int i, len;
+
+- ret = i2c_master_send(cl, buf, 2);
+- if (ret < 0)
+- return ret;
+- usleep_range(30000, 50000);
+-
+ is_sat = !strncmp(cl->name, TC90522_I2C_DEV_SAT,
+ strlen(TC90522_I2C_DEV_SAT));
+ if (is_sat) {
+@@ -260,6 +254,46 @@ static int config_demod(struct i2c_client *cl, enum pt1_fe_clk clk)
+ return 0;
+ }
+
++/*
++ * Init registers for (each pair of) terrestrial/satellite block in demod.
++ * Note that resetting terr. block also resets its peer sat. block as well.
++ * This function must be called before configuring any demod block
++ * (before pt1_wakeup(), fe->ops.init()).
++ */
++static int pt1_demod_block_init(struct pt1 *pt1)
++{
++ struct i2c_client *cl;
++ u8 buf[2] = {0x01, 0x80};
++ int ret;
++ int i;
++
++ /* reset all terr. & sat. pairs first */
++ for (i = 0; i < PT1_NR_ADAPS; i++) {
++ cl = pt1->adaps[i]->demod_i2c_client;
++ if (strncmp(cl->name, TC90522_I2C_DEV_TER,
++ strlen(TC90522_I2C_DEV_TER)))
++ continue;
++
++ ret = i2c_master_send(cl, buf, 2);
++ if (ret < 0)
++ return ret;
++ usleep_range(30000, 50000);
++ }
++
++ for (i = 0; i < PT1_NR_ADAPS; i++) {
++ cl = pt1->adaps[i]->demod_i2c_client;
++ if (strncmp(cl->name, TC90522_I2C_DEV_SAT,
++ strlen(TC90522_I2C_DEV_SAT)))
++ continue;
++
++ ret = i2c_master_send(cl, buf, 2);
++ if (ret < 0)
++ return ret;
++ usleep_range(30000, 50000);
++ }
++ return 0;
++}
++
+ static void pt1_write_reg(struct pt1 *pt1, int reg, u32 data)
+ {
+ writel(data, pt1->regs + reg * 4);
+@@ -987,6 +1021,10 @@ static int pt1_init_frontends(struct pt1 *pt1)
+ goto tuner_release;
+ }
+
++ ret = pt1_demod_block_init(pt1);
++ if (ret < 0)
++ goto fe_unregister;
++
+ return 0;
+
+ tuner_release:
+@@ -1245,6 +1283,10 @@ static int pt1_resume(struct device *dev)
+ pt1_update_power(pt1);
+ usleep_range(1000, 2000);
+
++ ret = pt1_demod_block_init(pt1);
++ if (ret < 0)
++ goto resume_err;
++
+ for (i = 0; i < PT1_NR_ADAPS; i++)
+ dvb_frontend_reinitialise(pt1->adaps[i]->fe);
+
+diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
+index ff2b7da90c08..6c40e60ac993 100644
+--- a/drivers/media/pci/tw5864/tw5864-video.c
++++ b/drivers/media/pci/tw5864/tw5864-video.c
+@@ -1395,13 +1395,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
+ input->vb = NULL;
+ spin_unlock_irqrestore(&input->slock, flags);
+
+- v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
+-
+ if (!vb) { /* Gone because of disabling */
+ dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
+ return;
+ }
+
++ v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
++
+ /*
+ * Check for space.
+ * Mind the overhead of startcode emulation prevention.
+diff --git a/drivers/media/platform/atmel/atmel-isi.c b/drivers/media/platform/atmel/atmel-isi.c
+index e8db4df1e7c4..1a0e5233ae28 100644
+--- a/drivers/media/platform/atmel/atmel-isi.c
++++ b/drivers/media/platform/atmel/atmel-isi.c
+@@ -496,7 +496,7 @@ static void stop_streaming(struct vb2_queue *vq)
+ spin_unlock_irq(&isi->irqlock);
+
+ if (!isi->enable_preview_path) {
+- timeout = jiffies + FRAME_INTERVAL_MILLI_SEC * HZ;
++ timeout = jiffies + (FRAME_INTERVAL_MILLI_SEC * HZ) / 1000;
+ /* Wait until the end of the current frame. */
+ while ((isi_readl(isi, ISI_STATUS) & ISI_CTRL_CDC) &&
+ time_before(jiffies, timeout))
+diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
+index 340f8218f54d..80fa60a4c448 100644
+--- a/drivers/media/platform/davinci/isif.c
++++ b/drivers/media/platform/davinci/isif.c
+@@ -884,9 +884,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
+ static int isif_config_ycbcr(void)
+ {
+ struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
+- struct vpss_pg_frame_size frame_size;
+ u32 modeset = 0, ccdcfg = 0;
+- struct vpss_sync_pol sync;
+
+ dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
+
+@@ -974,13 +972,6 @@ static int isif_config_ycbcr(void)
+ /* two fields are interleaved in memory */
+ regw(0x00000249, SDOFST);
+
+- /* Setup test pattern if enabled */
+- if (isif_cfg.bayer.config_params.test_pat_gen) {
+- sync.ccdpg_hdpol = params->hd_pol;
+- sync.ccdpg_vdpol = params->vd_pol;
+- dm365_vpss_set_sync_pol(sync);
+- dm365_vpss_set_pg_frame_size(frame_size);
+- }
+ return 0;
+ }
+
+diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
+index df1ae6b5c854..e45e062f4442 100644
+--- a/drivers/media/platform/davinci/vpbe.c
++++ b/drivers/media/platform/davinci/vpbe.c
+@@ -126,7 +126,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev,
+ struct v4l2_output *output)
+ {
+ struct vpbe_config *cfg = vpbe_dev->cfg;
+- int temp_index = output->index;
++ unsigned int temp_index = output->index;
+
+ if (temp_index >= cfg->num_outputs)
+ return -EINVAL;
+diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
+index 5700b7818621..45511d24d570 100644
+--- a/drivers/media/platform/omap/omap_vout.c
++++ b/drivers/media/platform/omap/omap_vout.c
+@@ -1527,23 +1527,20 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
+ unsigned long size;
+ struct videobuf_buffer *vb;
+
+- vb = q->bufs[b->index];
+-
+ if (!vout->streaming)
+ return -EINVAL;
+
+- if (file->f_flags & O_NONBLOCK)
+- /* Call videobuf_dqbuf for non blocking mode */
+- ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1);
+- else
+- /* Call videobuf_dqbuf for blocking mode */
+- ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
++ ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK));
++ if (ret)
++ return ret;
++
++ vb = q->bufs[b->index];
+
+ addr = (unsigned long) vout->buf_phy_addr[vb->i];
+ size = (unsigned long) vb->size;
+ dma_unmap_single(vout->vid_dev->v4l2_dev.dev, addr,
+ size, DMA_TO_DEVICE);
+- return ret;
++ return 0;
+ }
+
+ static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i)
+diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c
+index 485fa3fa8b49..c389ba9ba74d 100644
+--- a/drivers/media/platform/rcar-vin/rcar-core.c
++++ b/drivers/media/platform/rcar-vin/rcar-core.c
+@@ -631,7 +631,7 @@ static int rvin_parallel_init(struct rvin_dev *vin)
+ ret = v4l2_async_notifier_register(&vin->v4l2_dev, &vin->notifier);
+ if (ret < 0) {
+ vin_err(vin, "Notifier registration failed\n");
+- v4l2_async_notifier_cleanup(&vin->group->notifier);
++ v4l2_async_notifier_cleanup(&vin->notifier);
+ return ret;
+ }
+
+diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+index 350afaa29a62..fa7c42cf4b4e 100644
+--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+@@ -2005,7 +2005,7 @@ static int s5p_jpeg_controls_create(struct s5p_jpeg_ctx *ctx)
+
+ v4l2_ctrl_new_std(&ctx->ctrl_handler, &s5p_jpeg_ctrl_ops,
+ V4L2_CID_JPEG_RESTART_INTERVAL,
+- 0, 3, 0xffff, 0);
++ 0, 0xffff, 1, 0);
+ if (ctx->jpeg->variant->version == SJPEG_S5P)
+ mask = ~0x06; /* 422, 420 */
+ }
+diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
+index bbbc1b6938a5..b24596697f57 100644
+--- a/drivers/media/platform/vivid/vivid-osd.c
++++ b/drivers/media/platform/vivid/vivid-osd.c
+@@ -155,7 +155,7 @@ static int _vivid_fb_check_var(struct fb_var_screeninfo *var, struct vivid_dev *
+ var->nonstd = 0;
+
+ var->vmode &= ~FB_VMODE_MASK;
+- var->vmode = FB_VMODE_NONINTERLACED;
++ var->vmode |= FB_VMODE_NONINTERLACED;
+
+ /* Dummy values */
+ var->hsync_len = 24;
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index 1cf4019689a5..cccf1a743f4e 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -1271,8 +1271,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
+
+ switch (action->type) {
+ case ACTION_SEND_COMMAND: /* Send */
+- if (fmc_send_cmd(fmdev, 0, 0, action->data,
+- action->size, NULL, NULL))
++ ret = fmc_send_cmd(fmdev, 0, 0, action->data,
++ action->size, NULL, NULL);
++ if (ret)
+ goto rel_fw;
+
+ cmd_cnt++;
+diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
+index 5657f8710ca6..69445c8e38e2 100644
+--- a/drivers/media/usb/em28xx/em28xx-core.c
++++ b/drivers/media/usb/em28xx/em28xx-core.c
+@@ -930,7 +930,7 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
+
+ usb_bufs->buf = kcalloc(num_bufs, sizeof(void *), GFP_KERNEL);
+ if (!usb_bufs->buf) {
+- kfree(usb_bufs->buf);
++ kfree(usb_bufs->urb);
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/memory/tegra/mc.c b/drivers/memory/tegra/mc.c
+index c8f16666256c..346d8eadb44b 100644
+--- a/drivers/memory/tegra/mc.c
++++ b/drivers/memory/tegra/mc.c
+@@ -664,12 +664,13 @@ static int tegra_mc_probe(struct platform_device *pdev)
+ }
+
+ isr = tegra_mc_irq;
+- }
+
+- err = tegra_mc_setup_timings(mc);
+- if (err < 0) {
+- dev_err(&pdev->dev, "failed to setup timings: %d\n", err);
+- return err;
++ err = tegra_mc_setup_timings(mc);
++ if (err < 0) {
++ dev_err(&pdev->dev, "failed to setup timings: %d\n",
++ err);
++ return err;
++ }
+ }
+
+ mc->irq = platform_get_irq(pdev, 0);
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index c37c8bb86068..742d6c1973f4 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -126,6 +126,18 @@ static const struct intel_lpss_platform_info apl_i2c_info = {
+ .properties = apl_i2c_properties,
+ };
+
++static struct property_entry glk_i2c_properties[] = {
++ PROPERTY_ENTRY_U32("i2c-sda-hold-time-ns", 313),
++ PROPERTY_ENTRY_U32("i2c-sda-falling-time-ns", 171),
++ PROPERTY_ENTRY_U32("i2c-scl-falling-time-ns", 290),
++ { },
++};
++
++static const struct intel_lpss_platform_info glk_i2c_info = {
++ .clk_rate = 133000000,
++ .properties = glk_i2c_properties,
++};
++
+ static const struct intel_lpss_platform_info cnl_i2c_info = {
+ .clk_rate = 216000000,
+ .properties = spt_i2c_properties,
+@@ -165,14 +177,14 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info },
+ /* GLK */
+- { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31b0), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31b2), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31b4), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31b6), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31b8), (kernel_ulong_t)&bxt_i2c_info },
+- { PCI_VDEVICE(INTEL, 0x31ba), (kernel_ulong_t)&bxt_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31b0), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31b2), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31b4), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31b6), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31b8), (kernel_ulong_t)&glk_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x31ba), (kernel_ulong_t)&glk_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x31bc), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x31be), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x31c0), (kernel_ulong_t)&bxt_uart_info },
+diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
+index ff3fba16e735..95e217e6b6d7 100644
+--- a/drivers/mfd/intel-lpss.c
++++ b/drivers/mfd/intel-lpss.c
+@@ -545,6 +545,7 @@ module_init(intel_lpss_init);
+
+ static void __exit intel_lpss_exit(void)
+ {
++ ida_destroy(&intel_lpss_devid_ida);
+ debugfs_remove(intel_lpss_debugfs);
+ }
+ module_exit(intel_lpss_exit);
+diff --git a/drivers/misc/aspeed-lpc-snoop.c b/drivers/misc/aspeed-lpc-snoop.c
+index 2feb4347d67f..c10be21a1663 100644
+--- a/drivers/misc/aspeed-lpc-snoop.c
++++ b/drivers/misc/aspeed-lpc-snoop.c
+@@ -101,13 +101,13 @@ static ssize_t snoop_file_read(struct file *file, char __user *buffer,
+ return ret ? ret : copied;
+ }
+
+-static unsigned int snoop_file_poll(struct file *file,
++static __poll_t snoop_file_poll(struct file *file,
+ struct poll_table_struct *pt)
+ {
+ struct aspeed_lpc_snoop_channel *chan = snoop_file_to_chan(file);
+
+ poll_wait(file, &chan->wq, pt);
+- return !kfifo_is_empty(&chan->fifo) ? POLLIN : 0;
++ return !kfifo_is_empty(&chan->fifo) ? EPOLLIN : 0;
+ }
+
+ static const struct file_operations snoop_fops = {
+diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
+index 4d77a6ae183a..87281b3695e6 100644
+--- a/drivers/misc/mei/main.c
++++ b/drivers/misc/mei/main.c
+@@ -599,10 +599,10 @@ static __poll_t mei_poll(struct file *file, poll_table *wait)
+ mei_cl_read_start(cl, mei_cl_mtu(cl), file);
+ }
+
+- if (req_events & (POLLOUT | POLLWRNORM)) {
++ if (req_events & (EPOLLOUT | EPOLLWRNORM)) {
+ poll_wait(file, &cl->tx_wait, wait);
+ if (cl->tx_cb_queued < dev->tx_queue_limit)
+- mask |= POLLOUT | POLLWRNORM;
++ mask |= EPOLLOUT | EPOLLWRNORM;
+ }
+
+ out:
+diff --git a/drivers/misc/mic/card/mic_x100.c b/drivers/misc/mic/card/mic_x100.c
+index b9f0710ffa6b..4007adc666f3 100644
+--- a/drivers/misc/mic/card/mic_x100.c
++++ b/drivers/misc/mic/card/mic_x100.c
+@@ -249,6 +249,9 @@ static int __init mic_probe(struct platform_device *pdev)
+ mdrv->dev = &pdev->dev;
+ snprintf(mdrv->name, sizeof(mic_driver_name), mic_driver_name);
+
++ /* FIXME: use dma_set_mask_and_coherent() and check result */
++ dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
++
+ mdev->mmio.pa = MIC_X100_MMIO_BASE;
+ mdev->mmio.len = MIC_X100_MMIO_LEN;
+ mdev->mmio.va = devm_ioremap(&pdev->dev, MIC_X100_MMIO_BASE,
+@@ -294,18 +297,6 @@ static void mic_platform_shutdown(struct platform_device *pdev)
+ mic_remove(pdev);
+ }
+
+-static u64 mic_dma_mask = DMA_BIT_MASK(64);
+-
+-static struct platform_device mic_platform_dev = {
+- .name = mic_driver_name,
+- .id = 0,
+- .num_resources = 0,
+- .dev = {
+- .dma_mask = &mic_dma_mask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
+- },
+-};
+-
+ static struct platform_driver __refdata mic_platform_driver = {
+ .probe = mic_probe,
+ .remove = mic_remove,
+@@ -315,6 +306,8 @@ static struct platform_driver __refdata mic_platform_driver = {
+ },
+ };
+
++static struct platform_device *mic_platform_dev;
++
+ static int __init mic_init(void)
+ {
+ int ret;
+@@ -328,9 +321,12 @@ static int __init mic_init(void)
+
+ request_module("mic_x100_dma");
+ mic_init_card_debugfs();
+- ret = platform_device_register(&mic_platform_dev);
++
++ mic_platform_dev = platform_device_register_simple(mic_driver_name,
++ 0, NULL, 0);
++ ret = PTR_ERR_OR_ZERO(mic_platform_dev);
+ if (ret) {
+- pr_err("platform_device_register ret %d\n", ret);
++ pr_err("platform_device_register_full ret %d\n", ret);
+ goto cleanup_debugfs;
+ }
+ ret = platform_driver_register(&mic_platform_driver);
+@@ -341,7 +337,7 @@ static int __init mic_init(void)
+ return ret;
+
+ device_unregister:
+- platform_device_unregister(&mic_platform_dev);
++ platform_device_unregister(mic_platform_dev);
+ cleanup_debugfs:
+ mic_exit_card_debugfs();
+ done:
+@@ -351,7 +347,7 @@ done:
+ static void __exit mic_exit(void)
+ {
+ platform_driver_unregister(&mic_platform_driver);
+- platform_device_unregister(&mic_platform_dev);
++ platform_device_unregister(mic_platform_dev);
+ mic_exit_card_debugfs();
+ }
+
+diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
+index 0c3ef6f1df54..519826ba1378 100644
+--- a/drivers/misc/sgi-xp/xpc_partition.c
++++ b/drivers/misc/sgi-xp/xpc_partition.c
+@@ -70,7 +70,7 @@ xpc_get_rsvd_page_pa(int nasid)
+ unsigned long rp_pa = nasid; /* seed with nasid */
+ size_t len = 0;
+ size_t buf_len = 0;
+- void *buf = buf;
++ void *buf = NULL;
+ void *buf_base = NULL;
+ enum xp_retval (*get_partition_rsvd_page_pa)
+ (void *, u64 *, unsigned long *, size_t *) =
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index f57f5de54206..dd1c14d8f686 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -385,8 +385,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
+
+ if (mmc_gpio_alloc(host)) {
+ put_device(&host->class_dev);
+- ida_simple_remove(&mmc_host_ida, host->index);
+- kfree(host);
+ return NULL;
+ }
+
+diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
+index dd2f73af8f2c..d5bbe8e544de 100644
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -119,7 +119,14 @@ static const struct mmc_fixup mmc_ext_csd_fixups[] = {
+ END_FIXUP
+ };
+
++
+ static const struct mmc_fixup sdio_fixup_methods[] = {
++ SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251,
++ add_quirk, MMC_QUIRK_NONSTD_FUNC_IF),
++
++ SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251,
++ add_quirk, MMC_QUIRK_DISABLE_CD),
++
+ SDIO_FIXUP(SDIO_VENDOR_ID_TI, SDIO_DEVICE_ID_TI_WL1271,
+ add_quirk, MMC_QUIRK_NONSTD_FUNC_IF),
+
+diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c
+index 552bddc5096c..1cd10356fc14 100644
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -55,7 +55,9 @@ static int sdhci_brcmstb_probe(struct platform_device *pdev)
+ }
+
+ sdhci_get_of_property(pdev);
+- mmc_of_parse(host->mmc);
++ res = mmc_of_parse(host->mmc);
++ if (res)
++ goto err;
+
+ /*
+ * Supply the existing CAPS, but clear the UHS modes. This
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 2d3a2cb026d2..9f21e710fc38 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -343,7 +343,8 @@ static void b53_set_forwarding(struct b53_device *dev, int enable)
+ b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, mgmt);
+ }
+
+-static void b53_enable_vlan(struct b53_device *dev, bool enable)
++static void b53_enable_vlan(struct b53_device *dev, bool enable,
++ bool enable_filtering)
+ {
+ u8 mgmt, vc0, vc1, vc4 = 0, vc5;
+
+@@ -368,8 +369,13 @@ static void b53_enable_vlan(struct b53_device *dev, bool enable)
+ vc0 |= VC0_VLAN_EN | VC0_VID_CHK_EN | VC0_VID_HASH_VID;
+ vc1 |= VC1_RX_MCST_UNTAG_EN | VC1_RX_MCST_FWD_EN;
+ vc4 &= ~VC4_ING_VID_CHECK_MASK;
+- vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S;
+- vc5 |= VC5_DROP_VTABLE_MISS;
++ if (enable_filtering) {
++ vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S;
++ vc5 |= VC5_DROP_VTABLE_MISS;
++ } else {
++ vc4 |= VC4_ING_VID_VIO_FWD << VC4_ING_VID_CHECK_S;
++ vc5 &= ~VC5_DROP_VTABLE_MISS;
++ }
+
+ if (is5325(dev))
+ vc0 &= ~VC0_RESERVED_1;
+@@ -419,6 +425,9 @@ static void b53_enable_vlan(struct b53_device *dev, bool enable)
+ }
+
+ b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, mgmt);
++
++ dev->vlan_enabled = enable;
++ dev->vlan_filtering_enabled = enable_filtering;
+ }
+
+ static int b53_set_jumbo(struct b53_device *dev, bool enable, bool allow_10_100)
+@@ -622,25 +631,35 @@ static void b53_enable_mib(struct b53_device *dev)
+ b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc);
+ }
+
++static u16 b53_default_pvid(struct b53_device *dev)
++{
++ if (is5325(dev) || is5365(dev))
++ return 1;
++ else
++ return 0;
++}
++
+ int b53_configure_vlan(struct dsa_switch *ds)
+ {
+ struct b53_device *dev = ds->priv;
+ struct b53_vlan vl = { 0 };
+- int i;
++ int i, def_vid;
++
++ def_vid = b53_default_pvid(dev);
+
+ /* clear all vlan entries */
+ if (is5325(dev) || is5365(dev)) {
+- for (i = 1; i < dev->num_vlans; i++)
++ for (i = def_vid; i < dev->num_vlans; i++)
+ b53_set_vlan_entry(dev, i, &vl);
+ } else {
+ b53_do_vlan_op(dev, VTA_CMD_CLEAR);
+ }
+
+- b53_enable_vlan(dev, false);
++ b53_enable_vlan(dev, false, dev->vlan_filtering_enabled);
+
+ b53_for_each_port(dev, i)
+ b53_write16(dev, B53_VLAN_PAGE,
+- B53_VLAN_PORT_DEF_TAG(i), 1);
++ B53_VLAN_PORT_DEF_TAG(i), def_vid);
+
+ if (!is5325(dev) && !is5365(dev))
+ b53_set_jumbo(dev, dev->enable_jumbo, false);
+@@ -1071,6 +1090,46 @@ static void b53_adjust_link(struct dsa_switch *ds, int port,
+
+ int b53_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering)
+ {
++ struct b53_device *dev = ds->priv;
++ struct net_device *bridge_dev;
++ unsigned int i;
++ u16 pvid, new_pvid;
++
++ /* Handle the case were multiple bridges span the same switch device
++ * and one of them has a different setting than what is being requested
++ * which would be breaking filtering semantics for any of the other
++ * bridge devices.
++ */
++ b53_for_each_port(dev, i) {
++ bridge_dev = dsa_to_port(ds, i)->bridge_dev;
++ if (bridge_dev &&
++ bridge_dev != dsa_to_port(ds, port)->bridge_dev &&
++ br_vlan_enabled(bridge_dev) != vlan_filtering) {
++ netdev_err(bridge_dev,
++ "VLAN filtering is global to the switch!\n");
++ return -EINVAL;
++ }
++ }
++
++ b53_read16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port), &pvid);
++ new_pvid = pvid;
++ if (dev->vlan_filtering_enabled && !vlan_filtering) {
++ /* Filtering is currently enabled, use the default PVID since
++ * the bridge does not expect tagging anymore
++ */
++ dev->ports[port].pvid = pvid;
++ new_pvid = b53_default_pvid(dev);
++ } else if (!dev->vlan_filtering_enabled && vlan_filtering) {
++ /* Filtering is currently disabled, restore the previous PVID */
++ new_pvid = dev->ports[port].pvid;
++ }
++
++ if (pvid != new_pvid)
++ b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
++ new_pvid);
++
++ b53_enable_vlan(dev, dev->vlan_enabled, vlan_filtering);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(b53_vlan_filtering);
+@@ -1086,7 +1145,7 @@ int b53_vlan_prepare(struct dsa_switch *ds, int port,
+ if (vlan->vid_end > dev->num_vlans)
+ return -ERANGE;
+
+- b53_enable_vlan(dev, true);
++ b53_enable_vlan(dev, true, dev->vlan_filtering_enabled);
+
+ return 0;
+ }
+@@ -1116,7 +1175,7 @@ void b53_vlan_add(struct dsa_switch *ds, int port,
+ b53_fast_age_vlan(dev, vid);
+ }
+
+- if (pvid) {
++ if (pvid && !dsa_is_cpu_port(ds, port)) {
+ b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
+ vlan->vid_end);
+ b53_fast_age_vlan(dev, vid);
+@@ -1142,12 +1201,8 @@ int b53_vlan_del(struct dsa_switch *ds, int port,
+
+ vl->members &= ~BIT(port);
+
+- if (pvid == vid) {
+- if (is5325(dev) || is5365(dev))
+- pvid = 1;
+- else
+- pvid = 0;
+- }
++ if (pvid == vid)
++ pvid = b53_default_pvid(dev);
+
+ if (untagged && !dsa_is_cpu_port(ds, port))
+ vl->untag &= ~(BIT(port));
+@@ -1460,10 +1515,7 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct net_device *br)
+ b53_write16(dev, B53_PVLAN_PAGE, B53_PVLAN_PORT_MASK(port), pvlan);
+ dev->ports[port].vlan_ctl_mask = pvlan;
+
+- if (is5325(dev) || is5365(dev))
+- pvid = 1;
+- else
+- pvid = 0;
++ pvid = b53_default_pvid(dev);
+
+ /* Make this port join all VLANs without VLAN entries */
+ if (is58xx(dev)) {
+diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
+index df149756c282..e87af5db0d6d 100644
+--- a/drivers/net/dsa/b53/b53_priv.h
++++ b/drivers/net/dsa/b53/b53_priv.h
+@@ -73,6 +73,7 @@ enum {
+ struct b53_port {
+ u16 vlan_ctl_mask;
+ struct ethtool_eee eee;
++ u16 pvid;
+ };
+
+ struct b53_vlan {
+@@ -118,6 +119,8 @@ struct b53_device {
+
+ unsigned int num_vlans;
+ struct b53_vlan *vlans;
++ bool vlan_enabled;
++ bool vlan_filtering_enabled;
+ unsigned int num_ports;
+ struct b53_port *ports;
+ };
+diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
+index 33232cc9fb04..6c04f32e9641 100644
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -451,6 +451,18 @@ qca8k_set_pad_ctrl(struct qca8k_priv *priv, int port, int mode)
+ qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
+ QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
+ break;
++ case PHY_INTERFACE_MODE_RGMII_ID:
++ /* RGMII_ID needs internal delay. This is enabled through
++ * PORT5_PAD_CTRL for all ports, rather than individual port
++ * registers
++ */
++ qca8k_write(priv, reg,
++ QCA8K_PORT_PAD_RGMII_EN |
++ QCA8K_PORT_PAD_RGMII_TX_DELAY(QCA8K_MAX_DELAY) |
++ QCA8K_PORT_PAD_RGMII_RX_DELAY(QCA8K_MAX_DELAY));
++ qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
++ QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
++ break;
+ case PHY_INTERFACE_MODE_SGMII:
+ qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN);
+ break;
+diff --git a/drivers/net/dsa/qca8k.h b/drivers/net/dsa/qca8k.h
+index 613fe5c50236..d146e54c8a6c 100644
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -40,6 +40,7 @@
+ ((0x8 + (x & 0x3)) << 22)
+ #define QCA8K_PORT_PAD_RGMII_RX_DELAY(x) \
+ ((0x10 + (x & 0x3)) << 20)
++#define QCA8K_MAX_DELAY 3
+ #define QCA8K_PORT_PAD_RGMII_RX_DELAY_EN BIT(24)
+ #define QCA8K_PORT_PAD_SGMII_EN BIT(7)
+ #define QCA8K_REG_MODULE_EN 0x030
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
+index 7635c38e77dd..92261c946e2a 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -2008,7 +2008,7 @@ int ena_com_set_hash_function(struct ena_com_dev *ena_dev)
+ if (unlikely(ret))
+ return ret;
+
+- if (get_resp.u.flow_hash_func.supported_func & (1 << rss->hash_func)) {
++ if (!(get_resp.u.flow_hash_func.supported_func & BIT(rss->hash_func))) {
+ pr_err("Func hash %d isn't supported by device, abort\n",
+ rss->hash_func);
+ return -EOPNOTSUPP;
+@@ -2093,6 +2093,7 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,
+ return -EINVAL;
+ }
+
++ rss->hash_func = func;
+ rc = ena_com_set_hash_function(ena_dev);
+
+ /* Restore the old function */
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index 521607bc4393..eb9e07fa427e 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -695,8 +695,8 @@ static int ena_set_rxfh(struct net_device *netdev, const u32 *indir,
+ if (indir) {
+ for (i = 0; i < ENA_RX_RSS_TABLE_SIZE; i++) {
+ rc = ena_com_indirect_table_fill_entry(ena_dev,
+- ENA_IO_RXQ_IDX(indir[i]),
+- i);
++ i,
++ ENA_IO_RXQ_IDX(indir[i]));
+ if (unlikely(rc)) {
+ netif_err(adapter, drv, netdev,
+ "Cannot fill indirect table (index is too large)\n");
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index e26c195fec83..9afb19ebba58 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -1800,6 +1800,7 @@ err_setup_rx:
+ err_setup_tx:
+ ena_free_io_irq(adapter);
+ err_req_irq:
++ ena_del_napi(adapter);
+
+ return rc;
+ }
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+index 82582fa54d5d..72aa2a4c4d66 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+@@ -309,15 +309,13 @@ irqreturn_t aq_vec_isr_legacy(int irq, void *private)
+ {
+ struct aq_vec_s *self = private;
+ u64 irq_mask = 0U;
+- irqreturn_t err = 0;
++ int err;
+
+- if (!self) {
+- err = -EINVAL;
+- goto err_exit;
+- }
++ if (!self)
++ return IRQ_NONE;
+ err = self->aq_hw_ops->hw_irq_read(self->aq_hw, &irq_mask);
+ if (err < 0)
+- goto err_exit;
++ return IRQ_NONE;
+
+ if (irq_mask) {
+ self->aq_hw_ops->hw_irq_disable(self->aq_hw,
+@@ -325,11 +323,10 @@ irqreturn_t aq_vec_isr_legacy(int irq, void *private)
+ napi_schedule(&self->napi);
+ } else {
+ self->aq_hw_ops->hw_irq_enable(self->aq_hw, 1U);
+- err = IRQ_NONE;
++ return IRQ_NONE;
+ }
+
+-err_exit:
+- return err >= 0 ? IRQ_HANDLED : IRQ_NONE;
++ return IRQ_HANDLED;
+ }
+
+ cpumask_t *aq_vec_get_affinity_mask(struct aq_vec_s *self)
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+index 97addfa6f895..dab5891b9714 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+@@ -207,8 +207,8 @@ static int hw_atl_a0_hw_rss_set(struct aq_hw_s *self,
+ u32 i = 0U;
+ u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
+ int err = 0;
+- u16 bitary[(HW_ATL_A0_RSS_REDIRECTION_MAX *
+- HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
++ u16 bitary[1 + (HW_ATL_A0_RSS_REDIRECTION_MAX *
++ HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
+
+ memset(bitary, 0, sizeof(bitary));
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 51cd1f98bcf0..c4f914a29c38 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -192,8 +192,8 @@ static int hw_atl_b0_hw_rss_set(struct aq_hw_s *self,
+ u32 i = 0U;
+ u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
+ int err = 0;
+- u16 bitary[(HW_ATL_B0_RSS_REDIRECTION_MAX *
+- HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
++ u16 bitary[1 + (HW_ATL_B0_RSS_REDIRECTION_MAX *
++ HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
+
+ memset(bitary, 0, sizeof(bitary));
+
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 0bdbc72605e1..49aa3b5ea57c 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2470,7 +2470,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
+
+ priv->phy_interface = of_get_phy_mode(dn);
+ /* Default to GMII interface mode */
+- if (priv->phy_interface < 0)
++ if ((int)priv->phy_interface < 0)
+ priv->phy_interface = PHY_INTERFACE_MODE_GMII;
+
+ /* In the case of a fixed PHY, the DT node associated
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index f9e253b705ec..585f5aef0a45 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -527,6 +527,7 @@ struct rx_tpa_end_cmp_ext {
+ #define DFLT_HWRM_CMD_TIMEOUT 500
+ #define HWRM_CMD_TIMEOUT (bp->hwrm_cmd_timeout)
+ #define HWRM_RESET_TIMEOUT ((HWRM_CMD_TIMEOUT) * 4)
++#define HWRM_COREDUMP_TIMEOUT ((HWRM_CMD_TIMEOUT) * 12)
+ #define HWRM_RESP_ERR_CODE_MASK 0xffff
+ #define HWRM_RESP_LEN_OFFSET 4
+ #define HWRM_RESP_LEN_MASK 0xffff0000
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+index a85d2be986af..0e4e0b47f5d8 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+@@ -396,7 +396,7 @@ static int bnxt_hwrm_queue_dscp_qcaps(struct bnxt *bp)
+
+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_DSCP_QCAPS, -1, -1);
+ mutex_lock(&bp->hwrm_cmd_lock);
+- rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ rc = _hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+ if (!rc) {
+ bp->max_dscp_value = (1 << resp->num_dscp_bits) - 1;
+ if (bp->max_dscp_value < 0x3f)
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 0a409ba4012a..047024717d65 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1778,21 +1778,19 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ mutex_lock(&bp->hwrm_cmd_lock);
+ hwrm_err = _hwrm_send_message(bp, &install, sizeof(install),
+ INSTALL_PACKAGE_TIMEOUT);
+- if (hwrm_err)
+- goto flash_pkg_exit;
+-
+- if (resp->error_code) {
++ if (hwrm_err) {
+ u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err;
+
+- if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
++ if (resp->error_code && error_code ==
++ NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
+ install.flags |= cpu_to_le16(
+ NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG);
+ hwrm_err = _hwrm_send_message(bp, &install,
+ sizeof(install),
+ INSTALL_PACKAGE_TIMEOUT);
+- if (hwrm_err)
+- goto flash_pkg_exit;
+ }
++ if (hwrm_err)
++ goto flash_pkg_exit;
+ }
+
+ if (resp->result) {
+@@ -2600,7 +2598,7 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest,
+ bool offline = false;
+ u8 test_results = 0;
+ u8 test_mask = 0;
+- int rc, i;
++ int rc = 0, i;
+
+ if (!bp->num_tests || !BNXT_SINGLE_PF(bp))
+ return;
+@@ -2671,9 +2669,9 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest,
+ }
+ bnxt_hwrm_phy_loopback(bp, false, false);
+ bnxt_half_close_nic(bp);
+- bnxt_open_nic(bp, false, true);
++ rc = bnxt_open_nic(bp, false, true);
+ }
+- if (bnxt_test_irq(bp)) {
++ if (rc || bnxt_test_irq(bp)) {
+ buf[BNXT_IRQ_TEST_IDX] = 1;
+ etest->flags |= ETH_TEST_FL_FAILED;
+ }
+@@ -2835,7 +2833,7 @@ static int bnxt_hwrm_dbg_coredump_initiate(struct bnxt *bp, u16 component_id,
+ req.component_id = cpu_to_le16(component_id);
+ req.segment_id = cpu_to_le16(segment_id);
+
+- return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ return hwrm_send_message(bp, &req, sizeof(req), HWRM_COREDUMP_TIMEOUT);
+ }
+
+ static int bnxt_hwrm_dbg_coredump_retrieve(struct bnxt *bp, u16 component_id,
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+index bb04c695ab9f..c81d6c330548 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -5452,7 +5452,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ whoami = t4_read_reg(adapter, PL_WHOAMI_A);
+ pci_read_config_word(pdev, PCI_DEVICE_ID, &device_id);
+ chip = t4_get_chip_type(adapter, CHELSIO_PCI_ID_VER(device_id));
+- if (chip < 0) {
++ if ((int)chip < 0) {
+ dev_err(&pdev->dev, "Device %d is not supported\n", device_id);
+ err = chip;
+ goto out_free_adapter;
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/smt.c b/drivers/net/ethernet/chelsio/cxgb4/smt.c
+index 7b2207a2a130..9b3f4205cb4d 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/smt.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/smt.c
+@@ -98,11 +98,9 @@ found_reuse:
+
+ static void t4_smte_free(struct smt_entry *e)
+ {
+- spin_lock_bh(&e->lock);
+ if (atomic_read(&e->refcnt) == 0) { /* hasn't been recycled */
+ e->state = SMT_STATE_UNUSED;
+ }
+- spin_unlock_bh(&e->lock);
+ }
+
+ /**
+@@ -112,8 +110,10 @@ static void t4_smte_free(struct smt_entry *e)
+ */
+ void cxgb4_smt_release(struct smt_entry *e)
+ {
++ spin_lock_bh(&e->lock);
+ if (atomic_dec_and_test(&e->refcnt))
+ t4_smte_free(e);
++ spin_unlock_bh(&e->lock);
+ }
+ EXPORT_SYMBOL(cxgb4_smt_release);
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 462bb8c4f80c..d7736c9c6339 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -1600,13 +1600,15 @@ static int dpaa_eth_refill_bpools(struct dpaa_priv *priv)
+ * Skb freeing is not handled here.
+ *
+ * This function may be called on error paths in the Tx function, so guard
+- * against cases when not all fd relevant fields were filled in.
++ * against cases when not all fd relevant fields were filled in. To avoid
++ * reading the invalid transmission timestamp for the error paths set ts to
++ * false.
+ *
+ * Return the skb backpointer, since for S/G frames the buffer containing it
+ * gets freed here.
+ */
+ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+- const struct qm_fd *fd)
++ const struct qm_fd *fd, bool ts)
+ {
+ const enum dma_data_direction dma_dir = DMA_TO_DEVICE;
+ struct device *dev = priv->net_dev->dev.parent;
+@@ -1620,18 +1622,6 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+ skbh = (struct sk_buff **)phys_to_virt(addr);
+ skb = *skbh;
+
+- if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
+- memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+-
+- if (!fman_port_get_tstamp(priv->mac_dev->port[TX], (void *)skbh,
+- &ns)) {
+- shhwtstamps.hwtstamp = ns_to_ktime(ns);
+- skb_tstamp_tx(skb, &shhwtstamps);
+- } else {
+- dev_warn(dev, "fman_port_get_tstamp failed!\n");
+- }
+- }
+-
+ if (unlikely(qm_fd_get_format(fd) == qm_fd_sg)) {
+ nr_frags = skb_shinfo(skb)->nr_frags;
+ dma_unmap_single(dev, addr,
+@@ -1654,14 +1644,29 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+ dma_unmap_page(dev, qm_sg_addr(&sgt[i]),
+ qm_sg_entry_get_len(&sgt[i]), dma_dir);
+ }
+-
+- /* Free the page frag that we allocated on Tx */
+- skb_free_frag(phys_to_virt(addr));
+ } else {
+ dma_unmap_single(dev, addr,
+ skb_tail_pointer(skb) - (u8 *)skbh, dma_dir);
+ }
+
++ /* DMA unmapping is required before accessing the HW provided info */
++ if (ts && priv->tx_tstamp &&
++ skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
++ memset(&shhwtstamps, 0, sizeof(shhwtstamps));
++
++ if (!fman_port_get_tstamp(priv->mac_dev->port[TX], (void *)skbh,
++ &ns)) {
++ shhwtstamps.hwtstamp = ns_to_ktime(ns);
++ skb_tstamp_tx(skb, &shhwtstamps);
++ } else {
++ dev_warn(dev, "fman_port_get_tstamp failed!\n");
++ }
++ }
++
++ if (qm_fd_get_format(fd) == qm_fd_sg)
++ /* Free the page frag that we allocated on Tx */
++ skb_free_frag(phys_to_virt(addr));
++
+ return skb;
+ }
+
+@@ -2116,7 +2121,7 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ if (likely(dpaa_xmit(priv, percpu_stats, queue_mapping, &fd) == 0))
+ return NETDEV_TX_OK;
+
+- dpaa_cleanup_tx_fd(priv, &fd);
++ dpaa_cleanup_tx_fd(priv, &fd, false);
+ skb_to_fd_failed:
+ enomem:
+ percpu_stats->tx_errors++;
+@@ -2162,7 +2167,7 @@ static void dpaa_tx_error(struct net_device *net_dev,
+
+ percpu_priv->stats.tx_errors++;
+
+- skb = dpaa_cleanup_tx_fd(priv, fd);
++ skb = dpaa_cleanup_tx_fd(priv, fd, false);
+ dev_kfree_skb(skb);
+ }
+
+@@ -2203,7 +2208,7 @@ static void dpaa_tx_conf(struct net_device *net_dev,
+
+ percpu_priv->tx_confirm++;
+
+- skb = dpaa_cleanup_tx_fd(priv, fd);
++ skb = dpaa_cleanup_tx_fd(priv, fd, true);
+
+ consume_skb(skb);
+ }
+@@ -2433,7 +2438,7 @@ static void egress_ern(struct qman_portal *portal,
+ percpu_priv->stats.tx_fifo_errors++;
+ count_ern(percpu_priv, msg);
+
+- skb = dpaa_cleanup_tx_fd(priv, fd);
++ skb = dpaa_cleanup_tx_fd(priv, fd, false);
+ dev_kfree_skb_any(skb);
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+index 471805ea363b..b63871ef8a40 100644
+--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+@@ -1201,7 +1201,7 @@ static int hix5hd2_dev_probe(struct platform_device *pdev)
+ goto err_free_mdio;
+
+ priv->phy_mode = of_get_phy_mode(node);
+- if (priv->phy_mode < 0) {
++ if ((int)priv->phy_mode < 0) {
+ netdev_err(ndev, "not find phy-mode\n");
+ ret = -EINVAL;
+ goto err_mdiobus;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 1aaf6e2a3b39..3eb8b85f6afb 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1464,7 +1464,7 @@ static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev)
+ int i;
+
+ /* Find the stopped queue the same way the stack does */
+- for (i = 0; i < ndev->real_num_tx_queues; i++) {
++ for (i = 0; i < ndev->num_tx_queues; i++) {
+ struct netdev_queue *q;
+ unsigned long trans_start;
+
+@@ -2605,9 +2605,10 @@ err_free_chain:
+ cur_chain = head->next;
+ while (cur_chain) {
+ chain = cur_chain->next;
+- devm_kfree(&pdev->dev, chain);
++ devm_kfree(&pdev->dev, cur_chain);
+ cur_chain = chain;
+ }
++ head->next = NULL;
+
+ return -ENOMEM;
+ }
+@@ -2642,7 +2643,7 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ struct hnae3_handle *h = priv->ae_handle;
+ struct hns3_enet_tqp_vector *tqp_vector;
+ int ret = 0;
+- u16 i;
++ int i;
+
+ for (i = 0; i < priv->vector_num; i++) {
+ tqp_vector = &priv->tqp_vector[i];
+@@ -2679,7 +2680,7 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ ret = hns3_get_vector_ring_chain(tqp_vector,
+ &vector_ring_chain);
+ if (ret)
+- return ret;
++ goto map_ring_fail;
+
+ ret = h->ae_algo->ops->map_ring_to_vector(h,
+ tqp_vector->vector_irq, &vector_ring_chain);
+@@ -2687,13 +2688,19 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ hns3_free_vector_ring_chain(tqp_vector, &vector_ring_chain);
+
+ if (ret)
+- return ret;
++ goto map_ring_fail;
+
+ netif_napi_add(priv->netdev, &tqp_vector->napi,
+ hns3_nic_common_poll, NAPI_POLL_WEIGHT);
+ }
+
+ return 0;
++
++map_ring_fail:
++ while (i--)
++ netif_napi_del(&priv->tqp_vector[i].napi);
++
++ return ret;
+ }
+
+ static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv)
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index f8cc8d1f0b20..d575dd9a329d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -4833,6 +4833,7 @@ static int hclge_set_vlan_tx_offload_cfg(struct hclge_vport *vport)
+ struct hclge_vport_vtag_tx_cfg_cmd *req;
+ struct hclge_dev *hdev = vport->back;
+ struct hclge_desc desc;
++ u16 bmap_index;
+ int status;
+
+ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_VLAN_PORT_TX_CFG, false);
+@@ -4855,8 +4856,10 @@ static int hclge_set_vlan_tx_offload_cfg(struct hclge_vport *vport)
+ hnae3_set_bit(req->vport_vlan_cfg, HCLGE_CFG_NIC_ROCE_SEL_B, 0);
+
+ req->vf_offset = vport->vport_id / HCLGE_VF_NUM_PER_CMD;
+- req->vf_bitmap[req->vf_offset] =
+- 1 << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
++ bmap_index = vport->vport_id % HCLGE_VF_NUM_PER_CMD /
++ HCLGE_VF_NUM_PER_BYTE;
++ req->vf_bitmap[bmap_index] =
++ 1U << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
+
+ status = hclge_cmd_send(&hdev->hw, &desc, 1);
+ if (status)
+@@ -4873,6 +4876,7 @@ static int hclge_set_vlan_rx_offload_cfg(struct hclge_vport *vport)
+ struct hclge_vport_vtag_rx_cfg_cmd *req;
+ struct hclge_dev *hdev = vport->back;
+ struct hclge_desc desc;
++ u16 bmap_index;
+ int status;
+
+ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_VLAN_PORT_RX_CFG, false);
+@@ -4888,8 +4892,10 @@ static int hclge_set_vlan_rx_offload_cfg(struct hclge_vport *vport)
+ vcfg->vlan2_vlan_prionly ? 1 : 0);
+
+ req->vf_offset = vport->vport_id / HCLGE_VF_NUM_PER_CMD;
+- req->vf_bitmap[req->vf_offset] =
+- 1 << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
++ bmap_index = vport->vport_id % HCLGE_VF_NUM_PER_CMD /
++ HCLGE_VF_NUM_PER_BYTE;
++ req->vf_bitmap[bmap_index] =
++ 1U << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
+
+ status = hclge_cmd_send(&hdev->hw, &desc, 1);
+ if (status)
+@@ -5922,18 +5928,17 @@ static u32 hclge_get_max_channels(struct hnae3_handle *handle)
+ struct hclge_vport *vport = hclge_get_vport(handle);
+ struct hclge_dev *hdev = vport->back;
+
+- return min_t(u32, hdev->rss_size_max * kinfo->num_tc, hdev->num_tqps);
++ return min_t(u32, hdev->rss_size_max,
++ vport->alloc_tqps / kinfo->num_tc);
+ }
+
+ static void hclge_get_channels(struct hnae3_handle *handle,
+ struct ethtool_channels *ch)
+ {
+- struct hclge_vport *vport = hclge_get_vport(handle);
+-
+ ch->max_combined = hclge_get_max_channels(handle);
+ ch->other_count = 1;
+ ch->max_other = 1;
+- ch->combined_count = vport->alloc_tqps;
++ ch->combined_count = handle->kinfo.rss_size;
+ }
+
+ static void hclge_get_tqps_and_rss_info(struct hnae3_handle *handle,
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+index 260b1e779690..d14b7018fdf3 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+@@ -600,7 +600,7 @@ struct hclge_vport {
+ u16 alloc_rss_size;
+
+ u16 qs_offset;
+- u16 bw_limit; /* VSI BW Limit (0 = disabled) */
++ u32 bw_limit; /* VSI BW Limit (0 = disabled) */
+ u8 dwrr;
+
+ struct hclge_tx_vtag_cfg txvlan_cfg;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+index e08e82020402..997ca79ed892 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+@@ -181,12 +181,10 @@ static int hclge_map_unmap_ring_to_vf_vector(struct hclge_vport *vport, bool en,
+ return ret;
+
+ ret = hclge_bind_ring_with_vector(vport, vector_id, en, &ring_chain);
+- if (ret)
+- return ret;
+
+ hclge_free_vector_ring_chain(&ring_chain);
+
+- return 0;
++ return ret;
+ }
+
+ static int hclge_set_vf_promisc_mode(struct hclge_vport *vport,
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 67db19709dea..fd5375b5991b 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1957,7 +1957,8 @@ static u32 hclgevf_get_max_channels(struct hclgevf_dev *hdev)
+ struct hnae3_handle *nic = &hdev->nic;
+ struct hnae3_knic_private_info *kinfo = &nic->kinfo;
+
+- return min_t(u32, hdev->rss_size_max * kinfo->num_tc, hdev->num_tqps);
++ return min_t(u32, hdev->rss_size_max,
++ hdev->num_tqps / kinfo->num_tc);
+ }
+
+ /**
+@@ -1978,7 +1979,7 @@ static void hclgevf_get_channels(struct hnae3_handle *handle,
+ ch->max_combined = hclgevf_get_max_channels(hdev);
+ ch->other_count = 0;
+ ch->max_other = 0;
+- ch->combined_count = hdev->num_tqps;
++ ch->combined_count = handle->kinfo.rss_size;
+ }
+
+ static void hclgevf_get_tqps_and_rss_info(struct hnae3_handle *handle,
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index e8ee69d4e4d3..0f799e8e093c 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -1464,7 +1464,7 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
+
+ memset(pr, 0, sizeof(struct ehea_port_res));
+
+- pr->tx_bytes = rx_bytes;
++ pr->tx_bytes = tx_bytes;
+ pr->tx_packets = tx_packets;
+ pr->rx_bytes = rx_bytes;
+ pr->rx_packets = rx_packets;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
+index 85f75b5978fc..eb0ae6ab01e2 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
+@@ -1668,25 +1668,15 @@ enum i40e_status_code i40e_aq_set_phy_config(struct i40e_hw *hw,
+ return status;
+ }
+
+-/**
+- * i40e_set_fc
+- * @hw: pointer to the hw struct
+- * @aq_failures: buffer to return AdminQ failure information
+- * @atomic_restart: whether to enable atomic link restart
+- *
+- * Set the requested flow control mode using set_phy_config.
+- **/
+-enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
+- bool atomic_restart)
++static noinline_for_stack enum i40e_status_code
++i40e_set_fc_status(struct i40e_hw *hw,
++ struct i40e_aq_get_phy_abilities_resp *abilities,
++ bool atomic_restart)
+ {
+- enum i40e_fc_mode fc_mode = hw->fc.requested_mode;
+- struct i40e_aq_get_phy_abilities_resp abilities;
+ struct i40e_aq_set_phy_config config;
+- enum i40e_status_code status;
++ enum i40e_fc_mode fc_mode = hw->fc.requested_mode;
+ u8 pause_mask = 0x0;
+
+- *aq_failures = 0x0;
+-
+ switch (fc_mode) {
+ case I40E_FC_FULL:
+ pause_mask |= I40E_AQ_PHY_FLAG_PAUSE_TX;
+@@ -1702,6 +1692,48 @@ enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
+ break;
+ }
+
++ memset(&config, 0, sizeof(struct i40e_aq_set_phy_config));
++ /* clear the old pause settings */
++ config.abilities = abilities->abilities & ~(I40E_AQ_PHY_FLAG_PAUSE_TX) &
++ ~(I40E_AQ_PHY_FLAG_PAUSE_RX);
++ /* set the new abilities */
++ config.abilities |= pause_mask;
++ /* If the abilities have changed, then set the new config */
++ if (config.abilities == abilities->abilities)
++ return 0;
++
++ /* Auto restart link so settings take effect */
++ if (atomic_restart)
++ config.abilities |= I40E_AQ_PHY_ENABLE_ATOMIC_LINK;
++ /* Copy over all the old settings */
++ config.phy_type = abilities->phy_type;
++ config.phy_type_ext = abilities->phy_type_ext;
++ config.link_speed = abilities->link_speed;
++ config.eee_capability = abilities->eee_capability;
++ config.eeer = abilities->eeer_val;
++ config.low_power_ctrl = abilities->d3_lpan;
++ config.fec_config = abilities->fec_cfg_curr_mod_ext_info &
++ I40E_AQ_PHY_FEC_CONFIG_MASK;
++
++ return i40e_aq_set_phy_config(hw, &config, NULL);
++}
++
++/**
++ * i40e_set_fc
++ * @hw: pointer to the hw struct
++ * @aq_failures: buffer to return AdminQ failure information
++ * @atomic_restart: whether to enable atomic link restart
++ *
++ * Set the requested flow control mode using set_phy_config.
++ **/
++enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
++ bool atomic_restart)
++{
++ struct i40e_aq_get_phy_abilities_resp abilities;
++ enum i40e_status_code status;
++
++ *aq_failures = 0x0;
++
+ /* Get the current phy config */
+ status = i40e_aq_get_phy_capabilities(hw, false, false, &abilities,
+ NULL);
+@@ -1710,31 +1742,10 @@ enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
+ return status;
+ }
+
+- memset(&config, 0, sizeof(struct i40e_aq_set_phy_config));
+- /* clear the old pause settings */
+- config.abilities = abilities.abilities & ~(I40E_AQ_PHY_FLAG_PAUSE_TX) &
+- ~(I40E_AQ_PHY_FLAG_PAUSE_RX);
+- /* set the new abilities */
+- config.abilities |= pause_mask;
+- /* If the abilities have changed, then set the new config */
+- if (config.abilities != abilities.abilities) {
+- /* Auto restart link so settings take effect */
+- if (atomic_restart)
+- config.abilities |= I40E_AQ_PHY_ENABLE_ATOMIC_LINK;
+- /* Copy over all the old settings */
+- config.phy_type = abilities.phy_type;
+- config.phy_type_ext = abilities.phy_type_ext;
+- config.link_speed = abilities.link_speed;
+- config.eee_capability = abilities.eee_capability;
+- config.eeer = abilities.eeer_val;
+- config.low_power_ctrl = abilities.d3_lpan;
+- config.fec_config = abilities.fec_cfg_curr_mod_ext_info &
+- I40E_AQ_PHY_FEC_CONFIG_MASK;
+- status = i40e_aq_set_phy_config(hw, &config, NULL);
++ status = i40e_set_fc_status(hw, &abilities, atomic_restart);
++ if (status)
++ *aq_failures |= I40E_SET_FC_AQ_FAIL_SET;
+
+- if (status)
+- *aq_failures |= I40E_SET_FC_AQ_FAIL_SET;
+- }
+ /* Update the link info */
+ status = i40e_update_link_info(hw);
+ if (status) {
+@@ -2563,7 +2574,7 @@ i40e_status i40e_get_link_status(struct i40e_hw *hw, bool *link_up)
+ * i40e_updatelink_status - update status of the HW network link
+ * @hw: pointer to the hw struct
+ **/
+-i40e_status i40e_update_link_info(struct i40e_hw *hw)
++noinline_for_stack i40e_status i40e_update_link_info(struct i40e_hw *hw)
+ {
+ struct i40e_aq_get_phy_abilities_resp abilities;
+ i40e_status status = 0;
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+index b27f7a968820..49e6d66ccf80 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -114,7 +114,6 @@ static void ixgbe_ipsec_set_rx_ip(struct ixgbe_hw *hw, u16 idx, __be32 addr[])
+ **/
+ static void ixgbe_ipsec_clear_hw_tables(struct ixgbe_adapter *adapter)
+ {
+- struct ixgbe_ipsec *ipsec = adapter->ipsec;
+ struct ixgbe_hw *hw = &adapter->hw;
+ u32 buf[4] = {0, 0, 0, 0};
+ u16 idx;
+@@ -133,9 +132,6 @@ static void ixgbe_ipsec_clear_hw_tables(struct ixgbe_adapter *adapter)
+ ixgbe_ipsec_set_tx_sa(hw, idx, buf, 0);
+ ixgbe_ipsec_set_rx_sa(hw, idx, 0, buf, 0, 0, 0);
+ }
+-
+- ipsec->num_rx_sa = 0;
+- ipsec->num_tx_sa = 0;
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index de65ca1e6558..51cd58fbab69 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -1822,13 +1822,7 @@ static void ixgbe_pull_tail(struct ixgbe_ring *rx_ring,
+ static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring,
+ struct sk_buff *skb)
+ {
+- /* if the page was released unmap it, else just sync our portion */
+- if (unlikely(IXGBE_CB(skb)->page_released)) {
+- dma_unmap_page_attrs(rx_ring->dev, IXGBE_CB(skb)->dma,
+- ixgbe_rx_pg_size(rx_ring),
+- DMA_FROM_DEVICE,
+- IXGBE_RX_DMA_ATTR);
+- } else if (ring_uses_build_skb(rx_ring)) {
++ if (ring_uses_build_skb(rx_ring)) {
+ unsigned long offset = (unsigned long)(skb->data) & ~PAGE_MASK;
+
+ dma_sync_single_range_for_cpu(rx_ring->dev,
+@@ -1845,6 +1839,14 @@ static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring,
+ skb_frag_size(frag),
+ DMA_FROM_DEVICE);
+ }
++
++ /* If the page was released, just unmap it. */
++ if (unlikely(IXGBE_CB(skb)->page_released)) {
++ dma_unmap_page_attrs(rx_ring->dev, IXGBE_CB(skb)->dma,
++ ixgbe_rx_pg_size(rx_ring),
++ DMA_FROM_DEVICE,
++ IXGBE_RX_DMA_ATTR);
++ }
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index 9cbc4173973e..044687a1f27c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -1364,8 +1364,14 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
+
+ skb->protocol = *((__be16 *)(skb->data));
+
+- skb->ip_summed = CHECKSUM_COMPLETE;
+- skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
++ if (netdev->features & NETIF_F_RXCSUM) {
++ skb->ip_summed = CHECKSUM_COMPLETE;
++ skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
++ stats->csum_complete++;
++ } else {
++ skb->ip_summed = CHECKSUM_NONE;
++ stats->csum_none++;
++ }
+
+ if (unlikely(mlx5e_rx_hw_stamp(tstamp)))
+ skb_hwtstamps(skb)->hwtstamp =
+@@ -1384,7 +1390,6 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
+
+ skb->dev = netdev;
+
+- stats->csum_complete++;
+ stats->packets++;
+ stats->bytes += cqe_bcnt;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
+index 436a8136f26f..310f9e7d8320 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
+@@ -289,7 +289,6 @@ void mlx5_fpga_event(struct mlx5_core_dev *mdev, u8 event, void *data)
+ const char *event_name;
+ bool teardown = false;
+ unsigned long flags;
+- u32 fpga_qpn;
+ u8 syndrome;
+
+ switch (event) {
+@@ -300,7 +299,6 @@ void mlx5_fpga_event(struct mlx5_core_dev *mdev, u8 event, void *data)
+ case MLX5_EVENT_TYPE_FPGA_QP_ERROR:
+ syndrome = MLX5_GET(fpga_qp_error_event, data, syndrome);
+ event_name = mlx5_fpga_qp_syndrome_to_string(syndrome);
+- fpga_qpn = MLX5_GET(fpga_qp_error_event, data, fpga_qpn);
+ break;
+ default:
+ mlx5_fpga_warn_ratelimited(fdev, "Unexpected event %u\n",
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 82a53317285d..b16e0f45d28c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -469,6 +469,7 @@ static void del_hw_fte(struct fs_node *node)
+ mlx5_core_warn(dev,
+ "flow steering can't delete fte in index %d of flow group id %d\n",
+ fte->index, fg->id);
++ node->active = 0;
+ }
+ }
+
+@@ -1597,6 +1598,11 @@ lookup_fte_locked(struct mlx5_flow_group *g,
+ fte_tmp = NULL;
+ goto out;
+ }
++ if (!fte_tmp->node.active) {
++ tree_put_node(&fte_tmp->node);
++ fte_tmp = NULL;
++ goto out;
++ }
+
+ nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD);
+ out:
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+index f33707ce8b6b..479ac21cdbc6 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+@@ -44,14 +44,15 @@ static struct mlx5_core_rsc_common *mlx5_get_rsc(struct mlx5_core_dev *dev,
+ {
+ struct mlx5_qp_table *table = &dev->priv.qp_table;
+ struct mlx5_core_rsc_common *common;
++ unsigned long flags;
+
+- spin_lock(&table->lock);
++ spin_lock_irqsave(&table->lock, flags);
+
+ common = radix_tree_lookup(&table->tree, rsn);
+ if (common)
+ atomic_inc(&common->refcount);
+
+- spin_unlock(&table->lock);
++ spin_unlock_irqrestore(&table->lock, flags);
+
+ if (!common) {
+ mlx5_core_warn(dev, "Async event for bogus resource 0x%x\n",
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+index aee58b3892f2..c9895876a231 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+@@ -3215,7 +3215,7 @@ static inline void mlxsw_reg_qtct_pack(char *payload, u8 local_port,
+ * Configures the ETS elements.
+ */
+ #define MLXSW_REG_QEEC_ID 0x400D
+-#define MLXSW_REG_QEEC_LEN 0x1C
++#define MLXSW_REG_QEEC_LEN 0x20
+
+ MLXSW_REG_DEFINE(qeec, MLXSW_REG_QEEC_ID, MLXSW_REG_QEEC_LEN);
+
+@@ -3257,6 +3257,15 @@ MLXSW_ITEM32(reg, qeec, element_index, 0x04, 0, 8);
+ */
+ MLXSW_ITEM32(reg, qeec, next_element_index, 0x08, 0, 8);
+
++/* reg_qeec_mise
++ * Min shaper configuration enable. Enables configuration of the min
++ * shaper on this ETS element
++ * 0 - Disable
++ * 1 - Enable
++ * Access: RW
++ */
++MLXSW_ITEM32(reg, qeec, mise, 0x0C, 31, 1);
++
+ enum {
+ MLXSW_REG_QEEC_BYTES_MODE,
+ MLXSW_REG_QEEC_PACKETS_MODE,
+@@ -3273,6 +3282,17 @@ enum {
+ */
+ MLXSW_ITEM32(reg, qeec, pb, 0x0C, 28, 1);
+
++/* The smallest permitted min shaper rate. */
++#define MLXSW_REG_QEEC_MIS_MIN 200000 /* Kbps */
++
++/* reg_qeec_min_shaper_rate
++ * Min shaper information rate.
++ * For CPU port, can only be configured for port hierarchy.
++ * When in bytes mode, value is specified in units of 1000bps.
++ * Access: RW
++ */
++MLXSW_ITEM32(reg, qeec, min_shaper_rate, 0x0C, 0, 28);
++
+ /* reg_qeec_mase
+ * Max shaper configuration enable. Enables configuration of the max
+ * shaper on this ETS element.
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index 30ef318b3d68..5df9b25cab27 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -2753,6 +2753,21 @@ int mlxsw_sp_port_ets_maxrate_set(struct mlxsw_sp_port *mlxsw_sp_port,
+ return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(qeec), qeec_pl);
+ }
+
++static int mlxsw_sp_port_min_bw_set(struct mlxsw_sp_port *mlxsw_sp_port,
++ enum mlxsw_reg_qeec_hr hr, u8 index,
++ u8 next_index, u32 minrate)
++{
++ struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
++ char qeec_pl[MLXSW_REG_QEEC_LEN];
++
++ mlxsw_reg_qeec_pack(qeec_pl, mlxsw_sp_port->local_port, hr, index,
++ next_index);
++ mlxsw_reg_qeec_mise_set(qeec_pl, true);
++ mlxsw_reg_qeec_min_shaper_rate_set(qeec_pl, minrate);
++
++ return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(qeec), qeec_pl);
++}
++
+ int mlxsw_sp_port_prio_tc_set(struct mlxsw_sp_port *mlxsw_sp_port,
+ u8 switch_prio, u8 tclass)
+ {
+@@ -2830,6 +2845,16 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
+ return err;
+ }
+
++ /* Configure the min shaper for multicast TCs. */
++ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
++ err = mlxsw_sp_port_min_bw_set(mlxsw_sp_port,
++ MLXSW_REG_QEEC_HIERARCY_TC,
++ i + 8, i,
++ MLXSW_REG_QEEC_MIS_MIN);
++ if (err)
++ return err;
++ }
++
+ /* Map all priorities to traffic class 0. */
+ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+ err = mlxsw_sp_port_prio_tc_set(mlxsw_sp_port, i, 0);
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index c805dcbebd02..5f1875fe47cd 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -231,9 +231,9 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+
+ laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
+ if (!laddr) {
+- printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
+- dev_kfree_skb(skb);
+- return NETDEV_TX_BUSY;
++ pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
++ dev_kfree_skb_any(skb);
++ return NETDEV_TX_OK;
+ }
+
+ sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */
+diff --git a/drivers/net/ethernet/netronome/nfp/bpf/jit.c b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
+index 4e18d95e548f..c3ce0fb47a0f 100644
+--- a/drivers/net/ethernet/netronome/nfp/bpf/jit.c
++++ b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
+@@ -326,7 +326,18 @@ __emit_shf(struct nfp_prog *nfp_prog, u16 dst, enum alu_dst_ab dst_ab,
+ return;
+ }
+
+- if (sc == SHF_SC_L_SHF)
++ /* NFP shift instruction has something special. If shift direction is
++ * left then shift amount of 1 to 31 is specified as 32 minus the amount
++ * to shift.
++ *
++ * But no need to do this for indirect shift which has shift amount be
++ * 0. Even after we do this subtraction, shift amount 0 will be turned
++ * into 32 which will eventually be encoded the same as 0 because only
++ * low 5 bits are encoded, but shift amount be 32 will fail the
++ * FIELD_PREP check done later on shift mask (0x1f), due to 32 is out of
++ * mask range.
++ */
++ if (sc == SHF_SC_L_SHF && shift)
+ shift = 32 - shift;
+
+ insn = OP_SHF_BASE |
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
+index 44d3ea75d043..ab602a79b084 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
+@@ -423,7 +423,7 @@
+ #define NFP_NET_CFG_MBOX_SIMPLE_CMD 0x0
+ #define NFP_NET_CFG_MBOX_SIMPLE_RET 0x4
+ #define NFP_NET_CFG_MBOX_SIMPLE_VAL 0x8
+-#define NFP_NET_CFG_MBOX_SIMPLE_LEN 0x12
++#define NFP_NET_CFG_MBOX_SIMPLE_LEN 12
+
+ #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_ADD 1
+ #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_KILL 2
+diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
+index 76efed058f33..a791d7932b0e 100644
+--- a/drivers/net/ethernet/ni/nixge.c
++++ b/drivers/net/ethernet/ni/nixge.c
+@@ -1233,7 +1233,7 @@ static int nixge_probe(struct platform_device *pdev)
+ }
+
+ priv->phy_mode = of_get_phy_mode(pdev->dev.of_node);
+- if (priv->phy_mode < 0) {
++ if ((int)priv->phy_mode < 0) {
+ netdev_err(ndev, "not find \"phy-mode\" property\n");
+ err = -EINVAL;
+ goto unregister_mdio;
+diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
+index 8a31a02c9f47..65f69e562618 100644
+--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
+@@ -1053,7 +1053,6 @@ static int pasemi_mac_phy_init(struct net_device *dev)
+
+ dn = pci_device_to_OF_node(mac->pdev);
+ phy_dn = of_parse_phandle(dn, "phy-handle", 0);
+- of_node_put(phy_dn);
+
+ mac->link = 0;
+ mac->speed = 0;
+@@ -1062,6 +1061,7 @@ static int pasemi_mac_phy_init(struct net_device *dev)
+ phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
+ PHY_INTERFACE_MODE_SGMII);
+
++ of_node_put(phy_dn);
+ if (!phydev) {
+ printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
+ return -ENODEV;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+index 7002a660b6b4..39787bb885c8 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -532,7 +532,8 @@ int qed_iwarp_destroy_qp(struct qed_hwfn *p_hwfn, struct qed_rdma_qp *qp)
+
+ /* Make sure ep is closed before returning and freeing memory. */
+ if (ep) {
+- while (ep->state != QED_IWARP_EP_CLOSED && wait_count++ < 200)
++ while (READ_ONCE(ep->state) != QED_IWARP_EP_CLOSED &&
++ wait_count++ < 200)
+ msleep(100);
+
+ if (ep->state != QED_IWARP_EP_CLOSED)
+@@ -1023,8 +1024,6 @@ qed_iwarp_mpa_complete(struct qed_hwfn *p_hwfn,
+
+ params.ep_context = ep;
+
+- ep->state = QED_IWARP_EP_CLOSED;
+-
+ switch (fw_return_code) {
+ case RDMA_RETURN_OK:
+ ep->qp->max_rd_atomic_req = ep->cm_info.ord;
+@@ -1084,6 +1083,10 @@ qed_iwarp_mpa_complete(struct qed_hwfn *p_hwfn,
+ break;
+ }
+
++ if (fw_return_code != RDMA_RETURN_OK)
++ /* paired with READ_ONCE in destroy_qp */
++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
++
+ ep->event_cb(ep->cb_context, ¶ms);
+
+ /* on passive side, if there is no associated QP (REJECT) we need to
+@@ -2638,6 +2641,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
+ cbs.rx_release_cb = qed_iwarp_ll2_rel_rx_pkt;
+ cbs.tx_comp_cb = qed_iwarp_ll2_comp_tx_pkt;
+ cbs.tx_release_cb = qed_iwarp_ll2_rel_tx_pkt;
++ cbs.slowpath_cb = NULL;
+ cbs.cookie = p_hwfn;
+
+ memset(&data, 0, sizeof(data));
+@@ -2828,7 +2832,9 @@ static void qed_iwarp_qp_in_error(struct qed_hwfn *p_hwfn,
+ params.status = (fw_return_code == IWARP_QP_IN_ERROR_GOOD_CLOSE) ?
+ 0 : -ECONNRESET;
+
+- ep->state = QED_IWARP_EP_CLOSED;
++ /* paired with READ_ONCE in destroy_qp */
++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
++
+ spin_lock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock);
+ list_del(&ep->list_entry);
+ spin_unlock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock);
+@@ -2917,7 +2923,8 @@ qed_iwarp_tcp_connect_unsuccessful(struct qed_hwfn *p_hwfn,
+ params.event = QED_IWARP_EVENT_ACTIVE_COMPLETE;
+ params.ep_context = ep;
+ params.cm_info = &ep->cm_info;
+- ep->state = QED_IWARP_EP_CLOSED;
++ /* paired with READ_ONCE in destroy_qp */
++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
+
+ switch (fw_return_code) {
+ case IWARP_CONN_ERROR_TCP_CONNECT_INVALID_PACKET:
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+index 64ac95ca4df2..d921b991dbdb 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -1631,10 +1631,9 @@ static void __qed_get_vport_pstats_addrlen(struct qed_hwfn *p_hwfn,
+ }
+ }
+
+-static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt,
+- struct qed_eth_stats *p_stats,
+- u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_pstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ struct eth_pstorm_per_queue_stat pstats;
+ u32 pstats_addr = 0, pstats_len = 0;
+@@ -1661,10 +1660,9 @@ static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
+ HILO_64_REGPAIR(pstats.error_drop_pkts);
+ }
+
+-static void __qed_get_vport_tstats(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt,
+- struct qed_eth_stats *p_stats,
+- u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_tstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ struct tstorm_per_port_stat tstats;
+ u32 tstats_addr, tstats_len;
+@@ -1709,10 +1707,9 @@ static void __qed_get_vport_ustats_addrlen(struct qed_hwfn *p_hwfn,
+ }
+ }
+
+-static void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt,
+- struct qed_eth_stats *p_stats,
+- u16 statistics_bin)
++static noinline_for_stack
++void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ struct eth_ustorm_per_queue_stat ustats;
+ u32 ustats_addr = 0, ustats_len = 0;
+@@ -1751,10 +1748,9 @@ static void __qed_get_vport_mstats_addrlen(struct qed_hwfn *p_hwfn,
+ }
+ }
+
+-static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt,
+- struct qed_eth_stats *p_stats,
+- u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_mstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ struct eth_mstorm_per_queue_stat mstats;
+ u32 mstats_addr = 0, mstats_len = 0;
+@@ -1780,9 +1776,9 @@ static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
+ HILO_64_REGPAIR(mstats.tpa_coalesced_bytes);
+ }
+
+-static void __qed_get_vport_port_stats(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt,
+- struct qed_eth_stats *p_stats)
++static noinline_for_stack void
++__qed_get_vport_port_stats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ struct qed_eth_stats *p_stats)
+ {
+ struct qed_eth_stats_common *p_common = &p_stats->common;
+ struct port_stats port_stats;
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 66b775d462fd..9d188931bc09 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -475,7 +475,6 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
+ u16 signature = 0;
+ u16 spi_config;
+ u16 wrbuf_space = 0;
+- static u16 reset_count;
+
+ if (event == QCASPI_EVENT_CPUON) {
+ /* Read signature twice, if not valid
+@@ -528,13 +527,13 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
+
+ qca->sync = QCASPI_SYNC_RESET;
+ qca->stats.trig_reset++;
+- reset_count = 0;
++ qca->reset_count = 0;
+ break;
+ case QCASPI_SYNC_RESET:
+- reset_count++;
++ qca->reset_count++;
+ netdev_dbg(qca->net_dev, "sync: waiting for CPU on, count %u.\n",
+- reset_count);
+- if (reset_count >= QCASPI_RESET_TIMEOUT) {
++ qca->reset_count);
++ if (qca->reset_count >= QCASPI_RESET_TIMEOUT) {
+ /* reset did not seem to take place, try again */
+ qca->sync = QCASPI_SYNC_UNKNOWN;
+ qca->stats.reset_timeout++;
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h
+index fc0e98726b36..719c41227f22 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.h
++++ b/drivers/net/ethernet/qualcomm/qca_spi.h
+@@ -92,6 +92,7 @@ struct qcaspi {
+
+ unsigned int intr_req;
+ unsigned int intr_svc;
++ u16 reset_count;
+
+ #ifdef CONFIG_DEBUG_FS
+ struct dentry *device_root;
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 6068e96f5ac1..441643670ac0 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -3133,12 +3133,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev)
+ struct device_node *np = dev->of_node;
+ struct sh_eth_plat_data *pdata;
+ const char *mac_addr;
++ int ret;
+
+ pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
+ if (!pdata)
+ return NULL;
+
+- pdata->phy_interface = of_get_phy_mode(np);
++ ret = of_get_phy_mode(np);
++ if (ret < 0)
++ return NULL;
++ pdata->phy_interface = ret;
+
+ mac_addr = of_get_mac_address(np);
+ if (mac_addr)
+diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
+index 28d582c18afb..027367b9cc48 100644
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -432,9 +432,12 @@ static int netsec_mac_update_to_phy_state(struct netsec_priv *priv)
+ return 0;
+ }
+
++static int netsec_phy_read(struct mii_bus *bus, int phy_addr, int reg_addr);
++
+ static int netsec_phy_write(struct mii_bus *bus,
+ int phy_addr, int reg, u16 val)
+ {
++ int status;
+ struct netsec_priv *priv = bus->priv;
+
+ if (netsec_mac_write(priv, GMAC_REG_GDR, val))
+@@ -447,8 +450,19 @@ static int netsec_phy_write(struct mii_bus *bus,
+ GMAC_REG_SHIFT_CR_GAR)))
+ return -ETIMEDOUT;
+
+- return netsec_mac_wait_while_busy(priv, GMAC_REG_GAR,
+- NETSEC_GMAC_GAR_REG_GB);
++ status = netsec_mac_wait_while_busy(priv, GMAC_REG_GAR,
++ NETSEC_GMAC_GAR_REG_GB);
++
++ /* Developerbox implements RTL8211E PHY and there is
++ * a compatibility problem with F_GMAC4.
++ * RTL8211E expects MDC clock must be kept toggling for several
++ * clock cycle with MDIO high before entering the IDLE state.
++ * To meet this requirement, netsec driver needs to issue dummy
++ * read(e.g. read PHYID1(offset 0x2) register) right after write.
++ */
++ netsec_phy_read(bus, phy_addr, MII_PHYSID1);
++
++ return status;
+ }
+
+ static int netsec_phy_read(struct mii_bus *bus, int phy_addr, int reg_addr)
+@@ -1590,7 +1604,7 @@ static int netsec_probe(struct platform_device *pdev)
+ NETIF_MSG_LINK | NETIF_MSG_PROBE;
+
+ priv->phy_interface = device_get_phy_mode(&pdev->dev);
+- if (priv->phy_interface < 0) {
++ if ((int)priv->phy_interface < 0) {
+ dev_err(&pdev->dev, "missing required property 'phy-mode'\n");
+ ret = -ENODEV;
+ goto free_ndev;
+diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
+index 09d25b87cf7c..c309accc6797 100644
+--- a/drivers/net/ethernet/socionext/sni_ave.c
++++ b/drivers/net/ethernet/socionext/sni_ave.c
+@@ -1575,7 +1575,7 @@ static int ave_probe(struct platform_device *pdev)
+
+ np = dev->of_node;
+ phy_mode = of_get_phy_mode(np);
+- if (phy_mode < 0) {
++ if ((int)phy_mode < 0) {
+ dev_err(dev, "phy-mode not found\n");
+ return -EINVAL;
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+index 2c6d7c69c8f7..0d21082ceb93 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -191,7 +191,7 @@ static int ipq806x_gmac_of_parse(struct ipq806x_gmac *gmac)
+ struct device *dev = &gmac->pdev->dev;
+
+ gmac->phy_mode = of_get_phy_mode(dev->of_node);
+- if (gmac->phy_mode < 0) {
++ if ((int)gmac->phy_mode < 0) {
+ dev_err(dev, "missing phy mode property\n");
+ return -EINVAL;
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+index 94b46258e8ff..0a17535f13ae 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+@@ -355,7 +355,7 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
+
+ dwmac->dev = &pdev->dev;
+ dwmac->phy_mode = of_get_phy_mode(pdev->dev.of_node);
+- if (dwmac->phy_mode < 0) {
++ if ((int)dwmac->phy_mode < 0) {
+ dev_err(&pdev->dev, "missing phy-mode property\n");
+ ret = -EINVAL;
+ goto err_remove_config_dt;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index 48cf5e2b2441..bc8871e7351f 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -443,7 +443,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ }
+
+ /* Handle multiple unicast addresses */
+- if (netdev_uc_count(dev) > GMAC_MAX_PERFECT_ADDRESSES) {
++ if (netdev_uc_count(dev) > hw->unicast_filter_entries) {
+ /* Switch to promiscuous mode if more than 128 addrs
+ * are required
+ */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
+index 3f4f3132e16b..e436fa160c7d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
+@@ -515,6 +515,7 @@ int dwmac5_flex_pps_config(void __iomem *ioaddr, int index,
+
+ if (!enable) {
+ val |= PPSCMDx(index, 0x5);
++ val |= PPSEN0;
+ writel(val, ioaddr + MAC_PPS_CONTROL);
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+index cc60b3fb0892..8f8b8f381ffd 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+@@ -174,7 +174,7 @@ static int stmmac_enable(struct ptp_clock_info *ptp,
+ /* structure describing a PTP hardware clock */
+ static struct ptp_clock_info stmmac_ptp_clock_ops = {
+ .owner = THIS_MODULE,
+- .name = "stmmac_ptp_clock",
++ .name = "stmmac ptp",
+ .max_adj = 62500000,
+ .n_alarm = 0,
+ .n_ext_ts = 0,
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index 28764268a44f..b093f14eeec3 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -1573,7 +1573,7 @@ static int axienet_probe(struct platform_device *pdev)
+ }
+ } else {
+ lp->phy_mode = of_get_phy_mode(pdev->dev.of_node);
+- if (lp->phy_mode < 0) {
++ if ((int)lp->phy_mode < 0) {
+ ret = -EINVAL;
+ goto free_netdev;
+ }
+diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
+index 50709c76b672..dfa801315da6 100644
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -616,7 +616,8 @@ struct nvsp_5_send_indirect_table {
+ /* The number of entries in the send indirection table */
+ u32 count;
+
+- /* The offset of the send indirection table from top of this struct.
++ /* The offset of the send indirection table from the beginning of
++ * struct nvsp_message.
+ * The send indirection table tells which channel to put the send
+ * traffic on. Each entry is a channel number.
+ */
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 35413041dcf8..dbfd3a0c97d3 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1182,20 +1182,39 @@ static int netvsc_receive(struct net_device *ndev,
+ }
+
+ static void netvsc_send_table(struct net_device *ndev,
+- const struct nvsp_message *nvmsg)
++ struct netvsc_device *nvscdev,
++ const struct nvsp_message *nvmsg,
++ u32 msglen)
+ {
+ struct net_device_context *net_device_ctx = netdev_priv(ndev);
+- u32 count, *tab;
++ u32 count, offset, *tab;
+ int i;
+
+ count = nvmsg->msg.v5_msg.send_table.count;
++ offset = nvmsg->msg.v5_msg.send_table.offset;
++
+ if (count != VRSS_SEND_TAB_SIZE) {
+ netdev_err(ndev, "Received wrong send-table size:%u\n", count);
+ return;
+ }
+
+- tab = (u32 *)((unsigned long)&nvmsg->msg.v5_msg.send_table +
+- nvmsg->msg.v5_msg.send_table.offset);
++ /* If negotiated version <= NVSP_PROTOCOL_VERSION_6, the offset may be
++ * wrong due to a host bug. So fix the offset here.
++ */
++ if (nvscdev->nvsp_version <= NVSP_PROTOCOL_VERSION_6 &&
++ msglen >= sizeof(struct nvsp_message_header) +
++ sizeof(union nvsp_6_message_uber) + count * sizeof(u32))
++ offset = sizeof(struct nvsp_message_header) +
++ sizeof(union nvsp_6_message_uber);
++
++ /* Boundary check for all versions */
++ if (offset > msglen - count * sizeof(u32)) {
++ netdev_err(ndev, "Received send-table offset too big:%u\n",
++ offset);
++ return;
++ }
++
++ tab = (void *)nvmsg + offset;
+
+ for (i = 0; i < count; i++)
+ net_device_ctx->tx_table[i] = tab[i];
+@@ -1213,12 +1232,14 @@ static void netvsc_send_vf(struct net_device *ndev,
+ net_device_ctx->vf_alloc ? "added" : "removed");
+ }
+
+-static void netvsc_receive_inband(struct net_device *ndev,
+- const struct nvsp_message *nvmsg)
++static void netvsc_receive_inband(struct net_device *ndev,
++ struct netvsc_device *nvscdev,
++ const struct nvsp_message *nvmsg,
++ u32 msglen)
+ {
+ switch (nvmsg->hdr.msg_type) {
+ case NVSP_MSG5_TYPE_SEND_INDIRECTION_TABLE:
+- netvsc_send_table(ndev, nvmsg);
++ netvsc_send_table(ndev, nvscdev, nvmsg, msglen);
+ break;
+
+ case NVSP_MSG4_TYPE_SEND_VF_ASSOCIATION:
+@@ -1235,6 +1256,7 @@ static int netvsc_process_raw_pkt(struct hv_device *device,
+ int budget)
+ {
+ const struct nvsp_message *nvmsg = hv_pkt_data(desc);
++ u32 msglen = hv_pkt_datalen(desc);
+
+ trace_nvsp_recv(ndev, channel, nvmsg);
+
+@@ -1250,7 +1272,7 @@ static int netvsc_process_raw_pkt(struct hv_device *device,
+ break;
+
+ case VM_PKT_DATA_INBAND:
+- netvsc_receive_inband(ndev, nvmsg);
++ netvsc_receive_inband(ndev, net_device, nvmsg, msglen);
+ break;
+
+ default:
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 1f9f7fcdb0eb..7ab576d8b622 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -295,9 +295,9 @@ static inline u32 netvsc_get_hash(
+ else if (flow.basic.n_proto == htons(ETH_P_IPV6))
+ hash = jhash2((u32 *)&flow.addrs.v6addrs, 8, hashrnd);
+ else
+- hash = 0;
++ return 0;
+
+- skb_set_hash(skb, hash, PKT_HASH_TYPE_L3);
++ __skb_set_sw_hash(skb, hash, false);
+ }
+
+ return hash;
+@@ -804,8 +804,7 @@ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net,
+ skb->protocol == htons(ETH_P_IP))
+ netvsc_comp_ipcsum(skb);
+
+- /* Do L4 checksum offload if enabled and present.
+- */
++ /* Do L4 checksum offload if enabled and present. */
+ if (csum_info && (net->features & NETIF_F_RXCSUM)) {
+ if (csum_info->receive.tcp_checksum_succeeded ||
+ csum_info->receive.udp_checksum_succeeded)
+@@ -2004,6 +2003,12 @@ static rx_handler_result_t netvsc_vf_handle_frame(struct sk_buff **pskb)
+ struct netvsc_vf_pcpu_stats *pcpu_stats
+ = this_cpu_ptr(ndev_ctx->vf_stats);
+
++ skb = skb_share_check(skb, GFP_ATOMIC);
++ if (unlikely(!skb))
++ return RX_HANDLER_CONSUMED;
++
++ *pskb = skb;
++
+ skb->dev = ndev;
+
+ u64_stats_update_begin(&pcpu_stats->syncp);
+diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
+index 67b260877f30..59820164502e 100644
+--- a/drivers/net/phy/fixed_phy.c
++++ b/drivers/net/phy/fixed_phy.c
+@@ -67,11 +67,11 @@ static int fixed_mdio_read(struct mii_bus *bus, int phy_addr, int reg_num)
+ do {
+ s = read_seqcount_begin(&fp->seqcount);
+ /* Issue callback if user registered it. */
+- if (fp->link_update) {
++ if (fp->link_update)
+ fp->link_update(fp->phydev->attached_dev,
+ &fp->status);
+- fixed_phy_update(fp);
+- }
++ /* Check the GPIO for change in status */
++ fixed_phy_update(fp);
+ state = fp->status;
+ } while (read_seqcount_retry(&fp->seqcount, s));
+
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index c5588d4508f9..5c89a310359d 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -56,11 +56,12 @@ static int mdiobus_register_gpiod(struct mdio_device *mdiodev)
+ gpiod = fwnode_get_named_gpiod(&mdiodev->dev.of_node->fwnode,
+ "reset-gpios", 0, GPIOD_OUT_LOW,
+ "PHY reset");
+- if (PTR_ERR(gpiod) == -ENOENT ||
+- PTR_ERR(gpiod) == -ENOSYS)
+- gpiod = NULL;
+- else if (IS_ERR(gpiod))
+- return PTR_ERR(gpiod);
++ if (IS_ERR(gpiod)) {
++ if (PTR_ERR(gpiod) == -ENOENT || PTR_ERR(gpiod) == -ENOSYS)
++ gpiod = NULL;
++ else
++ return PTR_ERR(gpiod);
++ }
+
+ mdiodev->reset = gpiod;
+
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 05a6ae32ff65..b4c67c3a928b 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -977,6 +977,7 @@ static struct phy_driver ksphy_driver[] = {
+ .driver_data = &ksz9021_type,
+ .probe = kszphy_probe,
+ .config_init = ksz9031_config_init,
++ .soft_reset = genphy_soft_reset,
+ .read_status = ksz9031_read_status,
+ .ack_interrupt = kszphy_ack_interrupt,
+ .config_intr = kszphy_config_intr,
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 43c4f358eeb8..ae40d8137fd2 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -76,7 +76,7 @@ static LIST_HEAD(phy_fixup_list);
+ static DEFINE_MUTEX(phy_fixup_lock);
+
+ #ifdef CONFIG_PM
+-static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
++static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend)
+ {
+ struct device_driver *drv = phydev->mdio.dev.driver;
+ struct phy_driver *phydrv = to_phy_driver(drv);
+@@ -88,10 +88,11 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
+ /* PHY not attached? May suspend if the PHY has not already been
+ * suspended as part of a prior call to phy_disconnect() ->
+ * phy_detach() -> phy_suspend() because the parent netdev might be the
+- * MDIO bus driver and clock gated at this point.
++ * MDIO bus driver and clock gated at this point. Also may resume if
++ * PHY is not attached.
+ */
+ if (!netdev)
+- return !phydev->suspended;
++ return suspend ? !phydev->suspended : phydev->suspended;
+
+ if (netdev->wol_enabled)
+ return false;
+@@ -126,7 +127,7 @@ static int mdio_bus_phy_suspend(struct device *dev)
+ if (phydev->attached_dev && phydev->adjust_link)
+ phy_stop_machine(phydev);
+
+- if (!mdio_bus_phy_may_suspend(phydev))
++ if (!mdio_bus_phy_may_suspend(phydev, true))
+ return 0;
+
+ return phy_suspend(phydev);
+@@ -137,7 +138,7 @@ static int mdio_bus_phy_resume(struct device *dev)
+ struct phy_device *phydev = to_phy_device(dev);
+ int ret;
+
+- if (!mdio_bus_phy_may_suspend(phydev))
++ if (!mdio_bus_phy_may_suspend(phydev, false))
+ goto no_resume;
+
+ ret = phy_resume(phydev);
+@@ -1656,7 +1657,7 @@ int genphy_soft_reset(struct phy_device *phydev)
+ {
+ int ret;
+
+- ret = phy_write(phydev, MII_BMCR, BMCR_RESET);
++ ret = phy_set_bits(phydev, MII_BMCR, BMCR_RESET);
+ if (ret < 0)
+ return ret;
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 613f36681853..df88981e796a 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3496,7 +3496,6 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
+ struct vxlan_rdst *dst = &vxlan->default_dst;
+ struct vxlan_rdst old_dst;
+ struct vxlan_config conf;
+- struct vxlan_fdb *f = NULL;
+ int err;
+
+ err = vxlan_nl2conf(tb, data,
+@@ -3522,19 +3521,19 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
+ old_dst.remote_ifindex, 0);
+
+ if (!vxlan_addr_any(&dst->remote_ip)) {
+- err = vxlan_fdb_create(vxlan, all_zeros_mac,
++ err = vxlan_fdb_update(vxlan, all_zeros_mac,
+ &dst->remote_ip,
+ NUD_REACHABLE | NUD_PERMANENT,
++ NLM_F_APPEND | NLM_F_CREATE,
+ vxlan->cfg.dst_port,
+ dst->remote_vni,
+ dst->remote_vni,
+ dst->remote_ifindex,
+- NTF_SELF, &f);
++ NTF_SELF);
+ if (err) {
+ spin_unlock_bh(&vxlan->hash_lock);
+ return err;
+ }
+- vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH);
+ }
+ spin_unlock_bh(&vxlan->hash_lock);
+ }
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 448e3a8c33a6..a09d7a07e90a 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -1,7 +1,7 @@
+ /*
+ * Copyright (c) 2005-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
+- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+@@ -3853,7 +3853,7 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
+ ath10k_warn(ar, "failed to transmit management frame by ref via WMI: %d\n",
+ ret);
+ dma_unmap_single(ar->dev, paddr, skb->len,
+- DMA_FROM_DEVICE);
++ DMA_TO_DEVICE);
+ ieee80211_free_txskb(ar->hw, skb);
+ }
+ } else {
+diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
+index 686759b5613f..0ecaba824fb2 100644
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -392,16 +392,11 @@ static int ath10k_sdio_mbox_rx_process_packet(struct ath10k *ar,
+ struct ath10k_htc_hdr *htc_hdr = (struct ath10k_htc_hdr *)skb->data;
+ bool trailer_present = htc_hdr->flags & ATH10K_HTC_FLAG_TRAILER_PRESENT;
+ enum ath10k_htc_ep_id eid;
+- u16 payload_len;
+ u8 *trailer;
+ int ret;
+
+- payload_len = le16_to_cpu(htc_hdr->len);
+- skb->len = payload_len + sizeof(struct ath10k_htc_hdr);
+-
+ if (trailer_present) {
+- trailer = skb->data + sizeof(*htc_hdr) +
+- payload_len - htc_hdr->trailer_len;
++ trailer = skb->data + skb->len - htc_hdr->trailer_len;
+
+ eid = pipe_id_to_eid(htc_hdr->eid);
+
+@@ -638,13 +633,31 @@ static int ath10k_sdio_mbox_rx_packet(struct ath10k *ar,
+ {
+ struct ath10k_sdio *ar_sdio = ath10k_sdio_priv(ar);
+ struct sk_buff *skb = pkt->skb;
++ struct ath10k_htc_hdr *htc_hdr;
+ int ret;
+
+ ret = ath10k_sdio_readsb(ar, ar_sdio->mbox_info.htc_addr,
+ skb->data, pkt->alloc_len);
++ if (ret)
++ goto out;
++
++ /* Update actual length. The original length may be incorrect,
++ * as the FW will bundle multiple packets as long as their sizes
++ * fit within the same aligned length (pkt->alloc_len).
++ */
++ htc_hdr = (struct ath10k_htc_hdr *)skb->data;
++ pkt->act_len = le16_to_cpu(htc_hdr->len) + sizeof(*htc_hdr);
++ if (pkt->act_len > pkt->alloc_len) {
++ ath10k_warn(ar, "rx packet too large (%zu > %zu)\n",
++ pkt->act_len, pkt->alloc_len);
++ ret = -EMSGSIZE;
++ goto out;
++ }
++
++ skb_put(skb, pkt->act_len);
++
++out:
+ pkt->status = ret;
+- if (!ret)
+- skb_put(skb, pkt->act_len);
+
+ return ret;
+ }
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index cdc1e64d52ad..248decb494c2 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -2693,7 +2693,7 @@ ath10k_wmi_tlv_op_gen_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu,
+ ieee80211_is_deauth(hdr->frame_control) ||
+ ieee80211_is_disassoc(hdr->frame_control)) &&
+ ieee80211_has_protected(hdr->frame_control)) {
+- len += IEEE80211_CCMP_MIC_LEN;
++ skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
+ buf_len += IEEE80211_CCMP_MIC_LEN;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index aefc92d2c09b..0f6ff7a78e49 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1,7 +1,7 @@
+ /*
+ * Copyright (c) 2005-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
+- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+@@ -2340,7 +2340,7 @@ static int wmi_process_mgmt_tx_comp(struct ath10k *ar, u32 desc_id,
+
+ msdu = pkt_addr->vaddr;
+ dma_unmap_single(ar->dev, pkt_addr->paddr,
+- msdu->len, DMA_FROM_DEVICE);
++ msdu->len, DMA_TO_DEVICE);
+ info = IEEE80211_SKB_CB(msdu);
+
+ if (status)
+diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
+index 6e236a485431..71b4888b30e7 100644
+--- a/drivers/net/wireless/ath/ath9k/dynack.c
++++ b/drivers/net/wireless/ath/ath9k/dynack.c
+@@ -300,9 +300,9 @@ void ath_dynack_node_init(struct ath_hw *ah, struct ath_node *an)
+
+ an->ackto = ackto;
+
+- spin_lock(&da->qlock);
++ spin_lock_bh(&da->qlock);
+ list_add_tail(&an->list, &da->nodes);
+- spin_unlock(&da->qlock);
++ spin_unlock_bh(&da->qlock);
+ }
+ EXPORT_SYMBOL(ath_dynack_node_init);
+
+@@ -316,9 +316,9 @@ void ath_dynack_node_deinit(struct ath_hw *ah, struct ath_node *an)
+ {
+ struct ath_dynack *da = &ah->dynack;
+
+- spin_lock(&da->qlock);
++ spin_lock_bh(&da->qlock);
+ list_del(&an->list);
+- spin_unlock(&da->qlock);
++ spin_unlock_bh(&da->qlock);
+ }
+ EXPORT_SYMBOL(ath_dynack_node_deinit);
+
+diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
+index 00098f24116d..6cd113b3b3e4 100644
+--- a/drivers/net/wireless/ath/wcn36xx/smd.c
++++ b/drivers/net/wireless/ath/wcn36xx/smd.c
+@@ -641,52 +641,58 @@ int wcn36xx_smd_start_hw_scan(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+ struct cfg80211_scan_request *req)
+ {
+ struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
+- struct wcn36xx_hal_start_scan_offload_req_msg msg_body;
++ struct wcn36xx_hal_start_scan_offload_req_msg *msg_body;
+ int ret, i;
+
+ if (req->ie_len > WCN36XX_MAX_SCAN_IE_LEN)
+ return -EINVAL;
+
+ mutex_lock(&wcn->hal_mutex);
+- INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_SCAN_OFFLOAD_REQ);
++ msg_body = kzalloc(sizeof(*msg_body), GFP_KERNEL);
++ if (!msg_body) {
++ ret = -ENOMEM;
++ goto out;
++ }
+
+- msg_body.scan_type = WCN36XX_HAL_SCAN_TYPE_ACTIVE;
+- msg_body.min_ch_time = 30;
+- msg_body.max_ch_time = 100;
+- msg_body.scan_hidden = 1;
+- memcpy(msg_body.mac, vif->addr, ETH_ALEN);
+- msg_body.bss_type = vif_priv->bss_type;
+- msg_body.p2p_search = vif->p2p;
++ INIT_HAL_MSG((*msg_body), WCN36XX_HAL_START_SCAN_OFFLOAD_REQ);
+
+- msg_body.num_ssid = min_t(u8, req->n_ssids, ARRAY_SIZE(msg_body.ssids));
+- for (i = 0; i < msg_body.num_ssid; i++) {
+- msg_body.ssids[i].length = min_t(u8, req->ssids[i].ssid_len,
+- sizeof(msg_body.ssids[i].ssid));
+- memcpy(msg_body.ssids[i].ssid, req->ssids[i].ssid,
+- msg_body.ssids[i].length);
++ msg_body->scan_type = WCN36XX_HAL_SCAN_TYPE_ACTIVE;
++ msg_body->min_ch_time = 30;
++ msg_body->max_ch_time = 100;
++ msg_body->scan_hidden = 1;
++ memcpy(msg_body->mac, vif->addr, ETH_ALEN);
++ msg_body->bss_type = vif_priv->bss_type;
++ msg_body->p2p_search = vif->p2p;
++
++ msg_body->num_ssid = min_t(u8, req->n_ssids, ARRAY_SIZE(msg_body->ssids));
++ for (i = 0; i < msg_body->num_ssid; i++) {
++ msg_body->ssids[i].length = min_t(u8, req->ssids[i].ssid_len,
++ sizeof(msg_body->ssids[i].ssid));
++ memcpy(msg_body->ssids[i].ssid, req->ssids[i].ssid,
++ msg_body->ssids[i].length);
+ }
+
+- msg_body.num_channel = min_t(u8, req->n_channels,
+- sizeof(msg_body.channels));
+- for (i = 0; i < msg_body.num_channel; i++)
+- msg_body.channels[i] = req->channels[i]->hw_value;
++ msg_body->num_channel = min_t(u8, req->n_channels,
++ sizeof(msg_body->channels));
++ for (i = 0; i < msg_body->num_channel; i++)
++ msg_body->channels[i] = req->channels[i]->hw_value;
+
+- msg_body.header.len -= WCN36XX_MAX_SCAN_IE_LEN;
++ msg_body->header.len -= WCN36XX_MAX_SCAN_IE_LEN;
+
+ if (req->ie_len > 0) {
+- msg_body.ie_len = req->ie_len;
+- msg_body.header.len += req->ie_len;
+- memcpy(msg_body.ie, req->ie, req->ie_len);
++ msg_body->ie_len = req->ie_len;
++ msg_body->header.len += req->ie_len;
++ memcpy(msg_body->ie, req->ie, req->ie_len);
+ }
+
+- PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
++ PREPARE_HAL_BUF(wcn->hal_buf, (*msg_body));
+
+ wcn36xx_dbg(WCN36XX_DBG_HAL,
+ "hal start hw-scan (channels: %u; ssids: %u; p2p: %s)\n",
+- msg_body.num_channel, msg_body.num_ssid,
+- msg_body.p2p_search ? "yes" : "no");
++ msg_body->num_channel, msg_body->num_ssid,
++ msg_body->p2p_search ? "yes" : "no");
+
+- ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
++ ret = wcn36xx_smd_send_and_wait(wcn, msg_body->header.len);
+ if (ret) {
+ wcn36xx_err("Sending hal_start_scan_offload failed\n");
+ goto out;
+@@ -698,6 +704,7 @@ int wcn36xx_smd_start_hw_scan(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+ goto out;
+ }
+ out:
++ kfree(msg_body);
+ mutex_unlock(&wcn->hal_mutex);
+ return ret;
+ }
+@@ -1257,96 +1264,104 @@ out:
+ static int wcn36xx_smd_config_bss_v1(struct wcn36xx *wcn,
+ const struct wcn36xx_hal_config_bss_req_msg *orig)
+ {
+- struct wcn36xx_hal_config_bss_req_msg_v1 msg_body;
+- struct wcn36xx_hal_config_bss_params_v1 *bss = &msg_body.bss_params;
+- struct wcn36xx_hal_config_sta_params_v1 *sta = &bss->sta;
++ struct wcn36xx_hal_config_bss_req_msg_v1 *msg_body;
++ struct wcn36xx_hal_config_bss_params_v1 *bss;
++ struct wcn36xx_hal_config_sta_params_v1 *sta;
++ int ret;
++
++ msg_body = kzalloc(sizeof(*msg_body), GFP_KERNEL);
++ if (!msg_body)
++ return -ENOMEM;
++
++ INIT_HAL_MSG((*msg_body), WCN36XX_HAL_CONFIG_BSS_REQ);
+
+- INIT_HAL_MSG(msg_body, WCN36XX_HAL_CONFIG_BSS_REQ);
++ bss = &msg_body->bss_params;
++ sta = &bss->sta;
+
+ /* convert orig to v1 */
+- memcpy(&msg_body.bss_params.bssid,
++ memcpy(&msg_body->bss_params.bssid,
+ &orig->bss_params.bssid, ETH_ALEN);
+- memcpy(&msg_body.bss_params.self_mac_addr,
++ memcpy(&msg_body->bss_params.self_mac_addr,
+ &orig->bss_params.self_mac_addr, ETH_ALEN);
+
+- msg_body.bss_params.bss_type = orig->bss_params.bss_type;
+- msg_body.bss_params.oper_mode = orig->bss_params.oper_mode;
+- msg_body.bss_params.nw_type = orig->bss_params.nw_type;
++ msg_body->bss_params.bss_type = orig->bss_params.bss_type;
++ msg_body->bss_params.oper_mode = orig->bss_params.oper_mode;
++ msg_body->bss_params.nw_type = orig->bss_params.nw_type;
+
+- msg_body.bss_params.short_slot_time_supported =
++ msg_body->bss_params.short_slot_time_supported =
+ orig->bss_params.short_slot_time_supported;
+- msg_body.bss_params.lla_coexist = orig->bss_params.lla_coexist;
+- msg_body.bss_params.llb_coexist = orig->bss_params.llb_coexist;
+- msg_body.bss_params.llg_coexist = orig->bss_params.llg_coexist;
+- msg_body.bss_params.ht20_coexist = orig->bss_params.ht20_coexist;
+- msg_body.bss_params.lln_non_gf_coexist =
++ msg_body->bss_params.lla_coexist = orig->bss_params.lla_coexist;
++ msg_body->bss_params.llb_coexist = orig->bss_params.llb_coexist;
++ msg_body->bss_params.llg_coexist = orig->bss_params.llg_coexist;
++ msg_body->bss_params.ht20_coexist = orig->bss_params.ht20_coexist;
++ msg_body->bss_params.lln_non_gf_coexist =
+ orig->bss_params.lln_non_gf_coexist;
+
+- msg_body.bss_params.lsig_tx_op_protection_full_support =
++ msg_body->bss_params.lsig_tx_op_protection_full_support =
+ orig->bss_params.lsig_tx_op_protection_full_support;
+- msg_body.bss_params.rifs_mode = orig->bss_params.rifs_mode;
+- msg_body.bss_params.beacon_interval = orig->bss_params.beacon_interval;
+- msg_body.bss_params.dtim_period = orig->bss_params.dtim_period;
+- msg_body.bss_params.tx_channel_width_set =
++ msg_body->bss_params.rifs_mode = orig->bss_params.rifs_mode;
++ msg_body->bss_params.beacon_interval = orig->bss_params.beacon_interval;
++ msg_body->bss_params.dtim_period = orig->bss_params.dtim_period;
++ msg_body->bss_params.tx_channel_width_set =
+ orig->bss_params.tx_channel_width_set;
+- msg_body.bss_params.oper_channel = orig->bss_params.oper_channel;
+- msg_body.bss_params.ext_channel = orig->bss_params.ext_channel;
++ msg_body->bss_params.oper_channel = orig->bss_params.oper_channel;
++ msg_body->bss_params.ext_channel = orig->bss_params.ext_channel;
+
+- msg_body.bss_params.reserved = orig->bss_params.reserved;
++ msg_body->bss_params.reserved = orig->bss_params.reserved;
+
+- memcpy(&msg_body.bss_params.ssid,
++ memcpy(&msg_body->bss_params.ssid,
+ &orig->bss_params.ssid,
+ sizeof(orig->bss_params.ssid));
+
+- msg_body.bss_params.action = orig->bss_params.action;
+- msg_body.bss_params.rateset = orig->bss_params.rateset;
+- msg_body.bss_params.ht = orig->bss_params.ht;
+- msg_body.bss_params.obss_prot_enabled =
++ msg_body->bss_params.action = orig->bss_params.action;
++ msg_body->bss_params.rateset = orig->bss_params.rateset;
++ msg_body->bss_params.ht = orig->bss_params.ht;
++ msg_body->bss_params.obss_prot_enabled =
+ orig->bss_params.obss_prot_enabled;
+- msg_body.bss_params.rmf = orig->bss_params.rmf;
+- msg_body.bss_params.ht_oper_mode = orig->bss_params.ht_oper_mode;
+- msg_body.bss_params.dual_cts_protection =
++ msg_body->bss_params.rmf = orig->bss_params.rmf;
++ msg_body->bss_params.ht_oper_mode = orig->bss_params.ht_oper_mode;
++ msg_body->bss_params.dual_cts_protection =
+ orig->bss_params.dual_cts_protection;
+
+- msg_body.bss_params.max_probe_resp_retry_limit =
++ msg_body->bss_params.max_probe_resp_retry_limit =
+ orig->bss_params.max_probe_resp_retry_limit;
+- msg_body.bss_params.hidden_ssid = orig->bss_params.hidden_ssid;
+- msg_body.bss_params.proxy_probe_resp =
++ msg_body->bss_params.hidden_ssid = orig->bss_params.hidden_ssid;
++ msg_body->bss_params.proxy_probe_resp =
+ orig->bss_params.proxy_probe_resp;
+- msg_body.bss_params.edca_params_valid =
++ msg_body->bss_params.edca_params_valid =
+ orig->bss_params.edca_params_valid;
+
+- memcpy(&msg_body.bss_params.acbe,
++ memcpy(&msg_body->bss_params.acbe,
+ &orig->bss_params.acbe,
+ sizeof(orig->bss_params.acbe));
+- memcpy(&msg_body.bss_params.acbk,
++ memcpy(&msg_body->bss_params.acbk,
+ &orig->bss_params.acbk,
+ sizeof(orig->bss_params.acbk));
+- memcpy(&msg_body.bss_params.acvi,
++ memcpy(&msg_body->bss_params.acvi,
+ &orig->bss_params.acvi,
+ sizeof(orig->bss_params.acvi));
+- memcpy(&msg_body.bss_params.acvo,
++ memcpy(&msg_body->bss_params.acvo,
+ &orig->bss_params.acvo,
+ sizeof(orig->bss_params.acvo));
+
+- msg_body.bss_params.ext_set_sta_key_param_valid =
++ msg_body->bss_params.ext_set_sta_key_param_valid =
+ orig->bss_params.ext_set_sta_key_param_valid;
+
+- memcpy(&msg_body.bss_params.ext_set_sta_key_param,
++ memcpy(&msg_body->bss_params.ext_set_sta_key_param,
+ &orig->bss_params.ext_set_sta_key_param,
+ sizeof(orig->bss_params.acvo));
+
+- msg_body.bss_params.wcn36xx_hal_persona =
++ msg_body->bss_params.wcn36xx_hal_persona =
+ orig->bss_params.wcn36xx_hal_persona;
+- msg_body.bss_params.spectrum_mgt_enable =
++ msg_body->bss_params.spectrum_mgt_enable =
+ orig->bss_params.spectrum_mgt_enable;
+- msg_body.bss_params.tx_mgmt_power = orig->bss_params.tx_mgmt_power;
+- msg_body.bss_params.max_tx_power = orig->bss_params.max_tx_power;
++ msg_body->bss_params.tx_mgmt_power = orig->bss_params.tx_mgmt_power;
++ msg_body->bss_params.max_tx_power = orig->bss_params.max_tx_power;
+
+ wcn36xx_smd_convert_sta_to_v1(wcn, &orig->bss_params.sta,
+- &msg_body.bss_params.sta);
++ &msg_body->bss_params.sta);
+
+- PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
++ PREPARE_HAL_BUF(wcn->hal_buf, (*msg_body));
+
+ wcn36xx_dbg(WCN36XX_DBG_HAL,
+ "hal config bss v1 bssid %pM self_mac_addr %pM bss_type %d oper_mode %d nw_type %d\n",
+@@ -1358,7 +1373,10 @@ static int wcn36xx_smd_config_bss_v1(struct wcn36xx *wcn,
+ sta->bssid, sta->action, sta->sta_index,
+ sta->bssid_index, sta->aid, sta->type, sta->mac);
+
+- return wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
++ ret = wcn36xx_smd_send_and_wait(wcn, msg_body->header.len);
++ kfree(msg_body);
++
++ return ret;
+ }
+
+
+@@ -1410,16 +1428,21 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta, const u8 *bssid,
+ bool update)
+ {
+- struct wcn36xx_hal_config_bss_req_msg msg;
++ struct wcn36xx_hal_config_bss_req_msg *msg;
+ struct wcn36xx_hal_config_bss_params *bss;
+ struct wcn36xx_hal_config_sta_params *sta_params;
+ struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
+ int ret;
+
+ mutex_lock(&wcn->hal_mutex);
+- INIT_HAL_MSG(msg, WCN36XX_HAL_CONFIG_BSS_REQ);
++ msg = kzalloc(sizeof(*msg), GFP_KERNEL);
++ if (!msg) {
++ ret = -ENOMEM;
++ goto out;
++ }
++ INIT_HAL_MSG((*msg), WCN36XX_HAL_CONFIG_BSS_REQ);
+
+- bss = &msg.bss_params;
++ bss = &msg->bss_params;
+ sta_params = &bss->sta;
+
+ WARN_ON(is_zero_ether_addr(bssid));
+@@ -1514,11 +1537,11 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+ sta_params->mac);
+
+ if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+- ret = wcn36xx_smd_config_bss_v1(wcn, &msg);
++ ret = wcn36xx_smd_config_bss_v1(wcn, msg);
+ } else {
+- PREPARE_HAL_BUF(wcn->hal_buf, msg);
++ PREPARE_HAL_BUF(wcn->hal_buf, (*msg));
+
+- ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
++ ret = wcn36xx_smd_send_and_wait(wcn, msg->header.len);
+ }
+ if (ret) {
+ wcn36xx_err("Sending hal_config_bss failed\n");
+@@ -1534,6 +1557,7 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+ goto out;
+ }
+ out:
++ kfree(msg);
+ mutex_unlock(&wcn->hal_mutex);
+ return ret;
+ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+index d2f788d88668..710dc59c5d34 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -617,15 +617,13 @@ int brcmf_sdiod_send_buf(struct brcmf_sdio_dev *sdiodev, u8 *buf, uint nbytes)
+
+ err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
+ if (err)
+- return err;
++ goto out;
+
+ addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+- if (!err)
+- err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr,
+- mypkt);
+-
++ err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr, mypkt);
++out:
+ brcmu_pkt_buf_free_skb(mypkt);
+
+ return err;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+index c4965184cdf3..3d441c5c745c 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -90,6 +90,7 @@ struct brcmf_bus_ops {
+ int (*get_memdump)(struct device *dev, void *data, size_t len);
+ int (*get_fwname)(struct device *dev, const char *ext,
+ unsigned char *fw_name);
++ void (*debugfs_create)(struct device *dev);
+ };
+
+
+@@ -235,6 +236,15 @@ int brcmf_bus_get_fwname(struct brcmf_bus *bus, const char *ext,
+ return bus->ops->get_fwname(bus->dev, ext, fw_name);
+ }
+
++static inline
++void brcmf_bus_debugfs_create(struct brcmf_bus *bus)
++{
++ if (!bus->ops->debugfs_create)
++ return;
++
++ return bus->ops->debugfs_create(bus->dev);
++}
++
+ /*
+ * interface functions from common layer
+ */
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+index 584e05fdca6a..9d7b8834b854 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1105,6 +1105,7 @@ static int brcmf_bus_started(struct brcmf_pub *drvr, struct cfg80211_ops *ops)
+ brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
+ brcmf_feat_debugfs_create(drvr);
+ brcmf_proto_debugfs_create(drvr);
++ brcmf_bus_debugfs_create(bus_if);
+
+ return 0;
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index abaed2fa2def..5c3b62e61980 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3131,9 +3131,12 @@ static int brcmf_debugfs_sdio_count_read(struct seq_file *seq, void *data)
+ return 0;
+ }
+
+-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
++static void brcmf_sdio_debugfs_create(struct device *dev)
+ {
+- struct brcmf_pub *drvr = bus->sdiodev->bus_if->drvr;
++ struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++ struct brcmf_pub *drvr = bus_if->drvr;
++ struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++ struct brcmf_sdio *bus = sdiodev->bus;
+ struct dentry *dentry = brcmf_debugfs_get_devdir(drvr);
+
+ if (IS_ERR_OR_NULL(dentry))
+@@ -3153,7 +3156,7 @@ static int brcmf_sdio_checkdied(struct brcmf_sdio *bus)
+ return 0;
+ }
+
+-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
++static void brcmf_sdio_debugfs_create(struct device *dev)
+ {
+ }
+ #endif /* DEBUG */
+@@ -3438,8 +3441,6 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
+ if (bus->rxbuf)
+ bus->rxblen = value;
+
+- brcmf_sdio_debugfs_create(bus);
+-
+ /* the commands below use the terms tx and rx from
+ * a device perspective, ie. bus:txglom affects the
+ * bus transfers from device to host.
+@@ -4050,6 +4051,7 @@ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
+ .get_ramsize = brcmf_sdio_bus_get_ramsize,
+ .get_memdump = brcmf_sdio_bus_get_memdump,
+ .get_fwname = brcmf_sdio_get_fwname,
++ .debugfs_create = brcmf_sdio_debugfs_create
+ };
+
+ #define BRCMF_SDIO_FW_CODE 0
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
+index 6c5338364794..d22c1eefba6a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
+@@ -165,7 +165,7 @@ struct iwl_nvm_access_resp {
+ */
+ struct iwl_nvm_get_info {
+ __le32 reserved;
+-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_CMD_S_VER_1 */
++} __packed; /* REGULATORY_NVM_GET_INFO_CMD_API_S_VER_1 */
+
+ /**
+ * enum iwl_nvm_info_general_flags - flags in NVM_GET_INFO resp
+@@ -180,14 +180,14 @@ enum iwl_nvm_info_general_flags {
+ * @flags: bit 0: 1 - empty, 0 - non-empty
+ * @nvm_version: nvm version
+ * @board_type: board type
+- * @reserved: reserved
++ * @n_hw_addrs: number of reserved MAC addresses
+ */
+ struct iwl_nvm_get_info_general {
+ __le32 flags;
+ __le16 nvm_version;
+ u8 board_type;
+- u8 reserved;
+-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_GENERAL_S_VER_1 */
++ u8 n_hw_addrs;
++} __packed; /* REGULATORY_NVM_GET_INFO_GENERAL_S_VER_2 */
+
+ /**
+ * enum iwl_nvm_mac_sku_flags - flags in &iwl_nvm_get_info_sku
+@@ -231,7 +231,7 @@ struct iwl_nvm_get_info_sku {
+ struct iwl_nvm_get_info_phy {
+ __le32 tx_chains;
+ __le32 rx_chains;
+-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_PHY_SKU_SECTION_S_VER_1 */
++} __packed; /* REGULATORY_NVM_GET_INFO_PHY_SKU_SECTION_S_VER_1 */
+
+ #define IWL_NUM_CHANNELS (51)
+
+@@ -245,7 +245,7 @@ struct iwl_nvm_get_info_regulatory {
+ __le32 lar_enabled;
+ __le16 channel_profile[IWL_NUM_CHANNELS];
+ __le16 reserved;
+-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_1 */
++} __packed; /* REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_1 */
+
+ /**
+ * struct iwl_nvm_get_info_rsp - response to get NVM data
+@@ -259,7 +259,7 @@ struct iwl_nvm_get_info_rsp {
+ struct iwl_nvm_get_info_sku mac_sku;
+ struct iwl_nvm_get_info_phy phy_sku;
+ struct iwl_nvm_get_info_regulatory regulatory;
+-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_CMD_RSP_S_VER_2 */
++} __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_3 */
+
+ /**
+ * struct iwl_nvm_access_complete_cmd - NVM_ACCESS commands are completed
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+index 73969dbeb5c5..b850cca9853c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+@@ -1315,6 +1315,7 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
+ bool lar_fw_supported = !iwlwifi_mod_params.lar_disable &&
+ fw_has_capa(&fw->ucode_capa,
+ IWL_UCODE_TLV_CAPA_LAR_SUPPORT);
++ bool empty_otp;
+ u32 mac_flags;
+ u32 sbands_flags = 0;
+
+@@ -1330,7 +1331,9 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
+ }
+
+ rsp = (void *)hcmd.resp_pkt->data;
+- if (le32_to_cpu(rsp->general.flags) & NVM_GENERAL_FLAGS_EMPTY_OTP)
++ empty_otp = !!(le32_to_cpu(rsp->general.flags) &
++ NVM_GENERAL_FLAGS_EMPTY_OTP);
++ if (empty_otp)
+ IWL_INFO(trans, "OTP is empty\n");
+
+ nvm = kzalloc(sizeof(*nvm) +
+@@ -1354,6 +1357,11 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
+
+ /* Initialize general data */
+ nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
++ nvm->n_hw_addrs = rsp->general.n_hw_addrs;
++ if (nvm->n_hw_addrs == 0)
++ IWL_WARN(trans,
++ "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
++ empty_otp);
+
+ /* Initialize MAC sku data */
+ mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 9808d954dca2..c7e2b88cd5ab 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -110,12 +110,12 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
+ int i;
+ struct iwl_rss_config_cmd cmd = {
+ .flags = cpu_to_le32(IWL_RSS_ENABLE),
+- .hash_mask = IWL_RSS_HASH_TYPE_IPV4_TCP |
+- IWL_RSS_HASH_TYPE_IPV4_UDP |
+- IWL_RSS_HASH_TYPE_IPV4_PAYLOAD |
+- IWL_RSS_HASH_TYPE_IPV6_TCP |
+- IWL_RSS_HASH_TYPE_IPV6_UDP |
+- IWL_RSS_HASH_TYPE_IPV6_PAYLOAD,
++ .hash_mask = BIT(IWL_RSS_HASH_TYPE_IPV4_TCP) |
++ BIT(IWL_RSS_HASH_TYPE_IPV4_UDP) |
++ BIT(IWL_RSS_HASH_TYPE_IPV4_PAYLOAD) |
++ BIT(IWL_RSS_HASH_TYPE_IPV6_TCP) |
++ BIT(IWL_RSS_HASH_TYPE_IPV6_UDP) |
++ BIT(IWL_RSS_HASH_TYPE_IPV6_PAYLOAD),
+ };
+
+ if (mvm->trans->num_rx_queues == 1)
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index 036d1d82d93e..77e369453642 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -1077,7 +1077,6 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
+ he_phy_data = le64_to_cpu(desc->v1.he_phy_data);
+
+ rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
+- rx_status->ampdu_reference = mvm->ampdu_ref;
+ /* toggle is switched whenever new aggregation starts */
+ if (toggle_bit != mvm->ampdu_toggle) {
+ mvm->ampdu_ref++;
+@@ -1092,6 +1091,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
+ RX_FLAG_AMPDU_EOF_BIT;
+ }
+ }
++ rx_status->ampdu_reference = mvm->ampdu_ref;
+ }
+
+ rcu_read_lock();
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index e850aa504b60..69057701641e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -2462,7 +2462,7 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+ struct iwl_mvm_tid_data *tid_data;
+ u16 normalized_ssn;
+- int txq_id;
++ u16 txq_id;
+ int ret;
+
+ if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
+@@ -2506,17 +2506,24 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ */
+ txq_id = mvmsta->tid_data[tid].txq_id;
+ if (txq_id == IWL_MVM_INVALID_QUEUE) {
+- txq_id = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
+- IWL_MVM_DQA_MIN_DATA_QUEUE,
+- IWL_MVM_DQA_MAX_DATA_QUEUE);
+- if (txq_id < 0) {
+- ret = txq_id;
++ ret = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
++ IWL_MVM_DQA_MIN_DATA_QUEUE,
++ IWL_MVM_DQA_MAX_DATA_QUEUE);
++ if (ret < 0) {
+ IWL_ERR(mvm, "Failed to allocate agg queue\n");
+ goto release_locks;
+ }
+
++ txq_id = ret;
++
+ /* TXQ hasn't yet been enabled, so mark it only as reserved */
+ mvm->queue_info[txq_id].status = IWL_MVM_QUEUE_RESERVED;
++ } else if (WARN_ON(txq_id >= IWL_MAX_HW_QUEUES)) {
++ ret = -ENXIO;
++ IWL_ERR(mvm, "tid_id %d out of range (0, %d)!\n",
++ tid, IWL_MAX_HW_QUEUES - 1);
++ goto out;
++
+ } else if (unlikely(mvm->queue_info[txq_id].status ==
+ IWL_MVM_QUEUE_SHARED)) {
+ ret = -ENXIO;
+diff --git a/drivers/net/wireless/marvell/libertas_tf/cmd.c b/drivers/net/wireless/marvell/libertas_tf/cmd.c
+index 909ac3685010..2b193f1257a5 100644
+--- a/drivers/net/wireless/marvell/libertas_tf/cmd.c
++++ b/drivers/net/wireless/marvell/libertas_tf/cmd.c
+@@ -69,7 +69,7 @@ static void lbtf_geo_init(struct lbtf_private *priv)
+ break;
+ }
+
+- for (ch = priv->range.start; ch < priv->range.end; ch++)
++ for (ch = range->start; ch < range->end; ch++)
+ priv->channels[CHAN_TO_IDX(ch)].flags = 0;
+ }
+
+diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
+index 8d40e92fb6f2..dcf927de65f3 100644
+--- a/drivers/net/wireless/mediatek/mt76/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/usb.c
+@@ -273,10 +273,16 @@ EXPORT_SYMBOL_GPL(mt76u_buf_alloc);
+ void mt76u_buf_free(struct mt76u_buf *buf)
+ {
+ struct urb *urb = buf->urb;
++ struct scatterlist *sg;
+ int i;
+
+- for (i = 0; i < urb->num_sgs; i++)
+- skb_free_frag(sg_virt(&urb->sg[i]));
++ for (i = 0; i < urb->num_sgs; i++) {
++ sg = &urb->sg[i];
++ if (!sg)
++ continue;
++
++ skb_free_frag(sg_virt(sg));
++ }
+ usb_free_urb(buf->urb);
+ }
+ EXPORT_SYMBOL_GPL(mt76u_buf_free);
+@@ -478,7 +484,8 @@ static int mt76u_alloc_rx(struct mt76_dev *dev)
+ nsgs = 1;
+ }
+
+- for (i = 0; i < MT_NUM_RX_ENTRIES; i++) {
++ q->ndesc = MT_NUM_RX_ENTRIES;
++ for (i = 0; i < q->ndesc; i++) {
+ err = mt76u_buf_alloc(dev, &q->entry[i].ubuf,
+ nsgs, q->buf_size,
+ SKB_WITH_OVERHEAD(q->buf_size),
+@@ -486,7 +493,6 @@ static int mt76u_alloc_rx(struct mt76_dev *dev)
+ if (err < 0)
+ return err;
+ }
+- q->ndesc = MT_NUM_RX_ENTRIES;
+
+ return mt76u_submit_rx_buffers(dev);
+ }
+diff --git a/drivers/net/wireless/mediatek/mt7601u/phy.c b/drivers/net/wireless/mediatek/mt7601u/phy.c
+index b804abd464ae..539f78149e43 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/phy.c
++++ b/drivers/net/wireless/mediatek/mt7601u/phy.c
+@@ -221,7 +221,7 @@ int mt7601u_wait_bbp_ready(struct mt7601u_dev *dev)
+
+ do {
+ val = mt7601u_bbp_rr(dev, MT_BBP_REG_VERSION);
+- if (val && ~val)
++ if (val && val != 0xff)
+ break;
+ } while (--i);
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index d70385be9976..498994041bbc 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -109,7 +109,7 @@ static const struct file_operations file_ops_common = {
+ .open = dl_debug_open_common,
+ .read = seq_read,
+ .llseek = seq_lseek,
+- .release = seq_release,
++ .release = single_release,
+ };
+
+ static int rtl_debug_get_mac_page(struct seq_file *m, void *v)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+index 317c1b3101da..ba258318ee9f 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+@@ -3404,75 +3404,6 @@ static void rtl8821ae_update_hal_rate_table(struct ieee80211_hw *hw,
+ "%x\n", rtl_read_dword(rtlpriv, REG_ARFR0));
+ }
+
+-static u8 _rtl8821ae_mrate_idx_to_arfr_id(
+- struct ieee80211_hw *hw, u8 rate_index,
+- enum wireless_mode wirelessmode)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- struct rtl_phy *rtlphy = &rtlpriv->phy;
+- u8 ret = 0;
+- switch (rate_index) {
+- case RATR_INX_WIRELESS_NGB:
+- if (rtlphy->rf_type == RF_1T1R)
+- ret = 1;
+- else
+- ret = 0;
+- ; break;
+- case RATR_INX_WIRELESS_N:
+- case RATR_INX_WIRELESS_NG:
+- if (rtlphy->rf_type == RF_1T1R)
+- ret = 5;
+- else
+- ret = 4;
+- ; break;
+- case RATR_INX_WIRELESS_NB:
+- if (rtlphy->rf_type == RF_1T1R)
+- ret = 3;
+- else
+- ret = 2;
+- ; break;
+- case RATR_INX_WIRELESS_GB:
+- ret = 6;
+- break;
+- case RATR_INX_WIRELESS_G:
+- ret = 7;
+- break;
+- case RATR_INX_WIRELESS_B:
+- ret = 8;
+- break;
+- case RATR_INX_WIRELESS_MC:
+- if ((wirelessmode == WIRELESS_MODE_B)
+- || (wirelessmode == WIRELESS_MODE_G)
+- || (wirelessmode == WIRELESS_MODE_N_24G)
+- || (wirelessmode == WIRELESS_MODE_AC_24G))
+- ret = 6;
+- else
+- ret = 7;
+- case RATR_INX_WIRELESS_AC_5N:
+- if (rtlphy->rf_type == RF_1T1R)
+- ret = 10;
+- else
+- ret = 9;
+- break;
+- case RATR_INX_WIRELESS_AC_24N:
+- if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_80) {
+- if (rtlphy->rf_type == RF_1T1R)
+- ret = 10;
+- else
+- ret = 9;
+- } else {
+- if (rtlphy->rf_type == RF_1T1R)
+- ret = 11;
+- else
+- ret = 12;
+- }
+- break;
+- default:
+- ret = 0; break;
+- }
+- return ret;
+-}
+-
+ static u32 _rtl8821ae_rate_to_bitmap_2ssvht(__le16 vht_rate)
+ {
+ u8 i, j, tmp_rate;
+@@ -3761,7 +3692,7 @@ static void rtl8821ae_update_hal_rate_mask(struct ieee80211_hw *hw,
+ break;
+ }
+
+- ratr_index = _rtl8821ae_mrate_idx_to_arfr_id(hw, ratr_index, wirelessmode);
++ ratr_index = rtl_mrate_idx_to_arfr_id(hw, ratr_index, wirelessmode);
+ sta_entry->ratr_index = ratr_index;
+ ratr_bitmap = _rtl8821ae_set_ra_vht_ratr_bitmap(hw, wirelessmode,
+ ratr_bitmap);
+diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
+index dbe72f116017..a67ef23e81bc 100644
+--- a/drivers/ntb/hw/idt/ntb_hw_idt.c
++++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
+@@ -1105,9 +1105,9 @@ static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port,
+ }
+
+ /* Allocate memory for memory window descriptors */
+- ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt,
+- sizeof(*ret_mws), GFP_KERNEL);
+- if (IS_ERR_OR_NULL(ret_mws))
++ ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt, sizeof(*ret_mws),
++ GFP_KERNEL);
++ if (!ret_mws)
+ return ERR_PTR(-ENOMEM);
+
+ /* Copy the info of detected memory windows */
+@@ -2390,7 +2390,7 @@ static struct idt_ntb_dev *idt_create_dev(struct pci_dev *pdev,
+
+ /* Allocate memory for the IDT PCIe-device descriptor */
+ ndev = devm_kzalloc(&pdev->dev, sizeof(*ndev), GFP_KERNEL);
+- if (IS_ERR_OR_NULL(ndev)) {
++ if (!ndev) {
+ dev_err(&pdev->dev, "Memory allocation failed for descriptor");
+ return ERR_PTR(-ENOMEM);
+ }
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index 5ee5f40b4dfc..313f6258c424 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -899,7 +899,7 @@ static int switchtec_ntb_init_sndev(struct switchtec_ntb *sndev)
+ }
+
+ sndev->peer_partition = ffs(tpart_vec) - 1;
+- if (!(part_map & (1 << sndev->peer_partition))) {
++ if (!(part_map & (1ULL << sndev->peer_partition))) {
+ dev_err(&sndev->stdev->dev,
+ "ntb target partition is not NT partition\n");
+ return -ENODEV;
+@@ -1120,7 +1120,7 @@ static int crosslink_enum_partition(struct switchtec_ntb *sndev,
+
+ dev_dbg(&sndev->stdev->dev,
+ "Crosslink BAR%d addr: %llx\n",
+- i, bar_addr);
++ i*2, bar_addr);
+
+ if (bar_addr != bar_space * i)
+ continue;
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 124f41157173..3c68a5b35ec1 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2396,7 +2396,7 @@ static int nvme_pci_reg_write32(struct nvme_ctrl *ctrl, u32 off, u32 val)
+
+ static int nvme_pci_reg_read64(struct nvme_ctrl *ctrl, u32 off, u64 *val)
+ {
+- *val = readq(to_nvme_dev(ctrl)->bar + off);
++ *val = lo_hi_readq(to_nvme_dev(ctrl)->bar + off);
+ return 0;
+ }
+
+diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
+index 926d9cc080cf..09281aca86c2 100644
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -50,7 +50,9 @@
+ #define IMX_OCOTP_BM_CTRL_ERROR 0x00000200
+ #define IMX_OCOTP_BM_CTRL_REL_SHADOWS 0x00000400
+
+-#define DEF_RELAX 20 /* > 16.5ns */
++#define TIMING_STROBE_PROG_US 10 /* Min time to blow a fuse */
++#define TIMING_STROBE_READ_NS 37 /* Min time before read */
++#define TIMING_RELAX_NS 17
+ #define DEF_FSOURCE 1001 /* > 1000 ns */
+ #define DEF_STROBE_PROG 10000 /* IPG clocks */
+ #define IMX_OCOTP_WR_UNLOCK 0x3E770000
+@@ -182,14 +184,41 @@ static void imx_ocotp_set_imx6_timing(struct ocotp_priv *priv)
+ * fields with timing values to match the current frequency of the
+ * ipg_clk. OTP writes will work at maximum bus frequencies as long
+ * as the HW_OCOTP_TIMING parameters are set correctly.
++ *
++ * Note: there are minimum timings required to ensure an OTP fuse burns
++ * correctly that are independent of the ipg_clk. Those values are not
++ * formally documented anywhere however, working from the minimum
++ * timings given in u-boot we can say:
++ *
++ * - Minimum STROBE_PROG time is 10 microseconds. Intuitively 10
++ * microseconds feels about right as representative of a minimum time
++ * to physically burn out a fuse.
++ *
++ * - Minimum STROBE_READ i.e. the time to wait post OTP fuse burn before
++ * performing another read is 37 nanoseconds
++ *
++ * - Minimum RELAX timing is 17 nanoseconds. This final RELAX minimum
++ * timing is not entirely clear the documentation says "This
++ * count value specifies the time to add to all default timing
++ * parameters other than the Tpgm and Trd. It is given in number
++ * of ipg_clk periods." where Tpgm and Trd refer to STROBE_PROG
++ * and STROBE_READ respectively. What the other timing parameters
++ * are though, is not specified. Experience shows a zero RELAX
++ * value will mess up a re-load of the shadow registers post OTP
++ * burn.
+ */
+ clk_rate = clk_get_rate(priv->clk);
+
+- relax = clk_rate / (1000000000 / DEF_RELAX) - 1;
+- strobe_prog = clk_rate / (1000000000 / 10000) + 2 * (DEF_RELAX + 1) - 1;
+- strobe_read = clk_rate / (1000000000 / 40) + 2 * (DEF_RELAX + 1) - 1;
++ relax = DIV_ROUND_UP(clk_rate * TIMING_RELAX_NS, 1000000000) - 1;
++ strobe_read = DIV_ROUND_UP(clk_rate * TIMING_STROBE_READ_NS,
++ 1000000000);
++ strobe_read += 2 * (relax + 1) - 1;
++ strobe_prog = DIV_ROUND_CLOSEST(clk_rate * TIMING_STROBE_PROG_US,
++ 1000000);
++ strobe_prog += 2 * (relax + 1) - 1;
+
+- timing = strobe_prog & 0x00000FFF;
++ timing = readl(priv->base + IMX_OCOTP_ADDR_TIMING) & 0x0FC00000;
++ timing |= strobe_prog & 0x00000FFF;
+ timing |= (relax << 12) & 0x0000F000;
+ timing |= (strobe_read << 16) & 0x003F0000;
+
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index 5ad1342f5682..7d2bc22680d9 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -370,7 +370,7 @@ struct phy_device *of_phy_get_and_connect(struct net_device *dev,
+ int ret;
+
+ iface = of_get_phy_mode(np);
+- if (iface < 0)
++ if ((int)iface < 0)
+ return NULL;
+ if (of_phy_is_fixed_link(np)) {
+ ret = of_phy_register_fixed_link(np);
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 1e80f9ec1aa6..34515f432375 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -793,6 +793,9 @@ static struct opp_table *_allocate_opp_table(struct device *dev)
+
+ INIT_LIST_HEAD(&opp_table->dev_list);
+
++ /* Mark regulator count uninitialized */
++ opp_table->regulator_count = -1;
++
+ opp_dev = _add_opp_dev(dev, opp_table);
+ if (!opp_dev) {
+ kfree(opp_table);
+@@ -955,7 +958,7 @@ struct dev_pm_opp *_opp_allocate(struct opp_table *table)
+ int count, supply_size;
+
+ /* Allocate space for at least one supply */
+- count = table->regulator_count ? table->regulator_count : 1;
++ count = table->regulator_count > 0 ? table->regulator_count : 1;
+ supply_size = sizeof(*opp->supplies) * count;
+
+ /* allocate new OPP node and supplies structures */
+@@ -1363,7 +1366,7 @@ free_regulators:
+
+ kfree(opp_table->regulators);
+ opp_table->regulators = NULL;
+- opp_table->regulator_count = 0;
++ opp_table->regulator_count = -1;
+ err:
+ dev_pm_opp_put_opp_table(opp_table);
+
+@@ -1392,7 +1395,7 @@ void dev_pm_opp_put_regulators(struct opp_table *opp_table)
+
+ kfree(opp_table->regulators);
+ opp_table->regulators = NULL;
+- opp_table->regulator_count = 0;
++ opp_table->regulator_count = -1;
+
+ put_opp_table:
+ dev_pm_opp_put_opp_table(opp_table);
+@@ -1545,6 +1548,9 @@ int dev_pm_opp_add(struct device *dev, unsigned long freq, unsigned long u_volt)
+ if (!opp_table)
+ return -ENOMEM;
+
++ /* Fix regulator count for dynamic OPPs */
++ opp_table->regulator_count = 1;
++
+ ret = _opp_add_v1(opp_table, dev, freq, u_volt, true);
+
+ dev_pm_opp_put_opp_table(opp_table);
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index 20988c426650..d64a13d7881b 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -113,12 +113,10 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev,
+ struct opp_table *opp_table)
+ {
+ u32 *microvolt, *microamp = NULL;
+- int supplies, vcount, icount, ret, i, j;
++ int supplies = opp_table->regulator_count, vcount, icount, ret, i, j;
+ struct property *prop = NULL;
+ char name[NAME_MAX];
+
+- supplies = opp_table->regulator_count ? opp_table->regulator_count : 1;
+-
+ /* Search for "opp-microvolt-<name>" */
+ if (opp_table->prop_name) {
+ snprintf(name, sizeof(name), "opp-microvolt-%s",
+@@ -133,7 +131,13 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev,
+
+ /* Missing property isn't a problem, but an invalid entry is */
+ if (!prop) {
+- if (!opp_table->regulator_count)
++ if (unlikely(supplies == -1)) {
++ /* Initialize regulator_count */
++ opp_table->regulator_count = 0;
++ return 0;
++ }
++
++ if (!supplies)
+ return 0;
+
+ dev_err(dev, "%s: opp-microvolt missing although OPP managing regulators\n",
+@@ -142,6 +146,14 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev,
+ }
+ }
+
++ if (unlikely(supplies == -1)) {
++ /* Initialize regulator_count */
++ supplies = opp_table->regulator_count = 1;
++ } else if (unlikely(!supplies)) {
++ dev_err(dev, "%s: opp-microvolt wasn't expected\n", __func__);
++ return -EINVAL;
++ }
++
+ vcount = of_property_count_u32_elems(opp->np, name);
+ if (vcount < 0) {
+ dev_err(dev, "%s: Invalid %s property (%d)\n",
+diff --git a/drivers/opp/opp.h b/drivers/opp/opp.h
+index 7c540fd063b2..c9e65964ed84 100644
+--- a/drivers/opp/opp.h
++++ b/drivers/opp/opp.h
+@@ -136,7 +136,9 @@ enum opp_table_access {
+ * @prop_name: A name to postfix to many DT properties, while parsing them.
+ * @clk: Device's clock handle
+ * @regulators: Supply regulators
+- * @regulator_count: Number of power supply regulators
++ * @regulator_count: Number of power supply regulators. Its value can be -1
++ * (uninitialized), 0 (no opp-microvolt property) or > 0 (has opp-microvolt
++ * property).
+ * @genpd_performance_state: Device's power domain support performance state.
+ * @set_opp: Platform specific set_opp callback
+ * @set_opp_data: Data to be passed to set_opp callback
+@@ -172,7 +174,7 @@ struct opp_table {
+ const char *prop_name;
+ struct clk *clk;
+ struct regulator **regulators;
+- unsigned int regulator_count;
++ int regulator_count;
+ bool genpd_performance_state;
+
+ int (*set_opp)(struct dev_pm_set_opp_data *data);
+diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
+index 739d97080d3b..a3d07d9c598b 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
++++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
+@@ -46,16 +46,19 @@ static u8 __dw_pcie_ep_find_next_cap(struct dw_pcie *pci, u8 cap_ptr,
+ u8 cap_id, next_cap_ptr;
+ u16 reg;
+
++ if (!cap_ptr)
++ return 0;
++
+ reg = dw_pcie_readw_dbi(pci, cap_ptr);
+- next_cap_ptr = (reg & 0xff00) >> 8;
+ cap_id = (reg & 0x00ff);
+
+- if (!next_cap_ptr || cap_id > PCI_CAP_ID_MAX)
++ if (cap_id > PCI_CAP_ID_MAX)
+ return 0;
+
+ if (cap_id == cap)
+ return cap_ptr;
+
++ next_cap_ptr = (reg & 0xff00) >> 8;
+ return __dw_pcie_ep_find_next_cap(pci, next_cap_ptr, cap);
+ }
+
+@@ -67,9 +70,6 @@ static u8 dw_pcie_ep_find_capability(struct dw_pcie *pci, u8 cap)
+ reg = dw_pcie_readw_dbi(pci, PCI_CAPABILITY_LIST);
+ next_cap_ptr = (reg & 0x00ff);
+
+- if (!next_cap_ptr)
+- return 0;
+-
+ return __dw_pcie_ep_find_next_cap(pci, next_cap_ptr, cap);
+ }
+
+diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
+index 3160e9342a2f..9d5cbc75d5ae 100644
+--- a/drivers/pci/controller/pcie-iproc.c
++++ b/drivers/pci/controller/pcie-iproc.c
+@@ -630,14 +630,6 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct iproc_pcie *pcie,
+ return (pcie->base + offset);
+ }
+
+- /*
+- * PAXC is connected to an internally emulated EP within the SoC. It
+- * allows only one device.
+- */
+- if (pcie->ep_is_internal)
+- if (slot > 0)
+- return NULL;
+-
+ return iproc_pcie_map_ep_cfg_reg(pcie, busno, slot, fn, where);
+ }
+
+@@ -1355,7 +1347,6 @@ static int iproc_pcie_rev_init(struct iproc_pcie *pcie)
+ break;
+ case IPROC_PCIE_PAXB:
+ regs = iproc_pcie_reg_paxb;
+- pcie->iproc_cfg_read = true;
+ pcie->has_apb_err_disable = true;
+ if (pcie->need_ob_cfg) {
+ pcie->ob_map = paxb_ob_map;
+@@ -1364,6 +1355,7 @@ static int iproc_pcie_rev_init(struct iproc_pcie *pcie)
+ break;
+ case IPROC_PCIE_PAXB_V2:
+ regs = iproc_pcie_reg_paxb_v2;
++ pcie->iproc_cfg_read = true;
+ pcie->has_apb_err_disable = true;
+ if (pcie->need_ob_cfg) {
+ pcie->ob_map = paxb_v2_ob_map;
+diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
+index a2d1e89d4867..14f816591e84 100644
+--- a/drivers/pci/controller/pcie-mobiveil.c
++++ b/drivers/pci/controller/pcie-mobiveil.c
+@@ -174,7 +174,7 @@ static bool mobiveil_pcie_valid_device(struct pci_bus *bus, unsigned int devfn)
+ * Do not read more than one device on the bus directly
+ * attached to RC
+ */
+- if ((bus->primary == pcie->root_bus_nr) && (devfn > 0))
++ if ((bus->primary == pcie->root_bus_nr) && (PCI_SLOT(devfn) > 0))
+ return false;
+
+ return true;
+@@ -395,7 +395,7 @@ static void program_ib_windows(struct mobiveil_pcie *pcie, int win_num,
+ int amap_ctrl_dw;
+ u64 size64 = ~(size - 1);
+
+- if ((pcie->ib_wins_configured + 1) > pcie->ppio_wins) {
++ if (win_num >= pcie->ppio_wins) {
+ dev_err(&pcie->pdev->dev,
+ "ERROR: max inbound windows reached !\n");
+ return;
+@@ -429,7 +429,7 @@ static void program_ob_windows(struct mobiveil_pcie *pcie, int win_num,
+ u32 value, type;
+ u64 size64 = ~(size - 1);
+
+- if ((pcie->ob_wins_configured + 1) > pcie->apio_wins) {
++ if (win_num >= pcie->apio_wins) {
+ dev_err(&pcie->pdev->dev,
+ "ERROR: max outbound windows reached !\n");
+ return;
+@@ -643,7 +643,7 @@ static struct irq_chip mobiveil_msi_irq_chip = {
+
+ static struct msi_domain_info mobiveil_msi_domain_info = {
+ .flags = (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
+- MSI_FLAG_MULTI_PCI_MSI | MSI_FLAG_PCI_MSIX),
++ MSI_FLAG_PCI_MSIX),
+ .chip = &mobiveil_msi_irq_chip,
+ };
+
+diff --git a/drivers/pci/controller/pcie-rockchip-ep.c b/drivers/pci/controller/pcie-rockchip-ep.c
+index b8163c56a142..caf34661d38d 100644
+--- a/drivers/pci/controller/pcie-rockchip-ep.c
++++ b/drivers/pci/controller/pcie-rockchip-ep.c
+@@ -350,7 +350,7 @@ static void rockchip_pcie_ep_assert_intx(struct rockchip_pcie_ep *ep, u8 fn,
+ struct rockchip_pcie *rockchip = &ep->rockchip;
+ u32 r = ep->max_regions - 1;
+ u32 offset;
+- u16 status;
++ u32 status;
+ u8 msg_code;
+
+ if (unlikely(ep->irq_pci_addr != ROCKCHIP_PCIE_EP_PCI_LEGACY_IRQ_ADDR ||
+diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
+index 3e86fa3c7da3..4bbd26e8a9e2 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-test.c
++++ b/drivers/pci/endpoint/functions/pci-epf-test.c
+@@ -175,7 +175,7 @@ static int pci_epf_test_read(struct pci_epf_test *epf_test)
+ goto err_map_addr;
+ }
+
+- memcpy(buf, src_addr, reg->size);
++ memcpy_fromio(buf, src_addr, reg->size);
+
+ crc32 = crc32_le(~0, buf, reg->size);
+ if (crc32 != reg->checksum)
+@@ -230,7 +230,7 @@ static int pci_epf_test_write(struct pci_epf_test *epf_test)
+ get_random_bytes(buf, reg->size);
+ reg->checksum = crc32_le(~0, buf, reg->size);
+
+- memcpy(dst_addr, buf, reg->size);
++ memcpy_toio(dst_addr, buf, reg->size);
+
+ /*
+ * wait 1ms inorder for the write to complete. Without this delay L3
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index bc1ff41ce3d3..78ae1cab9af7 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -959,15 +959,15 @@ static int pci_pm_freeze(struct device *dev)
+ }
+
+ /*
+- * This used to be done in pci_pm_prepare() for all devices and some
+- * drivers may depend on it, so do it here. Ideally, runtime-suspended
+- * devices should not be touched during freeze/thaw transitions,
+- * however.
++ * Resume all runtime-suspended devices before creating a snapshot
++ * image of system memory, because the restore kernel generally cannot
++ * be expected to always handle them consistently and they need to be
++ * put into the runtime-active metastate during system resume anyway,
++ * so it is better to ensure that the state saved in the image will be
++ * always consistent with that.
+ */
+- if (!dev_pm_smart_suspend_and_suspended(dev)) {
+- pm_runtime_resume(dev);
+- pci_dev->state_saved = false;
+- }
++ pm_runtime_resume(dev);
++ pci_dev->state_saved = false;
+
+ if (pm->freeze) {
+ int error;
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index c9f51fc24563..57a87a001b4f 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5039,39 +5039,42 @@ unlock:
+ return 0;
+ }
+
+-/* Save and disable devices from the top of the tree down */
+-static void pci_bus_save_and_disable(struct pci_bus *bus)
++/*
++ * Save and disable devices from the top of the tree down while holding
++ * the @dev mutex lock for the entire tree.
++ */
++static void pci_bus_save_and_disable_locked(struct pci_bus *bus)
+ {
+ struct pci_dev *dev;
+
+ list_for_each_entry(dev, &bus->devices, bus_list) {
+- pci_dev_lock(dev);
+ pci_dev_save_and_disable(dev);
+- pci_dev_unlock(dev);
+ if (dev->subordinate)
+- pci_bus_save_and_disable(dev->subordinate);
++ pci_bus_save_and_disable_locked(dev->subordinate);
+ }
+ }
+
+ /*
+- * Restore devices from top of the tree down - parent bridges need to be
+- * restored before we can get to subordinate devices.
++ * Restore devices from top of the tree down while holding @dev mutex lock
++ * for the entire tree. Parent bridges need to be restored before we can
++ * get to subordinate devices.
+ */
+-static void pci_bus_restore(struct pci_bus *bus)
++static void pci_bus_restore_locked(struct pci_bus *bus)
+ {
+ struct pci_dev *dev;
+
+ list_for_each_entry(dev, &bus->devices, bus_list) {
+- pci_dev_lock(dev);
+ pci_dev_restore(dev);
+- pci_dev_unlock(dev);
+ if (dev->subordinate)
+- pci_bus_restore(dev->subordinate);
++ pci_bus_restore_locked(dev->subordinate);
+ }
+ }
+
+-/* Save and disable devices from the top of the tree down */
+-static void pci_slot_save_and_disable(struct pci_slot *slot)
++/*
++ * Save and disable devices from the top of the tree down while holding
++ * the @dev mutex lock for the entire tree.
++ */
++static void pci_slot_save_and_disable_locked(struct pci_slot *slot)
+ {
+ struct pci_dev *dev;
+
+@@ -5080,26 +5083,25 @@ static void pci_slot_save_and_disable(struct pci_slot *slot)
+ continue;
+ pci_dev_save_and_disable(dev);
+ if (dev->subordinate)
+- pci_bus_save_and_disable(dev->subordinate);
++ pci_bus_save_and_disable_locked(dev->subordinate);
+ }
+ }
+
+ /*
+- * Restore devices from top of the tree down - parent bridges need to be
+- * restored before we can get to subordinate devices.
++ * Restore devices from top of the tree down while holding @dev mutex lock
++ * for the entire tree. Parent bridges need to be restored before we can
++ * get to subordinate devices.
+ */
+-static void pci_slot_restore(struct pci_slot *slot)
++static void pci_slot_restore_locked(struct pci_slot *slot)
+ {
+ struct pci_dev *dev;
+
+ list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ if (!dev->slot || dev->slot != slot)
+ continue;
+- pci_dev_lock(dev);
+ pci_dev_restore(dev);
+- pci_dev_unlock(dev);
+ if (dev->subordinate)
+- pci_bus_restore(dev->subordinate);
++ pci_bus_restore_locked(dev->subordinate);
+ }
+ }
+
+@@ -5158,17 +5160,15 @@ static int __pci_reset_slot(struct pci_slot *slot)
+ if (rc)
+ return rc;
+
+- pci_slot_save_and_disable(slot);
+-
+ if (pci_slot_trylock(slot)) {
++ pci_slot_save_and_disable_locked(slot);
+ might_sleep();
+ rc = pci_reset_hotplug_slot(slot->hotplug, 0);
++ pci_slot_restore_locked(slot);
+ pci_slot_unlock(slot);
+ } else
+ rc = -EAGAIN;
+
+- pci_slot_restore(slot);
+-
+ return rc;
+ }
+
+@@ -5254,17 +5254,15 @@ static int __pci_reset_bus(struct pci_bus *bus)
+ if (rc)
+ return rc;
+
+- pci_bus_save_and_disable(bus);
+-
+ if (pci_bus_trylock(bus)) {
++ pci_bus_save_and_disable_locked(bus);
+ might_sleep();
+ rc = pci_bridge_secondary_bus_reset(bus->self);
++ pci_bus_restore_locked(bus);
+ pci_bus_unlock(bus);
+ } else
+ rc = -EAGAIN;
+
+- pci_bus_restore(bus);
+-
+ return rc;
+ }
+
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index 5aaa4ce04ec3..ceb7ab3ba3d0 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -134,10 +134,6 @@ static void mrpc_cmd_submit(struct switchtec_dev *stdev)
+ stuser->data, stuser->data_len);
+ iowrite32(stuser->cmd, &stdev->mmio_mrpc->cmd);
+
+- stuser->status = ioread32(&stdev->mmio_mrpc->status);
+- if (stuser->status != SWITCHTEC_MRPC_STATUS_INPROGRESS)
+- mrpc_complete_cmd(stdev);
+-
+ schedule_delayed_work(&stdev->mrpc_timeout,
+ msecs_to_jiffies(500));
+ }
+diff --git a/drivers/phy/broadcom/phy-brcm-usb.c b/drivers/phy/broadcom/phy-brcm-usb.c
+index d1dab36fa5b7..e2455ffb8597 100644
+--- a/drivers/phy/broadcom/phy-brcm-usb.c
++++ b/drivers/phy/broadcom/phy-brcm-usb.c
+@@ -378,6 +378,13 @@ static int brcm_usb_phy_probe(struct platform_device *pdev)
+ return 0;
+ }
+
++static int brcm_usb_phy_remove(struct platform_device *pdev)
++{
++ sysfs_remove_group(&pdev->dev.kobj, &brcm_usb_phy_group);
++
++ return 0;
++}
++
+ #ifdef CONFIG_PM_SLEEP
+ static int brcm_usb_phy_suspend(struct device *dev)
+ {
+@@ -443,6 +450,7 @@ MODULE_DEVICE_TABLE(of, brcm_usb_dt_ids);
+
+ static struct platform_driver brcm_usb_driver = {
+ .probe = brcm_usb_phy_probe,
++ .remove = brcm_usb_phy_remove,
+ .driver = {
+ .name = "brcmstb-usb-phy",
+ .owner = THIS_MODULE,
+diff --git a/drivers/phy/qualcomm/phy-qcom-qusb2.c b/drivers/phy/qualcomm/phy-qcom-qusb2.c
+index 69c92843eb3b..9b7ae93e9df1 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qusb2.c
++++ b/drivers/phy/qualcomm/phy-qcom-qusb2.c
+@@ -526,7 +526,7 @@ static int __maybe_unused qusb2_phy_runtime_resume(struct device *dev)
+ }
+
+ if (!qphy->has_se_clk_scheme) {
+- clk_prepare_enable(qphy->ref_clk);
++ ret = clk_prepare_enable(qphy->ref_clk);
+ if (ret) {
+ dev_err(dev, "failed to enable ref clk, %d\n", ret);
+ goto disable_ahb_clk;
+diff --git a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
+index b70058caee50..20b9864adce0 100644
+--- a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
++++ b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
+@@ -54,8 +54,12 @@
+ /* drive strength control for ASIU GPIO */
+ #define IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET 0x58
+
+-/* drive strength control for CCM/CRMU (AON) GPIO */
+-#define IPROC_GPIO_DRV0_CTRL_OFFSET 0x00
++/* pinconf for CCM GPIO */
++#define IPROC_GPIO_PULL_DN_OFFSET 0x10
++#define IPROC_GPIO_PULL_UP_OFFSET 0x14
++
++/* pinconf for CRMU(aon) GPIO and CCM GPIO*/
++#define IPROC_GPIO_DRV_CTRL_OFFSET 0x00
+
+ #define GPIO_BANK_SIZE 0x200
+ #define NGPIOS_PER_BANK 32
+@@ -76,6 +80,12 @@ enum iproc_pinconf_param {
+ IPROC_PINCON_MAX,
+ };
+
++enum iproc_pinconf_ctrl_type {
++ IOCTRL_TYPE_AON = 1,
++ IOCTRL_TYPE_CDRU,
++ IOCTRL_TYPE_INVALID,
++};
++
+ /*
+ * Iproc GPIO core
+ *
+@@ -100,6 +110,7 @@ struct iproc_gpio {
+
+ void __iomem *base;
+ void __iomem *io_ctrl;
++ enum iproc_pinconf_ctrl_type io_ctrl_type;
+
+ raw_spinlock_t lock;
+
+@@ -461,20 +472,44 @@ static const struct pinctrl_ops iproc_pctrl_ops = {
+ static int iproc_gpio_set_pull(struct iproc_gpio *chip, unsigned gpio,
+ bool disable, bool pull_up)
+ {
++ void __iomem *base;
+ unsigned long flags;
++ unsigned int shift;
++ u32 val_1, val_2;
+
+ raw_spin_lock_irqsave(&chip->lock, flags);
+-
+- if (disable) {
+- iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, false);
++ if (chip->io_ctrl_type == IOCTRL_TYPE_CDRU) {
++ base = chip->io_ctrl;
++ shift = IPROC_GPIO_SHIFT(gpio);
++
++ val_1 = readl(base + IPROC_GPIO_PULL_UP_OFFSET);
++ val_2 = readl(base + IPROC_GPIO_PULL_DN_OFFSET);
++ if (disable) {
++ /* no pull-up or pull-down */
++ val_1 &= ~BIT(shift);
++ val_2 &= ~BIT(shift);
++ } else if (pull_up) {
++ val_1 |= BIT(shift);
++ val_2 &= ~BIT(shift);
++ } else {
++ val_1 &= ~BIT(shift);
++ val_2 |= BIT(shift);
++ }
++ writel(val_1, base + IPROC_GPIO_PULL_UP_OFFSET);
++ writel(val_2, base + IPROC_GPIO_PULL_DN_OFFSET);
+ } else {
+- iproc_set_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio,
+- pull_up);
+- iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, true);
++ if (disable) {
++ iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio,
++ false);
++ } else {
++ iproc_set_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio,
++ pull_up);
++ iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio,
++ true);
++ }
+ }
+
+ raw_spin_unlock_irqrestore(&chip->lock, flags);
+-
+ dev_dbg(chip->dev, "gpio:%u set pullup:%d\n", gpio, pull_up);
+
+ return 0;
+@@ -483,14 +518,35 @@ static int iproc_gpio_set_pull(struct iproc_gpio *chip, unsigned gpio,
+ static void iproc_gpio_get_pull(struct iproc_gpio *chip, unsigned gpio,
+ bool *disable, bool *pull_up)
+ {
++ void __iomem *base;
+ unsigned long flags;
++ unsigned int shift;
++ u32 val_1, val_2;
+
+ raw_spin_lock_irqsave(&chip->lock, flags);
+- *disable = !iproc_get_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio);
+- *pull_up = iproc_get_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio);
++ if (chip->io_ctrl_type == IOCTRL_TYPE_CDRU) {
++ base = chip->io_ctrl;
++ shift = IPROC_GPIO_SHIFT(gpio);
++
++ val_1 = readl(base + IPROC_GPIO_PULL_UP_OFFSET) & BIT(shift);
++ val_2 = readl(base + IPROC_GPIO_PULL_DN_OFFSET) & BIT(shift);
++
++ *pull_up = val_1 ? true : false;
++ *disable = (val_1 | val_2) ? false : true;
++
++ } else {
++ *disable = !iproc_get_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio);
++ *pull_up = iproc_get_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio);
++ }
+ raw_spin_unlock_irqrestore(&chip->lock, flags);
+ }
+
++#define DRV_STRENGTH_OFFSET(gpio, bit, type) ((type) == IOCTRL_TYPE_AON ? \
++ ((2 - (bit)) * 4 + IPROC_GPIO_DRV_CTRL_OFFSET) : \
++ ((type) == IOCTRL_TYPE_CDRU) ? \
++ ((bit) * 4 + IPROC_GPIO_DRV_CTRL_OFFSET) : \
++ ((bit) * 4 + IPROC_GPIO_REG(gpio, IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET)))
++
+ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
+ unsigned strength)
+ {
+@@ -505,11 +561,8 @@ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
+
+ if (chip->io_ctrl) {
+ base = chip->io_ctrl;
+- offset = IPROC_GPIO_DRV0_CTRL_OFFSET;
+ } else {
+ base = chip->base;
+- offset = IPROC_GPIO_REG(gpio,
+- IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET);
+ }
+
+ shift = IPROC_GPIO_SHIFT(gpio);
+@@ -520,11 +573,11 @@ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
+ raw_spin_lock_irqsave(&chip->lock, flags);
+ strength = (strength / 2) - 1;
+ for (i = 0; i < GPIO_DRV_STRENGTH_BITS; i++) {
++ offset = DRV_STRENGTH_OFFSET(gpio, i, chip->io_ctrl_type);
+ val = readl(base + offset);
+ val &= ~BIT(shift);
+ val |= ((strength >> i) & 0x1) << shift;
+ writel(val, base + offset);
+- offset += 4;
+ }
+ raw_spin_unlock_irqrestore(&chip->lock, flags);
+
+@@ -541,11 +594,8 @@ static int iproc_gpio_get_strength(struct iproc_gpio *chip, unsigned gpio,
+
+ if (chip->io_ctrl) {
+ base = chip->io_ctrl;
+- offset = IPROC_GPIO_DRV0_CTRL_OFFSET;
+ } else {
+ base = chip->base;
+- offset = IPROC_GPIO_REG(gpio,
+- IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET);
+ }
+
+ shift = IPROC_GPIO_SHIFT(gpio);
+@@ -553,10 +603,10 @@ static int iproc_gpio_get_strength(struct iproc_gpio *chip, unsigned gpio,
+ raw_spin_lock_irqsave(&chip->lock, flags);
+ *strength = 0;
+ for (i = 0; i < GPIO_DRV_STRENGTH_BITS; i++) {
++ offset = DRV_STRENGTH_OFFSET(gpio, i, chip->io_ctrl_type);
+ val = readl(base + offset) & BIT(shift);
+ val >>= shift;
+ *strength += (val << i);
+- offset += 4;
+ }
+
+ /* convert to mA */
+@@ -734,6 +784,7 @@ static int iproc_gpio_probe(struct platform_device *pdev)
+ u32 ngpios, pinconf_disable_mask = 0;
+ int irq, ret;
+ bool no_pinconf = false;
++ enum iproc_pinconf_ctrl_type io_ctrl_type = IOCTRL_TYPE_INVALID;
+
+ /* NSP does not support drive strength config */
+ if (of_device_is_compatible(dev->of_node, "brcm,iproc-nsp-gpio"))
+@@ -764,8 +815,15 @@ static int iproc_gpio_probe(struct platform_device *pdev)
+ dev_err(dev, "unable to map I/O memory\n");
+ return PTR_ERR(chip->io_ctrl);
+ }
++ if (of_device_is_compatible(dev->of_node,
++ "brcm,cygnus-ccm-gpio"))
++ io_ctrl_type = IOCTRL_TYPE_CDRU;
++ else
++ io_ctrl_type = IOCTRL_TYPE_AON;
+ }
+
++ chip->io_ctrl_type = io_ctrl_type;
++
+ if (of_property_read_u32(dev->of_node, "ngpios", &ngpios)) {
+ dev_err(&pdev->dev, "missing ngpios DT property\n");
+ return -ENODEV;
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 158f618f1695..0c0a5018102b 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -239,13 +239,9 @@ static const unsigned int eth_link_led_pins[] = { GPIOZ_14 };
+ static const unsigned int eth_act_led_pins[] = { GPIOZ_15 };
+
+ static const unsigned int tsin_a_d0_pins[] = { GPIODV_0 };
+-static const unsigned int tsin_a_d0_x_pins[] = { GPIOX_10 };
+ static const unsigned int tsin_a_clk_pins[] = { GPIODV_8 };
+-static const unsigned int tsin_a_clk_x_pins[] = { GPIOX_11 };
+ static const unsigned int tsin_a_sop_pins[] = { GPIODV_9 };
+-static const unsigned int tsin_a_sop_x_pins[] = { GPIOX_8 };
+ static const unsigned int tsin_a_d_valid_pins[] = { GPIODV_10 };
+-static const unsigned int tsin_a_d_valid_x_pins[] = { GPIOX_9 };
+ static const unsigned int tsin_a_fail_pins[] = { GPIODV_11 };
+ static const unsigned int tsin_a_dp_pins[] = {
+ GPIODV_1, GPIODV_2, GPIODV_3, GPIODV_4, GPIODV_5, GPIODV_6, GPIODV_7,
+@@ -432,10 +428,6 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {
+ GROUP(spi_miso, 5, 2),
+ GROUP(spi_ss0, 5, 1),
+ GROUP(spi_sclk, 5, 0),
+- GROUP(tsin_a_sop_x, 6, 3),
+- GROUP(tsin_a_d_valid_x, 6, 2),
+- GROUP(tsin_a_d0_x, 6, 1),
+- GROUP(tsin_a_clk_x, 6, 0),
+
+ /* Bank Z */
+ GROUP(eth_mdio, 4, 23),
+@@ -698,8 +690,8 @@ static const char * const eth_led_groups[] = {
+ };
+
+ static const char * const tsin_a_groups[] = {
+- "tsin_a_clk", "tsin_a_clk_x", "tsin_a_sop", "tsin_a_sop_x",
+- "tsin_a_d_valid", "tsin_a_d_valid_x", "tsin_a_d0", "tsin_a_d0_x",
++ "tsin_a_clk", "tsin_a_sop",
++ "tsin_a_d_valid", "tsin_a_d0",
+ "tsin_a_dp", "tsin_a_fail",
+ };
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-emev2.c b/drivers/pinctrl/sh-pfc/pfc-emev2.c
+index 1cbbe04d7df6..eafd8edbcbe9 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-emev2.c
++++ b/drivers/pinctrl/sh-pfc/pfc-emev2.c
+@@ -1263,6 +1263,14 @@ static const char * const dtv_groups[] = {
+ "dtv_b",
+ };
+
++static const char * const err_rst_reqb_groups[] = {
++ "err_rst_reqb",
++};
++
++static const char * const ext_clki_groups[] = {
++ "ext_clki",
++};
++
+ static const char * const iic0_groups[] = {
+ "iic0",
+ };
+@@ -1285,6 +1293,10 @@ static const char * const lcd_groups[] = {
+ "yuv3",
+ };
+
++static const char * const lowpwr_groups[] = {
++ "lowpwr",
++};
++
+ static const char * const ntsc_groups[] = {
+ "ntsc_clk",
+ "ntsc_data",
+@@ -1298,6 +1310,10 @@ static const char * const pwm1_groups[] = {
+ "pwm1",
+ };
+
++static const char * const ref_clko_groups[] = {
++ "ref_clko",
++};
++
+ static const char * const sd_groups[] = {
+ "sd_cki",
+ };
+@@ -1391,13 +1407,17 @@ static const struct sh_pfc_function pinmux_functions[] = {
+ SH_PFC_FUNCTION(cam),
+ SH_PFC_FUNCTION(cf),
+ SH_PFC_FUNCTION(dtv),
++ SH_PFC_FUNCTION(err_rst_reqb),
++ SH_PFC_FUNCTION(ext_clki),
+ SH_PFC_FUNCTION(iic0),
+ SH_PFC_FUNCTION(iic1),
+ SH_PFC_FUNCTION(jtag),
+ SH_PFC_FUNCTION(lcd),
++ SH_PFC_FUNCTION(lowpwr),
+ SH_PFC_FUNCTION(ntsc),
+ SH_PFC_FUNCTION(pwm0),
+ SH_PFC_FUNCTION(pwm1),
++ SH_PFC_FUNCTION(ref_clko),
+ SH_PFC_FUNCTION(sd),
+ SH_PFC_FUNCTION(sdi0),
+ SH_PFC_FUNCTION(sdi1),
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+index 35f436bcb849..e9739dbcb356 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+@@ -1982,7 +1982,7 @@ static const unsigned int gether_gmii_pins[] = {
+ */
+ 185, 186, 187, 188, 189, 190, 191, 192, 174, 161, 204,
+ 171, 170, 169, 168, 167, 166, 173, 172, 176, 184, 183, 203,
+- 205, 163, 206, 207,
++ 205, 163, 206, 207, 158,
+ };
+ static const unsigned int gether_gmii_mux[] = {
+ ET_ERXD0_MARK, ET_ERXD1_MARK, ET_ERXD2_MARK, ET_ERXD3_MARK,
+@@ -2154,6 +2154,7 @@ static const unsigned int lcd0_data24_1_mux[] = {
+ LCD0_D0_MARK, LCD0_D1_MARK, LCD0_D2_MARK, LCD0_D3_MARK,
+ LCD0_D4_MARK, LCD0_D5_MARK, LCD0_D6_MARK, LCD0_D7_MARK,
+ LCD0_D8_MARK, LCD0_D9_MARK, LCD0_D10_MARK, LCD0_D11_MARK,
++ LCD0_D12_MARK, LCD0_D13_MARK, LCD0_D14_MARK, LCD0_D15_MARK,
+ LCD0_D16_MARK, LCD0_D17_MARK, LCD0_D18_PORT163_MARK,
+ LCD0_D19_PORT162_MARK, LCD0_D20_PORT161_MARK, LCD0_D21_PORT158_MARK,
+ LCD0_D22_PORT160_MARK, LCD0_D23_PORT159_MARK,
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index 5811784d88cb..9eb860c8f917 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -3220,8 +3220,7 @@ static const unsigned int qspi_data4_b_pins[] = {
+ RCAR_GP_PIN(6, 4),
+ };
+ static const unsigned int qspi_data4_b_mux[] = {
+- SPCLK_B_MARK, MOSI_IO0_B_MARK, MISO_IO1_B_MARK,
+- IO2_B_MARK, IO3_B_MARK, SSL_B_MARK,
++ MOSI_IO0_B_MARK, MISO_IO1_B_MARK, IO2_B_MARK, IO3_B_MARK,
+ };
+ /* - SCIF0 ------------------------------------------------------------------ */
+ static const unsigned int scif0_data_pins[] = {
+@@ -4375,17 +4374,14 @@ static const unsigned int vin1_b_data18_pins[] = {
+ };
+ static const unsigned int vin1_b_data18_mux[] = {
+ /* B */
+- VI1_DATA0_B_MARK, VI1_DATA1_B_MARK,
+ VI1_DATA2_B_MARK, VI1_DATA3_B_MARK,
+ VI1_DATA4_B_MARK, VI1_DATA5_B_MARK,
+ VI1_DATA6_B_MARK, VI1_DATA7_B_MARK,
+ /* G */
+- VI1_G0_B_MARK, VI1_G1_B_MARK,
+ VI1_G2_B_MARK, VI1_G3_B_MARK,
+ VI1_G4_B_MARK, VI1_G5_B_MARK,
+ VI1_G6_B_MARK, VI1_G7_B_MARK,
+ /* R */
+- VI1_R0_B_MARK, VI1_R1_B_MARK,
+ VI1_R2_B_MARK, VI1_R3_B_MARK,
+ VI1_R4_B_MARK, VI1_R5_B_MARK,
+ VI1_R6_B_MARK, VI1_R7_B_MARK,
+@@ -5243,7 +5239,7 @@ static const char * const scifb2_groups[] = {
+ "scifb2_data_b",
+ "scifb2_clk_b",
+ "scifb2_ctrl_b",
+- "scifb0_data_c",
++ "scifb2_data_c",
+ "scifb2_clk_c",
+ "scifb2_data_d",
+ };
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+index cc3597f66605..46c41ca6ea38 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+@@ -1916,6 +1916,7 @@ static const char * const vin1_groups[] = {
+ "vin1_data8",
+ "vin1_data24_b",
+ "vin1_data20_b",
++ "vin1_data18_b",
+ "vin1_data16_b",
+ "vin1_sync",
+ "vin1_field",
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+index 164002437594..24b9bb1ee1fe 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+@@ -5215,7 +5215,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ FN_AVB_MDC, FN_SSI_SDATA6_B, 0, 0, }
+ },
+ { PINMUX_CFG_REG_VAR("IPSR9", 0xE6060044, 32,
+- 1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3) {
++ 1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3) {
+ /* IP9_31 [1] */
+ 0, 0,
+ /* IP9_30_28 [3] */
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77970.c b/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
+index eeb58b3bbc9a..53fae9fd682b 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
+@@ -2354,7 +2354,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ #define F_(x, y) x,
+ #define FM(x) FN_##x,
+ { PINMUX_CFG_REG_VAR("MOD_SEL0", 0xe6060500, 32,
+- 4, 4, 4, 4,
++ 4, 4, 4, 4, 4,
+ 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1) {
+ /* RESERVED 31, 30, 29, 28 */
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77980.c b/drivers/pinctrl/sh-pfc/pfc-r8a77980.c
+index 3f6967331f64..81a710bb8555 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77980.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77980.c
+@@ -2751,7 +2751,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ #define F_(x, y) x,
+ #define FM(x) FN_##x,
+ { PINMUX_CFG_REG_VAR("MOD_SEL0", 0xe6060500, 32,
+- 4, 4, 4, 4,
++ 4, 4, 4, 4, 4,
+ 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1) {
+ /* RESERVED 31, 30, 29, 28 */
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
+index adade5b7ffbc..337c80bde8f9 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
+@@ -391,10 +391,10 @@ FM(IP12_31_28) IP12_31_28 \
+ #define MOD_SEL0_27 FM(SEL_MSIOF3_0) FM(SEL_MSIOF3_1)
+ #define MOD_SEL0_26 FM(SEL_HSCIF3_0) FM(SEL_HSCIF3_1)
+ #define MOD_SEL0_25 FM(SEL_SCIF4_0) FM(SEL_SCIF4_1)
+-#define MOD_SEL0_24_23 FM(SEL_PWM0_0) FM(SEL_PWM0_1) FM(SEL_PWM0_2) FM(SEL_PWM0_3)
+-#define MOD_SEL0_22_21 FM(SEL_PWM1_0) FM(SEL_PWM1_1) FM(SEL_PWM1_2) FM(SEL_PWM1_3)
+-#define MOD_SEL0_20_19 FM(SEL_PWM2_0) FM(SEL_PWM2_1) FM(SEL_PWM2_2) FM(SEL_PWM2_3)
+-#define MOD_SEL0_18_17 FM(SEL_PWM3_0) FM(SEL_PWM3_1) FM(SEL_PWM3_2) FM(SEL_PWM3_3)
++#define MOD_SEL0_24_23 FM(SEL_PWM0_0) FM(SEL_PWM0_1) FM(SEL_PWM0_2) F_(0, 0)
++#define MOD_SEL0_22_21 FM(SEL_PWM1_0) FM(SEL_PWM1_1) FM(SEL_PWM1_2) F_(0, 0)
++#define MOD_SEL0_20_19 FM(SEL_PWM2_0) FM(SEL_PWM2_1) FM(SEL_PWM2_2) F_(0, 0)
++#define MOD_SEL0_18_17 FM(SEL_PWM3_0) FM(SEL_PWM3_1) FM(SEL_PWM3_2) F_(0, 0)
+ #define MOD_SEL0_15 FM(SEL_IRQ_0_0) FM(SEL_IRQ_0_1)
+ #define MOD_SEL0_14 FM(SEL_IRQ_1_0) FM(SEL_IRQ_1_1)
+ #define MOD_SEL0_13 FM(SEL_IRQ_2_0) FM(SEL_IRQ_2_1)
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+index a50d22bef1f4..cfdb4fc177c3 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+@@ -2119,7 +2119,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ },
+
+ { PINMUX_CFG_REG("PCIOR0", 0xfffe3852, 16, 1) {
+- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ PC8_IN, PC8_OUT,
+ PC7_IN, PC7_OUT,
+ PC6_IN, PC6_OUT,
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+index d25e6f674d0a..6dca760f9f28 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+@@ -3086,6 +3086,7 @@ static const unsigned int tpu4_to2_mux[] = {
+ };
+ static const unsigned int tpu4_to3_pins[] = {
+ /* TO */
++ PIN_NUMBER(6, 26),
+ };
+ static const unsigned int tpu4_to3_mux[] = {
+ TPU4TO3_MARK,
+@@ -3366,7 +3367,8 @@ static const char * const fsic_groups[] = {
+ "fsic_sclk_out",
+ "fsic_data_in",
+ "fsic_data_out",
+- "fsic_spdif",
++ "fsic_spdif_0",
++ "fsic_spdif_1",
+ };
+
+ static const char * const fsid_groups[] = {
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 3eccc9b3ca84..c691e5e9d9de 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2231,13 +2231,13 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ FN_LCD_CL1_B, 0, 0,
+ /* IP10_5_3 [3] */
+ FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
+- FN_LCD_DON_B, 0, 0, 0,
++ FN_LCD_DON_B, 0, 0,
+ /* IP10_2_0 [3] */
+ FN_SSI_SCK23, FN_VI1_4_B, FN_RX1_D, FN_FCLE_B,
+ FN_LCD_DATA15_B, 0, 0, 0 }
+ },
+ { PINMUX_CFG_REG_VAR("IPSR11", 0xFFFC0048, 32,
+- 3, 1, 2, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
++ 3, 1, 2, 3, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
+ /* IP11_31_29 [3] */
+ 0, 0, 0, 0, 0, 0, 0, 0,
+ /* IP11_28 [1] */
+diff --git a/drivers/platform/mips/cpu_hwmon.c b/drivers/platform/mips/cpu_hwmon.c
+index f66521c7f846..98128374d710 100644
+--- a/drivers/platform/mips/cpu_hwmon.c
++++ b/drivers/platform/mips/cpu_hwmon.c
+@@ -159,7 +159,7 @@ static int __init loongson_hwmon_init(void)
+
+ cpu_hwmon_dev = hwmon_device_register(NULL);
+ if (IS_ERR(cpu_hwmon_dev)) {
+- ret = -ENOMEM;
++ ret = PTR_ERR(cpu_hwmon_dev);
+ pr_err("hwmon_device_register fail!\n");
+ goto fail_hwmon_device_register;
+ }
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index f10af5c383c5..83fd7677af24 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -522,23 +522,22 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
+
+ input.length = (acpi_size) sizeof(*in_args);
+ input.pointer = in_args;
+- if (out_data != NULL) {
++ if (out_data) {
+ output.length = ACPI_ALLOCATE_BUFFER;
+ output.pointer = NULL;
+ status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0,
+ command, &input, &output);
+- } else
++ if (ACPI_SUCCESS(status)) {
++ obj = (union acpi_object *)output.pointer;
++ if (obj && obj->type == ACPI_TYPE_INTEGER)
++ *out_data = (u32)obj->integer.value;
++ }
++ kfree(output.pointer);
++ } else {
+ status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0,
+ command, &input, NULL);
+-
+- if (ACPI_SUCCESS(status) && out_data != NULL) {
+- obj = (union acpi_object *)output.pointer;
+- if (obj && obj->type == ACPI_TYPE_INTEGER)
+- *out_data = (u32) obj->integer.value;
+ }
+- kfree(output.pointer);
+ return status;
+-
+ }
+
+ /*
+@@ -588,7 +587,7 @@ static ssize_t show_hdmi_source(struct device *dev,
+ return scnprintf(buf, PAGE_SIZE,
+ "input [gpu] unknown\n");
+ }
+- pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
++ pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
+ return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
+ }
+
+diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
+index 04791ea5d97b..35cdc3998eb5 100644
+--- a/drivers/platform/x86/wmi.c
++++ b/drivers/platform/x86/wmi.c
+@@ -768,6 +768,9 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
+ struct wmi_block *wblock = dev_to_wblock(dev);
+ const struct wmi_device_id *id = wmi_driver->id_table;
+
++ if (id == NULL)
++ return 0;
++
+ while (id->guid_string) {
+ uuid_le driver_guid;
+
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index e85361878450..e43a7b3b570c 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -902,14 +902,14 @@ __power_supply_register(struct device *parent,
+ }
+
+ spin_lock_init(&psy->changed_lock);
+- rc = device_init_wakeup(dev, ws);
+- if (rc)
+- goto wakeup_init_failed;
+-
+ rc = device_add(dev);
+ if (rc)
+ goto device_add_failed;
+
++ rc = device_init_wakeup(dev, ws);
++ if (rc)
++ goto wakeup_init_failed;
++
+ rc = psy_register_thermal(psy);
+ if (rc)
+ goto register_thermal_failed;
+@@ -946,8 +946,8 @@ register_cooler_failed:
+ psy_unregister_thermal(psy);
+ register_thermal_failed:
+ device_del(dev);
+-device_add_failed:
+ wakeup_init_failed:
++device_add_failed:
+ check_supplies_failed:
+ dev_set_name_failed:
+ put_device(dev);
+diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
+index 1e69c1c9ec09..7a4a6406cf69 100644
+--- a/drivers/pwm/pwm-lpss.c
++++ b/drivers/pwm/pwm-lpss.c
+@@ -216,6 +216,12 @@ EXPORT_SYMBOL_GPL(pwm_lpss_probe);
+
+ int pwm_lpss_remove(struct pwm_lpss_chip *lpwm)
+ {
++ int i;
++
++ for (i = 0; i < lpwm->info->npwm; i++) {
++ if (pwm_is_enabled(&lpwm->chip.pwms[i]))
++ pm_runtime_put(lpwm->chip.dev);
++ }
+ return pwmchip_remove(&lpwm->chip);
+ }
+ EXPORT_SYMBOL_GPL(pwm_lpss_remove);
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index f6e738ad7bd9..e247ab632530 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -188,7 +188,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ do_div(fin_ps, fin_freq);
+
+ /* Calc pre_div with the period */
+- for (pre_div = 0; pre_div < MISC_CLK_DIV_MASK; pre_div++) {
++ for (pre_div = 0; pre_div <= MISC_CLK_DIV_MASK; pre_div++) {
+ cnt = DIV_ROUND_CLOSEST_ULL((u64)period * 1000,
+ fin_ps * (pre_div + 1));
+ dev_dbg(meson->chip.dev, "fin_ps=%llu pre_div=%u cnt=%u\n",
+@@ -197,7 +197,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ break;
+ }
+
+- if (pre_div == MISC_CLK_DIV_MASK) {
++ if (pre_div > MISC_CLK_DIV_MASK) {
+ dev_err(meson->chip.dev, "unable to get period pre_div\n");
+ return -EINVAL;
+ }
+@@ -325,11 +325,6 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ if (state->period != channel->state.period ||
+ state->duty_cycle != channel->state.duty_cycle ||
+ state->polarity != channel->state.polarity) {
+- if (channel->state.enabled) {
+- meson_pwm_disable(meson, pwm->hwpwm);
+- channel->state.enabled = false;
+- }
+-
+ if (state->polarity != channel->state.polarity) {
+ if (state->polarity == PWM_POLARITY_NORMAL)
+ meson->inverter_mask |= BIT(pwm->hwpwm);
+diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
+index ef989a15aefc..b29fc258eeba 100644
+--- a/drivers/rapidio/rio_cm.c
++++ b/drivers/rapidio/rio_cm.c
+@@ -1215,7 +1215,9 @@ static int riocm_ch_listen(u16 ch_id)
+ riocm_debug(CHOP, "(ch_%d)", ch_id);
+
+ ch = riocm_get_channel(ch_id);
+- if (!ch || !riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
++ if (!ch)
++ return -EINVAL;
++ if (!riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
+ ret = -EINVAL;
+ riocm_put_channel(ch);
+ return ret;
+diff --git a/drivers/regulator/lp87565-regulator.c b/drivers/regulator/lp87565-regulator.c
+index c192357d1dea..7cd6862406b7 100644
+--- a/drivers/regulator/lp87565-regulator.c
++++ b/drivers/regulator/lp87565-regulator.c
+@@ -193,7 +193,7 @@ static int lp87565_regulator_probe(struct platform_device *pdev)
+ struct lp87565 *lp87565 = dev_get_drvdata(pdev->dev.parent);
+ struct regulator_config config = { };
+ struct regulator_dev *rdev;
+- int i, min_idx = LP87565_BUCK_1, max_idx = LP87565_BUCK_3;
++ int i, min_idx = LP87565_BUCK_0, max_idx = LP87565_BUCK_3;
+
+ platform_set_drvdata(pdev, lp87565);
+
+diff --git a/drivers/regulator/pv88060-regulator.c b/drivers/regulator/pv88060-regulator.c
+index a9446056435f..1f2d8180506b 100644
+--- a/drivers/regulator/pv88060-regulator.c
++++ b/drivers/regulator/pv88060-regulator.c
+@@ -135,7 +135,7 @@ static int pv88060_set_current_limit(struct regulator_dev *rdev, int min,
+ int i;
+
+ /* search for closest to maximum */
+- for (i = info->n_current_limits; i >= 0; i--) {
++ for (i = info->n_current_limits - 1; i >= 0; i--) {
+ if (min <= info->current_limits[i]
+ && max >= info->current_limits[i]) {
+ return regmap_update_bits(rdev->regmap,
+diff --git a/drivers/regulator/pv88080-regulator.c b/drivers/regulator/pv88080-regulator.c
+index 9a08cb2de501..6770e4de2097 100644
+--- a/drivers/regulator/pv88080-regulator.c
++++ b/drivers/regulator/pv88080-regulator.c
+@@ -279,7 +279,7 @@ static int pv88080_set_current_limit(struct regulator_dev *rdev, int min,
+ int i;
+
+ /* search for closest to maximum */
+- for (i = info->n_current_limits; i >= 0; i--) {
++ for (i = info->n_current_limits - 1; i >= 0; i--) {
+ if (min <= info->current_limits[i]
+ && max >= info->current_limits[i]) {
+ return regmap_update_bits(rdev->regmap,
+diff --git a/drivers/regulator/pv88090-regulator.c b/drivers/regulator/pv88090-regulator.c
+index 7a0c15957bd0..2302b0df7630 100644
+--- a/drivers/regulator/pv88090-regulator.c
++++ b/drivers/regulator/pv88090-regulator.c
+@@ -157,7 +157,7 @@ static int pv88090_set_current_limit(struct regulator_dev *rdev, int min,
+ int i;
+
+ /* search for closest to maximum */
+- for (i = info->n_current_limits; i >= 0; i--) {
++ for (i = info->n_current_limits - 1; i >= 0; i--) {
+ if (min <= info->current_limits[i]
+ && max >= info->current_limits[i]) {
+ return regmap_update_bits(rdev->regmap,
+diff --git a/drivers/regulator/tps65086-regulator.c b/drivers/regulator/tps65086-regulator.c
+index 45e96e154690..5a5e9b5bf4be 100644
+--- a/drivers/regulator/tps65086-regulator.c
++++ b/drivers/regulator/tps65086-regulator.c
+@@ -90,8 +90,8 @@ static const struct regulator_linear_range tps65086_buck345_25mv_ranges[] = {
+ static const struct regulator_linear_range tps65086_ldoa1_ranges[] = {
+ REGULATOR_LINEAR_RANGE(1350000, 0x0, 0x0, 0),
+ REGULATOR_LINEAR_RANGE(1500000, 0x1, 0x7, 100000),
+- REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xA, 100000),
+- REGULATOR_LINEAR_RANGE(2700000, 0xB, 0xD, 150000),
++ REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xB, 100000),
++ REGULATOR_LINEAR_RANGE(2850000, 0xC, 0xD, 150000),
+ REGULATOR_LINEAR_RANGE(3300000, 0xE, 0xE, 0),
+ };
+
+diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
+index 5a5bc4bb08d2..df591435d12a 100644
+--- a/drivers/regulator/wm831x-dcdc.c
++++ b/drivers/regulator/wm831x-dcdc.c
+@@ -327,8 +327,8 @@ static int wm831x_buckv_get_voltage_sel(struct regulator_dev *rdev)
+ }
+
+ /* Current limit options */
+-static u16 wm831x_dcdc_ilim[] = {
+- 125, 250, 375, 500, 625, 750, 875, 1000
++static const unsigned int wm831x_dcdc_ilim[] = {
++ 125000, 250000, 375000, 500000, 625000, 750000, 875000, 1000000
+ };
+
+ static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev,
+diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c
+index 6a84b6372897..cc475dcbf27f 100644
+--- a/drivers/remoteproc/qcom_q6v5_pil.c
++++ b/drivers/remoteproc/qcom_q6v5_pil.c
+@@ -1268,16 +1268,26 @@ static const struct rproc_hexagon_res sdm845_mss = {
+
+ static const struct rproc_hexagon_res msm8996_mss = {
+ .hexagon_mba_image = "mba.mbn",
++ .proxy_supply = (struct qcom_mss_reg_res[]) {
++ {
++ .supply = "pll",
++ .uA = 100000,
++ },
++ {}
++ },
+ .proxy_clk_names = (char*[]){
+ "xo",
+ "pnoc",
++ "qdss",
+ NULL
+ },
+ .active_clk_names = (char*[]){
+ "iface",
+ "bus",
+ "mem",
+- "gpll0_mss_clk",
++ "gpll0_mss",
++ "snoc_axi",
++ "mnoc_axi",
+ NULL
+ },
+ .need_mem_protection = true,
+diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c
+index cab293cb2bf0..1fc48ebd3cd0 100644
+--- a/drivers/rtc/rtc-88pm80x.c
++++ b/drivers/rtc/rtc-88pm80x.c
+@@ -114,12 +114,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ unsigned char buf[4];
+ unsigned long ticks, base, data;
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -137,7 +139,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ base = ticks - data;
+ dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -158,11 +161,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ int ret;
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -185,12 +190,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0);
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
+index fbcf13bbbd8d..73697e4b18a9 100644
+--- a/drivers/rtc/rtc-88pm860x.c
++++ b/drivers/rtc/rtc-88pm860x.c
+@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ base = ticks - data;
+ dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
+index 71396b62dc52..ebd59e86a567 100644
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -749,8 +749,8 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
+ if (ret < 0)
+ return ret;
+
+- ctl[0] &= ~RX8130_REG_EXTENSION_WADA;
+- ctl[1] |= RX8130_REG_FLAG_AF;
++ ctl[0] &= RX8130_REG_EXTENSION_WADA;
++ ctl[1] &= ~RX8130_REG_FLAG_AF;
+ ctl[2] &= ~RX8130_REG_CONTROL0_AIE;
+
+ ret = regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl,
+@@ -773,8 +773,7 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
+
+ ctl[2] |= RX8130_REG_CONTROL0_AIE;
+
+- return regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl,
+- sizeof(ctl));
++ return regmap_write(ds1307->regmap, RX8130_REG_CONTROL0, ctl[2]);
+ }
+
+ static int rx8130_alarm_irq_enable(struct device *dev, unsigned int enabled)
+diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
+index 9caaccccaa57..b1ebca099b0d 100644
+--- a/drivers/rtc/rtc-ds1672.c
++++ b/drivers/rtc/rtc-ds1672.c
+@@ -58,7 +58,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
+ "%s: raw read data - counters=%02x,%02x,%02x,%02x\n",
+ __func__, buf[0], buf[1], buf[2], buf[3]);
+
+- time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+
+ rtc_time_to_tm(time, tm);
+
+diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c
+index 2f1772a358ca..18a6f15e313d 100644
+--- a/drivers/rtc/rtc-mc146818-lib.c
++++ b/drivers/rtc/rtc-mc146818-lib.c
+@@ -82,7 +82,7 @@ unsigned int mc146818_get_time(struct rtc_time *time)
+ time->tm_year += real_year - 72;
+ #endif
+
+- if (century)
++ if (century > 20)
+ time->tm_year += (century - 19) * 100;
+
+ /*
+diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c
+index f85f1fc29e32..964ed91416e1 100644
+--- a/drivers/rtc/rtc-mt6397.c
++++ b/drivers/rtc/rtc-mt6397.c
+@@ -362,7 +362,7 @@ static int mtk_rtc_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to request alarm IRQ: %d: %d\n",
+ rtc->irq, ret);
+- goto out_dispose_irq;
++ return ret;
+ }
+
+ device_init_wakeup(&pdev->dev, 1);
+@@ -378,9 +378,7 @@ static int mtk_rtc_probe(struct platform_device *pdev)
+ return 0;
+
+ out_free_irq:
+- free_irq(rtc->irq, rtc->rtc_dev);
+-out_dispose_irq:
+- irq_dispose_mapping(rtc->irq);
++ free_irq(rtc->irq, rtc);
+ return ret;
+ }
+
+@@ -388,8 +386,7 @@ static int mtk_rtc_remove(struct platform_device *pdev)
+ {
+ struct mt6397_rtc *rtc = platform_get_drvdata(pdev);
+
+- free_irq(rtc->irq, rtc->rtc_dev);
+- irq_dispose_mapping(rtc->irq);
++ free_irq(rtc->irq, rtc);
+
+ return 0;
+ }
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 7cb786d76e3c..8c62406f92dd 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -57,20 +57,14 @@ static int pcf2127_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ struct pcf2127 *pcf2127 = dev_get_drvdata(dev);
+ unsigned char buf[10];
+ int ret;
+- int i;
+
+- for (i = 0; i <= PCF2127_REG_CTRL3; i++) {
+- ret = regmap_read(pcf2127->regmap, PCF2127_REG_CTRL1 + i,
+- (unsigned int *)(buf + i));
+- if (ret) {
+- dev_err(dev, "%s: read error\n", __func__);
+- return ret;
+- }
+- }
+-
+- ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_SC,
+- (buf + PCF2127_REG_SC),
+- ARRAY_SIZE(buf) - PCF2127_REG_SC);
++ /*
++ * Avoid reading CTRL2 register as it causes WD_VAL register
++ * value to reset to 0 which means watchdog is stopped.
++ */
++ ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_CTRL3,
++ (buf + PCF2127_REG_CTRL3),
++ ARRAY_SIZE(buf) - PCF2127_REG_CTRL3);
+ if (ret) {
+ dev_err(dev, "%s: read error\n", __func__);
+ return ret;
+@@ -91,14 +85,12 @@ static int pcf2127_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ }
+
+ dev_dbg(dev,
+- "%s: raw data is cr1=%02x, cr2=%02x, cr3=%02x, "
+- "sec=%02x, min=%02x, hr=%02x, "
++ "%s: raw data is cr3=%02x, sec=%02x, min=%02x, hr=%02x, "
+ "mday=%02x, wday=%02x, mon=%02x, year=%02x\n",
+- __func__,
+- buf[0], buf[1], buf[2],
+- buf[3], buf[4], buf[5],
+- buf[6], buf[7], buf[8], buf[9]);
+-
++ __func__, buf[PCF2127_REG_CTRL3], buf[PCF2127_REG_SC],
++ buf[PCF2127_REG_MN], buf[PCF2127_REG_HR],
++ buf[PCF2127_REG_DM], buf[PCF2127_REG_DW],
++ buf[PCF2127_REG_MO], buf[PCF2127_REG_YR]);
+
+ tm->tm_sec = bcd2bin(buf[PCF2127_REG_SC] & 0x7F);
+ tm->tm_min = bcd2bin(buf[PCF2127_REG_MN] & 0x7F);
+diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
+index 3efc86c25d27..d8adf69b6697 100644
+--- a/drivers/rtc/rtc-pcf8563.c
++++ b/drivers/rtc/rtc-pcf8563.c
+@@ -563,7 +563,6 @@ static int pcf8563_probe(struct i2c_client *client,
+ struct pcf8563 *pcf8563;
+ int err;
+ unsigned char buf;
+- unsigned char alm_pending;
+
+ dev_dbg(&client->dev, "%s\n", __func__);
+
+@@ -587,13 +586,13 @@ static int pcf8563_probe(struct i2c_client *client,
+ return err;
+ }
+
+- err = pcf8563_get_alarm_mode(client, NULL, &alm_pending);
+- if (err) {
+- dev_err(&client->dev, "%s: read error\n", __func__);
++ /* Clear flags and disable interrupts */
++ buf = 0;
++ err = pcf8563_write_block_data(client, PCF8563_REG_ST2, 1, &buf);
++ if (err < 0) {
++ dev_err(&client->dev, "%s: write error\n", __func__);
+ return err;
+ }
+- if (alm_pending)
+- pcf8563_set_alarm_mode(client, 0);
+
+ pcf8563->rtc = devm_rtc_device_register(&client->dev,
+ pcf8563_driver.driver.name,
+@@ -605,7 +604,7 @@ static int pcf8563_probe(struct i2c_client *client,
+ if (client->irq > 0) {
+ err = devm_request_threaded_irq(&client->dev, client->irq,
+ NULL, pcf8563_irq,
+- IRQF_SHARED|IRQF_ONESHOT|IRQF_TRIGGER_FALLING,
++ IRQF_SHARED | IRQF_ONESHOT | IRQF_TRIGGER_LOW,
+ pcf8563_driver.driver.name, client);
+ if (err) {
+ dev_err(&client->dev, "unable to request IRQ %d\n",
+diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
+index 29358a045925..e03104b734fc 100644
+--- a/drivers/rtc/rtc-pm8xxx.c
++++ b/drivers/rtc/rtc-pm8xxx.c
+@@ -213,7 +213,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ }
+ }
+
+- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++ secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++ ((unsigned long)value[3] << 24);
+
+ rtc_time_to_tm(secs, tm);
+
+@@ -288,7 +289,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
+ return rc;
+ }
+
+- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++ secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++ ((unsigned long)value[3] << 24);
+
+ rtc_time_to_tm(secs, &alarm->time);
+
+diff --git a/drivers/rtc/rtc-rv3029c2.c b/drivers/rtc/rtc-rv3029c2.c
+index 3d6174eb32f6..cfe3aece51d1 100644
+--- a/drivers/rtc/rtc-rv3029c2.c
++++ b/drivers/rtc/rtc-rv3029c2.c
+@@ -282,13 +282,13 @@ static int rv3029_eeprom_read(struct device *dev, u8 reg,
+ static int rv3029_eeprom_write(struct device *dev, u8 reg,
+ u8 const buf[], size_t len)
+ {
+- int ret;
++ int ret, err;
+ size_t i;
+ u8 tmp;
+
+- ret = rv3029_eeprom_enter(dev);
+- if (ret < 0)
+- return ret;
++ err = rv3029_eeprom_enter(dev);
++ if (err < 0)
++ return err;
+
+ for (i = 0; i < len; i++, reg++) {
+ ret = rv3029_read_regs(dev, reg, &tmp, 1);
+@@ -304,11 +304,11 @@ static int rv3029_eeprom_write(struct device *dev, u8 reg,
+ break;
+ }
+
+- ret = rv3029_eeprom_exit(dev);
+- if (ret < 0)
+- return ret;
++ err = rv3029_eeprom_exit(dev);
++ if (err < 0)
++ return err;
+
+- return 0;
++ return ret;
+ }
+
+ static int rv3029_eeprom_update_bits(struct device *dev,
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index c238b190b3c9..aa90004f49e2 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -2330,10 +2330,10 @@ static bool qeth_l2_vnicc_recover_char(struct qeth_card *card, u32 vnicc,
+ static void qeth_l2_vnicc_init(struct qeth_card *card)
+ {
+ u32 *timeout = &card->options.vnicc.learning_timeout;
++ bool enable, error = false;
+ unsigned int chars_len, i;
+ unsigned long chars_tmp;
+ u32 sup_cmds, vnicc;
+- bool enable, error;
+
+ QETH_CARD_TEXT(card, 2, "vniccini");
+ /* reset rx_bcast */
+@@ -2354,17 +2354,24 @@ static void qeth_l2_vnicc_init(struct qeth_card *card)
+ chars_len = sizeof(card->options.vnicc.sup_chars) * BITS_PER_BYTE;
+ for_each_set_bit(i, &chars_tmp, chars_len) {
+ vnicc = BIT(i);
+- qeth_l2_vnicc_query_cmds(card, vnicc, &sup_cmds);
+- if (!(sup_cmds & IPA_VNICC_SET_TIMEOUT) ||
+- !(sup_cmds & IPA_VNICC_GET_TIMEOUT))
++ if (qeth_l2_vnicc_query_cmds(card, vnicc, &sup_cmds)) {
++ sup_cmds = 0;
++ error = true;
++ }
++ if ((sup_cmds & IPA_VNICC_SET_TIMEOUT) &&
++ (sup_cmds & IPA_VNICC_GET_TIMEOUT))
++ card->options.vnicc.getset_timeout_sup |= vnicc;
++ else
+ card->options.vnicc.getset_timeout_sup &= ~vnicc;
+- if (!(sup_cmds & IPA_VNICC_ENABLE) ||
+- !(sup_cmds & IPA_VNICC_DISABLE))
++ if ((sup_cmds & IPA_VNICC_ENABLE) &&
++ (sup_cmds & IPA_VNICC_DISABLE))
++ card->options.vnicc.set_char_sup |= vnicc;
++ else
+ card->options.vnicc.set_char_sup &= ~vnicc;
+ }
+ /* enforce assumed default values and recover settings, if changed */
+- error = qeth_l2_vnicc_recover_timeout(card, QETH_VNICC_LEARNING,
+- timeout);
++ error |= qeth_l2_vnicc_recover_timeout(card, QETH_VNICC_LEARNING,
++ timeout);
+ chars_tmp = card->options.vnicc.wanted_chars ^ QETH_VNICC_DEFAULT;
+ chars_len = sizeof(card->options.vnicc.wanted_chars) * BITS_PER_BYTE;
+ for_each_set_bit(i, &chars_tmp, chars_len) {
+diff --git a/drivers/scsi/fnic/fnic_isr.c b/drivers/scsi/fnic/fnic_isr.c
+index 4e3a50202e8c..d28088218c36 100644
+--- a/drivers/scsi/fnic/fnic_isr.c
++++ b/drivers/scsi/fnic/fnic_isr.c
+@@ -254,7 +254,7 @@ int fnic_set_intr_mode(struct fnic *fnic)
+ int vecs = n + m + o + 1;
+
+ if (pci_alloc_irq_vectors(fnic->pdev, vecs, vecs,
+- PCI_IRQ_MSIX) < 0) {
++ PCI_IRQ_MSIX) == vecs) {
+ fnic->rq_count = n;
+ fnic->raw_wq_count = m;
+ fnic->wq_copy_count = o;
+@@ -280,7 +280,7 @@ int fnic_set_intr_mode(struct fnic *fnic)
+ fnic->wq_copy_count >= 1 &&
+ fnic->cq_count >= 3 &&
+ fnic->intr_count >= 1 &&
+- pci_alloc_irq_vectors(fnic->pdev, 1, 1, PCI_IRQ_MSI) < 0) {
++ pci_alloc_irq_vectors(fnic->pdev, 1, 1, PCI_IRQ_MSI) == 1) {
+ fnic->rq_count = 1;
+ fnic->raw_wq_count = 1;
+ fnic->wq_copy_count = 1;
+diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
+index 42bcf7f3a0f9..6ba257cbc6d9 100644
+--- a/drivers/scsi/libfc/fc_exch.c
++++ b/drivers/scsi/libfc/fc_exch.c
+@@ -2603,7 +2603,7 @@ void fc_exch_recv(struct fc_lport *lport, struct fc_frame *fp)
+
+ /* lport lock ? */
+ if (!lport || lport->state == LPORT_ST_DISABLED) {
+- FC_LPORT_DBG(lport, "Receiving frames for an lport that "
++ FC_LIBFC_DBG("Receiving frames for an lport that "
+ "has not been initialized correctly\n");
+ fc_frame_free(fp);
+ return;
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 2f31d266339f..99469f9057ee 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3894,12 +3894,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
+ /*
+ * The cur_state should not last for more than max_wait secs
+ */
+- for (i = 0; i < max_wait; i++) {
++ for (i = 0; i < max_wait * 50; i++) {
+ curr_abs_state = instance->instancet->
+ read_fw_status_reg(instance->reg_set);
+
+ if (abs_state == curr_abs_state) {
+- msleep(1000);
++ msleep(20);
+ } else
+ break;
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index bb20a4a228cf..fff20a370767 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -6967,8 +6967,7 @@ qla2x00_module_init(void)
+ /* Initialize target kmem_cache and mem_pools */
+ ret = qlt_init();
+ if (ret < 0) {
+- kmem_cache_destroy(srb_cachep);
+- return ret;
++ goto destroy_cache;
+ } else if (ret > 0) {
+ /*
+ * If initiator mode is explictly disabled by qlt_init(),
+@@ -6989,11 +6988,10 @@ qla2x00_module_init(void)
+ qla2xxx_transport_template =
+ fc_attach_transport(&qla2xxx_transport_functions);
+ if (!qla2xxx_transport_template) {
+- kmem_cache_destroy(srb_cachep);
+ ql_log(ql_log_fatal, NULL, 0x0002,
+ "fc_attach_transport failed...Failing load!.\n");
+- qlt_exit();
+- return -ENODEV;
++ ret = -ENODEV;
++ goto qlt_exit;
+ }
+
+ apidev_major = register_chrdev(0, QLA2XXX_APIDEV, &apidev_fops);
+@@ -7005,27 +7003,37 @@ qla2x00_module_init(void)
+ qla2xxx_transport_vport_template =
+ fc_attach_transport(&qla2xxx_transport_vport_functions);
+ if (!qla2xxx_transport_vport_template) {
+- kmem_cache_destroy(srb_cachep);
+- qlt_exit();
+- fc_release_transport(qla2xxx_transport_template);
+ ql_log(ql_log_fatal, NULL, 0x0004,
+ "fc_attach_transport vport failed...Failing load!.\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto unreg_chrdev;
+ }
+ ql_log(ql_log_info, NULL, 0x0005,
+ "QLogic Fibre Channel HBA Driver: %s.\n",
+ qla2x00_version_str);
+ ret = pci_register_driver(&qla2xxx_pci_driver);
+ if (ret) {
+- kmem_cache_destroy(srb_cachep);
+- qlt_exit();
+- fc_release_transport(qla2xxx_transport_template);
+- fc_release_transport(qla2xxx_transport_vport_template);
+ ql_log(ql_log_fatal, NULL, 0x0006,
+ "pci_register_driver failed...ret=%d Failing load!.\n",
+ ret);
++ goto release_vport_transport;
+ }
+ return ret;
++
++release_vport_transport:
++ fc_release_transport(qla2xxx_transport_vport_template);
++
++unreg_chrdev:
++ if (apidev_major >= 0)
++ unregister_chrdev(apidev_major, QLA2XXX_APIDEV);
++ fc_release_transport(qla2xxx_transport_template);
++
++qlt_exit:
++ qlt_exit();
++
++destroy_cache:
++ kmem_cache_destroy(srb_cachep);
++ return ret;
+ }
+
+ /**
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index e9545411ec5a..95206e227730 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -2233,14 +2233,14 @@ void qlt_send_resp_ctio(struct qla_qpair *qpair, struct qla_tgt_cmd *cmd,
+ ctio->u.status1.scsi_status |=
+ cpu_to_le16(SS_RESIDUAL_UNDER);
+
+- /* Response code and sense key */
+- put_unaligned_le32(((0x70 << 24) | (sense_key << 8)),
+- (&ctio->u.status1.sense_data)[0]);
++ /* Fixed format sense data. */
++ ctio->u.status1.sense_data[0] = 0x70;
++ ctio->u.status1.sense_data[2] = sense_key;
+ /* Additional sense length */
+- put_unaligned_le32(0x0a, (&ctio->u.status1.sense_data)[1]);
++ ctio->u.status1.sense_data[7] = 0xa;
+ /* ASC and ASCQ */
+- put_unaligned_le32(((asc << 24) | (ascq << 16)),
+- (&ctio->u.status1.sense_data)[3]);
++ ctio->u.status1.sense_data[12] = asc;
++ ctio->u.status1.sense_data[13] = ascq;
+
+ /* Memory Barrier */
+ wmb();
+@@ -2290,7 +2290,7 @@ void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
+ mcmd->orig_iocb.imm_ntfy.u.isp24.status_subcode ==
+ ELS_TPRLO) {
+ ql_dbg(ql_dbg_disc, vha, 0x2106,
+- "TM response logo %phC status %#x state %#x",
++ "TM response logo %8phC status %#x state %#x",
+ mcmd->sess->port_name, mcmd->fc_tm_rsp,
+ mcmd->flags);
+ qlt_schedule_sess_for_deletion(mcmd->sess);
+@@ -5334,11 +5334,7 @@ qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
+ se_sess = sess->se_sess;
+
+ tag = sbitmap_queue_get(&se_sess->sess_tag_pool, &cpu);
+- if (tag < 0)
+- return;
+-
+- cmd = &((struct qla_tgt_cmd *)se_sess->sess_cmd_map)[tag];
+- if (!cmd) {
++ if (tag < 0) {
+ ql_dbg(ql_dbg_io, vha, 0x3009,
+ "qla_target(%d): %s: Allocation of cmd failed\n",
+ vha->vp_idx, __func__);
+@@ -5353,6 +5349,7 @@ qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
+ return;
+ }
+
++ cmd = &((struct qla_tgt_cmd *)se_sess->sess_cmd_map)[tag];
+ memset(cmd, 0, sizeof(struct qla_tgt_cmd));
+
+ qlt_incr_num_pend_cmds(vha);
+diff --git a/drivers/soc/amlogic/meson-gx-pwrc-vpu.c b/drivers/soc/amlogic/meson-gx-pwrc-vpu.c
+index 6289965c42e9..05421d029dff 100644
+--- a/drivers/soc/amlogic/meson-gx-pwrc-vpu.c
++++ b/drivers/soc/amlogic/meson-gx-pwrc-vpu.c
+@@ -54,12 +54,12 @@ static int meson_gx_pwrc_vpu_power_off(struct generic_pm_domain *genpd)
+ /* Power Down Memories */
+ for (i = 0; i < 32; i += 2) {
+ regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG0,
+- 0x2 << i, 0x3 << i);
++ 0x3 << i, 0x3 << i);
+ udelay(5);
+ }
+ for (i = 0; i < 32; i += 2) {
+ regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG1,
+- 0x2 << i, 0x3 << i);
++ 0x3 << i, 0x3 << i);
+ udelay(5);
+ }
+ for (i = 8; i < 16; i++) {
+@@ -108,13 +108,13 @@ static int meson_gx_pwrc_vpu_power_on(struct generic_pm_domain *genpd)
+ /* Power Up Memories */
+ for (i = 0; i < 32; i += 2) {
+ regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG0,
+- 0x2 << i, 0);
++ 0x3 << i, 0);
+ udelay(5);
+ }
+
+ for (i = 0; i < 32; i += 2) {
+ regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG1,
+- 0x2 << i, 0);
++ 0x3 << i, 0);
+ udelay(5);
+ }
+
+diff --git a/drivers/soc/amlogic/meson-gx-socinfo.c b/drivers/soc/amlogic/meson-gx-socinfo.c
+index 37ea0a1c24c8..1ae339f5eadb 100644
+--- a/drivers/soc/amlogic/meson-gx-socinfo.c
++++ b/drivers/soc/amlogic/meson-gx-socinfo.c
+@@ -43,20 +43,21 @@ static const struct meson_gx_package_id {
+ const char *name;
+ unsigned int major_id;
+ unsigned int pack_id;
++ unsigned int pack_mask;
+ } soc_packages[] = {
+- { "S905", 0x1f, 0 },
+- { "S905H", 0x1f, 0x13 },
+- { "S905M", 0x1f, 0x20 },
+- { "S905D", 0x21, 0 },
+- { "S905X", 0x21, 0x80 },
+- { "S905W", 0x21, 0xa0 },
+- { "S905L", 0x21, 0xc0 },
+- { "S905M2", 0x21, 0xe0 },
+- { "S912", 0x22, 0 },
+- { "962X", 0x24, 0x10 },
+- { "962E", 0x24, 0x20 },
+- { "A113X", 0x25, 0x37 },
+- { "A113D", 0x25, 0x22 },
++ { "S905", 0x1f, 0, 0x20 }, /* pack_id != 0x20 */
++ { "S905H", 0x1f, 0x3, 0xf }, /* pack_id & 0xf == 0x3 */
++ { "S905M", 0x1f, 0x20, 0xf0 }, /* pack_id == 0x20 */
++ { "S905D", 0x21, 0, 0xf0 },
++ { "S905X", 0x21, 0x80, 0xf0 },
++ { "S905W", 0x21, 0xa0, 0xf0 },
++ { "S905L", 0x21, 0xc0, 0xf0 },
++ { "S905M2", 0x21, 0xe0, 0xf0 },
++ { "S912", 0x22, 0, 0x0 }, /* Only S912 is known for GXM */
++ { "962X", 0x24, 0x10, 0xf0 },
++ { "962E", 0x24, 0x20, 0xf0 },
++ { "A113X", 0x25, 0x37, 0xff },
++ { "A113D", 0x25, 0x22, 0xff },
+ };
+
+ static inline unsigned int socinfo_to_major(u32 socinfo)
+@@ -81,13 +82,14 @@ static inline unsigned int socinfo_to_misc(u32 socinfo)
+
+ static const char *socinfo_to_package_id(u32 socinfo)
+ {
+- unsigned int pack = socinfo_to_pack(socinfo) & 0xf0;
++ unsigned int pack = socinfo_to_pack(socinfo);
+ unsigned int major = socinfo_to_major(socinfo);
+ int i;
+
+ for (i = 0 ; i < ARRAY_SIZE(soc_packages) ; ++i) {
+ if (soc_packages[i].major_id == major &&
+- soc_packages[i].pack_id == pack)
++ soc_packages[i].pack_id ==
++ (pack & soc_packages[i].pack_mask))
+ return soc_packages[i].name;
+ }
+
+diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c
+index 819bed0f5667..51b3a47b5a55 100644
+--- a/drivers/soc/fsl/qe/gpio.c
++++ b/drivers/soc/fsl/qe/gpio.c
+@@ -179,8 +179,10 @@ struct qe_pin *qe_pin_request(struct device_node *np, int index)
+ if (err < 0)
+ goto err0;
+ gc = gpio_to_chip(err);
+- if (WARN_ON(!gc))
++ if (WARN_ON(!gc)) {
++ err = -ENODEV;
+ goto err0;
++ }
+
+ if (!of_device_is_compatible(gc->of_node, "fsl,mpc8323-qe-pario-bank")) {
+ pr_debug("%s: tried to get a non-qe pin\n", __func__);
+diff --git a/drivers/soc/qcom/cmd-db.c b/drivers/soc/qcom/cmd-db.c
+index a6f646295f06..78d73ec587e1 100644
+--- a/drivers/soc/qcom/cmd-db.c
++++ b/drivers/soc/qcom/cmd-db.c
+@@ -283,8 +283,8 @@ static int cmd_db_dev_probe(struct platform_device *pdev)
+ }
+
+ cmd_db_header = memremap(rmem->base, rmem->size, MEMREMAP_WB);
+- if (IS_ERR_OR_NULL(cmd_db_header)) {
+- ret = PTR_ERR(cmd_db_header);
++ if (!cmd_db_header) {
++ ret = -ENOMEM;
+ cmd_db_header = NULL;
+ return ret;
+ }
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 584bcb018a62..285a6f463013 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -354,7 +354,7 @@ static int bcm_qspi_bspi_set_flex_mode(struct bcm_qspi *qspi,
+ {
+ int bpc = 0, bpp = 0;
+ u8 command = op->cmd.opcode;
+- int width = op->cmd.buswidth ? op->cmd.buswidth : SPI_NBITS_SINGLE;
++ int width = op->data.buswidth ? op->data.buswidth : SPI_NBITS_SINGLE;
+ int addrlen = op->addr.nbytes;
+ int flex_mode = 1;
+
+@@ -992,7 +992,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem,
+ if (mspi_read)
+ return bcm_qspi_mspi_exec_mem_op(spi, op);
+
+- ret = bcm_qspi_bspi_set_mode(qspi, op, -1);
++ ret = bcm_qspi_bspi_set_mode(qspi, op, 0);
+
+ if (!ret)
+ ret = bcm_qspi_bspi_exec_mem_op(spi, op);
+diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
+index 12c1fa5b06c5..c63ed402cf86 100644
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -416,7 +416,18 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, master);
+ master->mode_bits = (SPI_CPOL | SPI_CS_HIGH | SPI_NO_CS);
+ master->bits_per_word_mask = SPI_BPW_MASK(8);
+- master->num_chipselect = -1;
++ /* even though the driver never officially supported native CS
++ * allow a single native CS for legacy DT support purposes when
++ * no cs-gpio is configured.
++ * Known limitations for native cs are:
++ * * multiple chip-selects: cs0-cs2 are all simultaniously asserted
++ * whenever there is a transfer - this even includes SPI_NO_CS
++ * * SPI_CS_HIGH: is ignores - cs are always asserted low
++ * * cs_change: cs is deasserted after each spi_transfer
++ * * cs_delay_usec: cs is always deasserted one SCK cycle after
++ * a spi_transfer
++ */
++ master->num_chipselect = 1;
+ master->transfer_one = bcm2835aux_spi_transfer_one;
+ master->handle_err = bcm2835aux_spi_handle_err;
+ master->prepare_message = bcm2835aux_spi_prepare_message;
+diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
+index 7c88f74f7f47..94cc0a152449 100644
+--- a/drivers/spi/spi-cadence.c
++++ b/drivers/spi/spi-cadence.c
+@@ -584,11 +584,6 @@ static int cdns_spi_probe(struct platform_device *pdev)
+ goto clk_dis_apb;
+ }
+
+- pm_runtime_use_autosuspend(&pdev->dev);
+- pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
+- pm_runtime_set_active(&pdev->dev);
+- pm_runtime_enable(&pdev->dev);
+-
+ ret = of_property_read_u32(pdev->dev.of_node, "num-cs", &num_cs);
+ if (ret < 0)
+ master->num_chipselect = CDNS_SPI_DEFAULT_NUM_CS;
+@@ -603,8 +598,10 @@ static int cdns_spi_probe(struct platform_device *pdev)
+ /* SPI controller initializations */
+ cdns_spi_init_hw(xspi);
+
+- pm_runtime_mark_last_busy(&pdev->dev);
+- pm_runtime_put_autosuspend(&pdev->dev);
++ pm_runtime_set_active(&pdev->dev);
++ pm_runtime_enable(&pdev->dev);
++ pm_runtime_use_autosuspend(&pdev->dev);
++ pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq <= 0) {
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 8b79e36fab21..cd784552de7f 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -407,7 +407,6 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ }
+
+ m->status = status;
+- spi_finalize_current_message(master);
+
+ if (status || !cs_change) {
+ ndelay(nsecs);
+@@ -415,6 +414,7 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ }
+
+ fsl_spi_setup_transfer(spi, NULL);
++ spi_finalize_current_message(master);
+ return 0;
+ }
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index a1888dc6a938..09cfae3abce2 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -307,10 +307,16 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
+ x |= (u32)(*tx_buf++) << (i * 8);
+ tegra_spi_writel(tspi, x, SPI_TX_FIFO);
+ }
++
++ tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
+ } else {
++ unsigned int write_bytes;
+ max_n_32bit = min(tspi->curr_dma_words, tx_empty_count);
+ written_words = max_n_32bit;
+ nbytes = written_words * tspi->bytes_per_word;
++ if (nbytes > t->len - tspi->cur_pos)
++ nbytes = t->len - tspi->cur_pos;
++ write_bytes = nbytes;
+ for (count = 0; count < max_n_32bit; count++) {
+ u32 x = 0;
+
+@@ -319,8 +325,10 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
+ x |= (u32)(*tx_buf++) << (i * 8);
+ tegra_spi_writel(tspi, x, SPI_TX_FIFO);
+ }
++
++ tspi->cur_tx_pos += write_bytes;
+ }
+- tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
++
+ return written_words;
+ }
+
+@@ -344,20 +352,27 @@ static unsigned int tegra_spi_read_rx_fifo_to_client_rxbuf(
+ for (i = 0; len && (i < 4); i++, len--)
+ *rx_buf++ = (x >> i*8) & 0xFF;
+ }
+- tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ read_words += tspi->curr_dma_words;
++ tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ } else {
+ u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
++ u8 bytes_per_word = tspi->bytes_per_word;
++ unsigned int read_bytes;
+
++ len = rx_full_count * bytes_per_word;
++ if (len > t->len - tspi->cur_pos)
++ len = t->len - tspi->cur_pos;
++ read_bytes = len;
+ for (count = 0; count < rx_full_count; count++) {
+ u32 x = tegra_spi_readl(tspi, SPI_RX_FIFO) & rx_mask;
+
+- for (i = 0; (i < tspi->bytes_per_word); i++)
++ for (i = 0; len && (i < bytes_per_word); i++, len--)
+ *rx_buf++ = (x >> (i*8)) & 0xFF;
+ }
+- tspi->cur_rx_pos += rx_full_count * tspi->bytes_per_word;
+ read_words += rx_full_count;
++ tspi->cur_rx_pos += read_bytes;
+ }
++
+ return read_words;
+ }
+
+@@ -372,12 +387,17 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
+ unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
+
+ memcpy(tspi->tx_dma_buf, t->tx_buf + tspi->cur_pos, len);
++ tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ } else {
+ unsigned int i;
+ unsigned int count;
+ u8 *tx_buf = (u8 *)t->tx_buf + tspi->cur_tx_pos;
+ unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
++ unsigned int write_bytes;
+
++ if (consume > t->len - tspi->cur_pos)
++ consume = t->len - tspi->cur_pos;
++ write_bytes = consume;
+ for (count = 0; count < tspi->curr_dma_words; count++) {
+ u32 x = 0;
+
+@@ -386,8 +406,9 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
+ x |= (u32)(*tx_buf++) << (i * 8);
+ tspi->tx_dma_buf[count] = x;
+ }
++
++ tspi->cur_tx_pos += write_bytes;
+ }
+- tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+
+ /* Make the dma buffer to read by dma */
+ dma_sync_single_for_device(tspi->dev, tspi->tx_dma_phys,
+@@ -405,20 +426,28 @@ static void tegra_spi_copy_spi_rxbuf_to_client_rxbuf(
+ unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
+
+ memcpy(t->rx_buf + tspi->cur_rx_pos, tspi->rx_dma_buf, len);
++ tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ } else {
+ unsigned int i;
+ unsigned int count;
+ unsigned char *rx_buf = t->rx_buf + tspi->cur_rx_pos;
+ u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
++ unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
++ unsigned int read_bytes;
+
++ if (consume > t->len - tspi->cur_pos)
++ consume = t->len - tspi->cur_pos;
++ read_bytes = consume;
+ for (count = 0; count < tspi->curr_dma_words; count++) {
+ u32 x = tspi->rx_dma_buf[count] & rx_mask;
+
+- for (i = 0; (i < tspi->bytes_per_word); i++)
++ for (i = 0; consume && (i < tspi->bytes_per_word);
++ i++, consume--)
+ *rx_buf++ = (x >> (i*8)) & 0xFF;
+ }
++
++ tspi->cur_rx_pos += read_bytes;
+ }
+- tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+
+ /* Make the dma buffer to read by dma */
+ dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
+@@ -470,22 +499,39 @@ static int tegra_spi_start_rx_dma(struct tegra_spi_data *tspi, int len)
+ return 0;
+ }
+
+-static int tegra_spi_start_dma_based_transfer(
+- struct tegra_spi_data *tspi, struct spi_transfer *t)
++static int tegra_spi_flush_fifos(struct tegra_spi_data *tspi)
+ {
+- u32 val;
+- unsigned int len;
+- int ret = 0;
++ unsigned long timeout = jiffies + HZ;
+ u32 status;
+
+- /* Make sure that Rx and Tx fifo are empty */
+ status = tegra_spi_readl(tspi, SPI_FIFO_STATUS);
+ if ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) {
+- dev_err(tspi->dev, "Rx/Tx fifo are not empty status 0x%08x\n",
+- (unsigned)status);
+- return -EIO;
++ status |= SPI_RX_FIFO_FLUSH | SPI_TX_FIFO_FLUSH;
++ tegra_spi_writel(tspi, status, SPI_FIFO_STATUS);
++ while ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) {
++ status = tegra_spi_readl(tspi, SPI_FIFO_STATUS);
++ if (time_after(jiffies, timeout)) {
++ dev_err(tspi->dev,
++ "timeout waiting for fifo flush\n");
++ return -EIO;
++ }
++
++ udelay(1);
++ }
+ }
+
++ return 0;
++}
++
++static int tegra_spi_start_dma_based_transfer(
++ struct tegra_spi_data *tspi, struct spi_transfer *t)
++{
++ u32 val;
++ unsigned int len;
++ int ret = 0;
++ u8 dma_burst;
++ struct dma_slave_config dma_sconfig = {0};
++
+ val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1);
+ tegra_spi_writel(tspi, val, SPI_DMA_BLK);
+
+@@ -496,12 +542,16 @@ static int tegra_spi_start_dma_based_transfer(
+ len = tspi->curr_dma_words * 4;
+
+ /* Set attention level based on length of transfer */
+- if (len & 0xF)
++ if (len & 0xF) {
+ val |= SPI_TX_TRIG_1 | SPI_RX_TRIG_1;
+- else if (((len) >> 4) & 0x1)
++ dma_burst = 1;
++ } else if (((len) >> 4) & 0x1) {
+ val |= SPI_TX_TRIG_4 | SPI_RX_TRIG_4;
+- else
++ dma_burst = 4;
++ } else {
+ val |= SPI_TX_TRIG_8 | SPI_RX_TRIG_8;
++ dma_burst = 8;
++ }
+
+ if (tspi->cur_direction & DATA_DIR_TX)
+ val |= SPI_IE_TX;
+@@ -512,7 +562,18 @@ static int tegra_spi_start_dma_based_transfer(
+ tegra_spi_writel(tspi, val, SPI_DMA_CTL);
+ tspi->dma_control_reg = val;
+
++ dma_sconfig.device_fc = true;
+ if (tspi->cur_direction & DATA_DIR_TX) {
++ dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO;
++ dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++ dma_sconfig.dst_maxburst = dma_burst;
++ ret = dmaengine_slave_config(tspi->tx_dma_chan, &dma_sconfig);
++ if (ret < 0) {
++ dev_err(tspi->dev,
++ "DMA slave config failed: %d\n", ret);
++ return ret;
++ }
++
+ tegra_spi_copy_client_txbuf_to_spi_txbuf(tspi, t);
+ ret = tegra_spi_start_tx_dma(tspi, len);
+ if (ret < 0) {
+@@ -523,6 +584,16 @@ static int tegra_spi_start_dma_based_transfer(
+ }
+
+ if (tspi->cur_direction & DATA_DIR_RX) {
++ dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO;
++ dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++ dma_sconfig.src_maxburst = dma_burst;
++ ret = dmaengine_slave_config(tspi->rx_dma_chan, &dma_sconfig);
++ if (ret < 0) {
++ dev_err(tspi->dev,
++ "DMA slave config failed: %d\n", ret);
++ return ret;
++ }
++
+ /* Make the dma buffer to read by dma */
+ dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
+ tspi->dma_buf_size, DMA_FROM_DEVICE);
+@@ -582,7 +653,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
+ u32 *dma_buf;
+ dma_addr_t dma_phys;
+ int ret;
+- struct dma_slave_config dma_sconfig;
+
+ dma_chan = dma_request_slave_channel_reason(tspi->dev,
+ dma_to_memory ? "rx" : "tx");
+@@ -602,19 +672,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
+ return -ENOMEM;
+ }
+
+- if (dma_to_memory) {
+- dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO;
+- dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+- dma_sconfig.src_maxburst = 0;
+- } else {
+- dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO;
+- dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+- dma_sconfig.dst_maxburst = 0;
+- }
+-
+- ret = dmaengine_slave_config(dma_chan, &dma_sconfig);
+- if (ret)
+- goto scrub;
+ if (dma_to_memory) {
+ tspi->rx_dma_chan = dma_chan;
+ tspi->rx_dma_buf = dma_buf;
+@@ -625,11 +682,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
+ tspi->tx_dma_phys = dma_phys;
+ }
+ return 0;
+-
+-scrub:
+- dma_free_coherent(tspi->dev, tspi->dma_buf_size, dma_buf, dma_phys);
+- dma_release_channel(dma_chan);
+- return ret;
+ }
+
+ static void tegra_spi_deinit_dma_param(struct tegra_spi_data *tspi,
+@@ -730,6 +782,8 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
+
+ if (tspi->is_packed)
+ command1 |= SPI_PACKED;
++ else
++ command1 &= ~SPI_PACKED;
+
+ command1 &= ~(SPI_CS_SEL_MASK | SPI_TX_EN | SPI_RX_EN);
+ tspi->cur_direction = 0;
+@@ -748,6 +802,9 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
+ dev_dbg(tspi->dev, "The def 0x%x and written 0x%x\n",
+ tspi->def_command1_reg, (unsigned)command1);
+
++ ret = tegra_spi_flush_fifos(tspi);
++ if (ret < 0)
++ return ret;
+ if (total_fifo_words > SPI_FIFO_DEPTH)
+ ret = tegra_spi_start_dma_based_transfer(tspi, t);
+ else
+@@ -838,7 +895,17 @@ static int tegra_spi_transfer_one_message(struct spi_master *master,
+ if (WARN_ON(ret == 0)) {
+ dev_err(tspi->dev,
+ "spi transfer timeout, err %d\n", ret);
++ if (tspi->is_curr_dma_xfer &&
++ (tspi->cur_direction & DATA_DIR_TX))
++ dmaengine_terminate_all(tspi->tx_dma_chan);
++ if (tspi->is_curr_dma_xfer &&
++ (tspi->cur_direction & DATA_DIR_RX))
++ dmaengine_terminate_all(tspi->rx_dma_chan);
+ ret = -EIO;
++ tegra_spi_flush_fifos(tspi);
++ reset_control_assert(tspi->rst);
++ udelay(2);
++ reset_control_deassert(tspi->rst);
+ goto complete_xfer;
+ }
+
+@@ -889,6 +956,7 @@ static irqreturn_t handle_cpu_based_xfer(struct tegra_spi_data *tspi)
+ tspi->status_reg);
+ dev_err(tspi->dev, "CpuXfer 0x%08x:0x%08x\n",
+ tspi->command1_reg, tspi->dma_control_reg);
++ tegra_spi_flush_fifos(tspi);
+ reset_control_assert(tspi->rst);
+ udelay(2);
+ reset_control_deassert(tspi->rst);
+@@ -961,6 +1029,7 @@ static irqreturn_t handle_dma_based_xfer(struct tegra_spi_data *tspi)
+ tspi->status_reg);
+ dev_err(tspi->dev, "DmaXfer 0x%08x:0x%08x\n",
+ tspi->command1_reg, tspi->dma_control_reg);
++ tegra_spi_flush_fifos(tspi);
+ reset_control_assert(tspi->rst);
+ udelay(2);
+ reset_control_deassert(tspi->rst);
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index 4389ab80c23e..fa730a871d25 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -1008,6 +1008,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+
+ /* RX */
+ dma->sg_rx_p = kcalloc(num, sizeof(*dma->sg_rx_p), GFP_ATOMIC);
++ if (!dma->sg_rx_p)
++ return;
++
+ sg_init_table(dma->sg_rx_p, num); /* Initialize SG table */
+ /* offset, length setting */
+ sg = dma->sg_rx_p;
+@@ -1068,6 +1071,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+ }
+
+ dma->sg_tx_p = kcalloc(num, sizeof(*dma->sg_tx_p), GFP_ATOMIC);
++ if (!dma->sg_tx_p)
++ return;
++
+ sg_init_table(dma->sg_tx_p, num); /* Initialize SG table */
+ /* offset, length setting */
+ sg = dma->sg_tx_p;
+diff --git a/drivers/staging/android/vsoc.c b/drivers/staging/android/vsoc.c
+index 22571abcaa4e..034d86869772 100644
+--- a/drivers/staging/android/vsoc.c
++++ b/drivers/staging/android/vsoc.c
+@@ -260,7 +260,8 @@ do_create_fd_scoped_permission(struct vsoc_device_region *region_p,
+ atomic_t *owner_ptr = NULL;
+ struct vsoc_device_region *managed_region_p;
+
+- if (copy_from_user(&np->permission, &arg->perm, sizeof(*np)) ||
++ if (copy_from_user(&np->permission,
++ &arg->perm, sizeof(np->permission)) ||
+ copy_from_user(&managed_fd,
+ &arg->managed_region_fd, sizeof(managed_fd))) {
+ return -EFAULT;
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index d799b1b55de3..747518c29542 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -4984,7 +4984,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
+ case NI_RTSI_OUTPUT_G_SRC0:
+ case NI_RTSI_OUTPUT_G_GATE0:
+ case NI_RTSI_OUTPUT_RGOUT0:
+- case NI_RTSI_OUTPUT_RTSI_BRD_0:
++ case NI_RTSI_OUTPUT_RTSI_BRD(0):
++ case NI_RTSI_OUTPUT_RTSI_BRD(1):
++ case NI_RTSI_OUTPUT_RTSI_BRD(2):
++ case NI_RTSI_OUTPUT_RTSI_BRD(3):
+ return 1;
+ case NI_RTSI_OUTPUT_RTSI_OSC:
+ return (devpriv->is_m_series) ? 1 : 0;
+@@ -5005,11 +5008,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
+ devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
+ NISTC_RTSI_TRIGA_OUT_REG);
+- } else if (chan < 8) {
++ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
+ devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
+ NISTC_RTSI_TRIGB_OUT_REG);
++ } else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++ /* probably should never reach this, since the
++ * ni_valid_rtsi_output_source above errors out if chan is too
++ * high
++ */
++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++ return -EINVAL;
+ }
+ return 2;
+ }
+@@ -5025,12 +5035,12 @@ static unsigned int ni_get_rtsi_routing(struct comedi_device *dev,
+ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ return NISTC_RTSI_TRIG_TO_SRC(chan,
+ devpriv->rtsi_trig_b_output_reg);
+- } else {
+- if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
+- return NI_RTSI_OUTPUT_RTSI_OSC;
+- dev_err(dev->class_dev, "bug! should never get here?\n");
+- return 0;
++ } else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++ return NI_RTSI_OUTPUT_RTSI_OSC;
+ }
++
++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++ return -EINVAL;
+ }
+
+ static int ni_rtsi_insn_config(struct comedi_device *dev,
+diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
+index 010ae1e9c7fb..40680eaf3974 100644
+--- a/drivers/staging/greybus/light.c
++++ b/drivers/staging/greybus/light.c
+@@ -1098,21 +1098,21 @@ static void gb_lights_channel_release(struct gb_channel *channel)
+ static void gb_lights_light_release(struct gb_light *light)
+ {
+ int i;
+- int count;
+
+ light->ready = false;
+
+- count = light->channels_count;
+-
+ if (light->has_flash)
+ gb_lights_light_v4l2_unregister(light);
++ light->has_flash = false;
+
+- for (i = 0; i < count; i++) {
++ for (i = 0; i < light->channels_count; i++)
+ gb_lights_channel_release(&light->channels[i]);
+- light->channels_count--;
+- }
++ light->channels_count = 0;
++
+ kfree(light->channels);
++ light->channels = NULL;
+ kfree(light->name);
++ light->name = NULL;
+ }
+
+ static void gb_lights_release(struct gb_lights *glights)
+diff --git a/drivers/staging/most/cdev/cdev.c b/drivers/staging/most/cdev/cdev.c
+index 0b48677fa958..27d58b55b810 100644
+--- a/drivers/staging/most/cdev/cdev.c
++++ b/drivers/staging/most/cdev/cdev.c
+@@ -453,7 +453,9 @@ static int comp_probe(struct most_interface *iface, int channel_id,
+ c->devno = MKDEV(comp.major, current_minor);
+ cdev_init(&c->cdev, &channel_fops);
+ c->cdev.owner = THIS_MODULE;
+- cdev_add(&c->cdev, c->devno, 1);
++ retval = cdev_add(&c->cdev, c->devno, 1);
++ if (retval < 0)
++ goto err_free_c;
+ c->iface = iface;
+ c->cfg = cfg;
+ c->channel_id = channel_id;
+@@ -485,6 +487,7 @@ error_create_device:
+ list_del(&c->list);
+ error_alloc_kfifo:
+ cdev_del(&c->cdev);
++err_free_c:
+ kfree(c);
+ error_alloc_channel:
+ ida_simple_remove(&comp.minor_id, current_minor);
+diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+index 53f55f129a76..ddbeff8224ab 100644
+--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
++++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+@@ -2466,8 +2466,11 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf,
+ segment_size = (u8)PSD_DATA_GET_SEGMENT_SIZE(c2h_buf);
+ psd_set->data_size = total_size;
+
+- if (!psd_set->data)
++ if (!psd_set->data) {
+ psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL);
++ if (!psd_set->data)
++ return HALMAC_RET_MALLOC_FAIL;
++ }
+
+ if (segment_id == 0)
+ psd_set->segment_size = segment_size;
+diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+index 455082867246..edf25922b12d 100644
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -47,6 +47,7 @@ MODULE_DESCRIPTION("Broadcom 2835 MMAL video capture");
+ MODULE_AUTHOR("Vincent Sanders");
+ MODULE_LICENSE("GPL");
+ MODULE_VERSION(BM2835_MMAL_VERSION);
++MODULE_ALIAS("platform:bcm2835-camera");
+
+ int bcm2835_v4l2_debug;
+ module_param_named(debug, bcm2835_v4l2_debug, int, 0644);
+@@ -1854,6 +1855,12 @@ static int bcm2835_mmal_probe(struct platform_device *pdev)
+ num_cameras = get_num_cameras(instance,
+ resolutions,
+ MAX_BCM2835_CAMERAS);
++
++ if (num_cameras < 1) {
++ ret = -ENODEV;
++ goto cleanup_mmal;
++ }
++
+ if (num_cameras > MAX_BCM2835_CAMERAS)
+ num_cameras = MAX_BCM2835_CAMERAS;
+
+@@ -1953,6 +1960,9 @@ cleanup_gdev:
+ pr_info("%s: error %d while loading driver\n",
+ BM2835_MMAL_MODULE_NAME, ret);
+
++cleanup_mmal:
++ vchiq_mmal_finalise(instance);
++
+ return ret;
+ }
+
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index e9ff2a7c0c0e..22e97a93728d 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -85,7 +85,7 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
+ goto out_unlock;
+ }
+
+- se_cmd->se_lun = rcu_dereference(deve->se_lun);
++ se_cmd->se_lun = se_lun;
+ se_cmd->pr_res_key = deve->pr_res_key;
+ se_cmd->orig_fe_lun = unpacked_lun;
+ se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
+@@ -176,7 +176,7 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
+ goto out_unlock;
+ }
+
+- se_cmd->se_lun = rcu_dereference(deve->se_lun);
++ se_cmd->se_lun = se_lun;
+ se_cmd->pr_res_key = deve->pr_res_key;
+ se_cmd->orig_fe_lun = unpacked_lun;
+ se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
+diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
+index dfd23245f778..9df6b7260466 100644
+--- a/drivers/thermal/cpu_cooling.c
++++ b/drivers/thermal/cpu_cooling.c
+@@ -458,7 +458,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
+ load = 0;
+
+ total_load += load;
+- if (trace_thermal_power_cpu_limit_enabled() && load_cpu)
++ if (load_cpu)
+ load_cpu[i] = load;
+
+ i++;
+diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
+index 0691f260f6ea..f64643629d8b 100644
+--- a/drivers/thermal/mtk_thermal.c
++++ b/drivers/thermal/mtk_thermal.c
+@@ -431,7 +431,8 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank)
+ u32 raw;
+
+ for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) {
+- raw = readl(mt->thermal_base + conf->msr[i]);
++ raw = readl(mt->thermal_base +
++ conf->msr[conf->bank_data[bank->id].sensors[i]]);
+
+ temp = raw_to_mcelsius(mt,
+ conf->bank_data[bank->id].sensors[i],
+@@ -568,7 +569,8 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num,
+
+ for (i = 0; i < conf->bank_data[num].num_sensors; i++)
+ writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]],
+- mt->thermal_base + conf->adcpnp[i]);
++ mt->thermal_base +
++ conf->adcpnp[conf->bank_data[num].sensors[i]]);
+
+ writel((1 << conf->bank_data[num].num_sensors) - 1,
+ mt->thermal_base + TEMP_MONCTL0);
+diff --git a/drivers/thermal/rcar_gen3_thermal.c b/drivers/thermal/rcar_gen3_thermal.c
+index 704c8ad045bb..8f553453dd7f 100644
+--- a/drivers/thermal/rcar_gen3_thermal.c
++++ b/drivers/thermal/rcar_gen3_thermal.c
+@@ -14,7 +14,6 @@
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+-#include <linux/spinlock.h>
+ #include <linux/sys_soc.h>
+ #include <linux/thermal.h>
+
+@@ -81,7 +80,6 @@ struct rcar_gen3_thermal_tsc {
+ struct rcar_gen3_thermal_priv {
+ struct rcar_gen3_thermal_tsc *tscs[TSC_MAX_NUM];
+ unsigned int num_tscs;
+- spinlock_t lock; /* Protect interrupts on and off */
+ void (*thermal_init)(struct rcar_gen3_thermal_tsc *tsc);
+ };
+
+@@ -231,38 +229,16 @@ static irqreturn_t rcar_gen3_thermal_irq(int irq, void *data)
+ {
+ struct rcar_gen3_thermal_priv *priv = data;
+ u32 status;
+- int i, ret = IRQ_HANDLED;
++ int i;
+
+- spin_lock(&priv->lock);
+ for (i = 0; i < priv->num_tscs; i++) {
+ status = rcar_gen3_thermal_read(priv->tscs[i], REG_GEN3_IRQSTR);
+ rcar_gen3_thermal_write(priv->tscs[i], REG_GEN3_IRQSTR, 0);
+ if (status)
+- ret = IRQ_WAKE_THREAD;
++ thermal_zone_device_update(priv->tscs[i]->zone,
++ THERMAL_EVENT_UNSPECIFIED);
+ }
+
+- if (ret == IRQ_WAKE_THREAD)
+- rcar_thermal_irq_set(priv, false);
+-
+- spin_unlock(&priv->lock);
+-
+- return ret;
+-}
+-
+-static irqreturn_t rcar_gen3_thermal_irq_thread(int irq, void *data)
+-{
+- struct rcar_gen3_thermal_priv *priv = data;
+- unsigned long flags;
+- int i;
+-
+- for (i = 0; i < priv->num_tscs; i++)
+- thermal_zone_device_update(priv->tscs[i]->zone,
+- THERMAL_EVENT_UNSPECIFIED);
+-
+- spin_lock_irqsave(&priv->lock, flags);
+- rcar_thermal_irq_set(priv, true);
+- spin_unlock_irqrestore(&priv->lock, flags);
+-
+ return IRQ_HANDLED;
+ }
+
+@@ -364,8 +340,6 @@ static int rcar_gen3_thermal_probe(struct platform_device *pdev)
+ if (soc_device_match(r8a7795es1))
+ priv->thermal_init = rcar_gen3_thermal_init_r8a7795es1;
+
+- spin_lock_init(&priv->lock);
+-
+ platform_set_drvdata(pdev, priv);
+
+ /*
+@@ -383,9 +357,9 @@ static int rcar_gen3_thermal_probe(struct platform_device *pdev)
+ if (!irqname)
+ return -ENOMEM;
+
+- ret = devm_request_threaded_irq(dev, irq, rcar_gen3_thermal_irq,
+- rcar_gen3_thermal_irq_thread,
+- IRQF_SHARED, irqname, priv);
++ ret = devm_request_threaded_irq(dev, irq, NULL,
++ rcar_gen3_thermal_irq,
++ IRQF_ONESHOT, irqname, priv);
+ if (ret)
+ return ret;
+ }
+diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
+index b0baa4ce10f9..6bbf35682d53 100644
+--- a/drivers/tty/ipwireless/hardware.c
++++ b/drivers/tty/ipwireless/hardware.c
+@@ -1516,6 +1516,8 @@ static void ipw_send_setup_packet(struct ipw_hardware *hw)
+ sizeof(struct ipw_setup_get_version_query_packet),
+ ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP,
+ TL_SETUP_SIGNO_GET_VERSION_QRY);
++ if (!ver_packet)
++ return;
+ ver_packet->header.length = sizeof(struct tl_setup_get_version_qry);
+
+ /*
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index ee8a5cb61a5f..2daccb10ae2f 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -528,26 +528,26 @@ static int lpuart32_poll_init(struct uart_port *port)
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+ /* Disable Rx & Tx */
+- writel(0, sport->port.membase + UARTCTRL);
++ lpuart32_write(&sport->port, UARTCTRL, 0);
+
+- temp = readl(sport->port.membase + UARTFIFO);
++ temp = lpuart32_read(&sport->port, UARTFIFO);
+
+ /* Enable Rx and Tx FIFO */
+- writel(temp | UARTFIFO_RXFE | UARTFIFO_TXFE,
+- sport->port.membase + UARTFIFO);
++ lpuart32_write(&sport->port, UARTFIFO,
++ temp | UARTFIFO_RXFE | UARTFIFO_TXFE);
+
+ /* flush Tx and Rx FIFO */
+- writel(UARTFIFO_TXFLUSH | UARTFIFO_RXFLUSH,
+- sport->port.membase + UARTFIFO);
++ lpuart32_write(&sport->port, UARTFIFO,
++ UARTFIFO_TXFLUSH | UARTFIFO_RXFLUSH);
+
+ /* explicitly clear RDRF */
+- if (readl(sport->port.membase + UARTSTAT) & UARTSTAT_RDRF) {
+- readl(sport->port.membase + UARTDATA);
+- writel(UARTFIFO_RXUF, sport->port.membase + UARTFIFO);
++ if (lpuart32_read(&sport->port, UARTSTAT) & UARTSTAT_RDRF) {
++ lpuart32_read(&sport->port, UARTDATA);
++ lpuart32_write(&sport->port, UARTFIFO, UARTFIFO_RXUF);
+ }
+
+ /* Enable Rx and Tx */
+- writel(UARTCTRL_RE | UARTCTRL_TE, sport->port.membase + UARTCTRL);
++ lpuart32_write(&sport->port, UARTCTRL, UARTCTRL_RE | UARTCTRL_TE);
+ spin_unlock_irqrestore(&sport->port.lock, flags);
+
+ return 0;
+@@ -555,18 +555,18 @@ static int lpuart32_poll_init(struct uart_port *port)
+
+ static void lpuart32_poll_put_char(struct uart_port *port, unsigned char c)
+ {
+- while (!(readl(port->membase + UARTSTAT) & UARTSTAT_TDRE))
++ while (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_TDRE))
+ barrier();
+
+- writel(c, port->membase + UARTDATA);
++ lpuart32_write(port, UARTDATA, c);
+ }
+
+ static int lpuart32_poll_get_char(struct uart_port *port)
+ {
+- if (!(readl(port->membase + UARTSTAT) & UARTSTAT_RDRF))
++ if (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_RDRF))
+ return NO_POLL_CHAR;
+
+- return readl(port->membase + UARTDATA);
++ return lpuart32_read(port, UARTDATA);
+ }
+ #endif
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index e8d7a7bb4339..bce4ac1787ad 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -105,9 +105,7 @@ static int stm32_config_rs485(struct uart_port *port,
+ struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+ u32 usartdiv, baud, cr1, cr3;
+ bool over8;
+- unsigned long flags;
+
+- spin_lock_irqsave(&port->lock, flags);
+ stm32_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
+
+ port->rs485 = *rs485conf;
+@@ -147,7 +145,6 @@ static int stm32_config_rs485(struct uart_port *port,
+ }
+
+ stm32_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
+- spin_unlock_irqrestore(&port->lock, flags);
+
+ return 0;
+ }
+@@ -194,8 +191,8 @@ static int stm32_pending_rx(struct uart_port *port, u32 *sr, int *last_res,
+ return 0;
+ }
+
+-static unsigned long
+-stm32_get_char(struct uart_port *port, u32 *sr, int *last_res)
++static unsigned long stm32_get_char(struct uart_port *port, u32 *sr,
++ int *last_res)
+ {
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+@@ -205,10 +202,13 @@ stm32_get_char(struct uart_port *port, u32 *sr, int *last_res)
+ c = stm32_port->rx_buf[RX_BUF_L - (*last_res)--];
+ if ((*last_res) == 0)
+ *last_res = RX_BUF_L;
+- return c;
+ } else {
+- return readl_relaxed(port->membase + ofs->rdr);
++ c = readl_relaxed(port->membase + ofs->rdr);
++ /* apply RDR data mask */
++ c &= stm32_port->rdr_mask;
+ }
++
++ return c;
+ }
+
+ static void stm32_receive_chars(struct uart_port *port, bool threaded)
+@@ -225,35 +225,51 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded)
+
+ while (stm32_pending_rx(port, &sr, &stm32_port->last_res, threaded)) {
+ sr |= USART_SR_DUMMY_RX;
+- c = stm32_get_char(port, &sr, &stm32_port->last_res);
+ flag = TTY_NORMAL;
+- port->icount.rx++;
+
++ /*
++ * Status bits has to be cleared before reading the RDR:
++ * In FIFO mode, reading the RDR will pop the next data
++ * (if any) along with its status bits into the SR.
++ * Not doing so leads to misalignement between RDR and SR,
++ * and clear status bits of the next rx data.
++ *
++ * Clear errors flags for stm32f7 and stm32h7 compatible
++ * devices. On stm32f4 compatible devices, the error bit is
++ * cleared by the sequence [read SR - read DR].
++ */
++ if ((sr & USART_SR_ERR_MASK) && ofs->icr != UNDEF_REG)
++ writel_relaxed(sr & USART_SR_ERR_MASK,
++ port->membase + ofs->icr);
++
++ c = stm32_get_char(port, &sr, &stm32_port->last_res);
++ port->icount.rx++;
+ if (sr & USART_SR_ERR_MASK) {
+- if (sr & USART_SR_LBD) {
+- port->icount.brk++;
+- if (uart_handle_break(port))
+- continue;
+- } else if (sr & USART_SR_ORE) {
+- if (ofs->icr != UNDEF_REG)
+- writel_relaxed(USART_ICR_ORECF,
+- port->membase +
+- ofs->icr);
++ if (sr & USART_SR_ORE) {
+ port->icount.overrun++;
+ } else if (sr & USART_SR_PE) {
+ port->icount.parity++;
+ } else if (sr & USART_SR_FE) {
+- port->icount.frame++;
++ /* Break detection if character is null */
++ if (!c) {
++ port->icount.brk++;
++ if (uart_handle_break(port))
++ continue;
++ } else {
++ port->icount.frame++;
++ }
+ }
+
+ sr &= port->read_status_mask;
+
+- if (sr & USART_SR_LBD)
+- flag = TTY_BREAK;
+- else if (sr & USART_SR_PE)
++ if (sr & USART_SR_PE) {
+ flag = TTY_PARITY;
+- else if (sr & USART_SR_FE)
+- flag = TTY_FRAME;
++ } else if (sr & USART_SR_FE) {
++ if (!c)
++ flag = TTY_BREAK;
++ else
++ flag = TTY_FRAME;
++ }
+ }
+
+ if (uart_handle_sysrq_char(port, c))
+@@ -271,21 +287,6 @@ static void stm32_tx_dma_complete(void *arg)
+ struct uart_port *port = arg;
+ struct stm32_port *stm32port = to_stm32_port(port);
+ struct stm32_usart_offsets *ofs = &stm32port->info->ofs;
+- unsigned int isr;
+- int ret;
+-
+- ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr,
+- isr,
+- (isr & USART_SR_TC),
+- 10, 100000);
+-
+- if (ret)
+- dev_err(port->dev, "terminal count not set\n");
+-
+- if (ofs->icr == UNDEF_REG)
+- stm32_clr_bits(port, ofs->isr, USART_SR_TC);
+- else
+- stm32_set_bits(port, ofs->icr, USART_CR_TC);
+
+ stm32_clr_bits(port, ofs->cr3, USART_CR3_DMAT);
+ stm32port->tx_dma_busy = false;
+@@ -377,7 +378,6 @@ static void stm32_transmit_chars_dma(struct uart_port *port)
+ /* Issue pending DMA TX requests */
+ dma_async_issue_pending(stm32port->tx_ch);
+
+- stm32_clr_bits(port, ofs->isr, USART_SR_TC);
+ stm32_set_bits(port, ofs->cr3, USART_CR3_DMAT);
+
+ xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);
+@@ -401,15 +401,15 @@ static void stm32_transmit_chars(struct uart_port *port)
+ return;
+ }
+
+- if (uart_tx_stopped(port)) {
+- stm32_stop_tx(port);
++ if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
++ stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
+ return;
+ }
+
+- if (uart_circ_empty(xmit)) {
+- stm32_stop_tx(port);
+- return;
+- }
++ if (ofs->icr == UNDEF_REG)
++ stm32_clr_bits(port, ofs->isr, USART_SR_TC);
++ else
++ writel_relaxed(USART_ICR_TCCF, port->membase + ofs->icr);
+
+ if (stm32_port->tx_ch)
+ stm32_transmit_chars_dma(port);
+@@ -420,7 +420,7 @@ static void stm32_transmit_chars(struct uart_port *port)
+ uart_write_wakeup(port);
+
+ if (uart_circ_empty(xmit))
+- stm32_stop_tx(port);
++ stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
+ }
+
+ static irqreturn_t stm32_interrupt(int irq, void *ptr)
+@@ -554,7 +554,6 @@ static int stm32_startup(struct uart_port *port)
+ {
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+- struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+ const char *name = to_platform_device(port->dev)->name;
+ u32 val;
+ int ret;
+@@ -565,15 +564,6 @@ static int stm32_startup(struct uart_port *port)
+ if (ret)
+ return ret;
+
+- if (cfg->has_wakeup && stm32_port->wakeirq >= 0) {
+- ret = dev_pm_set_dedicated_wake_irq(port->dev,
+- stm32_port->wakeirq);
+- if (ret) {
+- free_irq(port->irq, port);
+- return ret;
+- }
+- }
+-
+ val = USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE;
+ if (stm32_port->fifoen)
+ val |= USART_CR1_FIFOEN;
+@@ -587,18 +577,56 @@ static void stm32_shutdown(struct uart_port *port)
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+ struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+- u32 val;
++ u32 val, isr;
++ int ret;
+
+ val = USART_CR1_TXEIE | USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE;
+ val |= BIT(cfg->uart_enable_bit);
+ if (stm32_port->fifoen)
+ val |= USART_CR1_FIFOEN;
++
++ ret = readl_relaxed_poll_timeout(port->membase + ofs->isr,
++ isr, (isr & USART_SR_TC),
++ 10, 100000);
++
++ if (ret)
++ dev_err(port->dev, "transmission complete not set\n");
++
+ stm32_clr_bits(port, ofs->cr1, val);
+
+- dev_pm_clear_wake_irq(port->dev);
+ free_irq(port->irq, port);
+ }
+
++unsigned int stm32_get_databits(struct ktermios *termios)
++{
++ unsigned int bits;
++
++ tcflag_t cflag = termios->c_cflag;
++
++ switch (cflag & CSIZE) {
++ /*
++ * CSIZE settings are not necessarily supported in hardware.
++ * CSIZE unsupported configurations are handled here to set word length
++ * to 8 bits word as default configuration and to print debug message.
++ */
++ case CS5:
++ bits = 5;
++ break;
++ case CS6:
++ bits = 6;
++ break;
++ case CS7:
++ bits = 7;
++ break;
++ /* default including CS8 */
++ default:
++ bits = 8;
++ break;
++ }
++
++ return bits;
++}
++
+ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ struct ktermios *old)
+ {
+@@ -606,7 +634,7 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+ struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+ struct serial_rs485 *rs485conf = &port->rs485;
+- unsigned int baud;
++ unsigned int baud, bits;
+ u32 usartdiv, mantissa, fraction, oversampling;
+ tcflag_t cflag = termios->c_cflag;
+ u32 cr1, cr2, cr3;
+@@ -632,16 +660,29 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ if (cflag & CSTOPB)
+ cr2 |= USART_CR2_STOP_2B;
+
++ bits = stm32_get_databits(termios);
++ stm32_port->rdr_mask = (BIT(bits) - 1);
++
+ if (cflag & PARENB) {
++ bits++;
+ cr1 |= USART_CR1_PCE;
+- if ((cflag & CSIZE) == CS8) {
+- if (cfg->has_7bits_data)
+- cr1 |= USART_CR1_M0;
+- else
+- cr1 |= USART_CR1_M;
+- }
+ }
+
++ /*
++ * Word length configuration:
++ * CS8 + parity, 9 bits word aka [M1:M0] = 0b01
++ * CS7 or (CS6 + parity), 7 bits word aka [M1:M0] = 0b10
++ * CS8 or (CS7 + parity), 8 bits word aka [M1:M0] = 0b00
++ * M0 and M1 already cleared by cr1 initialization.
++ */
++ if (bits == 9)
++ cr1 |= USART_CR1_M0;
++ else if ((bits == 7) && cfg->has_7bits_data)
++ cr1 |= USART_CR1_M1;
++ else if (bits != 8)
++ dev_dbg(port->dev, "Unsupported data bits config: %u bits\n"
++ , bits);
++
+ if (cflag & PARODD)
+ cr1 |= USART_CR1_PS;
+
+@@ -679,14 +720,14 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ if (termios->c_iflag & INPCK)
+ port->read_status_mask |= USART_SR_PE | USART_SR_FE;
+ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
+- port->read_status_mask |= USART_SR_LBD;
++ port->read_status_mask |= USART_SR_FE;
+
+ /* Characters to ignore */
+ port->ignore_status_mask = 0;
+ if (termios->c_iflag & IGNPAR)
+ port->ignore_status_mask = USART_SR_PE | USART_SR_FE;
+ if (termios->c_iflag & IGNBRK) {
+- port->ignore_status_mask |= USART_SR_LBD;
++ port->ignore_status_mask |= USART_SR_FE;
+ /*
+ * If we're ignoring parity and break indicators,
+ * ignore overruns too (for real raw support).
+@@ -1024,11 +1065,18 @@ static int stm32_serial_probe(struct platform_device *pdev)
+ ret = device_init_wakeup(&pdev->dev, true);
+ if (ret)
+ goto err_uninit;
++
++ ret = dev_pm_set_dedicated_wake_irq(&pdev->dev,
++ stm32port->wakeirq);
++ if (ret)
++ goto err_nowup;
++
++ device_set_wakeup_enable(&pdev->dev, false);
+ }
+
+ ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port);
+ if (ret)
+- goto err_nowup;
++ goto err_wirq;
+
+ ret = stm32_of_dma_rx_probe(stm32port, pdev);
+ if (ret)
+@@ -1042,6 +1090,10 @@ static int stm32_serial_probe(struct platform_device *pdev)
+
+ return 0;
+
++err_wirq:
++ if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0)
++ dev_pm_clear_wake_irq(&pdev->dev);
++
+ err_nowup:
+ if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0)
+ device_init_wakeup(&pdev->dev, false);
+@@ -1079,8 +1131,10 @@ static int stm32_serial_remove(struct platform_device *pdev)
+ TX_BUF_L, stm32_port->tx_buf,
+ stm32_port->tx_dma_buf);
+
+- if (cfg->has_wakeup && stm32_port->wakeirq >= 0)
++ if (cfg->has_wakeup && stm32_port->wakeirq >= 0) {
++ dev_pm_clear_wake_irq(&pdev->dev);
+ device_init_wakeup(&pdev->dev, false);
++ }
+
+ clk_disable_unprepare(stm32_port->clk);
+
+diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
+index 6f294e280ea3..30d2433e27c3 100644
+--- a/drivers/tty/serial/stm32-usart.h
++++ b/drivers/tty/serial/stm32-usart.h
+@@ -108,7 +108,6 @@ struct stm32_usart_info stm32h7_info = {
+ #define USART_SR_RXNE BIT(5)
+ #define USART_SR_TC BIT(6)
+ #define USART_SR_TXE BIT(7)
+-#define USART_SR_LBD BIT(8)
+ #define USART_SR_CTSIF BIT(9)
+ #define USART_SR_CTS BIT(10) /* F7 */
+ #define USART_SR_RTOF BIT(11) /* F7 */
+@@ -120,8 +119,7 @@ struct stm32_usart_info stm32h7_info = {
+ #define USART_SR_SBKF BIT(18) /* F7 */
+ #define USART_SR_WUF BIT(20) /* H7 */
+ #define USART_SR_TEACK BIT(21) /* F7 */
+-#define USART_SR_ERR_MASK (USART_SR_LBD | USART_SR_ORE | \
+- USART_SR_FE | USART_SR_PE)
++#define USART_SR_ERR_MASK (USART_SR_ORE | USART_SR_FE | USART_SR_PE)
+ /* Dummy bits */
+ #define USART_SR_DUMMY_RX BIT(16)
+
+@@ -151,8 +149,7 @@ struct stm32_usart_info stm32h7_info = {
+ #define USART_CR1_PS BIT(9)
+ #define USART_CR1_PCE BIT(10)
+ #define USART_CR1_WAKE BIT(11)
+-#define USART_CR1_M BIT(12)
+-#define USART_CR1_M0 BIT(12) /* F7 */
++#define USART_CR1_M0 BIT(12) /* F7 (CR1_M for F4) */
+ #define USART_CR1_MME BIT(13) /* F7 */
+ #define USART_CR1_CMIE BIT(14) /* F7 */
+ #define USART_CR1_OVER8 BIT(15)
+@@ -169,8 +166,6 @@ struct stm32_usart_info stm32h7_info = {
+ /* USART_CR2 */
+ #define USART_CR2_ADD_MASK GENMASK(3, 0) /* F4 */
+ #define USART_CR2_ADDM7 BIT(4) /* F7 */
+-#define USART_CR2_LBDL BIT(5)
+-#define USART_CR2_LBDIE BIT(6)
+ #define USART_CR2_LBCL BIT(8)
+ #define USART_CR2_CPHA BIT(9)
+ #define USART_CR2_CPOL BIT(10)
+@@ -227,12 +222,10 @@ struct stm32_usart_info stm32h7_info = {
+
+ /* USART_ICR */
+ #define USART_ICR_PECF BIT(0) /* F7 */
+-#define USART_ICR_FFECF BIT(1) /* F7 */
+-#define USART_ICR_NCF BIT(2) /* F7 */
++#define USART_ICR_FECF BIT(1) /* F7 */
+ #define USART_ICR_ORECF BIT(3) /* F7 */
+ #define USART_ICR_IDLECF BIT(4) /* F7 */
+ #define USART_ICR_TCCF BIT(6) /* F7 */
+-#define USART_ICR_LBDCF BIT(8) /* F7 */
+ #define USART_ICR_CTSCF BIT(9) /* F7 */
+ #define USART_ICR_RTOCF BIT(11) /* F7 */
+ #define USART_ICR_EOBCF BIT(12) /* F7 */
+@@ -261,6 +254,7 @@ struct stm32_port {
+ bool hw_flow_control;
+ bool fifoen;
+ int wakeirq;
++ int rdr_mask; /* receive data register mask */
+ };
+
+ static struct stm32_port stm32_ports[STM32_MAX_PORTS];
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index 2762148c169d..9c788748bdc6 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -938,9 +938,12 @@ int __uio_register_device(struct module *owner,
+ atomic_set(&idev->event, 0);
+
+ ret = uio_get_minor(idev);
+- if (ret)
++ if (ret) {
++ kfree(idev);
+ return ret;
++ }
+
++ device_initialize(&idev->dev);
+ idev->dev.devt = MKDEV(uio_major, idev->minor);
+ idev->dev.class = &uio_class;
+ idev->dev.parent = parent;
+@@ -951,7 +954,7 @@ int __uio_register_device(struct module *owner,
+ if (ret)
+ goto err_device_create;
+
+- ret = device_register(&idev->dev);
++ ret = device_add(&idev->dev);
+ if (ret)
+ goto err_device_create;
+
+@@ -983,9 +986,10 @@ int __uio_register_device(struct module *owner,
+ err_request_irq:
+ uio_dev_del_attributes(idev);
+ err_uio_dev_add_attributes:
+- device_unregister(&idev->dev);
++ device_del(&idev->dev);
+ err_device_create:
+ uio_free_minor(idev);
++ put_device(&idev->dev);
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(__uio_register_device);
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index b8a1fdefb515..4929c5883068 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -1107,7 +1107,7 @@ static int wdm_post_reset(struct usb_interface *intf)
+ rv = recover_from_urb_loss(desc);
+ mutex_unlock(&desc->wlock);
+ mutex_unlock(&desc->rlock);
+- return 0;
++ return rv;
+ }
+
+ static struct usb_driver wdm_driver = {
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 3f68edde0f03..f64d1cd08fb6 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -2230,6 +2230,7 @@ static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep)
+ if (status & DEV_DMA_STS_MASK)
+ dev_err(hsotg->dev, "descriptor %d closed with %x\n",
+ i, status & DEV_DMA_STS_MASK);
++ desc++;
+ }
+
+ return bytes_rem;
+diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
+index 518ead12458d..5d22f4bf2a9f 100644
+--- a/drivers/usb/dwc3/Kconfig
++++ b/drivers/usb/dwc3/Kconfig
+@@ -52,7 +52,8 @@ comment "Platform Glue Driver Support"
+
+ config USB_DWC3_OMAP
+ tristate "Texas Instruments OMAP5 and similar Platforms"
+- depends on EXTCON && (ARCH_OMAP2PLUS || COMPILE_TEST)
++ depends on ARCH_OMAP2PLUS || COMPILE_TEST
++ depends on EXTCON || !EXTCON
+ depends on OF
+ default USB_DWC3
+ help
+@@ -114,6 +115,7 @@ config USB_DWC3_ST
+ config USB_DWC3_QCOM
+ tristate "Qualcomm Platform"
+ depends on ARCH_QCOM || COMPILE_TEST
++ depends on EXTCON || !EXTCON
+ depends on OF
+ default USB_DWC3
+ help
+diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
+index d44b26d5b2a2..367697144cda 100644
+--- a/drivers/usb/gadget/udc/fsl_udc_core.c
++++ b/drivers/usb/gadget/udc/fsl_udc_core.c
+@@ -2247,8 +2247,10 @@ static int struct_udc_setup(struct fsl_udc *udc,
+ udc->phy_mode = pdata->phy_mode;
+
+ udc->eps = kcalloc(udc->max_ep, sizeof(struct fsl_ep), GFP_KERNEL);
+- if (!udc->eps)
+- return -1;
++ if (!udc->eps) {
++ ERR("kmalloc udc endpoint status failed\n");
++ goto eps_alloc_failed;
++ }
+
+ /* initialized QHs, take care of alignment */
+ size = udc->max_ep * sizeof(struct ep_queue_head);
+@@ -2262,8 +2264,7 @@ static int struct_udc_setup(struct fsl_udc *udc,
+ &udc->ep_qh_dma, GFP_KERNEL);
+ if (!udc->ep_qh) {
+ ERR("malloc QHs for udc failed\n");
+- kfree(udc->eps);
+- return -1;
++ goto ep_queue_alloc_failed;
+ }
+
+ udc->ep_qh_size = size;
+@@ -2272,8 +2273,17 @@ static int struct_udc_setup(struct fsl_udc *udc,
+ /* FIXME: fsl_alloc_request() ignores ep argument */
+ udc->status_req = container_of(fsl_alloc_request(NULL, GFP_KERNEL),
+ struct fsl_req, req);
++ if (!udc->status_req) {
++ ERR("kzalloc for udc status request failed\n");
++ goto udc_status_alloc_failed;
++ }
++
+ /* allocate a small amount of memory to get valid address */
+ udc->status_req->req.buf = kmalloc(8, GFP_KERNEL);
++ if (!udc->status_req->req.buf) {
++ ERR("kzalloc for udc request buffer failed\n");
++ goto udc_req_buf_alloc_failed;
++ }
+
+ udc->resume_state = USB_STATE_NOTATTACHED;
+ udc->usb_state = USB_STATE_POWERED;
+@@ -2281,6 +2291,18 @@ static int struct_udc_setup(struct fsl_udc *udc,
+ udc->remote_wakeup = 0; /* default to 0 on reset */
+
+ return 0;
++
++udc_req_buf_alloc_failed:
++ kfree(udc->status_req);
++udc_status_alloc_failed:
++ kfree(udc->ep_qh);
++ udc->ep_qh_size = 0;
++ep_queue_alloc_failed:
++ kfree(udc->eps);
++eps_alloc_failed:
++ udc->phy_mode = 0;
++ return -1;
++
+ }
+
+ /*----------------------------------------------------------------
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 8f180bf7561a..9772c0de59b7 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1104,7 +1104,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ }
+ port_li = readl(ports[wIndex]->addr + PORTLI);
+ status = xhci_get_ext_port_status(temp, port_li);
+- put_unaligned_le32(cpu_to_le32(status), &buf[4]);
++ put_unaligned_le32(status, &buf[4]);
+ }
+ break;
+ case SetPortFeature:
+diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
+index 91ea3083e7ad..affb5393c4c6 100644
+--- a/drivers/usb/phy/Kconfig
++++ b/drivers/usb/phy/Kconfig
+@@ -20,7 +20,7 @@ config AB8500_USB
+ in host mode, low speed.
+
+ config FSL_USB2_OTG
+- bool "Freescale USB OTG Transceiver Driver"
++ tristate "Freescale USB OTG Transceiver Driver"
+ depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
+ depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
+ select USB_PHY
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index 183550b63faa..dade34d70419 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -400,7 +400,7 @@ static int twl6030_usb_remove(struct platform_device *pdev)
+ {
+ struct twl6030_usb *twl = platform_get_drvdata(pdev);
+
+- cancel_delayed_work(&twl->get_status_work);
++ cancel_delayed_work_sync(&twl->get_status_work);
+ twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
+ REG_INT_MSK_LINE_C);
+ twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
+diff --git a/drivers/usb/typec/Kconfig b/drivers/usb/typec/Kconfig
+index 00878c386dd0..8445890accdf 100644
+--- a/drivers/usb/typec/Kconfig
++++ b/drivers/usb/typec/Kconfig
+@@ -95,6 +95,7 @@ source "drivers/usb/typec/ucsi/Kconfig"
+ config TYPEC_TPS6598X
+ tristate "TI TPS6598x USB Power Delivery controller driver"
+ depends on I2C
++ select REGMAP_I2C
+ help
+ Say Y or M here if your system has TI TPS65982 or TPS65983 USB Power
+ Delivery controller.
+diff --git a/drivers/usb/typec/fusb302/fusb302.c b/drivers/usb/typec/fusb302/fusb302.c
+index 62a0060d39d8..c749ce486ec8 100644
+--- a/drivers/usb/typec/fusb302/fusb302.c
++++ b/drivers/usb/typec/fusb302/fusb302.c
+@@ -990,13 +990,17 @@ done:
+ return ret;
+ }
+
+-static int tcpm_start_drp_toggling(struct tcpc_dev *dev,
+- enum typec_cc_status cc)
++static int tcpm_start_toggling(struct tcpc_dev *dev,
++ enum typec_port_type port_type,
++ enum typec_cc_status cc)
+ {
+ struct fusb302_chip *chip = container_of(dev, struct fusb302_chip,
+ tcpc_dev);
+ int ret = 0;
+
++ if (port_type != TYPEC_PORT_DRP)
++ return -EOPNOTSUPP;
++
+ mutex_lock(&chip->lock);
+ ret = fusb302_set_src_current(chip, cc_src_current[cc]);
+ if (ret < 0) {
+@@ -1206,7 +1210,7 @@ static void init_tcpc_dev(struct tcpc_dev *fusb302_tcpc_dev)
+ fusb302_tcpc_dev->set_vbus = tcpm_set_vbus;
+ fusb302_tcpc_dev->set_pd_rx = tcpm_set_pd_rx;
+ fusb302_tcpc_dev->set_roles = tcpm_set_roles;
+- fusb302_tcpc_dev->start_drp_toggling = tcpm_start_drp_toggling;
++ fusb302_tcpc_dev->start_toggling = tcpm_start_toggling;
+ fusb302_tcpc_dev->pd_transmit = tcpm_pd_transmit;
+ }
+
+diff --git a/drivers/usb/typec/tcpci.c b/drivers/usb/typec/tcpci.c
+index ac6b418b15f1..c1f7073a56de 100644
+--- a/drivers/usb/typec/tcpci.c
++++ b/drivers/usb/typec/tcpci.c
+@@ -100,13 +100,17 @@ static int tcpci_set_cc(struct tcpc_dev *tcpc, enum typec_cc_status cc)
+ return 0;
+ }
+
+-static int tcpci_start_drp_toggling(struct tcpc_dev *tcpc,
+- enum typec_cc_status cc)
++static int tcpci_start_toggling(struct tcpc_dev *tcpc,
++ enum typec_port_type port_type,
++ enum typec_cc_status cc)
+ {
+ int ret;
+ struct tcpci *tcpci = tcpc_to_tcpci(tcpc);
+ unsigned int reg = TCPC_ROLE_CTRL_DRP;
+
++ if (port_type != TYPEC_PORT_DRP)
++ return -EOPNOTSUPP;
++
+ /* Handle vendor drp toggling */
+ if (tcpci->data->start_drp_toggling) {
+ ret = tcpci->data->start_drp_toggling(tcpci, tcpci->data, cc);
+@@ -511,7 +515,7 @@ struct tcpci *tcpci_register_port(struct device *dev, struct tcpci_data *data)
+ tcpci->tcpc.get_cc = tcpci_get_cc;
+ tcpci->tcpc.set_polarity = tcpci_set_polarity;
+ tcpci->tcpc.set_vconn = tcpci_set_vconn;
+- tcpci->tcpc.start_drp_toggling = tcpci_start_drp_toggling;
++ tcpci->tcpc.start_toggling = tcpci_start_toggling;
+
+ tcpci->tcpc.set_pd_rx = tcpci_set_pd_rx;
+ tcpci->tcpc.set_roles = tcpci_set_roles;
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index 39cf19001239..29d72e9b0f01 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -31,7 +31,7 @@
+
+ #define FOREACH_STATE(S) \
+ S(INVALID_STATE), \
+- S(DRP_TOGGLING), \
++ S(TOGGLING), \
+ S(SRC_UNATTACHED), \
+ S(SRC_ATTACH_WAIT), \
+ S(SRC_ATTACHED), \
+@@ -473,7 +473,7 @@ static void tcpm_log(struct tcpm_port *port, const char *fmt, ...)
+ /* Do not log while disconnected and unattached */
+ if (tcpm_port_is_disconnected(port) &&
+ (port->state == SRC_UNATTACHED || port->state == SNK_UNATTACHED ||
+- port->state == DRP_TOGGLING))
++ port->state == TOGGLING))
+ return;
+
+ va_start(args, fmt);
+@@ -2561,20 +2561,16 @@ static int tcpm_set_charge(struct tcpm_port *port, bool charge)
+ return 0;
+ }
+
+-static bool tcpm_start_drp_toggling(struct tcpm_port *port,
+- enum typec_cc_status cc)
++static bool tcpm_start_toggling(struct tcpm_port *port, enum typec_cc_status cc)
+ {
+ int ret;
+
+- if (port->tcpc->start_drp_toggling &&
+- port->port_type == TYPEC_PORT_DRP) {
+- tcpm_log_force(port, "Start DRP toggling");
+- ret = port->tcpc->start_drp_toggling(port->tcpc, cc);
+- if (!ret)
+- return true;
+- }
++ if (!port->tcpc->start_toggling)
++ return false;
+
+- return false;
++ tcpm_log_force(port, "Start toggling");
++ ret = port->tcpc->start_toggling(port->tcpc, port->port_type, cc);
++ return ret == 0;
+ }
+
+ static void tcpm_set_cc(struct tcpm_port *port, enum typec_cc_status cc)
+@@ -2868,15 +2864,15 @@ static void run_state_machine(struct tcpm_port *port)
+
+ port->enter_state = port->state;
+ switch (port->state) {
+- case DRP_TOGGLING:
++ case TOGGLING:
+ break;
+ /* SRC states */
+ case SRC_UNATTACHED:
+ if (!port->non_pd_role_swap)
+ tcpm_swap_complete(port, -ENOTCONN);
+ tcpm_src_detach(port);
+- if (tcpm_start_drp_toggling(port, tcpm_rp_cc(port))) {
+- tcpm_set_state(port, DRP_TOGGLING, 0);
++ if (tcpm_start_toggling(port, tcpm_rp_cc(port))) {
++ tcpm_set_state(port, TOGGLING, 0);
+ break;
+ }
+ tcpm_set_cc(port, tcpm_rp_cc(port));
+@@ -3074,8 +3070,8 @@ static void run_state_machine(struct tcpm_port *port)
+ tcpm_swap_complete(port, -ENOTCONN);
+ tcpm_pps_complete(port, -ENOTCONN);
+ tcpm_snk_detach(port);
+- if (tcpm_start_drp_toggling(port, TYPEC_CC_RD)) {
+- tcpm_set_state(port, DRP_TOGGLING, 0);
++ if (tcpm_start_toggling(port, TYPEC_CC_RD)) {
++ tcpm_set_state(port, TOGGLING, 0);
+ break;
+ }
+ tcpm_set_cc(port, TYPEC_CC_RD);
+@@ -3642,7 +3638,7 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
+ : "connected");
+
+ switch (port->state) {
+- case DRP_TOGGLING:
++ case TOGGLING:
+ if (tcpm_port_is_debug(port) || tcpm_port_is_audio(port) ||
+ tcpm_port_is_source(port))
+ tcpm_set_state(port, SRC_ATTACH_WAIT, 0);
+diff --git a/drivers/usb/typec/typec_wcove.c b/drivers/usb/typec/typec_wcove.c
+index 6770afd40765..f1f8f45e2f3d 100644
+--- a/drivers/usb/typec/typec_wcove.c
++++ b/drivers/usb/typec/typec_wcove.c
+@@ -416,12 +416,16 @@ static int wcove_pd_transmit(struct tcpc_dev *tcpc,
+ return regmap_write(wcove->regmap, USBC_TXCMD, cmd | USBC_TXCMD_START);
+ }
+
+-static int wcove_start_drp_toggling(struct tcpc_dev *tcpc,
+- enum typec_cc_status cc)
++static int wcove_start_toggling(struct tcpc_dev *tcpc,
++ enum typec_port_type port_type,
++ enum typec_cc_status cc)
+ {
+ struct wcove_typec *wcove = tcpc_to_wcove(tcpc);
+ unsigned int usbc_ctrl;
+
++ if (port_type != TYPEC_PORT_DRP)
++ return -EOPNOTSUPP;
++
+ usbc_ctrl = USBC_CONTROL1_MODE_DRP | USBC_CONTROL1_DRPTOGGLE_RANDOM;
+
+ switch (cc) {
+@@ -642,7 +646,7 @@ static int wcove_typec_probe(struct platform_device *pdev)
+ wcove->tcpc.set_polarity = wcove_set_polarity;
+ wcove->tcpc.set_vconn = wcove_set_vconn;
+ wcove->tcpc.set_current_limit = wcove_set_current_limit;
+- wcove->tcpc.start_drp_toggling = wcove_start_drp_toggling;
++ wcove->tcpc.start_toggling = wcove_start_toggling;
+
+ wcove->tcpc.set_pd_rx = wcove_set_pd_rx;
+ wcove->tcpc.set_roles = wcove_set_roles;
+diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
+index 0212f0ee8aea..e052f62fdea7 100644
+--- a/drivers/vfio/mdev/mdev_core.c
++++ b/drivers/vfio/mdev/mdev_core.c
+@@ -150,10 +150,10 @@ static int mdev_device_remove_ops(struct mdev_device *mdev, bool force_remove)
+
+ static int mdev_device_remove_cb(struct device *dev, void *data)
+ {
+- if (!dev_is_mdev(dev))
+- return 0;
++ if (dev_is_mdev(dev))
++ mdev_device_remove(dev, true);
+
+- return mdev_device_remove(dev, data ? *(bool *)data : true);
++ return 0;
+ }
+
+ /*
+@@ -182,6 +182,7 @@ int mdev_register_device(struct device *dev, const struct mdev_parent_ops *ops)
+ /* Check for duplicate */
+ parent = __find_parent_device(dev);
+ if (parent) {
++ parent = NULL;
+ ret = -EEXIST;
+ goto add_dev_err;
+ }
+@@ -240,7 +241,6 @@ EXPORT_SYMBOL(mdev_register_device);
+ void mdev_unregister_device(struct device *dev)
+ {
+ struct mdev_parent *parent;
+- bool force_remove = true;
+
+ mutex_lock(&parent_list_lock);
+ parent = __find_parent_device(dev);
+@@ -254,8 +254,7 @@ void mdev_unregister_device(struct device *dev)
+ list_del(&parent->next);
+ class_compat_remove_link(mdev_bus_compat_class, dev, NULL);
+
+- device_for_each_child(dev, (void *)&force_remove,
+- mdev_device_remove_cb);
++ device_for_each_child(dev, NULL, mdev_device_remove_cb);
+
+ parent_remove_sysfs_files(parent);
+
+diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c
+index 249472f05509..e7770b511d03 100644
+--- a/drivers/vfio/mdev/mdev_sysfs.c
++++ b/drivers/vfio/mdev/mdev_sysfs.c
+@@ -280,7 +280,7 @@ type_link_failed:
+
+ void mdev_remove_sysfs_files(struct device *dev, struct mdev_type *type)
+ {
++ sysfs_remove_files(&dev->kobj, mdev_device_attrs);
+ sysfs_remove_link(&dev->kobj, "mdev_type");
+ sysfs_remove_link(type->devices_kobj, dev_name(dev));
+- sysfs_remove_files(&dev->kobj, mdev_device_attrs);
+ }
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 0a6eb53e79fb..66783a37f450 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -696,6 +696,7 @@ static long vfio_pci_ioctl(void *device_data,
+ {
+ void __iomem *io;
+ size_t size;
++ u16 orig_cmd;
+
+ info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+ info.flags = 0;
+@@ -711,15 +712,23 @@ static long vfio_pci_ioctl(void *device_data,
+ break;
+ }
+
+- /* Is it really there? */
++ /*
++ * Is it really there? Enable memory decode for
++ * implicit access in pci_map_rom().
++ */
++ pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
++ pci_write_config_word(pdev, PCI_COMMAND,
++ orig_cmd | PCI_COMMAND_MEMORY);
++
+ io = pci_map_rom(pdev, &size);
+- if (!io || !size) {
++ if (io) {
++ info.flags = VFIO_REGION_INFO_FLAG_READ;
++ pci_unmap_rom(pdev, io);
++ } else {
+ info.size = 0;
+- break;
+ }
+- pci_unmap_rom(pdev, io);
+
+- info.flags = VFIO_REGION_INFO_FLAG_READ;
++ pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
+ break;
+ }
+ case VFIO_PCI_VGA_REGION_INDEX:
+diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
+index a9be2d8e98df..55090d9f9de0 100644
+--- a/drivers/vhost/test.c
++++ b/drivers/vhost/test.c
+@@ -162,6 +162,7 @@ static int vhost_test_release(struct inode *inode, struct file *f)
+
+ vhost_test_stop(n, &private);
+ vhost_test_flush(n);
++ vhost_dev_stop(&n->dev);
+ vhost_dev_cleanup(&n->dev);
+ /* We do an extra flush before freeing memory,
+ * since jobs can re-queue themselves. */
+@@ -238,6 +239,7 @@ static long vhost_test_reset_owner(struct vhost_test *n)
+ }
+ vhost_test_stop(n, &priv);
+ vhost_test_flush(n);
++ vhost_dev_stop(&n->dev);
+ vhost_dev_reset_owner(&n->dev, umem);
+ done:
+ mutex_unlock(&n->dev.mutex);
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index 2030a6b77a09..ef2553f452ca 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -201,7 +201,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
+ LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
+ if (ret < 0)
+ goto out_i2c_err;
+- return bl->props.brightness;
++ return 0;
+
+ out_i2c_err:
+ dev_err(pchip->dev, "i2c failed to access\n");
+@@ -278,7 +278,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
+ LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
+ if (ret < 0)
+ goto out_i2c_err;
+- return bl->props.brightness;
++ return 0;
+
+ out_i2c_err:
+ dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
+diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
+index 7ddc0930e98c..3a3098d4873b 100644
+--- a/drivers/video/backlight/pwm_bl.c
++++ b/drivers/video/backlight/pwm_bl.c
+@@ -199,29 +199,17 @@ int pwm_backlight_brightness_default(struct device *dev,
+ struct platform_pwm_backlight_data *data,
+ unsigned int period)
+ {
+- unsigned int counter = 0;
+- unsigned int i, n;
++ unsigned int i;
+ u64 retval;
+
+ /*
+- * Count the number of bits needed to represent the period number. The
+- * number of bits is used to calculate the number of levels used for the
+- * brightness-levels table, the purpose of this calculation is have a
+- * pre-computed table with enough levels to get linear brightness
+- * perception. The period is divided by the number of bits so for a
+- * 8-bit PWM we have 255 / 8 = 32 brightness levels or for a 16-bit PWM
+- * we have 65535 / 16 = 4096 brightness levels.
+- *
+- * Note that this method is based on empirical testing on different
+- * devices with PWM of 8 and 16 bits of resolution.
++ * Once we have 4096 levels there's little point going much higher...
++ * neither interactive sliders nor animation benefits from having
++ * more values in the table.
+ */
+- n = period;
+- while (n) {
+- counter += n % 2;
+- n >>= 1;
+- }
++ data->max_brightness =
++ min((int)DIV_ROUND_UP(period, fls(period)), 4096);
+
+- data->max_brightness = DIV_ROUND_UP(period, counter);
+ data->levels = devm_kcalloc(dev, data->max_brightness,
+ sizeof(*data->levels), GFP_KERNEL);
+ if (!data->levels)
+diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
+index f103665cad43..f9b366d17587 100644
+--- a/drivers/video/fbdev/chipsfb.c
++++ b/drivers/video/fbdev/chipsfb.c
+@@ -350,7 +350,7 @@ static void init_chips(struct fb_info *p, unsigned long addr)
+ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ {
+ struct fb_info *p;
+- unsigned long addr, size;
++ unsigned long addr;
+ unsigned short cmd;
+ int rc = -ENODEV;
+
+@@ -362,7 +362,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ if ((dp->resource[0].flags & IORESOURCE_MEM) == 0)
+ goto err_disable;
+ addr = pci_resource_start(dp, 0);
+- size = pci_resource_len(dp, 0);
+ if (addr == 0)
+ goto err_disable;
+
+diff --git a/drivers/watchdog/rtd119x_wdt.c b/drivers/watchdog/rtd119x_wdt.c
+index d001c17ddfde..99caec6882d2 100644
+--- a/drivers/watchdog/rtd119x_wdt.c
++++ b/drivers/watchdog/rtd119x_wdt.c
+@@ -135,7 +135,7 @@ static int rtd119x_wdt_probe(struct platform_device *pdev)
+ rtd119x_wdt_set_timeout(&data->wdt_dev, data->wdt_dev.timeout);
+ rtd119x_wdt_stop(&data->wdt_dev);
+
+- ret = devm_watchdog_register_device(&pdev->dev, &data->wdt_dev);
++ ret = watchdog_register_device(&data->wdt_dev);
+ if (ret) {
+ clk_disable_unprepare(data->clk);
+ clk_put(data->clk);
+diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
+index ff9397d9638a..b6c65afd3677 100644
+--- a/drivers/watchdog/sprd_wdt.c
++++ b/drivers/watchdog/sprd_wdt.c
+@@ -342,10 +342,9 @@ static int sprd_wdt_probe(struct platform_device *pdev)
+
+ static int __maybe_unused sprd_wdt_pm_suspend(struct device *dev)
+ {
+- struct watchdog_device *wdd = dev_get_drvdata(dev);
+ struct sprd_wdt *wdt = dev_get_drvdata(dev);
+
+- if (watchdog_active(wdd))
++ if (watchdog_active(&wdt->wdd))
+ sprd_wdt_stop(&wdt->wdd);
+ sprd_wdt_disable(wdt);
+
+@@ -354,7 +353,6 @@ static int __maybe_unused sprd_wdt_pm_suspend(struct device *dev)
+
+ static int __maybe_unused sprd_wdt_pm_resume(struct device *dev)
+ {
+- struct watchdog_device *wdd = dev_get_drvdata(dev);
+ struct sprd_wdt *wdt = dev_get_drvdata(dev);
+ int ret;
+
+@@ -362,7 +360,7 @@ static int __maybe_unused sprd_wdt_pm_resume(struct device *dev)
+ if (ret)
+ return ret;
+
+- if (watchdog_active(wdd)) {
++ if (watchdog_active(&wdt->wdd)) {
+ ret = sprd_wdt_start(&wdt->wdd);
+ if (ret) {
+ sprd_wdt_disable(wdt);
+diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
+index b1357aa4bc55..f192b6f42da9 100644
+--- a/drivers/xen/cpu_hotplug.c
++++ b/drivers/xen/cpu_hotplug.c
+@@ -54,7 +54,7 @@ static int vcpu_online(unsigned int cpu)
+ }
+ static void vcpu_hotplug(unsigned int cpu)
+ {
+- if (!cpu_possible(cpu))
++ if (cpu >= nr_cpu_ids || !cpu_possible(cpu))
+ return;
+
+ switch (vcpu_online(cpu)) {
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index d4ea33581ac2..b3fbfed28682 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -784,7 +784,7 @@ static int pvcalls_back_poll(struct xenbus_device *dev,
+ mappass->reqcopy = *req;
+ icsk = inet_csk(mappass->sock->sk);
+ queue = &icsk->icsk_accept_queue;
+- data = queue->rskq_accept_head != NULL;
++ data = READ_ONCE(queue->rskq_accept_head) != NULL;
+ if (data) {
+ mappass->reqcopy.cmd = 0;
+ ret = 0;
+diff --git a/fs/affs/super.c b/fs/affs/super.c
+index d1ad11a8a4a5..b6ce0c36029b 100644
+--- a/fs/affs/super.c
++++ b/fs/affs/super.c
+@@ -561,14 +561,9 @@ affs_remount(struct super_block *sb, int *flags, char *data)
+ int root_block;
+ unsigned long mount_flags;
+ int res = 0;
+- char *new_opts;
+ char volume[32];
+ char *prefix = NULL;
+
+- new_opts = kstrdup(data, GFP_KERNEL);
+- if (data && !new_opts)
+- return -ENOMEM;
+-
+ pr_debug("%s(flags=0x%x,opts=\"%s\")\n", __func__, *flags, data);
+
+ sync_filesystem(sb);
+@@ -579,7 +574,6 @@ affs_remount(struct super_block *sb, int *flags, char *data)
+ &blocksize, &prefix, volume,
+ &mount_flags)) {
+ kfree(prefix);
+- kfree(new_opts);
+ return -EINVAL;
+ }
+
+diff --git a/fs/afs/callback.c b/fs/afs/callback.c
+index 4ad701250299..97283b04fa6f 100644
+--- a/fs/afs/callback.c
++++ b/fs/afs/callback.c
+@@ -221,14 +221,8 @@ void afs_break_callback(struct afs_vnode *vnode)
+ vnode->cb_break++;
+ afs_clear_permits(vnode);
+
+- spin_lock(&vnode->lock);
+-
+- _debug("break callback");
+-
+- if (list_empty(&vnode->granted_locks) &&
+- !list_empty(&vnode->pending_locks))
++ if (vnode->lock_state == AFS_VNODE_LOCK_WAITING_FOR_CB)
+ afs_lock_may_be_available(vnode);
+- spin_unlock(&vnode->lock);
+ }
+
+ write_sequnlock(&vnode->cb_lock);
+diff --git a/fs/afs/dir_edit.c b/fs/afs/dir_edit.c
+index 8b400f5aead5..0e7162527db8 100644
+--- a/fs/afs/dir_edit.c
++++ b/fs/afs/dir_edit.c
+@@ -72,13 +72,11 @@ static int afs_find_contig_bits(union afs_xdr_dir_block *block, unsigned int nr_
+ static void afs_set_contig_bits(union afs_xdr_dir_block *block,
+ int bit, unsigned int nr_slots)
+ {
+- u64 mask, before, after;
++ u64 mask;
+
+ mask = (1 << nr_slots) - 1;
+ mask <<= bit;
+
+- before = *(u64 *)block->hdr.bitmap;
+-
+ block->hdr.bitmap[0] |= (u8)(mask >> 0 * 8);
+ block->hdr.bitmap[1] |= (u8)(mask >> 1 * 8);
+ block->hdr.bitmap[2] |= (u8)(mask >> 2 * 8);
+@@ -87,8 +85,6 @@ static void afs_set_contig_bits(union afs_xdr_dir_block *block,
+ block->hdr.bitmap[5] |= (u8)(mask >> 5 * 8);
+ block->hdr.bitmap[6] |= (u8)(mask >> 6 * 8);
+ block->hdr.bitmap[7] |= (u8)(mask >> 7 * 8);
+-
+- after = *(u64 *)block->hdr.bitmap;
+ }
+
+ /*
+@@ -97,13 +93,11 @@ static void afs_set_contig_bits(union afs_xdr_dir_block *block,
+ static void afs_clear_contig_bits(union afs_xdr_dir_block *block,
+ int bit, unsigned int nr_slots)
+ {
+- u64 mask, before, after;
++ u64 mask;
+
+ mask = (1 << nr_slots) - 1;
+ mask <<= bit;
+
+- before = *(u64 *)block->hdr.bitmap;
+-
+ block->hdr.bitmap[0] &= ~(u8)(mask >> 0 * 8);
+ block->hdr.bitmap[1] &= ~(u8)(mask >> 1 * 8);
+ block->hdr.bitmap[2] &= ~(u8)(mask >> 2 * 8);
+@@ -112,8 +106,6 @@ static void afs_clear_contig_bits(union afs_xdr_dir_block *block,
+ block->hdr.bitmap[5] &= ~(u8)(mask >> 5 * 8);
+ block->hdr.bitmap[6] &= ~(u8)(mask >> 6 * 8);
+ block->hdr.bitmap[7] &= ~(u8)(mask >> 7 * 8);
+-
+- after = *(u64 *)block->hdr.bitmap;
+ }
+
+ /*
+diff --git a/fs/afs/file.c b/fs/afs/file.c
+index 843d3b970b84..0bd78df6a64e 100644
+--- a/fs/afs/file.c
++++ b/fs/afs/file.c
+@@ -169,11 +169,12 @@ int afs_release(struct inode *inode, struct file *file)
+ {
+ struct afs_vnode *vnode = AFS_FS_I(inode);
+ struct afs_file *af = file->private_data;
++ int ret = 0;
+
+ _enter("{%x:%u},", vnode->fid.vid, vnode->fid.vnode);
+
+ if ((file->f_mode & FMODE_WRITE))
+- return vfs_fsync(file, 0);
++ ret = vfs_fsync(file, 0);
+
+ file->private_data = NULL;
+ if (af->wb)
+@@ -181,8 +182,8 @@ int afs_release(struct inode *inode, struct file *file)
+ key_put(af->key);
+ kfree(af);
+ afs_prune_wb_keys(vnode);
+- _leave(" = 0");
+- return 0;
++ _leave(" = %d", ret);
++ return ret;
+ }
+
+ /*
+diff --git a/fs/afs/flock.c b/fs/afs/flock.c
+index 1bb300ef362b..fbf4986b1224 100644
+--- a/fs/afs/flock.c
++++ b/fs/afs/flock.c
+@@ -13,9 +13,11 @@
+
+ #define AFS_LOCK_GRANTED 0
+ #define AFS_LOCK_PENDING 1
++#define AFS_LOCK_YOUR_TRY 2
+
+ struct workqueue_struct *afs_lock_manager;
+
++static void afs_next_locker(struct afs_vnode *vnode, int error);
+ static void afs_fl_copy_lock(struct file_lock *new, struct file_lock *fl);
+ static void afs_fl_release_private(struct file_lock *fl);
+
+@@ -24,6 +26,12 @@ static const struct file_lock_operations afs_lock_ops = {
+ .fl_release_private = afs_fl_release_private,
+ };
+
++static inline void afs_set_lock_state(struct afs_vnode *vnode, enum afs_lock_state state)
++{
++ _debug("STATE %u -> %u", vnode->lock_state, state);
++ vnode->lock_state = state;
++}
++
+ /*
+ * if the callback is broken on this vnode, then the lock may now be available
+ */
+@@ -31,14 +39,17 @@ void afs_lock_may_be_available(struct afs_vnode *vnode)
+ {
+ _enter("{%x:%u}", vnode->fid.vid, vnode->fid.vnode);
+
+- queue_delayed_work(afs_lock_manager, &vnode->lock_work, 0);
++ spin_lock(&vnode->lock);
++ if (vnode->lock_state == AFS_VNODE_LOCK_WAITING_FOR_CB)
++ afs_next_locker(vnode, 0);
++ spin_unlock(&vnode->lock);
+ }
+
+ /*
+ * the lock will time out in 5 minutes unless we extend it, so schedule
+ * extension in a bit less than that time
+ */
+-static void afs_schedule_lock_extension(struct afs_vnode *vnode)
++static void __maybe_unused afs_schedule_lock_extension(struct afs_vnode *vnode)
+ {
+ queue_delayed_work(afs_lock_manager, &vnode->lock_work,
+ AFS_LOCKWAIT * HZ / 2);
+@@ -49,22 +60,65 @@ static void afs_schedule_lock_extension(struct afs_vnode *vnode)
+ * first lock in the queue is itself a readlock)
+ * - the caller must hold the vnode lock
+ */
+-static void afs_grant_locks(struct afs_vnode *vnode, struct file_lock *fl)
++static void afs_grant_locks(struct afs_vnode *vnode)
+ {
+ struct file_lock *p, *_p;
++ bool exclusive = (vnode->lock_type == AFS_LOCK_WRITE);
+
+- list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
+- if (fl->fl_type == F_RDLCK) {
+- list_for_each_entry_safe(p, _p, &vnode->pending_locks,
+- fl_u.afs.link) {
+- if (p->fl_type == F_RDLCK) {
+- p->fl_u.afs.state = AFS_LOCK_GRANTED;
+- list_move_tail(&p->fl_u.afs.link,
+- &vnode->granted_locks);
+- wake_up(&p->fl_wait);
+- }
++ list_for_each_entry_safe(p, _p, &vnode->pending_locks, fl_u.afs.link) {
++ if (!exclusive && p->fl_type == F_WRLCK)
++ continue;
++
++ list_move_tail(&p->fl_u.afs.link, &vnode->granted_locks);
++ p->fl_u.afs.state = AFS_LOCK_GRANTED;
++ wake_up(&p->fl_wait);
++ }
++}
++
++/*
++ * If an error is specified, reject every pending lock that matches the
++ * authentication and type of the lock we failed to get. If there are any
++ * remaining lockers, try to wake up one of them to have a go.
++ */
++static void afs_next_locker(struct afs_vnode *vnode, int error)
++{
++ struct file_lock *p, *_p, *next = NULL;
++ struct key *key = vnode->lock_key;
++ unsigned int fl_type = F_RDLCK;
++
++ _enter("");
++
++ if (vnode->lock_type == AFS_LOCK_WRITE)
++ fl_type = F_WRLCK;
++
++ list_for_each_entry_safe(p, _p, &vnode->pending_locks, fl_u.afs.link) {
++ if (error &&
++ p->fl_type == fl_type &&
++ afs_file_key(p->fl_file) == key) {
++ list_del_init(&p->fl_u.afs.link);
++ p->fl_u.afs.state = error;
++ wake_up(&p->fl_wait);
+ }
++
++ /* Select the next locker to hand off to. */
++ if (next &&
++ (next->fl_type == F_WRLCK || p->fl_type == F_RDLCK))
++ continue;
++ next = p;
++ }
++
++ vnode->lock_key = NULL;
++ key_put(key);
++
++ if (next) {
++ afs_set_lock_state(vnode, AFS_VNODE_LOCK_SETTING);
++ next->fl_u.afs.state = AFS_LOCK_YOUR_TRY;
++ wake_up(&next->fl_wait);
++ } else {
++ afs_set_lock_state(vnode, AFS_VNODE_LOCK_NONE);
+ }
++
++ _leave("");
+ }
+
+ /*
+@@ -170,8 +224,6 @@ void afs_lock_work(struct work_struct *work)
+ {
+ struct afs_vnode *vnode =
+ container_of(work, struct afs_vnode, lock_work.work);
+- struct file_lock *fl, *next;
+- afs_lock_type_t type;
+ struct key *key;
+ int ret;
+
+@@ -184,7 +236,7 @@ again:
+ switch (vnode->lock_state) {
+ case AFS_VNODE_LOCK_NEED_UNLOCK:
+ _debug("unlock");
+- vnode->lock_state = AFS_VNODE_LOCK_UNLOCKING;
++ afs_set_lock_state(vnode, AFS_VNODE_LOCK_UNLOCKING);
+ spin_unlock(&vnode->lock);
+
+ /* attempt to release the server lock; if it fails, we just
+@@ -196,22 +248,9 @@ again:
+ vnode->fid.vid, vnode->fid.vnode, ret);
+
+ spin_lock(&vnode->lock);
+- key_put(vnode->lock_key);
+- vnode->lock_key = NULL;
+- vnode->lock_state = AFS_VNODE_LOCK_NONE;
+-
+- if (list_empty(&vnode->pending_locks)) {
+- spin_unlock(&vnode->lock);
+- return;
+- }
+-
+- /* The new front of the queue now owns the state variables. */
+- next = list_entry(vnode->pending_locks.next,
+- struct file_lock, fl_u.afs.link);
+- vnode->lock_key = key_get(afs_file_key(next->fl_file));
+- vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+- vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+- goto again;
++ afs_next_locker(vnode, 0);
++ spin_unlock(&vnode->lock);
++ return;
+
+ /* If we've already got a lock, then it must be time to extend that
+ * lock as AFS locks time out after 5 minutes.
+@@ -222,7 +261,7 @@ again:
+ ASSERT(!list_empty(&vnode->granted_locks));
+
+ key = key_get(vnode->lock_key);
+- vnode->lock_state = AFS_VNODE_LOCK_EXTENDING;
++ afs_set_lock_state(vnode, AFS_VNODE_LOCK_EXTENDING);
+ spin_unlock(&vnode->lock);
+
+ ret = afs_extend_lock(vnode, key); /* RPC */
+@@ -236,72 +275,26 @@ again:
+
+ if (vnode->lock_state != AFS_VNODE_LOCK_EXTENDING)
+ goto again;
+- vnode->lock_state = AFS_VNODE_LOCK_GRANTED;
++ afs_set_lock_state(vnode, AFS_VNODE_LOCK_GRANTED);
+
+- if (ret == 0)
+- afs_schedule_lock_extension(vnode);
+- else
++ if (ret != 0)
+ queue_delayed_work(afs_lock_manager, &vnode->lock_work,
+ HZ * 10);
+ spin_unlock(&vnode->lock);
+ _leave(" [ext]");
+ return;
+
+- /* If we don't have a granted lock, then we must've been called
+- * back by the server, and so if might be possible to get a
+- * lock we're currently waiting for.
+- */
++ /* If we're waiting for a callback to indicate lock release, we can't
++ * actually rely on this, so need to recheck at regular intervals. The
++ * problem is that the server might not notify us if the lock just
++ * expires (say because a client died) rather than being explicitly
++ * released.
++ */
+ case AFS_VNODE_LOCK_WAITING_FOR_CB:
+- _debug("get");
+-
+- key = key_get(vnode->lock_key);
+- type = vnode->lock_type;
+- vnode->lock_state = AFS_VNODE_LOCK_SETTING;
++ _debug("retry");
++ afs_next_locker(vnode, 0);
+ spin_unlock(&vnode->lock);
+-
+- ret = afs_set_lock(vnode, key, type); /* RPC */
+- key_put(key);
+-
+- spin_lock(&vnode->lock);
+- switch (ret) {
+- case -EWOULDBLOCK:
+- _debug("blocked");
+- break;
+- case 0:
+- _debug("acquired");
+- vnode->lock_state = AFS_VNODE_LOCK_GRANTED;
+- /* Fall through */
+- default:
+- /* Pass the lock or the error onto the first locker in
+- * the list - if they're looking for this type of lock.
+- * If they're not, we assume that whoever asked for it
+- * took a signal.
+- */
+- if (list_empty(&vnode->pending_locks)) {
+- _debug("withdrawn");
+- vnode->lock_state = AFS_VNODE_LOCK_NEED_UNLOCK;
+- goto again;
+- }
+-
+- fl = list_entry(vnode->pending_locks.next,
+- struct file_lock, fl_u.afs.link);
+- type = (fl->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+- if (vnode->lock_type != type) {
+- _debug("changed");
+- vnode->lock_state = AFS_VNODE_LOCK_NEED_UNLOCK;
+- goto again;
+- }
+-
+- fl->fl_u.afs.state = ret;
+- if (ret == 0)
+- afs_grant_locks(vnode, fl);
+- else
+- list_del_init(&fl->fl_u.afs.link);
+- wake_up(&fl->fl_wait);
+- spin_unlock(&vnode->lock);
+- _leave(" [granted]");
+- return;
+- }
++ return;
+
+ default:
+ /* Looks like a lock request was withdrawn. */
+@@ -319,14 +312,15 @@ again:
+ */
+ static void afs_defer_unlock(struct afs_vnode *vnode)
+ {
+- _enter("");
++ _enter("%u", vnode->lock_state);
+
+- if (vnode->lock_state == AFS_VNODE_LOCK_GRANTED ||
+- vnode->lock_state == AFS_VNODE_LOCK_EXTENDING) {
++ if (list_empty(&vnode->granted_locks) &&
++ (vnode->lock_state == AFS_VNODE_LOCK_GRANTED ||
++ vnode->lock_state == AFS_VNODE_LOCK_EXTENDING)) {
+ cancel_delayed_work(&vnode->lock_work);
+
+- vnode->lock_state = AFS_VNODE_LOCK_NEED_UNLOCK;
+- afs_lock_may_be_available(vnode);
++ afs_set_lock_state(vnode, AFS_VNODE_LOCK_NEED_UNLOCK);
++ queue_delayed_work(afs_lock_manager, &vnode->lock_work, 0);
+ }
+ }
+
+@@ -375,50 +369,6 @@ static int afs_do_setlk_check(struct afs_vnode *vnode, struct key *key,
+ return 0;
+ }
+
+-/*
+- * Remove the front runner from the pending queue.
+- * - The caller must hold vnode->lock.
+- */
+-static void afs_dequeue_lock(struct afs_vnode *vnode, struct file_lock *fl)
+-{
+- struct file_lock *next;
+-
+- _enter("");
+-
+- /* ->lock_type, ->lock_key and ->lock_state only belong to this
+- * file_lock if we're at the front of the pending queue or if we have
+- * the lock granted or if the lock_state is NEED_UNLOCK or UNLOCKING.
+- */
+- if (vnode->granted_locks.next == &fl->fl_u.afs.link &&
+- vnode->granted_locks.prev == &fl->fl_u.afs.link) {
+- list_del_init(&fl->fl_u.afs.link);
+- afs_defer_unlock(vnode);
+- return;
+- }
+-
+- if (!list_empty(&vnode->granted_locks) ||
+- vnode->pending_locks.next != &fl->fl_u.afs.link) {
+- list_del_init(&fl->fl_u.afs.link);
+- return;
+- }
+-
+- list_del_init(&fl->fl_u.afs.link);
+- key_put(vnode->lock_key);
+- vnode->lock_key = NULL;
+- vnode->lock_state = AFS_VNODE_LOCK_NONE;
+-
+- if (list_empty(&vnode->pending_locks))
+- return;
+-
+- /* The new front of the queue now owns the state variables. */
+- next = list_entry(vnode->pending_locks.next,
+- struct file_lock, fl_u.afs.link);
+- vnode->lock_key = key_get(afs_file_key(next->fl_file));
+- vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+- vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+- afs_lock_may_be_available(vnode);
+-}
+-
+ /*
+ * request a lock on a file on the server
+ */
+@@ -432,10 +382,6 @@ static int afs_do_setlk(struct file *file, struct file_lock *fl)
+
+ _enter("{%x:%u},%u", vnode->fid.vid, vnode->fid.vnode, fl->fl_type);
+
+- /* only whole-file locks are supported */
+- if (fl->fl_start != 0 || fl->fl_end != OFFSET_MAX)
+- return -EINVAL;
+-
+ fl->fl_ops = &afs_lock_ops;
+ INIT_LIST_HEAD(&fl->fl_u.afs.link);
+ fl->fl_u.afs.state = AFS_LOCK_PENDING;
+@@ -447,44 +393,66 @@ static int afs_do_setlk(struct file *file, struct file_lock *fl)
+ return ret;
+
+ spin_lock(&vnode->lock);
++ list_add_tail(&fl->fl_u.afs.link, &vnode->pending_locks);
+
+- /* If we've already got a readlock on the server then we instantly
+- * grant another readlock, irrespective of whether there are any
+- * pending writelocks.
++ /* If we've already got a lock on the server then try to move to having
++ * the VFS grant the requested lock. Note that this means that other
++ * clients may get starved out.
+ */
+- if (type == AFS_LOCK_READ &&
+- vnode->lock_state == AFS_VNODE_LOCK_GRANTED &&
+- vnode->lock_type == AFS_LOCK_READ) {
+- _debug("instant readlock");
+- ASSERT(!list_empty(&vnode->granted_locks));
+- goto share_existing_lock;
+- }
++ _debug("try %u", vnode->lock_state);
++ if (vnode->lock_state == AFS_VNODE_LOCK_GRANTED) {
++ if (type == AFS_LOCK_READ) {
++ _debug("instant readlock");
++ list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
++ fl->fl_u.afs.state = AFS_LOCK_GRANTED;
++ goto vnode_is_locked_u;
++ }
+
+- list_add_tail(&fl->fl_u.afs.link, &vnode->pending_locks);
++ if (vnode->lock_type == AFS_LOCK_WRITE) {
++ _debug("instant writelock");
++ list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
++ fl->fl_u.afs.state = AFS_LOCK_GRANTED;
++ goto vnode_is_locked_u;
++ }
++ }
+
+ if (vnode->lock_state != AFS_VNODE_LOCK_NONE)
+ goto need_to_wait;
+
++try_to_lock:
+ /* We don't have a lock on this vnode and we aren't currently waiting
+ * for one either, so ask the server for a lock.
+ *
+ * Note that we need to be careful if we get interrupted by a signal
+ * after dispatching the request as we may still get the lock, even
+ * though we don't wait for the reply (it's not too bad a problem - the
+- * lock will expire in 10 mins anyway).
++ * lock will expire in 5 mins anyway).
+ */
+ _debug("not locked");
+ vnode->lock_key = key_get(key);
+ vnode->lock_type = type;
+- vnode->lock_state = AFS_VNODE_LOCK_SETTING;
++ afs_set_lock_state(vnode, AFS_VNODE_LOCK_SETTING);
+ spin_unlock(&vnode->lock);
+
+ ret = afs_set_lock(vnode, key, type); /* RPC */
+
+ spin_lock(&vnode->lock);
+ switch (ret) {
++ case -EKEYREJECTED:
++ case -EKEYEXPIRED:
++ case -EKEYREVOKED:
++ case -EPERM:
++ case -EACCES:
++ fl->fl_u.afs.state = ret;
++ list_del_init(&fl->fl_u.afs.link);
++ afs_next_locker(vnode, ret);
++ goto error_unlock;
++
+ default:
+- goto abort_attempt;
++ fl->fl_u.afs.state = ret;
++ list_del_init(&fl->fl_u.afs.link);
++ afs_next_locker(vnode, 0);
++ goto error_unlock;
+
+ case -EWOULDBLOCK:
+ /* The server doesn't have a lock-waiting queue, so the client
+@@ -494,29 +462,23 @@ static int afs_do_setlk(struct file *file, struct file_lock *fl)
+ _debug("would block");
+ ASSERT(list_empty(&vnode->granted_locks));
+ ASSERTCMP(vnode->pending_locks.next, ==, &fl->fl_u.afs.link);
+- vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+- goto need_to_wait;
++ goto lock_is_contended;
+
+ case 0:
+ _debug("acquired");
+- break;
++ afs_set_lock_state(vnode, AFS_VNODE_LOCK_GRANTED);
++ afs_grant_locks(vnode);
++ goto vnode_is_locked_u;
+ }
+
+- /* we've acquired a server lock, but it needs to be renewed after 5
+- * mins */
+- vnode->lock_state = AFS_VNODE_LOCK_GRANTED;
+- afs_schedule_lock_extension(vnode);
+-
+-share_existing_lock:
+- /* the lock has been granted as far as we're concerned... */
+- fl->fl_u.afs.state = AFS_LOCK_GRANTED;
+- list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
+-
+-given_lock:
+- /* ... but we do still need to get the VFS's blessing */
++vnode_is_locked_u:
+ spin_unlock(&vnode->lock);
++vnode_is_locked:
++ /* the lock has been granted by the server... */
++ ASSERTCMP(fl->fl_u.afs.state, ==, AFS_LOCK_GRANTED);
+
+- ret = posix_lock_file(file, fl, NULL);
++ /* ... but the VFS still needs to distribute access on this client. */
++ ret = locks_lock_file_wait(file, fl);
+ if (ret < 0)
+ goto vfs_rejected_lock;
+
+@@ -528,38 +490,61 @@ given_lock:
+ _leave(" = 0");
+ return 0;
+
++lock_is_contended:
++ if (!(fl->fl_flags & FL_SLEEP)) {
++ list_del_init(&fl->fl_u.afs.link);
++ afs_next_locker(vnode, 0);
++ ret = -EAGAIN;
++ goto error_unlock;
++ }
++
++ afs_set_lock_state(vnode, AFS_VNODE_LOCK_WAITING_FOR_CB);
++ queue_delayed_work(afs_lock_manager, &vnode->lock_work, HZ * 5);
++
+ need_to_wait:
+ /* We're going to have to wait. Either this client doesn't have a lock
+ * on the server yet and we need to wait for a callback to occur, or
+- * the client does have a lock on the server, but it belongs to some
+- * other process(es) and is incompatible with the lock we want.
++ * the client does have a lock on the server, but it's shared and we
++ * need an exclusive lock.
+ */
+- ret = -EAGAIN;
+- if (fl->fl_flags & FL_SLEEP) {
+- spin_unlock(&vnode->lock);
++ spin_unlock(&vnode->lock);
+
+- _debug("sleep");
+- ret = wait_event_interruptible(fl->fl_wait,
+- fl->fl_u.afs.state != AFS_LOCK_PENDING);
++ _debug("sleep");
++ ret = wait_event_interruptible(fl->fl_wait,
++ fl->fl_u.afs.state != AFS_LOCK_PENDING);
++ _debug("wait = %d", ret);
+
++ if (fl->fl_u.afs.state >= 0 && fl->fl_u.afs.state != AFS_LOCK_GRANTED) {
+ spin_lock(&vnode->lock);
+- }
+
+- if (fl->fl_u.afs.state == AFS_LOCK_GRANTED)
+- goto given_lock;
+- if (fl->fl_u.afs.state < 0)
+- ret = fl->fl_u.afs.state;
++ switch (fl->fl_u.afs.state) {
++ case AFS_LOCK_YOUR_TRY:
++ fl->fl_u.afs.state = AFS_LOCK_PENDING;
++ goto try_to_lock;
++ case AFS_LOCK_PENDING:
++ if (ret > 0) {
++ /* We need to retry the lock. We may not be
++ * notified by the server if it just expired
++ * rather than being released.
++ */
++ ASSERTCMP(vnode->lock_state, ==, AFS_VNODE_LOCK_WAITING_FOR_CB);
++ afs_set_lock_state(vnode, AFS_VNODE_LOCK_SETTING);
++ fl->fl_u.afs.state = AFS_LOCK_PENDING;
++ goto try_to_lock;
++ }
++ goto error_unlock;
++ case AFS_LOCK_GRANTED:
++ default:
++ break;
++ }
+
+-abort_attempt:
+- /* we aren't going to get the lock, either because we're unwilling to
+- * wait, or because some signal happened */
+- _debug("abort");
+- afs_dequeue_lock(vnode, fl);
++ spin_unlock(&vnode->lock);
++ }
+
+-error_unlock:
+- spin_unlock(&vnode->lock);
+- _leave(" = %d", ret);
+- return ret;
++ if (fl->fl_u.afs.state == AFS_LOCK_GRANTED)
++ goto vnode_is_locked;
++ ret = fl->fl_u.afs.state;
++ goto error;
+
+ vfs_rejected_lock:
+ /* The VFS rejected the lock we just obtained, so we have to discard
+@@ -569,9 +554,13 @@ vfs_rejected_lock:
+ _debug("vfs refused %d", ret);
+ spin_lock(&vnode->lock);
+ list_del_init(&fl->fl_u.afs.link);
+- if (list_empty(&vnode->granted_locks))
+- afs_defer_unlock(vnode);
+- goto error_unlock;
++ afs_defer_unlock(vnode);
++
++error_unlock:
++ spin_unlock(&vnode->lock);
++error:
++ _leave(" = %d", ret);
++ return ret;
+ }
+
+ /*
+@@ -587,11 +576,7 @@ static int afs_do_unlk(struct file *file, struct file_lock *fl)
+ /* Flush all pending writes before doing anything with locks. */
+ vfs_fsync(file, 0);
+
+- /* only whole-file unlocks are supported */
+- if (fl->fl_start != 0 || fl->fl_end != OFFSET_MAX)
+- return -EINVAL;
+-
+- ret = posix_lock_file(file, fl, NULL);
++ ret = locks_lock_file_wait(file, fl);
+ _leave(" = %d [%u]", ret, vnode->lock_state);
+ return ret;
+ }
+@@ -618,12 +603,15 @@ static int afs_do_getlk(struct file *file, struct file_lock *fl)
+ goto error;
+
+ lock_count = READ_ONCE(vnode->status.lock_count);
+- if (lock_count > 0)
+- fl->fl_type = F_RDLCK;
+- else
+- fl->fl_type = F_WRLCK;
+- fl->fl_start = 0;
+- fl->fl_end = OFFSET_MAX;
++ if (lock_count != 0) {
++ if (lock_count > 0)
++ fl->fl_type = F_RDLCK;
++ else
++ fl->fl_type = F_WRLCK;
++ fl->fl_start = 0;
++ fl->fl_end = OFFSET_MAX;
++ fl->fl_pid = 0;
++ }
+ }
+
+ ret = 0;
+@@ -710,7 +698,11 @@ static void afs_fl_release_private(struct file_lock *fl)
+ _enter("");
+
+ spin_lock(&vnode->lock);
+- afs_dequeue_lock(vnode, fl);
++
++ list_del_init(&fl->fl_u.afs.link);
++ if (list_empty(&vnode->granted_locks))
++ afs_defer_unlock(vnode);
++
+ _debug("state %u for %p", vnode->lock_state, vnode);
+ spin_unlock(&vnode->lock);
+ }
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 0726e40db0f8..e6f11da5461b 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -398,12 +398,9 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
+ vnode->cb_s_break = vnode->cb_interest->server->cb_s_break;
+ vnode->cb_v_break = vnode->volume->cb_v_break;
+ valid = false;
+- } else if (vnode->status.type == AFS_FTYPE_DIR &&
+- (!test_bit(AFS_VNODE_DIR_VALID, &vnode->flags) ||
+- vnode->cb_expires_at - 10 <= now)) {
++ } else if (test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags)) {
+ valid = false;
+- } else if (test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags) ||
+- vnode->cb_expires_at - 10 <= now) {
++ } else if (vnode->cb_expires_at - 10 <= now) {
+ valid = false;
+ } else {
+ valid = true;
+@@ -541,6 +538,7 @@ void afs_evict_inode(struct inode *inode)
+ }
+ #endif
+
++ afs_prune_wb_keys(vnode);
+ afs_put_permits(rcu_access_pointer(vnode->permit_cache));
+ key_put(vnode->lock_key);
+ vnode->lock_key = NULL;
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index 2543f24d23f8..560dd5ff5a15 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -573,6 +573,7 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
+ call->need_attention = false;
+ __set_current_state(TASK_RUNNING);
+ afs_deliver_to_call(call);
++ timeout = rtt2;
+ continue;
+ }
+
+diff --git a/fs/afs/security.c b/fs/afs/security.c
+index 81dfedb7879f..66042b432baa 100644
+--- a/fs/afs/security.c
++++ b/fs/afs/security.c
+@@ -87,11 +87,9 @@ void afs_clear_permits(struct afs_vnode *vnode)
+ permits = rcu_dereference_protected(vnode->permit_cache,
+ lockdep_is_held(&vnode->lock));
+ RCU_INIT_POINTER(vnode->permit_cache, NULL);
+- vnode->cb_break++;
+ spin_unlock(&vnode->lock);
+
+- if (permits)
+- afs_put_permits(permits);
++ afs_put_permits(permits);
+ }
+
+ /*
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index 18b9b7ca20c9..4961d32ccd1e 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -393,6 +393,7 @@ static int afs_fill_super(struct super_block *sb,
+ /* fill in the superblock */
+ sb->s_blocksize = PAGE_SIZE;
+ sb->s_blocksize_bits = PAGE_SHIFT;
++ sb->s_maxbytes = MAX_LFS_FILESIZE;
+ sb->s_magic = AFS_FS_MAGIC;
+ sb->s_op = &afs_super_ops;
+ if (!as->dyn_root)
+diff --git a/fs/afs/xattr.c b/fs/afs/xattr.c
+index cfcc674e64a5..411f67c79f09 100644
+--- a/fs/afs/xattr.c
++++ b/fs/afs/xattr.c
+@@ -50,7 +50,7 @@ static int afs_xattr_get_cell(const struct xattr_handler *handler,
+ return namelen;
+ if (namelen > size)
+ return -ERANGE;
+- memcpy(buffer, cell->name, size);
++ memcpy(buffer, cell->name, namelen);
+ return namelen;
+ }
+
+@@ -104,7 +104,7 @@ static int afs_xattr_get_volume(const struct xattr_handler *handler,
+ return namelen;
+ if (namelen > size)
+ return -ERANGE;
+- memcpy(buffer, volname, size);
++ memcpy(buffer, volname, namelen);
+ return namelen;
+ }
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 78490e544c91..c2c93fe9d7fd 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1895,7 +1895,7 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
+ bool sync = (file->f_flags & O_DSYNC) || IS_SYNC(file->f_mapping->host);
+ ssize_t err;
+ loff_t pos;
+- size_t count = iov_iter_count(from);
++ size_t count;
+ loff_t oldsize;
+ int clean_page = 0;
+
+@@ -1917,6 +1917,7 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
+ }
+
+ pos = iocb->ki_pos;
++ count = iov_iter_count(from);
+ if (iocb->ki_flags & IOCB_NOWAIT) {
+ /*
+ * We will allocate space in case nodatacow is not set,
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index e1b50c62ba65..c7dcb7c52108 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -12,6 +12,19 @@
+ #include "inode-map.h"
+ #include "transaction.h"
+
++static void fail_caching_thread(struct btrfs_root *root)
++{
++ struct btrfs_fs_info *fs_info = root->fs_info;
++
++ btrfs_warn(fs_info, "failed to start inode caching task");
++ btrfs_clear_pending_and_info(fs_info, INODE_MAP_CACHE,
++ "disabling inode map caching");
++ spin_lock(&root->ino_cache_lock);
++ root->ino_cache_state = BTRFS_CACHE_ERROR;
++ spin_unlock(&root->ino_cache_lock);
++ wake_up(&root->ino_cache_wait);
++}
++
+ static int caching_kthread(void *data)
+ {
+ struct btrfs_root *root = data;
+@@ -28,8 +41,10 @@ static int caching_kthread(void *data)
+ return 0;
+
+ path = btrfs_alloc_path();
+- if (!path)
++ if (!path) {
++ fail_caching_thread(root);
+ return -ENOMEM;
++ }
+
+ /* Since the commit root is read-only, we can safely skip locking. */
+ path->skip_locking = 1;
+@@ -145,6 +160,7 @@ static void start_caching(struct btrfs_root *root)
+ spin_lock(&root->ino_cache_lock);
+ root->ino_cache_state = BTRFS_CACHE_FINISHED;
+ spin_unlock(&root->ino_cache_lock);
++ wake_up(&root->ino_cache_wait);
+ return;
+ }
+
+@@ -163,11 +179,8 @@ static void start_caching(struct btrfs_root *root)
+
+ tsk = kthread_run(caching_kthread, root, "btrfs-ino-cache-%llu",
+ root->root_key.objectid);
+- if (IS_ERR(tsk)) {
+- btrfs_warn(fs_info, "failed to start inode caching task");
+- btrfs_clear_pending_and_info(fs_info, INODE_MAP_CACHE,
+- "disabling inode map caching");
+- }
++ if (IS_ERR(tsk))
++ fail_caching_thread(root);
+ }
+
+ int btrfs_find_free_ino(struct btrfs_root *root, u64 *objectid)
+@@ -185,11 +198,14 @@ again:
+
+ wait_event(root->ino_cache_wait,
+ root->ino_cache_state == BTRFS_CACHE_FINISHED ||
++ root->ino_cache_state == BTRFS_CACHE_ERROR ||
+ root->free_ino_ctl->free_space > 0);
+
+ if (root->ino_cache_state == BTRFS_CACHE_FINISHED &&
+ root->free_ino_ctl->free_space == 0)
+ return -ENOSPC;
++ else if (root->ino_cache_state == BTRFS_CACHE_ERROR)
++ return btrfs_find_free_objectid(root, objectid);
+ else
+ goto again;
+ }
+diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
+index 5e4f3f833e85..a09ce27ab220 100644
+--- a/fs/ceph/xattr.c
++++ b/fs/ceph/xattr.c
+@@ -221,7 +221,7 @@ static size_t ceph_vxattrcb_dir_rbytes(struct ceph_inode_info *ci, char *val,
+ static size_t ceph_vxattrcb_dir_rctime(struct ceph_inode_info *ci, char *val,
+ size_t size)
+ {
+- return snprintf(val, size, "%lld.09%ld", ci->i_rctime.tv_sec,
++ return snprintf(val, size, "%lld.%09ld", ci->i_rctime.tv_sec,
+ ci->i_rctime.tv_nsec);
+ }
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 7e85070d010f..576cf71576da 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -970,6 +970,7 @@ cifs_demultiplex_thread(void *p)
+ mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
+
+ set_freezable();
++ allow_kernel_signal(SIGKILL);
+ while (server->tcpStatus != CifsExiting) {
+ if (try_to_freeze())
+ continue;
+@@ -2454,7 +2455,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
+
+ task = xchg(&server->tsk, NULL);
+ if (task)
+- force_sig(SIGKILL, task);
++ send_sig(SIGKILL, task, 1);
+ }
+
+ static struct TCP_Server_Info *
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index 808cae6d5f50..ae3248326c44 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -147,6 +147,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt,
+ tmp = lookup_one_len_unlocked(nbuf, parent, strlen(nbuf));
+ if (IS_ERR(tmp)) {
+ dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
++ err = PTR_ERR(tmp);
+ goto out_err;
+ }
+ if (tmp != dentry) {
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 56f6e1782d5f..4572cb057951 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1419,7 +1419,7 @@ int htree_inlinedir_to_tree(struct file *dir_file,
+ err = ext4_htree_store_dirent(dir_file, hinfo->hash,
+ hinfo->minor_hash, de, &tmp_str);
+ if (err) {
+- count = err;
++ ret = err;
+ goto out;
+ }
+ count++;
+diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
+index 0d3d848d186b..ebe19894884b 100644
+--- a/fs/f2fs/dir.c
++++ b/fs/f2fs/dir.c
+@@ -572,6 +572,11 @@ add_dentry:
+
+ if (inode) {
+ f2fs_i_pino_write(inode, dir->i_ino);
++
++ /* synchronize inode page's data from inode cache */
++ if (is_inode_flag_set(inode, FI_NEW_INODE))
++ f2fs_update_inode(inode, page);
++
+ f2fs_put_page(page, 1);
+ }
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 72d154e71bb5..6b5b685af599 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -1701,7 +1701,7 @@ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
+ if (time_to_inject(sbi, FAULT_BLOCK)) {
+ f2fs_show_injection_info(FAULT_BLOCK);
+ release = *count;
+- goto enospc;
++ goto release_quota;
+ }
+
+ /*
+@@ -1741,6 +1741,7 @@ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
+
+ enospc:
+ percpu_counter_sub(&sbi->alloc_valid_block_count, release);
++release_quota:
+ dquot_release_reservation_block(inode, release);
+ return -ENOSPC;
+ }
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index 6bbb5f6801e2..c1ba29d10789 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -133,6 +133,7 @@ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page)
+
+ err = f2fs_get_node_info(fio.sbi, dn->nid, &ni);
+ if (err) {
++ f2fs_truncate_data_blocks_range(dn, 1);
+ f2fs_put_dnode(dn);
+ return err;
+ }
+@@ -577,6 +578,11 @@ int f2fs_add_inline_entry(struct inode *dir, const struct qstr *new_name,
+ /* we don't need to mark_inode_dirty now */
+ if (inode) {
+ f2fs_i_pino_write(inode, dir->i_ino);
++
++ /* synchronize inode page's data from inode cache */
++ if (is_inode_flag_set(inode, FI_NEW_INODE))
++ f2fs_update_inode(inode, page);
++
+ f2fs_put_page(page, 1);
+ }
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index a5663cb621d8..78789c5ed36b 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -1928,8 +1928,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+ * header ?
+ */
+ if (tlck->type & tlckTRUNCATE) {
+- /* This odd declaration suppresses a bogus gcc warning */
+- pxd_t pxd = pxd; /* truncated extent of xad */
++ pxd_t pxd; /* truncated extent of xad */
+ int twm;
+
+ /*
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 74ff459b75ef..b0c0c2fc2fba 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -240,6 +240,8 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation
+ spin_lock(&delegation->lock);
+ if (delegation->inode != NULL)
+ inode = igrab(delegation->inode);
++ if (!inode)
++ set_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags);
+ spin_unlock(&delegation->lock);
+ return inode;
+ }
+@@ -955,10 +957,11 @@ restart:
+ list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+ list_for_each_entry_rcu(delegation, &server->delegations,
+ super_list) {
+- if (test_bit(NFS_DELEGATION_RETURNING,
+- &delegation->flags))
+- continue;
+- if (test_bit(NFS_DELEGATION_NEED_RECLAIM,
++ if (test_bit(NFS_DELEGATION_INODE_FREEING,
++ &delegation->flags) ||
++ test_bit(NFS_DELEGATION_RETURNING,
++ &delegation->flags) ||
++ test_bit(NFS_DELEGATION_NEED_RECLAIM,
+ &delegation->flags) == 0)
+ continue;
+ if (!nfs_sb_active(server->super))
+@@ -1064,10 +1067,11 @@ restart:
+ list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+ list_for_each_entry_rcu(delegation, &server->delegations,
+ super_list) {
+- if (test_bit(NFS_DELEGATION_RETURNING,
+- &delegation->flags))
+- continue;
+- if (test_bit(NFS_DELEGATION_TEST_EXPIRED,
++ if (test_bit(NFS_DELEGATION_INODE_FREEING,
++ &delegation->flags) ||
++ test_bit(NFS_DELEGATION_RETURNING,
++ &delegation->flags) ||
++ test_bit(NFS_DELEGATION_TEST_EXPIRED,
+ &delegation->flags) == 0)
+ continue;
+ if (!nfs_sb_active(server->super))
+diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
+index dd0f3eed3890..f09b153ac82f 100644
+--- a/fs/nfs/delegation.h
++++ b/fs/nfs/delegation.h
+@@ -34,6 +34,7 @@ enum {
+ NFS_DELEGATION_RETURNING,
+ NFS_DELEGATION_REVOKED,
+ NFS_DELEGATION_TEST_EXPIRED,
++ NFS_DELEGATION_INODE_FREEING,
+ };
+
+ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred,
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
+index de50a342d5a5..2ac99124474c 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.h
++++ b/fs/nfs/flexfilelayout/flexfilelayout.h
+@@ -132,16 +132,6 @@ FF_LAYOUT_LSEG(struct pnfs_layout_segment *lseg)
+ generic_hdr);
+ }
+
+-static inline struct nfs4_deviceid_node *
+-FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx)
+-{
+- if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt ||
+- FF_LAYOUT_LSEG(lseg)->mirror_array[idx] == NULL ||
+- FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds == NULL)
+- return NULL;
+- return &FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds->id_node;
+-}
+-
+ static inline struct nfs4_ff_layout_ds *
+ FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node)
+ {
+@@ -151,9 +141,25 @@ FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node)
+ static inline struct nfs4_ff_layout_mirror *
+ FF_LAYOUT_COMP(struct pnfs_layout_segment *lseg, u32 idx)
+ {
+- if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt)
+- return NULL;
+- return FF_LAYOUT_LSEG(lseg)->mirror_array[idx];
++ struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg);
++
++ if (idx < fls->mirror_array_cnt)
++ return fls->mirror_array[idx];
++ return NULL;
++}
++
++static inline struct nfs4_deviceid_node *
++FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx)
++{
++ struct nfs4_ff_layout_mirror *mirror = FF_LAYOUT_COMP(lseg, idx);
++
++ if (mirror != NULL) {
++ struct nfs4_ff_layout_ds *mirror_ds = mirror->mirror_ds;
++
++ if (!IS_ERR_OR_NULL(mirror_ds))
++ return &mirror_ds->id_node;
++ }
++ return NULL;
+ }
+
+ static inline u32
+diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c
+index 69f72ed2bf87..ec9803088f6b 100644
+--- a/fs/nfs/nfs42xdr.c
++++ b/fs/nfs/nfs42xdr.c
+@@ -59,43 +59,53 @@
+ #define decode_clone_maxsz (op_decode_hdr_maxsz)
+
+ #define NFS4_enc_allocate_sz (compound_encode_hdr_maxsz + \
++ encode_sequence_maxsz + \
+ encode_putfh_maxsz + \
+ encode_allocate_maxsz + \
+ encode_getattr_maxsz)
+ #define NFS4_dec_allocate_sz (compound_decode_hdr_maxsz + \
++ decode_sequence_maxsz + \
+ decode_putfh_maxsz + \
+ decode_allocate_maxsz + \
+ decode_getattr_maxsz)
+ #define NFS4_enc_copy_sz (compound_encode_hdr_maxsz + \
++ encode_sequence_maxsz + \
+ encode_putfh_maxsz + \
+ encode_savefh_maxsz + \
+ encode_putfh_maxsz + \
+ encode_copy_maxsz + \
+ encode_commit_maxsz)
+ #define NFS4_dec_copy_sz (compound_decode_hdr_maxsz + \
++ decode_sequence_maxsz + \
+ decode_putfh_maxsz + \
+ decode_savefh_maxsz + \
+ decode_putfh_maxsz + \
+ decode_copy_maxsz + \
+ decode_commit_maxsz)
+ #define NFS4_enc_offload_cancel_sz (compound_encode_hdr_maxsz + \
++ encode_sequence_maxsz + \
+ encode_putfh_maxsz + \
+ encode_offload_cancel_maxsz)
+ #define NFS4_dec_offload_cancel_sz (compound_decode_hdr_maxsz + \
++ decode_sequence_maxsz + \
+ decode_putfh_maxsz + \
+ decode_offload_cancel_maxsz)
+ #define NFS4_enc_deallocate_sz (compound_encode_hdr_maxsz + \
++ encode_sequence_maxsz + \
+ encode_putfh_maxsz + \
+ encode_deallocate_maxsz + \
+ encode_getattr_maxsz)
+ #define NFS4_dec_deallocate_sz (compound_decode_hdr_maxsz + \
++ decode_sequence_maxsz + \
+ decode_putfh_maxsz + \
+ decode_deallocate_maxsz + \
+ decode_getattr_maxsz)
+ #define NFS4_enc_seek_sz (compound_encode_hdr_maxsz + \
++ encode_sequence_maxsz + \
+ encode_putfh_maxsz + \
+ encode_seek_maxsz)
+ #define NFS4_dec_seek_sz (compound_decode_hdr_maxsz + \
++ decode_sequence_maxsz + \
+ decode_putfh_maxsz + \
+ decode_seek_maxsz)
+ #define NFS4_enc_layoutstats_sz (compound_encode_hdr_maxsz + \
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index c818f9886f61..66f699e18755 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -758,22 +758,35 @@ static int
+ pnfs_layout_bulk_destroy_byserver_locked(struct nfs_client *clp,
+ struct nfs_server *server,
+ struct list_head *layout_list)
++ __must_hold(&clp->cl_lock)
++ __must_hold(RCU)
+ {
+ struct pnfs_layout_hdr *lo, *next;
+ struct inode *inode;
+
+ list_for_each_entry_safe(lo, next, &server->layouts, plh_layouts) {
+- if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags))
++ if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) ||
++ test_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags) ||
++ !list_empty(&lo->plh_bulk_destroy))
+ continue;
++ /* If the sb is being destroyed, just bail */
++ if (!nfs_sb_active(server->super))
++ break;
+ inode = igrab(lo->plh_inode);
+- if (inode == NULL)
+- continue;
+- list_del_init(&lo->plh_layouts);
+- if (pnfs_layout_add_bulk_destroy_list(inode, layout_list))
+- continue;
+- rcu_read_unlock();
+- spin_unlock(&clp->cl_lock);
+- iput(inode);
++ if (inode != NULL) {
++ list_del_init(&lo->plh_layouts);
++ if (pnfs_layout_add_bulk_destroy_list(inode,
++ layout_list))
++ continue;
++ rcu_read_unlock();
++ spin_unlock(&clp->cl_lock);
++ iput(inode);
++ } else {
++ rcu_read_unlock();
++ spin_unlock(&clp->cl_lock);
++ set_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags);
++ }
++ nfs_sb_deactive(server->super);
+ spin_lock(&clp->cl_lock);
+ rcu_read_lock();
+ return -EAGAIN;
+@@ -811,7 +824,7 @@ pnfs_layout_free_bulk_destroy_list(struct list_head *layout_list,
+ /* Free all lsegs that are attached to commit buckets */
+ nfs_commit_inode(inode, 0);
+ pnfs_put_layout_hdr(lo);
+- iput(inode);
++ nfs_iput_and_deactive(inode);
+ }
+ return ret;
+ }
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index ece367ebde69..3ba44819a88a 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -104,6 +104,7 @@ enum {
+ NFS_LAYOUT_RETURN_REQUESTED, /* Return this layout ASAP */
+ NFS_LAYOUT_INVALID_STID, /* layout stateid id is invalid */
+ NFS_LAYOUT_FIRST_LAYOUTGET, /* Serialize first layoutget */
++ NFS_LAYOUT_INODE_FREEING, /* The inode is being freed */
+ };
+
+ enum layoutdriver_policy_flags {
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index d90efdea9fbd..5db7aceb4190 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1930,7 +1930,7 @@ static int nfs_parse_devname(const char *dev_name,
+ /* kill possible hostname list: not supported */
+ comma = strchr(dev_name, ',');
+ if (comma != NULL && comma < end)
+- *comma = 0;
++ len = comma - dev_name;
+ }
+
+ if (len > maxnamlen)
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 117ffd90419e..e27637fa0f79 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -646,7 +646,7 @@ out:
+ return ret;
+ out_launder:
+ nfs_write_error_remove_page(req);
+- return ret;
++ return 0;
+ }
+
+ static int nfs_do_writepage(struct page *page, struct writeback_control *wbc,
+diff --git a/fs/xfs/xfs_quotaops.c b/fs/xfs/xfs_quotaops.c
+index a7c0c657dfaf..13ca7c16bfc7 100644
+--- a/fs/xfs/xfs_quotaops.c
++++ b/fs/xfs/xfs_quotaops.c
+@@ -202,6 +202,9 @@ xfs_fs_rm_xquota(
+ if (XFS_IS_QUOTA_ON(mp))
+ return -EINVAL;
+
++ if (uflags & ~(FS_USER_QUOTA | FS_GROUP_QUOTA | FS_PROJ_QUOTA))
++ return -EINVAL;
++
+ if (uflags & FS_USER_QUOTA)
+ flags |= XFS_DQ_USER;
+ if (uflags & FS_GROUP_QUOTA)
+diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h
+index 777814755fa6..675aa1e876ce 100644
+--- a/include/drm/drm_panel.h
++++ b/include/drm/drm_panel.h
+@@ -24,6 +24,7 @@
+ #ifndef __DRM_PANEL_H__
+ #define __DRM_PANEL_H__
+
++#include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/list.h>
+
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index df1252e22dcf..cd412817654f 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -917,26 +917,18 @@ int acpi_subsys_prepare(struct device *dev);
+ void acpi_subsys_complete(struct device *dev);
+ int acpi_subsys_suspend_late(struct device *dev);
+ int acpi_subsys_suspend_noirq(struct device *dev);
+-int acpi_subsys_resume_noirq(struct device *dev);
+-int acpi_subsys_resume_early(struct device *dev);
+ int acpi_subsys_suspend(struct device *dev);
+ int acpi_subsys_freeze(struct device *dev);
+-int acpi_subsys_freeze_late(struct device *dev);
+-int acpi_subsys_freeze_noirq(struct device *dev);
+-int acpi_subsys_thaw_noirq(struct device *dev);
++int acpi_subsys_poweroff(struct device *dev);
+ #else
+ static inline int acpi_dev_resume_early(struct device *dev) { return 0; }
+ static inline int acpi_subsys_prepare(struct device *dev) { return 0; }
+ static inline void acpi_subsys_complete(struct device *dev) {}
+ static inline int acpi_subsys_suspend_late(struct device *dev) { return 0; }
+ static inline int acpi_subsys_suspend_noirq(struct device *dev) { return 0; }
+-static inline int acpi_subsys_resume_noirq(struct device *dev) { return 0; }
+-static inline int acpi_subsys_resume_early(struct device *dev) { return 0; }
+ static inline int acpi_subsys_suspend(struct device *dev) { return 0; }
+ static inline int acpi_subsys_freeze(struct device *dev) { return 0; }
+-static inline int acpi_subsys_freeze_late(struct device *dev) { return 0; }
+-static inline int acpi_subsys_freeze_noirq(struct device *dev) { return 0; }
+-static inline int acpi_subsys_thaw_noirq(struct device *dev) { return 0; }
++static inline int acpi_subsys_poweroff(struct device *dev) { return 0; }
+ #endif
+
+ #ifdef CONFIG_ACPI
+diff --git a/include/linux/device.h b/include/linux/device.h
+index 19dd8852602c..c74ce473589a 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -701,7 +701,8 @@ extern unsigned long devm_get_free_pages(struct device *dev,
+ gfp_t gfp_mask, unsigned int order);
+ extern void devm_free_pages(struct device *dev, unsigned long addr);
+
+-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res);
++void __iomem *devm_ioremap_resource(struct device *dev,
++ const struct resource *res);
+
+ void __iomem *devm_of_iomap(struct device *dev,
+ struct device_node *node, int index,
+@@ -849,11 +850,12 @@ struct device_link {
+ struct list_head c_node;
+ enum device_link_state status;
+ u32 flags;
+- bool rpm_active;
++ refcount_t rpm_active;
+ struct kref kref;
+ #ifdef CONFIG_SRCU
+ struct rcu_head rcu_head;
+ #endif
++ bool supplier_preactivated; /* Owned by consumer probe. */
+ };
+
+ /**
+diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
+index 3188c0bef3e7..1d21e98d6854 100644
+--- a/include/linux/irqchip/arm-gic-v3.h
++++ b/include/linux/irqchip/arm-gic-v3.h
+@@ -165,7 +165,7 @@
+ #define GICR_PROPBASER_nCnB GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nCnB)
+ #define GICR_PROPBASER_nC GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nC)
+ #define GICR_PROPBASER_RaWt GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt)
+-#define GICR_PROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt)
++#define GICR_PROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWb)
+ #define GICR_PROPBASER_WaWt GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWt)
+ #define GICR_PROPBASER_WaWb GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWb)
+ #define GICR_PROPBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWaWt)
+@@ -192,7 +192,7 @@
+ #define GICR_PENDBASER_nCnB GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nCnB)
+ #define GICR_PENDBASER_nC GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nC)
+ #define GICR_PENDBASER_RaWt GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt)
+-#define GICR_PENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt)
++#define GICR_PENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWb)
+ #define GICR_PENDBASER_WaWt GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWt)
+ #define GICR_PENDBASER_WaWb GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWb)
+ #define GICR_PENDBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWaWt)
+@@ -251,7 +251,7 @@
+ #define GICR_VPROPBASER_nCnB GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nCnB)
+ #define GICR_VPROPBASER_nC GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nC)
+ #define GICR_VPROPBASER_RaWt GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt)
+-#define GICR_VPROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt)
++#define GICR_VPROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWb)
+ #define GICR_VPROPBASER_WaWt GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWt)
+ #define GICR_VPROPBASER_WaWb GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWb)
+ #define GICR_VPROPBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWaWt)
+@@ -277,7 +277,7 @@
+ #define GICR_VPENDBASER_nCnB GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nCnB)
+ #define GICR_VPENDBASER_nC GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nC)
+ #define GICR_VPENDBASER_RaWt GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt)
+-#define GICR_VPENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt)
++#define GICR_VPENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWb)
+ #define GICR_VPENDBASER_WaWt GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWt)
+ #define GICR_VPENDBASER_WaWb GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWb)
+ #define GICR_VPENDBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWaWt)
+@@ -351,7 +351,7 @@
+ #define GITS_CBASER_nCnB GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nCnB)
+ #define GITS_CBASER_nC GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nC)
+ #define GITS_CBASER_RaWt GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt)
+-#define GITS_CBASER_RaWb GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt)
++#define GITS_CBASER_RaWb GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWb)
+ #define GITS_CBASER_WaWt GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWt)
+ #define GITS_CBASER_WaWb GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWb)
+ #define GITS_CBASER_RaWaWt GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWaWt)
+@@ -375,7 +375,7 @@
+ #define GITS_BASER_nCnB GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nCnB)
+ #define GITS_BASER_nC GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nC)
+ #define GITS_BASER_RaWt GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt)
+-#define GITS_BASER_RaWb GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt)
++#define GITS_BASER_RaWb GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWb)
+ #define GITS_BASER_WaWt GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWt)
+ #define GITS_BASER_WaWb GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWb)
+ #define GITS_BASER_RaWaWt GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWaWt)
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index 177f11c96187..76b76b6aa83d 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -9053,8 +9053,6 @@ struct mlx5_ifc_query_lag_out_bits {
+
+ u8 syndrome[0x20];
+
+- u8 reserved_at_40[0x40];
+-
+ struct mlx5_ifc_lagc_bits ctx;
+ };
+
+diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
+index 4224902a8e22..358d6be357ed 100644
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -68,6 +68,8 @@
+
+ #define SDIO_VENDOR_ID_TI 0x0097
+ #define SDIO_DEVICE_ID_TI_WL1271 0x4076
++#define SDIO_VENDOR_ID_TI_WL1251 0x104c
++#define SDIO_DEVICE_ID_TI_WL1251 0x9066
+
+ #define SDIO_VENDOR_ID_STE 0x0020
+ #define SDIO_DEVICE_ID_STE_CW1200 0x2280
+diff --git a/include/linux/of.h b/include/linux/of.h
+index d5a863c1ee39..d4f14b0302b6 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -1001,7 +1001,7 @@ static inline struct device_node *of_find_matching_node(
+
+ static inline const char *of_node_get_device_type(const struct device_node *np)
+ {
+- return of_get_property(np, "type", NULL);
++ return of_get_property(np, "device_type", NULL);
+ }
+
+ static inline bool of_node_is_type(const struct device_node *np, const char *type)
+@@ -1425,7 +1425,8 @@ int of_overlay_notifier_unregister(struct notifier_block *nb);
+
+ #else
+
+-static inline int of_overlay_fdt_apply(void *overlay_fdt, int *ovcs_id)
++static inline int of_overlay_fdt_apply(void *overlay_fdt, u32 overlay_fdt_size,
++ int *ovcs_id)
+ {
+ return -ENOTSUPP;
+ }
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index b22bc81f3669..d8b4d31acd18 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -494,6 +494,11 @@ struct perf_addr_filters_head {
+ unsigned int nr_file_filters;
+ };
+
++struct perf_addr_filter_range {
++ unsigned long start;
++ unsigned long size;
++};
++
+ /**
+ * enum perf_event_state - the states of an event:
+ */
+@@ -670,7 +675,7 @@ struct perf_event {
+ /* address range filters */
+ struct perf_addr_filters_head addr_filters;
+ /* vma address array for file-based filders */
+- unsigned long *addr_filters_offs;
++ struct perf_addr_filter_range *addr_filter_ranges;
+ unsigned long addr_filters_gen;
+
+ void (*destroy)(struct perf_event *);
+diff --git a/include/linux/platform_data/dma-imx-sdma.h b/include/linux/platform_data/dma-imx-sdma.h
+index 6eaa53cef0bd..30e676b36b24 100644
+--- a/include/linux/platform_data/dma-imx-sdma.h
++++ b/include/linux/platform_data/dma-imx-sdma.h
+@@ -51,7 +51,10 @@ struct sdma_script_start_addrs {
+ /* End of v2 array */
+ s32 zcanfd_2_mcu_addr;
+ s32 zqspi_2_mcu_addr;
++ s32 mcu_2_ecspi_addr;
+ /* End of v3 array */
++ s32 mcu_2_zqspi_addr;
++ /* End of v4 array */
+ };
+
+ /**
+diff --git a/include/linux/rtc.h b/include/linux/rtc.h
+index 6aedc30003e7..5a34f59941fb 100644
+--- a/include/linux/rtc.h
++++ b/include/linux/rtc.h
+@@ -163,7 +163,7 @@ struct rtc_device {
+ #define to_rtc_device(d) container_of(d, struct rtc_device, dev)
+
+ /* useful timestamps */
+-#define RTC_TIMESTAMP_BEGIN_1900 -2208989361LL /* 1900-01-01 00:00:00 */
++#define RTC_TIMESTAMP_BEGIN_1900 -2208988800LL /* 1900-01-01 00:00:00 */
+ #define RTC_TIMESTAMP_BEGIN_2000 946684800LL /* 2000-01-01 00:00:00 */
+ #define RTC_TIMESTAMP_END_2099 4102444799LL /* 2099-12-31 23:59:59 */
+
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index e4d01469ed60..0be5ce2375cb 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -272,6 +272,9 @@ extern void signal_setup_done(int failed, struct ksignal *ksig, int stepping);
+ extern void exit_signals(struct task_struct *tsk);
+ extern void kernel_sigaction(int, __sighandler_t);
+
++#define SIG_KTHREAD ((__force __sighandler_t)2)
++#define SIG_KTHREAD_KERNEL ((__force __sighandler_t)3)
++
+ static inline void allow_signal(int sig)
+ {
+ /*
+@@ -279,7 +282,17 @@ static inline void allow_signal(int sig)
+ * know it'll be handled, so that they don't get converted to
+ * SIGKILL or just silently dropped.
+ */
+- kernel_sigaction(sig, (__force __sighandler_t)2);
++ kernel_sigaction(sig, SIG_KTHREAD);
++}
++
++static inline void allow_kernel_signal(int sig)
++{
++ /*
++ * Kernel threads handle their own signals. Let the signal code
++ * know signals sent by the kernel will be handled, so that they
++ * don't get silently dropped.
++ */
++ kernel_sigaction(sig, SIG_KTHREAD_KERNEL);
+ }
+
+ static inline void disallow_signal(int sig)
+diff --git a/include/linux/switchtec.h b/include/linux/switchtec.h
+index ab400af6f0ce..623719c91706 100644
+--- a/include/linux/switchtec.h
++++ b/include/linux/switchtec.h
+@@ -244,8 +244,8 @@ struct ntb_ctrl_regs {
+ u64 xlate_addr;
+ } bar_entry[6];
+ u32 reserved2[216];
+- u32 req_id_table[256];
+- u32 reserved3[512];
++ u32 req_id_table[512];
++ u32 reserved3[256];
+ u64 lut_entry[512];
+ } __packed;
+
+diff --git a/include/linux/usb/tcpm.h b/include/linux/usb/tcpm.h
+index 50c74a77db55..8cb93aff69f1 100644
+--- a/include/linux/usb/tcpm.h
++++ b/include/linux/usb/tcpm.h
+@@ -121,10 +121,10 @@ struct tcpc_config {
+ * with partner.
+ * @set_pd_rx: Called to enable or disable reception of PD messages
+ * @set_roles: Called to set power and data roles
+- * @start_drp_toggling:
+- * Optional; if supported by hardware, called to start DRP
+- * toggling. DRP toggling is stopped automatically if
+- * a connection is established.
++ * @start_toggling:
++ * Optional; if supported by hardware, called to start dual-role
++ * toggling or single-role connection detection. Toggling stops
++ * automatically if a connection is established.
+ * @try_role: Optional; called to set a preferred role
+ * @pd_transmit:Called to transmit PD message
+ * @mux: Pointer to multiplexer data
+@@ -147,8 +147,9 @@ struct tcpc_dev {
+ int (*set_pd_rx)(struct tcpc_dev *dev, bool on);
+ int (*set_roles)(struct tcpc_dev *dev, bool attached,
+ enum typec_role role, enum typec_data_role data);
+- int (*start_drp_toggling)(struct tcpc_dev *dev,
+- enum typec_cc_status cc);
++ int (*start_toggling)(struct tcpc_dev *dev,
++ enum typec_port_type port_type,
++ enum typec_cc_status cc);
+ int (*try_role)(struct tcpc_dev *dev, int role);
+ int (*pd_transmit)(struct tcpc_dev *dev, enum tcpm_transmit_type type,
+ const struct pd_message *msg);
+diff --git a/include/media/davinci/vpbe.h b/include/media/davinci/vpbe.h
+index 79a566d7defd..180a05e91497 100644
+--- a/include/media/davinci/vpbe.h
++++ b/include/media/davinci/vpbe.h
+@@ -92,7 +92,7 @@ struct vpbe_config {
+ struct encoder_config_info *ext_encoders;
+ /* amplifier information goes here */
+ struct amp_config_info *amp;
+- int num_outputs;
++ unsigned int num_outputs;
+ /* Order is venc outputs followed by LCD and then external encoders */
+ struct vpbe_output *outputs;
+ };
+diff --git a/include/net/request_sock.h b/include/net/request_sock.h
+index 347015515a7d..1653435f18f5 100644
+--- a/include/net/request_sock.h
++++ b/include/net/request_sock.h
+@@ -183,7 +183,7 @@ void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req,
+
+ static inline bool reqsk_queue_empty(const struct request_sock_queue *queue)
+ {
+- return queue->rskq_accept_head == NULL;
++ return READ_ONCE(queue->rskq_accept_head) == NULL;
+ }
+
+ static inline struct request_sock *reqsk_queue_remove(struct request_sock_queue *queue,
+@@ -195,7 +195,7 @@ static inline struct request_sock *reqsk_queue_remove(struct request_sock_queue
+ req = queue->rskq_accept_head;
+ if (req) {
+ sk_acceptq_removed(parent);
+- queue->rskq_accept_head = req->dl_next;
++ WRITE_ONCE(queue->rskq_accept_head, req->dl_next);
+ if (queue->rskq_accept_head == NULL)
+ queue->rskq_accept_tail = NULL;
+ }
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 2abbc15824af..2c6570e6fcfe 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -625,4 +625,9 @@ static inline __u32 sctp_min_frag_point(struct sctp_sock *sp, __u16 datasize)
+ return sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT, datasize);
+ }
+
++static inline bool sctp_newsk_ready(const struct sock *sk)
++{
++ return sock_flag(sk, SOCK_DEAD) || sk->sk_socket;
++}
++
+ #endif /* __net_sctp_h__ */
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index ac4ffe8013d8..918bfd0d7d1f 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -261,7 +261,7 @@ static inline bool tcp_under_memory_pressure(const struct sock *sk)
+ mem_cgroup_under_socket_pressure(sk->sk_memcg))
+ return true;
+
+- return tcp_memory_pressure;
++ return READ_ONCE(tcp_memory_pressure);
+ }
+ /*
+ * The next routines deal with comparing 32 bit unsigned ints
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index fb9b19a3b749..48dc1ce2170d 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1054,7 +1054,6 @@ static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
+ void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
+
+ struct xfrm_if_parms {
+- char name[IFNAMSIZ]; /* name of XFRM device */
+ int link; /* ifindex of underlying L2 interface */
+ u32 if_id; /* interface identifyer */
+ };
+diff --git a/include/sound/soc.h b/include/sound/soc.h
+index 41cec42fb456..88aa48e5485f 100644
+--- a/include/sound/soc.h
++++ b/include/sound/soc.h
+@@ -548,12 +548,12 @@ static inline void snd_soc_jack_free_gpios(struct snd_soc_jack *jack, int count,
+ }
+ #endif
+
+-#ifdef CONFIG_SND_SOC_AC97_BUS
+ struct snd_ac97 *snd_soc_alloc_ac97_component(struct snd_soc_component *component);
+ struct snd_ac97 *snd_soc_new_ac97_component(struct snd_soc_component *component,
+ unsigned int id, unsigned int id_mask);
+ void snd_soc_free_ac97_component(struct snd_ac97 *ac97);
+
++#ifdef CONFIG_SND_SOC_AC97_BUS
+ int snd_soc_set_ac97_ops(struct snd_ac97_bus_ops *ops);
+ int snd_soc_set_ac97_ops_of_reset(struct snd_ac97_bus_ops *ops,
+ struct platform_device *pdev);
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index a08916eb7615..0924119bcfa4 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -554,10 +554,10 @@ TRACE_EVENT(rxrpc_peer,
+ );
+
+ TRACE_EVENT(rxrpc_conn,
+- TP_PROTO(struct rxrpc_connection *conn, enum rxrpc_conn_trace op,
++ TP_PROTO(unsigned int conn_debug_id, enum rxrpc_conn_trace op,
+ int usage, const void *where),
+
+- TP_ARGS(conn, op, usage, where),
++ TP_ARGS(conn_debug_id, op, usage, where),
+
+ TP_STRUCT__entry(
+ __field(unsigned int, conn )
+@@ -567,7 +567,7 @@ TRACE_EVENT(rxrpc_conn,
+ ),
+
+ TP_fast_assign(
+- __entry->conn = conn->debug_id;
++ __entry->conn = conn_debug_id;
+ __entry->op = op;
+ __entry->usage = usage;
+ __entry->where = where;
+diff --git a/include/uapi/linux/btf.h b/include/uapi/linux/btf.h
+index 972265f32871..1e2662ff0529 100644
+--- a/include/uapi/linux/btf.h
++++ b/include/uapi/linux/btf.h
+@@ -22,9 +22,9 @@ struct btf_header {
+ };
+
+ /* Max # of type identifier */
+-#define BTF_MAX_TYPE 0x0000ffff
++#define BTF_MAX_TYPE 0x000fffff
+ /* Max offset into the string section */
+-#define BTF_MAX_NAME_OFFSET 0x0000ffff
++#define BTF_MAX_NAME_OFFSET 0x00ffffff
+ /* Max # of struct/union/enum members or func args */
+ #define BTF_MAX_VLEN 0xffff
+
+diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
+index 325ec6ef0a76..5eac62e1b68d 100644
+--- a/include/uapi/linux/netfilter/nf_tables.h
++++ b/include/uapi/linux/netfilter/nf_tables.h
+@@ -1128,7 +1128,7 @@ enum nft_log_level {
+ NFT_LOGLEVEL_AUDIT,
+ __NFT_LOGLEVEL_MAX
+ };
+-#define NFT_LOGLEVEL_MAX (__NFT_LOGLEVEL_MAX + 1)
++#define NFT_LOGLEVEL_MAX (__NFT_LOGLEVEL_MAX - 1)
+
+ /**
+ * enum nft_queue_attributes - nf_tables queue expression netlink attributes
+diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
+index 177a52436394..86477f3894e5 100644
+--- a/kernel/bpf/offload.c
++++ b/kernel/bpf/offload.c
+@@ -645,8 +645,10 @@ struct bpf_offload_dev *bpf_offload_dev_create(void)
+ down_write(&bpf_devs_lock);
+ if (!offdevs_inited) {
+ err = rhashtable_init(&offdevs, &offdevs_params);
+- if (err)
++ if (err) {
++ up_write(&bpf_devs_lock);
+ return ERR_PTR(err);
++ }
+ offdevs_inited = true;
+ }
+ up_write(&bpf_devs_lock);
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 9bbfb1ff4ac9..e85636fb81b9 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1253,7 +1253,7 @@ static int check_stack_access(struct bpf_verifier_env *env,
+ char tn_buf[48];
+
+ tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
+- verbose(env, "variable stack access var_off=%s off=%d size=%d",
++ verbose(env, "variable stack access var_off=%s off=%d size=%d\n",
+ tn_buf, off, size);
+ return -EACCES;
+ }
+diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
+index f338d23b112b..dc6bf35e7884 100644
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -2604,7 +2604,7 @@ static int kdb_per_cpu(int argc, const char **argv)
+ diag = kdbgetularg(argv[3], &whichcpu);
+ if (diag)
+ return diag;
+- if (!cpu_online(whichcpu)) {
++ if (whichcpu >= nr_cpu_ids || !cpu_online(whichcpu)) {
+ kdb_printf("cpu %ld is not online\n", whichcpu);
+ return KDB_BADCPUNUM;
+ }
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 460d5fd3ec4e..16af86ab24c4 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -1254,6 +1254,7 @@ static void put_ctx(struct perf_event_context *ctx)
+ * perf_event_context::lock
+ * perf_event::mmap_mutex
+ * mmap_sem
++ * perf_addr_filters_head::lock
+ *
+ * cpu_hotplug_lock
+ * pmus_lock
+@@ -2803,7 +2804,7 @@ static int perf_event_stop(struct perf_event *event, int restart)
+ *
+ * (p1) when userspace mappings change as a result of (1) or (2) or (3) below,
+ * we update the addresses of corresponding vmas in
+- * event::addr_filters_offs array and bump the event::addr_filters_gen;
++ * event::addr_filter_ranges array and bump the event::addr_filters_gen;
+ * (p2) when an event is scheduled in (pmu::add), it calls
+ * perf_event_addr_filters_sync() which calls pmu::addr_filters_sync()
+ * if the generation has changed since the previous call.
+@@ -4447,7 +4448,7 @@ static void _free_event(struct perf_event *event)
+
+ perf_event_free_bpf_prog(event);
+ perf_addr_filters_splice(event, NULL);
+- kfree(event->addr_filters_offs);
++ kfree(event->addr_filter_ranges);
+
+ if (event->destroy)
+ event->destroy(event);
+@@ -5011,6 +5012,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
+ if (perf_event_check_period(event, value))
+ return -EINVAL;
+
++ if (!event->attr.freq && (value & (1ULL << 63)))
++ return -EINVAL;
++
+ event_function_call(event, __perf_event_period, &value);
+
+ return 0;
+@@ -6742,7 +6746,8 @@ static void perf_event_addr_filters_exec(struct perf_event *event, void *data)
+ raw_spin_lock_irqsave(&ifh->lock, flags);
+ list_for_each_entry(filter, &ifh->list, entry) {
+ if (filter->path.dentry) {
+- event->addr_filters_offs[count] = 0;
++ event->addr_filter_ranges[count].start = 0;
++ event->addr_filter_ranges[count].size = 0;
+ restart++;
+ }
+
+@@ -7424,28 +7429,47 @@ static bool perf_addr_filter_match(struct perf_addr_filter *filter,
+ return true;
+ }
+
++static bool perf_addr_filter_vma_adjust(struct perf_addr_filter *filter,
++ struct vm_area_struct *vma,
++ struct perf_addr_filter_range *fr)
++{
++ unsigned long vma_size = vma->vm_end - vma->vm_start;
++ unsigned long off = vma->vm_pgoff << PAGE_SHIFT;
++ struct file *file = vma->vm_file;
++
++ if (!perf_addr_filter_match(filter, file, off, vma_size))
++ return false;
++
++ if (filter->offset < off) {
++ fr->start = vma->vm_start;
++ fr->size = min(vma_size, filter->size - (off - filter->offset));
++ } else {
++ fr->start = vma->vm_start + filter->offset - off;
++ fr->size = min(vma->vm_end - fr->start, filter->size);
++ }
++
++ return true;
++}
++
+ static void __perf_addr_filters_adjust(struct perf_event *event, void *data)
+ {
+ struct perf_addr_filters_head *ifh = perf_event_addr_filters(event);
+ struct vm_area_struct *vma = data;
+- unsigned long off = vma->vm_pgoff << PAGE_SHIFT, flags;
+- struct file *file = vma->vm_file;
+ struct perf_addr_filter *filter;
+ unsigned int restart = 0, count = 0;
++ unsigned long flags;
+
+ if (!has_addr_filter(event))
+ return;
+
+- if (!file)
++ if (!vma->vm_file)
+ return;
+
+ raw_spin_lock_irqsave(&ifh->lock, flags);
+ list_for_each_entry(filter, &ifh->list, entry) {
+- if (perf_addr_filter_match(filter, file, off,
+- vma->vm_end - vma->vm_start)) {
+- event->addr_filters_offs[count] = vma->vm_start;
++ if (perf_addr_filter_vma_adjust(filter, vma,
++ &event->addr_filter_ranges[count]))
+ restart++;
+- }
+
+ count++;
+ }
+@@ -8805,26 +8829,19 @@ static void perf_addr_filters_splice(struct perf_event *event,
+ * @filter; if so, adjust filter's address range.
+ * Called with mm::mmap_sem down for reading.
+ */
+-static unsigned long perf_addr_filter_apply(struct perf_addr_filter *filter,
+- struct mm_struct *mm)
++static void perf_addr_filter_apply(struct perf_addr_filter *filter,
++ struct mm_struct *mm,
++ struct perf_addr_filter_range *fr)
+ {
+ struct vm_area_struct *vma;
+
+ for (vma = mm->mmap; vma; vma = vma->vm_next) {
+- struct file *file = vma->vm_file;
+- unsigned long off = vma->vm_pgoff << PAGE_SHIFT;
+- unsigned long vma_size = vma->vm_end - vma->vm_start;
+-
+- if (!file)
+- continue;
+-
+- if (!perf_addr_filter_match(filter, file, off, vma_size))
++ if (!vma->vm_file)
+ continue;
+
+- return vma->vm_start;
++ if (perf_addr_filter_vma_adjust(filter, vma, fr))
++ return;
+ }
+-
+- return 0;
+ }
+
+ /*
+@@ -8847,26 +8864,29 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
+ if (task == TASK_TOMBSTONE)
+ return;
+
+- if (!ifh->nr_file_filters)
+- return;
+-
+- mm = get_task_mm(event->ctx->task);
+- if (!mm)
+- goto restart;
++ if (ifh->nr_file_filters) {
++ mm = get_task_mm(event->ctx->task);
++ if (!mm)
++ goto restart;
+
+- down_read(&mm->mmap_sem);
++ down_read(&mm->mmap_sem);
++ }
+
+ raw_spin_lock_irqsave(&ifh->lock, flags);
+ list_for_each_entry(filter, &ifh->list, entry) {
+- event->addr_filters_offs[count] = 0;
++ if (filter->path.dentry) {
++ /*
++ * Adjust base offset if the filter is associated to a
++ * binary that needs to be mapped:
++ */
++ event->addr_filter_ranges[count].start = 0;
++ event->addr_filter_ranges[count].size = 0;
+
+- /*
+- * Adjust base offset if the filter is associated to a binary
+- * that needs to be mapped:
+- */
+- if (filter->path.dentry)
+- event->addr_filters_offs[count] =
+- perf_addr_filter_apply(filter, mm);
++ perf_addr_filter_apply(filter, mm, &event->addr_filter_ranges[count]);
++ } else {
++ event->addr_filter_ranges[count].start = filter->offset;
++ event->addr_filter_ranges[count].size = filter->size;
++ }
+
+ count++;
+ }
+@@ -8874,9 +8894,11 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
+ event->addr_filters_gen++;
+ raw_spin_unlock_irqrestore(&ifh->lock, flags);
+
+- up_read(&mm->mmap_sem);
++ if (ifh->nr_file_filters) {
++ up_read(&mm->mmap_sem);
+
+- mmput(mm);
++ mmput(mm);
++ }
+
+ restart:
+ perf_event_stop(event, 1);
+@@ -10128,14 +10150,28 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ goto err_pmu;
+
+ if (has_addr_filter(event)) {
+- event->addr_filters_offs = kcalloc(pmu->nr_addr_filters,
+- sizeof(unsigned long),
+- GFP_KERNEL);
+- if (!event->addr_filters_offs) {
++ event->addr_filter_ranges = kcalloc(pmu->nr_addr_filters,
++ sizeof(struct perf_addr_filter_range),
++ GFP_KERNEL);
++ if (!event->addr_filter_ranges) {
+ err = -ENOMEM;
+ goto err_per_task;
+ }
+
++ /*
++ * Clone the parent's vma offsets: they are valid until exec()
++ * even if the mm is not shared with the parent.
++ */
++ if (event->parent) {
++ struct perf_addr_filters_head *ifh = perf_event_addr_filters(event);
++
++ raw_spin_lock_irq(&ifh->lock);
++ memcpy(event->addr_filter_ranges,
++ event->parent->addr_filter_ranges,
++ pmu->nr_addr_filters * sizeof(struct perf_addr_filter_range));
++ raw_spin_unlock_irq(&ifh->lock);
++ }
++
+ /* force hw sync on the address filters */
+ event->addr_filters_gen = 1;
+ }
+@@ -10154,7 +10190,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ return event;
+
+ err_addr_filters:
+- kfree(event->addr_filters_offs);
++ kfree(event->addr_filter_ranges);
+
+ err_per_task:
+ exclusive_event_destroy(event);
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 8cb5cd7c97e1..1a2d18e98bf9 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -216,6 +216,7 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
+ memset(s->addr, 0, THREAD_SIZE);
+
+ tsk->stack_vm_area = s;
++ tsk->stack = s->addr;
+ return s->addr;
+ }
+
+@@ -230,14 +231,20 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
+ * free_thread_stack() can be called in interrupt context,
+ * so cache the vm_struct.
+ */
+- if (stack)
++ if (stack) {
+ tsk->stack_vm_area = find_vm_area(stack);
++ tsk->stack = stack;
++ }
+ return stack;
+ #else
+ struct page *page = alloc_pages_node(node, THREADINFO_GFP,
+ THREAD_SIZE_ORDER);
+
+- return page ? page_address(page) : NULL;
++ if (likely(page)) {
++ tsk->stack = page_address(page);
++ return tsk->stack;
++ }
++ return NULL;
+ #endif
+ }
+
+@@ -268,7 +275,10 @@ static struct kmem_cache *thread_stack_cache;
+ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk,
+ int node)
+ {
+- return kmem_cache_alloc_node(thread_stack_cache, THREADINFO_GFP, node);
++ unsigned long *stack;
++ stack = kmem_cache_alloc_node(thread_stack_cache, THREADINFO_GFP, node);
++ tsk->stack = stack;
++ return stack;
+ }
+
+ static void free_thread_stack(struct task_struct *tsk)
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index 5d9fc01b60a6..6e8520a81dd8 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -148,6 +148,7 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size,
+ switch (fwid->type) {
+ case IRQCHIP_FWNODE_NAMED:
+ case IRQCHIP_FWNODE_NAMED_ID:
++ domain->fwnode = fwnode;
+ domain->name = kstrdup(fwid->name, GFP_KERNEL);
+ if (!domain->name) {
+ kfree(domain);
+@@ -183,7 +184,7 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size,
+ * unhappy about. Replace them with ':', which does
+ * the trick and is not as offensive as '\'...
+ */
+- name = kstrdup(of_node_full_name(of_node), GFP_KERNEL);
++ name = kasprintf(GFP_KERNEL, "%pOF", of_node);
+ if (!name) {
+ kfree(domain);
+ return NULL;
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 7278302e3485..08911bb6fe9a 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -86,6 +86,11 @@ static bool sig_task_ignored(struct task_struct *t, int sig, bool force)
+ handler == SIG_DFL && !(force && sig_kernel_only(sig)))
+ return true;
+
++ /* Only allow kernel generated signals to this kthread */
++ if (unlikely((t->flags & PF_KTHREAD) &&
++ (handler == SIG_KTHREAD_KERNEL) && !force))
++ return true;
++
+ return sig_handler_ignored(handler, sig);
+ }
+
+diff --git a/lib/devres.c b/lib/devres.c
+index faccf1a037d0..aa0f5308ac6b 100644
+--- a/lib/devres.c
++++ b/lib/devres.c
+@@ -131,7 +131,8 @@ EXPORT_SYMBOL(devm_iounmap);
+ * if (IS_ERR(base))
+ * return PTR_ERR(base);
+ */
+-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res)
++void __iomem *devm_ioremap_resource(struct device *dev,
++ const struct resource *res)
+ {
+ resource_size_t size;
+ const char *name;
+diff --git a/lib/kfifo.c b/lib/kfifo.c
+index 015656aa8182..6320ab91e343 100644
+--- a/lib/kfifo.c
++++ b/lib/kfifo.c
+@@ -82,7 +82,8 @@ int __kfifo_init(struct __kfifo *fifo, void *buffer,
+ {
+ size /= esize;
+
+- size = roundup_pow_of_two(size);
++ if (!is_power_of_2(size))
++ size = rounddown_pow_of_two(size);
+
+ fifo->in = 0;
+ fifo->out = 0;
+diff --git a/net/6lowpan/nhc.c b/net/6lowpan/nhc.c
+index 4fa2fdda174d..9e56fb98f33c 100644
+--- a/net/6lowpan/nhc.c
++++ b/net/6lowpan/nhc.c
+@@ -18,7 +18,7 @@
+ #include "nhc.h"
+
+ static struct rb_root rb_root = RB_ROOT;
+-static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX];
++static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX + 1];
+ static DEFINE_SPINLOCK(lowpan_nhc_lock);
+
+ static int lowpan_nhc_insert(struct lowpan_nhc *nhc)
+diff --git a/net/bpfilter/bpfilter_kern.c b/net/bpfilter/bpfilter_kern.c
+index 94e88f510c5b..450b257afa84 100644
+--- a/net/bpfilter/bpfilter_kern.c
++++ b/net/bpfilter/bpfilter_kern.c
+@@ -25,7 +25,7 @@ static void shutdown_umh(struct umh_info *info)
+ return;
+ tsk = get_pid_task(find_vpid(info->pid), PIDTYPE_PID);
+ if (tsk) {
+- force_sig(SIGKILL, tsk);
++ send_sig(SIGKILL, tsk, 1);
+ put_task_struct(tsk);
+ }
+ fput(info->pipe_to_umh);
+diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
+index 2cf7716254be..d42e3904b498 100644
+--- a/net/bridge/br_arp_nd_proxy.c
++++ b/net/bridge/br_arp_nd_proxy.c
+@@ -311,7 +311,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
+ /* Neighbor Advertisement */
+ memset(na, 0, sizeof(*na) + na_olen);
+ na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
+- na->icmph.icmp6_router = 0; /* XXX: should be 1 ? */
++ na->icmph.icmp6_router = (n->flags & NTF_ROUTER) ? 1 : 0;
+ na->icmph.icmp6_override = 1;
+ na->icmph.icmp6_solicited = 1;
+ na->target = ns->target;
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 785e19afd6aa..f59230e4fc29 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2165,7 +2165,9 @@ static int compat_copy_entries(unsigned char *data, unsigned int size_user,
+ if (ret < 0)
+ return ret;
+
+- WARN_ON(size_remaining);
++ if (size_remaining)
++ return -EINVAL;
++
+ return state->buf_kern_offset;
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index a26d87073f71..73ebacabfde8 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4349,12 +4349,17 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
+
+ act = bpf_prog_run_xdp(xdp_prog, xdp);
+
++ /* check if bpf_xdp_adjust_head was used */
+ off = xdp->data - orig_data;
+- if (off > 0)
+- __skb_pull(skb, off);
+- else if (off < 0)
+- __skb_push(skb, -off);
+- skb->mac_header += off;
++ if (off) {
++ if (off > 0)
++ __skb_pull(skb, off);
++ else if (off < 0)
++ __skb_push(skb, -off);
++
++ skb->mac_header += off;
++ skb_reset_network_header(skb);
++ }
+
+ /* check if bpf_xdp_adjust_tail was used. it can only "shrink"
+ * pckt.
+@@ -4465,23 +4470,6 @@ static int netif_rx_internal(struct sk_buff *skb)
+
+ trace_netif_rx(skb);
+
+- if (static_branch_unlikely(&generic_xdp_needed_key)) {
+- int ret;
+-
+- preempt_disable();
+- rcu_read_lock();
+- ret = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
+- rcu_read_unlock();
+- preempt_enable();
+-
+- /* Consider XDP consuming the packet a success from
+- * the netdev point of view we do not want to count
+- * this as an error.
+- */
+- if (ret != XDP_PASS)
+- return NET_RX_SUCCESS;
+- }
+-
+ #ifdef CONFIG_RPS
+ if (static_key_false(&rps_needed)) {
+ struct rps_dev_flow voidflow, *rflow = &voidflow;
+@@ -4815,6 +4803,18 @@ another_round:
+
+ __this_cpu_inc(softnet_data.processed);
+
++ if (static_branch_unlikely(&generic_xdp_needed_key)) {
++ int ret2;
++
++ preempt_disable();
++ ret2 = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
++ preempt_enable();
++
++ if (ret2 != XDP_PASS)
++ return NET_RX_DROP;
++ skb_reset_mac_len(skb);
++ }
++
+ if (skb->protocol == cpu_to_be16(ETH_P_8021Q) ||
+ skb->protocol == cpu_to_be16(ETH_P_8021AD)) {
+ skb = skb_vlan_untag(skb);
+@@ -5133,19 +5133,6 @@ static int netif_receive_skb_internal(struct sk_buff *skb)
+ if (skb_defer_rx_timestamp(skb))
+ return NET_RX_SUCCESS;
+
+- if (static_branch_unlikely(&generic_xdp_needed_key)) {
+- int ret;
+-
+- preempt_disable();
+- rcu_read_lock();
+- ret = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
+- rcu_read_unlock();
+- preempt_enable();
+-
+- if (ret != XDP_PASS)
+- return NET_RX_DROP;
+- }
+-
+ rcu_read_lock();
+ #ifdef CONFIG_RPS
+ if (static_key_false(&rps_needed)) {
+@@ -5166,7 +5153,6 @@ static int netif_receive_skb_internal(struct sk_buff *skb)
+
+ static void netif_receive_skb_list_internal(struct list_head *head)
+ {
+- struct bpf_prog *xdp_prog = NULL;
+ struct sk_buff *skb, *next;
+ struct list_head sublist;
+
+@@ -5179,21 +5165,6 @@ static void netif_receive_skb_list_internal(struct list_head *head)
+ }
+ list_splice_init(&sublist, head);
+
+- if (static_branch_unlikely(&generic_xdp_needed_key)) {
+- preempt_disable();
+- rcu_read_lock();
+- list_for_each_entry_safe(skb, next, head, list) {
+- xdp_prog = rcu_dereference(skb->dev->xdp_prog);
+- skb_list_del_init(skb);
+- if (do_xdp_generic(xdp_prog, skb) == XDP_PASS)
+- list_add_tail(&skb->list, &sublist);
+- }
+- rcu_read_unlock();
+- preempt_enable();
+- /* Put passed packets back on main list */
+- list_splice_init(&sublist, head);
+- }
+-
+ rcu_read_lock();
+ #ifdef CONFIG_RPS
+ if (static_key_false(&rps_needed)) {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 91b950261975..9daf1a4118b5 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4367,7 +4367,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
+ return -ENODEV;
+
+ idev = __in6_dev_get_safely(dev);
+- if (unlikely(!idev || !net->ipv6.devconf_all->forwarding))
++ if (unlikely(!idev || !idev->cnf.forwarding))
+ return BPF_FIB_LKUP_RET_FWD_DISABLED;
+
+ if (flags & BPF_FIB_LOOKUP_OUTPUT) {
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index e260d44ebdca..bf738ec68cb5 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1885,8 +1885,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
+ goto nla_put_failure;
+ {
+ unsigned long now = jiffies;
+- unsigned int flush_delta = now - tbl->last_flush;
+- unsigned int rand_delta = now - tbl->last_rand;
++ long flush_delta = now - tbl->last_flush;
++ long rand_delta = now - tbl->last_rand;
+ struct neigh_hash_table *nht;
+ struct ndt_config ndc = {
+ .ndtc_key_len = tbl->key_len,
+diff --git a/net/core/sock.c b/net/core/sock.c
+index bbde5f6a7dc9..b9ec14f2c729 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2179,8 +2179,8 @@ static void sk_leave_memory_pressure(struct sock *sk)
+ } else {
+ unsigned long *memory_pressure = sk->sk_prot->memory_pressure;
+
+- if (memory_pressure && *memory_pressure)
+- *memory_pressure = 0;
++ if (memory_pressure && READ_ONCE(*memory_pressure))
++ WRITE_ONCE(*memory_pressure, 0);
+ }
+ }
+
+diff --git a/net/dsa/port.c b/net/dsa/port.c
+index ed0595459df1..ea7efc86b9d7 100644
+--- a/net/dsa/port.c
++++ b/net/dsa/port.c
+@@ -69,7 +69,6 @@ static void dsa_port_set_state_now(struct dsa_port *dp, u8 state)
+
+ int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
+ {
+- u8 stp_state = dp->bridge_dev ? BR_STATE_BLOCKING : BR_STATE_FORWARDING;
+ struct dsa_switch *ds = dp->ds;
+ int port = dp->index;
+ int err;
+@@ -80,7 +79,8 @@ int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
+ return err;
+ }
+
+- dsa_port_set_state_now(dp, stp_state);
++ if (!dp->bridge_dev)
++ dsa_port_set_state_now(dp, BR_STATE_FORWARDING);
+
+ return 0;
+ }
+@@ -90,7 +90,8 @@ void dsa_port_disable(struct dsa_port *dp, struct phy_device *phy)
+ struct dsa_switch *ds = dp->ds;
+ int port = dp->index;
+
+- dsa_port_set_state_now(dp, BR_STATE_DISABLED);
++ if (!dp->bridge_dev)
++ dsa_port_set_state_now(dp, BR_STATE_DISABLED);
+
+ if (ds->ops->port_disable)
+ ds->ops->port_disable(ds, port, phy);
+diff --git a/net/dsa/slave.c b/net/dsa/slave.c
+index b39720d0995d..8ee28b6016d8 100644
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -1219,9 +1219,9 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev)
+ phy_flags = ds->ops->get_phy_flags(ds, dp->index);
+
+ ret = phylink_of_phy_connect(dp->pl, port_dn, phy_flags);
+- if (ret == -ENODEV) {
+- /* We could not connect to a designated PHY or SFP, so use the
+- * switch internal MDIO bus instead
++ if (ret == -ENODEV && ds->slave_mii_bus) {
++ /* We could not connect to a designated PHY or SFP, so try to
++ * use the switch internal MDIO bus instead
+ */
+ ret = dsa_slave_phy_connect(slave_dev, dp->index);
+ if (ret) {
+@@ -1233,7 +1233,7 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev)
+ }
+ }
+
+- return 0;
++ return ret;
+ }
+
+ static struct lock_class_key dsa_slave_netdev_xmit_lock_key;
+diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
+index e7857a8ac86d..f3074249c6fc 100644
+--- a/net/ieee802154/6lowpan/reassembly.c
++++ b/net/ieee802154/6lowpan/reassembly.c
+@@ -629,7 +629,7 @@ err_sysctl:
+
+ void lowpan_net_frag_exit(void)
+ {
+- inet_frags_fini(&lowpan_frags);
+ lowpan_frags_sysctl_unregister();
+ unregister_pernet_subsys(&lowpan_frags_ops);
++ inet_frags_fini(&lowpan_frags);
+ }
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 1fbe2f815474..bbf3b3daa999 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -424,8 +424,8 @@ int inet_release(struct socket *sock)
+ if (sock_flag(sk, SOCK_LINGER) &&
+ !(current->flags & PF_EXITING))
+ timeout = sk->sk_lingertime;
+- sock->sk = NULL;
+ sk->sk_prot->close(sk, timeout);
++ sock->sk = NULL;
+ }
+ return 0;
+ }
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 636a11c56cf5..79320858e719 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -937,7 +937,7 @@ struct sock *inet_csk_reqsk_queue_add(struct sock *sk,
+ req->sk = child;
+ req->dl_next = NULL;
+ if (queue->rskq_accept_head == NULL)
+- queue->rskq_accept_head = req;
++ WRITE_ONCE(queue->rskq_accept_head, req);
+ else
+ queue->rskq_accept_tail->dl_next = req;
+ queue->rskq_accept_tail = req;
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index d63091812342..fbf30122e8bf 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -940,7 +940,7 @@ static int __ip_append_data(struct sock *sk,
+ unsigned int fraglen;
+ unsigned int fraggap;
+ unsigned int alloclen;
+- unsigned int pagedlen = 0;
++ unsigned int pagedlen;
+ struct sk_buff *skb_prev;
+ alloc_new_skb:
+ skb_prev = skb;
+@@ -957,6 +957,7 @@ alloc_new_skb:
+ if (datalen > mtu - fragheaderlen)
+ datalen = maxfraglen - fragheaderlen;
+ fraglen = datalen + fragheaderlen;
++ pagedlen = 0;
+
+ if ((flags & MSG_MORE) &&
+ !(rt->dst.dev->features&NETIF_F_SG))
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 420e891ac59d..f03a1b68e70f 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -574,8 +574,9 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, u8 proto)
+ else if (skb->protocol == htons(ETH_P_IPV6))
+ tos = ipv6_get_dsfield((const struct ipv6hdr *)inner_iph);
+ }
+- ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src, 0,
+- RT_TOS(tos), tunnel->parms.link, tunnel->fwmark);
++ ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src,
++ tunnel_id_to_key32(key->tun_id), RT_TOS(tos),
++ 0, skb->mark);
+ if (tunnel->encap.type != TUNNEL_ENCAP_NONE)
+ goto tx_error;
+ rt = ip_route_output_key(tunnel->net, &fl4);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index cd8a92e7a39e..af9361eba64a 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -325,7 +325,7 @@ void tcp_enter_memory_pressure(struct sock *sk)
+ {
+ unsigned long val;
+
+- if (tcp_memory_pressure)
++ if (READ_ONCE(tcp_memory_pressure))
+ return;
+ val = jiffies;
+
+@@ -340,7 +340,7 @@ void tcp_leave_memory_pressure(struct sock *sk)
+ {
+ unsigned long val;
+
+- if (!tcp_memory_pressure)
++ if (!READ_ONCE(tcp_memory_pressure))
+ return;
+ val = xchg(&tcp_memory_pressure, 0);
+ if (val)
+diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
+index 0c0522b79b43..aa343654abfc 100644
+--- a/net/ipv4/udp_offload.c
++++ b/net/ipv4/udp_offload.c
+@@ -227,6 +227,11 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
+ seg = segs;
+ uh = udp_hdr(seg);
+
++ /* preserve TX timestamp flags and TS key for first segment */
++ skb_shinfo(seg)->tskey = skb_shinfo(gso_skb)->tskey;
++ skb_shinfo(seg)->tx_flags |=
++ (skb_shinfo(gso_skb)->tx_flags & SKBTX_ANY_TSTAMP);
++
+ /* compute checksum adjustment based on old length versus new */
+ newlen = htons(sizeof(*uh) + mss);
+ check = csum16_add(csum16_sub(uh->check, uh->len), newlen);
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index bbb5ffb3397d..7091568b9f63 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -1529,7 +1529,8 @@ static struct fib6_node *fib6_locate_1(struct fib6_node *root,
+ if (plen == fn->fn_bit)
+ return fn;
+
+- prev = fn;
++ if (fn->fn_flags & RTN_RTINFO)
++ prev = fn;
+
+ next:
+ /*
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index b3515a4f1303..1f2d0022ba6f 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -2218,6 +2218,7 @@ static void ip6erspan_tap_setup(struct net_device *dev)
+ {
+ ether_setup(dev);
+
++ dev->max_mtu = 0;
+ dev->netdev_ops = &ip6erspan_netdev_ops;
+ dev->needs_free_netdev = true;
+ dev->priv_destructor = ip6gre_dev_free;
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index eed9231c90ad..9886a84c2511 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1357,7 +1357,7 @@ emsgsize:
+ unsigned int fraglen;
+ unsigned int fraggap;
+ unsigned int alloclen;
+- unsigned int pagedlen = 0;
++ unsigned int pagedlen;
+ alloc_new_skb:
+ /* There's no room in the current skb */
+ if (skb)
+@@ -1381,6 +1381,7 @@ alloc_new_skb:
+ if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
+ datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
+ fraglen = datalen + fragheaderlen;
++ pagedlen = 0;
+
+ if ((flags & MSG_MORE) &&
+ !(rt->dst.dev->features&NETIF_F_SG))
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 4856d9320b28..a41156a00dd4 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -660,6 +660,8 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
+
+ skb->ip_summed = CHECKSUM_NONE;
+
++ sock_tx_timestamp(sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags);
++
+ if (flags & MSG_CONFIRM)
+ skb_set_dst_pending_confirm(skb, 1);
+
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index 095825f964e2..c6132e39ab16 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -593,8 +593,8 @@ err_protocol:
+
+ void ipv6_frag_exit(void)
+ {
+- inet_frags_fini(&ip6_frags);
+ ip6_frags_sysctl_unregister();
+ unregister_pernet_subsys(&ip6_frags_ops);
+ inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
++ inet_frags_fini(&ip6_frags);
+ }
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index f024914da1b2..23a1002ed86d 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -13,6 +13,7 @@
+ #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
+ #include <linux/module.h>
++#include <linux/netdevice.h>
+ #include <linux/types.h>
+ #include <linux/list.h>
+ #include <linux/errno.h>
+@@ -355,6 +356,9 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
+ err = -ENODEV;
+ goto err_free;
+ }
++
++ dev_hard_header(skb, skb->dev, ETH_P_AF_IUCV, NULL, NULL, skb->len);
++
+ if (!(skb->dev->flags & IFF_UP) || !netif_carrier_ok(skb->dev)) {
+ err = -ENETDOWN;
+ goto err_free;
+@@ -367,6 +371,8 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
+ skb_trim(skb, skb->dev->mtu);
+ }
+ skb->protocol = cpu_to_be16(ETH_P_AF_IUCV);
++
++ __skb_header_release(skb);
+ nskb = skb_clone(skb, GFP_ATOMIC);
+ if (!nskb) {
+ err = -ENOMEM;
+@@ -466,12 +472,14 @@ static void iucv_sever_path(struct sock *sk, int with_user_data)
+ /* Send controlling flags through an IUCV socket for HIPER transport */
+ static int iucv_send_ctrl(struct sock *sk, u8 flags)
+ {
++ struct iucv_sock *iucv = iucv_sk(sk);
+ int err = 0;
+ int blen;
+ struct sk_buff *skb;
+ u8 shutdown = 0;
+
+- blen = sizeof(struct af_iucv_trans_hdr) + ETH_HLEN;
++ blen = sizeof(struct af_iucv_trans_hdr) +
++ LL_RESERVED_SPACE(iucv->hs_dev);
+ if (sk->sk_shutdown & SEND_SHUTDOWN) {
+ /* controlling flags should be sent anyway */
+ shutdown = sk->sk_shutdown;
+@@ -1131,7 +1139,8 @@ static int iucv_sock_sendmsg(struct socket *sock, struct msghdr *msg,
+ * segmented records using the MSG_EOR flag), but
+ * for SOCK_STREAM we might want to improve it in future */
+ if (iucv->transport == AF_IUCV_TRANS_HIPER) {
+- headroom = sizeof(struct af_iucv_trans_hdr) + ETH_HLEN;
++ headroom = sizeof(struct af_iucv_trans_hdr) +
++ LL_RESERVED_SPACE(iucv->hs_dev);
+ linear = len;
+ } else {
+ if (len < PAGE_SIZE) {
+@@ -2456,6 +2465,13 @@ out:
+ return err;
+ }
+
++static void afiucv_iucv_exit(void)
++{
++ device_unregister(af_iucv_dev);
++ driver_unregister(&af_iucv_driver);
++ pr_iucv->iucv_unregister(&af_iucv_handler, 0);
++}
++
+ static int __init afiucv_init(void)
+ {
+ int err;
+@@ -2489,11 +2505,18 @@ static int __init afiucv_init(void)
+ err = afiucv_iucv_init();
+ if (err)
+ goto out_sock;
+- } else
+- register_netdevice_notifier(&afiucv_netdev_notifier);
++ }
++
++ err = register_netdevice_notifier(&afiucv_netdev_notifier);
++ if (err)
++ goto out_notifier;
++
+ dev_add_pack(&iucv_packet_type);
+ return 0;
+
++out_notifier:
++ if (pr_iucv)
++ afiucv_iucv_exit();
+ out_sock:
+ sock_unregister(PF_IUCV);
+ out_proto:
+@@ -2507,12 +2530,11 @@ out:
+ static void __exit afiucv_exit(void)
+ {
+ if (pr_iucv) {
+- device_unregister(af_iucv_dev);
+- driver_unregister(&af_iucv_driver);
+- pr_iucv->iucv_unregister(&af_iucv_handler, 0);
++ afiucv_iucv_exit();
+ symbol_put(iucv_if);
+- } else
+- unregister_netdevice_notifier(&afiucv_netdev_notifier);
++ }
++
++ unregister_netdevice_notifier(&afiucv_netdev_notifier);
+ dev_remove_pack(&iucv_packet_type);
+ sock_unregister(PF_IUCV);
+ proto_unregister(&iucv_proto);
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 52b5a2797c0c..e4dec03a19fe 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1735,7 +1735,8 @@ static __net_exit void l2tp_exit_net(struct net *net)
+ }
+ rcu_read_unlock_bh();
+
+- flush_workqueue(l2tp_wq);
++ if (l2tp_wq)
++ flush_workqueue(l2tp_wq);
+ rcu_barrier();
+
+ for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index b99e73a7e7e0..ce841d59bc72 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -113,22 +113,26 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
+ *
+ * Send data via reliable llc2 connection.
+ * Returns 0 upon success, non-zero if action did not succeed.
++ *
++ * This function always consumes a reference to the skb.
+ */
+ static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock)
+ {
+ struct llc_sock* llc = llc_sk(sk);
+- int rc = 0;
+
+ if (unlikely(llc_data_accept_state(llc->state) ||
+ llc->remote_busy_flag ||
+ llc->p_flag)) {
+ long timeout = sock_sndtimeo(sk, noblock);
++ int rc;
+
+ rc = llc_ui_wait_for_busy_core(sk, timeout);
++ if (rc) {
++ kfree_skb(skb);
++ return rc;
++ }
+ }
+- if (unlikely(!rc))
+- rc = llc_build_and_send_pkt(sk, skb);
+- return rc;
++ return llc_build_and_send_pkt(sk, skb);
+ }
+
+ static void llc_ui_sk_init(struct socket *sock, struct sock *sk)
+@@ -900,7 +904,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
+ int flags = msg->msg_flags;
+ int noblock = flags & MSG_DONTWAIT;
+- struct sk_buff *skb;
++ struct sk_buff *skb = NULL;
+ size_t size = 0;
+ int rc = -EINVAL, copied = 0, hdrlen;
+
+@@ -909,10 +913,10 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ lock_sock(sk);
+ if (addr) {
+ if (msg->msg_namelen < sizeof(*addr))
+- goto release;
++ goto out;
+ } else {
+ if (llc_ui_addr_null(&llc->addr))
+- goto release;
++ goto out;
+ addr = &llc->addr;
+ }
+ /* must bind connection to sap if user hasn't done it. */
+@@ -920,7 +924,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ /* bind to sap with null dev, exclusive. */
+ rc = llc_ui_autobind(sock, addr);
+ if (rc)
+- goto release;
++ goto out;
+ }
+ hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
+ size = hdrlen + len;
+@@ -929,12 +933,12 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ copied = size - hdrlen;
+ rc = -EINVAL;
+ if (copied < 0)
+- goto release;
++ goto out;
+ release_sock(sk);
+ skb = sock_alloc_send_skb(sk, size, noblock, &rc);
+ lock_sock(sk);
+ if (!skb)
+- goto release;
++ goto out;
+ skb->dev = llc->dev;
+ skb->protocol = llc_proto_type(addr->sllc_arphrd);
+ skb_reserve(skb, hdrlen);
+@@ -944,29 +948,31 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ if (sk->sk_type == SOCK_DGRAM || addr->sllc_ua) {
+ llc_build_and_send_ui_pkt(llc->sap, skb, addr->sllc_mac,
+ addr->sllc_sap);
++ skb = NULL;
+ goto out;
+ }
+ if (addr->sllc_test) {
+ llc_build_and_send_test_pkt(llc->sap, skb, addr->sllc_mac,
+ addr->sllc_sap);
++ skb = NULL;
+ goto out;
+ }
+ if (addr->sllc_xid) {
+ llc_build_and_send_xid_pkt(llc->sap, skb, addr->sllc_mac,
+ addr->sllc_sap);
++ skb = NULL;
+ goto out;
+ }
+ rc = -ENOPROTOOPT;
+ if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua))
+ goto out;
+ rc = llc_ui_send_data(sk, skb, noblock);
++ skb = NULL;
+ out:
+- if (rc) {
+- kfree_skb(skb);
+-release:
++ kfree_skb(skb);
++ if (rc)
+ dprintk("%s: failed sending from %02X to %02X: %d\n",
+ __func__, llc->laddr.lsap, llc->daddr.lsap, rc);
+- }
+ release_sock(sk);
+ return rc ? : copied;
+ }
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index ed2aca12460c..a79b739eb223 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -55,6 +55,8 @@ int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ;
+ * (executing it's actions and changing state), upper layer will be
+ * indicated or confirmed, if needed. Returns 0 for success, 1 for
+ * failure. The socket lock has to be held before calling this function.
++ *
++ * This function always consumes a reference to the skb.
+ */
+ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ {
+@@ -62,12 +64,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ struct llc_sock *llc = llc_sk(skb->sk);
+ struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+
+- /*
+- * We have to hold the skb, because llc_conn_service will kfree it in
+- * the sending path and we need to look at the skb->cb, where we encode
+- * llc_conn_state_ev.
+- */
+- skb_get(skb);
+ ev->ind_prim = ev->cfm_prim = 0;
+ /*
+ * Send event to state machine
+@@ -75,21 +71,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ rc = llc_conn_service(skb->sk, skb);
+ if (unlikely(rc != 0)) {
+ printk(KERN_ERR "%s: llc_conn_service failed\n", __func__);
+- goto out_kfree_skb;
+- }
+-
+- if (unlikely(!ev->ind_prim && !ev->cfm_prim)) {
+- /* indicate or confirm not required */
+- if (!skb->next)
+- goto out_kfree_skb;
+ goto out_skb_put;
+ }
+
+- if (unlikely(ev->ind_prim && ev->cfm_prim)) /* Paranoia */
+- skb_get(skb);
+-
+ switch (ev->ind_prim) {
+ case LLC_DATA_PRIM:
++ skb_get(skb);
+ llc_save_primitive(sk, skb, LLC_DATA_PRIM);
+ if (unlikely(sock_queue_rcv_skb(sk, skb))) {
+ /*
+@@ -106,6 +93,7 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ * skb->sk pointing to the newly created struct sock in
+ * llc_conn_handler. -acme
+ */
++ skb_get(skb);
+ skb_queue_tail(&sk->sk_receive_queue, skb);
+ sk->sk_state_change(sk);
+ break;
+@@ -121,7 +109,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ sk->sk_state_change(sk);
+ }
+ }
+- kfree_skb(skb);
+ sock_put(sk);
+ break;
+ case LLC_RESET_PRIM:
+@@ -130,14 +117,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ * RESET is not being notified to upper layers for now
+ */
+ printk(KERN_INFO "%s: received a reset ind!\n", __func__);
+- kfree_skb(skb);
+ break;
+ default:
+- if (ev->ind_prim) {
++ if (ev->ind_prim)
+ printk(KERN_INFO "%s: received unknown %d prim!\n",
+ __func__, ev->ind_prim);
+- kfree_skb(skb);
+- }
+ /* No indication */
+ break;
+ }
+@@ -179,15 +163,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ printk(KERN_INFO "%s: received a reset conf!\n", __func__);
+ break;
+ default:
+- if (ev->cfm_prim) {
++ if (ev->cfm_prim)
+ printk(KERN_INFO "%s: received unknown %d prim!\n",
+ __func__, ev->cfm_prim);
+- break;
+- }
+- goto out_skb_put; /* No confirmation */
++ /* No confirmation */
++ break;
+ }
+-out_kfree_skb:
+- kfree_skb(skb);
+ out_skb_put:
+ kfree_skb(skb);
+ return rc;
+diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c
+index 8db03c2d5440..ad6547736c21 100644
+--- a/net/llc/llc_if.c
++++ b/net/llc/llc_if.c
+@@ -38,6 +38,8 @@
+ * closed and -EBUSY when sending data is not permitted in this state or
+ * LLC has send an I pdu with p bit set to 1 and is waiting for it's
+ * response.
++ *
++ * This function always consumes a reference to the skb.
+ */
+ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
+ {
+@@ -46,20 +48,22 @@ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
+ struct llc_sock *llc = llc_sk(sk);
+
+ if (unlikely(llc->state == LLC_CONN_STATE_ADM))
+- goto out;
++ goto out_free;
+ rc = -EBUSY;
+ if (unlikely(llc_data_accept_state(llc->state) || /* data_conn_refuse */
+ llc->p_flag)) {
+ llc->failed_data_req = 1;
+- goto out;
++ goto out_free;
+ }
+ ev = llc_conn_ev(skb);
+ ev->type = LLC_CONN_EV_TYPE_PRIM;
+ ev->prim = LLC_DATA_PRIM;
+ ev->prim_type = LLC_PRIM_TYPE_REQ;
+ skb->dev = llc->dev;
+- rc = llc_conn_state_process(sk, skb);
+-out:
++ return llc_conn_state_process(sk, skb);
++
++out_free:
++ kfree_skb(skb);
+ return rc;
+ }
+
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index 3d5520776655..0b60e330c115 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -529,7 +529,7 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
+
+ /* (re)Initialize group rate indexes */
+ for(j = 0; j < MAX_THR_RATES; j++)
+- tmp_group_tp_rate[j] = group;
++ tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
+
+ for (i = 0; i < MCS_GROUP_RATES; i++) {
+ if (!(mi->supported[group] & BIT(i)))
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index b12f23c996f4..02d0b22d0114 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3391,9 +3391,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
+ case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
+ /* process for all: mesh, mlme, ibss */
+ break;
++ case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
++ if (is_multicast_ether_addr(mgmt->da) &&
++ !is_broadcast_ether_addr(mgmt->da))
++ return RX_DROP_MONITOR;
++
++ /* process only for station/IBSS */
++ if (sdata->vif.type != NL80211_IFTYPE_STATION &&
++ sdata->vif.type != NL80211_IFTYPE_ADHOC)
++ return RX_DROP_MONITOR;
++ break;
+ case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
+ case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
+- case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+ case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
+ if (is_multicast_ether_addr(mgmt->da) &&
+ !is_broadcast_ether_addr(mgmt->da))
+diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
+index 94f53a9b7d1a..faf6ef1b6a45 100644
+--- a/net/mpls/mpls_iptunnel.c
++++ b/net/mpls/mpls_iptunnel.c
+@@ -28,7 +28,7 @@
+ #include "internal.h"
+
+ static const struct nla_policy mpls_iptunnel_policy[MPLS_IPTUNNEL_MAX + 1] = {
+- [MPLS_IPTUNNEL_DST] = { .type = NLA_U32 },
++ [MPLS_IPTUNNEL_DST] = { .len = sizeof(u32) },
+ [MPLS_IPTUNNEL_TTL] = { .type = NLA_U8 },
+ };
+
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 7ba9ea55816a..31fa94064a62 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -555,10 +555,8 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ goto nla_put_failure;
+
+ if (ctnetlink_dump_status(skb, ct) < 0 ||
+- ctnetlink_dump_timeout(skb, ct) < 0 ||
+ ctnetlink_dump_acct(skb, ct, type) < 0 ||
+ ctnetlink_dump_timestamp(skb, ct) < 0 ||
+- ctnetlink_dump_protoinfo(skb, ct) < 0 ||
+ ctnetlink_dump_helpinfo(skb, ct) < 0 ||
+ ctnetlink_dump_mark(skb, ct) < 0 ||
+ ctnetlink_dump_secctx(skb, ct) < 0 ||
+@@ -570,6 +568,11 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ ctnetlink_dump_ct_synproxy(skb, ct) < 0)
+ goto nla_put_failure;
+
++ if (!test_bit(IPS_OFFLOAD_BIT, &ct->status) &&
++ (ctnetlink_dump_timeout(skb, ct) < 0 ||
++ ctnetlink_dump_protoinfo(skb, ct) < 0))
++ goto nla_put_failure;
++
+ nlmsg_end(skb, nlh);
+ return skb->len;
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index 70bd730ca059..890799c16aa4 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -491,14 +491,17 @@ EXPORT_SYMBOL_GPL(nf_flow_table_init);
+ static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data)
+ {
+ struct net_device *dev = data;
++ struct flow_offload_entry *e;
++
++ e = container_of(flow, struct flow_offload_entry, flow);
+
+ if (!dev) {
+ flow_offload_teardown(flow);
+ return;
+ }
+-
+- if (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
+- flow->tuplehash[1].tuple.iifidx == dev->ifindex)
++ if (net_eq(nf_ct_net(e->ct), dev_net(dev)) &&
++ (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
++ flow->tuplehash[1].tuple.iifidx == dev->ifindex))
+ flow_offload_dead(flow);
+ }
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 1ef8cb789c41..166edea0e452 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -103,8 +103,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ ct->status & IPS_SEQ_ADJUST)
+ goto out;
+
+- if (ctinfo == IP_CT_NEW ||
+- ctinfo == IP_CT_RELATED)
++ if (!nf_ct_is_confirmed(ct))
+ goto out;
+
+ if (test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status))
+diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
+index a35fb59ace73..df4e3e0412ed 100644
+--- a/net/netfilter/nft_osf.c
++++ b/net/netfilter/nft_osf.c
+@@ -69,6 +69,15 @@ nla_put_failure:
+ return -1;
+ }
+
++static int nft_osf_validate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr,
++ const struct nft_data **data)
++{
++ return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) |
++ (1 << NF_INET_PRE_ROUTING) |
++ (1 << NF_INET_FORWARD));
++}
++
+ static struct nft_expr_type nft_osf_type;
+ static const struct nft_expr_ops nft_osf_op = {
+ .eval = nft_osf_eval,
+@@ -76,6 +85,7 @@ static const struct nft_expr_ops nft_osf_op = {
+ .init = nft_osf_init,
+ .dump = nft_osf_dump,
+ .type = &nft_osf_type,
++ .validate = nft_osf_validate,
+ };
+
+ static struct nft_expr_type nft_osf_type __read_mostly = {
+diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
+index 015124e649cb..05118e03c3e4 100644
+--- a/net/netfilter/nft_set_hash.c
++++ b/net/netfilter/nft_set_hash.c
+@@ -488,6 +488,23 @@ static bool nft_hash_lookup_fast(const struct net *net,
+ return false;
+ }
+
++static u32 nft_jhash(const struct nft_set *set, const struct nft_hash *priv,
++ const struct nft_set_ext *ext)
++{
++ const struct nft_data *key = nft_set_ext_key(ext);
++ u32 hash, k1;
++
++ if (set->klen == 4) {
++ k1 = *(u32 *)key;
++ hash = jhash_1word(k1, priv->seed);
++ } else {
++ hash = jhash(key, set->klen, priv->seed);
++ }
++ hash = reciprocal_scale(hash, priv->buckets);
++
++ return hash;
++}
++
+ static int nft_hash_insert(const struct net *net, const struct nft_set *set,
+ const struct nft_set_elem *elem,
+ struct nft_set_ext **ext)
+@@ -497,8 +514,7 @@ static int nft_hash_insert(const struct net *net, const struct nft_set *set,
+ u8 genmask = nft_genmask_next(net);
+ u32 hash;
+
+- hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed);
+- hash = reciprocal_scale(hash, priv->buckets);
++ hash = nft_jhash(set, priv, &this->ext);
+ hlist_for_each_entry(he, &priv->table[hash], node) {
+ if (!memcmp(nft_set_ext_key(&this->ext),
+ nft_set_ext_key(&he->ext), set->klen) &&
+@@ -537,10 +553,9 @@ static void *nft_hash_deactivate(const struct net *net,
+ u8 genmask = nft_genmask_next(net);
+ u32 hash;
+
+- hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed);
+- hash = reciprocal_scale(hash, priv->buckets);
++ hash = nft_jhash(set, priv, &this->ext);
+ hlist_for_each_entry(he, &priv->table[hash], node) {
+- if (!memcmp(nft_set_ext_key(&this->ext), &elem->key.val,
++ if (!memcmp(nft_set_ext_key(&he->ext), &elem->key.val,
+ set->klen) &&
+ nft_set_elem_active(&he->ext, genmask)) {
+ nft_set_elem_change_active(net, set, &he->ext);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index ac65e66d1d72..ddf90e6fac51 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1297,15 +1297,21 @@ static void packet_sock_destruct(struct sock *sk)
+
+ static bool fanout_flow_is_huge(struct packet_sock *po, struct sk_buff *skb)
+ {
+- u32 rxhash;
++ u32 *history = po->rollover->history;
++ u32 victim, rxhash;
+ int i, count = 0;
+
+ rxhash = skb_get_hash(skb);
+ for (i = 0; i < ROLLOVER_HLEN; i++)
+- if (po->rollover->history[i] == rxhash)
++ if (READ_ONCE(history[i]) == rxhash)
+ count++;
+
+- po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash;
++ victim = prandom_u32() % ROLLOVER_HLEN;
++
++ /* Avoid dirtying the cache line if possible */
++ if (READ_ONCE(history[victim]) != rxhash)
++ WRITE_ONCE(history[victim], rxhash);
++
+ return count > (ROLLOVER_HLEN >> 1);
+ }
+
+@@ -3371,20 +3377,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ sock_recv_ts_and_drops(msg, sk, skb);
+
+ if (msg->msg_name) {
++ int copy_len;
++
+ /* If the address length field is there to be filled
+ * in, we fill it in now.
+ */
+ if (sock->type == SOCK_PACKET) {
+ __sockaddr_check_size(sizeof(struct sockaddr_pkt));
+ msg->msg_namelen = sizeof(struct sockaddr_pkt);
++ copy_len = msg->msg_namelen;
+ } else {
+ struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
+
+ msg->msg_namelen = sll->sll_halen +
+ offsetof(struct sockaddr_ll, sll_addr);
++ copy_len = msg->msg_namelen;
++ if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
++ memset(msg->msg_name +
++ offsetof(struct sockaddr_ll, sll_addr),
++ 0, sizeof(sll->sll_addr));
++ msg->msg_namelen = sizeof(struct sockaddr_ll);
++ }
+ }
+- memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
+- msg->msg_namelen);
++ memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ }
+
+ if (pkt_sk(sk)->auxdata) {
+diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c
+index 9252ad126335..ac46d8961b61 100644
+--- a/net/rds/ib_stats.c
++++ b/net/rds/ib_stats.c
+@@ -42,7 +42,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_ib_statistics, rds_ib_stats);
+ static const char *const rds_ib_stat_names[] = {
+ "ib_connect_raced",
+ "ib_listen_closed_stale",
+- "s_ib_evt_handler_call",
++ "ib_evt_handler_call",
+ "ib_tasklet_call",
+ "ib_tx_cq_event",
+ "ib_tx_ring_full",
+diff --git a/net/rds/stats.c b/net/rds/stats.c
+index 73be187d389e..6bbab4d74c4f 100644
+--- a/net/rds/stats.c
++++ b/net/rds/stats.c
+@@ -76,6 +76,8 @@ static const char *const rds_stat_names[] = {
+ "cong_update_received",
+ "cong_send_error",
+ "cong_send_blocked",
++ "recv_bytes_added_to_sock",
++ "recv_bytes_freed_fromsock",
+ };
+
+ void rds_stats_info_copy(struct rds_info_iterator *iter,
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index 7319d3ca30e9..a74edb10cbfc 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -869,7 +869,6 @@ static void rxrpc_sock_destructor(struct sock *sk)
+ static int rxrpc_release_sock(struct sock *sk)
+ {
+ struct rxrpc_sock *rx = rxrpc_sk(sk);
+- struct rxrpc_net *rxnet = rxrpc_net(sock_net(&rx->sk));
+
+ _enter("%p{%d,%d}", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
+
+@@ -905,8 +904,6 @@ static int rxrpc_release_sock(struct sock *sk)
+ rxrpc_release_calls_on_socket(rx);
+ flush_workqueue(rxrpc_workqueue);
+ rxrpc_purge_queue(&sk->sk_receive_queue);
+- rxrpc_queue_work(&rxnet->service_conn_reaper);
+- rxrpc_queue_work(&rxnet->client_conn_reaper);
+
+ rxrpc_unuse_local(rx->local);
+ rx->local = NULL;
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index dfd9eab77cc8..ccef6e40e002 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -644,6 +644,7 @@ struct rxrpc_call {
+ u8 ackr_reason; /* reason to ACK */
+ u16 ackr_skew; /* skew on packet being ACK'd */
+ rxrpc_serial_t ackr_serial; /* serial of packet being ACK'd */
++ rxrpc_serial_t ackr_first_seq; /* first sequence number received */
+ rxrpc_seq_t ackr_prev_seq; /* previous sequence number received */
+ rxrpc_seq_t ackr_consumed; /* Highest packet shown consumed */
+ rxrpc_seq_t ackr_seen; /* Highest packet shown seen */
+@@ -902,6 +903,7 @@ void rxrpc_disconnect_client_call(struct rxrpc_call *);
+ void rxrpc_put_client_conn(struct rxrpc_connection *);
+ void rxrpc_discard_expired_client_conns(struct work_struct *);
+ void rxrpc_destroy_all_client_connections(struct rxrpc_net *);
++void rxrpc_clean_up_local_conns(struct rxrpc_local *);
+
+ /*
+ * conn_event.c
+diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
+index 8079aacaecac..c5566bc4aaca 100644
+--- a/net/rxrpc/call_accept.c
++++ b/net/rxrpc/call_accept.c
+@@ -88,7 +88,7 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx,
+ smp_store_release(&b->conn_backlog_head,
+ (head + 1) & (size - 1));
+
+- trace_rxrpc_conn(conn, rxrpc_conn_new_service,
++ trace_rxrpc_conn(conn->debug_id, rxrpc_conn_new_service,
+ atomic_read(&conn->usage), here);
+ }
+
+diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
+index c979a56faaef..38d548532024 100644
+--- a/net/rxrpc/conn_client.c
++++ b/net/rxrpc/conn_client.c
+@@ -217,7 +217,8 @@ rxrpc_alloc_client_connection(struct rxrpc_conn_parameters *cp, gfp_t gfp)
+ rxrpc_get_local(conn->params.local);
+ key_get(conn->params.key);
+
+- trace_rxrpc_conn(conn, rxrpc_conn_new_client, atomic_read(&conn->usage),
++ trace_rxrpc_conn(conn->debug_id, rxrpc_conn_new_client,
++ atomic_read(&conn->usage),
+ __builtin_return_address(0));
+ trace_rxrpc_client(conn, -1, rxrpc_client_alloc);
+ _leave(" = %p", conn);
+@@ -989,11 +990,12 @@ rxrpc_put_one_client_conn(struct rxrpc_connection *conn)
+ void rxrpc_put_client_conn(struct rxrpc_connection *conn)
+ {
+ const void *here = __builtin_return_address(0);
++ unsigned int debug_id = conn->debug_id;
+ int n;
+
+ do {
+ n = atomic_dec_return(&conn->usage);
+- trace_rxrpc_conn(conn, rxrpc_conn_put_client, n, here);
++ trace_rxrpc_conn(debug_id, rxrpc_conn_put_client, n, here);
+ if (n > 0)
+ return;
+ ASSERTCMP(n, >=, 0);
+@@ -1166,3 +1168,47 @@ void rxrpc_destroy_all_client_connections(struct rxrpc_net *rxnet)
+
+ _leave("");
+ }
++
++/*
++ * Clean up the client connections on a local endpoint.
++ */
++void rxrpc_clean_up_local_conns(struct rxrpc_local *local)
++{
++ struct rxrpc_connection *conn, *tmp;
++ struct rxrpc_net *rxnet = local->rxnet;
++ unsigned int nr_active;
++ LIST_HEAD(graveyard);
++
++ _enter("");
++
++ spin_lock(&rxnet->client_conn_cache_lock);
++ nr_active = rxnet->nr_active_client_conns;
++
++ list_for_each_entry_safe(conn, tmp, &rxnet->idle_client_conns,
++ cache_link) {
++ if (conn->params.local == local) {
++ ASSERTCMP(conn->cache_state, ==, RXRPC_CONN_CLIENT_IDLE);
++
++ trace_rxrpc_client(conn, -1, rxrpc_client_discard);
++ if (!test_and_clear_bit(RXRPC_CONN_EXPOSED, &conn->flags))
++ BUG();
++ conn->cache_state = RXRPC_CONN_CLIENT_INACTIVE;
++ list_move(&conn->cache_link, &graveyard);
++ nr_active--;
++ }
++ }
++
++ rxnet->nr_active_client_conns = nr_active;
++ spin_unlock(&rxnet->client_conn_cache_lock);
++ ASSERTCMP(nr_active, >=, 0);
++
++ while (!list_empty(&graveyard)) {
++ conn = list_entry(graveyard.next,
++ struct rxrpc_connection, cache_link);
++ list_del_init(&conn->cache_link);
++
++ rxrpc_put_connection(conn);
++ }
++
++ _leave(" [culled]");
++}
+diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
+index 885dae829f4a..f338efd2880a 100644
+--- a/net/rxrpc/conn_object.c
++++ b/net/rxrpc/conn_object.c
+@@ -272,7 +272,7 @@ bool rxrpc_queue_conn(struct rxrpc_connection *conn)
+ if (n == 0)
+ return false;
+ if (rxrpc_queue_work(&conn->processor))
+- trace_rxrpc_conn(conn, rxrpc_conn_queued, n + 1, here);
++ trace_rxrpc_conn(conn->debug_id, rxrpc_conn_queued, n + 1, here);
+ else
+ rxrpc_put_connection(conn);
+ return true;
+@@ -287,7 +287,7 @@ void rxrpc_see_connection(struct rxrpc_connection *conn)
+ if (conn) {
+ int n = atomic_read(&conn->usage);
+
+- trace_rxrpc_conn(conn, rxrpc_conn_seen, n, here);
++ trace_rxrpc_conn(conn->debug_id, rxrpc_conn_seen, n, here);
+ }
+ }
+
+@@ -299,7 +299,7 @@ void rxrpc_get_connection(struct rxrpc_connection *conn)
+ const void *here = __builtin_return_address(0);
+ int n = atomic_inc_return(&conn->usage);
+
+- trace_rxrpc_conn(conn, rxrpc_conn_got, n, here);
++ trace_rxrpc_conn(conn->debug_id, rxrpc_conn_got, n, here);
+ }
+
+ /*
+@@ -313,7 +313,7 @@ rxrpc_get_connection_maybe(struct rxrpc_connection *conn)
+ if (conn) {
+ int n = atomic_fetch_add_unless(&conn->usage, 1, 0);
+ if (n > 0)
+- trace_rxrpc_conn(conn, rxrpc_conn_got, n + 1, here);
++ trace_rxrpc_conn(conn->debug_id, rxrpc_conn_got, n + 1, here);
+ else
+ conn = NULL;
+ }
+@@ -336,10 +336,11 @@ static void rxrpc_set_service_reap_timer(struct rxrpc_net *rxnet,
+ void rxrpc_put_service_conn(struct rxrpc_connection *conn)
+ {
+ const void *here = __builtin_return_address(0);
++ unsigned int debug_id = conn->debug_id;
+ int n;
+
+ n = atomic_dec_return(&conn->usage);
+- trace_rxrpc_conn(conn, rxrpc_conn_put_service, n, here);
++ trace_rxrpc_conn(debug_id, rxrpc_conn_put_service, n, here);
+ ASSERTCMP(n, >=, 0);
+ if (n == 1)
+ rxrpc_set_service_reap_timer(conn->params.local->rxnet,
+@@ -401,7 +402,7 @@ void rxrpc_service_connection_reaper(struct work_struct *work)
+ if (conn->state == RXRPC_CONN_SERVICE_PREALLOC)
+ continue;
+
+- if (rxnet->live) {
++ if (rxnet->live && !conn->params.local->dead) {
+ idle_timestamp = READ_ONCE(conn->idle_timestamp);
+ expire_at = idle_timestamp + rxrpc_connection_expiry * HZ;
+ if (conn->params.local->service_closed)
+@@ -423,7 +424,7 @@ void rxrpc_service_connection_reaper(struct work_struct *work)
+ */
+ if (atomic_cmpxchg(&conn->usage, 1, 0) != 1)
+ continue;
+- trace_rxrpc_conn(conn, rxrpc_conn_reap_service, 0, NULL);
++ trace_rxrpc_conn(conn->debug_id, rxrpc_conn_reap_service, 0, NULL);
+
+ if (rxrpc_conn_is_client(conn))
+ BUG();
+diff --git a/net/rxrpc/conn_service.c b/net/rxrpc/conn_service.c
+index 80773a50c755..6da7c4bf15e8 100644
+--- a/net/rxrpc/conn_service.c
++++ b/net/rxrpc/conn_service.c
+@@ -138,7 +138,7 @@ struct rxrpc_connection *rxrpc_prealloc_service_connection(struct rxrpc_net *rxn
+ list_add_tail(&conn->proc_link, &rxnet->conn_proc_list);
+ write_unlock(&rxnet->conn_lock);
+
+- trace_rxrpc_conn(conn, rxrpc_conn_new_service,
++ trace_rxrpc_conn(conn->debug_id, rxrpc_conn_new_service,
+ atomic_read(&conn->usage),
+ __builtin_return_address(0));
+ }
+diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
+index 7965600ee5de..2f91ab909191 100644
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -837,7 +837,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+ u8 acks[RXRPC_MAXACKS];
+ } buf;
+ rxrpc_serial_t acked_serial;
+- rxrpc_seq_t first_soft_ack, hard_ack;
++ rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt;
+ int nr_acks, offset, ioffset;
+
+ _enter("");
+@@ -851,13 +851,14 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+
+ acked_serial = ntohl(buf.ack.serial);
+ first_soft_ack = ntohl(buf.ack.firstPacket);
++ prev_pkt = ntohl(buf.ack.previousPacket);
+ hard_ack = first_soft_ack - 1;
+ nr_acks = buf.ack.nAcks;
+ summary.ack_reason = (buf.ack.reason < RXRPC_ACK__INVALID ?
+ buf.ack.reason : RXRPC_ACK__INVALID);
+
+ trace_rxrpc_rx_ack(call, sp->hdr.serial, acked_serial,
+- first_soft_ack, ntohl(buf.ack.previousPacket),
++ first_soft_ack, prev_pkt,
+ summary.ack_reason, nr_acks);
+
+ if (buf.ack.reason == RXRPC_ACK_PING_RESPONSE)
+@@ -878,8 +879,9 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+ rxrpc_propose_ack_respond_to_ack);
+ }
+
+- /* Discard any out-of-order or duplicate ACKs. */
+- if (before_eq(sp->hdr.serial, call->acks_latest))
++ /* Discard any out-of-order or duplicate ACKs (outside lock). */
++ if (before(first_soft_ack, call->ackr_first_seq) ||
++ before(prev_pkt, call->ackr_prev_seq))
+ return;
+
+ buf.info.rxMTU = 0;
+@@ -890,12 +892,16 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+
+ spin_lock(&call->input_lock);
+
+- /* Discard any out-of-order or duplicate ACKs. */
+- if (before_eq(sp->hdr.serial, call->acks_latest))
++ /* Discard any out-of-order or duplicate ACKs (inside lock). */
++ if (before(first_soft_ack, call->ackr_first_seq) ||
++ before(prev_pkt, call->ackr_prev_seq))
+ goto out;
+ call->acks_latest_ts = skb->tstamp;
+ call->acks_latest = sp->hdr.serial;
+
++ call->ackr_first_seq = first_soft_ack;
++ call->ackr_prev_seq = prev_pkt;
++
+ /* Parse rwind and mtu sizes if provided. */
+ if (buf.info.rxMTU)
+ rxrpc_input_ackinfo(call, skb, &buf.info);
+diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
+index c752ad487067..04f0976841a4 100644
+--- a/net/rxrpc/local_object.c
++++ b/net/rxrpc/local_object.c
+@@ -430,11 +430,14 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
+
+ _enter("%d", local->debug_id);
+
++ local->dead = true;
++
+ mutex_lock(&rxnet->local_mutex);
+ list_del_init(&local->link);
+ mutex_unlock(&rxnet->local_mutex);
+
+- ASSERT(RB_EMPTY_ROOT(&local->client_conns));
++ rxrpc_clean_up_local_conns(local);
++ rxrpc_service_connection_reaper(&rxnet->service_conn_reaper);
+ ASSERT(!local->service);
+
+ if (socket) {
+diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
+index 345dc1c5fe72..31e47cfb3e68 100644
+--- a/net/rxrpc/output.c
++++ b/net/rxrpc/output.c
+@@ -524,6 +524,9 @@ send_fragmentable:
+ }
+ break;
+ #endif
++
++ default:
++ BUG();
+ }
+
+ if (ret < 0)
+diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
+index 1e269441065a..9ecbf8edcf39 100644
+--- a/net/sched/act_csum.c
++++ b/net/sched/act_csum.c
+@@ -560,8 +560,11 @@ static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
+ struct tcf_result *res)
+ {
+ struct tcf_csum *p = to_tcf_csum(a);
++ bool orig_vlan_tag_present = false;
++ unsigned int vlan_hdr_count = 0;
+ struct tcf_csum_params *params;
+ u32 update_flags;
++ __be16 protocol;
+ int action;
+
+ params = rcu_dereference_bh(p->params);
+@@ -574,7 +577,9 @@ static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
+ goto drop;
+
+ update_flags = params->update_flags;
+- switch (tc_skb_protocol(skb)) {
++ protocol = tc_skb_protocol(skb);
++again:
++ switch (protocol) {
+ case cpu_to_be16(ETH_P_IP):
+ if (!tcf_csum_ipv4(skb, update_flags))
+ goto drop;
+@@ -583,13 +588,35 @@ static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
+ if (!tcf_csum_ipv6(skb, update_flags))
+ goto drop;
+ break;
++ case cpu_to_be16(ETH_P_8021AD): /* fall through */
++ case cpu_to_be16(ETH_P_8021Q):
++ if (skb_vlan_tag_present(skb) && !orig_vlan_tag_present) {
++ protocol = skb->protocol;
++ orig_vlan_tag_present = true;
++ } else {
++ struct vlan_hdr *vlan = (struct vlan_hdr *)skb->data;
++
++ protocol = vlan->h_vlan_encapsulated_proto;
++ skb_pull(skb, VLAN_HLEN);
++ skb_reset_network_header(skb);
++ vlan_hdr_count++;
++ }
++ goto again;
++ }
++
++out:
++ /* Restore the skb for the pulled VLAN tags */
++ while (vlan_hdr_count--) {
++ skb_push(skb, VLAN_HLEN);
++ skb_reset_network_header(skb);
+ }
+
+ return action;
+
+ drop:
+ qstats_drop_inc(this_cpu_ptr(p->common.cpu_qstats));
+- return TC_ACT_SHOT;
++ action = TC_ACT_SHOT;
++ goto out;
+ }
+
+ static int tcf_csum_dump(struct sk_buff *skb, struct tc_action *a, int bind,
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index 399e3beae6cf..a30c17a28281 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -445,7 +445,11 @@ static int __init mirred_init_module(void)
+ return err;
+
+ pr_info("Mirror/redirect action on\n");
+- return tcf_register_action(&act_mirred_ops, &mirred_net_ops);
++ err = tcf_register_action(&act_mirred_ops, &mirred_net_ops);
++ if (err)
++ unregister_netdevice_notifier(&mirred_device_notifier);
++
++ return err;
+ }
+
+ static void __exit mirred_cleanup_module(void)
+diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
+index e26a24017faa..940e72d6db18 100644
+--- a/net/sched/sch_cbs.c
++++ b/net/sched/sch_cbs.c
+@@ -61,16 +61,20 @@
+ #include <linux/string.h>
+ #include <linux/errno.h>
+ #include <linux/skbuff.h>
++#include <net/netevent.h>
+ #include <net/netlink.h>
+ #include <net/sch_generic.h>
+ #include <net/pkt_sched.h>
+
++static LIST_HEAD(cbs_list);
++static DEFINE_SPINLOCK(cbs_list_lock);
++
+ #define BYTES_PER_KBIT (1000LL / 8)
+
+ struct cbs_sched_data {
+ bool offload;
+ int queue;
+- s64 port_rate; /* in bytes/s */
++ atomic64_t port_rate; /* in bytes/s */
+ s64 last; /* timestamp in ns */
+ s64 credits; /* in bytes */
+ s32 locredit; /* in bytes */
+@@ -82,6 +86,7 @@ struct cbs_sched_data {
+ struct sk_buff **to_free);
+ struct sk_buff *(*dequeue)(struct Qdisc *sch);
+ struct Qdisc *qdisc;
++ struct list_head cbs_list;
+ };
+
+ static int cbs_child_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+@@ -206,7 +211,8 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
+ /* As sendslope is a negative number, this will decrease the
+ * amount of q->credits.
+ */
+- credits = credits_from_len(len, q->sendslope, q->port_rate);
++ credits = credits_from_len(len, q->sendslope,
++ atomic64_read(&q->port_rate));
+ credits += q->credits;
+
+ q->credits = max_t(s64, credits, q->locredit);
+@@ -293,6 +299,58 @@ static int cbs_enable_offload(struct net_device *dev, struct cbs_sched_data *q,
+ return 0;
+ }
+
++static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
++{
++ struct ethtool_link_ksettings ecmd;
++ int speed = SPEED_10;
++ int port_rate = -1;
++ int err;
++
++ err = __ethtool_get_link_ksettings(dev, &ecmd);
++ if (err < 0)
++ goto skip;
++
++ if (ecmd.base.speed && ecmd.base.speed != SPEED_UNKNOWN)
++ speed = ecmd.base.speed;
++
++skip:
++ port_rate = speed * 1000 * BYTES_PER_KBIT;
++
++ atomic64_set(&q->port_rate, port_rate);
++ netdev_dbg(dev, "cbs: set %s's port_rate to: %lld, linkspeed: %d\n",
++ dev->name, (long long)atomic64_read(&q->port_rate),
++ ecmd.base.speed);
++}
++
++static int cbs_dev_notifier(struct notifier_block *nb, unsigned long event,
++ void *ptr)
++{
++ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++ struct cbs_sched_data *q;
++ struct net_device *qdev;
++ bool found = false;
++
++ ASSERT_RTNL();
++
++ if (event != NETDEV_UP && event != NETDEV_CHANGE)
++ return NOTIFY_DONE;
++
++ spin_lock(&cbs_list_lock);
++ list_for_each_entry(q, &cbs_list, cbs_list) {
++ qdev = qdisc_dev(q->qdisc);
++ if (qdev == dev) {
++ found = true;
++ break;
++ }
++ }
++ spin_unlock(&cbs_list_lock);
++
++ if (found)
++ cbs_set_port_rate(dev, q);
++
++ return NOTIFY_DONE;
++}
++
+ static int cbs_change(struct Qdisc *sch, struct nlattr *opt,
+ struct netlink_ext_ack *extack)
+ {
+@@ -314,16 +372,7 @@ static int cbs_change(struct Qdisc *sch, struct nlattr *opt,
+ qopt = nla_data(tb[TCA_CBS_PARMS]);
+
+ if (!qopt->offload) {
+- struct ethtool_link_ksettings ecmd;
+- s64 link_speed;
+-
+- if (!__ethtool_get_link_ksettings(dev, &ecmd))
+- link_speed = ecmd.base.speed;
+- else
+- link_speed = SPEED_1000;
+-
+- q->port_rate = link_speed * 1000 * BYTES_PER_KBIT;
+-
++ cbs_set_port_rate(dev, q);
+ cbs_disable_offload(dev, q);
+ } else {
+ err = cbs_enable_offload(dev, q, qopt, extack);
+@@ -346,6 +395,7 @@ static int cbs_init(struct Qdisc *sch, struct nlattr *opt,
+ {
+ struct cbs_sched_data *q = qdisc_priv(sch);
+ struct net_device *dev = qdisc_dev(sch);
++ int err;
+
+ if (!opt) {
+ NL_SET_ERR_MSG(extack, "Missing CBS qdisc options which are mandatory");
+@@ -366,7 +416,17 @@ static int cbs_init(struct Qdisc *sch, struct nlattr *opt,
+
+ qdisc_watchdog_init(&q->watchdog, sch);
+
+- return cbs_change(sch, opt, extack);
++ err = cbs_change(sch, opt, extack);
++ if (err)
++ return err;
++
++ if (!q->offload) {
++ spin_lock(&cbs_list_lock);
++ list_add(&q->cbs_list, &cbs_list);
++ spin_unlock(&cbs_list_lock);
++ }
++
++ return 0;
+ }
+
+ static void cbs_destroy(struct Qdisc *sch)
+@@ -374,8 +434,11 @@ static void cbs_destroy(struct Qdisc *sch)
+ struct cbs_sched_data *q = qdisc_priv(sch);
+ struct net_device *dev = qdisc_dev(sch);
+
+- qdisc_watchdog_cancel(&q->watchdog);
++ spin_lock(&cbs_list_lock);
++ list_del(&q->cbs_list);
++ spin_unlock(&cbs_list_lock);
+
++ qdisc_watchdog_cancel(&q->watchdog);
+ cbs_disable_offload(dev, q);
+
+ if (q->qdisc)
+@@ -486,14 +549,29 @@ static struct Qdisc_ops cbs_qdisc_ops __read_mostly = {
+ .owner = THIS_MODULE,
+ };
+
++static struct notifier_block cbs_device_notifier = {
++ .notifier_call = cbs_dev_notifier,
++};
++
+ static int __init cbs_module_init(void)
+ {
+- return register_qdisc(&cbs_qdisc_ops);
++ int err;
++
++ err = register_netdevice_notifier(&cbs_device_notifier);
++ if (err)
++ return err;
++
++ err = register_qdisc(&cbs_qdisc_ops);
++ if (err)
++ unregister_netdevice_notifier(&cbs_device_notifier);
++
++ return err;
+ }
+
+ static void __exit cbs_module_exit(void)
+ {
+ unregister_qdisc(&cbs_qdisc_ops);
++ unregister_netdevice_notifier(&cbs_device_notifier);
+ }
+ module_init(cbs_module_init)
+ module_exit(cbs_module_exit)
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 15f8f24c190d..014a28d8dd4f 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -436,8 +436,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ struct netem_skb_cb *cb;
+ struct sk_buff *skb2;
+ struct sk_buff *segs = NULL;
+- unsigned int len = 0, last_len, prev_len = qdisc_pkt_len(skb);
+- int nb = 0;
++ unsigned int prev_len = qdisc_pkt_len(skb);
+ int count = 1;
+ int rc = NET_XMIT_SUCCESS;
+ int rc_drop = NET_XMIT_DROP;
+@@ -494,6 +493,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ segs = netem_segment(skb, sch, to_free);
+ if (!segs)
+ return rc_drop;
++ qdisc_skb_cb(segs)->pkt_len = segs->len;
+ } else {
+ segs = skb;
+ }
+@@ -509,6 +509,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ if (skb->ip_summed == CHECKSUM_PARTIAL &&
+ skb_checksum_help(skb)) {
+ qdisc_drop(skb, sch, to_free);
++ skb = NULL;
+ goto finish_segs;
+ }
+
+@@ -583,6 +584,12 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+
+ finish_segs:
+ if (segs) {
++ unsigned int len, last_len;
++ int nb;
++
++ len = skb ? skb->len : 0;
++ nb = skb ? 1 : 0;
++
+ while (segs) {
+ skb2 = segs->next;
+ segs->next = NULL;
+@@ -598,9 +605,10 @@ finish_segs:
+ }
+ segs = skb2;
+ }
+- sch->q.qlen += nb;
+- if (nb > 1)
+- qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
++ /* Parent qdiscs accounted for 1 skb of size @prev_len */
++ qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
++ } else if (!skb) {
++ return NET_XMIT_DROP;
+ }
+ return NET_XMIT_SUCCESS;
+ }
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index bfe29158afcc..f64d882c8698 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -255,7 +255,7 @@ int sctp_rcv(struct sk_buff *skb)
+ bh_lock_sock(sk);
+ }
+
+- if (sock_owned_by_user(sk)) {
++ if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
+ if (sctp_add_backlog(sk, skb)) {
+ bh_unlock_sock(sk);
+ sctp_chunk_free(chunk);
+@@ -333,7 +333,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+ local_bh_disable();
+ bh_lock_sock(sk);
+
+- if (sock_owned_by_user(sk)) {
++ if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
+ if (sk_add_backlog(sk, skb, sk->sk_rcvbuf))
+ sctp_chunk_free(chunk);
+ else
+@@ -348,7 +348,13 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+ if (backloged)
+ return 0;
+ } else {
+- sctp_inq_push(inqueue, chunk);
++ if (!sctp_newsk_ready(sk)) {
++ if (!sk_add_backlog(sk, skb, sk->sk_rcvbuf))
++ return 0;
++ sctp_chunk_free(chunk);
++ } else {
++ sctp_inq_push(inqueue, chunk);
++ }
+ }
+
+ done:
+diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c
+index dbf64a93d68a..371b4cf31fcd 100644
+--- a/net/smc/smc_diag.c
++++ b/net/smc/smc_diag.c
+@@ -38,6 +38,7 @@ static void smc_diag_msg_common_fill(struct smc_diag_msg *r, struct sock *sk)
+ {
+ struct smc_sock *smc = smc_sk(sk);
+
++ r->diag_family = sk->sk_family;
+ if (!smc->clcsock)
+ return;
+ r->id.idiag_sport = htons(smc->clcsock->sk->sk_num);
+@@ -45,14 +46,12 @@ static void smc_diag_msg_common_fill(struct smc_diag_msg *r, struct sock *sk)
+ r->id.idiag_if = smc->clcsock->sk->sk_bound_dev_if;
+ sock_diag_save_cookie(sk, r->id.idiag_cookie);
+ if (sk->sk_protocol == SMCPROTO_SMC) {
+- r->diag_family = PF_INET;
+ memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
+ memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
+ r->id.idiag_src[0] = smc->clcsock->sk->sk_rcv_saddr;
+ r->id.idiag_dst[0] = smc->clcsock->sk->sk_daddr;
+ #if IS_ENABLED(CONFIG_IPV6)
+ } else if (sk->sk_protocol == SMCPROTO_SMC6) {
+- r->diag_family = PF_INET6;
+ memcpy(&r->id.idiag_src, &smc->clcsock->sk->sk_v6_rcv_saddr,
+ sizeof(smc->clcsock->sk->sk_v6_rcv_saddr));
+ memcpy(&r->id.idiag_dst, &smc->clcsock->sk->sk_v6_daddr,
+diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c
+index bbcf0fe4ae10..36340912df48 100644
+--- a/net/smc/smc_rx.c
++++ b/net/smc/smc_rx.c
+@@ -212,8 +212,7 @@ int smc_rx_wait(struct smc_sock *smc, long *timeo,
+ rc = sk_wait_event(sk, timeo,
+ sk->sk_err ||
+ sk->sk_shutdown & RCV_SHUTDOWN ||
+- fcrit(conn) ||
+- smc_cdc_rxed_any_close_or_senddone(conn),
++ fcrit(conn),
+ &wait);
+ remove_wait_queue(sk_sleep(sk), &wait);
+ sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+@@ -263,6 +262,18 @@ static int smc_rx_recv_urg(struct smc_sock *smc, struct msghdr *msg, int len,
+ return -EAGAIN;
+ }
+
++static bool smc_rx_recvmsg_data_available(struct smc_sock *smc)
++{
++ struct smc_connection *conn = &smc->conn;
++
++ if (smc_rx_data_available(conn))
++ return true;
++ else if (conn->urg_state == SMC_URG_VALID)
++ /* we received a single urgent Byte - skip */
++ smc_rx_update_cons(smc, 0);
++ return false;
++}
++
+ /* smc_rx_recvmsg - receive data from RMBE
+ * @msg: copy data to receive buffer
+ * @pipe: copy data to pipe if set - indicates splice() call
+@@ -304,16 +315,18 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
+ if (read_done >= target || (pipe && read_done))
+ break;
+
+- if (atomic_read(&conn->bytes_to_rcv))
++ if (smc_rx_recvmsg_data_available(smc))
+ goto copy;
+- else if (conn->urg_state == SMC_URG_VALID)
+- /* we received a single urgent Byte - skip */
+- smc_rx_update_cons(smc, 0);
+
+ if (sk->sk_shutdown & RCV_SHUTDOWN ||
+- smc_cdc_rxed_any_close_or_senddone(conn) ||
+- conn->local_tx_ctrl.conn_state_flags.peer_conn_abort)
++ conn->local_tx_ctrl.conn_state_flags.peer_conn_abort) {
++ /* smc_cdc_msg_recv_action() could have run after
++ * above smc_rx_recvmsg_data_available()
++ */
++ if (smc_rx_recvmsg_data_available(smc))
++ goto copy;
+ break;
++ }
+
+ if (read_done) {
+ if (sk->sk_err ||
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index 1a65f88d021a..24c7a1e2bd34 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -1054,24 +1054,32 @@ gss_read_verf(struct rpc_gss_wire_cred *gc,
+ return 0;
+ }
+
+-/* Ok this is really heavily depending on a set of semantics in
+- * how rqstp is set up by svc_recv and pages laid down by the
+- * server when reading a request. We are basically guaranteed that
+- * the token lays all down linearly across a set of pages, starting
+- * at iov_base in rq_arg.head[0] which happens to be the first of a
+- * set of pages stored in rq_pages[].
+- * rq_arg.head[0].iov_base will provide us the page_base to pass
+- * to the upcall.
+- */
+-static inline int
+-gss_read_proxy_verf(struct svc_rqst *rqstp,
+- struct rpc_gss_wire_cred *gc, __be32 *authp,
+- struct xdr_netobj *in_handle,
+- struct gssp_in_token *in_token)
++static void gss_free_in_token_pages(struct gssp_in_token *in_token)
+ {
+- struct kvec *argv = &rqstp->rq_arg.head[0];
+ u32 inlen;
+- int res;
++ int i;
++
++ i = 0;
++ inlen = in_token->page_len;
++ while (inlen) {
++ if (in_token->pages[i])
++ put_page(in_token->pages[i]);
++ inlen -= inlen > PAGE_SIZE ? PAGE_SIZE : inlen;
++ }
++
++ kfree(in_token->pages);
++ in_token->pages = NULL;
++}
++
++static int gss_read_proxy_verf(struct svc_rqst *rqstp,
++ struct rpc_gss_wire_cred *gc, __be32 *authp,
++ struct xdr_netobj *in_handle,
++ struct gssp_in_token *in_token)
++{
++ struct kvec *argv = &rqstp->rq_arg.head[0];
++ unsigned int page_base, length;
++ int pages, i, res;
++ size_t inlen;
+
+ res = gss_read_common_verf(gc, argv, authp, in_handle);
+ if (res)
+@@ -1081,10 +1089,36 @@ gss_read_proxy_verf(struct svc_rqst *rqstp,
+ if (inlen > (argv->iov_len + rqstp->rq_arg.page_len))
+ return SVC_DENIED;
+
+- in_token->pages = rqstp->rq_pages;
+- in_token->page_base = (ulong)argv->iov_base & ~PAGE_MASK;
++ pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
++ in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
++ if (!in_token->pages)
++ return SVC_DENIED;
++ in_token->page_base = 0;
+ in_token->page_len = inlen;
++ for (i = 0; i < pages; i++) {
++ in_token->pages[i] = alloc_page(GFP_KERNEL);
++ if (!in_token->pages[i]) {
++ gss_free_in_token_pages(in_token);
++ return SVC_DENIED;
++ }
++ }
+
++ length = min_t(unsigned int, inlen, argv->iov_len);
++ memcpy(page_address(in_token->pages[0]), argv->iov_base, length);
++ inlen -= length;
++
++ i = 1;
++ page_base = rqstp->rq_arg.page_base;
++ while (inlen) {
++ length = min_t(unsigned int, inlen, PAGE_SIZE);
++ memcpy(page_address(in_token->pages[i]),
++ page_address(rqstp->rq_arg.pages[i]) + page_base,
++ length);
++
++ inlen -= length;
++ page_base = 0;
++ i++;
++ }
+ return 0;
+ }
+
+@@ -1259,8 +1293,11 @@ static int svcauth_gss_proxy_init(struct svc_rqst *rqstp,
+ break;
+ case GSS_S_COMPLETE:
+ status = gss_proxy_save_rsc(sn->rsc_cache, &ud, &handle);
+- if (status)
++ if (status) {
++ pr_info("%s: gss_proxy_save_rsc failed (%d)\n",
++ __func__, status);
+ goto out;
++ }
+ cli_handle.data = (u8 *)&handle;
+ cli_handle.len = sizeof(handle);
+ break;
+@@ -1271,15 +1308,20 @@ static int svcauth_gss_proxy_init(struct svc_rqst *rqstp,
+
+ /* Got an answer to the upcall; use it: */
+ if (gss_write_init_verf(sn->rsc_cache, rqstp,
+- &cli_handle, &ud.major_status))
++ &cli_handle, &ud.major_status)) {
++ pr_info("%s: gss_write_init_verf failed\n", __func__);
+ goto out;
++ }
+ if (gss_write_resv(resv, PAGE_SIZE,
+ &cli_handle, &ud.out_token,
+- ud.major_status, ud.minor_status))
++ ud.major_status, ud.minor_status)) {
++ pr_info("%s: gss_write_resv failed\n", __func__);
+ goto out;
++ }
+
+ ret = SVC_COMPLETE;
+ out:
++ gss_free_in_token_pages(&ud.in_token);
+ gssp_free_upcall_data(&ud);
+ return ret;
+ }
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 90ec322dbbc0..ef1f3d076af9 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -1558,10 +1558,11 @@ rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp)
+ rc = ib_post_recv(r_xprt->rx_ia.ri_id->qp, wr,
+ (const struct ib_recv_wr **)&bad_wr);
+ if (rc) {
+- for (wr = bad_wr; wr; wr = wr->next) {
++ for (wr = bad_wr; wr;) {
+ struct rpcrdma_rep *rep;
+
+ rep = container_of(wr, struct rpcrdma_rep, rr_recv_wr);
++ wr = wr->next;
+ rpcrdma_recv_buffer_put(rep);
+ --count;
+ }
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 0fbf8ea18ce0..cc9a0485536b 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -830,18 +830,31 @@ static int link_schedule_user(struct tipc_link *l, struct tipc_msg *hdr)
+ */
+ static void link_prepare_wakeup(struct tipc_link *l)
+ {
++ struct sk_buff_head *wakeupq = &l->wakeupq;
++ struct sk_buff_head *inputq = l->inputq;
+ struct sk_buff *skb, *tmp;
+- int imp, i = 0;
++ struct sk_buff_head tmpq;
++ int avail[5] = {0,};
++ int imp = 0;
++
++ __skb_queue_head_init(&tmpq);
+
+- skb_queue_walk_safe(&l->wakeupq, skb, tmp) {
++ for (; imp <= TIPC_SYSTEM_IMPORTANCE; imp++)
++ avail[imp] = l->backlog[imp].limit - l->backlog[imp].len;
++
++ skb_queue_walk_safe(wakeupq, skb, tmp) {
+ imp = TIPC_SKB_CB(skb)->chain_imp;
+- if (l->backlog[imp].len < l->backlog[imp].limit) {
+- skb_unlink(skb, &l->wakeupq);
+- skb_queue_tail(l->inputq, skb);
+- } else if (i++ > 10) {
+- break;
+- }
++ if (avail[imp] <= 0)
++ continue;
++ avail[imp]--;
++ __skb_unlink(skb, wakeupq);
++ __skb_queue_tail(&tmpq, skb);
+ }
++
++ spin_lock_bh(&inputq->lock);
++ skb_queue_splice_tail(&tmpq, inputq);
++ spin_unlock_bh(&inputq->lock);
++
+ }
+
+ void tipc_link_reset(struct tipc_link *l)
+diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
+index 67f69389ec17..23706ee16607 100644
+--- a/net/tipc/monitor.c
++++ b/net/tipc/monitor.c
+@@ -665,6 +665,21 @@ void tipc_mon_delete(struct net *net, int bearer_id)
+ kfree(mon);
+ }
+
++void tipc_mon_reinit_self(struct net *net)
++{
++ struct tipc_monitor *mon;
++ int bearer_id;
++
++ for (bearer_id = 0; bearer_id < MAX_BEARERS; bearer_id++) {
++ mon = tipc_monitor(net, bearer_id);
++ if (!mon)
++ continue;
++ write_lock_bh(&mon->lock);
++ mon->self->addr = tipc_own_addr(net);
++ write_unlock_bh(&mon->lock);
++ }
++}
++
+ int tipc_nl_monitor_set_threshold(struct net *net, u32 cluster_size)
+ {
+ struct tipc_net *tn = tipc_net(net);
+diff --git a/net/tipc/monitor.h b/net/tipc/monitor.h
+index 2a21b93e0d04..ed63d2e650b0 100644
+--- a/net/tipc/monitor.h
++++ b/net/tipc/monitor.h
+@@ -77,6 +77,7 @@ int __tipc_nl_add_monitor(struct net *net, struct tipc_nl_msg *msg,
+ u32 bearer_id);
+ int tipc_nl_add_monitor_peer(struct net *net, struct tipc_nl_msg *msg,
+ u32 bearer_id, u32 *prev_node);
++void tipc_mon_reinit_self(struct net *net);
+
+ extern const int tipc_max_domain_size;
+ #endif
+diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
+index e0a3dd424d8c..836e629e8f4a 100644
+--- a/net/tipc/name_distr.c
++++ b/net/tipc/name_distr.c
+@@ -94,8 +94,9 @@ struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ)
+ list_add_tail_rcu(&publ->binding_node, &nt->node_scope);
+ return NULL;
+ }
+- list_add_tail_rcu(&publ->binding_node, &nt->cluster_scope);
+-
++ write_lock_bh(&nt->cluster_scope_lock);
++ list_add_tail(&publ->binding_node, &nt->cluster_scope);
++ write_unlock_bh(&nt->cluster_scope_lock);
+ skb = named_prepare_buf(net, PUBLICATION, ITEM_SIZE, 0);
+ if (!skb) {
+ pr_warn("Publication distribution failure\n");
+@@ -112,11 +113,13 @@ struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ)
+ */
+ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ)
+ {
++ struct name_table *nt = tipc_name_table(net);
+ struct sk_buff *buf;
+ struct distr_item *item;
+
+- list_del_rcu(&publ->binding_node);
+-
++ write_lock_bh(&nt->cluster_scope_lock);
++ list_del(&publ->binding_node);
++ write_unlock_bh(&nt->cluster_scope_lock);
+ if (publ->scope == TIPC_NODE_SCOPE)
+ return NULL;
+
+@@ -147,7 +150,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
+ ITEM_SIZE) * ITEM_SIZE;
+ u32 msg_rem = msg_dsz;
+
+- list_for_each_entry_rcu(publ, pls, binding_node) {
++ list_for_each_entry(publ, pls, binding_node) {
+ /* Prepare next buffer: */
+ if (!skb) {
+ skb = named_prepare_buf(net, PUBLICATION, msg_rem,
+@@ -189,11 +192,10 @@ void tipc_named_node_up(struct net *net, u32 dnode)
+
+ __skb_queue_head_init(&head);
+
+- rcu_read_lock();
++ read_lock_bh(&nt->cluster_scope_lock);
+ named_distribute(net, &head, dnode, &nt->cluster_scope);
+- rcu_read_unlock();
+-
+ tipc_node_xmit(net, &head, dnode, 0);
++ read_unlock_bh(&nt->cluster_scope_lock);
+ }
+
+ /**
+diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
+index d72985ca1d55..89993afe0fbd 100644
+--- a/net/tipc/name_table.c
++++ b/net/tipc/name_table.c
+@@ -744,6 +744,7 @@ int tipc_nametbl_init(struct net *net)
+
+ INIT_LIST_HEAD(&nt->node_scope);
+ INIT_LIST_HEAD(&nt->cluster_scope);
++ rwlock_init(&nt->cluster_scope_lock);
+ tn->nametbl = nt;
+ spin_lock_init(&tn->nametbl_lock);
+ return 0;
+diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h
+index 892bd750b85f..f79066334cc8 100644
+--- a/net/tipc/name_table.h
++++ b/net/tipc/name_table.h
+@@ -100,6 +100,7 @@ struct name_table {
+ struct hlist_head services[TIPC_NAMETBL_SIZE];
+ struct list_head node_scope;
+ struct list_head cluster_scope;
++ rwlock_t cluster_scope_lock;
+ u32 local_publ_count;
+ };
+
+diff --git a/net/tipc/net.c b/net/tipc/net.c
+index 7ce1e86b024f..2e2e938fe4b7 100644
+--- a/net/tipc/net.c
++++ b/net/tipc/net.c
+@@ -42,6 +42,7 @@
+ #include "node.h"
+ #include "bcast.h"
+ #include "netlink.h"
++#include "monitor.h"
+
+ /*
+ * The TIPC locking policy is designed to ensure a very fine locking
+@@ -136,6 +137,7 @@ static void tipc_net_finalize(struct net *net, u32 addr)
+ tipc_set_node_addr(net, addr);
+ tipc_named_reinit(net);
+ tipc_sk_reinit(net);
++ tipc_mon_reinit_self(net);
+ tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
+ TIPC_CLUSTER_SCOPE, 0, addr);
+ }
+diff --git a/net/tipc/node.c b/net/tipc/node.c
+index 32556f480a60..e67ffd194927 100644
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -810,10 +810,10 @@ static void __tipc_node_link_down(struct tipc_node *n, int *bearer_id,
+ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
+ {
+ struct tipc_link_entry *le = &n->links[bearer_id];
++ struct tipc_media_addr *maddr = NULL;
+ struct tipc_link *l = le->link;
+- struct tipc_media_addr *maddr;
+- struct sk_buff_head xmitq;
+ int old_bearer_id = bearer_id;
++ struct sk_buff_head xmitq;
+
+ if (!l)
+ return;
+@@ -835,7 +835,8 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
+ tipc_node_write_unlock(n);
+ if (delete)
+ tipc_mon_remove_peer(n->net, n->addr, old_bearer_id);
+- tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
++ if (!skb_queue_empty(&xmitq))
++ tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
+ tipc_sk_rcv(n->net, &le->inputq);
+ }
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 5841d62ff580..40947ad90222 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -501,7 +501,7 @@ static void __tipc_shutdown(struct socket *sock, int error)
+ struct sock *sk = sock->sk;
+ struct tipc_sock *tsk = tipc_sk(sk);
+ struct net *net = sock_net(sk);
+- long timeout = CONN_TIMEOUT_DEFAULT;
++ long timeout = msecs_to_jiffies(CONN_TIMEOUT_DEFAULT);
+ u32 dnode = tsk_peer_node(tsk);
+ struct sk_buff *skb;
+
+diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
+index 1a779b1e8510..40f6d82083d7 100644
+--- a/net/tipc/sysctl.c
++++ b/net/tipc/sysctl.c
+@@ -37,6 +37,8 @@
+
+ #include <linux/sysctl.h>
+
++static int zero;
++static int one = 1;
+ static struct ctl_table_header *tipc_ctl_hdr;
+
+ static struct ctl_table tipc_table[] = {
+@@ -45,14 +47,16 @@ static struct ctl_table tipc_table[] = {
+ .data = &sysctl_tipc_rmem,
+ .maxlen = sizeof(sysctl_tipc_rmem),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &one,
+ },
+ {
+ .procname = "named_timeout",
+ .data = &sysctl_tipc_named_timeout,
+ .maxlen = sizeof(sysctl_tipc_named_timeout),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &zero,
+ },
+ {}
+ };
+diff --git a/net/tls/tls_device_fallback.c b/net/tls/tls_device_fallback.c
+index 426dd97725e4..6cf832891b53 100644
+--- a/net/tls/tls_device_fallback.c
++++ b/net/tls/tls_device_fallback.c
+@@ -208,6 +208,10 @@ static void complete_skb(struct sk_buff *nskb, struct sk_buff *skb, int headln)
+
+ update_chksum(nskb, headln);
+
++ /* sock_efree means skb must gone through skb_orphan_partial() */
++ if (nskb->destructor == sock_efree)
++ return;
++
+ delta = nskb->truesize - skb->truesize;
+ if (likely(delta < 0))
+ WARN_ON_ONCE(refcount_sub_and_test(-delta, &sk->sk_wmem_alloc));
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 64841238df85..5643bdee7198 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -3870,6 +3870,15 @@ static int __init regulatory_init_db(void)
+ {
+ int err;
+
++ /*
++ * It's possible that - due to other bugs/issues - cfg80211
++ * never called regulatory_init() below, or that it failed;
++ * in that case, don't try to do any further work here as
++ * it's doomed to lead to crashes.
++ */
++ if (IS_ERR_OR_NULL(reg_pdev))
++ return -EINVAL;
++
+ err = load_builtin_regdb_keys();
+ if (err)
+ return err;
+diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
+index d9117ab035f7..556a649512b6 100644
+--- a/net/xdp/xdp_umem.c
++++ b/net/xdp/xdp_umem.c
+@@ -23,6 +23,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
+ {
+ unsigned long flags;
+
++ if (!xs->tx)
++ return;
++
+ spin_lock_irqsave(&umem->xsk_list_lock, flags);
+ list_add_rcu(&xs->list, &umem->xsk_list);
+ spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
+@@ -32,6 +35,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
+ {
+ unsigned long flags;
+
++ if (!xs->tx)
++ return;
++
+ spin_lock_irqsave(&umem->xsk_list_lock, flags);
+ list_del_rcu(&xs->list);
+ spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index ff15207036dc..72caa4fb13f4 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -218,6 +218,9 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
+
+ mutex_lock(&xs->mutex);
+
++ if (xs->queue_id >= xs->dev->real_num_tx_queues)
++ goto out;
++
+ while (xskq_peek_desc(xs->tx, &desc)) {
+ char *buffer;
+ u64 addr;
+@@ -228,12 +231,6 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
+ goto out;
+ }
+
+- if (xskq_reserve_addr(xs->umem->cq))
+- goto out;
+-
+- if (xs->queue_id >= xs->dev->real_num_tx_queues)
+- goto out;
+-
+ len = desc.len;
+ skb = sock_alloc_send_skb(sk, len, 1, &err);
+ if (unlikely(!skb)) {
+@@ -245,7 +242,7 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
+ addr = desc.addr;
+ buffer = xdp_umem_get_data(xs->umem, addr);
+ err = skb_store_bits(skb, 0, buffer, len);
+- if (unlikely(err)) {
++ if (unlikely(err) || xskq_reserve_addr(xs->umem->cq)) {
+ kfree_skb(skb);
+ goto out;
+ }
+@@ -323,7 +320,7 @@ static int xsk_init_queue(u32 entries, struct xsk_queue **queue,
+
+ /* Make sure queue is ready before it can be seen by others */
+ smp_wmb();
+- *queue = q;
++ WRITE_ONCE(*queue, q);
+ return 0;
+ }
+
+@@ -457,7 +454,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+ }
+
+ xdp_get_umem(umem_xs->umem);
+- xs->umem = umem_xs->umem;
++ WRITE_ONCE(xs->umem, umem_xs->umem);
+ sockfd_put(sock);
+ } else if (!xs->umem || !xdp_umem_validate_queues(xs->umem)) {
+ err = -EINVAL;
+@@ -537,7 +534,7 @@ static int xsk_setsockopt(struct socket *sock, int level, int optname,
+
+ /* Make sure umem is ready before it can be seen by others */
+ smp_wmb();
+- xs->umem = umem;
++ WRITE_ONCE(xs->umem, umem);
+ mutex_unlock(&xs->mutex);
+ return 0;
+ }
+@@ -661,6 +658,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
+ if (!umem)
+ return -EINVAL;
+
++ /* Matches the smp_wmb() in XDP_UMEM_REG */
++ smp_rmb();
+ if (offset == XDP_UMEM_PGOFF_FILL_RING)
+ q = READ_ONCE(umem->fq);
+ else if (offset == XDP_UMEM_PGOFF_COMPLETION_RING)
+@@ -670,6 +669,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
+ if (!q)
+ return -EINVAL;
+
++ /* Matches the smp_wmb() in xsk_init_queue */
++ smp_rmb();
+ qpg = virt_to_head_page(q->ring);
+ if (size > (PAGE_SIZE << compound_order(qpg)))
+ return -EINVAL;
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index d6a3cdf7885c..4ee512622e93 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -145,8 +145,6 @@ static int xfrmi_create(struct net_device *dev)
+ if (err < 0)
+ goto out;
+
+- strcpy(xi->p.name, dev->name);
+-
+ dev_hold(dev);
+ xfrmi_link(xfrmn, xi);
+
+@@ -293,7 +291,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ if (tdev == dev) {
+ stats->collisions++;
+ net_warn_ratelimited("%s: Local routing loop detected!\n",
+- xi->p.name);
++ dev->name);
+ goto tx_err_dst_release;
+ }
+
+@@ -648,12 +646,6 @@ static int xfrmi_newlink(struct net *src_net, struct net_device *dev,
+ int err;
+
+ xfrmi_netlink_parms(data, &p);
+-
+- if (!tb[IFLA_IFNAME])
+- return -EINVAL;
+-
+- nla_strlcpy(p.name, tb[IFLA_IFNAME], IFNAMSIZ);
+-
+ xi = xfrmi_locate(net, &p);
+ if (xi)
+ return -EEXIST;
+diff --git a/samples/bpf/xdp_rxq_info_user.c b/samples/bpf/xdp_rxq_info_user.c
+index ef26f882f92f..a55c81301c1a 100644
+--- a/samples/bpf/xdp_rxq_info_user.c
++++ b/samples/bpf/xdp_rxq_info_user.c
+@@ -472,9 +472,9 @@ int main(int argc, char **argv)
+ if (bpf_prog_load_xattr(&prog_load_attr, &obj, &prog_fd))
+ return EXIT_FAIL;
+
+- map = bpf_map__next(NULL, obj);
+- stats_global_map = bpf_map__next(map, obj);
+- rx_queue_index_map = bpf_map__next(stats_global_map, obj);
++ map = bpf_object__find_map_by_name(obj, "config_map");
++ stats_global_map = bpf_object__find_map_by_name(obj, "stats_global_map");
++ rx_queue_index_map = bpf_object__find_map_by_name(obj, "rx_queue_index_map");
+ if (!map || !stats_global_map || !rx_queue_index_map) {
+ printf("finding a map in obj file failed\n");
+ return EXIT_FAIL;
+diff --git a/security/apparmor/include/cred.h b/security/apparmor/include/cred.h
+index e287b7d0d4be..265ae6641a06 100644
+--- a/security/apparmor/include/cred.h
++++ b/security/apparmor/include/cred.h
+@@ -151,6 +151,8 @@ static inline struct aa_label *begin_current_label_crit_section(void)
+ {
+ struct aa_label *label = aa_current_raw_label();
+
++ might_sleep();
++
+ if (label_is_stale(label)) {
+ label = aa_get_newest_label(label);
+ if (aa_replace_current_label(label) == 0)
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index 590ca7d8fae5..730de4638b4e 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -114,13 +114,13 @@ static int apparmor_ptrace_access_check(struct task_struct *child,
+ struct aa_label *tracer, *tracee;
+ int error;
+
+- tracer = begin_current_label_crit_section();
++ tracer = __begin_current_label_crit_section();
+ tracee = aa_get_task_label(child);
+ error = aa_may_ptrace(tracer, tracee,
+ (mode & PTRACE_MODE_READ) ? AA_PTRACE_READ
+ : AA_PTRACE_TRACE);
+ aa_put_label(tracee);
+- end_current_label_crit_section(tracer);
++ __end_current_label_crit_section(tracer);
+
+ return error;
+ }
+diff --git a/security/apparmor/net.c b/security/apparmor/net.c
+index bb24cfa0a164..d5d72dd1ca1f 100644
+--- a/security/apparmor/net.c
++++ b/security/apparmor/net.c
+@@ -146,17 +146,20 @@ int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
+ static int aa_label_sk_perm(struct aa_label *label, const char *op, u32 request,
+ struct sock *sk)
+ {
+- struct aa_profile *profile;
+- DEFINE_AUDIT_SK(sa, op, sk);
++ int error = 0;
+
+ AA_BUG(!label);
+ AA_BUG(!sk);
+
+- if (unconfined(label))
+- return 0;
++ if (!unconfined(label)) {
++ struct aa_profile *profile;
++ DEFINE_AUDIT_SK(sa, op, sk);
+
+- return fn_for_each_confined(label, profile,
+- aa_profile_af_sk_perm(profile, &sa, request, sk));
++ error = fn_for_each_confined(label, profile,
++ aa_profile_af_sk_perm(profile, &sa, request, sk));
++ }
++
++ return error;
+ }
+
+ int aa_sk_perm(const char *op, u32 request, struct sock *sk)
+diff --git a/security/keys/key.c b/security/keys/key.c
+index 249a6da4d277..749a5cf27a19 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -297,6 +297,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
+ key->gid = gid;
+ key->perm = perm;
+ key->restrict_link = restrict_link;
++ key->last_used_at = ktime_get_real_seconds();
+
+ if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
+ key->flags |= 1 << KEY_FLAG_IN_QUOTA;
+diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
+index d2d96ca082b7..6224fd3bbf7c 100644
+--- a/sound/aoa/codecs/onyx.c
++++ b/sound/aoa/codecs/onyx.c
+@@ -74,8 +74,10 @@ static int onyx_read_register(struct onyx *onyx, u8 reg, u8 *value)
+ return 0;
+ }
+ v = i2c_smbus_read_byte_data(onyx->i2c, reg);
+- if (v < 0)
++ if (v < 0) {
++ *value = 0;
+ return -1;
++ }
+ *value = (u8)v;
+ onyx->cache[ONYX_REG_CONTROL-FIRSTREGISTER] = *value;
+ return 0;
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index 8a9dd4767b1e..63cc10604afc 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -176,11 +176,10 @@ struct azx {
+ #define azx_bus(chip) (&(chip)->bus.core)
+ #define bus_to_azx(_bus) container_of(_bus, struct azx, bus.core)
+
+-#ifdef CONFIG_X86
+-#define azx_snoop(chip) ((chip)->snoop)
+-#else
+-#define azx_snoop(chip) true
+-#endif
++static inline bool azx_snoop(struct azx *chip)
++{
++ return !IS_ENABLED(CONFIG_X86) || chip->snoop;
++}
+
+ /*
+ * macros for easy use
+diff --git a/sound/sh/aica.c b/sound/sh/aica.c
+index 2b26311405a4..ad3f71358486 100644
+--- a/sound/sh/aica.c
++++ b/sound/sh/aica.c
+@@ -303,7 +303,7 @@ static void aica_period_elapsed(struct timer_list *t)
+ {
+ struct snd_card_aica *dreamcastcard = from_timer(dreamcastcard,
+ t, timer);
+- struct snd_pcm_substream *substream = dreamcastcard->timer_substream;
++ struct snd_pcm_substream *substream = dreamcastcard->substream;
+ /*timer function - so cannot sleep */
+ int play_period;
+ struct snd_pcm_runtime *runtime;
+@@ -335,13 +335,6 @@ static void spu_begin_dma(struct snd_pcm_substream *substream)
+ dreamcastcard = substream->pcm->private_data;
+ /*get the queue to do the work */
+ schedule_work(&(dreamcastcard->spu_dma_work));
+- /* Timer may already be running */
+- if (unlikely(dreamcastcard->timer_substream)) {
+- mod_timer(&dreamcastcard->timer, jiffies + 4);
+- return;
+- }
+- timer_setup(&dreamcastcard->timer, aica_period_elapsed, 0);
+- dreamcastcard->timer_substream = substream;
+ mod_timer(&dreamcastcard->timer, jiffies + 4);
+ }
+
+@@ -379,8 +372,8 @@ static int snd_aicapcm_pcm_close(struct snd_pcm_substream
+ {
+ struct snd_card_aica *dreamcastcard = substream->pcm->private_data;
+ flush_work(&(dreamcastcard->spu_dma_work));
+- if (dreamcastcard->timer_substream)
+- del_timer(&dreamcastcard->timer);
++ del_timer(&dreamcastcard->timer);
++ dreamcastcard->substream = NULL;
+ kfree(dreamcastcard->channel);
+ spu_disable();
+ return 0;
+@@ -615,6 +608,7 @@ static int snd_aica_probe(struct platform_device *devptr)
+ "Yamaha AICA Super Intelligent Sound Processor for SEGA Dreamcast");
+ /* Prepare to use the queue */
+ INIT_WORK(&(dreamcastcard->spu_dma_work), run_spu_dma);
++ timer_setup(&dreamcastcard->timer, aica_period_elapsed, 0);
+ /* Load the PCM 'chip' */
+ err = snd_aicapcmchip(dreamcastcard, 0);
+ if (unlikely(err < 0))
+diff --git a/sound/soc/codecs/cs4349.c b/sound/soc/codecs/cs4349.c
+index bee0e343723f..f08d7a296c0c 100644
+--- a/sound/soc/codecs/cs4349.c
++++ b/sound/soc/codecs/cs4349.c
+@@ -381,6 +381,7 @@ static struct i2c_driver cs4349_i2c_driver = {
+ .driver = {
+ .name = "cs4349",
+ .of_match_table = cs4349_of_match,
++ .pm = &cs4349_runtime_pm,
+ },
+ .id_table = cs4349_i2c_id,
+ .probe = cs4349_i2c_probe,
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index e9fc2fd97d2f..3afa163f7652 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -231,7 +231,7 @@ static const struct soc_enum es8328_rline_enum =
+ ARRAY_SIZE(es8328_line_texts),
+ es8328_line_texts);
+ static const struct snd_kcontrol_new es8328_right_line_controls =
+- SOC_DAPM_ENUM("Route", es8328_lline_enum);
++ SOC_DAPM_ENUM("Route", es8328_rline_enum);
+
+ /* Left Mixer */
+ static const struct snd_kcontrol_new es8328_left_mixer_controls[] = {
+diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
+index e9ae821e7609..568b77692f5f 100644
+--- a/sound/soc/codecs/wm8737.c
++++ b/sound/soc/codecs/wm8737.c
+@@ -170,7 +170,7 @@ SOC_DOUBLE("Polarity Invert Switch", WM8737_ADC_CONTROL, 5, 6, 1, 0),
+ SOC_SINGLE("3D Switch", WM8737_3D_ENHANCE, 0, 1, 0),
+ SOC_SINGLE("3D Depth", WM8737_3D_ENHANCE, 1, 15, 0),
+ SOC_ENUM("3D Low Cut-off", low_3d),
+-SOC_ENUM("3D High Cut-off", low_3d),
++SOC_ENUM("3D High Cut-off", high_3d),
+ SOC_SINGLE_TLV("3D ADC Volume", WM8737_3D_ENHANCE, 7, 1, 1, adc_tlv),
+
+ SOC_SINGLE("Noise Gate Switch", WM8737_NOISE_GATE, 0, 1, 0),
+diff --git a/sound/soc/codecs/wm9705.c b/sound/soc/codecs/wm9705.c
+index ccdf088461b7..54c306707c02 100644
+--- a/sound/soc/codecs/wm9705.c
++++ b/sound/soc/codecs/wm9705.c
+@@ -325,8 +325,7 @@ static int wm9705_soc_probe(struct snd_soc_component *component)
+ if (wm9705->mfd_pdata) {
+ wm9705->ac97 = wm9705->mfd_pdata->ac97;
+ regmap = wm9705->mfd_pdata->regmap;
+- } else {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
++ } else if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS)) {
+ wm9705->ac97 = snd_soc_new_ac97_component(component, WM9705_VENDOR_ID,
+ WM9705_VENDOR_ID_MASK);
+ if (IS_ERR(wm9705->ac97)) {
+@@ -339,7 +338,8 @@ static int wm9705_soc_probe(struct snd_soc_component *component)
+ snd_soc_free_ac97_component(wm9705->ac97);
+ return PTR_ERR(regmap);
+ }
+-#endif
++ } else {
++ return -ENXIO;
+ }
+
+ snd_soc_component_set_drvdata(component, wm9705->ac97);
+@@ -350,14 +350,12 @@ static int wm9705_soc_probe(struct snd_soc_component *component)
+
+ static void wm9705_soc_remove(struct snd_soc_component *component)
+ {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
+ struct wm9705_priv *wm9705 = snd_soc_component_get_drvdata(component);
+
+- if (!wm9705->mfd_pdata) {
++ if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS) && !wm9705->mfd_pdata) {
+ snd_soc_component_exit_regmap(component);
+ snd_soc_free_ac97_component(wm9705->ac97);
+ }
+-#endif
+ }
+
+ static const struct snd_soc_component_driver soc_component_dev_wm9705 = {
+diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
+index ade34c26ad2f..01949eaba4fd 100644
+--- a/sound/soc/codecs/wm9712.c
++++ b/sound/soc/codecs/wm9712.c
+@@ -638,13 +638,13 @@ static int wm9712_soc_probe(struct snd_soc_component *component)
+ {
+ struct wm9712_priv *wm9712 = snd_soc_component_get_drvdata(component);
+ struct regmap *regmap;
+- int ret;
+
+ if (wm9712->mfd_pdata) {
+ wm9712->ac97 = wm9712->mfd_pdata->ac97;
+ regmap = wm9712->mfd_pdata->regmap;
+- } else {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
++ } else if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS)) {
++ int ret;
++
+ wm9712->ac97 = snd_soc_new_ac97_component(component, WM9712_VENDOR_ID,
+ WM9712_VENDOR_ID_MASK);
+ if (IS_ERR(wm9712->ac97)) {
+@@ -659,7 +659,8 @@ static int wm9712_soc_probe(struct snd_soc_component *component)
+ snd_soc_free_ac97_component(wm9712->ac97);
+ return PTR_ERR(regmap);
+ }
+-#endif
++ } else {
++ return -ENXIO;
+ }
+
+ snd_soc_component_init_regmap(component, regmap);
+@@ -672,14 +673,12 @@ static int wm9712_soc_probe(struct snd_soc_component *component)
+
+ static void wm9712_soc_remove(struct snd_soc_component *component)
+ {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
+ struct wm9712_priv *wm9712 = snd_soc_component_get_drvdata(component);
+
+- if (!wm9712->mfd_pdata) {
++ if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS) && !wm9712->mfd_pdata) {
+ snd_soc_component_exit_regmap(component);
+ snd_soc_free_ac97_component(wm9712->ac97);
+ }
+-#endif
+ }
+
+ static const struct snd_soc_component_driver soc_component_dev_wm9712 = {
+diff --git a/sound/soc/codecs/wm9713.c b/sound/soc/codecs/wm9713.c
+index 643863bb32e0..5a2fdf4f69bf 100644
+--- a/sound/soc/codecs/wm9713.c
++++ b/sound/soc/codecs/wm9713.c
+@@ -1214,8 +1214,7 @@ static int wm9713_soc_probe(struct snd_soc_component *component)
+ if (wm9713->mfd_pdata) {
+ wm9713->ac97 = wm9713->mfd_pdata->ac97;
+ regmap = wm9713->mfd_pdata->regmap;
+- } else {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
++ } else if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS)) {
+ wm9713->ac97 = snd_soc_new_ac97_component(component, WM9713_VENDOR_ID,
+ WM9713_VENDOR_ID_MASK);
+ if (IS_ERR(wm9713->ac97))
+@@ -1225,7 +1224,8 @@ static int wm9713_soc_probe(struct snd_soc_component *component)
+ snd_soc_free_ac97_component(wm9713->ac97);
+ return PTR_ERR(regmap);
+ }
+-#endif
++ } else {
++ return -ENXIO;
+ }
+
+ snd_soc_component_init_regmap(component, regmap);
+@@ -1238,14 +1238,12 @@ static int wm9713_soc_probe(struct snd_soc_component *component)
+
+ static void wm9713_soc_remove(struct snd_soc_component *component)
+ {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
+ struct wm9713_priv *wm9713 = snd_soc_component_get_drvdata(component);
+
+- if (!wm9713->mfd_pdata) {
++ if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS) && !wm9713->mfd_pdata) {
+ snd_soc_component_exit_regmap(component);
+ snd_soc_free_ac97_component(wm9713->ac97);
+ }
+-#endif
+ }
+
+ static const struct snd_soc_component_driver soc_component_dev_wm9713 = {
+diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
+index 6a8c279a4b20..14ab16e1369f 100644
+--- a/sound/soc/davinci/davinci-mcasp.c
++++ b/sound/soc/davinci/davinci-mcasp.c
+@@ -874,14 +874,13 @@ static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream,
+ active_slots = hweight32(mcasp->tdm_mask[stream]);
+ active_serializers = (channels + active_slots - 1) /
+ active_slots;
+- if (active_serializers == 1) {
++ if (active_serializers == 1)
+ active_slots = channels;
+- for (i = 0; i < total_slots; i++) {
+- if ((1 << i) & mcasp->tdm_mask[stream]) {
+- mask |= (1 << i);
+- if (--active_slots <= 0)
+- break;
+- }
++ for (i = 0; i < total_slots; i++) {
++ if ((1 << i) & mcasp->tdm_mask[stream]) {
++ mask |= (1 << i);
++ if (--active_slots <= 0)
++ break;
+ }
+ }
+ } else {
+diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
+index 9b9a7ec52905..4bd8da3a5f5b 100644
+--- a/sound/soc/fsl/imx-sgtl5000.c
++++ b/sound/soc/fsl/imx-sgtl5000.c
+@@ -112,7 +112,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
+ codec_dev = of_find_i2c_device_by_node(codec_np);
+ if (!codec_dev) {
+ dev_err(&pdev->dev, "failed to find codec platform device\n");
+- return -EPROBE_DEFER;
++ ret = -EPROBE_DEFER;
++ goto fail;
+ }
+
+ data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+diff --git a/sound/soc/meson/axg-tdmin.c b/sound/soc/meson/axg-tdmin.c
+index bbac44c81688..37207bbebb2a 100644
+--- a/sound/soc/meson/axg-tdmin.c
++++ b/sound/soc/meson/axg-tdmin.c
+@@ -119,7 +119,6 @@ static int axg_tdmin_prepare(struct regmap *map, struct axg_tdm_stream *ts)
+ break;
+
+ case SND_SOC_DAIFMT_LEFT_J:
+- case SND_SOC_DAIFMT_RIGHT_J:
+ case SND_SOC_DAIFMT_DSP_B:
+ val = TDMIN_CTRL_IN_BIT_SKEW(2);
+ break;
+diff --git a/sound/soc/meson/axg-tdmout.c b/sound/soc/meson/axg-tdmout.c
+index f73368ee1088..d11acb3cc696 100644
+--- a/sound/soc/meson/axg-tdmout.c
++++ b/sound/soc/meson/axg-tdmout.c
+@@ -136,7 +136,6 @@ static int axg_tdmout_prepare(struct regmap *map, struct axg_tdm_stream *ts)
+ break;
+
+ case SND_SOC_DAIFMT_LEFT_J:
+- case SND_SOC_DAIFMT_RIGHT_J:
+ case SND_SOC_DAIFMT_DSP_B:
+ val |= TDMOUT_CTRL0_INIT_BITNUM(2);
+ break;
+diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c
+index 1dd23bba1bed..4b559932adc3 100644
+--- a/sound/soc/qcom/apq8016_sbc.c
++++ b/sound/soc/qcom/apq8016_sbc.c
+@@ -164,41 +164,52 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
+
+ if (!cpu || !codec) {
+ dev_err(dev, "Can't find cpu/codec DT node\n");
+- return ERR_PTR(-EINVAL);
++ ret = -EINVAL;
++ goto error;
+ }
+
+ link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
+ if (!link->cpu_of_node) {
+ dev_err(card->dev, "error getting cpu phandle\n");
+- return ERR_PTR(-EINVAL);
++ ret = -EINVAL;
++ goto error;
+ }
+
+ ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
+ if (ret) {
+ dev_err(card->dev, "error getting cpu dai name\n");
+- return ERR_PTR(ret);
++ goto error;
+ }
+
+ ret = snd_soc_of_get_dai_link_codecs(dev, codec, link);
+
+ if (ret < 0) {
+ dev_err(card->dev, "error getting codec dai name\n");
+- return ERR_PTR(ret);
++ goto error;
+ }
+
+ link->platform_of_node = link->cpu_of_node;
+ ret = of_property_read_string(np, "link-name", &link->name);
+ if (ret) {
+ dev_err(card->dev, "error getting codec dai_link name\n");
+- return ERR_PTR(ret);
++ goto error;
+ }
+
+ link->stream_name = link->name;
+ link->init = apq8016_sbc_dai_init;
+ link++;
++
++ of_node_put(cpu);
++ of_node_put(codec);
+ }
+
+ return data;
++
++ error:
++ of_node_put(np);
++ of_node_put(cpu);
++ of_node_put(codec);
++ return ERR_PTR(ret);
+ }
+
+ static const struct snd_soc_dapm_widget apq8016_sbc_dapm_widgets[] = {
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 551bfc581fc1..53fefa7c982f 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -42,8 +42,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
+ else
+ codec_stream = &dai->driver->capture;
+
+- /* If the codec specifies any rate at all, it supports the stream. */
+- return codec_stream->rates;
++ /* If the codec specifies any channels at all, it supports the stream */
++ return codec_stream->channels_min;
+ }
+
+ /**
+diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
+index 18cf8404d27c..f248e563986c 100644
+--- a/sound/soc/sunxi/sun4i-i2s.c
++++ b/sound/soc/sunxi/sun4i-i2s.c
+@@ -80,8 +80,8 @@
+ #define SUN4I_I2S_CLK_DIV_MCLK_MASK GENMASK(3, 0)
+ #define SUN4I_I2S_CLK_DIV_MCLK(mclk) ((mclk) << 0)
+
+-#define SUN4I_I2S_RX_CNT_REG 0x28
+-#define SUN4I_I2S_TX_CNT_REG 0x2c
++#define SUN4I_I2S_TX_CNT_REG 0x28
++#define SUN4I_I2S_RX_CNT_REG 0x2c
+
+ #define SUN4I_I2S_TX_CHAN_SEL_REG 0x30
+ #define SUN4I_I2S_CHAN_SEL(num_chan) (((num_chan) - 1) << 0)
+diff --git a/sound/soc/sunxi/sun8i-codec.c b/sound/soc/sunxi/sun8i-codec.c
+index bf615fa16dc8..a3db6a68dfe6 100644
+--- a/sound/soc/sunxi/sun8i-codec.c
++++ b/sound/soc/sunxi/sun8i-codec.c
+@@ -465,7 +465,11 @@ static const struct snd_soc_dapm_route sun8i_codec_dapm_routes[] = {
+ { "Right Digital DAC Mixer", "AIF1 Slot 0 Digital DAC Playback Switch",
+ "AIF1 Slot 0 Right"},
+
+- /* ADC routes */
++ /* ADC Routes */
++ { "AIF1 Slot 0 Right ADC", NULL, "ADC" },
++ { "AIF1 Slot 0 Left ADC", NULL, "ADC" },
++
++ /* ADC Mixer Routes */
+ { "Left Digital ADC Mixer", "AIF1 Data Digital ADC Capture Switch",
+ "AIF1 Slot 0 Left ADC" },
+ { "Right Digital ADC Mixer", "AIF1 Data Digital ADC Capture Switch",
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index d7778f2bcbf8..6ac6a0980124 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -3480,7 +3480,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
+ if (err < 0)
+ goto _error;
+
+- snd_usb_mixer_apply_create_quirk(mixer);
++ err = snd_usb_mixer_apply_create_quirk(mixer);
++ if (err < 0)
++ goto _error;
+
+ err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
+ if (err < 0)
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 65f9c4ba62ee..90d4f61cc230 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3349,19 +3349,14 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ .ifnum = 0,
+ .type = QUIRK_AUDIO_STANDARD_MIXER,
+ },
+- /* Capture */
+- {
+- .ifnum = 1,
+- .type = QUIRK_IGNORE_INTERFACE,
+- },
+ /* Playback */
+ {
+- .ifnum = 2,
++ .ifnum = 1,
+ .type = QUIRK_AUDIO_FIXED_ENDPOINT,
+ .data = &(const struct audioformat) {
+ .formats = SNDRV_PCM_FMTBIT_S16_LE,
+ .channels = 2,
+- .iface = 2,
++ .iface = 1,
+ .altsetting = 1,
+ .altset_idx = 1,
+ .attributes = UAC_EP_CS_ATTR_FILL_MAX |
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index e4e6e2b3fd84..ff0cc3c17141 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -26,9 +26,9 @@ static void btf_dumper_ptr(const void *data, json_writer_t *jw,
+ bool is_plain_text)
+ {
+ if (is_plain_text)
+- jsonw_printf(jw, "%p", *(unsigned long *)data);
++ jsonw_printf(jw, "%p", data);
+ else
+- jsonw_printf(jw, "%u", *(unsigned long *)data);
++ jsonw_printf(jw, "%lu", *(unsigned long *)data);
+ }
+
+ static int btf_dumper_modifier(const struct btf_dumper *d, __u32 type_id,
+@@ -129,7 +129,7 @@ static int btf_dumper_int(const struct btf_type *t, __u8 bit_offset,
+ switch (BTF_INT_ENCODING(*int_type)) {
+ case 0:
+ if (BTF_INT_BITS(*int_type) == 64)
+- jsonw_printf(jw, "%lu", *(__u64 *)data);
++ jsonw_printf(jw, "%llu", *(__u64 *)data);
+ else if (BTF_INT_BITS(*int_type) == 32)
+ jsonw_printf(jw, "%u", *(__u32 *)data);
+ else if (BTF_INT_BITS(*int_type) == 16)
+@@ -142,7 +142,7 @@ static int btf_dumper_int(const struct btf_type *t, __u8 bit_offset,
+ break;
+ case BTF_INT_SIGNED:
+ if (BTF_INT_BITS(*int_type) == 64)
+- jsonw_printf(jw, "%ld", *(long long *)data);
++ jsonw_printf(jw, "%lld", *(long long *)data);
+ else if (BTF_INT_BITS(*int_type) == 32)
+ jsonw_printf(jw, "%d", *(int *)data);
+ else if (BTF_INT_BITS(*int_type) == 16)
+diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
+index ee7a9765c6b3..adbcd84818f7 100644
+--- a/tools/bpf/bpftool/cgroup.c
++++ b/tools/bpf/bpftool/cgroup.c
+@@ -164,7 +164,7 @@ static int do_show(int argc, char **argv)
+
+ cgroup_fd = open(argv[0], O_RDONLY);
+ if (cgroup_fd < 0) {
+- p_err("can't open cgroup %s", argv[1]);
++ p_err("can't open cgroup %s", argv[0]);
+ goto exit;
+ }
+
+@@ -345,7 +345,7 @@ static int do_attach(int argc, char **argv)
+
+ cgroup_fd = open(argv[0], O_RDONLY);
+ if (cgroup_fd < 0) {
+- p_err("can't open cgroup %s", argv[1]);
++ p_err("can't open cgroup %s", argv[0]);
+ goto exit;
+ }
+
+@@ -403,7 +403,7 @@ static int do_detach(int argc, char **argv)
+
+ cgroup_fd = open(argv[0], O_RDONLY);
+ if (cgroup_fd < 0) {
+- p_err("can't open cgroup %s", argv[1]);
++ p_err("can't open cgroup %s", argv[0]);
+ goto exit;
+ }
+
+diff --git a/tools/bpf/bpftool/map_perf_ring.c b/tools/bpf/bpftool/map_perf_ring.c
+index 6d41323be291..8ec0148d7426 100644
+--- a/tools/bpf/bpftool/map_perf_ring.c
++++ b/tools/bpf/bpftool/map_perf_ring.c
+@@ -205,7 +205,7 @@ int do_event_pipe(int argc, char **argv)
+ NEXT_ARG();
+ cpu = strtoul(*argv, &endptr, 0);
+ if (*endptr) {
+- p_err("can't parse %s as CPU ID", **argv);
++ p_err("can't parse %s as CPU ID", *argv);
+ goto err_close_map;
+ }
+
+@@ -216,7 +216,7 @@ int do_event_pipe(int argc, char **argv)
+ NEXT_ARG();
+ index = strtoul(*argv, &endptr, 0);
+ if (*endptr) {
+- p_err("can't parse %s as index", **argv);
++ p_err("can't parse %s as index", *argv);
+ goto err_close_map;
+ }
+
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index 21f867a543e0..ab208400ea14 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -681,24 +681,6 @@ int machine__process_switch_event(struct machine *machine __maybe_unused,
+ return 0;
+ }
+
+-static void dso__adjust_kmod_long_name(struct dso *dso, const char *filename)
+-{
+- const char *dup_filename;
+-
+- if (!filename || !dso || !dso->long_name)
+- return;
+- if (dso->long_name[0] != '[')
+- return;
+- if (!strchr(filename, '/'))
+- return;
+-
+- dup_filename = strdup(filename);
+- if (!dup_filename)
+- return;
+-
+- dso__set_long_name(dso, dup_filename, true);
+-}
+-
+ struct map *machine__findnew_module_map(struct machine *machine, u64 start,
+ const char *filename)
+ {
+@@ -710,15 +692,8 @@ struct map *machine__findnew_module_map(struct machine *machine, u64 start,
+ return NULL;
+
+ map = map_groups__find_by_name(&machine->kmaps, m.name);
+- if (map) {
+- /*
+- * If the map's dso is an offline module, give dso__load()
+- * a chance to find the file path of that module by fixing
+- * long_name.
+- */
+- dso__adjust_kmod_long_name(map->dso, filename);
++ if (map)
+ goto out;
+- }
+
+ dso = machine__findnew_module_dso(machine, &m, filename);
+ if (dso == NULL)
+diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
+index dac927e82336..4c156aeab6b8 100644
+--- a/tools/testing/selftests/ipc/msgque.c
++++ b/tools/testing/selftests/ipc/msgque.c
+@@ -1,9 +1,10 @@
+ // SPDX-License-Identifier: GPL-2.0
++#define _GNU_SOURCE
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <string.h>
+ #include <errno.h>
+-#include <linux/msg.h>
++#include <sys/msg.h>
+ #include <fcntl.h>
+
+ #include "../kselftest.h"
+@@ -73,7 +74,7 @@ int restore_queue(struct msgque_data *msgque)
+ return 0;
+
+ destroy:
+- if (msgctl(id, IPC_RMID, 0))
++ if (msgctl(id, IPC_RMID, NULL))
+ printf("Failed to destroy queue: %d\n", -errno);
+ return ret;
+ }
+@@ -120,7 +121,7 @@ int check_and_destroy_queue(struct msgque_data *msgque)
+
+ ret = 0;
+ err:
+- if (msgctl(msgque->msq_id, IPC_RMID, 0)) {
++ if (msgctl(msgque->msq_id, IPC_RMID, NULL)) {
+ printf("Failed to destroy queue: %d\n", -errno);
+ return -errno;
+ }
+@@ -129,7 +130,7 @@ err:
+
+ int dump_queue(struct msgque_data *msgque)
+ {
+- struct msqid64_ds ds;
++ struct msqid_ds ds;
+ int kern_id;
+ int i, ret;
+
+@@ -245,7 +246,7 @@ int main(int argc, char **argv)
+ return ksft_exit_pass();
+
+ err_destroy:
+- if (msgctl(msgque.msq_id, IPC_RMID, 0)) {
++ if (msgctl(msgque.msq_id, IPC_RMID, NULL)) {
+ printf("Failed to destroy queue: %d\n", -errno);
+ return ksft_exit_fail();
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-01-29 16:16 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-01-29 16:16 UTC (permalink / raw
To: gentoo-commits
commit: a237553df3d9872194b04bb1688fb0ec658cf944
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 29 16:15:47 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jan 29 16:15:47 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a237553d
Linux patch 4.19.100
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1099_linux-4.19.100.patch | 4278 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4282 insertions(+)
diff --git a/0000_README b/0000_README
index cae3438..7c99cc6 100644
--- a/0000_README
+++ b/0000_README
@@ -435,6 +435,10 @@ Patch: 1098_linux-4.19.99.patch
From: https://www.kernel.org
Desc: Linux 4.19.99
+Patch: 1099_linux-4.19.100.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.100
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1099_linux-4.19.100.patch b/1099_linux-4.19.100.patch
new file mode 100644
index 0000000..1e9d910
--- /dev/null
+++ b/1099_linux-4.19.100.patch
@@ -0,0 +1,4278 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index e6b6ec974eeb..8bf0c0532046 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1946,6 +1946,12 @@
+ Built with CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=y,
+ the default is off.
+
++ kpti= [ARM64] Control page table isolation of user
++ and kernel address spaces.
++ Default: enabled on cores which need mitigation.
++ 0: force disabled
++ 1: force enabled
++
+ kvm.ignore_msrs=[KVM] Ignore guest accesses to unhandled MSRs.
+ Default is 0 (don't ignore, but inject #GP)
+
+diff --git a/Makefile b/Makefile
+index a2be0c79eeb8..f1e428271abf 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 99
++SUBLEVEL = 100
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
+index 3b85c3ecac38..79e5cc70f1fd 100644
+--- a/arch/ia64/mm/init.c
++++ b/arch/ia64/mm/init.c
+@@ -661,21 +661,12 @@ int arch_add_memory(int nid, u64 start, u64 size, struct vmem_altmap *altmap,
+ return ret;
+ }
+
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+-int arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap)
++void arch_remove_memory(int nid, u64 start, u64 size,
++ struct vmem_altmap *altmap)
+ {
+ unsigned long start_pfn = start >> PAGE_SHIFT;
+ unsigned long nr_pages = size >> PAGE_SHIFT;
+- struct zone *zone;
+- int ret;
+-
+- zone = page_zone(pfn_to_page(start_pfn));
+- ret = __remove_pages(zone, start_pfn, nr_pages, altmap);
+- if (ret)
+- pr_warn("%s: Problem encountered in __remove_pages() as"
+- " ret=%d\n", __func__, ret);
+
+- return ret;
++ __remove_pages(start_pfn, nr_pages, altmap);
+ }
+ #endif
+-#endif
+diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
+index 9a6afd9f3f9b..84a012e42a7e 100644
+--- a/arch/powerpc/mm/mem.c
++++ b/arch/powerpc/mm/mem.c
+@@ -118,8 +118,8 @@ int __weak remove_section_mapping(unsigned long start, unsigned long end)
+ return -ENODEV;
+ }
+
+-int __meminit arch_add_memory(int nid, u64 start, u64 size, struct vmem_altmap *altmap,
+- bool want_memblock)
++int __ref arch_add_memory(int nid, u64 start, u64 size, struct vmem_altmap *altmap,
++ bool want_memblock)
+ {
+ unsigned long start_pfn = start >> PAGE_SHIFT;
+ unsigned long nr_pages = size >> PAGE_SHIFT;
+@@ -139,30 +139,20 @@ int __meminit arch_add_memory(int nid, u64 start, u64 size, struct vmem_altmap *
+ return __add_pages(nid, start_pfn, nr_pages, altmap, want_memblock);
+ }
+
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+-int __meminit arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap)
++void __ref arch_remove_memory(int nid, u64 start, u64 size,
++ struct vmem_altmap *altmap)
+ {
+ unsigned long start_pfn = start >> PAGE_SHIFT;
+ unsigned long nr_pages = size >> PAGE_SHIFT;
+- struct page *page;
+ int ret;
+
+- /*
+- * If we have an altmap then we need to skip over any reserved PFNs
+- * when querying the zone.
+- */
+- page = pfn_to_page(start_pfn);
+- if (altmap)
+- page += vmem_altmap_offset(altmap);
+-
+- ret = __remove_pages(page_zone(page), start_pfn, nr_pages, altmap);
+- if (ret)
+- return ret;
++ __remove_pages(start_pfn, nr_pages, altmap);
+
+ /* Remove htab bolted mappings for this section of memory */
+ start = (unsigned long)__va(start);
+ flush_inval_dcache_range(start, start + size);
+ ret = remove_section_mapping(start, start + size);
++ WARN_ON_ONCE(ret);
+
+ /* Ensure all vmalloc mappings are flushed in case they also
+ * hit that section of memory
+@@ -170,11 +160,8 @@ int __meminit arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap
+ vm_unmap_aliases();
+
+ resize_hpt_for_hotplug(memblock_phys_mem_size());
+-
+- return ret;
+ }
+ #endif
+-#endif /* CONFIG_MEMORY_HOTPLUG */
+
+ /*
+ * walk_memory_resource() needs to make sure there is no holes in a given
+diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c
+index dd3cc4632b9a..84d038ed3882 100644
+--- a/arch/powerpc/platforms/powernv/memtrace.c
++++ b/arch/powerpc/platforms/powernv/memtrace.c
+@@ -122,7 +122,7 @@ static u64 memtrace_alloc_node(u32 nid, u64 size)
+ */
+ end_pfn = base_pfn + nr_pages;
+ for (pfn = base_pfn; pfn < end_pfn; pfn += bytes>> PAGE_SHIFT) {
+- remove_memory(nid, pfn << PAGE_SHIFT, bytes);
++ __remove_memory(nid, pfn << PAGE_SHIFT, bytes);
+ }
+ unlock_device_hotplug();
+ return base_pfn << PAGE_SHIFT;
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index 62d3c72cd931..c2c6f32848e1 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -301,7 +301,7 @@ static int pseries_remove_memblock(unsigned long base, unsigned int memblock_siz
+ nid = memory_add_physaddr_to_nid(base);
+
+ for (i = 0; i < sections_per_block; i++) {
+- remove_memory(nid, base, MIN_MEMORY_BLOCK_SIZE);
++ __remove_memory(nid, base, MIN_MEMORY_BLOCK_SIZE);
+ base += MIN_MEMORY_BLOCK_SIZE;
+ }
+
+@@ -393,7 +393,7 @@ static int dlpar_remove_lmb(struct drmem_lmb *lmb)
+ block_sz = pseries_memory_block_size();
+ nid = memory_add_physaddr_to_nid(lmb->base_addr);
+
+- remove_memory(nid, lmb->base_addr, block_sz);
++ __remove_memory(nid, lmb->base_addr, block_sz);
+
+ /* Update memory regions for memory remove */
+ memblock_remove(lmb->base_addr, block_sz);
+@@ -680,7 +680,7 @@ static int dlpar_add_lmb(struct drmem_lmb *lmb)
+
+ rc = dlpar_online_lmb(lmb);
+ if (rc) {
+- remove_memory(nid, lmb->base_addr, block_sz);
++ __remove_memory(nid, lmb->base_addr, block_sz);
+ invalidate_lmb_associativity_index(lmb);
+ } else {
+ lmb->flags |= DRCONF_MEM_ASSIGNED;
+diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
+index 3fa3e5323612..379a925d9e82 100644
+--- a/arch/s390/mm/init.c
++++ b/arch/s390/mm/init.c
+@@ -239,15 +239,13 @@ int arch_add_memory(int nid, u64 start, u64 size, struct vmem_altmap *altmap,
+ return rc;
+ }
+
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+-int arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap)
++void arch_remove_memory(int nid, u64 start, u64 size,
++ struct vmem_altmap *altmap)
+ {
+- /*
+- * There is no hardware or firmware interface which could trigger a
+- * hot memory remove on s390. So there is nothing that needs to be
+- * implemented.
+- */
+- return -EBUSY;
++ unsigned long start_pfn = start >> PAGE_SHIFT;
++ unsigned long nr_pages = size >> PAGE_SHIFT;
++
++ __remove_pages(start_pfn, nr_pages, altmap);
++ vmem_remove_mapping(start, size);
+ }
+-#endif
+ #endif /* CONFIG_MEMORY_HOTPLUG */
+diff --git a/arch/sh/mm/init.c b/arch/sh/mm/init.c
+index 7713c084d040..47882be91121 100644
+--- a/arch/sh/mm/init.c
++++ b/arch/sh/mm/init.c
+@@ -443,21 +443,12 @@ int memory_add_physaddr_to_nid(u64 addr)
+ EXPORT_SYMBOL_GPL(memory_add_physaddr_to_nid);
+ #endif
+
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+-int arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap)
++void arch_remove_memory(int nid, u64 start, u64 size,
++ struct vmem_altmap *altmap)
+ {
+ unsigned long start_pfn = PFN_DOWN(start);
+ unsigned long nr_pages = size >> PAGE_SHIFT;
+- struct zone *zone;
+- int ret;
+-
+- zone = page_zone(pfn_to_page(start_pfn));
+- ret = __remove_pages(zone, start_pfn, nr_pages, altmap);
+- if (unlikely(ret))
+- pr_warn("%s: Failed, __remove_pages() == %d\n", __func__,
+- ret);
+
+- return ret;
++ __remove_pages(start_pfn, nr_pages, altmap);
+ }
+-#endif
+ #endif /* CONFIG_MEMORY_HOTPLUG */
+diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
+index 979e0a02cbe1..79b95910fd9f 100644
+--- a/arch/x86/mm/init_32.c
++++ b/arch/x86/mm/init_32.c
+@@ -860,18 +860,15 @@ int arch_add_memory(int nid, u64 start, u64 size, struct vmem_altmap *altmap,
+ return __add_pages(nid, start_pfn, nr_pages, altmap, want_memblock);
+ }
+
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+-int arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap)
++void arch_remove_memory(int nid, u64 start, u64 size,
++ struct vmem_altmap *altmap)
+ {
+ unsigned long start_pfn = start >> PAGE_SHIFT;
+ unsigned long nr_pages = size >> PAGE_SHIFT;
+- struct zone *zone;
+
+- zone = page_zone(pfn_to_page(start_pfn));
+- return __remove_pages(zone, start_pfn, nr_pages, altmap);
++ __remove_pages(start_pfn, nr_pages, altmap);
+ }
+ #endif
+-#endif
+
+ int kernel_set_to_readonly __read_mostly;
+
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index a3e9c6ee3cf2..81e85a8dd300 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -1132,7 +1132,6 @@ void __ref vmemmap_free(unsigned long start, unsigned long end,
+ remove_pagetable(start, end, false, altmap);
+ }
+
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+ static void __meminit
+ kernel_physical_mapping_remove(unsigned long start, unsigned long end)
+ {
+@@ -1142,25 +1141,15 @@ kernel_physical_mapping_remove(unsigned long start, unsigned long end)
+ remove_pagetable(start, end, true, NULL);
+ }
+
+-int __ref arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap)
++void __ref arch_remove_memory(int nid, u64 start, u64 size,
++ struct vmem_altmap *altmap)
+ {
+ unsigned long start_pfn = start >> PAGE_SHIFT;
+ unsigned long nr_pages = size >> PAGE_SHIFT;
+- struct page *page = pfn_to_page(start_pfn);
+- struct zone *zone;
+- int ret;
+
+- /* With altmap the first mapped page is offset from @start */
+- if (altmap)
+- page += vmem_altmap_offset(altmap);
+- zone = page_zone(page);
+- ret = __remove_pages(zone, start_pfn, nr_pages, altmap);
+- WARN_ON_ONCE(ret);
++ __remove_pages(start_pfn, nr_pages, altmap);
+ kernel_physical_mapping_remove(start, start + size);
+-
+- return ret;
+ }
+-#endif
+ #endif /* CONFIG_MEMORY_HOTPLUG */
+
+ static struct kcore_list kcore_vsyscall;
+diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
+index 2ccfbb61ca89..8fe0960ea572 100644
+--- a/drivers/acpi/acpi_memhotplug.c
++++ b/drivers/acpi/acpi_memhotplug.c
+@@ -282,7 +282,7 @@ static void acpi_memory_remove_memory(struct acpi_memory_device *mem_device)
+ nid = memory_add_physaddr_to_nid(info->start_addr);
+
+ acpi_unbind_memory_blocks(info);
+- remove_memory(nid, info->start_addr, info->length);
++ __remove_memory(nid, info->start_addr, info->length);
+ list_del(&info->list);
+ kfree(info);
+ }
+diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
+index 4e46dc9e41ad..112b1001c269 100644
+--- a/drivers/atm/firestream.c
++++ b/drivers/atm/firestream.c
+@@ -927,6 +927,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
+ }
+ if (!to) {
+ printk ("No more free channels for FS50..\n");
++ kfree(vcc);
+ return -EBUSY;
+ }
+ vcc->channo = dev->channo;
+@@ -937,6 +938,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
+ if (((DO_DIRECTION(rxtp) && dev->atm_vccs[vcc->channo])) ||
+ ( DO_DIRECTION(txtp) && test_bit (vcc->channo, dev->tx_inuse))) {
+ printk ("Channel is in use for FS155.\n");
++ kfree(vcc);
+ return -EBUSY;
+ }
+ }
+@@ -950,6 +952,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
+ tc, sizeof (struct fs_transmit_config));
+ if (!tc) {
+ fs_dprintk (FS_DEBUG_OPEN, "fs: can't alloc transmit_config.\n");
++ kfree(vcc);
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index ac1574a69610..e270abc86d46 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -39,6 +39,11 @@ static inline int base_memory_block_id(int section_nr)
+ return section_nr / sections_per_block;
+ }
+
++static inline int pfn_to_block_id(unsigned long pfn)
++{
++ return base_memory_block_id(pfn_to_section_nr(pfn));
++}
++
+ static int memory_subsys_online(struct device *dev);
+ static int memory_subsys_offline(struct device *dev);
+
+@@ -230,13 +235,14 @@ static bool pages_correctly_probed(unsigned long start_pfn)
+ * OK to have direct references to sparsemem variables in here.
+ */
+ static int
+-memory_block_action(unsigned long phys_index, unsigned long action, int online_type)
++memory_block_action(unsigned long start_section_nr, unsigned long action,
++ int online_type)
+ {
+ unsigned long start_pfn;
+ unsigned long nr_pages = PAGES_PER_SECTION * sections_per_block;
+ int ret;
+
+- start_pfn = section_nr_to_pfn(phys_index);
++ start_pfn = section_nr_to_pfn(start_section_nr);
+
+ switch (action) {
+ case MEM_ONLINE:
+@@ -250,7 +256,7 @@ memory_block_action(unsigned long phys_index, unsigned long action, int online_t
+ break;
+ default:
+ WARN(1, KERN_WARNING "%s(%ld, %ld) unknown action: "
+- "%ld\n", __func__, phys_index, action, action);
++ "%ld\n", __func__, start_section_nr, action, action);
+ ret = -EINVAL;
+ }
+
+@@ -590,10 +596,9 @@ int __weak arch_get_memory_phys_device(unsigned long start_pfn)
+ * A reference for the returned object is held and the reference for the
+ * hinted object is released.
+ */
+-struct memory_block *find_memory_block_hinted(struct mem_section *section,
+- struct memory_block *hint)
++static struct memory_block *find_memory_block_by_id(int block_id,
++ struct memory_block *hint)
+ {
+- int block_id = base_memory_block_id(__section_nr(section));
+ struct device *hintdev = hint ? &hint->dev : NULL;
+ struct device *dev;
+
+@@ -605,6 +610,14 @@ struct memory_block *find_memory_block_hinted(struct mem_section *section,
+ return to_memory_block(dev);
+ }
+
++struct memory_block *find_memory_block_hinted(struct mem_section *section,
++ struct memory_block *hint)
++{
++ int block_id = base_memory_block_id(__section_nr(section));
++
++ return find_memory_block_by_id(block_id, hint);
++}
++
+ /*
+ * For now, we have a linear search to go find the appropriate
+ * memory_block corresponding to a particular phys_index. If
+@@ -659,25 +672,28 @@ int register_memory(struct memory_block *memory)
+ return ret;
+ }
+
+-static int init_memory_block(struct memory_block **memory,
+- struct mem_section *section, unsigned long state)
++static int init_memory_block(struct memory_block **memory, int block_id,
++ unsigned long state)
+ {
+ struct memory_block *mem;
+ unsigned long start_pfn;
+- int scn_nr;
+ int ret = 0;
+
++ mem = find_memory_block_by_id(block_id, NULL);
++ if (mem) {
++ put_device(&mem->dev);
++ return -EEXIST;
++ }
+ mem = kzalloc(sizeof(*mem), GFP_KERNEL);
+ if (!mem)
+ return -ENOMEM;
+
+- scn_nr = __section_nr(section);
+- mem->start_section_nr =
+- base_memory_block_id(scn_nr) * sections_per_block;
++ mem->start_section_nr = block_id * sections_per_block;
+ mem->end_section_nr = mem->start_section_nr + sections_per_block - 1;
+ mem->state = state;
+ start_pfn = section_nr_to_pfn(mem->start_section_nr);
+ mem->phys_device = arch_get_memory_phys_device(start_pfn);
++ mem->nid = NUMA_NO_NODE;
+
+ ret = register_memory(mem);
+
+@@ -688,101 +704,98 @@ static int init_memory_block(struct memory_block **memory,
+ static int add_memory_block(int base_section_nr)
+ {
+ struct memory_block *mem;
+- int i, ret, section_count = 0, section_nr;
++ int i, ret, section_count = 0;
+
+ for (i = base_section_nr;
+- (i < base_section_nr + sections_per_block) && i < NR_MEM_SECTIONS;
+- i++) {
+- if (!present_section_nr(i))
+- continue;
+- if (section_count == 0)
+- section_nr = i;
+- section_count++;
+- }
++ i < base_section_nr + sections_per_block;
++ i++)
++ if (present_section_nr(i))
++ section_count++;
+
+ if (section_count == 0)
+ return 0;
+- ret = init_memory_block(&mem, __nr_to_section(section_nr), MEM_ONLINE);
++ ret = init_memory_block(&mem, base_memory_block_id(base_section_nr),
++ MEM_ONLINE);
+ if (ret)
+ return ret;
+ mem->section_count = section_count;
+ return 0;
+ }
+
++static void unregister_memory(struct memory_block *memory)
++{
++ if (WARN_ON_ONCE(memory->dev.bus != &memory_subsys))
++ return;
++
++ /* drop the ref. we got via find_memory_block() */
++ put_device(&memory->dev);
++ device_unregister(&memory->dev);
++}
++
+ /*
+- * need an interface for the VM to add new memory regions,
+- * but without onlining it.
++ * Create memory block devices for the given memory area. Start and size
++ * have to be aligned to memory block granularity. Memory block devices
++ * will be initialized as offline.
+ */
+-int hotplug_memory_register(int nid, struct mem_section *section)
++int create_memory_block_devices(unsigned long start, unsigned long size)
+ {
+- int ret = 0;
++ const int start_block_id = pfn_to_block_id(PFN_DOWN(start));
++ int end_block_id = pfn_to_block_id(PFN_DOWN(start + size));
+ struct memory_block *mem;
++ unsigned long block_id;
++ int ret = 0;
+
+- mutex_lock(&mem_sysfs_mutex);
++ if (WARN_ON_ONCE(!IS_ALIGNED(start, memory_block_size_bytes()) ||
++ !IS_ALIGNED(size, memory_block_size_bytes())))
++ return -EINVAL;
+
+- mem = find_memory_block(section);
+- if (mem) {
+- mem->section_count++;
+- put_device(&mem->dev);
+- } else {
+- ret = init_memory_block(&mem, section, MEM_OFFLINE);
++ mutex_lock(&mem_sysfs_mutex);
++ for (block_id = start_block_id; block_id != end_block_id; block_id++) {
++ ret = init_memory_block(&mem, block_id, MEM_OFFLINE);
+ if (ret)
+- goto out;
+- mem->section_count++;
++ break;
++ mem->section_count = sections_per_block;
++ }
++ if (ret) {
++ end_block_id = block_id;
++ for (block_id = start_block_id; block_id != end_block_id;
++ block_id++) {
++ mem = find_memory_block_by_id(block_id, NULL);
++ mem->section_count = 0;
++ unregister_memory(mem);
++ }
+ }
+-
+-out:
+ mutex_unlock(&mem_sysfs_mutex);
+ return ret;
+ }
+
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+-static void
+-unregister_memory(struct memory_block *memory)
+-{
+- BUG_ON(memory->dev.bus != &memory_subsys);
+-
+- /* drop the ref. we got in remove_memory_block() */
+- put_device(&memory->dev);
+- device_unregister(&memory->dev);
+-}
+-
+-static int remove_memory_section(unsigned long node_id,
+- struct mem_section *section, int phys_device)
++/*
++ * Remove memory block devices for the given memory area. Start and size
++ * have to be aligned to memory block granularity. Memory block devices
++ * have to be offline.
++ */
++void remove_memory_block_devices(unsigned long start, unsigned long size)
+ {
++ const int start_block_id = pfn_to_block_id(PFN_DOWN(start));
++ const int end_block_id = pfn_to_block_id(PFN_DOWN(start + size));
+ struct memory_block *mem;
++ int block_id;
+
+- mutex_lock(&mem_sysfs_mutex);
+-
+- /*
+- * Some users of the memory hotplug do not want/need memblock to
+- * track all sections. Skip over those.
+- */
+- mem = find_memory_block(section);
+- if (!mem)
+- goto out_unlock;
++ if (WARN_ON_ONCE(!IS_ALIGNED(start, memory_block_size_bytes()) ||
++ !IS_ALIGNED(size, memory_block_size_bytes())))
++ return;
+
+- unregister_mem_sect_under_nodes(mem, __section_nr(section));
+-
+- mem->section_count--;
+- if (mem->section_count == 0)
++ mutex_lock(&mem_sysfs_mutex);
++ for (block_id = start_block_id; block_id != end_block_id; block_id++) {
++ mem = find_memory_block_by_id(block_id, NULL);
++ if (WARN_ON_ONCE(!mem))
++ continue;
++ mem->section_count = 0;
++ unregister_memory_block_under_nodes(mem);
+ unregister_memory(mem);
+- else
+- put_device(&mem->dev);
+-
+-out_unlock:
++ }
+ mutex_unlock(&mem_sysfs_mutex);
+- return 0;
+-}
+-
+-int unregister_memory_section(struct mem_section *section)
+-{
+- if (!present_section(section))
+- return -EINVAL;
+-
+- return remove_memory_section(0, section, 0);
+ }
+-#endif /* CONFIG_MEMORY_HOTREMOVE */
+
+ /* return true if the memory block is offlined, otherwise, return false */
+ bool is_memblock_offlined(struct memory_block *mem)
+@@ -849,3 +862,39 @@ out:
+ printk(KERN_ERR "%s() failed: %d\n", __func__, ret);
+ return ret;
+ }
++
++struct for_each_memory_block_cb_data {
++ walk_memory_blocks_func_t func;
++ void *arg;
++};
++
++static int for_each_memory_block_cb(struct device *dev, void *data)
++{
++ struct memory_block *mem = to_memory_block(dev);
++ struct for_each_memory_block_cb_data *cb_data = data;
++
++ return cb_data->func(mem, cb_data->arg);
++}
++
++/**
++ * for_each_memory_block - walk through all present memory blocks
++ *
++ * @arg: argument passed to func
++ * @func: callback for each memory block walked
++ *
++ * This function walks through all present memory blocks, calling func on
++ * each memory block.
++ *
++ * In case func() returns an error, walking is aborted and the error is
++ * returned.
++ */
++int for_each_memory_block(void *arg, walk_memory_blocks_func_t func)
++{
++ struct for_each_memory_block_cb_data cb_data = {
++ .func = func,
++ .arg = arg,
++ };
++
++ return bus_for_each_dev(&memory_subsys, NULL, &cb_data,
++ for_each_memory_block_cb);
++}
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index c3968e2d0a98..f3565c2dbc52 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -409,8 +409,6 @@ int register_mem_sect_under_node(struct memory_block *mem_blk, void *arg)
+ int ret, nid = *(int *)arg;
+ unsigned long pfn, sect_start_pfn, sect_end_pfn;
+
+- mem_blk->nid = nid;
+-
+ sect_start_pfn = section_nr_to_pfn(mem_blk->start_section_nr);
+ sect_end_pfn = section_nr_to_pfn(mem_blk->end_section_nr);
+ sect_end_pfn += PAGES_PER_SECTION - 1;
+@@ -439,6 +437,13 @@ int register_mem_sect_under_node(struct memory_block *mem_blk, void *arg)
+ if (page_nid != nid)
+ continue;
+ }
++
++ /*
++ * If this memory block spans multiple nodes, we only indicate
++ * the last processed node.
++ */
++ mem_blk->nid = nid;
++
+ ret = sysfs_create_link_nowarn(&node_devices[nid]->dev.kobj,
+ &mem_blk->dev.kobj,
+ kobject_name(&mem_blk->dev.kobj));
+@@ -453,40 +458,19 @@ int register_mem_sect_under_node(struct memory_block *mem_blk, void *arg)
+ return 0;
+ }
+
+-/* unregister memory section under all nodes that it spans */
+-int unregister_mem_sect_under_nodes(struct memory_block *mem_blk,
+- unsigned long phys_index)
++/*
++ * Unregister a memory block device under the node it spans. Memory blocks
++ * with multiple nodes cannot be offlined and therefore also never be removed.
++ */
++void unregister_memory_block_under_nodes(struct memory_block *mem_blk)
+ {
+- NODEMASK_ALLOC(nodemask_t, unlinked_nodes, GFP_KERNEL);
+- unsigned long pfn, sect_start_pfn, sect_end_pfn;
+-
+- if (!mem_blk) {
+- NODEMASK_FREE(unlinked_nodes);
+- return -EFAULT;
+- }
+- if (!unlinked_nodes)
+- return -ENOMEM;
+- nodes_clear(*unlinked_nodes);
+-
+- sect_start_pfn = section_nr_to_pfn(phys_index);
+- sect_end_pfn = sect_start_pfn + PAGES_PER_SECTION - 1;
+- for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) {
+- int nid;
++ if (mem_blk->nid == NUMA_NO_NODE)
++ return;
+
+- nid = get_nid_for_pfn(pfn);
+- if (nid < 0)
+- continue;
+- if (!node_online(nid))
+- continue;
+- if (node_test_and_set(nid, *unlinked_nodes))
+- continue;
+- sysfs_remove_link(&node_devices[nid]->dev.kobj,
+- kobject_name(&mem_blk->dev.kobj));
+- sysfs_remove_link(&mem_blk->dev.kobj,
+- kobject_name(&node_devices[nid]->dev.kobj));
+- }
+- NODEMASK_FREE(unlinked_nodes);
+- return 0;
++ sysfs_remove_link(&node_devices[mem_blk->nid]->dev.kobj,
++ kobject_name(&mem_blk->dev.kobj));
++ sysfs_remove_link(&mem_blk->dev.kobj,
++ kobject_name(&node_devices[mem_blk->nid]->dev.kobj));
+ }
+
+ int link_mem_sections(int nid, unsigned long start_pfn, unsigned long end_pfn)
+diff --git a/drivers/crypto/geode-aes.c b/drivers/crypto/geode-aes.c
+index eb2a0a73cbed..d670f7000cbb 100644
+--- a/drivers/crypto/geode-aes.c
++++ b/drivers/crypto/geode-aes.c
+@@ -14,6 +14,7 @@
+ #include <linux/spinlock.h>
+ #include <crypto/algapi.h>
+ #include <crypto/aes.h>
++#include <crypto/skcipher.h>
+
+ #include <linux/io.h>
+ #include <linux/delay.h>
+@@ -170,13 +171,15 @@ static int geode_setkey_blk(struct crypto_tfm *tfm, const u8 *key,
+ /*
+ * The requested key size is not supported by HW, do a fallback
+ */
+- op->fallback.blk->base.crt_flags &= ~CRYPTO_TFM_REQ_MASK;
+- op->fallback.blk->base.crt_flags |= (tfm->crt_flags & CRYPTO_TFM_REQ_MASK);
++ crypto_skcipher_clear_flags(op->fallback.blk, CRYPTO_TFM_REQ_MASK);
++ crypto_skcipher_set_flags(op->fallback.blk,
++ tfm->crt_flags & CRYPTO_TFM_REQ_MASK);
+
+- ret = crypto_blkcipher_setkey(op->fallback.blk, key, len);
++ ret = crypto_skcipher_setkey(op->fallback.blk, key, len);
+ if (ret) {
+ tfm->crt_flags &= ~CRYPTO_TFM_RES_MASK;
+- tfm->crt_flags |= (op->fallback.blk->base.crt_flags & CRYPTO_TFM_RES_MASK);
++ tfm->crt_flags |= crypto_skcipher_get_flags(op->fallback.blk) &
++ CRYPTO_TFM_RES_MASK;
+ }
+ return ret;
+ }
+@@ -185,33 +188,28 @@ static int fallback_blk_dec(struct blkcipher_desc *desc,
+ struct scatterlist *dst, struct scatterlist *src,
+ unsigned int nbytes)
+ {
+- unsigned int ret;
+- struct crypto_blkcipher *tfm;
+ struct geode_aes_op *op = crypto_blkcipher_ctx(desc->tfm);
++ SKCIPHER_REQUEST_ON_STACK(req, op->fallback.blk);
+
+- tfm = desc->tfm;
+- desc->tfm = op->fallback.blk;
+-
+- ret = crypto_blkcipher_decrypt_iv(desc, dst, src, nbytes);
++ skcipher_request_set_tfm(req, op->fallback.blk);
++ skcipher_request_set_callback(req, 0, NULL, NULL);
++ skcipher_request_set_crypt(req, src, dst, nbytes, desc->info);
+
+- desc->tfm = tfm;
+- return ret;
++ return crypto_skcipher_decrypt(req);
+ }
++
+ static int fallback_blk_enc(struct blkcipher_desc *desc,
+ struct scatterlist *dst, struct scatterlist *src,
+ unsigned int nbytes)
+ {
+- unsigned int ret;
+- struct crypto_blkcipher *tfm;
+ struct geode_aes_op *op = crypto_blkcipher_ctx(desc->tfm);
++ SKCIPHER_REQUEST_ON_STACK(req, op->fallback.blk);
+
+- tfm = desc->tfm;
+- desc->tfm = op->fallback.blk;
+-
+- ret = crypto_blkcipher_encrypt_iv(desc, dst, src, nbytes);
++ skcipher_request_set_tfm(req, op->fallback.blk);
++ skcipher_request_set_callback(req, 0, NULL, NULL);
++ skcipher_request_set_crypt(req, src, dst, nbytes, desc->info);
+
+- desc->tfm = tfm;
+- return ret;
++ return crypto_skcipher_encrypt(req);
+ }
+
+ static void
+@@ -311,6 +309,9 @@ geode_cbc_decrypt(struct blkcipher_desc *desc,
+ struct blkcipher_walk walk;
+ int err, ret;
+
++ if (nbytes % AES_BLOCK_SIZE)
++ return -EINVAL;
++
+ if (unlikely(op->keylen != AES_KEYSIZE_128))
+ return fallback_blk_dec(desc, dst, src, nbytes);
+
+@@ -343,6 +344,9 @@ geode_cbc_encrypt(struct blkcipher_desc *desc,
+ struct blkcipher_walk walk;
+ int err, ret;
+
++ if (nbytes % AES_BLOCK_SIZE)
++ return -EINVAL;
++
+ if (unlikely(op->keylen != AES_KEYSIZE_128))
+ return fallback_blk_enc(desc, dst, src, nbytes);
+
+@@ -370,8 +374,9 @@ static int fallback_init_blk(struct crypto_tfm *tfm)
+ const char *name = crypto_tfm_alg_name(tfm);
+ struct geode_aes_op *op = crypto_tfm_ctx(tfm);
+
+- op->fallback.blk = crypto_alloc_blkcipher(name, 0,
+- CRYPTO_ALG_ASYNC | CRYPTO_ALG_NEED_FALLBACK);
++ op->fallback.blk = crypto_alloc_skcipher(name, 0,
++ CRYPTO_ALG_ASYNC |
++ CRYPTO_ALG_NEED_FALLBACK);
+
+ if (IS_ERR(op->fallback.blk)) {
+ printk(KERN_ERR "Error allocating fallback algo %s\n", name);
+@@ -385,7 +390,7 @@ static void fallback_exit_blk(struct crypto_tfm *tfm)
+ {
+ struct geode_aes_op *op = crypto_tfm_ctx(tfm);
+
+- crypto_free_blkcipher(op->fallback.blk);
++ crypto_free_skcipher(op->fallback.blk);
+ op->fallback.blk = NULL;
+ }
+
+@@ -424,6 +429,9 @@ geode_ecb_decrypt(struct blkcipher_desc *desc,
+ struct blkcipher_walk walk;
+ int err, ret;
+
++ if (nbytes % AES_BLOCK_SIZE)
++ return -EINVAL;
++
+ if (unlikely(op->keylen != AES_KEYSIZE_128))
+ return fallback_blk_dec(desc, dst, src, nbytes);
+
+@@ -454,6 +462,9 @@ geode_ecb_encrypt(struct blkcipher_desc *desc,
+ struct blkcipher_walk walk;
+ int err, ret;
+
++ if (nbytes % AES_BLOCK_SIZE)
++ return -EINVAL;
++
+ if (unlikely(op->keylen != AES_KEYSIZE_128))
+ return fallback_blk_enc(desc, dst, src, nbytes);
+
+diff --git a/drivers/crypto/geode-aes.h b/drivers/crypto/geode-aes.h
+index f442ca972e3c..c5763a041bb8 100644
+--- a/drivers/crypto/geode-aes.h
++++ b/drivers/crypto/geode-aes.h
+@@ -64,7 +64,7 @@ struct geode_aes_op {
+ u8 *iv;
+
+ union {
+- struct crypto_blkcipher *blk;
++ struct crypto_skcipher *blk;
+ struct crypto_cipher *cip;
+ } fallback;
+ u32 keylen;
+diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c
+index f4c7516eb989..0a87c5b51286 100644
+--- a/drivers/hwmon/adt7475.c
++++ b/drivers/hwmon/adt7475.c
+@@ -296,9 +296,10 @@ static inline u16 volt2reg(int channel, long volt, u8 bypass_attn)
+ long reg;
+
+ if (bypass_attn & (1 << channel))
+- reg = (volt * 1024) / 2250;
++ reg = DIV_ROUND_CLOSEST(volt * 1024, 2250);
+ else
+- reg = (volt * r[1] * 1024) / ((r[0] + r[1]) * 2250);
++ reg = DIV_ROUND_CLOSEST(volt * r[1] * 1024,
++ (r[0] + r[1]) * 2250);
+ return clamp_val(reg, 0, 1023) & (0xff << 2);
+ }
+
+diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
+index 6b3559f58b67..d34de21d43ad 100644
+--- a/drivers/hwmon/hwmon.c
++++ b/drivers/hwmon/hwmon.c
+@@ -51,6 +51,7 @@ struct hwmon_device_attribute {
+
+ #define to_hwmon_attr(d) \
+ container_of(d, struct hwmon_device_attribute, dev_attr)
++#define to_dev_attr(a) container_of(a, struct device_attribute, attr)
+
+ /*
+ * Thermal zone information
+@@ -58,7 +59,7 @@ struct hwmon_device_attribute {
+ * also provides the sensor index.
+ */
+ struct hwmon_thermal_data {
+- struct hwmon_device *hwdev; /* Reference to hwmon device */
++ struct device *dev; /* Reference to hwmon device */
+ int index; /* sensor index */
+ };
+
+@@ -95,9 +96,27 @@ static const struct attribute_group *hwmon_dev_attr_groups[] = {
+ NULL
+ };
+
++static void hwmon_free_attrs(struct attribute **attrs)
++{
++ int i;
++
++ for (i = 0; attrs[i]; i++) {
++ struct device_attribute *dattr = to_dev_attr(attrs[i]);
++ struct hwmon_device_attribute *hattr = to_hwmon_attr(dattr);
++
++ kfree(hattr);
++ }
++ kfree(attrs);
++}
++
+ static void hwmon_dev_release(struct device *dev)
+ {
+- kfree(to_hwmon_device(dev));
++ struct hwmon_device *hwdev = to_hwmon_device(dev);
++
++ if (hwdev->group.attrs)
++ hwmon_free_attrs(hwdev->group.attrs);
++ kfree(hwdev->groups);
++ kfree(hwdev);
+ }
+
+ static struct class hwmon_class = {
+@@ -121,11 +140,11 @@ static DEFINE_IDA(hwmon_ida);
+ static int hwmon_thermal_get_temp(void *data, int *temp)
+ {
+ struct hwmon_thermal_data *tdata = data;
+- struct hwmon_device *hwdev = tdata->hwdev;
++ struct hwmon_device *hwdev = to_hwmon_device(tdata->dev);
+ int ret;
+ long t;
+
+- ret = hwdev->chip->ops->read(&hwdev->dev, hwmon_temp, hwmon_temp_input,
++ ret = hwdev->chip->ops->read(tdata->dev, hwmon_temp, hwmon_temp_input,
+ tdata->index, &t);
+ if (ret < 0)
+ return ret;
+@@ -139,8 +158,7 @@ static const struct thermal_zone_of_device_ops hwmon_thermal_ops = {
+ .get_temp = hwmon_thermal_get_temp,
+ };
+
+-static int hwmon_thermal_add_sensor(struct device *dev,
+- struct hwmon_device *hwdev, int index)
++static int hwmon_thermal_add_sensor(struct device *dev, int index)
+ {
+ struct hwmon_thermal_data *tdata;
+ struct thermal_zone_device *tzd;
+@@ -149,10 +167,10 @@ static int hwmon_thermal_add_sensor(struct device *dev,
+ if (!tdata)
+ return -ENOMEM;
+
+- tdata->hwdev = hwdev;
++ tdata->dev = dev;
+ tdata->index = index;
+
+- tzd = devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata,
++ tzd = devm_thermal_zone_of_sensor_register(dev, index, tdata,
+ &hwmon_thermal_ops);
+ /*
+ * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV,
+@@ -164,8 +182,7 @@ static int hwmon_thermal_add_sensor(struct device *dev,
+ return 0;
+ }
+ #else
+-static int hwmon_thermal_add_sensor(struct device *dev,
+- struct hwmon_device *hwdev, int index)
++static int hwmon_thermal_add_sensor(struct device *dev, int index)
+ {
+ return 0;
+ }
+@@ -242,8 +259,7 @@ static bool is_string_attr(enum hwmon_sensor_types type, u32 attr)
+ (type == hwmon_fan && attr == hwmon_fan_label);
+ }
+
+-static struct attribute *hwmon_genattr(struct device *dev,
+- const void *drvdata,
++static struct attribute *hwmon_genattr(const void *drvdata,
+ enum hwmon_sensor_types type,
+ u32 attr,
+ int index,
+@@ -271,7 +287,7 @@ static struct attribute *hwmon_genattr(struct device *dev,
+ if ((mode & S_IWUGO) && !ops->write)
+ return ERR_PTR(-EINVAL);
+
+- hattr = devm_kzalloc(dev, sizeof(*hattr), GFP_KERNEL);
++ hattr = kzalloc(sizeof(*hattr), GFP_KERNEL);
+ if (!hattr)
+ return ERR_PTR(-ENOMEM);
+
+@@ -478,8 +494,7 @@ static int hwmon_num_channel_attrs(const struct hwmon_channel_info *info)
+ return n;
+ }
+
+-static int hwmon_genattrs(struct device *dev,
+- const void *drvdata,
++static int hwmon_genattrs(const void *drvdata,
+ struct attribute **attrs,
+ const struct hwmon_ops *ops,
+ const struct hwmon_channel_info *info)
+@@ -505,7 +520,7 @@ static int hwmon_genattrs(struct device *dev,
+ attr_mask &= ~BIT(attr);
+ if (attr >= template_size)
+ return -EINVAL;
+- a = hwmon_genattr(dev, drvdata, info->type, attr, i,
++ a = hwmon_genattr(drvdata, info->type, attr, i,
+ templates[attr], ops);
+ if (IS_ERR(a)) {
+ if (PTR_ERR(a) != -ENOENT)
+@@ -519,8 +534,7 @@ static int hwmon_genattrs(struct device *dev,
+ }
+
+ static struct attribute **
+-__hwmon_create_attrs(struct device *dev, const void *drvdata,
+- const struct hwmon_chip_info *chip)
++__hwmon_create_attrs(const void *drvdata, const struct hwmon_chip_info *chip)
+ {
+ int ret, i, aindex = 0, nattrs = 0;
+ struct attribute **attrs;
+@@ -531,15 +545,17 @@ __hwmon_create_attrs(struct device *dev, const void *drvdata,
+ if (nattrs == 0)
+ return ERR_PTR(-EINVAL);
+
+- attrs = devm_kcalloc(dev, nattrs + 1, sizeof(*attrs), GFP_KERNEL);
++ attrs = kcalloc(nattrs + 1, sizeof(*attrs), GFP_KERNEL);
+ if (!attrs)
+ return ERR_PTR(-ENOMEM);
+
+ for (i = 0; chip->info[i]; i++) {
+- ret = hwmon_genattrs(dev, drvdata, &attrs[aindex], chip->ops,
++ ret = hwmon_genattrs(drvdata, &attrs[aindex], chip->ops,
+ chip->info[i]);
+- if (ret < 0)
++ if (ret < 0) {
++ hwmon_free_attrs(attrs);
+ return ERR_PTR(ret);
++ }
+ aindex += ret;
+ }
+
+@@ -581,14 +597,13 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
+ for (i = 0; groups[i]; i++)
+ ngroups++;
+
+- hwdev->groups = devm_kcalloc(dev, ngroups, sizeof(*groups),
+- GFP_KERNEL);
++ hwdev->groups = kcalloc(ngroups, sizeof(*groups), GFP_KERNEL);
+ if (!hwdev->groups) {
+ err = -ENOMEM;
+ goto free_hwmon;
+ }
+
+- attrs = __hwmon_create_attrs(dev, drvdata, chip);
++ attrs = __hwmon_create_attrs(drvdata, chip);
+ if (IS_ERR(attrs)) {
+ err = PTR_ERR(attrs);
+ goto free_hwmon;
+@@ -633,8 +648,7 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
+ hwmon_temp_input, j))
+ continue;
+ if (info[i]->config[j] & HWMON_T_INPUT) {
+- err = hwmon_thermal_add_sensor(dev,
+- hwdev, j);
++ err = hwmon_thermal_add_sensor(hdev, j);
+ if (err) {
+ device_unregister(hdev);
+ goto ida_remove;
+@@ -647,7 +661,7 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
+ return hdev;
+
+ free_hwmon:
+- kfree(hwdev);
++ hwmon_dev_release(hdev);
+ ida_remove:
+ ida_simple_remove(&hwmon_ida, id);
+ return ERR_PTR(err);
+diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
+index 38ffbdb0a85f..779ec8fdfae0 100644
+--- a/drivers/hwmon/nct7802.c
++++ b/drivers/hwmon/nct7802.c
+@@ -32,8 +32,8 @@
+ static const u8 REG_VOLTAGE[5] = { 0x09, 0x0a, 0x0c, 0x0d, 0x0e };
+
+ static const u8 REG_VOLTAGE_LIMIT_LSB[2][5] = {
+- { 0x40, 0x00, 0x42, 0x44, 0x46 },
+- { 0x3f, 0x00, 0x41, 0x43, 0x45 },
++ { 0x46, 0x00, 0x40, 0x42, 0x44 },
++ { 0x45, 0x00, 0x3f, 0x41, 0x43 },
+ };
+
+ static const u8 REG_VOLTAGE_LIMIT_MSB[5] = { 0x48, 0x00, 0x47, 0x47, 0x48 };
+diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
+index 0dad8626bcfb..6cf28b049635 100644
+--- a/drivers/hwtracing/coresight/coresight-etb10.c
++++ b/drivers/hwtracing/coresight/coresight-etb10.c
+@@ -275,9 +275,7 @@ static void *etb_alloc_buffer(struct coresight_device *csdev, int cpu,
+ int node;
+ struct cs_buffers *buf;
+
+- if (cpu == -1)
+- cpu = smp_processor_id();
+- node = cpu_to_node(cpu);
++ node = (cpu == -1) ? NUMA_NO_NODE : cpu_to_node(cpu);
+
+ buf = kzalloc_node(sizeof(struct cs_buffers), GFP_KERNEL, node);
+ if (!buf)
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+index e31061308e19..e90af39283b1 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+@@ -304,9 +304,7 @@ static void *tmc_alloc_etf_buffer(struct coresight_device *csdev, int cpu,
+ int node;
+ struct cs_buffers *buf;
+
+- if (cpu == -1)
+- cpu = smp_processor_id();
+- node = cpu_to_node(cpu);
++ node = (cpu == -1) ? NUMA_NO_NODE : cpu_to_node(cpu);
+
+ /* Allocate memory structure for interaction with Perf */
+ buf = kzalloc_node(sizeof(struct cs_buffers), GFP_KERNEL, node);
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index f39670c5c25c..9899f7e155a5 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -2584,17 +2584,6 @@ isert_wait4logout(struct isert_conn *isert_conn)
+ }
+ }
+
+-static void
+-isert_wait4cmds(struct iscsi_conn *conn)
+-{
+- isert_info("iscsi_conn %p\n", conn);
+-
+- if (conn->sess) {
+- target_sess_cmd_list_set_waiting(conn->sess->se_sess);
+- target_wait_for_sess_cmds(conn->sess->se_sess);
+- }
+-}
+-
+ /**
+ * isert_put_unsol_pending_cmds() - Drop commands waiting for
+ * unsolicitate dataout
+@@ -2642,7 +2631,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
+
+ ib_drain_qp(isert_conn->qp);
+ isert_put_unsol_pending_cmds(conn);
+- isert_wait4cmds(conn);
+ isert_wait4logout(isert_conn);
+
+ queue_work(isert_release_wq, &isert_conn->release_work);
+diff --git a/drivers/input/misc/keyspan_remote.c b/drivers/input/misc/keyspan_remote.c
+index a8937ceac66a..af4db1350915 100644
+--- a/drivers/input/misc/keyspan_remote.c
++++ b/drivers/input/misc/keyspan_remote.c
+@@ -339,7 +339,8 @@ static int keyspan_setup(struct usb_device* dev)
+ int retval = 0;
+
+ retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+- 0x11, 0x40, 0x5601, 0x0, NULL, 0, 0);
++ 0x11, 0x40, 0x5601, 0x0, NULL, 0,
++ USB_CTRL_SET_TIMEOUT);
+ if (retval) {
+ dev_dbg(&dev->dev, "%s - failed to set bit rate due to error: %d\n",
+ __func__, retval);
+@@ -347,7 +348,8 @@ static int keyspan_setup(struct usb_device* dev)
+ }
+
+ retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+- 0x44, 0x40, 0x0, 0x0, NULL, 0, 0);
++ 0x44, 0x40, 0x0, 0x0, NULL, 0,
++ USB_CTRL_SET_TIMEOUT);
+ if (retval) {
+ dev_dbg(&dev->dev, "%s - failed to set resume sensitivity due to error: %d\n",
+ __func__, retval);
+@@ -355,7 +357,8 @@ static int keyspan_setup(struct usb_device* dev)
+ }
+
+ retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+- 0x22, 0x40, 0x0, 0x0, NULL, 0, 0);
++ 0x22, 0x40, 0x0, 0x0, NULL, 0,
++ USB_CTRL_SET_TIMEOUT);
+ if (retval) {
+ dev_dbg(&dev->dev, "%s - failed to turn receive on due to error: %d\n",
+ __func__, retval);
+diff --git a/drivers/input/misc/pm8xxx-vibrator.c b/drivers/input/misc/pm8xxx-vibrator.c
+index 7dd1c1fbe42a..27b3db154a33 100644
+--- a/drivers/input/misc/pm8xxx-vibrator.c
++++ b/drivers/input/misc/pm8xxx-vibrator.c
+@@ -98,7 +98,7 @@ static int pm8xxx_vib_set(struct pm8xxx_vib *vib, bool on)
+
+ if (regs->enable_mask)
+ rc = regmap_update_bits(vib->regmap, regs->enable_addr,
+- on ? regs->enable_mask : 0, val);
++ regs->enable_mask, on ? ~0 : 0);
+
+ return rc;
+ }
+diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c
+index 4b2466cf2fb1..b6ccf39c6a7b 100644
+--- a/drivers/input/rmi4/rmi_smbus.c
++++ b/drivers/input/rmi4/rmi_smbus.c
+@@ -166,6 +166,7 @@ static int rmi_smb_write_block(struct rmi_transport_dev *xport, u16 rmiaddr,
+ /* prepare to write next block of bytes */
+ cur_len -= SMB_MAX_COUNT;
+ databuff += SMB_MAX_COUNT;
++ rmiaddr += SMB_MAX_COUNT;
+ }
+ exit:
+ mutex_unlock(&rmi_smb->page_mutex);
+@@ -217,6 +218,7 @@ static int rmi_smb_read_block(struct rmi_transport_dev *xport, u16 rmiaddr,
+ /* prepare to read next block of bytes */
+ cur_len -= SMB_MAX_COUNT;
+ databuff += SMB_MAX_COUNT;
++ rmiaddr += SMB_MAX_COUNT;
+ }
+
+ retval = 0;
+diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
+index c82cd5079d0e..dc2ad1cc8fe1 100644
+--- a/drivers/input/tablet/aiptek.c
++++ b/drivers/input/tablet/aiptek.c
+@@ -1815,14 +1815,14 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0);
+
+ /* Verify that a device really has an endpoint */
+- if (intf->altsetting[0].desc.bNumEndpoints < 1) {
++ if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
+ dev_err(&intf->dev,
+ "interface has %d endpoints, but must have minimum 1\n",
+- intf->altsetting[0].desc.bNumEndpoints);
++ intf->cur_altsetting->desc.bNumEndpoints);
+ err = -EINVAL;
+ goto fail3;
+ }
+- endpoint = &intf->altsetting[0].endpoint[0].desc;
++ endpoint = &intf->cur_altsetting->endpoint[0].desc;
+
+ /* Go set up our URB, which is called when the tablet receives
+ * input.
+diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
+index 35031228a6d0..799c94dda651 100644
+--- a/drivers/input/tablet/gtco.c
++++ b/drivers/input/tablet/gtco.c
+@@ -875,18 +875,14 @@ static int gtco_probe(struct usb_interface *usbinterface,
+ }
+
+ /* Sanity check that a device has an endpoint */
+- if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) {
++ if (usbinterface->cur_altsetting->desc.bNumEndpoints < 1) {
+ dev_err(&usbinterface->dev,
+ "Invalid number of endpoints\n");
+ error = -EINVAL;
+ goto err_free_urb;
+ }
+
+- /*
+- * The endpoint is always altsetting 0, we know this since we know
+- * this device only has one interrupt endpoint
+- */
+- endpoint = &usbinterface->altsetting[0].endpoint[0].desc;
++ endpoint = &usbinterface->cur_altsetting->endpoint[0].desc;
+
+ /* Some debug */
+ dev_dbg(&usbinterface->dev, "gtco # interfaces: %d\n", usbinterface->num_altsetting);
+@@ -973,7 +969,7 @@ static int gtco_probe(struct usb_interface *usbinterface,
+ input_dev->dev.parent = &usbinterface->dev;
+
+ /* Setup the URB, it will be posted later on open of input device */
+- endpoint = &usbinterface->altsetting[0].endpoint[0].desc;
++ endpoint = &usbinterface->cur_altsetting->endpoint[0].desc;
+
+ usb_fill_int_urb(gtco->urbinfo,
+ udev,
+diff --git a/drivers/input/tablet/pegasus_notetaker.c b/drivers/input/tablet/pegasus_notetaker.c
+index ffd03cfe3131..570cdaef3558 100644
+--- a/drivers/input/tablet/pegasus_notetaker.c
++++ b/drivers/input/tablet/pegasus_notetaker.c
+@@ -274,7 +274,7 @@ static int pegasus_probe(struct usb_interface *intf,
+ return -ENODEV;
+
+ /* Sanity check that the device has an endpoint */
+- if (intf->altsetting[0].desc.bNumEndpoints < 1) {
++ if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
+ dev_err(&intf->dev, "Invalid number of endpoints\n");
+ return -EINVAL;
+ }
+diff --git a/drivers/input/touchscreen/sun4i-ts.c b/drivers/input/touchscreen/sun4i-ts.c
+index d2e14d9e5975..ab44eb0352d0 100644
+--- a/drivers/input/touchscreen/sun4i-ts.c
++++ b/drivers/input/touchscreen/sun4i-ts.c
+@@ -246,6 +246,7 @@ static int sun4i_ts_probe(struct platform_device *pdev)
+ struct device *dev = &pdev->dev;
+ struct device_node *np = dev->of_node;
+ struct device *hwmon;
++ struct thermal_zone_device *thermal;
+ int error;
+ u32 reg;
+ bool ts_attached;
+@@ -365,7 +366,10 @@ static int sun4i_ts_probe(struct platform_device *pdev)
+ if (IS_ERR(hwmon))
+ return PTR_ERR(hwmon);
+
+- devm_thermal_zone_of_sensor_register(ts->dev, 0, ts, &sun4i_ts_tz_ops);
++ thermal = devm_thermal_zone_of_sensor_register(ts->dev, 0, ts,
++ &sun4i_ts_tz_ops);
++ if (IS_ERR(thermal))
++ return PTR_ERR(thermal);
+
+ writel(TEMP_IRQ_EN(1), ts->base + TP_INT_FIFOC);
+
+diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
+index 894843a7ec7b..caa3aca2ea54 100644
+--- a/drivers/input/touchscreen/sur40.c
++++ b/drivers/input/touchscreen/sur40.c
+@@ -657,7 +657,7 @@ static int sur40_probe(struct usb_interface *interface,
+ int error;
+
+ /* Check if we really have the right interface. */
+- iface_desc = &interface->altsetting[0];
++ iface_desc = interface->cur_altsetting;
+ if (iface_desc->desc.bInterfaceClass != 0xFF)
+ return -ENODEV;
+
+diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
+index 7675b645db2e..f75d892b6f03 100644
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1548,12 +1548,12 @@ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops,
+ case V4L2_BUF_TYPE_VBI_CAPTURE:
+ if (unlikely(!ops->vidioc_s_fmt_vbi_cap))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.vbi);
++ CLEAR_AFTER_FIELD(p, fmt.vbi.flags);
+ return ops->vidioc_s_fmt_vbi_cap(file, fh, arg);
+ case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
+ if (unlikely(!ops->vidioc_s_fmt_sliced_vbi_cap))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.sliced);
++ CLEAR_AFTER_FIELD(p, fmt.sliced.io_size);
+ return ops->vidioc_s_fmt_sliced_vbi_cap(file, fh, arg);
+ case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+ if (unlikely(!ops->vidioc_s_fmt_vid_out))
+@@ -1576,22 +1576,22 @@ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops,
+ case V4L2_BUF_TYPE_VBI_OUTPUT:
+ if (unlikely(!ops->vidioc_s_fmt_vbi_out))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.vbi);
++ CLEAR_AFTER_FIELD(p, fmt.vbi.flags);
+ return ops->vidioc_s_fmt_vbi_out(file, fh, arg);
+ case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
+ if (unlikely(!ops->vidioc_s_fmt_sliced_vbi_out))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.sliced);
++ CLEAR_AFTER_FIELD(p, fmt.sliced.io_size);
+ return ops->vidioc_s_fmt_sliced_vbi_out(file, fh, arg);
+ case V4L2_BUF_TYPE_SDR_CAPTURE:
+ if (unlikely(!ops->vidioc_s_fmt_sdr_cap))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.sdr);
++ CLEAR_AFTER_FIELD(p, fmt.sdr.buffersize);
+ return ops->vidioc_s_fmt_sdr_cap(file, fh, arg);
+ case V4L2_BUF_TYPE_SDR_OUTPUT:
+ if (unlikely(!ops->vidioc_s_fmt_sdr_out))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.sdr);
++ CLEAR_AFTER_FIELD(p, fmt.sdr.buffersize);
+ return ops->vidioc_s_fmt_sdr_out(file, fh, arg);
+ case V4L2_BUF_TYPE_META_CAPTURE:
+ if (unlikely(!ops->vidioc_s_fmt_meta_cap))
+@@ -1635,12 +1635,12 @@ static int v4l_try_fmt(const struct v4l2_ioctl_ops *ops,
+ case V4L2_BUF_TYPE_VBI_CAPTURE:
+ if (unlikely(!ops->vidioc_try_fmt_vbi_cap))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.vbi);
++ CLEAR_AFTER_FIELD(p, fmt.vbi.flags);
+ return ops->vidioc_try_fmt_vbi_cap(file, fh, arg);
+ case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
+ if (unlikely(!ops->vidioc_try_fmt_sliced_vbi_cap))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.sliced);
++ CLEAR_AFTER_FIELD(p, fmt.sliced.io_size);
+ return ops->vidioc_try_fmt_sliced_vbi_cap(file, fh, arg);
+ case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+ if (unlikely(!ops->vidioc_try_fmt_vid_out))
+@@ -1663,22 +1663,22 @@ static int v4l_try_fmt(const struct v4l2_ioctl_ops *ops,
+ case V4L2_BUF_TYPE_VBI_OUTPUT:
+ if (unlikely(!ops->vidioc_try_fmt_vbi_out))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.vbi);
++ CLEAR_AFTER_FIELD(p, fmt.vbi.flags);
+ return ops->vidioc_try_fmt_vbi_out(file, fh, arg);
+ case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
+ if (unlikely(!ops->vidioc_try_fmt_sliced_vbi_out))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.sliced);
++ CLEAR_AFTER_FIELD(p, fmt.sliced.io_size);
+ return ops->vidioc_try_fmt_sliced_vbi_out(file, fh, arg);
+ case V4L2_BUF_TYPE_SDR_CAPTURE:
+ if (unlikely(!ops->vidioc_try_fmt_sdr_cap))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.sdr);
++ CLEAR_AFTER_FIELD(p, fmt.sdr.buffersize);
+ return ops->vidioc_try_fmt_sdr_cap(file, fh, arg);
+ case V4L2_BUF_TYPE_SDR_OUTPUT:
+ if (unlikely(!ops->vidioc_try_fmt_sdr_out))
+ break;
+- CLEAR_AFTER_FIELD(p, fmt.sdr);
++ CLEAR_AFTER_FIELD(p, fmt.sdr.buffersize);
+ return ops->vidioc_try_fmt_sdr_out(file, fh, arg);
+ case V4L2_BUF_TYPE_META_CAPTURE:
+ if (unlikely(!ops->vidioc_try_fmt_meta_cap))
+diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
+index 908b23e6a03c..14d749a0de95 100644
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -177,7 +177,7 @@ static void tegra_sdhci_reset(struct sdhci_host *host, u8 mask)
+ misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50;
+ if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104)
+ misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104;
+- if (soc_data->nvquirks & SDHCI_MISC_CTRL_ENABLE_SDR50)
++ if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50)
+ clk_ctrl |= SDHCI_CLOCK_CTRL_SDR50_TUNING_OVERRIDE;
+ }
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 369817a29c22..5a7fd89a8f2b 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3700,11 +3700,13 @@ int sdhci_setup_host(struct sdhci_host *host)
+ if (host->ops->get_min_clock)
+ mmc->f_min = host->ops->get_min_clock(host);
+ else if (host->version >= SDHCI_SPEC_300) {
+- if (host->clk_mul) {
+- mmc->f_min = (host->max_clk * host->clk_mul) / 1024;
++ if (host->clk_mul)
+ max_clk = host->max_clk * host->clk_mul;
+- } else
+- mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
++ /*
++ * Divided Clock Mode minimum clock rate is always less than
++ * Programmable Clock Mode minimum clock rate.
++ */
++ mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
+ } else
+ mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200;
+
+diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
+index cf0769ad39cd..b2e5bcae7fbe 100644
+--- a/drivers/net/can/slcan.c
++++ b/drivers/net/can/slcan.c
+@@ -343,9 +343,16 @@ static void slcan_transmit(struct work_struct *work)
+ */
+ static void slcan_write_wakeup(struct tty_struct *tty)
+ {
+- struct slcan *sl = tty->disc_data;
++ struct slcan *sl;
++
++ rcu_read_lock();
++ sl = rcu_dereference(tty->disc_data);
++ if (!sl)
++ goto out;
+
+ schedule_work(&sl->tx_work);
++out:
++ rcu_read_unlock();
+ }
+
+ /* Send a can_frame to a TTY queue. */
+@@ -640,10 +647,11 @@ static void slcan_close(struct tty_struct *tty)
+ return;
+
+ spin_lock_bh(&sl->lock);
+- tty->disc_data = NULL;
++ rcu_assign_pointer(tty->disc_data, NULL);
+ sl->tty = NULL;
+ spin_unlock_bh(&sl->lock);
+
++ synchronize_rcu();
+ flush_work(&sl->tx_work);
+
+ /* Flush network side */
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index b7d75011cede..736a6a5fbd98 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2166,8 +2166,8 @@ static void bcmgenet_init_tx_ring(struct bcmgenet_priv *priv,
+ DMA_END_ADDR);
+
+ /* Initialize Tx NAPI */
+- netif_napi_add(priv->dev, &ring->napi, bcmgenet_tx_poll,
+- NAPI_POLL_WEIGHT);
++ netif_tx_napi_add(priv->dev, &ring->napi, bcmgenet_tx_poll,
++ NAPI_POLL_WEIGHT);
+ }
+
+ /* Initialize a RDMA ring */
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+index 6be6de0774b6..c82469ab7aba 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+@@ -2449,6 +2449,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
+
+ if (!is_offload(adapter))
+ return -EOPNOTSUPP;
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
+ if (!(adapter->flags & FULL_INIT_DONE))
+ return -EIO; /* need the memory controllers */
+ if (copy_from_user(&t, useraddr, sizeof(t)))
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index 5f1875fe47cd..69282f31d519 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -63,6 +63,8 @@ static int sonic_open(struct net_device *dev)
+
+ netif_dbg(lp, ifup, dev, "%s: initializing sonic driver\n", __func__);
+
++ spin_lock_init(&lp->lock);
++
+ for (i = 0; i < SONIC_NUM_RRS; i++) {
+ struct sk_buff *skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2);
+ if (skb == NULL) {
+@@ -113,6 +115,24 @@ static int sonic_open(struct net_device *dev)
+ return 0;
+ }
+
++/* Wait for the SONIC to become idle. */
++static void sonic_quiesce(struct net_device *dev, u16 mask)
++{
++ struct sonic_local * __maybe_unused lp = netdev_priv(dev);
++ int i;
++ u16 bits;
++
++ for (i = 0; i < 1000; ++i) {
++ bits = SONIC_READ(SONIC_CMD) & mask;
++ if (!bits)
++ return;
++ if (irqs_disabled() || in_interrupt())
++ udelay(20);
++ else
++ usleep_range(100, 200);
++ }
++ WARN_ONCE(1, "command deadline expired! 0x%04x\n", bits);
++}
+
+ /*
+ * Close the SONIC device
+@@ -129,6 +149,9 @@ static int sonic_close(struct net_device *dev)
+ /*
+ * stop the SONIC, disable interrupts
+ */
++ SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS);
++ sonic_quiesce(dev, SONIC_CR_ALL);
++
+ SONIC_WRITE(SONIC_IMR, 0);
+ SONIC_WRITE(SONIC_ISR, 0x7fff);
+ SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
+@@ -168,6 +191,9 @@ static void sonic_tx_timeout(struct net_device *dev)
+ * put the Sonic into software-reset mode and
+ * disable all interrupts before releasing DMA buffers
+ */
++ SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS);
++ sonic_quiesce(dev, SONIC_CR_ALL);
++
+ SONIC_WRITE(SONIC_IMR, 0);
+ SONIC_WRITE(SONIC_ISR, 0x7fff);
+ SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
+@@ -205,8 +231,6 @@ static void sonic_tx_timeout(struct net_device *dev)
+ * wake the tx queue
+ * Concurrently with all of this, the SONIC is potentially writing to
+ * the status flags of the TDs.
+- * Until some mutual exclusion is added, this code will not work with SMP. However,
+- * MIPS Jazz machines and m68k Macs were all uni-processor machines.
+ */
+
+ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+@@ -214,7 +238,8 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ struct sonic_local *lp = netdev_priv(dev);
+ dma_addr_t laddr;
+ int length;
+- int entry = lp->next_tx;
++ int entry;
++ unsigned long flags;
+
+ netif_dbg(lp, tx_queued, dev, "%s: skb=%p\n", __func__, skb);
+
+@@ -236,6 +261,10 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ return NETDEV_TX_OK;
+ }
+
++ spin_lock_irqsave(&lp->lock, flags);
++
++ entry = lp->next_tx;
++
+ sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */
+ sonic_tda_put(dev, entry, SONIC_TD_FRAG_COUNT, 1); /* single fragment */
+ sonic_tda_put(dev, entry, SONIC_TD_PKTSIZE, length); /* length of packet */
+@@ -245,10 +274,6 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ sonic_tda_put(dev, entry, SONIC_TD_LINK,
+ sonic_tda_get(dev, entry, SONIC_TD_LINK) | SONIC_EOL);
+
+- /*
+- * Must set tx_skb[entry] only after clearing status, and
+- * before clearing EOL and before stopping queue
+- */
+ wmb();
+ lp->tx_len[entry] = length;
+ lp->tx_laddr[entry] = laddr;
+@@ -271,6 +296,8 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+
+ SONIC_WRITE(SONIC_CMD, SONIC_CR_TXP);
+
++ spin_unlock_irqrestore(&lp->lock, flags);
++
+ return NETDEV_TX_OK;
+ }
+
+@@ -283,15 +310,28 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id)
+ struct net_device *dev = dev_id;
+ struct sonic_local *lp = netdev_priv(dev);
+ int status;
++ unsigned long flags;
++
++ /* The lock has two purposes. Firstly, it synchronizes sonic_interrupt()
++ * with sonic_send_packet() so that the two functions can share state.
++ * Secondly, it makes sonic_interrupt() re-entrant, as that is required
++ * by macsonic which must use two IRQs with different priority levels.
++ */
++ spin_lock_irqsave(&lp->lock, flags);
++
++ status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT;
++ if (!status) {
++ spin_unlock_irqrestore(&lp->lock, flags);
+
+- if (!(status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT))
+ return IRQ_NONE;
++ }
+
+ do {
++ SONIC_WRITE(SONIC_ISR, status); /* clear the interrupt(s) */
++
+ if (status & SONIC_INT_PKTRX) {
+ netif_dbg(lp, intr, dev, "%s: packet rx\n", __func__);
+ sonic_rx(dev); /* got packet(s) */
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_PKTRX); /* clear the interrupt */
+ }
+
+ if (status & SONIC_INT_TXDN) {
+@@ -299,11 +339,12 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id)
+ int td_status;
+ int freed_some = 0;
+
+- /* At this point, cur_tx is the index of a TD that is one of:
+- * unallocated/freed (status set & tx_skb[entry] clear)
+- * allocated and sent (status set & tx_skb[entry] set )
+- * allocated and not yet sent (status clear & tx_skb[entry] set )
+- * still being allocated by sonic_send_packet (status clear & tx_skb[entry] clear)
++ /* The state of a Transmit Descriptor may be inferred
++ * from { tx_skb[entry], td_status } as follows.
++ * { clear, clear } => the TD has never been used
++ * { set, clear } => the TD was handed to SONIC
++ * { set, set } => the TD was handed back
++ * { clear, set } => the TD is available for re-use
+ */
+
+ netif_dbg(lp, intr, dev, "%s: tx done\n", __func__);
+@@ -312,18 +353,19 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id)
+ if ((td_status = sonic_tda_get(dev, entry, SONIC_TD_STATUS)) == 0)
+ break;
+
+- if (td_status & 0x0001) {
++ if (td_status & SONIC_TCR_PTX) {
+ lp->stats.tx_packets++;
+ lp->stats.tx_bytes += sonic_tda_get(dev, entry, SONIC_TD_PKTSIZE);
+ } else {
+- lp->stats.tx_errors++;
+- if (td_status & 0x0642)
++ if (td_status & (SONIC_TCR_EXD |
++ SONIC_TCR_EXC | SONIC_TCR_BCM))
+ lp->stats.tx_aborted_errors++;
+- if (td_status & 0x0180)
++ if (td_status &
++ (SONIC_TCR_NCRS | SONIC_TCR_CRLS))
+ lp->stats.tx_carrier_errors++;
+- if (td_status & 0x0020)
++ if (td_status & SONIC_TCR_OWC)
+ lp->stats.tx_window_errors++;
+- if (td_status & 0x0004)
++ if (td_status & SONIC_TCR_FU)
+ lp->stats.tx_fifo_errors++;
+ }
+
+@@ -345,7 +387,6 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id)
+ if (freed_some || lp->tx_skb[entry] == NULL)
+ netif_wake_queue(dev); /* The ring is no longer full */
+ lp->cur_tx = entry;
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_TXDN); /* clear the interrupt */
+ }
+
+ /*
+@@ -354,42 +395,37 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id)
+ if (status & SONIC_INT_RFO) {
+ netif_dbg(lp, rx_err, dev, "%s: rx fifo overrun\n",
+ __func__);
+- lp->stats.rx_fifo_errors++;
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_RFO); /* clear the interrupt */
+ }
+ if (status & SONIC_INT_RDE) {
+ netif_dbg(lp, rx_err, dev, "%s: rx descriptors exhausted\n",
+ __func__);
+- lp->stats.rx_dropped++;
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_RDE); /* clear the interrupt */
+ }
+ if (status & SONIC_INT_RBAE) {
+ netif_dbg(lp, rx_err, dev, "%s: rx buffer area exceeded\n",
+ __func__);
+- lp->stats.rx_dropped++;
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_RBAE); /* clear the interrupt */
+ }
+
+ /* counter overruns; all counters are 16bit wide */
+- if (status & SONIC_INT_FAE) {
++ if (status & SONIC_INT_FAE)
+ lp->stats.rx_frame_errors += 65536;
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_FAE); /* clear the interrupt */
+- }
+- if (status & SONIC_INT_CRC) {
++ if (status & SONIC_INT_CRC)
+ lp->stats.rx_crc_errors += 65536;
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_CRC); /* clear the interrupt */
+- }
+- if (status & SONIC_INT_MP) {
++ if (status & SONIC_INT_MP)
+ lp->stats.rx_missed_errors += 65536;
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_MP); /* clear the interrupt */
+- }
+
+ /* transmit error */
+ if (status & SONIC_INT_TXER) {
+- if (SONIC_READ(SONIC_TCR) & SONIC_TCR_FU)
+- netif_dbg(lp, tx_err, dev, "%s: tx fifo underrun\n",
+- __func__);
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_TXER); /* clear the interrupt */
++ u16 tcr = SONIC_READ(SONIC_TCR);
++
++ netif_dbg(lp, tx_err, dev, "%s: TXER intr, TCR %04x\n",
++ __func__, tcr);
++
++ if (tcr & (SONIC_TCR_EXD | SONIC_TCR_EXC |
++ SONIC_TCR_FU | SONIC_TCR_BCM)) {
++ /* Aborted transmission. Try again. */
++ netif_stop_queue(dev);
++ SONIC_WRITE(SONIC_CMD, SONIC_CR_TXP);
++ }
+ }
+
+ /* bus retry */
+@@ -399,107 +435,164 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id)
+ /* ... to help debug DMA problems causing endless interrupts. */
+ /* Bounce the eth interface to turn on the interrupt again. */
+ SONIC_WRITE(SONIC_IMR, 0);
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_BR); /* clear the interrupt */
+ }
+
+- /* load CAM done */
+- if (status & SONIC_INT_LCD)
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_LCD); /* clear the interrupt */
+- } while((status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT));
++ status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT;
++ } while (status);
++
++ spin_unlock_irqrestore(&lp->lock, flags);
++
+ return IRQ_HANDLED;
+ }
+
++/* Return the array index corresponding to a given Receive Buffer pointer. */
++static int index_from_addr(struct sonic_local *lp, dma_addr_t addr,
++ unsigned int last)
++{
++ unsigned int i = last;
++
++ do {
++ i = (i + 1) & SONIC_RRS_MASK;
++ if (addr == lp->rx_laddr[i])
++ return i;
++ } while (i != last);
++
++ return -ENOENT;
++}
++
++/* Allocate and map a new skb to be used as a receive buffer. */
++static bool sonic_alloc_rb(struct net_device *dev, struct sonic_local *lp,
++ struct sk_buff **new_skb, dma_addr_t *new_addr)
++{
++ *new_skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2);
++ if (!*new_skb)
++ return false;
++
++ if (SONIC_BUS_SCALE(lp->dma_bitmode) == 2)
++ skb_reserve(*new_skb, 2);
++
++ *new_addr = dma_map_single(lp->device, skb_put(*new_skb, SONIC_RBSIZE),
++ SONIC_RBSIZE, DMA_FROM_DEVICE);
++ if (!*new_addr) {
++ dev_kfree_skb(*new_skb);
++ *new_skb = NULL;
++ return false;
++ }
++
++ return true;
++}
++
++/* Place a new receive resource in the Receive Resource Area and update RWP. */
++static void sonic_update_rra(struct net_device *dev, struct sonic_local *lp,
++ dma_addr_t old_addr, dma_addr_t new_addr)
++{
++ unsigned int entry = sonic_rr_entry(dev, SONIC_READ(SONIC_RWP));
++ unsigned int end = sonic_rr_entry(dev, SONIC_READ(SONIC_RRP));
++ u32 buf;
++
++ /* The resources in the range [RRP, RWP) belong to the SONIC. This loop
++ * scans the other resources in the RRA, those in the range [RWP, RRP).
++ */
++ do {
++ buf = (sonic_rra_get(dev, entry, SONIC_RR_BUFADR_H) << 16) |
++ sonic_rra_get(dev, entry, SONIC_RR_BUFADR_L);
++
++ if (buf == old_addr)
++ break;
++
++ entry = (entry + 1) & SONIC_RRS_MASK;
++ } while (entry != end);
++
++ WARN_ONCE(buf != old_addr, "failed to find resource!\n");
++
++ sonic_rra_put(dev, entry, SONIC_RR_BUFADR_H, new_addr >> 16);
++ sonic_rra_put(dev, entry, SONIC_RR_BUFADR_L, new_addr & 0xffff);
++
++ entry = (entry + 1) & SONIC_RRS_MASK;
++
++ SONIC_WRITE(SONIC_RWP, sonic_rr_addr(dev, entry));
++}
++
+ /*
+ * We have a good packet(s), pass it/them up the network stack.
+ */
+ static void sonic_rx(struct net_device *dev)
+ {
+ struct sonic_local *lp = netdev_priv(dev);
+- int status;
+ int entry = lp->cur_rx;
++ int prev_entry = lp->eol_rx;
++ bool rbe = false;
+
+ while (sonic_rda_get(dev, entry, SONIC_RD_IN_USE) == 0) {
+- struct sk_buff *used_skb;
+- struct sk_buff *new_skb;
+- dma_addr_t new_laddr;
+- u16 bufadr_l;
+- u16 bufadr_h;
+- int pkt_len;
+-
+- status = sonic_rda_get(dev, entry, SONIC_RD_STATUS);
+- if (status & SONIC_RCR_PRX) {
+- /* Malloc up new buffer. */
+- new_skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2);
+- if (new_skb == NULL) {
+- lp->stats.rx_dropped++;
++ u16 status = sonic_rda_get(dev, entry, SONIC_RD_STATUS);
++
++ /* If the RD has LPKT set, the chip has finished with the RB */
++ if ((status & SONIC_RCR_PRX) && (status & SONIC_RCR_LPKT)) {
++ struct sk_buff *new_skb;
++ dma_addr_t new_laddr;
++ u32 addr = (sonic_rda_get(dev, entry,
++ SONIC_RD_PKTPTR_H) << 16) |
++ sonic_rda_get(dev, entry, SONIC_RD_PKTPTR_L);
++ int i = index_from_addr(lp, addr, entry);
++
++ if (i < 0) {
++ WARN_ONCE(1, "failed to find buffer!\n");
+ break;
+ }
+- /* provide 16 byte IP header alignment unless DMA requires otherwise */
+- if(SONIC_BUS_SCALE(lp->dma_bitmode) == 2)
+- skb_reserve(new_skb, 2);
+-
+- new_laddr = dma_map_single(lp->device, skb_put(new_skb, SONIC_RBSIZE),
+- SONIC_RBSIZE, DMA_FROM_DEVICE);
+- if (!new_laddr) {
+- dev_kfree_skb(new_skb);
+- printk(KERN_ERR "%s: Failed to map rx buffer, dropping packet.\n", dev->name);
++
++ if (sonic_alloc_rb(dev, lp, &new_skb, &new_laddr)) {
++ struct sk_buff *used_skb = lp->rx_skb[i];
++ int pkt_len;
++
++ /* Pass the used buffer up the stack */
++ dma_unmap_single(lp->device, addr, SONIC_RBSIZE,
++ DMA_FROM_DEVICE);
++
++ pkt_len = sonic_rda_get(dev, entry,
++ SONIC_RD_PKTLEN);
++ skb_trim(used_skb, pkt_len);
++ used_skb->protocol = eth_type_trans(used_skb,
++ dev);
++ netif_rx(used_skb);
++ lp->stats.rx_packets++;
++ lp->stats.rx_bytes += pkt_len;
++
++ lp->rx_skb[i] = new_skb;
++ lp->rx_laddr[i] = new_laddr;
++ } else {
++ /* Failed to obtain a new buffer so re-use it */
++ new_laddr = addr;
+ lp->stats.rx_dropped++;
+- break;
+ }
+-
+- /* now we have a new skb to replace it, pass the used one up the stack */
+- dma_unmap_single(lp->device, lp->rx_laddr[entry], SONIC_RBSIZE, DMA_FROM_DEVICE);
+- used_skb = lp->rx_skb[entry];
+- pkt_len = sonic_rda_get(dev, entry, SONIC_RD_PKTLEN);
+- skb_trim(used_skb, pkt_len);
+- used_skb->protocol = eth_type_trans(used_skb, dev);
+- netif_rx(used_skb);
+- lp->stats.rx_packets++;
+- lp->stats.rx_bytes += pkt_len;
+-
+- /* and insert the new skb */
+- lp->rx_laddr[entry] = new_laddr;
+- lp->rx_skb[entry] = new_skb;
+-
+- bufadr_l = (unsigned long)new_laddr & 0xffff;
+- bufadr_h = (unsigned long)new_laddr >> 16;
+- sonic_rra_put(dev, entry, SONIC_RR_BUFADR_L, bufadr_l);
+- sonic_rra_put(dev, entry, SONIC_RR_BUFADR_H, bufadr_h);
+- } else {
+- /* This should only happen, if we enable accepting broken packets. */
+- lp->stats.rx_errors++;
+- if (status & SONIC_RCR_FAER)
+- lp->stats.rx_frame_errors++;
+- if (status & SONIC_RCR_CRCR)
+- lp->stats.rx_crc_errors++;
+- }
+- if (status & SONIC_RCR_LPKT) {
+- /*
+- * this was the last packet out of the current receive buffer
+- * give the buffer back to the SONIC
++ /* If RBE is already asserted when RWP advances then
++ * it's safe to clear RBE after processing this packet.
+ */
+- lp->cur_rwp += SIZEOF_SONIC_RR * SONIC_BUS_SCALE(lp->dma_bitmode);
+- if (lp->cur_rwp >= lp->rra_end) lp->cur_rwp = lp->rra_laddr & 0xffff;
+- SONIC_WRITE(SONIC_RWP, lp->cur_rwp);
+- if (SONIC_READ(SONIC_ISR) & SONIC_INT_RBE) {
+- netif_dbg(lp, rx_err, dev, "%s: rx buffer exhausted\n",
+- __func__);
+- SONIC_WRITE(SONIC_ISR, SONIC_INT_RBE); /* clear the flag */
+- }
+- } else
+- printk(KERN_ERR "%s: rx desc without RCR_LPKT. Shouldn't happen !?\n",
+- dev->name);
++ rbe = rbe || SONIC_READ(SONIC_ISR) & SONIC_INT_RBE;
++ sonic_update_rra(dev, lp, addr, new_laddr);
++ }
+ /*
+ * give back the descriptor
+ */
+- sonic_rda_put(dev, entry, SONIC_RD_LINK,
+- sonic_rda_get(dev, entry, SONIC_RD_LINK) | SONIC_EOL);
++ sonic_rda_put(dev, entry, SONIC_RD_STATUS, 0);
+ sonic_rda_put(dev, entry, SONIC_RD_IN_USE, 1);
+- sonic_rda_put(dev, lp->eol_rx, SONIC_RD_LINK,
+- sonic_rda_get(dev, lp->eol_rx, SONIC_RD_LINK) & ~SONIC_EOL);
+- lp->eol_rx = entry;
+- lp->cur_rx = entry = (entry + 1) & SONIC_RDS_MASK;
++
++ prev_entry = entry;
++ entry = (entry + 1) & SONIC_RDS_MASK;
++ }
++
++ lp->cur_rx = entry;
++
++ if (prev_entry != lp->eol_rx) {
++ /* Advance the EOL flag to put descriptors back into service */
++ sonic_rda_put(dev, prev_entry, SONIC_RD_LINK, SONIC_EOL |
++ sonic_rda_get(dev, prev_entry, SONIC_RD_LINK));
++ sonic_rda_put(dev, lp->eol_rx, SONIC_RD_LINK, ~SONIC_EOL &
++ sonic_rda_get(dev, lp->eol_rx, SONIC_RD_LINK));
++ lp->eol_rx = prev_entry;
+ }
++
++ if (rbe)
++ SONIC_WRITE(SONIC_ISR, SONIC_INT_RBE);
+ /*
+ * If any worth-while packets have been received, netif_rx()
+ * has done a mark_bh(NET_BH) for us and will work on them
+@@ -549,6 +642,8 @@ static void sonic_multicast_list(struct net_device *dev)
+ (netdev_mc_count(dev) > 15)) {
+ rcr |= SONIC_RCR_AMC;
+ } else {
++ unsigned long flags;
++
+ netif_dbg(lp, ifup, dev, "%s: mc_count %d\n", __func__,
+ netdev_mc_count(dev));
+ sonic_set_cam_enable(dev, 1); /* always enable our own address */
+@@ -562,9 +657,14 @@ static void sonic_multicast_list(struct net_device *dev)
+ i++;
+ }
+ SONIC_WRITE(SONIC_CDC, 16);
+- /* issue Load CAM command */
+ SONIC_WRITE(SONIC_CDP, lp->cda_laddr & 0xffff);
++
++ /* LCAM and TXP commands can't be used simultaneously */
++ spin_lock_irqsave(&lp->lock, flags);
++ sonic_quiesce(dev, SONIC_CR_TXP);
+ SONIC_WRITE(SONIC_CMD, SONIC_CR_LCAM);
++ sonic_quiesce(dev, SONIC_CR_LCAM);
++ spin_unlock_irqrestore(&lp->lock, flags);
+ }
+ }
+
+@@ -579,7 +679,6 @@ static void sonic_multicast_list(struct net_device *dev)
+ */
+ static int sonic_init(struct net_device *dev)
+ {
+- unsigned int cmd;
+ struct sonic_local *lp = netdev_priv(dev);
+ int i;
+
+@@ -591,12 +690,16 @@ static int sonic_init(struct net_device *dev)
+ SONIC_WRITE(SONIC_ISR, 0x7fff);
+ SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
+
++ /* While in reset mode, clear CAM Enable register */
++ SONIC_WRITE(SONIC_CE, 0);
++
+ /*
+ * clear software reset flag, disable receiver, clear and
+ * enable interrupts, then completely initialize the SONIC
+ */
+ SONIC_WRITE(SONIC_CMD, 0);
+- SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS);
++ SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS | SONIC_CR_STP);
++ sonic_quiesce(dev, SONIC_CR_ALL);
+
+ /*
+ * initialize the receive resource area
+@@ -614,15 +717,10 @@ static int sonic_init(struct net_device *dev)
+ }
+
+ /* initialize all RRA registers */
+- lp->rra_end = (lp->rra_laddr + SONIC_NUM_RRS * SIZEOF_SONIC_RR *
+- SONIC_BUS_SCALE(lp->dma_bitmode)) & 0xffff;
+- lp->cur_rwp = (lp->rra_laddr + (SONIC_NUM_RRS - 1) * SIZEOF_SONIC_RR *
+- SONIC_BUS_SCALE(lp->dma_bitmode)) & 0xffff;
+-
+- SONIC_WRITE(SONIC_RSA, lp->rra_laddr & 0xffff);
+- SONIC_WRITE(SONIC_REA, lp->rra_end);
+- SONIC_WRITE(SONIC_RRP, lp->rra_laddr & 0xffff);
+- SONIC_WRITE(SONIC_RWP, lp->cur_rwp);
++ SONIC_WRITE(SONIC_RSA, sonic_rr_addr(dev, 0));
++ SONIC_WRITE(SONIC_REA, sonic_rr_addr(dev, SONIC_NUM_RRS));
++ SONIC_WRITE(SONIC_RRP, sonic_rr_addr(dev, 0));
++ SONIC_WRITE(SONIC_RWP, sonic_rr_addr(dev, SONIC_NUM_RRS - 1));
+ SONIC_WRITE(SONIC_URRA, lp->rra_laddr >> 16);
+ SONIC_WRITE(SONIC_EOBC, (SONIC_RBSIZE >> 1) - (lp->dma_bitmode ? 2 : 1));
+
+@@ -630,14 +728,7 @@ static int sonic_init(struct net_device *dev)
+ netif_dbg(lp, ifup, dev, "%s: issuing RRRA command\n", __func__);
+
+ SONIC_WRITE(SONIC_CMD, SONIC_CR_RRRA);
+- i = 0;
+- while (i++ < 100) {
+- if (SONIC_READ(SONIC_CMD) & SONIC_CR_RRRA)
+- break;
+- }
+-
+- netif_dbg(lp, ifup, dev, "%s: status=%x, i=%d\n", __func__,
+- SONIC_READ(SONIC_CMD), i);
++ sonic_quiesce(dev, SONIC_CR_RRRA);
+
+ /*
+ * Initialize the receive descriptors so that they
+@@ -712,28 +803,17 @@ static int sonic_init(struct net_device *dev)
+ * load the CAM
+ */
+ SONIC_WRITE(SONIC_CMD, SONIC_CR_LCAM);
+-
+- i = 0;
+- while (i++ < 100) {
+- if (SONIC_READ(SONIC_ISR) & SONIC_INT_LCD)
+- break;
+- }
+- netif_dbg(lp, ifup, dev, "%s: CMD=%x, ISR=%x, i=%d\n", __func__,
+- SONIC_READ(SONIC_CMD), SONIC_READ(SONIC_ISR), i);
++ sonic_quiesce(dev, SONIC_CR_LCAM);
+
+ /*
+ * enable receiver, disable loopback
+ * and enable all interrupts
+ */
+- SONIC_WRITE(SONIC_CMD, SONIC_CR_RXEN | SONIC_CR_STP);
+ SONIC_WRITE(SONIC_RCR, SONIC_RCR_DEFAULT);
+ SONIC_WRITE(SONIC_TCR, SONIC_TCR_DEFAULT);
+ SONIC_WRITE(SONIC_ISR, 0x7fff);
+ SONIC_WRITE(SONIC_IMR, SONIC_IMR_DEFAULT);
+-
+- cmd = SONIC_READ(SONIC_CMD);
+- if ((cmd & SONIC_CR_RXEN) == 0 || (cmd & SONIC_CR_STP) == 0)
+- printk(KERN_ERR "sonic_init: failed, status=%x\n", cmd);
++ SONIC_WRITE(SONIC_CMD, SONIC_CR_RXEN);
+
+ netif_dbg(lp, ifup, dev, "%s: new status=%x\n", __func__,
+ SONIC_READ(SONIC_CMD));
+diff --git a/drivers/net/ethernet/natsemi/sonic.h b/drivers/net/ethernet/natsemi/sonic.h
+index 2b27f7049acb..1df6d2f06cc4 100644
+--- a/drivers/net/ethernet/natsemi/sonic.h
++++ b/drivers/net/ethernet/natsemi/sonic.h
+@@ -110,6 +110,9 @@
+ #define SONIC_CR_TXP 0x0002
+ #define SONIC_CR_HTX 0x0001
+
++#define SONIC_CR_ALL (SONIC_CR_LCAM | SONIC_CR_RRRA | \
++ SONIC_CR_RXEN | SONIC_CR_TXP)
++
+ /*
+ * SONIC data configuration bits
+ */
+@@ -175,6 +178,7 @@
+ #define SONIC_TCR_NCRS 0x0100
+ #define SONIC_TCR_CRLS 0x0080
+ #define SONIC_TCR_EXC 0x0040
++#define SONIC_TCR_OWC 0x0020
+ #define SONIC_TCR_PMB 0x0008
+ #define SONIC_TCR_FU 0x0004
+ #define SONIC_TCR_BCM 0x0002
+@@ -274,8 +278,9 @@
+ #define SONIC_NUM_RDS SONIC_NUM_RRS /* number of receive descriptors */
+ #define SONIC_NUM_TDS 16 /* number of transmit descriptors */
+
+-#define SONIC_RDS_MASK (SONIC_NUM_RDS-1)
+-#define SONIC_TDS_MASK (SONIC_NUM_TDS-1)
++#define SONIC_RRS_MASK (SONIC_NUM_RRS - 1)
++#define SONIC_RDS_MASK (SONIC_NUM_RDS - 1)
++#define SONIC_TDS_MASK (SONIC_NUM_TDS - 1)
+
+ #define SONIC_RBSIZE 1520 /* size of one resource buffer */
+
+@@ -312,8 +317,6 @@ struct sonic_local {
+ u32 rda_laddr; /* logical DMA address of RDA */
+ dma_addr_t rx_laddr[SONIC_NUM_RRS]; /* logical DMA addresses of rx skbuffs */
+ dma_addr_t tx_laddr[SONIC_NUM_TDS]; /* logical DMA addresses of tx skbuffs */
+- unsigned int rra_end;
+- unsigned int cur_rwp;
+ unsigned int cur_rx;
+ unsigned int cur_tx; /* first unacked transmit packet */
+ unsigned int eol_rx;
+@@ -322,6 +325,7 @@ struct sonic_local {
+ int msg_enable;
+ struct device *device; /* generic device */
+ struct net_device_stats stats;
++ spinlock_t lock;
+ };
+
+ #define TX_TIMEOUT (3 * HZ)
+@@ -344,30 +348,30 @@ static void sonic_msg_init(struct net_device *dev);
+ as far as we can tell. */
+ /* OpenBSD calls this "SWO". I'd like to think that sonic_buf_put()
+ is a much better name. */
+-static inline void sonic_buf_put(void* base, int bitmode,
++static inline void sonic_buf_put(u16 *base, int bitmode,
+ int offset, __u16 val)
+ {
+ if (bitmode)
+ #ifdef __BIG_ENDIAN
+- ((__u16 *) base + (offset*2))[1] = val;
++ __raw_writew(val, base + (offset * 2) + 1);
+ #else
+- ((__u16 *) base + (offset*2))[0] = val;
++ __raw_writew(val, base + (offset * 2) + 0);
+ #endif
+ else
+- ((__u16 *) base)[offset] = val;
++ __raw_writew(val, base + (offset * 1) + 0);
+ }
+
+-static inline __u16 sonic_buf_get(void* base, int bitmode,
++static inline __u16 sonic_buf_get(u16 *base, int bitmode,
+ int offset)
+ {
+ if (bitmode)
+ #ifdef __BIG_ENDIAN
+- return ((volatile __u16 *) base + (offset*2))[1];
++ return __raw_readw(base + (offset * 2) + 1);
+ #else
+- return ((volatile __u16 *) base + (offset*2))[0];
++ return __raw_readw(base + (offset * 2) + 0);
+ #endif
+ else
+- return ((volatile __u16 *) base)[offset];
++ return __raw_readw(base + (offset * 1) + 0);
+ }
+
+ /* Inlines that you should actually use for reading/writing DMA buffers */
+@@ -447,6 +451,22 @@ static inline __u16 sonic_rra_get(struct net_device* dev, int entry,
+ (entry * SIZEOF_SONIC_RR) + offset);
+ }
+
++static inline u16 sonic_rr_addr(struct net_device *dev, int entry)
++{
++ struct sonic_local *lp = netdev_priv(dev);
++
++ return lp->rra_laddr +
++ entry * SIZEOF_SONIC_RR * SONIC_BUS_SCALE(lp->dma_bitmode);
++}
++
++static inline u16 sonic_rr_entry(struct net_device *dev, u16 addr)
++{
++ struct sonic_local *lp = netdev_priv(dev);
++
++ return (addr - (u16)lp->rra_laddr) / (SIZEOF_SONIC_RR *
++ SONIC_BUS_SCALE(lp->dma_bitmode));
++}
++
+ static const char version[] =
+ "sonic.c:v0.92 20.9.98 tsbogend@alpha.franken.de\n";
+
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index 6571cac6e786..ee086441dcbe 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -809,19 +809,21 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
+ return NULL;
+ }
+
+- if (sock->sk->sk_protocol != IPPROTO_UDP) {
++ sk = sock->sk;
++ if (sk->sk_protocol != IPPROTO_UDP ||
++ sk->sk_type != SOCK_DGRAM ||
++ (sk->sk_family != AF_INET && sk->sk_family != AF_INET6)) {
+ pr_debug("socket fd=%d not UDP\n", fd);
+ sk = ERR_PTR(-EINVAL);
+ goto out_sock;
+ }
+
+- lock_sock(sock->sk);
+- if (sock->sk->sk_user_data) {
++ lock_sock(sk);
++ if (sk->sk_user_data) {
+ sk = ERR_PTR(-EBUSY);
+ goto out_rel_sock;
+ }
+
+- sk = sock->sk;
+ sock_hold(sk);
+
+ tuncfg.sk_user_data = gtp;
+diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
+index 77207f936871..93f303ec17e2 100644
+--- a/drivers/net/slip/slip.c
++++ b/drivers/net/slip/slip.c
+@@ -452,9 +452,16 @@ static void slip_transmit(struct work_struct *work)
+ */
+ static void slip_write_wakeup(struct tty_struct *tty)
+ {
+- struct slip *sl = tty->disc_data;
++ struct slip *sl;
++
++ rcu_read_lock();
++ sl = rcu_dereference(tty->disc_data);
++ if (!sl)
++ goto out;
+
+ schedule_work(&sl->tx_work);
++out:
++ rcu_read_unlock();
+ }
+
+ static void sl_tx_timeout(struct net_device *dev)
+@@ -882,10 +889,11 @@ static void slip_close(struct tty_struct *tty)
+ return;
+
+ spin_lock_bh(&sl->lock);
+- tty->disc_data = NULL;
++ rcu_assign_pointer(tty->disc_data, NULL);
+ sl->tty = NULL;
+ spin_unlock_bh(&sl->lock);
+
++ synchronize_rcu();
+ flush_work(&sl->tx_work);
+
+ /* VSV = very important to remove timers */
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index bbd92221c6ca..09c444d3b496 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1900,6 +1900,10 @@ drop:
+ if (ret != XDP_PASS) {
+ rcu_read_unlock();
+ local_bh_enable();
++ if (frags) {
++ tfile->napi.skb = NULL;
++ mutex_unlock(&tfile->napi_mutex);
++ }
+ return total_len;
+ }
+ }
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 7d708aeb4576..92548887df2f 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -31,6 +31,7 @@
+ #include <linux/mdio.h>
+ #include <linux/phy.h>
+ #include <net/ip6_checksum.h>
++#include <net/vxlan.h>
+ #include <linux/interrupt.h>
+ #include <linux/irqdomain.h>
+ #include <linux/irq.h>
+@@ -3686,6 +3687,19 @@ static void lan78xx_tx_timeout(struct net_device *net)
+ tasklet_schedule(&dev->bh);
+ }
+
++static netdev_features_t lan78xx_features_check(struct sk_buff *skb,
++ struct net_device *netdev,
++ netdev_features_t features)
++{
++ if (skb->len + TX_OVERHEAD > MAX_SINGLE_PACKET_SIZE)
++ features &= ~NETIF_F_GSO_MASK;
++
++ features = vlan_features_check(skb, features);
++ features = vxlan_features_check(skb, features);
++
++ return features;
++}
++
+ static const struct net_device_ops lan78xx_netdev_ops = {
+ .ndo_open = lan78xx_open,
+ .ndo_stop = lan78xx_stop,
+@@ -3699,6 +3713,7 @@ static const struct net_device_ops lan78xx_netdev_ops = {
+ .ndo_set_features = lan78xx_set_features,
+ .ndo_vlan_rx_add_vid = lan78xx_vlan_rx_add_vid,
+ .ndo_vlan_rx_kill_vid = lan78xx_vlan_rx_kill_vid,
++ .ndo_features_check = lan78xx_features_check,
+ };
+
+ static void lan78xx_stat_monitor(struct timer_list *t)
+diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c
+index 57edfada0665..c9401c121a14 100644
+--- a/drivers/net/wireless/marvell/libertas/cfg.c
++++ b/drivers/net/wireless/marvell/libertas/cfg.c
+@@ -273,6 +273,10 @@ add_ie_rates(u8 *tlv, const u8 *ie, int *nrates)
+ int hw, ap, ap_max = ie[1];
+ u8 hw_rate;
+
++ if (ap_max > MAX_RATES) {
++ lbs_deb_assoc("invalid rates\n");
++ return tlv;
++ }
+ /* Advance past IE header */
+ ie += 2;
+
+@@ -1717,6 +1721,9 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
+ struct cmd_ds_802_11_ad_hoc_join cmd;
+ u8 preamble = RADIO_PREAMBLE_SHORT;
+ int ret = 0;
++ int hw, i;
++ u8 rates_max;
++ u8 *rates;
+
+ /* TODO: set preamble based on scan result */
+ ret = lbs_set_radio(priv, preamble, 1);
+@@ -1775,9 +1782,12 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
+ if (!rates_eid) {
+ lbs_add_rates(cmd.bss.rates);
+ } else {
+- int hw, i;
+- u8 rates_max = rates_eid[1];
+- u8 *rates = cmd.bss.rates;
++ rates_max = rates_eid[1];
++ if (rates_max > MAX_RATES) {
++ lbs_deb_join("invalid rates");
++ goto out;
++ }
++ rates = cmd.bss.rates;
+ for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
+ u8 hw_rate = lbs_rates[hw].bitrate / 5;
+ for (i = 0; i < rates_max; i++) {
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 20a57a48ae1e..36f8eb9f24a7 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4891,18 +4891,25 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0422, quirk_no_ext_tags);
+
+ #ifdef CONFIG_PCI_ATS
+ /*
+- * Some devices have a broken ATS implementation causing IOMMU stalls.
+- * Don't use ATS for those devices.
++ * Some devices require additional driver setup to enable ATS. Don't use
++ * ATS for those devices as ATS will be enabled before the driver has had a
++ * chance to load and configure the device.
+ */
+-static void quirk_no_ats(struct pci_dev *pdev)
++static void quirk_amd_harvest_no_ats(struct pci_dev *pdev)
+ {
+- pci_info(pdev, "disabling ATS (broken on this device)\n");
++ if (pdev->device == 0x7340 && pdev->revision != 0xc5)
++ return;
++
++ pci_info(pdev, "disabling ATS\n");
+ pdev->ats_cap = 0;
+ }
+
+ /* AMD Stoney platform GPU */
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_no_ats);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_no_ats);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_amd_harvest_no_ats);
++/* AMD Iceland dGPU */
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_amd_harvest_no_ats);
++/* AMD Navi14 dGPU */
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7340, quirk_amd_harvest_no_ats);
+ #endif /* CONFIG_PCI_ATS */
+
+ /* Freescale PCIe doesn't support MSI in RC mode */
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 4d0fc6b01fa0..4c4781e5974f 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -37,6 +37,8 @@
+
+ #define ISCSI_TRANSPORT_VERSION "2.0-870"
+
++#define ISCSI_SEND_MAX_ALLOWED 10
++
+ static int dbg_session;
+ module_param_named(debug_session, dbg_session, int,
+ S_IRUGO | S_IWUSR);
+@@ -3680,6 +3682,7 @@ iscsi_if_rx(struct sk_buff *skb)
+ struct nlmsghdr *nlh;
+ struct iscsi_uevent *ev;
+ uint32_t group;
++ int retries = ISCSI_SEND_MAX_ALLOWED;
+
+ nlh = nlmsg_hdr(skb);
+ if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) ||
+@@ -3710,6 +3713,10 @@ iscsi_if_rx(struct sk_buff *skb)
+ break;
+ err = iscsi_if_send_reply(portid, nlh->nlmsg_type,
+ ev, sizeof(*ev));
++ if (err == -EAGAIN && --retries < 0) {
++ printk(KERN_WARNING "Send reply failed, error %d\n", err);
++ break;
++ }
+ } while (err < 0 && err != -ECONNREFUSED && err != -ESRCH);
+ skb_pull(skb, rlen);
+ }
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 7d868d37ab5f..345b18d52ec6 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1969,9 +1969,13 @@ static int sd_done(struct scsi_cmnd *SCpnt)
+ }
+ break;
+ case REQ_OP_ZONE_REPORT:
++ /* To avoid that the block layer performs an incorrect
++ * bio_advance() call and restart of the remainder of
++ * incomplete report zone BIOs, always indicate a full
++ * completion of REQ_OP_ZONE_REPORT.
++ */
+ if (!result) {
+- good_bytes = scsi_bufflen(SCpnt)
+- - scsi_get_resid(SCpnt);
++ good_bytes = scsi_bufflen(SCpnt);
+ scsi_set_resid(SCpnt, 0);
+ } else {
+ good_bytes = 0;
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 317d0f3f7a14..14bd54d0e79d 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4123,9 +4123,6 @@ int iscsit_close_connection(
+ iscsit_stop_nopin_response_timer(conn);
+ iscsit_stop_nopin_timer(conn);
+
+- if (conn->conn_transport->iscsit_wait_conn)
+- conn->conn_transport->iscsit_wait_conn(conn);
+-
+ /*
+ * During Connection recovery drop unacknowledged out of order
+ * commands for this connection, and prepare the other commands
+@@ -4211,6 +4208,9 @@ int iscsit_close_connection(
+ target_sess_cmd_list_set_waiting(sess->se_sess);
+ target_wait_for_sess_cmds(sess->se_sess);
+
++ if (conn->conn_transport->iscsit_wait_conn)
++ conn->conn_transport->iscsit_wait_conn(conn);
++
+ ahash_request_free(conn->conn_tx_hash);
+ if (conn->conn_rx_hash) {
+ struct crypto_ahash *tfm;
+diff --git a/fs/afs/cell.c b/fs/afs/cell.c
+index ee07162d35c7..cce0e23b2454 100644
+--- a/fs/afs/cell.c
++++ b/fs/afs/cell.c
+@@ -135,8 +135,17 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net,
+ _leave(" = -ENAMETOOLONG");
+ return ERR_PTR(-ENAMETOOLONG);
+ }
+- if (namelen == 5 && memcmp(name, "@cell", 5) == 0)
++
++ /* Prohibit cell names that contain unprintable chars, '/' and '@' or
++ * that begin with a dot. This also precludes "@cell".
++ */
++ if (name[0] == '.')
+ return ERR_PTR(-EINVAL);
++ for (i = 0; i < namelen; i++) {
++ char ch = name[i];
++ if (!isprint(ch) || ch == '/' || ch == '@')
++ return ERR_PTR(-EINVAL);
++ }
+
+ _enter("%*.*s,%s", namelen, namelen, name, vllist);
+
+diff --git a/fs/namei.c b/fs/namei.c
+index 914178cdbe94..2aad8042a05b 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1009,7 +1009,8 @@ static int may_linkat(struct path *link)
+ * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
+ * should be allowed, or not, on files that already
+ * exist.
+- * @dir: the sticky parent directory
++ * @dir_mode: mode bits of directory
++ * @dir_uid: owner of directory
+ * @inode: the inode of the file to open
+ *
+ * Block an O_CREAT open of a FIFO (or a regular file) when:
+@@ -1025,18 +1026,18 @@ static int may_linkat(struct path *link)
+ *
+ * Returns 0 if the open is allowed, -ve on error.
+ */
+-static int may_create_in_sticky(struct dentry * const dir,
++static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid,
+ struct inode * const inode)
+ {
+ if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
+ (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
+- likely(!(dir->d_inode->i_mode & S_ISVTX)) ||
+- uid_eq(inode->i_uid, dir->d_inode->i_uid) ||
++ likely(!(dir_mode & S_ISVTX)) ||
++ uid_eq(inode->i_uid, dir_uid) ||
+ uid_eq(current_fsuid(), inode->i_uid))
+ return 0;
+
+- if (likely(dir->d_inode->i_mode & 0002) ||
+- (dir->d_inode->i_mode & 0020 &&
++ if (likely(dir_mode & 0002) ||
++ (dir_mode & 0020 &&
+ ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
+ (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
+ return -EACCES;
+@@ -3258,6 +3259,8 @@ static int do_last(struct nameidata *nd,
+ struct file *file, const struct open_flags *op)
+ {
+ struct dentry *dir = nd->path.dentry;
++ kuid_t dir_uid = dir->d_inode->i_uid;
++ umode_t dir_mode = dir->d_inode->i_mode;
+ int open_flag = op->open_flag;
+ bool will_truncate = (open_flag & O_TRUNC) != 0;
+ bool got_write = false;
+@@ -3393,7 +3396,7 @@ finish_open:
+ error = -EISDIR;
+ if (d_is_dir(nd->path.dentry))
+ goto out;
+- error = may_create_in_sticky(dir,
++ error = may_create_in_sticky(dir_mode, dir_uid,
+ d_backing_inode(nd->path.dentry));
+ if (unlikely(error))
+ goto out;
+diff --git a/include/linux/memory.h b/include/linux/memory.h
+index a6ddefc60517..5c411365cdbe 100644
+--- a/include/linux/memory.h
++++ b/include/linux/memory.h
+@@ -111,16 +111,16 @@ extern int register_memory_notifier(struct notifier_block *nb);
+ extern void unregister_memory_notifier(struct notifier_block *nb);
+ extern int register_memory_isolate_notifier(struct notifier_block *nb);
+ extern void unregister_memory_isolate_notifier(struct notifier_block *nb);
+-int hotplug_memory_register(int nid, struct mem_section *section);
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+-extern int unregister_memory_section(struct mem_section *);
+-#endif
++int create_memory_block_devices(unsigned long start, unsigned long size);
++void remove_memory_block_devices(unsigned long start, unsigned long size);
+ extern int memory_dev_init(void);
+ extern int memory_notify(unsigned long val, void *v);
+ extern int memory_isolate_notify(unsigned long val, void *v);
+ extern struct memory_block *find_memory_block_hinted(struct mem_section *,
+ struct memory_block *);
+ extern struct memory_block *find_memory_block(struct mem_section *);
++typedef int (*walk_memory_blocks_func_t)(struct memory_block *, void *);
++extern int for_each_memory_block(void *arg, walk_memory_blocks_func_t func);
+ #define CONFIG_MEM_BLOCK_SIZE (PAGES_PER_SECTION<<PAGE_SHIFT)
+ #endif /* CONFIG_MEMORY_HOTPLUG_SPARSE */
+
+diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
+index 4915e6cd7fd5..d17d45c41a0b 100644
+--- a/include/linux/memory_hotplug.h
++++ b/include/linux/memory_hotplug.h
+@@ -108,12 +108,10 @@ static inline bool movable_node_is_enabled(void)
+ return movable_node_enabled;
+ }
+
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+-extern int arch_remove_memory(u64 start, u64 size,
+- struct vmem_altmap *altmap);
+-extern int __remove_pages(struct zone *zone, unsigned long start_pfn,
+- unsigned long nr_pages, struct vmem_altmap *altmap);
+-#endif /* CONFIG_MEMORY_HOTREMOVE */
++extern void arch_remove_memory(int nid, u64 start, u64 size,
++ struct vmem_altmap *altmap);
++extern void __remove_pages(unsigned long start_pfn, unsigned long nr_pages,
++ struct vmem_altmap *altmap);
+
+ /* reasonably generic interface to expand the physical pages */
+ extern int __add_pages(int nid, unsigned long start_pfn, unsigned long nr_pages,
+@@ -303,6 +301,7 @@ extern bool is_mem_section_removable(unsigned long pfn, unsigned long nr_pages);
+ extern void try_offline_node(int nid);
+ extern int offline_pages(unsigned long start_pfn, unsigned long nr_pages);
+ extern void remove_memory(int nid, u64 start, u64 size);
++extern void __remove_memory(int nid, u64 start, u64 size);
+
+ #else
+ static inline bool is_mem_section_removable(unsigned long pfn,
+@@ -319,6 +318,7 @@ static inline int offline_pages(unsigned long start_pfn, unsigned long nr_pages)
+ }
+
+ static inline void remove_memory(int nid, u64 start, u64 size) {}
++static inline void __remove_memory(int nid, u64 start, u64 size) {}
+ #endif /* CONFIG_MEMORY_HOTREMOVE */
+
+ extern void __ref free_area_init_core_hotplug(int nid);
+@@ -331,12 +331,14 @@ extern int arch_add_memory(int nid, u64 start, u64 size,
+ struct vmem_altmap *altmap, bool want_memblock);
+ extern void move_pfn_range_to_zone(struct zone *zone, unsigned long start_pfn,
+ unsigned long nr_pages, struct vmem_altmap *altmap);
++extern void remove_pfn_range_from_zone(struct zone *zone,
++ unsigned long start_pfn,
++ unsigned long nr_pages);
+ extern int offline_pages(unsigned long start_pfn, unsigned long nr_pages);
+ extern bool is_memblock_offlined(struct memory_block *mem);
+-extern void remove_memory(int nid, u64 start, u64 size);
+-extern int sparse_add_one_section(struct pglist_data *pgdat,
+- unsigned long start_pfn, struct vmem_altmap *altmap);
+-extern void sparse_remove_one_section(struct zone *zone, struct mem_section *ms,
++extern int sparse_add_one_section(int nid, unsigned long start_pfn,
++ struct vmem_altmap *altmap);
++extern void sparse_remove_one_section(struct mem_section *ms,
+ unsigned long map_offset, struct vmem_altmap *altmap);
+ extern struct page *sparse_decode_mem_map(unsigned long coded_mem_map,
+ unsigned long pnum);
+diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
+index d4b0c79d2924..d6791e2df30a 100644
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -637,8 +637,7 @@ typedef struct pglist_data {
+ #if defined(CONFIG_MEMORY_HOTPLUG) || defined(CONFIG_DEFERRED_STRUCT_PAGE_INIT)
+ /*
+ * Must be held any time you expect node_start_pfn, node_present_pages
+- * or node_spanned_pages stay constant. Holding this will also
+- * guarantee that any pfn_valid() stays that way.
++ * or node_spanned_pages stay constant.
+ *
+ * pgdat_resize_lock() and pgdat_resize_unlock() are provided to
+ * manipulate node_size_lock without checking for CONFIG_MEMORY_HOTPLUG
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index d5527e3828d1..84bbdcbb199a 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3579,6 +3579,8 @@ int dev_set_alias(struct net_device *, const char *, size_t);
+ int dev_get_alias(const struct net_device *, char *, size_t);
+ int dev_change_net_namespace(struct net_device *, struct net *, const char *);
+ int __dev_set_mtu(struct net_device *, int);
++int dev_validate_mtu(struct net_device *dev, int mtu,
++ struct netlink_ext_ack *extack);
+ int dev_set_mtu_ext(struct net_device *dev, int mtu,
+ struct netlink_ext_ack *extack);
+ int dev_set_mtu(struct net_device *, int);
+diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h
+index 1d100efe74ec..7e39049d2ce6 100644
+--- a/include/linux/netfilter/ipset/ip_set.h
++++ b/include/linux/netfilter/ipset/ip_set.h
+@@ -451,13 +451,6 @@ ip6addrptr(const struct sk_buff *skb, bool src, struct in6_addr *addr)
+ sizeof(*addr));
+ }
+
+-/* Calculate the bytes required to store the inclusive range of a-b */
+-static inline int
+-bitmap_bytes(u32 a, u32 b)
+-{
+- return 4 * ((((b - a + 8) / 8) + 3) / 4);
+-}
+-
+ #include <linux/netfilter/ipset/ip_set_timeout.h>
+ #include <linux/netfilter/ipset/ip_set_comment.h>
+ #include <linux/netfilter/ipset/ip_set_counter.h>
+diff --git a/include/linux/node.h b/include/linux/node.h
+index 257bb3d6d014..708939bae9aa 100644
+--- a/include/linux/node.h
++++ b/include/linux/node.h
+@@ -72,8 +72,7 @@ extern int register_cpu_under_node(unsigned int cpu, unsigned int nid);
+ extern int unregister_cpu_under_node(unsigned int cpu, unsigned int nid);
+ extern int register_mem_sect_under_node(struct memory_block *mem_blk,
+ void *arg);
+-extern int unregister_mem_sect_under_nodes(struct memory_block *mem_blk,
+- unsigned long phys_index);
++extern void unregister_memory_block_under_nodes(struct memory_block *mem_blk);
+
+ #ifdef CONFIG_HUGETLBFS
+ extern void register_hugetlbfs_with_node(node_registration_func_t doregister,
+@@ -105,10 +104,8 @@ static inline int register_mem_sect_under_node(struct memory_block *mem_blk,
+ {
+ return 0;
+ }
+-static inline int unregister_mem_sect_under_nodes(struct memory_block *mem_blk,
+- unsigned long phys_index)
++static inline void unregister_memory_block_under_nodes(struct memory_block *mem_blk)
+ {
+- return 0;
+ }
+
+ static inline void register_hugetlbfs_with_node(node_registration_func_t reg,
+diff --git a/include/trace/events/xen.h b/include/trace/events/xen.h
+index fdcf88bcf0ea..bb76c03898cc 100644
+--- a/include/trace/events/xen.h
++++ b/include/trace/events/xen.h
+@@ -66,7 +66,11 @@ TRACE_EVENT(xen_mc_callback,
+ TP_PROTO(xen_mc_callback_fn_t fn, void *data),
+ TP_ARGS(fn, data),
+ TP_STRUCT__entry(
+- __field(xen_mc_callback_fn_t, fn)
++ /*
++ * Use field_struct to avoid is_signed_type()
++ * comparison of a function pointer.
++ */
++ __field_struct(xen_mc_callback_fn_t, fn)
+ __field(void *, data)
+ ),
+ TP_fast_assign(
+diff --git a/kernel/memremap.c b/kernel/memremap.c
+index 7c5fb8a208ac..331baad8efec 100644
+--- a/kernel/memremap.c
++++ b/kernel/memremap.c
+@@ -120,7 +120,9 @@ static void devm_memremap_pages_release(void *data)
+ struct device *dev = pgmap->dev;
+ struct resource *res = &pgmap->res;
+ resource_size_t align_start, align_size;
++ struct page *first_page;
+ unsigned long pfn;
++ int nid;
+
+ pgmap->kill(pgmap->ref);
+ for_each_device_pfn(pfn, pgmap)
+@@ -131,13 +133,17 @@ static void devm_memremap_pages_release(void *data)
+ align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
+ - align_start;
+
++ /* make sure to access a memmap that was actually initialized */
++ first_page = pfn_to_page(pfn_first(pgmap));
++
++ nid = page_to_nid(first_page);
++
+ mem_hotplug_begin();
+ if (pgmap->type == MEMORY_DEVICE_PRIVATE) {
+ pfn = align_start >> PAGE_SHIFT;
+- __remove_pages(page_zone(pfn_to_page(pfn)), pfn,
+- align_size >> PAGE_SHIFT, NULL);
++ __remove_pages(pfn, align_size >> PAGE_SHIFT, NULL);
+ } else {
+- arch_remove_memory(align_start, align_size,
++ arch_remove_memory(nid, align_start, align_size,
+ pgmap->altmap_valid ? &pgmap->altmap : NULL);
+ kasan_remove_zero_shadow(__va(align_start), align_size);
+ }
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 0fb92d0c7b20..dbd3c97d1501 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -49,6 +49,7 @@ struct hist_field {
+ struct ftrace_event_field *field;
+ unsigned long flags;
+ hist_field_fn_t fn;
++ unsigned int ref;
+ unsigned int size;
+ unsigned int offset;
+ unsigned int is_signed;
+@@ -1274,6 +1275,17 @@ static u64 hist_field_cpu(struct hist_field *hist_field,
+ return cpu;
+ }
+
++/**
++ * check_field_for_var_ref - Check if a VAR_REF field references a variable
++ * @hist_field: The VAR_REF field to check
++ * @var_data: The hist trigger that owns the variable
++ * @var_idx: The trigger variable identifier
++ *
++ * Check the given VAR_REF field to see whether or not it references
++ * the given variable associated with the given trigger.
++ *
++ * Return: The VAR_REF field if it does reference the variable, NULL if not
++ */
+ static struct hist_field *
+ check_field_for_var_ref(struct hist_field *hist_field,
+ struct hist_trigger_data *var_data,
+@@ -1324,6 +1336,18 @@ check_field_for_var_refs(struct hist_trigger_data *hist_data,
+ return found;
+ }
+
++/**
++ * find_var_ref - Check if a trigger has a reference to a trigger variable
++ * @hist_data: The hist trigger that might have a reference to the variable
++ * @var_data: The hist trigger that owns the variable
++ * @var_idx: The trigger variable identifier
++ *
++ * Check the list of var_refs[] on the first hist trigger to see
++ * whether any of them are references to the variable on the second
++ * trigger.
++ *
++ * Return: The VAR_REF field referencing the variable if so, NULL if not
++ */
+ static struct hist_field *find_var_ref(struct hist_trigger_data *hist_data,
+ struct hist_trigger_data *var_data,
+ unsigned int var_idx)
+@@ -1350,6 +1374,20 @@ static struct hist_field *find_var_ref(struct hist_trigger_data *hist_data,
+ return found;
+ }
+
++/**
++ * find_any_var_ref - Check if there is a reference to a given trigger variable
++ * @hist_data: The hist trigger
++ * @var_idx: The trigger variable identifier
++ *
++ * Check to see whether the given variable is currently referenced by
++ * any other trigger.
++ *
++ * The trigger the variable is defined on is explicitly excluded - the
++ * assumption being that a self-reference doesn't prevent a trigger
++ * from being removed.
++ *
++ * Return: The VAR_REF field referencing the variable if so, NULL if not
++ */
+ static struct hist_field *find_any_var_ref(struct hist_trigger_data *hist_data,
+ unsigned int var_idx)
+ {
+@@ -1368,6 +1406,19 @@ static struct hist_field *find_any_var_ref(struct hist_trigger_data *hist_data,
+ return found;
+ }
+
++/**
++ * check_var_refs - Check if there is a reference to any of trigger's variables
++ * @hist_data: The hist trigger
++ *
++ * A trigger can define one or more variables. If any one of them is
++ * currently referenced by any other trigger, this function will
++ * determine that.
++
++ * Typically used to determine whether or not a trigger can be removed
++ * - if there are any references to a trigger's variables, it cannot.
++ *
++ * Return: True if there is a reference to any of trigger's variables
++ */
+ static bool check_var_refs(struct hist_trigger_data *hist_data)
+ {
+ struct hist_field *field;
+@@ -1511,11 +1562,13 @@ static struct hist_field *find_var(struct hist_trigger_data *hist_data,
+ struct event_trigger_data *test;
+ struct hist_field *hist_field;
+
++ lockdep_assert_held(&event_mutex);
++
+ hist_field = find_var_field(hist_data, var_name);
+ if (hist_field)
+ return hist_field;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ test_data = test->private_data;
+ hist_field = find_var_field(test_data, var_name);
+@@ -1565,7 +1618,9 @@ static struct hist_field *find_file_var(struct trace_event_file *file,
+ struct event_trigger_data *test;
+ struct hist_field *hist_field;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ test_data = test->private_data;
+ hist_field = find_var_field(test_data, var_name);
+@@ -2171,6 +2226,23 @@ static int contains_operator(char *str)
+ return field_op;
+ }
+
++static void get_hist_field(struct hist_field *hist_field)
++{
++ hist_field->ref++;
++}
++
++static void __destroy_hist_field(struct hist_field *hist_field)
++{
++ if (--hist_field->ref > 1)
++ return;
++
++ kfree(hist_field->var.name);
++ kfree(hist_field->name);
++ kfree(hist_field->type);
++
++ kfree(hist_field);
++}
++
+ static void destroy_hist_field(struct hist_field *hist_field,
+ unsigned int level)
+ {
+@@ -2182,14 +2254,13 @@ static void destroy_hist_field(struct hist_field *hist_field,
+ if (!hist_field)
+ return;
+
++ if (hist_field->flags & HIST_FIELD_FL_VAR_REF)
++ return; /* var refs will be destroyed separately */
++
+ for (i = 0; i < HIST_FIELD_OPERANDS_MAX; i++)
+ destroy_hist_field(hist_field->operands[i], level + 1);
+
+- kfree(hist_field->var.name);
+- kfree(hist_field->name);
+- kfree(hist_field->type);
+-
+- kfree(hist_field);
++ __destroy_hist_field(hist_field);
+ }
+
+ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data,
+@@ -2206,6 +2277,8 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data,
+ if (!hist_field)
+ return NULL;
+
++ hist_field->ref = 1;
++
+ hist_field->hist_data = hist_data;
+
+ if (flags & HIST_FIELD_FL_EXPR || flags & HIST_FIELD_FL_ALIAS)
+@@ -2316,6 +2389,12 @@ static void destroy_hist_fields(struct hist_trigger_data *hist_data)
+ hist_data->fields[i] = NULL;
+ }
+ }
++
++ for (i = 0; i < hist_data->n_var_refs; i++) {
++ WARN_ON(!(hist_data->var_refs[i]->flags & HIST_FIELD_FL_VAR_REF));
++ __destroy_hist_field(hist_data->var_refs[i]);
++ hist_data->var_refs[i] = NULL;
++ }
+ }
+
+ static int init_var_ref(struct hist_field *ref_field,
+@@ -2374,11 +2453,38 @@ static int init_var_ref(struct hist_field *ref_field,
+ goto out;
+ }
+
+-static struct hist_field *create_var_ref(struct hist_field *var_field,
++/**
++ * create_var_ref - Create a variable reference and attach it to trigger
++ * @hist_data: The trigger that will be referencing the variable
++ * @var_field: The VAR field to create a reference to
++ * @system: The optional system string
++ * @event_name: The optional event_name string
++ *
++ * Given a variable hist_field, create a VAR_REF hist_field that
++ * represents a reference to it.
++ *
++ * This function also adds the reference to the trigger that
++ * now references the variable.
++ *
++ * Return: The VAR_REF field if successful, NULL if not
++ */
++static struct hist_field *create_var_ref(struct hist_trigger_data *hist_data,
++ struct hist_field *var_field,
+ char *system, char *event_name)
+ {
+ unsigned long flags = HIST_FIELD_FL_VAR_REF;
+ struct hist_field *ref_field;
++ int i;
++
++ /* Check if the variable already exists */
++ for (i = 0; i < hist_data->n_var_refs; i++) {
++ ref_field = hist_data->var_refs[i];
++ if (ref_field->var.idx == var_field->var.idx &&
++ ref_field->var.hist_data == var_field->hist_data) {
++ get_hist_field(ref_field);
++ return ref_field;
++ }
++ }
+
+ ref_field = create_hist_field(var_field->hist_data, NULL, flags, NULL);
+ if (ref_field) {
+@@ -2386,6 +2492,9 @@ static struct hist_field *create_var_ref(struct hist_field *var_field,
+ destroy_hist_field(ref_field, 0);
+ return NULL;
+ }
++
++ hist_data->var_refs[hist_data->n_var_refs] = ref_field;
++ ref_field->var_ref_idx = hist_data->n_var_refs++;
+ }
+
+ return ref_field;
+@@ -2459,7 +2568,8 @@ static struct hist_field *parse_var_ref(struct hist_trigger_data *hist_data,
+
+ var_field = find_event_var(hist_data, system, event_name, var_name);
+ if (var_field)
+- ref_field = create_var_ref(var_field, system, event_name);
++ ref_field = create_var_ref(hist_data, var_field,
++ system, event_name);
+
+ if (!ref_field)
+ hist_err_event("Couldn't find variable: $",
+@@ -2579,8 +2689,6 @@ static struct hist_field *parse_atom(struct hist_trigger_data *hist_data,
+ if (!s) {
+ hist_field = parse_var_ref(hist_data, ref_system, ref_event, ref_var);
+ if (hist_field) {
+- hist_data->var_refs[hist_data->n_var_refs] = hist_field;
+- hist_field->var_ref_idx = hist_data->n_var_refs++;
+ if (var_name) {
+ hist_field = create_alias(hist_data, hist_field, var_name);
+ if (!hist_field) {
+@@ -2828,7 +2936,9 @@ static char *find_trigger_filter(struct hist_trigger_data *hist_data,
+ {
+ struct event_trigger_data *test;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ if (test->private_data == hist_data)
+ return test->filter_str;
+@@ -2879,9 +2989,11 @@ find_compatible_hist(struct hist_trigger_data *target_hist_data,
+ struct event_trigger_data *test;
+ unsigned int n_keys;
+
++ lockdep_assert_held(&event_mutex);
++
+ n_keys = target_hist_data->n_fields - target_hist_data->n_vals;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ hist_data = test->private_data;
+
+@@ -3354,7 +3466,6 @@ static int onmax_create(struct hist_trigger_data *hist_data,
+ unsigned int var_ref_idx = hist_data->n_var_refs;
+ struct field_var *field_var;
+ char *onmax_var_str, *param;
+- unsigned long flags;
+ unsigned int i;
+ int ret = 0;
+
+@@ -3371,18 +3482,10 @@ static int onmax_create(struct hist_trigger_data *hist_data,
+ return -EINVAL;
+ }
+
+- flags = HIST_FIELD_FL_VAR_REF;
+- ref_field = create_hist_field(hist_data, NULL, flags, NULL);
++ ref_field = create_var_ref(hist_data, var_field, NULL, NULL);
+ if (!ref_field)
+ return -ENOMEM;
+
+- if (init_var_ref(ref_field, var_field, NULL, NULL)) {
+- destroy_hist_field(ref_field, 0);
+- ret = -ENOMEM;
+- goto out;
+- }
+- hist_data->var_refs[hist_data->n_var_refs] = ref_field;
+- ref_field->var_ref_idx = hist_data->n_var_refs++;
+ data->onmax.var = ref_field;
+
+ data->fn = onmax_save;
+@@ -3573,9 +3676,6 @@ static void save_synth_var_ref(struct hist_trigger_data *hist_data,
+ struct hist_field *var_ref)
+ {
+ hist_data->synth_var_refs[hist_data->n_synth_var_refs++] = var_ref;
+-
+- hist_data->var_refs[hist_data->n_var_refs] = var_ref;
+- var_ref->var_ref_idx = hist_data->n_var_refs++;
+ }
+
+ static int check_synth_field(struct synth_event *event,
+@@ -3730,7 +3830,8 @@ static int onmatch_create(struct hist_trigger_data *hist_data,
+ }
+
+ if (check_synth_field(event, hist_field, field_pos) == 0) {
+- var_ref = create_var_ref(hist_field, system, event_name);
++ var_ref = create_var_ref(hist_data, hist_field,
++ system, event_name);
+ if (!var_ref) {
+ kfree(p);
+ ret = -ENOMEM;
+@@ -4905,7 +5006,7 @@ static int hist_show(struct seq_file *m, void *v)
+ goto out_unlock;
+ }
+
+- list_for_each_entry_rcu(data, &event_file->triggers, list) {
++ list_for_each_entry(data, &event_file->triggers, list) {
+ if (data->cmd_ops->trigger_type == ETT_EVENT_HIST)
+ hist_trigger_show(m, data, n++);
+ }
+@@ -5296,7 +5397,9 @@ static int hist_register_trigger(char *glob, struct event_trigger_ops *ops,
+ if (hist_data->attrs->name && !named_data)
+ goto new;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ if (!hist_trigger_match(data, test, named_data, false))
+ continue;
+@@ -5380,10 +5483,12 @@ static bool have_hist_trigger_match(struct event_trigger_data *data,
+ struct event_trigger_data *test, *named_data = NULL;
+ bool match = false;
+
++ lockdep_assert_held(&event_mutex);
++
+ if (hist_data->attrs->name)
+ named_data = find_named_trigger(hist_data->attrs->name);
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ if (hist_trigger_match(data, test, named_data, false)) {
+ match = true;
+@@ -5401,10 +5506,12 @@ static bool hist_trigger_check_refs(struct event_trigger_data *data,
+ struct hist_trigger_data *hist_data = data->private_data;
+ struct event_trigger_data *test, *named_data = NULL;
+
++ lockdep_assert_held(&event_mutex);
++
+ if (hist_data->attrs->name)
+ named_data = find_named_trigger(hist_data->attrs->name);
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ if (!hist_trigger_match(data, test, named_data, false))
+ continue;
+@@ -5426,10 +5533,12 @@ static void hist_unregister_trigger(char *glob, struct event_trigger_ops *ops,
+ struct event_trigger_data *test, *named_data = NULL;
+ bool unregistered = false;
+
++ lockdep_assert_held(&event_mutex);
++
+ if (hist_data->attrs->name)
+ named_data = find_named_trigger(hist_data->attrs->name);
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ if (!hist_trigger_match(data, test, named_data, false))
+ continue;
+@@ -5455,7 +5564,9 @@ static bool hist_file_check_refs(struct trace_event_file *file)
+ struct hist_trigger_data *hist_data;
+ struct event_trigger_data *test;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
+ hist_data = test->private_data;
+ if (check_var_refs(hist_data))
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index cd12ecb66eb9..b05d1b6a6291 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -495,7 +495,9 @@ void update_cond_flag(struct trace_event_file *file)
+ struct event_trigger_data *data;
+ bool set_cond = false;
+
+- list_for_each_entry_rcu(data, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(data, &file->triggers, list) {
+ if (data->filter || event_command_post_trigger(data->cmd_ops) ||
+ event_command_needs_rec(data->cmd_ops)) {
+ set_cond = true;
+@@ -530,7 +532,9 @@ static int register_trigger(char *glob, struct event_trigger_ops *ops,
+ struct event_trigger_data *test;
+ int ret = 0;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ if (test->cmd_ops->trigger_type == data->cmd_ops->trigger_type) {
+ ret = -EEXIST;
+ goto out;
+@@ -575,7 +579,9 @@ static void unregister_trigger(char *glob, struct event_trigger_ops *ops,
+ struct event_trigger_data *data;
+ bool unregistered = false;
+
+- list_for_each_entry_rcu(data, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(data, &file->triggers, list) {
+ if (data->cmd_ops->trigger_type == test->cmd_ops->trigger_type) {
+ unregistered = true;
+ list_del_rcu(&data->list);
+@@ -1490,7 +1496,9 @@ int event_enable_register_trigger(char *glob,
+ struct event_trigger_data *test;
+ int ret = 0;
+
+- list_for_each_entry_rcu(test, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(test, &file->triggers, list) {
+ test_enable_data = test->private_data;
+ if (test_enable_data &&
+ (test->cmd_ops->trigger_type ==
+@@ -1530,7 +1538,9 @@ void event_enable_unregister_trigger(char *glob,
+ struct event_trigger_data *data;
+ bool unregistered = false;
+
+- list_for_each_entry_rcu(data, &file->triggers, list) {
++ lockdep_assert_held(&event_mutex);
++
++ list_for_each_entry(data, &file->triggers, list) {
+ enable_data = data->private_data;
+ if (enable_data &&
+ (data->cmd_ops->trigger_type ==
+diff --git a/mm/hmm.c b/mm/hmm.c
+index 57f0d2a4ff34..c482c07bbab7 100644
+--- a/mm/hmm.c
++++ b/mm/hmm.c
+@@ -997,21 +997,21 @@ static void hmm_devmem_release(void *data)
+ struct hmm_devmem *devmem = data;
+ struct resource *resource = devmem->resource;
+ unsigned long start_pfn, npages;
+- struct zone *zone;
+ struct page *page;
++ int nid;
+
+ /* pages are dead and unused, undo the arch mapping */
+ start_pfn = (resource->start & ~(PA_SECTION_SIZE - 1)) >> PAGE_SHIFT;
+ npages = ALIGN(resource_size(resource), PA_SECTION_SIZE) >> PAGE_SHIFT;
+
+ page = pfn_to_page(start_pfn);
+- zone = page_zone(page);
++ nid = page_to_nid(page);
+
+ mem_hotplug_begin();
+ if (resource->desc == IORES_DESC_DEVICE_PRIVATE_MEMORY)
+- __remove_pages(zone, start_pfn, npages, NULL);
++ __remove_pages(start_pfn, npages, NULL);
+ else
+- arch_remove_memory(start_pfn << PAGE_SHIFT,
++ arch_remove_memory(nid, start_pfn << PAGE_SHIFT,
+ npages << PAGE_SHIFT, NULL);
+ mem_hotplug_done();
+
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 413f6709039a..abc10dcbc9d5 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -255,14 +255,8 @@ static int __meminit __add_section(int nid, unsigned long phys_start_pfn,
+ if (pfn_valid(phys_start_pfn))
+ return -EEXIST;
+
+- ret = sparse_add_one_section(NODE_DATA(nid), phys_start_pfn, altmap);
+- if (ret < 0)
+- return ret;
+-
+- if (!want_memblock)
+- return 0;
+-
+- return hotplug_memory_register(nid, __pfn_to_section(phys_start_pfn));
++ ret = sparse_add_one_section(nid, phys_start_pfn, altmap);
++ return ret < 0 ? ret : 0;
+ }
+
+ /*
+@@ -315,7 +309,6 @@ out:
+ return err;
+ }
+
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+ /* find the smallest valid pfn in the range [start_pfn, end_pfn) */
+ static unsigned long find_smallest_section_pfn(int nid, struct zone *zone,
+ unsigned long start_pfn,
+@@ -456,10 +449,11 @@ static void update_pgdat_span(struct pglist_data *pgdat)
+ pgdat->node_spanned_pages = node_end_pfn - node_start_pfn;
+ }
+
+-static void __remove_zone(struct zone *zone, unsigned long start_pfn)
++void __ref remove_pfn_range_from_zone(struct zone *zone,
++ unsigned long start_pfn,
++ unsigned long nr_pages)
+ {
+ struct pglist_data *pgdat = zone->zone_pgdat;
+- int nr_pages = PAGES_PER_SECTION;
+ unsigned long flags;
+
+ #ifdef CONFIG_ZONE_DEVICE
+@@ -472,37 +466,33 @@ static void __remove_zone(struct zone *zone, unsigned long start_pfn)
+ return;
+ #endif
+
++ clear_zone_contiguous(zone);
++
+ pgdat_resize_lock(zone->zone_pgdat, &flags);
+ shrink_zone_span(zone, start_pfn, start_pfn + nr_pages);
+ update_pgdat_span(pgdat);
+ pgdat_resize_unlock(zone->zone_pgdat, &flags);
++
++ set_zone_contiguous(zone);
+ }
+
+-static int __remove_section(struct zone *zone, struct mem_section *ms,
+- unsigned long map_offset, struct vmem_altmap *altmap)
++static void __remove_section(struct mem_section *ms, unsigned long map_offset,
++ struct vmem_altmap *altmap)
+ {
+ unsigned long start_pfn;
+ int scn_nr;
+- int ret = -EINVAL;
+
+- if (!valid_section(ms))
+- return ret;
+-
+- ret = unregister_memory_section(ms);
+- if (ret)
+- return ret;
++ if (WARN_ON_ONCE(!valid_section(ms)))
++ return;
+
+ scn_nr = __section_nr(ms);
+ start_pfn = section_nr_to_pfn((unsigned long)scn_nr);
+- __remove_zone(zone, start_pfn);
+
+- sparse_remove_one_section(zone, ms, map_offset, altmap);
+- return 0;
++ sparse_remove_one_section(ms, map_offset, altmap);
+ }
+
+ /**
+- * __remove_pages() - remove sections of pages from a zone
+- * @zone: zone from which pages need to be removed
++ * __remove_pages() - remove sections of pages
+ * @phys_start_pfn: starting pageframe (must be aligned to start of a section)
+ * @nr_pages: number of pages to remove (must be multiple of section size)
+ * @altmap: alternative device page map or %NULL if default memmap is used
+@@ -512,34 +502,15 @@ static int __remove_section(struct zone *zone, struct mem_section *ms,
+ * sure that pages are marked reserved and zones are adjust properly by
+ * calling offline_pages().
+ */
+-int __remove_pages(struct zone *zone, unsigned long phys_start_pfn,
+- unsigned long nr_pages, struct vmem_altmap *altmap)
++void __remove_pages(unsigned long phys_start_pfn, unsigned long nr_pages,
++ struct vmem_altmap *altmap)
+ {
+ unsigned long i;
+ unsigned long map_offset = 0;
+- int sections_to_remove, ret = 0;
+-
+- /* In the ZONE_DEVICE case device driver owns the memory region */
+- if (is_dev_zone(zone)) {
+- if (altmap)
+- map_offset = vmem_altmap_offset(altmap);
+- } else {
+- resource_size_t start, size;
++ int sections_to_remove;
+
+- start = phys_start_pfn << PAGE_SHIFT;
+- size = nr_pages * PAGE_SIZE;
+-
+- ret = release_mem_region_adjustable(&iomem_resource, start,
+- size);
+- if (ret) {
+- resource_size_t endres = start + size - 1;
+-
+- pr_warn("Unable to release resource <%pa-%pa> (%d)\n",
+- &start, &endres, ret);
+- }
+- }
+-
+- clear_zone_contiguous(zone);
++ if (altmap)
++ map_offset = vmem_altmap_offset(altmap);
+
+ /*
+ * We can only remove entire sections
+@@ -552,18 +523,10 @@ int __remove_pages(struct zone *zone, unsigned long phys_start_pfn,
+ unsigned long pfn = phys_start_pfn + i*PAGES_PER_SECTION;
+
+ cond_resched();
+- ret = __remove_section(zone, __pfn_to_section(pfn), map_offset,
+- altmap);
++ __remove_section(__pfn_to_section(pfn), map_offset, altmap);
+ map_offset = 0;
+- if (ret)
+- break;
+ }
+-
+- set_zone_contiguous(zone);
+-
+- return ret;
+ }
+-#endif /* CONFIG_MEMORY_HOTREMOVE */
+
+ int set_online_page_callback(online_page_callback_t callback)
+ {
+@@ -932,6 +895,7 @@ failed_addition:
+ (unsigned long long) pfn << PAGE_SHIFT,
+ (((unsigned long long) pfn + nr_pages) << PAGE_SHIFT) - 1);
+ memory_notify(MEM_CANCEL_ONLINE, &arg);
++ remove_pfn_range_from_zone(zone, pfn, nr_pages);
+ mem_hotplug_done();
+ return ret;
+ }
+@@ -1119,6 +1083,13 @@ int __ref add_memory_resource(int nid, struct resource *res, bool online)
+ if (ret < 0)
+ goto error;
+
++ /* create memory block devices after memory was added */
++ ret = create_memory_block_devices(start, size);
++ if (ret) {
++ arch_remove_memory(nid, start, size, NULL);
++ goto error;
++ }
++
+ if (new_node) {
+ /* If sysfs file of new node can't be created, cpu on the node
+ * can't be hot-added. There is no rollback way now.
+@@ -1709,6 +1680,7 @@ repeat:
+ writeback_set_ratelimit();
+
+ memory_notify(MEM_OFFLINE, &arg);
++ remove_pfn_range_from_zone(zone, start_pfn, nr_pages);
+ mem_hotplug_done();
+ return 0;
+
+@@ -1839,6 +1811,18 @@ static int check_and_unmap_cpu_on_node(pg_data_t *pgdat)
+ return 0;
+ }
+
++static int check_no_memblock_for_node_cb(struct memory_block *mem, void *arg)
++{
++ int nid = *(int *)arg;
++
++ /*
++ * If a memory block belongs to multiple nodes, the stored nid is not
++ * reliable. However, such blocks are always online (e.g., cannot get
++ * offlined) and, therefore, are still spanned by the node.
++ */
++ return mem->nid == nid ? -EEXIST : 0;
++}
++
+ /**
+ * try_offline_node
+ * @nid: the node ID
+@@ -1851,25 +1835,24 @@ static int check_and_unmap_cpu_on_node(pg_data_t *pgdat)
+ void try_offline_node(int nid)
+ {
+ pg_data_t *pgdat = NODE_DATA(nid);
+- unsigned long start_pfn = pgdat->node_start_pfn;
+- unsigned long end_pfn = start_pfn + pgdat->node_spanned_pages;
+- unsigned long pfn;
+-
+- for (pfn = start_pfn; pfn < end_pfn; pfn += PAGES_PER_SECTION) {
+- unsigned long section_nr = pfn_to_section_nr(pfn);
+-
+- if (!present_section_nr(section_nr))
+- continue;
++ int rc;
+
+- if (pfn_to_nid(pfn) != nid)
+- continue;
++ /*
++ * If the node still spans pages (especially ZONE_DEVICE), don't
++ * offline it. A node spans memory after move_pfn_range_to_zone(),
++ * e.g., after the memory block was onlined.
++ */
++ if (pgdat->node_spanned_pages)
++ return;
+
+- /*
+- * some memory sections of this node are not removed, and we
+- * can't offline node now.
+- */
++ /*
++ * Especially offline memory blocks might not be spanned by the
++ * node. They will get spanned by the node once they get onlined.
++ * However, they link to the node in sysfs and can get onlined later.
++ */
++ rc = for_each_memory_block(&nid, check_no_memblock_for_node_cb);
++ if (rc)
+ return;
+- }
+
+ if (check_and_unmap_cpu_on_node(pgdat))
+ return;
+@@ -1883,6 +1866,26 @@ void try_offline_node(int nid)
+ }
+ EXPORT_SYMBOL(try_offline_node);
+
++static void __release_memory_resource(resource_size_t start,
++ resource_size_t size)
++{
++ int ret;
++
++ /*
++ * When removing memory in the same granularity as it was added,
++ * this function never fails. It might only fail if resources
++ * have to be adjusted or split. We'll ignore the error, as
++ * removing of memory cannot fail.
++ */
++ ret = release_mem_region_adjustable(&iomem_resource, start, size);
++ if (ret) {
++ resource_size_t endres = start + size - 1;
++
++ pr_warn("Unable to release resource <%pa-%pa> (%d)\n",
++ &start, &endres, ret);
++ }
++}
++
+ /**
+ * remove_memory
+ * @nid: the node ID
+@@ -1893,7 +1896,7 @@ EXPORT_SYMBOL(try_offline_node);
+ * and online/offline operations before this call, as required by
+ * try_offline_node().
+ */
+-void __ref remove_memory(int nid, u64 start, u64 size)
++void __ref __remove_memory(int nid, u64 start, u64 size)
+ {
+ int ret;
+
+@@ -1916,11 +1919,22 @@ void __ref remove_memory(int nid, u64 start, u64 size)
+ memblock_free(start, size);
+ memblock_remove(start, size);
+
+- arch_remove_memory(start, size, NULL);
++ /* remove memory block devices before removing memory */
++ remove_memory_block_devices(start, size);
++
++ arch_remove_memory(nid, start, size, NULL);
++ __release_memory_resource(start, size);
+
+ try_offline_node(nid);
+
+ mem_hotplug_done();
+ }
++
++void remove_memory(int nid, u64 start, u64 size)
++{
++ lock_device_hotplug();
++ __remove_memory(nid, start, size);
++ unlock_device_hotplug();
++}
+ EXPORT_SYMBOL_GPL(remove_memory);
+ #endif /* CONFIG_MEMORY_HOTREMOVE */
+diff --git a/mm/sparse.c b/mm/sparse.c
+index 45950a074bdb..3b24ba903d9e 100644
+--- a/mm/sparse.c
++++ b/mm/sparse.c
+@@ -576,7 +576,6 @@ static void __kfree_section_memmap(struct page *memmap,
+
+ vmemmap_free(start, end, altmap);
+ }
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+ static void free_map_bootmem(struct page *memmap)
+ {
+ unsigned long start = (unsigned long)memmap;
+@@ -584,7 +583,6 @@ static void free_map_bootmem(struct page *memmap)
+
+ vmemmap_free(start, end, NULL);
+ }
+-#endif /* CONFIG_MEMORY_HOTREMOVE */
+ #else
+ static struct page *__kmalloc_section_memmap(void)
+ {
+@@ -623,7 +621,6 @@ static void __kfree_section_memmap(struct page *memmap,
+ get_order(sizeof(struct page) * PAGES_PER_SECTION));
+ }
+
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+ static void free_map_bootmem(struct page *memmap)
+ {
+ unsigned long maps_section_nr, removing_section_nr, i;
+@@ -653,7 +650,6 @@ static void free_map_bootmem(struct page *memmap)
+ put_page_bootmem(page);
+ }
+ }
+-#endif /* CONFIG_MEMORY_HOTREMOVE */
+ #endif /* CONFIG_SPARSEMEM_VMEMMAP */
+
+ /*
+@@ -661,25 +657,24 @@ static void free_map_bootmem(struct page *memmap)
+ * set. If this is <=0, then that means that the passed-in
+ * map was not consumed and must be freed.
+ */
+-int __meminit sparse_add_one_section(struct pglist_data *pgdat,
+- unsigned long start_pfn, struct vmem_altmap *altmap)
++int __meminit sparse_add_one_section(int nid, unsigned long start_pfn,
++ struct vmem_altmap *altmap)
+ {
+ unsigned long section_nr = pfn_to_section_nr(start_pfn);
+ struct mem_section *ms;
+ struct page *memmap;
+ unsigned long *usemap;
+- unsigned long flags;
+ int ret;
+
+ /*
+ * no locking for this, because it does its own
+ * plus, it does a kmalloc
+ */
+- ret = sparse_index_init(section_nr, pgdat->node_id);
++ ret = sparse_index_init(section_nr, nid);
+ if (ret < 0 && ret != -EEXIST)
+ return ret;
+ ret = 0;
+- memmap = kmalloc_section_memmap(section_nr, pgdat->node_id, altmap);
++ memmap = kmalloc_section_memmap(section_nr, nid, altmap);
+ if (!memmap)
+ return -ENOMEM;
+ usemap = __kmalloc_section_usemap();
+@@ -688,8 +683,6 @@ int __meminit sparse_add_one_section(struct pglist_data *pgdat,
+ return -ENOMEM;
+ }
+
+- pgdat_resize_lock(pgdat, &flags);
+-
+ ms = __pfn_to_section(start_pfn);
+ if (ms->section_mem_map & SECTION_MARKED_PRESENT) {
+ ret = -EEXIST;
+@@ -708,7 +701,6 @@ int __meminit sparse_add_one_section(struct pglist_data *pgdat,
+ sparse_init_one_section(ms, section_nr, memmap, usemap);
+
+ out:
+- pgdat_resize_unlock(pgdat, &flags);
+ if (ret < 0) {
+ kfree(usemap);
+ __kfree_section_memmap(memmap, altmap);
+@@ -716,7 +708,6 @@ out:
+ return ret;
+ }
+
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+ #ifdef CONFIG_MEMORY_FAILURE
+ static void clear_hwpoisoned_pages(struct page *memmap, int nr_pages)
+ {
+@@ -766,14 +757,12 @@ static void free_section_usemap(struct page *memmap, unsigned long *usemap,
+ free_map_bootmem(memmap);
+ }
+
+-void sparse_remove_one_section(struct zone *zone, struct mem_section *ms,
+- unsigned long map_offset, struct vmem_altmap *altmap)
++void sparse_remove_one_section(struct mem_section *ms, unsigned long map_offset,
++ struct vmem_altmap *altmap)
+ {
+ struct page *memmap = NULL;
+- unsigned long *usemap = NULL, flags;
+- struct pglist_data *pgdat = zone->zone_pgdat;
++ unsigned long *usemap = NULL;
+
+- pgdat_resize_lock(pgdat, &flags);
+ if (ms->section_mem_map) {
+ usemap = ms->pageblock_flags;
+ memmap = sparse_decode_mem_map(ms->section_mem_map,
+@@ -781,11 +770,9 @@ void sparse_remove_one_section(struct zone *zone, struct mem_section *ms,
+ ms->section_mem_map = 0;
+ ms->pageblock_flags = NULL;
+ }
+- pgdat_resize_unlock(pgdat, &flags);
+
+ clear_hwpoisoned_pages(memmap + map_offset,
+ PAGES_PER_SECTION - map_offset);
+ free_section_usemap(memmap, usemap, altmap);
+ }
+-#endif /* CONFIG_MEMORY_HOTREMOVE */
+ #endif /* CONFIG_MEMORY_HOTPLUG */
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 73ebacabfde8..1c0224e8fc78 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -7752,6 +7752,22 @@ int __dev_set_mtu(struct net_device *dev, int new_mtu)
+ }
+ EXPORT_SYMBOL(__dev_set_mtu);
+
++int dev_validate_mtu(struct net_device *dev, int new_mtu,
++ struct netlink_ext_ack *extack)
++{
++ /* MTU must be positive, and in range */
++ if (new_mtu < 0 || new_mtu < dev->min_mtu) {
++ NL_SET_ERR_MSG(extack, "mtu less than device minimum");
++ return -EINVAL;
++ }
++
++ if (dev->max_mtu > 0 && new_mtu > dev->max_mtu) {
++ NL_SET_ERR_MSG(extack, "mtu greater than device maximum");
++ return -EINVAL;
++ }
++ return 0;
++}
++
+ /**
+ * dev_set_mtu_ext - Change maximum transfer unit
+ * @dev: device
+@@ -7768,16 +7784,9 @@ int dev_set_mtu_ext(struct net_device *dev, int new_mtu,
+ if (new_mtu == dev->mtu)
+ return 0;
+
+- /* MTU must be positive, and in range */
+- if (new_mtu < 0 || new_mtu < dev->min_mtu) {
+- NL_SET_ERR_MSG(extack, "mtu less than device minimum");
+- return -EINVAL;
+- }
+-
+- if (dev->max_mtu > 0 && new_mtu > dev->max_mtu) {
+- NL_SET_ERR_MSG(extack, "mtu greater than device maximum");
+- return -EINVAL;
+- }
++ err = dev_validate_mtu(dev, new_mtu, extack);
++ if (err)
++ return err;
+
+ if (!netif_device_present(dev))
+ return -ENODEV;
+@@ -8696,8 +8705,10 @@ int register_netdevice(struct net_device *dev)
+ goto err_uninit;
+
+ ret = netdev_register_kobject(dev);
+- if (ret)
++ if (ret) {
++ dev->reg_state = NETREG_UNREGISTERED;
+ goto err_uninit;
++ }
+ dev->reg_state = NETREG_REGISTERED;
+
+ __netdev_update_features(dev);
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index bf9a3b6ac885..7614a4f42bfc 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -928,25 +928,30 @@ static int rx_queue_add_kobject(struct net_device *dev, int index)
+ struct kobject *kobj = &queue->kobj;
+ int error = 0;
+
++ /* Kobject_put later will trigger rx_queue_release call which
++ * decreases dev refcount: Take that reference here
++ */
++ dev_hold(queue->dev);
++
+ kobj->kset = dev->queues_kset;
+ error = kobject_init_and_add(kobj, &rx_queue_ktype, NULL,
+ "rx-%u", index);
+ if (error)
+- return error;
+-
+- dev_hold(queue->dev);
++ goto err;
+
+ if (dev->sysfs_rx_queue_group) {
+ error = sysfs_create_group(kobj, dev->sysfs_rx_queue_group);
+- if (error) {
+- kobject_put(kobj);
+- return error;
+- }
++ if (error)
++ goto err;
+ }
+
+ kobject_uevent(kobj, KOBJ_ADD);
+
+ return error;
++
++err:
++ kobject_put(kobj);
++ return error;
+ }
+ #endif /* CONFIG_SYSFS */
+
+@@ -1467,25 +1472,29 @@ static int netdev_queue_add_kobject(struct net_device *dev, int index)
+ struct kobject *kobj = &queue->kobj;
+ int error = 0;
+
++ /* Kobject_put later will trigger netdev_queue_release call
++ * which decreases dev refcount: Take that reference here
++ */
++ dev_hold(queue->dev);
++
+ kobj->kset = dev->queues_kset;
+ error = kobject_init_and_add(kobj, &netdev_queue_ktype, NULL,
+ "tx-%u", index);
+ if (error)
+- return error;
+-
+- dev_hold(queue->dev);
++ goto err;
+
+ #ifdef CONFIG_BQL
+ error = sysfs_create_group(kobj, &dql_group);
+- if (error) {
+- kobject_put(kobj);
+- return error;
+- }
++ if (error)
++ goto err;
+ #endif
+
+ kobject_uevent(kobj, KOBJ_ADD);
+-
+ return 0;
++
++err:
++ kobject_put(kobj);
++ return error;
+ }
+ #endif /* CONFIG_SYSFS */
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index dbb3c0c7c132..f51973f458e4 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2875,8 +2875,17 @@ struct net_device *rtnl_create_link(struct net *net,
+ dev->rtnl_link_ops = ops;
+ dev->rtnl_link_state = RTNL_LINK_INITIALIZING;
+
+- if (tb[IFLA_MTU])
+- dev->mtu = nla_get_u32(tb[IFLA_MTU]);
++ if (tb[IFLA_MTU]) {
++ u32 mtu = nla_get_u32(tb[IFLA_MTU]);
++ int err;
++
++ err = dev_validate_mtu(dev, mtu, NULL);
++ if (err) {
++ free_netdev(dev);
++ return ERR_PTR(err);
++ }
++ dev->mtu = mtu;
++ }
+ if (tb[IFLA_ADDRESS]) {
+ memcpy(dev->dev_addr, nla_data(tb[IFLA_ADDRESS]),
+ nla_len(tb[IFLA_ADDRESS]));
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index f03a1b68e70f..14fd8a37a729 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -1203,10 +1203,8 @@ int ip_tunnel_init(struct net_device *dev)
+ iph->version = 4;
+ iph->ihl = 5;
+
+- if (tunnel->collect_md) {
+- dev->features |= NETIF_F_NETNS_LOCAL;
++ if (tunnel->collect_md)
+ netif_keep_dst(dev);
+- }
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(ip_tunnel_init);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index af9361eba64a..e80eb1788f80 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2507,6 +2507,7 @@ static void tcp_rtx_queue_purge(struct sock *sk)
+ {
+ struct rb_node *p = rb_first(&sk->tcp_rtx_queue);
+
++ tcp_sk(sk)->highest_sack = NULL;
+ while (p) {
+ struct sk_buff *skb = rb_to_skb(p);
+
+diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
+index 02ff2dde9609..b371e66502c3 100644
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -680,8 +680,7 @@ static void bbr_update_bw(struct sock *sk, const struct rate_sample *rs)
+ * bandwidth sample. Delivered is in packets and interval_us in uS and
+ * ratio will be <<1 for most connections. So delivered is first scaled.
+ */
+- bw = (u64)rs->delivered * BW_UNIT;
+- do_div(bw, rs->interval_us);
++ bw = div64_long((u64)rs->delivered * BW_UNIT, rs->interval_us);
+
+ /* If this sample is application-limited, it is likely to have a very
+ * low delivered count that represents application behavior rather than
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index e286a9647a73..38b6d8f90a44 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3149,6 +3149,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, u32 prior_fack,
+ tp->retransmit_skb_hint = NULL;
+ if (unlikely(skb == tp->lost_skb_hint))
+ tp->lost_skb_hint = NULL;
++ tcp_highest_sack_replace(sk, skb, next);
+ tcp_rtx_queue_unlink_and_free(skb, sk);
+ }
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 1cc20edf4762..cc4ba42052c2 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3165,6 +3165,7 @@ int tcp_send_synack(struct sock *sk)
+ if (!nskb)
+ return -ENOMEM;
+ INIT_LIST_HEAD(&nskb->tcp_tsorted_anchor);
++ tcp_highest_sack_replace(sk, skb, nskb);
+ tcp_rtx_queue_unlink_and_free(skb, sk);
+ __skb_header_release(nskb);
+ tcp_rbtree_insert(&sk->tcp_rtx_queue, nskb);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 2eeae0455b14..0ef04cda1b27 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1305,7 +1305,8 @@ static void udp_rmem_release(struct sock *sk, int size, int partial,
+ if (likely(partial)) {
+ up->forward_deficit += size;
+ size = up->forward_deficit;
+- if (size < (sk->sk_rcvbuf >> 2))
++ if (size < (sk->sk_rcvbuf >> 2) &&
++ !skb_queue_empty(&up->reader_queue))
+ return;
+ } else {
+ size += up->forward_deficit;
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 1f2d0022ba6f..90621d498fd1 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1486,7 +1486,6 @@ static int ip6gre_tunnel_init_common(struct net_device *dev)
+ dev->mtu -= 8;
+
+ if (tunnel->parms.collect_md) {
+- dev->features |= NETIF_F_NETNS_LOCAL;
+ netif_keep_dst(dev);
+ }
+ ip6gre_tnl_init_features(dev);
+@@ -1914,7 +1913,6 @@ static void ip6gre_tap_setup(struct net_device *dev)
+ dev->needs_free_netdev = true;
+ dev->priv_destructor = ip6gre_dev_free;
+
+- dev->features |= NETIF_F_NETNS_LOCAL;
+ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+ netif_keep_dst(dev);
+@@ -2223,7 +2221,6 @@ static void ip6erspan_tap_setup(struct net_device *dev)
+ dev->needs_free_netdev = true;
+ dev->priv_destructor = ip6gre_dev_free;
+
+- dev->features |= NETIF_F_NETNS_LOCAL;
+ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+ netif_keep_dst(dev);
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index e3b4237b2832..8e70a015c792 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1882,10 +1882,8 @@ static int ip6_tnl_dev_init(struct net_device *dev)
+ if (err)
+ return err;
+ ip6_tnl_link_config(t);
+- if (t->parms.collect_md) {
+- dev->features |= NETIF_F_NETNS_LOCAL;
++ if (t->parms.collect_md)
+ netif_keep_dst(dev);
+- }
+ return 0;
+ }
+
+diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
+index 60325dbfe88b..607709a8847c 100644
+--- a/net/ipv6/seg6_local.c
++++ b/net/ipv6/seg6_local.c
+@@ -28,6 +28,7 @@
+ #include <net/addrconf.h>
+ #include <net/ip6_route.h>
+ #include <net/dst_cache.h>
++#include <net/ip_tunnels.h>
+ #ifdef CONFIG_IPV6_SEG6_HMAC
+ #include <net/seg6_hmac.h>
+ #endif
+@@ -135,7 +136,8 @@ static bool decap_and_validate(struct sk_buff *skb, int proto)
+
+ skb_reset_network_header(skb);
+ skb_reset_transport_header(skb);
+- skb->encapsulation = 0;
++ if (iptunnel_pull_offloads(skb))
++ return false;
+
+ return true;
+ }
+diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h
+index af480ffefaf3..37f68062be41 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_gen.h
++++ b/net/netfilter/ipset/ip_set_bitmap_gen.h
+@@ -79,7 +79,7 @@ mtype_flush(struct ip_set *set)
+
+ if (set->extensions & IPSET_EXT_DESTROY)
+ mtype_ext_cleanup(set);
+- memset(map->members, 0, map->memsize);
++ bitmap_zero(map->members, map->elements);
+ set->elements = 0;
+ set->ext_size = 0;
+ }
+diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
+index 488d6d05c65c..e3257077158f 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
++++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
+@@ -40,7 +40,7 @@ MODULE_ALIAS("ip_set_bitmap:ip");
+
+ /* Type structure */
+ struct bitmap_ip {
+- void *members; /* the set members */
++ unsigned long *members; /* the set members */
+ u32 first_ip; /* host byte order, included in range */
+ u32 last_ip; /* host byte order, included in range */
+ u32 elements; /* number of max elements in the set */
+@@ -223,7 +223,7 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map,
+ u32 first_ip, u32 last_ip,
+ u32 elements, u32 hosts, u8 netmask)
+ {
+- map->members = ip_set_alloc(map->memsize);
++ map->members = bitmap_zalloc(elements, GFP_KERNEL | __GFP_NOWARN);
+ if (!map->members)
+ return false;
+ map->first_ip = first_ip;
+@@ -313,7 +313,7 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
+ if (!map)
+ return -ENOMEM;
+
+- map->memsize = bitmap_bytes(0, elements - 1);
++ map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
+ set->variant = &bitmap_ip;
+ if (!init_map_ip(set, map, first_ip, last_ip,
+ elements, hosts, netmask)) {
+diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+index 794e0335a864..9669cace4522 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+@@ -46,7 +46,7 @@ enum {
+
+ /* Type structure */
+ struct bitmap_ipmac {
+- void *members; /* the set members */
++ unsigned long *members; /* the set members */
+ u32 first_ip; /* host byte order, included in range */
+ u32 last_ip; /* host byte order, included in range */
+ u32 elements; /* number of max elements in the set */
+@@ -303,7 +303,7 @@ static bool
+ init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
+ u32 first_ip, u32 last_ip, u32 elements)
+ {
+- map->members = ip_set_alloc(map->memsize);
++ map->members = bitmap_zalloc(elements, GFP_KERNEL | __GFP_NOWARN);
+ if (!map->members)
+ return false;
+ map->first_ip = first_ip;
+@@ -364,7 +364,7 @@ bitmap_ipmac_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
+ if (!map)
+ return -ENOMEM;
+
+- map->memsize = bitmap_bytes(0, elements - 1);
++ map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
+ set->variant = &bitmap_ipmac;
+ if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) {
+ kfree(map);
+diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c
+index b561ca8b3659..ae09f2af6a19 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_port.c
++++ b/net/netfilter/ipset/ip_set_bitmap_port.c
+@@ -34,7 +34,7 @@ MODULE_ALIAS("ip_set_bitmap:port");
+
+ /* Type structure */
+ struct bitmap_port {
+- void *members; /* the set members */
++ unsigned long *members; /* the set members */
+ u16 first_port; /* host byte order, included in range */
+ u16 last_port; /* host byte order, included in range */
+ u32 elements; /* number of max elements in the set */
+@@ -208,7 +208,7 @@ static bool
+ init_map_port(struct ip_set *set, struct bitmap_port *map,
+ u16 first_port, u16 last_port)
+ {
+- map->members = ip_set_alloc(map->memsize);
++ map->members = bitmap_zalloc(map->elements, GFP_KERNEL | __GFP_NOWARN);
+ if (!map->members)
+ return false;
+ map->first_port = first_port;
+@@ -248,7 +248,7 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
+ return -ENOMEM;
+
+ map->elements = elements;
+- map->memsize = bitmap_bytes(0, map->elements);
++ map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
+ set->variant = &bitmap_port;
+ if (!init_map_port(set, map, first_port, last_port)) {
+ kfree(map);
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 7f0d3ffd5469..5881f6668817 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -471,15 +471,28 @@ static inline u64 nf_tables_alloc_handle(struct nft_table *table)
+
+ static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
+
++static const struct nft_chain_type *
++__nft_chain_type_get(u8 family, enum nft_chain_types type)
++{
++ if (family >= NFPROTO_NUMPROTO ||
++ type >= NFT_CHAIN_T_MAX)
++ return NULL;
++
++ return chain_type[family][type];
++}
++
+ static const struct nft_chain_type *
+ __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
+ {
++ const struct nft_chain_type *type;
+ int i;
+
+ for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
+- if (chain_type[family][i] != NULL &&
+- !nla_strcmp(nla, chain_type[family][i]->name))
+- return chain_type[family][i];
++ type = __nft_chain_type_get(family, i);
++ if (!type)
++ continue;
++ if (!nla_strcmp(nla, type->name))
++ return type;
+ }
+ return NULL;
+ }
+@@ -1050,11 +1063,8 @@ static void nf_tables_table_destroy(struct nft_ctx *ctx)
+
+ void nft_register_chain_type(const struct nft_chain_type *ctype)
+ {
+- if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
+- return;
+-
+ nfnl_lock(NFNL_SUBSYS_NFTABLES);
+- if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) {
++ if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) {
+ nfnl_unlock(NFNL_SUBSYS_NFTABLES);
+ return;
+ }
+@@ -1511,7 +1521,10 @@ static int nft_chain_parse_hook(struct net *net,
+ hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
+ hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
+
+- type = chain_type[family][NFT_CHAIN_T_DEFAULT];
++ type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT);
++ if (!type)
++ return -EOPNOTSUPP;
++
+ if (nla[NFTA_CHAIN_TYPE]) {
+ type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
+ family, autoload);
+diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
+index df4e3e0412ed..a003533ff4d9 100644
+--- a/net/netfilter/nft_osf.c
++++ b/net/netfilter/nft_osf.c
+@@ -47,6 +47,9 @@ static int nft_osf_init(const struct nft_ctx *ctx,
+ struct nft_osf *priv = nft_expr_priv(expr);
+ int err;
+
++ if (!tb[NFTA_OSF_DREG])
++ return -EINVAL;
++
+ priv->dreg = nft_parse_register(tb[NFTA_OSF_DREG]);
+ err = nft_validate_register_store(ctx, priv->dreg, NULL,
+ NFT_DATA_VALUE, NFT_OSF_MAXGENRELEN);
+diff --git a/net/sched/ematch.c b/net/sched/ematch.c
+index 1331a4c2d8ff..750d88d0cfd9 100644
+--- a/net/sched/ematch.c
++++ b/net/sched/ematch.c
+@@ -267,12 +267,12 @@ static int tcf_em_validate(struct tcf_proto *tp,
+ }
+ em->data = (unsigned long) v;
+ }
++ em->datalen = data_len;
+ }
+ }
+
+ em->matchid = em_hdr->matchid;
+ em->flags = em_hdr->flags;
+- em->datalen = data_len;
+ em->net = net;
+
+ err = 0;
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 20a511398389..bd1cbbfe5924 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -765,6 +765,10 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
+ if (sk->sk_state == TCP_ESTABLISHED)
+ goto out;
+
++ rc = -EALREADY; /* Do nothing if call is already in progress */
++ if (sk->sk_state == TCP_SYN_SENT)
++ goto out;
++
+ sk->sk_state = TCP_CLOSE;
+ sock->state = SS_UNCONNECTED;
+
+@@ -811,7 +815,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
+ /* Now the loop */
+ rc = -EINPROGRESS;
+ if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK))
+- goto out_put_neigh;
++ goto out;
+
+ rc = x25_wait_for_connection_establishment(sk);
+ if (rc)
+diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
+index 895c40e8679f..3b0dcf38fd8b 100644
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -39,6 +39,10 @@
+ #define R_AARCH64_ABS64 257
+ #endif
+
++#define R_ARM_PC24 1
++#define R_ARM_THM_CALL 10
++#define R_ARM_CALL 28
++
+ static int fd_map; /* File descriptor for file being modified. */
+ static int mmap_failed; /* Boolean flag. */
+ static char gpfx; /* prefix for global symbol name (sometimes '_') */
+@@ -414,6 +418,18 @@ is_mcounted_section_name(char const *const txtname)
+ #define RECORD_MCOUNT_64
+ #include "recordmcount.h"
+
++static int arm_is_fake_mcount(Elf32_Rel const *rp)
++{
++ switch (ELF32_R_TYPE(w(rp->r_info))) {
++ case R_ARM_THM_CALL:
++ case R_ARM_CALL:
++ case R_ARM_PC24:
++ return 0;
++ }
++
++ return 1;
++}
++
+ /* 64-bit EM_MIPS has weird ELF64_Rela.r_info.
+ * http://techpubs.sgi.com/library/manuals/4000/007-4658-001/pdf/007-4658-001.pdf
+ * We interpret Table 29 Relocation Operation (Elf64_Rel, Elf64_Rela) [p.40]
+@@ -515,6 +531,7 @@ do_file(char const *const fname)
+ altmcount = "__gnu_mcount_nc";
+ make_nop = make_nop_arm;
+ rel_type_nop = R_ARM_NONE;
++ is_fake_mcount32 = arm_is_fake_mcount;
+ break;
+ case EM_AARCH64:
+ reltype = R_AARCH64_ABS64;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-02-01 10:30 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-02-01 10:30 UTC (permalink / raw
To: gentoo-commits
commit: 2fcaa12fcd6f3449eaa828d2a68d3c0d7f9202d4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 1 10:30:22 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Feb 1 10:30:22 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2fcaa12f
Linux patch 4.19.101
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1100_linux-4.19.101.patch | 2206 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2210 insertions(+)
diff --git a/0000_README b/0000_README
index 7c99cc6..fcf3d5e 100644
--- a/0000_README
+++ b/0000_README
@@ -439,6 +439,10 @@ Patch: 1099_linux-4.19.100.patch
From: https://www.kernel.org
Desc: Linux 4.19.100
+Patch: 1100_linux-4.19.101.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.101
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1100_linux-4.19.101.patch b/1100_linux-4.19.101.patch
new file mode 100644
index 0000000..8304fb2
--- /dev/null
+++ b/1100_linux-4.19.101.patch
@@ -0,0 +1,2206 @@
+diff --git a/Makefile b/Makefile
+index f1e428271abf..ca186bcc02ba 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 100
++SUBLEVEL = 101
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/plat-eznps/Kconfig b/arch/arc/plat-eznps/Kconfig
+index 8eff057efcae..ce908e2c5282 100644
+--- a/arch/arc/plat-eznps/Kconfig
++++ b/arch/arc/plat-eznps/Kconfig
+@@ -7,7 +7,7 @@
+ menuconfig ARC_PLAT_EZNPS
+ bool "\"EZchip\" ARC dev platform"
+ select CPU_BIG_ENDIAN
+- select CLKSRC_NPS
++ select CLKSRC_NPS if !PHYS_ADDR_T_64BIT
+ select EZNPS_GIC
+ select EZCHIP_NPS_MANAGEMENT_ENET if ETHERNET
+ help
+diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c
+index 00d422336a45..4e722d73a3c3 100644
+--- a/arch/arm64/kvm/debug.c
++++ b/arch/arm64/kvm/debug.c
+@@ -112,7 +112,7 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu)
+ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ {
+ bool trap_debug = !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY);
+- unsigned long mdscr;
++ unsigned long mdscr, orig_mdcr_el2 = vcpu->arch.mdcr_el2;
+
+ trace_kvm_arm_setup_debug(vcpu, vcpu->guest_debug);
+
+@@ -208,6 +208,10 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ if (vcpu_read_sys_reg(vcpu, MDSCR_EL1) & (DBG_MDSCR_KDE | DBG_MDSCR_MDE))
+ vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY;
+
++ /* Write mdcr_el2 changes since vcpu_load on VHE systems */
++ if (has_vhe() && orig_mdcr_el2 != vcpu->arch.mdcr_el2)
++ write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
++
+ trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2);
+ trace_kvm_arm_set_dreg32("MDSCR_EL1", vcpu_read_sys_reg(vcpu, MDSCR_EL1));
+ }
+diff --git a/block/blk-lib.c b/block/blk-lib.c
+index 1f196cf0aa5d..0dbc9e2ab9a3 100644
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -52,15 +52,14 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+ if ((sector | nr_sects) & bs_mask)
+ return -EINVAL;
+
+- while (nr_sects) {
+- unsigned int req_sects = nr_sects;
+- sector_t end_sect;
++ if (!nr_sects)
++ return -EINVAL;
+
+- if (!req_sects)
+- goto fail;
+- req_sects = min(req_sects, bio_allowed_max_sectors(q));
++ while (nr_sects) {
++ sector_t req_sects = min_t(sector_t, nr_sects,
++ bio_allowed_max_sectors(q));
+
+- end_sect = sector + req_sects;
++ WARN_ON_ONCE((req_sects << 9) > UINT_MAX);
+
+ bio = next_bio(bio, 0, gfp_mask);
+ bio->bi_iter.bi_sector = sector;
+@@ -68,8 +67,8 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+ bio_set_op_attrs(bio, op, 0);
+
+ bio->bi_iter.bi_size = req_sects << 9;
++ sector += req_sects;
+ nr_sects -= req_sects;
+- sector = end_sect;
+
+ /*
+ * We can loop for a long time in here, if someone does
+@@ -82,14 +81,6 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+
+ *biop = bio;
+ return 0;
+-
+-fail:
+- if (bio) {
+- submit_bio_wait(bio);
+- bio_put(bio);
+- }
+- *biop = NULL;
+- return -EOPNOTSUPP;
+ }
+ EXPORT_SYMBOL(__blkdev_issue_discard);
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index ed643ce12278..4fc8e6a7abb2 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -139,11 +139,13 @@ void af_alg_release_parent(struct sock *sk)
+ sk = ask->parent;
+ ask = alg_sk(sk);
+
+- lock_sock(sk);
++ local_bh_disable();
++ bh_lock_sock(sk);
+ ask->nokey_refcnt -= nokey;
+ if (!last)
+ last = !--ask->refcnt;
+- release_sock(sk);
++ bh_unlock_sock(sk);
++ local_bh_enable();
+
+ if (last)
+ sock_put(sk);
+diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
+index 6470e3c4c990..7323e9210f4b 100644
+--- a/drivers/atm/eni.c
++++ b/drivers/atm/eni.c
+@@ -372,7 +372,7 @@ static int do_rx_dma(struct atm_vcc *vcc,struct sk_buff *skb,
+ here = (eni_vcc->descr+skip) & (eni_vcc->words-1);
+ dma[j++] = (here << MID_DMA_COUNT_SHIFT) | (vcc->vci
+ << MID_DMA_VCI_SHIFT) | MID_DT_JK;
+- j++;
++ dma[j++] = 0;
+ }
+ here = (eni_vcc->descr+size+skip) & (eni_vcc->words-1);
+ if (!eff) size += skip;
+@@ -445,7 +445,7 @@ static int do_rx_dma(struct atm_vcc *vcc,struct sk_buff *skb,
+ if (size != eff) {
+ dma[j++] = (here << MID_DMA_COUNT_SHIFT) |
+ (vcc->vci << MID_DMA_VCI_SHIFT) | MID_DT_JK;
+- j++;
++ dma[j++] = 0;
+ }
+ if (!j || j > 2*RX_DMA_BUF) {
+ printk(KERN_CRIT DEV_LABEL "!j or j too big!!!\n");
+diff --git a/drivers/base/component.c b/drivers/base/component.c
+index e8d676fad0c9..7f7c4233cd31 100644
+--- a/drivers/base/component.c
++++ b/drivers/base/component.c
+@@ -74,11 +74,11 @@ static int component_devices_show(struct seq_file *s, void *data)
+ seq_printf(s, "%-40s %20s\n", "device name", "status");
+ seq_puts(s, "-------------------------------------------------------------\n");
+ for (i = 0; i < match->num; i++) {
+- struct device *d = (struct device *)match->compare[i].data;
++ struct component *component = match->compare[i].component;
+
+- seq_printf(s, "%-40s %20s\n", dev_name(d),
+- match->compare[i].component ?
+- "registered" : "not registered");
++ seq_printf(s, "%-40s %20s\n",
++ component ? dev_name(component->dev) : "(unknown)",
++ component ? (component->bound ? "bound" : "not bound") : "not registered");
+ }
+ mutex_unlock(&component_mutex);
+
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 86fe1df90239..53e822793d46 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1653,6 +1653,56 @@ void get_random_bytes(void *buf, int nbytes)
+ }
+ EXPORT_SYMBOL(get_random_bytes);
+
++
++/*
++ * Each time the timer fires, we expect that we got an unpredictable
++ * jump in the cycle counter. Even if the timer is running on another
++ * CPU, the timer activity will be touching the stack of the CPU that is
++ * generating entropy..
++ *
++ * Note that we don't re-arm the timer in the timer itself - we are
++ * happy to be scheduled away, since that just makes the load more
++ * complex, but we do not want the timer to keep ticking unless the
++ * entropy loop is running.
++ *
++ * So the re-arming always happens in the entropy loop itself.
++ */
++static void entropy_timer(struct timer_list *t)
++{
++ credit_entropy_bits(&input_pool, 1);
++}
++
++/*
++ * If we have an actual cycle counter, see if we can
++ * generate enough entropy with timing noise
++ */
++static void try_to_generate_entropy(void)
++{
++ struct {
++ unsigned long now;
++ struct timer_list timer;
++ } stack;
++
++ stack.now = random_get_entropy();
++
++ /* Slow counter - or none. Don't even bother */
++ if (stack.now == random_get_entropy())
++ return;
++
++ timer_setup_on_stack(&stack.timer, entropy_timer, 0);
++ while (!crng_ready()) {
++ if (!timer_pending(&stack.timer))
++ mod_timer(&stack.timer, jiffies+1);
++ mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now));
++ schedule();
++ stack.now = random_get_entropy();
++ }
++
++ del_timer_sync(&stack.timer);
++ destroy_timer_on_stack(&stack.timer);
++ mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now));
++}
++
+ /*
+ * Wait for the urandom pool to be seeded and thus guaranteed to supply
+ * cryptographically secure random numbers. This applies to: the /dev/urandom
+@@ -1667,7 +1717,17 @@ int wait_for_random_bytes(void)
+ {
+ if (likely(crng_ready()))
+ return 0;
+- return wait_event_interruptible(crng_init_wait, crng_ready());
++
++ do {
++ int ret;
++ ret = wait_event_interruptible_timeout(crng_init_wait, crng_ready(), HZ);
++ if (ret)
++ return ret > 0 ? 0 : ret;
++
++ try_to_generate_entropy();
++ } while (!crng_ready());
++
++ return 0;
+ }
+ EXPORT_SYMBOL(wait_for_random_bytes);
+
+diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
+index 010bbf607797..c435f89f34e3 100644
+--- a/drivers/crypto/chelsio/chcr_algo.c
++++ b/drivers/crypto/chelsio/chcr_algo.c
+@@ -3135,9 +3135,6 @@ static int chcr_gcm_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
+ aeadctx->mayverify = VERIFY_SW;
+ break;
+ default:
+-
+- crypto_tfm_set_flags((struct crypto_tfm *) tfm,
+- CRYPTO_TFM_RES_BAD_KEY_LEN);
+ return -EINVAL;
+ }
+ return crypto_aead_setauthsize(aeadctx->sw_cipher, authsize);
+@@ -3162,8 +3159,6 @@ static int chcr_4106_4309_setauthsize(struct crypto_aead *tfm,
+ aeadctx->mayverify = VERIFY_HW;
+ break;
+ default:
+- crypto_tfm_set_flags((struct crypto_tfm *)tfm,
+- CRYPTO_TFM_RES_BAD_KEY_LEN);
+ return -EINVAL;
+ }
+ return crypto_aead_setauthsize(aeadctx->sw_cipher, authsize);
+@@ -3204,8 +3199,6 @@ static int chcr_ccm_setauthsize(struct crypto_aead *tfm,
+ aeadctx->mayverify = VERIFY_HW;
+ break;
+ default:
+- crypto_tfm_set_flags((struct crypto_tfm *)tfm,
+- CRYPTO_TFM_RES_BAD_KEY_LEN);
+ return -EINVAL;
+ }
+ return crypto_aead_setauthsize(aeadctx->sw_cipher, authsize);
+@@ -3230,8 +3223,7 @@ static int chcr_ccm_common_setkey(struct crypto_aead *aead,
+ ck_size = CHCR_KEYCTX_CIPHER_KEY_SIZE_256;
+ mk_size = CHCR_KEYCTX_MAC_KEY_SIZE_256;
+ } else {
+- crypto_tfm_set_flags((struct crypto_tfm *)aead,
+- CRYPTO_TFM_RES_BAD_KEY_LEN);
++ crypto_aead_set_flags(aead, CRYPTO_TFM_RES_BAD_KEY_LEN);
+ aeadctx->enckey_len = 0;
+ return -EINVAL;
+ }
+@@ -3269,8 +3261,7 @@ static int chcr_aead_rfc4309_setkey(struct crypto_aead *aead, const u8 *key,
+ int error;
+
+ if (keylen < 3) {
+- crypto_tfm_set_flags((struct crypto_tfm *)aead,
+- CRYPTO_TFM_RES_BAD_KEY_LEN);
++ crypto_aead_set_flags(aead, CRYPTO_TFM_RES_BAD_KEY_LEN);
+ aeadctx->enckey_len = 0;
+ return -EINVAL;
+ }
+@@ -3320,8 +3311,7 @@ static int chcr_gcm_setkey(struct crypto_aead *aead, const u8 *key,
+ } else if (keylen == AES_KEYSIZE_256) {
+ ck_size = CHCR_KEYCTX_CIPHER_KEY_SIZE_256;
+ } else {
+- crypto_tfm_set_flags((struct crypto_tfm *)aead,
+- CRYPTO_TFM_RES_BAD_KEY_LEN);
++ crypto_aead_set_flags(aead, CRYPTO_TFM_RES_BAD_KEY_LEN);
+ pr_err("GCM: Invalid key length %d\n", keylen);
+ ret = -EINVAL;
+ goto out;
+diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
+index ed51221621a5..2c34e9537f9e 100644
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -1059,6 +1059,7 @@ config GPIO_MADERA
+ config GPIO_MAX77620
+ tristate "GPIO support for PMIC MAX77620 and MAX20024"
+ depends on MFD_MAX77620
++ select GPIOLIB_IRQCHIP
+ help
+ GPIO driver for MAX77620 and MAX20024 PMIC from Maxim Semiconductor.
+ MAX77620 PMIC has 8 pins that can be configured as GPIOs. The
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 1949d6fca53e..f491092f36ff 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -620,6 +620,7 @@
+ #define USB_VENDOR_ID_ITE 0x048d
+ #define USB_DEVICE_ID_ITE_LENOVO_YOGA 0x8386
+ #define USB_DEVICE_ID_ITE_LENOVO_YOGA2 0x8350
++#define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720 0x837a
+ #define USB_DEVICE_ID_ITE_LENOVO_YOGA900 0x8396
+ #define USB_DEVICE_ID_ITE8595 0x8595
+
+@@ -717,6 +718,7 @@
+ #define USB_DEVICE_ID_LG_MULTITOUCH 0x0064
+ #define USB_DEVICE_ID_LG_MELFAS_MT 0x6007
+ #define I2C_DEVICE_ID_LG_8001 0x8001
++#define I2C_DEVICE_ID_LG_7010 0x7010
+
+ #define USB_VENDOR_ID_LOGITECH 0x046d
+ #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
+@@ -1074,6 +1076,7 @@
+ #define USB_DEVICE_ID_SYNAPTICS_LTS2 0x1d10
+ #define USB_DEVICE_ID_SYNAPTICS_HD 0x0ac3
+ #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD 0x1ac3
++#define USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012 0x2968
+ #define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710
+
+ #define USB_VENDOR_ID_TEXAS_INSTRUMENTS 0x2047
+diff --git a/drivers/hid/hid-ite.c b/drivers/hid/hid-ite.c
+index 98b059d79bc8..2ce1eb0c9212 100644
+--- a/drivers/hid/hid-ite.c
++++ b/drivers/hid/hid-ite.c
+@@ -43,6 +43,9 @@ static int ite_event(struct hid_device *hdev, struct hid_field *field,
+ static const struct hid_device_id ite_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE8595) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_258A, USB_DEVICE_ID_258A_6A88) },
++ /* ITE8595 USB kbd ctlr, with Synaptics touchpad connected to it. */
++ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS,
++ USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, ite_devices);
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index f9167d0e095c..19dfd8acd0da 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1007,7 +1007,7 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input,
+ tool = MT_TOOL_DIAL;
+ else if (unlikely(!confidence_state)) {
+ tool = MT_TOOL_PALM;
+- if (!active &&
++ if (!active && mt &&
+ input_mt_is_active(&mt->slots[slotnum])) {
+ /*
+ * The non-confidence was reported for
+@@ -1972,6 +1972,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_LG,
+ HID_USB_DEVICE(USB_VENDOR_ID_LG,
+ USB_DEVICE_ID_LG_MELFAS_MT) },
++ { .driver_data = MT_CLS_LG,
++ HID_DEVICE(BUS_I2C, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_7010) },
+
+ /* MosArt panels */
+ { .driver_data = MT_CLS_CONFIDENCE_MINUS_ONE,
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 57d6fe9ed416..b9529bed4d76 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -175,6 +175,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD2, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
++ { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE), HID_QUIRK_MULTI_INPUT },
+
+ { 0 }
+ };
+diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
+index 8dae0f9b819e..6286204d4c56 100644
+--- a/drivers/hid/hid-steam.c
++++ b/drivers/hid/hid-steam.c
+@@ -768,8 +768,12 @@ static int steam_probe(struct hid_device *hdev,
+
+ if (steam->quirks & STEAM_QUIRK_WIRELESS) {
+ hid_info(hdev, "Steam wireless receiver connected");
++ /* If using a wireless adaptor ask for connection status */
++ steam->connected = false;
+ steam_request_conn_status(steam);
+ } else {
++ /* A wired connection is always present */
++ steam->connected = true;
+ ret = steam_register(steam);
+ if (ret) {
+ hid_err(hdev,
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 0a39e444e308..f2c8c59fc582 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -52,6 +52,8 @@
+ #define I2C_HID_QUIRK_DELAY_AFTER_SLEEP BIT(3)
+ #define I2C_HID_QUIRK_BOGUS_IRQ BIT(4)
+ #define I2C_HID_QUIRK_RESET_ON_RESUME BIT(5)
++#define I2C_HID_QUIRK_BAD_INPUT_SIZE BIT(6)
++
+
+ /* flags */
+ #define I2C_HID_STARTED 0
+@@ -185,6 +187,8 @@ static const struct i2c_hid_quirks {
+ I2C_HID_QUIRK_BOGUS_IRQ },
+ { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID,
+ I2C_HID_QUIRK_RESET_ON_RESUME },
++ { USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720,
++ I2C_HID_QUIRK_BAD_INPUT_SIZE },
+ { 0, 0 }
+ };
+
+@@ -516,9 +520,15 @@ static void i2c_hid_get_input(struct i2c_hid *ihid)
+ }
+
+ if ((ret_size > size) || (ret_size < 2)) {
+- dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
+- __func__, size, ret_size);
+- return;
++ if (ihid->quirks & I2C_HID_QUIRK_BAD_INPUT_SIZE) {
++ ihid->inbuf[0] = size & 0xff;
++ ihid->inbuf[1] = size >> 8;
++ ret_size = size;
++ } else {
++ dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
++ __func__, size, ret_size);
++ return;
++ }
+ }
+
+ i2c_hid_dbg(ihid, "input: %*ph\n", ret_size, ihid->inbuf);
+diff --git a/drivers/iio/gyro/st_gyro_core.c b/drivers/iio/gyro/st_gyro_core.c
+index b31064ba37b9..02f6f263e338 100644
+--- a/drivers/iio/gyro/st_gyro_core.c
++++ b/drivers/iio/gyro/st_gyro_core.c
+@@ -141,7 +141,6 @@ static const struct st_sensor_settings st_gyro_sensors_settings[] = {
+ [2] = LSM330DLC_GYRO_DEV_NAME,
+ [3] = L3G4IS_GYRO_DEV_NAME,
+ [4] = LSM330_GYRO_DEV_NAME,
+- [5] = LSM9DS0_GYRO_DEV_NAME,
+ },
+ .ch = (struct iio_chan_spec *)st_gyro_16bit_channels,
+ .odr = {
+@@ -211,6 +210,80 @@ static const struct st_sensor_settings st_gyro_sensors_settings[] = {
+ .multi_read_bit = true,
+ .bootime = 2,
+ },
++ {
++ .wai = 0xd4,
++ .wai_addr = ST_SENSORS_DEFAULT_WAI_ADDRESS,
++ .sensors_supported = {
++ [0] = LSM9DS0_GYRO_DEV_NAME,
++ },
++ .ch = (struct iio_chan_spec *)st_gyro_16bit_channels,
++ .odr = {
++ .addr = 0x20,
++ .mask = GENMASK(7, 6),
++ .odr_avl = {
++ { .hz = 95, .value = 0x00, },
++ { .hz = 190, .value = 0x01, },
++ { .hz = 380, .value = 0x02, },
++ { .hz = 760, .value = 0x03, },
++ },
++ },
++ .pw = {
++ .addr = 0x20,
++ .mask = BIT(3),
++ .value_on = ST_SENSORS_DEFAULT_POWER_ON_VALUE,
++ .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE,
++ },
++ .enable_axis = {
++ .addr = ST_SENSORS_DEFAULT_AXIS_ADDR,
++ .mask = ST_SENSORS_DEFAULT_AXIS_MASK,
++ },
++ .fs = {
++ .addr = 0x23,
++ .mask = GENMASK(5, 4),
++ .fs_avl = {
++ [0] = {
++ .num = ST_GYRO_FS_AVL_245DPS,
++ .value = 0x00,
++ .gain = IIO_DEGREE_TO_RAD(8750),
++ },
++ [1] = {
++ .num = ST_GYRO_FS_AVL_500DPS,
++ .value = 0x01,
++ .gain = IIO_DEGREE_TO_RAD(17500),
++ },
++ [2] = {
++ .num = ST_GYRO_FS_AVL_2000DPS,
++ .value = 0x02,
++ .gain = IIO_DEGREE_TO_RAD(70000),
++ },
++ },
++ },
++ .bdu = {
++ .addr = 0x23,
++ .mask = BIT(7),
++ },
++ .drdy_irq = {
++ .int2 = {
++ .addr = 0x22,
++ .mask = BIT(3),
++ },
++ /*
++ * The sensor has IHL (active low) and open
++ * drain settings, but only for INT1 and not
++ * for the DRDY line on INT2.
++ */
++ .stat_drdy = {
++ .addr = ST_SENSORS_DEFAULT_STAT_ADDR,
++ .mask = GENMASK(2, 0),
++ },
++ },
++ .sim = {
++ .addr = 0x23,
++ .value = BIT(0),
++ },
++ .multi_read_bit = true,
++ .bootime = 2,
++ },
+ {
+ .wai = 0xd7,
+ .wai_addr = ST_SENSORS_DEFAULT_WAI_ADDRESS,
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index bea19aa33758..0783f44e9afe 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -3709,7 +3709,20 @@ static void set_remap_table_entry(struct amd_iommu *iommu, u16 devid,
+ iommu_flush_dte(iommu, devid);
+ }
+
+-static struct irq_remap_table *alloc_irq_table(u16 devid)
++static int set_remap_table_entry_alias(struct pci_dev *pdev, u16 alias,
++ void *data)
++{
++ struct irq_remap_table *table = data;
++
++ irq_lookup_table[alias] = table;
++ set_dte_irq_entry(alias, table);
++
++ iommu_flush_dte(amd_iommu_rlookup_table[alias], alias);
++
++ return 0;
++}
++
++static struct irq_remap_table *alloc_irq_table(u16 devid, struct pci_dev *pdev)
+ {
+ struct irq_remap_table *table = NULL;
+ struct irq_remap_table *new_table = NULL;
+@@ -3755,7 +3768,12 @@ static struct irq_remap_table *alloc_irq_table(u16 devid)
+ table = new_table;
+ new_table = NULL;
+
+- set_remap_table_entry(iommu, devid, table);
++ if (pdev)
++ pci_for_each_dma_alias(pdev, set_remap_table_entry_alias,
++ table);
++ else
++ set_remap_table_entry(iommu, devid, table);
++
+ if (devid != alias)
+ set_remap_table_entry(iommu, alias, table);
+
+@@ -3772,7 +3790,8 @@ out_unlock:
+ return table;
+ }
+
+-static int alloc_irq_index(u16 devid, int count, bool align)
++static int alloc_irq_index(u16 devid, int count, bool align,
++ struct pci_dev *pdev)
+ {
+ struct irq_remap_table *table;
+ int index, c, alignment = 1;
+@@ -3782,7 +3801,7 @@ static int alloc_irq_index(u16 devid, int count, bool align)
+ if (!iommu)
+ return -ENODEV;
+
+- table = alloc_irq_table(devid);
++ table = alloc_irq_table(devid, pdev);
+ if (!table)
+ return -ENODEV;
+
+@@ -4215,7 +4234,7 @@ static int irq_remapping_alloc(struct irq_domain *domain, unsigned int virq,
+ struct irq_remap_table *table;
+ struct amd_iommu *iommu;
+
+- table = alloc_irq_table(devid);
++ table = alloc_irq_table(devid, NULL);
+ if (table) {
+ if (!table->min_index) {
+ /*
+@@ -4232,11 +4251,15 @@ static int irq_remapping_alloc(struct irq_domain *domain, unsigned int virq,
+ } else {
+ index = -ENOMEM;
+ }
+- } else {
++ } else if (info->type == X86_IRQ_ALLOC_TYPE_MSI ||
++ info->type == X86_IRQ_ALLOC_TYPE_MSIX) {
+ bool align = (info->type == X86_IRQ_ALLOC_TYPE_MSI);
+
+- index = alloc_irq_index(devid, nr_irqs, align);
++ index = alloc_irq_index(devid, nr_irqs, align, info->msi_dev);
++ } else {
++ index = alloc_irq_index(devid, nr_irqs, false, NULL);
+ }
++
+ if (index < 0) {
+ pr_warn("Failed to allocate IRTE\n");
+ ret = index;
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index 9c4042420022..d80372d21c14 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -141,8 +141,12 @@
+
+ #define MEI_DEV_ID_CMP_LP 0x02e0 /* Comet Point LP */
+ #define MEI_DEV_ID_CMP_LP_3 0x02e4 /* Comet Point LP 3 (iTouch) */
++
+ #define MEI_DEV_ID_CMP_V 0xA3BA /* Comet Point Lake V */
+
++#define MEI_DEV_ID_CMP_H 0x06e0 /* Comet Lake H */
++#define MEI_DEV_ID_CMP_H_3 0x06e4 /* Comet Lake H 3 (iTouch) */
++
+ #define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
+
+ #define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index 41a10e392839..3498c10b8263 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -108,6 +108,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP, MEI_ME_PCH12_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP_3, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_V, MEI_ME_PCH12_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_H, MEI_ME_PCH12_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_H_3, MEI_ME_PCH8_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+
+diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
+index e445ab724827..88f8d31e4c83 100644
+--- a/drivers/net/ethernet/broadcom/b44.c
++++ b/drivers/net/ethernet/broadcom/b44.c
+@@ -1519,8 +1519,10 @@ static int b44_magic_pattern(u8 *macaddr, u8 *ppattern, u8 *pmask, int offset)
+ int ethaddr_bytes = ETH_ALEN;
+
+ memset(ppattern + offset, 0xff, magicsync);
+- for (j = 0; j < magicsync; j++)
+- set_bit(len++, (unsigned long *) pmask);
++ for (j = 0; j < magicsync; j++) {
++ pmask[len >> 3] |= BIT(len & 7);
++ len++;
++ }
+
+ for (j = 0; j < B44_MAX_PATTERNS; j++) {
+ if ((B44_PATTERN_SIZE - len) >= ETH_ALEN)
+@@ -1532,7 +1534,8 @@ static int b44_magic_pattern(u8 *macaddr, u8 *ppattern, u8 *pmask, int offset)
+ for (k = 0; k< ethaddr_bytes; k++) {
+ ppattern[offset + magicsync +
+ (j * ETH_ALEN) + k] = macaddr[k];
+- set_bit(len++, (unsigned long *) pmask);
++ pmask[len >> 3] |= BIT(len & 7);
++ len++;
+ }
+ }
+ return len - 1;
+diff --git a/drivers/net/wan/sdla.c b/drivers/net/wan/sdla.c
+index 57ed259c8208..09fde60a5f9d 100644
+--- a/drivers/net/wan/sdla.c
++++ b/drivers/net/wan/sdla.c
+@@ -711,7 +711,7 @@ static netdev_tx_t sdla_transmit(struct sk_buff *skb,
+
+ spin_lock_irqsave(&sdla_lock, flags);
+ SDLA_WINDOW(dev, addr);
+- pbuf = (void *)(((int) dev->mem_start) + (addr & SDLA_ADDR_MASK));
++ pbuf = (void *)(dev->mem_start + (addr & SDLA_ADDR_MASK));
+ __sdla_write(dev, pbuf->buf_addr, skb->data, skb->len);
+ SDLA_WINDOW(dev, addr);
+ pbuf->opp_flag = 1;
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index fb649d85b8fc..dd0c32379375 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -1216,7 +1216,7 @@ err_fw:
+ static int send_eject_command(struct usb_interface *interface)
+ {
+ struct usb_device *udev = interface_to_usbdev(interface);
+- struct usb_host_interface *iface_desc = &interface->altsetting[0];
++ struct usb_host_interface *iface_desc = interface->cur_altsetting;
+ struct usb_endpoint_descriptor *endpoint;
+ unsigned char *cmd;
+ u8 bulk_out_ep;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+index 44ead0fea7c6..6a213fe760ff 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1357,7 +1357,7 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ goto fail;
+ }
+
+- desc = &intf->altsetting[0].desc;
++ desc = &intf->cur_altsetting->desc;
+ if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) ||
+ (desc->bInterfaceSubClass != 2) ||
+ (desc->bInterfaceProtocol != 0xff)) {
+@@ -1370,7 +1370,7 @@ brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
+
+ num_of_eps = desc->bNumEndpoints;
+ for (ep = 0; ep < num_of_eps; ep++) {
+- endpoint = &intf->altsetting[0].endpoint[ep].desc;
++ endpoint = &intf->cur_altsetting->endpoint[ep].desc;
+ endpoint_num = usb_endpoint_num(endpoint);
+ if (!usb_endpoint_xfer_bulk(endpoint))
+ continue;
+diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+index 94ad6fe29e69..2c7dd2a7350c 100644
+--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
++++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+@@ -1611,9 +1611,9 @@ static int ezusb_probe(struct usb_interface *interface,
+ /* set up the endpoint information */
+ /* check out the endpoints */
+
+- iface_desc = &interface->altsetting[0].desc;
++ iface_desc = &interface->cur_altsetting->desc;
+ for (i = 0; i < iface_desc->bNumEndpoints; ++i) {
+- ep = &interface->altsetting[0].endpoint[i].desc;
++ ep = &interface->cur_altsetting->endpoint[i].desc;
+
+ if (usb_endpoint_is_bulk_in(ep)) {
+ /* we found a bulk in endpoint */
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index b2e1523b4dc1..070ea0f456ab 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -5921,7 +5921,7 @@ static int rtl8xxxu_parse_usb(struct rtl8xxxu_priv *priv,
+ u8 dir, xtype, num;
+ int ret = 0;
+
+- host_interface = &interface->altsetting[0];
++ host_interface = interface->cur_altsetting;
+ interface_desc = &host_interface->desc;
+ endpoints = interface_desc->bNumEndpoints;
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
+index 01edf960ff3c..a7b341e95e76 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
+@@ -616,6 +616,7 @@ static int bl_cmd(struct rsi_hw *adapter, u8 cmd, u8 exp_resp, char *str)
+ bl_start_cmd_timer(adapter, timeout);
+ status = bl_write_cmd(adapter, cmd, exp_resp, ®out_val);
+ if (status < 0) {
++ bl_stop_cmd_timer(adapter);
+ rsi_dbg(ERR_ZONE,
+ "%s: Command %s (%0x) writing failed..\n",
+ __func__, str, cmd);
+@@ -731,10 +732,9 @@ static int ping_pong_write(struct rsi_hw *adapter, u8 cmd, u8 *addr, u32 size)
+ }
+
+ status = bl_cmd(adapter, cmd_req, cmd_resp, str);
+- if (status) {
+- bl_stop_cmd_timer(adapter);
++ if (status)
+ return status;
+- }
++
+ return 0;
+ }
+
+@@ -822,10 +822,9 @@ static int auto_fw_upgrade(struct rsi_hw *adapter, u8 *flash_content,
+
+ status = bl_cmd(adapter, EOF_REACHED, FW_LOADING_SUCCESSFUL,
+ "EOF_REACHED");
+- if (status) {
+- bl_stop_cmd_timer(adapter);
++ if (status)
+ return status;
+- }
++
+ rsi_dbg(INFO_ZONE, "FW loading is done and FW is running..\n");
+ return 0;
+ }
+@@ -846,6 +845,7 @@ static int rsi_load_firmware(struct rsi_hw *adapter)
+ status = hif_ops->master_reg_read(adapter, SWBL_REGOUT,
+ ®out_val, 2);
+ if (status < 0) {
++ bl_stop_cmd_timer(adapter);
+ rsi_dbg(ERR_ZONE,
+ "%s: REGOUT read failed\n", __func__);
+ return status;
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index 14e56bee0548..90eb749e2b61 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -16,6 +16,7 @@
+ */
+
+ #include <linux/module.h>
++#include <linux/types.h>
+ #include <net/rsi_91x.h>
+ #include "rsi_usb.h"
+ #include "rsi_hal.h"
+@@ -29,7 +30,7 @@ MODULE_PARM_DESC(dev_oper_mode,
+ "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n"
+ "6[AP + BT classic], 14[AP + BT classic + BT LE]");
+
+-static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num);
++static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num, gfp_t flags);
+
+ /**
+ * rsi_usb_card_write() - This function writes to the USB Card.
+@@ -117,7 +118,7 @@ static int rsi_find_bulk_in_and_out_endpoints(struct usb_interface *interface,
+ __le16 buffer_size;
+ int ii, bin_found = 0, bout_found = 0;
+
+- iface_desc = &(interface->altsetting[0]);
++ iface_desc = interface->cur_altsetting;
+
+ for (ii = 0; ii < iface_desc->desc.bNumEndpoints; ++ii) {
+ endpoint = &(iface_desc->endpoint[ii].desc);
+@@ -283,7 +284,7 @@ static void rsi_rx_done_handler(struct urb *urb)
+ status = 0;
+
+ out:
+- if (rsi_rx_urb_submit(dev->priv, rx_cb->ep_num))
++ if (rsi_rx_urb_submit(dev->priv, rx_cb->ep_num, GFP_ATOMIC))
+ rsi_dbg(ERR_ZONE, "%s: Failed in urb submission", __func__);
+
+ if (status)
+@@ -296,7 +297,7 @@ out:
+ *
+ * Return: 0 on success, a negative error code on failure.
+ */
+-static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num)
++static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num, gfp_t mem_flags)
+ {
+ struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
+ struct rx_usb_ctrl_block *rx_cb = &dev->rx_cb[ep_num - 1];
+@@ -326,9 +327,11 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num)
+ rsi_rx_done_handler,
+ rx_cb);
+
+- status = usb_submit_urb(urb, GFP_KERNEL);
+- if (status)
++ status = usb_submit_urb(urb, mem_flags);
++ if (status) {
+ rsi_dbg(ERR_ZONE, "%s: Failed in urb submission\n", __func__);
++ dev_kfree_skb(skb);
++ }
+
+ return status;
+ }
+@@ -781,12 +784,12 @@ static int rsi_probe(struct usb_interface *pfunction,
+ rsi_dbg(INIT_ZONE, "%s: Device Init Done\n", __func__);
+ }
+
+- status = rsi_rx_urb_submit(adapter, WLAN_EP);
++ status = rsi_rx_urb_submit(adapter, WLAN_EP, GFP_KERNEL);
+ if (status)
+ goto err1;
+
+ if (adapter->priv->coex_mode > 1) {
+- status = rsi_rx_urb_submit(adapter, BT_EP);
++ status = rsi_rx_urb_submit(adapter, BT_EP, GFP_KERNEL);
+ if (status)
+ goto err1;
+ }
+diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
+index c2cda3acd4af..0fddfb464e9c 100644
+--- a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
++++ b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c
+@@ -1275,7 +1275,7 @@ static void print_id(struct usb_device *udev)
+ static int eject_installer(struct usb_interface *intf)
+ {
+ struct usb_device *udev = interface_to_usbdev(intf);
+- struct usb_host_interface *iface_desc = &intf->altsetting[0];
++ struct usb_host_interface *iface_desc = intf->cur_altsetting;
+ struct usb_endpoint_descriptor *endpoint;
+ unsigned char *cmd;
+ u8 bulk_out_ep;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 36f8eb9f24a7..5b4c36ab1596 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3986,6 +3986,40 @@ static void quirk_mic_x200_dma_alias(struct pci_dev *pdev)
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2260, quirk_mic_x200_dma_alias);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2264, quirk_mic_x200_dma_alias);
+
++/*
++ * Intel Visual Compute Accelerator (VCA) is a family of PCIe add-in devices
++ * exposing computational units via Non Transparent Bridges (NTB, PEX 87xx).
++ *
++ * Similarly to MIC x200, we need to add DMA aliases to allow buffer access
++ * when IOMMU is enabled. These aliases allow computational unit access to
++ * host memory. These aliases mark the whole VCA device as one IOMMU
++ * group.
++ *
++ * All possible slot numbers (0x20) are used, since we are unable to tell
++ * what slot is used on other side. This quirk is intended for both host
++ * and computational unit sides. The VCA devices have up to five functions
++ * (four for DMA channels and one additional).
++ */
++static void quirk_pex_vca_alias(struct pci_dev *pdev)
++{
++ const unsigned int num_pci_slots = 0x20;
++ unsigned int slot;
++
++ for (slot = 0; slot < num_pci_slots; slot++) {
++ pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x0));
++ pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x1));
++ pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x2));
++ pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x3));
++ pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x4));
++ }
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2954, quirk_pex_vca_alias);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2955, quirk_pex_vca_alias);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2956, quirk_pex_vca_alias);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2958, quirk_pex_vca_alias);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2959, quirk_pex_vca_alias);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x295A, quirk_pex_vca_alias);
++
+ /*
+ * The IOMMU and interrupt controller on Broadcom Vulcan/Cavium ThunderX2 are
+ * associated not at the root bus, but at a bridge below. This quirk avoids
+diff --git a/drivers/phy/motorola/phy-cpcap-usb.c b/drivers/phy/motorola/phy-cpcap-usb.c
+index 4ba3634009af..593c77dbde2e 100644
+--- a/drivers/phy/motorola/phy-cpcap-usb.c
++++ b/drivers/phy/motorola/phy-cpcap-usb.c
+@@ -115,7 +115,7 @@ struct cpcap_usb_ints_state {
+ enum cpcap_gpio_mode {
+ CPCAP_DM_DP,
+ CPCAP_MDM_RX_TX,
+- CPCAP_UNKNOWN,
++ CPCAP_UNKNOWN_DISABLED, /* Seems to disable USB lines */
+ CPCAP_OTG_DM_DP,
+ };
+
+@@ -379,7 +379,8 @@ static int cpcap_usb_set_uart_mode(struct cpcap_phy_ddata *ddata)
+ {
+ int error;
+
+- error = cpcap_usb_gpio_set_mode(ddata, CPCAP_DM_DP);
++ /* Disable lines to prevent glitches from waking up mdm6600 */
++ error = cpcap_usb_gpio_set_mode(ddata, CPCAP_UNKNOWN_DISABLED);
+ if (error)
+ goto out_err;
+
+@@ -406,6 +407,11 @@ static int cpcap_usb_set_uart_mode(struct cpcap_phy_ddata *ddata)
+ if (error)
+ goto out_err;
+
++ /* Enable UART mode */
++ error = cpcap_usb_gpio_set_mode(ddata, CPCAP_DM_DP);
++ if (error)
++ goto out_err;
++
+ return 0;
+
+ out_err:
+@@ -418,7 +424,8 @@ static int cpcap_usb_set_usb_mode(struct cpcap_phy_ddata *ddata)
+ {
+ int error;
+
+- error = cpcap_usb_gpio_set_mode(ddata, CPCAP_OTG_DM_DP);
++ /* Disable lines to prevent glitches from waking up mdm6600 */
++ error = cpcap_usb_gpio_set_mode(ddata, CPCAP_UNKNOWN_DISABLED);
+ if (error)
+ return error;
+
+@@ -458,6 +465,11 @@ static int cpcap_usb_set_usb_mode(struct cpcap_phy_ddata *ddata)
+ if (error)
+ goto out_err;
+
++ /* Enable USB mode */
++ error = cpcap_usb_gpio_set_mode(ddata, CPCAP_OTG_DM_DP);
++ if (error)
++ goto out_err;
++
+ return 0;
+
+ out_err:
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c
+index 4c470104a0d6..cf515928fed0 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c
+@@ -66,7 +66,7 @@
+ /* QPHY_V3_PCS_MISC_CLAMP_ENABLE register bits */
+ #define CLAMP_EN BIT(0) /* enables i/o clamp_n */
+
+-#define PHY_INIT_COMPLETE_TIMEOUT 1000
++#define PHY_INIT_COMPLETE_TIMEOUT 10000
+ #define POWER_DOWN_DELAY_US_MIN 10
+ #define POWER_DOWN_DELAY_US_MAX 11
+
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index 3433986d5220..949dbc8aab41 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -37,6 +37,7 @@
+
+ struct quirk_entry {
+ bool touchpad_led;
++ bool kbd_led_not_present;
+ bool kbd_led_levels_off_1;
+ bool kbd_missing_ac_tag;
+
+@@ -77,6 +78,10 @@ static struct quirk_entry quirk_dell_latitude_e6410 = {
+ .kbd_led_levels_off_1 = true,
+ };
+
++static struct quirk_entry quirk_dell_inspiron_1012 = {
++ .kbd_led_not_present = true,
++};
++
+ static struct platform_driver platform_driver = {
+ .driver = {
+ .name = "dell-laptop",
+@@ -314,6 +319,24 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
+ },
+ .driver_data = &quirk_dell_latitude_e6410,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "Dell Inspiron 1012",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1012"),
++ },
++ .driver_data = &quirk_dell_inspiron_1012,
++ },
++ {
++ .callback = dmi_matched,
++ .ident = "Dell Inspiron 1018",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1018"),
++ },
++ .driver_data = &quirk_dell_inspiron_1012,
++ },
+ { }
+ };
+
+@@ -1497,6 +1520,9 @@ static void kbd_init(void)
+ {
+ int ret;
+
++ if (quirks && quirks->kbd_led_not_present)
++ return;
++
+ ret = kbd_init_info();
+ kbd_init_tokens();
+
+diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
+index ac2eb89ef7a5..5a47e28e38c1 100644
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -179,9 +179,11 @@ static inline u32 rx_max(struct dw_spi *dws)
+
+ static void dw_writer(struct dw_spi *dws)
+ {
+- u32 max = tx_max(dws);
++ u32 max;
+ u16 txw = 0;
+
++ spin_lock(&dws->buf_lock);
++ max = tx_max(dws);
+ while (max--) {
+ /* Set the tx word if the transfer's original "tx" is not null */
+ if (dws->tx_end - dws->len) {
+@@ -193,13 +195,16 @@ static void dw_writer(struct dw_spi *dws)
+ dw_write_io_reg(dws, DW_SPI_DR, txw);
+ dws->tx += dws->n_bytes;
+ }
++ spin_unlock(&dws->buf_lock);
+ }
+
+ static void dw_reader(struct dw_spi *dws)
+ {
+- u32 max = rx_max(dws);
++ u32 max;
+ u16 rxw;
+
++ spin_lock(&dws->buf_lock);
++ max = rx_max(dws);
+ while (max--) {
+ rxw = dw_read_io_reg(dws, DW_SPI_DR);
+ /* Care rx only if the transfer's original "rx" is not null */
+@@ -211,6 +216,7 @@ static void dw_reader(struct dw_spi *dws)
+ }
+ dws->rx += dws->n_bytes;
+ }
++ spin_unlock(&dws->buf_lock);
+ }
+
+ static void int_error_stop(struct dw_spi *dws, const char *msg)
+@@ -283,18 +289,20 @@ static int dw_spi_transfer_one(struct spi_controller *master,
+ {
+ struct dw_spi *dws = spi_controller_get_devdata(master);
+ struct chip_data *chip = spi_get_ctldata(spi);
++ unsigned long flags;
+ u8 imask = 0;
+ u16 txlevel = 0;
+ u32 cr0;
+ int ret;
+
+ dws->dma_mapped = 0;
+-
++ spin_lock_irqsave(&dws->buf_lock, flags);
+ dws->tx = (void *)transfer->tx_buf;
+ dws->tx_end = dws->tx + transfer->len;
+ dws->rx = transfer->rx_buf;
+ dws->rx_end = dws->rx + transfer->len;
+ dws->len = transfer->len;
++ spin_unlock_irqrestore(&dws->buf_lock, flags);
+
+ spi_enable_chip(dws, 0);
+
+@@ -485,6 +493,7 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws)
+ dws->type = SSI_MOTO_SPI;
+ dws->dma_inited = 0;
+ dws->dma_addr = (dma_addr_t)(dws->paddr + DW_SPI_DR);
++ spin_lock_init(&dws->buf_lock);
+
+ spi_controller_set_devdata(master, dws);
+
+diff --git a/drivers/spi/spi-dw.h b/drivers/spi/spi-dw.h
+index 0168b08364d5..20a09fe79ae7 100644
+--- a/drivers/spi/spi-dw.h
++++ b/drivers/spi/spi-dw.h
+@@ -118,6 +118,7 @@ struct dw_spi {
+ size_t len;
+ void *tx;
+ void *tx_end;
++ spinlock_t buf_lock;
+ void *rx;
+ void *rx_end;
+ int dma_mapped;
+diff --git a/drivers/staging/most/net/net.c b/drivers/staging/most/net/net.c
+index 30d816b7e165..ff80834ef04a 100644
+--- a/drivers/staging/most/net/net.c
++++ b/drivers/staging/most/net/net.c
+@@ -81,6 +81,11 @@ static int skb_to_mamac(const struct sk_buff *skb, struct mbo *mbo)
+ unsigned int payload_len = skb->len - ETH_HLEN;
+ unsigned int mdp_len = payload_len + MDP_HDR_LEN;
+
++ if (mdp_len < skb->len) {
++ pr_err("drop: too large packet! (%u)\n", skb->len);
++ return -EINVAL;
++ }
++
+ if (mbo->buffer_length < mdp_len) {
+ pr_err("drop: too small buffer! (%d for %d)\n",
+ mbo->buffer_length, mdp_len);
+@@ -128,6 +133,11 @@ static int skb_to_mep(const struct sk_buff *skb, struct mbo *mbo)
+ u8 *buff = mbo->virt_address;
+ unsigned int mep_len = skb->len + MEP_HDR_LEN;
+
++ if (mep_len < skb->len) {
++ pr_err("drop: too large packet! (%u)\n", skb->len);
++ return -EINVAL;
++ }
++
+ if (mbo->buffer_length < mep_len) {
+ pr_err("drop: too small buffer! (%d for %d)\n",
+ mbo->buffer_length, mep_len);
+diff --git a/drivers/staging/vt6656/device.h b/drivers/staging/vt6656/device.h
+index cabdda259de2..77e59a92e80b 100644
+--- a/drivers/staging/vt6656/device.h
++++ b/drivers/staging/vt6656/device.h
+@@ -52,6 +52,8 @@
+ #define RATE_AUTO 12
+
+ #define MAX_RATE 12
++#define VNT_B_RATES (BIT(RATE_1M) | BIT(RATE_2M) |\
++ BIT(RATE_5M) | BIT(RATE_11M))
+
+ /*
+ * device specific
+diff --git a/drivers/staging/vt6656/int.c b/drivers/staging/vt6656/int.c
+index 504424b19fcf..af0060c74530 100644
+--- a/drivers/staging/vt6656/int.c
++++ b/drivers/staging/vt6656/int.c
+@@ -97,9 +97,11 @@ static int vnt_int_report_rate(struct vnt_private *priv, u8 pkt_no, u8 tsr)
+
+ info->status.rates[0].count = tx_retry;
+
+- if (!(tsr & (TSR_TMO | TSR_RETRYTMO))) {
++ if (!(tsr & TSR_TMO)) {
+ info->status.rates[0].idx = idx;
+- info->flags |= IEEE80211_TX_STAT_ACK;
++
++ if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
++ info->flags |= IEEE80211_TX_STAT_ACK;
+ }
+
+ ieee80211_tx_status_irqsafe(priv->hw, context->skb);
+diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
+index ff9cf0f9e7de..36562ac94c1f 100644
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -978,6 +978,7 @@ vt6656_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ ieee80211_hw_set(priv->hw, RX_INCLUDES_FCS);
+ ieee80211_hw_set(priv->hw, REPORTS_TX_ACK_STATUS);
+ ieee80211_hw_set(priv->hw, SUPPORTS_PS);
++ ieee80211_hw_set(priv->hw, PS_NULLFUNC_STACK);
+
+ priv->hw->max_signal = 100;
+
+diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
+index 9def0748ffee..4b4f07fbb9bf 100644
+--- a/drivers/staging/vt6656/rxtx.c
++++ b/drivers/staging/vt6656/rxtx.c
+@@ -278,11 +278,9 @@ static u16 vnt_rxtx_datahead_g(struct vnt_usb_send_context *tx_context,
+ PK_TYPE_11B, &buf->b);
+
+ /* Get Duration and TimeStamp */
+- if (ieee80211_is_pspoll(hdr->frame_control)) {
+- __le16 dur = cpu_to_le16(priv->current_aid | BIT(14) | BIT(15));
+-
+- buf->duration_a = dur;
+- buf->duration_b = dur;
++ if (ieee80211_is_nullfunc(hdr->frame_control)) {
++ buf->duration_a = hdr->duration_id;
++ buf->duration_b = hdr->duration_id;
+ } else {
+ buf->duration_a = vnt_get_duration_le(priv,
+ tx_context->pkt_type, need_ack);
+@@ -371,10 +369,8 @@ static u16 vnt_rxtx_datahead_ab(struct vnt_usb_send_context *tx_context,
+ tx_context->pkt_type, &buf->ab);
+
+ /* Get Duration and TimeStampOff */
+- if (ieee80211_is_pspoll(hdr->frame_control)) {
+- __le16 dur = cpu_to_le16(priv->current_aid | BIT(14) | BIT(15));
+-
+- buf->duration = dur;
++ if (ieee80211_is_nullfunc(hdr->frame_control)) {
++ buf->duration = hdr->duration_id;
+ } else {
+ buf->duration = vnt_get_duration_le(priv, tx_context->pkt_type,
+ need_ack);
+@@ -815,10 +811,14 @@ int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
+ if (info->band == NL80211_BAND_5GHZ) {
+ pkt_type = PK_TYPE_11A;
+ } else {
+- if (tx_rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
+- pkt_type = PK_TYPE_11GB;
+- else
+- pkt_type = PK_TYPE_11GA;
++ if (tx_rate->flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
++ if (priv->basic_rates & VNT_B_RATES)
++ pkt_type = PK_TYPE_11GB;
++ else
++ pkt_type = PK_TYPE_11GA;
++ } else {
++ pkt_type = PK_TYPE_11A;
++ }
+ }
+ } else {
+ pkt_type = PK_TYPE_11B;
+diff --git a/drivers/staging/wlan-ng/prism2mgmt.c b/drivers/staging/wlan-ng/prism2mgmt.c
+index 7350fe5d96a3..a8860d2aee68 100644
+--- a/drivers/staging/wlan-ng/prism2mgmt.c
++++ b/drivers/staging/wlan-ng/prism2mgmt.c
+@@ -959,7 +959,7 @@ int prism2mgmt_flashdl_state(struct wlandevice *wlandev, void *msgp)
+ }
+ }
+
+- return 0;
++ return result;
+ }
+
+ /*----------------------------------------------------------------
+diff --git a/drivers/tty/serial/8250/8250_bcm2835aux.c b/drivers/tty/serial/8250/8250_bcm2835aux.c
+index bd53661103eb..3173d98cb42d 100644
+--- a/drivers/tty/serial/8250/8250_bcm2835aux.c
++++ b/drivers/tty/serial/8250/8250_bcm2835aux.c
+@@ -115,7 +115,7 @@ static int bcm2835aux_serial_remove(struct platform_device *pdev)
+ {
+ struct bcm2835aux_data *data = platform_get_drvdata(pdev);
+
+- serial8250_unregister_port(data->uart.port.line);
++ serial8250_unregister_port(data->line);
+ clk_disable_unprepare(data->clk);
+
+ return 0;
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index f52fcbc5c971..6666d2a52bf5 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1199,6 +1199,9 @@ static void dwc3_core_exit_mode(struct dwc3 *dwc)
+ /* do nothing */
+ break;
+ }
++
++ /* de-assert DRVVBUS for HOST and OTG mode */
++ dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE);
+ }
+
+ static void dwc3_get_properties(struct dwc3 *dwc)
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 8fa39e664940..edf7984707b7 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -34,6 +34,7 @@
+ #define PCI_DEVICE_ID_INTEL_GLK 0x31aa
+ #define PCI_DEVICE_ID_INTEL_CNPLP 0x9dee
+ #define PCI_DEVICE_ID_INTEL_CNPH 0xa36e
++#define PCI_DEVICE_ID_INTEL_CNPV 0xa3b0
+ #define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee
+
+ #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
+@@ -340,6 +341,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CNPH),
+ (kernel_ulong_t) &dwc3_pci_intel_properties, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CNPV),
++ (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ICLLP),
+ (kernel_ulong_t) &dwc3_pci_intel_properties, },
+
+diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
+index 7643716b5299..badd38586b54 100644
+--- a/drivers/usb/serial/ir-usb.c
++++ b/drivers/usb/serial/ir-usb.c
+@@ -45,9 +45,10 @@ static int buffer_size;
+ static int xbof = -1;
+
+ static int ir_startup (struct usb_serial *serial);
+-static int ir_open(struct tty_struct *tty, struct usb_serial_port *port);
+-static int ir_prepare_write_buffer(struct usb_serial_port *port,
+- void *dest, size_t size);
++static int ir_write(struct tty_struct *tty, struct usb_serial_port *port,
++ const unsigned char *buf, int count);
++static int ir_write_room(struct tty_struct *tty);
++static void ir_write_bulk_callback(struct urb *urb);
+ static void ir_process_read_urb(struct urb *urb);
+ static void ir_set_termios(struct tty_struct *tty,
+ struct usb_serial_port *port, struct ktermios *old_termios);
+@@ -77,8 +78,9 @@ static struct usb_serial_driver ir_device = {
+ .num_ports = 1,
+ .set_termios = ir_set_termios,
+ .attach = ir_startup,
+- .open = ir_open,
+- .prepare_write_buffer = ir_prepare_write_buffer,
++ .write = ir_write,
++ .write_room = ir_write_room,
++ .write_bulk_callback = ir_write_bulk_callback,
+ .process_read_urb = ir_process_read_urb,
+ };
+
+@@ -195,6 +197,9 @@ static int ir_startup(struct usb_serial *serial)
+ struct usb_irda_cs_descriptor *irda_desc;
+ int rates;
+
++ if (serial->num_bulk_in < 1 || serial->num_bulk_out < 1)
++ return -ENODEV;
++
+ irda_desc = irda_usb_find_class_desc(serial, 0);
+ if (!irda_desc) {
+ dev_err(&serial->dev->dev,
+@@ -251,35 +256,102 @@ static int ir_startup(struct usb_serial *serial)
+ return 0;
+ }
+
+-static int ir_open(struct tty_struct *tty, struct usb_serial_port *port)
++static int ir_write(struct tty_struct *tty, struct usb_serial_port *port,
++ const unsigned char *buf, int count)
+ {
+- int i;
++ struct urb *urb = NULL;
++ unsigned long flags;
++ int ret;
+
+- for (i = 0; i < ARRAY_SIZE(port->write_urbs); ++i)
+- port->write_urbs[i]->transfer_flags = URB_ZERO_PACKET;
++ if (port->bulk_out_size == 0)
++ return -EINVAL;
+
+- /* Start reading from the device */
+- return usb_serial_generic_open(tty, port);
+-}
++ if (count == 0)
++ return 0;
+
+-static int ir_prepare_write_buffer(struct usb_serial_port *port,
+- void *dest, size_t size)
+-{
+- unsigned char *buf = dest;
+- int count;
++ count = min(count, port->bulk_out_size - 1);
++
++ spin_lock_irqsave(&port->lock, flags);
++ if (__test_and_clear_bit(0, &port->write_urbs_free)) {
++ urb = port->write_urbs[0];
++ port->tx_bytes += count;
++ }
++ spin_unlock_irqrestore(&port->lock, flags);
++
++ if (!urb)
++ return 0;
+
+ /*
+ * The first byte of the packet we send to the device contains an
+- * inbound header which indicates an additional number of BOFs and
++ * outbound header which indicates an additional number of BOFs and
+ * a baud rate change.
+ *
+ * See section 5.4.2.2 of the USB IrDA spec.
+ */
+- *buf = ir_xbof | ir_baud;
++ *(u8 *)urb->transfer_buffer = ir_xbof | ir_baud;
++
++ memcpy(urb->transfer_buffer + 1, buf, count);
++
++ urb->transfer_buffer_length = count + 1;
++ urb->transfer_flags = URB_ZERO_PACKET;
++
++ ret = usb_submit_urb(urb, GFP_ATOMIC);
++ if (ret) {
++ dev_err(&port->dev, "failed to submit write urb: %d\n", ret);
++
++ spin_lock_irqsave(&port->lock, flags);
++ __set_bit(0, &port->write_urbs_free);
++ port->tx_bytes -= count;
++ spin_unlock_irqrestore(&port->lock, flags);
++
++ return ret;
++ }
++
++ return count;
++}
++
++static void ir_write_bulk_callback(struct urb *urb)
++{
++ struct usb_serial_port *port = urb->context;
++ int status = urb->status;
++ unsigned long flags;
++
++ spin_lock_irqsave(&port->lock, flags);
++ __set_bit(0, &port->write_urbs_free);
++ port->tx_bytes -= urb->transfer_buffer_length - 1;
++ spin_unlock_irqrestore(&port->lock, flags);
++
++ switch (status) {
++ case 0:
++ break;
++ case -ENOENT:
++ case -ECONNRESET:
++ case -ESHUTDOWN:
++ dev_dbg(&port->dev, "write urb stopped: %d\n", status);
++ return;
++ case -EPIPE:
++ dev_err(&port->dev, "write urb stopped: %d\n", status);
++ return;
++ default:
++ dev_err(&port->dev, "nonzero write-urb status: %d\n", status);
++ break;
++ }
++
++ usb_serial_port_softint(port);
++}
++
++static int ir_write_room(struct tty_struct *tty)
++{
++ struct usb_serial_port *port = tty->driver_data;
++ int count = 0;
++
++ if (port->bulk_out_size == 0)
++ return 0;
++
++ if (test_bit(0, &port->write_urbs_free))
++ count = port->bulk_out_size - 1;
+
+- count = kfifo_out_locked(&port->write_fifo, buf + 1, size - 1,
+- &port->lock);
+- return count + 1;
++ return count;
+ }
+
+ static void ir_process_read_urb(struct urb *urb)
+@@ -332,34 +404,34 @@ static void ir_set_termios(struct tty_struct *tty,
+
+ switch (baud) {
+ case 2400:
+- ir_baud = USB_IRDA_BR_2400;
++ ir_baud = USB_IRDA_LS_2400;
+ break;
+ case 9600:
+- ir_baud = USB_IRDA_BR_9600;
++ ir_baud = USB_IRDA_LS_9600;
+ break;
+ case 19200:
+- ir_baud = USB_IRDA_BR_19200;
++ ir_baud = USB_IRDA_LS_19200;
+ break;
+ case 38400:
+- ir_baud = USB_IRDA_BR_38400;
++ ir_baud = USB_IRDA_LS_38400;
+ break;
+ case 57600:
+- ir_baud = USB_IRDA_BR_57600;
++ ir_baud = USB_IRDA_LS_57600;
+ break;
+ case 115200:
+- ir_baud = USB_IRDA_BR_115200;
++ ir_baud = USB_IRDA_LS_115200;
+ break;
+ case 576000:
+- ir_baud = USB_IRDA_BR_576000;
++ ir_baud = USB_IRDA_LS_576000;
+ break;
+ case 1152000:
+- ir_baud = USB_IRDA_BR_1152000;
++ ir_baud = USB_IRDA_LS_1152000;
+ break;
+ case 4000000:
+- ir_baud = USB_IRDA_BR_4000000;
++ ir_baud = USB_IRDA_LS_4000000;
+ break;
+ default:
+- ir_baud = USB_IRDA_BR_9600;
++ ir_baud = USB_IRDA_LS_9600;
+ baud = 9600;
+ }
+
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index d0bdebd87ce3..1b23741036ee 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -87,12 +87,15 @@ UNUSUAL_DEV(0x2537, 0x1068, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_UAS),
+
+-/* Reported-by: Takeo Nakayama <javhera@gmx.com> */
++/*
++ * Initially Reported-by: Takeo Nakayama <javhera@gmx.com>
++ * UAS Ignore Reported by Steven Ellis <sellis@redhat.com>
++ */
+ UNUSUAL_DEV(0x357d, 0x7788, 0x0000, 0x9999,
+ "JMicron",
+ "JMS566",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+- US_FL_NO_REPORT_OPCODES),
++ US_FL_NO_REPORT_OPCODES | US_FL_IGNORE_UAS),
+
+ /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+ UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x9999,
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index b165c46aca74..709d4de11f40 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -594,6 +594,7 @@ config MAX63XX_WATCHDOG
+ config MAX77620_WATCHDOG
+ tristate "Maxim Max77620 Watchdog Timer"
+ depends on MFD_MAX77620 || COMPILE_TEST
++ select WATCHDOG_CORE
+ help
+ This is the driver for the Max77620 watchdog timer.
+ Say 'Y' here to enable the watchdog timer support for
+diff --git a/drivers/watchdog/rn5t618_wdt.c b/drivers/watchdog/rn5t618_wdt.c
+index e60f55702ab7..d2e79cf70e77 100644
+--- a/drivers/watchdog/rn5t618_wdt.c
++++ b/drivers/watchdog/rn5t618_wdt.c
+@@ -193,6 +193,7 @@ static struct platform_driver rn5t618_wdt_driver = {
+
+ module_platform_driver(rn5t618_wdt_driver);
+
++MODULE_ALIAS("platform:rn5t618-wdt");
+ MODULE_AUTHOR("Beniamino Galvani <b.galvani@gmail.com>");
+ MODULE_DESCRIPTION("RN5T618 watchdog driver");
+ MODULE_LICENSE("GPL v2");
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 766974fe637a..14265b4bbcc0 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -750,7 +750,7 @@ __smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid,
+ {
+ struct close_cancelled_open *cancelled;
+
+- cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL);
++ cancelled = kzalloc(sizeof(*cancelled), GFP_ATOMIC);
+ if (!cancelled)
+ return -ENOMEM;
+
+diff --git a/include/linux/power/smartreflex.h b/include/linux/power/smartreflex.h
+index 7b81dad712de..37d9b70ed8f0 100644
+--- a/include/linux/power/smartreflex.h
++++ b/include/linux/power/smartreflex.h
+@@ -296,6 +296,9 @@ struct omap_sr_data {
+ struct voltagedomain *voltdm;
+ };
+
++
++extern struct omap_sr_data omap_sr_pdata[OMAP_SR_NR];
++
+ #ifdef CONFIG_POWER_AVS_OMAP
+
+ /* Smartreflex module enable/disable interface */
+diff --git a/include/linux/usb/irda.h b/include/linux/usb/irda.h
+index 396d2b043e64..556a801efce3 100644
+--- a/include/linux/usb/irda.h
++++ b/include/linux/usb/irda.h
+@@ -119,11 +119,22 @@ struct usb_irda_cs_descriptor {
+ * 6 - 115200 bps
+ * 7 - 576000 bps
+ * 8 - 1.152 Mbps
+- * 9 - 5 mbps
++ * 9 - 4 Mbps
+ * 10..15 - Reserved
+ */
+ #define USB_IRDA_STATUS_LINK_SPEED 0x0f
+
++#define USB_IRDA_LS_NO_CHANGE 0
++#define USB_IRDA_LS_2400 1
++#define USB_IRDA_LS_9600 2
++#define USB_IRDA_LS_19200 3
++#define USB_IRDA_LS_38400 4
++#define USB_IRDA_LS_57600 5
++#define USB_IRDA_LS_115200 6
++#define USB_IRDA_LS_576000 7
++#define USB_IRDA_LS_1152000 8
++#define USB_IRDA_LS_4000000 9
++
+ /* The following is a 4-bit value used only for
+ * outbound header:
+ *
+diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
+index 75a3f3fdb359..c1162f2fde78 100644
+--- a/include/net/pkt_cls.h
++++ b/include/net/pkt_cls.h
+@@ -206,31 +206,38 @@ __cls_set_class(unsigned long *clp, unsigned long cl)
+ return xchg(clp, cl);
+ }
+
+-static inline unsigned long
+-cls_set_class(struct Qdisc *q, unsigned long *clp, unsigned long cl)
++static inline void
++__tcf_bind_filter(struct Qdisc *q, struct tcf_result *r, unsigned long base)
+ {
+- unsigned long old_cl;
++ unsigned long cl;
+
+- sch_tree_lock(q);
+- old_cl = __cls_set_class(clp, cl);
+- sch_tree_unlock(q);
+- return old_cl;
++ cl = q->ops->cl_ops->bind_tcf(q, base, r->classid);
++ cl = __cls_set_class(&r->class, cl);
++ if (cl)
++ q->ops->cl_ops->unbind_tcf(q, cl);
+ }
+
+ static inline void
+ tcf_bind_filter(struct tcf_proto *tp, struct tcf_result *r, unsigned long base)
+ {
+ struct Qdisc *q = tp->chain->block->q;
+- unsigned long cl;
+
+ /* Check q as it is not set for shared blocks. In that case,
+ * setting class is not supported.
+ */
+ if (!q)
+ return;
+- cl = q->ops->cl_ops->bind_tcf(q, base, r->classid);
+- cl = cls_set_class(q, &r->class, cl);
+- if (cl)
++ sch_tree_lock(q);
++ __tcf_bind_filter(q, r, base);
++ sch_tree_unlock(q);
++}
++
++static inline void
++__tcf_unbind_filter(struct Qdisc *q, struct tcf_result *r)
++{
++ unsigned long cl;
++
++ if ((cl = __cls_set_class(&r->class, 0)) != 0)
+ q->ops->cl_ops->unbind_tcf(q, cl);
+ }
+
+@@ -238,12 +245,10 @@ static inline void
+ tcf_unbind_filter(struct tcf_proto *tp, struct tcf_result *r)
+ {
+ struct Qdisc *q = tp->chain->block->q;
+- unsigned long cl;
+
+ if (!q)
+ return;
+- if ((cl = __cls_set_class(&r->class, 0)) != 0)
+- q->ops->cl_ops->unbind_tcf(q, cl);
++ __tcf_unbind_filter(q, r);
+ }
+
+ struct tcf_exts {
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index c9cd5086bd54..d737a6a2600b 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -273,7 +273,8 @@ struct tcf_proto_ops {
+ int (*reoffload)(struct tcf_proto *tp, bool add,
+ tc_setup_cb_t *cb, void *cb_priv,
+ struct netlink_ext_ack *extack);
+- void (*bind_class)(void *, u32, unsigned long);
++ void (*bind_class)(void *, u32, unsigned long,
++ void *, unsigned long);
+ void * (*tmplt_create)(struct net *net,
+ struct tcf_chain *chain,
+ struct nlattr **tca,
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index f0abb8fe0ae9..7f4f4ab5bfef 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -282,66 +282,72 @@ static inline struct cfs_rq *group_cfs_rq(struct sched_entity *grp)
+ return grp->my_q;
+ }
+
+-static inline void list_add_leaf_cfs_rq(struct cfs_rq *cfs_rq)
++static inline bool list_add_leaf_cfs_rq(struct cfs_rq *cfs_rq)
+ {
+- if (!cfs_rq->on_list) {
+- struct rq *rq = rq_of(cfs_rq);
+- int cpu = cpu_of(rq);
++ struct rq *rq = rq_of(cfs_rq);
++ int cpu = cpu_of(rq);
++
++ if (cfs_rq->on_list)
++ return rq->tmp_alone_branch == &rq->leaf_cfs_rq_list;
++
++ cfs_rq->on_list = 1;
++
++ /*
++ * Ensure we either appear before our parent (if already
++ * enqueued) or force our parent to appear after us when it is
++ * enqueued. The fact that we always enqueue bottom-up
++ * reduces this to two cases and a special case for the root
++ * cfs_rq. Furthermore, it also means that we will always reset
++ * tmp_alone_branch either when the branch is connected
++ * to a tree or when we reach the top of the tree
++ */
++ if (cfs_rq->tg->parent &&
++ cfs_rq->tg->parent->cfs_rq[cpu]->on_list) {
+ /*
+- * Ensure we either appear before our parent (if already
+- * enqueued) or force our parent to appear after us when it is
+- * enqueued. The fact that we always enqueue bottom-up
+- * reduces this to two cases and a special case for the root
+- * cfs_rq. Furthermore, it also means that we will always reset
+- * tmp_alone_branch either when the branch is connected
+- * to a tree or when we reach the beg of the tree
++ * If parent is already on the list, we add the child
++ * just before. Thanks to circular linked property of
++ * the list, this means to put the child at the tail
++ * of the list that starts by parent.
+ */
+- if (cfs_rq->tg->parent &&
+- cfs_rq->tg->parent->cfs_rq[cpu]->on_list) {
+- /*
+- * If parent is already on the list, we add the child
+- * just before. Thanks to circular linked property of
+- * the list, this means to put the child at the tail
+- * of the list that starts by parent.
+- */
+- list_add_tail_rcu(&cfs_rq->leaf_cfs_rq_list,
+- &(cfs_rq->tg->parent->cfs_rq[cpu]->leaf_cfs_rq_list));
+- /*
+- * The branch is now connected to its tree so we can
+- * reset tmp_alone_branch to the beginning of the
+- * list.
+- */
+- rq->tmp_alone_branch = &rq->leaf_cfs_rq_list;
+- } else if (!cfs_rq->tg->parent) {
+- /*
+- * cfs rq without parent should be put
+- * at the tail of the list.
+- */
+- list_add_tail_rcu(&cfs_rq->leaf_cfs_rq_list,
+- &rq->leaf_cfs_rq_list);
+- /*
+- * We have reach the beg of a tree so we can reset
+- * tmp_alone_branch to the beginning of the list.
+- */
+- rq->tmp_alone_branch = &rq->leaf_cfs_rq_list;
+- } else {
+- /*
+- * The parent has not already been added so we want to
+- * make sure that it will be put after us.
+- * tmp_alone_branch points to the beg of the branch
+- * where we will add parent.
+- */
+- list_add_rcu(&cfs_rq->leaf_cfs_rq_list,
+- rq->tmp_alone_branch);
+- /*
+- * update tmp_alone_branch to points to the new beg
+- * of the branch
+- */
+- rq->tmp_alone_branch = &cfs_rq->leaf_cfs_rq_list;
+- }
++ list_add_tail_rcu(&cfs_rq->leaf_cfs_rq_list,
++ &(cfs_rq->tg->parent->cfs_rq[cpu]->leaf_cfs_rq_list));
++ /*
++ * The branch is now connected to its tree so we can
++ * reset tmp_alone_branch to the beginning of the
++ * list.
++ */
++ rq->tmp_alone_branch = &rq->leaf_cfs_rq_list;
++ return true;
++ }
+
+- cfs_rq->on_list = 1;
++ if (!cfs_rq->tg->parent) {
++ /*
++ * cfs rq without parent should be put
++ * at the tail of the list.
++ */
++ list_add_tail_rcu(&cfs_rq->leaf_cfs_rq_list,
++ &rq->leaf_cfs_rq_list);
++ /*
++ * We have reach the top of a tree so we can reset
++ * tmp_alone_branch to the beginning of the list.
++ */
++ rq->tmp_alone_branch = &rq->leaf_cfs_rq_list;
++ return true;
+ }
++
++ /*
++ * The parent has not already been added so we want to
++ * make sure that it will be put after us.
++ * tmp_alone_branch points to the begin of the branch
++ * where we will add parent.
++ */
++ list_add_rcu(&cfs_rq->leaf_cfs_rq_list, rq->tmp_alone_branch);
++ /*
++ * update tmp_alone_branch to points to the new begin
++ * of the branch
++ */
++ rq->tmp_alone_branch = &cfs_rq->leaf_cfs_rq_list;
++ return false;
+ }
+
+ static inline void list_del_leaf_cfs_rq(struct cfs_rq *cfs_rq)
+@@ -352,7 +358,12 @@ static inline void list_del_leaf_cfs_rq(struct cfs_rq *cfs_rq)
+ }
+ }
+
+-/* Iterate through all leaf cfs_rq's on a runqueue: */
++static inline void assert_list_leaf_cfs_rq(struct rq *rq)
++{
++ SCHED_WARN_ON(rq->tmp_alone_branch != &rq->leaf_cfs_rq_list);
++}
++
++/* Iterate through all cfs_rq's on a runqueue in bottom-up order */
+ #define for_each_leaf_cfs_rq(rq, cfs_rq) \
+ list_for_each_entry_rcu(cfs_rq, &rq->leaf_cfs_rq_list, leaf_cfs_rq_list)
+
+@@ -438,14 +449,19 @@ static inline struct cfs_rq *group_cfs_rq(struct sched_entity *grp)
+ return NULL;
+ }
+
+-static inline void list_add_leaf_cfs_rq(struct cfs_rq *cfs_rq)
++static inline bool list_add_leaf_cfs_rq(struct cfs_rq *cfs_rq)
+ {
++ return true;
+ }
+
+ static inline void list_del_leaf_cfs_rq(struct cfs_rq *cfs_rq)
+ {
+ }
+
++static inline void assert_list_leaf_cfs_rq(struct rq *rq)
++{
++}
++
+ #define for_each_leaf_cfs_rq(rq, cfs_rq) \
+ for (cfs_rq = &rq->cfs; cfs_rq; cfs_rq = NULL)
+
+@@ -5005,6 +5021,12 @@ static void __maybe_unused unthrottle_offline_cfs_rqs(struct rq *rq)
+ }
+
+ #else /* CONFIG_CFS_BANDWIDTH */
++
++static inline bool cfs_bandwidth_used(void)
++{
++ return false;
++}
++
+ static inline u64 cfs_rq_clock_task(struct cfs_rq *cfs_rq)
+ {
+ return rq_clock_task(rq_of(cfs_rq));
+@@ -5160,6 +5182,23 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags)
+ if (!se)
+ add_nr_running(rq, 1);
+
++ if (cfs_bandwidth_used()) {
++ /*
++ * When bandwidth control is enabled; the cfs_rq_throttled()
++ * breaks in the above iteration can result in incomplete
++ * leaf list maintenance, resulting in triggering the assertion
++ * below.
++ */
++ for_each_sched_entity(se) {
++ cfs_rq = cfs_rq_of(se);
++
++ if (list_add_leaf_cfs_rq(cfs_rq))
++ break;
++ }
++ }
++
++ assert_list_leaf_cfs_rq(rq);
++
+ hrtick_update(rq);
+ }
+
+diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
+index 6a5dce8baf19..14098da696f2 100644
+--- a/net/sched/cls_basic.c
++++ b/net/sched/cls_basic.c
+@@ -254,12 +254,17 @@ skip:
+ }
+ }
+
+-static void basic_bind_class(void *fh, u32 classid, unsigned long cl)
++static void basic_bind_class(void *fh, u32 classid, unsigned long cl, void *q,
++ unsigned long base)
+ {
+ struct basic_filter *f = fh;
+
+- if (f && f->res.classid == classid)
+- f->res.class = cl;
++ if (f && f->res.classid == classid) {
++ if (cl)
++ __tcf_bind_filter(q, &f->res, base);
++ else
++ __tcf_unbind_filter(q, &f->res);
++ }
+ }
+
+ static int basic_dump(struct net *net, struct tcf_proto *tp, void *fh,
+diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
+index fa6fe2fe0f32..5d100126cbf3 100644
+--- a/net/sched/cls_bpf.c
++++ b/net/sched/cls_bpf.c
+@@ -627,12 +627,17 @@ nla_put_failure:
+ return -1;
+ }
+
+-static void cls_bpf_bind_class(void *fh, u32 classid, unsigned long cl)
++static void cls_bpf_bind_class(void *fh, u32 classid, unsigned long cl,
++ void *q, unsigned long base)
+ {
+ struct cls_bpf_prog *prog = fh;
+
+- if (prog && prog->res.classid == classid)
+- prog->res.class = cl;
++ if (prog && prog->res.classid == classid) {
++ if (cl)
++ __tcf_bind_filter(q, &prog->res, base);
++ else
++ __tcf_unbind_filter(q, &prog->res);
++ }
+ }
+
+ static void cls_bpf_walk(struct tcf_proto *tp, struct tcf_walker *arg)
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index 09b359784629..22415311f324 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -1942,12 +1942,17 @@ nla_put_failure:
+ return -EMSGSIZE;
+ }
+
+-static void fl_bind_class(void *fh, u32 classid, unsigned long cl)
++static void fl_bind_class(void *fh, u32 classid, unsigned long cl, void *q,
++ unsigned long base)
+ {
+ struct cls_fl_filter *f = fh;
+
+- if (f && f->res.classid == classid)
+- f->res.class = cl;
++ if (f && f->res.classid == classid) {
++ if (cl)
++ __tcf_bind_filter(q, &f->res, base);
++ else
++ __tcf_unbind_filter(q, &f->res);
++ }
+ }
+
+ static struct tcf_proto_ops cls_fl_ops __read_mostly = {
+diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
+index 29eeeaf3ea44..cb2c62605fc7 100644
+--- a/net/sched/cls_fw.c
++++ b/net/sched/cls_fw.c
+@@ -432,12 +432,17 @@ nla_put_failure:
+ return -1;
+ }
+
+-static void fw_bind_class(void *fh, u32 classid, unsigned long cl)
++static void fw_bind_class(void *fh, u32 classid, unsigned long cl, void *q,
++ unsigned long base)
+ {
+ struct fw_filter *f = fh;
+
+- if (f && f->res.classid == classid)
+- f->res.class = cl;
++ if (f && f->res.classid == classid) {
++ if (cl)
++ __tcf_bind_filter(q, &f->res, base);
++ else
++ __tcf_unbind_filter(q, &f->res);
++ }
+ }
+
+ static struct tcf_proto_ops cls_fw_ops __read_mostly = {
+diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
+index 621bc1d5b057..40be745db357 100644
+--- a/net/sched/cls_matchall.c
++++ b/net/sched/cls_matchall.c
+@@ -310,12 +310,17 @@ nla_put_failure:
+ return -1;
+ }
+
+-static void mall_bind_class(void *fh, u32 classid, unsigned long cl)
++static void mall_bind_class(void *fh, u32 classid, unsigned long cl, void *q,
++ unsigned long base)
+ {
+ struct cls_mall_head *head = fh;
+
+- if (head && head->res.classid == classid)
+- head->res.class = cl;
++ if (head && head->res.classid == classid) {
++ if (cl)
++ __tcf_bind_filter(q, &head->res, base);
++ else
++ __tcf_unbind_filter(q, &head->res);
++ }
+ }
+
+ static struct tcf_proto_ops cls_mall_ops __read_mostly = {
+diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
+index 0404aa5fa7cb..37ae23db4a44 100644
+--- a/net/sched/cls_route.c
++++ b/net/sched/cls_route.c
+@@ -645,12 +645,17 @@ nla_put_failure:
+ return -1;
+ }
+
+-static void route4_bind_class(void *fh, u32 classid, unsigned long cl)
++static void route4_bind_class(void *fh, u32 classid, unsigned long cl, void *q,
++ unsigned long base)
+ {
+ struct route4_filter *f = fh;
+
+- if (f && f->res.classid == classid)
+- f->res.class = cl;
++ if (f && f->res.classid == classid) {
++ if (cl)
++ __tcf_bind_filter(q, &f->res, base);
++ else
++ __tcf_unbind_filter(q, &f->res);
++ }
+ }
+
+ static struct tcf_proto_ops cls_route4_ops __read_mostly = {
+diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
+index e9ccf7daea7d..6d30a291bcd2 100644
+--- a/net/sched/cls_rsvp.h
++++ b/net/sched/cls_rsvp.h
+@@ -736,12 +736,17 @@ nla_put_failure:
+ return -1;
+ }
+
+-static void rsvp_bind_class(void *fh, u32 classid, unsigned long cl)
++static void rsvp_bind_class(void *fh, u32 classid, unsigned long cl, void *q,
++ unsigned long base)
+ {
+ struct rsvp_filter *f = fh;
+
+- if (f && f->res.classid == classid)
+- f->res.class = cl;
++ if (f && f->res.classid == classid) {
++ if (cl)
++ __tcf_bind_filter(q, &f->res, base);
++ else
++ __tcf_unbind_filter(q, &f->res);
++ }
+ }
+
+ static struct tcf_proto_ops RSVP_OPS __read_mostly = {
+diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
+index 38bb882bb958..edf27365f91c 100644
+--- a/net/sched/cls_tcindex.c
++++ b/net/sched/cls_tcindex.c
+@@ -652,12 +652,17 @@ nla_put_failure:
+ return -1;
+ }
+
+-static void tcindex_bind_class(void *fh, u32 classid, unsigned long cl)
++static void tcindex_bind_class(void *fh, u32 classid, unsigned long cl,
++ void *q, unsigned long base)
+ {
+ struct tcindex_filter_result *r = fh;
+
+- if (r && r->res.classid == classid)
+- r->res.class = cl;
++ if (r && r->res.classid == classid) {
++ if (cl)
++ __tcf_bind_filter(q, &r->res, base);
++ else
++ __tcf_unbind_filter(q, &r->res);
++ }
+ }
+
+ static struct tcf_proto_ops cls_tcindex_ops __read_mostly = {
+diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
+index b2c3406a2cf2..fe246e03fcd9 100644
+--- a/net/sched/cls_u32.c
++++ b/net/sched/cls_u32.c
+@@ -1315,12 +1315,17 @@ static int u32_reoffload(struct tcf_proto *tp, bool add, tc_setup_cb_t *cb,
+ return 0;
+ }
+
+-static void u32_bind_class(void *fh, u32 classid, unsigned long cl)
++static void u32_bind_class(void *fh, u32 classid, unsigned long cl, void *q,
++ unsigned long base)
+ {
+ struct tc_u_knode *n = fh;
+
+- if (n && n->res.classid == classid)
+- n->res.class = cl;
++ if (n && n->res.classid == classid) {
++ if (cl)
++ __tcf_bind_filter(q, &n->res, base);
++ else
++ __tcf_unbind_filter(q, &n->res);
++ }
+ }
+
+ static int u32_dump(struct net *net, struct tcf_proto *tp, void *fh,
+diff --git a/net/sched/ematch.c b/net/sched/ematch.c
+index 750d88d0cfd9..113a133ee544 100644
+--- a/net/sched/ematch.c
++++ b/net/sched/ematch.c
+@@ -242,6 +242,9 @@ static int tcf_em_validate(struct tcf_proto *tp,
+ goto errout;
+
+ if (em->ops->change) {
++ err = -EINVAL;
++ if (em_hdr->flags & TCF_EM_SIMPLE)
++ goto errout;
+ err = em->ops->change(net, data, data_len, em);
+ if (err < 0)
+ goto errout;
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 84fdc4857771..39e319d04bb8 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1803,8 +1803,9 @@ static int tclass_del_notify(struct net *net,
+
+ struct tcf_bind_args {
+ struct tcf_walker w;
+- u32 classid;
++ unsigned long base;
+ unsigned long cl;
++ u32 classid;
+ };
+
+ static int tcf_node_bind(struct tcf_proto *tp, void *n, struct tcf_walker *arg)
+@@ -1815,7 +1816,7 @@ static int tcf_node_bind(struct tcf_proto *tp, void *n, struct tcf_walker *arg)
+ struct Qdisc *q = tcf_block_q(tp->chain->block);
+
+ sch_tree_lock(q);
+- tp->ops->bind_class(n, a->classid, a->cl);
++ tp->ops->bind_class(n, a->classid, a->cl, q, a->base);
+ sch_tree_unlock(q);
+ }
+ return 0;
+@@ -1846,6 +1847,7 @@ static void tc_bind_tclass(struct Qdisc *q, u32 portid, u32 clid,
+
+ arg.w.fn = tcf_node_bind;
+ arg.classid = clid;
++ arg.base = cl;
+ arg.cl = new_cl;
+ tp->ops->walk(tp, &arg.w);
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-02-01 10:37 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-02-01 10:37 UTC (permalink / raw
To: gentoo-commits
commit: b18a46ffd48d9685f90c4ff4441e079b8b9e0692
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 1 10:37:23 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Feb 1 10:37:23 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b18a46ff
Removal of redundant patch
Removed
2500_usb-storage-Disable-UAS-on-JMicron-SATA-enclosure.patch
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 ---
...age-Disable-UAS-on-JMicron-SATA-enclosure.patch | 40 ----------------------
2 files changed, 44 deletions(-)
diff --git a/0000_README b/0000_README
index fcf3d5e..2399ee7 100644
--- a/0000_README
+++ b/0000_README
@@ -455,10 +455,6 @@ Patch: 2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
From: https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-marcel@holtmann.org/raw
Desc: Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758
-Patch: 2500_usb-storage-Disable-UAS-on-JMicron-SATA-enclosure.patch
-From: https://bugzilla.redhat.com/show_bug.cgi?id=1260207#c5
-Desc: Add UAS disable quirk. See bug #640082.
-
Patch: 2600_enable-key-swapping-for-apple-mac.patch
From: https://github.com/free5lot/hid-apple-patched
Desc: This hid-apple patch enables swapping of the FN and left Control keys and some additional on some apple keyboards. See bug #622902
diff --git a/2500_usb-storage-Disable-UAS-on-JMicron-SATA-enclosure.patch b/2500_usb-storage-Disable-UAS-on-JMicron-SATA-enclosure.patch
deleted file mode 100644
index 0dd93ef..0000000
--- a/2500_usb-storage-Disable-UAS-on-JMicron-SATA-enclosure.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From d02a55182307c01136b599fd048b4679f259a84e Mon Sep 17 00:00:00 2001
-From: Laura Abbott <labbott@fedoraproject.org>
-Date: Tue, 8 Sep 2015 09:53:38 -0700
-Subject: [PATCH] usb-storage: Disable UAS on JMicron SATA enclosure
-
-Steve Ellis reported incorrect block sizes and alignement
-offsets with a SATA enclosure. Adding a quirk to disable
-UAS fixes the problems.
-
-Reported-by: Steven Ellis <sellis@redhat.com>
-Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
----
- drivers/usb/storage/unusual_uas.h | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
-index c85ea53..216d93d 100644
---- a/drivers/usb/storage/unusual_uas.h
-+++ b/drivers/usb/storage/unusual_uas.h
-@@ -141,12 +141,15 @@ UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
- USB_SC_DEVICE, USB_PR_DEVICE, NULL,
- US_FL_NO_ATA_1X),
-
--/* Reported-by: Takeo Nakayama <javhera@gmx.com> */
-+/*
-+ * Initially Reported-by: Takeo Nakayama <javhera@gmx.com>
-+ * UAS Ignore Reported by Steven Ellis <sellis@redhat.com>
-+ */
- UNUSUAL_DEV(0x357d, 0x7788, 0x0000, 0x9999,
- "JMicron",
- "JMS566",
- USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-- US_FL_NO_REPORT_OPCODES),
-+ US_FL_NO_REPORT_OPCODES | US_FL_IGNORE_UAS),
-
- /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
- UNUSUAL_DEV(0x4971, 0x1012, 0x0000, 0x9999,
---
-2.4.3
-
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-02-05 17:05 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-02-05 17:05 UTC (permalink / raw
To: gentoo-commits
commit: c4181dc6ce2cfbd67ab78a5e9e23474e0a2e5c71
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 5 17:05:05 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Feb 5 17:05:05 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c4181dc6
Linuxpatch 4.19.102
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1101_linux-4.19.102.patch | 2428 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2432 insertions(+)
diff --git a/0000_README b/0000_README
index 2399ee7..0d9cae4 100644
--- a/0000_README
+++ b/0000_README
@@ -443,6 +443,10 @@ Patch: 1100_linux-4.19.101.patch
From: https://www.kernel.org
Desc: Linux 4.19.101
+Patch: 1101_linux-4.19.102.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.102
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1101_linux-4.19.102.patch b/1101_linux-4.19.102.patch
new file mode 100644
index 0000000..ade97ea
--- /dev/null
+++ b/1101_linux-4.19.102.patch
@@ -0,0 +1,2428 @@
+diff --git a/Documentation/ABI/testing/sysfs-class-devfreq b/Documentation/ABI/testing/sysfs-class-devfreq
+index ee39acacf6f8..335595a79866 100644
+--- a/Documentation/ABI/testing/sysfs-class-devfreq
++++ b/Documentation/ABI/testing/sysfs-class-devfreq
+@@ -7,6 +7,13 @@ Description:
+ The name of devfreq object denoted as ... is same as the
+ name of device using devfreq.
+
++What: /sys/class/devfreq/.../name
++Date: November 2019
++Contact: Chanwoo Choi <cw00.choi@samsung.com>
++Description:
++ The /sys/class/devfreq/.../name shows the name of device
++ of the corresponding devfreq object.
++
+ What: /sys/class/devfreq/.../governor
+ Date: September 2011
+ Contact: MyungJoo Ham <myungjoo.ham@samsung.com>
+diff --git a/Makefile b/Makefile
+index ca186bcc02ba..597a14e2127b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 101
++SUBLEVEL = 102
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am335x-boneblack-common.dtsi b/arch/arm/boot/dts/am335x-boneblack-common.dtsi
+index 21bc1173fa6b..cb4267edde63 100644
+--- a/arch/arm/boot/dts/am335x-boneblack-common.dtsi
++++ b/arch/arm/boot/dts/am335x-boneblack-common.dtsi
+@@ -131,6 +131,11 @@
+ };
+
+ / {
++ memory@80000000 {
++ device_type = "memory";
++ reg = <0x80000000 0x20000000>; /* 512 MB */
++ };
++
+ clk_mcasp0_fixed: clk_mcasp0_fixed {
+ #clock-cells = <0>;
+ compatible = "fixed-clock";
+diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
+index 12735cf9674b..b6950eee550b 100644
+--- a/arch/arm/boot/dts/am43x-epos-evm.dts
++++ b/arch/arm/boot/dts/am43x-epos-evm.dts
+@@ -839,6 +839,7 @@
+ pinctrl-names = "default", "sleep";
+ pinctrl-0 = <&spi0_pins_default>;
+ pinctrl-1 = <&spi0_pins_sleep>;
++ ti,pindir-d0-out-d1-in = <1>;
+ };
+
+ &spi1 {
+@@ -846,6 +847,7 @@
+ pinctrl-names = "default", "sleep";
+ pinctrl-0 = <&spi1_pins_default>;
+ pinctrl-1 = <&spi1_pins_sleep>;
++ ti,pindir-d0-out-d1-in = <1>;
+ };
+
+ &usb2_phy1 {
+diff --git a/arch/arm/boot/dts/am571x-idk.dts b/arch/arm/boot/dts/am571x-idk.dts
+index bf4163eb6b2a..510f61d20b6d 100644
+--- a/arch/arm/boot/dts/am571x-idk.dts
++++ b/arch/arm/boot/dts/am571x-idk.dts
+@@ -93,10 +93,6 @@
+ gpios = <&gpio5 18 GPIO_ACTIVE_HIGH>;
+ };
+
+-&pcie1_ep {
+- gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
+-};
+-
+ &mmc1 {
+ pinctrl-names = "default", "hs";
+ pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
+diff --git a/arch/arm/boot/dts/am572x-idk-common.dtsi b/arch/arm/boot/dts/am572x-idk-common.dtsi
+index 784639ddf451..8a7d34c8ae11 100644
+--- a/arch/arm/boot/dts/am572x-idk-common.dtsi
++++ b/arch/arm/boot/dts/am572x-idk-common.dtsi
+@@ -71,10 +71,6 @@
+ gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
+ };
+
+-&pcie1_ep {
+- gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
+-};
+-
+ &mailbox5 {
+ status = "okay";
+ mbox_ipu1_ipc3x: mbox_ipu1_ipc3x {
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+index d53532b47947..0051b2e05c2d 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
++++ b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+@@ -32,6 +32,27 @@
+ reg = <0x0 0x80000000 0x0 0x80000000>;
+ };
+
++ main_12v0: fixedregulator-main_12v0 {
++ /* main supply */
++ compatible = "regulator-fixed";
++ regulator-name = "main_12v0";
++ regulator-min-microvolt = <12000000>;
++ regulator-max-microvolt = <12000000>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
++ evm_5v0: fixedregulator-evm_5v0 {
++ /* Output of TPS54531D */
++ compatible = "regulator-fixed";
++ regulator-name = "evm_5v0";
++ regulator-min-microvolt = <5000000>;
++ regulator-max-microvolt = <5000000>;
++ vin-supply = <&main_12v0>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
+ vdd_3v3: fixedregulator-vdd_3v3 {
+ compatible = "regulator-fixed";
+ regulator-name = "vdd_3v3";
+@@ -550,10 +571,6 @@
+ gpios = <&gpio2 8 GPIO_ACTIVE_LOW>;
+ };
+
+-&pcie1_ep {
+- gpios = <&gpio2 8 GPIO_ACTIVE_LOW>;
+-};
+-
+ &mcasp3 {
+ #sound-dai-cells = <0>;
+ assigned-clocks = <&l4per_clkctrl DRA7_MCASP3_CLKCTRL 24>;
+diff --git a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+index e5f0645e53a7..7e74ba83f809 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+@@ -90,7 +90,7 @@
+ initial-mode = <1>; /* initialize in HUB mode */
+ disabled-ports = <1>;
+ intn-gpios = <&pio 7 5 GPIO_ACTIVE_HIGH>; /* PH5 */
+- reset-gpios = <&pio 4 16 GPIO_ACTIVE_HIGH>; /* PE16 */
++ reset-gpios = <&pio 4 16 GPIO_ACTIVE_LOW>; /* PE16 */
+ connect-gpios = <&pio 4 17 GPIO_ACTIVE_HIGH>; /* PE17 */
+ refclk-frequency = <19200000>;
+ };
+diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
+index 82a942894fc0..83e463c05dcd 100644
+--- a/arch/arm/kernel/hyp-stub.S
++++ b/arch/arm/kernel/hyp-stub.S
+@@ -159,10 +159,9 @@ ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE
+ #if !defined(ZIMAGE) && defined(CONFIG_ARM_ARCH_TIMER)
+ @ make CNTP_* and CNTPCT accessible from PL1
+ mrc p15, 0, r7, c0, c1, 1 @ ID_PFR1
+- lsr r7, #16
+- and r7, #0xf
+- cmp r7, #1
+- bne 1f
++ ubfx r7, r7, #16, #4
++ teq r7, #0
++ beq 1f
+ mrc p15, 4, r7, c14, c1, 0 @ CNTHCTL
+ orr r7, r7, #3 @ PL1PCEN | PL1PCTEN
+ mcr p15, 4, r7, c14, c1, 0 @ CNTHCTL
+diff --git a/arch/arm64/boot/Makefile b/arch/arm64/boot/Makefile
+index 1f012c506434..cd3414898d10 100644
+--- a/arch/arm64/boot/Makefile
++++ b/arch/arm64/boot/Makefile
+@@ -16,7 +16,7 @@
+
+ OBJCOPYFLAGS_Image :=-O binary -R .note -R .note.gnu.build-id -R .comment -S
+
+-targets := Image Image.gz
++targets := Image Image.bz2 Image.gz Image.lz4 Image.lzma Image.lzo
+
+ $(obj)/Image: vmlinux FORCE
+ $(call if_changed,objcopy)
+diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
+index a1a5e4c59e6b..4d5ad9cb0f69 100644
+--- a/arch/parisc/kernel/drivers.c
++++ b/arch/parisc/kernel/drivers.c
+@@ -868,8 +868,8 @@ static void print_parisc_device(struct parisc_device *dev)
+ static int count;
+
+ print_pa_hwpath(dev, hw_path);
+- pr_info("%d. %s at 0x%px [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
+- ++count, dev->name, (void*) dev->hpa.start, hw_path, dev->id.hw_type,
++ pr_info("%d. %s at %pap [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
++ ++count, dev->name, &(dev->hpa.start), hw_path, dev->id.hw_type,
+ dev->id.hversion_rev, dev->id.hversion, dev->id.sversion);
+
+ if (dev->num_addrs) {
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
+index e1a961f05dcd..baa0c503e741 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
+@@ -63,6 +63,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy0: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
+index c288f3c6c637..93095600e808 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
+@@ -60,6 +60,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy6: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
+index 94f3e7175012..ff4bd38f0645 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
+@@ -63,6 +63,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy1: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
+index 94a76982d214..1fa38ed6f59e 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
+@@ -60,6 +60,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy7: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
+index b5ff5f71c6b8..a8cc9780c0c4 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy0: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
+index ee44182c6348..8b8bd70c9382 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy1: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
+index f05f0d775039..619c880b54d8 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe5000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy2: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
+index a9114ec51075..d7ebb73a400d 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe7000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy3: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
+index 44dd00ac7367..b151d696a069 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe9000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy4: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
+index 5b1b84b58602..adc0ae0013a3 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xeb000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy5: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
+index 0e1daaef9e74..435047e0e250 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
+@@ -60,6 +60,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy14: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
+index 68c5ef779266..c098657cca0a 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
+@@ -60,6 +60,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy15: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
+index 605363cc1117..9d06824815f3 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy8: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
+index 1955dfa13634..70e947730c4b 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy9: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
+index 2c1476454ee0..ad96e6529595 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe5000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy10: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
+index b8b541ff5fb0..034bc4b71f7a 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe7000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy11: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
+index 4b2cfddd1b15..93ca23d82b39 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe9000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy12: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
+index 0a52ddf7cc17..23b3117a2fd2 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xeb000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy13: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
+index eed1c137f618..87f71a6cd3ef 100644
+--- a/arch/riscv/kernel/vdso/Makefile
++++ b/arch/riscv/kernel/vdso/Makefile
+@@ -55,7 +55,8 @@ quiet_cmd_vdsold = VDSOLD $@
+ cmd_vdsold = $(CC) $(KBUILD_CFLAGS) $(call cc-option, -no-pie) -nostdlib -nostartfiles $(SYSCFLAGS_$(@F)) \
+ -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp && \
+ $(CROSS_COMPILE)objcopy \
+- $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@
++ $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@ && \
++ rm $@.tmp
+
+ # install commands for the unstripped file
+ quiet_cmd_vdso_install = INSTALL $@
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index 841a0246eb89..11c5accfa4db 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -2005,7 +2005,7 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,
+
+ if (rdt_mon_capable) {
+ ret = mongroup_create_dir(rdtgroup_default.kn,
+- NULL, "mon_groups",
++ &rdtgroup_default, "mon_groups",
+ &kn_mongrp);
+ if (ret) {
+ dentry = ERR_PTR(ret);
+@@ -2167,7 +2167,11 @@ static void free_all_child_rdtgrp(struct rdtgroup *rdtgrp)
+ list_for_each_entry_safe(sentry, stmp, head, mon.crdtgrp_list) {
+ free_rmid(sentry->mon.rmid);
+ list_del(&sentry->mon.crdtgrp_list);
+- kfree(sentry);
++
++ if (atomic_read(&sentry->waitcount) != 0)
++ sentry->flags = RDT_DELETED;
++ else
++ kfree(sentry);
+ }
+ }
+
+@@ -2205,7 +2209,11 @@ static void rmdir_all_sub(void)
+
+ kernfs_remove(rdtgrp->kn);
+ list_del(&rdtgrp->rdtgroup_list);
+- kfree(rdtgrp);
++
++ if (atomic_read(&rdtgrp->waitcount) != 0)
++ rdtgrp->flags = RDT_DELETED;
++ else
++ kfree(rdtgrp);
+ }
+ /* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */
+ update_closid_rmid(cpu_online_mask, &rdtgroup_default);
+@@ -2407,7 +2415,7 @@ static int mkdir_mondata_all(struct kernfs_node *parent_kn,
+ /*
+ * Create the mon_data directory first.
+ */
+- ret = mongroup_create_dir(parent_kn, NULL, "mon_data", &kn);
++ ret = mongroup_create_dir(parent_kn, prgrp, "mon_data", &kn);
+ if (ret)
+ return ret;
+
+@@ -2560,7 +2568,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
+ uint files = 0;
+ int ret;
+
+- prdtgrp = rdtgroup_kn_lock_live(prgrp_kn);
++ prdtgrp = rdtgroup_kn_lock_live(parent_kn);
+ rdt_last_cmd_clear();
+ if (!prdtgrp) {
+ ret = -ENODEV;
+@@ -2635,7 +2643,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
+ kernfs_activate(kn);
+
+ /*
+- * The caller unlocks the prgrp_kn upon success.
++ * The caller unlocks the parent_kn upon success.
+ */
+ return 0;
+
+@@ -2646,7 +2654,7 @@ out_destroy:
+ out_free_rgrp:
+ kfree(rdtgrp);
+ out_unlock:
+- rdtgroup_kn_unlock(prgrp_kn);
++ rdtgroup_kn_unlock(parent_kn);
+ return ret;
+ }
+
+@@ -2684,7 +2692,7 @@ static int rdtgroup_mkdir_mon(struct kernfs_node *parent_kn,
+ */
+ list_add_tail(&rdtgrp->mon.crdtgrp_list, &prgrp->mon.crdtgrp_list);
+
+- rdtgroup_kn_unlock(prgrp_kn);
++ rdtgroup_kn_unlock(parent_kn);
+ return ret;
+ }
+
+@@ -2727,7 +2735,7 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn,
+ * Create an empty mon_groups directory to hold the subset
+ * of tasks and cpus to monitor.
+ */
+- ret = mongroup_create_dir(kn, NULL, "mon_groups", NULL);
++ ret = mongroup_create_dir(kn, rdtgrp, "mon_groups", NULL);
+ if (ret) {
+ rdt_last_cmd_puts("kernfs subdir error\n");
+ goto out_del_list;
+@@ -2743,7 +2751,7 @@ out_id_free:
+ out_common_fail:
+ mkdir_rdt_prepare_clean(rdtgrp);
+ out_unlock:
+- rdtgroup_kn_unlock(prgrp_kn);
++ rdtgroup_kn_unlock(parent_kn);
+ return ret;
+ }
+
+@@ -2869,13 +2877,13 @@ static int rdtgroup_rmdir_ctrl(struct kernfs_node *kn, struct rdtgroup *rdtgrp,
+ closid_free(rdtgrp->closid);
+ free_rmid(rdtgrp->mon.rmid);
+
++ rdtgroup_ctrl_remove(kn, rdtgrp);
++
+ /*
+ * Free all the child monitor group rmids.
+ */
+ free_all_child_rdtgrp(rdtgrp);
+
+- rdtgroup_ctrl_remove(kn, rdtgrp);
+-
+ return 0;
+ }
+
+diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
+index a5718c0a3dc4..1348541da463 100644
+--- a/crypto/pcrypt.c
++++ b/crypto/pcrypt.c
+@@ -505,11 +505,12 @@ err:
+
+ static void __exit pcrypt_exit(void)
+ {
++ crypto_unregister_template(&pcrypt_tmpl);
++
+ pcrypt_fini_padata(&pencrypt);
+ pcrypt_fini_padata(&pdecrypt);
+
+ kset_unregister(pcrypt_kset);
+- crypto_unregister_template(&pcrypt_tmpl);
+ }
+
+ module_init(pcrypt_init);
+diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
+index 67549ce88cc9..774748497ace 100644
+--- a/drivers/char/ttyprintk.c
++++ b/drivers/char/ttyprintk.c
+@@ -18,10 +18,11 @@
+ #include <linux/serial.h>
+ #include <linux/tty.h>
+ #include <linux/module.h>
++#include <linux/spinlock.h>
+
+ struct ttyprintk_port {
+ struct tty_port port;
+- struct mutex port_write_mutex;
++ spinlock_t spinlock;
+ };
+
+ static struct ttyprintk_port tpk_port;
+@@ -100,11 +101,12 @@ static int tpk_open(struct tty_struct *tty, struct file *filp)
+ static void tpk_close(struct tty_struct *tty, struct file *filp)
+ {
+ struct ttyprintk_port *tpkp = tty->driver_data;
++ unsigned long flags;
+
+- mutex_lock(&tpkp->port_write_mutex);
++ spin_lock_irqsave(&tpkp->spinlock, flags);
+ /* flush tpk_printk buffer */
+ tpk_printk(NULL, 0);
+- mutex_unlock(&tpkp->port_write_mutex);
++ spin_unlock_irqrestore(&tpkp->spinlock, flags);
+
+ tty_port_close(&tpkp->port, tty, filp);
+ }
+@@ -116,13 +118,14 @@ static int tpk_write(struct tty_struct *tty,
+ const unsigned char *buf, int count)
+ {
+ struct ttyprintk_port *tpkp = tty->driver_data;
++ unsigned long flags;
+ int ret;
+
+
+ /* exclusive use of tpk_printk within this tty */
+- mutex_lock(&tpkp->port_write_mutex);
++ spin_lock_irqsave(&tpkp->spinlock, flags);
+ ret = tpk_printk(buf, count);
+- mutex_unlock(&tpkp->port_write_mutex);
++ spin_unlock_irqrestore(&tpkp->spinlock, flags);
+
+ return ret;
+ }
+@@ -172,7 +175,7 @@ static int __init ttyprintk_init(void)
+ {
+ int ret = -ENOMEM;
+
+- mutex_init(&tpk_port.port_write_mutex);
++ spin_lock_init(&tpk_port.spinlock);
+
+ ttyprintk_driver = tty_alloc_driver(1,
+ TTY_DRIVER_RESET_TERMIOS |
+diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
+index d083b860f083..10689d8cd386 100644
+--- a/drivers/clk/mmp/clk-of-mmp2.c
++++ b/drivers/clk/mmp/clk-of-mmp2.c
+@@ -134,7 +134,7 @@ static DEFINE_SPINLOCK(ssp3_lock);
+ static const char *ssp_parent_names[] = {"vctcxo_4", "vctcxo_2", "vctcxo", "pll1_16"};
+
+ static DEFINE_SPINLOCK(timer_lock);
+-static const char *timer_parent_names[] = {"clk32", "vctcxo_2", "vctcxo_4", "vctcxo"};
++static const char *timer_parent_names[] = {"clk32", "vctcxo_4", "vctcxo_2", "vctcxo"};
+
+ static DEFINE_SPINLOCK(reset_lock);
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
+index 8d05d4f1f8a1..28b84c701a7d 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
+@@ -23,9 +23,9 @@
+ */
+
+ static const char * const ar100_r_apb2_parents[] = { "osc24M", "osc32k",
+- "pll-periph0", "iosc" };
++ "iosc", "pll-periph0" };
+ static const struct ccu_mux_var_prediv ar100_r_apb2_predivs[] = {
+- { .index = 2, .shift = 0, .width = 5 },
++ { .index = 3, .shift = 0, .width = 5 },
+ };
+
+ static struct ccu_div ar100_clk = {
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 1229bfb3180e..8122d0e0d4c4 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -1014,6 +1014,14 @@ err_out:
+ }
+ EXPORT_SYMBOL(devfreq_remove_governor);
+
++static ssize_t name_show(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ struct devfreq *devfreq = to_devfreq(dev);
++ return sprintf(buf, "%s\n", dev_name(devfreq->dev.parent));
++}
++static DEVICE_ATTR_RO(name);
++
+ static ssize_t governor_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+@@ -1330,6 +1338,7 @@ static ssize_t trans_stat_show(struct device *dev,
+ static DEVICE_ATTR_RO(trans_stat);
+
+ static struct attribute *devfreq_attrs[] = {
++ &dev_attr_name.attr,
+ &dev_attr_governor.attr,
+ &dev_attr_available_governors.attr,
+ &dev_attr_cur_freq.attr,
+diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
+index ae7540b765e1..aa12fd266389 100644
+--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
+@@ -483,10 +483,10 @@ static int si470x_i2c_remove(struct i2c_client *client)
+
+ free_irq(client->irq, radio);
+ video_unregister_device(&radio->videodev);
+- kfree(radio);
+
+ v4l2_ctrl_handler_free(&radio->hdl);
+ v4l2_device_unregister(&radio->v4l2_dev);
++ kfree(radio);
+ return 0;
+ }
+
+diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
+index 25871979123f..d2737460c9d3 100644
+--- a/drivers/media/usb/dvb-usb/af9005.c
++++ b/drivers/media/usb/dvb-usb/af9005.c
+@@ -563,7 +563,7 @@ static int af9005_boot_packet(struct usb_device *udev, int type, u8 *reply,
+ u8 *buf, int size)
+ {
+ u16 checksum;
+- int act_len, i, ret;
++ int act_len = 0, i, ret;
+
+ memset(buf, 0, size);
+ buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff);
+diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c
+index 49b9d63e5885..e66df4fd1a29 100644
+--- a/drivers/media/usb/dvb-usb/digitv.c
++++ b/drivers/media/usb/dvb-usb/digitv.c
+@@ -233,18 +233,22 @@ static struct rc_map_table rc_map_digitv_table[] = {
+
+ static int digitv_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
+ {
+- int i;
++ int ret, i;
+ u8 key[5];
+ u8 b[4] = { 0 };
+
+ *event = 0;
+ *state = REMOTE_NO_KEY_PRESSED;
+
+- digitv_ctrl_msg(d,USB_READ_REMOTE,0,NULL,0,&key[1],4);
++ ret = digitv_ctrl_msg(d, USB_READ_REMOTE, 0, NULL, 0, &key[1], 4);
++ if (ret)
++ return ret;
+
+ /* Tell the device we've read the remote. Not sure how necessary
+ this is, but the Nebula SDK does it. */
+- digitv_ctrl_msg(d,USB_WRITE_REMOTE,0,b,4,NULL,0);
++ ret = digitv_ctrl_msg(d, USB_WRITE_REMOTE, 0, b, 4, NULL, 0);
++ if (ret)
++ return ret;
+
+ /* if something is inside the buffer, simulate key press */
+ if (key[1] != 0)
+diff --git a/drivers/media/usb/dvb-usb/dvb-usb-urb.c b/drivers/media/usb/dvb-usb/dvb-usb-urb.c
+index c1b4e94a37f8..2aabf90d8697 100644
+--- a/drivers/media/usb/dvb-usb/dvb-usb-urb.c
++++ b/drivers/media/usb/dvb-usb/dvb-usb-urb.c
+@@ -12,7 +12,7 @@
+ int dvb_usb_generic_rw(struct dvb_usb_device *d, u8 *wbuf, u16 wlen, u8 *rbuf,
+ u16 rlen, int delay_ms)
+ {
+- int actlen,ret = -ENOMEM;
++ int actlen = 0, ret = -ENOMEM;
+
+ if (!d || wbuf == NULL || wlen == 0)
+ return -EINVAL;
+diff --git a/drivers/media/usb/dvb-usb/vp7045.c b/drivers/media/usb/dvb-usb/vp7045.c
+index e2c8a8530554..445d3e4c3de5 100644
+--- a/drivers/media/usb/dvb-usb/vp7045.c
++++ b/drivers/media/usb/dvb-usb/vp7045.c
+@@ -99,10 +99,14 @@ static int vp7045_power_ctrl(struct dvb_usb_device *d, int onoff)
+
+ static int vp7045_rc_query(struct dvb_usb_device *d)
+ {
++ int ret;
+ u8 key;
+- vp7045_usb_op(d,RC_VAL_READ,NULL,0,&key,1,20);
+
+- deb_rc("remote query key: %x %d\n",key,key);
++ ret = vp7045_usb_op(d, RC_VAL_READ, NULL, 0, &key, 1, 20);
++ if (ret)
++ return ret;
++
++ deb_rc("remote query key: %x\n", key);
+
+ if (key != 0x44) {
+ /*
+@@ -118,15 +122,18 @@ static int vp7045_rc_query(struct dvb_usb_device *d)
+
+ static int vp7045_read_eeprom(struct dvb_usb_device *d,u8 *buf, int len, int offset)
+ {
+- int i = 0;
+- u8 v,br[2];
++ int i, ret;
++ u8 v, br[2];
+ for (i=0; i < len; i++) {
+ v = offset + i;
+- vp7045_usb_op(d,GET_EE_VALUE,&v,1,br,2,5);
++ ret = vp7045_usb_op(d, GET_EE_VALUE, &v, 1, br, 2, 5);
++ if (ret)
++ return ret;
++
+ buf[i] = br[1];
+ }
+- deb_info("VP7045 EEPROM read (offs: %d, len: %d) : ",offset, i);
+- debug_dump(buf,i,deb_info);
++ deb_info("VP7045 EEPROM read (offs: %d, len: %d) : ", offset, i);
++ debug_dump(buf, i, deb_info);
+ return 0;
+ }
+
+diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
+index b12356c533a6..c9a2b29a60a5 100644
+--- a/drivers/media/usb/gspca/gspca.c
++++ b/drivers/media/usb/gspca/gspca.c
+@@ -1473,7 +1473,7 @@ int gspca_dev_probe2(struct usb_interface *intf,
+ pr_err("couldn't kzalloc gspca struct\n");
+ return -ENOMEM;
+ }
+- gspca_dev->usb_buf = kmalloc(USB_BUF_SZ, GFP_KERNEL);
++ gspca_dev->usb_buf = kzalloc(USB_BUF_SZ, GFP_KERNEL);
+ if (!gspca_dev->usb_buf) {
+ pr_err("out of memory\n");
+ ret = -ENOMEM;
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 02a4187d81bd..c93609007670 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -72,7 +72,7 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)
+
+ /* Force link status for IMP port */
+ reg = core_readl(priv, offset);
+- reg |= (MII_SW_OR | LINK_STS);
++ reg |= (MII_SW_OR | LINK_STS | GMII_SPEED_UP_2G);
+ core_writel(priv, reg, offset);
+
+ /* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 2f61175f5655..5cf85a89016e 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8215,11 +8215,23 @@ static bool bnxt_fltr_match(struct bnxt_ntuple_filter *f1,
+ struct flow_keys *keys1 = &f1->fkeys;
+ struct flow_keys *keys2 = &f2->fkeys;
+
+- if (keys1->addrs.v4addrs.src == keys2->addrs.v4addrs.src &&
+- keys1->addrs.v4addrs.dst == keys2->addrs.v4addrs.dst &&
+- keys1->ports.ports == keys2->ports.ports &&
+- keys1->basic.ip_proto == keys2->basic.ip_proto &&
+- keys1->basic.n_proto == keys2->basic.n_proto &&
++ if (keys1->basic.n_proto != keys2->basic.n_proto ||
++ keys1->basic.ip_proto != keys2->basic.ip_proto)
++ return false;
++
++ if (keys1->basic.n_proto == htons(ETH_P_IP)) {
++ if (keys1->addrs.v4addrs.src != keys2->addrs.v4addrs.src ||
++ keys1->addrs.v4addrs.dst != keys2->addrs.v4addrs.dst)
++ return false;
++ } else {
++ if (memcmp(&keys1->addrs.v6addrs.src, &keys2->addrs.v6addrs.src,
++ sizeof(keys1->addrs.v6addrs.src)) ||
++ memcmp(&keys1->addrs.v6addrs.dst, &keys2->addrs.v6addrs.dst,
++ sizeof(keys1->addrs.v6addrs.dst)))
++ return false;
++ }
++
++ if (keys1->ports.ports == keys2->ports.ports &&
+ keys1->control.flags == keys2->control.flags &&
+ ether_addr_equal(f1->src_mac_addr, f2->src_mac_addr) &&
+ ether_addr_equal(f1->dst_mac_addr, f2->dst_mac_addr))
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+index d320e9afab88..4af6e6ffc5df 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+@@ -70,8 +70,7 @@ static void *seq_tab_start(struct seq_file *seq, loff_t *pos)
+ static void *seq_tab_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+ v = seq_tab_get_idx(seq->private, *pos + 1);
+- if (v)
+- ++*pos;
++ ++(*pos);
+ return v;
+ }
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+index 301c4df8a566..986277744611 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+@@ -683,8 +683,7 @@ static void *l2t_seq_start(struct seq_file *seq, loff_t *pos)
+ static void *l2t_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+ v = l2t_get_idx(seq, *pos);
+- if (v)
+- ++*pos;
++ ++(*pos);
+ return v;
+ }
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
+index 41c6fa200e74..e1901874c19f 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
+@@ -110,7 +110,7 @@ do { \
+ /* Interface Mode Register (IF_MODE) */
+
+ #define IF_MODE_MASK 0x00000003 /* 30-31 Mask on i/f mode bits */
+-#define IF_MODE_XGMII 0x00000000 /* 30-31 XGMII (10G) interface */
++#define IF_MODE_10G 0x00000000 /* 30-31 10G interface */
+ #define IF_MODE_GMII 0x00000002 /* 30-31 GMII (1G) interface */
+ #define IF_MODE_RGMII 0x00000004
+ #define IF_MODE_RGMII_AUTO 0x00008000
+@@ -440,7 +440,7 @@ static int init(struct memac_regs __iomem *regs, struct memac_cfg *cfg,
+ tmp = 0;
+ switch (phy_if) {
+ case PHY_INTERFACE_MODE_XGMII:
+- tmp |= IF_MODE_XGMII;
++ tmp |= IF_MODE_10G;
+ break;
+ default:
+ tmp |= IF_MODE_GMII;
+diff --git a/drivers/net/ethernet/freescale/xgmac_mdio.c b/drivers/net/ethernet/freescale/xgmac_mdio.c
+index e03b30c60dcf..c82c85ef5fb3 100644
+--- a/drivers/net/ethernet/freescale/xgmac_mdio.c
++++ b/drivers/net/ethernet/freescale/xgmac_mdio.c
+@@ -49,6 +49,7 @@ struct tgec_mdio_controller {
+ struct mdio_fsl_priv {
+ struct tgec_mdio_controller __iomem *mdio_base;
+ bool is_little_endian;
++ bool has_a011043;
+ };
+
+ static u32 xgmac_read32(void __iomem *regs,
+@@ -226,7 +227,8 @@ static int xgmac_mdio_read(struct mii_bus *bus, int phy_id, int regnum)
+ return ret;
+
+ /* Return all Fs if nothing was there */
+- if (xgmac_read32(®s->mdio_stat, endian) & MDIO_STAT_RD_ER) {
++ if ((xgmac_read32(®s->mdio_stat, endian) & MDIO_STAT_RD_ER) &&
++ !priv->has_a011043) {
+ dev_err(&bus->dev,
+ "Error while reading PHY%d reg at %d.%hhu\n",
+ phy_id, dev_addr, regnum);
+@@ -274,6 +276,9 @@ static int xgmac_mdio_probe(struct platform_device *pdev)
+ priv->is_little_endian = of_property_read_bool(pdev->dev.of_node,
+ "little-endian");
+
++ priv->has_a011043 = of_property_read_bool(pdev->dev.of_node,
++ "fsl,erratum-a011043");
++
+ ret = of_mdiobus_register(bus, np);
+ if (ret) {
+ dev_err(&pdev->dev, "cannot register MDIO bus\n");
+diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
+index bafdcf70a353..fdab974b245b 100644
+--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
++++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
+@@ -530,7 +530,7 @@ static s32 igb_set_sfp_media_type_82575(struct e1000_hw *hw)
+ dev_spec->module_plugged = true;
+ if (eth_flags->e1000_base_lx || eth_flags->e1000_base_sx) {
+ hw->phy.media_type = e1000_media_type_internal_serdes;
+- } else if (eth_flags->e100_base_fx) {
++ } else if (eth_flags->e100_base_fx || eth_flags->e100_base_lx) {
+ dev_spec->sgmii_active = true;
+ hw->phy.media_type = e1000_media_type_internal_serdes;
+ } else if (eth_flags->e1000_base_t) {
+@@ -657,14 +657,10 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
+ break;
+ }
+
+- /* do not change link mode for 100BaseFX */
+- if (dev_spec->eth_flags.e100_base_fx)
+- break;
+-
+ /* change current link mode setting */
+ ctrl_ext &= ~E1000_CTRL_EXT_LINK_MODE_MASK;
+
+- if (hw->phy.media_type == e1000_media_type_copper)
++ if (dev_spec->sgmii_active)
+ ctrl_ext |= E1000_CTRL_EXT_LINK_MODE_SGMII;
+ else
+ ctrl_ext |= E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES;
+diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+index 5acf3b743876..50954e444985 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+@@ -181,7 +181,7 @@ static int igb_get_link_ksettings(struct net_device *netdev,
+ advertising &= ~ADVERTISED_1000baseKX_Full;
+ }
+ }
+- if (eth_flags->e100_base_fx) {
++ if (eth_flags->e100_base_fx || eth_flags->e100_base_lx) {
+ supported |= SUPPORTED_100baseT_Full;
+ advertising |= ADVERTISED_100baseT_Full;
+ }
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 51cd58fbab69..8177276500f5 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -5189,7 +5189,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+ struct ixgbe_hw *hw = &adapter->hw;
+ struct hlist_node *node2;
+ struct ixgbe_fdir_filter *filter;
+- u64 action;
++ u8 queue;
+
+ spin_lock(&adapter->fdir_perfect_lock);
+
+@@ -5198,17 +5198,34 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+
+ hlist_for_each_entry_safe(filter, node2,
+ &adapter->fdir_filter_list, fdir_node) {
+- action = filter->action;
+- if (action != IXGBE_FDIR_DROP_QUEUE && action != 0)
+- action =
+- (action >> ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF) - 1;
++ if (filter->action == IXGBE_FDIR_DROP_QUEUE) {
++ queue = IXGBE_FDIR_DROP_QUEUE;
++ } else {
++ u32 ring = ethtool_get_flow_spec_ring(filter->action);
++ u8 vf = ethtool_get_flow_spec_ring_vf(filter->action);
++
++ if (!vf && (ring >= adapter->num_rx_queues)) {
++ e_err(drv, "FDIR restore failed without VF, ring: %u\n",
++ ring);
++ continue;
++ } else if (vf &&
++ ((vf > adapter->num_vfs) ||
++ ring >= adapter->num_rx_queues_per_pool)) {
++ e_err(drv, "FDIR restore failed with VF, vf: %hhu, ring: %u\n",
++ vf, ring);
++ continue;
++ }
++
++ /* Map the ring onto the absolute queue index */
++ if (!vf)
++ queue = adapter->rx_ring[ring]->reg_idx;
++ else
++ queue = ((vf - 1) *
++ adapter->num_rx_queues_per_pool) + ring;
++ }
+
+ ixgbe_fdir_write_perfect_filter_82599(hw,
+- &filter->filter,
+- filter->sw_idx,
+- (action == IXGBE_FDIR_DROP_QUEUE) ?
+- IXGBE_FDIR_DROP_QUEUE :
+- adapter->rx_ring[action]->reg_idx);
++ &filter->filter, filter->sw_idx, queue);
+ }
+
+ spin_unlock(&adapter->fdir_perfect_lock);
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 4093a9c52c18..a10756f0b0d8 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -2066,11 +2066,6 @@ static int ixgbevf_write_uc_addr_list(struct net_device *netdev)
+ struct ixgbe_hw *hw = &adapter->hw;
+ int count = 0;
+
+- if ((netdev_uc_count(netdev)) > 10) {
+- pr_err("Too many unicast filters - No Space\n");
+- return -ENOSPC;
+- }
+-
+ if (!netdev_uc_empty(netdev)) {
+ struct netdev_hw_addr *ha;
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+index a496390b8632..07f9067affc6 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+@@ -2043,6 +2043,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev,
+ break;
+ }
+ entry += p_hdr->size;
++ cond_resched();
+ }
+ p_dev->ahw->reset.seq_index = index;
+ }
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+index afa10a163da1..f34ae8c75bc5 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+@@ -703,6 +703,7 @@ static u32 qlcnic_read_memory_test_agent(struct qlcnic_adapter *adapter,
+ addr += 16;
+ reg_read -= 16;
+ ret += 16;
++ cond_resched();
+ }
+ out:
+ mutex_unlock(&adapter->ahw->mem_lock);
+@@ -1383,6 +1384,7 @@ int qlcnic_dump_fw(struct qlcnic_adapter *adapter)
+ buf_offset += entry->hdr.cap_size;
+ entry_offset += entry->hdr.offset;
+ buffer = fw_dump->data + buf_offset;
++ cond_resched();
+ }
+
+ fw_dump->clr = 1;
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index b55fd76348f9..13c8788e3b6b 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -999,6 +999,7 @@ static const struct usb_device_id products[] = {
+ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
+ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */
+ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
++ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
+
+ /* 3. Combined interface devices matching on interface number */
+ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index db817d3c2bb8..c5c188dc6626 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -5259,6 +5259,11 @@ static int rtl8152_probe(struct usb_interface *intf,
+
+ intf->needs_remote_wakeup = 1;
+
++ if (!rtl_can_wakeup(tp))
++ __rtl_set_wol(tp, 0);
++ else
++ tp->saved_wolopts = __rtl_get_wol(tp);
++
+ tp->rtl_ops.init(tp);
+ queue_delayed_work(system_long_wq, &tp->hw_phy_work, 0);
+ set_ethernet_addr(tp);
+@@ -5272,10 +5277,6 @@ static int rtl8152_probe(struct usb_interface *intf,
+ goto out1;
+ }
+
+- if (!rtl_can_wakeup(tp))
+- __rtl_set_wol(tp, 0);
+-
+- tp->saved_wolopts = __rtl_get_wol(tp);
+ if (tp->saved_wolopts)
+ device_set_wakeup_enable(&udev->dev, true);
+ else
+diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
+index 5512c7f73fce..c3fe9bfff812 100644
+--- a/drivers/net/wireless/cisco/airo.c
++++ b/drivers/net/wireless/cisco/airo.c
+@@ -7786,16 +7786,8 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
+ case AIROGVLIST: ridcode = RID_APLIST; break;
+ case AIROGDRVNAM: ridcode = RID_DRVNAME; break;
+ case AIROGEHTENC: ridcode = RID_ETHERENCAP; break;
+- case AIROGWEPKTMP: ridcode = RID_WEP_TEMP;
+- /* Only super-user can read WEP keys */
+- if (!capable(CAP_NET_ADMIN))
+- return -EPERM;
+- break;
+- case AIROGWEPKNV: ridcode = RID_WEP_PERM;
+- /* Only super-user can read WEP keys */
+- if (!capable(CAP_NET_ADMIN))
+- return -EPERM;
+- break;
++ case AIROGWEPKTMP: ridcode = RID_WEP_TEMP; break;
++ case AIROGWEPKNV: ridcode = RID_WEP_PERM; break;
+ case AIROGSTAT: ridcode = RID_STATUS; break;
+ case AIROGSTATSD32: ridcode = RID_STATSDELTA; break;
+ case AIROGSTATSC32: ridcode = RID_STATS; break;
+@@ -7809,7 +7801,13 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
+ return -EINVAL;
+ }
+
+- if ((iobuf = kmalloc(RIDSIZE, GFP_KERNEL)) == NULL)
++ if (ridcode == RID_WEP_TEMP || ridcode == RID_WEP_PERM) {
++ /* Only super-user can read WEP keys */
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
++ }
++
++ if ((iobuf = kzalloc(RIDSIZE, GFP_KERNEL)) == NULL)
+ return -ENOMEM;
+
+ PC4500_readrid(ai,ridcode,iobuf,RIDSIZE, 1);
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+index b850cca9853c..a6e64787a345 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+@@ -217,6 +217,34 @@ enum iwl_nvm_channel_flags {
+ NVM_CHANNEL_DC_HIGH = BIT(12),
+ };
+
++/**
++ * enum iwl_reg_capa_flags - global flags applied for the whole regulatory
++ * domain.
++ * @REG_CAPA_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
++ * 2.4Ghz band is allowed.
++ * @REG_CAPA_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
++ * 5Ghz band is allowed.
++ * @REG_CAPA_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
++ * for this regulatory domain (valid only in 5Ghz).
++ * @REG_CAPA_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
++ * for this regulatory domain (valid only in 5Ghz).
++ * @REG_CAPA_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
++ * @REG_CAPA_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
++ * @REG_CAPA_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
++ * for this regulatory domain (valid only in 5Ghz).
++ * @REG_CAPA_DC_HIGH_ENABLED: DC HIGH allowed.
++ */
++enum iwl_reg_capa_flags {
++ REG_CAPA_BF_CCD_LOW_BAND = BIT(0),
++ REG_CAPA_BF_CCD_HIGH_BAND = BIT(1),
++ REG_CAPA_160MHZ_ALLOWED = BIT(2),
++ REG_CAPA_80MHZ_ALLOWED = BIT(3),
++ REG_CAPA_MCS_8_ALLOWED = BIT(4),
++ REG_CAPA_MCS_9_ALLOWED = BIT(5),
++ REG_CAPA_40MHZ_FORBIDDEN = BIT(7),
++ REG_CAPA_DC_HIGH_ENABLED = BIT(9),
++};
++
+ static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
+ int chan, u16 flags)
+ {
+@@ -923,6 +951,7 @@ IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
+
+ static u32 iwl_nvm_get_regdom_bw_flags(const u8 *nvm_chan,
+ int ch_idx, u16 nvm_flags,
++ u16 cap_flags,
+ const struct iwl_cfg *cfg)
+ {
+ u32 flags = NL80211_RRF_NO_HT40;
+@@ -966,6 +995,20 @@ static u32 iwl_nvm_get_regdom_bw_flags(const u8 *nvm_chan,
+ (flags & NL80211_RRF_NO_IR))
+ flags |= NL80211_RRF_GO_CONCURRENT;
+
++ /*
++ * cap_flags is per regulatory domain so apply it for every channel
++ */
++ if (ch_idx >= NUM_2GHZ_CHANNELS) {
++ if (cap_flags & REG_CAPA_40MHZ_FORBIDDEN)
++ flags |= NL80211_RRF_NO_HT40;
++
++ if (!(cap_flags & REG_CAPA_80MHZ_ALLOWED))
++ flags |= NL80211_RRF_NO_80MHZ;
++
++ if (!(cap_flags & REG_CAPA_160MHZ_ALLOWED))
++ flags |= NL80211_RRF_NO_160MHZ;
++ }
++
+ return flags;
+ }
+
+@@ -977,7 +1020,7 @@ struct regdb_ptrs {
+ struct ieee80211_regdomain *
+ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
+ int num_of_ch, __le32 *channels, u16 fw_mcc,
+- u16 geo_info)
++ u16 geo_info, u16 cap)
+ {
+ int ch_idx;
+ u16 ch_flags;
+@@ -1038,7 +1081,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
+ }
+
+ reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+- ch_flags, cfg);
++ ch_flags, cap,
++ cfg);
+
+ /* we can't continue the same rule */
+ if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
+index 234d1009a9de..a9bdd4aa01c7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
+@@ -7,7 +7,7 @@
+ *
+ * Copyright(c) 2008 - 2015 Intel Corporation. All rights reserved.
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -34,7 +34,7 @@
+ *
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -108,7 +108,7 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
+ struct ieee80211_regdomain *
+ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
+ int num_of_ch, __le32 *channels, u16 fw_mcc,
+- u16 geo_info);
++ u16 geo_info, u16 cap);
+
+ /**
+ * struct iwl_nvm_section - describes an NVM section in memory.
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 476c44db0e64..58653598db14 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -317,7 +317,8 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
+ __le32_to_cpu(resp->n_channels),
+ resp->channels,
+ __le16_to_cpu(resp->mcc),
+- __le16_to_cpu(resp->geo_info));
++ __le16_to_cpu(resp->geo_info),
++ __le16_to_cpu(resp->cap));
+ /* Store the return source id */
+ src_id = resp->source_id;
+ kfree(resp);
+diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+index 5733e440ecaf..81cc1044532d 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -1129,6 +1129,12 @@ static void rsi_disconnect(struct sdio_func *pfunction)
+ rsi_mac80211_detach(adapter);
+ mdelay(10);
+
++ if (IS_ENABLED(CONFIG_RSI_COEX) && adapter->priv->coex_mode > 1 &&
++ adapter->priv->bt_adapter) {
++ rsi_bt_ops.detach(adapter->priv->bt_adapter);
++ adapter->priv->bt_adapter = NULL;
++ }
++
+ /* Reset Chip */
+ rsi_reset_chip(adapter);
+
+@@ -1305,6 +1311,12 @@ static int rsi_freeze(struct device *dev)
+ rsi_dbg(ERR_ZONE,
+ "##### Device can not wake up through WLAN\n");
+
++ if (IS_ENABLED(CONFIG_RSI_COEX) && common->coex_mode > 1 &&
++ common->bt_adapter) {
++ rsi_bt_ops.detach(common->bt_adapter);
++ common->bt_adapter = NULL;
++ }
++
+ ret = rsi_sdio_disable_interrupts(pfunction);
+
+ if (sdev->write_fail)
+@@ -1352,6 +1364,12 @@ static void rsi_shutdown(struct device *dev)
+ if (rsi_config_wowlan(adapter, wowlan))
+ rsi_dbg(ERR_ZONE, "Failed to configure WoWLAN\n");
+
++ if (IS_ENABLED(CONFIG_RSI_COEX) && adapter->priv->coex_mode > 1 &&
++ adapter->priv->bt_adapter) {
++ rsi_bt_ops.detach(adapter->priv->bt_adapter);
++ adapter->priv->bt_adapter = NULL;
++ }
++
+ rsi_sdio_disable_interrupts(sdev->pfunction);
+
+ if (sdev->write_fail)
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index 90eb749e2b61..54106646445a 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -291,6 +291,15 @@ out:
+ dev_kfree_skb(rx_cb->rx_skb);
+ }
+
++static void rsi_rx_urb_kill(struct rsi_hw *adapter, u8 ep_num)
++{
++ struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
++ struct rx_usb_ctrl_block *rx_cb = &dev->rx_cb[ep_num - 1];
++ struct urb *urb = rx_cb->rx_urb;
++
++ usb_kill_urb(urb);
++}
++
+ /**
+ * rsi_rx_urb_submit() - This function submits the given URB to the USB stack.
+ * @adapter: Pointer to the adapter structure.
+@@ -791,10 +800,13 @@ static int rsi_probe(struct usb_interface *pfunction,
+ if (adapter->priv->coex_mode > 1) {
+ status = rsi_rx_urb_submit(adapter, BT_EP, GFP_KERNEL);
+ if (status)
+- goto err1;
++ goto err_kill_wlan_urb;
+ }
+
+ return 0;
++
++err_kill_wlan_urb:
++ rsi_rx_urb_kill(adapter, WLAN_EP);
+ err1:
+ rsi_deinit_usb_interface(adapter);
+ err:
+@@ -818,6 +830,17 @@ static void rsi_disconnect(struct usb_interface *pfunction)
+ return;
+
+ rsi_mac80211_detach(adapter);
++
++ if (IS_ENABLED(CONFIG_RSI_COEX) && adapter->priv->coex_mode > 1 &&
++ adapter->priv->bt_adapter) {
++ rsi_bt_ops.detach(adapter->priv->bt_adapter);
++ adapter->priv->bt_adapter = NULL;
++ }
++
++ if (adapter->priv->coex_mode > 1)
++ rsi_rx_urb_kill(adapter, BT_EP);
++ rsi_rx_urb_kill(adapter, WLAN_EP);
++
+ rsi_reset_card(adapter);
+ rsi_deinit_usb_interface(adapter);
+ rsi_91x_deinit(adapter);
+diff --git a/drivers/platform/x86/gpd-pocket-fan.c b/drivers/platform/x86/gpd-pocket-fan.c
+index 73eb1572b966..b471b86c28fe 100644
+--- a/drivers/platform/x86/gpd-pocket-fan.c
++++ b/drivers/platform/x86/gpd-pocket-fan.c
+@@ -127,7 +127,7 @@ static int gpd_pocket_fan_probe(struct platform_device *pdev)
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(temp_limits); i++) {
+- if (temp_limits[i] < 40000 || temp_limits[i] > 70000) {
++ if (temp_limits[i] < 20000 || temp_limits[i] > 90000) {
+ dev_err(&pdev->dev, "Invalid temp-limit %d (must be between 40000 and 70000)\n",
+ temp_limits[i]);
+ temp_limits[0] = TEMP_LIMIT0_DEFAULT;
+diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
+index 8cbd3c9f0b4c..73ffc16ec022 100644
+--- a/drivers/scsi/fnic/fnic_scsi.c
++++ b/drivers/scsi/fnic/fnic_scsi.c
+@@ -446,6 +446,9 @@ static int fnic_queuecommand_lck(struct scsi_cmnd *sc, void (*done)(struct scsi_
+ if (unlikely(fnic_chk_state_flags_locked(fnic, FNIC_FLAGS_IO_BLOCKED)))
+ return SCSI_MLQUEUE_HOST_BUSY;
+
++ if (unlikely(fnic_chk_state_flags_locked(fnic, FNIC_FLAGS_FWRESET)))
++ return SCSI_MLQUEUE_HOST_BUSY;
++
+ rport = starget_to_rport(scsi_target(sc->device));
+ if (!rport) {
+ FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c
+index f5cb8c0af09f..c1fda6acb670 100644
+--- a/drivers/soc/ti/wkup_m3_ipc.c
++++ b/drivers/soc/ti/wkup_m3_ipc.c
+@@ -426,6 +426,8 @@ static void wkup_m3_rproc_boot_thread(struct wkup_m3_ipc *m3_ipc)
+ ret = rproc_boot(m3_ipc->rproc);
+ if (ret)
+ dev_err(dev, "rproc_boot failed\n");
++ else
++ m3_ipc_state = m3_ipc;
+
+ do_exit(0);
+ }
+@@ -512,8 +514,6 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev)
+ goto err_put_rproc;
+ }
+
+- m3_ipc_state = m3_ipc;
+-
+ return 0;
+
+ err_put_rproc:
+diff --git a/drivers/tee/optee/Kconfig b/drivers/tee/optee/Kconfig
+index 3c59e19029be..3c1ec4e9ed29 100644
+--- a/drivers/tee/optee/Kconfig
++++ b/drivers/tee/optee/Kconfig
+@@ -2,6 +2,7 @@
+ config OPTEE
+ tristate "OP-TEE"
+ depends on HAVE_ARM_SMCCC
++ depends on MMU
+ help
+ This implements the OP-TEE Trusted Execution Environment (TEE)
+ driver.
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index ddbad8d50949..db4002ecbaca 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -2167,7 +2167,15 @@ static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ */
+ thresh = SZ_4M;
+
+- if (!mixed && total_free_meta - thresh < block_rsv->size)
++ /*
++ * We only want to claim there's no available space if we can no longer
++ * allocate chunks for our metadata profile and our global reserve will
++ * not fit in the free metadata space. If we aren't ->full then we
++ * still can allocate chunks and thus are fine using the currently
++ * calculated f_bavail.
++ */
++ if (!mixed && block_rsv->space_info->full &&
++ total_free_meta - thresh < block_rsv->size)
+ buf->f_bavail = 0;
+
+ buf->f_type = BTRFS_SUPER_MAGIC;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 1a8d57fe0b1a..32d8bdf683bb 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1842,6 +1842,13 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
+ arg = JBD2_DEFAULT_MAX_COMMIT_AGE;
+ sbi->s_commit_interval = HZ * arg;
+ } else if (token == Opt_debug_want_extra_isize) {
++ if ((arg & 1) ||
++ (arg < 4) ||
++ (arg > (sbi->s_inode_size - EXT4_GOOD_OLD_INODE_SIZE))) {
++ ext4_msg(sb, KERN_ERR,
++ "Invalid want_extra_isize %d", arg);
++ return -1;
++ }
+ sbi->s_want_extra_isize = arg;
+ } else if (token == Opt_max_batch_time) {
+ sbi->s_max_batch_time = arg;
+@@ -3513,40 +3520,6 @@ int ext4_calculate_overhead(struct super_block *sb)
+ return 0;
+ }
+
+-static void ext4_clamp_want_extra_isize(struct super_block *sb)
+-{
+- struct ext4_sb_info *sbi = EXT4_SB(sb);
+- struct ext4_super_block *es = sbi->s_es;
+- unsigned def_extra_isize = sizeof(struct ext4_inode) -
+- EXT4_GOOD_OLD_INODE_SIZE;
+-
+- if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) {
+- sbi->s_want_extra_isize = 0;
+- return;
+- }
+- if (sbi->s_want_extra_isize < 4) {
+- sbi->s_want_extra_isize = def_extra_isize;
+- if (ext4_has_feature_extra_isize(sb)) {
+- if (sbi->s_want_extra_isize <
+- le16_to_cpu(es->s_want_extra_isize))
+- sbi->s_want_extra_isize =
+- le16_to_cpu(es->s_want_extra_isize);
+- if (sbi->s_want_extra_isize <
+- le16_to_cpu(es->s_min_extra_isize))
+- sbi->s_want_extra_isize =
+- le16_to_cpu(es->s_min_extra_isize);
+- }
+- }
+- /* Check if enough inode space is available */
+- if ((sbi->s_want_extra_isize > sbi->s_inode_size) ||
+- (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >
+- sbi->s_inode_size)) {
+- sbi->s_want_extra_isize = def_extra_isize;
+- ext4_msg(sb, KERN_INFO,
+- "required extra inode space not available");
+- }
+-}
+-
+ static void ext4_set_resv_clusters(struct super_block *sb)
+ {
+ ext4_fsblk_t resv_clusters;
+@@ -3754,6 +3727,65 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ */
+ sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT;
+
++ if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) {
++ sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE;
++ sbi->s_first_ino = EXT4_GOOD_OLD_FIRST_INO;
++ } else {
++ sbi->s_inode_size = le16_to_cpu(es->s_inode_size);
++ sbi->s_first_ino = le32_to_cpu(es->s_first_ino);
++ if (sbi->s_first_ino < EXT4_GOOD_OLD_FIRST_INO) {
++ ext4_msg(sb, KERN_ERR, "invalid first ino: %u",
++ sbi->s_first_ino);
++ goto failed_mount;
++ }
++ if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) ||
++ (!is_power_of_2(sbi->s_inode_size)) ||
++ (sbi->s_inode_size > blocksize)) {
++ ext4_msg(sb, KERN_ERR,
++ "unsupported inode size: %d",
++ sbi->s_inode_size);
++ goto failed_mount;
++ }
++ /*
++ * i_atime_extra is the last extra field available for
++ * [acm]times in struct ext4_inode. Checking for that
++ * field should suffice to ensure we have extra space
++ * for all three.
++ */
++ if (sbi->s_inode_size >= offsetof(struct ext4_inode, i_atime_extra) +
++ sizeof(((struct ext4_inode *)0)->i_atime_extra)) {
++ sb->s_time_gran = 1;
++ } else {
++ sb->s_time_gran = NSEC_PER_SEC;
++ }
++ }
++ if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE) {
++ sbi->s_want_extra_isize = sizeof(struct ext4_inode) -
++ EXT4_GOOD_OLD_INODE_SIZE;
++ if (ext4_has_feature_extra_isize(sb)) {
++ unsigned v, max = (sbi->s_inode_size -
++ EXT4_GOOD_OLD_INODE_SIZE);
++
++ v = le16_to_cpu(es->s_want_extra_isize);
++ if (v > max) {
++ ext4_msg(sb, KERN_ERR,
++ "bad s_want_extra_isize: %d", v);
++ goto failed_mount;
++ }
++ if (sbi->s_want_extra_isize < v)
++ sbi->s_want_extra_isize = v;
++
++ v = le16_to_cpu(es->s_min_extra_isize);
++ if (v > max) {
++ ext4_msg(sb, KERN_ERR,
++ "bad s_min_extra_isize: %d", v);
++ goto failed_mount;
++ }
++ if (sbi->s_want_extra_isize < v)
++ sbi->s_want_extra_isize = v;
++ }
++ }
++
+ if (sbi->s_es->s_mount_opts[0]) {
+ char *s_mount_opts = kstrndup(sbi->s_es->s_mount_opts,
+ sizeof(sbi->s_es->s_mount_opts),
+@@ -3955,29 +3987,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ has_huge_files);
+ sb->s_maxbytes = ext4_max_size(sb->s_blocksize_bits, has_huge_files);
+
+- if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) {
+- sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE;
+- sbi->s_first_ino = EXT4_GOOD_OLD_FIRST_INO;
+- } else {
+- sbi->s_inode_size = le16_to_cpu(es->s_inode_size);
+- sbi->s_first_ino = le32_to_cpu(es->s_first_ino);
+- if (sbi->s_first_ino < EXT4_GOOD_OLD_FIRST_INO) {
+- ext4_msg(sb, KERN_ERR, "invalid first ino: %u",
+- sbi->s_first_ino);
+- goto failed_mount;
+- }
+- if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) ||
+- (!is_power_of_2(sbi->s_inode_size)) ||
+- (sbi->s_inode_size > blocksize)) {
+- ext4_msg(sb, KERN_ERR,
+- "unsupported inode size: %d",
+- sbi->s_inode_size);
+- goto failed_mount;
+- }
+- if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE)
+- sb->s_time_gran = 1 << (EXT4_EPOCH_BITS - 2);
+- }
+-
+ sbi->s_desc_size = le16_to_cpu(es->s_desc_size);
+ if (ext4_has_feature_64bit(sb)) {
+ if (sbi->s_desc_size < EXT4_MIN_DESC_SIZE_64BIT ||
+@@ -4421,8 +4430,6 @@ no_journal:
+ } else if (ret)
+ goto failed_mount4a;
+
+- ext4_clamp_want_extra_isize(sb);
+-
+ ext4_set_resv_clusters(sb);
+
+ err = ext4_setup_system_zone(sb);
+@@ -5207,8 +5214,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ goto restore_opts;
+ }
+
+- ext4_clamp_want_extra_isize(sb);
+-
+ if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^
+ test_opt(sb, JOURNAL_CHECKSUM)) {
+ ext4_msg(sb, KERN_ERR, "changing journal_checksum "
+diff --git a/fs/namei.c b/fs/namei.c
+index 2aad8042a05b..c00a7e1da4c0 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -3259,8 +3259,8 @@ static int do_last(struct nameidata *nd,
+ struct file *file, const struct open_flags *op)
+ {
+ struct dentry *dir = nd->path.dentry;
+- kuid_t dir_uid = dir->d_inode->i_uid;
+- umode_t dir_mode = dir->d_inode->i_mode;
++ kuid_t dir_uid = nd->inode->i_uid;
++ umode_t dir_mode = nd->inode->i_mode;
+ int open_flag = op->open_flag;
+ bool will_truncate = (open_flag & O_TRUNC) != 0;
+ bool got_write = false;
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index a3507490be6e..6280efeceb0a 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -629,6 +629,7 @@ static void reiserfs_put_super(struct super_block *s)
+ reiserfs_write_unlock(s);
+ mutex_destroy(&REISERFS_SB(s)->lock);
+ destroy_workqueue(REISERFS_SB(s)->commit_wq);
++ kfree(REISERFS_SB(s)->s_jdev);
+ kfree(s->s_fs_info);
+ s->s_fs_info = NULL;
+ }
+@@ -2243,6 +2244,7 @@ error_unlocked:
+ kfree(qf_names[j]);
+ }
+ #endif
++ kfree(sbi->s_jdev);
+ kfree(sbi);
+
+ s->s_fs_info = NULL;
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 20f5ba262cc0..0530de9a4efc 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1843,11 +1843,11 @@ static inline void rseq_migrate(struct task_struct *t)
+
+ /*
+ * If parent process has a registered restartable sequences area, the
+- * child inherits. Only applies when forking a process, not a thread.
++ * child inherits. Unregister rseq for a clone with CLONE_VM set.
+ */
+ static inline void rseq_fork(struct task_struct *t, unsigned long clone_flags)
+ {
+- if (clone_flags & CLONE_THREAD) {
++ if (clone_flags & CLONE_VM) {
+ t->rseq = NULL;
+ t->rseq_len = 0;
+ t->rseq_sig = 0;
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 1fa2e72ff7a6..ae936cd5567e 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -3050,6 +3050,9 @@ struct cfg80211_external_auth_params {
+ *
+ * @start_radar_detection: Start radar detection in the driver.
+ *
++ * @end_cac: End running CAC, probably because a related CAC
++ * was finished on another phy.
++ *
+ * @update_ft_ies: Provide updated Fast BSS Transition information to the
+ * driver. If the SME is in the driver/firmware, this information can be
+ * used in building Authentication and Reassociation Request frames.
+@@ -3364,6 +3367,8 @@ struct cfg80211_ops {
+ struct net_device *dev,
+ struct cfg80211_chan_def *chandef,
+ u32 cac_time_ms);
++ void (*end_cac)(struct wiphy *wiphy,
++ struct net_device *dev);
+ int (*update_ft_ies)(struct wiphy *wiphy, struct net_device *dev,
+ struct cfg80211_update_ft_ies_params *ftie);
+ int (*crit_proto_start)(struct wiphy *wiphy,
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 78ef274b036e..08bd40d90066 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -2940,8 +2940,6 @@ static int cgroup_apply_control_enable(struct cgroup *cgrp)
+ for_each_subsys(ss, ssid) {
+ struct cgroup_subsys_state *css = cgroup_css(dsct, ss);
+
+- WARN_ON_ONCE(css && percpu_ref_is_dying(&css->refcnt));
+-
+ if (!(cgroup_ss_mask(dsct) & (1 << ss->id)))
+ continue;
+
+@@ -2951,6 +2949,8 @@ static int cgroup_apply_control_enable(struct cgroup *cgrp)
+ return PTR_ERR(css);
+ }
+
++ WARN_ON_ONCE(percpu_ref_is_dying(&css->refcnt));
++
+ if (css_visible(css)) {
+ ret = css_populate_dir(css);
+ if (ret)
+@@ -2986,11 +2986,11 @@ static void cgroup_apply_control_disable(struct cgroup *cgrp)
+ for_each_subsys(ss, ssid) {
+ struct cgroup_subsys_state *css = cgroup_css(dsct, ss);
+
+- WARN_ON_ONCE(css && percpu_ref_is_dying(&css->refcnt));
+-
+ if (!css)
+ continue;
+
++ WARN_ON_ONCE(percpu_ref_is_dying(&css->refcnt));
++
+ if (css->parent &&
+ !(cgroup_ss_mask(dsct) & (1 << ss->id))) {
+ kill_css(css);
+@@ -3277,7 +3277,8 @@ static ssize_t cgroup_type_write(struct kernfs_open_file *of, char *buf,
+ if (strcmp(strstrip(buf), "threaded"))
+ return -EINVAL;
+
+- cgrp = cgroup_kn_lock_live(of->kn, false);
++ /* drain dying csses before we re-apply (threaded) subtree control */
++ cgrp = cgroup_kn_lock_live(of->kn, true);
+ if (!cgrp)
+ return -ENOENT;
+
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index a4a1cab16c0f..adeb163cd661 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2808,6 +2808,9 @@ int mpol_parse_str(char *str, struct mempolicy **mpol)
+ char *flags = strchr(str, '=');
+ int err = 1;
+
++ if (flags)
++ *flags++ = '\0'; /* terminate mode string */
++
+ if (nodelist) {
+ /* NUL-terminate mode or flags string */
+ *nodelist++ = '\0';
+@@ -2818,9 +2821,6 @@ int mpol_parse_str(char *str, struct mempolicy **mpol)
+ } else
+ nodes_clear(nodes);
+
+- if (flags)
+- *flags++ = '\0'; /* terminate mode string */
+-
+ for (mode = 0; mode < MPOL_MAX; mode++) {
+ if (!strcmp(str, policy_modes[mode])) {
+ break;
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 593557c107d2..70f8ad4ade3f 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -1672,7 +1672,7 @@ out_flush:
+ err1 = do_move_pages_to_node(mm, &pagelist, current_node);
+ if (!err1)
+ err1 = store_status(status, start, current_node, i - start);
+- if (!err)
++ if (err >= 0)
+ err = err1;
+ out:
+ return err;
+diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
+index d4e2a166ae17..e506c51ff765 100644
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -831,6 +831,8 @@ static int hci_sock_release(struct socket *sock)
+ if (!sk)
+ return 0;
+
++ lock_sock(sk);
++
+ switch (hci_pi(sk)->channel) {
+ case HCI_CHANNEL_MONITOR:
+ atomic_dec(&monitor_promisc);
+@@ -878,6 +880,7 @@ static int hci_sock_release(struct socket *sock)
+ skb_queue_purge(&sk->sk_receive_queue);
+ skb_queue_purge(&sk->sk_write_queue);
+
++ release_sock(sk);
+ sock_put(sk);
+ return 0;
+ }
+diff --git a/net/core/utils.c b/net/core/utils.c
+index 2a597ac7808e..60045e9fea05 100644
+--- a/net/core/utils.c
++++ b/net/core/utils.c
+@@ -442,6 +442,23 @@ void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
+ }
+ EXPORT_SYMBOL(inet_proto_csum_replace4);
+
++/**
++ * inet_proto_csum_replace16 - update layer 4 header checksum field
++ * @sum: Layer 4 header checksum field
++ * @skb: sk_buff for the packet
++ * @from: old IPv6 address
++ * @to: new IPv6 address
++ * @pseudohdr: True if layer 4 header checksum includes pseudoheader
++ *
++ * Update layer 4 header as per the update in IPv6 src/dst address.
++ *
++ * There is no need to update skb->csum in this function, because update in two
++ * fields a.) IPv6 src/dst address and b.) L4 header checksum cancels each other
++ * for skb->csum calculation. Whereas inet_proto_csum_replace4 function needs to
++ * update skb->csum, because update in 3 fields a.) IPv4 src/dst address,
++ * b.) IPv4 Header checksum and c.) L4 header checksum results in same diff as
++ * L4 Header checksum for skb->csum calculation.
++ */
+ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
+ const __be32 *from, const __be32 *to,
+ bool pseudohdr)
+@@ -453,9 +470,6 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
+ if (skb->ip_summed != CHECKSUM_PARTIAL) {
+ *sum = csum_fold(csum_partial(diff, sizeof(diff),
+ ~csum_unfold(*sum)));
+- if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr)
+- skb->csum = ~csum_partial(diff, sizeof(diff),
+- ~skb->csum);
+ } else if (pseudohdr)
+ *sum = ~csum_fold(csum_partial(diff, sizeof(diff),
+ csum_unfold(*sum)));
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index 960f4faaf294..f5e5fcd90859 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -208,8 +208,17 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
+ int mtu;
+
+ if (!dst) {
+- dev->stats.tx_carrier_errors++;
+- goto tx_error_icmp;
++ struct rtable *rt;
++
++ fl->u.ip4.flowi4_oif = dev->ifindex;
++ fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++ rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
++ if (IS_ERR(rt)) {
++ dev->stats.tx_carrier_errors++;
++ goto tx_error_icmp;
++ }
++ dst = &rt->dst;
++ skb_dst_set(skb, dst);
+ }
+
+ dst_hold(dst);
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index bfd39db3398a..67ff206b6d61 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -453,8 +453,17 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ int err = -1;
+ int mtu;
+
+- if (!dst)
+- goto tx_err_link_failure;
++ if (!dst) {
++ fl->u.ip6.flowi6_oif = dev->ifindex;
++ fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
++ if (dst->error) {
++ dst_release(dst);
++ dst = NULL;
++ goto tx_err_link_failure;
++ }
++ skb_dst_set(skb, dst);
++ }
+
+ dst_hold(dst);
+ dst = xfrm_lookup(t->net, dst, fl, NULL, 0);
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index e46944500cfa..cb7076d9a769 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2825,6 +2825,28 @@ static int ieee80211_start_radar_detection(struct wiphy *wiphy,
+ return err;
+ }
+
++static void ieee80211_end_cac(struct wiphy *wiphy,
++ struct net_device *dev)
++{
++ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++ struct ieee80211_local *local = sdata->local;
++
++ mutex_lock(&local->mtx);
++ list_for_each_entry(sdata, &local->interfaces, list) {
++ /* it might be waiting for the local->mtx, but then
++ * by the time it gets it, sdata->wdev.cac_started
++ * will no longer be true
++ */
++ cancel_delayed_work(&sdata->dfs_cac_timer_work);
++
++ if (sdata->wdev.cac_started) {
++ ieee80211_vif_release_channel(sdata);
++ sdata->wdev.cac_started = false;
++ }
++ }
++ mutex_unlock(&local->mtx);
++}
++
+ static struct cfg80211_beacon_data *
+ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
+ {
+@@ -3848,6 +3870,7 @@ const struct cfg80211_ops mac80211_config_ops = {
+ #endif
+ .get_channel = ieee80211_cfg_get_channel,
+ .start_radar_detection = ieee80211_start_radar_detection,
++ .end_cac = ieee80211_end_cac,
+ .channel_switch = ieee80211_channel_switch,
+ .set_qos_map = ieee80211_set_qos_map,
+ .set_ap_chanwidth = ieee80211_set_ap_chanwidth,
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index 6950cd0bf594..740dc9fa127c 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -326,6 +326,9 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
+ unsigned long fail_avg =
+ ewma_mesh_fail_avg_read(&sta->mesh->fail_avg);
+
++ if (sta->mesh->plink_state != NL80211_PLINK_ESTAB)
++ return MAX_METRIC;
++
+ /* Try to get rate based on HW/SW RC algorithm.
+ * Rate is returned in units of Kbps, correct this
+ * to comply with airtime calculation units
+diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
+index b3622823bad2..ebd66e8f46b3 100644
+--- a/net/mac80211/tkip.c
++++ b/net/mac80211/tkip.c
+@@ -266,9 +266,21 @@ int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm,
+ if ((keyid >> 6) != key->conf.keyidx)
+ return TKIP_DECRYPT_INVALID_KEYIDX;
+
+- if (rx_ctx->ctx.state != TKIP_STATE_NOT_INIT &&
+- (iv32 < rx_ctx->iv32 ||
+- (iv32 == rx_ctx->iv32 && iv16 <= rx_ctx->iv16)))
++ /* Reject replays if the received TSC is smaller than or equal to the
++ * last received value in a valid message, but with an exception for
++ * the case where a new key has been set and no valid frame using that
++ * key has yet received and the local RSC was initialized to 0. This
++ * exception allows the very first frame sent by the transmitter to be
++ * accepted even if that transmitter were to use TSC 0 (IEEE 802.11
++ * described TSC to be initialized to 1 whenever a new key is taken into
++ * use).
++ */
++ if (iv32 < rx_ctx->iv32 ||
++ (iv32 == rx_ctx->iv32 &&
++ (iv16 < rx_ctx->iv16 ||
++ (iv16 == rx_ctx->iv16 &&
++ (rx_ctx->iv32 || rx_ctx->iv16 ||
++ rx_ctx->ctx.state != TKIP_STATE_NOT_INIT)))))
+ return TKIP_DECRYPT_REPLAY;
+
+ if (only_iv) {
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index 09441bbb0166..e5444f3ff43f 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -235,6 +235,9 @@ static int nft_tunnel_obj_erspan_init(const struct nlattr *attr,
+ if (err < 0)
+ return err;
+
++ if (!tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION])
++ return -EINVAL;
++
+ version = ntohl(nla_get_be32(tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION]));
+ switch (version) {
+ case ERSPAN_VERSION:
+diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
+index 4cff76f33d45..a8c58aeb9dde 100644
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1170,6 +1170,16 @@ rdev_start_radar_detection(struct cfg80211_registered_device *rdev,
+ return ret;
+ }
+
++static inline void
++rdev_end_cac(struct cfg80211_registered_device *rdev,
++ struct net_device *dev)
++{
++ trace_rdev_end_cac(&rdev->wiphy, dev);
++ if (rdev->ops->end_cac)
++ rdev->ops->end_cac(&rdev->wiphy, dev);
++ trace_rdev_return_void(&rdev->wiphy);
++}
++
+ static inline int
+ rdev_set_mcast_rate(struct cfg80211_registered_device *rdev,
+ struct net_device *dev,
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 5643bdee7198..018c60be153a 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2254,14 +2254,15 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
+
+ static void handle_channel_custom(struct wiphy *wiphy,
+ struct ieee80211_channel *chan,
+- const struct ieee80211_regdomain *regd)
++ const struct ieee80211_regdomain *regd,
++ u32 min_bw)
+ {
+ u32 bw_flags = 0;
+ const struct ieee80211_reg_rule *reg_rule = NULL;
+ const struct ieee80211_power_rule *power_rule = NULL;
+ u32 bw;
+
+- for (bw = MHZ_TO_KHZ(20); bw >= MHZ_TO_KHZ(5); bw = bw / 2) {
++ for (bw = MHZ_TO_KHZ(20); bw >= min_bw; bw = bw / 2) {
+ reg_rule = freq_reg_info_regd(MHZ_TO_KHZ(chan->center_freq),
+ regd, bw);
+ if (!IS_ERR(reg_rule))
+@@ -2317,8 +2318,14 @@ static void handle_band_custom(struct wiphy *wiphy,
+ if (!sband)
+ return;
+
++ /*
++ * We currently assume that you always want at least 20 MHz,
++ * otherwise channel 12 might get enabled if this rule is
++ * compatible to US, which permits 2402 - 2472 MHz.
++ */
+ for (i = 0; i < sband->n_channels; i++)
+- handle_channel_custom(wiphy, &sband->channels[i], regd);
++ handle_channel_custom(wiphy, &sband->channels[i], regd,
++ MHZ_TO_KHZ(20));
+ }
+
+ /* Used by drivers prior to wiphy registration */
+@@ -3833,6 +3840,25 @@ bool regulatory_pre_cac_allowed(struct wiphy *wiphy)
+ return pre_cac_allowed;
+ }
+
++static void cfg80211_check_and_end_cac(struct cfg80211_registered_device *rdev)
++{
++ struct wireless_dev *wdev;
++ /* If we finished CAC or received radar, we should end any
++ * CAC running on the same channels.
++ * the check !cfg80211_chandef_dfs_usable contain 2 options:
++ * either all channels are available - those the CAC_FINISHED
++ * event has effected another wdev state, or there is a channel
++ * in unavailable state in wdev chandef - those the RADAR_DETECTED
++ * event has effected another wdev state.
++ * In both cases we should end the CAC on the wdev.
++ */
++ list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
++ if (wdev->cac_started &&
++ !cfg80211_chandef_dfs_usable(&rdev->wiphy, &wdev->chandef))
++ rdev_end_cac(rdev, wdev->netdev);
++ }
++}
++
+ void regulatory_propagate_dfs_state(struct wiphy *wiphy,
+ struct cfg80211_chan_def *chandef,
+ enum nl80211_dfs_state dfs_state,
+@@ -3859,8 +3885,10 @@ void regulatory_propagate_dfs_state(struct wiphy *wiphy,
+ cfg80211_set_dfs_state(&rdev->wiphy, chandef, dfs_state);
+
+ if (event == NL80211_RADAR_DETECTED ||
+- event == NL80211_RADAR_CAC_FINISHED)
++ event == NL80211_RADAR_CAC_FINISHED) {
+ cfg80211_sched_dfs_chan_update(rdev);
++ cfg80211_check_and_end_cac(rdev);
++ }
+
+ nl80211_radar_notify(rdev, chandef, event, NULL, GFP_KERNEL);
+ }
+diff --git a/net/wireless/trace.h b/net/wireless/trace.h
+index 7c73510b161f..54b0bb344cf9 100644
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -607,6 +607,11 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_flush_pmksa,
+ TP_ARGS(wiphy, netdev)
+ );
+
++DEFINE_EVENT(wiphy_netdev_evt, rdev_end_cac,
++ TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
++ TP_ARGS(wiphy, netdev)
++);
++
+ DECLARE_EVENT_CLASS(station_add_change,
+ TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, u8 *mac,
+ struct station_parameters *params),
+diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
+index 5e677dac2a0c..69102fda9ebd 100644
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -657,7 +657,8 @@ struct iw_statistics *get_wireless_stats(struct net_device *dev)
+ return NULL;
+ }
+
+-static int iw_handler_get_iwstats(struct net_device * dev,
++/* noinline to avoid a bogus warning with -O3 */
++static noinline int iw_handler_get_iwstats(struct net_device * dev,
+ struct iw_request_info * info,
+ union iwreq_data * wrqu,
+ char * extra)
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 4ee512622e93..317fe9c92932 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -268,9 +268,6 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ int err = -1;
+ int mtu;
+
+- if (!dst)
+- goto tx_err_link_failure;
+-
+ dst_hold(dst);
+ dst = xfrm_lookup_with_ifid(xi->net, dst, fl, NULL, 0, xi->p.if_id);
+ if (IS_ERR(dst)) {
+@@ -297,7 +294,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+
+ mtu = dst_mtu(dst);
+ if (!skb->ignore_df && skb->len > mtu) {
+- skb_dst_update_pmtu(skb, mtu);
++ skb_dst_update_pmtu_no_confirm(skb, mtu);
+
+ if (skb->protocol == htons(ETH_P_IPV6)) {
+ if (mtu < IPV6_MIN_MTU)
+@@ -343,6 +340,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct xfrm_if *xi = netdev_priv(dev);
+ struct net_device_stats *stats = &xi->dev->stats;
++ struct dst_entry *dst = skb_dst(skb);
+ struct flowi fl;
+ int ret;
+
+@@ -352,10 +350,33 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
+ case htons(ETH_P_IPV6):
+ xfrm_decode_session(skb, &fl, AF_INET6);
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
++ if (!dst) {
++ fl.u.ip6.flowi6_oif = dev->ifindex;
++ fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++ dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
++ if (dst->error) {
++ dst_release(dst);
++ stats->tx_carrier_errors++;
++ goto tx_err;
++ }
++ skb_dst_set(skb, dst);
++ }
+ break;
+ case htons(ETH_P_IP):
+ xfrm_decode_session(skb, &fl, AF_INET);
+ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
++ if (!dst) {
++ struct rtable *rt;
++
++ fl.u.ip4.flowi4_oif = dev->ifindex;
++ fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++ rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
++ if (IS_ERR(rt)) {
++ stats->tx_carrier_errors++;
++ goto tx_err;
++ }
++ skb_dst_set(skb, &rt->dst);
++ }
+ break;
+ default:
+ goto tx_err;
+@@ -566,12 +587,9 @@ static void xfrmi_dev_setup(struct net_device *dev)
+ {
+ dev->netdev_ops = &xfrmi_netdev_ops;
+ dev->type = ARPHRD_NONE;
+- dev->hard_header_len = ETH_HLEN;
+- dev->min_header_len = ETH_HLEN;
+ dev->mtu = ETH_DATA_LEN;
+ dev->min_mtu = ETH_MIN_MTU;
+- dev->max_mtu = ETH_DATA_LEN;
+- dev->addr_len = ETH_ALEN;
++ dev->max_mtu = IP_MAX_MTU;
+ dev->flags = IFF_NOARP;
+ dev->needs_free_netdev = true;
+ dev->priv_destructor = xfrmi_dev_free;
+diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
+index 03923a138ef5..ca0c98240e0d 100644
+--- a/security/tomoyo/common.c
++++ b/security/tomoyo/common.c
+@@ -2254,9 +2254,9 @@ static const char * const tomoyo_memory_headers[TOMOYO_MAX_MEMORY_STAT] = {
+ [TOMOYO_MEMORY_QUERY] = "query message:",
+ };
+
+-/* Timestamp counter for last updated. */
+-static unsigned int tomoyo_stat_updated[TOMOYO_MAX_POLICY_STAT];
+ /* Counter for number of updates. */
++static atomic_t tomoyo_stat_updated[TOMOYO_MAX_POLICY_STAT];
++/* Timestamp counter for last updated. */
+ static time64_t tomoyo_stat_modified[TOMOYO_MAX_POLICY_STAT];
+
+ /**
+@@ -2268,10 +2268,7 @@ static time64_t tomoyo_stat_modified[TOMOYO_MAX_POLICY_STAT];
+ */
+ void tomoyo_update_stat(const u8 index)
+ {
+- /*
+- * I don't use atomic operations because race condition is not fatal.
+- */
+- tomoyo_stat_updated[index]++;
++ atomic_inc(&tomoyo_stat_updated[index]);
+ tomoyo_stat_modified[index] = ktime_get_real_seconds();
+ }
+
+@@ -2291,7 +2288,7 @@ static void tomoyo_read_stat(struct tomoyo_io_buffer *head)
+ for (i = 0; i < TOMOYO_MAX_POLICY_STAT; i++) {
+ tomoyo_io_printf(head, "Policy %-30s %10u",
+ tomoyo_policy_headers[i],
+- tomoyo_stat_updated[i]);
++ atomic_read(&tomoyo_stat_updated[i]));
+ if (tomoyo_stat_modified[i]) {
+ struct tomoyo_time stamp;
+ tomoyo_convert_time(tomoyo_stat_modified[i], &stamp);
+diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
+index 27770143ae8f..974e1a449172 100644
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -2435,6 +2435,13 @@ static void rt5640_disable_jack_detect(struct snd_soc_component *component)
+ {
+ struct rt5640_priv *rt5640 = snd_soc_component_get_drvdata(component);
+
++ /*
++ * soc_remove_component() force-disables jack and thus rt5640->jack
++ * could be NULL at the time of driver's module unloading.
++ */
++ if (!rt5640->jack)
++ return;
++
+ disable_irq(rt5640->irq);
+ rt5640_cancel_work(rt5640);
+
+diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c
+index 313dab2857ef..4b0beb372cd9 100644
+--- a/sound/soc/sti/uniperif_player.c
++++ b/sound/soc/sti/uniperif_player.c
+@@ -226,7 +226,6 @@ static void uni_player_set_channel_status(struct uniperif *player,
+ * sampling frequency. If no sample rate is already specified, then
+ * set one.
+ */
+- mutex_lock(&player->ctrl_lock);
+ if (runtime) {
+ switch (runtime->rate) {
+ case 22050:
+@@ -303,7 +302,6 @@ static void uni_player_set_channel_status(struct uniperif *player,
+ player->stream_settings.iec958.status[3 + (n * 4)] << 24;
+ SET_UNIPERIF_CHANNEL_STA_REGN(player, n, status);
+ }
+- mutex_unlock(&player->ctrl_lock);
+
+ /* Update the channel status */
+ if (player->ver < SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0)
+@@ -365,8 +363,10 @@ static int uni_player_prepare_iec958(struct uniperif *player,
+
+ SET_UNIPERIF_CTRL_ZERO_STUFF_HW(player);
+
++ mutex_lock(&player->ctrl_lock);
+ /* Update the channel status */
+ uni_player_set_channel_status(player, runtime);
++ mutex_unlock(&player->ctrl_lock);
+
+ /* Clear the user validity user bits */
+ SET_UNIPERIF_USER_VALIDITY_VALIDITY_LR(player, 0);
+@@ -598,7 +598,6 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol,
+ iec958->status[1] = ucontrol->value.iec958.status[1];
+ iec958->status[2] = ucontrol->value.iec958.status[2];
+ iec958->status[3] = ucontrol->value.iec958.status[3];
+- mutex_unlock(&player->ctrl_lock);
+
+ spin_lock_irqsave(&player->irq_lock, flags);
+ if (player->substream && player->substream->runtime)
+@@ -608,6 +607,8 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol,
+ uni_player_set_channel_status(player, NULL);
+
+ spin_unlock_irqrestore(&player->irq_lock, flags);
++ mutex_unlock(&player->ctrl_lock);
++
+ return 0;
+ }
+
+diff --git a/tools/include/linux/string.h b/tools/include/linux/string.h
+index 6c3e2cc274c5..0ec646f127dc 100644
+--- a/tools/include/linux/string.h
++++ b/tools/include/linux/string.h
+@@ -14,7 +14,15 @@ int strtobool(const char *s, bool *res);
+ * However uClibc headers also define __GLIBC__ hence the hack below
+ */
+ #if defined(__GLIBC__) && !defined(__UCLIBC__)
++// pragma diagnostic was introduced in gcc 4.6
++#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
++#pragma GCC diagnostic push
++#pragma GCC diagnostic ignored "-Wredundant-decls"
++#endif
+ extern size_t strlcpy(char *dest, const char *src, size_t size);
++#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
++#pragma GCC diagnostic pop
++#endif
+ #endif
+
+ char *str_error_r(int errnum, char *buf, size_t buflen);
+diff --git a/tools/lib/string.c b/tools/lib/string.c
+index 93b3d4b6feac..ee0afcbdd696 100644
+--- a/tools/lib/string.c
++++ b/tools/lib/string.c
+@@ -95,6 +95,10 @@ int strtobool(const char *s, bool *res)
+ * If libc has strlcpy() then that version will override this
+ * implementation:
+ */
++#ifdef __clang__
++#pragma clang diagnostic push
++#pragma clang diagnostic ignored "-Wignored-attributes"
++#endif
+ size_t __weak strlcpy(char *dest, const char *src, size_t size)
+ {
+ size_t ret = strlen(src);
+@@ -106,3 +110,6 @@ size_t __weak strlcpy(char *dest, const char *src, size_t size)
+ }
+ return ret;
+ }
++#ifdef __clang__
++#pragma clang diagnostic pop
++#endif
+diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c
+index 2700f1f17876..27248a0aad84 100644
+--- a/tools/lib/traceevent/parse-filter.c
++++ b/tools/lib/traceevent/parse-filter.c
+@@ -1227,8 +1227,10 @@ filter_event(struct event_filter *filter, struct event_format *event,
+ }
+
+ filter_type = add_filter_type(filter, event->id);
+- if (filter_type == NULL)
++ if (filter_type == NULL) {
++ free_arg(arg);
+ return TEP_ERRNO__MEM_ALLOC_FAILED;
++ }
+
+ if (filter_type->filter)
+ free_arg(filter_type->filter);
+diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
+index 1452e5153c60..2bd39fdc8ab0 100644
+--- a/tools/perf/builtin-c2c.c
++++ b/tools/perf/builtin-c2c.c
+@@ -586,8 +586,8 @@ tot_hitm_cmp(struct perf_hpp_fmt *fmt __maybe_unused,
+ {
+ struct c2c_hist_entry *c2c_left;
+ struct c2c_hist_entry *c2c_right;
+- unsigned int tot_hitm_left;
+- unsigned int tot_hitm_right;
++ uint64_t tot_hitm_left;
++ uint64_t tot_hitm_right;
+
+ c2c_left = container_of(left, struct c2c_hist_entry, he);
+ c2c_right = container_of(right, struct c2c_hist_entry, he);
+@@ -620,7 +620,8 @@ __f ## _cmp(struct perf_hpp_fmt *fmt __maybe_unused, \
+ \
+ c2c_left = container_of(left, struct c2c_hist_entry, he); \
+ c2c_right = container_of(right, struct c2c_hist_entry, he); \
+- return c2c_left->stats.__f - c2c_right->stats.__f; \
++ return (uint64_t) c2c_left->stats.__f - \
++ (uint64_t) c2c_right->stats.__f; \
+ }
+
+ #define STAT_FN(__f) \
+@@ -673,7 +674,8 @@ ld_llcmiss_cmp(struct perf_hpp_fmt *fmt __maybe_unused,
+ c2c_left = container_of(left, struct c2c_hist_entry, he);
+ c2c_right = container_of(right, struct c2c_hist_entry, he);
+
+- return llc_miss(&c2c_left->stats) - llc_miss(&c2c_right->stats);
++ return (uint64_t) llc_miss(&c2c_left->stats) -
++ (uint64_t) llc_miss(&c2c_right->stats);
+ }
+
+ static uint64_t total_records(struct c2c_stats *stats)
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index b2b6a9672544..5312c761a5db 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -383,10 +383,10 @@ static int report__setup_sample_type(struct report *rep)
+ PERF_SAMPLE_BRANCH_ANY))
+ rep->nonany_branch_mode = true;
+
+-#ifndef HAVE_LIBUNWIND_SUPPORT
++#if !defined(HAVE_LIBUNWIND_SUPPORT) && !defined(HAVE_DWARF_SUPPORT)
+ if (dwarf_callchain_users) {
+- ui__warning("Please install libunwind development packages "
+- "during the perf build.\n");
++ ui__warning("Please install libunwind or libdw "
++ "development packages during the perf build.\n");
+ }
+ #endif
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-02-11 16:20 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-02-11 16:20 UTC (permalink / raw
To: gentoo-commits
commit: 7f8cc789b776e0cf768d27cff4118be5960094c0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Feb 11 16:20:35 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Feb 11 16:20:35 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7f8cc789
Linux patch 4.19.103
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1102_linux-4.19.103.patch | 17138 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 17142 insertions(+)
diff --git a/0000_README b/0000_README
index 0d9cae4..8ac0cbe 100644
--- a/0000_README
+++ b/0000_README
@@ -447,6 +447,10 @@ Patch: 1101_linux-4.19.102.patch
From: https://www.kernel.org
Desc: Linux 4.19.102
+Patch: 1102_linux-4.19.103.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.103
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1102_linux-4.19.103.patch b/1102_linux-4.19.103.patch
new file mode 100644
index 0000000..7b0adc1
--- /dev/null
+++ b/1102_linux-4.19.103.patch
@@ -0,0 +1,17138 @@
+diff --git a/Makefile b/Makefile
+index 597a14e2127b..37f58becf5c2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 102
++SUBLEVEL = 103
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/include/asm/kvm_emulate.h b/arch/arm/include/asm/kvm_emulate.h
+index 77121b713bef..7d2ca035d6c8 100644
+--- a/arch/arm/include/asm/kvm_emulate.h
++++ b/arch/arm/include/asm/kvm_emulate.h
+@@ -26,13 +26,25 @@
+ #include <asm/cputype.h>
+
+ /* arm64 compatibility macros */
++#define PSR_AA32_MODE_FIQ FIQ_MODE
++#define PSR_AA32_MODE_SVC SVC_MODE
+ #define PSR_AA32_MODE_ABT ABT_MODE
+ #define PSR_AA32_MODE_UND UND_MODE
+ #define PSR_AA32_T_BIT PSR_T_BIT
++#define PSR_AA32_F_BIT PSR_F_BIT
+ #define PSR_AA32_I_BIT PSR_I_BIT
+ #define PSR_AA32_A_BIT PSR_A_BIT
+ #define PSR_AA32_E_BIT PSR_E_BIT
+ #define PSR_AA32_IT_MASK PSR_IT_MASK
++#define PSR_AA32_GE_MASK 0x000f0000
++#define PSR_AA32_DIT_BIT 0x00200000
++#define PSR_AA32_PAN_BIT 0x00400000
++#define PSR_AA32_SSBS_BIT 0x00800000
++#define PSR_AA32_Q_BIT PSR_Q_BIT
++#define PSR_AA32_V_BIT PSR_V_BIT
++#define PSR_AA32_C_BIT PSR_C_BIT
++#define PSR_AA32_Z_BIT PSR_Z_BIT
++#define PSR_AA32_N_BIT PSR_N_BIT
+
+ unsigned long *vcpu_reg(struct kvm_vcpu *vcpu, u8 reg_num);
+
+@@ -53,6 +65,11 @@ static inline void vcpu_write_spsr(struct kvm_vcpu *vcpu, unsigned long v)
+ *__vcpu_spsr(vcpu) = v;
+ }
+
++static inline unsigned long host_spsr_to_spsr32(unsigned long spsr)
++{
++ return spsr;
++}
++
+ static inline unsigned long vcpu_get_reg(struct kvm_vcpu *vcpu,
+ u8 reg_num)
+ {
+@@ -189,6 +206,11 @@ static inline bool kvm_vcpu_dabt_issext(struct kvm_vcpu *vcpu)
+ return kvm_vcpu_get_hsr(vcpu) & HSR_SSE;
+ }
+
++static inline bool kvm_vcpu_dabt_issf(const struct kvm_vcpu *vcpu)
++{
++ return false;
++}
++
+ static inline int kvm_vcpu_dabt_get_rd(struct kvm_vcpu *vcpu)
+ {
+ return (kvm_vcpu_get_hsr(vcpu) & HSR_SRT_MASK) >> HSR_SRT_SHIFT;
+diff --git a/arch/arm/include/asm/kvm_mmio.h b/arch/arm/include/asm/kvm_mmio.h
+index f3a7de71f515..848339d76f9a 100644
+--- a/arch/arm/include/asm/kvm_mmio.h
++++ b/arch/arm/include/asm/kvm_mmio.h
+@@ -26,6 +26,8 @@
+ struct kvm_decode {
+ unsigned long rt;
+ bool sign_extend;
++ /* Not used on 32-bit arm */
++ bool sixty_four;
+ };
+
+ void kvm_mmio_write_buf(void *buf, unsigned int len, unsigned long data);
+diff --git a/arch/arm/mach-tegra/sleep-tegra30.S b/arch/arm/mach-tegra/sleep-tegra30.S
+index dd4a67dabd91..b7cd41461e7d 100644
+--- a/arch/arm/mach-tegra/sleep-tegra30.S
++++ b/arch/arm/mach-tegra/sleep-tegra30.S
+@@ -382,6 +382,14 @@ _pll_m_c_x_done:
+ pll_locked r1, r0, CLK_RESET_PLLC_BASE
+ pll_locked r1, r0, CLK_RESET_PLLX_BASE
+
++ tegra_get_soc_id TEGRA_APB_MISC_BASE, r1
++ cmp r1, #TEGRA30
++ beq 1f
++ ldr r1, [r0, #CLK_RESET_PLLP_BASE]
++ bic r1, r1, #(1<<31) @ disable PllP bypass
++ str r1, [r0, #CLK_RESET_PLLP_BASE]
++1:
++
+ mov32 r7, TEGRA_TMRUS_BASE
+ ldr r1, [r7]
+ add r1, r1, #LOCK_DELAY
+@@ -641,7 +649,10 @@ tegra30_switch_cpu_to_clk32k:
+ str r0, [r4, #PMC_PLLP_WB0_OVERRIDE]
+
+ /* disable PLLP, PLLA, PLLC and PLLX */
++ tegra_get_soc_id TEGRA_APB_MISC_BASE, r1
++ cmp r1, #TEGRA30
+ ldr r0, [r5, #CLK_RESET_PLLP_BASE]
++ orrne r0, r0, #(1 << 31) @ enable PllP bypass on fast cluster
+ bic r0, r0, #(1 << 30)
+ str r0, [r5, #CLK_RESET_PLLP_BASE]
+ ldr r0, [r5, #CLK_RESET_PLLA_BASE]
+diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
+index 6106a85ae0be..778cb4f868d9 100644
+--- a/arch/arm64/include/asm/kvm_emulate.h
++++ b/arch/arm64/include/asm/kvm_emulate.h
+@@ -202,6 +202,38 @@ static inline void vcpu_write_spsr(struct kvm_vcpu *vcpu, unsigned long v)
+ vcpu_gp_regs(vcpu)->spsr[KVM_SPSR_EL1] = v;
+ }
+
++/*
++ * The layout of SPSR for an AArch32 state is different when observed from an
++ * AArch64 SPSR_ELx or an AArch32 SPSR_*. This function generates the AArch32
++ * view given an AArch64 view.
++ *
++ * In ARM DDI 0487E.a see:
++ *
++ * - The AArch64 view (SPSR_EL2) in section C5.2.18, page C5-426
++ * - The AArch32 view (SPSR_abt) in section G8.2.126, page G8-6256
++ * - The AArch32 view (SPSR_und) in section G8.2.132, page G8-6280
++ *
++ * Which show the following differences:
++ *
++ * | Bit | AA64 | AA32 | Notes |
++ * +-----+------+------+-----------------------------|
++ * | 24 | DIT | J | J is RES0 in ARMv8 |
++ * | 21 | SS | DIT | SS doesn't exist in AArch32 |
++ *
++ * ... and all other bits are (currently) common.
++ */
++static inline unsigned long host_spsr_to_spsr32(unsigned long spsr)
++{
++ const unsigned long overlap = BIT(24) | BIT(21);
++ unsigned long dit = !!(spsr & PSR_AA32_DIT_BIT);
++
++ spsr &= ~overlap;
++
++ spsr |= dit << 21;
++
++ return spsr;
++}
++
+ static inline bool vcpu_mode_priv(const struct kvm_vcpu *vcpu)
+ {
+ u32 mode;
+@@ -261,6 +293,11 @@ static inline bool kvm_vcpu_dabt_issext(const struct kvm_vcpu *vcpu)
+ return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_SSE);
+ }
+
++static inline bool kvm_vcpu_dabt_issf(const struct kvm_vcpu *vcpu)
++{
++ return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_SF);
++}
++
+ static inline int kvm_vcpu_dabt_get_rd(const struct kvm_vcpu *vcpu)
+ {
+ return (kvm_vcpu_get_hsr(vcpu) & ESR_ELx_SRT_MASK) >> ESR_ELx_SRT_SHIFT;
+diff --git a/arch/arm64/include/asm/kvm_mmio.h b/arch/arm64/include/asm/kvm_mmio.h
+index 75ea42079757..0240290cf764 100644
+--- a/arch/arm64/include/asm/kvm_mmio.h
++++ b/arch/arm64/include/asm/kvm_mmio.h
+@@ -21,13 +21,11 @@
+ #include <linux/kvm_host.h>
+ #include <asm/kvm_arm.h>
+
+-/*
+- * This is annoying. The mmio code requires this, even if we don't
+- * need any decoding. To be fixed.
+- */
+ struct kvm_decode {
+ unsigned long rt;
+ bool sign_extend;
++ /* Witdth of the register accessed by the faulting instruction is 64-bits */
++ bool sixty_four;
+ };
+
+ void kvm_mmio_write_buf(void *buf, unsigned int len, unsigned long data);
+diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h
+index 6bc43889d11e..163970d5c4b1 100644
+--- a/arch/arm64/include/asm/ptrace.h
++++ b/arch/arm64/include/asm/ptrace.h
+@@ -50,6 +50,7 @@
+ #define PSR_AA32_I_BIT 0x00000080
+ #define PSR_AA32_A_BIT 0x00000100
+ #define PSR_AA32_E_BIT 0x00000200
++#define PSR_AA32_PAN_BIT 0x00400000
+ #define PSR_AA32_SSBS_BIT 0x00800000
+ #define PSR_AA32_DIT_BIT 0x01000000
+ #define PSR_AA32_Q_BIT 0x08000000
+diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h
+index b0fd1d300154..978ff79fba2b 100644
+--- a/arch/arm64/include/uapi/asm/ptrace.h
++++ b/arch/arm64/include/uapi/asm/ptrace.h
+@@ -49,6 +49,7 @@
+ #define PSR_SSBS_BIT 0x00001000
+ #define PSR_PAN_BIT 0x00400000
+ #define PSR_UAO_BIT 0x00800000
++#define PSR_DIT_BIT 0x01000000
+ #define PSR_V_BIT 0x10000000
+ #define PSR_C_BIT 0x20000000
+ #define PSR_Z_BIT 0x40000000
+diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
+index a55e91dfcf8f..41c80c311367 100644
+--- a/arch/arm64/kvm/inject_fault.c
++++ b/arch/arm64/kvm/inject_fault.c
+@@ -25,9 +25,6 @@
+ #include <asm/kvm_emulate.h>
+ #include <asm/esr.h>
+
+-#define PSTATE_FAULT_BITS_64 (PSR_MODE_EL1h | PSR_A_BIT | PSR_F_BIT | \
+- PSR_I_BIT | PSR_D_BIT)
+-
+ #define CURRENT_EL_SP_EL0_VECTOR 0x0
+ #define CURRENT_EL_SP_ELx_VECTOR 0x200
+ #define LOWER_EL_AArch64_VECTOR 0x400
+@@ -61,6 +58,69 @@ static u64 get_except_vector(struct kvm_vcpu *vcpu, enum exception_type type)
+ return vcpu_read_sys_reg(vcpu, VBAR_EL1) + exc_offset + type;
+ }
+
++/*
++ * When an exception is taken, most PSTATE fields are left unchanged in the
++ * handler. However, some are explicitly overridden (e.g. M[4:0]). Luckily all
++ * of the inherited bits have the same position in the AArch64/AArch32 SPSR_ELx
++ * layouts, so we don't need to shuffle these for exceptions from AArch32 EL0.
++ *
++ * For the SPSR_ELx layout for AArch64, see ARM DDI 0487E.a page C5-429.
++ * For the SPSR_ELx layout for AArch32, see ARM DDI 0487E.a page C5-426.
++ *
++ * Here we manipulate the fields in order of the AArch64 SPSR_ELx layout, from
++ * MSB to LSB.
++ */
++static unsigned long get_except64_pstate(struct kvm_vcpu *vcpu)
++{
++ unsigned long sctlr = vcpu_read_sys_reg(vcpu, SCTLR_EL1);
++ unsigned long old, new;
++
++ old = *vcpu_cpsr(vcpu);
++ new = 0;
++
++ new |= (old & PSR_N_BIT);
++ new |= (old & PSR_Z_BIT);
++ new |= (old & PSR_C_BIT);
++ new |= (old & PSR_V_BIT);
++
++ // TODO: TCO (if/when ARMv8.5-MemTag is exposed to guests)
++
++ new |= (old & PSR_DIT_BIT);
++
++ // PSTATE.UAO is set to zero upon any exception to AArch64
++ // See ARM DDI 0487E.a, page D5-2579.
++
++ // PSTATE.PAN is unchanged unless SCTLR_ELx.SPAN == 0b0
++ // SCTLR_ELx.SPAN is RES1 when ARMv8.1-PAN is not implemented
++ // See ARM DDI 0487E.a, page D5-2578.
++ new |= (old & PSR_PAN_BIT);
++ if (!(sctlr & SCTLR_EL1_SPAN))
++ new |= PSR_PAN_BIT;
++
++ // PSTATE.SS is set to zero upon any exception to AArch64
++ // See ARM DDI 0487E.a, page D2-2452.
++
++ // PSTATE.IL is set to zero upon any exception to AArch64
++ // See ARM DDI 0487E.a, page D1-2306.
++
++ // PSTATE.SSBS is set to SCTLR_ELx.DSSBS upon any exception to AArch64
++ // See ARM DDI 0487E.a, page D13-3258
++ if (sctlr & SCTLR_ELx_DSSBS)
++ new |= PSR_SSBS_BIT;
++
++ // PSTATE.BTYPE is set to zero upon any exception to AArch64
++ // See ARM DDI 0487E.a, pages D1-2293 to D1-2294.
++
++ new |= PSR_D_BIT;
++ new |= PSR_A_BIT;
++ new |= PSR_I_BIT;
++ new |= PSR_F_BIT;
++
++ new |= PSR_MODE_EL1h;
++
++ return new;
++}
++
+ static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr)
+ {
+ unsigned long cpsr = *vcpu_cpsr(vcpu);
+@@ -70,7 +130,7 @@ static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr
+ vcpu_write_elr_el1(vcpu, *vcpu_pc(vcpu));
+ *vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync);
+
+- *vcpu_cpsr(vcpu) = PSTATE_FAULT_BITS_64;
++ *vcpu_cpsr(vcpu) = get_except64_pstate(vcpu);
+ vcpu_write_spsr(vcpu, cpsr);
+
+ vcpu_write_sys_reg(vcpu, addr, FAR_EL1);
+@@ -105,7 +165,7 @@ static void inject_undef64(struct kvm_vcpu *vcpu)
+ vcpu_write_elr_el1(vcpu, *vcpu_pc(vcpu));
+ *vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync);
+
+- *vcpu_cpsr(vcpu) = PSTATE_FAULT_BITS_64;
++ *vcpu_cpsr(vcpu) = get_except64_pstate(vcpu);
+ vcpu_write_spsr(vcpu, cpsr);
+
+ /*
+diff --git a/arch/mips/Makefile.postlink b/arch/mips/Makefile.postlink
+index 4eea4188cb20..13e0beb9eee3 100644
+--- a/arch/mips/Makefile.postlink
++++ b/arch/mips/Makefile.postlink
+@@ -12,7 +12,7 @@ __archpost:
+ include scripts/Kbuild.include
+
+ CMD_RELOCS = arch/mips/boot/tools/relocs
+-quiet_cmd_relocs = RELOCS $@
++quiet_cmd_relocs = RELOCS $@
+ cmd_relocs = $(CMD_RELOCS) $@
+
+ # `@true` prevents complaint when there is nothing to be done
+diff --git a/arch/mips/boot/Makefile b/arch/mips/boot/Makefile
+index 35704c28a28b..0ccc20320099 100644
+--- a/arch/mips/boot/Makefile
++++ b/arch/mips/boot/Makefile
+@@ -123,7 +123,7 @@ $(obj)/vmlinux.its.S: $(addprefix $(srctree)/arch/mips/$(PLATFORM)/,$(ITS_INPUTS
+ targets += vmlinux.its
+ targets += vmlinux.gz.its
+ targets += vmlinux.bz2.its
+-targets += vmlinux.lzmo.its
++targets += vmlinux.lzma.its
+ targets += vmlinux.lzo.its
+
+ quiet_cmd_cpp_its_S = ITS $@
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index a80669209155..6f475dc5829b 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -230,6 +230,7 @@ config PPC
+ select NEED_SG_DMA_LENGTH
+ select NO_BOOTMEM
+ select OF
++ select OF_DMA_DEFAULT_COHERENT if !NOT_COHERENT_CACHE
+ select OF_EARLY_FLATTREE
+ select OF_RESERVED_MEM
+ select OLD_SIGACTION if PPC32
+diff --git a/arch/powerpc/boot/4xx.c b/arch/powerpc/boot/4xx.c
+index f7da65169124..3c8774163c7e 100644
+--- a/arch/powerpc/boot/4xx.c
++++ b/arch/powerpc/boot/4xx.c
+@@ -232,7 +232,7 @@ void ibm4xx_denali_fixup_memsize(void)
+ dpath = 8; /* 64 bits */
+
+ /* get address pins (rows) */
+- val = SDRAM0_READ(DDR0_42);
++ val = SDRAM0_READ(DDR0_42);
+
+ row = DDR_GET_VAL(val, DDR_APIN, DDR_APIN_SHIFT);
+ if (row > max_row)
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index dbfe32327212..5dc592fb4f5f 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -2065,7 +2065,7 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_hv(struct kvm *kvm,
+ mutex_unlock(&kvm->lock);
+
+ if (!vcore)
+- goto free_vcpu;
++ goto uninit_vcpu;
+
+ spin_lock(&vcore->lock);
+ ++vcore->num_threads;
+@@ -2082,6 +2082,8 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_hv(struct kvm *kvm,
+
+ return vcpu;
+
++uninit_vcpu:
++ kvm_vcpu_uninit(vcpu);
+ free_vcpu:
+ kmem_cache_free(kvm_vcpu_cache, vcpu);
+ out:
+diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c
+index de9702219dee..7869112a8f3c 100644
+--- a/arch/powerpc/kvm/book3s_pr.c
++++ b/arch/powerpc/kvm/book3s_pr.c
+@@ -1772,10 +1772,12 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_pr(struct kvm *kvm,
+
+ err = kvmppc_mmu_init(vcpu);
+ if (err < 0)
+- goto uninit_vcpu;
++ goto free_shared_page;
+
+ return vcpu;
+
++free_shared_page:
++ free_page((unsigned long)vcpu->arch.shared);
+ uninit_vcpu:
+ kvm_vcpu_uninit(vcpu);
+ free_shadow_vcpu:
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index c2c6f32848e1..fc01a2c0f8ed 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -366,8 +366,10 @@ static bool lmb_is_removable(struct drmem_lmb *lmb)
+
+ for (i = 0; i < scns_per_block; i++) {
+ pfn = PFN_DOWN(phys_addr);
+- if (!pfn_present(pfn))
++ if (!pfn_present(pfn)) {
++ phys_addr += MIN_MEMORY_BLOCK_SIZE;
+ continue;
++ }
+
+ rc &= is_mem_section_removable(pfn, PAGES_PER_SECTION);
+ phys_addr += MIN_MEMORY_BLOCK_SIZE;
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index f0fa22e7d36c..3291e5fb94bc 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -1878,15 +1878,14 @@ static void dump_300_sprs(void)
+
+ printf("pidr = %.16lx tidr = %.16lx\n",
+ mfspr(SPRN_PID), mfspr(SPRN_TIDR));
+- printf("asdr = %.16lx psscr = %.16lx\n",
+- mfspr(SPRN_ASDR), hv ? mfspr(SPRN_PSSCR)
+- : mfspr(SPRN_PSSCR_PR));
++ printf("psscr = %.16lx\n",
++ hv ? mfspr(SPRN_PSSCR) : mfspr(SPRN_PSSCR_PR));
+
+ if (!hv)
+ return;
+
+- printf("ptcr = %.16lx\n",
+- mfspr(SPRN_PTCR));
++ printf("ptcr = %.16lx asdr = %.16lx\n",
++ mfspr(SPRN_PTCR), mfspr(SPRN_ASDR));
+ #endif
+ }
+
+diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
+index 0d753291c43c..ac3c86b21d79 100644
+--- a/arch/s390/include/asm/page.h
++++ b/arch/s390/include/asm/page.h
+@@ -33,6 +33,8 @@
+ #define ARCH_HAS_PREPARE_HUGEPAGE
+ #define ARCH_HAS_HUGEPAGE_CLEAR_FLUSH
+
++#define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
++
+ #include <asm/setup.h>
+ #ifndef __ASSEMBLY__
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index db3196aebaa1..11c3cd906ab4 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -2564,9 +2564,7 @@ static void kvm_s390_vcpu_initial_reset(struct kvm_vcpu *vcpu)
+ vcpu->arch.sie_block->gcr[14] = CR14_UNUSED_32 |
+ CR14_UNUSED_33 |
+ CR14_EXTERNAL_DAMAGE_SUBMASK;
+- /* make sure the new fpc will be lazily loaded */
+- save_fpu_regs();
+- current->thread.fpu.fpc = 0;
++ vcpu->run->s.regs.fpc = 0;
+ vcpu->arch.sie_block->gbea = 1;
+ vcpu->arch.sie_block->pp = 0;
+ vcpu->arch.sie_block->fpf &= ~FPF_BPBC;
+@@ -3994,7 +3992,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
+ switch (ioctl) {
+ case KVM_S390_STORE_STATUS:
+ idx = srcu_read_lock(&vcpu->kvm->srcu);
+- r = kvm_s390_vcpu_store_status(vcpu, arg);
++ r = kvm_s390_store_status_unloaded(vcpu, arg);
+ srcu_read_unlock(&vcpu->kvm->srcu, idx);
+ break;
+ case KVM_S390_SET_INITIAL_PSW: {
+diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
+index b0246c705a19..5674710a4841 100644
+--- a/arch/s390/mm/hugetlbpage.c
++++ b/arch/s390/mm/hugetlbpage.c
+@@ -2,7 +2,7 @@
+ /*
+ * IBM System z Huge TLB Page Support for Kernel.
+ *
+- * Copyright IBM Corp. 2007,2016
++ * Copyright IBM Corp. 2007,2020
+ * Author(s): Gerald Schaefer <gerald.schaefer@de.ibm.com>
+ */
+
+@@ -11,6 +11,9 @@
+
+ #include <linux/mm.h>
+ #include <linux/hugetlb.h>
++#include <linux/mman.h>
++#include <linux/sched/mm.h>
++#include <linux/security.h>
+
+ /*
+ * If the bit selected by single-bit bitmask "a" is set within "x", move
+@@ -267,3 +270,98 @@ static __init int setup_hugepagesz(char *opt)
+ return 1;
+ }
+ __setup("hugepagesz=", setup_hugepagesz);
++
++static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
++ unsigned long addr, unsigned long len,
++ unsigned long pgoff, unsigned long flags)
++{
++ struct hstate *h = hstate_file(file);
++ struct vm_unmapped_area_info info;
++
++ info.flags = 0;
++ info.length = len;
++ info.low_limit = current->mm->mmap_base;
++ info.high_limit = TASK_SIZE;
++ info.align_mask = PAGE_MASK & ~huge_page_mask(h);
++ info.align_offset = 0;
++ return vm_unmapped_area(&info);
++}
++
++static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
++ unsigned long addr0, unsigned long len,
++ unsigned long pgoff, unsigned long flags)
++{
++ struct hstate *h = hstate_file(file);
++ struct vm_unmapped_area_info info;
++ unsigned long addr;
++
++ info.flags = VM_UNMAPPED_AREA_TOPDOWN;
++ info.length = len;
++ info.low_limit = max(PAGE_SIZE, mmap_min_addr);
++ info.high_limit = current->mm->mmap_base;
++ info.align_mask = PAGE_MASK & ~huge_page_mask(h);
++ info.align_offset = 0;
++ addr = vm_unmapped_area(&info);
++
++ /*
++ * A failed mmap() very likely causes application failure,
++ * so fall back to the bottom-up function here. This scenario
++ * can happen with large stack limits and large mmap()
++ * allocations.
++ */
++ if (addr & ~PAGE_MASK) {
++ VM_BUG_ON(addr != -ENOMEM);
++ info.flags = 0;
++ info.low_limit = TASK_UNMAPPED_BASE;
++ info.high_limit = TASK_SIZE;
++ addr = vm_unmapped_area(&info);
++ }
++
++ return addr;
++}
++
++unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
++ unsigned long len, unsigned long pgoff, unsigned long flags)
++{
++ struct hstate *h = hstate_file(file);
++ struct mm_struct *mm = current->mm;
++ struct vm_area_struct *vma;
++ int rc;
++
++ if (len & ~huge_page_mask(h))
++ return -EINVAL;
++ if (len > TASK_SIZE - mmap_min_addr)
++ return -ENOMEM;
++
++ if (flags & MAP_FIXED) {
++ if (prepare_hugepage_range(file, addr, len))
++ return -EINVAL;
++ goto check_asce_limit;
++ }
++
++ if (addr) {
++ addr = ALIGN(addr, huge_page_size(h));
++ vma = find_vma(mm, addr);
++ if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
++ (!vma || addr + len <= vm_start_gap(vma)))
++ goto check_asce_limit;
++ }
++
++ if (mm->get_unmapped_area == arch_get_unmapped_area)
++ addr = hugetlb_get_unmapped_area_bottomup(file, addr, len,
++ pgoff, flags);
++ else
++ addr = hugetlb_get_unmapped_area_topdown(file, addr, len,
++ pgoff, flags);
++ if (addr & ~PAGE_MASK)
++ return addr;
++
++check_asce_limit:
++ if (addr + len > current->mm->context.asce_limit &&
++ addr + len <= TASK_SIZE) {
++ rc = crst_table_upgrade(mm, addr + len);
++ if (rc)
++ return (unsigned long) rc;
++ }
++ return addr;
++}
+diff --git a/arch/sparc/include/uapi/asm/ipcbuf.h b/arch/sparc/include/uapi/asm/ipcbuf.h
+index 9d0d125500e2..084b8949ddff 100644
+--- a/arch/sparc/include/uapi/asm/ipcbuf.h
++++ b/arch/sparc/include/uapi/asm/ipcbuf.h
+@@ -15,19 +15,19 @@
+
+ struct ipc64_perm
+ {
+- __kernel_key_t key;
+- __kernel_uid_t uid;
+- __kernel_gid_t gid;
+- __kernel_uid_t cuid;
+- __kernel_gid_t cgid;
++ __kernel_key_t key;
++ __kernel_uid32_t uid;
++ __kernel_gid32_t gid;
++ __kernel_uid32_t cuid;
++ __kernel_gid32_t cgid;
+ #ifndef __arch64__
+- unsigned short __pad0;
++ unsigned short __pad0;
+ #endif
+- __kernel_mode_t mode;
+- unsigned short __pad1;
+- unsigned short seq;
+- unsigned long long __unused1;
+- unsigned long long __unused2;
++ __kernel_mode_t mode;
++ unsigned short __pad1;
++ unsigned short seq;
++ unsigned long long __unused1;
++ unsigned long long __unused2;
+ };
+
+ #endif /* __SPARC_IPCBUF_H */
+diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
+index 050368db9d35..3c1e51ead072 100644
+--- a/arch/x86/include/asm/apic.h
++++ b/arch/x86/include/asm/apic.h
+@@ -448,6 +448,14 @@ static inline void ack_APIC_irq(void)
+ apic_eoi();
+ }
+
++
++static inline bool lapic_vector_set_in_irr(unsigned int vector)
++{
++ u32 irr = apic_read(APIC_IRR + (vector / 32 * 0x10));
++
++ return !!(irr & (1U << (vector % 32)));
++}
++
+ static inline unsigned default_get_apic_id(unsigned long x)
+ {
+ unsigned int ver = GET_APIC_VERSION(apic_read(APIC_LVR));
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 155be8adb934..21a58fcc3dd4 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -350,12 +350,12 @@ struct kvm_mmu {
+ void (*set_cr3)(struct kvm_vcpu *vcpu, unsigned long root);
+ unsigned long (*get_cr3)(struct kvm_vcpu *vcpu);
+ u64 (*get_pdptr)(struct kvm_vcpu *vcpu, int index);
+- int (*page_fault)(struct kvm_vcpu *vcpu, gva_t gva, u32 err,
++ int (*page_fault)(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, u32 err,
+ bool prefault);
+ void (*inject_page_fault)(struct kvm_vcpu *vcpu,
+ struct x86_exception *fault);
+- gpa_t (*gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t gva, u32 access,
+- struct x86_exception *exception);
++ gpa_t (*gva_to_gpa)(struct kvm_vcpu *vcpu, gpa_t gva_or_gpa,
++ u32 access, struct x86_exception *exception);
+ gpa_t (*translate_gpa)(struct kvm_vcpu *vcpu, gpa_t gpa, u32 access,
+ struct x86_exception *exception);
+ int (*sync_page)(struct kvm_vcpu *vcpu,
+@@ -1354,7 +1354,7 @@ void kvm_vcpu_deactivate_apicv(struct kvm_vcpu *vcpu);
+
+ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu);
+
+-int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t gva, u64 error_code,
++int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, u64 error_code,
+ void *insn, int insn_len);
+ void kvm_mmu_invlpg(struct kvm_vcpu *vcpu, gva_t gva);
+ void kvm_mmu_invpcid_gva(struct kvm_vcpu *vcpu, gva_t gva, unsigned long pcid);
+diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c
+index 72a94401f9e0..1f5df339e48f 100644
+--- a/arch/x86/kernel/apic/msi.c
++++ b/arch/x86/kernel/apic/msi.c
+@@ -26,10 +26,8 @@
+
+ static struct irq_domain *msi_default_domain;
+
+-static void irq_msi_compose_msg(struct irq_data *data, struct msi_msg *msg)
++static void __irq_msi_compose_msg(struct irq_cfg *cfg, struct msi_msg *msg)
+ {
+- struct irq_cfg *cfg = irqd_cfg(data);
+-
+ msg->address_hi = MSI_ADDR_BASE_HI;
+
+ if (x2apic_enabled())
+@@ -50,6 +48,127 @@ static void irq_msi_compose_msg(struct irq_data *data, struct msi_msg *msg)
+ MSI_DATA_VECTOR(cfg->vector);
+ }
+
++static void irq_msi_compose_msg(struct irq_data *data, struct msi_msg *msg)
++{
++ __irq_msi_compose_msg(irqd_cfg(data), msg);
++}
++
++static void irq_msi_update_msg(struct irq_data *irqd, struct irq_cfg *cfg)
++{
++ struct msi_msg msg[2] = { [1] = { }, };
++
++ __irq_msi_compose_msg(cfg, msg);
++ irq_data_get_irq_chip(irqd)->irq_write_msi_msg(irqd, msg);
++}
++
++static int
++msi_set_affinity(struct irq_data *irqd, const struct cpumask *mask, bool force)
++{
++ struct irq_cfg old_cfg, *cfg = irqd_cfg(irqd);
++ struct irq_data *parent = irqd->parent_data;
++ unsigned int cpu;
++ int ret;
++
++ /* Save the current configuration */
++ cpu = cpumask_first(irq_data_get_effective_affinity_mask(irqd));
++ old_cfg = *cfg;
++
++ /* Allocate a new target vector */
++ ret = parent->chip->irq_set_affinity(parent, mask, force);
++ if (ret < 0 || ret == IRQ_SET_MASK_OK_DONE)
++ return ret;
++
++ /*
++ * For non-maskable and non-remapped MSI interrupts the migration
++ * to a different destination CPU and a different vector has to be
++ * done careful to handle the possible stray interrupt which can be
++ * caused by the non-atomic update of the address/data pair.
++ *
++ * Direct update is possible when:
++ * - The MSI is maskable (remapped MSI does not use this code path)).
++ * The quirk bit is not set in this case.
++ * - The new vector is the same as the old vector
++ * - The old vector is MANAGED_IRQ_SHUTDOWN_VECTOR (interrupt starts up)
++ * - The new destination CPU is the same as the old destination CPU
++ */
++ if (!irqd_msi_nomask_quirk(irqd) ||
++ cfg->vector == old_cfg.vector ||
++ old_cfg.vector == MANAGED_IRQ_SHUTDOWN_VECTOR ||
++ cfg->dest_apicid == old_cfg.dest_apicid) {
++ irq_msi_update_msg(irqd, cfg);
++ return ret;
++ }
++
++ /*
++ * Paranoia: Validate that the interrupt target is the local
++ * CPU.
++ */
++ if (WARN_ON_ONCE(cpu != smp_processor_id())) {
++ irq_msi_update_msg(irqd, cfg);
++ return ret;
++ }
++
++ /*
++ * Redirect the interrupt to the new vector on the current CPU
++ * first. This might cause a spurious interrupt on this vector if
++ * the device raises an interrupt right between this update and the
++ * update to the final destination CPU.
++ *
++ * If the vector is in use then the installed device handler will
++ * denote it as spurious which is no harm as this is a rare event
++ * and interrupt handlers have to cope with spurious interrupts
++ * anyway. If the vector is unused, then it is marked so it won't
++ * trigger the 'No irq handler for vector' warning in do_IRQ().
++ *
++ * This requires to hold vector lock to prevent concurrent updates to
++ * the affected vector.
++ */
++ lock_vector_lock();
++
++ /*
++ * Mark the new target vector on the local CPU if it is currently
++ * unused. Reuse the VECTOR_RETRIGGERED state which is also used in
++ * the CPU hotplug path for a similar purpose. This cannot be
++ * undone here as the current CPU has interrupts disabled and
++ * cannot handle the interrupt before the whole set_affinity()
++ * section is done. In the CPU unplug case, the current CPU is
++ * about to vanish and will not handle any interrupts anymore. The
++ * vector is cleaned up when the CPU comes online again.
++ */
++ if (IS_ERR_OR_NULL(this_cpu_read(vector_irq[cfg->vector])))
++ this_cpu_write(vector_irq[cfg->vector], VECTOR_RETRIGGERED);
++
++ /* Redirect it to the new vector on the local CPU temporarily */
++ old_cfg.vector = cfg->vector;
++ irq_msi_update_msg(irqd, &old_cfg);
++
++ /* Now transition it to the target CPU */
++ irq_msi_update_msg(irqd, cfg);
++
++ /*
++ * All interrupts after this point are now targeted at the new
++ * vector/CPU.
++ *
++ * Drop vector lock before testing whether the temporary assignment
++ * to the local CPU was hit by an interrupt raised in the device,
++ * because the retrigger function acquires vector lock again.
++ */
++ unlock_vector_lock();
++
++ /*
++ * Check whether the transition raced with a device interrupt and
++ * is pending in the local APICs IRR. It is safe to do this outside
++ * of vector lock as the irq_desc::lock of this interrupt is still
++ * held and interrupts are disabled: The check is not accessing the
++ * underlying vector store. It's just checking the local APIC's
++ * IRR.
++ */
++ if (lapic_vector_set_in_irr(cfg->vector))
++ irq_data_get_irq_chip(irqd)->irq_retrigger(irqd);
++
++ return ret;
++}
++
+ /*
+ * IRQ Chip for MSI PCI/PCI-X/PCI-Express Devices,
+ * which implement the MSI or MSI-X Capability Structure.
+@@ -61,6 +180,7 @@ static struct irq_chip pci_msi_controller = {
+ .irq_ack = irq_chip_ack_parent,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
+ .irq_compose_msi_msg = irq_msi_compose_msg,
++ .irq_set_affinity = msi_set_affinity,
+ .flags = IRQCHIP_SKIP_SET_WAKE,
+ };
+
+@@ -149,6 +269,8 @@ void __init arch_init_msi_domain(struct irq_domain *parent)
+ }
+ if (!msi_default_domain)
+ pr_warn("failed to initialize irqdomain for MSI/MSI-x.\n");
++ else
++ msi_default_domain->flags |= IRQ_DOMAIN_MSI_NOMASK_QUIRK;
+ }
+
+ #ifdef CONFIG_IRQ_REMAP
+diff --git a/arch/x86/kernel/cpu/tsx.c b/arch/x86/kernel/cpu/tsx.c
+index 3e20d322bc98..032509adf9de 100644
+--- a/arch/x86/kernel/cpu/tsx.c
++++ b/arch/x86/kernel/cpu/tsx.c
+@@ -115,11 +115,12 @@ void __init tsx_init(void)
+ tsx_disable();
+
+ /*
+- * tsx_disable() will change the state of the
+- * RTM CPUID bit. Clear it here since it is now
+- * expected to be not set.
++ * tsx_disable() will change the state of the RTM and HLE CPUID
++ * bits. Clear them here since they are now expected to be not
++ * set.
+ */
+ setup_clear_cpu_cap(X86_FEATURE_RTM);
++ setup_clear_cpu_cap(X86_FEATURE_HLE);
+ } else if (tsx_ctrl_state == TSX_CTRL_ENABLE) {
+
+ /*
+@@ -131,10 +132,10 @@ void __init tsx_init(void)
+ tsx_enable();
+
+ /*
+- * tsx_enable() will change the state of the
+- * RTM CPUID bit. Force it here since it is now
+- * expected to be set.
++ * tsx_enable() will change the state of the RTM and HLE CPUID
++ * bits. Force them here since they are now expected to be set.
+ */
+ setup_force_cpu_cap(X86_FEATURE_RTM);
++ setup_force_cpu_cap(X86_FEATURE_HLE);
+ }
+ }
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index e699f4d2a450..c91431bc476e 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -5164,16 +5164,28 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
+ ctxt->ad_bytes = def_ad_bytes ^ 6;
+ break;
+ case 0x26: /* ES override */
++ has_seg_override = true;
++ ctxt->seg_override = VCPU_SREG_ES;
++ break;
+ case 0x2e: /* CS override */
++ has_seg_override = true;
++ ctxt->seg_override = VCPU_SREG_CS;
++ break;
+ case 0x36: /* SS override */
++ has_seg_override = true;
++ ctxt->seg_override = VCPU_SREG_SS;
++ break;
+ case 0x3e: /* DS override */
+ has_seg_override = true;
+- ctxt->seg_override = (ctxt->b >> 3) & 3;
++ ctxt->seg_override = VCPU_SREG_DS;
+ break;
+ case 0x64: /* FS override */
++ has_seg_override = true;
++ ctxt->seg_override = VCPU_SREG_FS;
++ break;
+ case 0x65: /* GS override */
+ has_seg_override = true;
+- ctxt->seg_override = ctxt->b & 7;
++ ctxt->seg_override = VCPU_SREG_GS;
+ break;
+ case 0x40 ... 0x4f: /* REX */
+ if (mode != X86EMUL_MODE_PROT64)
+@@ -5257,10 +5269,15 @@ done_prefixes:
+ }
+ break;
+ case Escape:
+- if (ctxt->modrm > 0xbf)
+- opcode = opcode.u.esc->high[ctxt->modrm - 0xc0];
+- else
++ if (ctxt->modrm > 0xbf) {
++ size_t size = ARRAY_SIZE(opcode.u.esc->high);
++ u32 index = array_index_nospec(
++ ctxt->modrm - 0xc0, size);
++
++ opcode = opcode.u.esc->high[index];
++ } else {
+ opcode = opcode.u.esc->op[(ctxt->modrm >> 3) & 7];
++ }
+ break;
+ case InstrDual:
+ if ((ctxt->modrm >> 6) == 3)
+diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
+index 5842c5f587fe..3fd6c4b2c2b7 100644
+--- a/arch/x86/kvm/hyperv.c
++++ b/arch/x86/kvm/hyperv.c
+@@ -792,11 +792,12 @@ static int kvm_hv_msr_get_crash_data(struct kvm_vcpu *vcpu,
+ u32 index, u64 *pdata)
+ {
+ struct kvm_hv *hv = &vcpu->kvm->arch.hyperv;
++ size_t size = ARRAY_SIZE(hv->hv_crash_param);
+
+- if (WARN_ON_ONCE(index >= ARRAY_SIZE(hv->hv_crash_param)))
++ if (WARN_ON_ONCE(index >= size))
+ return -EINVAL;
+
+- *pdata = hv->hv_crash_param[index];
++ *pdata = hv->hv_crash_param[array_index_nospec(index, size)];
+ return 0;
+ }
+
+@@ -835,11 +836,12 @@ static int kvm_hv_msr_set_crash_data(struct kvm_vcpu *vcpu,
+ u32 index, u64 data)
+ {
+ struct kvm_hv *hv = &vcpu->kvm->arch.hyperv;
++ size_t size = ARRAY_SIZE(hv->hv_crash_param);
+
+- if (WARN_ON_ONCE(index >= ARRAY_SIZE(hv->hv_crash_param)))
++ if (WARN_ON_ONCE(index >= size))
+ return -EINVAL;
+
+- hv->hv_crash_param[index] = data;
++ hv->hv_crash_param[array_index_nospec(index, size)] = data;
+ return 0;
+ }
+
+diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
+index bdcd4139eca9..38a36a1cc87f 100644
+--- a/arch/x86/kvm/i8259.c
++++ b/arch/x86/kvm/i8259.c
+@@ -460,10 +460,14 @@ static int picdev_write(struct kvm_pic *s,
+ switch (addr) {
+ case 0x20:
+ case 0x21:
++ pic_lock(s);
++ pic_ioport_write(&s->pics[0], addr, data);
++ pic_unlock(s);
++ break;
+ case 0xa0:
+ case 0xa1:
+ pic_lock(s);
+- pic_ioport_write(&s->pics[addr >> 7], addr, data);
++ pic_ioport_write(&s->pics[1], addr, data);
+ pic_unlock(s);
+ break;
+ case 0x4d0:
+diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
+index 4e822ad363f3..bac2ec9b4443 100644
+--- a/arch/x86/kvm/ioapic.c
++++ b/arch/x86/kvm/ioapic.c
+@@ -36,6 +36,7 @@
+ #include <linux/io.h>
+ #include <linux/slab.h>
+ #include <linux/export.h>
++#include <linux/nospec.h>
+ #include <asm/processor.h>
+ #include <asm/page.h>
+ #include <asm/current.h>
+@@ -73,13 +74,14 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
+ default:
+ {
+ u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
+- u64 redir_content;
++ u64 redir_content = ~0ULL;
+
+- if (redir_index < IOAPIC_NUM_PINS)
+- redir_content =
+- ioapic->redirtbl[redir_index].bits;
+- else
+- redir_content = ~0ULL;
++ if (redir_index < IOAPIC_NUM_PINS) {
++ u32 index = array_index_nospec(
++ redir_index, IOAPIC_NUM_PINS);
++
++ redir_content = ioapic->redirtbl[index].bits;
++ }
+
+ result = (ioapic->ioregsel & 0x1) ?
+ (redir_content >> 32) & 0xffffffff :
+@@ -297,6 +299,7 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
+ ioapic_debug("change redir index %x val %x\n", index, val);
+ if (index >= IOAPIC_NUM_PINS)
+ return;
++ index = array_index_nospec(index, IOAPIC_NUM_PINS);
+ e = &ioapic->redirtbl[index];
+ mask_before = e->fields.mask;
+ /* Preserve read-only fields */
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 262e49301cae..05905961ecca 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -1862,15 +1862,20 @@ int kvm_lapic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
+ case APIC_LVTTHMR:
+ case APIC_LVTPC:
+ case APIC_LVT1:
+- case APIC_LVTERR:
++ case APIC_LVTERR: {
+ /* TODO: Check vector */
++ size_t size;
++ u32 index;
++
+ if (!kvm_apic_sw_enabled(apic))
+ val |= APIC_LVT_MASKED;
+-
+- val &= apic_lvt_mask[(reg - APIC_LVTT) >> 4];
++ size = ARRAY_SIZE(apic_lvt_mask);
++ index = array_index_nospec(
++ (reg - APIC_LVTT) >> 4, size);
++ val &= apic_lvt_mask[index];
+ kvm_lapic_set_reg(apic, reg, val);
+-
+ break;
++ }
+
+ case APIC_LVTT:
+ if (!kvm_apic_sw_enabled(apic))
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index eddf91a0e363..62f1e4663bc3 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -1184,12 +1184,12 @@ static bool mmu_gfn_lpage_is_disallowed(struct kvm_vcpu *vcpu, gfn_t gfn,
+ return __mmu_gfn_lpage_is_disallowed(gfn, level, slot);
+ }
+
+-static int host_mapping_level(struct kvm *kvm, gfn_t gfn)
++static int host_mapping_level(struct kvm_vcpu *vcpu, gfn_t gfn)
+ {
+ unsigned long page_size;
+ int i, ret = 0;
+
+- page_size = kvm_host_page_size(kvm, gfn);
++ page_size = kvm_host_page_size(vcpu, gfn);
+
+ for (i = PT_PAGE_TABLE_LEVEL; i <= PT_MAX_HUGEPAGE_LEVEL; ++i) {
+ if (page_size >= KVM_HPAGE_SIZE(i))
+@@ -1239,7 +1239,7 @@ static int mapping_level(struct kvm_vcpu *vcpu, gfn_t large_gfn,
+ if (unlikely(*force_pt_level))
+ return PT_PAGE_TABLE_LEVEL;
+
+- host_level = host_mapping_level(vcpu->kvm, large_gfn);
++ host_level = host_mapping_level(vcpu, large_gfn);
+
+ if (host_level == PT_PAGE_TABLE_LEVEL)
+ return host_level;
+@@ -3390,7 +3390,7 @@ static bool is_access_allowed(u32 fault_err_code, u64 spte)
+ * - true: let the vcpu to access on the same address again.
+ * - false: let the real page fault path to fix it.
+ */
+-static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level,
++static bool fast_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, int level,
+ u32 error_code)
+ {
+ struct kvm_shadow_walk_iterator iterator;
+@@ -3410,7 +3410,7 @@ static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level,
+ do {
+ u64 new_spte;
+
+- for_each_shadow_entry_lockless(vcpu, gva, iterator, spte)
++ for_each_shadow_entry_lockless(vcpu, cr2_or_gpa, iterator, spte)
+ if (!is_shadow_present_pte(spte) ||
+ iterator.level < level)
+ break;
+@@ -3488,7 +3488,7 @@ static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level,
+
+ } while (true);
+
+- trace_fast_page_fault(vcpu, gva, error_code, iterator.sptep,
++ trace_fast_page_fault(vcpu, cr2_or_gpa, error_code, iterator.sptep,
+ spte, fault_handled);
+ walk_shadow_page_lockless_end(vcpu);
+
+@@ -3496,10 +3496,11 @@ static bool fast_page_fault(struct kvm_vcpu *vcpu, gva_t gva, int level,
+ }
+
+ static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
+- gva_t gva, kvm_pfn_t *pfn, bool write, bool *writable);
++ gpa_t cr2_or_gpa, kvm_pfn_t *pfn, bool write,
++ bool *writable);
+ static int make_mmu_pages_available(struct kvm_vcpu *vcpu);
+
+-static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, u32 error_code,
++static int nonpaging_map(struct kvm_vcpu *vcpu, gpa_t gpa, u32 error_code,
+ gfn_t gfn, bool prefault)
+ {
+ int r;
+@@ -3525,16 +3526,16 @@ static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, u32 error_code,
+ gfn &= ~(KVM_PAGES_PER_HPAGE(level) - 1);
+ }
+
+- if (fast_page_fault(vcpu, v, level, error_code))
++ if (fast_page_fault(vcpu, gpa, level, error_code))
+ return RET_PF_RETRY;
+
+ mmu_seq = vcpu->kvm->mmu_notifier_seq;
+ smp_rmb();
+
+- if (try_async_pf(vcpu, prefault, gfn, v, &pfn, write, &map_writable))
++ if (try_async_pf(vcpu, prefault, gfn, gpa, &pfn, write, &map_writable))
+ return RET_PF_RETRY;
+
+- if (handle_abnormal_pfn(vcpu, v, gfn, pfn, ACC_ALL, &r))
++ if (handle_abnormal_pfn(vcpu, gpa, gfn, pfn, ACC_ALL, &r))
+ return r;
+
+ r = RET_PF_RETRY;
+@@ -3545,7 +3546,7 @@ static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, u32 error_code,
+ goto out_unlock;
+ if (likely(!force_pt_level))
+ transparent_hugepage_adjust(vcpu, gfn, &pfn, &level);
+- r = __direct_map(vcpu, v, write, map_writable, level, pfn,
++ r = __direct_map(vcpu, gpa, write, map_writable, level, pfn,
+ prefault, false);
+ out_unlock:
+ spin_unlock(&vcpu->kvm->mmu_lock);
+@@ -3838,7 +3839,7 @@ void kvm_mmu_sync_roots(struct kvm_vcpu *vcpu)
+ }
+ EXPORT_SYMBOL_GPL(kvm_mmu_sync_roots);
+
+-static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, gva_t vaddr,
++static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, gpa_t vaddr,
+ u32 access, struct x86_exception *exception)
+ {
+ if (exception)
+@@ -3846,7 +3847,7 @@ static gpa_t nonpaging_gva_to_gpa(struct kvm_vcpu *vcpu, gva_t vaddr,
+ return vaddr;
+ }
+
+-static gpa_t nonpaging_gva_to_gpa_nested(struct kvm_vcpu *vcpu, gva_t vaddr,
++static gpa_t nonpaging_gva_to_gpa_nested(struct kvm_vcpu *vcpu, gpa_t vaddr,
+ u32 access,
+ struct x86_exception *exception)
+ {
+@@ -4006,13 +4007,14 @@ static void shadow_page_table_clear_flood(struct kvm_vcpu *vcpu, gva_t addr)
+ walk_shadow_page_lockless_end(vcpu);
+ }
+
+-static int nonpaging_page_fault(struct kvm_vcpu *vcpu, gva_t gva,
++static int nonpaging_page_fault(struct kvm_vcpu *vcpu, gpa_t gpa,
+ u32 error_code, bool prefault)
+ {
+- gfn_t gfn = gva >> PAGE_SHIFT;
++ gfn_t gfn = gpa >> PAGE_SHIFT;
+ int r;
+
+- pgprintk("%s: gva %lx error %x\n", __func__, gva, error_code);
++ /* Note, paging is disabled, ergo gva == gpa. */
++ pgprintk("%s: gva %lx error %x\n", __func__, gpa, error_code);
+
+ if (page_fault_handle_page_track(vcpu, error_code, gfn))
+ return RET_PF_EMULATE;
+@@ -4024,11 +4026,12 @@ static int nonpaging_page_fault(struct kvm_vcpu *vcpu, gva_t gva,
+ MMU_WARN_ON(!VALID_PAGE(vcpu->arch.mmu.root_hpa));
+
+
+- return nonpaging_map(vcpu, gva & PAGE_MASK,
++ return nonpaging_map(vcpu, gpa & PAGE_MASK,
+ error_code, gfn, prefault);
+ }
+
+-static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn)
++static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
++ gfn_t gfn)
+ {
+ struct kvm_arch_async_pf arch;
+
+@@ -4037,7 +4040,8 @@ static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn)
+ arch.direct_map = vcpu->arch.mmu.direct_map;
+ arch.cr3 = vcpu->arch.mmu.get_cr3(vcpu);
+
+- return kvm_setup_async_pf(vcpu, gva, kvm_vcpu_gfn_to_hva(vcpu, gfn), &arch);
++ return kvm_setup_async_pf(vcpu, cr2_or_gpa,
++ kvm_vcpu_gfn_to_hva(vcpu, gfn), &arch);
+ }
+
+ bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu)
+@@ -4054,7 +4058,8 @@ bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu)
+ }
+
+ static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
+- gva_t gva, kvm_pfn_t *pfn, bool write, bool *writable)
++ gpa_t cr2_or_gpa, kvm_pfn_t *pfn, bool write,
++ bool *writable)
+ {
+ struct kvm_memory_slot *slot;
+ bool async;
+@@ -4074,12 +4079,12 @@ static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
+ return false; /* *pfn has correct page already */
+
+ if (!prefault && kvm_can_do_async_pf(vcpu)) {
+- trace_kvm_try_async_get_page(gva, gfn);
++ trace_kvm_try_async_get_page(cr2_or_gpa, gfn);
+ if (kvm_find_async_pf_gfn(vcpu, gfn)) {
+- trace_kvm_async_pf_doublefault(gva, gfn);
++ trace_kvm_async_pf_doublefault(cr2_or_gpa, gfn);
+ kvm_make_request(KVM_REQ_APF_HALT, vcpu);
+ return true;
+- } else if (kvm_arch_setup_async_pf(vcpu, gva, gfn))
++ } else if (kvm_arch_setup_async_pf(vcpu, cr2_or_gpa, gfn))
+ return true;
+ }
+
+@@ -4092,6 +4097,12 @@ int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code,
+ {
+ int r = 1;
+
++#ifndef CONFIG_X86_64
++ /* A 64-bit CR2 should be impossible on 32-bit KVM. */
++ if (WARN_ON_ONCE(fault_address >> 32))
++ return -EFAULT;
++#endif
++
+ vcpu->arch.l1tf_flush_l1d = true;
+ switch (vcpu->arch.apf.host_apf_reason) {
+ default:
+@@ -4129,7 +4140,7 @@ check_hugepage_cache_consistency(struct kvm_vcpu *vcpu, gfn_t gfn, int level)
+ return kvm_mtrr_check_gfn_range_consistency(vcpu, gfn, page_num);
+ }
+
+-static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa, u32 error_code,
++static int tdp_page_fault(struct kvm_vcpu *vcpu, gpa_t gpa, u32 error_code,
+ bool prefault)
+ {
+ kvm_pfn_t pfn;
+@@ -5307,7 +5318,7 @@ static int make_mmu_pages_available(struct kvm_vcpu *vcpu)
+ return 0;
+ }
+
+-int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
++int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, u64 error_code,
+ void *insn, int insn_len)
+ {
+ int r, emulation_type = 0;
+@@ -5317,19 +5328,20 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
+ /* With shadow page tables, fault_address contains a GVA or nGPA. */
+ if (vcpu->arch.mmu.direct_map) {
+ vcpu->arch.gpa_available = true;
+- vcpu->arch.gpa_val = cr2;
++ vcpu->arch.gpa_val = cr2_or_gpa;
+ }
+
+ r = RET_PF_INVALID;
+ if (unlikely(error_code & PFERR_RSVD_MASK)) {
+- r = handle_mmio_page_fault(vcpu, cr2, direct);
++ r = handle_mmio_page_fault(vcpu, cr2_or_gpa, direct);
+ if (r == RET_PF_EMULATE)
+ goto emulate;
+ }
+
+ if (r == RET_PF_INVALID) {
+- r = vcpu->arch.mmu.page_fault(vcpu, cr2, lower_32_bits(error_code),
+- false);
++ r = vcpu->arch.mmu.page_fault(vcpu, cr2_or_gpa,
++ lower_32_bits(error_code),
++ false);
+ WARN_ON(r == RET_PF_INVALID);
+ }
+
+@@ -5347,7 +5359,7 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
+ */
+ if (vcpu->arch.mmu.direct_map &&
+ (error_code & PFERR_NESTED_GUEST_PAGE) == PFERR_NESTED_GUEST_PAGE) {
+- kvm_mmu_unprotect_page(vcpu->kvm, gpa_to_gfn(cr2));
++ kvm_mmu_unprotect_page(vcpu->kvm, gpa_to_gfn(cr2_or_gpa));
+ return 1;
+ }
+
+@@ -5362,7 +5374,7 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code,
+ * explicitly shadowing L1's page tables, i.e. unprotecting something
+ * for L1 isn't going to magically fix whatever issue cause L2 to fail.
+ */
+- if (!mmio_info_in_cache(vcpu, cr2, direct) && !is_guest_mode(vcpu))
++ if (!mmio_info_in_cache(vcpu, cr2_or_gpa, direct) && !is_guest_mode(vcpu))
+ emulation_type = EMULTYPE_ALLOW_RETRY;
+ emulate:
+ /*
+@@ -5375,7 +5387,7 @@ emulate:
+ if (unlikely(insn && !insn_len))
+ return 1;
+
+- er = x86_emulate_instruction(vcpu, cr2, emulation_type, insn, insn_len);
++ er = x86_emulate_instruction(vcpu, cr2_or_gpa, emulation_type, insn, insn_len);
+
+ switch (er) {
+ case EMULATE_DONE:
+diff --git a/arch/x86/kvm/mmutrace.h b/arch/x86/kvm/mmutrace.h
+index 918b0d5bf272..cb41b036eb26 100644
+--- a/arch/x86/kvm/mmutrace.h
++++ b/arch/x86/kvm/mmutrace.h
+@@ -249,13 +249,13 @@ TRACE_EVENT(
+
+ TRACE_EVENT(
+ fast_page_fault,
+- TP_PROTO(struct kvm_vcpu *vcpu, gva_t gva, u32 error_code,
++ TP_PROTO(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, u32 error_code,
+ u64 *sptep, u64 old_spte, bool retry),
+- TP_ARGS(vcpu, gva, error_code, sptep, old_spte, retry),
++ TP_ARGS(vcpu, cr2_or_gpa, error_code, sptep, old_spte, retry),
+
+ TP_STRUCT__entry(
+ __field(int, vcpu_id)
+- __field(gva_t, gva)
++ __field(gpa_t, cr2_or_gpa)
+ __field(u32, error_code)
+ __field(u64 *, sptep)
+ __field(u64, old_spte)
+@@ -265,7 +265,7 @@ TRACE_EVENT(
+
+ TP_fast_assign(
+ __entry->vcpu_id = vcpu->vcpu_id;
+- __entry->gva = gva;
++ __entry->cr2_or_gpa = cr2_or_gpa;
+ __entry->error_code = error_code;
+ __entry->sptep = sptep;
+ __entry->old_spte = old_spte;
+@@ -273,9 +273,9 @@ TRACE_EVENT(
+ __entry->retry = retry;
+ ),
+
+- TP_printk("vcpu %d gva %lx error_code %s sptep %p old %#llx"
++ TP_printk("vcpu %d gva %llx error_code %s sptep %p old %#llx"
+ " new %llx spurious %d fixed %d", __entry->vcpu_id,
+- __entry->gva, __print_flags(__entry->error_code, "|",
++ __entry->cr2_or_gpa, __print_flags(__entry->error_code, "|",
+ kvm_mmu_trace_pferr_flags), __entry->sptep,
+ __entry->old_spte, __entry->new_spte,
+ __spte_satisfied(old_spte), __spte_satisfied(new_spte)
+diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c
+index 9f72cc427158..fabce87697e5 100644
+--- a/arch/x86/kvm/mtrr.c
++++ b/arch/x86/kvm/mtrr.c
+@@ -194,11 +194,15 @@ static bool fixed_msr_to_seg_unit(u32 msr, int *seg, int *unit)
+ break;
+ case MSR_MTRRfix16K_80000 ... MSR_MTRRfix16K_A0000:
+ *seg = 1;
+- *unit = msr - MSR_MTRRfix16K_80000;
++ *unit = array_index_nospec(
++ msr - MSR_MTRRfix16K_80000,
++ MSR_MTRRfix16K_A0000 - MSR_MTRRfix16K_80000 + 1);
+ break;
+ case MSR_MTRRfix4K_C0000 ... MSR_MTRRfix4K_F8000:
+ *seg = 2;
+- *unit = msr - MSR_MTRRfix4K_C0000;
++ *unit = array_index_nospec(
++ msr - MSR_MTRRfix4K_C0000,
++ MSR_MTRRfix4K_F8000 - MSR_MTRRfix4K_C0000 + 1);
+ break;
+ default:
+ return false;
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index adf42dc8d38b..100ae4fabf17 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -273,11 +273,11 @@ static inline unsigned FNAME(gpte_pkeys)(struct kvm_vcpu *vcpu, u64 gpte)
+ }
+
+ /*
+- * Fetch a guest pte for a guest virtual address
++ * Fetch a guest pte for a guest virtual address, or for an L2's GPA.
+ */
+ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
+ struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
+- gva_t addr, u32 access)
++ gpa_t addr, u32 access)
+ {
+ int ret;
+ pt_element_t pte;
+@@ -478,7 +478,7 @@ error:
+ }
+
+ static int FNAME(walk_addr)(struct guest_walker *walker,
+- struct kvm_vcpu *vcpu, gva_t addr, u32 access)
++ struct kvm_vcpu *vcpu, gpa_t addr, u32 access)
+ {
+ return FNAME(walk_addr_generic)(walker, vcpu, &vcpu->arch.mmu, addr,
+ access);
+@@ -593,7 +593,7 @@ static void FNAME(pte_prefetch)(struct kvm_vcpu *vcpu, struct guest_walker *gw,
+ * If the guest tries to write a write-protected page, we need to
+ * emulate this operation, return 1 to indicate this case.
+ */
+-static int FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
++static int FNAME(fetch)(struct kvm_vcpu *vcpu, gpa_t addr,
+ struct guest_walker *gw,
+ int write_fault, int hlevel,
+ kvm_pfn_t pfn, bool map_writable, bool prefault,
+@@ -747,7 +747,7 @@ FNAME(is_self_change_mapping)(struct kvm_vcpu *vcpu,
+ * Returns: 1 if we need to emulate the instruction, 0 otherwise, or
+ * a negative value on error.
+ */
+-static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code,
++static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gpa_t addr, u32 error_code,
+ bool prefault)
+ {
+ int write_fault = error_code & PFERR_WRITE_MASK;
+@@ -926,18 +926,19 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva, hpa_t root_hpa)
+ spin_unlock(&vcpu->kvm->mmu_lock);
+ }
+
+-static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr, u32 access,
++/* Note, @addr is a GPA when gva_to_gpa() translates an L2 GPA to an L1 GPA. */
++static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gpa_t addr, u32 access,
+ struct x86_exception *exception)
+ {
+ struct guest_walker walker;
+ gpa_t gpa = UNMAPPED_GVA;
+ int r;
+
+- r = FNAME(walk_addr)(&walker, vcpu, vaddr, access);
++ r = FNAME(walk_addr)(&walker, vcpu, addr, access);
+
+ if (r) {
+ gpa = gfn_to_gpa(walker.gfn);
+- gpa |= vaddr & ~PAGE_MASK;
++ gpa |= addr & ~PAGE_MASK;
+ } else if (exception)
+ *exception = walker.fault;
+
+@@ -945,7 +946,8 @@ static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr, u32 access,
+ }
+
+ #if PTTYPE != PTTYPE_EPT
+-static gpa_t FNAME(gva_to_gpa_nested)(struct kvm_vcpu *vcpu, gva_t vaddr,
++/* Note, gva_to_gpa_nested() is only used to translate L2 GVAs. */
++static gpa_t FNAME(gva_to_gpa_nested)(struct kvm_vcpu *vcpu, gpa_t vaddr,
+ u32 access,
+ struct x86_exception *exception)
+ {
+@@ -953,6 +955,11 @@ static gpa_t FNAME(gva_to_gpa_nested)(struct kvm_vcpu *vcpu, gva_t vaddr,
+ gpa_t gpa = UNMAPPED_GVA;
+ int r;
+
++#ifndef CONFIG_X86_64
++ /* A 64-bit GVA should be impossible on 32-bit KVM. */
++ WARN_ON_ONCE(vaddr >> 32);
++#endif
++
+ r = FNAME(walk_addr_nested)(&walker, vcpu, vaddr, access);
+
+ if (r) {
+diff --git a/arch/x86/kvm/pmu.h b/arch/x86/kvm/pmu.h
+index 22dff661145a..7b4828e50ab3 100644
+--- a/arch/x86/kvm/pmu.h
++++ b/arch/x86/kvm/pmu.h
+@@ -2,6 +2,8 @@
+ #ifndef __KVM_X86_PMU_H
+ #define __KVM_X86_PMU_H
+
++#include <linux/nospec.h>
++
+ #define vcpu_to_pmu(vcpu) (&(vcpu)->arch.pmu)
+ #define pmu_to_vcpu(pmu) (container_of((pmu), struct kvm_vcpu, arch.pmu))
+ #define pmc_to_pmu(pmc) (&(pmc)->vcpu->arch.pmu)
+@@ -86,8 +88,12 @@ static inline bool pmc_is_enabled(struct kvm_pmc *pmc)
+ static inline struct kvm_pmc *get_gp_pmc(struct kvm_pmu *pmu, u32 msr,
+ u32 base)
+ {
+- if (msr >= base && msr < base + pmu->nr_arch_gp_counters)
+- return &pmu->gp_counters[msr - base];
++ if (msr >= base && msr < base + pmu->nr_arch_gp_counters) {
++ u32 index = array_index_nospec(msr - base,
++ pmu->nr_arch_gp_counters);
++
++ return &pmu->gp_counters[index];
++ }
+
+ return NULL;
+ }
+@@ -97,8 +103,12 @@ static inline struct kvm_pmc *get_fixed_pmc(struct kvm_pmu *pmu, u32 msr)
+ {
+ int base = MSR_CORE_PERF_FIXED_CTR0;
+
+- if (msr >= base && msr < base + pmu->nr_arch_fixed_counters)
+- return &pmu->fixed_counters[msr - base];
++ if (msr >= base && msr < base + pmu->nr_arch_fixed_counters) {
++ u32 index = array_index_nospec(msr - base,
++ pmu->nr_arch_fixed_counters);
++
++ return &pmu->fixed_counters[index];
++ }
+
+ return NULL;
+ }
+diff --git a/arch/x86/kvm/pmu_intel.c b/arch/x86/kvm/pmu_intel.c
+index c3f103e2b08e..2ab8c20c8bfa 100644
+--- a/arch/x86/kvm/pmu_intel.c
++++ b/arch/x86/kvm/pmu_intel.c
+@@ -87,10 +87,14 @@ static unsigned intel_find_arch_event(struct kvm_pmu *pmu,
+
+ static unsigned intel_find_fixed_event(int idx)
+ {
+- if (idx >= ARRAY_SIZE(fixed_pmc_events))
++ u32 event;
++ size_t size = ARRAY_SIZE(fixed_pmc_events);
++
++ if (idx >= size)
+ return PERF_COUNT_HW_MAX;
+
+- return intel_arch_events[fixed_pmc_events[idx]].event_type;
++ event = fixed_pmc_events[array_index_nospec(idx, size)];
++ return intel_arch_events[event].event_type;
+ }
+
+ /* check if a PMC is enabled by comparing it with globl_ctrl bits. */
+@@ -131,16 +135,20 @@ static struct kvm_pmc *intel_msr_idx_to_pmc(struct kvm_vcpu *vcpu,
+ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+ bool fixed = idx & (1u << 30);
+ struct kvm_pmc *counters;
++ unsigned int num_counters;
+
+ idx &= ~(3u << 30);
+- if (!fixed && idx >= pmu->nr_arch_gp_counters)
+- return NULL;
+- if (fixed && idx >= pmu->nr_arch_fixed_counters)
++ if (fixed) {
++ counters = pmu->fixed_counters;
++ num_counters = pmu->nr_arch_fixed_counters;
++ } else {
++ counters = pmu->gp_counters;
++ num_counters = pmu->nr_arch_gp_counters;
++ }
++ if (idx >= num_counters)
+ return NULL;
+- counters = fixed ? pmu->fixed_counters : pmu->gp_counters;
+ *mask &= pmu->counter_bitmask[fixed ? KVM_PMC_FIXED : KVM_PMC_GP];
+-
+- return &counters[idx];
++ return &counters[array_index_nospec(idx, num_counters)];
+ }
+
+ static bool intel_is_valid_msr(struct kvm_vcpu *vcpu, u32 msr)
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index fa2abed1a14d..2660c01eadae 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -8793,8 +8793,10 @@ static int handle_vmread(struct kvm_vcpu *vcpu)
+ /* _system ok, nested_vmx_check_permission has verified cpl=0 */
+ if (kvm_write_guest_virt_system(vcpu, gva, &field_value,
+ (is_long_mode(vcpu) ? 8 : 4),
+- &e))
++ &e)) {
+ kvm_inject_page_fault(vcpu, &e);
++ return 1;
++ }
+ }
+
+ nested_vmx_succeed(vcpu);
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+new file mode 100644
+index 000000000000..3791ce8d269e
+--- /dev/null
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -0,0 +1,8033 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Kernel-based Virtual Machine driver for Linux
++ *
++ * This module enables machines with Intel VT-x extensions to run virtual
++ * machines without emulation or binary translation.
++ *
++ * Copyright (C) 2006 Qumranet, Inc.
++ * Copyright 2010 Red Hat, Inc. and/or its affiliates.
++ *
++ * Authors:
++ * Avi Kivity <avi@qumranet.com>
++ * Yaniv Kamay <yaniv@qumranet.com>
++ */
++
++#include <linux/frame.h>
++#include <linux/highmem.h>
++#include <linux/hrtimer.h>
++#include <linux/kernel.h>
++#include <linux/kvm_host.h>
++#include <linux/module.h>
++#include <linux/moduleparam.h>
++#include <linux/mod_devicetable.h>
++#include <linux/mm.h>
++#include <linux/sched.h>
++#include <linux/sched/smt.h>
++#include <linux/slab.h>
++#include <linux/tboot.h>
++#include <linux/trace_events.h>
++
++#include <asm/apic.h>
++#include <asm/asm.h>
++#include <asm/cpu.h>
++#include <asm/debugreg.h>
++#include <asm/desc.h>
++#include <asm/fpu/internal.h>
++#include <asm/io.h>
++#include <asm/irq_remapping.h>
++#include <asm/kexec.h>
++#include <asm/perf_event.h>
++#include <asm/mce.h>
++#include <asm/mmu_context.h>
++#include <asm/mshyperv.h>
++#include <asm/spec-ctrl.h>
++#include <asm/virtext.h>
++#include <asm/vmx.h>
++
++#include "capabilities.h"
++#include "cpuid.h"
++#include "evmcs.h"
++#include "irq.h"
++#include "kvm_cache_regs.h"
++#include "lapic.h"
++#include "mmu.h"
++#include "nested.h"
++#include "ops.h"
++#include "pmu.h"
++#include "trace.h"
++#include "vmcs.h"
++#include "vmcs12.h"
++#include "vmx.h"
++#include "x86.h"
++
++MODULE_AUTHOR("Qumranet");
++MODULE_LICENSE("GPL");
++
++static const struct x86_cpu_id vmx_cpu_id[] = {
++ X86_FEATURE_MATCH(X86_FEATURE_VMX),
++ {}
++};
++MODULE_DEVICE_TABLE(x86cpu, vmx_cpu_id);
++
++bool __read_mostly enable_vpid = 1;
++module_param_named(vpid, enable_vpid, bool, 0444);
++
++static bool __read_mostly enable_vnmi = 1;
++module_param_named(vnmi, enable_vnmi, bool, S_IRUGO);
++
++bool __read_mostly flexpriority_enabled = 1;
++module_param_named(flexpriority, flexpriority_enabled, bool, S_IRUGO);
++
++bool __read_mostly enable_ept = 1;
++module_param_named(ept, enable_ept, bool, S_IRUGO);
++
++bool __read_mostly enable_unrestricted_guest = 1;
++module_param_named(unrestricted_guest,
++ enable_unrestricted_guest, bool, S_IRUGO);
++
++bool __read_mostly enable_ept_ad_bits = 1;
++module_param_named(eptad, enable_ept_ad_bits, bool, S_IRUGO);
++
++static bool __read_mostly emulate_invalid_guest_state = true;
++module_param(emulate_invalid_guest_state, bool, S_IRUGO);
++
++static bool __read_mostly fasteoi = 1;
++module_param(fasteoi, bool, S_IRUGO);
++
++static bool __read_mostly enable_apicv = 1;
++module_param(enable_apicv, bool, S_IRUGO);
++
++/*
++ * If nested=1, nested virtualization is supported, i.e., guests may use
++ * VMX and be a hypervisor for its own guests. If nested=0, guests may not
++ * use VMX instructions.
++ */
++static bool __read_mostly nested = 1;
++module_param(nested, bool, S_IRUGO);
++
++bool __read_mostly enable_pml = 1;
++module_param_named(pml, enable_pml, bool, S_IRUGO);
++
++static bool __read_mostly dump_invalid_vmcs = 0;
++module_param(dump_invalid_vmcs, bool, 0644);
++
++#define MSR_BITMAP_MODE_X2APIC 1
++#define MSR_BITMAP_MODE_X2APIC_APICV 2
++
++#define KVM_VMX_TSC_MULTIPLIER_MAX 0xffffffffffffffffULL
++
++/* Guest_tsc -> host_tsc conversion requires 64-bit division. */
++static int __read_mostly cpu_preemption_timer_multi;
++static bool __read_mostly enable_preemption_timer = 1;
++#ifdef CONFIG_X86_64
++module_param_named(preemption_timer, enable_preemption_timer, bool, S_IRUGO);
++#endif
++
++#define KVM_VM_CR0_ALWAYS_OFF (X86_CR0_NW | X86_CR0_CD)
++#define KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR0_NE
++#define KVM_VM_CR0_ALWAYS_ON \
++ (KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST | \
++ X86_CR0_WP | X86_CR0_PG | X86_CR0_PE)
++#define KVM_CR4_GUEST_OWNED_BITS \
++ (X86_CR4_PVI | X86_CR4_DE | X86_CR4_PCE | X86_CR4_OSFXSR \
++ | X86_CR4_OSXMMEXCPT | X86_CR4_LA57 | X86_CR4_TSD)
++
++#define KVM_VM_CR4_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR4_VMXE
++#define KVM_PMODE_VM_CR4_ALWAYS_ON (X86_CR4_PAE | X86_CR4_VMXE)
++#define KVM_RMODE_VM_CR4_ALWAYS_ON (X86_CR4_VME | X86_CR4_PAE | X86_CR4_VMXE)
++
++#define RMODE_GUEST_OWNED_EFLAGS_BITS (~(X86_EFLAGS_IOPL | X86_EFLAGS_VM))
++
++#define MSR_IA32_RTIT_STATUS_MASK (~(RTIT_STATUS_FILTEREN | \
++ RTIT_STATUS_CONTEXTEN | RTIT_STATUS_TRIGGEREN | \
++ RTIT_STATUS_ERROR | RTIT_STATUS_STOPPED | \
++ RTIT_STATUS_BYTECNT))
++
++#define MSR_IA32_RTIT_OUTPUT_BASE_MASK \
++ (~((1UL << cpuid_query_maxphyaddr(vcpu)) - 1) | 0x7f)
++
++/*
++ * These 2 parameters are used to config the controls for Pause-Loop Exiting:
++ * ple_gap: upper bound on the amount of time between two successive
++ * executions of PAUSE in a loop. Also indicate if ple enabled.
++ * According to test, this time is usually smaller than 128 cycles.
++ * ple_window: upper bound on the amount of time a guest is allowed to execute
++ * in a PAUSE loop. Tests indicate that most spinlocks are held for
++ * less than 2^12 cycles
++ * Time is measured based on a counter that runs at the same rate as the TSC,
++ * refer SDM volume 3b section 21.6.13 & 22.1.3.
++ */
++static unsigned int ple_gap = KVM_DEFAULT_PLE_GAP;
++module_param(ple_gap, uint, 0444);
++
++static unsigned int ple_window = KVM_VMX_DEFAULT_PLE_WINDOW;
++module_param(ple_window, uint, 0444);
++
++/* Default doubles per-vcpu window every exit. */
++static unsigned int ple_window_grow = KVM_DEFAULT_PLE_WINDOW_GROW;
++module_param(ple_window_grow, uint, 0444);
++
++/* Default resets per-vcpu window every exit to ple_window. */
++static unsigned int ple_window_shrink = KVM_DEFAULT_PLE_WINDOW_SHRINK;
++module_param(ple_window_shrink, uint, 0444);
++
++/* Default is to compute the maximum so we can never overflow. */
++static unsigned int ple_window_max = KVM_VMX_DEFAULT_PLE_WINDOW_MAX;
++module_param(ple_window_max, uint, 0444);
++
++/* Default is SYSTEM mode, 1 for host-guest mode */
++int __read_mostly pt_mode = PT_MODE_SYSTEM;
++module_param(pt_mode, int, S_IRUGO);
++
++static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
++static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_cond);
++static DEFINE_MUTEX(vmx_l1d_flush_mutex);
++
++/* Storage for pre module init parameter parsing */
++static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param = VMENTER_L1D_FLUSH_AUTO;
++
++static const struct {
++ const char *option;
++ bool for_parse;
++} vmentry_l1d_param[] = {
++ [VMENTER_L1D_FLUSH_AUTO] = {"auto", true},
++ [VMENTER_L1D_FLUSH_NEVER] = {"never", true},
++ [VMENTER_L1D_FLUSH_COND] = {"cond", true},
++ [VMENTER_L1D_FLUSH_ALWAYS] = {"always", true},
++ [VMENTER_L1D_FLUSH_EPT_DISABLED] = {"EPT disabled", false},
++ [VMENTER_L1D_FLUSH_NOT_REQUIRED] = {"not required", false},
++};
++
++#define L1D_CACHE_ORDER 4
++static void *vmx_l1d_flush_pages;
++
++static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf)
++{
++ struct page *page;
++ unsigned int i;
++
++ if (!boot_cpu_has_bug(X86_BUG_L1TF)) {
++ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED;
++ return 0;
++ }
++
++ if (!enable_ept) {
++ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_EPT_DISABLED;
++ return 0;
++ }
++
++ if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) {
++ u64 msr;
++
++ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, msr);
++ if (msr & ARCH_CAP_SKIP_VMENTRY_L1DFLUSH) {
++ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED;
++ return 0;
++ }
++ }
++
++ /* If set to auto use the default l1tf mitigation method */
++ if (l1tf == VMENTER_L1D_FLUSH_AUTO) {
++ switch (l1tf_mitigation) {
++ case L1TF_MITIGATION_OFF:
++ l1tf = VMENTER_L1D_FLUSH_NEVER;
++ break;
++ case L1TF_MITIGATION_FLUSH_NOWARN:
++ case L1TF_MITIGATION_FLUSH:
++ case L1TF_MITIGATION_FLUSH_NOSMT:
++ l1tf = VMENTER_L1D_FLUSH_COND;
++ break;
++ case L1TF_MITIGATION_FULL:
++ case L1TF_MITIGATION_FULL_FORCE:
++ l1tf = VMENTER_L1D_FLUSH_ALWAYS;
++ break;
++ }
++ } else if (l1tf_mitigation == L1TF_MITIGATION_FULL_FORCE) {
++ l1tf = VMENTER_L1D_FLUSH_ALWAYS;
++ }
++
++ if (l1tf != VMENTER_L1D_FLUSH_NEVER && !vmx_l1d_flush_pages &&
++ !boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
++ /*
++ * This allocation for vmx_l1d_flush_pages is not tied to a VM
++ * lifetime and so should not be charged to a memcg.
++ */
++ page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER);
++ if (!page)
++ return -ENOMEM;
++ vmx_l1d_flush_pages = page_address(page);
++
++ /*
++ * Initialize each page with a different pattern in
++ * order to protect against KSM in the nested
++ * virtualization case.
++ */
++ for (i = 0; i < 1u << L1D_CACHE_ORDER; ++i) {
++ memset(vmx_l1d_flush_pages + i * PAGE_SIZE, i + 1,
++ PAGE_SIZE);
++ }
++ }
++
++ l1tf_vmx_mitigation = l1tf;
++
++ if (l1tf != VMENTER_L1D_FLUSH_NEVER)
++ static_branch_enable(&vmx_l1d_should_flush);
++ else
++ static_branch_disable(&vmx_l1d_should_flush);
++
++ if (l1tf == VMENTER_L1D_FLUSH_COND)
++ static_branch_enable(&vmx_l1d_flush_cond);
++ else
++ static_branch_disable(&vmx_l1d_flush_cond);
++ return 0;
++}
++
++static int vmentry_l1d_flush_parse(const char *s)
++{
++ unsigned int i;
++
++ if (s) {
++ for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
++ if (vmentry_l1d_param[i].for_parse &&
++ sysfs_streq(s, vmentry_l1d_param[i].option))
++ return i;
++ }
++ }
++ return -EINVAL;
++}
++
++static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
++{
++ int l1tf, ret;
++
++ l1tf = vmentry_l1d_flush_parse(s);
++ if (l1tf < 0)
++ return l1tf;
++
++ if (!boot_cpu_has(X86_BUG_L1TF))
++ return 0;
++
++ /*
++ * Has vmx_init() run already? If not then this is the pre init
++ * parameter parsing. In that case just store the value and let
++ * vmx_init() do the proper setup after enable_ept has been
++ * established.
++ */
++ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO) {
++ vmentry_l1d_flush_param = l1tf;
++ return 0;
++ }
++
++ mutex_lock(&vmx_l1d_flush_mutex);
++ ret = vmx_setup_l1d_flush(l1tf);
++ mutex_unlock(&vmx_l1d_flush_mutex);
++ return ret;
++}
++
++static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp)
++{
++ if (WARN_ON_ONCE(l1tf_vmx_mitigation >= ARRAY_SIZE(vmentry_l1d_param)))
++ return sprintf(s, "???\n");
++
++ return sprintf(s, "%s\n", vmentry_l1d_param[l1tf_vmx_mitigation].option);
++}
++
++static const struct kernel_param_ops vmentry_l1d_flush_ops = {
++ .set = vmentry_l1d_flush_set,
++ .get = vmentry_l1d_flush_get,
++};
++module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, NULL, 0644);
++
++static bool guest_state_valid(struct kvm_vcpu *vcpu);
++static u32 vmx_segment_access_rights(struct kvm_segment *var);
++static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
++ u32 msr, int type);
++
++void vmx_vmexit(void);
++
++#define vmx_insn_failed(fmt...) \
++do { \
++ WARN_ONCE(1, fmt); \
++ pr_warn_ratelimited(fmt); \
++} while (0)
++
++asmlinkage void vmread_error(unsigned long field, bool fault)
++{
++ if (fault)
++ kvm_spurious_fault();
++ else
++ vmx_insn_failed("kvm: vmread failed: field=%lx\n", field);
++}
++
++noinline void vmwrite_error(unsigned long field, unsigned long value)
++{
++ vmx_insn_failed("kvm: vmwrite failed: field=%lx val=%lx err=%d\n",
++ field, value, vmcs_read32(VM_INSTRUCTION_ERROR));
++}
++
++noinline void vmclear_error(struct vmcs *vmcs, u64 phys_addr)
++{
++ vmx_insn_failed("kvm: vmclear failed: %p/%llx\n", vmcs, phys_addr);
++}
++
++noinline void vmptrld_error(struct vmcs *vmcs, u64 phys_addr)
++{
++ vmx_insn_failed("kvm: vmptrld failed: %p/%llx\n", vmcs, phys_addr);
++}
++
++noinline void invvpid_error(unsigned long ext, u16 vpid, gva_t gva)
++{
++ vmx_insn_failed("kvm: invvpid failed: ext=0x%lx vpid=%u gva=0x%lx\n",
++ ext, vpid, gva);
++}
++
++noinline void invept_error(unsigned long ext, u64 eptp, gpa_t gpa)
++{
++ vmx_insn_failed("kvm: invept failed: ext=0x%lx eptp=%llx gpa=0x%llx\n",
++ ext, eptp, gpa);
++}
++
++static DEFINE_PER_CPU(struct vmcs *, vmxarea);
++DEFINE_PER_CPU(struct vmcs *, current_vmcs);
++/*
++ * We maintain a per-CPU linked-list of VMCS loaded on that CPU. This is needed
++ * when a CPU is brought down, and we need to VMCLEAR all VMCSs loaded on it.
++ */
++static DEFINE_PER_CPU(struct list_head, loaded_vmcss_on_cpu);
++
++/*
++ * We maintian a per-CPU linked-list of vCPU, so in wakeup_handler() we
++ * can find which vCPU should be waken up.
++ */
++static DEFINE_PER_CPU(struct list_head, blocked_vcpu_on_cpu);
++static DEFINE_PER_CPU(spinlock_t, blocked_vcpu_on_cpu_lock);
++
++static DECLARE_BITMAP(vmx_vpid_bitmap, VMX_NR_VPIDS);
++static DEFINE_SPINLOCK(vmx_vpid_lock);
++
++struct vmcs_config vmcs_config;
++struct vmx_capability vmx_capability;
++
++#define VMX_SEGMENT_FIELD(seg) \
++ [VCPU_SREG_##seg] = { \
++ .selector = GUEST_##seg##_SELECTOR, \
++ .base = GUEST_##seg##_BASE, \
++ .limit = GUEST_##seg##_LIMIT, \
++ .ar_bytes = GUEST_##seg##_AR_BYTES, \
++ }
++
++static const struct kvm_vmx_segment_field {
++ unsigned selector;
++ unsigned base;
++ unsigned limit;
++ unsigned ar_bytes;
++} kvm_vmx_segment_fields[] = {
++ VMX_SEGMENT_FIELD(CS),
++ VMX_SEGMENT_FIELD(DS),
++ VMX_SEGMENT_FIELD(ES),
++ VMX_SEGMENT_FIELD(FS),
++ VMX_SEGMENT_FIELD(GS),
++ VMX_SEGMENT_FIELD(SS),
++ VMX_SEGMENT_FIELD(TR),
++ VMX_SEGMENT_FIELD(LDTR),
++};
++
++u64 host_efer;
++static unsigned long host_idt_base;
++
++/*
++ * Though SYSCALL is only supported in 64-bit mode on Intel CPUs, kvm
++ * will emulate SYSCALL in legacy mode if the vendor string in guest
++ * CPUID.0:{EBX,ECX,EDX} is "AuthenticAMD" or "AMDisbetter!" To
++ * support this emulation, IA32_STAR must always be included in
++ * vmx_msr_index[], even in i386 builds.
++ */
++const u32 vmx_msr_index[] = {
++#ifdef CONFIG_X86_64
++ MSR_SYSCALL_MASK, MSR_LSTAR, MSR_CSTAR,
++#endif
++ MSR_EFER, MSR_TSC_AUX, MSR_STAR,
++ MSR_IA32_TSX_CTRL,
++};
++
++#if IS_ENABLED(CONFIG_HYPERV)
++static bool __read_mostly enlightened_vmcs = true;
++module_param(enlightened_vmcs, bool, 0444);
++
++/* check_ept_pointer() should be under protection of ept_pointer_lock. */
++static void check_ept_pointer_match(struct kvm *kvm)
++{
++ struct kvm_vcpu *vcpu;
++ u64 tmp_eptp = INVALID_PAGE;
++ int i;
++
++ kvm_for_each_vcpu(i, vcpu, kvm) {
++ if (!VALID_PAGE(tmp_eptp)) {
++ tmp_eptp = to_vmx(vcpu)->ept_pointer;
++ } else if (tmp_eptp != to_vmx(vcpu)->ept_pointer) {
++ to_kvm_vmx(kvm)->ept_pointers_match
++ = EPT_POINTERS_MISMATCH;
++ return;
++ }
++ }
++
++ to_kvm_vmx(kvm)->ept_pointers_match = EPT_POINTERS_MATCH;
++}
++
++static int kvm_fill_hv_flush_list_func(struct hv_guest_mapping_flush_list *flush,
++ void *data)
++{
++ struct kvm_tlb_range *range = data;
++
++ return hyperv_fill_flush_guest_mapping_list(flush, range->start_gfn,
++ range->pages);
++}
++
++static inline int __hv_remote_flush_tlb_with_range(struct kvm *kvm,
++ struct kvm_vcpu *vcpu, struct kvm_tlb_range *range)
++{
++ u64 ept_pointer = to_vmx(vcpu)->ept_pointer;
++
++ /*
++ * FLUSH_GUEST_PHYSICAL_ADDRESS_SPACE hypercall needs address
++ * of the base of EPT PML4 table, strip off EPT configuration
++ * information.
++ */
++ if (range)
++ return hyperv_flush_guest_mapping_range(ept_pointer & PAGE_MASK,
++ kvm_fill_hv_flush_list_func, (void *)range);
++ else
++ return hyperv_flush_guest_mapping(ept_pointer & PAGE_MASK);
++}
++
++static int hv_remote_flush_tlb_with_range(struct kvm *kvm,
++ struct kvm_tlb_range *range)
++{
++ struct kvm_vcpu *vcpu;
++ int ret = 0, i;
++
++ spin_lock(&to_kvm_vmx(kvm)->ept_pointer_lock);
++
++ if (to_kvm_vmx(kvm)->ept_pointers_match == EPT_POINTERS_CHECK)
++ check_ept_pointer_match(kvm);
++
++ if (to_kvm_vmx(kvm)->ept_pointers_match != EPT_POINTERS_MATCH) {
++ kvm_for_each_vcpu(i, vcpu, kvm) {
++ /* If ept_pointer is invalid pointer, bypass flush request. */
++ if (VALID_PAGE(to_vmx(vcpu)->ept_pointer))
++ ret |= __hv_remote_flush_tlb_with_range(
++ kvm, vcpu, range);
++ }
++ } else {
++ ret = __hv_remote_flush_tlb_with_range(kvm,
++ kvm_get_vcpu(kvm, 0), range);
++ }
++
++ spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock);
++ return ret;
++}
++static int hv_remote_flush_tlb(struct kvm *kvm)
++{
++ return hv_remote_flush_tlb_with_range(kvm, NULL);
++}
++
++static int hv_enable_direct_tlbflush(struct kvm_vcpu *vcpu)
++{
++ struct hv_enlightened_vmcs *evmcs;
++ struct hv_partition_assist_pg **p_hv_pa_pg =
++ &vcpu->kvm->arch.hyperv.hv_pa_pg;
++ /*
++ * Synthetic VM-Exit is not enabled in current code and so All
++ * evmcs in singe VM shares same assist page.
++ */
++ if (!*p_hv_pa_pg)
++ *p_hv_pa_pg = kzalloc(PAGE_SIZE, GFP_KERNEL);
++
++ if (!*p_hv_pa_pg)
++ return -ENOMEM;
++
++ evmcs = (struct hv_enlightened_vmcs *)to_vmx(vcpu)->loaded_vmcs->vmcs;
++
++ evmcs->partition_assist_page =
++ __pa(*p_hv_pa_pg);
++ evmcs->hv_vm_id = (unsigned long)vcpu->kvm;
++ evmcs->hv_enlightenments_control.nested_flush_hypercall = 1;
++
++ return 0;
++}
++
++#endif /* IS_ENABLED(CONFIG_HYPERV) */
++
++/*
++ * Comment's format: document - errata name - stepping - processor name.
++ * Refer from
++ * https://www.virtualbox.org/svn/vbox/trunk/src/VBox/VMM/VMMR0/HMR0.cpp
++ */
++static u32 vmx_preemption_cpu_tfms[] = {
++/* 323344.pdf - BA86 - D0 - Xeon 7500 Series */
++0x000206E6,
++/* 323056.pdf - AAX65 - C2 - Xeon L3406 */
++/* 322814.pdf - AAT59 - C2 - i7-600, i5-500, i5-400 and i3-300 Mobile */
++/* 322911.pdf - AAU65 - C2 - i5-600, i3-500 Desktop and Pentium G6950 */
++0x00020652,
++/* 322911.pdf - AAU65 - K0 - i5-600, i3-500 Desktop and Pentium G6950 */
++0x00020655,
++/* 322373.pdf - AAO95 - B1 - Xeon 3400 Series */
++/* 322166.pdf - AAN92 - B1 - i7-800 and i5-700 Desktop */
++/*
++ * 320767.pdf - AAP86 - B1 -
++ * i7-900 Mobile Extreme, i7-800 and i7-700 Mobile
++ */
++0x000106E5,
++/* 321333.pdf - AAM126 - C0 - Xeon 3500 */
++0x000106A0,
++/* 321333.pdf - AAM126 - C1 - Xeon 3500 */
++0x000106A1,
++/* 320836.pdf - AAJ124 - C0 - i7-900 Desktop Extreme and i7-900 Desktop */
++0x000106A4,
++ /* 321333.pdf - AAM126 - D0 - Xeon 3500 */
++ /* 321324.pdf - AAK139 - D0 - Xeon 5500 */
++ /* 320836.pdf - AAJ124 - D0 - i7-900 Extreme and i7-900 Desktop */
++0x000106A5,
++ /* Xeon E3-1220 V2 */
++0x000306A8,
++};
++
++static inline bool cpu_has_broken_vmx_preemption_timer(void)
++{
++ u32 eax = cpuid_eax(0x00000001), i;
++
++ /* Clear the reserved bits */
++ eax &= ~(0x3U << 14 | 0xfU << 28);
++ for (i = 0; i < ARRAY_SIZE(vmx_preemption_cpu_tfms); i++)
++ if (eax == vmx_preemption_cpu_tfms[i])
++ return true;
++
++ return false;
++}
++
++static inline bool cpu_need_virtualize_apic_accesses(struct kvm_vcpu *vcpu)
++{
++ return flexpriority_enabled && lapic_in_kernel(vcpu);
++}
++
++static inline bool report_flexpriority(void)
++{
++ return flexpriority_enabled;
++}
++
++static inline int __find_msr_index(struct vcpu_vmx *vmx, u32 msr)
++{
++ int i;
++
++ for (i = 0; i < vmx->nmsrs; ++i)
++ if (vmx_msr_index[vmx->guest_msrs[i].index] == msr)
++ return i;
++ return -1;
++}
++
++struct shared_msr_entry *find_msr_entry(struct vcpu_vmx *vmx, u32 msr)
++{
++ int i;
++
++ i = __find_msr_index(vmx, msr);
++ if (i >= 0)
++ return &vmx->guest_msrs[i];
++ return NULL;
++}
++
++static int vmx_set_guest_msr(struct vcpu_vmx *vmx, struct shared_msr_entry *msr, u64 data)
++{
++ int ret = 0;
++
++ u64 old_msr_data = msr->data;
++ msr->data = data;
++ if (msr - vmx->guest_msrs < vmx->save_nmsrs) {
++ preempt_disable();
++ ret = kvm_set_shared_msr(msr->index, msr->data,
++ msr->mask);
++ preempt_enable();
++ if (ret)
++ msr->data = old_msr_data;
++ }
++ return ret;
++}
++
++void loaded_vmcs_init(struct loaded_vmcs *loaded_vmcs)
++{
++ vmcs_clear(loaded_vmcs->vmcs);
++ if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched)
++ vmcs_clear(loaded_vmcs->shadow_vmcs);
++ loaded_vmcs->cpu = -1;
++ loaded_vmcs->launched = 0;
++}
++
++#ifdef CONFIG_KEXEC_CORE
++/*
++ * This bitmap is used to indicate whether the vmclear
++ * operation is enabled on all cpus. All disabled by
++ * default.
++ */
++static cpumask_t crash_vmclear_enabled_bitmap = CPU_MASK_NONE;
++
++static inline void crash_enable_local_vmclear(int cpu)
++{
++ cpumask_set_cpu(cpu, &crash_vmclear_enabled_bitmap);
++}
++
++static inline void crash_disable_local_vmclear(int cpu)
++{
++ cpumask_clear_cpu(cpu, &crash_vmclear_enabled_bitmap);
++}
++
++static inline int crash_local_vmclear_enabled(int cpu)
++{
++ return cpumask_test_cpu(cpu, &crash_vmclear_enabled_bitmap);
++}
++
++static void crash_vmclear_local_loaded_vmcss(void)
++{
++ int cpu = raw_smp_processor_id();
++ struct loaded_vmcs *v;
++
++ if (!crash_local_vmclear_enabled(cpu))
++ return;
++
++ list_for_each_entry(v, &per_cpu(loaded_vmcss_on_cpu, cpu),
++ loaded_vmcss_on_cpu_link)
++ vmcs_clear(v->vmcs);
++}
++#else
++static inline void crash_enable_local_vmclear(int cpu) { }
++static inline void crash_disable_local_vmclear(int cpu) { }
++#endif /* CONFIG_KEXEC_CORE */
++
++static void __loaded_vmcs_clear(void *arg)
++{
++ struct loaded_vmcs *loaded_vmcs = arg;
++ int cpu = raw_smp_processor_id();
++
++ if (loaded_vmcs->cpu != cpu)
++ return; /* vcpu migration can race with cpu offline */
++ if (per_cpu(current_vmcs, cpu) == loaded_vmcs->vmcs)
++ per_cpu(current_vmcs, cpu) = NULL;
++ crash_disable_local_vmclear(cpu);
++ list_del(&loaded_vmcs->loaded_vmcss_on_cpu_link);
++
++ /*
++ * we should ensure updating loaded_vmcs->loaded_vmcss_on_cpu_link
++ * is before setting loaded_vmcs->vcpu to -1 which is done in
++ * loaded_vmcs_init. Otherwise, other cpu can see vcpu = -1 fist
++ * then adds the vmcs into percpu list before it is deleted.
++ */
++ smp_wmb();
++
++ loaded_vmcs_init(loaded_vmcs);
++ crash_enable_local_vmclear(cpu);
++}
++
++void loaded_vmcs_clear(struct loaded_vmcs *loaded_vmcs)
++{
++ int cpu = loaded_vmcs->cpu;
++
++ if (cpu != -1)
++ smp_call_function_single(cpu,
++ __loaded_vmcs_clear, loaded_vmcs, 1);
++}
++
++static bool vmx_segment_cache_test_set(struct vcpu_vmx *vmx, unsigned seg,
++ unsigned field)
++{
++ bool ret;
++ u32 mask = 1 << (seg * SEG_FIELD_NR + field);
++
++ if (!kvm_register_is_available(&vmx->vcpu, VCPU_EXREG_SEGMENTS)) {
++ kvm_register_mark_available(&vmx->vcpu, VCPU_EXREG_SEGMENTS);
++ vmx->segment_cache.bitmask = 0;
++ }
++ ret = vmx->segment_cache.bitmask & mask;
++ vmx->segment_cache.bitmask |= mask;
++ return ret;
++}
++
++static u16 vmx_read_guest_seg_selector(struct vcpu_vmx *vmx, unsigned seg)
++{
++ u16 *p = &vmx->segment_cache.seg[seg].selector;
++
++ if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_SEL))
++ *p = vmcs_read16(kvm_vmx_segment_fields[seg].selector);
++ return *p;
++}
++
++static ulong vmx_read_guest_seg_base(struct vcpu_vmx *vmx, unsigned seg)
++{
++ ulong *p = &vmx->segment_cache.seg[seg].base;
++
++ if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_BASE))
++ *p = vmcs_readl(kvm_vmx_segment_fields[seg].base);
++ return *p;
++}
++
++static u32 vmx_read_guest_seg_limit(struct vcpu_vmx *vmx, unsigned seg)
++{
++ u32 *p = &vmx->segment_cache.seg[seg].limit;
++
++ if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_LIMIT))
++ *p = vmcs_read32(kvm_vmx_segment_fields[seg].limit);
++ return *p;
++}
++
++static u32 vmx_read_guest_seg_ar(struct vcpu_vmx *vmx, unsigned seg)
++{
++ u32 *p = &vmx->segment_cache.seg[seg].ar;
++
++ if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_AR))
++ *p = vmcs_read32(kvm_vmx_segment_fields[seg].ar_bytes);
++ return *p;
++}
++
++void update_exception_bitmap(struct kvm_vcpu *vcpu)
++{
++ u32 eb;
++
++ eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
++ (1u << DB_VECTOR) | (1u << AC_VECTOR);
++ /*
++ * Guest access to VMware backdoor ports could legitimately
++ * trigger #GP because of TSS I/O permission bitmap.
++ * We intercept those #GP and allow access to them anyway
++ * as VMware does.
++ */
++ if (enable_vmware_backdoor)
++ eb |= (1u << GP_VECTOR);
++ if ((vcpu->guest_debug &
++ (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
++ (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP))
++ eb |= 1u << BP_VECTOR;
++ if (to_vmx(vcpu)->rmode.vm86_active)
++ eb = ~0;
++ if (enable_ept)
++ eb &= ~(1u << PF_VECTOR); /* bypass_guest_pf = 0 */
++
++ /* When we are running a nested L2 guest and L1 specified for it a
++ * certain exception bitmap, we must trap the same exceptions and pass
++ * them to L1. When running L2, we will only handle the exceptions
++ * specified above if L1 did not want them.
++ */
++ if (is_guest_mode(vcpu))
++ eb |= get_vmcs12(vcpu)->exception_bitmap;
++
++ vmcs_write32(EXCEPTION_BITMAP, eb);
++}
++
++/*
++ * Check if MSR is intercepted for currently loaded MSR bitmap.
++ */
++static bool msr_write_intercepted(struct kvm_vcpu *vcpu, u32 msr)
++{
++ unsigned long *msr_bitmap;
++ int f = sizeof(unsigned long);
++
++ if (!cpu_has_vmx_msr_bitmap())
++ return true;
++
++ msr_bitmap = to_vmx(vcpu)->loaded_vmcs->msr_bitmap;
++
++ if (msr <= 0x1fff) {
++ return !!test_bit(msr, msr_bitmap + 0x800 / f);
++ } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
++ msr &= 0x1fff;
++ return !!test_bit(msr, msr_bitmap + 0xc00 / f);
++ }
++
++ return true;
++}
++
++static void clear_atomic_switch_msr_special(struct vcpu_vmx *vmx,
++ unsigned long entry, unsigned long exit)
++{
++ vm_entry_controls_clearbit(vmx, entry);
++ vm_exit_controls_clearbit(vmx, exit);
++}
++
++int vmx_find_msr_index(struct vmx_msrs *m, u32 msr)
++{
++ unsigned int i;
++
++ for (i = 0; i < m->nr; ++i) {
++ if (m->val[i].index == msr)
++ return i;
++ }
++ return -ENOENT;
++}
++
++static void clear_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr)
++{
++ int i;
++ struct msr_autoload *m = &vmx->msr_autoload;
++
++ switch (msr) {
++ case MSR_EFER:
++ if (cpu_has_load_ia32_efer()) {
++ clear_atomic_switch_msr_special(vmx,
++ VM_ENTRY_LOAD_IA32_EFER,
++ VM_EXIT_LOAD_IA32_EFER);
++ return;
++ }
++ break;
++ case MSR_CORE_PERF_GLOBAL_CTRL:
++ if (cpu_has_load_perf_global_ctrl()) {
++ clear_atomic_switch_msr_special(vmx,
++ VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL,
++ VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL);
++ return;
++ }
++ break;
++ }
++ i = vmx_find_msr_index(&m->guest, msr);
++ if (i < 0)
++ goto skip_guest;
++ --m->guest.nr;
++ m->guest.val[i] = m->guest.val[m->guest.nr];
++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
++
++skip_guest:
++ i = vmx_find_msr_index(&m->host, msr);
++ if (i < 0)
++ return;
++
++ --m->host.nr;
++ m->host.val[i] = m->host.val[m->host.nr];
++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
++}
++
++static void add_atomic_switch_msr_special(struct vcpu_vmx *vmx,
++ unsigned long entry, unsigned long exit,
++ unsigned long guest_val_vmcs, unsigned long host_val_vmcs,
++ u64 guest_val, u64 host_val)
++{
++ vmcs_write64(guest_val_vmcs, guest_val);
++ if (host_val_vmcs != HOST_IA32_EFER)
++ vmcs_write64(host_val_vmcs, host_val);
++ vm_entry_controls_setbit(vmx, entry);
++ vm_exit_controls_setbit(vmx, exit);
++}
++
++static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
++ u64 guest_val, u64 host_val, bool entry_only)
++{
++ int i, j = 0;
++ struct msr_autoload *m = &vmx->msr_autoload;
++
++ switch (msr) {
++ case MSR_EFER:
++ if (cpu_has_load_ia32_efer()) {
++ add_atomic_switch_msr_special(vmx,
++ VM_ENTRY_LOAD_IA32_EFER,
++ VM_EXIT_LOAD_IA32_EFER,
++ GUEST_IA32_EFER,
++ HOST_IA32_EFER,
++ guest_val, host_val);
++ return;
++ }
++ break;
++ case MSR_CORE_PERF_GLOBAL_CTRL:
++ if (cpu_has_load_perf_global_ctrl()) {
++ add_atomic_switch_msr_special(vmx,
++ VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL,
++ VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL,
++ GUEST_IA32_PERF_GLOBAL_CTRL,
++ HOST_IA32_PERF_GLOBAL_CTRL,
++ guest_val, host_val);
++ return;
++ }
++ break;
++ case MSR_IA32_PEBS_ENABLE:
++ /* PEBS needs a quiescent period after being disabled (to write
++ * a record). Disabling PEBS through VMX MSR swapping doesn't
++ * provide that period, so a CPU could write host's record into
++ * guest's memory.
++ */
++ wrmsrl(MSR_IA32_PEBS_ENABLE, 0);
++ }
++
++ i = vmx_find_msr_index(&m->guest, msr);
++ if (!entry_only)
++ j = vmx_find_msr_index(&m->host, msr);
++
++ if ((i < 0 && m->guest.nr == NR_LOADSTORE_MSRS) ||
++ (j < 0 && m->host.nr == NR_LOADSTORE_MSRS)) {
++ printk_once(KERN_WARNING "Not enough msr switch entries. "
++ "Can't add msr %x\n", msr);
++ return;
++ }
++ if (i < 0) {
++ i = m->guest.nr++;
++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
++ }
++ m->guest.val[i].index = msr;
++ m->guest.val[i].value = guest_val;
++
++ if (entry_only)
++ return;
++
++ if (j < 0) {
++ j = m->host.nr++;
++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
++ }
++ m->host.val[j].index = msr;
++ m->host.val[j].value = host_val;
++}
++
++static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset)
++{
++ u64 guest_efer = vmx->vcpu.arch.efer;
++ u64 ignore_bits = 0;
++
++ /* Shadow paging assumes NX to be available. */
++ if (!enable_ept)
++ guest_efer |= EFER_NX;
++
++ /*
++ * LMA and LME handled by hardware; SCE meaningless outside long mode.
++ */
++ ignore_bits |= EFER_SCE;
++#ifdef CONFIG_X86_64
++ ignore_bits |= EFER_LMA | EFER_LME;
++ /* SCE is meaningful only in long mode on Intel */
++ if (guest_efer & EFER_LMA)
++ ignore_bits &= ~(u64)EFER_SCE;
++#endif
++
++ /*
++ * On EPT, we can't emulate NX, so we must switch EFER atomically.
++ * On CPUs that support "load IA32_EFER", always switch EFER
++ * atomically, since it's faster than switching it manually.
++ */
++ if (cpu_has_load_ia32_efer() ||
++ (enable_ept && ((vmx->vcpu.arch.efer ^ host_efer) & EFER_NX))) {
++ if (!(guest_efer & EFER_LMA))
++ guest_efer &= ~EFER_LME;
++ if (guest_efer != host_efer)
++ add_atomic_switch_msr(vmx, MSR_EFER,
++ guest_efer, host_efer, false);
++ else
++ clear_atomic_switch_msr(vmx, MSR_EFER);
++ return false;
++ } else {
++ clear_atomic_switch_msr(vmx, MSR_EFER);
++
++ guest_efer &= ~ignore_bits;
++ guest_efer |= host_efer & ignore_bits;
++
++ vmx->guest_msrs[efer_offset].data = guest_efer;
++ vmx->guest_msrs[efer_offset].mask = ~ignore_bits;
++
++ return true;
++ }
++}
++
++#ifdef CONFIG_X86_32
++/*
++ * On 32-bit kernels, VM exits still load the FS and GS bases from the
++ * VMCS rather than the segment table. KVM uses this helper to figure
++ * out the current bases to poke them into the VMCS before entry.
++ */
++static unsigned long segment_base(u16 selector)
++{
++ struct desc_struct *table;
++ unsigned long v;
++
++ if (!(selector & ~SEGMENT_RPL_MASK))
++ return 0;
++
++ table = get_current_gdt_ro();
++
++ if ((selector & SEGMENT_TI_MASK) == SEGMENT_LDT) {
++ u16 ldt_selector = kvm_read_ldt();
++
++ if (!(ldt_selector & ~SEGMENT_RPL_MASK))
++ return 0;
++
++ table = (struct desc_struct *)segment_base(ldt_selector);
++ }
++ v = get_desc_base(&table[selector >> 3]);
++ return v;
++}
++#endif
++
++static inline void pt_load_msr(struct pt_ctx *ctx, u32 addr_range)
++{
++ u32 i;
++
++ wrmsrl(MSR_IA32_RTIT_STATUS, ctx->status);
++ wrmsrl(MSR_IA32_RTIT_OUTPUT_BASE, ctx->output_base);
++ wrmsrl(MSR_IA32_RTIT_OUTPUT_MASK, ctx->output_mask);
++ wrmsrl(MSR_IA32_RTIT_CR3_MATCH, ctx->cr3_match);
++ for (i = 0; i < addr_range; i++) {
++ wrmsrl(MSR_IA32_RTIT_ADDR0_A + i * 2, ctx->addr_a[i]);
++ wrmsrl(MSR_IA32_RTIT_ADDR0_B + i * 2, ctx->addr_b[i]);
++ }
++}
++
++static inline void pt_save_msr(struct pt_ctx *ctx, u32 addr_range)
++{
++ u32 i;
++
++ rdmsrl(MSR_IA32_RTIT_STATUS, ctx->status);
++ rdmsrl(MSR_IA32_RTIT_OUTPUT_BASE, ctx->output_base);
++ rdmsrl(MSR_IA32_RTIT_OUTPUT_MASK, ctx->output_mask);
++ rdmsrl(MSR_IA32_RTIT_CR3_MATCH, ctx->cr3_match);
++ for (i = 0; i < addr_range; i++) {
++ rdmsrl(MSR_IA32_RTIT_ADDR0_A + i * 2, ctx->addr_a[i]);
++ rdmsrl(MSR_IA32_RTIT_ADDR0_B + i * 2, ctx->addr_b[i]);
++ }
++}
++
++static void pt_guest_enter(struct vcpu_vmx *vmx)
++{
++ if (pt_mode == PT_MODE_SYSTEM)
++ return;
++
++ /*
++ * GUEST_IA32_RTIT_CTL is already set in the VMCS.
++ * Save host state before VM entry.
++ */
++ rdmsrl(MSR_IA32_RTIT_CTL, vmx->pt_desc.host.ctl);
++ if (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) {
++ wrmsrl(MSR_IA32_RTIT_CTL, 0);
++ pt_save_msr(&vmx->pt_desc.host, vmx->pt_desc.addr_range);
++ pt_load_msr(&vmx->pt_desc.guest, vmx->pt_desc.addr_range);
++ }
++}
++
++static void pt_guest_exit(struct vcpu_vmx *vmx)
++{
++ if (pt_mode == PT_MODE_SYSTEM)
++ return;
++
++ if (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) {
++ pt_save_msr(&vmx->pt_desc.guest, vmx->pt_desc.addr_range);
++ pt_load_msr(&vmx->pt_desc.host, vmx->pt_desc.addr_range);
++ }
++
++ /* Reload host state (IA32_RTIT_CTL will be cleared on VM exit). */
++ wrmsrl(MSR_IA32_RTIT_CTL, vmx->pt_desc.host.ctl);
++}
++
++void vmx_set_host_fs_gs(struct vmcs_host_state *host, u16 fs_sel, u16 gs_sel,
++ unsigned long fs_base, unsigned long gs_base)
++{
++ if (unlikely(fs_sel != host->fs_sel)) {
++ if (!(fs_sel & 7))
++ vmcs_write16(HOST_FS_SELECTOR, fs_sel);
++ else
++ vmcs_write16(HOST_FS_SELECTOR, 0);
++ host->fs_sel = fs_sel;
++ }
++ if (unlikely(gs_sel != host->gs_sel)) {
++ if (!(gs_sel & 7))
++ vmcs_write16(HOST_GS_SELECTOR, gs_sel);
++ else
++ vmcs_write16(HOST_GS_SELECTOR, 0);
++ host->gs_sel = gs_sel;
++ }
++ if (unlikely(fs_base != host->fs_base)) {
++ vmcs_writel(HOST_FS_BASE, fs_base);
++ host->fs_base = fs_base;
++ }
++ if (unlikely(gs_base != host->gs_base)) {
++ vmcs_writel(HOST_GS_BASE, gs_base);
++ host->gs_base = gs_base;
++ }
++}
++
++void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct vmcs_host_state *host_state;
++#ifdef CONFIG_X86_64
++ int cpu = raw_smp_processor_id();
++#endif
++ unsigned long fs_base, gs_base;
++ u16 fs_sel, gs_sel;
++ int i;
++
++ vmx->req_immediate_exit = false;
++
++ /*
++ * Note that guest MSRs to be saved/restored can also be changed
++ * when guest state is loaded. This happens when guest transitions
++ * to/from long-mode by setting MSR_EFER.LMA.
++ */
++ if (!vmx->guest_msrs_ready) {
++ vmx->guest_msrs_ready = true;
++ for (i = 0; i < vmx->save_nmsrs; ++i)
++ kvm_set_shared_msr(vmx->guest_msrs[i].index,
++ vmx->guest_msrs[i].data,
++ vmx->guest_msrs[i].mask);
++
++ }
++ if (vmx->guest_state_loaded)
++ return;
++
++ host_state = &vmx->loaded_vmcs->host_state;
++
++ /*
++ * Set host fs and gs selectors. Unfortunately, 22.2.3 does not
++ * allow segment selectors with cpl > 0 or ti == 1.
++ */
++ host_state->ldt_sel = kvm_read_ldt();
++
++#ifdef CONFIG_X86_64
++ savesegment(ds, host_state->ds_sel);
++ savesegment(es, host_state->es_sel);
++
++ gs_base = cpu_kernelmode_gs_base(cpu);
++ if (likely(is_64bit_mm(current->mm))) {
++ save_fsgs_for_kvm();
++ fs_sel = current->thread.fsindex;
++ gs_sel = current->thread.gsindex;
++ fs_base = current->thread.fsbase;
++ vmx->msr_host_kernel_gs_base = current->thread.gsbase;
++ } else {
++ savesegment(fs, fs_sel);
++ savesegment(gs, gs_sel);
++ fs_base = read_msr(MSR_FS_BASE);
++ vmx->msr_host_kernel_gs_base = read_msr(MSR_KERNEL_GS_BASE);
++ }
++
++ wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
++#else
++ savesegment(fs, fs_sel);
++ savesegment(gs, gs_sel);
++ fs_base = segment_base(fs_sel);
++ gs_base = segment_base(gs_sel);
++#endif
++
++ vmx_set_host_fs_gs(host_state, fs_sel, gs_sel, fs_base, gs_base);
++ vmx->guest_state_loaded = true;
++}
++
++static void vmx_prepare_switch_to_host(struct vcpu_vmx *vmx)
++{
++ struct vmcs_host_state *host_state;
++
++ if (!vmx->guest_state_loaded)
++ return;
++
++ host_state = &vmx->loaded_vmcs->host_state;
++
++ ++vmx->vcpu.stat.host_state_reload;
++
++#ifdef CONFIG_X86_64
++ rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
++#endif
++ if (host_state->ldt_sel || (host_state->gs_sel & 7)) {
++ kvm_load_ldt(host_state->ldt_sel);
++#ifdef CONFIG_X86_64
++ load_gs_index(host_state->gs_sel);
++#else
++ loadsegment(gs, host_state->gs_sel);
++#endif
++ }
++ if (host_state->fs_sel & 7)
++ loadsegment(fs, host_state->fs_sel);
++#ifdef CONFIG_X86_64
++ if (unlikely(host_state->ds_sel | host_state->es_sel)) {
++ loadsegment(ds, host_state->ds_sel);
++ loadsegment(es, host_state->es_sel);
++ }
++#endif
++ invalidate_tss_limit();
++#ifdef CONFIG_X86_64
++ wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
++#endif
++ load_fixmap_gdt(raw_smp_processor_id());
++ vmx->guest_state_loaded = false;
++ vmx->guest_msrs_ready = false;
++}
++
++#ifdef CONFIG_X86_64
++static u64 vmx_read_guest_kernel_gs_base(struct vcpu_vmx *vmx)
++{
++ preempt_disable();
++ if (vmx->guest_state_loaded)
++ rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
++ preempt_enable();
++ return vmx->msr_guest_kernel_gs_base;
++}
++
++static void vmx_write_guest_kernel_gs_base(struct vcpu_vmx *vmx, u64 data)
++{
++ preempt_disable();
++ if (vmx->guest_state_loaded)
++ wrmsrl(MSR_KERNEL_GS_BASE, data);
++ preempt_enable();
++ vmx->msr_guest_kernel_gs_base = data;
++}
++#endif
++
++static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
++{
++ struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
++ struct pi_desc old, new;
++ unsigned int dest;
++
++ /*
++ * In case of hot-plug or hot-unplug, we may have to undo
++ * vmx_vcpu_pi_put even if there is no assigned device. And we
++ * always keep PI.NDST up to date for simplicity: it makes the
++ * code easier, and CPU migration is not a fast path.
++ */
++ if (!pi_test_sn(pi_desc) && vcpu->cpu == cpu)
++ return;
++
++ /*
++ * If the 'nv' field is POSTED_INTR_WAKEUP_VECTOR, do not change
++ * PI.NDST: pi_post_block is the one expected to change PID.NDST and the
++ * wakeup handler expects the vCPU to be on the blocked_vcpu_list that
++ * matches PI.NDST. Otherwise, a vcpu may not be able to be woken up
++ * correctly.
++ */
++ if (pi_desc->nv == POSTED_INTR_WAKEUP_VECTOR || vcpu->cpu == cpu) {
++ pi_clear_sn(pi_desc);
++ goto after_clear_sn;
++ }
++
++ /* The full case. */
++ do {
++ old.control = new.control = pi_desc->control;
++
++ dest = cpu_physical_id(cpu);
++
++ if (x2apic_enabled())
++ new.ndst = dest;
++ else
++ new.ndst = (dest << 8) & 0xFF00;
++
++ new.sn = 0;
++ } while (cmpxchg64(&pi_desc->control, old.control,
++ new.control) != old.control);
++
++after_clear_sn:
++
++ /*
++ * Clear SN before reading the bitmap. The VT-d firmware
++ * writes the bitmap and reads SN atomically (5.2.3 in the
++ * spec), so it doesn't really have a memory barrier that
++ * pairs with this, but we cannot do that and we need one.
++ */
++ smp_mb__after_atomic();
++
++ if (!pi_is_pir_empty(pi_desc))
++ pi_set_on(pi_desc);
++}
++
++void vmx_vcpu_load_vmcs(struct kvm_vcpu *vcpu, int cpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ bool already_loaded = vmx->loaded_vmcs->cpu == cpu;
++
++ if (!already_loaded) {
++ loaded_vmcs_clear(vmx->loaded_vmcs);
++ local_irq_disable();
++ crash_disable_local_vmclear(cpu);
++
++ /*
++ * Read loaded_vmcs->cpu should be before fetching
++ * loaded_vmcs->loaded_vmcss_on_cpu_link.
++ * See the comments in __loaded_vmcs_clear().
++ */
++ smp_rmb();
++
++ list_add(&vmx->loaded_vmcs->loaded_vmcss_on_cpu_link,
++ &per_cpu(loaded_vmcss_on_cpu, cpu));
++ crash_enable_local_vmclear(cpu);
++ local_irq_enable();
++ }
++
++ if (per_cpu(current_vmcs, cpu) != vmx->loaded_vmcs->vmcs) {
++ per_cpu(current_vmcs, cpu) = vmx->loaded_vmcs->vmcs;
++ vmcs_load(vmx->loaded_vmcs->vmcs);
++ indirect_branch_prediction_barrier();
++ }
++
++ if (!already_loaded) {
++ void *gdt = get_current_gdt_ro();
++ unsigned long sysenter_esp;
++
++ kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
++
++ /*
++ * Linux uses per-cpu TSS and GDT, so set these when switching
++ * processors. See 22.2.4.
++ */
++ vmcs_writel(HOST_TR_BASE,
++ (unsigned long)&get_cpu_entry_area(cpu)->tss.x86_tss);
++ vmcs_writel(HOST_GDTR_BASE, (unsigned long)gdt); /* 22.2.4 */
++
++ rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
++ vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
++
++ vmx->loaded_vmcs->cpu = cpu;
++ }
++
++ /* Setup TSC multiplier */
++ if (kvm_has_tsc_control &&
++ vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio)
++ decache_tsc_multiplier(vmx);
++}
++
++/*
++ * Switches to specified vcpu, until a matching vcpu_put(), but assumes
++ * vcpu mutex is already taken.
++ */
++void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ vmx_vcpu_load_vmcs(vcpu, cpu);
++
++ vmx_vcpu_pi_load(vcpu, cpu);
++
++ vmx->host_pkru = read_pkru();
++ vmx->host_debugctlmsr = get_debugctlmsr();
++}
++
++static void vmx_vcpu_pi_put(struct kvm_vcpu *vcpu)
++{
++ struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
++
++ if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
++ !irq_remapping_cap(IRQ_POSTING_CAP) ||
++ !kvm_vcpu_apicv_active(vcpu))
++ return;
++
++ /* Set SN when the vCPU is preempted */
++ if (vcpu->preempted)
++ pi_set_sn(pi_desc);
++}
++
++static void vmx_vcpu_put(struct kvm_vcpu *vcpu)
++{
++ vmx_vcpu_pi_put(vcpu);
++
++ vmx_prepare_switch_to_host(to_vmx(vcpu));
++}
++
++static bool emulation_required(struct kvm_vcpu *vcpu)
++{
++ return emulate_invalid_guest_state && !guest_state_valid(vcpu);
++}
++
++static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu);
++
++unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long rflags, save_rflags;
++
++ if (!kvm_register_is_available(vcpu, VCPU_EXREG_RFLAGS)) {
++ kvm_register_mark_available(vcpu, VCPU_EXREG_RFLAGS);
++ rflags = vmcs_readl(GUEST_RFLAGS);
++ if (vmx->rmode.vm86_active) {
++ rflags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
++ save_rflags = vmx->rmode.save_rflags;
++ rflags |= save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
++ }
++ vmx->rflags = rflags;
++ }
++ return vmx->rflags;
++}
++
++void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long old_rflags;
++
++ if (enable_unrestricted_guest) {
++ kvm_register_mark_available(vcpu, VCPU_EXREG_RFLAGS);
++ vmx->rflags = rflags;
++ vmcs_writel(GUEST_RFLAGS, rflags);
++ return;
++ }
++
++ old_rflags = vmx_get_rflags(vcpu);
++ vmx->rflags = rflags;
++ if (vmx->rmode.vm86_active) {
++ vmx->rmode.save_rflags = rflags;
++ rflags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
++ }
++ vmcs_writel(GUEST_RFLAGS, rflags);
++
++ if ((old_rflags ^ vmx->rflags) & X86_EFLAGS_VM)
++ vmx->emulation_required = emulation_required(vcpu);
++}
++
++u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu)
++{
++ u32 interruptibility = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
++ int ret = 0;
++
++ if (interruptibility & GUEST_INTR_STATE_STI)
++ ret |= KVM_X86_SHADOW_INT_STI;
++ if (interruptibility & GUEST_INTR_STATE_MOV_SS)
++ ret |= KVM_X86_SHADOW_INT_MOV_SS;
++
++ return ret;
++}
++
++void vmx_set_interrupt_shadow(struct kvm_vcpu *vcpu, int mask)
++{
++ u32 interruptibility_old = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
++ u32 interruptibility = interruptibility_old;
++
++ interruptibility &= ~(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS);
++
++ if (mask & KVM_X86_SHADOW_INT_MOV_SS)
++ interruptibility |= GUEST_INTR_STATE_MOV_SS;
++ else if (mask & KVM_X86_SHADOW_INT_STI)
++ interruptibility |= GUEST_INTR_STATE_STI;
++
++ if ((interruptibility != interruptibility_old))
++ vmcs_write32(GUEST_INTERRUPTIBILITY_INFO, interruptibility);
++}
++
++static int vmx_rtit_ctl_check(struct kvm_vcpu *vcpu, u64 data)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long value;
++
++ /*
++ * Any MSR write that attempts to change bits marked reserved will
++ * case a #GP fault.
++ */
++ if (data & vmx->pt_desc.ctl_bitmask)
++ return 1;
++
++ /*
++ * Any attempt to modify IA32_RTIT_CTL while TraceEn is set will
++ * result in a #GP unless the same write also clears TraceEn.
++ */
++ if ((vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) &&
++ ((vmx->pt_desc.guest.ctl ^ data) & ~RTIT_CTL_TRACEEN))
++ return 1;
++
++ /*
++ * WRMSR to IA32_RTIT_CTL that sets TraceEn but clears this bit
++ * and FabricEn would cause #GP, if
++ * CPUID.(EAX=14H, ECX=0):ECX.SNGLRGNOUT[bit 2] = 0
++ */
++ if ((data & RTIT_CTL_TRACEEN) && !(data & RTIT_CTL_TOPA) &&
++ !(data & RTIT_CTL_FABRIC_EN) &&
++ !intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_single_range_output))
++ return 1;
++
++ /*
++ * MTCFreq, CycThresh and PSBFreq encodings check, any MSR write that
++ * utilize encodings marked reserved will casue a #GP fault.
++ */
++ value = intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_mtc_periods);
++ if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_mtc) &&
++ !test_bit((data & RTIT_CTL_MTC_RANGE) >>
++ RTIT_CTL_MTC_RANGE_OFFSET, &value))
++ return 1;
++ value = intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_cycle_thresholds);
++ if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_psb_cyc) &&
++ !test_bit((data & RTIT_CTL_CYC_THRESH) >>
++ RTIT_CTL_CYC_THRESH_OFFSET, &value))
++ return 1;
++ value = intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_psb_periods);
++ if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_psb_cyc) &&
++ !test_bit((data & RTIT_CTL_PSB_FREQ) >>
++ RTIT_CTL_PSB_FREQ_OFFSET, &value))
++ return 1;
++
++ /*
++ * If ADDRx_CFG is reserved or the encodings is >2 will
++ * cause a #GP fault.
++ */
++ value = (data & RTIT_CTL_ADDR0) >> RTIT_CTL_ADDR0_OFFSET;
++ if ((value && (vmx->pt_desc.addr_range < 1)) || (value > 2))
++ return 1;
++ value = (data & RTIT_CTL_ADDR1) >> RTIT_CTL_ADDR1_OFFSET;
++ if ((value && (vmx->pt_desc.addr_range < 2)) || (value > 2))
++ return 1;
++ value = (data & RTIT_CTL_ADDR2) >> RTIT_CTL_ADDR2_OFFSET;
++ if ((value && (vmx->pt_desc.addr_range < 3)) || (value > 2))
++ return 1;
++ value = (data & RTIT_CTL_ADDR3) >> RTIT_CTL_ADDR3_OFFSET;
++ if ((value && (vmx->pt_desc.addr_range < 4)) || (value > 2))
++ return 1;
++
++ return 0;
++}
++
++static int skip_emulated_instruction(struct kvm_vcpu *vcpu)
++{
++ unsigned long rip;
++
++ /*
++ * Using VMCS.VM_EXIT_INSTRUCTION_LEN on EPT misconfig depends on
++ * undefined behavior: Intel's SDM doesn't mandate the VMCS field be
++ * set when EPT misconfig occurs. In practice, real hardware updates
++ * VM_EXIT_INSTRUCTION_LEN on EPT misconfig, but other hypervisors
++ * (namely Hyper-V) don't set it due to it being undefined behavior,
++ * i.e. we end up advancing IP with some random value.
++ */
++ if (!static_cpu_has(X86_FEATURE_HYPERVISOR) ||
++ to_vmx(vcpu)->exit_reason != EXIT_REASON_EPT_MISCONFIG) {
++ rip = kvm_rip_read(vcpu);
++ rip += vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
++ kvm_rip_write(vcpu, rip);
++ } else {
++ if (!kvm_emulate_instruction(vcpu, EMULTYPE_SKIP))
++ return 0;
++ }
++
++ /* skipping an emulated instruction also counts */
++ vmx_set_interrupt_shadow(vcpu, 0);
++
++ return 1;
++}
++
++static void vmx_clear_hlt(struct kvm_vcpu *vcpu)
++{
++ /*
++ * Ensure that we clear the HLT state in the VMCS. We don't need to
++ * explicitly skip the instruction because if the HLT state is set,
++ * then the instruction is already executing and RIP has already been
++ * advanced.
++ */
++ if (kvm_hlt_in_guest(vcpu->kvm) &&
++ vmcs_read32(GUEST_ACTIVITY_STATE) == GUEST_ACTIVITY_HLT)
++ vmcs_write32(GUEST_ACTIVITY_STATE, GUEST_ACTIVITY_ACTIVE);
++}
++
++static void vmx_queue_exception(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned nr = vcpu->arch.exception.nr;
++ bool has_error_code = vcpu->arch.exception.has_error_code;
++ u32 error_code = vcpu->arch.exception.error_code;
++ u32 intr_info = nr | INTR_INFO_VALID_MASK;
++
++ kvm_deliver_exception_payload(vcpu);
++
++ if (has_error_code) {
++ vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE, error_code);
++ intr_info |= INTR_INFO_DELIVER_CODE_MASK;
++ }
++
++ if (vmx->rmode.vm86_active) {
++ int inc_eip = 0;
++ if (kvm_exception_is_soft(nr))
++ inc_eip = vcpu->arch.event_exit_inst_len;
++ kvm_inject_realmode_interrupt(vcpu, nr, inc_eip);
++ return;
++ }
++
++ WARN_ON_ONCE(vmx->emulation_required);
++
++ if (kvm_exception_is_soft(nr)) {
++ vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
++ vmx->vcpu.arch.event_exit_inst_len);
++ intr_info |= INTR_TYPE_SOFT_EXCEPTION;
++ } else
++ intr_info |= INTR_TYPE_HARD_EXCEPTION;
++
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, intr_info);
++
++ vmx_clear_hlt(vcpu);
++}
++
++static bool vmx_rdtscp_supported(void)
++{
++ return cpu_has_vmx_rdtscp();
++}
++
++static bool vmx_invpcid_supported(void)
++{
++ return cpu_has_vmx_invpcid();
++}
++
++/*
++ * Swap MSR entry in host/guest MSR entry array.
++ */
++static void move_msr_up(struct vcpu_vmx *vmx, int from, int to)
++{
++ struct shared_msr_entry tmp;
++
++ tmp = vmx->guest_msrs[to];
++ vmx->guest_msrs[to] = vmx->guest_msrs[from];
++ vmx->guest_msrs[from] = tmp;
++}
++
++/*
++ * Set up the vmcs to automatically save and restore system
++ * msrs. Don't touch the 64-bit msrs if the guest is in legacy
++ * mode, as fiddling with msrs is very expensive.
++ */
++static void setup_msrs(struct vcpu_vmx *vmx)
++{
++ int save_nmsrs, index;
++
++ save_nmsrs = 0;
++#ifdef CONFIG_X86_64
++ /*
++ * The SYSCALL MSRs are only needed on long mode guests, and only
++ * when EFER.SCE is set.
++ */
++ if (is_long_mode(&vmx->vcpu) && (vmx->vcpu.arch.efer & EFER_SCE)) {
++ index = __find_msr_index(vmx, MSR_STAR);
++ if (index >= 0)
++ move_msr_up(vmx, index, save_nmsrs++);
++ index = __find_msr_index(vmx, MSR_LSTAR);
++ if (index >= 0)
++ move_msr_up(vmx, index, save_nmsrs++);
++ index = __find_msr_index(vmx, MSR_SYSCALL_MASK);
++ if (index >= 0)
++ move_msr_up(vmx, index, save_nmsrs++);
++ }
++#endif
++ index = __find_msr_index(vmx, MSR_EFER);
++ if (index >= 0 && update_transition_efer(vmx, index))
++ move_msr_up(vmx, index, save_nmsrs++);
++ index = __find_msr_index(vmx, MSR_TSC_AUX);
++ if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
++ move_msr_up(vmx, index, save_nmsrs++);
++ index = __find_msr_index(vmx, MSR_IA32_TSX_CTRL);
++ if (index >= 0)
++ move_msr_up(vmx, index, save_nmsrs++);
++
++ vmx->save_nmsrs = save_nmsrs;
++ vmx->guest_msrs_ready = false;
++
++ if (cpu_has_vmx_msr_bitmap())
++ vmx_update_msr_bitmap(&vmx->vcpu);
++}
++
++static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++
++ if (is_guest_mode(vcpu) &&
++ (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETTING))
++ return vcpu->arch.tsc_offset - vmcs12->tsc_offset;
++
++ return vcpu->arch.tsc_offset;
++}
++
++static u64 vmx_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ u64 g_tsc_offset = 0;
++
++ /*
++ * We're here if L1 chose not to trap WRMSR to TSC. According
++ * to the spec, this should set L1's TSC; The offset that L1
++ * set for L2 remains unchanged, and still needs to be added
++ * to the newly set TSC to get L2's TSC.
++ */
++ if (is_guest_mode(vcpu) &&
++ (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETTING))
++ g_tsc_offset = vmcs12->tsc_offset;
++
++ trace_kvm_write_tsc_offset(vcpu->vcpu_id,
++ vcpu->arch.tsc_offset - g_tsc_offset,
++ offset);
++ vmcs_write64(TSC_OFFSET, offset + g_tsc_offset);
++ return offset + g_tsc_offset;
++}
++
++/*
++ * nested_vmx_allowed() checks whether a guest should be allowed to use VMX
++ * instructions and MSRs (i.e., nested VMX). Nested VMX is disabled for
++ * all guests if the "nested" module option is off, and can also be disabled
++ * for a single guest by disabling its VMX cpuid bit.
++ */
++bool nested_vmx_allowed(struct kvm_vcpu *vcpu)
++{
++ return nested && guest_cpuid_has(vcpu, X86_FEATURE_VMX);
++}
++
++static inline bool vmx_feature_control_msr_valid(struct kvm_vcpu *vcpu,
++ uint64_t val)
++{
++ uint64_t valid_bits = to_vmx(vcpu)->msr_ia32_feature_control_valid_bits;
++
++ return !(val & ~valid_bits);
++}
++
++static int vmx_get_msr_feature(struct kvm_msr_entry *msr)
++{
++ switch (msr->index) {
++ case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
++ if (!nested)
++ return 1;
++ return vmx_get_vmx_msr(&vmcs_config.nested, msr->index, &msr->data);
++ default:
++ return 1;
++ }
++}
++
++/*
++ * Reads an msr value (of 'msr_index') into 'pdata'.
++ * Returns 0 on success, non-0 otherwise.
++ * Assumes vcpu_load() was already called.
++ */
++static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct shared_msr_entry *msr;
++ u32 index;
++
++ switch (msr_info->index) {
++#ifdef CONFIG_X86_64
++ case MSR_FS_BASE:
++ msr_info->data = vmcs_readl(GUEST_FS_BASE);
++ break;
++ case MSR_GS_BASE:
++ msr_info->data = vmcs_readl(GUEST_GS_BASE);
++ break;
++ case MSR_KERNEL_GS_BASE:
++ msr_info->data = vmx_read_guest_kernel_gs_base(vmx);
++ break;
++#endif
++ case MSR_EFER:
++ return kvm_get_msr_common(vcpu, msr_info);
++ case MSR_IA32_TSX_CTRL:
++ if (!msr_info->host_initiated &&
++ !(vcpu->arch.arch_capabilities & ARCH_CAP_TSX_CTRL_MSR))
++ return 1;
++ goto find_shared_msr;
++ case MSR_IA32_UMWAIT_CONTROL:
++ if (!msr_info->host_initiated && !vmx_has_waitpkg(vmx))
++ return 1;
++
++ msr_info->data = vmx->msr_ia32_umwait_control;
++ break;
++ case MSR_IA32_SPEC_CTRL:
++ if (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
++ return 1;
++
++ msr_info->data = to_vmx(vcpu)->spec_ctrl;
++ break;
++ case MSR_IA32_SYSENTER_CS:
++ msr_info->data = vmcs_read32(GUEST_SYSENTER_CS);
++ break;
++ case MSR_IA32_SYSENTER_EIP:
++ msr_info->data = vmcs_readl(GUEST_SYSENTER_EIP);
++ break;
++ case MSR_IA32_SYSENTER_ESP:
++ msr_info->data = vmcs_readl(GUEST_SYSENTER_ESP);
++ break;
++ case MSR_IA32_BNDCFGS:
++ if (!kvm_mpx_supported() ||
++ (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_MPX)))
++ return 1;
++ msr_info->data = vmcs_read64(GUEST_BNDCFGS);
++ break;
++ case MSR_IA32_MCG_EXT_CTL:
++ if (!msr_info->host_initiated &&
++ !(vmx->msr_ia32_feature_control &
++ FEATURE_CONTROL_LMCE))
++ return 1;
++ msr_info->data = vcpu->arch.mcg_ext_ctl;
++ break;
++ case MSR_IA32_FEATURE_CONTROL:
++ msr_info->data = vmx->msr_ia32_feature_control;
++ break;
++ case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
++ if (!nested_vmx_allowed(vcpu))
++ return 1;
++ return vmx_get_vmx_msr(&vmx->nested.msrs, msr_info->index,
++ &msr_info->data);
++ case MSR_IA32_RTIT_CTL:
++ if (pt_mode != PT_MODE_HOST_GUEST)
++ return 1;
++ msr_info->data = vmx->pt_desc.guest.ctl;
++ break;
++ case MSR_IA32_RTIT_STATUS:
++ if (pt_mode != PT_MODE_HOST_GUEST)
++ return 1;
++ msr_info->data = vmx->pt_desc.guest.status;
++ break;
++ case MSR_IA32_RTIT_CR3_MATCH:
++ if ((pt_mode != PT_MODE_HOST_GUEST) ||
++ !intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_cr3_filtering))
++ return 1;
++ msr_info->data = vmx->pt_desc.guest.cr3_match;
++ break;
++ case MSR_IA32_RTIT_OUTPUT_BASE:
++ if ((pt_mode != PT_MODE_HOST_GUEST) ||
++ (!intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_topa_output) &&
++ !intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_single_range_output)))
++ return 1;
++ msr_info->data = vmx->pt_desc.guest.output_base;
++ break;
++ case MSR_IA32_RTIT_OUTPUT_MASK:
++ if ((pt_mode != PT_MODE_HOST_GUEST) ||
++ (!intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_topa_output) &&
++ !intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_single_range_output)))
++ return 1;
++ msr_info->data = vmx->pt_desc.guest.output_mask;
++ break;
++ case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B:
++ index = msr_info->index - MSR_IA32_RTIT_ADDR0_A;
++ if ((pt_mode != PT_MODE_HOST_GUEST) ||
++ (index >= 2 * intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_num_address_ranges)))
++ return 1;
++ if (is_noncanonical_address(data, vcpu))
++ return 1;
++ if (index % 2)
++ msr_info->data = vmx->pt_desc.guest.addr_b[index / 2];
++ else
++ msr_info->data = vmx->pt_desc.guest.addr_a[index / 2];
++ break;
++ case MSR_TSC_AUX:
++ if (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
++ return 1;
++ goto find_shared_msr;
++ default:
++ find_shared_msr:
++ msr = find_msr_entry(vmx, msr_info->index);
++ if (msr) {
++ msr_info->data = msr->data;
++ break;
++ }
++ return kvm_get_msr_common(vcpu, msr_info);
++ }
++
++ return 0;
++}
++
++/*
++ * Writes msr value into the appropriate "register".
++ * Returns 0 on success, non-0 otherwise.
++ * Assumes vcpu_load() was already called.
++ */
++static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct shared_msr_entry *msr;
++ int ret = 0;
++ u32 msr_index = msr_info->index;
++ u64 data = msr_info->data;
++ u32 index;
++
++ switch (msr_index) {
++ case MSR_EFER:
++ ret = kvm_set_msr_common(vcpu, msr_info);
++ break;
++#ifdef CONFIG_X86_64
++ case MSR_FS_BASE:
++ vmx_segment_cache_clear(vmx);
++ vmcs_writel(GUEST_FS_BASE, data);
++ break;
++ case MSR_GS_BASE:
++ vmx_segment_cache_clear(vmx);
++ vmcs_writel(GUEST_GS_BASE, data);
++ break;
++ case MSR_KERNEL_GS_BASE:
++ vmx_write_guest_kernel_gs_base(vmx, data);
++ break;
++#endif
++ case MSR_IA32_SYSENTER_CS:
++ if (is_guest_mode(vcpu))
++ get_vmcs12(vcpu)->guest_sysenter_cs = data;
++ vmcs_write32(GUEST_SYSENTER_CS, data);
++ break;
++ case MSR_IA32_SYSENTER_EIP:
++ if (is_guest_mode(vcpu))
++ get_vmcs12(vcpu)->guest_sysenter_eip = data;
++ vmcs_writel(GUEST_SYSENTER_EIP, data);
++ break;
++ case MSR_IA32_SYSENTER_ESP:
++ if (is_guest_mode(vcpu))
++ get_vmcs12(vcpu)->guest_sysenter_esp = data;
++ vmcs_writel(GUEST_SYSENTER_ESP, data);
++ break;
++ case MSR_IA32_DEBUGCTLMSR:
++ if (is_guest_mode(vcpu) && get_vmcs12(vcpu)->vm_exit_controls &
++ VM_EXIT_SAVE_DEBUG_CONTROLS)
++ get_vmcs12(vcpu)->guest_ia32_debugctl = data;
++
++ ret = kvm_set_msr_common(vcpu, msr_info);
++ break;
++
++ case MSR_IA32_BNDCFGS:
++ if (!kvm_mpx_supported() ||
++ (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_MPX)))
++ return 1;
++ if (is_noncanonical_address(data & PAGE_MASK, vcpu) ||
++ (data & MSR_IA32_BNDCFGS_RSVD))
++ return 1;
++ vmcs_write64(GUEST_BNDCFGS, data);
++ break;
++ case MSR_IA32_UMWAIT_CONTROL:
++ if (!msr_info->host_initiated && !vmx_has_waitpkg(vmx))
++ return 1;
++
++ /* The reserved bit 1 and non-32 bit [63:32] should be zero */
++ if (data & (BIT_ULL(1) | GENMASK_ULL(63, 32)))
++ return 1;
++
++ vmx->msr_ia32_umwait_control = data;
++ break;
++ case MSR_IA32_SPEC_CTRL:
++ if (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
++ return 1;
++
++ /* The STIBP bit doesn't fault even if it's not advertised */
++ if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD))
++ return 1;
++
++ vmx->spec_ctrl = data;
++
++ if (!data)
++ break;
++
++ /*
++ * For non-nested:
++ * When it's written (to non-zero) for the first time, pass
++ * it through.
++ *
++ * For nested:
++ * The handling of the MSR bitmap for L2 guests is done in
++ * nested_vmx_prepare_msr_bitmap. We should not touch the
++ * vmcs02.msr_bitmap here since it gets completely overwritten
++ * in the merging. We update the vmcs01 here for L1 as well
++ * since it will end up touching the MSR anyway now.
++ */
++ vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap,
++ MSR_IA32_SPEC_CTRL,
++ MSR_TYPE_RW);
++ break;
++ case MSR_IA32_TSX_CTRL:
++ if (!msr_info->host_initiated &&
++ !(vcpu->arch.arch_capabilities & ARCH_CAP_TSX_CTRL_MSR))
++ return 1;
++ if (data & ~(TSX_CTRL_RTM_DISABLE | TSX_CTRL_CPUID_CLEAR))
++ return 1;
++ goto find_shared_msr;
++ case MSR_IA32_PRED_CMD:
++ if (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
++ return 1;
++
++ if (data & ~PRED_CMD_IBPB)
++ return 1;
++
++ if (!data)
++ break;
++
++ wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB);
++
++ /*
++ * For non-nested:
++ * When it's written (to non-zero) for the first time, pass
++ * it through.
++ *
++ * For nested:
++ * The handling of the MSR bitmap for L2 guests is done in
++ * nested_vmx_prepare_msr_bitmap. We should not touch the
++ * vmcs02.msr_bitmap here since it gets completely overwritten
++ * in the merging.
++ */
++ vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD,
++ MSR_TYPE_W);
++ break;
++ case MSR_IA32_CR_PAT:
++ if (!kvm_pat_valid(data))
++ return 1;
++
++ if (is_guest_mode(vcpu) &&
++ get_vmcs12(vcpu)->vm_exit_controls & VM_EXIT_SAVE_IA32_PAT)
++ get_vmcs12(vcpu)->guest_ia32_pat = data;
++
++ if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
++ vmcs_write64(GUEST_IA32_PAT, data);
++ vcpu->arch.pat = data;
++ break;
++ }
++ ret = kvm_set_msr_common(vcpu, msr_info);
++ break;
++ case MSR_IA32_TSC_ADJUST:
++ ret = kvm_set_msr_common(vcpu, msr_info);
++ break;
++ case MSR_IA32_MCG_EXT_CTL:
++ if ((!msr_info->host_initiated &&
++ !(to_vmx(vcpu)->msr_ia32_feature_control &
++ FEATURE_CONTROL_LMCE)) ||
++ (data & ~MCG_EXT_CTL_LMCE_EN))
++ return 1;
++ vcpu->arch.mcg_ext_ctl = data;
++ break;
++ case MSR_IA32_FEATURE_CONTROL:
++ if (!vmx_feature_control_msr_valid(vcpu, data) ||
++ (to_vmx(vcpu)->msr_ia32_feature_control &
++ FEATURE_CONTROL_LOCKED && !msr_info->host_initiated))
++ return 1;
++ vmx->msr_ia32_feature_control = data;
++ if (msr_info->host_initiated && data == 0)
++ vmx_leave_nested(vcpu);
++ break;
++ case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
++ if (!msr_info->host_initiated)
++ return 1; /* they are read-only */
++ if (!nested_vmx_allowed(vcpu))
++ return 1;
++ return vmx_set_vmx_msr(vcpu, msr_index, data);
++ case MSR_IA32_RTIT_CTL:
++ if ((pt_mode != PT_MODE_HOST_GUEST) ||
++ vmx_rtit_ctl_check(vcpu, data) ||
++ vmx->nested.vmxon)
++ return 1;
++ vmcs_write64(GUEST_IA32_RTIT_CTL, data);
++ vmx->pt_desc.guest.ctl = data;
++ pt_update_intercept_for_msr(vmx);
++ break;
++ case MSR_IA32_RTIT_STATUS:
++ if ((pt_mode != PT_MODE_HOST_GUEST) ||
++ (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) ||
++ (data & MSR_IA32_RTIT_STATUS_MASK))
++ return 1;
++ vmx->pt_desc.guest.status = data;
++ break;
++ case MSR_IA32_RTIT_CR3_MATCH:
++ if ((pt_mode != PT_MODE_HOST_GUEST) ||
++ (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) ||
++ !intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_cr3_filtering))
++ return 1;
++ vmx->pt_desc.guest.cr3_match = data;
++ break;
++ case MSR_IA32_RTIT_OUTPUT_BASE:
++ if ((pt_mode != PT_MODE_HOST_GUEST) ||
++ (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) ||
++ (!intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_topa_output) &&
++ !intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_single_range_output)) ||
++ (data & MSR_IA32_RTIT_OUTPUT_BASE_MASK))
++ return 1;
++ vmx->pt_desc.guest.output_base = data;
++ break;
++ case MSR_IA32_RTIT_OUTPUT_MASK:
++ if ((pt_mode != PT_MODE_HOST_GUEST) ||
++ (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) ||
++ (!intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_topa_output) &&
++ !intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_single_range_output)))
++ return 1;
++ vmx->pt_desc.guest.output_mask = data;
++ break;
++ case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B:
++ index = msr_info->index - MSR_IA32_RTIT_ADDR0_A;
++ if ((pt_mode != PT_MODE_HOST_GUEST) ||
++ (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) ||
++ (index >= 2 * intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_num_address_ranges)))
++ return 1;
++ if (is_noncanonical_address(data, vcpu))
++ return 1;
++ if (index % 2)
++ vmx->pt_desc.guest.addr_b[index / 2] = data;
++ else
++ vmx->pt_desc.guest.addr_a[index / 2] = data;
++ break;
++ case MSR_TSC_AUX:
++ if (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
++ return 1;
++ /* Check reserved bit, higher 32 bits should be zero */
++ if ((data >> 32) != 0)
++ return 1;
++ goto find_shared_msr;
++
++ default:
++ find_shared_msr:
++ msr = find_msr_entry(vmx, msr_index);
++ if (msr)
++ ret = vmx_set_guest_msr(vmx, msr, data);
++ else
++ ret = kvm_set_msr_common(vcpu, msr_info);
++ }
++
++ return ret;
++}
++
++static void vmx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
++{
++ kvm_register_mark_available(vcpu, reg);
++
++ switch (reg) {
++ case VCPU_REGS_RSP:
++ vcpu->arch.regs[VCPU_REGS_RSP] = vmcs_readl(GUEST_RSP);
++ break;
++ case VCPU_REGS_RIP:
++ vcpu->arch.regs[VCPU_REGS_RIP] = vmcs_readl(GUEST_RIP);
++ break;
++ case VCPU_EXREG_PDPTR:
++ if (enable_ept)
++ ept_save_pdptrs(vcpu);
++ break;
++ case VCPU_EXREG_CR3:
++ if (enable_unrestricted_guest || (enable_ept && is_paging(vcpu)))
++ vcpu->arch.cr3 = vmcs_readl(GUEST_CR3);
++ break;
++ default:
++ WARN_ON_ONCE(1);
++ break;
++ }
++}
++
++static __init int cpu_has_kvm_support(void)
++{
++ return cpu_has_vmx();
++}
++
++static __init int vmx_disabled_by_bios(void)
++{
++ u64 msr;
++
++ rdmsrl(MSR_IA32_FEATURE_CONTROL, msr);
++ if (msr & FEATURE_CONTROL_LOCKED) {
++ /* launched w/ TXT and VMX disabled */
++ if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX)
++ && tboot_enabled())
++ return 1;
++ /* launched w/o TXT and VMX only enabled w/ TXT */
++ if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
++ && (msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX)
++ && !tboot_enabled()) {
++ printk(KERN_WARNING "kvm: disable TXT in the BIOS or "
++ "activate TXT before enabling KVM\n");
++ return 1;
++ }
++ /* launched w/o TXT and VMX disabled */
++ if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
++ && !tboot_enabled())
++ return 1;
++ }
++
++ return 0;
++}
++
++static void kvm_cpu_vmxon(u64 addr)
++{
++ cr4_set_bits(X86_CR4_VMXE);
++ intel_pt_handle_vmx(1);
++
++ asm volatile ("vmxon %0" : : "m"(addr));
++}
++
++static int hardware_enable(void)
++{
++ int cpu = raw_smp_processor_id();
++ u64 phys_addr = __pa(per_cpu(vmxarea, cpu));
++ u64 old, test_bits;
++
++ if (cr4_read_shadow() & X86_CR4_VMXE)
++ return -EBUSY;
++
++ /*
++ * This can happen if we hot-added a CPU but failed to allocate
++ * VP assist page for it.
++ */
++ if (static_branch_unlikely(&enable_evmcs) &&
++ !hv_get_vp_assist_page(cpu))
++ return -EFAULT;
++
++ INIT_LIST_HEAD(&per_cpu(loaded_vmcss_on_cpu, cpu));
++ INIT_LIST_HEAD(&per_cpu(blocked_vcpu_on_cpu, cpu));
++ spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
++
++ /*
++ * Now we can enable the vmclear operation in kdump
++ * since the loaded_vmcss_on_cpu list on this cpu
++ * has been initialized.
++ *
++ * Though the cpu is not in VMX operation now, there
++ * is no problem to enable the vmclear operation
++ * for the loaded_vmcss_on_cpu list is empty!
++ */
++ crash_enable_local_vmclear(cpu);
++
++ rdmsrl(MSR_IA32_FEATURE_CONTROL, old);
++
++ test_bits = FEATURE_CONTROL_LOCKED;
++ test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
++ if (tboot_enabled())
++ test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX;
++
++ if ((old & test_bits) != test_bits) {
++ /* enable and lock */
++ wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits);
++ }
++ kvm_cpu_vmxon(phys_addr);
++ if (enable_ept)
++ ept_sync_global();
++
++ return 0;
++}
++
++static void vmclear_local_loaded_vmcss(void)
++{
++ int cpu = raw_smp_processor_id();
++ struct loaded_vmcs *v, *n;
++
++ list_for_each_entry_safe(v, n, &per_cpu(loaded_vmcss_on_cpu, cpu),
++ loaded_vmcss_on_cpu_link)
++ __loaded_vmcs_clear(v);
++}
++
++
++/* Just like cpu_vmxoff(), but with the __kvm_handle_fault_on_reboot()
++ * tricks.
++ */
++static void kvm_cpu_vmxoff(void)
++{
++ asm volatile (__ex("vmxoff"));
++
++ intel_pt_handle_vmx(0);
++ cr4_clear_bits(X86_CR4_VMXE);
++}
++
++static void hardware_disable(void)
++{
++ vmclear_local_loaded_vmcss();
++ kvm_cpu_vmxoff();
++}
++
++static __init int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt,
++ u32 msr, u32 *result)
++{
++ u32 vmx_msr_low, vmx_msr_high;
++ u32 ctl = ctl_min | ctl_opt;
++
++ rdmsr(msr, vmx_msr_low, vmx_msr_high);
++
++ ctl &= vmx_msr_high; /* bit == 0 in high word ==> must be zero */
++ ctl |= vmx_msr_low; /* bit == 1 in low word ==> must be one */
++
++ /* Ensure minimum (required) set of control bits are supported. */
++ if (ctl_min & ~ctl)
++ return -EIO;
++
++ *result = ctl;
++ return 0;
++}
++
++static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf,
++ struct vmx_capability *vmx_cap)
++{
++ u32 vmx_msr_low, vmx_msr_high;
++ u32 min, opt, min2, opt2;
++ u32 _pin_based_exec_control = 0;
++ u32 _cpu_based_exec_control = 0;
++ u32 _cpu_based_2nd_exec_control = 0;
++ u32 _vmexit_control = 0;
++ u32 _vmentry_control = 0;
++
++ memset(vmcs_conf, 0, sizeof(*vmcs_conf));
++ min = CPU_BASED_HLT_EXITING |
++#ifdef CONFIG_X86_64
++ CPU_BASED_CR8_LOAD_EXITING |
++ CPU_BASED_CR8_STORE_EXITING |
++#endif
++ CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_CR3_STORE_EXITING |
++ CPU_BASED_UNCOND_IO_EXITING |
++ CPU_BASED_MOV_DR_EXITING |
++ CPU_BASED_USE_TSC_OFFSETTING |
++ CPU_BASED_MWAIT_EXITING |
++ CPU_BASED_MONITOR_EXITING |
++ CPU_BASED_INVLPG_EXITING |
++ CPU_BASED_RDPMC_EXITING;
++
++ opt = CPU_BASED_TPR_SHADOW |
++ CPU_BASED_USE_MSR_BITMAPS |
++ CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
++ if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PROCBASED_CTLS,
++ &_cpu_based_exec_control) < 0)
++ return -EIO;
++#ifdef CONFIG_X86_64
++ if ((_cpu_based_exec_control & CPU_BASED_TPR_SHADOW))
++ _cpu_based_exec_control &= ~CPU_BASED_CR8_LOAD_EXITING &
++ ~CPU_BASED_CR8_STORE_EXITING;
++#endif
++ if (_cpu_based_exec_control & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) {
++ min2 = 0;
++ opt2 = SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
++ SECONDARY_EXEC_WBINVD_EXITING |
++ SECONDARY_EXEC_ENABLE_VPID |
++ SECONDARY_EXEC_ENABLE_EPT |
++ SECONDARY_EXEC_UNRESTRICTED_GUEST |
++ SECONDARY_EXEC_PAUSE_LOOP_EXITING |
++ SECONDARY_EXEC_DESC |
++ SECONDARY_EXEC_RDTSCP |
++ SECONDARY_EXEC_ENABLE_INVPCID |
++ SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
++ SECONDARY_EXEC_SHADOW_VMCS |
++ SECONDARY_EXEC_XSAVES |
++ SECONDARY_EXEC_RDSEED_EXITING |
++ SECONDARY_EXEC_RDRAND_EXITING |
++ SECONDARY_EXEC_ENABLE_PML |
++ SECONDARY_EXEC_TSC_SCALING |
++ SECONDARY_EXEC_ENABLE_USR_WAIT_PAUSE |
++ SECONDARY_EXEC_PT_USE_GPA |
++ SECONDARY_EXEC_PT_CONCEAL_VMX |
++ SECONDARY_EXEC_ENABLE_VMFUNC |
++ SECONDARY_EXEC_ENCLS_EXITING;
++ if (adjust_vmx_controls(min2, opt2,
++ MSR_IA32_VMX_PROCBASED_CTLS2,
++ &_cpu_based_2nd_exec_control) < 0)
++ return -EIO;
++ }
++#ifndef CONFIG_X86_64
++ if (!(_cpu_based_2nd_exec_control &
++ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES))
++ _cpu_based_exec_control &= ~CPU_BASED_TPR_SHADOW;
++#endif
++
++ if (!(_cpu_based_exec_control & CPU_BASED_TPR_SHADOW))
++ _cpu_based_2nd_exec_control &= ~(
++ SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
++
++ rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP,
++ &vmx_cap->ept, &vmx_cap->vpid);
++
++ if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) {
++ /* CR3 accesses and invlpg don't need to cause VM Exits when EPT
++ enabled */
++ _cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_CR3_STORE_EXITING |
++ CPU_BASED_INVLPG_EXITING);
++ } else if (vmx_cap->ept) {
++ vmx_cap->ept = 0;
++ pr_warn_once("EPT CAP should not exist if not support "
++ "1-setting enable EPT VM-execution control\n");
++ }
++ if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_VPID) &&
++ vmx_cap->vpid) {
++ vmx_cap->vpid = 0;
++ pr_warn_once("VPID CAP should not exist if not support "
++ "1-setting enable VPID VM-execution control\n");
++ }
++
++ min = VM_EXIT_SAVE_DEBUG_CONTROLS | VM_EXIT_ACK_INTR_ON_EXIT;
++#ifdef CONFIG_X86_64
++ min |= VM_EXIT_HOST_ADDR_SPACE_SIZE;
++#endif
++ opt = VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
++ VM_EXIT_LOAD_IA32_PAT |
++ VM_EXIT_LOAD_IA32_EFER |
++ VM_EXIT_CLEAR_BNDCFGS |
++ VM_EXIT_PT_CONCEAL_PIP |
++ VM_EXIT_CLEAR_IA32_RTIT_CTL;
++ if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_EXIT_CTLS,
++ &_vmexit_control) < 0)
++ return -EIO;
++
++ min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING;
++ opt = PIN_BASED_VIRTUAL_NMIS | PIN_BASED_POSTED_INTR |
++ PIN_BASED_VMX_PREEMPTION_TIMER;
++ if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PINBASED_CTLS,
++ &_pin_based_exec_control) < 0)
++ return -EIO;
++
++ if (cpu_has_broken_vmx_preemption_timer())
++ _pin_based_exec_control &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
++ if (!(_cpu_based_2nd_exec_control &
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY))
++ _pin_based_exec_control &= ~PIN_BASED_POSTED_INTR;
++
++ min = VM_ENTRY_LOAD_DEBUG_CONTROLS;
++ opt = VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL |
++ VM_ENTRY_LOAD_IA32_PAT |
++ VM_ENTRY_LOAD_IA32_EFER |
++ VM_ENTRY_LOAD_BNDCFGS |
++ VM_ENTRY_PT_CONCEAL_PIP |
++ VM_ENTRY_LOAD_IA32_RTIT_CTL;
++ if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_ENTRY_CTLS,
++ &_vmentry_control) < 0)
++ return -EIO;
++
++ /*
++ * Some cpus support VM_{ENTRY,EXIT}_IA32_PERF_GLOBAL_CTRL but they
++ * can't be used due to an errata where VM Exit may incorrectly clear
++ * IA32_PERF_GLOBAL_CTRL[34:32]. Workaround the errata by using the
++ * MSR load mechanism to switch IA32_PERF_GLOBAL_CTRL.
++ */
++ if (boot_cpu_data.x86 == 0x6) {
++ switch (boot_cpu_data.x86_model) {
++ case 26: /* AAK155 */
++ case 30: /* AAP115 */
++ case 37: /* AAT100 */
++ case 44: /* BC86,AAY89,BD102 */
++ case 46: /* BA97 */
++ _vmentry_control &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
++ _vmexit_control &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
++ pr_warn_once("kvm: VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL "
++ "does not work properly. Using workaround\n");
++ break;
++ default:
++ break;
++ }
++ }
++
++
++ rdmsr(MSR_IA32_VMX_BASIC, vmx_msr_low, vmx_msr_high);
++
++ /* IA-32 SDM Vol 3B: VMCS size is never greater than 4kB. */
++ if ((vmx_msr_high & 0x1fff) > PAGE_SIZE)
++ return -EIO;
++
++#ifdef CONFIG_X86_64
++ /* IA-32 SDM Vol 3B: 64-bit CPUs always have VMX_BASIC_MSR[48]==0. */
++ if (vmx_msr_high & (1u<<16))
++ return -EIO;
++#endif
++
++ /* Require Write-Back (WB) memory type for VMCS accesses. */
++ if (((vmx_msr_high >> 18) & 15) != 6)
++ return -EIO;
++
++ vmcs_conf->size = vmx_msr_high & 0x1fff;
++ vmcs_conf->order = get_order(vmcs_conf->size);
++ vmcs_conf->basic_cap = vmx_msr_high & ~0x1fff;
++
++ vmcs_conf->revision_id = vmx_msr_low;
++
++ vmcs_conf->pin_based_exec_ctrl = _pin_based_exec_control;
++ vmcs_conf->cpu_based_exec_ctrl = _cpu_based_exec_control;
++ vmcs_conf->cpu_based_2nd_exec_ctrl = _cpu_based_2nd_exec_control;
++ vmcs_conf->vmexit_ctrl = _vmexit_control;
++ vmcs_conf->vmentry_ctrl = _vmentry_control;
++
++ if (static_branch_unlikely(&enable_evmcs))
++ evmcs_sanitize_exec_ctrls(vmcs_conf);
++
++ return 0;
++}
++
++struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu, gfp_t flags)
++{
++ int node = cpu_to_node(cpu);
++ struct page *pages;
++ struct vmcs *vmcs;
++
++ pages = __alloc_pages_node(node, flags, vmcs_config.order);
++ if (!pages)
++ return NULL;
++ vmcs = page_address(pages);
++ memset(vmcs, 0, vmcs_config.size);
++
++ /* KVM supports Enlightened VMCS v1 only */
++ if (static_branch_unlikely(&enable_evmcs))
++ vmcs->hdr.revision_id = KVM_EVMCS_VERSION;
++ else
++ vmcs->hdr.revision_id = vmcs_config.revision_id;
++
++ if (shadow)
++ vmcs->hdr.shadow_vmcs = 1;
++ return vmcs;
++}
++
++void free_vmcs(struct vmcs *vmcs)
++{
++ free_pages((unsigned long)vmcs, vmcs_config.order);
++}
++
++/*
++ * Free a VMCS, but before that VMCLEAR it on the CPU where it was last loaded
++ */
++void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
++{
++ if (!loaded_vmcs->vmcs)
++ return;
++ loaded_vmcs_clear(loaded_vmcs);
++ free_vmcs(loaded_vmcs->vmcs);
++ loaded_vmcs->vmcs = NULL;
++ if (loaded_vmcs->msr_bitmap)
++ free_page((unsigned long)loaded_vmcs->msr_bitmap);
++ WARN_ON(loaded_vmcs->shadow_vmcs != NULL);
++}
++
++int alloc_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
++{
++ loaded_vmcs->vmcs = alloc_vmcs(false);
++ if (!loaded_vmcs->vmcs)
++ return -ENOMEM;
++
++ loaded_vmcs->shadow_vmcs = NULL;
++ loaded_vmcs->hv_timer_soft_disabled = false;
++ loaded_vmcs_init(loaded_vmcs);
++
++ if (cpu_has_vmx_msr_bitmap()) {
++ loaded_vmcs->msr_bitmap = (unsigned long *)
++ __get_free_page(GFP_KERNEL_ACCOUNT);
++ if (!loaded_vmcs->msr_bitmap)
++ goto out_vmcs;
++ memset(loaded_vmcs->msr_bitmap, 0xff, PAGE_SIZE);
++
++ if (IS_ENABLED(CONFIG_HYPERV) &&
++ static_branch_unlikely(&enable_evmcs) &&
++ (ms_hyperv.nested_features & HV_X64_NESTED_MSR_BITMAP)) {
++ struct hv_enlightened_vmcs *evmcs =
++ (struct hv_enlightened_vmcs *)loaded_vmcs->vmcs;
++
++ evmcs->hv_enlightenments_control.msr_bitmap = 1;
++ }
++ }
++
++ memset(&loaded_vmcs->host_state, 0, sizeof(struct vmcs_host_state));
++ memset(&loaded_vmcs->controls_shadow, 0,
++ sizeof(struct vmcs_controls_shadow));
++
++ return 0;
++
++out_vmcs:
++ free_loaded_vmcs(loaded_vmcs);
++ return -ENOMEM;
++}
++
++static void free_kvm_area(void)
++{
++ int cpu;
++
++ for_each_possible_cpu(cpu) {
++ free_vmcs(per_cpu(vmxarea, cpu));
++ per_cpu(vmxarea, cpu) = NULL;
++ }
++}
++
++static __init int alloc_kvm_area(void)
++{
++ int cpu;
++
++ for_each_possible_cpu(cpu) {
++ struct vmcs *vmcs;
++
++ vmcs = alloc_vmcs_cpu(false, cpu, GFP_KERNEL);
++ if (!vmcs) {
++ free_kvm_area();
++ return -ENOMEM;
++ }
++
++ /*
++ * When eVMCS is enabled, alloc_vmcs_cpu() sets
++ * vmcs->revision_id to KVM_EVMCS_VERSION instead of
++ * revision_id reported by MSR_IA32_VMX_BASIC.
++ *
++ * However, even though not explicitly documented by
++ * TLFS, VMXArea passed as VMXON argument should
++ * still be marked with revision_id reported by
++ * physical CPU.
++ */
++ if (static_branch_unlikely(&enable_evmcs))
++ vmcs->hdr.revision_id = vmcs_config.revision_id;
++
++ per_cpu(vmxarea, cpu) = vmcs;
++ }
++ return 0;
++}
++
++static void fix_pmode_seg(struct kvm_vcpu *vcpu, int seg,
++ struct kvm_segment *save)
++{
++ if (!emulate_invalid_guest_state) {
++ /*
++ * CS and SS RPL should be equal during guest entry according
++ * to VMX spec, but in reality it is not always so. Since vcpu
++ * is in the middle of the transition from real mode to
++ * protected mode it is safe to assume that RPL 0 is a good
++ * default value.
++ */
++ if (seg == VCPU_SREG_CS || seg == VCPU_SREG_SS)
++ save->selector &= ~SEGMENT_RPL_MASK;
++ save->dpl = save->selector & SEGMENT_RPL_MASK;
++ save->s = 1;
++ }
++ vmx_set_segment(vcpu, save, seg);
++}
++
++static void enter_pmode(struct kvm_vcpu *vcpu)
++{
++ unsigned long flags;
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ /*
++ * Update real mode segment cache. It may be not up-to-date if sement
++ * register was written while vcpu was in a guest mode.
++ */
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_ES], VCPU_SREG_ES);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_DS], VCPU_SREG_DS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_FS], VCPU_SREG_FS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_GS], VCPU_SREG_GS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_SS], VCPU_SREG_SS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_CS], VCPU_SREG_CS);
++
++ vmx->rmode.vm86_active = 0;
++
++ vmx_segment_cache_clear(vmx);
++
++ vmx_set_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_TR], VCPU_SREG_TR);
++
++ flags = vmcs_readl(GUEST_RFLAGS);
++ flags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
++ flags |= vmx->rmode.save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
++ vmcs_writel(GUEST_RFLAGS, flags);
++
++ vmcs_writel(GUEST_CR4, (vmcs_readl(GUEST_CR4) & ~X86_CR4_VME) |
++ (vmcs_readl(CR4_READ_SHADOW) & X86_CR4_VME));
++
++ update_exception_bitmap(vcpu);
++
++ fix_pmode_seg(vcpu, VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]);
++ fix_pmode_seg(vcpu, VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]);
++ fix_pmode_seg(vcpu, VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]);
++ fix_pmode_seg(vcpu, VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]);
++ fix_pmode_seg(vcpu, VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]);
++ fix_pmode_seg(vcpu, VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]);
++}
++
++static void fix_rmode_seg(int seg, struct kvm_segment *save)
++{
++ const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
++ struct kvm_segment var = *save;
++
++ var.dpl = 0x3;
++ if (seg == VCPU_SREG_CS)
++ var.type = 0x3;
++
++ if (!emulate_invalid_guest_state) {
++ var.selector = var.base >> 4;
++ var.base = var.base & 0xffff0;
++ var.limit = 0xffff;
++ var.g = 0;
++ var.db = 0;
++ var.present = 1;
++ var.s = 1;
++ var.l = 0;
++ var.unusable = 0;
++ var.type = 0x3;
++ var.avl = 0;
++ if (save->base & 0xf)
++ printk_once(KERN_WARNING "kvm: segment base is not "
++ "paragraph aligned when entering "
++ "protected mode (seg=%d)", seg);
++ }
++
++ vmcs_write16(sf->selector, var.selector);
++ vmcs_writel(sf->base, var.base);
++ vmcs_write32(sf->limit, var.limit);
++ vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(&var));
++}
++
++static void enter_rmode(struct kvm_vcpu *vcpu)
++{
++ unsigned long flags;
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct kvm_vmx *kvm_vmx = to_kvm_vmx(vcpu->kvm);
++
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_TR], VCPU_SREG_TR);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_ES], VCPU_SREG_ES);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_DS], VCPU_SREG_DS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_FS], VCPU_SREG_FS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_GS], VCPU_SREG_GS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_SS], VCPU_SREG_SS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_CS], VCPU_SREG_CS);
++
++ vmx->rmode.vm86_active = 1;
++
++ /*
++ * Very old userspace does not call KVM_SET_TSS_ADDR before entering
++ * vcpu. Warn the user that an update is overdue.
++ */
++ if (!kvm_vmx->tss_addr)
++ printk_once(KERN_WARNING "kvm: KVM_SET_TSS_ADDR need to be "
++ "called before entering vcpu\n");
++
++ vmx_segment_cache_clear(vmx);
++
++ vmcs_writel(GUEST_TR_BASE, kvm_vmx->tss_addr);
++ vmcs_write32(GUEST_TR_LIMIT, RMODE_TSS_SIZE - 1);
++ vmcs_write32(GUEST_TR_AR_BYTES, 0x008b);
++
++ flags = vmcs_readl(GUEST_RFLAGS);
++ vmx->rmode.save_rflags = flags;
++
++ flags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
++
++ vmcs_writel(GUEST_RFLAGS, flags);
++ vmcs_writel(GUEST_CR4, vmcs_readl(GUEST_CR4) | X86_CR4_VME);
++ update_exception_bitmap(vcpu);
++
++ fix_rmode_seg(VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]);
++ fix_rmode_seg(VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]);
++ fix_rmode_seg(VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]);
++ fix_rmode_seg(VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]);
++ fix_rmode_seg(VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]);
++ fix_rmode_seg(VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]);
++
++ kvm_mmu_reset_context(vcpu);
++}
++
++void vmx_set_efer(struct kvm_vcpu *vcpu, u64 efer)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct shared_msr_entry *msr = find_msr_entry(vmx, MSR_EFER);
++
++ if (!msr)
++ return;
++
++ vcpu->arch.efer = efer;
++ if (efer & EFER_LMA) {
++ vm_entry_controls_setbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
++ msr->data = efer;
++ } else {
++ vm_entry_controls_clearbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
++
++ msr->data = efer & ~EFER_LME;
++ }
++ setup_msrs(vmx);
++}
++
++#ifdef CONFIG_X86_64
++
++static void enter_lmode(struct kvm_vcpu *vcpu)
++{
++ u32 guest_tr_ar;
++
++ vmx_segment_cache_clear(to_vmx(vcpu));
++
++ guest_tr_ar = vmcs_read32(GUEST_TR_AR_BYTES);
++ if ((guest_tr_ar & VMX_AR_TYPE_MASK) != VMX_AR_TYPE_BUSY_64_TSS) {
++ pr_debug_ratelimited("%s: tss fixup for long mode. \n",
++ __func__);
++ vmcs_write32(GUEST_TR_AR_BYTES,
++ (guest_tr_ar & ~VMX_AR_TYPE_MASK)
++ | VMX_AR_TYPE_BUSY_64_TSS);
++ }
++ vmx_set_efer(vcpu, vcpu->arch.efer | EFER_LMA);
++}
++
++static void exit_lmode(struct kvm_vcpu *vcpu)
++{
++ vm_entry_controls_clearbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
++ vmx_set_efer(vcpu, vcpu->arch.efer & ~EFER_LMA);
++}
++
++#endif
++
++static void vmx_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t addr)
++{
++ int vpid = to_vmx(vcpu)->vpid;
++
++ if (!vpid_sync_vcpu_addr(vpid, addr))
++ vpid_sync_context(vpid);
++
++ /*
++ * If VPIDs are not supported or enabled, then the above is a no-op.
++ * But we don't really need a TLB flush in that case anyway, because
++ * each VM entry/exit includes an implicit flush when VPID is 0.
++ */
++}
++
++static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
++{
++ ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits;
++
++ vcpu->arch.cr0 &= ~cr0_guest_owned_bits;
++ vcpu->arch.cr0 |= vmcs_readl(GUEST_CR0) & cr0_guest_owned_bits;
++}
++
++static void vmx_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
++{
++ ulong cr4_guest_owned_bits = vcpu->arch.cr4_guest_owned_bits;
++
++ vcpu->arch.cr4 &= ~cr4_guest_owned_bits;
++ vcpu->arch.cr4 |= vmcs_readl(GUEST_CR4) & cr4_guest_owned_bits;
++}
++
++static void ept_load_pdptrs(struct kvm_vcpu *vcpu)
++{
++ struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
++
++ if (!kvm_register_is_dirty(vcpu, VCPU_EXREG_PDPTR))
++ return;
++
++ if (is_pae_paging(vcpu)) {
++ vmcs_write64(GUEST_PDPTR0, mmu->pdptrs[0]);
++ vmcs_write64(GUEST_PDPTR1, mmu->pdptrs[1]);
++ vmcs_write64(GUEST_PDPTR2, mmu->pdptrs[2]);
++ vmcs_write64(GUEST_PDPTR3, mmu->pdptrs[3]);
++ }
++}
++
++void ept_save_pdptrs(struct kvm_vcpu *vcpu)
++{
++ struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
++
++ if (is_pae_paging(vcpu)) {
++ mmu->pdptrs[0] = vmcs_read64(GUEST_PDPTR0);
++ mmu->pdptrs[1] = vmcs_read64(GUEST_PDPTR1);
++ mmu->pdptrs[2] = vmcs_read64(GUEST_PDPTR2);
++ mmu->pdptrs[3] = vmcs_read64(GUEST_PDPTR3);
++ }
++
++ kvm_register_mark_dirty(vcpu, VCPU_EXREG_PDPTR);
++}
++
++static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
++ unsigned long cr0,
++ struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (!kvm_register_is_available(vcpu, VCPU_EXREG_CR3))
++ vmx_cache_reg(vcpu, VCPU_EXREG_CR3);
++ if (!(cr0 & X86_CR0_PG)) {
++ /* From paging/starting to nonpaging */
++ exec_controls_setbit(vmx, CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_CR3_STORE_EXITING);
++ vcpu->arch.cr0 = cr0;
++ vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
++ } else if (!is_paging(vcpu)) {
++ /* From nonpaging to paging */
++ exec_controls_clearbit(vmx, CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_CR3_STORE_EXITING);
++ vcpu->arch.cr0 = cr0;
++ vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
++ }
++
++ if (!(cr0 & X86_CR0_WP))
++ *hw_cr0 &= ~X86_CR0_WP;
++}
++
++void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long hw_cr0;
++
++ hw_cr0 = (cr0 & ~KVM_VM_CR0_ALWAYS_OFF);
++ if (enable_unrestricted_guest)
++ hw_cr0 |= KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST;
++ else {
++ hw_cr0 |= KVM_VM_CR0_ALWAYS_ON;
++
++ if (vmx->rmode.vm86_active && (cr0 & X86_CR0_PE))
++ enter_pmode(vcpu);
++
++ if (!vmx->rmode.vm86_active && !(cr0 & X86_CR0_PE))
++ enter_rmode(vcpu);
++ }
++
++#ifdef CONFIG_X86_64
++ if (vcpu->arch.efer & EFER_LME) {
++ if (!is_paging(vcpu) && (cr0 & X86_CR0_PG))
++ enter_lmode(vcpu);
++ if (is_paging(vcpu) && !(cr0 & X86_CR0_PG))
++ exit_lmode(vcpu);
++ }
++#endif
++
++ if (enable_ept && !enable_unrestricted_guest)
++ ept_update_paging_mode_cr0(&hw_cr0, cr0, vcpu);
++
++ vmcs_writel(CR0_READ_SHADOW, cr0);
++ vmcs_writel(GUEST_CR0, hw_cr0);
++ vcpu->arch.cr0 = cr0;
++
++ /* depends on vcpu->arch.cr0 to be set to a new value */
++ vmx->emulation_required = emulation_required(vcpu);
++}
++
++static int get_ept_level(struct kvm_vcpu *vcpu)
++{
++ if (cpu_has_vmx_ept_5levels() && (cpuid_maxphyaddr(vcpu) > 48))
++ return 5;
++ return 4;
++}
++
++u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa)
++{
++ u64 eptp = VMX_EPTP_MT_WB;
++
++ eptp |= (get_ept_level(vcpu) == 5) ? VMX_EPTP_PWL_5 : VMX_EPTP_PWL_4;
++
++ if (enable_ept_ad_bits &&
++ (!is_guest_mode(vcpu) || nested_ept_ad_enabled(vcpu)))
++ eptp |= VMX_EPTP_AD_ENABLE_BIT;
++ eptp |= (root_hpa & PAGE_MASK);
++
++ return eptp;
++}
++
++void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
++{
++ struct kvm *kvm = vcpu->kvm;
++ bool update_guest_cr3 = true;
++ unsigned long guest_cr3;
++ u64 eptp;
++
++ guest_cr3 = cr3;
++ if (enable_ept) {
++ eptp = construct_eptp(vcpu, cr3);
++ vmcs_write64(EPT_POINTER, eptp);
++
++ if (kvm_x86_ops->tlb_remote_flush) {
++ spin_lock(&to_kvm_vmx(kvm)->ept_pointer_lock);
++ to_vmx(vcpu)->ept_pointer = eptp;
++ to_kvm_vmx(kvm)->ept_pointers_match
++ = EPT_POINTERS_CHECK;
++ spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock);
++ }
++
++ /* Loading vmcs02.GUEST_CR3 is handled by nested VM-Enter. */
++ if (is_guest_mode(vcpu))
++ update_guest_cr3 = false;
++ else if (!enable_unrestricted_guest && !is_paging(vcpu))
++ guest_cr3 = to_kvm_vmx(kvm)->ept_identity_map_addr;
++ else if (test_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail))
++ guest_cr3 = vcpu->arch.cr3;
++ else /* vmcs01.GUEST_CR3 is already up-to-date. */
++ update_guest_cr3 = false;
++ ept_load_pdptrs(vcpu);
++ }
++
++ if (update_guest_cr3)
++ vmcs_writel(GUEST_CR3, guest_cr3);
++}
++
++int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ /*
++ * Pass through host's Machine Check Enable value to hw_cr4, which
++ * is in force while we are in guest mode. Do not let guests control
++ * this bit, even if host CR4.MCE == 0.
++ */
++ unsigned long hw_cr4;
++
++ hw_cr4 = (cr4_read_shadow() & X86_CR4_MCE) | (cr4 & ~X86_CR4_MCE);
++ if (enable_unrestricted_guest)
++ hw_cr4 |= KVM_VM_CR4_ALWAYS_ON_UNRESTRICTED_GUEST;
++ else if (vmx->rmode.vm86_active)
++ hw_cr4 |= KVM_RMODE_VM_CR4_ALWAYS_ON;
++ else
++ hw_cr4 |= KVM_PMODE_VM_CR4_ALWAYS_ON;
++
++ if (!boot_cpu_has(X86_FEATURE_UMIP) && vmx_umip_emulated()) {
++ if (cr4 & X86_CR4_UMIP) {
++ secondary_exec_controls_setbit(vmx, SECONDARY_EXEC_DESC);
++ hw_cr4 &= ~X86_CR4_UMIP;
++ } else if (!is_guest_mode(vcpu) ||
++ !nested_cpu_has2(get_vmcs12(vcpu), SECONDARY_EXEC_DESC)) {
++ secondary_exec_controls_clearbit(vmx, SECONDARY_EXEC_DESC);
++ }
++ }
++
++ if (cr4 & X86_CR4_VMXE) {
++ /*
++ * To use VMXON (and later other VMX instructions), a guest
++ * must first be able to turn on cr4.VMXE (see handle_vmon()).
++ * So basically the check on whether to allow nested VMX
++ * is here. We operate under the default treatment of SMM,
++ * so VMX cannot be enabled under SMM.
++ */
++ if (!nested_vmx_allowed(vcpu) || is_smm(vcpu))
++ return 1;
++ }
++
++ if (vmx->nested.vmxon && !nested_cr4_valid(vcpu, cr4))
++ return 1;
++
++ vcpu->arch.cr4 = cr4;
++
++ if (!enable_unrestricted_guest) {
++ if (enable_ept) {
++ if (!is_paging(vcpu)) {
++ hw_cr4 &= ~X86_CR4_PAE;
++ hw_cr4 |= X86_CR4_PSE;
++ } else if (!(cr4 & X86_CR4_PAE)) {
++ hw_cr4 &= ~X86_CR4_PAE;
++ }
++ }
++
++ /*
++ * SMEP/SMAP/PKU is disabled if CPU is in non-paging mode in
++ * hardware. To emulate this behavior, SMEP/SMAP/PKU needs
++ * to be manually disabled when guest switches to non-paging
++ * mode.
++ *
++ * If !enable_unrestricted_guest, the CPU is always running
++ * with CR0.PG=1 and CR4 needs to be modified.
++ * If enable_unrestricted_guest, the CPU automatically
++ * disables SMEP/SMAP/PKU when the guest sets CR0.PG=0.
++ */
++ if (!is_paging(vcpu))
++ hw_cr4 &= ~(X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE);
++ }
++
++ vmcs_writel(CR4_READ_SHADOW, cr4);
++ vmcs_writel(GUEST_CR4, hw_cr4);
++ return 0;
++}
++
++void vmx_get_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 ar;
++
++ if (vmx->rmode.vm86_active && seg != VCPU_SREG_LDTR) {
++ *var = vmx->rmode.segs[seg];
++ if (seg == VCPU_SREG_TR
++ || var->selector == vmx_read_guest_seg_selector(vmx, seg))
++ return;
++ var->base = vmx_read_guest_seg_base(vmx, seg);
++ var->selector = vmx_read_guest_seg_selector(vmx, seg);
++ return;
++ }
++ var->base = vmx_read_guest_seg_base(vmx, seg);
++ var->limit = vmx_read_guest_seg_limit(vmx, seg);
++ var->selector = vmx_read_guest_seg_selector(vmx, seg);
++ ar = vmx_read_guest_seg_ar(vmx, seg);
++ var->unusable = (ar >> 16) & 1;
++ var->type = ar & 15;
++ var->s = (ar >> 4) & 1;
++ var->dpl = (ar >> 5) & 3;
++ /*
++ * Some userspaces do not preserve unusable property. Since usable
++ * segment has to be present according to VMX spec we can use present
++ * property to amend userspace bug by making unusable segment always
++ * nonpresent. vmx_segment_access_rights() already marks nonpresent
++ * segment as unusable.
++ */
++ var->present = !var->unusable;
++ var->avl = (ar >> 12) & 1;
++ var->l = (ar >> 13) & 1;
++ var->db = (ar >> 14) & 1;
++ var->g = (ar >> 15) & 1;
++}
++
++static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)
++{
++ struct kvm_segment s;
++
++ if (to_vmx(vcpu)->rmode.vm86_active) {
++ vmx_get_segment(vcpu, &s, seg);
++ return s.base;
++ }
++ return vmx_read_guest_seg_base(to_vmx(vcpu), seg);
++}
++
++int vmx_get_cpl(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (unlikely(vmx->rmode.vm86_active))
++ return 0;
++ else {
++ int ar = vmx_read_guest_seg_ar(vmx, VCPU_SREG_SS);
++ return VMX_AR_DPL(ar);
++ }
++}
++
++static u32 vmx_segment_access_rights(struct kvm_segment *var)
++{
++ u32 ar;
++
++ if (var->unusable || !var->present)
++ ar = 1 << 16;
++ else {
++ ar = var->type & 15;
++ ar |= (var->s & 1) << 4;
++ ar |= (var->dpl & 3) << 5;
++ ar |= (var->present & 1) << 7;
++ ar |= (var->avl & 1) << 12;
++ ar |= (var->l & 1) << 13;
++ ar |= (var->db & 1) << 14;
++ ar |= (var->g & 1) << 15;
++ }
++
++ return ar;
++}
++
++void vmx_set_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
++
++ vmx_segment_cache_clear(vmx);
++
++ if (vmx->rmode.vm86_active && seg != VCPU_SREG_LDTR) {
++ vmx->rmode.segs[seg] = *var;
++ if (seg == VCPU_SREG_TR)
++ vmcs_write16(sf->selector, var->selector);
++ else if (var->s)
++ fix_rmode_seg(seg, &vmx->rmode.segs[seg]);
++ goto out;
++ }
++
++ vmcs_writel(sf->base, var->base);
++ vmcs_write32(sf->limit, var->limit);
++ vmcs_write16(sf->selector, var->selector);
++
++ /*
++ * Fix the "Accessed" bit in AR field of segment registers for older
++ * qemu binaries.
++ * IA32 arch specifies that at the time of processor reset the
++ * "Accessed" bit in the AR field of segment registers is 1. And qemu
++ * is setting it to 0 in the userland code. This causes invalid guest
++ * state vmexit when "unrestricted guest" mode is turned on.
++ * Fix for this setup issue in cpu_reset is being pushed in the qemu
++ * tree. Newer qemu binaries with that qemu fix would not need this
++ * kvm hack.
++ */
++ if (enable_unrestricted_guest && (seg != VCPU_SREG_LDTR))
++ var->type |= 0x1; /* Accessed */
++
++ vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(var));
++
++out:
++ vmx->emulation_required = emulation_required(vcpu);
++}
++
++static void vmx_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
++{
++ u32 ar = vmx_read_guest_seg_ar(to_vmx(vcpu), VCPU_SREG_CS);
++
++ *db = (ar >> 14) & 1;
++ *l = (ar >> 13) & 1;
++}
++
++static void vmx_get_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
++{
++ dt->size = vmcs_read32(GUEST_IDTR_LIMIT);
++ dt->address = vmcs_readl(GUEST_IDTR_BASE);
++}
++
++static void vmx_set_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
++{
++ vmcs_write32(GUEST_IDTR_LIMIT, dt->size);
++ vmcs_writel(GUEST_IDTR_BASE, dt->address);
++}
++
++static void vmx_get_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
++{
++ dt->size = vmcs_read32(GUEST_GDTR_LIMIT);
++ dt->address = vmcs_readl(GUEST_GDTR_BASE);
++}
++
++static void vmx_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
++{
++ vmcs_write32(GUEST_GDTR_LIMIT, dt->size);
++ vmcs_writel(GUEST_GDTR_BASE, dt->address);
++}
++
++static bool rmode_segment_valid(struct kvm_vcpu *vcpu, int seg)
++{
++ struct kvm_segment var;
++ u32 ar;
++
++ vmx_get_segment(vcpu, &var, seg);
++ var.dpl = 0x3;
++ if (seg == VCPU_SREG_CS)
++ var.type = 0x3;
++ ar = vmx_segment_access_rights(&var);
++
++ if (var.base != (var.selector << 4))
++ return false;
++ if (var.limit != 0xffff)
++ return false;
++ if (ar != 0xf3)
++ return false;
++
++ return true;
++}
++
++static bool code_segment_valid(struct kvm_vcpu *vcpu)
++{
++ struct kvm_segment cs;
++ unsigned int cs_rpl;
++
++ vmx_get_segment(vcpu, &cs, VCPU_SREG_CS);
++ cs_rpl = cs.selector & SEGMENT_RPL_MASK;
++
++ if (cs.unusable)
++ return false;
++ if (~cs.type & (VMX_AR_TYPE_CODE_MASK|VMX_AR_TYPE_ACCESSES_MASK))
++ return false;
++ if (!cs.s)
++ return false;
++ if (cs.type & VMX_AR_TYPE_WRITEABLE_MASK) {
++ if (cs.dpl > cs_rpl)
++ return false;
++ } else {
++ if (cs.dpl != cs_rpl)
++ return false;
++ }
++ if (!cs.present)
++ return false;
++
++ /* TODO: Add Reserved field check, this'll require a new member in the kvm_segment_field structure */
++ return true;
++}
++
++static bool stack_segment_valid(struct kvm_vcpu *vcpu)
++{
++ struct kvm_segment ss;
++ unsigned int ss_rpl;
++
++ vmx_get_segment(vcpu, &ss, VCPU_SREG_SS);
++ ss_rpl = ss.selector & SEGMENT_RPL_MASK;
++
++ if (ss.unusable)
++ return true;
++ if (ss.type != 3 && ss.type != 7)
++ return false;
++ if (!ss.s)
++ return false;
++ if (ss.dpl != ss_rpl) /* DPL != RPL */
++ return false;
++ if (!ss.present)
++ return false;
++
++ return true;
++}
++
++static bool data_segment_valid(struct kvm_vcpu *vcpu, int seg)
++{
++ struct kvm_segment var;
++ unsigned int rpl;
++
++ vmx_get_segment(vcpu, &var, seg);
++ rpl = var.selector & SEGMENT_RPL_MASK;
++
++ if (var.unusable)
++ return true;
++ if (!var.s)
++ return false;
++ if (!var.present)
++ return false;
++ if (~var.type & (VMX_AR_TYPE_CODE_MASK|VMX_AR_TYPE_WRITEABLE_MASK)) {
++ if (var.dpl < rpl) /* DPL < RPL */
++ return false;
++ }
++
++ /* TODO: Add other members to kvm_segment_field to allow checking for other access
++ * rights flags
++ */
++ return true;
++}
++
++static bool tr_valid(struct kvm_vcpu *vcpu)
++{
++ struct kvm_segment tr;
++
++ vmx_get_segment(vcpu, &tr, VCPU_SREG_TR);
++
++ if (tr.unusable)
++ return false;
++ if (tr.selector & SEGMENT_TI_MASK) /* TI = 1 */
++ return false;
++ if (tr.type != 3 && tr.type != 11) /* TODO: Check if guest is in IA32e mode */
++ return false;
++ if (!tr.present)
++ return false;
++
++ return true;
++}
++
++static bool ldtr_valid(struct kvm_vcpu *vcpu)
++{
++ struct kvm_segment ldtr;
++
++ vmx_get_segment(vcpu, &ldtr, VCPU_SREG_LDTR);
++
++ if (ldtr.unusable)
++ return true;
++ if (ldtr.selector & SEGMENT_TI_MASK) /* TI = 1 */
++ return false;
++ if (ldtr.type != 2)
++ return false;
++ if (!ldtr.present)
++ return false;
++
++ return true;
++}
++
++static bool cs_ss_rpl_check(struct kvm_vcpu *vcpu)
++{
++ struct kvm_segment cs, ss;
++
++ vmx_get_segment(vcpu, &cs, VCPU_SREG_CS);
++ vmx_get_segment(vcpu, &ss, VCPU_SREG_SS);
++
++ return ((cs.selector & SEGMENT_RPL_MASK) ==
++ (ss.selector & SEGMENT_RPL_MASK));
++}
++
++/*
++ * Check if guest state is valid. Returns true if valid, false if
++ * not.
++ * We assume that registers are always usable
++ */
++static bool guest_state_valid(struct kvm_vcpu *vcpu)
++{
++ if (enable_unrestricted_guest)
++ return true;
++
++ /* real mode guest state checks */
++ if (!is_protmode(vcpu) || (vmx_get_rflags(vcpu) & X86_EFLAGS_VM)) {
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_CS))
++ return false;
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_SS))
++ return false;
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_DS))
++ return false;
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_ES))
++ return false;
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_FS))
++ return false;
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_GS))
++ return false;
++ } else {
++ /* protected mode guest state checks */
++ if (!cs_ss_rpl_check(vcpu))
++ return false;
++ if (!code_segment_valid(vcpu))
++ return false;
++ if (!stack_segment_valid(vcpu))
++ return false;
++ if (!data_segment_valid(vcpu, VCPU_SREG_DS))
++ return false;
++ if (!data_segment_valid(vcpu, VCPU_SREG_ES))
++ return false;
++ if (!data_segment_valid(vcpu, VCPU_SREG_FS))
++ return false;
++ if (!data_segment_valid(vcpu, VCPU_SREG_GS))
++ return false;
++ if (!tr_valid(vcpu))
++ return false;
++ if (!ldtr_valid(vcpu))
++ return false;
++ }
++ /* TODO:
++ * - Add checks on RIP
++ * - Add checks on RFLAGS
++ */
++
++ return true;
++}
++
++static int init_rmode_tss(struct kvm *kvm)
++{
++ gfn_t fn;
++ u16 data = 0;
++ int idx, r;
++
++ idx = srcu_read_lock(&kvm->srcu);
++ fn = to_kvm_vmx(kvm)->tss_addr >> PAGE_SHIFT;
++ r = kvm_clear_guest_page(kvm, fn, 0, PAGE_SIZE);
++ if (r < 0)
++ goto out;
++ data = TSS_BASE_SIZE + TSS_REDIRECTION_SIZE;
++ r = kvm_write_guest_page(kvm, fn++, &data,
++ TSS_IOPB_BASE_OFFSET, sizeof(u16));
++ if (r < 0)
++ goto out;
++ r = kvm_clear_guest_page(kvm, fn++, 0, PAGE_SIZE);
++ if (r < 0)
++ goto out;
++ r = kvm_clear_guest_page(kvm, fn, 0, PAGE_SIZE);
++ if (r < 0)
++ goto out;
++ data = ~0;
++ r = kvm_write_guest_page(kvm, fn, &data,
++ RMODE_TSS_SIZE - 2 * PAGE_SIZE - 1,
++ sizeof(u8));
++out:
++ srcu_read_unlock(&kvm->srcu, idx);
++ return r;
++}
++
++static int init_rmode_identity_map(struct kvm *kvm)
++{
++ struct kvm_vmx *kvm_vmx = to_kvm_vmx(kvm);
++ int i, idx, r = 0;
++ kvm_pfn_t identity_map_pfn;
++ u32 tmp;
++
++ /* Protect kvm_vmx->ept_identity_pagetable_done. */
++ mutex_lock(&kvm->slots_lock);
++
++ if (likely(kvm_vmx->ept_identity_pagetable_done))
++ goto out2;
++
++ if (!kvm_vmx->ept_identity_map_addr)
++ kvm_vmx->ept_identity_map_addr = VMX_EPT_IDENTITY_PAGETABLE_ADDR;
++ identity_map_pfn = kvm_vmx->ept_identity_map_addr >> PAGE_SHIFT;
++
++ r = __x86_set_memory_region(kvm, IDENTITY_PAGETABLE_PRIVATE_MEMSLOT,
++ kvm_vmx->ept_identity_map_addr, PAGE_SIZE);
++ if (r < 0)
++ goto out2;
++
++ idx = srcu_read_lock(&kvm->srcu);
++ r = kvm_clear_guest_page(kvm, identity_map_pfn, 0, PAGE_SIZE);
++ if (r < 0)
++ goto out;
++ /* Set up identity-mapping pagetable for EPT in real mode */
++ for (i = 0; i < PT32_ENT_PER_PAGE; i++) {
++ tmp = (i << 22) + (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER |
++ _PAGE_ACCESSED | _PAGE_DIRTY | _PAGE_PSE);
++ r = kvm_write_guest_page(kvm, identity_map_pfn,
++ &tmp, i * sizeof(tmp), sizeof(tmp));
++ if (r < 0)
++ goto out;
++ }
++ kvm_vmx->ept_identity_pagetable_done = true;
++
++out:
++ srcu_read_unlock(&kvm->srcu, idx);
++
++out2:
++ mutex_unlock(&kvm->slots_lock);
++ return r;
++}
++
++static void seg_setup(int seg)
++{
++ const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
++ unsigned int ar;
++
++ vmcs_write16(sf->selector, 0);
++ vmcs_writel(sf->base, 0);
++ vmcs_write32(sf->limit, 0xffff);
++ ar = 0x93;
++ if (seg == VCPU_SREG_CS)
++ ar |= 0x08; /* code segment */
++
++ vmcs_write32(sf->ar_bytes, ar);
++}
++
++static int alloc_apic_access_page(struct kvm *kvm)
++{
++ struct page *page;
++ int r = 0;
++
++ mutex_lock(&kvm->slots_lock);
++ if (kvm->arch.apic_access_page_done)
++ goto out;
++ r = __x86_set_memory_region(kvm, APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
++ APIC_DEFAULT_PHYS_BASE, PAGE_SIZE);
++ if (r)
++ goto out;
++
++ page = gfn_to_page(kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT);
++ if (is_error_page(page)) {
++ r = -EFAULT;
++ goto out;
++ }
++
++ /*
++ * Do not pin the page in memory, so that memory hot-unplug
++ * is able to migrate it.
++ */
++ put_page(page);
++ kvm->arch.apic_access_page_done = true;
++out:
++ mutex_unlock(&kvm->slots_lock);
++ return r;
++}
++
++int allocate_vpid(void)
++{
++ int vpid;
++
++ if (!enable_vpid)
++ return 0;
++ spin_lock(&vmx_vpid_lock);
++ vpid = find_first_zero_bit(vmx_vpid_bitmap, VMX_NR_VPIDS);
++ if (vpid < VMX_NR_VPIDS)
++ __set_bit(vpid, vmx_vpid_bitmap);
++ else
++ vpid = 0;
++ spin_unlock(&vmx_vpid_lock);
++ return vpid;
++}
++
++void free_vpid(int vpid)
++{
++ if (!enable_vpid || vpid == 0)
++ return;
++ spin_lock(&vmx_vpid_lock);
++ __clear_bit(vpid, vmx_vpid_bitmap);
++ spin_unlock(&vmx_vpid_lock);
++}
++
++static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
++ u32 msr, int type)
++{
++ int f = sizeof(unsigned long);
++
++ if (!cpu_has_vmx_msr_bitmap())
++ return;
++
++ if (static_branch_unlikely(&enable_evmcs))
++ evmcs_touch_msr_bitmap();
++
++ /*
++ * See Intel PRM Vol. 3, 20.6.9 (MSR-Bitmap Address). Early manuals
++ * have the write-low and read-high bitmap offsets the wrong way round.
++ * We can control MSRs 0x00000000-0x00001fff and 0xc0000000-0xc0001fff.
++ */
++ if (msr <= 0x1fff) {
++ if (type & MSR_TYPE_R)
++ /* read-low */
++ __clear_bit(msr, msr_bitmap + 0x000 / f);
++
++ if (type & MSR_TYPE_W)
++ /* write-low */
++ __clear_bit(msr, msr_bitmap + 0x800 / f);
++
++ } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
++ msr &= 0x1fff;
++ if (type & MSR_TYPE_R)
++ /* read-high */
++ __clear_bit(msr, msr_bitmap + 0x400 / f);
++
++ if (type & MSR_TYPE_W)
++ /* write-high */
++ __clear_bit(msr, msr_bitmap + 0xc00 / f);
++
++ }
++}
++
++static __always_inline void vmx_enable_intercept_for_msr(unsigned long *msr_bitmap,
++ u32 msr, int type)
++{
++ int f = sizeof(unsigned long);
++
++ if (!cpu_has_vmx_msr_bitmap())
++ return;
++
++ if (static_branch_unlikely(&enable_evmcs))
++ evmcs_touch_msr_bitmap();
++
++ /*
++ * See Intel PRM Vol. 3, 20.6.9 (MSR-Bitmap Address). Early manuals
++ * have the write-low and read-high bitmap offsets the wrong way round.
++ * We can control MSRs 0x00000000-0x00001fff and 0xc0000000-0xc0001fff.
++ */
++ if (msr <= 0x1fff) {
++ if (type & MSR_TYPE_R)
++ /* read-low */
++ __set_bit(msr, msr_bitmap + 0x000 / f);
++
++ if (type & MSR_TYPE_W)
++ /* write-low */
++ __set_bit(msr, msr_bitmap + 0x800 / f);
++
++ } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
++ msr &= 0x1fff;
++ if (type & MSR_TYPE_R)
++ /* read-high */
++ __set_bit(msr, msr_bitmap + 0x400 / f);
++
++ if (type & MSR_TYPE_W)
++ /* write-high */
++ __set_bit(msr, msr_bitmap + 0xc00 / f);
++
++ }
++}
++
++static __always_inline void vmx_set_intercept_for_msr(unsigned long *msr_bitmap,
++ u32 msr, int type, bool value)
++{
++ if (value)
++ vmx_enable_intercept_for_msr(msr_bitmap, msr, type);
++ else
++ vmx_disable_intercept_for_msr(msr_bitmap, msr, type);
++}
++
++static u8 vmx_msr_bitmap_mode(struct kvm_vcpu *vcpu)
++{
++ u8 mode = 0;
++
++ if (cpu_has_secondary_exec_ctrls() &&
++ (secondary_exec_controls_get(to_vmx(vcpu)) &
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE)) {
++ mode |= MSR_BITMAP_MODE_X2APIC;
++ if (enable_apicv && kvm_vcpu_apicv_active(vcpu))
++ mode |= MSR_BITMAP_MODE_X2APIC_APICV;
++ }
++
++ return mode;
++}
++
++static void vmx_update_msr_bitmap_x2apic(unsigned long *msr_bitmap,
++ u8 mode)
++{
++ int msr;
++
++ for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
++ unsigned word = msr / BITS_PER_LONG;
++ msr_bitmap[word] = (mode & MSR_BITMAP_MODE_X2APIC_APICV) ? 0 : ~0;
++ msr_bitmap[word + (0x800 / sizeof(long))] = ~0;
++ }
++
++ if (mode & MSR_BITMAP_MODE_X2APIC) {
++ /*
++ * TPR reads and writes can be virtualized even if virtual interrupt
++ * delivery is not in use.
++ */
++ vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_TASKPRI), MSR_TYPE_RW);
++ if (mode & MSR_BITMAP_MODE_X2APIC_APICV) {
++ vmx_enable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_TMCCT), MSR_TYPE_R);
++ vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_EOI), MSR_TYPE_W);
++ vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_SELF_IPI), MSR_TYPE_W);
++ }
++ }
++}
++
++void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long *msr_bitmap = vmx->vmcs01.msr_bitmap;
++ u8 mode = vmx_msr_bitmap_mode(vcpu);
++ u8 changed = mode ^ vmx->msr_bitmap_mode;
++
++ if (!changed)
++ return;
++
++ if (changed & (MSR_BITMAP_MODE_X2APIC | MSR_BITMAP_MODE_X2APIC_APICV))
++ vmx_update_msr_bitmap_x2apic(msr_bitmap, mode);
++
++ vmx->msr_bitmap_mode = mode;
++}
++
++void pt_update_intercept_for_msr(struct vcpu_vmx *vmx)
++{
++ unsigned long *msr_bitmap = vmx->vmcs01.msr_bitmap;
++ bool flag = !(vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN);
++ u32 i;
++
++ vmx_set_intercept_for_msr(msr_bitmap, MSR_IA32_RTIT_STATUS,
++ MSR_TYPE_RW, flag);
++ vmx_set_intercept_for_msr(msr_bitmap, MSR_IA32_RTIT_OUTPUT_BASE,
++ MSR_TYPE_RW, flag);
++ vmx_set_intercept_for_msr(msr_bitmap, MSR_IA32_RTIT_OUTPUT_MASK,
++ MSR_TYPE_RW, flag);
++ vmx_set_intercept_for_msr(msr_bitmap, MSR_IA32_RTIT_CR3_MATCH,
++ MSR_TYPE_RW, flag);
++ for (i = 0; i < vmx->pt_desc.addr_range; i++) {
++ vmx_set_intercept_for_msr(msr_bitmap,
++ MSR_IA32_RTIT_ADDR0_A + i * 2, MSR_TYPE_RW, flag);
++ vmx_set_intercept_for_msr(msr_bitmap,
++ MSR_IA32_RTIT_ADDR0_B + i * 2, MSR_TYPE_RW, flag);
++ }
++}
++
++static bool vmx_get_enable_apicv(struct kvm *kvm)
++{
++ return enable_apicv;
++}
++
++static bool vmx_guest_apic_has_interrupt(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ void *vapic_page;
++ u32 vppr;
++ int rvi;
++
++ if (WARN_ON_ONCE(!is_guest_mode(vcpu)) ||
++ !nested_cpu_has_vid(get_vmcs12(vcpu)) ||
++ WARN_ON_ONCE(!vmx->nested.virtual_apic_map.gfn))
++ return false;
++
++ rvi = vmx_get_rvi();
++
++ vapic_page = vmx->nested.virtual_apic_map.hva;
++ vppr = *((u32 *)(vapic_page + APIC_PROCPRI));
++
++ return ((rvi & 0xf0) > (vppr & 0xf0));
++}
++
++static inline bool kvm_vcpu_trigger_posted_interrupt(struct kvm_vcpu *vcpu,
++ bool nested)
++{
++#ifdef CONFIG_SMP
++ int pi_vec = nested ? POSTED_INTR_NESTED_VECTOR : POSTED_INTR_VECTOR;
++
++ if (vcpu->mode == IN_GUEST_MODE) {
++ /*
++ * The vector of interrupt to be delivered to vcpu had
++ * been set in PIR before this function.
++ *
++ * Following cases will be reached in this block, and
++ * we always send a notification event in all cases as
++ * explained below.
++ *
++ * Case 1: vcpu keeps in non-root mode. Sending a
++ * notification event posts the interrupt to vcpu.
++ *
++ * Case 2: vcpu exits to root mode and is still
++ * runnable. PIR will be synced to vIRR before the
++ * next vcpu entry. Sending a notification event in
++ * this case has no effect, as vcpu is not in root
++ * mode.
++ *
++ * Case 3: vcpu exits to root mode and is blocked.
++ * vcpu_block() has already synced PIR to vIRR and
++ * never blocks vcpu if vIRR is not cleared. Therefore,
++ * a blocked vcpu here does not wait for any requested
++ * interrupts in PIR, and sending a notification event
++ * which has no effect is safe here.
++ */
++
++ apic->send_IPI_mask(get_cpu_mask(vcpu->cpu), pi_vec);
++ return true;
++ }
++#endif
++ return false;
++}
++
++static int vmx_deliver_nested_posted_interrupt(struct kvm_vcpu *vcpu,
++ int vector)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (is_guest_mode(vcpu) &&
++ vector == vmx->nested.posted_intr_nv) {
++ /*
++ * If a posted intr is not recognized by hardware,
++ * we will accomplish it in the next vmentry.
++ */
++ vmx->nested.pi_pending = true;
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
++ /* the PIR and ON have been set by L1. */
++ if (!kvm_vcpu_trigger_posted_interrupt(vcpu, true))
++ kvm_vcpu_kick(vcpu);
++ return 0;
++ }
++ return -1;
++}
++/*
++ * Send interrupt to vcpu via posted interrupt way.
++ * 1. If target vcpu is running(non-root mode), send posted interrupt
++ * notification to vcpu and hardware will sync PIR to vIRR atomically.
++ * 2. If target vcpu isn't running(root mode), kick it to pick up the
++ * interrupt from PIR in next vmentry.
++ */
++static void vmx_deliver_posted_interrupt(struct kvm_vcpu *vcpu, int vector)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int r;
++
++ r = vmx_deliver_nested_posted_interrupt(vcpu, vector);
++ if (!r)
++ return;
++
++ if (pi_test_and_set_pir(vector, &vmx->pi_desc))
++ return;
++
++ /* If a previous notification has sent the IPI, nothing to do. */
++ if (pi_test_and_set_on(&vmx->pi_desc))
++ return;
++
++ if (!kvm_vcpu_trigger_posted_interrupt(vcpu, false))
++ kvm_vcpu_kick(vcpu);
++}
++
++/*
++ * Set up the vmcs's constant host-state fields, i.e., host-state fields that
++ * will not change in the lifetime of the guest.
++ * Note that host-state that does change is set elsewhere. E.g., host-state
++ * that is set differently for each CPU is set in vmx_vcpu_load(), not here.
++ */
++void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
++{
++ u32 low32, high32;
++ unsigned long tmpl;
++ unsigned long cr0, cr3, cr4;
++
++ cr0 = read_cr0();
++ WARN_ON(cr0 & X86_CR0_TS);
++ vmcs_writel(HOST_CR0, cr0); /* 22.2.3 */
++
++ /*
++ * Save the most likely value for this task's CR3 in the VMCS.
++ * We can't use __get_current_cr3_fast() because we're not atomic.
++ */
++ cr3 = __read_cr3();
++ vmcs_writel(HOST_CR3, cr3); /* 22.2.3 FIXME: shadow tables */
++ vmx->loaded_vmcs->host_state.cr3 = cr3;
++
++ /* Save the most likely value for this task's CR4 in the VMCS. */
++ cr4 = cr4_read_shadow();
++ vmcs_writel(HOST_CR4, cr4); /* 22.2.3, 22.2.5 */
++ vmx->loaded_vmcs->host_state.cr4 = cr4;
++
++ vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */
++#ifdef CONFIG_X86_64
++ /*
++ * Load null selectors, so we can avoid reloading them in
++ * vmx_prepare_switch_to_host(), in case userspace uses
++ * the null selectors too (the expected case).
++ */
++ vmcs_write16(HOST_DS_SELECTOR, 0);
++ vmcs_write16(HOST_ES_SELECTOR, 0);
++#else
++ vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
++ vmcs_write16(HOST_ES_SELECTOR, __KERNEL_DS); /* 22.2.4 */
++#endif
++ vmcs_write16(HOST_SS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
++ vmcs_write16(HOST_TR_SELECTOR, GDT_ENTRY_TSS*8); /* 22.2.4 */
++
++ vmcs_writel(HOST_IDTR_BASE, host_idt_base); /* 22.2.4 */
++
++ vmcs_writel(HOST_RIP, (unsigned long)vmx_vmexit); /* 22.2.5 */
++
++ rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
++ vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
++ rdmsrl(MSR_IA32_SYSENTER_EIP, tmpl);
++ vmcs_writel(HOST_IA32_SYSENTER_EIP, tmpl); /* 22.2.3 */
++
++ if (vmcs_config.vmexit_ctrl & VM_EXIT_LOAD_IA32_PAT) {
++ rdmsr(MSR_IA32_CR_PAT, low32, high32);
++ vmcs_write64(HOST_IA32_PAT, low32 | ((u64) high32 << 32));
++ }
++
++ if (cpu_has_load_ia32_efer())
++ vmcs_write64(HOST_IA32_EFER, host_efer);
++}
++
++void set_cr4_guest_host_mask(struct vcpu_vmx *vmx)
++{
++ vmx->vcpu.arch.cr4_guest_owned_bits = KVM_CR4_GUEST_OWNED_BITS;
++ if (enable_ept)
++ vmx->vcpu.arch.cr4_guest_owned_bits |= X86_CR4_PGE;
++ if (is_guest_mode(&vmx->vcpu))
++ vmx->vcpu.arch.cr4_guest_owned_bits &=
++ ~get_vmcs12(&vmx->vcpu)->cr4_guest_host_mask;
++ vmcs_writel(CR4_GUEST_HOST_MASK, ~vmx->vcpu.arch.cr4_guest_owned_bits);
++}
++
++u32 vmx_pin_based_exec_ctrl(struct vcpu_vmx *vmx)
++{
++ u32 pin_based_exec_ctrl = vmcs_config.pin_based_exec_ctrl;
++
++ if (!kvm_vcpu_apicv_active(&vmx->vcpu))
++ pin_based_exec_ctrl &= ~PIN_BASED_POSTED_INTR;
++
++ if (!enable_vnmi)
++ pin_based_exec_ctrl &= ~PIN_BASED_VIRTUAL_NMIS;
++
++ if (!enable_preemption_timer)
++ pin_based_exec_ctrl &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
++
++ return pin_based_exec_ctrl;
++}
++
++static void vmx_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ pin_controls_set(vmx, vmx_pin_based_exec_ctrl(vmx));
++ if (cpu_has_secondary_exec_ctrls()) {
++ if (kvm_vcpu_apicv_active(vcpu))
++ secondary_exec_controls_setbit(vmx,
++ SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
++ else
++ secondary_exec_controls_clearbit(vmx,
++ SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
++ }
++
++ if (cpu_has_vmx_msr_bitmap())
++ vmx_update_msr_bitmap(vcpu);
++}
++
++u32 vmx_exec_control(struct vcpu_vmx *vmx)
++{
++ u32 exec_control = vmcs_config.cpu_based_exec_ctrl;
++
++ if (vmx->vcpu.arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)
++ exec_control &= ~CPU_BASED_MOV_DR_EXITING;
++
++ if (!cpu_need_tpr_shadow(&vmx->vcpu)) {
++ exec_control &= ~CPU_BASED_TPR_SHADOW;
++#ifdef CONFIG_X86_64
++ exec_control |= CPU_BASED_CR8_STORE_EXITING |
++ CPU_BASED_CR8_LOAD_EXITING;
++#endif
++ }
++ if (!enable_ept)
++ exec_control |= CPU_BASED_CR3_STORE_EXITING |
++ CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_INVLPG_EXITING;
++ if (kvm_mwait_in_guest(vmx->vcpu.kvm))
++ exec_control &= ~(CPU_BASED_MWAIT_EXITING |
++ CPU_BASED_MONITOR_EXITING);
++ if (kvm_hlt_in_guest(vmx->vcpu.kvm))
++ exec_control &= ~CPU_BASED_HLT_EXITING;
++ return exec_control;
++}
++
++
++static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx)
++{
++ struct kvm_vcpu *vcpu = &vmx->vcpu;
++
++ u32 exec_control = vmcs_config.cpu_based_2nd_exec_ctrl;
++
++ if (pt_mode == PT_MODE_SYSTEM)
++ exec_control &= ~(SECONDARY_EXEC_PT_USE_GPA | SECONDARY_EXEC_PT_CONCEAL_VMX);
++ if (!cpu_need_virtualize_apic_accesses(vcpu))
++ exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
++ if (vmx->vpid == 0)
++ exec_control &= ~SECONDARY_EXEC_ENABLE_VPID;
++ if (!enable_ept) {
++ exec_control &= ~SECONDARY_EXEC_ENABLE_EPT;
++ enable_unrestricted_guest = 0;
++ }
++ if (!enable_unrestricted_guest)
++ exec_control &= ~SECONDARY_EXEC_UNRESTRICTED_GUEST;
++ if (kvm_pause_in_guest(vmx->vcpu.kvm))
++ exec_control &= ~SECONDARY_EXEC_PAUSE_LOOP_EXITING;
++ if (!kvm_vcpu_apicv_active(vcpu))
++ exec_control &= ~(SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
++ exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
++
++ /* SECONDARY_EXEC_DESC is enabled/disabled on writes to CR4.UMIP,
++ * in vmx_set_cr4. */
++ exec_control &= ~SECONDARY_EXEC_DESC;
++
++ /* SECONDARY_EXEC_SHADOW_VMCS is enabled when L1 executes VMPTRLD
++ (handle_vmptrld).
++ We can NOT enable shadow_vmcs here because we don't have yet
++ a current VMCS12
++ */
++ exec_control &= ~SECONDARY_EXEC_SHADOW_VMCS;
++
++ if (!enable_pml)
++ exec_control &= ~SECONDARY_EXEC_ENABLE_PML;
++
++ if (vmx_xsaves_supported()) {
++ /* Exposing XSAVES only when XSAVE is exposed */
++ bool xsaves_enabled =
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVES);
++
++ vcpu->arch.xsaves_enabled = xsaves_enabled;
++
++ if (!xsaves_enabled)
++ exec_control &= ~SECONDARY_EXEC_XSAVES;
++
++ if (nested) {
++ if (xsaves_enabled)
++ vmx->nested.msrs.secondary_ctls_high |=
++ SECONDARY_EXEC_XSAVES;
++ else
++ vmx->nested.msrs.secondary_ctls_high &=
++ ~SECONDARY_EXEC_XSAVES;
++ }
++ }
++
++ if (vmx_rdtscp_supported()) {
++ bool rdtscp_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP);
++ if (!rdtscp_enabled)
++ exec_control &= ~SECONDARY_EXEC_RDTSCP;
++
++ if (nested) {
++ if (rdtscp_enabled)
++ vmx->nested.msrs.secondary_ctls_high |=
++ SECONDARY_EXEC_RDTSCP;
++ else
++ vmx->nested.msrs.secondary_ctls_high &=
++ ~SECONDARY_EXEC_RDTSCP;
++ }
++ }
++
++ if (vmx_invpcid_supported()) {
++ /* Exposing INVPCID only when PCID is exposed */
++ bool invpcid_enabled =
++ guest_cpuid_has(vcpu, X86_FEATURE_INVPCID) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_PCID);
++
++ if (!invpcid_enabled) {
++ exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
++ guest_cpuid_clear(vcpu, X86_FEATURE_INVPCID);
++ }
++
++ if (nested) {
++ if (invpcid_enabled)
++ vmx->nested.msrs.secondary_ctls_high |=
++ SECONDARY_EXEC_ENABLE_INVPCID;
++ else
++ vmx->nested.msrs.secondary_ctls_high &=
++ ~SECONDARY_EXEC_ENABLE_INVPCID;
++ }
++ }
++
++ if (vmx_rdrand_supported()) {
++ bool rdrand_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDRAND);
++ if (rdrand_enabled)
++ exec_control &= ~SECONDARY_EXEC_RDRAND_EXITING;
++
++ if (nested) {
++ if (rdrand_enabled)
++ vmx->nested.msrs.secondary_ctls_high |=
++ SECONDARY_EXEC_RDRAND_EXITING;
++ else
++ vmx->nested.msrs.secondary_ctls_high &=
++ ~SECONDARY_EXEC_RDRAND_EXITING;
++ }
++ }
++
++ if (vmx_rdseed_supported()) {
++ bool rdseed_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDSEED);
++ if (rdseed_enabled)
++ exec_control &= ~SECONDARY_EXEC_RDSEED_EXITING;
++
++ if (nested) {
++ if (rdseed_enabled)
++ vmx->nested.msrs.secondary_ctls_high |=
++ SECONDARY_EXEC_RDSEED_EXITING;
++ else
++ vmx->nested.msrs.secondary_ctls_high &=
++ ~SECONDARY_EXEC_RDSEED_EXITING;
++ }
++ }
++
++ if (vmx_waitpkg_supported()) {
++ bool waitpkg_enabled =
++ guest_cpuid_has(vcpu, X86_FEATURE_WAITPKG);
++
++ if (!waitpkg_enabled)
++ exec_control &= ~SECONDARY_EXEC_ENABLE_USR_WAIT_PAUSE;
++
++ if (nested) {
++ if (waitpkg_enabled)
++ vmx->nested.msrs.secondary_ctls_high |=
++ SECONDARY_EXEC_ENABLE_USR_WAIT_PAUSE;
++ else
++ vmx->nested.msrs.secondary_ctls_high &=
++ ~SECONDARY_EXEC_ENABLE_USR_WAIT_PAUSE;
++ }
++ }
++
++ vmx->secondary_exec_control = exec_control;
++}
++
++static void ept_set_mmio_spte_mask(void)
++{
++ /*
++ * EPT Misconfigurations can be generated if the value of bits 2:0
++ * of an EPT paging-structure entry is 110b (write/execute).
++ */
++ kvm_mmu_set_mmio_spte_mask(VMX_EPT_RWX_MASK,
++ VMX_EPT_MISCONFIG_WX_VALUE, 0);
++}
++
++#define VMX_XSS_EXIT_BITMAP 0
++
++/*
++ * Noting that the initialization of Guest-state Area of VMCS is in
++ * vmx_vcpu_reset().
++ */
++static void init_vmcs(struct vcpu_vmx *vmx)
++{
++ if (nested)
++ nested_vmx_set_vmcs_shadowing_bitmap();
++
++ if (cpu_has_vmx_msr_bitmap())
++ vmcs_write64(MSR_BITMAP, __pa(vmx->vmcs01.msr_bitmap));
++
++ vmcs_write64(VMCS_LINK_POINTER, -1ull); /* 22.3.1.5 */
++
++ /* Control */
++ pin_controls_set(vmx, vmx_pin_based_exec_ctrl(vmx));
++
++ exec_controls_set(vmx, vmx_exec_control(vmx));
++
++ if (cpu_has_secondary_exec_ctrls()) {
++ vmx_compute_secondary_exec_control(vmx);
++ secondary_exec_controls_set(vmx, vmx->secondary_exec_control);
++ }
++
++ if (kvm_vcpu_apicv_active(&vmx->vcpu)) {
++ vmcs_write64(EOI_EXIT_BITMAP0, 0);
++ vmcs_write64(EOI_EXIT_BITMAP1, 0);
++ vmcs_write64(EOI_EXIT_BITMAP2, 0);
++ vmcs_write64(EOI_EXIT_BITMAP3, 0);
++
++ vmcs_write16(GUEST_INTR_STATUS, 0);
++
++ vmcs_write16(POSTED_INTR_NV, POSTED_INTR_VECTOR);
++ vmcs_write64(POSTED_INTR_DESC_ADDR, __pa((&vmx->pi_desc)));
++ }
++
++ if (!kvm_pause_in_guest(vmx->vcpu.kvm)) {
++ vmcs_write32(PLE_GAP, ple_gap);
++ vmx->ple_window = ple_window;
++ vmx->ple_window_dirty = true;
++ }
++
++ vmcs_write32(PAGE_FAULT_ERROR_CODE_MASK, 0);
++ vmcs_write32(PAGE_FAULT_ERROR_CODE_MATCH, 0);
++ vmcs_write32(CR3_TARGET_COUNT, 0); /* 22.2.1 */
++
++ vmcs_write16(HOST_FS_SELECTOR, 0); /* 22.2.4 */
++ vmcs_write16(HOST_GS_SELECTOR, 0); /* 22.2.4 */
++ vmx_set_constant_host_state(vmx);
++ vmcs_writel(HOST_FS_BASE, 0); /* 22.2.4 */
++ vmcs_writel(HOST_GS_BASE, 0); /* 22.2.4 */
++
++ if (cpu_has_vmx_vmfunc())
++ vmcs_write64(VM_FUNCTION_CONTROL, 0);
++
++ vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
++ vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host.val));
++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
++ vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest.val));
++
++ if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT)
++ vmcs_write64(GUEST_IA32_PAT, vmx->vcpu.arch.pat);
++
++ vm_exit_controls_set(vmx, vmx_vmexit_ctrl());
++
++ /* 22.2.1, 20.8.1 */
++ vm_entry_controls_set(vmx, vmx_vmentry_ctrl());
++
++ vmx->vcpu.arch.cr0_guest_owned_bits = X86_CR0_TS;
++ vmcs_writel(CR0_GUEST_HOST_MASK, ~X86_CR0_TS);
++
++ set_cr4_guest_host_mask(vmx);
++
++ if (vmx->vpid != 0)
++ vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
++
++ if (vmx_xsaves_supported())
++ vmcs_write64(XSS_EXIT_BITMAP, VMX_XSS_EXIT_BITMAP);
++
++ if (enable_pml) {
++ vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
++ vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
++ }
++
++ if (cpu_has_vmx_encls_vmexit())
++ vmcs_write64(ENCLS_EXITING_BITMAP, -1ull);
++
++ if (pt_mode == PT_MODE_HOST_GUEST) {
++ memset(&vmx->pt_desc, 0, sizeof(vmx->pt_desc));
++ /* Bit[6~0] are forced to 1, writes are ignored. */
++ vmx->pt_desc.guest.output_mask = 0x7F;
++ vmcs_write64(GUEST_IA32_RTIT_CTL, 0);
++ }
++}
++
++static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct msr_data apic_base_msr;
++ u64 cr0;
++
++ vmx->rmode.vm86_active = 0;
++ vmx->spec_ctrl = 0;
++
++ vmx->msr_ia32_umwait_control = 0;
++
++ vcpu->arch.microcode_version = 0x100000000ULL;
++ vmx->vcpu.arch.regs[VCPU_REGS_RDX] = get_rdx_init_val();
++ vmx->hv_deadline_tsc = -1;
++ kvm_set_cr8(vcpu, 0);
++
++ if (!init_event) {
++ apic_base_msr.data = APIC_DEFAULT_PHYS_BASE |
++ MSR_IA32_APICBASE_ENABLE;
++ if (kvm_vcpu_is_reset_bsp(vcpu))
++ apic_base_msr.data |= MSR_IA32_APICBASE_BSP;
++ apic_base_msr.host_initiated = true;
++ kvm_set_apic_base(vcpu, &apic_base_msr);
++ }
++
++ vmx_segment_cache_clear(vmx);
++
++ seg_setup(VCPU_SREG_CS);
++ vmcs_write16(GUEST_CS_SELECTOR, 0xf000);
++ vmcs_writel(GUEST_CS_BASE, 0xffff0000ul);
++
++ seg_setup(VCPU_SREG_DS);
++ seg_setup(VCPU_SREG_ES);
++ seg_setup(VCPU_SREG_FS);
++ seg_setup(VCPU_SREG_GS);
++ seg_setup(VCPU_SREG_SS);
++
++ vmcs_write16(GUEST_TR_SELECTOR, 0);
++ vmcs_writel(GUEST_TR_BASE, 0);
++ vmcs_write32(GUEST_TR_LIMIT, 0xffff);
++ vmcs_write32(GUEST_TR_AR_BYTES, 0x008b);
++
++ vmcs_write16(GUEST_LDTR_SELECTOR, 0);
++ vmcs_writel(GUEST_LDTR_BASE, 0);
++ vmcs_write32(GUEST_LDTR_LIMIT, 0xffff);
++ vmcs_write32(GUEST_LDTR_AR_BYTES, 0x00082);
++
++ if (!init_event) {
++ vmcs_write32(GUEST_SYSENTER_CS, 0);
++ vmcs_writel(GUEST_SYSENTER_ESP, 0);
++ vmcs_writel(GUEST_SYSENTER_EIP, 0);
++ vmcs_write64(GUEST_IA32_DEBUGCTL, 0);
++ }
++
++ kvm_set_rflags(vcpu, X86_EFLAGS_FIXED);
++ kvm_rip_write(vcpu, 0xfff0);
++
++ vmcs_writel(GUEST_GDTR_BASE, 0);
++ vmcs_write32(GUEST_GDTR_LIMIT, 0xffff);
++
++ vmcs_writel(GUEST_IDTR_BASE, 0);
++ vmcs_write32(GUEST_IDTR_LIMIT, 0xffff);
++
++ vmcs_write32(GUEST_ACTIVITY_STATE, GUEST_ACTIVITY_ACTIVE);
++ vmcs_write32(GUEST_INTERRUPTIBILITY_INFO, 0);
++ vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS, 0);
++ if (kvm_mpx_supported())
++ vmcs_write64(GUEST_BNDCFGS, 0);
++
++ setup_msrs(vmx);
++
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0); /* 22.2.1 */
++
++ if (cpu_has_vmx_tpr_shadow() && !init_event) {
++ vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, 0);
++ if (cpu_need_tpr_shadow(vcpu))
++ vmcs_write64(VIRTUAL_APIC_PAGE_ADDR,
++ __pa(vcpu->arch.apic->regs));
++ vmcs_write32(TPR_THRESHOLD, 0);
++ }
++
++ kvm_make_request(KVM_REQ_APIC_PAGE_RELOAD, vcpu);
++
++ cr0 = X86_CR0_NW | X86_CR0_CD | X86_CR0_ET;
++ vmx->vcpu.arch.cr0 = cr0;
++ vmx_set_cr0(vcpu, cr0); /* enter rmode */
++ vmx_set_cr4(vcpu, 0);
++ vmx_set_efer(vcpu, 0);
++
++ update_exception_bitmap(vcpu);
++
++ vpid_sync_context(vmx->vpid);
++ if (init_event)
++ vmx_clear_hlt(vcpu);
++}
++
++static void enable_irq_window(struct kvm_vcpu *vcpu)
++{
++ exec_controls_setbit(to_vmx(vcpu), CPU_BASED_INTR_WINDOW_EXITING);
++}
++
++static void enable_nmi_window(struct kvm_vcpu *vcpu)
++{
++ if (!enable_vnmi ||
++ vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
++ enable_irq_window(vcpu);
++ return;
++ }
++
++ exec_controls_setbit(to_vmx(vcpu), CPU_BASED_NMI_WINDOW_EXITING);
++}
++
++static void vmx_inject_irq(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ uint32_t intr;
++ int irq = vcpu->arch.interrupt.nr;
++
++ trace_kvm_inj_virq(irq);
++
++ ++vcpu->stat.irq_injections;
++ if (vmx->rmode.vm86_active) {
++ int inc_eip = 0;
++ if (vcpu->arch.interrupt.soft)
++ inc_eip = vcpu->arch.event_exit_inst_len;
++ kvm_inject_realmode_interrupt(vcpu, irq, inc_eip);
++ return;
++ }
++ intr = irq | INTR_INFO_VALID_MASK;
++ if (vcpu->arch.interrupt.soft) {
++ intr |= INTR_TYPE_SOFT_INTR;
++ vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
++ vmx->vcpu.arch.event_exit_inst_len);
++ } else
++ intr |= INTR_TYPE_EXT_INTR;
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, intr);
++
++ vmx_clear_hlt(vcpu);
++}
++
++static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (!enable_vnmi) {
++ /*
++ * Tracking the NMI-blocked state in software is built upon
++ * finding the next open IRQ window. This, in turn, depends on
++ * well-behaving guests: They have to keep IRQs disabled at
++ * least as long as the NMI handler runs. Otherwise we may
++ * cause NMI nesting, maybe breaking the guest. But as this is
++ * highly unlikely, we can live with the residual risk.
++ */
++ vmx->loaded_vmcs->soft_vnmi_blocked = 1;
++ vmx->loaded_vmcs->vnmi_blocked_time = 0;
++ }
++
++ ++vcpu->stat.nmi_injections;
++ vmx->loaded_vmcs->nmi_known_unmasked = false;
++
++ if (vmx->rmode.vm86_active) {
++ kvm_inject_realmode_interrupt(vcpu, NMI_VECTOR, 0);
++ return;
++ }
++
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD,
++ INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK | NMI_VECTOR);
++
++ vmx_clear_hlt(vcpu);
++}
++
++bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ bool masked;
++
++ if (!enable_vnmi)
++ return vmx->loaded_vmcs->soft_vnmi_blocked;
++ if (vmx->loaded_vmcs->nmi_known_unmasked)
++ return false;
++ masked = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_NMI;
++ vmx->loaded_vmcs->nmi_known_unmasked = !masked;
++ return masked;
++}
++
++void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (!enable_vnmi) {
++ if (vmx->loaded_vmcs->soft_vnmi_blocked != masked) {
++ vmx->loaded_vmcs->soft_vnmi_blocked = masked;
++ vmx->loaded_vmcs->vnmi_blocked_time = 0;
++ }
++ } else {
++ vmx->loaded_vmcs->nmi_known_unmasked = !masked;
++ if (masked)
++ vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++ GUEST_INTR_STATE_NMI);
++ else
++ vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
++ GUEST_INTR_STATE_NMI);
++ }
++}
++
++static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
++{
++ if (to_vmx(vcpu)->nested.nested_run_pending)
++ return 0;
++
++ if (!enable_vnmi &&
++ to_vmx(vcpu)->loaded_vmcs->soft_vnmi_blocked)
++ return 0;
++
++ return !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
++ (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_STI
++ | GUEST_INTR_STATE_NMI));
++}
++
++static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu)
++{
++ return (!to_vmx(vcpu)->nested.nested_run_pending &&
++ vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_IF) &&
++ !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
++ (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS));
++}
++
++static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr)
++{
++ int ret;
++
++ if (enable_unrestricted_guest)
++ return 0;
++
++ ret = x86_set_memory_region(kvm, TSS_PRIVATE_MEMSLOT, addr,
++ PAGE_SIZE * 3);
++ if (ret)
++ return ret;
++ to_kvm_vmx(kvm)->tss_addr = addr;
++ return init_rmode_tss(kvm);
++}
++
++static int vmx_set_identity_map_addr(struct kvm *kvm, u64 ident_addr)
++{
++ to_kvm_vmx(kvm)->ept_identity_map_addr = ident_addr;
++ return 0;
++}
++
++static bool rmode_exception(struct kvm_vcpu *vcpu, int vec)
++{
++ switch (vec) {
++ case BP_VECTOR:
++ /*
++ * Update instruction length as we may reinject the exception
++ * from user space while in guest debugging mode.
++ */
++ to_vmx(vcpu)->vcpu.arch.event_exit_inst_len =
++ vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
++ if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
++ return false;
++ /* fall through */
++ case DB_VECTOR:
++ if (vcpu->guest_debug &
++ (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
++ return false;
++ /* fall through */
++ case DE_VECTOR:
++ case OF_VECTOR:
++ case BR_VECTOR:
++ case UD_VECTOR:
++ case DF_VECTOR:
++ case SS_VECTOR:
++ case GP_VECTOR:
++ case MF_VECTOR:
++ return true;
++ break;
++ }
++ return false;
++}
++
++static int handle_rmode_exception(struct kvm_vcpu *vcpu,
++ int vec, u32 err_code)
++{
++ /*
++ * Instruction with address size override prefix opcode 0x67
++ * Cause the #SS fault with 0 error code in VM86 mode.
++ */
++ if (((vec == GP_VECTOR) || (vec == SS_VECTOR)) && err_code == 0) {
++ if (kvm_emulate_instruction(vcpu, 0)) {
++ if (vcpu->arch.halt_request) {
++ vcpu->arch.halt_request = 0;
++ return kvm_vcpu_halt(vcpu);
++ }
++ return 1;
++ }
++ return 0;
++ }
++
++ /*
++ * Forward all other exceptions that are valid in real mode.
++ * FIXME: Breaks guest debugging in real mode, needs to be fixed with
++ * the required debugging infrastructure rework.
++ */
++ kvm_queue_exception(vcpu, vec);
++ return 1;
++}
++
++/*
++ * Trigger machine check on the host. We assume all the MSRs are already set up
++ * by the CPU and that we still run on the same CPU as the MCE occurred on.
++ * We pass a fake environment to the machine check handler because we want
++ * the guest to be always treated like user space, no matter what context
++ * it used internally.
++ */
++static void kvm_machine_check(void)
++{
++#if defined(CONFIG_X86_MCE) && defined(CONFIG_X86_64)
++ struct pt_regs regs = {
++ .cs = 3, /* Fake ring 3 no matter what the guest ran on */
++ .flags = X86_EFLAGS_IF,
++ };
++
++ do_machine_check(®s, 0);
++#endif
++}
++
++static int handle_machine_check(struct kvm_vcpu *vcpu)
++{
++ /* handled by vmx_vcpu_run() */
++ return 1;
++}
++
++static int handle_exception_nmi(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct kvm_run *kvm_run = vcpu->run;
++ u32 intr_info, ex_no, error_code;
++ unsigned long cr2, rip, dr6;
++ u32 vect_info;
++
++ vect_info = vmx->idt_vectoring_info;
++ intr_info = vmx->exit_intr_info;
++
++ if (is_machine_check(intr_info) || is_nmi(intr_info))
++ return 1; /* handled by handle_exception_nmi_irqoff() */
++
++ if (is_invalid_opcode(intr_info))
++ return handle_ud(vcpu);
++
++ error_code = 0;
++ if (intr_info & INTR_INFO_DELIVER_CODE_MASK)
++ error_code = vmcs_read32(VM_EXIT_INTR_ERROR_CODE);
++
++ if (!vmx->rmode.vm86_active && is_gp_fault(intr_info)) {
++ WARN_ON_ONCE(!enable_vmware_backdoor);
++
++ /*
++ * VMware backdoor emulation on #GP interception only handles
++ * IN{S}, OUT{S}, and RDPMC, none of which generate a non-zero
++ * error code on #GP.
++ */
++ if (error_code) {
++ kvm_queue_exception_e(vcpu, GP_VECTOR, error_code);
++ return 1;
++ }
++ return kvm_emulate_instruction(vcpu, EMULTYPE_VMWARE_GP);
++ }
++
++ /*
++ * The #PF with PFEC.RSVD = 1 indicates the guest is accessing
++ * MMIO, it is better to report an internal error.
++ * See the comments in vmx_handle_exit.
++ */
++ if ((vect_info & VECTORING_INFO_VALID_MASK) &&
++ !(is_page_fault(intr_info) && !(error_code & PFERR_RSVD_MASK))) {
++ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
++ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_SIMUL_EX;
++ vcpu->run->internal.ndata = 3;
++ vcpu->run->internal.data[0] = vect_info;
++ vcpu->run->internal.data[1] = intr_info;
++ vcpu->run->internal.data[2] = error_code;
++ return 0;
++ }
++
++ if (is_page_fault(intr_info)) {
++ cr2 = vmcs_readl(EXIT_QUALIFICATION);
++ /* EPT won't cause page fault directly */
++ WARN_ON_ONCE(!vcpu->arch.apf.host_apf_reason && enable_ept);
++ return kvm_handle_page_fault(vcpu, error_code, cr2, NULL, 0);
++ }
++
++ ex_no = intr_info & INTR_INFO_VECTOR_MASK;
++
++ if (vmx->rmode.vm86_active && rmode_exception(vcpu, ex_no))
++ return handle_rmode_exception(vcpu, ex_no, error_code);
++
++ switch (ex_no) {
++ case AC_VECTOR:
++ kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
++ return 1;
++ case DB_VECTOR:
++ dr6 = vmcs_readl(EXIT_QUALIFICATION);
++ if (!(vcpu->guest_debug &
++ (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))) {
++ vcpu->arch.dr6 &= ~DR_TRAP_BITS;
++ vcpu->arch.dr6 |= dr6 | DR6_RTM;
++ if (is_icebp(intr_info))
++ WARN_ON(!skip_emulated_instruction(vcpu));
++
++ kvm_queue_exception(vcpu, DB_VECTOR);
++ return 1;
++ }
++ kvm_run->debug.arch.dr6 = dr6 | DR6_FIXED_1;
++ kvm_run->debug.arch.dr7 = vmcs_readl(GUEST_DR7);
++ /* fall through */
++ case BP_VECTOR:
++ /*
++ * Update instruction length as we may reinject #BP from
++ * user space while in guest debugging mode. Reading it for
++ * #DB as well causes no harm, it is not used in that case.
++ */
++ vmx->vcpu.arch.event_exit_inst_len =
++ vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
++ kvm_run->exit_reason = KVM_EXIT_DEBUG;
++ rip = kvm_rip_read(vcpu);
++ kvm_run->debug.arch.pc = vmcs_readl(GUEST_CS_BASE) + rip;
++ kvm_run->debug.arch.exception = ex_no;
++ break;
++ default:
++ kvm_run->exit_reason = KVM_EXIT_EXCEPTION;
++ kvm_run->ex.exception = ex_no;
++ kvm_run->ex.error_code = error_code;
++ break;
++ }
++ return 0;
++}
++
++static __always_inline int handle_external_interrupt(struct kvm_vcpu *vcpu)
++{
++ ++vcpu->stat.irq_exits;
++ return 1;
++}
++
++static int handle_triple_fault(struct kvm_vcpu *vcpu)
++{
++ vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
++ vcpu->mmio_needed = 0;
++ return 0;
++}
++
++static int handle_io(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification;
++ int size, in, string;
++ unsigned port;
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ string = (exit_qualification & 16) != 0;
++
++ ++vcpu->stat.io_exits;
++
++ if (string)
++ return kvm_emulate_instruction(vcpu, 0);
++
++ port = exit_qualification >> 16;
++ size = (exit_qualification & 7) + 1;
++ in = (exit_qualification & 8) != 0;
++
++ return kvm_fast_pio(vcpu, size, port, in);
++}
++
++static void
++vmx_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
++{
++ /*
++ * Patch in the VMCALL instruction:
++ */
++ hypercall[0] = 0x0f;
++ hypercall[1] = 0x01;
++ hypercall[2] = 0xc1;
++}
++
++/* called to set cr0 as appropriate for a mov-to-cr0 exit. */
++static int handle_set_cr0(struct kvm_vcpu *vcpu, unsigned long val)
++{
++ if (is_guest_mode(vcpu)) {
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ unsigned long orig_val = val;
++
++ /*
++ * We get here when L2 changed cr0 in a way that did not change
++ * any of L1's shadowed bits (see nested_vmx_exit_handled_cr),
++ * but did change L0 shadowed bits. So we first calculate the
++ * effective cr0 value that L1 would like to write into the
++ * hardware. It consists of the L2-owned bits from the new
++ * value combined with the L1-owned bits from L1's guest_cr0.
++ */
++ val = (val & ~vmcs12->cr0_guest_host_mask) |
++ (vmcs12->guest_cr0 & vmcs12->cr0_guest_host_mask);
++
++ if (!nested_guest_cr0_valid(vcpu, val))
++ return 1;
++
++ if (kvm_set_cr0(vcpu, val))
++ return 1;
++ vmcs_writel(CR0_READ_SHADOW, orig_val);
++ return 0;
++ } else {
++ if (to_vmx(vcpu)->nested.vmxon &&
++ !nested_host_cr0_valid(vcpu, val))
++ return 1;
++
++ return kvm_set_cr0(vcpu, val);
++ }
++}
++
++static int handle_set_cr4(struct kvm_vcpu *vcpu, unsigned long val)
++{
++ if (is_guest_mode(vcpu)) {
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ unsigned long orig_val = val;
++
++ /* analogously to handle_set_cr0 */
++ val = (val & ~vmcs12->cr4_guest_host_mask) |
++ (vmcs12->guest_cr4 & vmcs12->cr4_guest_host_mask);
++ if (kvm_set_cr4(vcpu, val))
++ return 1;
++ vmcs_writel(CR4_READ_SHADOW, orig_val);
++ return 0;
++ } else
++ return kvm_set_cr4(vcpu, val);
++}
++
++static int handle_desc(struct kvm_vcpu *vcpu)
++{
++ WARN_ON(!(vcpu->arch.cr4 & X86_CR4_UMIP));
++ return kvm_emulate_instruction(vcpu, 0);
++}
++
++static int handle_cr(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification, val;
++ int cr;
++ int reg;
++ int err;
++ int ret;
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ cr = exit_qualification & 15;
++ reg = (exit_qualification >> 8) & 15;
++ switch ((exit_qualification >> 4) & 3) {
++ case 0: /* mov to cr */
++ val = kvm_register_readl(vcpu, reg);
++ trace_kvm_cr_write(cr, val);
++ switch (cr) {
++ case 0:
++ err = handle_set_cr0(vcpu, val);
++ return kvm_complete_insn_gp(vcpu, err);
++ case 3:
++ WARN_ON_ONCE(enable_unrestricted_guest);
++ err = kvm_set_cr3(vcpu, val);
++ return kvm_complete_insn_gp(vcpu, err);
++ case 4:
++ err = handle_set_cr4(vcpu, val);
++ return kvm_complete_insn_gp(vcpu, err);
++ case 8: {
++ u8 cr8_prev = kvm_get_cr8(vcpu);
++ u8 cr8 = (u8)val;
++ err = kvm_set_cr8(vcpu, cr8);
++ ret = kvm_complete_insn_gp(vcpu, err);
++ if (lapic_in_kernel(vcpu))
++ return ret;
++ if (cr8_prev <= cr8)
++ return ret;
++ /*
++ * TODO: we might be squashing a
++ * KVM_GUESTDBG_SINGLESTEP-triggered
++ * KVM_EXIT_DEBUG here.
++ */
++ vcpu->run->exit_reason = KVM_EXIT_SET_TPR;
++ return 0;
++ }
++ }
++ break;
++ case 2: /* clts */
++ WARN_ONCE(1, "Guest should always own CR0.TS");
++ vmx_set_cr0(vcpu, kvm_read_cr0_bits(vcpu, ~X86_CR0_TS));
++ trace_kvm_cr_write(0, kvm_read_cr0(vcpu));
++ return kvm_skip_emulated_instruction(vcpu);
++ case 1: /*mov from cr*/
++ switch (cr) {
++ case 3:
++ WARN_ON_ONCE(enable_unrestricted_guest);
++ val = kvm_read_cr3(vcpu);
++ kvm_register_write(vcpu, reg, val);
++ trace_kvm_cr_read(cr, val);
++ return kvm_skip_emulated_instruction(vcpu);
++ case 8:
++ val = kvm_get_cr8(vcpu);
++ kvm_register_write(vcpu, reg, val);
++ trace_kvm_cr_read(cr, val);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ break;
++ case 3: /* lmsw */
++ val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f;
++ trace_kvm_cr_write(0, (kvm_read_cr0(vcpu) & ~0xful) | val);
++ kvm_lmsw(vcpu, val);
++
++ return kvm_skip_emulated_instruction(vcpu);
++ default:
++ break;
++ }
++ vcpu->run->exit_reason = 0;
++ vcpu_unimpl(vcpu, "unhandled control register: op %d cr %d\n",
++ (int)(exit_qualification >> 4) & 3, cr);
++ return 0;
++}
++
++static int handle_dr(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification;
++ int dr, dr7, reg;
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ dr = exit_qualification & DEBUG_REG_ACCESS_NUM;
++
++ /* First, if DR does not exist, trigger UD */
++ if (!kvm_require_dr(vcpu, dr))
++ return 1;
++
++ /* Do not handle if the CPL > 0, will trigger GP on re-entry */
++ if (!kvm_require_cpl(vcpu, 0))
++ return 1;
++ dr7 = vmcs_readl(GUEST_DR7);
++ if (dr7 & DR7_GD) {
++ /*
++ * As the vm-exit takes precedence over the debug trap, we
++ * need to emulate the latter, either for the host or the
++ * guest debugging itself.
++ */
++ if (vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) {
++ vcpu->run->debug.arch.dr6 = vcpu->arch.dr6;
++ vcpu->run->debug.arch.dr7 = dr7;
++ vcpu->run->debug.arch.pc = kvm_get_linear_rip(vcpu);
++ vcpu->run->debug.arch.exception = DB_VECTOR;
++ vcpu->run->exit_reason = KVM_EXIT_DEBUG;
++ return 0;
++ } else {
++ vcpu->arch.dr6 &= ~DR_TRAP_BITS;
++ vcpu->arch.dr6 |= DR6_BD | DR6_RTM;
++ kvm_queue_exception(vcpu, DB_VECTOR);
++ return 1;
++ }
++ }
++
++ if (vcpu->guest_debug == 0) {
++ exec_controls_clearbit(to_vmx(vcpu), CPU_BASED_MOV_DR_EXITING);
++
++ /*
++ * No more DR vmexits; force a reload of the debug registers
++ * and reenter on this instruction. The next vmexit will
++ * retrieve the full state of the debug registers.
++ */
++ vcpu->arch.switch_db_regs |= KVM_DEBUGREG_WONT_EXIT;
++ return 1;
++ }
++
++ reg = DEBUG_REG_ACCESS_REG(exit_qualification);
++ if (exit_qualification & TYPE_MOV_FROM_DR) {
++ unsigned long val;
++
++ if (kvm_get_dr(vcpu, dr, &val))
++ return 1;
++ kvm_register_write(vcpu, reg, val);
++ } else
++ if (kvm_set_dr(vcpu, dr, kvm_register_readl(vcpu, reg)))
++ return 1;
++
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static u64 vmx_get_dr6(struct kvm_vcpu *vcpu)
++{
++ return vcpu->arch.dr6;
++}
++
++static void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val)
++{
++}
++
++static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)
++{
++ get_debugreg(vcpu->arch.db[0], 0);
++ get_debugreg(vcpu->arch.db[1], 1);
++ get_debugreg(vcpu->arch.db[2], 2);
++ get_debugreg(vcpu->arch.db[3], 3);
++ get_debugreg(vcpu->arch.dr6, 6);
++ vcpu->arch.dr7 = vmcs_readl(GUEST_DR7);
++
++ vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_WONT_EXIT;
++ exec_controls_setbit(to_vmx(vcpu), CPU_BASED_MOV_DR_EXITING);
++}
++
++static void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val)
++{
++ vmcs_writel(GUEST_DR7, val);
++}
++
++static int handle_tpr_below_threshold(struct kvm_vcpu *vcpu)
++{
++ kvm_apic_update_ppr(vcpu);
++ return 1;
++}
++
++static int handle_interrupt_window(struct kvm_vcpu *vcpu)
++{
++ exec_controls_clearbit(to_vmx(vcpu), CPU_BASED_INTR_WINDOW_EXITING);
++
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
++
++ ++vcpu->stat.irq_window_exits;
++ return 1;
++}
++
++static int handle_vmcall(struct kvm_vcpu *vcpu)
++{
++ return kvm_emulate_hypercall(vcpu);
++}
++
++static int handle_invd(struct kvm_vcpu *vcpu)
++{
++ return kvm_emulate_instruction(vcpu, 0);
++}
++
++static int handle_invlpg(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++
++ kvm_mmu_invlpg(vcpu, exit_qualification);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static int handle_rdpmc(struct kvm_vcpu *vcpu)
++{
++ int err;
++
++ err = kvm_rdpmc(vcpu);
++ return kvm_complete_insn_gp(vcpu, err);
++}
++
++static int handle_wbinvd(struct kvm_vcpu *vcpu)
++{
++ return kvm_emulate_wbinvd(vcpu);
++}
++
++static int handle_xsetbv(struct kvm_vcpu *vcpu)
++{
++ u64 new_bv = kvm_read_edx_eax(vcpu);
++ u32 index = kvm_rcx_read(vcpu);
++
++ if (kvm_set_xcr(vcpu, index, new_bv) == 0)
++ return kvm_skip_emulated_instruction(vcpu);
++ return 1;
++}
++
++static int handle_apic_access(struct kvm_vcpu *vcpu)
++{
++ if (likely(fasteoi)) {
++ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ int access_type, offset;
++
++ access_type = exit_qualification & APIC_ACCESS_TYPE;
++ offset = exit_qualification & APIC_ACCESS_OFFSET;
++ /*
++ * Sane guest uses MOV to write EOI, with written value
++ * not cared. So make a short-circuit here by avoiding
++ * heavy instruction emulation.
++ */
++ if ((access_type == TYPE_LINEAR_APIC_INST_WRITE) &&
++ (offset == APIC_EOI)) {
++ kvm_lapic_set_eoi(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ }
++ return kvm_emulate_instruction(vcpu, 0);
++}
++
++static int handle_apic_eoi_induced(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ int vector = exit_qualification & 0xff;
++
++ /* EOI-induced VM exit is trap-like and thus no need to adjust IP */
++ kvm_apic_set_eoi_accelerated(vcpu, vector);
++ return 1;
++}
++
++static int handle_apic_write(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ u32 offset = exit_qualification & 0xfff;
++
++ /* APIC-write VM exit is trap-like and thus no need to adjust IP */
++ kvm_apic_write_nodecode(vcpu, offset);
++ return 1;
++}
++
++static int handle_task_switch(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long exit_qualification;
++ bool has_error_code = false;
++ u32 error_code = 0;
++ u16 tss_selector;
++ int reason, type, idt_v, idt_index;
++
++ idt_v = (vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK);
++ idt_index = (vmx->idt_vectoring_info & VECTORING_INFO_VECTOR_MASK);
++ type = (vmx->idt_vectoring_info & VECTORING_INFO_TYPE_MASK);
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++
++ reason = (u32)exit_qualification >> 30;
++ if (reason == TASK_SWITCH_GATE && idt_v) {
++ switch (type) {
++ case INTR_TYPE_NMI_INTR:
++ vcpu->arch.nmi_injected = false;
++ vmx_set_nmi_mask(vcpu, true);
++ break;
++ case INTR_TYPE_EXT_INTR:
++ case INTR_TYPE_SOFT_INTR:
++ kvm_clear_interrupt_queue(vcpu);
++ break;
++ case INTR_TYPE_HARD_EXCEPTION:
++ if (vmx->idt_vectoring_info &
++ VECTORING_INFO_DELIVER_CODE_MASK) {
++ has_error_code = true;
++ error_code =
++ vmcs_read32(IDT_VECTORING_ERROR_CODE);
++ }
++ /* fall through */
++ case INTR_TYPE_SOFT_EXCEPTION:
++ kvm_clear_exception_queue(vcpu);
++ break;
++ default:
++ break;
++ }
++ }
++ tss_selector = exit_qualification;
++
++ if (!idt_v || (type != INTR_TYPE_HARD_EXCEPTION &&
++ type != INTR_TYPE_EXT_INTR &&
++ type != INTR_TYPE_NMI_INTR))
++ WARN_ON(!skip_emulated_instruction(vcpu));
++
++ /*
++ * TODO: What about debug traps on tss switch?
++ * Are we supposed to inject them and update dr6?
++ */
++ return kvm_task_switch(vcpu, tss_selector,
++ type == INTR_TYPE_SOFT_INTR ? idt_index : -1,
++ reason, has_error_code, error_code);
++}
++
++static int handle_ept_violation(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification;
++ gpa_t gpa;
++ u64 error_code;
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++
++ /*
++ * EPT violation happened while executing iret from NMI,
++ * "blocked by NMI" bit has to be set before next VM entry.
++ * There are errata that may cause this bit to not be set:
++ * AAK134, BY25.
++ */
++ if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++ enable_vnmi &&
++ (exit_qualification & INTR_INFO_UNBLOCK_NMI))
++ vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
++
++ gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
++ trace_kvm_page_fault(gpa, exit_qualification);
++
++ /* Is it a read fault? */
++ error_code = (exit_qualification & EPT_VIOLATION_ACC_READ)
++ ? PFERR_USER_MASK : 0;
++ /* Is it a write fault? */
++ error_code |= (exit_qualification & EPT_VIOLATION_ACC_WRITE)
++ ? PFERR_WRITE_MASK : 0;
++ /* Is it a fetch fault? */
++ error_code |= (exit_qualification & EPT_VIOLATION_ACC_INSTR)
++ ? PFERR_FETCH_MASK : 0;
++ /* ept page table entry is present? */
++ error_code |= (exit_qualification &
++ (EPT_VIOLATION_READABLE | EPT_VIOLATION_WRITABLE |
++ EPT_VIOLATION_EXECUTABLE))
++ ? PFERR_PRESENT_MASK : 0;
++
++ error_code |= (exit_qualification & 0x100) != 0 ?
++ PFERR_GUEST_FINAL_MASK : PFERR_GUEST_PAGE_MASK;
++
++ vcpu->arch.exit_qualification = exit_qualification;
++ return kvm_mmu_page_fault(vcpu, gpa, error_code, NULL, 0);
++}
++
++static int handle_ept_misconfig(struct kvm_vcpu *vcpu)
++{
++ gpa_t gpa;
++
++ /*
++ * A nested guest cannot optimize MMIO vmexits, because we have an
++ * nGPA here instead of the required GPA.
++ */
++ gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
++ if (!is_guest_mode(vcpu) &&
++ !kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, gpa, 0, NULL)) {
++ trace_kvm_fast_mmio(gpa);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ return kvm_mmu_page_fault(vcpu, gpa, PFERR_RSVD_MASK, NULL, 0);
++}
++
++static int handle_nmi_window(struct kvm_vcpu *vcpu)
++{
++ WARN_ON_ONCE(!enable_vnmi);
++ exec_controls_clearbit(to_vmx(vcpu), CPU_BASED_NMI_WINDOW_EXITING);
++ ++vcpu->stat.nmi_window_exits;
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
++
++ return 1;
++}
++
++static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ bool intr_window_requested;
++ unsigned count = 130;
++
++ /*
++ * We should never reach the point where we are emulating L2
++ * due to invalid guest state as that means we incorrectly
++ * allowed a nested VMEntry with an invalid vmcs12.
++ */
++ WARN_ON_ONCE(vmx->emulation_required && vmx->nested.nested_run_pending);
++
++ intr_window_requested = exec_controls_get(vmx) &
++ CPU_BASED_INTR_WINDOW_EXITING;
++
++ while (vmx->emulation_required && count-- != 0) {
++ if (intr_window_requested && vmx_interrupt_allowed(vcpu))
++ return handle_interrupt_window(&vmx->vcpu);
++
++ if (kvm_test_request(KVM_REQ_EVENT, vcpu))
++ return 1;
++
++ if (!kvm_emulate_instruction(vcpu, 0))
++ return 0;
++
++ if (vmx->emulation_required && !vmx->rmode.vm86_active &&
++ vcpu->arch.exception.pending) {
++ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
++ vcpu->run->internal.suberror =
++ KVM_INTERNAL_ERROR_EMULATION;
++ vcpu->run->internal.ndata = 0;
++ return 0;
++ }
++
++ if (vcpu->arch.halt_request) {
++ vcpu->arch.halt_request = 0;
++ return kvm_vcpu_halt(vcpu);
++ }
++
++ /*
++ * Note, return 1 and not 0, vcpu_run() is responsible for
++ * morphing the pending signal into the proper return code.
++ */
++ if (signal_pending(current))
++ return 1;
++
++ if (need_resched())
++ schedule();
++ }
++
++ return 1;
++}
++
++static void grow_ple_window(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned int old = vmx->ple_window;
++
++ vmx->ple_window = __grow_ple_window(old, ple_window,
++ ple_window_grow,
++ ple_window_max);
++
++ if (vmx->ple_window != old) {
++ vmx->ple_window_dirty = true;
++ trace_kvm_ple_window_update(vcpu->vcpu_id,
++ vmx->ple_window, old);
++ }
++}
++
++static void shrink_ple_window(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned int old = vmx->ple_window;
++
++ vmx->ple_window = __shrink_ple_window(old, ple_window,
++ ple_window_shrink,
++ ple_window);
++
++ if (vmx->ple_window != old) {
++ vmx->ple_window_dirty = true;
++ trace_kvm_ple_window_update(vcpu->vcpu_id,
++ vmx->ple_window, old);
++ }
++}
++
++/*
++ * Handler for POSTED_INTERRUPT_WAKEUP_VECTOR.
++ */
++static void wakeup_handler(void)
++{
++ struct kvm_vcpu *vcpu;
++ int cpu = smp_processor_id();
++
++ spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
++ list_for_each_entry(vcpu, &per_cpu(blocked_vcpu_on_cpu, cpu),
++ blocked_vcpu_list) {
++ struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
++
++ if (pi_test_on(pi_desc) == 1)
++ kvm_vcpu_kick(vcpu);
++ }
++ spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
++}
++
++static void vmx_enable_tdp(void)
++{
++ kvm_mmu_set_mask_ptes(VMX_EPT_READABLE_MASK,
++ enable_ept_ad_bits ? VMX_EPT_ACCESS_BIT : 0ull,
++ enable_ept_ad_bits ? VMX_EPT_DIRTY_BIT : 0ull,
++ 0ull, VMX_EPT_EXECUTABLE_MASK,
++ cpu_has_vmx_ept_execute_only() ? 0ull : VMX_EPT_READABLE_MASK,
++ VMX_EPT_RWX_MASK, 0ull);
++
++ ept_set_mmio_spte_mask();
++ kvm_enable_tdp();
++}
++
++/*
++ * Indicate a busy-waiting vcpu in spinlock. We do not enable the PAUSE
++ * exiting, so only get here on cpu with PAUSE-Loop-Exiting.
++ */
++static int handle_pause(struct kvm_vcpu *vcpu)
++{
++ if (!kvm_pause_in_guest(vcpu->kvm))
++ grow_ple_window(vcpu);
++
++ /*
++ * Intel sdm vol3 ch-25.1.3 says: The "PAUSE-loop exiting"
++ * VM-execution control is ignored if CPL > 0. OTOH, KVM
++ * never set PAUSE_EXITING and just set PLE if supported,
++ * so the vcpu must be CPL=0 if it gets a PAUSE exit.
++ */
++ kvm_vcpu_on_spin(vcpu, true);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static int handle_nop(struct kvm_vcpu *vcpu)
++{
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static int handle_mwait(struct kvm_vcpu *vcpu)
++{
++ printk_once(KERN_WARNING "kvm: MWAIT instruction emulated as NOP!\n");
++ return handle_nop(vcpu);
++}
++
++static int handle_invalid_op(struct kvm_vcpu *vcpu)
++{
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++}
++
++static int handle_monitor_trap(struct kvm_vcpu *vcpu)
++{
++ return 1;
++}
++
++static int handle_monitor(struct kvm_vcpu *vcpu)
++{
++ printk_once(KERN_WARNING "kvm: MONITOR instruction emulated as NOP!\n");
++ return handle_nop(vcpu);
++}
++
++static int handle_invpcid(struct kvm_vcpu *vcpu)
++{
++ u32 vmx_instruction_info;
++ unsigned long type;
++ bool pcid_enabled;
++ gva_t gva;
++ struct x86_exception e;
++ unsigned i;
++ unsigned long roots_to_free = 0;
++ struct {
++ u64 pcid;
++ u64 gla;
++ } operand;
++
++ if (!guest_cpuid_has(vcpu, X86_FEATURE_INVPCID)) {
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++ }
++
++ vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
++ type = kvm_register_readl(vcpu, (vmx_instruction_info >> 28) & 0xf);
++
++ if (type > 3) {
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++
++ /* According to the Intel instruction reference, the memory operand
++ * is read even if it isn't needed (e.g., for type==all)
++ */
++ if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
++ vmx_instruction_info, false,
++ sizeof(operand), &gva))
++ return 1;
++
++ if (kvm_read_guest_virt(vcpu, gva, &operand, sizeof(operand), &e)) {
++ kvm_inject_page_fault(vcpu, &e);
++ return 1;
++ }
++
++ if (operand.pcid >> 12 != 0) {
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++
++ pcid_enabled = kvm_read_cr4_bits(vcpu, X86_CR4_PCIDE);
++
++ switch (type) {
++ case INVPCID_TYPE_INDIV_ADDR:
++ if ((!pcid_enabled && (operand.pcid != 0)) ||
++ is_noncanonical_address(operand.gla, vcpu)) {
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++ kvm_mmu_invpcid_gva(vcpu, operand.gla, operand.pcid);
++ return kvm_skip_emulated_instruction(vcpu);
++
++ case INVPCID_TYPE_SINGLE_CTXT:
++ if (!pcid_enabled && (operand.pcid != 0)) {
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++
++ if (kvm_get_active_pcid(vcpu) == operand.pcid) {
++ kvm_mmu_sync_roots(vcpu);
++ kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
++ }
++
++ for (i = 0; i < KVM_MMU_NUM_PREV_ROOTS; i++)
++ if (kvm_get_pcid(vcpu, vcpu->arch.mmu->prev_roots[i].cr3)
++ == operand.pcid)
++ roots_to_free |= KVM_MMU_ROOT_PREVIOUS(i);
++
++ kvm_mmu_free_roots(vcpu, vcpu->arch.mmu, roots_to_free);
++ /*
++ * If neither the current cr3 nor any of the prev_roots use the
++ * given PCID, then nothing needs to be done here because a
++ * resync will happen anyway before switching to any other CR3.
++ */
++
++ return kvm_skip_emulated_instruction(vcpu);
++
++ case INVPCID_TYPE_ALL_NON_GLOBAL:
++ /*
++ * Currently, KVM doesn't mark global entries in the shadow
++ * page tables, so a non-global flush just degenerates to a
++ * global flush. If needed, we could optimize this later by
++ * keeping track of global entries in shadow page tables.
++ */
++
++ /* fall-through */
++ case INVPCID_TYPE_ALL_INCL_GLOBAL:
++ kvm_mmu_unload(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++
++ default:
++ BUG(); /* We have already checked above that type <= 3 */
++ }
++}
++
++static int handle_pml_full(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification;
++
++ trace_kvm_pml_full(vcpu->vcpu_id);
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++
++ /*
++ * PML buffer FULL happened while executing iret from NMI,
++ * "blocked by NMI" bit has to be set before next VM entry.
++ */
++ if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++ enable_vnmi &&
++ (exit_qualification & INTR_INFO_UNBLOCK_NMI))
++ vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++ GUEST_INTR_STATE_NMI);
++
++ /*
++ * PML buffer already flushed at beginning of VMEXIT. Nothing to do
++ * here.., and there's no userspace involvement needed for PML.
++ */
++ return 1;
++}
++
++static int handle_preemption_timer(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (!vmx->req_immediate_exit &&
++ !unlikely(vmx->loaded_vmcs->hv_timer_soft_disabled))
++ kvm_lapic_expired_hv_timer(vcpu);
++
++ return 1;
++}
++
++/*
++ * When nested=0, all VMX instruction VM Exits filter here. The handlers
++ * are overwritten by nested_vmx_setup() when nested=1.
++ */
++static int handle_vmx_instruction(struct kvm_vcpu *vcpu)
++{
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++}
++
++static int handle_encls(struct kvm_vcpu *vcpu)
++{
++ /*
++ * SGX virtualization is not yet supported. There is no software
++ * enable bit for SGX, so we have to trap ENCLS and inject a #UD
++ * to prevent the guest from executing ENCLS.
++ */
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++}
++
++/*
++ * The exit handlers return 1 if the exit was handled fully and guest execution
++ * may resume. Otherwise they set the kvm_run parameter to indicate what needs
++ * to be done to userspace and return 0.
++ */
++static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
++ [EXIT_REASON_EXCEPTION_NMI] = handle_exception_nmi,
++ [EXIT_REASON_EXTERNAL_INTERRUPT] = handle_external_interrupt,
++ [EXIT_REASON_TRIPLE_FAULT] = handle_triple_fault,
++ [EXIT_REASON_NMI_WINDOW] = handle_nmi_window,
++ [EXIT_REASON_IO_INSTRUCTION] = handle_io,
++ [EXIT_REASON_CR_ACCESS] = handle_cr,
++ [EXIT_REASON_DR_ACCESS] = handle_dr,
++ [EXIT_REASON_CPUID] = kvm_emulate_cpuid,
++ [EXIT_REASON_MSR_READ] = kvm_emulate_rdmsr,
++ [EXIT_REASON_MSR_WRITE] = kvm_emulate_wrmsr,
++ [EXIT_REASON_INTERRUPT_WINDOW] = handle_interrupt_window,
++ [EXIT_REASON_HLT] = kvm_emulate_halt,
++ [EXIT_REASON_INVD] = handle_invd,
++ [EXIT_REASON_INVLPG] = handle_invlpg,
++ [EXIT_REASON_RDPMC] = handle_rdpmc,
++ [EXIT_REASON_VMCALL] = handle_vmcall,
++ [EXIT_REASON_VMCLEAR] = handle_vmx_instruction,
++ [EXIT_REASON_VMLAUNCH] = handle_vmx_instruction,
++ [EXIT_REASON_VMPTRLD] = handle_vmx_instruction,
++ [EXIT_REASON_VMPTRST] = handle_vmx_instruction,
++ [EXIT_REASON_VMREAD] = handle_vmx_instruction,
++ [EXIT_REASON_VMRESUME] = handle_vmx_instruction,
++ [EXIT_REASON_VMWRITE] = handle_vmx_instruction,
++ [EXIT_REASON_VMOFF] = handle_vmx_instruction,
++ [EXIT_REASON_VMON] = handle_vmx_instruction,
++ [EXIT_REASON_TPR_BELOW_THRESHOLD] = handle_tpr_below_threshold,
++ [EXIT_REASON_APIC_ACCESS] = handle_apic_access,
++ [EXIT_REASON_APIC_WRITE] = handle_apic_write,
++ [EXIT_REASON_EOI_INDUCED] = handle_apic_eoi_induced,
++ [EXIT_REASON_WBINVD] = handle_wbinvd,
++ [EXIT_REASON_XSETBV] = handle_xsetbv,
++ [EXIT_REASON_TASK_SWITCH] = handle_task_switch,
++ [EXIT_REASON_MCE_DURING_VMENTRY] = handle_machine_check,
++ [EXIT_REASON_GDTR_IDTR] = handle_desc,
++ [EXIT_REASON_LDTR_TR] = handle_desc,
++ [EXIT_REASON_EPT_VIOLATION] = handle_ept_violation,
++ [EXIT_REASON_EPT_MISCONFIG] = handle_ept_misconfig,
++ [EXIT_REASON_PAUSE_INSTRUCTION] = handle_pause,
++ [EXIT_REASON_MWAIT_INSTRUCTION] = handle_mwait,
++ [EXIT_REASON_MONITOR_TRAP_FLAG] = handle_monitor_trap,
++ [EXIT_REASON_MONITOR_INSTRUCTION] = handle_monitor,
++ [EXIT_REASON_INVEPT] = handle_vmx_instruction,
++ [EXIT_REASON_INVVPID] = handle_vmx_instruction,
++ [EXIT_REASON_RDRAND] = handle_invalid_op,
++ [EXIT_REASON_RDSEED] = handle_invalid_op,
++ [EXIT_REASON_PML_FULL] = handle_pml_full,
++ [EXIT_REASON_INVPCID] = handle_invpcid,
++ [EXIT_REASON_VMFUNC] = handle_vmx_instruction,
++ [EXIT_REASON_PREEMPTION_TIMER] = handle_preemption_timer,
++ [EXIT_REASON_ENCLS] = handle_encls,
++};
++
++static const int kvm_vmx_max_exit_handlers =
++ ARRAY_SIZE(kvm_vmx_exit_handlers);
++
++static void vmx_get_exit_info(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2)
++{
++ *info1 = vmcs_readl(EXIT_QUALIFICATION);
++ *info2 = vmcs_read32(VM_EXIT_INTR_INFO);
++}
++
++static void vmx_destroy_pml_buffer(struct vcpu_vmx *vmx)
++{
++ if (vmx->pml_pg) {
++ __free_page(vmx->pml_pg);
++ vmx->pml_pg = NULL;
++ }
++}
++
++static void vmx_flush_pml_buffer(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u64 *pml_buf;
++ u16 pml_idx;
++
++ pml_idx = vmcs_read16(GUEST_PML_INDEX);
++
++ /* Do nothing if PML buffer is empty */
++ if (pml_idx == (PML_ENTITY_NUM - 1))
++ return;
++
++ /* PML index always points to next available PML buffer entity */
++ if (pml_idx >= PML_ENTITY_NUM)
++ pml_idx = 0;
++ else
++ pml_idx++;
++
++ pml_buf = page_address(vmx->pml_pg);
++ for (; pml_idx < PML_ENTITY_NUM; pml_idx++) {
++ u64 gpa;
++
++ gpa = pml_buf[pml_idx];
++ WARN_ON(gpa & (PAGE_SIZE - 1));
++ kvm_vcpu_mark_page_dirty(vcpu, gpa >> PAGE_SHIFT);
++ }
++
++ /* reset PML index */
++ vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
++}
++
++/*
++ * Flush all vcpus' PML buffer and update logged GPAs to dirty_bitmap.
++ * Called before reporting dirty_bitmap to userspace.
++ */
++static void kvm_flush_pml_buffers(struct kvm *kvm)
++{
++ int i;
++ struct kvm_vcpu *vcpu;
++ /*
++ * We only need to kick vcpu out of guest mode here, as PML buffer
++ * is flushed at beginning of all VMEXITs, and it's obvious that only
++ * vcpus running in guest are possible to have unflushed GPAs in PML
++ * buffer.
++ */
++ kvm_for_each_vcpu(i, vcpu, kvm)
++ kvm_vcpu_kick(vcpu);
++}
++
++static void vmx_dump_sel(char *name, uint32_t sel)
++{
++ pr_err("%s sel=0x%04x, attr=0x%05x, limit=0x%08x, base=0x%016lx\n",
++ name, vmcs_read16(sel),
++ vmcs_read32(sel + GUEST_ES_AR_BYTES - GUEST_ES_SELECTOR),
++ vmcs_read32(sel + GUEST_ES_LIMIT - GUEST_ES_SELECTOR),
++ vmcs_readl(sel + GUEST_ES_BASE - GUEST_ES_SELECTOR));
++}
++
++static void vmx_dump_dtsel(char *name, uint32_t limit)
++{
++ pr_err("%s limit=0x%08x, base=0x%016lx\n",
++ name, vmcs_read32(limit),
++ vmcs_readl(limit + GUEST_GDTR_BASE - GUEST_GDTR_LIMIT));
++}
++
++void dump_vmcs(void)
++{
++ u32 vmentry_ctl, vmexit_ctl;
++ u32 cpu_based_exec_ctrl, pin_based_exec_ctrl, secondary_exec_control;
++ unsigned long cr4;
++ u64 efer;
++ int i, n;
++
++ if (!dump_invalid_vmcs) {
++ pr_warn_ratelimited("set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.\n");
++ return;
++ }
++
++ vmentry_ctl = vmcs_read32(VM_ENTRY_CONTROLS);
++ vmexit_ctl = vmcs_read32(VM_EXIT_CONTROLS);
++ cpu_based_exec_ctrl = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
++ pin_based_exec_ctrl = vmcs_read32(PIN_BASED_VM_EXEC_CONTROL);
++ cr4 = vmcs_readl(GUEST_CR4);
++ efer = vmcs_read64(GUEST_IA32_EFER);
++ secondary_exec_control = 0;
++ if (cpu_has_secondary_exec_ctrls())
++ secondary_exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
++
++ pr_err("*** Guest State ***\n");
++ pr_err("CR0: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n",
++ vmcs_readl(GUEST_CR0), vmcs_readl(CR0_READ_SHADOW),
++ vmcs_readl(CR0_GUEST_HOST_MASK));
++ pr_err("CR4: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n",
++ cr4, vmcs_readl(CR4_READ_SHADOW), vmcs_readl(CR4_GUEST_HOST_MASK));
++ pr_err("CR3 = 0x%016lx\n", vmcs_readl(GUEST_CR3));
++ if ((secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT) &&
++ (cr4 & X86_CR4_PAE) && !(efer & EFER_LMA))
++ {
++ pr_err("PDPTR0 = 0x%016llx PDPTR1 = 0x%016llx\n",
++ vmcs_read64(GUEST_PDPTR0), vmcs_read64(GUEST_PDPTR1));
++ pr_err("PDPTR2 = 0x%016llx PDPTR3 = 0x%016llx\n",
++ vmcs_read64(GUEST_PDPTR2), vmcs_read64(GUEST_PDPTR3));
++ }
++ pr_err("RSP = 0x%016lx RIP = 0x%016lx\n",
++ vmcs_readl(GUEST_RSP), vmcs_readl(GUEST_RIP));
++ pr_err("RFLAGS=0x%08lx DR7 = 0x%016lx\n",
++ vmcs_readl(GUEST_RFLAGS), vmcs_readl(GUEST_DR7));
++ pr_err("Sysenter RSP=%016lx CS:RIP=%04x:%016lx\n",
++ vmcs_readl(GUEST_SYSENTER_ESP),
++ vmcs_read32(GUEST_SYSENTER_CS), vmcs_readl(GUEST_SYSENTER_EIP));
++ vmx_dump_sel("CS: ", GUEST_CS_SELECTOR);
++ vmx_dump_sel("DS: ", GUEST_DS_SELECTOR);
++ vmx_dump_sel("SS: ", GUEST_SS_SELECTOR);
++ vmx_dump_sel("ES: ", GUEST_ES_SELECTOR);
++ vmx_dump_sel("FS: ", GUEST_FS_SELECTOR);
++ vmx_dump_sel("GS: ", GUEST_GS_SELECTOR);
++ vmx_dump_dtsel("GDTR:", GUEST_GDTR_LIMIT);
++ vmx_dump_sel("LDTR:", GUEST_LDTR_SELECTOR);
++ vmx_dump_dtsel("IDTR:", GUEST_IDTR_LIMIT);
++ vmx_dump_sel("TR: ", GUEST_TR_SELECTOR);
++ if ((vmexit_ctl & (VM_EXIT_SAVE_IA32_PAT | VM_EXIT_SAVE_IA32_EFER)) ||
++ (vmentry_ctl & (VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_IA32_EFER)))
++ pr_err("EFER = 0x%016llx PAT = 0x%016llx\n",
++ efer, vmcs_read64(GUEST_IA32_PAT));
++ pr_err("DebugCtl = 0x%016llx DebugExceptions = 0x%016lx\n",
++ vmcs_read64(GUEST_IA32_DEBUGCTL),
++ vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS));
++ if (cpu_has_load_perf_global_ctrl() &&
++ vmentry_ctl & VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL)
++ pr_err("PerfGlobCtl = 0x%016llx\n",
++ vmcs_read64(GUEST_IA32_PERF_GLOBAL_CTRL));
++ if (vmentry_ctl & VM_ENTRY_LOAD_BNDCFGS)
++ pr_err("BndCfgS = 0x%016llx\n", vmcs_read64(GUEST_BNDCFGS));
++ pr_err("Interruptibility = %08x ActivityState = %08x\n",
++ vmcs_read32(GUEST_INTERRUPTIBILITY_INFO),
++ vmcs_read32(GUEST_ACTIVITY_STATE));
++ if (secondary_exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY)
++ pr_err("InterruptStatus = %04x\n",
++ vmcs_read16(GUEST_INTR_STATUS));
++
++ pr_err("*** Host State ***\n");
++ pr_err("RIP = 0x%016lx RSP = 0x%016lx\n",
++ vmcs_readl(HOST_RIP), vmcs_readl(HOST_RSP));
++ pr_err("CS=%04x SS=%04x DS=%04x ES=%04x FS=%04x GS=%04x TR=%04x\n",
++ vmcs_read16(HOST_CS_SELECTOR), vmcs_read16(HOST_SS_SELECTOR),
++ vmcs_read16(HOST_DS_SELECTOR), vmcs_read16(HOST_ES_SELECTOR),
++ vmcs_read16(HOST_FS_SELECTOR), vmcs_read16(HOST_GS_SELECTOR),
++ vmcs_read16(HOST_TR_SELECTOR));
++ pr_err("FSBase=%016lx GSBase=%016lx TRBase=%016lx\n",
++ vmcs_readl(HOST_FS_BASE), vmcs_readl(HOST_GS_BASE),
++ vmcs_readl(HOST_TR_BASE));
++ pr_err("GDTBase=%016lx IDTBase=%016lx\n",
++ vmcs_readl(HOST_GDTR_BASE), vmcs_readl(HOST_IDTR_BASE));
++ pr_err("CR0=%016lx CR3=%016lx CR4=%016lx\n",
++ vmcs_readl(HOST_CR0), vmcs_readl(HOST_CR3),
++ vmcs_readl(HOST_CR4));
++ pr_err("Sysenter RSP=%016lx CS:RIP=%04x:%016lx\n",
++ vmcs_readl(HOST_IA32_SYSENTER_ESP),
++ vmcs_read32(HOST_IA32_SYSENTER_CS),
++ vmcs_readl(HOST_IA32_SYSENTER_EIP));
++ if (vmexit_ctl & (VM_EXIT_LOAD_IA32_PAT | VM_EXIT_LOAD_IA32_EFER))
++ pr_err("EFER = 0x%016llx PAT = 0x%016llx\n",
++ vmcs_read64(HOST_IA32_EFER),
++ vmcs_read64(HOST_IA32_PAT));
++ if (cpu_has_load_perf_global_ctrl() &&
++ vmexit_ctl & VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL)
++ pr_err("PerfGlobCtl = 0x%016llx\n",
++ vmcs_read64(HOST_IA32_PERF_GLOBAL_CTRL));
++
++ pr_err("*** Control State ***\n");
++ pr_err("PinBased=%08x CPUBased=%08x SecondaryExec=%08x\n",
++ pin_based_exec_ctrl, cpu_based_exec_ctrl, secondary_exec_control);
++ pr_err("EntryControls=%08x ExitControls=%08x\n", vmentry_ctl, vmexit_ctl);
++ pr_err("ExceptionBitmap=%08x PFECmask=%08x PFECmatch=%08x\n",
++ vmcs_read32(EXCEPTION_BITMAP),
++ vmcs_read32(PAGE_FAULT_ERROR_CODE_MASK),
++ vmcs_read32(PAGE_FAULT_ERROR_CODE_MATCH));
++ pr_err("VMEntry: intr_info=%08x errcode=%08x ilen=%08x\n",
++ vmcs_read32(VM_ENTRY_INTR_INFO_FIELD),
++ vmcs_read32(VM_ENTRY_EXCEPTION_ERROR_CODE),
++ vmcs_read32(VM_ENTRY_INSTRUCTION_LEN));
++ pr_err("VMExit: intr_info=%08x errcode=%08x ilen=%08x\n",
++ vmcs_read32(VM_EXIT_INTR_INFO),
++ vmcs_read32(VM_EXIT_INTR_ERROR_CODE),
++ vmcs_read32(VM_EXIT_INSTRUCTION_LEN));
++ pr_err(" reason=%08x qualification=%016lx\n",
++ vmcs_read32(VM_EXIT_REASON), vmcs_readl(EXIT_QUALIFICATION));
++ pr_err("IDTVectoring: info=%08x errcode=%08x\n",
++ vmcs_read32(IDT_VECTORING_INFO_FIELD),
++ vmcs_read32(IDT_VECTORING_ERROR_CODE));
++ pr_err("TSC Offset = 0x%016llx\n", vmcs_read64(TSC_OFFSET));
++ if (secondary_exec_control & SECONDARY_EXEC_TSC_SCALING)
++ pr_err("TSC Multiplier = 0x%016llx\n",
++ vmcs_read64(TSC_MULTIPLIER));
++ if (cpu_based_exec_ctrl & CPU_BASED_TPR_SHADOW) {
++ if (secondary_exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY) {
++ u16 status = vmcs_read16(GUEST_INTR_STATUS);
++ pr_err("SVI|RVI = %02x|%02x ", status >> 8, status & 0xff);
++ }
++ pr_cont("TPR Threshold = 0x%02x\n", vmcs_read32(TPR_THRESHOLD));
++ if (secondary_exec_control & SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)
++ pr_err("APIC-access addr = 0x%016llx ", vmcs_read64(APIC_ACCESS_ADDR));
++ pr_cont("virt-APIC addr = 0x%016llx\n", vmcs_read64(VIRTUAL_APIC_PAGE_ADDR));
++ }
++ if (pin_based_exec_ctrl & PIN_BASED_POSTED_INTR)
++ pr_err("PostedIntrVec = 0x%02x\n", vmcs_read16(POSTED_INTR_NV));
++ if ((secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT))
++ pr_err("EPT pointer = 0x%016llx\n", vmcs_read64(EPT_POINTER));
++ n = vmcs_read32(CR3_TARGET_COUNT);
++ for (i = 0; i + 1 < n; i += 4)
++ pr_err("CR3 target%u=%016lx target%u=%016lx\n",
++ i, vmcs_readl(CR3_TARGET_VALUE0 + i * 2),
++ i + 1, vmcs_readl(CR3_TARGET_VALUE0 + i * 2 + 2));
++ if (i < n)
++ pr_err("CR3 target%u=%016lx\n",
++ i, vmcs_readl(CR3_TARGET_VALUE0 + i * 2));
++ if (secondary_exec_control & SECONDARY_EXEC_PAUSE_LOOP_EXITING)
++ pr_err("PLE Gap=%08x Window=%08x\n",
++ vmcs_read32(PLE_GAP), vmcs_read32(PLE_WINDOW));
++ if (secondary_exec_control & SECONDARY_EXEC_ENABLE_VPID)
++ pr_err("Virtual processor ID = 0x%04x\n",
++ vmcs_read16(VIRTUAL_PROCESSOR_ID));
++}
++
++/*
++ * The guest has exited. See if we can fix it or if we need userspace
++ * assistance.
++ */
++static int vmx_handle_exit(struct kvm_vcpu *vcpu,
++ enum exit_fastpath_completion exit_fastpath)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 exit_reason = vmx->exit_reason;
++ u32 vectoring_info = vmx->idt_vectoring_info;
++
++ trace_kvm_exit(exit_reason, vcpu, KVM_ISA_VMX);
++
++ /*
++ * Flush logged GPAs PML buffer, this will make dirty_bitmap more
++ * updated. Another good is, in kvm_vm_ioctl_get_dirty_log, before
++ * querying dirty_bitmap, we only need to kick all vcpus out of guest
++ * mode as if vcpus is in root mode, the PML buffer must has been
++ * flushed already.
++ */
++ if (enable_pml)
++ vmx_flush_pml_buffer(vcpu);
++
++ /* If guest state is invalid, start emulating */
++ if (vmx->emulation_required)
++ return handle_invalid_guest_state(vcpu);
++
++ if (is_guest_mode(vcpu) && nested_vmx_exit_reflected(vcpu, exit_reason))
++ return nested_vmx_reflect_vmexit(vcpu, exit_reason);
++
++ if (exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY) {
++ dump_vmcs();
++ vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
++ vcpu->run->fail_entry.hardware_entry_failure_reason
++ = exit_reason;
++ return 0;
++ }
++
++ if (unlikely(vmx->fail)) {
++ dump_vmcs();
++ vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
++ vcpu->run->fail_entry.hardware_entry_failure_reason
++ = vmcs_read32(VM_INSTRUCTION_ERROR);
++ return 0;
++ }
++
++ /*
++ * Note:
++ * Do not try to fix EXIT_REASON_EPT_MISCONFIG if it caused by
++ * delivery event since it indicates guest is accessing MMIO.
++ * The vm-exit can be triggered again after return to guest that
++ * will cause infinite loop.
++ */
++ if ((vectoring_info & VECTORING_INFO_VALID_MASK) &&
++ (exit_reason != EXIT_REASON_EXCEPTION_NMI &&
++ exit_reason != EXIT_REASON_EPT_VIOLATION &&
++ exit_reason != EXIT_REASON_PML_FULL &&
++ exit_reason != EXIT_REASON_TASK_SWITCH)) {
++ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
++ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV;
++ vcpu->run->internal.ndata = 3;
++ vcpu->run->internal.data[0] = vectoring_info;
++ vcpu->run->internal.data[1] = exit_reason;
++ vcpu->run->internal.data[2] = vcpu->arch.exit_qualification;
++ if (exit_reason == EXIT_REASON_EPT_MISCONFIG) {
++ vcpu->run->internal.ndata++;
++ vcpu->run->internal.data[3] =
++ vmcs_read64(GUEST_PHYSICAL_ADDRESS);
++ }
++ return 0;
++ }
++
++ if (unlikely(!enable_vnmi &&
++ vmx->loaded_vmcs->soft_vnmi_blocked)) {
++ if (vmx_interrupt_allowed(vcpu)) {
++ vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++ } else if (vmx->loaded_vmcs->vnmi_blocked_time > 1000000000LL &&
++ vcpu->arch.nmi_pending) {
++ /*
++ * This CPU don't support us in finding the end of an
++ * NMI-blocked window if the guest runs with IRQs
++ * disabled. So we pull the trigger after 1 s of
++ * futile waiting, but inform the user about this.
++ */
++ printk(KERN_WARNING "%s: Breaking out of NMI-blocked "
++ "state on VCPU %d after 1 s timeout\n",
++ __func__, vcpu->vcpu_id);
++ vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++ }
++ }
++
++ if (exit_fastpath == EXIT_FASTPATH_SKIP_EMUL_INS) {
++ kvm_skip_emulated_instruction(vcpu);
++ return 1;
++ } else if (exit_reason < kvm_vmx_max_exit_handlers
++ && kvm_vmx_exit_handlers[exit_reason]) {
++#ifdef CONFIG_RETPOLINE
++ if (exit_reason == EXIT_REASON_MSR_WRITE)
++ return kvm_emulate_wrmsr(vcpu);
++ else if (exit_reason == EXIT_REASON_PREEMPTION_TIMER)
++ return handle_preemption_timer(vcpu);
++ else if (exit_reason == EXIT_REASON_INTERRUPT_WINDOW)
++ return handle_interrupt_window(vcpu);
++ else if (exit_reason == EXIT_REASON_EXTERNAL_INTERRUPT)
++ return handle_external_interrupt(vcpu);
++ else if (exit_reason == EXIT_REASON_HLT)
++ return kvm_emulate_halt(vcpu);
++ else if (exit_reason == EXIT_REASON_EPT_MISCONFIG)
++ return handle_ept_misconfig(vcpu);
++#endif
++ return kvm_vmx_exit_handlers[exit_reason](vcpu);
++ } else {
++ vcpu_unimpl(vcpu, "vmx: unexpected exit reason 0x%x\n",
++ exit_reason);
++ dump_vmcs();
++ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
++ vcpu->run->internal.suberror =
++ KVM_INTERNAL_ERROR_UNEXPECTED_EXIT_REASON;
++ vcpu->run->internal.ndata = 1;
++ vcpu->run->internal.data[0] = exit_reason;
++ return 0;
++ }
++}
++
++/*
++ * Software based L1D cache flush which is used when microcode providing
++ * the cache control MSR is not loaded.
++ *
++ * The L1D cache is 32 KiB on Nehalem and later microarchitectures, but to
++ * flush it is required to read in 64 KiB because the replacement algorithm
++ * is not exactly LRU. This could be sized at runtime via topology
++ * information but as all relevant affected CPUs have 32KiB L1D cache size
++ * there is no point in doing so.
++ */
++static void vmx_l1d_flush(struct kvm_vcpu *vcpu)
++{
++ int size = PAGE_SIZE << L1D_CACHE_ORDER;
++
++ /*
++ * This code is only executed when the the flush mode is 'cond' or
++ * 'always'
++ */
++ if (static_branch_likely(&vmx_l1d_flush_cond)) {
++ bool flush_l1d;
++
++ /*
++ * Clear the per-vcpu flush bit, it gets set again
++ * either from vcpu_run() or from one of the unsafe
++ * VMEXIT handlers.
++ */
++ flush_l1d = vcpu->arch.l1tf_flush_l1d;
++ vcpu->arch.l1tf_flush_l1d = false;
++
++ /*
++ * Clear the per-cpu flush bit, it gets set again from
++ * the interrupt handlers.
++ */
++ flush_l1d |= kvm_get_cpu_l1tf_flush_l1d();
++ kvm_clear_cpu_l1tf_flush_l1d();
++
++ if (!flush_l1d)
++ return;
++ }
++
++ vcpu->stat.l1d_flush++;
++
++ if (static_cpu_has(X86_FEATURE_FLUSH_L1D)) {
++ wrmsrl(MSR_IA32_FLUSH_CMD, L1D_FLUSH);
++ return;
++ }
++
++ asm volatile(
++ /* First ensure the pages are in the TLB */
++ "xorl %%eax, %%eax\n"
++ ".Lpopulate_tlb:\n\t"
++ "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t"
++ "addl $4096, %%eax\n\t"
++ "cmpl %%eax, %[size]\n\t"
++ "jne .Lpopulate_tlb\n\t"
++ "xorl %%eax, %%eax\n\t"
++ "cpuid\n\t"
++ /* Now fill the cache */
++ "xorl %%eax, %%eax\n"
++ ".Lfill_cache:\n"
++ "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t"
++ "addl $64, %%eax\n\t"
++ "cmpl %%eax, %[size]\n\t"
++ "jne .Lfill_cache\n\t"
++ "lfence\n"
++ :: [flush_pages] "r" (vmx_l1d_flush_pages),
++ [size] "r" (size)
++ : "eax", "ebx", "ecx", "edx");
++}
++
++static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ int tpr_threshold;
++
++ if (is_guest_mode(vcpu) &&
++ nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
++ return;
++
++ tpr_threshold = (irr == -1 || tpr < irr) ? 0 : irr;
++ if (is_guest_mode(vcpu))
++ to_vmx(vcpu)->nested.l1_tpr_threshold = tpr_threshold;
++ else
++ vmcs_write32(TPR_THRESHOLD, tpr_threshold);
++}
++
++void vmx_set_virtual_apic_mode(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 sec_exec_control;
++
++ if (!lapic_in_kernel(vcpu))
++ return;
++
++ if (!flexpriority_enabled &&
++ !cpu_has_vmx_virtualize_x2apic_mode())
++ return;
++
++ /* Postpone execution until vmcs01 is the current VMCS. */
++ if (is_guest_mode(vcpu)) {
++ vmx->nested.change_vmcs01_virtual_apic_mode = true;
++ return;
++ }
++
++ sec_exec_control = secondary_exec_controls_get(vmx);
++ sec_exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE);
++
++ switch (kvm_get_apic_mode(vcpu)) {
++ case LAPIC_MODE_INVALID:
++ WARN_ONCE(true, "Invalid local APIC state");
++ case LAPIC_MODE_DISABLED:
++ break;
++ case LAPIC_MODE_XAPIC:
++ if (flexpriority_enabled) {
++ sec_exec_control |=
++ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
++ vmx_flush_tlb(vcpu, true);
++ }
++ break;
++ case LAPIC_MODE_X2APIC:
++ if (cpu_has_vmx_virtualize_x2apic_mode())
++ sec_exec_control |=
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
++ break;
++ }
++ secondary_exec_controls_set(vmx, sec_exec_control);
++
++ vmx_update_msr_bitmap(vcpu);
++}
++
++static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa)
++{
++ if (!is_guest_mode(vcpu)) {
++ vmcs_write64(APIC_ACCESS_ADDR, hpa);
++ vmx_flush_tlb(vcpu, true);
++ }
++}
++
++static void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)
++{
++ u16 status;
++ u8 old;
++
++ if (max_isr == -1)
++ max_isr = 0;
++
++ status = vmcs_read16(GUEST_INTR_STATUS);
++ old = status >> 8;
++ if (max_isr != old) {
++ status &= 0xff;
++ status |= max_isr << 8;
++ vmcs_write16(GUEST_INTR_STATUS, status);
++ }
++}
++
++static void vmx_set_rvi(int vector)
++{
++ u16 status;
++ u8 old;
++
++ if (vector == -1)
++ vector = 0;
++
++ status = vmcs_read16(GUEST_INTR_STATUS);
++ old = (u8)status & 0xff;
++ if ((u8)vector != old) {
++ status &= ~0xff;
++ status |= (u8)vector;
++ vmcs_write16(GUEST_INTR_STATUS, status);
++ }
++}
++
++static void vmx_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr)
++{
++ /*
++ * When running L2, updating RVI is only relevant when
++ * vmcs12 virtual-interrupt-delivery enabled.
++ * However, it can be enabled only when L1 also
++ * intercepts external-interrupts and in that case
++ * we should not update vmcs02 RVI but instead intercept
++ * interrupt. Therefore, do nothing when running L2.
++ */
++ if (!is_guest_mode(vcpu))
++ vmx_set_rvi(max_irr);
++}
++
++static int vmx_sync_pir_to_irr(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int max_irr;
++ bool max_irr_updated;
++
++ WARN_ON(!vcpu->arch.apicv_active);
++ if (pi_test_on(&vmx->pi_desc)) {
++ pi_clear_on(&vmx->pi_desc);
++ /*
++ * IOMMU can write to PID.ON, so the barrier matters even on UP.
++ * But on x86 this is just a compiler barrier anyway.
++ */
++ smp_mb__after_atomic();
++ max_irr_updated =
++ kvm_apic_update_irr(vcpu, vmx->pi_desc.pir, &max_irr);
++
++ /*
++ * If we are running L2 and L1 has a new pending interrupt
++ * which can be injected, we should re-evaluate
++ * what should be done with this new L1 interrupt.
++ * If L1 intercepts external-interrupts, we should
++ * exit from L2 to L1. Otherwise, interrupt should be
++ * delivered directly to L2.
++ */
++ if (is_guest_mode(vcpu) && max_irr_updated) {
++ if (nested_exit_on_intr(vcpu))
++ kvm_vcpu_exiting_guest_mode(vcpu);
++ else
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
++ }
++ } else {
++ max_irr = kvm_lapic_find_highest_irr(vcpu);
++ }
++ vmx_hwapic_irr_update(vcpu, max_irr);
++ return max_irr;
++}
++
++static bool vmx_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
++{
++ struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
++
++ return pi_test_on(pi_desc) ||
++ (pi_test_sn(pi_desc) && !pi_is_pir_empty(pi_desc));
++}
++
++static void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
++{
++ if (!kvm_vcpu_apicv_active(vcpu))
++ return;
++
++ vmcs_write64(EOI_EXIT_BITMAP0, eoi_exit_bitmap[0]);
++ vmcs_write64(EOI_EXIT_BITMAP1, eoi_exit_bitmap[1]);
++ vmcs_write64(EOI_EXIT_BITMAP2, eoi_exit_bitmap[2]);
++ vmcs_write64(EOI_EXIT_BITMAP3, eoi_exit_bitmap[3]);
++}
++
++static void vmx_apicv_post_state_restore(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ pi_clear_on(&vmx->pi_desc);
++ memset(vmx->pi_desc.pir, 0, sizeof(vmx->pi_desc.pir));
++}
++
++static void handle_exception_nmi_irqoff(struct vcpu_vmx *vmx)
++{
++ vmx->exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++
++ /* if exit due to PF check for async PF */
++ if (is_page_fault(vmx->exit_intr_info))
++ vmx->vcpu.arch.apf.host_apf_reason = kvm_read_and_reset_pf_reason();
++
++ /* Handle machine checks before interrupts are enabled */
++ if (is_machine_check(vmx->exit_intr_info))
++ kvm_machine_check();
++
++ /* We need to handle NMIs before interrupts are enabled */
++ if (is_nmi(vmx->exit_intr_info)) {
++ kvm_before_interrupt(&vmx->vcpu);
++ asm("int $2");
++ kvm_after_interrupt(&vmx->vcpu);
++ }
++}
++
++static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu)
++{
++ unsigned int vector;
++ unsigned long entry;
++#ifdef CONFIG_X86_64
++ unsigned long tmp;
++#endif
++ gate_desc *desc;
++ u32 intr_info;
++
++ intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++ if (WARN_ONCE(!is_external_intr(intr_info),
++ "KVM: unexpected VM-Exit interrupt info: 0x%x", intr_info))
++ return;
++
++ vector = intr_info & INTR_INFO_VECTOR_MASK;
++ desc = (gate_desc *)host_idt_base + vector;
++ entry = gate_offset(desc);
++
++ kvm_before_interrupt(vcpu);
++
++ asm volatile(
++#ifdef CONFIG_X86_64
++ "mov %%" _ASM_SP ", %[sp]\n\t"
++ "and $0xfffffffffffffff0, %%" _ASM_SP "\n\t"
++ "push $%c[ss]\n\t"
++ "push %[sp]\n\t"
++#endif
++ "pushf\n\t"
++ __ASM_SIZE(push) " $%c[cs]\n\t"
++ CALL_NOSPEC
++ :
++#ifdef CONFIG_X86_64
++ [sp]"=&r"(tmp),
++#endif
++ ASM_CALL_CONSTRAINT
++ :
++ THUNK_TARGET(entry),
++ [ss]"i"(__KERNEL_DS),
++ [cs]"i"(__KERNEL_CS)
++ );
++
++ kvm_after_interrupt(vcpu);
++}
++STACK_FRAME_NON_STANDARD(handle_external_interrupt_irqoff);
++
++static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu,
++ enum exit_fastpath_completion *exit_fastpath)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (vmx->exit_reason == EXIT_REASON_EXTERNAL_INTERRUPT)
++ handle_external_interrupt_irqoff(vcpu);
++ else if (vmx->exit_reason == EXIT_REASON_EXCEPTION_NMI)
++ handle_exception_nmi_irqoff(vmx);
++ else if (!is_guest_mode(vcpu) &&
++ vmx->exit_reason == EXIT_REASON_MSR_WRITE)
++ *exit_fastpath = handle_fastpath_set_msr_irqoff(vcpu);
++}
++
++static bool vmx_has_emulated_msr(int index)
++{
++ switch (index) {
++ case MSR_IA32_SMBASE:
++ /*
++ * We cannot do SMM unless we can run the guest in big
++ * real mode.
++ */
++ return enable_unrestricted_guest || emulate_invalid_guest_state;
++ case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
++ return nested;
++ case MSR_AMD64_VIRT_SPEC_CTRL:
++ /* This is AMD only. */
++ return false;
++ default:
++ return true;
++ }
++}
++
++static bool vmx_pt_supported(void)
++{
++ return pt_mode == PT_MODE_HOST_GUEST;
++}
++
++static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
++{
++ u32 exit_intr_info;
++ bool unblock_nmi;
++ u8 vector;
++ bool idtv_info_valid;
++
++ idtv_info_valid = vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK;
++
++ if (enable_vnmi) {
++ if (vmx->loaded_vmcs->nmi_known_unmasked)
++ return;
++ /*
++ * Can't use vmx->exit_intr_info since we're not sure what
++ * the exit reason is.
++ */
++ exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++ unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
++ vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
++ /*
++ * SDM 3: 27.7.1.2 (September 2008)
++ * Re-set bit "block by NMI" before VM entry if vmexit caused by
++ * a guest IRET fault.
++ * SDM 3: 23.2.2 (September 2008)
++ * Bit 12 is undefined in any of the following cases:
++ * If the VM exit sets the valid bit in the IDT-vectoring
++ * information field.
++ * If the VM exit is due to a double fault.
++ */
++ if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
++ vector != DF_VECTOR && !idtv_info_valid)
++ vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++ GUEST_INTR_STATE_NMI);
++ else
++ vmx->loaded_vmcs->nmi_known_unmasked =
++ !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
++ & GUEST_INTR_STATE_NMI);
++ } else if (unlikely(vmx->loaded_vmcs->soft_vnmi_blocked))
++ vmx->loaded_vmcs->vnmi_blocked_time +=
++ ktime_to_ns(ktime_sub(ktime_get(),
++ vmx->loaded_vmcs->entry_time));
++}
++
++static void __vmx_complete_interrupts(struct kvm_vcpu *vcpu,
++ u32 idt_vectoring_info,
++ int instr_len_field,
++ int error_code_field)
++{
++ u8 vector;
++ int type;
++ bool idtv_info_valid;
++
++ idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
++
++ vcpu->arch.nmi_injected = false;
++ kvm_clear_exception_queue(vcpu);
++ kvm_clear_interrupt_queue(vcpu);
++
++ if (!idtv_info_valid)
++ return;
++
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
++
++ vector = idt_vectoring_info & VECTORING_INFO_VECTOR_MASK;
++ type = idt_vectoring_info & VECTORING_INFO_TYPE_MASK;
++
++ switch (type) {
++ case INTR_TYPE_NMI_INTR:
++ vcpu->arch.nmi_injected = true;
++ /*
++ * SDM 3: 27.7.1.2 (September 2008)
++ * Clear bit "block by NMI" before VM entry if a NMI
++ * delivery faulted.
++ */
++ vmx_set_nmi_mask(vcpu, false);
++ break;
++ case INTR_TYPE_SOFT_EXCEPTION:
++ vcpu->arch.event_exit_inst_len = vmcs_read32(instr_len_field);
++ /* fall through */
++ case INTR_TYPE_HARD_EXCEPTION:
++ if (idt_vectoring_info & VECTORING_INFO_DELIVER_CODE_MASK) {
++ u32 err = vmcs_read32(error_code_field);
++ kvm_requeue_exception_e(vcpu, vector, err);
++ } else
++ kvm_requeue_exception(vcpu, vector);
++ break;
++ case INTR_TYPE_SOFT_INTR:
++ vcpu->arch.event_exit_inst_len = vmcs_read32(instr_len_field);
++ /* fall through */
++ case INTR_TYPE_EXT_INTR:
++ kvm_queue_interrupt(vcpu, vector, type == INTR_TYPE_SOFT_INTR);
++ break;
++ default:
++ break;
++ }
++}
++
++static void vmx_complete_interrupts(struct vcpu_vmx *vmx)
++{
++ __vmx_complete_interrupts(&vmx->vcpu, vmx->idt_vectoring_info,
++ VM_EXIT_INSTRUCTION_LEN,
++ IDT_VECTORING_ERROR_CODE);
++}
++
++static void vmx_cancel_injection(struct kvm_vcpu *vcpu)
++{
++ __vmx_complete_interrupts(vcpu,
++ vmcs_read32(VM_ENTRY_INTR_INFO_FIELD),
++ VM_ENTRY_INSTRUCTION_LEN,
++ VM_ENTRY_EXCEPTION_ERROR_CODE);
++
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0);
++}
++
++static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx)
++{
++ int i, nr_msrs;
++ struct perf_guest_switch_msr *msrs;
++
++ msrs = perf_guest_get_msrs(&nr_msrs);
++
++ if (!msrs)
++ return;
++
++ for (i = 0; i < nr_msrs; i++)
++ if (msrs[i].host == msrs[i].guest)
++ clear_atomic_switch_msr(vmx, msrs[i].msr);
++ else
++ add_atomic_switch_msr(vmx, msrs[i].msr, msrs[i].guest,
++ msrs[i].host, false);
++}
++
++static void atomic_switch_umwait_control_msr(struct vcpu_vmx *vmx)
++{
++ u32 host_umwait_control;
++
++ if (!vmx_has_waitpkg(vmx))
++ return;
++
++ host_umwait_control = get_umwait_control_msr();
++
++ if (vmx->msr_ia32_umwait_control != host_umwait_control)
++ add_atomic_switch_msr(vmx, MSR_IA32_UMWAIT_CONTROL,
++ vmx->msr_ia32_umwait_control,
++ host_umwait_control, false);
++ else
++ clear_atomic_switch_msr(vmx, MSR_IA32_UMWAIT_CONTROL);
++}
++
++static void vmx_update_hv_timer(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u64 tscl;
++ u32 delta_tsc;
++
++ if (vmx->req_immediate_exit) {
++ vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, 0);
++ vmx->loaded_vmcs->hv_timer_soft_disabled = false;
++ } else if (vmx->hv_deadline_tsc != -1) {
++ tscl = rdtsc();
++ if (vmx->hv_deadline_tsc > tscl)
++ /* set_hv_timer ensures the delta fits in 32-bits */
++ delta_tsc = (u32)((vmx->hv_deadline_tsc - tscl) >>
++ cpu_preemption_timer_multi);
++ else
++ delta_tsc = 0;
++
++ vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, delta_tsc);
++ vmx->loaded_vmcs->hv_timer_soft_disabled = false;
++ } else if (!vmx->loaded_vmcs->hv_timer_soft_disabled) {
++ vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, -1);
++ vmx->loaded_vmcs->hv_timer_soft_disabled = true;
++ }
++}
++
++void vmx_update_host_rsp(struct vcpu_vmx *vmx, unsigned long host_rsp)
++{
++ if (unlikely(host_rsp != vmx->loaded_vmcs->host_state.rsp)) {
++ vmx->loaded_vmcs->host_state.rsp = host_rsp;
++ vmcs_writel(HOST_RSP, host_rsp);
++ }
++}
++
++bool __vmx_vcpu_run(struct vcpu_vmx *vmx, unsigned long *regs, bool launched);
++
++static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long cr3, cr4;
++
++ /* Record the guest's net vcpu time for enforced NMI injections. */
++ if (unlikely(!enable_vnmi &&
++ vmx->loaded_vmcs->soft_vnmi_blocked))
++ vmx->loaded_vmcs->entry_time = ktime_get();
++
++ /* Don't enter VMX if guest state is invalid, let the exit handler
++ start emulation until we arrive back to a valid state */
++ if (vmx->emulation_required)
++ return;
++
++ if (vmx->ple_window_dirty) {
++ vmx->ple_window_dirty = false;
++ vmcs_write32(PLE_WINDOW, vmx->ple_window);
++ }
++
++ if (vmx->nested.need_vmcs12_to_shadow_sync)
++ nested_sync_vmcs12_to_shadow(vcpu);
++
++ if (kvm_register_is_dirty(vcpu, VCPU_REGS_RSP))
++ vmcs_writel(GUEST_RSP, vcpu->arch.regs[VCPU_REGS_RSP]);
++ if (kvm_register_is_dirty(vcpu, VCPU_REGS_RIP))
++ vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
++
++ cr3 = __get_current_cr3_fast();
++ if (unlikely(cr3 != vmx->loaded_vmcs->host_state.cr3)) {
++ vmcs_writel(HOST_CR3, cr3);
++ vmx->loaded_vmcs->host_state.cr3 = cr3;
++ }
++
++ cr4 = cr4_read_shadow();
++ if (unlikely(cr4 != vmx->loaded_vmcs->host_state.cr4)) {
++ vmcs_writel(HOST_CR4, cr4);
++ vmx->loaded_vmcs->host_state.cr4 = cr4;
++ }
++
++ /* When single-stepping over STI and MOV SS, we must clear the
++ * corresponding interruptibility bits in the guest state. Otherwise
++ * vmentry fails as it then expects bit 14 (BS) in pending debug
++ * exceptions being set, but that's not correct for the guest debugging
++ * case. */
++ if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
++ vmx_set_interrupt_shadow(vcpu, 0);
++
++ kvm_load_guest_xsave_state(vcpu);
++
++ if (static_cpu_has(X86_FEATURE_PKU) &&
++ kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
++ vcpu->arch.pkru != vmx->host_pkru)
++ __write_pkru(vcpu->arch.pkru);
++
++ pt_guest_enter(vmx);
++
++ atomic_switch_perf_msrs(vmx);
++ atomic_switch_umwait_control_msr(vmx);
++
++ if (enable_preemption_timer)
++ vmx_update_hv_timer(vcpu);
++
++ if (lapic_in_kernel(vcpu) &&
++ vcpu->arch.apic->lapic_timer.timer_advance_ns)
++ kvm_wait_lapic_expire(vcpu);
++
++ /*
++ * If this vCPU has touched SPEC_CTRL, restore the guest's value if
++ * it's non-zero. Since vmentry is serialising on affected CPUs, there
++ * is no need to worry about the conditional branch over the wrmsr
++ * being speculatively taken.
++ */
++ x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
++
++ /* L1D Flush includes CPU buffer clear to mitigate MDS */
++ if (static_branch_unlikely(&vmx_l1d_should_flush))
++ vmx_l1d_flush(vcpu);
++ else if (static_branch_unlikely(&mds_user_clear))
++ mds_clear_cpu_buffers();
++
++ if (vcpu->arch.cr2 != read_cr2())
++ write_cr2(vcpu->arch.cr2);
++
++ vmx->fail = __vmx_vcpu_run(vmx, (unsigned long *)&vcpu->arch.regs,
++ vmx->loaded_vmcs->launched);
++
++ vcpu->arch.cr2 = read_cr2();
++
++ /*
++ * We do not use IBRS in the kernel. If this vCPU has used the
++ * SPEC_CTRL MSR it may have left it on; save the value and
++ * turn it off. This is much more efficient than blindly adding
++ * it to the atomic save/restore list. Especially as the former
++ * (Saving guest MSRs on vmexit) doesn't even exist in KVM.
++ *
++ * For non-nested case:
++ * If the L01 MSR bitmap does not intercept the MSR, then we need to
++ * save it.
++ *
++ * For nested case:
++ * If the L02 MSR bitmap does not intercept the MSR, then we need to
++ * save it.
++ */
++ if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)))
++ vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL);
++
++ x86_spec_ctrl_restore_host(vmx->spec_ctrl, 0);
++
++ /* All fields are clean at this point */
++ if (static_branch_unlikely(&enable_evmcs))
++ current_evmcs->hv_clean_fields |=
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL;
++
++ if (static_branch_unlikely(&enable_evmcs))
++ current_evmcs->hv_vp_id = vcpu->arch.hyperv.vp_index;
++
++ /* MSR_IA32_DEBUGCTLMSR is zeroed on vmexit. Restore it if needed */
++ if (vmx->host_debugctlmsr)
++ update_debugctlmsr(vmx->host_debugctlmsr);
++
++#ifndef CONFIG_X86_64
++ /*
++ * The sysexit path does not restore ds/es, so we must set them to
++ * a reasonable value ourselves.
++ *
++ * We can't defer this to vmx_prepare_switch_to_host() since that
++ * function may be executed in interrupt context, which saves and
++ * restore segments around it, nullifying its effect.
++ */
++ loadsegment(ds, __USER_DS);
++ loadsegment(es, __USER_DS);
++#endif
++
++ vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
++ | (1 << VCPU_EXREG_RFLAGS)
++ | (1 << VCPU_EXREG_PDPTR)
++ | (1 << VCPU_EXREG_SEGMENTS)
++ | (1 << VCPU_EXREG_CR3));
++ vcpu->arch.regs_dirty = 0;
++
++ pt_guest_exit(vmx);
++
++ /*
++ * eager fpu is enabled if PKEY is supported and CR4 is switched
++ * back on host, so it is safe to read guest PKRU from current
++ * XSAVE.
++ */
++ if (static_cpu_has(X86_FEATURE_PKU) &&
++ kvm_read_cr4_bits(vcpu, X86_CR4_PKE)) {
++ vcpu->arch.pkru = rdpkru();
++ if (vcpu->arch.pkru != vmx->host_pkru)
++ __write_pkru(vmx->host_pkru);
++ }
++
++ kvm_load_host_xsave_state(vcpu);
++
++ vmx->nested.nested_run_pending = 0;
++ vmx->idt_vectoring_info = 0;
++
++ vmx->exit_reason = vmx->fail ? 0xdead : vmcs_read32(VM_EXIT_REASON);
++ if ((u16)vmx->exit_reason == EXIT_REASON_MCE_DURING_VMENTRY)
++ kvm_machine_check();
++
++ if (vmx->fail || (vmx->exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY))
++ return;
++
++ vmx->loaded_vmcs->launched = 1;
++ vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
++
++ vmx_recover_nmi_blocking(vmx);
++ vmx_complete_interrupts(vmx);
++}
++
++static struct kvm *vmx_vm_alloc(void)
++{
++ struct kvm_vmx *kvm_vmx = __vmalloc(sizeof(struct kvm_vmx),
++ GFP_KERNEL_ACCOUNT | __GFP_ZERO,
++ PAGE_KERNEL);
++ return &kvm_vmx->kvm;
++}
++
++static void vmx_vm_free(struct kvm *kvm)
++{
++ kfree(kvm->arch.hyperv.hv_pa_pg);
++ vfree(to_kvm_vmx(kvm));
++}
++
++static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (enable_pml)
++ vmx_destroy_pml_buffer(vmx);
++ free_vpid(vmx->vpid);
++ nested_vmx_free_vcpu(vcpu);
++ free_loaded_vmcs(vmx->loaded_vmcs);
++ kvm_vcpu_uninit(vcpu);
++ kmem_cache_free(x86_fpu_cache, vmx->vcpu.arch.user_fpu);
++ kmem_cache_free(x86_fpu_cache, vmx->vcpu.arch.guest_fpu);
++ kmem_cache_free(kvm_vcpu_cache, vmx);
++}
++
++static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
++{
++ int err;
++ struct vcpu_vmx *vmx;
++ unsigned long *msr_bitmap;
++ int i, cpu;
++
++ BUILD_BUG_ON_MSG(offsetof(struct vcpu_vmx, vcpu) != 0,
++ "struct kvm_vcpu must be at offset 0 for arch usercopy region");
++
++ vmx = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL_ACCOUNT);
++ if (!vmx)
++ return ERR_PTR(-ENOMEM);
++
++ vmx->vcpu.arch.user_fpu = kmem_cache_zalloc(x86_fpu_cache,
++ GFP_KERNEL_ACCOUNT);
++ if (!vmx->vcpu.arch.user_fpu) {
++ printk(KERN_ERR "kvm: failed to allocate kvm userspace's fpu\n");
++ err = -ENOMEM;
++ goto free_partial_vcpu;
++ }
++
++ vmx->vcpu.arch.guest_fpu = kmem_cache_zalloc(x86_fpu_cache,
++ GFP_KERNEL_ACCOUNT);
++ if (!vmx->vcpu.arch.guest_fpu) {
++ printk(KERN_ERR "kvm: failed to allocate vcpu's fpu\n");
++ err = -ENOMEM;
++ goto free_user_fpu;
++ }
++
++ vmx->vpid = allocate_vpid();
++
++ err = kvm_vcpu_init(&vmx->vcpu, kvm, id);
++ if (err)
++ goto free_vcpu;
++
++ err = -ENOMEM;
++
++ /*
++ * If PML is turned on, failure on enabling PML just results in failure
++ * of creating the vcpu, therefore we can simplify PML logic (by
++ * avoiding dealing with cases, such as enabling PML partially on vcpus
++ * for the guest), etc.
++ */
++ if (enable_pml) {
++ vmx->pml_pg = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
++ if (!vmx->pml_pg)
++ goto uninit_vcpu;
++ }
++
++ BUILD_BUG_ON(ARRAY_SIZE(vmx_msr_index) != NR_SHARED_MSRS);
++
++ for (i = 0; i < ARRAY_SIZE(vmx_msr_index); ++i) {
++ u32 index = vmx_msr_index[i];
++ u32 data_low, data_high;
++ int j = vmx->nmsrs;
++
++ if (rdmsr_safe(index, &data_low, &data_high) < 0)
++ continue;
++ if (wrmsr_safe(index, data_low, data_high) < 0)
++ continue;
++
++ vmx->guest_msrs[j].index = i;
++ vmx->guest_msrs[j].data = 0;
++ switch (index) {
++ case MSR_IA32_TSX_CTRL:
++ /*
++ * No need to pass TSX_CTRL_CPUID_CLEAR through, so
++ * let's avoid changing CPUID bits under the host
++ * kernel's feet.
++ */
++ vmx->guest_msrs[j].mask = ~(u64)TSX_CTRL_CPUID_CLEAR;
++ break;
++ default:
++ vmx->guest_msrs[j].mask = -1ull;
++ break;
++ }
++ ++vmx->nmsrs;
++ }
++
++ err = alloc_loaded_vmcs(&vmx->vmcs01);
++ if (err < 0)
++ goto free_pml;
++
++ msr_bitmap = vmx->vmcs01.msr_bitmap;
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_TSC, MSR_TYPE_R);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_FS_BASE, MSR_TYPE_RW);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_GS_BASE, MSR_TYPE_RW);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_KERNEL_GS_BASE, MSR_TYPE_RW);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_CS, MSR_TYPE_RW);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_ESP, MSR_TYPE_RW);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_EIP, MSR_TYPE_RW);
++ if (kvm_cstate_in_guest(kvm)) {
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_CORE_C1_RES, MSR_TYPE_R);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_CORE_C3_RESIDENCY, MSR_TYPE_R);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_CORE_C6_RESIDENCY, MSR_TYPE_R);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_CORE_C7_RESIDENCY, MSR_TYPE_R);
++ }
++ vmx->msr_bitmap_mode = 0;
++
++ vmx->loaded_vmcs = &vmx->vmcs01;
++ cpu = get_cpu();
++ vmx_vcpu_load(&vmx->vcpu, cpu);
++ vmx->vcpu.cpu = cpu;
++ init_vmcs(vmx);
++ vmx_vcpu_put(&vmx->vcpu);
++ put_cpu();
++ if (cpu_need_virtualize_apic_accesses(&vmx->vcpu)) {
++ err = alloc_apic_access_page(kvm);
++ if (err)
++ goto free_vmcs;
++ }
++
++ if (enable_ept && !enable_unrestricted_guest) {
++ err = init_rmode_identity_map(kvm);
++ if (err)
++ goto free_vmcs;
++ }
++
++ if (nested)
++ nested_vmx_setup_ctls_msrs(&vmx->nested.msrs,
++ vmx_capability.ept,
++ kvm_vcpu_apicv_active(&vmx->vcpu));
++ else
++ memset(&vmx->nested.msrs, 0, sizeof(vmx->nested.msrs));
++
++ vmx->nested.posted_intr_nv = -1;
++ vmx->nested.current_vmptr = -1ull;
++
++ vmx->msr_ia32_feature_control_valid_bits = FEATURE_CONTROL_LOCKED;
++
++ /*
++ * Enforce invariant: pi_desc.nv is always either POSTED_INTR_VECTOR
++ * or POSTED_INTR_WAKEUP_VECTOR.
++ */
++ vmx->pi_desc.nv = POSTED_INTR_VECTOR;
++ vmx->pi_desc.sn = 1;
++
++ vmx->ept_pointer = INVALID_PAGE;
++
++ return &vmx->vcpu;
++
++free_vmcs:
++ free_loaded_vmcs(vmx->loaded_vmcs);
++free_pml:
++ vmx_destroy_pml_buffer(vmx);
++uninit_vcpu:
++ kvm_vcpu_uninit(&vmx->vcpu);
++free_vcpu:
++ free_vpid(vmx->vpid);
++ kmem_cache_free(x86_fpu_cache, vmx->vcpu.arch.guest_fpu);
++free_user_fpu:
++ kmem_cache_free(x86_fpu_cache, vmx->vcpu.arch.user_fpu);
++free_partial_vcpu:
++ kmem_cache_free(kvm_vcpu_cache, vmx);
++ return ERR_PTR(err);
++}
++
++#define L1TF_MSG_SMT "L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
++#define L1TF_MSG_L1D "L1TF CPU bug present and virtualization mitigation disabled, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
++
++static int vmx_vm_init(struct kvm *kvm)
++{
++ spin_lock_init(&to_kvm_vmx(kvm)->ept_pointer_lock);
++
++ if (!ple_gap)
++ kvm->arch.pause_in_guest = true;
++
++ if (boot_cpu_has(X86_BUG_L1TF) && enable_ept) {
++ switch (l1tf_mitigation) {
++ case L1TF_MITIGATION_OFF:
++ case L1TF_MITIGATION_FLUSH_NOWARN:
++ /* 'I explicitly don't care' is set */
++ break;
++ case L1TF_MITIGATION_FLUSH:
++ case L1TF_MITIGATION_FLUSH_NOSMT:
++ case L1TF_MITIGATION_FULL:
++ /*
++ * Warn upon starting the first VM in a potentially
++ * insecure environment.
++ */
++ if (sched_smt_active())
++ pr_warn_once(L1TF_MSG_SMT);
++ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER)
++ pr_warn_once(L1TF_MSG_L1D);
++ break;
++ case L1TF_MITIGATION_FULL_FORCE:
++ /* Flush is enforced */
++ break;
++ }
++ }
++ return 0;
++}
++
++static int __init vmx_check_processor_compat(void)
++{
++ struct vmcs_config vmcs_conf;
++ struct vmx_capability vmx_cap;
++
++ if (setup_vmcs_config(&vmcs_conf, &vmx_cap) < 0)
++ return -EIO;
++ if (nested)
++ nested_vmx_setup_ctls_msrs(&vmcs_conf.nested, vmx_cap.ept,
++ enable_apicv);
++ if (memcmp(&vmcs_config, &vmcs_conf, sizeof(struct vmcs_config)) != 0) {
++ printk(KERN_ERR "kvm: CPU %d feature inconsistency!\n",
++ smp_processor_id());
++ return -EIO;
++ }
++ return 0;
++}
++
++static u64 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
++{
++ u8 cache;
++ u64 ipat = 0;
++
++ /* For VT-d and EPT combination
++ * 1. MMIO: always map as UC
++ * 2. EPT with VT-d:
++ * a. VT-d without snooping control feature: can't guarantee the
++ * result, try to trust guest.
++ * b. VT-d with snooping control feature: snooping control feature of
++ * VT-d engine can guarantee the cache correctness. Just set it
++ * to WB to keep consistent with host. So the same as item 3.
++ * 3. EPT without VT-d: always map as WB and set IPAT=1 to keep
++ * consistent with host MTRR
++ */
++ if (is_mmio) {
++ cache = MTRR_TYPE_UNCACHABLE;
++ goto exit;
++ }
++
++ if (!kvm_arch_has_noncoherent_dma(vcpu->kvm)) {
++ ipat = VMX_EPT_IPAT_BIT;
++ cache = MTRR_TYPE_WRBACK;
++ goto exit;
++ }
++
++ if (kvm_read_cr0(vcpu) & X86_CR0_CD) {
++ ipat = VMX_EPT_IPAT_BIT;
++ if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
++ cache = MTRR_TYPE_WRBACK;
++ else
++ cache = MTRR_TYPE_UNCACHABLE;
++ goto exit;
++ }
++
++ cache = kvm_mtrr_get_guest_memory_type(vcpu, gfn);
++
++exit:
++ return (cache << VMX_EPT_MT_EPTE_SHIFT) | ipat;
++}
++
++static int vmx_get_lpage_level(void)
++{
++ if (enable_ept && !cpu_has_vmx_ept_1g_page())
++ return PT_DIRECTORY_LEVEL;
++ else
++ /* For shadow and EPT supported 1GB page */
++ return PT_PDPE_LEVEL;
++}
++
++static void vmcs_set_secondary_exec_control(struct vcpu_vmx *vmx)
++{
++ /*
++ * These bits in the secondary execution controls field
++ * are dynamic, the others are mostly based on the hypervisor
++ * architecture and the guest's CPUID. Do not touch the
++ * dynamic bits.
++ */
++ u32 mask =
++ SECONDARY_EXEC_SHADOW_VMCS |
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
++ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
++ SECONDARY_EXEC_DESC;
++
++ u32 new_ctl = vmx->secondary_exec_control;
++ u32 cur_ctl = secondary_exec_controls_get(vmx);
++
++ secondary_exec_controls_set(vmx, (new_ctl & ~mask) | (cur_ctl & mask));
++}
++
++/*
++ * Generate MSR_IA32_VMX_CR{0,4}_FIXED1 according to CPUID. Only set bits
++ * (indicating "allowed-1") if they are supported in the guest's CPUID.
++ */
++static void nested_vmx_cr_fixed1_bits_update(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct kvm_cpuid_entry2 *entry;
++
++ vmx->nested.msrs.cr0_fixed1 = 0xffffffff;
++ vmx->nested.msrs.cr4_fixed1 = X86_CR4_PCE;
++
++#define cr4_fixed1_update(_cr4_mask, _reg, _cpuid_mask) do { \
++ if (entry && (entry->_reg & (_cpuid_mask))) \
++ vmx->nested.msrs.cr4_fixed1 |= (_cr4_mask); \
++} while (0)
++
++ entry = kvm_find_cpuid_entry(vcpu, 0x1, 0);
++ cr4_fixed1_update(X86_CR4_VME, edx, bit(X86_FEATURE_VME));
++ cr4_fixed1_update(X86_CR4_PVI, edx, bit(X86_FEATURE_VME));
++ cr4_fixed1_update(X86_CR4_TSD, edx, bit(X86_FEATURE_TSC));
++ cr4_fixed1_update(X86_CR4_DE, edx, bit(X86_FEATURE_DE));
++ cr4_fixed1_update(X86_CR4_PSE, edx, bit(X86_FEATURE_PSE));
++ cr4_fixed1_update(X86_CR4_PAE, edx, bit(X86_FEATURE_PAE));
++ cr4_fixed1_update(X86_CR4_MCE, edx, bit(X86_FEATURE_MCE));
++ cr4_fixed1_update(X86_CR4_PGE, edx, bit(X86_FEATURE_PGE));
++ cr4_fixed1_update(X86_CR4_OSFXSR, edx, bit(X86_FEATURE_FXSR));
++ cr4_fixed1_update(X86_CR4_OSXMMEXCPT, edx, bit(X86_FEATURE_XMM));
++ cr4_fixed1_update(X86_CR4_VMXE, ecx, bit(X86_FEATURE_VMX));
++ cr4_fixed1_update(X86_CR4_SMXE, ecx, bit(X86_FEATURE_SMX));
++ cr4_fixed1_update(X86_CR4_PCIDE, ecx, bit(X86_FEATURE_PCID));
++ cr4_fixed1_update(X86_CR4_OSXSAVE, ecx, bit(X86_FEATURE_XSAVE));
++
++ entry = kvm_find_cpuid_entry(vcpu, 0x7, 0);
++ cr4_fixed1_update(X86_CR4_FSGSBASE, ebx, bit(X86_FEATURE_FSGSBASE));
++ cr4_fixed1_update(X86_CR4_SMEP, ebx, bit(X86_FEATURE_SMEP));
++ cr4_fixed1_update(X86_CR4_SMAP, ebx, bit(X86_FEATURE_SMAP));
++ cr4_fixed1_update(X86_CR4_PKE, ecx, bit(X86_FEATURE_PKU));
++ cr4_fixed1_update(X86_CR4_UMIP, ecx, bit(X86_FEATURE_UMIP));
++ cr4_fixed1_update(X86_CR4_LA57, ecx, bit(X86_FEATURE_LA57));
++
++#undef cr4_fixed1_update
++}
++
++static void nested_vmx_entry_exit_ctls_update(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (kvm_mpx_supported()) {
++ bool mpx_enabled = guest_cpuid_has(vcpu, X86_FEATURE_MPX);
++
++ if (mpx_enabled) {
++ vmx->nested.msrs.entry_ctls_high |= VM_ENTRY_LOAD_BNDCFGS;
++ vmx->nested.msrs.exit_ctls_high |= VM_EXIT_CLEAR_BNDCFGS;
++ } else {
++ vmx->nested.msrs.entry_ctls_high &= ~VM_ENTRY_LOAD_BNDCFGS;
++ vmx->nested.msrs.exit_ctls_high &= ~VM_EXIT_CLEAR_BNDCFGS;
++ }
++ }
++}
++
++static void update_intel_pt_cfg(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct kvm_cpuid_entry2 *best = NULL;
++ int i;
++
++ for (i = 0; i < PT_CPUID_LEAVES; i++) {
++ best = kvm_find_cpuid_entry(vcpu, 0x14, i);
++ if (!best)
++ return;
++ vmx->pt_desc.caps[CPUID_EAX + i*PT_CPUID_REGS_NUM] = best->eax;
++ vmx->pt_desc.caps[CPUID_EBX + i*PT_CPUID_REGS_NUM] = best->ebx;
++ vmx->pt_desc.caps[CPUID_ECX + i*PT_CPUID_REGS_NUM] = best->ecx;
++ vmx->pt_desc.caps[CPUID_EDX + i*PT_CPUID_REGS_NUM] = best->edx;
++ }
++
++ /* Get the number of configurable Address Ranges for filtering */
++ vmx->pt_desc.addr_range = intel_pt_validate_cap(vmx->pt_desc.caps,
++ PT_CAP_num_address_ranges);
++
++ /* Initialize and clear the no dependency bits */
++ vmx->pt_desc.ctl_bitmask = ~(RTIT_CTL_TRACEEN | RTIT_CTL_OS |
++ RTIT_CTL_USR | RTIT_CTL_TSC_EN | RTIT_CTL_DISRETC);
++
++ /*
++ * If CPUID.(EAX=14H,ECX=0):EBX[0]=1 CR3Filter can be set otherwise
++ * will inject an #GP
++ */
++ if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_cr3_filtering))
++ vmx->pt_desc.ctl_bitmask &= ~RTIT_CTL_CR3EN;
++
++ /*
++ * If CPUID.(EAX=14H,ECX=0):EBX[1]=1 CYCEn, CycThresh and
++ * PSBFreq can be set
++ */
++ if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_psb_cyc))
++ vmx->pt_desc.ctl_bitmask &= ~(RTIT_CTL_CYCLEACC |
++ RTIT_CTL_CYC_THRESH | RTIT_CTL_PSB_FREQ);
++
++ /*
++ * If CPUID.(EAX=14H,ECX=0):EBX[3]=1 MTCEn BranchEn and
++ * MTCFreq can be set
++ */
++ if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_mtc))
++ vmx->pt_desc.ctl_bitmask &= ~(RTIT_CTL_MTC_EN |
++ RTIT_CTL_BRANCH_EN | RTIT_CTL_MTC_RANGE);
++
++ /* If CPUID.(EAX=14H,ECX=0):EBX[4]=1 FUPonPTW and PTWEn can be set */
++ if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_ptwrite))
++ vmx->pt_desc.ctl_bitmask &= ~(RTIT_CTL_FUP_ON_PTW |
++ RTIT_CTL_PTW_EN);
++
++ /* If CPUID.(EAX=14H,ECX=0):EBX[5]=1 PwrEvEn can be set */
++ if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_power_event_trace))
++ vmx->pt_desc.ctl_bitmask &= ~RTIT_CTL_PWR_EVT_EN;
++
++ /* If CPUID.(EAX=14H,ECX=0):ECX[0]=1 ToPA can be set */
++ if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_topa_output))
++ vmx->pt_desc.ctl_bitmask &= ~RTIT_CTL_TOPA;
++
++ /* If CPUID.(EAX=14H,ECX=0):ECX[3]=1 FabircEn can be set */
++ if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_output_subsys))
++ vmx->pt_desc.ctl_bitmask &= ~RTIT_CTL_FABRIC_EN;
++
++ /* unmask address range configure area */
++ for (i = 0; i < vmx->pt_desc.addr_range; i++)
++ vmx->pt_desc.ctl_bitmask &= ~(0xfULL << (32 + i * 4));
++}
++
++static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ /* xsaves_enabled is recomputed in vmx_compute_secondary_exec_control(). */
++ vcpu->arch.xsaves_enabled = false;
++
++ if (cpu_has_secondary_exec_ctrls()) {
++ vmx_compute_secondary_exec_control(vmx);
++ vmcs_set_secondary_exec_control(vmx);
++ }
++
++ if (nested_vmx_allowed(vcpu))
++ to_vmx(vcpu)->msr_ia32_feature_control_valid_bits |=
++ FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX |
++ FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
++ else
++ to_vmx(vcpu)->msr_ia32_feature_control_valid_bits &=
++ ~(FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX |
++ FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX);
++
++ if (nested_vmx_allowed(vcpu)) {
++ nested_vmx_cr_fixed1_bits_update(vcpu);
++ nested_vmx_entry_exit_ctls_update(vcpu);
++ }
++
++ if (boot_cpu_has(X86_FEATURE_INTEL_PT) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_INTEL_PT))
++ update_intel_pt_cfg(vcpu);
++
++ if (boot_cpu_has(X86_FEATURE_RTM)) {
++ struct shared_msr_entry *msr;
++ msr = find_msr_entry(vmx, MSR_IA32_TSX_CTRL);
++ if (msr) {
++ bool enabled = guest_cpuid_has(vcpu, X86_FEATURE_RTM);
++ vmx_set_guest_msr(vmx, msr, enabled ? 0 : TSX_CTRL_RTM_DISABLE);
++ }
++ }
++}
++
++static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
++{
++ if (func == 1 && nested)
++ entry->ecx |= bit(X86_FEATURE_VMX);
++}
++
++static void vmx_request_immediate_exit(struct kvm_vcpu *vcpu)
++{
++ to_vmx(vcpu)->req_immediate_exit = true;
++}
++
++static int vmx_check_intercept(struct kvm_vcpu *vcpu,
++ struct x86_instruction_info *info,
++ enum x86_intercept_stage stage)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ struct x86_emulate_ctxt *ctxt = &vcpu->arch.emulate_ctxt;
++
++ /*
++ * RDPID causes #UD if disabled through secondary execution controls.
++ * Because it is marked as EmulateOnUD, we need to intercept it here.
++ */
++ if (info->intercept == x86_intercept_rdtscp &&
++ !nested_cpu_has2(vmcs12, SECONDARY_EXEC_RDTSCP)) {
++ ctxt->exception.vector = UD_VECTOR;
++ ctxt->exception.error_code_valid = false;
++ return X86EMUL_PROPAGATE_FAULT;
++ }
++
++ /* TODO: check more intercepts... */
++ return X86EMUL_CONTINUE;
++}
++
++#ifdef CONFIG_X86_64
++/* (a << shift) / divisor, return 1 if overflow otherwise 0 */
++static inline int u64_shl_div_u64(u64 a, unsigned int shift,
++ u64 divisor, u64 *result)
++{
++ u64 low = a << shift, high = a >> (64 - shift);
++
++ /* To avoid the overflow on divq */
++ if (high >= divisor)
++ return 1;
++
++ /* Low hold the result, high hold rem which is discarded */
++ asm("divq %2\n\t" : "=a" (low), "=d" (high) :
++ "rm" (divisor), "0" (low), "1" (high));
++ *result = low;
++
++ return 0;
++}
++
++static int vmx_set_hv_timer(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc,
++ bool *expired)
++{
++ struct vcpu_vmx *vmx;
++ u64 tscl, guest_tscl, delta_tsc, lapic_timer_advance_cycles;
++ struct kvm_timer *ktimer = &vcpu->arch.apic->lapic_timer;
++
++ if (kvm_mwait_in_guest(vcpu->kvm) ||
++ kvm_can_post_timer_interrupt(vcpu))
++ return -EOPNOTSUPP;
++
++ vmx = to_vmx(vcpu);
++ tscl = rdtsc();
++ guest_tscl = kvm_read_l1_tsc(vcpu, tscl);
++ delta_tsc = max(guest_deadline_tsc, guest_tscl) - guest_tscl;
++ lapic_timer_advance_cycles = nsec_to_cycles(vcpu,
++ ktimer->timer_advance_ns);
++
++ if (delta_tsc > lapic_timer_advance_cycles)
++ delta_tsc -= lapic_timer_advance_cycles;
++ else
++ delta_tsc = 0;
++
++ /* Convert to host delta tsc if tsc scaling is enabled */
++ if (vcpu->arch.tsc_scaling_ratio != kvm_default_tsc_scaling_ratio &&
++ delta_tsc && u64_shl_div_u64(delta_tsc,
++ kvm_tsc_scaling_ratio_frac_bits,
++ vcpu->arch.tsc_scaling_ratio, &delta_tsc))
++ return -ERANGE;
++
++ /*
++ * If the delta tsc can't fit in the 32 bit after the multi shift,
++ * we can't use the preemption timer.
++ * It's possible that it fits on later vmentries, but checking
++ * on every vmentry is costly so we just use an hrtimer.
++ */
++ if (delta_tsc >> (cpu_preemption_timer_multi + 32))
++ return -ERANGE;
++
++ vmx->hv_deadline_tsc = tscl + delta_tsc;
++ *expired = !delta_tsc;
++ return 0;
++}
++
++static void vmx_cancel_hv_timer(struct kvm_vcpu *vcpu)
++{
++ to_vmx(vcpu)->hv_deadline_tsc = -1;
++}
++#endif
++
++static void vmx_sched_in(struct kvm_vcpu *vcpu, int cpu)
++{
++ if (!kvm_pause_in_guest(vcpu->kvm))
++ shrink_ple_window(vcpu);
++}
++
++static void vmx_slot_enable_log_dirty(struct kvm *kvm,
++ struct kvm_memory_slot *slot)
++{
++ kvm_mmu_slot_leaf_clear_dirty(kvm, slot);
++ kvm_mmu_slot_largepage_remove_write_access(kvm, slot);
++}
++
++static void vmx_slot_disable_log_dirty(struct kvm *kvm,
++ struct kvm_memory_slot *slot)
++{
++ kvm_mmu_slot_set_dirty(kvm, slot);
++}
++
++static void vmx_flush_log_dirty(struct kvm *kvm)
++{
++ kvm_flush_pml_buffers(kvm);
++}
++
++static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu)
++{
++ struct vmcs12 *vmcs12;
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ gpa_t gpa, dst;
++
++ if (is_guest_mode(vcpu)) {
++ WARN_ON_ONCE(vmx->nested.pml_full);
++
++ /*
++ * Check if PML is enabled for the nested guest.
++ * Whether eptp bit 6 is set is already checked
++ * as part of A/D emulation.
++ */
++ vmcs12 = get_vmcs12(vcpu);
++ if (!nested_cpu_has_pml(vmcs12))
++ return 0;
++
++ if (vmcs12->guest_pml_index >= PML_ENTITY_NUM) {
++ vmx->nested.pml_full = true;
++ return 1;
++ }
++
++ gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS) & ~0xFFFull;
++ dst = vmcs12->pml_address + sizeof(u64) * vmcs12->guest_pml_index;
++
++ if (kvm_write_guest_page(vcpu->kvm, gpa_to_gfn(dst), &gpa,
++ offset_in_page(dst), sizeof(gpa)))
++ return 0;
++
++ vmcs12->guest_pml_index--;
++ }
++
++ return 0;
++}
++
++static void vmx_enable_log_dirty_pt_masked(struct kvm *kvm,
++ struct kvm_memory_slot *memslot,
++ gfn_t offset, unsigned long mask)
++{
++ kvm_mmu_clear_dirty_pt_masked(kvm, memslot, offset, mask);
++}
++
++static void __pi_post_block(struct kvm_vcpu *vcpu)
++{
++ struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
++ struct pi_desc old, new;
++ unsigned int dest;
++
++ do {
++ old.control = new.control = pi_desc->control;
++ WARN(old.nv != POSTED_INTR_WAKEUP_VECTOR,
++ "Wakeup handler not enabled while the VCPU is blocked\n");
++
++ dest = cpu_physical_id(vcpu->cpu);
++
++ if (x2apic_enabled())
++ new.ndst = dest;
++ else
++ new.ndst = (dest << 8) & 0xFF00;
++
++ /* set 'NV' to 'notification vector' */
++ new.nv = POSTED_INTR_VECTOR;
++ } while (cmpxchg64(&pi_desc->control, old.control,
++ new.control) != old.control);
++
++ if (!WARN_ON_ONCE(vcpu->pre_pcpu == -1)) {
++ spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
++ list_del(&vcpu->blocked_vcpu_list);
++ spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
++ vcpu->pre_pcpu = -1;
++ }
++}
++
++/*
++ * This routine does the following things for vCPU which is going
++ * to be blocked if VT-d PI is enabled.
++ * - Store the vCPU to the wakeup list, so when interrupts happen
++ * we can find the right vCPU to wake up.
++ * - Change the Posted-interrupt descriptor as below:
++ * 'NDST' <-- vcpu->pre_pcpu
++ * 'NV' <-- POSTED_INTR_WAKEUP_VECTOR
++ * - If 'ON' is set during this process, which means at least one
++ * interrupt is posted for this vCPU, we cannot block it, in
++ * this case, return 1, otherwise, return 0.
++ *
++ */
++static int pi_pre_block(struct kvm_vcpu *vcpu)
++{
++ unsigned int dest;
++ struct pi_desc old, new;
++ struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
++
++ if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
++ !irq_remapping_cap(IRQ_POSTING_CAP) ||
++ !kvm_vcpu_apicv_active(vcpu))
++ return 0;
++
++ WARN_ON(irqs_disabled());
++ local_irq_disable();
++ if (!WARN_ON_ONCE(vcpu->pre_pcpu != -1)) {
++ vcpu->pre_pcpu = vcpu->cpu;
++ spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
++ list_add_tail(&vcpu->blocked_vcpu_list,
++ &per_cpu(blocked_vcpu_on_cpu,
++ vcpu->pre_pcpu));
++ spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
++ }
++
++ do {
++ old.control = new.control = pi_desc->control;
++
++ WARN((pi_desc->sn == 1),
++ "Warning: SN field of posted-interrupts "
++ "is set before blocking\n");
++
++ /*
++ * Since vCPU can be preempted during this process,
++ * vcpu->cpu could be different with pre_pcpu, we
++ * need to set pre_pcpu as the destination of wakeup
++ * notification event, then we can find the right vCPU
++ * to wakeup in wakeup handler if interrupts happen
++ * when the vCPU is in blocked state.
++ */
++ dest = cpu_physical_id(vcpu->pre_pcpu);
++
++ if (x2apic_enabled())
++ new.ndst = dest;
++ else
++ new.ndst = (dest << 8) & 0xFF00;
++
++ /* set 'NV' to 'wakeup vector' */
++ new.nv = POSTED_INTR_WAKEUP_VECTOR;
++ } while (cmpxchg64(&pi_desc->control, old.control,
++ new.control) != old.control);
++
++ /* We should not block the vCPU if an interrupt is posted for it. */
++ if (pi_test_on(pi_desc) == 1)
++ __pi_post_block(vcpu);
++
++ local_irq_enable();
++ return (vcpu->pre_pcpu == -1);
++}
++
++static int vmx_pre_block(struct kvm_vcpu *vcpu)
++{
++ if (pi_pre_block(vcpu))
++ return 1;
++
++ if (kvm_lapic_hv_timer_in_use(vcpu))
++ kvm_lapic_switch_to_sw_timer(vcpu);
++
++ return 0;
++}
++
++static void pi_post_block(struct kvm_vcpu *vcpu)
++{
++ if (vcpu->pre_pcpu == -1)
++ return;
++
++ WARN_ON(irqs_disabled());
++ local_irq_disable();
++ __pi_post_block(vcpu);
++ local_irq_enable();
++}
++
++static void vmx_post_block(struct kvm_vcpu *vcpu)
++{
++ if (kvm_x86_ops->set_hv_timer)
++ kvm_lapic_switch_to_hv_timer(vcpu);
++
++ pi_post_block(vcpu);
++}
++
++/*
++ * vmx_update_pi_irte - set IRTE for Posted-Interrupts
++ *
++ * @kvm: kvm
++ * @host_irq: host irq of the interrupt
++ * @guest_irq: gsi of the interrupt
++ * @set: set or unset PI
++ * returns 0 on success, < 0 on failure
++ */
++static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
++ uint32_t guest_irq, bool set)
++{
++ struct kvm_kernel_irq_routing_entry *e;
++ struct kvm_irq_routing_table *irq_rt;
++ struct kvm_lapic_irq irq;
++ struct kvm_vcpu *vcpu;
++ struct vcpu_data vcpu_info;
++ int idx, ret = 0;
++
++ if (!kvm_arch_has_assigned_device(kvm) ||
++ !irq_remapping_cap(IRQ_POSTING_CAP) ||
++ !kvm_vcpu_apicv_active(kvm->vcpus[0]))
++ return 0;
++
++ idx = srcu_read_lock(&kvm->irq_srcu);
++ irq_rt = srcu_dereference(kvm->irq_routing, &kvm->irq_srcu);
++ if (guest_irq >= irq_rt->nr_rt_entries ||
++ hlist_empty(&irq_rt->map[guest_irq])) {
++ pr_warn_once("no route for guest_irq %u/%u (broken user space?)\n",
++ guest_irq, irq_rt->nr_rt_entries);
++ goto out;
++ }
++
++ hlist_for_each_entry(e, &irq_rt->map[guest_irq], link) {
++ if (e->type != KVM_IRQ_ROUTING_MSI)
++ continue;
++ /*
++ * VT-d PI cannot support posting multicast/broadcast
++ * interrupts to a vCPU, we still use interrupt remapping
++ * for these kind of interrupts.
++ *
++ * For lowest-priority interrupts, we only support
++ * those with single CPU as the destination, e.g. user
++ * configures the interrupts via /proc/irq or uses
++ * irqbalance to make the interrupts single-CPU.
++ *
++ * We will support full lowest-priority interrupt later.
++ *
++ * In addition, we can only inject generic interrupts using
++ * the PI mechanism, refuse to route others through it.
++ */
++
++ kvm_set_msi_irq(kvm, e, &irq);
++ if (!kvm_intr_is_single_vcpu(kvm, &irq, &vcpu) ||
++ !kvm_irq_is_postable(&irq)) {
++ /*
++ * Make sure the IRTE is in remapped mode if
++ * we don't handle it in posted mode.
++ */
++ ret = irq_set_vcpu_affinity(host_irq, NULL);
++ if (ret < 0) {
++ printk(KERN_INFO
++ "failed to back to remapped mode, irq: %u\n",
++ host_irq);
++ goto out;
++ }
++
++ continue;
++ }
++
++ vcpu_info.pi_desc_addr = __pa(vcpu_to_pi_desc(vcpu));
++ vcpu_info.vector = irq.vector;
++
++ trace_kvm_pi_irte_update(host_irq, vcpu->vcpu_id, e->gsi,
++ vcpu_info.vector, vcpu_info.pi_desc_addr, set);
++
++ if (set)
++ ret = irq_set_vcpu_affinity(host_irq, &vcpu_info);
++ else
++ ret = irq_set_vcpu_affinity(host_irq, NULL);
++
++ if (ret < 0) {
++ printk(KERN_INFO "%s: failed to update PI IRTE\n",
++ __func__);
++ goto out;
++ }
++ }
++
++ ret = 0;
++out:
++ srcu_read_unlock(&kvm->irq_srcu, idx);
++ return ret;
++}
++
++static void vmx_setup_mce(struct kvm_vcpu *vcpu)
++{
++ if (vcpu->arch.mcg_cap & MCG_LMCE_P)
++ to_vmx(vcpu)->msr_ia32_feature_control_valid_bits |=
++ FEATURE_CONTROL_LMCE;
++ else
++ to_vmx(vcpu)->msr_ia32_feature_control_valid_bits &=
++ ~FEATURE_CONTROL_LMCE;
++}
++
++static int vmx_smi_allowed(struct kvm_vcpu *vcpu)
++{
++ /* we need a nested vmexit to enter SMM, postpone if run is pending */
++ if (to_vmx(vcpu)->nested.nested_run_pending)
++ return 0;
++ return 1;
++}
++
++static int vmx_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ vmx->nested.smm.guest_mode = is_guest_mode(vcpu);
++ if (vmx->nested.smm.guest_mode)
++ nested_vmx_vmexit(vcpu, -1, 0, 0);
++
++ vmx->nested.smm.vmxon = vmx->nested.vmxon;
++ vmx->nested.vmxon = false;
++ vmx_clear_hlt(vcpu);
++ return 0;
++}
++
++static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, const char *smstate)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int ret;
++
++ if (vmx->nested.smm.vmxon) {
++ vmx->nested.vmxon = true;
++ vmx->nested.smm.vmxon = false;
++ }
++
++ if (vmx->nested.smm.guest_mode) {
++ ret = nested_vmx_enter_non_root_mode(vcpu, false);
++ if (ret)
++ return ret;
++
++ vmx->nested.smm.guest_mode = false;
++ }
++ return 0;
++}
++
++static int enable_smi_window(struct kvm_vcpu *vcpu)
++{
++ return 0;
++}
++
++static bool vmx_need_emulation_on_page_fault(struct kvm_vcpu *vcpu)
++{
++ return false;
++}
++
++static bool vmx_apic_init_signal_blocked(struct kvm_vcpu *vcpu)
++{
++ return to_vmx(vcpu)->nested.vmxon;
++}
++
++static __init int hardware_setup(void)
++{
++ unsigned long host_bndcfgs;
++ struct desc_ptr dt;
++ int r, i;
++
++ rdmsrl_safe(MSR_EFER, &host_efer);
++
++ store_idt(&dt);
++ host_idt_base = dt.address;
++
++ for (i = 0; i < ARRAY_SIZE(vmx_msr_index); ++i)
++ kvm_define_shared_msr(i, vmx_msr_index[i]);
++
++ if (setup_vmcs_config(&vmcs_config, &vmx_capability) < 0)
++ return -EIO;
++
++ if (boot_cpu_has(X86_FEATURE_NX))
++ kvm_enable_efer_bits(EFER_NX);
++
++ if (boot_cpu_has(X86_FEATURE_MPX)) {
++ rdmsrl(MSR_IA32_BNDCFGS, host_bndcfgs);
++ WARN_ONCE(host_bndcfgs, "KVM: BNDCFGS in host will be lost");
++ }
++
++ if (!cpu_has_vmx_vpid() || !cpu_has_vmx_invvpid() ||
++ !(cpu_has_vmx_invvpid_single() || cpu_has_vmx_invvpid_global()))
++ enable_vpid = 0;
++
++ if (!cpu_has_vmx_ept() ||
++ !cpu_has_vmx_ept_4levels() ||
++ !cpu_has_vmx_ept_mt_wb() ||
++ !cpu_has_vmx_invept_global())
++ enable_ept = 0;
++
++ if (!cpu_has_vmx_ept_ad_bits() || !enable_ept)
++ enable_ept_ad_bits = 0;
++
++ if (!cpu_has_vmx_unrestricted_guest() || !enable_ept)
++ enable_unrestricted_guest = 0;
++
++ if (!cpu_has_vmx_flexpriority())
++ flexpriority_enabled = 0;
++
++ if (!cpu_has_virtual_nmis())
++ enable_vnmi = 0;
++
++ /*
++ * set_apic_access_page_addr() is used to reload apic access
++ * page upon invalidation. No need to do anything if not
++ * using the APIC_ACCESS_ADDR VMCS field.
++ */
++ if (!flexpriority_enabled)
++ kvm_x86_ops->set_apic_access_page_addr = NULL;
++
++ if (!cpu_has_vmx_tpr_shadow())
++ kvm_x86_ops->update_cr8_intercept = NULL;
++
++ if (enable_ept && !cpu_has_vmx_ept_2m_page())
++ kvm_disable_largepages();
++
++#if IS_ENABLED(CONFIG_HYPERV)
++ if (ms_hyperv.nested_features & HV_X64_NESTED_GUEST_MAPPING_FLUSH
++ && enable_ept) {
++ kvm_x86_ops->tlb_remote_flush = hv_remote_flush_tlb;
++ kvm_x86_ops->tlb_remote_flush_with_range =
++ hv_remote_flush_tlb_with_range;
++ }
++#endif
++
++ if (!cpu_has_vmx_ple()) {
++ ple_gap = 0;
++ ple_window = 0;
++ ple_window_grow = 0;
++ ple_window_max = 0;
++ ple_window_shrink = 0;
++ }
++
++ if (!cpu_has_vmx_apicv()) {
++ enable_apicv = 0;
++ kvm_x86_ops->sync_pir_to_irr = NULL;
++ }
++
++ if (cpu_has_vmx_tsc_scaling()) {
++ kvm_has_tsc_control = true;
++ kvm_max_tsc_scaling_ratio = KVM_VMX_TSC_MULTIPLIER_MAX;
++ kvm_tsc_scaling_ratio_frac_bits = 48;
++ }
++
++ set_bit(0, vmx_vpid_bitmap); /* 0 is reserved for host */
++
++ if (enable_ept)
++ vmx_enable_tdp();
++ else
++ kvm_disable_tdp();
++
++ /*
++ * Only enable PML when hardware supports PML feature, and both EPT
++ * and EPT A/D bit features are enabled -- PML depends on them to work.
++ */
++ if (!enable_ept || !enable_ept_ad_bits || !cpu_has_vmx_pml())
++ enable_pml = 0;
++
++ if (!enable_pml) {
++ kvm_x86_ops->slot_enable_log_dirty = NULL;
++ kvm_x86_ops->slot_disable_log_dirty = NULL;
++ kvm_x86_ops->flush_log_dirty = NULL;
++ kvm_x86_ops->enable_log_dirty_pt_masked = NULL;
++ }
++
++ if (!cpu_has_vmx_preemption_timer())
++ enable_preemption_timer = false;
++
++ if (enable_preemption_timer) {
++ u64 use_timer_freq = 5000ULL * 1000 * 1000;
++ u64 vmx_msr;
++
++ rdmsrl(MSR_IA32_VMX_MISC, vmx_msr);
++ cpu_preemption_timer_multi =
++ vmx_msr & VMX_MISC_PREEMPTION_TIMER_RATE_MASK;
++
++ if (tsc_khz)
++ use_timer_freq = (u64)tsc_khz * 1000;
++ use_timer_freq >>= cpu_preemption_timer_multi;
++
++ /*
++ * KVM "disables" the preemption timer by setting it to its max
++ * value. Don't use the timer if it might cause spurious exits
++ * at a rate faster than 0.1 Hz (of uninterrupted guest time).
++ */
++ if (use_timer_freq > 0xffffffffu / 10)
++ enable_preemption_timer = false;
++ }
++
++ if (!enable_preemption_timer) {
++ kvm_x86_ops->set_hv_timer = NULL;
++ kvm_x86_ops->cancel_hv_timer = NULL;
++ kvm_x86_ops->request_immediate_exit = __kvm_request_immediate_exit;
++ }
++
++ kvm_set_posted_intr_wakeup_handler(wakeup_handler);
++
++ kvm_mce_cap_supported |= MCG_LMCE_P;
++
++ if (pt_mode != PT_MODE_SYSTEM && pt_mode != PT_MODE_HOST_GUEST)
++ return -EINVAL;
++ if (!enable_ept || !cpu_has_vmx_intel_pt())
++ pt_mode = PT_MODE_SYSTEM;
++
++ if (nested) {
++ nested_vmx_setup_ctls_msrs(&vmcs_config.nested,
++ vmx_capability.ept, enable_apicv);
++
++ r = nested_vmx_hardware_setup(kvm_vmx_exit_handlers);
++ if (r)
++ return r;
++ }
++
++ r = alloc_kvm_area();
++ if (r)
++ nested_vmx_hardware_unsetup();
++ return r;
++}
++
++static __exit void hardware_unsetup(void)
++{
++ if (nested)
++ nested_vmx_hardware_unsetup();
++
++ free_kvm_area();
++}
++
++static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
++ .cpu_has_kvm_support = cpu_has_kvm_support,
++ .disabled_by_bios = vmx_disabled_by_bios,
++ .hardware_setup = hardware_setup,
++ .hardware_unsetup = hardware_unsetup,
++ .check_processor_compatibility = vmx_check_processor_compat,
++ .hardware_enable = hardware_enable,
++ .hardware_disable = hardware_disable,
++ .cpu_has_accelerated_tpr = report_flexpriority,
++ .has_emulated_msr = vmx_has_emulated_msr,
++
++ .vm_init = vmx_vm_init,
++ .vm_alloc = vmx_vm_alloc,
++ .vm_free = vmx_vm_free,
++
++ .vcpu_create = vmx_create_vcpu,
++ .vcpu_free = vmx_free_vcpu,
++ .vcpu_reset = vmx_vcpu_reset,
++
++ .prepare_guest_switch = vmx_prepare_switch_to_guest,
++ .vcpu_load = vmx_vcpu_load,
++ .vcpu_put = vmx_vcpu_put,
++
++ .update_bp_intercept = update_exception_bitmap,
++ .get_msr_feature = vmx_get_msr_feature,
++ .get_msr = vmx_get_msr,
++ .set_msr = vmx_set_msr,
++ .get_segment_base = vmx_get_segment_base,
++ .get_segment = vmx_get_segment,
++ .set_segment = vmx_set_segment,
++ .get_cpl = vmx_get_cpl,
++ .get_cs_db_l_bits = vmx_get_cs_db_l_bits,
++ .decache_cr0_guest_bits = vmx_decache_cr0_guest_bits,
++ .decache_cr4_guest_bits = vmx_decache_cr4_guest_bits,
++ .set_cr0 = vmx_set_cr0,
++ .set_cr3 = vmx_set_cr3,
++ .set_cr4 = vmx_set_cr4,
++ .set_efer = vmx_set_efer,
++ .get_idt = vmx_get_idt,
++ .set_idt = vmx_set_idt,
++ .get_gdt = vmx_get_gdt,
++ .set_gdt = vmx_set_gdt,
++ .get_dr6 = vmx_get_dr6,
++ .set_dr6 = vmx_set_dr6,
++ .set_dr7 = vmx_set_dr7,
++ .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs,
++ .cache_reg = vmx_cache_reg,
++ .get_rflags = vmx_get_rflags,
++ .set_rflags = vmx_set_rflags,
++
++ .tlb_flush = vmx_flush_tlb,
++ .tlb_flush_gva = vmx_flush_tlb_gva,
++
++ .run = vmx_vcpu_run,
++ .handle_exit = vmx_handle_exit,
++ .skip_emulated_instruction = skip_emulated_instruction,
++ .set_interrupt_shadow = vmx_set_interrupt_shadow,
++ .get_interrupt_shadow = vmx_get_interrupt_shadow,
++ .patch_hypercall = vmx_patch_hypercall,
++ .set_irq = vmx_inject_irq,
++ .set_nmi = vmx_inject_nmi,
++ .queue_exception = vmx_queue_exception,
++ .cancel_injection = vmx_cancel_injection,
++ .interrupt_allowed = vmx_interrupt_allowed,
++ .nmi_allowed = vmx_nmi_allowed,
++ .get_nmi_mask = vmx_get_nmi_mask,
++ .set_nmi_mask = vmx_set_nmi_mask,
++ .enable_nmi_window = enable_nmi_window,
++ .enable_irq_window = enable_irq_window,
++ .update_cr8_intercept = update_cr8_intercept,
++ .set_virtual_apic_mode = vmx_set_virtual_apic_mode,
++ .set_apic_access_page_addr = vmx_set_apic_access_page_addr,
++ .get_enable_apicv = vmx_get_enable_apicv,
++ .refresh_apicv_exec_ctrl = vmx_refresh_apicv_exec_ctrl,
++ .load_eoi_exitmap = vmx_load_eoi_exitmap,
++ .apicv_post_state_restore = vmx_apicv_post_state_restore,
++ .hwapic_irr_update = vmx_hwapic_irr_update,
++ .hwapic_isr_update = vmx_hwapic_isr_update,
++ .guest_apic_has_interrupt = vmx_guest_apic_has_interrupt,
++ .sync_pir_to_irr = vmx_sync_pir_to_irr,
++ .deliver_posted_interrupt = vmx_deliver_posted_interrupt,
++ .dy_apicv_has_pending_interrupt = vmx_dy_apicv_has_pending_interrupt,
++
++ .set_tss_addr = vmx_set_tss_addr,
++ .set_identity_map_addr = vmx_set_identity_map_addr,
++ .get_tdp_level = get_ept_level,
++ .get_mt_mask = vmx_get_mt_mask,
++
++ .get_exit_info = vmx_get_exit_info,
++
++ .get_lpage_level = vmx_get_lpage_level,
++
++ .cpuid_update = vmx_cpuid_update,
++
++ .rdtscp_supported = vmx_rdtscp_supported,
++ .invpcid_supported = vmx_invpcid_supported,
++
++ .set_supported_cpuid = vmx_set_supported_cpuid,
++
++ .has_wbinvd_exit = cpu_has_vmx_wbinvd_exit,
++
++ .read_l1_tsc_offset = vmx_read_l1_tsc_offset,
++ .write_l1_tsc_offset = vmx_write_l1_tsc_offset,
++
++ .set_tdp_cr3 = vmx_set_cr3,
++
++ .check_intercept = vmx_check_intercept,
++ .handle_exit_irqoff = vmx_handle_exit_irqoff,
++ .mpx_supported = vmx_mpx_supported,
++ .xsaves_supported = vmx_xsaves_supported,
++ .umip_emulated = vmx_umip_emulated,
++ .pt_supported = vmx_pt_supported,
++
++ .request_immediate_exit = vmx_request_immediate_exit,
++
++ .sched_in = vmx_sched_in,
++
++ .slot_enable_log_dirty = vmx_slot_enable_log_dirty,
++ .slot_disable_log_dirty = vmx_slot_disable_log_dirty,
++ .flush_log_dirty = vmx_flush_log_dirty,
++ .enable_log_dirty_pt_masked = vmx_enable_log_dirty_pt_masked,
++ .write_log_dirty = vmx_write_pml_buffer,
++
++ .pre_block = vmx_pre_block,
++ .post_block = vmx_post_block,
++
++ .pmu_ops = &intel_pmu_ops,
++
++ .update_pi_irte = vmx_update_pi_irte,
++
++#ifdef CONFIG_X86_64
++ .set_hv_timer = vmx_set_hv_timer,
++ .cancel_hv_timer = vmx_cancel_hv_timer,
++#endif
++
++ .setup_mce = vmx_setup_mce,
++
++ .smi_allowed = vmx_smi_allowed,
++ .pre_enter_smm = vmx_pre_enter_smm,
++ .pre_leave_smm = vmx_pre_leave_smm,
++ .enable_smi_window = enable_smi_window,
++
++ .check_nested_events = NULL,
++ .get_nested_state = NULL,
++ .set_nested_state = NULL,
++ .get_vmcs12_pages = NULL,
++ .nested_enable_evmcs = NULL,
++ .nested_get_evmcs_version = NULL,
++ .need_emulation_on_page_fault = vmx_need_emulation_on_page_fault,
++ .apic_init_signal_blocked = vmx_apic_init_signal_blocked,
++};
++
++static void vmx_cleanup_l1d_flush(void)
++{
++ if (vmx_l1d_flush_pages) {
++ free_pages((unsigned long)vmx_l1d_flush_pages, L1D_CACHE_ORDER);
++ vmx_l1d_flush_pages = NULL;
++ }
++ /* Restore state so sysfs ignores VMX */
++ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
++}
++
++static void vmx_exit(void)
++{
++#ifdef CONFIG_KEXEC_CORE
++ RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL);
++ synchronize_rcu();
++#endif
++
++ kvm_exit();
++
++#if IS_ENABLED(CONFIG_HYPERV)
++ if (static_branch_unlikely(&enable_evmcs)) {
++ int cpu;
++ struct hv_vp_assist_page *vp_ap;
++ /*
++ * Reset everything to support using non-enlightened VMCS
++ * access later (e.g. when we reload the module with
++ * enlightened_vmcs=0)
++ */
++ for_each_online_cpu(cpu) {
++ vp_ap = hv_get_vp_assist_page(cpu);
++
++ if (!vp_ap)
++ continue;
++
++ vp_ap->nested_control.features.directhypercall = 0;
++ vp_ap->current_nested_vmcs = 0;
++ vp_ap->enlighten_vmentry = 0;
++ }
++
++ static_branch_disable(&enable_evmcs);
++ }
++#endif
++ vmx_cleanup_l1d_flush();
++}
++module_exit(vmx_exit);
++
++static int __init vmx_init(void)
++{
++ int r;
++
++#if IS_ENABLED(CONFIG_HYPERV)
++ /*
++ * Enlightened VMCS usage should be recommended and the host needs
++ * to support eVMCS v1 or above. We can also disable eVMCS support
++ * with module parameter.
++ */
++ if (enlightened_vmcs &&
++ ms_hyperv.hints & HV_X64_ENLIGHTENED_VMCS_RECOMMENDED &&
++ (ms_hyperv.nested_features & HV_X64_ENLIGHTENED_VMCS_VERSION) >=
++ KVM_EVMCS_VERSION) {
++ int cpu;
++
++ /* Check that we have assist pages on all online CPUs */
++ for_each_online_cpu(cpu) {
++ if (!hv_get_vp_assist_page(cpu)) {
++ enlightened_vmcs = false;
++ break;
++ }
++ }
++
++ if (enlightened_vmcs) {
++ pr_info("KVM: vmx: using Hyper-V Enlightened VMCS\n");
++ static_branch_enable(&enable_evmcs);
++ }
++
++ if (ms_hyperv.nested_features & HV_X64_NESTED_DIRECT_FLUSH)
++ vmx_x86_ops.enable_direct_tlbflush
++ = hv_enable_direct_tlbflush;
++
++ } else {
++ enlightened_vmcs = false;
++ }
++#endif
++
++ r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx),
++ __alignof__(struct vcpu_vmx), THIS_MODULE);
++ if (r)
++ return r;
++
++ /*
++ * Must be called after kvm_init() so enable_ept is properly set
++ * up. Hand the parameter mitigation value in which was stored in
++ * the pre module init parser. If no parameter was given, it will
++ * contain 'auto' which will be turned into the default 'cond'
++ * mitigation mode.
++ */
++ r = vmx_setup_l1d_flush(vmentry_l1d_flush_param);
++ if (r) {
++ vmx_exit();
++ return r;
++ }
++
++#ifdef CONFIG_KEXEC_CORE
++ rcu_assign_pointer(crash_vmclear_loaded_vmcss,
++ crash_vmclear_local_loaded_vmcss);
++#endif
++ vmx_check_vmcs12_offsets();
++
++ return 0;
++}
++module_init(vmx_init);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 353f63f3b262..ade694f94a49 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -92,6 +92,8 @@ u64 __read_mostly efer_reserved_bits = ~((u64)(EFER_SCE | EFER_LME | EFER_LMA));
+ static u64 __read_mostly efer_reserved_bits = ~((u64)EFER_SCE);
+ #endif
+
++static u64 __read_mostly cr4_reserved_bits = CR4_RESERVED_BITS;
++
+ #define VM_STAT(x, ...) offsetof(struct kvm, stat.x), KVM_STAT_VM, ## __VA_ARGS__
+ #define VCPU_STAT(x, ...) offsetof(struct kvm_vcpu, stat.x), KVM_STAT_VCPU, ## __VA_ARGS__
+
+@@ -793,9 +795,38 @@ int kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
+ }
+ EXPORT_SYMBOL_GPL(kvm_set_xcr);
+
++static u64 kvm_host_cr4_reserved_bits(struct cpuinfo_x86 *c)
++{
++ u64 reserved_bits = CR4_RESERVED_BITS;
++
++ if (!cpu_has(c, X86_FEATURE_XSAVE))
++ reserved_bits |= X86_CR4_OSXSAVE;
++
++ if (!cpu_has(c, X86_FEATURE_SMEP))
++ reserved_bits |= X86_CR4_SMEP;
++
++ if (!cpu_has(c, X86_FEATURE_SMAP))
++ reserved_bits |= X86_CR4_SMAP;
++
++ if (!cpu_has(c, X86_FEATURE_FSGSBASE))
++ reserved_bits |= X86_CR4_FSGSBASE;
++
++ if (!cpu_has(c, X86_FEATURE_PKU))
++ reserved_bits |= X86_CR4_PKE;
++
++ if (!cpu_has(c, X86_FEATURE_LA57) &&
++ !(cpuid_ecx(0x7) & bit(X86_FEATURE_LA57)))
++ reserved_bits |= X86_CR4_LA57;
++
++ if (!cpu_has(c, X86_FEATURE_UMIP) && !kvm_x86_ops->umip_emulated())
++ reserved_bits |= X86_CR4_UMIP;
++
++ return reserved_bits;
++}
++
+ static int kvm_valid_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+- if (cr4 & CR4_RESERVED_BITS)
++ if (cr4 & cr4_reserved_bits)
+ return -EINVAL;
+
+ if (!guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) && (cr4 & X86_CR4_OSXSAVE))
+@@ -961,9 +992,11 @@ static u64 kvm_dr6_fixed(struct kvm_vcpu *vcpu)
+
+ static int __kvm_set_dr(struct kvm_vcpu *vcpu, int dr, unsigned long val)
+ {
++ size_t size = ARRAY_SIZE(vcpu->arch.db);
++
+ switch (dr) {
+ case 0 ... 3:
+- vcpu->arch.db[dr] = val;
++ vcpu->arch.db[array_index_nospec(dr, size)] = val;
+ if (!(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP))
+ vcpu->arch.eff_db[dr] = val;
+ break;
+@@ -1000,9 +1033,11 @@ EXPORT_SYMBOL_GPL(kvm_set_dr);
+
+ int kvm_get_dr(struct kvm_vcpu *vcpu, int dr, unsigned long *val)
+ {
++ size_t size = ARRAY_SIZE(vcpu->arch.db);
++
+ switch (dr) {
+ case 0 ... 3:
+- *val = vcpu->arch.db[dr];
++ *val = vcpu->arch.db[array_index_nospec(dr, size)];
+ break;
+ case 4:
+ /* fall through */
+@@ -2269,7 +2304,10 @@ static int set_msr_mce(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ default:
+ if (msr >= MSR_IA32_MC0_CTL &&
+ msr < MSR_IA32_MCx_CTL(bank_num)) {
+- u32 offset = msr - MSR_IA32_MC0_CTL;
++ u32 offset = array_index_nospec(
++ msr - MSR_IA32_MC0_CTL,
++ MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);
++
+ /* only 0 or all 1s can be written to IA32_MCi_CTL
+ * some Linux kernels though clear bit 10 in bank 4 to
+ * workaround a BIOS/GART TBL issue on AMD K8s, ignore
+@@ -2681,7 +2719,10 @@ static int get_msr_mce(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata, bool host)
+ default:
+ if (msr >= MSR_IA32_MC0_CTL &&
+ msr < MSR_IA32_MCx_CTL(bank_num)) {
+- u32 offset = msr - MSR_IA32_MC0_CTL;
++ u32 offset = array_index_nospec(
++ msr - MSR_IA32_MC0_CTL,
++ MSR_IA32_MCx_CTL(bank_num) - MSR_IA32_MC0_CTL);
++
+ data = vcpu->arch.mce_banks[offset];
+ break;
+ }
+@@ -3234,6 +3275,9 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu)
+ if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
+ return;
+
++ if (vcpu->arch.st.steal.preempted)
++ return;
++
+ vcpu->arch.st.steal.preempted = KVM_VCPU_PREEMPTED;
+
+ kvm_write_guest_offset_cached(vcpu->kvm, &vcpu->arch.st.stime,
+@@ -5977,11 +6021,11 @@ static int handle_emulation_failure(struct kvm_vcpu *vcpu, int emulation_type)
+ return r;
+ }
+
+-static bool reexecute_instruction(struct kvm_vcpu *vcpu, gva_t cr2,
++static bool reexecute_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
+ bool write_fault_to_shadow_pgtable,
+ int emulation_type)
+ {
+- gpa_t gpa = cr2;
++ gpa_t gpa = cr2_or_gpa;
+ kvm_pfn_t pfn;
+
+ if (!(emulation_type & EMULTYPE_ALLOW_RETRY))
+@@ -5995,7 +6039,7 @@ static bool reexecute_instruction(struct kvm_vcpu *vcpu, gva_t cr2,
+ * Write permission should be allowed since only
+ * write access need to be emulated.
+ */
+- gpa = kvm_mmu_gva_to_gpa_write(vcpu, cr2, NULL);
++ gpa = kvm_mmu_gva_to_gpa_write(vcpu, cr2_or_gpa, NULL);
+
+ /*
+ * If the mapping is invalid in guest, let cpu retry
+@@ -6052,10 +6096,10 @@ static bool reexecute_instruction(struct kvm_vcpu *vcpu, gva_t cr2,
+ }
+
+ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
+- unsigned long cr2, int emulation_type)
++ gpa_t cr2_or_gpa, int emulation_type)
+ {
+ struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt);
+- unsigned long last_retry_eip, last_retry_addr, gpa = cr2;
++ unsigned long last_retry_eip, last_retry_addr, gpa = cr2_or_gpa;
+
+ last_retry_eip = vcpu->arch.last_retry_eip;
+ last_retry_addr = vcpu->arch.last_retry_addr;
+@@ -6084,14 +6128,14 @@ static bool retry_instruction(struct x86_emulate_ctxt *ctxt,
+ if (x86_page_table_writing_insn(ctxt))
+ return false;
+
+- if (ctxt->eip == last_retry_eip && last_retry_addr == cr2)
++ if (ctxt->eip == last_retry_eip && last_retry_addr == cr2_or_gpa)
+ return false;
+
+ vcpu->arch.last_retry_eip = ctxt->eip;
+- vcpu->arch.last_retry_addr = cr2;
++ vcpu->arch.last_retry_addr = cr2_or_gpa;
+
+ if (!vcpu->arch.mmu.direct_map)
+- gpa = kvm_mmu_gva_to_gpa_write(vcpu, cr2, NULL);
++ gpa = kvm_mmu_gva_to_gpa_write(vcpu, cr2_or_gpa, NULL);
+
+ kvm_mmu_unprotect_page(vcpu->kvm, gpa_to_gfn(gpa));
+
+@@ -6252,11 +6296,8 @@ static bool is_vmware_backdoor_opcode(struct x86_emulate_ctxt *ctxt)
+ return false;
+ }
+
+-int x86_emulate_instruction(struct kvm_vcpu *vcpu,
+- unsigned long cr2,
+- int emulation_type,
+- void *insn,
+- int insn_len)
++int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
++ int emulation_type, void *insn, int insn_len)
+ {
+ int r;
+ struct x86_emulate_ctxt *ctxt = &vcpu->arch.emulate_ctxt;
+@@ -6299,7 +6340,7 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
+ if (r != EMULATION_OK) {
+ if (emulation_type & EMULTYPE_TRAP_UD)
+ return EMULATE_FAIL;
+- if (reexecute_instruction(vcpu, cr2, write_fault_to_spt,
++ if (reexecute_instruction(vcpu, cr2_or_gpa, write_fault_to_spt,
+ emulation_type))
+ return EMULATE_DONE;
+ if (ctxt->have_exception) {
+@@ -6329,7 +6370,7 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
+ return EMULATE_DONE;
+ }
+
+- if (retry_instruction(ctxt, cr2, emulation_type))
++ if (retry_instruction(ctxt, cr2_or_gpa, emulation_type))
+ return EMULATE_DONE;
+
+ /* this is needed for vmware backdoor interface to work since it
+@@ -6341,7 +6382,7 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
+
+ restart:
+ /* Save the faulting GPA (cr2) in the address field */
+- ctxt->exception.address = cr2;
++ ctxt->exception.address = cr2_or_gpa;
+
+ r = x86_emulate_insn(ctxt);
+
+@@ -6349,7 +6390,7 @@ restart:
+ return EMULATE_DONE;
+
+ if (r == EMULATION_FAILED) {
+- if (reexecute_instruction(vcpu, cr2, write_fault_to_spt,
++ if (reexecute_instruction(vcpu, cr2_or_gpa, write_fault_to_spt,
+ emulation_type))
+ return EMULATE_DONE;
+
+@@ -6753,7 +6794,7 @@ static void kvm_set_mmio_spte_mask(void)
+ * If reserved bit is not supported, clear the present bit to disable
+ * mmio page fault.
+ */
+- if (IS_ENABLED(CONFIG_X86_64) && maxphyaddr == 52)
++ if (maxphyaddr == 52)
+ mask &= ~1ull;
+
+ kvm_mmu_set_mmio_spte_mask(mask, mask);
+@@ -8225,6 +8266,8 @@ int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu,
+ struct kvm_mp_state *mp_state)
+ {
+ vcpu_load(vcpu);
++ if (kvm_mpx_supported())
++ kvm_load_guest_fpu(vcpu);
+
+ kvm_apic_accept_events(vcpu);
+ if (vcpu->arch.mp_state == KVM_MP_STATE_HALTED &&
+@@ -8233,6 +8276,8 @@ int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu,
+ else
+ mp_state->mp_state = vcpu->arch.mp_state;
+
++ if (kvm_mpx_supported())
++ kvm_put_guest_fpu(vcpu);
+ vcpu_put(vcpu);
+ return 0;
+ }
+@@ -8654,7 +8699,7 @@ void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
+ kvm_mmu_unload(vcpu);
+ vcpu_put(vcpu);
+
+- kvm_x86_ops->vcpu_free(vcpu);
++ kvm_arch_vcpu_free(vcpu);
+ }
+
+ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
+@@ -8847,6 +8892,8 @@ int kvm_arch_hardware_setup(void)
+ if (r != 0)
+ return r;
+
++ cr4_reserved_bits = kvm_host_cr4_reserved_bits(&boot_cpu_data);
++
+ if (kvm_has_tsc_control) {
+ /*
+ * Make sure the user can only configure tsc_khz values that
+@@ -9505,7 +9552,7 @@ void kvm_arch_async_page_ready(struct kvm_vcpu *vcpu, struct kvm_async_pf *work)
+ work->arch.cr3 != vcpu->arch.mmu.get_cr3(vcpu))
+ return;
+
+- vcpu->arch.mmu.page_fault(vcpu, work->gva, 0, true);
++ vcpu->arch.mmu.page_fault(vcpu, work->cr2_or_gpa, 0, true);
+ }
+
+ static inline u32 kvm_async_pf_hash_fn(gfn_t gfn)
+@@ -9588,7 +9635,7 @@ void kvm_arch_async_page_not_present(struct kvm_vcpu *vcpu,
+ {
+ struct x86_exception fault;
+
+- trace_kvm_async_pf_not_present(work->arch.token, work->gva);
++ trace_kvm_async_pf_not_present(work->arch.token, work->cr2_or_gpa);
+ kvm_add_async_pf_gfn(vcpu, work->arch.gfn);
+
+ if (!(vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED) ||
+@@ -9616,7 +9663,7 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu,
+ work->arch.token = ~0; /* broadcast wakeup */
+ else
+ kvm_del_async_pf_gfn(vcpu, work->arch.gfn);
+- trace_kvm_async_pf_ready(work->arch.token, work->gva);
++ trace_kvm_async_pf_ready(work->arch.token, work->cr2_or_gpa);
+
+ if (vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED &&
+ !apf_get_user(vcpu, &val)) {
+diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
+index 608e5f8c5d0a..422331b257d3 100644
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -284,7 +284,7 @@ int kvm_mtrr_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata);
+ bool kvm_mtrr_check_gfn_range_consistency(struct kvm_vcpu *vcpu, gfn_t gfn,
+ int page_num);
+ bool kvm_vector_hashing_enabled(void);
+-int x86_emulate_instruction(struct kvm_vcpu *vcpu, unsigned long cr2,
++int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
+ int emulation_type, void *insn, int insn_len);
+
+ #define KVM_SUPPORTED_XCR0 (XFEATURE_MASK_FP | XFEATURE_MASK_SSE \
+diff --git a/crypto/algapi.c b/crypto/algapi.c
+index c0755cf4f53f..346557a3fc0b 100644
+--- a/crypto/algapi.c
++++ b/crypto/algapi.c
+@@ -649,11 +649,9 @@ EXPORT_SYMBOL_GPL(crypto_grab_spawn);
+
+ void crypto_drop_spawn(struct crypto_spawn *spawn)
+ {
+- if (!spawn->alg)
+- return;
+-
+ down_write(&crypto_alg_sem);
+- list_del(&spawn->list);
++ if (spawn->alg)
++ list_del(&spawn->list);
+ up_write(&crypto_alg_sem);
+ }
+ EXPORT_SYMBOL_GPL(crypto_drop_spawn);
+@@ -661,22 +659,16 @@ EXPORT_SYMBOL_GPL(crypto_drop_spawn);
+ static struct crypto_alg *crypto_spawn_alg(struct crypto_spawn *spawn)
+ {
+ struct crypto_alg *alg;
+- struct crypto_alg *alg2;
+
+ down_read(&crypto_alg_sem);
+ alg = spawn->alg;
+- alg2 = alg;
+- if (alg2)
+- alg2 = crypto_mod_get(alg2);
+- up_read(&crypto_alg_sem);
+-
+- if (!alg2) {
+- if (alg)
+- crypto_shoot_alg(alg);
+- return ERR_PTR(-EAGAIN);
++ if (alg && !crypto_mod_get(alg)) {
++ alg->cra_flags |= CRYPTO_ALG_DYING;
++ alg = NULL;
+ }
++ up_read(&crypto_alg_sem);
+
+- return alg;
++ return alg ?: ERR_PTR(-EAGAIN);
+ }
+
+ struct crypto_tfm *crypto_spawn_tfm(struct crypto_spawn *spawn, u32 type,
+diff --git a/crypto/api.c b/crypto/api.c
+index 7aca9f86c5f3..1909195b2c70 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -349,13 +349,12 @@ static unsigned int crypto_ctxsize(struct crypto_alg *alg, u32 type, u32 mask)
+ return len;
+ }
+
+-void crypto_shoot_alg(struct crypto_alg *alg)
++static void crypto_shoot_alg(struct crypto_alg *alg)
+ {
+ down_write(&crypto_alg_sem);
+ alg->cra_flags |= CRYPTO_ALG_DYING;
+ up_write(&crypto_alg_sem);
+ }
+-EXPORT_SYMBOL_GPL(crypto_shoot_alg);
+
+ struct crypto_tfm *__crypto_alloc_tfm(struct crypto_alg *alg, u32 type,
+ u32 mask)
+diff --git a/crypto/internal.h b/crypto/internal.h
+index 9a3f39939fba..f8d6efaffef9 100644
+--- a/crypto/internal.h
++++ b/crypto/internal.h
+@@ -79,7 +79,6 @@ void crypto_alg_tested(const char *name, int err);
+ void crypto_remove_spawns(struct crypto_alg *alg, struct list_head *list,
+ struct crypto_alg *nalg);
+ void crypto_remove_final(struct list_head *list);
+-void crypto_shoot_alg(struct crypto_alg *alg);
+ struct crypto_tfm *__crypto_alloc_tfm(struct crypto_alg *alg, u32 type,
+ u32 mask);
+ void *crypto_create_tfm(struct crypto_alg *alg,
+diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
+index 1348541da463..85082574c515 100644
+--- a/crypto/pcrypt.c
++++ b/crypto/pcrypt.c
+@@ -130,7 +130,6 @@ static void pcrypt_aead_done(struct crypto_async_request *areq, int err)
+ struct padata_priv *padata = pcrypt_request_padata(preq);
+
+ padata->info = err;
+- req->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+
+ padata_do_serial(padata);
+ }
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index cb97b6105f52..674a0e92b798 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -51,6 +51,8 @@
+ #define PREFIX "ACPI: "
+
+ #define ACPI_BATTERY_VALUE_UNKNOWN 0xFFFFFFFF
++#define ACPI_BATTERY_CAPACITY_VALID(capacity) \
++ ((capacity) != 0 && (capacity) != ACPI_BATTERY_VALUE_UNKNOWN)
+
+ #define ACPI_BATTERY_DEVICE_NAME "Battery"
+
+@@ -205,7 +207,8 @@ static int acpi_battery_is_charged(struct acpi_battery *battery)
+
+ static bool acpi_battery_is_degraded(struct acpi_battery *battery)
+ {
+- return battery->full_charge_capacity && battery->design_capacity &&
++ return ACPI_BATTERY_CAPACITY_VALID(battery->full_charge_capacity) &&
++ ACPI_BATTERY_CAPACITY_VALID(battery->design_capacity) &&
+ battery->full_charge_capacity < battery->design_capacity;
+ }
+
+@@ -227,7 +230,7 @@ static int acpi_battery_get_property(struct power_supply *psy,
+ enum power_supply_property psp,
+ union power_supply_propval *val)
+ {
+- int ret = 0;
++ int full_capacity = ACPI_BATTERY_VALUE_UNKNOWN, ret = 0;
+ struct acpi_battery *battery = to_acpi_battery(psy);
+
+ if (acpi_battery_present(battery)) {
+@@ -276,14 +279,14 @@ static int acpi_battery_get_property(struct power_supply *psy,
+ break;
+ case POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN:
+ case POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN:
+- if (battery->design_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
++ if (!ACPI_BATTERY_CAPACITY_VALID(battery->design_capacity))
+ ret = -ENODEV;
+ else
+ val->intval = battery->design_capacity * 1000;
+ break;
+ case POWER_SUPPLY_PROP_CHARGE_FULL:
+ case POWER_SUPPLY_PROP_ENERGY_FULL:
+- if (battery->full_charge_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
++ if (!ACPI_BATTERY_CAPACITY_VALID(battery->full_charge_capacity))
+ ret = -ENODEV;
+ else
+ val->intval = battery->full_charge_capacity * 1000;
+@@ -296,11 +299,17 @@ static int acpi_battery_get_property(struct power_supply *psy,
+ val->intval = battery->capacity_now * 1000;
+ break;
+ case POWER_SUPPLY_PROP_CAPACITY:
+- if (battery->capacity_now && battery->full_charge_capacity)
+- val->intval = battery->capacity_now * 100/
+- battery->full_charge_capacity;
++ if (ACPI_BATTERY_CAPACITY_VALID(battery->full_charge_capacity))
++ full_capacity = battery->full_charge_capacity;
++ else if (ACPI_BATTERY_CAPACITY_VALID(battery->design_capacity))
++ full_capacity = battery->design_capacity;
++
++ if (battery->capacity_now == ACPI_BATTERY_VALUE_UNKNOWN ||
++ full_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
++ ret = -ENODEV;
+ else
+- val->intval = 0;
++ val->intval = battery->capacity_now * 100/
++ full_capacity;
+ break;
+ case POWER_SUPPLY_PROP_CAPACITY_LEVEL:
+ if (battery->state & ACPI_BATTERY_STATE_CRITICAL)
+@@ -346,6 +355,20 @@ static enum power_supply_property charge_battery_props[] = {
+ POWER_SUPPLY_PROP_SERIAL_NUMBER,
+ };
+
++static enum power_supply_property charge_battery_full_cap_broken_props[] = {
++ POWER_SUPPLY_PROP_STATUS,
++ POWER_SUPPLY_PROP_PRESENT,
++ POWER_SUPPLY_PROP_TECHNOLOGY,
++ POWER_SUPPLY_PROP_CYCLE_COUNT,
++ POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN,
++ POWER_SUPPLY_PROP_VOLTAGE_NOW,
++ POWER_SUPPLY_PROP_CURRENT_NOW,
++ POWER_SUPPLY_PROP_CHARGE_NOW,
++ POWER_SUPPLY_PROP_MODEL_NAME,
++ POWER_SUPPLY_PROP_MANUFACTURER,
++ POWER_SUPPLY_PROP_SERIAL_NUMBER,
++};
++
+ static enum power_supply_property energy_battery_props[] = {
+ POWER_SUPPLY_PROP_STATUS,
+ POWER_SUPPLY_PROP_PRESENT,
+@@ -807,20 +830,34 @@ static void __exit battery_hook_exit(void)
+ static int sysfs_add_battery(struct acpi_battery *battery)
+ {
+ struct power_supply_config psy_cfg = { .drv_data = battery, };
++ bool full_cap_broken = false;
++
++ if (!ACPI_BATTERY_CAPACITY_VALID(battery->full_charge_capacity) &&
++ !ACPI_BATTERY_CAPACITY_VALID(battery->design_capacity))
++ full_cap_broken = true;
+
+ if (battery->power_unit == ACPI_BATTERY_POWER_UNIT_MA) {
+- battery->bat_desc.properties = charge_battery_props;
+- battery->bat_desc.num_properties =
+- ARRAY_SIZE(charge_battery_props);
+- } else if (battery->full_charge_capacity == 0) {
+- battery->bat_desc.properties =
+- energy_battery_full_cap_broken_props;
+- battery->bat_desc.num_properties =
+- ARRAY_SIZE(energy_battery_full_cap_broken_props);
++ if (full_cap_broken) {
++ battery->bat_desc.properties =
++ charge_battery_full_cap_broken_props;
++ battery->bat_desc.num_properties =
++ ARRAY_SIZE(charge_battery_full_cap_broken_props);
++ } else {
++ battery->bat_desc.properties = charge_battery_props;
++ battery->bat_desc.num_properties =
++ ARRAY_SIZE(charge_battery_props);
++ }
+ } else {
+- battery->bat_desc.properties = energy_battery_props;
+- battery->bat_desc.num_properties =
+- ARRAY_SIZE(energy_battery_props);
++ if (full_cap_broken) {
++ battery->bat_desc.properties =
++ energy_battery_full_cap_broken_props;
++ battery->bat_desc.num_properties =
++ ARRAY_SIZE(energy_battery_full_cap_broken_props);
++ } else {
++ battery->bat_desc.properties = energy_battery_props;
++ battery->bat_desc.num_properties =
++ ARRAY_SIZE(energy_battery_props);
++ }
+ }
+
+ battery->bat_desc.name = acpi_device_bid(battery->device);
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 43587ac680e4..214c4e2e8ade 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -328,6 +328,11 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 7510"),
+ },
+ },
++
++ /*
++ * Desktops which falsely report a backlight and which our heuristics
++ * for this do not catch.
++ */
+ {
+ .callback = video_detect_force_none,
+ .ident = "Dell OptiPlex 9020M",
+@@ -336,6 +341,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 9020M"),
+ },
+ },
++ {
++ .callback = video_detect_force_none,
++ .ident = "MSI MS-7721",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MSI"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MS-7721"),
++ },
++ },
+ { },
+ };
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 4abd7c6531d9..3b382a7e07b2 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -265,10 +265,38 @@ static void dpm_wait_for_suppliers(struct device *dev, bool async)
+ device_links_read_unlock(idx);
+ }
+
+-static void dpm_wait_for_superior(struct device *dev, bool async)
++static bool dpm_wait_for_superior(struct device *dev, bool async)
+ {
+- dpm_wait(dev->parent, async);
++ struct device *parent;
++
++ /*
++ * If the device is resumed asynchronously and the parent's callback
++ * deletes both the device and the parent itself, the parent object may
++ * be freed while this function is running, so avoid that by reference
++ * counting the parent once more unless the device has been deleted
++ * already (in which case return right away).
++ */
++ mutex_lock(&dpm_list_mtx);
++
++ if (!device_pm_initialized(dev)) {
++ mutex_unlock(&dpm_list_mtx);
++ return false;
++ }
++
++ parent = get_device(dev->parent);
++
++ mutex_unlock(&dpm_list_mtx);
++
++ dpm_wait(parent, async);
++ put_device(parent);
++
+ dpm_wait_for_suppliers(dev, async);
++
++ /*
++ * If the parent's callback has deleted the device, attempting to resume
++ * it would be invalid, so avoid doing that then.
++ */
++ return device_pm_initialized(dev);
+ }
+
+ static void dpm_wait_for_consumers(struct device *dev, bool async)
+@@ -628,7 +656,8 @@ static int device_resume_noirq(struct device *dev, pm_message_t state, bool asyn
+ if (!dev->power.is_noirq_suspended)
+ goto Out;
+
+- dpm_wait_for_superior(dev, async);
++ if (!dpm_wait_for_superior(dev, async))
++ goto Out;
+
+ skip_resume = dev_pm_may_skip_resume(dev);
+
+@@ -829,7 +858,8 @@ static int device_resume_early(struct device *dev, pm_message_t state, bool asyn
+ if (!dev->power.is_late_suspended)
+ goto Out;
+
+- dpm_wait_for_superior(dev, async);
++ if (!dpm_wait_for_superior(dev, async))
++ goto Out;
+
+ callback = dpm_subsys_resume_early_cb(dev, state, &info);
+
+@@ -949,7 +979,9 @@ static int device_resume(struct device *dev, pm_message_t state, bool async)
+ goto Complete;
+ }
+
+- dpm_wait_for_superior(dev, async);
++ if (!dpm_wait_for_superior(dev, async))
++ goto Complete;
++
+ dpm_watchdog_set(&wd, dev);
+ device_lock(dev);
+
+diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
+index 38c4eb28c8bf..b137c5d34eec 100644
+--- a/drivers/clk/tegra/clk-tegra-periph.c
++++ b/drivers/clk/tegra/clk-tegra-periph.c
+@@ -799,7 +799,11 @@ static struct tegra_periph_init_data gate_clks[] = {
+ GATE("ahbdma", "hclk", 33, 0, tegra_clk_ahbdma, 0),
+ GATE("apbdma", "pclk", 34, 0, tegra_clk_apbdma, 0),
+ GATE("kbc", "clk_32k", 36, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_kbc, 0),
+- GATE("fuse", "clk_m", 39, TEGRA_PERIPH_ON_APB, tegra_clk_fuse, 0),
++ /*
++ * Critical for RAM re-repair operation, which must occur on resume
++ * from LP1 system suspend and as part of CCPLEX cluster switching.
++ */
++ GATE("fuse", "clk_m", 39, TEGRA_PERIPH_ON_APB, tegra_clk_fuse, CLK_IS_CRITICAL),
+ GATE("fuse_burn", "clk_m", 39, TEGRA_PERIPH_ON_APB, tegra_clk_fuse_burn, 0),
+ GATE("kfuse", "clk_m", 40, TEGRA_PERIPH_ON_APB, tegra_clk_kfuse, 0),
+ GATE("apbif", "clk_m", 107, TEGRA_PERIPH_ON_APB, tegra_clk_apbif, 0),
+diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
+index 53a78035381d..92060864e356 100644
+--- a/drivers/crypto/atmel-aes.c
++++ b/drivers/crypto/atmel-aes.c
+@@ -91,7 +91,6 @@
+ struct atmel_aes_caps {
+ bool has_dualbuff;
+ bool has_cfb64;
+- bool has_ctr32;
+ bool has_gcm;
+ bool has_xts;
+ bool has_authenc;
+@@ -1016,8 +1015,9 @@ static int atmel_aes_ctr_transfer(struct atmel_aes_dev *dd)
+ struct atmel_aes_ctr_ctx *ctx = atmel_aes_ctr_ctx_cast(dd->ctx);
+ struct ablkcipher_request *req = ablkcipher_request_cast(dd->areq);
+ struct scatterlist *src, *dst;
+- u32 ctr, blocks;
+ size_t datalen;
++ u32 ctr;
++ u16 blocks, start, end;
+ bool use_dma, fragmented = false;
+
+ /* Check for transfer completion. */
+@@ -1029,27 +1029,17 @@ static int atmel_aes_ctr_transfer(struct atmel_aes_dev *dd)
+ datalen = req->nbytes - ctx->offset;
+ blocks = DIV_ROUND_UP(datalen, AES_BLOCK_SIZE);
+ ctr = be32_to_cpu(ctx->iv[3]);
+- if (dd->caps.has_ctr32) {
+- /* Check 32bit counter overflow. */
+- u32 start = ctr;
+- u32 end = start + blocks - 1;
+-
+- if (end < start) {
+- ctr |= 0xffffffff;
+- datalen = AES_BLOCK_SIZE * -start;
+- fragmented = true;
+- }
+- } else {
+- /* Check 16bit counter overflow. */
+- u16 start = ctr & 0xffff;
+- u16 end = start + (u16)blocks - 1;
+-
+- if (blocks >> 16 || end < start) {
+- ctr |= 0xffff;
+- datalen = AES_BLOCK_SIZE * (0x10000-start);
+- fragmented = true;
+- }
++
++ /* Check 16bit counter overflow. */
++ start = ctr & 0xffff;
++ end = start + blocks - 1;
++
++ if (blocks >> 16 || end < start) {
++ ctr |= 0xffff;
++ datalen = AES_BLOCK_SIZE * (0x10000 - start);
++ fragmented = true;
+ }
++
+ use_dma = (datalen >= ATMEL_AES_DMA_THRESHOLD);
+
+ /* Jump to offset. */
+@@ -2553,7 +2543,6 @@ static void atmel_aes_get_cap(struct atmel_aes_dev *dd)
+ {
+ dd->caps.has_dualbuff = 0;
+ dd->caps.has_cfb64 = 0;
+- dd->caps.has_ctr32 = 0;
+ dd->caps.has_gcm = 0;
+ dd->caps.has_xts = 0;
+ dd->caps.has_authenc = 0;
+@@ -2564,7 +2553,6 @@ static void atmel_aes_get_cap(struct atmel_aes_dev *dd)
+ case 0x500:
+ dd->caps.has_dualbuff = 1;
+ dd->caps.has_cfb64 = 1;
+- dd->caps.has_ctr32 = 1;
+ dd->caps.has_gcm = 1;
+ dd->caps.has_xts = 1;
+ dd->caps.has_authenc = 1;
+@@ -2573,7 +2561,6 @@ static void atmel_aes_get_cap(struct atmel_aes_dev *dd)
+ case 0x200:
+ dd->caps.has_dualbuff = 1;
+ dd->caps.has_cfb64 = 1;
+- dd->caps.has_ctr32 = 1;
+ dd->caps.has_gcm = 1;
+ dd->caps.max_burst_size = 4;
+ break;
+diff --git a/drivers/crypto/ccp/ccp-dev-v3.c b/drivers/crypto/ccp/ccp-dev-v3.c
+index 240bebbcb8ac..ae0cc0a4dc5c 100644
+--- a/drivers/crypto/ccp/ccp-dev-v3.c
++++ b/drivers/crypto/ccp/ccp-dev-v3.c
+@@ -590,6 +590,7 @@ const struct ccp_vdata ccpv3_platform = {
+ .setup = NULL,
+ .perform = &ccp3_actions,
+ .offset = 0,
++ .rsamax = CCP_RSA_MAX_WIDTH,
+ };
+
+ const struct ccp_vdata ccpv3 = {
+diff --git a/drivers/crypto/ccree/cc_driver.h b/drivers/crypto/ccree/cc_driver.h
+index be7f9bd5c559..d41193932207 100644
+--- a/drivers/crypto/ccree/cc_driver.h
++++ b/drivers/crypto/ccree/cc_driver.h
+@@ -131,6 +131,7 @@ struct cc_drvdata {
+ u32 axim_mon_offset;
+ u32 sig_offset;
+ u32 ver_offset;
++ bool pm_on;
+ };
+
+ struct cc_crypto_alg {
+diff --git a/drivers/crypto/ccree/cc_pm.c b/drivers/crypto/ccree/cc_pm.c
+index 638082dff183..2df2c2ca8aae 100644
+--- a/drivers/crypto/ccree/cc_pm.c
++++ b/drivers/crypto/ccree/cc_pm.c
+@@ -23,14 +23,8 @@ const struct dev_pm_ops ccree_pm = {
+ int cc_pm_suspend(struct device *dev)
+ {
+ struct cc_drvdata *drvdata = dev_get_drvdata(dev);
+- int rc;
+
+ dev_dbg(dev, "set HOST_POWER_DOWN_EN\n");
+- rc = cc_suspend_req_queue(drvdata);
+- if (rc) {
+- dev_err(dev, "cc_suspend_req_queue (%x)\n", rc);
+- return rc;
+- }
+ fini_cc_regs(drvdata);
+ cc_iowrite(drvdata, CC_REG(HOST_POWER_DOWN_EN), POWER_DOWN_ENABLE);
+ cc_clk_off(drvdata);
+@@ -59,13 +53,6 @@ int cc_pm_resume(struct device *dev)
+ /* check if tee fips error occurred during power down */
+ cc_tee_handle_fips_error(drvdata);
+
+- rc = cc_resume_req_queue(drvdata);
+- if (rc) {
+- dev_err(dev, "cc_resume_req_queue (%x)\n", rc);
+- return rc;
+- }
+-
+- /* must be after the queue resuming as it uses the HW queue*/
+ cc_init_hash_sram(drvdata);
+
+ cc_init_iv_sram(drvdata);
+@@ -77,12 +64,10 @@ int cc_pm_get(struct device *dev)
+ int rc = 0;
+ struct cc_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (cc_req_queue_suspended(drvdata))
++ if (drvdata->pm_on)
+ rc = pm_runtime_get_sync(dev);
+- else
+- pm_runtime_get_noresume(dev);
+
+- return rc;
++ return (rc == 1 ? 0 : rc);
+ }
+
+ int cc_pm_put_suspend(struct device *dev)
+@@ -90,14 +75,11 @@ int cc_pm_put_suspend(struct device *dev)
+ int rc = 0;
+ struct cc_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (!cc_req_queue_suspended(drvdata)) {
++ if (drvdata->pm_on) {
+ pm_runtime_mark_last_busy(dev);
+ rc = pm_runtime_put_autosuspend(dev);
+- } else {
+- /* Something wrong happens*/
+- dev_err(dev, "request to suspend already suspended queue");
+- rc = -EBUSY;
+ }
++
+ return rc;
+ }
+
+@@ -108,7 +90,7 @@ int cc_pm_init(struct cc_drvdata *drvdata)
+ /* must be before the enabling to avoid resdundent suspending */
+ pm_runtime_set_autosuspend_delay(dev, CC_SUSPEND_TIMEOUT);
+ pm_runtime_use_autosuspend(dev);
+- /* activate the PM module */
++ /* set us as active - note we won't do PM ops until cc_pm_go()! */
+ return pm_runtime_set_active(dev);
+ }
+
+@@ -116,9 +98,11 @@ int cc_pm_init(struct cc_drvdata *drvdata)
+ void cc_pm_go(struct cc_drvdata *drvdata)
+ {
+ pm_runtime_enable(drvdata_to_dev(drvdata));
++ drvdata->pm_on = true;
+ }
+
+ void cc_pm_fini(struct cc_drvdata *drvdata)
+ {
+ pm_runtime_disable(drvdata_to_dev(drvdata));
++ drvdata->pm_on = false;
+ }
+diff --git a/drivers/crypto/ccree/cc_request_mgr.c b/drivers/crypto/ccree/cc_request_mgr.c
+index 83a8aaae61c7..1d88abc6d230 100644
+--- a/drivers/crypto/ccree/cc_request_mgr.c
++++ b/drivers/crypto/ccree/cc_request_mgr.c
+@@ -41,7 +41,6 @@ struct cc_req_mgr_handle {
+ #else
+ struct tasklet_struct comptask;
+ #endif
+- bool is_runtime_suspended;
+ };
+
+ struct cc_bl_item {
+@@ -403,6 +402,7 @@ static void cc_proc_backlog(struct cc_drvdata *drvdata)
+ spin_lock(&mgr->bl_lock);
+ list_del(&bli->list);
+ --mgr->bl_len;
++ kfree(bli);
+ }
+
+ spin_unlock(&mgr->bl_lock);
+@@ -660,52 +660,3 @@ static void comp_handler(unsigned long devarg)
+
+ cc_proc_backlog(drvdata);
+ }
+-
+-/*
+- * resume the queue configuration - no need to take the lock as this happens
+- * inside the spin lock protection
+- */
+-#if defined(CONFIG_PM)
+-int cc_resume_req_queue(struct cc_drvdata *drvdata)
+-{
+- struct cc_req_mgr_handle *request_mgr_handle =
+- drvdata->request_mgr_handle;
+-
+- spin_lock_bh(&request_mgr_handle->hw_lock);
+- request_mgr_handle->is_runtime_suspended = false;
+- spin_unlock_bh(&request_mgr_handle->hw_lock);
+-
+- return 0;
+-}
+-
+-/*
+- * suspend the queue configuration. Since it is used for the runtime suspend
+- * only verify that the queue can be suspended.
+- */
+-int cc_suspend_req_queue(struct cc_drvdata *drvdata)
+-{
+- struct cc_req_mgr_handle *request_mgr_handle =
+- drvdata->request_mgr_handle;
+-
+- /* lock the send_request */
+- spin_lock_bh(&request_mgr_handle->hw_lock);
+- if (request_mgr_handle->req_queue_head !=
+- request_mgr_handle->req_queue_tail) {
+- spin_unlock_bh(&request_mgr_handle->hw_lock);
+- return -EBUSY;
+- }
+- request_mgr_handle->is_runtime_suspended = true;
+- spin_unlock_bh(&request_mgr_handle->hw_lock);
+-
+- return 0;
+-}
+-
+-bool cc_req_queue_suspended(struct cc_drvdata *drvdata)
+-{
+- struct cc_req_mgr_handle *request_mgr_handle =
+- drvdata->request_mgr_handle;
+-
+- return request_mgr_handle->is_runtime_suspended;
+-}
+-
+-#endif
+diff --git a/drivers/crypto/ccree/cc_request_mgr.h b/drivers/crypto/ccree/cc_request_mgr.h
+index 573cb97af085..ae96abce25c9 100644
+--- a/drivers/crypto/ccree/cc_request_mgr.h
++++ b/drivers/crypto/ccree/cc_request_mgr.h
+@@ -40,12 +40,4 @@ void complete_request(struct cc_drvdata *drvdata);
+
+ void cc_req_mgr_fini(struct cc_drvdata *drvdata);
+
+-#if defined(CONFIG_PM)
+-int cc_resume_req_queue(struct cc_drvdata *drvdata);
+-
+-int cc_suspend_req_queue(struct cc_drvdata *drvdata);
+-
+-bool cc_req_queue_suspended(struct cc_drvdata *drvdata);
+-#endif
+-
+ #endif /*__REQUEST_MGR_H__*/
+diff --git a/drivers/crypto/geode-aes.c b/drivers/crypto/geode-aes.c
+index d670f7000cbb..0bd99c0decf5 100644
+--- a/drivers/crypto/geode-aes.c
++++ b/drivers/crypto/geode-aes.c
+@@ -14,7 +14,7 @@
+ #include <linux/spinlock.h>
+ #include <crypto/algapi.h>
+ #include <crypto/aes.h>
+-#include <crypto/skcipher.h>
++#include <crypto/internal/skcipher.h>
+
+ #include <linux/io.h>
+ #include <linux/delay.h>
+@@ -28,12 +28,12 @@ static spinlock_t lock;
+
+ /* Write a 128 bit field (either a writable key or IV) */
+ static inline void
+-_writefield(u32 offset, void *value)
++_writefield(u32 offset, const void *value)
+ {
+ int i;
+
+ for (i = 0; i < 4; i++)
+- iowrite32(((u32 *) value)[i], _iobase + offset + (i * 4));
++ iowrite32(((const u32 *) value)[i], _iobase + offset + (i * 4));
+ }
+
+ /* Read a 128 bit field (either a writable key or IV) */
+@@ -47,12 +47,12 @@ _readfield(u32 offset, void *value)
+ }
+
+ static int
+-do_crypt(void *src, void *dst, int len, u32 flags)
++do_crypt(const void *src, void *dst, u32 len, u32 flags)
+ {
+ u32 status;
+ u32 counter = AES_OP_TIMEOUT;
+
+- iowrite32(virt_to_phys(src), _iobase + AES_SOURCEA_REG);
++ iowrite32(virt_to_phys((void *)src), _iobase + AES_SOURCEA_REG);
+ iowrite32(virt_to_phys(dst), _iobase + AES_DSTA_REG);
+ iowrite32(len, _iobase + AES_LENA_REG);
+
+@@ -69,16 +69,14 @@ do_crypt(void *src, void *dst, int len, u32 flags)
+ return counter ? 0 : 1;
+ }
+
+-static unsigned int
+-geode_aes_crypt(struct geode_aes_op *op)
++static void
++geode_aes_crypt(const struct geode_aes_tfm_ctx *tctx, const void *src,
++ void *dst, u32 len, u8 *iv, int mode, int dir)
+ {
+ u32 flags = 0;
+ unsigned long iflags;
+ int ret;
+
+- if (op->len == 0)
+- return 0;
+-
+ /* If the source and destination is the same, then
+ * we need to turn on the coherent flags, otherwise
+ * we don't need to worry
+@@ -86,32 +84,28 @@ geode_aes_crypt(struct geode_aes_op *op)
+
+ flags |= (AES_CTRL_DCA | AES_CTRL_SCA);
+
+- if (op->dir == AES_DIR_ENCRYPT)
++ if (dir == AES_DIR_ENCRYPT)
+ flags |= AES_CTRL_ENCRYPT;
+
+ /* Start the critical section */
+
+ spin_lock_irqsave(&lock, iflags);
+
+- if (op->mode == AES_MODE_CBC) {
++ if (mode == AES_MODE_CBC) {
+ flags |= AES_CTRL_CBC;
+- _writefield(AES_WRITEIV0_REG, op->iv);
++ _writefield(AES_WRITEIV0_REG, iv);
+ }
+
+- if (!(op->flags & AES_FLAGS_HIDDENKEY)) {
+- flags |= AES_CTRL_WRKEY;
+- _writefield(AES_WRITEKEY0_REG, op->key);
+- }
++ flags |= AES_CTRL_WRKEY;
++ _writefield(AES_WRITEKEY0_REG, tctx->key);
+
+- ret = do_crypt(op->src, op->dst, op->len, flags);
++ ret = do_crypt(src, dst, len, flags);
+ BUG_ON(ret);
+
+- if (op->mode == AES_MODE_CBC)
+- _readfield(AES_WRITEIV0_REG, op->iv);
++ if (mode == AES_MODE_CBC)
++ _readfield(AES_WRITEIV0_REG, iv);
+
+ spin_unlock_irqrestore(&lock, iflags);
+-
+- return op->len;
+ }
+
+ /* CRYPTO-API Functions */
+@@ -119,13 +113,13 @@ geode_aes_crypt(struct geode_aes_op *op)
+ static int geode_setkey_cip(struct crypto_tfm *tfm, const u8 *key,
+ unsigned int len)
+ {
+- struct geode_aes_op *op = crypto_tfm_ctx(tfm);
++ struct geode_aes_tfm_ctx *tctx = crypto_tfm_ctx(tfm);
+ unsigned int ret;
+
+- op->keylen = len;
++ tctx->keylen = len;
+
+ if (len == AES_KEYSIZE_128) {
+- memcpy(op->key, key, len);
++ memcpy(tctx->key, key, len);
+ return 0;
+ }
+
+@@ -138,132 +132,93 @@ static int geode_setkey_cip(struct crypto_tfm *tfm, const u8 *key,
+ /*
+ * The requested key size is not supported by HW, do a fallback
+ */
+- op->fallback.cip->base.crt_flags &= ~CRYPTO_TFM_REQ_MASK;
+- op->fallback.cip->base.crt_flags |= (tfm->crt_flags & CRYPTO_TFM_REQ_MASK);
++ tctx->fallback.cip->base.crt_flags &= ~CRYPTO_TFM_REQ_MASK;
++ tctx->fallback.cip->base.crt_flags |=
++ (tfm->crt_flags & CRYPTO_TFM_REQ_MASK);
+
+- ret = crypto_cipher_setkey(op->fallback.cip, key, len);
++ ret = crypto_cipher_setkey(tctx->fallback.cip, key, len);
+ if (ret) {
+ tfm->crt_flags &= ~CRYPTO_TFM_RES_MASK;
+- tfm->crt_flags |= (op->fallback.cip->base.crt_flags & CRYPTO_TFM_RES_MASK);
++ tfm->crt_flags |= (tctx->fallback.cip->base.crt_flags &
++ CRYPTO_TFM_RES_MASK);
+ }
+ return ret;
+ }
+
+-static int geode_setkey_blk(struct crypto_tfm *tfm, const u8 *key,
+- unsigned int len)
++static int geode_setkey_skcipher(struct crypto_skcipher *tfm, const u8 *key,
++ unsigned int len)
+ {
+- struct geode_aes_op *op = crypto_tfm_ctx(tfm);
++ struct geode_aes_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
+ unsigned int ret;
+
+- op->keylen = len;
++ tctx->keylen = len;
+
+ if (len == AES_KEYSIZE_128) {
+- memcpy(op->key, key, len);
++ memcpy(tctx->key, key, len);
+ return 0;
+ }
+
+ if (len != AES_KEYSIZE_192 && len != AES_KEYSIZE_256) {
+ /* not supported at all */
+- tfm->crt_flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
++ crypto_skcipher_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
+ return -EINVAL;
+ }
+
+ /*
+ * The requested key size is not supported by HW, do a fallback
+ */
+- crypto_skcipher_clear_flags(op->fallback.blk, CRYPTO_TFM_REQ_MASK);
+- crypto_skcipher_set_flags(op->fallback.blk,
+- tfm->crt_flags & CRYPTO_TFM_REQ_MASK);
+-
+- ret = crypto_skcipher_setkey(op->fallback.blk, key, len);
+- if (ret) {
+- tfm->crt_flags &= ~CRYPTO_TFM_RES_MASK;
+- tfm->crt_flags |= crypto_skcipher_get_flags(op->fallback.blk) &
+- CRYPTO_TFM_RES_MASK;
+- }
++ crypto_skcipher_clear_flags(tctx->fallback.skcipher,
++ CRYPTO_TFM_REQ_MASK);
++ crypto_skcipher_set_flags(tctx->fallback.skcipher,
++ crypto_skcipher_get_flags(tfm) &
++ CRYPTO_TFM_REQ_MASK);
++ ret = crypto_skcipher_setkey(tctx->fallback.skcipher, key, len);
++ crypto_skcipher_set_flags(tfm,
++ crypto_skcipher_get_flags(tctx->fallback.skcipher) &
++ CRYPTO_TFM_RES_MASK);
+ return ret;
+ }
+
+-static int fallback_blk_dec(struct blkcipher_desc *desc,
+- struct scatterlist *dst, struct scatterlist *src,
+- unsigned int nbytes)
+-{
+- struct geode_aes_op *op = crypto_blkcipher_ctx(desc->tfm);
+- SKCIPHER_REQUEST_ON_STACK(req, op->fallback.blk);
+-
+- skcipher_request_set_tfm(req, op->fallback.blk);
+- skcipher_request_set_callback(req, 0, NULL, NULL);
+- skcipher_request_set_crypt(req, src, dst, nbytes, desc->info);
+-
+- return crypto_skcipher_decrypt(req);
+-}
+-
+-static int fallback_blk_enc(struct blkcipher_desc *desc,
+- struct scatterlist *dst, struct scatterlist *src,
+- unsigned int nbytes)
+-{
+- struct geode_aes_op *op = crypto_blkcipher_ctx(desc->tfm);
+- SKCIPHER_REQUEST_ON_STACK(req, op->fallback.blk);
+-
+- skcipher_request_set_tfm(req, op->fallback.blk);
+- skcipher_request_set_callback(req, 0, NULL, NULL);
+- skcipher_request_set_crypt(req, src, dst, nbytes, desc->info);
+-
+- return crypto_skcipher_encrypt(req);
+-}
+-
+ static void
+ geode_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+ {
+- struct geode_aes_op *op = crypto_tfm_ctx(tfm);
++ const struct geode_aes_tfm_ctx *tctx = crypto_tfm_ctx(tfm);
+
+- if (unlikely(op->keylen != AES_KEYSIZE_128)) {
+- crypto_cipher_encrypt_one(op->fallback.cip, out, in);
++ if (unlikely(tctx->keylen != AES_KEYSIZE_128)) {
++ crypto_cipher_encrypt_one(tctx->fallback.cip, out, in);
+ return;
+ }
+
+- op->src = (void *) in;
+- op->dst = (void *) out;
+- op->mode = AES_MODE_ECB;
+- op->flags = 0;
+- op->len = AES_BLOCK_SIZE;
+- op->dir = AES_DIR_ENCRYPT;
+-
+- geode_aes_crypt(op);
++ geode_aes_crypt(tctx, in, out, AES_BLOCK_SIZE, NULL,
++ AES_MODE_ECB, AES_DIR_ENCRYPT);
+ }
+
+
+ static void
+ geode_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+ {
+- struct geode_aes_op *op = crypto_tfm_ctx(tfm);
++ const struct geode_aes_tfm_ctx *tctx = crypto_tfm_ctx(tfm);
+
+- if (unlikely(op->keylen != AES_KEYSIZE_128)) {
+- crypto_cipher_decrypt_one(op->fallback.cip, out, in);
++ if (unlikely(tctx->keylen != AES_KEYSIZE_128)) {
++ crypto_cipher_decrypt_one(tctx->fallback.cip, out, in);
+ return;
+ }
+
+- op->src = (void *) in;
+- op->dst = (void *) out;
+- op->mode = AES_MODE_ECB;
+- op->flags = 0;
+- op->len = AES_BLOCK_SIZE;
+- op->dir = AES_DIR_DECRYPT;
+-
+- geode_aes_crypt(op);
++ geode_aes_crypt(tctx, in, out, AES_BLOCK_SIZE, NULL,
++ AES_MODE_ECB, AES_DIR_DECRYPT);
+ }
+
+ static int fallback_init_cip(struct crypto_tfm *tfm)
+ {
+ const char *name = crypto_tfm_alg_name(tfm);
+- struct geode_aes_op *op = crypto_tfm_ctx(tfm);
++ struct geode_aes_tfm_ctx *tctx = crypto_tfm_ctx(tfm);
+
+- op->fallback.cip = crypto_alloc_cipher(name, 0,
+- CRYPTO_ALG_ASYNC | CRYPTO_ALG_NEED_FALLBACK);
++ tctx->fallback.cip = crypto_alloc_cipher(name, 0,
++ CRYPTO_ALG_NEED_FALLBACK);
+
+- if (IS_ERR(op->fallback.cip)) {
++ if (IS_ERR(tctx->fallback.cip)) {
+ printk(KERN_ERR "Error allocating fallback algo %s\n", name);
+- return PTR_ERR(op->fallback.cip);
++ return PTR_ERR(tctx->fallback.cip);
+ }
+
+ return 0;
+@@ -271,10 +226,9 @@ static int fallback_init_cip(struct crypto_tfm *tfm)
+
+ static void fallback_exit_cip(struct crypto_tfm *tfm)
+ {
+- struct geode_aes_op *op = crypto_tfm_ctx(tfm);
++ struct geode_aes_tfm_ctx *tctx = crypto_tfm_ctx(tfm);
+
+- crypto_free_cipher(op->fallback.cip);
+- op->fallback.cip = NULL;
++ crypto_free_cipher(tctx->fallback.cip);
+ }
+
+ static struct crypto_alg geode_alg = {
+@@ -287,7 +241,7 @@ static struct crypto_alg geode_alg = {
+ .cra_init = fallback_init_cip,
+ .cra_exit = fallback_exit_cip,
+ .cra_blocksize = AES_BLOCK_SIZE,
+- .cra_ctxsize = sizeof(struct geode_aes_op),
++ .cra_ctxsize = sizeof(struct geode_aes_tfm_ctx),
+ .cra_module = THIS_MODULE,
+ .cra_u = {
+ .cipher = {
+@@ -300,222 +254,126 @@ static struct crypto_alg geode_alg = {
+ }
+ };
+
+-static int
+-geode_cbc_decrypt(struct blkcipher_desc *desc,
+- struct scatterlist *dst, struct scatterlist *src,
+- unsigned int nbytes)
++static int geode_init_skcipher(struct crypto_skcipher *tfm)
+ {
+- struct geode_aes_op *op = crypto_blkcipher_ctx(desc->tfm);
+- struct blkcipher_walk walk;
+- int err, ret;
+-
+- if (nbytes % AES_BLOCK_SIZE)
+- return -EINVAL;
+-
+- if (unlikely(op->keylen != AES_KEYSIZE_128))
+- return fallback_blk_dec(desc, dst, src, nbytes);
++ const char *name = crypto_tfm_alg_name(&tfm->base);
++ struct geode_aes_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
+
+- blkcipher_walk_init(&walk, dst, src, nbytes);
+- err = blkcipher_walk_virt(desc, &walk);
+- op->iv = walk.iv;
+-
+- while ((nbytes = walk.nbytes)) {
+- op->src = walk.src.virt.addr,
+- op->dst = walk.dst.virt.addr;
+- op->mode = AES_MODE_CBC;
+- op->len = nbytes - (nbytes % AES_BLOCK_SIZE);
+- op->dir = AES_DIR_DECRYPT;
+-
+- ret = geode_aes_crypt(op);
+-
+- nbytes -= ret;
+- err = blkcipher_walk_done(desc, &walk, nbytes);
++ tctx->fallback.skcipher =
++ crypto_alloc_skcipher(name, 0, CRYPTO_ALG_NEED_FALLBACK |
++ CRYPTO_ALG_ASYNC);
++ if (IS_ERR(tctx->fallback.skcipher)) {
++ printk(KERN_ERR "Error allocating fallback algo %s\n", name);
++ return PTR_ERR(tctx->fallback.skcipher);
+ }
+
+- return err;
++ crypto_skcipher_set_reqsize(tfm, sizeof(struct skcipher_request) +
++ crypto_skcipher_reqsize(tctx->fallback.skcipher));
++ return 0;
+ }
+
+-static int
+-geode_cbc_encrypt(struct blkcipher_desc *desc,
+- struct scatterlist *dst, struct scatterlist *src,
+- unsigned int nbytes)
++static void geode_exit_skcipher(struct crypto_skcipher *tfm)
+ {
+- struct geode_aes_op *op = crypto_blkcipher_ctx(desc->tfm);
+- struct blkcipher_walk walk;
+- int err, ret;
++ struct geode_aes_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
+
+- if (nbytes % AES_BLOCK_SIZE)
+- return -EINVAL;
+-
+- if (unlikely(op->keylen != AES_KEYSIZE_128))
+- return fallback_blk_enc(desc, dst, src, nbytes);
++ crypto_free_skcipher(tctx->fallback.skcipher);
++}
+
+- blkcipher_walk_init(&walk, dst, src, nbytes);
+- err = blkcipher_walk_virt(desc, &walk);
+- op->iv = walk.iv;
++static int geode_skcipher_crypt(struct skcipher_request *req, int mode, int dir)
++{
++ struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
++ const struct geode_aes_tfm_ctx *tctx = crypto_skcipher_ctx(tfm);
++ struct skcipher_walk walk;
++ unsigned int nbytes;
++ int err;
++
++ if (unlikely(tctx->keylen != AES_KEYSIZE_128)) {
++ struct skcipher_request *subreq = skcipher_request_ctx(req);
++
++ *subreq = *req;
++ skcipher_request_set_tfm(subreq, tctx->fallback.skcipher);
++ if (dir == AES_DIR_DECRYPT)
++ return crypto_skcipher_decrypt(subreq);
++ else
++ return crypto_skcipher_encrypt(subreq);
++ }
+
+- while ((nbytes = walk.nbytes)) {
+- op->src = walk.src.virt.addr,
+- op->dst = walk.dst.virt.addr;
+- op->mode = AES_MODE_CBC;
+- op->len = nbytes - (nbytes % AES_BLOCK_SIZE);
+- op->dir = AES_DIR_ENCRYPT;
++ err = skcipher_walk_virt(&walk, req, false);
+
+- ret = geode_aes_crypt(op);
+- nbytes -= ret;
+- err = blkcipher_walk_done(desc, &walk, nbytes);
++ while ((nbytes = walk.nbytes) != 0) {
++ geode_aes_crypt(tctx, walk.src.virt.addr, walk.dst.virt.addr,
++ round_down(nbytes, AES_BLOCK_SIZE),
++ walk.iv, mode, dir);
++ err = skcipher_walk_done(&walk, nbytes % AES_BLOCK_SIZE);
+ }
+
+ return err;
+ }
+
+-static int fallback_init_blk(struct crypto_tfm *tfm)
++static int geode_cbc_encrypt(struct skcipher_request *req)
+ {
+- const char *name = crypto_tfm_alg_name(tfm);
+- struct geode_aes_op *op = crypto_tfm_ctx(tfm);
+-
+- op->fallback.blk = crypto_alloc_skcipher(name, 0,
+- CRYPTO_ALG_ASYNC |
+- CRYPTO_ALG_NEED_FALLBACK);
+-
+- if (IS_ERR(op->fallback.blk)) {
+- printk(KERN_ERR "Error allocating fallback algo %s\n", name);
+- return PTR_ERR(op->fallback.blk);
+- }
+-
+- return 0;
++ return geode_skcipher_crypt(req, AES_MODE_CBC, AES_DIR_ENCRYPT);
+ }
+
+-static void fallback_exit_blk(struct crypto_tfm *tfm)
++static int geode_cbc_decrypt(struct skcipher_request *req)
+ {
+- struct geode_aes_op *op = crypto_tfm_ctx(tfm);
+-
+- crypto_free_skcipher(op->fallback.blk);
+- op->fallback.blk = NULL;
++ return geode_skcipher_crypt(req, AES_MODE_CBC, AES_DIR_DECRYPT);
+ }
+
+-static struct crypto_alg geode_cbc_alg = {
+- .cra_name = "cbc(aes)",
+- .cra_driver_name = "cbc-aes-geode",
+- .cra_priority = 400,
+- .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER |
+- CRYPTO_ALG_KERN_DRIVER_ONLY |
+- CRYPTO_ALG_NEED_FALLBACK,
+- .cra_init = fallback_init_blk,
+- .cra_exit = fallback_exit_blk,
+- .cra_blocksize = AES_BLOCK_SIZE,
+- .cra_ctxsize = sizeof(struct geode_aes_op),
+- .cra_alignmask = 15,
+- .cra_type = &crypto_blkcipher_type,
+- .cra_module = THIS_MODULE,
+- .cra_u = {
+- .blkcipher = {
+- .min_keysize = AES_MIN_KEY_SIZE,
+- .max_keysize = AES_MAX_KEY_SIZE,
+- .setkey = geode_setkey_blk,
+- .encrypt = geode_cbc_encrypt,
+- .decrypt = geode_cbc_decrypt,
+- .ivsize = AES_BLOCK_SIZE,
+- }
+- }
+-};
+-
+-static int
+-geode_ecb_decrypt(struct blkcipher_desc *desc,
+- struct scatterlist *dst, struct scatterlist *src,
+- unsigned int nbytes)
++static int geode_ecb_encrypt(struct skcipher_request *req)
+ {
+- struct geode_aes_op *op = crypto_blkcipher_ctx(desc->tfm);
+- struct blkcipher_walk walk;
+- int err, ret;
+-
+- if (nbytes % AES_BLOCK_SIZE)
+- return -EINVAL;
+-
+- if (unlikely(op->keylen != AES_KEYSIZE_128))
+- return fallback_blk_dec(desc, dst, src, nbytes);
+-
+- blkcipher_walk_init(&walk, dst, src, nbytes);
+- err = blkcipher_walk_virt(desc, &walk);
+-
+- while ((nbytes = walk.nbytes)) {
+- op->src = walk.src.virt.addr,
+- op->dst = walk.dst.virt.addr;
+- op->mode = AES_MODE_ECB;
+- op->len = nbytes - (nbytes % AES_BLOCK_SIZE);
+- op->dir = AES_DIR_DECRYPT;
+-
+- ret = geode_aes_crypt(op);
+- nbytes -= ret;
+- err = blkcipher_walk_done(desc, &walk, nbytes);
+- }
+-
+- return err;
++ return geode_skcipher_crypt(req, AES_MODE_ECB, AES_DIR_ENCRYPT);
+ }
+
+-static int
+-geode_ecb_encrypt(struct blkcipher_desc *desc,
+- struct scatterlist *dst, struct scatterlist *src,
+- unsigned int nbytes)
++static int geode_ecb_decrypt(struct skcipher_request *req)
+ {
+- struct geode_aes_op *op = crypto_blkcipher_ctx(desc->tfm);
+- struct blkcipher_walk walk;
+- int err, ret;
+-
+- if (nbytes % AES_BLOCK_SIZE)
+- return -EINVAL;
+-
+- if (unlikely(op->keylen != AES_KEYSIZE_128))
+- return fallback_blk_enc(desc, dst, src, nbytes);
+-
+- blkcipher_walk_init(&walk, dst, src, nbytes);
+- err = blkcipher_walk_virt(desc, &walk);
+-
+- while ((nbytes = walk.nbytes)) {
+- op->src = walk.src.virt.addr,
+- op->dst = walk.dst.virt.addr;
+- op->mode = AES_MODE_ECB;
+- op->len = nbytes - (nbytes % AES_BLOCK_SIZE);
+- op->dir = AES_DIR_ENCRYPT;
+-
+- ret = geode_aes_crypt(op);
+- nbytes -= ret;
+- ret = blkcipher_walk_done(desc, &walk, nbytes);
+- }
+-
+- return err;
++ return geode_skcipher_crypt(req, AES_MODE_ECB, AES_DIR_DECRYPT);
+ }
+
+-static struct crypto_alg geode_ecb_alg = {
+- .cra_name = "ecb(aes)",
+- .cra_driver_name = "ecb-aes-geode",
+- .cra_priority = 400,
+- .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER |
+- CRYPTO_ALG_KERN_DRIVER_ONLY |
+- CRYPTO_ALG_NEED_FALLBACK,
+- .cra_init = fallback_init_blk,
+- .cra_exit = fallback_exit_blk,
+- .cra_blocksize = AES_BLOCK_SIZE,
+- .cra_ctxsize = sizeof(struct geode_aes_op),
+- .cra_alignmask = 15,
+- .cra_type = &crypto_blkcipher_type,
+- .cra_module = THIS_MODULE,
+- .cra_u = {
+- .blkcipher = {
+- .min_keysize = AES_MIN_KEY_SIZE,
+- .max_keysize = AES_MAX_KEY_SIZE,
+- .setkey = geode_setkey_blk,
+- .encrypt = geode_ecb_encrypt,
+- .decrypt = geode_ecb_decrypt,
+- }
+- }
++static struct skcipher_alg geode_skcipher_algs[] = {
++ {
++ .base.cra_name = "cbc(aes)",
++ .base.cra_driver_name = "cbc-aes-geode",
++ .base.cra_priority = 400,
++ .base.cra_flags = CRYPTO_ALG_KERN_DRIVER_ONLY |
++ CRYPTO_ALG_NEED_FALLBACK,
++ .base.cra_blocksize = AES_BLOCK_SIZE,
++ .base.cra_ctxsize = sizeof(struct geode_aes_tfm_ctx),
++ .base.cra_alignmask = 15,
++ .base.cra_module = THIS_MODULE,
++ .init = geode_init_skcipher,
++ .exit = geode_exit_skcipher,
++ .setkey = geode_setkey_skcipher,
++ .encrypt = geode_cbc_encrypt,
++ .decrypt = geode_cbc_decrypt,
++ .min_keysize = AES_MIN_KEY_SIZE,
++ .max_keysize = AES_MAX_KEY_SIZE,
++ .ivsize = AES_BLOCK_SIZE,
++ }, {
++ .base.cra_name = "ecb(aes)",
++ .base.cra_driver_name = "ecb-aes-geode",
++ .base.cra_priority = 400,
++ .base.cra_flags = CRYPTO_ALG_KERN_DRIVER_ONLY |
++ CRYPTO_ALG_NEED_FALLBACK,
++ .base.cra_blocksize = AES_BLOCK_SIZE,
++ .base.cra_ctxsize = sizeof(struct geode_aes_tfm_ctx),
++ .base.cra_alignmask = 15,
++ .base.cra_module = THIS_MODULE,
++ .init = geode_init_skcipher,
++ .exit = geode_exit_skcipher,
++ .setkey = geode_setkey_skcipher,
++ .encrypt = geode_ecb_encrypt,
++ .decrypt = geode_ecb_decrypt,
++ .min_keysize = AES_MIN_KEY_SIZE,
++ .max_keysize = AES_MAX_KEY_SIZE,
++ },
+ };
+
+ static void geode_aes_remove(struct pci_dev *dev)
+ {
+ crypto_unregister_alg(&geode_alg);
+- crypto_unregister_alg(&geode_ecb_alg);
+- crypto_unregister_alg(&geode_cbc_alg);
++ crypto_unregister_skciphers(geode_skcipher_algs,
++ ARRAY_SIZE(geode_skcipher_algs));
+
+ pci_iounmap(dev, _iobase);
+ _iobase = NULL;
+@@ -553,20 +411,14 @@ static int geode_aes_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ if (ret)
+ goto eiomap;
+
+- ret = crypto_register_alg(&geode_ecb_alg);
++ ret = crypto_register_skciphers(geode_skcipher_algs,
++ ARRAY_SIZE(geode_skcipher_algs));
+ if (ret)
+ goto ealg;
+
+- ret = crypto_register_alg(&geode_cbc_alg);
+- if (ret)
+- goto eecb;
+-
+ dev_notice(&dev->dev, "GEODE AES engine enabled.\n");
+ return 0;
+
+- eecb:
+- crypto_unregister_alg(&geode_ecb_alg);
+-
+ ealg:
+ crypto_unregister_alg(&geode_alg);
+
+diff --git a/drivers/crypto/geode-aes.h b/drivers/crypto/geode-aes.h
+index c5763a041bb8..157443dc6d8a 100644
+--- a/drivers/crypto/geode-aes.h
++++ b/drivers/crypto/geode-aes.h
+@@ -50,21 +50,10 @@
+
+ #define AES_OP_TIMEOUT 0x50000
+
+-struct geode_aes_op {
+-
+- void *src;
+- void *dst;
+-
+- u32 mode;
+- u32 dir;
+- u32 flags;
+- int len;
+-
++struct geode_aes_tfm_ctx {
+ u8 key[AES_KEYSIZE_128];
+- u8 *iv;
+-
+ union {
+- struct crypto_skcipher *blk;
++ struct crypto_skcipher *skcipher;
+ struct crypto_cipher *cip;
+ } fallback;
+ u32 keylen;
+diff --git a/drivers/crypto/picoxcell_crypto.c b/drivers/crypto/picoxcell_crypto.c
+index 321d5e2ac833..e2491754c468 100644
+--- a/drivers/crypto/picoxcell_crypto.c
++++ b/drivers/crypto/picoxcell_crypto.c
+@@ -1616,6 +1616,11 @@ static const struct of_device_id spacc_of_id_table[] = {
+ MODULE_DEVICE_TABLE(of, spacc_of_id_table);
+ #endif /* CONFIG_OF */
+
++static void spacc_tasklet_kill(void *data)
++{
++ tasklet_kill(data);
++}
++
+ static int spacc_probe(struct platform_device *pdev)
+ {
+ int i, err, ret;
+@@ -1659,6 +1664,14 @@ static int spacc_probe(struct platform_device *pdev)
+ return -ENXIO;
+ }
+
++ tasklet_init(&engine->complete, spacc_spacc_complete,
++ (unsigned long)engine);
++
++ ret = devm_add_action(&pdev->dev, spacc_tasklet_kill,
++ &engine->complete);
++ if (ret)
++ return ret;
++
+ if (devm_request_irq(&pdev->dev, irq->start, spacc_spacc_irq, 0,
+ engine->name, engine)) {
+ dev_err(engine->dev, "failed to request IRQ\n");
+@@ -1716,8 +1729,6 @@ static int spacc_probe(struct platform_device *pdev)
+ INIT_LIST_HEAD(&engine->completed);
+ INIT_LIST_HEAD(&engine->in_progress);
+ engine->in_flight = 0;
+- tasklet_init(&engine->complete, spacc_spacc_complete,
+- (unsigned long)engine);
+
+ platform_set_drvdata(pdev, engine);
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+index 8403b6a9a77b..d8c53ddc23b4 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+@@ -248,7 +248,8 @@ bool dm_helpers_dp_mst_write_payload_allocation_table(
+ drm_dp_mst_reset_vcpi_slots(mst_mgr, mst_port);
+ }
+
+- ret = drm_dp_update_payload_part1(mst_mgr);
++ /* It's OK for this to fail */
++ drm_dp_update_payload_part1(mst_mgr);
+
+ /* mst_mgr->->payloads are VC payload notify MST branch using DPCD or
+ * AUX message. The sequence is slot 1-63 allocated sequence for each
+@@ -257,9 +258,6 @@ bool dm_helpers_dp_mst_write_payload_allocation_table(
+
+ get_payload_table(aconnector, proposed_table);
+
+- if (ret)
+- return false;
+-
+ return true;
+ }
+
+@@ -310,7 +308,6 @@ bool dm_helpers_dp_mst_send_payload_allocation(
+ struct amdgpu_dm_connector *aconnector;
+ struct drm_dp_mst_topology_mgr *mst_mgr;
+ struct drm_dp_mst_port *mst_port;
+- int ret;
+
+ aconnector = stream->sink->priv;
+
+@@ -324,10 +321,8 @@ bool dm_helpers_dp_mst_send_payload_allocation(
+ if (!mst_mgr->mst_state)
+ return false;
+
+- ret = drm_dp_update_payload_part2(mst_mgr);
+-
+- if (ret)
+- return false;
++ /* It's OK for this to fail */
++ drm_dp_update_payload_part2(mst_mgr);
+
+ if (!enable)
+ drm_dp_mst_deallocate_vcpi(mst_mgr, mst_port);
+diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
+index d73281095fac..976109c20d49 100644
+--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
+@@ -79,7 +79,11 @@ static void atmel_hlcdc_crtc_mode_set_nofb(struct drm_crtc *c)
+ struct videomode vm;
+ unsigned long prate;
+ unsigned int cfg;
+- int div;
++ int div, ret;
++
++ ret = clk_prepare_enable(crtc->dc->hlcdc->sys_clk);
++ if (ret)
++ return;
+
+ vm.vfront_porch = adj->crtc_vsync_start - adj->crtc_vdisplay;
+ vm.vback_porch = adj->crtc_vtotal - adj->crtc_vsync_end;
+@@ -138,6 +142,8 @@ static void atmel_hlcdc_crtc_mode_set_nofb(struct drm_crtc *c)
+ ATMEL_HLCDC_VSPSU | ATMEL_HLCDC_VSPHO |
+ ATMEL_HLCDC_GUARDTIME_MASK | ATMEL_HLCDC_MODE_MASK,
+ cfg);
++
++ clk_disable_unprepare(crtc->dc->hlcdc->sys_clk);
+ }
+
+ static enum drm_mode_status
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 58fe3945494c..bf4eed5f6a7e 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2125,6 +2125,7 @@ static bool drm_dp_get_vc_payload_bw(int dp_link_bw,
+ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool mst_state)
+ {
+ int ret = 0;
++ int i = 0;
+ struct drm_dp_mst_branch *mstb = NULL;
+
+ mutex_lock(&mgr->lock);
+@@ -2185,10 +2186,21 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms
+ /* this can fail if the device is gone */
+ drm_dp_dpcd_writeb(mgr->aux, DP_MSTM_CTRL, 0);
+ ret = 0;
++ mutex_lock(&mgr->payload_lock);
+ memset(mgr->payloads, 0, mgr->max_payloads * sizeof(struct drm_dp_payload));
+ mgr->payload_mask = 0;
+ set_bit(0, &mgr->payload_mask);
++ for (i = 0; i < mgr->max_payloads; i++) {
++ struct drm_dp_vcpi *vcpi = mgr->proposed_vcpis[i];
++
++ if (vcpi) {
++ vcpi->vcpi = 0;
++ vcpi->num_slots = 0;
++ }
++ mgr->proposed_vcpis[i] = NULL;
++ }
+ mgr->vcpi_mask = 0;
++ mutex_unlock(&mgr->payload_lock);
+ }
+
+ out_unlock:
+diff --git a/drivers/gpu/drm/drm_rect.c b/drivers/gpu/drm/drm_rect.c
+index 8c057829b804..0f5a0c64c4c4 100644
+--- a/drivers/gpu/drm/drm_rect.c
++++ b/drivers/gpu/drm/drm_rect.c
+@@ -52,7 +52,12 @@ EXPORT_SYMBOL(drm_rect_intersect);
+
+ static u32 clip_scaled(u32 src, u32 dst, u32 clip)
+ {
+- u64 tmp = mul_u32_u32(src, dst - clip);
++ u64 tmp;
++
++ if (dst == 0)
++ return 0;
++
++ tmp = mul_u32_u32(src, dst - clip);
+
+ /*
+ * Round toward 1.0 when clipping so that we don't accidentally
+diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_dsi_encoder.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_dsi_encoder.c
+index 6a1ebdace391..6253717d2e0c 100644
+--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_dsi_encoder.c
++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_dsi_encoder.c
+@@ -139,7 +139,7 @@ static void mdp4_dsi_encoder_enable(struct drm_encoder *encoder)
+ if (mdp4_dsi_encoder->enabled)
+ return;
+
+- mdp4_crtc_set_config(encoder->crtc,
++ mdp4_crtc_set_config(encoder->crtc,
+ MDP4_DMA_CONFIG_PACK_ALIGN_MSB |
+ MDP4_DMA_CONFIG_DEFLKR_EN |
+ MDP4_DMA_CONFIG_DITHER_EN |
+diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+index 97a0573cc514..79eb11cd185d 100644
+--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+@@ -357,8 +357,7 @@ static void sun6i_dsi_inst_init(struct sun6i_dsi *dsi,
+ static u16 sun6i_dsi_get_video_start_delay(struct sun6i_dsi *dsi,
+ struct drm_display_mode *mode)
+ {
+- u16 start = clamp(mode->vtotal - mode->vdisplay - 10, 8, 100);
+- u16 delay = mode->vtotal - (mode->vsync_end - mode->vdisplay) + start;
++ u16 delay = mode->vtotal - (mode->vsync_end - mode->vdisplay) + 1;
+
+ if (delay > mode->vtotal)
+ delay = delay % mode->vtotal;
+diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
+index d2a735ac9ba1..9ca0706a9d40 100644
+--- a/drivers/hv/hv_balloon.c
++++ b/drivers/hv/hv_balloon.c
+@@ -1215,10 +1215,7 @@ static unsigned int alloc_balloon_pages(struct hv_dynmem_device *dm,
+ unsigned int i = 0;
+ struct page *pg;
+
+- if (num_pages < alloc_unit)
+- return 0;
+-
+- for (i = 0; (i * alloc_unit) < num_pages; i++) {
++ for (i = 0; i < num_pages / alloc_unit; i++) {
+ if (bl_resp->hdr.size + sizeof(union dm_mem_page_range) >
+ PAGE_SIZE)
+ return i * alloc_unit;
+@@ -1252,7 +1249,7 @@ static unsigned int alloc_balloon_pages(struct hv_dynmem_device *dm,
+
+ }
+
+- return num_pages;
++ return i * alloc_unit;
+ }
+
+ static void balloon_up(struct work_struct *dummy)
+@@ -1267,9 +1264,6 @@ static void balloon_up(struct work_struct *dummy)
+ long avail_pages;
+ unsigned long floor;
+
+- /* The host balloons pages in 2M granularity. */
+- WARN_ON_ONCE(num_pages % PAGES_IN_2M != 0);
+-
+ /*
+ * We will attempt 2M allocations. However, if we fail to
+ * allocate 2M chunks, we will go back to 4k allocations.
+@@ -1279,14 +1273,13 @@ static void balloon_up(struct work_struct *dummy)
+ avail_pages = si_mem_available();
+ floor = compute_balloon_floor();
+
+- /* Refuse to balloon below the floor, keep the 2M granularity. */
++ /* Refuse to balloon below the floor. */
+ if (avail_pages < num_pages || avail_pages - num_pages < floor) {
+ pr_warn("Balloon request will be partially fulfilled. %s\n",
+ avail_pages < num_pages ? "Not enough memory." :
+ "Balloon floor reached.");
+
+ num_pages = avail_pages > floor ? (avail_pages - floor) : 0;
+- num_pages -= num_pages % PAGES_IN_2M;
+ }
+
+ while (!done) {
+diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
+index 6ec748eccff7..4bda1242df87 100644
+--- a/drivers/infiniband/core/umem_odp.c
++++ b/drivers/infiniband/core/umem_odp.c
+@@ -689,7 +689,7 @@ int ib_umem_odp_map_dma_pages(struct ib_umem *umem, u64 user_virt, u64 bcnt,
+
+ while (bcnt > 0) {
+ const size_t gup_num_pages = min_t(size_t,
+- (bcnt + BIT(page_shift) - 1) >> page_shift,
++ ALIGN(bcnt, PAGE_SIZE) / PAGE_SIZE,
+ PAGE_SIZE / sizeof(struct page *));
+
+ down_read(&owning_mm->mmap_sem);
+diff --git a/drivers/infiniband/hw/mlx5/gsi.c b/drivers/infiniband/hw/mlx5/gsi.c
+index 4950df3f71b6..5c73c0a790fa 100644
+--- a/drivers/infiniband/hw/mlx5/gsi.c
++++ b/drivers/infiniband/hw/mlx5/gsi.c
+@@ -507,8 +507,7 @@ int mlx5_ib_gsi_post_send(struct ib_qp *qp, const struct ib_send_wr *wr,
+ ret = ib_post_send(tx_qp, &cur_wr.wr, bad_wr);
+ if (ret) {
+ /* Undo the effect of adding the outstanding wr */
+- gsi->outstanding_pi = (gsi->outstanding_pi - 1) %
+- gsi->cap.max_send_wr;
++ gsi->outstanding_pi--;
+ goto err;
+ }
+ spin_unlock_irqrestore(&gsi->lock, flags);
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index 4677b18ac281..2a2f189dd37c 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -329,6 +329,9 @@ struct cached_dev {
+ */
+ atomic_t has_dirty;
+
++#define BCH_CACHE_READA_ALL 0
++#define BCH_CACHE_READA_META_ONLY 1
++ unsigned int cache_readahead_policy;
+ struct bch_ratelimit writeback_rate;
+ struct delayed_work writeback_rate_update;
+
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index 4ca3e3d3f9c7..c1e487d1261c 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -391,13 +391,20 @@ static bool check_should_bypass(struct cached_dev *dc, struct bio *bio)
+ goto skip;
+
+ /*
+- * Flag for bypass if the IO is for read-ahead or background,
+- * unless the read-ahead request is for metadata
++ * If the bio is for read-ahead or background IO, bypass it or
++ * not depends on the following situations,
++ * - If the IO is for meta data, always cache it and no bypass
++ * - If the IO is not meta data, check dc->cache_reada_policy,
++ * BCH_CACHE_READA_ALL: cache it and not bypass
++ * BCH_CACHE_READA_META_ONLY: not cache it and bypass
++ * That is, read-ahead request for metadata always get cached
+ * (eg, for gfs2 or xfs).
+ */
+- if (bio->bi_opf & (REQ_RAHEAD|REQ_BACKGROUND) &&
+- !(bio->bi_opf & (REQ_META|REQ_PRIO)))
+- goto skip;
++ if ((bio->bi_opf & (REQ_RAHEAD|REQ_BACKGROUND))) {
++ if (!(bio->bi_opf & (REQ_META|REQ_PRIO)) &&
++ (dc->cache_readahead_policy != BCH_CACHE_READA_ALL))
++ goto skip;
++ }
+
+ if (bio->bi_iter.bi_sector & (c->sb.block_size - 1) ||
+ bio_sectors(bio) & (c->sb.block_size - 1)) {
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index 3e8d1f1b562f..591d9c8107dd 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -25,6 +25,12 @@ static const char * const bch_cache_modes[] = {
+ NULL
+ };
+
++static const char * const bch_reada_cache_policies[] = {
++ "all",
++ "meta-only",
++ NULL
++};
++
+ /* Default is -1; we skip past it for stop_when_cache_set_failed */
+ static const char * const bch_stop_on_failure_modes[] = {
+ "auto",
+@@ -94,6 +100,7 @@ rw_attribute(congested_write_threshold_us);
+ rw_attribute(sequential_cutoff);
+ rw_attribute(data_csum);
+ rw_attribute(cache_mode);
++rw_attribute(readahead_cache_policy);
+ rw_attribute(stop_when_cache_set_failed);
+ rw_attribute(writeback_metadata);
+ rw_attribute(writeback_running);
+@@ -160,6 +167,11 @@ SHOW(__bch_cached_dev)
+ bch_cache_modes,
+ BDEV_CACHE_MODE(&dc->sb));
+
++ if (attr == &sysfs_readahead_cache_policy)
++ return bch_snprint_string_list(buf, PAGE_SIZE,
++ bch_reada_cache_policies,
++ dc->cache_readahead_policy);
++
+ if (attr == &sysfs_stop_when_cache_set_failed)
+ return bch_snprint_string_list(buf, PAGE_SIZE,
+ bch_stop_on_failure_modes,
+@@ -324,6 +336,15 @@ STORE(__cached_dev)
+ }
+ }
+
++ if (attr == &sysfs_readahead_cache_policy) {
++ v = __sysfs_match_string(bch_reada_cache_policies, -1, buf);
++ if (v < 0)
++ return v;
++
++ if ((unsigned int) v != dc->cache_readahead_policy)
++ dc->cache_readahead_policy = v;
++ }
++
+ if (attr == &sysfs_stop_when_cache_set_failed) {
+ v = __sysfs_match_string(bch_stop_on_failure_modes, -1, buf);
+ if (v < 0)
+@@ -417,6 +438,7 @@ static struct attribute *bch_cached_dev_files[] = {
+ &sysfs_data_csum,
+ #endif
+ &sysfs_cache_mode,
++ &sysfs_readahead_cache_policy,
+ &sysfs_stop_when_cache_set_failed,
+ &sysfs_writeback_metadata,
+ &sysfs_writeback_running,
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 34f5de13a93d..750f8b34e693 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -482,8 +482,14 @@ static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv,
+ static int crypt_iv_benbi_ctr(struct crypt_config *cc, struct dm_target *ti,
+ const char *opts)
+ {
+- unsigned bs = crypto_skcipher_blocksize(any_tfm(cc));
+- int log = ilog2(bs);
++ unsigned bs;
++ int log;
++
++ if (test_bit(CRYPT_MODE_INTEGRITY_AEAD, &cc->cipher_flags))
++ bs = crypto_aead_blocksize(any_tfm_aead(cc));
++ else
++ bs = crypto_skcipher_blocksize(any_tfm(cc));
++ log = ilog2(bs);
+
+ /* we need to calculate how far we must shift the sector count
+ * to get the cipher block count, we use this shift in _gen */
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index 503c4265ecbe..820c2e07dadf 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -447,7 +447,13 @@ static void writecache_notify_io(unsigned long error, void *context)
+ complete(&endio->c);
+ }
+
+-static void ssd_commit_flushed(struct dm_writecache *wc)
++static void writecache_wait_for_ios(struct dm_writecache *wc, int direction)
++{
++ wait_event(wc->bio_in_progress_wait[direction],
++ !atomic_read(&wc->bio_in_progress[direction]));
++}
++
++static void ssd_commit_flushed(struct dm_writecache *wc, bool wait_for_ios)
+ {
+ struct dm_io_region region;
+ struct dm_io_request req;
+@@ -493,17 +499,20 @@ static void ssd_commit_flushed(struct dm_writecache *wc)
+ writecache_notify_io(0, &endio);
+ wait_for_completion_io(&endio.c);
+
++ if (wait_for_ios)
++ writecache_wait_for_ios(wc, WRITE);
++
+ writecache_disk_flush(wc, wc->ssd_dev);
+
+ memset(wc->dirty_bitmap, 0, wc->dirty_bitmap_size);
+ }
+
+-static void writecache_commit_flushed(struct dm_writecache *wc)
++static void writecache_commit_flushed(struct dm_writecache *wc, bool wait_for_ios)
+ {
+ if (WC_MODE_PMEM(wc))
+ wmb();
+ else
+- ssd_commit_flushed(wc);
++ ssd_commit_flushed(wc, wait_for_ios);
+ }
+
+ static void writecache_disk_flush(struct dm_writecache *wc, struct dm_dev *dev)
+@@ -527,12 +536,6 @@ static void writecache_disk_flush(struct dm_writecache *wc, struct dm_dev *dev)
+ writecache_error(wc, r, "error flushing metadata: %d", r);
+ }
+
+-static void writecache_wait_for_ios(struct dm_writecache *wc, int direction)
+-{
+- wait_event(wc->bio_in_progress_wait[direction],
+- !atomic_read(&wc->bio_in_progress[direction]));
+-}
+-
+ #define WFE_RETURN_FOLLOWING 1
+ #define WFE_LOWEST_SEQ 2
+
+@@ -730,14 +733,12 @@ static void writecache_flush(struct dm_writecache *wc)
+ e = e2;
+ cond_resched();
+ }
+- writecache_commit_flushed(wc);
+-
+- writecache_wait_for_ios(wc, WRITE);
++ writecache_commit_flushed(wc, true);
+
+ wc->seq_count++;
+ pmem_assign(sb(wc)->seq_count, cpu_to_le64(wc->seq_count));
+ writecache_flush_region(wc, &sb(wc)->seq_count, sizeof sb(wc)->seq_count);
+- writecache_commit_flushed(wc);
++ writecache_commit_flushed(wc, false);
+
+ wc->overwrote_committed = false;
+
+@@ -761,7 +762,7 @@ static void writecache_flush(struct dm_writecache *wc)
+ }
+
+ if (need_flush_after_free)
+- writecache_commit_flushed(wc);
++ writecache_commit_flushed(wc, false);
+ }
+
+ static void writecache_flush_work(struct work_struct *work)
+@@ -814,7 +815,7 @@ static void writecache_discard(struct dm_writecache *wc, sector_t start, sector_
+ }
+
+ if (discarded_something)
+- writecache_commit_flushed(wc);
++ writecache_commit_flushed(wc, false);
+ }
+
+ static bool writecache_wait_for_writeback(struct dm_writecache *wc)
+@@ -963,7 +964,7 @@ erase_this:
+
+ if (need_flush) {
+ writecache_flush_all_metadata(wc);
+- writecache_commit_flushed(wc);
++ writecache_commit_flushed(wc, false);
+ }
+
+ wc_unlock(wc);
+@@ -1347,7 +1348,7 @@ static void __writecache_endio_pmem(struct dm_writecache *wc, struct list_head *
+ wc->writeback_size--;
+ n_walked++;
+ if (unlikely(n_walked >= ENDIO_LATENCY)) {
+- writecache_commit_flushed(wc);
++ writecache_commit_flushed(wc, false);
+ wc_unlock(wc);
+ wc_lock(wc);
+ n_walked = 0;
+@@ -1428,7 +1429,7 @@ pop_from_list:
+ writecache_wait_for_ios(wc, READ);
+ }
+
+- writecache_commit_flushed(wc);
++ writecache_commit_flushed(wc, false);
+
+ wc_unlock(wc);
+ }
+@@ -1759,10 +1760,10 @@ static int init_memory(struct dm_writecache *wc)
+ write_original_sector_seq_count(wc, &wc->entries[b], -1, -1);
+
+ writecache_flush_all_metadata(wc);
+- writecache_commit_flushed(wc);
++ writecache_commit_flushed(wc, false);
+ pmem_assign(sb(wc)->magic, cpu_to_le32(MEMORY_SUPERBLOCK_MAGIC));
+ writecache_flush_region(wc, &sb(wc)->magic, sizeof sb(wc)->magic);
+- writecache_commit_flushed(wc);
++ writecache_commit_flushed(wc, false);
+
+ return 0;
+ }
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index c2c17149d968..086a870087cf 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -132,6 +132,7 @@ struct dmz_metadata {
+
+ sector_t zone_bitmap_size;
+ unsigned int zone_nr_bitmap_blocks;
++ unsigned int zone_bits_per_mblk;
+
+ unsigned int nr_bitmap_blocks;
+ unsigned int nr_map_blocks;
+@@ -1165,7 +1166,10 @@ static int dmz_init_zones(struct dmz_metadata *zmd)
+
+ /* Init */
+ zmd->zone_bitmap_size = dev->zone_nr_blocks >> 3;
+- zmd->zone_nr_bitmap_blocks = zmd->zone_bitmap_size >> DMZ_BLOCK_SHIFT;
++ zmd->zone_nr_bitmap_blocks =
++ max_t(sector_t, 1, zmd->zone_bitmap_size >> DMZ_BLOCK_SHIFT);
++ zmd->zone_bits_per_mblk = min_t(sector_t, dev->zone_nr_blocks,
++ DMZ_BLOCK_SIZE_BITS);
+
+ /* Allocate zone array */
+ zmd->zones = kcalloc(dev->nr_zones, sizeof(struct dm_zone), GFP_KERNEL);
+@@ -1982,7 +1986,7 @@ int dmz_copy_valid_blocks(struct dmz_metadata *zmd, struct dm_zone *from_zone,
+ dmz_release_mblock(zmd, to_mblk);
+ dmz_release_mblock(zmd, from_mblk);
+
+- chunk_block += DMZ_BLOCK_SIZE_BITS;
++ chunk_block += zmd->zone_bits_per_mblk;
+ }
+
+ to_zone->weight = from_zone->weight;
+@@ -2043,7 +2047,7 @@ int dmz_validate_blocks(struct dmz_metadata *zmd, struct dm_zone *zone,
+
+ /* Set bits */
+ bit = chunk_block & DMZ_BLOCK_MASK_BITS;
+- nr_bits = min(nr_blocks, DMZ_BLOCK_SIZE_BITS - bit);
++ nr_bits = min(nr_blocks, zmd->zone_bits_per_mblk - bit);
+
+ count = dmz_set_bits((unsigned long *)mblk->data, bit, nr_bits);
+ if (count) {
+@@ -2122,7 +2126,7 @@ int dmz_invalidate_blocks(struct dmz_metadata *zmd, struct dm_zone *zone,
+
+ /* Clear bits */
+ bit = chunk_block & DMZ_BLOCK_MASK_BITS;
+- nr_bits = min(nr_blocks, DMZ_BLOCK_SIZE_BITS - bit);
++ nr_bits = min(nr_blocks, zmd->zone_bits_per_mblk - bit);
+
+ count = dmz_clear_bits((unsigned long *)mblk->data,
+ bit, nr_bits);
+@@ -2182,6 +2186,7 @@ static int dmz_to_next_set_block(struct dmz_metadata *zmd, struct dm_zone *zone,
+ {
+ struct dmz_mblock *mblk;
+ unsigned int bit, set_bit, nr_bits;
++ unsigned int zone_bits = zmd->zone_bits_per_mblk;
+ unsigned long *bitmap;
+ int n = 0;
+
+@@ -2196,15 +2201,15 @@ static int dmz_to_next_set_block(struct dmz_metadata *zmd, struct dm_zone *zone,
+ /* Get offset */
+ bitmap = (unsigned long *) mblk->data;
+ bit = chunk_block & DMZ_BLOCK_MASK_BITS;
+- nr_bits = min(nr_blocks, DMZ_BLOCK_SIZE_BITS - bit);
++ nr_bits = min(nr_blocks, zone_bits - bit);
+ if (set)
+- set_bit = find_next_bit(bitmap, DMZ_BLOCK_SIZE_BITS, bit);
++ set_bit = find_next_bit(bitmap, zone_bits, bit);
+ else
+- set_bit = find_next_zero_bit(bitmap, DMZ_BLOCK_SIZE_BITS, bit);
++ set_bit = find_next_zero_bit(bitmap, zone_bits, bit);
+ dmz_release_mblock(zmd, mblk);
+
+ n += set_bit - bit;
+- if (set_bit < DMZ_BLOCK_SIZE_BITS)
++ if (set_bit < zone_bits)
+ break;
+
+ nr_blocks -= nr_bits;
+@@ -2307,7 +2312,7 @@ static void dmz_get_zone_weight(struct dmz_metadata *zmd, struct dm_zone *zone)
+ /* Count bits in this block */
+ bitmap = mblk->data;
+ bit = chunk_block & DMZ_BLOCK_MASK_BITS;
+- nr_bits = min(nr_blocks, DMZ_BLOCK_SIZE_BITS - bit);
++ nr_bits = min(nr_blocks, zmd->zone_bits_per_mblk - bit);
+ n += dmz_count_bits(bitmap, bit, nr_bits);
+
+ dmz_release_mblock(zmd, mblk);
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index c9860e3b04dd..3965f3cf8ea1 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1819,6 +1819,7 @@ static void dm_init_normal_md_queue(struct mapped_device *md)
+ /*
+ * Initialize aspects of queue that aren't relevant for blk-mq
+ */
++ md->queue->backing_dev_info->congested_data = md;
+ md->queue->backing_dev_info->congested_fn = dm_any_congested;
+ }
+
+@@ -1913,7 +1914,12 @@ static struct mapped_device *alloc_dev(int minor)
+ if (!md->queue)
+ goto bad;
+ md->queue->queuedata = md;
+- md->queue->backing_dev_info->congested_data = md;
++ /*
++ * default to bio-based required ->make_request_fn until DM
++ * table is loaded and md->type established. If request-based
++ * table is loaded: blk-mq will override accordingly.
++ */
++ blk_queue_make_request(md->queue, dm_make_request);
+
+ md->disk = alloc_disk_node(1, md->numa_node_id);
+ if (!md->disk)
+@@ -2242,7 +2248,6 @@ int dm_setup_md_queue(struct mapped_device *md, struct dm_table *t)
+ case DM_TYPE_BIO_BASED:
+ case DM_TYPE_DAX_BIO_BASED:
+ dm_init_normal_md_queue(md);
+- blk_queue_make_request(md->queue, dm_make_request);
+ break;
+ case DM_TYPE_NVME_BIO_BASED:
+ dm_init_normal_md_queue(md);
+diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c
+index 0a3b8ae4a29c..17aef55ed708 100644
+--- a/drivers/md/persistent-data/dm-space-map-common.c
++++ b/drivers/md/persistent-data/dm-space-map-common.c
+@@ -382,6 +382,33 @@ int sm_ll_find_free_block(struct ll_disk *ll, dm_block_t begin,
+ return -ENOSPC;
+ }
+
++int sm_ll_find_common_free_block(struct ll_disk *old_ll, struct ll_disk *new_ll,
++ dm_block_t begin, dm_block_t end, dm_block_t *b)
++{
++ int r;
++ uint32_t count;
++
++ do {
++ r = sm_ll_find_free_block(new_ll, begin, new_ll->nr_blocks, b);
++ if (r)
++ break;
++
++ /* double check this block wasn't used in the old transaction */
++ if (*b >= old_ll->nr_blocks)
++ count = 0;
++ else {
++ r = sm_ll_lookup(old_ll, *b, &count);
++ if (r)
++ break;
++
++ if (count)
++ begin = *b + 1;
++ }
++ } while (count);
++
++ return r;
++}
++
+ static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b,
+ int (*mutator)(void *context, uint32_t old, uint32_t *new),
+ void *context, enum allocation_event *ev)
+diff --git a/drivers/md/persistent-data/dm-space-map-common.h b/drivers/md/persistent-data/dm-space-map-common.h
+index b3078d5eda0c..8de63ce39bdd 100644
+--- a/drivers/md/persistent-data/dm-space-map-common.h
++++ b/drivers/md/persistent-data/dm-space-map-common.h
+@@ -109,6 +109,8 @@ int sm_ll_lookup_bitmap(struct ll_disk *ll, dm_block_t b, uint32_t *result);
+ int sm_ll_lookup(struct ll_disk *ll, dm_block_t b, uint32_t *result);
+ int sm_ll_find_free_block(struct ll_disk *ll, dm_block_t begin,
+ dm_block_t end, dm_block_t *result);
++int sm_ll_find_common_free_block(struct ll_disk *old_ll, struct ll_disk *new_ll,
++ dm_block_t begin, dm_block_t end, dm_block_t *result);
+ int sm_ll_insert(struct ll_disk *ll, dm_block_t b, uint32_t ref_count, enum allocation_event *ev);
+ int sm_ll_inc(struct ll_disk *ll, dm_block_t b, enum allocation_event *ev);
+ int sm_ll_dec(struct ll_disk *ll, dm_block_t b, enum allocation_event *ev);
+diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
+index 32adf6b4a9c7..bf4c5e2ccb6f 100644
+--- a/drivers/md/persistent-data/dm-space-map-disk.c
++++ b/drivers/md/persistent-data/dm-space-map-disk.c
+@@ -167,8 +167,10 @@ static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b)
+ enum allocation_event ev;
+ struct sm_disk *smd = container_of(sm, struct sm_disk, sm);
+
+- /* FIXME: we should loop round a couple of times */
+- r = sm_ll_find_free_block(&smd->old_ll, smd->begin, smd->old_ll.nr_blocks, b);
++ /*
++ * Any block we allocate has to be free in both the old and current ll.
++ */
++ r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, smd->begin, smd->ll.nr_blocks, b);
+ if (r)
+ return r;
+
+diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
+index 25328582cc48..9e3c64ec2026 100644
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -448,7 +448,10 @@ static int sm_metadata_new_block_(struct dm_space_map *sm, dm_block_t *b)
+ enum allocation_event ev;
+ struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
+
+- r = sm_ll_find_free_block(&smm->old_ll, smm->begin, smm->old_ll.nr_blocks, b);
++ /*
++ * Any block we allocate has to be free in both the old and current ll.
++ */
++ r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, smm->begin, smm->ll.nr_blocks, b);
+ if (r)
+ return r;
+
+diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
+index 6f3030b2054d..1df9522c30fa 100644
+--- a/drivers/media/rc/iguanair.c
++++ b/drivers/media/rc/iguanair.c
+@@ -424,7 +424,7 @@ static int iguanair_probe(struct usb_interface *intf,
+ int ret, pipein, pipeout;
+ struct usb_host_interface *idesc;
+
+- idesc = intf->altsetting;
++ idesc = intf->cur_altsetting;
+ if (idesc->desc.bNumEndpoints < 2)
+ return -ENODEV;
+
+diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
+index 0f218afdadaa..c30affbd43a9 100644
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -1874,23 +1874,28 @@ int rc_register_device(struct rc_dev *dev)
+
+ dev->registered = true;
+
+- if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
+- rc = rc_setup_rx_device(dev);
+- if (rc)
+- goto out_dev;
+- }
+-
+- /* Ensure that the lirc kfifo is setup before we start the thread */
++ /*
++ * once the the input device is registered in rc_setup_rx_device,
++ * userspace can open the input device and rc_open() will be called
++ * as a result. This results in driver code being allowed to submit
++ * keycodes with rc_keydown, so lirc must be registered first.
++ */
+ if (dev->allowed_protocols != RC_PROTO_BIT_CEC) {
+ rc = ir_lirc_register(dev);
+ if (rc < 0)
+- goto out_rx;
++ goto out_dev;
++ }
++
++ if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
++ rc = rc_setup_rx_device(dev);
++ if (rc)
++ goto out_lirc;
+ }
+
+ if (dev->driver_type == RC_DRIVER_IR_RAW) {
+ rc = ir_raw_event_register(dev);
+ if (rc < 0)
+- goto out_lirc;
++ goto out_rx;
+ }
+
+ dev_dbg(&dev->dev, "Registered rc%u (driver: %s)\n", dev->minor,
+@@ -1898,11 +1903,11 @@ int rc_register_device(struct rc_dev *dev)
+
+ return 0;
+
++out_rx:
++ rc_free_rx_device(dev);
+ out_lirc:
+ if (dev->allowed_protocols != RC_PROTO_BIT_CEC)
+ ir_lirc_unregister(dev);
+-out_rx:
+- rc_free_rx_device(dev);
+ out_dev:
+ device_del(&dev->dev);
+ out_rx_free:
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 063e229ead5e..38c73cdbef70 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -1482,6 +1482,11 @@ static int uvc_scan_chain_forward(struct uvc_video_chain *chain,
+ break;
+ if (forward == prev)
+ continue;
++ if (forward->chain.next || forward->chain.prev) {
++ uvc_trace(UVC_TRACE_DESCR, "Found reference to "
++ "entity %d already in chain.\n", forward->id);
++ return -EINVAL;
++ }
+
+ switch (UVC_ENTITY_TYPE(forward)) {
+ case UVC_VC_EXTENSION_UNIT:
+@@ -1563,6 +1568,13 @@ static int uvc_scan_chain_backward(struct uvc_video_chain *chain,
+ return -1;
+ }
+
++ if (term->chain.next || term->chain.prev) {
++ uvc_trace(UVC_TRACE_DESCR, "Found reference to "
++ "entity %d already in chain.\n",
++ term->id);
++ return -EINVAL;
++ }
++
+ if (uvc_trace_param & UVC_TRACE_PROBE)
+ printk(KERN_CONT " %d", term->id);
+
+diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+index 6481212fda77..3efe4e0a80a4 100644
+--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+@@ -1171,36 +1171,38 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ u32 aux_space;
+ int compatible_arg = 1;
+ long err = 0;
++ unsigned int ncmd;
+
+ /*
+ * 1. When struct size is different, converts the command.
+ */
+ switch (cmd) {
+- case VIDIOC_G_FMT32: cmd = VIDIOC_G_FMT; break;
+- case VIDIOC_S_FMT32: cmd = VIDIOC_S_FMT; break;
+- case VIDIOC_QUERYBUF32: cmd = VIDIOC_QUERYBUF; break;
+- case VIDIOC_G_FBUF32: cmd = VIDIOC_G_FBUF; break;
+- case VIDIOC_S_FBUF32: cmd = VIDIOC_S_FBUF; break;
+- case VIDIOC_QBUF32: cmd = VIDIOC_QBUF; break;
+- case VIDIOC_DQBUF32: cmd = VIDIOC_DQBUF; break;
+- case VIDIOC_ENUMSTD32: cmd = VIDIOC_ENUMSTD; break;
+- case VIDIOC_ENUMINPUT32: cmd = VIDIOC_ENUMINPUT; break;
+- case VIDIOC_TRY_FMT32: cmd = VIDIOC_TRY_FMT; break;
+- case VIDIOC_G_EXT_CTRLS32: cmd = VIDIOC_G_EXT_CTRLS; break;
+- case VIDIOC_S_EXT_CTRLS32: cmd = VIDIOC_S_EXT_CTRLS; break;
+- case VIDIOC_TRY_EXT_CTRLS32: cmd = VIDIOC_TRY_EXT_CTRLS; break;
+- case VIDIOC_DQEVENT32: cmd = VIDIOC_DQEVENT; break;
+- case VIDIOC_OVERLAY32: cmd = VIDIOC_OVERLAY; break;
+- case VIDIOC_STREAMON32: cmd = VIDIOC_STREAMON; break;
+- case VIDIOC_STREAMOFF32: cmd = VIDIOC_STREAMOFF; break;
+- case VIDIOC_G_INPUT32: cmd = VIDIOC_G_INPUT; break;
+- case VIDIOC_S_INPUT32: cmd = VIDIOC_S_INPUT; break;
+- case VIDIOC_G_OUTPUT32: cmd = VIDIOC_G_OUTPUT; break;
+- case VIDIOC_S_OUTPUT32: cmd = VIDIOC_S_OUTPUT; break;
+- case VIDIOC_CREATE_BUFS32: cmd = VIDIOC_CREATE_BUFS; break;
+- case VIDIOC_PREPARE_BUF32: cmd = VIDIOC_PREPARE_BUF; break;
+- case VIDIOC_G_EDID32: cmd = VIDIOC_G_EDID; break;
+- case VIDIOC_S_EDID32: cmd = VIDIOC_S_EDID; break;
++ case VIDIOC_G_FMT32: ncmd = VIDIOC_G_FMT; break;
++ case VIDIOC_S_FMT32: ncmd = VIDIOC_S_FMT; break;
++ case VIDIOC_QUERYBUF32: ncmd = VIDIOC_QUERYBUF; break;
++ case VIDIOC_G_FBUF32: ncmd = VIDIOC_G_FBUF; break;
++ case VIDIOC_S_FBUF32: ncmd = VIDIOC_S_FBUF; break;
++ case VIDIOC_QBUF32: ncmd = VIDIOC_QBUF; break;
++ case VIDIOC_DQBUF32: ncmd = VIDIOC_DQBUF; break;
++ case VIDIOC_ENUMSTD32: ncmd = VIDIOC_ENUMSTD; break;
++ case VIDIOC_ENUMINPUT32: ncmd = VIDIOC_ENUMINPUT; break;
++ case VIDIOC_TRY_FMT32: ncmd = VIDIOC_TRY_FMT; break;
++ case VIDIOC_G_EXT_CTRLS32: ncmd = VIDIOC_G_EXT_CTRLS; break;
++ case VIDIOC_S_EXT_CTRLS32: ncmd = VIDIOC_S_EXT_CTRLS; break;
++ case VIDIOC_TRY_EXT_CTRLS32: ncmd = VIDIOC_TRY_EXT_CTRLS; break;
++ case VIDIOC_DQEVENT32: ncmd = VIDIOC_DQEVENT; break;
++ case VIDIOC_OVERLAY32: ncmd = VIDIOC_OVERLAY; break;
++ case VIDIOC_STREAMON32: ncmd = VIDIOC_STREAMON; break;
++ case VIDIOC_STREAMOFF32: ncmd = VIDIOC_STREAMOFF; break;
++ case VIDIOC_G_INPUT32: ncmd = VIDIOC_G_INPUT; break;
++ case VIDIOC_S_INPUT32: ncmd = VIDIOC_S_INPUT; break;
++ case VIDIOC_G_OUTPUT32: ncmd = VIDIOC_G_OUTPUT; break;
++ case VIDIOC_S_OUTPUT32: ncmd = VIDIOC_S_OUTPUT; break;
++ case VIDIOC_CREATE_BUFS32: ncmd = VIDIOC_CREATE_BUFS; break;
++ case VIDIOC_PREPARE_BUF32: ncmd = VIDIOC_PREPARE_BUF; break;
++ case VIDIOC_G_EDID32: ncmd = VIDIOC_G_EDID; break;
++ case VIDIOC_S_EDID32: ncmd = VIDIOC_S_EDID; break;
++ default: ncmd = cmd; break;
+ }
+
+ /*
+@@ -1209,11 +1211,11 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ * argument into it.
+ */
+ switch (cmd) {
+- case VIDIOC_OVERLAY:
+- case VIDIOC_STREAMON:
+- case VIDIOC_STREAMOFF:
+- case VIDIOC_S_INPUT:
+- case VIDIOC_S_OUTPUT:
++ case VIDIOC_OVERLAY32:
++ case VIDIOC_STREAMON32:
++ case VIDIOC_STREAMOFF32:
++ case VIDIOC_S_INPUT32:
++ case VIDIOC_S_OUTPUT32:
+ err = alloc_userspace(sizeof(unsigned int), 0, &new_p64);
+ if (!err && assign_in_user((unsigned int __user *)new_p64,
+ (compat_uint_t __user *)p32))
+@@ -1221,23 +1223,23 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ compatible_arg = 0;
+ break;
+
+- case VIDIOC_G_INPUT:
+- case VIDIOC_G_OUTPUT:
++ case VIDIOC_G_INPUT32:
++ case VIDIOC_G_OUTPUT32:
+ err = alloc_userspace(sizeof(unsigned int), 0, &new_p64);
+ compatible_arg = 0;
+ break;
+
+- case VIDIOC_G_EDID:
+- case VIDIOC_S_EDID:
++ case VIDIOC_G_EDID32:
++ case VIDIOC_S_EDID32:
+ err = alloc_userspace(sizeof(struct v4l2_edid), 0, &new_p64);
+ if (!err)
+ err = get_v4l2_edid32(new_p64, p32);
+ compatible_arg = 0;
+ break;
+
+- case VIDIOC_G_FMT:
+- case VIDIOC_S_FMT:
+- case VIDIOC_TRY_FMT:
++ case VIDIOC_G_FMT32:
++ case VIDIOC_S_FMT32:
++ case VIDIOC_TRY_FMT32:
+ err = bufsize_v4l2_format(p32, &aux_space);
+ if (!err)
+ err = alloc_userspace(sizeof(struct v4l2_format),
+@@ -1250,7 +1252,7 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ compatible_arg = 0;
+ break;
+
+- case VIDIOC_CREATE_BUFS:
++ case VIDIOC_CREATE_BUFS32:
+ err = bufsize_v4l2_create(p32, &aux_space);
+ if (!err)
+ err = alloc_userspace(sizeof(struct v4l2_create_buffers),
+@@ -1263,10 +1265,10 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ compatible_arg = 0;
+ break;
+
+- case VIDIOC_PREPARE_BUF:
+- case VIDIOC_QUERYBUF:
+- case VIDIOC_QBUF:
+- case VIDIOC_DQBUF:
++ case VIDIOC_PREPARE_BUF32:
++ case VIDIOC_QUERYBUF32:
++ case VIDIOC_QBUF32:
++ case VIDIOC_DQBUF32:
+ err = bufsize_v4l2_buffer(p32, &aux_space);
+ if (!err)
+ err = alloc_userspace(sizeof(struct v4l2_buffer),
+@@ -1279,7 +1281,7 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ compatible_arg = 0;
+ break;
+
+- case VIDIOC_S_FBUF:
++ case VIDIOC_S_FBUF32:
+ err = alloc_userspace(sizeof(struct v4l2_framebuffer), 0,
+ &new_p64);
+ if (!err)
+@@ -1287,13 +1289,13 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ compatible_arg = 0;
+ break;
+
+- case VIDIOC_G_FBUF:
++ case VIDIOC_G_FBUF32:
+ err = alloc_userspace(sizeof(struct v4l2_framebuffer), 0,
+ &new_p64);
+ compatible_arg = 0;
+ break;
+
+- case VIDIOC_ENUMSTD:
++ case VIDIOC_ENUMSTD32:
+ err = alloc_userspace(sizeof(struct v4l2_standard), 0,
+ &new_p64);
+ if (!err)
+@@ -1301,16 +1303,16 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ compatible_arg = 0;
+ break;
+
+- case VIDIOC_ENUMINPUT:
++ case VIDIOC_ENUMINPUT32:
+ err = alloc_userspace(sizeof(struct v4l2_input), 0, &new_p64);
+ if (!err)
+ err = get_v4l2_input32(new_p64, p32);
+ compatible_arg = 0;
+ break;
+
+- case VIDIOC_G_EXT_CTRLS:
+- case VIDIOC_S_EXT_CTRLS:
+- case VIDIOC_TRY_EXT_CTRLS:
++ case VIDIOC_G_EXT_CTRLS32:
++ case VIDIOC_S_EXT_CTRLS32:
++ case VIDIOC_TRY_EXT_CTRLS32:
+ err = bufsize_v4l2_ext_controls(p32, &aux_space);
+ if (!err)
+ err = alloc_userspace(sizeof(struct v4l2_ext_controls),
+@@ -1322,7 +1324,7 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ }
+ compatible_arg = 0;
+ break;
+- case VIDIOC_DQEVENT:
++ case VIDIOC_DQEVENT32:
+ err = alloc_userspace(sizeof(struct v4l2_event), 0, &new_p64);
+ compatible_arg = 0;
+ break;
+@@ -1340,9 +1342,9 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ * Otherwise, it will pass the newly allocated @new_p64 argument.
+ */
+ if (compatible_arg)
+- err = native_ioctl(file, cmd, (unsigned long)p32);
++ err = native_ioctl(file, ncmd, (unsigned long)p32);
+ else
+- err = native_ioctl(file, cmd, (unsigned long)new_p64);
++ err = native_ioctl(file, ncmd, (unsigned long)new_p64);
+
+ if (err == -ENOTTY)
+ return err;
+@@ -1358,13 +1360,13 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ * the blocks to maximum allowed value.
+ */
+ switch (cmd) {
+- case VIDIOC_G_EXT_CTRLS:
+- case VIDIOC_S_EXT_CTRLS:
+- case VIDIOC_TRY_EXT_CTRLS:
++ case VIDIOC_G_EXT_CTRLS32:
++ case VIDIOC_S_EXT_CTRLS32:
++ case VIDIOC_TRY_EXT_CTRLS32:
+ if (put_v4l2_ext_controls32(file, new_p64, p32))
+ err = -EFAULT;
+ break;
+- case VIDIOC_S_EDID:
++ case VIDIOC_S_EDID32:
+ if (put_v4l2_edid32(new_p64, p32))
+ err = -EFAULT;
+ break;
+@@ -1377,49 +1379,49 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
+ * the original 32 bits structure.
+ */
+ switch (cmd) {
+- case VIDIOC_S_INPUT:
+- case VIDIOC_S_OUTPUT:
+- case VIDIOC_G_INPUT:
+- case VIDIOC_G_OUTPUT:
++ case VIDIOC_S_INPUT32:
++ case VIDIOC_S_OUTPUT32:
++ case VIDIOC_G_INPUT32:
++ case VIDIOC_G_OUTPUT32:
+ if (assign_in_user((compat_uint_t __user *)p32,
+ ((unsigned int __user *)new_p64)))
+ err = -EFAULT;
+ break;
+
+- case VIDIOC_G_FBUF:
++ case VIDIOC_G_FBUF32:
+ err = put_v4l2_framebuffer32(new_p64, p32);
+ break;
+
+- case VIDIOC_DQEVENT:
++ case VIDIOC_DQEVENT32:
+ err = put_v4l2_event32(new_p64, p32);
+ break;
+
+- case VIDIOC_G_EDID:
++ case VIDIOC_G_EDID32:
+ err = put_v4l2_edid32(new_p64, p32);
+ break;
+
+- case VIDIOC_G_FMT:
+- case VIDIOC_S_FMT:
+- case VIDIOC_TRY_FMT:
++ case VIDIOC_G_FMT32:
++ case VIDIOC_S_FMT32:
++ case VIDIOC_TRY_FMT32:
+ err = put_v4l2_format32(new_p64, p32);
+ break;
+
+- case VIDIOC_CREATE_BUFS:
++ case VIDIOC_CREATE_BUFS32:
+ err = put_v4l2_create32(new_p64, p32);
+ break;
+
+- case VIDIOC_PREPARE_BUF:
+- case VIDIOC_QUERYBUF:
+- case VIDIOC_QBUF:
+- case VIDIOC_DQBUF:
++ case VIDIOC_PREPARE_BUF32:
++ case VIDIOC_QUERYBUF32:
++ case VIDIOC_QBUF32:
++ case VIDIOC_DQBUF32:
+ err = put_v4l2_buffer32(new_p64, p32);
+ break;
+
+- case VIDIOC_ENUMSTD:
++ case VIDIOC_ENUMSTD32:
+ err = put_v4l2_standard32(new_p64, p32);
+ break;
+
+- case VIDIOC_ENUMINPUT:
++ case VIDIOC_ENUMINPUT32:
+ err = put_v4l2_input32(new_p64, p32);
+ break;
+ }
+diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
+index 08929c087e27..4c396e0defa4 100644
+--- a/drivers/media/v4l2-core/videobuf-dma-sg.c
++++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
+@@ -352,8 +352,11 @@ int videobuf_dma_free(struct videobuf_dmabuf *dma)
+ BUG_ON(dma->sglen);
+
+ if (dma->pages) {
+- for (i = 0; i < dma->nr_pages; i++)
++ for (i = 0; i < dma->nr_pages; i++) {
++ if (dma->direction == DMA_FROM_DEVICE)
++ set_page_dirty_lock(dma->pages[i]);
+ put_page(dma->pages[i]);
++ }
+ kfree(dma->pages);
+ dma->pages = NULL;
+ }
+diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
+index f8e0fa97bb31..aa65931142ba 100644
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -128,7 +128,7 @@ static const struct regmap_range axp288_writeable_ranges[] = {
+ static const struct regmap_range axp288_volatile_ranges[] = {
+ regmap_reg_range(AXP20X_PWR_INPUT_STATUS, AXP288_POWER_REASON),
+ regmap_reg_range(AXP288_BC_GLOBAL, AXP288_BC_GLOBAL),
+- regmap_reg_range(AXP288_BC_DET_STAT, AXP288_BC_DET_STAT),
++ regmap_reg_range(AXP288_BC_DET_STAT, AXP20X_VBUS_IPSOUT_MGMT),
+ regmap_reg_range(AXP20X_CHRG_BAK_CTRL, AXP20X_CHRG_BAK_CTRL),
+ regmap_reg_range(AXP20X_IRQ1_EN, AXP20X_IPSOUT_V_HIGH_L),
+ regmap_reg_range(AXP20X_TIMER_CTRL, AXP20X_TIMER_CTRL),
+diff --git a/drivers/mfd/da9062-core.c b/drivers/mfd/da9062-core.c
+index 9f6105906c09..83c624f6033c 100644
+--- a/drivers/mfd/da9062-core.c
++++ b/drivers/mfd/da9062-core.c
+@@ -257,7 +257,7 @@ static const struct mfd_cell da9062_devs[] = {
+ .name = "da9062-watchdog",
+ .num_resources = ARRAY_SIZE(da9062_wdt_resources),
+ .resources = da9062_wdt_resources,
+- .of_compatible = "dlg,da9062-wdt",
++ .of_compatible = "dlg,da9062-watchdog",
+ },
+ {
+ .name = "da9062-thermal",
+diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
+index 90e789943466..1476465ce803 100644
+--- a/drivers/mfd/dln2.c
++++ b/drivers/mfd/dln2.c
+@@ -725,6 +725,8 @@ static int dln2_probe(struct usb_interface *interface,
+ const struct usb_device_id *usb_id)
+ {
+ struct usb_host_interface *hostif = interface->cur_altsetting;
++ struct usb_endpoint_descriptor *epin;
++ struct usb_endpoint_descriptor *epout;
+ struct device *dev = &interface->dev;
+ struct dln2_dev *dln2;
+ int ret;
+@@ -734,12 +736,19 @@ static int dln2_probe(struct usb_interface *interface,
+ hostif->desc.bNumEndpoints < 2)
+ return -ENODEV;
+
++ epin = &hostif->endpoint[0].desc;
++ epout = &hostif->endpoint[1].desc;
++ if (!usb_endpoint_is_bulk_out(epout))
++ return -ENODEV;
++ if (!usb_endpoint_is_bulk_in(epin))
++ return -ENODEV;
++
+ dln2 = kzalloc(sizeof(*dln2), GFP_KERNEL);
+ if (!dln2)
+ return -ENOMEM;
+
+- dln2->ep_out = hostif->endpoint[0].desc.bEndpointAddress;
+- dln2->ep_in = hostif->endpoint[1].desc.bEndpointAddress;
++ dln2->ep_out = epout->bEndpointAddress;
++ dln2->ep_in = epin->bEndpointAddress;
+ dln2->usb_dev = usb_get_dev(interface_to_usbdev(interface));
+ dln2->interface = interface;
+ usb_set_intfdata(interface, dln2);
+diff --git a/drivers/mfd/rn5t618.c b/drivers/mfd/rn5t618.c
+index f4037d42a60f..dd4251f105e0 100644
+--- a/drivers/mfd/rn5t618.c
++++ b/drivers/mfd/rn5t618.c
+@@ -32,6 +32,7 @@ static bool rn5t618_volatile_reg(struct device *dev, unsigned int reg)
+ case RN5T618_WATCHDOGCNT:
+ case RN5T618_DCIRQ:
+ case RN5T618_ILIMDATAH ... RN5T618_AIN0DATAL:
++ case RN5T618_ADCCNT3:
+ case RN5T618_IR_ADC1 ... RN5T618_IR_ADC3:
+ case RN5T618_IR_GPR:
+ case RN5T618_IR_GPF:
+diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
+index ea254d00541f..24795454d106 100644
+--- a/drivers/mmc/host/mmc_spi.c
++++ b/drivers/mmc/host/mmc_spi.c
+@@ -1154,17 +1154,22 @@ static void mmc_spi_initsequence(struct mmc_spi_host *host)
+ * SPI protocol. Another is that when chipselect is released while
+ * the card returns BUSY status, the clock must issue several cycles
+ * with chipselect high before the card will stop driving its output.
++ *
++ * SPI_CS_HIGH means "asserted" here. In some cases like when using
++ * GPIOs for chip select, SPI_CS_HIGH is set but this will be logically
++ * inverted by gpiolib, so if we want to ascertain to drive it high
++ * we should toggle the default with an XOR as we do here.
+ */
+- host->spi->mode |= SPI_CS_HIGH;
++ host->spi->mode ^= SPI_CS_HIGH;
+ if (spi_setup(host->spi) != 0) {
+ /* Just warn; most cards work without it. */
+ dev_warn(&host->spi->dev,
+ "can't change chip-select polarity\n");
+- host->spi->mode &= ~SPI_CS_HIGH;
++ host->spi->mode ^= SPI_CS_HIGH;
+ } else {
+ mmc_spi_readbytes(host, 18);
+
+- host->spi->mode &= ~SPI_CS_HIGH;
++ host->spi->mode ^= SPI_CS_HIGH;
+ if (spi_setup(host->spi) != 0) {
+ /* Wot, we can't get the same setup we had before? */
+ dev_err(&host->spi->dev,
+diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
+index 1ebcf0eb781e..04e88d4796fa 100644
+--- a/drivers/mmc/host/sdhci-of-at91.c
++++ b/drivers/mmc/host/sdhci-of-at91.c
+@@ -332,19 +332,22 @@ static int sdhci_at91_probe(struct platform_device *pdev)
+ priv->mainck = devm_clk_get(&pdev->dev, "baseclk");
+ if (IS_ERR(priv->mainck)) {
+ dev_err(&pdev->dev, "failed to get baseclk\n");
+- return PTR_ERR(priv->mainck);
++ ret = PTR_ERR(priv->mainck);
++ goto sdhci_pltfm_free;
+ }
+
+ priv->hclock = devm_clk_get(&pdev->dev, "hclock");
+ if (IS_ERR(priv->hclock)) {
+ dev_err(&pdev->dev, "failed to get hclock\n");
+- return PTR_ERR(priv->hclock);
++ ret = PTR_ERR(priv->hclock);
++ goto sdhci_pltfm_free;
+ }
+
+ priv->gck = devm_clk_get(&pdev->dev, "multclk");
+ if (IS_ERR(priv->gck)) {
+ dev_err(&pdev->dev, "failed to get multclk\n");
+- return PTR_ERR(priv->gck);
++ ret = PTR_ERR(priv->gck);
++ goto sdhci_pltfm_free;
+ }
+
+ ret = sdhci_at91_set_clks_presets(&pdev->dev);
+diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
+index 462526a10537..8e292992f84c 100644
+--- a/drivers/mtd/ubi/fastmap.c
++++ b/drivers/mtd/ubi/fastmap.c
+@@ -73,7 +73,7 @@ static int self_check_seen(struct ubi_device *ubi, unsigned long *seen)
+ return 0;
+
+ for (pnum = 0; pnum < ubi->peb_count; pnum++) {
+- if (test_bit(pnum, seen) && ubi->lookuptbl[pnum]) {
++ if (!test_bit(pnum, seen) && ubi->lookuptbl[pnum]) {
+ ubi_err(ubi, "self-check failed for PEB %d, fastmap didn't see it", pnum);
+ ret = -EINVAL;
+ }
+@@ -1146,7 +1146,7 @@ static int ubi_write_fastmap(struct ubi_device *ubi,
+ struct rb_node *tmp_rb;
+ int ret, i, j, free_peb_count, used_peb_count, vol_count;
+ int scrub_peb_count, erase_peb_count;
+- unsigned long *seen_pebs = NULL;
++ unsigned long *seen_pebs;
+
+ fm_raw = ubi->fm_buf;
+ memset(ubi->fm_buf, 0, ubi->fm_size);
+@@ -1160,7 +1160,7 @@ static int ubi_write_fastmap(struct ubi_device *ubi,
+ dvbuf = new_fm_vbuf(ubi, UBI_FM_DATA_VOLUME_ID);
+ if (!dvbuf) {
+ ret = -ENOMEM;
+- goto out_kfree;
++ goto out_free_avbuf;
+ }
+
+ avhdr = ubi_get_vid_hdr(avbuf);
+@@ -1169,7 +1169,7 @@ static int ubi_write_fastmap(struct ubi_device *ubi,
+ seen_pebs = init_seen(ubi);
+ if (IS_ERR(seen_pebs)) {
+ ret = PTR_ERR(seen_pebs);
+- goto out_kfree;
++ goto out_free_dvbuf;
+ }
+
+ spin_lock(&ubi->volumes_lock);
+@@ -1337,7 +1337,7 @@ static int ubi_write_fastmap(struct ubi_device *ubi,
+ ret = ubi_io_write_vid_hdr(ubi, new_fm->e[0]->pnum, avbuf);
+ if (ret) {
+ ubi_err(ubi, "unable to write vid_hdr to fastmap SB!");
+- goto out_kfree;
++ goto out_free_seen;
+ }
+
+ for (i = 0; i < new_fm->used_blocks; i++) {
+@@ -1359,7 +1359,7 @@ static int ubi_write_fastmap(struct ubi_device *ubi,
+ if (ret) {
+ ubi_err(ubi, "unable to write vid_hdr to PEB %i!",
+ new_fm->e[i]->pnum);
+- goto out_kfree;
++ goto out_free_seen;
+ }
+ }
+
+@@ -1369,7 +1369,7 @@ static int ubi_write_fastmap(struct ubi_device *ubi,
+ if (ret) {
+ ubi_err(ubi, "unable to write fastmap to PEB %i!",
+ new_fm->e[i]->pnum);
+- goto out_kfree;
++ goto out_free_seen;
+ }
+ }
+
+@@ -1379,10 +1379,13 @@ static int ubi_write_fastmap(struct ubi_device *ubi,
+ ret = self_check_seen(ubi, seen_pebs);
+ dbg_bld("fastmap written!");
+
+-out_kfree:
+- ubi_free_vid_buf(avbuf);
+- ubi_free_vid_buf(dvbuf);
++out_free_seen:
+ free_seen(seen_pebs);
++out_free_dvbuf:
++ ubi_free_vid_buf(dvbuf);
++out_free_avbuf:
++ ubi_free_vid_buf(avbuf);
++
+ out:
+ return ret;
+ }
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index e82108c917a6..334e3f22d4f1 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -1399,26 +1399,31 @@ netdev_tx_t bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
+ bool do_tx_balance = true;
+ u32 hash_index = 0;
+ const u8 *hash_start = NULL;
+- struct ipv6hdr *ip6hdr;
+
+ skb_reset_mac_header(skb);
+ eth_data = eth_hdr(skb);
+
+ switch (ntohs(skb->protocol)) {
+ case ETH_P_IP: {
+- const struct iphdr *iph = ip_hdr(skb);
++ const struct iphdr *iph;
+
+ if (is_broadcast_ether_addr(eth_data->h_dest) ||
+- iph->daddr == ip_bcast ||
+- iph->protocol == IPPROTO_IGMP) {
++ !pskb_network_may_pull(skb, sizeof(*iph))) {
++ do_tx_balance = false;
++ break;
++ }
++ iph = ip_hdr(skb);
++ if (iph->daddr == ip_bcast || iph->protocol == IPPROTO_IGMP) {
+ do_tx_balance = false;
+ break;
+ }
+ hash_start = (char *)&(iph->daddr);
+ hash_size = sizeof(iph->daddr);
+- }
+ break;
+- case ETH_P_IPV6:
++ }
++ case ETH_P_IPV6: {
++ const struct ipv6hdr *ip6hdr;
++
+ /* IPv6 doesn't really use broadcast mac address, but leave
+ * that here just in case.
+ */
+@@ -1435,7 +1440,11 @@ netdev_tx_t bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
+ break;
+ }
+
+- /* Additianally, DAD probes should not be tx-balanced as that
++ if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) {
++ do_tx_balance = false;
++ break;
++ }
++ /* Additionally, DAD probes should not be tx-balanced as that
+ * will lead to false positives for duplicate addresses and
+ * prevent address configuration from working.
+ */
+@@ -1445,17 +1454,26 @@ netdev_tx_t bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
+ break;
+ }
+
+- hash_start = (char *)&(ipv6_hdr(skb)->daddr);
+- hash_size = sizeof(ipv6_hdr(skb)->daddr);
++ hash_start = (char *)&ip6hdr->daddr;
++ hash_size = sizeof(ip6hdr->daddr);
+ break;
+- case ETH_P_IPX:
+- if (ipx_hdr(skb)->ipx_checksum != IPX_NO_CHECKSUM) {
++ }
++ case ETH_P_IPX: {
++ const struct ipxhdr *ipxhdr;
++
++ if (pskb_network_may_pull(skb, sizeof(*ipxhdr))) {
++ do_tx_balance = false;
++ break;
++ }
++ ipxhdr = (struct ipxhdr *)skb_network_header(skb);
++
++ if (ipxhdr->ipx_checksum != IPX_NO_CHECKSUM) {
+ /* something is wrong with this packet */
+ do_tx_balance = false;
+ break;
+ }
+
+- if (ipx_hdr(skb)->ipx_type != IPX_TYPE_NCP) {
++ if (ipxhdr->ipx_type != IPX_TYPE_NCP) {
+ /* The only protocol worth balancing in
+ * this family since it has an "ARP" like
+ * mechanism
+@@ -1464,9 +1482,11 @@ netdev_tx_t bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
+ break;
+ }
+
++ eth_data = eth_hdr(skb);
+ hash_start = (char *)eth_data->h_dest;
+ hash_size = ETH_ALEN;
+ break;
++ }
+ case ETH_P_ARP:
+ do_tx_balance = false;
+ if (bond_info->rlb_enabled)
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 9f21e710fc38..51436e7eae10 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -655,7 +655,7 @@ int b53_configure_vlan(struct dsa_switch *ds)
+ b53_do_vlan_op(dev, VTA_CMD_CLEAR);
+ }
+
+- b53_enable_vlan(dev, false, dev->vlan_filtering_enabled);
++ b53_enable_vlan(dev, dev->vlan_enabled, dev->vlan_filtering_enabled);
+
+ b53_for_each_port(dev, i)
+ b53_write16(dev, B53_VLAN_PAGE,
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index c93609007670..f181a28cb452 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -72,7 +72,9 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)
+
+ /* Force link status for IMP port */
+ reg = core_readl(priv, offset);
+- reg |= (MII_SW_OR | LINK_STS | GMII_SPEED_UP_2G);
++ reg |= (MII_SW_OR | LINK_STS);
++ if (priv->type == BCM7278_DEVICE_ID)
++ reg |= GMII_SPEED_UP_2G;
+ core_writel(priv, reg, offset);
+
+ /* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 49aa3b5ea57c..6f8649376ff0 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2716,6 +2716,9 @@ static int __maybe_unused bcm_sysport_resume(struct device *d)
+
+ umac_reset(priv);
+
++ /* Disable the UniMAC RX/TX */
++ umac_enable_set(priv, CMD_RX_EN | CMD_TX_EN, 0);
++
+ /* We may have been suspended and never received a WOL event that
+ * would turn off MPD detection, take care of that now
+ */
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 5cf85a89016e..c19d0eabeb52 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -5861,7 +5861,7 @@ static void bnxt_setup_msix(struct bnxt *bp)
+ int tcs, i;
+
+ tcs = netdev_get_num_tc(dev);
+- if (tcs > 1) {
++ if (tcs) {
+ int i, off, count;
+
+ for (i = 0; i < tcs; i++) {
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index c2eb18854794..d1ff317f3b18 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -66,7 +66,11 @@
+ /* Max length of transmit frame must be a multiple of 8 bytes */
+ #define MACB_TX_LEN_ALIGN 8
+ #define MACB_MAX_TX_LEN ((unsigned int)((1 << MACB_TX_FRMLEN_SIZE) - 1) & ~((unsigned int)(MACB_TX_LEN_ALIGN - 1)))
+-#define GEM_MAX_TX_LEN ((unsigned int)((1 << GEM_TX_FRMLEN_SIZE) - 1) & ~((unsigned int)(MACB_TX_LEN_ALIGN - 1)))
++/* Limit maximum TX length as per Cadence TSO errata. This is to avoid a
++ * false amba_error in TX path from the DMA assuming there is not enough
++ * space in the SRAM (16KB) even when there is.
++ */
++#define GEM_MAX_TX_LEN (unsigned int)(0x3FC0)
+
+ #define GEM_MTU_MIN_SIZE ETH_MIN_MTU
+ #define MACB_NETIF_LSO NETIF_F_TSO
+@@ -1654,16 +1658,14 @@ static netdev_features_t macb_features_check(struct sk_buff *skb,
+
+ /* Validate LSO compatibility */
+
+- /* there is only one buffer */
+- if (!skb_is_nonlinear(skb))
++ /* there is only one buffer or protocol is not UDP */
++ if (!skb_is_nonlinear(skb) || (ip_hdr(skb)->protocol != IPPROTO_UDP))
+ return features;
+
+ /* length of header */
+ hdrlen = skb_transport_offset(skb);
+- if (ip_hdr(skb)->protocol == IPPROTO_TCP)
+- hdrlen += tcp_hdrlen(skb);
+
+- /* For LSO:
++ /* For UFO only:
+ * When software supplies two or more payload buffers all payload buffers
+ * apart from the last must be a multiple of 8 bytes in size.
+ */
+diff --git a/drivers/net/ethernet/dec/tulip/dmfe.c b/drivers/net/ethernet/dec/tulip/dmfe.c
+index 17ef7a28873d..0defd5b1212a 100644
+--- a/drivers/net/ethernet/dec/tulip/dmfe.c
++++ b/drivers/net/ethernet/dec/tulip/dmfe.c
+@@ -2222,15 +2222,16 @@ static int __init dmfe_init_module(void)
+ if (cr6set)
+ dmfe_cr6_user_set = cr6set;
+
+- switch(mode) {
+- case DMFE_10MHF:
++ switch (mode) {
++ case DMFE_10MHF:
+ case DMFE_100MHF:
+ case DMFE_10MFD:
+ case DMFE_100MFD:
+ case DMFE_1M_HPNA:
+ dmfe_media_mode = mode;
+ break;
+- default:dmfe_media_mode = DMFE_AUTO;
++ default:
++ dmfe_media_mode = DMFE_AUTO;
+ break;
+ }
+
+diff --git a/drivers/net/ethernet/dec/tulip/uli526x.c b/drivers/net/ethernet/dec/tulip/uli526x.c
+index 488a744084c9..f4751a8de629 100644
+--- a/drivers/net/ethernet/dec/tulip/uli526x.c
++++ b/drivers/net/ethernet/dec/tulip/uli526x.c
+@@ -1817,8 +1817,8 @@ static int __init uli526x_init_module(void)
+ if (cr6set)
+ uli526x_cr6_user_set = cr6set;
+
+- switch (mode) {
+- case ULI526X_10MHF:
++ switch (mode) {
++ case ULI526X_10MHF:
+ case ULI526X_100MHF:
+ case ULI526X_10MFD:
+ case ULI526X_100MFD:
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 4313bbb2396f..51885e6dec50 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -385,6 +385,8 @@ struct mvneta_pcpu_stats {
+ struct u64_stats_sync syncp;
+ u64 rx_packets;
+ u64 rx_bytes;
++ u64 rx_dropped;
++ u64 rx_errors;
+ u64 tx_packets;
+ u64 tx_bytes;
+ };
+@@ -701,6 +703,8 @@ mvneta_get_stats64(struct net_device *dev,
+ struct mvneta_pcpu_stats *cpu_stats;
+ u64 rx_packets;
+ u64 rx_bytes;
++ u64 rx_dropped;
++ u64 rx_errors;
+ u64 tx_packets;
+ u64 tx_bytes;
+
+@@ -709,19 +713,20 @@ mvneta_get_stats64(struct net_device *dev,
+ start = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
+ rx_packets = cpu_stats->rx_packets;
+ rx_bytes = cpu_stats->rx_bytes;
++ rx_dropped = cpu_stats->rx_dropped;
++ rx_errors = cpu_stats->rx_errors;
+ tx_packets = cpu_stats->tx_packets;
+ tx_bytes = cpu_stats->tx_bytes;
+ } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, start));
+
+ stats->rx_packets += rx_packets;
+ stats->rx_bytes += rx_bytes;
++ stats->rx_dropped += rx_dropped;
++ stats->rx_errors += rx_errors;
+ stats->tx_packets += tx_packets;
+ stats->tx_bytes += tx_bytes;
+ }
+
+- stats->rx_errors = dev->stats.rx_errors;
+- stats->rx_dropped = dev->stats.rx_dropped;
+-
+ stats->tx_dropped = dev->stats.tx_dropped;
+ }
+
+@@ -1698,8 +1703,14 @@ static u32 mvneta_txq_desc_csum(int l3_offs, int l3_proto,
+ static void mvneta_rx_error(struct mvneta_port *pp,
+ struct mvneta_rx_desc *rx_desc)
+ {
++ struct mvneta_pcpu_stats *stats = this_cpu_ptr(pp->stats);
+ u32 status = rx_desc->status;
+
++ /* update per-cpu counter */
++ u64_stats_update_begin(&stats->syncp);
++ stats->rx_errors++;
++ u64_stats_update_end(&stats->syncp);
++
+ switch (status & MVNETA_RXD_ERR_CODE_MASK) {
+ case MVNETA_RXD_ERR_CRC:
+ netdev_err(pp->dev, "bad rx status %08x (crc error), size=%d\n",
+@@ -1960,7 +1971,6 @@ static int mvneta_rx_swbm(struct napi_struct *napi,
+ /* Check errors only for FIRST descriptor */
+ if (rx_status & MVNETA_RXD_ERR_SUMMARY) {
+ mvneta_rx_error(pp, rx_desc);
+- dev->stats.rx_errors++;
+ /* leave the descriptor untouched */
+ continue;
+ }
+@@ -1971,11 +1981,17 @@ static int mvneta_rx_swbm(struct napi_struct *napi,
+ skb_size = max(rx_copybreak, rx_header_size);
+ rxq->skb = netdev_alloc_skb_ip_align(dev, skb_size);
+ if (unlikely(!rxq->skb)) {
++ struct mvneta_pcpu_stats *stats = this_cpu_ptr(pp->stats);
++
+ netdev_err(dev,
+ "Can't allocate skb on queue %d\n",
+ rxq->id);
+- dev->stats.rx_dropped++;
++
+ rxq->skb_alloc_err++;
++
++ u64_stats_update_begin(&stats->syncp);
++ stats->rx_dropped++;
++ u64_stats_update_end(&stats->syncp);
+ continue;
+ }
+ copy_size = min(skb_size, rx_bytes);
+@@ -2135,7 +2151,6 @@ err_drop_frame_ret_pool:
+ mvneta_bm_pool_put_bp(pp->bm_priv, bm_pool,
+ rx_desc->buf_phys_addr);
+ err_drop_frame:
+- dev->stats.rx_errors++;
+ mvneta_rx_error(pp, rx_desc);
+ /* leave the descriptor untouched */
+ continue;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+index b5a8769a5bfd..715ccafc92cd 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+@@ -848,6 +848,7 @@ void mlx5_fpga_ipsec_delete_sa_ctx(void *context)
+ mutex_lock(&fpga_xfrm->lock);
+ if (!--fpga_xfrm->num_rules) {
+ mlx5_fpga_ipsec_release_sa_ctx(fpga_xfrm->sa_ctx);
++ kfree(fpga_xfrm->sa_ctx);
+ fpga_xfrm->sa_ctx = NULL;
+ }
+ mutex_unlock(&fpga_xfrm->lock);
+@@ -1472,7 +1473,7 @@ int mlx5_fpga_esp_modify_xfrm(struct mlx5_accel_esp_xfrm *xfrm,
+ if (!memcmp(&xfrm->attrs, attrs, sizeof(xfrm->attrs)))
+ return 0;
+
+- if (!mlx5_fpga_esp_validate_xfrm_attrs(mdev, attrs)) {
++ if (mlx5_fpga_esp_validate_xfrm_attrs(mdev, attrs)) {
+ mlx5_core_warn(mdev, "Tried to create an esp with unsupported attrs\n");
+ return -EOPNOTSUPP;
+ }
+diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
+index 8355dfbb8ec3..f97b35430c84 100644
+--- a/drivers/net/ethernet/smsc/smc911x.c
++++ b/drivers/net/ethernet/smsc/smc911x.c
+@@ -947,7 +947,7 @@ static void smc911x_phy_configure(struct work_struct *work)
+ if (lp->ctl_rspeed != 100)
+ my_ad_caps &= ~(ADVERTISE_100BASE4|ADVERTISE_100FULL|ADVERTISE_100HALF);
+
+- if (!lp->ctl_rfduplx)
++ if (!lp->ctl_rfduplx)
+ my_ad_caps &= ~(ADVERTISE_100FULL|ADVERTISE_10FULL);
+
+ /* Update our Auto-Neg Advertisement Register */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index f069adfc2b35..9c7b1d8e8220 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4513,6 +4513,7 @@ int stmmac_suspend(struct device *dev)
+ {
+ struct net_device *ndev = dev_get_drvdata(dev);
+ struct stmmac_priv *priv = netdev_priv(ndev);
++ u32 chan;
+
+ if (!ndev || !netif_running(ndev))
+ return 0;
+@@ -4527,6 +4528,9 @@ int stmmac_suspend(struct device *dev)
+
+ stmmac_disable_all_queues(priv);
+
++ for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
++ del_timer_sync(&priv->tx_queue[chan].txtimer);
++
+ /* Stop TX/RX DMA */
+ stmmac_stop_all_dma(priv);
+
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index ee086441dcbe..eab9984f73a8 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -772,12 +772,12 @@ static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize)
+ int i;
+
+ gtp->addr_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (gtp->addr_hash == NULL)
+ return -ENOMEM;
+
+ gtp->tid_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (gtp->tid_hash == NULL)
+ goto err1;
+
+diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c
+index bdc4d23627c5..bf03db40d4f0 100644
+--- a/drivers/net/ppp/ppp_async.c
++++ b/drivers/net/ppp/ppp_async.c
+@@ -878,15 +878,15 @@ ppp_async_input(struct asyncppp *ap, const unsigned char *buf,
+ skb = dev_alloc_skb(ap->mru + PPP_HDRLEN + 2);
+ if (!skb)
+ goto nomem;
+- ap->rpkt = skb;
+- }
+- if (skb->len == 0) {
+- /* Try to get the payload 4-byte aligned.
+- * This should match the
+- * PPP_ALLSTATIONS/PPP_UI/compressed tests in
+- * process_input_packet, but we do not have
+- * enough chars here to test buf[1] and buf[2].
+- */
++ ap->rpkt = skb;
++ }
++ if (skb->len == 0) {
++ /* Try to get the payload 4-byte aligned.
++ * This should match the
++ * PPP_ALLSTATIONS/PPP_UI/compressed tests in
++ * process_input_packet, but we do not have
++ * enough chars here to test buf[1] and buf[2].
++ */
+ if (buf[0] != PPP_ALLSTATIONS)
+ skb_reserve(skb, 2 + (buf[0] & 1));
+ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+index 6a213fe760ff..41254f04ab15 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -441,6 +441,7 @@ fail:
+ usb_free_urb(req->urb);
+ list_del(q->next);
+ }
++ kfree(reqs);
+ return NULL;
+
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+index f2579c94ffdb..3270faafe0bc 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+@@ -286,7 +286,7 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
+ int regulatory_type;
+
+ /* Checking for required sections */
+- if (mvm->trans->cfg->nvm_type != IWL_NVM_EXT) {
++ if (mvm->trans->cfg->nvm_type == IWL_NVM) {
+ if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW].data ||
+ !mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data) {
+ IWL_ERR(mvm, "Can't parse empty OTP/NVM sections\n");
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index 69057701641e..373ace38edab 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -3045,6 +3045,10 @@ static int iwl_mvm_send_sta_igtk(struct iwl_mvm *mvm,
+ igtk_cmd.sta_id = cpu_to_le32(sta_id);
+
+ if (remove_key) {
++ /* This is a valid situation for IGTK */
++ if (sta_id == IWL_MVM_INVALID_STA)
++ return 0;
++
+ igtk_cmd.ctrl_flags |= cpu_to_le32(STA_KEY_NOT_VALID);
+ } else {
+ struct ieee80211_key_seq seq;
+@@ -3352,9 +3356,9 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
+ IWL_DEBUG_WEP(mvm, "mvm remove dynamic key: idx=%d sta=%d\n",
+ keyconf->keyidx, sta_id);
+
+- if (mvm_sta && (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
+- keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
+- keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256))
++ if (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
++ keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
++ keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
+ return iwl_mvm_send_sta_igtk(mvm, keyconf, sta_id, true);
+
+ if (!__test_and_clear_bit(keyconf->hw_key_idx, mvm->fw_key_table)) {
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+index 6dd835f1efc2..fbfa0b15d0c8 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+@@ -232,6 +232,7 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
+
+ if (country_ie_len >
+ (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) {
++ rcu_read_unlock();
+ mwifiex_dbg(priv->adapter, ERROR,
+ "11D: country_ie_len overflow!, deauth AP\n");
+ return -EINVAL;
+diff --git a/drivers/nfc/pn544/pn544.c b/drivers/nfc/pn544/pn544.c
+index 70e898e38b16..f30bdf95610f 100644
+--- a/drivers/nfc/pn544/pn544.c
++++ b/drivers/nfc/pn544/pn544.c
+@@ -704,7 +704,7 @@ static int pn544_hci_check_presence(struct nfc_hci_dev *hdev,
+ target->nfcid1_len != 10)
+ return -EOPNOTSUPP;
+
+- return nfc_hci_send_cmd(hdev, NFC_HCI_RF_READER_A_GATE,
++ return nfc_hci_send_cmd(hdev, NFC_HCI_RF_READER_A_GATE,
+ PN544_RF_READER_CMD_ACTIVATE_NEXT,
+ target->nfcid1, target->nfcid1_len, NULL);
+ } else if (target->supported_protocols & (NFC_PROTO_JEWEL_MASK |
+diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
+index ad3fcad4d75b..5e1315900562 100644
+--- a/drivers/of/Kconfig
++++ b/drivers/of/Kconfig
+@@ -103,4 +103,8 @@ config OF_OVERLAY
+ config OF_NUMA
+ bool
+
++config OF_DMA_DEFAULT_COHERENT
++ # arches should select this if DMA is coherent by default for OF devices
++ bool
++
+ endif # OF
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 7ddbf0a1ab86..c42aebba35ab 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -970,12 +970,16 @@ EXPORT_SYMBOL_GPL(of_dma_get_range);
+ * @np: device node
+ *
+ * It returns true if "dma-coherent" property was found
+- * for this device in DT.
++ * for this device in the DT, or if DMA is coherent by
++ * default for OF devices on the current platform.
+ */
+ bool of_dma_is_coherent(struct device_node *np)
+ {
+ struct device_node *node = of_node_get(np);
+
++ if (IS_ENABLED(CONFIG_OF_DMA_DEFAULT_COHERENT))
++ return true;
++
+ while (node) {
+ if (of_property_read_bool(node, "dma-coherent")) {
+ of_node_put(node);
+diff --git a/drivers/pci/controller/dwc/pci-keystone-dw.c b/drivers/pci/controller/dwc/pci-keystone-dw.c
+index 0682213328e9..15c612e853af 100644
+--- a/drivers/pci/controller/dwc/pci-keystone-dw.c
++++ b/drivers/pci/controller/dwc/pci-keystone-dw.c
+@@ -425,7 +425,7 @@ void ks_dw_pcie_initiate_link_train(struct keystone_pcie *ks_pcie)
+ /* Disable Link training */
+ val = ks_dw_app_readl(ks_pcie, CMD_STATUS);
+ val &= ~LTSSM_EN_VAL;
+- ks_dw_app_writel(ks_pcie, CMD_STATUS, LTSSM_EN_VAL | val);
++ ks_dw_app_writel(ks_pcie, CMD_STATUS, val);
+
+ /* Initiate Link Training */
+ val = ks_dw_app_readl(ks_pcie, CMD_STATUS);
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 58e487352853..6f86583605a4 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -2398,7 +2398,7 @@ static int tegra_pcie_probe(struct platform_device *pdev)
+
+ pm_runtime_enable(pcie->dev);
+ err = pm_runtime_get_sync(pcie->dev);
+- if (err) {
++ if (err < 0) {
+ dev_err(dev, "fail to enable pcie controller: %d\n", err);
+ goto teardown_msi;
+ }
+diff --git a/drivers/phy/qualcomm/phy-qcom-apq8064-sata.c b/drivers/phy/qualcomm/phy-qcom-apq8064-sata.c
+index 69ce2afac015..c6925e3e878b 100644
+--- a/drivers/phy/qualcomm/phy-qcom-apq8064-sata.c
++++ b/drivers/phy/qualcomm/phy-qcom-apq8064-sata.c
+@@ -88,7 +88,7 @@ static int read_poll_timeout(void __iomem *addr, u32 mask)
+ if (readl_relaxed(addr) & mask)
+ return 0;
+
+- usleep_range(DELAY_INTERVAL_US, DELAY_INTERVAL_US + 50);
++ usleep_range(DELAY_INTERVAL_US, DELAY_INTERVAL_US + 50);
+ } while (!time_after(jiffies, timeout));
+
+ return (readl_relaxed(addr) & mask) ? 0 : -ETIMEDOUT;
+diff --git a/drivers/platform/x86/intel_scu_ipc.c b/drivers/platform/x86/intel_scu_ipc.c
+index 75c8fef7a482..54f131bec192 100644
+--- a/drivers/platform/x86/intel_scu_ipc.c
++++ b/drivers/platform/x86/intel_scu_ipc.c
+@@ -69,26 +69,22 @@
+ struct intel_scu_ipc_pdata_t {
+ u32 i2c_base;
+ u32 i2c_len;
+- u8 irq_mode;
+ };
+
+ static const struct intel_scu_ipc_pdata_t intel_scu_ipc_lincroft_pdata = {
+ .i2c_base = 0xff12b000,
+ .i2c_len = 0x10,
+- .irq_mode = 0,
+ };
+
+ /* Penwell and Cloverview */
+ static const struct intel_scu_ipc_pdata_t intel_scu_ipc_penwell_pdata = {
+ .i2c_base = 0xff12b000,
+ .i2c_len = 0x10,
+- .irq_mode = 1,
+ };
+
+ static const struct intel_scu_ipc_pdata_t intel_scu_ipc_tangier_pdata = {
+ .i2c_base = 0xff00d000,
+ .i2c_len = 0x10,
+- .irq_mode = 0,
+ };
+
+ struct intel_scu_ipc_dev {
+@@ -101,6 +97,9 @@ struct intel_scu_ipc_dev {
+
+ static struct intel_scu_ipc_dev ipcdev; /* Only one for now */
+
++#define IPC_STATUS 0x04
++#define IPC_STATUS_IRQ BIT(2)
++
+ /*
+ * IPC Read Buffer (Read Only):
+ * 16 byte buffer for receiving data from SCU, if IPC command
+@@ -122,11 +121,8 @@ static DEFINE_MUTEX(ipclock); /* lock used to prevent multiple call to SCU */
+ */
+ static inline void ipc_command(struct intel_scu_ipc_dev *scu, u32 cmd)
+ {
+- if (scu->irq_mode) {
+- reinit_completion(&scu->cmd_complete);
+- writel(cmd | IPC_IOC, scu->ipc_base);
+- }
+- writel(cmd, scu->ipc_base);
++ reinit_completion(&scu->cmd_complete);
++ writel(cmd | IPC_IOC, scu->ipc_base);
+ }
+
+ /*
+@@ -612,9 +608,10 @@ EXPORT_SYMBOL(intel_scu_ipc_i2c_cntrl);
+ static irqreturn_t ioc(int irq, void *dev_id)
+ {
+ struct intel_scu_ipc_dev *scu = dev_id;
++ int status = ipc_read_status(scu);
+
+- if (scu->irq_mode)
+- complete(&scu->cmd_complete);
++ writel(status | IPC_STATUS_IRQ, scu->ipc_base + IPC_STATUS);
++ complete(&scu->cmd_complete);
+
+ return IRQ_HANDLED;
+ }
+@@ -640,8 +637,6 @@ static int ipc_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ if (!pdata)
+ return -ENODEV;
+
+- scu->irq_mode = pdata->irq_mode;
+-
+ err = pcim_enable_device(pdev);
+ if (err)
+ return err;
+diff --git a/drivers/power/supply/ltc2941-battery-gauge.c b/drivers/power/supply/ltc2941-battery-gauge.c
+index 4f129bb4c972..ff5febea1a21 100644
+--- a/drivers/power/supply/ltc2941-battery-gauge.c
++++ b/drivers/power/supply/ltc2941-battery-gauge.c
+@@ -448,7 +448,7 @@ static int ltc294x_i2c_remove(struct i2c_client *client)
+ {
+ struct ltc294x_info *info = i2c_get_clientdata(client);
+
+- cancel_delayed_work(&info->work);
++ cancel_delayed_work_sync(&info->work);
+ power_supply_unregister(info->supply);
+ return 0;
+ }
+diff --git a/drivers/scsi/csiostor/csio_scsi.c b/drivers/scsi/csiostor/csio_scsi.c
+index e09c7f360dbd..0cb585759de6 100644
+--- a/drivers/scsi/csiostor/csio_scsi.c
++++ b/drivers/scsi/csiostor/csio_scsi.c
+@@ -1383,7 +1383,7 @@ csio_device_reset(struct device *dev,
+ return -EINVAL;
+
+ /* Delete NPIV lnodes */
+- csio_lnodes_exit(hw, 1);
++ csio_lnodes_exit(hw, 1);
+
+ /* Block upper IOs */
+ csio_lnodes_block_request(hw);
+diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
+index c7533fa7f46e..36871760a5d3 100644
+--- a/drivers/scsi/qla2xxx/qla_dbg.c
++++ b/drivers/scsi/qla2xxx/qla_dbg.c
+@@ -2520,12 +2520,6 @@ qla83xx_fw_dump_failed:
+ /* Driver Debug Functions. */
+ /****************************************************************************/
+
+-static inline int
+-ql_mask_match(uint32_t level)
+-{
+- return (level & ql2xextended_error_logging) == level;
+-}
+-
+ /*
+ * This function is for formatting and logging debug information.
+ * It is to be used when vha is available. It formats the message
+diff --git a/drivers/scsi/qla2xxx/qla_dbg.h b/drivers/scsi/qla2xxx/qla_dbg.h
+index 8877aa97d829..ceca6dd34db1 100644
+--- a/drivers/scsi/qla2xxx/qla_dbg.h
++++ b/drivers/scsi/qla2xxx/qla_dbg.h
+@@ -374,3 +374,9 @@ extern int qla24xx_dump_ram(struct qla_hw_data *, uint32_t, uint32_t *,
+ extern void qla24xx_pause_risc(struct device_reg_24xx __iomem *,
+ struct qla_hw_data *);
+ extern int qla24xx_soft_reset(struct qla_hw_data *);
++
++static inline int
++ql_mask_match(uint level)
++{
++ return (level & ql2xextended_error_logging) == level;
++}
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 01ded6c6ad38..f9b3151f4b10 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -1876,6 +1876,18 @@ static void qla24xx_nvme_iocb_entry(scsi_qla_host_t *vha, struct req_que *req,
+ inbuf = (uint32_t *)&sts->nvme_ersp_data;
+ outbuf = (uint32_t *)fd->rspaddr;
+ iocb->u.nvme.rsp_pyld_len = le16_to_cpu(sts->nvme_rsp_pyld_len);
++ if (unlikely(iocb->u.nvme.rsp_pyld_len >
++ sizeof(struct nvme_fc_ersp_iu))) {
++ if (ql_mask_match(ql_dbg_io)) {
++ WARN_ONCE(1, "Unexpected response payload length %u.\n",
++ iocb->u.nvme.rsp_pyld_len);
++ ql_log(ql_log_warn, fcport->vha, 0x5100,
++ "Unexpected response payload length %u.\n",
++ iocb->u.nvme.rsp_pyld_len);
++ }
++ iocb->u.nvme.rsp_pyld_len =
++ sizeof(struct nvme_fc_ersp_iu);
++ }
+ iter = iocb->u.nvme.rsp_pyld_len >> 2;
+ for (; iter; iter--)
+ *outbuf++ = swab32(*inbuf++);
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index abef3b29fa10..bef9faea5eee 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -5994,9 +5994,8 @@ qla2x00_dump_mctp_data(scsi_qla_host_t *vha, dma_addr_t req_dma, uint32_t addr,
+ mcp->mb[7] = LSW(MSD(req_dma));
+ mcp->mb[8] = MSW(addr);
+ /* Setting RAM ID to valid */
+- mcp->mb[10] |= BIT_7;
+ /* For MCTP RAM ID is 0x40 */
+- mcp->mb[10] |= 0x40;
++ mcp->mb[10] = BIT_7 | 0x40;
+
+ mcp->out_mb |= MBX_10|MBX_8|MBX_7|MBX_6|MBX_5|MBX_4|MBX_3|MBX_2|MBX_1|
+ MBX_0;
+diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
+index de2bc78449e7..3007eecfa509 100644
+--- a/drivers/scsi/qla2xxx/qla_nx.c
++++ b/drivers/scsi/qla2xxx/qla_nx.c
+@@ -1605,8 +1605,7 @@ qla82xx_get_bootld_offset(struct qla_hw_data *ha)
+ return (u8 *)&ha->hablob->fw->data[offset];
+ }
+
+-static __le32
+-qla82xx_get_fw_size(struct qla_hw_data *ha)
++static u32 qla82xx_get_fw_size(struct qla_hw_data *ha)
+ {
+ struct qla82xx_uri_data_desc *uri_desc = NULL;
+
+@@ -1617,7 +1616,7 @@ qla82xx_get_fw_size(struct qla_hw_data *ha)
+ return cpu_to_le32(uri_desc->size);
+ }
+
+- return cpu_to_le32(*(u32 *)&ha->hablob->fw->data[FW_SIZE_OFFSET]);
++ return get_unaligned_le32(&ha->hablob->fw->data[FW_SIZE_OFFSET]);
+ }
+
+ static u8 *
+@@ -1808,7 +1807,7 @@ qla82xx_fw_load_from_blob(struct qla_hw_data *ha)
+ }
+
+ flashaddr = FLASH_ADDR_START;
+- size = (__force u32)qla82xx_get_fw_size(ha) / 8;
++ size = qla82xx_get_fw_size(ha) / 8;
+ ptr64 = (u64 *)qla82xx_get_fw_offs(ha);
+
+ for (i = 0; i < size; i++) {
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index f8acf101af3d..f59b8982b288 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -4146,7 +4146,7 @@ static void qla4xxx_mem_free(struct scsi_qla_host *ha)
+ dma_free_coherent(&ha->pdev->dev, ha->queues_len, ha->queues,
+ ha->queues_dma);
+
+- if (ha->fw_dump)
++ if (ha->fw_dump)
+ vfree(ha->fw_dump);
+
+ ha->queues_len = 0;
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 3601e770da16..af01be59a721 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -5044,6 +5044,7 @@ static int ufshcd_disable_auto_bkops(struct ufs_hba *hba)
+
+ hba->auto_bkops_enabled = false;
+ trace_ufshcd_auto_bkops_state(dev_name(hba->dev), "Disabled");
++ hba->is_urgent_bkops_lvl_checked = false;
+ out:
+ return err;
+ }
+@@ -5068,6 +5069,7 @@ static void ufshcd_force_reset_auto_bkops(struct ufs_hba *hba)
+ hba->ee_ctrl_mask &= ~MASK_EE_URGENT_BKOPS;
+ ufshcd_disable_auto_bkops(hba);
+ }
++ hba->is_urgent_bkops_lvl_checked = false;
+ }
+
+ static inline int ufshcd_get_bkops_status(struct ufs_hba *hba, u32 *status)
+@@ -5114,6 +5116,7 @@ static int ufshcd_bkops_ctrl(struct ufs_hba *hba,
+ err = ufshcd_enable_auto_bkops(hba);
+ else
+ err = ufshcd_disable_auto_bkops(hba);
++ hba->urgent_bkops_lvl = curr_status;
+ out:
+ return err;
+ }
+diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c
+index 460d5d7c984f..7f5cf488b2b1 100644
+--- a/drivers/usb/gadget/function/f_ecm.c
++++ b/drivers/usb/gadget/function/f_ecm.c
+@@ -52,6 +52,7 @@ struct f_ecm {
+ struct usb_ep *notify;
+ struct usb_request *notify_req;
+ u8 notify_state;
++ atomic_t notify_count;
+ bool is_open;
+
+ /* FIXME is_open needs some irq-ish locking
+@@ -380,7 +381,7 @@ static void ecm_do_notify(struct f_ecm *ecm)
+ int status;
+
+ /* notification already in flight? */
+- if (!req)
++ if (atomic_read(&ecm->notify_count))
+ return;
+
+ event = req->buf;
+@@ -420,10 +421,10 @@ static void ecm_do_notify(struct f_ecm *ecm)
+ event->bmRequestType = 0xA1;
+ event->wIndex = cpu_to_le16(ecm->ctrl_id);
+
+- ecm->notify_req = NULL;
++ atomic_inc(&ecm->notify_count);
+ status = usb_ep_queue(ecm->notify, req, GFP_ATOMIC);
+ if (status < 0) {
+- ecm->notify_req = req;
++ atomic_dec(&ecm->notify_count);
+ DBG(cdev, "notify --> %d\n", status);
+ }
+ }
+@@ -448,17 +449,19 @@ static void ecm_notify_complete(struct usb_ep *ep, struct usb_request *req)
+ switch (req->status) {
+ case 0:
+ /* no fault */
++ atomic_dec(&ecm->notify_count);
+ break;
+ case -ECONNRESET:
+ case -ESHUTDOWN:
++ atomic_set(&ecm->notify_count, 0);
+ ecm->notify_state = ECM_NOTIFY_NONE;
+ break;
+ default:
+ DBG(cdev, "event %02x --> %d\n",
+ event->bNotificationType, req->status);
++ atomic_dec(&ecm->notify_count);
+ break;
+ }
+- ecm->notify_req = req;
+ ecm_do_notify(ecm);
+ }
+
+@@ -907,6 +910,11 @@ static void ecm_unbind(struct usb_configuration *c, struct usb_function *f)
+
+ usb_free_all_descriptors(f);
+
++ if (atomic_read(&ecm->notify_count)) {
++ usb_ep_dequeue(ecm->notify, ecm->notify_req);
++ atomic_set(&ecm->notify_count, 0);
++ }
++
+ kfree(ecm->notify_req->buf);
+ usb_ep_free_request(ecm->notify, ecm->notify_req);
+ }
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index 5780fba620ab..cfca4584ae13 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -54,6 +54,7 @@ struct f_ncm {
+ struct usb_ep *notify;
+ struct usb_request *notify_req;
+ u8 notify_state;
++ atomic_t notify_count;
+ bool is_open;
+
+ const struct ndp_parser_opts *parser_opts;
+@@ -547,7 +548,7 @@ static void ncm_do_notify(struct f_ncm *ncm)
+ int status;
+
+ /* notification already in flight? */
+- if (!req)
++ if (atomic_read(&ncm->notify_count))
+ return;
+
+ event = req->buf;
+@@ -587,7 +588,8 @@ static void ncm_do_notify(struct f_ncm *ncm)
+ event->bmRequestType = 0xA1;
+ event->wIndex = cpu_to_le16(ncm->ctrl_id);
+
+- ncm->notify_req = NULL;
++ atomic_inc(&ncm->notify_count);
++
+ /*
+ * In double buffering if there is a space in FIFO,
+ * completion callback can be called right after the call,
+@@ -597,7 +599,7 @@ static void ncm_do_notify(struct f_ncm *ncm)
+ status = usb_ep_queue(ncm->notify, req, GFP_ATOMIC);
+ spin_lock(&ncm->lock);
+ if (status < 0) {
+- ncm->notify_req = req;
++ atomic_dec(&ncm->notify_count);
+ DBG(cdev, "notify --> %d\n", status);
+ }
+ }
+@@ -632,17 +634,19 @@ static void ncm_notify_complete(struct usb_ep *ep, struct usb_request *req)
+ case 0:
+ VDBG(cdev, "Notification %02x sent\n",
+ event->bNotificationType);
++ atomic_dec(&ncm->notify_count);
+ break;
+ case -ECONNRESET:
+ case -ESHUTDOWN:
++ atomic_set(&ncm->notify_count, 0);
+ ncm->notify_state = NCM_NOTIFY_NONE;
+ break;
+ default:
+ DBG(cdev, "event %02x --> %d\n",
+ event->bNotificationType, req->status);
++ atomic_dec(&ncm->notify_count);
+ break;
+ }
+- ncm->notify_req = req;
+ ncm_do_notify(ncm);
+ spin_unlock(&ncm->lock);
+ }
+@@ -1612,6 +1616,11 @@ static void ncm_unbind(struct usb_configuration *c, struct usb_function *f)
+ ncm_string_defs[0].id = 0;
+ usb_free_all_descriptors(f);
+
++ if (atomic_read(&ncm->notify_count)) {
++ usb_ep_dequeue(ncm->notify, ncm->notify_req);
++ atomic_set(&ncm->notify_count, 0);
++ }
++
+ kfree(ncm->notify_req->buf);
+ usb_ep_free_request(ncm->notify, ncm->notify_req);
+ }
+diff --git a/drivers/usb/gadget/legacy/cdc2.c b/drivers/usb/gadget/legacy/cdc2.c
+index da1c37933ca1..8d7a556ece30 100644
+--- a/drivers/usb/gadget/legacy/cdc2.c
++++ b/drivers/usb/gadget/legacy/cdc2.c
+@@ -225,7 +225,7 @@ static struct usb_composite_driver cdc_driver = {
+ .name = "g_cdc",
+ .dev = &device_desc,
+ .strings = dev_strings,
+- .max_speed = USB_SPEED_HIGH,
++ .max_speed = USB_SPEED_SUPER,
+ .bind = cdc_bind,
+ .unbind = cdc_unbind,
+ };
+diff --git a/drivers/usb/gadget/legacy/g_ffs.c b/drivers/usb/gadget/legacy/g_ffs.c
+index b640ed3fcf70..ae6d8f7092b8 100644
+--- a/drivers/usb/gadget/legacy/g_ffs.c
++++ b/drivers/usb/gadget/legacy/g_ffs.c
+@@ -149,7 +149,7 @@ static struct usb_composite_driver gfs_driver = {
+ .name = DRIVER_NAME,
+ .dev = &gfs_dev_desc,
+ .strings = gfs_dev_strings,
+- .max_speed = USB_SPEED_HIGH,
++ .max_speed = USB_SPEED_SUPER,
+ .bind = gfs_bind,
+ .unbind = gfs_unbind,
+ };
+diff --git a/drivers/usb/gadget/legacy/multi.c b/drivers/usb/gadget/legacy/multi.c
+index 50515f9e1022..ec9749845660 100644
+--- a/drivers/usb/gadget/legacy/multi.c
++++ b/drivers/usb/gadget/legacy/multi.c
+@@ -482,7 +482,7 @@ static struct usb_composite_driver multi_driver = {
+ .name = "g_multi",
+ .dev = &device_desc,
+ .strings = dev_strings,
+- .max_speed = USB_SPEED_HIGH,
++ .max_speed = USB_SPEED_SUPER,
+ .bind = multi_bind,
+ .unbind = multi_unbind,
+ .needs_serial = 1,
+diff --git a/drivers/usb/gadget/legacy/ncm.c b/drivers/usb/gadget/legacy/ncm.c
+index 8465f081e921..c61e71ba7045 100644
+--- a/drivers/usb/gadget/legacy/ncm.c
++++ b/drivers/usb/gadget/legacy/ncm.c
+@@ -197,7 +197,7 @@ static struct usb_composite_driver ncm_driver = {
+ .name = "g_ncm",
+ .dev = &device_desc,
+ .strings = dev_strings,
+- .max_speed = USB_SPEED_HIGH,
++ .max_speed = USB_SPEED_SUPER,
+ .bind = gncm_bind,
+ .unbind = gncm_unbind,
+ };
+diff --git a/drivers/usb/typec/tcpci.c b/drivers/usb/typec/tcpci.c
+index c1f7073a56de..dfae41fe1331 100644
+--- a/drivers/usb/typec/tcpci.c
++++ b/drivers/usb/typec/tcpci.c
+@@ -581,6 +581,12 @@ static int tcpci_probe(struct i2c_client *client,
+ static int tcpci_remove(struct i2c_client *client)
+ {
+ struct tcpci_chip *chip = i2c_get_clientdata(client);
++ int err;
++
++ /* Disable chip interrupts before unregistering port */
++ err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0);
++ if (err < 0)
++ return err;
+
+ tcpci_unregister_port(chip->tcpci);
+
+diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
+index eb8fa25f8eb2..8b1f37ffb65a 100644
+--- a/drivers/watchdog/watchdog_core.c
++++ b/drivers/watchdog/watchdog_core.c
+@@ -138,6 +138,25 @@ int watchdog_init_timeout(struct watchdog_device *wdd,
+ }
+ EXPORT_SYMBOL_GPL(watchdog_init_timeout);
+
++static int watchdog_reboot_notifier(struct notifier_block *nb,
++ unsigned long code, void *data)
++{
++ struct watchdog_device *wdd;
++
++ wdd = container_of(nb, struct watchdog_device, reboot_nb);
++ if (code == SYS_DOWN || code == SYS_HALT) {
++ if (watchdog_active(wdd)) {
++ int ret;
++
++ ret = wdd->ops->stop(wdd);
++ if (ret)
++ return NOTIFY_BAD;
++ }
++ }
++
++ return NOTIFY_DONE;
++}
++
+ static int watchdog_restart_notifier(struct notifier_block *nb,
+ unsigned long action, void *data)
+ {
+@@ -226,6 +245,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd)
+ }
+ }
+
++ if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
++ wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
++
++ ret = register_reboot_notifier(&wdd->reboot_nb);
++ if (ret) {
++ pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
++ wdd->id, ret);
++ watchdog_dev_unregister(wdd);
++ ida_simple_remove(&watchdog_ida, id);
++ return ret;
++ }
++ }
++
+ if (wdd->ops->restart) {
+ wdd->restart_nb.notifier_call = watchdog_restart_notifier;
+
+@@ -271,6 +303,9 @@ static void __watchdog_unregister_device(struct watchdog_device *wdd)
+ if (wdd->ops->restart)
+ unregister_restart_handler(&wdd->restart_nb);
+
++ if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status))
++ unregister_reboot_notifier(&wdd->reboot_nb);
++
+ watchdog_dev_unregister(wdd);
+ ida_simple_remove(&watchdog_ida, wdd->id);
+ }
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index 4b89333e8eb4..e64aa88e99da 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -42,7 +42,6 @@
+ #include <linux/miscdevice.h> /* For handling misc devices */
+ #include <linux/module.h> /* For module stuff/... */
+ #include <linux/mutex.h> /* For mutexes */
+-#include <linux/reboot.h> /* For reboot notifier */
+ #include <linux/slab.h> /* For memory functions */
+ #include <linux/types.h> /* For standard types (like size_t) */
+ #include <linux/watchdog.h> /* For watchdog specific items */
+@@ -1048,25 +1047,6 @@ static void watchdog_cdev_unregister(struct watchdog_device *wdd)
+ put_device(&wd_data->dev);
+ }
+
+-static int watchdog_reboot_notifier(struct notifier_block *nb,
+- unsigned long code, void *data)
+-{
+- struct watchdog_device *wdd;
+-
+- wdd = container_of(nb, struct watchdog_device, reboot_nb);
+- if (code == SYS_DOWN || code == SYS_HALT) {
+- if (watchdog_active(wdd)) {
+- int ret;
+-
+- ret = wdd->ops->stop(wdd);
+- if (ret)
+- return NOTIFY_BAD;
+- }
+- }
+-
+- return NOTIFY_DONE;
+-}
+-
+ /*
+ * watchdog_dev_register: register a watchdog device
+ * @wdd: watchdog device
+@@ -1085,22 +1065,8 @@ int watchdog_dev_register(struct watchdog_device *wdd)
+ return ret;
+
+ ret = watchdog_register_pretimeout(wdd);
+- if (ret) {
++ if (ret)
+ watchdog_cdev_unregister(wdd);
+- return ret;
+- }
+-
+- if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
+- wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
+-
+- ret = devm_register_reboot_notifier(&wdd->wd_data->dev,
+- &wdd->reboot_nb);
+- if (ret) {
+- pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
+- wdd->id, ret);
+- watchdog_dev_unregister(wdd);
+- }
+- }
+
+ return ret;
+ }
+diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
+index 2acbfe104e46..3aab77916915 100644
+--- a/drivers/xen/xen-balloon.c
++++ b/drivers/xen/xen-balloon.c
+@@ -83,7 +83,7 @@ static void watch_target(struct xenbus_watch *watch,
+ "%llu", &static_max) == 1))
+ static_max >>= PAGE_SHIFT - 10;
+ else
+- static_max = new_target;
++ static_max = balloon_stats.current_pages;
+
+ target_diff = (xen_pv_domain() || xen_initial_domain()) ? 0
+ : static_max - balloon_stats.target_pages;
+diff --git a/fs/aio.c b/fs/aio.c
+index 911e23087dfb..b5fbf2061868 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -1600,6 +1600,14 @@ static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb,
+ return 0;
+ }
+
++static void aio_poll_put_work(struct work_struct *work)
++{
++ struct poll_iocb *req = container_of(work, struct poll_iocb, work);
++ struct aio_kiocb *iocb = container_of(req, struct aio_kiocb, poll);
++
++ iocb_put(iocb);
++}
++
+ static void aio_poll_complete_work(struct work_struct *work)
+ {
+ struct poll_iocb *req = container_of(work, struct poll_iocb, work);
+@@ -1664,6 +1672,8 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
+ list_del_init(&req->wait.entry);
+
+ if (mask && spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) {
++ struct kioctx *ctx = iocb->ki_ctx;
++
+ /*
+ * Try to complete the iocb inline if we can. Use
+ * irqsave/irqrestore because not all filesystems (e.g. fuse)
+@@ -1673,8 +1683,14 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
+ list_del(&iocb->ki_list);
+ iocb->ki_res.res = mangle_poll(mask);
+ req->done = true;
+- spin_unlock_irqrestore(&iocb->ki_ctx->ctx_lock, flags);
+- iocb_put(iocb);
++ if (iocb->ki_eventfd && eventfd_signal_count()) {
++ iocb = NULL;
++ INIT_WORK(&req->work, aio_poll_put_work);
++ schedule_work(&req->work);
++ }
++ spin_unlock_irqrestore(&ctx->ctx_lock, flags);
++ if (iocb)
++ iocb_put(iocb);
+ } else {
+ schedule_work(&req->work);
+ }
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 84ff398ae70b..c9943d70e2cb 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -337,12 +337,10 @@ u64 btrfs_get_tree_mod_seq(struct btrfs_fs_info *fs_info,
+ struct seq_list *elem)
+ {
+ write_lock(&fs_info->tree_mod_log_lock);
+- spin_lock(&fs_info->tree_mod_seq_lock);
+ if (!elem->seq) {
+ elem->seq = btrfs_inc_tree_mod_seq(fs_info);
+ list_add_tail(&elem->list, &fs_info->tree_mod_seq_list);
+ }
+- spin_unlock(&fs_info->tree_mod_seq_lock);
+ write_unlock(&fs_info->tree_mod_log_lock);
+
+ return elem->seq;
+@@ -362,7 +360,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info,
+ if (!seq_putting)
+ return;
+
+- spin_lock(&fs_info->tree_mod_seq_lock);
++ write_lock(&fs_info->tree_mod_log_lock);
+ list_del(&elem->list);
+ elem->seq = 0;
+
+@@ -373,19 +371,17 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info,
+ * blocker with lower sequence number exists, we
+ * cannot remove anything from the log
+ */
+- spin_unlock(&fs_info->tree_mod_seq_lock);
++ write_unlock(&fs_info->tree_mod_log_lock);
+ return;
+ }
+ min_seq = cur_elem->seq;
+ }
+ }
+- spin_unlock(&fs_info->tree_mod_seq_lock);
+
+ /*
+ * anything that's lower than the lowest existing (read: blocked)
+ * sequence number can be removed from the tree.
+ */
+- write_lock(&fs_info->tree_mod_log_lock);
+ tm_root = &fs_info->tree_mod_log;
+ for (node = rb_first(tm_root); node; node = next) {
+ next = rb_next(node);
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index d24ecbf938b6..15cb96ad15d8 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -893,14 +893,12 @@ struct btrfs_fs_info {
+ struct list_head delayed_iputs;
+ struct mutex cleaner_delayed_iput_mutex;
+
+- /* this protects tree_mod_seq_list */
+- spinlock_t tree_mod_seq_lock;
+ atomic64_t tree_mod_seq;
+- struct list_head tree_mod_seq_list;
+
+- /* this protects tree_mod_log */
++ /* this protects tree_mod_log and tree_mod_seq_list */
+ rwlock_t tree_mod_log_lock;
+ struct rb_root tree_mod_log;
++ struct list_head tree_mod_seq_list;
+
+ atomic_t async_delalloc_pages;
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 7e5c81e80e15..09a12115b640 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -301,7 +301,7 @@ void btrfs_merge_delayed_refs(struct btrfs_trans_handle *trans,
+ if (head->is_data)
+ return;
+
+- spin_lock(&fs_info->tree_mod_seq_lock);
++ read_lock(&fs_info->tree_mod_log_lock);
+ if (!list_empty(&fs_info->tree_mod_seq_list)) {
+ struct seq_list *elem;
+
+@@ -309,7 +309,7 @@ void btrfs_merge_delayed_refs(struct btrfs_trans_handle *trans,
+ struct seq_list, list);
+ seq = elem->seq;
+ }
+- spin_unlock(&fs_info->tree_mod_seq_lock);
++ read_unlock(&fs_info->tree_mod_log_lock);
+
+ again:
+ for (node = rb_first(&head->ref_tree); node; node = rb_next(node)) {
+@@ -326,7 +326,7 @@ int btrfs_check_delayed_seq(struct btrfs_fs_info *fs_info, u64 seq)
+ struct seq_list *elem;
+ int ret = 0;
+
+- spin_lock(&fs_info->tree_mod_seq_lock);
++ read_lock(&fs_info->tree_mod_log_lock);
+ if (!list_empty(&fs_info->tree_mod_seq_list)) {
+ elem = list_first_entry(&fs_info->tree_mod_seq_list,
+ struct seq_list, list);
+@@ -339,7 +339,7 @@ int btrfs_check_delayed_seq(struct btrfs_fs_info *fs_info, u64 seq)
+ }
+ }
+
+- spin_unlock(&fs_info->tree_mod_seq_lock);
++ read_unlock(&fs_info->tree_mod_log_lock);
+ return ret;
+ }
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index e12c37f457e0..9e467e8a8cb5 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -2031,7 +2031,7 @@ static void free_root_extent_buffers(struct btrfs_root *root)
+ }
+
+ /* helper to cleanup tree roots */
+-static void free_root_pointers(struct btrfs_fs_info *info, int chunk_root)
++static void free_root_pointers(struct btrfs_fs_info *info, bool free_chunk_root)
+ {
+ free_root_extent_buffers(info->tree_root);
+
+@@ -2040,7 +2040,7 @@ static void free_root_pointers(struct btrfs_fs_info *info, int chunk_root)
+ free_root_extent_buffers(info->csum_root);
+ free_root_extent_buffers(info->quota_root);
+ free_root_extent_buffers(info->uuid_root);
+- if (chunk_root)
++ if (free_chunk_root)
+ free_root_extent_buffers(info->chunk_root);
+ free_root_extent_buffers(info->free_space_root);
+ }
+@@ -2645,7 +2645,6 @@ int open_ctree(struct super_block *sb,
+ spin_lock_init(&fs_info->fs_roots_radix_lock);
+ spin_lock_init(&fs_info->delayed_iput_lock);
+ spin_lock_init(&fs_info->defrag_inodes_lock);
+- spin_lock_init(&fs_info->tree_mod_seq_lock);
+ spin_lock_init(&fs_info->super_lock);
+ spin_lock_init(&fs_info->qgroup_op_lock);
+ spin_lock_init(&fs_info->buffer_lock);
+@@ -3274,7 +3273,7 @@ fail_block_groups:
+ btrfs_put_block_group_cache(fs_info);
+
+ fail_tree_roots:
+- free_root_pointers(fs_info, 1);
++ free_root_pointers(fs_info, true);
+ invalidate_inode_pages2(fs_info->btree_inode->i_mapping);
+
+ fail_sb_buffer:
+@@ -3302,7 +3301,7 @@ recovery_tree_root:
+ if (!btrfs_test_opt(fs_info, USEBACKUPROOT))
+ goto fail_tree_roots;
+
+- free_root_pointers(fs_info, 0);
++ free_root_pointers(fs_info, false);
+
+ /* don't use the log in recovery mode, it won't be valid */
+ btrfs_set_super_log_root(disk_super, 0);
+@@ -3984,10 +3983,17 @@ void close_ctree(struct btrfs_fs_info *fs_info)
+ invalidate_inode_pages2(fs_info->btree_inode->i_mapping);
+ btrfs_stop_all_workers(fs_info);
+
+- btrfs_free_block_groups(fs_info);
+-
+ clear_bit(BTRFS_FS_OPEN, &fs_info->flags);
+- free_root_pointers(fs_info, 1);
++ free_root_pointers(fs_info, true);
++
++ /*
++ * We must free the block groups after dropping the fs_roots as we could
++ * have had an IO error and have left over tree log blocks that aren't
++ * cleaned up until the fs roots are freed. This makes the block group
++ * accounting appear to be wrong because there's pending reserved bytes,
++ * so make sure we do the block group cleanup afterwards.
++ */
++ btrfs_free_block_groups(fs_info);
+
+ iput(fs_info->btree_inode);
+
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index fed44390c049..11efb4f5041c 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -4014,6 +4014,14 @@ retry:
+ */
+ scanned = 1;
+ index = 0;
++
++ /*
++ * If we're looping we could run into a page that is locked by a
++ * writer and that writer could be waiting on writeback for a
++ * page in our current bio, and thus deadlock, so flush the
++ * write bio here.
++ */
++ flush_write_bio(epd);
+ goto retry;
+ }
+
+diff --git a/fs/btrfs/tests/btrfs-tests.c b/fs/btrfs/tests/btrfs-tests.c
+index db72b3b6209e..2eec1dd3803a 100644
+--- a/fs/btrfs/tests/btrfs-tests.c
++++ b/fs/btrfs/tests/btrfs-tests.c
+@@ -102,7 +102,6 @@ struct btrfs_fs_info *btrfs_alloc_dummy_fs_info(u32 nodesize, u32 sectorsize)
+ spin_lock_init(&fs_info->qgroup_op_lock);
+ spin_lock_init(&fs_info->super_lock);
+ spin_lock_init(&fs_info->fs_roots_radix_lock);
+- spin_lock_init(&fs_info->tree_mod_seq_lock);
+ mutex_init(&fs_info->qgroup_ioctl_lock);
+ mutex_init(&fs_info->qgroup_rescan_lock);
+ rwlock_init(&fs_info->tree_mod_log_lock);
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 26317bca5649..4b1491e1b803 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1936,6 +1936,14 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+ struct btrfs_transaction *prev_trans = NULL;
+ int ret;
+
++ /*
++ * Some places just start a transaction to commit it. We need to make
++ * sure that if this commit fails that the abort code actually marks the
++ * transaction as failed, so set trans->dirty to make the abort code do
++ * the right thing.
++ */
++ trans->dirty = true;
++
+ /* Stop the commit early if ->aborted is set */
+ if (unlikely(READ_ONCE(cur_trans->aborted))) {
+ ret = cur_trans->aborted;
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index fe7165c9d875..d4c86c6cbe39 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3892,7 +3892,7 @@ static int log_csums(struct btrfs_trans_handle *trans,
+ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ struct btrfs_inode *inode,
+ struct btrfs_path *dst_path,
+- struct btrfs_path *src_path, u64 *last_extent,
++ struct btrfs_path *src_path,
+ int start_slot, int nr, int inode_only,
+ u64 logged_isize)
+ {
+@@ -3903,7 +3903,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ struct btrfs_file_extent_item *extent;
+ struct btrfs_inode_item *inode_item;
+ struct extent_buffer *src = src_path->nodes[0];
+- struct btrfs_key first_key, last_key, key;
+ int ret;
+ struct btrfs_key *ins_keys;
+ u32 *ins_sizes;
+@@ -3911,9 +3910,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ int i;
+ struct list_head ordered_sums;
+ int skip_csum = inode->flags & BTRFS_INODE_NODATASUM;
+- bool has_extents = false;
+- bool need_find_last_extent = true;
+- bool done = false;
+
+ INIT_LIST_HEAD(&ordered_sums);
+
+@@ -3922,8 +3918,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ if (!ins_data)
+ return -ENOMEM;
+
+- first_key.objectid = (u64)-1;
+-
+ ins_sizes = (u32 *)ins_data;
+ ins_keys = (struct btrfs_key *)(ins_data + nr * sizeof(u32));
+
+@@ -3944,9 +3938,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+
+ src_offset = btrfs_item_ptr_offset(src, start_slot + i);
+
+- if (i == nr - 1)
+- last_key = ins_keys[i];
+-
+ if (ins_keys[i].type == BTRFS_INODE_ITEM_KEY) {
+ inode_item = btrfs_item_ptr(dst_path->nodes[0],
+ dst_path->slots[0],
+@@ -3960,20 +3951,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ src_offset, ins_sizes[i]);
+ }
+
+- /*
+- * We set need_find_last_extent here in case we know we were
+- * processing other items and then walk into the first extent in
+- * the inode. If we don't hit an extent then nothing changes,
+- * we'll do the last search the next time around.
+- */
+- if (ins_keys[i].type == BTRFS_EXTENT_DATA_KEY) {
+- has_extents = true;
+- if (first_key.objectid == (u64)-1)
+- first_key = ins_keys[i];
+- } else {
+- need_find_last_extent = false;
+- }
+-
+ /* take a reference on file data extents so that truncates
+ * or deletes of this inode don't have to relog the inode
+ * again
+@@ -4039,167 +4016,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ kfree(sums);
+ }
+
+- if (!has_extents)
+- return ret;
+-
+- if (need_find_last_extent && *last_extent == first_key.offset) {
+- /*
+- * We don't have any leafs between our current one and the one
+- * we processed before that can have file extent items for our
+- * inode (and have a generation number smaller than our current
+- * transaction id).
+- */
+- need_find_last_extent = false;
+- }
+-
+- /*
+- * Because we use btrfs_search_forward we could skip leaves that were
+- * not modified and then assume *last_extent is valid when it really
+- * isn't. So back up to the previous leaf and read the end of the last
+- * extent before we go and fill in holes.
+- */
+- if (need_find_last_extent) {
+- u64 len;
+-
+- ret = btrfs_prev_leaf(inode->root, src_path);
+- if (ret < 0)
+- return ret;
+- if (ret)
+- goto fill_holes;
+- if (src_path->slots[0])
+- src_path->slots[0]--;
+- src = src_path->nodes[0];
+- btrfs_item_key_to_cpu(src, &key, src_path->slots[0]);
+- if (key.objectid != btrfs_ino(inode) ||
+- key.type != BTRFS_EXTENT_DATA_KEY)
+- goto fill_holes;
+- extent = btrfs_item_ptr(src, src_path->slots[0],
+- struct btrfs_file_extent_item);
+- if (btrfs_file_extent_type(src, extent) ==
+- BTRFS_FILE_EXTENT_INLINE) {
+- len = btrfs_file_extent_ram_bytes(src, extent);
+- *last_extent = ALIGN(key.offset + len,
+- fs_info->sectorsize);
+- } else {
+- len = btrfs_file_extent_num_bytes(src, extent);
+- *last_extent = key.offset + len;
+- }
+- }
+-fill_holes:
+- /* So we did prev_leaf, now we need to move to the next leaf, but a few
+- * things could have happened
+- *
+- * 1) A merge could have happened, so we could currently be on a leaf
+- * that holds what we were copying in the first place.
+- * 2) A split could have happened, and now not all of the items we want
+- * are on the same leaf.
+- *
+- * So we need to adjust how we search for holes, we need to drop the
+- * path and re-search for the first extent key we found, and then walk
+- * forward until we hit the last one we copied.
+- */
+- if (need_find_last_extent) {
+- /* btrfs_prev_leaf could return 1 without releasing the path */
+- btrfs_release_path(src_path);
+- ret = btrfs_search_slot(NULL, inode->root, &first_key,
+- src_path, 0, 0);
+- if (ret < 0)
+- return ret;
+- ASSERT(ret == 0);
+- src = src_path->nodes[0];
+- i = src_path->slots[0];
+- } else {
+- i = start_slot;
+- }
+-
+- /*
+- * Ok so here we need to go through and fill in any holes we may have
+- * to make sure that holes are punched for those areas in case they had
+- * extents previously.
+- */
+- while (!done) {
+- u64 offset, len;
+- u64 extent_end;
+-
+- if (i >= btrfs_header_nritems(src_path->nodes[0])) {
+- ret = btrfs_next_leaf(inode->root, src_path);
+- if (ret < 0)
+- return ret;
+- ASSERT(ret == 0);
+- src = src_path->nodes[0];
+- i = 0;
+- need_find_last_extent = true;
+- }
+-
+- btrfs_item_key_to_cpu(src, &key, i);
+- if (!btrfs_comp_cpu_keys(&key, &last_key))
+- done = true;
+- if (key.objectid != btrfs_ino(inode) ||
+- key.type != BTRFS_EXTENT_DATA_KEY) {
+- i++;
+- continue;
+- }
+- extent = btrfs_item_ptr(src, i, struct btrfs_file_extent_item);
+- if (btrfs_file_extent_type(src, extent) ==
+- BTRFS_FILE_EXTENT_INLINE) {
+- len = btrfs_file_extent_ram_bytes(src, extent);
+- extent_end = ALIGN(key.offset + len,
+- fs_info->sectorsize);
+- } else {
+- len = btrfs_file_extent_num_bytes(src, extent);
+- extent_end = key.offset + len;
+- }
+- i++;
+-
+- if (*last_extent == key.offset) {
+- *last_extent = extent_end;
+- continue;
+- }
+- offset = *last_extent;
+- len = key.offset - *last_extent;
+- ret = btrfs_insert_file_extent(trans, log, btrfs_ino(inode),
+- offset, 0, 0, len, 0, len, 0, 0, 0);
+- if (ret)
+- break;
+- *last_extent = extent_end;
+- }
+-
+- /*
+- * Check if there is a hole between the last extent found in our leaf
+- * and the first extent in the next leaf. If there is one, we need to
+- * log an explicit hole so that at replay time we can punch the hole.
+- */
+- if (ret == 0 &&
+- key.objectid == btrfs_ino(inode) &&
+- key.type == BTRFS_EXTENT_DATA_KEY &&
+- i == btrfs_header_nritems(src_path->nodes[0])) {
+- ret = btrfs_next_leaf(inode->root, src_path);
+- need_find_last_extent = true;
+- if (ret > 0) {
+- ret = 0;
+- } else if (ret == 0) {
+- btrfs_item_key_to_cpu(src_path->nodes[0], &key,
+- src_path->slots[0]);
+- if (key.objectid == btrfs_ino(inode) &&
+- key.type == BTRFS_EXTENT_DATA_KEY &&
+- *last_extent < key.offset) {
+- const u64 len = key.offset - *last_extent;
+-
+- ret = btrfs_insert_file_extent(trans, log,
+- btrfs_ino(inode),
+- *last_extent, 0,
+- 0, len, 0, len,
+- 0, 0, 0);
+- *last_extent += len;
+- }
+- }
+- }
+- /*
+- * Need to let the callers know we dropped the path so they should
+- * re-search.
+- */
+- if (!ret && need_find_last_extent)
+- ret = 1;
+ return ret;
+ }
+
+@@ -4365,7 +4181,7 @@ static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans,
+ const u64 i_size = i_size_read(&inode->vfs_inode);
+ const u64 ino = btrfs_ino(inode);
+ struct btrfs_path *dst_path = NULL;
+- u64 last_extent = (u64)-1;
++ bool dropped_extents = false;
+ int ins_nr = 0;
+ int start_slot;
+ int ret;
+@@ -4387,8 +4203,7 @@ static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans,
+ if (slot >= btrfs_header_nritems(leaf)) {
+ if (ins_nr > 0) {
+ ret = copy_items(trans, inode, dst_path, path,
+- &last_extent, start_slot,
+- ins_nr, 1, 0);
++ start_slot, ins_nr, 1, 0);
+ if (ret < 0)
+ goto out;
+ ins_nr = 0;
+@@ -4412,8 +4227,7 @@ static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans,
+ path->slots[0]++;
+ continue;
+ }
+- if (last_extent == (u64)-1) {
+- last_extent = key.offset;
++ if (!dropped_extents) {
+ /*
+ * Avoid logging extent items logged in past fsync calls
+ * and leading to duplicate keys in the log tree.
+@@ -4427,6 +4241,7 @@ static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans,
+ } while (ret == -EAGAIN);
+ if (ret)
+ goto out;
++ dropped_extents = true;
+ }
+ if (ins_nr == 0)
+ start_slot = slot;
+@@ -4441,7 +4256,7 @@ static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans,
+ }
+ }
+ if (ins_nr > 0) {
+- ret = copy_items(trans, inode, dst_path, path, &last_extent,
++ ret = copy_items(trans, inode, dst_path, path,
+ start_slot, ins_nr, 1, 0);
+ if (ret > 0)
+ ret = 0;
+@@ -4636,13 +4451,8 @@ static int btrfs_log_all_xattrs(struct btrfs_trans_handle *trans,
+
+ if (slot >= nritems) {
+ if (ins_nr > 0) {
+- u64 last_extent = 0;
+-
+ ret = copy_items(trans, inode, dst_path, path,
+- &last_extent, start_slot,
+- ins_nr, 1, 0);
+- /* can't be 1, extent items aren't processed */
+- ASSERT(ret <= 0);
++ start_slot, ins_nr, 1, 0);
+ if (ret < 0)
+ return ret;
+ ins_nr = 0;
+@@ -4666,13 +4476,8 @@ static int btrfs_log_all_xattrs(struct btrfs_trans_handle *trans,
+ cond_resched();
+ }
+ if (ins_nr > 0) {
+- u64 last_extent = 0;
+-
+ ret = copy_items(trans, inode, dst_path, path,
+- &last_extent, start_slot,
+- ins_nr, 1, 0);
+- /* can't be 1, extent items aren't processed */
+- ASSERT(ret <= 0);
++ start_slot, ins_nr, 1, 0);
+ if (ret < 0)
+ return ret;
+ }
+@@ -4681,100 +4486,119 @@ static int btrfs_log_all_xattrs(struct btrfs_trans_handle *trans,
+ }
+
+ /*
+- * If the no holes feature is enabled we need to make sure any hole between the
+- * last extent and the i_size of our inode is explicitly marked in the log. This
+- * is to make sure that doing something like:
+- *
+- * 1) create file with 128Kb of data
+- * 2) truncate file to 64Kb
+- * 3) truncate file to 256Kb
+- * 4) fsync file
+- * 5) <crash/power failure>
+- * 6) mount fs and trigger log replay
+- *
+- * Will give us a file with a size of 256Kb, the first 64Kb of data match what
+- * the file had in its first 64Kb of data at step 1 and the last 192Kb of the
+- * file correspond to a hole. The presence of explicit holes in a log tree is
+- * what guarantees that log replay will remove/adjust file extent items in the
+- * fs/subvol tree.
+- *
+- * Here we do not need to care about holes between extents, that is already done
+- * by copy_items(). We also only need to do this in the full sync path, where we
+- * lookup for extents from the fs/subvol tree only. In the fast path case, we
+- * lookup the list of modified extent maps and if any represents a hole, we
+- * insert a corresponding extent representing a hole in the log tree.
++ * When using the NO_HOLES feature if we punched a hole that causes the
++ * deletion of entire leafs or all the extent items of the first leaf (the one
++ * that contains the inode item and references) we may end up not processing
++ * any extents, because there are no leafs with a generation matching the
++ * current transaction that have extent items for our inode. So we need to find
++ * if any holes exist and then log them. We also need to log holes after any
++ * truncate operation that changes the inode's size.
+ */
+-static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
+- struct btrfs_root *root,
+- struct btrfs_inode *inode,
+- struct btrfs_path *path)
++static int btrfs_log_holes(struct btrfs_trans_handle *trans,
++ struct btrfs_root *root,
++ struct btrfs_inode *inode,
++ struct btrfs_path *path)
+ {
+ struct btrfs_fs_info *fs_info = root->fs_info;
+- int ret;
+ struct btrfs_key key;
+- u64 hole_start;
+- u64 hole_size;
+- struct extent_buffer *leaf;
+- struct btrfs_root *log = root->log_root;
+ const u64 ino = btrfs_ino(inode);
+ const u64 i_size = i_size_read(&inode->vfs_inode);
++ u64 prev_extent_end = 0;
++ int ret;
+
+- if (!btrfs_fs_incompat(fs_info, NO_HOLES))
++ if (!btrfs_fs_incompat(fs_info, NO_HOLES) || i_size == 0)
+ return 0;
+
+ key.objectid = ino;
+ key.type = BTRFS_EXTENT_DATA_KEY;
+- key.offset = (u64)-1;
++ key.offset = 0;
+
+ ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+- ASSERT(ret != 0);
+ if (ret < 0)
+ return ret;
+
+- ASSERT(path->slots[0] > 0);
+- path->slots[0]--;
+- leaf = path->nodes[0];
+- btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
+-
+- if (key.objectid != ino || key.type != BTRFS_EXTENT_DATA_KEY) {
+- /* inode does not have any extents */
+- hole_start = 0;
+- hole_size = i_size;
+- } else {
++ while (true) {
+ struct btrfs_file_extent_item *extent;
++ struct extent_buffer *leaf = path->nodes[0];
+ u64 len;
+
+- /*
+- * If there's an extent beyond i_size, an explicit hole was
+- * already inserted by copy_items().
+- */
+- if (key.offset >= i_size)
+- return 0;
++ if (path->slots[0] >= btrfs_header_nritems(path->nodes[0])) {
++ ret = btrfs_next_leaf(root, path);
++ if (ret < 0)
++ return ret;
++ if (ret > 0) {
++ ret = 0;
++ break;
++ }
++ leaf = path->nodes[0];
++ }
++
++ btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
++ if (key.objectid != ino || key.type != BTRFS_EXTENT_DATA_KEY)
++ break;
++
++ /* We have a hole, log it. */
++ if (prev_extent_end < key.offset) {
++ const u64 hole_len = key.offset - prev_extent_end;
++
++ /*
++ * Release the path to avoid deadlocks with other code
++ * paths that search the root while holding locks on
++ * leafs from the log root.
++ */
++ btrfs_release_path(path);
++ ret = btrfs_insert_file_extent(trans, root->log_root,
++ ino, prev_extent_end, 0,
++ 0, hole_len, 0, hole_len,
++ 0, 0, 0);
++ if (ret < 0)
++ return ret;
++
++ /*
++ * Search for the same key again in the root. Since it's
++ * an extent item and we are holding the inode lock, the
++ * key must still exist. If it doesn't just emit warning
++ * and return an error to fall back to a transaction
++ * commit.
++ */
++ ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
++ if (ret < 0)
++ return ret;
++ if (WARN_ON(ret > 0))
++ return -ENOENT;
++ leaf = path->nodes[0];
++ }
+
+ extent = btrfs_item_ptr(leaf, path->slots[0],
+ struct btrfs_file_extent_item);
+-
+ if (btrfs_file_extent_type(leaf, extent) ==
+- BTRFS_FILE_EXTENT_INLINE)
+- return 0;
++ BTRFS_FILE_EXTENT_INLINE) {
++ len = btrfs_file_extent_ram_bytes(leaf, extent);
++ prev_extent_end = ALIGN(key.offset + len,
++ fs_info->sectorsize);
++ } else {
++ len = btrfs_file_extent_num_bytes(leaf, extent);
++ prev_extent_end = key.offset + len;
++ }
+
+- len = btrfs_file_extent_num_bytes(leaf, extent);
+- /* Last extent goes beyond i_size, no need to log a hole. */
+- if (key.offset + len > i_size)
+- return 0;
+- hole_start = key.offset + len;
+- hole_size = i_size - hole_start;
++ path->slots[0]++;
++ cond_resched();
+ }
+- btrfs_release_path(path);
+
+- /* Last extent ends at i_size. */
+- if (hole_size == 0)
+- return 0;
++ if (prev_extent_end < i_size) {
++ u64 hole_len;
+
+- hole_size = ALIGN(hole_size, fs_info->sectorsize);
+- ret = btrfs_insert_file_extent(trans, log, ino, hole_start, 0, 0,
+- hole_size, 0, hole_size, 0, 0, 0);
+- return ret;
++ btrfs_release_path(path);
++ hole_len = ALIGN(i_size - prev_extent_end, fs_info->sectorsize);
++ ret = btrfs_insert_file_extent(trans, root->log_root,
++ ino, prev_extent_end, 0, 0,
++ hole_len, 0, hole_len,
++ 0, 0, 0);
++ if (ret < 0)
++ return ret;
++ }
++
++ return 0;
+ }
+
+ /*
+@@ -4934,7 +4758,6 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
+ struct btrfs_key min_key;
+ struct btrfs_key max_key;
+ struct btrfs_root *log = root->log_root;
+- u64 last_extent = 0;
+ int err = 0;
+ int ret;
+ int nritems;
+@@ -5108,7 +4931,7 @@ again:
+ ins_start_slot = path->slots[0];
+ }
+ ret = copy_items(trans, inode, dst_path, path,
+- &last_extent, ins_start_slot,
++ ins_start_slot,
+ ins_nr, inode_only,
+ logged_isize);
+ if (ret < 0) {
+@@ -5161,17 +4984,13 @@ again:
+ if (ins_nr == 0)
+ goto next_slot;
+ ret = copy_items(trans, inode, dst_path, path,
+- &last_extent, ins_start_slot,
++ ins_start_slot,
+ ins_nr, inode_only, logged_isize);
+ if (ret < 0) {
+ err = ret;
+ goto out_unlock;
+ }
+ ins_nr = 0;
+- if (ret) {
+- btrfs_release_path(path);
+- continue;
+- }
+ goto next_slot;
+ }
+
+@@ -5184,18 +5003,13 @@ again:
+ goto next_slot;
+ }
+
+- ret = copy_items(trans, inode, dst_path, path, &last_extent,
++ ret = copy_items(trans, inode, dst_path, path,
+ ins_start_slot, ins_nr, inode_only,
+ logged_isize);
+ if (ret < 0) {
+ err = ret;
+ goto out_unlock;
+ }
+- if (ret) {
+- ins_nr = 0;
+- btrfs_release_path(path);
+- continue;
+- }
+ ins_nr = 1;
+ ins_start_slot = path->slots[0];
+ next_slot:
+@@ -5209,13 +5023,12 @@ next_slot:
+ }
+ if (ins_nr) {
+ ret = copy_items(trans, inode, dst_path, path,
+- &last_extent, ins_start_slot,
++ ins_start_slot,
+ ins_nr, inode_only, logged_isize);
+ if (ret < 0) {
+ err = ret;
+ goto out_unlock;
+ }
+- ret = 0;
+ ins_nr = 0;
+ }
+ btrfs_release_path(path);
+@@ -5230,14 +5043,13 @@ next_key:
+ }
+ }
+ if (ins_nr) {
+- ret = copy_items(trans, inode, dst_path, path, &last_extent,
++ ret = copy_items(trans, inode, dst_path, path,
+ ins_start_slot, ins_nr, inode_only,
+ logged_isize);
+ if (ret < 0) {
+ err = ret;
+ goto out_unlock;
+ }
+- ret = 0;
+ ins_nr = 0;
+ }
+
+@@ -5250,7 +5062,7 @@ next_key:
+ if (max_key.type >= BTRFS_EXTENT_DATA_KEY && !fast_search) {
+ btrfs_release_path(path);
+ btrfs_release_path(dst_path);
+- err = btrfs_log_trailing_hole(trans, root, inode, path);
++ err = btrfs_log_holes(trans, root, inode, path);
+ if (err)
+ goto out_unlock;
+ }
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 43f29621e51f..0d4e4d97e6cf 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -259,9 +259,14 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon)
+ }
+
+ rc = cifs_negotiate_protocol(0, tcon->ses);
+- if (!rc && tcon->ses->need_reconnect)
++ if (!rc && tcon->ses->need_reconnect) {
+ rc = cifs_setup_session(0, tcon->ses, nls_codepage);
+-
++ if ((rc == -EACCES) && !tcon->retry) {
++ rc = -EHOSTDOWN;
++ mutex_unlock(&tcon->ses->session_mutex);
++ goto failed;
++ }
++ }
+ if (rc || !tcon->need_reconnect) {
+ mutex_unlock(&tcon->ses->session_mutex);
+ goto out;
+@@ -306,6 +311,7 @@ out:
+ case SMB2_SET_INFO:
+ rc = -EAGAIN;
+ }
++failed:
+ unload_nls(nls_codepage);
+ return rc;
+ }
+@@ -3130,8 +3136,8 @@ smb2_readv_callback(struct mid_q_entry *mid)
+ struct smb2_sync_hdr *shdr =
+ (struct smb2_sync_hdr *)rdata->iov[0].iov_base;
+ unsigned int credits_received = 0;
+- struct smb_rqst rqst = { .rq_iov = rdata->iov,
+- .rq_nvec = 2,
++ struct smb_rqst rqst = { .rq_iov = &rdata->iov[1],
++ .rq_nvec = 1,
+ .rq_pages = rdata->pages,
+ .rq_offset = rdata->page_offset,
+ .rq_npages = rdata->nr_pages,
+diff --git a/fs/eventfd.c b/fs/eventfd.c
+index 08d3bd602f73..ce1d1711fbba 100644
+--- a/fs/eventfd.c
++++ b/fs/eventfd.c
+@@ -22,6 +22,8 @@
+ #include <linux/proc_fs.h>
+ #include <linux/seq_file.h>
+
++DEFINE_PER_CPU(int, eventfd_wake_count);
++
+ struct eventfd_ctx {
+ struct kref kref;
+ wait_queue_head_t wqh;
+@@ -55,12 +57,25 @@ __u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n)
+ {
+ unsigned long flags;
+
++ /*
++ * Deadlock or stack overflow issues can happen if we recurse here
++ * through waitqueue wakeup handlers. If the caller users potentially
++ * nested waitqueues with custom wakeup handlers, then it should
++ * check eventfd_signal_count() before calling this function. If
++ * it returns true, the eventfd_signal() call should be deferred to a
++ * safe context.
++ */
++ if (WARN_ON_ONCE(this_cpu_read(eventfd_wake_count)))
++ return 0;
++
+ spin_lock_irqsave(&ctx->wqh.lock, flags);
++ this_cpu_inc(eventfd_wake_count);
+ if (ULLONG_MAX - ctx->count < n)
+ n = ULLONG_MAX - ctx->count;
+ ctx->count += n;
+ if (waitqueue_active(&ctx->wqh))
+ wake_up_locked_poll(&ctx->wqh, EPOLLIN);
++ this_cpu_dec(eventfd_wake_count);
+ spin_unlock_irqrestore(&ctx->wqh.lock, flags);
+
+ return n;
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index 364e647d87c0..80a3038e0e46 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -1093,9 +1093,9 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
+
+ if (EXT2_BLOCKS_PER_GROUP(sb) == 0)
+ goto cantfind_ext2;
+- sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -
+- le32_to_cpu(es->s_first_data_block) - 1)
+- / EXT2_BLOCKS_PER_GROUP(sb)) + 1;
++ sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -
++ le32_to_cpu(es->s_first_data_block) - 1)
++ / EXT2_BLOCKS_PER_GROUP(sb)) + 1;
+ db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) /
+ EXT2_DESC_PER_BLOCK(sb);
+ sbi->s_group_desc = kmalloc_array (db_count,
+diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
+index db7590178dfc..9cc79b7b0df1 100644
+--- a/fs/ext4/page-io.c
++++ b/fs/ext4/page-io.c
+@@ -481,17 +481,26 @@ int ext4_bio_write_page(struct ext4_io_submit *io,
+ nr_to_submit) {
+ gfp_t gfp_flags = GFP_NOFS;
+
++ /*
++ * Since bounce page allocation uses a mempool, we can only use
++ * a waiting mask (i.e. request guaranteed allocation) on the
++ * first page of the bio. Otherwise it can deadlock.
++ */
++ if (io->io_bio)
++ gfp_flags = GFP_NOWAIT | __GFP_NOWARN;
+ retry_encrypt:
+ data_page = fscrypt_encrypt_page(inode, page, PAGE_SIZE, 0,
+ page->index, gfp_flags);
+ if (IS_ERR(data_page)) {
+ ret = PTR_ERR(data_page);
+- if (ret == -ENOMEM && wbc->sync_mode == WB_SYNC_ALL) {
+- if (io->io_bio) {
++ if (ret == -ENOMEM &&
++ (io->io_bio || wbc->sync_mode == WB_SYNC_ALL)) {
++ gfp_flags = GFP_NOFS;
++ if (io->io_bio)
+ ext4_io_submit(io);
+- congestion_wait(BLK_RW_ASYNC, HZ/50);
+- }
+- gfp_flags |= __GFP_NOFAIL;
++ else
++ gfp_flags |= __GFP_NOFAIL;
++ congestion_wait(BLK_RW_ASYNC, HZ/50);
+ goto retry_encrypt;
+ }
+ data_page = NULL;
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 7a9cc64f5ca3..da348cf4ff56 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1148,9 +1148,11 @@ static int f2fs_statfs_project(struct super_block *sb,
+ return PTR_ERR(dquot);
+ spin_lock(&dquot->dq_dqb_lock);
+
+- limit = (dquot->dq_dqb.dqb_bsoftlimit ?
+- dquot->dq_dqb.dqb_bsoftlimit :
+- dquot->dq_dqb.dqb_bhardlimit) >> sb->s_blocksize_bits;
++ limit = min_not_zero(dquot->dq_dqb.dqb_bsoftlimit,
++ dquot->dq_dqb.dqb_bhardlimit);
++ if (limit)
++ limit >>= sb->s_blocksize_bits;
++
+ if (limit && buf->f_blocks > limit) {
+ curblock = dquot->dq_dqb.dqb_curspace >> sb->s_blocksize_bits;
+ buf->f_blocks = limit;
+@@ -1159,9 +1161,9 @@ static int f2fs_statfs_project(struct super_block *sb,
+ (buf->f_blocks - curblock) : 0;
+ }
+
+- limit = dquot->dq_dqb.dqb_isoftlimit ?
+- dquot->dq_dqb.dqb_isoftlimit :
+- dquot->dq_dqb.dqb_ihardlimit;
++ limit = min_not_zero(dquot->dq_dqb.dqb_isoftlimit,
++ dquot->dq_dqb.dqb_ihardlimit);
++
+ if (limit && buf->f_files > limit) {
+ buf->f_files = limit;
+ buf->f_ffree =
+diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
+index 08369c6cd127..143e7d518c5d 100644
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -780,7 +780,7 @@ static ssize_t gfs2_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ struct file *file = iocb->ki_filp;
+ struct inode *inode = file_inode(file);
+ struct gfs2_inode *ip = GFS2_I(inode);
+- ssize_t written = 0, ret;
++ ssize_t ret;
+
+ ret = gfs2_rsqa_alloc(ip);
+ if (ret)
+@@ -800,68 +800,58 @@ static ssize_t gfs2_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ inode_lock(inode);
+ ret = generic_write_checks(iocb, from);
+ if (ret <= 0)
+- goto out;
+-
+- /* We can write back this queue in page reclaim */
+- current->backing_dev_info = inode_to_bdi(inode);
++ goto out_unlock;
+
+ ret = file_remove_privs(file);
+ if (ret)
+- goto out2;
++ goto out_unlock;
+
+ ret = file_update_time(file);
+ if (ret)
+- goto out2;
++ goto out_unlock;
+
+ if (iocb->ki_flags & IOCB_DIRECT) {
+ struct address_space *mapping = file->f_mapping;
+- loff_t pos, endbyte;
+- ssize_t buffered;
++ ssize_t buffered, ret2;
+
+- written = gfs2_file_direct_write(iocb, from);
+- if (written < 0 || !iov_iter_count(from))
+- goto out2;
++ ret = gfs2_file_direct_write(iocb, from);
++ if (ret < 0 || !iov_iter_count(from))
++ goto out_unlock;
+
+- ret = iomap_file_buffered_write(iocb, from, &gfs2_iomap_ops);
+- if (unlikely(ret < 0))
+- goto out2;
+- buffered = ret;
++ iocb->ki_flags |= IOCB_DSYNC;
++ current->backing_dev_info = inode_to_bdi(inode);
++ buffered = iomap_file_buffered_write(iocb, from, &gfs2_iomap_ops);
++ current->backing_dev_info = NULL;
++ if (unlikely(buffered <= 0))
++ goto out_unlock;
+
+ /*
+ * We need to ensure that the page cache pages are written to
+ * disk and invalidated to preserve the expected O_DIRECT
+- * semantics.
++ * semantics. If the writeback or invalidate fails, only report
++ * the direct I/O range as we don't know if the buffered pages
++ * made it to disk.
+ */
+- pos = iocb->ki_pos;
+- endbyte = pos + buffered - 1;
+- ret = filemap_write_and_wait_range(mapping, pos, endbyte);
+- if (!ret) {
+- iocb->ki_pos += buffered;
+- written += buffered;
+- invalidate_mapping_pages(mapping,
+- pos >> PAGE_SHIFT,
+- endbyte >> PAGE_SHIFT);
+- } else {
+- /*
+- * We don't know how much we wrote, so just return
+- * the number of bytes which were direct-written
+- */
+- }
++ iocb->ki_pos += buffered;
++ ret2 = generic_write_sync(iocb, buffered);
++ invalidate_mapping_pages(mapping,
++ (iocb->ki_pos - buffered) >> PAGE_SHIFT,
++ (iocb->ki_pos - 1) >> PAGE_SHIFT);
++ if (!ret || ret2 > 0)
++ ret += ret2;
+ } else {
++ current->backing_dev_info = inode_to_bdi(inode);
+ ret = iomap_file_buffered_write(iocb, from, &gfs2_iomap_ops);
+- if (likely(ret > 0))
++ current->backing_dev_info = NULL;
++ if (likely(ret > 0)) {
+ iocb->ki_pos += ret;
++ ret = generic_write_sync(iocb, ret);
++ }
+ }
+
+-out2:
+- current->backing_dev_info = NULL;
+-out:
++out_unlock:
+ inode_unlock(inode);
+- if (likely(ret > 0)) {
+- /* Handle various SYNC-type writes */
+- ret = generic_write_sync(iocb, ret);
+- }
+- return written ? written : ret;
++ return ret;
+ }
+
+ static int fallocate_chunk(struct inode *inode, loff_t offset, loff_t len,
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index df390a69c49a..1a2339f2cb49 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1002,6 +1002,7 @@ static void *jbd2_seq_info_start(struct seq_file *seq, loff_t *pos)
+
+ static void *jbd2_seq_info_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
++ (*pos)++;
+ return NULL;
+ }
+
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index b8d686087952..4ae726e70d87 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -162,6 +162,17 @@ typedef struct {
+ bool eof;
+ } nfs_readdir_descriptor_t;
+
++static
++void nfs_readdir_init_array(struct page *page)
++{
++ struct nfs_cache_array *array;
++
++ array = kmap_atomic(page);
++ memset(array, 0, sizeof(struct nfs_cache_array));
++ array->eof_index = -1;
++ kunmap_atomic(array);
++}
++
+ /*
+ * we are freeing strings created by nfs_add_to_readdir_array()
+ */
+@@ -174,6 +185,7 @@ void nfs_readdir_clear_array(struct page *page)
+ array = kmap_atomic(page);
+ for (i = 0; i < array->size; i++)
+ kfree(array->array[i].string.name);
++ array->size = 0;
+ kunmap_atomic(array);
+ }
+
+@@ -610,6 +622,8 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page,
+ int status = -ENOMEM;
+ unsigned int array_size = ARRAY_SIZE(pages);
+
++ nfs_readdir_init_array(page);
++
+ entry.prev_cookie = 0;
+ entry.cookie = desc->last_cookie;
+ entry.eof = 0;
+@@ -626,8 +640,6 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page,
+ }
+
+ array = kmap(page);
+- memset(array, 0, sizeof(struct nfs_cache_array));
+- array->eof_index = -1;
+
+ status = nfs_readdir_alloc_pages(pages, array_size);
+ if (status < 0)
+@@ -681,6 +693,7 @@ int nfs_readdir_filler(nfs_readdir_descriptor_t *desc, struct page* page)
+ unlock_page(page);
+ return 0;
+ error:
++ nfs_readdir_clear_array(page);
+ unlock_page(page);
+ return ret;
+ }
+@@ -688,8 +701,6 @@ int nfs_readdir_filler(nfs_readdir_descriptor_t *desc, struct page* page)
+ static
+ void cache_page_release(nfs_readdir_descriptor_t *desc)
+ {
+- if (!desc->page->mapping)
+- nfs_readdir_clear_array(desc->page);
+ put_page(desc->page);
+ desc->page = NULL;
+ }
+@@ -703,19 +714,28 @@ struct page *get_cache_page(nfs_readdir_descriptor_t *desc)
+
+ /*
+ * Returns 0 if desc->dir_cookie was found on page desc->page_index
++ * and locks the page to prevent removal from the page cache.
+ */
+ static
+-int find_cache_page(nfs_readdir_descriptor_t *desc)
++int find_and_lock_cache_page(nfs_readdir_descriptor_t *desc)
+ {
+ int res;
+
+ desc->page = get_cache_page(desc);
+ if (IS_ERR(desc->page))
+ return PTR_ERR(desc->page);
+-
+- res = nfs_readdir_search_array(desc);
++ res = lock_page_killable(desc->page);
+ if (res != 0)
+- cache_page_release(desc);
++ goto error;
++ res = -EAGAIN;
++ if (desc->page->mapping != NULL) {
++ res = nfs_readdir_search_array(desc);
++ if (res == 0)
++ return 0;
++ }
++ unlock_page(desc->page);
++error:
++ cache_page_release(desc);
+ return res;
+ }
+
+@@ -730,7 +750,7 @@ int readdir_search_pagecache(nfs_readdir_descriptor_t *desc)
+ desc->last_cookie = 0;
+ }
+ do {
+- res = find_cache_page(desc);
++ res = find_and_lock_cache_page(desc);
+ } while (res == -EAGAIN);
+ return res;
+ }
+@@ -769,7 +789,6 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc)
+ desc->eof = true;
+
+ kunmap(desc->page);
+- cache_page_release(desc);
+ dfprintk(DIRCACHE, "NFS: nfs_do_filldir() filling ended @ cookie %Lu; returning = %d\n",
+ (unsigned long long)*desc->dir_cookie, res);
+ return res;
+@@ -815,13 +834,13 @@ int uncached_readdir(nfs_readdir_descriptor_t *desc)
+
+ status = nfs_do_filldir(desc);
+
++ out_release:
++ nfs_readdir_clear_array(desc->page);
++ cache_page_release(desc);
+ out:
+ dfprintk(DIRCACHE, "NFS: %s: returns %d\n",
+ __func__, status);
+ return status;
+- out_release:
+- cache_page_release(desc);
+- goto out;
+ }
+
+ /* The file offset position represents the dirent entry number. A
+@@ -886,6 +905,8 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx)
+ break;
+
+ res = nfs_do_filldir(desc);
++ unlock_page(desc->page);
++ cache_page_release(desc);
+ if (res < 0)
+ break;
+ } while (!desc->eof);
+diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
+index 2b36aa037ce0..f4cf1c0793c6 100644
+--- a/fs/nfsd/nfs4layouts.c
++++ b/fs/nfsd/nfs4layouts.c
+@@ -676,7 +676,7 @@ nfsd4_cb_layout_done(struct nfsd4_callback *cb, struct rpc_task *task)
+
+ /* Client gets 2 lease periods to return it */
+ cutoff = ktime_add_ns(task->tk_start,
+- nn->nfsd4_lease * NSEC_PER_SEC * 2);
++ (u64)nn->nfsd4_lease * NSEC_PER_SEC * 2);
+
+ if (ktime_before(now, cutoff)) {
+ rpc_delay(task, HZ/100); /* 10 mili-seconds */
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index c8ce128e0054..ed73e86194fa 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -6075,7 +6075,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ }
+
+ if (fl_flags & FL_SLEEP) {
+- nbl->nbl_time = jiffies;
++ nbl->nbl_time = get_seconds();
+ spin_lock(&nn->blocked_locks_lock);
+ list_add_tail(&nbl->nbl_list, &lock_sop->lo_blocked);
+ list_add_tail(&nbl->nbl_lru, &nn->blocked_locks_lru);
+diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
+index 0f07ad6dc1ef..594fc1a8b672 100644
+--- a/fs/nfsd/state.h
++++ b/fs/nfsd/state.h
+@@ -592,7 +592,7 @@ static inline bool nfsd4_stateid_generation_after(stateid_t *a, stateid_t *b)
+ struct nfsd4_blocked_lock {
+ struct list_head nbl_list;
+ struct list_head nbl_lru;
+- unsigned long nbl_time;
++ time_t nbl_time;
+ struct file_lock nbl_lock;
+ struct knfsd_fh nbl_fh;
+ struct nfsd4_callback nbl_cb;
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 4fe8db314950..80cededcd10d 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1016,6 +1016,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
+ host_err = vfs_iter_write(file, &iter, &pos, flags);
+ if (host_err < 0)
+ goto out_nfserr;
++ *cnt = host_err;
+ nfsdstats.io_write += *cnt;
+ fsnotify_modify(file);
+
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index a3e077fcfeb9..fbd70111a2f1 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2109,17 +2109,15 @@ static int ocfs2_is_io_unaligned(struct inode *inode, size_t count, loff_t pos)
+ static int ocfs2_inode_lock_for_extent_tree(struct inode *inode,
+ struct buffer_head **di_bh,
+ int meta_level,
+- int overwrite_io,
+ int write_sem,
+ int wait)
+ {
+ int ret = 0;
+
+ if (wait)
+- ret = ocfs2_inode_lock(inode, NULL, meta_level);
++ ret = ocfs2_inode_lock(inode, di_bh, meta_level);
+ else
+- ret = ocfs2_try_inode_lock(inode,
+- overwrite_io ? NULL : di_bh, meta_level);
++ ret = ocfs2_try_inode_lock(inode, di_bh, meta_level);
+ if (ret < 0)
+ goto out;
+
+@@ -2144,6 +2142,7 @@ static int ocfs2_inode_lock_for_extent_tree(struct inode *inode,
+
+ out_unlock:
+ brelse(*di_bh);
++ *di_bh = NULL;
+ ocfs2_inode_unlock(inode, meta_level);
+ out:
+ return ret;
+@@ -2186,7 +2185,6 @@ static int ocfs2_prepare_inode_for_write(struct file *file,
+ ret = ocfs2_inode_lock_for_extent_tree(inode,
+ &di_bh,
+ meta_level,
+- overwrite_io,
+ write_sem,
+ wait);
+ if (ret < 0) {
+@@ -2244,13 +2242,13 @@ static int ocfs2_prepare_inode_for_write(struct file *file,
+ &di_bh,
+ meta_level,
+ write_sem);
++ meta_level = 1;
++ write_sem = 1;
+ ret = ocfs2_inode_lock_for_extent_tree(inode,
+ &di_bh,
+ meta_level,
+- overwrite_io,
+- 1,
++ write_sem,
+ wait);
+- write_sem = 1;
+ if (ret < 0) {
+ if (ret != -EAGAIN)
+ mlog_errno(ret);
+diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
+index 0bd276e4ccbe..fa5ac5de807c 100644
+--- a/fs/overlayfs/file.c
++++ b/fs/overlayfs/file.c
+@@ -149,7 +149,7 @@ static loff_t ovl_llseek(struct file *file, loff_t offset, int whence)
+ struct inode *inode = file_inode(file);
+ struct fd real;
+ const struct cred *old_cred;
+- ssize_t ret;
++ loff_t ret;
+
+ /*
+ * The two special cases below do not need to involve real fs,
+diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
+index cc8303a806b4..11b7941c5dbc 100644
+--- a/fs/overlayfs/readdir.c
++++ b/fs/overlayfs/readdir.c
+@@ -507,7 +507,13 @@ get:
+ if (err)
+ goto fail;
+
+- WARN_ON_ONCE(dir->d_sb->s_dev != stat.dev);
++ /*
++ * Directory inode is always on overlay st_dev.
++ * Non-dir with ovl_same_dev() could be on pseudo st_dev in case
++ * of xino bits overflow.
++ */
++ WARN_ON_ONCE(S_ISDIR(stat.mode) &&
++ dir->d_sb->s_dev != stat.dev);
+ ino = stat.ino;
+ } else if (xinobits && !OVL_TYPE_UPPER(type)) {
+ ino = ovl_remap_lower_ino(ino, xinobits,
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index 5767b373a8ff..d7c0aa0626cd 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -242,6 +242,8 @@ static struct dentry *ubifs_lookup(struct inode *dir, struct dentry *dentry,
+ if (nm.hash) {
+ ubifs_assert(c, fname_len(&nm) == 0);
+ ubifs_assert(c, fname_name(&nm) == NULL);
++ if (nm.hash & ~UBIFS_S_KEY_HASH_MASK)
++ goto done; /* ENOENT */
+ dent_key_init_hash(c, &key, dir->i_ino, nm.hash);
+ err = ubifs_tnc_lookup_dh(c, &key, dent, nm.minor_hash);
+ } else {
+diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
+index 1b78f2e09218..65b4f63349c7 100644
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -798,7 +798,9 @@ static int ubifs_do_bulk_read(struct ubifs_info *c, struct bu_info *bu,
+
+ if (page_offset > end_index)
+ break;
+- page = find_or_create_page(mapping, page_offset, ra_gfp_mask);
++ page = pagecache_get_page(mapping, page_offset,
++ FGP_LOCK|FGP_ACCESSED|FGP_CREAT|FGP_NOWAIT,
++ ra_gfp_mask);
+ if (!page)
+ break;
+ if (!PageUptodate(page))
+diff --git a/fs/ubifs/ioctl.c b/fs/ubifs/ioctl.c
+index 0164bcc827f8..e666459f63c7 100644
+--- a/fs/ubifs/ioctl.c
++++ b/fs/ubifs/ioctl.c
+@@ -28,6 +28,11 @@
+ #include <linux/mount.h>
+ #include "ubifs.h"
+
++/* Need to be kept consistent with checked flags in ioctl2ubifs() */
++#define UBIFS_SUPPORTED_IOCTL_FLAGS \
++ (FS_COMPR_FL | FS_SYNC_FL | FS_APPEND_FL | \
++ FS_IMMUTABLE_FL | FS_DIRSYNC_FL)
++
+ /**
+ * ubifs_set_inode_flags - set VFS inode flags.
+ * @inode: VFS inode to set flags for
+@@ -127,7 +132,8 @@ static int setflags(struct inode *inode, int flags)
+ }
+ }
+
+- ui->flags = ioctl2ubifs(flags);
++ ui->flags &= ~ioctl2ubifs(UBIFS_SUPPORTED_IOCTL_FLAGS);
++ ui->flags |= ioctl2ubifs(flags);
+ ubifs_set_inode_flags(inode);
+ inode->i_ctime = current_time(inode);
+ release = ui->dirty;
+@@ -169,6 +175,9 @@ long ubifs_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ if (get_user(flags, (int __user *) arg))
+ return -EFAULT;
+
++ if (flags & ~UBIFS_SUPPORTED_IOCTL_FLAGS)
++ return -EOPNOTSUPP;
++
+ if (!S_ISDIR(inode->i_mode))
+ flags &= ~FS_DIRSYNC_FL;
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 7af011dc9ae8..6fd0f14e9dd2 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -999,7 +999,6 @@ static int check_partition_desc(struct super_block *sb,
+ switch (le32_to_cpu(p->accessType)) {
+ case PD_ACCESS_TYPE_READ_ONLY:
+ case PD_ACCESS_TYPE_WRITE_ONCE:
+- case PD_ACCESS_TYPE_REWRITABLE:
+ case PD_ACCESS_TYPE_NONE:
+ goto force_ro;
+ }
+diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
+index ffcc7724ca21..dc4fd8a6644d 100644
+--- a/include/linux/eventfd.h
++++ b/include/linux/eventfd.h
+@@ -12,6 +12,8 @@
+ #include <linux/fcntl.h>
+ #include <linux/wait.h>
+ #include <linux/err.h>
++#include <linux/percpu-defs.h>
++#include <linux/percpu.h>
+
+ /*
+ * CAREFUL: Check include/uapi/asm-generic/fcntl.h when defining
+@@ -40,6 +42,13 @@ __u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n);
+ int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_entry_t *wait,
+ __u64 *cnt);
+
++DECLARE_PER_CPU(int, eventfd_wake_count);
++
++static inline bool eventfd_signal_count(void)
++{
++ return this_cpu_read(eventfd_wake_count);
++}
++
+ #else /* CONFIG_EVENTFD */
+
+ /*
+@@ -68,6 +77,11 @@ static inline int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx,
+ return -ENOSYS;
+ }
+
++static inline bool eventfd_signal_count(void)
++{
++ return false;
++}
++
+ #endif
+
+ #endif /* _LINUX_EVENTFD_H */
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index c9bffda04a45..6ecaf056ab63 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -208,6 +208,8 @@ struct irq_data {
+ * IRQD_SINGLE_TARGET - IRQ allows only a single affinity target
+ * IRQD_DEFAULT_TRIGGER_SET - Expected trigger already been set
+ * IRQD_CAN_RESERVE - Can use reservation mode
++ * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change
++ * required
+ */
+ enum {
+ IRQD_TRIGGER_MASK = 0xf,
+@@ -230,6 +232,7 @@ enum {
+ IRQD_SINGLE_TARGET = (1 << 24),
+ IRQD_DEFAULT_TRIGGER_SET = (1 << 25),
+ IRQD_CAN_RESERVE = (1 << 26),
++ IRQD_MSI_NOMASK_QUIRK = (1 << 27),
+ };
+
+ #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors)
+@@ -389,6 +392,21 @@ static inline bool irqd_can_reserve(struct irq_data *d)
+ return __irqd_to_state(d) & IRQD_CAN_RESERVE;
+ }
+
++static inline void irqd_set_msi_nomask_quirk(struct irq_data *d)
++{
++ __irqd_to_state(d) |= IRQD_MSI_NOMASK_QUIRK;
++}
++
++static inline void irqd_clr_msi_nomask_quirk(struct irq_data *d)
++{
++ __irqd_to_state(d) &= ~IRQD_MSI_NOMASK_QUIRK;
++}
++
++static inline bool irqd_msi_nomask_quirk(struct irq_data *d)
++{
++ return __irqd_to_state(d) & IRQD_MSI_NOMASK_QUIRK;
++}
++
+ #undef __irqd_to_state
+
+ static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
+diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
+index dccfa65aee96..8301f1df0682 100644
+--- a/include/linux/irqdomain.h
++++ b/include/linux/irqdomain.h
+@@ -202,6 +202,13 @@ enum {
+ /* Irq domain implements MSI remapping */
+ IRQ_DOMAIN_FLAG_MSI_REMAP = (1 << 5),
+
++ /*
++ * Quirk to handle MSI implementations which do not provide
++ * masking. Currently known to affect x86, but partially
++ * handled in core code.
++ */
++ IRQ_DOMAIN_MSI_NOMASK_QUIRK = (1 << 6),
++
+ /*
+ * Flags starting from IRQ_DOMAIN_FLAG_NONCORE are reserved
+ * for implementation specific purposes and ignored by the
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 748016ae01e3..0f99ecc01bc7 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -186,7 +186,7 @@ struct kvm_async_pf {
+ struct list_head queue;
+ struct kvm_vcpu *vcpu;
+ struct mm_struct *mm;
+- gva_t gva;
++ gpa_t cr2_or_gpa;
+ unsigned long addr;
+ struct kvm_arch_async_pf arch;
+ bool wakeup_all;
+@@ -194,8 +194,8 @@ struct kvm_async_pf {
+
+ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu);
+ void kvm_check_async_pf_completion(struct kvm_vcpu *vcpu);
+-int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
+- struct kvm_arch_async_pf *arch);
++int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
++ unsigned long hva, struct kvm_arch_async_pf *arch);
+ int kvm_async_pf_wakeup_all(struct kvm_vcpu *vcpu);
+ #endif
+
+@@ -704,7 +704,7 @@ int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len);
+ int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len);
+ struct kvm_memory_slot *gfn_to_memslot(struct kvm *kvm, gfn_t gfn);
+ bool kvm_is_visible_gfn(struct kvm *kvm, gfn_t gfn);
+-unsigned long kvm_host_page_size(struct kvm *kvm, gfn_t gfn);
++unsigned long kvm_host_page_size(struct kvm_vcpu *vcpu, gfn_t gfn);
+ void mark_page_dirty(struct kvm *kvm, gfn_t gfn);
+
+ struct kvm_memslots *kvm_vcpu_memslots(struct kvm_vcpu *vcpu);
+diff --git a/include/linux/memblock.h b/include/linux/memblock.h
+index 516920549378..2acdd046df2d 100644
+--- a/include/linux/memblock.h
++++ b/include/linux/memblock.h
+@@ -265,21 +265,6 @@ void __next_mem_pfn_range(int *idx, int nid, unsigned long *out_start_pfn,
+ for_each_mem_range_rev(i, &memblock.memory, &memblock.reserved, \
+ nid, flags, p_start, p_end, p_nid)
+
+-/**
+- * for_each_resv_unavail_range - iterate through reserved and unavailable memory
+- * @i: u64 used as loop variable
+- * @p_start: ptr to phys_addr_t for start address of the range, can be %NULL
+- * @p_end: ptr to phys_addr_t for end address of the range, can be %NULL
+- *
+- * Walks over unavailable but reserved (reserved && !memory) areas of memblock.
+- * Available as soon as memblock is initialized.
+- * Note: because this memory does not belong to any physical node, flags and
+- * nid arguments do not make sense and thus not exported as arguments.
+- */
+-#define for_each_resv_unavail_range(i, p_start, p_end) \
+- for_each_mem_range(i, &memblock.reserved, &memblock.memory, \
+- NUMA_NO_NODE, MEMBLOCK_NONE, p_start, p_end, NULL)
+-
+ static inline void memblock_set_region_flags(struct memblock_region *r,
+ enum memblock_flags flags)
+ {
+diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h
+index 2d2096ba1cfe..90b8ce813fa6 100644
+--- a/include/linux/percpu-defs.h
++++ b/include/linux/percpu-defs.h
+@@ -176,8 +176,7 @@
+ * Declaration/definition used for per-CPU variables that should be accessed
+ * as decrypted when memory encryption is enabled in the guest.
+ */
+-#if defined(CONFIG_VIRTUALIZATION) && defined(CONFIG_AMD_MEM_ENCRYPT)
+-
++#ifdef CONFIG_AMD_MEM_ENCRYPT
+ #define DECLARE_PER_CPU_DECRYPTED(type, name) \
+ DECLARE_PER_CPU_SECTION(type, name, "..decrypted")
+
+diff --git a/include/media/v4l2-rect.h b/include/media/v4l2-rect.h
+index 595c3ba05f23..59745e5feb4d 100644
+--- a/include/media/v4l2-rect.h
++++ b/include/media/v4l2-rect.h
+@@ -63,10 +63,10 @@ static inline void v4l2_rect_map_inside(struct v4l2_rect *r,
+ r->left = boundary->left;
+ if (r->top < boundary->top)
+ r->top = boundary->top;
+- if (r->left + r->width > boundary->width)
+- r->left = boundary->width - r->width;
+- if (r->top + r->height > boundary->height)
+- r->top = boundary->height - r->height;
++ if (r->left + r->width > boundary->left + boundary->width)
++ r->left = boundary->left + boundary->width - r->width;
++ if (r->top + r->height > boundary->top + boundary->height)
++ r->top = boundary->top + boundary->height - r->height;
+ }
+
+ /**
+diff --git a/include/net/ipx.h b/include/net/ipx.h
+index baf090390998..9d1342807b59 100644
+--- a/include/net/ipx.h
++++ b/include/net/ipx.h
+@@ -47,11 +47,6 @@ struct ipxhdr {
+ /* From af_ipx.c */
+ extern int sysctl_ipx_pprop_broadcasting;
+
+-static __inline__ struct ipxhdr *ipx_hdr(struct sk_buff *skb)
+-{
+- return (struct ipxhdr *)skb_transport_header(skb);
+-}
+-
+ struct ipx_interface {
+ /* IPX address */
+ __be32 if_netnum;
+diff --git a/ipc/msg.c b/ipc/msg.c
+index 883642cf2b27..ac4de3f67261 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -377,7 +377,7 @@ copy_msqid_from_user(struct msqid64_ds *out, void __user *buf, int version)
+ * NOTE: no locks must be held, the rwsem is taken inside this function.
+ */
+ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
+- struct msqid64_ds *msqid64)
++ struct ipc64_perm *perm, int msg_qbytes)
+ {
+ struct kern_ipc_perm *ipcp;
+ struct msg_queue *msq;
+@@ -387,7 +387,7 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
+ rcu_read_lock();
+
+ ipcp = ipcctl_obtain_check(ns, &msg_ids(ns), msqid, cmd,
+- &msqid64->msg_perm, msqid64->msg_qbytes);
++ perm, msg_qbytes);
+ if (IS_ERR(ipcp)) {
+ err = PTR_ERR(ipcp);
+ goto out_unlock1;
+@@ -409,18 +409,18 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
+ {
+ DEFINE_WAKE_Q(wake_q);
+
+- if (msqid64->msg_qbytes > ns->msg_ctlmnb &&
++ if (msg_qbytes > ns->msg_ctlmnb &&
+ !capable(CAP_SYS_RESOURCE)) {
+ err = -EPERM;
+ goto out_unlock1;
+ }
+
+ ipc_lock_object(&msq->q_perm);
+- err = ipc_update_perm(&msqid64->msg_perm, ipcp);
++ err = ipc_update_perm(perm, ipcp);
+ if (err)
+ goto out_unlock0;
+
+- msq->q_qbytes = msqid64->msg_qbytes;
++ msq->q_qbytes = msg_qbytes;
+
+ msq->q_ctime = ktime_get_real_seconds();
+ /*
+@@ -603,9 +603,10 @@ long ksys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
+ case IPC_SET:
+ if (copy_msqid_from_user(&msqid64, buf, version))
+ return -EFAULT;
+- /* fallthru */
++ return msgctl_down(ns, msqid, cmd, &msqid64.msg_perm,
++ msqid64.msg_qbytes);
+ case IPC_RMID:
+- return msgctl_down(ns, msqid, cmd, &msqid64);
++ return msgctl_down(ns, msqid, cmd, NULL, 0);
+ default:
+ return -EINVAL;
+ }
+@@ -724,9 +725,9 @@ long compat_ksys_msgctl(int msqid, int cmd, void __user *uptr)
+ case IPC_SET:
+ if (copy_compat_msqid_from_user(&msqid64, uptr, version))
+ return -EFAULT;
+- /* fallthru */
++ return msgctl_down(ns, msqid, cmd, &msqid64.msg_perm, msqid64.msg_qbytes);
+ case IPC_RMID:
+- return msgctl_down(ns, msqid, cmd, &msqid64);
++ return msgctl_down(ns, msqid, cmd, NULL, 0);
+ default:
+ return -EINVAL;
+ }
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 16af86ab24c4..8c70ee23fbe9 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5709,7 +5709,15 @@ accounting:
+ */
+ user_lock_limit *= num_online_cpus();
+
+- user_locked = atomic_long_read(&user->locked_vm) + user_extra;
++ user_locked = atomic_long_read(&user->locked_vm);
++
++ /*
++ * sysctl_perf_event_mlock may have changed, so that
++ * user->locked_vm > user_lock_limit
++ */
++ if (user_locked > user_lock_limit)
++ user_locked = user_lock_limit;
++ user_locked += user_extra;
+
+ if (user_locked > user_lock_limit)
+ extra = user_locked - user_lock_limit;
+diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c
+index 6f636136cccc..b3f55dd581b0 100644
+--- a/kernel/irq/debugfs.c
++++ b/kernel/irq/debugfs.c
+@@ -113,6 +113,7 @@ static const struct irq_bit_descr irqdata_states[] = {
+ BIT_MASK_DESCR(IRQD_AFFINITY_MANAGED),
+ BIT_MASK_DESCR(IRQD_MANAGED_SHUTDOWN),
+ BIT_MASK_DESCR(IRQD_CAN_RESERVE),
++ BIT_MASK_DESCR(IRQD_MSI_NOMASK_QUIRK),
+
+ BIT_MASK_DESCR(IRQD_FORWARDED_TO_VCPU),
+
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index 6e8520a81dd8..e0eda2bd3975 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -1421,6 +1421,7 @@ int irq_domain_push_irq(struct irq_domain *domain, int virq, void *arg)
+ if (rv) {
+ /* Restore the original irq_data. */
+ *root_irq_data = *child_irq_data;
++ kfree(child_irq_data);
+ goto error;
+ }
+
+diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
+index 4ca2fd46645d..dc1186ce3ecd 100644
+--- a/kernel/irq/msi.c
++++ b/kernel/irq/msi.c
+@@ -453,8 +453,11 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
+ continue;
+
+ irq_data = irq_domain_get_irq_data(domain, desc->irq);
+- if (!can_reserve)
++ if (!can_reserve) {
+ irqd_clr_can_reserve(irq_data);
++ if (domain->flags & IRQ_DOMAIN_MSI_NOMASK_QUIRK)
++ irqd_set_msi_nomask_quirk(irq_data);
++ }
+ ret = irq_domain_activate_irq(irq_data, can_reserve);
+ if (ret)
+ goto cleanup;
+diff --git a/kernel/module.c b/kernel/module.c
+index d3aaec62c142..70a75a7216ab 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1729,6 +1729,8 @@ static int module_add_modinfo_attrs(struct module *mod)
+ error_out:
+ if (i > 0)
+ module_remove_modinfo_attrs(mod, --i);
++ else
++ kfree(mod->modinfo_attrs);
+ return error;
+ }
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 6c06b3039fae..11c5f9c8779e 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -35,6 +35,8 @@
+
+ #define MAX_OBJ_NUM 1000
+
++static void padata_free_pd(struct parallel_data *pd);
++
+ static int padata_index_to_cpu(struct parallel_data *pd, int cpu_index)
+ {
+ int cpu, target_cpu;
+@@ -334,6 +336,7 @@ static void padata_serial_worker(struct work_struct *serial_work)
+ struct padata_serial_queue *squeue;
+ struct parallel_data *pd;
+ LIST_HEAD(local_list);
++ int cnt;
+
+ local_bh_disable();
+ squeue = container_of(serial_work, struct padata_serial_queue, work);
+@@ -343,6 +346,8 @@ static void padata_serial_worker(struct work_struct *serial_work)
+ list_replace_init(&squeue->serial.list, &local_list);
+ spin_unlock(&squeue->serial.lock);
+
++ cnt = 0;
++
+ while (!list_empty(&local_list)) {
+ struct padata_priv *padata;
+
+@@ -352,9 +357,12 @@ static void padata_serial_worker(struct work_struct *serial_work)
+ list_del_init(&padata->list);
+
+ padata->serial(padata);
+- atomic_dec(&pd->refcnt);
++ cnt++;
+ }
+ local_bh_enable();
++
++ if (atomic_sub_and_test(cnt, &pd->refcnt))
++ padata_free_pd(pd);
+ }
+
+ /**
+@@ -501,8 +509,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,
+ timer_setup(&pd->timer, padata_reorder_timer, 0);
+ atomic_set(&pd->seq_nr, -1);
+ atomic_set(&pd->reorder_objects, 0);
+- atomic_set(&pd->refcnt, 0);
+- pd->pinst = pinst;
++ atomic_set(&pd->refcnt, 1);
+ spin_lock_init(&pd->lock);
+
+ return pd;
+@@ -526,31 +533,6 @@ static void padata_free_pd(struct parallel_data *pd)
+ kfree(pd);
+ }
+
+-/* Flush all objects out of the padata queues. */
+-static void padata_flush_queues(struct parallel_data *pd)
+-{
+- int cpu;
+- struct padata_parallel_queue *pqueue;
+- struct padata_serial_queue *squeue;
+-
+- for_each_cpu(cpu, pd->cpumask.pcpu) {
+- pqueue = per_cpu_ptr(pd->pqueue, cpu);
+- flush_work(&pqueue->work);
+- }
+-
+- del_timer_sync(&pd->timer);
+-
+- if (atomic_read(&pd->reorder_objects))
+- padata_reorder(pd);
+-
+- for_each_cpu(cpu, pd->cpumask.cbcpu) {
+- squeue = per_cpu_ptr(pd->squeue, cpu);
+- flush_work(&squeue->work);
+- }
+-
+- BUG_ON(atomic_read(&pd->refcnt) != 0);
+-}
+-
+ static void __padata_start(struct padata_instance *pinst)
+ {
+ pinst->flags |= PADATA_INIT;
+@@ -564,10 +546,6 @@ static void __padata_stop(struct padata_instance *pinst)
+ pinst->flags &= ~PADATA_INIT;
+
+ synchronize_rcu();
+-
+- get_online_cpus();
+- padata_flush_queues(pinst->pd);
+- put_online_cpus();
+ }
+
+ /* Replace the internal control structure with a new one. */
+@@ -588,8 +566,8 @@ static void padata_replace(struct padata_instance *pinst,
+ if (!cpumask_equal(pd_old->cpumask.cbcpu, pd_new->cpumask.cbcpu))
+ notification_mask |= PADATA_CPU_SERIAL;
+
+- padata_flush_queues(pd_old);
+- padata_free_pd(pd_old);
++ if (atomic_dec_and_test(&pd_old->refcnt))
++ padata_free_pd(pd_old);
+
+ if (notification_mask)
+ blocking_notifier_call_chain(&pinst->cpumask_change_notifier,
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 845efadaf7ec..7a2fdc097c8c 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2717,8 +2717,6 @@ void register_console(struct console *newcon)
+ * for us.
+ */
+ logbuf_lock_irqsave(flags);
+- console_seq = syslog_seq;
+- console_idx = syslog_idx;
+ /*
+ * We're about to replay the log buffer. Only do this to the
+ * just-registered console to avoid excessive message spam to
+@@ -2730,6 +2728,8 @@ void register_console(struct console *newcon)
+ */
+ exclusive_console = newcon;
+ exclusive_console_stop_seq = console_seq;
++ console_seq = syslog_seq;
++ console_idx = syslog_idx;
+ logbuf_unlock_irqrestore(flags);
+ }
+ console_unlock();
+diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
+index a97c20ea9bce..5f6de49dc78e 100644
+--- a/kernel/rcu/tree_plugin.h
++++ b/kernel/rcu/tree_plugin.h
+@@ -267,7 +267,7 @@ static void rcu_preempt_ctxt_queue(struct rcu_node *rnp, struct rcu_data *rdp)
+ * blocked tasks.
+ */
+ if (!rnp->gp_tasks && (blkd_state & RCU_GP_BLKD)) {
+- rnp->gp_tasks = &t->rcu_node_entry;
++ WRITE_ONCE(rnp->gp_tasks, &t->rcu_node_entry);
+ WARN_ON_ONCE(rnp->completedqs == rnp->gp_seq);
+ }
+ if (!rnp->exp_tasks && (blkd_state & RCU_EXP_BLKD))
+@@ -392,7 +392,7 @@ static void rcu_preempt_note_context_switch(bool preempt)
+ */
+ static int rcu_preempt_blocked_readers_cgp(struct rcu_node *rnp)
+ {
+- return rnp->gp_tasks != NULL;
++ return READ_ONCE(rnp->gp_tasks) != NULL;
+ }
+
+ /*
+@@ -557,7 +557,7 @@ static void rcu_read_unlock_special(struct task_struct *t)
+ trace_rcu_unlock_preempted_task(TPS("rcu_preempt"),
+ rnp->gp_seq, t->pid);
+ if (&t->rcu_node_entry == rnp->gp_tasks)
+- rnp->gp_tasks = np;
++ WRITE_ONCE(rnp->gp_tasks, np);
+ if (&t->rcu_node_entry == rnp->exp_tasks)
+ rnp->exp_tasks = np;
+ if (IS_ENABLED(CONFIG_RCU_BOOST)) {
+@@ -716,7 +716,7 @@ rcu_preempt_check_blocked_tasks(struct rcu_state *rsp, struct rcu_node *rnp)
+ dump_blkd_tasks(rsp, rnp, 10);
+ if (rcu_preempt_has_tasks(rnp) &&
+ (rnp->qsmaskinit || rnp->wait_blkd_tasks)) {
+- rnp->gp_tasks = rnp->blkd_tasks.next;
++ WRITE_ONCE(rnp->gp_tasks, rnp->blkd_tasks.next);
+ t = container_of(rnp->gp_tasks, struct task_struct,
+ rcu_node_entry);
+ trace_rcu_unlock_preempted_task(TPS("rcu_preempt-GPS"),
+@@ -883,7 +883,8 @@ dump_blkd_tasks(struct rcu_state *rsp, struct rcu_node *rnp, int ncheck)
+ pr_info("%s: %d:%d ->qsmask %#lx ->qsmaskinit %#lx ->qsmaskinitnext %#lx\n",
+ __func__, rnp1->grplo, rnp1->grphi, rnp1->qsmask, rnp1->qsmaskinit, rnp1->qsmaskinitnext);
+ pr_info("%s: ->gp_tasks %p ->boost_tasks %p ->exp_tasks %p\n",
+- __func__, rnp->gp_tasks, rnp->boost_tasks, rnp->exp_tasks);
++ __func__, READ_ONCE(rnp->gp_tasks), rnp->boost_tasks,
++ rnp->exp_tasks);
+ pr_info("%s: ->blkd_tasks", __func__);
+ i = 0;
+ list_for_each(lhp, &rnp->blkd_tasks) {
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index f4255a65c44b..9eece67f29f3 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -91,6 +91,7 @@ static int alarmtimer_rtc_add_device(struct device *dev,
+ unsigned long flags;
+ struct rtc_device *rtc = to_rtc_device(dev);
+ struct wakeup_source *__ws;
++ int ret = 0;
+
+ if (rtcdev)
+ return -EBUSY;
+@@ -105,8 +106,8 @@ static int alarmtimer_rtc_add_device(struct device *dev,
+ spin_lock_irqsave(&rtcdev_lock, flags);
+ if (!rtcdev) {
+ if (!try_module_get(rtc->owner)) {
+- spin_unlock_irqrestore(&rtcdev_lock, flags);
+- return -1;
++ ret = -1;
++ goto unlock;
+ }
+
+ rtcdev = rtc;
+@@ -115,11 +116,12 @@ static int alarmtimer_rtc_add_device(struct device *dev,
+ ws = __ws;
+ __ws = NULL;
+ }
++unlock:
+ spin_unlock_irqrestore(&rtcdev_lock, flags);
+
+ wakeup_source_unregister(__ws);
+
+- return 0;
++ return ret;
+ }
+
+ static inline void alarmtimer_rtc_timer_init(void)
+diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
+index 0e6e97a01942..f80bb104c41a 100644
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -311,8 +311,15 @@ static void clocksource_watchdog(struct timer_list *unused)
+ next_cpu = cpumask_next(raw_smp_processor_id(), cpu_online_mask);
+ if (next_cpu >= nr_cpu_ids)
+ next_cpu = cpumask_first(cpu_online_mask);
+- watchdog_timer.expires += WATCHDOG_INTERVAL;
+- add_timer_on(&watchdog_timer, next_cpu);
++
++ /*
++ * Arm timer if not already pending: could race with concurrent
++ * pair clocksource_stop_watchdog() clocksource_start_watchdog().
++ */
++ if (!timer_pending(&watchdog_timer)) {
++ watchdog_timer.expires += WATCHDOG_INTERVAL;
++ add_timer_on(&watchdog_timer, next_cpu);
++ }
+ out:
+ spin_unlock(&watchdog_lock);
+ }
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 37a435bac161..53795237e975 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -5072,8 +5072,8 @@ static const struct file_operations ftrace_notrace_fops = {
+
+ static DEFINE_MUTEX(graph_lock);
+
+-struct ftrace_hash *ftrace_graph_hash = EMPTY_HASH;
+-struct ftrace_hash *ftrace_graph_notrace_hash = EMPTY_HASH;
++struct ftrace_hash __rcu *ftrace_graph_hash = EMPTY_HASH;
++struct ftrace_hash __rcu *ftrace_graph_notrace_hash = EMPTY_HASH;
+
+ enum graph_filter_type {
+ GRAPH_FILTER_NOTRACE = 0,
+@@ -5344,8 +5344,15 @@ ftrace_graph_release(struct inode *inode, struct file *file)
+
+ mutex_unlock(&graph_lock);
+
+- /* Wait till all users are no longer using the old hash */
+- synchronize_sched();
++ /*
++ * We need to do a hard force of sched synchronization.
++ * This is because we use preempt_disable() to do RCU, but
++ * the function tracers can be called where RCU is not watching
++ * (like before user_exit()). We can not rely on the RCU
++ * infrastructure to do the synchronization, thus we must do it
++ * ourselves.
++ */
++ schedule_on_each_cpu(ftrace_sync);
+
+ free_ftrace_hash(old_hash);
+ }
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index d11d7bfc3fa5..ee0c6a313ed1 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -872,22 +872,31 @@ extern void __trace_graph_return(struct trace_array *tr,
+ unsigned long flags, int pc);
+
+ #ifdef CONFIG_DYNAMIC_FTRACE
+-extern struct ftrace_hash *ftrace_graph_hash;
+-extern struct ftrace_hash *ftrace_graph_notrace_hash;
++extern struct ftrace_hash __rcu *ftrace_graph_hash;
++extern struct ftrace_hash __rcu *ftrace_graph_notrace_hash;
+
+ static inline int ftrace_graph_addr(struct ftrace_graph_ent *trace)
+ {
+ unsigned long addr = trace->func;
+ int ret = 0;
++ struct ftrace_hash *hash;
+
+ preempt_disable_notrace();
+
+- if (ftrace_hash_empty(ftrace_graph_hash)) {
++ /*
++ * Have to open code "rcu_dereference_sched()" because the
++ * function graph tracer can be called when RCU is not
++ * "watching".
++ * Protected with schedule_on_each_cpu(ftrace_sync)
++ */
++ hash = rcu_dereference_protected(ftrace_graph_hash, !preemptible());
++
++ if (ftrace_hash_empty(hash)) {
+ ret = 1;
+ goto out;
+ }
+
+- if (ftrace_lookup_ip(ftrace_graph_hash, addr)) {
++ if (ftrace_lookup_ip(hash, addr)) {
+
+ /*
+ * This needs to be cleared on the return functions
+@@ -923,10 +932,20 @@ static inline void ftrace_graph_addr_finish(struct ftrace_graph_ret *trace)
+ static inline int ftrace_graph_notrace_addr(unsigned long addr)
+ {
+ int ret = 0;
++ struct ftrace_hash *notrace_hash;
+
+ preempt_disable_notrace();
+
+- if (ftrace_lookup_ip(ftrace_graph_notrace_hash, addr))
++ /*
++ * Have to open code "rcu_dereference_sched()" because the
++ * function graph tracer can be called when RCU is not
++ * "watching".
++ * Protected with schedule_on_each_cpu(ftrace_sync)
++ */
++ notrace_hash = rcu_dereference_protected(ftrace_graph_notrace_hash,
++ !preemptible());
++
++ if (ftrace_lookup_ip(notrace_hash, addr))
+ ret = 1;
+
+ preempt_enable_notrace();
+diff --git a/kernel/trace/trace_sched_switch.c b/kernel/trace/trace_sched_switch.c
+index e288168661e1..e304196d7c28 100644
+--- a/kernel/trace/trace_sched_switch.c
++++ b/kernel/trace/trace_sched_switch.c
+@@ -89,8 +89,10 @@ static void tracing_sched_unregister(void)
+
+ static void tracing_start_sched_switch(int ops)
+ {
+- bool sched_register = (!sched_cmdline_ref && !sched_tgid_ref);
++ bool sched_register;
++
+ mutex_lock(&sched_register_mutex);
++ sched_register = (!sched_cmdline_ref && !sched_tgid_ref);
+
+ switch (ops) {
+ case RECORD_CMDLINE:
+diff --git a/lib/test_kasan.c b/lib/test_kasan.c
+index ec657105edbf..bd0e067c4895 100644
+--- a/lib/test_kasan.c
++++ b/lib/test_kasan.c
+@@ -157,6 +157,7 @@ static noinline void __init kmalloc_oob_krealloc_more(void)
+ if (!ptr1 || !ptr2) {
+ pr_err("Allocation failed\n");
+ kfree(ptr1);
++ kfree(ptr2);
+ return;
+ }
+
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index abc10dcbc9d5..aae7ff485671 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -1902,8 +1902,6 @@ void __ref __remove_memory(int nid, u64 start, u64 size)
+
+ BUG_ON(check_hotplug_memory_range(start, size));
+
+- mem_hotplug_begin();
+-
+ /*
+ * All memory blocks must be offlined before removing memory. Check
+ * whether all memory blocks in question are offline and trigger a BUG()
+@@ -1919,9 +1917,14 @@ void __ref __remove_memory(int nid, u64 start, u64 size)
+ memblock_free(start, size);
+ memblock_remove(start, size);
+
+- /* remove memory block devices before removing memory */
++ /*
++ * Memory block device removal under the device_hotplug_lock is
++ * a barrier against racing online attempts.
++ */
+ remove_memory_block_devices(start, size);
+
++ mem_hotplug_begin();
++
+ arch_remove_memory(nid, start, size, NULL);
+ __release_memory_resource(start, size);
+
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 70f8ad4ade3f..a69b842f95da 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -1623,8 +1623,19 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
+ start = i;
+ } else if (node != current_node) {
+ err = do_move_pages_to_node(mm, &pagelist, current_node);
+- if (err)
++ if (err) {
++ /*
++ * Positive err means the number of failed
++ * pages to migrate. Since we are going to
++ * abort and return the number of non-migrated
++ * pages, so need to incude the rest of the
++ * nr_pages that have not been attempted as
++ * well.
++ */
++ if (err > 0)
++ err += nr_pages - i - 1;
+ goto out;
++ }
+ err = store_status(status, start, current_node, i - start);
+ if (err)
+ goto out;
+@@ -1655,8 +1666,11 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
+ goto out_flush;
+
+ err = do_move_pages_to_node(mm, &pagelist, current_node);
+- if (err)
++ if (err) {
++ if (err > 0)
++ err += nr_pages - i - 1;
+ goto out;
++ }
+ if (i > start) {
+ err = store_status(status, start, current_node, i - start);
+ if (err)
+@@ -1670,6 +1684,13 @@ out_flush:
+
+ /* Make sure we do not overwrite the existing error */
+ err1 = do_move_pages_to_node(mm, &pagelist, current_node);
++ /*
++ * Don't have to report non-attempted pages here since:
++ * - If the above loop is done gracefully all pages have been
++ * attempted.
++ * - If the above loop is aborted it means a fatal error
++ * happened, should return ret.
++ */
+ if (!err1)
+ err1 = store_status(status, start, current_node, i - start);
+ if (err >= 0)
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 74fb5c338e8f..e5c610d711f3 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -6456,45 +6456,75 @@ void __init free_area_init_node(int nid, unsigned long *zones_size,
+ }
+
+ #if defined(CONFIG_HAVE_MEMBLOCK) && !defined(CONFIG_FLAT_NODE_MEM_MAP)
++
++/*
++ * Zero all valid struct pages in range [spfn, epfn), return number of struct
++ * pages zeroed
++ */
++static u64 zero_pfn_range(unsigned long spfn, unsigned long epfn)
++{
++ unsigned long pfn;
++ u64 pgcnt = 0;
++
++ for (pfn = spfn; pfn < epfn; pfn++) {
++ if (!pfn_valid(ALIGN_DOWN(pfn, pageblock_nr_pages))) {
++ pfn = ALIGN_DOWN(pfn, pageblock_nr_pages)
++ + pageblock_nr_pages - 1;
++ continue;
++ }
++ mm_zero_struct_page(pfn_to_page(pfn));
++ pgcnt++;
++ }
++
++ return pgcnt;
++}
++
+ /*
+ * Only struct pages that are backed by physical memory are zeroed and
+ * initialized by going through __init_single_page(). But, there are some
+ * struct pages which are reserved in memblock allocator and their fields
+ * may be accessed (for example page_to_pfn() on some configuration accesses
+ * flags). We must explicitly zero those struct pages.
++ *
++ * This function also addresses a similar issue where struct pages are left
++ * uninitialized because the physical address range is not covered by
++ * memblock.memory or memblock.reserved. That could happen when memblock
++ * layout is manually configured via memmap=, or when the highest physical
++ * address (max_pfn) does not end on a section boundary.
+ */
+ void __init zero_resv_unavail(void)
+ {
+ phys_addr_t start, end;
+- unsigned long pfn;
+ u64 i, pgcnt;
++ phys_addr_t next = 0;
+
+ /*
+- * Loop through ranges that are reserved, but do not have reported
+- * physical memory backing.
++ * Loop through unavailable ranges not covered by memblock.memory.
+ */
+ pgcnt = 0;
+- for_each_resv_unavail_range(i, &start, &end) {
+- for (pfn = PFN_DOWN(start); pfn < PFN_UP(end); pfn++) {
+- if (!pfn_valid(ALIGN_DOWN(pfn, pageblock_nr_pages))) {
+- pfn = ALIGN_DOWN(pfn, pageblock_nr_pages)
+- + pageblock_nr_pages - 1;
+- continue;
+- }
+- mm_zero_struct_page(pfn_to_page(pfn));
+- pgcnt++;
+- }
++ for_each_mem_range(i, &memblock.memory, NULL,
++ NUMA_NO_NODE, MEMBLOCK_NONE, &start, &end, NULL) {
++ if (next < start)
++ pgcnt += zero_pfn_range(PFN_DOWN(next), PFN_UP(start));
++ next = end;
+ }
+
++ /*
++ * Early sections always have a fully populated memmap for the whole
++ * section - see pfn_valid(). If the last section has holes at the
++ * end and that section is marked "online", the memmap will be
++ * considered initialized. Make sure that memmap has a well defined
++ * state.
++ */
++ pgcnt += zero_pfn_range(PFN_DOWN(next),
++ round_up(max_pfn, PAGES_PER_SECTION));
++
+ /*
+ * Struct pages that do not have backing memory. This could be because
+ * firmware is using some of this memory, or for some other reasons.
+- * Once memblock is changed so such behaviour is not allowed: i.e.
+- * list of "reserved" memory must be a subset of list of "memory", then
+- * this code can be removed.
+ */
+ if (pgcnt)
+- pr_info("Reserved but unavailable: %lld pages", pgcnt);
++ pr_info("Zeroed struct page in unavailable ranges: %lld pages", pgcnt);
+ }
+ #endif /* CONFIG_HAVE_MEMBLOCK && !CONFIG_FLAT_NODE_MEM_MAP */
+
+diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c
+index 56080da4aa77..5fee6ec7c93d 100644
+--- a/net/hsr/hsr_slave.c
++++ b/net/hsr/hsr_slave.c
+@@ -32,6 +32,8 @@ static rx_handler_result_t hsr_handle_frame(struct sk_buff **pskb)
+
+ rcu_read_lock(); /* hsr->node_db, hsr->ports */
+ port = hsr_port_get_rcu(skb->dev);
++ if (!port)
++ goto finish_pass;
+
+ if (hsr_addr_is_self(port->hsr, eth_hdr(skb)->h_source)) {
+ /* Directly kill frames sent by ourselves */
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index e80eb1788f80..34fda81c7db0 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2588,10 +2588,12 @@ int tcp_disconnect(struct sock *sk, int flags)
+ tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+ tp->snd_cwnd_cnt = 0;
+ tp->window_clamp = 0;
++ tp->delivered = 0;
+ tp->delivered_ce = 0;
+ tcp_set_ca_state(sk, TCP_CA_Open);
+ tp->is_sack_reneg = 0;
+ tcp_clear_retrans(tp);
++ tp->total_retrans = 0;
+ inet_csk_delack_init(sk);
+ /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
+ * issue in __tcp_select_window()
+@@ -2603,10 +2605,14 @@ int tcp_disconnect(struct sock *sk, int flags)
+ sk->sk_rx_dst = NULL;
+ tcp_saved_syn_free(tp);
+ tp->compressed_ack = 0;
++ tp->segs_in = 0;
++ tp->segs_out = 0;
+ tp->bytes_sent = 0;
+ tp->bytes_acked = 0;
+ tp->bytes_received = 0;
+ tp->bytes_retrans = 0;
++ tp->data_segs_in = 0;
++ tp->data_segs_out = 0;
+ tp->dsack_dups = 0;
+ tp->reord_seen = 0;
+
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index e4dec03a19fe..d0a295cd71ef 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -325,8 +325,13 @@ int l2tp_session_register(struct l2tp_session *session,
+
+ spin_lock_bh(&pn->l2tp_session_hlist_lock);
+
++ /* IP encap expects session IDs to be globally unique, while
++ * UDP encap doesn't.
++ */
+ hlist_for_each_entry(session_walk, g_head, global_hlist)
+- if (session_walk->session_id == session->session_id) {
++ if (session_walk->session_id == session->session_id &&
++ (session_walk->tunnel->encap == L2TP_ENCAPTYPE_IP ||
++ tunnel->encap == L2TP_ENCAPTYPE_IP)) {
+ err = -EEXIST;
+ goto err_tlock_pnlock;
+ }
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index a74edb10cbfc..57f835d2442e 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -196,6 +196,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
+ service_in_use:
+ write_unlock(&local->services_lock);
+ rxrpc_unuse_local(local);
++ rxrpc_put_local(local);
+ ret = -EADDRINUSE;
+ error_unlock:
+ release_sock(&rx->sk);
+@@ -906,6 +907,7 @@ static int rxrpc_release_sock(struct sock *sk)
+ rxrpc_purge_queue(&sk->sk_receive_queue);
+
+ rxrpc_unuse_local(rx->local);
++ rxrpc_put_local(rx->local);
+ rx->local = NULL;
+ key_put(rx->key);
+ rx->key = NULL;
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index ccef6e40e002..9c4ee7513214 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -484,6 +484,7 @@ enum rxrpc_call_flag {
+ RXRPC_CALL_BEGAN_RX_TIMER, /* We began the expect_rx_by timer */
+ RXRPC_CALL_RX_HEARD, /* The peer responded at least once to this call */
+ RXRPC_CALL_RX_UNDERRUN, /* Got data underrun */
++ RXRPC_CALL_DISCONNECTED, /* The call has been disconnected */
+ };
+
+ /*
+@@ -1006,6 +1007,16 @@ void rxrpc_unuse_local(struct rxrpc_local *);
+ void rxrpc_queue_local(struct rxrpc_local *);
+ void rxrpc_destroy_all_locals(struct rxrpc_net *);
+
++static inline bool __rxrpc_unuse_local(struct rxrpc_local *local)
++{
++ return atomic_dec_return(&local->active_users) == 0;
++}
++
++static inline bool __rxrpc_use_local(struct rxrpc_local *local)
++{
++ return atomic_fetch_add_unless(&local->active_users, 1, 0) != 0;
++}
++
+ /*
+ * misc.c
+ */
+diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
+index 215f4d98baa0..17fdfce1625f 100644
+--- a/net/rxrpc/call_object.c
++++ b/net/rxrpc/call_object.c
+@@ -520,7 +520,7 @@ void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call)
+
+ _debug("RELEASE CALL %p (%d CONN %p)", call, call->debug_id, conn);
+
+- if (conn)
++ if (conn && !test_bit(RXRPC_CALL_DISCONNECTED, &call->flags))
+ rxrpc_disconnect_call(call);
+
+ for (i = 0; i < RXRPC_RXTX_BUFF_SIZE; i++) {
+@@ -654,6 +654,7 @@ static void rxrpc_rcu_destroy_call(struct rcu_head *rcu)
+ struct rxrpc_call *call = container_of(rcu, struct rxrpc_call, rcu);
+ struct rxrpc_net *rxnet = call->rxnet;
+
++ rxrpc_put_connection(call->conn);
+ rxrpc_put_peer(call->peer);
+ kfree(call->rxtx_buffer);
+ kfree(call->rxtx_annotations);
+@@ -677,7 +678,6 @@ void rxrpc_cleanup_call(struct rxrpc_call *call)
+
+ ASSERTCMP(call->state, ==, RXRPC_CALL_COMPLETE);
+ ASSERT(test_bit(RXRPC_CALL_RELEASED, &call->flags));
+- ASSERTCMP(call->conn, ==, NULL);
+
+ /* Clean up the Rx/Tx buffer */
+ for (i = 0; i < RXRPC_RXTX_BUFF_SIZE; i++)
+diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
+index 38d548532024..4ffc7b87fec0 100644
+--- a/net/rxrpc/conn_client.c
++++ b/net/rxrpc/conn_client.c
+@@ -786,6 +786,7 @@ void rxrpc_disconnect_client_call(struct rxrpc_call *call)
+ u32 cid;
+
+ spin_lock(&conn->channel_lock);
++ set_bit(RXRPC_CALL_DISCONNECTED, &call->flags);
+
+ cid = call->cid;
+ if (cid) {
+@@ -793,7 +794,6 @@ void rxrpc_disconnect_client_call(struct rxrpc_call *call)
+ chan = &conn->channels[channel];
+ }
+ trace_rxrpc_client(conn, channel, rxrpc_client_chan_disconnect);
+- call->conn = NULL;
+
+ /* Calls that have never actually been assigned a channel can simply be
+ * discarded. If the conn didn't get used either, it will follow
+@@ -909,7 +909,6 @@ out:
+ spin_unlock(&rxnet->client_conn_cache_lock);
+ out_2:
+ spin_unlock(&conn->channel_lock);
+- rxrpc_put_connection(conn);
+ _leave("");
+ return;
+
+diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
+index b6fca8ebb117..126154a97a59 100644
+--- a/net/rxrpc/conn_event.c
++++ b/net/rxrpc/conn_event.c
+@@ -453,16 +453,12 @@ again:
+ /*
+ * connection-level event processor
+ */
+-void rxrpc_process_connection(struct work_struct *work)
++static void rxrpc_do_process_connection(struct rxrpc_connection *conn)
+ {
+- struct rxrpc_connection *conn =
+- container_of(work, struct rxrpc_connection, processor);
+ struct sk_buff *skb;
+ u32 abort_code = RX_PROTOCOL_ERROR;
+ int ret;
+
+- rxrpc_see_connection(conn);
+-
+ if (test_and_clear_bit(RXRPC_CONN_EV_CHALLENGE, &conn->events))
+ rxrpc_secure_connection(conn);
+
+@@ -490,18 +486,33 @@ void rxrpc_process_connection(struct work_struct *work)
+ }
+ }
+
+-out:
+- rxrpc_put_connection(conn);
+- _leave("");
+ return;
+
+ requeue_and_leave:
+ skb_queue_head(&conn->rx_queue, skb);
+- goto out;
++ return;
+
+ protocol_error:
+ if (rxrpc_abort_connection(conn, ret, abort_code) < 0)
+ goto requeue_and_leave;
+ rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+- goto out;
++ return;
++}
++
++void rxrpc_process_connection(struct work_struct *work)
++{
++ struct rxrpc_connection *conn =
++ container_of(work, struct rxrpc_connection, processor);
++
++ rxrpc_see_connection(conn);
++
++ if (__rxrpc_use_local(conn->params.local)) {
++ rxrpc_do_process_connection(conn);
++ rxrpc_unuse_local(conn->params.local);
++ }
++
++ rxrpc_put_connection(conn);
++ _leave("");
++ return;
+ }
++
+diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
+index f338efd2880a..c4c4450891e0 100644
+--- a/net/rxrpc/conn_object.c
++++ b/net/rxrpc/conn_object.c
+@@ -226,9 +226,8 @@ void rxrpc_disconnect_call(struct rxrpc_call *call)
+ __rxrpc_disconnect_call(conn, call);
+ spin_unlock(&conn->channel_lock);
+
+- call->conn = NULL;
++ set_bit(RXRPC_CALL_DISCONNECTED, &call->flags);
+ conn->idle_timestamp = jiffies;
+- rxrpc_put_connection(conn);
+ }
+
+ /*
+diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
+index 2f91ab909191..d9beb28fc32f 100644
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -612,10 +612,8 @@ ack:
+ false, true,
+ rxrpc_propose_ack_input_data);
+
+- if (sp->hdr.seq == READ_ONCE(call->rx_hard_ack) + 1) {
+- trace_rxrpc_notify_socket(call->debug_id, serial);
+- rxrpc_notify_socket(call);
+- }
++ trace_rxrpc_notify_socket(call->debug_id, serial);
++ rxrpc_notify_socket(call);
+
+ unlock:
+ spin_unlock(&call->input_lock);
+diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
+index 04f0976841a4..4c0087a48e87 100644
+--- a/net/rxrpc/local_object.c
++++ b/net/rxrpc/local_object.c
+@@ -368,11 +368,14 @@ void rxrpc_queue_local(struct rxrpc_local *local)
+ void rxrpc_put_local(struct rxrpc_local *local)
+ {
+ const void *here = __builtin_return_address(0);
++ unsigned int debug_id;
+ int n;
+
+ if (local) {
++ debug_id = local->debug_id;
++
+ n = atomic_dec_return(&local->usage);
+- trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
++ trace_rxrpc_local(debug_id, rxrpc_local_put, n, here);
+
+ if (n == 0)
+ call_rcu(&local->rcu, rxrpc_local_rcu);
+@@ -384,14 +387,11 @@ void rxrpc_put_local(struct rxrpc_local *local)
+ */
+ struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *local)
+ {
+- unsigned int au;
+-
+ local = rxrpc_get_local_maybe(local);
+ if (!local)
+ return NULL;
+
+- au = atomic_fetch_add_unless(&local->active_users, 1, 0);
+- if (au == 0) {
++ if (!__rxrpc_use_local(local)) {
+ rxrpc_put_local(local);
+ return NULL;
+ }
+@@ -405,14 +405,11 @@ struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *local)
+ */
+ void rxrpc_unuse_local(struct rxrpc_local *local)
+ {
+- unsigned int au;
+-
+ if (local) {
+- au = atomic_dec_return(&local->active_users);
+- if (au == 0)
++ if (__rxrpc_unuse_local(local)) {
++ rxrpc_get_local(local);
+ rxrpc_queue_local(local);
+- else
+- rxrpc_put_local(local);
++ }
+ }
+ }
+
+@@ -469,7 +466,7 @@ static void rxrpc_local_processor(struct work_struct *work)
+
+ do {
+ again = false;
+- if (atomic_read(&local->active_users) == 0) {
++ if (!__rxrpc_use_local(local)) {
+ rxrpc_local_destroyer(local);
+ break;
+ }
+@@ -483,6 +480,8 @@ static void rxrpc_local_processor(struct work_struct *work)
+ rxrpc_process_local_events(local);
+ again = true;
+ }
++
++ __rxrpc_unuse_local(local);
+ } while (again);
+
+ rxrpc_put_local(local);
+diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
+index 31e47cfb3e68..b0aa08e3796d 100644
+--- a/net/rxrpc/output.c
++++ b/net/rxrpc/output.c
+@@ -133,7 +133,7 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn,
+ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
+ rxrpc_serial_t *_serial)
+ {
+- struct rxrpc_connection *conn = NULL;
++ struct rxrpc_connection *conn;
+ struct rxrpc_ack_buffer *pkt;
+ struct msghdr msg;
+ struct kvec iov[2];
+@@ -143,18 +143,14 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
+ int ret;
+ u8 reason;
+
+- spin_lock_bh(&call->lock);
+- if (call->conn)
+- conn = rxrpc_get_connection_maybe(call->conn);
+- spin_unlock_bh(&call->lock);
+- if (!conn)
++ if (test_bit(RXRPC_CALL_DISCONNECTED, &call->flags))
+ return -ECONNRESET;
+
+ pkt = kzalloc(sizeof(*pkt), GFP_KERNEL);
+- if (!pkt) {
+- rxrpc_put_connection(conn);
++ if (!pkt)
+ return -ENOMEM;
+- }
++
++ conn = call->conn;
+
+ msg.msg_name = &call->peer->srx.transport;
+ msg.msg_namelen = call->peer->srx.transport_len;
+@@ -249,7 +245,6 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
+ }
+
+ out:
+- rxrpc_put_connection(conn);
+ kfree(pkt);
+ return ret;
+ }
+@@ -259,7 +254,7 @@ out:
+ */
+ int rxrpc_send_abort_packet(struct rxrpc_call *call)
+ {
+- struct rxrpc_connection *conn = NULL;
++ struct rxrpc_connection *conn;
+ struct rxrpc_abort_buffer pkt;
+ struct msghdr msg;
+ struct kvec iov[1];
+@@ -276,13 +271,11 @@ int rxrpc_send_abort_packet(struct rxrpc_call *call)
+ test_bit(RXRPC_CALL_TX_LAST, &call->flags))
+ return 0;
+
+- spin_lock_bh(&call->lock);
+- if (call->conn)
+- conn = rxrpc_get_connection_maybe(call->conn);
+- spin_unlock_bh(&call->lock);
+- if (!conn)
++ if (test_bit(RXRPC_CALL_DISCONNECTED, &call->flags))
+ return -ECONNRESET;
+
++ conn = call->conn;
++
+ msg.msg_name = &call->peer->srx.transport;
+ msg.msg_namelen = call->peer->srx.transport_len;
+ msg.msg_control = NULL;
+@@ -317,8 +310,6 @@ int rxrpc_send_abort_packet(struct rxrpc_call *call)
+ trace_rxrpc_tx_packet(call->debug_id, &pkt.whdr,
+ rxrpc_tx_point_call_abort);
+ rxrpc_tx_backoff(call, ret);
+-
+- rxrpc_put_connection(conn);
+ return ret;
+ }
+
+diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
+index 42582a9ff81d..85bdc31d3dbf 100644
+--- a/net/rxrpc/peer_event.c
++++ b/net/rxrpc/peer_event.c
+@@ -357,27 +357,31 @@ static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet,
+ if (!rxrpc_get_peer_maybe(peer))
+ continue;
+
+- spin_unlock_bh(&rxnet->peer_hash_lock);
+-
+- keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;
+- slot = keepalive_at - base;
+- _debug("%02x peer %u t=%d {%pISp}",
+- cursor, peer->debug_id, slot, &peer->srx.transport);
++ if (__rxrpc_use_local(peer->local)) {
++ spin_unlock_bh(&rxnet->peer_hash_lock);
++
++ keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME;
++ slot = keepalive_at - base;
++ _debug("%02x peer %u t=%d {%pISp}",
++ cursor, peer->debug_id, slot, &peer->srx.transport);
++
++ if (keepalive_at <= base ||
++ keepalive_at > base + RXRPC_KEEPALIVE_TIME) {
++ rxrpc_send_keepalive(peer);
++ slot = RXRPC_KEEPALIVE_TIME;
++ }
+
+- if (keepalive_at <= base ||
+- keepalive_at > base + RXRPC_KEEPALIVE_TIME) {
+- rxrpc_send_keepalive(peer);
+- slot = RXRPC_KEEPALIVE_TIME;
++ /* A transmission to this peer occurred since last we
++ * examined it so put it into the appropriate future
++ * bucket.
++ */
++ slot += cursor;
++ slot &= mask;
++ spin_lock_bh(&rxnet->peer_hash_lock);
++ list_add_tail(&peer->keepalive_link,
++ &rxnet->peer_keepalive[slot & mask]);
++ rxrpc_unuse_local(peer->local);
+ }
+-
+- /* A transmission to this peer occurred since last we examined
+- * it so put it into the appropriate future bucket.
+- */
+- slot += cursor;
+- slot &= mask;
+- spin_lock_bh(&rxnet->peer_hash_lock);
+- list_add_tail(&peer->keepalive_link,
+- &rxnet->peer_keepalive[slot & mask]);
+ rxrpc_put_peer_locked(peer);
+ }
+
+diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
+index 6d30a291bcd2..eb1dd2afc5a1 100644
+--- a/net/sched/cls_rsvp.h
++++ b/net/sched/cls_rsvp.h
+@@ -466,10 +466,8 @@ static u32 gen_tunnel(struct rsvp_head *data)
+
+ static const struct nla_policy rsvp_policy[TCA_RSVP_MAX + 1] = {
+ [TCA_RSVP_CLASSID] = { .type = NLA_U32 },
+- [TCA_RSVP_DST] = { .type = NLA_BINARY,
+- .len = RSVP_DST_LEN * sizeof(u32) },
+- [TCA_RSVP_SRC] = { .type = NLA_BINARY,
+- .len = RSVP_DST_LEN * sizeof(u32) },
++ [TCA_RSVP_DST] = { .len = RSVP_DST_LEN * sizeof(u32) },
++ [TCA_RSVP_SRC] = { .len = RSVP_DST_LEN * sizeof(u32) },
+ [TCA_RSVP_PINFO] = { .len = sizeof(struct tc_rsvp_pinfo) },
+ };
+
+diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
+index edf27365f91c..db4b5d9ffaf7 100644
+--- a/net/sched/cls_tcindex.c
++++ b/net/sched/cls_tcindex.c
+@@ -333,12 +333,31 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ cp->fall_through = p->fall_through;
+ cp->tp = tp;
+
++ if (tb[TCA_TCINDEX_HASH])
++ cp->hash = nla_get_u32(tb[TCA_TCINDEX_HASH]);
++
++ if (tb[TCA_TCINDEX_MASK])
++ cp->mask = nla_get_u16(tb[TCA_TCINDEX_MASK]);
++
++ if (tb[TCA_TCINDEX_SHIFT])
++ cp->shift = nla_get_u32(tb[TCA_TCINDEX_SHIFT]);
++
++ if (!cp->hash) {
++ /* Hash not specified, use perfect hash if the upper limit
++ * of the hashing index is below the threshold.
++ */
++ if ((cp->mask >> cp->shift) < PERFECT_HASH_THRESHOLD)
++ cp->hash = (cp->mask >> cp->shift) + 1;
++ else
++ cp->hash = DEFAULT_HASH_SIZE;
++ }
++
+ if (p->perfect) {
+ int i;
+
+ if (tcindex_alloc_perfect_hash(net, cp) < 0)
+ goto errout;
+- for (i = 0; i < cp->hash; i++)
++ for (i = 0; i < min(cp->hash, p->hash); i++)
+ cp->perfect[i].res = p->perfect[i].res;
+ balloc = 1;
+ }
+@@ -346,19 +365,10 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+
+ err = tcindex_filter_result_init(&new_filter_result);
+ if (err < 0)
+- goto errout1;
++ goto errout_alloc;
+ if (old_r)
+ cr = r->res;
+
+- if (tb[TCA_TCINDEX_HASH])
+- cp->hash = nla_get_u32(tb[TCA_TCINDEX_HASH]);
+-
+- if (tb[TCA_TCINDEX_MASK])
+- cp->mask = nla_get_u16(tb[TCA_TCINDEX_MASK]);
+-
+- if (tb[TCA_TCINDEX_SHIFT])
+- cp->shift = nla_get_u32(tb[TCA_TCINDEX_SHIFT]);
+-
+ err = -EBUSY;
+
+ /* Hash already allocated, make sure that we still meet the
+@@ -376,16 +386,6 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ if (tb[TCA_TCINDEX_FALL_THROUGH])
+ cp->fall_through = nla_get_u32(tb[TCA_TCINDEX_FALL_THROUGH]);
+
+- if (!cp->hash) {
+- /* Hash not specified, use perfect hash if the upper limit
+- * of the hashing index is below the threshold.
+- */
+- if ((cp->mask >> cp->shift) < PERFECT_HASH_THRESHOLD)
+- cp->hash = (cp->mask >> cp->shift) + 1;
+- else
+- cp->hash = DEFAULT_HASH_SIZE;
+- }
+-
+ if (!cp->perfect && !cp->h)
+ cp->alloc_hash = cp->hash;
+
+@@ -484,7 +484,6 @@ errout_alloc:
+ tcindex_free_perfect_hash(cp);
+ else if (balloc == 2)
+ kfree(cp->h);
+-errout1:
+ tcf_exts_destroy(&new_filter_result.exts);
+ errout:
+ kfree(cp);
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index 24c7a1e2bd34..68830e88b6e9 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -1224,6 +1224,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
+ dprintk("RPC: No creds found!\n");
+ goto out;
+ } else {
++ struct timespec64 boot;
+
+ /* steal creds */
+ rsci.cred = ud->creds;
+@@ -1244,6 +1245,9 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
+ &expiry, GFP_KERNEL);
+ if (status)
+ goto out;
++
++ getboottime64(&boot);
++ expiry -= boot.tv_sec;
+ }
+
+ rsci.h.expiry_time = expiry;
+diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
+index 75d4b48601aa..85a6e8f5a75d 100644
+--- a/samples/bpf/Makefile
++++ b/samples/bpf/Makefile
+@@ -221,7 +221,7 @@ all:
+
+ clean:
+ $(MAKE) -C ../../ M=$(CURDIR) clean
+- @rm -f *~
++ @find $(CURDIR) -type f -name '*~' -delete
+
+ $(LIBBPF): FORCE
+ # Fix up variables inherited from Kbuild that tools/ build system won't like
+diff --git a/scripts/find-unused-docs.sh b/scripts/find-unused-docs.sh
+index 3f46f8977dc4..ee6a50e33aba 100755
+--- a/scripts/find-unused-docs.sh
++++ b/scripts/find-unused-docs.sh
+@@ -54,7 +54,7 @@ for file in `find $1 -name '*.c'`; do
+ if [[ ${FILES_INCLUDED[$file]+_} ]]; then
+ continue;
+ fi
+- str=$(scripts/kernel-doc -text -export "$file" 2>/dev/null)
++ str=$(scripts/kernel-doc -export "$file" 2>/dev/null)
+ if [[ -n "$str" ]]; then
+ echo "$file"
+ fi
+diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c
+index 9af154db530a..b78cc8d86a8b 100644
+--- a/sound/drivers/dummy.c
++++ b/sound/drivers/dummy.c
+@@ -929,7 +929,7 @@ static void print_formats(struct snd_dummy *dummy,
+ {
+ int i;
+
+- for (i = 0; i < SNDRV_PCM_FORMAT_LAST; i++) {
++ for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) {
+ if (dummy->pcm_hw.formats & (1ULL << i))
+ snd_iprintf(buffer, " %s", snd_pcm_format_name(i));
+ }
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index d63fea5d1c92..3ee5b7b9b595 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2324,6 +2324,8 @@ static struct snd_pci_quirk power_save_blacklist[] = {
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1581607 */
+ SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
++ SND_PCI_QUIRK(0x1558, 0x6504, "Clevo W65_67SB", 0),
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+ SND_PCI_QUIRK(0x1028, 0x0497, "Dell Precision T3600", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+ /* Note the P55A-UD3 and Z87-D3HP share the subsys id for the HDA dev */
+diff --git a/sound/usb/validate.c b/sound/usb/validate.c
+index 389e8657434a..5a3c4f7882b0 100644
+--- a/sound/usb/validate.c
++++ b/sound/usb/validate.c
+@@ -110,7 +110,7 @@ static bool validate_processing_unit(const void *p,
+ default:
+ if (v->type == UAC1_EXTENSION_UNIT)
+ return true; /* OK */
+- switch (d->wProcessType) {
++ switch (le16_to_cpu(d->wProcessType)) {
+ case UAC_PROCESS_UP_DOWNMIX:
+ case UAC_PROCESS_DOLBY_PROLOGIC:
+ if (d->bLength < len + 1) /* bNrModes */
+@@ -125,7 +125,7 @@ static bool validate_processing_unit(const void *p,
+ case UAC_VERSION_2:
+ if (v->type == UAC2_EXTENSION_UNIT_V2)
+ return true; /* OK */
+- switch (d->wProcessType) {
++ switch (le16_to_cpu(d->wProcessType)) {
+ case UAC2_PROCESS_UP_DOWNMIX:
+ case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */
+ if (d->bLength < len + 1) /* bNrModes */
+@@ -142,7 +142,7 @@ static bool validate_processing_unit(const void *p,
+ len += 2; /* wClusterDescrID */
+ break;
+ }
+- switch (d->wProcessType) {
++ switch (le16_to_cpu(d->wProcessType)) {
+ case UAC3_PROCESS_UP_DOWNMIX:
+ if (d->bLength < len + 1) /* bNrModes */
+ return false;
+diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
+index ba7ee74ee533..f6ca0a216f3c 100755
+--- a/tools/kvm/kvm_stat/kvm_stat
++++ b/tools/kvm/kvm_stat/kvm_stat
+@@ -271,6 +271,7 @@ class ArchX86(Arch):
+ def __init__(self, exit_reasons):
+ self.sc_perf_evt_open = 298
+ self.ioctl_numbers = IOCTL_NUMBERS
++ self.exit_reason_field = 'exit_reason'
+ self.exit_reasons = exit_reasons
+
+ def debugfs_is_child(self, field):
+@@ -290,6 +291,7 @@ class ArchPPC(Arch):
+ # numbers depend on the wordsize.
+ char_ptr_size = ctypes.sizeof(ctypes.c_char_p)
+ self.ioctl_numbers['SET_FILTER'] = 0x80002406 | char_ptr_size << 16
++ self.exit_reason_field = 'exit_nr'
+ self.exit_reasons = {}
+
+ def debugfs_is_child(self, field):
+@@ -301,6 +303,7 @@ class ArchA64(Arch):
+ def __init__(self):
+ self.sc_perf_evt_open = 241
+ self.ioctl_numbers = IOCTL_NUMBERS
++ self.exit_reason_field = 'esr_ec'
+ self.exit_reasons = AARCH64_EXIT_REASONS
+
+ def debugfs_is_child(self, field):
+@@ -312,6 +315,7 @@ class ArchS390(Arch):
+ def __init__(self):
+ self.sc_perf_evt_open = 331
+ self.ioctl_numbers = IOCTL_NUMBERS
++ self.exit_reason_field = None
+ self.exit_reasons = None
+
+ def debugfs_is_child(self, field):
+@@ -542,8 +546,8 @@ class TracepointProvider(Provider):
+ """
+ filters = {}
+ filters['kvm_userspace_exit'] = ('reason', USERSPACE_EXIT_REASONS)
+- if ARCH.exit_reasons:
+- filters['kvm_exit'] = ('exit_reason', ARCH.exit_reasons)
++ if ARCH.exit_reason_field and ARCH.exit_reasons:
++ filters['kvm_exit'] = (ARCH.exit_reason_field, ARCH.exit_reasons)
+ return filters
+
+ def _get_available_fields(self):
+diff --git a/virt/kvm/arm/aarch32.c b/virt/kvm/arm/aarch32.c
+index 6880236974b8..d915548759a4 100644
+--- a/virt/kvm/arm/aarch32.c
++++ b/virt/kvm/arm/aarch32.c
+@@ -21,6 +21,7 @@
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
++#include <linux/bits.h>
+ #include <linux/kvm_host.h>
+ #include <asm/kvm_emulate.h>
+ #include <asm/kvm_hyp.h>
+@@ -39,25 +40,115 @@ static const u8 return_offsets[8][2] = {
+ [7] = { 4, 4 }, /* FIQ, unused */
+ };
+
++/*
++ * When an exception is taken, most CPSR fields are left unchanged in the
++ * handler. However, some are explicitly overridden (e.g. M[4:0]).
++ *
++ * The SPSR/SPSR_ELx layouts differ, and the below is intended to work with
++ * either format. Note: SPSR.J bit doesn't exist in SPSR_ELx, but this bit was
++ * obsoleted by the ARMv7 virtualization extensions and is RES0.
++ *
++ * For the SPSR layout seen from AArch32, see:
++ * - ARM DDI 0406C.d, page B1-1148
++ * - ARM DDI 0487E.a, page G8-6264
++ *
++ * For the SPSR_ELx layout for AArch32 seen from AArch64, see:
++ * - ARM DDI 0487E.a, page C5-426
++ *
++ * Here we manipulate the fields in order of the AArch32 SPSR_ELx layout, from
++ * MSB to LSB.
++ */
++static unsigned long get_except32_cpsr(struct kvm_vcpu *vcpu, u32 mode)
++{
++ u32 sctlr = vcpu_cp15(vcpu, c1_SCTLR);
++ unsigned long old, new;
++
++ old = *vcpu_cpsr(vcpu);
++ new = 0;
++
++ new |= (old & PSR_AA32_N_BIT);
++ new |= (old & PSR_AA32_Z_BIT);
++ new |= (old & PSR_AA32_C_BIT);
++ new |= (old & PSR_AA32_V_BIT);
++ new |= (old & PSR_AA32_Q_BIT);
++
++ // CPSR.IT[7:0] are set to zero upon any exception
++ // See ARM DDI 0487E.a, section G1.12.3
++ // See ARM DDI 0406C.d, section B1.8.3
++
++ new |= (old & PSR_AA32_DIT_BIT);
++
++ // CPSR.SSBS is set to SCTLR.DSSBS upon any exception
++ // See ARM DDI 0487E.a, page G8-6244
++ if (sctlr & BIT(31))
++ new |= PSR_AA32_SSBS_BIT;
++
++ // CPSR.PAN is unchanged unless SCTLR.SPAN == 0b0
++ // SCTLR.SPAN is RES1 when ARMv8.1-PAN is not implemented
++ // See ARM DDI 0487E.a, page G8-6246
++ new |= (old & PSR_AA32_PAN_BIT);
++ if (!(sctlr & BIT(23)))
++ new |= PSR_AA32_PAN_BIT;
++
++ // SS does not exist in AArch32, so ignore
++
++ // CPSR.IL is set to zero upon any exception
++ // See ARM DDI 0487E.a, page G1-5527
++
++ new |= (old & PSR_AA32_GE_MASK);
++
++ // CPSR.IT[7:0] are set to zero upon any exception
++ // See prior comment above
++
++ // CPSR.E is set to SCTLR.EE upon any exception
++ // See ARM DDI 0487E.a, page G8-6245
++ // See ARM DDI 0406C.d, page B4-1701
++ if (sctlr & BIT(25))
++ new |= PSR_AA32_E_BIT;
++
++ // CPSR.A is unchanged upon an exception to Undefined, Supervisor
++ // CPSR.A is set upon an exception to other modes
++ // See ARM DDI 0487E.a, pages G1-5515 to G1-5516
++ // See ARM DDI 0406C.d, page B1-1182
++ new |= (old & PSR_AA32_A_BIT);
++ if (mode != PSR_AA32_MODE_UND && mode != PSR_AA32_MODE_SVC)
++ new |= PSR_AA32_A_BIT;
++
++ // CPSR.I is set upon any exception
++ // See ARM DDI 0487E.a, pages G1-5515 to G1-5516
++ // See ARM DDI 0406C.d, page B1-1182
++ new |= PSR_AA32_I_BIT;
++
++ // CPSR.F is set upon an exception to FIQ
++ // CPSR.F is unchanged upon an exception to other modes
++ // See ARM DDI 0487E.a, pages G1-5515 to G1-5516
++ // See ARM DDI 0406C.d, page B1-1182
++ new |= (old & PSR_AA32_F_BIT);
++ if (mode == PSR_AA32_MODE_FIQ)
++ new |= PSR_AA32_F_BIT;
++
++ // CPSR.T is set to SCTLR.TE upon any exception
++ // See ARM DDI 0487E.a, page G8-5514
++ // See ARM DDI 0406C.d, page B1-1181
++ if (sctlr & BIT(30))
++ new |= PSR_AA32_T_BIT;
++
++ new |= mode;
++
++ return new;
++}
++
+ static void prepare_fault32(struct kvm_vcpu *vcpu, u32 mode, u32 vect_offset)
+ {
+- unsigned long cpsr;
+- unsigned long new_spsr_value = *vcpu_cpsr(vcpu);
+- bool is_thumb = (new_spsr_value & PSR_AA32_T_BIT);
++ unsigned long spsr = *vcpu_cpsr(vcpu);
++ bool is_thumb = (spsr & PSR_AA32_T_BIT);
+ u32 return_offset = return_offsets[vect_offset >> 2][is_thumb];
+ u32 sctlr = vcpu_cp15(vcpu, c1_SCTLR);
+
+- cpsr = mode | PSR_AA32_I_BIT;
+-
+- if (sctlr & (1 << 30))
+- cpsr |= PSR_AA32_T_BIT;
+- if (sctlr & (1 << 25))
+- cpsr |= PSR_AA32_E_BIT;
+-
+- *vcpu_cpsr(vcpu) = cpsr;
++ *vcpu_cpsr(vcpu) = get_except32_cpsr(vcpu, mode);
+
+ /* Note: These now point to the banked copies */
+- vcpu_write_spsr(vcpu, new_spsr_value);
++ vcpu_write_spsr(vcpu, host_spsr_to_spsr32(spsr));
+ *vcpu_reg32(vcpu, 14) = *vcpu_pc(vcpu) + return_offset;
+
+ /* Branch to exception vector */
+@@ -95,7 +186,7 @@ static void inject_abt32(struct kvm_vcpu *vcpu, bool is_pabt,
+ fsr = &vcpu_cp15(vcpu, c5_DFSR);
+ }
+
+- prepare_fault32(vcpu, PSR_AA32_MODE_ABT | PSR_AA32_A_BIT, vect_offset);
++ prepare_fault32(vcpu, PSR_AA32_MODE_ABT, vect_offset);
+
+ *far = addr;
+
+diff --git a/virt/kvm/arm/mmio.c b/virt/kvm/arm/mmio.c
+index 3caee91bca08..878e0edb2e1b 100644
+--- a/virt/kvm/arm/mmio.c
++++ b/virt/kvm/arm/mmio.c
+@@ -117,6 +117,9 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
+ data = (data ^ mask) - mask;
+ }
+
++ if (!vcpu->arch.mmio_decode.sixty_four)
++ data = data & 0xffffffff;
++
+ trace_kvm_mmio(KVM_TRACE_MMIO_READ, len, run->mmio.phys_addr,
+ &data);
+ data = vcpu_data_host_to_guest(vcpu, data, len);
+@@ -137,6 +140,7 @@ static int decode_hsr(struct kvm_vcpu *vcpu, bool *is_write, int *len)
+ unsigned long rt;
+ int access_size;
+ bool sign_extend;
++ bool sixty_four;
+
+ if (kvm_vcpu_dabt_iss1tw(vcpu)) {
+ /* page table accesses IO mem: tell guest to fix its TTBR */
+@@ -150,11 +154,13 @@ static int decode_hsr(struct kvm_vcpu *vcpu, bool *is_write, int *len)
+
+ *is_write = kvm_vcpu_dabt_iswrite(vcpu);
+ sign_extend = kvm_vcpu_dabt_issext(vcpu);
++ sixty_four = kvm_vcpu_dabt_issf(vcpu);
+ rt = kvm_vcpu_dabt_get_rd(vcpu);
+
+ *len = access_size;
+ vcpu->arch.mmio_decode.sign_extend = sign_extend;
+ vcpu->arch.mmio_decode.rt = rt;
++ vcpu->arch.mmio_decode.sixty_four = sixty_four;
+
+ return 0;
+ }
+diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
+index 23c2519c5b32..c9861c2315e8 100644
+--- a/virt/kvm/async_pf.c
++++ b/virt/kvm/async_pf.c
+@@ -76,7 +76,7 @@ static void async_pf_execute(struct work_struct *work)
+ struct mm_struct *mm = apf->mm;
+ struct kvm_vcpu *vcpu = apf->vcpu;
+ unsigned long addr = apf->addr;
+- gva_t gva = apf->gva;
++ gpa_t cr2_or_gpa = apf->cr2_or_gpa;
+ int locked = 1;
+
+ might_sleep();
+@@ -104,7 +104,7 @@ static void async_pf_execute(struct work_struct *work)
+ * this point
+ */
+
+- trace_kvm_async_pf_completed(addr, gva);
++ trace_kvm_async_pf_completed(addr, cr2_or_gpa);
+
+ if (swq_has_sleeper(&vcpu->wq))
+ swake_up_one(&vcpu->wq);
+@@ -177,8 +177,8 @@ void kvm_check_async_pf_completion(struct kvm_vcpu *vcpu)
+ }
+ }
+
+-int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
+- struct kvm_arch_async_pf *arch)
++int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
++ unsigned long hva, struct kvm_arch_async_pf *arch)
+ {
+ struct kvm_async_pf *work;
+
+@@ -197,7 +197,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
+
+ work->wakeup_all = false;
+ work->vcpu = vcpu;
+- work->gva = gva;
++ work->cr2_or_gpa = cr2_or_gpa;
+ work->addr = hva;
+ work->arch = *arch;
+ work->mm = current->mm;
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 9502b1a44232..beec19fcf8cd 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1294,14 +1294,14 @@ bool kvm_is_visible_gfn(struct kvm *kvm, gfn_t gfn)
+ }
+ EXPORT_SYMBOL_GPL(kvm_is_visible_gfn);
+
+-unsigned long kvm_host_page_size(struct kvm *kvm, gfn_t gfn)
++unsigned long kvm_host_page_size(struct kvm_vcpu *vcpu, gfn_t gfn)
+ {
+ struct vm_area_struct *vma;
+ unsigned long addr, size;
+
+ size = PAGE_SIZE;
+
+- addr = gfn_to_hva(kvm, gfn);
++ addr = kvm_vcpu_gfn_to_hva_prot(vcpu, gfn, NULL);
+ if (kvm_is_error_hva(addr))
+ return PAGE_SIZE;
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-02-14 23:52 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-02-14 23:52 UTC (permalink / raw
To: gentoo-commits
commit: 08c1c813a743bc4ae2802b0f97128f56bb902fce
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 14 23:52:14 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Feb 14 23:52:14 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=08c1c813
Linux patch 4.19.104
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1103_linux-4.19.104.patch | 2222 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2226 insertions(+)
diff --git a/0000_README b/0000_README
index 8ac0cbe..6839197 100644
--- a/0000_README
+++ b/0000_README
@@ -451,6 +451,10 @@ Patch: 1102_linux-4.19.103.patch
From: https://www.kernel.org
Desc: Linux 4.19.103
+Patch: 1103_linux-4.19.104.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.104
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1103_linux-4.19.104.patch b/1103_linux-4.19.104.patch
new file mode 100644
index 0000000..04bc7eb
--- /dev/null
+++ b/1103_linux-4.19.104.patch
@@ -0,0 +1,2222 @@
+diff --git a/Makefile b/Makefile
+index 37f58becf5c2..004d964cca50 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 103
++SUBLEVEL = 104
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi
+index 37bafd44e36d..da10a569adf7 100644
+--- a/arch/arc/boot/dts/axs10x_mb.dtsi
++++ b/arch/arc/boot/dts/axs10x_mb.dtsi
+@@ -80,6 +80,7 @@
+ interrupt-names = "macirq";
+ phy-mode = "rgmii";
+ snps,pbl = < 32 >;
++ snps,multicast-filter-bins = <256>;
+ clocks = <&apbclk>;
+ clock-names = "stmmaceth";
+ max-speed = <100>;
+diff --git a/arch/arm/boot/dts/am43xx-clocks.dtsi b/arch/arm/boot/dts/am43xx-clocks.dtsi
+index a7037a4b4fd4..ce3c4196f173 100644
+--- a/arch/arm/boot/dts/am43xx-clocks.dtsi
++++ b/arch/arm/boot/dts/am43xx-clocks.dtsi
+@@ -707,6 +707,60 @@
+ ti,bit-shift = <8>;
+ reg = <0x2a48>;
+ };
++
++ clkout1_osc_div_ck: clkout1-osc-div-ck {
++ #clock-cells = <0>;
++ compatible = "ti,divider-clock";
++ clocks = <&sys_clkin_ck>;
++ ti,bit-shift = <20>;
++ ti,max-div = <4>;
++ reg = <0x4100>;
++ };
++
++ clkout1_src2_mux_ck: clkout1-src2-mux-ck {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&clk_rc32k_ck>, <&sysclk_div>, <&dpll_ddr_m2_ck>,
++ <&dpll_per_m2_ck>, <&dpll_disp_m2_ck>,
++ <&dpll_mpu_m2_ck>;
++ reg = <0x4100>;
++ };
++
++ clkout1_src2_pre_div_ck: clkout1-src2-pre-div-ck {
++ #clock-cells = <0>;
++ compatible = "ti,divider-clock";
++ clocks = <&clkout1_src2_mux_ck>;
++ ti,bit-shift = <4>;
++ ti,max-div = <8>;
++ reg = <0x4100>;
++ };
++
++ clkout1_src2_post_div_ck: clkout1-src2-post-div-ck {
++ #clock-cells = <0>;
++ compatible = "ti,divider-clock";
++ clocks = <&clkout1_src2_pre_div_ck>;
++ ti,bit-shift = <8>;
++ ti,max-div = <32>;
++ ti,index-power-of-two;
++ reg = <0x4100>;
++ };
++
++ clkout1_mux_ck: clkout1-mux-ck {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&clkout1_osc_div_ck>, <&clk_rc32k_ck>,
++ <&clkout1_src2_post_div_ck>, <&dpll_extdev_m2_ck>;
++ ti,bit-shift = <16>;
++ reg = <0x4100>;
++ };
++
++ clkout1_ck: clkout1-ck {
++ #clock-cells = <0>;
++ compatible = "ti,gate-clock";
++ clocks = <&clkout1_mux_ck>;
++ ti,bit-shift = <23>;
++ reg = <0x4100>;
++ };
+ };
+
+ &prcm {
+diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
+index 9118e29b6d6a..3fa6b9fbb822 100644
+--- a/arch/arm/boot/dts/at91sam9260.dtsi
++++ b/arch/arm/boot/dts/at91sam9260.dtsi
+@@ -434,7 +434,7 @@
+ usart0 {
+ pinctrl_usart0: usart0-0 {
+ atmel,pins =
+- <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 5 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -468,7 +468,7 @@
+ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+- <AT91_PIOB 6 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 6 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 7 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -486,7 +486,7 @@
+ usart2 {
+ pinctrl_usart2: usart2-0 {
+ atmel,pins =
+- <AT91_PIOB 8 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 8 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 9 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -504,7 +504,7 @@
+ usart3 {
+ pinctrl_usart3: usart3-0 {
+ atmel,pins =
+- <AT91_PIOB 10 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 10 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 11 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -522,7 +522,7 @@
+ uart0 {
+ pinctrl_uart0: uart0-0 {
+ atmel,pins =
+- <AT91_PIOA 31 AT91_PERIPH_B AT91_PINCTRL_NONE
++ <AT91_PIOA 31 AT91_PERIPH_B AT91_PINCTRL_PULL_UP
+ AT91_PIOA 30 AT91_PERIPH_B AT91_PINCTRL_PULL_UP>;
+ };
+ };
+@@ -530,7 +530,7 @@
+ uart1 {
+ pinctrl_uart1: uart1-0 {
+ atmel,pins =
+- <AT91_PIOB 12 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 12 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 13 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/at91sam9261.dtsi b/arch/arm/boot/dts/at91sam9261.dtsi
+index 33f09d5ea020..590d28852997 100644
+--- a/arch/arm/boot/dts/at91sam9261.dtsi
++++ b/arch/arm/boot/dts/at91sam9261.dtsi
+@@ -328,7 +328,7 @@
+ usart0 {
+ pinctrl_usart0: usart0-0 {
+ atmel,pins =
+- <AT91_PIOC 8 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOC 8 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOC 9 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -346,7 +346,7 @@
+ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+- <AT91_PIOC 12 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOC 12 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOC 13 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -364,7 +364,7 @@
+ usart2 {
+ pinctrl_usart2: usart2-0 {
+ atmel,pins =
+- <AT91_PIOC 14 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOC 14 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOC 15 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
+index af68a86c9973..745918b97786 100644
+--- a/arch/arm/boot/dts/at91sam9263.dtsi
++++ b/arch/arm/boot/dts/at91sam9263.dtsi
+@@ -437,7 +437,7 @@
+ usart0 {
+ pinctrl_usart0: usart0-0 {
+ atmel,pins =
+- <AT91_PIOA 26 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOA 26 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOA 27 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -455,7 +455,7 @@
+ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+- <AT91_PIOD 0 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOD 0 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOD 1 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -473,7 +473,7 @@
+ usart2 {
+ pinctrl_usart2: usart2-0 {
+ atmel,pins =
+- <AT91_PIOD 2 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOD 2 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOD 3 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
+index d16db1fa7e15..ea80a5a12760 100644
+--- a/arch/arm/boot/dts/at91sam9g45.dtsi
++++ b/arch/arm/boot/dts/at91sam9g45.dtsi
+@@ -555,7 +555,7 @@
+ usart0 {
+ pinctrl_usart0: usart0-0 {
+ atmel,pins =
+- <AT91_PIOB 19 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 19 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 18 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -573,7 +573,7 @@
+ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+- <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 5 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -591,7 +591,7 @@
+ usart2 {
+ pinctrl_usart2: usart2-0 {
+ atmel,pins =
+- <AT91_PIOB 6 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 6 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 7 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -609,7 +609,7 @@
+ usart3 {
+ pinctrl_usart3: usart3-0 {
+ atmel,pins =
+- <AT91_PIOB 8 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 8 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 9 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi
+index 8fb22030f00b..ad495f5a5790 100644
+--- a/arch/arm/boot/dts/at91sam9rl.dtsi
++++ b/arch/arm/boot/dts/at91sam9rl.dtsi
+@@ -681,7 +681,7 @@
+ usart0 {
+ pinctrl_usart0: usart0-0 {
+ atmel,pins =
+- <AT91_PIOA 6 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOA 6 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOA 7 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -720,7 +720,7 @@
+ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+- <AT91_PIOA 11 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOA 11 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOA 12 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -743,7 +743,7 @@
+ usart2 {
+ pinctrl_usart2: usart2-0 {
+ atmel,pins =
+- <AT91_PIOA 13 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOA 13 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOA 14 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -766,7 +766,7 @@
+ usart3 {
+ pinctrl_usart3: usart3-0 {
+ atmel,pins =
+- <AT91_PIOB 0 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOB 0 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOB 1 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
+index 1408fa4a62e4..d01464bfd5fc 100644
+--- a/arch/arm/boot/dts/sama5d3.dtsi
++++ b/arch/arm/boot/dts/sama5d3.dtsi
+@@ -1187,49 +1187,49 @@
+ usart0_clk: usart0_clk {
+ #clock-cells = <0>;
+ reg = <12>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ usart1_clk: usart1_clk {
+ #clock-cells = <0>;
+ reg = <13>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ usart2_clk: usart2_clk {
+ #clock-cells = <0>;
+ reg = <14>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ usart3_clk: usart3_clk {
+ #clock-cells = <0>;
+ reg = <15>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ uart0_clk: uart0_clk {
+ #clock-cells = <0>;
+ reg = <16>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ twi0_clk: twi0_clk {
+ reg = <18>;
+ #clock-cells = <0>;
+- atmel,clk-output-range = <0 16625000>;
++ atmel,clk-output-range = <0 41500000>;
+ };
+
+ twi1_clk: twi1_clk {
+ #clock-cells = <0>;
+ reg = <19>;
+- atmel,clk-output-range = <0 16625000>;
++ atmel,clk-output-range = <0 41500000>;
+ };
+
+ twi2_clk: twi2_clk {
+ #clock-cells = <0>;
+ reg = <20>;
+- atmel,clk-output-range = <0 16625000>;
++ atmel,clk-output-range = <0 41500000>;
+ };
+
+ mci0_clk: mci0_clk {
+@@ -1245,19 +1245,19 @@
+ spi0_clk: spi0_clk {
+ #clock-cells = <0>;
+ reg = <24>;
+- atmel,clk-output-range = <0 133000000>;
++ atmel,clk-output-range = <0 166000000>;
+ };
+
+ spi1_clk: spi1_clk {
+ #clock-cells = <0>;
+ reg = <25>;
+- atmel,clk-output-range = <0 133000000>;
++ atmel,clk-output-range = <0 166000000>;
+ };
+
+ tcb0_clk: tcb0_clk {
+ #clock-cells = <0>;
+ reg = <26>;
+- atmel,clk-output-range = <0 133000000>;
++ atmel,clk-output-range = <0 166000000>;
+ };
+
+ pwm_clk: pwm_clk {
+@@ -1268,7 +1268,7 @@
+ adc_clk: adc_clk {
+ #clock-cells = <0>;
+ reg = <29>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ dma0_clk: dma0_clk {
+@@ -1299,13 +1299,13 @@
+ ssc0_clk: ssc0_clk {
+ #clock-cells = <0>;
+ reg = <38>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ ssc1_clk: ssc1_clk {
+ #clock-cells = <0>;
+ reg = <39>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ sha_clk: sha_clk {
+diff --git a/arch/arm/boot/dts/sama5d3_can.dtsi b/arch/arm/boot/dts/sama5d3_can.dtsi
+index c5a3772741bf..0fac79f75c06 100644
+--- a/arch/arm/boot/dts/sama5d3_can.dtsi
++++ b/arch/arm/boot/dts/sama5d3_can.dtsi
+@@ -37,13 +37,13 @@
+ can0_clk: can0_clk {
+ #clock-cells = <0>;
+ reg = <40>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ can1_clk: can1_clk {
+ #clock-cells = <0>;
+ reg = <41>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/sama5d3_tcb1.dtsi b/arch/arm/boot/dts/sama5d3_tcb1.dtsi
+index cb30bdb1a9ca..7a68d355ff72 100644
+--- a/arch/arm/boot/dts/sama5d3_tcb1.dtsi
++++ b/arch/arm/boot/dts/sama5d3_tcb1.dtsi
+@@ -23,6 +23,7 @@
+ tcb1_clk: tcb1_clk {
+ #clock-cells = <0>;
+ reg = <27>;
++ atmel,clk-output-range = <0 166000000>;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/sama5d3_uart.dtsi b/arch/arm/boot/dts/sama5d3_uart.dtsi
+index f599f8a5f664..f6d301c16cb1 100644
+--- a/arch/arm/boot/dts/sama5d3_uart.dtsi
++++ b/arch/arm/boot/dts/sama5d3_uart.dtsi
+@@ -42,13 +42,13 @@
+ uart0_clk: uart0_clk {
+ #clock-cells = <0>;
+ reg = <16>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ uart1_clk: uart1_clk {
+ #clock-cells = <0>;
+ reg = <17>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+ };
+ };
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index e1d330a26921..ade055556a7b 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -357,7 +357,7 @@ static inline void poison_init_mem(void *s, size_t count)
+ *p++ = 0xe7fddef0;
+ }
+
+-static inline void
++static inline void __init
+ free_memmap(unsigned long start_pfn, unsigned long end_pfn)
+ {
+ struct page *start_pg, *end_pg;
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index 220ebfa0ece6..1375307fbe4d 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -1241,7 +1241,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
+ {
+ /* FP/SIMD is not implemented */
+ .capability = ARM64_HAS_NO_FPSIMD,
+- .type = ARM64_CPUCAP_SYSTEM_FEATURE,
++ .type = ARM64_CPUCAP_BOOT_RESTRICTED_CPU_LOCAL_FEATURE,
+ .min_field_value = 0,
+ .matches = has_no_fpsimd,
+ },
+diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
+index 0211c3c7533b..38aab5b34cc4 100644
+--- a/arch/arm64/kernel/ptrace.c
++++ b/arch/arm64/kernel/ptrace.c
+@@ -627,6 +627,13 @@ static int gpr_set(struct task_struct *target, const struct user_regset *regset,
+ return 0;
+ }
+
++static int fpr_active(struct task_struct *target, const struct user_regset *regset)
++{
++ if (!system_supports_fpsimd())
++ return -ENODEV;
++ return regset->n;
++}
++
+ /*
+ * TODO: update fp accessors for lazy context switching (sync/flush hwstate)
+ */
+@@ -649,6 +656,9 @@ static int fpr_get(struct task_struct *target, const struct user_regset *regset,
+ unsigned int pos, unsigned int count,
+ void *kbuf, void __user *ubuf)
+ {
++ if (!system_supports_fpsimd())
++ return -EINVAL;
++
+ if (target == current)
+ fpsimd_preserve_current_state();
+
+@@ -688,6 +698,9 @@ static int fpr_set(struct task_struct *target, const struct user_regset *regset,
+ {
+ int ret;
+
++ if (!system_supports_fpsimd())
++ return -EINVAL;
++
+ ret = __fpr_set(target, regset, pos, count, kbuf, ubuf, 0);
+ if (ret)
+ return ret;
+@@ -990,6 +1003,7 @@ static const struct user_regset aarch64_regsets[] = {
+ */
+ .size = sizeof(u32),
+ .align = sizeof(u32),
++ .active = fpr_active,
+ .get = fpr_get,
+ .set = fpr_set
+ },
+@@ -1176,6 +1190,9 @@ static int compat_vfp_get(struct task_struct *target,
+ compat_ulong_t fpscr;
+ int ret, vregs_end_pos;
+
++ if (!system_supports_fpsimd())
++ return -EINVAL;
++
+ uregs = &target->thread.uw.fpsimd_state;
+
+ if (target == current)
+@@ -1209,6 +1226,9 @@ static int compat_vfp_set(struct task_struct *target,
+ compat_ulong_t fpscr;
+ int ret, vregs_end_pos;
+
++ if (!system_supports_fpsimd())
++ return -EINVAL;
++
+ uregs = &target->thread.uw.fpsimd_state;
+
+ vregs_end_pos = VFP_STATE_SIZE - sizeof(compat_ulong_t);
+@@ -1266,6 +1286,7 @@ static const struct user_regset aarch32_regsets[] = {
+ .n = VFP_STATE_SIZE / sizeof(compat_ulong_t),
+ .size = sizeof(compat_ulong_t),
+ .align = sizeof(compat_ulong_t),
++ .active = fpr_active,
+ .get = compat_vfp_get,
+ .set = compat_vfp_set
+ },
+diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
+index 06f02960b439..b1a08cb760e0 100644
+--- a/arch/powerpc/platforms/pseries/iommu.c
++++ b/arch/powerpc/platforms/pseries/iommu.c
+@@ -167,10 +167,10 @@ static unsigned long tce_get_pseries(struct iommu_table *tbl, long index)
+ return be64_to_cpu(*tcep);
+ }
+
+-static void tce_free_pSeriesLP(struct iommu_table*, long, long);
++static void tce_free_pSeriesLP(unsigned long liobn, long, long);
+ static void tce_freemulti_pSeriesLP(struct iommu_table*, long, long);
+
+-static int tce_build_pSeriesLP(struct iommu_table *tbl, long tcenum,
++static int tce_build_pSeriesLP(unsigned long liobn, long tcenum, long tceshift,
+ long npages, unsigned long uaddr,
+ enum dma_data_direction direction,
+ unsigned long attrs)
+@@ -181,25 +181,25 @@ static int tce_build_pSeriesLP(struct iommu_table *tbl, long tcenum,
+ int ret = 0;
+ long tcenum_start = tcenum, npages_start = npages;
+
+- rpn = __pa(uaddr) >> TCE_SHIFT;
++ rpn = __pa(uaddr) >> tceshift;
+ proto_tce = TCE_PCI_READ;
+ if (direction != DMA_TO_DEVICE)
+ proto_tce |= TCE_PCI_WRITE;
+
+ while (npages--) {
+- tce = proto_tce | (rpn & TCE_RPN_MASK) << TCE_RPN_SHIFT;
+- rc = plpar_tce_put((u64)tbl->it_index, (u64)tcenum << 12, tce);
++ tce = proto_tce | (rpn & TCE_RPN_MASK) << tceshift;
++ rc = plpar_tce_put((u64)liobn, (u64)tcenum << tceshift, tce);
+
+ if (unlikely(rc == H_NOT_ENOUGH_RESOURCES)) {
+ ret = (int)rc;
+- tce_free_pSeriesLP(tbl, tcenum_start,
++ tce_free_pSeriesLP(liobn, tcenum_start,
+ (npages_start - (npages + 1)));
+ break;
+ }
+
+ if (rc && printk_ratelimit()) {
+ printk("tce_build_pSeriesLP: plpar_tce_put failed. rc=%lld\n", rc);
+- printk("\tindex = 0x%llx\n", (u64)tbl->it_index);
++ printk("\tindex = 0x%llx\n", (u64)liobn);
+ printk("\ttcenum = 0x%llx\n", (u64)tcenum);
+ printk("\ttce val = 0x%llx\n", tce );
+ dump_stack();
+@@ -228,7 +228,8 @@ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum,
+ unsigned long flags;
+
+ if ((npages == 1) || !firmware_has_feature(FW_FEATURE_MULTITCE)) {
+- return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr,
++ return tce_build_pSeriesLP(tbl->it_index, tcenum,
++ tbl->it_page_shift, npages, uaddr,
+ direction, attrs);
+ }
+
+@@ -244,8 +245,9 @@ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum,
+ /* If allocation fails, fall back to the loop implementation */
+ if (!tcep) {
+ local_irq_restore(flags);
+- return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr,
+- direction, attrs);
++ return tce_build_pSeriesLP(tbl->it_index, tcenum,
++ tbl->it_page_shift,
++ npages, uaddr, direction, attrs);
+ }
+ __this_cpu_write(tce_page, tcep);
+ }
+@@ -296,16 +298,16 @@ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum,
+ return ret;
+ }
+
+-static void tce_free_pSeriesLP(struct iommu_table *tbl, long tcenum, long npages)
++static void tce_free_pSeriesLP(unsigned long liobn, long tcenum, long npages)
+ {
+ u64 rc;
+
+ while (npages--) {
+- rc = plpar_tce_put((u64)tbl->it_index, (u64)tcenum << 12, 0);
++ rc = plpar_tce_put((u64)liobn, (u64)tcenum << 12, 0);
+
+ if (rc && printk_ratelimit()) {
+ printk("tce_free_pSeriesLP: plpar_tce_put failed. rc=%lld\n", rc);
+- printk("\tindex = 0x%llx\n", (u64)tbl->it_index);
++ printk("\tindex = 0x%llx\n", (u64)liobn);
+ printk("\ttcenum = 0x%llx\n", (u64)tcenum);
+ dump_stack();
+ }
+@@ -320,7 +322,7 @@ static void tce_freemulti_pSeriesLP(struct iommu_table *tbl, long tcenum, long n
+ u64 rc;
+
+ if (!firmware_has_feature(FW_FEATURE_MULTITCE))
+- return tce_free_pSeriesLP(tbl, tcenum, npages);
++ return tce_free_pSeriesLP(tbl->it_index, tcenum, npages);
+
+ rc = plpar_tce_stuff((u64)tbl->it_index, (u64)tcenum << 12, 0, npages);
+
+@@ -435,6 +437,19 @@ static int tce_setrange_multi_pSeriesLP(unsigned long start_pfn,
+ u64 rc = 0;
+ long l, limit;
+
++ if (!firmware_has_feature(FW_FEATURE_MULTITCE)) {
++ unsigned long tceshift = be32_to_cpu(maprange->tce_shift);
++ unsigned long dmastart = (start_pfn << PAGE_SHIFT) +
++ be64_to_cpu(maprange->dma_base);
++ unsigned long tcenum = dmastart >> tceshift;
++ unsigned long npages = num_pfn << PAGE_SHIFT >> tceshift;
++ void *uaddr = __va(start_pfn << PAGE_SHIFT);
++
++ return tce_build_pSeriesLP(be32_to_cpu(maprange->liobn),
++ tcenum, tceshift, npages, (unsigned long) uaddr,
++ DMA_BIDIRECTIONAL, 0);
++ }
++
+ local_irq_disable(); /* to protect tcep and the page behind it */
+ tcep = __this_cpu_read(tce_page);
+
+diff --git a/arch/powerpc/platforms/pseries/vio.c b/arch/powerpc/platforms/pseries/vio.c
+index 49e04ec19238..0e7778be4c49 100644
+--- a/arch/powerpc/platforms/pseries/vio.c
++++ b/arch/powerpc/platforms/pseries/vio.c
+@@ -1195,6 +1195,8 @@ static struct iommu_table *vio_build_iommu_table(struct vio_dev *dev)
+ if (tbl == NULL)
+ return NULL;
+
++ kref_init(&tbl->it_kref);
++
+ of_parse_dma_window(dev->dev.of_node, dma_window,
+ &tbl->it_index, &offset, &size);
+
+diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
+index 578b5455334f..31fbb4a7d9f6 100644
+--- a/arch/x86/entry/calling.h
++++ b/arch/x86/entry/calling.h
+@@ -172,21 +172,6 @@ For 32-bit we have the following conventions - kernel is built with
+ .endif
+ .endm
+
+-/*
+- * This is a sneaky trick to help the unwinder find pt_regs on the stack. The
+- * frame pointer is replaced with an encoded pointer to pt_regs. The encoding
+- * is just setting the LSB, which makes it an invalid stack address and is also
+- * a signal to the unwinder that it's a pt_regs pointer in disguise.
+- *
+- * NOTE: This macro must be used *after* PUSH_AND_CLEAR_REGS because it corrupts
+- * the original rbp.
+- */
+-.macro ENCODE_FRAME_POINTER ptregs_offset=0
+-#ifdef CONFIG_FRAME_POINTER
+- leaq 1+\ptregs_offset(%rsp), %rbp
+-#endif
+-.endm
+-
+ #ifdef CONFIG_PAGE_TABLE_ISOLATION
+
+ /*
+diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
+index 8059d4fd915c..d07432062ee6 100644
+--- a/arch/x86/entry/entry_32.S
++++ b/arch/x86/entry/entry_32.S
+@@ -245,22 +245,6 @@
+ .Lend_\@:
+ .endm
+
+-/*
+- * This is a sneaky trick to help the unwinder find pt_regs on the stack. The
+- * frame pointer is replaced with an encoded pointer to pt_regs. The encoding
+- * is just clearing the MSB, which makes it an invalid stack address and is also
+- * a signal to the unwinder that it's a pt_regs pointer in disguise.
+- *
+- * NOTE: This macro must be used *after* SAVE_ALL because it corrupts the
+- * original rbp.
+- */
+-.macro ENCODE_FRAME_POINTER
+-#ifdef CONFIG_FRAME_POINTER
+- mov %esp, %ebp
+- andl $0x7fffffff, %ebp
+-#endif
+-.endm
+-
+ .macro RESTORE_INT_REGS
+ popl %ebx
+ popl %ecx
+diff --git a/arch/x86/include/asm/frame.h b/arch/x86/include/asm/frame.h
+index 5cbce6fbb534..296b346184b2 100644
+--- a/arch/x86/include/asm/frame.h
++++ b/arch/x86/include/asm/frame.h
+@@ -22,6 +22,35 @@
+ pop %_ASM_BP
+ .endm
+
++#ifdef CONFIG_X86_64
++/*
++ * This is a sneaky trick to help the unwinder find pt_regs on the stack. The
++ * frame pointer is replaced with an encoded pointer to pt_regs. The encoding
++ * is just setting the LSB, which makes it an invalid stack address and is also
++ * a signal to the unwinder that it's a pt_regs pointer in disguise.
++ *
++ * NOTE: This macro must be used *after* PUSH_AND_CLEAR_REGS because it corrupts
++ * the original rbp.
++ */
++.macro ENCODE_FRAME_POINTER ptregs_offset=0
++ leaq 1+\ptregs_offset(%rsp), %rbp
++.endm
++#else /* !CONFIG_X86_64 */
++/*
++ * This is a sneaky trick to help the unwinder find pt_regs on the stack. The
++ * frame pointer is replaced with an encoded pointer to pt_regs. The encoding
++ * is just clearing the MSB, which makes it an invalid stack address and is also
++ * a signal to the unwinder that it's a pt_regs pointer in disguise.
++ *
++ * NOTE: This macro must be used *after* SAVE_ALL because it corrupts the
++ * original ebp.
++ */
++.macro ENCODE_FRAME_POINTER
++ mov %esp, %ebp
++ andl $0x7fffffff, %ebp
++.endm
++#endif /* CONFIG_X86_64 */
++
+ #else /* !__ASSEMBLY__ */
+
+ #define FRAME_BEGIN \
+@@ -30,12 +59,32 @@
+
+ #define FRAME_END "pop %" _ASM_BP "\n"
+
++#ifdef CONFIG_X86_64
++#define ENCODE_FRAME_POINTER \
++ "lea 1(%rsp), %rbp\n\t"
++#else /* !CONFIG_X86_64 */
++#define ENCODE_FRAME_POINTER \
++ "movl %esp, %ebp\n\t" \
++ "andl $0x7fffffff, %ebp\n\t"
++#endif /* CONFIG_X86_64 */
++
+ #endif /* __ASSEMBLY__ */
+
+ #define FRAME_OFFSET __ASM_SEL(4, 8)
+
+ #else /* !CONFIG_FRAME_POINTER */
+
++#ifdef __ASSEMBLY__
++
++.macro ENCODE_FRAME_POINTER ptregs_offset=0
++.endm
++
++#else /* !__ASSEMBLY */
++
++#define ENCODE_FRAME_POINTER
++
++#endif
++
+ #define FRAME_BEGIN
+ #define FRAME_END
+ #define FRAME_OFFSET 0
+diff --git a/arch/x86/kernel/ftrace_32.S b/arch/x86/kernel/ftrace_32.S
+index 4c8440de3355..83f18e829ac7 100644
+--- a/arch/x86/kernel/ftrace_32.S
++++ b/arch/x86/kernel/ftrace_32.S
+@@ -9,6 +9,7 @@
+ #include <asm/export.h>
+ #include <asm/ftrace.h>
+ #include <asm/nospec-branch.h>
++#include <asm/frame.h>
+
+ #ifdef CC_USING_FENTRY
+ # define function_hook __fentry__
+@@ -131,6 +132,8 @@ ENTRY(ftrace_regs_caller)
+ pushl %ecx
+ pushl %ebx
+
++ ENCODE_FRAME_POINTER
++
+ movl 12*4(%esp), %eax /* Load ip (1st parameter) */
+ subl $MCOUNT_INSN_SIZE, %eax /* Adjust ip */
+ #ifdef CC_USING_FENTRY
+diff --git a/arch/x86/kernel/ftrace_64.S b/arch/x86/kernel/ftrace_64.S
+index 75f2b36b41a6..24b9abf718e8 100644
+--- a/arch/x86/kernel/ftrace_64.S
++++ b/arch/x86/kernel/ftrace_64.S
+@@ -9,6 +9,7 @@
+ #include <asm/export.h>
+ #include <asm/nospec-branch.h>
+ #include <asm/unwind_hints.h>
++#include <asm/frame.h>
+
+ .code64
+ .section .entry.text, "ax"
+@@ -222,6 +223,8 @@ GLOBAL(ftrace_regs_caller_op_ptr)
+ leaq MCOUNT_REG_SIZE+8*2(%rsp), %rcx
+ movq %rcx, RSP(%rsp)
+
++ ENCODE_FRAME_POINTER
++
+ /* regs go into 4th parameter */
+ leaq (%rsp), %rcx
+
+diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c
+index ef125d4be8fc..cb548a0506c5 100644
+--- a/drivers/crypto/atmel-sha.c
++++ b/drivers/crypto/atmel-sha.c
+@@ -1921,12 +1921,7 @@ static int atmel_sha_hmac_setkey(struct crypto_ahash *tfm, const u8 *key,
+ {
+ struct atmel_sha_hmac_ctx *hmac = crypto_ahash_ctx(tfm);
+
+- if (atmel_sha_hmac_key_set(&hmac->hkey, key, keylen)) {
+- crypto_ahash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
+- return -EINVAL;
+- }
+-
+- return 0;
++ return atmel_sha_hmac_key_set(&hmac->hkey, key, keylen);
+ }
+
+ static int atmel_sha_hmac_init(struct ahash_request *req)
+diff --git a/drivers/crypto/axis/artpec6_crypto.c b/drivers/crypto/axis/artpec6_crypto.c
+index fdcdc751d03b..3caf57ebdbff 100644
+--- a/drivers/crypto/axis/artpec6_crypto.c
++++ b/drivers/crypto/axis/artpec6_crypto.c
+@@ -1256,7 +1256,7 @@ static int artpec6_crypto_aead_set_key(struct crypto_aead *tfm, const u8 *key,
+
+ if (len != 16 && len != 24 && len != 32) {
+ crypto_aead_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
+- return -1;
++ return -EINVAL;
+ }
+
+ ctx->key_length = len;
+diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
+index a9238fb15013..5dec96155814 100644
+--- a/drivers/gpio/gpio-zynq.c
++++ b/drivers/gpio/gpio-zynq.c
+@@ -357,6 +357,28 @@ static int zynq_gpio_dir_out(struct gpio_chip *chip, unsigned int pin,
+ return 0;
+ }
+
++/**
++ * zynq_gpio_get_direction - Read the direction of the specified GPIO pin
++ * @chip: gpio_chip instance to be worked on
++ * @pin: gpio pin number within the device
++ *
++ * This function returns the direction of the specified GPIO.
++ *
++ * Return: 0 for output, 1 for input
++ */
++static int zynq_gpio_get_direction(struct gpio_chip *chip, unsigned int pin)
++{
++ u32 reg;
++ unsigned int bank_num, bank_pin_num;
++ struct zynq_gpio *gpio = gpiochip_get_data(chip);
++
++ zynq_gpio_get_bank_pin(pin, &bank_num, &bank_pin_num, gpio);
++
++ reg = readl_relaxed(gpio->base_addr + ZYNQ_GPIO_DIRM_OFFSET(bank_num));
++
++ return !(reg & BIT(bank_pin_num));
++}
++
+ /**
+ * zynq_gpio_irq_mask - Disable the interrupts for a gpio pin
+ * @irq_data: per irq and chip data passed down to chip functions
+@@ -829,6 +851,7 @@ static int zynq_gpio_probe(struct platform_device *pdev)
+ chip->free = zynq_gpio_free;
+ chip->direction_input = zynq_gpio_dir_in;
+ chip->direction_output = zynq_gpio_dir_out;
++ chip->get_direction = zynq_gpio_get_direction;
+ chip->base = of_alias_get_id(pdev->dev.of_node, "gpio");
+ chip->ngpio = gpio->p_data->ngpio;
+
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index 9e5f70e7122a..6e96a2fb97dc 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -136,7 +136,7 @@ int ib_nl_handle_ip_res_resp(struct sk_buff *skb,
+ if (ib_nl_is_good_ip_resp(nlh))
+ ib_nl_process_good_ip_rsep(nlh);
+
+- return skb->len;
++ return 0;
+ }
+
+ static int ib_nl_ip_send_msg(struct rdma_dev_addr *dev_addr,
+diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
+index 8be082edf986..9881e6fa9fe4 100644
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -1078,7 +1078,7 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ }
+
+ settimeout_out:
+- return skb->len;
++ return 0;
+ }
+
+ static inline int ib_nl_is_good_resolve_resp(const struct nlmsghdr *nlh)
+@@ -1149,7 +1149,7 @@ int ib_nl_handle_resolve_resp(struct sk_buff *skb,
+ }
+
+ resp_out:
+- return skb->len;
++ return 0;
+ }
+
+ static void free_sm_ah(struct kref *kref)
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 357de3b4fddd..5404717998b0 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -273,7 +273,6 @@ void ib_uverbs_release_file(struct kref *ref)
+ }
+
+ static ssize_t ib_uverbs_event_read(struct ib_uverbs_event_queue *ev_queue,
+- struct ib_uverbs_file *uverbs_file,
+ struct file *filp, char __user *buf,
+ size_t count, loff_t *pos,
+ size_t eventsz)
+@@ -291,19 +290,16 @@ static ssize_t ib_uverbs_event_read(struct ib_uverbs_event_queue *ev_queue,
+
+ if (wait_event_interruptible(ev_queue->poll_wait,
+ (!list_empty(&ev_queue->event_list) ||
+- /* The barriers built into wait_event_interruptible()
+- * and wake_up() guarentee this will see the null set
+- * without using RCU
+- */
+- !uverbs_file->device->ib_dev)))
++ ev_queue->is_closed)))
+ return -ERESTARTSYS;
+
++ spin_lock_irq(&ev_queue->lock);
++
+ /* If device was disassociated and no event exists set an error */
+- if (list_empty(&ev_queue->event_list) &&
+- !uverbs_file->device->ib_dev)
++ if (list_empty(&ev_queue->event_list) && ev_queue->is_closed) {
++ spin_unlock_irq(&ev_queue->lock);
+ return -EIO;
+-
+- spin_lock_irq(&ev_queue->lock);
++ }
+ }
+
+ event = list_entry(ev_queue->event_list.next, struct ib_uverbs_event, list);
+@@ -338,8 +334,7 @@ static ssize_t ib_uverbs_async_event_read(struct file *filp, char __user *buf,
+ {
+ struct ib_uverbs_async_event_file *file = filp->private_data;
+
+- return ib_uverbs_event_read(&file->ev_queue, file->uverbs_file, filp,
+- buf, count, pos,
++ return ib_uverbs_event_read(&file->ev_queue, filp, buf, count, pos,
+ sizeof(struct ib_uverbs_async_event_desc));
+ }
+
+@@ -349,9 +344,8 @@ static ssize_t ib_uverbs_comp_event_read(struct file *filp, char __user *buf,
+ struct ib_uverbs_completion_event_file *comp_ev_file =
+ filp->private_data;
+
+- return ib_uverbs_event_read(&comp_ev_file->ev_queue,
+- comp_ev_file->uobj.ufile, filp,
+- buf, count, pos,
++ return ib_uverbs_event_read(&comp_ev_file->ev_queue, filp, buf, count,
++ pos,
+ sizeof(struct ib_uverbs_comp_event_desc));
+ }
+
+@@ -374,7 +368,9 @@ static __poll_t ib_uverbs_event_poll(struct ib_uverbs_event_queue *ev_queue,
+ static __poll_t ib_uverbs_async_event_poll(struct file *filp,
+ struct poll_table_struct *wait)
+ {
+- return ib_uverbs_event_poll(filp->private_data, filp, wait);
++ struct ib_uverbs_async_event_file *file = filp->private_data;
++
++ return ib_uverbs_event_poll(&file->ev_queue, filp, wait);
+ }
+
+ static __poll_t ib_uverbs_comp_event_poll(struct file *filp,
+@@ -388,9 +384,9 @@ static __poll_t ib_uverbs_comp_event_poll(struct file *filp,
+
+ static int ib_uverbs_async_event_fasync(int fd, struct file *filp, int on)
+ {
+- struct ib_uverbs_event_queue *ev_queue = filp->private_data;
++ struct ib_uverbs_async_event_file *file = filp->private_data;
+
+- return fasync_helper(fd, filp, on, &ev_queue->async_queue);
++ return fasync_helper(fd, filp, on, &file->ev_queue.async_queue);
+ }
+
+ static int ib_uverbs_comp_event_fasync(int fd, struct file *filp, int on)
+diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
+index 9386bb57b3d7..a19d3ad14dc3 100644
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -246,6 +246,13 @@ static int mlx4_ib_update_gids(struct gid_entry *gids,
+ return mlx4_ib_update_gids_v1(gids, ibdev, port_num);
+ }
+
++static void free_gid_entry(struct gid_entry *entry)
++{
++ memset(&entry->gid, 0, sizeof(entry->gid));
++ kfree(entry->ctx);
++ entry->ctx = NULL;
++}
++
+ static int mlx4_ib_add_gid(const struct ib_gid_attr *attr, void **context)
+ {
+ struct mlx4_ib_dev *ibdev = to_mdev(attr->device);
+@@ -306,6 +313,8 @@ static int mlx4_ib_add_gid(const struct ib_gid_attr *attr, void **context)
+ GFP_ATOMIC);
+ if (!gids) {
+ ret = -ENOMEM;
++ *context = NULL;
++ free_gid_entry(&port_gid_table->gids[free]);
+ } else {
+ for (i = 0; i < MLX4_MAX_PORT_GIDS; i++) {
+ memcpy(&gids[i].gid, &port_gid_table->gids[i].gid, sizeof(union ib_gid));
+@@ -317,6 +326,12 @@ static int mlx4_ib_add_gid(const struct ib_gid_attr *attr, void **context)
+
+ if (!ret && hw_update) {
+ ret = mlx4_ib_update_gids(gids, ibdev, attr->port_num);
++ if (ret) {
++ spin_lock_bh(&iboe->lock);
++ *context = NULL;
++ free_gid_entry(&port_gid_table->gids[free]);
++ spin_unlock_bh(&iboe->lock);
++ }
+ kfree(gids);
+ }
+
+@@ -346,10 +361,7 @@ static int mlx4_ib_del_gid(const struct ib_gid_attr *attr, void **context)
+ if (!ctx->refcount) {
+ unsigned int real_index = ctx->real_index;
+
+- memset(&port_gid_table->gids[real_index].gid, 0,
+- sizeof(port_gid_table->gids[real_index].gid));
+- kfree(port_gid_table->gids[real_index].ctx);
+- port_gid_table->gids[real_index].ctx = NULL;
++ free_gid_entry(&port_gid_table->gids[real_index]);
+ hw_update = 1;
+ }
+ }
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index 2ab7100bcff1..eff1f3aa5ef4 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -810,6 +810,7 @@ static int arm_smmu_cmdq_build_cmd(u64 *cmd, struct arm_smmu_cmdq_ent *ent)
+ cmd[1] |= FIELD_PREP(CMDQ_CFGI_1_RANGE, 31);
+ break;
+ case CMDQ_OP_TLBI_NH_VA:
++ cmd[0] |= FIELD_PREP(CMDQ_TLBI_0_VMID, ent->tlbi.vmid);
+ cmd[0] |= FIELD_PREP(CMDQ_TLBI_0_ASID, ent->tlbi.asid);
+ cmd[1] |= FIELD_PREP(CMDQ_TLBI_1_LEAF, ent->tlbi.leaf);
+ cmd[1] |= ent->tlbi.addr & CMDQ_TLBI_1_VA_MASK;
+diff --git a/drivers/media/i2c/adv748x/adv748x.h b/drivers/media/i2c/adv748x/adv748x.h
+index 1cf46c401664..9cc5672e4148 100644
+--- a/drivers/media/i2c/adv748x/adv748x.h
++++ b/drivers/media/i2c/adv748x/adv748x.h
+@@ -361,10 +361,10 @@ int adv748x_write_block(struct adv748x_state *state, int client_page,
+
+ #define io_read(s, r) adv748x_read(s, ADV748X_PAGE_IO, r)
+ #define io_write(s, r, v) adv748x_write(s, ADV748X_PAGE_IO, r, v)
+-#define io_clrset(s, r, m, v) io_write(s, r, (io_read(s, r) & ~m) | v)
++#define io_clrset(s, r, m, v) io_write(s, r, (io_read(s, r) & ~(m)) | (v))
+
+ #define hdmi_read(s, r) adv748x_read(s, ADV748X_PAGE_HDMI, r)
+-#define hdmi_read16(s, r, m) (((hdmi_read(s, r) << 8) | hdmi_read(s, r+1)) & m)
++#define hdmi_read16(s, r, m) (((hdmi_read(s, r) << 8) | hdmi_read(s, (r)+1)) & (m))
+ #define hdmi_write(s, r, v) adv748x_write(s, ADV748X_PAGE_HDMI, r, v)
+
+ #define repeater_read(s, r) adv748x_read(s, ADV748X_PAGE_REPEATER, r)
+@@ -372,11 +372,11 @@ int adv748x_write_block(struct adv748x_state *state, int client_page,
+
+ #define sdp_read(s, r) adv748x_read(s, ADV748X_PAGE_SDP, r)
+ #define sdp_write(s, r, v) adv748x_write(s, ADV748X_PAGE_SDP, r, v)
+-#define sdp_clrset(s, r, m, v) sdp_write(s, r, (sdp_read(s, r) & ~m) | v)
++#define sdp_clrset(s, r, m, v) sdp_write(s, r, (sdp_read(s, r) & ~(m)) | (v))
+
+ #define cp_read(s, r) adv748x_read(s, ADV748X_PAGE_CP, r)
+ #define cp_write(s, r, v) adv748x_write(s, ADV748X_PAGE_CP, r, v)
+-#define cp_clrset(s, r, m, v) cp_write(s, r, (cp_read(s, r) & ~m) | v)
++#define cp_clrset(s, r, m, v) cp_write(s, r, (cp_read(s, r) & ~(m)) | (v))
+
+ #define txa_read(s, r) adv748x_read(s, ADV748X_PAGE_TXA, r)
+ #define txb_read(s, r) adv748x_read(s, ADV748X_PAGE_TXB, r)
+diff --git a/drivers/mtd/nand/onenand/onenand_base.c b/drivers/mtd/nand/onenand/onenand_base.c
+index 4ca4b194e7d7..db3587d30691 100644
+--- a/drivers/mtd/nand/onenand/onenand_base.c
++++ b/drivers/mtd/nand/onenand/onenand_base.c
+@@ -1251,44 +1251,44 @@ static int onenand_read_ops_nolock(struct mtd_info *mtd, loff_t from,
+
+ stats = mtd->ecc_stats;
+
+- /* Read-while-load method */
++ /* Read-while-load method */
+
+- /* Do first load to bufferRAM */
+- if (read < len) {
+- if (!onenand_check_bufferram(mtd, from)) {
++ /* Do first load to bufferRAM */
++ if (read < len) {
++ if (!onenand_check_bufferram(mtd, from)) {
+ this->command(mtd, ONENAND_CMD_READ, from, writesize);
+- ret = this->wait(mtd, FL_READING);
+- onenand_update_bufferram(mtd, from, !ret);
++ ret = this->wait(mtd, FL_READING);
++ onenand_update_bufferram(mtd, from, !ret);
+ if (mtd_is_eccerr(ret))
+ ret = 0;
+- }
+- }
++ }
++ }
+
+ thislen = min_t(int, writesize, len - read);
+ column = from & (writesize - 1);
+ if (column + thislen > writesize)
+ thislen = writesize - column;
+
+- while (!ret) {
+- /* If there is more to load then start next load */
+- from += thislen;
+- if (read + thislen < len) {
++ while (!ret) {
++ /* If there is more to load then start next load */
++ from += thislen;
++ if (read + thislen < len) {
+ this->command(mtd, ONENAND_CMD_READ, from, writesize);
+- /*
+- * Chip boundary handling in DDP
+- * Now we issued chip 1 read and pointed chip 1
++ /*
++ * Chip boundary handling in DDP
++ * Now we issued chip 1 read and pointed chip 1
+ * bufferram so we have to point chip 0 bufferram.
+- */
+- if (ONENAND_IS_DDP(this) &&
+- unlikely(from == (this->chipsize >> 1))) {
+- this->write_word(ONENAND_DDP_CHIP0, this->base + ONENAND_REG_START_ADDRESS2);
+- boundary = 1;
+- } else
+- boundary = 0;
+- ONENAND_SET_PREV_BUFFERRAM(this);
+- }
+- /* While load is going, read from last bufferRAM */
+- this->read_bufferram(mtd, ONENAND_DATARAM, buf, column, thislen);
++ */
++ if (ONENAND_IS_DDP(this) &&
++ unlikely(from == (this->chipsize >> 1))) {
++ this->write_word(ONENAND_DDP_CHIP0, this->base + ONENAND_REG_START_ADDRESS2);
++ boundary = 1;
++ } else
++ boundary = 0;
++ ONENAND_SET_PREV_BUFFERRAM(this);
++ }
++ /* While load is going, read from last bufferRAM */
++ this->read_bufferram(mtd, ONENAND_DATARAM, buf, column, thislen);
+
+ /* Read oob area if needed */
+ if (oobbuf) {
+@@ -1304,24 +1304,24 @@ static int onenand_read_ops_nolock(struct mtd_info *mtd, loff_t from,
+ oobcolumn = 0;
+ }
+
+- /* See if we are done */
+- read += thislen;
+- if (read == len)
+- break;
+- /* Set up for next read from bufferRAM */
+- if (unlikely(boundary))
+- this->write_word(ONENAND_DDP_CHIP1, this->base + ONENAND_REG_START_ADDRESS2);
+- ONENAND_SET_NEXT_BUFFERRAM(this);
+- buf += thislen;
++ /* See if we are done */
++ read += thislen;
++ if (read == len)
++ break;
++ /* Set up for next read from bufferRAM */
++ if (unlikely(boundary))
++ this->write_word(ONENAND_DDP_CHIP1, this->base + ONENAND_REG_START_ADDRESS2);
++ ONENAND_SET_NEXT_BUFFERRAM(this);
++ buf += thislen;
+ thislen = min_t(int, writesize, len - read);
+- column = 0;
+- cond_resched();
+- /* Now wait for load */
+- ret = this->wait(mtd, FL_READING);
+- onenand_update_bufferram(mtd, from, !ret);
++ column = 0;
++ cond_resched();
++ /* Now wait for load */
++ ret = this->wait(mtd, FL_READING);
++ onenand_update_bufferram(mtd, from, !ret);
+ if (mtd_is_eccerr(ret))
+ ret = 0;
+- }
++ }
+
+ /*
+ * Return success, if no ECC failures, else -EBADMSG
+diff --git a/drivers/mtd/parsers/sharpslpart.c b/drivers/mtd/parsers/sharpslpart.c
+index e5ea6127ab5a..671a61845bd5 100644
+--- a/drivers/mtd/parsers/sharpslpart.c
++++ b/drivers/mtd/parsers/sharpslpart.c
+@@ -165,10 +165,10 @@ static int sharpsl_nand_get_logical_num(u8 *oob)
+
+ static int sharpsl_nand_init_ftl(struct mtd_info *mtd, struct sharpsl_ftl *ftl)
+ {
+- unsigned int block_num, log_num, phymax;
++ unsigned int block_num, phymax;
++ int i, ret, log_num;
+ loff_t block_adr;
+ u8 *oob;
+- int i, ret;
+
+ oob = kzalloc(mtd->oobsize, GFP_KERNEL);
+ if (!oob)
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index 2a503aacf0c6..caece8339a50 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -1613,11 +1613,22 @@ static int ath10k_pci_dump_memory_reg(struct ath10k *ar,
+ {
+ struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+ u32 i;
++ int ret;
++
++ mutex_lock(&ar->conf_mutex);
++ if (ar->state != ATH10K_STATE_ON) {
++ ath10k_warn(ar, "Skipping pci_dump_memory_reg invalid state\n");
++ ret = -EIO;
++ goto done;
++ }
+
+ for (i = 0; i < region->len; i += 4)
+ *(u32 *)(buf + i) = ioread32(ar_pci->mem + region->start + i);
+
+- return region->len;
++ ret = region->len;
++done:
++ mutex_unlock(&ar->conf_mutex);
++ return ret;
+ }
+
+ /* if an error happened returns < 0, otherwise the length */
+@@ -1713,7 +1724,11 @@ static void ath10k_pci_dump_memory(struct ath10k *ar,
+ count = ath10k_pci_dump_memory_sram(ar, current_region, buf);
+ break;
+ case ATH10K_MEM_REGION_TYPE_IOREG:
+- count = ath10k_pci_dump_memory_reg(ar, current_region, buf);
++ ret = ath10k_pci_dump_memory_reg(ar, current_region, buf);
++ if (ret < 0)
++ break;
++
++ count = ret;
+ break;
+ default:
+ ret = ath10k_pci_dump_memory_generic(ar, current_region, buf);
+diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c
+index c9401c121a14..4e3de684928b 100644
+--- a/drivers/net/wireless/marvell/libertas/cfg.c
++++ b/drivers/net/wireless/marvell/libertas/cfg.c
+@@ -1785,6 +1785,8 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
+ rates_max = rates_eid[1];
+ if (rates_max > MAX_RATES) {
+ lbs_deb_join("invalid rates");
++ rcu_read_unlock();
++ ret = -EINVAL;
+ goto out;
+ }
+ rates = cmd.bss.rates;
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index dd02bbd9544e..85d6d5f3dce5 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -2894,6 +2894,13 @@ mwifiex_cmd_append_vsie_tlv(struct mwifiex_private *priv,
+ vs_param_set->header.len =
+ cpu_to_le16((((u16) priv->vs_ie[id].ie[1])
+ & 0x00FF) + 2);
++ if (le16_to_cpu(vs_param_set->header.len) >
++ MWIFIEX_MAX_VSIE_LEN) {
++ mwifiex_dbg(priv->adapter, ERROR,
++ "Invalid param length!\n");
++ break;
++ }
++
+ memcpy(vs_param_set->ie, priv->vs_ie[id].ie,
+ le16_to_cpu(vs_param_set->header.len));
+ *buffer += le16_to_cpu(vs_param_set->header.len) +
+diff --git a/drivers/net/wireless/marvell/mwifiex/wmm.c b/drivers/net/wireless/marvell/mwifiex/wmm.c
+index 64916ba15df5..429ea2752e6a 100644
+--- a/drivers/net/wireless/marvell/mwifiex/wmm.c
++++ b/drivers/net/wireless/marvell/mwifiex/wmm.c
+@@ -977,6 +977,10 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
+ "WMM Parameter Set Count: %d\n",
+ wmm_param_ie->qos_info_bitmap & mask);
+
++ if (wmm_param_ie->vend_hdr.len + 2 >
++ sizeof(struct ieee_types_wmm_parameter))
++ break;
++
+ memcpy((u8 *) &priv->curr_bss_params.bss_descriptor.
+ wmm_ie, wmm_param_ie,
+ wmm_param_ie->vend_hdr.len + 2);
+diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
+index c5f3cd4ed766..c3b0b10f95cb 100644
+--- a/drivers/pci/iov.c
++++ b/drivers/pci/iov.c
+@@ -188,10 +188,10 @@ int pci_iov_add_virtfn(struct pci_dev *dev, int id)
+ sprintf(buf, "virtfn%u", id);
+ rc = sysfs_create_link(&dev->dev.kobj, &virtfn->dev.kobj, buf);
+ if (rc)
+- goto failed2;
++ goto failed1;
+ rc = sysfs_create_link(&virtfn->dev.kobj, &dev->dev.kobj, "physfn");
+ if (rc)
+- goto failed3;
++ goto failed2;
+
+ kobject_uevent(&virtfn->dev.kobj, KOBJ_CHANGE);
+
+@@ -199,11 +199,10 @@ int pci_iov_add_virtfn(struct pci_dev *dev, int id)
+
+ return 0;
+
+-failed3:
+- sysfs_remove_link(&dev->dev.kobj, buf);
+ failed2:
+- pci_stop_and_remove_bus_device(virtfn);
++ sysfs_remove_link(&dev->dev.kobj, buf);
+ failed1:
++ pci_stop_and_remove_bus_device(virtfn);
+ pci_dev_put(dev);
+ failed0:
+ virtfn_remove_bus(dev->bus, bus);
+diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
+index 79b1824e83b4..8e5b00a420a5 100644
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -1820,12 +1820,18 @@ again:
+ /* restore size and flags */
+ list_for_each_entry(fail_res, &fail_head, list) {
+ struct resource *res = fail_res->res;
++ int idx;
+
+ res->start = fail_res->start;
+ res->end = fail_res->end;
+ res->flags = fail_res->flags;
+- if (fail_res->dev->subordinate)
+- res->flags = 0;
++
++ if (pci_is_bridge(fail_res->dev)) {
++ idx = res - &fail_res->dev->resource[0];
++ if (idx >= PCI_BRIDGE_RESOURCES &&
++ idx <= PCI_BRIDGE_RESOURCE_END)
++ res->flags = 0;
++ }
+ }
+ free_list(&fail_head);
+
+@@ -2066,12 +2072,18 @@ again:
+ /* restore size and flags */
+ list_for_each_entry(fail_res, &fail_head, list) {
+ struct resource *res = fail_res->res;
++ int idx;
+
+ res->start = fail_res->start;
+ res->end = fail_res->end;
+ res->flags = fail_res->flags;
+- if (fail_res->dev->subordinate)
+- res->flags = 0;
++
++ if (pci_is_bridge(fail_res->dev)) {
++ idx = res - &fail_res->dev->resource[0];
++ if (idx >= PCI_BRIDGE_RESOURCES &&
++ idx <= PCI_BRIDGE_RESOURCE_END)
++ res->flags = 0;
++ }
+ }
+ free_list(&fail_head);
+
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index ceb7ab3ba3d0..43431816412c 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -1186,7 +1186,7 @@ static int switchtec_init_isr(struct switchtec_dev *stdev)
+ if (nvecs < 0)
+ return nvecs;
+
+- event_irq = ioread32(&stdev->mmio_part_cfg->vep_vector_number);
++ event_irq = ioread16(&stdev->mmio_part_cfg->vep_vector_number);
+ if (event_irq < 0 || event_irq >= nvecs)
+ return -EFAULT;
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7778.c b/drivers/pinctrl/sh-pfc/pfc-r8a7778.c
+index 00d61d175249..c60fce1225b0 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7778.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7778.c
+@@ -2325,7 +2325,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ FN_ATAG0_A, 0, FN_REMOCON_B, 0,
+ /* IP0_11_8 [4] */
+ FN_SD1_DAT2_A, FN_MMC_D2, 0, FN_BS,
+- FN_ATADIR0_A, 0, FN_SDSELF_B, 0,
++ FN_ATADIR0_A, 0, FN_SDSELF_A, 0,
+ FN_PWM4_B, 0, 0, 0,
+ 0, 0, 0, 0,
+ /* IP0_7_5 [3] */
+@@ -2367,7 +2367,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ FN_TS_SDAT0_A, 0, 0, 0,
+ 0, 0, 0, 0,
+ /* IP1_10_8 [3] */
+- FN_SD1_CLK_B, FN_MMC_D6, 0, FN_A24,
++ FN_SD1_CD_A, FN_MMC_D6, 0, FN_A24,
+ FN_DREQ1_A, 0, FN_HRX0_B, FN_TS_SPSYNC0_A,
+ /* IP1_7_5 [3] */
+ FN_A23, FN_HTX0_B, FN_TX2_B, FN_DACK2_A,
+diff --git a/drivers/platform/x86/intel_mid_powerbtn.c b/drivers/platform/x86/intel_mid_powerbtn.c
+index 5ad44204a9c3..10dbd6cac48a 100644
+--- a/drivers/platform/x86/intel_mid_powerbtn.c
++++ b/drivers/platform/x86/intel_mid_powerbtn.c
+@@ -158,9 +158,10 @@ static int mid_pb_probe(struct platform_device *pdev)
+
+ input_set_capability(input, EV_KEY, KEY_POWER);
+
+- ddata = (struct mid_pb_ddata *)id->driver_data;
++ ddata = devm_kmemdup(&pdev->dev, (void *)id->driver_data,
++ sizeof(*ddata), GFP_KERNEL);
+ if (!ddata)
+- return -ENODATA;
++ return -ENOMEM;
+
+ ddata->dev = &pdev->dev;
+ ddata->irq = irq;
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index a5a19ff10535..0fa94d9e8d44 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -854,7 +854,7 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
+ rtc_cmos_int_handler = cmos_interrupt;
+
+ retval = request_irq(rtc_irq, rtc_cmos_int_handler,
+- IRQF_SHARED, dev_name(&cmos_rtc.rtc->dev),
++ 0, dev_name(&cmos_rtc.rtc->dev),
+ cmos_rtc.rtc);
+ if (retval < 0) {
+ dev_dbg(dev, "IRQ %d is already in use\n", rtc_irq);
+diff --git a/drivers/rtc/rtc-hym8563.c b/drivers/rtc/rtc-hym8563.c
+index e5ad527cb75e..a8c2d38b2411 100644
+--- a/drivers/rtc/rtc-hym8563.c
++++ b/drivers/rtc/rtc-hym8563.c
+@@ -105,7 +105,7 @@ static int hym8563_rtc_read_time(struct device *dev, struct rtc_time *tm)
+
+ if (!hym8563->valid) {
+ dev_warn(&client->dev, "no valid clock/calendar values available\n");
+- return -EPERM;
++ return -EINVAL;
+ }
+
+ ret = i2c_smbus_read_i2c_block_data(client, HYM8563_SEC, 7, buf);
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 99469f9057ee..21f971447dd8 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -4177,7 +4177,8 @@ dcmd_timeout_ocr_possible(struct megasas_instance *instance) {
+ if (instance->adapter_type == MFI_SERIES)
+ return KILL_ADAPTER;
+ else if (instance->unload ||
+- test_bit(MEGASAS_FUSION_IN_RESET, &instance->reset_flags))
++ test_bit(MEGASAS_FUSION_OCR_NOT_POSSIBLE,
++ &instance->reset_flags))
+ return IGNORE_TIMEOUT;
+ else
+ return INITIATE_OCR;
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index f45c54f02bfa..b094a4e55c32 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -4558,6 +4558,7 @@ int megasas_reset_fusion(struct Scsi_Host *shost, int reason)
+ if (instance->requestorId && !instance->skip_heartbeat_timer_del)
+ del_timer_sync(&instance->sriov_heartbeat_timer);
+ set_bit(MEGASAS_FUSION_IN_RESET, &instance->reset_flags);
++ set_bit(MEGASAS_FUSION_OCR_NOT_POSSIBLE, &instance->reset_flags);
+ atomic_set(&instance->adprecovery, MEGASAS_ADPRESET_SM_POLLING);
+ instance->instancet->disable_intr(instance);
+ megasas_sync_irqs((unsigned long)instance);
+@@ -4747,7 +4748,7 @@ fail_kill_adapter:
+ atomic_set(&instance->adprecovery, MEGASAS_HBA_OPERATIONAL);
+ }
+ out:
+- clear_bit(MEGASAS_FUSION_IN_RESET, &instance->reset_flags);
++ clear_bit(MEGASAS_FUSION_OCR_NOT_POSSIBLE, &instance->reset_flags);
+ mutex_unlock(&instance->reset_mutex);
+ return retval;
+ }
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.h b/drivers/scsi/megaraid/megaraid_sas_fusion.h
+index 8e5ebee6517f..df7bbd0354e9 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.h
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.h
+@@ -102,6 +102,7 @@ enum MR_RAID_FLAGS_IO_SUB_TYPE {
+
+ #define MEGASAS_FP_CMD_LEN 16
+ #define MEGASAS_FUSION_IN_RESET 0
++#define MEGASAS_FUSION_OCR_NOT_POSSIBLE 1
+ #define THRESHOLD_REPLY_COUNT 50
+ #define RAID_1_PEER_CMDS 2
+ #define JBOD_MAPS_COUNT 2
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index af01be59a721..f4fcaee41dc2 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -6685,7 +6685,8 @@ static int ufshcd_probe_hba(struct ufs_hba *hba)
+ ufshcd_init_icc_levels(hba);
+
+ /* Add required well known logical units to scsi mid layer */
+- if (ufshcd_scsi_add_wlus(hba))
++ ret = ufshcd_scsi_add_wlus(hba);
++ if (ret)
+ goto out;
+
+ /* Initialize devfreq after UFS device is detected */
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index eb72dba71d83..62a7b80801d2 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -12,6 +12,8 @@
+
+ #include "internals.h"
+
++#define SPI_MEM_MAX_BUSWIDTH 4
++
+ /**
+ * spi_controller_dma_map_mem_op_data() - DMA-map the buffer attached to a
+ * memory operation
+@@ -149,6 +151,44 @@ static bool spi_mem_default_supports_op(struct spi_mem *mem,
+ }
+ EXPORT_SYMBOL_GPL(spi_mem_default_supports_op);
+
++static bool spi_mem_buswidth_is_valid(u8 buswidth)
++{
++ if (hweight8(buswidth) > 1 || buswidth > SPI_MEM_MAX_BUSWIDTH)
++ return false;
++
++ return true;
++}
++
++static int spi_mem_check_op(const struct spi_mem_op *op)
++{
++ if (!op->cmd.buswidth)
++ return -EINVAL;
++
++ if ((op->addr.nbytes && !op->addr.buswidth) ||
++ (op->dummy.nbytes && !op->dummy.buswidth) ||
++ (op->data.nbytes && !op->data.buswidth))
++ return -EINVAL;
++
++ if (!spi_mem_buswidth_is_valid(op->cmd.buswidth) ||
++ !spi_mem_buswidth_is_valid(op->addr.buswidth) ||
++ !spi_mem_buswidth_is_valid(op->dummy.buswidth) ||
++ !spi_mem_buswidth_is_valid(op->data.buswidth))
++ return -EINVAL;
++
++ return 0;
++}
++
++static bool spi_mem_internal_supports_op(struct spi_mem *mem,
++ const struct spi_mem_op *op)
++{
++ struct spi_controller *ctlr = mem->spi->controller;
++
++ if (ctlr->mem_ops && ctlr->mem_ops->supports_op)
++ return ctlr->mem_ops->supports_op(mem, op);
++
++ return spi_mem_default_supports_op(mem, op);
++}
++
+ /**
+ * spi_mem_supports_op() - Check if a memory device and the controller it is
+ * connected to support a specific memory operation
+@@ -166,12 +206,10 @@ EXPORT_SYMBOL_GPL(spi_mem_default_supports_op);
+ */
+ bool spi_mem_supports_op(struct spi_mem *mem, const struct spi_mem_op *op)
+ {
+- struct spi_controller *ctlr = mem->spi->controller;
+-
+- if (ctlr->mem_ops && ctlr->mem_ops->supports_op)
+- return ctlr->mem_ops->supports_op(mem, op);
++ if (spi_mem_check_op(op))
++ return false;
+
+- return spi_mem_default_supports_op(mem, op);
++ return spi_mem_internal_supports_op(mem, op);
+ }
+ EXPORT_SYMBOL_GPL(spi_mem_supports_op);
+
+@@ -196,7 +234,11 @@ int spi_mem_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
+ u8 *tmpbuf;
+ int ret;
+
+- if (!spi_mem_supports_op(mem, op))
++ ret = spi_mem_check_op(op);
++ if (ret)
++ return ret;
++
++ if (!spi_mem_internal_supports_op(mem, op))
+ return -ENOTSUPP;
+
+ if (ctlr->mem_ops) {
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index 66d49d511885..31950a38f0fb 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -26,6 +26,7 @@
+ #include <linux/of.h>
+ #include <linux/module.h>
+ #include <linux/pm_runtime.h>
++#include <linux/iopoll.h>
+
+ #define CDNS_UART_TTY_NAME "ttyPS"
+ #define CDNS_UART_NAME "xuartps"
+@@ -34,6 +35,7 @@
+ #define CDNS_UART_NR_PORTS 2
+ #define CDNS_UART_FIFO_SIZE 64 /* FIFO size */
+ #define CDNS_UART_REGISTER_SPACE 0x1000
++#define TX_TIMEOUT 500000
+
+ /* Rx Trigger level */
+ static int rx_trigger_level = 56;
+@@ -681,18 +683,21 @@ static void cdns_uart_set_termios(struct uart_port *port,
+ unsigned int cval = 0;
+ unsigned int baud, minbaud, maxbaud;
+ unsigned long flags;
+- unsigned int ctrl_reg, mode_reg;
+-
+- spin_lock_irqsave(&port->lock, flags);
++ unsigned int ctrl_reg, mode_reg, val;
++ int err;
+
+ /* Wait for the transmit FIFO to empty before making changes */
+ if (!(readl(port->membase + CDNS_UART_CR) &
+ CDNS_UART_CR_TX_DIS)) {
+- while (!(readl(port->membase + CDNS_UART_SR) &
+- CDNS_UART_SR_TXEMPTY)) {
+- cpu_relax();
++ err = readl_poll_timeout(port->membase + CDNS_UART_SR,
++ val, (val & CDNS_UART_SR_TXEMPTY),
++ 1000, TX_TIMEOUT);
++ if (err) {
++ dev_err(port->dev, "timed out waiting for tx empty");
++ return;
+ }
+ }
++ spin_lock_irqsave(&port->lock, flags);
+
+ /* Disable the TX and RX to set baud rate */
+ ctrl_reg = readl(port->membase + CDNS_UART_CR);
+diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
+index 5f93cfacb3d1..ac3e06367cb6 100644
+--- a/fs/nfs/Kconfig
++++ b/fs/nfs/Kconfig
+@@ -89,7 +89,7 @@ config NFS_V4
+ config NFS_SWAP
+ bool "Provide swap over NFS support"
+ default n
+- depends on NFS_FS
++ depends on NFS_FS && SWAP
+ select SUNRPC_SWAP
+ help
+ This option enables swapon to work on files located on NFS mounts.
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index 29b70337dcd9..c61bd3fc723e 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -261,10 +261,10 @@ static int nfs_direct_cmp_commit_data_verf(struct nfs_direct_req *dreq,
+ data->ds_commit_index);
+
+ /* verifier not set so always fail */
+- if (verfp->committed < 0)
++ if (verfp->committed < 0 || data->res.verf->committed <= NFS_UNSTABLE)
+ return 1;
+
+- return nfs_direct_cmp_verf(verfp, &data->verf);
++ return nfs_direct_cmp_verf(verfp, data->res.verf);
+ }
+
+ /**
+diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
+index 64e4fa33d89f..9956453aa6ff 100644
+--- a/fs/nfs/nfs3xdr.c
++++ b/fs/nfs/nfs3xdr.c
+@@ -2380,6 +2380,7 @@ static int nfs3_xdr_dec_commit3res(struct rpc_rqst *req,
+ void *data)
+ {
+ struct nfs_commitres *result = data;
++ struct nfs_writeverf *verf = result->verf;
+ enum nfs_stat status;
+ int error;
+
+@@ -2392,7 +2393,9 @@ static int nfs3_xdr_dec_commit3res(struct rpc_rqst *req,
+ result->op_status = status;
+ if (status != NFS3_OK)
+ goto out_status;
+- error = decode_writeverf3(xdr, &result->verf->verifier);
++ error = decode_writeverf3(xdr, &verf->verifier);
++ if (!error)
++ verf->committed = NFS_FILE_SYNC;
+ out:
+ return error;
+ out_status:
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 7834b325394f..fad795041d32 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3089,6 +3089,11 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir,
+ exception.retry = 1;
+ continue;
+ }
++ if (status == -NFS4ERR_EXPIRED) {
++ nfs4_schedule_lease_recovery(server->nfs_client);
++ exception.retry = 1;
++ continue;
++ }
+ if (status == -EAGAIN) {
+ /* We must have found a delegation */
+ exception.retry = 1;
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index 1c0227c78a7b..c4cf0192d7bb 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -4439,11 +4439,14 @@ static int decode_write_verifier(struct xdr_stream *xdr, struct nfs_write_verifi
+
+ static int decode_commit(struct xdr_stream *xdr, struct nfs_commitres *res)
+ {
++ struct nfs_writeverf *verf = res->verf;
+ int status;
+
+ status = decode_op_hdr(xdr, OP_COMMIT);
+ if (!status)
+- status = decode_write_verifier(xdr, &res->verf->verifier);
++ status = decode_write_verifier(xdr, &verf->verifier);
++ if (!status)
++ verf->committed = NFS_FILE_SYNC;
+ return status;
+ }
+
+diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
+index d5e4d3cd8c7f..acfb52bc0007 100644
+--- a/fs/nfs/pnfs_nfs.c
++++ b/fs/nfs/pnfs_nfs.c
+@@ -30,12 +30,11 @@ EXPORT_SYMBOL_GPL(pnfs_generic_rw_release);
+ /* Fake up some data that will cause nfs_commit_release to retry the writes. */
+ void pnfs_generic_prepare_to_resend_writes(struct nfs_commit_data *data)
+ {
+- struct nfs_page *first = nfs_list_entry(data->pages.next);
++ struct nfs_writeverf *verf = data->res.verf;
+
+ data->task.tk_status = 0;
+- memcpy(&data->verf.verifier, &first->wb_verf,
+- sizeof(data->verf.verifier));
+- data->verf.verifier.data[0]++; /* ensure verifier mismatch */
++ memset(&verf->verifier, 0, sizeof(verf->verifier));
++ verf->committed = NFS_UNSTABLE;
+ }
+ EXPORT_SYMBOL_GPL(pnfs_generic_prepare_to_resend_writes);
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index e27637fa0f79..ce1da8cbac00 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -240,7 +240,15 @@ out:
+ /* A writeback failed: mark the page as bad, and invalidate the page cache */
+ static void nfs_set_pageerror(struct address_space *mapping)
+ {
++ struct inode *inode = mapping->host;
++
+ nfs_zap_mapping(mapping->host, mapping);
++ /* Force file size revalidation */
++ spin_lock(&inode->i_lock);
++ NFS_I(inode)->cache_validity |= NFS_INO_REVAL_FORCED |
++ NFS_INO_REVAL_PAGECACHE |
++ NFS_INO_INVALID_SIZE;
++ spin_unlock(&inode->i_lock);
+ }
+
+ /*
+@@ -1806,6 +1814,7 @@ static void nfs_commit_done(struct rpc_task *task, void *calldata)
+
+ static void nfs_commit_release_pages(struct nfs_commit_data *data)
+ {
++ const struct nfs_writeverf *verf = data->res.verf;
+ struct nfs_page *req;
+ int status = data->task.tk_status;
+ struct nfs_commit_info cinfo;
+@@ -1832,7 +1841,8 @@ static void nfs_commit_release_pages(struct nfs_commit_data *data)
+
+ /* Okay, COMMIT succeeded, apparently. Check the verifier
+ * returned by the server against all stored verfs. */
+- if (!nfs_write_verifier_cmp(&req->wb_verf, &data->verf.verifier)) {
++ if (verf->committed > NFS_UNSTABLE &&
++ !nfs_write_verifier_cmp(&req->wb_verf, &verf->verifier)) {
+ /* We have a match */
+ if (req->wb_page)
+ nfs_inode_remove_request(req);
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index 54e4d1fd21f8..874cd6e94093 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -3864,6 +3864,9 @@ static inline int ib_check_mr_access(int flags)
+ !(flags & IB_ACCESS_LOCAL_WRITE))
+ return -EINVAL;
+
++ if (flags & ~IB_ACCESS_SUPPORTED)
++ return -EINVAL;
++
+ return 0;
+ }
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 11c5f9c8779e..cfab62923c45 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -510,6 +510,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,
+ atomic_set(&pd->seq_nr, -1);
+ atomic_set(&pd->reorder_objects, 0);
+ atomic_set(&pd->refcnt, 1);
++ pd->pinst = pinst;
+ spin_lock_init(&pd->lock);
+
+ return pd;
+diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
+index 70350dc67366..db6ca51228d2 100644
+--- a/net/vmw_vsock/hyperv_transport.c
++++ b/net/vmw_vsock/hyperv_transport.c
+@@ -144,28 +144,15 @@ struct hvsock {
+ ****************************************************************************
+ * The only valid Service GUIDs, from the perspectives of both the host and *
+ * Linux VM, that can be connected by the other end, must conform to this *
+- * format: <port>-facb-11e6-bd58-64006a7986d3, and the "port" must be in *
+- * this range [0, 0x7FFFFFFF]. *
++ * format: <port>-facb-11e6-bd58-64006a7986d3. *
+ ****************************************************************************
+ *
+ * When we write apps on the host to connect(), the GUID ServiceID is used.
+ * When we write apps in Linux VM to connect(), we only need to specify the
+ * port and the driver will form the GUID and use that to request the host.
+ *
+- * From the perspective of Linux VM:
+- * 1. the local ephemeral port (i.e. the local auto-bound port when we call
+- * connect() without explicit bind()) is generated by __vsock_bind_stream(),
+- * and the range is [1024, 0xFFFFFFFF).
+- * 2. the remote ephemeral port (i.e. the auto-generated remote port for
+- * a connect request initiated by the host's connect()) is generated by
+- * hvs_remote_addr_init() and the range is [0x80000000, 0xFFFFFFFF).
+ */
+
+-#define MAX_LISTEN_PORT ((u32)0x7FFFFFFF)
+-#define MAX_VM_LISTEN_PORT MAX_LISTEN_PORT
+-#define MAX_HOST_LISTEN_PORT MAX_LISTEN_PORT
+-#define MIN_HOST_EPHEMERAL_PORT (MAX_HOST_LISTEN_PORT + 1)
+-
+ /* 00000000-facb-11e6-bd58-64006a7986d3 */
+ static const uuid_le srv_id_template =
+ UUID_LE(0x00000000, 0xfacb, 0x11e6, 0xbd, 0x58,
+@@ -188,33 +175,6 @@ static void hvs_addr_init(struct sockaddr_vm *addr, const uuid_le *svr_id)
+ vsock_addr_init(addr, VMADDR_CID_ANY, port);
+ }
+
+-static void hvs_remote_addr_init(struct sockaddr_vm *remote,
+- struct sockaddr_vm *local)
+-{
+- static u32 host_ephemeral_port = MIN_HOST_EPHEMERAL_PORT;
+- struct sock *sk;
+-
+- vsock_addr_init(remote, VMADDR_CID_ANY, VMADDR_PORT_ANY);
+-
+- while (1) {
+- /* Wrap around ? */
+- if (host_ephemeral_port < MIN_HOST_EPHEMERAL_PORT ||
+- host_ephemeral_port == VMADDR_PORT_ANY)
+- host_ephemeral_port = MIN_HOST_EPHEMERAL_PORT;
+-
+- remote->svm_port = host_ephemeral_port++;
+-
+- sk = vsock_find_connected_socket(remote, local);
+- if (!sk) {
+- /* Found an available ephemeral port */
+- return;
+- }
+-
+- /* Release refcnt got in vsock_find_connected_socket */
+- sock_put(sk);
+- }
+-}
+-
+ static void hvs_set_channel_pending_send_size(struct vmbus_channel *chan)
+ {
+ set_channel_pending_send_size(chan,
+@@ -342,12 +302,7 @@ static void hvs_open_connection(struct vmbus_channel *chan)
+ if_type = &chan->offermsg.offer.if_type;
+ if_instance = &chan->offermsg.offer.if_instance;
+ conn_from_host = chan->offermsg.offer.u.pipe.user_def[0];
+-
+- /* The host or the VM should only listen on a port in
+- * [0, MAX_LISTEN_PORT]
+- */
+- if (!is_valid_srv_id(if_type) ||
+- get_port_by_srv_id(if_type) > MAX_LISTEN_PORT)
++ if (!is_valid_srv_id(if_type))
+ return;
+
+ hvs_addr_init(&addr, conn_from_host ? if_type : if_instance);
+@@ -371,6 +326,13 @@ static void hvs_open_connection(struct vmbus_channel *chan)
+
+ new->sk_state = TCP_SYN_SENT;
+ vnew = vsock_sk(new);
++
++ hvs_addr_init(&vnew->local_addr, if_type);
++
++ /* Remote peer is always the host */
++ vsock_addr_init(&vnew->remote_addr,
++ VMADDR_CID_HOST, VMADDR_PORT_ANY);
++ vnew->remote_addr.svm_port = get_port_by_srv_id(if_instance);
+ hvs_new = vnew->trans;
+ hvs_new->chan = chan;
+ } else {
+@@ -410,8 +372,6 @@ static void hvs_open_connection(struct vmbus_channel *chan)
+ sk->sk_ack_backlog++;
+
+ hvs_addr_init(&vnew->local_addr, if_type);
+- hvs_remote_addr_init(&vnew->remote_addr, &vnew->local_addr);
+-
+ hvs_new->vm_srv_id = *if_type;
+ hvs_new->host_srv_id = *if_instance;
+
+@@ -716,16 +676,6 @@ static bool hvs_stream_is_active(struct vsock_sock *vsk)
+
+ static bool hvs_stream_allow(u32 cid, u32 port)
+ {
+- /* The host's port range [MIN_HOST_EPHEMERAL_PORT, 0xFFFFFFFF) is
+- * reserved as ephemeral ports, which are used as the host's ports
+- * when the host initiates connections.
+- *
+- * Perform this check in the guest so an immediate error is produced
+- * instead of a timeout.
+- */
+- if (port > MAX_HOST_LISTEN_PORT)
+- return false;
+-
+ if (cid == VMADDR_CID_HOST)
+ return true;
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 53fefa7c982f..f7d4a77028f2 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2341,42 +2341,81 @@ int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream,
+ }
+ EXPORT_SYMBOL_GPL(dpcm_be_dai_trigger);
+
++static int dpcm_dai_trigger_fe_be(struct snd_pcm_substream *substream,
++ int cmd, bool fe_first)
++{
++ struct snd_soc_pcm_runtime *fe = substream->private_data;
++ int ret;
++
++ /* call trigger on the frontend before the backend. */
++ if (fe_first) {
++ dev_dbg(fe->dev, "ASoC: pre trigger FE %s cmd %d\n",
++ fe->dai_link->name, cmd);
++
++ ret = soc_pcm_trigger(substream, cmd);
++ if (ret < 0)
++ return ret;
++
++ ret = dpcm_be_dai_trigger(fe, substream->stream, cmd);
++ return ret;
++ }
++
++ /* call trigger on the frontend after the backend. */
++ ret = dpcm_be_dai_trigger(fe, substream->stream, cmd);
++ if (ret < 0)
++ return ret;
++
++ dev_dbg(fe->dev, "ASoC: post trigger FE %s cmd %d\n",
++ fe->dai_link->name, cmd);
++
++ ret = soc_pcm_trigger(substream, cmd);
++
++ return ret;
++}
++
+ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
+ {
+ struct snd_soc_pcm_runtime *fe = substream->private_data;
+- int stream = substream->stream, ret;
++ int stream = substream->stream;
++ int ret = 0;
+ enum snd_soc_dpcm_trigger trigger = fe->dai_link->trigger[stream];
+
+ fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
+
+ switch (trigger) {
+ case SND_SOC_DPCM_TRIGGER_PRE:
+- /* call trigger on the frontend before the backend. */
+-
+- dev_dbg(fe->dev, "ASoC: pre trigger FE %s cmd %d\n",
+- fe->dai_link->name, cmd);
+-
+- ret = soc_pcm_trigger(substream, cmd);
+- if (ret < 0) {
+- dev_err(fe->dev,"ASoC: trigger FE failed %d\n", ret);
+- goto out;
++ switch (cmd) {
++ case SNDRV_PCM_TRIGGER_START:
++ case SNDRV_PCM_TRIGGER_RESUME:
++ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++ ret = dpcm_dai_trigger_fe_be(substream, cmd, true);
++ break;
++ case SNDRV_PCM_TRIGGER_STOP:
++ case SNDRV_PCM_TRIGGER_SUSPEND:
++ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
++ ret = dpcm_dai_trigger_fe_be(substream, cmd, false);
++ break;
++ default:
++ ret = -EINVAL;
++ break;
+ }
+-
+- ret = dpcm_be_dai_trigger(fe, substream->stream, cmd);
+ break;
+ case SND_SOC_DPCM_TRIGGER_POST:
+- /* call trigger on the frontend after the backend. */
+-
+- ret = dpcm_be_dai_trigger(fe, substream->stream, cmd);
+- if (ret < 0) {
+- dev_err(fe->dev,"ASoC: trigger FE failed %d\n", ret);
+- goto out;
++ switch (cmd) {
++ case SNDRV_PCM_TRIGGER_START:
++ case SNDRV_PCM_TRIGGER_RESUME:
++ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++ ret = dpcm_dai_trigger_fe_be(substream, cmd, false);
++ break;
++ case SNDRV_PCM_TRIGGER_STOP:
++ case SNDRV_PCM_TRIGGER_SUSPEND:
++ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
++ ret = dpcm_dai_trigger_fe_be(substream, cmd, true);
++ break;
++ default:
++ ret = -EINVAL;
++ break;
+ }
+-
+- dev_dbg(fe->dev, "ASoC: post trigger FE %s cmd %d\n",
+- fe->dai_link->name, cmd);
+-
+- ret = soc_pcm_trigger(substream, cmd);
+ break;
+ case SND_SOC_DPCM_TRIGGER_BESPOKE:
+ /* bespoke trigger() - handles both FE and BEs */
+@@ -2385,10 +2424,6 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
+ fe->dai_link->name, cmd);
+
+ ret = soc_pcm_bespoke_trigger(substream, cmd);
+- if (ret < 0) {
+- dev_err(fe->dev,"ASoC: trigger FE failed %d\n", ret);
+- goto out;
+- }
+ break;
+ default:
+ dev_err(fe->dev, "ASoC: invalid trigger cmd %d for %s\n", cmd,
+@@ -2397,6 +2432,12 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
+ goto out;
+ }
+
++ if (ret < 0) {
++ dev_err(fe->dev, "ASoC: trigger FE cmd: %d failed: %d\n",
++ cmd, ret);
++ goto out;
++ }
++
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_RESUME:
+diff --git a/tools/power/acpi/Makefile.config b/tools/power/acpi/Makefile.config
+index f304be71c278..fc116c060b98 100644
+--- a/tools/power/acpi/Makefile.config
++++ b/tools/power/acpi/Makefile.config
+@@ -18,7 +18,7 @@ include $(srctree)/../../scripts/Makefile.include
+
+ OUTPUT=$(srctree)/
+ ifeq ("$(origin O)", "command line")
+- OUTPUT := $(O)/power/acpi/
++ OUTPUT := $(O)/tools/power/acpi/
+ endif
+ #$(info Determined 'OUTPUT' to be $(OUTPUT))
+
+diff --git a/virt/kvm/arm/aarch32.c b/virt/kvm/arm/aarch32.c
+index d915548759a4..18d6d5124397 100644
+--- a/virt/kvm/arm/aarch32.c
++++ b/virt/kvm/arm/aarch32.c
+@@ -26,6 +26,10 @@
+ #include <asm/kvm_emulate.h>
+ #include <asm/kvm_hyp.h>
+
++#define DFSR_FSC_EXTABT_LPAE 0x10
++#define DFSR_FSC_EXTABT_nLPAE 0x08
++#define DFSR_LPAE BIT(9)
++
+ /*
+ * Table taken from ARMv8 ARM DDI0487B-B, table G1-10.
+ */
+@@ -192,10 +196,12 @@ static void inject_abt32(struct kvm_vcpu *vcpu, bool is_pabt,
+
+ /* Give the guest an IMPLEMENTATION DEFINED exception */
+ is_lpae = (vcpu_cp15(vcpu, c2_TTBCR) >> 31);
+- if (is_lpae)
+- *fsr = 1 << 9 | 0x34;
+- else
+- *fsr = 0x14;
++ if (is_lpae) {
++ *fsr = DFSR_LPAE | DFSR_FSC_EXTABT_LPAE;
++ } else {
++ /* no need to shuffle FS[4] into DFSR[10] as its 0 */
++ *fsr = DFSR_FSC_EXTABT_nLPAE;
++ }
+ }
+
+ void kvm_inject_dabt32(struct kvm_vcpu *vcpu, unsigned long addr)
+diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
+index bf330b493c1e..a5bc10d30618 100644
+--- a/virt/kvm/arm/mmu.c
++++ b/virt/kvm/arm/mmu.c
+@@ -1925,7 +1925,8 @@ int kvm_test_age_hva(struct kvm *kvm, unsigned long hva)
+ if (!kvm->arch.pgd)
+ return 0;
+ trace_kvm_test_age_hva(hva);
+- return handle_hva_to_gpa(kvm, hva, hva, kvm_test_age_hva_handler, NULL);
++ return handle_hva_to_gpa(kvm, hva, hva + PAGE_SIZE,
++ kvm_test_age_hva_handler, NULL);
+ }
+
+ void kvm_mmu_free_memory_caches(struct kvm_vcpu *vcpu)
+diff --git a/virt/kvm/arm/pmu.c b/virt/kvm/arm/pmu.c
+index 1c5b76c46e26..6d52fd50c1ff 100644
+--- a/virt/kvm/arm/pmu.c
++++ b/virt/kvm/arm/pmu.c
+@@ -316,6 +316,9 @@ void kvm_pmu_software_increment(struct kvm_vcpu *vcpu, u64 val)
+ if (val == 0)
+ return;
+
++ if (!(__vcpu_sys_reg(vcpu, PMCR_EL0) & ARMV8_PMU_PMCR_E))
++ return;
++
+ enable = __vcpu_sys_reg(vcpu, PMCNTENSET_EL0);
+ for (i = 0; i < ARMV8_PMU_CYCLE_IDX; i++) {
+ if (!(val & BIT(i)))
+diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
+index 0dbe332eb343..9295addea7ec 100644
+--- a/virt/kvm/arm/vgic/vgic-its.c
++++ b/virt/kvm/arm/vgic/vgic-its.c
+@@ -2292,7 +2292,8 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz)
+ target_addr = (u32)(val >> KVM_ITS_CTE_RDBASE_SHIFT);
+ coll_id = val & KVM_ITS_CTE_ICID_MASK;
+
+- if (target_addr >= atomic_read(&kvm->online_vcpus))
++ if (target_addr != COLLECTION_NOT_MAPPED &&
++ target_addr >= atomic_read(&kvm->online_vcpus))
+ return -EINVAL;
+
+ collection = find_collection(its, coll_id);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-02-19 23:45 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-02-19 23:45 UTC (permalink / raw
To: gentoo-commits
commit: 0e48f80db777845a4ff23c262674ad2515652533
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 19 23:44:50 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Feb 19 23:44:50 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0e48f80d
Linux patch 4.19.105
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1104_linux-4.19.105.patch | 1521 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1525 insertions(+)
diff --git a/0000_README b/0000_README
index 6839197..f83fdcc 100644
--- a/0000_README
+++ b/0000_README
@@ -455,6 +455,10 @@ Patch: 1103_linux-4.19.104.patch
From: https://www.kernel.org
Desc: Linux 4.19.104
+Patch: 1104_linux-4.19.105.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.105
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1104_linux-4.19.105.patch b/1104_linux-4.19.105.patch
new file mode 100644
index 0000000..183f892
--- /dev/null
+++ b/1104_linux-4.19.105.patch
@@ -0,0 +1,1521 @@
+diff --git a/Makefile b/Makefile
+index 004d964cca50..eef7de60cd94 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 104
++SUBLEVEL = 105
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/mach-npcm/Kconfig b/arch/arm/mach-npcm/Kconfig
+index 684c9c9a32bd..1d17515deb4e 100644
+--- a/arch/arm/mach-npcm/Kconfig
++++ b/arch/arm/mach-npcm/Kconfig
+@@ -10,7 +10,7 @@ config ARCH_NPCM7XX
+ depends on ARCH_MULTI_V7
+ select PINCTRL_NPCM7XX
+ select NPCM7XX_TIMER
+- select ARCH_REQUIRE_GPIOLIB
++ select GPIOLIB
+ select CACHE_L2X0
+ select ARM_GIC
+ select HAVE_ARM_TWD if SMP
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index 1375307fbe4d..ac3126aba036 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -42,9 +42,7 @@ EXPORT_SYMBOL_GPL(elf_hwcap);
+ #define COMPAT_ELF_HWCAP_DEFAULT \
+ (COMPAT_HWCAP_HALF|COMPAT_HWCAP_THUMB|\
+ COMPAT_HWCAP_FAST_MULT|COMPAT_HWCAP_EDSP|\
+- COMPAT_HWCAP_TLS|COMPAT_HWCAP_VFP|\
+- COMPAT_HWCAP_VFPv3|COMPAT_HWCAP_VFPv4|\
+- COMPAT_HWCAP_NEON|COMPAT_HWCAP_IDIV|\
++ COMPAT_HWCAP_TLS|COMPAT_HWCAP_IDIV|\
+ COMPAT_HWCAP_LPAE)
+ unsigned int compat_elf_hwcap __read_mostly = COMPAT_ELF_HWCAP_DEFAULT;
+ unsigned int compat_elf_hwcap2 __read_mostly;
+@@ -1341,17 +1339,30 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
+ {},
+ };
+
+-#define HWCAP_CAP(reg, field, s, min_value, cap_type, cap) \
+- { \
+- .desc = #cap, \
+- .type = ARM64_CPUCAP_SYSTEM_FEATURE, \
++
++#define HWCAP_CPUID_MATCH(reg, field, s, min_value) \
+ .matches = has_cpuid_feature, \
+ .sys_reg = reg, \
+ .field_pos = field, \
+ .sign = s, \
+ .min_field_value = min_value, \
++
++#define __HWCAP_CAP(name, cap_type, cap) \
++ .desc = name, \
++ .type = ARM64_CPUCAP_SYSTEM_FEATURE, \
+ .hwcap_type = cap_type, \
+ .hwcap = cap, \
++
++#define HWCAP_CAP(reg, field, s, min_value, cap_type, cap) \
++ { \
++ __HWCAP_CAP(#cap, cap_type, cap) \
++ HWCAP_CPUID_MATCH(reg, field, s, min_value) \
++ }
++
++#define HWCAP_CAP_MATCH(match, cap_type, cap) \
++ { \
++ __HWCAP_CAP(#cap, cap_type, cap) \
++ .matches = match, \
+ }
+
+ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = {
+@@ -1387,8 +1398,35 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = {
+ {},
+ };
+
++#ifdef CONFIG_COMPAT
++static bool compat_has_neon(const struct arm64_cpu_capabilities *cap, int scope)
++{
++ /*
++ * Check that all of MVFR1_EL1.{SIMDSP, SIMDInt, SIMDLS} are available,
++ * in line with that of arm32 as in vfp_init(). We make sure that the
++ * check is future proof, by making sure value is non-zero.
++ */
++ u32 mvfr1;
++
++ WARN_ON(scope == SCOPE_LOCAL_CPU && preemptible());
++ if (scope == SCOPE_SYSTEM)
++ mvfr1 = read_sanitised_ftr_reg(SYS_MVFR1_EL1);
++ else
++ mvfr1 = read_sysreg_s(SYS_MVFR1_EL1);
++
++ return cpuid_feature_extract_unsigned_field(mvfr1, MVFR1_SIMDSP_SHIFT) &&
++ cpuid_feature_extract_unsigned_field(mvfr1, MVFR1_SIMDINT_SHIFT) &&
++ cpuid_feature_extract_unsigned_field(mvfr1, MVFR1_SIMDLS_SHIFT);
++}
++#endif
++
+ static const struct arm64_cpu_capabilities compat_elf_hwcaps[] = {
+ #ifdef CONFIG_COMPAT
++ HWCAP_CAP_MATCH(compat_has_neon, CAP_COMPAT_HWCAP, COMPAT_HWCAP_NEON),
++ HWCAP_CAP(SYS_MVFR1_EL1, MVFR1_SIMDFMAC_SHIFT, FTR_UNSIGNED, 1, CAP_COMPAT_HWCAP, COMPAT_HWCAP_VFPv4),
++ /* Arm v8 mandates MVFR0.FPDP == {0, 2}. So, piggy back on this for the presence of VFP support */
++ HWCAP_CAP(SYS_MVFR0_EL1, MVFR0_FPDP_SHIFT, FTR_UNSIGNED, 2, CAP_COMPAT_HWCAP, COMPAT_HWCAP_VFP),
++ HWCAP_CAP(SYS_MVFR0_EL1, MVFR0_FPDP_SHIFT, FTR_UNSIGNED, 2, CAP_COMPAT_HWCAP, COMPAT_HWCAP_VFPv3),
+ HWCAP_CAP(SYS_ID_ISAR5_EL1, ID_ISAR5_AES_SHIFT, FTR_UNSIGNED, 2, CAP_COMPAT_HWCAP2, COMPAT_HWCAP2_PMULL),
+ HWCAP_CAP(SYS_ID_ISAR5_EL1, ID_ISAR5_AES_SHIFT, FTR_UNSIGNED, 1, CAP_COMPAT_HWCAP2, COMPAT_HWCAP2_AES),
+ HWCAP_CAP(SYS_ID_ISAR5_EL1, ID_ISAR5_SHA1_SHIFT, FTR_UNSIGNED, 1, CAP_COMPAT_HWCAP2, COMPAT_HWCAP2_SHA1),
+diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
+index 58c53bc96928..14fdbaa6ee3a 100644
+--- a/arch/arm64/kernel/fpsimd.c
++++ b/arch/arm64/kernel/fpsimd.c
+@@ -218,6 +218,7 @@ static void sve_free(struct task_struct *task)
+ static void task_fpsimd_load(void)
+ {
+ WARN_ON(!in_softirq() && !irqs_disabled());
++ WARN_ON(!system_supports_fpsimd());
+
+ if (system_supports_sve() && test_thread_flag(TIF_SVE))
+ sve_load_state(sve_pffr(¤t->thread),
+@@ -238,6 +239,7 @@ void fpsimd_save(void)
+ struct user_fpsimd_state *st = __this_cpu_read(fpsimd_last_state.st);
+ /* set by fpsimd_bind_task_to_cpu() or fpsimd_bind_state_to_cpu() */
+
++ WARN_ON(!system_supports_fpsimd());
+ WARN_ON(!in_softirq() && !irqs_disabled());
+
+ if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) {
+@@ -977,6 +979,7 @@ void fpsimd_bind_task_to_cpu(void)
+ struct fpsimd_last_state_struct *last =
+ this_cpu_ptr(&fpsimd_last_state);
+
++ WARN_ON(!system_supports_fpsimd());
+ last->st = ¤t->thread.uw.fpsimd_state;
+ current->thread.fpsimd_cpu = smp_processor_id();
+
+@@ -996,6 +999,7 @@ void fpsimd_bind_state_to_cpu(struct user_fpsimd_state *st)
+ struct fpsimd_last_state_struct *last =
+ this_cpu_ptr(&fpsimd_last_state);
+
++ WARN_ON(!system_supports_fpsimd());
+ WARN_ON(!in_softirq() && !irqs_disabled());
+
+ last->st = st;
+@@ -1008,8 +1012,19 @@ void fpsimd_bind_state_to_cpu(struct user_fpsimd_state *st)
+ */
+ void fpsimd_restore_current_state(void)
+ {
+- if (!system_supports_fpsimd())
++ /*
++ * For the tasks that were created before we detected the absence of
++ * FP/SIMD, the TIF_FOREIGN_FPSTATE could be set via fpsimd_thread_switch(),
++ * e.g, init. This could be then inherited by the children processes.
++ * If we later detect that the system doesn't support FP/SIMD,
++ * we must clear the flag for all the tasks to indicate that the
++ * FPSTATE is clean (as we can't have one) to avoid looping for ever in
++ * do_notify_resume().
++ */
++ if (!system_supports_fpsimd()) {
++ clear_thread_flag(TIF_FOREIGN_FPSTATE);
+ return;
++ }
+
+ local_bh_disable();
+
+@@ -1028,7 +1043,7 @@ void fpsimd_restore_current_state(void)
+ */
+ void fpsimd_update_current_state(struct user_fpsimd_state const *state)
+ {
+- if (!system_supports_fpsimd())
++ if (WARN_ON(!system_supports_fpsimd()))
+ return;
+
+ local_bh_disable();
+@@ -1055,6 +1070,7 @@ void fpsimd_flush_task_state(struct task_struct *t)
+
+ void fpsimd_flush_cpu_state(void)
+ {
++ WARN_ON(!system_supports_fpsimd());
+ __this_cpu_write(fpsimd_last_state.st, NULL);
+ set_thread_flag(TIF_FOREIGN_FPSTATE);
+ }
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
+index d668c13218b8..d6a49bb07a5f 100644
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -414,6 +414,13 @@ static void ssbs_thread_switch(struct task_struct *next)
+ if (unlikely(next->flags & PF_KTHREAD))
+ return;
+
++ /*
++ * If all CPUs implement the SSBS extension, then we just need to
++ * context-switch the PSTATE field.
++ */
++ if (cpu_have_feature(cpu_feature(SSBS)))
++ return;
++
+ /* If the mitigation is enabled, then we leave SSBS clear. */
+ if ((arm64_get_ssbd_state() == ARM64_SSBD_FORCE_ENABLE) ||
+ test_tsk_thread_flag(next, TIF_SSBD))
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index 6290a4e81d57..f3978931aaf4 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -37,7 +37,15 @@
+ /* Check whether the FP regs were dirtied while in the host-side run loop: */
+ static bool __hyp_text update_fp_enabled(struct kvm_vcpu *vcpu)
+ {
+- if (vcpu->arch.host_thread_info->flags & _TIF_FOREIGN_FPSTATE)
++ /*
++ * When the system doesn't support FP/SIMD, we cannot rely on
++ * the _TIF_FOREIGN_FPSTATE flag. However, we always inject an
++ * abort on the very first access to FP and thus we should never
++ * see KVM_ARM64_FP_ENABLED. For added safety, make sure we always
++ * trap the accesses.
++ */
++ if (!system_supports_fpsimd() ||
++ vcpu->arch.host_thread_info->flags & _TIF_FOREIGN_FPSTATE)
+ vcpu->arch.flags &= ~(KVM_ARM64_FP_ENABLED |
+ KVM_ARM64_FP_HOST);
+
+diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
+index 2dc9eb4e1acc..b6a4ce9dafaf 100644
+--- a/arch/s390/include/asm/timex.h
++++ b/arch/s390/include/asm/timex.h
+@@ -155,7 +155,7 @@ static inline void get_tod_clock_ext(char *clk)
+
+ static inline unsigned long long get_tod_clock(void)
+ {
+- unsigned char clk[STORE_CLOCK_EXT_SIZE];
++ char clk[STORE_CLOCK_EXT_SIZE];
+
+ get_tod_clock_ext(clk);
+ return *((unsigned long long *)&clk[1]);
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index defb536aebce..c3ec535fd36b 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -245,6 +245,7 @@ static const u64 amd_f17h_perfmon_event_map[PERF_COUNT_HW_MAX] =
+ [PERF_COUNT_HW_CPU_CYCLES] = 0x0076,
+ [PERF_COUNT_HW_INSTRUCTIONS] = 0x00c0,
+ [PERF_COUNT_HW_CACHE_REFERENCES] = 0xff60,
++ [PERF_COUNT_HW_CACHE_MISSES] = 0x0964,
+ [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c2,
+ [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c3,
+ [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x0287,
+diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
+index e91814d1a27f..79caeba8b6f0 100644
+--- a/arch/x86/events/intel/ds.c
++++ b/arch/x86/events/intel/ds.c
+@@ -1402,6 +1402,8 @@ intel_pmu_save_and_restart_reload(struct perf_event *event, int count)
+ old = ((s64)(prev_raw_count << shift) >> shift);
+ local64_add(new - old + count * period, &event->count);
+
++ local64_set(&hwc->period_left, -new);
++
+ perf_event_update_userpage(event);
+
+ return 0;
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index 100ae4fabf17..61f10a4fd807 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -36,7 +36,7 @@
+ #define PT_GUEST_ACCESSED_SHIFT PT_ACCESSED_SHIFT
+ #define PT_HAVE_ACCESSED_DIRTY(mmu) true
+ #ifdef CONFIG_X86_64
+- #define PT_MAX_FULL_LEVELS 4
++ #define PT_MAX_FULL_LEVELS PT64_ROOT_MAX_LEVEL
+ #define CMPXCHG cmpxchg
+ #else
+ #define CMPXCHG cmpxchg64
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index 3791ce8d269e..997926a9121c 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -2968,6 +2968,9 @@ void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
+
+ static int get_ept_level(struct kvm_vcpu *vcpu)
+ {
++ /* Nested EPT currently only supports 4-level walks. */
++ if (is_guest_mode(vcpu) && nested_cpu_has_ept(get_vmcs12(vcpu)))
++ return 4;
+ if (cpu_has_vmx_ept_5levels() && (cpuid_maxphyaddr(vcpu) > 48))
+ return 5;
+ return 4;
+diff --git a/drivers/hwmon/pmbus/ltc2978.c b/drivers/hwmon/pmbus/ltc2978.c
+index 58b789c28b48..94eea2ac6251 100644
+--- a/drivers/hwmon/pmbus/ltc2978.c
++++ b/drivers/hwmon/pmbus/ltc2978.c
+@@ -89,8 +89,8 @@ enum chips { ltc2974, ltc2975, ltc2977, ltc2978, ltc2980, ltc3880, ltc3882,
+
+ #define LTC_POLL_TIMEOUT 100 /* in milli-seconds */
+
+-#define LTC_NOT_BUSY BIT(5)
+-#define LTC_NOT_PENDING BIT(4)
++#define LTC_NOT_BUSY BIT(6)
++#define LTC_NOT_PENDING BIT(5)
+
+ /*
+ * LTC2978 clears peak data whenever the CLEAR_FAULTS command is executed, which
+diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
+index b79b61bd6ee4..4e2565cccb8a 100644
+--- a/drivers/infiniband/core/security.c
++++ b/drivers/infiniband/core/security.c
+@@ -336,22 +336,16 @@ static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp,
+ if (!new_pps)
+ return NULL;
+
+- if (qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) {
+- if (!qp_pps) {
+- new_pps->main.port_num = qp_attr->port_num;
+- new_pps->main.pkey_index = qp_attr->pkey_index;
+- } else {
+- new_pps->main.port_num = (qp_attr_mask & IB_QP_PORT) ?
+- qp_attr->port_num :
+- qp_pps->main.port_num;
+-
+- new_pps->main.pkey_index =
+- (qp_attr_mask & IB_QP_PKEY_INDEX) ?
+- qp_attr->pkey_index :
+- qp_pps->main.pkey_index;
+- }
++ if (qp_attr_mask & IB_QP_PORT)
++ new_pps->main.port_num =
++ (qp_pps) ? qp_pps->main.port_num : qp_attr->port_num;
++ if (qp_attr_mask & IB_QP_PKEY_INDEX)
++ new_pps->main.pkey_index = (qp_pps) ? qp_pps->main.pkey_index :
++ qp_attr->pkey_index;
++ if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT))
+ new_pps->main.state = IB_PORT_PKEY_VALID;
+- } else if (qp_pps) {
++
++ if (!(qp_attr_mask & (IB_QP_PKEY_INDEX || IB_QP_PORT)) && qp_pps) {
+ new_pps->main.port_num = qp_pps->main.port_num;
+ new_pps->main.pkey_index = qp_pps->main.pkey_index;
+ if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index e012ca80f9d1..5e10a40fd26d 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -2914,12 +2914,6 @@ static int kern_spec_to_ib_spec_action(struct ib_uverbs_file *ufile,
+ return 0;
+ }
+
+-static size_t kern_spec_filter_sz(const struct ib_uverbs_flow_spec_hdr *spec)
+-{
+- /* Returns user space filter size, includes padding */
+- return (spec->size - sizeof(struct ib_uverbs_flow_spec_hdr)) / 2;
+-}
+-
+ static ssize_t spec_filter_size(const void *kern_spec_filter, u16 kern_filter_size,
+ u16 ib_real_filter_sz)
+ {
+@@ -3063,11 +3057,16 @@ int ib_uverbs_kern_spec_to_ib_spec_filter(enum ib_flow_spec_type type,
+ static int kern_spec_to_ib_spec_filter(struct ib_uverbs_flow_spec *kern_spec,
+ union ib_flow_spec *ib_spec)
+ {
+- ssize_t kern_filter_sz;
++ size_t kern_filter_sz;
+ void *kern_spec_mask;
+ void *kern_spec_val;
+
+- kern_filter_sz = kern_spec_filter_sz(&kern_spec->hdr);
++ if (check_sub_overflow((size_t)kern_spec->hdr.size,
++ sizeof(struct ib_uverbs_flow_spec_hdr),
++ &kern_filter_sz))
++ return -EINVAL;
++
++ kern_filter_sz /= 2;
+
+ kern_spec_val = (void *)kern_spec +
+ sizeof(struct ib_uverbs_flow_spec_hdr);
+diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
+index bedd5fba33b0..01ed0a667928 100644
+--- a/drivers/infiniband/hw/hfi1/affinity.c
++++ b/drivers/infiniband/hw/hfi1/affinity.c
+@@ -478,6 +478,8 @@ static int _dev_comp_vect_mappings_create(struct hfi1_devdata *dd,
+ rvt_get_ibdev_name(&(dd)->verbs_dev.rdi), i, cpu);
+ }
+
++ free_cpumask_var(available_cpus);
++ free_cpumask_var(non_intr_cpus);
+ return 0;
+
+ fail:
+diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
+index 34ffca618427..adeb259458de 100644
+--- a/drivers/infiniband/hw/hfi1/file_ops.c
++++ b/drivers/infiniband/hw/hfi1/file_ops.c
+@@ -200,23 +200,24 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
+
+ fd = kzalloc(sizeof(*fd), GFP_KERNEL);
+
+- if (fd) {
+- fd->rec_cpu_num = -1; /* no cpu affinity by default */
+- fd->mm = current->mm;
+- mmgrab(fd->mm);
+- fd->dd = dd;
+- kobject_get(&fd->dd->kobj);
+- fp->private_data = fd;
+- } else {
+- fp->private_data = NULL;
+-
+- if (atomic_dec_and_test(&dd->user_refcount))
+- complete(&dd->user_comp);
+-
+- return -ENOMEM;
+- }
+-
++ if (!fd || init_srcu_struct(&fd->pq_srcu))
++ goto nomem;
++ spin_lock_init(&fd->pq_rcu_lock);
++ spin_lock_init(&fd->tid_lock);
++ spin_lock_init(&fd->invalid_lock);
++ fd->rec_cpu_num = -1; /* no cpu affinity by default */
++ fd->mm = current->mm;
++ mmgrab(fd->mm);
++ fd->dd = dd;
++ kobject_get(&fd->dd->kobj);
++ fp->private_data = fd;
+ return 0;
++nomem:
++ kfree(fd);
++ fp->private_data = NULL;
++ if (atomic_dec_and_test(&dd->user_refcount))
++ complete(&dd->user_comp);
++ return -ENOMEM;
+ }
+
+ static long hfi1_file_ioctl(struct file *fp, unsigned int cmd,
+@@ -301,21 +302,30 @@ static long hfi1_file_ioctl(struct file *fp, unsigned int cmd,
+ static ssize_t hfi1_write_iter(struct kiocb *kiocb, struct iov_iter *from)
+ {
+ struct hfi1_filedata *fd = kiocb->ki_filp->private_data;
+- struct hfi1_user_sdma_pkt_q *pq = fd->pq;
++ struct hfi1_user_sdma_pkt_q *pq;
+ struct hfi1_user_sdma_comp_q *cq = fd->cq;
+ int done = 0, reqs = 0;
+ unsigned long dim = from->nr_segs;
++ int idx;
+
+- if (!cq || !pq)
++ idx = srcu_read_lock(&fd->pq_srcu);
++ pq = srcu_dereference(fd->pq, &fd->pq_srcu);
++ if (!cq || !pq) {
++ srcu_read_unlock(&fd->pq_srcu, idx);
+ return -EIO;
++ }
+
+- if (!iter_is_iovec(from) || !dim)
++ if (!iter_is_iovec(from) || !dim) {
++ srcu_read_unlock(&fd->pq_srcu, idx);
+ return -EINVAL;
++ }
+
+ trace_hfi1_sdma_request(fd->dd, fd->uctxt->ctxt, fd->subctxt, dim);
+
+- if (atomic_read(&pq->n_reqs) == pq->n_max_reqs)
++ if (atomic_read(&pq->n_reqs) == pq->n_max_reqs) {
++ srcu_read_unlock(&fd->pq_srcu, idx);
+ return -ENOSPC;
++ }
+
+ while (dim) {
+ int ret;
+@@ -333,6 +343,7 @@ static ssize_t hfi1_write_iter(struct kiocb *kiocb, struct iov_iter *from)
+ reqs++;
+ }
+
++ srcu_read_unlock(&fd->pq_srcu, idx);
+ return reqs;
+ }
+
+@@ -706,6 +717,7 @@ done:
+ if (atomic_dec_and_test(&dd->user_refcount))
+ complete(&dd->user_comp);
+
++ cleanup_srcu_struct(&fdata->pq_srcu);
+ kfree(fdata);
+ return 0;
+ }
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index 232fc4b59a98..ab981874c71c 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1376,10 +1376,13 @@ struct mmu_rb_handler;
+
+ /* Private data for file operations */
+ struct hfi1_filedata {
++ struct srcu_struct pq_srcu;
+ struct hfi1_devdata *dd;
+ struct hfi1_ctxtdata *uctxt;
+ struct hfi1_user_sdma_comp_q *cq;
+- struct hfi1_user_sdma_pkt_q *pq;
++ /* update side lock for SRCU */
++ spinlock_t pq_rcu_lock;
++ struct hfi1_user_sdma_pkt_q __rcu *pq;
+ u16 subctxt;
+ /* for cpu affinity; -1 if none */
+ int rec_cpu_num;
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+index 4e986ca4dd35..4e417ed08b09 100644
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+@@ -90,9 +90,6 @@ int hfi1_user_exp_rcv_init(struct hfi1_filedata *fd,
+ struct hfi1_devdata *dd = uctxt->dd;
+ int ret = 0;
+
+- spin_lock_init(&fd->tid_lock);
+- spin_lock_init(&fd->invalid_lock);
+-
+ fd->entry_to_rb = kcalloc(uctxt->expected_count,
+ sizeof(struct rb_node *),
+ GFP_KERNEL);
+@@ -165,10 +162,12 @@ void hfi1_user_exp_rcv_free(struct hfi1_filedata *fd)
+ if (fd->handler) {
+ hfi1_mmu_rb_unregister(fd->handler);
+ } else {
++ mutex_lock(&uctxt->exp_mutex);
+ if (!EXP_TID_SET_EMPTY(uctxt->tid_full_list))
+ unlock_exp_tids(uctxt, &uctxt->tid_full_list, fd);
+ if (!EXP_TID_SET_EMPTY(uctxt->tid_used_list))
+ unlock_exp_tids(uctxt, &uctxt->tid_used_list, fd);
++ mutex_unlock(&uctxt->exp_mutex);
+ }
+
+ kfree(fd->invalid_tids);
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index 684a298e1503..a3b08a9ef5ff 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -179,7 +179,6 @@ int hfi1_user_sdma_alloc_queues(struct hfi1_ctxtdata *uctxt,
+ pq = kzalloc(sizeof(*pq), GFP_KERNEL);
+ if (!pq)
+ return -ENOMEM;
+-
+ pq->dd = dd;
+ pq->ctxt = uctxt->ctxt;
+ pq->subctxt = fd->subctxt;
+@@ -236,7 +235,7 @@ int hfi1_user_sdma_alloc_queues(struct hfi1_ctxtdata *uctxt,
+ goto pq_mmu_fail;
+ }
+
+- fd->pq = pq;
++ rcu_assign_pointer(fd->pq, pq);
+ fd->cq = cq;
+
+ return 0;
+@@ -264,8 +263,14 @@ int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd,
+
+ trace_hfi1_sdma_user_free_queues(uctxt->dd, uctxt->ctxt, fd->subctxt);
+
+- pq = fd->pq;
++ spin_lock(&fd->pq_rcu_lock);
++ pq = srcu_dereference_check(fd->pq, &fd->pq_srcu,
++ lockdep_is_held(&fd->pq_rcu_lock));
+ if (pq) {
++ rcu_assign_pointer(fd->pq, NULL);
++ spin_unlock(&fd->pq_rcu_lock);
++ synchronize_srcu(&fd->pq_srcu);
++ /* at this point there can be no more new requests */
+ if (pq->handler)
+ hfi1_mmu_rb_unregister(pq->handler);
+ iowait_sdma_drain(&pq->busy);
+@@ -277,7 +282,8 @@ int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd,
+ kfree(pq->req_in_use);
+ kmem_cache_destroy(pq->txreq_cache);
+ kfree(pq);
+- fd->pq = NULL;
++ } else {
++ spin_unlock(&fd->pq_rcu_lock);
+ }
+ if (fd->cq) {
+ vfree(fd->cq->comps);
+@@ -321,7 +327,8 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ {
+ int ret = 0, i;
+ struct hfi1_ctxtdata *uctxt = fd->uctxt;
+- struct hfi1_user_sdma_pkt_q *pq = fd->pq;
++ struct hfi1_user_sdma_pkt_q *pq =
++ srcu_dereference(fd->pq, &fd->pq_srcu);
+ struct hfi1_user_sdma_comp_q *cq = fd->cq;
+ struct hfi1_devdata *dd = pq->dd;
+ unsigned long idx = 0;
+diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
+index 7d03680afd91..fbc316775669 100644
+--- a/drivers/infiniband/sw/rdmavt/qp.c
++++ b/drivers/infiniband/sw/rdmavt/qp.c
+@@ -58,6 +58,8 @@
+ #include "trace.h"
+
+ static void rvt_rc_timeout(struct timer_list *t);
++static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
++ enum ib_qp_type type);
+
+ /*
+ * Convert the AETH RNR timeout code into the number of microseconds.
+@@ -268,40 +270,41 @@ no_qp_table:
+ }
+
+ /**
+- * free_all_qps - check for QPs still in use
++ * rvt_free_qp_cb - callback function to reset a qp
++ * @qp: the qp to reset
++ * @v: a 64-bit value
++ *
++ * This function resets the qp and removes it from the
++ * qp hash table.
++ */
++static void rvt_free_qp_cb(struct rvt_qp *qp, u64 v)
++{
++ unsigned int *qp_inuse = (unsigned int *)v;
++ struct rvt_dev_info *rdi = ib_to_rvt(qp->ibqp.device);
++
++ /* Reset the qp and remove it from the qp hash list */
++ rvt_reset_qp(rdi, qp, qp->ibqp.qp_type);
++
++ /* Increment the qp_inuse count */
++ (*qp_inuse)++;
++}
++
++/**
++ * rvt_free_all_qps - check for QPs still in use
+ * @rdi: rvt device info structure
+ *
+ * There should not be any QPs still in use.
+ * Free memory for table.
++ * Return the number of QPs still in use.
+ */
+ static unsigned rvt_free_all_qps(struct rvt_dev_info *rdi)
+ {
+- unsigned long flags;
+- struct rvt_qp *qp;
+- unsigned n, qp_inuse = 0;
+- spinlock_t *ql; /* work around too long line below */
+-
+- if (rdi->driver_f.free_all_qps)
+- qp_inuse = rdi->driver_f.free_all_qps(rdi);
++ unsigned int qp_inuse = 0;
+
+ qp_inuse += rvt_mcast_tree_empty(rdi);
+
+- if (!rdi->qp_dev)
+- return qp_inuse;
++ rvt_qp_iter(rdi, (u64)&qp_inuse, rvt_free_qp_cb);
+
+- ql = &rdi->qp_dev->qpt_lock;
+- spin_lock_irqsave(ql, flags);
+- for (n = 0; n < rdi->qp_dev->qp_table_size; n++) {
+- qp = rcu_dereference_protected(rdi->qp_dev->qp_table[n],
+- lockdep_is_held(ql));
+- RCU_INIT_POINTER(rdi->qp_dev->qp_table[n], NULL);
+-
+- for (; qp; qp = rcu_dereference_protected(qp->next,
+- lockdep_is_held(ql)))
+- qp_inuse++;
+- }
+- spin_unlock_irqrestore(ql, flags);
+- synchronize_rcu();
+ return qp_inuse;
+ }
+
+@@ -684,14 +687,14 @@ static void rvt_init_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
+ }
+
+ /**
+- * rvt_reset_qp - initialize the QP state to the reset state
++ * _rvt_reset_qp - initialize the QP state to the reset state
+ * @qp: the QP to reset
+ * @type: the QP type
+ *
+ * r_lock, s_hlock, and s_lock are required to be held by the caller
+ */
+-static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
+- enum ib_qp_type type)
++static void _rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
++ enum ib_qp_type type)
+ __must_hold(&qp->s_lock)
+ __must_hold(&qp->s_hlock)
+ __must_hold(&qp->r_lock)
+@@ -737,6 +740,27 @@ static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
+ lockdep_assert_held(&qp->s_lock);
+ }
+
++/**
++ * rvt_reset_qp - initialize the QP state to the reset state
++ * @rdi: the device info
++ * @qp: the QP to reset
++ * @type: the QP type
++ *
++ * This is the wrapper function to acquire the r_lock, s_hlock, and s_lock
++ * before calling _rvt_reset_qp().
++ */
++static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
++ enum ib_qp_type type)
++{
++ spin_lock_irq(&qp->r_lock);
++ spin_lock(&qp->s_hlock);
++ spin_lock(&qp->s_lock);
++ _rvt_reset_qp(rdi, qp, type);
++ spin_unlock(&qp->s_lock);
++ spin_unlock(&qp->s_hlock);
++ spin_unlock_irq(&qp->r_lock);
++}
++
+ /** rvt_free_qpn - Free a qpn from the bit map
+ * @qpt: QP table
+ * @qpn: queue pair number to free
+@@ -1285,7 +1309,7 @@ int rvt_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ switch (new_state) {
+ case IB_QPS_RESET:
+ if (qp->state != IB_QPS_RESET)
+- rvt_reset_qp(rdi, qp, ibqp->qp_type);
++ _rvt_reset_qp(rdi, qp, ibqp->qp_type);
+ break;
+
+ case IB_QPS_RTR:
+@@ -1434,13 +1458,7 @@ int rvt_destroy_qp(struct ib_qp *ibqp)
+ struct rvt_qp *qp = ibqp_to_rvtqp(ibqp);
+ struct rvt_dev_info *rdi = ib_to_rvt(ibqp->device);
+
+- spin_lock_irq(&qp->r_lock);
+- spin_lock(&qp->s_hlock);
+- spin_lock(&qp->s_lock);
+ rvt_reset_qp(rdi, qp, ibqp->qp_type);
+- spin_unlock(&qp->s_lock);
+- spin_unlock(&qp->s_hlock);
+- spin_unlock_irq(&qp->r_lock);
+
+ wait_event(qp->wait, !atomic_read(&qp->refcount));
+ /* qpn is now available for use again */
+diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
+index ea089cb091ad..dc06e9844378 100644
+--- a/drivers/infiniband/sw/rxe/rxe_comp.c
++++ b/drivers/infiniband/sw/rxe/rxe_comp.c
+@@ -329,7 +329,7 @@ static inline enum comp_state check_ack(struct rxe_qp *qp,
+ qp->comp.psn = pkt->psn;
+ if (qp->req.wait_psn) {
+ qp->req.wait_psn = 0;
+- rxe_run_task(&qp->req.task, 1);
++ rxe_run_task(&qp->req.task, 0);
+ }
+ }
+ return COMPST_ERROR_RETRY;
+@@ -457,7 +457,7 @@ static void do_complete(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
+ */
+ if (qp->req.wait_fence) {
+ qp->req.wait_fence = 0;
+- rxe_run_task(&qp->req.task, 1);
++ rxe_run_task(&qp->req.task, 0);
+ }
+ }
+
+@@ -473,7 +473,7 @@ static inline enum comp_state complete_ack(struct rxe_qp *qp,
+ if (qp->req.need_rd_atomic) {
+ qp->comp.timeout_retry = 0;
+ qp->req.need_rd_atomic = 0;
+- rxe_run_task(&qp->req.task, 1);
++ rxe_run_task(&qp->req.task, 0);
+ }
+ }
+
+@@ -719,7 +719,7 @@ int rxe_completer(void *arg)
+ RXE_CNT_COMP_RETRY);
+ qp->req.need_retry = 1;
+ qp->comp.started_retry = 1;
+- rxe_run_task(&qp->req.task, 1);
++ rxe_run_task(&qp->req.task, 0);
+ }
+
+ if (pkt) {
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index e8d1134943c4..f47e3fca403d 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -149,7 +149,6 @@ static const char * const topbuttonpad_pnp_ids[] = {
+ "LEN0042", /* Yoga */
+ "LEN0045",
+ "LEN0047",
+- "LEN0049",
+ "LEN2000", /* S540 */
+ "LEN2001", /* Edge E431 */
+ "LEN2002", /* Edge E531 */
+@@ -169,9 +168,11 @@ static const char * const smbus_pnp_ids[] = {
+ /* all of the topbuttonpad_pnp_ids are valid, we just add some extras */
+ "LEN0048", /* X1 Carbon 3 */
+ "LEN0046", /* X250 */
++ "LEN0049", /* Yoga 11e */
+ "LEN004a", /* W541 */
+ "LEN005b", /* P50 */
+ "LEN005e", /* T560 */
++ "LEN006c", /* T470s */
+ "LEN0071", /* T480 */
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN0073", /* X1 Carbon G5 (Elantech) */
+@@ -182,6 +183,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN009b", /* T580 */
+ "LEN200f", /* T450s */
++ "LEN2044", /* L470 */
+ "LEN2054", /* E480 */
+ "LEN2055", /* E580 */
+ "SYN3052", /* HP EliteBook 840 G4 */
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index b7bd89b3b2f9..f41fd15b7b7c 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3449,7 +3449,7 @@ static void nvme_get_fw_slot_info(struct nvme_ctrl *ctrl)
+ if (!log)
+ return;
+
+- if (nvme_get_log(ctrl, NVME_NSID_ALL, 0, NVME_LOG_FW_SLOT, log,
++ if (nvme_get_log(ctrl, NVME_NSID_ALL, NVME_LOG_FW_SLOT, 0, log,
+ sizeof(*log), 0))
+ dev_warn(ctrl->device, "Get FW SLOT INFO log error\n");
+ kfree(log);
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 9e467e8a8cb5..ea45112a98be 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -3117,6 +3117,7 @@ retry_root_backup:
+ /* do not make disk changes in broken FS or nologreplay is given */
+ if (btrfs_super_log_root(disk_super) != 0 &&
+ !btrfs_test_opt(fs_info, NOLOGREPLAY)) {
++ btrfs_info(fs_info, "start tree-log replay");
+ ret = btrfs_replay_log(fs_info, fs_devices);
+ if (ret) {
+ err = ret;
+diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
+index 6648d55e5339..813425df16f7 100644
+--- a/fs/btrfs/extent_map.c
++++ b/fs/btrfs/extent_map.c
+@@ -228,6 +228,17 @@ static void try_merge_map(struct extent_map_tree *tree, struct extent_map *em)
+ struct extent_map *merge = NULL;
+ struct rb_node *rb;
+
++ /*
++ * We can't modify an extent map that is in the tree and that is being
++ * used by another task, as it can cause that other task to see it in
++ * inconsistent state during the merging. We always have 1 reference for
++ * the tree and 1 for this task (which is unpinning the extent map or
++ * clearing the logging flag), so anything > 2 means it's being used by
++ * other tasks too.
++ */
++ if (refcount_read(&em->refs) > 2)
++ return;
++
+ if (em->start != 0) {
+ rb = rb_prev(&em->rb_node);
+ if (rb)
+diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
+index cd2a5864e103..dbc685ca017f 100644
+--- a/fs/btrfs/ref-verify.c
++++ b/fs/btrfs/ref-verify.c
+@@ -747,6 +747,7 @@ int btrfs_ref_tree_mod(struct btrfs_root *root, u64 bytenr, u64 num_bytes,
+ */
+ be = add_block_entry(root->fs_info, bytenr, num_bytes, ref_root);
+ if (IS_ERR(be)) {
++ kfree(ref);
+ kfree(ra);
+ ret = PTR_ERR(be);
+ goto out;
+@@ -760,6 +761,8 @@ int btrfs_ref_tree_mod(struct btrfs_root *root, u64 bytenr, u64 num_bytes,
+ "re-allocated a block that still has references to it!");
+ dump_block_entry(fs_info, be);
+ dump_ref_action(fs_info, ra);
++ kfree(ref);
++ kfree(ra);
+ goto out_unlock;
+ }
+
+@@ -822,6 +825,7 @@ int btrfs_ref_tree_mod(struct btrfs_root *root, u64 bytenr, u64 num_bytes,
+ "dropping a ref for a existing root that doesn't have a ref on the block");
+ dump_block_entry(fs_info, be);
+ dump_ref_action(fs_info, ra);
++ kfree(ref);
+ kfree(ra);
+ goto out_unlock;
+ }
+@@ -837,6 +841,7 @@ int btrfs_ref_tree_mod(struct btrfs_root *root, u64 bytenr, u64 num_bytes,
+ "attempting to add another ref for an existing ref on a tree block");
+ dump_block_entry(fs_info, be);
+ dump_ref_action(fs_info, ra);
++ kfree(ref);
+ kfree(ra);
+ goto out_unlock;
+ }
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index db4002ecbaca..6a5b16a119ed 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -1857,6 +1857,8 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
+ }
+
+ if (btrfs_super_log_root(fs_info->super_copy) != 0) {
++ btrfs_warn(fs_info,
++ "mount required to replay tree-log, cannot remount read-write");
+ ret = -EINVAL;
+ goto restore;
+ }
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index 7edc8172c53a..d203cc935ff8 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -203,6 +203,7 @@ static int ext4_protect_reserved_inode(struct super_block *sb,
+ return PTR_ERR(inode);
+ num = (inode->i_size + sb->s_blocksize - 1) >> sb->s_blocksize_bits;
+ while (i < num) {
++ cond_resched();
+ map.m_lblk = i;
+ map.m_len = num - i;
+ n = ext4_map_blocks(NULL, inode, &map, 0);
+diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
+index d947c5e439cf..ae520a726339 100644
+--- a/fs/ext4/dir.c
++++ b/fs/ext4/dir.c
+@@ -126,12 +126,14 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
+ if (err != ERR_BAD_DX_DIR) {
+ return err;
+ }
+- /*
+- * We don't set the inode dirty flag since it's not
+- * critical that it get flushed back to the disk.
+- */
+- ext4_clear_inode_flag(file_inode(file),
+- EXT4_INODE_INDEX);
++ /* Can we just clear INDEX flag to ignore htree information? */
++ if (!ext4_has_metadata_csum(sb)) {
++ /*
++ * We don't set the inode dirty flag since it's not
++ * critical that it gets flushed back to the disk.
++ */
++ ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);
++ }
+ }
+
+ if (ext4_has_inline_data(inode)) {
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index f8456a423c4e..5c0e06645b1e 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -2375,8 +2375,11 @@ void ext4_insert_dentry(struct inode *inode,
+ struct ext4_filename *fname);
+ static inline void ext4_update_dx_flag(struct inode *inode)
+ {
+- if (!ext4_has_feature_dir_index(inode->i_sb))
++ if (!ext4_has_feature_dir_index(inode->i_sb)) {
++ /* ext4_iget() should have caught this... */
++ WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb));
+ ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);
++ }
+ }
+ static const unsigned char ext4_filetype_table[] = {
+ DT_UNKNOWN, DT_REG, DT_DIR, DT_CHR, DT_BLK, DT_FIFO, DT_SOCK, DT_LNK
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 950e3dcff7b0..8e535bb34d5f 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4975,6 +4975,18 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+ }
++ /*
++ * If dir_index is not enabled but there's dir with INDEX flag set,
++ * we'd normally treat htree data as empty space. But with metadata
++ * checksumming that corrupts checksums so forbid that.
++ */
++ if (!ext4_has_feature_dir_index(sb) && ext4_has_metadata_csum(sb) &&
++ ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) {
++ ext4_error_inode(inode, function, line, 0,
++ "iget: Dir with htree data on filesystem without dir_index feature.");
++ ret = -EFSCORRUPTED;
++ goto bad_inode;
++ }
+ ei->i_disksize = inode->i_size;
+ #ifdef CONFIG_QUOTA
+ ei->i_reserved_quota = 0;
+diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
+index 2305b4374fd3..9d00e0dd2ba9 100644
+--- a/fs/ext4/mmp.c
++++ b/fs/ext4/mmp.c
+@@ -120,10 +120,10 @@ void __dump_mmp_msg(struct super_block *sb, struct mmp_struct *mmp,
+ {
+ __ext4_warning(sb, function, line, "%s", msg);
+ __ext4_warning(sb, function, line,
+- "MMP failure info: last update time: %llu, last update "
+- "node: %s, last update device: %s",
+- (long long unsigned int) le64_to_cpu(mmp->mmp_time),
+- mmp->mmp_nodename, mmp->mmp_bdevname);
++ "MMP failure info: last update time: %llu, last update node: %.*s, last update device: %.*s",
++ (unsigned long long)le64_to_cpu(mmp->mmp_time),
++ (int)sizeof(mmp->mmp_nodename), mmp->mmp_nodename,
++ (int)sizeof(mmp->mmp_bdevname), mmp->mmp_bdevname);
+ }
+
+ /*
+@@ -154,6 +154,7 @@ static int kmmpd(void *data)
+ mmp_check_interval = max(EXT4_MMP_CHECK_MULT * mmp_update_interval,
+ EXT4_MMP_MIN_CHECK_INTERVAL);
+ mmp->mmp_check_interval = cpu_to_le16(mmp_check_interval);
++ BUILD_BUG_ON(sizeof(mmp->mmp_bdevname) < BDEVNAME_SIZE);
+ bdevname(bh->b_bdev, mmp->mmp_bdevname);
+
+ memcpy(mmp->mmp_nodename, init_utsname()->nodename,
+@@ -375,7 +376,8 @@ skip:
+ /*
+ * Start a kernel thread to update the MMP block periodically.
+ */
+- EXT4_SB(sb)->s_mmp_tsk = kthread_run(kmmpd, mmpd_data, "kmmpd-%s",
++ EXT4_SB(sb)->s_mmp_tsk = kthread_run(kmmpd, mmpd_data, "kmmpd-%.*s",
++ (int)sizeof(mmp->mmp_bdevname),
+ bdevname(bh->b_bdev,
+ mmp->mmp_bdevname));
+ if (IS_ERR(EXT4_SB(sb)->s_mmp_tsk)) {
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 43dcb91d63f4..4608d0d3b7f9 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2085,6 +2085,13 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ retval = ext4_dx_add_entry(handle, &fname, dir, inode);
+ if (!retval || (retval != ERR_BAD_DX_DIR))
+ goto out;
++ /* Can we just ignore htree data? */
++ if (ext4_has_metadata_csum(sb)) {
++ EXT4_ERROR_INODE(dir,
++ "Directory has corrupted htree index.");
++ retval = -EFSCORRUPTED;
++ goto out;
++ }
+ ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
+ dx_fallback++;
+ ext4_mark_inode_dirty(handle, dir);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 32d8bdf683bb..e080e90178a0 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2923,17 +2923,11 @@ static int ext4_feature_set_ok(struct super_block *sb, int readonly)
+ return 0;
+ }
+
+-#ifndef CONFIG_QUOTA
+- if (ext4_has_feature_quota(sb) && !readonly) {
++#if !defined(CONFIG_QUOTA) || !defined(CONFIG_QFMT_V2)
++ if (!readonly && (ext4_has_feature_quota(sb) ||
++ ext4_has_feature_project(sb))) {
+ ext4_msg(sb, KERN_ERR,
+- "Filesystem with quota feature cannot be mounted RDWR "
+- "without CONFIG_QUOTA");
+- return 0;
+- }
+- if (ext4_has_feature_project(sb) && !readonly) {
+- ext4_msg(sb, KERN_ERR,
+- "Filesystem with project quota feature cannot be mounted RDWR "
+- "without CONFIG_QUOTA");
++ "The kernel was not built with CONFIG_QUOTA and CONFIG_QFMT_V2");
+ return 0;
+ }
+ #endif /* CONFIG_QUOTA */
+@@ -3727,6 +3721,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ */
+ sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT;
+
++ blocksize = BLOCK_SIZE << le32_to_cpu(es->s_log_block_size);
++ if (blocksize < EXT4_MIN_BLOCK_SIZE ||
++ blocksize > EXT4_MAX_BLOCK_SIZE) {
++ ext4_msg(sb, KERN_ERR,
++ "Unsupported filesystem blocksize %d (%d log_block_size)",
++ blocksize, le32_to_cpu(es->s_log_block_size));
++ goto failed_mount;
++ }
++
+ if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) {
+ sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE;
+ sbi->s_first_ino = EXT4_GOOD_OLD_FIRST_INO;
+@@ -3744,6 +3747,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ ext4_msg(sb, KERN_ERR,
+ "unsupported inode size: %d",
+ sbi->s_inode_size);
++ ext4_msg(sb, KERN_ERR, "blocksize: %d", blocksize);
+ goto failed_mount;
+ }
+ /*
+@@ -3907,14 +3911,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ if (!ext4_feature_set_ok(sb, (sb_rdonly(sb))))
+ goto failed_mount;
+
+- blocksize = BLOCK_SIZE << le32_to_cpu(es->s_log_block_size);
+- if (blocksize < EXT4_MIN_BLOCK_SIZE ||
+- blocksize > EXT4_MAX_BLOCK_SIZE) {
+- ext4_msg(sb, KERN_ERR,
+- "Unsupported filesystem blocksize %d (%d log_block_size)",
+- blocksize, le32_to_cpu(es->s_log_block_size));
+- goto failed_mount;
+- }
+ if (le32_to_cpu(es->s_log_block_size) >
+ (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
+ ext4_msg(sb, KERN_ERR,
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 020bd7a0d8e0..c321fa06081c 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -971,29 +971,33 @@ restart_loop:
+ * it. */
+
+ /*
+- * A buffer which has been freed while still being journaled by
+- * a previous transaction.
+- */
+- if (buffer_freed(bh)) {
++ * A buffer which has been freed while still being journaled
++ * by a previous transaction, refile the buffer to BJ_Forget of
++ * the running transaction. If the just committed transaction
++ * contains "add to orphan" operation, we can completely
++ * invalidate the buffer now. We are rather through in that
++ * since the buffer may be still accessible when blocksize <
++ * pagesize and it is attached to the last partial page.
++ */
++ if (buffer_freed(bh) && !jh->b_next_transaction) {
++ struct address_space *mapping;
++
++ clear_buffer_freed(bh);
++ clear_buffer_jbddirty(bh);
++
+ /*
+- * If the running transaction is the one containing
+- * "add to orphan" operation (b_next_transaction !=
+- * NULL), we have to wait for that transaction to
+- * commit before we can really get rid of the buffer.
+- * So just clear b_modified to not confuse transaction
+- * credit accounting and refile the buffer to
+- * BJ_Forget of the running transaction. If the just
+- * committed transaction contains "add to orphan"
+- * operation, we can completely invalidate the buffer
+- * now. We are rather through in that since the
+- * buffer may be still accessible when blocksize <
+- * pagesize and it is attached to the last partial
+- * page.
++ * Block device buffers need to stay mapped all the
++ * time, so it is enough to clear buffer_jbddirty and
++ * buffer_freed bits. For the file mapping buffers (i.e.
++ * journalled data) we need to unmap buffer and clear
++ * more bits. We also need to be careful about the check
++ * because the data page mapping can get cleared under
++ * out hands, which alse need not to clear more bits
++ * because the page and buffers will be freed and can
++ * never be reused once we are done with them.
+ */
+- jh->b_modified = 0;
+- if (!jh->b_next_transaction) {
+- clear_buffer_freed(bh);
+- clear_buffer_jbddirty(bh);
++ mapping = READ_ONCE(bh->b_page->mapping);
++ if (mapping && !sb_is_blkdev_sb(mapping->host->i_sb)) {
+ clear_buffer_mapped(bh);
+ clear_buffer_new(bh);
+ clear_buffer_req(bh);
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 911ff18249b7..97ffe12a2262 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -2228,14 +2228,16 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
+ return -EBUSY;
+ }
+ /*
+- * OK, buffer won't be reachable after truncate. We just set
+- * j_next_transaction to the running transaction (if there is
+- * one) and mark buffer as freed so that commit code knows it
+- * should clear dirty bits when it is done with the buffer.
++ * OK, buffer won't be reachable after truncate. We just clear
++ * b_modified to not confuse transaction credit accounting, and
++ * set j_next_transaction to the running transaction (if there
++ * is one) and mark buffer as freed so that commit code knows
++ * it should clear dirty bits when it is done with the buffer.
+ */
+ set_buffer_freed(bh);
+ if (journal->j_running_transaction && buffer_jbddirty(bh))
+ jh->b_next_transaction = journal->j_running_transaction;
++ jh->b_modified = 0;
+ jbd2_journal_put_journal_head(jh);
+ spin_unlock(&journal->j_list_lock);
+ jbd_unlock_bh_state(bh);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index fad795041d32..668b648064b7 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5117,7 +5117,7 @@ static void nfs4_proc_write_setup(struct nfs_pgio_header *hdr,
+ hdr->timestamp = jiffies;
+
+ msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_WRITE];
+- nfs4_init_sequence(&hdr->args.seq_args, &hdr->res.seq_res, 1, 0);
++ nfs4_init_sequence(&hdr->args.seq_args, &hdr->res.seq_res, 0, 0);
+ nfs4_state_protect_write(server->nfs_client, clnt, msg, hdr);
+ }
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index ae735bcb9a2c..a8a47e1596dd 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2442,6 +2442,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
++ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+ SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+diff --git a/sound/usb/clock.c b/sound/usb/clock.c
+index e31349865f20..bfe5540030b8 100644
+--- a/sound/usb/clock.c
++++ b/sound/usb/clock.c
+@@ -165,8 +165,34 @@ static int uac_clock_selector_set_val(struct snd_usb_audio *chip, int selector_i
+ return ret;
+ }
+
++/*
++ * Assume the clock is valid if clock source supports only one single sample
++ * rate, the terminal is connected directly to it (there is no clock selector)
++ * and clock type is internal. This is to deal with some Denon DJ controllers
++ * that always reports that clock is invalid.
++ */
++static bool uac_clock_source_is_valid_quirk(struct snd_usb_audio *chip,
++ struct audioformat *fmt,
++ int source_id)
++{
++ if (fmt->protocol == UAC_VERSION_2) {
++ struct uac_clock_source_descriptor *cs_desc =
++ snd_usb_find_clock_source(chip->ctrl_intf, source_id);
++
++ if (!cs_desc)
++ return false;
++
++ return (fmt->nr_rates == 1 &&
++ (fmt->clock & 0xff) == cs_desc->bClockID &&
++ (cs_desc->bmAttributes & 0x3) !=
++ UAC_CLOCK_SOURCE_TYPE_EXT);
++ }
++
++ return false;
++}
++
+ static bool uac_clock_source_is_valid(struct snd_usb_audio *chip,
+- int protocol,
++ struct audioformat *fmt,
+ int source_id)
+ {
+ int err;
+@@ -174,26 +200,26 @@ static bool uac_clock_source_is_valid(struct snd_usb_audio *chip,
+ struct usb_device *dev = chip->dev;
+ u32 bmControls;
+
+- if (protocol == UAC_VERSION_3) {
++ if (fmt->protocol == UAC_VERSION_3) {
+ struct uac3_clock_source_descriptor *cs_desc =
+ snd_usb_find_clock_source_v3(chip->ctrl_intf, source_id);
+
+ if (!cs_desc)
+- return 0;
++ return false;
+ bmControls = le32_to_cpu(cs_desc->bmControls);
+ } else { /* UAC_VERSION_1/2 */
+ struct uac_clock_source_descriptor *cs_desc =
+ snd_usb_find_clock_source(chip->ctrl_intf, source_id);
+
+ if (!cs_desc)
+- return 0;
++ return false;
+ bmControls = cs_desc->bmControls;
+ }
+
+ /* If a clock source can't tell us whether it's valid, we assume it is */
+ if (!uac_v2v3_control_is_readable(bmControls,
+ UAC2_CS_CONTROL_CLOCK_VALID))
+- return 1;
++ return true;
+
+ err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_CUR,
+ USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN,
+@@ -205,13 +231,17 @@ static bool uac_clock_source_is_valid(struct snd_usb_audio *chip,
+ dev_warn(&dev->dev,
+ "%s(): cannot get clock validity for id %d\n",
+ __func__, source_id);
+- return 0;
++ return false;
+ }
+
+- return !!data;
++ if (data)
++ return true;
++ else
++ return uac_clock_source_is_valid_quirk(chip, fmt, source_id);
+ }
+
+-static int __uac_clock_find_source(struct snd_usb_audio *chip, int entity_id,
++static int __uac_clock_find_source(struct snd_usb_audio *chip,
++ struct audioformat *fmt, int entity_id,
+ unsigned long *visited, bool validate)
+ {
+ struct uac_clock_source_descriptor *source;
+@@ -231,7 +261,7 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip, int entity_id,
+ source = snd_usb_find_clock_source(chip->ctrl_intf, entity_id);
+ if (source) {
+ entity_id = source->bClockID;
+- if (validate && !uac_clock_source_is_valid(chip, UAC_VERSION_2,
++ if (validate && !uac_clock_source_is_valid(chip, fmt,
+ entity_id)) {
+ usb_audio_err(chip,
+ "clock source %d is not valid, cannot use\n",
+@@ -262,8 +292,9 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip, int entity_id,
+ }
+
+ cur = ret;
+- ret = __uac_clock_find_source(chip, selector->baCSourceID[ret - 1],
+- visited, validate);
++ ret = __uac_clock_find_source(chip, fmt,
++ selector->baCSourceID[ret - 1],
++ visited, validate);
+ if (!validate || ret > 0 || !chip->autoclock)
+ return ret;
+
+@@ -274,8 +305,9 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip, int entity_id,
+ if (i == cur)
+ continue;
+
+- ret = __uac_clock_find_source(chip, selector->baCSourceID[i - 1],
+- visited, true);
++ ret = __uac_clock_find_source(chip, fmt,
++ selector->baCSourceID[i - 1],
++ visited, true);
+ if (ret < 0)
+ continue;
+
+@@ -295,14 +327,16 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip, int entity_id,
+ /* FIXME: multipliers only act as pass-thru element for now */
+ multiplier = snd_usb_find_clock_multiplier(chip->ctrl_intf, entity_id);
+ if (multiplier)
+- return __uac_clock_find_source(chip, multiplier->bCSourceID,
+- visited, validate);
++ return __uac_clock_find_source(chip, fmt,
++ multiplier->bCSourceID,
++ visited, validate);
+
+ return -EINVAL;
+ }
+
+-static int __uac3_clock_find_source(struct snd_usb_audio *chip, int entity_id,
+- unsigned long *visited, bool validate)
++static int __uac3_clock_find_source(struct snd_usb_audio *chip,
++ struct audioformat *fmt, int entity_id,
++ unsigned long *visited, bool validate)
+ {
+ struct uac3_clock_source_descriptor *source;
+ struct uac3_clock_selector_descriptor *selector;
+@@ -321,7 +355,7 @@ static int __uac3_clock_find_source(struct snd_usb_audio *chip, int entity_id,
+ source = snd_usb_find_clock_source_v3(chip->ctrl_intf, entity_id);
+ if (source) {
+ entity_id = source->bClockID;
+- if (validate && !uac_clock_source_is_valid(chip, UAC_VERSION_3,
++ if (validate && !uac_clock_source_is_valid(chip, fmt,
+ entity_id)) {
+ usb_audio_err(chip,
+ "clock source %d is not valid, cannot use\n",
+@@ -352,7 +386,8 @@ static int __uac3_clock_find_source(struct snd_usb_audio *chip, int entity_id,
+ }
+
+ cur = ret;
+- ret = __uac3_clock_find_source(chip, selector->baCSourceID[ret - 1],
++ ret = __uac3_clock_find_source(chip, fmt,
++ selector->baCSourceID[ret - 1],
+ visited, validate);
+ if (!validate || ret > 0 || !chip->autoclock)
+ return ret;
+@@ -364,8 +399,9 @@ static int __uac3_clock_find_source(struct snd_usb_audio *chip, int entity_id,
+ if (i == cur)
+ continue;
+
+- ret = __uac3_clock_find_source(chip, selector->baCSourceID[i - 1],
+- visited, true);
++ ret = __uac3_clock_find_source(chip, fmt,
++ selector->baCSourceID[i - 1],
++ visited, true);
+ if (ret < 0)
+ continue;
+
+@@ -386,7 +422,8 @@ static int __uac3_clock_find_source(struct snd_usb_audio *chip, int entity_id,
+ multiplier = snd_usb_find_clock_multiplier_v3(chip->ctrl_intf,
+ entity_id);
+ if (multiplier)
+- return __uac3_clock_find_source(chip, multiplier->bCSourceID,
++ return __uac3_clock_find_source(chip, fmt,
++ multiplier->bCSourceID,
+ visited, validate);
+
+ return -EINVAL;
+@@ -403,18 +440,18 @@ static int __uac3_clock_find_source(struct snd_usb_audio *chip, int entity_id,
+ *
+ * Returns the clock source UnitID (>=0) on success, or an error.
+ */
+-int snd_usb_clock_find_source(struct snd_usb_audio *chip, int protocol,
+- int entity_id, bool validate)
++int snd_usb_clock_find_source(struct snd_usb_audio *chip,
++ struct audioformat *fmt, bool validate)
+ {
+ DECLARE_BITMAP(visited, 256);
+ memset(visited, 0, sizeof(visited));
+
+- switch (protocol) {
++ switch (fmt->protocol) {
+ case UAC_VERSION_2:
+- return __uac_clock_find_source(chip, entity_id, visited,
++ return __uac_clock_find_source(chip, fmt, fmt->clock, visited,
+ validate);
+ case UAC_VERSION_3:
+- return __uac3_clock_find_source(chip, entity_id, visited,
++ return __uac3_clock_find_source(chip, fmt, fmt->clock, visited,
+ validate);
+ default:
+ return -EINVAL;
+@@ -515,8 +552,7 @@ static int set_sample_rate_v2v3(struct snd_usb_audio *chip, int iface,
+ * automatic clock selection if the current clock is not
+ * valid.
+ */
+- clock = snd_usb_clock_find_source(chip, fmt->protocol,
+- fmt->clock, true);
++ clock = snd_usb_clock_find_source(chip, fmt, true);
+ if (clock < 0) {
+ /* We did not find a valid clock, but that might be
+ * because the current sample rate does not match an
+@@ -524,8 +560,7 @@ static int set_sample_rate_v2v3(struct snd_usb_audio *chip, int iface,
+ * and we will do another validation after setting the
+ * rate.
+ */
+- clock = snd_usb_clock_find_source(chip, fmt->protocol,
+- fmt->clock, false);
++ clock = snd_usb_clock_find_source(chip, fmt, false);
+ if (clock < 0)
+ return clock;
+ }
+@@ -591,7 +626,7 @@ static int set_sample_rate_v2v3(struct snd_usb_audio *chip, int iface,
+
+ validation:
+ /* validate clock after rate change */
+- if (!uac_clock_source_is_valid(chip, fmt->protocol, clock))
++ if (!uac_clock_source_is_valid(chip, fmt, clock))
+ return -ENXIO;
+ return 0;
+ }
+diff --git a/sound/usb/clock.h b/sound/usb/clock.h
+index 076e31b79ee0..68df0fbe09d0 100644
+--- a/sound/usb/clock.h
++++ b/sound/usb/clock.h
+@@ -6,7 +6,7 @@ int snd_usb_init_sample_rate(struct snd_usb_audio *chip, int iface,
+ struct usb_host_interface *alts,
+ struct audioformat *fmt, int rate);
+
+-int snd_usb_clock_find_source(struct snd_usb_audio *chip, int protocol,
+- int entity_id, bool validate);
++int snd_usb_clock_find_source(struct snd_usb_audio *chip,
++ struct audioformat *fmt, bool validate);
+
+ #endif /* __USBAUDIO_CLOCK_H */
+diff --git a/sound/usb/format.c b/sound/usb/format.c
+index fd13ac11b136..9d27429ed403 100644
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -306,8 +306,7 @@ static int parse_audio_format_rates_v2v3(struct snd_usb_audio *chip,
+ struct usb_device *dev = chip->dev;
+ unsigned char tmp[2], *data;
+ int nr_triplets, data_size, ret = 0;
+- int clock = snd_usb_clock_find_source(chip, fp->protocol,
+- fp->clock, false);
++ int clock = snd_usb_clock_find_source(chip, fp, false);
+
+ if (clock < 0) {
+ dev_err(&dev->dev,
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 6ac6a0980124..f2e173b9691d 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -912,6 +912,15 @@ static int parse_term_proc_unit(struct mixer_build *state,
+ return 0;
+ }
+
++static int parse_term_effect_unit(struct mixer_build *state,
++ struct usb_audio_term *term,
++ void *p1, int id)
++{
++ term->type = UAC3_EFFECT_UNIT << 16; /* virtual type */
++ term->id = id;
++ return 0;
++}
++
+ static int parse_term_uac2_clock_source(struct mixer_build *state,
+ struct usb_audio_term *term,
+ void *p1, int id)
+@@ -996,8 +1005,7 @@ static int __check_input_term(struct mixer_build *state, int id,
+ UAC3_PROCESSING_UNIT);
+ case PTYPE(UAC_VERSION_2, UAC2_EFFECT_UNIT):
+ case PTYPE(UAC_VERSION_3, UAC3_EFFECT_UNIT):
+- return parse_term_proc_unit(state, term, p1, id,
+- UAC3_EFFECT_UNIT);
++ return parse_term_effect_unit(state, term, p1, id);
+ case PTYPE(UAC_VERSION_1, UAC1_EXTENSION_UNIT):
+ case PTYPE(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2):
+ case PTYPE(UAC_VERSION_3, UAC3_EXTENSION_UNIT):
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 49f6f6129857..5bbfd7577b33 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1182,6 +1182,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */
+ case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
+ case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
++ case USB_ID(0x2912, 0x30c8): /* Audioengine D1 */
+ return true;
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-02-24 11:06 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-02-24 11:06 UTC (permalink / raw
To: gentoo-commits
commit: 86fa72f29ab4a860912cb34ce60fbd2053ddf2d3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Feb 24 11:06:35 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Feb 24 11:06:35 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=86fa72f2
Linux patch 4.19.106
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1105_linux-4.19.106.patch | 13713 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 13717 insertions(+)
diff --git a/0000_README b/0000_README
index f83fdcc..3213eab 100644
--- a/0000_README
+++ b/0000_README
@@ -459,6 +459,10 @@ Patch: 1104_linux-4.19.105.patch
From: https://www.kernel.org
Desc: Linux 4.19.105
+Patch: 1105_linux-4.19.106.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.106
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1105_linux-4.19.106.patch b/1105_linux-4.19.106.patch
new file mode 100644
index 0000000..ea910af
--- /dev/null
+++ b/1105_linux-4.19.106.patch
@@ -0,0 +1,13713 @@
+diff --git a/Makefile b/Makefile
+index eef7de60cd94..c010fd4a3286 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 105
++SUBLEVEL = 106
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 185e552f1461..e2f7c50dbace 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -61,7 +61,7 @@ config ARM
+ select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32
+ select HAVE_CONTEXT_TRACKING
+ select HAVE_C_RECORDMCOUNT
+- select HAVE_DEBUG_KMEMLEAK
++ select HAVE_DEBUG_KMEMLEAK if !XIP_KERNEL
+ select HAVE_DMA_CONTIGUOUS if MMU
+ select HAVE_DYNAMIC_FTRACE if (!XIP_KERNEL) && !CPU_ENDIAN_BE32 && MMU
+ select HAVE_DYNAMIC_FTRACE_WITH_REGS if HAVE_DYNAMIC_FTRACE
+@@ -2008,7 +2008,7 @@ config XIP_DEFLATED_DATA
+ config KEXEC
+ bool "Kexec system call (EXPERIMENTAL)"
+ depends on (!SMP || PM_SLEEP_SMP)
+- depends on !CPU_V7M
++ depends on MMU
+ select KEXEC_CORE
+ help
+ kexec is a system call that implements the ability to shutdown your
+diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+index 315d0e7615f3..bc5f2de02d43 100644
+--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+@@ -657,7 +657,7 @@
+ pinctrl-0 = <&pinctrl_usdhc2>;
+ bus-width = <4>;
+ cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
+- wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
++ disable-wp;
+ vmmc-supply = <®_3p3v_sd>;
+ vqmmc-supply = <®_3p3v>;
+ no-1-8-v;
+@@ -670,7 +670,7 @@
+ pinctrl-0 = <&pinctrl_usdhc3>;
+ bus-width = <4>;
+ cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
+- wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
++ disable-wp;
+ vmmc-supply = <®_3p3v_sd>;
+ vqmmc-supply = <®_3p3v>;
+ no-1-8-v;
+@@ -804,6 +804,7 @@
+ &usbh1 {
+ vbus-supply = <®_5p0v_main>;
+ disable-over-current;
++ maximum-speed = "full-speed";
+ status = "okay";
+ };
+
+@@ -1081,7 +1082,6 @@
+ MX6QDL_PAD_SD2_DAT1__SD2_DATA1 0x17059
+ MX6QDL_PAD_SD2_DAT2__SD2_DATA2 0x17059
+ MX6QDL_PAD_SD2_DAT3__SD2_DATA3 0x17059
+- MX6QDL_PAD_NANDF_D3__GPIO2_IO03 0x40010040
+ MX6QDL_PAD_NANDF_D2__GPIO2_IO02 0x40010040
+ >;
+ };
+@@ -1094,7 +1094,6 @@
+ MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059
+ MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059
+ MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059
+- MX6QDL_PAD_NANDF_D1__GPIO2_IO01 0x40010040
+ MX6QDL_PAD_NANDF_D0__GPIO2_IO00 0x40010040
+
+ >;
+diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi
+index 03919714645a..f1c9b2bc542c 100644
+--- a/arch/arm/boot/dts/r8a7779.dtsi
++++ b/arch/arm/boot/dts/r8a7779.dtsi
+@@ -68,6 +68,14 @@
+ <0xf0000100 0x100>;
+ };
+
++ timer@f0000200 {
++ compatible = "arm,cortex-a9-global-timer";
++ reg = <0xf0000200 0x100>;
++ interrupts = <GIC_PPI 11
++ (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
++ clocks = <&cpg_clocks R8A7779_CLK_ZS>;
++ };
++
+ timer@f0000600 {
+ compatible = "arm,cortex-a9-twd-timer";
+ reg = <0xf0000600 0x20>;
+diff --git a/arch/arm/boot/dts/stm32f469-disco.dts b/arch/arm/boot/dts/stm32f469-disco.dts
+index 3ee768cb86fc..eea979ef5512 100644
+--- a/arch/arm/boot/dts/stm32f469-disco.dts
++++ b/arch/arm/boot/dts/stm32f469-disco.dts
+@@ -75,6 +75,13 @@
+ regulator-max-microvolt = <3300000>;
+ };
+
++ vdd_dsi: vdd-dsi {
++ compatible = "regulator-fixed";
++ regulator-name = "vdd_dsi";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ };
++
+ soc {
+ dma-ranges = <0xc0000000 0x0 0x10000000>;
+ };
+@@ -154,6 +161,7 @@
+ compatible = "orisetech,otm8009a";
+ reg = <0>; /* dsi virtual channel (0..3) */
+ reset-gpios = <&gpioh 7 GPIO_ACTIVE_LOW>;
++ power-supply = <&vdd_dsi>;
+ status = "okay";
+
+ port {
+diff --git a/arch/arm/boot/dts/sun8i-h3.dtsi b/arch/arm/boot/dts/sun8i-h3.dtsi
+index 9233ba30a857..11172fbdc03a 100644
+--- a/arch/arm/boot/dts/sun8i-h3.dtsi
++++ b/arch/arm/boot/dts/sun8i-h3.dtsi
+@@ -80,7 +80,7 @@
+ #cooling-cells = <2>;
+ };
+
+- cpu@1 {
++ cpu1: cpu@1 {
+ compatible = "arm,cortex-a7";
+ device_type = "cpu";
+ reg = <1>;
+@@ -90,7 +90,7 @@
+ #cooling-cells = <2>;
+ };
+
+- cpu@2 {
++ cpu2: cpu@2 {
+ compatible = "arm,cortex-a7";
+ device_type = "cpu";
+ reg = <2>;
+@@ -100,7 +100,7 @@
+ #cooling-cells = <2>;
+ };
+
+- cpu@3 {
++ cpu3: cpu@3 {
+ compatible = "arm,cortex-a7";
+ device_type = "cpu";
+ reg = <3>;
+@@ -111,6 +111,15 @@
+ };
+ };
+
++ pmu {
++ compatible = "arm,cortex-a7-pmu";
++ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
++ };
++
+ timer {
+ compatible = "arm,armv7-timer";
+ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index 72813e7aefb8..bd4391269611 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -69,6 +69,16 @@
+ clock-output-names = "osc32k";
+ };
+
++ pmu {
++ compatible = "arm,cortex-a53-pmu",
++ "arm,armv8-pmuv3";
++ interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
++ };
++
+ psci {
+ compatible = "arm,psci-0.2";
+ method = "smc";
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 8c86c41a0d25..3e7baabf6450 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -918,6 +918,8 @@
+ interrupts = <0 138 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&hsusb_phy2>;
+ phy-names = "usb2-phy";
++ snps,dis_u2_susphy_quirk;
++ snps,dis_enblslpm_quirk;
+ };
+ };
+
+@@ -947,6 +949,8 @@
+ interrupts = <0 131 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&hsusb_phy1>, <&ssusb_phy_0>;
+ phy-names = "usb2-phy", "usb3-phy";
++ snps,dis_u2_susphy_quirk;
++ snps,dis_enblslpm_quirk;
+ };
+ };
+
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+index 4b650ec1d7dd..887a8512bf10 100644
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -35,13 +35,16 @@ void apply_alternatives_module(void *start, size_t length);
+ static inline void apply_alternatives_module(void *start, size_t length) { }
+ #endif
+
+-#define ALTINSTR_ENTRY(feature,cb) \
++#define ALTINSTR_ENTRY(feature) \
+ " .word 661b - .\n" /* label */ \
+- " .if " __stringify(cb) " == 0\n" \
+ " .word 663f - .\n" /* new instruction */ \
+- " .else\n" \
++ " .hword " __stringify(feature) "\n" /* feature bit */ \
++ " .byte 662b-661b\n" /* source len */ \
++ " .byte 664f-663f\n" /* replacement len */
++
++#define ALTINSTR_ENTRY_CB(feature, cb) \
++ " .word 661b - .\n" /* label */ \
+ " .word " __stringify(cb) "- .\n" /* callback */ \
+- " .endif\n" \
+ " .hword " __stringify(feature) "\n" /* feature bit */ \
+ " .byte 662b-661b\n" /* source len */ \
+ " .byte 664f-663f\n" /* replacement len */
+@@ -62,15 +65,14 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ *
+ * Alternatives with callbacks do not generate replacement instructions.
+ */
+-#define __ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg_enabled, cb) \
++#define __ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg_enabled) \
+ ".if "__stringify(cfg_enabled)" == 1\n" \
+ "661:\n\t" \
+ oldinstr "\n" \
+ "662:\n" \
+ ".pushsection .altinstructions,\"a\"\n" \
+- ALTINSTR_ENTRY(feature,cb) \
++ ALTINSTR_ENTRY(feature) \
+ ".popsection\n" \
+- " .if " __stringify(cb) " == 0\n" \
+ ".pushsection .altinstr_replacement, \"a\"\n" \
+ "663:\n\t" \
+ newinstr "\n" \
+@@ -78,17 +80,25 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ ".popsection\n\t" \
+ ".org . - (664b-663b) + (662b-661b)\n\t" \
+ ".org . - (662b-661b) + (664b-663b)\n" \
+- ".else\n\t" \
++ ".endif\n"
++
++#define __ALTERNATIVE_CFG_CB(oldinstr, feature, cfg_enabled, cb) \
++ ".if "__stringify(cfg_enabled)" == 1\n" \
++ "661:\n\t" \
++ oldinstr "\n" \
++ "662:\n" \
++ ".pushsection .altinstructions,\"a\"\n" \
++ ALTINSTR_ENTRY_CB(feature, cb) \
++ ".popsection\n" \
+ "663:\n\t" \
+ "664:\n\t" \
+- ".endif\n" \
+ ".endif\n"
+
+ #define _ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg, ...) \
+- __ALTERNATIVE_CFG(oldinstr, newinstr, feature, IS_ENABLED(cfg), 0)
++ __ALTERNATIVE_CFG(oldinstr, newinstr, feature, IS_ENABLED(cfg))
+
+ #define ALTERNATIVE_CB(oldinstr, cb) \
+- __ALTERNATIVE_CFG(oldinstr, "NOT_AN_INSTRUCTION", ARM64_CB_PATCH, 1, cb)
++ __ALTERNATIVE_CFG_CB(oldinstr, ARM64_CB_PATCH, 1, cb)
+ #else
+
+ #include <asm/assembler.h>
+diff --git a/arch/microblaze/kernel/cpu/cache.c b/arch/microblaze/kernel/cpu/cache.c
+index 0bde47e4fa69..dcba53803fa5 100644
+--- a/arch/microblaze/kernel/cpu/cache.c
++++ b/arch/microblaze/kernel/cpu/cache.c
+@@ -92,7 +92,8 @@ static inline void __disable_dcache_nomsr(void)
+ #define CACHE_LOOP_LIMITS(start, end, cache_line_length, cache_size) \
+ do { \
+ int align = ~(cache_line_length - 1); \
+- end = min(start + cache_size, end); \
++ if (start < UINT_MAX - cache_size) \
++ end = min(start + cache_size, end); \
+ start &= align; \
+ } while (0)
+
+diff --git a/arch/mips/loongson64/loongson-3/platform.c b/arch/mips/loongson64/loongson-3/platform.c
+index 25a97cc0ee33..0db4cc3196eb 100644
+--- a/arch/mips/loongson64/loongson-3/platform.c
++++ b/arch/mips/loongson64/loongson-3/platform.c
+@@ -31,6 +31,9 @@ static int __init loongson3_platform_init(void)
+ continue;
+
+ pdev = kzalloc(sizeof(struct platform_device), GFP_KERNEL);
++ if (!pdev)
++ return -ENOMEM;
++
+ pdev->name = loongson_sysconf.sensors[i].name;
+ pdev->id = loongson_sysconf.sensors[i].id;
+ pdev->dev.platform_data = &loongson_sysconf.sensors[i];
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index af1f3d5f9a0f..377d23f58197 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -554,12 +554,6 @@ static void *eeh_rmv_device(struct eeh_dev *edev, void *userdata)
+
+ pci_iov_remove_virtfn(edev->physfn, pdn->vf_index);
+ edev->pdev = NULL;
+-
+- /*
+- * We have to set the VF PE number to invalid one, which is
+- * required to plug the VF successfully.
+- */
+- pdn->pe_number = IODA_INVALID_PE;
+ #endif
+ if (rmv_data)
+ list_add(&edev->rmv_list, &rmv_data->edev_list);
+diff --git a/arch/powerpc/kernel/pci_dn.c b/arch/powerpc/kernel/pci_dn.c
+index ab147a1909c8..7cecc3bd953b 100644
+--- a/arch/powerpc/kernel/pci_dn.c
++++ b/arch/powerpc/kernel/pci_dn.c
+@@ -257,9 +257,22 @@ void remove_dev_pci_data(struct pci_dev *pdev)
+ continue;
+
+ #ifdef CONFIG_EEH
+- /* Release EEH device for the VF */
++ /*
++ * Release EEH state for this VF. The PCI core
++ * has already torn down the pci_dev for this VF, but
++ * we're responsible to removing the eeh_dev since it
++ * has the same lifetime as the pci_dn that spawned it.
++ */
+ edev = pdn_to_eeh_dev(pdn);
+ if (edev) {
++ /*
++ * We allocate pci_dn's for the totalvfs count,
++ * but only only the vfs that were activated
++ * have a configured PE.
++ */
++ if (edev->pe)
++ eeh_rmv_from_parent_pe(edev);
++
+ pdn->edev = NULL;
+ kfree(edev);
+ }
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index ee63749a2d47..ecd211c5f24a 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -1552,6 +1552,10 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+
+ /* Reserve PE for each VF */
+ for (vf_index = 0; vf_index < num_vfs; vf_index++) {
++ int vf_devfn = pci_iov_virtfn_devfn(pdev, vf_index);
++ int vf_bus = pci_iov_virtfn_bus(pdev, vf_index);
++ struct pci_dn *vf_pdn;
++
+ if (pdn->m64_single_mode)
+ pe_num = pdn->pe_num_map[vf_index];
+ else
+@@ -1564,13 +1568,11 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+ pe->pbus = NULL;
+ pe->parent_dev = pdev;
+ pe->mve_number = -1;
+- pe->rid = (pci_iov_virtfn_bus(pdev, vf_index) << 8) |
+- pci_iov_virtfn_devfn(pdev, vf_index);
++ pe->rid = (vf_bus << 8) | vf_devfn;
+
+ pe_info(pe, "VF %04d:%02d:%02d.%d associated with PE#%x\n",
+ hose->global_number, pdev->bus->number,
+- PCI_SLOT(pci_iov_virtfn_devfn(pdev, vf_index)),
+- PCI_FUNC(pci_iov_virtfn_devfn(pdev, vf_index)), pe_num);
++ PCI_SLOT(vf_devfn), PCI_FUNC(vf_devfn), pe_num);
+
+ if (pnv_ioda_configure_pe(phb, pe)) {
+ /* XXX What do we do here ? */
+@@ -1584,6 +1586,15 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+ list_add_tail(&pe->list, &phb->ioda.pe_list);
+ mutex_unlock(&phb->ioda.pe_list_mutex);
+
++ /* associate this pe to it's pdn */
++ list_for_each_entry(vf_pdn, &pdn->parent->child_list, list) {
++ if (vf_pdn->busno == vf_bus &&
++ vf_pdn->devfn == vf_devfn) {
++ vf_pdn->pe_number = pe_num;
++ break;
++ }
++ }
++
+ pnv_pci_ioda2_setup_dma_pe(phb, pe);
+ }
+ }
+@@ -3004,9 +3015,6 @@ static void pnv_pci_ioda_fixup_iov_resources(struct pci_dev *pdev)
+ struct pci_dn *pdn;
+ int mul, total_vfs;
+
+- if (!pdev->is_physfn || pci_dev_is_added(pdev))
+- return;
+-
+ pdn = pci_get_pdn(pdev);
+ pdn->vfs_expanded = 0;
+ pdn->m64_single_mode = false;
+@@ -3081,6 +3089,30 @@ truncate_iov:
+ res->end = res->start - 1;
+ }
+ }
++
++static void pnv_pci_ioda_fixup_iov(struct pci_dev *pdev)
++{
++ if (WARN_ON(pci_dev_is_added(pdev)))
++ return;
++
++ if (pdev->is_virtfn) {
++ struct pnv_ioda_pe *pe = pnv_ioda_get_pe(pdev);
++
++ /*
++ * VF PEs are single-device PEs so their pdev pointer needs to
++ * be set. The pdev doesn't exist when the PE is allocated (in
++ * (pcibios_sriov_enable()) so we fix it up here.
++ */
++ pe->pdev = pdev;
++ WARN_ON(!(pe->flags & PNV_IODA_PE_VF));
++ } else if (pdev->is_physfn) {
++ /*
++ * For PFs adjust their allocated IOV resources to match what
++ * the PHB can support using it's M64 BAR table.
++ */
++ pnv_pci_ioda_fixup_iov_resources(pdev);
++ }
++}
+ #endif /* CONFIG_PCI_IOV */
+
+ static void pnv_ioda_setup_pe_res(struct pnv_ioda_pe *pe,
+@@ -3974,7 +4006,7 @@ static void __init pnv_pci_init_ioda_phb(struct device_node *np,
+ ppc_md.pcibios_default_alignment = pnv_pci_default_alignment;
+
+ #ifdef CONFIG_PCI_IOV
+- ppc_md.pcibios_fixup_sriov = pnv_pci_ioda_fixup_iov_resources;
++ ppc_md.pcibios_fixup_sriov = pnv_pci_ioda_fixup_iov;
+ ppc_md.pcibios_iov_resource_alignment = pnv_pci_iov_resource_alignment;
+ ppc_md.pcibios_sriov_enable = pnv_pcibios_sriov_enable;
+ ppc_md.pcibios_sriov_disable = pnv_pcibios_sriov_disable;
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index c846300b7836..b6fa900af5da 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -820,24 +820,6 @@ void pnv_pci_dma_dev_setup(struct pci_dev *pdev)
+ {
+ struct pci_controller *hose = pci_bus_to_host(pdev->bus);
+ struct pnv_phb *phb = hose->private_data;
+-#ifdef CONFIG_PCI_IOV
+- struct pnv_ioda_pe *pe;
+- struct pci_dn *pdn;
+-
+- /* Fix the VF pdn PE number */
+- if (pdev->is_virtfn) {
+- pdn = pci_get_pdn(pdev);
+- WARN_ON(pdn->pe_number != IODA_INVALID_PE);
+- list_for_each_entry(pe, &phb->ioda.pe_list, list) {
+- if (pe->rid == ((pdev->bus->number << 8) |
+- (pdev->devfn & 0xff))) {
+- pdn->pe_number = pe->pe_number;
+- pe->pdev = pdev;
+- break;
+- }
+- }
+- }
+-#endif /* CONFIG_PCI_IOV */
+
+ if (phb && phb->dma_dev_setup)
+ phb->dma_dev_setup(phb, pdev);
+diff --git a/arch/s390/Makefile b/arch/s390/Makefile
+index e6c2e8925fef..4bccde36cb16 100644
+--- a/arch/s390/Makefile
++++ b/arch/s390/Makefile
+@@ -63,7 +63,7 @@ cflags-y += -Wa,-I$(srctree)/arch/$(ARCH)/include
+ #
+ cflags-$(CONFIG_FRAME_POINTER) += -fno-optimize-sibling-calls
+
+-ifeq ($(call cc-option-yn,-mpacked-stack),y)
++ifeq ($(call cc-option-yn,-mpacked-stack -mbackchain -msoft-float),y)
+ cflags-$(CONFIG_PACK_STACK) += -mpacked-stack -D__PACK_STACK
+ aflags-$(CONFIG_PACK_STACK) += -D__PACK_STACK
+ endif
+diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
+index e93fbf02490c..83afd5b78e16 100644
+--- a/arch/s390/kernel/mcount.S
++++ b/arch/s390/kernel/mcount.S
+@@ -25,6 +25,12 @@ ENTRY(ftrace_stub)
+ #define STACK_PTREGS (STACK_FRAME_OVERHEAD)
+ #define STACK_PTREGS_GPRS (STACK_PTREGS + __PT_GPRS)
+ #define STACK_PTREGS_PSW (STACK_PTREGS + __PT_PSW)
++#ifdef __PACK_STACK
++/* allocate just enough for r14, r15 and backchain */
++#define TRACED_FUNC_FRAME_SIZE 24
++#else
++#define TRACED_FUNC_FRAME_SIZE STACK_FRAME_OVERHEAD
++#endif
+
+ ENTRY(_mcount)
+ BR_EX %r14
+@@ -38,9 +44,16 @@ ENTRY(ftrace_caller)
+ #if !(defined(CC_USING_HOTPATCH) || defined(CC_USING_NOP_MCOUNT))
+ aghi %r0,MCOUNT_RETURN_FIXUP
+ #endif
+- aghi %r15,-STACK_FRAME_SIZE
++ # allocate stack frame for ftrace_caller to contain traced function
++ aghi %r15,-TRACED_FUNC_FRAME_SIZE
+ stg %r1,__SF_BACKCHAIN(%r15)
++ stg %r0,(__SF_GPRS+8*8)(%r15)
++ stg %r15,(__SF_GPRS+9*8)(%r15)
++ # allocate pt_regs and stack frame for ftrace_trace_function
++ aghi %r15,-STACK_FRAME_SIZE
+ stg %r1,(STACK_PTREGS_GPRS+15*8)(%r15)
++ aghi %r1,-TRACED_FUNC_FRAME_SIZE
++ stg %r1,__SF_BACKCHAIN(%r15)
+ stg %r0,(STACK_PTREGS_PSW+8)(%r15)
+ stmg %r2,%r14,(STACK_PTREGS_GPRS+2*8)(%r15)
+ #ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index 05ea466b9e40..3515f2b55eb9 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -2109,7 +2109,7 @@ static int flic_ais_mode_get_all(struct kvm *kvm, struct kvm_device_attr *attr)
+ return -EINVAL;
+
+ if (!test_kvm_facility(kvm, 72))
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+
+ mutex_lock(&fi->ais_lock);
+ ais.simm = fi->simm;
+@@ -2412,7 +2412,7 @@ static int modify_ais_mode(struct kvm *kvm, struct kvm_device_attr *attr)
+ int ret = 0;
+
+ if (!test_kvm_facility(kvm, 72))
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+
+ if (copy_from_user(&req, (void __user *)attr->addr, sizeof(req)))
+ return -EFAULT;
+@@ -2492,7 +2492,7 @@ static int flic_ais_mode_set_all(struct kvm *kvm, struct kvm_device_attr *attr)
+ struct kvm_s390_ais_all ais;
+
+ if (!test_kvm_facility(kvm, 72))
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+
+ if (copy_from_user(&ais, (void __user *)attr->addr, sizeof(ais)))
+ return -EFAULT;
+diff --git a/arch/s390/pci/pci_sysfs.c b/arch/s390/pci/pci_sysfs.c
+index 430c14b006d1..0e11fc023fe7 100644
+--- a/arch/s390/pci/pci_sysfs.c
++++ b/arch/s390/pci/pci_sysfs.c
+@@ -13,6 +13,8 @@
+ #include <linux/stat.h>
+ #include <linux/pci.h>
+
++#include "../../../drivers/pci/pci.h"
++
+ #include <asm/sclp.h>
+
+ #define zpci_attr(name, fmt, member) \
+@@ -40,31 +42,50 @@ zpci_attr(segment3, "0x%02x\n", pfip[3]);
+ static ssize_t recover_store(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
++ struct kernfs_node *kn;
+ struct pci_dev *pdev = to_pci_dev(dev);
+ struct zpci_dev *zdev = to_zpci(pdev);
+- int ret;
+-
+- if (!device_remove_file_self(dev, attr))
+- return count;
+-
++ int ret = 0;
++
++ /* Can't use device_remove_self() here as that would lead us to lock
++ * the pci_rescan_remove_lock while holding the device' kernfs lock.
++ * This would create a possible deadlock with disable_slot() which is
++ * not directly protected by the device' kernfs lock but takes it
++ * during the device removal which happens under
++ * pci_rescan_remove_lock.
++ *
++ * This is analogous to sdev_store_delete() in
++ * drivers/scsi/scsi_sysfs.c
++ */
++ kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
++ WARN_ON_ONCE(!kn);
++ /* device_remove_file() serializes concurrent calls ignoring all but
++ * the first
++ */
++ device_remove_file(dev, attr);
++
++ /* A concurrent call to recover_store() may slip between
++ * sysfs_break_active_protection() and the sysfs file removal.
++ * Once it unblocks from pci_lock_rescan_remove() the original pdev
++ * will already be removed.
++ */
+ pci_lock_rescan_remove();
+- pci_stop_and_remove_bus_device(pdev);
+- ret = zpci_disable_device(zdev);
+- if (ret)
+- goto error;
+-
+- ret = zpci_enable_device(zdev);
+- if (ret)
+- goto error;
+-
+- pci_rescan_bus(zdev->bus);
++ if (pci_dev_is_added(pdev)) {
++ pci_stop_and_remove_bus_device(pdev);
++ ret = zpci_disable_device(zdev);
++ if (ret)
++ goto out;
++
++ ret = zpci_enable_device(zdev);
++ if (ret)
++ goto out;
++ pci_rescan_bus(zdev->bus);
++ }
++out:
+ pci_unlock_rescan_remove();
+-
+- return count;
+-
+-error:
+- pci_unlock_rescan_remove();
+- return ret;
++ if (kn)
++ sysfs_unbreak_active_protection(kn);
++ return ret ? ret : count;
+ }
+ static DEVICE_ATTR_WO(recover);
+
+diff --git a/arch/sh/include/cpu-sh2a/cpu/sh7269.h b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
+index d516e5d48818..b887cc402b71 100644
+--- a/arch/sh/include/cpu-sh2a/cpu/sh7269.h
++++ b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
+@@ -78,8 +78,15 @@ enum {
+ GPIO_FN_WDTOVF,
+
+ /* CAN */
+- GPIO_FN_CTX1, GPIO_FN_CRX1, GPIO_FN_CTX0, GPIO_FN_CTX0_CTX1,
+- GPIO_FN_CRX0, GPIO_FN_CRX0_CRX1, GPIO_FN_CRX0_CRX1_CRX2,
++ GPIO_FN_CTX2, GPIO_FN_CRX2,
++ GPIO_FN_CTX1, GPIO_FN_CRX1,
++ GPIO_FN_CTX0, GPIO_FN_CRX0,
++ GPIO_FN_CTX0_CTX1, GPIO_FN_CRX0_CRX1,
++ GPIO_FN_CTX0_CTX1_CTX2, GPIO_FN_CRX0_CRX1_CRX2,
++ GPIO_FN_CTX2_PJ21, GPIO_FN_CRX2_PJ20,
++ GPIO_FN_CTX1_PJ23, GPIO_FN_CRX1_PJ22,
++ GPIO_FN_CTX0_CTX1_PJ23, GPIO_FN_CRX0_CRX1_PJ22,
++ GPIO_FN_CTX0_CTX1_CTX2_PJ21, GPIO_FN_CRX0_CRX1_CRX2_PJ20,
+
+ /* DMAC */
+ GPIO_FN_TEND0, GPIO_FN_DACK0, GPIO_FN_DREQ0,
+diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
+index 61afd787bd0c..59b6df13ddea 100644
+--- a/arch/sparc/kernel/vmlinux.lds.S
++++ b/arch/sparc/kernel/vmlinux.lds.S
+@@ -172,12 +172,14 @@ SECTIONS
+ }
+ PERCPU_SECTION(SMP_CACHE_BYTES)
+
+-#ifdef CONFIG_JUMP_LABEL
+ . = ALIGN(PAGE_SIZE);
+ .exit.text : {
+ EXIT_TEXT
+ }
+-#endif
++
++ .exit.data : {
++ EXIT_DATA
++ }
+
+ . = ALIGN(PAGE_SIZE);
+ __init_end = .;
+diff --git a/arch/x86/entry/vdso/vdso32-setup.c b/arch/x86/entry/vdso/vdso32-setup.c
+index 42d4c89f990e..ddff0ca6f509 100644
+--- a/arch/x86/entry/vdso/vdso32-setup.c
++++ b/arch/x86/entry/vdso/vdso32-setup.c
+@@ -11,6 +11,7 @@
+ #include <linux/smp.h>
+ #include <linux/kernel.h>
+ #include <linux/mm_types.h>
++#include <linux/elf.h>
+
+ #include <asm/processor.h>
+ #include <asm/vdso.h>
+diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h
+index 75ded1d13d98..9d5d949e662e 100644
+--- a/arch/x86/include/asm/nmi.h
++++ b/arch/x86/include/asm/nmi.h
+@@ -41,7 +41,6 @@ struct nmiaction {
+ struct list_head list;
+ nmi_handler_t handler;
+ u64 max_duration;
+- struct irq_work irq_work;
+ unsigned long flags;
+ const char *name;
+ };
+diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
+index 086cf1d1d71d..0f8b9b900b0e 100644
+--- a/arch/x86/kernel/nmi.c
++++ b/arch/x86/kernel/nmi.c
+@@ -102,18 +102,22 @@ static int __init nmi_warning_debugfs(void)
+ }
+ fs_initcall(nmi_warning_debugfs);
+
+-static void nmi_max_handler(struct irq_work *w)
++static void nmi_check_duration(struct nmiaction *action, u64 duration)
+ {
+- struct nmiaction *a = container_of(w, struct nmiaction, irq_work);
++ u64 whole_msecs = READ_ONCE(action->max_duration);
+ int remainder_ns, decimal_msecs;
+- u64 whole_msecs = READ_ONCE(a->max_duration);
++
++ if (duration < nmi_longest_ns || duration < action->max_duration)
++ return;
++
++ action->max_duration = duration;
+
+ remainder_ns = do_div(whole_msecs, (1000 * 1000));
+ decimal_msecs = remainder_ns / 1000;
+
+ printk_ratelimited(KERN_INFO
+ "INFO: NMI handler (%ps) took too long to run: %lld.%03d msecs\n",
+- a->handler, whole_msecs, decimal_msecs);
++ action->handler, whole_msecs, decimal_msecs);
+ }
+
+ static int nmi_handle(unsigned int type, struct pt_regs *regs)
+@@ -140,11 +144,7 @@ static int nmi_handle(unsigned int type, struct pt_regs *regs)
+ delta = sched_clock() - delta;
+ trace_nmi_handler(a->handler, (int)delta, thishandled);
+
+- if (delta < nmi_longest_ns || delta < a->max_duration)
+- continue;
+-
+- a->max_duration = delta;
+- irq_work_queue(&a->irq_work);
++ nmi_check_duration(a, delta);
+ }
+
+ rcu_read_unlock();
+@@ -162,8 +162,6 @@ int __register_nmi_handler(unsigned int type, struct nmiaction *action)
+ if (!action->handler)
+ return -EINVAL;
+
+- init_irq_work(&action->irq_work, nmi_max_handler);
+-
+ raw_spin_lock_irqsave(&desc->lock, flags);
+
+ /*
+diff --git a/arch/x86/kernel/sysfb_simplefb.c b/arch/x86/kernel/sysfb_simplefb.c
+index 85195d447a92..f3215346e47f 100644
+--- a/arch/x86/kernel/sysfb_simplefb.c
++++ b/arch/x86/kernel/sysfb_simplefb.c
+@@ -94,11 +94,11 @@ __init int create_simplefb(const struct screen_info *si,
+ if (si->orig_video_isVGA == VIDEO_TYPE_VLFB)
+ size <<= 16;
+ length = mode->height * mode->stride;
+- length = PAGE_ALIGN(length);
+ if (length > size) {
+ printk(KERN_WARNING "sysfb: VRAM smaller than advertised\n");
+ return -EINVAL;
+ }
++ length = PAGE_ALIGN(length);
+
+ /* setup IORESOURCE_MEM as framebuffer memory */
+ memset(&res, 0, sizeof(res));
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 2660c01eadae..aead984d89ad 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -5302,6 +5302,9 @@ static void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
+
+ static int get_ept_level(struct kvm_vcpu *vcpu)
+ {
++ /* Nested EPT currently only supports 4-level walks. */
++ if (is_guest_mode(vcpu) && nested_cpu_has_ept(get_vmcs12(vcpu)))
++ return 4;
+ if (cpu_has_vmx_ept_5levels() && (cpuid_maxphyaddr(vcpu) > 48))
+ return 5;
+ return 4;
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+deleted file mode 100644
+index 997926a9121c..000000000000
+--- a/arch/x86/kvm/vmx/vmx.c
++++ /dev/null
+@@ -1,8036 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0-only
+-/*
+- * Kernel-based Virtual Machine driver for Linux
+- *
+- * This module enables machines with Intel VT-x extensions to run virtual
+- * machines without emulation or binary translation.
+- *
+- * Copyright (C) 2006 Qumranet, Inc.
+- * Copyright 2010 Red Hat, Inc. and/or its affiliates.
+- *
+- * Authors:
+- * Avi Kivity <avi@qumranet.com>
+- * Yaniv Kamay <yaniv@qumranet.com>
+- */
+-
+-#include <linux/frame.h>
+-#include <linux/highmem.h>
+-#include <linux/hrtimer.h>
+-#include <linux/kernel.h>
+-#include <linux/kvm_host.h>
+-#include <linux/module.h>
+-#include <linux/moduleparam.h>
+-#include <linux/mod_devicetable.h>
+-#include <linux/mm.h>
+-#include <linux/sched.h>
+-#include <linux/sched/smt.h>
+-#include <linux/slab.h>
+-#include <linux/tboot.h>
+-#include <linux/trace_events.h>
+-
+-#include <asm/apic.h>
+-#include <asm/asm.h>
+-#include <asm/cpu.h>
+-#include <asm/debugreg.h>
+-#include <asm/desc.h>
+-#include <asm/fpu/internal.h>
+-#include <asm/io.h>
+-#include <asm/irq_remapping.h>
+-#include <asm/kexec.h>
+-#include <asm/perf_event.h>
+-#include <asm/mce.h>
+-#include <asm/mmu_context.h>
+-#include <asm/mshyperv.h>
+-#include <asm/spec-ctrl.h>
+-#include <asm/virtext.h>
+-#include <asm/vmx.h>
+-
+-#include "capabilities.h"
+-#include "cpuid.h"
+-#include "evmcs.h"
+-#include "irq.h"
+-#include "kvm_cache_regs.h"
+-#include "lapic.h"
+-#include "mmu.h"
+-#include "nested.h"
+-#include "ops.h"
+-#include "pmu.h"
+-#include "trace.h"
+-#include "vmcs.h"
+-#include "vmcs12.h"
+-#include "vmx.h"
+-#include "x86.h"
+-
+-MODULE_AUTHOR("Qumranet");
+-MODULE_LICENSE("GPL");
+-
+-static const struct x86_cpu_id vmx_cpu_id[] = {
+- X86_FEATURE_MATCH(X86_FEATURE_VMX),
+- {}
+-};
+-MODULE_DEVICE_TABLE(x86cpu, vmx_cpu_id);
+-
+-bool __read_mostly enable_vpid = 1;
+-module_param_named(vpid, enable_vpid, bool, 0444);
+-
+-static bool __read_mostly enable_vnmi = 1;
+-module_param_named(vnmi, enable_vnmi, bool, S_IRUGO);
+-
+-bool __read_mostly flexpriority_enabled = 1;
+-module_param_named(flexpriority, flexpriority_enabled, bool, S_IRUGO);
+-
+-bool __read_mostly enable_ept = 1;
+-module_param_named(ept, enable_ept, bool, S_IRUGO);
+-
+-bool __read_mostly enable_unrestricted_guest = 1;
+-module_param_named(unrestricted_guest,
+- enable_unrestricted_guest, bool, S_IRUGO);
+-
+-bool __read_mostly enable_ept_ad_bits = 1;
+-module_param_named(eptad, enable_ept_ad_bits, bool, S_IRUGO);
+-
+-static bool __read_mostly emulate_invalid_guest_state = true;
+-module_param(emulate_invalid_guest_state, bool, S_IRUGO);
+-
+-static bool __read_mostly fasteoi = 1;
+-module_param(fasteoi, bool, S_IRUGO);
+-
+-static bool __read_mostly enable_apicv = 1;
+-module_param(enable_apicv, bool, S_IRUGO);
+-
+-/*
+- * If nested=1, nested virtualization is supported, i.e., guests may use
+- * VMX and be a hypervisor for its own guests. If nested=0, guests may not
+- * use VMX instructions.
+- */
+-static bool __read_mostly nested = 1;
+-module_param(nested, bool, S_IRUGO);
+-
+-bool __read_mostly enable_pml = 1;
+-module_param_named(pml, enable_pml, bool, S_IRUGO);
+-
+-static bool __read_mostly dump_invalid_vmcs = 0;
+-module_param(dump_invalid_vmcs, bool, 0644);
+-
+-#define MSR_BITMAP_MODE_X2APIC 1
+-#define MSR_BITMAP_MODE_X2APIC_APICV 2
+-
+-#define KVM_VMX_TSC_MULTIPLIER_MAX 0xffffffffffffffffULL
+-
+-/* Guest_tsc -> host_tsc conversion requires 64-bit division. */
+-static int __read_mostly cpu_preemption_timer_multi;
+-static bool __read_mostly enable_preemption_timer = 1;
+-#ifdef CONFIG_X86_64
+-module_param_named(preemption_timer, enable_preemption_timer, bool, S_IRUGO);
+-#endif
+-
+-#define KVM_VM_CR0_ALWAYS_OFF (X86_CR0_NW | X86_CR0_CD)
+-#define KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR0_NE
+-#define KVM_VM_CR0_ALWAYS_ON \
+- (KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST | \
+- X86_CR0_WP | X86_CR0_PG | X86_CR0_PE)
+-#define KVM_CR4_GUEST_OWNED_BITS \
+- (X86_CR4_PVI | X86_CR4_DE | X86_CR4_PCE | X86_CR4_OSFXSR \
+- | X86_CR4_OSXMMEXCPT | X86_CR4_LA57 | X86_CR4_TSD)
+-
+-#define KVM_VM_CR4_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR4_VMXE
+-#define KVM_PMODE_VM_CR4_ALWAYS_ON (X86_CR4_PAE | X86_CR4_VMXE)
+-#define KVM_RMODE_VM_CR4_ALWAYS_ON (X86_CR4_VME | X86_CR4_PAE | X86_CR4_VMXE)
+-
+-#define RMODE_GUEST_OWNED_EFLAGS_BITS (~(X86_EFLAGS_IOPL | X86_EFLAGS_VM))
+-
+-#define MSR_IA32_RTIT_STATUS_MASK (~(RTIT_STATUS_FILTEREN | \
+- RTIT_STATUS_CONTEXTEN | RTIT_STATUS_TRIGGEREN | \
+- RTIT_STATUS_ERROR | RTIT_STATUS_STOPPED | \
+- RTIT_STATUS_BYTECNT))
+-
+-#define MSR_IA32_RTIT_OUTPUT_BASE_MASK \
+- (~((1UL << cpuid_query_maxphyaddr(vcpu)) - 1) | 0x7f)
+-
+-/*
+- * These 2 parameters are used to config the controls for Pause-Loop Exiting:
+- * ple_gap: upper bound on the amount of time between two successive
+- * executions of PAUSE in a loop. Also indicate if ple enabled.
+- * According to test, this time is usually smaller than 128 cycles.
+- * ple_window: upper bound on the amount of time a guest is allowed to execute
+- * in a PAUSE loop. Tests indicate that most spinlocks are held for
+- * less than 2^12 cycles
+- * Time is measured based on a counter that runs at the same rate as the TSC,
+- * refer SDM volume 3b section 21.6.13 & 22.1.3.
+- */
+-static unsigned int ple_gap = KVM_DEFAULT_PLE_GAP;
+-module_param(ple_gap, uint, 0444);
+-
+-static unsigned int ple_window = KVM_VMX_DEFAULT_PLE_WINDOW;
+-module_param(ple_window, uint, 0444);
+-
+-/* Default doubles per-vcpu window every exit. */
+-static unsigned int ple_window_grow = KVM_DEFAULT_PLE_WINDOW_GROW;
+-module_param(ple_window_grow, uint, 0444);
+-
+-/* Default resets per-vcpu window every exit to ple_window. */
+-static unsigned int ple_window_shrink = KVM_DEFAULT_PLE_WINDOW_SHRINK;
+-module_param(ple_window_shrink, uint, 0444);
+-
+-/* Default is to compute the maximum so we can never overflow. */
+-static unsigned int ple_window_max = KVM_VMX_DEFAULT_PLE_WINDOW_MAX;
+-module_param(ple_window_max, uint, 0444);
+-
+-/* Default is SYSTEM mode, 1 for host-guest mode */
+-int __read_mostly pt_mode = PT_MODE_SYSTEM;
+-module_param(pt_mode, int, S_IRUGO);
+-
+-static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
+-static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_cond);
+-static DEFINE_MUTEX(vmx_l1d_flush_mutex);
+-
+-/* Storage for pre module init parameter parsing */
+-static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param = VMENTER_L1D_FLUSH_AUTO;
+-
+-static const struct {
+- const char *option;
+- bool for_parse;
+-} vmentry_l1d_param[] = {
+- [VMENTER_L1D_FLUSH_AUTO] = {"auto", true},
+- [VMENTER_L1D_FLUSH_NEVER] = {"never", true},
+- [VMENTER_L1D_FLUSH_COND] = {"cond", true},
+- [VMENTER_L1D_FLUSH_ALWAYS] = {"always", true},
+- [VMENTER_L1D_FLUSH_EPT_DISABLED] = {"EPT disabled", false},
+- [VMENTER_L1D_FLUSH_NOT_REQUIRED] = {"not required", false},
+-};
+-
+-#define L1D_CACHE_ORDER 4
+-static void *vmx_l1d_flush_pages;
+-
+-static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf)
+-{
+- struct page *page;
+- unsigned int i;
+-
+- if (!boot_cpu_has_bug(X86_BUG_L1TF)) {
+- l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED;
+- return 0;
+- }
+-
+- if (!enable_ept) {
+- l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_EPT_DISABLED;
+- return 0;
+- }
+-
+- if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) {
+- u64 msr;
+-
+- rdmsrl(MSR_IA32_ARCH_CAPABILITIES, msr);
+- if (msr & ARCH_CAP_SKIP_VMENTRY_L1DFLUSH) {
+- l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED;
+- return 0;
+- }
+- }
+-
+- /* If set to auto use the default l1tf mitigation method */
+- if (l1tf == VMENTER_L1D_FLUSH_AUTO) {
+- switch (l1tf_mitigation) {
+- case L1TF_MITIGATION_OFF:
+- l1tf = VMENTER_L1D_FLUSH_NEVER;
+- break;
+- case L1TF_MITIGATION_FLUSH_NOWARN:
+- case L1TF_MITIGATION_FLUSH:
+- case L1TF_MITIGATION_FLUSH_NOSMT:
+- l1tf = VMENTER_L1D_FLUSH_COND;
+- break;
+- case L1TF_MITIGATION_FULL:
+- case L1TF_MITIGATION_FULL_FORCE:
+- l1tf = VMENTER_L1D_FLUSH_ALWAYS;
+- break;
+- }
+- } else if (l1tf_mitigation == L1TF_MITIGATION_FULL_FORCE) {
+- l1tf = VMENTER_L1D_FLUSH_ALWAYS;
+- }
+-
+- if (l1tf != VMENTER_L1D_FLUSH_NEVER && !vmx_l1d_flush_pages &&
+- !boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
+- /*
+- * This allocation for vmx_l1d_flush_pages is not tied to a VM
+- * lifetime and so should not be charged to a memcg.
+- */
+- page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER);
+- if (!page)
+- return -ENOMEM;
+- vmx_l1d_flush_pages = page_address(page);
+-
+- /*
+- * Initialize each page with a different pattern in
+- * order to protect against KSM in the nested
+- * virtualization case.
+- */
+- for (i = 0; i < 1u << L1D_CACHE_ORDER; ++i) {
+- memset(vmx_l1d_flush_pages + i * PAGE_SIZE, i + 1,
+- PAGE_SIZE);
+- }
+- }
+-
+- l1tf_vmx_mitigation = l1tf;
+-
+- if (l1tf != VMENTER_L1D_FLUSH_NEVER)
+- static_branch_enable(&vmx_l1d_should_flush);
+- else
+- static_branch_disable(&vmx_l1d_should_flush);
+-
+- if (l1tf == VMENTER_L1D_FLUSH_COND)
+- static_branch_enable(&vmx_l1d_flush_cond);
+- else
+- static_branch_disable(&vmx_l1d_flush_cond);
+- return 0;
+-}
+-
+-static int vmentry_l1d_flush_parse(const char *s)
+-{
+- unsigned int i;
+-
+- if (s) {
+- for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
+- if (vmentry_l1d_param[i].for_parse &&
+- sysfs_streq(s, vmentry_l1d_param[i].option))
+- return i;
+- }
+- }
+- return -EINVAL;
+-}
+-
+-static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
+-{
+- int l1tf, ret;
+-
+- l1tf = vmentry_l1d_flush_parse(s);
+- if (l1tf < 0)
+- return l1tf;
+-
+- if (!boot_cpu_has(X86_BUG_L1TF))
+- return 0;
+-
+- /*
+- * Has vmx_init() run already? If not then this is the pre init
+- * parameter parsing. In that case just store the value and let
+- * vmx_init() do the proper setup after enable_ept has been
+- * established.
+- */
+- if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO) {
+- vmentry_l1d_flush_param = l1tf;
+- return 0;
+- }
+-
+- mutex_lock(&vmx_l1d_flush_mutex);
+- ret = vmx_setup_l1d_flush(l1tf);
+- mutex_unlock(&vmx_l1d_flush_mutex);
+- return ret;
+-}
+-
+-static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp)
+-{
+- if (WARN_ON_ONCE(l1tf_vmx_mitigation >= ARRAY_SIZE(vmentry_l1d_param)))
+- return sprintf(s, "???\n");
+-
+- return sprintf(s, "%s\n", vmentry_l1d_param[l1tf_vmx_mitigation].option);
+-}
+-
+-static const struct kernel_param_ops vmentry_l1d_flush_ops = {
+- .set = vmentry_l1d_flush_set,
+- .get = vmentry_l1d_flush_get,
+-};
+-module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, NULL, 0644);
+-
+-static bool guest_state_valid(struct kvm_vcpu *vcpu);
+-static u32 vmx_segment_access_rights(struct kvm_segment *var);
+-static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
+- u32 msr, int type);
+-
+-void vmx_vmexit(void);
+-
+-#define vmx_insn_failed(fmt...) \
+-do { \
+- WARN_ONCE(1, fmt); \
+- pr_warn_ratelimited(fmt); \
+-} while (0)
+-
+-asmlinkage void vmread_error(unsigned long field, bool fault)
+-{
+- if (fault)
+- kvm_spurious_fault();
+- else
+- vmx_insn_failed("kvm: vmread failed: field=%lx\n", field);
+-}
+-
+-noinline void vmwrite_error(unsigned long field, unsigned long value)
+-{
+- vmx_insn_failed("kvm: vmwrite failed: field=%lx val=%lx err=%d\n",
+- field, value, vmcs_read32(VM_INSTRUCTION_ERROR));
+-}
+-
+-noinline void vmclear_error(struct vmcs *vmcs, u64 phys_addr)
+-{
+- vmx_insn_failed("kvm: vmclear failed: %p/%llx\n", vmcs, phys_addr);
+-}
+-
+-noinline void vmptrld_error(struct vmcs *vmcs, u64 phys_addr)
+-{
+- vmx_insn_failed("kvm: vmptrld failed: %p/%llx\n", vmcs, phys_addr);
+-}
+-
+-noinline void invvpid_error(unsigned long ext, u16 vpid, gva_t gva)
+-{
+- vmx_insn_failed("kvm: invvpid failed: ext=0x%lx vpid=%u gva=0x%lx\n",
+- ext, vpid, gva);
+-}
+-
+-noinline void invept_error(unsigned long ext, u64 eptp, gpa_t gpa)
+-{
+- vmx_insn_failed("kvm: invept failed: ext=0x%lx eptp=%llx gpa=0x%llx\n",
+- ext, eptp, gpa);
+-}
+-
+-static DEFINE_PER_CPU(struct vmcs *, vmxarea);
+-DEFINE_PER_CPU(struct vmcs *, current_vmcs);
+-/*
+- * We maintain a per-CPU linked-list of VMCS loaded on that CPU. This is needed
+- * when a CPU is brought down, and we need to VMCLEAR all VMCSs loaded on it.
+- */
+-static DEFINE_PER_CPU(struct list_head, loaded_vmcss_on_cpu);
+-
+-/*
+- * We maintian a per-CPU linked-list of vCPU, so in wakeup_handler() we
+- * can find which vCPU should be waken up.
+- */
+-static DEFINE_PER_CPU(struct list_head, blocked_vcpu_on_cpu);
+-static DEFINE_PER_CPU(spinlock_t, blocked_vcpu_on_cpu_lock);
+-
+-static DECLARE_BITMAP(vmx_vpid_bitmap, VMX_NR_VPIDS);
+-static DEFINE_SPINLOCK(vmx_vpid_lock);
+-
+-struct vmcs_config vmcs_config;
+-struct vmx_capability vmx_capability;
+-
+-#define VMX_SEGMENT_FIELD(seg) \
+- [VCPU_SREG_##seg] = { \
+- .selector = GUEST_##seg##_SELECTOR, \
+- .base = GUEST_##seg##_BASE, \
+- .limit = GUEST_##seg##_LIMIT, \
+- .ar_bytes = GUEST_##seg##_AR_BYTES, \
+- }
+-
+-static const struct kvm_vmx_segment_field {
+- unsigned selector;
+- unsigned base;
+- unsigned limit;
+- unsigned ar_bytes;
+-} kvm_vmx_segment_fields[] = {
+- VMX_SEGMENT_FIELD(CS),
+- VMX_SEGMENT_FIELD(DS),
+- VMX_SEGMENT_FIELD(ES),
+- VMX_SEGMENT_FIELD(FS),
+- VMX_SEGMENT_FIELD(GS),
+- VMX_SEGMENT_FIELD(SS),
+- VMX_SEGMENT_FIELD(TR),
+- VMX_SEGMENT_FIELD(LDTR),
+-};
+-
+-u64 host_efer;
+-static unsigned long host_idt_base;
+-
+-/*
+- * Though SYSCALL is only supported in 64-bit mode on Intel CPUs, kvm
+- * will emulate SYSCALL in legacy mode if the vendor string in guest
+- * CPUID.0:{EBX,ECX,EDX} is "AuthenticAMD" or "AMDisbetter!" To
+- * support this emulation, IA32_STAR must always be included in
+- * vmx_msr_index[], even in i386 builds.
+- */
+-const u32 vmx_msr_index[] = {
+-#ifdef CONFIG_X86_64
+- MSR_SYSCALL_MASK, MSR_LSTAR, MSR_CSTAR,
+-#endif
+- MSR_EFER, MSR_TSC_AUX, MSR_STAR,
+- MSR_IA32_TSX_CTRL,
+-};
+-
+-#if IS_ENABLED(CONFIG_HYPERV)
+-static bool __read_mostly enlightened_vmcs = true;
+-module_param(enlightened_vmcs, bool, 0444);
+-
+-/* check_ept_pointer() should be under protection of ept_pointer_lock. */
+-static void check_ept_pointer_match(struct kvm *kvm)
+-{
+- struct kvm_vcpu *vcpu;
+- u64 tmp_eptp = INVALID_PAGE;
+- int i;
+-
+- kvm_for_each_vcpu(i, vcpu, kvm) {
+- if (!VALID_PAGE(tmp_eptp)) {
+- tmp_eptp = to_vmx(vcpu)->ept_pointer;
+- } else if (tmp_eptp != to_vmx(vcpu)->ept_pointer) {
+- to_kvm_vmx(kvm)->ept_pointers_match
+- = EPT_POINTERS_MISMATCH;
+- return;
+- }
+- }
+-
+- to_kvm_vmx(kvm)->ept_pointers_match = EPT_POINTERS_MATCH;
+-}
+-
+-static int kvm_fill_hv_flush_list_func(struct hv_guest_mapping_flush_list *flush,
+- void *data)
+-{
+- struct kvm_tlb_range *range = data;
+-
+- return hyperv_fill_flush_guest_mapping_list(flush, range->start_gfn,
+- range->pages);
+-}
+-
+-static inline int __hv_remote_flush_tlb_with_range(struct kvm *kvm,
+- struct kvm_vcpu *vcpu, struct kvm_tlb_range *range)
+-{
+- u64 ept_pointer = to_vmx(vcpu)->ept_pointer;
+-
+- /*
+- * FLUSH_GUEST_PHYSICAL_ADDRESS_SPACE hypercall needs address
+- * of the base of EPT PML4 table, strip off EPT configuration
+- * information.
+- */
+- if (range)
+- return hyperv_flush_guest_mapping_range(ept_pointer & PAGE_MASK,
+- kvm_fill_hv_flush_list_func, (void *)range);
+- else
+- return hyperv_flush_guest_mapping(ept_pointer & PAGE_MASK);
+-}
+-
+-static int hv_remote_flush_tlb_with_range(struct kvm *kvm,
+- struct kvm_tlb_range *range)
+-{
+- struct kvm_vcpu *vcpu;
+- int ret = 0, i;
+-
+- spin_lock(&to_kvm_vmx(kvm)->ept_pointer_lock);
+-
+- if (to_kvm_vmx(kvm)->ept_pointers_match == EPT_POINTERS_CHECK)
+- check_ept_pointer_match(kvm);
+-
+- if (to_kvm_vmx(kvm)->ept_pointers_match != EPT_POINTERS_MATCH) {
+- kvm_for_each_vcpu(i, vcpu, kvm) {
+- /* If ept_pointer is invalid pointer, bypass flush request. */
+- if (VALID_PAGE(to_vmx(vcpu)->ept_pointer))
+- ret |= __hv_remote_flush_tlb_with_range(
+- kvm, vcpu, range);
+- }
+- } else {
+- ret = __hv_remote_flush_tlb_with_range(kvm,
+- kvm_get_vcpu(kvm, 0), range);
+- }
+-
+- spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock);
+- return ret;
+-}
+-static int hv_remote_flush_tlb(struct kvm *kvm)
+-{
+- return hv_remote_flush_tlb_with_range(kvm, NULL);
+-}
+-
+-static int hv_enable_direct_tlbflush(struct kvm_vcpu *vcpu)
+-{
+- struct hv_enlightened_vmcs *evmcs;
+- struct hv_partition_assist_pg **p_hv_pa_pg =
+- &vcpu->kvm->arch.hyperv.hv_pa_pg;
+- /*
+- * Synthetic VM-Exit is not enabled in current code and so All
+- * evmcs in singe VM shares same assist page.
+- */
+- if (!*p_hv_pa_pg)
+- *p_hv_pa_pg = kzalloc(PAGE_SIZE, GFP_KERNEL);
+-
+- if (!*p_hv_pa_pg)
+- return -ENOMEM;
+-
+- evmcs = (struct hv_enlightened_vmcs *)to_vmx(vcpu)->loaded_vmcs->vmcs;
+-
+- evmcs->partition_assist_page =
+- __pa(*p_hv_pa_pg);
+- evmcs->hv_vm_id = (unsigned long)vcpu->kvm;
+- evmcs->hv_enlightenments_control.nested_flush_hypercall = 1;
+-
+- return 0;
+-}
+-
+-#endif /* IS_ENABLED(CONFIG_HYPERV) */
+-
+-/*
+- * Comment's format: document - errata name - stepping - processor name.
+- * Refer from
+- * https://www.virtualbox.org/svn/vbox/trunk/src/VBox/VMM/VMMR0/HMR0.cpp
+- */
+-static u32 vmx_preemption_cpu_tfms[] = {
+-/* 323344.pdf - BA86 - D0 - Xeon 7500 Series */
+-0x000206E6,
+-/* 323056.pdf - AAX65 - C2 - Xeon L3406 */
+-/* 322814.pdf - AAT59 - C2 - i7-600, i5-500, i5-400 and i3-300 Mobile */
+-/* 322911.pdf - AAU65 - C2 - i5-600, i3-500 Desktop and Pentium G6950 */
+-0x00020652,
+-/* 322911.pdf - AAU65 - K0 - i5-600, i3-500 Desktop and Pentium G6950 */
+-0x00020655,
+-/* 322373.pdf - AAO95 - B1 - Xeon 3400 Series */
+-/* 322166.pdf - AAN92 - B1 - i7-800 and i5-700 Desktop */
+-/*
+- * 320767.pdf - AAP86 - B1 -
+- * i7-900 Mobile Extreme, i7-800 and i7-700 Mobile
+- */
+-0x000106E5,
+-/* 321333.pdf - AAM126 - C0 - Xeon 3500 */
+-0x000106A0,
+-/* 321333.pdf - AAM126 - C1 - Xeon 3500 */
+-0x000106A1,
+-/* 320836.pdf - AAJ124 - C0 - i7-900 Desktop Extreme and i7-900 Desktop */
+-0x000106A4,
+- /* 321333.pdf - AAM126 - D0 - Xeon 3500 */
+- /* 321324.pdf - AAK139 - D0 - Xeon 5500 */
+- /* 320836.pdf - AAJ124 - D0 - i7-900 Extreme and i7-900 Desktop */
+-0x000106A5,
+- /* Xeon E3-1220 V2 */
+-0x000306A8,
+-};
+-
+-static inline bool cpu_has_broken_vmx_preemption_timer(void)
+-{
+- u32 eax = cpuid_eax(0x00000001), i;
+-
+- /* Clear the reserved bits */
+- eax &= ~(0x3U << 14 | 0xfU << 28);
+- for (i = 0; i < ARRAY_SIZE(vmx_preemption_cpu_tfms); i++)
+- if (eax == vmx_preemption_cpu_tfms[i])
+- return true;
+-
+- return false;
+-}
+-
+-static inline bool cpu_need_virtualize_apic_accesses(struct kvm_vcpu *vcpu)
+-{
+- return flexpriority_enabled && lapic_in_kernel(vcpu);
+-}
+-
+-static inline bool report_flexpriority(void)
+-{
+- return flexpriority_enabled;
+-}
+-
+-static inline int __find_msr_index(struct vcpu_vmx *vmx, u32 msr)
+-{
+- int i;
+-
+- for (i = 0; i < vmx->nmsrs; ++i)
+- if (vmx_msr_index[vmx->guest_msrs[i].index] == msr)
+- return i;
+- return -1;
+-}
+-
+-struct shared_msr_entry *find_msr_entry(struct vcpu_vmx *vmx, u32 msr)
+-{
+- int i;
+-
+- i = __find_msr_index(vmx, msr);
+- if (i >= 0)
+- return &vmx->guest_msrs[i];
+- return NULL;
+-}
+-
+-static int vmx_set_guest_msr(struct vcpu_vmx *vmx, struct shared_msr_entry *msr, u64 data)
+-{
+- int ret = 0;
+-
+- u64 old_msr_data = msr->data;
+- msr->data = data;
+- if (msr - vmx->guest_msrs < vmx->save_nmsrs) {
+- preempt_disable();
+- ret = kvm_set_shared_msr(msr->index, msr->data,
+- msr->mask);
+- preempt_enable();
+- if (ret)
+- msr->data = old_msr_data;
+- }
+- return ret;
+-}
+-
+-void loaded_vmcs_init(struct loaded_vmcs *loaded_vmcs)
+-{
+- vmcs_clear(loaded_vmcs->vmcs);
+- if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched)
+- vmcs_clear(loaded_vmcs->shadow_vmcs);
+- loaded_vmcs->cpu = -1;
+- loaded_vmcs->launched = 0;
+-}
+-
+-#ifdef CONFIG_KEXEC_CORE
+-/*
+- * This bitmap is used to indicate whether the vmclear
+- * operation is enabled on all cpus. All disabled by
+- * default.
+- */
+-static cpumask_t crash_vmclear_enabled_bitmap = CPU_MASK_NONE;
+-
+-static inline void crash_enable_local_vmclear(int cpu)
+-{
+- cpumask_set_cpu(cpu, &crash_vmclear_enabled_bitmap);
+-}
+-
+-static inline void crash_disable_local_vmclear(int cpu)
+-{
+- cpumask_clear_cpu(cpu, &crash_vmclear_enabled_bitmap);
+-}
+-
+-static inline int crash_local_vmclear_enabled(int cpu)
+-{
+- return cpumask_test_cpu(cpu, &crash_vmclear_enabled_bitmap);
+-}
+-
+-static void crash_vmclear_local_loaded_vmcss(void)
+-{
+- int cpu = raw_smp_processor_id();
+- struct loaded_vmcs *v;
+-
+- if (!crash_local_vmclear_enabled(cpu))
+- return;
+-
+- list_for_each_entry(v, &per_cpu(loaded_vmcss_on_cpu, cpu),
+- loaded_vmcss_on_cpu_link)
+- vmcs_clear(v->vmcs);
+-}
+-#else
+-static inline void crash_enable_local_vmclear(int cpu) { }
+-static inline void crash_disable_local_vmclear(int cpu) { }
+-#endif /* CONFIG_KEXEC_CORE */
+-
+-static void __loaded_vmcs_clear(void *arg)
+-{
+- struct loaded_vmcs *loaded_vmcs = arg;
+- int cpu = raw_smp_processor_id();
+-
+- if (loaded_vmcs->cpu != cpu)
+- return; /* vcpu migration can race with cpu offline */
+- if (per_cpu(current_vmcs, cpu) == loaded_vmcs->vmcs)
+- per_cpu(current_vmcs, cpu) = NULL;
+- crash_disable_local_vmclear(cpu);
+- list_del(&loaded_vmcs->loaded_vmcss_on_cpu_link);
+-
+- /*
+- * we should ensure updating loaded_vmcs->loaded_vmcss_on_cpu_link
+- * is before setting loaded_vmcs->vcpu to -1 which is done in
+- * loaded_vmcs_init. Otherwise, other cpu can see vcpu = -1 fist
+- * then adds the vmcs into percpu list before it is deleted.
+- */
+- smp_wmb();
+-
+- loaded_vmcs_init(loaded_vmcs);
+- crash_enable_local_vmclear(cpu);
+-}
+-
+-void loaded_vmcs_clear(struct loaded_vmcs *loaded_vmcs)
+-{
+- int cpu = loaded_vmcs->cpu;
+-
+- if (cpu != -1)
+- smp_call_function_single(cpu,
+- __loaded_vmcs_clear, loaded_vmcs, 1);
+-}
+-
+-static bool vmx_segment_cache_test_set(struct vcpu_vmx *vmx, unsigned seg,
+- unsigned field)
+-{
+- bool ret;
+- u32 mask = 1 << (seg * SEG_FIELD_NR + field);
+-
+- if (!kvm_register_is_available(&vmx->vcpu, VCPU_EXREG_SEGMENTS)) {
+- kvm_register_mark_available(&vmx->vcpu, VCPU_EXREG_SEGMENTS);
+- vmx->segment_cache.bitmask = 0;
+- }
+- ret = vmx->segment_cache.bitmask & mask;
+- vmx->segment_cache.bitmask |= mask;
+- return ret;
+-}
+-
+-static u16 vmx_read_guest_seg_selector(struct vcpu_vmx *vmx, unsigned seg)
+-{
+- u16 *p = &vmx->segment_cache.seg[seg].selector;
+-
+- if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_SEL))
+- *p = vmcs_read16(kvm_vmx_segment_fields[seg].selector);
+- return *p;
+-}
+-
+-static ulong vmx_read_guest_seg_base(struct vcpu_vmx *vmx, unsigned seg)
+-{
+- ulong *p = &vmx->segment_cache.seg[seg].base;
+-
+- if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_BASE))
+- *p = vmcs_readl(kvm_vmx_segment_fields[seg].base);
+- return *p;
+-}
+-
+-static u32 vmx_read_guest_seg_limit(struct vcpu_vmx *vmx, unsigned seg)
+-{
+- u32 *p = &vmx->segment_cache.seg[seg].limit;
+-
+- if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_LIMIT))
+- *p = vmcs_read32(kvm_vmx_segment_fields[seg].limit);
+- return *p;
+-}
+-
+-static u32 vmx_read_guest_seg_ar(struct vcpu_vmx *vmx, unsigned seg)
+-{
+- u32 *p = &vmx->segment_cache.seg[seg].ar;
+-
+- if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_AR))
+- *p = vmcs_read32(kvm_vmx_segment_fields[seg].ar_bytes);
+- return *p;
+-}
+-
+-void update_exception_bitmap(struct kvm_vcpu *vcpu)
+-{
+- u32 eb;
+-
+- eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
+- (1u << DB_VECTOR) | (1u << AC_VECTOR);
+- /*
+- * Guest access to VMware backdoor ports could legitimately
+- * trigger #GP because of TSS I/O permission bitmap.
+- * We intercept those #GP and allow access to them anyway
+- * as VMware does.
+- */
+- if (enable_vmware_backdoor)
+- eb |= (1u << GP_VECTOR);
+- if ((vcpu->guest_debug &
+- (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
+- (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP))
+- eb |= 1u << BP_VECTOR;
+- if (to_vmx(vcpu)->rmode.vm86_active)
+- eb = ~0;
+- if (enable_ept)
+- eb &= ~(1u << PF_VECTOR); /* bypass_guest_pf = 0 */
+-
+- /* When we are running a nested L2 guest and L1 specified for it a
+- * certain exception bitmap, we must trap the same exceptions and pass
+- * them to L1. When running L2, we will only handle the exceptions
+- * specified above if L1 did not want them.
+- */
+- if (is_guest_mode(vcpu))
+- eb |= get_vmcs12(vcpu)->exception_bitmap;
+-
+- vmcs_write32(EXCEPTION_BITMAP, eb);
+-}
+-
+-/*
+- * Check if MSR is intercepted for currently loaded MSR bitmap.
+- */
+-static bool msr_write_intercepted(struct kvm_vcpu *vcpu, u32 msr)
+-{
+- unsigned long *msr_bitmap;
+- int f = sizeof(unsigned long);
+-
+- if (!cpu_has_vmx_msr_bitmap())
+- return true;
+-
+- msr_bitmap = to_vmx(vcpu)->loaded_vmcs->msr_bitmap;
+-
+- if (msr <= 0x1fff) {
+- return !!test_bit(msr, msr_bitmap + 0x800 / f);
+- } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
+- msr &= 0x1fff;
+- return !!test_bit(msr, msr_bitmap + 0xc00 / f);
+- }
+-
+- return true;
+-}
+-
+-static void clear_atomic_switch_msr_special(struct vcpu_vmx *vmx,
+- unsigned long entry, unsigned long exit)
+-{
+- vm_entry_controls_clearbit(vmx, entry);
+- vm_exit_controls_clearbit(vmx, exit);
+-}
+-
+-int vmx_find_msr_index(struct vmx_msrs *m, u32 msr)
+-{
+- unsigned int i;
+-
+- for (i = 0; i < m->nr; ++i) {
+- if (m->val[i].index == msr)
+- return i;
+- }
+- return -ENOENT;
+-}
+-
+-static void clear_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr)
+-{
+- int i;
+- struct msr_autoload *m = &vmx->msr_autoload;
+-
+- switch (msr) {
+- case MSR_EFER:
+- if (cpu_has_load_ia32_efer()) {
+- clear_atomic_switch_msr_special(vmx,
+- VM_ENTRY_LOAD_IA32_EFER,
+- VM_EXIT_LOAD_IA32_EFER);
+- return;
+- }
+- break;
+- case MSR_CORE_PERF_GLOBAL_CTRL:
+- if (cpu_has_load_perf_global_ctrl()) {
+- clear_atomic_switch_msr_special(vmx,
+- VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL,
+- VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL);
+- return;
+- }
+- break;
+- }
+- i = vmx_find_msr_index(&m->guest, msr);
+- if (i < 0)
+- goto skip_guest;
+- --m->guest.nr;
+- m->guest.val[i] = m->guest.val[m->guest.nr];
+- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
+-
+-skip_guest:
+- i = vmx_find_msr_index(&m->host, msr);
+- if (i < 0)
+- return;
+-
+- --m->host.nr;
+- m->host.val[i] = m->host.val[m->host.nr];
+- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
+-}
+-
+-static void add_atomic_switch_msr_special(struct vcpu_vmx *vmx,
+- unsigned long entry, unsigned long exit,
+- unsigned long guest_val_vmcs, unsigned long host_val_vmcs,
+- u64 guest_val, u64 host_val)
+-{
+- vmcs_write64(guest_val_vmcs, guest_val);
+- if (host_val_vmcs != HOST_IA32_EFER)
+- vmcs_write64(host_val_vmcs, host_val);
+- vm_entry_controls_setbit(vmx, entry);
+- vm_exit_controls_setbit(vmx, exit);
+-}
+-
+-static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
+- u64 guest_val, u64 host_val, bool entry_only)
+-{
+- int i, j = 0;
+- struct msr_autoload *m = &vmx->msr_autoload;
+-
+- switch (msr) {
+- case MSR_EFER:
+- if (cpu_has_load_ia32_efer()) {
+- add_atomic_switch_msr_special(vmx,
+- VM_ENTRY_LOAD_IA32_EFER,
+- VM_EXIT_LOAD_IA32_EFER,
+- GUEST_IA32_EFER,
+- HOST_IA32_EFER,
+- guest_val, host_val);
+- return;
+- }
+- break;
+- case MSR_CORE_PERF_GLOBAL_CTRL:
+- if (cpu_has_load_perf_global_ctrl()) {
+- add_atomic_switch_msr_special(vmx,
+- VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL,
+- VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL,
+- GUEST_IA32_PERF_GLOBAL_CTRL,
+- HOST_IA32_PERF_GLOBAL_CTRL,
+- guest_val, host_val);
+- return;
+- }
+- break;
+- case MSR_IA32_PEBS_ENABLE:
+- /* PEBS needs a quiescent period after being disabled (to write
+- * a record). Disabling PEBS through VMX MSR swapping doesn't
+- * provide that period, so a CPU could write host's record into
+- * guest's memory.
+- */
+- wrmsrl(MSR_IA32_PEBS_ENABLE, 0);
+- }
+-
+- i = vmx_find_msr_index(&m->guest, msr);
+- if (!entry_only)
+- j = vmx_find_msr_index(&m->host, msr);
+-
+- if ((i < 0 && m->guest.nr == NR_LOADSTORE_MSRS) ||
+- (j < 0 && m->host.nr == NR_LOADSTORE_MSRS)) {
+- printk_once(KERN_WARNING "Not enough msr switch entries. "
+- "Can't add msr %x\n", msr);
+- return;
+- }
+- if (i < 0) {
+- i = m->guest.nr++;
+- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
+- }
+- m->guest.val[i].index = msr;
+- m->guest.val[i].value = guest_val;
+-
+- if (entry_only)
+- return;
+-
+- if (j < 0) {
+- j = m->host.nr++;
+- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
+- }
+- m->host.val[j].index = msr;
+- m->host.val[j].value = host_val;
+-}
+-
+-static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset)
+-{
+- u64 guest_efer = vmx->vcpu.arch.efer;
+- u64 ignore_bits = 0;
+-
+- /* Shadow paging assumes NX to be available. */
+- if (!enable_ept)
+- guest_efer |= EFER_NX;
+-
+- /*
+- * LMA and LME handled by hardware; SCE meaningless outside long mode.
+- */
+- ignore_bits |= EFER_SCE;
+-#ifdef CONFIG_X86_64
+- ignore_bits |= EFER_LMA | EFER_LME;
+- /* SCE is meaningful only in long mode on Intel */
+- if (guest_efer & EFER_LMA)
+- ignore_bits &= ~(u64)EFER_SCE;
+-#endif
+-
+- /*
+- * On EPT, we can't emulate NX, so we must switch EFER atomically.
+- * On CPUs that support "load IA32_EFER", always switch EFER
+- * atomically, since it's faster than switching it manually.
+- */
+- if (cpu_has_load_ia32_efer() ||
+- (enable_ept && ((vmx->vcpu.arch.efer ^ host_efer) & EFER_NX))) {
+- if (!(guest_efer & EFER_LMA))
+- guest_efer &= ~EFER_LME;
+- if (guest_efer != host_efer)
+- add_atomic_switch_msr(vmx, MSR_EFER,
+- guest_efer, host_efer, false);
+- else
+- clear_atomic_switch_msr(vmx, MSR_EFER);
+- return false;
+- } else {
+- clear_atomic_switch_msr(vmx, MSR_EFER);
+-
+- guest_efer &= ~ignore_bits;
+- guest_efer |= host_efer & ignore_bits;
+-
+- vmx->guest_msrs[efer_offset].data = guest_efer;
+- vmx->guest_msrs[efer_offset].mask = ~ignore_bits;
+-
+- return true;
+- }
+-}
+-
+-#ifdef CONFIG_X86_32
+-/*
+- * On 32-bit kernels, VM exits still load the FS and GS bases from the
+- * VMCS rather than the segment table. KVM uses this helper to figure
+- * out the current bases to poke them into the VMCS before entry.
+- */
+-static unsigned long segment_base(u16 selector)
+-{
+- struct desc_struct *table;
+- unsigned long v;
+-
+- if (!(selector & ~SEGMENT_RPL_MASK))
+- return 0;
+-
+- table = get_current_gdt_ro();
+-
+- if ((selector & SEGMENT_TI_MASK) == SEGMENT_LDT) {
+- u16 ldt_selector = kvm_read_ldt();
+-
+- if (!(ldt_selector & ~SEGMENT_RPL_MASK))
+- return 0;
+-
+- table = (struct desc_struct *)segment_base(ldt_selector);
+- }
+- v = get_desc_base(&table[selector >> 3]);
+- return v;
+-}
+-#endif
+-
+-static inline void pt_load_msr(struct pt_ctx *ctx, u32 addr_range)
+-{
+- u32 i;
+-
+- wrmsrl(MSR_IA32_RTIT_STATUS, ctx->status);
+- wrmsrl(MSR_IA32_RTIT_OUTPUT_BASE, ctx->output_base);
+- wrmsrl(MSR_IA32_RTIT_OUTPUT_MASK, ctx->output_mask);
+- wrmsrl(MSR_IA32_RTIT_CR3_MATCH, ctx->cr3_match);
+- for (i = 0; i < addr_range; i++) {
+- wrmsrl(MSR_IA32_RTIT_ADDR0_A + i * 2, ctx->addr_a[i]);
+- wrmsrl(MSR_IA32_RTIT_ADDR0_B + i * 2, ctx->addr_b[i]);
+- }
+-}
+-
+-static inline void pt_save_msr(struct pt_ctx *ctx, u32 addr_range)
+-{
+- u32 i;
+-
+- rdmsrl(MSR_IA32_RTIT_STATUS, ctx->status);
+- rdmsrl(MSR_IA32_RTIT_OUTPUT_BASE, ctx->output_base);
+- rdmsrl(MSR_IA32_RTIT_OUTPUT_MASK, ctx->output_mask);
+- rdmsrl(MSR_IA32_RTIT_CR3_MATCH, ctx->cr3_match);
+- for (i = 0; i < addr_range; i++) {
+- rdmsrl(MSR_IA32_RTIT_ADDR0_A + i * 2, ctx->addr_a[i]);
+- rdmsrl(MSR_IA32_RTIT_ADDR0_B + i * 2, ctx->addr_b[i]);
+- }
+-}
+-
+-static void pt_guest_enter(struct vcpu_vmx *vmx)
+-{
+- if (pt_mode == PT_MODE_SYSTEM)
+- return;
+-
+- /*
+- * GUEST_IA32_RTIT_CTL is already set in the VMCS.
+- * Save host state before VM entry.
+- */
+- rdmsrl(MSR_IA32_RTIT_CTL, vmx->pt_desc.host.ctl);
+- if (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) {
+- wrmsrl(MSR_IA32_RTIT_CTL, 0);
+- pt_save_msr(&vmx->pt_desc.host, vmx->pt_desc.addr_range);
+- pt_load_msr(&vmx->pt_desc.guest, vmx->pt_desc.addr_range);
+- }
+-}
+-
+-static void pt_guest_exit(struct vcpu_vmx *vmx)
+-{
+- if (pt_mode == PT_MODE_SYSTEM)
+- return;
+-
+- if (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) {
+- pt_save_msr(&vmx->pt_desc.guest, vmx->pt_desc.addr_range);
+- pt_load_msr(&vmx->pt_desc.host, vmx->pt_desc.addr_range);
+- }
+-
+- /* Reload host state (IA32_RTIT_CTL will be cleared on VM exit). */
+- wrmsrl(MSR_IA32_RTIT_CTL, vmx->pt_desc.host.ctl);
+-}
+-
+-void vmx_set_host_fs_gs(struct vmcs_host_state *host, u16 fs_sel, u16 gs_sel,
+- unsigned long fs_base, unsigned long gs_base)
+-{
+- if (unlikely(fs_sel != host->fs_sel)) {
+- if (!(fs_sel & 7))
+- vmcs_write16(HOST_FS_SELECTOR, fs_sel);
+- else
+- vmcs_write16(HOST_FS_SELECTOR, 0);
+- host->fs_sel = fs_sel;
+- }
+- if (unlikely(gs_sel != host->gs_sel)) {
+- if (!(gs_sel & 7))
+- vmcs_write16(HOST_GS_SELECTOR, gs_sel);
+- else
+- vmcs_write16(HOST_GS_SELECTOR, 0);
+- host->gs_sel = gs_sel;
+- }
+- if (unlikely(fs_base != host->fs_base)) {
+- vmcs_writel(HOST_FS_BASE, fs_base);
+- host->fs_base = fs_base;
+- }
+- if (unlikely(gs_base != host->gs_base)) {
+- vmcs_writel(HOST_GS_BASE, gs_base);
+- host->gs_base = gs_base;
+- }
+-}
+-
+-void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct vmcs_host_state *host_state;
+-#ifdef CONFIG_X86_64
+- int cpu = raw_smp_processor_id();
+-#endif
+- unsigned long fs_base, gs_base;
+- u16 fs_sel, gs_sel;
+- int i;
+-
+- vmx->req_immediate_exit = false;
+-
+- /*
+- * Note that guest MSRs to be saved/restored can also be changed
+- * when guest state is loaded. This happens when guest transitions
+- * to/from long-mode by setting MSR_EFER.LMA.
+- */
+- if (!vmx->guest_msrs_ready) {
+- vmx->guest_msrs_ready = true;
+- for (i = 0; i < vmx->save_nmsrs; ++i)
+- kvm_set_shared_msr(vmx->guest_msrs[i].index,
+- vmx->guest_msrs[i].data,
+- vmx->guest_msrs[i].mask);
+-
+- }
+- if (vmx->guest_state_loaded)
+- return;
+-
+- host_state = &vmx->loaded_vmcs->host_state;
+-
+- /*
+- * Set host fs and gs selectors. Unfortunately, 22.2.3 does not
+- * allow segment selectors with cpl > 0 or ti == 1.
+- */
+- host_state->ldt_sel = kvm_read_ldt();
+-
+-#ifdef CONFIG_X86_64
+- savesegment(ds, host_state->ds_sel);
+- savesegment(es, host_state->es_sel);
+-
+- gs_base = cpu_kernelmode_gs_base(cpu);
+- if (likely(is_64bit_mm(current->mm))) {
+- save_fsgs_for_kvm();
+- fs_sel = current->thread.fsindex;
+- gs_sel = current->thread.gsindex;
+- fs_base = current->thread.fsbase;
+- vmx->msr_host_kernel_gs_base = current->thread.gsbase;
+- } else {
+- savesegment(fs, fs_sel);
+- savesegment(gs, gs_sel);
+- fs_base = read_msr(MSR_FS_BASE);
+- vmx->msr_host_kernel_gs_base = read_msr(MSR_KERNEL_GS_BASE);
+- }
+-
+- wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+-#else
+- savesegment(fs, fs_sel);
+- savesegment(gs, gs_sel);
+- fs_base = segment_base(fs_sel);
+- gs_base = segment_base(gs_sel);
+-#endif
+-
+- vmx_set_host_fs_gs(host_state, fs_sel, gs_sel, fs_base, gs_base);
+- vmx->guest_state_loaded = true;
+-}
+-
+-static void vmx_prepare_switch_to_host(struct vcpu_vmx *vmx)
+-{
+- struct vmcs_host_state *host_state;
+-
+- if (!vmx->guest_state_loaded)
+- return;
+-
+- host_state = &vmx->loaded_vmcs->host_state;
+-
+- ++vmx->vcpu.stat.host_state_reload;
+-
+-#ifdef CONFIG_X86_64
+- rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+-#endif
+- if (host_state->ldt_sel || (host_state->gs_sel & 7)) {
+- kvm_load_ldt(host_state->ldt_sel);
+-#ifdef CONFIG_X86_64
+- load_gs_index(host_state->gs_sel);
+-#else
+- loadsegment(gs, host_state->gs_sel);
+-#endif
+- }
+- if (host_state->fs_sel & 7)
+- loadsegment(fs, host_state->fs_sel);
+-#ifdef CONFIG_X86_64
+- if (unlikely(host_state->ds_sel | host_state->es_sel)) {
+- loadsegment(ds, host_state->ds_sel);
+- loadsegment(es, host_state->es_sel);
+- }
+-#endif
+- invalidate_tss_limit();
+-#ifdef CONFIG_X86_64
+- wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
+-#endif
+- load_fixmap_gdt(raw_smp_processor_id());
+- vmx->guest_state_loaded = false;
+- vmx->guest_msrs_ready = false;
+-}
+-
+-#ifdef CONFIG_X86_64
+-static u64 vmx_read_guest_kernel_gs_base(struct vcpu_vmx *vmx)
+-{
+- preempt_disable();
+- if (vmx->guest_state_loaded)
+- rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+- preempt_enable();
+- return vmx->msr_guest_kernel_gs_base;
+-}
+-
+-static void vmx_write_guest_kernel_gs_base(struct vcpu_vmx *vmx, u64 data)
+-{
+- preempt_disable();
+- if (vmx->guest_state_loaded)
+- wrmsrl(MSR_KERNEL_GS_BASE, data);
+- preempt_enable();
+- vmx->msr_guest_kernel_gs_base = data;
+-}
+-#endif
+-
+-static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
+-{
+- struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+- struct pi_desc old, new;
+- unsigned int dest;
+-
+- /*
+- * In case of hot-plug or hot-unplug, we may have to undo
+- * vmx_vcpu_pi_put even if there is no assigned device. And we
+- * always keep PI.NDST up to date for simplicity: it makes the
+- * code easier, and CPU migration is not a fast path.
+- */
+- if (!pi_test_sn(pi_desc) && vcpu->cpu == cpu)
+- return;
+-
+- /*
+- * If the 'nv' field is POSTED_INTR_WAKEUP_VECTOR, do not change
+- * PI.NDST: pi_post_block is the one expected to change PID.NDST and the
+- * wakeup handler expects the vCPU to be on the blocked_vcpu_list that
+- * matches PI.NDST. Otherwise, a vcpu may not be able to be woken up
+- * correctly.
+- */
+- if (pi_desc->nv == POSTED_INTR_WAKEUP_VECTOR || vcpu->cpu == cpu) {
+- pi_clear_sn(pi_desc);
+- goto after_clear_sn;
+- }
+-
+- /* The full case. */
+- do {
+- old.control = new.control = pi_desc->control;
+-
+- dest = cpu_physical_id(cpu);
+-
+- if (x2apic_enabled())
+- new.ndst = dest;
+- else
+- new.ndst = (dest << 8) & 0xFF00;
+-
+- new.sn = 0;
+- } while (cmpxchg64(&pi_desc->control, old.control,
+- new.control) != old.control);
+-
+-after_clear_sn:
+-
+- /*
+- * Clear SN before reading the bitmap. The VT-d firmware
+- * writes the bitmap and reads SN atomically (5.2.3 in the
+- * spec), so it doesn't really have a memory barrier that
+- * pairs with this, but we cannot do that and we need one.
+- */
+- smp_mb__after_atomic();
+-
+- if (!pi_is_pir_empty(pi_desc))
+- pi_set_on(pi_desc);
+-}
+-
+-void vmx_vcpu_load_vmcs(struct kvm_vcpu *vcpu, int cpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- bool already_loaded = vmx->loaded_vmcs->cpu == cpu;
+-
+- if (!already_loaded) {
+- loaded_vmcs_clear(vmx->loaded_vmcs);
+- local_irq_disable();
+- crash_disable_local_vmclear(cpu);
+-
+- /*
+- * Read loaded_vmcs->cpu should be before fetching
+- * loaded_vmcs->loaded_vmcss_on_cpu_link.
+- * See the comments in __loaded_vmcs_clear().
+- */
+- smp_rmb();
+-
+- list_add(&vmx->loaded_vmcs->loaded_vmcss_on_cpu_link,
+- &per_cpu(loaded_vmcss_on_cpu, cpu));
+- crash_enable_local_vmclear(cpu);
+- local_irq_enable();
+- }
+-
+- if (per_cpu(current_vmcs, cpu) != vmx->loaded_vmcs->vmcs) {
+- per_cpu(current_vmcs, cpu) = vmx->loaded_vmcs->vmcs;
+- vmcs_load(vmx->loaded_vmcs->vmcs);
+- indirect_branch_prediction_barrier();
+- }
+-
+- if (!already_loaded) {
+- void *gdt = get_current_gdt_ro();
+- unsigned long sysenter_esp;
+-
+- kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
+-
+- /*
+- * Linux uses per-cpu TSS and GDT, so set these when switching
+- * processors. See 22.2.4.
+- */
+- vmcs_writel(HOST_TR_BASE,
+- (unsigned long)&get_cpu_entry_area(cpu)->tss.x86_tss);
+- vmcs_writel(HOST_GDTR_BASE, (unsigned long)gdt); /* 22.2.4 */
+-
+- rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
+- vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
+-
+- vmx->loaded_vmcs->cpu = cpu;
+- }
+-
+- /* Setup TSC multiplier */
+- if (kvm_has_tsc_control &&
+- vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio)
+- decache_tsc_multiplier(vmx);
+-}
+-
+-/*
+- * Switches to specified vcpu, until a matching vcpu_put(), but assumes
+- * vcpu mutex is already taken.
+- */
+-void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- vmx_vcpu_load_vmcs(vcpu, cpu);
+-
+- vmx_vcpu_pi_load(vcpu, cpu);
+-
+- vmx->host_pkru = read_pkru();
+- vmx->host_debugctlmsr = get_debugctlmsr();
+-}
+-
+-static void vmx_vcpu_pi_put(struct kvm_vcpu *vcpu)
+-{
+- struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+-
+- if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
+- !irq_remapping_cap(IRQ_POSTING_CAP) ||
+- !kvm_vcpu_apicv_active(vcpu))
+- return;
+-
+- /* Set SN when the vCPU is preempted */
+- if (vcpu->preempted)
+- pi_set_sn(pi_desc);
+-}
+-
+-static void vmx_vcpu_put(struct kvm_vcpu *vcpu)
+-{
+- vmx_vcpu_pi_put(vcpu);
+-
+- vmx_prepare_switch_to_host(to_vmx(vcpu));
+-}
+-
+-static bool emulation_required(struct kvm_vcpu *vcpu)
+-{
+- return emulate_invalid_guest_state && !guest_state_valid(vcpu);
+-}
+-
+-static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu);
+-
+-unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long rflags, save_rflags;
+-
+- if (!kvm_register_is_available(vcpu, VCPU_EXREG_RFLAGS)) {
+- kvm_register_mark_available(vcpu, VCPU_EXREG_RFLAGS);
+- rflags = vmcs_readl(GUEST_RFLAGS);
+- if (vmx->rmode.vm86_active) {
+- rflags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
+- save_rflags = vmx->rmode.save_rflags;
+- rflags |= save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
+- }
+- vmx->rflags = rflags;
+- }
+- return vmx->rflags;
+-}
+-
+-void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long old_rflags;
+-
+- if (enable_unrestricted_guest) {
+- kvm_register_mark_available(vcpu, VCPU_EXREG_RFLAGS);
+- vmx->rflags = rflags;
+- vmcs_writel(GUEST_RFLAGS, rflags);
+- return;
+- }
+-
+- old_rflags = vmx_get_rflags(vcpu);
+- vmx->rflags = rflags;
+- if (vmx->rmode.vm86_active) {
+- vmx->rmode.save_rflags = rflags;
+- rflags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
+- }
+- vmcs_writel(GUEST_RFLAGS, rflags);
+-
+- if ((old_rflags ^ vmx->rflags) & X86_EFLAGS_VM)
+- vmx->emulation_required = emulation_required(vcpu);
+-}
+-
+-u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu)
+-{
+- u32 interruptibility = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
+- int ret = 0;
+-
+- if (interruptibility & GUEST_INTR_STATE_STI)
+- ret |= KVM_X86_SHADOW_INT_STI;
+- if (interruptibility & GUEST_INTR_STATE_MOV_SS)
+- ret |= KVM_X86_SHADOW_INT_MOV_SS;
+-
+- return ret;
+-}
+-
+-void vmx_set_interrupt_shadow(struct kvm_vcpu *vcpu, int mask)
+-{
+- u32 interruptibility_old = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
+- u32 interruptibility = interruptibility_old;
+-
+- interruptibility &= ~(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS);
+-
+- if (mask & KVM_X86_SHADOW_INT_MOV_SS)
+- interruptibility |= GUEST_INTR_STATE_MOV_SS;
+- else if (mask & KVM_X86_SHADOW_INT_STI)
+- interruptibility |= GUEST_INTR_STATE_STI;
+-
+- if ((interruptibility != interruptibility_old))
+- vmcs_write32(GUEST_INTERRUPTIBILITY_INFO, interruptibility);
+-}
+-
+-static int vmx_rtit_ctl_check(struct kvm_vcpu *vcpu, u64 data)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long value;
+-
+- /*
+- * Any MSR write that attempts to change bits marked reserved will
+- * case a #GP fault.
+- */
+- if (data & vmx->pt_desc.ctl_bitmask)
+- return 1;
+-
+- /*
+- * Any attempt to modify IA32_RTIT_CTL while TraceEn is set will
+- * result in a #GP unless the same write also clears TraceEn.
+- */
+- if ((vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) &&
+- ((vmx->pt_desc.guest.ctl ^ data) & ~RTIT_CTL_TRACEEN))
+- return 1;
+-
+- /*
+- * WRMSR to IA32_RTIT_CTL that sets TraceEn but clears this bit
+- * and FabricEn would cause #GP, if
+- * CPUID.(EAX=14H, ECX=0):ECX.SNGLRGNOUT[bit 2] = 0
+- */
+- if ((data & RTIT_CTL_TRACEEN) && !(data & RTIT_CTL_TOPA) &&
+- !(data & RTIT_CTL_FABRIC_EN) &&
+- !intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_single_range_output))
+- return 1;
+-
+- /*
+- * MTCFreq, CycThresh and PSBFreq encodings check, any MSR write that
+- * utilize encodings marked reserved will casue a #GP fault.
+- */
+- value = intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_mtc_periods);
+- if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_mtc) &&
+- !test_bit((data & RTIT_CTL_MTC_RANGE) >>
+- RTIT_CTL_MTC_RANGE_OFFSET, &value))
+- return 1;
+- value = intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_cycle_thresholds);
+- if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_psb_cyc) &&
+- !test_bit((data & RTIT_CTL_CYC_THRESH) >>
+- RTIT_CTL_CYC_THRESH_OFFSET, &value))
+- return 1;
+- value = intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_psb_periods);
+- if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_psb_cyc) &&
+- !test_bit((data & RTIT_CTL_PSB_FREQ) >>
+- RTIT_CTL_PSB_FREQ_OFFSET, &value))
+- return 1;
+-
+- /*
+- * If ADDRx_CFG is reserved or the encodings is >2 will
+- * cause a #GP fault.
+- */
+- value = (data & RTIT_CTL_ADDR0) >> RTIT_CTL_ADDR0_OFFSET;
+- if ((value && (vmx->pt_desc.addr_range < 1)) || (value > 2))
+- return 1;
+- value = (data & RTIT_CTL_ADDR1) >> RTIT_CTL_ADDR1_OFFSET;
+- if ((value && (vmx->pt_desc.addr_range < 2)) || (value > 2))
+- return 1;
+- value = (data & RTIT_CTL_ADDR2) >> RTIT_CTL_ADDR2_OFFSET;
+- if ((value && (vmx->pt_desc.addr_range < 3)) || (value > 2))
+- return 1;
+- value = (data & RTIT_CTL_ADDR3) >> RTIT_CTL_ADDR3_OFFSET;
+- if ((value && (vmx->pt_desc.addr_range < 4)) || (value > 2))
+- return 1;
+-
+- return 0;
+-}
+-
+-static int skip_emulated_instruction(struct kvm_vcpu *vcpu)
+-{
+- unsigned long rip;
+-
+- /*
+- * Using VMCS.VM_EXIT_INSTRUCTION_LEN on EPT misconfig depends on
+- * undefined behavior: Intel's SDM doesn't mandate the VMCS field be
+- * set when EPT misconfig occurs. In practice, real hardware updates
+- * VM_EXIT_INSTRUCTION_LEN on EPT misconfig, but other hypervisors
+- * (namely Hyper-V) don't set it due to it being undefined behavior,
+- * i.e. we end up advancing IP with some random value.
+- */
+- if (!static_cpu_has(X86_FEATURE_HYPERVISOR) ||
+- to_vmx(vcpu)->exit_reason != EXIT_REASON_EPT_MISCONFIG) {
+- rip = kvm_rip_read(vcpu);
+- rip += vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
+- kvm_rip_write(vcpu, rip);
+- } else {
+- if (!kvm_emulate_instruction(vcpu, EMULTYPE_SKIP))
+- return 0;
+- }
+-
+- /* skipping an emulated instruction also counts */
+- vmx_set_interrupt_shadow(vcpu, 0);
+-
+- return 1;
+-}
+-
+-static void vmx_clear_hlt(struct kvm_vcpu *vcpu)
+-{
+- /*
+- * Ensure that we clear the HLT state in the VMCS. We don't need to
+- * explicitly skip the instruction because if the HLT state is set,
+- * then the instruction is already executing and RIP has already been
+- * advanced.
+- */
+- if (kvm_hlt_in_guest(vcpu->kvm) &&
+- vmcs_read32(GUEST_ACTIVITY_STATE) == GUEST_ACTIVITY_HLT)
+- vmcs_write32(GUEST_ACTIVITY_STATE, GUEST_ACTIVITY_ACTIVE);
+-}
+-
+-static void vmx_queue_exception(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned nr = vcpu->arch.exception.nr;
+- bool has_error_code = vcpu->arch.exception.has_error_code;
+- u32 error_code = vcpu->arch.exception.error_code;
+- u32 intr_info = nr | INTR_INFO_VALID_MASK;
+-
+- kvm_deliver_exception_payload(vcpu);
+-
+- if (has_error_code) {
+- vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE, error_code);
+- intr_info |= INTR_INFO_DELIVER_CODE_MASK;
+- }
+-
+- if (vmx->rmode.vm86_active) {
+- int inc_eip = 0;
+- if (kvm_exception_is_soft(nr))
+- inc_eip = vcpu->arch.event_exit_inst_len;
+- kvm_inject_realmode_interrupt(vcpu, nr, inc_eip);
+- return;
+- }
+-
+- WARN_ON_ONCE(vmx->emulation_required);
+-
+- if (kvm_exception_is_soft(nr)) {
+- vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
+- vmx->vcpu.arch.event_exit_inst_len);
+- intr_info |= INTR_TYPE_SOFT_EXCEPTION;
+- } else
+- intr_info |= INTR_TYPE_HARD_EXCEPTION;
+-
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, intr_info);
+-
+- vmx_clear_hlt(vcpu);
+-}
+-
+-static bool vmx_rdtscp_supported(void)
+-{
+- return cpu_has_vmx_rdtscp();
+-}
+-
+-static bool vmx_invpcid_supported(void)
+-{
+- return cpu_has_vmx_invpcid();
+-}
+-
+-/*
+- * Swap MSR entry in host/guest MSR entry array.
+- */
+-static void move_msr_up(struct vcpu_vmx *vmx, int from, int to)
+-{
+- struct shared_msr_entry tmp;
+-
+- tmp = vmx->guest_msrs[to];
+- vmx->guest_msrs[to] = vmx->guest_msrs[from];
+- vmx->guest_msrs[from] = tmp;
+-}
+-
+-/*
+- * Set up the vmcs to automatically save and restore system
+- * msrs. Don't touch the 64-bit msrs if the guest is in legacy
+- * mode, as fiddling with msrs is very expensive.
+- */
+-static void setup_msrs(struct vcpu_vmx *vmx)
+-{
+- int save_nmsrs, index;
+-
+- save_nmsrs = 0;
+-#ifdef CONFIG_X86_64
+- /*
+- * The SYSCALL MSRs are only needed on long mode guests, and only
+- * when EFER.SCE is set.
+- */
+- if (is_long_mode(&vmx->vcpu) && (vmx->vcpu.arch.efer & EFER_SCE)) {
+- index = __find_msr_index(vmx, MSR_STAR);
+- if (index >= 0)
+- move_msr_up(vmx, index, save_nmsrs++);
+- index = __find_msr_index(vmx, MSR_LSTAR);
+- if (index >= 0)
+- move_msr_up(vmx, index, save_nmsrs++);
+- index = __find_msr_index(vmx, MSR_SYSCALL_MASK);
+- if (index >= 0)
+- move_msr_up(vmx, index, save_nmsrs++);
+- }
+-#endif
+- index = __find_msr_index(vmx, MSR_EFER);
+- if (index >= 0 && update_transition_efer(vmx, index))
+- move_msr_up(vmx, index, save_nmsrs++);
+- index = __find_msr_index(vmx, MSR_TSC_AUX);
+- if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
+- move_msr_up(vmx, index, save_nmsrs++);
+- index = __find_msr_index(vmx, MSR_IA32_TSX_CTRL);
+- if (index >= 0)
+- move_msr_up(vmx, index, save_nmsrs++);
+-
+- vmx->save_nmsrs = save_nmsrs;
+- vmx->guest_msrs_ready = false;
+-
+- if (cpu_has_vmx_msr_bitmap())
+- vmx_update_msr_bitmap(&vmx->vcpu);
+-}
+-
+-static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+-
+- if (is_guest_mode(vcpu) &&
+- (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETTING))
+- return vcpu->arch.tsc_offset - vmcs12->tsc_offset;
+-
+- return vcpu->arch.tsc_offset;
+-}
+-
+-static u64 vmx_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- u64 g_tsc_offset = 0;
+-
+- /*
+- * We're here if L1 chose not to trap WRMSR to TSC. According
+- * to the spec, this should set L1's TSC; The offset that L1
+- * set for L2 remains unchanged, and still needs to be added
+- * to the newly set TSC to get L2's TSC.
+- */
+- if (is_guest_mode(vcpu) &&
+- (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETTING))
+- g_tsc_offset = vmcs12->tsc_offset;
+-
+- trace_kvm_write_tsc_offset(vcpu->vcpu_id,
+- vcpu->arch.tsc_offset - g_tsc_offset,
+- offset);
+- vmcs_write64(TSC_OFFSET, offset + g_tsc_offset);
+- return offset + g_tsc_offset;
+-}
+-
+-/*
+- * nested_vmx_allowed() checks whether a guest should be allowed to use VMX
+- * instructions and MSRs (i.e., nested VMX). Nested VMX is disabled for
+- * all guests if the "nested" module option is off, and can also be disabled
+- * for a single guest by disabling its VMX cpuid bit.
+- */
+-bool nested_vmx_allowed(struct kvm_vcpu *vcpu)
+-{
+- return nested && guest_cpuid_has(vcpu, X86_FEATURE_VMX);
+-}
+-
+-static inline bool vmx_feature_control_msr_valid(struct kvm_vcpu *vcpu,
+- uint64_t val)
+-{
+- uint64_t valid_bits = to_vmx(vcpu)->msr_ia32_feature_control_valid_bits;
+-
+- return !(val & ~valid_bits);
+-}
+-
+-static int vmx_get_msr_feature(struct kvm_msr_entry *msr)
+-{
+- switch (msr->index) {
+- case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
+- if (!nested)
+- return 1;
+- return vmx_get_vmx_msr(&vmcs_config.nested, msr->index, &msr->data);
+- default:
+- return 1;
+- }
+-}
+-
+-/*
+- * Reads an msr value (of 'msr_index') into 'pdata'.
+- * Returns 0 on success, non-0 otherwise.
+- * Assumes vcpu_load() was already called.
+- */
+-static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct shared_msr_entry *msr;
+- u32 index;
+-
+- switch (msr_info->index) {
+-#ifdef CONFIG_X86_64
+- case MSR_FS_BASE:
+- msr_info->data = vmcs_readl(GUEST_FS_BASE);
+- break;
+- case MSR_GS_BASE:
+- msr_info->data = vmcs_readl(GUEST_GS_BASE);
+- break;
+- case MSR_KERNEL_GS_BASE:
+- msr_info->data = vmx_read_guest_kernel_gs_base(vmx);
+- break;
+-#endif
+- case MSR_EFER:
+- return kvm_get_msr_common(vcpu, msr_info);
+- case MSR_IA32_TSX_CTRL:
+- if (!msr_info->host_initiated &&
+- !(vcpu->arch.arch_capabilities & ARCH_CAP_TSX_CTRL_MSR))
+- return 1;
+- goto find_shared_msr;
+- case MSR_IA32_UMWAIT_CONTROL:
+- if (!msr_info->host_initiated && !vmx_has_waitpkg(vmx))
+- return 1;
+-
+- msr_info->data = vmx->msr_ia32_umwait_control;
+- break;
+- case MSR_IA32_SPEC_CTRL:
+- if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
+- return 1;
+-
+- msr_info->data = to_vmx(vcpu)->spec_ctrl;
+- break;
+- case MSR_IA32_SYSENTER_CS:
+- msr_info->data = vmcs_read32(GUEST_SYSENTER_CS);
+- break;
+- case MSR_IA32_SYSENTER_EIP:
+- msr_info->data = vmcs_readl(GUEST_SYSENTER_EIP);
+- break;
+- case MSR_IA32_SYSENTER_ESP:
+- msr_info->data = vmcs_readl(GUEST_SYSENTER_ESP);
+- break;
+- case MSR_IA32_BNDCFGS:
+- if (!kvm_mpx_supported() ||
+- (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_MPX)))
+- return 1;
+- msr_info->data = vmcs_read64(GUEST_BNDCFGS);
+- break;
+- case MSR_IA32_MCG_EXT_CTL:
+- if (!msr_info->host_initiated &&
+- !(vmx->msr_ia32_feature_control &
+- FEATURE_CONTROL_LMCE))
+- return 1;
+- msr_info->data = vcpu->arch.mcg_ext_ctl;
+- break;
+- case MSR_IA32_FEATURE_CONTROL:
+- msr_info->data = vmx->msr_ia32_feature_control;
+- break;
+- case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
+- if (!nested_vmx_allowed(vcpu))
+- return 1;
+- return vmx_get_vmx_msr(&vmx->nested.msrs, msr_info->index,
+- &msr_info->data);
+- case MSR_IA32_RTIT_CTL:
+- if (pt_mode != PT_MODE_HOST_GUEST)
+- return 1;
+- msr_info->data = vmx->pt_desc.guest.ctl;
+- break;
+- case MSR_IA32_RTIT_STATUS:
+- if (pt_mode != PT_MODE_HOST_GUEST)
+- return 1;
+- msr_info->data = vmx->pt_desc.guest.status;
+- break;
+- case MSR_IA32_RTIT_CR3_MATCH:
+- if ((pt_mode != PT_MODE_HOST_GUEST) ||
+- !intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_cr3_filtering))
+- return 1;
+- msr_info->data = vmx->pt_desc.guest.cr3_match;
+- break;
+- case MSR_IA32_RTIT_OUTPUT_BASE:
+- if ((pt_mode != PT_MODE_HOST_GUEST) ||
+- (!intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_topa_output) &&
+- !intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_single_range_output)))
+- return 1;
+- msr_info->data = vmx->pt_desc.guest.output_base;
+- break;
+- case MSR_IA32_RTIT_OUTPUT_MASK:
+- if ((pt_mode != PT_MODE_HOST_GUEST) ||
+- (!intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_topa_output) &&
+- !intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_single_range_output)))
+- return 1;
+- msr_info->data = vmx->pt_desc.guest.output_mask;
+- break;
+- case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B:
+- index = msr_info->index - MSR_IA32_RTIT_ADDR0_A;
+- if ((pt_mode != PT_MODE_HOST_GUEST) ||
+- (index >= 2 * intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_num_address_ranges)))
+- return 1;
+- if (is_noncanonical_address(data, vcpu))
+- return 1;
+- if (index % 2)
+- msr_info->data = vmx->pt_desc.guest.addr_b[index / 2];
+- else
+- msr_info->data = vmx->pt_desc.guest.addr_a[index / 2];
+- break;
+- case MSR_TSC_AUX:
+- if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
+- return 1;
+- goto find_shared_msr;
+- default:
+- find_shared_msr:
+- msr = find_msr_entry(vmx, msr_info->index);
+- if (msr) {
+- msr_info->data = msr->data;
+- break;
+- }
+- return kvm_get_msr_common(vcpu, msr_info);
+- }
+-
+- return 0;
+-}
+-
+-/*
+- * Writes msr value into the appropriate "register".
+- * Returns 0 on success, non-0 otherwise.
+- * Assumes vcpu_load() was already called.
+- */
+-static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct shared_msr_entry *msr;
+- int ret = 0;
+- u32 msr_index = msr_info->index;
+- u64 data = msr_info->data;
+- u32 index;
+-
+- switch (msr_index) {
+- case MSR_EFER:
+- ret = kvm_set_msr_common(vcpu, msr_info);
+- break;
+-#ifdef CONFIG_X86_64
+- case MSR_FS_BASE:
+- vmx_segment_cache_clear(vmx);
+- vmcs_writel(GUEST_FS_BASE, data);
+- break;
+- case MSR_GS_BASE:
+- vmx_segment_cache_clear(vmx);
+- vmcs_writel(GUEST_GS_BASE, data);
+- break;
+- case MSR_KERNEL_GS_BASE:
+- vmx_write_guest_kernel_gs_base(vmx, data);
+- break;
+-#endif
+- case MSR_IA32_SYSENTER_CS:
+- if (is_guest_mode(vcpu))
+- get_vmcs12(vcpu)->guest_sysenter_cs = data;
+- vmcs_write32(GUEST_SYSENTER_CS, data);
+- break;
+- case MSR_IA32_SYSENTER_EIP:
+- if (is_guest_mode(vcpu))
+- get_vmcs12(vcpu)->guest_sysenter_eip = data;
+- vmcs_writel(GUEST_SYSENTER_EIP, data);
+- break;
+- case MSR_IA32_SYSENTER_ESP:
+- if (is_guest_mode(vcpu))
+- get_vmcs12(vcpu)->guest_sysenter_esp = data;
+- vmcs_writel(GUEST_SYSENTER_ESP, data);
+- break;
+- case MSR_IA32_DEBUGCTLMSR:
+- if (is_guest_mode(vcpu) && get_vmcs12(vcpu)->vm_exit_controls &
+- VM_EXIT_SAVE_DEBUG_CONTROLS)
+- get_vmcs12(vcpu)->guest_ia32_debugctl = data;
+-
+- ret = kvm_set_msr_common(vcpu, msr_info);
+- break;
+-
+- case MSR_IA32_BNDCFGS:
+- if (!kvm_mpx_supported() ||
+- (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_MPX)))
+- return 1;
+- if (is_noncanonical_address(data & PAGE_MASK, vcpu) ||
+- (data & MSR_IA32_BNDCFGS_RSVD))
+- return 1;
+- vmcs_write64(GUEST_BNDCFGS, data);
+- break;
+- case MSR_IA32_UMWAIT_CONTROL:
+- if (!msr_info->host_initiated && !vmx_has_waitpkg(vmx))
+- return 1;
+-
+- /* The reserved bit 1 and non-32 bit [63:32] should be zero */
+- if (data & (BIT_ULL(1) | GENMASK_ULL(63, 32)))
+- return 1;
+-
+- vmx->msr_ia32_umwait_control = data;
+- break;
+- case MSR_IA32_SPEC_CTRL:
+- if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
+- return 1;
+-
+- /* The STIBP bit doesn't fault even if it's not advertised */
+- if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD))
+- return 1;
+-
+- vmx->spec_ctrl = data;
+-
+- if (!data)
+- break;
+-
+- /*
+- * For non-nested:
+- * When it's written (to non-zero) for the first time, pass
+- * it through.
+- *
+- * For nested:
+- * The handling of the MSR bitmap for L2 guests is done in
+- * nested_vmx_prepare_msr_bitmap. We should not touch the
+- * vmcs02.msr_bitmap here since it gets completely overwritten
+- * in the merging. We update the vmcs01 here for L1 as well
+- * since it will end up touching the MSR anyway now.
+- */
+- vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap,
+- MSR_IA32_SPEC_CTRL,
+- MSR_TYPE_RW);
+- break;
+- case MSR_IA32_TSX_CTRL:
+- if (!msr_info->host_initiated &&
+- !(vcpu->arch.arch_capabilities & ARCH_CAP_TSX_CTRL_MSR))
+- return 1;
+- if (data & ~(TSX_CTRL_RTM_DISABLE | TSX_CTRL_CPUID_CLEAR))
+- return 1;
+- goto find_shared_msr;
+- case MSR_IA32_PRED_CMD:
+- if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
+- return 1;
+-
+- if (data & ~PRED_CMD_IBPB)
+- return 1;
+-
+- if (!data)
+- break;
+-
+- wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB);
+-
+- /*
+- * For non-nested:
+- * When it's written (to non-zero) for the first time, pass
+- * it through.
+- *
+- * For nested:
+- * The handling of the MSR bitmap for L2 guests is done in
+- * nested_vmx_prepare_msr_bitmap. We should not touch the
+- * vmcs02.msr_bitmap here since it gets completely overwritten
+- * in the merging.
+- */
+- vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD,
+- MSR_TYPE_W);
+- break;
+- case MSR_IA32_CR_PAT:
+- if (!kvm_pat_valid(data))
+- return 1;
+-
+- if (is_guest_mode(vcpu) &&
+- get_vmcs12(vcpu)->vm_exit_controls & VM_EXIT_SAVE_IA32_PAT)
+- get_vmcs12(vcpu)->guest_ia32_pat = data;
+-
+- if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
+- vmcs_write64(GUEST_IA32_PAT, data);
+- vcpu->arch.pat = data;
+- break;
+- }
+- ret = kvm_set_msr_common(vcpu, msr_info);
+- break;
+- case MSR_IA32_TSC_ADJUST:
+- ret = kvm_set_msr_common(vcpu, msr_info);
+- break;
+- case MSR_IA32_MCG_EXT_CTL:
+- if ((!msr_info->host_initiated &&
+- !(to_vmx(vcpu)->msr_ia32_feature_control &
+- FEATURE_CONTROL_LMCE)) ||
+- (data & ~MCG_EXT_CTL_LMCE_EN))
+- return 1;
+- vcpu->arch.mcg_ext_ctl = data;
+- break;
+- case MSR_IA32_FEATURE_CONTROL:
+- if (!vmx_feature_control_msr_valid(vcpu, data) ||
+- (to_vmx(vcpu)->msr_ia32_feature_control &
+- FEATURE_CONTROL_LOCKED && !msr_info->host_initiated))
+- return 1;
+- vmx->msr_ia32_feature_control = data;
+- if (msr_info->host_initiated && data == 0)
+- vmx_leave_nested(vcpu);
+- break;
+- case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
+- if (!msr_info->host_initiated)
+- return 1; /* they are read-only */
+- if (!nested_vmx_allowed(vcpu))
+- return 1;
+- return vmx_set_vmx_msr(vcpu, msr_index, data);
+- case MSR_IA32_RTIT_CTL:
+- if ((pt_mode != PT_MODE_HOST_GUEST) ||
+- vmx_rtit_ctl_check(vcpu, data) ||
+- vmx->nested.vmxon)
+- return 1;
+- vmcs_write64(GUEST_IA32_RTIT_CTL, data);
+- vmx->pt_desc.guest.ctl = data;
+- pt_update_intercept_for_msr(vmx);
+- break;
+- case MSR_IA32_RTIT_STATUS:
+- if ((pt_mode != PT_MODE_HOST_GUEST) ||
+- (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) ||
+- (data & MSR_IA32_RTIT_STATUS_MASK))
+- return 1;
+- vmx->pt_desc.guest.status = data;
+- break;
+- case MSR_IA32_RTIT_CR3_MATCH:
+- if ((pt_mode != PT_MODE_HOST_GUEST) ||
+- (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) ||
+- !intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_cr3_filtering))
+- return 1;
+- vmx->pt_desc.guest.cr3_match = data;
+- break;
+- case MSR_IA32_RTIT_OUTPUT_BASE:
+- if ((pt_mode != PT_MODE_HOST_GUEST) ||
+- (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) ||
+- (!intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_topa_output) &&
+- !intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_single_range_output)) ||
+- (data & MSR_IA32_RTIT_OUTPUT_BASE_MASK))
+- return 1;
+- vmx->pt_desc.guest.output_base = data;
+- break;
+- case MSR_IA32_RTIT_OUTPUT_MASK:
+- if ((pt_mode != PT_MODE_HOST_GUEST) ||
+- (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) ||
+- (!intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_topa_output) &&
+- !intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_single_range_output)))
+- return 1;
+- vmx->pt_desc.guest.output_mask = data;
+- break;
+- case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B:
+- index = msr_info->index - MSR_IA32_RTIT_ADDR0_A;
+- if ((pt_mode != PT_MODE_HOST_GUEST) ||
+- (vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN) ||
+- (index >= 2 * intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_num_address_ranges)))
+- return 1;
+- if (is_noncanonical_address(data, vcpu))
+- return 1;
+- if (index % 2)
+- vmx->pt_desc.guest.addr_b[index / 2] = data;
+- else
+- vmx->pt_desc.guest.addr_a[index / 2] = data;
+- break;
+- case MSR_TSC_AUX:
+- if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
+- return 1;
+- /* Check reserved bit, higher 32 bits should be zero */
+- if ((data >> 32) != 0)
+- return 1;
+- goto find_shared_msr;
+-
+- default:
+- find_shared_msr:
+- msr = find_msr_entry(vmx, msr_index);
+- if (msr)
+- ret = vmx_set_guest_msr(vmx, msr, data);
+- else
+- ret = kvm_set_msr_common(vcpu, msr_info);
+- }
+-
+- return ret;
+-}
+-
+-static void vmx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
+-{
+- kvm_register_mark_available(vcpu, reg);
+-
+- switch (reg) {
+- case VCPU_REGS_RSP:
+- vcpu->arch.regs[VCPU_REGS_RSP] = vmcs_readl(GUEST_RSP);
+- break;
+- case VCPU_REGS_RIP:
+- vcpu->arch.regs[VCPU_REGS_RIP] = vmcs_readl(GUEST_RIP);
+- break;
+- case VCPU_EXREG_PDPTR:
+- if (enable_ept)
+- ept_save_pdptrs(vcpu);
+- break;
+- case VCPU_EXREG_CR3:
+- if (enable_unrestricted_guest || (enable_ept && is_paging(vcpu)))
+- vcpu->arch.cr3 = vmcs_readl(GUEST_CR3);
+- break;
+- default:
+- WARN_ON_ONCE(1);
+- break;
+- }
+-}
+-
+-static __init int cpu_has_kvm_support(void)
+-{
+- return cpu_has_vmx();
+-}
+-
+-static __init int vmx_disabled_by_bios(void)
+-{
+- u64 msr;
+-
+- rdmsrl(MSR_IA32_FEATURE_CONTROL, msr);
+- if (msr & FEATURE_CONTROL_LOCKED) {
+- /* launched w/ TXT and VMX disabled */
+- if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX)
+- && tboot_enabled())
+- return 1;
+- /* launched w/o TXT and VMX only enabled w/ TXT */
+- if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
+- && (msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX)
+- && !tboot_enabled()) {
+- printk(KERN_WARNING "kvm: disable TXT in the BIOS or "
+- "activate TXT before enabling KVM\n");
+- return 1;
+- }
+- /* launched w/o TXT and VMX disabled */
+- if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
+- && !tboot_enabled())
+- return 1;
+- }
+-
+- return 0;
+-}
+-
+-static void kvm_cpu_vmxon(u64 addr)
+-{
+- cr4_set_bits(X86_CR4_VMXE);
+- intel_pt_handle_vmx(1);
+-
+- asm volatile ("vmxon %0" : : "m"(addr));
+-}
+-
+-static int hardware_enable(void)
+-{
+- int cpu = raw_smp_processor_id();
+- u64 phys_addr = __pa(per_cpu(vmxarea, cpu));
+- u64 old, test_bits;
+-
+- if (cr4_read_shadow() & X86_CR4_VMXE)
+- return -EBUSY;
+-
+- /*
+- * This can happen if we hot-added a CPU but failed to allocate
+- * VP assist page for it.
+- */
+- if (static_branch_unlikely(&enable_evmcs) &&
+- !hv_get_vp_assist_page(cpu))
+- return -EFAULT;
+-
+- INIT_LIST_HEAD(&per_cpu(loaded_vmcss_on_cpu, cpu));
+- INIT_LIST_HEAD(&per_cpu(blocked_vcpu_on_cpu, cpu));
+- spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+-
+- /*
+- * Now we can enable the vmclear operation in kdump
+- * since the loaded_vmcss_on_cpu list on this cpu
+- * has been initialized.
+- *
+- * Though the cpu is not in VMX operation now, there
+- * is no problem to enable the vmclear operation
+- * for the loaded_vmcss_on_cpu list is empty!
+- */
+- crash_enable_local_vmclear(cpu);
+-
+- rdmsrl(MSR_IA32_FEATURE_CONTROL, old);
+-
+- test_bits = FEATURE_CONTROL_LOCKED;
+- test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
+- if (tboot_enabled())
+- test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX;
+-
+- if ((old & test_bits) != test_bits) {
+- /* enable and lock */
+- wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits);
+- }
+- kvm_cpu_vmxon(phys_addr);
+- if (enable_ept)
+- ept_sync_global();
+-
+- return 0;
+-}
+-
+-static void vmclear_local_loaded_vmcss(void)
+-{
+- int cpu = raw_smp_processor_id();
+- struct loaded_vmcs *v, *n;
+-
+- list_for_each_entry_safe(v, n, &per_cpu(loaded_vmcss_on_cpu, cpu),
+- loaded_vmcss_on_cpu_link)
+- __loaded_vmcs_clear(v);
+-}
+-
+-
+-/* Just like cpu_vmxoff(), but with the __kvm_handle_fault_on_reboot()
+- * tricks.
+- */
+-static void kvm_cpu_vmxoff(void)
+-{
+- asm volatile (__ex("vmxoff"));
+-
+- intel_pt_handle_vmx(0);
+- cr4_clear_bits(X86_CR4_VMXE);
+-}
+-
+-static void hardware_disable(void)
+-{
+- vmclear_local_loaded_vmcss();
+- kvm_cpu_vmxoff();
+-}
+-
+-static __init int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt,
+- u32 msr, u32 *result)
+-{
+- u32 vmx_msr_low, vmx_msr_high;
+- u32 ctl = ctl_min | ctl_opt;
+-
+- rdmsr(msr, vmx_msr_low, vmx_msr_high);
+-
+- ctl &= vmx_msr_high; /* bit == 0 in high word ==> must be zero */
+- ctl |= vmx_msr_low; /* bit == 1 in low word ==> must be one */
+-
+- /* Ensure minimum (required) set of control bits are supported. */
+- if (ctl_min & ~ctl)
+- return -EIO;
+-
+- *result = ctl;
+- return 0;
+-}
+-
+-static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf,
+- struct vmx_capability *vmx_cap)
+-{
+- u32 vmx_msr_low, vmx_msr_high;
+- u32 min, opt, min2, opt2;
+- u32 _pin_based_exec_control = 0;
+- u32 _cpu_based_exec_control = 0;
+- u32 _cpu_based_2nd_exec_control = 0;
+- u32 _vmexit_control = 0;
+- u32 _vmentry_control = 0;
+-
+- memset(vmcs_conf, 0, sizeof(*vmcs_conf));
+- min = CPU_BASED_HLT_EXITING |
+-#ifdef CONFIG_X86_64
+- CPU_BASED_CR8_LOAD_EXITING |
+- CPU_BASED_CR8_STORE_EXITING |
+-#endif
+- CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_CR3_STORE_EXITING |
+- CPU_BASED_UNCOND_IO_EXITING |
+- CPU_BASED_MOV_DR_EXITING |
+- CPU_BASED_USE_TSC_OFFSETTING |
+- CPU_BASED_MWAIT_EXITING |
+- CPU_BASED_MONITOR_EXITING |
+- CPU_BASED_INVLPG_EXITING |
+- CPU_BASED_RDPMC_EXITING;
+-
+- opt = CPU_BASED_TPR_SHADOW |
+- CPU_BASED_USE_MSR_BITMAPS |
+- CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
+- if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PROCBASED_CTLS,
+- &_cpu_based_exec_control) < 0)
+- return -EIO;
+-#ifdef CONFIG_X86_64
+- if ((_cpu_based_exec_control & CPU_BASED_TPR_SHADOW))
+- _cpu_based_exec_control &= ~CPU_BASED_CR8_LOAD_EXITING &
+- ~CPU_BASED_CR8_STORE_EXITING;
+-#endif
+- if (_cpu_based_exec_control & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) {
+- min2 = 0;
+- opt2 = SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
+- SECONDARY_EXEC_WBINVD_EXITING |
+- SECONDARY_EXEC_ENABLE_VPID |
+- SECONDARY_EXEC_ENABLE_EPT |
+- SECONDARY_EXEC_UNRESTRICTED_GUEST |
+- SECONDARY_EXEC_PAUSE_LOOP_EXITING |
+- SECONDARY_EXEC_DESC |
+- SECONDARY_EXEC_RDTSCP |
+- SECONDARY_EXEC_ENABLE_INVPCID |
+- SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
+- SECONDARY_EXEC_SHADOW_VMCS |
+- SECONDARY_EXEC_XSAVES |
+- SECONDARY_EXEC_RDSEED_EXITING |
+- SECONDARY_EXEC_RDRAND_EXITING |
+- SECONDARY_EXEC_ENABLE_PML |
+- SECONDARY_EXEC_TSC_SCALING |
+- SECONDARY_EXEC_ENABLE_USR_WAIT_PAUSE |
+- SECONDARY_EXEC_PT_USE_GPA |
+- SECONDARY_EXEC_PT_CONCEAL_VMX |
+- SECONDARY_EXEC_ENABLE_VMFUNC |
+- SECONDARY_EXEC_ENCLS_EXITING;
+- if (adjust_vmx_controls(min2, opt2,
+- MSR_IA32_VMX_PROCBASED_CTLS2,
+- &_cpu_based_2nd_exec_control) < 0)
+- return -EIO;
+- }
+-#ifndef CONFIG_X86_64
+- if (!(_cpu_based_2nd_exec_control &
+- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES))
+- _cpu_based_exec_control &= ~CPU_BASED_TPR_SHADOW;
+-#endif
+-
+- if (!(_cpu_based_exec_control & CPU_BASED_TPR_SHADOW))
+- _cpu_based_2nd_exec_control &= ~(
+- SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
+-
+- rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP,
+- &vmx_cap->ept, &vmx_cap->vpid);
+-
+- if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) {
+- /* CR3 accesses and invlpg don't need to cause VM Exits when EPT
+- enabled */
+- _cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_CR3_STORE_EXITING |
+- CPU_BASED_INVLPG_EXITING);
+- } else if (vmx_cap->ept) {
+- vmx_cap->ept = 0;
+- pr_warn_once("EPT CAP should not exist if not support "
+- "1-setting enable EPT VM-execution control\n");
+- }
+- if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_VPID) &&
+- vmx_cap->vpid) {
+- vmx_cap->vpid = 0;
+- pr_warn_once("VPID CAP should not exist if not support "
+- "1-setting enable VPID VM-execution control\n");
+- }
+-
+- min = VM_EXIT_SAVE_DEBUG_CONTROLS | VM_EXIT_ACK_INTR_ON_EXIT;
+-#ifdef CONFIG_X86_64
+- min |= VM_EXIT_HOST_ADDR_SPACE_SIZE;
+-#endif
+- opt = VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
+- VM_EXIT_LOAD_IA32_PAT |
+- VM_EXIT_LOAD_IA32_EFER |
+- VM_EXIT_CLEAR_BNDCFGS |
+- VM_EXIT_PT_CONCEAL_PIP |
+- VM_EXIT_CLEAR_IA32_RTIT_CTL;
+- if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_EXIT_CTLS,
+- &_vmexit_control) < 0)
+- return -EIO;
+-
+- min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING;
+- opt = PIN_BASED_VIRTUAL_NMIS | PIN_BASED_POSTED_INTR |
+- PIN_BASED_VMX_PREEMPTION_TIMER;
+- if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PINBASED_CTLS,
+- &_pin_based_exec_control) < 0)
+- return -EIO;
+-
+- if (cpu_has_broken_vmx_preemption_timer())
+- _pin_based_exec_control &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
+- if (!(_cpu_based_2nd_exec_control &
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY))
+- _pin_based_exec_control &= ~PIN_BASED_POSTED_INTR;
+-
+- min = VM_ENTRY_LOAD_DEBUG_CONTROLS;
+- opt = VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL |
+- VM_ENTRY_LOAD_IA32_PAT |
+- VM_ENTRY_LOAD_IA32_EFER |
+- VM_ENTRY_LOAD_BNDCFGS |
+- VM_ENTRY_PT_CONCEAL_PIP |
+- VM_ENTRY_LOAD_IA32_RTIT_CTL;
+- if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_ENTRY_CTLS,
+- &_vmentry_control) < 0)
+- return -EIO;
+-
+- /*
+- * Some cpus support VM_{ENTRY,EXIT}_IA32_PERF_GLOBAL_CTRL but they
+- * can't be used due to an errata where VM Exit may incorrectly clear
+- * IA32_PERF_GLOBAL_CTRL[34:32]. Workaround the errata by using the
+- * MSR load mechanism to switch IA32_PERF_GLOBAL_CTRL.
+- */
+- if (boot_cpu_data.x86 == 0x6) {
+- switch (boot_cpu_data.x86_model) {
+- case 26: /* AAK155 */
+- case 30: /* AAP115 */
+- case 37: /* AAT100 */
+- case 44: /* BC86,AAY89,BD102 */
+- case 46: /* BA97 */
+- _vmentry_control &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
+- _vmexit_control &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
+- pr_warn_once("kvm: VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL "
+- "does not work properly. Using workaround\n");
+- break;
+- default:
+- break;
+- }
+- }
+-
+-
+- rdmsr(MSR_IA32_VMX_BASIC, vmx_msr_low, vmx_msr_high);
+-
+- /* IA-32 SDM Vol 3B: VMCS size is never greater than 4kB. */
+- if ((vmx_msr_high & 0x1fff) > PAGE_SIZE)
+- return -EIO;
+-
+-#ifdef CONFIG_X86_64
+- /* IA-32 SDM Vol 3B: 64-bit CPUs always have VMX_BASIC_MSR[48]==0. */
+- if (vmx_msr_high & (1u<<16))
+- return -EIO;
+-#endif
+-
+- /* Require Write-Back (WB) memory type for VMCS accesses. */
+- if (((vmx_msr_high >> 18) & 15) != 6)
+- return -EIO;
+-
+- vmcs_conf->size = vmx_msr_high & 0x1fff;
+- vmcs_conf->order = get_order(vmcs_conf->size);
+- vmcs_conf->basic_cap = vmx_msr_high & ~0x1fff;
+-
+- vmcs_conf->revision_id = vmx_msr_low;
+-
+- vmcs_conf->pin_based_exec_ctrl = _pin_based_exec_control;
+- vmcs_conf->cpu_based_exec_ctrl = _cpu_based_exec_control;
+- vmcs_conf->cpu_based_2nd_exec_ctrl = _cpu_based_2nd_exec_control;
+- vmcs_conf->vmexit_ctrl = _vmexit_control;
+- vmcs_conf->vmentry_ctrl = _vmentry_control;
+-
+- if (static_branch_unlikely(&enable_evmcs))
+- evmcs_sanitize_exec_ctrls(vmcs_conf);
+-
+- return 0;
+-}
+-
+-struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu, gfp_t flags)
+-{
+- int node = cpu_to_node(cpu);
+- struct page *pages;
+- struct vmcs *vmcs;
+-
+- pages = __alloc_pages_node(node, flags, vmcs_config.order);
+- if (!pages)
+- return NULL;
+- vmcs = page_address(pages);
+- memset(vmcs, 0, vmcs_config.size);
+-
+- /* KVM supports Enlightened VMCS v1 only */
+- if (static_branch_unlikely(&enable_evmcs))
+- vmcs->hdr.revision_id = KVM_EVMCS_VERSION;
+- else
+- vmcs->hdr.revision_id = vmcs_config.revision_id;
+-
+- if (shadow)
+- vmcs->hdr.shadow_vmcs = 1;
+- return vmcs;
+-}
+-
+-void free_vmcs(struct vmcs *vmcs)
+-{
+- free_pages((unsigned long)vmcs, vmcs_config.order);
+-}
+-
+-/*
+- * Free a VMCS, but before that VMCLEAR it on the CPU where it was last loaded
+- */
+-void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
+-{
+- if (!loaded_vmcs->vmcs)
+- return;
+- loaded_vmcs_clear(loaded_vmcs);
+- free_vmcs(loaded_vmcs->vmcs);
+- loaded_vmcs->vmcs = NULL;
+- if (loaded_vmcs->msr_bitmap)
+- free_page((unsigned long)loaded_vmcs->msr_bitmap);
+- WARN_ON(loaded_vmcs->shadow_vmcs != NULL);
+-}
+-
+-int alloc_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
+-{
+- loaded_vmcs->vmcs = alloc_vmcs(false);
+- if (!loaded_vmcs->vmcs)
+- return -ENOMEM;
+-
+- loaded_vmcs->shadow_vmcs = NULL;
+- loaded_vmcs->hv_timer_soft_disabled = false;
+- loaded_vmcs_init(loaded_vmcs);
+-
+- if (cpu_has_vmx_msr_bitmap()) {
+- loaded_vmcs->msr_bitmap = (unsigned long *)
+- __get_free_page(GFP_KERNEL_ACCOUNT);
+- if (!loaded_vmcs->msr_bitmap)
+- goto out_vmcs;
+- memset(loaded_vmcs->msr_bitmap, 0xff, PAGE_SIZE);
+-
+- if (IS_ENABLED(CONFIG_HYPERV) &&
+- static_branch_unlikely(&enable_evmcs) &&
+- (ms_hyperv.nested_features & HV_X64_NESTED_MSR_BITMAP)) {
+- struct hv_enlightened_vmcs *evmcs =
+- (struct hv_enlightened_vmcs *)loaded_vmcs->vmcs;
+-
+- evmcs->hv_enlightenments_control.msr_bitmap = 1;
+- }
+- }
+-
+- memset(&loaded_vmcs->host_state, 0, sizeof(struct vmcs_host_state));
+- memset(&loaded_vmcs->controls_shadow, 0,
+- sizeof(struct vmcs_controls_shadow));
+-
+- return 0;
+-
+-out_vmcs:
+- free_loaded_vmcs(loaded_vmcs);
+- return -ENOMEM;
+-}
+-
+-static void free_kvm_area(void)
+-{
+- int cpu;
+-
+- for_each_possible_cpu(cpu) {
+- free_vmcs(per_cpu(vmxarea, cpu));
+- per_cpu(vmxarea, cpu) = NULL;
+- }
+-}
+-
+-static __init int alloc_kvm_area(void)
+-{
+- int cpu;
+-
+- for_each_possible_cpu(cpu) {
+- struct vmcs *vmcs;
+-
+- vmcs = alloc_vmcs_cpu(false, cpu, GFP_KERNEL);
+- if (!vmcs) {
+- free_kvm_area();
+- return -ENOMEM;
+- }
+-
+- /*
+- * When eVMCS is enabled, alloc_vmcs_cpu() sets
+- * vmcs->revision_id to KVM_EVMCS_VERSION instead of
+- * revision_id reported by MSR_IA32_VMX_BASIC.
+- *
+- * However, even though not explicitly documented by
+- * TLFS, VMXArea passed as VMXON argument should
+- * still be marked with revision_id reported by
+- * physical CPU.
+- */
+- if (static_branch_unlikely(&enable_evmcs))
+- vmcs->hdr.revision_id = vmcs_config.revision_id;
+-
+- per_cpu(vmxarea, cpu) = vmcs;
+- }
+- return 0;
+-}
+-
+-static void fix_pmode_seg(struct kvm_vcpu *vcpu, int seg,
+- struct kvm_segment *save)
+-{
+- if (!emulate_invalid_guest_state) {
+- /*
+- * CS and SS RPL should be equal during guest entry according
+- * to VMX spec, but in reality it is not always so. Since vcpu
+- * is in the middle of the transition from real mode to
+- * protected mode it is safe to assume that RPL 0 is a good
+- * default value.
+- */
+- if (seg == VCPU_SREG_CS || seg == VCPU_SREG_SS)
+- save->selector &= ~SEGMENT_RPL_MASK;
+- save->dpl = save->selector & SEGMENT_RPL_MASK;
+- save->s = 1;
+- }
+- vmx_set_segment(vcpu, save, seg);
+-}
+-
+-static void enter_pmode(struct kvm_vcpu *vcpu)
+-{
+- unsigned long flags;
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- /*
+- * Update real mode segment cache. It may be not up-to-date if sement
+- * register was written while vcpu was in a guest mode.
+- */
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_ES], VCPU_SREG_ES);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_DS], VCPU_SREG_DS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_FS], VCPU_SREG_FS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_GS], VCPU_SREG_GS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_SS], VCPU_SREG_SS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_CS], VCPU_SREG_CS);
+-
+- vmx->rmode.vm86_active = 0;
+-
+- vmx_segment_cache_clear(vmx);
+-
+- vmx_set_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_TR], VCPU_SREG_TR);
+-
+- flags = vmcs_readl(GUEST_RFLAGS);
+- flags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
+- flags |= vmx->rmode.save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
+- vmcs_writel(GUEST_RFLAGS, flags);
+-
+- vmcs_writel(GUEST_CR4, (vmcs_readl(GUEST_CR4) & ~X86_CR4_VME) |
+- (vmcs_readl(CR4_READ_SHADOW) & X86_CR4_VME));
+-
+- update_exception_bitmap(vcpu);
+-
+- fix_pmode_seg(vcpu, VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]);
+- fix_pmode_seg(vcpu, VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]);
+- fix_pmode_seg(vcpu, VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]);
+- fix_pmode_seg(vcpu, VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]);
+- fix_pmode_seg(vcpu, VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]);
+- fix_pmode_seg(vcpu, VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]);
+-}
+-
+-static void fix_rmode_seg(int seg, struct kvm_segment *save)
+-{
+- const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
+- struct kvm_segment var = *save;
+-
+- var.dpl = 0x3;
+- if (seg == VCPU_SREG_CS)
+- var.type = 0x3;
+-
+- if (!emulate_invalid_guest_state) {
+- var.selector = var.base >> 4;
+- var.base = var.base & 0xffff0;
+- var.limit = 0xffff;
+- var.g = 0;
+- var.db = 0;
+- var.present = 1;
+- var.s = 1;
+- var.l = 0;
+- var.unusable = 0;
+- var.type = 0x3;
+- var.avl = 0;
+- if (save->base & 0xf)
+- printk_once(KERN_WARNING "kvm: segment base is not "
+- "paragraph aligned when entering "
+- "protected mode (seg=%d)", seg);
+- }
+-
+- vmcs_write16(sf->selector, var.selector);
+- vmcs_writel(sf->base, var.base);
+- vmcs_write32(sf->limit, var.limit);
+- vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(&var));
+-}
+-
+-static void enter_rmode(struct kvm_vcpu *vcpu)
+-{
+- unsigned long flags;
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct kvm_vmx *kvm_vmx = to_kvm_vmx(vcpu->kvm);
+-
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_TR], VCPU_SREG_TR);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_ES], VCPU_SREG_ES);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_DS], VCPU_SREG_DS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_FS], VCPU_SREG_FS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_GS], VCPU_SREG_GS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_SS], VCPU_SREG_SS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_CS], VCPU_SREG_CS);
+-
+- vmx->rmode.vm86_active = 1;
+-
+- /*
+- * Very old userspace does not call KVM_SET_TSS_ADDR before entering
+- * vcpu. Warn the user that an update is overdue.
+- */
+- if (!kvm_vmx->tss_addr)
+- printk_once(KERN_WARNING "kvm: KVM_SET_TSS_ADDR need to be "
+- "called before entering vcpu\n");
+-
+- vmx_segment_cache_clear(vmx);
+-
+- vmcs_writel(GUEST_TR_BASE, kvm_vmx->tss_addr);
+- vmcs_write32(GUEST_TR_LIMIT, RMODE_TSS_SIZE - 1);
+- vmcs_write32(GUEST_TR_AR_BYTES, 0x008b);
+-
+- flags = vmcs_readl(GUEST_RFLAGS);
+- vmx->rmode.save_rflags = flags;
+-
+- flags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
+-
+- vmcs_writel(GUEST_RFLAGS, flags);
+- vmcs_writel(GUEST_CR4, vmcs_readl(GUEST_CR4) | X86_CR4_VME);
+- update_exception_bitmap(vcpu);
+-
+- fix_rmode_seg(VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]);
+- fix_rmode_seg(VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]);
+- fix_rmode_seg(VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]);
+- fix_rmode_seg(VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]);
+- fix_rmode_seg(VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]);
+- fix_rmode_seg(VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]);
+-
+- kvm_mmu_reset_context(vcpu);
+-}
+-
+-void vmx_set_efer(struct kvm_vcpu *vcpu, u64 efer)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct shared_msr_entry *msr = find_msr_entry(vmx, MSR_EFER);
+-
+- if (!msr)
+- return;
+-
+- vcpu->arch.efer = efer;
+- if (efer & EFER_LMA) {
+- vm_entry_controls_setbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
+- msr->data = efer;
+- } else {
+- vm_entry_controls_clearbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
+-
+- msr->data = efer & ~EFER_LME;
+- }
+- setup_msrs(vmx);
+-}
+-
+-#ifdef CONFIG_X86_64
+-
+-static void enter_lmode(struct kvm_vcpu *vcpu)
+-{
+- u32 guest_tr_ar;
+-
+- vmx_segment_cache_clear(to_vmx(vcpu));
+-
+- guest_tr_ar = vmcs_read32(GUEST_TR_AR_BYTES);
+- if ((guest_tr_ar & VMX_AR_TYPE_MASK) != VMX_AR_TYPE_BUSY_64_TSS) {
+- pr_debug_ratelimited("%s: tss fixup for long mode. \n",
+- __func__);
+- vmcs_write32(GUEST_TR_AR_BYTES,
+- (guest_tr_ar & ~VMX_AR_TYPE_MASK)
+- | VMX_AR_TYPE_BUSY_64_TSS);
+- }
+- vmx_set_efer(vcpu, vcpu->arch.efer | EFER_LMA);
+-}
+-
+-static void exit_lmode(struct kvm_vcpu *vcpu)
+-{
+- vm_entry_controls_clearbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
+- vmx_set_efer(vcpu, vcpu->arch.efer & ~EFER_LMA);
+-}
+-
+-#endif
+-
+-static void vmx_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t addr)
+-{
+- int vpid = to_vmx(vcpu)->vpid;
+-
+- if (!vpid_sync_vcpu_addr(vpid, addr))
+- vpid_sync_context(vpid);
+-
+- /*
+- * If VPIDs are not supported or enabled, then the above is a no-op.
+- * But we don't really need a TLB flush in that case anyway, because
+- * each VM entry/exit includes an implicit flush when VPID is 0.
+- */
+-}
+-
+-static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
+-{
+- ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits;
+-
+- vcpu->arch.cr0 &= ~cr0_guest_owned_bits;
+- vcpu->arch.cr0 |= vmcs_readl(GUEST_CR0) & cr0_guest_owned_bits;
+-}
+-
+-static void vmx_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
+-{
+- ulong cr4_guest_owned_bits = vcpu->arch.cr4_guest_owned_bits;
+-
+- vcpu->arch.cr4 &= ~cr4_guest_owned_bits;
+- vcpu->arch.cr4 |= vmcs_readl(GUEST_CR4) & cr4_guest_owned_bits;
+-}
+-
+-static void ept_load_pdptrs(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
+-
+- if (!kvm_register_is_dirty(vcpu, VCPU_EXREG_PDPTR))
+- return;
+-
+- if (is_pae_paging(vcpu)) {
+- vmcs_write64(GUEST_PDPTR0, mmu->pdptrs[0]);
+- vmcs_write64(GUEST_PDPTR1, mmu->pdptrs[1]);
+- vmcs_write64(GUEST_PDPTR2, mmu->pdptrs[2]);
+- vmcs_write64(GUEST_PDPTR3, mmu->pdptrs[3]);
+- }
+-}
+-
+-void ept_save_pdptrs(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
+-
+- if (is_pae_paging(vcpu)) {
+- mmu->pdptrs[0] = vmcs_read64(GUEST_PDPTR0);
+- mmu->pdptrs[1] = vmcs_read64(GUEST_PDPTR1);
+- mmu->pdptrs[2] = vmcs_read64(GUEST_PDPTR2);
+- mmu->pdptrs[3] = vmcs_read64(GUEST_PDPTR3);
+- }
+-
+- kvm_register_mark_dirty(vcpu, VCPU_EXREG_PDPTR);
+-}
+-
+-static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
+- unsigned long cr0,
+- struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (!kvm_register_is_available(vcpu, VCPU_EXREG_CR3))
+- vmx_cache_reg(vcpu, VCPU_EXREG_CR3);
+- if (!(cr0 & X86_CR0_PG)) {
+- /* From paging/starting to nonpaging */
+- exec_controls_setbit(vmx, CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_CR3_STORE_EXITING);
+- vcpu->arch.cr0 = cr0;
+- vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
+- } else if (!is_paging(vcpu)) {
+- /* From nonpaging to paging */
+- exec_controls_clearbit(vmx, CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_CR3_STORE_EXITING);
+- vcpu->arch.cr0 = cr0;
+- vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
+- }
+-
+- if (!(cr0 & X86_CR0_WP))
+- *hw_cr0 &= ~X86_CR0_WP;
+-}
+-
+-void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long hw_cr0;
+-
+- hw_cr0 = (cr0 & ~KVM_VM_CR0_ALWAYS_OFF);
+- if (enable_unrestricted_guest)
+- hw_cr0 |= KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST;
+- else {
+- hw_cr0 |= KVM_VM_CR0_ALWAYS_ON;
+-
+- if (vmx->rmode.vm86_active && (cr0 & X86_CR0_PE))
+- enter_pmode(vcpu);
+-
+- if (!vmx->rmode.vm86_active && !(cr0 & X86_CR0_PE))
+- enter_rmode(vcpu);
+- }
+-
+-#ifdef CONFIG_X86_64
+- if (vcpu->arch.efer & EFER_LME) {
+- if (!is_paging(vcpu) && (cr0 & X86_CR0_PG))
+- enter_lmode(vcpu);
+- if (is_paging(vcpu) && !(cr0 & X86_CR0_PG))
+- exit_lmode(vcpu);
+- }
+-#endif
+-
+- if (enable_ept && !enable_unrestricted_guest)
+- ept_update_paging_mode_cr0(&hw_cr0, cr0, vcpu);
+-
+- vmcs_writel(CR0_READ_SHADOW, cr0);
+- vmcs_writel(GUEST_CR0, hw_cr0);
+- vcpu->arch.cr0 = cr0;
+-
+- /* depends on vcpu->arch.cr0 to be set to a new value */
+- vmx->emulation_required = emulation_required(vcpu);
+-}
+-
+-static int get_ept_level(struct kvm_vcpu *vcpu)
+-{
+- /* Nested EPT currently only supports 4-level walks. */
+- if (is_guest_mode(vcpu) && nested_cpu_has_ept(get_vmcs12(vcpu)))
+- return 4;
+- if (cpu_has_vmx_ept_5levels() && (cpuid_maxphyaddr(vcpu) > 48))
+- return 5;
+- return 4;
+-}
+-
+-u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa)
+-{
+- u64 eptp = VMX_EPTP_MT_WB;
+-
+- eptp |= (get_ept_level(vcpu) == 5) ? VMX_EPTP_PWL_5 : VMX_EPTP_PWL_4;
+-
+- if (enable_ept_ad_bits &&
+- (!is_guest_mode(vcpu) || nested_ept_ad_enabled(vcpu)))
+- eptp |= VMX_EPTP_AD_ENABLE_BIT;
+- eptp |= (root_hpa & PAGE_MASK);
+-
+- return eptp;
+-}
+-
+-void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
+-{
+- struct kvm *kvm = vcpu->kvm;
+- bool update_guest_cr3 = true;
+- unsigned long guest_cr3;
+- u64 eptp;
+-
+- guest_cr3 = cr3;
+- if (enable_ept) {
+- eptp = construct_eptp(vcpu, cr3);
+- vmcs_write64(EPT_POINTER, eptp);
+-
+- if (kvm_x86_ops->tlb_remote_flush) {
+- spin_lock(&to_kvm_vmx(kvm)->ept_pointer_lock);
+- to_vmx(vcpu)->ept_pointer = eptp;
+- to_kvm_vmx(kvm)->ept_pointers_match
+- = EPT_POINTERS_CHECK;
+- spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock);
+- }
+-
+- /* Loading vmcs02.GUEST_CR3 is handled by nested VM-Enter. */
+- if (is_guest_mode(vcpu))
+- update_guest_cr3 = false;
+- else if (!enable_unrestricted_guest && !is_paging(vcpu))
+- guest_cr3 = to_kvm_vmx(kvm)->ept_identity_map_addr;
+- else if (test_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail))
+- guest_cr3 = vcpu->arch.cr3;
+- else /* vmcs01.GUEST_CR3 is already up-to-date. */
+- update_guest_cr3 = false;
+- ept_load_pdptrs(vcpu);
+- }
+-
+- if (update_guest_cr3)
+- vmcs_writel(GUEST_CR3, guest_cr3);
+-}
+-
+-int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- /*
+- * Pass through host's Machine Check Enable value to hw_cr4, which
+- * is in force while we are in guest mode. Do not let guests control
+- * this bit, even if host CR4.MCE == 0.
+- */
+- unsigned long hw_cr4;
+-
+- hw_cr4 = (cr4_read_shadow() & X86_CR4_MCE) | (cr4 & ~X86_CR4_MCE);
+- if (enable_unrestricted_guest)
+- hw_cr4 |= KVM_VM_CR4_ALWAYS_ON_UNRESTRICTED_GUEST;
+- else if (vmx->rmode.vm86_active)
+- hw_cr4 |= KVM_RMODE_VM_CR4_ALWAYS_ON;
+- else
+- hw_cr4 |= KVM_PMODE_VM_CR4_ALWAYS_ON;
+-
+- if (!boot_cpu_has(X86_FEATURE_UMIP) && vmx_umip_emulated()) {
+- if (cr4 & X86_CR4_UMIP) {
+- secondary_exec_controls_setbit(vmx, SECONDARY_EXEC_DESC);
+- hw_cr4 &= ~X86_CR4_UMIP;
+- } else if (!is_guest_mode(vcpu) ||
+- !nested_cpu_has2(get_vmcs12(vcpu), SECONDARY_EXEC_DESC)) {
+- secondary_exec_controls_clearbit(vmx, SECONDARY_EXEC_DESC);
+- }
+- }
+-
+- if (cr4 & X86_CR4_VMXE) {
+- /*
+- * To use VMXON (and later other VMX instructions), a guest
+- * must first be able to turn on cr4.VMXE (see handle_vmon()).
+- * So basically the check on whether to allow nested VMX
+- * is here. We operate under the default treatment of SMM,
+- * so VMX cannot be enabled under SMM.
+- */
+- if (!nested_vmx_allowed(vcpu) || is_smm(vcpu))
+- return 1;
+- }
+-
+- if (vmx->nested.vmxon && !nested_cr4_valid(vcpu, cr4))
+- return 1;
+-
+- vcpu->arch.cr4 = cr4;
+-
+- if (!enable_unrestricted_guest) {
+- if (enable_ept) {
+- if (!is_paging(vcpu)) {
+- hw_cr4 &= ~X86_CR4_PAE;
+- hw_cr4 |= X86_CR4_PSE;
+- } else if (!(cr4 & X86_CR4_PAE)) {
+- hw_cr4 &= ~X86_CR4_PAE;
+- }
+- }
+-
+- /*
+- * SMEP/SMAP/PKU is disabled if CPU is in non-paging mode in
+- * hardware. To emulate this behavior, SMEP/SMAP/PKU needs
+- * to be manually disabled when guest switches to non-paging
+- * mode.
+- *
+- * If !enable_unrestricted_guest, the CPU is always running
+- * with CR0.PG=1 and CR4 needs to be modified.
+- * If enable_unrestricted_guest, the CPU automatically
+- * disables SMEP/SMAP/PKU when the guest sets CR0.PG=0.
+- */
+- if (!is_paging(vcpu))
+- hw_cr4 &= ~(X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE);
+- }
+-
+- vmcs_writel(CR4_READ_SHADOW, cr4);
+- vmcs_writel(GUEST_CR4, hw_cr4);
+- return 0;
+-}
+-
+-void vmx_get_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 ar;
+-
+- if (vmx->rmode.vm86_active && seg != VCPU_SREG_LDTR) {
+- *var = vmx->rmode.segs[seg];
+- if (seg == VCPU_SREG_TR
+- || var->selector == vmx_read_guest_seg_selector(vmx, seg))
+- return;
+- var->base = vmx_read_guest_seg_base(vmx, seg);
+- var->selector = vmx_read_guest_seg_selector(vmx, seg);
+- return;
+- }
+- var->base = vmx_read_guest_seg_base(vmx, seg);
+- var->limit = vmx_read_guest_seg_limit(vmx, seg);
+- var->selector = vmx_read_guest_seg_selector(vmx, seg);
+- ar = vmx_read_guest_seg_ar(vmx, seg);
+- var->unusable = (ar >> 16) & 1;
+- var->type = ar & 15;
+- var->s = (ar >> 4) & 1;
+- var->dpl = (ar >> 5) & 3;
+- /*
+- * Some userspaces do not preserve unusable property. Since usable
+- * segment has to be present according to VMX spec we can use present
+- * property to amend userspace bug by making unusable segment always
+- * nonpresent. vmx_segment_access_rights() already marks nonpresent
+- * segment as unusable.
+- */
+- var->present = !var->unusable;
+- var->avl = (ar >> 12) & 1;
+- var->l = (ar >> 13) & 1;
+- var->db = (ar >> 14) & 1;
+- var->g = (ar >> 15) & 1;
+-}
+-
+-static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)
+-{
+- struct kvm_segment s;
+-
+- if (to_vmx(vcpu)->rmode.vm86_active) {
+- vmx_get_segment(vcpu, &s, seg);
+- return s.base;
+- }
+- return vmx_read_guest_seg_base(to_vmx(vcpu), seg);
+-}
+-
+-int vmx_get_cpl(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (unlikely(vmx->rmode.vm86_active))
+- return 0;
+- else {
+- int ar = vmx_read_guest_seg_ar(vmx, VCPU_SREG_SS);
+- return VMX_AR_DPL(ar);
+- }
+-}
+-
+-static u32 vmx_segment_access_rights(struct kvm_segment *var)
+-{
+- u32 ar;
+-
+- if (var->unusable || !var->present)
+- ar = 1 << 16;
+- else {
+- ar = var->type & 15;
+- ar |= (var->s & 1) << 4;
+- ar |= (var->dpl & 3) << 5;
+- ar |= (var->present & 1) << 7;
+- ar |= (var->avl & 1) << 12;
+- ar |= (var->l & 1) << 13;
+- ar |= (var->db & 1) << 14;
+- ar |= (var->g & 1) << 15;
+- }
+-
+- return ar;
+-}
+-
+-void vmx_set_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
+-
+- vmx_segment_cache_clear(vmx);
+-
+- if (vmx->rmode.vm86_active && seg != VCPU_SREG_LDTR) {
+- vmx->rmode.segs[seg] = *var;
+- if (seg == VCPU_SREG_TR)
+- vmcs_write16(sf->selector, var->selector);
+- else if (var->s)
+- fix_rmode_seg(seg, &vmx->rmode.segs[seg]);
+- goto out;
+- }
+-
+- vmcs_writel(sf->base, var->base);
+- vmcs_write32(sf->limit, var->limit);
+- vmcs_write16(sf->selector, var->selector);
+-
+- /*
+- * Fix the "Accessed" bit in AR field of segment registers for older
+- * qemu binaries.
+- * IA32 arch specifies that at the time of processor reset the
+- * "Accessed" bit in the AR field of segment registers is 1. And qemu
+- * is setting it to 0 in the userland code. This causes invalid guest
+- * state vmexit when "unrestricted guest" mode is turned on.
+- * Fix for this setup issue in cpu_reset is being pushed in the qemu
+- * tree. Newer qemu binaries with that qemu fix would not need this
+- * kvm hack.
+- */
+- if (enable_unrestricted_guest && (seg != VCPU_SREG_LDTR))
+- var->type |= 0x1; /* Accessed */
+-
+- vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(var));
+-
+-out:
+- vmx->emulation_required = emulation_required(vcpu);
+-}
+-
+-static void vmx_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
+-{
+- u32 ar = vmx_read_guest_seg_ar(to_vmx(vcpu), VCPU_SREG_CS);
+-
+- *db = (ar >> 14) & 1;
+- *l = (ar >> 13) & 1;
+-}
+-
+-static void vmx_get_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
+-{
+- dt->size = vmcs_read32(GUEST_IDTR_LIMIT);
+- dt->address = vmcs_readl(GUEST_IDTR_BASE);
+-}
+-
+-static void vmx_set_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
+-{
+- vmcs_write32(GUEST_IDTR_LIMIT, dt->size);
+- vmcs_writel(GUEST_IDTR_BASE, dt->address);
+-}
+-
+-static void vmx_get_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
+-{
+- dt->size = vmcs_read32(GUEST_GDTR_LIMIT);
+- dt->address = vmcs_readl(GUEST_GDTR_BASE);
+-}
+-
+-static void vmx_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
+-{
+- vmcs_write32(GUEST_GDTR_LIMIT, dt->size);
+- vmcs_writel(GUEST_GDTR_BASE, dt->address);
+-}
+-
+-static bool rmode_segment_valid(struct kvm_vcpu *vcpu, int seg)
+-{
+- struct kvm_segment var;
+- u32 ar;
+-
+- vmx_get_segment(vcpu, &var, seg);
+- var.dpl = 0x3;
+- if (seg == VCPU_SREG_CS)
+- var.type = 0x3;
+- ar = vmx_segment_access_rights(&var);
+-
+- if (var.base != (var.selector << 4))
+- return false;
+- if (var.limit != 0xffff)
+- return false;
+- if (ar != 0xf3)
+- return false;
+-
+- return true;
+-}
+-
+-static bool code_segment_valid(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_segment cs;
+- unsigned int cs_rpl;
+-
+- vmx_get_segment(vcpu, &cs, VCPU_SREG_CS);
+- cs_rpl = cs.selector & SEGMENT_RPL_MASK;
+-
+- if (cs.unusable)
+- return false;
+- if (~cs.type & (VMX_AR_TYPE_CODE_MASK|VMX_AR_TYPE_ACCESSES_MASK))
+- return false;
+- if (!cs.s)
+- return false;
+- if (cs.type & VMX_AR_TYPE_WRITEABLE_MASK) {
+- if (cs.dpl > cs_rpl)
+- return false;
+- } else {
+- if (cs.dpl != cs_rpl)
+- return false;
+- }
+- if (!cs.present)
+- return false;
+-
+- /* TODO: Add Reserved field check, this'll require a new member in the kvm_segment_field structure */
+- return true;
+-}
+-
+-static bool stack_segment_valid(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_segment ss;
+- unsigned int ss_rpl;
+-
+- vmx_get_segment(vcpu, &ss, VCPU_SREG_SS);
+- ss_rpl = ss.selector & SEGMENT_RPL_MASK;
+-
+- if (ss.unusable)
+- return true;
+- if (ss.type != 3 && ss.type != 7)
+- return false;
+- if (!ss.s)
+- return false;
+- if (ss.dpl != ss_rpl) /* DPL != RPL */
+- return false;
+- if (!ss.present)
+- return false;
+-
+- return true;
+-}
+-
+-static bool data_segment_valid(struct kvm_vcpu *vcpu, int seg)
+-{
+- struct kvm_segment var;
+- unsigned int rpl;
+-
+- vmx_get_segment(vcpu, &var, seg);
+- rpl = var.selector & SEGMENT_RPL_MASK;
+-
+- if (var.unusable)
+- return true;
+- if (!var.s)
+- return false;
+- if (!var.present)
+- return false;
+- if (~var.type & (VMX_AR_TYPE_CODE_MASK|VMX_AR_TYPE_WRITEABLE_MASK)) {
+- if (var.dpl < rpl) /* DPL < RPL */
+- return false;
+- }
+-
+- /* TODO: Add other members to kvm_segment_field to allow checking for other access
+- * rights flags
+- */
+- return true;
+-}
+-
+-static bool tr_valid(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_segment tr;
+-
+- vmx_get_segment(vcpu, &tr, VCPU_SREG_TR);
+-
+- if (tr.unusable)
+- return false;
+- if (tr.selector & SEGMENT_TI_MASK) /* TI = 1 */
+- return false;
+- if (tr.type != 3 && tr.type != 11) /* TODO: Check if guest is in IA32e mode */
+- return false;
+- if (!tr.present)
+- return false;
+-
+- return true;
+-}
+-
+-static bool ldtr_valid(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_segment ldtr;
+-
+- vmx_get_segment(vcpu, &ldtr, VCPU_SREG_LDTR);
+-
+- if (ldtr.unusable)
+- return true;
+- if (ldtr.selector & SEGMENT_TI_MASK) /* TI = 1 */
+- return false;
+- if (ldtr.type != 2)
+- return false;
+- if (!ldtr.present)
+- return false;
+-
+- return true;
+-}
+-
+-static bool cs_ss_rpl_check(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_segment cs, ss;
+-
+- vmx_get_segment(vcpu, &cs, VCPU_SREG_CS);
+- vmx_get_segment(vcpu, &ss, VCPU_SREG_SS);
+-
+- return ((cs.selector & SEGMENT_RPL_MASK) ==
+- (ss.selector & SEGMENT_RPL_MASK));
+-}
+-
+-/*
+- * Check if guest state is valid. Returns true if valid, false if
+- * not.
+- * We assume that registers are always usable
+- */
+-static bool guest_state_valid(struct kvm_vcpu *vcpu)
+-{
+- if (enable_unrestricted_guest)
+- return true;
+-
+- /* real mode guest state checks */
+- if (!is_protmode(vcpu) || (vmx_get_rflags(vcpu) & X86_EFLAGS_VM)) {
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_CS))
+- return false;
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_SS))
+- return false;
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_DS))
+- return false;
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_ES))
+- return false;
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_FS))
+- return false;
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_GS))
+- return false;
+- } else {
+- /* protected mode guest state checks */
+- if (!cs_ss_rpl_check(vcpu))
+- return false;
+- if (!code_segment_valid(vcpu))
+- return false;
+- if (!stack_segment_valid(vcpu))
+- return false;
+- if (!data_segment_valid(vcpu, VCPU_SREG_DS))
+- return false;
+- if (!data_segment_valid(vcpu, VCPU_SREG_ES))
+- return false;
+- if (!data_segment_valid(vcpu, VCPU_SREG_FS))
+- return false;
+- if (!data_segment_valid(vcpu, VCPU_SREG_GS))
+- return false;
+- if (!tr_valid(vcpu))
+- return false;
+- if (!ldtr_valid(vcpu))
+- return false;
+- }
+- /* TODO:
+- * - Add checks on RIP
+- * - Add checks on RFLAGS
+- */
+-
+- return true;
+-}
+-
+-static int init_rmode_tss(struct kvm *kvm)
+-{
+- gfn_t fn;
+- u16 data = 0;
+- int idx, r;
+-
+- idx = srcu_read_lock(&kvm->srcu);
+- fn = to_kvm_vmx(kvm)->tss_addr >> PAGE_SHIFT;
+- r = kvm_clear_guest_page(kvm, fn, 0, PAGE_SIZE);
+- if (r < 0)
+- goto out;
+- data = TSS_BASE_SIZE + TSS_REDIRECTION_SIZE;
+- r = kvm_write_guest_page(kvm, fn++, &data,
+- TSS_IOPB_BASE_OFFSET, sizeof(u16));
+- if (r < 0)
+- goto out;
+- r = kvm_clear_guest_page(kvm, fn++, 0, PAGE_SIZE);
+- if (r < 0)
+- goto out;
+- r = kvm_clear_guest_page(kvm, fn, 0, PAGE_SIZE);
+- if (r < 0)
+- goto out;
+- data = ~0;
+- r = kvm_write_guest_page(kvm, fn, &data,
+- RMODE_TSS_SIZE - 2 * PAGE_SIZE - 1,
+- sizeof(u8));
+-out:
+- srcu_read_unlock(&kvm->srcu, idx);
+- return r;
+-}
+-
+-static int init_rmode_identity_map(struct kvm *kvm)
+-{
+- struct kvm_vmx *kvm_vmx = to_kvm_vmx(kvm);
+- int i, idx, r = 0;
+- kvm_pfn_t identity_map_pfn;
+- u32 tmp;
+-
+- /* Protect kvm_vmx->ept_identity_pagetable_done. */
+- mutex_lock(&kvm->slots_lock);
+-
+- if (likely(kvm_vmx->ept_identity_pagetable_done))
+- goto out2;
+-
+- if (!kvm_vmx->ept_identity_map_addr)
+- kvm_vmx->ept_identity_map_addr = VMX_EPT_IDENTITY_PAGETABLE_ADDR;
+- identity_map_pfn = kvm_vmx->ept_identity_map_addr >> PAGE_SHIFT;
+-
+- r = __x86_set_memory_region(kvm, IDENTITY_PAGETABLE_PRIVATE_MEMSLOT,
+- kvm_vmx->ept_identity_map_addr, PAGE_SIZE);
+- if (r < 0)
+- goto out2;
+-
+- idx = srcu_read_lock(&kvm->srcu);
+- r = kvm_clear_guest_page(kvm, identity_map_pfn, 0, PAGE_SIZE);
+- if (r < 0)
+- goto out;
+- /* Set up identity-mapping pagetable for EPT in real mode */
+- for (i = 0; i < PT32_ENT_PER_PAGE; i++) {
+- tmp = (i << 22) + (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER |
+- _PAGE_ACCESSED | _PAGE_DIRTY | _PAGE_PSE);
+- r = kvm_write_guest_page(kvm, identity_map_pfn,
+- &tmp, i * sizeof(tmp), sizeof(tmp));
+- if (r < 0)
+- goto out;
+- }
+- kvm_vmx->ept_identity_pagetable_done = true;
+-
+-out:
+- srcu_read_unlock(&kvm->srcu, idx);
+-
+-out2:
+- mutex_unlock(&kvm->slots_lock);
+- return r;
+-}
+-
+-static void seg_setup(int seg)
+-{
+- const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
+- unsigned int ar;
+-
+- vmcs_write16(sf->selector, 0);
+- vmcs_writel(sf->base, 0);
+- vmcs_write32(sf->limit, 0xffff);
+- ar = 0x93;
+- if (seg == VCPU_SREG_CS)
+- ar |= 0x08; /* code segment */
+-
+- vmcs_write32(sf->ar_bytes, ar);
+-}
+-
+-static int alloc_apic_access_page(struct kvm *kvm)
+-{
+- struct page *page;
+- int r = 0;
+-
+- mutex_lock(&kvm->slots_lock);
+- if (kvm->arch.apic_access_page_done)
+- goto out;
+- r = __x86_set_memory_region(kvm, APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
+- APIC_DEFAULT_PHYS_BASE, PAGE_SIZE);
+- if (r)
+- goto out;
+-
+- page = gfn_to_page(kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT);
+- if (is_error_page(page)) {
+- r = -EFAULT;
+- goto out;
+- }
+-
+- /*
+- * Do not pin the page in memory, so that memory hot-unplug
+- * is able to migrate it.
+- */
+- put_page(page);
+- kvm->arch.apic_access_page_done = true;
+-out:
+- mutex_unlock(&kvm->slots_lock);
+- return r;
+-}
+-
+-int allocate_vpid(void)
+-{
+- int vpid;
+-
+- if (!enable_vpid)
+- return 0;
+- spin_lock(&vmx_vpid_lock);
+- vpid = find_first_zero_bit(vmx_vpid_bitmap, VMX_NR_VPIDS);
+- if (vpid < VMX_NR_VPIDS)
+- __set_bit(vpid, vmx_vpid_bitmap);
+- else
+- vpid = 0;
+- spin_unlock(&vmx_vpid_lock);
+- return vpid;
+-}
+-
+-void free_vpid(int vpid)
+-{
+- if (!enable_vpid || vpid == 0)
+- return;
+- spin_lock(&vmx_vpid_lock);
+- __clear_bit(vpid, vmx_vpid_bitmap);
+- spin_unlock(&vmx_vpid_lock);
+-}
+-
+-static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
+- u32 msr, int type)
+-{
+- int f = sizeof(unsigned long);
+-
+- if (!cpu_has_vmx_msr_bitmap())
+- return;
+-
+- if (static_branch_unlikely(&enable_evmcs))
+- evmcs_touch_msr_bitmap();
+-
+- /*
+- * See Intel PRM Vol. 3, 20.6.9 (MSR-Bitmap Address). Early manuals
+- * have the write-low and read-high bitmap offsets the wrong way round.
+- * We can control MSRs 0x00000000-0x00001fff and 0xc0000000-0xc0001fff.
+- */
+- if (msr <= 0x1fff) {
+- if (type & MSR_TYPE_R)
+- /* read-low */
+- __clear_bit(msr, msr_bitmap + 0x000 / f);
+-
+- if (type & MSR_TYPE_W)
+- /* write-low */
+- __clear_bit(msr, msr_bitmap + 0x800 / f);
+-
+- } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
+- msr &= 0x1fff;
+- if (type & MSR_TYPE_R)
+- /* read-high */
+- __clear_bit(msr, msr_bitmap + 0x400 / f);
+-
+- if (type & MSR_TYPE_W)
+- /* write-high */
+- __clear_bit(msr, msr_bitmap + 0xc00 / f);
+-
+- }
+-}
+-
+-static __always_inline void vmx_enable_intercept_for_msr(unsigned long *msr_bitmap,
+- u32 msr, int type)
+-{
+- int f = sizeof(unsigned long);
+-
+- if (!cpu_has_vmx_msr_bitmap())
+- return;
+-
+- if (static_branch_unlikely(&enable_evmcs))
+- evmcs_touch_msr_bitmap();
+-
+- /*
+- * See Intel PRM Vol. 3, 20.6.9 (MSR-Bitmap Address). Early manuals
+- * have the write-low and read-high bitmap offsets the wrong way round.
+- * We can control MSRs 0x00000000-0x00001fff and 0xc0000000-0xc0001fff.
+- */
+- if (msr <= 0x1fff) {
+- if (type & MSR_TYPE_R)
+- /* read-low */
+- __set_bit(msr, msr_bitmap + 0x000 / f);
+-
+- if (type & MSR_TYPE_W)
+- /* write-low */
+- __set_bit(msr, msr_bitmap + 0x800 / f);
+-
+- } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
+- msr &= 0x1fff;
+- if (type & MSR_TYPE_R)
+- /* read-high */
+- __set_bit(msr, msr_bitmap + 0x400 / f);
+-
+- if (type & MSR_TYPE_W)
+- /* write-high */
+- __set_bit(msr, msr_bitmap + 0xc00 / f);
+-
+- }
+-}
+-
+-static __always_inline void vmx_set_intercept_for_msr(unsigned long *msr_bitmap,
+- u32 msr, int type, bool value)
+-{
+- if (value)
+- vmx_enable_intercept_for_msr(msr_bitmap, msr, type);
+- else
+- vmx_disable_intercept_for_msr(msr_bitmap, msr, type);
+-}
+-
+-static u8 vmx_msr_bitmap_mode(struct kvm_vcpu *vcpu)
+-{
+- u8 mode = 0;
+-
+- if (cpu_has_secondary_exec_ctrls() &&
+- (secondary_exec_controls_get(to_vmx(vcpu)) &
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE)) {
+- mode |= MSR_BITMAP_MODE_X2APIC;
+- if (enable_apicv && kvm_vcpu_apicv_active(vcpu))
+- mode |= MSR_BITMAP_MODE_X2APIC_APICV;
+- }
+-
+- return mode;
+-}
+-
+-static void vmx_update_msr_bitmap_x2apic(unsigned long *msr_bitmap,
+- u8 mode)
+-{
+- int msr;
+-
+- for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
+- unsigned word = msr / BITS_PER_LONG;
+- msr_bitmap[word] = (mode & MSR_BITMAP_MODE_X2APIC_APICV) ? 0 : ~0;
+- msr_bitmap[word + (0x800 / sizeof(long))] = ~0;
+- }
+-
+- if (mode & MSR_BITMAP_MODE_X2APIC) {
+- /*
+- * TPR reads and writes can be virtualized even if virtual interrupt
+- * delivery is not in use.
+- */
+- vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_TASKPRI), MSR_TYPE_RW);
+- if (mode & MSR_BITMAP_MODE_X2APIC_APICV) {
+- vmx_enable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_TMCCT), MSR_TYPE_R);
+- vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_EOI), MSR_TYPE_W);
+- vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_SELF_IPI), MSR_TYPE_W);
+- }
+- }
+-}
+-
+-void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long *msr_bitmap = vmx->vmcs01.msr_bitmap;
+- u8 mode = vmx_msr_bitmap_mode(vcpu);
+- u8 changed = mode ^ vmx->msr_bitmap_mode;
+-
+- if (!changed)
+- return;
+-
+- if (changed & (MSR_BITMAP_MODE_X2APIC | MSR_BITMAP_MODE_X2APIC_APICV))
+- vmx_update_msr_bitmap_x2apic(msr_bitmap, mode);
+-
+- vmx->msr_bitmap_mode = mode;
+-}
+-
+-void pt_update_intercept_for_msr(struct vcpu_vmx *vmx)
+-{
+- unsigned long *msr_bitmap = vmx->vmcs01.msr_bitmap;
+- bool flag = !(vmx->pt_desc.guest.ctl & RTIT_CTL_TRACEEN);
+- u32 i;
+-
+- vmx_set_intercept_for_msr(msr_bitmap, MSR_IA32_RTIT_STATUS,
+- MSR_TYPE_RW, flag);
+- vmx_set_intercept_for_msr(msr_bitmap, MSR_IA32_RTIT_OUTPUT_BASE,
+- MSR_TYPE_RW, flag);
+- vmx_set_intercept_for_msr(msr_bitmap, MSR_IA32_RTIT_OUTPUT_MASK,
+- MSR_TYPE_RW, flag);
+- vmx_set_intercept_for_msr(msr_bitmap, MSR_IA32_RTIT_CR3_MATCH,
+- MSR_TYPE_RW, flag);
+- for (i = 0; i < vmx->pt_desc.addr_range; i++) {
+- vmx_set_intercept_for_msr(msr_bitmap,
+- MSR_IA32_RTIT_ADDR0_A + i * 2, MSR_TYPE_RW, flag);
+- vmx_set_intercept_for_msr(msr_bitmap,
+- MSR_IA32_RTIT_ADDR0_B + i * 2, MSR_TYPE_RW, flag);
+- }
+-}
+-
+-static bool vmx_get_enable_apicv(struct kvm *kvm)
+-{
+- return enable_apicv;
+-}
+-
+-static bool vmx_guest_apic_has_interrupt(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- void *vapic_page;
+- u32 vppr;
+- int rvi;
+-
+- if (WARN_ON_ONCE(!is_guest_mode(vcpu)) ||
+- !nested_cpu_has_vid(get_vmcs12(vcpu)) ||
+- WARN_ON_ONCE(!vmx->nested.virtual_apic_map.gfn))
+- return false;
+-
+- rvi = vmx_get_rvi();
+-
+- vapic_page = vmx->nested.virtual_apic_map.hva;
+- vppr = *((u32 *)(vapic_page + APIC_PROCPRI));
+-
+- return ((rvi & 0xf0) > (vppr & 0xf0));
+-}
+-
+-static inline bool kvm_vcpu_trigger_posted_interrupt(struct kvm_vcpu *vcpu,
+- bool nested)
+-{
+-#ifdef CONFIG_SMP
+- int pi_vec = nested ? POSTED_INTR_NESTED_VECTOR : POSTED_INTR_VECTOR;
+-
+- if (vcpu->mode == IN_GUEST_MODE) {
+- /*
+- * The vector of interrupt to be delivered to vcpu had
+- * been set in PIR before this function.
+- *
+- * Following cases will be reached in this block, and
+- * we always send a notification event in all cases as
+- * explained below.
+- *
+- * Case 1: vcpu keeps in non-root mode. Sending a
+- * notification event posts the interrupt to vcpu.
+- *
+- * Case 2: vcpu exits to root mode and is still
+- * runnable. PIR will be synced to vIRR before the
+- * next vcpu entry. Sending a notification event in
+- * this case has no effect, as vcpu is not in root
+- * mode.
+- *
+- * Case 3: vcpu exits to root mode and is blocked.
+- * vcpu_block() has already synced PIR to vIRR and
+- * never blocks vcpu if vIRR is not cleared. Therefore,
+- * a blocked vcpu here does not wait for any requested
+- * interrupts in PIR, and sending a notification event
+- * which has no effect is safe here.
+- */
+-
+- apic->send_IPI_mask(get_cpu_mask(vcpu->cpu), pi_vec);
+- return true;
+- }
+-#endif
+- return false;
+-}
+-
+-static int vmx_deliver_nested_posted_interrupt(struct kvm_vcpu *vcpu,
+- int vector)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (is_guest_mode(vcpu) &&
+- vector == vmx->nested.posted_intr_nv) {
+- /*
+- * If a posted intr is not recognized by hardware,
+- * we will accomplish it in the next vmentry.
+- */
+- vmx->nested.pi_pending = true;
+- kvm_make_request(KVM_REQ_EVENT, vcpu);
+- /* the PIR and ON have been set by L1. */
+- if (!kvm_vcpu_trigger_posted_interrupt(vcpu, true))
+- kvm_vcpu_kick(vcpu);
+- return 0;
+- }
+- return -1;
+-}
+-/*
+- * Send interrupt to vcpu via posted interrupt way.
+- * 1. If target vcpu is running(non-root mode), send posted interrupt
+- * notification to vcpu and hardware will sync PIR to vIRR atomically.
+- * 2. If target vcpu isn't running(root mode), kick it to pick up the
+- * interrupt from PIR in next vmentry.
+- */
+-static void vmx_deliver_posted_interrupt(struct kvm_vcpu *vcpu, int vector)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int r;
+-
+- r = vmx_deliver_nested_posted_interrupt(vcpu, vector);
+- if (!r)
+- return;
+-
+- if (pi_test_and_set_pir(vector, &vmx->pi_desc))
+- return;
+-
+- /* If a previous notification has sent the IPI, nothing to do. */
+- if (pi_test_and_set_on(&vmx->pi_desc))
+- return;
+-
+- if (!kvm_vcpu_trigger_posted_interrupt(vcpu, false))
+- kvm_vcpu_kick(vcpu);
+-}
+-
+-/*
+- * Set up the vmcs's constant host-state fields, i.e., host-state fields that
+- * will not change in the lifetime of the guest.
+- * Note that host-state that does change is set elsewhere. E.g., host-state
+- * that is set differently for each CPU is set in vmx_vcpu_load(), not here.
+- */
+-void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+-{
+- u32 low32, high32;
+- unsigned long tmpl;
+- unsigned long cr0, cr3, cr4;
+-
+- cr0 = read_cr0();
+- WARN_ON(cr0 & X86_CR0_TS);
+- vmcs_writel(HOST_CR0, cr0); /* 22.2.3 */
+-
+- /*
+- * Save the most likely value for this task's CR3 in the VMCS.
+- * We can't use __get_current_cr3_fast() because we're not atomic.
+- */
+- cr3 = __read_cr3();
+- vmcs_writel(HOST_CR3, cr3); /* 22.2.3 FIXME: shadow tables */
+- vmx->loaded_vmcs->host_state.cr3 = cr3;
+-
+- /* Save the most likely value for this task's CR4 in the VMCS. */
+- cr4 = cr4_read_shadow();
+- vmcs_writel(HOST_CR4, cr4); /* 22.2.3, 22.2.5 */
+- vmx->loaded_vmcs->host_state.cr4 = cr4;
+-
+- vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */
+-#ifdef CONFIG_X86_64
+- /*
+- * Load null selectors, so we can avoid reloading them in
+- * vmx_prepare_switch_to_host(), in case userspace uses
+- * the null selectors too (the expected case).
+- */
+- vmcs_write16(HOST_DS_SELECTOR, 0);
+- vmcs_write16(HOST_ES_SELECTOR, 0);
+-#else
+- vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
+- vmcs_write16(HOST_ES_SELECTOR, __KERNEL_DS); /* 22.2.4 */
+-#endif
+- vmcs_write16(HOST_SS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
+- vmcs_write16(HOST_TR_SELECTOR, GDT_ENTRY_TSS*8); /* 22.2.4 */
+-
+- vmcs_writel(HOST_IDTR_BASE, host_idt_base); /* 22.2.4 */
+-
+- vmcs_writel(HOST_RIP, (unsigned long)vmx_vmexit); /* 22.2.5 */
+-
+- rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
+- vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
+- rdmsrl(MSR_IA32_SYSENTER_EIP, tmpl);
+- vmcs_writel(HOST_IA32_SYSENTER_EIP, tmpl); /* 22.2.3 */
+-
+- if (vmcs_config.vmexit_ctrl & VM_EXIT_LOAD_IA32_PAT) {
+- rdmsr(MSR_IA32_CR_PAT, low32, high32);
+- vmcs_write64(HOST_IA32_PAT, low32 | ((u64) high32 << 32));
+- }
+-
+- if (cpu_has_load_ia32_efer())
+- vmcs_write64(HOST_IA32_EFER, host_efer);
+-}
+-
+-void set_cr4_guest_host_mask(struct vcpu_vmx *vmx)
+-{
+- vmx->vcpu.arch.cr4_guest_owned_bits = KVM_CR4_GUEST_OWNED_BITS;
+- if (enable_ept)
+- vmx->vcpu.arch.cr4_guest_owned_bits |= X86_CR4_PGE;
+- if (is_guest_mode(&vmx->vcpu))
+- vmx->vcpu.arch.cr4_guest_owned_bits &=
+- ~get_vmcs12(&vmx->vcpu)->cr4_guest_host_mask;
+- vmcs_writel(CR4_GUEST_HOST_MASK, ~vmx->vcpu.arch.cr4_guest_owned_bits);
+-}
+-
+-u32 vmx_pin_based_exec_ctrl(struct vcpu_vmx *vmx)
+-{
+- u32 pin_based_exec_ctrl = vmcs_config.pin_based_exec_ctrl;
+-
+- if (!kvm_vcpu_apicv_active(&vmx->vcpu))
+- pin_based_exec_ctrl &= ~PIN_BASED_POSTED_INTR;
+-
+- if (!enable_vnmi)
+- pin_based_exec_ctrl &= ~PIN_BASED_VIRTUAL_NMIS;
+-
+- if (!enable_preemption_timer)
+- pin_based_exec_ctrl &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
+-
+- return pin_based_exec_ctrl;
+-}
+-
+-static void vmx_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- pin_controls_set(vmx, vmx_pin_based_exec_ctrl(vmx));
+- if (cpu_has_secondary_exec_ctrls()) {
+- if (kvm_vcpu_apicv_active(vcpu))
+- secondary_exec_controls_setbit(vmx,
+- SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
+- else
+- secondary_exec_controls_clearbit(vmx,
+- SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
+- }
+-
+- if (cpu_has_vmx_msr_bitmap())
+- vmx_update_msr_bitmap(vcpu);
+-}
+-
+-u32 vmx_exec_control(struct vcpu_vmx *vmx)
+-{
+- u32 exec_control = vmcs_config.cpu_based_exec_ctrl;
+-
+- if (vmx->vcpu.arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)
+- exec_control &= ~CPU_BASED_MOV_DR_EXITING;
+-
+- if (!cpu_need_tpr_shadow(&vmx->vcpu)) {
+- exec_control &= ~CPU_BASED_TPR_SHADOW;
+-#ifdef CONFIG_X86_64
+- exec_control |= CPU_BASED_CR8_STORE_EXITING |
+- CPU_BASED_CR8_LOAD_EXITING;
+-#endif
+- }
+- if (!enable_ept)
+- exec_control |= CPU_BASED_CR3_STORE_EXITING |
+- CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_INVLPG_EXITING;
+- if (kvm_mwait_in_guest(vmx->vcpu.kvm))
+- exec_control &= ~(CPU_BASED_MWAIT_EXITING |
+- CPU_BASED_MONITOR_EXITING);
+- if (kvm_hlt_in_guest(vmx->vcpu.kvm))
+- exec_control &= ~CPU_BASED_HLT_EXITING;
+- return exec_control;
+-}
+-
+-
+-static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx)
+-{
+- struct kvm_vcpu *vcpu = &vmx->vcpu;
+-
+- u32 exec_control = vmcs_config.cpu_based_2nd_exec_ctrl;
+-
+- if (pt_mode == PT_MODE_SYSTEM)
+- exec_control &= ~(SECONDARY_EXEC_PT_USE_GPA | SECONDARY_EXEC_PT_CONCEAL_VMX);
+- if (!cpu_need_virtualize_apic_accesses(vcpu))
+- exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+- if (vmx->vpid == 0)
+- exec_control &= ~SECONDARY_EXEC_ENABLE_VPID;
+- if (!enable_ept) {
+- exec_control &= ~SECONDARY_EXEC_ENABLE_EPT;
+- enable_unrestricted_guest = 0;
+- }
+- if (!enable_unrestricted_guest)
+- exec_control &= ~SECONDARY_EXEC_UNRESTRICTED_GUEST;
+- if (kvm_pause_in_guest(vmx->vcpu.kvm))
+- exec_control &= ~SECONDARY_EXEC_PAUSE_LOOP_EXITING;
+- if (!kvm_vcpu_apicv_active(vcpu))
+- exec_control &= ~(SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
+- exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
+-
+- /* SECONDARY_EXEC_DESC is enabled/disabled on writes to CR4.UMIP,
+- * in vmx_set_cr4. */
+- exec_control &= ~SECONDARY_EXEC_DESC;
+-
+- /* SECONDARY_EXEC_SHADOW_VMCS is enabled when L1 executes VMPTRLD
+- (handle_vmptrld).
+- We can NOT enable shadow_vmcs here because we don't have yet
+- a current VMCS12
+- */
+- exec_control &= ~SECONDARY_EXEC_SHADOW_VMCS;
+-
+- if (!enable_pml)
+- exec_control &= ~SECONDARY_EXEC_ENABLE_PML;
+-
+- if (vmx_xsaves_supported()) {
+- /* Exposing XSAVES only when XSAVE is exposed */
+- bool xsaves_enabled =
+- guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
+- guest_cpuid_has(vcpu, X86_FEATURE_XSAVES);
+-
+- vcpu->arch.xsaves_enabled = xsaves_enabled;
+-
+- if (!xsaves_enabled)
+- exec_control &= ~SECONDARY_EXEC_XSAVES;
+-
+- if (nested) {
+- if (xsaves_enabled)
+- vmx->nested.msrs.secondary_ctls_high |=
+- SECONDARY_EXEC_XSAVES;
+- else
+- vmx->nested.msrs.secondary_ctls_high &=
+- ~SECONDARY_EXEC_XSAVES;
+- }
+- }
+-
+- if (vmx_rdtscp_supported()) {
+- bool rdtscp_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP);
+- if (!rdtscp_enabled)
+- exec_control &= ~SECONDARY_EXEC_RDTSCP;
+-
+- if (nested) {
+- if (rdtscp_enabled)
+- vmx->nested.msrs.secondary_ctls_high |=
+- SECONDARY_EXEC_RDTSCP;
+- else
+- vmx->nested.msrs.secondary_ctls_high &=
+- ~SECONDARY_EXEC_RDTSCP;
+- }
+- }
+-
+- if (vmx_invpcid_supported()) {
+- /* Exposing INVPCID only when PCID is exposed */
+- bool invpcid_enabled =
+- guest_cpuid_has(vcpu, X86_FEATURE_INVPCID) &&
+- guest_cpuid_has(vcpu, X86_FEATURE_PCID);
+-
+- if (!invpcid_enabled) {
+- exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
+- guest_cpuid_clear(vcpu, X86_FEATURE_INVPCID);
+- }
+-
+- if (nested) {
+- if (invpcid_enabled)
+- vmx->nested.msrs.secondary_ctls_high |=
+- SECONDARY_EXEC_ENABLE_INVPCID;
+- else
+- vmx->nested.msrs.secondary_ctls_high &=
+- ~SECONDARY_EXEC_ENABLE_INVPCID;
+- }
+- }
+-
+- if (vmx_rdrand_supported()) {
+- bool rdrand_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDRAND);
+- if (rdrand_enabled)
+- exec_control &= ~SECONDARY_EXEC_RDRAND_EXITING;
+-
+- if (nested) {
+- if (rdrand_enabled)
+- vmx->nested.msrs.secondary_ctls_high |=
+- SECONDARY_EXEC_RDRAND_EXITING;
+- else
+- vmx->nested.msrs.secondary_ctls_high &=
+- ~SECONDARY_EXEC_RDRAND_EXITING;
+- }
+- }
+-
+- if (vmx_rdseed_supported()) {
+- bool rdseed_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDSEED);
+- if (rdseed_enabled)
+- exec_control &= ~SECONDARY_EXEC_RDSEED_EXITING;
+-
+- if (nested) {
+- if (rdseed_enabled)
+- vmx->nested.msrs.secondary_ctls_high |=
+- SECONDARY_EXEC_RDSEED_EXITING;
+- else
+- vmx->nested.msrs.secondary_ctls_high &=
+- ~SECONDARY_EXEC_RDSEED_EXITING;
+- }
+- }
+-
+- if (vmx_waitpkg_supported()) {
+- bool waitpkg_enabled =
+- guest_cpuid_has(vcpu, X86_FEATURE_WAITPKG);
+-
+- if (!waitpkg_enabled)
+- exec_control &= ~SECONDARY_EXEC_ENABLE_USR_WAIT_PAUSE;
+-
+- if (nested) {
+- if (waitpkg_enabled)
+- vmx->nested.msrs.secondary_ctls_high |=
+- SECONDARY_EXEC_ENABLE_USR_WAIT_PAUSE;
+- else
+- vmx->nested.msrs.secondary_ctls_high &=
+- ~SECONDARY_EXEC_ENABLE_USR_WAIT_PAUSE;
+- }
+- }
+-
+- vmx->secondary_exec_control = exec_control;
+-}
+-
+-static void ept_set_mmio_spte_mask(void)
+-{
+- /*
+- * EPT Misconfigurations can be generated if the value of bits 2:0
+- * of an EPT paging-structure entry is 110b (write/execute).
+- */
+- kvm_mmu_set_mmio_spte_mask(VMX_EPT_RWX_MASK,
+- VMX_EPT_MISCONFIG_WX_VALUE, 0);
+-}
+-
+-#define VMX_XSS_EXIT_BITMAP 0
+-
+-/*
+- * Noting that the initialization of Guest-state Area of VMCS is in
+- * vmx_vcpu_reset().
+- */
+-static void init_vmcs(struct vcpu_vmx *vmx)
+-{
+- if (nested)
+- nested_vmx_set_vmcs_shadowing_bitmap();
+-
+- if (cpu_has_vmx_msr_bitmap())
+- vmcs_write64(MSR_BITMAP, __pa(vmx->vmcs01.msr_bitmap));
+-
+- vmcs_write64(VMCS_LINK_POINTER, -1ull); /* 22.3.1.5 */
+-
+- /* Control */
+- pin_controls_set(vmx, vmx_pin_based_exec_ctrl(vmx));
+-
+- exec_controls_set(vmx, vmx_exec_control(vmx));
+-
+- if (cpu_has_secondary_exec_ctrls()) {
+- vmx_compute_secondary_exec_control(vmx);
+- secondary_exec_controls_set(vmx, vmx->secondary_exec_control);
+- }
+-
+- if (kvm_vcpu_apicv_active(&vmx->vcpu)) {
+- vmcs_write64(EOI_EXIT_BITMAP0, 0);
+- vmcs_write64(EOI_EXIT_BITMAP1, 0);
+- vmcs_write64(EOI_EXIT_BITMAP2, 0);
+- vmcs_write64(EOI_EXIT_BITMAP3, 0);
+-
+- vmcs_write16(GUEST_INTR_STATUS, 0);
+-
+- vmcs_write16(POSTED_INTR_NV, POSTED_INTR_VECTOR);
+- vmcs_write64(POSTED_INTR_DESC_ADDR, __pa((&vmx->pi_desc)));
+- }
+-
+- if (!kvm_pause_in_guest(vmx->vcpu.kvm)) {
+- vmcs_write32(PLE_GAP, ple_gap);
+- vmx->ple_window = ple_window;
+- vmx->ple_window_dirty = true;
+- }
+-
+- vmcs_write32(PAGE_FAULT_ERROR_CODE_MASK, 0);
+- vmcs_write32(PAGE_FAULT_ERROR_CODE_MATCH, 0);
+- vmcs_write32(CR3_TARGET_COUNT, 0); /* 22.2.1 */
+-
+- vmcs_write16(HOST_FS_SELECTOR, 0); /* 22.2.4 */
+- vmcs_write16(HOST_GS_SELECTOR, 0); /* 22.2.4 */
+- vmx_set_constant_host_state(vmx);
+- vmcs_writel(HOST_FS_BASE, 0); /* 22.2.4 */
+- vmcs_writel(HOST_GS_BASE, 0); /* 22.2.4 */
+-
+- if (cpu_has_vmx_vmfunc())
+- vmcs_write64(VM_FUNCTION_CONTROL, 0);
+-
+- vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
+- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
+- vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host.val));
+- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
+- vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest.val));
+-
+- if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT)
+- vmcs_write64(GUEST_IA32_PAT, vmx->vcpu.arch.pat);
+-
+- vm_exit_controls_set(vmx, vmx_vmexit_ctrl());
+-
+- /* 22.2.1, 20.8.1 */
+- vm_entry_controls_set(vmx, vmx_vmentry_ctrl());
+-
+- vmx->vcpu.arch.cr0_guest_owned_bits = X86_CR0_TS;
+- vmcs_writel(CR0_GUEST_HOST_MASK, ~X86_CR0_TS);
+-
+- set_cr4_guest_host_mask(vmx);
+-
+- if (vmx->vpid != 0)
+- vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
+-
+- if (vmx_xsaves_supported())
+- vmcs_write64(XSS_EXIT_BITMAP, VMX_XSS_EXIT_BITMAP);
+-
+- if (enable_pml) {
+- vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
+- vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
+- }
+-
+- if (cpu_has_vmx_encls_vmexit())
+- vmcs_write64(ENCLS_EXITING_BITMAP, -1ull);
+-
+- if (pt_mode == PT_MODE_HOST_GUEST) {
+- memset(&vmx->pt_desc, 0, sizeof(vmx->pt_desc));
+- /* Bit[6~0] are forced to 1, writes are ignored. */
+- vmx->pt_desc.guest.output_mask = 0x7F;
+- vmcs_write64(GUEST_IA32_RTIT_CTL, 0);
+- }
+-}
+-
+-static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct msr_data apic_base_msr;
+- u64 cr0;
+-
+- vmx->rmode.vm86_active = 0;
+- vmx->spec_ctrl = 0;
+-
+- vmx->msr_ia32_umwait_control = 0;
+-
+- vcpu->arch.microcode_version = 0x100000000ULL;
+- vmx->vcpu.arch.regs[VCPU_REGS_RDX] = get_rdx_init_val();
+- vmx->hv_deadline_tsc = -1;
+- kvm_set_cr8(vcpu, 0);
+-
+- if (!init_event) {
+- apic_base_msr.data = APIC_DEFAULT_PHYS_BASE |
+- MSR_IA32_APICBASE_ENABLE;
+- if (kvm_vcpu_is_reset_bsp(vcpu))
+- apic_base_msr.data |= MSR_IA32_APICBASE_BSP;
+- apic_base_msr.host_initiated = true;
+- kvm_set_apic_base(vcpu, &apic_base_msr);
+- }
+-
+- vmx_segment_cache_clear(vmx);
+-
+- seg_setup(VCPU_SREG_CS);
+- vmcs_write16(GUEST_CS_SELECTOR, 0xf000);
+- vmcs_writel(GUEST_CS_BASE, 0xffff0000ul);
+-
+- seg_setup(VCPU_SREG_DS);
+- seg_setup(VCPU_SREG_ES);
+- seg_setup(VCPU_SREG_FS);
+- seg_setup(VCPU_SREG_GS);
+- seg_setup(VCPU_SREG_SS);
+-
+- vmcs_write16(GUEST_TR_SELECTOR, 0);
+- vmcs_writel(GUEST_TR_BASE, 0);
+- vmcs_write32(GUEST_TR_LIMIT, 0xffff);
+- vmcs_write32(GUEST_TR_AR_BYTES, 0x008b);
+-
+- vmcs_write16(GUEST_LDTR_SELECTOR, 0);
+- vmcs_writel(GUEST_LDTR_BASE, 0);
+- vmcs_write32(GUEST_LDTR_LIMIT, 0xffff);
+- vmcs_write32(GUEST_LDTR_AR_BYTES, 0x00082);
+-
+- if (!init_event) {
+- vmcs_write32(GUEST_SYSENTER_CS, 0);
+- vmcs_writel(GUEST_SYSENTER_ESP, 0);
+- vmcs_writel(GUEST_SYSENTER_EIP, 0);
+- vmcs_write64(GUEST_IA32_DEBUGCTL, 0);
+- }
+-
+- kvm_set_rflags(vcpu, X86_EFLAGS_FIXED);
+- kvm_rip_write(vcpu, 0xfff0);
+-
+- vmcs_writel(GUEST_GDTR_BASE, 0);
+- vmcs_write32(GUEST_GDTR_LIMIT, 0xffff);
+-
+- vmcs_writel(GUEST_IDTR_BASE, 0);
+- vmcs_write32(GUEST_IDTR_LIMIT, 0xffff);
+-
+- vmcs_write32(GUEST_ACTIVITY_STATE, GUEST_ACTIVITY_ACTIVE);
+- vmcs_write32(GUEST_INTERRUPTIBILITY_INFO, 0);
+- vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS, 0);
+- if (kvm_mpx_supported())
+- vmcs_write64(GUEST_BNDCFGS, 0);
+-
+- setup_msrs(vmx);
+-
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0); /* 22.2.1 */
+-
+- if (cpu_has_vmx_tpr_shadow() && !init_event) {
+- vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, 0);
+- if (cpu_need_tpr_shadow(vcpu))
+- vmcs_write64(VIRTUAL_APIC_PAGE_ADDR,
+- __pa(vcpu->arch.apic->regs));
+- vmcs_write32(TPR_THRESHOLD, 0);
+- }
+-
+- kvm_make_request(KVM_REQ_APIC_PAGE_RELOAD, vcpu);
+-
+- cr0 = X86_CR0_NW | X86_CR0_CD | X86_CR0_ET;
+- vmx->vcpu.arch.cr0 = cr0;
+- vmx_set_cr0(vcpu, cr0); /* enter rmode */
+- vmx_set_cr4(vcpu, 0);
+- vmx_set_efer(vcpu, 0);
+-
+- update_exception_bitmap(vcpu);
+-
+- vpid_sync_context(vmx->vpid);
+- if (init_event)
+- vmx_clear_hlt(vcpu);
+-}
+-
+-static void enable_irq_window(struct kvm_vcpu *vcpu)
+-{
+- exec_controls_setbit(to_vmx(vcpu), CPU_BASED_INTR_WINDOW_EXITING);
+-}
+-
+-static void enable_nmi_window(struct kvm_vcpu *vcpu)
+-{
+- if (!enable_vnmi ||
+- vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
+- enable_irq_window(vcpu);
+- return;
+- }
+-
+- exec_controls_setbit(to_vmx(vcpu), CPU_BASED_NMI_WINDOW_EXITING);
+-}
+-
+-static void vmx_inject_irq(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- uint32_t intr;
+- int irq = vcpu->arch.interrupt.nr;
+-
+- trace_kvm_inj_virq(irq);
+-
+- ++vcpu->stat.irq_injections;
+- if (vmx->rmode.vm86_active) {
+- int inc_eip = 0;
+- if (vcpu->arch.interrupt.soft)
+- inc_eip = vcpu->arch.event_exit_inst_len;
+- kvm_inject_realmode_interrupt(vcpu, irq, inc_eip);
+- return;
+- }
+- intr = irq | INTR_INFO_VALID_MASK;
+- if (vcpu->arch.interrupt.soft) {
+- intr |= INTR_TYPE_SOFT_INTR;
+- vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
+- vmx->vcpu.arch.event_exit_inst_len);
+- } else
+- intr |= INTR_TYPE_EXT_INTR;
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, intr);
+-
+- vmx_clear_hlt(vcpu);
+-}
+-
+-static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (!enable_vnmi) {
+- /*
+- * Tracking the NMI-blocked state in software is built upon
+- * finding the next open IRQ window. This, in turn, depends on
+- * well-behaving guests: They have to keep IRQs disabled at
+- * least as long as the NMI handler runs. Otherwise we may
+- * cause NMI nesting, maybe breaking the guest. But as this is
+- * highly unlikely, we can live with the residual risk.
+- */
+- vmx->loaded_vmcs->soft_vnmi_blocked = 1;
+- vmx->loaded_vmcs->vnmi_blocked_time = 0;
+- }
+-
+- ++vcpu->stat.nmi_injections;
+- vmx->loaded_vmcs->nmi_known_unmasked = false;
+-
+- if (vmx->rmode.vm86_active) {
+- kvm_inject_realmode_interrupt(vcpu, NMI_VECTOR, 0);
+- return;
+- }
+-
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD,
+- INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK | NMI_VECTOR);
+-
+- vmx_clear_hlt(vcpu);
+-}
+-
+-bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- bool masked;
+-
+- if (!enable_vnmi)
+- return vmx->loaded_vmcs->soft_vnmi_blocked;
+- if (vmx->loaded_vmcs->nmi_known_unmasked)
+- return false;
+- masked = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_NMI;
+- vmx->loaded_vmcs->nmi_known_unmasked = !masked;
+- return masked;
+-}
+-
+-void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (!enable_vnmi) {
+- if (vmx->loaded_vmcs->soft_vnmi_blocked != masked) {
+- vmx->loaded_vmcs->soft_vnmi_blocked = masked;
+- vmx->loaded_vmcs->vnmi_blocked_time = 0;
+- }
+- } else {
+- vmx->loaded_vmcs->nmi_known_unmasked = !masked;
+- if (masked)
+- vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+- GUEST_INTR_STATE_NMI);
+- else
+- vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
+- GUEST_INTR_STATE_NMI);
+- }
+-}
+-
+-static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+-{
+- if (to_vmx(vcpu)->nested.nested_run_pending)
+- return 0;
+-
+- if (!enable_vnmi &&
+- to_vmx(vcpu)->loaded_vmcs->soft_vnmi_blocked)
+- return 0;
+-
+- return !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+- (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_STI
+- | GUEST_INTR_STATE_NMI));
+-}
+-
+-static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu)
+-{
+- return (!to_vmx(vcpu)->nested.nested_run_pending &&
+- vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_IF) &&
+- !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+- (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS));
+-}
+-
+-static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr)
+-{
+- int ret;
+-
+- if (enable_unrestricted_guest)
+- return 0;
+-
+- ret = x86_set_memory_region(kvm, TSS_PRIVATE_MEMSLOT, addr,
+- PAGE_SIZE * 3);
+- if (ret)
+- return ret;
+- to_kvm_vmx(kvm)->tss_addr = addr;
+- return init_rmode_tss(kvm);
+-}
+-
+-static int vmx_set_identity_map_addr(struct kvm *kvm, u64 ident_addr)
+-{
+- to_kvm_vmx(kvm)->ept_identity_map_addr = ident_addr;
+- return 0;
+-}
+-
+-static bool rmode_exception(struct kvm_vcpu *vcpu, int vec)
+-{
+- switch (vec) {
+- case BP_VECTOR:
+- /*
+- * Update instruction length as we may reinject the exception
+- * from user space while in guest debugging mode.
+- */
+- to_vmx(vcpu)->vcpu.arch.event_exit_inst_len =
+- vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
+- if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
+- return false;
+- /* fall through */
+- case DB_VECTOR:
+- if (vcpu->guest_debug &
+- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
+- return false;
+- /* fall through */
+- case DE_VECTOR:
+- case OF_VECTOR:
+- case BR_VECTOR:
+- case UD_VECTOR:
+- case DF_VECTOR:
+- case SS_VECTOR:
+- case GP_VECTOR:
+- case MF_VECTOR:
+- return true;
+- break;
+- }
+- return false;
+-}
+-
+-static int handle_rmode_exception(struct kvm_vcpu *vcpu,
+- int vec, u32 err_code)
+-{
+- /*
+- * Instruction with address size override prefix opcode 0x67
+- * Cause the #SS fault with 0 error code in VM86 mode.
+- */
+- if (((vec == GP_VECTOR) || (vec == SS_VECTOR)) && err_code == 0) {
+- if (kvm_emulate_instruction(vcpu, 0)) {
+- if (vcpu->arch.halt_request) {
+- vcpu->arch.halt_request = 0;
+- return kvm_vcpu_halt(vcpu);
+- }
+- return 1;
+- }
+- return 0;
+- }
+-
+- /*
+- * Forward all other exceptions that are valid in real mode.
+- * FIXME: Breaks guest debugging in real mode, needs to be fixed with
+- * the required debugging infrastructure rework.
+- */
+- kvm_queue_exception(vcpu, vec);
+- return 1;
+-}
+-
+-/*
+- * Trigger machine check on the host. We assume all the MSRs are already set up
+- * by the CPU and that we still run on the same CPU as the MCE occurred on.
+- * We pass a fake environment to the machine check handler because we want
+- * the guest to be always treated like user space, no matter what context
+- * it used internally.
+- */
+-static void kvm_machine_check(void)
+-{
+-#if defined(CONFIG_X86_MCE) && defined(CONFIG_X86_64)
+- struct pt_regs regs = {
+- .cs = 3, /* Fake ring 3 no matter what the guest ran on */
+- .flags = X86_EFLAGS_IF,
+- };
+-
+- do_machine_check(®s, 0);
+-#endif
+-}
+-
+-static int handle_machine_check(struct kvm_vcpu *vcpu)
+-{
+- /* handled by vmx_vcpu_run() */
+- return 1;
+-}
+-
+-static int handle_exception_nmi(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct kvm_run *kvm_run = vcpu->run;
+- u32 intr_info, ex_no, error_code;
+- unsigned long cr2, rip, dr6;
+- u32 vect_info;
+-
+- vect_info = vmx->idt_vectoring_info;
+- intr_info = vmx->exit_intr_info;
+-
+- if (is_machine_check(intr_info) || is_nmi(intr_info))
+- return 1; /* handled by handle_exception_nmi_irqoff() */
+-
+- if (is_invalid_opcode(intr_info))
+- return handle_ud(vcpu);
+-
+- error_code = 0;
+- if (intr_info & INTR_INFO_DELIVER_CODE_MASK)
+- error_code = vmcs_read32(VM_EXIT_INTR_ERROR_CODE);
+-
+- if (!vmx->rmode.vm86_active && is_gp_fault(intr_info)) {
+- WARN_ON_ONCE(!enable_vmware_backdoor);
+-
+- /*
+- * VMware backdoor emulation on #GP interception only handles
+- * IN{S}, OUT{S}, and RDPMC, none of which generate a non-zero
+- * error code on #GP.
+- */
+- if (error_code) {
+- kvm_queue_exception_e(vcpu, GP_VECTOR, error_code);
+- return 1;
+- }
+- return kvm_emulate_instruction(vcpu, EMULTYPE_VMWARE_GP);
+- }
+-
+- /*
+- * The #PF with PFEC.RSVD = 1 indicates the guest is accessing
+- * MMIO, it is better to report an internal error.
+- * See the comments in vmx_handle_exit.
+- */
+- if ((vect_info & VECTORING_INFO_VALID_MASK) &&
+- !(is_page_fault(intr_info) && !(error_code & PFERR_RSVD_MASK))) {
+- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+- vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_SIMUL_EX;
+- vcpu->run->internal.ndata = 3;
+- vcpu->run->internal.data[0] = vect_info;
+- vcpu->run->internal.data[1] = intr_info;
+- vcpu->run->internal.data[2] = error_code;
+- return 0;
+- }
+-
+- if (is_page_fault(intr_info)) {
+- cr2 = vmcs_readl(EXIT_QUALIFICATION);
+- /* EPT won't cause page fault directly */
+- WARN_ON_ONCE(!vcpu->arch.apf.host_apf_reason && enable_ept);
+- return kvm_handle_page_fault(vcpu, error_code, cr2, NULL, 0);
+- }
+-
+- ex_no = intr_info & INTR_INFO_VECTOR_MASK;
+-
+- if (vmx->rmode.vm86_active && rmode_exception(vcpu, ex_no))
+- return handle_rmode_exception(vcpu, ex_no, error_code);
+-
+- switch (ex_no) {
+- case AC_VECTOR:
+- kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
+- return 1;
+- case DB_VECTOR:
+- dr6 = vmcs_readl(EXIT_QUALIFICATION);
+- if (!(vcpu->guest_debug &
+- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))) {
+- vcpu->arch.dr6 &= ~DR_TRAP_BITS;
+- vcpu->arch.dr6 |= dr6 | DR6_RTM;
+- if (is_icebp(intr_info))
+- WARN_ON(!skip_emulated_instruction(vcpu));
+-
+- kvm_queue_exception(vcpu, DB_VECTOR);
+- return 1;
+- }
+- kvm_run->debug.arch.dr6 = dr6 | DR6_FIXED_1;
+- kvm_run->debug.arch.dr7 = vmcs_readl(GUEST_DR7);
+- /* fall through */
+- case BP_VECTOR:
+- /*
+- * Update instruction length as we may reinject #BP from
+- * user space while in guest debugging mode. Reading it for
+- * #DB as well causes no harm, it is not used in that case.
+- */
+- vmx->vcpu.arch.event_exit_inst_len =
+- vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
+- kvm_run->exit_reason = KVM_EXIT_DEBUG;
+- rip = kvm_rip_read(vcpu);
+- kvm_run->debug.arch.pc = vmcs_readl(GUEST_CS_BASE) + rip;
+- kvm_run->debug.arch.exception = ex_no;
+- break;
+- default:
+- kvm_run->exit_reason = KVM_EXIT_EXCEPTION;
+- kvm_run->ex.exception = ex_no;
+- kvm_run->ex.error_code = error_code;
+- break;
+- }
+- return 0;
+-}
+-
+-static __always_inline int handle_external_interrupt(struct kvm_vcpu *vcpu)
+-{
+- ++vcpu->stat.irq_exits;
+- return 1;
+-}
+-
+-static int handle_triple_fault(struct kvm_vcpu *vcpu)
+-{
+- vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
+- vcpu->mmio_needed = 0;
+- return 0;
+-}
+-
+-static int handle_io(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification;
+- int size, in, string;
+- unsigned port;
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- string = (exit_qualification & 16) != 0;
+-
+- ++vcpu->stat.io_exits;
+-
+- if (string)
+- return kvm_emulate_instruction(vcpu, 0);
+-
+- port = exit_qualification >> 16;
+- size = (exit_qualification & 7) + 1;
+- in = (exit_qualification & 8) != 0;
+-
+- return kvm_fast_pio(vcpu, size, port, in);
+-}
+-
+-static void
+-vmx_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
+-{
+- /*
+- * Patch in the VMCALL instruction:
+- */
+- hypercall[0] = 0x0f;
+- hypercall[1] = 0x01;
+- hypercall[2] = 0xc1;
+-}
+-
+-/* called to set cr0 as appropriate for a mov-to-cr0 exit. */
+-static int handle_set_cr0(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+- if (is_guest_mode(vcpu)) {
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- unsigned long orig_val = val;
+-
+- /*
+- * We get here when L2 changed cr0 in a way that did not change
+- * any of L1's shadowed bits (see nested_vmx_exit_handled_cr),
+- * but did change L0 shadowed bits. So we first calculate the
+- * effective cr0 value that L1 would like to write into the
+- * hardware. It consists of the L2-owned bits from the new
+- * value combined with the L1-owned bits from L1's guest_cr0.
+- */
+- val = (val & ~vmcs12->cr0_guest_host_mask) |
+- (vmcs12->guest_cr0 & vmcs12->cr0_guest_host_mask);
+-
+- if (!nested_guest_cr0_valid(vcpu, val))
+- return 1;
+-
+- if (kvm_set_cr0(vcpu, val))
+- return 1;
+- vmcs_writel(CR0_READ_SHADOW, orig_val);
+- return 0;
+- } else {
+- if (to_vmx(vcpu)->nested.vmxon &&
+- !nested_host_cr0_valid(vcpu, val))
+- return 1;
+-
+- return kvm_set_cr0(vcpu, val);
+- }
+-}
+-
+-static int handle_set_cr4(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+- if (is_guest_mode(vcpu)) {
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- unsigned long orig_val = val;
+-
+- /* analogously to handle_set_cr0 */
+- val = (val & ~vmcs12->cr4_guest_host_mask) |
+- (vmcs12->guest_cr4 & vmcs12->cr4_guest_host_mask);
+- if (kvm_set_cr4(vcpu, val))
+- return 1;
+- vmcs_writel(CR4_READ_SHADOW, orig_val);
+- return 0;
+- } else
+- return kvm_set_cr4(vcpu, val);
+-}
+-
+-static int handle_desc(struct kvm_vcpu *vcpu)
+-{
+- WARN_ON(!(vcpu->arch.cr4 & X86_CR4_UMIP));
+- return kvm_emulate_instruction(vcpu, 0);
+-}
+-
+-static int handle_cr(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification, val;
+- int cr;
+- int reg;
+- int err;
+- int ret;
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- cr = exit_qualification & 15;
+- reg = (exit_qualification >> 8) & 15;
+- switch ((exit_qualification >> 4) & 3) {
+- case 0: /* mov to cr */
+- val = kvm_register_readl(vcpu, reg);
+- trace_kvm_cr_write(cr, val);
+- switch (cr) {
+- case 0:
+- err = handle_set_cr0(vcpu, val);
+- return kvm_complete_insn_gp(vcpu, err);
+- case 3:
+- WARN_ON_ONCE(enable_unrestricted_guest);
+- err = kvm_set_cr3(vcpu, val);
+- return kvm_complete_insn_gp(vcpu, err);
+- case 4:
+- err = handle_set_cr4(vcpu, val);
+- return kvm_complete_insn_gp(vcpu, err);
+- case 8: {
+- u8 cr8_prev = kvm_get_cr8(vcpu);
+- u8 cr8 = (u8)val;
+- err = kvm_set_cr8(vcpu, cr8);
+- ret = kvm_complete_insn_gp(vcpu, err);
+- if (lapic_in_kernel(vcpu))
+- return ret;
+- if (cr8_prev <= cr8)
+- return ret;
+- /*
+- * TODO: we might be squashing a
+- * KVM_GUESTDBG_SINGLESTEP-triggered
+- * KVM_EXIT_DEBUG here.
+- */
+- vcpu->run->exit_reason = KVM_EXIT_SET_TPR;
+- return 0;
+- }
+- }
+- break;
+- case 2: /* clts */
+- WARN_ONCE(1, "Guest should always own CR0.TS");
+- vmx_set_cr0(vcpu, kvm_read_cr0_bits(vcpu, ~X86_CR0_TS));
+- trace_kvm_cr_write(0, kvm_read_cr0(vcpu));
+- return kvm_skip_emulated_instruction(vcpu);
+- case 1: /*mov from cr*/
+- switch (cr) {
+- case 3:
+- WARN_ON_ONCE(enable_unrestricted_guest);
+- val = kvm_read_cr3(vcpu);
+- kvm_register_write(vcpu, reg, val);
+- trace_kvm_cr_read(cr, val);
+- return kvm_skip_emulated_instruction(vcpu);
+- case 8:
+- val = kvm_get_cr8(vcpu);
+- kvm_register_write(vcpu, reg, val);
+- trace_kvm_cr_read(cr, val);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- break;
+- case 3: /* lmsw */
+- val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f;
+- trace_kvm_cr_write(0, (kvm_read_cr0(vcpu) & ~0xful) | val);
+- kvm_lmsw(vcpu, val);
+-
+- return kvm_skip_emulated_instruction(vcpu);
+- default:
+- break;
+- }
+- vcpu->run->exit_reason = 0;
+- vcpu_unimpl(vcpu, "unhandled control register: op %d cr %d\n",
+- (int)(exit_qualification >> 4) & 3, cr);
+- return 0;
+-}
+-
+-static int handle_dr(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification;
+- int dr, dr7, reg;
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- dr = exit_qualification & DEBUG_REG_ACCESS_NUM;
+-
+- /* First, if DR does not exist, trigger UD */
+- if (!kvm_require_dr(vcpu, dr))
+- return 1;
+-
+- /* Do not handle if the CPL > 0, will trigger GP on re-entry */
+- if (!kvm_require_cpl(vcpu, 0))
+- return 1;
+- dr7 = vmcs_readl(GUEST_DR7);
+- if (dr7 & DR7_GD) {
+- /*
+- * As the vm-exit takes precedence over the debug trap, we
+- * need to emulate the latter, either for the host or the
+- * guest debugging itself.
+- */
+- if (vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) {
+- vcpu->run->debug.arch.dr6 = vcpu->arch.dr6;
+- vcpu->run->debug.arch.dr7 = dr7;
+- vcpu->run->debug.arch.pc = kvm_get_linear_rip(vcpu);
+- vcpu->run->debug.arch.exception = DB_VECTOR;
+- vcpu->run->exit_reason = KVM_EXIT_DEBUG;
+- return 0;
+- } else {
+- vcpu->arch.dr6 &= ~DR_TRAP_BITS;
+- vcpu->arch.dr6 |= DR6_BD | DR6_RTM;
+- kvm_queue_exception(vcpu, DB_VECTOR);
+- return 1;
+- }
+- }
+-
+- if (vcpu->guest_debug == 0) {
+- exec_controls_clearbit(to_vmx(vcpu), CPU_BASED_MOV_DR_EXITING);
+-
+- /*
+- * No more DR vmexits; force a reload of the debug registers
+- * and reenter on this instruction. The next vmexit will
+- * retrieve the full state of the debug registers.
+- */
+- vcpu->arch.switch_db_regs |= KVM_DEBUGREG_WONT_EXIT;
+- return 1;
+- }
+-
+- reg = DEBUG_REG_ACCESS_REG(exit_qualification);
+- if (exit_qualification & TYPE_MOV_FROM_DR) {
+- unsigned long val;
+-
+- if (kvm_get_dr(vcpu, dr, &val))
+- return 1;
+- kvm_register_write(vcpu, reg, val);
+- } else
+- if (kvm_set_dr(vcpu, dr, kvm_register_readl(vcpu, reg)))
+- return 1;
+-
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static u64 vmx_get_dr6(struct kvm_vcpu *vcpu)
+-{
+- return vcpu->arch.dr6;
+-}
+-
+-static void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+-}
+-
+-static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)
+-{
+- get_debugreg(vcpu->arch.db[0], 0);
+- get_debugreg(vcpu->arch.db[1], 1);
+- get_debugreg(vcpu->arch.db[2], 2);
+- get_debugreg(vcpu->arch.db[3], 3);
+- get_debugreg(vcpu->arch.dr6, 6);
+- vcpu->arch.dr7 = vmcs_readl(GUEST_DR7);
+-
+- vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_WONT_EXIT;
+- exec_controls_setbit(to_vmx(vcpu), CPU_BASED_MOV_DR_EXITING);
+-}
+-
+-static void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+- vmcs_writel(GUEST_DR7, val);
+-}
+-
+-static int handle_tpr_below_threshold(struct kvm_vcpu *vcpu)
+-{
+- kvm_apic_update_ppr(vcpu);
+- return 1;
+-}
+-
+-static int handle_interrupt_window(struct kvm_vcpu *vcpu)
+-{
+- exec_controls_clearbit(to_vmx(vcpu), CPU_BASED_INTR_WINDOW_EXITING);
+-
+- kvm_make_request(KVM_REQ_EVENT, vcpu);
+-
+- ++vcpu->stat.irq_window_exits;
+- return 1;
+-}
+-
+-static int handle_vmcall(struct kvm_vcpu *vcpu)
+-{
+- return kvm_emulate_hypercall(vcpu);
+-}
+-
+-static int handle_invd(struct kvm_vcpu *vcpu)
+-{
+- return kvm_emulate_instruction(vcpu, 0);
+-}
+-
+-static int handle_invlpg(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+-
+- kvm_mmu_invlpg(vcpu, exit_qualification);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static int handle_rdpmc(struct kvm_vcpu *vcpu)
+-{
+- int err;
+-
+- err = kvm_rdpmc(vcpu);
+- return kvm_complete_insn_gp(vcpu, err);
+-}
+-
+-static int handle_wbinvd(struct kvm_vcpu *vcpu)
+-{
+- return kvm_emulate_wbinvd(vcpu);
+-}
+-
+-static int handle_xsetbv(struct kvm_vcpu *vcpu)
+-{
+- u64 new_bv = kvm_read_edx_eax(vcpu);
+- u32 index = kvm_rcx_read(vcpu);
+-
+- if (kvm_set_xcr(vcpu, index, new_bv) == 0)
+- return kvm_skip_emulated_instruction(vcpu);
+- return 1;
+-}
+-
+-static int handle_apic_access(struct kvm_vcpu *vcpu)
+-{
+- if (likely(fasteoi)) {
+- unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- int access_type, offset;
+-
+- access_type = exit_qualification & APIC_ACCESS_TYPE;
+- offset = exit_qualification & APIC_ACCESS_OFFSET;
+- /*
+- * Sane guest uses MOV to write EOI, with written value
+- * not cared. So make a short-circuit here by avoiding
+- * heavy instruction emulation.
+- */
+- if ((access_type == TYPE_LINEAR_APIC_INST_WRITE) &&
+- (offset == APIC_EOI)) {
+- kvm_lapic_set_eoi(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- }
+- return kvm_emulate_instruction(vcpu, 0);
+-}
+-
+-static int handle_apic_eoi_induced(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- int vector = exit_qualification & 0xff;
+-
+- /* EOI-induced VM exit is trap-like and thus no need to adjust IP */
+- kvm_apic_set_eoi_accelerated(vcpu, vector);
+- return 1;
+-}
+-
+-static int handle_apic_write(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- u32 offset = exit_qualification & 0xfff;
+-
+- /* APIC-write VM exit is trap-like and thus no need to adjust IP */
+- kvm_apic_write_nodecode(vcpu, offset);
+- return 1;
+-}
+-
+-static int handle_task_switch(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long exit_qualification;
+- bool has_error_code = false;
+- u32 error_code = 0;
+- u16 tss_selector;
+- int reason, type, idt_v, idt_index;
+-
+- idt_v = (vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK);
+- idt_index = (vmx->idt_vectoring_info & VECTORING_INFO_VECTOR_MASK);
+- type = (vmx->idt_vectoring_info & VECTORING_INFO_TYPE_MASK);
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+-
+- reason = (u32)exit_qualification >> 30;
+- if (reason == TASK_SWITCH_GATE && idt_v) {
+- switch (type) {
+- case INTR_TYPE_NMI_INTR:
+- vcpu->arch.nmi_injected = false;
+- vmx_set_nmi_mask(vcpu, true);
+- break;
+- case INTR_TYPE_EXT_INTR:
+- case INTR_TYPE_SOFT_INTR:
+- kvm_clear_interrupt_queue(vcpu);
+- break;
+- case INTR_TYPE_HARD_EXCEPTION:
+- if (vmx->idt_vectoring_info &
+- VECTORING_INFO_DELIVER_CODE_MASK) {
+- has_error_code = true;
+- error_code =
+- vmcs_read32(IDT_VECTORING_ERROR_CODE);
+- }
+- /* fall through */
+- case INTR_TYPE_SOFT_EXCEPTION:
+- kvm_clear_exception_queue(vcpu);
+- break;
+- default:
+- break;
+- }
+- }
+- tss_selector = exit_qualification;
+-
+- if (!idt_v || (type != INTR_TYPE_HARD_EXCEPTION &&
+- type != INTR_TYPE_EXT_INTR &&
+- type != INTR_TYPE_NMI_INTR))
+- WARN_ON(!skip_emulated_instruction(vcpu));
+-
+- /*
+- * TODO: What about debug traps on tss switch?
+- * Are we supposed to inject them and update dr6?
+- */
+- return kvm_task_switch(vcpu, tss_selector,
+- type == INTR_TYPE_SOFT_INTR ? idt_index : -1,
+- reason, has_error_code, error_code);
+-}
+-
+-static int handle_ept_violation(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification;
+- gpa_t gpa;
+- u64 error_code;
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+-
+- /*
+- * EPT violation happened while executing iret from NMI,
+- * "blocked by NMI" bit has to be set before next VM entry.
+- * There are errata that may cause this bit to not be set:
+- * AAK134, BY25.
+- */
+- if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
+- enable_vnmi &&
+- (exit_qualification & INTR_INFO_UNBLOCK_NMI))
+- vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
+-
+- gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
+- trace_kvm_page_fault(gpa, exit_qualification);
+-
+- /* Is it a read fault? */
+- error_code = (exit_qualification & EPT_VIOLATION_ACC_READ)
+- ? PFERR_USER_MASK : 0;
+- /* Is it a write fault? */
+- error_code |= (exit_qualification & EPT_VIOLATION_ACC_WRITE)
+- ? PFERR_WRITE_MASK : 0;
+- /* Is it a fetch fault? */
+- error_code |= (exit_qualification & EPT_VIOLATION_ACC_INSTR)
+- ? PFERR_FETCH_MASK : 0;
+- /* ept page table entry is present? */
+- error_code |= (exit_qualification &
+- (EPT_VIOLATION_READABLE | EPT_VIOLATION_WRITABLE |
+- EPT_VIOLATION_EXECUTABLE))
+- ? PFERR_PRESENT_MASK : 0;
+-
+- error_code |= (exit_qualification & 0x100) != 0 ?
+- PFERR_GUEST_FINAL_MASK : PFERR_GUEST_PAGE_MASK;
+-
+- vcpu->arch.exit_qualification = exit_qualification;
+- return kvm_mmu_page_fault(vcpu, gpa, error_code, NULL, 0);
+-}
+-
+-static int handle_ept_misconfig(struct kvm_vcpu *vcpu)
+-{
+- gpa_t gpa;
+-
+- /*
+- * A nested guest cannot optimize MMIO vmexits, because we have an
+- * nGPA here instead of the required GPA.
+- */
+- gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
+- if (!is_guest_mode(vcpu) &&
+- !kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, gpa, 0, NULL)) {
+- trace_kvm_fast_mmio(gpa);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- return kvm_mmu_page_fault(vcpu, gpa, PFERR_RSVD_MASK, NULL, 0);
+-}
+-
+-static int handle_nmi_window(struct kvm_vcpu *vcpu)
+-{
+- WARN_ON_ONCE(!enable_vnmi);
+- exec_controls_clearbit(to_vmx(vcpu), CPU_BASED_NMI_WINDOW_EXITING);
+- ++vcpu->stat.nmi_window_exits;
+- kvm_make_request(KVM_REQ_EVENT, vcpu);
+-
+- return 1;
+-}
+-
+-static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- bool intr_window_requested;
+- unsigned count = 130;
+-
+- /*
+- * We should never reach the point where we are emulating L2
+- * due to invalid guest state as that means we incorrectly
+- * allowed a nested VMEntry with an invalid vmcs12.
+- */
+- WARN_ON_ONCE(vmx->emulation_required && vmx->nested.nested_run_pending);
+-
+- intr_window_requested = exec_controls_get(vmx) &
+- CPU_BASED_INTR_WINDOW_EXITING;
+-
+- while (vmx->emulation_required && count-- != 0) {
+- if (intr_window_requested && vmx_interrupt_allowed(vcpu))
+- return handle_interrupt_window(&vmx->vcpu);
+-
+- if (kvm_test_request(KVM_REQ_EVENT, vcpu))
+- return 1;
+-
+- if (!kvm_emulate_instruction(vcpu, 0))
+- return 0;
+-
+- if (vmx->emulation_required && !vmx->rmode.vm86_active &&
+- vcpu->arch.exception.pending) {
+- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+- vcpu->run->internal.suberror =
+- KVM_INTERNAL_ERROR_EMULATION;
+- vcpu->run->internal.ndata = 0;
+- return 0;
+- }
+-
+- if (vcpu->arch.halt_request) {
+- vcpu->arch.halt_request = 0;
+- return kvm_vcpu_halt(vcpu);
+- }
+-
+- /*
+- * Note, return 1 and not 0, vcpu_run() is responsible for
+- * morphing the pending signal into the proper return code.
+- */
+- if (signal_pending(current))
+- return 1;
+-
+- if (need_resched())
+- schedule();
+- }
+-
+- return 1;
+-}
+-
+-static void grow_ple_window(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned int old = vmx->ple_window;
+-
+- vmx->ple_window = __grow_ple_window(old, ple_window,
+- ple_window_grow,
+- ple_window_max);
+-
+- if (vmx->ple_window != old) {
+- vmx->ple_window_dirty = true;
+- trace_kvm_ple_window_update(vcpu->vcpu_id,
+- vmx->ple_window, old);
+- }
+-}
+-
+-static void shrink_ple_window(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned int old = vmx->ple_window;
+-
+- vmx->ple_window = __shrink_ple_window(old, ple_window,
+- ple_window_shrink,
+- ple_window);
+-
+- if (vmx->ple_window != old) {
+- vmx->ple_window_dirty = true;
+- trace_kvm_ple_window_update(vcpu->vcpu_id,
+- vmx->ple_window, old);
+- }
+-}
+-
+-/*
+- * Handler for POSTED_INTERRUPT_WAKEUP_VECTOR.
+- */
+-static void wakeup_handler(void)
+-{
+- struct kvm_vcpu *vcpu;
+- int cpu = smp_processor_id();
+-
+- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+- list_for_each_entry(vcpu, &per_cpu(blocked_vcpu_on_cpu, cpu),
+- blocked_vcpu_list) {
+- struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+-
+- if (pi_test_on(pi_desc) == 1)
+- kvm_vcpu_kick(vcpu);
+- }
+- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+-}
+-
+-static void vmx_enable_tdp(void)
+-{
+- kvm_mmu_set_mask_ptes(VMX_EPT_READABLE_MASK,
+- enable_ept_ad_bits ? VMX_EPT_ACCESS_BIT : 0ull,
+- enable_ept_ad_bits ? VMX_EPT_DIRTY_BIT : 0ull,
+- 0ull, VMX_EPT_EXECUTABLE_MASK,
+- cpu_has_vmx_ept_execute_only() ? 0ull : VMX_EPT_READABLE_MASK,
+- VMX_EPT_RWX_MASK, 0ull);
+-
+- ept_set_mmio_spte_mask();
+- kvm_enable_tdp();
+-}
+-
+-/*
+- * Indicate a busy-waiting vcpu in spinlock. We do not enable the PAUSE
+- * exiting, so only get here on cpu with PAUSE-Loop-Exiting.
+- */
+-static int handle_pause(struct kvm_vcpu *vcpu)
+-{
+- if (!kvm_pause_in_guest(vcpu->kvm))
+- grow_ple_window(vcpu);
+-
+- /*
+- * Intel sdm vol3 ch-25.1.3 says: The "PAUSE-loop exiting"
+- * VM-execution control is ignored if CPL > 0. OTOH, KVM
+- * never set PAUSE_EXITING and just set PLE if supported,
+- * so the vcpu must be CPL=0 if it gets a PAUSE exit.
+- */
+- kvm_vcpu_on_spin(vcpu, true);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static int handle_nop(struct kvm_vcpu *vcpu)
+-{
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static int handle_mwait(struct kvm_vcpu *vcpu)
+-{
+- printk_once(KERN_WARNING "kvm: MWAIT instruction emulated as NOP!\n");
+- return handle_nop(vcpu);
+-}
+-
+-static int handle_invalid_op(struct kvm_vcpu *vcpu)
+-{
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+-}
+-
+-static int handle_monitor_trap(struct kvm_vcpu *vcpu)
+-{
+- return 1;
+-}
+-
+-static int handle_monitor(struct kvm_vcpu *vcpu)
+-{
+- printk_once(KERN_WARNING "kvm: MONITOR instruction emulated as NOP!\n");
+- return handle_nop(vcpu);
+-}
+-
+-static int handle_invpcid(struct kvm_vcpu *vcpu)
+-{
+- u32 vmx_instruction_info;
+- unsigned long type;
+- bool pcid_enabled;
+- gva_t gva;
+- struct x86_exception e;
+- unsigned i;
+- unsigned long roots_to_free = 0;
+- struct {
+- u64 pcid;
+- u64 gla;
+- } operand;
+-
+- if (!guest_cpuid_has(vcpu, X86_FEATURE_INVPCID)) {
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+- }
+-
+- vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+- type = kvm_register_readl(vcpu, (vmx_instruction_info >> 28) & 0xf);
+-
+- if (type > 3) {
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+-
+- /* According to the Intel instruction reference, the memory operand
+- * is read even if it isn't needed (e.g., for type==all)
+- */
+- if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
+- vmx_instruction_info, false,
+- sizeof(operand), &gva))
+- return 1;
+-
+- if (kvm_read_guest_virt(vcpu, gva, &operand, sizeof(operand), &e)) {
+- kvm_inject_page_fault(vcpu, &e);
+- return 1;
+- }
+-
+- if (operand.pcid >> 12 != 0) {
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+-
+- pcid_enabled = kvm_read_cr4_bits(vcpu, X86_CR4_PCIDE);
+-
+- switch (type) {
+- case INVPCID_TYPE_INDIV_ADDR:
+- if ((!pcid_enabled && (operand.pcid != 0)) ||
+- is_noncanonical_address(operand.gla, vcpu)) {
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+- kvm_mmu_invpcid_gva(vcpu, operand.gla, operand.pcid);
+- return kvm_skip_emulated_instruction(vcpu);
+-
+- case INVPCID_TYPE_SINGLE_CTXT:
+- if (!pcid_enabled && (operand.pcid != 0)) {
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+-
+- if (kvm_get_active_pcid(vcpu) == operand.pcid) {
+- kvm_mmu_sync_roots(vcpu);
+- kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
+- }
+-
+- for (i = 0; i < KVM_MMU_NUM_PREV_ROOTS; i++)
+- if (kvm_get_pcid(vcpu, vcpu->arch.mmu->prev_roots[i].cr3)
+- == operand.pcid)
+- roots_to_free |= KVM_MMU_ROOT_PREVIOUS(i);
+-
+- kvm_mmu_free_roots(vcpu, vcpu->arch.mmu, roots_to_free);
+- /*
+- * If neither the current cr3 nor any of the prev_roots use the
+- * given PCID, then nothing needs to be done here because a
+- * resync will happen anyway before switching to any other CR3.
+- */
+-
+- return kvm_skip_emulated_instruction(vcpu);
+-
+- case INVPCID_TYPE_ALL_NON_GLOBAL:
+- /*
+- * Currently, KVM doesn't mark global entries in the shadow
+- * page tables, so a non-global flush just degenerates to a
+- * global flush. If needed, we could optimize this later by
+- * keeping track of global entries in shadow page tables.
+- */
+-
+- /* fall-through */
+- case INVPCID_TYPE_ALL_INCL_GLOBAL:
+- kvm_mmu_unload(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+-
+- default:
+- BUG(); /* We have already checked above that type <= 3 */
+- }
+-}
+-
+-static int handle_pml_full(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification;
+-
+- trace_kvm_pml_full(vcpu->vcpu_id);
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+-
+- /*
+- * PML buffer FULL happened while executing iret from NMI,
+- * "blocked by NMI" bit has to be set before next VM entry.
+- */
+- if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
+- enable_vnmi &&
+- (exit_qualification & INTR_INFO_UNBLOCK_NMI))
+- vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+- GUEST_INTR_STATE_NMI);
+-
+- /*
+- * PML buffer already flushed at beginning of VMEXIT. Nothing to do
+- * here.., and there's no userspace involvement needed for PML.
+- */
+- return 1;
+-}
+-
+-static int handle_preemption_timer(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (!vmx->req_immediate_exit &&
+- !unlikely(vmx->loaded_vmcs->hv_timer_soft_disabled))
+- kvm_lapic_expired_hv_timer(vcpu);
+-
+- return 1;
+-}
+-
+-/*
+- * When nested=0, all VMX instruction VM Exits filter here. The handlers
+- * are overwritten by nested_vmx_setup() when nested=1.
+- */
+-static int handle_vmx_instruction(struct kvm_vcpu *vcpu)
+-{
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+-}
+-
+-static int handle_encls(struct kvm_vcpu *vcpu)
+-{
+- /*
+- * SGX virtualization is not yet supported. There is no software
+- * enable bit for SGX, so we have to trap ENCLS and inject a #UD
+- * to prevent the guest from executing ENCLS.
+- */
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+-}
+-
+-/*
+- * The exit handlers return 1 if the exit was handled fully and guest execution
+- * may resume. Otherwise they set the kvm_run parameter to indicate what needs
+- * to be done to userspace and return 0.
+- */
+-static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
+- [EXIT_REASON_EXCEPTION_NMI] = handle_exception_nmi,
+- [EXIT_REASON_EXTERNAL_INTERRUPT] = handle_external_interrupt,
+- [EXIT_REASON_TRIPLE_FAULT] = handle_triple_fault,
+- [EXIT_REASON_NMI_WINDOW] = handle_nmi_window,
+- [EXIT_REASON_IO_INSTRUCTION] = handle_io,
+- [EXIT_REASON_CR_ACCESS] = handle_cr,
+- [EXIT_REASON_DR_ACCESS] = handle_dr,
+- [EXIT_REASON_CPUID] = kvm_emulate_cpuid,
+- [EXIT_REASON_MSR_READ] = kvm_emulate_rdmsr,
+- [EXIT_REASON_MSR_WRITE] = kvm_emulate_wrmsr,
+- [EXIT_REASON_INTERRUPT_WINDOW] = handle_interrupt_window,
+- [EXIT_REASON_HLT] = kvm_emulate_halt,
+- [EXIT_REASON_INVD] = handle_invd,
+- [EXIT_REASON_INVLPG] = handle_invlpg,
+- [EXIT_REASON_RDPMC] = handle_rdpmc,
+- [EXIT_REASON_VMCALL] = handle_vmcall,
+- [EXIT_REASON_VMCLEAR] = handle_vmx_instruction,
+- [EXIT_REASON_VMLAUNCH] = handle_vmx_instruction,
+- [EXIT_REASON_VMPTRLD] = handle_vmx_instruction,
+- [EXIT_REASON_VMPTRST] = handle_vmx_instruction,
+- [EXIT_REASON_VMREAD] = handle_vmx_instruction,
+- [EXIT_REASON_VMRESUME] = handle_vmx_instruction,
+- [EXIT_REASON_VMWRITE] = handle_vmx_instruction,
+- [EXIT_REASON_VMOFF] = handle_vmx_instruction,
+- [EXIT_REASON_VMON] = handle_vmx_instruction,
+- [EXIT_REASON_TPR_BELOW_THRESHOLD] = handle_tpr_below_threshold,
+- [EXIT_REASON_APIC_ACCESS] = handle_apic_access,
+- [EXIT_REASON_APIC_WRITE] = handle_apic_write,
+- [EXIT_REASON_EOI_INDUCED] = handle_apic_eoi_induced,
+- [EXIT_REASON_WBINVD] = handle_wbinvd,
+- [EXIT_REASON_XSETBV] = handle_xsetbv,
+- [EXIT_REASON_TASK_SWITCH] = handle_task_switch,
+- [EXIT_REASON_MCE_DURING_VMENTRY] = handle_machine_check,
+- [EXIT_REASON_GDTR_IDTR] = handle_desc,
+- [EXIT_REASON_LDTR_TR] = handle_desc,
+- [EXIT_REASON_EPT_VIOLATION] = handle_ept_violation,
+- [EXIT_REASON_EPT_MISCONFIG] = handle_ept_misconfig,
+- [EXIT_REASON_PAUSE_INSTRUCTION] = handle_pause,
+- [EXIT_REASON_MWAIT_INSTRUCTION] = handle_mwait,
+- [EXIT_REASON_MONITOR_TRAP_FLAG] = handle_monitor_trap,
+- [EXIT_REASON_MONITOR_INSTRUCTION] = handle_monitor,
+- [EXIT_REASON_INVEPT] = handle_vmx_instruction,
+- [EXIT_REASON_INVVPID] = handle_vmx_instruction,
+- [EXIT_REASON_RDRAND] = handle_invalid_op,
+- [EXIT_REASON_RDSEED] = handle_invalid_op,
+- [EXIT_REASON_PML_FULL] = handle_pml_full,
+- [EXIT_REASON_INVPCID] = handle_invpcid,
+- [EXIT_REASON_VMFUNC] = handle_vmx_instruction,
+- [EXIT_REASON_PREEMPTION_TIMER] = handle_preemption_timer,
+- [EXIT_REASON_ENCLS] = handle_encls,
+-};
+-
+-static const int kvm_vmx_max_exit_handlers =
+- ARRAY_SIZE(kvm_vmx_exit_handlers);
+-
+-static void vmx_get_exit_info(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2)
+-{
+- *info1 = vmcs_readl(EXIT_QUALIFICATION);
+- *info2 = vmcs_read32(VM_EXIT_INTR_INFO);
+-}
+-
+-static void vmx_destroy_pml_buffer(struct vcpu_vmx *vmx)
+-{
+- if (vmx->pml_pg) {
+- __free_page(vmx->pml_pg);
+- vmx->pml_pg = NULL;
+- }
+-}
+-
+-static void vmx_flush_pml_buffer(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u64 *pml_buf;
+- u16 pml_idx;
+-
+- pml_idx = vmcs_read16(GUEST_PML_INDEX);
+-
+- /* Do nothing if PML buffer is empty */
+- if (pml_idx == (PML_ENTITY_NUM - 1))
+- return;
+-
+- /* PML index always points to next available PML buffer entity */
+- if (pml_idx >= PML_ENTITY_NUM)
+- pml_idx = 0;
+- else
+- pml_idx++;
+-
+- pml_buf = page_address(vmx->pml_pg);
+- for (; pml_idx < PML_ENTITY_NUM; pml_idx++) {
+- u64 gpa;
+-
+- gpa = pml_buf[pml_idx];
+- WARN_ON(gpa & (PAGE_SIZE - 1));
+- kvm_vcpu_mark_page_dirty(vcpu, gpa >> PAGE_SHIFT);
+- }
+-
+- /* reset PML index */
+- vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
+-}
+-
+-/*
+- * Flush all vcpus' PML buffer and update logged GPAs to dirty_bitmap.
+- * Called before reporting dirty_bitmap to userspace.
+- */
+-static void kvm_flush_pml_buffers(struct kvm *kvm)
+-{
+- int i;
+- struct kvm_vcpu *vcpu;
+- /*
+- * We only need to kick vcpu out of guest mode here, as PML buffer
+- * is flushed at beginning of all VMEXITs, and it's obvious that only
+- * vcpus running in guest are possible to have unflushed GPAs in PML
+- * buffer.
+- */
+- kvm_for_each_vcpu(i, vcpu, kvm)
+- kvm_vcpu_kick(vcpu);
+-}
+-
+-static void vmx_dump_sel(char *name, uint32_t sel)
+-{
+- pr_err("%s sel=0x%04x, attr=0x%05x, limit=0x%08x, base=0x%016lx\n",
+- name, vmcs_read16(sel),
+- vmcs_read32(sel + GUEST_ES_AR_BYTES - GUEST_ES_SELECTOR),
+- vmcs_read32(sel + GUEST_ES_LIMIT - GUEST_ES_SELECTOR),
+- vmcs_readl(sel + GUEST_ES_BASE - GUEST_ES_SELECTOR));
+-}
+-
+-static void vmx_dump_dtsel(char *name, uint32_t limit)
+-{
+- pr_err("%s limit=0x%08x, base=0x%016lx\n",
+- name, vmcs_read32(limit),
+- vmcs_readl(limit + GUEST_GDTR_BASE - GUEST_GDTR_LIMIT));
+-}
+-
+-void dump_vmcs(void)
+-{
+- u32 vmentry_ctl, vmexit_ctl;
+- u32 cpu_based_exec_ctrl, pin_based_exec_ctrl, secondary_exec_control;
+- unsigned long cr4;
+- u64 efer;
+- int i, n;
+-
+- if (!dump_invalid_vmcs) {
+- pr_warn_ratelimited("set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state.\n");
+- return;
+- }
+-
+- vmentry_ctl = vmcs_read32(VM_ENTRY_CONTROLS);
+- vmexit_ctl = vmcs_read32(VM_EXIT_CONTROLS);
+- cpu_based_exec_ctrl = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
+- pin_based_exec_ctrl = vmcs_read32(PIN_BASED_VM_EXEC_CONTROL);
+- cr4 = vmcs_readl(GUEST_CR4);
+- efer = vmcs_read64(GUEST_IA32_EFER);
+- secondary_exec_control = 0;
+- if (cpu_has_secondary_exec_ctrls())
+- secondary_exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
+-
+- pr_err("*** Guest State ***\n");
+- pr_err("CR0: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n",
+- vmcs_readl(GUEST_CR0), vmcs_readl(CR0_READ_SHADOW),
+- vmcs_readl(CR0_GUEST_HOST_MASK));
+- pr_err("CR4: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n",
+- cr4, vmcs_readl(CR4_READ_SHADOW), vmcs_readl(CR4_GUEST_HOST_MASK));
+- pr_err("CR3 = 0x%016lx\n", vmcs_readl(GUEST_CR3));
+- if ((secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT) &&
+- (cr4 & X86_CR4_PAE) && !(efer & EFER_LMA))
+- {
+- pr_err("PDPTR0 = 0x%016llx PDPTR1 = 0x%016llx\n",
+- vmcs_read64(GUEST_PDPTR0), vmcs_read64(GUEST_PDPTR1));
+- pr_err("PDPTR2 = 0x%016llx PDPTR3 = 0x%016llx\n",
+- vmcs_read64(GUEST_PDPTR2), vmcs_read64(GUEST_PDPTR3));
+- }
+- pr_err("RSP = 0x%016lx RIP = 0x%016lx\n",
+- vmcs_readl(GUEST_RSP), vmcs_readl(GUEST_RIP));
+- pr_err("RFLAGS=0x%08lx DR7 = 0x%016lx\n",
+- vmcs_readl(GUEST_RFLAGS), vmcs_readl(GUEST_DR7));
+- pr_err("Sysenter RSP=%016lx CS:RIP=%04x:%016lx\n",
+- vmcs_readl(GUEST_SYSENTER_ESP),
+- vmcs_read32(GUEST_SYSENTER_CS), vmcs_readl(GUEST_SYSENTER_EIP));
+- vmx_dump_sel("CS: ", GUEST_CS_SELECTOR);
+- vmx_dump_sel("DS: ", GUEST_DS_SELECTOR);
+- vmx_dump_sel("SS: ", GUEST_SS_SELECTOR);
+- vmx_dump_sel("ES: ", GUEST_ES_SELECTOR);
+- vmx_dump_sel("FS: ", GUEST_FS_SELECTOR);
+- vmx_dump_sel("GS: ", GUEST_GS_SELECTOR);
+- vmx_dump_dtsel("GDTR:", GUEST_GDTR_LIMIT);
+- vmx_dump_sel("LDTR:", GUEST_LDTR_SELECTOR);
+- vmx_dump_dtsel("IDTR:", GUEST_IDTR_LIMIT);
+- vmx_dump_sel("TR: ", GUEST_TR_SELECTOR);
+- if ((vmexit_ctl & (VM_EXIT_SAVE_IA32_PAT | VM_EXIT_SAVE_IA32_EFER)) ||
+- (vmentry_ctl & (VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_IA32_EFER)))
+- pr_err("EFER = 0x%016llx PAT = 0x%016llx\n",
+- efer, vmcs_read64(GUEST_IA32_PAT));
+- pr_err("DebugCtl = 0x%016llx DebugExceptions = 0x%016lx\n",
+- vmcs_read64(GUEST_IA32_DEBUGCTL),
+- vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS));
+- if (cpu_has_load_perf_global_ctrl() &&
+- vmentry_ctl & VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL)
+- pr_err("PerfGlobCtl = 0x%016llx\n",
+- vmcs_read64(GUEST_IA32_PERF_GLOBAL_CTRL));
+- if (vmentry_ctl & VM_ENTRY_LOAD_BNDCFGS)
+- pr_err("BndCfgS = 0x%016llx\n", vmcs_read64(GUEST_BNDCFGS));
+- pr_err("Interruptibility = %08x ActivityState = %08x\n",
+- vmcs_read32(GUEST_INTERRUPTIBILITY_INFO),
+- vmcs_read32(GUEST_ACTIVITY_STATE));
+- if (secondary_exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY)
+- pr_err("InterruptStatus = %04x\n",
+- vmcs_read16(GUEST_INTR_STATUS));
+-
+- pr_err("*** Host State ***\n");
+- pr_err("RIP = 0x%016lx RSP = 0x%016lx\n",
+- vmcs_readl(HOST_RIP), vmcs_readl(HOST_RSP));
+- pr_err("CS=%04x SS=%04x DS=%04x ES=%04x FS=%04x GS=%04x TR=%04x\n",
+- vmcs_read16(HOST_CS_SELECTOR), vmcs_read16(HOST_SS_SELECTOR),
+- vmcs_read16(HOST_DS_SELECTOR), vmcs_read16(HOST_ES_SELECTOR),
+- vmcs_read16(HOST_FS_SELECTOR), vmcs_read16(HOST_GS_SELECTOR),
+- vmcs_read16(HOST_TR_SELECTOR));
+- pr_err("FSBase=%016lx GSBase=%016lx TRBase=%016lx\n",
+- vmcs_readl(HOST_FS_BASE), vmcs_readl(HOST_GS_BASE),
+- vmcs_readl(HOST_TR_BASE));
+- pr_err("GDTBase=%016lx IDTBase=%016lx\n",
+- vmcs_readl(HOST_GDTR_BASE), vmcs_readl(HOST_IDTR_BASE));
+- pr_err("CR0=%016lx CR3=%016lx CR4=%016lx\n",
+- vmcs_readl(HOST_CR0), vmcs_readl(HOST_CR3),
+- vmcs_readl(HOST_CR4));
+- pr_err("Sysenter RSP=%016lx CS:RIP=%04x:%016lx\n",
+- vmcs_readl(HOST_IA32_SYSENTER_ESP),
+- vmcs_read32(HOST_IA32_SYSENTER_CS),
+- vmcs_readl(HOST_IA32_SYSENTER_EIP));
+- if (vmexit_ctl & (VM_EXIT_LOAD_IA32_PAT | VM_EXIT_LOAD_IA32_EFER))
+- pr_err("EFER = 0x%016llx PAT = 0x%016llx\n",
+- vmcs_read64(HOST_IA32_EFER),
+- vmcs_read64(HOST_IA32_PAT));
+- if (cpu_has_load_perf_global_ctrl() &&
+- vmexit_ctl & VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL)
+- pr_err("PerfGlobCtl = 0x%016llx\n",
+- vmcs_read64(HOST_IA32_PERF_GLOBAL_CTRL));
+-
+- pr_err("*** Control State ***\n");
+- pr_err("PinBased=%08x CPUBased=%08x SecondaryExec=%08x\n",
+- pin_based_exec_ctrl, cpu_based_exec_ctrl, secondary_exec_control);
+- pr_err("EntryControls=%08x ExitControls=%08x\n", vmentry_ctl, vmexit_ctl);
+- pr_err("ExceptionBitmap=%08x PFECmask=%08x PFECmatch=%08x\n",
+- vmcs_read32(EXCEPTION_BITMAP),
+- vmcs_read32(PAGE_FAULT_ERROR_CODE_MASK),
+- vmcs_read32(PAGE_FAULT_ERROR_CODE_MATCH));
+- pr_err("VMEntry: intr_info=%08x errcode=%08x ilen=%08x\n",
+- vmcs_read32(VM_ENTRY_INTR_INFO_FIELD),
+- vmcs_read32(VM_ENTRY_EXCEPTION_ERROR_CODE),
+- vmcs_read32(VM_ENTRY_INSTRUCTION_LEN));
+- pr_err("VMExit: intr_info=%08x errcode=%08x ilen=%08x\n",
+- vmcs_read32(VM_EXIT_INTR_INFO),
+- vmcs_read32(VM_EXIT_INTR_ERROR_CODE),
+- vmcs_read32(VM_EXIT_INSTRUCTION_LEN));
+- pr_err(" reason=%08x qualification=%016lx\n",
+- vmcs_read32(VM_EXIT_REASON), vmcs_readl(EXIT_QUALIFICATION));
+- pr_err("IDTVectoring: info=%08x errcode=%08x\n",
+- vmcs_read32(IDT_VECTORING_INFO_FIELD),
+- vmcs_read32(IDT_VECTORING_ERROR_CODE));
+- pr_err("TSC Offset = 0x%016llx\n", vmcs_read64(TSC_OFFSET));
+- if (secondary_exec_control & SECONDARY_EXEC_TSC_SCALING)
+- pr_err("TSC Multiplier = 0x%016llx\n",
+- vmcs_read64(TSC_MULTIPLIER));
+- if (cpu_based_exec_ctrl & CPU_BASED_TPR_SHADOW) {
+- if (secondary_exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY) {
+- u16 status = vmcs_read16(GUEST_INTR_STATUS);
+- pr_err("SVI|RVI = %02x|%02x ", status >> 8, status & 0xff);
+- }
+- pr_cont("TPR Threshold = 0x%02x\n", vmcs_read32(TPR_THRESHOLD));
+- if (secondary_exec_control & SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)
+- pr_err("APIC-access addr = 0x%016llx ", vmcs_read64(APIC_ACCESS_ADDR));
+- pr_cont("virt-APIC addr = 0x%016llx\n", vmcs_read64(VIRTUAL_APIC_PAGE_ADDR));
+- }
+- if (pin_based_exec_ctrl & PIN_BASED_POSTED_INTR)
+- pr_err("PostedIntrVec = 0x%02x\n", vmcs_read16(POSTED_INTR_NV));
+- if ((secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT))
+- pr_err("EPT pointer = 0x%016llx\n", vmcs_read64(EPT_POINTER));
+- n = vmcs_read32(CR3_TARGET_COUNT);
+- for (i = 0; i + 1 < n; i += 4)
+- pr_err("CR3 target%u=%016lx target%u=%016lx\n",
+- i, vmcs_readl(CR3_TARGET_VALUE0 + i * 2),
+- i + 1, vmcs_readl(CR3_TARGET_VALUE0 + i * 2 + 2));
+- if (i < n)
+- pr_err("CR3 target%u=%016lx\n",
+- i, vmcs_readl(CR3_TARGET_VALUE0 + i * 2));
+- if (secondary_exec_control & SECONDARY_EXEC_PAUSE_LOOP_EXITING)
+- pr_err("PLE Gap=%08x Window=%08x\n",
+- vmcs_read32(PLE_GAP), vmcs_read32(PLE_WINDOW));
+- if (secondary_exec_control & SECONDARY_EXEC_ENABLE_VPID)
+- pr_err("Virtual processor ID = 0x%04x\n",
+- vmcs_read16(VIRTUAL_PROCESSOR_ID));
+-}
+-
+-/*
+- * The guest has exited. See if we can fix it or if we need userspace
+- * assistance.
+- */
+-static int vmx_handle_exit(struct kvm_vcpu *vcpu,
+- enum exit_fastpath_completion exit_fastpath)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 exit_reason = vmx->exit_reason;
+- u32 vectoring_info = vmx->idt_vectoring_info;
+-
+- trace_kvm_exit(exit_reason, vcpu, KVM_ISA_VMX);
+-
+- /*
+- * Flush logged GPAs PML buffer, this will make dirty_bitmap more
+- * updated. Another good is, in kvm_vm_ioctl_get_dirty_log, before
+- * querying dirty_bitmap, we only need to kick all vcpus out of guest
+- * mode as if vcpus is in root mode, the PML buffer must has been
+- * flushed already.
+- */
+- if (enable_pml)
+- vmx_flush_pml_buffer(vcpu);
+-
+- /* If guest state is invalid, start emulating */
+- if (vmx->emulation_required)
+- return handle_invalid_guest_state(vcpu);
+-
+- if (is_guest_mode(vcpu) && nested_vmx_exit_reflected(vcpu, exit_reason))
+- return nested_vmx_reflect_vmexit(vcpu, exit_reason);
+-
+- if (exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY) {
+- dump_vmcs();
+- vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
+- vcpu->run->fail_entry.hardware_entry_failure_reason
+- = exit_reason;
+- return 0;
+- }
+-
+- if (unlikely(vmx->fail)) {
+- dump_vmcs();
+- vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
+- vcpu->run->fail_entry.hardware_entry_failure_reason
+- = vmcs_read32(VM_INSTRUCTION_ERROR);
+- return 0;
+- }
+-
+- /*
+- * Note:
+- * Do not try to fix EXIT_REASON_EPT_MISCONFIG if it caused by
+- * delivery event since it indicates guest is accessing MMIO.
+- * The vm-exit can be triggered again after return to guest that
+- * will cause infinite loop.
+- */
+- if ((vectoring_info & VECTORING_INFO_VALID_MASK) &&
+- (exit_reason != EXIT_REASON_EXCEPTION_NMI &&
+- exit_reason != EXIT_REASON_EPT_VIOLATION &&
+- exit_reason != EXIT_REASON_PML_FULL &&
+- exit_reason != EXIT_REASON_TASK_SWITCH)) {
+- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+- vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV;
+- vcpu->run->internal.ndata = 3;
+- vcpu->run->internal.data[0] = vectoring_info;
+- vcpu->run->internal.data[1] = exit_reason;
+- vcpu->run->internal.data[2] = vcpu->arch.exit_qualification;
+- if (exit_reason == EXIT_REASON_EPT_MISCONFIG) {
+- vcpu->run->internal.ndata++;
+- vcpu->run->internal.data[3] =
+- vmcs_read64(GUEST_PHYSICAL_ADDRESS);
+- }
+- return 0;
+- }
+-
+- if (unlikely(!enable_vnmi &&
+- vmx->loaded_vmcs->soft_vnmi_blocked)) {
+- if (vmx_interrupt_allowed(vcpu)) {
+- vmx->loaded_vmcs->soft_vnmi_blocked = 0;
+- } else if (vmx->loaded_vmcs->vnmi_blocked_time > 1000000000LL &&
+- vcpu->arch.nmi_pending) {
+- /*
+- * This CPU don't support us in finding the end of an
+- * NMI-blocked window if the guest runs with IRQs
+- * disabled. So we pull the trigger after 1 s of
+- * futile waiting, but inform the user about this.
+- */
+- printk(KERN_WARNING "%s: Breaking out of NMI-blocked "
+- "state on VCPU %d after 1 s timeout\n",
+- __func__, vcpu->vcpu_id);
+- vmx->loaded_vmcs->soft_vnmi_blocked = 0;
+- }
+- }
+-
+- if (exit_fastpath == EXIT_FASTPATH_SKIP_EMUL_INS) {
+- kvm_skip_emulated_instruction(vcpu);
+- return 1;
+- } else if (exit_reason < kvm_vmx_max_exit_handlers
+- && kvm_vmx_exit_handlers[exit_reason]) {
+-#ifdef CONFIG_RETPOLINE
+- if (exit_reason == EXIT_REASON_MSR_WRITE)
+- return kvm_emulate_wrmsr(vcpu);
+- else if (exit_reason == EXIT_REASON_PREEMPTION_TIMER)
+- return handle_preemption_timer(vcpu);
+- else if (exit_reason == EXIT_REASON_INTERRUPT_WINDOW)
+- return handle_interrupt_window(vcpu);
+- else if (exit_reason == EXIT_REASON_EXTERNAL_INTERRUPT)
+- return handle_external_interrupt(vcpu);
+- else if (exit_reason == EXIT_REASON_HLT)
+- return kvm_emulate_halt(vcpu);
+- else if (exit_reason == EXIT_REASON_EPT_MISCONFIG)
+- return handle_ept_misconfig(vcpu);
+-#endif
+- return kvm_vmx_exit_handlers[exit_reason](vcpu);
+- } else {
+- vcpu_unimpl(vcpu, "vmx: unexpected exit reason 0x%x\n",
+- exit_reason);
+- dump_vmcs();
+- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+- vcpu->run->internal.suberror =
+- KVM_INTERNAL_ERROR_UNEXPECTED_EXIT_REASON;
+- vcpu->run->internal.ndata = 1;
+- vcpu->run->internal.data[0] = exit_reason;
+- return 0;
+- }
+-}
+-
+-/*
+- * Software based L1D cache flush which is used when microcode providing
+- * the cache control MSR is not loaded.
+- *
+- * The L1D cache is 32 KiB on Nehalem and later microarchitectures, but to
+- * flush it is required to read in 64 KiB because the replacement algorithm
+- * is not exactly LRU. This could be sized at runtime via topology
+- * information but as all relevant affected CPUs have 32KiB L1D cache size
+- * there is no point in doing so.
+- */
+-static void vmx_l1d_flush(struct kvm_vcpu *vcpu)
+-{
+- int size = PAGE_SIZE << L1D_CACHE_ORDER;
+-
+- /*
+- * This code is only executed when the the flush mode is 'cond' or
+- * 'always'
+- */
+- if (static_branch_likely(&vmx_l1d_flush_cond)) {
+- bool flush_l1d;
+-
+- /*
+- * Clear the per-vcpu flush bit, it gets set again
+- * either from vcpu_run() or from one of the unsafe
+- * VMEXIT handlers.
+- */
+- flush_l1d = vcpu->arch.l1tf_flush_l1d;
+- vcpu->arch.l1tf_flush_l1d = false;
+-
+- /*
+- * Clear the per-cpu flush bit, it gets set again from
+- * the interrupt handlers.
+- */
+- flush_l1d |= kvm_get_cpu_l1tf_flush_l1d();
+- kvm_clear_cpu_l1tf_flush_l1d();
+-
+- if (!flush_l1d)
+- return;
+- }
+-
+- vcpu->stat.l1d_flush++;
+-
+- if (static_cpu_has(X86_FEATURE_FLUSH_L1D)) {
+- wrmsrl(MSR_IA32_FLUSH_CMD, L1D_FLUSH);
+- return;
+- }
+-
+- asm volatile(
+- /* First ensure the pages are in the TLB */
+- "xorl %%eax, %%eax\n"
+- ".Lpopulate_tlb:\n\t"
+- "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t"
+- "addl $4096, %%eax\n\t"
+- "cmpl %%eax, %[size]\n\t"
+- "jne .Lpopulate_tlb\n\t"
+- "xorl %%eax, %%eax\n\t"
+- "cpuid\n\t"
+- /* Now fill the cache */
+- "xorl %%eax, %%eax\n"
+- ".Lfill_cache:\n"
+- "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t"
+- "addl $64, %%eax\n\t"
+- "cmpl %%eax, %[size]\n\t"
+- "jne .Lfill_cache\n\t"
+- "lfence\n"
+- :: [flush_pages] "r" (vmx_l1d_flush_pages),
+- [size] "r" (size)
+- : "eax", "ebx", "ecx", "edx");
+-}
+-
+-static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- int tpr_threshold;
+-
+- if (is_guest_mode(vcpu) &&
+- nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
+- return;
+-
+- tpr_threshold = (irr == -1 || tpr < irr) ? 0 : irr;
+- if (is_guest_mode(vcpu))
+- to_vmx(vcpu)->nested.l1_tpr_threshold = tpr_threshold;
+- else
+- vmcs_write32(TPR_THRESHOLD, tpr_threshold);
+-}
+-
+-void vmx_set_virtual_apic_mode(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 sec_exec_control;
+-
+- if (!lapic_in_kernel(vcpu))
+- return;
+-
+- if (!flexpriority_enabled &&
+- !cpu_has_vmx_virtualize_x2apic_mode())
+- return;
+-
+- /* Postpone execution until vmcs01 is the current VMCS. */
+- if (is_guest_mode(vcpu)) {
+- vmx->nested.change_vmcs01_virtual_apic_mode = true;
+- return;
+- }
+-
+- sec_exec_control = secondary_exec_controls_get(vmx);
+- sec_exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE);
+-
+- switch (kvm_get_apic_mode(vcpu)) {
+- case LAPIC_MODE_INVALID:
+- WARN_ONCE(true, "Invalid local APIC state");
+- case LAPIC_MODE_DISABLED:
+- break;
+- case LAPIC_MODE_XAPIC:
+- if (flexpriority_enabled) {
+- sec_exec_control |=
+- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+- vmx_flush_tlb(vcpu, true);
+- }
+- break;
+- case LAPIC_MODE_X2APIC:
+- if (cpu_has_vmx_virtualize_x2apic_mode())
+- sec_exec_control |=
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
+- break;
+- }
+- secondary_exec_controls_set(vmx, sec_exec_control);
+-
+- vmx_update_msr_bitmap(vcpu);
+-}
+-
+-static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa)
+-{
+- if (!is_guest_mode(vcpu)) {
+- vmcs_write64(APIC_ACCESS_ADDR, hpa);
+- vmx_flush_tlb(vcpu, true);
+- }
+-}
+-
+-static void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)
+-{
+- u16 status;
+- u8 old;
+-
+- if (max_isr == -1)
+- max_isr = 0;
+-
+- status = vmcs_read16(GUEST_INTR_STATUS);
+- old = status >> 8;
+- if (max_isr != old) {
+- status &= 0xff;
+- status |= max_isr << 8;
+- vmcs_write16(GUEST_INTR_STATUS, status);
+- }
+-}
+-
+-static void vmx_set_rvi(int vector)
+-{
+- u16 status;
+- u8 old;
+-
+- if (vector == -1)
+- vector = 0;
+-
+- status = vmcs_read16(GUEST_INTR_STATUS);
+- old = (u8)status & 0xff;
+- if ((u8)vector != old) {
+- status &= ~0xff;
+- status |= (u8)vector;
+- vmcs_write16(GUEST_INTR_STATUS, status);
+- }
+-}
+-
+-static void vmx_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr)
+-{
+- /*
+- * When running L2, updating RVI is only relevant when
+- * vmcs12 virtual-interrupt-delivery enabled.
+- * However, it can be enabled only when L1 also
+- * intercepts external-interrupts and in that case
+- * we should not update vmcs02 RVI but instead intercept
+- * interrupt. Therefore, do nothing when running L2.
+- */
+- if (!is_guest_mode(vcpu))
+- vmx_set_rvi(max_irr);
+-}
+-
+-static int vmx_sync_pir_to_irr(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int max_irr;
+- bool max_irr_updated;
+-
+- WARN_ON(!vcpu->arch.apicv_active);
+- if (pi_test_on(&vmx->pi_desc)) {
+- pi_clear_on(&vmx->pi_desc);
+- /*
+- * IOMMU can write to PID.ON, so the barrier matters even on UP.
+- * But on x86 this is just a compiler barrier anyway.
+- */
+- smp_mb__after_atomic();
+- max_irr_updated =
+- kvm_apic_update_irr(vcpu, vmx->pi_desc.pir, &max_irr);
+-
+- /*
+- * If we are running L2 and L1 has a new pending interrupt
+- * which can be injected, we should re-evaluate
+- * what should be done with this new L1 interrupt.
+- * If L1 intercepts external-interrupts, we should
+- * exit from L2 to L1. Otherwise, interrupt should be
+- * delivered directly to L2.
+- */
+- if (is_guest_mode(vcpu) && max_irr_updated) {
+- if (nested_exit_on_intr(vcpu))
+- kvm_vcpu_exiting_guest_mode(vcpu);
+- else
+- kvm_make_request(KVM_REQ_EVENT, vcpu);
+- }
+- } else {
+- max_irr = kvm_lapic_find_highest_irr(vcpu);
+- }
+- vmx_hwapic_irr_update(vcpu, max_irr);
+- return max_irr;
+-}
+-
+-static bool vmx_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
+-{
+- struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+-
+- return pi_test_on(pi_desc) ||
+- (pi_test_sn(pi_desc) && !pi_is_pir_empty(pi_desc));
+-}
+-
+-static void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
+-{
+- if (!kvm_vcpu_apicv_active(vcpu))
+- return;
+-
+- vmcs_write64(EOI_EXIT_BITMAP0, eoi_exit_bitmap[0]);
+- vmcs_write64(EOI_EXIT_BITMAP1, eoi_exit_bitmap[1]);
+- vmcs_write64(EOI_EXIT_BITMAP2, eoi_exit_bitmap[2]);
+- vmcs_write64(EOI_EXIT_BITMAP3, eoi_exit_bitmap[3]);
+-}
+-
+-static void vmx_apicv_post_state_restore(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- pi_clear_on(&vmx->pi_desc);
+- memset(vmx->pi_desc.pir, 0, sizeof(vmx->pi_desc.pir));
+-}
+-
+-static void handle_exception_nmi_irqoff(struct vcpu_vmx *vmx)
+-{
+- vmx->exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+-
+- /* if exit due to PF check for async PF */
+- if (is_page_fault(vmx->exit_intr_info))
+- vmx->vcpu.arch.apf.host_apf_reason = kvm_read_and_reset_pf_reason();
+-
+- /* Handle machine checks before interrupts are enabled */
+- if (is_machine_check(vmx->exit_intr_info))
+- kvm_machine_check();
+-
+- /* We need to handle NMIs before interrupts are enabled */
+- if (is_nmi(vmx->exit_intr_info)) {
+- kvm_before_interrupt(&vmx->vcpu);
+- asm("int $2");
+- kvm_after_interrupt(&vmx->vcpu);
+- }
+-}
+-
+-static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu)
+-{
+- unsigned int vector;
+- unsigned long entry;
+-#ifdef CONFIG_X86_64
+- unsigned long tmp;
+-#endif
+- gate_desc *desc;
+- u32 intr_info;
+-
+- intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+- if (WARN_ONCE(!is_external_intr(intr_info),
+- "KVM: unexpected VM-Exit interrupt info: 0x%x", intr_info))
+- return;
+-
+- vector = intr_info & INTR_INFO_VECTOR_MASK;
+- desc = (gate_desc *)host_idt_base + vector;
+- entry = gate_offset(desc);
+-
+- kvm_before_interrupt(vcpu);
+-
+- asm volatile(
+-#ifdef CONFIG_X86_64
+- "mov %%" _ASM_SP ", %[sp]\n\t"
+- "and $0xfffffffffffffff0, %%" _ASM_SP "\n\t"
+- "push $%c[ss]\n\t"
+- "push %[sp]\n\t"
+-#endif
+- "pushf\n\t"
+- __ASM_SIZE(push) " $%c[cs]\n\t"
+- CALL_NOSPEC
+- :
+-#ifdef CONFIG_X86_64
+- [sp]"=&r"(tmp),
+-#endif
+- ASM_CALL_CONSTRAINT
+- :
+- THUNK_TARGET(entry),
+- [ss]"i"(__KERNEL_DS),
+- [cs]"i"(__KERNEL_CS)
+- );
+-
+- kvm_after_interrupt(vcpu);
+-}
+-STACK_FRAME_NON_STANDARD(handle_external_interrupt_irqoff);
+-
+-static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu,
+- enum exit_fastpath_completion *exit_fastpath)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (vmx->exit_reason == EXIT_REASON_EXTERNAL_INTERRUPT)
+- handle_external_interrupt_irqoff(vcpu);
+- else if (vmx->exit_reason == EXIT_REASON_EXCEPTION_NMI)
+- handle_exception_nmi_irqoff(vmx);
+- else if (!is_guest_mode(vcpu) &&
+- vmx->exit_reason == EXIT_REASON_MSR_WRITE)
+- *exit_fastpath = handle_fastpath_set_msr_irqoff(vcpu);
+-}
+-
+-static bool vmx_has_emulated_msr(int index)
+-{
+- switch (index) {
+- case MSR_IA32_SMBASE:
+- /*
+- * We cannot do SMM unless we can run the guest in big
+- * real mode.
+- */
+- return enable_unrestricted_guest || emulate_invalid_guest_state;
+- case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
+- return nested;
+- case MSR_AMD64_VIRT_SPEC_CTRL:
+- /* This is AMD only. */
+- return false;
+- default:
+- return true;
+- }
+-}
+-
+-static bool vmx_pt_supported(void)
+-{
+- return pt_mode == PT_MODE_HOST_GUEST;
+-}
+-
+-static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
+-{
+- u32 exit_intr_info;
+- bool unblock_nmi;
+- u8 vector;
+- bool idtv_info_valid;
+-
+- idtv_info_valid = vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+-
+- if (enable_vnmi) {
+- if (vmx->loaded_vmcs->nmi_known_unmasked)
+- return;
+- /*
+- * Can't use vmx->exit_intr_info since we're not sure what
+- * the exit reason is.
+- */
+- exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+- unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
+- vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
+- /*
+- * SDM 3: 27.7.1.2 (September 2008)
+- * Re-set bit "block by NMI" before VM entry if vmexit caused by
+- * a guest IRET fault.
+- * SDM 3: 23.2.2 (September 2008)
+- * Bit 12 is undefined in any of the following cases:
+- * If the VM exit sets the valid bit in the IDT-vectoring
+- * information field.
+- * If the VM exit is due to a double fault.
+- */
+- if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
+- vector != DF_VECTOR && !idtv_info_valid)
+- vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+- GUEST_INTR_STATE_NMI);
+- else
+- vmx->loaded_vmcs->nmi_known_unmasked =
+- !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
+- & GUEST_INTR_STATE_NMI);
+- } else if (unlikely(vmx->loaded_vmcs->soft_vnmi_blocked))
+- vmx->loaded_vmcs->vnmi_blocked_time +=
+- ktime_to_ns(ktime_sub(ktime_get(),
+- vmx->loaded_vmcs->entry_time));
+-}
+-
+-static void __vmx_complete_interrupts(struct kvm_vcpu *vcpu,
+- u32 idt_vectoring_info,
+- int instr_len_field,
+- int error_code_field)
+-{
+- u8 vector;
+- int type;
+- bool idtv_info_valid;
+-
+- idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+-
+- vcpu->arch.nmi_injected = false;
+- kvm_clear_exception_queue(vcpu);
+- kvm_clear_interrupt_queue(vcpu);
+-
+- if (!idtv_info_valid)
+- return;
+-
+- kvm_make_request(KVM_REQ_EVENT, vcpu);
+-
+- vector = idt_vectoring_info & VECTORING_INFO_VECTOR_MASK;
+- type = idt_vectoring_info & VECTORING_INFO_TYPE_MASK;
+-
+- switch (type) {
+- case INTR_TYPE_NMI_INTR:
+- vcpu->arch.nmi_injected = true;
+- /*
+- * SDM 3: 27.7.1.2 (September 2008)
+- * Clear bit "block by NMI" before VM entry if a NMI
+- * delivery faulted.
+- */
+- vmx_set_nmi_mask(vcpu, false);
+- break;
+- case INTR_TYPE_SOFT_EXCEPTION:
+- vcpu->arch.event_exit_inst_len = vmcs_read32(instr_len_field);
+- /* fall through */
+- case INTR_TYPE_HARD_EXCEPTION:
+- if (idt_vectoring_info & VECTORING_INFO_DELIVER_CODE_MASK) {
+- u32 err = vmcs_read32(error_code_field);
+- kvm_requeue_exception_e(vcpu, vector, err);
+- } else
+- kvm_requeue_exception(vcpu, vector);
+- break;
+- case INTR_TYPE_SOFT_INTR:
+- vcpu->arch.event_exit_inst_len = vmcs_read32(instr_len_field);
+- /* fall through */
+- case INTR_TYPE_EXT_INTR:
+- kvm_queue_interrupt(vcpu, vector, type == INTR_TYPE_SOFT_INTR);
+- break;
+- default:
+- break;
+- }
+-}
+-
+-static void vmx_complete_interrupts(struct vcpu_vmx *vmx)
+-{
+- __vmx_complete_interrupts(&vmx->vcpu, vmx->idt_vectoring_info,
+- VM_EXIT_INSTRUCTION_LEN,
+- IDT_VECTORING_ERROR_CODE);
+-}
+-
+-static void vmx_cancel_injection(struct kvm_vcpu *vcpu)
+-{
+- __vmx_complete_interrupts(vcpu,
+- vmcs_read32(VM_ENTRY_INTR_INFO_FIELD),
+- VM_ENTRY_INSTRUCTION_LEN,
+- VM_ENTRY_EXCEPTION_ERROR_CODE);
+-
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0);
+-}
+-
+-static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx)
+-{
+- int i, nr_msrs;
+- struct perf_guest_switch_msr *msrs;
+-
+- msrs = perf_guest_get_msrs(&nr_msrs);
+-
+- if (!msrs)
+- return;
+-
+- for (i = 0; i < nr_msrs; i++)
+- if (msrs[i].host == msrs[i].guest)
+- clear_atomic_switch_msr(vmx, msrs[i].msr);
+- else
+- add_atomic_switch_msr(vmx, msrs[i].msr, msrs[i].guest,
+- msrs[i].host, false);
+-}
+-
+-static void atomic_switch_umwait_control_msr(struct vcpu_vmx *vmx)
+-{
+- u32 host_umwait_control;
+-
+- if (!vmx_has_waitpkg(vmx))
+- return;
+-
+- host_umwait_control = get_umwait_control_msr();
+-
+- if (vmx->msr_ia32_umwait_control != host_umwait_control)
+- add_atomic_switch_msr(vmx, MSR_IA32_UMWAIT_CONTROL,
+- vmx->msr_ia32_umwait_control,
+- host_umwait_control, false);
+- else
+- clear_atomic_switch_msr(vmx, MSR_IA32_UMWAIT_CONTROL);
+-}
+-
+-static void vmx_update_hv_timer(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u64 tscl;
+- u32 delta_tsc;
+-
+- if (vmx->req_immediate_exit) {
+- vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, 0);
+- vmx->loaded_vmcs->hv_timer_soft_disabled = false;
+- } else if (vmx->hv_deadline_tsc != -1) {
+- tscl = rdtsc();
+- if (vmx->hv_deadline_tsc > tscl)
+- /* set_hv_timer ensures the delta fits in 32-bits */
+- delta_tsc = (u32)((vmx->hv_deadline_tsc - tscl) >>
+- cpu_preemption_timer_multi);
+- else
+- delta_tsc = 0;
+-
+- vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, delta_tsc);
+- vmx->loaded_vmcs->hv_timer_soft_disabled = false;
+- } else if (!vmx->loaded_vmcs->hv_timer_soft_disabled) {
+- vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, -1);
+- vmx->loaded_vmcs->hv_timer_soft_disabled = true;
+- }
+-}
+-
+-void vmx_update_host_rsp(struct vcpu_vmx *vmx, unsigned long host_rsp)
+-{
+- if (unlikely(host_rsp != vmx->loaded_vmcs->host_state.rsp)) {
+- vmx->loaded_vmcs->host_state.rsp = host_rsp;
+- vmcs_writel(HOST_RSP, host_rsp);
+- }
+-}
+-
+-bool __vmx_vcpu_run(struct vcpu_vmx *vmx, unsigned long *regs, bool launched);
+-
+-static void vmx_vcpu_run(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long cr3, cr4;
+-
+- /* Record the guest's net vcpu time for enforced NMI injections. */
+- if (unlikely(!enable_vnmi &&
+- vmx->loaded_vmcs->soft_vnmi_blocked))
+- vmx->loaded_vmcs->entry_time = ktime_get();
+-
+- /* Don't enter VMX if guest state is invalid, let the exit handler
+- start emulation until we arrive back to a valid state */
+- if (vmx->emulation_required)
+- return;
+-
+- if (vmx->ple_window_dirty) {
+- vmx->ple_window_dirty = false;
+- vmcs_write32(PLE_WINDOW, vmx->ple_window);
+- }
+-
+- if (vmx->nested.need_vmcs12_to_shadow_sync)
+- nested_sync_vmcs12_to_shadow(vcpu);
+-
+- if (kvm_register_is_dirty(vcpu, VCPU_REGS_RSP))
+- vmcs_writel(GUEST_RSP, vcpu->arch.regs[VCPU_REGS_RSP]);
+- if (kvm_register_is_dirty(vcpu, VCPU_REGS_RIP))
+- vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
+-
+- cr3 = __get_current_cr3_fast();
+- if (unlikely(cr3 != vmx->loaded_vmcs->host_state.cr3)) {
+- vmcs_writel(HOST_CR3, cr3);
+- vmx->loaded_vmcs->host_state.cr3 = cr3;
+- }
+-
+- cr4 = cr4_read_shadow();
+- if (unlikely(cr4 != vmx->loaded_vmcs->host_state.cr4)) {
+- vmcs_writel(HOST_CR4, cr4);
+- vmx->loaded_vmcs->host_state.cr4 = cr4;
+- }
+-
+- /* When single-stepping over STI and MOV SS, we must clear the
+- * corresponding interruptibility bits in the guest state. Otherwise
+- * vmentry fails as it then expects bit 14 (BS) in pending debug
+- * exceptions being set, but that's not correct for the guest debugging
+- * case. */
+- if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
+- vmx_set_interrupt_shadow(vcpu, 0);
+-
+- kvm_load_guest_xsave_state(vcpu);
+-
+- if (static_cpu_has(X86_FEATURE_PKU) &&
+- kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
+- vcpu->arch.pkru != vmx->host_pkru)
+- __write_pkru(vcpu->arch.pkru);
+-
+- pt_guest_enter(vmx);
+-
+- atomic_switch_perf_msrs(vmx);
+- atomic_switch_umwait_control_msr(vmx);
+-
+- if (enable_preemption_timer)
+- vmx_update_hv_timer(vcpu);
+-
+- if (lapic_in_kernel(vcpu) &&
+- vcpu->arch.apic->lapic_timer.timer_advance_ns)
+- kvm_wait_lapic_expire(vcpu);
+-
+- /*
+- * If this vCPU has touched SPEC_CTRL, restore the guest's value if
+- * it's non-zero. Since vmentry is serialising on affected CPUs, there
+- * is no need to worry about the conditional branch over the wrmsr
+- * being speculatively taken.
+- */
+- x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
+-
+- /* L1D Flush includes CPU buffer clear to mitigate MDS */
+- if (static_branch_unlikely(&vmx_l1d_should_flush))
+- vmx_l1d_flush(vcpu);
+- else if (static_branch_unlikely(&mds_user_clear))
+- mds_clear_cpu_buffers();
+-
+- if (vcpu->arch.cr2 != read_cr2())
+- write_cr2(vcpu->arch.cr2);
+-
+- vmx->fail = __vmx_vcpu_run(vmx, (unsigned long *)&vcpu->arch.regs,
+- vmx->loaded_vmcs->launched);
+-
+- vcpu->arch.cr2 = read_cr2();
+-
+- /*
+- * We do not use IBRS in the kernel. If this vCPU has used the
+- * SPEC_CTRL MSR it may have left it on; save the value and
+- * turn it off. This is much more efficient than blindly adding
+- * it to the atomic save/restore list. Especially as the former
+- * (Saving guest MSRs on vmexit) doesn't even exist in KVM.
+- *
+- * For non-nested case:
+- * If the L01 MSR bitmap does not intercept the MSR, then we need to
+- * save it.
+- *
+- * For nested case:
+- * If the L02 MSR bitmap does not intercept the MSR, then we need to
+- * save it.
+- */
+- if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)))
+- vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL);
+-
+- x86_spec_ctrl_restore_host(vmx->spec_ctrl, 0);
+-
+- /* All fields are clean at this point */
+- if (static_branch_unlikely(&enable_evmcs))
+- current_evmcs->hv_clean_fields |=
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL;
+-
+- if (static_branch_unlikely(&enable_evmcs))
+- current_evmcs->hv_vp_id = vcpu->arch.hyperv.vp_index;
+-
+- /* MSR_IA32_DEBUGCTLMSR is zeroed on vmexit. Restore it if needed */
+- if (vmx->host_debugctlmsr)
+- update_debugctlmsr(vmx->host_debugctlmsr);
+-
+-#ifndef CONFIG_X86_64
+- /*
+- * The sysexit path does not restore ds/es, so we must set them to
+- * a reasonable value ourselves.
+- *
+- * We can't defer this to vmx_prepare_switch_to_host() since that
+- * function may be executed in interrupt context, which saves and
+- * restore segments around it, nullifying its effect.
+- */
+- loadsegment(ds, __USER_DS);
+- loadsegment(es, __USER_DS);
+-#endif
+-
+- vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
+- | (1 << VCPU_EXREG_RFLAGS)
+- | (1 << VCPU_EXREG_PDPTR)
+- | (1 << VCPU_EXREG_SEGMENTS)
+- | (1 << VCPU_EXREG_CR3));
+- vcpu->arch.regs_dirty = 0;
+-
+- pt_guest_exit(vmx);
+-
+- /*
+- * eager fpu is enabled if PKEY is supported and CR4 is switched
+- * back on host, so it is safe to read guest PKRU from current
+- * XSAVE.
+- */
+- if (static_cpu_has(X86_FEATURE_PKU) &&
+- kvm_read_cr4_bits(vcpu, X86_CR4_PKE)) {
+- vcpu->arch.pkru = rdpkru();
+- if (vcpu->arch.pkru != vmx->host_pkru)
+- __write_pkru(vmx->host_pkru);
+- }
+-
+- kvm_load_host_xsave_state(vcpu);
+-
+- vmx->nested.nested_run_pending = 0;
+- vmx->idt_vectoring_info = 0;
+-
+- vmx->exit_reason = vmx->fail ? 0xdead : vmcs_read32(VM_EXIT_REASON);
+- if ((u16)vmx->exit_reason == EXIT_REASON_MCE_DURING_VMENTRY)
+- kvm_machine_check();
+-
+- if (vmx->fail || (vmx->exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY))
+- return;
+-
+- vmx->loaded_vmcs->launched = 1;
+- vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
+-
+- vmx_recover_nmi_blocking(vmx);
+- vmx_complete_interrupts(vmx);
+-}
+-
+-static struct kvm *vmx_vm_alloc(void)
+-{
+- struct kvm_vmx *kvm_vmx = __vmalloc(sizeof(struct kvm_vmx),
+- GFP_KERNEL_ACCOUNT | __GFP_ZERO,
+- PAGE_KERNEL);
+- return &kvm_vmx->kvm;
+-}
+-
+-static void vmx_vm_free(struct kvm *kvm)
+-{
+- kfree(kvm->arch.hyperv.hv_pa_pg);
+- vfree(to_kvm_vmx(kvm));
+-}
+-
+-static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (enable_pml)
+- vmx_destroy_pml_buffer(vmx);
+- free_vpid(vmx->vpid);
+- nested_vmx_free_vcpu(vcpu);
+- free_loaded_vmcs(vmx->loaded_vmcs);
+- kvm_vcpu_uninit(vcpu);
+- kmem_cache_free(x86_fpu_cache, vmx->vcpu.arch.user_fpu);
+- kmem_cache_free(x86_fpu_cache, vmx->vcpu.arch.guest_fpu);
+- kmem_cache_free(kvm_vcpu_cache, vmx);
+-}
+-
+-static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
+-{
+- int err;
+- struct vcpu_vmx *vmx;
+- unsigned long *msr_bitmap;
+- int i, cpu;
+-
+- BUILD_BUG_ON_MSG(offsetof(struct vcpu_vmx, vcpu) != 0,
+- "struct kvm_vcpu must be at offset 0 for arch usercopy region");
+-
+- vmx = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL_ACCOUNT);
+- if (!vmx)
+- return ERR_PTR(-ENOMEM);
+-
+- vmx->vcpu.arch.user_fpu = kmem_cache_zalloc(x86_fpu_cache,
+- GFP_KERNEL_ACCOUNT);
+- if (!vmx->vcpu.arch.user_fpu) {
+- printk(KERN_ERR "kvm: failed to allocate kvm userspace's fpu\n");
+- err = -ENOMEM;
+- goto free_partial_vcpu;
+- }
+-
+- vmx->vcpu.arch.guest_fpu = kmem_cache_zalloc(x86_fpu_cache,
+- GFP_KERNEL_ACCOUNT);
+- if (!vmx->vcpu.arch.guest_fpu) {
+- printk(KERN_ERR "kvm: failed to allocate vcpu's fpu\n");
+- err = -ENOMEM;
+- goto free_user_fpu;
+- }
+-
+- vmx->vpid = allocate_vpid();
+-
+- err = kvm_vcpu_init(&vmx->vcpu, kvm, id);
+- if (err)
+- goto free_vcpu;
+-
+- err = -ENOMEM;
+-
+- /*
+- * If PML is turned on, failure on enabling PML just results in failure
+- * of creating the vcpu, therefore we can simplify PML logic (by
+- * avoiding dealing with cases, such as enabling PML partially on vcpus
+- * for the guest), etc.
+- */
+- if (enable_pml) {
+- vmx->pml_pg = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
+- if (!vmx->pml_pg)
+- goto uninit_vcpu;
+- }
+-
+- BUILD_BUG_ON(ARRAY_SIZE(vmx_msr_index) != NR_SHARED_MSRS);
+-
+- for (i = 0; i < ARRAY_SIZE(vmx_msr_index); ++i) {
+- u32 index = vmx_msr_index[i];
+- u32 data_low, data_high;
+- int j = vmx->nmsrs;
+-
+- if (rdmsr_safe(index, &data_low, &data_high) < 0)
+- continue;
+- if (wrmsr_safe(index, data_low, data_high) < 0)
+- continue;
+-
+- vmx->guest_msrs[j].index = i;
+- vmx->guest_msrs[j].data = 0;
+- switch (index) {
+- case MSR_IA32_TSX_CTRL:
+- /*
+- * No need to pass TSX_CTRL_CPUID_CLEAR through, so
+- * let's avoid changing CPUID bits under the host
+- * kernel's feet.
+- */
+- vmx->guest_msrs[j].mask = ~(u64)TSX_CTRL_CPUID_CLEAR;
+- break;
+- default:
+- vmx->guest_msrs[j].mask = -1ull;
+- break;
+- }
+- ++vmx->nmsrs;
+- }
+-
+- err = alloc_loaded_vmcs(&vmx->vmcs01);
+- if (err < 0)
+- goto free_pml;
+-
+- msr_bitmap = vmx->vmcs01.msr_bitmap;
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_TSC, MSR_TYPE_R);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_FS_BASE, MSR_TYPE_RW);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_GS_BASE, MSR_TYPE_RW);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_KERNEL_GS_BASE, MSR_TYPE_RW);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_CS, MSR_TYPE_RW);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_ESP, MSR_TYPE_RW);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_EIP, MSR_TYPE_RW);
+- if (kvm_cstate_in_guest(kvm)) {
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_CORE_C1_RES, MSR_TYPE_R);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_CORE_C3_RESIDENCY, MSR_TYPE_R);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_CORE_C6_RESIDENCY, MSR_TYPE_R);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_CORE_C7_RESIDENCY, MSR_TYPE_R);
+- }
+- vmx->msr_bitmap_mode = 0;
+-
+- vmx->loaded_vmcs = &vmx->vmcs01;
+- cpu = get_cpu();
+- vmx_vcpu_load(&vmx->vcpu, cpu);
+- vmx->vcpu.cpu = cpu;
+- init_vmcs(vmx);
+- vmx_vcpu_put(&vmx->vcpu);
+- put_cpu();
+- if (cpu_need_virtualize_apic_accesses(&vmx->vcpu)) {
+- err = alloc_apic_access_page(kvm);
+- if (err)
+- goto free_vmcs;
+- }
+-
+- if (enable_ept && !enable_unrestricted_guest) {
+- err = init_rmode_identity_map(kvm);
+- if (err)
+- goto free_vmcs;
+- }
+-
+- if (nested)
+- nested_vmx_setup_ctls_msrs(&vmx->nested.msrs,
+- vmx_capability.ept,
+- kvm_vcpu_apicv_active(&vmx->vcpu));
+- else
+- memset(&vmx->nested.msrs, 0, sizeof(vmx->nested.msrs));
+-
+- vmx->nested.posted_intr_nv = -1;
+- vmx->nested.current_vmptr = -1ull;
+-
+- vmx->msr_ia32_feature_control_valid_bits = FEATURE_CONTROL_LOCKED;
+-
+- /*
+- * Enforce invariant: pi_desc.nv is always either POSTED_INTR_VECTOR
+- * or POSTED_INTR_WAKEUP_VECTOR.
+- */
+- vmx->pi_desc.nv = POSTED_INTR_VECTOR;
+- vmx->pi_desc.sn = 1;
+-
+- vmx->ept_pointer = INVALID_PAGE;
+-
+- return &vmx->vcpu;
+-
+-free_vmcs:
+- free_loaded_vmcs(vmx->loaded_vmcs);
+-free_pml:
+- vmx_destroy_pml_buffer(vmx);
+-uninit_vcpu:
+- kvm_vcpu_uninit(&vmx->vcpu);
+-free_vcpu:
+- free_vpid(vmx->vpid);
+- kmem_cache_free(x86_fpu_cache, vmx->vcpu.arch.guest_fpu);
+-free_user_fpu:
+- kmem_cache_free(x86_fpu_cache, vmx->vcpu.arch.user_fpu);
+-free_partial_vcpu:
+- kmem_cache_free(kvm_vcpu_cache, vmx);
+- return ERR_PTR(err);
+-}
+-
+-#define L1TF_MSG_SMT "L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
+-#define L1TF_MSG_L1D "L1TF CPU bug present and virtualization mitigation disabled, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
+-
+-static int vmx_vm_init(struct kvm *kvm)
+-{
+- spin_lock_init(&to_kvm_vmx(kvm)->ept_pointer_lock);
+-
+- if (!ple_gap)
+- kvm->arch.pause_in_guest = true;
+-
+- if (boot_cpu_has(X86_BUG_L1TF) && enable_ept) {
+- switch (l1tf_mitigation) {
+- case L1TF_MITIGATION_OFF:
+- case L1TF_MITIGATION_FLUSH_NOWARN:
+- /* 'I explicitly don't care' is set */
+- break;
+- case L1TF_MITIGATION_FLUSH:
+- case L1TF_MITIGATION_FLUSH_NOSMT:
+- case L1TF_MITIGATION_FULL:
+- /*
+- * Warn upon starting the first VM in a potentially
+- * insecure environment.
+- */
+- if (sched_smt_active())
+- pr_warn_once(L1TF_MSG_SMT);
+- if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER)
+- pr_warn_once(L1TF_MSG_L1D);
+- break;
+- case L1TF_MITIGATION_FULL_FORCE:
+- /* Flush is enforced */
+- break;
+- }
+- }
+- return 0;
+-}
+-
+-static int __init vmx_check_processor_compat(void)
+-{
+- struct vmcs_config vmcs_conf;
+- struct vmx_capability vmx_cap;
+-
+- if (setup_vmcs_config(&vmcs_conf, &vmx_cap) < 0)
+- return -EIO;
+- if (nested)
+- nested_vmx_setup_ctls_msrs(&vmcs_conf.nested, vmx_cap.ept,
+- enable_apicv);
+- if (memcmp(&vmcs_config, &vmcs_conf, sizeof(struct vmcs_config)) != 0) {
+- printk(KERN_ERR "kvm: CPU %d feature inconsistency!\n",
+- smp_processor_id());
+- return -EIO;
+- }
+- return 0;
+-}
+-
+-static u64 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
+-{
+- u8 cache;
+- u64 ipat = 0;
+-
+- /* For VT-d and EPT combination
+- * 1. MMIO: always map as UC
+- * 2. EPT with VT-d:
+- * a. VT-d without snooping control feature: can't guarantee the
+- * result, try to trust guest.
+- * b. VT-d with snooping control feature: snooping control feature of
+- * VT-d engine can guarantee the cache correctness. Just set it
+- * to WB to keep consistent with host. So the same as item 3.
+- * 3. EPT without VT-d: always map as WB and set IPAT=1 to keep
+- * consistent with host MTRR
+- */
+- if (is_mmio) {
+- cache = MTRR_TYPE_UNCACHABLE;
+- goto exit;
+- }
+-
+- if (!kvm_arch_has_noncoherent_dma(vcpu->kvm)) {
+- ipat = VMX_EPT_IPAT_BIT;
+- cache = MTRR_TYPE_WRBACK;
+- goto exit;
+- }
+-
+- if (kvm_read_cr0(vcpu) & X86_CR0_CD) {
+- ipat = VMX_EPT_IPAT_BIT;
+- if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
+- cache = MTRR_TYPE_WRBACK;
+- else
+- cache = MTRR_TYPE_UNCACHABLE;
+- goto exit;
+- }
+-
+- cache = kvm_mtrr_get_guest_memory_type(vcpu, gfn);
+-
+-exit:
+- return (cache << VMX_EPT_MT_EPTE_SHIFT) | ipat;
+-}
+-
+-static int vmx_get_lpage_level(void)
+-{
+- if (enable_ept && !cpu_has_vmx_ept_1g_page())
+- return PT_DIRECTORY_LEVEL;
+- else
+- /* For shadow and EPT supported 1GB page */
+- return PT_PDPE_LEVEL;
+-}
+-
+-static void vmcs_set_secondary_exec_control(struct vcpu_vmx *vmx)
+-{
+- /*
+- * These bits in the secondary execution controls field
+- * are dynamic, the others are mostly based on the hypervisor
+- * architecture and the guest's CPUID. Do not touch the
+- * dynamic bits.
+- */
+- u32 mask =
+- SECONDARY_EXEC_SHADOW_VMCS |
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
+- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+- SECONDARY_EXEC_DESC;
+-
+- u32 new_ctl = vmx->secondary_exec_control;
+- u32 cur_ctl = secondary_exec_controls_get(vmx);
+-
+- secondary_exec_controls_set(vmx, (new_ctl & ~mask) | (cur_ctl & mask));
+-}
+-
+-/*
+- * Generate MSR_IA32_VMX_CR{0,4}_FIXED1 according to CPUID. Only set bits
+- * (indicating "allowed-1") if they are supported in the guest's CPUID.
+- */
+-static void nested_vmx_cr_fixed1_bits_update(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct kvm_cpuid_entry2 *entry;
+-
+- vmx->nested.msrs.cr0_fixed1 = 0xffffffff;
+- vmx->nested.msrs.cr4_fixed1 = X86_CR4_PCE;
+-
+-#define cr4_fixed1_update(_cr4_mask, _reg, _cpuid_mask) do { \
+- if (entry && (entry->_reg & (_cpuid_mask))) \
+- vmx->nested.msrs.cr4_fixed1 |= (_cr4_mask); \
+-} while (0)
+-
+- entry = kvm_find_cpuid_entry(vcpu, 0x1, 0);
+- cr4_fixed1_update(X86_CR4_VME, edx, bit(X86_FEATURE_VME));
+- cr4_fixed1_update(X86_CR4_PVI, edx, bit(X86_FEATURE_VME));
+- cr4_fixed1_update(X86_CR4_TSD, edx, bit(X86_FEATURE_TSC));
+- cr4_fixed1_update(X86_CR4_DE, edx, bit(X86_FEATURE_DE));
+- cr4_fixed1_update(X86_CR4_PSE, edx, bit(X86_FEATURE_PSE));
+- cr4_fixed1_update(X86_CR4_PAE, edx, bit(X86_FEATURE_PAE));
+- cr4_fixed1_update(X86_CR4_MCE, edx, bit(X86_FEATURE_MCE));
+- cr4_fixed1_update(X86_CR4_PGE, edx, bit(X86_FEATURE_PGE));
+- cr4_fixed1_update(X86_CR4_OSFXSR, edx, bit(X86_FEATURE_FXSR));
+- cr4_fixed1_update(X86_CR4_OSXMMEXCPT, edx, bit(X86_FEATURE_XMM));
+- cr4_fixed1_update(X86_CR4_VMXE, ecx, bit(X86_FEATURE_VMX));
+- cr4_fixed1_update(X86_CR4_SMXE, ecx, bit(X86_FEATURE_SMX));
+- cr4_fixed1_update(X86_CR4_PCIDE, ecx, bit(X86_FEATURE_PCID));
+- cr4_fixed1_update(X86_CR4_OSXSAVE, ecx, bit(X86_FEATURE_XSAVE));
+-
+- entry = kvm_find_cpuid_entry(vcpu, 0x7, 0);
+- cr4_fixed1_update(X86_CR4_FSGSBASE, ebx, bit(X86_FEATURE_FSGSBASE));
+- cr4_fixed1_update(X86_CR4_SMEP, ebx, bit(X86_FEATURE_SMEP));
+- cr4_fixed1_update(X86_CR4_SMAP, ebx, bit(X86_FEATURE_SMAP));
+- cr4_fixed1_update(X86_CR4_PKE, ecx, bit(X86_FEATURE_PKU));
+- cr4_fixed1_update(X86_CR4_UMIP, ecx, bit(X86_FEATURE_UMIP));
+- cr4_fixed1_update(X86_CR4_LA57, ecx, bit(X86_FEATURE_LA57));
+-
+-#undef cr4_fixed1_update
+-}
+-
+-static void nested_vmx_entry_exit_ctls_update(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (kvm_mpx_supported()) {
+- bool mpx_enabled = guest_cpuid_has(vcpu, X86_FEATURE_MPX);
+-
+- if (mpx_enabled) {
+- vmx->nested.msrs.entry_ctls_high |= VM_ENTRY_LOAD_BNDCFGS;
+- vmx->nested.msrs.exit_ctls_high |= VM_EXIT_CLEAR_BNDCFGS;
+- } else {
+- vmx->nested.msrs.entry_ctls_high &= ~VM_ENTRY_LOAD_BNDCFGS;
+- vmx->nested.msrs.exit_ctls_high &= ~VM_EXIT_CLEAR_BNDCFGS;
+- }
+- }
+-}
+-
+-static void update_intel_pt_cfg(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct kvm_cpuid_entry2 *best = NULL;
+- int i;
+-
+- for (i = 0; i < PT_CPUID_LEAVES; i++) {
+- best = kvm_find_cpuid_entry(vcpu, 0x14, i);
+- if (!best)
+- return;
+- vmx->pt_desc.caps[CPUID_EAX + i*PT_CPUID_REGS_NUM] = best->eax;
+- vmx->pt_desc.caps[CPUID_EBX + i*PT_CPUID_REGS_NUM] = best->ebx;
+- vmx->pt_desc.caps[CPUID_ECX + i*PT_CPUID_REGS_NUM] = best->ecx;
+- vmx->pt_desc.caps[CPUID_EDX + i*PT_CPUID_REGS_NUM] = best->edx;
+- }
+-
+- /* Get the number of configurable Address Ranges for filtering */
+- vmx->pt_desc.addr_range = intel_pt_validate_cap(vmx->pt_desc.caps,
+- PT_CAP_num_address_ranges);
+-
+- /* Initialize and clear the no dependency bits */
+- vmx->pt_desc.ctl_bitmask = ~(RTIT_CTL_TRACEEN | RTIT_CTL_OS |
+- RTIT_CTL_USR | RTIT_CTL_TSC_EN | RTIT_CTL_DISRETC);
+-
+- /*
+- * If CPUID.(EAX=14H,ECX=0):EBX[0]=1 CR3Filter can be set otherwise
+- * will inject an #GP
+- */
+- if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_cr3_filtering))
+- vmx->pt_desc.ctl_bitmask &= ~RTIT_CTL_CR3EN;
+-
+- /*
+- * If CPUID.(EAX=14H,ECX=0):EBX[1]=1 CYCEn, CycThresh and
+- * PSBFreq can be set
+- */
+- if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_psb_cyc))
+- vmx->pt_desc.ctl_bitmask &= ~(RTIT_CTL_CYCLEACC |
+- RTIT_CTL_CYC_THRESH | RTIT_CTL_PSB_FREQ);
+-
+- /*
+- * If CPUID.(EAX=14H,ECX=0):EBX[3]=1 MTCEn BranchEn and
+- * MTCFreq can be set
+- */
+- if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_mtc))
+- vmx->pt_desc.ctl_bitmask &= ~(RTIT_CTL_MTC_EN |
+- RTIT_CTL_BRANCH_EN | RTIT_CTL_MTC_RANGE);
+-
+- /* If CPUID.(EAX=14H,ECX=0):EBX[4]=1 FUPonPTW and PTWEn can be set */
+- if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_ptwrite))
+- vmx->pt_desc.ctl_bitmask &= ~(RTIT_CTL_FUP_ON_PTW |
+- RTIT_CTL_PTW_EN);
+-
+- /* If CPUID.(EAX=14H,ECX=0):EBX[5]=1 PwrEvEn can be set */
+- if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_power_event_trace))
+- vmx->pt_desc.ctl_bitmask &= ~RTIT_CTL_PWR_EVT_EN;
+-
+- /* If CPUID.(EAX=14H,ECX=0):ECX[0]=1 ToPA can be set */
+- if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_topa_output))
+- vmx->pt_desc.ctl_bitmask &= ~RTIT_CTL_TOPA;
+-
+- /* If CPUID.(EAX=14H,ECX=0):ECX[3]=1 FabircEn can be set */
+- if (intel_pt_validate_cap(vmx->pt_desc.caps, PT_CAP_output_subsys))
+- vmx->pt_desc.ctl_bitmask &= ~RTIT_CTL_FABRIC_EN;
+-
+- /* unmask address range configure area */
+- for (i = 0; i < vmx->pt_desc.addr_range; i++)
+- vmx->pt_desc.ctl_bitmask &= ~(0xfULL << (32 + i * 4));
+-}
+-
+-static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- /* xsaves_enabled is recomputed in vmx_compute_secondary_exec_control(). */
+- vcpu->arch.xsaves_enabled = false;
+-
+- if (cpu_has_secondary_exec_ctrls()) {
+- vmx_compute_secondary_exec_control(vmx);
+- vmcs_set_secondary_exec_control(vmx);
+- }
+-
+- if (nested_vmx_allowed(vcpu))
+- to_vmx(vcpu)->msr_ia32_feature_control_valid_bits |=
+- FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX |
+- FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
+- else
+- to_vmx(vcpu)->msr_ia32_feature_control_valid_bits &=
+- ~(FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX |
+- FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX);
+-
+- if (nested_vmx_allowed(vcpu)) {
+- nested_vmx_cr_fixed1_bits_update(vcpu);
+- nested_vmx_entry_exit_ctls_update(vcpu);
+- }
+-
+- if (boot_cpu_has(X86_FEATURE_INTEL_PT) &&
+- guest_cpuid_has(vcpu, X86_FEATURE_INTEL_PT))
+- update_intel_pt_cfg(vcpu);
+-
+- if (boot_cpu_has(X86_FEATURE_RTM)) {
+- struct shared_msr_entry *msr;
+- msr = find_msr_entry(vmx, MSR_IA32_TSX_CTRL);
+- if (msr) {
+- bool enabled = guest_cpuid_has(vcpu, X86_FEATURE_RTM);
+- vmx_set_guest_msr(vmx, msr, enabled ? 0 : TSX_CTRL_RTM_DISABLE);
+- }
+- }
+-}
+-
+-static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
+-{
+- if (func == 1 && nested)
+- entry->ecx |= bit(X86_FEATURE_VMX);
+-}
+-
+-static void vmx_request_immediate_exit(struct kvm_vcpu *vcpu)
+-{
+- to_vmx(vcpu)->req_immediate_exit = true;
+-}
+-
+-static int vmx_check_intercept(struct kvm_vcpu *vcpu,
+- struct x86_instruction_info *info,
+- enum x86_intercept_stage stage)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- struct x86_emulate_ctxt *ctxt = &vcpu->arch.emulate_ctxt;
+-
+- /*
+- * RDPID causes #UD if disabled through secondary execution controls.
+- * Because it is marked as EmulateOnUD, we need to intercept it here.
+- */
+- if (info->intercept == x86_intercept_rdtscp &&
+- !nested_cpu_has2(vmcs12, SECONDARY_EXEC_RDTSCP)) {
+- ctxt->exception.vector = UD_VECTOR;
+- ctxt->exception.error_code_valid = false;
+- return X86EMUL_PROPAGATE_FAULT;
+- }
+-
+- /* TODO: check more intercepts... */
+- return X86EMUL_CONTINUE;
+-}
+-
+-#ifdef CONFIG_X86_64
+-/* (a << shift) / divisor, return 1 if overflow otherwise 0 */
+-static inline int u64_shl_div_u64(u64 a, unsigned int shift,
+- u64 divisor, u64 *result)
+-{
+- u64 low = a << shift, high = a >> (64 - shift);
+-
+- /* To avoid the overflow on divq */
+- if (high >= divisor)
+- return 1;
+-
+- /* Low hold the result, high hold rem which is discarded */
+- asm("divq %2\n\t" : "=a" (low), "=d" (high) :
+- "rm" (divisor), "0" (low), "1" (high));
+- *result = low;
+-
+- return 0;
+-}
+-
+-static int vmx_set_hv_timer(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc,
+- bool *expired)
+-{
+- struct vcpu_vmx *vmx;
+- u64 tscl, guest_tscl, delta_tsc, lapic_timer_advance_cycles;
+- struct kvm_timer *ktimer = &vcpu->arch.apic->lapic_timer;
+-
+- if (kvm_mwait_in_guest(vcpu->kvm) ||
+- kvm_can_post_timer_interrupt(vcpu))
+- return -EOPNOTSUPP;
+-
+- vmx = to_vmx(vcpu);
+- tscl = rdtsc();
+- guest_tscl = kvm_read_l1_tsc(vcpu, tscl);
+- delta_tsc = max(guest_deadline_tsc, guest_tscl) - guest_tscl;
+- lapic_timer_advance_cycles = nsec_to_cycles(vcpu,
+- ktimer->timer_advance_ns);
+-
+- if (delta_tsc > lapic_timer_advance_cycles)
+- delta_tsc -= lapic_timer_advance_cycles;
+- else
+- delta_tsc = 0;
+-
+- /* Convert to host delta tsc if tsc scaling is enabled */
+- if (vcpu->arch.tsc_scaling_ratio != kvm_default_tsc_scaling_ratio &&
+- delta_tsc && u64_shl_div_u64(delta_tsc,
+- kvm_tsc_scaling_ratio_frac_bits,
+- vcpu->arch.tsc_scaling_ratio, &delta_tsc))
+- return -ERANGE;
+-
+- /*
+- * If the delta tsc can't fit in the 32 bit after the multi shift,
+- * we can't use the preemption timer.
+- * It's possible that it fits on later vmentries, but checking
+- * on every vmentry is costly so we just use an hrtimer.
+- */
+- if (delta_tsc >> (cpu_preemption_timer_multi + 32))
+- return -ERANGE;
+-
+- vmx->hv_deadline_tsc = tscl + delta_tsc;
+- *expired = !delta_tsc;
+- return 0;
+-}
+-
+-static void vmx_cancel_hv_timer(struct kvm_vcpu *vcpu)
+-{
+- to_vmx(vcpu)->hv_deadline_tsc = -1;
+-}
+-#endif
+-
+-static void vmx_sched_in(struct kvm_vcpu *vcpu, int cpu)
+-{
+- if (!kvm_pause_in_guest(vcpu->kvm))
+- shrink_ple_window(vcpu);
+-}
+-
+-static void vmx_slot_enable_log_dirty(struct kvm *kvm,
+- struct kvm_memory_slot *slot)
+-{
+- kvm_mmu_slot_leaf_clear_dirty(kvm, slot);
+- kvm_mmu_slot_largepage_remove_write_access(kvm, slot);
+-}
+-
+-static void vmx_slot_disable_log_dirty(struct kvm *kvm,
+- struct kvm_memory_slot *slot)
+-{
+- kvm_mmu_slot_set_dirty(kvm, slot);
+-}
+-
+-static void vmx_flush_log_dirty(struct kvm *kvm)
+-{
+- kvm_flush_pml_buffers(kvm);
+-}
+-
+-static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu)
+-{
+- struct vmcs12 *vmcs12;
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- gpa_t gpa, dst;
+-
+- if (is_guest_mode(vcpu)) {
+- WARN_ON_ONCE(vmx->nested.pml_full);
+-
+- /*
+- * Check if PML is enabled for the nested guest.
+- * Whether eptp bit 6 is set is already checked
+- * as part of A/D emulation.
+- */
+- vmcs12 = get_vmcs12(vcpu);
+- if (!nested_cpu_has_pml(vmcs12))
+- return 0;
+-
+- if (vmcs12->guest_pml_index >= PML_ENTITY_NUM) {
+- vmx->nested.pml_full = true;
+- return 1;
+- }
+-
+- gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS) & ~0xFFFull;
+- dst = vmcs12->pml_address + sizeof(u64) * vmcs12->guest_pml_index;
+-
+- if (kvm_write_guest_page(vcpu->kvm, gpa_to_gfn(dst), &gpa,
+- offset_in_page(dst), sizeof(gpa)))
+- return 0;
+-
+- vmcs12->guest_pml_index--;
+- }
+-
+- return 0;
+-}
+-
+-static void vmx_enable_log_dirty_pt_masked(struct kvm *kvm,
+- struct kvm_memory_slot *memslot,
+- gfn_t offset, unsigned long mask)
+-{
+- kvm_mmu_clear_dirty_pt_masked(kvm, memslot, offset, mask);
+-}
+-
+-static void __pi_post_block(struct kvm_vcpu *vcpu)
+-{
+- struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+- struct pi_desc old, new;
+- unsigned int dest;
+-
+- do {
+- old.control = new.control = pi_desc->control;
+- WARN(old.nv != POSTED_INTR_WAKEUP_VECTOR,
+- "Wakeup handler not enabled while the VCPU is blocked\n");
+-
+- dest = cpu_physical_id(vcpu->cpu);
+-
+- if (x2apic_enabled())
+- new.ndst = dest;
+- else
+- new.ndst = (dest << 8) & 0xFF00;
+-
+- /* set 'NV' to 'notification vector' */
+- new.nv = POSTED_INTR_VECTOR;
+- } while (cmpxchg64(&pi_desc->control, old.control,
+- new.control) != old.control);
+-
+- if (!WARN_ON_ONCE(vcpu->pre_pcpu == -1)) {
+- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+- list_del(&vcpu->blocked_vcpu_list);
+- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+- vcpu->pre_pcpu = -1;
+- }
+-}
+-
+-/*
+- * This routine does the following things for vCPU which is going
+- * to be blocked if VT-d PI is enabled.
+- * - Store the vCPU to the wakeup list, so when interrupts happen
+- * we can find the right vCPU to wake up.
+- * - Change the Posted-interrupt descriptor as below:
+- * 'NDST' <-- vcpu->pre_pcpu
+- * 'NV' <-- POSTED_INTR_WAKEUP_VECTOR
+- * - If 'ON' is set during this process, which means at least one
+- * interrupt is posted for this vCPU, we cannot block it, in
+- * this case, return 1, otherwise, return 0.
+- *
+- */
+-static int pi_pre_block(struct kvm_vcpu *vcpu)
+-{
+- unsigned int dest;
+- struct pi_desc old, new;
+- struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+-
+- if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
+- !irq_remapping_cap(IRQ_POSTING_CAP) ||
+- !kvm_vcpu_apicv_active(vcpu))
+- return 0;
+-
+- WARN_ON(irqs_disabled());
+- local_irq_disable();
+- if (!WARN_ON_ONCE(vcpu->pre_pcpu != -1)) {
+- vcpu->pre_pcpu = vcpu->cpu;
+- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+- list_add_tail(&vcpu->blocked_vcpu_list,
+- &per_cpu(blocked_vcpu_on_cpu,
+- vcpu->pre_pcpu));
+- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+- }
+-
+- do {
+- old.control = new.control = pi_desc->control;
+-
+- WARN((pi_desc->sn == 1),
+- "Warning: SN field of posted-interrupts "
+- "is set before blocking\n");
+-
+- /*
+- * Since vCPU can be preempted during this process,
+- * vcpu->cpu could be different with pre_pcpu, we
+- * need to set pre_pcpu as the destination of wakeup
+- * notification event, then we can find the right vCPU
+- * to wakeup in wakeup handler if interrupts happen
+- * when the vCPU is in blocked state.
+- */
+- dest = cpu_physical_id(vcpu->pre_pcpu);
+-
+- if (x2apic_enabled())
+- new.ndst = dest;
+- else
+- new.ndst = (dest << 8) & 0xFF00;
+-
+- /* set 'NV' to 'wakeup vector' */
+- new.nv = POSTED_INTR_WAKEUP_VECTOR;
+- } while (cmpxchg64(&pi_desc->control, old.control,
+- new.control) != old.control);
+-
+- /* We should not block the vCPU if an interrupt is posted for it. */
+- if (pi_test_on(pi_desc) == 1)
+- __pi_post_block(vcpu);
+-
+- local_irq_enable();
+- return (vcpu->pre_pcpu == -1);
+-}
+-
+-static int vmx_pre_block(struct kvm_vcpu *vcpu)
+-{
+- if (pi_pre_block(vcpu))
+- return 1;
+-
+- if (kvm_lapic_hv_timer_in_use(vcpu))
+- kvm_lapic_switch_to_sw_timer(vcpu);
+-
+- return 0;
+-}
+-
+-static void pi_post_block(struct kvm_vcpu *vcpu)
+-{
+- if (vcpu->pre_pcpu == -1)
+- return;
+-
+- WARN_ON(irqs_disabled());
+- local_irq_disable();
+- __pi_post_block(vcpu);
+- local_irq_enable();
+-}
+-
+-static void vmx_post_block(struct kvm_vcpu *vcpu)
+-{
+- if (kvm_x86_ops->set_hv_timer)
+- kvm_lapic_switch_to_hv_timer(vcpu);
+-
+- pi_post_block(vcpu);
+-}
+-
+-/*
+- * vmx_update_pi_irte - set IRTE for Posted-Interrupts
+- *
+- * @kvm: kvm
+- * @host_irq: host irq of the interrupt
+- * @guest_irq: gsi of the interrupt
+- * @set: set or unset PI
+- * returns 0 on success, < 0 on failure
+- */
+-static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
+- uint32_t guest_irq, bool set)
+-{
+- struct kvm_kernel_irq_routing_entry *e;
+- struct kvm_irq_routing_table *irq_rt;
+- struct kvm_lapic_irq irq;
+- struct kvm_vcpu *vcpu;
+- struct vcpu_data vcpu_info;
+- int idx, ret = 0;
+-
+- if (!kvm_arch_has_assigned_device(kvm) ||
+- !irq_remapping_cap(IRQ_POSTING_CAP) ||
+- !kvm_vcpu_apicv_active(kvm->vcpus[0]))
+- return 0;
+-
+- idx = srcu_read_lock(&kvm->irq_srcu);
+- irq_rt = srcu_dereference(kvm->irq_routing, &kvm->irq_srcu);
+- if (guest_irq >= irq_rt->nr_rt_entries ||
+- hlist_empty(&irq_rt->map[guest_irq])) {
+- pr_warn_once("no route for guest_irq %u/%u (broken user space?)\n",
+- guest_irq, irq_rt->nr_rt_entries);
+- goto out;
+- }
+-
+- hlist_for_each_entry(e, &irq_rt->map[guest_irq], link) {
+- if (e->type != KVM_IRQ_ROUTING_MSI)
+- continue;
+- /*
+- * VT-d PI cannot support posting multicast/broadcast
+- * interrupts to a vCPU, we still use interrupt remapping
+- * for these kind of interrupts.
+- *
+- * For lowest-priority interrupts, we only support
+- * those with single CPU as the destination, e.g. user
+- * configures the interrupts via /proc/irq or uses
+- * irqbalance to make the interrupts single-CPU.
+- *
+- * We will support full lowest-priority interrupt later.
+- *
+- * In addition, we can only inject generic interrupts using
+- * the PI mechanism, refuse to route others through it.
+- */
+-
+- kvm_set_msi_irq(kvm, e, &irq);
+- if (!kvm_intr_is_single_vcpu(kvm, &irq, &vcpu) ||
+- !kvm_irq_is_postable(&irq)) {
+- /*
+- * Make sure the IRTE is in remapped mode if
+- * we don't handle it in posted mode.
+- */
+- ret = irq_set_vcpu_affinity(host_irq, NULL);
+- if (ret < 0) {
+- printk(KERN_INFO
+- "failed to back to remapped mode, irq: %u\n",
+- host_irq);
+- goto out;
+- }
+-
+- continue;
+- }
+-
+- vcpu_info.pi_desc_addr = __pa(vcpu_to_pi_desc(vcpu));
+- vcpu_info.vector = irq.vector;
+-
+- trace_kvm_pi_irte_update(host_irq, vcpu->vcpu_id, e->gsi,
+- vcpu_info.vector, vcpu_info.pi_desc_addr, set);
+-
+- if (set)
+- ret = irq_set_vcpu_affinity(host_irq, &vcpu_info);
+- else
+- ret = irq_set_vcpu_affinity(host_irq, NULL);
+-
+- if (ret < 0) {
+- printk(KERN_INFO "%s: failed to update PI IRTE\n",
+- __func__);
+- goto out;
+- }
+- }
+-
+- ret = 0;
+-out:
+- srcu_read_unlock(&kvm->irq_srcu, idx);
+- return ret;
+-}
+-
+-static void vmx_setup_mce(struct kvm_vcpu *vcpu)
+-{
+- if (vcpu->arch.mcg_cap & MCG_LMCE_P)
+- to_vmx(vcpu)->msr_ia32_feature_control_valid_bits |=
+- FEATURE_CONTROL_LMCE;
+- else
+- to_vmx(vcpu)->msr_ia32_feature_control_valid_bits &=
+- ~FEATURE_CONTROL_LMCE;
+-}
+-
+-static int vmx_smi_allowed(struct kvm_vcpu *vcpu)
+-{
+- /* we need a nested vmexit to enter SMM, postpone if run is pending */
+- if (to_vmx(vcpu)->nested.nested_run_pending)
+- return 0;
+- return 1;
+-}
+-
+-static int vmx_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- vmx->nested.smm.guest_mode = is_guest_mode(vcpu);
+- if (vmx->nested.smm.guest_mode)
+- nested_vmx_vmexit(vcpu, -1, 0, 0);
+-
+- vmx->nested.smm.vmxon = vmx->nested.vmxon;
+- vmx->nested.vmxon = false;
+- vmx_clear_hlt(vcpu);
+- return 0;
+-}
+-
+-static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, const char *smstate)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int ret;
+-
+- if (vmx->nested.smm.vmxon) {
+- vmx->nested.vmxon = true;
+- vmx->nested.smm.vmxon = false;
+- }
+-
+- if (vmx->nested.smm.guest_mode) {
+- ret = nested_vmx_enter_non_root_mode(vcpu, false);
+- if (ret)
+- return ret;
+-
+- vmx->nested.smm.guest_mode = false;
+- }
+- return 0;
+-}
+-
+-static int enable_smi_window(struct kvm_vcpu *vcpu)
+-{
+- return 0;
+-}
+-
+-static bool vmx_need_emulation_on_page_fault(struct kvm_vcpu *vcpu)
+-{
+- return false;
+-}
+-
+-static bool vmx_apic_init_signal_blocked(struct kvm_vcpu *vcpu)
+-{
+- return to_vmx(vcpu)->nested.vmxon;
+-}
+-
+-static __init int hardware_setup(void)
+-{
+- unsigned long host_bndcfgs;
+- struct desc_ptr dt;
+- int r, i;
+-
+- rdmsrl_safe(MSR_EFER, &host_efer);
+-
+- store_idt(&dt);
+- host_idt_base = dt.address;
+-
+- for (i = 0; i < ARRAY_SIZE(vmx_msr_index); ++i)
+- kvm_define_shared_msr(i, vmx_msr_index[i]);
+-
+- if (setup_vmcs_config(&vmcs_config, &vmx_capability) < 0)
+- return -EIO;
+-
+- if (boot_cpu_has(X86_FEATURE_NX))
+- kvm_enable_efer_bits(EFER_NX);
+-
+- if (boot_cpu_has(X86_FEATURE_MPX)) {
+- rdmsrl(MSR_IA32_BNDCFGS, host_bndcfgs);
+- WARN_ONCE(host_bndcfgs, "KVM: BNDCFGS in host will be lost");
+- }
+-
+- if (!cpu_has_vmx_vpid() || !cpu_has_vmx_invvpid() ||
+- !(cpu_has_vmx_invvpid_single() || cpu_has_vmx_invvpid_global()))
+- enable_vpid = 0;
+-
+- if (!cpu_has_vmx_ept() ||
+- !cpu_has_vmx_ept_4levels() ||
+- !cpu_has_vmx_ept_mt_wb() ||
+- !cpu_has_vmx_invept_global())
+- enable_ept = 0;
+-
+- if (!cpu_has_vmx_ept_ad_bits() || !enable_ept)
+- enable_ept_ad_bits = 0;
+-
+- if (!cpu_has_vmx_unrestricted_guest() || !enable_ept)
+- enable_unrestricted_guest = 0;
+-
+- if (!cpu_has_vmx_flexpriority())
+- flexpriority_enabled = 0;
+-
+- if (!cpu_has_virtual_nmis())
+- enable_vnmi = 0;
+-
+- /*
+- * set_apic_access_page_addr() is used to reload apic access
+- * page upon invalidation. No need to do anything if not
+- * using the APIC_ACCESS_ADDR VMCS field.
+- */
+- if (!flexpriority_enabled)
+- kvm_x86_ops->set_apic_access_page_addr = NULL;
+-
+- if (!cpu_has_vmx_tpr_shadow())
+- kvm_x86_ops->update_cr8_intercept = NULL;
+-
+- if (enable_ept && !cpu_has_vmx_ept_2m_page())
+- kvm_disable_largepages();
+-
+-#if IS_ENABLED(CONFIG_HYPERV)
+- if (ms_hyperv.nested_features & HV_X64_NESTED_GUEST_MAPPING_FLUSH
+- && enable_ept) {
+- kvm_x86_ops->tlb_remote_flush = hv_remote_flush_tlb;
+- kvm_x86_ops->tlb_remote_flush_with_range =
+- hv_remote_flush_tlb_with_range;
+- }
+-#endif
+-
+- if (!cpu_has_vmx_ple()) {
+- ple_gap = 0;
+- ple_window = 0;
+- ple_window_grow = 0;
+- ple_window_max = 0;
+- ple_window_shrink = 0;
+- }
+-
+- if (!cpu_has_vmx_apicv()) {
+- enable_apicv = 0;
+- kvm_x86_ops->sync_pir_to_irr = NULL;
+- }
+-
+- if (cpu_has_vmx_tsc_scaling()) {
+- kvm_has_tsc_control = true;
+- kvm_max_tsc_scaling_ratio = KVM_VMX_TSC_MULTIPLIER_MAX;
+- kvm_tsc_scaling_ratio_frac_bits = 48;
+- }
+-
+- set_bit(0, vmx_vpid_bitmap); /* 0 is reserved for host */
+-
+- if (enable_ept)
+- vmx_enable_tdp();
+- else
+- kvm_disable_tdp();
+-
+- /*
+- * Only enable PML when hardware supports PML feature, and both EPT
+- * and EPT A/D bit features are enabled -- PML depends on them to work.
+- */
+- if (!enable_ept || !enable_ept_ad_bits || !cpu_has_vmx_pml())
+- enable_pml = 0;
+-
+- if (!enable_pml) {
+- kvm_x86_ops->slot_enable_log_dirty = NULL;
+- kvm_x86_ops->slot_disable_log_dirty = NULL;
+- kvm_x86_ops->flush_log_dirty = NULL;
+- kvm_x86_ops->enable_log_dirty_pt_masked = NULL;
+- }
+-
+- if (!cpu_has_vmx_preemption_timer())
+- enable_preemption_timer = false;
+-
+- if (enable_preemption_timer) {
+- u64 use_timer_freq = 5000ULL * 1000 * 1000;
+- u64 vmx_msr;
+-
+- rdmsrl(MSR_IA32_VMX_MISC, vmx_msr);
+- cpu_preemption_timer_multi =
+- vmx_msr & VMX_MISC_PREEMPTION_TIMER_RATE_MASK;
+-
+- if (tsc_khz)
+- use_timer_freq = (u64)tsc_khz * 1000;
+- use_timer_freq >>= cpu_preemption_timer_multi;
+-
+- /*
+- * KVM "disables" the preemption timer by setting it to its max
+- * value. Don't use the timer if it might cause spurious exits
+- * at a rate faster than 0.1 Hz (of uninterrupted guest time).
+- */
+- if (use_timer_freq > 0xffffffffu / 10)
+- enable_preemption_timer = false;
+- }
+-
+- if (!enable_preemption_timer) {
+- kvm_x86_ops->set_hv_timer = NULL;
+- kvm_x86_ops->cancel_hv_timer = NULL;
+- kvm_x86_ops->request_immediate_exit = __kvm_request_immediate_exit;
+- }
+-
+- kvm_set_posted_intr_wakeup_handler(wakeup_handler);
+-
+- kvm_mce_cap_supported |= MCG_LMCE_P;
+-
+- if (pt_mode != PT_MODE_SYSTEM && pt_mode != PT_MODE_HOST_GUEST)
+- return -EINVAL;
+- if (!enable_ept || !cpu_has_vmx_intel_pt())
+- pt_mode = PT_MODE_SYSTEM;
+-
+- if (nested) {
+- nested_vmx_setup_ctls_msrs(&vmcs_config.nested,
+- vmx_capability.ept, enable_apicv);
+-
+- r = nested_vmx_hardware_setup(kvm_vmx_exit_handlers);
+- if (r)
+- return r;
+- }
+-
+- r = alloc_kvm_area();
+- if (r)
+- nested_vmx_hardware_unsetup();
+- return r;
+-}
+-
+-static __exit void hardware_unsetup(void)
+-{
+- if (nested)
+- nested_vmx_hardware_unsetup();
+-
+- free_kvm_area();
+-}
+-
+-static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
+- .cpu_has_kvm_support = cpu_has_kvm_support,
+- .disabled_by_bios = vmx_disabled_by_bios,
+- .hardware_setup = hardware_setup,
+- .hardware_unsetup = hardware_unsetup,
+- .check_processor_compatibility = vmx_check_processor_compat,
+- .hardware_enable = hardware_enable,
+- .hardware_disable = hardware_disable,
+- .cpu_has_accelerated_tpr = report_flexpriority,
+- .has_emulated_msr = vmx_has_emulated_msr,
+-
+- .vm_init = vmx_vm_init,
+- .vm_alloc = vmx_vm_alloc,
+- .vm_free = vmx_vm_free,
+-
+- .vcpu_create = vmx_create_vcpu,
+- .vcpu_free = vmx_free_vcpu,
+- .vcpu_reset = vmx_vcpu_reset,
+-
+- .prepare_guest_switch = vmx_prepare_switch_to_guest,
+- .vcpu_load = vmx_vcpu_load,
+- .vcpu_put = vmx_vcpu_put,
+-
+- .update_bp_intercept = update_exception_bitmap,
+- .get_msr_feature = vmx_get_msr_feature,
+- .get_msr = vmx_get_msr,
+- .set_msr = vmx_set_msr,
+- .get_segment_base = vmx_get_segment_base,
+- .get_segment = vmx_get_segment,
+- .set_segment = vmx_set_segment,
+- .get_cpl = vmx_get_cpl,
+- .get_cs_db_l_bits = vmx_get_cs_db_l_bits,
+- .decache_cr0_guest_bits = vmx_decache_cr0_guest_bits,
+- .decache_cr4_guest_bits = vmx_decache_cr4_guest_bits,
+- .set_cr0 = vmx_set_cr0,
+- .set_cr3 = vmx_set_cr3,
+- .set_cr4 = vmx_set_cr4,
+- .set_efer = vmx_set_efer,
+- .get_idt = vmx_get_idt,
+- .set_idt = vmx_set_idt,
+- .get_gdt = vmx_get_gdt,
+- .set_gdt = vmx_set_gdt,
+- .get_dr6 = vmx_get_dr6,
+- .set_dr6 = vmx_set_dr6,
+- .set_dr7 = vmx_set_dr7,
+- .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs,
+- .cache_reg = vmx_cache_reg,
+- .get_rflags = vmx_get_rflags,
+- .set_rflags = vmx_set_rflags,
+-
+- .tlb_flush = vmx_flush_tlb,
+- .tlb_flush_gva = vmx_flush_tlb_gva,
+-
+- .run = vmx_vcpu_run,
+- .handle_exit = vmx_handle_exit,
+- .skip_emulated_instruction = skip_emulated_instruction,
+- .set_interrupt_shadow = vmx_set_interrupt_shadow,
+- .get_interrupt_shadow = vmx_get_interrupt_shadow,
+- .patch_hypercall = vmx_patch_hypercall,
+- .set_irq = vmx_inject_irq,
+- .set_nmi = vmx_inject_nmi,
+- .queue_exception = vmx_queue_exception,
+- .cancel_injection = vmx_cancel_injection,
+- .interrupt_allowed = vmx_interrupt_allowed,
+- .nmi_allowed = vmx_nmi_allowed,
+- .get_nmi_mask = vmx_get_nmi_mask,
+- .set_nmi_mask = vmx_set_nmi_mask,
+- .enable_nmi_window = enable_nmi_window,
+- .enable_irq_window = enable_irq_window,
+- .update_cr8_intercept = update_cr8_intercept,
+- .set_virtual_apic_mode = vmx_set_virtual_apic_mode,
+- .set_apic_access_page_addr = vmx_set_apic_access_page_addr,
+- .get_enable_apicv = vmx_get_enable_apicv,
+- .refresh_apicv_exec_ctrl = vmx_refresh_apicv_exec_ctrl,
+- .load_eoi_exitmap = vmx_load_eoi_exitmap,
+- .apicv_post_state_restore = vmx_apicv_post_state_restore,
+- .hwapic_irr_update = vmx_hwapic_irr_update,
+- .hwapic_isr_update = vmx_hwapic_isr_update,
+- .guest_apic_has_interrupt = vmx_guest_apic_has_interrupt,
+- .sync_pir_to_irr = vmx_sync_pir_to_irr,
+- .deliver_posted_interrupt = vmx_deliver_posted_interrupt,
+- .dy_apicv_has_pending_interrupt = vmx_dy_apicv_has_pending_interrupt,
+-
+- .set_tss_addr = vmx_set_tss_addr,
+- .set_identity_map_addr = vmx_set_identity_map_addr,
+- .get_tdp_level = get_ept_level,
+- .get_mt_mask = vmx_get_mt_mask,
+-
+- .get_exit_info = vmx_get_exit_info,
+-
+- .get_lpage_level = vmx_get_lpage_level,
+-
+- .cpuid_update = vmx_cpuid_update,
+-
+- .rdtscp_supported = vmx_rdtscp_supported,
+- .invpcid_supported = vmx_invpcid_supported,
+-
+- .set_supported_cpuid = vmx_set_supported_cpuid,
+-
+- .has_wbinvd_exit = cpu_has_vmx_wbinvd_exit,
+-
+- .read_l1_tsc_offset = vmx_read_l1_tsc_offset,
+- .write_l1_tsc_offset = vmx_write_l1_tsc_offset,
+-
+- .set_tdp_cr3 = vmx_set_cr3,
+-
+- .check_intercept = vmx_check_intercept,
+- .handle_exit_irqoff = vmx_handle_exit_irqoff,
+- .mpx_supported = vmx_mpx_supported,
+- .xsaves_supported = vmx_xsaves_supported,
+- .umip_emulated = vmx_umip_emulated,
+- .pt_supported = vmx_pt_supported,
+-
+- .request_immediate_exit = vmx_request_immediate_exit,
+-
+- .sched_in = vmx_sched_in,
+-
+- .slot_enable_log_dirty = vmx_slot_enable_log_dirty,
+- .slot_disable_log_dirty = vmx_slot_disable_log_dirty,
+- .flush_log_dirty = vmx_flush_log_dirty,
+- .enable_log_dirty_pt_masked = vmx_enable_log_dirty_pt_masked,
+- .write_log_dirty = vmx_write_pml_buffer,
+-
+- .pre_block = vmx_pre_block,
+- .post_block = vmx_post_block,
+-
+- .pmu_ops = &intel_pmu_ops,
+-
+- .update_pi_irte = vmx_update_pi_irte,
+-
+-#ifdef CONFIG_X86_64
+- .set_hv_timer = vmx_set_hv_timer,
+- .cancel_hv_timer = vmx_cancel_hv_timer,
+-#endif
+-
+- .setup_mce = vmx_setup_mce,
+-
+- .smi_allowed = vmx_smi_allowed,
+- .pre_enter_smm = vmx_pre_enter_smm,
+- .pre_leave_smm = vmx_pre_leave_smm,
+- .enable_smi_window = enable_smi_window,
+-
+- .check_nested_events = NULL,
+- .get_nested_state = NULL,
+- .set_nested_state = NULL,
+- .get_vmcs12_pages = NULL,
+- .nested_enable_evmcs = NULL,
+- .nested_get_evmcs_version = NULL,
+- .need_emulation_on_page_fault = vmx_need_emulation_on_page_fault,
+- .apic_init_signal_blocked = vmx_apic_init_signal_blocked,
+-};
+-
+-static void vmx_cleanup_l1d_flush(void)
+-{
+- if (vmx_l1d_flush_pages) {
+- free_pages((unsigned long)vmx_l1d_flush_pages, L1D_CACHE_ORDER);
+- vmx_l1d_flush_pages = NULL;
+- }
+- /* Restore state so sysfs ignores VMX */
+- l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
+-}
+-
+-static void vmx_exit(void)
+-{
+-#ifdef CONFIG_KEXEC_CORE
+- RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL);
+- synchronize_rcu();
+-#endif
+-
+- kvm_exit();
+-
+-#if IS_ENABLED(CONFIG_HYPERV)
+- if (static_branch_unlikely(&enable_evmcs)) {
+- int cpu;
+- struct hv_vp_assist_page *vp_ap;
+- /*
+- * Reset everything to support using non-enlightened VMCS
+- * access later (e.g. when we reload the module with
+- * enlightened_vmcs=0)
+- */
+- for_each_online_cpu(cpu) {
+- vp_ap = hv_get_vp_assist_page(cpu);
+-
+- if (!vp_ap)
+- continue;
+-
+- vp_ap->nested_control.features.directhypercall = 0;
+- vp_ap->current_nested_vmcs = 0;
+- vp_ap->enlighten_vmentry = 0;
+- }
+-
+- static_branch_disable(&enable_evmcs);
+- }
+-#endif
+- vmx_cleanup_l1d_flush();
+-}
+-module_exit(vmx_exit);
+-
+-static int __init vmx_init(void)
+-{
+- int r;
+-
+-#if IS_ENABLED(CONFIG_HYPERV)
+- /*
+- * Enlightened VMCS usage should be recommended and the host needs
+- * to support eVMCS v1 or above. We can also disable eVMCS support
+- * with module parameter.
+- */
+- if (enlightened_vmcs &&
+- ms_hyperv.hints & HV_X64_ENLIGHTENED_VMCS_RECOMMENDED &&
+- (ms_hyperv.nested_features & HV_X64_ENLIGHTENED_VMCS_VERSION) >=
+- KVM_EVMCS_VERSION) {
+- int cpu;
+-
+- /* Check that we have assist pages on all online CPUs */
+- for_each_online_cpu(cpu) {
+- if (!hv_get_vp_assist_page(cpu)) {
+- enlightened_vmcs = false;
+- break;
+- }
+- }
+-
+- if (enlightened_vmcs) {
+- pr_info("KVM: vmx: using Hyper-V Enlightened VMCS\n");
+- static_branch_enable(&enable_evmcs);
+- }
+-
+- if (ms_hyperv.nested_features & HV_X64_NESTED_DIRECT_FLUSH)
+- vmx_x86_ops.enable_direct_tlbflush
+- = hv_enable_direct_tlbflush;
+-
+- } else {
+- enlightened_vmcs = false;
+- }
+-#endif
+-
+- r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx),
+- __alignof__(struct vcpu_vmx), THIS_MODULE);
+- if (r)
+- return r;
+-
+- /*
+- * Must be called after kvm_init() so enable_ept is properly set
+- * up. Hand the parameter mitigation value in which was stored in
+- * the pre module init parser. If no parameter was given, it will
+- * contain 'auto' which will be turned into the default 'cond'
+- * mitigation mode.
+- */
+- r = vmx_setup_l1d_flush(vmentry_l1d_flush_param);
+- if (r) {
+- vmx_exit();
+- return r;
+- }
+-
+-#ifdef CONFIG_KEXEC_CORE
+- rcu_assign_pointer(crash_vmclear_loaded_vmcss,
+- crash_vmclear_local_loaded_vmcss);
+-#endif
+- vmx_check_vmcs12_offsets();
+-
+- return 0;
+-}
+-module_init(vmx_init);
+diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
+index 0a0e9112f284..5cb9f009f2be 100644
+--- a/arch/x86/lib/x86-opcode-map.txt
++++ b/arch/x86/lib/x86-opcode-map.txt
+@@ -909,7 +909,7 @@ EndTable
+
+ GrpTable: Grp3_2
+ 0: TEST Ev,Iz
+-1:
++1: TEST Ev,Iz
+ 2: NOT Ev
+ 3: NEG Ev
+ 4: MUL rAX,Ev
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index e2d4b25c7aa4..101f3ad0d6ad 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -2126,19 +2126,13 @@ int kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
+ .pgd = pgd,
+ .numpages = numpages,
+ .mask_set = __pgprot(0),
+- .mask_clr = __pgprot(0),
++ .mask_clr = __pgprot(~page_flags & (_PAGE_NX|_PAGE_RW)),
+ .flags = 0,
+ };
+
+ if (!(__supported_pte_mask & _PAGE_NX))
+ goto out;
+
+- if (!(page_flags & _PAGE_NX))
+- cpa.mask_clr = __pgprot(_PAGE_NX);
+-
+- if (!(page_flags & _PAGE_RW))
+- cpa.mask_clr = __pgprot(_PAGE_RW);
+-
+ if (!(page_flags & _PAGE_ENC))
+ cpa.mask_clr = pgprot_encrypted(cpa.mask_clr);
+
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 335a62e74a2e..e7f19dec16b9 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -480,7 +480,6 @@ void __init efi_init(void)
+ efi_char16_t *c16;
+ char vendor[100] = "unknown";
+ int i = 0;
+- void *tmp;
+
+ #ifdef CONFIG_X86_32
+ if (boot_params.efi_info.efi_systab_hi ||
+@@ -505,14 +504,16 @@ void __init efi_init(void)
+ /*
+ * Show what we know for posterity
+ */
+- c16 = tmp = early_memremap(efi.systab->fw_vendor, 2);
++ c16 = early_memremap_ro(efi.systab->fw_vendor,
++ sizeof(vendor) * sizeof(efi_char16_t));
+ if (c16) {
+- for (i = 0; i < sizeof(vendor) - 1 && *c16; ++i)
+- vendor[i] = *c16++;
++ for (i = 0; i < sizeof(vendor) - 1 && c16[i]; ++i)
++ vendor[i] = c16[i];
+ vendor[i] = '\0';
+- } else
++ early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
++ } else {
+ pr_err("Could not map the firmware vendor!\n");
+- early_memunmap(tmp, 2);
++ }
+
+ pr_info("EFI v%u.%.02u by %s\n",
+ efi.systab->hdr.revision >> 16,
+@@ -929,16 +930,14 @@ static void __init __efi_enter_virtual_mode(void)
+
+ if (efi_alloc_page_tables()) {
+ pr_err("Failed to allocate EFI page tables\n");
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
++ goto err;
+ }
+
+ efi_merge_regions();
+ new_memmap = efi_map_regions(&count, &pg_shift);
+ if (!new_memmap) {
+ pr_err("Error reallocating memory, EFI runtime non-functional!\n");
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
++ goto err;
+ }
+
+ pa = __pa(new_memmap);
+@@ -952,8 +951,7 @@ static void __init __efi_enter_virtual_mode(void)
+
+ if (efi_memmap_init_late(pa, efi.memmap.desc_size * count)) {
+ pr_err("Failed to remap late EFI memory map\n");
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
++ goto err;
+ }
+
+ if (efi_enabled(EFI_DBG)) {
+@@ -961,12 +959,11 @@ static void __init __efi_enter_virtual_mode(void)
+ efi_print_memmap();
+ }
+
+- BUG_ON(!efi.systab);
++ if (WARN_ON(!efi.systab))
++ goto err;
+
+- if (efi_setup_page_tables(pa, 1 << pg_shift)) {
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
+- }
++ if (efi_setup_page_tables(pa, 1 << pg_shift))
++ goto err;
+
+ efi_sync_low_kernel_mappings();
+
+@@ -986,9 +983,9 @@ static void __init __efi_enter_virtual_mode(void)
+ }
+
+ if (status != EFI_SUCCESS) {
+- pr_alert("Unable to switch EFI into virtual mode (status=%lx)!\n",
+- status);
+- panic("EFI call to SetVirtualAddressMap() failed!");
++ pr_err("Unable to switch EFI into virtual mode (status=%lx)!\n",
++ status);
++ goto err;
+ }
+
+ /*
+@@ -1015,6 +1012,10 @@ static void __init __efi_enter_virtual_mode(void)
+
+ /* clean DUMMY object */
+ efi_delete_dummy_variable();
++ return;
++
++err:
++ clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+ }
+
+ void __init efi_enter_virtual_mode(void)
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index ee5d08f25ce4..6db8f3598c80 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -389,11 +389,12 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
+ return 0;
+
+ page = alloc_page(GFP_KERNEL|__GFP_DMA32);
+- if (!page)
+- panic("Unable to allocate EFI runtime stack < 4GB\n");
++ if (!page) {
++ pr_err("Unable to allocate EFI runtime stack < 4GB\n");
++ return 1;
++ }
+
+- efi_scratch.phys_stack = virt_to_phys(page_address(page));
+- efi_scratch.phys_stack += PAGE_SIZE; /* stack grows down */
++ efi_scratch.phys_stack = page_to_phys(page + 1); /* stack grows down */
+
+ npages = (_etext - _text) >> PAGE_SHIFT;
+ text = __pa(_text);
+diff --git a/drivers/acpi/acpica/dsfield.c b/drivers/acpi/acpica/dsfield.c
+index 30fe89545d6a..bcc6a7acc576 100644
+--- a/drivers/acpi/acpica/dsfield.c
++++ b/drivers/acpi/acpica/dsfield.c
+@@ -244,7 +244,7 @@ cleanup:
+ * FUNCTION: acpi_ds_get_field_names
+ *
+ * PARAMETERS: info - create_field info structure
+- * ` walk_state - Current method state
++ * walk_state - Current method state
+ * arg - First parser arg for the field name list
+ *
+ * RETURN: Status
+diff --git a/drivers/acpi/acpica/dswload.c b/drivers/acpi/acpica/dswload.c
+index d06c41446282..ba53662f1217 100644
+--- a/drivers/acpi/acpica/dswload.c
++++ b/drivers/acpi/acpica/dswload.c
+@@ -412,6 +412,27 @@ acpi_status acpi_ds_load1_end_op(struct acpi_walk_state *walk_state)
+ ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH, "Op=%p State=%p\n", op,
+ walk_state));
+
++ /*
++ * Disassembler: handle create field operators here.
++ *
++ * create_buffer_field is a deferred op that is typically processed in load
++ * pass 2. However, disassembly of control method contents walk the parse
++ * tree with ACPI_PARSE_LOAD_PASS1 and AML_CREATE operators are processed
++ * in a later walk. This is a problem when there is a control method that
++ * has the same name as the AML_CREATE object. In this case, any use of the
++ * name segment will be detected as a method call rather than a reference
++ * to a buffer field.
++ *
++ * This earlier creation during disassembly solves this issue by inserting
++ * the named object in the ACPI namespace so that references to this name
++ * would be a name string rather than a method call.
++ */
++ if ((walk_state->parse_flags & ACPI_PARSE_DISASSEMBLE) &&
++ (walk_state->op_info->flags & AML_CREATE)) {
++ status = acpi_ds_create_buffer_field(op, walk_state);
++ return_ACPI_STATUS(status);
++ }
++
+ /* We are only interested in opcodes that have an associated name */
+
+ if (!(walk_state->op_info->flags & (AML_NAMED | AML_FIELD))) {
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index a25d77b3a16a..d5c19e25ddf5 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -102,6 +102,17 @@ static const struct dmi_system_id lid_blacklst[] = {
+ },
+ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
+ },
++ {
++ /*
++ * Razer Blade Stealth 13 late 2019, notification of the LID device
++ * only happens on close, not on open and _LID always returns closed.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Razer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Razer Blade Stealth 13 Late 2019"),
++ },
++ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
++ },
+ {}
+ };
+
+diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
+index 99a38115b0a8..86aab14872fd 100644
+--- a/drivers/atm/fore200e.c
++++ b/drivers/atm/fore200e.c
+@@ -1504,12 +1504,14 @@ fore200e_open(struct atm_vcc *vcc)
+ static void
+ fore200e_close(struct atm_vcc* vcc)
+ {
+- struct fore200e* fore200e = FORE200E_DEV(vcc->dev);
+ struct fore200e_vcc* fore200e_vcc;
++ struct fore200e* fore200e;
+ struct fore200e_vc_map* vc_map;
+ unsigned long flags;
+
+ ASSERT(vcc);
++ fore200e = FORE200E_DEV(vcc->dev);
++
+ ASSERT((vcc->vpi >= 0) && (vcc->vpi < 1<<FORE200E_VPI_BITS));
+ ASSERT((vcc->vci >= 0) && (vcc->vci < 1<<FORE200E_VCI_BITS));
+
+@@ -1554,10 +1556,10 @@ fore200e_close(struct atm_vcc* vcc)
+ static int
+ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
+ {
+- struct fore200e* fore200e = FORE200E_DEV(vcc->dev);
+- struct fore200e_vcc* fore200e_vcc = FORE200E_VCC(vcc);
++ struct fore200e* fore200e;
++ struct fore200e_vcc* fore200e_vcc;
+ struct fore200e_vc_map* vc_map;
+- struct host_txq* txq = &fore200e->host_txq;
++ struct host_txq* txq;
+ struct host_txq_entry* entry;
+ struct tpd* tpd;
+ struct tpd_haddr tpd_haddr;
+@@ -1570,9 +1572,18 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
+ unsigned char* data;
+ unsigned long flags;
+
+- ASSERT(vcc);
+- ASSERT(fore200e);
+- ASSERT(fore200e_vcc);
++ if (!vcc)
++ return -EINVAL;
++
++ fore200e = FORE200E_DEV(vcc->dev);
++ fore200e_vcc = FORE200E_VCC(vcc);
++
++ if (!fore200e)
++ return -EINVAL;
++
++ txq = &fore200e->host_txq;
++ if (!fore200e_vcc)
++ return -EINVAL;
+
+ if (!test_bit(ATM_VF_READY, &vcc->flags)) {
+ DPRINTK(1, "VC %d.%d.%d not ready for tx\n", vcc->itf, vcc->vpi, vcc->vpi);
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 11d24a552ee4..5f6416e6ba96 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -470,7 +470,10 @@ static int really_probe(struct device *dev, struct device_driver *drv)
+ atomic_inc(&probe_count);
+ pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
+ drv->bus->name, __func__, drv->name, dev_name(dev));
+- WARN_ON(!list_empty(&dev->devres_head));
++ if (!list_empty(&dev->devres_head)) {
++ dev_crit(dev, "Resources present before probing\n");
++ return -EBUSY;
++ }
+
+ re_probe:
+ dev->driver = drv;
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index e9be1f56929a..d1f901b58f75 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -27,6 +27,7 @@
+ #include <linux/limits.h>
+ #include <linux/property.h>
+ #include <linux/kmemleak.h>
++#include <linux/types.h>
+
+ #include "base.h"
+ #include "power/power.h"
+@@ -67,7 +68,7 @@ void __weak arch_setup_pdev_archdata(struct platform_device *pdev)
+ struct resource *platform_get_resource(struct platform_device *dev,
+ unsigned int type, unsigned int num)
+ {
+- int i;
++ u32 i;
+
+ for (i = 0; i < dev->num_resources; i++) {
+ struct resource *r = &dev->resource[i];
+@@ -162,7 +163,7 @@ struct resource *platform_get_resource_byname(struct platform_device *dev,
+ unsigned int type,
+ const char *name)
+ {
+- int i;
++ u32 i;
+
+ for (i = 0; i < dev->num_resources; i++) {
+ struct resource *r = &dev->resource[i];
+@@ -359,7 +360,8 @@ EXPORT_SYMBOL_GPL(platform_device_add_properties);
+ */
+ int platform_device_add(struct platform_device *pdev)
+ {
+- int i, ret;
++ u32 i;
++ int ret;
+
+ if (!pdev)
+ return -EINVAL;
+@@ -425,7 +427,7 @@ int platform_device_add(struct platform_device *pdev)
+ pdev->id = PLATFORM_DEVID_AUTO;
+ }
+
+- while (--i >= 0) {
++ while (i--) {
+ struct resource *r = &pdev->resource[i];
+ if (r->parent)
+ release_resource(r);
+@@ -446,7 +448,7 @@ EXPORT_SYMBOL_GPL(platform_device_add);
+ */
+ void platform_device_del(struct platform_device *pdev)
+ {
+- int i;
++ u32 i;
+
+ if (pdev) {
+ device_remove_properties(&pdev->dev);
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index 17defbf4f332..02e8fff3f828 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -463,6 +463,25 @@ static struct kobject *brd_probe(dev_t dev, int *part, void *data)
+ return kobj;
+ }
+
++static inline void brd_check_and_reset_par(void)
++{
++ if (unlikely(!max_part))
++ max_part = 1;
++
++ /*
++ * make sure 'max_part' can be divided exactly by (1U << MINORBITS),
++ * otherwise, it is possiable to get same dev_t when adding partitions.
++ */
++ if ((1U << MINORBITS) % max_part != 0)
++ max_part = 1UL << fls(max_part);
++
++ if (max_part > DISK_MAX_PARTS) {
++ pr_info("brd: max_part can't be larger than %d, reset max_part = %d.\n",
++ DISK_MAX_PARTS, DISK_MAX_PARTS);
++ max_part = DISK_MAX_PARTS;
++ }
++}
++
+ static int __init brd_init(void)
+ {
+ struct brd_device *brd, *next;
+@@ -486,8 +505,7 @@ static int __init brd_init(void)
+ if (register_blkdev(RAMDISK_MAJOR, "ramdisk"))
+ return -EIO;
+
+- if (unlikely(!max_part))
+- max_part = 1;
++ brd_check_and_reset_par();
+
+ for (i = 0; i < rd_nr; i++) {
+ brd = brd_alloc(i);
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index b9d321bdaa8a..226103af30f0 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1216,6 +1216,16 @@ static int nbd_start_device(struct nbd_device *nbd)
+ args = kzalloc(sizeof(*args), GFP_KERNEL);
+ if (!args) {
+ sock_shutdown(nbd);
++ /*
++ * If num_connections is m (2 < m),
++ * and NO.1 ~ NO.n(1 < n < m) kzallocs are successful.
++ * But NO.(n + 1) failed. We still have n recv threads.
++ * So, add flush_workqueue here to prevent recv threads
++ * dropping the last config_refs and trying to destroy
++ * the workqueue from inside the workqueue.
++ */
++ if (i)
++ flush_workqueue(nbd->recv_workq);
+ return -ENOMEM;
+ }
+ sk_set_memalloc(config->socks[i]->sock->sk);
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index b942f4c8cea8..d3ad1b8c133e 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2097,7 +2097,7 @@ static int rbd_img_fill_nodata(struct rbd_img_request *img_req,
+ u64 off, u64 len)
+ {
+ struct ceph_file_extent ex = { off, len };
+- union rbd_img_fill_iter dummy;
++ union rbd_img_fill_iter dummy = {};
+ struct rbd_img_fill_ctx fctx = {
+ .pos_type = OBJ_REQUEST_NODATA,
+ .pos = &dummy,
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 53e822793d46..28b110cd3977 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1609,8 +1609,9 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
+ print_once = true;
+ #endif
+ if (__ratelimit(&unseeded_warning))
+- pr_notice("random: %s called from %pS with crng_init=%d\n",
+- func_name, caller, crng_init);
++ printk_deferred(KERN_NOTICE "random: %s called from %pS "
++ "with crng_init=%d\n", func_name, caller,
++ crng_init);
+ }
+
+ /*
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index 51b2388d80ac..ee693e15d9eb 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -203,6 +203,9 @@ static int _freq_tbl_determine_rate(struct clk_hw *hw, const struct freq_tbl *f,
+
+ clk_flags = clk_hw_get_flags(hw);
+ p = clk_hw_get_parent_by_index(hw, index);
++ if (!p)
++ return -EINVAL;
++
+ if (clk_flags & CLK_SET_RATE_PARENT) {
+ rate = f->freq;
+ if (f->pre_div) {
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index dec4a130390a..9ac6c299e074 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -901,11 +901,26 @@ static const struct sunxi_ccu_desc sun50i_a64_ccu_desc = {
+ .num_resets = ARRAY_SIZE(sun50i_a64_ccu_resets),
+ };
+
++static struct ccu_pll_nb sun50i_a64_pll_cpu_nb = {
++ .common = &pll_cpux_clk.common,
++ /* copy from pll_cpux_clk */
++ .enable = BIT(31),
++ .lock = BIT(28),
++};
++
++static struct ccu_mux_nb sun50i_a64_cpu_nb = {
++ .common = &cpux_clk.common,
++ .cm = &cpux_clk.mux,
++ .delay_us = 1, /* > 8 clock cycles at 24 MHz */
++ .bypass_index = 1, /* index of 24 MHz oscillator */
++};
++
+ static int sun50i_a64_ccu_probe(struct platform_device *pdev)
+ {
+ struct resource *res;
+ void __iomem *reg;
+ u32 val;
++ int ret;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ reg = devm_ioremap_resource(&pdev->dev, res);
+@@ -919,7 +934,18 @@ static int sun50i_a64_ccu_probe(struct platform_device *pdev)
+
+ writel(0x515, reg + SUN50I_A64_PLL_MIPI_REG);
+
+- return sunxi_ccu_probe(pdev->dev.of_node, reg, &sun50i_a64_ccu_desc);
++ ret = sunxi_ccu_probe(pdev->dev.of_node, reg, &sun50i_a64_ccu_desc);
++ if (ret)
++ return ret;
++
++ /* Gate then ungate PLL CPU after any rate changes */
++ ccu_pll_notifier_register(&sun50i_a64_pll_cpu_nb);
++
++ /* Reparent CPU during PLL CPU rate changes */
++ ccu_mux_notifier_register(pll_cpux_clk.common.hw.clk,
++ &sun50i_a64_cpu_nb);
++
++ return 0;
+ }
+
+ static const struct of_device_id sun50i_a64_ccu_ids[] = {
+diff --git a/drivers/clk/uniphier/clk-uniphier-peri.c b/drivers/clk/uniphier/clk-uniphier-peri.c
+index 89b3ac378b3f..8b75dc116a98 100644
+--- a/drivers/clk/uniphier/clk-uniphier-peri.c
++++ b/drivers/clk/uniphier/clk-uniphier-peri.c
+@@ -27,8 +27,8 @@
+ #define UNIPHIER_PERI_CLK_FI2C(idx, ch) \
+ UNIPHIER_CLK_GATE("i2c" #ch, (idx), "i2c", 0x24, 24 + (ch))
+
+-#define UNIPHIER_PERI_CLK_SCSSI(idx) \
+- UNIPHIER_CLK_GATE("scssi", (idx), "spi", 0x20, 17)
++#define UNIPHIER_PERI_CLK_SCSSI(idx, ch) \
++ UNIPHIER_CLK_GATE("scssi" #ch, (idx), "spi", 0x20, 17 + (ch))
+
+ #define UNIPHIER_PERI_CLK_MCSSI(idx) \
+ UNIPHIER_CLK_GATE("mcssi", (idx), "spi", 0x24, 14)
+@@ -44,7 +44,7 @@ const struct uniphier_clk_data uniphier_ld4_peri_clk_data[] = {
+ UNIPHIER_PERI_CLK_I2C(6, 2),
+ UNIPHIER_PERI_CLK_I2C(7, 3),
+ UNIPHIER_PERI_CLK_I2C(8, 4),
+- UNIPHIER_PERI_CLK_SCSSI(11),
++ UNIPHIER_PERI_CLK_SCSSI(11, 0),
+ { /* sentinel */ }
+ };
+
+@@ -60,7 +60,10 @@ const struct uniphier_clk_data uniphier_pro4_peri_clk_data[] = {
+ UNIPHIER_PERI_CLK_FI2C(8, 4),
+ UNIPHIER_PERI_CLK_FI2C(9, 5),
+ UNIPHIER_PERI_CLK_FI2C(10, 6),
+- UNIPHIER_PERI_CLK_SCSSI(11),
+- UNIPHIER_PERI_CLK_MCSSI(12),
++ UNIPHIER_PERI_CLK_SCSSI(11, 0),
++ UNIPHIER_PERI_CLK_SCSSI(12, 1),
++ UNIPHIER_PERI_CLK_SCSSI(13, 2),
++ UNIPHIER_PERI_CLK_SCSSI(14, 3),
++ UNIPHIER_PERI_CLK_MCSSI(15),
+ { /* sentinel */ }
+ };
+diff --git a/drivers/clocksource/bcm2835_timer.c b/drivers/clocksource/bcm2835_timer.c
+index 60da2537bef9..1082dcef17d1 100644
+--- a/drivers/clocksource/bcm2835_timer.c
++++ b/drivers/clocksource/bcm2835_timer.c
+@@ -134,7 +134,7 @@ static int __init bcm2835_timer_init(struct device_node *node)
+ ret = setup_irq(irq, &timer->act);
+ if (ret) {
+ pr_err("Can't set up timer IRQ\n");
+- goto err_iounmap;
++ goto err_timer_free;
+ }
+
+ clockevents_config_and_register(&timer->evt, freq, 0xf, 0xffffffff);
+@@ -143,6 +143,9 @@ static int __init bcm2835_timer_init(struct device_node *node)
+
+ return 0;
+
++err_timer_free:
++ kfree(timer);
++
+ err_iounmap:
+ iounmap(base);
+ return ret;
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index 8b749c721c87..28d24118c645 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -731,6 +731,14 @@ static int chtls_close_listsrv_rpl(struct chtls_dev *cdev, struct sk_buff *skb)
+ return 0;
+ }
+
++static void chtls_purge_wr_queue(struct sock *sk)
++{
++ struct sk_buff *skb;
++
++ while ((skb = dequeue_wr(sk)) != NULL)
++ kfree_skb(skb);
++}
++
+ static void chtls_release_resources(struct sock *sk)
+ {
+ struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
+@@ -745,6 +753,11 @@ static void chtls_release_resources(struct sock *sk)
+ kfree_skb(csk->txdata_skb_cache);
+ csk->txdata_skb_cache = NULL;
+
++ if (csk->wr_credits != csk->wr_max_credits) {
++ chtls_purge_wr_queue(sk);
++ chtls_reset_wr_list(csk);
++ }
++
+ if (csk->l2t_entry) {
+ cxgb4_l2t_release(csk->l2t_entry);
+ csk->l2t_entry = NULL;
+@@ -1714,6 +1727,7 @@ static void chtls_peer_close(struct sock *sk, struct sk_buff *skb)
+ else
+ sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
+ }
++ kfree_skb(skb);
+ }
+
+ static void chtls_close_con_rpl(struct sock *sk, struct sk_buff *skb)
+@@ -2041,19 +2055,6 @@ rel_skb:
+ return 0;
+ }
+
+-static struct sk_buff *dequeue_wr(struct sock *sk)
+-{
+- struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
+- struct sk_buff *skb = csk->wr_skb_head;
+-
+- if (likely(skb)) {
+- /* Don't bother clearing the tail */
+- csk->wr_skb_head = WR_SKB_CB(skb)->next_wr;
+- WR_SKB_CB(skb)->next_wr = NULL;
+- }
+- return skb;
+-}
+-
+ static void chtls_rx_ack(struct sock *sk, struct sk_buff *skb)
+ {
+ struct cpl_fw4_ack *hdr = cplhdr(skb) + RSS_HDR;
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.h b/drivers/crypto/chelsio/chtls/chtls_cm.h
+index 78eb3afa3a80..4282d8a4eae4 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.h
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.h
+@@ -188,6 +188,12 @@ static inline void chtls_kfree_skb(struct sock *sk, struct sk_buff *skb)
+ kfree_skb(skb);
+ }
+
++static inline void chtls_reset_wr_list(struct chtls_sock *csk)
++{
++ csk->wr_skb_head = NULL;
++ csk->wr_skb_tail = NULL;
++}
++
+ static inline void enqueue_wr(struct chtls_sock *csk, struct sk_buff *skb)
+ {
+ WR_SKB_CB(skb)->next_wr = NULL;
+@@ -200,4 +206,19 @@ static inline void enqueue_wr(struct chtls_sock *csk, struct sk_buff *skb)
+ WR_SKB_CB(csk->wr_skb_tail)->next_wr = skb;
+ csk->wr_skb_tail = skb;
+ }
++
++static inline struct sk_buff *dequeue_wr(struct sock *sk)
++{
++ struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
++ struct sk_buff *skb = NULL;
++
++ skb = csk->wr_skb_head;
++
++ if (likely(skb)) {
++ /* Don't bother clearing the tail */
++ csk->wr_skb_head = WR_SKB_CB(skb)->next_wr;
++ WR_SKB_CB(skb)->next_wr = NULL;
++ }
++ return skb;
++}
+ #endif
+diff --git a/drivers/crypto/chelsio/chtls/chtls_hw.c b/drivers/crypto/chelsio/chtls/chtls_hw.c
+index 490960755864..64d24823c65a 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_hw.c
++++ b/drivers/crypto/chelsio/chtls/chtls_hw.c
+@@ -361,6 +361,7 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, u32 optname)
+ kwr->sc_imm.cmd_more = cpu_to_be32(ULPTX_CMD_V(ULP_TX_SC_IMM));
+ kwr->sc_imm.len = cpu_to_be32(klen);
+
++ lock_sock(sk);
+ /* key info */
+ kctx = (struct _key_ctx *)(kwr + 1);
+ ret = chtls_key_info(csk, kctx, keylen, optname);
+@@ -399,8 +400,10 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, u32 optname)
+ csk->tlshws.txkey = keyid;
+ }
+
++ release_sock(sk);
+ return ret;
+ out_notcb:
++ release_sock(sk);
+ free_tls_keyid(sk);
+ out_nokey:
+ kfree_skb(skb);
+diff --git a/drivers/devfreq/Kconfig b/drivers/devfreq/Kconfig
+index 6a172d338f6d..4c4ec68b0566 100644
+--- a/drivers/devfreq/Kconfig
++++ b/drivers/devfreq/Kconfig
+@@ -103,7 +103,8 @@ config ARM_TEGRA_DEVFREQ
+
+ config ARM_RK3399_DMC_DEVFREQ
+ tristate "ARM RK3399 DMC DEVFREQ Driver"
+- depends on ARCH_ROCKCHIP
++ depends on (ARCH_ROCKCHIP && HAVE_ARM_SMCCC) || \
++ (COMPILE_TEST && HAVE_ARM_SMCCC)
+ select DEVFREQ_EVENT_ROCKCHIP_DFI
+ select DEVFREQ_GOV_SIMPLE_ONDEMAND
+ select PM_DEVFREQ_EVENT
+diff --git a/drivers/devfreq/event/Kconfig b/drivers/devfreq/event/Kconfig
+index cd949800eed9..8851bc4e8e3e 100644
+--- a/drivers/devfreq/event/Kconfig
++++ b/drivers/devfreq/event/Kconfig
+@@ -33,7 +33,7 @@ config DEVFREQ_EVENT_EXYNOS_PPMU
+
+ config DEVFREQ_EVENT_ROCKCHIP_DFI
+ tristate "ROCKCHIP DFI DEVFREQ event Driver"
+- depends on ARCH_ROCKCHIP
++ depends on ARCH_ROCKCHIP || COMPILE_TEST
+ help
+ This add the devfreq-event driver for Rockchip SoC. It provides DFI
+ (DDR Monitor Module) driver to count ddr load.
+diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
+index f1a441ab395d..8a52a5efee4f 100644
+--- a/drivers/dma/dmaengine.c
++++ b/drivers/dma/dmaengine.c
+@@ -190,7 +190,7 @@ __dma_device_satisfies_mask(struct dma_device *device,
+
+ static struct module *dma_chan_to_owner(struct dma_chan *chan)
+ {
+- return chan->device->dev->driver->owner;
++ return chan->device->owner;
+ }
+
+ /**
+@@ -923,6 +923,8 @@ int dma_async_device_register(struct dma_device *device)
+ return -EIO;
+ }
+
++ device->owner = device->dev->driver->owner;
++
+ if (dma_has_cap(DMA_MEMCPY, device->cap_mask) && !device->device_prep_dma_memcpy) {
+ dev_err(device->dev,
+ "Device claims capability %s, but op is not defined\n",
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index ceb82e74f5b4..d66a7fdff898 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -738,12 +738,8 @@ static void sdma_start_desc(struct sdma_channel *sdmac)
+ return;
+ }
+ sdmac->desc = desc = to_sdma_desc(&vd->tx);
+- /*
+- * Do not delete the node in desc_issued list in cyclic mode, otherwise
+- * the desc allocated will never be freed in vchan_dma_desc_free_list
+- */
+- if (!(sdmac->flags & IMX_DMA_SG_LOOP))
+- list_del(&vd->node);
++
++ list_del(&vd->node);
+
+ sdma->channel_control[channel].base_bd_ptr = desc->bd_phys;
+ sdma->channel_control[channel].current_bd_ptr = desc->bd_phys;
+@@ -1044,7 +1040,6 @@ static void sdma_channel_terminate_work(struct work_struct *work)
+
+ spin_lock_irqsave(&sdmac->vc.lock, flags);
+ vchan_get_all_descriptors(&sdmac->vc, &head);
+- sdmac->desc = NULL;
+ spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+ vchan_dma_desc_free_list(&sdmac->vc, &head);
+ }
+@@ -1052,11 +1047,19 @@ static void sdma_channel_terminate_work(struct work_struct *work)
+ static int sdma_disable_channel_async(struct dma_chan *chan)
+ {
+ struct sdma_channel *sdmac = to_sdma_chan(chan);
++ unsigned long flags;
++
++ spin_lock_irqsave(&sdmac->vc.lock, flags);
+
+ sdma_disable_channel(chan);
+
+- if (sdmac->desc)
++ if (sdmac->desc) {
++ vchan_terminate_vdesc(&sdmac->desc->vd);
++ sdmac->desc = NULL;
+ schedule_work(&sdmac->terminate_worker);
++ }
++
++ spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+
+ return 0;
+ }
+diff --git a/drivers/gpio/gpio-grgpio.c b/drivers/gpio/gpio-grgpio.c
+index 60a1556c570a..c1be299e5567 100644
+--- a/drivers/gpio/gpio-grgpio.c
++++ b/drivers/gpio/gpio-grgpio.c
+@@ -258,17 +258,16 @@ static int grgpio_irq_map(struct irq_domain *d, unsigned int irq,
+ lirq->irq = irq;
+ uirq = &priv->uirqs[lirq->index];
+ if (uirq->refcnt == 0) {
++ spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+ ret = request_irq(uirq->uirq, grgpio_irq_handler, 0,
+ dev_name(priv->dev), priv);
+ if (ret) {
+ dev_err(priv->dev,
+ "Could not request underlying irq %d\n",
+ uirq->uirq);
+-
+- spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+-
+ return ret;
+ }
++ spin_lock_irqsave(&priv->gc.bgpio_lock, flags);
+ }
+ uirq->refcnt++;
+
+@@ -314,8 +313,11 @@ static void grgpio_irq_unmap(struct irq_domain *d, unsigned int irq)
+ if (index >= 0) {
+ uirq = &priv->uirqs[lirq->index];
+ uirq->refcnt--;
+- if (uirq->refcnt == 0)
++ if (uirq->refcnt == 0) {
++ spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+ free_irq(uirq->uirq, priv);
++ return;
++ }
+ }
+
+ spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+index bf872f694f50..d1fbaea91f58 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+@@ -337,17 +337,9 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
+ path_size += le16_to_cpu(path->usSize);
+
+ if (device_support & le16_to_cpu(path->usDeviceTag)) {
+- uint8_t con_obj_id, con_obj_num, con_obj_type;
+-
+- con_obj_id =
++ uint8_t con_obj_id =
+ (le16_to_cpu(path->usConnObjectId) & OBJECT_ID_MASK)
+ >> OBJECT_ID_SHIFT;
+- con_obj_num =
+- (le16_to_cpu(path->usConnObjectId) & ENUM_ID_MASK)
+- >> ENUM_ID_SHIFT;
+- con_obj_type =
+- (le16_to_cpu(path->usConnObjectId) &
+- OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+
+ /* Skip TV/CV support */
+ if ((le16_to_cpu(path->usDeviceTag) ==
+@@ -372,14 +364,7 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
+ router.ddc_valid = false;
+ router.cd_valid = false;
+ for (j = 0; j < ((le16_to_cpu(path->usSize) - 8) / 2); j++) {
+- uint8_t grph_obj_id, grph_obj_num, grph_obj_type;
+-
+- grph_obj_id =
+- (le16_to_cpu(path->usGraphicObjIds[j]) &
+- OBJECT_ID_MASK) >> OBJECT_ID_SHIFT;
+- grph_obj_num =
+- (le16_to_cpu(path->usGraphicObjIds[j]) &
+- ENUM_ID_MASK) >> ENUM_ID_SHIFT;
++ uint8_t grph_obj_type=
+ grph_obj_type =
+ (le16_to_cpu(path->usGraphicObjIds[j]) &
+ OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15_common.h b/drivers/gpu/drm/amd/amdgpu/soc15_common.h
+index 0942f492d2e1..9d444f7fdfcd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15_common.h
++++ b/drivers/gpu/drm/amd/amdgpu/soc15_common.h
+@@ -51,6 +51,7 @@
+ do { \
+ uint32_t tmp_ = RREG32(adev->reg_offset[ip##_HWIP][inst][reg##_BASE_IDX] + reg); \
+ uint32_t loop = adev->usec_timeout; \
++ ret = 0; \
+ while ((tmp_ & (mask)) != (expected_value)) { \
+ udelay(2); \
+ tmp_ = RREG32(adev->reg_offset[ip##_HWIP][inst][reg##_BASE_IDX] + reg); \
+diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calc_math.h b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calc_math.h
+deleted file mode 100644
+index f46ab0e24ca1..000000000000
+--- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calc_math.h
++++ /dev/null
+@@ -1,40 +0,0 @@
+-/*
+- * Copyright 2017 Advanced Micro Devices, Inc.
+- *
+- * Permission is hereby granted, free of charge, to any person obtaining a
+- * copy of this software and associated documentation files (the "Software"),
+- * to deal in the Software without restriction, including without limitation
+- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+- * and/or sell copies of the Software, and to permit persons to whom the
+- * Software is furnished to do so, subject to the following conditions:
+- *
+- * The above copyright notice and this permission notice shall be included in
+- * all copies or substantial portions of the Software.
+- *
+- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+- * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+- * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+- * OTHER DEALINGS IN THE SOFTWARE.
+- *
+- * Authors: AMD
+- *
+- */
+-
+-#ifndef _DCN_CALC_MATH_H_
+-#define _DCN_CALC_MATH_H_
+-
+-float dcn_bw_mod(const float arg1, const float arg2);
+-float dcn_bw_min2(const float arg1, const float arg2);
+-unsigned int dcn_bw_max(const unsigned int arg1, const unsigned int arg2);
+-float dcn_bw_max2(const float arg1, const float arg2);
+-float dcn_bw_floor2(const float arg, const float significance);
+-float dcn_bw_ceil2(const float arg, const float significance);
+-float dcn_bw_max3(float v1, float v2, float v3);
+-float dcn_bw_max5(float v1, float v2, float v3, float v4, float v5);
+-float dcn_bw_pow(float a, float exp);
+-float dcn_bw_log(float a, float b);
+-
+-#endif /* _DCN_CALC_MATH_H_ */
+diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+index 6342f6499351..b0956c360393 100644
+--- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
++++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+@@ -1346,6 +1346,7 @@ void dcn_bw_update_from_pplib(struct dc *dc)
+ struct dc_context *ctx = dc->ctx;
+ struct dm_pp_clock_levels_with_voltage fclks = {0}, dcfclks = {0};
+ bool res;
++ unsigned vmin0p65_idx, vmid0p72_idx, vnom0p8_idx, vmax0p9_idx;
+
+ /* TODO: This is not the proper way to obtain fabric_and_dram_bandwidth, should be min(fclk, memclk) */
+ res = dm_pp_get_clock_levels_by_type_with_voltage(
+@@ -1357,17 +1358,28 @@ void dcn_bw_update_from_pplib(struct dc *dc)
+ res = verify_clock_values(&fclks);
+
+ if (res) {
+- ASSERT(fclks.num_levels >= 3);
+- dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 = 32 * (fclks.data[0].clocks_in_khz / 1000.0) / 1000.0;
+- dc->dcn_soc->fabric_and_dram_bandwidth_vmid0p72 = dc->dcn_soc->number_of_channels *
+- (fclks.data[fclks.num_levels - (fclks.num_levels > 2 ? 3 : 2)].clocks_in_khz / 1000.0)
+- * ddr4_dram_factor_single_Channel / 1000.0;
+- dc->dcn_soc->fabric_and_dram_bandwidth_vnom0p8 = dc->dcn_soc->number_of_channels *
+- (fclks.data[fclks.num_levels - 2].clocks_in_khz / 1000.0)
+- * ddr4_dram_factor_single_Channel / 1000.0;
+- dc->dcn_soc->fabric_and_dram_bandwidth_vmax0p9 = dc->dcn_soc->number_of_channels *
+- (fclks.data[fclks.num_levels - 1].clocks_in_khz / 1000.0)
+- * ddr4_dram_factor_single_Channel / 1000.0;
++ ASSERT(fclks.num_levels);
++
++ vmin0p65_idx = 0;
++ vmid0p72_idx = fclks.num_levels -
++ (fclks.num_levels > 2 ? 3 : (fclks.num_levels > 1 ? 2 : 1));
++ vnom0p8_idx = fclks.num_levels - (fclks.num_levels > 1 ? 2 : 1);
++ vmax0p9_idx = fclks.num_levels - 1;
++
++ dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 =
++ 32 * (fclks.data[vmin0p65_idx].clocks_in_khz / 1000.0) / 1000.0;
++ dc->dcn_soc->fabric_and_dram_bandwidth_vmid0p72 =
++ dc->dcn_soc->number_of_channels *
++ (fclks.data[vmid0p72_idx].clocks_in_khz / 1000.0)
++ * ddr4_dram_factor_single_Channel / 1000.0;
++ dc->dcn_soc->fabric_and_dram_bandwidth_vnom0p8 =
++ dc->dcn_soc->number_of_channels *
++ (fclks.data[vnom0p8_idx].clocks_in_khz / 1000.0)
++ * ddr4_dram_factor_single_Channel / 1000.0;
++ dc->dcn_soc->fabric_and_dram_bandwidth_vmax0p9 =
++ dc->dcn_soc->number_of_channels *
++ (fclks.data[vmax0p9_idx].clocks_in_khz / 1000.0)
++ * ddr4_dram_factor_single_Channel / 1000.0;
+ } else
+ BREAK_TO_DEBUGGER();
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 2f42964fb9f4..3abc0294c05f 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -780,8 +780,7 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
+ same_edid = is_same_edid(&prev_sink->dc_edid, &sink->dc_edid);
+
+ if (link->connector_signal == SIGNAL_TYPE_DISPLAY_PORT &&
+- sink_caps.transaction_type == DDC_TRANSACTION_TYPE_I2C_OVER_AUX &&
+- reason != DETECT_REASON_HPDRX) {
++ sink_caps.transaction_type == DDC_TRANSACTION_TYPE_I2C_OVER_AUX) {
+ /*
+ * TODO debug why Dell 2413 doesn't like
+ * two link trainings
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c b/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
+index b953b02a1512..723af0b2dda0 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
+@@ -24,7 +24,7 @@
+ */
+
+ #include "dml_common_defs.h"
+-#include "../calcs/dcn_calc_math.h"
++#include "dcn_calc_math.h"
+
+ #include "dml_inline_defs.h"
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
+index e8ce08567cd8..e4f595a3038c 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
++++ b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
+@@ -27,7 +27,7 @@
+ #define __DML_INLINE_DEFS_H__
+
+ #include "dml_common_defs.h"
+-#include "../calcs/dcn_calc_math.h"
++#include "dcn_calc_math.h"
+ #include "dml_logger.h"
+
+ static inline double dml_min(double a, double b)
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/dcn_calc_math.h b/drivers/gpu/drm/amd/display/dc/inc/dcn_calc_math.h
+new file mode 100644
+index 000000000000..f46ab0e24ca1
+--- /dev/null
++++ b/drivers/gpu/drm/amd/display/dc/inc/dcn_calc_math.h
+@@ -0,0 +1,40 @@
++/*
++ * Copyright 2017 Advanced Micro Devices, Inc.
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a
++ * copy of this software and associated documentation files (the "Software"),
++ * to deal in the Software without restriction, including without limitation
++ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
++ * and/or sell copies of the Software, and to permit persons to whom the
++ * Software is furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
++ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
++ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
++ * OTHER DEALINGS IN THE SOFTWARE.
++ *
++ * Authors: AMD
++ *
++ */
++
++#ifndef _DCN_CALC_MATH_H_
++#define _DCN_CALC_MATH_H_
++
++float dcn_bw_mod(const float arg1, const float arg2);
++float dcn_bw_min2(const float arg1, const float arg2);
++unsigned int dcn_bw_max(const unsigned int arg1, const unsigned int arg2);
++float dcn_bw_max2(const float arg1, const float arg2);
++float dcn_bw_floor2(const float arg, const float significance);
++float dcn_bw_ceil2(const float arg, const float significance);
++float dcn_bw_max3(float v1, float v2, float v3);
++float dcn_bw_max5(float v1, float v2, float v3, float v4, float v5);
++float dcn_bw_pow(float a, float exp);
++float dcn_bw_log(float a, float b);
++
++#endif /* _DCN_CALC_MATH_H_ */
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+index 1546bc49004f..48e31711bc68 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+@@ -994,12 +994,15 @@ static int smu10_get_clock_by_type_with_latency(struct pp_hwmgr *hwmgr,
+
+ clocks->num_levels = 0;
+ for (i = 0; i < pclk_vol_table->count; i++) {
+- clocks->data[i].clocks_in_khz = pclk_vol_table->entries[i].clk * 10;
+- clocks->data[i].latency_in_us = latency_required ?
+- smu10_get_mem_latency(hwmgr,
+- pclk_vol_table->entries[i].clk) :
+- 0;
+- clocks->num_levels++;
++ if (pclk_vol_table->entries[i].clk) {
++ clocks->data[clocks->num_levels].clocks_in_khz =
++ pclk_vol_table->entries[i].clk * 10;
++ clocks->data[clocks->num_levels].latency_in_us = latency_required ?
++ smu10_get_mem_latency(hwmgr,
++ pclk_vol_table->entries[i].clk) :
++ 0;
++ clocks->num_levels++;
++ }
+ }
+
+ return 0;
+@@ -1045,9 +1048,11 @@ static int smu10_get_clock_by_type_with_voltage(struct pp_hwmgr *hwmgr,
+
+ clocks->num_levels = 0;
+ for (i = 0; i < pclk_vol_table->count; i++) {
+- clocks->data[i].clocks_in_khz = pclk_vol_table->entries[i].clk * 10;
+- clocks->data[i].voltage_in_mv = pclk_vol_table->entries[i].vol;
+- clocks->num_levels++;
++ if (pclk_vol_table->entries[i].clk) {
++ clocks->data[clocks->num_levels].clocks_in_khz = pclk_vol_table->entries[i].clk * 10;
++ clocks->data[clocks->num_levels].voltage_in_mv = pclk_vol_table->entries[i].vol;
++ clocks->num_levels++;
++ }
+ }
+
+ return 0;
+diff --git a/drivers/gpu/drm/drm_debugfs_crc.c b/drivers/gpu/drm/drm_debugfs_crc.c
+index c88e5ff41add..a3c756710845 100644
+--- a/drivers/gpu/drm/drm_debugfs_crc.c
++++ b/drivers/gpu/drm/drm_debugfs_crc.c
+@@ -101,8 +101,8 @@ static ssize_t crc_control_write(struct file *file, const char __user *ubuf,
+ if (IS_ERR(source))
+ return PTR_ERR(source);
+
+- if (source[len] == '\n')
+- source[len] = '\0';
++ if (source[len - 1] == '\n')
++ source[len - 1] = '\0';
+
+ spin_lock_irq(&crc->lock);
+
+diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
+index adefae58b5fc..b4035ef72af8 100644
+--- a/drivers/gpu/drm/gma500/framebuffer.c
++++ b/drivers/gpu/drm/gma500/framebuffer.c
+@@ -480,6 +480,7 @@ static int psbfb_probe(struct drm_fb_helper *helper,
+ container_of(helper, struct psb_fbdev, psb_fb_helper);
+ struct drm_device *dev = psb_fbdev->psb_fb_helper.dev;
+ struct drm_psb_private *dev_priv = dev->dev_private;
++ unsigned int fb_size;
+ int bytespp;
+
+ bytespp = sizes->surface_bpp / 8;
+@@ -489,8 +490,11 @@ static int psbfb_probe(struct drm_fb_helper *helper,
+ /* If the mode will not fit in 32bit then switch to 16bit to get
+ a console on full resolution. The X mode setting server will
+ allocate its own 32bit GEM framebuffer */
+- if (ALIGN(sizes->fb_width * bytespp, 64) * sizes->fb_height >
+- dev_priv->vram_stolen_size) {
++ fb_size = ALIGN(sizes->surface_width * bytespp, 64) *
++ sizes->surface_height;
++ fb_size = ALIGN(fb_size, PAGE_SIZE);
++
++ if (fb_size > dev_priv->vram_stolen_size) {
+ sizes->surface_bpp = 16;
+ sizes->surface_depth = 16;
+ }
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index 92ecb9bf982c..b86ee7d25af3 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -308,6 +308,7 @@ err_pm_runtime_put:
+ static void mtk_crtc_ddp_hw_fini(struct mtk_drm_crtc *mtk_crtc)
+ {
+ struct drm_device *drm = mtk_crtc->base.dev;
++ struct drm_crtc *crtc = &mtk_crtc->base;
+ int i;
+
+ DRM_DEBUG_DRIVER("%s\n", __func__);
+@@ -329,6 +330,13 @@ static void mtk_crtc_ddp_hw_fini(struct mtk_drm_crtc *mtk_crtc)
+ mtk_disp_mutex_unprepare(mtk_crtc->mutex);
+
+ pm_runtime_put(drm->dev);
++
++ if (crtc->state->event && !crtc->state->active) {
++ spin_lock_irq(&crtc->dev->event_lock);
++ drm_crtc_send_vblank_event(crtc, crtc->state->event);
++ crtc->state->event = NULL;
++ spin_unlock_irq(&crtc->dev->event_lock);
++ }
+ }
+
+ static void mtk_crtc_ddp_config(struct drm_crtc *crtc)
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
+index 412d49bc6e56..ba3883aed456 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
+@@ -157,7 +157,7 @@ nouveau_fence_wait_uevent_handler(struct nvif_notify *notify)
+
+ fence = list_entry(fctx->pending.next, typeof(*fence), head);
+ chan = rcu_dereference_protected(fence->channel, lockdep_is_held(&fctx->lock));
+- if (nouveau_fence_update(fence->channel, fctx))
++ if (nouveau_fence_update(chan, fctx))
+ ret = NVIF_NOTIFY_DROP;
+ }
+ spin_unlock_irqrestore(&fctx->lock, flags);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+index e4b977cc8452..37715a2a2f3f 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+@@ -63,14 +63,12 @@ nouveau_vram_manager_new(struct ttm_mem_type_manager *man,
+ {
+ struct nouveau_bo *nvbo = nouveau_bo(bo);
+ struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
+- struct nouveau_mem *mem;
+ int ret;
+
+ if (drm->client.device.info.ram_size == 0)
+ return -ENOMEM;
+
+ ret = nouveau_mem_new(&drm->master, nvbo->kind, nvbo->comp, reg);
+- mem = nouveau_mem(reg);
+ if (ret)
+ return ret;
+
+@@ -103,11 +101,9 @@ nouveau_gart_manager_new(struct ttm_mem_type_manager *man,
+ {
+ struct nouveau_bo *nvbo = nouveau_bo(bo);
+ struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
+- struct nouveau_mem *mem;
+ int ret;
+
+ ret = nouveau_mem_new(&drm->master, nvbo->kind, nvbo->comp, reg);
+- mem = nouveau_mem(reg);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/memory.c b/drivers/gpu/drm/nouveau/nvkm/core/memory.c
+index e85a08ecd9da..4cc186262d34 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/memory.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/memory.c
+@@ -91,8 +91,8 @@ nvkm_memory_tags_get(struct nvkm_memory *memory, struct nvkm_device *device,
+ }
+
+ refcount_set(&tags->refcount, 1);
++ *ptags = memory->tags = tags;
+ mutex_unlock(&fb->subdev.mutex);
+- *ptags = tags;
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
+index bcf32d92ee5a..50e3539f33d2 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
+@@ -74,6 +74,8 @@ nv50_disp_chan_mthd(struct nv50_disp_chan *chan, int debug)
+
+ if (debug > subdev->debug)
+ return;
++ if (!mthd)
++ return;
+
+ for (i = 0; (list = mthd->data[i].mthd) != NULL; i++) {
+ u32 base = chan->head * mthd->addr;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
+index 500cb08dd608..b57ab5cea9a1 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
+@@ -143,23 +143,24 @@ gk20a_gr_av_to_method(struct gf100_gr *gr, const char *fw_name,
+
+ nent = (fuc.size / sizeof(struct gk20a_fw_av));
+
+- pack = vzalloc((sizeof(*pack) * max_classes) +
+- (sizeof(*init) * (nent + 1)));
++ pack = vzalloc((sizeof(*pack) * (max_classes + 1)) +
++ (sizeof(*init) * (nent + max_classes + 1)));
+ if (!pack) {
+ ret = -ENOMEM;
+ goto end;
+ }
+
+- init = (void *)(pack + max_classes);
++ init = (void *)(pack + max_classes + 1);
+
+- for (i = 0; i < nent; i++) {
+- struct gf100_gr_init *ent = &init[i];
++ for (i = 0; i < nent; i++, init++) {
+ struct gk20a_fw_av *av = &((struct gk20a_fw_av *)fuc.data)[i];
+ u32 class = av->addr & 0xffff;
+ u32 addr = (av->addr & 0xffff0000) >> 14;
+
+ if (prevclass != class) {
+- pack[classidx].init = ent;
++ if (prevclass) /* Add terminator to the method list. */
++ init++;
++ pack[classidx].init = init;
+ pack[classidx].type = class;
+ prevclass = class;
+ if (++classidx >= max_classes) {
+@@ -169,10 +170,10 @@ gk20a_gr_av_to_method(struct gf100_gr *gr, const char *fw_name,
+ }
+ }
+
+- ent->addr = addr;
+- ent->data = av->data;
+- ent->count = 1;
+- ent->pitch = 1;
++ init->addr = addr;
++ init->data = av->data;
++ init->count = 1;
++ init->pitch = 1;
+ }
+
+ *ppack = pack;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
+index 16ad91c91a7b..f18ce6ff5b7e 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
+@@ -150,6 +150,7 @@ nvkm_fault_dtor(struct nvkm_subdev *subdev)
+ struct nvkm_fault *fault = nvkm_fault(subdev);
+ int i;
+
++ nvkm_notify_fini(&fault->nrpfb);
+ nvkm_event_fini(&fault->event);
+
+ for (i = 0; i < fault->buffer_nr; i++) {
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
+index df8b919dcf09..ace6fefba428 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
+@@ -108,6 +108,7 @@ gm20b_secboot_new(struct nvkm_device *device, int index,
+ struct gm200_secboot *gsb;
+ struct nvkm_acr *acr;
+
++ *psb = NULL;
+ acr = acr_r352_new(BIT(NVKM_SECBOOT_FALCON_FECS) |
+ BIT(NVKM_SECBOOT_FALCON_PMU));
+ if (IS_ERR(acr))
+@@ -116,10 +117,8 @@ gm20b_secboot_new(struct nvkm_device *device, int index,
+ acr->optional_falcons = BIT(NVKM_SECBOOT_FALCON_PMU);
+
+ gsb = kzalloc(sizeof(*gsb), GFP_KERNEL);
+- if (!gsb) {
+- psb = NULL;
++ if (!gsb)
+ return -ENOMEM;
+- }
+ *psb = &gsb->base;
+
+ ret = nvkm_secboot_ctor(&gm20b_secboot, acr, device, index, &gsb->base);
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index d8e2d7b3b836..7d1e14f0140a 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -121,6 +121,8 @@ static void dce5_crtc_load_lut(struct drm_crtc *crtc)
+
+ DRM_DEBUG_KMS("%d\n", radeon_crtc->crtc_id);
+
++ msleep(10);
++
+ WREG32(NI_INPUT_CSC_CONTROL + radeon_crtc->crtc_offset,
+ (NI_INPUT_CSC_GRPH_MODE(NI_INPUT_CSC_BYPASS) |
+ NI_INPUT_CSC_OVL_MODE(NI_INPUT_CSC_BYPASS)));
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+index 3b75af9bf85f..f27bd7cff579 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+@@ -210,8 +210,10 @@ int vmw_cmdbuf_res_add(struct vmw_cmdbuf_res_manager *man,
+
+ cres->hash.key = user_key | (res_type << 24);
+ ret = drm_ht_insert_item(&man->resources, &cres->hash);
+- if (unlikely(ret != 0))
++ if (unlikely(ret != 0)) {
++ kfree(cres);
+ goto out_invalid_key;
++ }
+
+ cres->state = VMW_CMDBUF_RES_ADD;
+ cres->res = vmw_resource_reference(res);
+diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
+index b127ed60c733..9dde8390da09 100644
+--- a/drivers/ide/cmd64x.c
++++ b/drivers/ide/cmd64x.c
+@@ -65,6 +65,9 @@ static void cmd64x_program_timings(ide_drive_t *drive, u8 mode)
+ struct ide_timing t;
+ u8 arttim = 0;
+
++ if (drive->dn >= ARRAY_SIZE(drwtim_regs))
++ return;
++
+ ide_timing_compute(drive, mode, &t, T, 0);
+
+ /*
+diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
+index a97affca18ab..0f57d45484d1 100644
+--- a/drivers/ide/serverworks.c
++++ b/drivers/ide/serverworks.c
+@@ -114,6 +114,9 @@ static void svwks_set_pio_mode(ide_hwif_t *hwif, ide_drive_t *drive)
+ struct pci_dev *dev = to_pci_dev(hwif->dev);
+ const u8 pio = drive->pio_mode - XFER_PIO_0;
+
++ if (drive->dn >= ARRAY_SIZE(drive_pci))
++ return;
++
+ pci_write_config_byte(dev, drive_pci[drive->dn], pio_modes[pio]);
+
+ if (svwks_csb_check(dev)) {
+@@ -140,6 +143,9 @@ static void svwks_set_dma_mode(ide_hwif_t *hwif, ide_drive_t *drive)
+
+ u8 ultra_enable = 0, ultra_timing = 0, dma_timing = 0;
+
++ if (drive->dn >= ARRAY_SIZE(drive_pci2))
++ return;
++
+ pci_read_config_byte(dev, (0x56|hwif->channel), &ultra_timing);
+ pci_read_config_byte(dev, 0x54, &ultra_enable);
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index b09a4b1cf397..1221faea75a6 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -1687,6 +1687,14 @@ static u64 access_sw_pio_drain(const struct cntr_entry *entry,
+ return dd->verbs_dev.n_piodrain;
+ }
+
++static u64 access_sw_ctx0_seq_drop(const struct cntr_entry *entry,
++ void *context, int vl, int mode, u64 data)
++{
++ struct hfi1_devdata *dd = context;
++
++ return dd->ctx0_seq_drop;
++}
++
+ static u64 access_sw_vtx_wait(const struct cntr_entry *entry,
+ void *context, int vl, int mode, u64 data)
+ {
+@@ -4247,6 +4255,8 @@ static struct cntr_entry dev_cntrs[DEV_CNTR_LAST] = {
+ access_sw_cpu_intr),
+ [C_SW_CPU_RCV_LIM] = CNTR_ELEM("RcvLimit", 0, 0, CNTR_NORMAL,
+ access_sw_cpu_rcv_limit),
++[C_SW_CTX0_SEQ_DROP] = CNTR_ELEM("SeqDrop0", 0, 0, CNTR_NORMAL,
++ access_sw_ctx0_seq_drop),
+ [C_SW_VTX_WAIT] = CNTR_ELEM("vTxWait", 0, 0, CNTR_NORMAL,
+ access_sw_vtx_wait),
+ [C_SW_PIO_WAIT] = CNTR_ELEM("PioWait", 0, 0, CNTR_NORMAL,
+diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
+index 36b04d6300e5..c9a352d8a7e1 100644
+--- a/drivers/infiniband/hw/hfi1/chip.h
++++ b/drivers/infiniband/hw/hfi1/chip.h
+@@ -909,6 +909,7 @@ enum {
+ C_DC_PG_STS_TX_MBE_CNT,
+ C_SW_CPU_INTR,
+ C_SW_CPU_RCV_LIM,
++ C_SW_CTX0_SEQ_DROP,
+ C_SW_VTX_WAIT,
+ C_SW_PIO_WAIT,
+ C_SW_PIO_DRAIN,
+diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
+index d5277c23cba6..769e114567a0 100644
+--- a/drivers/infiniband/hw/hfi1/driver.c
++++ b/drivers/infiniband/hw/hfi1/driver.c
+@@ -734,6 +734,7 @@ static noinline int skip_rcv_packet(struct hfi1_packet *packet, int thread)
+ {
+ int ret;
+
++ packet->rcd->dd->ctx0_seq_drop++;
+ /* Set up for the next packet */
+ packet->rhqoff += packet->rsize;
+ if (packet->rhqoff >= packet->maxcnt)
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index ab981874c71c..e38de547785d 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1093,6 +1093,8 @@ struct hfi1_devdata {
+
+ char *boardname; /* human readable board info */
+
++ u64 ctx0_seq_drop;
++
+ /* reset value */
+ u64 z_int_counter;
+ u64 z_rcv_limit;
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index 6a75f96b9096..b4e24362edbb 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -407,7 +407,7 @@ struct rxe_dev {
+ struct list_head pending_mmaps;
+
+ spinlock_t mmap_offset_lock; /* guard mmap_offset */
+- int mmap_offset;
++ u64 mmap_offset;
+
+ atomic64_t stats_counters[RXE_NUM_OF_COUNTERS];
+
+diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
+index 1e18ca0d1b4e..3fdaa644a82c 100644
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -968,6 +968,7 @@ static int edt_ft5x06_ts_probe(struct i2c_client *client,
+ {
+ const struct edt_i2c_chip_data *chip_data;
+ struct edt_ft5x06_ts_data *tsdata;
++ u8 buf[2] = { 0xfc, 0x00 };
+ struct input_dev *input;
+ unsigned long irq_flags;
+ int error;
+@@ -1037,6 +1038,12 @@ static int edt_ft5x06_ts_probe(struct i2c_client *client,
+ return error;
+ }
+
++ /*
++ * Dummy read access. EP0700MLP1 returns bogus data on the first
++ * register read access and ignores writes.
++ */
++ edt_ft5x06_ts_readwrite(tsdata->client, 2, buf, 2, buf);
++
+ edt_ft5x06_ts_set_regs(tsdata);
+ edt_ft5x06_ts_get_defaults(&client->dev, tsdata);
+ edt_ft5x06_ts_get_parameters(tsdata);
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index eff1f3aa5ef4..6b7664052b5b 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -1185,7 +1185,8 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid,
+ }
+
+ arm_smmu_sync_ste_for_sid(smmu, sid);
+- dst[0] = cpu_to_le64(val);
++ /* See comment in arm_smmu_write_ctx_desc() */
++ WRITE_ONCE(dst[0], cpu_to_le64(val));
+ arm_smmu_sync_ste_for_sid(smmu, sid);
+
+ /* It's likely that we'll want to use the new STE soon */
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 7f9824b0609e..72994d67bc5b 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1345,7 +1345,6 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid,
+ struct qi_desc desc;
+
+ if (mask) {
+- WARN_ON_ONCE(addr & ((1ULL << (VTD_PAGE_SHIFT + mask)) - 1));
+ addr |= (1ULL << (VTD_PAGE_SHIFT + mask - 1)) - 1;
+ desc.high = QI_DEV_IOTLB_ADDR(addr) | QI_DEV_IOTLB_SIZE;
+ } else
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index fd8730b2cd46..5944d3b4dca3 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -377,7 +377,7 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_
+ /* Do not use PASID 0 in caching mode (virtualised IOMMU) */
+ ret = intel_pasid_alloc_id(svm,
+ !!cap_caching_mode(iommu->cap),
+- pasid_max - 1, GFP_KERNEL);
++ pasid_max, GFP_KERNEL);
+ if (ret < 0) {
+ kfree(svm);
+ kfree(sdev);
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 050d6e040128..bf7b69449b43 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -578,7 +578,7 @@ static struct its_collection *its_build_invall_cmd(struct its_node *its,
+ struct its_cmd_desc *desc)
+ {
+ its_encode_cmd(cmd, GITS_CMD_INVALL);
+- its_encode_collection(cmd, desc->its_mapc_cmd.col->col_id);
++ its_encode_collection(cmd, desc->its_invall_cmd.col->col_id);
+
+ its_fixup_cmd(cmd);
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index d5912f1ec884..ac888d7a0b00 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1347,6 +1347,7 @@ static struct
+ struct redist_region *redist_regs;
+ u32 nr_redist_regions;
+ bool single_redist;
++ int enabled_rdists;
+ u32 maint_irq;
+ int maint_irq_mode;
+ phys_addr_t vcpu_base;
+@@ -1441,8 +1442,10 @@ static int __init gic_acpi_match_gicc(struct acpi_subtable_header *header,
+ * If GICC is enabled and has valid gicr base address, then it means
+ * GICR base is presented via GICC
+ */
+- if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address)
++ if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address) {
++ acpi_data.enabled_rdists++;
+ return 0;
++ }
+
+ /*
+ * It's perfectly valid firmware can pass disabled GICC entry, driver
+@@ -1472,8 +1475,10 @@ static int __init gic_acpi_count_gicr_regions(void)
+
+ count = acpi_table_parse_madt(ACPI_MADT_TYPE_GENERIC_INTERRUPT,
+ gic_acpi_match_gicc, 0);
+- if (count > 0)
++ if (count > 0) {
+ acpi_data.single_redist = true;
++ count = acpi_data.enabled_rdists;
++ }
+
+ return count;
+ }
+diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
+index 98b6e1d4b1a6..f7fdbf5d183b 100644
+--- a/drivers/irqchip/irq-mbigen.c
++++ b/drivers/irqchip/irq-mbigen.c
+@@ -381,6 +381,7 @@ static struct platform_driver mbigen_platform_driver = {
+ .name = "Hisilicon MBIGEN-V2",
+ .of_match_table = mbigen_of_match,
+ .acpi_match_table = ACPI_PTR(mbigen_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = mbigen_device_probe,
+ };
+diff --git a/drivers/leds/leds-pca963x.c b/drivers/leds/leds-pca963x.c
+index 5c0908113e38..bbcde13b77f1 100644
+--- a/drivers/leds/leds-pca963x.c
++++ b/drivers/leds/leds-pca963x.c
+@@ -43,6 +43,8 @@
+ #define PCA963X_LED_PWM 0x2 /* Controlled through PWM */
+ #define PCA963X_LED_GRP_PWM 0x3 /* Controlled through PWM/GRPPWM */
+
++#define PCA963X_MODE2_OUTDRV 0x04 /* Open-drain or totem pole */
++#define PCA963X_MODE2_INVRT 0x10 /* Normal or inverted direction */
+ #define PCA963X_MODE2_DMBLNK 0x20 /* Enable blinking */
+
+ #define PCA963X_MODE1 0x00
+@@ -462,12 +464,12 @@ static int pca963x_probe(struct i2c_client *client,
+ PCA963X_MODE2);
+ /* Configure output: open-drain or totem pole (push-pull) */
+ if (pdata->outdrv == PCA963X_OPEN_DRAIN)
+- mode2 |= 0x01;
++ mode2 &= ~PCA963X_MODE2_OUTDRV;
+ else
+- mode2 |= 0x05;
++ mode2 |= PCA963X_MODE2_OUTDRV;
+ /* Configure direction: normal or inverted */
+ if (pdata->dir == PCA963X_INVERTED)
+- mode2 |= 0x10;
++ mode2 |= PCA963X_MODE2_INVRT;
+ i2c_smbus_write_byte_data(pca963x->chip->client, PCA963X_MODE2,
+ mode2);
+ }
+diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h
+index c71365e7c1fa..a50dcfda656f 100644
+--- a/drivers/md/bcache/bset.h
++++ b/drivers/md/bcache/bset.h
+@@ -397,7 +397,8 @@ void bch_btree_keys_stats(struct btree_keys *b, struct bset_stats *state);
+
+ /* Bkey utility code */
+
+-#define bset_bkey_last(i) bkey_idx((struct bkey *) (i)->d, (i)->keys)
++#define bset_bkey_last(i) bkey_idx((struct bkey *) (i)->d, \
++ (unsigned int)(i)->keys)
+
+ static inline struct bkey *bset_bkey_idx(struct bset *i, unsigned int idx)
+ {
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index c45d9ad01077..5b5cbfadd003 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1226,6 +1226,9 @@ static void cached_dev_free(struct closure *cl)
+
+ mutex_unlock(&bch_register_lock);
+
++ if (dc->sb_bio.bi_inline_vecs[0].bv_page)
++ put_page(bio_first_page_all(&dc->sb_bio));
++
+ if (!IS_ERR_OR_NULL(dc->bdev))
+ blkdev_put(dc->bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+
+diff --git a/drivers/media/i2c/mt9v032.c b/drivers/media/i2c/mt9v032.c
+index f74730d24d8f..04788692c9ff 100644
+--- a/drivers/media/i2c/mt9v032.c
++++ b/drivers/media/i2c/mt9v032.c
+@@ -431,10 +431,12 @@ static int mt9v032_enum_mbus_code(struct v4l2_subdev *subdev,
+ struct v4l2_subdev_pad_config *cfg,
+ struct v4l2_subdev_mbus_code_enum *code)
+ {
++ struct mt9v032 *mt9v032 = to_mt9v032(subdev);
++
+ if (code->index > 0)
+ return -EINVAL;
+
+- code->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++ code->code = mt9v032->format.code;
+ return 0;
+ }
+
+@@ -442,7 +444,11 @@ static int mt9v032_enum_frame_size(struct v4l2_subdev *subdev,
+ struct v4l2_subdev_pad_config *cfg,
+ struct v4l2_subdev_frame_size_enum *fse)
+ {
+- if (fse->index >= 3 || fse->code != MEDIA_BUS_FMT_SGRBG10_1X10)
++ struct mt9v032 *mt9v032 = to_mt9v032(subdev);
++
++ if (fse->index >= 3)
++ return -EINVAL;
++ if (mt9v032->format.code != fse->code)
+ return -EINVAL;
+
+ fse->min_width = MT9V032_WINDOW_WIDTH_DEF / (1 << fse->index);
+diff --git a/drivers/media/pci/cx23885/cx23885-cards.c b/drivers/media/pci/cx23885/cx23885-cards.c
+index ed3210dc50bc..642aefdbb7bb 100644
+--- a/drivers/media/pci/cx23885/cx23885-cards.c
++++ b/drivers/media/pci/cx23885/cx23885-cards.c
+@@ -811,6 +811,25 @@ struct cx23885_board cx23885_boards[] = {
+ .name = "Hauppauge WinTV-Starburst2",
+ .portb = CX23885_MPEG_DVB,
+ },
++ [CX23885_BOARD_AVERMEDIA_CE310B] = {
++ .name = "AVerMedia CE310B",
++ .porta = CX23885_ANALOG_VIDEO,
++ .force_bff = 1,
++ .input = {{
++ .type = CX23885_VMUX_COMPOSITE1,
++ .vmux = CX25840_VIN1_CH1 |
++ CX25840_NONE_CH2 |
++ CX25840_NONE0_CH3,
++ .amux = CX25840_AUDIO7,
++ }, {
++ .type = CX23885_VMUX_SVIDEO,
++ .vmux = CX25840_VIN8_CH1 |
++ CX25840_NONE_CH2 |
++ CX25840_VIN7_CH3 |
++ CX25840_SVIDEO_ON,
++ .amux = CX25840_AUDIO7,
++ } },
++ },
+ };
+ const unsigned int cx23885_bcount = ARRAY_SIZE(cx23885_boards);
+
+@@ -1134,6 +1153,10 @@ struct cx23885_subid cx23885_subids[] = {
+ .subvendor = 0x0070,
+ .subdevice = 0xf02a,
+ .card = CX23885_BOARD_HAUPPAUGE_STARBURST2,
++ }, {
++ .subvendor = 0x1461,
++ .subdevice = 0x3100,
++ .card = CX23885_BOARD_AVERMEDIA_CE310B,
+ },
+ };
+ const unsigned int cx23885_idcount = ARRAY_SIZE(cx23885_subids);
+@@ -2358,6 +2381,7 @@ void cx23885_card_setup(struct cx23885_dev *dev)
+ case CX23885_BOARD_DVBSKY_T982:
+ case CX23885_BOARD_VIEWCAST_260E:
+ case CX23885_BOARD_VIEWCAST_460E:
++ case CX23885_BOARD_AVERMEDIA_CE310B:
+ dev->sd_cx25840 = v4l2_i2c_new_subdev(&dev->v4l2_dev,
+ &dev->i2c_bus[2].i2c_adap,
+ "cx25840", 0x88 >> 1, NULL);
+diff --git a/drivers/media/pci/cx23885/cx23885-video.c b/drivers/media/pci/cx23885/cx23885-video.c
+index f8a3deadc77a..2a20c7165e1e 100644
+--- a/drivers/media/pci/cx23885/cx23885-video.c
++++ b/drivers/media/pci/cx23885/cx23885-video.c
+@@ -268,7 +268,8 @@ static int cx23885_video_mux(struct cx23885_dev *dev, unsigned int input)
+ (dev->board == CX23885_BOARD_MYGICA_X8507) ||
+ (dev->board == CX23885_BOARD_AVERMEDIA_HC81R) ||
+ (dev->board == CX23885_BOARD_VIEWCAST_260E) ||
+- (dev->board == CX23885_BOARD_VIEWCAST_460E)) {
++ (dev->board == CX23885_BOARD_VIEWCAST_460E) ||
++ (dev->board == CX23885_BOARD_AVERMEDIA_CE310B)) {
+ /* Configure audio routing */
+ v4l2_subdev_call(dev->sd_cx25840, audio, s_routing,
+ INPUT(input)->amux, 0, 0);
+diff --git a/drivers/media/pci/cx23885/cx23885.h b/drivers/media/pci/cx23885/cx23885.h
+index cf965efabe66..7bbd62cc993e 100644
+--- a/drivers/media/pci/cx23885/cx23885.h
++++ b/drivers/media/pci/cx23885/cx23885.h
+@@ -111,6 +111,7 @@
+ #define CX23885_BOARD_HAUPPAUGE_STARBURST2 59
+ #define CX23885_BOARD_HAUPPAUGE_QUADHD_DVB_885 60
+ #define CX23885_BOARD_HAUPPAUGE_QUADHD_ATSC_885 61
++#define CX23885_BOARD_AVERMEDIA_CE310B 62
+
+ #define GPIO_0 0x00000001
+ #define GPIO_1 0x00000002
+diff --git a/drivers/media/platform/sti/bdisp/bdisp-hw.c b/drivers/media/platform/sti/bdisp/bdisp-hw.c
+index 26d9fa7aeb5f..d57f659d740a 100644
+--- a/drivers/media/platform/sti/bdisp/bdisp-hw.c
++++ b/drivers/media/platform/sti/bdisp/bdisp-hw.c
+@@ -14,8 +14,8 @@
+ #define MAX_SRC_WIDTH 2048
+
+ /* Reset & boot poll config */
+-#define POLL_RST_MAX 50
+-#define POLL_RST_DELAY_MS 20
++#define POLL_RST_MAX 500
++#define POLL_RST_DELAY_MS 2
+
+ enum bdisp_target_plan {
+ BDISP_RGB,
+@@ -382,7 +382,7 @@ int bdisp_hw_reset(struct bdisp_dev *bdisp)
+ for (i = 0; i < POLL_RST_MAX; i++) {
+ if (readl(bdisp->regs + BLT_STA1) & BLT_STA1_IDLE)
+ break;
+- msleep(POLL_RST_DELAY_MS);
++ udelay(POLL_RST_DELAY_MS * 1000);
+ }
+ if (i == POLL_RST_MAX)
+ dev_err(bdisp->dev, "Reset timeout\n");
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
+index 733d9172425b..026a3bd71204 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -2013,10 +2013,10 @@ static int enic_stop(struct net_device *netdev)
+ napi_disable(&enic->napi[i]);
+
+ netif_carrier_off(netdev);
+- netif_tx_disable(netdev);
+ if (vnic_dev_get_intr_mode(enic->vdev) == VNIC_DEV_INTR_MODE_MSIX)
+ for (i = 0; i < enic->wq_count; i++)
+ napi_disable(&enic->napi[enic_cq_wq(enic, i)]);
++ netif_tx_disable(netdev);
+
+ if (!enic_is_dynamic(enic) && !enic_is_sriov_vf(enic))
+ enic_dev_del_station_addr(enic);
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index c97c4edfa31b..cf2d1e846a69 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -2685,13 +2685,17 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ skb_dirtytx = tx_queue->skb_dirtytx;
+
+ while ((skb = tx_queue->tx_skbuff[skb_dirtytx])) {
++ bool do_tstamp;
++
++ do_tstamp = (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
++ priv->hwts_tx_en;
+
+ frags = skb_shinfo(skb)->nr_frags;
+
+ /* When time stamping, one additional TxBD must be freed.
+ * Also, we need to dma_unmap_single() the TxPAL.
+ */
+- if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS))
++ if (unlikely(do_tstamp))
+ nr_txbds = frags + 2;
+ else
+ nr_txbds = frags + 1;
+@@ -2705,7 +2709,7 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ (lstatus & BD_LENGTH_MASK))
+ break;
+
+- if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) {
++ if (unlikely(do_tstamp)) {
+ next = next_txbd(bdp, base, tx_ring_size);
+ buflen = be16_to_cpu(next->length) +
+ GMAC_FCB_LEN + GMAC_TXPAL_LEN;
+@@ -2715,7 +2719,7 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ dma_unmap_single(priv->dev, be32_to_cpu(bdp->bufPtr),
+ buflen, DMA_TO_DEVICE);
+
+- if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) {
++ if (unlikely(do_tstamp)) {
+ struct skb_shared_hwtstamps shhwtstamps;
+ u64 *ns = (u64 *)(((uintptr_t)skb->data + 0x10) &
+ ~0x7UL);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index 8255d797ea94..9a68dee588c1 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -211,6 +211,9 @@ void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
+ s->tx_tls_resync_bytes += sq_stats->tls_resync_bytes;
+ #endif
+ s->tx_cqes += sq_stats->cqes;
++
++ /* https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92657 */
++ barrier();
+ }
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
+index 41e607a14846..4fe193c4fa55 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
+@@ -215,7 +215,7 @@ mlxsw_sp_dpipe_table_erif_entries_dump(void *priv, bool counters_enabled,
+ start_again:
+ err = devlink_dpipe_entry_ctx_prepare(dump_ctx);
+ if (err)
+- return err;
++ goto err_ctx_prepare;
+ j = 0;
+ for (; i < rif_count; i++) {
+ struct mlxsw_sp_rif *rif = mlxsw_sp_rif_by_index(mlxsw_sp, i);
+@@ -247,6 +247,7 @@ start_again:
+ return 0;
+ err_entry_append:
+ err_entry_get:
++err_ctx_prepare:
+ rtnl_unlock();
+ devlink_dpipe_entry_clear(&entry);
+ return err;
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 4ab87fe84542..6ea43e48d5f9 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -7433,6 +7433,15 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ int chipset, region, i;
+ int jumbo_max, rc;
+
++ /* Some tools for creating an initramfs don't consider softdeps, then
++ * r8169.ko may be in initramfs, but realtek.ko not. Then the generic
++ * PHY driver is used that doesn't work with most chip versions.
++ */
++ if (!driver_find("RTL8201CP Ethernet", &mdio_bus_type)) {
++ dev_err(&pdev->dev, "realtek.ko not loaded, maybe it needs to be added to initramfs?\n");
++ return -ENOENT;
++ }
++
+ dev = devm_alloc_etherdev(&pdev->dev, sizeof (*tp));
+ if (!dev)
+ return -ENOMEM;
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index daeab33f623e..9ab04ef532f3 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -242,6 +242,11 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ ret = -ENOMEM;
+ goto free_riptr;
+ }
++ if (riptr != (u16)riptr || tiptr != (u16)tiptr) {
++ dev_err(priv->dev, "MURAM allocation out of addressable range\n");
++ ret = -ENOMEM;
++ goto free_tiptr;
++ }
+
+ /* Set RIPTR, TIPTR */
+ iowrite16be(riptr, &priv->ucc_pram->riptr);
+diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
+index 6a505c26a3e7..a269ed63d90f 100644
+--- a/drivers/net/wan/ixp4xx_hss.c
++++ b/drivers/net/wan/ixp4xx_hss.c
+@@ -261,7 +261,7 @@ struct port {
+ struct hss_plat_info *plat;
+ buffer_t *rx_buff_tab[RX_DESCS], *tx_buff_tab[TX_DESCS];
+ struct desc *desc_tab; /* coherent */
+- u32 desc_tab_phys;
++ dma_addr_t desc_tab_phys;
+ unsigned int id;
+ unsigned int clock_type, clock_rate, loopback;
+ unsigned int initialized, carrier;
+@@ -861,7 +861,7 @@ static int hss_hdlc_xmit(struct sk_buff *skb, struct net_device *dev)
+ dev->stats.tx_dropped++;
+ return NETDEV_TX_OK;
+ }
+- memcpy_swab32(mem, (u32 *)((int)skb->data & ~3), bytes / 4);
++ memcpy_swab32(mem, (u32 *)((uintptr_t)skb->data & ~3), bytes / 4);
+ dev_kfree_skb(skb);
+ #endif
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 0f6ff7a78e49..3372dfa0decc 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -9193,7 +9193,7 @@ static int ath10k_wmi_mgmt_tx_clean_up_pending(int msdu_id, void *ptr,
+
+ msdu = pkt_addr->vaddr;
+ dma_unmap_single(ar->dev, pkt_addr->paddr,
+- msdu->len, DMA_FROM_DEVICE);
++ msdu->len, DMA_TO_DEVICE);
+ ieee80211_free_txskb(ar->hw, msdu);
+
+ return 0;
+diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c
+index 55f411925960..770cc218ca4b 100644
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -1304,8 +1304,9 @@ static void handle_irq_ucode_debug(struct b43legacy_wldev *dev)
+ }
+
+ /* Interrupt handler bottom-half */
+-static void b43legacy_interrupt_tasklet(struct b43legacy_wldev *dev)
++static void b43legacy_interrupt_tasklet(unsigned long data)
+ {
++ struct b43legacy_wldev *dev = (struct b43legacy_wldev *)data;
+ u32 reason;
+ u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
+ u32 merged_dma_reason = 0;
+@@ -3775,7 +3776,7 @@ static int b43legacy_one_core_attach(struct ssb_device *dev,
+ b43legacy_set_status(wldev, B43legacy_STAT_UNINIT);
+ wldev->bad_frames_preempt = modparam_bad_frames_preempt;
+ tasklet_init(&wldev->isr_tasklet,
+- (void (*)(unsigned long))b43legacy_interrupt_tasklet,
++ b43legacy_interrupt_tasklet,
+ (unsigned long)wldev);
+ if (modparam_pio)
+ wldev->__using_pio = true;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 5c3b62e61980..e0211321fe9e 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1934,6 +1934,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
+ BRCMF_SDIO_FT_NORMAL)) {
+ rd->len = 0;
+ brcmu_pkt_buf_free_skb(pkt);
++ continue;
+ }
+ bus->sdcnt.rx_readahead_cnt++;
+ if (rd->len != roundup(rd_new.len, 16)) {
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+index 910db46db6a1..a3a470976a5c 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+@@ -3220,8 +3220,9 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv)
+ }
+ }
+
+-static void ipw2100_irq_tasklet(struct ipw2100_priv *priv)
++static void ipw2100_irq_tasklet(unsigned long data)
+ {
++ struct ipw2100_priv *priv = (struct ipw2100_priv *)data;
+ struct net_device *dev = priv->net_dev;
+ unsigned long flags;
+ u32 inta, tmp;
+@@ -6025,7 +6026,7 @@ static void ipw2100_rf_kill(struct work_struct *work)
+ spin_unlock_irqrestore(&priv->low_lock, flags);
+ }
+
+-static void ipw2100_irq_tasklet(struct ipw2100_priv *priv);
++static void ipw2100_irq_tasklet(unsigned long data);
+
+ static const struct net_device_ops ipw2100_netdev_ops = {
+ .ndo_open = ipw2100_open,
+@@ -6155,7 +6156,7 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
+ INIT_DELAYED_WORK(&priv->rf_kill, ipw2100_rf_kill);
+ INIT_DELAYED_WORK(&priv->scan_event, ipw2100_scan_event);
+
+- tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
++ tasklet_init(&priv->irq_tasklet,
+ ipw2100_irq_tasklet, (unsigned long)priv);
+
+ /* NOTE: We do not start the deferred work for status checks yet */
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+index 9644e7b93645..04aee2fdba37 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+@@ -1959,8 +1959,9 @@ static void notify_wx_assoc_event(struct ipw_priv *priv)
+ wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
+ }
+
+-static void ipw_irq_tasklet(struct ipw_priv *priv)
++static void ipw_irq_tasklet(unsigned long data)
+ {
++ struct ipw_priv *priv = (struct ipw_priv *)data;
+ u32 inta, inta_mask, handled = 0;
+ unsigned long flags;
+ int rc = 0;
+@@ -10694,7 +10695,7 @@ static int ipw_setup_deferred_work(struct ipw_priv *priv)
+ INIT_WORK(&priv->qos_activate, ipw_bg_qos_activate);
+ #endif /* CONFIG_IPW2200_QOS */
+
+- tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
++ tasklet_init(&priv->irq_tasklet,
+ ipw_irq_tasklet, (unsigned long)priv);
+
+ return ret;
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index 57e3b6cca234..b536ec20eacc 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -1392,8 +1392,9 @@ il3945_dump_nic_error_log(struct il_priv *il)
+ }
+
+ static void
+-il3945_irq_tasklet(struct il_priv *il)
++il3945_irq_tasklet(unsigned long data)
+ {
++ struct il_priv *il = (struct il_priv *)data;
+ u32 inta, handled = 0;
+ u32 inta_fh;
+ unsigned long flags;
+@@ -3419,7 +3420,7 @@ il3945_setup_deferred_work(struct il_priv *il)
+ timer_setup(&il->watchdog, il_bg_watchdog, 0);
+
+ tasklet_init(&il->irq_tasklet,
+- (void (*)(unsigned long))il3945_irq_tasklet,
++ il3945_irq_tasklet,
+ (unsigned long)il);
+ }
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index 280cd8ae1696..6fc51c74cdb8 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -4360,8 +4360,9 @@ il4965_synchronize_irq(struct il_priv *il)
+ }
+
+ static void
+-il4965_irq_tasklet(struct il_priv *il)
++il4965_irq_tasklet(unsigned long data)
+ {
++ struct il_priv *il = (struct il_priv *)data;
+ u32 inta, handled = 0;
+ u32 inta_fh;
+ unsigned long flags;
+@@ -6257,7 +6258,7 @@ il4965_setup_deferred_work(struct il_priv *il)
+ timer_setup(&il->watchdog, il_bg_watchdog, 0);
+
+ tasklet_init(&il->irq_tasklet,
+- (void (*)(unsigned long))il4965_irq_tasklet,
++ il4965_irq_tasklet,
+ (unsigned long)il);
+ }
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
+index 6514baf799fe..e16f2597c219 100644
+--- a/drivers/net/wireless/intel/iwlegacy/common.c
++++ b/drivers/net/wireless/intel/iwlegacy/common.c
+@@ -717,7 +717,7 @@ il_eeprom_init(struct il_priv *il)
+ u32 gp = _il_rd(il, CSR_EEPROM_GP);
+ int sz;
+ int ret;
+- u16 addr;
++ int addr;
+
+ /* allocate eeprom */
+ sz = il->cfg->eeprom_size;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+index 1232f63278eb..319103f4b432 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+@@ -739,7 +739,8 @@ static struct thermal_zone_device_ops tzone_ops = {
+ static void iwl_mvm_thermal_zone_register(struct iwl_mvm *mvm)
+ {
+ int i;
+- char name[] = "iwlwifi";
++ char name[16];
++ static atomic_t counter = ATOMIC_INIT(0);
+
+ if (!iwl_mvm_is_tt_in_fw(mvm)) {
+ mvm->tz_device.tzone = NULL;
+@@ -749,6 +750,7 @@ static void iwl_mvm_thermal_zone_register(struct iwl_mvm *mvm)
+
+ BUILD_BUG_ON(ARRAY_SIZE(name) >= THERMAL_NAME_LENGTH);
+
++ sprintf(name, "iwlwifi_%u", atomic_inc_return(&counter) & 0xFF);
+ mvm->tz_device.tzone = thermal_zone_device_register(name,
+ IWL_MAX_DTS_TRIPS,
+ IWL_WRITABLE_TRIPS_MSK,
+diff --git a/drivers/net/wireless/intersil/hostap/hostap_ap.c b/drivers/net/wireless/intersil/hostap/hostap_ap.c
+index 0094b1d2b577..3ec46f48cfde 100644
+--- a/drivers/net/wireless/intersil/hostap/hostap_ap.c
++++ b/drivers/net/wireless/intersil/hostap/hostap_ap.c
+@@ -2508,7 +2508,7 @@ static int prism2_hostapd_add_sta(struct ap_data *ap,
+ sta->supported_rates[0] = 2;
+ if (sta->tx_supp_rates & WLAN_RATE_2M)
+ sta->supported_rates[1] = 4;
+- if (sta->tx_supp_rates & WLAN_RATE_5M5)
++ if (sta->tx_supp_rates & WLAN_RATE_5M5)
+ sta->supported_rates[2] = 11;
+ if (sta->tx_supp_rates & WLAN_RATE_11M)
+ sta->supported_rates[3] = 22;
+diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+index 2c7dd2a7350c..b704e4bce171 100644
+--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
++++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+@@ -1364,7 +1364,8 @@ static int ezusb_init(struct hermes *hw)
+ int retval;
+
+ BUG_ON(in_interrupt());
+- BUG_ON(!upriv);
++ if (!upriv)
++ return -EINVAL;
+
+ upriv->reply_count = 0;
+ /* Write the MAGIC number on the simulated registers to keep
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 5d1fda16fc8c..83749578fa8b 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -1082,13 +1082,15 @@ done:
+ return ret;
+ }
+
+-static void _rtl_pci_irq_tasklet(struct ieee80211_hw *hw)
++static void _rtl_pci_irq_tasklet(unsigned long data)
+ {
++ struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+ _rtl_pci_tx_chk_waitq(hw);
+ }
+
+-static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
++static void _rtl_pci_prepare_bcn_tasklet(unsigned long data)
+ {
++ struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+@@ -1214,10 +1216,10 @@ static void _rtl_pci_init_struct(struct ieee80211_hw *hw,
+
+ /*task */
+ tasklet_init(&rtlpriv->works.irq_tasklet,
+- (void (*)(unsigned long))_rtl_pci_irq_tasklet,
++ _rtl_pci_irq_tasklet,
+ (unsigned long)hw);
+ tasklet_init(&rtlpriv->works.irq_prepare_bcn_tasklet,
+- (void (*)(unsigned long))_rtl_pci_prepare_bcn_tasklet,
++ _rtl_pci_prepare_bcn_tasklet,
+ (unsigned long)hw);
+ INIT_WORK(&rtlpriv->works.lps_change_work,
+ rtl_lps_change_work_callback);
+diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
+index 60ae382f50da..06bb226c62ef 100644
+--- a/drivers/nfc/port100.c
++++ b/drivers/nfc/port100.c
+@@ -574,7 +574,7 @@ static void port100_tx_update_payload_len(void *_frame, int len)
+ {
+ struct port100_frame *frame = _frame;
+
+- frame->datalen = cpu_to_le16(le16_to_cpu(frame->datalen) + len);
++ le16_add_cpu(&frame->datalen, len);
+ }
+
+ static bool port100_rx_frame_is_valid(void *_frame)
+diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
+index 9d5cbc75d5ae..ec86414216f9 100644
+--- a/drivers/pci/controller/pcie-iproc.c
++++ b/drivers/pci/controller/pcie-iproc.c
+@@ -1526,6 +1526,30 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802,
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804,
+ quirk_paxc_disable_msi_parsing);
+
++static void quirk_paxc_bridge(struct pci_dev *pdev)
++{
++ /*
++ * The PCI config space is shared with the PAXC root port and the first
++ * Ethernet device. So, we need to workaround this by telling the PCI
++ * code that the bridge is not an Ethernet device.
++ */
++ if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE)
++ pdev->class = PCI_CLASS_BRIDGE_PCI << 8;
++
++ /*
++ * MPSS is not being set properly (as it is currently 0). This is
++ * because that area of the PCI config space is hard coded to zero, and
++ * is not modifiable by firmware. Set this to 2 (e.g., 512 byte MPS)
++ * so that the MPS can be set to the real max value.
++ */
++ pdev->pcie_mpss = 2;
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16cd, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16f0, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd750, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804, quirk_paxc_bridge);
++
+ MODULE_AUTHOR("Ray Jui <rjui@broadcom.com>");
+ MODULE_DESCRIPTION("Broadcom iPROC PCIe common driver");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 5b4c36ab1596..419dda6dbd16 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1848,19 +1848,40 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x2609, quirk_intel_pcie_pm);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x260a, quirk_intel_pcie_pm);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x260b, quirk_intel_pcie_pm);
+
++static void quirk_d3hot_delay(struct pci_dev *dev, unsigned int delay)
++{
++ if (dev->d3_delay >= delay)
++ return;
++
++ dev->d3_delay = delay;
++ pci_info(dev, "extending delay after power-on from D3hot to %d msec\n",
++ dev->d3_delay);
++}
++
+ static void quirk_radeon_pm(struct pci_dev *dev)
+ {
+ if (dev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+- dev->subsystem_device == 0x00e2) {
+- if (dev->d3_delay < 20) {
+- dev->d3_delay = 20;
+- pci_info(dev, "extending delay after power-on from D3 to %d msec\n",
+- dev->d3_delay);
+- }
+- }
++ dev->subsystem_device == 0x00e2)
++ quirk_d3hot_delay(dev, 20);
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6741, quirk_radeon_pm);
+
++/*
++ * Ryzen5/7 XHCI controllers fail upon resume from runtime suspend or s2idle.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=205587
++ *
++ * The kernel attempts to transition these devices to D3cold, but that seems
++ * to be ineffective on the platforms in question; the PCI device appears to
++ * remain on in D3hot state. The D3hot-to-D0 transition then requires an
++ * extended delay in order to succeed.
++ */
++static void quirk_ryzen_xhci_d3hot(struct pci_dev *dev)
++{
++ quirk_d3hot_delay(dev, 20);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e0, quirk_ryzen_xhci_d3hot);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e1, quirk_ryzen_xhci_d3hot);
++
+ #ifdef CONFIG_X86_IO_APIC
+ static int dmi_disable_ioapicreroute(const struct dmi_system_id *d)
+ {
+@@ -2358,32 +2379,6 @@ DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_BROADCOM,
+ PCI_DEVICE_ID_TIGON3_5719,
+ quirk_brcm_5719_limit_mrrs);
+
+-#ifdef CONFIG_PCIE_IPROC_PLATFORM
+-static void quirk_paxc_bridge(struct pci_dev *pdev)
+-{
+- /*
+- * The PCI config space is shared with the PAXC root port and the first
+- * Ethernet device. So, we need to workaround this by telling the PCI
+- * code that the bridge is not an Ethernet device.
+- */
+- if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE)
+- pdev->class = PCI_CLASS_BRIDGE_PCI << 8;
+-
+- /*
+- * MPSS is not being set properly (as it is currently 0). This is
+- * because that area of the PCI config space is hard coded to zero, and
+- * is not modifiable by firmware. Set this to 2 (e.g., 512 byte MPS)
+- * so that the MPS can be set to the real max value.
+- */
+- pdev->pcie_mpss = 2;
+-}
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16cd, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16f0, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd750, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804, quirk_paxc_bridge);
+-#endif
+-
+ /*
+ * Originally in EDAC sources for i82875P: Intel tells BIOS developers to
+ * hide device 6 which configures the overflow device access containing the
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index 021e28ff1194..a760d8bda0af 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -950,7 +950,13 @@ static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned int offset)
+
+ raw_spin_lock_irqsave(&byt_lock, flags);
+ value = readl(reg);
+- value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
++
++ /* Do not clear direct-irq enabled IRQs (from gpio_disable_free) */
++ if (value & BYT_DIRECT_IRQ_EN)
++ /* nothing to do */ ;
++ else
++ value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
++
+ writel(value, reg);
+ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ }
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+index e1c34e19222e..3ddb9565ed80 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+@@ -500,17 +500,15 @@ enum {
+ SD_WP_MARK, SD_CLK_MARK, SD_CMD_MARK,
+ CRX0_MARK, CRX1_MARK,
+ CTX0_MARK, CTX1_MARK,
++ CRX0_CRX1_MARK, CTX0_CTX1_MARK,
+
+ PWM1A_MARK, PWM1B_MARK, PWM1C_MARK, PWM1D_MARK,
+ PWM1E_MARK, PWM1F_MARK, PWM1G_MARK, PWM1H_MARK,
+ PWM2A_MARK, PWM2B_MARK, PWM2C_MARK, PWM2D_MARK,
+ PWM2E_MARK, PWM2F_MARK, PWM2G_MARK, PWM2H_MARK,
+ IERXD_MARK, IETXD_MARK,
+- CRX0_CRX1_MARK,
+ WDTOVF_MARK,
+
+- CRX0X1_MARK,
+-
+ /* DMAC */
+ TEND0_MARK, DACK0_MARK, DREQ0_MARK,
+ TEND1_MARK, DACK1_MARK, DREQ1_MARK,
+@@ -998,12 +996,12 @@ static const u16 pinmux_data[] = {
+
+ PINMUX_DATA(PJ3_DATA, PJ3MD_00),
+ PINMUX_DATA(CRX1_MARK, PJ3MD_01),
+- PINMUX_DATA(CRX0X1_MARK, PJ3MD_10),
++ PINMUX_DATA(CRX0_CRX1_MARK, PJ3MD_10),
+ PINMUX_DATA(IRQ1_PJ_MARK, PJ3MD_11),
+
+ PINMUX_DATA(PJ2_DATA, PJ2MD_000),
+ PINMUX_DATA(CTX1_MARK, PJ2MD_001),
+- PINMUX_DATA(CRX0_CRX1_MARK, PJ2MD_010),
++ PINMUX_DATA(CTX0_CTX1_MARK, PJ2MD_010),
+ PINMUX_DATA(CS2_MARK, PJ2MD_011),
+ PINMUX_DATA(SCK0_MARK, PJ2MD_100),
+ PINMUX_DATA(LCD_M_DISP_MARK, PJ2MD_101),
+@@ -1248,6 +1246,7 @@ static const struct pinmux_func pinmux_func_gpios[] = {
+ GPIO_FN(CTX1),
+ GPIO_FN(CRX1),
+ GPIO_FN(CTX0),
++ GPIO_FN(CTX0_CTX1),
+ GPIO_FN(CRX0),
+ GPIO_FN(CRX0_CRX1),
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+index cfdb4fc177c3..3df0c0d139d0 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+@@ -740,13 +740,12 @@ enum {
+ CRX0_MARK, CTX0_MARK,
+ CRX1_MARK, CTX1_MARK,
+ CRX2_MARK, CTX2_MARK,
+- CRX0_CRX1_MARK,
+- CRX0_CRX1_CRX2_MARK,
+- CTX0CTX1CTX2_MARK,
++ CRX0_CRX1_MARK, CTX0_CTX1_MARK,
++ CRX0_CRX1_CRX2_MARK, CTX0_CTX1_CTX2_MARK,
+ CRX1_PJ22_MARK, CTX1_PJ23_MARK,
+ CRX2_PJ20_MARK, CTX2_PJ21_MARK,
+- CRX0CRX1_PJ22_MARK,
+- CRX0CRX1CRX2_PJ20_MARK,
++ CRX0_CRX1_PJ22_MARK, CTX0_CTX1_PJ23_MARK,
++ CRX0_CRX1_CRX2_PJ20_MARK, CTX0_CTX1_CTX2_PJ21_MARK,
+
+ /* VDC */
+ DV_CLK_MARK,
+@@ -824,6 +823,7 @@ static const u16 pinmux_data[] = {
+ PINMUX_DATA(CS3_MARK, PC8MD_001),
+ PINMUX_DATA(TXD7_MARK, PC8MD_010),
+ PINMUX_DATA(CTX1_MARK, PC8MD_011),
++ PINMUX_DATA(CTX0_CTX1_MARK, PC8MD_100),
+
+ PINMUX_DATA(PC7_DATA, PC7MD_000),
+ PINMUX_DATA(CKE_MARK, PC7MD_001),
+@@ -836,11 +836,12 @@ static const u16 pinmux_data[] = {
+ PINMUX_DATA(CAS_MARK, PC6MD_001),
+ PINMUX_DATA(SCK7_MARK, PC6MD_010),
+ PINMUX_DATA(CTX0_MARK, PC6MD_011),
++ PINMUX_DATA(CTX0_CTX1_CTX2_MARK, PC6MD_100),
+
+ PINMUX_DATA(PC5_DATA, PC5MD_000),
+ PINMUX_DATA(RAS_MARK, PC5MD_001),
+ PINMUX_DATA(CRX0_MARK, PC5MD_011),
+- PINMUX_DATA(CTX0CTX1CTX2_MARK, PC5MD_100),
++ PINMUX_DATA(CTX0_CTX1_CTX2_MARK, PC5MD_100),
+ PINMUX_DATA(IRQ0_PC_MARK, PC5MD_101),
+
+ PINMUX_DATA(PC4_DATA, PC4MD_00),
+@@ -1292,30 +1293,32 @@ static const u16 pinmux_data[] = {
+ PINMUX_DATA(LCD_DATA23_PJ23_MARK, PJ23MD_010),
+ PINMUX_DATA(LCD_TCON6_MARK, PJ23MD_011),
+ PINMUX_DATA(IRQ3_PJ_MARK, PJ23MD_100),
+- PINMUX_DATA(CTX1_MARK, PJ23MD_101),
++ PINMUX_DATA(CTX1_PJ23_MARK, PJ23MD_101),
++ PINMUX_DATA(CTX0_CTX1_PJ23_MARK, PJ23MD_110),
+
+ PINMUX_DATA(PJ22_DATA, PJ22MD_000),
+ PINMUX_DATA(DV_DATA22_MARK, PJ22MD_001),
+ PINMUX_DATA(LCD_DATA22_PJ22_MARK, PJ22MD_010),
+ PINMUX_DATA(LCD_TCON5_MARK, PJ22MD_011),
+ PINMUX_DATA(IRQ2_PJ_MARK, PJ22MD_100),
+- PINMUX_DATA(CRX1_MARK, PJ22MD_101),
+- PINMUX_DATA(CRX0_CRX1_MARK, PJ22MD_110),
++ PINMUX_DATA(CRX1_PJ22_MARK, PJ22MD_101),
++ PINMUX_DATA(CRX0_CRX1_PJ22_MARK, PJ22MD_110),
+
+ PINMUX_DATA(PJ21_DATA, PJ21MD_000),
+ PINMUX_DATA(DV_DATA21_MARK, PJ21MD_001),
+ PINMUX_DATA(LCD_DATA21_PJ21_MARK, PJ21MD_010),
+ PINMUX_DATA(LCD_TCON4_MARK, PJ21MD_011),
+ PINMUX_DATA(IRQ1_PJ_MARK, PJ21MD_100),
+- PINMUX_DATA(CTX2_MARK, PJ21MD_101),
++ PINMUX_DATA(CTX2_PJ21_MARK, PJ21MD_101),
++ PINMUX_DATA(CTX0_CTX1_CTX2_PJ21_MARK, PJ21MD_110),
+
+ PINMUX_DATA(PJ20_DATA, PJ20MD_000),
+ PINMUX_DATA(DV_DATA20_MARK, PJ20MD_001),
+ PINMUX_DATA(LCD_DATA20_PJ20_MARK, PJ20MD_010),
+ PINMUX_DATA(LCD_TCON3_MARK, PJ20MD_011),
+ PINMUX_DATA(IRQ0_PJ_MARK, PJ20MD_100),
+- PINMUX_DATA(CRX2_MARK, PJ20MD_101),
+- PINMUX_DATA(CRX0CRX1CRX2_PJ20_MARK, PJ20MD_110),
++ PINMUX_DATA(CRX2_PJ20_MARK, PJ20MD_101),
++ PINMUX_DATA(CRX0_CRX1_CRX2_PJ20_MARK, PJ20MD_110),
+
+ PINMUX_DATA(PJ19_DATA, PJ19MD_000),
+ PINMUX_DATA(DV_DATA19_MARK, PJ19MD_001),
+@@ -1666,12 +1669,24 @@ static const struct pinmux_func pinmux_func_gpios[] = {
+ GPIO_FN(WDTOVF),
+
+ /* CAN */
++ GPIO_FN(CTX2),
++ GPIO_FN(CRX2),
+ GPIO_FN(CTX1),
+ GPIO_FN(CRX1),
+ GPIO_FN(CTX0),
+ GPIO_FN(CRX0),
++ GPIO_FN(CTX0_CTX1),
+ GPIO_FN(CRX0_CRX1),
++ GPIO_FN(CTX0_CTX1_CTX2),
+ GPIO_FN(CRX0_CRX1_CRX2),
++ GPIO_FN(CTX2_PJ21),
++ GPIO_FN(CRX2_PJ20),
++ GPIO_FN(CTX1_PJ23),
++ GPIO_FN(CRX1_PJ22),
++ GPIO_FN(CTX0_CTX1_PJ23),
++ GPIO_FN(CRX0_CRX1_PJ22),
++ GPIO_FN(CTX0_CTX1_CTX2_PJ21),
++ GPIO_FN(CRX0_CRX1_CRX2_PJ20),
+
+ /* DMAC */
+ GPIO_FN(TEND0),
+diff --git a/drivers/pwm/pwm-omap-dmtimer.c b/drivers/pwm/pwm-omap-dmtimer.c
+index f45798679e3c..c6e710a713d3 100644
+--- a/drivers/pwm/pwm-omap-dmtimer.c
++++ b/drivers/pwm/pwm-omap-dmtimer.c
+@@ -301,15 +301,10 @@ static int pwm_omap_dmtimer_probe(struct platform_device *pdev)
+ goto put;
+ }
+
+-put:
+- of_node_put(timer);
+- if (ret < 0)
+- return ret;
+-
+ omap = devm_kzalloc(&pdev->dev, sizeof(*omap), GFP_KERNEL);
+ if (!omap) {
+- pdata->free(dm_timer);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto err_alloc_omap;
+ }
+
+ omap->pdata = pdata;
+@@ -342,18 +337,38 @@ put:
+ ret = pwmchip_add(&omap->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to register PWM\n");
+- omap->pdata->free(omap->dm_timer);
+- return ret;
++ goto err_pwmchip_add;
+ }
+
++ of_node_put(timer);
++
+ platform_set_drvdata(pdev, omap);
+
+ return 0;
++
++err_pwmchip_add:
++
++ /*
++ * *omap is allocated using devm_kzalloc,
++ * so no free necessary here
++ */
++err_alloc_omap:
++
++ pdata->free(dm_timer);
++put:
++ of_node_put(timer);
++
++ return ret;
+ }
+
+ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+ {
+ struct pwm_omap_dmtimer_chip *omap = platform_get_drvdata(pdev);
++ int ret;
++
++ ret = pwmchip_remove(&omap->chip);
++ if (ret)
++ return ret;
+
+ if (pm_runtime_active(&omap->dm_timer_pdev->dev))
+ omap->pdata->stop(omap->dm_timer);
+@@ -362,7 +377,7 @@ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+
+ mutex_destroy(&omap->mutex);
+
+- return pwmchip_remove(&omap->chip);
++ return 0;
+ }
+
+ static const struct of_device_id pwm_omap_dmtimer_of_match[] = {
+diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
+index 567f5e2771c4..e1e5dfcb16f3 100644
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -170,13 +170,9 @@ static void pca9685_pwm_gpio_set(struct gpio_chip *gpio, unsigned int offset,
+ static void pca9685_pwm_gpio_free(struct gpio_chip *gpio, unsigned int offset)
+ {
+ struct pca9685 *pca = gpiochip_get_data(gpio);
+- struct pwm_device *pwm;
+
+ pca9685_pwm_gpio_set(gpio, offset, 0);
+ pm_runtime_put(pca->chip.dev);
+- mutex_lock(&pca->lock);
+- pwm = &pca->chip.pwms[offset];
+- mutex_unlock(&pca->lock);
+ }
+
+ static int pca9685_pwm_gpio_get_direction(struct gpio_chip *chip,
+diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
+index 213b68743cc8..92498ac50303 100644
+--- a/drivers/regulator/rk808-regulator.c
++++ b/drivers/regulator/rk808-regulator.c
+@@ -714,7 +714,7 @@ static int rk808_regulator_dt_parse_pdata(struct device *dev,
+ }
+
+ if (!pdata->dvs_gpio[i]) {
+- dev_warn(dev, "there is no dvs%d gpio\n", i);
++ dev_info(dev, "there is no dvs%d gpio\n", i);
+ continue;
+ }
+
+diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
+index aa6206706fe3..abbef17c97ee 100644
+--- a/drivers/remoteproc/remoteproc_core.c
++++ b/drivers/remoteproc/remoteproc_core.c
+@@ -1786,7 +1786,7 @@ static int __init remoteproc_init(void)
+
+ return 0;
+ }
+-module_init(remoteproc_init);
++subsys_initcall(remoteproc_init);
+
+ static void __exit remoteproc_exit(void)
+ {
+diff --git a/drivers/reset/reset-uniphier.c b/drivers/reset/reset-uniphier.c
+index 5605745663ae..adbecb2c7cd3 100644
+--- a/drivers/reset/reset-uniphier.c
++++ b/drivers/reset/reset-uniphier.c
+@@ -202,8 +202,8 @@ static const struct uniphier_reset_data uniphier_pro5_sd_reset_data[] = {
+ #define UNIPHIER_PERI_RESET_FI2C(id, ch) \
+ UNIPHIER_RESETX((id), 0x114, 24 + (ch))
+
+-#define UNIPHIER_PERI_RESET_SCSSI(id) \
+- UNIPHIER_RESETX((id), 0x110, 17)
++#define UNIPHIER_PERI_RESET_SCSSI(id, ch) \
++ UNIPHIER_RESETX((id), 0x110, 17 + (ch))
+
+ #define UNIPHIER_PERI_RESET_MCSSI(id) \
+ UNIPHIER_RESETX((id), 0x114, 14)
+@@ -218,7 +218,7 @@ static const struct uniphier_reset_data uniphier_ld4_peri_reset_data[] = {
+ UNIPHIER_PERI_RESET_I2C(6, 2),
+ UNIPHIER_PERI_RESET_I2C(7, 3),
+ UNIPHIER_PERI_RESET_I2C(8, 4),
+- UNIPHIER_PERI_RESET_SCSSI(11),
++ UNIPHIER_PERI_RESET_SCSSI(11, 0),
+ UNIPHIER_RESET_END,
+ };
+
+@@ -234,8 +234,11 @@ static const struct uniphier_reset_data uniphier_pro4_peri_reset_data[] = {
+ UNIPHIER_PERI_RESET_FI2C(8, 4),
+ UNIPHIER_PERI_RESET_FI2C(9, 5),
+ UNIPHIER_PERI_RESET_FI2C(10, 6),
+- UNIPHIER_PERI_RESET_SCSSI(11),
+- UNIPHIER_PERI_RESET_MCSSI(12),
++ UNIPHIER_PERI_RESET_SCSSI(11, 0),
++ UNIPHIER_PERI_RESET_SCSSI(12, 1),
++ UNIPHIER_PERI_RESET_SCSSI(13, 2),
++ UNIPHIER_PERI_RESET_SCSSI(14, 3),
++ UNIPHIER_PERI_RESET_MCSSI(15),
+ UNIPHIER_RESET_END,
+ };
+
+diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c
+index 915a34f141e4..49e02e874553 100644
+--- a/drivers/scsi/aic7xxx/aic7xxx_core.c
++++ b/drivers/scsi/aic7xxx/aic7xxx_core.c
+@@ -2321,7 +2321,7 @@ ahc_find_syncrate(struct ahc_softc *ahc, u_int *period,
+ * At some speeds, we only support
+ * ST transfers.
+ */
+- if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
++ if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
+ *ppr_options &= ~MSG_EXT_PPR_DT_REQ;
+ break;
+ }
+diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
+index 55181d28291e..7212e3a13fe6 100644
+--- a/drivers/scsi/iscsi_tcp.c
++++ b/drivers/scsi/iscsi_tcp.c
+@@ -892,6 +892,10 @@ free_host:
+ static void iscsi_sw_tcp_session_destroy(struct iscsi_cls_session *cls_session)
+ {
+ struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
++ struct iscsi_session *session = cls_session->dd_data;
++
++ if (WARN_ON_ONCE(session->leadconn))
++ return;
+
+ iscsi_tcp_r2tpool_free(cls_session->dd_data);
+ iscsi_session_teardown(cls_session);
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 4c4781e5974f..c0fb9e789080 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2945,6 +2945,24 @@ iscsi_set_path(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+ return err;
+ }
+
++static int iscsi_session_has_conns(int sid)
++{
++ struct iscsi_cls_conn *conn;
++ unsigned long flags;
++ int found = 0;
++
++ spin_lock_irqsave(&connlock, flags);
++ list_for_each_entry(conn, &connlist, conn_list) {
++ if (iscsi_conn_get_sid(conn) == sid) {
++ found = 1;
++ break;
++ }
++ }
++ spin_unlock_irqrestore(&connlock, flags);
++
++ return found;
++}
++
+ static int
+ iscsi_set_iface_params(struct iscsi_transport *transport,
+ struct iscsi_uevent *ev, uint32_t len)
+@@ -3522,10 +3540,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
+ break;
+ case ISCSI_UEVENT_DESTROY_SESSION:
+ session = iscsi_session_lookup(ev->u.d_session.sid);
+- if (session)
+- transport->destroy_session(session);
+- else
++ if (!session)
+ err = -EINVAL;
++ else if (iscsi_session_has_conns(ev->u.d_session.sid))
++ err = -EBUSY;
++ else
++ transport->destroy_session(session);
+ break;
+ case ISCSI_UEVENT_UNBIND_SESSION:
+ session = iscsi_session_lookup(ev->u.d_session.sid);
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index f4fcaee41dc2..b3dee24917a8 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -4809,7 +4809,7 @@ ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
+ break;
+ } /* end of switch */
+
+- if (host_byte(result) != DID_OK)
++ if ((host_byte(result) != DID_OK) && !hba->silence_err_logs)
+ ufshcd_print_trs(hba, 1 << lrbp->task_tag, true);
+ return result;
+ }
+@@ -5341,8 +5341,8 @@ static void ufshcd_err_handler(struct work_struct *work)
+
+ /*
+ * if host reset is required then skip clearing the pending
+- * transfers forcefully because they will automatically get
+- * cleared after link startup.
++ * transfers forcefully because they will get cleared during
++ * host reset and restore
+ */
+ if (needs_reset)
+ goto skip_pending_xfer_clear;
+@@ -5996,9 +5996,15 @@ static int ufshcd_host_reset_and_restore(struct ufs_hba *hba)
+ int err;
+ unsigned long flags;
+
+- /* Reset the host controller */
++ /*
++ * Stop the host controller and complete the requests
++ * cleared by h/w
++ */
+ spin_lock_irqsave(hba->host->host_lock, flags);
+ ufshcd_hba_stop(hba, false);
++ hba->silence_err_logs = true;
++ ufshcd_complete_requests(hba);
++ hba->silence_err_logs = false;
+ spin_unlock_irqrestore(hba->host->host_lock, flags);
+
+ /* scale up clocks to max frequency before full reinitialization */
+@@ -6032,22 +6038,12 @@ out:
+ static int ufshcd_reset_and_restore(struct ufs_hba *hba)
+ {
+ int err = 0;
+- unsigned long flags;
+ int retries = MAX_HOST_RESET_RETRIES;
+
+ do {
+ err = ufshcd_host_reset_and_restore(hba);
+ } while (err && --retries);
+
+- /*
+- * After reset the door-bell might be cleared, complete
+- * outstanding requests in s/w here.
+- */
+- spin_lock_irqsave(hba->host->host_lock, flags);
+- ufshcd_transfer_req_compl(hba);
+- ufshcd_tmc_handler(hba);
+- spin_unlock_irqrestore(hba->host->host_lock, flags);
+-
+ return err;
+ }
+
+diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
+index 33fdd3f281ae..4554a4b725b5 100644
+--- a/drivers/scsi/ufs/ufshcd.h
++++ b/drivers/scsi/ufs/ufshcd.h
+@@ -489,6 +489,7 @@ struct ufs_stats {
+ * @uic_error: UFS interconnect layer error status
+ * @saved_err: sticky error mask
+ * @saved_uic_err: sticky UIC error mask
++ * @silence_err_logs: flag to silence error logs
+ * @dev_cmd: ufs device management command information
+ * @last_dme_cmd_tstamp: time stamp of the last completed DME command
+ * @auto_bkops_enabled: to track whether bkops is enabled in device
+@@ -645,6 +646,7 @@ struct ufs_hba {
+ u32 saved_err;
+ u32 saved_uic_err;
+ struct ufs_stats ufs_stats;
++ bool silence_err_logs;
+
+ /* Device management request data */
+ struct ufs_dev_cmd dev_cmd;
+diff --git a/drivers/soc/tegra/fuse/tegra-apbmisc.c b/drivers/soc/tegra/fuse/tegra-apbmisc.c
+index e5a4d8f98b10..d1cbb0fe1691 100644
+--- a/drivers/soc/tegra/fuse/tegra-apbmisc.c
++++ b/drivers/soc/tegra/fuse/tegra-apbmisc.c
+@@ -135,7 +135,7 @@ void __init tegra_init_apbmisc(void)
+ apbmisc.flags = IORESOURCE_MEM;
+
+ /* strapping options */
+- if (tegra_get_chip_id() == TEGRA124) {
++ if (of_machine_is_compatible("nvidia,tegra124")) {
+ straps.start = 0x7000e864;
+ straps.end = 0x7000e867;
+ } else {
+diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+index bee3c3a7a7a9..2db4444267a7 100644
+--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+@@ -229,18 +229,21 @@ static char *translate_scan(struct adapter *padapter,
+
+ /* parsing WPA/WPA2 IE */
+ {
+- u8 buf[MAX_WPA_IE_LEN];
++ u8 *buf;
+ u8 wpa_ie[255], rsn_ie[255];
+ u16 wpa_len = 0, rsn_len = 0;
+ u8 *p;
+
++ buf = kzalloc(MAX_WPA_IE_LEN, GFP_ATOMIC);
++ if (!buf)
++ return start;
++
+ rtw_get_sec_ie(pnetwork->network.ies, pnetwork->network.ie_length, rsn_ie, &rsn_len, wpa_ie, &wpa_len);
+ RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_wx_get_scan: ssid =%s\n", pnetwork->network.Ssid.Ssid));
+ RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_wx_get_scan: wpa_len =%d rsn_len =%d\n", wpa_len, rsn_len));
+
+ if (wpa_len > 0) {
+ p = buf;
+- memset(buf, 0, MAX_WPA_IE_LEN);
+ p += sprintf(p, "wpa_ie=");
+ for (i = 0; i < wpa_len; i++)
+ p += sprintf(p, "%02x", wpa_ie[i]);
+@@ -257,7 +260,6 @@ static char *translate_scan(struct adapter *padapter,
+ }
+ if (rsn_len > 0) {
+ p = buf;
+- memset(buf, 0, MAX_WPA_IE_LEN);
+ p += sprintf(p, "rsn_ie=");
+ for (i = 0; i < rsn_len; i++)
+ p += sprintf(p, "%02x", rsn_ie[i]);
+@@ -271,6 +273,7 @@ static char *translate_scan(struct adapter *padapter,
+ iwe.u.data.length = rsn_len;
+ start = iwe_stream_add_point(info, start, stop, &iwe, rsn_ie);
+ }
++ kfree(buf);
+ }
+
+ {/* parsing WPS IE */
+diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
+index b88ecf102764..e9779b03ee56 100644
+--- a/drivers/tty/synclink_gt.c
++++ b/drivers/tty/synclink_gt.c
+@@ -1335,10 +1335,10 @@ static void throttle(struct tty_struct * tty)
+ DBGINFO(("%s throttle\n", info->device_name));
+ if (I_IXOFF(tty))
+ send_xchar(tty, STOP_CHAR(tty));
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->signals &= ~SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -1360,10 +1360,10 @@ static void unthrottle(struct tty_struct * tty)
+ else
+ send_xchar(tty, START_CHAR(tty));
+ }
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->signals |= SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -2561,8 +2561,8 @@ static void change_params(struct slgt_info *info)
+ info->read_status_mask = IRQ_RXOVER;
+ if (I_INPCK(info->port.tty))
+ info->read_status_mask |= MASK_PARITY | MASK_FRAMING;
+- if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+- info->read_status_mask |= MASK_BREAK;
++ if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
++ info->read_status_mask |= MASK_BREAK;
+ if (I_IGNPAR(info->port.tty))
+ info->ignore_status_mask |= MASK_PARITY | MASK_FRAMING;
+ if (I_IGNBRK(info->port.tty)) {
+@@ -3193,7 +3193,7 @@ static int tiocmset(struct tty_struct *tty,
+ info->signals &= ~SerialSignal_DTR;
+
+ spin_lock_irqsave(&info->lock,flags);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ return 0;
+ }
+@@ -3204,7 +3204,7 @@ static int carrier_raised(struct tty_port *port)
+ struct slgt_info *info = container_of(port, struct slgt_info, port);
+
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ return (info->signals & SerialSignal_DCD) ? 1 : 0;
+ }
+@@ -3219,7 +3219,7 @@ static void dtr_rts(struct tty_port *port, int on)
+ info->signals |= SerialSignal_RTS | SerialSignal_DTR;
+ else
+ info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+
+diff --git a/drivers/tty/synclinkmp.c b/drivers/tty/synclinkmp.c
+index 1e4d5b9c981a..57c2c647af61 100644
+--- a/drivers/tty/synclinkmp.c
++++ b/drivers/tty/synclinkmp.c
+@@ -1454,10 +1454,10 @@ static void throttle(struct tty_struct * tty)
+ if (I_IXOFF(tty))
+ send_xchar(tty, STOP_CHAR(tty));
+
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->serial_signals &= ~SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -1483,10 +1483,10 @@ static void unthrottle(struct tty_struct * tty)
+ send_xchar(tty, START_CHAR(tty));
+ }
+
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->serial_signals |= SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -2471,7 +2471,7 @@ static void isr_io_pin( SLMP_INFO *info, u16 status )
+ if (status & SerialSignal_CTS) {
+ if ( debug_level >= DEBUG_LEVEL_ISR )
+ printk("CTS tx start...");
+- info->port.tty->hw_stopped = 0;
++ info->port.tty->hw_stopped = 0;
+ tx_start(info);
+ info->pending_bh |= BH_TRANSMIT;
+ return;
+@@ -2480,7 +2480,7 @@ static void isr_io_pin( SLMP_INFO *info, u16 status )
+ if (!(status & SerialSignal_CTS)) {
+ if ( debug_level >= DEBUG_LEVEL_ISR )
+ printk("CTS tx stop...");
+- info->port.tty->hw_stopped = 1;
++ info->port.tty->hw_stopped = 1;
+ tx_stop(info);
+ }
+ }
+@@ -2807,8 +2807,8 @@ static void change_params(SLMP_INFO *info)
+ info->read_status_mask2 = OVRN;
+ if (I_INPCK(info->port.tty))
+ info->read_status_mask2 |= PE | FRME;
+- if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+- info->read_status_mask1 |= BRKD;
++ if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
++ info->read_status_mask1 |= BRKD;
+ if (I_IGNPAR(info->port.tty))
+ info->ignore_status_mask2 |= PE | FRME;
+ if (I_IGNBRK(info->port.tty)) {
+@@ -3178,7 +3178,7 @@ static int tiocmget(struct tty_struct *tty)
+ unsigned long flags;
+
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+
+ result = ((info->serial_signals & SerialSignal_RTS) ? TIOCM_RTS : 0) |
+@@ -3216,7 +3216,7 @@ static int tiocmset(struct tty_struct *tty,
+ info->serial_signals &= ~SerialSignal_DTR;
+
+ spin_lock_irqsave(&info->lock,flags);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+
+ return 0;
+@@ -3228,7 +3228,7 @@ static int carrier_raised(struct tty_port *port)
+ unsigned long flags;
+
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+
+ return (info->serial_signals & SerialSignal_DCD) ? 1 : 0;
+@@ -3244,7 +3244,7 @@ static void dtr_rts(struct tty_port *port, int on)
+ info->serial_signals |= SerialSignal_RTS | SerialSignal_DTR;
+ else
+ info->serial_signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+
+diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c
+index e1134a4d97f3..a00b4aee6c79 100644
+--- a/drivers/uio/uio_dmem_genirq.c
++++ b/drivers/uio/uio_dmem_genirq.c
+@@ -135,11 +135,13 @@ static int uio_dmem_genirq_irqcontrol(struct uio_info *dev_info, s32 irq_on)
+ if (irq_on) {
+ if (test_and_clear_bit(0, &priv->flags))
+ enable_irq(dev_info->irq);
++ spin_unlock_irqrestore(&priv->lock, flags);
+ } else {
+- if (!test_and_set_bit(0, &priv->flags))
++ if (!test_and_set_bit(0, &priv->flags)) {
++ spin_unlock_irqrestore(&priv->lock, flags);
+ disable_irq(dev_info->irq);
++ }
+ }
+- spin_unlock_irqrestore(&priv->lock, flags);
+
+ return 0;
+ }
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index f64d1cd08fb6..17f3e7b4d4fe 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -3918,11 +3918,12 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,
+ * a unique tx-fifo even if it is non-periodic.
+ */
+ if (dir_in && hsotg->dedicated_fifos) {
++ unsigned fifo_count = dwc2_hsotg_tx_fifo_count(hsotg);
+ u32 fifo_index = 0;
+ u32 fifo_size = UINT_MAX;
+
+ size = hs_ep->ep.maxpacket * hs_ep->mc;
+- for (i = 1; i < hsotg->num_of_eps; ++i) {
++ for (i = 1; i <= fifo_count; ++i) {
+ if (hsotg->fifo_map & (1 << i))
+ continue;
+ val = dwc2_readl(hsotg, DPTXFSIZN(i));
+diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
+index 729e60e49564..e50108f9a374 100644
+--- a/drivers/usb/gadget/udc/gr_udc.c
++++ b/drivers/usb/gadget/udc/gr_udc.c
+@@ -2180,8 +2180,6 @@ static int gr_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
+- spin_lock(&dev->lock);
+-
+ /* Inside lock so that no gadget can use this udc until probe is done */
+ retval = usb_add_gadget_udc(dev->dev, &dev->gadget);
+ if (retval) {
+@@ -2190,15 +2188,21 @@ static int gr_probe(struct platform_device *pdev)
+ }
+ dev->added = 1;
+
++ spin_lock(&dev->lock);
++
+ retval = gr_udc_init(dev);
+- if (retval)
++ if (retval) {
++ spin_unlock(&dev->lock);
+ goto out;
+-
+- gr_dfs_create(dev);
++ }
+
+ /* Clear all interrupt enables that might be left on since last boot */
+ gr_disable_interrupts_and_pullup(dev);
+
++ spin_unlock(&dev->lock);
++
++ gr_dfs_create(dev);
++
+ retval = gr_request_irq(dev, dev->irq);
+ if (retval) {
+ dev_err(dev->dev, "Failed to request irq %d\n", dev->irq);
+@@ -2227,8 +2231,6 @@ static int gr_probe(struct platform_device *pdev)
+ dev_info(dev->dev, "regs: %p, irq %d\n", dev->regs, dev->irq);
+
+ out:
+- spin_unlock(&dev->lock);
+-
+ if (retval)
+ gr_remove(pdev);
+
+diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
+index b1dd81fb5f55..24e622c05638 100644
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -361,8 +361,6 @@ static const struct musb_platform_ops omap2430_ops = {
+ .init = omap2430_musb_init,
+ .exit = omap2430_musb_exit,
+
+- .set_vbus = omap2430_musb_set_vbus,
+-
+ .enable = omap2430_musb_enable,
+ .disable = omap2430_musb_disable,
+
+diff --git a/drivers/video/fbdev/pxa168fb.c b/drivers/video/fbdev/pxa168fb.c
+index d059d04c63ac..20195d3dbf08 100644
+--- a/drivers/video/fbdev/pxa168fb.c
++++ b/drivers/video/fbdev/pxa168fb.c
+@@ -769,8 +769,8 @@ failed_free_cmap:
+ failed_free_clk:
+ clk_disable_unprepare(fbi->clk);
+ failed_free_fbmem:
+- dma_free_coherent(fbi->dev, info->fix.smem_len,
+- info->screen_base, fbi->fb_start_dma);
++ dma_free_wc(fbi->dev, info->fix.smem_len,
++ info->screen_base, fbi->fb_start_dma);
+ failed_free_info:
+ kfree(info);
+
+@@ -804,7 +804,7 @@ static int pxa168fb_remove(struct platform_device *pdev)
+
+ irq = platform_get_irq(pdev, 0);
+
+- dma_free_wc(fbi->dev, PAGE_ALIGN(info->fix.smem_len),
++ dma_free_wc(fbi->dev, info->fix.smem_len,
+ info->screen_base, info->fix.smem_start);
+
+ clk_disable_unprepare(fbi->clk);
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index 14ac36ca8fbd..1afcbef397ab 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -126,6 +126,8 @@ static void set_page_pfns(struct virtio_balloon *vb,
+ {
+ unsigned int i;
+
++ BUILD_BUG_ON(VIRTIO_BALLOON_PAGES_PER_PAGE > VIRTIO_BALLOON_ARRAY_PFNS_MAX);
++
+ /*
+ * Set balloon pfns pointing at this page.
+ * Note that the first pfn points at start of the page.
+diff --git a/drivers/visorbus/visorchipset.c b/drivers/visorbus/visorchipset.c
+index ca752b8f495f..cb1eb7e05f87 100644
+--- a/drivers/visorbus/visorchipset.c
++++ b/drivers/visorbus/visorchipset.c
+@@ -1210,14 +1210,17 @@ static void setup_crash_devices_work_queue(struct work_struct *work)
+ {
+ struct controlvm_message local_crash_bus_msg;
+ struct controlvm_message local_crash_dev_msg;
+- struct controlvm_message msg;
++ struct controlvm_message msg = {
++ .hdr.id = CONTROLVM_CHIPSET_INIT,
++ .cmd.init_chipset = {
++ .bus_count = 23,
++ .switch_count = 0,
++ },
++ };
+ u32 local_crash_msg_offset;
+ u16 local_crash_msg_count;
+
+ /* send init chipset msg */
+- msg.hdr.id = CONTROLVM_CHIPSET_INIT;
+- msg.cmd.init_chipset.bus_count = 23;
+- msg.cmd.init_chipset.switch_count = 0;
+ chipset_init(&msg);
+ /* get saved message count */
+ if (visorchannel_read(chipset_dev->controlvm_channel,
+diff --git a/drivers/vme/bridges/vme_fake.c b/drivers/vme/bridges/vme_fake.c
+index 7d83691047f4..685a43bdc2a1 100644
+--- a/drivers/vme/bridges/vme_fake.c
++++ b/drivers/vme/bridges/vme_fake.c
+@@ -418,8 +418,9 @@ static void fake_lm_check(struct fake_driver *bridge, unsigned long long addr,
+ }
+ }
+
+-static u8 fake_vmeread8(struct fake_driver *bridge, unsigned long long addr,
+- u32 aspace, u32 cycle)
++static noinline_for_stack u8 fake_vmeread8(struct fake_driver *bridge,
++ unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ u8 retval = 0xff;
+ int i;
+@@ -450,8 +451,9 @@ static u8 fake_vmeread8(struct fake_driver *bridge, unsigned long long addr,
+ return retval;
+ }
+
+-static u16 fake_vmeread16(struct fake_driver *bridge, unsigned long long addr,
+- u32 aspace, u32 cycle)
++static noinline_for_stack u16 fake_vmeread16(struct fake_driver *bridge,
++ unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ u16 retval = 0xffff;
+ int i;
+@@ -482,8 +484,9 @@ static u16 fake_vmeread16(struct fake_driver *bridge, unsigned long long addr,
+ return retval;
+ }
+
+-static u32 fake_vmeread32(struct fake_driver *bridge, unsigned long long addr,
+- u32 aspace, u32 cycle)
++static noinline_for_stack u32 fake_vmeread32(struct fake_driver *bridge,
++ unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ u32 retval = 0xffffffff;
+ int i;
+@@ -613,8 +616,9 @@ out:
+ return retval;
+ }
+
+-static void fake_vmewrite8(struct fake_driver *bridge, u8 *buf,
+- unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite8(struct fake_driver *bridge,
++ u8 *buf, unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ int i;
+ unsigned long long start, end, offset;
+@@ -643,8 +647,9 @@ static void fake_vmewrite8(struct fake_driver *bridge, u8 *buf,
+
+ }
+
+-static void fake_vmewrite16(struct fake_driver *bridge, u16 *buf,
+- unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite16(struct fake_driver *bridge,
++ u16 *buf, unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ int i;
+ unsigned long long start, end, offset;
+@@ -673,8 +678,9 @@ static void fake_vmewrite16(struct fake_driver *bridge, u16 *buf,
+
+ }
+
+-static void fake_vmewrite32(struct fake_driver *bridge, u32 *buf,
+- unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite32(struct fake_driver *bridge,
++ u32 *buf, unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ int i;
+ unsigned long long start, end, offset;
+diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
+index 833cf3c35b4d..3b77c8ab5357 100644
+--- a/fs/btrfs/check-integrity.c
++++ b/fs/btrfs/check-integrity.c
+@@ -629,7 +629,6 @@ static struct btrfsic_dev_state *btrfsic_dev_state_hashtable_lookup(dev_t dev,
+ static int btrfsic_process_superblock(struct btrfsic_state *state,
+ struct btrfs_fs_devices *fs_devices)
+ {
+- struct btrfs_fs_info *fs_info = state->fs_info;
+ struct btrfs_super_block *selected_super;
+ struct list_head *dev_head = &fs_devices->devices;
+ struct btrfs_device *device;
+@@ -700,7 +699,7 @@ static int btrfsic_process_superblock(struct btrfsic_state *state,
+ break;
+ }
+
+- num_copies = btrfs_num_copies(fs_info, next_bytenr,
++ num_copies = btrfs_num_copies(state->fs_info, next_bytenr,
+ state->metablock_size);
+ if (state->print_mask & BTRFSIC_PRINT_MASK_NUM_COPIES)
+ pr_info("num_copies(log_bytenr=%llu) = %d\n",
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index 4cf2817ab120..f9e280d0b44f 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -275,7 +275,8 @@ found:
+ csum += count * csum_size;
+ nblocks -= count;
+ next:
+- while (count--) {
++ while (count > 0) {
++ count--;
+ disk_bytenr += fs_info->sectorsize;
+ offset += fs_info->sectorsize;
+ page_bytes_left -= fs_info->sectorsize;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 5bbcdcff68a9..9c3b394b99fa 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -7260,6 +7260,8 @@ int btrfs_get_dev_stats(struct btrfs_fs_info *fs_info,
+ else
+ btrfs_dev_stat_reset(dev, i);
+ }
++ btrfs_info(fs_info, "device stats zeroed by %s (%d)",
++ current->comm, task_pid_nr(current));
+ } else {
+ for (i = 0; i < BTRFS_DEV_STAT_VALUES_MAX; i++)
+ if (stats->nr_items > i)
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 09db6d08614d..a2e903203bf9 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -2343,8 +2343,7 @@ static void __do_request(struct ceph_mds_client *mdsc,
+ if (!(mdsc->fsc->mount_options->flags &
+ CEPH_MOUNT_OPT_MOUNTWAIT) &&
+ !ceph_mdsmap_is_cluster_available(mdsc->mdsmap)) {
+- err = -ENOENT;
+- pr_info("probably no mds server is up\n");
++ err = -EHOSTUNREACH;
+ goto finish;
+ }
+ }
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index 2bd0b1ed9708..c4314f449240 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -1106,6 +1106,11 @@ static struct dentry *ceph_mount(struct file_system_type *fs_type,
+ return res;
+
+ out_splat:
++ if (!ceph_mdsmap_is_cluster_available(fsc->mdsc->mdsmap)) {
++ pr_info("No mds server is up or the cluster is laggy\n");
++ err = -EHOSTUNREACH;
++ }
++
+ ceph_mdsc_close_sessions(fsc->mdsc);
+ deactivate_locked_super(sb);
+ goto out_final;
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 576cf71576da..6c62ce40608a 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3342,8 +3342,10 @@ match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data)
+ {
+ struct cifs_sb_info *old = CIFS_SB(sb);
+ struct cifs_sb_info *new = mnt_data->cifs_sb;
+- bool old_set = old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
+- bool new_set = new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
++ bool old_set = (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
++ old->prepath;
++ bool new_set = (new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
++ new->prepath;
+
+ if (old_set && new_set && !strcmp(new->prepath, old->prepath))
+ return 1;
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 0d4e4d97e6cf..e2d2b749c8f3 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3425,6 +3425,9 @@ smb2_writev_callback(struct mid_q_entry *mid)
+ wdata->cfile->fid.persistent_fid,
+ tcon->tid, tcon->ses->Suid, wdata->offset,
+ wdata->bytes, wdata->result);
++ if (wdata->result == -ENOSPC)
++ printk_once(KERN_WARNING "Out of space writing to %s\n",
++ tcon->treeName);
+ } else
+ trace_smb3_write_done(0 /* no xid */,
+ wdata->cfile->fid.persistent_fid,
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index f4a24a46245e..52d155b4e733 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -40,9 +40,10 @@ static ssize_t ext4_dax_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ struct inode *inode = file_inode(iocb->ki_filp);
+ ssize_t ret;
+
+- if (!inode_trylock_shared(inode)) {
+- if (iocb->ki_flags & IOCB_NOWAIT)
++ if (iocb->ki_flags & IOCB_NOWAIT) {
++ if (!inode_trylock_shared(inode))
+ return -EAGAIN;
++ } else {
+ inode_lock_shared(inode);
+ }
+ /*
+@@ -190,9 +191,10 @@ ext4_dax_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ struct inode *inode = file_inode(iocb->ki_filp);
+ ssize_t ret;
+
+- if (!inode_trylock(inode)) {
+- if (iocb->ki_flags & IOCB_NOWAIT)
++ if (iocb->ki_flags & IOCB_NOWAIT) {
++ if (!inode_trylock(inode))
+ return -EAGAIN;
++ } else {
+ inode_lock(inode);
+ }
+ ret = ext4_write_checks(iocb, from);
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index 0ace2c2e3de9..4f0cc0c79d1e 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -769,6 +769,7 @@ static int __f2fs_tmpfile(struct inode *dir, struct dentry *dentry,
+
+ if (whiteout) {
+ f2fs_i_links_write(inode, false);
++ inode->i_state |= I_LINKABLE;
+ *whiteout = inode;
+ } else {
+ d_tmpfile(dentry, inode);
+@@ -835,6 +836,12 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ F2FS_I(old_dentry->d_inode)->i_projid)))
+ return -EXDEV;
+
++ if (flags & RENAME_WHITEOUT) {
++ err = f2fs_create_whiteout(old_dir, &whiteout);
++ if (err)
++ return err;
++ }
++
+ err = dquot_initialize(old_dir);
+ if (err)
+ goto out;
+@@ -865,17 +872,11 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ }
+ }
+
+- if (flags & RENAME_WHITEOUT) {
+- err = f2fs_create_whiteout(old_dir, &whiteout);
+- if (err)
+- goto out_dir;
+- }
+-
+ if (new_inode) {
+
+ err = -ENOTEMPTY;
+ if (old_dir_entry && !f2fs_empty_dir(new_inode))
+- goto out_whiteout;
++ goto out_dir;
+
+ err = -ENOENT;
+ new_entry = f2fs_find_entry(new_dir, &new_dentry->d_name,
+@@ -883,7 +884,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ if (!new_entry) {
+ if (IS_ERR(new_page))
+ err = PTR_ERR(new_page);
+- goto out_whiteout;
++ goto out_dir;
+ }
+
+ f2fs_balance_fs(sbi, true);
+@@ -915,7 +916,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ err = f2fs_add_link(new_dentry, old_inode);
+ if (err) {
+ f2fs_unlock_op(sbi);
+- goto out_whiteout;
++ goto out_dir;
+ }
+
+ if (old_dir_entry)
+@@ -939,7 +940,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ if (IS_ERR(old_page))
+ err = PTR_ERR(old_page);
+ f2fs_unlock_op(sbi);
+- goto out_whiteout;
++ goto out_dir;
+ }
+ }
+ }
+@@ -958,7 +959,6 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ f2fs_delete_entry(old_entry, old_page, old_dir, NULL);
+
+ if (whiteout) {
+- whiteout->i_state |= I_LINKABLE;
+ set_inode_flag(whiteout, FI_INC_LINK);
+ err = f2fs_add_link(old_dentry, whiteout);
+ if (err)
+@@ -992,15 +992,14 @@ put_out_dir:
+ f2fs_unlock_op(sbi);
+ if (new_page)
+ f2fs_put_page(new_page, 0);
+-out_whiteout:
+- if (whiteout)
+- iput(whiteout);
+ out_dir:
+ if (old_dir_entry)
+ f2fs_put_page(old_dir_page, 0);
+ out_old:
+ f2fs_put_page(old_page, 0);
+ out:
++ if (whiteout)
++ iput(whiteout);
+ return err;
+ }
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index 98887187af4c..9a59f49ba405 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -658,10 +658,12 @@ int __init f2fs_init_sysfs(void)
+
+ ret = kobject_init_and_add(&f2fs_feat, &f2fs_feat_ktype,
+ NULL, "features");
+- if (ret)
++ if (ret) {
++ kobject_put(&f2fs_feat);
+ kset_unregister(&f2fs_kset);
+- else
++ } else {
+ f2fs_proc_root = proc_mkdir("fs/f2fs", NULL);
++ }
+ return ret;
+ }
+
+@@ -682,8 +684,11 @@ int f2fs_register_sysfs(struct f2fs_sb_info *sbi)
+ init_completion(&sbi->s_kobj_unregister);
+ err = kobject_init_and_add(&sbi->s_kobj, &f2fs_sb_ktype, NULL,
+ "%s", sb->s_id);
+- if (err)
++ if (err) {
++ kobject_put(&sbi->s_kobj);
++ wait_for_completion(&sbi->s_kobj_unregister);
+ return err;
++ }
+
+ if (f2fs_proc_root)
+ sbi->s_proc = proc_mkdir(sb->s_id, f2fs_proc_root);
+@@ -711,4 +716,5 @@ void f2fs_unregister_sysfs(struct f2fs_sb_info *sbi)
+ remove_proc_entry(sbi->sb->s_id, f2fs_proc_root);
+ }
+ kobject_del(&sbi->s_kobj);
++ kobject_put(&sbi->s_kobj);
+ }
+diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
+index 26f8d7e46462..66409cbd3ed5 100644
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -165,7 +165,7 @@ void __jbd2_log_wait_for_space(journal_t *journal)
+ "journal space in %s\n", __func__,
+ journal->j_devname);
+ WARN_ON(1);
+- jbd2_journal_abort(journal, 0);
++ jbd2_journal_abort(journal, -EIO);
+ }
+ write_lock(&journal->j_state_lock);
+ } else {
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index c321fa06081c..4200a6fe9599 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -781,7 +781,7 @@ start_journal_io:
+ err = journal_submit_commit_record(journal, commit_transaction,
+ &cbh, crc32_sum);
+ if (err)
+- __jbd2_journal_abort_hard(journal);
++ jbd2_journal_abort(journal, err);
+ }
+
+ blk_finish_plug(&plug);
+@@ -874,7 +874,7 @@ start_journal_io:
+ err = journal_submit_commit_record(journal, commit_transaction,
+ &cbh, crc32_sum);
+ if (err)
+- __jbd2_journal_abort_hard(journal);
++ jbd2_journal_abort(journal, err);
+ }
+ if (cbh)
+ err = journal_wait_on_commit_record(journal, cbh);
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 1a2339f2cb49..a15a22d20909 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1701,6 +1701,11 @@ int jbd2_journal_load(journal_t *journal)
+ journal->j_devname);
+ return -EFSCORRUPTED;
+ }
++ /*
++ * clear JBD2_ABORT flag initialized in journal_init_common
++ * here to update log tail information with the newest seq.
++ */
++ journal->j_flags &= ~JBD2_ABORT;
+
+ /* OK, we've finished with the dynamic journal bits:
+ * reinitialise the dynamic contents of the superblock in memory
+@@ -1708,7 +1713,6 @@ int jbd2_journal_load(journal_t *journal)
+ if (journal_reset(journal))
+ goto recovery_error;
+
+- journal->j_flags &= ~JBD2_ABORT;
+ journal->j_flags |= JBD2_LOADED;
+ return 0;
+
+@@ -2129,8 +2133,7 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+
+ if (journal->j_flags & JBD2_ABORT) {
+ write_unlock(&journal->j_state_lock);
+- if (!old_errno && old_errno != -ESHUTDOWN &&
+- errno == -ESHUTDOWN)
++ if (old_errno != -ESHUTDOWN && errno == -ESHUTDOWN)
+ jbd2_journal_update_sb_errno(journal);
+ return;
+ }
+@@ -2138,12 +2141,10 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+
+ __jbd2_journal_abort_hard(journal);
+
+- if (errno) {
+- jbd2_journal_update_sb_errno(journal);
+- write_lock(&journal->j_state_lock);
+- journal->j_flags |= JBD2_REC_ERR;
+- write_unlock(&journal->j_state_lock);
+- }
++ jbd2_journal_update_sb_errno(journal);
++ write_lock(&journal->j_state_lock);
++ journal->j_flags |= JBD2_REC_ERR;
++ write_unlock(&journal->j_state_lock);
+ }
+
+ /**
+@@ -2185,11 +2186,6 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+ * failure to disk. ext3_error, for example, now uses this
+ * functionality.
+ *
+- * Errors which originate from within the journaling layer will NOT
+- * supply an errno; a null errno implies that absolutely no further
+- * writes are done to the journal (unless there are any already in
+- * progress).
+- *
+ */
+
+ void jbd2_journal_abort(journal_t *journal, int errno)
+diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
+index 94f98e190e63..526441de89c1 100644
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -283,14 +283,14 @@ static ssize_t _nfs42_proc_copy(struct file *src,
+ status = handle_async_copy(res, server, src, dst,
+ &args->src_stateid);
+ if (status)
+- return status;
++ goto out;
+ }
+
+ if ((!res->synchronous || !args->sync) &&
+ res->write_res.verifier.committed != NFS_FILE_SYNC) {
+ status = process_copy_commit(dst, pos_dst, res);
+ if (status)
+- return status;
++ goto out;
+ }
+
+ truncate_pagecache_range(dst_inode, pos_dst,
+diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
+index 497a4171ef61..bfb50fc51528 100644
+--- a/fs/ocfs2/journal.h
++++ b/fs/ocfs2/journal.h
+@@ -637,9 +637,11 @@ static inline void ocfs2_update_inode_fsync_trans(handle_t *handle,
+ {
+ struct ocfs2_inode_info *oi = OCFS2_I(inode);
+
+- oi->i_sync_tid = handle->h_transaction->t_tid;
+- if (datasync)
+- oi->i_datasync_tid = handle->h_transaction->t_tid;
++ if (!is_handle_aborted(handle)) {
++ oi->i_sync_tid = handle->h_transaction->t_tid;
++ if (datasync)
++ oi->i_datasync_tid = handle->h_transaction->t_tid;
++ }
+ }
+
+ #endif /* OCFS2_JOURNAL_H */
+diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c
+index 0732cb08173e..e24738c691f6 100644
+--- a/fs/orangefs/orangefs-debugfs.c
++++ b/fs/orangefs/orangefs-debugfs.c
+@@ -305,6 +305,7 @@ static void *help_start(struct seq_file *m, loff_t *pos)
+
+ static void *help_next(struct seq_file *m, void *v, loff_t *pos)
+ {
++ (*pos)++;
+ gossip_debug(GOSSIP_DEBUGFS_DEBUG, "help_next: start\n");
+
+ return NULL;
+diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
+index 0037aea97d39..2946713cb00d 100644
+--- a/fs/reiserfs/stree.c
++++ b/fs/reiserfs/stree.c
+@@ -2250,7 +2250,8 @@ error_out:
+ /* also releases the path */
+ unfix_nodes(&s_ins_balance);
+ #ifdef REISERQUOTA_DEBUG
+- reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
++ if (inode)
++ reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
+ "reiserquota insert_item(): freeing %u id=%u type=%c",
+ quota_bytes, inode->i_uid, head2type(ih));
+ #endif
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index 6280efeceb0a..de5eda33c92a 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -1954,7 +1954,7 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
+ if (!sbi->s_jdev) {
+ SWARN(silent, s, "", "Cannot allocate memory for "
+ "journal device name");
+- goto error;
++ goto error_unlocked;
+ }
+ }
+ #ifdef CONFIG_QUOTA
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 6fd0f14e9dd2..1676a175cd7a 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -2469,17 +2469,29 @@ static unsigned int udf_count_free_table(struct super_block *sb,
+ static unsigned int udf_count_free(struct super_block *sb)
+ {
+ unsigned int accum = 0;
+- struct udf_sb_info *sbi;
++ struct udf_sb_info *sbi = UDF_SB(sb);
+ struct udf_part_map *map;
++ unsigned int part = sbi->s_partition;
++ int ptype = sbi->s_partmaps[part].s_partition_type;
++
++ if (ptype == UDF_METADATA_MAP25) {
++ part = sbi->s_partmaps[part].s_type_specific.s_metadata.
++ s_phys_partition_ref;
++ } else if (ptype == UDF_VIRTUAL_MAP15 || ptype == UDF_VIRTUAL_MAP20) {
++ /*
++ * Filesystems with VAT are append-only and we cannot write to
++ * them. Let's just report 0 here.
++ */
++ return 0;
++ }
+
+- sbi = UDF_SB(sb);
+ if (sbi->s_lvid_bh) {
+ struct logicalVolIntegrityDesc *lvid =
+ (struct logicalVolIntegrityDesc *)
+ sbi->s_lvid_bh->b_data;
+- if (le32_to_cpu(lvid->numOfPartitions) > sbi->s_partition) {
++ if (le32_to_cpu(lvid->numOfPartitions) > part) {
+ accum = le32_to_cpu(
+- lvid->freeSpaceTable[sbi->s_partition]);
++ lvid->freeSpaceTable[part]);
+ if (accum == 0xFFFFFFFF)
+ accum = 0;
+ }
+@@ -2488,7 +2500,7 @@ static unsigned int udf_count_free(struct super_block *sb)
+ if (accum)
+ return accum;
+
+- map = &sbi->s_partmaps[sbi->s_partition];
++ map = &sbi->s_partmaps[part];
+ if (map->s_partition_flags & UDF_PART_FLAG_UNALLOC_BITMAP) {
+ accum += udf_count_free_bitmap(sb,
+ map->s_uspace.s_bitmap);
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index 0647f436f88c..50128c36f0b4 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -686,6 +686,7 @@ struct dma_filter {
+ * @fill_align: alignment shift for memset operations
+ * @dev_id: unique device ID
+ * @dev: struct device reference for dma mapping api
++ * @owner: owner module (automatically set based on the provided dev)
+ * @src_addr_widths: bit mask of src addr widths the device supports
+ * Width is specified in bytes, e.g. for a device supporting
+ * a width of 4 the mask should have BIT(4) set.
+@@ -749,6 +750,7 @@ struct dma_device {
+
+ int dev_id;
+ struct device *dev;
++ struct module *owner;
+
+ u32 src_addr_widths;
+ u32 dst_addr_widths;
+diff --git a/include/linux/list_nulls.h b/include/linux/list_nulls.h
+index 3ef96743db8d..1ecd35664e0d 100644
+--- a/include/linux/list_nulls.h
++++ b/include/linux/list_nulls.h
+@@ -72,10 +72,10 @@ static inline void hlist_nulls_add_head(struct hlist_nulls_node *n,
+ struct hlist_nulls_node *first = h->first;
+
+ n->next = first;
+- n->pprev = &h->first;
++ WRITE_ONCE(n->pprev, &h->first);
+ h->first = n;
+ if (!is_a_nulls(first))
+- first->pprev = &n->next;
++ WRITE_ONCE(first->pprev, &n->next);
+ }
+
+ static inline void __hlist_nulls_del(struct hlist_nulls_node *n)
+@@ -85,13 +85,13 @@ static inline void __hlist_nulls_del(struct hlist_nulls_node *n)
+
+ WRITE_ONCE(*pprev, next);
+ if (!is_a_nulls(next))
+- next->pprev = pprev;
++ WRITE_ONCE(next->pprev, pprev);
+ }
+
+ static inline void hlist_nulls_del(struct hlist_nulls_node *n)
+ {
+ __hlist_nulls_del(n);
+- n->pprev = LIST_POISON2;
++ WRITE_ONCE(n->pprev, LIST_POISON2);
+ }
+
+ /**
+diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
+index 61974c4c566b..90f2e2232c6d 100644
+--- a/include/linux/rculist_nulls.h
++++ b/include/linux/rculist_nulls.h
+@@ -34,7 +34,7 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)
+ {
+ if (!hlist_nulls_unhashed(n)) {
+ __hlist_nulls_del(n);
+- n->pprev = NULL;
++ WRITE_ONCE(n->pprev, NULL);
+ }
+ }
+
+@@ -66,7 +66,7 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)
+ static inline void hlist_nulls_del_rcu(struct hlist_nulls_node *n)
+ {
+ __hlist_nulls_del(n);
+- n->pprev = LIST_POISON2;
++ WRITE_ONCE(n->pprev, LIST_POISON2);
+ }
+
+ /**
+@@ -94,10 +94,10 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n,
+ struct hlist_nulls_node *first = h->first;
+
+ n->next = first;
+- n->pprev = &h->first;
++ WRITE_ONCE(n->pprev, &h->first);
+ rcu_assign_pointer(hlist_nulls_first_rcu(h), n);
+ if (!is_a_nulls(first))
+- first->pprev = &n->next;
++ WRITE_ONCE(first->pprev, &n->next);
+ }
+
+ /**
+diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
+index b330e4a08a6b..40840fec337c 100644
+--- a/include/media/v4l2-device.h
++++ b/include/media/v4l2-device.h
+@@ -372,7 +372,7 @@ static inline void v4l2_subdev_notify(struct v4l2_subdev *sd,
+ struct v4l2_subdev *__sd; \
+ \
+ __v4l2_device_call_subdevs_p(v4l2_dev, __sd, \
+- !(grpid) || __sd->grp_id == (grpid), o, f , \
++ (grpid) == 0 || __sd->grp_id == (grpid), o, f , \
+ ##args); \
+ } while (0)
+
+@@ -404,7 +404,7 @@ static inline void v4l2_subdev_notify(struct v4l2_subdev *sd,
+ ({ \
+ struct v4l2_subdev *__sd; \
+ __v4l2_device_call_subdevs_until_err_p(v4l2_dev, __sd, \
+- !(grpid) || __sd->grp_id == (grpid), o, f , \
++ (grpid) == 0 || __sd->grp_id == (grpid), o, f , \
+ ##args); \
+ })
+
+@@ -432,8 +432,8 @@ static inline void v4l2_subdev_notify(struct v4l2_subdev *sd,
+ struct v4l2_subdev *__sd; \
+ \
+ __v4l2_device_call_subdevs_p(v4l2_dev, __sd, \
+- !(grpmsk) || (__sd->grp_id & (grpmsk)), o, f , \
+- ##args); \
++ (grpmsk) == 0 || (__sd->grp_id & (grpmsk)), o, \
++ f , ##args); \
+ } while (0)
+
+ /**
+@@ -463,8 +463,8 @@ static inline void v4l2_subdev_notify(struct v4l2_subdev *sd,
+ ({ \
+ struct v4l2_subdev *__sd; \
+ __v4l2_device_call_subdevs_until_err_p(v4l2_dev, __sd, \
+- !(grpmsk) || (__sd->grp_id & (grpmsk)), o, f , \
+- ##args); \
++ (grpmsk) == 0 || (__sd->grp_id & (grpmsk)), o, \
++ f , ##args); \
+ })
+
+
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index dc9d7ac8228d..c04815bb15cc 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -198,6 +198,7 @@ static void *map_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ void *key = map_iter(m)->key;
+ void *prev_key;
+
++ (*pos)++;
+ if (map_iter(m)->done)
+ return NULL;
+
+@@ -210,8 +211,6 @@ static void *map_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ map_iter(m)->done = true;
+ return NULL;
+ }
+-
+- ++(*pos);
+ return key;
+ }
+
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 8d6b8b5493f9..2d850eaaf82e 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -493,8 +493,7 @@ static int bringup_wait_for_ap(unsigned int cpu)
+ if (WARN_ON_ONCE((!cpu_online(cpu))))
+ return -ECANCELED;
+
+- /* Unpark the stopper thread and the hotplug thread of the target cpu */
+- stop_machine_unpark(cpu);
++ /* Unpark the hotplug thread of the target cpu */
+ kthread_unpark(st->thread);
+
+ /*
+@@ -1048,8 +1047,8 @@ void notify_cpu_starting(unsigned int cpu)
+
+ /*
+ * Called from the idle task. Wake up the controlling task which brings the
+- * stopper and the hotplug thread of the upcoming CPU up and then delegates
+- * the rest of the online bringup to the hotplug thread.
++ * hotplug thread of the upcoming CPU up and then delegates the rest of the
++ * online bringup to the hotplug thread.
+ */
+ void cpuhp_online_idle(enum cpuhp_state state)
+ {
+@@ -1059,6 +1058,12 @@ void cpuhp_online_idle(enum cpuhp_state state)
+ if (state != CPUHP_AP_ONLINE_IDLE)
+ return;
+
++ /*
++ * Unpart the stopper thread before we start the idle loop (and start
++ * scheduling); this ensures the stopper task is always available.
++ */
++ stop_machine_unpark(smp_processor_id());
++
+ st->state = CPUHP_AP_ONLINE_IDLE;
+ complete_ap_thread(st, true);
+ }
+diff --git a/kernel/module.c b/kernel/module.c
+index 70a75a7216ab..20fc0efc679c 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2980,9 +2980,7 @@ static int setup_load_info(struct load_info *info, int flags)
+
+ /* Try to find a name early so we can log errors with a module name */
+ info->index.info = find_sec(info, ".modinfo");
+- if (!info->index.info)
+- info->name = "(missing .modinfo section)";
+- else
++ if (info->index.info)
+ info->name = get_modinfo(info, "name");
+
+ /* Find internal symbols and strings. */
+@@ -2997,14 +2995,15 @@ static int setup_load_info(struct load_info *info, int flags)
+ }
+
+ if (info->index.sym == 0) {
+- pr_warn("%s: module has no symbols (stripped?)\n", info->name);
++ pr_warn("%s: module has no symbols (stripped?)\n",
++ info->name ?: "(missing .modinfo section or name field)");
+ return -ENOEXEC;
+ }
+
+ info->index.mod = find_sec(info, ".gnu.linkonce.this_module");
+ if (!info->index.mod) {
+ pr_warn("%s: No module found in object\n",
+- info->name ?: "(missing .modinfo name field)");
++ info->name ?: "(missing .modinfo section or name field)");
+ return -ENOEXEC;
+ }
+ /* This is temporary: point mod into copy of data. */
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 53795237e975..0c379cd40bea 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -6525,9 +6525,10 @@ static void *fpid_next(struct seq_file *m, void *v, loff_t *pos)
+ struct trace_array *tr = m->private;
+ struct trace_pid_list *pid_list = rcu_dereference_sched(tr->function_pids);
+
+- if (v == FTRACE_NO_PIDS)
++ if (v == FTRACE_NO_PIDS) {
++ (*pos)++;
+ return NULL;
+-
++ }
+ return trace_pid_next(pid_list, v, pos);
+ }
+
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index b05d1b6a6291..9300e8bbf08a 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -115,9 +115,10 @@ static void *trigger_next(struct seq_file *m, void *t, loff_t *pos)
+ {
+ struct trace_event_file *event_file = event_file_data(m->private);
+
+- if (t == SHOW_AVAILABLE_TRIGGERS)
++ if (t == SHOW_AVAILABLE_TRIGGERS) {
++ (*pos)++;
+ return NULL;
+-
++ }
+ return seq_list_next(t, &event_file->triggers, pos);
+ }
+
+diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c
+index 75bf1bcb4a8a..92b76f9e25ed 100644
+--- a/kernel/trace/trace_stat.c
++++ b/kernel/trace/trace_stat.c
+@@ -278,18 +278,22 @@ static int tracing_stat_init(void)
+
+ d_tracing = tracing_init_dentry();
+ if (IS_ERR(d_tracing))
+- return 0;
++ return -ENODEV;
+
+ stat_dir = tracefs_create_dir("trace_stat", d_tracing);
+- if (!stat_dir)
++ if (!stat_dir) {
+ pr_warn("Could not create tracefs 'trace_stat' entry\n");
++ return -ENOMEM;
++ }
+ return 0;
+ }
+
+ static int init_stat_file(struct stat_session *session)
+ {
+- if (!stat_dir && tracing_stat_init())
+- return -ENODEV;
++ int ret;
++
++ if (!stat_dir && (ret = tracing_stat_init()))
++ return ret;
+
+ session->file = tracefs_create_file(session->ts->name, 0644,
+ stat_dir,
+@@ -302,7 +306,7 @@ static int init_stat_file(struct stat_session *session)
+ int register_stat_tracer(struct tracer_stat *trace)
+ {
+ struct stat_session *session, *node;
+- int ret;
++ int ret = -EINVAL;
+
+ if (!trace)
+ return -EINVAL;
+@@ -313,17 +317,15 @@ int register_stat_tracer(struct tracer_stat *trace)
+ /* Already registered? */
+ mutex_lock(&all_stat_sessions_mutex);
+ list_for_each_entry(node, &all_stat_sessions, session_list) {
+- if (node->ts == trace) {
+- mutex_unlock(&all_stat_sessions_mutex);
+- return -EINVAL;
+- }
++ if (node->ts == trace)
++ goto out;
+ }
+- mutex_unlock(&all_stat_sessions_mutex);
+
++ ret = -ENOMEM;
+ /* Init the session */
+ session = kzalloc(sizeof(*session), GFP_KERNEL);
+ if (!session)
+- return -ENOMEM;
++ goto out;
+
+ session->ts = trace;
+ INIT_LIST_HEAD(&session->session_list);
+@@ -332,15 +334,16 @@ int register_stat_tracer(struct tracer_stat *trace)
+ ret = init_stat_file(session);
+ if (ret) {
+ destroy_session(session);
+- return ret;
++ goto out;
+ }
+
++ ret = 0;
+ /* Register */
+- mutex_lock(&all_stat_sessions_mutex);
+ list_add_tail(&session->session_list, &all_stat_sessions);
++ out:
+ mutex_unlock(&all_stat_sessions_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ void unregister_stat_tracer(struct tracer_stat *trace)
+diff --git a/kernel/watchdog.c b/kernel/watchdog.c
+index bbc4940f21af..6d60701dc636 100644
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -161,6 +161,8 @@ static void lockup_detector_update_enable(void)
+
+ #ifdef CONFIG_SOFTLOCKUP_DETECTOR
+
++#define SOFTLOCKUP_RESET ULONG_MAX
++
+ /* Global variables, exported for sysctl */
+ unsigned int __read_mostly softlockup_panic =
+ CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE;
+@@ -267,7 +269,7 @@ notrace void touch_softlockup_watchdog_sched(void)
+ * Preemption can be enabled. It doesn't matter which CPU's timestamp
+ * gets zeroed here, so use the raw_ operation.
+ */
+- raw_cpu_write(watchdog_touch_ts, 0);
++ raw_cpu_write(watchdog_touch_ts, SOFTLOCKUP_RESET);
+ }
+
+ notrace void touch_softlockup_watchdog(void)
+@@ -291,14 +293,14 @@ void touch_all_softlockup_watchdogs(void)
+ * the softlockup check.
+ */
+ for_each_cpu(cpu, &watchdog_allowed_mask)
+- per_cpu(watchdog_touch_ts, cpu) = 0;
++ per_cpu(watchdog_touch_ts, cpu) = SOFTLOCKUP_RESET;
+ wq_watchdog_touch(-1);
+ }
+
+ void touch_softlockup_watchdog_sync(void)
+ {
+ __this_cpu_write(softlockup_touch_sync, true);
+- __this_cpu_write(watchdog_touch_ts, 0);
++ __this_cpu_write(watchdog_touch_ts, SOFTLOCKUP_RESET);
+ }
+
+ static int is_softlockup(unsigned long touch_ts)
+@@ -376,7 +378,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
+ /* .. and repeat */
+ hrtimer_forward_now(hrtimer, ns_to_ktime(sample_period));
+
+- if (touch_ts == 0) {
++ if (touch_ts == SOFTLOCKUP_RESET) {
+ if (unlikely(__this_cpu_read(softlockup_touch_sync))) {
+ /*
+ * If the time stamp was touched atomically
+diff --git a/lib/scatterlist.c b/lib/scatterlist.c
+index 8c3036c37ba0..60e7eca2f4be 100644
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -305,7 +305,7 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents,
+ if (prv)
+ table->nents = ++table->orig_nents;
+
+- return -ENOMEM;
++ return -ENOMEM;
+ }
+
+ sg_init_table(sg, alloc_size);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 1c0224e8fc78..c1a3baf16957 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4306,14 +4306,14 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
+ /* Reinjected packets coming from act_mirred or similar should
+ * not get XDP generic processing.
+ */
+- if (skb_cloned(skb) || skb_is_tc_redirected(skb))
++ if (skb_is_tc_redirected(skb))
+ return XDP_PASS;
+
+ /* XDP packets must be linear and must have sufficient headroom
+ * of XDP_PACKET_HEADROOM bytes. This is the guarantee that also
+ * native XDP provides, thus we need to do it here as well.
+ */
+- if (skb_is_nonlinear(skb) ||
++ if (skb_cloned(skb) || skb_is_nonlinear(skb) ||
+ skb_headroom(skb) < XDP_PACKET_HEADROOM) {
+ int hroom = XDP_PACKET_HEADROOM - skb_headroom(skb);
+ int troom = skb->tail + skb->data_len - skb->end;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 9daf1a4118b5..40b3af05c883 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3207,7 +3207,7 @@ static int __bpf_tx_xdp_map(struct net_device *dev_rx, void *fwd,
+ return err;
+ }
+ default:
+- break;
++ return -EBADRQC;
+ }
+ return 0;
+ }
+diff --git a/net/dsa/tag_qca.c b/net/dsa/tag_qca.c
+index 66a952118dfd..9c0dd31d4445 100644
+--- a/net/dsa/tag_qca.c
++++ b/net/dsa/tag_qca.c
+@@ -41,7 +41,7 @@ static struct sk_buff *qca_tag_xmit(struct sk_buff *skb, struct net_device *dev)
+ struct dsa_port *dp = dsa_slave_to_port(dev);
+ u16 *phdr, hdr;
+
+- if (skb_cow_head(skb, 0) < 0)
++ if (skb_cow_head(skb, QCA_HDR_LEN) < 0)
+ return NULL;
+
+ skb_push(skb, QCA_HDR_LEN);
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index e5444f3ff43f..5e66042ac346 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -218,8 +218,9 @@ static int nft_tunnel_obj_vxlan_init(const struct nlattr *attr,
+ }
+
+ static const struct nla_policy nft_tunnel_opts_erspan_policy[NFTA_TUNNEL_KEY_ERSPAN_MAX + 1] = {
++ [NFTA_TUNNEL_KEY_ERSPAN_VERSION] = { .type = NLA_U32 },
+ [NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX] = { .type = NLA_U32 },
+- [NFTA_TUNNEL_KEY_ERSPAN_V2_DIR] = { .type = NLA_U8 },
++ [NFTA_TUNNEL_KEY_ERSPAN_V2_DIR] = { .type = NLA_U8 },
+ [NFTA_TUNNEL_KEY_ERSPAN_V2_HWID] = { .type = NLA_U8 },
+ };
+
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index 22415311f324..c006d3b89ba3 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -486,6 +486,7 @@ static const struct nla_policy fl_policy[TCA_FLOWER_MAX + 1] = {
+ [TCA_FLOWER_KEY_ENC_IP_TTL_MASK] = { .type = NLA_U8 },
+ [TCA_FLOWER_KEY_ENC_OPTS] = { .type = NLA_NESTED },
+ [TCA_FLOWER_KEY_ENC_OPTS_MASK] = { .type = NLA_NESTED },
++ [TCA_FLOWER_FLAGS] = { .type = NLA_U32 },
+ };
+
+ static const struct nla_policy
+diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
+index 40be745db357..74863b0ff694 100644
+--- a/net/sched/cls_matchall.c
++++ b/net/sched/cls_matchall.c
+@@ -137,6 +137,7 @@ static void *mall_get(struct tcf_proto *tp, u32 handle)
+ static const struct nla_policy mall_policy[TCA_MATCHALL_MAX + 1] = {
+ [TCA_MATCHALL_UNSPEC] = { .type = NLA_UNSPEC },
+ [TCA_MATCHALL_CLASSID] = { .type = NLA_U32 },
++ [TCA_MATCHALL_FLAGS] = { .type = NLA_U32 },
+ };
+
+ static int mall_set_parms(struct net *net, struct tcf_proto *tp,
+diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c
+index 371b4cf31fcd..2379a02c319d 100644
+--- a/net/smc/smc_diag.c
++++ b/net/smc/smc_diag.c
+@@ -38,16 +38,15 @@ static void smc_diag_msg_common_fill(struct smc_diag_msg *r, struct sock *sk)
+ {
+ struct smc_sock *smc = smc_sk(sk);
+
++ memset(r, 0, sizeof(*r));
+ r->diag_family = sk->sk_family;
++ sock_diag_save_cookie(sk, r->id.idiag_cookie);
+ if (!smc->clcsock)
+ return;
+ r->id.idiag_sport = htons(smc->clcsock->sk->sk_num);
+ r->id.idiag_dport = smc->clcsock->sk->sk_dport;
+ r->id.idiag_if = smc->clcsock->sk->sk_bound_dev_if;
+- sock_diag_save_cookie(sk, r->id.idiag_cookie);
+ if (sk->sk_protocol == SMCPROTO_SMC) {
+- memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
+- memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
+ r->id.idiag_src[0] = smc->clcsock->sk->sk_rcv_saddr;
+ r->id.idiag_dst[0] = smc->clcsock->sk->sk_daddr;
+ #if IS_ENABLED(CONFIG_IPV6)
+diff --git a/scripts/Kconfig.include b/scripts/Kconfig.include
+index 3b2861f47709..79455ad6b386 100644
+--- a/scripts/Kconfig.include
++++ b/scripts/Kconfig.include
+@@ -20,7 +20,7 @@ success = $(if-success,$(1),y,n)
+
+ # $(cc-option,<flag>)
+ # Return y if the compiler supports <flag>, n otherwise
+-cc-option = $(success,$(CC) -Werror $(CLANG_FLAGS) $(1) -E -x c /dev/null -o /dev/null)
++cc-option = $(success,$(CC) -Werror $(CLANG_FLAGS) $(1) -S -x c /dev/null -o /dev/null)
+
+ # $(ld-option,<flag>)
+ # Return y if the linker supports <flag>, n otherwise
+diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
+index 0dde19cf7486..2caf5fac102a 100644
+--- a/scripts/kconfig/confdata.c
++++ b/scripts/kconfig/confdata.c
+@@ -1314,7 +1314,7 @@ bool conf_set_all_new_symbols(enum conf_def_mode mode)
+
+ sym_calc_value(csym);
+ if (mode == def_random)
+- has_changed = randomize_choice_values(csym);
++ has_changed |= randomize_choice_values(csym);
+ else {
+ set_all_choice_values(csym);
+ has_changed = true;
+diff --git a/security/selinux/avc.c b/security/selinux/avc.c
+index 5de18a6d5c3f..d52be7b9f08c 100644
+--- a/security/selinux/avc.c
++++ b/security/selinux/avc.c
+@@ -496,7 +496,7 @@ static inline int avc_xperms_audit(struct selinux_state *state,
+ if (likely(!audited))
+ return 0;
+ return slow_avc_audit(state, ssid, tsid, tclass, requested,
+- audited, denied, result, ad, 0);
++ audited, denied, result, ad);
+ }
+
+ static void avc_node_free(struct rcu_head *rhead)
+@@ -689,40 +689,37 @@ static struct avc_node *avc_insert(struct selinux_avc *avc,
+ struct avc_node *pos, *node = NULL;
+ int hvalue;
+ unsigned long flag;
++ spinlock_t *lock;
++ struct hlist_head *head;
+
+ if (avc_latest_notif_update(avc, avd->seqno, 1))
+- goto out;
++ return NULL;
+
+ node = avc_alloc_node(avc);
+- if (node) {
+- struct hlist_head *head;
+- spinlock_t *lock;
+- int rc = 0;
+-
+- hvalue = avc_hash(ssid, tsid, tclass);
+- avc_node_populate(node, ssid, tsid, tclass, avd);
+- rc = avc_xperms_populate(node, xp_node);
+- if (rc) {
+- kmem_cache_free(avc_node_cachep, node);
+- return NULL;
+- }
+- head = &avc->avc_cache.slots[hvalue];
+- lock = &avc->avc_cache.slots_lock[hvalue];
++ if (!node)
++ return NULL;
+
+- spin_lock_irqsave(lock, flag);
+- hlist_for_each_entry(pos, head, list) {
+- if (pos->ae.ssid == ssid &&
+- pos->ae.tsid == tsid &&
+- pos->ae.tclass == tclass) {
+- avc_node_replace(avc, node, pos);
+- goto found;
+- }
++ avc_node_populate(node, ssid, tsid, tclass, avd);
++ if (avc_xperms_populate(node, xp_node)) {
++ avc_node_kill(avc, node);
++ return NULL;
++ }
++
++ hvalue = avc_hash(ssid, tsid, tclass);
++ head = &avc->avc_cache.slots[hvalue];
++ lock = &avc->avc_cache.slots_lock[hvalue];
++ spin_lock_irqsave(lock, flag);
++ hlist_for_each_entry(pos, head, list) {
++ if (pos->ae.ssid == ssid &&
++ pos->ae.tsid == tsid &&
++ pos->ae.tclass == tclass) {
++ avc_node_replace(avc, node, pos);
++ goto found;
+ }
+- hlist_add_head_rcu(&node->list, head);
+-found:
+- spin_unlock_irqrestore(lock, flag);
+ }
+-out:
++ hlist_add_head_rcu(&node->list, head);
++found:
++ spin_unlock_irqrestore(lock, flag);
+ return node;
+ }
+
+@@ -766,8 +763,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
+ noinline int slow_avc_audit(struct selinux_state *state,
+ u32 ssid, u32 tsid, u16 tclass,
+ u32 requested, u32 audited, u32 denied, int result,
+- struct common_audit_data *a,
+- unsigned int flags)
++ struct common_audit_data *a)
+ {
+ struct common_audit_data stack_data;
+ struct selinux_audit_data sad;
+@@ -777,17 +773,6 @@ noinline int slow_avc_audit(struct selinux_state *state,
+ a->type = LSM_AUDIT_DATA_NONE;
+ }
+
+- /*
+- * When in a RCU walk do the audit on the RCU retry. This is because
+- * the collection of the dname in an inode audit message is not RCU
+- * safe. Note this may drop some audits when the situation changes
+- * during retry. However this is logically just as if the operation
+- * happened a little later.
+- */
+- if ((a->type == LSM_AUDIT_DATA_INODE) &&
+- (flags & MAY_NOT_BLOCK))
+- return -ECHILD;
+-
+ sad.tclass = tclass;
+ sad.requested = requested;
+ sad.ssid = ssid;
+@@ -860,16 +845,14 @@ static int avc_update_node(struct selinux_avc *avc,
+ /*
+ * If we are in a non-blocking code path, e.g. VFS RCU walk,
+ * then we must not add permissions to a cache entry
+- * because we cannot safely audit the denial. Otherwise,
++ * because we will not audit the denial. Otherwise,
+ * during the subsequent blocking retry (e.g. VFS ref walk), we
+ * will find the permissions already granted in the cache entry
+ * and won't audit anything at all, leading to silent denials in
+ * permissive mode that only appear when in enforcing mode.
+ *
+- * See the corresponding handling in slow_avc_audit(), and the
+- * logic in selinux_inode_follow_link and selinux_inode_permission
+- * for the VFS MAY_NOT_BLOCK flag, which is transliterated into
+- * AVC_NONBLOCKING for avc_has_perm_noaudit().
++ * See the corresponding handling of MAY_NOT_BLOCK in avc_audit()
++ * and selinux_inode_permission().
+ */
+ if (flags & AVC_NONBLOCKING)
+ return 0;
+@@ -913,7 +896,7 @@ static int avc_update_node(struct selinux_avc *avc,
+ if (orig->ae.xp_node) {
+ rc = avc_xperms_populate(node, orig->ae.xp_node);
+ if (rc) {
+- kmem_cache_free(avc_node_cachep, node);
++ avc_node_kill(avc, node);
+ goto out_unlock;
+ }
+ }
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 040c843968dc..c574285966f9 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -3171,8 +3171,7 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
+
+ static noinline int audit_inode_permission(struct inode *inode,
+ u32 perms, u32 audited, u32 denied,
+- int result,
+- unsigned flags)
++ int result)
+ {
+ struct common_audit_data ad;
+ struct inode_security_struct *isec = inode->i_security;
+@@ -3183,7 +3182,7 @@ static noinline int audit_inode_permission(struct inode *inode,
+
+ rc = slow_avc_audit(&selinux_state,
+ current_sid(), isec->sid, isec->sclass, perms,
+- audited, denied, result, &ad, flags);
++ audited, denied, result, &ad);
+ if (rc)
+ return rc;
+ return 0;
+@@ -3230,7 +3229,11 @@ static int selinux_inode_permission(struct inode *inode, int mask)
+ if (likely(!audited))
+ return rc;
+
+- rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
++ /* fall back to ref-walk if we have to generate audit */
++ if (flags & MAY_NOT_BLOCK)
++ return -ECHILD;
++
++ rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
+ if (rc2)
+ return rc2;
+ return rc;
+diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
+index 74ea50977c20..cf4cc3ef959b 100644
+--- a/security/selinux/include/avc.h
++++ b/security/selinux/include/avc.h
+@@ -100,8 +100,7 @@ static inline u32 avc_audit_required(u32 requested,
+ int slow_avc_audit(struct selinux_state *state,
+ u32 ssid, u32 tsid, u16 tclass,
+ u32 requested, u32 audited, u32 denied, int result,
+- struct common_audit_data *a,
+- unsigned flags);
++ struct common_audit_data *a);
+
+ /**
+ * avc_audit - Audit the granting or denial of permissions.
+@@ -135,9 +134,12 @@ static inline int avc_audit(struct selinux_state *state,
+ audited = avc_audit_required(requested, avd, result, 0, &denied);
+ if (likely(!audited))
+ return 0;
++ /* fall back to ref-walk if we have to generate audit */
++ if (flags & MAY_NOT_BLOCK)
++ return -ECHILD;
+ return slow_avc_audit(state, ssid, tsid, tclass,
+ requested, audited, denied, result,
+- a, flags);
++ a);
+ }
+
+ #define AVC_STRICT 1 /* Ignore permissive mode. */
+diff --git a/sound/core/control.c b/sound/core/control.c
+index 649d3217590e..d1312f14d78f 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -1468,8 +1468,9 @@ static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
+ if (kctl->tlv.c == NULL)
+ return -ENXIO;
+
+- /* When locked, this is unavailable. */
+- if (vd->owner != NULL && vd->owner != file)
++ /* Write and command operations are not allowed for locked element. */
++ if (op_flag != SNDRV_CTL_TLV_OP_READ &&
++ vd->owner != NULL && vd->owner != file)
+ return -EPERM;
+
+ return kctl->tlv.c(kctl, op_flag, size, buf);
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 5500dd437b44..78bb96263bc2 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -935,6 +935,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
++ SND_PCI_QUIRK(0x17aa, 0x21d2, "Lenovo T420s", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD),
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index c827a2a89cc3..c67fadd5aae5 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2604,9 +2604,12 @@ static int alloc_intel_hdmi(struct hda_codec *codec)
+ /* parse and post-process for Intel codecs */
+ static int parse_intel_hdmi(struct hda_codec *codec)
+ {
+- int err;
++ int err, retries = 3;
++
++ do {
++ err = hdmi_parse_codec(codec);
++ } while (err < 0 && retries--);
+
+- err = hdmi_parse_codec(codec);
+ if (err < 0) {
+ generic_spec_free(codec);
+ return err;
+diff --git a/sound/sh/aica.c b/sound/sh/aica.c
+index ad3f71358486..69ac44b33560 100644
+--- a/sound/sh/aica.c
++++ b/sound/sh/aica.c
+@@ -117,10 +117,10 @@ static void spu_memset(u32 toi, u32 what, int length)
+ }
+
+ /* spu_memload - write to SPU address space */
+-static void spu_memload(u32 toi, void *from, int length)
++static void spu_memload(u32 toi, const void *from, int length)
+ {
+ unsigned long flags;
+- u32 *froml = from;
++ const u32 *froml = from;
+ u32 __iomem *to = (u32 __iomem *) (SPU_MEMORY_BASE + toi);
+ int i;
+ u32 val;
+diff --git a/sound/sh/sh_dac_audio.c b/sound/sh/sh_dac_audio.c
+index 834b2574786f..6251b5e1b64a 100644
+--- a/sound/sh/sh_dac_audio.c
++++ b/sound/sh/sh_dac_audio.c
+@@ -190,7 +190,6 @@ static int snd_sh_dac_pcm_copy(struct snd_pcm_substream *substream,
+ {
+ /* channel is not used (interleaved data) */
+ struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+- struct snd_pcm_runtime *runtime = substream->runtime;
+
+ if (copy_from_user_toio(chip->data_buffer + pos, src, count))
+ return -EFAULT;
+@@ -210,7 +209,6 @@ static int snd_sh_dac_pcm_copy_kernel(struct snd_pcm_substream *substream,
+ {
+ /* channel is not used (interleaved data) */
+ struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+- struct snd_pcm_runtime *runtime = substream->runtime;
+
+ memcpy_toio(chip->data_buffer + pos, src, count);
+ chip->buffer_end = chip->data_buffer + pos + count;
+@@ -229,7 +227,6 @@ static int snd_sh_dac_pcm_silence(struct snd_pcm_substream *substream,
+ {
+ /* channel is not used (interleaved data) */
+ struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+- struct snd_pcm_runtime *runtime = substream->runtime;
+
+ memset_io(chip->data_buffer + pos, 0, count);
+ chip->buffer_end = chip->data_buffer + pos + count;
+diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig
+index 64b784e96f84..dad778e5884b 100644
+--- a/sound/soc/atmel/Kconfig
++++ b/sound/soc/atmel/Kconfig
+@@ -25,6 +25,8 @@ config SND_ATMEL_SOC_DMA
+
+ config SND_ATMEL_SOC_SSC_DMA
+ tristate
++ select SND_ATMEL_SOC_DMA
++ select SND_ATMEL_SOC_PDC
+
+ config SND_ATMEL_SOC_SSC
+ tristate
+diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
+index c1dd9a7b48df..36b345970364 100644
+--- a/sound/usb/usx2y/usX2Yhwdep.c
++++ b/sound/usb/usx2y/usX2Yhwdep.c
+@@ -131,7 +131,7 @@ static int snd_usX2Y_hwdep_dsp_status(struct snd_hwdep *hw,
+ info->num_dsps = 2; // 0: Prepad Data, 1: FPGA Code
+ if (us428->chip_status & USX2Y_STAT_CHIP_INIT)
+ info->chip_ready = 1;
+- info->version = USX2Y_DRIVER_VERSION;
++ info->version = USX2Y_DRIVER_VERSION;
+ return 0;
+ }
+
+diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
+index 7aba8243a0e7..bd021a0eeef8 100644
+--- a/tools/lib/api/fs/fs.c
++++ b/tools/lib/api/fs/fs.c
+@@ -210,6 +210,7 @@ static bool fs__env_override(struct fs *fs)
+ size_t name_len = strlen(fs->name);
+ /* name + "_PATH" + '\0' */
+ char upper_name[name_len + 5 + 1];
++
+ memcpy(upper_name, fs->name, name_len);
+ mem_toupper(upper_name, name_len);
+ strcpy(&upper_name[name_len], "_PATH");
+@@ -219,7 +220,8 @@ static bool fs__env_override(struct fs *fs)
+ return false;
+
+ fs->found = true;
+- strncpy(fs->path, override_path, sizeof(fs->path));
++ strncpy(fs->path, override_path, sizeof(fs->path) - 1);
++ fs->path[sizeof(fs->path) - 1] = '\0';
+ return true;
+ }
+
+diff --git a/tools/objtool/arch/x86/lib/x86-opcode-map.txt b/tools/objtool/arch/x86/lib/x86-opcode-map.txt
+index 0a0e9112f284..5cb9f009f2be 100644
+--- a/tools/objtool/arch/x86/lib/x86-opcode-map.txt
++++ b/tools/objtool/arch/x86/lib/x86-opcode-map.txt
+@@ -909,7 +909,7 @@ EndTable
+
+ GrpTable: Grp3_2
+ 0: TEST Ev,Iz
+-1:
++1: TEST Ev,Iz
+ 2: NOT Ev
+ 3: NEG Ev
+ 4: MUL rAX,Ev
+diff --git a/tools/testing/selftests/bpf/test_select_reuseport.c b/tools/testing/selftests/bpf/test_select_reuseport.c
+index 75646d9b34aa..cdbbdab2725f 100644
+--- a/tools/testing/selftests/bpf/test_select_reuseport.c
++++ b/tools/testing/selftests/bpf/test_select_reuseport.c
+@@ -30,7 +30,7 @@
+ #define REUSEPORT_ARRAY_SIZE 32
+
+ static int result_map, tmp_index_ovr_map, linum_map, data_check_map;
+-static enum result expected_results[NR_RESULTS];
++static __u32 expected_results[NR_RESULTS];
+ static int sk_fds[REUSEPORT_ARRAY_SIZE];
+ static int reuseport_array, outer_map;
+ static int select_by_skb_data_prog;
+@@ -610,7 +610,19 @@ static void setup_per_test(int type, unsigned short family, bool inany)
+
+ static void cleanup_per_test(void)
+ {
+- int i, err;
++ int i, err, zero = 0;
++
++ memset(expected_results, 0, sizeof(expected_results));
++
++ for (i = 0; i < NR_RESULTS; i++) {
++ err = bpf_map_update_elem(result_map, &i, &zero, BPF_ANY);
++ RET_IF(err, "reset elem in result_map",
++ "i:%u err:%d errno:%d\n", i, err, errno);
++ }
++
++ err = bpf_map_update_elem(linum_map, &zero, &zero, BPF_ANY);
++ RET_IF(err, "reset line number in linum_map", "err:%d errno:%d\n",
++ err, errno);
+
+ for (i = 0; i < REUSEPORT_ARRAY_SIZE; i++)
+ close(sk_fds[i]);
+diff --git a/tools/testing/selftests/size/get_size.c b/tools/testing/selftests/size/get_size.c
+index d4b59ab979a0..f55943b6d1e2 100644
+--- a/tools/testing/selftests/size/get_size.c
++++ b/tools/testing/selftests/size/get_size.c
+@@ -12,23 +12,35 @@
+ * own execution. It also attempts to have as few dependencies
+ * on kernel features as possible.
+ *
+- * It should be statically linked, with startup libs avoided.
+- * It uses no library calls, and only the following 3 syscalls:
++ * It should be statically linked, with startup libs avoided. It uses
++ * no library calls except the syscall() function for the following 3
++ * syscalls:
+ * sysinfo(), write(), and _exit()
+ *
+ * For output, it avoids printf (which in some C libraries
+ * has large external dependencies) by implementing it's own
+ * number output and print routines, and using __builtin_strlen()
++ *
++ * The test may crash if any of the above syscalls fails because in some
++ * libc implementations (e.g. the GNU C Library) errno is saved in
++ * thread-local storage, which does not get initialized due to avoiding
++ * startup libs.
+ */
+
+ #include <sys/sysinfo.h>
+ #include <unistd.h>
++#include <sys/syscall.h>
+
+ #define STDOUT_FILENO 1
+
+ static int print(const char *s)
+ {
+- return write(STDOUT_FILENO, s, __builtin_strlen(s));
++ size_t len = 0;
++
++ while (s[len] != '\0')
++ len++;
++
++ return syscall(SYS_write, STDOUT_FILENO, s, len);
+ }
+
+ static inline char *num_to_str(unsigned long num, char *buf, int len)
+@@ -80,12 +92,12 @@ void _start(void)
+ print("TAP version 13\n");
+ print("# Testing system size.\n");
+
+- ccode = sysinfo(&info);
++ ccode = syscall(SYS_sysinfo, &info);
+ if (ccode < 0) {
+ print("not ok 1");
+ print(test_name);
+ print(" ---\n reason: \"could not get sysinfo\"\n ...\n");
+- _exit(ccode);
++ syscall(SYS_exit, ccode);
+ }
+ print("ok 1");
+ print(test_name);
+@@ -101,5 +113,5 @@ void _start(void)
+ print(" ...\n");
+ print("1..1\n");
+
+- _exit(0);
++ syscall(SYS_exit, 0);
+ }
+diff --git a/tools/usb/usbip/src/usbip_network.c b/tools/usb/usbip/src/usbip_network.c
+index 8ffcd47d9638..902f55208e23 100644
+--- a/tools/usb/usbip/src/usbip_network.c
++++ b/tools/usb/usbip/src/usbip_network.c
+@@ -62,39 +62,39 @@ void usbip_setup_port_number(char *arg)
+ info("using port %d (\"%s\")", usbip_port, usbip_port_string);
+ }
+
+-void usbip_net_pack_uint32_t(int pack, uint32_t *num)
++uint32_t usbip_net_pack_uint32_t(int pack, uint32_t num)
+ {
+ uint32_t i;
+
+ if (pack)
+- i = htonl(*num);
++ i = htonl(num);
+ else
+- i = ntohl(*num);
++ i = ntohl(num);
+
+- *num = i;
++ return i;
+ }
+
+-void usbip_net_pack_uint16_t(int pack, uint16_t *num)
++uint16_t usbip_net_pack_uint16_t(int pack, uint16_t num)
+ {
+ uint16_t i;
+
+ if (pack)
+- i = htons(*num);
++ i = htons(num);
+ else
+- i = ntohs(*num);
++ i = ntohs(num);
+
+- *num = i;
++ return i;
+ }
+
+ void usbip_net_pack_usb_device(int pack, struct usbip_usb_device *udev)
+ {
+- usbip_net_pack_uint32_t(pack, &udev->busnum);
+- usbip_net_pack_uint32_t(pack, &udev->devnum);
+- usbip_net_pack_uint32_t(pack, &udev->speed);
++ udev->busnum = usbip_net_pack_uint32_t(pack, udev->busnum);
++ udev->devnum = usbip_net_pack_uint32_t(pack, udev->devnum);
++ udev->speed = usbip_net_pack_uint32_t(pack, udev->speed);
+
+- usbip_net_pack_uint16_t(pack, &udev->idVendor);
+- usbip_net_pack_uint16_t(pack, &udev->idProduct);
+- usbip_net_pack_uint16_t(pack, &udev->bcdDevice);
++ udev->idVendor = usbip_net_pack_uint16_t(pack, udev->idVendor);
++ udev->idProduct = usbip_net_pack_uint16_t(pack, udev->idProduct);
++ udev->bcdDevice = usbip_net_pack_uint16_t(pack, udev->bcdDevice);
+ }
+
+ void usbip_net_pack_usb_interface(int pack __attribute__((unused)),
+@@ -141,6 +141,14 @@ ssize_t usbip_net_send(int sockfd, void *buff, size_t bufflen)
+ return usbip_net_xmit(sockfd, buff, bufflen, 1);
+ }
+
++static inline void usbip_net_pack_op_common(int pack,
++ struct op_common *op_common)
++{
++ op_common->version = usbip_net_pack_uint16_t(pack, op_common->version);
++ op_common->code = usbip_net_pack_uint16_t(pack, op_common->code);
++ op_common->status = usbip_net_pack_uint32_t(pack, op_common->status);
++}
++
+ int usbip_net_send_op_common(int sockfd, uint32_t code, uint32_t status)
+ {
+ struct op_common op_common;
+@@ -152,7 +160,7 @@ int usbip_net_send_op_common(int sockfd, uint32_t code, uint32_t status)
+ op_common.code = code;
+ op_common.status = status;
+
+- PACK_OP_COMMON(1, &op_common);
++ usbip_net_pack_op_common(1, &op_common);
+
+ rc = usbip_net_send(sockfd, &op_common, sizeof(op_common));
+ if (rc < 0) {
+@@ -176,7 +184,7 @@ int usbip_net_recv_op_common(int sockfd, uint16_t *code, int *status)
+ goto err;
+ }
+
+- PACK_OP_COMMON(0, &op_common);
++ usbip_net_pack_op_common(0, &op_common);
+
+ if (op_common.version != USBIP_VERSION) {
+ err("USBIP Kernel and tool version mismatch: %d %d:",
+diff --git a/tools/usb/usbip/src/usbip_network.h b/tools/usb/usbip/src/usbip_network.h
+index 555215eae43e..83b4c5344f72 100644
+--- a/tools/usb/usbip/src/usbip_network.h
++++ b/tools/usb/usbip/src/usbip_network.h
+@@ -32,12 +32,6 @@ struct op_common {
+
+ } __attribute__((packed));
+
+-#define PACK_OP_COMMON(pack, op_common) do {\
+- usbip_net_pack_uint16_t(pack, &(op_common)->version);\
+- usbip_net_pack_uint16_t(pack, &(op_common)->code);\
+- usbip_net_pack_uint32_t(pack, &(op_common)->status);\
+-} while (0)
+-
+ /* ---------------------------------------------------------------------- */
+ /* Dummy Code */
+ #define OP_UNSPEC 0x00
+@@ -163,11 +157,11 @@ struct op_devlist_reply_extra {
+ } while (0)
+
+ #define PACK_OP_DEVLIST_REPLY(pack, reply) do {\
+- usbip_net_pack_uint32_t(pack, &(reply)->ndev);\
++ (reply)->ndev = usbip_net_pack_uint32_t(pack, (reply)->ndev);\
+ } while (0)
+
+-void usbip_net_pack_uint32_t(int pack, uint32_t *num);
+-void usbip_net_pack_uint16_t(int pack, uint16_t *num);
++uint32_t usbip_net_pack_uint32_t(int pack, uint32_t num);
++uint16_t usbip_net_pack_uint16_t(int pack, uint16_t num);
+ void usbip_net_pack_usb_device(int pack, struct usbip_usb_device *udev);
+ void usbip_net_pack_usb_interface(int pack, struct usbip_usb_interface *uinf);
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-02-28 16:38 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-02-28 16:38 UTC (permalink / raw
To: gentoo-commits
commit: 95211ef5ab2b6b97467a0a274eeb89815029df2e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 28 16:38:04 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Feb 28 16:38:04 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=95211ef5
Linux patch 4.19.107
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1106_linux-4.19.107.patch | 4497 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4501 insertions(+)
diff --git a/0000_README b/0000_README
index 3213eab..7d48aad 100644
--- a/0000_README
+++ b/0000_README
@@ -463,6 +463,10 @@ Patch: 1105_linux-4.19.106.patch
From: https://www.kernel.org
Desc: Linux 4.19.106
+Patch: 1106_linux-4.19.107.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.107
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1106_linux-4.19.107.patch b/1106_linux-4.19.107.patch
new file mode 100644
index 0000000..4d8e950
--- /dev/null
+++ b/1106_linux-4.19.107.patch
@@ -0,0 +1,4497 @@
+diff --git a/MAINTAINERS b/MAINTAINERS
+index d735500d3dad..b9f9da0b886f 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -7340,7 +7340,7 @@ M: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+ M: Rodrigo Vivi <rodrigo.vivi@intel.com>
+ L: intel-gfx@lists.freedesktop.org
+ W: https://01.org/linuxgraphics/
+-B: https://01.org/linuxgraphics/documentation/how-report-bugs
++B: https://gitlab.freedesktop.org/drm/intel/-/wikis/How-to-file-i915-bugs
+ C: irc://chat.freenode.net/intel-gfx
+ Q: http://patchwork.freedesktop.org/project/intel-gfx/
+ T: git git://anongit.freedesktop.org/drm-intel
+diff --git a/Makefile b/Makefile
+index c010fd4a3286..69e2527a6968 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 106
++SUBLEVEL = 107
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c
+index b3e8db376ecd..57b3745f7f1b 100644
+--- a/arch/powerpc/kernel/signal.c
++++ b/arch/powerpc/kernel/signal.c
+@@ -200,14 +200,27 @@ unsigned long get_tm_stackpointer(struct task_struct *tsk)
+ * normal/non-checkpointed stack pointer.
+ */
+
++ unsigned long ret = tsk->thread.regs->gpr[1];
++
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ BUG_ON(tsk != current);
+
+ if (MSR_TM_ACTIVE(tsk->thread.regs->msr)) {
++ preempt_disable();
+ tm_reclaim_current(TM_CAUSE_SIGNAL);
+ if (MSR_TM_TRANSACTIONAL(tsk->thread.regs->msr))
+- return tsk->thread.ckpt_regs.gpr[1];
++ ret = tsk->thread.ckpt_regs.gpr[1];
++
++ /*
++ * If we treclaim, we must clear the current thread's TM bits
++ * before re-enabling preemption. Otherwise we might be
++ * preempted and have the live MSR[TS] changed behind our back
++ * (tm_recheckpoint_new_task() would recheckpoint). Besides, we
++ * enter the signal handler in non-transactional state.
++ */
++ tsk->thread.regs->msr &= ~MSR_TS_MASK;
++ preempt_enable();
+ }
+ #endif
+- return tsk->thread.regs->gpr[1];
++ return ret;
+ }
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index 906b05c2adae..06b4b828d258 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -493,19 +493,11 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
+ */
+ static int save_tm_user_regs(struct pt_regs *regs,
+ struct mcontext __user *frame,
+- struct mcontext __user *tm_frame, int sigret)
++ struct mcontext __user *tm_frame, int sigret,
++ unsigned long msr)
+ {
+- unsigned long msr = regs->msr;
+-
+ WARN_ON(tm_suspend_disabled);
+
+- /* Remove TM bits from thread's MSR. The MSR in the sigcontext
+- * just indicates to userland that we were doing a transaction, but we
+- * don't want to return in transactional state. This also ensures
+- * that flush_fp_to_thread won't set TIF_RESTORE_TM again.
+- */
+- regs->msr &= ~MSR_TS_MASK;
+-
+ /* Save both sets of general registers */
+ if (save_general_regs(¤t->thread.ckpt_regs, frame)
+ || save_general_regs(regs, tm_frame))
+@@ -916,6 +908,10 @@ int handle_rt_signal32(struct ksignal *ksig, sigset_t *oldset,
+ int sigret;
+ unsigned long tramp;
+ struct pt_regs *regs = tsk->thread.regs;
++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++ /* Save the thread's msr before get_tm_stackpointer() changes it */
++ unsigned long msr = regs->msr;
++#endif
+
+ BUG_ON(tsk != current);
+
+@@ -948,13 +944,13 @@ int handle_rt_signal32(struct ksignal *ksig, sigset_t *oldset,
+
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ tm_frame = &rt_sf->uc_transact.uc_mcontext;
+- if (MSR_TM_ACTIVE(regs->msr)) {
++ if (MSR_TM_ACTIVE(msr)) {
+ if (__put_user((unsigned long)&rt_sf->uc_transact,
+ &rt_sf->uc.uc_link) ||
+ __put_user((unsigned long)tm_frame,
+ &rt_sf->uc_transact.uc_regs))
+ goto badframe;
+- if (save_tm_user_regs(regs, frame, tm_frame, sigret))
++ if (save_tm_user_regs(regs, frame, tm_frame, sigret, msr))
+ goto badframe;
+ }
+ else
+@@ -1365,6 +1361,10 @@ int handle_signal32(struct ksignal *ksig, sigset_t *oldset,
+ int sigret;
+ unsigned long tramp;
+ struct pt_regs *regs = tsk->thread.regs;
++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++ /* Save the thread's msr before get_tm_stackpointer() changes it */
++ unsigned long msr = regs->msr;
++#endif
+
+ BUG_ON(tsk != current);
+
+@@ -1398,9 +1398,9 @@ int handle_signal32(struct ksignal *ksig, sigset_t *oldset,
+
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ tm_mctx = &frame->mctx_transact;
+- if (MSR_TM_ACTIVE(regs->msr)) {
++ if (MSR_TM_ACTIVE(msr)) {
+ if (save_tm_user_regs(regs, &frame->mctx, &frame->mctx_transact,
+- sigret))
++ sigret, msr))
+ goto badframe;
+ }
+ else
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
+index b5933d7219db..b088b0700d0d 100644
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -196,7 +196,8 @@ static long setup_sigcontext(struct sigcontext __user *sc,
+ static long setup_tm_sigcontexts(struct sigcontext __user *sc,
+ struct sigcontext __user *tm_sc,
+ struct task_struct *tsk,
+- int signr, sigset_t *set, unsigned long handler)
++ int signr, sigset_t *set, unsigned long handler,
++ unsigned long msr)
+ {
+ /* When CONFIG_ALTIVEC is set, we _always_ setup v_regs even if the
+ * process never used altivec yet (MSR_VEC is zero in pt_regs of
+@@ -211,12 +212,11 @@ static long setup_tm_sigcontexts(struct sigcontext __user *sc,
+ elf_vrreg_t __user *tm_v_regs = sigcontext_vmx_regs(tm_sc);
+ #endif
+ struct pt_regs *regs = tsk->thread.regs;
+- unsigned long msr = tsk->thread.regs->msr;
+ long err = 0;
+
+ BUG_ON(tsk != current);
+
+- BUG_ON(!MSR_TM_ACTIVE(regs->msr));
++ BUG_ON(!MSR_TM_ACTIVE(msr));
+
+ WARN_ON(tm_suspend_disabled);
+
+@@ -226,13 +226,6 @@ static long setup_tm_sigcontexts(struct sigcontext __user *sc,
+ */
+ msr |= tsk->thread.ckpt_regs.msr & (MSR_FP | MSR_VEC | MSR_VSX);
+
+- /* Remove TM bits from thread's MSR. The MSR in the sigcontext
+- * just indicates to userland that we were doing a transaction, but we
+- * don't want to return in transactional state. This also ensures
+- * that flush_fp_to_thread won't set TIF_RESTORE_TM again.
+- */
+- regs->msr &= ~MSR_TS_MASK;
+-
+ #ifdef CONFIG_ALTIVEC
+ err |= __put_user(v_regs, &sc->v_regs);
+ err |= __put_user(tm_v_regs, &tm_sc->v_regs);
+@@ -803,6 +796,10 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set,
+ unsigned long newsp = 0;
+ long err = 0;
+ struct pt_regs *regs = tsk->thread.regs;
++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++ /* Save the thread's msr before get_tm_stackpointer() changes it */
++ unsigned long msr = regs->msr;
++#endif
+
+ BUG_ON(tsk != current);
+
+@@ -820,7 +817,7 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set,
+ err |= __put_user(0, &frame->uc.uc_flags);
+ err |= __save_altstack(&frame->uc.uc_stack, regs->gpr[1]);
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+- if (MSR_TM_ACTIVE(regs->msr)) {
++ if (MSR_TM_ACTIVE(msr)) {
+ /* The ucontext_t passed to userland points to the second
+ * ucontext_t (for transactional state) with its uc_link ptr.
+ */
+@@ -828,7 +825,8 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set,
+ err |= setup_tm_sigcontexts(&frame->uc.uc_mcontext,
+ &frame->uc_transact.uc_mcontext,
+ tsk, ksig->sig, NULL,
+- (unsigned long)ksig->ka.sa.sa_handler);
++ (unsigned long)ksig->ka.sa.sa_handler,
++ msr);
+ } else
+ #endif
+ {
+diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
+index ac3c86b21d79..349b1c1ef779 100644
+--- a/arch/s390/include/asm/page.h
++++ b/arch/s390/include/asm/page.h
+@@ -42,7 +42,7 @@ void __storage_key_init_range(unsigned long start, unsigned long end);
+
+ static inline void storage_key_init_range(unsigned long start, unsigned long end)
+ {
+- if (PAGE_DEFAULT_KEY)
++ if (PAGE_DEFAULT_KEY != 0)
+ __storage_key_init_range(start, end);
+ }
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 21a58fcc3dd4..067288d4ef6e 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1040,7 +1040,7 @@ struct kvm_x86_ops {
+ void (*load_eoi_exitmap)(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap);
+ void (*set_virtual_apic_mode)(struct kvm_vcpu *vcpu);
+ void (*set_apic_access_page_addr)(struct kvm_vcpu *vcpu, hpa_t hpa);
+- void (*deliver_posted_interrupt)(struct kvm_vcpu *vcpu, int vector);
++ int (*deliver_posted_interrupt)(struct kvm_vcpu *vcpu, int vector);
+ int (*sync_pir_to_irr)(struct kvm_vcpu *vcpu);
+ int (*set_tss_addr)(struct kvm *kvm, unsigned int addr);
+ int (*set_identity_map_addr)(struct kvm *kvm, u64 ident_addr);
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 0f4feee6d082..d2c25a13e1ce 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -455,6 +455,8 @@
+ #define MSR_K7_HWCR 0xc0010015
+ #define MSR_K7_HWCR_SMMLOCK_BIT 0
+ #define MSR_K7_HWCR_SMMLOCK BIT_ULL(MSR_K7_HWCR_SMMLOCK_BIT)
++#define MSR_K7_HWCR_IRPERF_EN_BIT 30
++#define MSR_K7_HWCR_IRPERF_EN BIT_ULL(MSR_K7_HWCR_IRPERF_EN_BIT)
+ #define MSR_K7_FID_VID_CTL 0xc0010041
+ #define MSR_K7_FID_VID_STATUS 0xc0010042
+
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 75715fa0e822..120769955687 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -25,6 +25,7 @@
+
+ static const int amd_erratum_383[];
+ static const int amd_erratum_400[];
++static const int amd_erratum_1054[];
+ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum);
+
+ /*
+@@ -983,6 +984,15 @@ static void init_amd(struct cpuinfo_x86 *c)
+ /* AMD CPUs don't reset SS attributes on SYSRET, Xen does. */
+ if (!cpu_has(c, X86_FEATURE_XENPV))
+ set_cpu_bug(c, X86_BUG_SYSRET_SS_ATTRS);
++
++ /*
++ * Turn on the Instructions Retired free counter on machines not
++ * susceptible to erratum #1054 "Instructions Retired Performance
++ * Counter May Be Inaccurate".
++ */
++ if (cpu_has(c, X86_FEATURE_IRPERF) &&
++ !cpu_has_amd_erratum(c, amd_erratum_1054))
++ msr_set_bit(MSR_K7_HWCR, MSR_K7_HWCR_IRPERF_EN_BIT);
+ }
+
+ #ifdef CONFIG_X86_32
+@@ -1110,6 +1120,10 @@ static const int amd_erratum_400[] =
+ static const int amd_erratum_383[] =
+ AMD_OSVW_ERRATUM(3, AMD_MODEL_RANGE(0x10, 0, 0, 0xff, 0xf));
+
++/* #1054: Instructions Retired Performance Counter May Be Inaccurate */
++static const int amd_erratum_1054[] =
++ AMD_OSVW_ERRATUM(0, AMD_MODEL_RANGE(0x17, 0, 0, 0x2f, 0xf));
++
+
+ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
+ {
+diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+index da0b6967349a..f878d24ff3c1 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -1117,9 +1117,12 @@ static const struct sysfs_ops threshold_ops = {
+ .store = store,
+ };
+
++static void threshold_block_release(struct kobject *kobj);
++
+ static struct kobj_type threshold_ktype = {
+ .sysfs_ops = &threshold_ops,
+ .default_attrs = default_attrs,
++ .release = threshold_block_release,
+ };
+
+ static const char *get_name(unsigned int bank, struct threshold_block *b)
+@@ -1152,8 +1155,9 @@ static const char *get_name(unsigned int bank, struct threshold_block *b)
+ return buf_mcatype;
+ }
+
+-static int allocate_threshold_blocks(unsigned int cpu, unsigned int bank,
+- unsigned int block, u32 address)
++static int allocate_threshold_blocks(unsigned int cpu, struct threshold_bank *tb,
++ unsigned int bank, unsigned int block,
++ u32 address)
+ {
+ struct threshold_block *b = NULL;
+ u32 low, high;
+@@ -1197,16 +1201,12 @@ static int allocate_threshold_blocks(unsigned int cpu, unsigned int bank,
+
+ INIT_LIST_HEAD(&b->miscj);
+
+- if (per_cpu(threshold_banks, cpu)[bank]->blocks) {
+- list_add(&b->miscj,
+- &per_cpu(threshold_banks, cpu)[bank]->blocks->miscj);
+- } else {
+- per_cpu(threshold_banks, cpu)[bank]->blocks = b;
+- }
++ if (tb->blocks)
++ list_add(&b->miscj, &tb->blocks->miscj);
++ else
++ tb->blocks = b;
+
+- err = kobject_init_and_add(&b->kobj, &threshold_ktype,
+- per_cpu(threshold_banks, cpu)[bank]->kobj,
+- get_name(bank, b));
++ err = kobject_init_and_add(&b->kobj, &threshold_ktype, tb->kobj, get_name(bank, b));
+ if (err)
+ goto out_free;
+ recurse:
+@@ -1214,7 +1214,7 @@ recurse:
+ if (!address)
+ return 0;
+
+- err = allocate_threshold_blocks(cpu, bank, block, address);
++ err = allocate_threshold_blocks(cpu, tb, bank, block, address);
+ if (err)
+ goto out_free;
+
+@@ -1299,8 +1299,6 @@ static int threshold_create_bank(unsigned int cpu, unsigned int bank)
+ goto out_free;
+ }
+
+- per_cpu(threshold_banks, cpu)[bank] = b;
+-
+ if (is_shared_bank(bank)) {
+ refcount_set(&b->cpus, 1);
+
+@@ -1311,9 +1309,13 @@ static int threshold_create_bank(unsigned int cpu, unsigned int bank)
+ }
+ }
+
+- err = allocate_threshold_blocks(cpu, bank, 0, msr_ops.misc(bank));
+- if (!err)
+- goto out;
++ err = allocate_threshold_blocks(cpu, b, bank, 0, msr_ops.misc(bank));
++ if (err)
++ goto out_free;
++
++ per_cpu(threshold_banks, cpu)[bank] = b;
++
++ return 0;
+
+ out_free:
+ kfree(b);
+@@ -1322,8 +1324,12 @@ static int threshold_create_bank(unsigned int cpu, unsigned int bank)
+ return err;
+ }
+
+-static void deallocate_threshold_block(unsigned int cpu,
+- unsigned int bank)
++static void threshold_block_release(struct kobject *kobj)
++{
++ kfree(to_block(kobj));
++}
++
++static void deallocate_threshold_block(unsigned int cpu, unsigned int bank)
+ {
+ struct threshold_block *pos = NULL;
+ struct threshold_block *tmp = NULL;
+@@ -1333,13 +1339,11 @@ static void deallocate_threshold_block(unsigned int cpu,
+ return;
+
+ list_for_each_entry_safe(pos, tmp, &head->blocks->miscj, miscj) {
+- kobject_put(&pos->kobj);
+ list_del(&pos->miscj);
+- kfree(pos);
++ kobject_put(&pos->kobj);
+ }
+
+- kfree(per_cpu(threshold_banks, cpu)[bank]->blocks);
+- per_cpu(threshold_banks, cpu)[bank]->blocks = NULL;
++ kobject_put(&head->blocks->kobj);
+ }
+
+ static void __threshold_remove_blocks(struct threshold_bank *b)
+diff --git a/arch/x86/kvm/irq_comm.c b/arch/x86/kvm/irq_comm.c
+index 3cc3b2d130a0..4d000aea05e0 100644
+--- a/arch/x86/kvm/irq_comm.c
++++ b/arch/x86/kvm/irq_comm.c
+@@ -427,7 +427,7 @@ void kvm_scan_ioapic_routes(struct kvm_vcpu *vcpu,
+
+ kvm_set_msi_irq(vcpu->kvm, entry, &irq);
+
+- if (irq.level && kvm_apic_match_dest(vcpu, NULL, 0,
++ if (irq.trig_mode && kvm_apic_match_dest(vcpu, NULL, 0,
+ irq.dest_id, irq.dest_mode))
+ __set_bit(irq.vector, ioapic_handled_vectors);
+ }
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 05905961ecca..8c6392534d14 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -633,9 +633,11 @@ static inline bool pv_eoi_enabled(struct kvm_vcpu *vcpu)
+ static bool pv_eoi_get_pending(struct kvm_vcpu *vcpu)
+ {
+ u8 val;
+- if (pv_eoi_get_user(vcpu, &val) < 0)
++ if (pv_eoi_get_user(vcpu, &val) < 0) {
+ apic_debug("Can't read EOI MSR value: 0x%llx\n",
+ (unsigned long long)vcpu->arch.pv_eoi.msr_val);
++ return false;
++ }
+ return val & 0x1;
+ }
+
+@@ -1060,11 +1062,8 @@ static int __apic_accept_irq(struct kvm_lapic *apic, int delivery_mode,
+ apic_clear_vector(vector, apic->regs + APIC_TMR);
+ }
+
+- if (vcpu->arch.apicv_active)
+- kvm_x86_ops->deliver_posted_interrupt(vcpu, vector);
+- else {
++ if (kvm_x86_ops->deliver_posted_interrupt(vcpu, vector)) {
+ kvm_lapic_set_irr(vector, apic);
+-
+ kvm_make_request(KVM_REQ_EVENT, vcpu);
+ kvm_vcpu_kick(vcpu);
+ }
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 7657dcd72134..0219693bf08e 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -5140,8 +5140,11 @@ static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
+ return;
+ }
+
+-static void svm_deliver_avic_intr(struct kvm_vcpu *vcpu, int vec)
++static int svm_deliver_avic_intr(struct kvm_vcpu *vcpu, int vec)
+ {
++ if (!vcpu->arch.apicv_active)
++ return -1;
++
+ kvm_lapic_set_irr(vec, vcpu->arch.apic);
+ smp_mb__after_atomic();
+
+@@ -5150,6 +5153,8 @@ static void svm_deliver_avic_intr(struct kvm_vcpu *vcpu, int vec)
+ kvm_cpu_get_apicid(vcpu->cpu));
+ else
+ kvm_vcpu_wake_up(vcpu);
++
++ return 0;
+ }
+
+ static bool svm_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index aead984d89ad..9c48484dbe23 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -5725,6 +5725,26 @@ static bool cs_ss_rpl_check(struct kvm_vcpu *vcpu)
+ (ss.selector & SEGMENT_RPL_MASK));
+ }
+
++static bool nested_vmx_check_io_bitmaps(struct kvm_vcpu *vcpu,
++ unsigned int port, int size);
++static bool nested_vmx_exit_handled_io(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ unsigned long exit_qualification;
++ unsigned short port;
++ int size;
++
++ if (!nested_cpu_has(vmcs12, CPU_BASED_USE_IO_BITMAPS))
++ return nested_cpu_has(vmcs12, CPU_BASED_UNCOND_IO_EXITING);
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++
++ port = exit_qualification >> 16;
++ size = (exit_qualification & 7) + 1;
++
++ return nested_vmx_check_io_bitmaps(vcpu, port, size);
++}
++
+ /*
+ * Check if guest state is valid. Returns true if valid, false if
+ * not.
+@@ -6264,24 +6284,29 @@ static int vmx_deliver_nested_posted_interrupt(struct kvm_vcpu *vcpu,
+ * 2. If target vcpu isn't running(root mode), kick it to pick up the
+ * interrupt from PIR in next vmentry.
+ */
+-static void vmx_deliver_posted_interrupt(struct kvm_vcpu *vcpu, int vector)
++static int vmx_deliver_posted_interrupt(struct kvm_vcpu *vcpu, int vector)
+ {
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
+ int r;
+
+ r = vmx_deliver_nested_posted_interrupt(vcpu, vector);
+ if (!r)
+- return;
++ return 0;
++
++ if (!vcpu->arch.apicv_active)
++ return -1;
+
+ if (pi_test_and_set_pir(vector, &vmx->pi_desc))
+- return;
++ return 0;
+
+ /* If a previous notification has sent the IPI, nothing to do. */
+ if (pi_test_and_set_on(&vmx->pi_desc))
+- return;
++ return 0;
+
+ if (!kvm_vcpu_trigger_posted_interrupt(vcpu, false))
+ kvm_vcpu_kick(vcpu);
++
++ return 0;
+ }
+
+ /*
+@@ -9469,23 +9494,17 @@ static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
+ static const int kvm_vmx_max_exit_handlers =
+ ARRAY_SIZE(kvm_vmx_exit_handlers);
+
+-static bool nested_vmx_exit_handled_io(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
++/*
++ * Return true if an IO instruction with the specified port and size should cause
++ * a VM-exit into L1.
++ */
++bool nested_vmx_check_io_bitmaps(struct kvm_vcpu *vcpu, unsigned int port,
++ int size)
+ {
+- unsigned long exit_qualification;
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+ gpa_t bitmap, last_bitmap;
+- unsigned int port;
+- int size;
+ u8 b;
+
+- if (!nested_cpu_has(vmcs12, CPU_BASED_USE_IO_BITMAPS))
+- return nested_cpu_has(vmcs12, CPU_BASED_UNCOND_IO_EXITING);
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+-
+- port = exit_qualification >> 16;
+- size = (exit_qualification & 7) + 1;
+-
+ last_bitmap = (gpa_t)-1;
+ b = -1;
+
+@@ -13675,6 +13694,39 @@ static void nested_vmx_entry_failure(struct kvm_vcpu *vcpu,
+ to_vmx(vcpu)->nested.sync_shadow_vmcs = true;
+ }
+
++static int vmx_check_intercept_io(struct kvm_vcpu *vcpu,
++ struct x86_instruction_info *info)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ unsigned short port;
++ bool intercept;
++ int size;
++
++ if (info->intercept == x86_intercept_in ||
++ info->intercept == x86_intercept_ins) {
++ port = info->src_val;
++ size = info->dst_bytes;
++ } else {
++ port = info->dst_val;
++ size = info->src_bytes;
++ }
++
++ /*
++ * If the 'use IO bitmaps' VM-execution control is 0, IO instruction
++ * VM-exits depend on the 'unconditional IO exiting' VM-execution
++ * control.
++ *
++ * Otherwise, IO instruction VM-exits are controlled by the IO bitmaps.
++ */
++ if (!nested_cpu_has(vmcs12, CPU_BASED_USE_IO_BITMAPS))
++ intercept = nested_cpu_has(vmcs12,
++ CPU_BASED_UNCOND_IO_EXITING);
++ else
++ intercept = nested_vmx_check_io_bitmaps(vcpu, port, size);
++
++ return intercept ? X86EMUL_UNHANDLEABLE : X86EMUL_CONTINUE;
++}
++
+ static int vmx_check_intercept(struct kvm_vcpu *vcpu,
+ struct x86_instruction_info *info,
+ enum x86_intercept_stage stage)
+@@ -13682,19 +13734,31 @@ static int vmx_check_intercept(struct kvm_vcpu *vcpu,
+ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+ struct x86_emulate_ctxt *ctxt = &vcpu->arch.emulate_ctxt;
+
++ switch (info->intercept) {
+ /*
+ * RDPID causes #UD if disabled through secondary execution controls.
+ * Because it is marked as EmulateOnUD, we need to intercept it here.
+ */
+- if (info->intercept == x86_intercept_rdtscp &&
+- !nested_cpu_has2(vmcs12, SECONDARY_EXEC_RDTSCP)) {
+- ctxt->exception.vector = UD_VECTOR;
+- ctxt->exception.error_code_valid = false;
+- return X86EMUL_PROPAGATE_FAULT;
+- }
++ case x86_intercept_rdtscp:
++ if (!nested_cpu_has2(vmcs12, SECONDARY_EXEC_RDTSCP)) {
++ ctxt->exception.vector = UD_VECTOR;
++ ctxt->exception.error_code_valid = false;
++ return X86EMUL_PROPAGATE_FAULT;
++ }
++ break;
++
++ case x86_intercept_in:
++ case x86_intercept_ins:
++ case x86_intercept_out:
++ case x86_intercept_outs:
++ return vmx_check_intercept_io(vcpu, info);
+
+ /* TODO: check more intercepts... */
+- return X86EMUL_CONTINUE;
++ default:
++ break;
++ }
++
++ return X86EMUL_UNHANDLEABLE;
+ }
+
+ #ifdef CONFIG_X86_64
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index fa1c5a442957..bbc8710704e2 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -96,6 +96,7 @@ enum board_ids {
+
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static void ahci_remove_one(struct pci_dev *dev);
++static void ahci_shutdown_one(struct pci_dev *dev);
+ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
+ unsigned long deadline);
+ static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
+@@ -609,6 +610,7 @@ static struct pci_driver ahci_pci_driver = {
+ .id_table = ahci_pci_tbl,
+ .probe = ahci_init_one,
+ .remove = ahci_remove_one,
++ .shutdown = ahci_shutdown_one,
+ .driver = {
+ .pm = &ahci_pci_pm_ops,
+ },
+@@ -1897,6 +1899,11 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ return 0;
+ }
+
++static void ahci_shutdown_one(struct pci_dev *pdev)
++{
++ ata_pci_shutdown_one(pdev);
++}
++
+ static void ahci_remove_one(struct pci_dev *pdev)
+ {
+ pm_runtime_get_noresume(&pdev->dev);
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index b45b6f7722ce..75d582ca917f 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6780,6 +6780,26 @@ void ata_pci_remove_one(struct pci_dev *pdev)
+ ata_host_detach(host);
+ }
+
++void ata_pci_shutdown_one(struct pci_dev *pdev)
++{
++ struct ata_host *host = pci_get_drvdata(pdev);
++ int i;
++
++ for (i = 0; i < host->n_ports; i++) {
++ struct ata_port *ap = host->ports[i];
++
++ ap->pflags |= ATA_PFLAG_FROZEN;
++
++ /* Disable port interrupts */
++ if (ap->ops->freeze)
++ ap->ops->freeze(ap);
++
++ /* Stop the port DMA engines */
++ if (ap->ops->port_stop)
++ ap->ops->port_stop(ap);
++ }
++}
++
+ /* move to PCI subsystem */
+ int pci_test_config_bits(struct pci_dev *pdev, const struct pci_bits *bits)
+ {
+@@ -7400,6 +7420,7 @@ EXPORT_SYMBOL_GPL(ata_timing_cycle2mode);
+
+ #ifdef CONFIG_PCI
+ EXPORT_SYMBOL_GPL(pci_test_config_bits);
++EXPORT_SYMBOL_GPL(ata_pci_shutdown_one);
+ EXPORT_SYMBOL_GPL(ata_pci_remove_one);
+ #ifdef CONFIG_PM
+ EXPORT_SYMBOL_GPL(ata_pci_device_do_suspend);
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index e71589e244fb..bf222c4b2f82 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -852,14 +852,17 @@ static void reset_fdc_info(int mode)
+ /* selects the fdc and drive, and enables the fdc's input/dma. */
+ static void set_fdc(int drive)
+ {
++ unsigned int new_fdc = fdc;
++
+ if (drive >= 0 && drive < N_DRIVE) {
+- fdc = FDC(drive);
++ new_fdc = FDC(drive);
+ current_drive = drive;
+ }
+- if (fdc != 1 && fdc != 0) {
++ if (new_fdc >= N_FDC) {
+ pr_info("bad fdc value\n");
+ return;
+ }
++ fdc = new_fdc;
+ set_dor(fdc, ~0, 8);
+ #if N_FDC > 1
+ set_dor(1 - fdc, ~8, 0);
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 28b110cd3977..53e822793d46 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1609,9 +1609,8 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
+ print_once = true;
+ #endif
+ if (__ratelimit(&unseeded_warning))
+- printk_deferred(KERN_NOTICE "random: %s called from %pS "
+- "with crng_init=%d\n", func_name, caller,
+- crng_init);
++ pr_notice("random: %s called from %pS with crng_init=%d\n",
++ func_name, caller, crng_init);
+ }
+
+ /*
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index d66a7fdff898..ceb82e74f5b4 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -738,8 +738,12 @@ static void sdma_start_desc(struct sdma_channel *sdmac)
+ return;
+ }
+ sdmac->desc = desc = to_sdma_desc(&vd->tx);
+-
+- list_del(&vd->node);
++ /*
++ * Do not delete the node in desc_issued list in cyclic mode, otherwise
++ * the desc allocated will never be freed in vchan_dma_desc_free_list
++ */
++ if (!(sdmac->flags & IMX_DMA_SG_LOOP))
++ list_del(&vd->node);
+
+ sdma->channel_control[channel].base_bd_ptr = desc->bd_phys;
+ sdma->channel_control[channel].current_bd_ptr = desc->bd_phys;
+@@ -1040,6 +1044,7 @@ static void sdma_channel_terminate_work(struct work_struct *work)
+
+ spin_lock_irqsave(&sdmac->vc.lock, flags);
+ vchan_get_all_descriptors(&sdmac->vc, &head);
++ sdmac->desc = NULL;
+ spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+ vchan_dma_desc_free_list(&sdmac->vc, &head);
+ }
+@@ -1047,19 +1052,11 @@ static void sdma_channel_terminate_work(struct work_struct *work)
+ static int sdma_disable_channel_async(struct dma_chan *chan)
+ {
+ struct sdma_channel *sdmac = to_sdma_chan(chan);
+- unsigned long flags;
+-
+- spin_lock_irqsave(&sdmac->vc.lock, flags);
+
+ sdma_disable_channel(chan);
+
+- if (sdmac->desc) {
+- vchan_terminate_vdesc(&sdmac->desc->vd);
+- sdmac->desc = NULL;
++ if (sdmac->desc)
+ schedule_work(&sdmac->terminate_worker);
+- }
+-
+- spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
+index 83f2717fcf81..9e74f4304313 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -205,7 +205,12 @@ static u32 soc15_get_config_memsize(struct amdgpu_device *adev)
+
+ static u32 soc15_get_xclk(struct amdgpu_device *adev)
+ {
+- return adev->clock.spll.reference_freq;
++ u32 reference_clock = adev->clock.spll.reference_freq;
++
++ if (adev->asic_type == CHIP_RAVEN)
++ return reference_clock / 4;
++
++ return reference_clock;
+ }
+
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/wndw.c b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+index b3db4553098d..d343ae66c64f 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+@@ -405,6 +405,8 @@ nv50_wndw_atomic_check(struct drm_plane *plane, struct drm_plane_state *state)
+ asyw->clr.ntfy = armw->ntfy.handle != 0;
+ asyw->clr.sema = armw->sema.handle != 0;
+ asyw->clr.xlut = armw->xlut.handle != 0;
++ if (asyw->clr.xlut && asyw->visible)
++ asyw->set.xlut = asyw->xlut.handle != 0;
+ if (wndw->func->image_clr)
+ asyw->clr.image = armw->image.handle[0] != 0;
+ }
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index 9899f7e155a5..f39670c5c25c 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -2584,6 +2584,17 @@ isert_wait4logout(struct isert_conn *isert_conn)
+ }
+ }
+
++static void
++isert_wait4cmds(struct iscsi_conn *conn)
++{
++ isert_info("iscsi_conn %p\n", conn);
++
++ if (conn->sess) {
++ target_sess_cmd_list_set_waiting(conn->sess->se_sess);
++ target_wait_for_sess_cmds(conn->sess->se_sess);
++ }
++}
++
+ /**
+ * isert_put_unsol_pending_cmds() - Drop commands waiting for
+ * unsolicitate dataout
+@@ -2631,6 +2642,7 @@ static void isert_wait_conn(struct iscsi_conn *conn)
+
+ ib_drain_qp(isert_conn->qp);
+ isert_put_unsol_pending_cmds(conn);
++ isert_wait4cmds(conn);
+ isert_wait4logout(isert_conn);
+
+ queue_work(isert_release_wq, &isert_conn->release_work);
+diff --git a/drivers/iommu/qcom_iommu.c b/drivers/iommu/qcom_iommu.c
+index ee70e9921cf1..9a6ed5eeaad1 100644
+--- a/drivers/iommu/qcom_iommu.c
++++ b/drivers/iommu/qcom_iommu.c
+@@ -333,21 +333,19 @@ static void qcom_iommu_domain_free(struct iommu_domain *domain)
+ {
+ struct qcom_iommu_domain *qcom_domain = to_qcom_iommu_domain(domain);
+
+- if (WARN_ON(qcom_domain->iommu)) /* forgot to detach? */
+- return;
+-
+ iommu_put_dma_cookie(domain);
+
+- /* NOTE: unmap can be called after client device is powered off,
+- * for example, with GPUs or anything involving dma-buf. So we
+- * cannot rely on the device_link. Make sure the IOMMU is on to
+- * avoid unclocked accesses in the TLB inv path:
+- */
+- pm_runtime_get_sync(qcom_domain->iommu->dev);
+-
+- free_io_pgtable_ops(qcom_domain->pgtbl_ops);
+-
+- pm_runtime_put_sync(qcom_domain->iommu->dev);
++ if (qcom_domain->iommu) {
++ /*
++ * NOTE: unmap can be called after client device is powered
++ * off, for example, with GPUs or anything involving dma-buf.
++ * So we cannot rely on the device_link. Make sure the IOMMU
++ * is on to avoid unclocked accesses in the TLB inv path:
++ */
++ pm_runtime_get_sync(qcom_domain->iommu->dev);
++ free_io_pgtable_ops(qcom_domain->pgtbl_ops);
++ pm_runtime_put_sync(qcom_domain->iommu->dev);
++ }
+
+ kfree(qcom_domain);
+ }
+@@ -392,7 +390,7 @@ static void qcom_iommu_detach_dev(struct iommu_domain *domain, struct device *de
+ struct qcom_iommu_domain *qcom_domain = to_qcom_iommu_domain(domain);
+ unsigned i;
+
+- if (!qcom_domain->iommu)
++ if (WARN_ON(!qcom_domain->iommu))
+ return;
+
+ pm_runtime_get_sync(qcom_iommu->dev);
+@@ -405,8 +403,6 @@ static void qcom_iommu_detach_dev(struct iommu_domain *domain, struct device *de
+ ctx->domain = NULL;
+ }
+ pm_runtime_put_sync(qcom_iommu->dev);
+-
+- qcom_domain->iommu = NULL;
+ }
+
+ static int qcom_iommu_map(struct iommu_domain *domain, unsigned long iova,
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 838ee58d80cd..e8bc25aed44c 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -569,6 +569,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
+ }
+
+ INIT_WORK(&ctrl->ana_work, nvme_ana_work);
++ kfree(ctrl->ana_log_buf);
+ ctrl->ana_log_buf = kmalloc(ctrl->ana_log_size, GFP_KERNEL);
+ if (!ctrl->ana_log_buf) {
+ error = -ENOMEM;
+diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
+index be815330ed95..e3df4bf521b5 100644
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -350,8 +350,23 @@ static inline vm_flags_t calc_vm_may_flags(unsigned long prot)
+ _calc_vm_trans(prot, PROT_EXEC, VM_MAYEXEC);
+ }
+
++static int ashmem_vmfile_mmap(struct file *file, struct vm_area_struct *vma)
++{
++ /* do not allow to mmap ashmem backing shmem file directly */
++ return -EPERM;
++}
++
++static unsigned long
++ashmem_vmfile_get_unmapped_area(struct file *file, unsigned long addr,
++ unsigned long len, unsigned long pgoff,
++ unsigned long flags)
++{
++ return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
++}
++
+ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
+ {
++ static struct file_operations vmfile_fops;
+ struct ashmem_area *asma = file->private_data;
+ int ret = 0;
+
+@@ -392,6 +407,19 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
+ }
+ vmfile->f_mode |= FMODE_LSEEK;
+ asma->file = vmfile;
++ /*
++ * override mmap operation of the vmfile so that it can't be
++ * remapped which would lead to creation of a new vma with no
++ * asma permission checks. Have to override get_unmapped_area
++ * as well to prevent VM_BUG_ON check for f_ops modification.
++ */
++ if (!vmfile_fops.mmap) {
++ vmfile_fops = *vmfile->f_op;
++ vmfile_fops.mmap = ashmem_vmfile_mmap;
++ vmfile_fops.get_unmapped_area =
++ ashmem_vmfile_get_unmapped_area;
++ }
++ vmfile->f_op = &vmfile_fops;
+ }
+ get_file(asma->file);
+
+diff --git a/drivers/staging/greybus/audio_manager.c b/drivers/staging/greybus/audio_manager.c
+index d44b070d8862..0f5c68edf2c1 100644
+--- a/drivers/staging/greybus/audio_manager.c
++++ b/drivers/staging/greybus/audio_manager.c
+@@ -89,8 +89,8 @@ void gb_audio_manager_remove_all(void)
+
+ list_for_each_entry_safe(module, next, &modules_list, list) {
+ list_del(&module->list);
+- kobject_put(&module->kobj);
+ ida_simple_remove(&module_id, module->id);
++ kobject_put(&module->kobj);
+ }
+
+ is_empty = list_empty(&modules_list);
+diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+index 2db4444267a7..0003f0c38038 100644
+--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+@@ -2026,7 +2026,7 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
+ struct ieee_param *param;
+ uint ret = 0;
+
+- if (p->length < sizeof(struct ieee_param) || !p->pointer) {
++ if (!p->pointer || p->length != sizeof(struct ieee_param)) {
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -2819,7 +2819,7 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p)
+ goto out;
+ }
+
+- if (!p->pointer) {
++ if (!p->pointer || p->length != sizeof(struct ieee_param)) {
+ ret = -EINVAL;
+ goto out;
+ }
+diff --git a/drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c b/drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c
+index 10b3f9733bad..4a27c3927da9 100644
+--- a/drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c
++++ b/drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c
+@@ -478,14 +478,13 @@ int rtl8723bs_xmit_thread(void *context)
+ s32 ret;
+ struct adapter *padapter;
+ struct xmit_priv *pxmitpriv;
+- u8 thread_name[20] = "RTWHALXT";
+-
++ u8 thread_name[20];
+
+ ret = _SUCCESS;
+ padapter = context;
+ pxmitpriv = &padapter->xmitpriv;
+
+- rtw_sprintf(thread_name, 20, "%s-"ADPT_FMT, thread_name, ADPT_ARG(padapter));
++ rtw_sprintf(thread_name, 20, "RTWHALXT-" ADPT_FMT, ADPT_ARG(padapter));
+ thread_enter(thread_name);
+
+ DBG_871X("start "FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+index 4f120e72c7d2..466d25ccc4bb 100644
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+@@ -3400,7 +3400,7 @@ static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
+
+ /* down(&ieee->wx_sem); */
+
+- if (p->length < sizeof(struct ieee_param) || !p->pointer) {
++ if (!p->pointer || p->length != sizeof(struct ieee_param)) {
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -4236,7 +4236,7 @@ static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p)
+
+
+ /* if (p->length < sizeof(struct ieee_param) || !p->pointer) { */
+- if (!p->pointer) {
++ if (!p->pointer || p->length != sizeof(*param)) {
+ ret = -EINVAL;
+ goto out;
+ }
+diff --git a/drivers/staging/vt6656/dpc.c b/drivers/staging/vt6656/dpc.c
+index 3b94e80f1d5e..879ceef517fb 100644
+--- a/drivers/staging/vt6656/dpc.c
++++ b/drivers/staging/vt6656/dpc.c
+@@ -130,7 +130,7 @@ int vnt_rx_data(struct vnt_private *priv, struct vnt_rcb *ptr_rcb,
+
+ vnt_rf_rssi_to_dbm(priv, *rssi, &rx_dbm);
+
+- priv->bb_pre_ed_rssi = (u8)rx_dbm + 1;
++ priv->bb_pre_ed_rssi = (u8)-rx_dbm + 1;
+ priv->current_rssi = priv->bb_pre_ed_rssi;
+
+ skb_pull(skb, 8);
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 14bd54d0e79d..03e9cb156df9 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1157,9 +1157,7 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ hdr->cmdsn, be32_to_cpu(hdr->data_length), payload_length,
+ conn->cid);
+
+- if (target_get_sess_cmd(&cmd->se_cmd, true) < 0)
+- return iscsit_add_reject_cmd(cmd,
+- ISCSI_REASON_WAITING_FOR_LOGOUT, buf);
++ target_get_sess_cmd(&cmd->se_cmd, true);
+
+ cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd,
+ scsilun_to_int(&hdr->lun));
+@@ -2000,9 +1998,7 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ conn->sess->se_sess, 0, DMA_NONE,
+ TCM_SIMPLE_TAG, cmd->sense_buffer + 2);
+
+- if (target_get_sess_cmd(&cmd->se_cmd, true) < 0)
+- return iscsit_add_reject_cmd(cmd,
+- ISCSI_REASON_WAITING_FOR_LOGOUT, buf);
++ target_get_sess_cmd(&cmd->se_cmd, true);
+
+ /*
+ * TASK_REASSIGN for ERL=2 / connection stays inside of
+@@ -4123,6 +4119,9 @@ int iscsit_close_connection(
+ iscsit_stop_nopin_response_timer(conn);
+ iscsit_stop_nopin_timer(conn);
+
++ if (conn->conn_transport->iscsit_wait_conn)
++ conn->conn_transport->iscsit_wait_conn(conn);
++
+ /*
+ * During Connection recovery drop unacknowledged out of order
+ * commands for this connection, and prepare the other commands
+@@ -4205,11 +4204,6 @@ int iscsit_close_connection(
+ * must wait until they have completed.
+ */
+ iscsit_check_conn_usage_count(conn);
+- target_sess_cmd_list_set_waiting(sess->se_sess);
+- target_wait_for_sess_cmds(sess->se_sess);
+-
+- if (conn->conn_transport->iscsit_wait_conn)
+- conn->conn_transport->iscsit_wait_conn(conn);
+
+ ahash_request_free(conn->conn_tx_hash);
+ if (conn->conn_rx_hash) {
+diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
+index 678bf3365947..42d90ceec279 100644
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -264,6 +264,12 @@ static int tb_switch_nvm_read(void *priv, unsigned int offset, void *val,
+ return ret;
+ }
+
++static int tb_switch_nvm_no_read(void *priv, unsigned int offset, void *val,
++ size_t bytes)
++{
++ return -EPERM;
++}
++
+ static int tb_switch_nvm_write(void *priv, unsigned int offset, void *val,
+ size_t bytes)
+ {
+@@ -309,6 +315,7 @@ static struct nvmem_device *register_nvmem(struct tb_switch *sw, int id,
+ config.read_only = true;
+ } else {
+ config.name = "nvm_non_active";
++ config.reg_read = tb_switch_nvm_no_read;
+ config.reg_write = tb_switch_nvm_write;
+ config.root_only = true;
+ }
+diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
+index fa1672993b4c..048a7bcae5f9 100644
+--- a/drivers/tty/serdev/serdev-ttyport.c
++++ b/drivers/tty/serdev/serdev-ttyport.c
+@@ -265,7 +265,6 @@ struct device *serdev_tty_port_register(struct tty_port *port,
+ struct device *parent,
+ struct tty_driver *drv, int idx)
+ {
+- const struct tty_port_client_operations *old_ops;
+ struct serdev_controller *ctrl;
+ struct serport *serport;
+ int ret;
+@@ -284,7 +283,6 @@ struct device *serdev_tty_port_register(struct tty_port *port,
+
+ ctrl->ops = &ctrl_ops;
+
+- old_ops = port->client_ops;
+ port->client_ops = &client_ops;
+ port->client_data = ctrl;
+
+@@ -297,7 +295,7 @@ struct device *serdev_tty_port_register(struct tty_port *port,
+
+ err_reset_data:
+ port->client_data = NULL;
+- port->client_ops = old_ops;
++ port->client_ops = &tty_port_default_client_ops;
+ serdev_controller_put(ctrl);
+
+ return ERR_PTR(ret);
+@@ -312,8 +310,8 @@ int serdev_tty_port_unregister(struct tty_port *port)
+ return -ENODEV;
+
+ serdev_controller_remove(ctrl);
+- port->client_ops = NULL;
+ port->client_data = NULL;
++ port->client_ops = &tty_port_default_client_ops;
+ serdev_controller_put(ctrl);
+
+ return 0;
+diff --git a/drivers/tty/serial/8250/8250_aspeed_vuart.c b/drivers/tty/serial/8250/8250_aspeed_vuart.c
+index 435bec40dee6..2d5c3643e6a5 100644
+--- a/drivers/tty/serial/8250/8250_aspeed_vuart.c
++++ b/drivers/tty/serial/8250/8250_aspeed_vuart.c
+@@ -375,7 +375,6 @@ static int aspeed_vuart_probe(struct platform_device *pdev)
+ port.port.line = rc;
+
+ port.port.irq = irq_of_parse_and_map(np, 0);
+- port.port.irqflags = IRQF_SHARED;
+ port.port.handle_irq = aspeed_vuart_handle_irq;
+ port.port.iotype = UPIO_MEM;
+ port.port.type = PORT_16550A;
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index 69aaee5d7fe1..b9567ef843fc 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -177,7 +177,7 @@ static int serial_link_irq_chain(struct uart_8250_port *up)
+ struct hlist_head *h;
+ struct hlist_node *n;
+ struct irq_info *i;
+- int ret, irq_flags = up->port.flags & UPF_SHARE_IRQ ? IRQF_SHARED : 0;
++ int ret;
+
+ mutex_lock(&hash_mutex);
+
+@@ -212,9 +212,8 @@ static int serial_link_irq_chain(struct uart_8250_port *up)
+ INIT_LIST_HEAD(&up->list);
+ i->head = &up->list;
+ spin_unlock_irq(&i->lock);
+- irq_flags |= up->port.irqflags;
+ ret = request_irq(up->port.irq, serial8250_interrupt,
+- irq_flags, up->port.name, i);
++ up->port.irqflags, up->port.name, i);
+ if (ret < 0)
+ serial_do_unlink(i, up);
+ }
+diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c
+index 2488de1c4bc4..8fedc075fb1e 100644
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -171,7 +171,6 @@ static int of_platform_serial_setup(struct platform_device *ofdev,
+
+ port->type = type;
+ port->uartclk = clk;
+- port->irqflags |= IRQF_SHARED;
+
+ if (of_property_read_bool(np, "no-loopback-test"))
+ port->flags |= UPF_SKIP_TEST;
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index aa4de6907f77..5a04d4ddca73 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -2253,6 +2253,10 @@ int serial8250_do_startup(struct uart_port *port)
+ }
+ }
+
++ /* Check if we need to have shared IRQs */
++ if (port->irq && (up->port.flags & UPF_SHARE_IRQ))
++ up->port.irqflags |= IRQF_SHARED;
++
+ if (port->irq && !(up->port.flags & UPF_NO_THRE_TEST)) {
+ unsigned char iir1;
+ /*
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index f34520e9ad6e..936d401f20b9 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -490,7 +490,8 @@ static void atmel_stop_tx(struct uart_port *port)
+ atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask);
+
+ if (atmel_uart_is_half_duplex(port))
+- atmel_start_rx(port);
++ if (!atomic_read(&atmel_port->tasklet_shutdown))
++ atmel_start_rx(port);
+
+ }
+
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 672e97978279..4066cb2b79cb 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -608,7 +608,7 @@ static void imx_uart_dma_tx(struct imx_port *sport)
+
+ sport->tx_bytes = uart_circ_chars_pending(xmit);
+
+- if (xmit->tail < xmit->head) {
++ if (xmit->tail < xmit->head || xmit->head == 0) {
+ sport->dma_tx_nents = 1;
+ sg_init_one(sgl, xmit->buf + xmit->tail, sport->tx_bytes);
+ } else {
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index b3f7d1a1e97f..4458419f053b 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -85,7 +85,7 @@
+ #define DEF_FIFO_DEPTH_WORDS 16
+ #define DEF_TX_WM 2
+ #define DEF_FIFO_WIDTH_BITS 32
+-#define UART_CONSOLE_RX_WM 2
++#define UART_RX_WM 2
+ #define MAX_LOOPBACK_CFG 3
+
+ #ifdef CONFIG_CONSOLE_POLL
+@@ -101,10 +101,6 @@ struct qcom_geni_serial_port {
+ u32 tx_fifo_depth;
+ u32 tx_fifo_width;
+ u32 rx_fifo_depth;
+- u32 tx_wm;
+- u32 rx_wm;
+- u32 rx_rfr;
+- enum geni_se_xfer_mode xfer_mode;
+ bool setup;
+ int (*handle_rx)(struct uart_port *uport, u32 bytes, bool drop);
+ unsigned int baud;
+@@ -125,6 +121,7 @@ static int handle_rx_console(struct uart_port *uport, u32 bytes, bool drop);
+ static int handle_rx_uart(struct uart_port *uport, u32 bytes, bool drop);
+ static unsigned int qcom_geni_serial_tx_empty(struct uart_port *port);
+ static void qcom_geni_serial_stop_rx(struct uart_port *uport);
++static void qcom_geni_serial_handle_rx(struct uart_port *uport, bool drop);
+
+ static const unsigned long root_freq[] = {7372800, 14745600, 19200000, 29491200,
+ 32000000, 48000000, 64000000, 80000000,
+@@ -226,7 +223,7 @@ static unsigned int qcom_geni_serial_get_mctrl(struct uart_port *uport)
+ if (uart_console(uport)) {
+ mctrl |= TIOCM_CTS;
+ } else {
+- geni_ios = readl_relaxed(uport->membase + SE_GENI_IOS);
++ geni_ios = readl(uport->membase + SE_GENI_IOS);
+ if (!(geni_ios & IO2_DATA_IN))
+ mctrl |= TIOCM_CTS;
+ }
+@@ -244,7 +241,7 @@ static void qcom_geni_serial_set_mctrl(struct uart_port *uport,
+
+ if (!(mctrl & TIOCM_RTS))
+ uart_manual_rfr = UART_MANUAL_RFR_EN | UART_RFR_NOT_READY;
+- writel_relaxed(uart_manual_rfr, uport->membase + SE_UART_MANUAL_RFR);
++ writel(uart_manual_rfr, uport->membase + SE_UART_MANUAL_RFR);
+ }
+
+ static const char *qcom_geni_serial_get_type(struct uart_port *uport)
+@@ -273,9 +270,6 @@ static bool qcom_geni_serial_poll_bit(struct uart_port *uport,
+ unsigned int fifo_bits;
+ unsigned long timeout_us = 20000;
+
+- /* Ensure polling is not re-ordered before the prior writes/reads */
+- mb();
+-
+ if (uport->private_data) {
+ port = to_dev_port(uport, uport);
+ baud = port->baud;
+@@ -295,7 +289,7 @@ static bool qcom_geni_serial_poll_bit(struct uart_port *uport,
+ */
+ timeout_us = DIV_ROUND_UP(timeout_us, 10) * 10;
+ while (timeout_us) {
+- reg = readl_relaxed(uport->membase + offset);
++ reg = readl(uport->membase + offset);
+ if ((bool)(reg & field) == set)
+ return true;
+ udelay(10);
+@@ -308,7 +302,7 @@ static void qcom_geni_serial_setup_tx(struct uart_port *uport, u32 xmit_size)
+ {
+ u32 m_cmd;
+
+- writel_relaxed(xmit_size, uport->membase + SE_UART_TX_TRANS_LEN);
++ writel(xmit_size, uport->membase + SE_UART_TX_TRANS_LEN);
+ m_cmd = UART_START_TX << M_OPCODE_SHFT;
+ writel(m_cmd, uport->membase + SE_GENI_M_CMD0);
+ }
+@@ -321,13 +315,13 @@ static void qcom_geni_serial_poll_tx_done(struct uart_port *uport)
+ done = qcom_geni_serial_poll_bit(uport, SE_GENI_M_IRQ_STATUS,
+ M_CMD_DONE_EN, true);
+ if (!done) {
+- writel_relaxed(M_GENI_CMD_ABORT, uport->membase +
++ writel(M_GENI_CMD_ABORT, uport->membase +
+ SE_GENI_M_CMD_CTRL_REG);
+ irq_clear |= M_CMD_ABORT_EN;
+ qcom_geni_serial_poll_bit(uport, SE_GENI_M_IRQ_STATUS,
+ M_CMD_ABORT_EN, true);
+ }
+- writel_relaxed(irq_clear, uport->membase + SE_GENI_M_IRQ_CLEAR);
++ writel(irq_clear, uport->membase + SE_GENI_M_IRQ_CLEAR);
+ }
+
+ static void qcom_geni_serial_abort_rx(struct uart_port *uport)
+@@ -337,8 +331,8 @@ static void qcom_geni_serial_abort_rx(struct uart_port *uport)
+ writel(S_GENI_CMD_ABORT, uport->membase + SE_GENI_S_CMD_CTRL_REG);
+ qcom_geni_serial_poll_bit(uport, SE_GENI_S_CMD_CTRL_REG,
+ S_GENI_CMD_ABORT, false);
+- writel_relaxed(irq_clear, uport->membase + SE_GENI_S_IRQ_CLEAR);
+- writel_relaxed(FORCE_DEFAULT, uport->membase + GENI_FORCE_DEFAULT_REG);
++ writel(irq_clear, uport->membase + SE_GENI_S_IRQ_CLEAR);
++ writel(FORCE_DEFAULT, uport->membase + GENI_FORCE_DEFAULT_REG);
+ }
+
+ #ifdef CONFIG_CONSOLE_POLL
+@@ -347,19 +341,13 @@ static int qcom_geni_serial_get_char(struct uart_port *uport)
+ u32 rx_fifo;
+ u32 status;
+
+- status = readl_relaxed(uport->membase + SE_GENI_M_IRQ_STATUS);
+- writel_relaxed(status, uport->membase + SE_GENI_M_IRQ_CLEAR);
+-
+- status = readl_relaxed(uport->membase + SE_GENI_S_IRQ_STATUS);
+- writel_relaxed(status, uport->membase + SE_GENI_S_IRQ_CLEAR);
++ status = readl(uport->membase + SE_GENI_M_IRQ_STATUS);
++ writel(status, uport->membase + SE_GENI_M_IRQ_CLEAR);
+
+- /*
+- * Ensure the writes to clear interrupts is not re-ordered after
+- * reading the data.
+- */
+- mb();
++ status = readl(uport->membase + SE_GENI_S_IRQ_STATUS);
++ writel(status, uport->membase + SE_GENI_S_IRQ_CLEAR);
+
+- status = readl_relaxed(uport->membase + SE_GENI_RX_FIFO_STATUS);
++ status = readl(uport->membase + SE_GENI_RX_FIFO_STATUS);
+ if (!(status & RX_FIFO_WC_MSK))
+ return NO_POLL_CHAR;
+
+@@ -370,15 +358,12 @@ static int qcom_geni_serial_get_char(struct uart_port *uport)
+ static void qcom_geni_serial_poll_put_char(struct uart_port *uport,
+ unsigned char c)
+ {
+- struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+-
+- writel_relaxed(port->tx_wm, uport->membase + SE_GENI_TX_WATERMARK_REG);
++ writel(DEF_TX_WM, uport->membase + SE_GENI_TX_WATERMARK_REG);
+ qcom_geni_serial_setup_tx(uport, 1);
+ WARN_ON(!qcom_geni_serial_poll_bit(uport, SE_GENI_M_IRQ_STATUS,
+ M_TX_FIFO_WATERMARK_EN, true));
+- writel_relaxed(c, uport->membase + SE_GENI_TX_FIFOn);
+- writel_relaxed(M_TX_FIFO_WATERMARK_EN, uport->membase +
+- SE_GENI_M_IRQ_CLEAR);
++ writel(c, uport->membase + SE_GENI_TX_FIFOn);
++ writel(M_TX_FIFO_WATERMARK_EN, uport->membase + SE_GENI_M_IRQ_CLEAR);
+ qcom_geni_serial_poll_tx_done(uport);
+ }
+ #endif
+@@ -386,7 +371,7 @@ static void qcom_geni_serial_poll_put_char(struct uart_port *uport,
+ #ifdef CONFIG_SERIAL_QCOM_GENI_CONSOLE
+ static void qcom_geni_serial_wr_char(struct uart_port *uport, int ch)
+ {
+- writel_relaxed(ch, uport->membase + SE_GENI_TX_FIFOn);
++ writel(ch, uport->membase + SE_GENI_TX_FIFOn);
+ }
+
+ static void
+@@ -405,7 +390,7 @@ __qcom_geni_serial_console_write(struct uart_port *uport, const char *s,
+ bytes_to_send++;
+ }
+
+- writel_relaxed(DEF_TX_WM, uport->membase + SE_GENI_TX_WATERMARK_REG);
++ writel(DEF_TX_WM, uport->membase + SE_GENI_TX_WATERMARK_REG);
+ qcom_geni_serial_setup_tx(uport, bytes_to_send);
+ for (i = 0; i < count; ) {
+ size_t chars_to_write = 0;
+@@ -423,7 +408,7 @@ __qcom_geni_serial_console_write(struct uart_port *uport, const char *s,
+ chars_to_write = min_t(size_t, count - i, avail / 2);
+ uart_console_write(uport, s + i, chars_to_write,
+ qcom_geni_serial_wr_char);
+- writel_relaxed(M_TX_FIFO_WATERMARK_EN, uport->membase +
++ writel(M_TX_FIFO_WATERMARK_EN, uport->membase +
+ SE_GENI_M_IRQ_CLEAR);
+ i += chars_to_write;
+ }
+@@ -438,6 +423,7 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s,
+ bool locked = true;
+ unsigned long flags;
+ u32 geni_status;
++ u32 irq_en;
+
+ WARN_ON(co->index < 0 || co->index >= GENI_UART_CONS_PORTS);
+
+@@ -451,7 +437,7 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s,
+ else
+ spin_lock_irqsave(&uport->lock, flags);
+
+- geni_status = readl_relaxed(uport->membase + SE_GENI_STATUS);
++ geni_status = readl(uport->membase + SE_GENI_STATUS);
+
+ /* Cancel the current write to log the fault */
+ if (!locked) {
+@@ -461,17 +447,22 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s,
+ geni_se_abort_m_cmd(&port->se);
+ qcom_geni_serial_poll_bit(uport, SE_GENI_M_IRQ_STATUS,
+ M_CMD_ABORT_EN, true);
+- writel_relaxed(M_CMD_ABORT_EN, uport->membase +
++ writel(M_CMD_ABORT_EN, uport->membase +
+ SE_GENI_M_IRQ_CLEAR);
+ }
+- writel_relaxed(M_CMD_CANCEL_EN, uport->membase +
+- SE_GENI_M_IRQ_CLEAR);
++ writel(M_CMD_CANCEL_EN, uport->membase + SE_GENI_M_IRQ_CLEAR);
+ } else if ((geni_status & M_GENI_CMD_ACTIVE) && !port->tx_remaining) {
+ /*
+ * It seems we can't interrupt existing transfers if all data
+ * has been sent, in which case we need to look for done first.
+ */
+ qcom_geni_serial_poll_tx_done(uport);
++
++ if (uart_circ_chars_pending(&uport->state->xmit)) {
++ irq_en = readl(uport->membase + SE_GENI_M_IRQ_EN);
++ writel(irq_en | M_TX_FIFO_WATERMARK_EN,
++ uport->membase + SE_GENI_M_IRQ_EN);
++ }
+ }
+
+ __qcom_geni_serial_console_write(uport, s, count);
+@@ -556,29 +547,20 @@ static int handle_rx_uart(struct uart_port *uport, u32 bytes, bool drop)
+ static void qcom_geni_serial_start_tx(struct uart_port *uport)
+ {
+ u32 irq_en;
+- struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+ u32 status;
+
+- if (port->xfer_mode == GENI_SE_FIFO) {
+- /*
+- * readl ensures reading & writing of IRQ_EN register
+- * is not re-ordered before checking the status of the
+- * Serial Engine.
+- */
+- status = readl(uport->membase + SE_GENI_STATUS);
+- if (status & M_GENI_CMD_ACTIVE)
+- return;
++ status = readl(uport->membase + SE_GENI_STATUS);
++ if (status & M_GENI_CMD_ACTIVE)
++ return;
+
+- if (!qcom_geni_serial_tx_empty(uport))
+- return;
++ if (!qcom_geni_serial_tx_empty(uport))
++ return;
+
+- irq_en = readl_relaxed(uport->membase + SE_GENI_M_IRQ_EN);
+- irq_en |= M_TX_FIFO_WATERMARK_EN | M_CMD_DONE_EN;
++ irq_en = readl(uport->membase + SE_GENI_M_IRQ_EN);
++ irq_en |= M_TX_FIFO_WATERMARK_EN | M_CMD_DONE_EN;
+
+- writel_relaxed(port->tx_wm, uport->membase +
+- SE_GENI_TX_WATERMARK_REG);
+- writel_relaxed(irq_en, uport->membase + SE_GENI_M_IRQ_EN);
+- }
++ writel(DEF_TX_WM, uport->membase + SE_GENI_TX_WATERMARK_REG);
++ writel(irq_en, uport->membase + SE_GENI_M_IRQ_EN);
+ }
+
+ static void qcom_geni_serial_stop_tx(struct uart_port *uport)
+@@ -587,35 +569,24 @@ static void qcom_geni_serial_stop_tx(struct uart_port *uport)
+ u32 status;
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+
+- irq_en = readl_relaxed(uport->membase + SE_GENI_M_IRQ_EN);
+- irq_en &= ~M_CMD_DONE_EN;
+- if (port->xfer_mode == GENI_SE_FIFO) {
+- irq_en &= ~M_TX_FIFO_WATERMARK_EN;
+- writel_relaxed(0, uport->membase +
+- SE_GENI_TX_WATERMARK_REG);
+- }
+- writel_relaxed(irq_en, uport->membase + SE_GENI_M_IRQ_EN);
+- status = readl_relaxed(uport->membase + SE_GENI_STATUS);
++ irq_en = readl(uport->membase + SE_GENI_M_IRQ_EN);
++ irq_en &= ~(M_CMD_DONE_EN | M_TX_FIFO_WATERMARK_EN);
++ writel(0, uport->membase + SE_GENI_TX_WATERMARK_REG);
++ writel(irq_en, uport->membase + SE_GENI_M_IRQ_EN);
++ status = readl(uport->membase + SE_GENI_STATUS);
+ /* Possible stop tx is called multiple times. */
+ if (!(status & M_GENI_CMD_ACTIVE))
+ return;
+
+- /*
+- * Ensure cancel command write is not re-ordered before checking
+- * the status of the Primary Sequencer.
+- */
+- mb();
+-
+ geni_se_cancel_m_cmd(&port->se);
+ if (!qcom_geni_serial_poll_bit(uport, SE_GENI_M_IRQ_STATUS,
+ M_CMD_CANCEL_EN, true)) {
+ geni_se_abort_m_cmd(&port->se);
+ qcom_geni_serial_poll_bit(uport, SE_GENI_M_IRQ_STATUS,
+ M_CMD_ABORT_EN, true);
+- writel_relaxed(M_CMD_ABORT_EN, uport->membase +
+- SE_GENI_M_IRQ_CLEAR);
++ writel(M_CMD_ABORT_EN, uport->membase + SE_GENI_M_IRQ_CLEAR);
+ }
+- writel_relaxed(M_CMD_CANCEL_EN, uport->membase + SE_GENI_M_IRQ_CLEAR);
++ writel(M_CMD_CANCEL_EN, uport->membase + SE_GENI_M_IRQ_CLEAR);
+ }
+
+ static void qcom_geni_serial_start_rx(struct uart_port *uport)
+@@ -624,27 +595,19 @@ static void qcom_geni_serial_start_rx(struct uart_port *uport)
+ u32 status;
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+
+- status = readl_relaxed(uport->membase + SE_GENI_STATUS);
++ status = readl(uport->membase + SE_GENI_STATUS);
+ if (status & S_GENI_CMD_ACTIVE)
+ qcom_geni_serial_stop_rx(uport);
+
+- /*
+- * Ensure setup command write is not re-ordered before checking
+- * the status of the Secondary Sequencer.
+- */
+- mb();
+-
+ geni_se_setup_s_cmd(&port->se, UART_START_READ, 0);
+
+- if (port->xfer_mode == GENI_SE_FIFO) {
+- irq_en = readl_relaxed(uport->membase + SE_GENI_S_IRQ_EN);
+- irq_en |= S_RX_FIFO_WATERMARK_EN | S_RX_FIFO_LAST_EN;
+- writel_relaxed(irq_en, uport->membase + SE_GENI_S_IRQ_EN);
++ irq_en = readl(uport->membase + SE_GENI_S_IRQ_EN);
++ irq_en |= S_RX_FIFO_WATERMARK_EN | S_RX_FIFO_LAST_EN;
++ writel(irq_en, uport->membase + SE_GENI_S_IRQ_EN);
+
+- irq_en = readl_relaxed(uport->membase + SE_GENI_M_IRQ_EN);
+- irq_en |= M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN;
+- writel_relaxed(irq_en, uport->membase + SE_GENI_M_IRQ_EN);
+- }
++ irq_en = readl(uport->membase + SE_GENI_M_IRQ_EN);
++ irq_en |= M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN;
++ writel(irq_en, uport->membase + SE_GENI_M_IRQ_EN);
+ }
+
+ static void qcom_geni_serial_stop_rx(struct uart_port *uport)
+@@ -652,34 +615,35 @@ static void qcom_geni_serial_stop_rx(struct uart_port *uport)
+ u32 irq_en;
+ u32 status;
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+- u32 irq_clear = S_CMD_DONE_EN;
++ u32 s_irq_status;
+
+- if (port->xfer_mode == GENI_SE_FIFO) {
+- irq_en = readl_relaxed(uport->membase + SE_GENI_S_IRQ_EN);
+- irq_en &= ~(S_RX_FIFO_WATERMARK_EN | S_RX_FIFO_LAST_EN);
+- writel_relaxed(irq_en, uport->membase + SE_GENI_S_IRQ_EN);
++ irq_en = readl(uport->membase + SE_GENI_S_IRQ_EN);
++ irq_en &= ~(S_RX_FIFO_WATERMARK_EN | S_RX_FIFO_LAST_EN);
++ writel(irq_en, uport->membase + SE_GENI_S_IRQ_EN);
+
+- irq_en = readl_relaxed(uport->membase + SE_GENI_M_IRQ_EN);
+- irq_en &= ~(M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN);
+- writel_relaxed(irq_en, uport->membase + SE_GENI_M_IRQ_EN);
+- }
++ irq_en = readl(uport->membase + SE_GENI_M_IRQ_EN);
++ irq_en &= ~(M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN);
++ writel(irq_en, uport->membase + SE_GENI_M_IRQ_EN);
+
+- status = readl_relaxed(uport->membase + SE_GENI_STATUS);
++ status = readl(uport->membase + SE_GENI_STATUS);
+ /* Possible stop rx is called multiple times. */
+ if (!(status & S_GENI_CMD_ACTIVE))
+ return;
+
++ geni_se_cancel_s_cmd(&port->se);
++ qcom_geni_serial_poll_bit(uport, SE_GENI_S_IRQ_STATUS,
++ S_CMD_CANCEL_EN, true);
+ /*
+- * Ensure cancel command write is not re-ordered before checking
+- * the status of the Secondary Sequencer.
++ * If timeout occurs secondary engine remains active
++ * and Abort sequence is executed.
+ */
+- mb();
++ s_irq_status = readl(uport->membase + SE_GENI_S_IRQ_STATUS);
++ /* Flush the Rx buffer */
++ if (s_irq_status & S_RX_FIFO_LAST_EN)
++ qcom_geni_serial_handle_rx(uport, true);
++ writel(s_irq_status, uport->membase + SE_GENI_S_IRQ_CLEAR);
+
+- geni_se_cancel_s_cmd(&port->se);
+- qcom_geni_serial_poll_bit(uport, SE_GENI_S_CMD_CTRL_REG,
+- S_GENI_CMD_CANCEL, false);
+- status = readl_relaxed(uport->membase + SE_GENI_STATUS);
+- writel_relaxed(irq_clear, uport->membase + SE_GENI_S_IRQ_CLEAR);
++ status = readl(uport->membase + SE_GENI_STATUS);
+ if (status & S_GENI_CMD_ACTIVE)
+ qcom_geni_serial_abort_rx(uport);
+ }
+@@ -693,7 +657,7 @@ static void qcom_geni_serial_handle_rx(struct uart_port *uport, bool drop)
+ u32 total_bytes;
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+
+- status = readl_relaxed(uport->membase + SE_GENI_RX_FIFO_STATUS);
++ status = readl(uport->membase + SE_GENI_RX_FIFO_STATUS);
+ word_cnt = status & RX_FIFO_WC_MSK;
+ last_word_partial = status & RX_LAST;
+ last_word_byte_cnt = (status & RX_LAST_BYTE_VALID_MSK) >>
+@@ -719,10 +683,11 @@ static void qcom_geni_serial_handle_tx(struct uart_port *uport, bool done,
+ size_t pending;
+ int i;
+ u32 status;
++ u32 irq_en;
+ unsigned int chunk;
+ int tail;
+
+- status = readl_relaxed(uport->membase + SE_GENI_TX_FIFO_STATUS);
++ status = readl(uport->membase + SE_GENI_TX_FIFO_STATUS);
+
+ /* Complete the current tx command before taking newly added data */
+ if (active)
+@@ -747,6 +712,11 @@ static void qcom_geni_serial_handle_tx(struct uart_port *uport, bool done,
+ if (!port->tx_remaining) {
+ qcom_geni_serial_setup_tx(uport, pending);
+ port->tx_remaining = pending;
++
++ irq_en = readl(uport->membase + SE_GENI_M_IRQ_EN);
++ if (!(irq_en & M_TX_FIFO_WATERMARK_EN))
++ writel(irq_en | M_TX_FIFO_WATERMARK_EN,
++ uport->membase + SE_GENI_M_IRQ_EN);
+ }
+
+ remaining = chunk;
+@@ -770,7 +740,23 @@ static void qcom_geni_serial_handle_tx(struct uart_port *uport, bool done,
+ }
+
+ xmit->tail = tail & (UART_XMIT_SIZE - 1);
++
++ /*
++ * The tx fifo watermark is level triggered and latched. Though we had
++ * cleared it in qcom_geni_serial_isr it will have already reasserted
++ * so we must clear it again here after our writes.
++ */
++ writel(M_TX_FIFO_WATERMARK_EN,
++ uport->membase + SE_GENI_M_IRQ_CLEAR);
++
+ out_write_wakeup:
++ if (!port->tx_remaining) {
++ irq_en = readl(uport->membase + SE_GENI_M_IRQ_EN);
++ if (irq_en & M_TX_FIFO_WATERMARK_EN)
++ writel(irq_en & ~M_TX_FIFO_WATERMARK_EN,
++ uport->membase + SE_GENI_M_IRQ_EN);
++ }
++
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(uport);
+ }
+@@ -791,12 +777,12 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
+ return IRQ_NONE;
+
+ spin_lock_irqsave(&uport->lock, flags);
+- m_irq_status = readl_relaxed(uport->membase + SE_GENI_M_IRQ_STATUS);
+- s_irq_status = readl_relaxed(uport->membase + SE_GENI_S_IRQ_STATUS);
+- geni_status = readl_relaxed(uport->membase + SE_GENI_STATUS);
+- m_irq_en = readl_relaxed(uport->membase + SE_GENI_M_IRQ_EN);
+- writel_relaxed(m_irq_status, uport->membase + SE_GENI_M_IRQ_CLEAR);
+- writel_relaxed(s_irq_status, uport->membase + SE_GENI_S_IRQ_CLEAR);
++ m_irq_status = readl(uport->membase + SE_GENI_M_IRQ_STATUS);
++ s_irq_status = readl(uport->membase + SE_GENI_S_IRQ_STATUS);
++ geni_status = readl(uport->membase + SE_GENI_STATUS);
++ m_irq_en = readl(uport->membase + SE_GENI_M_IRQ_EN);
++ writel(m_irq_status, uport->membase + SE_GENI_M_IRQ_CLEAR);
++ writel(s_irq_status, uport->membase + SE_GENI_S_IRQ_CLEAR);
+
+ if (WARN_ON(m_irq_status & M_ILLEGAL_CMD_EN))
+ goto out_unlock;
+@@ -806,8 +792,7 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
+ tty_insert_flip_char(tport, 0, TTY_OVERRUN);
+ }
+
+- if (m_irq_status & (M_TX_FIFO_WATERMARK_EN | M_CMD_DONE_EN) &&
+- m_irq_en & (M_TX_FIFO_WATERMARK_EN | M_CMD_DONE_EN))
++ if (m_irq_status & m_irq_en & (M_TX_FIFO_WATERMARK_EN | M_CMD_DONE_EN))
+ qcom_geni_serial_handle_tx(uport, m_irq_status & M_CMD_DONE_EN,
+ geni_status & M_GENI_CMD_ACTIVE);
+
+@@ -842,17 +827,6 @@ static void get_tx_fifo_size(struct qcom_geni_serial_port *port)
+ (port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE;
+ }
+
+-static void set_rfr_wm(struct qcom_geni_serial_port *port)
+-{
+- /*
+- * Set RFR (Flow off) to FIFO_DEPTH - 2.
+- * RX WM level at 10% RX_FIFO_DEPTH.
+- * TX WM level at 10% TX_FIFO_DEPTH.
+- */
+- port->rx_rfr = port->rx_fifo_depth - 2;
+- port->rx_wm = UART_CONSOLE_RX_WM;
+- port->tx_wm = DEF_TX_WM;
+-}
+
+ static void qcom_geni_serial_shutdown(struct uart_port *uport)
+ {
+@@ -891,21 +865,19 @@ static int qcom_geni_serial_port_setup(struct uart_port *uport)
+
+ get_tx_fifo_size(port);
+
+- set_rfr_wm(port);
+- writel_relaxed(rxstale, uport->membase + SE_UART_RX_STALE_CNT);
++ writel(rxstale, uport->membase + SE_UART_RX_STALE_CNT);
+ /*
+ * Make an unconditional cancel on the main sequencer to reset
+ * it else we could end up in data loss scenarios.
+ */
+- port->xfer_mode = GENI_SE_FIFO;
+ if (uart_console(uport))
+ qcom_geni_serial_poll_tx_done(uport);
+ geni_se_config_packing(&port->se, BITS_PER_BYTE, port->tx_bytes_pw,
+ false, true, false);
+ geni_se_config_packing(&port->se, BITS_PER_BYTE, port->rx_bytes_pw,
+ false, false, true);
+- geni_se_init(&port->se, port->rx_wm, port->rx_rfr);
+- geni_se_select_mode(&port->se, port->xfer_mode);
++ geni_se_init(&port->se, UART_RX_WM, port->rx_fifo_depth - 2);
++ geni_se_select_mode(&port->se, GENI_SE_FIFO);
+ if (!uart_console(uport)) {
+ port->rx_fifo = devm_kcalloc(uport->dev,
+ port->rx_fifo_depth, sizeof(u32), GFP_KERNEL);
+@@ -996,10 +968,10 @@ static void qcom_geni_serial_set_termios(struct uart_port *uport,
+ ser_clk_cfg |= clk_div << CLK_DIV_SHFT;
+
+ /* parity */
+- tx_trans_cfg = readl_relaxed(uport->membase + SE_UART_TX_TRANS_CFG);
+- tx_parity_cfg = readl_relaxed(uport->membase + SE_UART_TX_PARITY_CFG);
+- rx_trans_cfg = readl_relaxed(uport->membase + SE_UART_RX_TRANS_CFG);
+- rx_parity_cfg = readl_relaxed(uport->membase + SE_UART_RX_PARITY_CFG);
++ tx_trans_cfg = readl(uport->membase + SE_UART_TX_TRANS_CFG);
++ tx_parity_cfg = readl(uport->membase + SE_UART_TX_PARITY_CFG);
++ rx_trans_cfg = readl(uport->membase + SE_UART_RX_TRANS_CFG);
++ rx_parity_cfg = readl(uport->membase + SE_UART_RX_PARITY_CFG);
+ if (termios->c_cflag & PARENB) {
+ tx_trans_cfg |= UART_TX_PAR_EN;
+ rx_trans_cfg |= UART_RX_PAR_EN;
+@@ -1055,17 +1027,17 @@ static void qcom_geni_serial_set_termios(struct uart_port *uport,
+ uart_update_timeout(uport, termios->c_cflag, baud);
+
+ if (!uart_console(uport))
+- writel_relaxed(port->loopback,
++ writel(port->loopback,
+ uport->membase + SE_UART_LOOPBACK_CFG);
+- writel_relaxed(tx_trans_cfg, uport->membase + SE_UART_TX_TRANS_CFG);
+- writel_relaxed(tx_parity_cfg, uport->membase + SE_UART_TX_PARITY_CFG);
+- writel_relaxed(rx_trans_cfg, uport->membase + SE_UART_RX_TRANS_CFG);
+- writel_relaxed(rx_parity_cfg, uport->membase + SE_UART_RX_PARITY_CFG);
+- writel_relaxed(bits_per_char, uport->membase + SE_UART_TX_WORD_LEN);
+- writel_relaxed(bits_per_char, uport->membase + SE_UART_RX_WORD_LEN);
+- writel_relaxed(stop_bit_len, uport->membase + SE_UART_TX_STOP_BIT_LEN);
+- writel_relaxed(ser_clk_cfg, uport->membase + GENI_SER_M_CLK_CFG);
+- writel_relaxed(ser_clk_cfg, uport->membase + GENI_SER_S_CLK_CFG);
++ writel(tx_trans_cfg, uport->membase + SE_UART_TX_TRANS_CFG);
++ writel(tx_parity_cfg, uport->membase + SE_UART_TX_PARITY_CFG);
++ writel(rx_trans_cfg, uport->membase + SE_UART_RX_TRANS_CFG);
++ writel(rx_parity_cfg, uport->membase + SE_UART_RX_PARITY_CFG);
++ writel(bits_per_char, uport->membase + SE_UART_TX_WORD_LEN);
++ writel(bits_per_char, uport->membase + SE_UART_RX_WORD_LEN);
++ writel(stop_bit_len, uport->membase + SE_UART_TX_STOP_BIT_LEN);
++ writel(ser_clk_cfg, uport->membase + GENI_SER_M_CLK_CFG);
++ writel(ser_clk_cfg, uport->membase + GENI_SER_S_CLK_CFG);
+ out_restart_rx:
+ qcom_geni_serial_start_rx(uport);
+ }
+@@ -1156,13 +1128,13 @@ static int __init qcom_geni_serial_earlycon_setup(struct earlycon_device *dev,
+ geni_se_init(&se, DEF_FIFO_DEPTH_WORDS / 2, DEF_FIFO_DEPTH_WORDS - 2);
+ geni_se_select_mode(&se, GENI_SE_FIFO);
+
+- writel_relaxed(tx_trans_cfg, uport->membase + SE_UART_TX_TRANS_CFG);
+- writel_relaxed(tx_parity_cfg, uport->membase + SE_UART_TX_PARITY_CFG);
+- writel_relaxed(rx_trans_cfg, uport->membase + SE_UART_RX_TRANS_CFG);
+- writel_relaxed(rx_parity_cfg, uport->membase + SE_UART_RX_PARITY_CFG);
+- writel_relaxed(bits_per_char, uport->membase + SE_UART_TX_WORD_LEN);
+- writel_relaxed(bits_per_char, uport->membase + SE_UART_RX_WORD_LEN);
+- writel_relaxed(stop_bit_len, uport->membase + SE_UART_TX_STOP_BIT_LEN);
++ writel(tx_trans_cfg, uport->membase + SE_UART_TX_TRANS_CFG);
++ writel(tx_parity_cfg, uport->membase + SE_UART_TX_PARITY_CFG);
++ writel(rx_trans_cfg, uport->membase + SE_UART_RX_TRANS_CFG);
++ writel(rx_parity_cfg, uport->membase + SE_UART_RX_PARITY_CFG);
++ writel(bits_per_char, uport->membase + SE_UART_TX_WORD_LEN);
++ writel(bits_per_char, uport->membase + SE_UART_RX_WORD_LEN);
++ writel(stop_bit_len, uport->membase + SE_UART_TX_STOP_BIT_LEN);
+
+ dev->con->write = qcom_geni_serial_earlycon_write;
+ dev->con->setup = NULL;
+diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
+index c699d41a2a48..fbacb00c2601 100644
+--- a/drivers/tty/tty_port.c
++++ b/drivers/tty/tty_port.c
+@@ -52,10 +52,11 @@ static void tty_port_default_wakeup(struct tty_port *port)
+ }
+ }
+
+-static const struct tty_port_client_operations default_client_ops = {
++const struct tty_port_client_operations tty_port_default_client_ops = {
+ .receive_buf = tty_port_default_receive_buf,
+ .write_wakeup = tty_port_default_wakeup,
+ };
++EXPORT_SYMBOL_GPL(tty_port_default_client_ops);
+
+ void tty_port_init(struct tty_port *port)
+ {
+@@ -68,7 +69,7 @@ void tty_port_init(struct tty_port *port)
+ spin_lock_init(&port->lock);
+ port->close_delay = (50 * HZ) / 100;
+ port->closing_wait = (3000 * HZ) / 100;
+- port->client_ops = &default_client_ops;
++ port->client_ops = &tty_port_default_client_ops;
+ kref_init(&port->kref);
+ }
+ EXPORT_SYMBOL(tty_port_init);
+diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
+index 07496c711d7d..3ac4fe549c2e 100644
+--- a/drivers/tty/vt/selection.c
++++ b/drivers/tty/vt/selection.c
+@@ -27,6 +27,8 @@
+ #include <linux/console.h>
+ #include <linux/tty_flip.h>
+
++#include <linux/sched/signal.h>
++
+ /* Don't take this from <ctype.h>: 011-015 on the screen aren't spaces */
+ #define isspace(c) ((c) == ' ')
+
+@@ -337,6 +339,7 @@ int paste_selection(struct tty_struct *tty)
+ unsigned int count;
+ struct tty_ldisc *ld;
+ DECLARE_WAITQUEUE(wait, current);
++ int ret = 0;
+
+ console_lock();
+ poke_blanked_console();
+@@ -350,6 +353,10 @@ int paste_selection(struct tty_struct *tty)
+ add_wait_queue(&vc->paste_wait, &wait);
+ while (sel_buffer && sel_buffer_lth > pasted) {
+ set_current_state(TASK_INTERRUPTIBLE);
++ if (signal_pending(current)) {
++ ret = -EINTR;
++ break;
++ }
+ if (tty_throttled(tty)) {
+ schedule();
+ continue;
+@@ -365,5 +372,5 @@ int paste_selection(struct tty_struct *tty)
+
+ tty_buffer_unlock_exclusive(&vc->port);
+ tty_ldisc_deref(ld);
+- return 0;
++ return ret;
+ }
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index d673e3592662..ddaecb1bd9fd 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -936,10 +936,21 @@ static void flush_scrollback(struct vc_data *vc)
+ WARN_CONSOLE_UNLOCKED();
+
+ set_origin(vc);
+- if (vc->vc_sw->con_flush_scrollback)
++ if (vc->vc_sw->con_flush_scrollback) {
+ vc->vc_sw->con_flush_scrollback(vc);
+- else
++ } else if (con_is_visible(vc)) {
++ /*
++ * When no con_flush_scrollback method is provided then the
++ * legacy way for flushing the scrollback buffer is to use
++ * a side effect of the con_switch method. We do it only on
++ * the foreground console as background consoles have no
++ * scrollback buffers in that case and we obviously don't
++ * want to switch to them.
++ */
++ hide_cursor(vc);
+ vc->vc_sw->con_switch(vc);
++ set_cursor(vc);
++ }
+ }
+
+ /*
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index 73cdc0d633dd..2bb6de89b029 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -876,15 +876,20 @@ int vt_ioctl(struct tty_struct *tty,
+ return -EINVAL;
+
+ for (i = 0; i < MAX_NR_CONSOLES; i++) {
++ struct vc_data *vcp;
++
+ if (!vc_cons[i].d)
+ continue;
+ console_lock();
+- if (v.v_vlin)
+- vc_cons[i].d->vc_scan_lines = v.v_vlin;
+- if (v.v_clin)
+- vc_cons[i].d->vc_font.height = v.v_clin;
+- vc_cons[i].d->vc_resize_user = 1;
+- vc_resize(vc_cons[i].d, v.v_cols, v.v_rows);
++ vcp = vc_cons[i].d;
++ if (vcp) {
++ if (v.v_vlin)
++ vcp->vc_scan_lines = v.v_vlin;
++ if (v.v_clin)
++ vcp->vc_font.height = v.v_clin;
++ vcp->vc_resize_user = 1;
++ vc_resize(vcp, v.v_cols, v.v_rows);
++ }
+ console_unlock();
+ }
+ break;
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 0bf0e62bede3..2025261e97a1 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -256,6 +256,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
+ struct usb_host_interface *ifp, int num_ep,
+ unsigned char *buffer, int size)
+ {
++ struct usb_device *udev = to_usb_device(ddev);
+ unsigned char *buffer0 = buffer;
+ struct usb_endpoint_descriptor *d;
+ struct usb_host_endpoint *endpoint;
+@@ -297,6 +298,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
+ goto skip_to_next_endpoint_or_interface_descriptor;
+ }
+
++ /* Ignore blacklisted endpoints */
++ if (udev->quirks & USB_QUIRK_ENDPOINT_BLACKLIST) {
++ if (usb_endpoint_is_blacklisted(udev, ifp, d)) {
++ dev_warn(ddev, "config %d interface %d altsetting %d has a blacklisted endpoint with address 0x%X, skipping\n",
++ cfgno, inum, asnum,
++ d->bEndpointAddress);
++ goto skip_to_next_endpoint_or_interface_descriptor;
++ }
++ }
++
+ endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
+ ++ifp->desc.bNumEndpoints;
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 6ab4ca1d9ae1..27486b0a027a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -36,7 +36,9 @@
+ #include "otg_whitelist.h"
+
+ #define USB_VENDOR_GENESYS_LOGIC 0x05e3
++#define USB_VENDOR_SMSC 0x0424
+ #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01
++#define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02
+
+ #define USB_TP_TRANSMISSION_DELAY 40 /* ns */
+ #define USB_TP_TRANSMISSION_DELAY_MAX 65535 /* ns */
+@@ -1190,11 +1192,6 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ #ifdef CONFIG_PM
+ udev->reset_resume = 1;
+ #endif
+- /* Don't set the change_bits when the device
+- * was powered off.
+- */
+- if (test_bit(port1, hub->power_bits))
+- set_bit(port1, hub->change_bits);
+
+ } else {
+ /* The power session is gone; tell hub_wq */
+@@ -1700,6 +1697,10 @@ static void hub_disconnect(struct usb_interface *intf)
+ kfree(hub->buffer);
+
+ pm_suspend_ignore_children(&intf->dev, false);
++
++ if (hub->quirk_disable_autosuspend)
++ usb_autopm_put_interface(intf);
++
+ kref_put(&hub->kref, hub_release);
+ }
+
+@@ -1830,6 +1831,11 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ if (id->driver_info & HUB_QUIRK_CHECK_PORT_AUTOSUSPEND)
+ hub->quirk_check_port_auto_suspend = 1;
+
++ if (id->driver_info & HUB_QUIRK_DISABLE_AUTOSUSPEND) {
++ hub->quirk_disable_autosuspend = 1;
++ usb_autopm_get_interface(intf);
++ }
++
+ if (hub_configure(hub, &desc->endpoint[0].desc) >= 0)
+ return 0;
+
+@@ -5410,6 +5416,10 @@ out_hdev_lock:
+ }
+
+ static const struct usb_device_id hub_id_table[] = {
++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_CLASS,
++ .idVendor = USB_VENDOR_SMSC,
++ .bInterfaceClass = USB_CLASS_HUB,
++ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
+ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
+ | USB_DEVICE_ID_MATCH_INT_CLASS,
+ .idVendor = USB_VENDOR_GENESYS_LOGIC,
+diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h
+index 4accfb63f7dc..d0bbbd76ba8e 100644
+--- a/drivers/usb/core/hub.h
++++ b/drivers/usb/core/hub.h
+@@ -61,6 +61,7 @@ struct usb_hub {
+ unsigned quiescing:1;
+ unsigned disconnected:1;
+ unsigned in_reset:1;
++ unsigned quirk_disable_autosuspend:1;
+
+ unsigned quirk_check_port_auto_suspend:1;
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 6b6413073584..2b24336a72e5 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -354,6 +354,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x0904, 0x6103), .driver_info =
+ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
+
++ /* Sound Devices USBPre2 */
++ { USB_DEVICE(0x0926, 0x0202), .driver_info =
++ USB_QUIRK_ENDPOINT_BLACKLIST },
++
+ /* Keytouch QWERTY Panel keyboard */
+ { USB_DEVICE(0x0926, 0x3333), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+@@ -445,6 +449,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* INTEL VALUE SSD */
+ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* novation SoundControl XL */
++ { USB_DEVICE(0x1235, 0x0061), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ { } /* terminating entry must be last */
+ };
+
+@@ -472,6 +479,39 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
+ { } /* terminating entry must be last */
+ };
+
++/*
++ * Entries for blacklisted endpoints that should be ignored when parsing
++ * configuration descriptors.
++ *
++ * Matched for devices with USB_QUIRK_ENDPOINT_BLACKLIST.
++ */
++static const struct usb_device_id usb_endpoint_blacklist[] = {
++ { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0202, 1), .driver_info = 0x85 },
++ { }
++};
++
++bool usb_endpoint_is_blacklisted(struct usb_device *udev,
++ struct usb_host_interface *intf,
++ struct usb_endpoint_descriptor *epd)
++{
++ const struct usb_device_id *id;
++ unsigned int address;
++
++ for (id = usb_endpoint_blacklist; id->match_flags; ++id) {
++ if (!usb_match_device(udev, id))
++ continue;
++
++ if (!usb_match_one_id_intf(udev, intf, id))
++ continue;
++
++ address = id->driver_info;
++ if (address == epd->bEndpointAddress)
++ return true;
++ }
++
++ return false;
++}
++
+ static bool usb_match_any_interface(struct usb_device *udev,
+ const struct usb_device_id *id)
+ {
+diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
+index d95a5358f73d..c0df5a468d78 100644
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -37,6 +37,9 @@ extern void usb_authorize_interface(struct usb_interface *);
+ extern void usb_detect_quirks(struct usb_device *udev);
+ extern void usb_detect_interface_quirks(struct usb_device *udev);
+ extern void usb_release_quirk_list(void);
++extern bool usb_endpoint_is_blacklisted(struct usb_device *udev,
++ struct usb_host_interface *intf,
++ struct usb_endpoint_descriptor *epd);
+ extern int usb_remove_device(struct usb_device *udev);
+
+ extern int usb_get_device_descriptor(struct usb_device *dev,
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 17f3e7b4d4fe..d8424834902d 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -1004,11 +1004,6 @@ static void dwc2_hsotg_start_req(struct dwc2_hsotg *hsotg,
+ else
+ packets = 1; /* send one packet if length is zero. */
+
+- if (hs_ep->isochronous && length > (hs_ep->mc * hs_ep->ep.maxpacket)) {
+- dev_err(hsotg->dev, "req length > maxpacket*mc\n");
+- return;
+- }
+-
+ if (dir_in && index != 0)
+ if (hs_ep->isochronous)
+ epsize = DXEPTSIZ_MC(packets);
+@@ -1312,6 +1307,13 @@ static int dwc2_hsotg_ep_queue(struct usb_ep *ep, struct usb_request *req,
+ req->actual = 0;
+ req->status = -EINPROGRESS;
+
++ /* Don't queue ISOC request if length greater than mps*mc */
++ if (hs_ep->isochronous &&
++ req->length > (hs_ep->mc * hs_ep->ep.maxpacket)) {
++ dev_err(hs->dev, "req length > maxpacket*mc\n");
++ return -EINVAL;
++ }
++
+ /* In DDMA mode for ISOC's don't queue request if length greater
+ * than descriptor limits.
+ */
+@@ -1542,6 +1544,7 @@ static int dwc2_hsotg_process_req_status(struct dwc2_hsotg *hsotg,
+ struct dwc2_hsotg_ep *ep0 = hsotg->eps_out[0];
+ struct dwc2_hsotg_ep *ep;
+ __le16 reply;
++ u16 status;
+ int ret;
+
+ dev_dbg(hsotg->dev, "%s: USB_REQ_GET_STATUS\n", __func__);
+@@ -1553,11 +1556,10 @@ static int dwc2_hsotg_process_req_status(struct dwc2_hsotg *hsotg,
+
+ switch (ctrl->bRequestType & USB_RECIP_MASK) {
+ case USB_RECIP_DEVICE:
+- /*
+- * bit 0 => self powered
+- * bit 1 => remote wakeup
+- */
+- reply = cpu_to_le16(0);
++ status = 1 << USB_DEVICE_SELF_POWERED;
++ status |= hsotg->remote_wakeup_allowed <<
++ USB_DEVICE_REMOTE_WAKEUP;
++ reply = cpu_to_le16(status);
+ break;
+
+ case USB_RECIP_INTERFACE:
+@@ -1668,7 +1670,10 @@ static int dwc2_hsotg_process_req_feature(struct dwc2_hsotg *hsotg,
+ case USB_RECIP_DEVICE:
+ switch (wValue) {
+ case USB_DEVICE_REMOTE_WAKEUP:
+- hsotg->remote_wakeup_allowed = 1;
++ if (set)
++ hsotg->remote_wakeup_allowed = 1;
++ else
++ hsotg->remote_wakeup_allowed = 0;
+ break;
+
+ case USB_DEVICE_TEST_MODE:
+@@ -1678,16 +1683,17 @@ static int dwc2_hsotg_process_req_feature(struct dwc2_hsotg *hsotg,
+ return -EINVAL;
+
+ hsotg->test_mode = wIndex >> 8;
+- ret = dwc2_hsotg_send_reply(hsotg, ep0, NULL, 0);
+- if (ret) {
+- dev_err(hsotg->dev,
+- "%s: failed to send reply\n", __func__);
+- return ret;
+- }
+ break;
+ default:
+ return -ENOENT;
+ }
++
++ ret = dwc2_hsotg_send_reply(hsotg, ep0, NULL, 0);
++ if (ret) {
++ dev_err(hsotg->dev,
++ "%s: failed to send reply\n", __func__);
++ return ret;
++ }
+ break;
+
+ case USB_RECIP_ENDPOINT:
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index a6e682a000fc..430cfd620854 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2224,7 +2224,8 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
+ if (event->status & DEPEVT_STATUS_SHORT && !chain)
+ return 1;
+
+- if (event->status & DEPEVT_STATUS_IOC)
++ if ((trb->ctrl & DWC3_TRB_CTRL_IOC) ||
++ (trb->ctrl & DWC3_TRB_CTRL_LST))
+ return 1;
+
+ return 0;
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 33115e19756c..fea7c7e0143f 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -437,12 +437,10 @@ static u8 encode_bMaxPower(enum usb_device_speed speed,
+ val = CONFIG_USB_GADGET_VBUS_DRAW;
+ if (!val)
+ return 0;
+- switch (speed) {
+- case USB_SPEED_SUPER:
+- return DIV_ROUND_UP(val, 8);
+- default:
++ if (speed < USB_SPEED_SUPER)
+ return DIV_ROUND_UP(val, 2);
+- }
++ else
++ return DIV_ROUND_UP(val, 8);
+ }
+
+ static int config_buf(struct usb_configuration *config,
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 9772c0de59b7..a024230f00e2 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -55,6 +55,7 @@ static u8 usb_bos_descriptor [] = {
+ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
+ u16 wLength)
+ {
++ struct xhci_port_cap *port_cap = NULL;
+ int i, ssa_count;
+ u32 temp;
+ u16 desc_size, ssp_cap_size, ssa_size = 0;
+@@ -64,16 +65,24 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
+ ssp_cap_size = sizeof(usb_bos_descriptor) - desc_size;
+
+ /* does xhci support USB 3.1 Enhanced SuperSpeed */
+- if (xhci->usb3_rhub.min_rev >= 0x01) {
++ for (i = 0; i < xhci->num_port_caps; i++) {
++ if (xhci->port_caps[i].maj_rev == 0x03 &&
++ xhci->port_caps[i].min_rev >= 0x01) {
++ usb3_1 = true;
++ port_cap = &xhci->port_caps[i];
++ break;
++ }
++ }
++
++ if (usb3_1) {
+ /* does xhci provide a PSI table for SSA speed attributes? */
+- if (xhci->usb3_rhub.psi_count) {
++ if (port_cap->psi_count) {
+ /* two SSA entries for each unique PSI ID, RX and TX */
+- ssa_count = xhci->usb3_rhub.psi_uid_count * 2;
++ ssa_count = port_cap->psi_uid_count * 2;
+ ssa_size = ssa_count * sizeof(u32);
+ ssp_cap_size -= 16; /* skip copying the default SSA */
+ }
+ desc_size += ssp_cap_size;
+- usb3_1 = true;
+ }
+ memcpy(buf, &usb_bos_descriptor, min(desc_size, wLength));
+
+@@ -99,7 +108,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
+ }
+
+ /* If PSI table exists, add the custom speed attributes from it */
+- if (usb3_1 && xhci->usb3_rhub.psi_count) {
++ if (usb3_1 && port_cap->psi_count) {
+ u32 ssp_cap_base, bm_attrib, psi, psi_mant, psi_exp;
+ int offset;
+
+@@ -111,7 +120,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
+
+ /* attribute count SSAC bits 4:0 and ID count SSIC bits 8:5 */
+ bm_attrib = (ssa_count - 1) & 0x1f;
+- bm_attrib |= (xhci->usb3_rhub.psi_uid_count - 1) << 5;
++ bm_attrib |= (port_cap->psi_uid_count - 1) << 5;
+ put_unaligned_le32(bm_attrib, &buf[ssp_cap_base + 4]);
+
+ if (wLength < desc_size + ssa_size)
+@@ -124,8 +133,8 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
+ * USB 3.1 requires two SSA entries (RX and TX) for every link
+ */
+ offset = desc_size;
+- for (i = 0; i < xhci->usb3_rhub.psi_count; i++) {
+- psi = xhci->usb3_rhub.psi[i];
++ for (i = 0; i < port_cap->psi_count; i++) {
++ psi = port_cap->psi[i];
+ psi &= ~USB_SSP_SUBLINK_SPEED_RSVD;
+ psi_exp = XHCI_EXT_PORT_PSIE(psi);
+ psi_mant = XHCI_EXT_PORT_PSIM(psi);
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 82ce6d8b708d..9e87c282a743 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1475,9 +1475,15 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
+ /* Allow 3 retries for everything but isoc, set CErr = 3 */
+ if (!usb_endpoint_xfer_isoc(&ep->desc))
+ err_count = 3;
+- /* Some devices get this wrong */
+- if (usb_endpoint_xfer_bulk(&ep->desc) && udev->speed == USB_SPEED_HIGH)
+- max_packet = 512;
++ /* HS bulk max packet should be 512, FS bulk supports 8, 16, 32 or 64 */
++ if (usb_endpoint_xfer_bulk(&ep->desc)) {
++ if (udev->speed == USB_SPEED_HIGH)
++ max_packet = 512;
++ if (udev->speed == USB_SPEED_FULL) {
++ max_packet = rounddown_pow_of_two(max_packet);
++ max_packet = clamp_val(max_packet, 8, 64);
++ }
++ }
+ /* xHCI 1.0 and 1.1 indicates that ctrl ep avg TRB Length should be 8 */
+ if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version >= 0x100)
+ avg_trb_len = 8;
+@@ -1909,17 +1915,17 @@ no_bw:
+ xhci->usb3_rhub.num_ports = 0;
+ xhci->num_active_eps = 0;
+ kfree(xhci->usb2_rhub.ports);
+- kfree(xhci->usb2_rhub.psi);
+ kfree(xhci->usb3_rhub.ports);
+- kfree(xhci->usb3_rhub.psi);
+ kfree(xhci->hw_ports);
+ kfree(xhci->rh_bw);
+ kfree(xhci->ext_caps);
++ for (i = 0; i < xhci->num_port_caps; i++)
++ kfree(xhci->port_caps[i].psi);
++ kfree(xhci->port_caps);
++ xhci->num_port_caps = 0;
+
+ xhci->usb2_rhub.ports = NULL;
+- xhci->usb2_rhub.psi = NULL;
+ xhci->usb3_rhub.ports = NULL;
+- xhci->usb3_rhub.psi = NULL;
+ xhci->hw_ports = NULL;
+ xhci->rh_bw = NULL;
+ xhci->ext_caps = NULL;
+@@ -2120,6 +2126,7 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
+ u8 major_revision, minor_revision;
+ struct xhci_hub *rhub;
+ struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
++ struct xhci_port_cap *port_cap;
+
+ temp = readl(addr);
+ major_revision = XHCI_EXT_PORT_MAJOR(temp);
+@@ -2154,31 +2161,39 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
+ /* WTF? "Valid values are ‘1’ to MaxPorts" */
+ return;
+
+- rhub->psi_count = XHCI_EXT_PORT_PSIC(temp);
+- if (rhub->psi_count) {
+- rhub->psi = kcalloc_node(rhub->psi_count, sizeof(*rhub->psi),
+- GFP_KERNEL, dev_to_node(dev));
+- if (!rhub->psi)
+- rhub->psi_count = 0;
++ port_cap = &xhci->port_caps[xhci->num_port_caps++];
++ if (xhci->num_port_caps > max_caps)
++ return;
++
++ port_cap->maj_rev = major_revision;
++ port_cap->min_rev = minor_revision;
++ port_cap->psi_count = XHCI_EXT_PORT_PSIC(temp);
+
+- rhub->psi_uid_count++;
+- for (i = 0; i < rhub->psi_count; i++) {
+- rhub->psi[i] = readl(addr + 4 + i);
++ if (port_cap->psi_count) {
++ port_cap->psi = kcalloc_node(port_cap->psi_count,
++ sizeof(*port_cap->psi),
++ GFP_KERNEL, dev_to_node(dev));
++ if (!port_cap->psi)
++ port_cap->psi_count = 0;
++
++ port_cap->psi_uid_count++;
++ for (i = 0; i < port_cap->psi_count; i++) {
++ port_cap->psi[i] = readl(addr + 4 + i);
+
+ /* count unique ID values, two consecutive entries can
+ * have the same ID if link is assymetric
+ */
+- if (i && (XHCI_EXT_PORT_PSIV(rhub->psi[i]) !=
+- XHCI_EXT_PORT_PSIV(rhub->psi[i - 1])))
+- rhub->psi_uid_count++;
++ if (i && (XHCI_EXT_PORT_PSIV(port_cap->psi[i]) !=
++ XHCI_EXT_PORT_PSIV(port_cap->psi[i - 1])))
++ port_cap->psi_uid_count++;
+
+ xhci_dbg(xhci, "PSIV:%d PSIE:%d PLT:%d PFD:%d LP:%d PSIM:%d\n",
+- XHCI_EXT_PORT_PSIV(rhub->psi[i]),
+- XHCI_EXT_PORT_PSIE(rhub->psi[i]),
+- XHCI_EXT_PORT_PLT(rhub->psi[i]),
+- XHCI_EXT_PORT_PFD(rhub->psi[i]),
+- XHCI_EXT_PORT_LP(rhub->psi[i]),
+- XHCI_EXT_PORT_PSIM(rhub->psi[i]));
++ XHCI_EXT_PORT_PSIV(port_cap->psi[i]),
++ XHCI_EXT_PORT_PSIE(port_cap->psi[i]),
++ XHCI_EXT_PORT_PLT(port_cap->psi[i]),
++ XHCI_EXT_PORT_PFD(port_cap->psi[i]),
++ XHCI_EXT_PORT_LP(port_cap->psi[i]),
++ XHCI_EXT_PORT_PSIM(port_cap->psi[i]));
+ }
+ }
+ /* cache usb2 port capabilities */
+@@ -2225,6 +2240,7 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
+ continue;
+ }
+ hw_port->rhub = rhub;
++ hw_port->port_cap = port_cap;
+ rhub->num_ports++;
+ }
+ /* FIXME: Should we disable ports not in the Extended Capabilities? */
+@@ -2315,6 +2331,11 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
+ if (!xhci->ext_caps)
+ return -ENOMEM;
+
++ xhci->port_caps = kcalloc_node(cap_count, sizeof(*xhci->port_caps),
++ flags, dev_to_node(dev));
++ if (!xhci->port_caps)
++ return -ENOMEM;
++
+ offset = cap_start;
+
+ while (offset) {
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 075c49cfe60f..58cf551a1246 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -41,6 +41,7 @@
+ #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8
+ #define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8
+ #define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0
++#define PCI_DEVICE_ID_INTEL_CML_XHCI 0xa3af
+
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba
+@@ -179,7 +180,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+- pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) {
++ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_CML_XHCI)) {
+ xhci->quirks |= XHCI_PME_STUCK_QUIRK;
+ }
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+@@ -283,6 +285,9 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
+ if (!usb_hcd_is_primary_hcd(hcd))
+ return 0;
+
++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
++ xhci_pme_acpi_rtd3_enable(pdev);
++
+ xhci_dbg(xhci, "Got SBRN %u\n", (unsigned int) xhci->sbrn);
+
+ /* Find any debug ports */
+@@ -340,9 +345,6 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ HCC_MAX_PSA(xhci->hcc_params) >= 4)
+ xhci->shared_hcd->can_do_streams = 1;
+
+- if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+- xhci_pme_acpi_rtd3_enable(dev);
+-
+ /* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */
+ pm_runtime_put_noidle(&dev->dev);
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 98b67605d3cf..509a7fce8f05 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2692,6 +2692,42 @@ static int xhci_handle_event(struct xhci_hcd *xhci)
+ return 1;
+ }
+
++/*
++ * Update Event Ring Dequeue Pointer:
++ * - When all events have finished
++ * - To avoid "Event Ring Full Error" condition
++ */
++static void xhci_update_erst_dequeue(struct xhci_hcd *xhci,
++ union xhci_trb *event_ring_deq)
++{
++ u64 temp_64;
++ dma_addr_t deq;
++
++ temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
++ /* If necessary, update the HW's version of the event ring deq ptr. */
++ if (event_ring_deq != xhci->event_ring->dequeue) {
++ deq = xhci_trb_virt_to_dma(xhci->event_ring->deq_seg,
++ xhci->event_ring->dequeue);
++ if (deq == 0)
++ xhci_warn(xhci, "WARN something wrong with SW event ring dequeue ptr\n");
++ /*
++ * Per 4.9.4, Software writes to the ERDP register shall
++ * always advance the Event Ring Dequeue Pointer value.
++ */
++ if ((temp_64 & (u64) ~ERST_PTR_MASK) ==
++ ((u64) deq & (u64) ~ERST_PTR_MASK))
++ return;
++
++ /* Update HC event ring dequeue pointer */
++ temp_64 &= ERST_PTR_MASK;
++ temp_64 |= ((u64) deq & (u64) ~ERST_PTR_MASK);
++ }
++
++ /* Clear the event handler busy flag (RW1C) */
++ temp_64 |= ERST_EHB;
++ xhci_write_64(xhci, temp_64, &xhci->ir_set->erst_dequeue);
++}
++
+ /*
+ * xHCI spec says we can get an interrupt, and if the HC has an error condition,
+ * we might get bad data out of the event ring. Section 4.10.2.7 has a list of
+@@ -2703,9 +2739,9 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
+ union xhci_trb *event_ring_deq;
+ irqreturn_t ret = IRQ_NONE;
+ unsigned long flags;
+- dma_addr_t deq;
+ u64 temp_64;
+ u32 status;
++ int event_loop = 0;
+
+ spin_lock_irqsave(&xhci->lock, flags);
+ /* Check if the xHC generated the interrupt, or the irq is shared */
+@@ -2759,24 +2795,14 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
+ /* FIXME this should be a delayed service routine
+ * that clears the EHB.
+ */
+- while (xhci_handle_event(xhci) > 0) {}
+-
+- temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
+- /* If necessary, update the HW's version of the event ring deq ptr. */
+- if (event_ring_deq != xhci->event_ring->dequeue) {
+- deq = xhci_trb_virt_to_dma(xhci->event_ring->deq_seg,
+- xhci->event_ring->dequeue);
+- if (deq == 0)
+- xhci_warn(xhci, "WARN something wrong with SW event "
+- "ring dequeue ptr.\n");
+- /* Update HC event ring dequeue pointer */
+- temp_64 &= ERST_PTR_MASK;
+- temp_64 |= ((u64) deq & (u64) ~ERST_PTR_MASK);
++ while (xhci_handle_event(xhci) > 0) {
++ if (event_loop++ < TRBS_PER_SEGMENT / 2)
++ continue;
++ xhci_update_erst_dequeue(xhci, event_ring_deq);
++ event_loop = 0;
+ }
+
+- /* Clear the event handler busy flag (RW1C); event ring is empty. */
+- temp_64 |= ERST_EHB;
+- xhci_write_64(xhci, temp_64, &xhci->ir_set->erst_dequeue);
++ xhci_update_erst_dequeue(xhci, event_ring_deq);
+ ret = IRQ_HANDLED;
+
+ out:
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 9b33031cf6fc..4dedc822237f 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1704,11 +1704,21 @@ static inline unsigned int hcd_index(struct usb_hcd *hcd)
+ else
+ return 1;
+ }
++
++struct xhci_port_cap {
++ u32 *psi; /* array of protocol speed ID entries */
++ u8 psi_count;
++ u8 psi_uid_count;
++ u8 maj_rev;
++ u8 min_rev;
++};
++
+ struct xhci_port {
+ __le32 __iomem *addr;
+ int hw_portnum;
+ int hcd_portnum;
+ struct xhci_hub *rhub;
++ struct xhci_port_cap *port_cap;
+ };
+
+ struct xhci_hub {
+@@ -1718,9 +1728,6 @@ struct xhci_hub {
+ /* supported prococol extended capabiliy values */
+ u8 maj_rev;
+ u8 min_rev;
+- u32 *psi; /* array of protocol speed ID entries */
+- u8 psi_count;
+- u8 psi_uid_count;
+ };
+
+ /* There is one xhci_hcd structure per controller */
+@@ -1882,6 +1889,9 @@ struct xhci_hcd {
+ /* cached usb2 extened protocol capabilites */
+ u32 *ext_caps;
+ unsigned int num_ext_caps;
++ /* cached extended protocol port capabilities */
++ struct xhci_port_cap *port_caps;
++ unsigned int num_port_caps;
+ /* Compliance Mode Recovery Data */
+ struct timer_list comp_mode_recovery_timer;
+ u32 port_status_u0;
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index 2d9d9490cdd4..92875a264b14 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -33,6 +33,14 @@
+ #define USB_DEVICE_ID_CODEMERCS_IOWPV2 0x1512
+ /* full speed iowarrior */
+ #define USB_DEVICE_ID_CODEMERCS_IOW56 0x1503
++/* fuller speed iowarrior */
++#define USB_DEVICE_ID_CODEMERCS_IOW28 0x1504
++#define USB_DEVICE_ID_CODEMERCS_IOW28L 0x1505
++#define USB_DEVICE_ID_CODEMERCS_IOW100 0x1506
++
++/* OEMed devices */
++#define USB_DEVICE_ID_CODEMERCS_IOW24SAG 0x158a
++#define USB_DEVICE_ID_CODEMERCS_IOW56AM 0x158b
+
+ /* Get a minor range for your devices from the usb maintainer */
+ #ifdef CONFIG_USB_DYNAMIC_MINORS
+@@ -137,6 +145,11 @@ static const struct usb_device_id iowarrior_ids[] = {
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOWPV1)},
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOWPV2)},
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56)},
++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW24SAG)},
++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56AM)},
++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28)},
++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28L)},
++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW100)},
+ {} /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, iowarrior_ids);
+@@ -361,6 +374,7 @@ static ssize_t iowarrior_write(struct file *file,
+ }
+ switch (dev->product_id) {
+ case USB_DEVICE_ID_CODEMERCS_IOW24:
++ case USB_DEVICE_ID_CODEMERCS_IOW24SAG:
+ case USB_DEVICE_ID_CODEMERCS_IOWPV1:
+ case USB_DEVICE_ID_CODEMERCS_IOWPV2:
+ case USB_DEVICE_ID_CODEMERCS_IOW40:
+@@ -375,6 +389,10 @@ static ssize_t iowarrior_write(struct file *file,
+ goto exit;
+ break;
+ case USB_DEVICE_ID_CODEMERCS_IOW56:
++ case USB_DEVICE_ID_CODEMERCS_IOW56AM:
++ case USB_DEVICE_ID_CODEMERCS_IOW28:
++ case USB_DEVICE_ID_CODEMERCS_IOW28L:
++ case USB_DEVICE_ID_CODEMERCS_IOW100:
+ /* The IOW56 uses asynchronous IO and more urbs */
+ if (atomic_read(&dev->write_busy) == MAX_WRITES_IN_FLIGHT) {
+ /* Wait until we are below the limit for submitted urbs */
+@@ -499,6 +517,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd,
+ switch (cmd) {
+ case IOW_WRITE:
+ if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW24 ||
++ dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW24SAG ||
+ dev->product_id == USB_DEVICE_ID_CODEMERCS_IOWPV1 ||
+ dev->product_id == USB_DEVICE_ID_CODEMERCS_IOWPV2 ||
+ dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW40) {
+@@ -782,7 +801,11 @@ static int iowarrior_probe(struct usb_interface *interface,
+ goto error;
+ }
+
+- if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) {
++ if ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW100)) {
+ res = usb_find_last_int_out_endpoint(iface_desc,
+ &dev->int_out_endpoint);
+ if (res) {
+@@ -795,7 +818,11 @@ static int iowarrior_probe(struct usb_interface *interface,
+ /* we have to check the report_size often, so remember it in the endianness suitable for our machine */
+ dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
+ if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&
+- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56))
++ ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW100)))
+ /* IOWarrior56 has wMaxPacketSize different from report size */
+ dev->report_size = 7;
+
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index 1c6eb3a8741e..62ca8e29da48 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -45,6 +45,7 @@ struct uas_dev_info {
+ struct scsi_cmnd *cmnd[MAX_CMNDS];
+ spinlock_t lock;
+ struct work_struct work;
++ struct work_struct scan_work; /* for async scanning */
+ };
+
+ enum {
+@@ -114,6 +115,17 @@ out:
+ spin_unlock_irqrestore(&devinfo->lock, flags);
+ }
+
++static void uas_scan_work(struct work_struct *work)
++{
++ struct uas_dev_info *devinfo =
++ container_of(work, struct uas_dev_info, scan_work);
++ struct Scsi_Host *shost = usb_get_intfdata(devinfo->intf);
++
++ dev_dbg(&devinfo->intf->dev, "starting scan\n");
++ scsi_scan_host(shost);
++ dev_dbg(&devinfo->intf->dev, "scan complete\n");
++}
++
+ static void uas_add_work(struct uas_cmd_info *cmdinfo)
+ {
+ struct scsi_pointer *scp = (void *)cmdinfo;
+@@ -989,6 +1001,7 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ init_usb_anchor(&devinfo->data_urbs);
+ spin_lock_init(&devinfo->lock);
+ INIT_WORK(&devinfo->work, uas_do_work);
++ INIT_WORK(&devinfo->scan_work, uas_scan_work);
+
+ result = uas_configure_endpoints(devinfo);
+ if (result)
+@@ -1005,7 +1018,9 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ if (result)
+ goto free_streams;
+
+- scsi_scan_host(shost);
++ /* Submit the delayed_work for SCSI-device scanning */
++ schedule_work(&devinfo->scan_work);
++
+ return result;
+
+ free_streams:
+@@ -1173,6 +1188,12 @@ static void uas_disconnect(struct usb_interface *intf)
+ usb_kill_anchored_urbs(&devinfo->data_urbs);
+ uas_zap_pending(devinfo, DID_NO_CONNECT);
+
++ /*
++ * Prevent SCSI scanning (if it hasn't started yet)
++ * or wait for the SCSI-scanning routine to stop.
++ */
++ cancel_work_sync(&devinfo->scan_work);
++
+ scsi_remove_host(shost);
+ uas_free_streams(devinfo);
+ scsi_host_put(shost);
+diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c
+index 08cb419eb4e6..5f6b77ea34fb 100644
+--- a/drivers/xen/preempt.c
++++ b/drivers/xen/preempt.c
+@@ -37,7 +37,9 @@ asmlinkage __visible void xen_maybe_preempt_hcall(void)
+ * cpu.
+ */
+ __this_cpu_write(xen_in_preemptible_hcall, false);
+- _cond_resched();
++ local_irq_enable();
++ cond_resched();
++ local_irq_disable();
+ __this_cpu_write(xen_in_preemptible_hcall, true);
+ }
+ }
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index ea45112a98be..b5039b16de93 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -3153,6 +3153,7 @@ retry_root_backup:
+ if (IS_ERR(fs_info->fs_root)) {
+ err = PTR_ERR(fs_info->fs_root);
+ btrfs_warn(fs_info, "failed to read fs tree: %d", err);
++ fs_info->fs_root = NULL;
+ goto fail_qgroup;
+ }
+
+@@ -4468,7 +4469,6 @@ void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans,
+ wake_up(&fs_info->transaction_wait);
+
+ btrfs_destroy_delayed_inodes(fs_info);
+- btrfs_assert_delayed_root_empty(fs_info);
+
+ btrfs_destroy_marked_extents(fs_info, &cur_trans->dirty_pages,
+ EXTENT_DIRTY);
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 4ea9dd93a545..dec508a28ffa 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -10348,6 +10348,7 @@ static int __btrfs_prealloc_file_range(struct inode *inode, int mode,
+ struct btrfs_root *root = BTRFS_I(inode)->root;
+ struct btrfs_key ins;
+ u64 cur_offset = start;
++ u64 clear_offset = start;
+ u64 i_size;
+ u64 cur_bytes;
+ u64 last_alloc = (u64)-1;
+@@ -10382,6 +10383,15 @@ static int __btrfs_prealloc_file_range(struct inode *inode, int mode,
+ btrfs_end_transaction(trans);
+ break;
+ }
++
++ /*
++ * We've reserved this space, and thus converted it from
++ * ->bytes_may_use to ->bytes_reserved. Any error that happens
++ * from here on out we will only need to clear our reservation
++ * for the remaining unreserved area, so advance our
++ * clear_offset by our extent size.
++ */
++ clear_offset += ins.offset;
+ btrfs_dec_block_group_reservations(fs_info, ins.objectid);
+
+ last_alloc = ins.offset;
+@@ -10462,9 +10472,9 @@ next:
+ if (own_trans)
+ btrfs_end_transaction(trans);
+ }
+- if (cur_offset < end)
+- btrfs_free_reserved_data_space(inode, NULL, cur_offset,
+- end - cur_offset + 1);
++ if (clear_offset < end)
++ btrfs_free_reserved_data_space(inode, NULL, clear_offset,
++ end - clear_offset + 1);
+ return ret;
+ }
+
+diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
+index 0c4ef208b8b9..0f6d53ec78ed 100644
+--- a/fs/btrfs/ordered-data.c
++++ b/fs/btrfs/ordered-data.c
+@@ -712,10 +712,15 @@ int btrfs_wait_ordered_range(struct inode *inode, u64 start, u64 len)
+ }
+ btrfs_start_ordered_extent(inode, ordered, 1);
+ end = ordered->file_offset;
++ /*
++ * If the ordered extent had an error save the error but don't
++ * exit without waiting first for all other ordered extents in
++ * the range to complete.
++ */
+ if (test_bit(BTRFS_ORDERED_IOERR, &ordered->flags))
+ ret = -EIO;
+ btrfs_put_ordered_extent(ordered);
+- if (ret || end == 0 || end == start)
++ if (end == 0 || end == start)
+ break;
+ end--;
+ }
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 708f931c36f1..8e5353bd72cf 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -325,8 +325,10 @@ static int crypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
+ struct extent_crypt_result ecr;
+ int rc = 0;
+
+- BUG_ON(!crypt_stat || !crypt_stat->tfm
+- || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED));
++ if (!crypt_stat || !crypt_stat->tfm
++ || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
++ return -EINVAL;
++
+ if (unlikely(ecryptfs_verbosity > 0)) {
+ ecryptfs_printk(KERN_DEBUG, "Key size [%zd]; key:\n",
+ crypt_stat->key_size);
+diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
+index e74fe84d0886..250cb23ae69f 100644
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -1318,7 +1318,7 @@ parse_tag_1_packet(struct ecryptfs_crypt_stat *crypt_stat,
+ printk(KERN_WARNING "Tag 1 packet contains key larger "
+ "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES\n");
+ rc = -EINVAL;
+- goto out;
++ goto out_free;
+ }
+ memcpy((*new_auth_tok)->session_key.encrypted_key,
+ &data[(*packet_size)], (body_size - (ECRYPTFS_SIG_SIZE + 2)));
+diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
+index 9fdd5bcf4564..aa3ddb48ebac 100644
+--- a/fs/ecryptfs/messaging.c
++++ b/fs/ecryptfs/messaging.c
+@@ -392,6 +392,7 @@ int __init ecryptfs_init_messaging(void)
+ * ecryptfs_message_buf_len),
+ GFP_KERNEL);
+ if (!ecryptfs_msg_ctx_arr) {
++ kfree(ecryptfs_daemon_hash);
+ rc = -ENOMEM;
+ goto out;
+ }
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index e5d6ee61ff48..f9645de9d04c 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -270,6 +270,7 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
+ ext4_group_t ngroups = ext4_get_groups_count(sb);
+ struct ext4_group_desc *desc;
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ struct buffer_head *bh_p;
+
+ if (block_group >= ngroups) {
+ ext4_error(sb, "block_group >= groups_count - block_group = %u,"
+@@ -280,7 +281,14 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
+
+ group_desc = block_group >> EXT4_DESC_PER_BLOCK_BITS(sb);
+ offset = block_group & (EXT4_DESC_PER_BLOCK(sb) - 1);
+- if (!sbi->s_group_desc[group_desc]) {
++ bh_p = sbi_array_rcu_deref(sbi, s_group_desc, group_desc);
++ /*
++ * sbi_array_rcu_deref returns with rcu unlocked, this is ok since
++ * the pointer being dereferenced won't be dereferenced again. By
++ * looking at the usage in add_new_gdb() the value isn't modified,
++ * just the pointer, and so it remains valid.
++ */
++ if (!bh_p) {
+ ext4_error(sb, "Group descriptor not loaded - "
+ "block_group = %u, group_desc = %u, desc = %u",
+ block_group, group_desc, offset);
+@@ -288,10 +296,10 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
+ }
+
+ desc = (struct ext4_group_desc *)(
+- (__u8 *)sbi->s_group_desc[group_desc]->b_data +
++ (__u8 *)bh_p->b_data +
+ offset * EXT4_DESC_SIZE(sb));
+ if (bh)
+- *bh = sbi->s_group_desc[group_desc];
++ *bh = bh_p;
+ return desc;
+ }
+
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 5c0e06645b1e..0a4461ac4225 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1372,7 +1372,7 @@ struct ext4_sb_info {
+ loff_t s_bitmap_maxbytes; /* max bytes for bitmap files */
+ struct buffer_head * s_sbh; /* Buffer containing the super block */
+ struct ext4_super_block *s_es; /* Pointer to the super block in the buffer */
+- struct buffer_head **s_group_desc;
++ struct buffer_head * __rcu *s_group_desc;
+ unsigned int s_mount_opt;
+ unsigned int s_mount_opt2;
+ unsigned int s_mount_flags;
+@@ -1430,7 +1430,7 @@ struct ext4_sb_info {
+ #endif
+
+ /* for buddy allocator */
+- struct ext4_group_info ***s_group_info;
++ struct ext4_group_info ** __rcu *s_group_info;
+ struct inode *s_buddy_cache;
+ spinlock_t s_md_lock;
+ unsigned short *s_mb_offsets;
+@@ -1480,7 +1480,7 @@ struct ext4_sb_info {
+ unsigned int s_extent_max_zeroout_kb;
+
+ unsigned int s_log_groups_per_flex;
+- struct flex_groups *s_flex_groups;
++ struct flex_groups * __rcu *s_flex_groups;
+ ext4_group_t s_flex_groups_allocated;
+
+ /* workqueue for reserved extent conversions (buffered io) */
+@@ -1520,8 +1520,11 @@ struct ext4_sb_info {
+ struct ratelimit_state s_warning_ratelimit_state;
+ struct ratelimit_state s_msg_ratelimit_state;
+
+- /* Barrier between changing inodes' journal flags and writepages ops. */
+- struct percpu_rw_semaphore s_journal_flag_rwsem;
++ /*
++ * Barrier between writepages ops and changing any inode's JOURNAL_DATA
++ * or EXTENTS flag.
++ */
++ struct percpu_rw_semaphore s_writepages_rwsem;
+ struct dax_device *s_daxdev;
+ };
+
+@@ -1541,6 +1544,23 @@ static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino)
+ ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count));
+ }
+
++/*
++ * Returns: sbi->field[index]
++ * Used to access an array element from the following sbi fields which require
++ * rcu protection to avoid dereferencing an invalid pointer due to reassignment
++ * - s_group_desc
++ * - s_group_info
++ * - s_flex_group
++ */
++#define sbi_array_rcu_deref(sbi, field, index) \
++({ \
++ typeof(*((sbi)->field)) _v; \
++ rcu_read_lock(); \
++ _v = ((typeof(_v)*)rcu_dereference((sbi)->field))[index]; \
++ rcu_read_unlock(); \
++ _v; \
++})
++
+ /*
+ * Inode dynamic state flags
+ */
+@@ -2564,6 +2584,7 @@ extern int ext4_generic_delete_entry(handle_t *handle,
+ extern bool ext4_empty_dir(struct inode *inode);
+
+ /* resize.c */
++extern void ext4_kvfree_array_rcu(void *to_free);
+ extern int ext4_group_add(struct super_block *sb,
+ struct ext4_new_group_data *input);
+ extern int ext4_group_extend(struct super_block *sb,
+@@ -2811,13 +2832,13 @@ static inline
+ struct ext4_group_info *ext4_get_group_info(struct super_block *sb,
+ ext4_group_t group)
+ {
+- struct ext4_group_info ***grp_info;
++ struct ext4_group_info **grp_info;
+ long indexv, indexh;
+ BUG_ON(group >= EXT4_SB(sb)->s_groups_count);
+- grp_info = EXT4_SB(sb)->s_group_info;
+ indexv = group >> (EXT4_DESC_PER_BLOCK_BITS(sb));
+ indexh = group & ((EXT4_DESC_PER_BLOCK(sb)) - 1);
+- return grp_info[indexv][indexh];
++ grp_info = sbi_array_rcu_deref(EXT4_SB(sb), s_group_info, indexv);
++ return grp_info[indexh];
+ }
+
+ /*
+@@ -2867,7 +2888,7 @@ static inline void ext4_update_i_disksize(struct inode *inode, loff_t newsize)
+ !inode_is_locked(inode));
+ down_write(&EXT4_I(inode)->i_data_sem);
+ if (newsize > EXT4_I(inode)->i_disksize)
+- EXT4_I(inode)->i_disksize = newsize;
++ WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize);
+ up_write(&EXT4_I(inode)->i_data_sem);
+ }
+
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 091a18a51c99..dafa7e4aaecb 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -330,11 +330,13 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
+
+ percpu_counter_inc(&sbi->s_freeinodes_counter);
+ if (sbi->s_log_groups_per_flex) {
+- ext4_group_t f = ext4_flex_group(sbi, block_group);
++ struct flex_groups *fg;
+
+- atomic_inc(&sbi->s_flex_groups[f].free_inodes);
++ fg = sbi_array_rcu_deref(sbi, s_flex_groups,
++ ext4_flex_group(sbi, block_group));
++ atomic_inc(&fg->free_inodes);
+ if (is_directory)
+- atomic_dec(&sbi->s_flex_groups[f].used_dirs);
++ atomic_dec(&fg->used_dirs);
+ }
+ BUFFER_TRACE(bh2, "call ext4_handle_dirty_metadata");
+ fatal = ext4_handle_dirty_metadata(handle, NULL, bh2);
+@@ -370,12 +372,13 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g,
+ int flex_size, struct orlov_stats *stats)
+ {
+ struct ext4_group_desc *desc;
+- struct flex_groups *flex_group = EXT4_SB(sb)->s_flex_groups;
+
+ if (flex_size > 1) {
+- stats->free_inodes = atomic_read(&flex_group[g].free_inodes);
+- stats->free_clusters = atomic64_read(&flex_group[g].free_clusters);
+- stats->used_dirs = atomic_read(&flex_group[g].used_dirs);
++ struct flex_groups *fg = sbi_array_rcu_deref(EXT4_SB(sb),
++ s_flex_groups, g);
++ stats->free_inodes = atomic_read(&fg->free_inodes);
++ stats->free_clusters = atomic64_read(&fg->free_clusters);
++ stats->used_dirs = atomic_read(&fg->used_dirs);
+ return;
+ }
+
+@@ -1056,7 +1059,8 @@ got:
+ if (sbi->s_log_groups_per_flex) {
+ ext4_group_t f = ext4_flex_group(sbi, group);
+
+- atomic_inc(&sbi->s_flex_groups[f].used_dirs);
++ atomic_inc(&sbi_array_rcu_deref(sbi, s_flex_groups,
++ f)->used_dirs);
+ }
+ }
+ if (ext4_has_group_desc_csum(sb)) {
+@@ -1079,7 +1083,8 @@ got:
+
+ if (sbi->s_log_groups_per_flex) {
+ flex_group = ext4_flex_group(sbi, group);
+- atomic_dec(&sbi->s_flex_groups[flex_group].free_inodes);
++ atomic_dec(&sbi_array_rcu_deref(sbi, s_flex_groups,
++ flex_group)->free_inodes);
+ }
+
+ inode->i_ino = ino + group * EXT4_INODES_PER_GROUP(sb);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 8e535bb34d5f..23b4b1745a39 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -2569,7 +2569,7 @@ update_disksize:
+ * truncate are avoided by checking i_size under i_data_sem.
+ */
+ disksize = ((loff_t)mpd->first_page) << PAGE_SHIFT;
+- if (disksize > EXT4_I(inode)->i_disksize) {
++ if (disksize > READ_ONCE(EXT4_I(inode)->i_disksize)) {
+ int err2;
+ loff_t i_size;
+
+@@ -2730,7 +2730,7 @@ static int ext4_writepages(struct address_space *mapping,
+ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
+ return -EIO;
+
+- percpu_down_read(&sbi->s_journal_flag_rwsem);
++ percpu_down_read(&sbi->s_writepages_rwsem);
+ trace_ext4_writepages(inode, wbc);
+
+ /*
+@@ -2950,7 +2950,7 @@ unplug:
+ out_writepages:
+ trace_ext4_writepages_result(inode, wbc, ret,
+ nr_to_write - wbc->nr_to_write);
+- percpu_up_read(&sbi->s_journal_flag_rwsem);
++ percpu_up_read(&sbi->s_writepages_rwsem);
+ return ret;
+ }
+
+@@ -2965,13 +2965,13 @@ static int ext4_dax_writepages(struct address_space *mapping,
+ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
+ return -EIO;
+
+- percpu_down_read(&sbi->s_journal_flag_rwsem);
++ percpu_down_read(&sbi->s_writepages_rwsem);
+ trace_ext4_writepages(inode, wbc);
+
+ ret = dax_writeback_mapping_range(mapping, inode->i_sb->s_bdev, wbc);
+ trace_ext4_writepages_result(inode, wbc, ret,
+ nr_to_write - wbc->nr_to_write);
+- percpu_up_read(&sbi->s_journal_flag_rwsem);
++ percpu_up_read(&sbi->s_writepages_rwsem);
+ return ret;
+ }
+
+@@ -6207,7 +6207,7 @@ int ext4_change_inode_journal_flag(struct inode *inode, int val)
+ }
+ }
+
+- percpu_down_write(&sbi->s_journal_flag_rwsem);
++ percpu_down_write(&sbi->s_writepages_rwsem);
+ jbd2_journal_lock_updates(journal);
+
+ /*
+@@ -6224,7 +6224,7 @@ int ext4_change_inode_journal_flag(struct inode *inode, int val)
+ err = jbd2_journal_flush(journal);
+ if (err < 0) {
+ jbd2_journal_unlock_updates(journal);
+- percpu_up_write(&sbi->s_journal_flag_rwsem);
++ percpu_up_write(&sbi->s_writepages_rwsem);
+ return err;
+ }
+ ext4_clear_inode_flag(inode, EXT4_INODE_JOURNAL_DATA);
+@@ -6232,7 +6232,7 @@ int ext4_change_inode_journal_flag(struct inode *inode, int val)
+ ext4_set_aops(inode);
+
+ jbd2_journal_unlock_updates(journal);
+- percpu_up_write(&sbi->s_journal_flag_rwsem);
++ percpu_up_write(&sbi->s_writepages_rwsem);
+
+ if (val)
+ up_write(&EXT4_I(inode)->i_mmap_sem);
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index cc229f3357f7..71121fcf9e8c 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -2356,7 +2356,7 @@ int ext4_mb_alloc_groupinfo(struct super_block *sb, ext4_group_t ngroups)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+ unsigned size;
+- struct ext4_group_info ***new_groupinfo;
++ struct ext4_group_info ***old_groupinfo, ***new_groupinfo;
+
+ size = (ngroups + EXT4_DESC_PER_BLOCK(sb) - 1) >>
+ EXT4_DESC_PER_BLOCK_BITS(sb);
+@@ -2369,13 +2369,16 @@ int ext4_mb_alloc_groupinfo(struct super_block *sb, ext4_group_t ngroups)
+ ext4_msg(sb, KERN_ERR, "can't allocate buddy meta group");
+ return -ENOMEM;
+ }
+- if (sbi->s_group_info) {
+- memcpy(new_groupinfo, sbi->s_group_info,
++ rcu_read_lock();
++ old_groupinfo = rcu_dereference(sbi->s_group_info);
++ if (old_groupinfo)
++ memcpy(new_groupinfo, old_groupinfo,
+ sbi->s_group_info_size * sizeof(*sbi->s_group_info));
+- kvfree(sbi->s_group_info);
+- }
+- sbi->s_group_info = new_groupinfo;
++ rcu_read_unlock();
++ rcu_assign_pointer(sbi->s_group_info, new_groupinfo);
+ sbi->s_group_info_size = size / sizeof(*sbi->s_group_info);
++ if (old_groupinfo)
++ ext4_kvfree_array_rcu(old_groupinfo);
+ ext4_debug("allocated s_groupinfo array for %d meta_bg's\n",
+ sbi->s_group_info_size);
+ return 0;
+@@ -2387,6 +2390,7 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
+ {
+ int i;
+ int metalen = 0;
++ int idx = group >> EXT4_DESC_PER_BLOCK_BITS(sb);
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+ struct ext4_group_info **meta_group_info;
+ struct kmem_cache *cachep = get_groupinfo_cache(sb->s_blocksize_bits);
+@@ -2405,12 +2409,12 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
+ "for a buddy group");
+ goto exit_meta_group_info;
+ }
+- sbi->s_group_info[group >> EXT4_DESC_PER_BLOCK_BITS(sb)] =
+- meta_group_info;
++ rcu_read_lock();
++ rcu_dereference(sbi->s_group_info)[idx] = meta_group_info;
++ rcu_read_unlock();
+ }
+
+- meta_group_info =
+- sbi->s_group_info[group >> EXT4_DESC_PER_BLOCK_BITS(sb)];
++ meta_group_info = sbi_array_rcu_deref(sbi, s_group_info, idx);
+ i = group & (EXT4_DESC_PER_BLOCK(sb) - 1);
+
+ meta_group_info[i] = kmem_cache_zalloc(cachep, GFP_NOFS);
+@@ -2458,8 +2462,13 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
+ exit_group_info:
+ /* If a meta_group_info table has been allocated, release it now */
+ if (group % EXT4_DESC_PER_BLOCK(sb) == 0) {
+- kfree(sbi->s_group_info[group >> EXT4_DESC_PER_BLOCK_BITS(sb)]);
+- sbi->s_group_info[group >> EXT4_DESC_PER_BLOCK_BITS(sb)] = NULL;
++ struct ext4_group_info ***group_info;
++
++ rcu_read_lock();
++ group_info = rcu_dereference(sbi->s_group_info);
++ kfree(group_info[idx]);
++ group_info[idx] = NULL;
++ rcu_read_unlock();
+ }
+ exit_meta_group_info:
+ return -ENOMEM;
+@@ -2472,6 +2481,7 @@ static int ext4_mb_init_backend(struct super_block *sb)
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+ int err;
+ struct ext4_group_desc *desc;
++ struct ext4_group_info ***group_info;
+ struct kmem_cache *cachep;
+
+ err = ext4_mb_alloc_groupinfo(sb, ngroups);
+@@ -2506,11 +2516,16 @@ err_freebuddy:
+ while (i-- > 0)
+ kmem_cache_free(cachep, ext4_get_group_info(sb, i));
+ i = sbi->s_group_info_size;
++ rcu_read_lock();
++ group_info = rcu_dereference(sbi->s_group_info);
+ while (i-- > 0)
+- kfree(sbi->s_group_info[i]);
++ kfree(group_info[i]);
++ rcu_read_unlock();
+ iput(sbi->s_buddy_cache);
+ err_freesgi:
+- kvfree(sbi->s_group_info);
++ rcu_read_lock();
++ kvfree(rcu_dereference(sbi->s_group_info));
++ rcu_read_unlock();
+ return -ENOMEM;
+ }
+
+@@ -2699,7 +2714,7 @@ int ext4_mb_release(struct super_block *sb)
+ ext4_group_t ngroups = ext4_get_groups_count(sb);
+ ext4_group_t i;
+ int num_meta_group_infos;
+- struct ext4_group_info *grinfo;
++ struct ext4_group_info *grinfo, ***group_info;
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+ struct kmem_cache *cachep = get_groupinfo_cache(sb->s_blocksize_bits);
+
+@@ -2717,9 +2732,12 @@ int ext4_mb_release(struct super_block *sb)
+ num_meta_group_infos = (ngroups +
+ EXT4_DESC_PER_BLOCK(sb) - 1) >>
+ EXT4_DESC_PER_BLOCK_BITS(sb);
++ rcu_read_lock();
++ group_info = rcu_dereference(sbi->s_group_info);
+ for (i = 0; i < num_meta_group_infos; i++)
+- kfree(sbi->s_group_info[i]);
+- kvfree(sbi->s_group_info);
++ kfree(group_info[i]);
++ kvfree(group_info);
++ rcu_read_unlock();
+ }
+ kfree(sbi->s_mb_offsets);
+ kfree(sbi->s_mb_maxs);
+@@ -3018,7 +3036,8 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
+ ext4_group_t flex_group = ext4_flex_group(sbi,
+ ac->ac_b_ex.fe_group);
+ atomic64_sub(ac->ac_b_ex.fe_len,
+- &sbi->s_flex_groups[flex_group].free_clusters);
++ &sbi_array_rcu_deref(sbi, s_flex_groups,
++ flex_group)->free_clusters);
+ }
+
+ err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh);
+@@ -4912,7 +4931,8 @@ do_more:
+ if (sbi->s_log_groups_per_flex) {
+ ext4_group_t flex_group = ext4_flex_group(sbi, block_group);
+ atomic64_add(count_clusters,
+- &sbi->s_flex_groups[flex_group].free_clusters);
++ &sbi_array_rcu_deref(sbi, s_flex_groups,
++ flex_group)->free_clusters);
+ }
+
+ if (!(flags & EXT4_FREE_BLOCKS_NO_QUOT_UPDATE))
+@@ -5061,7 +5081,8 @@ int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,
+ if (sbi->s_log_groups_per_flex) {
+ ext4_group_t flex_group = ext4_flex_group(sbi, block_group);
+ atomic64_add(clusters_freed,
+- &sbi->s_flex_groups[flex_group].free_clusters);
++ &sbi_array_rcu_deref(sbi, s_flex_groups,
++ flex_group)->free_clusters);
+ }
+
+ ext4_mb_unload_buddy(&e4b);
+diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
+index a98bfca9c463..bec4ad787c7d 100644
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -427,6 +427,7 @@ static int free_ext_block(handle_t *handle, struct inode *inode)
+
+ int ext4_ext_migrate(struct inode *inode)
+ {
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ handle_t *handle;
+ int retval = 0, i;
+ __le32 *i_data;
+@@ -451,6 +452,8 @@ int ext4_ext_migrate(struct inode *inode)
+ */
+ return retval;
+
++ percpu_down_write(&sbi->s_writepages_rwsem);
++
+ /*
+ * Worst case we can touch the allocation bitmaps, a bgd
+ * block, and a block to link in the orphan list. We do need
+@@ -461,7 +464,7 @@ int ext4_ext_migrate(struct inode *inode)
+
+ if (IS_ERR(handle)) {
+ retval = PTR_ERR(handle);
+- return retval;
++ goto out_unlock;
+ }
+ goal = (((inode->i_ino - 1) / EXT4_INODES_PER_GROUP(inode->i_sb)) *
+ EXT4_INODES_PER_GROUP(inode->i_sb)) + 1;
+@@ -472,7 +475,7 @@ int ext4_ext_migrate(struct inode *inode)
+ if (IS_ERR(tmp_inode)) {
+ retval = PTR_ERR(tmp_inode);
+ ext4_journal_stop(handle);
+- return retval;
++ goto out_unlock;
+ }
+ i_size_write(tmp_inode, i_size_read(inode));
+ /*
+@@ -514,7 +517,7 @@ int ext4_ext_migrate(struct inode *inode)
+ */
+ ext4_orphan_del(NULL, tmp_inode);
+ retval = PTR_ERR(handle);
+- goto out;
++ goto out_tmp_inode;
+ }
+
+ ei = EXT4_I(inode);
+@@ -595,10 +598,11 @@ err_out:
+ /* Reset the extent details */
+ ext4_ext_tree_init(handle, tmp_inode);
+ ext4_journal_stop(handle);
+-out:
++out_tmp_inode:
+ unlock_new_inode(tmp_inode);
+ iput(tmp_inode);
+-
++out_unlock:
++ percpu_up_write(&sbi->s_writepages_rwsem);
+ return retval;
+ }
+
+@@ -608,7 +612,8 @@ out:
+ int ext4_ind_migrate(struct inode *inode)
+ {
+ struct ext4_extent_header *eh;
+- struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ struct ext4_super_block *es = sbi->s_es;
+ struct ext4_inode_info *ei = EXT4_I(inode);
+ struct ext4_extent *ex;
+ unsigned int i, len;
+@@ -632,9 +637,13 @@ int ext4_ind_migrate(struct inode *inode)
+ if (test_opt(inode->i_sb, DELALLOC))
+ ext4_alloc_da_blocks(inode);
+
++ percpu_down_write(&sbi->s_writepages_rwsem);
++
+ handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
+- if (IS_ERR(handle))
+- return PTR_ERR(handle);
++ if (IS_ERR(handle)) {
++ ret = PTR_ERR(handle);
++ goto out_unlock;
++ }
+
+ down_write(&EXT4_I(inode)->i_data_sem);
+ ret = ext4_ext_check_inode(inode);
+@@ -669,5 +678,7 @@ int ext4_ind_migrate(struct inode *inode)
+ errout:
+ ext4_journal_stop(handle);
+ up_write(&EXT4_I(inode)->i_data_sem);
++out_unlock:
++ percpu_up_write(&sbi->s_writepages_rwsem);
+ return ret;
+ }
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 4608d0d3b7f9..a8f2e3549bb9 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1431,6 +1431,7 @@ restart:
+ /*
+ * We deal with the read-ahead logic here.
+ */
++ cond_resched();
+ if (ra_ptr >= ra_max) {
+ /* Refill the readahead buffer */
+ ra_ptr = 0;
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 4d5c0fc9d23a..ef552d93708e 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -17,6 +17,33 @@
+
+ #include "ext4_jbd2.h"
+
++struct ext4_rcu_ptr {
++ struct rcu_head rcu;
++ void *ptr;
++};
++
++static void ext4_rcu_ptr_callback(struct rcu_head *head)
++{
++ struct ext4_rcu_ptr *ptr;
++
++ ptr = container_of(head, struct ext4_rcu_ptr, rcu);
++ kvfree(ptr->ptr);
++ kfree(ptr);
++}
++
++void ext4_kvfree_array_rcu(void *to_free)
++{
++ struct ext4_rcu_ptr *ptr = kzalloc(sizeof(*ptr), GFP_KERNEL);
++
++ if (ptr) {
++ ptr->ptr = to_free;
++ call_rcu(&ptr->rcu, ext4_rcu_ptr_callback);
++ return;
++ }
++ synchronize_rcu();
++ kvfree(to_free);
++}
++
+ int ext4_resize_begin(struct super_block *sb)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+@@ -560,8 +587,8 @@ static int setup_new_flex_group_blocks(struct super_block *sb,
+ brelse(gdb);
+ goto out;
+ }
+- memcpy(gdb->b_data, sbi->s_group_desc[j]->b_data,
+- gdb->b_size);
++ memcpy(gdb->b_data, sbi_array_rcu_deref(sbi,
++ s_group_desc, j)->b_data, gdb->b_size);
+ set_buffer_uptodate(gdb);
+
+ err = ext4_handle_dirty_metadata(handle, NULL, gdb);
+@@ -879,13 +906,15 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ }
+ brelse(dind);
+
+- o_group_desc = EXT4_SB(sb)->s_group_desc;
++ rcu_read_lock();
++ o_group_desc = rcu_dereference(EXT4_SB(sb)->s_group_desc);
+ memcpy(n_group_desc, o_group_desc,
+ EXT4_SB(sb)->s_gdb_count * sizeof(struct buffer_head *));
++ rcu_read_unlock();
+ n_group_desc[gdb_num] = gdb_bh;
+- EXT4_SB(sb)->s_group_desc = n_group_desc;
++ rcu_assign_pointer(EXT4_SB(sb)->s_group_desc, n_group_desc);
+ EXT4_SB(sb)->s_gdb_count++;
+- kvfree(o_group_desc);
++ ext4_kvfree_array_rcu(o_group_desc);
+
+ le16_add_cpu(&es->s_reserved_gdt_blocks, -1);
+ err = ext4_handle_dirty_super(handle, sb);
+@@ -929,9 +958,11 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
+ return err;
+ }
+
+- o_group_desc = EXT4_SB(sb)->s_group_desc;
++ rcu_read_lock();
++ o_group_desc = rcu_dereference(EXT4_SB(sb)->s_group_desc);
+ memcpy(n_group_desc, o_group_desc,
+ EXT4_SB(sb)->s_gdb_count * sizeof(struct buffer_head *));
++ rcu_read_unlock();
+ n_group_desc[gdb_num] = gdb_bh;
+
+ BUFFER_TRACE(gdb_bh, "get_write_access");
+@@ -942,9 +973,9 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
+ return err;
+ }
+
+- EXT4_SB(sb)->s_group_desc = n_group_desc;
++ rcu_assign_pointer(EXT4_SB(sb)->s_group_desc, n_group_desc);
+ EXT4_SB(sb)->s_gdb_count++;
+- kvfree(o_group_desc);
++ ext4_kvfree_array_rcu(o_group_desc);
+ return err;
+ }
+
+@@ -1210,7 +1241,8 @@ static int ext4_add_new_descs(handle_t *handle, struct super_block *sb,
+ * use non-sparse filesystems anymore. This is already checked above.
+ */
+ if (gdb_off) {
+- gdb_bh = sbi->s_group_desc[gdb_num];
++ gdb_bh = sbi_array_rcu_deref(sbi, s_group_desc,
++ gdb_num);
+ BUFFER_TRACE(gdb_bh, "get_write_access");
+ err = ext4_journal_get_write_access(handle, gdb_bh);
+
+@@ -1292,7 +1324,7 @@ static int ext4_setup_new_descs(handle_t *handle, struct super_block *sb,
+ /*
+ * get_write_access() has been called on gdb_bh by ext4_add_new_desc().
+ */
+- gdb_bh = sbi->s_group_desc[gdb_num];
++ gdb_bh = sbi_array_rcu_deref(sbi, s_group_desc, gdb_num);
+ /* Update group descriptor block for new group */
+ gdp = (struct ext4_group_desc *)(gdb_bh->b_data +
+ gdb_off * EXT4_DESC_SIZE(sb));
+@@ -1420,11 +1452,14 @@ static void ext4_update_super(struct super_block *sb,
+ percpu_counter_read(&sbi->s_freeclusters_counter));
+ if (ext4_has_feature_flex_bg(sb) && sbi->s_log_groups_per_flex) {
+ ext4_group_t flex_group;
++ struct flex_groups *fg;
++
+ flex_group = ext4_flex_group(sbi, group_data[0].group);
++ fg = sbi_array_rcu_deref(sbi, s_flex_groups, flex_group);
+ atomic64_add(EXT4_NUM_B2C(sbi, free_blocks),
+- &sbi->s_flex_groups[flex_group].free_clusters);
++ &fg->free_clusters);
+ atomic_add(EXT4_INODES_PER_GROUP(sb) * flex_gd->count,
+- &sbi->s_flex_groups[flex_group].free_inodes);
++ &fg->free_inodes);
+ }
+
+ /*
+@@ -1519,7 +1554,8 @@ exit_journal:
+ for (; gdb_num <= gdb_num_end; gdb_num++) {
+ struct buffer_head *gdb_bh;
+
+- gdb_bh = sbi->s_group_desc[gdb_num];
++ gdb_bh = sbi_array_rcu_deref(sbi, s_group_desc,
++ gdb_num);
+ if (old_gdb == gdb_bh->b_blocknr)
+ continue;
+ update_backups(sb, gdb_bh->b_blocknr, gdb_bh->b_data,
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index e080e90178a0..cb797489b2d8 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -969,6 +969,8 @@ static void ext4_put_super(struct super_block *sb)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+ struct ext4_super_block *es = sbi->s_es;
++ struct buffer_head **group_desc;
++ struct flex_groups **flex_groups;
+ int aborted = 0;
+ int i, err;
+
+@@ -999,15 +1001,23 @@ static void ext4_put_super(struct super_block *sb)
+ if (!sb_rdonly(sb))
+ ext4_commit_super(sb, 1);
+
++ rcu_read_lock();
++ group_desc = rcu_dereference(sbi->s_group_desc);
+ for (i = 0; i < sbi->s_gdb_count; i++)
+- brelse(sbi->s_group_desc[i]);
+- kvfree(sbi->s_group_desc);
+- kvfree(sbi->s_flex_groups);
++ brelse(group_desc[i]);
++ kvfree(group_desc);
++ flex_groups = rcu_dereference(sbi->s_flex_groups);
++ if (flex_groups) {
++ for (i = 0; i < sbi->s_flex_groups_allocated; i++)
++ kvfree(flex_groups[i]);
++ kvfree(flex_groups);
++ }
++ rcu_read_unlock();
+ percpu_counter_destroy(&sbi->s_freeclusters_counter);
+ percpu_counter_destroy(&sbi->s_freeinodes_counter);
+ percpu_counter_destroy(&sbi->s_dirs_counter);
+ percpu_counter_destroy(&sbi->s_dirtyclusters_counter);
+- percpu_free_rwsem(&sbi->s_journal_flag_rwsem);
++ percpu_free_rwsem(&sbi->s_writepages_rwsem);
+ #ifdef CONFIG_QUOTA
+ for (i = 0; i < EXT4_MAXQUOTAS; i++)
+ kfree(get_qf_name(sb, sbi, i));
+@@ -2287,8 +2297,8 @@ done:
+ int ext4_alloc_flex_bg_array(struct super_block *sb, ext4_group_t ngroup)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+- struct flex_groups *new_groups;
+- int size;
++ struct flex_groups **old_groups, **new_groups;
++ int size, i;
+
+ if (!sbi->s_log_groups_per_flex)
+ return 0;
+@@ -2297,22 +2307,37 @@ int ext4_alloc_flex_bg_array(struct super_block *sb, ext4_group_t ngroup)
+ if (size <= sbi->s_flex_groups_allocated)
+ return 0;
+
+- size = roundup_pow_of_two(size * sizeof(struct flex_groups));
+- new_groups = kvzalloc(size, GFP_KERNEL);
++ new_groups = kvzalloc(roundup_pow_of_two(size *
++ sizeof(*sbi->s_flex_groups)), GFP_KERNEL);
+ if (!new_groups) {
+- ext4_msg(sb, KERN_ERR, "not enough memory for %d flex groups",
+- size / (int) sizeof(struct flex_groups));
++ ext4_msg(sb, KERN_ERR,
++ "not enough memory for %d flex group pointers", size);
+ return -ENOMEM;
+ }
+-
+- if (sbi->s_flex_groups) {
+- memcpy(new_groups, sbi->s_flex_groups,
+- (sbi->s_flex_groups_allocated *
+- sizeof(struct flex_groups)));
+- kvfree(sbi->s_flex_groups);
++ for (i = sbi->s_flex_groups_allocated; i < size; i++) {
++ new_groups[i] = kvzalloc(roundup_pow_of_two(
++ sizeof(struct flex_groups)),
++ GFP_KERNEL);
++ if (!new_groups[i]) {
++ for (i--; i >= sbi->s_flex_groups_allocated; i--)
++ kvfree(new_groups[i]);
++ kvfree(new_groups);
++ ext4_msg(sb, KERN_ERR,
++ "not enough memory for %d flex groups", size);
++ return -ENOMEM;
++ }
+ }
+- sbi->s_flex_groups = new_groups;
+- sbi->s_flex_groups_allocated = size / sizeof(struct flex_groups);
++ rcu_read_lock();
++ old_groups = rcu_dereference(sbi->s_flex_groups);
++ if (old_groups)
++ memcpy(new_groups, old_groups,
++ (sbi->s_flex_groups_allocated *
++ sizeof(struct flex_groups *)));
++ rcu_read_unlock();
++ rcu_assign_pointer(sbi->s_flex_groups, new_groups);
++ sbi->s_flex_groups_allocated = size;
++ if (old_groups)
++ ext4_kvfree_array_rcu(old_groups);
+ return 0;
+ }
+
+@@ -2320,6 +2345,7 @@ static int ext4_fill_flex_info(struct super_block *sb)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+ struct ext4_group_desc *gdp = NULL;
++ struct flex_groups *fg;
+ ext4_group_t flex_group;
+ int i, err;
+
+@@ -2337,12 +2363,11 @@ static int ext4_fill_flex_info(struct super_block *sb)
+ gdp = ext4_get_group_desc(sb, i, NULL);
+
+ flex_group = ext4_flex_group(sbi, i);
+- atomic_add(ext4_free_inodes_count(sb, gdp),
+- &sbi->s_flex_groups[flex_group].free_inodes);
++ fg = sbi_array_rcu_deref(sbi, s_flex_groups, flex_group);
++ atomic_add(ext4_free_inodes_count(sb, gdp), &fg->free_inodes);
+ atomic64_add(ext4_free_group_clusters(sb, gdp),
+- &sbi->s_flex_groups[flex_group].free_clusters);
+- atomic_add(ext4_used_dirs_count(sb, gdp),
+- &sbi->s_flex_groups[flex_group].used_dirs);
++ &fg->free_clusters);
++ atomic_add(ext4_used_dirs_count(sb, gdp), &fg->used_dirs);
+ }
+
+ return 1;
+@@ -2923,7 +2948,7 @@ static int ext4_feature_set_ok(struct super_block *sb, int readonly)
+ return 0;
+ }
+
+-#if !defined(CONFIG_QUOTA) || !defined(CONFIG_QFMT_V2)
++#if !IS_ENABLED(CONFIG_QUOTA) || !IS_ENABLED(CONFIG_QFMT_V2)
+ if (!readonly && (ext4_has_feature_quota(sb) ||
+ ext4_has_feature_project(sb))) {
+ ext4_msg(sb, KERN_ERR,
+@@ -3548,9 +3573,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ {
+ struct dax_device *dax_dev = fs_dax_get_by_bdev(sb->s_bdev);
+ char *orig_data = kstrdup(data, GFP_KERNEL);
+- struct buffer_head *bh;
++ struct buffer_head *bh, **group_desc;
+ struct ext4_super_block *es = NULL;
+ struct ext4_sb_info *sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
++ struct flex_groups **flex_groups;
+ ext4_fsblk_t block;
+ ext4_fsblk_t sb_block = get_sb_block(&data);
+ ext4_fsblk_t logical_sb_block;
+@@ -4166,9 +4192,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ goto failed_mount;
+ }
+ }
+- sbi->s_group_desc = kvmalloc_array(db_count,
+- sizeof(struct buffer_head *),
+- GFP_KERNEL);
++ rcu_assign_pointer(sbi->s_group_desc,
++ kvmalloc_array(db_count,
++ sizeof(struct buffer_head *),
++ GFP_KERNEL));
+ if (sbi->s_group_desc == NULL) {
+ ext4_msg(sb, KERN_ERR, "not enough memory");
+ ret = -ENOMEM;
+@@ -4184,14 +4211,19 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ }
+
+ for (i = 0; i < db_count; i++) {
++ struct buffer_head *bh;
++
+ block = descriptor_loc(sb, logical_sb_block, i);
+- sbi->s_group_desc[i] = sb_bread_unmovable(sb, block);
+- if (!sbi->s_group_desc[i]) {
++ bh = sb_bread_unmovable(sb, block);
++ if (!bh) {
+ ext4_msg(sb, KERN_ERR,
+ "can't read group descriptor %d", i);
+ db_count = i;
+ goto failed_mount2;
+ }
++ rcu_read_lock();
++ rcu_dereference(sbi->s_group_desc)[i] = bh;
++ rcu_read_unlock();
+ }
+ sbi->s_gdb_count = db_count;
+ if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
+@@ -4463,7 +4495,7 @@ no_journal:
+ err = percpu_counter_init(&sbi->s_dirtyclusters_counter, 0,
+ GFP_KERNEL);
+ if (!err)
+- err = percpu_init_rwsem(&sbi->s_journal_flag_rwsem);
++ err = percpu_init_rwsem(&sbi->s_writepages_rwsem);
+
+ if (err) {
+ ext4_msg(sb, KERN_ERR, "insufficient memory");
+@@ -4551,13 +4583,19 @@ failed_mount7:
+ ext4_unregister_li_request(sb);
+ failed_mount6:
+ ext4_mb_release(sb);
+- if (sbi->s_flex_groups)
+- kvfree(sbi->s_flex_groups);
++ rcu_read_lock();
++ flex_groups = rcu_dereference(sbi->s_flex_groups);
++ if (flex_groups) {
++ for (i = 0; i < sbi->s_flex_groups_allocated; i++)
++ kvfree(flex_groups[i]);
++ kvfree(flex_groups);
++ }
++ rcu_read_unlock();
+ percpu_counter_destroy(&sbi->s_freeclusters_counter);
+ percpu_counter_destroy(&sbi->s_freeinodes_counter);
+ percpu_counter_destroy(&sbi->s_dirs_counter);
+ percpu_counter_destroy(&sbi->s_dirtyclusters_counter);
+- percpu_free_rwsem(&sbi->s_journal_flag_rwsem);
++ percpu_free_rwsem(&sbi->s_writepages_rwsem);
+ failed_mount5:
+ ext4_ext_release(sb);
+ ext4_release_system_zone(sb);
+@@ -4588,9 +4626,12 @@ failed_mount3:
+ if (sbi->s_mmp_tsk)
+ kthread_stop(sbi->s_mmp_tsk);
+ failed_mount2:
++ rcu_read_lock();
++ group_desc = rcu_dereference(sbi->s_group_desc);
+ for (i = 0; i < db_count; i++)
+- brelse(sbi->s_group_desc[i]);
+- kvfree(sbi->s_group_desc);
++ brelse(group_desc[i]);
++ kvfree(group_desc);
++ rcu_read_unlock();
+ failed_mount:
+ if (sbi->s_chksum_driver)
+ crypto_free_shash(sbi->s_chksum_driver);
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 97ffe12a2262..04ffef9cea8c 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -831,8 +831,6 @@ do_get_write_access(handle_t *handle, struct journal_head *jh,
+ char *frozen_buffer = NULL;
+ unsigned long start_lock, time_lock;
+
+- if (is_handle_aborted(handle))
+- return -EROFS;
+ journal = transaction->t_journal;
+
+ jbd_debug(5, "journal_head %p, force_copy %d\n", jh, force_copy);
+@@ -1084,6 +1082,9 @@ int jbd2_journal_get_write_access(handle_t *handle, struct buffer_head *bh)
+ struct journal_head *jh;
+ int rc;
+
++ if (is_handle_aborted(handle))
++ return -EROFS;
++
+ if (jbd2_write_access_granted(handle, bh, false))
+ return 0;
+
+@@ -1221,6 +1222,9 @@ int jbd2_journal_get_undo_access(handle_t *handle, struct buffer_head *bh)
+ struct journal_head *jh;
+ char *committed_data = NULL;
+
++ if (is_handle_aborted(handle))
++ return -EROFS;
++
+ if (jbd2_write_access_granted(handle, bh, true))
+ return 0;
+
+diff --git a/include/linux/intel-svm.h b/include/linux/intel-svm.h
+index 99bc5b3ae26e..733eaf95e207 100644
+--- a/include/linux/intel-svm.h
++++ b/include/linux/intel-svm.h
+@@ -130,7 +130,7 @@ static inline int intel_svm_unbind_mm(struct device *dev, int pasid)
+ BUG();
+ }
+
+-static int intel_svm_is_pasid_valid(struct device *dev, int pasid)
++static inline int intel_svm_is_pasid_valid(struct device *dev, int pasid)
+ {
+ return -EINVAL;
+ }
+diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
+index 8301f1df0682..092445543258 100644
+--- a/include/linux/irqdomain.h
++++ b/include/linux/irqdomain.h
+@@ -188,7 +188,7 @@ enum {
+ IRQ_DOMAIN_FLAG_HIERARCHY = (1 << 0),
+
+ /* Irq domain name was allocated in __irq_domain_add() */
+- IRQ_DOMAIN_NAME_ALLOCATED = (1 << 6),
++ IRQ_DOMAIN_NAME_ALLOCATED = (1 << 1),
+
+ /* Irq domain is an IPI domain with virq per cpu */
+ IRQ_DOMAIN_FLAG_IPI_PER_CPU = (1 << 2),
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index aff09d0b3545..75a916d7ab2a 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -1236,6 +1236,7 @@ struct pci_bits {
+ };
+
+ extern int pci_test_config_bits(struct pci_dev *pdev, const struct pci_bits *bits);
++extern void ata_pci_shutdown_one(struct pci_dev *pdev);
+ extern void ata_pci_remove_one(struct pci_dev *pdev);
+
+ #ifdef CONFIG_PM
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index 76db046f09ab..248a137112e8 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -225,6 +225,8 @@ struct tty_port_client_operations {
+ void (*write_wakeup)(struct tty_port *port);
+ };
+
++extern const struct tty_port_client_operations tty_port_default_client_ops;
++
+ struct tty_port {
+ struct tty_bufhead buf; /* Locked internally */
+ struct tty_struct *tty; /* Back pointer */
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index a1be64c9940f..22c1f579afe3 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -69,4 +69,7 @@
+ /* Hub needs extra delay after resetting its port. */
+ #define USB_QUIRK_HUB_SLOW_RESET BIT(14)
+
++/* device has blacklisted endpoints */
++#define USB_QUIRK_ENDPOINT_BLACKLIST BIT(15)
++
+ #endif /* __LINUX_USB_QUIRKS_H */
+diff --git a/include/scsi/iscsi_proto.h b/include/scsi/iscsi_proto.h
+index f0a01a54bd15..df156f1d50b2 100644
+--- a/include/scsi/iscsi_proto.h
++++ b/include/scsi/iscsi_proto.h
+@@ -638,7 +638,6 @@ struct iscsi_reject {
+ #define ISCSI_REASON_BOOKMARK_INVALID 9
+ #define ISCSI_REASON_BOOKMARK_NO_RESOURCES 10
+ #define ISCSI_REASON_NEGOTIATION_RESET 11
+-#define ISCSI_REASON_WAITING_FOR_LOGOUT 12
+
+ /* Max. number of Key=Value pairs in a text message */
+ #define MAX_KEY_VALUE_PAIRS 8192
+diff --git a/include/sound/rawmidi.h b/include/sound/rawmidi.h
+index 6665cb29e1a2..c2a71fd8dfaf 100644
+--- a/include/sound/rawmidi.h
++++ b/include/sound/rawmidi.h
+@@ -92,9 +92,9 @@ struct snd_rawmidi_substream {
+ struct list_head list; /* list of all substream for given stream */
+ int stream; /* direction */
+ int number; /* substream number */
+- unsigned int opened: 1, /* open flag */
+- append: 1, /* append flag (merge more streams) */
+- active_sensing: 1; /* send active sensing when close */
++ bool opened; /* open flag */
++ bool append; /* append flag (merge more streams) */
++ bool active_sensing; /* send active sensing when close */
+ int use_count; /* use counter (for output) */
+ size_t bytes;
+ struct snd_rawmidi *rmidi;
+diff --git a/ipc/sem.c b/ipc/sem.c
+index 26f8e37fcdcb..2bf535dd0b93 100644
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -2345,11 +2345,9 @@ void exit_sem(struct task_struct *tsk)
+ ipc_assert_locked_object(&sma->sem_perm);
+ list_del(&un->list_id);
+
+- /* we are the last process using this ulp, acquiring ulp->lock
+- * isn't required. Besides that, we are also protected against
+- * IPC_RMID as we hold sma->sem_perm lock now
+- */
++ spin_lock(&ulp->lock);
+ list_del_rcu(&un->list_proc);
++ spin_unlock(&ulp->lock);
+
+ /* perform adjustments registered in un */
+ for (i = 0; i < sma->sem_nsems; i++) {
+diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
+index 86477f3894e5..66e13aace241 100644
+--- a/kernel/bpf/offload.c
++++ b/kernel/bpf/offload.c
+@@ -289,7 +289,7 @@ int bpf_prog_offload_info_fill(struct bpf_prog_info *info,
+
+ ulen = info->jited_prog_len;
+ info->jited_prog_len = aux->offload->jited_len;
+- if (info->jited_prog_len & ulen) {
++ if (info->jited_prog_len && ulen) {
+ uinsns = u64_to_user_ptr(info->jited_prog_insns);
+ ulen = min_t(u32, info->jited_prog_len, ulen);
+ if (copy_to_user(uinsns, aux->offload->jited_image, ulen)) {
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index ea57f3d397fe..3f4618510d05 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -126,8 +126,6 @@ static inline void unregister_handler_proc(unsigned int irq,
+
+ extern bool irq_can_set_affinity_usr(unsigned int irq);
+
+-extern int irq_select_affinity_usr(unsigned int irq);
+-
+ extern void irq_set_thread_affinity(struct irq_desc *desc);
+
+ extern int irq_do_set_affinity(struct irq_data *data,
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 23bcfa71077f..eb69b805f908 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -441,23 +441,9 @@ int irq_setup_affinity(struct irq_desc *desc)
+ {
+ return irq_select_affinity(irq_desc_get_irq(desc));
+ }
+-#endif
++#endif /* CONFIG_AUTO_IRQ_AFFINITY */
++#endif /* CONFIG_SMP */
+
+-/*
+- * Called when a bogus affinity is set via /proc/irq
+- */
+-int irq_select_affinity_usr(unsigned int irq)
+-{
+- struct irq_desc *desc = irq_to_desc(irq);
+- unsigned long flags;
+- int ret;
+-
+- raw_spin_lock_irqsave(&desc->lock, flags);
+- ret = irq_setup_affinity(desc);
+- raw_spin_unlock_irqrestore(&desc->lock, flags);
+- return ret;
+-}
+-#endif
+
+ /**
+ * irq_set_vcpu_affinity - Set vcpu affinity for the interrupt
+diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
+index da9addb8d655..e8c655b7a430 100644
+--- a/kernel/irq/proc.c
++++ b/kernel/irq/proc.c
+@@ -115,6 +115,28 @@ static int irq_affinity_list_proc_show(struct seq_file *m, void *v)
+ return show_irq_affinity(AFFINITY_LIST, m);
+ }
+
++#ifndef CONFIG_AUTO_IRQ_AFFINITY
++static inline int irq_select_affinity_usr(unsigned int irq)
++{
++ /*
++ * If the interrupt is started up already then this fails. The
++ * interrupt is assigned to an online CPU already. There is no
++ * point to move it around randomly. Tell user space that the
++ * selected mask is bogus.
++ *
++ * If not then any change to the affinity is pointless because the
++ * startup code invokes irq_setup_affinity() which will select
++ * a online CPU anyway.
++ */
++ return -EINVAL;
++}
++#else
++/* ALPHA magic affinity auto selector. Keep it for historical reasons. */
++static inline int irq_select_affinity_usr(unsigned int irq)
++{
++ return irq_select_affinity(irq);
++}
++#endif
+
+ static ssize_t write_irq_affinity(int type, struct file *file,
+ const char __user *buffer, size_t count, loff_t *pos)
+diff --git a/lib/stackdepot.c b/lib/stackdepot.c
+index e513459a5601..3376a3291186 100644
+--- a/lib/stackdepot.c
++++ b/lib/stackdepot.c
+@@ -92,15 +92,19 @@ static bool init_stack_slab(void **prealloc)
+ return true;
+ if (stack_slabs[depot_index] == NULL) {
+ stack_slabs[depot_index] = *prealloc;
++ *prealloc = NULL;
+ } else {
+- stack_slabs[depot_index + 1] = *prealloc;
++ /* If this is the last depot slab, do not touch the next one. */
++ if (depot_index + 1 < STACK_ALLOC_MAX_SLABS) {
++ stack_slabs[depot_index + 1] = *prealloc;
++ *prealloc = NULL;
++ }
+ /*
+ * This smp_store_release pairs with smp_load_acquire() from
+ * |next_slab_inited| above and in depot_save_stack().
+ */
+ smp_store_release(&next_slab_inited, 1);
+ }
+- *prealloc = NULL;
+ return true;
+ }
+
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 3a3d109dce21..0f7ff204083e 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -419,8 +419,10 @@ int memcg_expand_shrinker_maps(int new_id)
+ if (mem_cgroup_is_root(memcg))
+ continue;
+ ret = memcg_expand_one_shrinker_map(memcg, size, old_size);
+- if (ret)
++ if (ret) {
++ mem_cgroup_iter_break(NULL, memcg);
+ goto unlock;
++ }
+ }
+ unlock:
+ if (!ret)
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index b37610c0eac6..bc2ecd43251a 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2446,10 +2446,13 @@ out:
+ /*
+ * Scan types proportional to swappiness and
+ * their relative recent reclaim efficiency.
+- * Make sure we don't miss the last page
+- * because of a round-off error.
++ * Make sure we don't miss the last page on
++ * the offlined memory cgroups because of a
++ * round-off error.
+ */
+- scan = DIV64_U64_ROUND_UP(scan * fraction[file],
++ scan = mem_cgroup_online(memcg) ?
++ div64_u64(scan * fraction[file], denominator) :
++ DIV64_U64_ROUND_UP(scan * fraction[file],
+ denominator);
+ break;
+ case SCAN_FILE:
+diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
+index 1ad4017f9b73..0c2dc6def86d 100644
+--- a/net/netfilter/xt_hashlimit.c
++++ b/net/netfilter/xt_hashlimit.c
+@@ -845,6 +845,8 @@ hashlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ return hashlimit_mt_common(skb, par, hinfo, &info->cfg, 3);
+ }
+
++#define HASHLIMIT_MAX_SIZE 1048576
++
+ static int hashlimit_mt_check_common(const struct xt_mtchk_param *par,
+ struct xt_hashlimit_htable **hinfo,
+ struct hashlimit_cfg3 *cfg,
+@@ -855,6 +857,14 @@ static int hashlimit_mt_check_common(const struct xt_mtchk_param *par,
+
+ if (cfg->gc_interval == 0 || cfg->expire == 0)
+ return -EINVAL;
++ if (cfg->size > HASHLIMIT_MAX_SIZE) {
++ cfg->size = HASHLIMIT_MAX_SIZE;
++ pr_info_ratelimited("size too large, truncated to %u\n", cfg->size);
++ }
++ if (cfg->max > HASHLIMIT_MAX_SIZE) {
++ cfg->max = HASHLIMIT_MAX_SIZE;
++ pr_info_ratelimited("max too large, truncated to %u\n", cfg->max);
++ }
+ if (par->family == NFPROTO_IPV4) {
+ if (cfg->srcmask > 32 || cfg->dstmask > 32)
+ return -EINVAL;
+diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
+index 17fdfce1625f..964c4e45de11 100644
+--- a/net/rxrpc/call_object.c
++++ b/net/rxrpc/call_object.c
+@@ -647,11 +647,11 @@ void rxrpc_put_call(struct rxrpc_call *call, enum rxrpc_call_trace op)
+ }
+
+ /*
+- * Final call destruction under RCU.
++ * Final call destruction - but must be done in process context.
+ */
+-static void rxrpc_rcu_destroy_call(struct rcu_head *rcu)
++static void rxrpc_destroy_call(struct work_struct *work)
+ {
+- struct rxrpc_call *call = container_of(rcu, struct rxrpc_call, rcu);
++ struct rxrpc_call *call = container_of(work, struct rxrpc_call, processor);
+ struct rxrpc_net *rxnet = call->rxnet;
+
+ rxrpc_put_connection(call->conn);
+@@ -663,6 +663,22 @@ static void rxrpc_rcu_destroy_call(struct rcu_head *rcu)
+ wake_up_var(&rxnet->nr_calls);
+ }
+
++/*
++ * Final call destruction under RCU.
++ */
++static void rxrpc_rcu_destroy_call(struct rcu_head *rcu)
++{
++ struct rxrpc_call *call = container_of(rcu, struct rxrpc_call, rcu);
++
++ if (in_softirq()) {
++ INIT_WORK(&call->processor, rxrpc_destroy_call);
++ if (!rxrpc_queue_work(&call->processor))
++ BUG();
++ } else {
++ rxrpc_destroy_call(&call->processor);
++ }
++}
++
+ /*
+ * clean up a call
+ */
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index bd3d68e0489d..aaf9c419c3dd 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -563,7 +563,7 @@ static int update_timestamp_of_queue(struct snd_seq_event *event,
+ event->queue = queue;
+ event->flags &= ~SNDRV_SEQ_TIME_STAMP_MASK;
+ if (real_time) {
+- event->time.time = snd_seq_timer_get_cur_time(q->timer);
++ event->time.time = snd_seq_timer_get_cur_time(q->timer, true);
+ event->flags |= SNDRV_SEQ_TIME_STAMP_REAL;
+ } else {
+ event->time.tick = snd_seq_timer_get_cur_tick(q->timer);
+@@ -1642,7 +1642,7 @@ static int snd_seq_ioctl_get_queue_status(struct snd_seq_client *client,
+ tmr = queue->timer;
+ status->events = queue->tickq->cells + queue->timeq->cells;
+
+- status->time = snd_seq_timer_get_cur_time(tmr);
++ status->time = snd_seq_timer_get_cur_time(tmr, true);
+ status->tick = snd_seq_timer_get_cur_tick(tmr);
+
+ status->running = tmr->running;
+diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
+index 3b3ac96f1f5f..28b4dd45b8d1 100644
+--- a/sound/core/seq/seq_queue.c
++++ b/sound/core/seq/seq_queue.c
+@@ -251,6 +251,8 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop)
+ {
+ unsigned long flags;
+ struct snd_seq_event_cell *cell;
++ snd_seq_tick_time_t cur_tick;
++ snd_seq_real_time_t cur_time;
+
+ if (q == NULL)
+ return;
+@@ -267,17 +269,18 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop)
+
+ __again:
+ /* Process tick queue... */
++ cur_tick = snd_seq_timer_get_cur_tick(q->timer);
+ for (;;) {
+- cell = snd_seq_prioq_cell_out(q->tickq,
+- &q->timer->tick.cur_tick);
++ cell = snd_seq_prioq_cell_out(q->tickq, &cur_tick);
+ if (!cell)
+ break;
+ snd_seq_dispatch_event(cell, atomic, hop);
+ }
+
+ /* Process time queue... */
++ cur_time = snd_seq_timer_get_cur_time(q->timer, false);
+ for (;;) {
+- cell = snd_seq_prioq_cell_out(q->timeq, &q->timer->cur_time);
++ cell = snd_seq_prioq_cell_out(q->timeq, &cur_time);
+ if (!cell)
+ break;
+ snd_seq_dispatch_event(cell, atomic, hop);
+@@ -405,6 +408,7 @@ int snd_seq_queue_check_access(int queueid, int client)
+ int snd_seq_queue_set_owner(int queueid, int client, int locked)
+ {
+ struct snd_seq_queue *q = queueptr(queueid);
++ unsigned long flags;
+
+ if (q == NULL)
+ return -EINVAL;
+@@ -414,8 +418,10 @@ int snd_seq_queue_set_owner(int queueid, int client, int locked)
+ return -EPERM;
+ }
+
++ spin_lock_irqsave(&q->owner_lock, flags);
+ q->locked = locked ? 1 : 0;
+ q->owner = client;
++ spin_unlock_irqrestore(&q->owner_lock, flags);
+ queue_access_unlock(q);
+ queuefree(q);
+
+@@ -552,15 +558,17 @@ void snd_seq_queue_client_termination(int client)
+ unsigned long flags;
+ int i;
+ struct snd_seq_queue *q;
++ bool matched;
+
+ for (i = 0; i < SNDRV_SEQ_MAX_QUEUES; i++) {
+ if ((q = queueptr(i)) == NULL)
+ continue;
+ spin_lock_irqsave(&q->owner_lock, flags);
+- if (q->owner == client)
++ matched = (q->owner == client);
++ if (matched)
+ q->klocked = 1;
+ spin_unlock_irqrestore(&q->owner_lock, flags);
+- if (q->owner == client) {
++ if (matched) {
+ if (q->timer->running)
+ snd_seq_timer_stop(q->timer);
+ snd_seq_timer_reset(q->timer);
+@@ -752,6 +760,8 @@ void snd_seq_info_queues_read(struct snd_info_entry *entry,
+ int i, bpm;
+ struct snd_seq_queue *q;
+ struct snd_seq_timer *tmr;
++ bool locked;
++ int owner;
+
+ for (i = 0; i < SNDRV_SEQ_MAX_QUEUES; i++) {
+ if ((q = queueptr(i)) == NULL)
+@@ -763,9 +773,14 @@ void snd_seq_info_queues_read(struct snd_info_entry *entry,
+ else
+ bpm = 0;
+
++ spin_lock_irq(&q->owner_lock);
++ locked = q->locked;
++ owner = q->owner;
++ spin_unlock_irq(&q->owner_lock);
++
+ snd_iprintf(buffer, "queue %d: [%s]\n", q->queue, q->name);
+- snd_iprintf(buffer, "owned by client : %d\n", q->owner);
+- snd_iprintf(buffer, "lock status : %s\n", q->locked ? "Locked" : "Free");
++ snd_iprintf(buffer, "owned by client : %d\n", owner);
++ snd_iprintf(buffer, "lock status : %s\n", locked ? "Locked" : "Free");
+ snd_iprintf(buffer, "queued time events : %d\n", snd_seq_prioq_avail(q->timeq));
+ snd_iprintf(buffer, "queued tick events : %d\n", snd_seq_prioq_avail(q->tickq));
+ snd_iprintf(buffer, "timer state : %s\n", tmr->running ? "Running" : "Stopped");
+diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
+index aed8e1c1f02f..3da44a4f9257 100644
+--- a/sound/core/seq/seq_timer.c
++++ b/sound/core/seq/seq_timer.c
+@@ -437,14 +437,15 @@ int snd_seq_timer_continue(struct snd_seq_timer *tmr)
+ }
+
+ /* return current 'real' time. use timeofday() to get better granularity. */
+-snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr)
++snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr,
++ bool adjust_ktime)
+ {
+ snd_seq_real_time_t cur_time;
+ unsigned long flags;
+
+ spin_lock_irqsave(&tmr->lock, flags);
+ cur_time = tmr->cur_time;
+- if (tmr->running) {
++ if (adjust_ktime && tmr->running) {
+ struct timespec64 tm;
+
+ ktime_get_ts64(&tm);
+@@ -461,7 +462,13 @@ snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr)
+ high PPQ values) */
+ snd_seq_tick_time_t snd_seq_timer_get_cur_tick(struct snd_seq_timer *tmr)
+ {
+- return tmr->tick.cur_tick;
++ snd_seq_tick_time_t cur_tick;
++ unsigned long flags;
++
++ spin_lock_irqsave(&tmr->lock, flags);
++ cur_tick = tmr->tick.cur_tick;
++ spin_unlock_irqrestore(&tmr->lock, flags);
++ return cur_tick;
+ }
+
+
+diff --git a/sound/core/seq/seq_timer.h b/sound/core/seq/seq_timer.h
+index 62f390671096..44f52f5963db 100644
+--- a/sound/core/seq/seq_timer.h
++++ b/sound/core/seq/seq_timer.h
+@@ -135,7 +135,8 @@ int snd_seq_timer_set_tempo_ppq(struct snd_seq_timer *tmr, int tempo, int ppq);
+ int snd_seq_timer_set_position_tick(struct snd_seq_timer *tmr, snd_seq_tick_time_t position);
+ int snd_seq_timer_set_position_time(struct snd_seq_timer *tmr, snd_seq_real_time_t position);
+ int snd_seq_timer_set_skew(struct snd_seq_timer *tmr, unsigned int skew, unsigned int base);
+-snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr);
++snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr,
++ bool adjust_ktime);
+ snd_seq_tick_time_t snd_seq_timer_get_cur_tick(struct snd_seq_timer *tmr);
+
+ extern int seq_default_timer_class;
+diff --git a/sound/hda/hdmi_chmap.c b/sound/hda/hdmi_chmap.c
+index f21633cd9b38..acbe61b8db7b 100644
+--- a/sound/hda/hdmi_chmap.c
++++ b/sound/hda/hdmi_chmap.c
+@@ -249,7 +249,7 @@ void snd_hdac_print_channel_allocation(int spk_alloc, char *buf, int buflen)
+
+ for (i = 0, j = 0; i < ARRAY_SIZE(cea_speaker_allocation_names); i++) {
+ if (spk_alloc & (1 << i))
+- j += snprintf(buf + j, buflen - j, " %s",
++ j += scnprintf(buf + j, buflen - j, " %s",
+ cea_speaker_allocation_names[i]);
+ }
+ buf[j] = '\0'; /* necessary when j == 0 */
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 82b0dc9f528f..f3a6b1d869d8 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -4019,7 +4019,7 @@ void snd_print_pcm_bits(int pcm, char *buf, int buflen)
+
+ for (i = 0, j = 0; i < ARRAY_SIZE(bits); i++)
+ if (pcm & (AC_SUPPCM_BITS_8 << i))
+- j += snprintf(buf + j, buflen - j, " %d", bits[i]);
++ j += scnprintf(buf + j, buflen - j, " %d", bits[i]);
+
+ buf[j] = '\0'; /* necessary when j == 0 */
+ }
+diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
+index ba7fe9b6655c..864cc8c9ada0 100644
+--- a/sound/pci/hda/hda_eld.c
++++ b/sound/pci/hda/hda_eld.c
+@@ -373,7 +373,7 @@ static void hdmi_print_pcm_rates(int pcm, char *buf, int buflen)
+
+ for (i = 0, j = 0; i < ARRAY_SIZE(alsa_rates); i++)
+ if (pcm & (1 << i))
+- j += snprintf(buf + j, buflen - j, " %d",
++ j += scnprintf(buf + j, buflen - j, " %d",
+ alsa_rates[i]);
+
+ buf[j] = '\0'; /* necessary when j == 0 */
+diff --git a/sound/pci/hda/hda_sysfs.c b/sound/pci/hda/hda_sysfs.c
+index 6ec79c58d48d..6535155e992d 100644
+--- a/sound/pci/hda/hda_sysfs.c
++++ b/sound/pci/hda/hda_sysfs.c
+@@ -221,7 +221,7 @@ static ssize_t init_verbs_show(struct device *dev,
+ int i, len = 0;
+ mutex_lock(&codec->user_mutex);
+ snd_array_for_each(&codec->init_verbs, i, v) {
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "0x%02x 0x%03x 0x%04x\n",
+ v->nid, v->verb, v->param);
+ }
+@@ -271,7 +271,7 @@ static ssize_t hints_show(struct device *dev,
+ int i, len = 0;
+ mutex_lock(&codec->user_mutex);
+ snd_array_for_each(&codec->hints, i, hint) {
+- len += snprintf(buf + len, PAGE_SIZE - len,
++ len += scnprintf(buf + len, PAGE_SIZE - len,
+ "%s = %s\n", hint->key, hint->val);
+ }
+ mutex_unlock(&codec->user_mutex);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index a8a47e1596dd..94fffc0675a7 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2442,7 +2442,9 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
++ SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+ SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+diff --git a/sound/soc/sunxi/sun8i-codec.c b/sound/soc/sunxi/sun8i-codec.c
+index a3db6a68dfe6..8bcdeb281770 100644
+--- a/sound/soc/sunxi/sun8i-codec.c
++++ b/sound/soc/sunxi/sun8i-codec.c
+@@ -89,6 +89,7 @@
+
+ #define SUN8I_SYS_SR_CTRL_AIF1_FS_MASK GENMASK(15, 12)
+ #define SUN8I_SYS_SR_CTRL_AIF2_FS_MASK GENMASK(11, 8)
++#define SUN8I_AIF1CLK_CTRL_AIF1_DATA_FMT_MASK GENMASK(3, 2)
+ #define SUN8I_AIF1CLK_CTRL_AIF1_WORD_SIZ_MASK GENMASK(5, 4)
+ #define SUN8I_AIF1CLK_CTRL_AIF1_LRCK_DIV_MASK GENMASK(8, 6)
+ #define SUN8I_AIF1CLK_CTRL_AIF1_BCLK_DIV_MASK GENMASK(12, 9)
+@@ -250,7 +251,7 @@ static int sun8i_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ return -EINVAL;
+ }
+ regmap_update_bits(scodec->regmap, SUN8I_AIF1CLK_CTRL,
+- BIT(SUN8I_AIF1CLK_CTRL_AIF1_DATA_FMT),
++ SUN8I_AIF1CLK_CTRL_AIF1_DATA_FMT_MASK,
+ value << SUN8I_AIF1CLK_CTRL_AIF1_DATA_FMT);
+
+ return 0;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-03-05 16:23 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-03-05 16:23 UTC (permalink / raw
To: gentoo-commits
commit: 836621b120225f053a815f0660ead626b1a5ebb4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Mar 5 16:23:07 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Mar 5 16:23:07 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=836621b1
Linux patch 4.19.108
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1107_linux-4.19.108.patch | 2999 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3003 insertions(+)
diff --git a/0000_README b/0000_README
index 7d48aad..65259b7 100644
--- a/0000_README
+++ b/0000_README
@@ -467,6 +467,10 @@ Patch: 1106_linux-4.19.107.patch
From: https://www.kernel.org
Desc: Linux 4.19.107
+Patch: 1107_linux-4.19.108.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.108
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1107_linux-4.19.108.patch b/1107_linux-4.19.108.patch
new file mode 100644
index 0000000..f4ed81e
--- /dev/null
+++ b/1107_linux-4.19.108.patch
@@ -0,0 +1,2999 @@
+diff --git a/Documentation/networking/nf_flowtable.txt b/Documentation/networking/nf_flowtable.txt
+index 54128c50d508..b01c91893481 100644
+--- a/Documentation/networking/nf_flowtable.txt
++++ b/Documentation/networking/nf_flowtable.txt
+@@ -76,7 +76,7 @@ flowtable and add one rule to your forward chain.
+
+ table inet x {
+ flowtable f {
+- hook ingress priority 0 devices = { eth0, eth1 };
++ hook ingress priority 0; devices = { eth0, eth1 };
+ }
+ chain y {
+ type filter hook forward priority 0; policy accept;
+diff --git a/Makefile b/Makefile
+index 69e2527a6968..313f0c8dd66f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 107
++SUBLEVEL = 108
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/stihxxx-b2120.dtsi b/arch/arm/boot/dts/stihxxx-b2120.dtsi
+index 4dedfcb0fcb3..ac42d3c6bda0 100644
+--- a/arch/arm/boot/dts/stihxxx-b2120.dtsi
++++ b/arch/arm/boot/dts/stihxxx-b2120.dtsi
+@@ -45,7 +45,7 @@
+ /* DAC */
+ format = "i2s";
+ mclk-fs = <256>;
+- frame-inversion = <1>;
++ frame-inversion;
+ cpu {
+ sound-dai = <&sti_uni_player2>;
+ };
+diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
+index 0bef238d2c0c..0d5f9c8f5bda 100644
+--- a/arch/mips/kernel/vpe.c
++++ b/arch/mips/kernel/vpe.c
+@@ -134,7 +134,7 @@ void release_vpe(struct vpe *v)
+ {
+ list_del(&v->list);
+ if (v->load_addr)
+- release_progmem(v);
++ release_progmem(v->load_addr);
+ kfree(v);
+ }
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 0219693bf08e..3f0565e1a7a8 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1298,6 +1298,47 @@ static void shrink_ple_window(struct kvm_vcpu *vcpu)
+ control->pause_filter_count, old);
+ }
+
++/*
++ * The default MMIO mask is a single bit (excluding the present bit),
++ * which could conflict with the memory encryption bit. Check for
++ * memory encryption support and override the default MMIO mask if
++ * memory encryption is enabled.
++ */
++static __init void svm_adjust_mmio_mask(void)
++{
++ unsigned int enc_bit, mask_bit;
++ u64 msr, mask;
++
++ /* If there is no memory encryption support, use existing mask */
++ if (cpuid_eax(0x80000000) < 0x8000001f)
++ return;
++
++ /* If memory encryption is not enabled, use existing mask */
++ rdmsrl(MSR_K8_SYSCFG, msr);
++ if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT))
++ return;
++
++ enc_bit = cpuid_ebx(0x8000001f) & 0x3f;
++ mask_bit = boot_cpu_data.x86_phys_bits;
++
++ /* Increment the mask bit if it is the same as the encryption bit */
++ if (enc_bit == mask_bit)
++ mask_bit++;
++
++ /*
++ * If the mask bit location is below 52, then some bits above the
++ * physical addressing limit will always be reserved, so use the
++ * rsvd_bits() function to generate the mask. This mask, along with
++ * the present bit, will be used to generate a page fault with
++ * PFER.RSV = 1.
++ *
++ * If the mask bit location is 52 (or above), then clear the mask.
++ */
++ mask = (mask_bit < 52) ? rsvd_bits(mask_bit, 51) | PT_PRESENT_MASK : 0;
++
++ kvm_mmu_set_mmio_spte_mask(mask, PT_WRITABLE_MASK | PT_USER_MASK);
++}
++
+ static __init int svm_hardware_setup(void)
+ {
+ int cpu;
+@@ -1352,6 +1393,8 @@ static __init int svm_hardware_setup(void)
+ }
+ }
+
++ svm_adjust_mmio_mask();
++
+ for_each_possible_cpu(cpu) {
+ r = svm_cpu_init(cpu);
+ if (r)
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 9c48484dbe23..a81d7d9ce9d6 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -13724,6 +13724,7 @@ static int vmx_check_intercept_io(struct kvm_vcpu *vcpu,
+ else
+ intercept = nested_vmx_check_io_bitmaps(vcpu, port, size);
+
++ /* FIXME: produce nested vmexit and return X86EMUL_INTERCEPTED. */
+ return intercept ? X86EMUL_UNHANDLEABLE : X86EMUL_CONTINUE;
+ }
+
+@@ -13753,6 +13754,20 @@ static int vmx_check_intercept(struct kvm_vcpu *vcpu,
+ case x86_intercept_outs:
+ return vmx_check_intercept_io(vcpu, info);
+
++ case x86_intercept_lgdt:
++ case x86_intercept_lidt:
++ case x86_intercept_lldt:
++ case x86_intercept_ltr:
++ case x86_intercept_sgdt:
++ case x86_intercept_sidt:
++ case x86_intercept_sldt:
++ case x86_intercept_str:
++ if (!nested_cpu_has2(vmcs12, SECONDARY_EXEC_DESC))
++ return X86EMUL_CONTINUE;
++
++ /* FIXME: produce nested vmexit and return X86EMUL_INTERCEPTED. */
++ break;
++
+ /* TODO: check more intercepts... */
+ default:
+ break;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index ade694f94a49..2cb379e261c0 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -8693,12 +8693,6 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu)
+
+ void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
+ {
+- vcpu->arch.apf.msr_val = 0;
+-
+- vcpu_load(vcpu);
+- kvm_mmu_unload(vcpu);
+- vcpu_put(vcpu);
+-
+ kvm_arch_vcpu_free(vcpu);
+ }
+
+diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
+index 95600309ce42..23cde3d8e8fb 100644
+--- a/drivers/acpi/acpi_watchdog.c
++++ b/drivers/acpi/acpi_watchdog.c
+@@ -129,12 +129,11 @@ void __init acpi_watchdog_init(void)
+ gas = &entries[i].register_region;
+
+ res.start = gas->address;
++ res.end = res.start + ACPI_ACCESS_BYTE_WIDTH(gas->access_width) - 1;
+ if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
+ res.flags = IORESOURCE_MEM;
+- res.end = res.start + ALIGN(gas->access_width, 4) - 1;
+ } else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
+ res.flags = IORESOURCE_IO;
+- res.end = res.start + gas->access_width - 1;
+ } else {
+ pr_warn("Unsupported address space: %u\n",
+ gas->space_id);
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index af44db2dfb68..fec679433f72 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -735,10 +735,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+ msg = ssif_info->curr_msg;
+ if (msg) {
++ if (data) {
++ if (len > IPMI_MAX_MSG_LENGTH)
++ len = IPMI_MAX_MSG_LENGTH;
++ memcpy(msg->rsp, data, len);
++ } else {
++ len = 0;
++ }
+ msg->rsp_size = len;
+- if (msg->rsp_size > IPMI_MAX_MSG_LENGTH)
+- msg->rsp_size = IPMI_MAX_MSG_LENGTH;
+- memcpy(msg->rsp, data, msg->rsp_size);
+ ssif_info->curr_msg = NULL;
+ }
+
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 8122d0e0d4c4..06a981c72246 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -600,7 +600,6 @@ struct devfreq *devfreq_add_device(struct device *dev,
+ {
+ struct devfreq *devfreq;
+ struct devfreq_governor *governor;
+- static atomic_t devfreq_no = ATOMIC_INIT(-1);
+ int err = 0;
+
+ if (!dev || !profile || !governor_name) {
+@@ -661,8 +660,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
+ }
+ devfreq->max_freq = devfreq->scaling_max_freq;
+
+- dev_set_name(&devfreq->dev, "devfreq%d",
+- atomic_inc_return(&devfreq_no));
++ dev_set_name(&devfreq->dev, "%s", dev_name(dev));
+ err = device_register(&devfreq->dev);
+ if (err) {
+ mutex_unlock(&devfreq->lock);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.h
+index bb5a47a45790..5c76a815396d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.h
+@@ -97,6 +97,7 @@ struct amdgpu_gmc {
+ uint32_t srbm_soft_reset;
+ bool prt_warning;
+ uint64_t stolen_size;
++ uint32_t sdpif_register;
+ /* apertures */
+ u64 shared_aperture_start;
+ u64 shared_aperture_end;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+index ede27dab675f..8b25940c1367 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+@@ -992,6 +992,19 @@ static void gmc_v9_0_init_golden_registers(struct amdgpu_device *adev)
+ }
+ }
+
++/**
++ * gmc_v9_0_restore_registers - restores regs
++ *
++ * @adev: amdgpu_device pointer
++ *
++ * This restores register values, saved at suspend.
++ */
++static void gmc_v9_0_restore_registers(struct amdgpu_device *adev)
++{
++ if (adev->asic_type == CHIP_RAVEN)
++ WREG32(mmDCHUBBUB_SDPIF_MMIO_CNTRL_0, adev->gmc.sdpif_register);
++}
++
+ /**
+ * gmc_v9_0_gart_enable - gart enable
+ *
+@@ -1080,6 +1093,20 @@ static int gmc_v9_0_hw_init(void *handle)
+ return r;
+ }
+
++/**
++ * gmc_v9_0_save_registers - saves regs
++ *
++ * @adev: amdgpu_device pointer
++ *
++ * This saves potential register values that should be
++ * restored upon resume
++ */
++static void gmc_v9_0_save_registers(struct amdgpu_device *adev)
++{
++ if (adev->asic_type == CHIP_RAVEN)
++ adev->gmc.sdpif_register = RREG32(mmDCHUBBUB_SDPIF_MMIO_CNTRL_0);
++}
++
+ /**
+ * gmc_v9_0_gart_disable - gart disable
+ *
+@@ -1112,9 +1139,16 @@ static int gmc_v9_0_hw_fini(void *handle)
+
+ static int gmc_v9_0_suspend(void *handle)
+ {
++ int r;
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+- return gmc_v9_0_hw_fini(adev);
++ r = gmc_v9_0_hw_fini(adev);
++ if (r)
++ return r;
++
++ gmc_v9_0_save_registers(adev);
++
++ return 0;
+ }
+
+ static int gmc_v9_0_resume(void *handle)
+@@ -1122,6 +1156,7 @@ static int gmc_v9_0_resume(void *handle)
+ int r;
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
++ gmc_v9_0_restore_registers(adev);
+ r = gmc_v9_0_hw_init(adev);
+ if (r)
+ return r;
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_12_0_offset.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_12_0_offset.h
+index b6f74bf4af02..27bb8c1ab858 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_12_0_offset.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_12_0_offset.h
+@@ -7376,6 +7376,8 @@
+ #define mmCRTC4_CRTC_DRR_CONTROL 0x0f3e
+ #define mmCRTC4_CRTC_DRR_CONTROL_BASE_IDX 2
+
++#define mmDCHUBBUB_SDPIF_MMIO_CNTRL_0 0x395d
++#define mmDCHUBBUB_SDPIF_MMIO_CNTRL_0_BASE_IDX 2
+
+ // addressBlock: dce_dc_fmt4_dispdec
+ // base address: 0x2000
+diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
+index 51ed99a37803..6053f5a93f58 100644
+--- a/drivers/gpu/drm/i915/gvt/dmabuf.c
++++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
+@@ -95,12 +95,12 @@ static void dmabuf_gem_object_free(struct kref *kref)
+ dmabuf_obj = container_of(pos,
+ struct intel_vgpu_dmabuf_obj, list);
+ if (dmabuf_obj == obj) {
++ list_del(pos);
+ intel_gvt_hypervisor_put_vfio_device(vgpu);
+ idr_remove(&vgpu->object_idr,
+ dmabuf_obj->dmabuf_id);
+ kfree(dmabuf_obj->info);
+ kfree(dmabuf_obj);
+- list_del(pos);
+ break;
+ }
+ }
+diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
+index c628be05fbfe..69bba88906cd 100644
+--- a/drivers/gpu/drm/i915/gvt/vgpu.c
++++ b/drivers/gpu/drm/i915/gvt/vgpu.c
+@@ -556,9 +556,9 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
+
+ intel_vgpu_reset_mmio(vgpu, dmlr);
+ populate_pvinfo_page(vgpu);
+- intel_vgpu_reset_display(vgpu);
+
+ if (dmlr) {
++ intel_vgpu_reset_display(vgpu);
+ intel_vgpu_reset_cfg_space(vgpu);
+ /* only reset the failsafe mode when dmlr reset */
+ vgpu->failsafe = false;
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index dbfd2c006f74..6f81de85fb86 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -492,6 +492,14 @@ static int msm_drm_init(struct device *dev, struct drm_driver *drv)
+ if (ret)
+ goto err_msm_uninit;
+
++ if (!dev->dma_parms) {
++ dev->dma_parms = devm_kzalloc(dev, sizeof(*dev->dma_parms),
++ GFP_KERNEL);
++ if (!dev->dma_parms)
++ return -ENOMEM;
++ }
++ dma_set_max_seg_size(dev, DMA_BIT_MASK(32));
++
+ msm_gem_shrinker_init(ddev);
+
+ switch (get_mdp_ver(pdev)) {
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index 3cd7229b6e54..895f49b565ee 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -734,7 +734,7 @@ static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ if (data->has_sp) {
+ input2 = input_allocate_device();
+ if (!input2) {
+- input_free_device(input2);
++ ret = -ENOMEM;
+ goto exit;
+ }
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index e723156057a6..2c85d075daee 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1566,7 +1566,9 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
+
+ rsize = ((report->size - 1) >> 3) + 1;
+
+- if (rsize > HID_MAX_BUFFER_SIZE)
++ if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
++ rsize = HID_MAX_BUFFER_SIZE - 1;
++ else if (rsize > HID_MAX_BUFFER_SIZE)
+ rsize = HID_MAX_BUFFER_SIZE;
+
+ if (csize < rsize) {
+diff --git a/drivers/hid/hid-ite.c b/drivers/hid/hid-ite.c
+index 2ce1eb0c9212..f2e23f81601e 100644
+--- a/drivers/hid/hid-ite.c
++++ b/drivers/hid/hid-ite.c
+@@ -44,8 +44,9 @@ static const struct hid_device_id ite_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE8595) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_258A, USB_DEVICE_ID_258A_6A88) },
+ /* ITE8595 USB kbd ctlr, with Synaptics touchpad connected to it. */
+- { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS,
+- USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012) },
++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_SYNAPTICS,
++ USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, ite_devices);
+diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
+index da000195b79a..c34ef95d7cef 100644
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -954,9 +954,9 @@ void hiddev_disconnect(struct hid_device *hid)
+ hiddev->exist = 0;
+
+ if (hiddev->open) {
+- mutex_unlock(&hiddev->existancelock);
+ hid_hw_close(hiddev->hid);
+ wake_up_interruptible(&hiddev->wait);
++ mutex_unlock(&hiddev->existancelock);
+ } else {
+ mutex_unlock(&hiddev->existancelock);
+ kfree(hiddev);
+diff --git a/drivers/i2c/busses/i2c-altera.c b/drivers/i2c/busses/i2c-altera.c
+index f5e1941e65b5..a1cdcfc74acf 100644
+--- a/drivers/i2c/busses/i2c-altera.c
++++ b/drivers/i2c/busses/i2c-altera.c
+@@ -182,7 +182,7 @@ static void altr_i2c_init(struct altr_i2c_dev *idev)
+ /* SCL Low Time */
+ writel(t_low, idev->base + ALTR_I2C_SCL_LOW);
+ /* SDA Hold Time, 300ns */
+- writel(div_u64(300 * clk_mhz, 1000), idev->base + ALTR_I2C_SDA_HOLD);
++ writel(3 * clk_mhz / 10, idev->base + ALTR_I2C_SDA_HOLD);
+
+ /* Mask all master interrupt bits */
+ altr_i2c_int_enable(idev, ALTR_I2C_ALL_IRQ, false);
+diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c
+index 30132c3957cd..41ca9ff7b5da 100644
+--- a/drivers/i2c/busses/i2c-jz4780.c
++++ b/drivers/i2c/busses/i2c-jz4780.c
+@@ -82,25 +82,6 @@
+ #define JZ4780_I2C_STA_TFNF BIT(1)
+ #define JZ4780_I2C_STA_ACT BIT(0)
+
+-static const char * const jz4780_i2c_abrt_src[] = {
+- "ABRT_7B_ADDR_NOACK",
+- "ABRT_10ADDR1_NOACK",
+- "ABRT_10ADDR2_NOACK",
+- "ABRT_XDATA_NOACK",
+- "ABRT_GCALL_NOACK",
+- "ABRT_GCALL_READ",
+- "ABRT_HS_ACKD",
+- "SBYTE_ACKDET",
+- "ABRT_HS_NORSTRT",
+- "SBYTE_NORSTRT",
+- "ABRT_10B_RD_NORSTRT",
+- "ABRT_MASTER_DIS",
+- "ARB_LOST",
+- "SLVFLUSH_TXFIFO",
+- "SLV_ARBLOST",
+- "SLVRD_INTX",
+-};
+-
+ #define JZ4780_I2C_INTST_IGC BIT(11)
+ #define JZ4780_I2C_INTST_ISTT BIT(10)
+ #define JZ4780_I2C_INTST_ISTP BIT(9)
+@@ -538,21 +519,8 @@ done:
+
+ static void jz4780_i2c_txabrt(struct jz4780_i2c *i2c, int src)
+ {
+- int i;
+-
+- dev_err(&i2c->adap.dev, "txabrt: 0x%08x\n", src);
+- dev_err(&i2c->adap.dev, "device addr=%x\n",
+- jz4780_i2c_readw(i2c, JZ4780_I2C_TAR));
+- dev_err(&i2c->adap.dev, "send cmd count:%d %d\n",
+- i2c->cmd, i2c->cmd_buf[i2c->cmd]);
+- dev_err(&i2c->adap.dev, "receive data count:%d %d\n",
+- i2c->cmd, i2c->data_buf[i2c->cmd]);
+-
+- for (i = 0; i < 16; i++) {
+- if (src & BIT(i))
+- dev_dbg(&i2c->adap.dev, "I2C TXABRT[%d]=%s\n",
+- i, jz4780_i2c_abrt_src[i]);
+- }
++ dev_dbg(&i2c->adap.dev, "txabrt: 0x%08x, cmd: %d, send: %d, recv: %d\n",
++ src, i2c->cmd, i2c->cmd_buf[i2c->cmd], i2c->data_buf[i2c->cmd]);
+ }
+
+ static inline int jz4780_i2c_xfer_read(struct jz4780_i2c *i2c,
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index bf7b69449b43..f9b73336a39e 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -208,7 +208,7 @@ static struct its_collection *dev_event_to_col(struct its_device *its_dev,
+
+ static struct its_collection *valid_col(struct its_collection *col)
+ {
+- if (WARN_ON_ONCE(col->target_address & GENMASK_ULL(0, 15)))
++ if (WARN_ON_ONCE(col->target_address & GENMASK_ULL(15, 0)))
+ return NULL;
+
+ return col;
+diff --git a/drivers/macintosh/therm_windtunnel.c b/drivers/macintosh/therm_windtunnel.c
+index 8c744578122a..a0d87ed9da69 100644
+--- a/drivers/macintosh/therm_windtunnel.c
++++ b/drivers/macintosh/therm_windtunnel.c
+@@ -300,9 +300,11 @@ static int control_loop(void *dummy)
+ /* i2c probing and setup */
+ /************************************************************************/
+
+-static int
+-do_attach( struct i2c_adapter *adapter )
++static void do_attach(struct i2c_adapter *adapter)
+ {
++ struct i2c_board_info info = { };
++ struct device_node *np;
++
+ /* scan 0x48-0x4f (DS1775) and 0x2c-2x2f (ADM1030) */
+ static const unsigned short scan_ds1775[] = {
+ 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
+@@ -313,25 +315,24 @@ do_attach( struct i2c_adapter *adapter )
+ I2C_CLIENT_END
+ };
+
+- if( strncmp(adapter->name, "uni-n", 5) )
+- return 0;
+-
+- if( !x.running ) {
+- struct i2c_board_info info;
++ if (x.running || strncmp(adapter->name, "uni-n", 5))
++ return;
+
+- memset(&info, 0, sizeof(struct i2c_board_info));
+- strlcpy(info.type, "therm_ds1775", I2C_NAME_SIZE);
++ np = of_find_compatible_node(adapter->dev.of_node, NULL, "MAC,ds1775");
++ if (np) {
++ of_node_put(np);
++ } else {
++ strlcpy(info.type, "MAC,ds1775", I2C_NAME_SIZE);
+ i2c_new_probed_device(adapter, &info, scan_ds1775, NULL);
++ }
+
+- strlcpy(info.type, "therm_adm1030", I2C_NAME_SIZE);
++ np = of_find_compatible_node(adapter->dev.of_node, NULL, "MAC,adm1030");
++ if (np) {
++ of_node_put(np);
++ } else {
++ strlcpy(info.type, "MAC,adm1030", I2C_NAME_SIZE);
+ i2c_new_probed_device(adapter, &info, scan_adm1030, NULL);
+-
+- if( x.thermostat && x.fan ) {
+- x.running = 1;
+- x.poll_task = kthread_run(control_loop, NULL, "g4fand");
+- }
+ }
+- return 0;
+ }
+
+ static int
+@@ -404,8 +405,8 @@ out:
+ enum chip { ds1775, adm1030 };
+
+ static const struct i2c_device_id therm_windtunnel_id[] = {
+- { "therm_ds1775", ds1775 },
+- { "therm_adm1030", adm1030 },
++ { "MAC,ds1775", ds1775 },
++ { "MAC,adm1030", adm1030 },
+ { }
+ };
+ MODULE_DEVICE_TABLE(i2c, therm_windtunnel_id);
+@@ -414,6 +415,7 @@ static int
+ do_probe(struct i2c_client *cl, const struct i2c_device_id *id)
+ {
+ struct i2c_adapter *adapter = cl->adapter;
++ int ret = 0;
+
+ if( !i2c_check_functionality(adapter, I2C_FUNC_SMBUS_WORD_DATA
+ | I2C_FUNC_SMBUS_WRITE_BYTE) )
+@@ -421,11 +423,19 @@ do_probe(struct i2c_client *cl, const struct i2c_device_id *id)
+
+ switch (id->driver_data) {
+ case adm1030:
+- return attach_fan( cl );
++ ret = attach_fan(cl);
++ break;
+ case ds1775:
+- return attach_thermostat(cl);
++ ret = attach_thermostat(cl);
++ break;
+ }
+- return 0;
++
++ if (!x.running && x.thermostat && x.fan) {
++ x.running = 1;
++ x.poll_task = kthread_run(control_loop, NULL, "g4fand");
++ }
++
++ return ret;
+ }
+
+ static struct i2c_driver g4fan_driver = {
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
+index 92261c946e2a..3afc0e59a2bd 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -201,6 +201,11 @@ static inline void comp_ctxt_release(struct ena_com_admin_queue *queue,
+ static struct ena_comp_ctx *get_comp_ctxt(struct ena_com_admin_queue *queue,
+ u16 command_id, bool capture)
+ {
++ if (unlikely(!queue->comp_ctx)) {
++ pr_err("Completion context is NULL\n");
++ return NULL;
++ }
++
+ if (unlikely(command_id >= queue->q_depth)) {
+ pr_err("command id is larger than the queue size. cmd_id: %u queue size %d\n",
+ command_id, queue->q_depth);
+@@ -842,6 +847,24 @@ static int ena_com_get_feature(struct ena_com_dev *ena_dev,
+ 0);
+ }
+
++static void ena_com_hash_key_fill_default_key(struct ena_com_dev *ena_dev)
++{
++ struct ena_admin_feature_rss_flow_hash_control *hash_key =
++ (ena_dev->rss).hash_key;
++
++ netdev_rss_key_fill(&hash_key->key, sizeof(hash_key->key));
++ /* The key is stored in the device in u32 array
++ * as well as the API requires the key to be passed in this
++ * format. Thus the size of our array should be divided by 4
++ */
++ hash_key->keys_num = sizeof(hash_key->key) / sizeof(u32);
++}
++
++int ena_com_get_current_hash_function(struct ena_com_dev *ena_dev)
++{
++ return ena_dev->rss.hash_func;
++}
++
+ static int ena_com_hash_key_allocate(struct ena_com_dev *ena_dev)
+ {
+ struct ena_rss *rss = &ena_dev->rss;
+@@ -2075,15 +2098,16 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,
+
+ switch (func) {
+ case ENA_ADMIN_TOEPLITZ:
+- if (key_len > sizeof(hash_key->key)) {
+- pr_err("key len (%hu) is bigger than the max supported (%zu)\n",
+- key_len, sizeof(hash_key->key));
+- return -EINVAL;
++ if (key) {
++ if (key_len != sizeof(hash_key->key)) {
++ pr_err("key len (%hu) doesn't equal the supported size (%zu)\n",
++ key_len, sizeof(hash_key->key));
++ return -EINVAL;
++ }
++ memcpy(hash_key->key, key, key_len);
++ rss->hash_init_val = init_val;
++ hash_key->keys_num = key_len >> 2;
+ }
+-
+- memcpy(hash_key->key, key, key_len);
+- rss->hash_init_val = init_val;
+- hash_key->keys_num = key_len >> 2;
+ break;
+ case ENA_ADMIN_CRC32:
+ rss->hash_init_val = init_val;
+@@ -2120,7 +2144,11 @@ int ena_com_get_hash_function(struct ena_com_dev *ena_dev,
+ if (unlikely(rc))
+ return rc;
+
+- rss->hash_func = get_resp.u.flow_hash_func.selected_func;
++ /* ffs() returns 1 in case the lsb is set */
++ rss->hash_func = ffs(get_resp.u.flow_hash_func.selected_func);
++ if (rss->hash_func)
++ rss->hash_func--;
++
+ if (func)
+ *func = rss->hash_func;
+
+@@ -2408,6 +2436,8 @@ int ena_com_rss_init(struct ena_com_dev *ena_dev, u16 indr_tbl_log_size)
+ if (unlikely(rc))
+ goto err_hash_key;
+
++ ena_com_hash_key_fill_default_key(ena_dev);
++
+ rc = ena_com_hash_ctrl_init(ena_dev);
+ if (unlikely(rc))
+ goto err_hash_ctrl;
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.h b/drivers/net/ethernet/amazon/ena/ena_com.h
+index 7b784f8a06a6..7272fb0d858d 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.h
++++ b/drivers/net/ethernet/amazon/ena/ena_com.h
+@@ -42,6 +42,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/types.h>
+ #include <linux/wait.h>
++#include <linux/netdevice.h>
+
+ #include "ena_common_defs.h"
+ #include "ena_admin_defs.h"
+@@ -631,6 +632,14 @@ int ena_com_rss_init(struct ena_com_dev *ena_dev, u16 log_size);
+ */
+ void ena_com_rss_destroy(struct ena_com_dev *ena_dev);
+
++/* ena_com_get_current_hash_function - Get RSS hash function
++ * @ena_dev: ENA communication layer struct
++ *
++ * Return the current hash function.
++ * @return: 0 or one of the ena_admin_hash_functions values.
++ */
++int ena_com_get_current_hash_function(struct ena_com_dev *ena_dev);
++
+ /* ena_com_fill_hash_function - Fill RSS hash function
+ * @ena_dev: ENA communication layer struct
+ * @func: The hash function (Toeplitz or crc)
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index eb9e07fa427e..66f992510e0e 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -649,6 +649,28 @@ static u32 ena_get_rxfh_key_size(struct net_device *netdev)
+ return ENA_HASH_KEY_SIZE;
+ }
+
++static int ena_indirection_table_get(struct ena_adapter *adapter, u32 *indir)
++{
++ struct ena_com_dev *ena_dev = adapter->ena_dev;
++ int i, rc;
++
++ if (!indir)
++ return 0;
++
++ rc = ena_com_indirect_table_get(ena_dev, indir);
++ if (rc)
++ return rc;
++
++ /* Our internal representation of the indices is: even indices
++ * for Tx and uneven indices for Rx. We need to convert the Rx
++ * indices to be consecutive
++ */
++ for (i = 0; i < ENA_RX_RSS_TABLE_SIZE; i++)
++ indir[i] = ENA_IO_RXQ_IDX_TO_COMBINED_IDX(indir[i]);
++
++ return rc;
++}
++
+ static int ena_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,
+ u8 *hfunc)
+ {
+@@ -657,11 +679,25 @@ static int ena_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,
+ u8 func;
+ int rc;
+
+- rc = ena_com_indirect_table_get(adapter->ena_dev, indir);
++ rc = ena_indirection_table_get(adapter, indir);
+ if (rc)
+ return rc;
+
++ /* We call this function in order to check if the device
++ * supports getting/setting the hash function.
++ */
+ rc = ena_com_get_hash_function(adapter->ena_dev, &ena_func, key);
++
++ if (rc) {
++ if (rc == -EOPNOTSUPP) {
++ key = NULL;
++ hfunc = NULL;
++ rc = 0;
++ }
++
++ return rc;
++ }
++
+ if (rc)
+ return rc;
+
+@@ -670,7 +706,7 @@ static int ena_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,
+ func = ETH_RSS_HASH_TOP;
+ break;
+ case ENA_ADMIN_CRC32:
+- func = ETH_RSS_HASH_XOR;
++ func = ETH_RSS_HASH_CRC32;
+ break;
+ default:
+ netif_err(adapter, drv, netdev,
+@@ -713,10 +749,13 @@ static int ena_set_rxfh(struct net_device *netdev, const u32 *indir,
+ }
+
+ switch (hfunc) {
++ case ETH_RSS_HASH_NO_CHANGE:
++ func = ena_com_get_current_hash_function(ena_dev);
++ break;
+ case ETH_RSS_HASH_TOP:
+ func = ENA_ADMIN_TOEPLITZ;
+ break;
+- case ETH_RSS_HASH_XOR:
++ case ETH_RSS_HASH_CRC32:
+ func = ENA_ADMIN_CRC32;
+ break;
+ default:
+@@ -817,6 +856,7 @@ static const struct ethtool_ops ena_ethtool_ops = {
+ .get_channels = ena_get_channels,
+ .get_tunable = ena_get_tunable,
+ .set_tunable = ena_set_tunable,
++ .get_ts_info = ethtool_op_get_ts_info,
+ };
+
+ void ena_set_ethtool_ops(struct net_device *netdev)
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 9afb19ebba58..8736718b1735 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2847,8 +2847,8 @@ static void check_for_missing_keep_alive(struct ena_adapter *adapter)
+ if (adapter->keep_alive_timeout == ENA_HW_HINTS_NO_TIMEOUT)
+ return;
+
+- keep_alive_expired = round_jiffies(adapter->last_keep_alive_jiffies +
+- adapter->keep_alive_timeout);
++ keep_alive_expired = adapter->last_keep_alive_jiffies +
++ adapter->keep_alive_timeout;
+ if (unlikely(time_is_before_jiffies(keep_alive_expired))) {
+ netif_err(adapter, drv, adapter->netdev,
+ "Keep alive watchdog timeout.\n");
+@@ -2950,7 +2950,7 @@ static void ena_timer_service(struct timer_list *t)
+ }
+
+ /* Reset the timer */
+- mod_timer(&adapter->timer_service, jiffies + HZ);
++ mod_timer(&adapter->timer_service, round_jiffies(jiffies + HZ));
+ }
+
+ static int ena_calc_io_queue_num(struct pci_dev *pdev,
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+index 7c7ae56c52cf..f4783effe5c0 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -113,6 +113,8 @@
+
+ #define ENA_IO_TXQ_IDX(q) (2 * (q))
+ #define ENA_IO_RXQ_IDX(q) (2 * (q) + 1)
++#define ENA_IO_TXQ_IDX_TO_COMBINED_IDX(q) ((q) / 2)
++#define ENA_IO_RXQ_IDX_TO_COMBINED_IDX(q) (((q) - 1) / 2)
+
+ #define ENA_MGMNT_IRQ_IDX 0
+ #define ENA_IO_IRQ_FIRST_IDX 1
+diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+index 50dd6bf176d0..3a489b2b99c9 100644
+--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+@@ -2034,7 +2034,7 @@ static int xgene_enet_probe(struct platform_device *pdev)
+ int ret;
+
+ ndev = alloc_etherdev_mqs(sizeof(struct xgene_enet_pdata),
+- XGENE_NUM_RX_RING, XGENE_NUM_TX_RING);
++ XGENE_NUM_TX_RING, XGENE_NUM_RX_RING);
+ if (!ndev)
+ return -ENOMEM;
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index 8cc34b0bedc3..15dcfb6704e5 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -399,8 +399,10 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
+ dx_buff->len,
+ DMA_TO_DEVICE);
+
+- if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa)))
++ if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa))) {
++ ret = 0;
+ goto exit;
++ }
+
+ first = dx_buff;
+ dx_buff->len_pkt = skb->len;
+@@ -530,10 +532,6 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
+ if (likely(frags)) {
+ err = self->aq_hw_ops->hw_ring_tx_xmit(self->aq_hw,
+ ring, frags);
+- if (err >= 0) {
+- ++ring->stats.tx.packets;
+- ring->stats.tx.bytes += skb->len;
+- }
+ } else {
+ err = NETDEV_TX_BUSY;
+ }
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index b3c7994d73eb..b03e5fd4327e 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -162,9 +162,12 @@ bool aq_ring_tx_clean(struct aq_ring_s *self)
+ }
+ }
+
+- if (unlikely(buff->is_eop))
+- dev_kfree_skb_any(buff->skb);
++ if (unlikely(buff->is_eop)) {
++ ++self->stats.rx.packets;
++ self->stats.tx.bytes += buff->skb->len;
+
++ dev_kfree_skb_any(buff->skb);
++ }
+ buff->pa = 0U;
+ buff->eop_index = 0xffffU;
+ self->sw_head = aq_ring_next_dx(self, self->sw_head);
+diff --git a/drivers/net/ethernet/mscc/ocelot_board.c b/drivers/net/ethernet/mscc/ocelot_board.c
+index 3cdf63e35b53..4054cf9db818 100644
+--- a/drivers/net/ethernet/mscc/ocelot_board.c
++++ b/drivers/net/ethernet/mscc/ocelot_board.c
+@@ -105,6 +105,14 @@ static irqreturn_t ocelot_xtr_irq_handler(int irq, void *arg)
+ if (err != 4)
+ break;
+
++ /* At this point the IFH was read correctly, so it is safe to
++ * presume that there is no error. The err needs to be reset
++ * otherwise a frame could come in CPU queue between the while
++ * condition and the check for error later on. And in that case
++ * the new frame is just removed and not processed.
++ */
++ err = 0;
++
+ ocelot_parse_ifh(ifh, &info);
+
+ dev = ocelot->ports[info.port]->dev;
+diff --git a/drivers/net/ethernet/qlogic/qede/qede.h b/drivers/net/ethernet/qlogic/qede/qede.h
+index d242a5724069..dc3be8a4acf4 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede.h
++++ b/drivers/net/ethernet/qlogic/qede/qede.h
+@@ -162,6 +162,8 @@ struct qede_rdma_dev {
+ struct list_head entry;
+ struct list_head rdma_event_list;
+ struct workqueue_struct *rdma_wq;
++ struct kref refcnt;
++ struct completion event_comp;
+ };
+
+ struct qede_ptp;
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_rdma.c b/drivers/net/ethernet/qlogic/qede/qede_rdma.c
+index 1900bf7e67d1..cd12fb919ad5 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_rdma.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_rdma.c
+@@ -57,6 +57,9 @@ static void _qede_rdma_dev_add(struct qede_dev *edev)
+ static int qede_rdma_create_wq(struct qede_dev *edev)
+ {
+ INIT_LIST_HEAD(&edev->rdma_info.rdma_event_list);
++ kref_init(&edev->rdma_info.refcnt);
++ init_completion(&edev->rdma_info.event_comp);
++
+ edev->rdma_info.rdma_wq = create_singlethread_workqueue("rdma_wq");
+ if (!edev->rdma_info.rdma_wq) {
+ DP_NOTICE(edev, "qedr: Could not create workqueue\n");
+@@ -81,8 +84,23 @@ static void qede_rdma_cleanup_event(struct qede_dev *edev)
+ }
+ }
+
++static void qede_rdma_complete_event(struct kref *ref)
++{
++ struct qede_rdma_dev *rdma_dev =
++ container_of(ref, struct qede_rdma_dev, refcnt);
++
++ /* no more events will be added after this */
++ complete(&rdma_dev->event_comp);
++}
++
+ static void qede_rdma_destroy_wq(struct qede_dev *edev)
+ {
++ /* Avoid race with add_event flow, make sure it finishes before
++ * we start accessing the list and cleaning up the work
++ */
++ kref_put(&edev->rdma_info.refcnt, qede_rdma_complete_event);
++ wait_for_completion(&edev->rdma_info.event_comp);
++
+ qede_rdma_cleanup_event(edev);
+ destroy_workqueue(edev->rdma_info.rdma_wq);
+ }
+@@ -287,15 +305,24 @@ static void qede_rdma_add_event(struct qede_dev *edev,
+ if (!edev->rdma_info.qedr_dev)
+ return;
+
++ /* We don't want the cleanup flow to start while we're allocating and
++ * scheduling the work
++ */
++ if (!kref_get_unless_zero(&edev->rdma_info.refcnt))
++ return; /* already being destroyed */
++
+ event_node = qede_rdma_get_free_event_node(edev);
+ if (!event_node)
+- return;
++ goto out;
+
+ event_node->event = event;
+ event_node->ptr = edev;
+
+ INIT_WORK(&event_node->work, qede_rdma_handle_event);
+ queue_work(edev->rdma_info.rdma_wq, &event_node->work);
++
++out:
++ kref_put(&edev->rdma_info.refcnt, qede_rdma_complete_event);
+ }
+
+ void qede_rdma_dev_event_open(struct qede_dev *edev)
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index dbfd3a0c97d3..77a9a753d979 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -110,7 +110,7 @@ static struct netvsc_device *alloc_net_device(void)
+
+ init_waitqueue_head(&net_device->wait_drain);
+ net_device->destroy = false;
+- net_device->tx_disable = false;
++ net_device->tx_disable = true;
+
+ net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
+ net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 7ab576d8b622..bdb55db4523b 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -984,6 +984,7 @@ static int netvsc_attach(struct net_device *ndev,
+ }
+
+ /* In any case device is now ready */
++ nvdev->tx_disable = false;
+ netif_device_attach(ndev);
+
+ /* Note: enable and attach happen when sub-channels setup */
+@@ -2336,6 +2337,8 @@ static int netvsc_probe(struct hv_device *dev,
+ else
+ net->max_mtu = ETH_DATA_LEN;
+
++ nvdev->tx_disable = false;
++
+ ret = register_netdevice(net);
+ if (ret != 0) {
+ pr_err("Unable to register netdev.\n");
+diff --git a/drivers/net/phy/mdio-bcm-iproc.c b/drivers/net/phy/mdio-bcm-iproc.c
+index 46fe1ae919a3..51ce3ea17fb3 100644
+--- a/drivers/net/phy/mdio-bcm-iproc.c
++++ b/drivers/net/phy/mdio-bcm-iproc.c
+@@ -188,6 +188,23 @@ static int iproc_mdio_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++#ifdef CONFIG_PM_SLEEP
++int iproc_mdio_resume(struct device *dev)
++{
++ struct platform_device *pdev = to_platform_device(dev);
++ struct iproc_mdio_priv *priv = platform_get_drvdata(pdev);
++
++ /* restore the mii clock configuration */
++ iproc_mdio_config_clk(priv->base);
++
++ return 0;
++}
++
++static const struct dev_pm_ops iproc_mdio_pm_ops = {
++ .resume = iproc_mdio_resume
++};
++#endif /* CONFIG_PM_SLEEP */
++
+ static const struct of_device_id iproc_mdio_of_match[] = {
+ { .compatible = "brcm,iproc-mdio", },
+ { /* sentinel */ },
+@@ -198,6 +215,9 @@ static struct platform_driver iproc_mdio_driver = {
+ .driver = {
+ .name = "iproc-mdio",
+ .of_match_table = iproc_mdio_of_match,
++#ifdef CONFIG_PM_SLEEP
++ .pm = &iproc_mdio_pm_ops,
++#endif
+ },
+ .probe = iproc_mdio_probe,
+ .remove = iproc_mdio_remove,
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 13c8788e3b6b..a04f8577d9f2 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -63,7 +63,6 @@ enum qmi_wwan_flags {
+
+ enum qmi_wwan_quirks {
+ QMI_WWAN_QUIRK_DTR = 1 << 0, /* needs "set DTR" request */
+- QMI_WWAN_QUIRK_QUECTEL_DYNCFG = 1 << 1, /* check num. endpoints */
+ };
+
+ struct qmimux_hdr {
+@@ -853,16 +852,6 @@ static const struct driver_info qmi_wwan_info_quirk_dtr = {
+ .data = QMI_WWAN_QUIRK_DTR,
+ };
+
+-static const struct driver_info qmi_wwan_info_quirk_quectel_dyncfg = {
+- .description = "WWAN/QMI device",
+- .flags = FLAG_WWAN | FLAG_SEND_ZLP,
+- .bind = qmi_wwan_bind,
+- .unbind = qmi_wwan_unbind,
+- .manage_power = qmi_wwan_manage_power,
+- .rx_fixup = qmi_wwan_rx_fixup,
+- .data = QMI_WWAN_QUIRK_DTR | QMI_WWAN_QUIRK_QUECTEL_DYNCFG,
+-};
+-
+ #define HUAWEI_VENDOR_ID 0x12D1
+
+ /* map QMI/wwan function by a fixed interface number */
+@@ -883,14 +872,18 @@ static const struct driver_info qmi_wwan_info_quirk_quectel_dyncfg = {
+ #define QMI_GOBI_DEVICE(vend, prod) \
+ QMI_FIXED_INTF(vend, prod, 0)
+
+-/* Quectel does not use fixed interface numbers on at least some of their
+- * devices. We need to check the number of endpoints to ensure that we bind to
+- * the correct interface.
++/* Many devices have QMI and DIAG functions which are distinguishable
++ * from other vendor specific functions by class, subclass and
++ * protocol all being 0xff. The DIAG function has exactly 2 endpoints
++ * and is silently rejected when probed.
++ *
++ * This makes it possible to match dynamically numbered QMI functions
++ * as seen on e.g. many Quectel modems.
+ */
+-#define QMI_QUIRK_QUECTEL_DYNCFG(vend, prod) \
++#define QMI_MATCH_FF_FF_FF(vend, prod) \
+ USB_DEVICE_AND_INTERFACE_INFO(vend, prod, USB_CLASS_VENDOR_SPEC, \
+ USB_SUBCLASS_VENDOR_SPEC, 0xff), \
+- .driver_info = (unsigned long)&qmi_wwan_info_quirk_quectel_dyncfg
++ .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtr
+
+ static const struct usb_device_id products[] = {
+ /* 1. CDC ECM like devices match on the control interface */
+@@ -996,10 +989,10 @@ static const struct usb_device_id products[] = {
+ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7),
+ .driver_info = (unsigned long)&qmi_wwan_info,
+ },
+- {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
+- {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */
+- {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
+- {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */
++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
+
+ /* 3. Combined interface devices matching on interface number */
+ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
+@@ -1298,6 +1291,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x413c, 0x81b6, 8)}, /* Dell Wireless 5811e */
+ {QMI_FIXED_INTF(0x413c, 0x81b6, 10)}, /* Dell Wireless 5811e */
+ {QMI_FIXED_INTF(0x413c, 0x81d7, 0)}, /* Dell Wireless 5821e */
++ {QMI_FIXED_INTF(0x413c, 0x81d7, 1)}, /* Dell Wireless 5821e preproduction config */
+ {QMI_FIXED_INTF(0x413c, 0x81e0, 0)}, /* Dell Wireless 5821e with eSIM support*/
+ {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
+ {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */
+@@ -1389,7 +1383,6 @@ static int qmi_wwan_probe(struct usb_interface *intf,
+ {
+ struct usb_device_id *id = (struct usb_device_id *)prod;
+ struct usb_interface_descriptor *desc = &intf->cur_altsetting->desc;
+- const struct driver_info *info;
+
+ /* Workaround to enable dynamic IDs. This disables usbnet
+ * blacklisting functionality. Which, if required, can be
+@@ -1425,12 +1418,8 @@ static int qmi_wwan_probe(struct usb_interface *intf,
+ * different. Ignore the current interface if the number of endpoints
+ * equals the number for the diag interface (two).
+ */
+- info = (void *)id->driver_info;
+-
+- if (info->data & QMI_WWAN_QUIRK_QUECTEL_DYNCFG) {
+- if (desc->bNumEndpoints == 2)
+- return -ENODEV;
+- }
++ if (desc->bNumEndpoints == 2)
++ return -ENODEV;
+
+ return usbnet_probe(intf, id);
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 4f5571123f70..24da49615135 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -3283,6 +3283,15 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ spin_lock_init(&trans_pcie->reg_lock);
+ mutex_init(&trans_pcie->mutex);
+ init_waitqueue_head(&trans_pcie->ucode_write_waitq);
++
++ trans_pcie->rba.alloc_wq = alloc_workqueue("rb_allocator",
++ WQ_HIGHPRI | WQ_UNBOUND, 1);
++ if (!trans_pcie->rba.alloc_wq) {
++ ret = -ENOMEM;
++ goto out_free_trans;
++ }
++ INIT_WORK(&trans_pcie->rba.rx_alloc, iwl_pcie_rx_allocator_work);
++
+ trans_pcie->tso_hdr_page = alloc_percpu(struct iwl_tso_hdr_page);
+ if (!trans_pcie->tso_hdr_page) {
+ ret = -ENOMEM;
+@@ -3485,10 +3494,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ trans_pcie->inta_mask = CSR_INI_SET_MASK;
+ }
+
+- trans_pcie->rba.alloc_wq = alloc_workqueue("rb_allocator",
+- WQ_HIGHPRI | WQ_UNBOUND, 1);
+- INIT_WORK(&trans_pcie->rba.rx_alloc, iwl_pcie_rx_allocator_work);
+-
+ #ifdef CONFIG_IWLWIFI_PCIE_RTPM
+ trans->runtime_pm_mode = IWL_PLAT_PM_MODE_D0I3;
+ #else
+@@ -3501,6 +3506,8 @@ out_free_ict:
+ iwl_pcie_free_ict(trans);
+ out_no_pci:
+ free_percpu(trans_pcie->tso_hdr_page);
++ destroy_workqueue(trans_pcie->rba.alloc_wq);
++out_free_trans:
+ iwl_trans_free(trans);
+ return ERR_PTR(ret);
+ }
+diff --git a/drivers/net/wireless/marvell/mwifiex/main.h b/drivers/net/wireless/marvell/mwifiex/main.h
+index e39bb5c42c9a..7e526014b638 100644
+--- a/drivers/net/wireless/marvell/mwifiex/main.h
++++ b/drivers/net/wireless/marvell/mwifiex/main.h
+@@ -1294,19 +1294,6 @@ mwifiex_copy_rates(u8 *dest, u32 pos, u8 *src, int len)
+ return pos;
+ }
+
+-/* This function return interface number with the same bss_type.
+- */
+-static inline u8
+-mwifiex_get_intf_num(struct mwifiex_adapter *adapter, u8 bss_type)
+-{
+- u8 i, num = 0;
+-
+- for (i = 0; i < adapter->priv_num; i++)
+- if (adapter->priv[i] && adapter->priv[i]->bss_type == bss_type)
+- num++;
+- return num;
+-}
+-
+ /*
+ * This function returns the correct private structure pointer based
+ * upon the BSS type and BSS number.
+diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c
+index 6058c48d56dc..b6b7bbe168eb 100644
+--- a/drivers/net/wireless/marvell/mwifiex/tdls.c
++++ b/drivers/net/wireless/marvell/mwifiex/tdls.c
+@@ -897,7 +897,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
+ u8 *peer, *pos, *end;
+ u8 i, action, basic;
+ u16 cap = 0;
+- int ie_len = 0;
++ int ies_len = 0;
+
+ if (len < (sizeof(struct ethhdr) + 3))
+ return;
+@@ -919,7 +919,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
+ pos = buf + sizeof(struct ethhdr) + 4;
+ /* payload 1+ category 1 + action 1 + dialog 1 */
+ cap = get_unaligned_le16(pos);
+- ie_len = len - sizeof(struct ethhdr) - TDLS_REQ_FIX_LEN;
++ ies_len = len - sizeof(struct ethhdr) - TDLS_REQ_FIX_LEN;
+ pos += 2;
+ break;
+
+@@ -929,7 +929,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
+ /* payload 1+ category 1 + action 1 + dialog 1 + status code 2*/
+ pos = buf + sizeof(struct ethhdr) + 6;
+ cap = get_unaligned_le16(pos);
+- ie_len = len - sizeof(struct ethhdr) - TDLS_RESP_FIX_LEN;
++ ies_len = len - sizeof(struct ethhdr) - TDLS_RESP_FIX_LEN;
+ pos += 2;
+ break;
+
+@@ -937,7 +937,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
+ if (len < (sizeof(struct ethhdr) + TDLS_CONFIRM_FIX_LEN))
+ return;
+ pos = buf + sizeof(struct ethhdr) + TDLS_CONFIRM_FIX_LEN;
+- ie_len = len - sizeof(struct ethhdr) - TDLS_CONFIRM_FIX_LEN;
++ ies_len = len - sizeof(struct ethhdr) - TDLS_CONFIRM_FIX_LEN;
+ break;
+ default:
+ mwifiex_dbg(priv->adapter, ERROR, "Unknown TDLS frame type.\n");
+@@ -950,33 +950,33 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
+
+ sta_ptr->tdls_cap.capab = cpu_to_le16(cap);
+
+- for (end = pos + ie_len; pos + 1 < end; pos += 2 + pos[1]) {
+- if (pos + 2 + pos[1] > end)
++ for (end = pos + ies_len; pos + 1 < end; pos += 2 + pos[1]) {
++ u8 ie_len = pos[1];
++
++ if (pos + 2 + ie_len > end)
+ break;
+
+ switch (*pos) {
+ case WLAN_EID_SUPP_RATES:
+- if (pos[1] > 32)
++ if (ie_len > sizeof(sta_ptr->tdls_cap.rates))
+ return;
+- sta_ptr->tdls_cap.rates_len = pos[1];
+- for (i = 0; i < pos[1]; i++)
++ sta_ptr->tdls_cap.rates_len = ie_len;
++ for (i = 0; i < ie_len; i++)
+ sta_ptr->tdls_cap.rates[i] = pos[i + 2];
+ break;
+
+ case WLAN_EID_EXT_SUPP_RATES:
+- if (pos[1] > 32)
++ if (ie_len > sizeof(sta_ptr->tdls_cap.rates))
+ return;
+ basic = sta_ptr->tdls_cap.rates_len;
+- if (pos[1] > 32 - basic)
++ if (ie_len > sizeof(sta_ptr->tdls_cap.rates) - basic)
+ return;
+- for (i = 0; i < pos[1]; i++)
++ for (i = 0; i < ie_len; i++)
+ sta_ptr->tdls_cap.rates[basic + i] = pos[i + 2];
+- sta_ptr->tdls_cap.rates_len += pos[1];
++ sta_ptr->tdls_cap.rates_len += ie_len;
+ break;
+ case WLAN_EID_HT_CAPABILITY:
+- if (pos > end - sizeof(struct ieee80211_ht_cap) - 2)
+- return;
+- if (pos[1] != sizeof(struct ieee80211_ht_cap))
++ if (ie_len != sizeof(struct ieee80211_ht_cap))
+ return;
+ /* copy the ie's value into ht_capb*/
+ memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos + 2,
+@@ -984,59 +984,45 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
+ sta_ptr->is_11n_enabled = 1;
+ break;
+ case WLAN_EID_HT_OPERATION:
+- if (pos > end -
+- sizeof(struct ieee80211_ht_operation) - 2)
+- return;
+- if (pos[1] != sizeof(struct ieee80211_ht_operation))
++ if (ie_len != sizeof(struct ieee80211_ht_operation))
+ return;
+ /* copy the ie's value into ht_oper*/
+ memcpy(&sta_ptr->tdls_cap.ht_oper, pos + 2,
+ sizeof(struct ieee80211_ht_operation));
+ break;
+ case WLAN_EID_BSS_COEX_2040:
+- if (pos > end - 3)
+- return;
+- if (pos[1] != 1)
++ if (ie_len != sizeof(pos[2]))
+ return;
+ sta_ptr->tdls_cap.coex_2040 = pos[2];
+ break;
+ case WLAN_EID_EXT_CAPABILITY:
+- if (pos > end - sizeof(struct ieee_types_header))
+- return;
+- if (pos[1] < sizeof(struct ieee_types_header))
++ if (ie_len < sizeof(struct ieee_types_header))
+ return;
+- if (pos[1] > 8)
++ if (ie_len > 8)
+ return;
+ memcpy((u8 *)&sta_ptr->tdls_cap.extcap, pos,
+ sizeof(struct ieee_types_header) +
+- min_t(u8, pos[1], 8));
++ min_t(u8, ie_len, 8));
+ break;
+ case WLAN_EID_RSN:
+- if (pos > end - sizeof(struct ieee_types_header))
++ if (ie_len < sizeof(struct ieee_types_header))
+ return;
+- if (pos[1] < sizeof(struct ieee_types_header))
+- return;
+- if (pos[1] > IEEE_MAX_IE_SIZE -
++ if (ie_len > IEEE_MAX_IE_SIZE -
+ sizeof(struct ieee_types_header))
+ return;
+ memcpy((u8 *)&sta_ptr->tdls_cap.rsn_ie, pos,
+ sizeof(struct ieee_types_header) +
+- min_t(u8, pos[1], IEEE_MAX_IE_SIZE -
++ min_t(u8, ie_len, IEEE_MAX_IE_SIZE -
+ sizeof(struct ieee_types_header)));
+ break;
+ case WLAN_EID_QOS_CAPA:
+- if (pos > end - 3)
+- return;
+- if (pos[1] != 1)
++ if (ie_len != sizeof(pos[2]))
+ return;
+ sta_ptr->tdls_cap.qos_info = pos[2];
+ break;
+ case WLAN_EID_VHT_OPERATION:
+ if (priv->adapter->is_hw_11ac_capable) {
+- if (pos > end -
+- sizeof(struct ieee80211_vht_operation) - 2)
+- return;
+- if (pos[1] !=
++ if (ie_len !=
+ sizeof(struct ieee80211_vht_operation))
+ return;
+ /* copy the ie's value into vhtoper*/
+@@ -1046,10 +1032,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
+ break;
+ case WLAN_EID_VHT_CAPABILITY:
+ if (priv->adapter->is_hw_11ac_capable) {
+- if (pos > end -
+- sizeof(struct ieee80211_vht_cap) - 2)
+- return;
+- if (pos[1] != sizeof(struct ieee80211_vht_cap))
++ if (ie_len != sizeof(struct ieee80211_vht_cap))
+ return;
+ /* copy the ie's value into vhtcap*/
+ memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos + 2,
+@@ -1059,9 +1042,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
+ break;
+ case WLAN_EID_AID:
+ if (priv->adapter->is_hw_11ac_capable) {
+- if (pos > end - 4)
+- return;
+- if (pos[1] != 2)
++ if (ie_len != sizeof(u16))
+ return;
+ sta_ptr->tdls_cap.aid =
+ get_unaligned_le16((pos + 2));
+diff --git a/drivers/nfc/pn544/i2c.c b/drivers/nfc/pn544/i2c.c
+index d0207f8e68b7..dcef73eb4120 100644
+--- a/drivers/nfc/pn544/i2c.c
++++ b/drivers/nfc/pn544/i2c.c
+@@ -236,6 +236,7 @@ static void pn544_hci_i2c_platform_init(struct pn544_i2c_phy *phy)
+
+ out:
+ gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
++ usleep_range(10000, 15000);
+ }
+
+ static void pn544_hci_i2c_enable_mode(struct pn544_i2c_phy *phy, int run_mode)
+diff --git a/drivers/pwm/pwm-omap-dmtimer.c b/drivers/pwm/pwm-omap-dmtimer.c
+index c6e710a713d3..527b87959742 100644
+--- a/drivers/pwm/pwm-omap-dmtimer.c
++++ b/drivers/pwm/pwm-omap-dmtimer.c
+@@ -259,7 +259,7 @@ static int pwm_omap_dmtimer_probe(struct platform_device *pdev)
+ if (!timer_pdev) {
+ dev_err(&pdev->dev, "Unable to find Timer pdev\n");
+ ret = -ENODEV;
+- goto put;
++ goto err_find_timer_pdev;
+ }
+
+ timer_pdata = dev_get_platdata(&timer_pdev->dev);
+@@ -267,7 +267,7 @@ static int pwm_omap_dmtimer_probe(struct platform_device *pdev)
+ dev_dbg(&pdev->dev,
+ "dmtimer pdata structure NULL, deferring probe\n");
+ ret = -EPROBE_DEFER;
+- goto put;
++ goto err_platdata;
+ }
+
+ pdata = timer_pdata->timer_ops;
+@@ -286,19 +286,19 @@ static int pwm_omap_dmtimer_probe(struct platform_device *pdev)
+ !pdata->write_counter) {
+ dev_err(&pdev->dev, "Incomplete dmtimer pdata structure\n");
+ ret = -EINVAL;
+- goto put;
++ goto err_platdata;
+ }
+
+ if (!of_get_property(timer, "ti,timer-pwm", NULL)) {
+ dev_err(&pdev->dev, "Missing ti,timer-pwm capability\n");
+ ret = -ENODEV;
+- goto put;
++ goto err_timer_property;
+ }
+
+ dm_timer = pdata->request_by_node(timer);
+ if (!dm_timer) {
+ ret = -EPROBE_DEFER;
+- goto put;
++ goto err_request_timer;
+ }
+
+ omap = devm_kzalloc(&pdev->dev, sizeof(*omap), GFP_KERNEL);
+@@ -355,7 +355,14 @@ err_pwmchip_add:
+ err_alloc_omap:
+
+ pdata->free(dm_timer);
+-put:
++err_request_timer:
++
++err_timer_property:
++err_platdata:
++
++ put_device(&timer_pdev->dev);
++err_find_timer_pdev:
++
+ of_node_put(timer);
+
+ return ret;
+@@ -375,6 +382,8 @@ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+
+ omap->pdata->free(omap->dm_timer);
+
++ put_device(&omap->dm_timer_pdev->dev);
++
+ mutex_destroy(&omap->mutex);
+
+ return 0;
+diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
+index 7e85d238767b..1c799ddd9709 100644
+--- a/drivers/s390/crypto/ap_bus.h
++++ b/drivers/s390/crypto/ap_bus.h
+@@ -158,7 +158,7 @@ struct ap_card {
+ unsigned int functions; /* AP device function bitfield. */
+ int queue_depth; /* AP queue depth.*/
+ int id; /* AP card number. */
+- atomic_t total_request_count; /* # requests ever for this AP device.*/
++ atomic64_t total_request_count; /* # requests ever for this AP device.*/
+ };
+
+ #define to_ap_card(x) container_of((x), struct ap_card, ap_dev.device)
+@@ -175,7 +175,7 @@ struct ap_queue {
+ enum ap_state state; /* State of the AP device. */
+ int pendingq_count; /* # requests on pendingq list. */
+ int requestq_count; /* # requests on requestq list. */
+- int total_request_count; /* # requests ever for this AP device.*/
++ u64 total_request_count; /* # requests ever for this AP device.*/
+ int request_timeout; /* Request timeout in jiffies. */
+ struct timer_list timeout; /* Timer for request timeouts. */
+ struct list_head pendingq; /* List of message sent to AP queue. */
+diff --git a/drivers/s390/crypto/ap_card.c b/drivers/s390/crypto/ap_card.c
+index 63b4cc6cd7e5..e85bfca1ed16 100644
+--- a/drivers/s390/crypto/ap_card.c
++++ b/drivers/s390/crypto/ap_card.c
+@@ -63,13 +63,13 @@ static ssize_t request_count_show(struct device *dev,
+ char *buf)
+ {
+ struct ap_card *ac = to_ap_card(dev);
+- unsigned int req_cnt;
++ u64 req_cnt;
+
+ req_cnt = 0;
+ spin_lock_bh(&ap_list_lock);
+- req_cnt = atomic_read(&ac->total_request_count);
++ req_cnt = atomic64_read(&ac->total_request_count);
+ spin_unlock_bh(&ap_list_lock);
+- return snprintf(buf, PAGE_SIZE, "%d\n", req_cnt);
++ return snprintf(buf, PAGE_SIZE, "%llu\n", req_cnt);
+ }
+
+ static ssize_t request_count_store(struct device *dev,
+@@ -83,7 +83,7 @@ static ssize_t request_count_store(struct device *dev,
+ for_each_ap_queue(aq, ac)
+ aq->total_request_count = 0;
+ spin_unlock_bh(&ap_list_lock);
+- atomic_set(&ac->total_request_count, 0);
++ atomic64_set(&ac->total_request_count, 0);
+
+ return count;
+ }
+diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
+index 576ac08777c5..e1647da122f7 100644
+--- a/drivers/s390/crypto/ap_queue.c
++++ b/drivers/s390/crypto/ap_queue.c
+@@ -470,12 +470,12 @@ static ssize_t request_count_show(struct device *dev,
+ char *buf)
+ {
+ struct ap_queue *aq = to_ap_queue(dev);
+- unsigned int req_cnt;
++ u64 req_cnt;
+
+ spin_lock_bh(&aq->lock);
+ req_cnt = aq->total_request_count;
+ spin_unlock_bh(&aq->lock);
+- return snprintf(buf, PAGE_SIZE, "%d\n", req_cnt);
++ return snprintf(buf, PAGE_SIZE, "%llu\n", req_cnt);
+ }
+
+ static ssize_t request_count_store(struct device *dev,
+@@ -667,7 +667,7 @@ void ap_queue_message(struct ap_queue *aq, struct ap_message *ap_msg)
+ list_add_tail(&ap_msg->list, &aq->requestq);
+ aq->requestq_count++;
+ aq->total_request_count++;
+- atomic_inc(&aq->card->total_request_count);
++ atomic64_inc(&aq->card->total_request_count);
+ /* Send/receive as many request from the queue as possible. */
+ ap_wait(ap_sm_event_loop(aq, AP_EVENT_POLL));
+ spin_unlock_bh(&aq->lock);
+diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
+index b2737bfeb8bb..23c24a699cef 100644
+--- a/drivers/s390/crypto/zcrypt_api.c
++++ b/drivers/s390/crypto/zcrypt_api.c
+@@ -190,8 +190,8 @@ static inline bool zcrypt_card_compare(struct zcrypt_card *zc,
+ weight += atomic_read(&zc->load);
+ pref_weight += atomic_read(&pref_zc->load);
+ if (weight == pref_weight)
+- return atomic_read(&zc->card->total_request_count) >
+- atomic_read(&pref_zc->card->total_request_count);
++ return atomic64_read(&zc->card->total_request_count) >
++ atomic64_read(&pref_zc->card->total_request_count);
+ return weight > pref_weight;
+ }
+
+@@ -719,11 +719,12 @@ static void zcrypt_qdepth_mask(char qdepth[], size_t max_adapters)
+ spin_unlock(&zcrypt_list_lock);
+ }
+
+-static void zcrypt_perdev_reqcnt(int reqcnt[], size_t max_adapters)
++static void zcrypt_perdev_reqcnt(u32 reqcnt[], size_t max_adapters)
+ {
+ struct zcrypt_card *zc;
+ struct zcrypt_queue *zq;
+ int card;
++ u64 cnt;
+
+ memset(reqcnt, 0, sizeof(int) * max_adapters);
+ spin_lock(&zcrypt_list_lock);
+@@ -735,8 +736,9 @@ static void zcrypt_perdev_reqcnt(int reqcnt[], size_t max_adapters)
+ || card >= max_adapters)
+ continue;
+ spin_lock(&zq->queue->lock);
+- reqcnt[card] = zq->queue->total_request_count;
++ cnt = zq->queue->total_request_count;
+ spin_unlock(&zq->queue->lock);
++ reqcnt[card] = (cnt < UINT_MAX) ? (u32) cnt : UINT_MAX;
+ }
+ }
+ local_bh_enable();
+@@ -907,9 +909,9 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
+ return 0;
+ }
+ case ZCRYPT_PERDEV_REQCNT: {
+- int *reqcnt;
++ u32 *reqcnt;
+
+- reqcnt = kcalloc(AP_DEVICES, sizeof(int), GFP_KERNEL);
++ reqcnt = kcalloc(AP_DEVICES, sizeof(u32), GFP_KERNEL);
+ if (!reqcnt)
+ return -ENOMEM;
+ zcrypt_perdev_reqcnt(reqcnt, AP_DEVICES);
+@@ -966,7 +968,7 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
+ }
+ case Z90STAT_PERDEV_REQCNT: {
+ /* the old ioctl supports only 64 adapters */
+- int reqcnt[MAX_ZDEV_CARDIDS];
++ u32 reqcnt[MAX_ZDEV_CARDIDS];
+
+ zcrypt_perdev_reqcnt(reqcnt, MAX_ZDEV_CARDIDS);
+ if (copy_to_user((int __user *) arg, reqcnt, sizeof(reqcnt)))
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index aa90004f49e2..eb917e93fa72 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -2148,15 +2148,14 @@ int qeth_l2_vnicc_set_state(struct qeth_card *card, u32 vnicc, bool state)
+
+ QETH_CARD_TEXT(card, 2, "vniccsch");
+
+- /* do not change anything if BridgePort is enabled */
+- if (qeth_bridgeport_is_in_use(card))
+- return -EBUSY;
+-
+ /* check if characteristic and enable/disable are supported */
+ if (!(card->options.vnicc.sup_chars & vnicc) ||
+ !(card->options.vnicc.set_char_sup & vnicc))
+ return -EOPNOTSUPP;
+
++ if (qeth_bridgeport_is_in_use(card))
++ return -EBUSY;
++
+ /* set enable/disable command and store wanted characteristic */
+ if (state) {
+ cmd = IPA_VNICC_ENABLE;
+@@ -2202,14 +2201,13 @@ int qeth_l2_vnicc_get_state(struct qeth_card *card, u32 vnicc, bool *state)
+
+ QETH_CARD_TEXT(card, 2, "vniccgch");
+
+- /* do not get anything if BridgePort is enabled */
+- if (qeth_bridgeport_is_in_use(card))
+- return -EBUSY;
+-
+ /* check if characteristic is supported */
+ if (!(card->options.vnicc.sup_chars & vnicc))
+ return -EOPNOTSUPP;
+
++ if (qeth_bridgeport_is_in_use(card))
++ return -EBUSY;
++
+ /* if card is ready, query current VNICC state */
+ if (qeth_card_hw_is_reachable(card))
+ rc = qeth_l2_vnicc_query_chars(card);
+@@ -2227,15 +2225,14 @@ int qeth_l2_vnicc_set_timeout(struct qeth_card *card, u32 timeout)
+
+ QETH_CARD_TEXT(card, 2, "vniccsto");
+
+- /* do not change anything if BridgePort is enabled */
+- if (qeth_bridgeport_is_in_use(card))
+- return -EBUSY;
+-
+ /* check if characteristic and set_timeout are supported */
+ if (!(card->options.vnicc.sup_chars & QETH_VNICC_LEARNING) ||
+ !(card->options.vnicc.getset_timeout_sup & QETH_VNICC_LEARNING))
+ return -EOPNOTSUPP;
+
++ if (qeth_bridgeport_is_in_use(card))
++ return -EBUSY;
++
+ /* do we need to do anything? */
+ if (card->options.vnicc.learning_timeout == timeout)
+ return rc;
+@@ -2264,14 +2261,14 @@ int qeth_l2_vnicc_get_timeout(struct qeth_card *card, u32 *timeout)
+
+ QETH_CARD_TEXT(card, 2, "vniccgto");
+
+- /* do not get anything if BridgePort is enabled */
+- if (qeth_bridgeport_is_in_use(card))
+- return -EBUSY;
+-
+ /* check if characteristic and get_timeout are supported */
+ if (!(card->options.vnicc.sup_chars & QETH_VNICC_LEARNING) ||
+ !(card->options.vnicc.getset_timeout_sup & QETH_VNICC_LEARNING))
+ return -EOPNOTSUPP;
++
++ if (qeth_bridgeport_is_in_use(card))
++ return -EBUSY;
++
+ /* if card is ready, get timeout. Otherwise, just return stored value */
+ *timeout = card->options.vnicc.learning_timeout;
+ if (qeth_card_hw_is_reachable(card))
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index 257e254c6137..0ec6385eb15e 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -47,7 +47,8 @@
+ defined(CONFIG_ARCH_TEGRA_124_SOC) || \
+ defined(CONFIG_ARCH_TEGRA_132_SOC) || \
+ defined(CONFIG_ARCH_TEGRA_210_SOC) || \
+- defined(CONFIG_ARCH_TEGRA_186_SOC)
++ defined(CONFIG_ARCH_TEGRA_186_SOC) || \
++ defined(CONFIG_ARCH_TEGRA_194_SOC)
+ static u32 tegra30_fuse_read_early(struct tegra_fuse *fuse, unsigned int offset)
+ {
+ if (WARN_ON(!fuse->base))
+diff --git a/drivers/thermal/broadcom/brcmstb_thermal.c b/drivers/thermal/broadcom/brcmstb_thermal.c
+index 1919f91fa756..8d16a41eacae 100644
+--- a/drivers/thermal/broadcom/brcmstb_thermal.c
++++ b/drivers/thermal/broadcom/brcmstb_thermal.c
+@@ -58,7 +58,7 @@
+ #define AVS_TMON_TP_TEST_ENABLE 0x20
+
+ /* Default coefficients */
+-#define AVS_TMON_TEMP_SLOPE -487
++#define AVS_TMON_TEMP_SLOPE 487
+ #define AVS_TMON_TEMP_OFFSET 410040
+
+ /* HW related temperature constants */
+@@ -117,23 +117,12 @@ struct brcmstb_thermal_priv {
+ struct thermal_zone_device *thermal;
+ };
+
+-static void avs_tmon_get_coeffs(struct thermal_zone_device *tz, int *slope,
+- int *offset)
+-{
+- *slope = thermal_zone_get_slope(tz);
+- *offset = thermal_zone_get_offset(tz);
+-}
+-
+ /* Convert a HW code to a temperature reading (millidegree celsius) */
+ static inline int avs_tmon_code_to_temp(struct thermal_zone_device *tz,
+ u32 code)
+ {
+- const int val = code & AVS_TMON_TEMP_MASK;
+- int slope, offset;
+-
+- avs_tmon_get_coeffs(tz, &slope, &offset);
+-
+- return slope * val + offset;
++ return (AVS_TMON_TEMP_OFFSET -
++ (int)((code & AVS_TMON_TEMP_MAX) * AVS_TMON_TEMP_SLOPE));
+ }
+
+ /*
+@@ -145,20 +134,18 @@ static inline int avs_tmon_code_to_temp(struct thermal_zone_device *tz,
+ static inline u32 avs_tmon_temp_to_code(struct thermal_zone_device *tz,
+ int temp, bool low)
+ {
+- int slope, offset;
+-
+ if (temp < AVS_TMON_TEMP_MIN)
+- return AVS_TMON_TEMP_MAX; /* Maximum code value */
+-
+- avs_tmon_get_coeffs(tz, &slope, &offset);
++ return AVS_TMON_TEMP_MAX; /* Maximum code value */
+
+- if (temp >= offset)
++ if (temp >= AVS_TMON_TEMP_OFFSET)
+ return 0; /* Minimum code value */
+
+ if (low)
+- return (u32)(DIV_ROUND_UP(offset - temp, abs(slope)));
++ return (u32)(DIV_ROUND_UP(AVS_TMON_TEMP_OFFSET - temp,
++ AVS_TMON_TEMP_SLOPE));
+ else
+- return (u32)((offset - temp) / abs(slope));
++ return (u32)((AVS_TMON_TEMP_OFFSET - temp) /
++ AVS_TMON_TEMP_SLOPE);
+ }
+
+ static int brcmstb_get_temp(void *data, int *temp)
+diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
+index 06ed20dd01ba..cee0274806c5 100644
+--- a/drivers/tty/sysrq.c
++++ b/drivers/tty/sysrq.c
+@@ -546,7 +546,6 @@ void __handle_sysrq(int key, bool check_mask)
+ */
+ orig_log_level = console_loglevel;
+ console_loglevel = CONSOLE_LOGLEVEL_DEFAULT;
+- pr_info("SysRq : ");
+
+ op_p = __sysrq_get_key_op(key);
+ if (op_p) {
+@@ -555,14 +554,15 @@ void __handle_sysrq(int key, bool check_mask)
+ * should not) and is the invoked operation enabled?
+ */
+ if (!check_mask || sysrq_on_mask(op_p->enable_mask)) {
+- pr_cont("%s\n", op_p->action_msg);
++ pr_info("%s\n", op_p->action_msg);
+ console_loglevel = orig_log_level;
+ op_p->handler(key);
+ } else {
+- pr_cont("This sysrq operation is disabled.\n");
++ pr_info("This sysrq operation is disabled.\n");
++ console_loglevel = orig_log_level;
+ }
+ } else {
+- pr_cont("HELP : ");
++ pr_info("HELP : ");
+ /* Only print the help msg once per handler */
+ for (i = 0; i < ARRAY_SIZE(sysrq_key_table); i++) {
+ if (sysrq_key_table[i]) {
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index 124356dc39e1..88c8c158ec25 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -1187,10 +1187,6 @@ static int vhost_net_release(struct inode *inode, struct file *f)
+
+ static struct socket *get_raw_socket(int fd)
+ {
+- struct {
+- struct sockaddr_ll sa;
+- char buf[MAX_ADDR_LEN];
+- } uaddr;
+ int r;
+ struct socket *sock = sockfd_lookup(fd, &r);
+
+@@ -1203,11 +1199,7 @@ static struct socket *get_raw_socket(int fd)
+ goto err;
+ }
+
+- r = sock->ops->getname(sock, (struct sockaddr *)&uaddr.sa, 0);
+- if (r < 0)
+- goto err;
+-
+- if (uaddr.sa.sll_family != AF_PACKET) {
++ if (sock->sk->sk_family != AF_PACKET) {
+ r = -EPFNOSUPPORT;
+ goto err;
+ }
+diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c
+index 56ad19608a9b..9d91ed59615d 100644
+--- a/drivers/watchdog/wdat_wdt.c
++++ b/drivers/watchdog/wdat_wdt.c
+@@ -392,7 +392,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)
+
+ memset(&r, 0, sizeof(r));
+ r.start = gas->address;
+- r.end = r.start + gas->access_width - 1;
++ r.end = r.start + ACPI_ACCESS_BYTE_WIDTH(gas->access_width) - 1;
+ if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
+ r.flags = IORESOURCE_MEM;
+ } else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) {
+diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
+index 1d377b7f2860..130bdca9e568 100644
+--- a/fs/cifs/cifsacl.c
++++ b/fs/cifs/cifsacl.c
+@@ -603,7 +603,7 @@ static void access_flags_to_mode(__le32 ace_flags, int type, umode_t *pmode,
+ ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
+ *pmode |= (S_IXUGO & (*pbits_to_set));
+
+- cifs_dbg(NOISY, "access flags 0x%x mode now 0x%x\n", flags, *pmode);
++ cifs_dbg(NOISY, "access flags 0x%x mode now %04o\n", flags, *pmode);
+ return;
+ }
+
+@@ -632,7 +632,7 @@ static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
+ if (mode & S_IXUGO)
+ *pace_flags |= SET_FILE_EXEC_RIGHTS;
+
+- cifs_dbg(NOISY, "mode: 0x%x, access flags now 0x%x\n",
++ cifs_dbg(NOISY, "mode: %04o, access flags now 0x%x\n",
+ mode, *pace_flags);
+ return;
+ }
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 6c62ce40608a..975f800b9dd4 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3794,7 +3794,7 @@ int cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
+ cifs_sb->mnt_gid = pvolume_info->linux_gid;
+ cifs_sb->mnt_file_mode = pvolume_info->file_mode;
+ cifs_sb->mnt_dir_mode = pvolume_info->dir_mode;
+- cifs_dbg(FYI, "file mode: 0x%hx dir mode: 0x%hx\n",
++ cifs_dbg(FYI, "file mode: %04ho dir mode: %04ho\n",
+ cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode);
+
+ cifs_sb->actimeo = pvolume_info->actimeo;
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 26154db6c87f..fbebf241dbf2 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1579,7 +1579,7 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, umode_t mode)
+ struct TCP_Server_Info *server;
+ char *full_path;
+
+- cifs_dbg(FYI, "In cifs_mkdir, mode = 0x%hx inode = 0x%p\n",
++ cifs_dbg(FYI, "In cifs_mkdir, mode = %04ho inode = 0x%p\n",
+ mode, inode);
+
+ cifs_sb = CIFS_SB(inode->i_sb);
+diff --git a/fs/dax.c b/fs/dax.c
+index f0d932fa39c2..d09701aa6f2f 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -1301,6 +1301,9 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
+ lockdep_assert_held(&inode->i_rwsem);
+ }
+
++ if (iocb->ki_flags & IOCB_NOWAIT)
++ flags |= IOMAP_NOWAIT;
++
+ while (iov_iter_count(iter)) {
+ ret = iomap_apply(inode, pos, iov_iter_count(iter), flags, ops,
+ iter, dax_iomap_actor);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index cb797489b2d8..d44fc3f579e1 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2298,7 +2298,7 @@ int ext4_alloc_flex_bg_array(struct super_block *sb, ext4_group_t ngroup)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+ struct flex_groups **old_groups, **new_groups;
+- int size, i;
++ int size, i, j;
+
+ if (!sbi->s_log_groups_per_flex)
+ return 0;
+@@ -2319,8 +2319,8 @@ int ext4_alloc_flex_bg_array(struct super_block *sb, ext4_group_t ngroup)
+ sizeof(struct flex_groups)),
+ GFP_KERNEL);
+ if (!new_groups[i]) {
+- for (i--; i >= sbi->s_flex_groups_allocated; i--)
+- kvfree(new_groups[i]);
++ for (j = sbi->s_flex_groups_allocated; j < i; j++)
++ kvfree(new_groups[j]);
+ kvfree(new_groups);
+ ext4_msg(sb, KERN_ERR,
+ "not enough memory for %d flex groups", size);
+diff --git a/fs/namei.c b/fs/namei.c
+index c00a7e1da4c0..327844fedf3d 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1368,7 +1368,7 @@ static int follow_dotdot_rcu(struct nameidata *nd)
+ nd->path.dentry = parent;
+ nd->seq = seq;
+ if (unlikely(!path_connected(&nd->path)))
+- return -ENOENT;
++ return -ECHILD;
+ break;
+ } else {
+ struct mount *mnt = real_mount(nd->path.mnt);
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index 66ceb12ebc63..2939a6cd7fec 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -528,11 +528,12 @@ typedef u64 acpi_integer;
+ #define ACPI_MAKE_RSDP_SIG(dest) (memcpy (ACPI_CAST_PTR (char, (dest)), ACPI_SIG_RSDP, 8))
+
+ /*
+- * Algorithm to obtain access bit width.
++ * Algorithm to obtain access bit or byte width.
+ * Can be used with access_width of struct acpi_generic_address and access_size of
+ * struct acpi_resource_generic_register.
+ */
+ #define ACPI_ACCESS_BIT_WIDTH(size) (1 << ((size) + 2))
++#define ACPI_ACCESS_BYTE_WIDTH(size) (1 << ((size) - 1))
+
+ /*******************************************************************************
+ *
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 8b3e5e8a72fb..8506637f070d 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -495,7 +495,7 @@ struct hid_report_enum {
+ };
+
+ #define HID_MIN_BUFFER_SIZE 64 /* make sure there is at least a packet size of space */
+-#define HID_MAX_BUFFER_SIZE 4096 /* 4kb */
++#define HID_MAX_BUFFER_SIZE 8192 /* 8kb */
+ #define HID_CONTROL_FIFO_SIZE 256 /* to init devices with >100 reports */
+ #define HID_OUTPUT_FIFO_SIZE 64
+
+diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
+index 4618cbbe3632..99f8580344d0 100644
+--- a/include/net/flow_dissector.h
++++ b/include/net/flow_dissector.h
+@@ -5,6 +5,7 @@
+ #include <linux/types.h>
+ #include <linux/in6.h>
+ #include <linux/siphash.h>
++#include <linux/string.h>
+ #include <uapi/linux/if_ether.h>
+
+ /**
+@@ -306,4 +307,12 @@ static inline void *skb_flow_dissector_target(struct flow_dissector *flow_dissec
+ return ((char *)target_container) + flow_dissector->offset[key_id];
+ }
+
++static inline void
++flow_dissector_init_keys(struct flow_dissector_key_control *key_control,
++ struct flow_dissector_key_basic *key_basic)
++{
++ memset(key_control, 0, sizeof(*key_control));
++ memset(key_basic, 0, sizeof(*key_basic));
++}
++
+ #endif
+diff --git a/include/uapi/linux/usb/charger.h b/include/uapi/linux/usb/charger.h
+index 5f72af35b3ed..ad22079125bf 100644
+--- a/include/uapi/linux/usb/charger.h
++++ b/include/uapi/linux/usb/charger.h
+@@ -14,18 +14,18 @@
+ * ACA (Accessory Charger Adapters)
+ */
+ enum usb_charger_type {
+- UNKNOWN_TYPE,
+- SDP_TYPE,
+- DCP_TYPE,
+- CDP_TYPE,
+- ACA_TYPE,
++ UNKNOWN_TYPE = 0,
++ SDP_TYPE = 1,
++ DCP_TYPE = 2,
++ CDP_TYPE = 3,
++ ACA_TYPE = 4,
+ };
+
+ /* USB charger state */
+ enum usb_charger_state {
+- USB_CHARGER_DEFAULT,
+- USB_CHARGER_PRESENT,
+- USB_CHARGER_ABSENT,
++ USB_CHARGER_DEFAULT = 0,
++ USB_CHARGER_PRESENT = 1,
++ USB_CHARGER_ABSENT = 2,
+ };
+
+ #endif /* _UAPI__LINUX_USB_CHARGER_H */
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 2a8058764aa6..1f08c38e604a 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -1106,13 +1106,11 @@ static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature
+ audit_log_end(ab);
+ }
+
+-static int audit_set_feature(struct sk_buff *skb)
++static int audit_set_feature(struct audit_features *uaf)
+ {
+- struct audit_features *uaf;
+ int i;
+
+ BUILD_BUG_ON(AUDIT_LAST_FEATURE + 1 > ARRAY_SIZE(audit_feature_names));
+- uaf = nlmsg_data(nlmsg_hdr(skb));
+
+ /* if there is ever a version 2 we should handle that here */
+
+@@ -1180,6 +1178,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ {
+ u32 seq;
+ void *data;
++ int data_len;
+ int err;
+ struct audit_buffer *ab;
+ u16 msg_type = nlh->nlmsg_type;
+@@ -1193,6 +1192,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+
+ seq = nlh->nlmsg_seq;
+ data = nlmsg_data(nlh);
++ data_len = nlmsg_len(nlh);
+
+ switch (msg_type) {
+ case AUDIT_GET: {
+@@ -1216,7 +1216,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ struct audit_status s;
+ memset(&s, 0, sizeof(s));
+ /* guard against past and future API changes */
+- memcpy(&s, data, min_t(size_t, sizeof(s), nlmsg_len(nlh)));
++ memcpy(&s, data, min_t(size_t, sizeof(s), data_len));
+ if (s.mask & AUDIT_STATUS_ENABLED) {
+ err = audit_set_enabled(s.enabled);
+ if (err < 0)
+@@ -1320,7 +1320,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ return err;
+ break;
+ case AUDIT_SET_FEATURE:
+- err = audit_set_feature(skb);
++ if (data_len < sizeof(struct audit_features))
++ return -EINVAL;
++ err = audit_set_feature(data);
+ if (err)
+ return err;
+ break;
+@@ -1332,6 +1334,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+
+ err = audit_filter(msg_type, AUDIT_FILTER_USER);
+ if (err == 1) { /* match or error */
++ char *str = data;
++
+ err = 0;
+ if (msg_type == AUDIT_USER_TTY) {
+ err = tty_audit_push();
+@@ -1339,26 +1343,24 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ break;
+ }
+ audit_log_common_recv_msg(&ab, msg_type);
+- if (msg_type != AUDIT_USER_TTY)
++ if (msg_type != AUDIT_USER_TTY) {
++ /* ensure NULL termination */
++ str[data_len - 1] = '\0';
+ audit_log_format(ab, " msg='%.*s'",
+ AUDIT_MESSAGE_TEXT_MAX,
+- (char *)data);
+- else {
+- int size;
+-
++ str);
++ } else {
+ audit_log_format(ab, " data=");
+- size = nlmsg_len(nlh);
+- if (size > 0 &&
+- ((unsigned char *)data)[size - 1] == '\0')
+- size--;
+- audit_log_n_untrustedstring(ab, data, size);
++ if (data_len > 0 && str[data_len - 1] == '\0')
++ data_len--;
++ audit_log_n_untrustedstring(ab, str, data_len);
+ }
+ audit_log_end(ab);
+ }
+ break;
+ case AUDIT_ADD_RULE:
+ case AUDIT_DEL_RULE:
+- if (nlmsg_len(nlh) < sizeof(struct audit_rule_data))
++ if (data_len < sizeof(struct audit_rule_data))
+ return -EINVAL;
+ if (audit_enabled == AUDIT_LOCKED) {
+ audit_log_common_recv_msg(&ab, AUDIT_CONFIG_CHANGE);
+@@ -1366,7 +1368,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ audit_log_end(ab);
+ return -EPERM;
+ }
+- err = audit_rule_change(msg_type, seq, data, nlmsg_len(nlh));
++ err = audit_rule_change(msg_type, seq, data, data_len);
+ break;
+ case AUDIT_LIST_RULES:
+ err = audit_list_rules_send(skb, seq);
+@@ -1380,7 +1382,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ case AUDIT_MAKE_EQUIV: {
+ void *bufp = data;
+ u32 sizes[2];
+- size_t msglen = nlmsg_len(nlh);
++ size_t msglen = data_len;
+ char *old, *new;
+
+ err = -EINVAL;
+@@ -1456,7 +1458,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+
+ memset(&s, 0, sizeof(s));
+ /* guard against past and future API changes */
+- memcpy(&s, data, min_t(size_t, sizeof(s), nlmsg_len(nlh)));
++ memcpy(&s, data, min_t(size_t, sizeof(s), data_len));
+ /* check if new data is valid */
+ if ((s.enabled != 0 && s.enabled != 1) ||
+ (s.log_passwd != 0 && s.log_passwd != 1))
+diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
+index 425c67e4f568..1c8a48abda80 100644
+--- a/kernel/auditfilter.c
++++ b/kernel/auditfilter.c
+@@ -452,6 +452,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
+ bufp = data->buf;
+ for (i = 0; i < data->field_count; i++) {
+ struct audit_field *f = &entry->rule.fields[i];
++ u32 f_val;
+
+ err = -EINVAL;
+
+@@ -460,12 +461,12 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
+ goto exit_free;
+
+ f->type = data->fields[i];
+- f->val = data->values[i];
++ f_val = data->values[i];
+
+ /* Support legacy tests for a valid loginuid */
+- if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {
++ if ((f->type == AUDIT_LOGINUID) && (f_val == AUDIT_UID_UNSET)) {
+ f->type = AUDIT_LOGINUID_SET;
+- f->val = 0;
++ f_val = 0;
+ entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
+ }
+
+@@ -481,7 +482,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
+ case AUDIT_SUID:
+ case AUDIT_FSUID:
+ case AUDIT_OBJ_UID:
+- f->uid = make_kuid(current_user_ns(), f->val);
++ f->uid = make_kuid(current_user_ns(), f_val);
+ if (!uid_valid(f->uid))
+ goto exit_free;
+ break;
+@@ -490,11 +491,12 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
+ case AUDIT_SGID:
+ case AUDIT_FSGID:
+ case AUDIT_OBJ_GID:
+- f->gid = make_kgid(current_user_ns(), f->val);
++ f->gid = make_kgid(current_user_ns(), f_val);
+ if (!gid_valid(f->gid))
+ goto exit_free;
+ break;
+ case AUDIT_ARCH:
++ f->val = f_val;
+ entry->rule.arch_f = f;
+ break;
+ case AUDIT_SUBJ_USER:
+@@ -507,11 +509,13 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
+ case AUDIT_OBJ_TYPE:
+ case AUDIT_OBJ_LEV_LOW:
+ case AUDIT_OBJ_LEV_HIGH:
+- str = audit_unpack_string(&bufp, &remain, f->val);
+- if (IS_ERR(str))
++ str = audit_unpack_string(&bufp, &remain, f_val);
++ if (IS_ERR(str)) {
++ err = PTR_ERR(str);
+ goto exit_free;
+- entry->rule.buflen += f->val;
+-
++ }
++ entry->rule.buflen += f_val;
++ f->lsm_str = str;
+ err = security_audit_rule_init(f->type, f->op, str,
+ (void **)&f->lsm_rule);
+ /* Keep currently invalid fields around in case they
+@@ -520,68 +524,71 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
+ pr_warn("audit rule for LSM \'%s\' is invalid\n",
+ str);
+ err = 0;
+- }
+- if (err) {
+- kfree(str);
++ } else if (err)
+ goto exit_free;
+- } else
+- f->lsm_str = str;
+ break;
+ case AUDIT_WATCH:
+- str = audit_unpack_string(&bufp, &remain, f->val);
+- if (IS_ERR(str))
++ str = audit_unpack_string(&bufp, &remain, f_val);
++ if (IS_ERR(str)) {
++ err = PTR_ERR(str);
+ goto exit_free;
+- entry->rule.buflen += f->val;
+-
+- err = audit_to_watch(&entry->rule, str, f->val, f->op);
++ }
++ err = audit_to_watch(&entry->rule, str, f_val, f->op);
+ if (err) {
+ kfree(str);
+ goto exit_free;
+ }
++ entry->rule.buflen += f_val;
+ break;
+ case AUDIT_DIR:
+- str = audit_unpack_string(&bufp, &remain, f->val);
+- if (IS_ERR(str))
++ str = audit_unpack_string(&bufp, &remain, f_val);
++ if (IS_ERR(str)) {
++ err = PTR_ERR(str);
+ goto exit_free;
+- entry->rule.buflen += f->val;
+-
++ }
+ err = audit_make_tree(&entry->rule, str, f->op);
+ kfree(str);
+ if (err)
+ goto exit_free;
++ entry->rule.buflen += f_val;
+ break;
+ case AUDIT_INODE:
++ f->val = f_val;
+ err = audit_to_inode(&entry->rule, f);
+ if (err)
+ goto exit_free;
+ break;
+ case AUDIT_FILTERKEY:
+- if (entry->rule.filterkey || f->val > AUDIT_MAX_KEY_LEN)
++ if (entry->rule.filterkey || f_val > AUDIT_MAX_KEY_LEN)
+ goto exit_free;
+- str = audit_unpack_string(&bufp, &remain, f->val);
+- if (IS_ERR(str))
++ str = audit_unpack_string(&bufp, &remain, f_val);
++ if (IS_ERR(str)) {
++ err = PTR_ERR(str);
+ goto exit_free;
+- entry->rule.buflen += f->val;
++ }
++ entry->rule.buflen += f_val;
+ entry->rule.filterkey = str;
+ break;
+ case AUDIT_EXE:
+- if (entry->rule.exe || f->val > PATH_MAX)
++ if (entry->rule.exe || f_val > PATH_MAX)
+ goto exit_free;
+- str = audit_unpack_string(&bufp, &remain, f->val);
++ str = audit_unpack_string(&bufp, &remain, f_val);
+ if (IS_ERR(str)) {
+ err = PTR_ERR(str);
+ goto exit_free;
+ }
+- entry->rule.buflen += f->val;
+-
+- audit_mark = audit_alloc_mark(&entry->rule, str, f->val);
++ audit_mark = audit_alloc_mark(&entry->rule, str, f_val);
+ if (IS_ERR(audit_mark)) {
+ kfree(str);
+ err = PTR_ERR(audit_mark);
+ goto exit_free;
+ }
++ entry->rule.buflen += f_val;
+ entry->rule.exe = audit_mark;
+ break;
++ default:
++ f->val = f_val;
++ break;
+ }
+ }
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index f4e4095ec7ea..00050a22f6a1 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -523,6 +523,8 @@ static void do_unoptimize_kprobes(void)
+ arch_unoptimize_kprobes(&unoptimizing_list, &freeing_list);
+ /* Loop free_list for disarming */
+ list_for_each_entry_safe(op, tmp, &freeing_list, list) {
++ /* Switching from detour code to origin */
++ op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
+ /* Disarm probes if marked disabled */
+ if (kprobe_disabled(&op->kp))
+ arch_disarm_kprobe(&op->kp);
+@@ -662,6 +664,7 @@ static void force_unoptimize_kprobe(struct optimized_kprobe *op)
+ {
+ lockdep_assert_cpus_held();
+ arch_unoptimize_kprobe(op);
++ op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
+ if (kprobe_disabled(&op->kp))
+ arch_disarm_kprobe(&op->kp);
+ }
+@@ -689,7 +692,6 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)
+ return;
+ }
+
+- op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
+ if (!list_empty(&op->list)) {
+ /* Dequeue from the optimization queue */
+ list_del_init(&op->list);
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 7f4f4ab5bfef..86ccaaf0c1bf 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -353,6 +353,18 @@ static inline bool list_add_leaf_cfs_rq(struct cfs_rq *cfs_rq)
+ static inline void list_del_leaf_cfs_rq(struct cfs_rq *cfs_rq)
+ {
+ if (cfs_rq->on_list) {
++ struct rq *rq = rq_of(cfs_rq);
++
++ /*
++ * With cfs_rq being unthrottled/throttled during an enqueue,
++ * it can happen the tmp_alone_branch points the a leaf that
++ * we finally want to del. In this case, tmp_alone_branch moves
++ * to the prev element but it will point to rq->leaf_cfs_rq_list
++ * at the end of the enqueue.
++ */
++ if (rq->tmp_alone_branch == &cfs_rq->leaf_cfs_rq_list)
++ rq->tmp_alone_branch = cfs_rq->leaf_cfs_rq_list.prev;
++
+ list_del_rcu(&cfs_rq->leaf_cfs_rq_list);
+ cfs_rq->on_list = 0;
+ }
+@@ -363,9 +375,10 @@ static inline void assert_list_leaf_cfs_rq(struct rq *rq)
+ SCHED_WARN_ON(rq->tmp_alone_branch != &rq->leaf_cfs_rq_list);
+ }
+
+-/* Iterate through all cfs_rq's on a runqueue in bottom-up order */
+-#define for_each_leaf_cfs_rq(rq, cfs_rq) \
+- list_for_each_entry_rcu(cfs_rq, &rq->leaf_cfs_rq_list, leaf_cfs_rq_list)
++/* Iterate thr' all leaf cfs_rq's on a runqueue */
++#define for_each_leaf_cfs_rq_safe(rq, cfs_rq, pos) \
++ list_for_each_entry_safe(cfs_rq, pos, &rq->leaf_cfs_rq_list, \
++ leaf_cfs_rq_list)
+
+ /* Do the two (enqueued) entities belong to the same group ? */
+ static inline struct cfs_rq *
+@@ -462,8 +475,8 @@ static inline void assert_list_leaf_cfs_rq(struct rq *rq)
+ {
+ }
+
+-#define for_each_leaf_cfs_rq(rq, cfs_rq) \
+- for (cfs_rq = &rq->cfs; cfs_rq; cfs_rq = NULL)
++#define for_each_leaf_cfs_rq_safe(rq, cfs_rq, pos) \
++ for (cfs_rq = &rq->cfs, pos = NULL; cfs_rq; cfs_rq = pos)
+
+ static inline struct sched_entity *parent_entity(struct sched_entity *se)
+ {
+@@ -4441,6 +4454,10 @@ static int tg_unthrottle_up(struct task_group *tg, void *data)
+ /* adjust cfs_rq_clock_task() */
+ cfs_rq->throttled_clock_task_time += rq_clock_task(rq) -
+ cfs_rq->throttled_clock_task;
++
++ /* Add cfs_rq with already running entity in the list */
++ if (cfs_rq->nr_running >= 1)
++ list_add_leaf_cfs_rq(cfs_rq);
+ }
+
+ return 0;
+@@ -4452,8 +4469,10 @@ static int tg_throttle_down(struct task_group *tg, void *data)
+ struct cfs_rq *cfs_rq = tg->cfs_rq[cpu_of(rq)];
+
+ /* group is entering throttled state, stop time */
+- if (!cfs_rq->throttle_count)
++ if (!cfs_rq->throttle_count) {
+ cfs_rq->throttled_clock_task = rq_clock_task(rq);
++ list_del_leaf_cfs_rq(cfs_rq);
++ }
+ cfs_rq->throttle_count++;
+
+ return 0;
+@@ -4556,6 +4575,8 @@ void unthrottle_cfs_rq(struct cfs_rq *cfs_rq)
+ break;
+ }
+
++ assert_list_leaf_cfs_rq(rq);
++
+ if (!se)
+ add_nr_running(rq, task_delta);
+
+@@ -7441,10 +7462,27 @@ static inline bool others_have_blocked(struct rq *rq)
+
+ #ifdef CONFIG_FAIR_GROUP_SCHED
+
++static inline bool cfs_rq_is_decayed(struct cfs_rq *cfs_rq)
++{
++ if (cfs_rq->load.weight)
++ return false;
++
++ if (cfs_rq->avg.load_sum)
++ return false;
++
++ if (cfs_rq->avg.util_sum)
++ return false;
++
++ if (cfs_rq->avg.runnable_load_sum)
++ return false;
++
++ return true;
++}
++
+ static void update_blocked_averages(int cpu)
+ {
+ struct rq *rq = cpu_rq(cpu);
+- struct cfs_rq *cfs_rq;
++ struct cfs_rq *cfs_rq, *pos;
+ const struct sched_class *curr_class;
+ struct rq_flags rf;
+ bool done = true;
+@@ -7456,13 +7494,9 @@ static void update_blocked_averages(int cpu)
+ * Iterates the task_group tree in a bottom up fashion, see
+ * list_add_leaf_cfs_rq() for details.
+ */
+- for_each_leaf_cfs_rq(rq, cfs_rq) {
++ for_each_leaf_cfs_rq_safe(rq, cfs_rq, pos) {
+ struct sched_entity *se;
+
+- /* throttled entities do not contribute to load */
+- if (throttled_hierarchy(cfs_rq))
+- continue;
+-
+ if (update_cfs_rq_load_avg(cfs_rq_clock_task(cfs_rq), cfs_rq))
+ update_tg_load_avg(cfs_rq, 0);
+
+@@ -7471,6 +7505,13 @@ static void update_blocked_averages(int cpu)
+ if (se && !skip_blocked_update(se))
+ update_load_avg(cfs_rq_of(se), se, 0);
+
++ /*
++ * There can be a lot of idle CPU cgroups. Don't let fully
++ * decayed cfs_rqs linger on the list.
++ */
++ if (cfs_rq_is_decayed(cfs_rq))
++ list_del_leaf_cfs_rq(cfs_rq);
++
+ /* Don't need periodic decay once load/util_avg are null */
+ if (cfs_rq_has_blocked(cfs_rq))
+ done = false;
+@@ -10256,10 +10297,10 @@ const struct sched_class fair_sched_class = {
+ #ifdef CONFIG_SCHED_DEBUG
+ void print_cfs_stats(struct seq_file *m, int cpu)
+ {
+- struct cfs_rq *cfs_rq;
++ struct cfs_rq *cfs_rq, *pos;
+
+ rcu_read_lock();
+- for_each_leaf_cfs_rq(cpu_rq(cpu), cfs_rq)
++ for_each_leaf_cfs_rq_safe(cpu_rq(cpu), cfs_rq, pos)
+ print_cfs_rq(m, cpu, cfs_rq);
+ rcu_read_unlock();
+ }
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index e61aa1c68e99..c41f7d1ab5fa 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1549,6 +1549,7 @@ static __init int init_trace_selftests(void)
+
+ pr_info("Running postponed tracer tests:\n");
+
++ tracing_selftest_running = true;
+ list_for_each_entry_safe(p, n, &postponed_selftests, list) {
+ ret = run_tracer_selftest(p->type);
+ /* If the test fails, then warn and remove from available_tracers */
+@@ -1567,6 +1568,7 @@ static __init int init_trace_selftests(void)
+ list_del(&p->list);
+ kfree(p);
+ }
++ tracing_selftest_running = false;
+
+ out:
+ mutex_unlock(&trace_types_lock);
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 5bb93cf18009..146998357bed 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -173,16 +173,13 @@ static ssize_t enabled_store(struct kobject *kobj,
+ {
+ ssize_t ret = count;
+
+- if (!memcmp("always", buf,
+- min(sizeof("always")-1, count))) {
++ if (sysfs_streq(buf, "always")) {
+ clear_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG, &transparent_hugepage_flags);
+ set_bit(TRANSPARENT_HUGEPAGE_FLAG, &transparent_hugepage_flags);
+- } else if (!memcmp("madvise", buf,
+- min(sizeof("madvise")-1, count))) {
++ } else if (sysfs_streq(buf, "madvise")) {
+ clear_bit(TRANSPARENT_HUGEPAGE_FLAG, &transparent_hugepage_flags);
+ set_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG, &transparent_hugepage_flags);
+- } else if (!memcmp("never", buf,
+- min(sizeof("never")-1, count))) {
++ } else if (sysfs_streq(buf, "never")) {
+ clear_bit(TRANSPARENT_HUGEPAGE_FLAG, &transparent_hugepage_flags);
+ clear_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG, &transparent_hugepage_flags);
+ } else
+@@ -246,32 +243,27 @@ static ssize_t defrag_store(struct kobject *kobj,
+ struct kobj_attribute *attr,
+ const char *buf, size_t count)
+ {
+- if (!memcmp("always", buf,
+- min(sizeof("always")-1, count))) {
++ if (sysfs_streq(buf, "always")) {
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
+ set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
+- } else if (!memcmp("defer+madvise", buf,
+- min(sizeof("defer+madvise")-1, count))) {
++ } else if (sysfs_streq(buf, "defer+madvise")) {
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
+ set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
+- } else if (!memcmp("defer", buf,
+- min(sizeof("defer")-1, count))) {
++ } else if (sysfs_streq(buf, "defer")) {
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
+ set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
+- } else if (!memcmp("madvise", buf,
+- min(sizeof("madvise")-1, count))) {
++ } else if (sysfs_streq(buf, "madvise")) {
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
+ set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
+- } else if (!memcmp("never", buf,
+- min(sizeof("never")-1, count))) {
++ } else if (sysfs_streq(buf, "never")) {
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
+ clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
+@@ -2661,7 +2653,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+ unsigned long flags;
+ pgoff_t end;
+
+- VM_BUG_ON_PAGE(is_huge_zero_page(page), page);
++ VM_BUG_ON_PAGE(is_huge_zero_page(head), head);
+ VM_BUG_ON_PAGE(!PageLocked(page), page);
+ VM_BUG_ON_PAGE(!PageCompound(page), page);
+
+diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
+index 0ff3953f64aa..8916c5d9b3b3 100644
+--- a/net/core/fib_rules.c
++++ b/net/core/fib_rules.c
+@@ -968,7 +968,7 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
+
+ frh = nlmsg_data(nlh);
+ frh->family = ops->family;
+- frh->table = rule->table;
++ frh->table = rule->table < 256 ? rule->table : RT_TABLE_COMPAT;
+ if (nla_put_u32(skb, FRA_TABLE, rule->table))
+ goto nla_put_failure;
+ if (nla_put_u32(skb, FRA_SUPPRESS_PREFIXLEN, rule->suppress_prefixlen))
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 7091568b9f63..5e8979c1f76d 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -981,8 +981,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
+ found++;
+ break;
+ }
+- if (rt_can_ecmp)
+- fallback_ins = fallback_ins ?: ins;
++ fallback_ins = fallback_ins ?: ins;
+ goto next_iter;
+ }
+
+@@ -1025,7 +1024,9 @@ next_iter:
+ }
+
+ if (fallback_ins && !found) {
+- /* No ECMP-able route found, replace first non-ECMP one */
++ /* No matching route with same ecmp-able-ness found, replace
++ * first matching route
++ */
+ ins = fallback_ins;
+ iter = rcu_dereference_protected(*ins,
+ lockdep_is_held(&rt->fib6_table->tb6_lock));
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index f8fe4c9ead4d..9c36a743ddbc 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -4514,6 +4514,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
+ */
+ cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
+ NLM_F_REPLACE);
++ cfg->fc_nlinfo.nlh->nlmsg_flags |= NLM_F_CREATE;
+ nhn++;
+ }
+
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index f101a6460b44..7fa9871b1db9 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -945,16 +945,22 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+ elem_parse_failed = true;
+ break;
+ case WLAN_EID_VHT_OPERATION:
+- if (elen >= sizeof(struct ieee80211_vht_operation))
++ if (elen >= sizeof(struct ieee80211_vht_operation)) {
+ elems->vht_operation = (void *)pos;
+- else
+- elem_parse_failed = true;
++ if (calc_crc)
++ crc = crc32_be(crc, pos - 2, elen + 2);
++ break;
++ }
++ elem_parse_failed = true;
+ break;
+ case WLAN_EID_OPMODE_NOTIF:
+- if (elen > 0)
++ if (elen > 0) {
+ elems->opmode_notif = pos;
+- else
+- elem_parse_failed = true;
++ if (calc_crc)
++ crc = crc32_be(crc, pos - 2, elen + 2);
++ break;
++ }
++ elem_parse_failed = true;
+ break;
+ case WLAN_EID_MESH_ID:
+ elems->mesh_id = pos;
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index 5e66042ac346..1c6d15ea76d4 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -467,8 +467,8 @@ static int nft_tunnel_opts_dump(struct sk_buff *skb,
+ static int nft_tunnel_ports_dump(struct sk_buff *skb,
+ struct ip_tunnel_info *info)
+ {
+- if (nla_put_be16(skb, NFTA_TUNNEL_KEY_SPORT, htons(info->key.tp_src)) < 0 ||
+- nla_put_be16(skb, NFTA_TUNNEL_KEY_DPORT, htons(info->key.tp_dst)) < 0)
++ if (nla_put_be16(skb, NFTA_TUNNEL_KEY_SPORT, info->key.tp_src) < 0 ||
++ nla_put_be16(skb, NFTA_TUNNEL_KEY_DPORT, info->key.tp_dst) < 0)
+ return -1;
+
+ return 0;
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 930d17fa906c..4a1b1bb39b4b 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1029,7 +1029,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
+ if (nlk->netlink_bind && groups) {
+ int group;
+
+- for (group = 0; group < nlk->ngroups; group++) {
++ /* nl_groups is a u32, so cap the maximum groups we can bind */
++ for (group = 0; group < BITS_PER_TYPE(u32); group++) {
+ if (!test_bit(group, &groups))
+ continue;
+ err = nlk->netlink_bind(net, group + 1);
+@@ -1048,7 +1049,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
+ netlink_insert(sk, nladdr->nl_pid) :
+ netlink_autobind(sock);
+ if (err) {
+- netlink_undo_bind(nlk->ngroups, groups, sk);
++ netlink_undo_bind(BITS_PER_TYPE(u32), groups, sk);
+ goto unlock;
+ }
+ }
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index c006d3b89ba3..44ca31f8538d 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -196,6 +196,7 @@ static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp,
+ struct fl_flow_key skb_mkey;
+
+ list_for_each_entry_rcu(mask, &head->masks, list) {
++ flow_dissector_init_keys(&skb_key.control, &skb_key.basic);
+ fl_clear_masked_range(&skb_key, mask);
+
+ skb_key.indev_ifindex = skb->skb_iif;
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 559f09ac0b22..9f4d325f3a79 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -185,6 +185,16 @@ static inline bool sctp_chunk_length_valid(struct sctp_chunk *chunk,
+ return true;
+ }
+
++/* Check for format error in an ABORT chunk */
++static inline bool sctp_err_chunk_valid(struct sctp_chunk *chunk)
++{
++ struct sctp_errhdr *err;
++
++ sctp_walk_errors(err, chunk->chunk_hdr);
++
++ return (void *)err == (void *)chunk->chunk_end;
++}
++
+ /**********************************************************
+ * These are the state functions for handling chunk events.
+ **********************************************************/
+@@ -2270,6 +2280,9 @@ enum sctp_disposition sctp_sf_shutdown_pending_abort(
+ sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
+ return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
+
++ if (!sctp_err_chunk_valid(chunk))
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
+ return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
+ }
+
+@@ -2313,6 +2326,9 @@ enum sctp_disposition sctp_sf_shutdown_sent_abort(
+ sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
+ return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
+
++ if (!sctp_err_chunk_valid(chunk))
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
+ /* Stop the T2-shutdown timer. */
+ sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
+ SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
+@@ -2580,6 +2596,9 @@ enum sctp_disposition sctp_sf_do_9_1_abort(
+ sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
+ return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
+
++ if (!sctp_err_chunk_valid(chunk))
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
+ return __sctp_sf_do_9_1_abort(net, ep, asoc, type, arg, commands);
+ }
+
+@@ -2597,16 +2616,8 @@ static enum sctp_disposition __sctp_sf_do_9_1_abort(
+
+ /* See if we have an error cause code in the chunk. */
+ len = ntohs(chunk->chunk_hdr->length);
+- if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) {
+- struct sctp_errhdr *err;
+-
+- sctp_walk_errors(err, chunk->chunk_hdr);
+- if ((void *)err != (void *)chunk->chunk_end)
+- return sctp_sf_pdiscard(net, ep, asoc, type, arg,
+- commands);
+-
++ if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
+ error = ((struct sctp_errhdr *)chunk->skb->data)->cause;
+- }
+
+ sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
+ /* ASSOC_FAILED will DELETE_TCB. */
+diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
+index 52241d679cc9..aa9a17ac1f7b 100644
+--- a/net/smc/smc_clc.c
++++ b/net/smc/smc_clc.c
+@@ -364,7 +364,9 @@ int smc_clc_send_decline(struct smc_sock *smc, u32 peer_diag_info)
+ dclc.hdr.length = htons(sizeof(struct smc_clc_msg_decline));
+ dclc.hdr.version = SMC_CLC_V1;
+ dclc.hdr.flag = (peer_diag_info == SMC_CLC_DECL_SYNCERR) ? 1 : 0;
+- memcpy(dclc.id_for_peer, local_systemid, sizeof(local_systemid));
++ if (smc->conn.lgr && !smc->conn.lgr->is_smcd)
++ memcpy(dclc.id_for_peer, local_systemid,
++ sizeof(local_systemid));
+ dclc.peer_diagnosis = htonl(peer_diag_info);
+ memcpy(dclc.trl.eyecatcher, SMC_EYECATCHER, sizeof(SMC_EYECATCHER));
+
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index 0a613e0ef3bf..8f40bbfd60ea 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -506,7 +506,7 @@ struct tls_record_info *tls_get_record(struct tls_offload_context_tx *context,
+ u32 seq, u64 *p_record_sn)
+ {
+ u64 record_sn = context->hint_record_sn;
+- struct tls_record_info *info;
++ struct tls_record_info *info, *last;
+
+ info = context->retransmit_hint;
+ if (!info ||
+@@ -516,6 +516,25 @@ struct tls_record_info *tls_get_record(struct tls_offload_context_tx *context,
+ */
+ info = list_first_entry(&context->records_list,
+ struct tls_record_info, list);
++
++ /* send the start_marker record if seq number is before the
++ * tls offload start marker sequence number. This record is
++ * required to handle TCP packets which are before TLS offload
++ * started.
++ * And if it's not start marker, look if this seq number
++ * belongs to the list.
++ */
++ if (likely(!tls_record_is_start_marker(info))) {
++ /* we have the first record, get the last record to see
++ * if this seq number belongs to the list.
++ */
++ last = list_last_entry(&context->records_list,
++ struct tls_record_info, list);
++
++ if (!between(seq, tls_record_start_seq(info),
++ last->end_seq))
++ return NULL;
++ }
+ record_sn = context->unacked_record_sn;
+ }
+
+diff --git a/net/wireless/ethtool.c b/net/wireless/ethtool.c
+index a9c0f368db5d..24e18405cdb4 100644
+--- a/net/wireless/ethtool.c
++++ b/net/wireless/ethtool.c
+@@ -7,9 +7,13 @@
+ void cfg80211_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
+ {
+ struct wireless_dev *wdev = dev->ieee80211_ptr;
++ struct device *pdev = wiphy_dev(wdev->wiphy);
+
+- strlcpy(info->driver, wiphy_dev(wdev->wiphy)->driver->name,
+- sizeof(info->driver));
++ if (pdev->driver)
++ strlcpy(info->driver, pdev->driver->name,
++ sizeof(info->driver));
++ else
++ strlcpy(info->driver, "N/A", sizeof(info->driver));
+
+ strlcpy(info->version, init_utsname()->release, sizeof(info->version));
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 823dea187691..dfde06b8d25d 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -323,6 +323,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
+ [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
+ [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
++ [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
+ [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
+ [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
+ [NL80211_ATTR_PID] = { .type = NLA_U32 },
+diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
+index 692d2fa31c35..ed34902022c1 100644
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -2931,6 +2931,7 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
+
+ continue;
+ }
++ actions->ms.map = map;
+ top = pstack__peek(browser->pstack);
+ if (top == &browser->hists->dso_filter) {
+ /*
+diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c
+index bbb0e042d8e5..59475287e2e1 100644
+--- a/tools/perf/util/stat-shadow.c
++++ b/tools/perf/util/stat-shadow.c
+@@ -209,12 +209,12 @@ void perf_stat__update_shadow_stats(struct perf_evsel *counter, u64 count,
+ int cpu, struct runtime_stat *st)
+ {
+ int ctx = evsel_context(counter);
++ u64 count_ns = count;
+
+ count *= counter->scale;
+
+- if (perf_evsel__match(counter, SOFTWARE, SW_TASK_CLOCK) ||
+- perf_evsel__match(counter, SOFTWARE, SW_CPU_CLOCK))
+- update_runtime_stat(st, STAT_NSECS, 0, cpu, count);
++ if (perf_evsel__is_clock(counter))
++ update_runtime_stat(st, STAT_NSECS, 0, cpu, count_ns);
+ else if (perf_evsel__match(counter, HARDWARE, HW_CPU_CYCLES))
+ update_runtime_stat(st, STAT_CYCLES, ctx, cpu, count);
+ else if (perf_stat_evsel__is(counter, CYCLES_IN_TX))
+diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
+index c0885fb65767..7d1a7c0dc56a 100755
+--- a/tools/testing/selftests/net/fib_tests.sh
++++ b/tools/testing/selftests/net/fib_tests.sh
+@@ -848,6 +848,12 @@ ipv6_rt_replace_mpath()
+ check_route6 "2001:db8:104::/64 via 2001:db8:101::3 dev veth1 metric 1024"
+ log_test $? 0 "Multipath with single path via multipath attribute"
+
++ # multipath with dev-only
++ add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2"
++ run_cmd "$IP -6 ro replace 2001:db8:104::/64 dev veth1"
++ check_route6 "2001:db8:104::/64 dev veth1 metric 1024"
++ log_test $? 0 "Multipath with dev-only"
++
+ # route replace fails - invalid nexthop 1
+ add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2"
+ run_cmd "$IP -6 ro replace 2001:db8:104::/64 nexthop via 2001:db8:111::3 nexthop via 2001:db8:103::3"
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index beec19fcf8cd..4e499b78569b 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2024,12 +2024,12 @@ int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ if (slots->generation != ghc->generation)
+ __kvm_gfn_to_hva_cache_init(slots, ghc, ghc->gpa, ghc->len);
+
+- if (unlikely(!ghc->memslot))
+- return kvm_write_guest(kvm, gpa, data, len);
+-
+ if (kvm_is_error_hva(ghc->hva))
+ return -EFAULT;
+
++ if (unlikely(!ghc->memslot))
++ return kvm_write_guest(kvm, gpa, data, len);
++
+ r = __copy_to_user((void __user *)ghc->hva + offset, data, len);
+ if (r)
+ return -EFAULT;
+@@ -2057,12 +2057,12 @@ int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ if (slots->generation != ghc->generation)
+ __kvm_gfn_to_hva_cache_init(slots, ghc, ghc->gpa, ghc->len);
+
+- if (unlikely(!ghc->memslot))
+- return kvm_read_guest(kvm, ghc->gpa, data, len);
+-
+ if (kvm_is_error_hva(ghc->hva))
+ return -EFAULT;
+
++ if (unlikely(!ghc->memslot))
++ return kvm_read_guest(kvm, ghc->gpa, data, len);
++
+ r = __copy_from_user(data, (void __user *)ghc->hva, len);
+ if (r)
+ return -EFAULT;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-03-11 17:20 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-03-11 17:20 UTC (permalink / raw
To: gentoo-commits
commit: a7a2d5b8301b005322e03bf60e509e3f9c6775ab
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 11 17:19:48 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 11 17:19:48 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a7a2d5b8
Linux patch 4.19.109
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1108_linux-4.19.109.patch | 2869 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2873 insertions(+)
diff --git a/0000_README b/0000_README
index 65259b7..f28ed71 100644
--- a/0000_README
+++ b/0000_README
@@ -471,6 +471,10 @@ Patch: 1107_linux-4.19.108.patch
From: https://www.kernel.org
Desc: Linux 4.19.108
+Patch: 1108_linux-4.19.109.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.109
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1108_linux-4.19.109.patch b/1108_linux-4.19.109.patch
new file mode 100644
index 0000000..ed6fc38
--- /dev/null
+++ b/1108_linux-4.19.109.patch
@@ -0,0 +1,2869 @@
+diff --git a/Makefile b/Makefile
+index 313f0c8dd66f..059c5e0aac15 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 108
++SUBLEVEL = 109
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am437x-idk-evm.dts b/arch/arm/boot/dts/am437x-idk-evm.dts
+index 20132477a871..80603af33cab 100644
+--- a/arch/arm/boot/dts/am437x-idk-evm.dts
++++ b/arch/arm/boot/dts/am437x-idk-evm.dts
+@@ -525,11 +525,11 @@
+ * Supply voltage supervisor on board will not allow opp50 so
+ * disable it and set opp100 as suspend OPP.
+ */
+- opp50@300000000 {
++ opp50-300000000 {
+ status = "disabled";
+ };
+
+- opp100@600000000 {
++ opp100-600000000 {
+ opp-suspend;
+ };
+ };
+diff --git a/arch/arm/boot/dts/dra76x.dtsi b/arch/arm/boot/dts/dra76x.dtsi
+index 613e4dc0ed3e..216e1d1a69c7 100644
+--- a/arch/arm/boot/dts/dra76x.dtsi
++++ b/arch/arm/boot/dts/dra76x.dtsi
+@@ -81,3 +81,8 @@
+ reg = <0x3fc>;
+ };
+ };
++
++&mmc3 {
++ /* dra76x is not affected by i887 */
++ max-frequency = <96000000>;
++};
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi
+index 6486df3e2942..881cea0b61ba 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi
+@@ -183,7 +183,6 @@
+ pinctrl-0 = <&pinctrl_usdhc4>;
+ bus-width = <8>;
+ non-removable;
+- vmmc-supply = <&vdd_emmc_1p8>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm/boot/dts/imx7-colibri.dtsi b/arch/arm/boot/dts/imx7-colibri.dtsi
+index c1ed83131b49..37aeba999be3 100644
+--- a/arch/arm/boot/dts/imx7-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7-colibri.dtsi
+@@ -319,7 +319,6 @@
+ assigned-clock-rates = <400000000>;
+ bus-width = <8>;
+ fsl,tuning-step = <2>;
+- max-frequency = <100000000>;
+ vmmc-supply = <®_module_3v3>;
+ vqmmc-supply = <®_DCDC3>;
+ non-removable;
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index 7e22309bccac..074b4ec520c6 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -584,7 +584,7 @@
+ };
+
+ mdio0: mdio@2d24000 {
+- compatible = "fsl,etsec2-mdio";
++ compatible = "gianfar";
+ device_type = "mdio";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -593,7 +593,7 @@
+ };
+
+ mdio1: mdio@2d64000 {
+- compatible = "fsl,etsec2-mdio";
++ compatible = "gianfar";
+ device_type = "mdio";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/mach-imx/Makefile b/arch/arm/mach-imx/Makefile
+index bae179af21f6..e9cfe8e86f33 100644
+--- a/arch/arm/mach-imx/Makefile
++++ b/arch/arm/mach-imx/Makefile
+@@ -89,6 +89,8 @@ AFLAGS_suspend-imx6.o :=-Wa,-march=armv7-a
+ obj-$(CONFIG_SOC_IMX6) += suspend-imx6.o
+ obj-$(CONFIG_SOC_IMX53) += suspend-imx53.o
+ endif
++AFLAGS_resume-imx6.o :=-Wa,-march=armv7-a
++obj-$(CONFIG_SOC_IMX6) += resume-imx6.o
+ obj-$(CONFIG_SOC_IMX6) += pm-imx6.o
+
+ obj-$(CONFIG_SOC_IMX1) += mach-imx1.o
+diff --git a/arch/arm/mach-imx/common.h b/arch/arm/mach-imx/common.h
+index 423dd76bb6b8..9728e39cd182 100644
+--- a/arch/arm/mach-imx/common.h
++++ b/arch/arm/mach-imx/common.h
+@@ -103,17 +103,17 @@ void imx_cpu_die(unsigned int cpu);
+ int imx_cpu_kill(unsigned int cpu);
+
+ #ifdef CONFIG_SUSPEND
+-void v7_cpu_resume(void);
+ void imx53_suspend(void __iomem *ocram_vbase);
+ extern const u32 imx53_suspend_sz;
+ void imx6_suspend(void __iomem *ocram_vbase);
+ #else
+-static inline void v7_cpu_resume(void) {}
+ static inline void imx53_suspend(void __iomem *ocram_vbase) {}
+ static const u32 imx53_suspend_sz;
+ static inline void imx6_suspend(void __iomem *ocram_vbase) {}
+ #endif
+
++void v7_cpu_resume(void);
++
+ void imx6_pm_ccm_init(const char *ccm_compat);
+ void imx6q_pm_init(void);
+ void imx6dl_pm_init(void);
+diff --git a/arch/arm/mach-imx/resume-imx6.S b/arch/arm/mach-imx/resume-imx6.S
+new file mode 100644
+index 000000000000..5bd1ba7ef15b
+--- /dev/null
++++ b/arch/arm/mach-imx/resume-imx6.S
+@@ -0,0 +1,24 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright 2014 Freescale Semiconductor, Inc.
++ */
++
++#include <linux/linkage.h>
++#include <asm/assembler.h>
++#include <asm/asm-offsets.h>
++#include <asm/hardware/cache-l2x0.h>
++#include "hardware.h"
++
++/*
++ * The following code must assume it is running from physical address
++ * where absolute virtual addresses to the data section have to be
++ * turned into relative ones.
++ */
++
++ENTRY(v7_cpu_resume)
++ bl v7_invalidate_l1
++#ifdef CONFIG_CACHE_L2X0
++ bl l2c310_early_resume
++#endif
++ b cpu_resume
++ENDPROC(v7_cpu_resume)
+diff --git a/arch/arm/mach-imx/suspend-imx6.S b/arch/arm/mach-imx/suspend-imx6.S
+index 76ee2ceec8d5..7d84b617af48 100644
+--- a/arch/arm/mach-imx/suspend-imx6.S
++++ b/arch/arm/mach-imx/suspend-imx6.S
+@@ -333,17 +333,3 @@ resume:
+
+ ret lr
+ ENDPROC(imx6_suspend)
+-
+-/*
+- * The following code must assume it is running from physical address
+- * where absolute virtual addresses to the data section have to be
+- * turned into relative ones.
+- */
+-
+-ENTRY(v7_cpu_resume)
+- bl v7_invalidate_l1
+-#ifdef CONFIG_CACHE_L2X0
+- bl l2c310_early_resume
+-#endif
+- b cpu_resume
+-ENDPROC(v7_cpu_resume)
+diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
+index 1eab54bc6ee9..a2183bb54a29 100644
+--- a/arch/powerpc/kernel/cputable.c
++++ b/arch/powerpc/kernel/cputable.c
+@@ -2188,11 +2188,13 @@ static struct cpu_spec * __init setup_cpu_spec(unsigned long offset,
+ * oprofile_cpu_type already has a value, then we are
+ * possibly overriding a real PVR with a logical one,
+ * and, in that case, keep the current value for
+- * oprofile_cpu_type.
++ * oprofile_cpu_type. Futhermore, let's ensure that the
++ * fix for the PMAO bug is enabled on compatibility mode.
+ */
+ if (old.oprofile_cpu_type != NULL) {
+ t->oprofile_cpu_type = old.oprofile_cpu_type;
+ t->oprofile_type = old.oprofile_type;
++ t->cpu_features |= old.cpu_features & CPU_FTR_PMAO_BUG;
+ }
+ }
+
+diff --git a/arch/s390/Makefile b/arch/s390/Makefile
+index 4bccde36cb16..9a3a698c8fca 100644
+--- a/arch/s390/Makefile
++++ b/arch/s390/Makefile
+@@ -140,7 +140,7 @@ all: bzImage
+ #KBUILD_IMAGE is necessary for packaging targets like rpm-pkg, deb-pkg...
+ KBUILD_IMAGE := $(boot)/bzImage
+
+-install: vmlinux
++install:
+ $(Q)$(MAKE) $(build)=$(boot) $@
+
+ bzImage: vmlinux
+diff --git a/arch/s390/boot/Makefile b/arch/s390/boot/Makefile
+index f6a9b0c20355..45c72d1f9e7d 100644
+--- a/arch/s390/boot/Makefile
++++ b/arch/s390/boot/Makefile
+@@ -46,7 +46,7 @@ quiet_cmd_ar = AR $@
+ $(obj)/startup.a: $(OBJECTS) FORCE
+ $(call if_changed,ar)
+
+-install: $(CONFIGURE) $(obj)/bzImage
++install:
+ sh -x $(srctree)/$(obj)/install.sh $(KERNELRELEASE) $(obj)/bzImage \
+ System.map "$(INSTALL_PATH)"
+
+diff --git a/arch/s390/include/asm/qdio.h b/arch/s390/include/asm/qdio.h
+index 9c9970a5dfb1..1f2cd98dcb05 100644
+--- a/arch/s390/include/asm/qdio.h
++++ b/arch/s390/include/asm/qdio.h
+@@ -228,7 +228,7 @@ struct qdio_buffer {
+ * @sbal: absolute SBAL address
+ */
+ struct sl_element {
+- unsigned long sbal;
++ u64 sbal;
+ } __attribute__ ((packed));
+
+ /**
+diff --git a/arch/x86/boot/compressed/kaslr_64.c b/arch/x86/boot/compressed/kaslr_64.c
+index 748456c365f4..9557c5a15b91 100644
+--- a/arch/x86/boot/compressed/kaslr_64.c
++++ b/arch/x86/boot/compressed/kaslr_64.c
+@@ -29,9 +29,6 @@
+ #define __PAGE_OFFSET __PAGE_OFFSET_BASE
+ #include "../../mm/ident_map.c"
+
+-/* Used by pgtable.h asm code to force instruction serialization. */
+-unsigned long __force_order;
+-
+ /* Used to track our page table allocation area. */
+ struct alloc_pgt_data {
+ unsigned char *pgt_buf;
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index a6458ab499c2..7f43eba8d0c1 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -387,7 +387,7 @@ static __always_inline void setup_pku(struct cpuinfo_x86 *c)
+ * cpuid bit to be set. We need to ensure that we
+ * update that bit in this CPU's "cpu_info".
+ */
+- get_cpu_cap(c);
++ set_cpu_cap(c, X86_FEATURE_OSPKE);
+ }
+
+ #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index 6db8f3598c80..2a9a703ef4a0 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -313,7 +313,7 @@ void efi_sync_low_kernel_mappings(void)
+ static inline phys_addr_t
+ virt_to_phys_or_null_size(void *va, unsigned long size)
+ {
+- bool bad_size;
++ phys_addr_t pa;
+
+ if (!va)
+ return 0;
+@@ -321,16 +321,13 @@ virt_to_phys_or_null_size(void *va, unsigned long size)
+ if (virt_addr_valid(va))
+ return virt_to_phys(va);
+
+- /*
+- * A fully aligned variable on the stack is guaranteed not to
+- * cross a page bounary. Try to catch strings on the stack by
+- * checking that 'size' is a power of two.
+- */
+- bad_size = size > PAGE_SIZE || !is_power_of_2(size);
++ pa = slow_virt_to_phys(va);
+
+- WARN_ON(!IS_ALIGNED((unsigned long)va, size) || bad_size);
++ /* check if the object crosses a page boundary */
++ if (WARN_ON((pa ^ (pa + size - 1)) & PAGE_MASK))
++ return 0;
+
+- return slow_virt_to_phys(va);
++ return pa;
+ }
+
+ #define virt_to_phys_or_null(addr) \
+@@ -790,6 +787,8 @@ static efi_status_t
+ efi_thunk_get_variable(efi_char16_t *name, efi_guid_t *vendor,
+ u32 *attr, unsigned long *data_size, void *data)
+ {
++ u8 buf[24] __aligned(8);
++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd));
+ efi_status_t status;
+ u32 phys_name, phys_vendor, phys_attr;
+ u32 phys_data_size, phys_data;
+@@ -797,14 +796,19 @@ efi_thunk_get_variable(efi_char16_t *name, efi_guid_t *vendor,
+
+ spin_lock_irqsave(&efi_runtime_lock, flags);
+
++ *vnd = *vendor;
++
+ phys_data_size = virt_to_phys_or_null(data_size);
+- phys_vendor = virt_to_phys_or_null(vendor);
++ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
+ phys_attr = virt_to_phys_or_null(attr);
+ phys_data = virt_to_phys_or_null_size(data, *data_size);
+
+- status = efi_thunk(get_variable, phys_name, phys_vendor,
+- phys_attr, phys_data_size, phys_data);
++ if (!phys_name || (data && !phys_data))
++ status = EFI_INVALID_PARAMETER;
++ else
++ status = efi_thunk(get_variable, phys_name, phys_vendor,
++ phys_attr, phys_data_size, phys_data);
+
+ spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
+@@ -815,19 +819,25 @@ static efi_status_t
+ efi_thunk_set_variable(efi_char16_t *name, efi_guid_t *vendor,
+ u32 attr, unsigned long data_size, void *data)
+ {
++ u8 buf[24] __aligned(8);
++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd));
+ u32 phys_name, phys_vendor, phys_data;
+ efi_status_t status;
+ unsigned long flags;
+
+ spin_lock_irqsave(&efi_runtime_lock, flags);
+
++ *vnd = *vendor;
++
+ phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
+- phys_vendor = virt_to_phys_or_null(vendor);
++ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_data = virt_to_phys_or_null_size(data, data_size);
+
+- /* If data_size is > sizeof(u32) we've got problems */
+- status = efi_thunk(set_variable, phys_name, phys_vendor,
+- attr, data_size, phys_data);
++ if (!phys_name || !phys_data)
++ status = EFI_INVALID_PARAMETER;
++ else
++ status = efi_thunk(set_variable, phys_name, phys_vendor,
++ attr, data_size, phys_data);
+
+ spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
+@@ -839,6 +849,8 @@ efi_thunk_set_variable_nonblocking(efi_char16_t *name, efi_guid_t *vendor,
+ u32 attr, unsigned long data_size,
+ void *data)
+ {
++ u8 buf[24] __aligned(8);
++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd));
+ u32 phys_name, phys_vendor, phys_data;
+ efi_status_t status;
+ unsigned long flags;
+@@ -846,13 +858,17 @@ efi_thunk_set_variable_nonblocking(efi_char16_t *name, efi_guid_t *vendor,
+ if (!spin_trylock_irqsave(&efi_runtime_lock, flags))
+ return EFI_NOT_READY;
+
++ *vnd = *vendor;
++
+ phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
+- phys_vendor = virt_to_phys_or_null(vendor);
++ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_data = virt_to_phys_or_null_size(data, data_size);
+
+- /* If data_size is > sizeof(u32) we've got problems */
+- status = efi_thunk(set_variable, phys_name, phys_vendor,
+- attr, data_size, phys_data);
++ if (!phys_name || !phys_data)
++ status = EFI_INVALID_PARAMETER;
++ else
++ status = efi_thunk(set_variable, phys_name, phys_vendor,
++ attr, data_size, phys_data);
+
+ spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
+@@ -864,21 +880,29 @@ efi_thunk_get_next_variable(unsigned long *name_size,
+ efi_char16_t *name,
+ efi_guid_t *vendor)
+ {
++ u8 buf[24] __aligned(8);
++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd));
+ efi_status_t status;
+ u32 phys_name_size, phys_name, phys_vendor;
+ unsigned long flags;
+
+ spin_lock_irqsave(&efi_runtime_lock, flags);
+
++ *vnd = *vendor;
++
+ phys_name_size = virt_to_phys_or_null(name_size);
+- phys_vendor = virt_to_phys_or_null(vendor);
++ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_name = virt_to_phys_or_null_size(name, *name_size);
+
+- status = efi_thunk(get_next_variable, phys_name_size,
+- phys_name, phys_vendor);
++ if (!phys_name)
++ status = EFI_INVALID_PARAMETER;
++ else
++ status = efi_thunk(get_next_variable, phys_name_size,
++ phys_name, phys_vendor);
+
+ spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
++ *vendor = *vnd;
+ return status;
+ }
+
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 1730a26ff6ab..76864ea59160 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -908,14 +908,15 @@ static u64 xen_read_msr_safe(unsigned int msr, int *err)
+ static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
+ {
+ int ret;
++#ifdef CONFIG_X86_64
++ unsigned int which;
++ u64 base;
++#endif
+
+ ret = 0;
+
+ switch (msr) {
+ #ifdef CONFIG_X86_64
+- unsigned which;
+- u64 base;
+-
+ case MSR_FS_BASE: which = SEGBASE_FS; goto set;
+ case MSR_KERNEL_GS_BASE: which = SEGBASE_GS_USER; goto set;
+ case MSR_GS_BASE: which = SEGBASE_GS_KERNEL; goto set;
+diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c
+index cee78f9c4794..935d1697ec36 100644
+--- a/drivers/dma/coh901318.c
++++ b/drivers/dma/coh901318.c
+@@ -1944,8 +1944,6 @@ static void dma_tc_handle(struct coh901318_chan *cohc)
+ return;
+ }
+
+- spin_lock(&cohc->lock);
+-
+ /*
+ * When we reach this point, at least one queue item
+ * should have been moved over from cohc->queue to
+@@ -1966,8 +1964,6 @@ static void dma_tc_handle(struct coh901318_chan *cohc)
+ if (coh901318_queue_start(cohc) == NULL)
+ cohc->busy = 0;
+
+- spin_unlock(&cohc->lock);
+-
+ /*
+ * This tasklet will remove items from cohc->active
+ * and thus terminates them.
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index ceb82e74f5b4..eea89c3b54c1 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -335,6 +335,7 @@ struct sdma_desc {
+ * @sdma: pointer to the SDMA engine for this channel
+ * @channel: the channel number, matches dmaengine chan_id + 1
+ * @direction: transfer type. Needed for setting SDMA script
++ * @slave_config Slave configuration
+ * @peripheral_type: Peripheral type. Needed for setting SDMA script
+ * @event_id0: aka dma request line
+ * @event_id1: for channels that use 2 events
+@@ -362,6 +363,7 @@ struct sdma_channel {
+ struct sdma_engine *sdma;
+ unsigned int channel;
+ enum dma_transfer_direction direction;
++ struct dma_slave_config slave_config;
+ enum sdma_peripheral_type peripheral_type;
+ unsigned int event_id0;
+ unsigned int event_id1;
+@@ -440,6 +442,10 @@ struct sdma_engine {
+ struct sdma_buffer_descriptor *bd0;
+ };
+
++static int sdma_config_write(struct dma_chan *chan,
++ struct dma_slave_config *dmaengine_cfg,
++ enum dma_transfer_direction direction);
++
+ static struct sdma_driver_data sdma_imx31 = {
+ .chnenbl0 = SDMA_CHNENBL0_IMX31,
+ .num_events = 32,
+@@ -1122,18 +1128,6 @@ static int sdma_config_channel(struct dma_chan *chan)
+ sdmac->shp_addr = 0;
+ sdmac->per_addr = 0;
+
+- if (sdmac->event_id0) {
+- if (sdmac->event_id0 >= sdmac->sdma->drvdata->num_events)
+- return -EINVAL;
+- sdma_event_enable(sdmac, sdmac->event_id0);
+- }
+-
+- if (sdmac->event_id1) {
+- if (sdmac->event_id1 >= sdmac->sdma->drvdata->num_events)
+- return -EINVAL;
+- sdma_event_enable(sdmac, sdmac->event_id1);
+- }
+-
+ switch (sdmac->peripheral_type) {
+ case IMX_DMATYPE_DSP:
+ sdma_config_ownership(sdmac, false, true, true);
+@@ -1431,6 +1425,8 @@ static struct dma_async_tx_descriptor *sdma_prep_slave_sg(
+ struct scatterlist *sg;
+ struct sdma_desc *desc;
+
++ sdma_config_write(chan, &sdmac->slave_config, direction);
++
+ desc = sdma_transfer_init(sdmac, direction, sg_len);
+ if (!desc)
+ goto err_out;
+@@ -1515,6 +1511,8 @@ static struct dma_async_tx_descriptor *sdma_prep_dma_cyclic(
+
+ dev_dbg(sdma->dev, "%s channel: %d\n", __func__, channel);
+
++ sdma_config_write(chan, &sdmac->slave_config, direction);
++
+ desc = sdma_transfer_init(sdmac, direction, num_periods);
+ if (!desc)
+ goto err_out;
+@@ -1570,17 +1568,18 @@ err_out:
+ return NULL;
+ }
+
+-static int sdma_config(struct dma_chan *chan,
+- struct dma_slave_config *dmaengine_cfg)
++static int sdma_config_write(struct dma_chan *chan,
++ struct dma_slave_config *dmaengine_cfg,
++ enum dma_transfer_direction direction)
+ {
+ struct sdma_channel *sdmac = to_sdma_chan(chan);
+
+- if (dmaengine_cfg->direction == DMA_DEV_TO_MEM) {
++ if (direction == DMA_DEV_TO_MEM) {
+ sdmac->per_address = dmaengine_cfg->src_addr;
+ sdmac->watermark_level = dmaengine_cfg->src_maxburst *
+ dmaengine_cfg->src_addr_width;
+ sdmac->word_size = dmaengine_cfg->src_addr_width;
+- } else if (dmaengine_cfg->direction == DMA_DEV_TO_DEV) {
++ } else if (direction == DMA_DEV_TO_DEV) {
+ sdmac->per_address2 = dmaengine_cfg->src_addr;
+ sdmac->per_address = dmaengine_cfg->dst_addr;
+ sdmac->watermark_level = dmaengine_cfg->src_maxburst &
+@@ -1594,10 +1593,33 @@ static int sdma_config(struct dma_chan *chan,
+ dmaengine_cfg->dst_addr_width;
+ sdmac->word_size = dmaengine_cfg->dst_addr_width;
+ }
+- sdmac->direction = dmaengine_cfg->direction;
++ sdmac->direction = direction;
+ return sdma_config_channel(chan);
+ }
+
++static int sdma_config(struct dma_chan *chan,
++ struct dma_slave_config *dmaengine_cfg)
++{
++ struct sdma_channel *sdmac = to_sdma_chan(chan);
++
++ memcpy(&sdmac->slave_config, dmaengine_cfg, sizeof(*dmaengine_cfg));
++
++ /* Set ENBLn earlier to make sure dma request triggered after that */
++ if (sdmac->event_id0) {
++ if (sdmac->event_id0 >= sdmac->sdma->drvdata->num_events)
++ return -EINVAL;
++ sdma_event_enable(sdmac, sdmac->event_id0);
++ }
++
++ if (sdmac->event_id1) {
++ if (sdmac->event_id1 >= sdmac->sdma->drvdata->num_events)
++ return -EINVAL;
++ sdma_event_enable(sdmac, sdmac->event_id1);
++ }
++
++ return 0;
++}
++
+ static enum dma_status sdma_tx_status(struct dma_chan *chan,
+ dma_cookie_t cookie,
+ struct dma_tx_state *txstate)
+diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
+index fb23993430d3..15481aeaeecd 100644
+--- a/drivers/dma/tegra20-apb-dma.c
++++ b/drivers/dma/tegra20-apb-dma.c
+@@ -288,7 +288,7 @@ static struct tegra_dma_desc *tegra_dma_desc_get(
+
+ /* Do not allocate if desc are waiting for ack */
+ list_for_each_entry(dma_desc, &tdc->free_dma_desc, node) {
+- if (async_tx_test_ack(&dma_desc->txd)) {
++ if (async_tx_test_ack(&dma_desc->txd) && !dma_desc->cb_count) {
+ list_del(&dma_desc->node);
+ spin_unlock_irqrestore(&tdc->lock, flags);
+ dma_desc->txd.flags = 0;
+@@ -756,10 +756,6 @@ static int tegra_dma_terminate_all(struct dma_chan *dc)
+ bool was_busy;
+
+ spin_lock_irqsave(&tdc->lock, flags);
+- if (list_empty(&tdc->pending_sg_req)) {
+- spin_unlock_irqrestore(&tdc->lock, flags);
+- return 0;
+- }
+
+ if (!tdc->busy)
+ goto skip_dma_stop;
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 94265e438514..05d6f9c86ac3 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2863,6 +2863,7 @@ static int init_csrows(struct mem_ctl_info *mci)
+ dimm = csrow->channels[j]->dimm;
+ dimm->mtype = pvt->dram_type;
+ dimm->edac_mode = edac_mode;
++ dimm->grain = 64;
+ }
+ }
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+index b1da9ce54379..aa28a43ff842 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+@@ -1118,8 +1118,8 @@ static void mdp5_crtc_wait_for_pp_done(struct drm_crtc *crtc)
+ ret = wait_for_completion_timeout(&mdp5_crtc->pp_completion,
+ msecs_to_jiffies(50));
+ if (ret == 0)
+- dev_warn(dev->dev, "pp done time out, lm=%d\n",
+- mdp5_cstate->pipeline.mixer->lm);
++ dev_warn_ratelimited(dev->dev, "pp done time out, lm=%d\n",
++ mdp5_cstate->pipeline.mixer->lm);
+ }
+
+ static void mdp5_crtc_wait_for_flush_done(struct drm_crtc *crtc)
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_manager.c b/drivers/gpu/drm/msm/dsi/dsi_manager.c
+index 5224010d90e4..b01762a7778a 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_manager.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_manager.c
+@@ -328,7 +328,7 @@ static int dsi_mgr_connector_get_modes(struct drm_connector *connector)
+ return num;
+ }
+
+-static int dsi_mgr_connector_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status dsi_mgr_connector_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+ {
+ int id = dsi_mgr_connector_get_id(connector);
+@@ -471,6 +471,7 @@ static void dsi_mgr_bridge_post_disable(struct drm_bridge *bridge)
+ struct msm_dsi *msm_dsi1 = dsi_mgr_get_dsi(DSI_1);
+ struct mipi_dsi_host *host = msm_dsi->host;
+ struct drm_panel *panel = msm_dsi->panel;
++ struct msm_dsi_pll *src_pll;
+ bool is_dual_dsi = IS_DUAL_DSI();
+ int ret;
+
+@@ -511,6 +512,10 @@ static void dsi_mgr_bridge_post_disable(struct drm_bridge *bridge)
+ id, ret);
+ }
+
++ /* Save PLL status if it is a clock source */
++ src_pll = msm_dsi_phy_get_pll(msm_dsi->phy);
++ msm_dsi_pll_save_state(src_pll);
++
+ ret = msm_dsi_host_power_off(host);
+ if (ret)
+ pr_err("%s: host %d power off failed,%d\n", __func__, id, ret);
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+index 9a9fa0c75a13..c630871de7c5 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+@@ -726,10 +726,6 @@ void msm_dsi_phy_disable(struct msm_dsi_phy *phy)
+ if (!phy || !phy->cfg->ops.disable)
+ return;
+
+- /* Save PLL status if it is a clock source */
+- if (phy->usecase != MSM_DSI_PHY_SLAVE)
+- msm_dsi_pll_save_state(phy->pll);
+-
+ phy->cfg->ops.disable(phy);
+
+ dsi_phy_regulator_disable(phy);
+diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+index 31205625c734..21a69b046625 100644
+--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+@@ -406,6 +406,12 @@ static int dsi_pll_10nm_vco_prepare(struct clk_hw *hw)
+ if (pll_10nm->slave)
+ dsi_pll_enable_pll_bias(pll_10nm->slave);
+
++ rc = dsi_pll_10nm_vco_set_rate(hw,pll_10nm->vco_current_rate, 0);
++ if (rc) {
++ pr_err("vco_set_rate failed, rc=%d\n", rc);
++ return rc;
++ }
++
+ /* Start PLL */
+ pll_write(pll_10nm->phy_cmn_mmio + REG_DSI_10nm_PHY_CMN_PLL_CNTRL,
+ 0x01);
+diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.c b/drivers/gpu/drm/sun4i/sun8i_mixer.c
+index cb65b0ed53fd..71a798e5d559 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c
+@@ -110,48 +110,104 @@ static const struct de2_fmt_info de2_formats[] = {
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
++ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XRGB4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
+ {
+ .drm_fmt = DRM_FORMAT_ABGR4444,
+ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR4444,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
++ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XBGR4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
+ {
+ .drm_fmt = DRM_FORMAT_RGBA4444,
+ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA4444,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
++ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_RGBX4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
+ {
+ .drm_fmt = DRM_FORMAT_BGRA4444,
+ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA4444,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
++ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_BGRX4444,
++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA4444,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
+ {
+ .drm_fmt = DRM_FORMAT_ARGB1555,
+ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB1555,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
++ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XRGB1555,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB1555,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
+ {
+ .drm_fmt = DRM_FORMAT_ABGR1555,
+ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR1555,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
++ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_XBGR1555,
++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR1555,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
+ {
+ .drm_fmt = DRM_FORMAT_RGBA5551,
+ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA5551,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
++ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_RGBX5551,
++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA5551,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
+ {
+ .drm_fmt = DRM_FORMAT_BGRA5551,
+ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA5551,
+ .rgb = true,
+ .csc = SUN8I_CSC_MODE_OFF,
+ },
++ {
++ /* for DE2 VI layer which ignores alpha */
++ .drm_fmt = DRM_FORMAT_BGRX5551,
++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA5551,
++ .rgb = true,
++ .csc = SUN8I_CSC_MODE_OFF,
++ },
+ {
+ .drm_fmt = DRM_FORMAT_UYVY,
+ .de2_fmt = SUN8I_MIXER_FBFMT_UYVY,
+@@ -200,12 +256,6 @@ static const struct de2_fmt_info de2_formats[] = {
+ .rgb = false,
+ .csc = SUN8I_CSC_MODE_YUV2RGB,
+ },
+- {
+- .drm_fmt = DRM_FORMAT_YUV444,
+- .de2_fmt = SUN8I_MIXER_FBFMT_RGB888,
+- .rgb = true,
+- .csc = SUN8I_CSC_MODE_YUV2RGB,
+- },
+ {
+ .drm_fmt = DRM_FORMAT_YUV422,
+ .de2_fmt = SUN8I_MIXER_FBFMT_YUV422,
+@@ -224,12 +274,6 @@ static const struct de2_fmt_info de2_formats[] = {
+ .rgb = false,
+ .csc = SUN8I_CSC_MODE_YUV2RGB,
+ },
+- {
+- .drm_fmt = DRM_FORMAT_YVU444,
+- .de2_fmt = SUN8I_MIXER_FBFMT_RGB888,
+- .rgb = true,
+- .csc = SUN8I_CSC_MODE_YVU2RGB,
+- },
+ {
+ .drm_fmt = DRM_FORMAT_YVU422,
+ .de2_fmt = SUN8I_MIXER_FBFMT_YUV422,
+diff --git a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
+index f4fe97813f94..15fc6363cc43 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
+@@ -330,26 +330,26 @@ static const struct drm_plane_funcs sun8i_vi_layer_funcs = {
+ };
+
+ /*
+- * While all RGB formats are supported, VI planes don't support
+- * alpha blending, so there is no point having formats with alpha
+- * channel if their opaque analog exist.
++ * While DE2 VI layer supports same RGB formats as UI layer, alpha
++ * channel is ignored. This structure lists all unique variants
++ * where alpha channel is replaced with "don't care" (X) channel.
+ */
+ static const u32 sun8i_vi_layer_formats[] = {
+- DRM_FORMAT_ABGR1555,
+- DRM_FORMAT_ABGR4444,
+- DRM_FORMAT_ARGB1555,
+- DRM_FORMAT_ARGB4444,
+ DRM_FORMAT_BGR565,
+ DRM_FORMAT_BGR888,
+- DRM_FORMAT_BGRA5551,
+- DRM_FORMAT_BGRA4444,
++ DRM_FORMAT_BGRX4444,
++ DRM_FORMAT_BGRX5551,
+ DRM_FORMAT_BGRX8888,
+ DRM_FORMAT_RGB565,
+ DRM_FORMAT_RGB888,
+- DRM_FORMAT_RGBA4444,
+- DRM_FORMAT_RGBA5551,
++ DRM_FORMAT_RGBX4444,
++ DRM_FORMAT_RGBX5551,
+ DRM_FORMAT_RGBX8888,
++ DRM_FORMAT_XBGR1555,
++ DRM_FORMAT_XBGR4444,
+ DRM_FORMAT_XBGR8888,
++ DRM_FORMAT_XRGB1555,
++ DRM_FORMAT_XRGB4444,
+ DRM_FORMAT_XRGB8888,
+
+ DRM_FORMAT_NV16,
+@@ -363,11 +363,9 @@ static const u32 sun8i_vi_layer_formats[] = {
+ DRM_FORMAT_YUV411,
+ DRM_FORMAT_YUV420,
+ DRM_FORMAT_YUV422,
+- DRM_FORMAT_YUV444,
+ DRM_FORMAT_YVU411,
+ DRM_FORMAT_YVU420,
+ DRM_FORMAT_YVU422,
+- DRM_FORMAT_YVU444,
+ };
+
+ struct sun8i_vi_layer *sun8i_vi_layer_init_one(struct drm_device *drm,
+diff --git a/drivers/hwmon/adt7462.c b/drivers/hwmon/adt7462.c
+index 19f2a6d48bac..bdd7679fd298 100644
+--- a/drivers/hwmon/adt7462.c
++++ b/drivers/hwmon/adt7462.c
+@@ -426,7 +426,7 @@ static int ADT7462_REG_VOLT(struct adt7462_data *data, int which)
+ return 0x95;
+ break;
+ }
+- return -ENODEV;
++ return 0;
+ }
+
+ /* Provide labels for sysfs */
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 4c533275d1f2..64f206e11d49 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1231,6 +1231,7 @@ struct ib_cm_id *ib_cm_insert_listen(struct ib_device *device,
+ /* Sharing an ib_cm_id with different handlers is not
+ * supported */
+ spin_unlock_irqrestore(&cm.lock, flags);
++ ib_destroy_cm_id(cm_id);
+ return ERR_PTR(-EINVAL);
+ }
+ atomic_inc(&cm_id_priv->refcount);
+diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
+index 5d676cff41f4..99dd8452724d 100644
+--- a/drivers/infiniband/core/iwcm.c
++++ b/drivers/infiniband/core/iwcm.c
+@@ -158,8 +158,10 @@ static void dealloc_work_entries(struct iwcm_id_private *cm_id_priv)
+ {
+ struct list_head *e, *tmp;
+
+- list_for_each_safe(e, tmp, &cm_id_priv->work_free_list)
++ list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) {
++ list_del(e);
+ kfree(list_entry(e, struct iwcm_work, free_list));
++ }
+ }
+
+ static int alloc_work_entries(struct iwcm_id_private *cm_id_priv, int count)
+diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
+index 4e2565cccb8a..f2c2e725375e 100644
+--- a/drivers/infiniband/core/security.c
++++ b/drivers/infiniband/core/security.c
+@@ -337,15 +337,19 @@ static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp,
+ return NULL;
+
+ if (qp_attr_mask & IB_QP_PORT)
+- new_pps->main.port_num =
+- (qp_pps) ? qp_pps->main.port_num : qp_attr->port_num;
++ new_pps->main.port_num = qp_attr->port_num;
++ else if (qp_pps)
++ new_pps->main.port_num = qp_pps->main.port_num;
++
+ if (qp_attr_mask & IB_QP_PKEY_INDEX)
+- new_pps->main.pkey_index = (qp_pps) ? qp_pps->main.pkey_index :
+- qp_attr->pkey_index;
++ new_pps->main.pkey_index = qp_attr->pkey_index;
++ else if (qp_pps)
++ new_pps->main.pkey_index = qp_pps->main.pkey_index;
++
+ if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT))
+ new_pps->main.state = IB_PORT_PKEY_VALID;
+
+- if (!(qp_attr_mask & (IB_QP_PKEY_INDEX || IB_QP_PORT)) && qp_pps) {
++ if (!(qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) && qp_pps) {
+ new_pps->main.port_num = qp_pps->main.port_num;
+ new_pps->main.pkey_index = qp_pps->main.pkey_index;
+ if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index 90e12f9433a3..1cf1dfbf2596 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -595,10 +595,11 @@ static inline void hfi1_handle_packet(struct hfi1_packet *packet,
+ opa_get_lid(packet->dlid, 9B));
+ if (!mcast)
+ goto drop;
++ rcu_read_lock();
+ list_for_each_entry_rcu(p, &mcast->qp_list, list) {
+ packet->qp = p->qp;
+ if (hfi1_do_pkey_check(packet))
+- goto drop;
++ goto unlock_drop;
+ spin_lock_irqsave(&packet->qp->r_lock, flags);
+ packet_handler = qp_ok(packet);
+ if (likely(packet_handler))
+@@ -607,6 +608,7 @@ static inline void hfi1_handle_packet(struct hfi1_packet *packet,
+ ibp->rvp.n_pkt_drops++;
+ spin_unlock_irqrestore(&packet->qp->r_lock, flags);
+ }
++ rcu_read_unlock();
+ /*
+ * Notify rvt_multicast_detach() if it is waiting for us
+ * to finish.
+diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c
+index 803c3544c75b..5abbbb656a52 100644
+--- a/drivers/infiniband/hw/qib/qib_verbs.c
++++ b/drivers/infiniband/hw/qib/qib_verbs.c
+@@ -360,8 +360,10 @@ void qib_ib_rcv(struct qib_ctxtdata *rcd, void *rhdr, void *data, u32 tlen)
+ if (mcast == NULL)
+ goto drop;
+ this_cpu_inc(ibp->pmastats->n_multicast_rcv);
++ rcu_read_lock();
+ list_for_each_entry_rcu(p, &mcast->qp_list, list)
+ qib_qp_rcv(rcd, hdr, 1, data, tlen, p->qp);
++ rcu_read_unlock();
+ /*
+ * Notify rvt_multicast_detach() if it is waiting for us
+ * to finish.
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index 84ff70027c25..2ddd575e97f7 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -2859,8 +2859,8 @@ static void cache_postsuspend(struct dm_target *ti)
+ prevent_background_work(cache);
+ BUG_ON(atomic_read(&cache->nr_io_migrations));
+
+- cancel_delayed_work(&cache->waker);
+- flush_workqueue(cache->wq);
++ cancel_delayed_work_sync(&cache->waker);
++ drain_workqueue(cache->wq);
+ WARN_ON(cache->tracker.in_flight);
+
+ /*
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 2e22d588f056..5885239cc1f8 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -186,17 +186,19 @@ struct dm_integrity_c {
+ __u8 sectors_per_block;
+
+ unsigned char mode;
+- int suspending;
+
+ int failed;
+
+ struct crypto_shash *internal_hash;
+
++ struct dm_target *ti;
++
+ /* these variables are locked with endio_wait.lock */
+ struct rb_root in_progress;
+ struct list_head wait_list;
+ wait_queue_head_t endio_wait;
+ struct workqueue_struct *wait_wq;
++ struct workqueue_struct *offload_wq;
+
+ unsigned char commit_seq;
+ commit_id_t commit_ids[N_COMMIT_IDS];
+@@ -1236,7 +1238,7 @@ static void dec_in_flight(struct dm_integrity_io *dio)
+ dio->range.logical_sector += dio->range.n_sectors;
+ bio_advance(bio, dio->range.n_sectors << SECTOR_SHIFT);
+ INIT_WORK(&dio->work, integrity_bio_wait);
+- queue_work(ic->wait_wq, &dio->work);
++ queue_work(ic->offload_wq, &dio->work);
+ return;
+ }
+ do_endio_flush(ic, dio);
+@@ -1656,7 +1658,7 @@ static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map
+
+ if (need_sync_io && from_map) {
+ INIT_WORK(&dio->work, integrity_bio_wait);
+- queue_work(ic->metadata_wq, &dio->work);
++ queue_work(ic->offload_wq, &dio->work);
+ return;
+ }
+
+@@ -2080,7 +2082,7 @@ static void integrity_writer(struct work_struct *w)
+ unsigned prev_free_sectors;
+
+ /* the following test is not needed, but it tests the replay code */
+- if (READ_ONCE(ic->suspending) && !ic->meta_dev)
++ if (unlikely(dm_suspended(ic->ti)) && !ic->meta_dev)
+ return;
+
+ spin_lock_irq(&ic->endio_wait.lock);
+@@ -2139,7 +2141,7 @@ static void integrity_recalc(struct work_struct *w)
+
+ next_chunk:
+
+- if (unlikely(READ_ONCE(ic->suspending)))
++ if (unlikely(dm_suspended(ic->ti)))
+ goto unlock_ret;
+
+ range.logical_sector = le64_to_cpu(ic->sb->recalc_sector);
+@@ -2411,8 +2413,6 @@ static void dm_integrity_postsuspend(struct dm_target *ti)
+
+ del_timer_sync(&ic->autocommit_timer);
+
+- WRITE_ONCE(ic->suspending, 1);
+-
+ if (ic->recalc_wq)
+ drain_workqueue(ic->recalc_wq);
+
+@@ -2426,8 +2426,6 @@ static void dm_integrity_postsuspend(struct dm_target *ti)
+ dm_integrity_flush_buffers(ic);
+ }
+
+- WRITE_ONCE(ic->suspending, 0);
+-
+ BUG_ON(!RB_EMPTY_ROOT(&ic->in_progress));
+
+ ic->journal_uptodate = true;
+@@ -3116,6 +3114,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ }
+ ti->private = ic;
+ ti->per_io_data_size = sizeof(struct dm_integrity_io);
++ ic->ti = ti;
+
+ ic->in_progress = RB_ROOT;
+ INIT_LIST_HEAD(&ic->wait_list);
+@@ -3310,6 +3309,14 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ goto bad;
+ }
+
++ ic->offload_wq = alloc_workqueue("dm-integrity-offload", WQ_MEM_RECLAIM,
++ METADATA_WORKQUEUE_MAX_ACTIVE);
++ if (!ic->offload_wq) {
++ ti->error = "Cannot allocate workqueue";
++ r = -ENOMEM;
++ goto bad;
++ }
++
+ ic->commit_wq = alloc_workqueue("dm-integrity-commit", WQ_MEM_RECLAIM, 1);
+ if (!ic->commit_wq) {
+ ti->error = "Cannot allocate workqueue";
+@@ -3546,6 +3553,8 @@ static void dm_integrity_dtr(struct dm_target *ti)
+ destroy_workqueue(ic->metadata_wq);
+ if (ic->wait_wq)
+ destroy_workqueue(ic->wait_wq);
++ if (ic->offload_wq)
++ destroy_workqueue(ic->offload_wq);
+ if (ic->commit_wq)
+ destroy_workqueue(ic->commit_wq);
+ if (ic->writer_wq)
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index 820c2e07dadf..4e4a09054f85 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -631,6 +631,12 @@ static void writecache_add_to_freelist(struct dm_writecache *wc, struct wc_entry
+ wc->freelist_size++;
+ }
+
++static inline void writecache_verify_watermark(struct dm_writecache *wc)
++{
++ if (unlikely(wc->freelist_size + wc->writeback_size <= wc->freelist_high_watermark))
++ queue_work(wc->writeback_wq, &wc->writeback_work);
++}
++
+ static struct wc_entry *writecache_pop_from_freelist(struct dm_writecache *wc)
+ {
+ struct wc_entry *e;
+@@ -652,8 +658,8 @@ static struct wc_entry *writecache_pop_from_freelist(struct dm_writecache *wc)
+ list_del(&e->lru);
+ }
+ wc->freelist_size--;
+- if (unlikely(wc->freelist_size + wc->writeback_size <= wc->freelist_high_watermark))
+- queue_work(wc->writeback_wq, &wc->writeback_work);
++
++ writecache_verify_watermark(wc);
+
+ return e;
+ }
+@@ -844,7 +850,7 @@ static void writecache_suspend(struct dm_target *ti)
+ }
+ wc_unlock(wc);
+
+- flush_workqueue(wc->writeback_wq);
++ drain_workqueue(wc->writeback_wq);
+
+ wc_lock(wc);
+ if (flush_on_suspend)
+@@ -967,6 +973,8 @@ erase_this:
+ writecache_commit_flushed(wc, false);
+ }
+
++ writecache_verify_watermark(wc);
++
+ wc_unlock(wc);
+ }
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 3965f3cf8ea1..43643151584a 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2353,6 +2353,7 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
+ map = dm_get_live_table(md, &srcu_idx);
+ if (!dm_suspended_md(md)) {
+ dm_table_presuspend_targets(map);
++ set_bit(DMF_SUSPENDED, &md->flags);
+ dm_table_postsuspend_targets(map);
+ }
+ /* dm_put_live_table must be before msleep, otherwise deadlock is possible */
+diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
+index ce9bd1b91210..fc237b820c4f 100644
+--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
++++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
+@@ -787,12 +787,12 @@ int v4l2_m2m_register_media_controller(struct v4l2_m2m_dev *m2m_dev,
+ goto err_rel_entity1;
+
+ /* Connect the three entities */
+- ret = media_create_pad_link(m2m_dev->source, 0, &m2m_dev->proc, 1,
++ ret = media_create_pad_link(m2m_dev->source, 0, &m2m_dev->proc, 0,
+ MEDIA_LNK_FL_IMMUTABLE | MEDIA_LNK_FL_ENABLED);
+ if (ret)
+ goto err_rel_entity2;
+
+- ret = media_create_pad_link(&m2m_dev->proc, 0, &m2m_dev->sink, 0,
++ ret = media_create_pad_link(&m2m_dev->proc, 1, &m2m_dev->sink, 0,
+ MEDIA_LNK_FL_IMMUTABLE | MEDIA_LNK_FL_ENABLED);
+ if (ret)
+ goto err_rm_links0;
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 51436e7eae10..ac5d945b934a 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1165,6 +1165,9 @@ void b53_vlan_add(struct dsa_switch *ds, int port,
+
+ b53_get_vlan_entry(dev, vid, vl);
+
++ if (vid == 0 && vid == b53_default_pvid(dev))
++ untagged = true;
++
+ vl->members |= BIT(port);
+ if (untagged && !dsa_is_cpu_port(ds, port))
+ vl->untag |= BIT(port);
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index f181a28cb452..8c69789fbe09 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -73,8 +73,7 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)
+ /* Force link status for IMP port */
+ reg = core_readl(priv, offset);
+ reg |= (MII_SW_OR | LINK_STS);
+- if (priv->type == BCM7278_DEVICE_ID)
+- reg |= GMII_SPEED_UP_2G;
++ reg &= ~GMII_SPEED_UP_2G;
+ core_writel(priv, reg, offset);
+
+ /* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
+diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+index 8ae28f82aafd..e5fc89813852 100644
+--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+@@ -413,10 +413,19 @@ void bgx_lmac_rx_tx_enable(int node, int bgx_idx, int lmacid, bool enable)
+ lmac = &bgx->lmac[lmacid];
+
+ cfg = bgx_reg_read(bgx, lmacid, BGX_CMRX_CFG);
+- if (enable)
++ if (enable) {
+ cfg |= CMR_PKT_RX_EN | CMR_PKT_TX_EN;
+- else
++
++ /* enable TX FIFO Underflow interrupt */
++ bgx_reg_modify(bgx, lmacid, BGX_GMP_GMI_TXX_INT_ENA_W1S,
++ GMI_TXX_INT_UNDFLW);
++ } else {
+ cfg &= ~(CMR_PKT_RX_EN | CMR_PKT_TX_EN);
++
++ /* Disable TX FIFO Underflow interrupt */
++ bgx_reg_modify(bgx, lmacid, BGX_GMP_GMI_TXX_INT_ENA_W1C,
++ GMI_TXX_INT_UNDFLW);
++ }
+ bgx_reg_write(bgx, lmacid, BGX_CMRX_CFG, cfg);
+
+ if (bgx->is_rgx)
+@@ -1544,6 +1553,48 @@ static int bgx_init_phy(struct bgx *bgx)
+ return bgx_init_of_phy(bgx);
+ }
+
++static irqreturn_t bgx_intr_handler(int irq, void *data)
++{
++ struct bgx *bgx = (struct bgx *)data;
++ u64 status, val;
++ int lmac;
++
++ for (lmac = 0; lmac < bgx->lmac_count; lmac++) {
++ status = bgx_reg_read(bgx, lmac, BGX_GMP_GMI_TXX_INT);
++ if (status & GMI_TXX_INT_UNDFLW) {
++ pci_err(bgx->pdev, "BGX%d lmac%d UNDFLW\n",
++ bgx->bgx_id, lmac);
++ val = bgx_reg_read(bgx, lmac, BGX_CMRX_CFG);
++ val &= ~CMR_EN;
++ bgx_reg_write(bgx, lmac, BGX_CMRX_CFG, val);
++ val |= CMR_EN;
++ bgx_reg_write(bgx, lmac, BGX_CMRX_CFG, val);
++ }
++ /* clear interrupts */
++ bgx_reg_write(bgx, lmac, BGX_GMP_GMI_TXX_INT, status);
++ }
++
++ return IRQ_HANDLED;
++}
++
++static void bgx_register_intr(struct pci_dev *pdev)
++{
++ struct bgx *bgx = pci_get_drvdata(pdev);
++ int ret;
++
++ ret = pci_alloc_irq_vectors(pdev, BGX_LMAC_VEC_OFFSET,
++ BGX_LMAC_VEC_OFFSET, PCI_IRQ_ALL_TYPES);
++ if (ret < 0) {
++ pci_err(pdev, "Req for #%d msix vectors failed\n",
++ BGX_LMAC_VEC_OFFSET);
++ return;
++ }
++ ret = pci_request_irq(pdev, GMPX_GMI_TX_INT, bgx_intr_handler, NULL,
++ bgx, "BGX%d", bgx->bgx_id);
++ if (ret)
++ pci_free_irq(pdev, GMPX_GMI_TX_INT, bgx);
++}
++
+ static int bgx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ int err;
+@@ -1559,7 +1610,7 @@ static int bgx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ pci_set_drvdata(pdev, bgx);
+
+- err = pci_enable_device(pdev);
++ err = pcim_enable_device(pdev);
+ if (err) {
+ dev_err(dev, "Failed to enable PCI device\n");
+ pci_set_drvdata(pdev, NULL);
+@@ -1613,6 +1664,8 @@ static int bgx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ bgx_init_hw(bgx);
+
++ bgx_register_intr(pdev);
++
+ /* Enable all LMACs */
+ for (lmac = 0; lmac < bgx->lmac_count; lmac++) {
+ err = bgx_lmac_enable(bgx, lmac);
+@@ -1629,6 +1682,7 @@ static int bgx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ err_enable:
+ bgx_vnic[bgx->bgx_id] = NULL;
++ pci_free_irq(pdev, GMPX_GMI_TX_INT, bgx);
+ err_release_regions:
+ pci_release_regions(pdev);
+ err_disable_device:
+@@ -1646,6 +1700,8 @@ static void bgx_remove(struct pci_dev *pdev)
+ for (lmac = 0; lmac < bgx->lmac_count; lmac++)
+ bgx_lmac_disable(bgx, lmac);
+
++ pci_free_irq(pdev, GMPX_GMI_TX_INT, bgx);
++
+ bgx_vnic[bgx->bgx_id] = NULL;
+ pci_release_regions(pdev);
+ pci_disable_device(pdev);
+diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+index cbdd20b9ee6f..ac0c89cd5c3d 100644
+--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+@@ -183,6 +183,15 @@
+ #define BGX_GMP_GMI_TXX_BURST 0x38228
+ #define BGX_GMP_GMI_TXX_MIN_PKT 0x38240
+ #define BGX_GMP_GMI_TXX_SGMII_CTL 0x38300
++#define BGX_GMP_GMI_TXX_INT 0x38500
++#define BGX_GMP_GMI_TXX_INT_W1S 0x38508
++#define BGX_GMP_GMI_TXX_INT_ENA_W1C 0x38510
++#define BGX_GMP_GMI_TXX_INT_ENA_W1S 0x38518
++#define GMI_TXX_INT_PTP_LOST BIT_ULL(4)
++#define GMI_TXX_INT_LATE_COL BIT_ULL(3)
++#define GMI_TXX_INT_XSDEF BIT_ULL(2)
++#define GMI_TXX_INT_XSCOL BIT_ULL(1)
++#define GMI_TXX_INT_UNDFLW BIT_ULL(0)
+
+ #define BGX_MSIX_VEC_0_29_ADDR 0x400000 /* +(0..29) << 4 */
+ #define BGX_MSIX_VEC_0_29_CTL 0x400008
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index 4c5c87b158f5..627abef829c9 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -772,13 +772,6 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause)
+ else
+ return -EINVAL;
+
+- /* Tell the OS link is going down, the link will go back up when fw
+- * says it is ready asynchronously
+- */
+- ice_print_link_msg(vsi, false);
+- netif_carrier_off(netdev);
+- netif_tx_stop_all_queues(netdev);
+-
+ /* Set the FC mode and only restart AN if link is up */
+ status = ice_set_fc(pi, &aq_failures, link_up);
+
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index 35f8c9ef204d..9de59facec21 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -475,24 +475,6 @@ static int msg_enable;
+ * chip is busy transferring packet data (RX/TX FIFO accesses).
+ */
+
+-/**
+- * ks_rdreg8 - read 8 bit register from device
+- * @ks : The chip information
+- * @offset: The register address
+- *
+- * Read a 8bit register from the chip, returning the result
+- */
+-static u8 ks_rdreg8(struct ks_net *ks, int offset)
+-{
+- u16 data;
+- u8 shift_bit = offset & 0x03;
+- u8 shift_data = (offset & 1) << 3;
+- ks->cmd_reg_cache = (u16) offset | (u16)(BE0 << shift_bit);
+- iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd);
+- data = ioread16(ks->hw_addr);
+- return (u8)(data >> shift_data);
+-}
+-
+ /**
+ * ks_rdreg16 - read 16 bit register from device
+ * @ks : The chip information
+@@ -503,27 +485,11 @@ static u8 ks_rdreg8(struct ks_net *ks, int offset)
+
+ static u16 ks_rdreg16(struct ks_net *ks, int offset)
+ {
+- ks->cmd_reg_cache = (u16)offset | ((BE1 | BE0) << (offset & 0x02));
++ ks->cmd_reg_cache = (u16)offset | ((BE3 | BE2) >> (offset & 0x02));
+ iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd);
+ return ioread16(ks->hw_addr);
+ }
+
+-/**
+- * ks_wrreg8 - write 8bit register value to chip
+- * @ks: The chip information
+- * @offset: The register address
+- * @value: The value to write
+- *
+- */
+-static void ks_wrreg8(struct ks_net *ks, int offset, u8 value)
+-{
+- u8 shift_bit = (offset & 0x03);
+- u16 value_write = (u16)(value << ((offset & 1) << 3));
+- ks->cmd_reg_cache = (u16)offset | (BE0 << shift_bit);
+- iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd);
+- iowrite16(value_write, ks->hw_addr);
+-}
+-
+ /**
+ * ks_wrreg16 - write 16bit register value to chip
+ * @ks: The chip information
+@@ -534,7 +500,7 @@ static void ks_wrreg8(struct ks_net *ks, int offset, u8 value)
+
+ static void ks_wrreg16(struct ks_net *ks, int offset, u16 value)
+ {
+- ks->cmd_reg_cache = (u16)offset | ((BE1 | BE0) << (offset & 0x02));
++ ks->cmd_reg_cache = (u16)offset | ((BE3 | BE2) >> (offset & 0x02));
+ iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd);
+ iowrite16(value, ks->hw_addr);
+ }
+@@ -550,7 +516,7 @@ static inline void ks_inblk(struct ks_net *ks, u16 *wptr, u32 len)
+ {
+ len >>= 1;
+ while (len--)
+- *wptr++ = (u16)ioread16(ks->hw_addr);
++ *wptr++ = be16_to_cpu(ioread16(ks->hw_addr));
+ }
+
+ /**
+@@ -564,7 +530,7 @@ static inline void ks_outblk(struct ks_net *ks, u16 *wptr, u32 len)
+ {
+ len >>= 1;
+ while (len--)
+- iowrite16(*wptr++, ks->hw_addr);
++ iowrite16(cpu_to_be16(*wptr++), ks->hw_addr);
+ }
+
+ static void ks_disable_int(struct ks_net *ks)
+@@ -643,8 +609,7 @@ static void ks_read_config(struct ks_net *ks)
+ u16 reg_data = 0;
+
+ /* Regardless of bus width, 8 bit read should always work.*/
+- reg_data = ks_rdreg8(ks, KS_CCR) & 0x00FF;
+- reg_data |= ks_rdreg8(ks, KS_CCR+1) << 8;
++ reg_data = ks_rdreg16(ks, KS_CCR);
+
+ /* addr/data bus are multiplexed */
+ ks->sharedbus = (reg_data & CCR_SHARED) == CCR_SHARED;
+@@ -748,7 +713,7 @@ static inline void ks_read_qmu(struct ks_net *ks, u16 *buf, u32 len)
+
+ /* 1. set sudo DMA mode */
+ ks_wrreg16(ks, KS_RXFDPR, RXFDPR_RXFPAI);
+- ks_wrreg8(ks, KS_RXQCR, (ks->rc_rxqcr | RXQCR_SDA) & 0xff);
++ ks_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+
+ /* 2. read prepend data */
+ /**
+@@ -765,7 +730,7 @@ static inline void ks_read_qmu(struct ks_net *ks, u16 *buf, u32 len)
+ ks_inblk(ks, buf, ALIGN(len, 4));
+
+ /* 4. reset sudo DMA Mode */
+- ks_wrreg8(ks, KS_RXQCR, ks->rc_rxqcr);
++ ks_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+ }
+
+ /**
+@@ -998,13 +963,13 @@ static void ks_write_qmu(struct ks_net *ks, u8 *pdata, u16 len)
+ ks->txh.txw[1] = cpu_to_le16(len);
+
+ /* 1. set sudo-DMA mode */
+- ks_wrreg8(ks, KS_RXQCR, (ks->rc_rxqcr | RXQCR_SDA) & 0xff);
++ ks_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+ /* 2. write status/lenth info */
+ ks_outblk(ks, ks->txh.txw, 4);
+ /* 3. write pkt data */
+ ks_outblk(ks, (u16 *)pdata, ALIGN(len, 4));
+ /* 4. reset sudo-DMA mode */
+- ks_wrreg8(ks, KS_RXQCR, ks->rc_rxqcr);
++ ks_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+ /* 5. Enqueue Tx(move the pkt from TX buffer into TXQ) */
+ ks_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
+ /* 6. wait until TXQCR_METFE is auto-cleared */
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index f41fd15b7b7c..a8132e8d72bb 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1058,8 +1058,8 @@ static struct nvme_id_ns *nvme_identify_ns(struct nvme_ctrl *ctrl,
+ static int nvme_set_features(struct nvme_ctrl *dev, unsigned fid, unsigned dword11,
+ void *buffer, size_t buflen, u32 *result)
+ {
++ union nvme_result res = { 0 };
+ struct nvme_command c;
+- union nvme_result res;
+ int ret;
+
+ memset(&c, 0, sizeof(c));
+diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c
+index 0075fb0bef8c..77518010adc8 100644
+--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
++++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
+@@ -19,6 +19,7 @@
+
+ #define PHY_MDM6600_PHY_DELAY_MS 4000 /* PHY enable 2.2s to 3.5s */
+ #define PHY_MDM6600_ENABLED_DELAY_MS 8000 /* 8s more total for MDM6600 */
++#define PHY_MDM6600_WAKE_KICK_MS 600 /* time on after GPIO toggle */
+ #define MDM6600_MODEM_IDLE_DELAY_MS 1000 /* modem after USB suspend */
+ #define MDM6600_MODEM_WAKE_DELAY_MS 200 /* modem response after idle */
+
+@@ -224,10 +225,24 @@ static irqreturn_t phy_mdm6600_wakeirq_thread(int irq, void *data)
+ {
+ struct phy_mdm6600 *ddata = data;
+ struct gpio_desc *mode_gpio1;
++ int error, wakeup;
+
+ mode_gpio1 = ddata->mode_gpios->desc[PHY_MDM6600_MODE1];
+- dev_dbg(ddata->dev, "OOB wake on mode_gpio1: %i\n",
+- gpiod_get_value(mode_gpio1));
++ wakeup = gpiod_get_value(mode_gpio1);
++ if (!wakeup)
++ return IRQ_NONE;
++
++ dev_dbg(ddata->dev, "OOB wake on mode_gpio1: %i\n", wakeup);
++ error = pm_runtime_get_sync(ddata->dev);
++ if (error < 0) {
++ pm_runtime_put_noidle(ddata->dev);
++
++ return IRQ_NONE;
++ }
++
++ /* Just wake-up and kick the autosuspend timer */
++ pm_runtime_mark_last_busy(ddata->dev);
++ pm_runtime_put_autosuspend(ddata->dev);
+
+ return IRQ_HANDLED;
+ }
+@@ -477,8 +492,14 @@ static void phy_mdm6600_modem_wake(struct work_struct *work)
+
+ ddata = container_of(work, struct phy_mdm6600, modem_wake_work.work);
+ phy_mdm6600_wake_modem(ddata);
++
++ /*
++ * The modem does not always stay awake 1.2 seconds after toggling
++ * the wake GPIO, and sometimes it idles after about some 600 ms
++ * making writes time out.
++ */
+ schedule_delayed_work(&ddata->modem_wake_work,
+- msecs_to_jiffies(MDM6600_MODEM_IDLE_DELAY_MS));
++ msecs_to_jiffies(PHY_MDM6600_WAKE_KICK_MS));
+ }
+
+ static int __maybe_unused phy_mdm6600_runtime_suspend(struct device *dev)
+diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c
+index 2a3f874a21d5..9cebff8e8d74 100644
+--- a/drivers/s390/cio/blacklist.c
++++ b/drivers/s390/cio/blacklist.c
+@@ -303,8 +303,10 @@ static void *
+ cio_ignore_proc_seq_next(struct seq_file *s, void *it, loff_t *offset)
+ {
+ struct ccwdev_iter *iter;
++ loff_t p = *offset;
+
+- if (*offset >= (__MAX_SUBCHANNEL + 1) * (__MAX_SSID + 1))
++ (*offset)++;
++ if (p >= (__MAX_SUBCHANNEL + 1) * (__MAX_SSID + 1))
+ return NULL;
+ iter = it;
+ if (iter->devno == __MAX_SUBCHANNEL) {
+@@ -314,7 +316,6 @@ cio_ignore_proc_seq_next(struct seq_file *s, void *it, loff_t *offset)
+ return NULL;
+ } else
+ iter->devno++;
+- (*offset)++;
+ return iter;
+ }
+
+diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
+index 034528a5453e..d040c4920ee7 100644
+--- a/drivers/s390/cio/qdio_setup.c
++++ b/drivers/s390/cio/qdio_setup.c
+@@ -8,6 +8,7 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/export.h>
++#include <linux/io.h>
+ #include <asm/qdio.h>
+
+ #include "cio.h"
+@@ -208,7 +209,7 @@ static void setup_storage_lists(struct qdio_q *q, struct qdio_irq *irq_ptr,
+
+ /* fill in sl */
+ for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; j++)
+- q->sl->element[j].sbal = (unsigned long)q->sbal[j];
++ q->sl->element[j].sbal = virt_to_phys(q->sbal[j]);
+ }
+
+ static void setup_queues(struct qdio_irq *irq_ptr,
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 81e2c591acb0..d99bfbfcafb7 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -4929,10 +4929,10 @@ static void qeth_qdio_establish_cq(struct qeth_card *card,
+ if (card->options.cq == QETH_CQ_ENABLED) {
+ int offset = QDIO_MAX_BUFFERS_PER_Q *
+ (card->qdio.no_in_queues - 1);
+- for (i = 0; i < QDIO_MAX_BUFFERS_PER_Q; ++i) {
+- in_sbal_ptrs[offset + i] = (struct qdio_buffer *)
+- virt_to_phys(card->qdio.c_q->bufs[i].buffer);
+- }
++
++ for (i = 0; i < QDIO_MAX_BUFFERS_PER_Q; i++)
++ in_sbal_ptrs[offset + i] =
++ card->qdio.c_q->bufs[i].buffer;
+
+ queue_start_poll[card->qdio.no_in_queues - 1] = NULL;
+ }
+@@ -4967,10 +4967,9 @@ static int qeth_qdio_establish(struct qeth_card *card)
+ rc = -ENOMEM;
+ goto out_free_qib_param;
+ }
+- for (i = 0; i < QDIO_MAX_BUFFERS_PER_Q; ++i) {
+- in_sbal_ptrs[i] = (struct qdio_buffer *)
+- virt_to_phys(card->qdio.in_q->bufs[i].buffer);
+- }
++
++ for (i = 0; i < QDIO_MAX_BUFFERS_PER_Q; i++)
++ in_sbal_ptrs[i] = card->qdio.in_q->bufs[i].buffer;
+
+ queue_start_poll = kcalloc(card->qdio.no_in_queues, sizeof(void *),
+ GFP_KERNEL);
+@@ -4991,11 +4990,11 @@ static int qeth_qdio_establish(struct qeth_card *card)
+ rc = -ENOMEM;
+ goto out_free_queue_start_poll;
+ }
++
+ for (i = 0, k = 0; i < card->qdio.no_out_queues; ++i)
+- for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; ++j, ++k) {
+- out_sbal_ptrs[k] = (struct qdio_buffer *)virt_to_phys(
+- card->qdio.out_qs[i]->bufs[j]->buffer);
+- }
++ for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; j++, k++)
++ out_sbal_ptrs[k] =
++ card->qdio.out_qs[i]->bufs[j]->buffer;
+
+ memset(&init_data, 0, sizeof(struct qdio_initialize));
+ init_data.cdev = CARD_DDEV(card);
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index b094a4e55c32..81bd824bb9d9 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -530,7 +530,8 @@ retry_alloc:
+
+ fusion->io_request_frames =
+ dma_pool_alloc(fusion->io_request_frames_pool,
+- GFP_KERNEL, &fusion->io_request_frames_phys);
++ GFP_KERNEL | __GFP_NOWARN,
++ &fusion->io_request_frames_phys);
+ if (!fusion->io_request_frames) {
+ if (instance->max_fw_cmds >= (MEGASAS_REDUCE_QD_COUNT * 2)) {
+ instance->max_fw_cmds -= MEGASAS_REDUCE_QD_COUNT;
+@@ -568,7 +569,7 @@ retry_alloc:
+
+ fusion->io_request_frames =
+ dma_pool_alloc(fusion->io_request_frames_pool,
+- GFP_KERNEL,
++ GFP_KERNEL | __GFP_NOWARN,
+ &fusion->io_request_frames_phys);
+
+ if (!fusion->io_request_frames) {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 59feda261e08..5be4212312cb 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -866,6 +866,8 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+ pm8001_exec_internal_task_abort(pm8001_ha, pm8001_dev ,
+ dev, 1, 0);
++ while (pm8001_dev->running_req)
++ msleep(20);
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ }
+ PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
+@@ -1238,8 +1240,10 @@ int pm8001_abort_task(struct sas_task *task)
+ PM8001_MSG_DBG(pm8001_ha,
+ pm8001_printk("Waiting for Port reset\n"));
+ wait_for_completion(&completion_reset);
+- if (phy->port_reset_status)
++ if (phy->port_reset_status) {
++ pm8001_dev_gone_notify(dev);
+ goto out;
++ }
+
+ /*
+ * 4. SATA Abort ALL
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 8627feb80261..c63b5db435c5 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -604,7 +604,7 @@ static void update_main_config_table(struct pm8001_hba_info *pm8001_ha)
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.port_recovery_timer &=
+ 0x0000ffff;
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.port_recovery_timer |=
+- 0x140000;
++ CHIP_8006_PORT_RECOVERY_TIMEOUT;
+ }
+ pm8001_mw32(address, MAIN_PORT_RECOVERY_TIMER,
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.port_recovery_timer);
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h
+index 7dd2699d0efb..bbe1747234ff 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.h
++++ b/drivers/scsi/pm8001/pm80xx_hwi.h
+@@ -228,6 +228,8 @@
+ #define SAS_MAX_AIP 0x200000
+ #define IT_NEXUS_TIMEOUT 0x7D0
+ #define PORT_RECOVERY_TIMEOUT ((IT_NEXUS_TIMEOUT/100) + 30)
++/* Port recovery timeout, 10000 ms for PM8006 controller */
++#define CHIP_8006_PORT_RECOVERY_TIMEOUT 0x640000
+
+ #ifdef __LITTLE_ENDIAN_BITFIELD
+ struct sas_identify_frame_local {
+diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
+index 9a06ffdb73b8..1669c554ea34 100644
+--- a/drivers/spi/spi-bcm63xx-hsspi.c
++++ b/drivers/spi/spi-bcm63xx-hsspi.c
+@@ -371,7 +371,6 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)
+ goto out_disable_clk;
+
+ rate = clk_get_rate(pll_clk);
+- clk_disable_unprepare(pll_clk);
+ if (!rate) {
+ ret = -EINVAL;
+ goto out_disable_pll_clk;
+diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
+index 0089aa305ef9..870735776437 100644
+--- a/drivers/tty/serial/8250/8250_exar.c
++++ b/drivers/tty/serial/8250/8250_exar.c
+@@ -24,6 +24,14 @@
+
+ #include "8250.h"
+
++#define PCI_DEVICE_ID_ACCES_COM_2S 0x1052
++#define PCI_DEVICE_ID_ACCES_COM_4S 0x105d
++#define PCI_DEVICE_ID_ACCES_COM_8S 0x106c
++#define PCI_DEVICE_ID_ACCES_COM232_8 0x10a8
++#define PCI_DEVICE_ID_ACCES_COM_2SM 0x10d2
++#define PCI_DEVICE_ID_ACCES_COM_4SM 0x10db
++#define PCI_DEVICE_ID_ACCES_COM_8SM 0x10ea
++
+ #define PCI_DEVICE_ID_COMMTECH_4224PCI335 0x0002
+ #define PCI_DEVICE_ID_COMMTECH_4222PCI335 0x0004
+ #define PCI_DEVICE_ID_COMMTECH_2324PCI335 0x000a
+@@ -571,6 +579,22 @@ static int __maybe_unused exar_resume(struct device *dev)
+
+ static SIMPLE_DEV_PM_OPS(exar_pci_pm, exar_suspend, exar_resume);
+
++static const struct exar8250_board acces_com_2x = {
++ .num_ports = 2,
++ .setup = pci_xr17c154_setup,
++};
++
++static const struct exar8250_board acces_com_4x = {
++ .num_ports = 4,
++ .setup = pci_xr17c154_setup,
++};
++
++static const struct exar8250_board acces_com_8x = {
++ .num_ports = 8,
++ .setup = pci_xr17c154_setup,
++};
++
++
+ static const struct exar8250_board pbn_fastcom335_2 = {
+ .num_ports = 2,
+ .setup = pci_fastcom335_setup,
+@@ -639,6 +663,15 @@ static const struct exar8250_board pbn_exar_XR17V8358 = {
+ }
+
+ static const struct pci_device_id exar_pci_tbl[] = {
++ EXAR_DEVICE(ACCESSIO, ACCES_COM_2S, acces_com_2x),
++ EXAR_DEVICE(ACCESSIO, ACCES_COM_4S, acces_com_4x),
++ EXAR_DEVICE(ACCESSIO, ACCES_COM_8S, acces_com_8x),
++ EXAR_DEVICE(ACCESSIO, ACCES_COM232_8, acces_com_8x),
++ EXAR_DEVICE(ACCESSIO, ACCES_COM_2SM, acces_com_2x),
++ EXAR_DEVICE(ACCESSIO, ACCES_COM_4SM, acces_com_4x),
++ EXAR_DEVICE(ACCESSIO, ACCES_COM_8SM, acces_com_8x),
++
++
+ CONNECT_DEVICE(XR17C152, UART_2_232, pbn_connect),
+ CONNECT_DEVICE(XR17C154, UART_4_232, pbn_connect),
+ CONNECT_DEVICE(XR17C158, UART_8_232, pbn_connect),
+diff --git a/drivers/tty/serial/ar933x_uart.c b/drivers/tty/serial/ar933x_uart.c
+index 3bdd56a1021b..ea12f10610b6 100644
+--- a/drivers/tty/serial/ar933x_uart.c
++++ b/drivers/tty/serial/ar933x_uart.c
+@@ -286,6 +286,10 @@ static void ar933x_uart_set_termios(struct uart_port *port,
+ ar933x_uart_rmw_set(up, AR933X_UART_CS_REG,
+ AR933X_UART_CS_HOST_INT_EN);
+
++ /* enable RX and TX ready overide */
++ ar933x_uart_rmw_set(up, AR933X_UART_CS_REG,
++ AR933X_UART_CS_TX_READY_ORIDE | AR933X_UART_CS_RX_READY_ORIDE);
++
+ /* reenable the UART */
+ ar933x_uart_rmw(up, AR933X_UART_CS_REG,
+ AR933X_UART_CS_IF_MODE_M << AR933X_UART_CS_IF_MODE_S,
+@@ -418,6 +422,10 @@ static int ar933x_uart_startup(struct uart_port *port)
+ ar933x_uart_rmw_set(up, AR933X_UART_CS_REG,
+ AR933X_UART_CS_HOST_INT_EN);
+
++ /* enable RX and TX ready overide */
++ ar933x_uart_rmw_set(up, AR933X_UART_CS_REG,
++ AR933X_UART_CS_TX_READY_ORIDE | AR933X_UART_CS_RX_READY_ORIDE);
++
+ /* Enable RX interrupts */
+ up->ier = AR933X_UART_INT_RX_VALID;
+ ar933x_uart_write(up, AR933X_UART_INT_EN_REG, up->ier);
+diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
+index 7d26c9b57d8e..fb9d369e0f50 100644
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -840,7 +840,7 @@ static int mvebu_uart_probe(struct platform_device *pdev)
+
+ port->membase = devm_ioremap_resource(&pdev->dev, reg);
+ if (IS_ERR(port->membase))
+- return -PTR_ERR(port->membase);
++ return PTR_ERR(port->membase);
+
+ mvuart = devm_kzalloc(&pdev->dev, sizeof(struct mvebu_uart),
+ GFP_KERNEL);
+diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
+index 3ac4fe549c2e..8a1671724835 100644
+--- a/drivers/tty/vt/selection.c
++++ b/drivers/tty/vt/selection.c
+@@ -14,6 +14,7 @@
+ #include <linux/tty.h>
+ #include <linux/sched.h>
+ #include <linux/mm.h>
++#include <linux/mutex.h>
+ #include <linux/slab.h>
+ #include <linux/types.h>
+
+@@ -43,6 +44,7 @@ static volatile int sel_start = -1; /* cleared by clear_selection */
+ static int sel_end;
+ static int sel_buffer_lth;
+ static char *sel_buffer;
++static DEFINE_MUTEX(sel_lock);
+
+ /* clear_selection, highlight and highlight_pointer can be called
+ from interrupt (via scrollback/front) */
+@@ -165,7 +167,7 @@ static int store_utf8(u32 c, char *p)
+ * The entire selection process is managed under the console_lock. It's
+ * a lot under the lock but its hardly a performance path
+ */
+-int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *tty)
++static int __set_selection(const struct tiocl_selection __user *sel, struct tty_struct *tty)
+ {
+ struct vc_data *vc = vc_cons[fg_console].d;
+ int new_sel_start, new_sel_end, spc;
+@@ -173,7 +175,7 @@ int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *t
+ char *bp, *obp;
+ int i, ps, pe, multiplier;
+ u32 c;
+- int mode;
++ int mode, ret = 0;
+
+ poke_blanked_console();
+ if (copy_from_user(&v, sel, sizeof(*sel)))
+@@ -322,7 +324,21 @@ int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *t
+ }
+ }
+ sel_buffer_lth = bp - sel_buffer;
+- return 0;
++
++ return ret;
++}
++
++int set_selection(const struct tiocl_selection __user *v, struct tty_struct *tty)
++{
++ int ret;
++
++ mutex_lock(&sel_lock);
++ console_lock();
++ ret = __set_selection(v, tty);
++ console_unlock();
++ mutex_unlock(&sel_lock);
++
++ return ret;
+ }
+
+ /* Insert the contents of the selection buffer into the
+@@ -351,6 +367,7 @@ int paste_selection(struct tty_struct *tty)
+ tty_buffer_lock_exclusive(&vc->port);
+
+ add_wait_queue(&vc->paste_wait, &wait);
++ mutex_lock(&sel_lock);
+ while (sel_buffer && sel_buffer_lth > pasted) {
+ set_current_state(TASK_INTERRUPTIBLE);
+ if (signal_pending(current)) {
+@@ -358,7 +375,9 @@ int paste_selection(struct tty_struct *tty)
+ break;
+ }
+ if (tty_throttled(tty)) {
++ mutex_unlock(&sel_lock);
+ schedule();
++ mutex_lock(&sel_lock);
+ continue;
+ }
+ __set_current_state(TASK_RUNNING);
+@@ -367,6 +386,7 @@ int paste_selection(struct tty_struct *tty)
+ count);
+ pasted += count;
+ }
++ mutex_unlock(&sel_lock);
+ remove_wait_queue(&vc->paste_wait, &wait);
+ __set_current_state(TASK_RUNNING);
+
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index ddaecb1bd9fd..5cecf529562a 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -3022,9 +3022,7 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
+ switch (type)
+ {
+ case TIOCL_SETSEL:
+- console_lock();
+ ret = set_selection((struct tiocl_selection __user *)(p+1), tty);
+- console_unlock();
+ break;
+ case TIOCL_PASTESEL:
+ ret = paste_selection(tty);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 27486b0a027a..8cf2d2a5e266 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -961,13 +961,17 @@ int usb_remove_device(struct usb_device *udev)
+ {
+ struct usb_hub *hub;
+ struct usb_interface *intf;
++ int ret;
+
+ if (!udev->parent) /* Can't remove a root hub */
+ return -EINVAL;
+ hub = usb_hub_to_struct_hub(udev->parent);
+ intf = to_usb_interface(hub->intfdev);
+
+- usb_autopm_get_interface(intf);
++ ret = usb_autopm_get_interface(intf);
++ if (ret < 0)
++ return ret;
++
+ set_bit(udev->portnum, hub->removed_bits);
+ hub_port_logical_disconnect(hub, udev->portnum);
+ usb_autopm_put_interface(intf);
+@@ -1833,7 +1837,7 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)
+
+ if (id->driver_info & HUB_QUIRK_DISABLE_AUTOSUSPEND) {
+ hub->quirk_disable_autosuspend = 1;
+- usb_autopm_get_interface(intf);
++ usb_autopm_get_interface_no_resume(intf);
+ }
+
+ if (hub_configure(hub, &desc->endpoint[0].desc) >= 0)
+diff --git a/drivers/usb/core/port.c b/drivers/usb/core/port.c
+index 4a2143195395..1fe83b522d5f 100644
+--- a/drivers/usb/core/port.c
++++ b/drivers/usb/core/port.c
+@@ -203,7 +203,10 @@ static int usb_port_runtime_resume(struct device *dev)
+ if (!port_dev->is_superspeed && peer)
+ pm_runtime_get_sync(&peer->dev);
+
+- usb_autopm_get_interface(intf);
++ retval = usb_autopm_get_interface(intf);
++ if (retval < 0)
++ return retval;
++
+ retval = usb_hub_set_port_power(hdev, hub, port1, true);
+ msleep(hub_power_on_good_delay(hub));
+ if (udev && !retval) {
+@@ -256,7 +259,10 @@ static int usb_port_runtime_suspend(struct device *dev)
+ if (usb_port_block_power_off)
+ return -EBUSY;
+
+- usb_autopm_get_interface(intf);
++ retval = usb_autopm_get_interface(intf);
++ if (retval < 0)
++ return retval;
++
+ retval = usb_hub_set_port_power(hdev, hub, port1, false);
+ usb_clear_port_feature(hdev, port1, USB_PORT_FEAT_C_CONNECTION);
+ if (!port_dev->is_superspeed)
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 2b24336a72e5..2dac3e7cdd97 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -231,6 +231,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Logitech PTZ Pro Camera */
+ { USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT },
+
++ /* Logitech Screen Share */
++ { USB_DEVICE(0x046d, 0x086c), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* Logitech Quickcam Fusion */
+ { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 430cfd620854..d482f89ffae2 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1067,7 +1067,14 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ unsigned int rem = length % maxp;
+ unsigned chain = true;
+
+- if (sg_is_last(s))
++ /*
++ * IOMMU driver is coalescing the list of sgs which shares a
++ * page boundary into one and giving it to USB driver. With
++ * this the number of sgs mapped is not equal to the number of
++ * sgs passed. So mark the chain bit to false if it isthe last
++ * mapped sg.
++ */
++ if (i == remaining - 1)
+ chain = false;
+
+ if (rem && usb_endpoint_dir_out(dep->endpoint.desc) && !chain) {
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index fea7c7e0143f..30aefd1adbad 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -438,9 +438,13 @@ static u8 encode_bMaxPower(enum usb_device_speed speed,
+ if (!val)
+ return 0;
+ if (speed < USB_SPEED_SUPER)
+- return DIV_ROUND_UP(val, 2);
++ return min(val, 500U) / 2;
+ else
+- return DIV_ROUND_UP(val, 8);
++ /*
++ * USB 3.x supports up to 900mA, but since 900 isn't divisible
++ * by 8 the integral division will effectively cap to 896mA.
++ */
++ return min(val, 900U) / 8;
+ }
+
+ static int config_buf(struct usb_configuration *config,
+@@ -838,6 +842,10 @@ static int set_config(struct usb_composite_dev *cdev,
+
+ /* when we return, be sure our power usage is valid */
+ power = c->MaxPower ? c->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW;
++ if (gadget->speed < USB_SPEED_SUPER)
++ power = min(power, 500U);
++ else
++ power = min(power, 900U);
+ done:
+ usb_gadget_vbus_draw(gadget, power);
+ if (result >= 0 && cdev->delayed_status)
+@@ -2264,7 +2272,7 @@ void composite_resume(struct usb_gadget *gadget)
+ {
+ struct usb_composite_dev *cdev = get_gadget_data(gadget);
+ struct usb_function *f;
+- u16 maxpower;
++ unsigned maxpower;
+
+ /* REVISIT: should we have config level
+ * suspend/resume callbacks?
+@@ -2278,10 +2286,14 @@ void composite_resume(struct usb_gadget *gadget)
+ f->resume(f);
+ }
+
+- maxpower = cdev->config->MaxPower;
++ maxpower = cdev->config->MaxPower ?
++ cdev->config->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW;
++ if (gadget->speed < USB_SPEED_SUPER)
++ maxpower = min(maxpower, 500U);
++ else
++ maxpower = min(maxpower, 900U);
+
+- usb_gadget_vbus_draw(gadget, maxpower ?
+- maxpower : CONFIG_USB_GADGET_VBUS_DRAW);
++ usb_gadget_vbus_draw(gadget, maxpower);
+ }
+
+ cdev->suspended = 0;
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 2050993fb58b..a9239455eb6d 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1077,18 +1077,19 @@ static int ffs_aio_cancel(struct kiocb *kiocb)
+ {
+ struct ffs_io_data *io_data = kiocb->private;
+ struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
++ unsigned long flags;
+ int value;
+
+ ENTER();
+
+- spin_lock_irq(&epfile->ffs->eps_lock);
++ spin_lock_irqsave(&epfile->ffs->eps_lock, flags);
+
+ if (likely(io_data && io_data->ep && io_data->req))
+ value = usb_ep_dequeue(io_data->ep, io_data->req);
+ else
+ value = -EINVAL;
+
+- spin_unlock_irq(&epfile->ffs->eps_lock);
++ spin_unlock_irqrestore(&epfile->ffs->eps_lock, flags);
+
+ return value;
+ }
+diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
+index d4d317db89df..38afe96c5cd2 100644
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -567,8 +567,10 @@ static int gs_start_io(struct gs_port *port)
+ port->n_read = 0;
+ started = gs_start_rx(port);
+
+- /* unblock any pending writes into our circular buffer */
+ if (started) {
++ gs_start_tx(port);
++ /* Unblock any pending writes into our circular buffer, in case
++ * we didn't in gs_start_tx() */
+ tty_wakeup(port->port.tty);
+ } else {
+ gs_free_requests(ep, head, &port->read_allocated);
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 1cd9b6305b06..1880f3e13f57 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1258,6 +1258,12 @@ UNUSUAL_DEV( 0x090a, 0x1200, 0x0000, 0x9999,
+ USB_SC_RBC, USB_PR_BULK, NULL,
+ 0 ),
+
++UNUSUAL_DEV(0x090c, 0x1000, 0x1100, 0x1100,
++ "Samsung",
++ "Flash Drive FIT",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_MAX_SECTORS_64),
++
+ /* aeb */
+ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
+ "Feiya",
+diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
+index c6b3bdbbdbc9..bfaa9ec4bc1f 100644
+--- a/drivers/video/console/vgacon.c
++++ b/drivers/video/console/vgacon.c
+@@ -1316,6 +1316,9 @@ static int vgacon_font_get(struct vc_data *c, struct console_font *font)
+ static int vgacon_resize(struct vc_data *c, unsigned int width,
+ unsigned int height, unsigned int user)
+ {
++ if ((width << 1) * height > vga_vram_size)
++ return -EINVAL;
++
+ if (width % 2 || width > screen_info.orig_video_cols ||
+ height > (screen_info.orig_video_lines * vga_default_font_height)/
+ c->vc_font.height)
+diff --git a/drivers/watchdog/da9062_wdt.c b/drivers/watchdog/da9062_wdt.c
+index fe169d8e1fb2..7f0a8e635286 100644
+--- a/drivers/watchdog/da9062_wdt.c
++++ b/drivers/watchdog/da9062_wdt.c
+@@ -99,13 +99,6 @@ static int da9062_wdt_stop(struct watchdog_device *wdd)
+ struct da9062_watchdog *wdt = watchdog_get_drvdata(wdd);
+ int ret;
+
+- ret = da9062_reset_watchdog_timer(wdt);
+- if (ret) {
+- dev_err(wdt->hw->dev, "Failed to ping the watchdog (err = %d)\n",
+- ret);
+- return ret;
+- }
+-
+ ret = regmap_update_bits(wdt->hw->regmap,
+ DA9062AA_CONTROL_D,
+ DA9062AA_TWDSCALE_MASK,
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index fbebf241dbf2..51d410c6f6a4 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -2003,6 +2003,7 @@ int cifs_revalidate_dentry_attr(struct dentry *dentry)
+ struct inode *inode = d_inode(dentry);
+ struct super_block *sb = dentry->d_sb;
+ char *full_path = NULL;
++ int count = 0;
+
+ if (inode == NULL)
+ return -ENOENT;
+@@ -2024,15 +2025,18 @@ int cifs_revalidate_dentry_attr(struct dentry *dentry)
+ full_path, inode, inode->i_count.counter,
+ dentry, cifs_get_time(dentry), jiffies);
+
++again:
+ if (cifs_sb_master_tcon(CIFS_SB(sb))->unix_ext)
+ rc = cifs_get_inode_info_unix(&inode, full_path, sb, xid);
+ else
+ rc = cifs_get_inode_info(&inode, full_path, NULL, sb,
+ xid, NULL);
+-
++ if (rc == -EAGAIN && count++ < 10)
++ goto again;
+ out:
+ kfree(full_path);
+ free_xid(xid);
++
+ return rc;
+ }
+
+diff --git a/fs/fat/inode.c b/fs/fat/inode.c
+index d6b81e31f9f5..70d37a5fd72c 100644
+--- a/fs/fat/inode.c
++++ b/fs/fat/inode.c
+@@ -743,6 +743,13 @@ static struct inode *fat_alloc_inode(struct super_block *sb)
+ return NULL;
+
+ init_rwsem(&ei->truncate_lock);
++ /* Zeroing to allow iput() even if partial initialized inode. */
++ ei->mmu_private = 0;
++ ei->i_start = 0;
++ ei->i_logstart = 0;
++ ei->i_attrs = 0;
++ ei->i_pos = 0;
++
+ return &ei->vfs_inode;
+ }
+
+@@ -1373,16 +1380,6 @@ out:
+ return 0;
+ }
+
+-static void fat_dummy_inode_init(struct inode *inode)
+-{
+- /* Initialize this dummy inode to work as no-op. */
+- MSDOS_I(inode)->mmu_private = 0;
+- MSDOS_I(inode)->i_start = 0;
+- MSDOS_I(inode)->i_logstart = 0;
+- MSDOS_I(inode)->i_attrs = 0;
+- MSDOS_I(inode)->i_pos = 0;
+-}
+-
+ static int fat_read_root(struct inode *inode)
+ {
+ struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);
+@@ -1827,13 +1824,11 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
+ fat_inode = new_inode(sb);
+ if (!fat_inode)
+ goto out_fail;
+- fat_dummy_inode_init(fat_inode);
+ sbi->fat_inode = fat_inode;
+
+ fsinfo_inode = new_inode(sb);
+ if (!fsinfo_inode)
+ goto out_fail;
+- fat_dummy_inode_init(fsinfo_inode);
+ fsinfo_inode->i_ino = MSDOS_FSINFO_INO;
+ sbi->fsinfo_inode = fsinfo_inode;
+ insert_inode_hash(fsinfo_inode);
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 00050a22f6a1..92aad49b82f9 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -625,6 +625,18 @@ void wait_for_kprobe_optimizer(void)
+ mutex_unlock(&kprobe_mutex);
+ }
+
++static bool optprobe_queued_unopt(struct optimized_kprobe *op)
++{
++ struct optimized_kprobe *_op;
++
++ list_for_each_entry(_op, &unoptimizing_list, list) {
++ if (op == _op)
++ return true;
++ }
++
++ return false;
++}
++
+ /* Optimize kprobe if p is ready to be optimized */
+ static void optimize_kprobe(struct kprobe *p)
+ {
+@@ -646,17 +658,21 @@ static void optimize_kprobe(struct kprobe *p)
+ return;
+
+ /* Check if it is already optimized. */
+- if (op->kp.flags & KPROBE_FLAG_OPTIMIZED)
++ if (op->kp.flags & KPROBE_FLAG_OPTIMIZED) {
++ if (optprobe_queued_unopt(op)) {
++ /* This is under unoptimizing. Just dequeue the probe */
++ list_del_init(&op->list);
++ }
+ return;
++ }
+ op->kp.flags |= KPROBE_FLAG_OPTIMIZED;
+
+- if (!list_empty(&op->list))
+- /* This is under unoptimizing. Just dequeue the probe */
+- list_del_init(&op->list);
+- else {
+- list_add(&op->list, &optimizing_list);
+- kick_kprobe_optimizer();
+- }
++ /* On unoptimizing/optimizing_list, op must have OPTIMIZED flag */
++ if (WARN_ON_ONCE(!list_empty(&op->list)))
++ return;
++
++ list_add(&op->list, &optimizing_list);
++ kick_kprobe_optimizer();
+ }
+
+ /* Short cut to direct unoptimizing */
+@@ -678,30 +694,33 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)
+ return; /* This is not an optprobe nor optimized */
+
+ op = container_of(p, struct optimized_kprobe, kp);
+- if (!kprobe_optimized(p)) {
+- /* Unoptimized or unoptimizing case */
+- if (force && !list_empty(&op->list)) {
+- /*
+- * Only if this is unoptimizing kprobe and forced,
+- * forcibly unoptimize it. (No need to unoptimize
+- * unoptimized kprobe again :)
+- */
+- list_del_init(&op->list);
+- force_unoptimize_kprobe(op);
+- }
++ if (!kprobe_optimized(p))
+ return;
+- }
+
+ if (!list_empty(&op->list)) {
+- /* Dequeue from the optimization queue */
+- list_del_init(&op->list);
++ if (optprobe_queued_unopt(op)) {
++ /* Queued in unoptimizing queue */
++ if (force) {
++ /*
++ * Forcibly unoptimize the kprobe here, and queue it
++ * in the freeing list for release afterwards.
++ */
++ force_unoptimize_kprobe(op);
++ list_move(&op->list, &freeing_list);
++ }
++ } else {
++ /* Dequeue from the optimizing queue */
++ list_del_init(&op->list);
++ op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
++ }
+ return;
+ }
++
+ /* Optimized kprobe case */
+- if (force)
++ if (force) {
+ /* Forcibly update the code: this is a special case */
+ force_unoptimize_kprobe(op);
+- else {
++ } else {
+ list_add(&op->list, &unoptimizing_list);
+ kick_kprobe_optimizer();
+ }
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 146998357bed..280b0e71b783 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2949,8 +2949,7 @@ void set_pmd_migration_entry(struct page_vma_mapped_walk *pvmw,
+ return;
+
+ flush_cache_range(vma, address, address + HPAGE_PMD_SIZE);
+- pmdval = *pvmw->pmd;
+- pmdp_invalidate(vma, address, pvmw->pmd);
++ pmdval = pmdp_invalidate(vma, address, pvmw->pmd);
+ if (pmd_dirty(pmdval))
+ set_page_dirty(page);
+ entry = make_migration_entry(page, pmd_write(pmdval));
+diff --git a/mm/mprotect.c b/mm/mprotect.c
+index 6d331620b9e5..86837f25055b 100644
+--- a/mm/mprotect.c
++++ b/mm/mprotect.c
+@@ -162,6 +162,31 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
+ return pages;
+ }
+
++/*
++ * Used when setting automatic NUMA hinting protection where it is
++ * critical that a numa hinting PMD is not confused with a bad PMD.
++ */
++static inline int pmd_none_or_clear_bad_unless_trans_huge(pmd_t *pmd)
++{
++ pmd_t pmdval = pmd_read_atomic(pmd);
++
++ /* See pmd_none_or_trans_huge_or_clear_bad for info on barrier */
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++ barrier();
++#endif
++
++ if (pmd_none(pmdval))
++ return 1;
++ if (pmd_trans_huge(pmdval))
++ return 0;
++ if (unlikely(pmd_bad(pmdval))) {
++ pmd_clear_bad(pmd);
++ return 1;
++ }
++
++ return 0;
++}
++
+ static inline unsigned long change_pmd_range(struct vm_area_struct *vma,
+ pud_t *pud, unsigned long addr, unsigned long end,
+ pgprot_t newprot, int dirty_accountable, int prot_numa)
+@@ -178,8 +203,17 @@ static inline unsigned long change_pmd_range(struct vm_area_struct *vma,
+ unsigned long this_pages;
+
+ next = pmd_addr_end(addr, end);
+- if (!is_swap_pmd(*pmd) && !pmd_trans_huge(*pmd) && !pmd_devmap(*pmd)
+- && pmd_none_or_clear_bad(pmd))
++
++ /*
++ * Automatic NUMA balancing walks the tables with mmap_sem
++ * held for read. It's possible a parallel update to occur
++ * between pmd_trans_huge() and a pmd_none_or_clear_bad()
++ * check leading to a false positive and clearing.
++ * Hence, it's necessary to atomically read the PMD value
++ * for all the checks.
++ */
++ if (!is_swap_pmd(*pmd) && !pmd_devmap(*pmd) &&
++ pmd_none_or_clear_bad_unless_trans_huge(pmd))
+ goto next;
+
+ /* invoke the mmu notifier if the pmd is populated */
+diff --git a/sound/hda/ext/hdac_ext_controller.c b/sound/hda/ext/hdac_ext_controller.c
+index 60cb00fd0c69..84b44cdae28a 100644
+--- a/sound/hda/ext/hdac_ext_controller.c
++++ b/sound/hda/ext/hdac_ext_controller.c
+@@ -262,6 +262,7 @@ EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_link_power_down_all);
+ int snd_hdac_ext_bus_link_get(struct hdac_bus *bus,
+ struct hdac_ext_link *link)
+ {
++ unsigned long codec_mask;
+ int ret = 0;
+
+ mutex_lock(&bus->lock);
+@@ -283,9 +284,11 @@ int snd_hdac_ext_bus_link_get(struct hdac_bus *bus,
+ * HDA spec section 4.3 - Codec Discovery
+ */
+ udelay(521);
+- bus->codec_mask = snd_hdac_chip_readw(bus, STATESTS);
+- dev_dbg(bus->dev, "codec_mask = 0x%lx\n", bus->codec_mask);
+- snd_hdac_chip_writew(bus, STATESTS, bus->codec_mask);
++ codec_mask = snd_hdac_chip_readw(bus, STATESTS);
++ dev_dbg(bus->dev, "codec_mask = 0x%lx\n", codec_mask);
++ snd_hdac_chip_writew(bus, STATESTS, codec_mask);
++ if (!bus->codec_mask)
++ bus->codec_mask = codec_mask;
+ }
+
+ mutex_unlock(&bus->lock);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 94fffc0675a7..86ab022f386e 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2442,6 +2442,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
++ SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
+@@ -6465,6 +6466,8 @@ static const struct hda_fixup alc269_fixups[] = {
+ [ALC285_FIXUP_SPEAKER2_TO_DAC1] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_speaker2_to_dac1,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_THINKPAD_ACPI
+ },
+ [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
+ .type = HDA_FIXUP_PINS,
+@@ -6886,6 +6889,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x097e, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
+ SND_PCI_QUIRK(0x1028, 0x097d, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
++ SND_PCI_QUIRK(0x1028, 0x098d, "Dell Precision", ALC233_FIXUP_ASUS_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1028, 0x09bf, "Dell Precision", ALC233_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
+diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
+index f0f2d4fd3769..5272c81641c1 100644
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -1437,13 +1437,15 @@ int pcm512x_probe(struct device *dev, struct regmap *regmap)
+ }
+
+ pcm512x->sclk = devm_clk_get(dev, NULL);
+- if (PTR_ERR(pcm512x->sclk) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(pcm512x->sclk) == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto err;
++ }
+ if (!IS_ERR(pcm512x->sclk)) {
+ ret = clk_prepare_enable(pcm512x->sclk);
+ if (ret != 0) {
+ dev_err(dev, "Failed to enable SCLK: %d\n", ret);
+- return ret;
++ goto err;
+ }
+ }
+
+diff --git a/sound/soc/intel/skylake/skl-debug.c b/sound/soc/intel/skylake/skl-debug.c
+index faf1cba57abb..a0714c0e6e8b 100644
+--- a/sound/soc/intel/skylake/skl-debug.c
++++ b/sound/soc/intel/skylake/skl-debug.c
+@@ -42,8 +42,8 @@ static ssize_t skl_print_pins(struct skl_module_pin *m_pin, char *buf,
+ int i;
+ ssize_t ret = 0;
+
+- for (i = 0; i < max_pin; i++)
+- ret += snprintf(buf + size, MOD_BUF - size,
++ for (i = 0; i < max_pin; i++) {
++ ret += scnprintf(buf + size, MOD_BUF - size,
+ "%s %d\n\tModule %d\n\tInstance %d\n\t"
+ "In-used %s\n\tType %s\n"
+ "\tState %d\n\tIndex %d\n",
+@@ -53,13 +53,15 @@ static ssize_t skl_print_pins(struct skl_module_pin *m_pin, char *buf,
+ m_pin[i].in_use ? "Used" : "Unused",
+ m_pin[i].is_dynamic ? "Dynamic" : "Static",
+ m_pin[i].pin_state, i);
++ size += ret;
++ }
+ return ret;
+ }
+
+ static ssize_t skl_print_fmt(struct skl_module_fmt *fmt, char *buf,
+ ssize_t size, bool direction)
+ {
+- return snprintf(buf + size, MOD_BUF - size,
++ return scnprintf(buf + size, MOD_BUF - size,
+ "%s\n\tCh %d\n\tFreq %d\n\tBit depth %d\n\t"
+ "Valid bit depth %d\n\tCh config %#x\n\tInterleaving %d\n\t"
+ "Sample Type %d\n\tCh Map %#x\n",
+@@ -81,16 +83,16 @@ static ssize_t module_read(struct file *file, char __user *user_buf,
+ if (!buf)
+ return -ENOMEM;
+
+- ret = snprintf(buf, MOD_BUF, "Module:\n\tUUID %pUL\n\tModule id %d\n"
++ ret = scnprintf(buf, MOD_BUF, "Module:\n\tUUID %pUL\n\tModule id %d\n"
+ "\tInstance id %d\n\tPvt_id %d\n", mconfig->guid,
+ mconfig->id.module_id, mconfig->id.instance_id,
+ mconfig->id.pvt_id);
+
+- ret += snprintf(buf + ret, MOD_BUF - ret,
++ ret += scnprintf(buf + ret, MOD_BUF - ret,
+ "Resources:\n\tMCPS %#x\n\tIBS %#x\n\tOBS %#x\t\n",
+ mconfig->mcps, mconfig->ibs, mconfig->obs);
+
+- ret += snprintf(buf + ret, MOD_BUF - ret,
++ ret += scnprintf(buf + ret, MOD_BUF - ret,
+ "Module data:\n\tCore %d\n\tIn queue %d\n\t"
+ "Out queue %d\n\tType %s\n",
+ mconfig->core_id, mconfig->max_in_queue,
+@@ -100,38 +102,38 @@ static ssize_t module_read(struct file *file, char __user *user_buf,
+ ret += skl_print_fmt(mconfig->in_fmt, buf, ret, true);
+ ret += skl_print_fmt(mconfig->out_fmt, buf, ret, false);
+
+- ret += snprintf(buf + ret, MOD_BUF - ret,
++ ret += scnprintf(buf + ret, MOD_BUF - ret,
+ "Fixup:\n\tParams %#x\n\tConverter %#x\n",
+ mconfig->params_fixup, mconfig->converter);
+
+- ret += snprintf(buf + ret, MOD_BUF - ret,
++ ret += scnprintf(buf + ret, MOD_BUF - ret,
+ "Module Gateway:\n\tType %#x\n\tVbus %#x\n\tHW conn %#x\n\tSlot %#x\n",
+ mconfig->dev_type, mconfig->vbus_id,
+ mconfig->hw_conn_type, mconfig->time_slot);
+
+- ret += snprintf(buf + ret, MOD_BUF - ret,
++ ret += scnprintf(buf + ret, MOD_BUF - ret,
+ "Pipeline:\n\tID %d\n\tPriority %d\n\tConn Type %d\n\t"
+ "Pages %#x\n", mconfig->pipe->ppl_id,
+ mconfig->pipe->pipe_priority, mconfig->pipe->conn_type,
+ mconfig->pipe->memory_pages);
+
+- ret += snprintf(buf + ret, MOD_BUF - ret,
++ ret += scnprintf(buf + ret, MOD_BUF - ret,
+ "\tParams:\n\t\tHost DMA %d\n\t\tLink DMA %d\n",
+ mconfig->pipe->p_params->host_dma_id,
+ mconfig->pipe->p_params->link_dma_id);
+
+- ret += snprintf(buf + ret, MOD_BUF - ret,
++ ret += scnprintf(buf + ret, MOD_BUF - ret,
+ "\tPCM params:\n\t\tCh %d\n\t\tFreq %d\n\t\tFormat %d\n",
+ mconfig->pipe->p_params->ch,
+ mconfig->pipe->p_params->s_freq,
+ mconfig->pipe->p_params->s_fmt);
+
+- ret += snprintf(buf + ret, MOD_BUF - ret,
++ ret += scnprintf(buf + ret, MOD_BUF - ret,
+ "\tLink %#x\n\tStream %#x\n",
+ mconfig->pipe->p_params->linktype,
+ mconfig->pipe->p_params->stream);
+
+- ret += snprintf(buf + ret, MOD_BUF - ret,
++ ret += scnprintf(buf + ret, MOD_BUF - ret,
+ "\tState %d\n\tPassthru %s\n",
+ mconfig->pipe->state,
+ mconfig->pipe->passthru ? "true" : "false");
+@@ -141,7 +143,7 @@ static ssize_t module_read(struct file *file, char __user *user_buf,
+ ret += skl_print_pins(mconfig->m_out_pin, buf,
+ mconfig->max_out_queue, ret, false);
+
+- ret += snprintf(buf + ret, MOD_BUF - ret,
++ ret += scnprintf(buf + ret, MOD_BUF - ret,
+ "Other:\n\tDomain %d\n\tHomogeneous Input %s\n\t"
+ "Homogeneous Output %s\n\tIn Queue Mask %d\n\t"
+ "Out Queue Mask %d\n\tDMA ID %d\n\tMem Pages %d\n\t"
+@@ -199,7 +201,7 @@ static ssize_t fw_softreg_read(struct file *file, char __user *user_buf,
+ __ioread32_copy(d->fw_read_buff, fw_reg_addr, w0_stat_sz >> 2);
+
+ for (offset = 0; offset < FW_REG_SIZE; offset += 16) {
+- ret += snprintf(tmp + ret, FW_REG_BUF - ret, "%#.4x: ", offset);
++ ret += scnprintf(tmp + ret, FW_REG_BUF - ret, "%#.4x: ", offset);
+ hex_dump_to_buffer(d->fw_read_buff + offset, 16, 16, 4,
+ tmp + ret, FW_REG_BUF - ret, 0);
+ ret += strlen(tmp + ret);
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 7f0b48b36380..db5b005f4b1e 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -4551,7 +4551,7 @@ static void soc_dapm_shutdown_dapm(struct snd_soc_dapm_context *dapm)
+ continue;
+ if (w->power) {
+ dapm_seq_insert(w, &down_list, false);
+- w->power = 0;
++ w->new_power = 0;
+ powerdown = 1;
+ }
+ }
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index f7d4a77028f2..356d4e754561 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -3357,16 +3357,16 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
+ ssize_t offset = 0;
+
+ /* FE state */
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ "[%s - %s]\n", fe->dai_link->name,
+ stream ? "Capture" : "Playback");
+
+- offset += snprintf(buf + offset, size - offset, "State: %s\n",
++ offset += scnprintf(buf + offset, size - offset, "State: %s\n",
+ dpcm_state_string(fe->dpcm[stream].state));
+
+ if ((fe->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
+ (fe->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ "Hardware Params: "
+ "Format = %s, Channels = %d, Rate = %d\n",
+ snd_pcm_format_name(params_format(params)),
+@@ -3374,10 +3374,10 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
+ params_rate(params));
+
+ /* BEs state */
+- offset += snprintf(buf + offset, size - offset, "Backends:\n");
++ offset += scnprintf(buf + offset, size - offset, "Backends:\n");
+
+ if (list_empty(&fe->dpcm[stream].be_clients)) {
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ " No active DSP links\n");
+ goto out;
+ }
+@@ -3386,16 +3386,16 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
+ struct snd_soc_pcm_runtime *be = dpcm->be;
+ params = &dpcm->hw_params;
+
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ "- %s\n", be->dai_link->name);
+
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ " State: %s\n",
+ dpcm_state_string(be->dpcm[stream].state));
+
+ if ((be->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) &&
+ (be->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP))
+- offset += snprintf(buf + offset, size - offset,
++ offset += scnprintf(buf + offset, size - offset,
+ " Hardware Params: "
+ "Format = %s, Channels = %d, Rate = %d\n",
+ snd_pcm_format_name(params_format(params)),
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 069f38fbf07b..30fc45aa1869 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -2154,8 +2154,11 @@ static int soc_tplg_link_elems_load(struct soc_tplg *tplg,
+ }
+
+ ret = soc_tplg_link_config(tplg, _link);
+- if (ret < 0)
++ if (ret < 0) {
++ if (!abi_match)
++ kfree(_link);
+ return ret;
++ }
+
+ /* offset by version-specific struct size and
+ * real priv data size
+@@ -2310,7 +2313,7 @@ static int soc_tplg_manifest_load(struct soc_tplg *tplg,
+ {
+ struct snd_soc_tplg_manifest *manifest, *_manifest;
+ bool abi_match;
+- int err;
++ int ret = 0;
+
+ if (tplg->pass != SOC_TPLG_PASS_MANIFEST)
+ return 0;
+@@ -2323,19 +2326,19 @@ static int soc_tplg_manifest_load(struct soc_tplg *tplg,
+ _manifest = manifest;
+ } else {
+ abi_match = false;
+- err = manifest_new_ver(tplg, manifest, &_manifest);
+- if (err < 0)
+- return err;
++ ret = manifest_new_ver(tplg, manifest, &_manifest);
++ if (ret < 0)
++ return ret;
+ }
+
+ /* pass control to component driver for optional further init */
+ if (tplg->comp && tplg->ops && tplg->ops->manifest)
+- return tplg->ops->manifest(tplg->comp, tplg->index, _manifest);
++ ret = tplg->ops->manifest(tplg->comp, tplg->index, _manifest);
+
+ if (!abi_match) /* free the duplicated one */
+ kfree(_manifest);
+
+- return 0;
++ return ret;
+ }
+
+ /* validate header magic, size and type */
+diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
+index 8b0f16409ed7..0ef203ec59fd 100644
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -85,17 +85,20 @@ else
+ $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_PROGS))
+ endif
+
++define INSTALL_SINGLE_RULE
++ $(if $(INSTALL_LIST),@mkdir -p $(INSTALL_PATH))
++ $(if $(INSTALL_LIST),@echo rsync -a $(INSTALL_LIST) $(INSTALL_PATH)/)
++ $(if $(INSTALL_LIST),@rsync -a $(INSTALL_LIST) $(INSTALL_PATH)/)
++endef
++
+ define INSTALL_RULE
+- @if [ "X$(TEST_PROGS)$(TEST_PROGS_EXTENDED)$(TEST_FILES)" != "X" ]; then \
+- mkdir -p ${INSTALL_PATH}; \
+- echo "rsync -a $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(INSTALL_PATH)/"; \
+- rsync -a $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(INSTALL_PATH)/; \
+- fi
+- @if [ "X$(TEST_GEN_PROGS)$(TEST_CUSTOM_PROGS)$(TEST_GEN_PROGS_EXTENDED)$(TEST_GEN_FILES)" != "X" ]; then \
+- mkdir -p ${INSTALL_PATH}; \
+- echo "rsync -a $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/"; \
+- rsync -a $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/; \
+- fi
++ $(eval INSTALL_LIST = $(TEST_PROGS)) $(INSTALL_SINGLE_RULE)
++ $(eval INSTALL_LIST = $(TEST_PROGS_EXTENDED)) $(INSTALL_SINGLE_RULE)
++ $(eval INSTALL_LIST = $(TEST_FILES)) $(INSTALL_SINGLE_RULE)
++ $(eval INSTALL_LIST = $(TEST_GEN_PROGS)) $(INSTALL_SINGLE_RULE)
++ $(eval INSTALL_LIST = $(TEST_CUSTOM_PROGS)) $(INSTALL_SINGLE_RULE)
++ $(eval INSTALL_LIST = $(TEST_GEN_PROGS_EXTENDED)) $(INSTALL_SINGLE_RULE)
++ $(eval INSTALL_LIST = $(TEST_GEN_FILES)) $(INSTALL_SINGLE_RULE)
+ endef
+
+ install: all
+diff --git a/tools/testing/selftests/net/forwarding/mirror_gre.sh b/tools/testing/selftests/net/forwarding/mirror_gre.sh
+index e6fd7a18c655..0266443601bc 100755
+--- a/tools/testing/selftests/net/forwarding/mirror_gre.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre.sh
+@@ -63,22 +63,23 @@ test_span_gre_mac()
+ {
+ local tundev=$1; shift
+ local direction=$1; shift
+- local prot=$1; shift
+ local what=$1; shift
+
+- local swp3mac=$(mac_get $swp3)
+- local h3mac=$(mac_get $h3)
++ case "$direction" in
++ ingress) local src_mac=$(mac_get $h1); local dst_mac=$(mac_get $h2)
++ ;;
++ egress) local src_mac=$(mac_get $h2); local dst_mac=$(mac_get $h1)
++ ;;
++ esac
+
+ RET=0
+
+ mirror_install $swp1 $direction $tundev "matchall $tcflags"
+- tc filter add dev $h3 ingress pref 77 prot $prot \
+- flower ip_proto 0x2f src_mac $swp3mac dst_mac $h3mac \
+- action pass
++ icmp_capture_install h3-${tundev} "src_mac $src_mac dst_mac $dst_mac"
+
+- mirror_test v$h1 192.0.2.1 192.0.2.2 $h3 77 10
++ mirror_test v$h1 192.0.2.1 192.0.2.2 h3-${tundev} 100 10
+
+- tc filter del dev $h3 ingress pref 77
++ icmp_capture_uninstall h3-${tundev}
+ mirror_uninstall $swp1 $direction
+
+ log_test "$direction $what: envelope MAC ($tcflags)"
+@@ -120,14 +121,14 @@ test_ip6gretap()
+
+ test_gretap_mac()
+ {
+- test_span_gre_mac gt4 ingress ip "mirror to gretap"
+- test_span_gre_mac gt4 egress ip "mirror to gretap"
++ test_span_gre_mac gt4 ingress "mirror to gretap"
++ test_span_gre_mac gt4 egress "mirror to gretap"
+ }
+
+ test_ip6gretap_mac()
+ {
+- test_span_gre_mac gt6 ingress ipv6 "mirror to ip6gretap"
+- test_span_gre_mac gt6 egress ipv6 "mirror to ip6gretap"
++ test_span_gre_mac gt6 ingress "mirror to ip6gretap"
++ test_span_gre_mac gt6 egress "mirror to ip6gretap"
+ }
+
+ test_all()
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-03-16 12:23 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-03-16 12:23 UTC (permalink / raw
To: gentoo-commits
commit: a66c75a90a0ff3fd27e2fe18daa09dce21c12202
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 16 12:23:25 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Mar 16 12:23:25 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a66c75a9
Linux patch 4.19.110
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 ++++
1109_linux-4.19.110.patch | 26 ++++++++++++++++++++++++++
2 files changed, 30 insertions(+)
diff --git a/0000_README b/0000_README
index f28ed71..8e31d5f 100644
--- a/0000_README
+++ b/0000_README
@@ -475,6 +475,10 @@ Patch: 1108_linux-4.19.109.patch
From: https://www.kernel.org
Desc: Linux 4.19.109
+Patch: 1109_linux-4.19.110.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.110
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1109_linux-4.19.110.patch b/1109_linux-4.19.110.patch
new file mode 100644
index 0000000..955b326
--- /dev/null
+++ b/1109_linux-4.19.110.patch
@@ -0,0 +1,26 @@
+diff --git a/Makefile b/Makefile
+index 059c5e0aac15..ada958d1bc2b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 109
++SUBLEVEL = 110
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 3f0565e1a7a8..cc8f3b41a1b2 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1336,7 +1336,7 @@ static __init void svm_adjust_mmio_mask(void)
+ */
+ mask = (mask_bit < 52) ? rsvd_bits(mask_bit, 51) | PT_PRESENT_MASK : 0;
+
+- kvm_mmu_set_mmio_spte_mask(mask, PT_WRITABLE_MASK | PT_USER_MASK);
++ kvm_mmu_set_mmio_spte_mask(mask, mask);
+ }
+
+ static __init int svm_hardware_setup(void)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-03-18 14:21 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-03-18 14:21 UTC (permalink / raw
To: gentoo-commits
commit: 0c71034458005ca3ca7c140cd80cafd8e68e314a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 18 14:20:50 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 18 14:20:50 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0c710344
Linux patch 4.19.111
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1110_linux-4.19.111.patch | 2538 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2542 insertions(+)
diff --git a/0000_README b/0000_README
index 8e31d5f..7eab5d8 100644
--- a/0000_README
+++ b/0000_README
@@ -479,6 +479,10 @@ Patch: 1109_linux-4.19.110.patch
From: https://www.kernel.org
Desc: Linux 4.19.110
+Patch: 1110_linux-4.19.111.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.111
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1110_linux-4.19.111.patch b/1110_linux-4.19.111.patch
new file mode 100644
index 0000000..d0588c2
--- /dev/null
+++ b/1110_linux-4.19.111.patch
@@ -0,0 +1,2538 @@
+diff --git a/Documentation/filesystems/porting b/Documentation/filesystems/porting
+index 32b5186be412..041b0ded8b44 100644
+--- a/Documentation/filesystems/porting
++++ b/Documentation/filesystems/porting
+@@ -627,3 +627,10 @@ in your dentry operations instead.
+ DCACHE_RCUACCESS is gone; having an RCU delay on dentry freeing is the
+ default. DCACHE_NORCU opts out, and only d_alloc_pseudo() has any
+ business doing so.
++--
++[mandatory]
++
++ [should've been added in 2016] stale comment in finish_open()
++ nonwithstanding, failure exits in ->atomic_open() instances should
++ *NOT* fput() the file, no matter what. Everything is handled by the
++ caller.
+diff --git a/Makefile b/Makefile
+index ada958d1bc2b..fed04bdef0a3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 110
++SUBLEVEL = 111
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h
+index b29f1a9fd6f7..07c8e1a6c56e 100644
+--- a/arch/arc/include/asm/linkage.h
++++ b/arch/arc/include/asm/linkage.h
+@@ -14,6 +14,8 @@
+ #ifdef __ASSEMBLY__
+
+ #define ASM_NL ` /* use '`' to mark new line in macro */
++#define __ALIGN .align 4
++#define __ALIGN_STR __stringify(__ALIGN)
+
+ /* annotation for data we want in DCCM - if enabled in .config */
+ .macro ARCFP_DATA nm
+diff --git a/arch/x86/kernel/cpu/mcheck/mce_intel.c b/arch/x86/kernel/cpu/mcheck/mce_intel.c
+index d05be307d081..1d87b85150db 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce_intel.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_intel.c
+@@ -489,17 +489,18 @@ static void intel_ppin_init(struct cpuinfo_x86 *c)
+ return;
+
+ if ((val & 3UL) == 1UL) {
+- /* PPIN available but disabled: */
++ /* PPIN locked in disabled mode */
+ return;
+ }
+
+- /* If PPIN is disabled, but not locked, try to enable: */
+- if (!(val & 3UL)) {
++ /* If PPIN is disabled, try to enable */
++ if (!(val & 2UL)) {
+ wrmsrl_safe(MSR_PPIN_CTL, val | 2UL);
+ rdmsrl_safe(MSR_PPIN_CTL, &val);
+ }
+
+- if ((val & 3UL) == 2UL)
++ /* Is the enable bit set? */
++ if (val & 2UL)
+ set_cpu_cap(c, X86_FEATURE_INTEL_PPIN);
+ }
+ }
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index c91431bc476e..210eabd71ab2 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -5112,6 +5112,7 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
+ ctxt->fetch.ptr = ctxt->fetch.data;
+ ctxt->fetch.end = ctxt->fetch.data + insn_len;
+ ctxt->opcode_len = 1;
++ ctxt->intercept = x86_intercept_none;
+ if (insn_len > 0)
+ memcpy(ctxt->fetch.data, insn, insn_len);
+ else {
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index dd64f586679e..728c9a9609f0 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -271,10 +271,12 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx,
+ err = virtblk_add_req(vblk->vqs[qid].vq, vbr, vbr->sg, num);
+ if (err) {
+ virtqueue_kick(vblk->vqs[qid].vq);
+- blk_mq_stop_hw_queue(hctx);
++ /* Don't stop the queue if -ENOMEM: we may have failed to
++ * bounce the buffer due to global resource outage.
++ */
++ if (err == -ENOSPC)
++ blk_mq_stop_hw_queue(hctx);
+ spin_unlock_irqrestore(&vblk->vqs[qid].lock, flags);
+- /* Out of mem doesn't actually happen, since we fall back
+- * to direct descriptors */
+ if (err == -ENOMEM || err == -ENOSPC)
+ return BLK_STS_DEV_RESOURCE;
+ return BLK_STS_IOERR;
+diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
+index 3e626fd9bd4e..1c65f5ac4368 100644
+--- a/drivers/firmware/efi/efivars.c
++++ b/drivers/firmware/efi/efivars.c
+@@ -139,13 +139,16 @@ static ssize_t
+ efivar_attr_read(struct efivar_entry *entry, char *buf)
+ {
+ struct efi_variable *var = &entry->var;
++ unsigned long size = sizeof(var->Data);
+ char *str = buf;
++ int ret;
+
+ if (!entry || !buf)
+ return -EINVAL;
+
+- var->DataSize = 1024;
+- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data))
++ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data);
++ var->DataSize = size;
++ if (ret)
+ return -EIO;
+
+ if (var->Attributes & EFI_VARIABLE_NON_VOLATILE)
+@@ -172,13 +175,16 @@ static ssize_t
+ efivar_size_read(struct efivar_entry *entry, char *buf)
+ {
+ struct efi_variable *var = &entry->var;
++ unsigned long size = sizeof(var->Data);
+ char *str = buf;
++ int ret;
+
+ if (!entry || !buf)
+ return -EINVAL;
+
+- var->DataSize = 1024;
+- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data))
++ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data);
++ var->DataSize = size;
++ if (ret)
+ return -EIO;
+
+ str += sprintf(str, "0x%lx\n", var->DataSize);
+@@ -189,12 +195,15 @@ static ssize_t
+ efivar_data_read(struct efivar_entry *entry, char *buf)
+ {
+ struct efi_variable *var = &entry->var;
++ unsigned long size = sizeof(var->Data);
++ int ret;
+
+ if (!entry || !buf)
+ return -EINVAL;
+
+- var->DataSize = 1024;
+- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data))
++ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data);
++ var->DataSize = size;
++ if (ret)
+ return -EIO;
+
+ memcpy(buf, var->Data, var->DataSize);
+@@ -263,6 +272,9 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count)
+ u8 *data;
+ int err;
+
++ if (!entry || !buf)
++ return -EINVAL;
++
+ if (is_compat()) {
+ struct compat_efi_variable *compat;
+
+@@ -314,14 +326,16 @@ efivar_show_raw(struct efivar_entry *entry, char *buf)
+ {
+ struct efi_variable *var = &entry->var;
+ struct compat_efi_variable *compat;
++ unsigned long datasize = sizeof(var->Data);
+ size_t size;
++ int ret;
+
+ if (!entry || !buf)
+ return 0;
+
+- var->DataSize = 1024;
+- if (efivar_entry_get(entry, &entry->var.Attributes,
+- &entry->var.DataSize, entry->var.Data))
++ ret = efivar_entry_get(entry, &var->Attributes, &datasize, var->Data);
++ var->DataSize = datasize;
++ if (ret)
+ return -EIO;
+
+ if (is_compat()) {
+diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
+index b0aeffd4e269..92e519d58618 100644
+--- a/drivers/firmware/efi/runtime-wrappers.c
++++ b/drivers/firmware/efi/runtime-wrappers.c
+@@ -45,39 +45,7 @@
+ #define __efi_call_virt(f, args...) \
+ __efi_call_virt_pointer(efi.systab->runtime, f, args)
+
+-/* efi_runtime_service() function identifiers */
+-enum efi_rts_ids {
+- GET_TIME,
+- SET_TIME,
+- GET_WAKEUP_TIME,
+- SET_WAKEUP_TIME,
+- GET_VARIABLE,
+- GET_NEXT_VARIABLE,
+- SET_VARIABLE,
+- QUERY_VARIABLE_INFO,
+- GET_NEXT_HIGH_MONO_COUNT,
+- UPDATE_CAPSULE,
+- QUERY_CAPSULE_CAPS,
+-};
+-
+-/*
+- * efi_runtime_work: Details of EFI Runtime Service work
+- * @arg<1-5>: EFI Runtime Service function arguments
+- * @status: Status of executing EFI Runtime Service
+- * @efi_rts_id: EFI Runtime Service function identifier
+- * @efi_rts_comp: Struct used for handling completions
+- */
+-struct efi_runtime_work {
+- void *arg1;
+- void *arg2;
+- void *arg3;
+- void *arg4;
+- void *arg5;
+- efi_status_t status;
+- struct work_struct work;
+- enum efi_rts_ids efi_rts_id;
+- struct completion efi_rts_comp;
+-};
++struct efi_runtime_work efi_rts_work;
+
+ /*
+ * efi_queue_work: Queue efi_runtime_service() and wait until it's done
+@@ -91,7 +59,6 @@ struct efi_runtime_work {
+ */
+ #define efi_queue_work(_rts, _arg1, _arg2, _arg3, _arg4, _arg5) \
+ ({ \
+- struct efi_runtime_work efi_rts_work; \
+ efi_rts_work.status = EFI_ABORTED; \
+ \
+ init_completion(&efi_rts_work.efi_rts_comp); \
+@@ -191,18 +158,16 @@ extern struct semaphore __efi_uv_runtime_lock __alias(efi_runtime_lock);
+ */
+ static void efi_call_rts(struct work_struct *work)
+ {
+- struct efi_runtime_work *efi_rts_work;
+ void *arg1, *arg2, *arg3, *arg4, *arg5;
+ efi_status_t status = EFI_NOT_FOUND;
+
+- efi_rts_work = container_of(work, struct efi_runtime_work, work);
+- arg1 = efi_rts_work->arg1;
+- arg2 = efi_rts_work->arg2;
+- arg3 = efi_rts_work->arg3;
+- arg4 = efi_rts_work->arg4;
+- arg5 = efi_rts_work->arg5;
++ arg1 = efi_rts_work.arg1;
++ arg2 = efi_rts_work.arg2;
++ arg3 = efi_rts_work.arg3;
++ arg4 = efi_rts_work.arg4;
++ arg5 = efi_rts_work.arg5;
+
+- switch (efi_rts_work->efi_rts_id) {
++ switch (efi_rts_work.efi_rts_id) {
+ case GET_TIME:
+ status = efi_call_virt(get_time, (efi_time_t *)arg1,
+ (efi_time_cap_t *)arg2);
+@@ -260,8 +225,8 @@ static void efi_call_rts(struct work_struct *work)
+ */
+ pr_err("Requested executing invalid EFI Runtime Service.\n");
+ }
+- efi_rts_work->status = status;
+- complete(&efi_rts_work->efi_rts_comp);
++ efi_rts_work.status = status;
++ complete(&efi_rts_work.efi_rts_comp);
+ }
+
+ static efi_status_t virt_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+index d1fbaea91f58..95f7bb22402f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+@@ -364,8 +364,7 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
+ router.ddc_valid = false;
+ router.cd_valid = false;
+ for (j = 0; j < ((le16_to_cpu(path->usSize) - 8) / 2); j++) {
+- uint8_t grph_obj_type=
+- grph_obj_type =
++ uint8_t grph_obj_type =
+ (le16_to_cpu(path->usGraphicObjIds[j]) &
+ OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+
+diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
+index 69bba88906cd..9cf769f8ebb2 100644
+--- a/drivers/gpu/drm/i915/gvt/vgpu.c
++++ b/drivers/gpu/drm/i915/gvt/vgpu.c
+@@ -272,10 +272,17 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
+ {
+ struct intel_gvt *gvt = vgpu->gvt;
+
+- mutex_lock(&vgpu->vgpu_lock);
+-
+ WARN(vgpu->active, "vGPU is still active!\n");
+
++ /*
++ * remove idr first so later clean can judge if need to stop
++ * service if no active vgpu.
++ */
++ mutex_lock(&gvt->lock);
++ idr_remove(&gvt->vgpu_idr, vgpu->id);
++ mutex_unlock(&gvt->lock);
++
++ mutex_lock(&vgpu->vgpu_lock);
+ intel_gvt_debugfs_remove_vgpu(vgpu);
+ intel_vgpu_clean_sched_policy(vgpu);
+ intel_vgpu_clean_submission(vgpu);
+@@ -290,7 +297,6 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
+ mutex_unlock(&vgpu->vgpu_lock);
+
+ mutex_lock(&gvt->lock);
+- idr_remove(&gvt->vgpu_idr, vgpu->id);
+ if (idr_is_empty(&gvt->vgpu_idr))
+ intel_gvt_clean_irq(gvt);
+ intel_gvt_update_vgpu_types(gvt);
+diff --git a/drivers/i2c/busses/i2c-gpio.c b/drivers/i2c/busses/i2c-gpio.c
+index c008d209f0b8..87014d144ccd 100644
+--- a/drivers/i2c/busses/i2c-gpio.c
++++ b/drivers/i2c/busses/i2c-gpio.c
+@@ -248,7 +248,7 @@ static struct gpio_desc *i2c_gpio_get_desc(struct device *dev,
+ if (ret == -ENOENT)
+ retdesc = ERR_PTR(-EPROBE_DEFER);
+
+- if (ret != -EPROBE_DEFER)
++ if (PTR_ERR(retdesc) != -EPROBE_DEFER)
+ dev_err(dev, "error trying to get descriptor: %d\n", ret);
+
+ return retdesc;
+diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
+index 559c3b1284d7..eb0569359387 100644
+--- a/drivers/i2c/i2c-core-acpi.c
++++ b/drivers/i2c/i2c-core-acpi.c
+@@ -352,10 +352,18 @@ static struct i2c_adapter *i2c_acpi_find_adapter_by_handle(acpi_handle handle)
+ static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev)
+ {
+ struct device *dev;
++ struct i2c_client *client;
+
+ dev = bus_find_device(&i2c_bus_type, NULL, adev,
+ i2c_acpi_find_match_device);
+- return dev ? i2c_verify_client(dev) : NULL;
++ if (!dev)
++ return NULL;
++
++ client = i2c_verify_client(dev);
++ if (!client)
++ put_device(dev);
++
++ return client;
+ }
+
+ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value,
+diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
+index f9dbb064f957..31ba8f92584a 100644
+--- a/drivers/iommu/dma-iommu.c
++++ b/drivers/iommu/dma-iommu.c
+@@ -190,15 +190,15 @@ static int cookie_init_hw_msi_region(struct iommu_dma_cookie *cookie,
+ start -= iova_offset(iovad, start);
+ num_pages = iova_align(iovad, end - start) >> iova_shift(iovad);
+
+- msi_page = kcalloc(num_pages, sizeof(*msi_page), GFP_KERNEL);
+- if (!msi_page)
+- return -ENOMEM;
+-
+ for (i = 0; i < num_pages; i++) {
+- msi_page[i].phys = start;
+- msi_page[i].iova = start;
+- INIT_LIST_HEAD(&msi_page[i].list);
+- list_add(&msi_page[i].list, &cookie->msi_page_list);
++ msi_page = kmalloc(sizeof(*msi_page), GFP_KERNEL);
++ if (!msi_page)
++ return -ENOMEM;
++
++ msi_page->phys = start;
++ msi_page->iova = start;
++ INIT_LIST_HEAD(&msi_page->list);
++ list_add(&msi_page->list, &cookie->msi_page_list);
+ start += iovad->granule;
+ }
+
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 72994d67bc5b..d936ff765fe4 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -39,6 +39,7 @@
+ #include <linux/dmi.h>
+ #include <linux/slab.h>
+ #include <linux/iommu.h>
++#include <linux/limits.h>
+ #include <asm/irq_remapping.h>
+ #include <asm/iommu_table.h>
+
+@@ -139,6 +140,13 @@ dmar_alloc_pci_notify_info(struct pci_dev *dev, unsigned long event)
+
+ BUG_ON(dev->is_virtfn);
+
++ /*
++ * Ignore devices that have a domain number higher than what can
++ * be looked up in DMAR, e.g. VMD subdevices with domain 0x10000
++ */
++ if (pci_domain_nr(dev->bus) > U16_MAX)
++ return NULL;
++
+ /* Only generate path[] for device addition event */
+ if (event == BUS_NOTIFY_ADD_DEVICE)
+ for (tmp = dev; tmp; tmp = tmp->bus->self)
+@@ -451,12 +459,13 @@ static int __init dmar_parse_one_andd(struct acpi_dmar_header *header,
+
+ /* Check for NUL termination within the designated length */
+ if (strnlen(andd->device_name, header->length - 8) == header->length - 8) {
+- WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND,
++ pr_warn(FW_BUG
+ "Your BIOS is broken; ANDD object name is not NUL-terminated\n"
+ "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+ dmi_get_system_info(DMI_BIOS_VENDOR),
+ dmi_get_system_info(DMI_BIOS_VERSION),
+ dmi_get_system_info(DMI_PRODUCT_VERSION));
++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ return -EINVAL;
+ }
+ pr_info("ANDD device: %x name: %s\n", andd->device_number,
+@@ -482,14 +491,14 @@ static int dmar_parse_one_rhsa(struct acpi_dmar_header *header, void *arg)
+ return 0;
+ }
+ }
+- WARN_TAINT(
+- 1, TAINT_FIRMWARE_WORKAROUND,
++ pr_warn(FW_BUG
+ "Your BIOS is broken; RHSA refers to non-existent DMAR unit at %llx\n"
+ "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+- drhd->reg_base_addr,
++ rhsa->base_address,
+ dmi_get_system_info(DMI_BIOS_VENDOR),
+ dmi_get_system_info(DMI_BIOS_VERSION),
+ dmi_get_system_info(DMI_PRODUCT_VERSION));
++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+
+ return 0;
+ }
+@@ -838,14 +847,14 @@ int __init dmar_table_init(void)
+
+ static void warn_invalid_dmar(u64 addr, const char *message)
+ {
+- WARN_TAINT_ONCE(
+- 1, TAINT_FIRMWARE_WORKAROUND,
++ pr_warn_once(FW_BUG
+ "Your BIOS is broken; DMAR reported at address %llx%s!\n"
+ "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+ addr, message,
+ dmi_get_system_info(DMI_BIOS_VENDOR),
+ dmi_get_system_info(DMI_BIOS_VERSION),
+ dmi_get_system_info(DMI_PRODUCT_VERSION));
++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ }
+
+ static int __ref
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 9df3b8441227..2a83fc31dd47 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3998,10 +3998,11 @@ static void quirk_ioat_snb_local_iommu(struct pci_dev *pdev)
+
+ /* we know that the this iommu should be at offset 0xa000 from vtbar */
+ drhd = dmar_find_matched_drhd_unit(pdev);
+- if (WARN_TAINT_ONCE(!drhd || drhd->reg_base_addr - vtbar != 0xa000,
+- TAINT_FIRMWARE_WORKAROUND,
+- "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n"))
++ if (!drhd || drhd->reg_base_addr - vtbar != 0xa000) {
++ pr_warn_once(FW_BUG "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n");
++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ pdev->dev.archdata.iommu = DUMMY_DEVICE_DOMAIN_INFO;
++ }
+ }
+ DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT_SNB, quirk_ioat_snb_local_iommu);
+
+@@ -5143,8 +5144,10 @@ static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain,
+ u64 phys = 0;
+
+ pte = pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT, &level);
+- if (pte)
+- phys = dma_pte_addr(pte);
++ if (pte && dma_pte_present(pte))
++ phys = dma_pte_addr(pte) +
++ (iova & (BIT_MASK(level_to_offset_bits(level) +
++ VTD_PAGE_SHIFT) - 1));
+
+ return phys;
+ }
+diff --git a/drivers/macintosh/windfarm_ad7417_sensor.c b/drivers/macintosh/windfarm_ad7417_sensor.c
+index 7c28b71246c9..781238d203c8 100644
+--- a/drivers/macintosh/windfarm_ad7417_sensor.c
++++ b/drivers/macintosh/windfarm_ad7417_sensor.c
+@@ -313,9 +313,16 @@ static const struct i2c_device_id wf_ad7417_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_ad7417_id);
+
++static const struct of_device_id wf_ad7417_of_id[] = {
++ { .compatible = "ad7417", },
++ { }
++};
++MODULE_DEVICE_TABLE(of, wf_ad7417_of_id);
++
+ static struct i2c_driver wf_ad7417_driver = {
+ .driver = {
+ .name = "wf_ad7417",
++ .of_match_table = wf_ad7417_of_id,
+ },
+ .probe = wf_ad7417_probe,
+ .remove = wf_ad7417_remove,
+diff --git a/drivers/macintosh/windfarm_fcu_controls.c b/drivers/macintosh/windfarm_fcu_controls.c
+index fab7a21e9577..177791ff8344 100644
+--- a/drivers/macintosh/windfarm_fcu_controls.c
++++ b/drivers/macintosh/windfarm_fcu_controls.c
+@@ -583,9 +583,16 @@ static const struct i2c_device_id wf_fcu_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_fcu_id);
+
++static const struct of_device_id wf_fcu_of_id[] = {
++ { .compatible = "fcu", },
++ { }
++};
++MODULE_DEVICE_TABLE(of, wf_fcu_of_id);
++
+ static struct i2c_driver wf_fcu_driver = {
+ .driver = {
+ .name = "wf_fcu",
++ .of_match_table = wf_fcu_of_id,
+ },
+ .probe = wf_fcu_probe,
+ .remove = wf_fcu_remove,
+diff --git a/drivers/macintosh/windfarm_lm75_sensor.c b/drivers/macintosh/windfarm_lm75_sensor.c
+index 6cdfe714901d..f48ad2445ed6 100644
+--- a/drivers/macintosh/windfarm_lm75_sensor.c
++++ b/drivers/macintosh/windfarm_lm75_sensor.c
+@@ -15,6 +15,7 @@
+ #include <linux/init.h>
+ #include <linux/wait.h>
+ #include <linux/i2c.h>
++#include <linux/of_device.h>
+ #include <asm/prom.h>
+ #include <asm/machdep.h>
+ #include <asm/io.h>
+@@ -92,9 +93,14 @@ static int wf_lm75_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+ struct wf_lm75_sensor *lm;
+- int rc, ds1775 = id->driver_data;
++ int rc, ds1775;
+ const char *name, *loc;
+
++ if (id)
++ ds1775 = id->driver_data;
++ else
++ ds1775 = !!of_device_get_match_data(&client->dev);
++
+ DBG("wf_lm75: creating %s device at address 0x%02x\n",
+ ds1775 ? "ds1775" : "lm75", client->addr);
+
+@@ -165,9 +171,17 @@ static const struct i2c_device_id wf_lm75_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_lm75_id);
+
++static const struct of_device_id wf_lm75_of_id[] = {
++ { .compatible = "lm75", .data = (void *)0},
++ { .compatible = "ds1775", .data = (void *)1 },
++ { }
++};
++MODULE_DEVICE_TABLE(of, wf_lm75_of_id);
++
+ static struct i2c_driver wf_lm75_driver = {
+ .driver = {
+ .name = "wf_lm75",
++ .of_match_table = wf_lm75_of_id,
+ },
+ .probe = wf_lm75_probe,
+ .remove = wf_lm75_remove,
+diff --git a/drivers/macintosh/windfarm_lm87_sensor.c b/drivers/macintosh/windfarm_lm87_sensor.c
+index 35aa571d498a..8b57a1fa6ae3 100644
+--- a/drivers/macintosh/windfarm_lm87_sensor.c
++++ b/drivers/macintosh/windfarm_lm87_sensor.c
+@@ -168,9 +168,16 @@ static const struct i2c_device_id wf_lm87_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_lm87_id);
+
++static const struct of_device_id wf_lm87_of_id[] = {
++ { .compatible = "lm87cimt", },
++ { }
++};
++MODULE_DEVICE_TABLE(of, wf_lm87_of_id);
++
+ static struct i2c_driver wf_lm87_driver = {
+ .driver = {
+ .name = "wf_lm87",
++ .of_match_table = wf_lm87_of_id,
+ },
+ .probe = wf_lm87_probe,
+ .remove = wf_lm87_remove,
+diff --git a/drivers/macintosh/windfarm_max6690_sensor.c b/drivers/macintosh/windfarm_max6690_sensor.c
+index 6ad035e13c08..d34a25a5a6d9 100644
+--- a/drivers/macintosh/windfarm_max6690_sensor.c
++++ b/drivers/macintosh/windfarm_max6690_sensor.c
+@@ -121,9 +121,16 @@ static const struct i2c_device_id wf_max6690_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_max6690_id);
+
++static const struct of_device_id wf_max6690_of_id[] = {
++ { .compatible = "max6690", },
++ { }
++};
++MODULE_DEVICE_TABLE(of, wf_max6690_of_id);
++
+ static struct i2c_driver wf_max6690_driver = {
+ .driver = {
+ .name = "wf_max6690",
++ .of_match_table = wf_max6690_of_id,
+ },
+ .probe = wf_max6690_probe,
+ .remove = wf_max6690_remove,
+diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
+index a0f61eb853c5..51ef77de4174 100644
+--- a/drivers/macintosh/windfarm_smu_sat.c
++++ b/drivers/macintosh/windfarm_smu_sat.c
+@@ -343,9 +343,16 @@ static const struct i2c_device_id wf_sat_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_sat_id);
+
++static const struct of_device_id wf_sat_of_id[] = {
++ { .compatible = "smu-sat", },
++ { }
++};
++MODULE_DEVICE_TABLE(of, wf_sat_of_id);
++
+ static struct i2c_driver wf_sat_driver = {
+ .driver = {
+ .name = "wf_smu_sat",
++ .of_match_table = wf_sat_of_id,
+ },
+ .probe = wf_sat_probe,
+ .remove = wf_sat_remove,
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index 334e3f22d4f1..2ee046c81389 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -66,11 +66,6 @@ struct arp_pkt {
+ };
+ #pragma pack()
+
+-static inline struct arp_pkt *arp_pkt(const struct sk_buff *skb)
+-{
+- return (struct arp_pkt *)skb_network_header(skb);
+-}
+-
+ /* Forward declaration */
+ static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[],
+ bool strict_match);
+@@ -568,10 +563,11 @@ static void rlb_req_update_subnet_clients(struct bonding *bond, __be32 src_ip)
+ spin_unlock(&bond->mode_lock);
+ }
+
+-static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bond)
++static struct slave *rlb_choose_channel(struct sk_buff *skb,
++ struct bonding *bond,
++ const struct arp_pkt *arp)
+ {
+ struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond));
+- struct arp_pkt *arp = arp_pkt(skb);
+ struct slave *assigned_slave, *curr_active_slave;
+ struct rlb_client_info *client_info;
+ u32 hash_index = 0;
+@@ -668,8 +664,12 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon
+ */
+ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond)
+ {
+- struct arp_pkt *arp = arp_pkt(skb);
+ struct slave *tx_slave = NULL;
++ struct arp_pkt *arp;
++
++ if (!pskb_network_may_pull(skb, sizeof(*arp)))
++ return NULL;
++ arp = (struct arp_pkt *)skb_network_header(skb);
+
+ /* Don't modify or load balance ARPs that do not originate locally
+ * (e.g.,arrive via a bridge).
+@@ -679,7 +679,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond)
+
+ if (arp->op_code == htons(ARPOP_REPLY)) {
+ /* the arp must be sent on the selected rx channel */
+- tx_slave = rlb_choose_channel(skb, bond);
++ tx_slave = rlb_choose_channel(skb, bond, arp);
+ if (tx_slave)
+ bond_hw_addr_copy(arp->mac_src, tx_slave->dev->dev_addr,
+ tx_slave->dev->addr_len);
+@@ -690,7 +690,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond)
+ * When the arp reply is received the entry will be updated
+ * with the correct unicast address of the client.
+ */
+- rlb_choose_channel(skb, bond);
++ rlb_choose_channel(skb, bond, arp);
+
+ /* The ARP reply packets must be delayed so that
+ * they can cancel out the influence of the ARP request.
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 49b853f53f59..1545f2b299d0 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -892,6 +892,7 @@ static const struct nla_policy can_policy[IFLA_CAN_MAX + 1] = {
+ = { .len = sizeof(struct can_bittiming) },
+ [IFLA_CAN_DATA_BITTIMING_CONST]
+ = { .len = sizeof(struct can_bittiming_const) },
++ [IFLA_CAN_TERMINATION] = { .type = NLA_U16 },
+ };
+
+ static int can_validate(struct nlattr *tb[], struct nlattr *data[],
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 6f8649376ff0..3fdf135bad56 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2168,7 +2168,7 @@ static int bcm_sysport_rule_set(struct bcm_sysport_priv *priv,
+ return -ENOSPC;
+
+ index = find_first_zero_bit(priv->filters, RXCHK_BRCM_TAG_MAX);
+- if (index > RXCHK_BRCM_TAG_MAX)
++ if (index >= RXCHK_BRCM_TAG_MAX)
+ return -ENOSPC;
+
+ /* Location is the classification ID, and index is the position
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index c19d0eabeb52..911cea2e5aa5 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8097,13 +8097,13 @@ static int bnxt_change_mtu(struct net_device *dev, int new_mtu)
+ struct bnxt *bp = netdev_priv(dev);
+
+ if (netif_running(dev))
+- bnxt_close_nic(bp, false, false);
++ bnxt_close_nic(bp, true, false);
+
+ dev->mtu = new_mtu;
+ bnxt_set_ring_params(bp);
+
+ if (netif_running(dev))
+- return bnxt_open_nic(bp, false, false);
++ return bnxt_open_nic(bp, true, false);
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 296ae1e4c322..9142992ccd5a 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -2476,15 +2476,15 @@ fec_enet_set_coalesce(struct net_device *ndev, struct ethtool_coalesce *ec)
+ return -EINVAL;
+ }
+
+- cycle = fec_enet_us_to_itr_clock(ndev, fep->rx_time_itr);
++ cycle = fec_enet_us_to_itr_clock(ndev, ec->rx_coalesce_usecs);
+ if (cycle > 0xFFFF) {
+ pr_err("Rx coalesced usec exceed hardware limitation\n");
+ return -EINVAL;
+ }
+
+- cycle = fec_enet_us_to_itr_clock(ndev, fep->tx_time_itr);
++ cycle = fec_enet_us_to_itr_clock(ndev, ec->tx_coalesce_usecs);
+ if (cycle > 0xFFFF) {
+- pr_err("Rx coalesced usec exceed hardware limitation\n");
++ pr_err("Tx coalesced usec exceed hardware limitation\n");
+ return -EINVAL;
+ }
+
+diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
+index 3d0dd39c289e..f448e7d669cf 100644
+--- a/drivers/net/ethernet/sfc/efx.c
++++ b/drivers/net/ethernet/sfc/efx.c
+@@ -522,6 +522,7 @@ efx_copy_channel(const struct efx_channel *old_channel)
+ if (tx_queue->channel)
+ tx_queue->channel = channel;
+ tx_queue->buffer = NULL;
++ tx_queue->cb_page = NULL;
+ memset(&tx_queue->txd, 0, sizeof(tx_queue->txd));
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+index 21d131347e2e..7b2a84320aab 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+@@ -34,6 +34,7 @@
+ static void dwmac1000_core_init(struct mac_device_info *hw,
+ struct net_device *dev)
+ {
++ struct stmmac_priv *priv = netdev_priv(dev);
+ void __iomem *ioaddr = hw->pcsr;
+ u32 value = readl(ioaddr + GMAC_CONTROL);
+ int mtu = dev->mtu;
+@@ -45,7 +46,7 @@ static void dwmac1000_core_init(struct mac_device_info *hw,
+ * Broadcom tags can look like invalid LLC/SNAP packets and cause the
+ * hardware to truncate packets on reception.
+ */
+- if (netdev_uses_dsa(dev))
++ if (netdev_uses_dsa(dev) || !priv->plat->enh_desc)
+ value &= ~GMAC_CONTROL_ACS;
+
+ if (mtu > 1500)
+diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
+index 1a8132eb2a3e..40ac60904c8d 100644
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -298,6 +298,7 @@ void ipvlan_process_multicast(struct work_struct *work)
+ }
+ if (dev)
+ dev_put(dev);
++ cond_resched();
+ }
+ }
+
+@@ -504,19 +505,21 @@ static int ipvlan_process_outbound(struct sk_buff *skb)
+ struct ethhdr *ethh = eth_hdr(skb);
+ int ret = NET_XMIT_DROP;
+
+- /* In this mode we dont care about multicast and broadcast traffic */
+- if (is_multicast_ether_addr(ethh->h_dest)) {
+- pr_debug_ratelimited("Dropped {multi|broad}cast of type=[%x]\n",
+- ntohs(skb->protocol));
+- kfree_skb(skb);
+- goto out;
+- }
+-
+ /* The ipvlan is a pseudo-L2 device, so the packets that we receive
+ * will have L2; which need to discarded and processed further
+ * in the net-ns of the main-device.
+ */
+ if (skb_mac_header_was_set(skb)) {
++ /* In this mode we dont care about
++ * multicast and broadcast traffic */
++ if (is_multicast_ether_addr(ethh->h_dest)) {
++ pr_debug_ratelimited(
++ "Dropped {multi|broad}cast of type=[%x]\n",
++ ntohs(skb->protocol));
++ kfree_skb(skb);
++ goto out;
++ }
++
+ skb_pull(skb, sizeof(*ethh));
+ skb->mac_header = (typeof(skb->mac_header))~0U;
+ skb_reset_network_header(skb);
+diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
+index 0115a2868933..87f605a33c37 100644
+--- a/drivers/net/ipvlan/ipvlan_main.c
++++ b/drivers/net/ipvlan/ipvlan_main.c
+@@ -236,7 +236,6 @@ static void ipvlan_uninit(struct net_device *dev)
+ static int ipvlan_open(struct net_device *dev)
+ {
+ struct ipvl_dev *ipvlan = netdev_priv(dev);
+- struct net_device *phy_dev = ipvlan->phy_dev;
+ struct ipvl_addr *addr;
+
+ if (ipvlan->port->mode == IPVLAN_MODE_L3 ||
+@@ -250,7 +249,7 @@ static int ipvlan_open(struct net_device *dev)
+ ipvlan_ht_addr_add(ipvlan, addr);
+ rcu_read_unlock();
+
+- return dev_uc_add(phy_dev, phy_dev->dev_addr);
++ return 0;
+ }
+
+ static int ipvlan_stop(struct net_device *dev)
+@@ -262,8 +261,6 @@ static int ipvlan_stop(struct net_device *dev)
+ dev_uc_unsync(phy_dev, dev);
+ dev_mc_unsync(phy_dev, dev);
+
+- dev_uc_del(phy_dev, phy_dev->dev_addr);
+-
+ rcu_read_lock();
+ list_for_each_entry_rcu(addr, &ipvlan->addrs, anode)
+ ipvlan_ht_addr_del(addr);
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 10a8ef2d025a..9a8ec94e8a44 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -2886,6 +2886,11 @@ static void macsec_dev_set_rx_mode(struct net_device *dev)
+ dev_uc_sync(real_dev, dev);
+ }
+
++static sci_t dev_to_sci(struct net_device *dev, __be16 port)
++{
++ return make_sci(dev->dev_addr, port);
++}
++
+ static int macsec_set_mac_address(struct net_device *dev, void *p)
+ {
+ struct macsec_dev *macsec = macsec_priv(dev);
+@@ -2907,6 +2912,7 @@ static int macsec_set_mac_address(struct net_device *dev, void *p)
+
+ out:
+ ether_addr_copy(dev->dev_addr, addr->sa_data);
++ macsec->secy.sci = dev_to_sci(dev, MACSEC_PORT_ES);
+ return 0;
+ }
+
+@@ -2989,6 +2995,7 @@ static const struct device_type macsec_type = {
+
+ static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = {
+ [IFLA_MACSEC_SCI] = { .type = NLA_U64 },
++ [IFLA_MACSEC_PORT] = { .type = NLA_U16 },
+ [IFLA_MACSEC_ICV_LEN] = { .type = NLA_U8 },
+ [IFLA_MACSEC_CIPHER_SUITE] = { .type = NLA_U64 },
+ [IFLA_MACSEC_WINDOW] = { .type = NLA_U32 },
+@@ -3188,11 +3195,6 @@ static bool sci_exists(struct net_device *dev, sci_t sci)
+ return false;
+ }
+
+-static sci_t dev_to_sci(struct net_device *dev, __be16 port)
+-{
+- return make_sci(dev->dev_addr, port);
+-}
+-
+ static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len)
+ {
+ struct macsec_dev *macsec = macsec_priv(dev);
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 277bbff53cff..a8f338dc0dfa 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -338,6 +338,8 @@ static void macvlan_process_broadcast(struct work_struct *w)
+ if (src)
+ dev_put(src->dev);
+ kfree_skb(skb);
++
++ cond_resched();
+ }
+ }
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index ae40d8137fd2..302d183beb9e 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -76,7 +76,7 @@ static LIST_HEAD(phy_fixup_list);
+ static DEFINE_MUTEX(phy_fixup_lock);
+
+ #ifdef CONFIG_PM
+-static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend)
++static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
+ {
+ struct device_driver *drv = phydev->mdio.dev.driver;
+ struct phy_driver *phydrv = to_phy_driver(drv);
+@@ -88,11 +88,10 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend)
+ /* PHY not attached? May suspend if the PHY has not already been
+ * suspended as part of a prior call to phy_disconnect() ->
+ * phy_detach() -> phy_suspend() because the parent netdev might be the
+- * MDIO bus driver and clock gated at this point. Also may resume if
+- * PHY is not attached.
++ * MDIO bus driver and clock gated at this point.
+ */
+ if (!netdev)
+- return suspend ? !phydev->suspended : phydev->suspended;
++ goto out;
+
+ if (netdev->wol_enabled)
+ return false;
+@@ -112,7 +111,8 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend)
+ if (device_may_wakeup(&netdev->dev))
+ return false;
+
+- return true;
++out:
++ return !phydev->suspended;
+ }
+
+ static int mdio_bus_phy_suspend(struct device *dev)
+@@ -127,9 +127,11 @@ static int mdio_bus_phy_suspend(struct device *dev)
+ if (phydev->attached_dev && phydev->adjust_link)
+ phy_stop_machine(phydev);
+
+- if (!mdio_bus_phy_may_suspend(phydev, true))
++ if (!mdio_bus_phy_may_suspend(phydev))
+ return 0;
+
++ phydev->suspended_by_mdio_bus = 1;
++
+ return phy_suspend(phydev);
+ }
+
+@@ -138,9 +140,11 @@ static int mdio_bus_phy_resume(struct device *dev)
+ struct phy_device *phydev = to_phy_device(dev);
+ int ret;
+
+- if (!mdio_bus_phy_may_suspend(phydev, false))
++ if (!phydev->suspended_by_mdio_bus)
+ goto no_resume;
+
++ phydev->suspended_by_mdio_bus = 0;
++
+ ret = phy_resume(phydev);
+ if (ret < 0)
+ return ret;
+diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
+index ea90db3c7705..01334aeac577 100644
+--- a/drivers/net/slip/slhc.c
++++ b/drivers/net/slip/slhc.c
+@@ -232,7 +232,7 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize,
+ register struct cstate *cs = lcs->next;
+ register unsigned long deltaS, deltaA;
+ register short changes = 0;
+- int hlen;
++ int nlen, hlen;
+ unsigned char new_seq[16];
+ register unsigned char *cp = new_seq;
+ struct iphdr *ip;
+@@ -248,6 +248,8 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize,
+ return isize;
+
+ ip = (struct iphdr *) icp;
++ if (ip->version != 4 || ip->ihl < 5)
++ return isize;
+
+ /* Bail if this packet isn't TCP, or is an IP fragment */
+ if (ip->protocol != IPPROTO_TCP || (ntohs(ip->frag_off) & 0x3fff)) {
+@@ -258,10 +260,14 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize,
+ comp->sls_o_tcp++;
+ return isize;
+ }
+- /* Extract TCP header */
++ nlen = ip->ihl * 4;
++ if (isize < nlen + sizeof(*th))
++ return isize;
+
+- th = (struct tcphdr *)(((unsigned char *)ip) + ip->ihl*4);
+- hlen = ip->ihl*4 + th->doff*4;
++ th = (struct tcphdr *)(icp + nlen);
++ if (th->doff < sizeof(struct tcphdr) / 4)
++ return isize;
++ hlen = nlen + th->doff * 4;
+
+ /* Bail if the TCP packet isn't `compressible' (i.e., ACK isn't set or
+ * some other control bit is set). Also uncompressible if
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 3feb49badda9..95524c06e64c 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -2215,6 +2215,8 @@ team_nl_option_policy[TEAM_ATTR_OPTION_MAX + 1] = {
+ [TEAM_ATTR_OPTION_CHANGED] = { .type = NLA_FLAG },
+ [TEAM_ATTR_OPTION_TYPE] = { .type = NLA_U8 },
+ [TEAM_ATTR_OPTION_DATA] = { .type = NLA_BINARY },
++ [TEAM_ATTR_OPTION_PORT_IFINDEX] = { .type = NLA_U32 },
++ [TEAM_ATTR_OPTION_ARRAY_INDEX] = { .type = NLA_U32 },
+ };
+
+ static int team_nl_cmd_noop(struct sk_buff *skb, struct genl_info *info)
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index c5c188dc6626..0639178cb009 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -2701,6 +2701,8 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired)
+ }
+
+ msleep(20);
++ if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ break;
+ }
+
+ return data;
+@@ -4062,7 +4064,10 @@ static void r8153_init(struct r8152 *tp)
+ if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ AUTOLOAD_DONE)
+ break;
++
+ msleep(20);
++ if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ break;
+ }
+
+ data = r8153_phy_status(tp, 0);
+@@ -4180,7 +4185,10 @@ static void r8153b_init(struct r8152 *tp)
+ if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ AUTOLOAD_DONE)
+ break;
++
+ msleep(20);
++ if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ break;
+ }
+
+ data = r8153_phy_status(tp, 0);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+index 3270faafe0bc..875557ce0d66 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+@@ -314,7 +314,8 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
+ }
+
+ /* PHY_SKU section is mandatory in B0 */
+- if (!mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) {
++ if (mvm->trans->cfg->nvm_type == IWL_NVM_EXT &&
++ !mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) {
+ IWL_ERR(mvm,
+ "Can't parse phy_sku in B0, empty sections\n");
+ return NULL;
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index c51da2205b93..cc6840377bc2 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -396,10 +396,13 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+ struct page *page = virt_to_head_page(data);
+ int offset = data - page_address(page);
+ struct sk_buff *skb = q->rx_head;
++ struct skb_shared_info *shinfo = skb_shinfo(skb);
+
+- offset += q->buf_offset;
+- skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, offset, len,
+- q->buf_size);
++ if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) {
++ offset += q->buf_offset;
++ skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len,
++ q->buf_size);
++ }
+
+ if (more)
+ return;
+diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
+index c6ff4d5fa482..76638dee65d9 100644
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -2008,7 +2008,6 @@ static int pinctrl_claim_hogs(struct pinctrl_dev *pctldev)
+ return PTR_ERR(pctldev->p);
+ }
+
+- kref_get(&pctldev->p->users);
+ pctldev->hog_default =
+ pinctrl_lookup_state(pctldev->p, PINCTRL_STATE_DEFAULT);
+ if (IS_ERR(pctldev->hog_default)) {
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 0c0a5018102b..22ddb238e17c 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -153,8 +153,8 @@ static const unsigned int sdio_d0_pins[] = { GPIOX_0 };
+ static const unsigned int sdio_d1_pins[] = { GPIOX_1 };
+ static const unsigned int sdio_d2_pins[] = { GPIOX_2 };
+ static const unsigned int sdio_d3_pins[] = { GPIOX_3 };
+-static const unsigned int sdio_cmd_pins[] = { GPIOX_4 };
+-static const unsigned int sdio_clk_pins[] = { GPIOX_5 };
++static const unsigned int sdio_clk_pins[] = { GPIOX_4 };
++static const unsigned int sdio_cmd_pins[] = { GPIOX_5 };
+ static const unsigned int sdio_irq_pins[] = { GPIOX_7 };
+
+ static const unsigned int nand_ce0_pins[] = { BOOT_8 };
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index 2fb6fa51fd3c..f6e3c0089825 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -561,7 +561,6 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
+ if (server->ops->close)
+ server->ops->close(xid, tcon, &fid);
+ cifs_del_pending_open(&open);
+- fput(file);
+ rc = -ENOMEM;
+ }
+
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index 998051c4aea7..d968b5c5df21 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -1251,7 +1251,7 @@ static int gfs2_atomic_open(struct inode *dir, struct dentry *dentry,
+ if (!(file->f_mode & FMODE_OPENED))
+ return finish_no_open(file, d);
+ dput(d);
+- return 0;
++ return excl && (flags & O_CREAT) ? -EEXIST : 0;
+ }
+
+ BUG_ON(d != NULL);
+diff --git a/fs/open.c b/fs/open.c
+index 878478745924..76996f920ebf 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -851,9 +851,6 @@ cleanup_file:
+ * the return value of d_splice_alias(), then the caller needs to perform dput()
+ * on it after finish_open().
+ *
+- * On successful return @file is a fully instantiated open file. After this, if
+- * an error occurs in ->atomic_open(), it needs to clean up with fput().
+- *
+ * Returns zero on success or -errno if the open failed.
+ */
+ int finish_open(struct file *file, struct dentry *dentry,
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index b4854b48a4f3..5ed1a2b285cd 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -62,6 +62,7 @@ struct css_task_iter {
+ struct list_head *mg_tasks_head;
+ struct list_head *dying_tasks_head;
+
++ struct list_head *cur_tasks_head;
+ struct css_set *cur_cset;
+ struct css_set *cur_dcset;
+ struct task_struct *cur_task;
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index cc3391796c0b..6797811bf1e6 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -1664,6 +1664,42 @@ struct linux_efi_tpm_eventlog {
+
+ extern int efi_tpm_eventlog_init(void);
+
++/* efi_runtime_service() function identifiers */
++enum efi_rts_ids {
++ GET_TIME,
++ SET_TIME,
++ GET_WAKEUP_TIME,
++ SET_WAKEUP_TIME,
++ GET_VARIABLE,
++ GET_NEXT_VARIABLE,
++ SET_VARIABLE,
++ QUERY_VARIABLE_INFO,
++ GET_NEXT_HIGH_MONO_COUNT,
++ UPDATE_CAPSULE,
++ QUERY_CAPSULE_CAPS,
++};
++
++/*
++ * efi_runtime_work: Details of EFI Runtime Service work
++ * @arg<1-5>: EFI Runtime Service function arguments
++ * @status: Status of executing EFI Runtime Service
++ * @efi_rts_id: EFI Runtime Service function identifier
++ * @efi_rts_comp: Struct used for handling completions
++ */
++struct efi_runtime_work {
++ void *arg1;
++ void *arg2;
++ void *arg3;
++ void *arg4;
++ void *arg5;
++ efi_status_t status;
++ struct work_struct work;
++ enum efi_rts_ids efi_rts_id;
++ struct completion efi_rts_comp;
++};
++
++extern struct efi_runtime_work efi_rts_work;
++
+ /* Workqueue to queue EFI Runtime Services */
+ extern struct workqueue_struct *efi_rts_wq;
+
+diff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h
+index 39faaaf843e1..c91cf2dee12a 100644
+--- a/include/linux/inet_diag.h
++++ b/include/linux/inet_diag.h
+@@ -2,15 +2,10 @@
+ #ifndef _INET_DIAG_H_
+ #define _INET_DIAG_H_ 1
+
++#include <net/netlink.h>
+ #include <uapi/linux/inet_diag.h>
+
+-struct net;
+-struct sock;
+ struct inet_hashinfo;
+-struct nlattr;
+-struct nlmsghdr;
+-struct sk_buff;
+-struct netlink_callback;
+
+ struct inet_diag_handler {
+ void (*dump)(struct sk_buff *skb,
+@@ -62,6 +57,17 @@ int inet_diag_bc_sk(const struct nlattr *_bc, struct sock *sk);
+
+ void inet_diag_msg_common_fill(struct inet_diag_msg *r, struct sock *sk);
+
++static inline size_t inet_diag_msg_attrs_size(void)
++{
++ return nla_total_size(1) /* INET_DIAG_SHUTDOWN */
++ + nla_total_size(1) /* INET_DIAG_TOS */
++#if IS_ENABLED(CONFIG_IPV6)
++ + nla_total_size(1) /* INET_DIAG_TCLASS */
++ + nla_total_size(1) /* INET_DIAG_SKV6ONLY */
++#endif
++ + nla_total_size(4) /* INET_DIAG_MARK */
++ + nla_total_size(4); /* INET_DIAG_CLASS_ID */
++}
+ int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
+ struct inet_diag_msg *r, int ext,
+ struct user_namespace *user_ns, bool net_admin);
+diff --git a/include/linux/phy.h b/include/linux/phy.h
+index cd6f637cbbfb..42766e7179d3 100644
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -373,6 +373,7 @@ struct phy_c45_device_ids {
+ * is_pseudo_fixed_link: Set to true if this phy is an Ethernet switch, etc.
+ * has_fixups: Set to true if this phy has fixups/quirks.
+ * suspended: Set to true if this phy has been suspended successfully.
++ * suspended_by_mdio_bus: Set to true if this phy was suspended by MDIO bus.
+ * sysfs_links: Internal boolean tracking sysfs symbolic links setup/removal.
+ * loopback_enabled: Set true if this phy has been loopbacked successfully.
+ * state: state of the PHY for management purposes
+@@ -411,6 +412,7 @@ struct phy_device {
+ unsigned is_pseudo_fixed_link:1;
+ unsigned has_fixups:1;
+ unsigned suspended:1;
++ unsigned suspended_by_mdio_bus:1;
+ unsigned sysfs_links:1;
+ unsigned loopback_enabled:1;
+
+diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
+index b473df5b9512..10886c19cfc5 100644
+--- a/include/net/fib_rules.h
++++ b/include/net/fib_rules.h
+@@ -107,6 +107,7 @@ struct fib_rule_notifier_info {
+ [FRA_OIFNAME] = { .type = NLA_STRING, .len = IFNAMSIZ - 1 }, \
+ [FRA_PRIORITY] = { .type = NLA_U32 }, \
+ [FRA_FWMARK] = { .type = NLA_U32 }, \
++ [FRA_TUN_ID] = { .type = NLA_U64 }, \
+ [FRA_FWMASK] = { .type = NLA_U32 }, \
+ [FRA_TABLE] = { .type = NLA_U32 }, \
+ [FRA_SUPPRESS_PREFIXLEN] = { .type = NLA_U32 }, \
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 08bd40d90066..877ba6dacca8 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -4157,12 +4157,16 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it)
+ }
+ } while (!css_set_populated(cset) && list_empty(&cset->dying_tasks));
+
+- if (!list_empty(&cset->tasks))
++ if (!list_empty(&cset->tasks)) {
+ it->task_pos = cset->tasks.next;
+- else if (!list_empty(&cset->mg_tasks))
++ it->cur_tasks_head = &cset->tasks;
++ } else if (!list_empty(&cset->mg_tasks)) {
+ it->task_pos = cset->mg_tasks.next;
+- else
++ it->cur_tasks_head = &cset->mg_tasks;
++ } else {
+ it->task_pos = cset->dying_tasks.next;
++ it->cur_tasks_head = &cset->dying_tasks;
++ }
+
+ it->tasks_head = &cset->tasks;
+ it->mg_tasks_head = &cset->mg_tasks;
+@@ -4220,10 +4224,14 @@ repeat:
+ else
+ it->task_pos = it->task_pos->next;
+
+- if (it->task_pos == it->tasks_head)
++ if (it->task_pos == it->tasks_head) {
+ it->task_pos = it->mg_tasks_head->next;
+- if (it->task_pos == it->mg_tasks_head)
++ it->cur_tasks_head = it->mg_tasks_head;
++ }
++ if (it->task_pos == it->mg_tasks_head) {
+ it->task_pos = it->dying_tasks_head->next;
++ it->cur_tasks_head = it->dying_tasks_head;
++ }
+ if (it->task_pos == it->dying_tasks_head)
+ css_task_iter_advance_css_set(it);
+ } else {
+@@ -4242,11 +4250,12 @@ repeat:
+ goto repeat;
+
+ /* and dying leaders w/o live member threads */
+- if (!atomic_read(&task->signal->live))
++ if (it->cur_tasks_head == it->dying_tasks_head &&
++ !atomic_read(&task->signal->live))
+ goto repeat;
+ } else {
+ /* skip all dying ones */
+- if (task->flags & PF_EXITING)
++ if (it->cur_tasks_head == it->dying_tasks_head)
+ goto repeat;
+ }
+ }
+@@ -4355,6 +4364,9 @@ static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos)
+ struct kernfs_open_file *of = s->private;
+ struct css_task_iter *it = of->priv;
+
++ if (pos)
++ (*pos)++;
++
+ return css_task_iter_next(it);
+ }
+
+@@ -4370,7 +4382,7 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos,
+ * from position 0, so we can simply keep iterating on !0 *pos.
+ */
+ if (!it) {
+- if (WARN_ON_ONCE((*pos)++))
++ if (WARN_ON_ONCE((*pos)))
+ return ERR_PTR(-EINVAL);
+
+ it = kzalloc(sizeof(*it), GFP_KERNEL);
+@@ -4378,10 +4390,11 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos,
+ return ERR_PTR(-ENOMEM);
+ of->priv = it;
+ css_task_iter_start(&cgrp->self, iter_flags, it);
+- } else if (!(*pos)++) {
++ } else if (!(*pos)) {
+ css_task_iter_end(it);
+ css_task_iter_start(&cgrp->self, iter_flags, it);
+- }
++ } else
++ return it->cur_task;
+
+ return cgroup_procs_next(s, NULL, NULL);
+ }
+@@ -5929,6 +5942,10 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
+ return;
+ }
+
++ /* Don't associate the sock with unrelated interrupted task's cgroup. */
++ if (in_interrupt())
++ return;
++
+ rcu_read_lock();
+
+ while (true) {
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 493908464b9e..eef77c82d2e1 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1384,14 +1384,16 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
+ WARN_ON_ONCE(!is_chained_work(wq)))
+ return;
+ retry:
+- if (req_cpu == WORK_CPU_UNBOUND)
+- cpu = wq_select_unbound_cpu(raw_smp_processor_id());
+-
+ /* pwq which will be used unless @work is executing elsewhere */
+- if (!(wq->flags & WQ_UNBOUND))
+- pwq = per_cpu_ptr(wq->cpu_pwqs, cpu);
+- else
++ if (wq->flags & WQ_UNBOUND) {
++ if (req_cpu == WORK_CPU_UNBOUND)
++ cpu = wq_select_unbound_cpu(raw_smp_processor_id());
+ pwq = unbound_pwq_by_node(wq, cpu_to_node(cpu));
++ } else {
++ if (req_cpu == WORK_CPU_UNBOUND)
++ cpu = raw_smp_processor_id();
++ pwq = per_cpu_ptr(wq->cpu_pwqs, cpu);
++ }
+
+ /*
+ * If @work was previously on a different pool, it might still be
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 0f7ff204083e..6ecb47c08665 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -6307,19 +6307,9 @@ void mem_cgroup_sk_alloc(struct sock *sk)
+ if (!mem_cgroup_sockets_enabled)
+ return;
+
+- /*
+- * Socket cloning can throw us here with sk_memcg already
+- * filled. It won't however, necessarily happen from
+- * process context. So the test for root memcg given
+- * the current task's memcg won't help us in this case.
+- *
+- * Respecting the original socket's memcg is a better
+- * decision in this case.
+- */
+- if (sk->sk_memcg) {
+- css_get(&sk->sk_memcg->css);
++ /* Do not associate the sock with unrelated interrupted task's memcg. */
++ if (in_interrupt())
+ return;
+- }
+
+ rcu_read_lock();
+ memcg = mem_cgroup_from_task(current);
+diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
+index f5941837c3ad..0b052ff51bde 100644
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -970,6 +970,10 @@ static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface)
+
+ lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex);
+
++ /* interface already disabled by batadv_iv_ogm_iface_disable */
++ if (!*ogm_buff)
++ return;
++
+ /* the interface gets activated here to avoid race conditions between
+ * the moment of activating the interface in
+ * hardif_activate_interface() where the originator mac is set and
+diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
+index d241ccc0ca02..bf9ea404abe7 100644
+--- a/net/batman-adv/bat_v_ogm.c
++++ b/net/batman-adv/bat_v_ogm.c
+@@ -29,6 +29,8 @@
+ #include <linux/kernel.h>
+ #include <linux/kref.h>
+ #include <linux/list.h>
++#include <linux/lockdep.h>
++#include <linux/mutex.h>
+ #include <linux/netdevice.h>
+ #include <linux/random.h>
+ #include <linux/rculist.h>
+@@ -128,14 +130,12 @@ static void batadv_v_ogm_send_to_if(struct sk_buff *skb,
+ }
+
+ /**
+- * batadv_v_ogm_send() - periodic worker broadcasting the own OGM
+- * @work: work queue item
++ * batadv_v_ogm_send_softif() - periodic worker broadcasting the own OGM
++ * @bat_priv: the bat priv with all the soft interface information
+ */
+-static void batadv_v_ogm_send(struct work_struct *work)
++static void batadv_v_ogm_send_softif(struct batadv_priv *bat_priv)
+ {
+ struct batadv_hard_iface *hard_iface;
+- struct batadv_priv_bat_v *bat_v;
+- struct batadv_priv *bat_priv;
+ struct batadv_ogm2_packet *ogm_packet;
+ struct sk_buff *skb, *skb_tmp;
+ unsigned char *ogm_buff;
+@@ -143,8 +143,7 @@ static void batadv_v_ogm_send(struct work_struct *work)
+ u16 tvlv_len = 0;
+ int ret;
+
+- bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work);
+- bat_priv = container_of(bat_v, struct batadv_priv, bat_v);
++ lockdep_assert_held(&bat_priv->bat_v.ogm_buff_mutex);
+
+ if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING)
+ goto out;
+@@ -235,6 +234,23 @@ out:
+ return;
+ }
+
++/**
++ * batadv_v_ogm_send() - periodic worker broadcasting the own OGM
++ * @work: work queue item
++ */
++static void batadv_v_ogm_send(struct work_struct *work)
++{
++ struct batadv_priv_bat_v *bat_v;
++ struct batadv_priv *bat_priv;
++
++ bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work);
++ bat_priv = container_of(bat_v, struct batadv_priv, bat_v);
++
++ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
++ batadv_v_ogm_send_softif(bat_priv);
++ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
++}
++
+ /**
+ * batadv_v_ogm_iface_enable() - prepare an interface for B.A.T.M.A.N. V
+ * @hard_iface: the interface to prepare
+@@ -261,11 +277,15 @@ void batadv_v_ogm_primary_iface_set(struct batadv_hard_iface *primary_iface)
+ struct batadv_priv *bat_priv = netdev_priv(primary_iface->soft_iface);
+ struct batadv_ogm2_packet *ogm_packet;
+
++ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
+ if (!bat_priv->bat_v.ogm_buff)
+- return;
++ goto unlock;
+
+ ogm_packet = (struct batadv_ogm2_packet *)bat_priv->bat_v.ogm_buff;
+ ether_addr_copy(ogm_packet->orig, primary_iface->net_dev->dev_addr);
++
++unlock:
++ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
+ }
+
+ /**
+@@ -887,6 +907,8 @@ int batadv_v_ogm_init(struct batadv_priv *bat_priv)
+ atomic_set(&bat_priv->bat_v.ogm_seqno, random_seqno);
+ INIT_DELAYED_WORK(&bat_priv->bat_v.ogm_wq, batadv_v_ogm_send);
+
++ mutex_init(&bat_priv->bat_v.ogm_buff_mutex);
++
+ return 0;
+ }
+
+@@ -898,7 +920,11 @@ void batadv_v_ogm_free(struct batadv_priv *bat_priv)
+ {
+ cancel_delayed_work_sync(&bat_priv->bat_v.ogm_wq);
+
++ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
++
+ kfree(bat_priv->bat_v.ogm_buff);
+ bat_priv->bat_v.ogm_buff = NULL;
+ bat_priv->bat_v.ogm_buff_len = 0;
++
++ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
+ }
+diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
+index 87e54f8a3f83..37598ae1d3f7 100644
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -28,6 +28,7 @@
+ #include <linux/compiler.h>
+ #include <linux/if_ether.h>
+ #include <linux/kref.h>
++#include <linux/mutex.h>
+ #include <linux/netdevice.h>
+ #include <linux/netlink.h>
+ #include <linux/sched.h> /* for linux/wait.h */
+@@ -1493,6 +1494,9 @@ struct batadv_priv_bat_v {
+ /** @ogm_seqno: OGM sequence number - used to identify each OGM */
+ atomic_t ogm_seqno;
+
++ /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */
++ struct mutex ogm_buff_mutex;
++
+ /** @ogm_wq: workqueue used to schedule OGM transmissions */
+ struct delayed_work ogm_wq;
+ };
+diff --git a/net/core/devlink.c b/net/core/devlink.c
+index 6bc42933be4a..a77e3777c8dd 100644
+--- a/net/core/devlink.c
++++ b/net/core/devlink.c
+@@ -2995,34 +2995,41 @@ devlink_param_value_get_from_info(const struct devlink_param *param,
+ struct genl_info *info,
+ union devlink_param_value *value)
+ {
++ struct nlattr *param_data;
+ int len;
+
+- if (param->type != DEVLINK_PARAM_TYPE_BOOL &&
+- !info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA])
++ param_data = info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA];
++
++ if (param->type != DEVLINK_PARAM_TYPE_BOOL && !param_data)
+ return -EINVAL;
+
+ switch (param->type) {
+ case DEVLINK_PARAM_TYPE_U8:
+- value->vu8 = nla_get_u8(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]);
++ if (nla_len(param_data) != sizeof(u8))
++ return -EINVAL;
++ value->vu8 = nla_get_u8(param_data);
+ break;
+ case DEVLINK_PARAM_TYPE_U16:
+- value->vu16 = nla_get_u16(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]);
++ if (nla_len(param_data) != sizeof(u16))
++ return -EINVAL;
++ value->vu16 = nla_get_u16(param_data);
+ break;
+ case DEVLINK_PARAM_TYPE_U32:
+- value->vu32 = nla_get_u32(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]);
++ if (nla_len(param_data) != sizeof(u32))
++ return -EINVAL;
++ value->vu32 = nla_get_u32(param_data);
+ break;
+ case DEVLINK_PARAM_TYPE_STRING:
+- len = strnlen(nla_data(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]),
+- nla_len(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]));
+- if (len == nla_len(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]) ||
++ len = strnlen(nla_data(param_data), nla_len(param_data));
++ if (len == nla_len(param_data) ||
+ len >= __DEVLINK_PARAM_MAX_STRING_VALUE)
+ return -EINVAL;
+- strcpy(value->vstr,
+- nla_data(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]));
++ strcpy(value->vstr, nla_data(param_data));
+ break;
+ case DEVLINK_PARAM_TYPE_BOOL:
+- value->vbool = info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA] ?
+- true : false;
++ if (param_data && nla_len(param_data))
++ return -EINVAL;
++ value->vbool = nla_get_flag(param_data);
+ break;
+ }
+ return 0;
+@@ -3600,6 +3607,8 @@ static const struct nla_policy devlink_nl_policy[DEVLINK_ATTR_MAX + 1] = {
+ [DEVLINK_ATTR_PARAM_VALUE_CMODE] = { .type = NLA_U8 },
+ [DEVLINK_ATTR_REGION_NAME] = { .type = NLA_NUL_STRING },
+ [DEVLINK_ATTR_REGION_SNAPSHOT_ID] = { .type = NLA_U32 },
++ [DEVLINK_ATTR_REGION_CHUNK_ADDR] = { .type = NLA_U64 },
++ [DEVLINK_ATTR_REGION_CHUNK_LEN] = { .type = NLA_U64 },
+ };
+
+ static const struct genl_ops devlink_nl_ops[] = {
+diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
+index 7bf833598615..67feeb207dad 100644
+--- a/net/core/netclassid_cgroup.c
++++ b/net/core/netclassid_cgroup.c
+@@ -57,30 +57,60 @@ static void cgrp_css_free(struct cgroup_subsys_state *css)
+ kfree(css_cls_state(css));
+ }
+
++/*
++ * To avoid freezing of sockets creation for tasks with big number of threads
++ * and opened sockets lets release file_lock every 1000 iterated descriptors.
++ * New sockets will already have been created with new classid.
++ */
++
++struct update_classid_context {
++ u32 classid;
++ unsigned int batch;
++};
++
++#define UPDATE_CLASSID_BATCH 1000
++
+ static int update_classid_sock(const void *v, struct file *file, unsigned n)
+ {
+ int err;
++ struct update_classid_context *ctx = (void *)v;
+ struct socket *sock = sock_from_file(file, &err);
+
+ if (sock) {
+ spin_lock(&cgroup_sk_update_lock);
+- sock_cgroup_set_classid(&sock->sk->sk_cgrp_data,
+- (unsigned long)v);
++ sock_cgroup_set_classid(&sock->sk->sk_cgrp_data, ctx->classid);
+ spin_unlock(&cgroup_sk_update_lock);
+ }
++ if (--ctx->batch == 0) {
++ ctx->batch = UPDATE_CLASSID_BATCH;
++ return n + 1;
++ }
+ return 0;
+ }
+
++static void update_classid_task(struct task_struct *p, u32 classid)
++{
++ struct update_classid_context ctx = {
++ .classid = classid,
++ .batch = UPDATE_CLASSID_BATCH
++ };
++ unsigned int fd = 0;
++
++ do {
++ task_lock(p);
++ fd = iterate_fd(p->files, fd, update_classid_sock, &ctx);
++ task_unlock(p);
++ cond_resched();
++ } while (fd);
++}
++
+ static void cgrp_attach(struct cgroup_taskset *tset)
+ {
+ struct cgroup_subsys_state *css;
+ struct task_struct *p;
+
+ cgroup_taskset_for_each(p, css, tset) {
+- task_lock(p);
+- iterate_fd(p->files, 0, update_classid_sock,
+- (void *)(unsigned long)css_cls_state(css)->classid);
+- task_unlock(p);
++ update_classid_task(p, css_cls_state(css)->classid);
+ }
+ }
+
+@@ -102,10 +132,7 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft,
+
+ css_task_iter_start(css, 0, &it);
+ while ((p = css_task_iter_next(&it))) {
+- task_lock(p);
+- iterate_fd(p->files, 0, update_classid_sock,
+- (void *)(unsigned long)cs->classid);
+- task_unlock(p);
++ update_classid_task(p, cs->classid);
+ cond_resched();
+ }
+ css_task_iter_end(&it);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index b9ec14f2c729..8abfde0d28ee 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1689,7 +1689,10 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
+ atomic_set(&newsk->sk_zckey, 0);
+
+ sock_reset_flag(newsk, SOCK_DONE);
+- mem_cgroup_sk_alloc(newsk);
++
++ /* sk->sk_memcg will be populated at accept() time */
++ newsk->sk_memcg = NULL;
++
+ cgroup_sk_alloc(&newsk->sk_cgrp_data);
+
+ rcu_read_lock();
+diff --git a/net/ieee802154/nl_policy.c b/net/ieee802154/nl_policy.c
+index 78f6f1233194..0f8597ec07fc 100644
+--- a/net/ieee802154/nl_policy.c
++++ b/net/ieee802154/nl_policy.c
+@@ -30,7 +30,13 @@ const struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
+ [IEEE802154_ATTR_HW_ADDR] = { .type = NLA_HW_ADDR, },
+ [IEEE802154_ATTR_PAN_ID] = { .type = NLA_U16, },
+ [IEEE802154_ATTR_CHANNEL] = { .type = NLA_U8, },
++ [IEEE802154_ATTR_BCN_ORD] = { .type = NLA_U8, },
++ [IEEE802154_ATTR_SF_ORD] = { .type = NLA_U8, },
++ [IEEE802154_ATTR_PAN_COORD] = { .type = NLA_U8, },
++ [IEEE802154_ATTR_BAT_EXT] = { .type = NLA_U8, },
++ [IEEE802154_ATTR_COORD_REALIGN] = { .type = NLA_U8, },
+ [IEEE802154_ATTR_PAGE] = { .type = NLA_U8, },
++ [IEEE802154_ATTR_DEV_TYPE] = { .type = NLA_U8, },
+ [IEEE802154_ATTR_COORD_SHORT_ADDR] = { .type = NLA_U16, },
+ [IEEE802154_ATTR_COORD_HW_ADDR] = { .type = NLA_HW_ADDR, },
+ [IEEE802154_ATTR_COORD_PAN_ID] = { .type = NLA_U16, },
+diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
+index 0eb4bfa2332c..ad9ea82daeb3 100644
+--- a/net/ipv4/gre_demux.c
++++ b/net/ipv4/gre_demux.c
+@@ -61,7 +61,9 @@ int gre_del_protocol(const struct gre_protocol *proto, u8 version)
+ }
+ EXPORT_SYMBOL_GPL(gre_del_protocol);
+
+-/* Fills in tpi and returns header length to be pulled. */
++/* Fills in tpi and returns header length to be pulled.
++ * Note that caller must use pskb_may_pull() before pulling GRE header.
++ */
+ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ bool *csum_err, __be16 proto, int nhs)
+ {
+@@ -115,8 +117,14 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
+ */
+ if (greh->flags == 0 && tpi->proto == htons(ETH_P_WCCP)) {
++ u8 _val, *val;
++
++ val = skb_header_pointer(skb, nhs + hdr_len,
++ sizeof(_val), &_val);
++ if (!val)
++ return -EINVAL;
+ tpi->proto = proto;
+- if ((*(u8 *)options & 0xF0) != 0x40)
++ if ((*val & 0xF0) != 0x40)
+ hdr_len += 4;
+ }
+ tpi->hdr_len = hdr_len;
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 79320858e719..34bd6230e9f4 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -479,8 +479,28 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern)
+ }
+ spin_unlock_bh(&queue->fastopenq.lock);
+ }
++
+ out:
+ release_sock(sk);
++ if (newsk && mem_cgroup_sockets_enabled) {
++ int amt;
++
++ /* atomically get the memory usage, set and charge the
++ * newsk->sk_memcg.
++ */
++ lock_sock(newsk);
++
++ /* The socket has not been accepted yet, no need to look at
++ * newsk->sk_wmem_queued.
++ */
++ amt = sk_mem_pages(newsk->sk_forward_alloc +
++ atomic_read(&newsk->sk_rmem_alloc));
++ mem_cgroup_sk_alloc(newsk);
++ if (newsk->sk_memcg && amt)
++ mem_cgroup_charge_skmem(newsk->sk_memcg, amt);
++
++ release_sock(newsk);
++ }
+ if (req)
+ reqsk_put(req);
+ return newsk;
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 9742b37afe1d..f0957ebf82cf 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -104,13 +104,9 @@ static size_t inet_sk_attr_size(struct sock *sk,
+ aux = handler->idiag_get_aux_size(sk, net_admin);
+
+ return nla_total_size(sizeof(struct tcp_info))
+- + nla_total_size(1) /* INET_DIAG_SHUTDOWN */
+- + nla_total_size(1) /* INET_DIAG_TOS */
+- + nla_total_size(1) /* INET_DIAG_TCLASS */
+- + nla_total_size(4) /* INET_DIAG_MARK */
+- + nla_total_size(4) /* INET_DIAG_CLASS_ID */
+- + nla_total_size(sizeof(struct inet_diag_meminfo))
+ + nla_total_size(sizeof(struct inet_diag_msg))
++ + inet_diag_msg_attrs_size()
++ + nla_total_size(sizeof(struct inet_diag_meminfo))
+ + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
+ + nla_total_size(TCP_CA_NAME_MAX)
+ + nla_total_size(sizeof(struct tcpvegas_info))
+@@ -151,6 +147,24 @@ int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
+ if (net_admin && nla_put_u32(skb, INET_DIAG_MARK, sk->sk_mark))
+ goto errout;
+
++ if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) ||
++ ext & (1 << (INET_DIAG_TCLASS - 1))) {
++ u32 classid = 0;
++
++#ifdef CONFIG_SOCK_CGROUP_DATA
++ classid = sock_cgroup_classid(&sk->sk_cgrp_data);
++#endif
++ /* Fallback to socket priority if class id isn't set.
++ * Classful qdiscs use it as direct reference to class.
++ * For cgroup2 classid is always zero.
++ */
++ if (!classid)
++ classid = sk->sk_priority;
++
++ if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid))
++ goto errout;
++ }
++
+ r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk));
+ r->idiag_inode = sock_i_ino(sk);
+
+@@ -288,24 +302,6 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
+ goto errout;
+ }
+
+- if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) ||
+- ext & (1 << (INET_DIAG_TCLASS - 1))) {
+- u32 classid = 0;
+-
+-#ifdef CONFIG_SOCK_CGROUP_DATA
+- classid = sock_cgroup_classid(&sk->sk_cgrp_data);
+-#endif
+- /* Fallback to socket priority if class id isn't set.
+- * Classful qdiscs use it as direct reference to class.
+- * For cgroup2 classid is always zero.
+- */
+- if (!classid)
+- classid = sk->sk_priority;
+-
+- if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid))
+- goto errout;
+- }
+-
+ out:
+ nlmsg_end(skb, nlh);
+ return 0;
+diff --git a/net/ipv4/raw_diag.c b/net/ipv4/raw_diag.c
+index 6367ecdf76c4..1d84b02ec765 100644
+--- a/net/ipv4/raw_diag.c
++++ b/net/ipv4/raw_diag.c
+@@ -99,8 +99,9 @@ static int raw_diag_dump_one(struct sk_buff *in_skb,
+ if (IS_ERR(sk))
+ return PTR_ERR(sk);
+
+- rep = nlmsg_new(sizeof(struct inet_diag_msg) +
+- sizeof(struct inet_diag_meminfo) + 64,
++ rep = nlmsg_new(nla_total_size(sizeof(struct inet_diag_msg)) +
++ inet_diag_msg_attrs_size() +
++ nla_total_size(sizeof(struct inet_diag_meminfo)) + 64,
+ GFP_KERNEL);
+ if (!rep) {
+ sock_put(sk);
+diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
+index d9ad986c7b2c..cc3f6da306c6 100644
+--- a/net/ipv4/udp_diag.c
++++ b/net/ipv4/udp_diag.c
+@@ -67,8 +67,9 @@ static int udp_dump_one(struct udp_table *tbl, struct sk_buff *in_skb,
+ goto out;
+
+ err = -ENOMEM;
+- rep = nlmsg_new(sizeof(struct inet_diag_msg) +
+- sizeof(struct inet_diag_meminfo) + 64,
++ rep = nlmsg_new(nla_total_size(sizeof(struct inet_diag_msg)) +
++ inet_diag_msg_attrs_size() +
++ nla_total_size(sizeof(struct inet_diag_meminfo)) + 64,
+ GFP_KERNEL);
+ if (!rep)
+ goto out;
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index ef309a26aba0..0c804716a2aa 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1175,11 +1175,12 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
+ }
+
+ static void
+-cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires, bool del_rt)
++cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires,
++ bool del_rt, bool del_peer)
+ {
+ struct fib6_info *f6i;
+
+- f6i = addrconf_get_prefix_route(&ifp->addr,
++ f6i = addrconf_get_prefix_route(del_peer ? &ifp->peer_addr : &ifp->addr,
+ ifp->prefix_len,
+ ifp->idev->dev,
+ 0, RTF_GATEWAY | RTF_DEFAULT);
+@@ -1244,7 +1245,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
+
+ if (action != CLEANUP_PREFIX_RT_NOP) {
+ cleanup_prefix_route(ifp, expires,
+- action == CLEANUP_PREFIX_RT_DEL);
++ action == CLEANUP_PREFIX_RT_DEL, false);
+ }
+
+ /* clean up prefsrc entries */
+@@ -3291,6 +3292,10 @@ static void addrconf_dev_config(struct net_device *dev)
+ (dev->type != ARPHRD_NONE) &&
+ (dev->type != ARPHRD_RAWIP)) {
+ /* Alas, we support only Ethernet autoconfiguration. */
++ idev = __in6_dev_get(dev);
++ if (!IS_ERR_OR_NULL(idev) && dev->flags & IFF_UP &&
++ dev->flags & IFF_MULTICAST)
++ ipv6_mc_up(idev);
+ return;
+ }
+
+@@ -4531,12 +4536,13 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh,
+ }
+
+ static int modify_prefix_route(struct inet6_ifaddr *ifp,
+- unsigned long expires, u32 flags)
++ unsigned long expires, u32 flags,
++ bool modify_peer)
+ {
+ struct fib6_info *f6i;
+ u32 prio;
+
+- f6i = addrconf_get_prefix_route(&ifp->addr,
++ f6i = addrconf_get_prefix_route(modify_peer ? &ifp->peer_addr : &ifp->addr,
+ ifp->prefix_len,
+ ifp->idev->dev,
+ 0, RTF_GATEWAY | RTF_DEFAULT);
+@@ -4549,7 +4555,8 @@ static int modify_prefix_route(struct inet6_ifaddr *ifp,
+ ip6_del_rt(dev_net(ifp->idev->dev), f6i);
+
+ /* add new one */
+- addrconf_prefix_route(&ifp->addr, ifp->prefix_len,
++ addrconf_prefix_route(modify_peer ? &ifp->peer_addr : &ifp->addr,
++ ifp->prefix_len,
+ ifp->rt_priority, ifp->idev->dev,
+ expires, flags, GFP_KERNEL);
+ } else {
+@@ -4571,6 +4578,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+ unsigned long timeout;
+ bool was_managetempaddr;
+ bool had_prefixroute;
++ bool new_peer = false;
+
+ ASSERT_RTNL();
+
+@@ -4602,6 +4610,13 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+ cfg->preferred_lft = timeout;
+ }
+
++ if (cfg->peer_pfx &&
++ memcmp(&ifp->peer_addr, cfg->peer_pfx, sizeof(struct in6_addr))) {
++ if (!ipv6_addr_any(&ifp->peer_addr))
++ cleanup_prefix_route(ifp, expires, true, true);
++ new_peer = true;
++ }
++
+ spin_lock_bh(&ifp->lock);
+ was_managetempaddr = ifp->flags & IFA_F_MANAGETEMPADDR;
+ had_prefixroute = ifp->flags & IFA_F_PERMANENT &&
+@@ -4617,6 +4632,9 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+ if (cfg->rt_priority && cfg->rt_priority != ifp->rt_priority)
+ ifp->rt_priority = cfg->rt_priority;
+
++ if (new_peer)
++ ifp->peer_addr = *cfg->peer_pfx;
++
+ spin_unlock_bh(&ifp->lock);
+ if (!(ifp->flags&IFA_F_TENTATIVE))
+ ipv6_ifa_notify(0, ifp);
+@@ -4625,7 +4643,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+ int rc = -ENOENT;
+
+ if (had_prefixroute)
+- rc = modify_prefix_route(ifp, expires, flags);
++ rc = modify_prefix_route(ifp, expires, flags, false);
+
+ /* prefix route could have been deleted; if so restore it */
+ if (rc == -ENOENT) {
+@@ -4633,6 +4651,15 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+ ifp->rt_priority, ifp->idev->dev,
+ expires, flags, GFP_KERNEL);
+ }
++
++ if (had_prefixroute && !ipv6_addr_any(&ifp->peer_addr))
++ rc = modify_prefix_route(ifp, expires, flags, true);
++
++ if (rc == -ENOENT && !ipv6_addr_any(&ifp->peer_addr)) {
++ addrconf_prefix_route(&ifp->peer_addr, ifp->prefix_len,
++ ifp->rt_priority, ifp->idev->dev,
++ expires, flags, GFP_KERNEL);
++ }
+ } else if (had_prefixroute) {
+ enum cleanup_prefix_rt_t action;
+ unsigned long rt_expires;
+@@ -4643,7 +4670,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+
+ if (action != CLEANUP_PREFIX_RT_NOP) {
+ cleanup_prefix_route(ifp, rt_expires,
+- action == CLEANUP_PREFIX_RT_DEL);
++ action == CLEANUP_PREFIX_RT_DEL, false);
+ }
+ }
+
+@@ -5702,9 +5729,9 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
+ if (ifp->idev->cnf.forwarding)
+ addrconf_join_anycast(ifp);
+ if (!ipv6_addr_any(&ifp->peer_addr))
+- addrconf_prefix_route(&ifp->peer_addr, 128, 0,
+- ifp->idev->dev, 0, 0,
+- GFP_ATOMIC);
++ addrconf_prefix_route(&ifp->peer_addr, 128,
++ ifp->rt_priority, ifp->idev->dev,
++ 0, 0, GFP_ATOMIC);
+ break;
+ case RTM_DELADDR:
+ if (ifp->idev->cnf.forwarding)
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index c0cac9cc3a28..a20be08f0e0b 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -185,9 +185,15 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ retv = -EBUSY;
+ break;
+ }
+- } else if (sk->sk_protocol != IPPROTO_TCP)
++ } else if (sk->sk_protocol == IPPROTO_TCP) {
++ if (sk->sk_prot != &tcpv6_prot) {
++ retv = -EBUSY;
++ break;
++ }
+ break;
+-
++ } else {
++ break;
++ }
+ if (sk->sk_state != TCP_ESTABLISHED) {
+ retv = -ENOTCONN;
+ break;
+diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
+index 13279f683da9..4c94f3ba2ae4 100644
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -390,7 +390,7 @@ static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ *pos = cpu + 1;
+ return per_cpu_ptr(net->ct.stat, cpu);
+ }
+-
++ (*pos)++;
+ return NULL;
+ }
+
+diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
+index 8ff4d22f10b2..353a2aa80c3c 100644
+--- a/net/netfilter/nf_synproxy_core.c
++++ b/net/netfilter/nf_synproxy_core.c
+@@ -273,7 +273,7 @@ static void *synproxy_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ *pos = cpu + 1;
+ return per_cpu_ptr(snet->stats, cpu);
+ }
+-
++ (*pos)++;
+ return NULL;
+ }
+
+diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
+index e5d27b2e4eba..66154dafa305 100644
+--- a/net/netfilter/nfnetlink_cthelper.c
++++ b/net/netfilter/nfnetlink_cthelper.c
+@@ -744,6 +744,8 @@ static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = {
+ [NFCTH_NAME] = { .type = NLA_NUL_STRING,
+ .len = NF_CT_HELPER_NAME_LEN-1 },
+ [NFCTH_QUEUE_NUM] = { .type = NLA_U32, },
++ [NFCTH_PRIV_DATA_LEN] = { .type = NLA_U32, },
++ [NFCTH_STATUS] = { .type = NLA_U32, },
+ };
+
+ static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = {
+diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
+index e110b0ebbf58..19446a89a2a8 100644
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -121,6 +121,7 @@ static const struct nla_policy nft_payload_policy[NFTA_PAYLOAD_MAX + 1] = {
+ [NFTA_PAYLOAD_LEN] = { .type = NLA_U32 },
+ [NFTA_PAYLOAD_CSUM_TYPE] = { .type = NLA_U32 },
+ [NFTA_PAYLOAD_CSUM_OFFSET] = { .type = NLA_U32 },
++ [NFTA_PAYLOAD_CSUM_FLAGS] = { .type = NLA_U32 },
+ };
+
+ static int nft_payload_init(const struct nft_ctx *ctx,
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index 1c6d15ea76d4..8ae948fd9dcf 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -308,6 +308,8 @@ static const struct nla_policy nft_tunnel_key_policy[NFTA_TUNNEL_KEY_MAX + 1] =
+ [NFTA_TUNNEL_KEY_FLAGS] = { .type = NLA_U32, },
+ [NFTA_TUNNEL_KEY_TOS] = { .type = NLA_U8, },
+ [NFTA_TUNNEL_KEY_TTL] = { .type = NLA_U8, },
++ [NFTA_TUNNEL_KEY_SPORT] = { .type = NLA_U16, },
++ [NFTA_TUNNEL_KEY_DPORT] = { .type = NLA_U16, },
+ [NFTA_TUNNEL_KEY_OPTS] = { .type = NLA_NESTED, },
+ };
+
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index 13e1ac333fa4..3bab89dbc371 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -1556,6 +1556,9 @@ static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
+ uint8_t nfproto = (unsigned long)PDE_DATA(file_inode(seq->file));
+ struct nf_mttg_trav *trav = seq->private;
+
++ if (ppos != NULL)
++ ++(*ppos);
++
+ switch (trav->class) {
+ case MTTG_TRAV_INIT:
+ trav->class = MTTG_TRAV_NFP_UNSPEC;
+@@ -1581,9 +1584,6 @@ static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
+ default:
+ return NULL;
+ }
+-
+- if (ppos != NULL)
+- ++*ppos;
+ return trav;
+ }
+
+diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
+index f44de4bc2100..570144507df1 100644
+--- a/net/netfilter/xt_recent.c
++++ b/net/netfilter/xt_recent.c
+@@ -497,12 +497,12 @@ static void *recent_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ const struct recent_entry *e = v;
+ const struct list_head *head = e->list.next;
+
++ (*pos)++;
+ while (head == &t->iphash[st->bucket]) {
+ if (++st->bucket >= ip_list_hash_size)
+ return NULL;
+ head = t->iphash[st->bucket].next;
+ }
+- (*pos)++;
+ return list_entry(head, struct recent_entry, list);
+ }
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 4a1b1bb39b4b..1bb9f219f07d 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -2411,7 +2411,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
+ in_skb->len))
+ WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_OFFS,
+ (u8 *)extack->bad_attr -
+- in_skb->data));
++ (u8 *)nlh));
+ } else {
+ if (extack->cookie_len)
+ WARN_ON(nla_put(skb, NLMSGERR_ATTR_COOKIE,
+diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
+index 19cb2e473ea6..4f5a09e3fd70 100644
+--- a/net/nfc/hci/core.c
++++ b/net/nfc/hci/core.c
+@@ -193,13 +193,20 @@ exit:
+ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+ struct sk_buff *skb)
+ {
+- u8 gate = hdev->pipes[pipe].gate;
+ u8 status = NFC_HCI_ANY_OK;
+ struct hci_create_pipe_resp *create_info;
+ struct hci_delete_pipe_noti *delete_info;
+ struct hci_all_pipe_cleared_noti *cleared_info;
++ u8 gate;
+
+- pr_debug("from gate %x pipe %x cmd %x\n", gate, pipe, cmd);
++ pr_debug("from pipe %x cmd %x\n", pipe, cmd);
++
++ if (pipe >= NFC_HCI_MAX_PIPES) {
++ status = NFC_HCI_ANY_E_NOK;
++ goto exit;
++ }
++
++ gate = hdev->pipes[pipe].gate;
+
+ switch (cmd) {
+ case NFC_HCI_ADM_NOTIFY_PIPE_CREATED:
+@@ -387,8 +394,14 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
+ struct sk_buff *skb)
+ {
+ int r = 0;
+- u8 gate = hdev->pipes[pipe].gate;
++ u8 gate;
++
++ if (pipe >= NFC_HCI_MAX_PIPES) {
++ pr_err("Discarded event %x to invalid pipe %x\n", event, pipe);
++ goto exit;
++ }
+
++ gate = hdev->pipes[pipe].gate;
+ if (gate == NFC_HCI_INVALID_GATE) {
+ pr_err("Discarded event %x to unopened pipe %x\n", event, pipe);
+ goto exit;
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index 30938854bb8d..a65a5a5f434b 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -44,6 +44,7 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
+ [NFC_ATTR_DEVICE_NAME] = { .type = NLA_STRING,
+ .len = NFC_DEVICE_NAME_MAXSIZE },
+ [NFC_ATTR_PROTOCOLS] = { .type = NLA_U32 },
++ [NFC_ATTR_TARGET_INDEX] = { .type = NLA_U32 },
+ [NFC_ATTR_COMM_MODE] = { .type = NLA_U8 },
+ [NFC_ATTR_RF_MODE] = { .type = NLA_U8 },
+ [NFC_ATTR_DEVICE_POWERED] = { .type = NLA_U8 },
+@@ -55,7 +56,10 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
+ [NFC_ATTR_LLC_SDP] = { .type = NLA_NESTED },
+ [NFC_ATTR_FIRMWARE_NAME] = { .type = NLA_STRING,
+ .len = NFC_FIRMWARE_NAME_MAXSIZE },
++ [NFC_ATTR_SE_INDEX] = { .type = NLA_U32 },
+ [NFC_ATTR_SE_APDU] = { .type = NLA_BINARY },
++ [NFC_ATTR_VENDOR_ID] = { .type = NLA_U32 },
++ [NFC_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
+ [NFC_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
+
+ };
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index ddf90e6fac51..ecea8edae61c 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2260,6 +2260,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ TP_STATUS_KERNEL, (macoff+snaplen));
+ if (!h.raw)
+ goto drop_n_account;
++
++ if (do_vnet &&
++ virtio_net_hdr_from_skb(skb, h.raw + macoff -
++ sizeof(struct virtio_net_hdr),
++ vio_le(), true, 0))
++ goto drop_n_account;
++
+ if (po->tp_version <= TPACKET_V2) {
+ packet_increment_rx_head(po, &po->rx_ring);
+ /*
+@@ -2272,12 +2279,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ status |= TP_STATUS_LOSING;
+ }
+
+- if (do_vnet &&
+- virtio_net_hdr_from_skb(skb, h.raw + macoff -
+- sizeof(struct virtio_net_hdr),
+- vio_le(), true, 0))
+- goto drop_n_account;
+-
+ po->stats.stats1.tp_packets++;
+ if (copy_skb) {
+ status |= TP_STATUS_COPY;
+diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
+index 1ee2b77f607b..ba60a8dd5bb3 100644
+--- a/net/sched/sch_fq.c
++++ b/net/sched/sch_fq.c
+@@ -695,6 +695,7 @@ static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = {
+ [TCA_FQ_FLOW_MAX_RATE] = { .type = NLA_U32 },
+ [TCA_FQ_BUCKETS_LOG] = { .type = NLA_U32 },
+ [TCA_FQ_FLOW_REFILL_DELAY] = { .type = NLA_U32 },
++ [TCA_FQ_ORPHAN_MASK] = { .type = NLA_U32 },
+ [TCA_FQ_LOW_RATE_THRESHOLD] = { .type = NLA_U32 },
+ };
+
+diff --git a/net/sctp/diag.c b/net/sctp/diag.c
+index 435847d98b51..8767405de9fa 100644
+--- a/net/sctp/diag.c
++++ b/net/sctp/diag.c
+@@ -252,15 +252,11 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc)
+ addrcnt++;
+
+ return nla_total_size(sizeof(struct sctp_info))
+- + nla_total_size(1) /* INET_DIAG_SHUTDOWN */
+- + nla_total_size(1) /* INET_DIAG_TOS */
+- + nla_total_size(1) /* INET_DIAG_TCLASS */
+- + nla_total_size(4) /* INET_DIAG_MARK */
+- + nla_total_size(4) /* INET_DIAG_CLASS_ID */
+ + nla_total_size(addrlen * asoc->peer.transport_count)
+ + nla_total_size(addrlen * addrcnt)
+- + nla_total_size(sizeof(struct inet_diag_meminfo))
+ + nla_total_size(sizeof(struct inet_diag_msg))
++ + inet_diag_msg_attrs_size()
++ + nla_total_size(sizeof(struct inet_diag_meminfo))
+ + 64;
+ }
+
+diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
+index e519ef29c0ff..c974d7d9a2bb 100644
+--- a/net/smc/smc_ib.c
++++ b/net/smc/smc_ib.c
+@@ -552,6 +552,8 @@ static void smc_ib_remove_dev(struct ib_device *ibdev, void *client_data)
+ struct smc_ib_device *smcibdev;
+
+ smcibdev = ib_get_client_data(ibdev, &smc_ib_client);
++ if (!smcibdev || smcibdev->ibdev != ibdev)
++ return;
+ ib_set_client_data(ibdev, &smc_ib_client, NULL);
+ spin_lock(&smc_ib_devices.lock);
+ list_del_init(&smcibdev->list); /* remove from smc_ib_devices */
+@@ -559,6 +561,7 @@ static void smc_ib_remove_dev(struct ib_device *ibdev, void *client_data)
+ smc_pnet_remove_by_ibdev(smcibdev);
+ smc_ib_cleanup_per_ibdev(smcibdev);
+ ib_unregister_event_handler(&smcibdev->event_handler);
++ cancel_work_sync(&smcibdev->port_event_work);
+ kfree(smcibdev);
+ }
+
+diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
+index 99ee419210ba..9b36163d951e 100644
+--- a/net/tipc/netlink.c
++++ b/net/tipc/netlink.c
+@@ -110,7 +110,8 @@ const struct nla_policy tipc_nl_prop_policy[TIPC_NLA_PROP_MAX + 1] = {
+ [TIPC_NLA_PROP_UNSPEC] = { .type = NLA_UNSPEC },
+ [TIPC_NLA_PROP_PRIO] = { .type = NLA_U32 },
+ [TIPC_NLA_PROP_TOL] = { .type = NLA_U32 },
+- [TIPC_NLA_PROP_WIN] = { .type = NLA_U32 }
++ [TIPC_NLA_PROP_WIN] = { .type = NLA_U32 },
++ [TIPC_NLA_PROP_MTU] = { .type = NLA_U32 }
+ };
+
+ const struct nla_policy tipc_nl_bearer_policy[TIPC_NLA_BEARER_MAX + 1] = {
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index dfde06b8d25d..d502cc7a8ff7 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -349,6 +349,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
+ [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
+ [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
++ [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
++ [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
+ [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
+ [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
+ [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
+@@ -397,6 +399,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ [NL80211_ATTR_MDID] = { .type = NLA_U16 },
+ [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
+ .len = IEEE80211_MAX_DATA_LEN },
++ [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
++ [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = { .type = NLA_U16 },
+ [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
+ [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
+ [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
+@@ -422,6 +426,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
+ [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
+ [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
++ [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
+ [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
+ [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
+ [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
+diff --git a/tools/perf/bench/futex-wake.c b/tools/perf/bench/futex-wake.c
+index e8181ad7d088..e62006342b18 100644
+--- a/tools/perf/bench/futex-wake.c
++++ b/tools/perf/bench/futex-wake.c
+@@ -42,7 +42,7 @@ static bool done = false, silent = false, fshared = false;
+ static pthread_mutex_t thread_lock;
+ static pthread_cond_t thread_parent, thread_worker;
+ static struct stats waketime_stats, wakeup_stats;
+-static unsigned int ncpus, threads_starting, nthreads = 0;
++static unsigned int threads_starting, nthreads = 0;
+ static int futex_flag = 0;
+
+ static const struct option options[] = {
+@@ -140,7 +140,7 @@ int bench_futex_wake(int argc, const char **argv)
+ sigaction(SIGINT, &act, NULL);
+
+ if (!nthreads)
+- nthreads = ncpus;
++ nthreads = cpu->nr;
+
+ worker = calloc(nthreads, sizeof(*worker));
+ if (!worker)
+diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
+index 87af8a68ab25..3118fc0d149b 100755
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -1372,7 +1372,7 @@ sub reboot {
+
+ } else {
+ # Make sure everything has been written to disk
+- run_ssh("sync");
++ run_ssh("sync", 10);
+
+ if (defined($time)) {
+ start_monitor;
+diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
+index 7d1a7c0dc56a..67048f922ff2 100755
+--- a/tools/testing/selftests/net/fib_tests.sh
++++ b/tools/testing/selftests/net/fib_tests.sh
+@@ -979,6 +979,27 @@ ipv6_addr_metric_test()
+ fi
+ log_test $rc 0 "Prefix route with metric on link up"
+
++ # verify peer metric added correctly
++ set -e
++ run_cmd "$IP -6 addr flush dev dummy2"
++ run_cmd "$IP -6 addr add dev dummy2 2001:db8:104::1 peer 2001:db8:104::2 metric 260"
++ set +e
++
++ check_route6 "2001:db8:104::1 dev dummy2 proto kernel metric 260"
++ log_test $? 0 "Set metric with peer route on local side"
++ log_test $? 0 "User specified metric on local address"
++ check_route6 "2001:db8:104::2 dev dummy2 proto kernel metric 260"
++ log_test $? 0 "Set metric with peer route on peer side"
++
++ set -e
++ run_cmd "$IP -6 addr change dev dummy2 2001:db8:104::1 peer 2001:db8:104::3 metric 261"
++ set +e
++
++ check_route6 "2001:db8:104::1 dev dummy2 proto kernel metric 261"
++ log_test $? 0 "Modify metric and peer address on local side"
++ check_route6 "2001:db8:104::3 dev dummy2 proto kernel metric 261"
++ log_test $? 0 "Modify metric and peer address on peer side"
++
+ $IP li del dummy1
+ $IP li del dummy2
+ cleanup
+@@ -1320,13 +1341,20 @@ ipv4_addr_metric_test()
+
+ run_cmd "$IP addr flush dev dummy2"
+ run_cmd "$IP addr add dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 260"
+- run_cmd "$IP addr change dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 261"
+ rc=$?
+ if [ $rc -eq 0 ]; then
+- check_route "172.16.104.2 dev dummy2 proto kernel scope link src 172.16.104.1 metric 261"
++ check_route "172.16.104.2 dev dummy2 proto kernel scope link src 172.16.104.1 metric 260"
++ rc=$?
++ fi
++ log_test $rc 0 "Set metric of address with peer route"
++
++ run_cmd "$IP addr change dev dummy2 172.16.104.1/32 peer 172.16.104.3 metric 261"
++ rc=$?
++ if [ $rc -eq 0 ]; then
++ check_route "172.16.104.3 dev dummy2 proto kernel scope link src 172.16.104.1 metric 261"
+ rc=$?
+ fi
+- log_test $rc 0 "Modify metric of address with peer route"
++ log_test $rc 0 "Modify metric and peer address for peer route"
+
+ $IP li del dummy1
+ $IP li del dummy2
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-03-20 11:57 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-03-20 11:57 UTC (permalink / raw
To: gentoo-commits
commit: d763e643caecaf529b1a9a2cfa9981ed82043b40
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 20 11:57:16 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Mar 20 11:57:16 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d763e643
Linux patch 4.19.112
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1111_linux-4.19.112.patch | 1986 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1990 insertions(+)
diff --git a/0000_README b/0000_README
index 7eab5d8..e470ab2 100644
--- a/0000_README
+++ b/0000_README
@@ -483,6 +483,10 @@ Patch: 1110_linux-4.19.111.patch
From: https://www.kernel.org
Desc: Linux 4.19.111
+Patch: 1111_linux-4.19.112.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.112
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1111_linux-4.19.112.patch b/1111_linux-4.19.112.patch
new file mode 100644
index 0000000..47b3ac8
--- /dev/null
+++ b/1111_linux-4.19.112.patch
@@ -0,0 +1,1986 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 8bf0c0532046..1a5101b7e853 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -136,6 +136,10 @@
+ dynamic table installation which will install SSDT
+ tables to /sys/firmware/acpi/tables/dynamic.
+
++ acpi_no_watchdog [HW,ACPI,WDT]
++ Ignore the ACPI-based watchdog interface (WDAT) and let
++ a native driver control the watchdog device instead.
++
+ acpi_rsdp= [ACPI,EFI,KEXEC]
+ Pass the RSDP address to the kernel, mostly used
+ on machines running EFI runtime service to boot the
+diff --git a/Documentation/driver-api/device_link.rst b/Documentation/driver-api/device_link.rst
+index d6763272e747..e8b0a8fd1ae0 100644
+--- a/Documentation/driver-api/device_link.rst
++++ b/Documentation/driver-api/device_link.rst
+@@ -25,8 +25,8 @@ suspend/resume and shutdown ordering.
+
+ Device links allow representation of such dependencies in the driver core.
+
+-In its standard form, a device link combines *both* dependency types:
+-It guarantees correct suspend/resume and shutdown ordering between a
++In its standard or *managed* form, a device link combines *both* dependency
++types: It guarantees correct suspend/resume and shutdown ordering between a
+ "supplier" device and its "consumer" devices, and it guarantees driver
+ presence on the supplier. The consumer devices are not probed before the
+ supplier is bound to a driver, and they're unbound before the supplier
+@@ -59,18 +59,24 @@ device ``->probe`` callback or a boot-time PCI quirk.
+
+ Another example for an inconsistent state would be a device link that
+ represents a driver presence dependency, yet is added from the consumer's
+-``->probe`` callback while the supplier hasn't probed yet: Had the driver
+-core known about the device link earlier, it wouldn't have probed the
++``->probe`` callback while the supplier hasn't started to probe yet: Had the
++driver core known about the device link earlier, it wouldn't have probed the
+ consumer in the first place. The onus is thus on the consumer to check
+ presence of the supplier after adding the link, and defer probing on
+-non-presence.
+-
+-If a device link is added in the ``->probe`` callback of the supplier or
+-consumer driver, it is typically deleted in its ``->remove`` callback for
+-symmetry. That way, if the driver is compiled as a module, the device
+-link is added on module load and orderly deleted on unload. The same
+-restrictions that apply to device link addition (e.g. exclusion of a
+-parallel suspend/resume transition) apply equally to deletion.
++non-presence. [Note that it is valid to create a link from the consumer's
++``->probe`` callback while the supplier is still probing, but the consumer must
++know that the supplier is functional already at the link creation time (that is
++the case, for instance, if the consumer has just acquired some resources that
++would not have been available had the supplier not been functional then).]
++
++If a device link with ``DL_FLAG_STATELESS`` set (i.e. a stateless device link)
++is added in the ``->probe`` callback of the supplier or consumer driver, it is
++typically deleted in its ``->remove`` callback for symmetry. That way, if the
++driver is compiled as a module, the device link is added on module load and
++orderly deleted on unload. The same restrictions that apply to device link
++addition (e.g. exclusion of a parallel suspend/resume transition) apply equally
++to deletion. Device links managed by the driver core are deleted automatically
++by it.
+
+ Several flags may be specified on device link addition, two of which
+ have already been mentioned above: ``DL_FLAG_STATELESS`` to express that no
+@@ -83,22 +89,37 @@ link is added from the consumer's ``->probe`` callback: ``DL_FLAG_RPM_ACTIVE``
+ can be specified to runtime resume the supplier upon addition of the
+ device link. ``DL_FLAG_AUTOREMOVE_CONSUMER`` causes the device link to be
+ automatically purged when the consumer fails to probe or later unbinds.
+-This obviates the need to explicitly delete the link in the ``->remove``
+-callback or in the error path of the ``->probe`` callback.
+
+ Similarly, when the device link is added from supplier's ``->probe`` callback,
+ ``DL_FLAG_AUTOREMOVE_SUPPLIER`` causes the device link to be automatically
+ purged when the supplier fails to probe or later unbinds.
+
++If neither ``DL_FLAG_AUTOREMOVE_CONSUMER`` nor ``DL_FLAG_AUTOREMOVE_SUPPLIER``
++is set, ``DL_FLAG_AUTOPROBE_CONSUMER`` can be used to request the driver core
++to probe for a driver for the consumer driver on the link automatically after
++a driver has been bound to the supplier device.
++
++Note, however, that any combinations of ``DL_FLAG_AUTOREMOVE_CONSUMER``,
++``DL_FLAG_AUTOREMOVE_SUPPLIER`` or ``DL_FLAG_AUTOPROBE_CONSUMER`` with
++``DL_FLAG_STATELESS`` are invalid and cannot be used.
++
+ Limitations
+ ===========
+
+-Driver authors should be aware that a driver presence dependency (i.e. when
+-``DL_FLAG_STATELESS`` is not specified on link addition) may cause probing of
+-the consumer to be deferred indefinitely. This can become a problem if the
+-consumer is required to probe before a certain initcall level is reached.
+-Worse, if the supplier driver is blacklisted or missing, the consumer will
+-never be probed.
++Driver authors should be aware that a driver presence dependency for managed
++device links (i.e. when ``DL_FLAG_STATELESS`` is not specified on link addition)
++may cause probing of the consumer to be deferred indefinitely. This can become
++a problem if the consumer is required to probe before a certain initcall level
++is reached. Worse, if the supplier driver is blacklisted or missing, the
++consumer will never be probed.
++
++Moreover, managed device links cannot be deleted directly. They are deleted
++by the driver core when they are not necessary any more in accordance with the
++``DL_FLAG_AUTOREMOVE_CONSUMER`` and ``DL_FLAG_AUTOREMOVE_SUPPLIER`` flags.
++However, stateless device links (i.e. device links with ``DL_FLAG_STATELESS``
++set) are expected to be removed by whoever called :c:func:`device_link_add()`
++to add them with the help of either :c:func:`device_link_del()` or
++:c:func:`device_link_remove()`.
+
+ Sometimes drivers depend on optional resources. They are able to operate
+ in a degraded mode (reduced feature set or performance) when those resources
+@@ -282,4 +303,4 @@ API
+ ===
+
+ .. kernel-doc:: drivers/base/core.c
+- :functions: device_link_add device_link_del
++ :functions: device_link_add device_link_del device_link_remove
+diff --git a/Makefile b/Makefile
+index fed04bdef0a3..bd57e085188d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 111
++SUBLEVEL = 112
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c
+index e8cda5e02b4e..a51b7ff0a85f 100644
+--- a/arch/arm/kernel/vdso.c
++++ b/arch/arm/kernel/vdso.c
+@@ -103,6 +103,8 @@ static bool __init cntvct_functional(void)
+ * this.
+ */
+ np = of_find_compatible_node(NULL, NULL, "arm,armv7-timer");
++ if (!np)
++ np = of_find_compatible_node(NULL, NULL, "arm,armv8-timer");
+ if (!np)
+ goto out_put;
+
+diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
+index 6709a8d33963..f1e34f16cfab 100644
+--- a/arch/arm/lib/copy_from_user.S
++++ b/arch/arm/lib/copy_from_user.S
+@@ -100,7 +100,7 @@ ENTRY(arm_copy_from_user)
+
+ ENDPROC(arm_copy_from_user)
+
+- .pushsection .fixup,"ax"
++ .pushsection .text.fixup,"ax"
+ .align 0
+ copy_abort_preamble
+ ldmfd sp!, {r1, r2, r3}
+diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
+index baa7e36073f9..604a8558752d 100644
+--- a/arch/x86/events/amd/uncore.c
++++ b/arch/x86/events/amd/uncore.c
+@@ -193,20 +193,18 @@ static int amd_uncore_event_init(struct perf_event *event)
+
+ /*
+ * NB and Last level cache counters (MSRs) are shared across all cores
+- * that share the same NB / Last level cache. Interrupts can be directed
+- * to a single target core, however, event counts generated by processes
+- * running on other cores cannot be masked out. So we do not support
+- * sampling and per-thread events.
++ * that share the same NB / Last level cache. On family 16h and below,
++ * Interrupts can be directed to a single target core, however, event
++ * counts generated by processes running on other cores cannot be masked
++ * out. So we do not support sampling and per-thread events via
++ * CAP_NO_INTERRUPT, and we do not enable counter overflow interrupts:
+ */
+- if (is_sampling_event(event) || event->attach_state & PERF_ATTACH_TASK)
+- return -EINVAL;
+
+ /* NB and Last level cache counters do not have usr/os/guest/host bits */
+ if (event->attr.exclude_user || event->attr.exclude_kernel ||
+ event->attr.exclude_host || event->attr.exclude_guest)
+ return -EINVAL;
+
+- /* and we do not enable counter overflow interrupts */
+ hwc->config = event->attr.config & AMD64_RAW_EVENT_MASK_NB;
+ hwc->idx = -1;
+
+@@ -314,6 +312,7 @@ static struct pmu amd_nb_pmu = {
+ .start = amd_uncore_start,
+ .stop = amd_uncore_stop,
+ .read = amd_uncore_read,
++ .capabilities = PERF_PMU_CAP_NO_INTERRUPT,
+ };
+
+ static struct pmu amd_llc_pmu = {
+@@ -324,6 +323,7 @@ static struct pmu amd_llc_pmu = {
+ .start = amd_uncore_start,
+ .stop = amd_uncore_stop,
+ .read = amd_uncore_read,
++ .capabilities = PERF_PMU_CAP_NO_INTERRUPT,
+ };
+
+ static struct amd_uncore *amd_uncore_alloc(unsigned int cpu)
+diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
+index 23cde3d8e8fb..0bd1899a287f 100644
+--- a/drivers/acpi/acpi_watchdog.c
++++ b/drivers/acpi/acpi_watchdog.c
+@@ -58,12 +58,14 @@ static bool acpi_watchdog_uses_rtc(const struct acpi_table_wdat *wdat)
+ }
+ #endif
+
++static bool acpi_no_watchdog;
++
+ static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void)
+ {
+ const struct acpi_table_wdat *wdat = NULL;
+ acpi_status status;
+
+- if (acpi_disabled)
++ if (acpi_disabled || acpi_no_watchdog)
+ return NULL;
+
+ status = acpi_get_table(ACPI_SIG_WDAT, 0,
+@@ -91,6 +93,14 @@ bool acpi_has_watchdog(void)
+ }
+ EXPORT_SYMBOL_GPL(acpi_has_watchdog);
+
++/* ACPI watchdog can be disabled on boot command line */
++static int __init disable_acpi_watchdog(char *str)
++{
++ acpi_no_watchdog = true;
++ return 1;
++}
++__setup("acpi_no_watchdog", disable_acpi_watchdog);
++
+ void __init acpi_watchdog_init(void)
+ {
+ const struct acpi_wdat_entry *entries;
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 742bc60e9cca..928fc1532a70 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -124,6 +124,50 @@ static int device_is_dependent(struct device *dev, void *target)
+ return ret;
+ }
+
++static void device_link_init_status(struct device_link *link,
++ struct device *consumer,
++ struct device *supplier)
++{
++ switch (supplier->links.status) {
++ case DL_DEV_PROBING:
++ switch (consumer->links.status) {
++ case DL_DEV_PROBING:
++ /*
++ * A consumer driver can create a link to a supplier
++ * that has not completed its probing yet as long as it
++ * knows that the supplier is already functional (for
++ * example, it has just acquired some resources from the
++ * supplier).
++ */
++ link->status = DL_STATE_CONSUMER_PROBE;
++ break;
++ default:
++ link->status = DL_STATE_DORMANT;
++ break;
++ }
++ break;
++ case DL_DEV_DRIVER_BOUND:
++ switch (consumer->links.status) {
++ case DL_DEV_PROBING:
++ link->status = DL_STATE_CONSUMER_PROBE;
++ break;
++ case DL_DEV_DRIVER_BOUND:
++ link->status = DL_STATE_ACTIVE;
++ break;
++ default:
++ link->status = DL_STATE_AVAILABLE;
++ break;
++ }
++ break;
++ case DL_DEV_UNBINDING:
++ link->status = DL_STATE_SUPPLIER_UNBIND;
++ break;
++ default:
++ link->status = DL_STATE_DORMANT;
++ break;
++ }
++}
++
+ static int device_reorder_to_tail(struct device *dev, void *not_used)
+ {
+ struct device_link *link;
+@@ -165,6 +209,13 @@ void device_pm_move_to_tail(struct device *dev)
+ device_links_read_unlock(idx);
+ }
+
++#define DL_MANAGED_LINK_FLAGS (DL_FLAG_AUTOREMOVE_CONSUMER | \
++ DL_FLAG_AUTOREMOVE_SUPPLIER | \
++ DL_FLAG_AUTOPROBE_CONSUMER)
++
++#define DL_ADD_VALID_FLAGS (DL_MANAGED_LINK_FLAGS | DL_FLAG_STATELESS | \
++ DL_FLAG_PM_RUNTIME | DL_FLAG_RPM_ACTIVE)
++
+ /**
+ * device_link_add - Create a link between two devices.
+ * @consumer: Consumer end of the link.
+@@ -179,14 +230,38 @@ void device_pm_move_to_tail(struct device *dev)
+ * of the link. If DL_FLAG_PM_RUNTIME is not set, DL_FLAG_RPM_ACTIVE will be
+ * ignored.
+ *
+- * If the DL_FLAG_AUTOREMOVE_CONSUMER flag is set, the link will be removed
+- * automatically when the consumer device driver unbinds from it. Analogously,
+- * if DL_FLAG_AUTOREMOVE_SUPPLIER is set in @flags, the link will be removed
+- * automatically when the supplier device driver unbinds from it.
+- *
+- * The combination of DL_FLAG_STATELESS and either DL_FLAG_AUTOREMOVE_CONSUMER
+- * or DL_FLAG_AUTOREMOVE_SUPPLIER set in @flags at the same time is invalid and
+- * will cause NULL to be returned upfront.
++ * If DL_FLAG_STATELESS is set in @flags, the caller of this function is
++ * expected to release the link returned by it directly with the help of either
++ * device_link_del() or device_link_remove().
++ *
++ * If that flag is not set, however, the caller of this function is handing the
++ * management of the link over to the driver core entirely and its return value
++ * can only be used to check whether or not the link is present. In that case,
++ * the DL_FLAG_AUTOREMOVE_CONSUMER and DL_FLAG_AUTOREMOVE_SUPPLIER device link
++ * flags can be used to indicate to the driver core when the link can be safely
++ * deleted. Namely, setting one of them in @flags indicates to the driver core
++ * that the link is not going to be used (by the given caller of this function)
++ * after unbinding the consumer or supplier driver, respectively, from its
++ * device, so the link can be deleted at that point. If none of them is set,
++ * the link will be maintained until one of the devices pointed to by it (either
++ * the consumer or the supplier) is unregistered.
++ *
++ * Also, if DL_FLAG_STATELESS, DL_FLAG_AUTOREMOVE_CONSUMER and
++ * DL_FLAG_AUTOREMOVE_SUPPLIER are not set in @flags (that is, a persistent
++ * managed device link is being added), the DL_FLAG_AUTOPROBE_CONSUMER flag can
++ * be used to request the driver core to automaticall probe for a consmer
++ * driver after successfully binding a driver to the supplier device.
++ *
++ * The combination of DL_FLAG_STATELESS and one of DL_FLAG_AUTOREMOVE_CONSUMER,
++ * DL_FLAG_AUTOREMOVE_SUPPLIER, or DL_FLAG_AUTOPROBE_CONSUMER set in @flags at
++ * the same time is invalid and will cause NULL to be returned upfront.
++ * However, if a device link between the given @consumer and @supplier pair
++ * exists already when this function is called for them, the existing link will
++ * be returned regardless of its current type and status (the link's flags may
++ * be modified then). The caller of this function is then expected to treat
++ * the link as though it has just been created, so (in particular) if
++ * DL_FLAG_STATELESS was passed in @flags, the link needs to be released
++ * explicitly when not needed any more (as stated above).
+ *
+ * A side effect of the link creation is re-ordering of dpm_list and the
+ * devices_kset list by moving the consumer device and all devices depending
+@@ -202,9 +277,11 @@ struct device_link *device_link_add(struct device *consumer,
+ {
+ struct device_link *link;
+
+- if (!consumer || !supplier ||
+- (flags & DL_FLAG_STATELESS &&
+- flags & (DL_FLAG_AUTOREMOVE_CONSUMER | DL_FLAG_AUTOREMOVE_SUPPLIER)))
++ if (!consumer || !supplier || flags & ~DL_ADD_VALID_FLAGS ||
++ (flags & DL_FLAG_STATELESS && flags & DL_MANAGED_LINK_FLAGS) ||
++ (flags & DL_FLAG_AUTOPROBE_CONSUMER &&
++ flags & (DL_FLAG_AUTOREMOVE_CONSUMER |
++ DL_FLAG_AUTOREMOVE_SUPPLIER)))
+ return NULL;
+
+ if (flags & DL_FLAG_PM_RUNTIME && flags & DL_FLAG_RPM_ACTIVE) {
+@@ -214,6 +291,9 @@ struct device_link *device_link_add(struct device *consumer,
+ }
+ }
+
++ if (!(flags & DL_FLAG_STATELESS))
++ flags |= DL_FLAG_MANAGED;
++
+ device_links_write_lock();
+ device_pm_lock();
+
+@@ -228,25 +308,18 @@ struct device_link *device_link_add(struct device *consumer,
+ goto out;
+ }
+
++ /*
++ * DL_FLAG_AUTOREMOVE_SUPPLIER indicates that the link will be needed
++ * longer than for DL_FLAG_AUTOREMOVE_CONSUMER and setting them both
++ * together doesn't make sense, so prefer DL_FLAG_AUTOREMOVE_SUPPLIER.
++ */
++ if (flags & DL_FLAG_AUTOREMOVE_SUPPLIER)
++ flags &= ~DL_FLAG_AUTOREMOVE_CONSUMER;
++
+ list_for_each_entry(link, &supplier->links.consumers, s_node) {
+ if (link->consumer != consumer)
+ continue;
+
+- /*
+- * Don't return a stateless link if the caller wants a stateful
+- * one and vice versa.
+- */
+- if (WARN_ON((flags & DL_FLAG_STATELESS) != (link->flags & DL_FLAG_STATELESS))) {
+- link = NULL;
+- goto out;
+- }
+-
+- if (flags & DL_FLAG_AUTOREMOVE_CONSUMER)
+- link->flags |= DL_FLAG_AUTOREMOVE_CONSUMER;
+-
+- if (flags & DL_FLAG_AUTOREMOVE_SUPPLIER)
+- link->flags |= DL_FLAG_AUTOREMOVE_SUPPLIER;
+-
+ if (flags & DL_FLAG_PM_RUNTIME) {
+ if (!(link->flags & DL_FLAG_PM_RUNTIME)) {
+ pm_runtime_new_link(consumer);
+@@ -256,7 +329,31 @@ struct device_link *device_link_add(struct device *consumer,
+ refcount_inc(&link->rpm_active);
+ }
+
+- kref_get(&link->kref);
++ if (flags & DL_FLAG_STATELESS) {
++ link->flags |= DL_FLAG_STATELESS;
++ kref_get(&link->kref);
++ goto out;
++ }
++
++ /*
++ * If the life time of the link following from the new flags is
++ * longer than indicated by the flags of the existing link,
++ * update the existing link to stay around longer.
++ */
++ if (flags & DL_FLAG_AUTOREMOVE_SUPPLIER) {
++ if (link->flags & DL_FLAG_AUTOREMOVE_CONSUMER) {
++ link->flags &= ~DL_FLAG_AUTOREMOVE_CONSUMER;
++ link->flags |= DL_FLAG_AUTOREMOVE_SUPPLIER;
++ }
++ } else if (!(flags & DL_FLAG_AUTOREMOVE_CONSUMER)) {
++ link->flags &= ~(DL_FLAG_AUTOREMOVE_CONSUMER |
++ DL_FLAG_AUTOREMOVE_SUPPLIER);
++ }
++ if (!(link->flags & DL_FLAG_MANAGED)) {
++ kref_get(&link->kref);
++ link->flags |= DL_FLAG_MANAGED;
++ device_link_init_status(link, consumer, supplier);
++ }
+ goto out;
+ }
+
+@@ -283,39 +380,18 @@ struct device_link *device_link_add(struct device *consumer,
+ kref_init(&link->kref);
+
+ /* Determine the initial link state. */
+- if (flags & DL_FLAG_STATELESS) {
++ if (flags & DL_FLAG_STATELESS)
+ link->status = DL_STATE_NONE;
+- } else {
+- switch (supplier->links.status) {
+- case DL_DEV_DRIVER_BOUND:
+- switch (consumer->links.status) {
+- case DL_DEV_PROBING:
+- /*
+- * Some callers expect the link creation during
+- * consumer driver probe to resume the supplier
+- * even without DL_FLAG_RPM_ACTIVE.
+- */
+- if (flags & DL_FLAG_PM_RUNTIME)
+- pm_runtime_resume(supplier);
+-
+- link->status = DL_STATE_CONSUMER_PROBE;
+- break;
+- case DL_DEV_DRIVER_BOUND:
+- link->status = DL_STATE_ACTIVE;
+- break;
+- default:
+- link->status = DL_STATE_AVAILABLE;
+- break;
+- }
+- break;
+- case DL_DEV_UNBINDING:
+- link->status = DL_STATE_SUPPLIER_UNBIND;
+- break;
+- default:
+- link->status = DL_STATE_DORMANT;
+- break;
+- }
+- }
++ else
++ device_link_init_status(link, consumer, supplier);
++
++ /*
++ * Some callers expect the link creation during consumer driver probe to
++ * resume the supplier even without DL_FLAG_RPM_ACTIVE.
++ */
++ if (link->status == DL_STATE_CONSUMER_PROBE &&
++ flags & DL_FLAG_PM_RUNTIME)
++ pm_runtime_resume(supplier);
+
+ /*
+ * Move the consumer and all of the devices depending on it to the end
+@@ -389,8 +465,16 @@ static void __device_link_del(struct kref *kref)
+ }
+ #endif /* !CONFIG_SRCU */
+
++static void device_link_put_kref(struct device_link *link)
++{
++ if (link->flags & DL_FLAG_STATELESS)
++ kref_put(&link->kref, __device_link_del);
++ else
++ WARN(1, "Unable to drop a managed device link reference\n");
++}
++
+ /**
+- * device_link_del - Delete a link between two devices.
++ * device_link_del - Delete a stateless link between two devices.
+ * @link: Device link to delete.
+ *
+ * The caller must ensure proper synchronization of this function with runtime
+@@ -402,14 +486,14 @@ void device_link_del(struct device_link *link)
+ {
+ device_links_write_lock();
+ device_pm_lock();
+- kref_put(&link->kref, __device_link_del);
++ device_link_put_kref(link);
+ device_pm_unlock();
+ device_links_write_unlock();
+ }
+ EXPORT_SYMBOL_GPL(device_link_del);
+
+ /**
+- * device_link_remove - remove a link between two devices.
++ * device_link_remove - Delete a stateless link between two devices.
+ * @consumer: Consumer end of the link.
+ * @supplier: Supplier end of the link.
+ *
+@@ -428,7 +512,7 @@ void device_link_remove(void *consumer, struct device *supplier)
+
+ list_for_each_entry(link, &supplier->links.consumers, s_node) {
+ if (link->consumer == consumer) {
+- kref_put(&link->kref, __device_link_del);
++ device_link_put_kref(link);
+ break;
+ }
+ }
+@@ -461,7 +545,7 @@ static void device_links_missing_supplier(struct device *dev)
+ * mark the link as "consumer probe in progress" to make the supplier removal
+ * wait for us to complete (or bad things may happen).
+ *
+- * Links with the DL_FLAG_STATELESS flag set are ignored.
++ * Links without the DL_FLAG_MANAGED flag set are ignored.
+ */
+ int device_links_check_suppliers(struct device *dev)
+ {
+@@ -471,7 +555,7 @@ int device_links_check_suppliers(struct device *dev)
+ device_links_write_lock();
+
+ list_for_each_entry(link, &dev->links.suppliers, c_node) {
+- if (link->flags & DL_FLAG_STATELESS)
++ if (!(link->flags & DL_FLAG_MANAGED))
+ continue;
+
+ if (link->status != DL_STATE_AVAILABLE) {
+@@ -496,7 +580,7 @@ int device_links_check_suppliers(struct device *dev)
+ *
+ * Also change the status of @dev's links to suppliers to "active".
+ *
+- * Links with the DL_FLAG_STATELESS flag set are ignored.
++ * Links without the DL_FLAG_MANAGED flag set are ignored.
+ */
+ void device_links_driver_bound(struct device *dev)
+ {
+@@ -505,15 +589,28 @@ void device_links_driver_bound(struct device *dev)
+ device_links_write_lock();
+
+ list_for_each_entry(link, &dev->links.consumers, s_node) {
+- if (link->flags & DL_FLAG_STATELESS)
++ if (!(link->flags & DL_FLAG_MANAGED))
++ continue;
++
++ /*
++ * Links created during consumer probe may be in the "consumer
++ * probe" state to start with if the supplier is still probing
++ * when they are created and they may become "active" if the
++ * consumer probe returns first. Skip them here.
++ */
++ if (link->status == DL_STATE_CONSUMER_PROBE ||
++ link->status == DL_STATE_ACTIVE)
+ continue;
+
+ WARN_ON(link->status != DL_STATE_DORMANT);
+ WRITE_ONCE(link->status, DL_STATE_AVAILABLE);
++
++ if (link->flags & DL_FLAG_AUTOPROBE_CONSUMER)
++ driver_deferred_probe_add(link->consumer);
+ }
+
+ list_for_each_entry(link, &dev->links.suppliers, c_node) {
+- if (link->flags & DL_FLAG_STATELESS)
++ if (!(link->flags & DL_FLAG_MANAGED))
+ continue;
+
+ WARN_ON(link->status != DL_STATE_CONSUMER_PROBE);
+@@ -525,6 +622,13 @@ void device_links_driver_bound(struct device *dev)
+ device_links_write_unlock();
+ }
+
++static void device_link_drop_managed(struct device_link *link)
++{
++ link->flags &= ~DL_FLAG_MANAGED;
++ WRITE_ONCE(link->status, DL_STATE_NONE);
++ kref_put(&link->kref, __device_link_del);
++}
++
+ /**
+ * __device_links_no_driver - Update links of a device without a driver.
+ * @dev: Device without a drvier.
+@@ -535,29 +639,60 @@ void device_links_driver_bound(struct device *dev)
+ * unless they already are in the "supplier unbind in progress" state in which
+ * case they need not be updated.
+ *
+- * Links with the DL_FLAG_STATELESS flag set are ignored.
++ * Links without the DL_FLAG_MANAGED flag set are ignored.
+ */
+ static void __device_links_no_driver(struct device *dev)
+ {
+ struct device_link *link, *ln;
+
+ list_for_each_entry_safe_reverse(link, ln, &dev->links.suppliers, c_node) {
+- if (link->flags & DL_FLAG_STATELESS)
++ if (!(link->flags & DL_FLAG_MANAGED))
+ continue;
+
+ if (link->flags & DL_FLAG_AUTOREMOVE_CONSUMER)
+- kref_put(&link->kref, __device_link_del);
+- else if (link->status != DL_STATE_SUPPLIER_UNBIND)
++ device_link_drop_managed(link);
++ else if (link->status == DL_STATE_CONSUMER_PROBE ||
++ link->status == DL_STATE_ACTIVE)
+ WRITE_ONCE(link->status, DL_STATE_AVAILABLE);
+ }
+
+ dev->links.status = DL_DEV_NO_DRIVER;
+ }
+
++/**
++ * device_links_no_driver - Update links after failing driver probe.
++ * @dev: Device whose driver has just failed to probe.
++ *
++ * Clean up leftover links to consumers for @dev and invoke
++ * %__device_links_no_driver() to update links to suppliers for it as
++ * appropriate.
++ *
++ * Links without the DL_FLAG_MANAGED flag set are ignored.
++ */
+ void device_links_no_driver(struct device *dev)
+ {
++ struct device_link *link;
++
+ device_links_write_lock();
++
++ list_for_each_entry(link, &dev->links.consumers, s_node) {
++ if (!(link->flags & DL_FLAG_MANAGED))
++ continue;
++
++ /*
++ * The probe has failed, so if the status of the link is
++ * "consumer probe" or "active", it must have been added by
++ * a probing consumer while this device was still probing.
++ * Change its state to "dormant", as it represents a valid
++ * relationship, but it is not functionally meaningful.
++ */
++ if (link->status == DL_STATE_CONSUMER_PROBE ||
++ link->status == DL_STATE_ACTIVE)
++ WRITE_ONCE(link->status, DL_STATE_DORMANT);
++ }
++
+ __device_links_no_driver(dev);
++
+ device_links_write_unlock();
+ }
+
+@@ -569,7 +704,7 @@ void device_links_no_driver(struct device *dev)
+ * invoke %__device_links_no_driver() to update links to suppliers for it as
+ * appropriate.
+ *
+- * Links with the DL_FLAG_STATELESS flag set are ignored.
++ * Links without the DL_FLAG_MANAGED flag set are ignored.
+ */
+ void device_links_driver_cleanup(struct device *dev)
+ {
+@@ -578,7 +713,7 @@ void device_links_driver_cleanup(struct device *dev)
+ device_links_write_lock();
+
+ list_for_each_entry_safe(link, ln, &dev->links.consumers, s_node) {
+- if (link->flags & DL_FLAG_STATELESS)
++ if (!(link->flags & DL_FLAG_MANAGED))
+ continue;
+
+ WARN_ON(link->flags & DL_FLAG_AUTOREMOVE_CONSUMER);
+@@ -591,7 +726,7 @@ void device_links_driver_cleanup(struct device *dev)
+ */
+ if (link->status == DL_STATE_SUPPLIER_UNBIND &&
+ link->flags & DL_FLAG_AUTOREMOVE_SUPPLIER)
+- kref_put(&link->kref, __device_link_del);
++ device_link_drop_managed(link);
+
+ WRITE_ONCE(link->status, DL_STATE_DORMANT);
+ }
+@@ -613,7 +748,7 @@ void device_links_driver_cleanup(struct device *dev)
+ *
+ * Return 'false' if there are no probing or active consumers.
+ *
+- * Links with the DL_FLAG_STATELESS flag set are ignored.
++ * Links without the DL_FLAG_MANAGED flag set are ignored.
+ */
+ bool device_links_busy(struct device *dev)
+ {
+@@ -623,7 +758,7 @@ bool device_links_busy(struct device *dev)
+ device_links_write_lock();
+
+ list_for_each_entry(link, &dev->links.consumers, s_node) {
+- if (link->flags & DL_FLAG_STATELESS)
++ if (!(link->flags & DL_FLAG_MANAGED))
+ continue;
+
+ if (link->status == DL_STATE_CONSUMER_PROBE
+@@ -653,7 +788,7 @@ bool device_links_busy(struct device *dev)
+ * driver to unbind and start over (the consumer will not re-probe as we have
+ * changed the state of the link already).
+ *
+- * Links with the DL_FLAG_STATELESS flag set are ignored.
++ * Links without the DL_FLAG_MANAGED flag set are ignored.
+ */
+ void device_links_unbind_consumers(struct device *dev)
+ {
+@@ -665,7 +800,7 @@ void device_links_unbind_consumers(struct device *dev)
+ list_for_each_entry(link, &dev->links.consumers, s_node) {
+ enum device_link_state status;
+
+- if (link->flags & DL_FLAG_STATELESS)
++ if (!(link->flags & DL_FLAG_MANAGED))
+ continue;
+
+ status = link->status;
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 5f6416e6ba96..caaeb7910a04 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -116,7 +116,7 @@ static void deferred_probe_work_func(struct work_struct *work)
+ }
+ static DECLARE_WORK(deferred_probe_work, deferred_probe_work_func);
+
+-static void driver_deferred_probe_add(struct device *dev)
++void driver_deferred_probe_add(struct device *dev)
+ {
+ mutex_lock(&deferred_probe_mutex);
+ if (list_empty(&dev->p->deferred_probe)) {
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 303ce7d54a30..2c99f93020bc 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1531,7 +1531,7 @@ void pm_runtime_remove(struct device *dev)
+ * runtime PM references to the device, drop the usage counter of the device
+ * (as many times as needed).
+ *
+- * Links with the DL_FLAG_STATELESS flag set are ignored.
++ * Links with the DL_FLAG_MANAGED flag unset are ignored.
+ *
+ * Since the device is guaranteed to be runtime-active at the point this is
+ * called, nothing else needs to be done here.
+@@ -1548,7 +1548,7 @@ void pm_runtime_clean_up_links(struct device *dev)
+ idx = device_links_read_lock();
+
+ list_for_each_entry_rcu(link, &dev->links.consumers, s_node) {
+- if (link->flags & DL_FLAG_STATELESS)
++ if (!(link->flags & DL_FLAG_MANAGED))
+ continue;
+
+ while (refcount_dec_not_one(&link->rpm_active))
+diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
+index 92e519d58618..b31e3d3729a6 100644
+--- a/drivers/firmware/efi/runtime-wrappers.c
++++ b/drivers/firmware/efi/runtime-wrappers.c
+@@ -62,7 +62,7 @@ struct efi_runtime_work efi_rts_work;
+ efi_rts_work.status = EFI_ABORTED; \
+ \
+ init_completion(&efi_rts_work.efi_rts_comp); \
+- INIT_WORK_ONSTACK(&efi_rts_work.work, efi_call_rts); \
++ INIT_WORK(&efi_rts_work.work, efi_call_rts); \
+ efi_rts_work.arg1 = _arg1; \
+ efi_rts_work.arg2 = _arg2; \
+ efi_rts_work.arg3 = _arg3; \
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index d0a81a03ddbd..8ab8f2350bbc 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -343,7 +343,8 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ unsigned long **bit, int *max)
+ {
+ if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
+- usage->hid == (HID_UP_MSVENDOR | 0x0003)) {
++ usage->hid == (HID_UP_MSVENDOR | 0x0003) ||
++ usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) {
+ /* The fn key on Apple USB keyboards */
+ set_bit(EV_REP, hi->input->evbit);
+ hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
+diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c
+index 8cb63ea9977d..fab8fd7082e0 100644
+--- a/drivers/hid/hid-google-hammer.c
++++ b/drivers/hid/hid-google-hammer.c
+@@ -124,6 +124,8 @@ static const struct hid_device_id hammer_devices[] = {
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MAGNEMITE) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MASTERBALL) },
++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MOONBALL) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_STAFF) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index f491092f36ff..b2fff44c8109 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -468,6 +468,7 @@
+ #define USB_DEVICE_ID_GOOGLE_WHISKERS 0x5030
+ #define USB_DEVICE_ID_GOOGLE_MASTERBALL 0x503c
+ #define USB_DEVICE_ID_GOOGLE_MAGNEMITE 0x503d
++#define USB_DEVICE_ID_GOOGLE_MOONBALL 0x5044
+
+ #define USB_VENDOR_ID_GOTOP 0x08f2
+ #define USB_DEVICE_ID_SUPER_Q2 0x007f
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index 10af8585c820..95052373a828 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -341,6 +341,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ .ident = "Trekstor SURFBOOK E11B",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TREKSTOR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SURFBOOK E11B"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ {
+ .ident = "Direkt-Tek DTLAPY116-2",
+ .matches = {
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index 694d0828215d..b7f809aa40c2 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -935,6 +935,8 @@ config MMC_SDHCI_XENON
+ config MMC_SDHCI_OMAP
+ tristate "TI SDHCI Controller Support"
+ depends on MMC_SDHCI_PLTFM && OF
++ select THERMAL
++ imply TI_SOC_THERMAL
+ help
+ This selects the Secure Digital Host Controller Interface (SDHCI)
+ support present in TI's DRA7 SOCs. The controller supports
+diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
+index d02f5cf76b3d..e9793d8e83a0 100644
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -27,6 +27,7 @@
+ #include <linux/regulator/consumer.h>
+ #include <linux/pinctrl/consumer.h>
+ #include <linux/sys_soc.h>
++#include <linux/thermal.h>
+
+ #include "sdhci-pltfm.h"
+
+@@ -115,6 +116,7 @@ struct sdhci_omap_host {
+
+ struct pinctrl *pinctrl;
+ struct pinctrl_state **pinctrl_state;
++ bool is_tuning;
+ };
+
+ static void sdhci_omap_start_clock(struct sdhci_omap_host *omap_host);
+@@ -289,15 +291,19 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ struct sdhci_host *host = mmc_priv(mmc);
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host);
++ struct thermal_zone_device *thermal_dev;
+ struct device *dev = omap_host->dev;
+ struct mmc_ios *ios = &mmc->ios;
+ u32 start_window = 0, max_window = 0;
++ bool single_point_failure = false;
+ bool dcrc_was_enabled = false;
+ u8 cur_match, prev_match = 0;
+ u32 length = 0, max_len = 0;
+ u32 phase_delay = 0;
++ int temperature;
+ int ret = 0;
+ u32 reg;
++ int i;
+
+ pltfm_host = sdhci_priv(host);
+ omap_host = sdhci_pltfm_priv(pltfm_host);
+@@ -311,6 +317,16 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ if (ios->timing == MMC_TIMING_UHS_SDR50 && !(reg & CAPA2_TSDR50))
+ return 0;
+
++ thermal_dev = thermal_zone_get_zone_by_name("cpu_thermal");
++ if (IS_ERR(thermal_dev)) {
++ dev_err(dev, "Unable to get thermal zone for tuning\n");
++ return PTR_ERR(thermal_dev);
++ }
++
++ ret = thermal_zone_get_temp(thermal_dev, &temperature);
++ if (ret)
++ return ret;
++
+ reg = sdhci_omap_readl(omap_host, SDHCI_OMAP_DLL);
+ reg |= DLL_SWT;
+ sdhci_omap_writel(omap_host, SDHCI_OMAP_DLL, reg);
+@@ -326,6 +342,13 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ dcrc_was_enabled = true;
+ }
+
++ omap_host->is_tuning = true;
++
++ /*
++ * Stage 1: Search for a maximum pass window ignoring any
++ * any single point failures. If the tuning value ends up
++ * near it, move away from it in stage 2 below
++ */
+ while (phase_delay <= MAX_PHASE_DELAY) {
+ sdhci_omap_set_dll(omap_host, phase_delay);
+
+@@ -333,10 +356,15 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ if (cur_match) {
+ if (prev_match) {
+ length++;
++ } else if (single_point_failure) {
++ /* ignore single point failure */
++ length++;
+ } else {
+ start_window = phase_delay;
+ length = 1;
+ }
++ } else {
++ single_point_failure = prev_match;
+ }
+
+ if (length > max_len) {
+@@ -354,18 +382,84 @@ static int sdhci_omap_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ goto tuning_error;
+ }
+
++ /*
++ * Assign tuning value as a ratio of maximum pass window based
++ * on temperature
++ */
++ if (temperature < -20000)
++ phase_delay = min(max_window + 4 * (max_len - 1) - 24,
++ max_window +
++ DIV_ROUND_UP(13 * max_len, 16) * 4);
++ else if (temperature < 20000)
++ phase_delay = max_window + DIV_ROUND_UP(9 * max_len, 16) * 4;
++ else if (temperature < 40000)
++ phase_delay = max_window + DIV_ROUND_UP(8 * max_len, 16) * 4;
++ else if (temperature < 70000)
++ phase_delay = max_window + DIV_ROUND_UP(7 * max_len, 16) * 4;
++ else if (temperature < 90000)
++ phase_delay = max_window + DIV_ROUND_UP(5 * max_len, 16) * 4;
++ else if (temperature < 120000)
++ phase_delay = max_window + DIV_ROUND_UP(4 * max_len, 16) * 4;
++ else
++ phase_delay = max_window + DIV_ROUND_UP(3 * max_len, 16) * 4;
++
++ /*
++ * Stage 2: Search for a single point failure near the chosen tuning
++ * value in two steps. First in the +3 to +10 range and then in the
++ * +2 to -10 range. If found, move away from it in the appropriate
++ * direction by the appropriate amount depending on the temperature.
++ */
++ for (i = 3; i <= 10; i++) {
++ sdhci_omap_set_dll(omap_host, phase_delay + i);
++
++ if (mmc_send_tuning(mmc, opcode, NULL)) {
++ if (temperature < 10000)
++ phase_delay += i + 6;
++ else if (temperature < 20000)
++ phase_delay += i - 12;
++ else if (temperature < 70000)
++ phase_delay += i - 8;
++ else
++ phase_delay += i - 6;
++
++ goto single_failure_found;
++ }
++ }
++
++ for (i = 2; i >= -10; i--) {
++ sdhci_omap_set_dll(omap_host, phase_delay + i);
++
++ if (mmc_send_tuning(mmc, opcode, NULL)) {
++ if (temperature < 10000)
++ phase_delay += i + 12;
++ else if (temperature < 20000)
++ phase_delay += i + 8;
++ else if (temperature < 70000)
++ phase_delay += i + 8;
++ else if (temperature < 90000)
++ phase_delay += i + 10;
++ else
++ phase_delay += i + 12;
++
++ goto single_failure_found;
++ }
++ }
++
++single_failure_found:
+ reg = sdhci_omap_readl(omap_host, SDHCI_OMAP_AC12);
+ if (!(reg & AC12_SCLK_SEL)) {
+ ret = -EIO;
+ goto tuning_error;
+ }
+
+- phase_delay = max_window + 4 * (max_len >> 1);
+ sdhci_omap_set_dll(omap_host, phase_delay);
+
++ omap_host->is_tuning = false;
++
+ goto ret;
+
+ tuning_error:
++ omap_host->is_tuning = false;
+ dev_err(dev, "Tuning failed\n");
+ sdhci_omap_disable_tuning(omap_host);
+
+@@ -695,6 +789,55 @@ static void sdhci_omap_set_uhs_signaling(struct sdhci_host *host,
+ sdhci_omap_start_clock(omap_host);
+ }
+
++void sdhci_omap_reset(struct sdhci_host *host, u8 mask)
++{
++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++ struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host);
++
++ /* Don't reset data lines during tuning operation */
++ if (omap_host->is_tuning)
++ mask &= ~SDHCI_RESET_DATA;
++
++ sdhci_reset(host, mask);
++}
++
++#define CMD_ERR_MASK (SDHCI_INT_CRC | SDHCI_INT_END_BIT | SDHCI_INT_INDEX |\
++ SDHCI_INT_TIMEOUT)
++#define CMD_MASK (CMD_ERR_MASK | SDHCI_INT_RESPONSE)
++
++static u32 sdhci_omap_irq(struct sdhci_host *host, u32 intmask)
++{
++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++ struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host);
++
++ if (omap_host->is_tuning && host->cmd && !host->data_early &&
++ (intmask & CMD_ERR_MASK)) {
++
++ /*
++ * Since we are not resetting data lines during tuning
++ * operation, data error or data complete interrupts
++ * might still arrive. Mark this request as a failure
++ * but still wait for the data interrupt
++ */
++ if (intmask & SDHCI_INT_TIMEOUT)
++ host->cmd->error = -ETIMEDOUT;
++ else
++ host->cmd->error = -EILSEQ;
++
++ host->cmd = NULL;
++
++ /*
++ * Sometimes command error interrupts and command complete
++ * interrupt will arrive together. Clear all command related
++ * interrupts here.
++ */
++ sdhci_writel(host, intmask & CMD_MASK, SDHCI_INT_STATUS);
++ intmask &= ~CMD_MASK;
++ }
++
++ return intmask;
++}
++
+ static struct sdhci_ops sdhci_omap_ops = {
+ .set_clock = sdhci_omap_set_clock,
+ .set_power = sdhci_omap_set_power,
+@@ -703,8 +846,9 @@ static struct sdhci_ops sdhci_omap_ops = {
+ .get_min_clock = sdhci_omap_get_min_clock,
+ .set_bus_width = sdhci_omap_set_bus_width,
+ .platform_send_init_74_clocks = sdhci_omap_init_74_clocks,
+- .reset = sdhci_reset,
++ .reset = sdhci_omap_reset,
+ .set_uhs_signaling = sdhci_omap_set_uhs_signaling,
++ .irq = sdhci_omap_irq,
+ };
+
+ static int sdhci_omap_set_capabilities(struct sdhci_omap_host *omap_host)
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c
+index 6b19607a4caa..9deec13d98e9 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c
+@@ -309,6 +309,7 @@ static int set_hw_ioctxt(struct hinic_hwdev *hwdev, unsigned int rq_depth,
+ }
+
+ hw_ioctxt.func_idx = HINIC_HWIF_FUNC_IDX(hwif);
++ hw_ioctxt.ppf_idx = HINIC_HWIF_PPF_IDX(hwif);
+
+ hw_ioctxt.set_cmdq_depth = HW_IOCTXT_SET_CMDQ_DEPTH_DEFAULT;
+ hw_ioctxt.cmdq_depth = 0;
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h
+index 0f5563f3b779..a011fd2d2627 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h
++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h
+@@ -104,8 +104,8 @@ struct hinic_cmd_hw_ioctxt {
+
+ u8 rsvd2;
+ u8 rsvd3;
++ u8 ppf_idx;
+ u8 rsvd4;
+- u8 rsvd5;
+
+ u16 rq_depth;
+ u16 rx_buf_sz_idx;
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h b/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h
+index 5b4760c0e9f5..f683ccbdfca0 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h
++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_if.h
+@@ -146,6 +146,7 @@
+ #define HINIC_HWIF_FUNC_IDX(hwif) ((hwif)->attr.func_idx)
+ #define HINIC_HWIF_PCI_INTF(hwif) ((hwif)->attr.pci_intf_idx)
+ #define HINIC_HWIF_PF_IDX(hwif) ((hwif)->attr.pf_idx)
++#define HINIC_HWIF_PPF_IDX(hwif) ((hwif)->attr.ppf_idx)
+
+ #define HINIC_FUNC_TYPE(hwif) ((hwif)->attr.func_type)
+ #define HINIC_IS_PF(hwif) (HINIC_FUNC_TYPE(hwif) == HINIC_PF)
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_qp.h b/drivers/net/ethernet/huawei/hinic/hinic_hw_qp.h
+index 6c84f83ec283..d46cfd4fbbbc 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_qp.h
++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_qp.h
+@@ -103,6 +103,7 @@ struct hinic_rq {
+
+ struct hinic_wq *wq;
+
++ struct cpumask affinity_mask;
+ u32 irq;
+ u16 msix_entry;
+
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_rx.c b/drivers/net/ethernet/huawei/hinic/hinic_rx.c
+index 06b24a92ed7d..3467d84d96c3 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_rx.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_rx.c
+@@ -414,7 +414,6 @@ static int rx_request_irq(struct hinic_rxq *rxq)
+ struct hinic_hwdev *hwdev = nic_dev->hwdev;
+ struct hinic_rq *rq = rxq->rq;
+ struct hinic_qp *qp;
+- struct cpumask mask;
+ int err;
+
+ rx_add_napi(rxq);
+@@ -431,8 +430,8 @@ static int rx_request_irq(struct hinic_rxq *rxq)
+ }
+
+ qp = container_of(rq, struct hinic_qp, rq);
+- cpumask_set_cpu(qp->q_id % num_online_cpus(), &mask);
+- return irq_set_affinity_hint(rq->irq, &mask);
++ cpumask_set_cpu(qp->q_id % num_online_cpus(), &rq->affinity_mask);
++ return irq_set_affinity_hint(rq->irq, &rq->affinity_mask);
+ }
+
+ static void rx_free_irq(struct hinic_rxq *rxq)
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index 9de59facec21..a5525bf977e2 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -832,14 +832,17 @@ static irqreturn_t ks_irq(int irq, void *pw)
+ {
+ struct net_device *netdev = pw;
+ struct ks_net *ks = netdev_priv(netdev);
++ unsigned long flags;
+ u16 status;
+
++ spin_lock_irqsave(&ks->statelock, flags);
+ /*this should be the first in IRQ handler */
+ ks_save_cmd_reg(ks);
+
+ status = ks_rdreg16(ks, KS_ISR);
+ if (unlikely(!status)) {
+ ks_restore_cmd_reg(ks);
++ spin_unlock_irqrestore(&ks->statelock, flags);
+ return IRQ_NONE;
+ }
+
+@@ -865,6 +868,7 @@ static irqreturn_t ks_irq(int irq, void *pw)
+ ks->netdev->stats.rx_over_errors++;
+ /* this should be the last in IRQ handler*/
+ ks_restore_cmd_reg(ks);
++ spin_unlock_irqrestore(&ks->statelock, flags);
+ return IRQ_HANDLED;
+ }
+
+@@ -934,6 +938,7 @@ static int ks_net_stop(struct net_device *netdev)
+
+ /* shutdown RX/TX QMU */
+ ks_disable_qmu(ks);
++ ks_disable_int(ks);
+
+ /* set powermode to soft power down to save power */
+ ks_set_powermode(ks, PMECR_PM_SOFTDOWN);
+@@ -990,10 +995,9 @@ static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ netdev_tx_t retv = NETDEV_TX_OK;
+ struct ks_net *ks = netdev_priv(netdev);
++ unsigned long flags;
+
+- disable_irq(netdev->irq);
+- ks_disable_int(ks);
+- spin_lock(&ks->statelock);
++ spin_lock_irqsave(&ks->statelock, flags);
+
+ /* Extra space are required:
+ * 4 byte for alignment, 4 for status/length, 4 for CRC
+@@ -1007,9 +1011,7 @@ static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+ dev_kfree_skb(skb);
+ } else
+ retv = NETDEV_TX_BUSY;
+- spin_unlock(&ks->statelock);
+- ks_enable_int(ks);
+- enable_irq(netdev->irq);
++ spin_unlock_irqrestore(&ks->statelock, flags);
+ return retv;
+ }
+
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+index 4c476fac7835..37786affa975 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+@@ -22,25 +22,6 @@
+ #include "rmnet_vnd.h"
+ #include "rmnet_private.h"
+
+-/* Locking scheme -
+- * The shared resource which needs to be protected is realdev->rx_handler_data.
+- * For the writer path, this is using rtnl_lock(). The writer paths are
+- * rmnet_newlink(), rmnet_dellink() and rmnet_force_unassociate_device(). These
+- * paths are already called with rtnl_lock() acquired in. There is also an
+- * ASSERT_RTNL() to ensure that we are calling with rtnl acquired. For
+- * dereference here, we will need to use rtnl_dereference(). Dev list writing
+- * needs to happen with rtnl_lock() acquired for netdev_master_upper_dev_link().
+- * For the reader path, the real_dev->rx_handler_data is called in the TX / RX
+- * path. We only need rcu_read_lock() for these scenarios. In these cases,
+- * the rcu_read_lock() is held in __dev_queue_xmit() and
+- * netif_receive_skb_internal(), so readers need to use rcu_dereference_rtnl()
+- * to get the relevant information. For dev list reading, we again acquire
+- * rcu_read_lock() in rmnet_dellink() for netdev_master_upper_dev_get_rcu().
+- * We also use unregister_netdevice_many() to free all rmnet devices in
+- * rmnet_force_unassociate_device() so we dont lose the rtnl_lock() and free in
+- * same context.
+- */
+-
+ /* Local Definitions and Declarations */
+
+ static const struct nla_policy rmnet_policy[IFLA_RMNET_MAX + 1] = {
+@@ -60,9 +41,10 @@ rmnet_get_port_rtnl(const struct net_device *real_dev)
+ return rtnl_dereference(real_dev->rx_handler_data);
+ }
+
+-static int rmnet_unregister_real_device(struct net_device *real_dev,
+- struct rmnet_port *port)
++static int rmnet_unregister_real_device(struct net_device *real_dev)
+ {
++ struct rmnet_port *port = rmnet_get_port_rtnl(real_dev);
++
+ if (port->nr_rmnet_devs)
+ return -EINVAL;
+
+@@ -70,9 +52,6 @@ static int rmnet_unregister_real_device(struct net_device *real_dev,
+
+ kfree(port);
+
+- /* release reference on real_dev */
+- dev_put(real_dev);
+-
+ netdev_dbg(real_dev, "Removed from rmnet\n");
+ return 0;
+ }
+@@ -98,9 +77,6 @@ static int rmnet_register_real_device(struct net_device *real_dev)
+ return -EBUSY;
+ }
+
+- /* hold on to real dev for MAP data */
+- dev_hold(real_dev);
+-
+ for (entry = 0; entry < RMNET_MAX_LOGICAL_EP; entry++)
+ INIT_HLIST_HEAD(&port->muxed_ep[entry]);
+
+@@ -108,28 +84,33 @@ static int rmnet_register_real_device(struct net_device *real_dev)
+ return 0;
+ }
+
+-static void rmnet_unregister_bridge(struct net_device *dev,
+- struct rmnet_port *port)
++static void rmnet_unregister_bridge(struct rmnet_port *port)
+ {
+- struct rmnet_port *bridge_port;
+- struct net_device *bridge_dev;
++ struct net_device *bridge_dev, *real_dev, *rmnet_dev;
++ struct rmnet_port *real_port;
+
+ if (port->rmnet_mode != RMNET_EPMODE_BRIDGE)
+ return;
+
+- /* bridge slave handling */
++ rmnet_dev = port->rmnet_dev;
+ if (!port->nr_rmnet_devs) {
+- bridge_dev = port->bridge_ep;
++ /* bridge device */
++ real_dev = port->bridge_ep;
++ bridge_dev = port->dev;
+
+- bridge_port = rmnet_get_port_rtnl(bridge_dev);
+- bridge_port->bridge_ep = NULL;
+- bridge_port->rmnet_mode = RMNET_EPMODE_VND;
++ real_port = rmnet_get_port_rtnl(real_dev);
++ real_port->bridge_ep = NULL;
++ real_port->rmnet_mode = RMNET_EPMODE_VND;
+ } else {
++ /* real device */
+ bridge_dev = port->bridge_ep;
+
+- bridge_port = rmnet_get_port_rtnl(bridge_dev);
+- rmnet_unregister_real_device(bridge_dev, bridge_port);
++ port->bridge_ep = NULL;
++ port->rmnet_mode = RMNET_EPMODE_VND;
+ }
++
++ netdev_upper_dev_unlink(bridge_dev, rmnet_dev);
++ rmnet_unregister_real_device(bridge_dev);
+ }
+
+ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
+@@ -144,6 +125,11 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
+ int err = 0;
+ u16 mux_id;
+
++ if (!tb[IFLA_LINK]) {
++ NL_SET_ERR_MSG_MOD(extack, "link not specified");
++ return -EINVAL;
++ }
++
+ real_dev = __dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
+ if (!real_dev || !dev)
+ return -ENODEV;
+@@ -166,7 +152,12 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
+ if (err)
+ goto err1;
+
++ err = netdev_upper_dev_link(real_dev, dev, extack);
++ if (err < 0)
++ goto err2;
++
+ port->rmnet_mode = mode;
++ port->rmnet_dev = dev;
+
+ hlist_add_head_rcu(&ep->hlnode, &port->muxed_ep[mux_id]);
+
+@@ -182,8 +173,11 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
+
+ return 0;
+
++err2:
++ unregister_netdevice(dev);
++ rmnet_vnd_dellink(mux_id, port, ep);
+ err1:
+- rmnet_unregister_real_device(real_dev, port);
++ rmnet_unregister_real_device(real_dev);
+ err0:
+ kfree(ep);
+ return err;
+@@ -192,77 +186,74 @@ err0:
+ static void rmnet_dellink(struct net_device *dev, struct list_head *head)
+ {
+ struct rmnet_priv *priv = netdev_priv(dev);
+- struct net_device *real_dev;
++ struct net_device *real_dev, *bridge_dev;
++ struct rmnet_port *real_port, *bridge_port;
+ struct rmnet_endpoint *ep;
+- struct rmnet_port *port;
+- u8 mux_id;
++ u8 mux_id = priv->mux_id;
+
+ real_dev = priv->real_dev;
+
+- if (!real_dev || !rmnet_is_real_dev_registered(real_dev))
++ if (!rmnet_is_real_dev_registered(real_dev))
+ return;
+
+- port = rmnet_get_port_rtnl(real_dev);
+-
+- mux_id = rmnet_vnd_get_mux(dev);
++ real_port = rmnet_get_port_rtnl(real_dev);
++ bridge_dev = real_port->bridge_ep;
++ if (bridge_dev) {
++ bridge_port = rmnet_get_port_rtnl(bridge_dev);
++ rmnet_unregister_bridge(bridge_port);
++ }
+
+- ep = rmnet_get_endpoint(port, mux_id);
++ ep = rmnet_get_endpoint(real_port, mux_id);
+ if (ep) {
+ hlist_del_init_rcu(&ep->hlnode);
+- rmnet_unregister_bridge(dev, port);
+- rmnet_vnd_dellink(mux_id, port, ep);
++ rmnet_vnd_dellink(mux_id, real_port, ep);
+ kfree(ep);
+ }
+- rmnet_unregister_real_device(real_dev, port);
+
++ netdev_upper_dev_unlink(real_dev, dev);
++ rmnet_unregister_real_device(real_dev);
+ unregister_netdevice_queue(dev, head);
+ }
+
+-static void rmnet_force_unassociate_device(struct net_device *dev)
++static void rmnet_force_unassociate_device(struct net_device *real_dev)
+ {
+- struct net_device *real_dev = dev;
+ struct hlist_node *tmp_ep;
+ struct rmnet_endpoint *ep;
+ struct rmnet_port *port;
+ unsigned long bkt_ep;
+ LIST_HEAD(list);
+
+- if (!rmnet_is_real_dev_registered(real_dev))
+- return;
+-
+- ASSERT_RTNL();
+-
+- port = rmnet_get_port_rtnl(dev);
+-
+- rcu_read_lock();
+- rmnet_unregister_bridge(dev, port);
+-
+- hash_for_each_safe(port->muxed_ep, bkt_ep, tmp_ep, ep, hlnode) {
+- unregister_netdevice_queue(ep->egress_dev, &list);
+- rmnet_vnd_dellink(ep->mux_id, port, ep);
++ port = rmnet_get_port_rtnl(real_dev);
+
+- hlist_del_init_rcu(&ep->hlnode);
+- kfree(ep);
++ if (port->nr_rmnet_devs) {
++ /* real device */
++ rmnet_unregister_bridge(port);
++ hash_for_each_safe(port->muxed_ep, bkt_ep, tmp_ep, ep, hlnode) {
++ unregister_netdevice_queue(ep->egress_dev, &list);
++ netdev_upper_dev_unlink(real_dev, ep->egress_dev);
++ rmnet_vnd_dellink(ep->mux_id, port, ep);
++ hlist_del_init_rcu(&ep->hlnode);
++ kfree(ep);
++ }
++ rmnet_unregister_real_device(real_dev);
++ unregister_netdevice_many(&list);
++ } else {
++ rmnet_unregister_bridge(port);
+ }
+-
+- rcu_read_unlock();
+- unregister_netdevice_many(&list);
+-
+- rmnet_unregister_real_device(real_dev, port);
+ }
+
+ static int rmnet_config_notify_cb(struct notifier_block *nb,
+ unsigned long event, void *data)
+ {
+- struct net_device *dev = netdev_notifier_info_to_dev(data);
++ struct net_device *real_dev = netdev_notifier_info_to_dev(data);
+
+- if (!dev)
++ if (!rmnet_is_real_dev_registered(real_dev))
+ return NOTIFY_DONE;
+
+ switch (event) {
+ case NETDEV_UNREGISTER:
+- netdev_dbg(dev, "Kernel unregister\n");
+- rmnet_force_unassociate_device(dev);
++ netdev_dbg(real_dev, "Kernel unregister\n");
++ rmnet_force_unassociate_device(real_dev);
+ break;
+
+ default:
+@@ -304,16 +295,18 @@ static int rmnet_changelink(struct net_device *dev, struct nlattr *tb[],
+ if (!dev)
+ return -ENODEV;
+
+- real_dev = __dev_get_by_index(dev_net(dev),
+- nla_get_u32(tb[IFLA_LINK]));
+-
+- if (!real_dev || !rmnet_is_real_dev_registered(real_dev))
++ real_dev = priv->real_dev;
++ if (!rmnet_is_real_dev_registered(real_dev))
+ return -ENODEV;
+
+ port = rmnet_get_port_rtnl(real_dev);
+
+ if (data[IFLA_RMNET_MUX_ID]) {
+ mux_id = nla_get_u16(data[IFLA_RMNET_MUX_ID]);
++ if (rmnet_get_endpoint(port, mux_id)) {
++ NL_SET_ERR_MSG_MOD(extack, "MUX ID already exists");
++ return -EINVAL;
++ }
+ ep = rmnet_get_endpoint(port, priv->mux_id);
+ if (!ep)
+ return -ENODEV;
+@@ -388,11 +381,10 @@ struct rtnl_link_ops rmnet_link_ops __read_mostly = {
+ .fill_info = rmnet_fill_info,
+ };
+
+-/* Needs either rcu_read_lock() or rtnl lock */
+-struct rmnet_port *rmnet_get_port(struct net_device *real_dev)
++struct rmnet_port *rmnet_get_port_rcu(struct net_device *real_dev)
+ {
+ if (rmnet_is_real_dev_registered(real_dev))
+- return rcu_dereference_rtnl(real_dev->rx_handler_data);
++ return rcu_dereference_bh(real_dev->rx_handler_data);
+ else
+ return NULL;
+ }
+@@ -418,7 +410,7 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
+ struct rmnet_port *port, *slave_port;
+ int err;
+
+- port = rmnet_get_port(real_dev);
++ port = rmnet_get_port_rtnl(real_dev);
+
+ /* If there is more than one rmnet dev attached, its probably being
+ * used for muxing. Skip the briding in that case
+@@ -426,6 +418,9 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
+ if (port->nr_rmnet_devs > 1)
+ return -EINVAL;
+
++ if (port->rmnet_mode != RMNET_EPMODE_VND)
++ return -EINVAL;
++
+ if (rmnet_is_real_dev_registered(slave_dev))
+ return -EBUSY;
+
+@@ -433,9 +428,17 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
+ if (err)
+ return -EBUSY;
+
+- slave_port = rmnet_get_port(slave_dev);
++ err = netdev_master_upper_dev_link(slave_dev, rmnet_dev, NULL, NULL,
++ extack);
++ if (err) {
++ rmnet_unregister_real_device(slave_dev);
++ return err;
++ }
++
++ slave_port = rmnet_get_port_rtnl(slave_dev);
+ slave_port->rmnet_mode = RMNET_EPMODE_BRIDGE;
+ slave_port->bridge_ep = real_dev;
++ slave_port->rmnet_dev = rmnet_dev;
+
+ port->rmnet_mode = RMNET_EPMODE_BRIDGE;
+ port->bridge_ep = slave_dev;
+@@ -447,16 +450,9 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
+ int rmnet_del_bridge(struct net_device *rmnet_dev,
+ struct net_device *slave_dev)
+ {
+- struct rmnet_priv *priv = netdev_priv(rmnet_dev);
+- struct net_device *real_dev = priv->real_dev;
+- struct rmnet_port *port, *slave_port;
++ struct rmnet_port *port = rmnet_get_port_rtnl(slave_dev);
+
+- port = rmnet_get_port(real_dev);
+- port->rmnet_mode = RMNET_EPMODE_VND;
+- port->bridge_ep = NULL;
+-
+- slave_port = rmnet_get_port(slave_dev);
+- rmnet_unregister_real_device(slave_dev, slave_port);
++ rmnet_unregister_bridge(port);
+
+ netdev_dbg(slave_dev, "removed from rmnet as slave\n");
+ return 0;
+@@ -482,8 +478,8 @@ static int __init rmnet_init(void)
+
+ static void __exit rmnet_exit(void)
+ {
+- unregister_netdevice_notifier(&rmnet_dev_notifier);
+ rtnl_link_unregister(&rmnet_link_ops);
++ unregister_netdevice_notifier(&rmnet_dev_notifier);
+ }
+
+ module_init(rmnet_init)
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
+index 34ac45a774e7..7691d1abe6e2 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
+@@ -37,6 +37,7 @@ struct rmnet_port {
+ u8 rmnet_mode;
+ struct hlist_head muxed_ep[RMNET_MAX_LOGICAL_EP];
+ struct net_device *bridge_ep;
++ struct net_device *rmnet_dev;
+ };
+
+ extern struct rtnl_link_ops rmnet_link_ops;
+@@ -74,7 +75,7 @@ struct rmnet_priv {
+ struct rmnet_priv_stats stats;
+ };
+
+-struct rmnet_port *rmnet_get_port(struct net_device *real_dev);
++struct rmnet_port *rmnet_get_port_rcu(struct net_device *real_dev);
+ struct rmnet_endpoint *rmnet_get_endpoint(struct rmnet_port *port, u8 mux_id);
+ int rmnet_add_bridge(struct net_device *rmnet_dev,
+ struct net_device *slave_dev,
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+index 11167abe5934..c9d43bad1e2f 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+@@ -168,6 +168,9 @@ static int rmnet_map_egress_handler(struct sk_buff *skb,
+ static void
+ rmnet_bridge_handler(struct sk_buff *skb, struct net_device *bridge_dev)
+ {
++ if (skb_mac_header_was_set(skb))
++ skb_push(skb, skb->mac_len);
++
+ if (bridge_dev) {
+ skb->dev = bridge_dev;
+ dev_queue_xmit(skb);
+@@ -193,7 +196,7 @@ rx_handler_result_t rmnet_rx_handler(struct sk_buff **pskb)
+ return RX_HANDLER_PASS;
+
+ dev = skb->dev;
+- port = rmnet_get_port(dev);
++ port = rmnet_get_port_rcu(dev);
+
+ switch (port->rmnet_mode) {
+ case RMNET_EPMODE_VND:
+@@ -226,7 +229,7 @@ void rmnet_egress_handler(struct sk_buff *skb)
+ skb->dev = priv->real_dev;
+ mux_id = priv->mux_id;
+
+- port = rmnet_get_port(skb->dev);
++ port = rmnet_get_port_rcu(skb->dev);
+ if (!port)
+ goto drop;
+
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+index d11c16aeb19a..ed02926f5fe9 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+@@ -276,14 +276,6 @@ int rmnet_vnd_dellink(u8 id, struct rmnet_port *port,
+ return 0;
+ }
+
+-u8 rmnet_vnd_get_mux(struct net_device *rmnet_dev)
+-{
+- struct rmnet_priv *priv;
+-
+- priv = netdev_priv(rmnet_dev);
+- return priv->mux_id;
+-}
+-
+ int rmnet_vnd_do_flow_control(struct net_device *rmnet_dev, int enable)
+ {
+ netdev_dbg(rmnet_dev, "Setting VND TX queue state to %d\n", enable);
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h
+index 71e4c3286951..22cfdfd5625a 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h
+@@ -25,6 +25,5 @@ int rmnet_vnd_dellink(u8 id, struct rmnet_port *port,
+ struct rmnet_endpoint *ep);
+ void rmnet_vnd_rx_fixup(struct sk_buff *skb, struct net_device *dev);
+ void rmnet_vnd_tx_fixup(struct sk_buff *skb, struct net_device *dev);
+-u8 rmnet_vnd_get_mux(struct net_device *rmnet_dev);
+ void rmnet_vnd_setup(struct net_device *dev);
+ #endif /* _RMNET_VND_H_ */
+diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
+index cc8fbf398c0d..d47151dbe804 100644
+--- a/drivers/net/ethernet/sfc/ptp.c
++++ b/drivers/net/ethernet/sfc/ptp.c
+@@ -563,13 +563,45 @@ efx_ptp_mac_nic_to_ktime_correction(struct efx_nic *efx,
+ u32 nic_major, u32 nic_minor,
+ s32 correction)
+ {
++ u32 sync_timestamp;
+ ktime_t kt = { 0 };
++ s16 delta;
+
+ if (!(nic_major & 0x80000000)) {
+ WARN_ON_ONCE(nic_major >> 16);
+- /* Use the top bits from the latest sync event. */
+- nic_major &= 0xffff;
+- nic_major |= (last_sync_timestamp_major(efx) & 0xffff0000);
++
++ /* Medford provides 48 bits of timestamp, so we must get the top
++ * 16 bits from the timesync event state.
++ *
++ * We only have the lower 16 bits of the time now, but we do
++ * have a full resolution timestamp at some point in past. As
++ * long as the difference between the (real) now and the sync
++ * is less than 2^15, then we can reconstruct the difference
++ * between those two numbers using only the lower 16 bits of
++ * each.
++ *
++ * Put another way
++ *
++ * a - b = ((a mod k) - b) mod k
++ *
++ * when -k/2 < (a-b) < k/2. In our case k is 2^16. We know
++ * (a mod k) and b, so can calculate the delta, a - b.
++ *
++ */
++ sync_timestamp = last_sync_timestamp_major(efx);
++
++ /* Because delta is s16 this does an implicit mask down to
++ * 16 bits which is what we need, assuming
++ * MEDFORD_TX_SECS_EVENT_BITS is 16. delta is signed so that
++ * we can deal with the (unlikely) case of sync timestamps
++ * arriving from the future.
++ */
++ delta = nic_major - sync_timestamp;
++
++ /* Recover the fully specified time now, by applying the offset
++ * to the (fully specified) sync time.
++ */
++ nic_major = sync_timestamp + delta;
+
+ kt = ptp->nic_to_kernel_time(nic_major, nic_minor,
+ correction);
+diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
+index 93f303ec17e2..5d864f812955 100644
+--- a/drivers/net/slip/slip.c
++++ b/drivers/net/slip/slip.c
+@@ -863,7 +863,10 @@ err_free_chan:
+ tty->disc_data = NULL;
+ clear_bit(SLF_INUSE, &sl->flags);
+ sl_free_netdev(sl->dev);
++ /* do not call free_netdev before rtnl_unlock */
++ rtnl_unlock();
+ free_netdev(sl->dev);
++ return err;
+
+ err_exit:
+ rtnl_unlock();
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index a04f8577d9f2..1d60ccd48ec2 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -274,6 +274,9 @@ static void qmi_wwan_netdev_setup(struct net_device *net)
+ netdev_dbg(net, "mode: raw IP\n");
+ } else if (!net->header_ops) { /* don't bother if already set */
+ ether_setup(net);
++ /* Restoring min/max mtu values set originally by usbnet */
++ net->min_mtu = 0;
++ net->max_mtu = ETH_MAX_MTU;
+ clear_bit(EVENT_NO_IP_ALIGN, &dev->flags);
+ netdev_dbg(net, "mode: Ethernet\n");
+ }
+diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c
+index b0dba35a8ad2..dc6fe93ce71f 100644
+--- a/drivers/net/wimax/i2400m/op-rfkill.c
++++ b/drivers/net/wimax/i2400m/op-rfkill.c
+@@ -147,6 +147,7 @@ error_msg_to_dev:
+ error_alloc:
+ d_fnend(4, dev, "(wimax_dev %p state %d) = %d\n",
+ wimax_dev, state, result);
++ kfree(cmd);
+ return result;
+ }
+
+diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c
+index f969a71348ef..8839f509b19a 100644
+--- a/drivers/scsi/libfc/fc_disc.c
++++ b/drivers/scsi/libfc/fc_disc.c
+@@ -640,6 +640,8 @@ redisc:
+ }
+ out:
+ kref_put(&rdata->kref, fc_rport_destroy);
++ if (!IS_ERR(fp))
++ fc_frame_free(fp);
+ }
+
+ /**
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 04ffef9cea8c..43693b679710 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1045,8 +1045,8 @@ static bool jbd2_write_access_granted(handle_t *handle, struct buffer_head *bh,
+ /* For undo access buffer must have data copied */
+ if (undo && !jh->b_committed_data)
+ goto out;
+- if (jh->b_transaction != handle->h_transaction &&
+- jh->b_next_transaction != handle->h_transaction)
++ if (READ_ONCE(jh->b_transaction) != handle->h_transaction &&
++ READ_ONCE(jh->b_next_transaction) != handle->h_transaction)
+ goto out;
+ /*
+ * There are two reasons for the barrier here:
+@@ -2467,8 +2467,8 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
+ * our jh reference and thus __jbd2_journal_file_buffer() must not
+ * take a new one.
+ */
+- jh->b_transaction = jh->b_next_transaction;
+- jh->b_next_transaction = NULL;
++ WRITE_ONCE(jh->b_transaction, jh->b_next_transaction);
++ WRITE_ONCE(jh->b_next_transaction, NULL);
+ if (buffer_freed(bh))
+ jlist = BJ_Forget;
+ else if (jh->b_modified)
+diff --git a/include/linux/device.h b/include/linux/device.h
+index c74ce473589a..b1c8150e9ea5 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -339,6 +339,7 @@ struct device *driver_find_device(struct device_driver *drv,
+ struct device *start, void *data,
+ int (*match)(struct device *dev, void *data));
+
++void driver_deferred_probe_add(struct device *dev);
+ int driver_deferred_probe_check_state(struct device *dev);
+
+ /**
+@@ -819,17 +820,21 @@ enum device_link_state {
+ /*
+ * Device link flags.
+ *
+- * STATELESS: The core won't track the presence of supplier/consumer drivers.
++ * STATELESS: The core will not remove this link automatically.
+ * AUTOREMOVE_CONSUMER: Remove the link automatically on consumer driver unbind.
+ * PM_RUNTIME: If set, the runtime PM framework will use this link.
+ * RPM_ACTIVE: Run pm_runtime_get_sync() on the supplier during link creation.
+ * AUTOREMOVE_SUPPLIER: Remove the link automatically on supplier driver unbind.
++ * AUTOPROBE_CONSUMER: Probe consumer driver automatically after supplier binds.
++ * MANAGED: The core tracks presence of supplier/consumer drivers (internal).
+ */
+ #define DL_FLAG_STATELESS BIT(0)
+ #define DL_FLAG_AUTOREMOVE_CONSUMER BIT(1)
+ #define DL_FLAG_PM_RUNTIME BIT(2)
+ #define DL_FLAG_RPM_ACTIVE BIT(3)
+ #define DL_FLAG_AUTOREMOVE_SUPPLIER BIT(4)
++#define DL_FLAG_AUTOPROBE_CONSUMER BIT(5)
++#define DL_FLAG_MANAGED BIT(6)
+
+ /**
+ * struct device_link - Device link representation.
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 08911bb6fe9a..c42eaf39b572 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -407,27 +407,32 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi
+ {
+ struct sigqueue *q = NULL;
+ struct user_struct *user;
++ int sigpending;
+
+ /*
+ * Protect access to @t credentials. This can go away when all
+ * callers hold rcu read lock.
++ *
++ * NOTE! A pending signal will hold on to the user refcount,
++ * and we get/put the refcount only when the sigpending count
++ * changes from/to zero.
+ */
+ rcu_read_lock();
+- user = get_uid(__task_cred(t)->user);
+- atomic_inc(&user->sigpending);
++ user = __task_cred(t)->user;
++ sigpending = atomic_inc_return(&user->sigpending);
++ if (sigpending == 1)
++ get_uid(user);
+ rcu_read_unlock();
+
+- if (override_rlimit ||
+- atomic_read(&user->sigpending) <=
+- task_rlimit(t, RLIMIT_SIGPENDING)) {
++ if (override_rlimit || likely(sigpending <= task_rlimit(t, RLIMIT_SIGPENDING))) {
+ q = kmem_cache_alloc(sigqueue_cachep, flags);
+ } else {
+ print_dropped_signal(sig);
+ }
+
+ if (unlikely(q == NULL)) {
+- atomic_dec(&user->sigpending);
+- free_uid(user);
++ if (atomic_dec_and_test(&user->sigpending))
++ free_uid(user);
+ } else {
+ INIT_LIST_HEAD(&q->list);
+ q->flags = 0;
+@@ -441,8 +446,8 @@ static void __sigqueue_free(struct sigqueue *q)
+ {
+ if (q->flags & SIGQUEUE_PREALLOC)
+ return;
+- atomic_dec(&q->user->sigpending);
+- free_uid(q->user);
++ if (atomic_dec_and_test(&q->user->sigpending))
++ free_uid(q->user);
+ kmem_cache_free(sigqueue_cachep, q);
+ }
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 9c3937c5ce38..764a1023ed87 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -3103,6 +3103,15 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
+ void *object = c->freelist;
+
+ if (unlikely(!object)) {
++ /*
++ * We may have removed an object from c->freelist using
++ * the fastpath in the previous iteration; in that case,
++ * c->tid has not been bumped yet.
++ * Since ___slab_alloc() may reenable interrupts while
++ * allocating memory, we should bump c->tid now.
++ */
++ c->tid = next_tid(c->tid);
++
+ /*
+ * Invoking slow path likely have side-effect
+ * of re-populating per CPU c->freelist
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index f0165c5f376b..1c21dc5d6dd4 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -1738,6 +1738,7 @@ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
+ {
+ unsigned char optbuf[sizeof(struct ip_options) + 40];
+ struct ip_options *opt = (struct ip_options *)optbuf;
++ int res;
+
+ if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES)
+ return;
+@@ -1749,7 +1750,11 @@ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
+
+ memset(opt, 0, sizeof(struct ip_options));
+ opt->optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr);
+- if (__ip_options_compile(dev_net(skb->dev), opt, skb, NULL))
++ rcu_read_lock();
++ res = __ip_options_compile(dev_net(skb->dev), opt, skb, NULL);
++ rcu_read_unlock();
++
++ if (res)
+ return;
+
+ if (gateway)
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 02d0b22d0114..c7c456c86b0d 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4042,7 +4042,7 @@ void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
+
+ lockdep_assert_held(&local->sta_mtx);
+
+- list_for_each_entry_rcu(sta, &local->sta_list, list) {
++ list_for_each_entry(sta, &local->sta_list, list) {
+ if (sdata != sta->sdata &&
+ (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
+ continue;
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 5c75118539bb..82d38f93c81a 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -203,7 +203,7 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+ hdr->size = cpu_to_le32(len);
+ hdr->confirm_rx = 0;
+
+- skb_put_padto(skb, ALIGN(len, 4));
++ skb_put_padto(skb, ALIGN(len, 4) + sizeof(*hdr));
+
+ mutex_lock(&node->ep_lock);
+ if (node->ep)
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 018c60be153a..32f575857e41 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2269,7 +2269,7 @@ static void handle_channel_custom(struct wiphy *wiphy,
+ break;
+ }
+
+- if (IS_ERR(reg_rule)) {
++ if (IS_ERR_OR_NULL(reg_rule)) {
+ pr_debug("Disabling freq %d MHz as custom regd has no rule that fits it\n",
+ chan->center_freq);
+ if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-03-25 14:58 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-03-25 14:58 UTC (permalink / raw
To: gentoo-commits
commit: f6eb349022334dfb4c800d30c6230ced648b53b4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 25 14:58:12 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 25 14:58:12 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f6eb3490
Linux patch 4.19.113
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1112_linux-4.19.113.patch | 1980 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1984 insertions(+)
diff --git a/0000_README b/0000_README
index e470ab2..a53677c 100644
--- a/0000_README
+++ b/0000_README
@@ -487,6 +487,10 @@ Patch: 1111_linux-4.19.112.patch
From: https://www.kernel.org
Desc: Linux 4.19.112
+Patch: 1112_linux-4.19.113.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.113
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1112_linux-4.19.113.patch b/1112_linux-4.19.113.patch
new file mode 100644
index 0000000..2022fa5
--- /dev/null
+++ b/1112_linux-4.19.113.patch
@@ -0,0 +1,1980 @@
+diff --git a/Makefile b/Makefile
+index bd57e085188d..61bfe5519a16 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 112
++SUBLEVEL = 113
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 7ce24b282d42..c1ef3201950a 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -324,6 +324,7 @@
+ device_type = "pci";
+ ranges = <0x81000000 0 0 0x03000 0 0x00010000
+ 0x82000000 0 0x20013000 0x13000 0 0xffed000>;
++ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
+ bus-range = <0x00 0xff>;
+ #interrupt-cells = <1>;
+ num-lanes = <1>;
+@@ -376,6 +377,7 @@
+ device_type = "pci";
+ ranges = <0x81000000 0 0 0x03000 0 0x00010000
+ 0x82000000 0 0x30013000 0x13000 0 0xffed000>;
++ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
+ bus-range = <0x00 0xff>;
+ #interrupt-cells = <1>;
+ num-lanes = <1>;
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index 52aa51f6310b..716810a08f24 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -936,11 +936,22 @@ void tick_broadcast(const struct cpumask *mask)
+ }
+ #endif
+
++/*
++ * The number of CPUs online, not counting this CPU (which may not be
++ * fully online and so not counted in num_online_cpus()).
++ */
++static inline unsigned int num_other_online_cpus(void)
++{
++ unsigned int this_cpu_online = cpu_online(smp_processor_id());
++
++ return num_online_cpus() - this_cpu_online;
++}
++
+ void smp_send_stop(void)
+ {
+ unsigned long timeout;
+
+- if (num_online_cpus() > 1) {
++ if (num_other_online_cpus()) {
+ cpumask_t mask;
+
+ cpumask_copy(&mask, cpu_online_mask);
+@@ -953,10 +964,10 @@ void smp_send_stop(void)
+
+ /* Wait up to one second for other CPUs to stop */
+ timeout = USEC_PER_SEC;
+- while (num_online_cpus() > 1 && timeout--)
++ while (num_other_online_cpus() && timeout--)
+ udelay(1);
+
+- if (num_online_cpus() > 1)
++ if (num_other_online_cpus())
+ pr_warning("SMP: failed to stop secondary CPUs %*pbl\n",
+ cpumask_pr_args(cpu_online_mask));
+
+@@ -979,7 +990,11 @@ void crash_smp_send_stop(void)
+
+ cpus_stopped = 1;
+
+- if (num_online_cpus() == 1) {
++ /*
++ * If this cpu is the only one alive at this point in time, online or
++ * not, there are no stop messages to be sent around, so just back out.
++ */
++ if (num_other_online_cpus() == 0) {
+ sdei_mask_local_cpu();
+ return;
+ }
+@@ -987,7 +1002,7 @@ void crash_smp_send_stop(void)
+ cpumask_copy(&mask, cpu_online_mask);
+ cpumask_clear_cpu(smp_processor_id(), &mask);
+
+- atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1);
++ atomic_set(&waiting_for_crash_ipi, num_other_online_cpus());
+
+ pr_crit("SMP: stopping secondary CPUs\n");
+ smp_cross_call(&mask, IPI_CPU_CRASH_STOP);
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index fd35eddf3266..d081d726ca8e 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -322,6 +322,12 @@ SECTIONS
+ *(.branch_lt)
+ }
+
++#ifdef CONFIG_DEBUG_INFO_BTF
++ .BTF : AT(ADDR(.BTF) - LOAD_OFFSET) {
++ *(.BTF)
++ }
++#endif
++
+ .opd : AT(ADDR(.opd) - LOAD_OFFSET) {
+ __start_opd = .;
+ KEEP(*(.opd))
+diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
+index 7dd308129b40..7c012ad1d7ed 100644
+--- a/arch/riscv/kernel/module.c
++++ b/arch/riscv/kernel/module.c
+@@ -16,6 +16,10 @@
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/moduleloader.h>
++#include <linux/vmalloc.h>
++#include <linux/sizes.h>
++#include <asm/pgtable.h>
++#include <asm/sections.h>
+
+ static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v)
+ {
+@@ -394,3 +398,15 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
+
+ return 0;
+ }
++
++#if defined(CONFIG_MMU) && defined(CONFIG_64BIT)
++#define VMALLOC_MODULE_START \
++ max(PFN_ALIGN((unsigned long)&_end - SZ_2G), VMALLOC_START)
++void *module_alloc(unsigned long size)
++{
++ return __vmalloc_node_range(size, 1, VMALLOC_MODULE_START,
++ VMALLOC_END, GFP_KERNEL,
++ PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
++ __builtin_return_address(0));
++}
++#endif
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 72e6fa1a913c..c61acf63529f 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -273,7 +273,7 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address)
+ return pmd_k;
+ }
+
+-void vmalloc_sync_all(void)
++static void vmalloc_sync(void)
+ {
+ unsigned long address;
+
+@@ -300,6 +300,16 @@ void vmalloc_sync_all(void)
+ }
+ }
+
++void vmalloc_sync_mappings(void)
++{
++ vmalloc_sync();
++}
++
++void vmalloc_sync_unmappings(void)
++{
++ vmalloc_sync();
++}
++
+ /*
+ * 32-bit:
+ *
+@@ -402,11 +412,23 @@ out:
+
+ #else /* CONFIG_X86_64: */
+
+-void vmalloc_sync_all(void)
++void vmalloc_sync_mappings(void)
+ {
++ /*
++ * 64-bit mappings might allocate new p4d/pud pages
++ * that need to be propagated to all tasks' PGDs.
++ */
+ sync_global_pgds(VMALLOC_START & PGDIR_MASK, VMALLOC_END);
+ }
+
++void vmalloc_sync_unmappings(void)
++{
++ /*
++ * Unmappings never allocate or free p4d/pud pages.
++ * No work is required here.
++ */
++}
++
+ /*
+ * 64-bit:
+ *
+diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
+index 9fe5952d117d..ecd3d0ec2f3b 100644
+--- a/block/bfq-cgroup.c
++++ b/block/bfq-cgroup.c
+@@ -525,12 +525,13 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,
+ */
+ entity = &bfqg->entity;
+ for_each_entity(entity) {
+- bfqg = container_of(entity, struct bfq_group, entity);
+- if (bfqg != bfqd->root_group) {
+- parent = bfqg_parent(bfqg);
++ struct bfq_group *curr_bfqg = container_of(entity,
++ struct bfq_group, entity);
++ if (curr_bfqg != bfqd->root_group) {
++ parent = bfqg_parent(curr_bfqg);
+ if (!parent)
+ parent = bfqd->root_group;
+- bfq_group_set_parent(bfqg, parent);
++ bfq_group_set_parent(curr_bfqg, parent);
+ }
+ }
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 73177b8a07bd..be6d233fdb9f 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -201,7 +201,7 @@ static int ghes_estatus_pool_expand(unsigned long len)
+ * New allocation must be visible in all pgd before it can be found by
+ * an NMI allocating from the pool.
+ */
+- vmalloc_sync_all();
++ vmalloc_sync_mappings();
+
+ return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1);
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index 65cecfdd9b45..a90e83e5ab57 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -694,11 +694,11 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
+ ssize_t result = 0;
+ uint32_t offset, se, sh, cu, wave, simd, thread, bank, *data;
+
+- if (size & 3 || *pos & 3)
++ if (size > 4096 || size & 3 || *pos & 3)
+ return -EINVAL;
+
+ /* decode offset */
+- offset = *pos & GENMASK_ULL(11, 0);
++ offset = (*pos & GENMASK_ULL(11, 0)) >> 2;
+ se = (*pos & GENMASK_ULL(19, 12)) >> 12;
+ sh = (*pos & GENMASK_ULL(27, 20)) >> 20;
+ cu = (*pos & GENMASK_ULL(35, 28)) >> 28;
+@@ -729,7 +729,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
+ while (size) {
+ uint32_t value;
+
+- value = data[offset++];
++ value = data[result >> 2];
+ r = put_user(value, (uint32_t *)buf);
+ if (r) {
+ result = r;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index c85bea70d965..ad9561853d8e 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -419,6 +419,7 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ dc_link_remove_remote_sink(aconnector->dc_link, aconnector->dc_sink);
+ dc_sink_release(aconnector->dc_sink);
+ aconnector->dc_sink = NULL;
++ aconnector->dc_link->cur_link_settings.lane_count = 0;
+ }
+
+ drm_connector_unregister(connector);
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
+index 1ea91e153d3a..c1adac888fd8 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
+@@ -684,8 +684,8 @@ static void hubbub1_det_request_size(
+
+ hubbub1_get_blk256_size(&blk256_width, &blk256_height, bpe);
+
+- swath_bytes_horz_wc = height * blk256_height * bpe;
+- swath_bytes_vert_wc = width * blk256_width * bpe;
++ swath_bytes_horz_wc = width * blk256_height * bpe;
++ swath_bytes_vert_wc = height * blk256_width * bpe;
+
+ *req128_horz_wc = (2 * swath_bytes_horz_wc <= detile_buf_size) ?
+ false : /* full 256B request */
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+index 2a0a1654d3ce..6930452a712a 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+@@ -1364,28 +1364,34 @@ static void hdmi_config_AVI(struct dw_hdmi *hdmi, struct drm_display_mode *mode)
+ frame.colorspace = HDMI_COLORSPACE_RGB;
+
+ /* Set up colorimetry */
+- switch (hdmi->hdmi_data.enc_out_encoding) {
+- case V4L2_YCBCR_ENC_601:
+- if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601)
+- frame.colorimetry = HDMI_COLORIMETRY_EXTENDED;
+- else
++ if (!hdmi_bus_fmt_is_rgb(hdmi->hdmi_data.enc_out_bus_format)) {
++ switch (hdmi->hdmi_data.enc_out_encoding) {
++ case V4L2_YCBCR_ENC_601:
++ if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV601)
++ frame.colorimetry = HDMI_COLORIMETRY_EXTENDED;
++ else
++ frame.colorimetry = HDMI_COLORIMETRY_ITU_601;
++ frame.extended_colorimetry =
++ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
++ break;
++ case V4L2_YCBCR_ENC_709:
++ if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709)
++ frame.colorimetry = HDMI_COLORIMETRY_EXTENDED;
++ else
++ frame.colorimetry = HDMI_COLORIMETRY_ITU_709;
++ frame.extended_colorimetry =
++ HDMI_EXTENDED_COLORIMETRY_XV_YCC_709;
++ break;
++ default: /* Carries no data */
+ frame.colorimetry = HDMI_COLORIMETRY_ITU_601;
++ frame.extended_colorimetry =
++ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
++ break;
++ }
++ } else {
++ frame.colorimetry = HDMI_COLORIMETRY_NONE;
+ frame.extended_colorimetry =
+- HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+- break;
+- case V4L2_YCBCR_ENC_709:
+- if (hdmi->hdmi_data.enc_in_encoding == V4L2_YCBCR_ENC_XV709)
+- frame.colorimetry = HDMI_COLORIMETRY_EXTENDED;
+- else
+- frame.colorimetry = HDMI_COLORIMETRY_ITU_709;
+- frame.extended_colorimetry =
+- HDMI_EXTENDED_COLORIMETRY_XV_YCC_709;
+- break;
+- default: /* Carries no data */
+- frame.colorimetry = HDMI_COLORIMETRY_ITU_601;
+- frame.extended_colorimetry =
+- HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+- break;
++ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601;
+ }
+
+ frame.scan_mode = HDMI_SCAN_MODE_NONE;
+diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
+index 086f2adc541b..19e9935c2e43 100644
+--- a/drivers/gpu/drm/drm_lease.c
++++ b/drivers/gpu/drm/drm_lease.c
+@@ -545,10 +545,12 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
+ }
+
+ DRM_DEBUG_LEASE("Creating lease\n");
++ /* lessee will take the ownership of leases */
+ lessee = drm_lease_create(lessor, &leases);
+
+ if (IS_ERR(lessee)) {
+ ret = PTR_ERR(lessee);
++ idr_destroy(&leases);
+ goto out_leases;
+ }
+
+@@ -583,7 +585,6 @@ out_lessee:
+
+ out_leases:
+ put_unused_fd(fd);
+- idr_destroy(&leases);
+
+ DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
+ return ret;
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+index 781b82c2c579..8d776070913d 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+@@ -1722,8 +1722,9 @@ static int exynos_dsi_probe(struct platform_device *pdev)
+ ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(dsi->supplies),
+ dsi->supplies);
+ if (ret) {
+- dev_info(dev, "failed to get regulators: %d\n", ret);
+- return -EPROBE_DEFER;
++ if (ret != -EPROBE_DEFER)
++ dev_info(dev, "failed to get regulators: %d\n", ret);
++ return ret;
+ }
+
+ dsi->clks = devm_kcalloc(dev,
+@@ -1736,9 +1737,10 @@ static int exynos_dsi_probe(struct platform_device *pdev)
+ dsi->clks[i] = devm_clk_get(dev, clk_names[i]);
+ if (IS_ERR(dsi->clks[i])) {
+ if (strcmp(clk_names[i], "sclk_mipi") == 0) {
+- strcpy(clk_names[i], OLD_SCLK_MIPI_CLK_NAME);
+- i--;
+- continue;
++ dsi->clks[i] = devm_clk_get(dev,
++ OLD_SCLK_MIPI_CLK_NAME);
++ if (!IS_ERR(dsi->clks[i]))
++ continue;
+ }
+
+ dev_info(dev, "failed to get the clock: %s\n",
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index b86ee7d25af3..eac9caf322f9 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -506,10 +506,18 @@ static const struct drm_crtc_helper_funcs mtk_crtc_helper_funcs = {
+
+ static int mtk_drm_crtc_init(struct drm_device *drm,
+ struct mtk_drm_crtc *mtk_crtc,
+- struct drm_plane *primary,
+- struct drm_plane *cursor, unsigned int pipe)
++ unsigned int pipe)
+ {
+- int ret;
++ struct drm_plane *primary = NULL;
++ struct drm_plane *cursor = NULL;
++ int i, ret;
++
++ for (i = 0; i < mtk_crtc->layer_nr; i++) {
++ if (mtk_crtc->planes[i].type == DRM_PLANE_TYPE_PRIMARY)
++ primary = &mtk_crtc->planes[i];
++ else if (mtk_crtc->planes[i].type == DRM_PLANE_TYPE_CURSOR)
++ cursor = &mtk_crtc->planes[i];
++ }
+
+ ret = drm_crtc_init_with_planes(drm, &mtk_crtc->base, primary, cursor,
+ &mtk_crtc_funcs, NULL);
+@@ -622,9 +630,7 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
+ goto unprepare;
+ }
+
+- ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, &mtk_crtc->planes[0],
+- mtk_crtc->layer_nr > 1 ? &mtk_crtc->planes[1] :
+- NULL, pipe);
++ ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, pipe);
+ if (ret < 0)
+ goto unprepare;
+ drm_mode_crtc_set_gamma_size(&mtk_crtc->base, MTK_LUT_SIZE);
+diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
+index 3cdf85b1ce4f..ecfe7a43c151 100644
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -491,7 +491,7 @@ static int msc_configure(struct msc *msc)
+ lockdep_assert_held(&msc->buf_mutex);
+
+ if (msc->mode > MSC_MODE_MULTI)
+- return -ENOTSUPP;
++ return -EINVAL;
+
+ if (msc->mode == MSC_MODE_MULTI)
+ msc_buffer_clear_hw_header(msc);
+@@ -942,7 +942,7 @@ static int msc_buffer_alloc(struct msc *msc, unsigned long *nr_pages,
+ } else if (msc->mode == MSC_MODE_MULTI) {
+ ret = msc_buffer_multi_alloc(msc, nr_pages, nr_wins);
+ } else {
+- ret = -ENOTSUPP;
++ ret = -EINVAL;
+ }
+
+ if (!ret) {
+@@ -1165,7 +1165,7 @@ static ssize_t intel_th_msc_read(struct file *file, char __user *buf,
+ if (ret >= 0)
+ *ppos = iter->offset;
+ } else {
+- ret = -ENOTSUPP;
++ ret = -EINVAL;
+ }
+
+ put_count:
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index e63a0c24e76b..8424c8c61355 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -210,6 +210,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Elkhart Lake CPU */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4529),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ {
+ /* Elkhart Lake */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26),
+diff --git a/drivers/iio/accel/st_accel_i2c.c b/drivers/iio/accel/st_accel_i2c.c
+index 2ca5d1f6ade0..b314ef878d2f 100644
+--- a/drivers/iio/accel/st_accel_i2c.c
++++ b/drivers/iio/accel/st_accel_i2c.c
+@@ -107,7 +107,7 @@ MODULE_DEVICE_TABLE(of, st_accel_of_match);
+
+ #ifdef CONFIG_ACPI
+ static const struct acpi_device_id st_accel_acpi_match[] = {
+- {"SMO8840", (kernel_ulong_t)LNG2DM_ACCEL_DEV_NAME},
++ {"SMO8840", (kernel_ulong_t)LIS2DH12_ACCEL_DEV_NAME},
+ {"SMO8A90", (kernel_ulong_t)LNG2DM_ACCEL_DEV_NAME},
+ { },
+ };
+diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
+index d5ea84cf6460..c485ff6f408b 100644
+--- a/drivers/iio/adc/at91-sama5d2_adc.c
++++ b/drivers/iio/adc/at91-sama5d2_adc.c
+@@ -731,6 +731,7 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
+
+ for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) {
+ struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit);
++ u32 cor;
+
+ if (!chan)
+ continue;
+@@ -739,6 +740,20 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
+ chan->type == IIO_PRESSURE)
+ continue;
+
++ if (state) {
++ cor = at91_adc_readl(st, AT91_SAMA5D2_COR);
++
++ if (chan->differential)
++ cor |= (BIT(chan->channel) |
++ BIT(chan->channel2)) <<
++ AT91_SAMA5D2_COR_DIFF_OFFSET;
++ else
++ cor &= ~(BIT(chan->channel) <<
++ AT91_SAMA5D2_COR_DIFF_OFFSET);
++
++ at91_adc_writel(st, AT91_SAMA5D2_COR, cor);
++ }
++
+ if (state) {
+ at91_adc_writel(st, AT91_SAMA5D2_CHER,
+ BIT(chan->channel));
+diff --git a/drivers/iio/light/vcnl4000.c b/drivers/iio/light/vcnl4000.c
+index 04fd0d4b6f19..d3d65ecb30a5 100644
+--- a/drivers/iio/light/vcnl4000.c
++++ b/drivers/iio/light/vcnl4000.c
+@@ -150,9 +150,10 @@ static int vcnl4200_init(struct vcnl4000_data *data)
+ data->al_scale = 24000;
+ data->vcnl4200_al.reg = VCNL4200_AL_DATA;
+ data->vcnl4200_ps.reg = VCNL4200_PS_DATA;
+- /* Integration time is 50ms, but the experiments show 54ms in total. */
+- data->vcnl4200_al.sampling_rate = ktime_set(0, 54000 * 1000);
+- data->vcnl4200_ps.sampling_rate = ktime_set(0, 4200 * 1000);
++ /* Default wait time is 50ms, add 20% tolerance. */
++ data->vcnl4200_al.sampling_rate = ktime_set(0, 60000 * 1000);
++ /* Default wait time is 4.8ms, add 20% tolerance. */
++ data->vcnl4200_ps.sampling_rate = ktime_set(0, 5760 * 1000);
+ data->vcnl4200_al.last_measurement = ktime_set(0, 0);
+ data->vcnl4200_ps.last_measurement = ktime_set(0, 0);
+ mutex_init(&data->vcnl4200_al.lock);
+diff --git a/drivers/iio/magnetometer/ak8974.c b/drivers/iio/magnetometer/ak8974.c
+index 93be1f4c0f27..806a3185b66d 100644
+--- a/drivers/iio/magnetometer/ak8974.c
++++ b/drivers/iio/magnetometer/ak8974.c
+@@ -563,7 +563,7 @@ static int ak8974_read_raw(struct iio_dev *indio_dev,
+ * We read all axes and discard all but one, for optimized
+ * reading, use the triggered buffer.
+ */
+- *val = le16_to_cpu(hw_values[chan->address]);
++ *val = (s16)le16_to_cpu(hw_values[chan->address]);
+
+ ret = IIO_VAL_INT;
+ }
+diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c
+index ccf1ce653b25..7722745e101f 100644
+--- a/drivers/iio/trigger/stm32-timer-trigger.c
++++ b/drivers/iio/trigger/stm32-timer-trigger.c
+@@ -161,7 +161,8 @@ static int stm32_timer_start(struct stm32_timer_trigger *priv,
+ return 0;
+ }
+
+-static void stm32_timer_stop(struct stm32_timer_trigger *priv)
++static void stm32_timer_stop(struct stm32_timer_trigger *priv,
++ struct iio_trigger *trig)
+ {
+ u32 ccer, cr1;
+
+@@ -179,6 +180,12 @@ static void stm32_timer_stop(struct stm32_timer_trigger *priv)
+ regmap_write(priv->regmap, TIM_PSC, 0);
+ regmap_write(priv->regmap, TIM_ARR, 0);
+
++ /* Force disable master mode */
++ if (stm32_timer_is_trgo2_name(trig->name))
++ regmap_update_bits(priv->regmap, TIM_CR2, TIM_CR2_MMS2, 0);
++ else
++ regmap_update_bits(priv->regmap, TIM_CR2, TIM_CR2_MMS, 0);
++
+ /* Make sure that registers are updated */
+ regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG);
+ }
+@@ -197,7 +204,7 @@ static ssize_t stm32_tt_store_frequency(struct device *dev,
+ return ret;
+
+ if (freq == 0) {
+- stm32_timer_stop(priv);
++ stm32_timer_stop(priv, trig);
+ } else {
+ ret = stm32_timer_start(priv, trig, freq);
+ if (ret)
+diff --git a/drivers/md/dm-bio-record.h b/drivers/md/dm-bio-record.h
+index c82578af56a5..2ea0360108e1 100644
+--- a/drivers/md/dm-bio-record.h
++++ b/drivers/md/dm-bio-record.h
+@@ -20,8 +20,13 @@
+ struct dm_bio_details {
+ struct gendisk *bi_disk;
+ u8 bi_partno;
++ int __bi_remaining;
+ unsigned long bi_flags;
+ struct bvec_iter bi_iter;
++ bio_end_io_t *bi_end_io;
++#if defined(CONFIG_BLK_DEV_INTEGRITY)
++ struct bio_integrity_payload *bi_integrity;
++#endif
+ };
+
+ static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio)
+@@ -30,6 +35,11 @@ static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio)
+ bd->bi_partno = bio->bi_partno;
+ bd->bi_flags = bio->bi_flags;
+ bd->bi_iter = bio->bi_iter;
++ bd->__bi_remaining = atomic_read(&bio->__bi_remaining);
++ bd->bi_end_io = bio->bi_end_io;
++#if defined(CONFIG_BLK_DEV_INTEGRITY)
++ bd->bi_integrity = bio_integrity(bio);
++#endif
+ }
+
+ static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio)
+@@ -38,6 +48,11 @@ static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio)
+ bio->bi_partno = bd->bi_partno;
+ bio->bi_flags = bd->bi_flags;
+ bio->bi_iter = bd->bi_iter;
++ atomic_set(&bio->__bi_remaining, bd->__bi_remaining);
++ bio->bi_end_io = bd->bi_end_io;
++#if defined(CONFIG_BLK_DEV_INTEGRITY)
++ bio->bi_integrity = bd->bi_integrity;
++#endif
+ }
+
+ #endif
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 5885239cc1f8..d75a4ce7d12a 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -6,6 +6,8 @@
+ * This file is released under the GPL.
+ */
+
++#include "dm-bio-record.h"
++
+ #include <linux/compiler.h>
+ #include <linux/module.h>
+ #include <linux/device-mapper.h>
+@@ -276,11 +278,7 @@ struct dm_integrity_io {
+
+ struct completion *completion;
+
+- struct gendisk *orig_bi_disk;
+- u8 orig_bi_partno;
+- bio_end_io_t *orig_bi_end_io;
+- struct bio_integrity_payload *orig_bi_integrity;
+- struct bvec_iter orig_bi_iter;
++ struct dm_bio_details bio_details;
+ };
+
+ struct journal_completion {
+@@ -1249,14 +1247,9 @@ static void integrity_end_io(struct bio *bio)
+ {
+ struct dm_integrity_io *dio = dm_per_bio_data(bio, sizeof(struct dm_integrity_io));
+
+- bio->bi_iter = dio->orig_bi_iter;
+- bio->bi_disk = dio->orig_bi_disk;
+- bio->bi_partno = dio->orig_bi_partno;
+- if (dio->orig_bi_integrity) {
+- bio->bi_integrity = dio->orig_bi_integrity;
++ dm_bio_restore(&dio->bio_details, bio);
++ if (bio->bi_integrity)
+ bio->bi_opf |= REQ_INTEGRITY;
+- }
+- bio->bi_end_io = dio->orig_bi_end_io;
+
+ if (dio->completion)
+ complete(dio->completion);
+@@ -1336,7 +1329,7 @@ static void integrity_metadata(struct work_struct *w)
+ if (!checksums)
+ checksums = checksums_onstack;
+
+- __bio_for_each_segment(bv, bio, iter, dio->orig_bi_iter) {
++ __bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) {
+ unsigned pos;
+ char *mem, *checksums_ptr;
+
+@@ -1380,7 +1373,7 @@ again:
+ if (likely(checksums != checksums_onstack))
+ kfree(checksums);
+ } else {
+- struct bio_integrity_payload *bip = dio->orig_bi_integrity;
++ struct bio_integrity_payload *bip = dio->bio_details.bi_integrity;
+
+ if (bip) {
+ struct bio_vec biv;
+@@ -1784,20 +1777,13 @@ offload_to_thread:
+ } else
+ dio->completion = NULL;
+
+- dio->orig_bi_iter = bio->bi_iter;
+-
+- dio->orig_bi_disk = bio->bi_disk;
+- dio->orig_bi_partno = bio->bi_partno;
++ dm_bio_record(&dio->bio_details, bio);
+ bio_set_dev(bio, ic->dev->bdev);
+-
+- dio->orig_bi_integrity = bio_integrity(bio);
+ bio->bi_integrity = NULL;
+ bio->bi_opf &= ~REQ_INTEGRITY;
+-
+- dio->orig_bi_end_io = bio->bi_end_io;
+ bio->bi_end_io = integrity_end_io;
+-
+ bio->bi_iter.bi_size = dio->range.n_sectors << SECTOR_SHIFT;
++
+ generic_make_request(bio);
+
+ if (need_sync_io) {
+diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c
+index d2ed3b9728b7..94bde09d9323 100644
+--- a/drivers/misc/altera-stapl/altera.c
++++ b/drivers/misc/altera-stapl/altera.c
+@@ -2126,8 +2126,8 @@ exit_done:
+ return status;
+ }
+
+-static int altera_get_note(u8 *p, s32 program_size,
+- s32 *offset, char *key, char *value, int length)
++static int altera_get_note(u8 *p, s32 program_size, s32 *offset,
++ char *key, char *value, int keylen, int vallen)
+ /*
+ * Gets key and value of NOTE fields in the JBC file.
+ * Can be called in two modes: if offset pointer is NULL,
+@@ -2184,7 +2184,7 @@ static int altera_get_note(u8 *p, s32 program_size,
+ &p[note_table + (8 * i) + 4])];
+
+ if (value != NULL)
+- strlcpy(value, value_ptr, length);
++ strlcpy(value, value_ptr, vallen);
+
+ }
+ }
+@@ -2203,13 +2203,13 @@ static int altera_get_note(u8 *p, s32 program_size,
+ strlcpy(key, &p[note_strings +
+ get_unaligned_be32(
+ &p[note_table + (8 * i)])],
+- length);
++ keylen);
+
+ if (value != NULL)
+ strlcpy(value, &p[note_strings +
+ get_unaligned_be32(
+ &p[note_table + (8 * i) + 4])],
+- length);
++ vallen);
+
+ *offset = i + 1;
+ }
+@@ -2463,7 +2463,7 @@ int altera_init(struct altera_config *config, const struct firmware *fw)
+ __func__, (format_version == 2) ? "Jam STAPL" :
+ "pre-standardized Jam 1.1");
+ while (altera_get_note((u8 *)fw->data, fw->size,
+- &offset, key, value, 256) == 0)
++ &offset, key, value, 32, 256) == 0)
+ printk(KERN_INFO "%s: NOTE \"%s\" = \"%s\"\n",
+ __func__, key, value);
+ }
+diff --git a/drivers/misc/cardreader/rts5227.c b/drivers/misc/cardreader/rts5227.c
+index 024dcba8d6c8..13645be5f3b5 100644
+--- a/drivers/misc/cardreader/rts5227.c
++++ b/drivers/misc/cardreader/rts5227.c
+@@ -369,6 +369,6 @@ static const struct pcr_ops rts522a_pcr_ops = {
+ void rts522a_init_params(struct rtsx_pcr *pcr)
+ {
+ rts5227_init_params(pcr);
+-
++ pcr->tx_initial_phase = SET_CLOCK_PHASE(20, 20, 11);
+ pcr->reg_pm_ctrl3 = RTS522A_PM_CTRL3;
+ }
+diff --git a/drivers/misc/cardreader/rts5249.c b/drivers/misc/cardreader/rts5249.c
+index dbe013abdb83..45cd75041d60 100644
+--- a/drivers/misc/cardreader/rts5249.c
++++ b/drivers/misc/cardreader/rts5249.c
+@@ -623,6 +623,7 @@ static const struct pcr_ops rts524a_pcr_ops = {
+ void rts524a_init_params(struct rtsx_pcr *pcr)
+ {
+ rts5249_init_params(pcr);
++ pcr->tx_initial_phase = SET_CLOCK_PHASE(27, 29, 11);
+ pcr->option.ltr_l1off_sspwrgate = LTR_L1OFF_SSPWRGATE_5250_DEF;
+ pcr->option.ltr_l1off_snooze_sspwrgate =
+ LTR_L1OFF_SNOOZE_SSPWRGATE_5250_DEF;
+@@ -731,6 +732,7 @@ static const struct pcr_ops rts525a_pcr_ops = {
+ void rts525a_init_params(struct rtsx_pcr *pcr)
+ {
+ rts5249_init_params(pcr);
++ pcr->tx_initial_phase = SET_CLOCK_PHASE(25, 29, 11);
+ pcr->option.ltr_l1off_sspwrgate = LTR_L1OFF_SSPWRGATE_5250_DEF;
+ pcr->option.ltr_l1off_snooze_sspwrgate =
+ LTR_L1OFF_SNOOZE_SSPWRGATE_5250_DEF;
+diff --git a/drivers/misc/cardreader/rts5260.c b/drivers/misc/cardreader/rts5260.c
+index a493b01c5bc6..958b19f7ce52 100644
+--- a/drivers/misc/cardreader/rts5260.c
++++ b/drivers/misc/cardreader/rts5260.c
+@@ -712,7 +712,7 @@ void rts5260_init_params(struct rtsx_pcr *pcr)
+ pcr->sd30_drive_sel_1v8 = CFG_DRIVER_TYPE_B;
+ pcr->sd30_drive_sel_3v3 = CFG_DRIVER_TYPE_B;
+ pcr->aspm_en = ASPM_L1_EN;
+- pcr->tx_initial_phase = SET_CLOCK_PHASE(1, 29, 16);
++ pcr->tx_initial_phase = SET_CLOCK_PHASE(27, 29, 11);
+ pcr->rx_initial_phase = SET_CLOCK_PHASE(24, 6, 5);
+
+ pcr->ic_version = rts5260_get_ic_version(pcr);
+diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
+index 30bd8081307e..02de6a5701d6 100644
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -618,19 +618,22 @@ static int sd_change_phase(struct realtek_pci_sdmmc *host,
+ u8 sample_point, bool rx)
+ {
+ struct rtsx_pcr *pcr = host->pcr;
+-
++ u16 SD_VP_CTL = 0;
+ dev_dbg(sdmmc_dev(host), "%s(%s): sample_point = %d\n",
+ __func__, rx ? "RX" : "TX", sample_point);
+
+ rtsx_pci_write_register(pcr, CLK_CTL, CHANGE_CLK, CHANGE_CLK);
+- if (rx)
++ if (rx) {
++ SD_VP_CTL = SD_VPRX_CTL;
+ rtsx_pci_write_register(pcr, SD_VPRX_CTL,
+ PHASE_SELECT_MASK, sample_point);
+- else
++ } else {
++ SD_VP_CTL = SD_VPTX_CTL;
+ rtsx_pci_write_register(pcr, SD_VPTX_CTL,
+ PHASE_SELECT_MASK, sample_point);
+- rtsx_pci_write_register(pcr, SD_VPCLK0_CTL, PHASE_NOT_RESET, 0);
+- rtsx_pci_write_register(pcr, SD_VPCLK0_CTL, PHASE_NOT_RESET,
++ }
++ rtsx_pci_write_register(pcr, SD_VP_CTL, PHASE_NOT_RESET, 0);
++ rtsx_pci_write_register(pcr, SD_VP_CTL, PHASE_NOT_RESET,
+ PHASE_NOT_RESET);
+ rtsx_pci_write_register(pcr, CLK_CTL, CHANGE_CLK, 0);
+ rtsx_pci_write_register(pcr, SD_CFG1, SD_ASYNC_FIFO_NOT_RST, 0);
+diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
+index 04e88d4796fa..8cd1794768ba 100644
+--- a/drivers/mmc/host/sdhci-of-at91.c
++++ b/drivers/mmc/host/sdhci-of-at91.c
+@@ -126,7 +126,8 @@ static void sdhci_at91_reset(struct sdhci_host *host, u8 mask)
+ {
+ sdhci_reset(host, mask);
+
+- if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
++ if ((host->mmc->caps & MMC_CAP_NONREMOVABLE)
++ || mmc_gpio_get_cd(host->mmc) >= 0)
+ sdhci_at91_set_force_card_detect(host);
+ }
+
+@@ -405,8 +406,11 @@ static int sdhci_at91_probe(struct platform_device *pdev)
+ * detection procedure using the SDMCC_CD signal is bypassed.
+ * This bit is reset when a software reset for all command is performed
+ * so we need to implement our own reset function to set back this bit.
++ *
++ * WA: SAMA5D2 doesn't drive CMD if using CD GPIO line.
+ */
+- if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
++ if ((host->mmc->caps & MMC_CAP_NONREMOVABLE)
++ || mmc_gpio_get_cd(host->mmc) >= 0)
+ sdhci_at91_set_force_card_detect(host);
+
+ pm_runtime_put_autosuspend(&pdev->dev);
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index 7f5ee6bb4430..9f895083bc0a 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -993,23 +993,24 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
+ struct sk_buff *skb)
+ {
+ int orig_iif = skb->skb_iif;
+- bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
+- bool is_ndisc = ipv6_ndisc_frame(skb);
++ bool need_strict;
+
+- /* loopback, multicast & non-ND link-local traffic; do not push through
+- * packet taps again. Reset pkt_type for upper layers to process skb
++ /* loopback traffic; do not push through packet taps again.
++ * Reset pkt_type for upper layers to process skb
+ */
+- if (skb->pkt_type == PACKET_LOOPBACK || (need_strict && !is_ndisc)) {
++ if (skb->pkt_type == PACKET_LOOPBACK) {
+ skb->dev = vrf_dev;
+ skb->skb_iif = vrf_dev->ifindex;
+ IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
+- if (skb->pkt_type == PACKET_LOOPBACK)
+- skb->pkt_type = PACKET_HOST;
++ skb->pkt_type = PACKET_HOST;
+ goto out;
+ }
+
+- /* if packet is NDISC then keep the ingress interface */
+- if (!is_ndisc) {
++ /* if packet is NDISC or addressed to multicast or link-local
++ * then keep the ingress interface
++ */
++ need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
++ if (!ipv6_ndisc_frame(skb) && !need_strict) {
+ vrf_rx_stats(vrf_dev, skb->len);
+ skb->dev = vrf_dev;
+ skb->skb_iif = vrf_dev->ifindex;
+diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c
+index 0f197516d708..9a6f7f822566 100644
+--- a/drivers/perf/arm_pmu_acpi.c
++++ b/drivers/perf/arm_pmu_acpi.c
+@@ -27,8 +27,6 @@ static int arm_pmu_acpi_register_irq(int cpu)
+ int gsi, trigger;
+
+ gicc = acpi_cpu_get_madt_gicc(cpu);
+- if (WARN_ON(!gicc))
+- return -EINVAL;
+
+ gsi = gicc->performance_interrupt;
+
+@@ -67,11 +65,10 @@ static void arm_pmu_acpi_unregister_irq(int cpu)
+ int gsi;
+
+ gicc = acpi_cpu_get_madt_gicc(cpu);
+- if (!gicc)
+- return;
+
+ gsi = gicc->performance_interrupt;
+- acpi_unregister_gsi(gsi);
++ if (gsi)
++ acpi_unregister_gsi(gsi);
+ }
+
+ static int arm_pmu_acpi_parse_irqs(void)
+diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
+index 7d7be60a2413..28a4505a1bc8 100644
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -314,6 +314,7 @@ config RTC_DRV_MAX6900
+ config RTC_DRV_MAX8907
+ tristate "Maxim MAX8907"
+ depends on MFD_MAX8907 || COMPILE_TEST
++ select REGMAP_IRQ
+ help
+ If you say yes here you will get support for the
+ RTC of Maxim MAX8907 PMIC.
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index 525388126e26..e4482823d8d7 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -76,6 +76,10 @@ MODULE_ALIAS("platform:pxa2xx-spi");
+ #define LPSS_CAPS_CS_EN_SHIFT 9
+ #define LPSS_CAPS_CS_EN_MASK (0xf << LPSS_CAPS_CS_EN_SHIFT)
+
++#define LPSS_PRIV_CLOCK_GATE 0x38
++#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK 0x3
++#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON 0x3
++
+ struct lpss_config {
+ /* LPSS offset from drv_data->ioaddr */
+ unsigned offset;
+@@ -92,6 +96,8 @@ struct lpss_config {
+ unsigned cs_sel_shift;
+ unsigned cs_sel_mask;
+ unsigned cs_num;
++ /* Quirks */
++ unsigned cs_clk_stays_gated : 1;
+ };
+
+ /* Keep these sorted with enum pxa_ssp_type */
+@@ -162,6 +168,7 @@ static const struct lpss_config lpss_platforms[] = {
+ .tx_threshold_hi = 56,
+ .cs_sel_shift = 8,
+ .cs_sel_mask = 3 << 8,
++ .cs_clk_stays_gated = true,
+ },
+ };
+
+@@ -389,6 +396,22 @@ static void lpss_ssp_cs_control(struct spi_device *spi, bool enable)
+ else
+ value |= LPSS_CS_CONTROL_CS_HIGH;
+ __lpss_ssp_write_priv(drv_data, config->reg_cs_ctrl, value);
++ if (config->cs_clk_stays_gated) {
++ u32 clkgate;
++
++ /*
++ * Changing CS alone when dynamic clock gating is on won't
++ * actually flip CS at that time. This ruins SPI transfers
++ * that specify delays, or have no data. Toggle the clock mode
++ * to force on briefly to poke the CS pin to move.
++ */
++ clkgate = __lpss_ssp_read_priv(drv_data, LPSS_PRIV_CLOCK_GATE);
++ value = (clkgate & ~LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK) |
++ LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON;
++
++ __lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, value);
++ __lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, clkgate);
++ }
+ }
+
+ static void cs_assert(struct spi_device *spi)
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index 974a8ce58b68..cb74fd1af205 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1190,6 +1190,11 @@ static int spi_qup_suspend(struct device *device)
+ struct spi_qup *controller = spi_master_get_devdata(master);
+ int ret;
+
++ if (pm_runtime_suspended(device)) {
++ ret = spi_qup_pm_resume_runtime(device);
++ if (ret)
++ return ret;
++ }
+ ret = spi_master_suspend(master);
+ if (ret)
+ return ret;
+@@ -1198,10 +1203,8 @@ static int spi_qup_suspend(struct device *device)
+ if (ret)
+ return ret;
+
+- if (!pm_runtime_suspended(device)) {
+- clk_disable_unprepare(controller->cclk);
+- clk_disable_unprepare(controller->iclk);
+- }
++ clk_disable_unprepare(controller->cclk);
++ clk_disable_unprepare(controller->iclk);
+ return 0;
+ }
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index cc4d31033494..f2848c59b0b8 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -403,9 +403,6 @@ static void zynqmp_qspi_chipselect(struct spi_device *qspi, bool is_high)
+
+ zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, genfifoentry);
+
+- /* Dummy generic FIFO entry */
+- zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, 0x0);
+-
+ /* Manually start the generic FIFO command */
+ zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST,
+ zynqmp_gqspi_read(xqspi, GQSPI_CONFIG_OFST) |
+diff --git a/drivers/staging/greybus/tools/loopback_test.c b/drivers/staging/greybus/tools/loopback_test.c
+index b82e2befe935..1452df84e2b7 100644
+--- a/drivers/staging/greybus/tools/loopback_test.c
++++ b/drivers/staging/greybus/tools/loopback_test.c
+@@ -21,6 +21,7 @@
+ #include <signal.h>
+
+ #define MAX_NUM_DEVICES 10
++#define MAX_SYSFS_PREFIX 0x80
+ #define MAX_SYSFS_PATH 0x200
+ #define CSV_MAX_LINE 0x1000
+ #define SYSFS_MAX_INT 0x20
+@@ -69,7 +70,7 @@ struct loopback_results {
+ };
+
+ struct loopback_device {
+- char name[MAX_SYSFS_PATH];
++ char name[MAX_STR_LEN];
+ char sysfs_entry[MAX_SYSFS_PATH];
+ char debugfs_entry[MAX_SYSFS_PATH];
+ struct loopback_results results;
+@@ -95,8 +96,8 @@ struct loopback_test {
+ int stop_all;
+ int poll_count;
+ char test_name[MAX_STR_LEN];
+- char sysfs_prefix[MAX_SYSFS_PATH];
+- char debugfs_prefix[MAX_SYSFS_PATH];
++ char sysfs_prefix[MAX_SYSFS_PREFIX];
++ char debugfs_prefix[MAX_SYSFS_PREFIX];
+ struct timespec poll_timeout;
+ struct loopback_device devices[MAX_NUM_DEVICES];
+ struct loopback_results aggregate_results;
+@@ -645,7 +646,7 @@ baddir:
+ static int open_poll_files(struct loopback_test *t)
+ {
+ struct loopback_device *dev;
+- char buf[MAX_STR_LEN];
++ char buf[MAX_SYSFS_PATH + MAX_STR_LEN];
+ char dummy;
+ int fds_idx = 0;
+ int i;
+@@ -663,7 +664,7 @@ static int open_poll_files(struct loopback_test *t)
+ goto err;
+ }
+ read(t->fds[fds_idx].fd, &dummy, 1);
+- t->fds[fds_idx].events = EPOLLERR|EPOLLPRI;
++ t->fds[fds_idx].events = POLLERR | POLLPRI;
+ t->fds[fds_idx].revents = 0;
+ fds_idx++;
+ }
+@@ -756,7 +757,7 @@ static int wait_for_complete(struct loopback_test *t)
+ }
+
+ for (i = 0; i < t->poll_count; i++) {
+- if (t->fds[i].revents & EPOLLPRI) {
++ if (t->fds[i].revents & POLLPRI) {
+ /* Dummy read to clear the event */
+ read(t->fds[i].fd, &dummy, 1);
+ number_of_events++;
+@@ -915,10 +916,10 @@ int main(int argc, char *argv[])
+ t.iteration_max = atoi(optarg);
+ break;
+ case 'S':
+- snprintf(t.sysfs_prefix, MAX_SYSFS_PATH, "%s", optarg);
++ snprintf(t.sysfs_prefix, MAX_SYSFS_PREFIX, "%s", optarg);
+ break;
+ case 'D':
+- snprintf(t.debugfs_prefix, MAX_SYSFS_PATH, "%s", optarg);
++ snprintf(t.debugfs_prefix, MAX_SYSFS_PREFIX, "%s", optarg);
+ break;
+ case 'm':
+ t.mask = atol(optarg);
+@@ -969,10 +970,10 @@ int main(int argc, char *argv[])
+ }
+
+ if (!strcmp(t.sysfs_prefix, ""))
+- snprintf(t.sysfs_prefix, MAX_SYSFS_PATH, "%s", sysfs_prefix);
++ snprintf(t.sysfs_prefix, MAX_SYSFS_PREFIX, "%s", sysfs_prefix);
+
+ if (!strcmp(t.debugfs_prefix, ""))
+- snprintf(t.debugfs_prefix, MAX_SYSFS_PATH, "%s", debugfs_prefix);
++ snprintf(t.debugfs_prefix, MAX_SYSFS_PREFIX, "%s", debugfs_prefix);
+
+ ret = find_loopback_devices(&t);
+ if (ret)
+diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+index 4b363112fa97..adf2937e395b 100644
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -38,6 +38,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
+ {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
+ {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
+ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */
++ {USB_DEVICE(0x2C4E, 0x0102)}, /* MERCUSYS MW150US v2 */
+ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
+ {} /* Terminating entry */
+diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
+index 869f40ebf1a7..d4a74f7ddf6b 100644
+--- a/drivers/staging/speakup/main.c
++++ b/drivers/staging/speakup/main.c
+@@ -561,7 +561,7 @@ static u_long get_word(struct vc_data *vc)
+ return 0;
+ } else if (tmpx < vc->vc_cols - 2 &&
+ (ch == SPACE || ch == 0 || (ch < 0x100 && IS_WDLM(ch))) &&
+- get_char(vc, (u_short *)&tmp_pos + 1, &temp) > SPACE) {
++ get_char(vc, (u_short *)tmp_pos + 1, &temp) > SPACE) {
+ tmp_pos += 2;
+ tmpx++;
+ } else {
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 59675cc7aa01..8689bf7ba60f 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -914,10 +914,10 @@ static int get_serial_info(struct acm *acm, struct serial_struct __user *info)
+ memset(&tmp, 0, sizeof(tmp));
+ tmp.xmit_fifo_size = acm->writesize;
+ tmp.baud_base = le32_to_cpu(acm->line.dwDTERate);
+- tmp.close_delay = acm->port.close_delay / 10;
++ tmp.close_delay = jiffies_to_msecs(acm->port.close_delay) / 10;
+ tmp.closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
+ ASYNC_CLOSING_WAIT_NONE :
+- acm->port.closing_wait / 10;
++ jiffies_to_msecs(acm->port.closing_wait) / 10;
+
+ if (copy_to_user(info, &tmp, sizeof(tmp)))
+ return -EFAULT;
+@@ -930,27 +930,35 @@ static int set_serial_info(struct acm *acm,
+ {
+ struct serial_struct new_serial;
+ unsigned int closing_wait, close_delay;
++ unsigned int old_closing_wait, old_close_delay;
+ int retval = 0;
+
+ if (copy_from_user(&new_serial, newinfo, sizeof(new_serial)))
+ return -EFAULT;
+
+- close_delay = new_serial.close_delay * 10;
++ close_delay = msecs_to_jiffies(new_serial.close_delay * 10);
+ closing_wait = new_serial.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
+- ASYNC_CLOSING_WAIT_NONE : new_serial.closing_wait * 10;
++ ASYNC_CLOSING_WAIT_NONE :
++ msecs_to_jiffies(new_serial.closing_wait * 10);
++
++ /* we must redo the rounding here, so that the values match */
++ old_close_delay = jiffies_to_msecs(acm->port.close_delay) / 10;
++ old_closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
++ ASYNC_CLOSING_WAIT_NONE :
++ jiffies_to_msecs(acm->port.closing_wait) / 10;
+
+ mutex_lock(&acm->port.mutex);
+
+- if (!capable(CAP_SYS_ADMIN)) {
+- if ((close_delay != acm->port.close_delay) ||
+- (closing_wait != acm->port.closing_wait))
++ if ((new_serial.close_delay != old_close_delay) ||
++ (new_serial.closing_wait != old_closing_wait)) {
++ if (!capable(CAP_SYS_ADMIN))
+ retval = -EPERM;
+- else
+- retval = -EOPNOTSUPP;
+- } else {
+- acm->port.close_delay = close_delay;
+- acm->port.closing_wait = closing_wait;
+- }
++ else {
++ acm->port.close_delay = close_delay;
++ acm->port.closing_wait = closing_wait;
++ }
++ } else
++ retval = -EOPNOTSUPP;
+
+ mutex_unlock(&acm->port.mutex);
+ return retval;
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 2dac3e7cdd97..da30b5664ff3 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -378,6 +378,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
+ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+
++ /* Realtek hub in Dell WD19 (Type-C) */
++ { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM },
++
++ /* Generic RTL8153 based ethernet adapters */
++ { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* Action Semiconductor flash disk */
+ { USB_DEVICE(0x10d6, 0x2200), .driver_info =
+ USB_QUIRK_STRING_FETCH_255 },
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 58cf551a1246..d87f48e6b0c7 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -128,7 +128,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_AMD_PLL_FIX;
+
+ if (pdev->vendor == PCI_VENDOR_ID_AMD &&
+- (pdev->device == 0x15e0 ||
++ (pdev->device == 0x145c ||
++ pdev->device == 0x15e0 ||
+ pdev->device == 0x15e1 ||
+ pdev->device == 0x43bb))
+ xhci->quirks |= XHCI_SUSPEND_DELAY;
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index e5da8ce62914..9602241e4371 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -443,6 +443,7 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_match);
+ static struct platform_driver usb_xhci_driver = {
+ .probe = xhci_plat_probe,
+ .remove = xhci_plat_remove,
++ .shutdown = usb_hcd_platform_shutdown,
+ .driver = {
+ .name = "xhci-hcd",
+ .pm = &xhci_plat_pm_ops,
+diff --git a/drivers/usb/host/xhci-trace.h b/drivers/usb/host/xhci-trace.h
+index 88b427434bd8..bc17128208a9 100644
+--- a/drivers/usb/host/xhci-trace.h
++++ b/drivers/usb/host/xhci-trace.h
+@@ -289,23 +289,12 @@ DECLARE_EVENT_CLASS(xhci_log_urb,
+ ),
+ TP_printk("ep%d%s-%s: urb %p pipe %u slot %d length %d/%d sgs %d/%d stream %d flags %08x",
+ __entry->epnum, __entry->dir_in ? "in" : "out",
+- ({ char *s;
+- switch (__entry->type) {
+- case USB_ENDPOINT_XFER_INT:
+- s = "intr";
+- break;
+- case USB_ENDPOINT_XFER_CONTROL:
+- s = "control";
+- break;
+- case USB_ENDPOINT_XFER_BULK:
+- s = "bulk";
+- break;
+- case USB_ENDPOINT_XFER_ISOC:
+- s = "isoc";
+- break;
+- default:
+- s = "UNKNOWN";
+- } s; }), __entry->urb, __entry->pipe, __entry->slot_id,
++ __print_symbolic(__entry->type,
++ { USB_ENDPOINT_XFER_INT, "intr" },
++ { USB_ENDPOINT_XFER_CONTROL, "control" },
++ { USB_ENDPOINT_XFER_BULK, "bulk" },
++ { USB_ENDPOINT_XFER_ISOC, "isoc" }),
++ __entry->urb, __entry->pipe, __entry->slot_id,
+ __entry->actual, __entry->length, __entry->num_mapped_sgs,
+ __entry->num_sgs, __entry->stream, __entry->flags
+ )
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 5b2e246f99da..1d4c370d44fe 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1183,6 +1183,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110a, 0xff), /* Telit ME910G1 */
+ .driver_info = NCTRL(0) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110b, 0xff), /* Telit ME910G1 (ECM) */
++ .driver_info = NCTRL(0) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 5d7b21ea6238..7751b94ac7f5 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -93,6 +93,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LD381_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index b0175f17d1a2..c98db6b650a5 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -124,6 +124,7 @@
+ #define HP_LM920_PRODUCT_ID 0x026b
+ #define HP_TD620_PRODUCT_ID 0x0956
+ #define HP_LD960_PRODUCT_ID 0x0b39
++#define HP_LD381_PRODUCT_ID 0x0f7f
+ #define HP_LCM220_PRODUCT_ID 0x3139
+ #define HP_LCM960_PRODUCT_ID 0x3239
+ #define HP_LD220_PRODUCT_ID 0x3524
+diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c
+index d239fc3c5e3d..eb5151fc8efa 100644
+--- a/drivers/xen/xenbus/xenbus_comms.c
++++ b/drivers/xen/xenbus/xenbus_comms.c
+@@ -313,6 +313,8 @@ static int process_msg(void)
+ req->msg.type = state.msg.type;
+ req->msg.len = state.msg.len;
+ req->body = state.body;
++ /* write body, then update state */
++ virt_wmb();
+ req->state = xb_req_state_got_reply;
+ req->cb(req);
+ } else
+@@ -395,6 +397,8 @@ static int process_writes(void)
+ if (state.req->state == xb_req_state_aborted)
+ kfree(state.req);
+ else {
++ /* write err, then update state */
++ virt_wmb();
+ state.req->state = xb_req_state_got_reply;
+ wake_up(&state.req->wq);
+ }
+diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
+index ddc18da61834..3a06eb699f33 100644
+--- a/drivers/xen/xenbus/xenbus_xs.c
++++ b/drivers/xen/xenbus/xenbus_xs.c
+@@ -191,8 +191,11 @@ static bool xenbus_ok(void)
+
+ static bool test_reply(struct xb_req_data *req)
+ {
+- if (req->state == xb_req_state_got_reply || !xenbus_ok())
++ if (req->state == xb_req_state_got_reply || !xenbus_ok()) {
++ /* read req->state before all other fields */
++ virt_rmb();
+ return true;
++ }
+
+ /* Make sure to reread req->state each time. */
+ barrier();
+@@ -202,7 +205,7 @@ static bool test_reply(struct xb_req_data *req)
+
+ static void *read_reply(struct xb_req_data *req)
+ {
+- while (req->state != xb_req_state_got_reply) {
++ do {
+ wait_event(req->wq, test_reply(req));
+
+ if (!xenbus_ok())
+@@ -216,7 +219,7 @@ static void *read_reply(struct xb_req_data *req)
+ if (req->err)
+ return ERR_PTR(req->err);
+
+- }
++ } while (req->state != xb_req_state_got_reply);
+
+ return req->body;
+ }
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index dec508a28ffa..c69e5b255745 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -10015,6 +10015,10 @@ out_fail:
+ ret = btrfs_sync_log(trans, BTRFS_I(old_inode)->root, &ctx);
+ if (ret)
+ commit_transaction = true;
++ } else if (sync_log) {
++ mutex_lock(&root->log_mutex);
++ list_del(&ctx.list);
++ mutex_unlock(&root->log_mutex);
+ }
+ if (commit_transaction) {
+ ret = btrfs_commit_transaction(trans);
+diff --git a/fs/inode.c b/fs/inode.c
+index 9c50521c9fe4..c9eb5041ffae 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -136,6 +136,7 @@ int inode_init_always(struct super_block *sb, struct inode *inode)
+ inode->i_sb = sb;
+ inode->i_blkbits = sb->s_blocksize_bits;
+ inode->i_flags = 0;
++ atomic64_set(&inode->i_sequence, 0);
+ atomic_set(&inode->i_count, 1);
+ inode->i_op = &empty_iops;
+ inode->i_fop = &no_open_fops;
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 92420009b9bc..15b8e02880c3 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -663,6 +663,7 @@ struct inode {
+ struct rcu_head i_rcu;
+ };
+ atomic64_t i_version;
++ atomic64_t i_sequence; /* see futex */
+ atomic_t i_count;
+ atomic_t i_dio_count;
+ atomic_t i_writecount;
+diff --git a/include/linux/futex.h b/include/linux/futex.h
+index ccaef0097785..a61bf436dcf3 100644
+--- a/include/linux/futex.h
++++ b/include/linux/futex.h
+@@ -29,23 +29,26 @@ struct task_struct;
+
+ union futex_key {
+ struct {
++ u64 i_seq;
+ unsigned long pgoff;
+- struct inode *inode;
+- int offset;
++ unsigned int offset;
+ } shared;
+ struct {
++ union {
++ struct mm_struct *mm;
++ u64 __tmp;
++ };
+ unsigned long address;
+- struct mm_struct *mm;
+- int offset;
++ unsigned int offset;
+ } private;
+ struct {
++ u64 ptr;
+ unsigned long word;
+- void *ptr;
+- int offset;
++ unsigned int offset;
+ } both;
+ };
+
+-#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = NULL } }
++#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = 0ULL } }
+
+ #ifdef CONFIG_FUTEX
+ extern void exit_robust_list(struct task_struct *curr);
+diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
+index 3f066ce63a63..f6e9433663a9 100644
+--- a/include/linux/page-flags.h
++++ b/include/linux/page-flags.h
+@@ -271,7 +271,7 @@ static inline int TestClearPage##uname(struct page *page) { return 0; }
+
+ __PAGEFLAG(Locked, locked, PF_NO_TAIL)
+ PAGEFLAG(Waiters, waiters, PF_ONLY_HEAD) __CLEARPAGEFLAG(Waiters, waiters, PF_ONLY_HEAD)
+-PAGEFLAG(Error, error, PF_NO_COMPOUND) TESTCLEARFLAG(Error, error, PF_NO_COMPOUND)
++PAGEFLAG(Error, error, PF_NO_TAIL) TESTCLEARFLAG(Error, error, PF_NO_TAIL)
+ PAGEFLAG(Referenced, referenced, PF_HEAD)
+ TESTCLEARFLAG(Referenced, referenced, PF_HEAD)
+ __SETPAGEFLAG(Referenced, referenced, PF_HEAD)
+diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
+index 398e9c95cd61..6ae8dd1d784f 100644
+--- a/include/linux/vmalloc.h
++++ b/include/linux/vmalloc.h
+@@ -107,8 +107,9 @@ extern int remap_vmalloc_range_partial(struct vm_area_struct *vma,
+
+ extern int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
+ unsigned long pgoff);
+-void vmalloc_sync_all(void);
+-
++void vmalloc_sync_mappings(void);
++void vmalloc_sync_unmappings(void);
++
+ /*
+ * Lowlevel-APIs (not for driver use!)
+ */
+diff --git a/kernel/futex.c b/kernel/futex.c
+index e75ad30aa7bc..920d853a8e9e 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -395,9 +395,9 @@ static inline int hb_waiters_pending(struct futex_hash_bucket *hb)
+ */
+ static struct futex_hash_bucket *hash_futex(union futex_key *key)
+ {
+- u32 hash = jhash2((u32*)&key->both.word,
+- (sizeof(key->both.word)+sizeof(key->both.ptr))/4,
++ u32 hash = jhash2((u32 *)key, offsetof(typeof(*key), both.offset) / 4,
+ key->both.offset);
++
+ return &futex_queues[hash & (futex_hashsize - 1)];
+ }
+
+@@ -439,7 +439,7 @@ static void get_futex_key_refs(union futex_key *key)
+
+ switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
+ case FUT_OFF_INODE:
+- ihold(key->shared.inode); /* implies smp_mb(); (B) */
++ smp_mb(); /* explicit smp_mb(); (B) */
+ break;
+ case FUT_OFF_MMSHARED:
+ futex_get_mm(key); /* implies smp_mb(); (B) */
+@@ -473,7 +473,6 @@ static void drop_futex_key_refs(union futex_key *key)
+
+ switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
+ case FUT_OFF_INODE:
+- iput(key->shared.inode);
+ break;
+ case FUT_OFF_MMSHARED:
+ mmdrop(key->private.mm);
+@@ -481,6 +480,46 @@ static void drop_futex_key_refs(union futex_key *key)
+ }
+ }
+
++/*
++ * Generate a machine wide unique identifier for this inode.
++ *
++ * This relies on u64 not wrapping in the life-time of the machine; which with
++ * 1ns resolution means almost 585 years.
++ *
++ * This further relies on the fact that a well formed program will not unmap
++ * the file while it has a (shared) futex waiting on it. This mapping will have
++ * a file reference which pins the mount and inode.
++ *
++ * If for some reason an inode gets evicted and read back in again, it will get
++ * a new sequence number and will _NOT_ match, even though it is the exact same
++ * file.
++ *
++ * It is important that match_futex() will never have a false-positive, esp.
++ * for PI futexes that can mess up the state. The above argues that false-negatives
++ * are only possible for malformed programs.
++ */
++static u64 get_inode_sequence_number(struct inode *inode)
++{
++ static atomic64_t i_seq;
++ u64 old;
++
++ /* Does the inode already have a sequence number? */
++ old = atomic64_read(&inode->i_sequence);
++ if (likely(old))
++ return old;
++
++ for (;;) {
++ u64 new = atomic64_add_return(1, &i_seq);
++ if (WARN_ON_ONCE(!new))
++ continue;
++
++ old = atomic64_cmpxchg_relaxed(&inode->i_sequence, 0, new);
++ if (old)
++ return old;
++ return new;
++ }
++}
++
+ /**
+ * get_futex_key() - Get parameters which are the keys for a futex
+ * @uaddr: virtual address of the futex
+@@ -493,9 +532,15 @@ static void drop_futex_key_refs(union futex_key *key)
+ *
+ * The key words are stored in @key on success.
+ *
+- * For shared mappings, it's (page->index, file_inode(vma->vm_file),
+- * offset_within_page). For private mappings, it's (uaddr, current->mm).
+- * We can usually work out the index without swapping in the page.
++ * For shared mappings (when @fshared), the key is:
++ * ( inode->i_sequence, page->index, offset_within_page )
++ * [ also see get_inode_sequence_number() ]
++ *
++ * For private mappings (or when !@fshared), the key is:
++ * ( current->mm, address, 0 )
++ *
++ * This allows (cross process, where applicable) identification of the futex
++ * without keeping the page pinned for the duration of the FUTEX_WAIT.
+ *
+ * lock_page() might sleep, the caller should not hold a spinlock.
+ */
+@@ -635,8 +680,6 @@ again:
+ key->private.mm = mm;
+ key->private.address = address;
+
+- get_futex_key_refs(key); /* implies smp_mb(); (B) */
+-
+ } else {
+ struct inode *inode;
+
+@@ -668,40 +711,14 @@ again:
+ goto again;
+ }
+
+- /*
+- * Take a reference unless it is about to be freed. Previously
+- * this reference was taken by ihold under the page lock
+- * pinning the inode in place so i_lock was unnecessary. The
+- * only way for this check to fail is if the inode was
+- * truncated in parallel which is almost certainly an
+- * application bug. In such a case, just retry.
+- *
+- * We are not calling into get_futex_key_refs() in file-backed
+- * cases, therefore a successful atomic_inc return below will
+- * guarantee that get_futex_key() will still imply smp_mb(); (B).
+- */
+- if (!atomic_inc_not_zero(&inode->i_count)) {
+- rcu_read_unlock();
+- put_page(page);
+-
+- goto again;
+- }
+-
+- /* Should be impossible but lets be paranoid for now */
+- if (WARN_ON_ONCE(inode->i_mapping != mapping)) {
+- err = -EFAULT;
+- rcu_read_unlock();
+- iput(inode);
+-
+- goto out;
+- }
+-
+ key->both.offset |= FUT_OFF_INODE; /* inode-based key */
+- key->shared.inode = inode;
++ key->shared.i_seq = get_inode_sequence_number(inode);
+ key->shared.pgoff = basepage_index(tail);
+ rcu_read_unlock();
+ }
+
++ get_futex_key_refs(key); /* implies smp_mb(); (B) */
++
+ out:
+ put_page(page);
+ return err;
+diff --git a/kernel/notifier.c b/kernel/notifier.c
+index 6196af8a8223..59a1e9b48a6a 100644
+--- a/kernel/notifier.c
++++ b/kernel/notifier.c
+@@ -552,7 +552,7 @@ NOKPROBE_SYMBOL(notify_die);
+
+ int register_die_notifier(struct notifier_block *nb)
+ {
+- vmalloc_sync_all();
++ vmalloc_sync_mappings();
+ return atomic_notifier_chain_register(&die_chain, nb);
+ }
+ EXPORT_SYMBOL_GPL(register_die_notifier);
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 6ecb47c08665..3b78b6af353b 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3759,7 +3759,7 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg,
+ struct mem_cgroup_thresholds *thresholds;
+ struct mem_cgroup_threshold_ary *new;
+ unsigned long usage;
+- int i, j, size;
++ int i, j, size, entries;
+
+ mutex_lock(&memcg->thresholds_lock);
+
+@@ -3779,14 +3779,20 @@ static void __mem_cgroup_usage_unregister_event(struct mem_cgroup *memcg,
+ __mem_cgroup_threshold(memcg, type == _MEMSWAP);
+
+ /* Calculate new number of threshold */
+- size = 0;
++ size = entries = 0;
+ for (i = 0; i < thresholds->primary->size; i++) {
+ if (thresholds->primary->entries[i].eventfd != eventfd)
+ size++;
++ else
++ entries++;
+ }
+
+ new = thresholds->spare;
+
++ /* If no items related to eventfd have been cleared, nothing to do */
++ if (!entries)
++ goto unlock;
++
+ /* Set thresholds array to NULL if we don't have thresholds */
+ if (!size) {
+ kfree(new);
+diff --git a/mm/nommu.c b/mm/nommu.c
+index 1d63ecfc98c5..86e1da96bc13 100644
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -446,10 +446,14 @@ void vm_unmap_aliases(void)
+ EXPORT_SYMBOL_GPL(vm_unmap_aliases);
+
+ /*
+- * Implement a stub for vmalloc_sync_all() if the architecture chose not to
+- * have one.
++ * Implement a stub for vmalloc_sync_[un]mapping() if the architecture
++ * chose not to have one.
+ */
+-void __weak vmalloc_sync_all(void)
++void __weak vmalloc_sync_mappings(void)
++{
++}
++
++void __weak vmalloc_sync_unmappings(void)
+ {
+ }
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 764a1023ed87..9b7b989273d4 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1906,8 +1906,6 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node,
+
+ if (node == NUMA_NO_NODE)
+ searchnode = numa_mem_id();
+- else if (!node_present_pages(node))
+- searchnode = node_to_mem_node(node);
+
+ object = get_partial_node(s, get_node(s, searchnode), c, flags);
+ if (object || node != NUMA_NO_NODE)
+@@ -2504,17 +2502,27 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
+ struct page *page;
+
+ page = c->page;
+- if (!page)
++ if (!page) {
++ /*
++ * if the node is not online or has no normal memory, just
++ * ignore the node constraint
++ */
++ if (unlikely(node != NUMA_NO_NODE &&
++ !node_state(node, N_NORMAL_MEMORY)))
++ node = NUMA_NO_NODE;
+ goto new_slab;
++ }
+ redo:
+
+ if (unlikely(!node_match(page, node))) {
+- int searchnode = node;
+-
+- if (node != NUMA_NO_NODE && !node_present_pages(node))
+- searchnode = node_to_mem_node(node);
+-
+- if (unlikely(!node_match(page, searchnode))) {
++ /*
++ * same as above but node_match() being false already
++ * implies node != NUMA_NO_NODE
++ */
++ if (!node_state(node, N_NORMAL_MEMORY)) {
++ node = NUMA_NO_NODE;
++ goto redo;
++ } else {
+ stat(s, ALLOC_NODE_MISMATCH);
+ deactivate_slab(s, page, c->freelist, c);
+ goto new_slab;
+@@ -2926,11 +2934,13 @@ redo:
+ barrier();
+
+ if (likely(page == c->page)) {
+- set_freepointer(s, tail_obj, c->freelist);
++ void **freelist = READ_ONCE(c->freelist);
++
++ set_freepointer(s, tail_obj, freelist);
+
+ if (unlikely(!this_cpu_cmpxchg_double(
+ s->cpu_slab->freelist, s->cpu_slab->tid,
+- c->freelist, tid,
++ freelist, tid,
+ head, next_tid(tid)))) {
+
+ note_cmpxchg_failure("slab_free", s, tid);
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index d8e877365f9f..958d6ba9ee2d 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1755,7 +1755,7 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
+ * First make sure the mappings are removed from all page-tables
+ * before they are freed.
+ */
+- vmalloc_sync_all();
++ vmalloc_sync_unmappings();
+
+ /*
+ * In this function, newly allocated vm_struct has VM_UNINITIALIZED
+@@ -2300,16 +2300,19 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
+ EXPORT_SYMBOL(remap_vmalloc_range);
+
+ /*
+- * Implement a stub for vmalloc_sync_all() if the architecture chose not to
+- * have one.
++ * Implement stubs for vmalloc_sync_[un]mappings () if the architecture chose
++ * not to have one.
+ *
+ * The purpose of this function is to make sure the vmalloc area
+ * mappings are identical in all page-tables in the system.
+ */
+-void __weak vmalloc_sync_all(void)
++void __weak vmalloc_sync_mappings(void)
+ {
+ }
+
++void __weak vmalloc_sync_unmappings(void)
++{
++}
+
+ static int f(pte_t *pte, pgtable_t table, unsigned long addr, void *data)
+ {
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index c5f4e89b6ff3..7b0c2498f461 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -734,7 +734,6 @@ static void tcp_v6_init_req(struct request_sock *req,
+ const struct sock *sk_listener,
+ struct sk_buff *skb)
+ {
+- bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags);
+ struct inet_request_sock *ireq = inet_rsk(req);
+ const struct ipv6_pinfo *np = inet6_sk(sk_listener);
+
+@@ -742,7 +741,7 @@ static void tcp_v6_init_req(struct request_sock *req,
+ ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
+
+ /* So that link locals have meaning */
+- if ((!sk_listener->sk_bound_dev_if || l3_slave) &&
++ if (!sk_listener->sk_bound_dev_if &&
+ ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
+ ireq->ir_iif = tcp_v6_iif(skb);
+
+diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
+index 8d5357053f86..486e135d3e30 100644
+--- a/scripts/Makefile.extrawarn
++++ b/scripts/Makefile.extrawarn
+@@ -72,5 +72,6 @@ KBUILD_CFLAGS += $(call cc-disable-warning, format)
+ KBUILD_CFLAGS += $(call cc-disable-warning, sign-compare)
+ KBUILD_CFLAGS += $(call cc-disable-warning, format-zero-length)
+ KBUILD_CFLAGS += $(call cc-disable-warning, uninitialized)
++KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast)
+ endif
+ endif
+diff --git a/scripts/parse-maintainers.pl b/scripts/parse-maintainers.pl
+old mode 100644
+new mode 100755
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index 31cb2acf8afc..732bbede7ebf 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->next) {
+ if (plugin->dst_frames)
+ frames = plugin->dst_frames(plugin, frames);
+- if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
++ if ((snd_pcm_sframes_t)frames <= 0)
+ return -ENXIO;
+ plugin = plugin->next;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->prev) {
+ if (plugin->src_frames)
+ frames = plugin->src_frames(plugin, frames);
+- if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
++ if ((snd_pcm_sframes_t)frames <= 0)
+ return -ENXIO;
+ plugin = plugin->prev;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+@@ -209,6 +209,8 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p
+ if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ plugin = snd_pcm_plug_last(plug);
+ while (plugin && drv_frames > 0) {
++ if (drv_frames > plugin->buf_frames)
++ drv_frames = plugin->buf_frames;
+ plugin_prev = plugin->prev;
+ if (plugin->src_frames)
+ drv_frames = plugin->src_frames(plugin, drv_frames);
+@@ -220,6 +222,8 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p
+ plugin_next = plugin->next;
+ if (plugin->dst_frames)
+ drv_frames = plugin->dst_frames(plugin, drv_frames);
++ if (drv_frames > plugin->buf_frames)
++ drv_frames = plugin->buf_frames;
+ plugin = plugin_next;
+ }
+ } else
+@@ -248,11 +252,15 @@ snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug, snd_pc
+ if (frames < 0)
+ return frames;
+ }
++ if (frames > plugin->buf_frames)
++ frames = plugin->buf_frames;
+ plugin = plugin_next;
+ }
+ } else if (stream == SNDRV_PCM_STREAM_CAPTURE) {
+ plugin = snd_pcm_plug_last(plug);
+ while (plugin) {
++ if (frames > plugin->buf_frames)
++ frames = plugin->buf_frames;
+ plugin_prev = plugin->prev;
+ if (plugin->src_frames) {
+ frames = plugin->src_frames(plugin, frames);
+diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
+index 0d5f8b16d057..b7bef25b34cc 100644
+--- a/sound/core/seq/oss/seq_oss_midi.c
++++ b/sound/core/seq/oss/seq_oss_midi.c
+@@ -615,6 +615,7 @@ send_midi_event(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, struct seq
+ len = snd_seq_oss_timer_start(dp->timer);
+ if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
+ snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev);
++ snd_midi_event_reset_decode(mdev->coder);
+ } else {
+ len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev);
+ if (len > 0)
+diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
+index cb988efd1ed0..af9af89a44d4 100644
+--- a/sound/core/seq/seq_virmidi.c
++++ b/sound/core/seq/seq_virmidi.c
+@@ -95,6 +95,7 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
+ if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
+ continue;
+ snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream);
++ snd_midi_event_reset_decode(vmidi->parser);
+ } else {
+ len = snd_midi_event_decode(vmidi->parser, msg, sizeof(msg), ev);
+ if (len > 0)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 86ab022f386e..23aab2fdac46 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7828,6 +7828,8 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->gen.mixer_nid = 0;
+ break;
+ case 0x10ec0225:
++ codec->power_save_node = 1;
++ /* fall through */
+ case 0x10ec0295:
+ case 0x10ec0299:
+ spec->codec_variant = ALC269_TYPE_ALC225;
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index bbcb0d4d83ae..0193d4989107 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -320,7 +320,7 @@ static void line6_data_received(struct urb *urb)
+ line6_midibuf_read(mb, line6->buffer_message,
+ LINE6_MIDI_MESSAGE_MAXLEN);
+
+- if (done == 0)
++ if (done <= 0)
+ break;
+
+ line6->message_length = done;
+diff --git a/sound/usb/line6/midibuf.c b/sound/usb/line6/midibuf.c
+index 36a610ba342e..c931d48801eb 100644
+--- a/sound/usb/line6/midibuf.c
++++ b/sound/usb/line6/midibuf.c
+@@ -163,7 +163,7 @@ int line6_midibuf_read(struct midi_buffer *this, unsigned char *data,
+ int midi_length_prev =
+ midibuf_message_length(this->command_prev);
+
+- if (midi_length_prev > 0) {
++ if (midi_length_prev > 1) {
+ midi_length = midi_length_prev - 1;
+ repeat = 1;
+ } else
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-04-02 15:24 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-04-02 15:24 UTC (permalink / raw
To: gentoo-commits
commit: fd5746a92ae302dc305683a6ef9fd4802b08a829
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Apr 2 15:24:34 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Apr 2 15:24:34 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=fd5746a9
Linux patch 4.19.114
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1113_linux-4.19.114.patch | 3587 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3591 insertions(+)
diff --git a/0000_README b/0000_README
index a53677c..99fb8b5 100644
--- a/0000_README
+++ b/0000_README
@@ -491,6 +491,10 @@ Patch: 1112_linux-4.19.113.patch
From: https://www.kernel.org
Desc: Linux 4.19.113
+Patch: 1113_linux-4.19.114.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.114
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1113_linux-4.19.114.patch b/1113_linux-4.19.114.patch
new file mode 100644
index 0000000..7ea62ad
--- /dev/null
+++ b/1113_linux-4.19.114.patch
@@ -0,0 +1,3587 @@
+diff --git a/Documentation/devicetree/bindings/net/fsl-fman.txt b/Documentation/devicetree/bindings/net/fsl-fman.txt
+index 299c0dcd67db..1316f0aec0cf 100644
+--- a/Documentation/devicetree/bindings/net/fsl-fman.txt
++++ b/Documentation/devicetree/bindings/net/fsl-fman.txt
+@@ -110,6 +110,13 @@ PROPERTIES
+ Usage: required
+ Definition: See soc/fsl/qman.txt and soc/fsl/bman.txt
+
++- fsl,erratum-a050385
++ Usage: optional
++ Value type: boolean
++ Definition: A boolean property. Indicates the presence of the
++ erratum A050385 which indicates that DMA transactions that are
++ split can result in a FMan lock.
++
+ =============================================================================
+ FMan MURAM Node
+
+diff --git a/Makefile b/Makefile
+index 61bfe5519a16..6f849dafbfec 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 113
++SUBLEVEL = 114
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+index b7f79f1c431a..5fcadb9cf992 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+@@ -118,6 +118,7 @@
+ &sdhci {
+ #address-cells = <1>;
+ #size-cells = <0>;
++ pinctrl-names = "default";
+ pinctrl-0 = <&emmc_gpio34 &gpclk2_gpio43>;
+ mmc-pwrseq = <&wifi_pwrseq>;
+ non-removable;
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index c1ef3201950a..e97ef16ce68a 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -150,6 +150,7 @@
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges = <0x0 0x0 0x0 0xc0000000>;
++ dma-ranges = <0x80000000 0x0 0x80000000 0x80000000>;
+ ti,hwmods = "l3_main_1", "l3_main_2";
+ reg = <0x0 0x44000000 0x0 0x1000000>,
+ <0x0 0x45000000 0x0 0x1000>;
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi
+index 881cea0b61ba..31fa37d2fe47 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi
+@@ -107,14 +107,14 @@
+ regulators {
+ vdd_arm: buck1 {
+ regulator-name = "vdd_arm";
+- regulator-min-microvolt = <730000>;
++ regulator-min-microvolt = <925000>;
+ regulator-max-microvolt = <1380000>;
+ regulator-always-on;
+ };
+
+ vdd_soc: buck2 {
+ regulator-name = "vdd_soc";
+- regulator-min-microvolt = <730000>;
++ regulator-min-microvolt = <1150000>;
+ regulator-max-microvolt = <1380000>;
+ regulator-always-on;
+ };
+diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
+index 37785e7d1238..00b2eb8c3195 100644
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -852,34 +852,46 @@
+ compatible = "ti,omap2-onenand";
+ reg = <0 0 0x20000>; /* CS0, offset 0, IO size 128K */
+
++ /*
++ * These timings are based on CONFIG_OMAP_GPMC_DEBUG=y reported
++ * bootloader set values when booted with v5.1
++ * (OneNAND Manufacturer: Samsung):
++ *
++ * cs0 GPMC_CS_CONFIG1: 0xfb001202
++ * cs0 GPMC_CS_CONFIG2: 0x00111100
++ * cs0 GPMC_CS_CONFIG3: 0x00020200
++ * cs0 GPMC_CS_CONFIG4: 0x11001102
++ * cs0 GPMC_CS_CONFIG5: 0x03101616
++ * cs0 GPMC_CS_CONFIG6: 0x90060000
++ */
+ gpmc,sync-read;
+ gpmc,sync-write;
+ gpmc,burst-length = <16>;
+ gpmc,burst-read;
+ gpmc,burst-wrap;
+ gpmc,burst-write;
+- gpmc,device-width = <2>; /* GPMC_DEVWIDTH_16BIT */
+- gpmc,mux-add-data = <2>; /* GPMC_MUX_AD */
++ gpmc,device-width = <2>;
++ gpmc,mux-add-data = <2>;
+ gpmc,cs-on-ns = <0>;
+- gpmc,cs-rd-off-ns = <87>;
+- gpmc,cs-wr-off-ns = <87>;
++ gpmc,cs-rd-off-ns = <102>;
++ gpmc,cs-wr-off-ns = <102>;
+ gpmc,adv-on-ns = <0>;
+- gpmc,adv-rd-off-ns = <10>;
+- gpmc,adv-wr-off-ns = <10>;
+- gpmc,oe-on-ns = <15>;
+- gpmc,oe-off-ns = <87>;
++ gpmc,adv-rd-off-ns = <12>;
++ gpmc,adv-wr-off-ns = <12>;
++ gpmc,oe-on-ns = <12>;
++ gpmc,oe-off-ns = <102>;
+ gpmc,we-on-ns = <0>;
+- gpmc,we-off-ns = <87>;
+- gpmc,rd-cycle-ns = <112>;
+- gpmc,wr-cycle-ns = <112>;
+- gpmc,access-ns = <81>;
+- gpmc,page-burst-access-ns = <15>;
++ gpmc,we-off-ns = <102>;
++ gpmc,rd-cycle-ns = <132>;
++ gpmc,wr-cycle-ns = <132>;
++ gpmc,access-ns = <96>;
++ gpmc,page-burst-access-ns = <18>;
+ gpmc,bus-turnaround-ns = <0>;
+ gpmc,cycle2cycle-delay-ns = <0>;
+ gpmc,wait-monitoring-ns = <0>;
+- gpmc,clk-activation-ns = <5>;
+- gpmc,wr-data-mux-bus-ns = <30>;
+- gpmc,wr-access-ns = <81>;
++ gpmc,clk-activation-ns = <6>;
++ gpmc,wr-data-mux-bus-ns = <36>;
++ gpmc,wr-access-ns = <96>;
+ gpmc,sync-clk-ps = <15000>;
+
+ /*
+diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
+index 574ac11c0489..3c0bafe0fb05 100644
+--- a/arch/arm/boot/dts/omap5.dtsi
++++ b/arch/arm/boot/dts/omap5.dtsi
+@@ -144,6 +144,7 @@
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges = <0 0 0 0xc0000000>;
++ dma-ranges = <0x80000000 0x0 0x80000000 0x80000000>;
+ ti,hwmods = "l3_main_1", "l3_main_2", "l3_main_3";
+ reg = <0 0x44000000 0 0x2000>,
+ <0 0x44800000 0 0x3000>,
+diff --git a/arch/arm/boot/dts/ox810se.dtsi b/arch/arm/boot/dts/ox810se.dtsi
+index c2b48a1838eb..6ebad0e80b9c 100644
+--- a/arch/arm/boot/dts/ox810se.dtsi
++++ b/arch/arm/boot/dts/ox810se.dtsi
+@@ -322,8 +322,8 @@
+ interrupt-controller;
+ reg = <0 0x200>;
+ #interrupt-cells = <1>;
+- valid-mask = <0xFFFFFFFF>;
+- clear-mask = <0>;
++ valid-mask = <0xffffffff>;
++ clear-mask = <0xffffffff>;
+ };
+
+ timer0: timer@200 {
+diff --git a/arch/arm/boot/dts/ox820.dtsi b/arch/arm/boot/dts/ox820.dtsi
+index 085bbd33eadc..f7dddfb01f81 100644
+--- a/arch/arm/boot/dts/ox820.dtsi
++++ b/arch/arm/boot/dts/ox820.dtsi
+@@ -239,8 +239,8 @@
+ reg = <0 0x200>;
+ interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
+ #interrupt-cells = <1>;
+- valid-mask = <0xFFFFFFFF>;
+- clear-mask = <0>;
++ valid-mask = <0xffffffff>;
++ clear-mask = <0xffffffff>;
+ };
+
+ timer0: timer@200 {
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi
+index 6082ae022136..d237162a8744 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi
+@@ -20,6 +20,8 @@
+ };
+
+ &fman0 {
++ fsl,erratum-a050385;
++
+ /* these aliases provide the FMan ports mapping */
+ enet0: ethernet@e0000 {
+ };
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a-rdb.dts b/arch/arm64/boot/dts/freescale/fsl-ls1043a-rdb.dts
+index 7b01ba8d3b7e..2dcec0a75550 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1043a-rdb.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a-rdb.dts
+@@ -118,12 +118,12 @@
+
+ ethernet@e4000 {
+ phy-handle = <&rgmii_phy1>;
+- phy-connection-type = "rgmii-txid";
++ phy-connection-type = "rgmii-id";
+ };
+
+ ethernet@e6000 {
+ phy-handle = <&rgmii_phy2>;
+- phy-connection-type = "rgmii-txid";
++ phy-connection-type = "rgmii-id";
+ };
+
+ ethernet@e8000 {
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
+index a59b48203688..d4f37b9aef8e 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
+@@ -125,12 +125,12 @@
+ &fman0 {
+ ethernet@e4000 {
+ phy-handle = <&rgmii_phy1>;
+- phy-connection-type = "rgmii";
++ phy-connection-type = "rgmii-id";
+ };
+
+ ethernet@e6000 {
+ phy-handle = <&rgmii_phy2>;
+- phy-connection-type = "rgmii";
++ phy-connection-type = "rgmii-id";
+ };
+
+ ethernet@e8000 {
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+index 887a8512bf10..1a7ba3de7079 100644
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -221,7 +221,7 @@ alternative_endif
+
+ .macro user_alt, label, oldinstr, newinstr, cond
+ 9999: alternative_insn "\oldinstr", "\newinstr", \cond
+- _ASM_EXTABLE 9999b, \label
++ _asm_extable 9999b, \label
+ .endm
+
+ /*
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index 5790671857e5..32b63b30ec40 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -35,6 +35,7 @@
+ #ifdef CONFIG_DYNAMIC_FTRACE
+
+ int ftrace_arch_code_modify_prepare(void)
++ __acquires(&text_mutex)
+ {
+ mutex_lock(&text_mutex);
+ set_kernel_text_rw();
+@@ -43,6 +44,7 @@ int ftrace_arch_code_modify_prepare(void)
+ }
+
+ int ftrace_arch_code_modify_post_process(void)
++ __releases(&text_mutex)
+ {
+ set_all_modules_text_ro();
+ set_kernel_text_ro();
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index bbc8710704e2..8df0ec85cc7b 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -409,6 +409,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/
+ { PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/
+ { PCI_VDEVICE(INTEL, 0xa356), board_ahci }, /* Cannon Lake PCH-H RAID */
++ { PCI_VDEVICE(INTEL, 0x06d7), board_ahci }, /* Comet Lake-H RAID */
+ { PCI_VDEVICE(INTEL, 0x0f22), board_ahci_mobile }, /* Bay Trail AHCI */
+ { PCI_VDEVICE(INTEL, 0x0f23), board_ahci_mobile }, /* Bay Trail AHCI */
+ { PCI_VDEVICE(INTEL, 0x22a3), board_ahci_mobile }, /* Cherry Tr. AHCI */
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index d872dc82725e..18f5973b9697 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -24,18 +24,21 @@
+
+ #include "gpiolib.h"
+
+-#define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l
+-#define QUIRK_NO_WAKEUP 0x02l
+-
+ static int run_edge_events_on_boot = -1;
+ module_param(run_edge_events_on_boot, int, 0444);
+ MODULE_PARM_DESC(run_edge_events_on_boot,
+ "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto");
+
+-static int honor_wakeup = -1;
+-module_param(honor_wakeup, int, 0444);
+-MODULE_PARM_DESC(honor_wakeup,
+- "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto");
++static char *ignore_wake;
++module_param(ignore_wake, charp, 0444);
++MODULE_PARM_DESC(ignore_wake,
++ "controller@pin combos on which to ignore the ACPI wake flag "
++ "ignore_wake=controller@pin[,controller@pin[,...]]");
++
++struct acpi_gpiolib_dmi_quirk {
++ bool no_edge_events_on_boot;
++ char *ignore_wake;
++};
+
+ /**
+ * struct acpi_gpio_event - ACPI GPIO event handler data
+@@ -205,6 +208,57 @@ static void acpi_gpiochip_request_irqs(struct acpi_gpio_chip *acpi_gpio)
+ acpi_gpiochip_request_irq(acpi_gpio, event);
+ }
+
++static bool acpi_gpio_in_ignore_list(const char *controller_in, int pin_in)
++{
++ const char *controller, *pin_str;
++ int len, pin;
++ char *endp;
++
++ controller = ignore_wake;
++ while (controller) {
++ pin_str = strchr(controller, '@');
++ if (!pin_str)
++ goto err;
++
++ len = pin_str - controller;
++ if (len == strlen(controller_in) &&
++ strncmp(controller, controller_in, len) == 0) {
++ pin = simple_strtoul(pin_str + 1, &endp, 10);
++ if (*endp != 0 && *endp != ',')
++ goto err;
++
++ if (pin == pin_in)
++ return true;
++ }
++
++ controller = strchr(controller, ',');
++ if (controller)
++ controller++;
++ }
++
++ return false;
++err:
++ pr_err_once("Error invalid value for gpiolib_acpi.ignore_wake: %s\n",
++ ignore_wake);
++ return false;
++}
++
++static bool acpi_gpio_irq_is_wake(struct device *parent,
++ struct acpi_resource_gpio *agpio)
++{
++ int pin = agpio->pin_table[0];
++
++ if (agpio->wake_capable != ACPI_WAKE_CAPABLE)
++ return false;
++
++ if (acpi_gpio_in_ignore_list(dev_name(parent), pin)) {
++ dev_info(parent, "Ignoring wakeup on pin %d\n", pin);
++ return false;
++ }
++
++ return true;
++}
++
+ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares,
+ void *context)
+ {
+@@ -286,7 +340,7 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares,
+ event->handle = evt_handle;
+ event->handler = handler;
+ event->irq = irq;
+- event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE;
++ event->irq_is_wake = acpi_gpio_irq_is_wake(chip->parent, agpio);
+ event->pin = pin;
+ event->desc = desc;
+
+@@ -1282,7 +1336,9 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "MINIX"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"),
+ },
+- .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT,
++ .driver_data = &(struct acpi_gpiolib_dmi_quirk) {
++ .no_edge_events_on_boot = true,
++ },
+ },
+ {
+ /*
+@@ -1295,16 +1351,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"),
+ },
+- .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT,
++ .driver_data = &(struct acpi_gpiolib_dmi_quirk) {
++ .no_edge_events_on_boot = true,
++ },
+ },
+ {
+ /*
+- * Various HP X2 10 Cherry Trail models use an external
+- * embedded-controller connected via I2C + an ACPI GPIO
+- * event handler. The embedded controller generates various
+- * spurious wakeup events when suspended. So disable wakeup
+- * for its handler (it uses the only ACPI GPIO event handler).
+- * This breaks wakeup when opening the lid, the user needs
++ * HP X2 10 models with Cherry Trail SoC + TI PMIC use an
++ * external embedded-controller connected via I2C + an ACPI GPIO
++ * event handler on INT33FF:01 pin 0, causing spurious wakeups.
++ * When suspending by closing the LID, the power to the USB
++ * keyboard is turned off, causing INT0002 ACPI events to
++ * trigger once the XHCI controller notices the keyboard is
++ * gone. So INT0002 events cause spurious wakeups too. Ignoring
++ * EC wakes breaks wakeup when opening the lid, the user needs
+ * to press the power-button to wakeup the system. The
+ * alternative is suspend simply not working, which is worse.
+ */
+@@ -1312,33 +1372,61 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"),
+ },
+- .driver_data = (void *)QUIRK_NO_WAKEUP,
++ .driver_data = &(struct acpi_gpiolib_dmi_quirk) {
++ .ignore_wake = "INT33FF:01@0,INT0002:00@2",
++ },
++ },
++ {
++ /*
++ * HP X2 10 models with Bay Trail SoC + AXP288 PMIC use an
++ * external embedded-controller connected via I2C + an ACPI GPIO
++ * event handler on INT33FC:02 pin 28, causing spurious wakeups.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++ DMI_MATCH(DMI_BOARD_NAME, "815D"),
++ },
++ .driver_data = &(struct acpi_gpiolib_dmi_quirk) {
++ .ignore_wake = "INT33FC:02@28",
++ },
++ },
++ {
++ /*
++ * HP X2 10 models with Cherry Trail SoC + AXP288 PMIC use an
++ * external embedded-controller connected via I2C + an ACPI GPIO
++ * event handler on INT33FF:01 pin 0, causing spurious wakeups.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++ DMI_MATCH(DMI_BOARD_NAME, "813E"),
++ },
++ .driver_data = &(struct acpi_gpiolib_dmi_quirk) {
++ .ignore_wake = "INT33FF:01@0",
++ },
+ },
+ {} /* Terminating entry */
+ };
+
+ static int acpi_gpio_setup_params(void)
+ {
++ const struct acpi_gpiolib_dmi_quirk *quirk = NULL;
+ const struct dmi_system_id *id;
+- long quirks = 0;
+
+ id = dmi_first_match(gpiolib_acpi_quirks);
+ if (id)
+- quirks = (long)id->driver_data;
++ quirk = id->driver_data;
+
+ if (run_edge_events_on_boot < 0) {
+- if (quirks & QUIRK_NO_EDGE_EVENTS_ON_BOOT)
++ if (quirk && quirk->no_edge_events_on_boot)
+ run_edge_events_on_boot = 0;
+ else
+ run_edge_events_on_boot = 1;
+ }
+
+- if (honor_wakeup < 0) {
+- if (quirks & QUIRK_NO_WAKEUP)
+- honor_wakeup = 0;
+- else
+- honor_wakeup = 1;
+- }
++ if (ignore_wake == NULL && quirk && quirk->ignore_wake)
++ ignore_wake = quirk->ignore_wake;
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index bf4eed5f6a7e..fc978603fc94 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1022,20 +1022,9 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
+ static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
+ {
+ struct drm_dp_mst_port *rport = NULL;
+-
+ mutex_lock(&mgr->lock);
+- /*
+- * Port may or may not be 'valid' but we don't care about that when
+- * destroying the port and we are guaranteed that the port pointer
+- * will be valid until we've finished
+- */
+- if (current_work() == &mgr->destroy_connector_work) {
+- kref_get(&port->kref);
+- rport = port;
+- } else if (mgr->mst_primary) {
+- rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
+- port);
+- }
++ if (mgr->mst_primary)
++ rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
+ mutex_unlock(&mgr->lock);
+ return rport;
+ }
+diff --git a/drivers/i2c/busses/i2c-hix5hd2.c b/drivers/i2c/busses/i2c-hix5hd2.c
+index 061a4bfb03f4..b5ad7696adf9 100644
+--- a/drivers/i2c/busses/i2c-hix5hd2.c
++++ b/drivers/i2c/busses/i2c-hix5hd2.c
+@@ -482,6 +482,7 @@ static int hix5hd2_i2c_remove(struct platform_device *pdev)
+ i2c_del_adapter(&priv->adap);
+ pm_runtime_disable(priv->dev);
+ pm_runtime_set_suspended(priv->dev);
++ clk_disable_unprepare(priv->clk);
+
+ return 0;
+ }
+diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
+index f2c2e725375e..6df6cc55fd16 100644
+--- a/drivers/infiniband/core/security.c
++++ b/drivers/infiniband/core/security.c
+@@ -346,16 +346,11 @@ static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp,
+ else if (qp_pps)
+ new_pps->main.pkey_index = qp_pps->main.pkey_index;
+
+- if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT))
++ if (((qp_attr_mask & IB_QP_PKEY_INDEX) &&
++ (qp_attr_mask & IB_QP_PORT)) ||
++ (qp_pps && qp_pps->main.state != IB_PORT_PKEY_NOT_VALID))
+ new_pps->main.state = IB_PORT_PKEY_VALID;
+
+- if (!(qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) && qp_pps) {
+- new_pps->main.port_num = qp_pps->main.port_num;
+- new_pps->main.pkey_index = qp_pps->main.pkey_index;
+- if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)
+- new_pps->main.state = IB_PORT_PKEY_VALID;
+- }
+-
+ if (qp_attr_mask & IB_QP_ALT_PATH) {
+ new_pps->alt.port_num = qp_attr->alt_port_num;
+ new_pps->alt.pkey_index = qp_attr->alt_pkey_index;
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 4c0f0ce02d2f..4fc9278d0dde 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -5524,6 +5524,10 @@ struct ib_wq *mlx5_ib_create_wq(struct ib_pd *pd,
+ if (udata->outlen && udata->outlen < min_resp_len)
+ return ERR_PTR(-EINVAL);
+
++ if (!capable(CAP_SYS_RAWIO) &&
++ init_attr->create_flags & IB_WQ_FLAGS_DELAY_DROP)
++ return ERR_PTR(-EPERM);
++
+ dev = to_mdev(pd->device);
+ switch (init_attr->wq_type) {
+ case IB_WQT_RQ:
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index f47e3fca403d..d9042d0566ab 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -189,6 +189,7 @@ static const char * const smbus_pnp_ids[] = {
+ "SYN3052", /* HP EliteBook 840 G4 */
+ "SYN3221", /* HP 15-ay000 */
+ "SYN323d", /* HP Spectre X360 13-w013dx */
++ "SYN3257", /* HP Envy 13-ad105ng */
+ NULL
+ };
+
+diff --git a/drivers/input/touchscreen/raydium_i2c_ts.c b/drivers/input/touchscreen/raydium_i2c_ts.c
+index c89853a36f9e..05c1054330b7 100644
+--- a/drivers/input/touchscreen/raydium_i2c_ts.c
++++ b/drivers/input/touchscreen/raydium_i2c_ts.c
+@@ -441,7 +441,7 @@ static int raydium_i2c_write_object(struct i2c_client *client,
+ return 0;
+ }
+
+-static bool raydium_i2c_boot_trigger(struct i2c_client *client)
++static int raydium_i2c_boot_trigger(struct i2c_client *client)
+ {
+ static const u8 cmd[7][6] = {
+ { 0x08, 0x0C, 0x09, 0x00, 0x50, 0xD7 },
+@@ -466,10 +466,10 @@ static bool raydium_i2c_boot_trigger(struct i2c_client *client)
+ }
+ }
+
+- return false;
++ return 0;
+ }
+
+-static bool raydium_i2c_fw_trigger(struct i2c_client *client)
++static int raydium_i2c_fw_trigger(struct i2c_client *client)
+ {
+ static const u8 cmd[5][11] = {
+ { 0, 0x09, 0x71, 0x0C, 0x09, 0x00, 0x50, 0xD7, 0, 0, 0 },
+@@ -492,7 +492,7 @@ static bool raydium_i2c_fw_trigger(struct i2c_client *client)
+ }
+ }
+
+- return false;
++ return 0;
+ }
+
+ static int raydium_i2c_check_path(struct i2c_client *client)
+diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
+index 427cda457af6..5104678f29b7 100644
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -510,6 +510,9 @@ static int flexcop_usb_init(struct flexcop_usb *fc_usb)
+ return ret;
+ }
+
++ if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints < 1)
++ return -ENODEV;
++
+ switch (fc_usb->udev->speed) {
+ case USB_SPEED_LOW:
+ err("cannot handle USB speed because it is too slow.");
+@@ -543,9 +546,6 @@ static int flexcop_usb_probe(struct usb_interface *intf,
+ struct flexcop_device *fc = NULL;
+ int ret;
+
+- if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+- return -ENODEV;
+-
+ if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
+ err("out of memory\n");
+ return -ENOMEM;
+diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
+index 94bd176104c1..6a53ff93c4d8 100644
+--- a/drivers/media/usb/dvb-usb/dib0700_core.c
++++ b/drivers/media/usb/dvb-usb/dib0700_core.c
+@@ -821,7 +821,7 @@ int dib0700_rc_setup(struct dvb_usb_device *d, struct usb_interface *intf)
+
+ /* Starting in firmware 1.20, the RC info is provided on a bulk pipe */
+
+- if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1)
++ if (intf->cur_altsetting->desc.bNumEndpoints < rc_ep + 1)
+ return -ENODEV;
+
+ purb = usb_alloc_urb(0, GFP_KERNEL);
+@@ -841,7 +841,7 @@ int dib0700_rc_setup(struct dvb_usb_device *d, struct usb_interface *intf)
+ * Some devices like the Hauppauge NovaTD model 52009 use an interrupt
+ * endpoint, while others use a bulk one.
+ */
+- e = &intf->altsetting[0].endpoint[rc_ep].desc;
++ e = &intf->cur_altsetting->endpoint[rc_ep].desc;
+ if (usb_endpoint_dir_in(e)) {
+ if (usb_endpoint_xfer_bulk(e)) {
+ pipe = usb_rcvbulkpipe(d->udev, rc_ep);
+diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c
+index cb41e61d50dd..1e9835dc24d4 100644
+--- a/drivers/media/usb/gspca/ov519.c
++++ b/drivers/media/usb/gspca/ov519.c
+@@ -3487,6 +3487,11 @@ static void ov511_mode_init_regs(struct sd *sd)
+ return;
+ }
+
++ if (alt->desc.bNumEndpoints < 1) {
++ sd->gspca_dev.usb_err = -ENODEV;
++ return;
++ }
++
+ packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ reg_w(sd, R51x_FIFO_PSIZE, packet_size >> 5);
+
+@@ -3613,6 +3618,11 @@ static void ov518_mode_init_regs(struct sd *sd)
+ return;
+ }
+
++ if (alt->desc.bNumEndpoints < 1) {
++ sd->gspca_dev.usb_err = -ENODEV;
++ return;
++ }
++
+ packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ ov518_reg_w32(sd, R51x_FIFO_PSIZE, packet_size & ~7, 2);
+
+diff --git a/drivers/media/usb/gspca/stv06xx/stv06xx.c b/drivers/media/usb/gspca/stv06xx/stv06xx.c
+index 6080a35310ca..b7ea4f982964 100644
+--- a/drivers/media/usb/gspca/stv06xx/stv06xx.c
++++ b/drivers/media/usb/gspca/stv06xx/stv06xx.c
+@@ -291,6 +291,9 @@ static int stv06xx_start(struct gspca_dev *gspca_dev)
+ return -EIO;
+ }
+
++ if (alt->desc.bNumEndpoints < 1)
++ return -ENODEV;
++
+ packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ err = stv06xx_write_bridge(sd, STV_ISO_SIZE_L, packet_size);
+ if (err < 0)
+@@ -315,11 +318,21 @@ out:
+
+ static int stv06xx_isoc_init(struct gspca_dev *gspca_dev)
+ {
++ struct usb_interface_cache *intfc;
+ struct usb_host_interface *alt;
+ struct sd *sd = (struct sd *) gspca_dev;
+
++ intfc = gspca_dev->dev->actconfig->intf_cache[0];
++
++ if (intfc->num_altsetting < 2)
++ return -ENODEV;
++
++ alt = &intfc->altsetting[1];
++
++ if (alt->desc.bNumEndpoints < 1)
++ return -ENODEV;
++
+ /* Start isoc bandwidth "negotiation" at max isoc bandwidth */
+- alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
+ alt->endpoint[0].desc.wMaxPacketSize =
+ cpu_to_le16(sd->sensor->max_packet_size[gspca_dev->curr_mode]);
+
+@@ -332,6 +345,10 @@ static int stv06xx_isoc_nego(struct gspca_dev *gspca_dev)
+ struct usb_host_interface *alt;
+ struct sd *sd = (struct sd *) gspca_dev;
+
++ /*
++ * Existence of altsetting and endpoint was verified in
++ * stv06xx_isoc_init()
++ */
+ alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
+ packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ min_packet_size = sd->sensor->min_packet_size[gspca_dev->curr_mode];
+diff --git a/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c b/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c
+index 7374aeb0a67a..6f1ced465472 100644
+--- a/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c
++++ b/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c
+@@ -194,6 +194,10 @@ static int pb0100_start(struct sd *sd)
+ alt = usb_altnum_to_altsetting(intf, sd->gspca_dev.alt);
+ if (!alt)
+ return -ENODEV;
++
++ if (alt->desc.bNumEndpoints < 1)
++ return -ENODEV;
++
+ packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+
+ /* If we don't have enough bandwidth use a lower framerate */
+diff --git a/drivers/media/usb/gspca/xirlink_cit.c b/drivers/media/usb/gspca/xirlink_cit.c
+index 58deb0c38826..fa65c3eaa725 100644
+--- a/drivers/media/usb/gspca/xirlink_cit.c
++++ b/drivers/media/usb/gspca/xirlink_cit.c
+@@ -1452,6 +1452,9 @@ static int cit_get_packet_size(struct gspca_dev *gspca_dev)
+ return -EIO;
+ }
+
++ if (alt->desc.bNumEndpoints < 1)
++ return -ENODEV;
++
+ return le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ }
+
+@@ -2636,6 +2639,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
+
+ static int sd_isoc_init(struct gspca_dev *gspca_dev)
+ {
++ struct usb_interface_cache *intfc;
+ struct usb_host_interface *alt;
+ int max_packet_size;
+
+@@ -2651,8 +2655,17 @@ static int sd_isoc_init(struct gspca_dev *gspca_dev)
+ break;
+ }
+
++ intfc = gspca_dev->dev->actconfig->intf_cache[0];
++
++ if (intfc->num_altsetting < 2)
++ return -ENODEV;
++
++ alt = &intfc->altsetting[1];
++
++ if (alt->desc.bNumEndpoints < 1)
++ return -ENODEV;
++
+ /* Start isoc bandwidth "negotiation" at max isoc bandwidth */
+- alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
+ alt->endpoint[0].desc.wMaxPacketSize = cpu_to_le16(max_packet_size);
+
+ return 0;
+@@ -2675,6 +2688,9 @@ static int sd_isoc_nego(struct gspca_dev *gspca_dev)
+ break;
+ }
+
++ /*
++ * Existence of altsetting and endpoint was verified in sd_isoc_init()
++ */
+ alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
+ packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ if (packet_size <= min_packet_size)
+diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
+index 5095c380b2c1..ee9c656d121f 100644
+--- a/drivers/media/usb/usbtv/usbtv-core.c
++++ b/drivers/media/usb/usbtv/usbtv-core.c
+@@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv, const u16 regs[][2], int size)
+
+ ret = usb_control_msg(usbtv->udev, pipe, USBTV_REQUEST_REG,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- value, index, NULL, 0, 0);
++ value, index, NULL, 0, USB_CTRL_GET_TIMEOUT);
+ if (ret < 0)
+ return ret;
+ }
+diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c
+index 36a9a4017185..6ff806ca43f5 100644
+--- a/drivers/media/usb/usbtv/usbtv-video.c
++++ b/drivers/media/usb/usbtv/usbtv-video.c
+@@ -805,7 +805,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl *ctrl)
+ ret = usb_control_msg(usbtv->udev,
+ usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0, USBTV_BASE + 0x0244, (void *)data, 3, 0);
++ 0, USBTV_BASE + 0x0244, (void *)data, 3,
++ USB_CTRL_GET_TIMEOUT);
+ if (ret < 0)
+ goto error;
+ }
+@@ -856,7 +857,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl *ctrl)
+ ret = usb_control_msg(usbtv->udev, usb_sndctrlpipe(usbtv->udev, 0),
+ USBTV_CONTROL_REG,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0, index, (void *)data, size, 0);
++ 0, index, (void *)data, size, USB_CTRL_SET_TIMEOUT);
+
+ error:
+ if (ret < 0)
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 0a74785e575b..56f7f3600469 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -2043,8 +2043,11 @@ static int mmc_do_erase(struct mmc_card *card, unsigned int from,
+ * the erase operation does not exceed the max_busy_timeout, we should
+ * use R1B response. Or we need to prevent the host from doing hw busy
+ * detection, which is done by converting to a R1 response instead.
++ * Note, some hosts requires R1B, which also means they are on their own
++ * when it comes to deal with the busy timeout.
+ */
+- if (card->host->max_busy_timeout &&
++ if (!(card->host->caps & MMC_CAP_NEED_RSP_BUSY) &&
++ card->host->max_busy_timeout &&
+ busy_timeout > card->host->max_busy_timeout) {
+ cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_AC;
+ } else {
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index f1fe446eee66..5ca53e225382 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1901,9 +1901,12 @@ static int mmc_sleep(struct mmc_host *host)
+ * If the max_busy_timeout of the host is specified, validate it against
+ * the sleep cmd timeout. A failure means we need to prevent the host
+ * from doing hw busy detection, which is done by converting to a R1
+- * response instead of a R1B.
++ * response instead of a R1B. Note, some hosts requires R1B, which also
++ * means they are on their own when it comes to deal with the busy
++ * timeout.
+ */
+- if (host->max_busy_timeout && (timeout_ms > host->max_busy_timeout)) {
++ if (!(host->caps & MMC_CAP_NEED_RSP_BUSY) && host->max_busy_timeout &&
++ (timeout_ms > host->max_busy_timeout)) {
+ cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
+ } else {
+ cmd.flags = MMC_RSP_R1B | MMC_CMD_AC;
+diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
+index 873b2aa0c155..693b99eff74b 100644
+--- a/drivers/mmc/core/mmc_ops.c
++++ b/drivers/mmc/core/mmc_ops.c
+@@ -536,10 +536,12 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
+ * If the cmd timeout and the max_busy_timeout of the host are both
+ * specified, let's validate them. A failure means we need to prevent
+ * the host from doing hw busy detection, which is done by converting
+- * to a R1 response instead of a R1B.
++ * to a R1 response instead of a R1B. Note, some hosts requires R1B,
++ * which also means they are on their own when it comes to deal with the
++ * busy timeout.
+ */
+- if (timeout_ms && host->max_busy_timeout &&
+- (timeout_ms > host->max_busy_timeout))
++ if (!(host->caps & MMC_CAP_NEED_RSP_BUSY) && timeout_ms &&
++ host->max_busy_timeout && (timeout_ms > host->max_busy_timeout))
+ use_r1b_resp = false;
+
+ cmd.opcode = MMC_SWITCH;
+diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
+index e9793d8e83a0..05ade7a2dd24 100644
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -1147,6 +1147,9 @@ static int sdhci_omap_probe(struct platform_device *pdev)
+ host->mmc_host_ops.execute_tuning = sdhci_omap_execute_tuning;
+ host->mmc_host_ops.enable_sdio_irq = sdhci_omap_enable_sdio_irq;
+
++ /* R1B responses is required to properly manage HW busy detection. */
++ mmc->caps |= MMC_CAP_NEED_RSP_BUSY;
++
+ ret = sdhci_setup_host(host);
+ if (ret)
+ goto err_put_sync;
+diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
+index 14d749a0de95..27bdf6d499bd 100644
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -502,6 +502,9 @@ static int sdhci_tegra_probe(struct platform_device *pdev)
+ if (tegra_host->soc_data->nvquirks & NVQUIRK_ENABLE_DDR50)
+ host->mmc->caps |= MMC_CAP_1_8V_DDR;
+
++ /* R1B responses is required to properly manage HW busy detection. */
++ host->mmc->caps |= MMC_CAP_NEED_RSP_BUSY;
++
+ tegra_host->power_gpio = devm_gpiod_get_optional(&pdev->dev, "power",
+ GPIOD_OUT_HIGH);
+ if (IS_ERR(tegra_host->power_gpio)) {
+diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
+index b2e5bcae7fbe..db9607809620 100644
+--- a/drivers/net/can/slcan.c
++++ b/drivers/net/can/slcan.c
+@@ -621,7 +621,10 @@ err_free_chan:
+ tty->disc_data = NULL;
+ clear_bit(SLF_INUSE, &sl->flags);
+ slc_free_netdev(sl->dev);
++ /* do not call free_netdev before rtnl_unlock */
++ rtnl_unlock();
+ free_netdev(sl->dev);
++ return err;
+
+ err_exit:
+ rtnl_unlock();
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 62e486652e62..8aa3b0af9fc2 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -549,7 +549,7 @@ mt7530_mib_reset(struct dsa_switch *ds)
+ static void
+ mt7530_port_set_status(struct mt7530_priv *priv, int port, int enable)
+ {
+- u32 mask = PMCR_TX_EN | PMCR_RX_EN;
++ u32 mask = PMCR_TX_EN | PMCR_RX_EN | PMCR_FORCE_LNK;
+
+ if (enable)
+ mt7530_set(priv, MT7530_PMCR_P(port), mask);
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 911cea2e5aa5..f008c91d4566 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8822,6 +8822,10 @@ static int bnxt_set_dflt_rings(struct bnxt *bp, bool sh)
+ bp->rx_nr_rings++;
+ bp->cp_nr_rings++;
+ }
++ if (rc) {
++ bp->tx_nr_rings = 0;
++ bp->rx_nr_rings = 0;
++ }
+ return rc;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+index 0e4e0b47f5d8..5becfcf55ffd 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+@@ -479,24 +479,26 @@ static int bnxt_dcbnl_ieee_getets(struct net_device *dev, struct ieee_ets *ets)
+ {
+ struct bnxt *bp = netdev_priv(dev);
+ struct ieee_ets *my_ets = bp->ieee_ets;
++ int rc;
+
+ ets->ets_cap = bp->max_tc;
+
+ if (!my_ets) {
+- int rc;
+-
+ if (bp->dcbx_cap & DCB_CAP_DCBX_HOST)
+ return 0;
+
+ my_ets = kzalloc(sizeof(*my_ets), GFP_KERNEL);
+ if (!my_ets)
+- return 0;
++ return -ENOMEM;
+ rc = bnxt_hwrm_queue_cos2bw_qcfg(bp, my_ets);
+ if (rc)
+- return 0;
++ goto error;
+ rc = bnxt_hwrm_queue_pri2cos_qcfg(bp, my_ets);
+ if (rc)
+- return 0;
++ goto error;
++
++ /* cache result */
++ bp->ieee_ets = my_ets;
+ }
+
+ ets->cbs = my_ets->cbs;
+@@ -505,6 +507,9 @@ static int bnxt_dcbnl_ieee_getets(struct net_device *dev, struct ieee_ets *ets)
+ memcpy(ets->tc_tsa, my_ets->tc_tsa, sizeof(ets->tc_tsa));
+ memcpy(ets->prio_tc, my_ets->prio_tc, sizeof(ets->prio_tc));
+ return 0;
++error:
++ kfree(my_ets);
++ return rc;
+ }
+
+ static int bnxt_dcbnl_ieee_setets(struct net_device *dev, struct ieee_ets *ets)
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index d7736c9c6339..4b21ae27a9fd 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2764,9 +2764,7 @@ static inline u16 dpaa_get_headroom(struct dpaa_buffer_layout *bl)
+ headroom = (u16)(bl->priv_data_size + DPAA_PARSE_RESULTS_SIZE +
+ DPAA_TIME_STAMP_SIZE + DPAA_HASH_RESULTS_SIZE);
+
+- return DPAA_FD_DATA_ALIGNMENT ? ALIGN(headroom,
+- DPAA_FD_DATA_ALIGNMENT) :
+- headroom;
++ return ALIGN(headroom, DPAA_FD_DATA_ALIGNMENT);
+ }
+
+ static int dpaa_eth_probe(struct platform_device *pdev)
+diff --git a/drivers/net/ethernet/freescale/fman/Kconfig b/drivers/net/ethernet/freescale/fman/Kconfig
+index dc0850b3b517..0b07ece83a2f 100644
+--- a/drivers/net/ethernet/freescale/fman/Kconfig
++++ b/drivers/net/ethernet/freescale/fman/Kconfig
+@@ -7,3 +7,31 @@ config FSL_FMAN
+ help
+ Freescale Data-Path Acceleration Architecture Frame Manager
+ (FMan) support
++
++config DPAA_ERRATUM_A050385
++ bool
++ depends on ARM64 && FSL_DPAA
++ default y
++ help
++ DPAA FMan erratum A050385 software workaround implementation:
++ align buffers, data start, SG fragment length to avoid FMan DMA
++ splits.
++ FMAN DMA read or writes under heavy traffic load may cause FMAN
++ internal resource leak thus stopping further packet processing.
++ The FMAN internal queue can overflow when FMAN splits single
++ read or write transactions into multiple smaller transactions
++ such that more than 17 AXI transactions are in flight from FMAN
++ to interconnect. When the FMAN internal queue overflows, it can
++ stall further packet processing. The issue can occur with any
++ one of the following three conditions:
++ 1. FMAN AXI transaction crosses 4K address boundary (Errata
++ A010022)
++ 2. FMAN DMA address for an AXI transaction is not 16 byte
++ aligned, i.e. the last 4 bits of an address are non-zero
++ 3. Scatter Gather (SG) frames have more than one SG buffer in
++ the SG list and any one of the buffers, except the last
++ buffer in the SG list has data size that is not a multiple
++ of 16 bytes, i.e., other than 16, 32, 48, 64, etc.
++ With any one of the above three conditions present, there is
++ likelihood of stalled FMAN packet processing, especially under
++ stress with multiple ports injecting line-rate traffic.
+diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
+index e80fedb27cee..21d8023535ae 100644
+--- a/drivers/net/ethernet/freescale/fman/fman.c
++++ b/drivers/net/ethernet/freescale/fman/fman.c
+@@ -1,5 +1,6 @@
+ /*
+ * Copyright 2008-2015 Freescale Semiconductor Inc.
++ * Copyright 2020 NXP
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+@@ -566,6 +567,10 @@ struct fman_cfg {
+ u32 qmi_def_tnums_thresh;
+ };
+
++#ifdef CONFIG_DPAA_ERRATUM_A050385
++static bool fman_has_err_a050385;
++#endif
++
+ static irqreturn_t fman_exceptions(struct fman *fman,
+ enum fman_exceptions exception)
+ {
+@@ -2517,6 +2522,14 @@ struct fman *fman_bind(struct device *fm_dev)
+ }
+ EXPORT_SYMBOL(fman_bind);
+
++#ifdef CONFIG_DPAA_ERRATUM_A050385
++bool fman_has_errata_a050385(void)
++{
++ return fman_has_err_a050385;
++}
++EXPORT_SYMBOL(fman_has_errata_a050385);
++#endif
++
+ static irqreturn_t fman_err_irq(int irq, void *handle)
+ {
+ struct fman *fman = (struct fman *)handle;
+@@ -2844,6 +2857,11 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
+ goto fman_free;
+ }
+
++#ifdef CONFIG_DPAA_ERRATUM_A050385
++ fman_has_err_a050385 =
++ of_property_read_bool(fm_node, "fsl,erratum-a050385");
++#endif
++
+ return fman;
+
+ fman_node_put:
+diff --git a/drivers/net/ethernet/freescale/fman/fman.h b/drivers/net/ethernet/freescale/fman/fman.h
+index 935c317fa696..f2ede1360f03 100644
+--- a/drivers/net/ethernet/freescale/fman/fman.h
++++ b/drivers/net/ethernet/freescale/fman/fman.h
+@@ -1,5 +1,6 @@
+ /*
+ * Copyright 2008-2015 Freescale Semiconductor Inc.
++ * Copyright 2020 NXP
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+@@ -398,6 +399,10 @@ u16 fman_get_max_frm(void);
+
+ int fman_get_rx_extra_headroom(void);
+
++#ifdef CONFIG_DPAA_ERRATUM_A050385
++bool fman_has_errata_a050385(void);
++#endif
++
+ struct fman *fman_bind(struct device *dev);
+
+ #endif /* __FM_H */
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 51885e6dec50..30a16cf796c7 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -2801,11 +2801,10 @@ static int mvneta_poll(struct napi_struct *napi, int budget)
+ /* For the case where the last mvneta_poll did not process all
+ * RX packets
+ */
+- rx_queue = fls(((cause_rx_tx >> 8) & 0xff));
+-
+ cause_rx_tx |= pp->neta_armada3700 ? pp->cause_rx_tx :
+ port->cause_rx_tx;
+
++ rx_queue = fls(((cause_rx_tx >> 8) & 0xff));
+ if (rx_queue) {
+ rx_queue = rx_queue - 1;
+ if (pp->bm_priv)
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c
+index 54275624718b..336e5ecc68f8 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c
+@@ -637,12 +637,12 @@ static int mlxsw_sp_mr_vif_resolve(struct mlxsw_sp_mr_table *mr_table,
+ return 0;
+
+ err_erif_unresolve:
+- list_for_each_entry_from_reverse(erve, &mr_vif->route_evif_list,
+- vif_node)
++ list_for_each_entry_continue_reverse(erve, &mr_vif->route_evif_list,
++ vif_node)
+ mlxsw_sp_mr_route_evif_unresolve(mr_table, erve);
+ err_irif_unresolve:
+- list_for_each_entry_from_reverse(irve, &mr_vif->route_ivif_list,
+- vif_node)
++ list_for_each_entry_continue_reverse(irve, &mr_vif->route_ivif_list,
++ vif_node)
+ mlxsw_sp_mr_route_ivif_unresolve(mr_table, irve);
+ mr_vif->rif = NULL;
+ return err;
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index a5525bf977e2..68af0d8cf613 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -475,6 +475,50 @@ static int msg_enable;
+ * chip is busy transferring packet data (RX/TX FIFO accesses).
+ */
+
++/**
++ * ks_check_endian - Check whether endianness of the bus is correct
++ * @ks : The chip information
++ *
++ * The KS8851-16MLL EESK pin allows selecting the endianness of the 16bit
++ * bus. To maintain optimum performance, the bus endianness should be set
++ * such that it matches the endianness of the CPU.
++ */
++
++static int ks_check_endian(struct ks_net *ks)
++{
++ u16 cider;
++
++ /*
++ * Read CIDER register first, however read it the "wrong" way around.
++ * If the endian strap on the KS8851-16MLL in incorrect and the chip
++ * is operating in different endianness than the CPU, then the meaning
++ * of BE[3:0] byte-enable bits is also swapped such that:
++ * BE[3,2,1,0] becomes BE[1,0,3,2]
++ *
++ * Luckily for us, the byte-enable bits are the top four MSbits of
++ * the address register and the CIDER register is at offset 0xc0.
++ * Hence, by reading address 0xc0c0, which is not impacted by endian
++ * swapping, we assert either BE[3:2] or BE[1:0] while reading the
++ * CIDER register.
++ *
++ * If the bus configuration is correct, reading 0xc0c0 asserts
++ * BE[3:2] and this read returns 0x0000, because to read register
++ * with bottom two LSbits of address set to 0, BE[1:0] must be
++ * asserted.
++ *
++ * If the bus configuration is NOT correct, reading 0xc0c0 asserts
++ * BE[1:0] and this read returns non-zero 0x8872 value.
++ */
++ iowrite16(BE3 | BE2 | KS_CIDER, ks->hw_addr_cmd);
++ cider = ioread16(ks->hw_addr);
++ if (!cider)
++ return 0;
++
++ netdev_err(ks->netdev, "incorrect EESK endian strap setting\n");
++
++ return -EINVAL;
++}
++
+ /**
+ * ks_rdreg16 - read 16 bit register from device
+ * @ks : The chip information
+@@ -485,7 +529,7 @@ static int msg_enable;
+
+ static u16 ks_rdreg16(struct ks_net *ks, int offset)
+ {
+- ks->cmd_reg_cache = (u16)offset | ((BE3 | BE2) >> (offset & 0x02));
++ ks->cmd_reg_cache = (u16)offset | ((BE1 | BE0) << (offset & 0x02));
+ iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd);
+ return ioread16(ks->hw_addr);
+ }
+@@ -500,7 +544,7 @@ static u16 ks_rdreg16(struct ks_net *ks, int offset)
+
+ static void ks_wrreg16(struct ks_net *ks, int offset, u16 value)
+ {
+- ks->cmd_reg_cache = (u16)offset | ((BE3 | BE2) >> (offset & 0x02));
++ ks->cmd_reg_cache = (u16)offset | ((BE1 | BE0) << (offset & 0x02));
+ iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd);
+ iowrite16(value, ks->hw_addr);
+ }
+@@ -516,7 +560,7 @@ static inline void ks_inblk(struct ks_net *ks, u16 *wptr, u32 len)
+ {
+ len >>= 1;
+ while (len--)
+- *wptr++ = be16_to_cpu(ioread16(ks->hw_addr));
++ *wptr++ = (u16)ioread16(ks->hw_addr);
+ }
+
+ /**
+@@ -530,7 +574,7 @@ static inline void ks_outblk(struct ks_net *ks, u16 *wptr, u32 len)
+ {
+ len >>= 1;
+ while (len--)
+- iowrite16(cpu_to_be16(*wptr++), ks->hw_addr);
++ iowrite16(*wptr++, ks->hw_addr);
+ }
+
+ static void ks_disable_int(struct ks_net *ks)
+@@ -1540,6 +1584,10 @@ static int ks8851_probe(struct platform_device *pdev)
+ goto err_free;
+ }
+
++ err = ks_check_endian(ks);
++ if (err)
++ goto err_free;
++
+ netdev->irq = platform_get_irq(pdev, 0);
+
+ if ((int)netdev->irq < 0) {
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 6ea43e48d5f9..807ef43a3cda 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -7249,7 +7249,7 @@ static int rtl_alloc_irq(struct rtl8169_private *tp)
+ RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~MSIEnable);
+ RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+ /* fall through */
+- case RTL_GIGA_MAC_VER_07 ... RTL_GIGA_MAC_VER_24:
++ case RTL_GIGA_MAC_VER_07 ... RTL_GIGA_MAC_VER_17:
+ flags = PCI_IRQ_LEGACY;
+ break;
+ default:
+@@ -7433,15 +7433,6 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ int chipset, region, i;
+ int jumbo_max, rc;
+
+- /* Some tools for creating an initramfs don't consider softdeps, then
+- * r8169.ko may be in initramfs, but realtek.ko not. Then the generic
+- * PHY driver is used that doesn't work with most chip versions.
+- */
+- if (!driver_find("RTL8201CP Ethernet", &mdio_bus_type)) {
+- dev_err(&pdev->dev, "realtek.ko not loaded, maybe it needs to be added to initramfs?\n");
+- return -ENOENT;
+- }
+-
+ dev = devm_alloc_etherdev(&pdev->dev, sizeof (*tp));
+ if (!dev)
+ return -ENOMEM;
+diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+index a9da1ad4b4f2..30cd087aa67c 100644
+--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
++++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+@@ -2282,7 +2282,7 @@ static int __init sxgbe_cmdline_opt(char *str)
+ if (!str || !*str)
+ return -EINVAL;
+ while ((opt = strsep(&str, ",")) != NULL) {
+- if (!strncmp(opt, "eee_timer:", 6)) {
++ if (!strncmp(opt, "eee_timer:", 10)) {
+ if (kstrtoint(opt + 10, 0, &eee_timer))
+ goto err;
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+index f45df6df6932..4e83ccab7253 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+@@ -1420,7 +1420,7 @@ static int rk_gmac_probe(struct platform_device *pdev)
+
+ ret = rk_gmac_clk_init(plat_dat);
+ if (ret)
+- return ret;
++ goto err_remove_config_dt;
+
+ ret = rk_gmac_powerup(plat_dat->bsp_priv);
+ if (ret)
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index e1427b56a073..ff83408733d4 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -1725,8 +1725,6 @@ static void geneve_destroy_tunnels(struct net *net, struct list_head *head)
+ if (!net_eq(dev_net(geneve->dev), net))
+ unregister_netdevice_queue(geneve->dev, head);
+ }
+-
+- WARN_ON_ONCE(!list_empty(&gn->sock_list));
+ }
+
+ static void __net_exit geneve_exit_batch_net(struct list_head *net_list)
+@@ -1741,6 +1739,12 @@ static void __net_exit geneve_exit_batch_net(struct list_head *net_list)
+ /* unregister the devices gathered above */
+ unregister_netdevice_many(&list);
+ rtnl_unlock();
++
++ list_for_each_entry(net, net_list, exit_list) {
++ const struct geneve_net *gn = net_generic(net, geneve_net_id);
++
++ WARN_ON_ONCE(!list_empty(&gn->sock_list));
++ }
+ }
+
+ static struct pernet_operations geneve_net_ops = {
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 9a8ec94e8a44..df7d6de7c59c 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -20,6 +20,7 @@
+ #include <net/genetlink.h>
+ #include <net/sock.h>
+ #include <net/gro_cells.h>
++#include <linux/if_arp.h>
+
+ #include <uapi/linux/if_macsec.h>
+
+@@ -3248,6 +3249,8 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ real_dev = __dev_get_by_index(net, nla_get_u32(tb[IFLA_LINK]));
+ if (!real_dev)
+ return -ENODEV;
++ if (real_dev->type != ARPHRD_ETHER)
++ return -EINVAL;
+
+ dev->priv_flags |= IFF_MACSEC;
+
+diff --git a/drivers/net/phy/mdio-mux-bcm-iproc.c b/drivers/net/phy/mdio-mux-bcm-iproc.c
+index c017486e9b86..575e0bd76193 100644
+--- a/drivers/net/phy/mdio-mux-bcm-iproc.c
++++ b/drivers/net/phy/mdio-mux-bcm-iproc.c
+@@ -301,8 +301,13 @@ static int mdio_mux_iproc_resume(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct iproc_mdiomux_desc *md = platform_get_drvdata(pdev);
++ int rc;
+
+- clk_prepare_enable(md->core_clk);
++ rc = clk_prepare_enable(md->core_clk);
++ if (rc) {
++ dev_err(md->dev, "failed to enable core clk\n");
++ return rc;
++ }
+ mdio_mux_iproc_config(md);
+
+ return 0;
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 1d60ccd48ec2..a7804def1120 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1147,6 +1147,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1435, 0xd182, 5)}, /* Wistron NeWeb D18 */
+ {QMI_FIXED_INTF(0x1435, 0xd191, 4)}, /* Wistron NeWeb D19Q1 */
+ {QMI_QUIRK_SET_DTR(0x1508, 0x1001, 4)}, /* Fibocom NL668 series */
++ {QMI_FIXED_INTF(0x1690, 0x7588, 4)}, /* ASKEY WWHC050 */
+ {QMI_FIXED_INTF(0x16d8, 0x6003, 0)}, /* CMOTech 6003 */
+ {QMI_FIXED_INTF(0x16d8, 0x6007, 0)}, /* CMOTech CHE-628S */
+ {QMI_FIXED_INTF(0x16d8, 0x6008, 0)}, /* CMOTech CMU-301 */
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index df88981e796a..64751b089482 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2451,10 +2451,19 @@ static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan,
+ /* Setup stats when device is created */
+ static int vxlan_init(struct net_device *dev)
+ {
++ struct vxlan_dev *vxlan = netdev_priv(dev);
++ int err;
++
+ dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+ if (!dev->tstats)
+ return -ENOMEM;
+
++ err = gro_cells_init(&vxlan->gro_cells, dev);
++ if (err) {
++ free_percpu(dev->tstats);
++ return err;
++ }
++
+ return 0;
+ }
+
+@@ -2712,8 +2721,6 @@ static void vxlan_setup(struct net_device *dev)
+
+ vxlan->dev = dev;
+
+- gro_cells_init(&vxlan->gro_cells, dev);
+-
+ for (h = 0; h < FDB_HASH_SIZE; ++h)
+ INIT_HLIST_HEAD(&vxlan->fdb_head[h]);
+ }
+diff --git a/drivers/nfc/fdp/fdp.c b/drivers/nfc/fdp/fdp.c
+index d5784a47fc13..954c83e917eb 100644
+--- a/drivers/nfc/fdp/fdp.c
++++ b/drivers/nfc/fdp/fdp.c
+@@ -192,7 +192,7 @@ static int fdp_nci_send_patch(struct nci_dev *ndev, u8 conn_id, u8 type)
+ const struct firmware *fw;
+ struct sk_buff *skb;
+ unsigned long len;
+- u8 max_size, payload_size;
++ int max_size, payload_size;
+ int rc = 0;
+
+ if ((type == NCI_PATCH_TYPE_OTP && !info->otp_patch) ||
+@@ -215,8 +215,7 @@ static int fdp_nci_send_patch(struct nci_dev *ndev, u8 conn_id, u8 type)
+
+ while (len) {
+
+- payload_size = min_t(unsigned long, (unsigned long) max_size,
+- len);
++ payload_size = min_t(unsigned long, max_size, len);
+
+ skb = nci_skb_alloc(ndev, (NCI_CTRL_HDR_SIZE + payload_size),
+ GFP_KERNEL);
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index 7d2bc22680d9..af7572fe090f 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -270,6 +270,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
+ rc = of_mdiobus_register_phy(mdio, child, addr);
+ if (rc && rc != -ENODEV)
+ goto unregister;
++ break;
+ }
+ }
+ }
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index 9c94ebb251cb..26351e9e0aaf 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -413,6 +413,14 @@ static const struct dmi_system_id critclk_systems[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "3I380D"),
+ },
+ },
++ {
++ /* pmc_plt_clk* - are used for ethernet controllers */
++ .ident = "Lex 2I385SW",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Lex BayTrail"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "2I385SW"),
++ },
++ },
+ {
+ /* pmc_plt_clk* - are used for ethernet controllers */
+ .ident = "Beckhoff CB3163",
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index d99bfbfcafb7..5f59e2dfc7db 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -2811,12 +2811,12 @@ static int qeth_init_input_buffer(struct qeth_card *card,
+ buf->rx_skb = netdev_alloc_skb(card->dev,
+ QETH_RX_PULL_LEN + ETH_HLEN);
+ if (!buf->rx_skb)
+- return 1;
++ return -ENOMEM;
+ }
+
+ pool_entry = qeth_find_free_buffer_pool_entry(card);
+ if (!pool_entry)
+- return 1;
++ return -ENOBUFS;
+
+ /*
+ * since the buffer is accessed only from the input_tasklet
+@@ -2848,10 +2848,15 @@ int qeth_init_qdio_queues(struct qeth_card *card)
+ /* inbound queue */
+ qdio_reset_buffers(card->qdio.in_q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q);
+ memset(&card->rx, 0, sizeof(struct qeth_rx));
++
+ qeth_initialize_working_pool_list(card);
+ /*give only as many buffers to hardware as we have buffer pool entries*/
+- for (i = 0; i < card->qdio.in_buf_pool.buf_count - 1; ++i)
+- qeth_init_input_buffer(card, &card->qdio.in_q->bufs[i]);
++ for (i = 0; i < card->qdio.in_buf_pool.buf_count - 1; i++) {
++ rc = qeth_init_input_buffer(card, &card->qdio.in_q->bufs[i]);
++ if (rc)
++ return rc;
++ }
++
+ card->qdio.in_q->next_buf_to_init =
+ card->qdio.in_buf_pool.buf_count - 1;
+ rc = do_QDIO(CARD_DDEV(card), QDIO_FLAG_SYNC_INPUT, 0, 0,
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 271990bc065b..1b04a8223eb0 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -9958,6 +9958,7 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg,
+ ioa_cfg->max_devs_supported = ipr_max_devs;
+
+ if (ioa_cfg->sis64) {
++ host->max_channel = IPR_MAX_SIS64_BUSES;
+ host->max_id = IPR_MAX_SIS64_TARGETS_PER_BUS;
+ host->max_lun = IPR_MAX_SIS64_LUNS_PER_TARGET;
+ if (ipr_max_devs > IPR_MAX_SIS64_DEVS)
+@@ -9966,6 +9967,7 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg,
+ + ((sizeof(struct ipr_config_table_entry64)
+ * ioa_cfg->max_devs_supported)));
+ } else {
++ host->max_channel = IPR_VSET_BUS;
+ host->max_id = IPR_MAX_NUM_TARGETS_PER_BUS;
+ host->max_lun = IPR_MAX_NUM_LUNS_PER_TARGET;
+ if (ipr_max_devs > IPR_MAX_PHYSICAL_DEVS)
+@@ -9975,7 +9977,6 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg,
+ * ioa_cfg->max_devs_supported)));
+ }
+
+- host->max_channel = IPR_VSET_BUS;
+ host->unique_id = host->host_no;
+ host->max_cmd_len = IPR_MAX_CDB_LEN;
+ host->can_queue = ioa_cfg->max_cmds;
+diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
+index f6baa2351313..9fbcdc283cdb 100644
+--- a/drivers/scsi/ipr.h
++++ b/drivers/scsi/ipr.h
+@@ -1313,6 +1313,7 @@ struct ipr_resource_entry {
+ #define IPR_ARRAY_VIRTUAL_BUS 0x1
+ #define IPR_VSET_VIRTUAL_BUS 0x2
+ #define IPR_IOAFP_VIRTUAL_BUS 0x3
++#define IPR_MAX_SIS64_BUSES 0x4
+
+ #define IPR_GET_RES_PHYS_LOC(res) \
+ (((res)->bus << 24) | ((res)->target << 8) | (res)->lun)
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 345b18d52ec6..f2f14d8d5943 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3210,9 +3210,11 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ if (sd_validate_opt_xfer_size(sdkp, dev_max)) {
+ q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
+ rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
+- } else
++ } else {
++ q->limits.io_opt = 0;
+ rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
+ (sector_t)BLK_DEF_MAX_SECTORS);
++ }
+
+ /* Do not exceed controller limit */
+ rw_max = min(rw_max, queue_max_hw_sectors(q));
+diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+index adf2937e395b..276c965afc11 100644
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -32,6 +32,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
+ /****** 8188EUS ********/
+ {USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */
+ {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
++ {USB_DEVICE(0x0B05, 0x18F0)}, /* ASUS USB-N10 Nano B1 */
+ {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
+ {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
+ {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
+index 767ec8184adf..65ad9773018e 100644
+--- a/drivers/staging/wlan-ng/hfa384x_usb.c
++++ b/drivers/staging/wlan-ng/hfa384x_usb.c
+@@ -3494,6 +3494,8 @@ static void hfa384x_int_rxmonitor(struct wlandevice *wlandev,
+ WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
+ pr_debug("overlen frm: len=%zd\n",
+ skblen - sizeof(struct p80211_caphdr));
++
++ return;
+ }
+
+ skb = dev_alloc_skb(skblen);
+diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c
+index b5ba176004c1..d8d86761b790 100644
+--- a/drivers/staging/wlan-ng/prism2usb.c
++++ b/drivers/staging/wlan-ng/prism2usb.c
+@@ -180,6 +180,7 @@ static void prism2sta_disconnect_usb(struct usb_interface *interface)
+
+ cancel_work_sync(&hw->link_bh);
+ cancel_work_sync(&hw->commsqual_bh);
++ cancel_work_sync(&hw->usb_work);
+
+ /* Now we complete any outstanding commands
+ * and tell everyone who is waiting for their
+diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
+index 8a1671724835..34a0e529cb5a 100644
+--- a/drivers/tty/vt/selection.c
++++ b/drivers/tty/vt/selection.c
+@@ -85,6 +85,11 @@ void clear_selection(void)
+ }
+ }
+
++bool vc_is_sel(struct vc_data *vc)
++{
++ return vc == sel_cons;
++}
++
+ /*
+ * User settable table: what characters are to be considered alphabetic?
+ * 128 bits. Locked by the console lock.
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 5cecf529562a..36c6f1b98372 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -890,8 +890,9 @@ static void hide_softcursor(struct vc_data *vc)
+
+ static void hide_cursor(struct vc_data *vc)
+ {
+- if (vc == sel_cons)
++ if (vc_is_sel(vc))
+ clear_selection();
++
+ vc->vc_sw->con_cursor(vc, CM_ERASE);
+ hide_softcursor(vc);
+ }
+@@ -901,7 +902,7 @@ static void set_cursor(struct vc_data *vc)
+ if (!con_is_fg(vc) || console_blanked || vc->vc_mode == KD_GRAPHICS)
+ return;
+ if (vc->vc_deccm) {
+- if (vc == sel_cons)
++ if (vc_is_sel(vc))
+ clear_selection();
+ add_softcursor(vc);
+ if ((vc->vc_cursor_type & 0x0f) != 1)
+@@ -1077,6 +1078,17 @@ static void visual_deinit(struct vc_data *vc)
+ module_put(vc->vc_sw->owner);
+ }
+
++static void vc_port_destruct(struct tty_port *port)
++{
++ struct vc_data *vc = container_of(port, struct vc_data, port);
++
++ kfree(vc);
++}
++
++static const struct tty_port_operations vc_port_ops = {
++ .destruct = vc_port_destruct,
++};
++
+ int vc_allocate(unsigned int currcons) /* return 0 on success */
+ {
+ struct vt_notifier_param param;
+@@ -1102,6 +1114,7 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */
+
+ vc_cons[currcons].d = vc;
+ tty_port_init(&vc->port);
++ vc->port.ops = &vc_port_ops;
+ INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
+
+ visual_init(vc, currcons, 1);
+@@ -1210,7 +1223,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ }
+ }
+
+- if (vc == sel_cons)
++ if (vc_is_sel(vc))
+ clear_selection();
+
+ old_rows = vc->vc_rows;
+@@ -3228,6 +3241,7 @@ static int con_install(struct tty_driver *driver, struct tty_struct *tty)
+
+ tty->driver_data = vc;
+ vc->port.tty = tty;
++ tty_port_get(&vc->port);
+
+ if (!tty->winsize.ws_row && !tty->winsize.ws_col) {
+ tty->winsize.ws_row = vc_cons[currcons].d->vc_rows;
+@@ -3263,6 +3277,13 @@ static void con_shutdown(struct tty_struct *tty)
+ console_unlock();
+ }
+
++static void con_cleanup(struct tty_struct *tty)
++{
++ struct vc_data *vc = tty->driver_data;
++
++ tty_port_put(&vc->port);
++}
++
+ static int default_color = 7; /* white */
+ static int default_italic_color = 2; // green (ASCII)
+ static int default_underline_color = 3; // cyan (ASCII)
+@@ -3387,7 +3408,8 @@ static const struct tty_operations con_ops = {
+ .throttle = con_throttle,
+ .unthrottle = con_unthrottle,
+ .resize = vt_resize,
+- .shutdown = con_shutdown
++ .shutdown = con_shutdown,
++ .cleanup = con_cleanup,
+ };
+
+ static struct cdev vc0_cdev;
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index 2bb6de89b029..5de81431c835 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -39,11 +39,32 @@
+ #include <linux/kbd_diacr.h>
+ #include <linux/selection.h>
+
+-char vt_dont_switch;
+-extern struct tty_driver *console_driver;
++bool vt_dont_switch;
+
+-#define VT_IS_IN_USE(i) (console_driver->ttys[i] && console_driver->ttys[i]->count)
+-#define VT_BUSY(i) (VT_IS_IN_USE(i) || i == fg_console || vc_cons[i].d == sel_cons)
++static inline bool vt_in_use(unsigned int i)
++{
++ const struct vc_data *vc = vc_cons[i].d;
++
++ /*
++ * console_lock must be held to prevent the vc from being deallocated
++ * while we're checking whether it's in-use.
++ */
++ WARN_CONSOLE_UNLOCKED();
++
++ return vc && kref_read(&vc->port.kref) > 1;
++}
++
++static inline bool vt_busy(int i)
++{
++ if (vt_in_use(i))
++ return true;
++ if (i == fg_console)
++ return true;
++ if (vc_is_sel(vc_cons[i].d))
++ return true;
++
++ return false;
++}
+
+ /*
+ * Console (vt and kd) routines, as defined by USL SVR4 manual, and by
+@@ -289,16 +310,14 @@ static int vt_disallocate(unsigned int vc_num)
+ int ret = 0;
+
+ console_lock();
+- if (VT_BUSY(vc_num))
++ if (vt_busy(vc_num))
+ ret = -EBUSY;
+ else if (vc_num)
+ vc = vc_deallocate(vc_num);
+ console_unlock();
+
+- if (vc && vc_num >= MIN_NR_CONSOLES) {
+- tty_port_destroy(&vc->port);
+- kfree(vc);
+- }
++ if (vc && vc_num >= MIN_NR_CONSOLES)
++ tty_port_put(&vc->port);
+
+ return ret;
+ }
+@@ -311,17 +330,15 @@ static void vt_disallocate_all(void)
+
+ console_lock();
+ for (i = 1; i < MAX_NR_CONSOLES; i++)
+- if (!VT_BUSY(i))
++ if (!vt_busy(i))
+ vc[i] = vc_deallocate(i);
+ else
+ vc[i] = NULL;
+ console_unlock();
+
+ for (i = 1; i < MAX_NR_CONSOLES; i++) {
+- if (vc[i] && i >= MIN_NR_CONSOLES) {
+- tty_port_destroy(&vc[i]->port);
+- kfree(vc[i]);
+- }
++ if (vc[i] && i >= MIN_NR_CONSOLES)
++ tty_port_put(&vc[i]->port);
+ }
+ }
+
+@@ -335,22 +352,13 @@ int vt_ioctl(struct tty_struct *tty,
+ {
+ struct vc_data *vc = tty->driver_data;
+ struct console_font_op op; /* used in multiple places here */
+- unsigned int console;
++ unsigned int console = vc->vc_num;
+ unsigned char ucval;
+ unsigned int uival;
+ void __user *up = (void __user *)arg;
+ int i, perm;
+ int ret = 0;
+
+- console = vc->vc_num;
+-
+-
+- if (!vc_cons_allocated(console)) { /* impossible? */
+- ret = -ENOIOCTLCMD;
+- goto out;
+- }
+-
+-
+ /*
+ * To have permissions to do most of the vt ioctls, we either have
+ * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
+@@ -641,15 +649,16 @@ int vt_ioctl(struct tty_struct *tty,
+ struct vt_stat __user *vtstat = up;
+ unsigned short state, mask;
+
+- /* Review: FIXME: Console lock ? */
+ if (put_user(fg_console + 1, &vtstat->v_active))
+ ret = -EFAULT;
+ else {
+ state = 1; /* /dev/tty0 is always open */
++ console_lock(); /* required by vt_in_use() */
+ for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask;
+ ++i, mask <<= 1)
+- if (VT_IS_IN_USE(i))
++ if (vt_in_use(i))
+ state |= mask;
++ console_unlock();
+ ret = put_user(state, &vtstat->v_state);
+ }
+ break;
+@@ -659,10 +668,11 @@ int vt_ioctl(struct tty_struct *tty,
+ * Returns the first available (non-opened) console.
+ */
+ case VT_OPENQRY:
+- /* FIXME: locking ? - but then this is a stupid API */
++ console_lock(); /* required by vt_in_use() */
+ for (i = 0; i < MAX_NR_CONSOLES; ++i)
+- if (! VT_IS_IN_USE(i))
++ if (!vt_in_use(i))
+ break;
++ console_unlock();
+ uival = i < MAX_NR_CONSOLES ? (i+1) : -1;
+ goto setint;
+
+@@ -1011,12 +1021,12 @@ int vt_ioctl(struct tty_struct *tty,
+ case VT_LOCKSWITCH:
+ if (!capable(CAP_SYS_TTY_CONFIG))
+ return -EPERM;
+- vt_dont_switch = 1;
++ vt_dont_switch = true;
+ break;
+ case VT_UNLOCKSWITCH:
+ if (!capable(CAP_SYS_TTY_CONFIG))
+ return -EPERM;
+- vt_dont_switch = 0;
++ vt_dont_switch = false;
+ break;
+ case VT_GETHIFONTMASK:
+ ret = put_user(vc->vc_hi_font_mask,
+@@ -1180,18 +1190,10 @@ long vt_compat_ioctl(struct tty_struct *tty,
+ {
+ struct vc_data *vc = tty->driver_data;
+ struct console_font_op op; /* used in multiple places here */
+- unsigned int console;
+ void __user *up = (void __user *)arg;
+ int perm;
+ int ret = 0;
+
+- console = vc->vc_num;
+-
+- if (!vc_cons_allocated(console)) { /* impossible? */
+- ret = -ENOIOCTLCMD;
+- goto out;
+- }
+-
+ /*
+ * To have permissions to do most of the vt ioctls, we either have
+ * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
+@@ -1251,7 +1253,7 @@ long vt_compat_ioctl(struct tty_struct *tty,
+ arg = (unsigned long)compat_ptr(arg);
+ goto fallback;
+ }
+-out:
++
+ return ret;
+
+ fallback:
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 8689bf7ba60f..6e0b41861735 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -949,16 +949,16 @@ static int set_serial_info(struct acm *acm,
+
+ mutex_lock(&acm->port.mutex);
+
+- if ((new_serial.close_delay != old_close_delay) ||
+- (new_serial.closing_wait != old_closing_wait)) {
+- if (!capable(CAP_SYS_ADMIN))
++ if (!capable(CAP_SYS_ADMIN)) {
++ if ((new_serial.close_delay != old_close_delay) ||
++ (new_serial.closing_wait != old_closing_wait))
+ retval = -EPERM;
+- else {
+- acm->port.close_delay = close_delay;
+- acm->port.closing_wait = closing_wait;
+- }
+- } else
+- retval = -EOPNOTSUPP;
++ else
++ retval = -EOPNOTSUPP;
++ } else {
++ acm->port.close_delay = close_delay;
++ acm->port.closing_wait = closing_wait;
++ }
+
+ mutex_unlock(&acm->port.mutex);
+ return retval;
+diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
+index b59ce9ad14ce..68f18afa8b2c 100644
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -1462,10 +1462,7 @@ done:
+ * We need to map sg if the transfer_buffer is
+ * NULL.
+ */
+- if (!urb->transfer_buffer)
+- qh->use_sg = true;
+-
+- if (qh->use_sg) {
++ if (!urb->transfer_buffer) {
+ /* sg_miter_start is already done in musb_ep_program */
+ if (!sg_miter_next(&qh->sg_miter)) {
+ dev_err(musb->controller, "error: sg list empty\n");
+@@ -1473,9 +1470,8 @@ done:
+ status = -EINVAL;
+ goto done;
+ }
+- urb->transfer_buffer = qh->sg_miter.addr;
+ length = min_t(u32, length, qh->sg_miter.length);
+- musb_write_fifo(hw_ep, length, urb->transfer_buffer);
++ musb_write_fifo(hw_ep, length, qh->sg_miter.addr);
+ qh->sg_miter.consumed = length;
+ sg_miter_stop(&qh->sg_miter);
+ } else {
+@@ -1484,11 +1480,6 @@ done:
+
+ qh->segsize = length;
+
+- if (qh->use_sg) {
+- if (offset + length >= urb->transfer_buffer_length)
+- qh->use_sg = false;
+- }
+-
+ musb_ep_select(mbase, epnum);
+ musb_writew(epio, MUSB_TXCSR,
+ MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY);
+@@ -2003,8 +1994,10 @@ finish:
+ urb->actual_length += xfer_len;
+ qh->offset += xfer_len;
+ if (done) {
+- if (qh->use_sg)
++ if (qh->use_sg) {
+ qh->use_sg = false;
++ urb->transfer_buffer = NULL;
++ }
+
+ if (urb->status == -EINPROGRESS)
+ urb->status = status;
+diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
+index 5d101b022e71..dab8c18e726f 100644
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -710,7 +710,7 @@ static void edge_interrupt_callback(struct urb *urb)
+ /* grab the txcredits for the ports if available */
+ position = 2;
+ portNumber = 0;
+- while ((position < length) &&
++ while ((position < length - 1) &&
+ (portNumber < edge_serial->serial->num_ports)) {
+ txCredits = data[position] | (data[position+1] << 8);
+ if (txCredits) {
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 1d4c370d44fe..8dad374ec81d 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1992,8 +1992,14 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
++ { USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff), /* Wistron Neweb D19Q1 */
++ .driver_info = RSVD(1) | RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */
++ .driver_info = RSVD(1) | RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */
+ .driver_info = RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2033, 0xff), /* BroadMobi BM806U */
++ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index 560dd5ff5a15..5d6d4f9f092a 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -159,7 +159,7 @@ void afs_put_call(struct afs_call *call)
+ int n = atomic_dec_return(&call->usage);
+ int o = atomic_read(&net->nr_outstanding_calls);
+
+- trace_afs_call(call, afs_call_trace_put, n + 1, o,
++ trace_afs_call(call, afs_call_trace_put, n, o,
+ __builtin_return_address(0));
+
+ ASSERTCMP(n, >=, 0);
+@@ -654,7 +654,7 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall,
+
+ u = atomic_fetch_add_unless(&call->usage, 1, 0);
+ if (u != 0) {
+- trace_afs_call(call, afs_call_trace_wake, u,
++ trace_afs_call(call, afs_call_trace_wake, u + 1,
+ atomic_read(&call->net->nr_outstanding_calls),
+ __builtin_return_address(0));
+
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 91a7ad259bcf..faca455bd3c6 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -1384,9 +1384,12 @@ static ssize_t ceph_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ struct inode *inode = file_inode(file);
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
++ struct ceph_osd_client *osdc = &fsc->client->osdc;
+ struct ceph_cap_flush *prealloc_cf;
+ ssize_t count, written = 0;
+ int err, want, got;
++ u32 map_flags;
++ u64 pool_flags;
+ loff_t pos;
+ loff_t limit = max(i_size_read(inode), fsc->max_file_size);
+
+@@ -1441,8 +1444,12 @@ retry_snap:
+ goto out;
+ }
+
+- /* FIXME: not complete since it doesn't account for being at quota */
+- if (ceph_osdmap_flag(&fsc->client->osdc, CEPH_OSDMAP_FULL)) {
++ down_read(&osdc->lock);
++ map_flags = osdc->osdmap->flags;
++ pool_flags = ceph_pg_pool_flags(osdc->osdmap, ci->i_layout.pool_id);
++ up_read(&osdc->lock);
++ if ((map_flags & CEPH_OSDMAP_FULL) ||
++ (pool_flags & CEPH_POOL_FLAG_FULL)) {
+ err = -ENOSPC;
+ goto out;
+ }
+@@ -1532,7 +1539,8 @@ retry_snap:
+ }
+
+ if (written >= 0) {
+- if (ceph_osdmap_flag(&fsc->client->osdc, CEPH_OSDMAP_NEARFULL))
++ if ((map_flags & CEPH_OSDMAP_NEARFULL) ||
++ (pool_flags & CEPH_POOL_FLAG_NEARFULL))
+ iocb->ki_flags |= IOCB_DSYNC;
+ written = generic_write_sync(iocb, written);
+ }
+diff --git a/fs/libfs.c b/fs/libfs.c
+index bd2d193d0a2a..02158618f4c9 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -802,7 +802,7 @@ int simple_attr_open(struct inode *inode, struct file *file,
+ {
+ struct simple_attr *attr;
+
+- attr = kmalloc(sizeof(*attr), GFP_KERNEL);
++ attr = kzalloc(sizeof(*attr), GFP_KERNEL);
+ if (!attr)
+ return -ENOMEM;
+
+@@ -842,9 +842,11 @@ ssize_t simple_attr_read(struct file *file, char __user *buf,
+ if (ret)
+ return ret;
+
+- if (*ppos) { /* continued read */
++ if (*ppos && attr->get_buf[0]) {
++ /* continued read */
+ size = strlen(attr->get_buf);
+- } else { /* first read */
++ } else {
++ /* first read */
+ u64 val;
+ ret = attr->get(attr->data, &val);
+ if (ret)
+diff --git a/fs/nfs/client.c b/fs/nfs/client.c
+index 0a2b59c1ecb3..07c5ddd5d6d5 100644
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -157,6 +157,7 @@ struct nfs_client *nfs_alloc_client(const struct nfs_client_initdata *cl_init)
+ if ((clp = kzalloc(sizeof(*clp), GFP_KERNEL)) == NULL)
+ goto error_0;
+
++ clp->cl_minorversion = cl_init->minorversion;
+ clp->cl_nfs_mod = cl_init->nfs_mod;
+ if (!try_module_get(clp->cl_nfs_mod->owner))
+ goto error_dealloc;
+diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
+index a7bc4e0494f9..6f45b1a95739 100644
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -35,6 +35,7 @@ static DEFINE_SPINLOCK(nfs_fscache_keys_lock);
+ struct nfs_server_key {
+ struct {
+ uint16_t nfsversion; /* NFS protocol version */
++ uint32_t minorversion; /* NFSv4 minor version */
+ uint16_t family; /* address family */
+ __be16 port; /* IP port */
+ } hdr;
+@@ -59,6 +60,7 @@ void nfs_fscache_get_client_cookie(struct nfs_client *clp)
+
+ memset(&key, 0, sizeof(key));
+ key.hdr.nfsversion = clp->rpc_ops->version;
++ key.hdr.minorversion = clp->cl_minorversion;
+ key.hdr.family = clp->cl_addr.ss_family;
+
+ switch (clp->cl_addr.ss_family) {
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 86991bcfbeb1..faaabbedc891 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -210,7 +210,6 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ INIT_LIST_HEAD(&clp->cl_ds_clients);
+ rpc_init_wait_queue(&clp->cl_rpcwaitq, "NFS client");
+ clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED;
+- clp->cl_minorversion = cl_init->minorversion;
+ clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion];
+ clp->cl_mig_gen = 1;
+ #if IS_ENABLED(CONFIG_NFS_V4_1)
+diff --git a/include/linux/ceph/osdmap.h b/include/linux/ceph/osdmap.h
+index 5675b1f09bc5..43fdadeb22da 100644
+--- a/include/linux/ceph/osdmap.h
++++ b/include/linux/ceph/osdmap.h
+@@ -37,6 +37,9 @@ int ceph_spg_compare(const struct ceph_spg *lhs, const struct ceph_spg *rhs);
+ #define CEPH_POOL_FLAG_HASHPSPOOL (1ULL << 0) /* hash pg seed and pool id
+ together */
+ #define CEPH_POOL_FLAG_FULL (1ULL << 1) /* pool is full */
++#define CEPH_POOL_FLAG_FULL_QUOTA (1ULL << 10) /* pool ran out of quota,
++ will set FULL too */
++#define CEPH_POOL_FLAG_NEARFULL (1ULL << 11) /* pool is nearfull */
+
+ struct ceph_pg_pool_info {
+ struct rb_node node;
+@@ -305,5 +308,6 @@ extern struct ceph_pg_pool_info *ceph_pg_pool_by_id(struct ceph_osdmap *map,
+
+ extern const char *ceph_pg_pool_name_by_id(struct ceph_osdmap *map, u64 id);
+ extern int ceph_pg_poolid_by_name(struct ceph_osdmap *map, const char *name);
++u64 ceph_pg_pool_flags(struct ceph_osdmap *map, u64 id);
+
+ #endif
+diff --git a/include/linux/ceph/rados.h b/include/linux/ceph/rados.h
+index f1988387c5ad..f6026bf4d8f4 100644
+--- a/include/linux/ceph/rados.h
++++ b/include/linux/ceph/rados.h
+@@ -143,8 +143,10 @@ extern const char *ceph_osd_state_name(int s);
+ /*
+ * osd map flag bits
+ */
+-#define CEPH_OSDMAP_NEARFULL (1<<0) /* sync writes (near ENOSPC) */
+-#define CEPH_OSDMAP_FULL (1<<1) /* no data writes (ENOSPC) */
++#define CEPH_OSDMAP_NEARFULL (1<<0) /* sync writes (near ENOSPC),
++ not set since ~luminous */
++#define CEPH_OSDMAP_FULL (1<<1) /* no data writes (ENOSPC),
++ not set since ~luminous */
+ #define CEPH_OSDMAP_PAUSERD (1<<2) /* pause all reads */
+ #define CEPH_OSDMAP_PAUSEWR (1<<3) /* pause all writes */
+ #define CEPH_OSDMAP_PAUSEREC (1<<4) /* pause recovery */
+diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
+index 840462ed1ec7..7e8e5b20e82b 100644
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -332,6 +332,7 @@ struct mmc_host {
+ MMC_CAP_UHS_SDR50 | MMC_CAP_UHS_SDR104 | \
+ MMC_CAP_UHS_DDR50)
+ /* (1 << 21) is free for reuse */
++#define MMC_CAP_NEED_RSP_BUSY (1 << 22) /* Commands with R1B can't use R1. */
+ #define MMC_CAP_DRIVER_TYPE_A (1 << 23) /* Host supports Driver Type A */
+ #define MMC_CAP_DRIVER_TYPE_C (1 << 24) /* Host supports Driver Type C */
+ #define MMC_CAP_DRIVER_TYPE_D (1 << 25) /* Host supports Driver Type D */
+diff --git a/include/linux/selection.h b/include/linux/selection.h
+index a8f5b97b216f..77a1fb7c3fd5 100644
+--- a/include/linux/selection.h
++++ b/include/linux/selection.h
+@@ -13,8 +13,8 @@
+
+ struct tty_struct;
+
+-extern struct vc_data *sel_cons;
+ struct tty_struct;
++struct vc_data;
+
+ extern void clear_selection(void);
+ extern int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *tty);
+@@ -23,6 +23,8 @@ extern int sel_loadlut(char __user *p);
+ extern int mouse_reporting(void);
+ extern void mouse_report(struct tty_struct * tty, int butt, int mrx, int mry);
+
++bool vc_is_sel(struct vc_data *vc);
++
+ extern int console_blanked;
+
+ extern const unsigned char color_table[];
+diff --git a/include/linux/vt_kern.h b/include/linux/vt_kern.h
+index 3fd07912909c..a3de234d3350 100644
+--- a/include/linux/vt_kern.h
++++ b/include/linux/vt_kern.h
+@@ -142,7 +142,7 @@ static inline bool vt_force_oops_output(struct vc_data *vc)
+ return false;
+ }
+
+-extern char vt_dont_switch;
++extern bool vt_dont_switch;
+ extern int default_utf8;
+ extern int global_cursor_default;
+
+diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h
+index d0a341bc4540..5bc2e30c0d75 100644
+--- a/include/trace/events/afs.h
++++ b/include/trace/events/afs.h
+@@ -94,7 +94,7 @@ enum afs_edit_dir_reason {
+ EM(afs_call_trace_free, "FREE ") \
+ EM(afs_call_trace_put, "PUT ") \
+ EM(afs_call_trace_wake, "WAKE ") \
+- E_(afs_call_trace_work, "WORK ")
++ E_(afs_call_trace_work, "QUEUE")
+
+ #define afs_fs_operations \
+ EM(afs_FS_FetchData, "FS.FetchData") \
+diff --git a/include/uapi/linux/serio.h b/include/uapi/linux/serio.h
+index a0cac1d8670d..1937915be413 100644
+--- a/include/uapi/linux/serio.h
++++ b/include/uapi/linux/serio.h
+@@ -9,7 +9,7 @@
+ #ifndef _UAPI_SERIO_H
+ #define _UAPI_SERIO_H
+
+-
++#include <linux/const.h>
+ #include <linux/ioctl.h>
+
+ #define SPIOCSTYPE _IOW('q', 0x01, unsigned long)
+@@ -18,10 +18,10 @@
+ /*
+ * bit masks for use in "interrupt" flags (3rd argument)
+ */
+-#define SERIO_TIMEOUT BIT(0)
+-#define SERIO_PARITY BIT(1)
+-#define SERIO_FRAME BIT(2)
+-#define SERIO_OOB_DATA BIT(3)
++#define SERIO_TIMEOUT _BITUL(0)
++#define SERIO_PARITY _BITUL(1)
++#define SERIO_FRAME _BITUL(2)
++#define SERIO_OOB_DATA _BITUL(3)
+
+ /*
+ * Serio types
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 3e2413345e71..471cc5c117a5 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -1763,7 +1763,7 @@ static int btf_enum_check_member(struct btf_verifier_env *env,
+
+ struct_size = struct_type->size;
+ bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
+- if (struct_size - bytes_offset < sizeof(int)) {
++ if (struct_size - bytes_offset < member_type->size) {
+ btf_verifier_log_member(env, struct_type, member,
+ "Member exceeds struct_size");
+ return -EINVAL;
+@@ -2387,7 +2387,7 @@ int btf_get_info_by_fd(const struct btf *btf,
+ union bpf_attr __user *uattr)
+ {
+ struct bpf_btf_info __user *uinfo;
+- struct bpf_btf_info info = {};
++ struct bpf_btf_info info;
+ u32 info_copy, btf_copy;
+ void __user *ubtf;
+ u32 uinfo_len;
+@@ -2396,6 +2396,7 @@ int btf_get_info_by_fd(const struct btf *btf,
+ uinfo_len = attr->info.info_len;
+
+ info_copy = min_t(u32, uinfo_len, sizeof(info));
++ memset(&info, 0, sizeof(info));
+ if (copy_from_user(&info, uinfo, info_copy))
+ return -EFAULT;
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 596959288eb9..b766265cf37d 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1958,7 +1958,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
+ union bpf_attr __user *uattr)
+ {
+ struct bpf_prog_info __user *uinfo = u64_to_user_ptr(attr->info.info);
+- struct bpf_prog_info info = {};
++ struct bpf_prog_info info;
+ u32 info_len = attr->info.info_len;
+ char __user *uinsns;
+ u32 ulen;
+@@ -1969,6 +1969,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
+ return err;
+ info_len = min_t(u32, sizeof(info), info_len);
+
++ memset(&info, 0, sizeof(info));
+ if (copy_from_user(&info, uinfo, info_len))
+ return -EFAULT;
+
+@@ -2136,7 +2137,7 @@ static int bpf_map_get_info_by_fd(struct bpf_map *map,
+ union bpf_attr __user *uattr)
+ {
+ struct bpf_map_info __user *uinfo = u64_to_user_ptr(attr->info.info);
+- struct bpf_map_info info = {};
++ struct bpf_map_info info;
+ u32 info_len = attr->info.info_len;
+ int err;
+
+@@ -2145,6 +2146,7 @@ static int bpf_map_get_info_by_fd(struct bpf_map *map,
+ return err;
+ info_len = min_t(u32, sizeof(info), info_len);
+
++ memset(&info, 0, sizeof(info));
+ info.type = map->map_type;
+ info.id = map->id;
+ info.key_size = map->key_size;
+@@ -2372,7 +2374,7 @@ out:
+
+ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, size)
+ {
+- union bpf_attr attr = {};
++ union bpf_attr attr;
+ int err;
+
+ if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN))
+@@ -2384,6 +2386,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz
+ size = min_t(u32, size, sizeof(attr));
+
+ /* copy attributes from user space, may be less than sizeof(bpf_attr) */
++ memset(&attr, 0, sizeof(attr));
+ if (copy_from_user(&attr, uattr, size) != 0)
+ return -EFAULT;
+
+diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
+index 51063e7a93c2..dd8bdbfbbde1 100644
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -501,6 +501,7 @@ static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos)
+ */
+ p++;
+ if (p >= end) {
++ (*pos)++;
+ return NULL;
+ } else {
+ *pos = *p;
+@@ -811,7 +812,7 @@ void cgroup1_release_agent(struct work_struct *work)
+
+ pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
+ agentbuf = kstrdup(cgrp->root->release_agent_path, GFP_KERNEL);
+- if (!pathbuf || !agentbuf)
++ if (!pathbuf || !agentbuf || !strlen(agentbuf))
+ goto out;
+
+ spin_lock_irq(&css_set_lock);
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index eb69b805f908..efcb54ee0922 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -283,7 +283,11 @@ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
+
+ if (desc->affinity_notify) {
+ kref_get(&desc->affinity_notify->kref);
+- schedule_work(&desc->affinity_notify->work);
++ if (!schedule_work(&desc->affinity_notify->work)) {
++ /* Work was already scheduled, drop our extra ref */
++ kref_put(&desc->affinity_notify->kref,
++ desc->affinity_notify->release);
++ }
+ }
+ irqd_set(data, IRQD_AFFINITY_SET);
+
+@@ -383,7 +387,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify)
+ raw_spin_unlock_irqrestore(&desc->lock, flags);
+
+ if (old_notify) {
+- cancel_work_sync(&old_notify->work);
++ if (cancel_work_sync(&old_notify->work)) {
++ /* Pending work had a ref, put that one too */
++ kref_put(&old_notify->kref, old_notify->release);
++ }
+ kref_put(&old_notify->kref, old_notify->release);
+ }
+
+diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
+index 98c0ff3d6441..7cb6025fe092 100644
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -711,6 +711,15 @@ int ceph_pg_poolid_by_name(struct ceph_osdmap *map, const char *name)
+ }
+ EXPORT_SYMBOL(ceph_pg_poolid_by_name);
+
++u64 ceph_pg_pool_flags(struct ceph_osdmap *map, u64 id)
++{
++ struct ceph_pg_pool_info *pi;
++
++ pi = __lookup_pg_pool(&map->pg_pools, id);
++ return pi ? pi->flags : 0;
++}
++EXPORT_SYMBOL(ceph_pg_pool_flags);
++
+ static void __remove_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *pi)
+ {
+ rb_erase(&pi->node, root);
+diff --git a/net/dsa/tag_brcm.c b/net/dsa/tag_brcm.c
+index 2b06bb91318b..2709bddef7d5 100644
+--- a/net/dsa/tag_brcm.c
++++ b/net/dsa/tag_brcm.c
+@@ -141,6 +141,8 @@ static struct sk_buff *brcm_tag_rcv_ll(struct sk_buff *skb,
+ /* Remove Broadcom tag and update checksum */
+ skb_pull_rcsum(skb, BRCM_TAG_LEN);
+
++ skb->offload_fwd_mark = 1;
++
+ return skb;
+ }
+
+diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
+index 9af16cb68f76..f5a3601948ca 100644
+--- a/net/hsr/hsr_framereg.c
++++ b/net/hsr/hsr_framereg.c
+@@ -466,13 +466,9 @@ int hsr_get_node_data(struct hsr_priv *hsr,
+ struct hsr_port *port;
+ unsigned long tdiff;
+
+-
+- rcu_read_lock();
+ node = find_node_by_AddrA(&hsr->node_db, addr);
+- if (!node) {
+- rcu_read_unlock();
+- return -ENOENT; /* No such entry */
+- }
++ if (!node)
++ return -ENOENT;
+
+ ether_addr_copy(addr_b, node->MacAddressB);
+
+@@ -507,7 +503,5 @@ int hsr_get_node_data(struct hsr_priv *hsr,
+ *addr_b_ifindex = -1;
+ }
+
+- rcu_read_unlock();
+-
+ return 0;
+ }
+diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
+index b9cce0fd5696..37708dabebd1 100644
+--- a/net/hsr/hsr_netlink.c
++++ b/net/hsr/hsr_netlink.c
+@@ -259,17 +259,16 @@ static int hsr_get_node_status(struct sk_buff *skb_in, struct genl_info *info)
+ if (!na)
+ goto invalid;
+
+- hsr_dev = __dev_get_by_index(genl_info_net(info),
+- nla_get_u32(info->attrs[HSR_A_IFINDEX]));
++ rcu_read_lock();
++ hsr_dev = dev_get_by_index_rcu(genl_info_net(info),
++ nla_get_u32(info->attrs[HSR_A_IFINDEX]));
+ if (!hsr_dev)
+- goto invalid;
++ goto rcu_unlock;
+ if (!is_hsr_master(hsr_dev))
+- goto invalid;
+-
++ goto rcu_unlock;
+
+ /* Send reply */
+-
+- skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
++ skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
+ if (!skb_out) {
+ res = -ENOMEM;
+ goto fail;
+@@ -321,12 +320,10 @@ static int hsr_get_node_status(struct sk_buff *skb_in, struct genl_info *info)
+ res = nla_put_u16(skb_out, HSR_A_IF1_SEQ, hsr_node_if1_seq);
+ if (res < 0)
+ goto nla_put_failure;
+- rcu_read_lock();
+ port = hsr_port_get_hsr(hsr, HSR_PT_SLAVE_A);
+ if (port)
+ res = nla_put_u32(skb_out, HSR_A_IF1_IFINDEX,
+ port->dev->ifindex);
+- rcu_read_unlock();
+ if (res < 0)
+ goto nla_put_failure;
+
+@@ -336,20 +333,22 @@ static int hsr_get_node_status(struct sk_buff *skb_in, struct genl_info *info)
+ res = nla_put_u16(skb_out, HSR_A_IF2_SEQ, hsr_node_if2_seq);
+ if (res < 0)
+ goto nla_put_failure;
+- rcu_read_lock();
+ port = hsr_port_get_hsr(hsr, HSR_PT_SLAVE_B);
+ if (port)
+ res = nla_put_u32(skb_out, HSR_A_IF2_IFINDEX,
+ port->dev->ifindex);
+- rcu_read_unlock();
+ if (res < 0)
+ goto nla_put_failure;
+
++ rcu_read_unlock();
++
+ genlmsg_end(skb_out, msg_head);
+ genlmsg_unicast(genl_info_net(info), skb_out, info->snd_portid);
+
+ return 0;
+
++rcu_unlock:
++ rcu_read_unlock();
+ invalid:
+ netlink_ack(skb_in, nlmsg_hdr(skb_in), -EINVAL, NULL);
+ return 0;
+@@ -359,6 +358,7 @@ nla_put_failure:
+ /* Fall through */
+
+ fail:
++ rcu_read_unlock();
+ return res;
+ }
+
+@@ -366,16 +366,14 @@ fail:
+ */
+ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info)
+ {
+- /* For receiving */
+- struct nlattr *na;
++ unsigned char addr[ETH_ALEN];
+ struct net_device *hsr_dev;
+-
+- /* For sending */
+ struct sk_buff *skb_out;
+- void *msg_head;
+ struct hsr_priv *hsr;
+- void *pos;
+- unsigned char addr[ETH_ALEN];
++ bool restart = false;
++ struct nlattr *na;
++ void *pos = NULL;
++ void *msg_head;
+ int res;
+
+ if (!info)
+@@ -385,17 +383,17 @@ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info)
+ if (!na)
+ goto invalid;
+
+- hsr_dev = __dev_get_by_index(genl_info_net(info),
+- nla_get_u32(info->attrs[HSR_A_IFINDEX]));
++ rcu_read_lock();
++ hsr_dev = dev_get_by_index_rcu(genl_info_net(info),
++ nla_get_u32(info->attrs[HSR_A_IFINDEX]));
+ if (!hsr_dev)
+- goto invalid;
++ goto rcu_unlock;
+ if (!is_hsr_master(hsr_dev))
+- goto invalid;
+-
++ goto rcu_unlock;
+
++restart:
+ /* Send reply */
+-
+- skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
++ skb_out = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+ if (!skb_out) {
+ res = -ENOMEM;
+ goto fail;
+@@ -409,18 +407,26 @@ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info)
+ goto nla_put_failure;
+ }
+
+- res = nla_put_u32(skb_out, HSR_A_IFINDEX, hsr_dev->ifindex);
+- if (res < 0)
+- goto nla_put_failure;
++ if (!restart) {
++ res = nla_put_u32(skb_out, HSR_A_IFINDEX, hsr_dev->ifindex);
++ if (res < 0)
++ goto nla_put_failure;
++ }
+
+ hsr = netdev_priv(hsr_dev);
+
+- rcu_read_lock();
+- pos = hsr_get_next_node(hsr, NULL, addr);
++ if (!pos)
++ pos = hsr_get_next_node(hsr, NULL, addr);
+ while (pos) {
+ res = nla_put(skb_out, HSR_A_NODE_ADDR, ETH_ALEN, addr);
+ if (res < 0) {
+- rcu_read_unlock();
++ if (res == -EMSGSIZE) {
++ genlmsg_end(skb_out, msg_head);
++ genlmsg_unicast(genl_info_net(info), skb_out,
++ info->snd_portid);
++ restart = true;
++ goto restart;
++ }
+ goto nla_put_failure;
+ }
+ pos = hsr_get_next_node(hsr, pos, addr);
+@@ -432,15 +438,18 @@ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info)
+
+ return 0;
+
++rcu_unlock:
++ rcu_read_unlock();
+ invalid:
+ netlink_ack(skb_in, nlmsg_hdr(skb_in), -EINVAL, NULL);
+ return 0;
+
+ nla_put_failure:
+- kfree_skb(skb_out);
++ nlmsg_free(skb_out);
+ /* Fall through */
+
+ fail:
++ rcu_read_unlock();
+ return res;
+ }
+
+@@ -467,6 +476,7 @@ static struct genl_family hsr_genl_family __ro_after_init = {
+ .name = "HSR",
+ .version = 1,
+ .maxattr = HSR_A_MAX,
++ .netnsok = true,
+ .module = THIS_MODULE,
+ .ops = hsr_ops,
+ .n_ops = ARRAY_SIZE(hsr_ops),
+diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c
+index 5fee6ec7c93d..b215df0bce0e 100644
+--- a/net/hsr/hsr_slave.c
++++ b/net/hsr/hsr_slave.c
+@@ -152,16 +152,16 @@ int hsr_add_port(struct hsr_priv *hsr, struct net_device *dev,
+ if (port == NULL)
+ return -ENOMEM;
+
++ port->hsr = hsr;
++ port->dev = dev;
++ port->type = type;
++
+ if (type != HSR_PT_MASTER) {
+ res = hsr_portdev_setup(dev, port);
+ if (res)
+ goto fail_dev_setup;
+ }
+
+- port->hsr = hsr;
+- port->dev = dev;
+- port->type = type;
+-
+ list_add_tail_rcu(&port->port_list, &hsr->ports);
+ synchronize_rcu();
+
+diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
+index 32cae39cdff6..2e12f848203a 100644
+--- a/net/ipv4/Kconfig
++++ b/net/ipv4/Kconfig
+@@ -302,6 +302,7 @@ config SYN_COOKIES
+
+ config NET_IPVTI
+ tristate "Virtual (secure) IP: tunneling"
++ depends on IPV6 || IPV6=n
+ select INET_TUNNEL
+ select NET_IP_TUNNEL
+ depends on INET_XFRM_MODE_TUNNEL
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index a3f77441f3e6..ffcb5983107d 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -1226,6 +1226,24 @@ static int ipgre_netlink_parms(struct net_device *dev,
+ if (data[IFLA_GRE_FWMARK])
+ *fwmark = nla_get_u32(data[IFLA_GRE_FWMARK]);
+
++ return 0;
++}
++
++static int erspan_netlink_parms(struct net_device *dev,
++ struct nlattr *data[],
++ struct nlattr *tb[],
++ struct ip_tunnel_parm *parms,
++ __u32 *fwmark)
++{
++ struct ip_tunnel *t = netdev_priv(dev);
++ int err;
++
++ err = ipgre_netlink_parms(dev, data, tb, parms, fwmark);
++ if (err)
++ return err;
++ if (!data)
++ return 0;
++
+ if (data[IFLA_GRE_ERSPAN_VER]) {
+ t->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
+
+@@ -1355,45 +1373,70 @@ bool is_gretap_dev(const struct net_device *dev)
+ }
+ EXPORT_SYMBOL_GPL(is_gretap_dev);
+
+-static int ipgre_newlink(struct net *src_net, struct net_device *dev,
+- struct nlattr *tb[], struct nlattr *data[],
+- struct netlink_ext_ack *extack)
++static int
++ipgre_newlink_encap_setup(struct net_device *dev, struct nlattr *data[])
+ {
+- struct ip_tunnel_parm p;
+ struct ip_tunnel_encap ipencap;
+- __u32 fwmark = 0;
+- int err;
+
+ if (ipgre_netlink_encap_parms(data, &ipencap)) {
+ struct ip_tunnel *t = netdev_priv(dev);
+- err = ip_tunnel_encap_setup(t, &ipencap);
++ int err = ip_tunnel_encap_setup(t, &ipencap);
+
+ if (err < 0)
+ return err;
+ }
+
++ return 0;
++}
++
++static int ipgre_newlink(struct net *src_net, struct net_device *dev,
++ struct nlattr *tb[], struct nlattr *data[],
++ struct netlink_ext_ack *extack)
++{
++ struct ip_tunnel_parm p;
++ __u32 fwmark = 0;
++ int err;
++
++ err = ipgre_newlink_encap_setup(dev, data);
++ if (err)
++ return err;
++
+ err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark);
+ if (err < 0)
+ return err;
+ return ip_tunnel_newlink(dev, tb, &p, fwmark);
+ }
+
++static int erspan_newlink(struct net *src_net, struct net_device *dev,
++ struct nlattr *tb[], struct nlattr *data[],
++ struct netlink_ext_ack *extack)
++{
++ struct ip_tunnel_parm p;
++ __u32 fwmark = 0;
++ int err;
++
++ err = ipgre_newlink_encap_setup(dev, data);
++ if (err)
++ return err;
++
++ err = erspan_netlink_parms(dev, data, tb, &p, &fwmark);
++ if (err)
++ return err;
++ return ip_tunnel_newlink(dev, tb, &p, fwmark);
++}
++
+ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
+ struct nlattr *data[],
+ struct netlink_ext_ack *extack)
+ {
+ struct ip_tunnel *t = netdev_priv(dev);
+- struct ip_tunnel_encap ipencap;
+ __u32 fwmark = t->fwmark;
+ struct ip_tunnel_parm p;
+ int err;
+
+- if (ipgre_netlink_encap_parms(data, &ipencap)) {
+- err = ip_tunnel_encap_setup(t, &ipencap);
+-
+- if (err < 0)
+- return err;
+- }
++ err = ipgre_newlink_encap_setup(dev, data);
++ if (err)
++ return err;
+
+ err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark);
+ if (err < 0)
+@@ -1406,8 +1449,34 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
+ t->parms.i_flags = p.i_flags;
+ t->parms.o_flags = p.o_flags;
+
+- if (strcmp(dev->rtnl_link_ops->kind, "erspan"))
+- ipgre_link_update(dev, !tb[IFLA_MTU]);
++ ipgre_link_update(dev, !tb[IFLA_MTU]);
++
++ return 0;
++}
++
++static int erspan_changelink(struct net_device *dev, struct nlattr *tb[],
++ struct nlattr *data[],
++ struct netlink_ext_ack *extack)
++{
++ struct ip_tunnel *t = netdev_priv(dev);
++ __u32 fwmark = t->fwmark;
++ struct ip_tunnel_parm p;
++ int err;
++
++ err = ipgre_newlink_encap_setup(dev, data);
++ if (err)
++ return err;
++
++ err = erspan_netlink_parms(dev, data, tb, &p, &fwmark);
++ if (err < 0)
++ return err;
++
++ err = ip_tunnel_changelink(dev, tb, &p, fwmark);
++ if (err < 0)
++ return err;
++
++ t->parms.i_flags = p.i_flags;
++ t->parms.o_flags = p.o_flags;
+
+ return 0;
+ }
+@@ -1598,8 +1667,8 @@ static struct rtnl_link_ops erspan_link_ops __read_mostly = {
+ .priv_size = sizeof(struct ip_tunnel),
+ .setup = erspan_setup,
+ .validate = erspan_validate,
+- .newlink = ipgre_newlink,
+- .changelink = ipgre_changelink,
++ .newlink = erspan_newlink,
++ .changelink = erspan_changelink,
+ .dellink = ip_tunnel_dellink,
+ .get_size = ipgre_get_size,
+ .fill_info = ipgre_fill_info,
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index f5e5fcd90859..ccb1d97dfa05 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -208,17 +208,39 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
+ int mtu;
+
+ if (!dst) {
+- struct rtable *rt;
+-
+- fl->u.ip4.flowi4_oif = dev->ifindex;
+- fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
+- rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
+- if (IS_ERR(rt)) {
++ switch (skb->protocol) {
++ case htons(ETH_P_IP): {
++ struct rtable *rt;
++
++ fl->u.ip4.flowi4_oif = dev->ifindex;
++ fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++ rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
++ if (IS_ERR(rt)) {
++ dev->stats.tx_carrier_errors++;
++ goto tx_error_icmp;
++ }
++ dst = &rt->dst;
++ skb_dst_set(skb, dst);
++ break;
++ }
++#if IS_ENABLED(CONFIG_IPV6)
++ case htons(ETH_P_IPV6):
++ fl->u.ip6.flowi6_oif = dev->ifindex;
++ fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
++ if (dst->error) {
++ dst_release(dst);
++ dst = NULL;
++ dev->stats.tx_carrier_errors++;
++ goto tx_error_icmp;
++ }
++ skb_dst_set(skb, dst);
++ break;
++#endif
++ default:
+ dev->stats.tx_carrier_errors++;
+ goto tx_error_icmp;
+ }
+- dst = &rt->dst;
+- skb_dst_set(skb, dst);
+ }
+
+ dst_hold(dst);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 34fda81c7db0..54dda47a9a56 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2870,8 +2870,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ err = -EPERM;
+ else if (tp->repair_queue == TCP_SEND_QUEUE)
+ tp->write_seq = val;
+- else if (tp->repair_queue == TCP_RECV_QUEUE)
++ else if (tp->repair_queue == TCP_RECV_QUEUE) {
+ WRITE_ONCE(tp->rcv_nxt, val);
++ WRITE_ONCE(tp->copied_seq, val);
++ }
+ else
+ err = -EINVAL;
+ break;
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 67ff206b6d61..94f16e82a458 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -315,7 +315,7 @@ static int vti6_rcv(struct sk_buff *skb)
+
+ if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
+ rcu_read_unlock();
+- return 0;
++ goto discard;
+ }
+
+ ipv6h = ipv6_hdr(skb);
+@@ -454,15 +454,33 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ int mtu;
+
+ if (!dst) {
+- fl->u.ip6.flowi6_oif = dev->ifindex;
+- fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
+- dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
+- if (dst->error) {
+- dst_release(dst);
+- dst = NULL;
++ switch (skb->protocol) {
++ case htons(ETH_P_IP): {
++ struct rtable *rt;
++
++ fl->u.ip4.flowi4_oif = dev->ifindex;
++ fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++ rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
++ if (IS_ERR(rt))
++ goto tx_err_link_failure;
++ dst = &rt->dst;
++ skb_dst_set(skb, dst);
++ break;
++ }
++ case htons(ETH_P_IPV6):
++ fl->u.ip6.flowi6_oif = dev->ifindex;
++ fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
++ if (dst->error) {
++ dst_release(dst);
++ dst = NULL;
++ goto tx_err_link_failure;
++ }
++ skb_dst_set(skb, dst);
++ break;
++ default:
+ goto tx_err_link_failure;
+ }
+- skb_dst_set(skb, dst);
+ }
+
+ dst_hold(dst);
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index cfd30671ccdf..a879d8071712 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1729,7 +1729,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
+ struct net_device *dev);
+ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
+ struct net_device *dev,
+- u32 info_flags);
++ u32 info_flags,
++ u32 ctrl_flags);
+ void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
+ struct sk_buff_head *skbs);
+ struct sk_buff *
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index 740dc9fa127c..433d136282de 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -1137,7 +1137,8 @@ int mesh_nexthop_resolve(struct ieee80211_sub_if_data *sdata,
+ }
+ }
+
+- if (!(mpath->flags & MESH_PATH_RESOLVING))
++ if (!(mpath->flags & MESH_PATH_RESOLVING) &&
++ mesh_path_sel_is_hwmp(sdata))
+ mesh_queue_preq(mpath, PREQ_Q_F_START);
+
+ if (skb_queue_len(&mpath->frame_queue) >= MESH_FRAME_QUEUE_LEN)
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 0c80a59ef914..ec2e83272f9d 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -3,7 +3,7 @@
+ * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
+ * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
+- * Copyright (C) 2018 Intel Corporation
++ * Copyright (C) 2018-2020 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -979,6 +979,11 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
+ might_sleep();
+ lockdep_assert_held(&local->sta_mtx);
+
++ while (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
++ ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
++ WARN_ON_ONCE(ret);
++ }
++
+ /* now keys can no longer be reached */
+ ieee80211_free_sta_keys(local, sta);
+
+diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
+index 67745d1d4c5d..aa6fabfed3a7 100644
+--- a/net/mac80211/tdls.c
++++ b/net/mac80211/tdls.c
+@@ -1055,7 +1055,7 @@ ieee80211_tdls_prep_mgmt_packet(struct wiphy *wiphy, struct net_device *dev,
+
+ /* disable bottom halves when entering the Tx path */
+ local_bh_disable();
+- __ieee80211_subif_start_xmit(skb, dev, flags);
++ __ieee80211_subif_start_xmit(skb, dev, flags, 0);
+ local_bh_enable();
+
+ return ret;
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 2f726cde9998..84639363173b 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -4,7 +4,7 @@
+ * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
+- * Copyright (C) 2018 Intel Corporation
++ * Copyright (C) 2018, 2020 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -2399,6 +2399,7 @@ static int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
+ * @sdata: virtual interface to build the header for
+ * @skb: the skb to build the header in
+ * @info_flags: skb flags to set
++ * @ctrl_flags: info control flags to set
+ *
+ * This function takes the skb with 802.3 header and reformats the header to
+ * the appropriate IEEE 802.11 header based on which interface the packet is
+@@ -2414,7 +2415,7 @@ static int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
+ */
+ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
+ struct sk_buff *skb, u32 info_flags,
+- struct sta_info *sta)
++ struct sta_info *sta, u32 ctrl_flags)
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_tx_info *info;
+@@ -2786,6 +2787,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
+ info->flags = info_flags;
+ info->ack_frame_id = info_id;
+ info->band = band;
++ info->control.flags = ctrl_flags;
+
+ return skb;
+ free:
+@@ -3511,8 +3513,26 @@ begin:
+ tx.skb = skb;
+ tx.sdata = vif_to_sdata(info->control.vif);
+
+- if (txq->sta)
++ if (txq->sta) {
+ tx.sta = container_of(txq->sta, struct sta_info, sta);
++ /*
++ * Drop unicast frames to unauthorised stations unless they are
++ * EAPOL frames from the local station.
++ */
++ if (unlikely(ieee80211_is_data(hdr->frame_control) &&
++ !ieee80211_vif_is_mesh(&tx.sdata->vif) &&
++ tx.sdata->vif.type != NL80211_IFTYPE_OCB &&
++ !is_multicast_ether_addr(hdr->addr1) &&
++ !test_sta_flag(tx.sta, WLAN_STA_AUTHORIZED) &&
++ (!(info->control.flags &
++ IEEE80211_TX_CTRL_PORT_CTRL_PROTO) ||
++ !ether_addr_equal(tx.sdata->vif.addr,
++ hdr->addr2)))) {
++ I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
++ ieee80211_free_txskb(&local->hw, skb);
++ goto begin;
++ }
++ }
+
+ /*
+ * The key can be removed while the packet was queued, so need to call
+@@ -3595,7 +3615,8 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
+
+ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
+ struct net_device *dev,
+- u32 info_flags)
++ u32 info_flags,
++ u32 ctrl_flags)
+ {
+ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ struct sta_info *sta;
+@@ -3666,7 +3687,8 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
+ skb->prev = NULL;
+ skb->next = NULL;
+
+- skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
++ skb = ieee80211_build_hdr(sdata, skb, info_flags,
++ sta, ctrl_flags);
+ if (IS_ERR(skb))
+ goto out;
+
+@@ -3806,9 +3828,9 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
+ __skb_queue_head_init(&queue);
+ ieee80211_convert_to_unicast(skb, dev, &queue);
+ while ((skb = __skb_dequeue(&queue)))
+- __ieee80211_subif_start_xmit(skb, dev, 0);
++ __ieee80211_subif_start_xmit(skb, dev, 0, 0);
+ } else {
+- __ieee80211_subif_start_xmit(skb, dev, 0);
++ __ieee80211_subif_start_xmit(skb, dev, 0, 0);
+ }
+
+ return NETDEV_TX_OK;
+@@ -3833,7 +3855,7 @@ ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,
+ goto out;
+ }
+
+- skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
++ skb = ieee80211_build_hdr(sdata, skb, info_flags, sta, 0);
+ if (IS_ERR(skb))
+ goto out;
+
+@@ -4836,6 +4858,7 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
+ struct ieee80211_local *local = sdata->local;
+ struct sk_buff *skb;
+ struct ethhdr *ehdr;
++ u32 ctrl_flags = 0;
+ u32 flags;
+
+ /* Only accept CONTROL_PORT_PROTOCOL configured in CONNECT/ASSOCIATE
+@@ -4845,6 +4868,9 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
+ proto != cpu_to_be16(ETH_P_PREAUTH))
+ return -EINVAL;
+
++ if (proto == sdata->control_port_protocol)
++ ctrl_flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
++
+ if (unencrypted)
+ flags = IEEE80211_TX_INTFL_DONT_ENCRYPT;
+ else
+@@ -4870,7 +4896,7 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
+ skb_reset_mac_header(skb);
+
+ local_bh_disable();
+- __ieee80211_subif_start_xmit(skb, skb->dev, flags);
++ __ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags);
+ local_bh_enable();
+
+ return 0;
+diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
+index a8c9ea12c3f5..bd01edfe44ea 100644
+--- a/net/netfilter/nf_flow_table_ip.c
++++ b/net/netfilter/nf_flow_table_ip.c
+@@ -188,6 +188,7 @@ static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
+ if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
+ return -1;
+
++ iph = ip_hdr(skb);
+ ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
+
+ tuple->src_v4.s_addr = iph->saddr;
+@@ -421,6 +422,7 @@ static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
+ if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
+ return -1;
+
++ ip6h = ipv6_hdr(skb);
+ ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
+
+ tuple->src_v6 = ip6h->saddr;
+diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
+index 8abb9891cdf2..649edbe77a20 100644
+--- a/net/netfilter/nft_fwd_netdev.c
++++ b/net/netfilter/nft_fwd_netdev.c
+@@ -186,6 +186,13 @@ nla_put_failure:
+ return -1;
+ }
+
++static int nft_fwd_validate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr,
++ const struct nft_data **data)
++{
++ return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS));
++}
++
+ static struct nft_expr_type nft_fwd_netdev_type;
+ static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {
+ .type = &nft_fwd_netdev_type,
+@@ -193,6 +200,7 @@ static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {
+ .eval = nft_fwd_neigh_eval,
+ .init = nft_fwd_neigh_init,
+ .dump = nft_fwd_neigh_dump,
++ .validate = nft_fwd_validate,
+ };
+
+ static const struct nft_expr_ops nft_fwd_netdev_ops = {
+@@ -201,6 +209,7 @@ static const struct nft_expr_ops nft_fwd_netdev_ops = {
+ .eval = nft_fwd_netdev_eval,
+ .init = nft_fwd_netdev_init,
+ .dump = nft_fwd_netdev_dump,
++ .validate = nft_fwd_validate,
+ };
+
+ static const struct nft_expr_ops *
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index ecea8edae61c..0e029aefa707 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2165,6 +2165,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ struct timespec ts;
+ __u32 ts_status;
+ bool is_drop_n_account = false;
++ unsigned int slot_id = 0;
+ bool do_vnet = false;
+
+ /* struct tpacket{2,3}_hdr is aligned to a multiple of TPACKET_ALIGNMENT.
+@@ -2261,6 +2262,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ if (!h.raw)
+ goto drop_n_account;
+
++ if (po->tp_version <= TPACKET_V2) {
++ slot_id = po->rx_ring.head;
++ if (test_bit(slot_id, po->rx_ring.rx_owner_map))
++ goto drop_n_account;
++ __set_bit(slot_id, po->rx_ring.rx_owner_map);
++ }
++
+ if (do_vnet &&
+ virtio_net_hdr_from_skb(skb, h.raw + macoff -
+ sizeof(struct virtio_net_hdr),
+@@ -2366,7 +2374,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ #endif
+
+ if (po->tp_version <= TPACKET_V2) {
++ spin_lock(&sk->sk_receive_queue.lock);
+ __packet_set_status(po, h.raw, status);
++ __clear_bit(slot_id, po->rx_ring.rx_owner_map);
++ spin_unlock(&sk->sk_receive_queue.lock);
+ sk->sk_data_ready(sk);
+ } else {
+ prb_clear_blk_fill_status(&po->rx_ring);
+@@ -4260,6 +4271,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ {
+ struct pgv *pg_vec = NULL;
+ struct packet_sock *po = pkt_sk(sk);
++ unsigned long *rx_owner_map = NULL;
+ int was_running, order = 0;
+ struct packet_ring_buffer *rb;
+ struct sk_buff_head *rb_queue;
+@@ -4345,6 +4357,12 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ }
+ break;
+ default:
++ if (!tx_ring) {
++ rx_owner_map = bitmap_alloc(req->tp_frame_nr,
++ GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO);
++ if (!rx_owner_map)
++ goto out_free_pg_vec;
++ }
+ break;
+ }
+ }
+@@ -4374,6 +4392,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ err = 0;
+ spin_lock_bh(&rb_queue->lock);
+ swap(rb->pg_vec, pg_vec);
++ if (po->tp_version <= TPACKET_V2)
++ swap(rb->rx_owner_map, rx_owner_map);
+ rb->frame_max = (req->tp_frame_nr - 1);
+ rb->head = 0;
+ rb->frame_size = req->tp_frame_size;
+@@ -4405,6 +4425,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ }
+
+ out_free_pg_vec:
++ bitmap_free(rx_owner_map);
+ if (pg_vec)
+ free_pg_vec(pg_vec, order, req->tp_block_nr);
+ out:
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index c70a2794456f..f10294800aaf 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -70,7 +70,10 @@ struct packet_ring_buffer {
+
+ unsigned int __percpu *pending_refcnt;
+
+- struct tpacket_kbdq_core prb_bdqc;
++ union {
++ unsigned long *rx_owner_map;
++ struct tpacket_kbdq_core prb_bdqc;
++ };
+ };
+
+ extern struct mutex fanout_mutex;
+diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
+index 37ae23db4a44..0256777b838e 100644
+--- a/net/sched/cls_route.c
++++ b/net/sched/cls_route.c
+@@ -536,8 +536,8 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
+ fp = &b->ht[h];
+ for (pfp = rtnl_dereference(*fp); pfp;
+ fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
+- if (pfp == f) {
+- *fp = f->next;
++ if (pfp == fold) {
++ rcu_assign_pointer(*fp, fold->next);
+ break;
+ }
+ }
+diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
+index db4b5d9ffaf7..0d7a0aac8dbb 100644
+--- a/net/sched/cls_tcindex.c
++++ b/net/sched/cls_tcindex.c
+@@ -357,6 +357,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+
+ if (tcindex_alloc_perfect_hash(net, cp) < 0)
+ goto errout;
++ cp->alloc_hash = cp->hash;
+ for (i = 0; i < min(cp->hash, p->hash); i++)
+ cp->perfect[i].res = p->perfect[i].res;
+ balloc = 1;
+diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
+index 940e72d6db18..d5e22452d597 100644
+--- a/net/sched/sch_cbs.c
++++ b/net/sched/sch_cbs.c
+@@ -185,6 +185,11 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
+ s64 credits;
+ int len;
+
++ /* The previous packet is still being sent */
++ if (now < q->last) {
++ qdisc_watchdog_schedule_ns(&q->watchdog, q->last);
++ return NULL;
++ }
+ if (q->credits < 0) {
+ credits = timediff_to_credits(now - q->last, q->idleslope);
+
+@@ -216,7 +221,12 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
+ credits += q->credits;
+
+ q->credits = max_t(s64, credits, q->locredit);
+- q->last = now;
++ /* Estimate of the transmission of the last byte of the packet in ns */
++ if (unlikely(atomic64_read(&q->port_rate) == 0))
++ q->last = now;
++ else
++ q->last = now + div64_s64(len * NSEC_PER_SEC,
++ atomic64_read(&q->port_rate));
+
+ return skb;
+ }
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index d502cc7a8ff7..0221849b7218 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -15607,7 +15607,7 @@ void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
+ goto nla_put_failure;
+
+ if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
+- nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
++ nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
+ goto nla_put_failure;
+
+ if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
+diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
+index 5611b7521020..8634ce677142 100644
+--- a/net/xfrm/xfrm_device.c
++++ b/net/xfrm/xfrm_device.c
+@@ -332,6 +332,7 @@ static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void
+ return xfrm_dev_feat_change(dev);
+
+ case NETDEV_DOWN:
++ case NETDEV_UNREGISTER:
+ return xfrm_dev_down(dev);
+ }
+ return NOTIFY_DONE;
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index ce1b262ce964..b30c074160e3 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -309,7 +309,9 @@ EXPORT_SYMBOL(xfrm_policy_destroy);
+
+ static void xfrm_policy_kill(struct xfrm_policy *policy)
+ {
++ write_lock_bh(&policy->lock);
+ policy->walk.dead = 1;
++ write_unlock_bh(&policy->lock);
+
+ atomic_inc(&policy->genid);
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 1484bc99a537..0b80c7907715 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -109,7 +109,8 @@ static inline int verify_sec_ctx_len(struct nlattr **attrs)
+ return 0;
+
+ uctx = nla_data(rt);
+- if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
++ if (uctx->len > nla_len(rt) ||
++ uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
+ return -EINVAL;
+
+ return 0;
+@@ -2272,6 +2273,9 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
+ xfrm_mark_get(attrs, &mark);
+
+ err = verify_newpolicy_info(&ua->policy);
++ if (err)
++ goto free_state;
++ err = verify_sec_ctx_len(attrs);
+ if (err)
+ goto free_state;
+
+diff --git a/scripts/dtc/dtc-lexer.l b/scripts/dtc/dtc-lexer.l
+index 615b7ec6588f..d3694d6cf202 100644
+--- a/scripts/dtc/dtc-lexer.l
++++ b/scripts/dtc/dtc-lexer.l
+@@ -38,7 +38,6 @@ LINECOMMENT "//".*\n
+ #include "srcpos.h"
+ #include "dtc-parser.tab.h"
+
+-YYLTYPE yylloc;
+ extern bool treesource_error;
+
+ /* CAUTION: this will stop working if we ever use yyless() or yyunput() */
+diff --git a/tools/perf/Makefile b/tools/perf/Makefile
+index 7902a5681fc8..b8fc7d972be9 100644
+--- a/tools/perf/Makefile
++++ b/tools/perf/Makefile
+@@ -35,7 +35,7 @@ endif
+ # Only pass canonical directory names as the output directory:
+ #
+ ifneq ($(O),)
+- FULL_O := $(shell readlink -f $(O) || echo $(O))
++ FULL_O := $(shell cd $(PWD); readlink -f $(O) || echo $(O))
+ endif
+
+ #
+diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
+index 1117ab86ebd3..d3d3601f41cc 100644
+--- a/tools/perf/util/map.c
++++ b/tools/perf/util/map.c
+@@ -85,7 +85,7 @@ static inline bool replace_android_lib(const char *filename, char *newfilename)
+ return true;
+ }
+
+- if (!strncmp(filename, "/system/lib/", 11)) {
++ if (!strncmp(filename, "/system/lib/", 12)) {
+ char *ndk, *app;
+ const char *arch;
+ size_t ndk_length;
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index a6aaac24ce05..876787de7959 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -623,14 +623,19 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwfl_Module *mod,
+ return -EINVAL;
+ }
+
+- /* Try to get actual symbol name from symtab */
+- symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL);
++ if (dwarf_entrypc(sp_die, &eaddr) == 0) {
++ /* If the DIE has entrypc, use it. */
++ symbol = dwarf_diename(sp_die);
++ } else {
++ /* Try to get actual symbol name and address from symtab */
++ symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL);
++ eaddr = sym.st_value;
++ }
+ if (!symbol) {
+ pr_warning("Failed to find symbol at 0x%lx\n",
+ (unsigned long)paddr);
+ return -ENOENT;
+ }
+- eaddr = sym.st_value;
+
+ tp->offset = (unsigned long)(paddr - eaddr);
+ tp->address = (unsigned long)paddr;
+diff --git a/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c b/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c
+index 2116df9ad832..c097a3748674 100644
+--- a/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c
++++ b/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c
+@@ -83,7 +83,7 @@ static struct pci_access *pci_acc;
+ static struct pci_dev *amd_fam14h_pci_dev;
+ static int nbp1_entered;
+
+-struct timespec start_time;
++static struct timespec start_time;
+ static unsigned long long timediff;
+
+ #ifdef DEBUG
+diff --git a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
+index 5b8c4956ff9a..85a8f0cc01a1 100644
+--- a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
++++ b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
+@@ -21,7 +21,7 @@ struct cpuidle_monitor cpuidle_sysfs_monitor;
+
+ static unsigned long long **previous_count;
+ static unsigned long long **current_count;
+-struct timespec start_time;
++static struct timespec start_time;
+ static unsigned long long timediff;
+
+ static int cpuidle_get_count_percent(unsigned int id, double *percent,
+diff --git a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
+index 051da0a7c454..4a27c55d50d8 100644
+--- a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
++++ b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
+@@ -29,6 +29,8 @@ struct cpuidle_monitor *all_monitors[] = {
+ 0
+ };
+
++int cpu_count;
++
+ static struct cpuidle_monitor *monitors[MONITORS_MAX];
+ static unsigned int avail_monitors;
+
+diff --git a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h
+index 2ae50b499e0a..06b3cd6de018 100644
+--- a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h
++++ b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h
+@@ -27,7 +27,7 @@
+ #endif
+ #define CSTATE_DESC_LEN 60
+
+-int cpu_count;
++extern int cpu_count;
+
+ /* Hard to define the right names ...: */
+ enum power_range_e {
+diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
+index 495066bafbe3..8fc6b1ca47dc 100644
+--- a/tools/scripts/Makefile.include
++++ b/tools/scripts/Makefile.include
+@@ -1,8 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0
+ ifneq ($(O),)
+ ifeq ($(origin O), command line)
+- dummy := $(if $(shell test -d $(O) || echo $(O)),$(error O=$(O) does not exist),)
+- ABSOLUTE_O := $(shell cd $(O) ; pwd)
++ dummy := $(if $(shell cd $(PWD); test -d $(O) || echo $(O)),$(error O=$(O) does not exist),)
++ ABSOLUTE_O := $(shell cd $(PWD); cd $(O) ; pwd)
+ OUTPUT := $(ABSOLUTE_O)/$(if $(subdir),$(subdir)/)
+ COMMAND_O := O=$(ABSOLUTE_O)
+ ifeq ($(objtree),)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-04-13 11:34 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-04-13 11:34 UTC (permalink / raw
To: gentoo-commits
commit: 94c77d39cd0775e11378a7308bbabc6e6f834254
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Apr 13 11:34:18 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Apr 13 11:34:18 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=94c77d39
Linux patch 4.19.115
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1114_linux-4.19.115.patch | 1883 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1887 insertions(+)
diff --git a/0000_README b/0000_README
index 99fb8b5..65d1a80 100644
--- a/0000_README
+++ b/0000_README
@@ -495,6 +495,10 @@ Patch: 1113_linux-4.19.114.patch
From: https://www.kernel.org
Desc: Linux 4.19.114
+Patch: 1114_linux-4.19.115.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.115
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1114_linux-4.19.115.patch b/1114_linux-4.19.115.patch
new file mode 100644
index 0000000..d2bb9d9
--- /dev/null
+++ b/1114_linux-4.19.115.patch
@@ -0,0 +1,1883 @@
+diff --git a/Makefile b/Makefile
+index 6f849dafbfec..9830a71e9192 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 114
++SUBLEVEL = 115
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index 06058fba5f86..d22ab8d9edc9 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -667,7 +667,7 @@ ENTRY(__boot_cpu_mode)
+ * with MMU turned off.
+ */
+ ENTRY(__early_cpu_boot_status)
+- .long 0
++ .quad 0
+
+ .popsection
+
+diff --git a/drivers/char/hw_random/imx-rngc.c b/drivers/char/hw_random/imx-rngc.c
+index 14730be54edf..dc9b8f377907 100644
+--- a/drivers/char/hw_random/imx-rngc.c
++++ b/drivers/char/hw_random/imx-rngc.c
+@@ -111,8 +111,10 @@ static int imx_rngc_self_test(struct imx_rngc *rngc)
+ return -ETIMEDOUT;
+ }
+
+- if (rngc->err_reg != 0)
++ if (rngc->err_reg != 0) {
++ imx_rngc_irq_mask_clear(rngc);
+ return -EIO;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 53e822793d46..d5f970d039bb 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -2280,11 +2280,11 @@ struct batched_entropy {
+
+ /*
+ * Get a random word for internal kernel use only. The quality of the random
+- * number is either as good as RDRAND or as good as /dev/urandom, with the
+- * goal of being quite fast and not depleting entropy. In order to ensure
++ * number is good as /dev/urandom, but there is no backtrack protection, with
++ * the goal of being quite fast and not depleting entropy. In order to ensure
+ * that the randomness provided by this function is okay, the function
+- * wait_for_random_bytes() should be called and return 0 at least once
+- * at any point prior.
++ * wait_for_random_bytes() should be called and return 0 at least once at any
++ * point prior.
+ */
+ static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64) = {
+ .batch_lock = __SPIN_LOCK_UNLOCKED(batched_entropy_u64.lock),
+@@ -2297,15 +2297,6 @@ u64 get_random_u64(void)
+ struct batched_entropy *batch;
+ static void *previous;
+
+-#if BITS_PER_LONG == 64
+- if (arch_get_random_long((unsigned long *)&ret))
+- return ret;
+-#else
+- if (arch_get_random_long((unsigned long *)&ret) &&
+- arch_get_random_long((unsigned long *)&ret + 1))
+- return ret;
+-#endif
+-
+ warn_unseeded_randomness(&previous);
+
+ batch = raw_cpu_ptr(&batched_entropy_u64);
+@@ -2330,9 +2321,6 @@ u32 get_random_u32(void)
+ struct batched_entropy *batch;
+ static void *previous;
+
+- if (arch_get_random_int(&ret))
+- return ret;
+-
+ warn_unseeded_randomness(&previous);
+
+ batch = raw_cpu_ptr(&batched_entropy_u32);
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index ee693e15d9eb..f420f0c96877 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -105,7 +105,7 @@ static int update_config(struct clk_rcg2 *rcg)
+ }
+
+ WARN(1, "%s: rcg didn't update its configuration.", name);
+- return 0;
++ return -EBUSY;
+ }
+
+ static int clk_rcg2_set_parent(struct clk_hw *hw, u8 index)
+diff --git a/drivers/extcon/extcon-axp288.c b/drivers/extcon/extcon-axp288.c
+index a983708b77a6..363b403bdb51 100644
+--- a/drivers/extcon/extcon-axp288.c
++++ b/drivers/extcon/extcon-axp288.c
+@@ -428,9 +428,40 @@ static int axp288_extcon_probe(struct platform_device *pdev)
+ /* Start charger cable type detection */
+ axp288_extcon_enable(info);
+
++ device_init_wakeup(dev, true);
++ platform_set_drvdata(pdev, info);
++
++ return 0;
++}
++
++static int __maybe_unused axp288_extcon_suspend(struct device *dev)
++{
++ struct axp288_extcon_info *info = dev_get_drvdata(dev);
++
++ if (device_may_wakeup(dev))
++ enable_irq_wake(info->irq[VBUS_RISING_IRQ]);
++
+ return 0;
+ }
+
++static int __maybe_unused axp288_extcon_resume(struct device *dev)
++{
++ struct axp288_extcon_info *info = dev_get_drvdata(dev);
++
++ /*
++ * Wakeup when a charger is connected to do charger-type
++ * connection and generate an extcon event which makes the
++ * axp288 charger driver set the input current limit.
++ */
++ if (device_may_wakeup(dev))
++ disable_irq_wake(info->irq[VBUS_RISING_IRQ]);
++
++ return 0;
++}
++
++static SIMPLE_DEV_PM_OPS(axp288_extcon_pm_ops, axp288_extcon_suspend,
++ axp288_extcon_resume);
++
+ static const struct platform_device_id axp288_extcon_table[] = {
+ { .name = "axp288_extcon" },
+ {},
+@@ -442,6 +473,7 @@ static struct platform_driver axp288_extcon_driver = {
+ .id_table = axp288_extcon_table,
+ .driver = {
+ .name = "axp288_extcon",
++ .pm = &axp288_extcon_pm_ops,
+ },
+ };
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+index 4f8f3bb21832..a54f8943ffa3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+@@ -857,7 +857,7 @@ static int vcn_v1_0_set_clockgating_state(void *handle,
+
+ if (enable) {
+ /* wait for STATUS to clear */
+- if (vcn_v1_0_is_idle(handle))
++ if (!vcn_v1_0_is_idle(handle))
+ return -EBUSY;
+ vcn_v1_0_enable_clock_gating(adev);
+ } else {
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index 122249da03ab..a4928854a3de 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -2440,6 +2440,17 @@ static bool retrieve_link_cap(struct dc_link *link)
+ sink_id.ieee_device_id,
+ sizeof(sink_id.ieee_device_id));
+
++ /* Quirk Apple MBP 2017 15" Retina panel: Wrong DP_MAX_LINK_RATE */
++ {
++ uint8_t str_mbp_2017[] = { 101, 68, 21, 101, 98, 97 };
++
++ if ((link->dpcd_caps.sink_dev_id == 0x0010fa) &&
++ !memcmp(link->dpcd_caps.sink_dev_id_str, str_mbp_2017,
++ sizeof(str_mbp_2017))) {
++ link->reported_link_cap.link_rate = 0x0c;
++ }
++ }
++
+ core_link_read_dpcd(
+ link,
+ DP_SINK_HW_REVISION_START,
+diff --git a/drivers/gpu/drm/bochs/bochs_hw.c b/drivers/gpu/drm/bochs/bochs_hw.c
+index a39b0343c197..401c218567af 100644
+--- a/drivers/gpu/drm/bochs/bochs_hw.c
++++ b/drivers/gpu/drm/bochs/bochs_hw.c
+@@ -97,10 +97,8 @@ int bochs_hw_init(struct drm_device *dev, uint32_t flags)
+ size = min(size, mem);
+ }
+
+- if (pci_request_region(pdev, 0, "bochs-drm") != 0) {
+- DRM_ERROR("Cannot request framebuffer\n");
+- return -EBUSY;
+- }
++ if (pci_request_region(pdev, 0, "bochs-drm") != 0)
++ DRM_WARN("Cannot request framebuffer, boot fb still active?\n");
+
+ bochs->fb_map = ioremap(addr, size);
+ if (bochs->fb_map == NULL) {
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index fc978603fc94..7c3c323773d3 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -439,6 +439,7 @@ static bool drm_dp_sideband_parse_remote_dpcd_read(struct drm_dp_sideband_msg_rx
+ if (idx > raw->curlen)
+ goto fail_len;
+ repmsg->u.remote_dpcd_read_ack.num_bytes = raw->msg[idx];
++ idx++;
+ if (idx > raw->curlen)
+ goto fail_len;
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
+index 7fea74861a87..c83655b008b9 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
+@@ -311,6 +311,8 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,
+ u32 return_target, return_dwords;
+ u32 link_target, link_dwords;
+ bool switch_context = gpu->exec_state != exec_state;
++ unsigned int new_flush_seq = READ_ONCE(gpu->mmu->flush_seq);
++ bool need_flush = gpu->flush_seq != new_flush_seq;
+
+ lockdep_assert_held(&gpu->lock);
+
+@@ -325,14 +327,14 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,
+ * need to append a mmu flush load state, followed by a new
+ * link to this buffer - a total of four additional words.
+ */
+- if (gpu->mmu->need_flush || switch_context) {
++ if (need_flush || switch_context) {
+ u32 target, extra_dwords;
+
+ /* link command */
+ extra_dwords = 1;
+
+ /* flush command */
+- if (gpu->mmu->need_flush) {
++ if (need_flush) {
+ if (gpu->mmu->version == ETNAVIV_IOMMU_V1)
+ extra_dwords += 1;
+ else
+@@ -345,7 +347,7 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,
+
+ target = etnaviv_buffer_reserve(gpu, buffer, extra_dwords);
+
+- if (gpu->mmu->need_flush) {
++ if (need_flush) {
+ /* Add the MMU flush */
+ if (gpu->mmu->version == ETNAVIV_IOMMU_V1) {
+ CMD_LOAD_STATE(buffer, VIVS_GL_FLUSH_MMU,
+@@ -365,7 +367,7 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,
+ SYNC_RECIPIENT_PE);
+ }
+
+- gpu->mmu->need_flush = false;
++ gpu->flush_seq = new_flush_seq;
+ }
+
+ if (switch_context) {
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
+index 9a75a6937268..039e0509af6a 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
+@@ -139,6 +139,7 @@ struct etnaviv_gpu {
+
+ struct etnaviv_iommu *mmu;
+ struct etnaviv_cmdbuf_suballoc *cmdbuf_suballoc;
++ unsigned int flush_seq;
+
+ /* Power Control: */
+ struct clk *clk_bus;
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+index 8069f9f36a2e..e132dccedf88 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+@@ -261,7 +261,7 @@ int etnaviv_iommu_map_gem(struct etnaviv_iommu *mmu,
+ }
+
+ list_add_tail(&mapping->mmu_node, &mmu->mappings);
+- mmu->need_flush = true;
++ mmu->flush_seq++;
+ unlock:
+ mutex_unlock(&mmu->lock);
+
+@@ -280,7 +280,7 @@ void etnaviv_iommu_unmap_gem(struct etnaviv_iommu *mmu,
+ etnaviv_iommu_remove_mapping(mmu, mapping);
+
+ list_del(&mapping->mmu_node);
+- mmu->need_flush = true;
++ mmu->flush_seq++;
+ mutex_unlock(&mmu->lock);
+ }
+
+@@ -357,7 +357,7 @@ int etnaviv_iommu_get_suballoc_va(struct etnaviv_gpu *gpu, dma_addr_t paddr,
+ mutex_unlock(&mmu->lock);
+ return ret;
+ }
+- gpu->mmu->need_flush = true;
++ mmu->flush_seq++;
+ mutex_unlock(&mmu->lock);
+
+ *iova = (u32)vram_node->start;
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.h b/drivers/gpu/drm/etnaviv/etnaviv_mmu.h
+index a0db17ffb686..348a94d9695b 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.h
++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.h
+@@ -48,7 +48,7 @@ struct etnaviv_iommu {
+ struct mutex lock;
+ struct list_head mappings;
+ struct drm_mm mm;
+- bool need_flush;
++ unsigned int flush_seq;
+ };
+
+ struct etnaviv_gem_object;
+diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
+index f59ca27a4a35..e53b7cb2211d 100644
+--- a/drivers/gpu/drm/msm/msm_gem.c
++++ b/drivers/gpu/drm/msm/msm_gem.c
+@@ -43,6 +43,46 @@ static bool use_pages(struct drm_gem_object *obj)
+ return !msm_obj->vram_node;
+ }
+
++/*
++ * Cache sync.. this is a bit over-complicated, to fit dma-mapping
++ * API. Really GPU cache is out of scope here (handled on cmdstream)
++ * and all we need to do is invalidate newly allocated pages before
++ * mapping to CPU as uncached/writecombine.
++ *
++ * On top of this, we have the added headache, that depending on
++ * display generation, the display's iommu may be wired up to either
++ * the toplevel drm device (mdss), or to the mdp sub-node, meaning
++ * that here we either have dma-direct or iommu ops.
++ *
++ * Let this be a cautionary tail of abstraction gone wrong.
++ */
++
++static void sync_for_device(struct msm_gem_object *msm_obj)
++{
++ struct device *dev = msm_obj->base.dev->dev;
++
++ if (get_dma_ops(dev)) {
++ dma_sync_sg_for_device(dev, msm_obj->sgt->sgl,
++ msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
++ } else {
++ dma_map_sg(dev, msm_obj->sgt->sgl,
++ msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
++ }
++}
++
++static void sync_for_cpu(struct msm_gem_object *msm_obj)
++{
++ struct device *dev = msm_obj->base.dev->dev;
++
++ if (get_dma_ops(dev)) {
++ dma_sync_sg_for_cpu(dev, msm_obj->sgt->sgl,
++ msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
++ } else {
++ dma_unmap_sg(dev, msm_obj->sgt->sgl,
++ msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
++ }
++}
++
+ /* allocate pages from VRAM carveout, used when no IOMMU: */
+ static struct page **get_pages_vram(struct drm_gem_object *obj, int npages)
+ {
+@@ -108,8 +148,7 @@ static struct page **get_pages(struct drm_gem_object *obj)
+ * because display controller, GPU, etc. are not coherent:
+ */
+ if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
+- dma_map_sg(dev->dev, msm_obj->sgt->sgl,
+- msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
++ sync_for_device(msm_obj);
+ }
+
+ return msm_obj->pages;
+@@ -138,9 +177,7 @@ static void put_pages(struct drm_gem_object *obj)
+ * GPU, etc. are not coherent:
+ */
+ if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
+- dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
+- msm_obj->sgt->nents,
+- DMA_BIDIRECTIONAL);
++ sync_for_cpu(msm_obj);
+
+ sg_free_table(msm_obj->sgt);
+ kfree(msm_obj->sgt);
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index e16872e0724f..5c03f4701ece 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2753,6 +2753,7 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
+ err2:
+ kfree(route->path_rec);
+ route->path_rec = NULL;
++ route->num_paths = 0;
+ err1:
+ kfree(work);
+ return ret;
+@@ -4635,6 +4636,19 @@ static int __init cma_init(void)
+ {
+ int ret;
+
++ /*
++ * There is a rare lock ordering dependency in cma_netdev_callback()
++ * that only happens when bonding is enabled. Teach lockdep that rtnl
++ * must never be nested under lock so it can find these without having
++ * to test with bonding.
++ */
++ if (IS_ENABLED(CONFIG_LOCKDEP)) {
++ rtnl_lock();
++ mutex_lock(&lock);
++ mutex_unlock(&lock);
++ rtnl_unlock();
++ }
++
+ cma_wq = alloc_ordered_workqueue("rdma_cm", WQ_MEM_RECLAIM);
+ if (!cma_wq)
+ return -ENOMEM;
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index 01d68ed46c1b..2acc30c3d5b2 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -89,6 +89,7 @@ struct ucma_context {
+
+ struct ucma_file *file;
+ struct rdma_cm_id *cm_id;
++ struct mutex mutex;
+ u64 uid;
+
+ struct list_head list;
+@@ -215,6 +216,7 @@ static struct ucma_context *ucma_alloc_ctx(struct ucma_file *file)
+ init_completion(&ctx->comp);
+ INIT_LIST_HEAD(&ctx->mc_list);
+ ctx->file = file;
++ mutex_init(&ctx->mutex);
+
+ mutex_lock(&mut);
+ ctx->id = idr_alloc(&ctx_idr, ctx, 0, 0, GFP_KERNEL);
+@@ -596,6 +598,7 @@ static int ucma_free_ctx(struct ucma_context *ctx)
+ }
+
+ events_reported = ctx->events_reported;
++ mutex_destroy(&ctx->mutex);
+ kfree(ctx);
+ return events_reported;
+ }
+@@ -665,7 +668,10 @@ static ssize_t ucma_bind_ip(struct ucma_file *file, const char __user *inbuf,
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+
++ mutex_lock(&ctx->mutex);
+ ret = rdma_bind_addr(ctx->cm_id, (struct sockaddr *) &cmd.addr);
++ mutex_unlock(&ctx->mutex);
++
+ ucma_put_ctx(ctx);
+ return ret;
+ }
+@@ -688,7 +694,9 @@ static ssize_t ucma_bind(struct ucma_file *file, const char __user *inbuf,
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+
++ mutex_lock(&ctx->mutex);
+ ret = rdma_bind_addr(ctx->cm_id, (struct sockaddr *) &cmd.addr);
++ mutex_unlock(&ctx->mutex);
+ ucma_put_ctx(ctx);
+ return ret;
+ }
+@@ -712,8 +720,10 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file,
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+
++ mutex_lock(&ctx->mutex);
+ ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
+ (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);
++ mutex_unlock(&ctx->mutex);
+ ucma_put_ctx(ctx);
+ return ret;
+ }
+@@ -738,8 +748,10 @@ static ssize_t ucma_resolve_addr(struct ucma_file *file,
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+
++ mutex_lock(&ctx->mutex);
+ ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
+ (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);
++ mutex_unlock(&ctx->mutex);
+ ucma_put_ctx(ctx);
+ return ret;
+ }
+@@ -759,7 +771,9 @@ static ssize_t ucma_resolve_route(struct ucma_file *file,
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+
++ mutex_lock(&ctx->mutex);
+ ret = rdma_resolve_route(ctx->cm_id, cmd.timeout_ms);
++ mutex_unlock(&ctx->mutex);
+ ucma_put_ctx(ctx);
+ return ret;
+ }
+@@ -848,6 +862,7 @@ static ssize_t ucma_query_route(struct ucma_file *file,
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+
++ mutex_lock(&ctx->mutex);
+ memset(&resp, 0, sizeof resp);
+ addr = (struct sockaddr *) &ctx->cm_id->route.addr.src_addr;
+ memcpy(&resp.src_addr, addr, addr->sa_family == AF_INET ?
+@@ -871,6 +886,7 @@ static ssize_t ucma_query_route(struct ucma_file *file,
+ ucma_copy_iw_route(&resp, &ctx->cm_id->route);
+
+ out:
++ mutex_unlock(&ctx->mutex);
+ if (copy_to_user(u64_to_user_ptr(cmd.response),
+ &resp, sizeof(resp)))
+ ret = -EFAULT;
+@@ -1022,6 +1038,7 @@ static ssize_t ucma_query(struct ucma_file *file,
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+
++ mutex_lock(&ctx->mutex);
+ switch (cmd.option) {
+ case RDMA_USER_CM_QUERY_ADDR:
+ ret = ucma_query_addr(ctx, response, out_len);
+@@ -1036,6 +1053,7 @@ static ssize_t ucma_query(struct ucma_file *file,
+ ret = -ENOSYS;
+ break;
+ }
++ mutex_unlock(&ctx->mutex);
+
+ ucma_put_ctx(ctx);
+ return ret;
+@@ -1076,7 +1094,9 @@ static ssize_t ucma_connect(struct ucma_file *file, const char __user *inbuf,
+ return PTR_ERR(ctx);
+
+ ucma_copy_conn_param(ctx->cm_id, &conn_param, &cmd.conn_param);
++ mutex_lock(&ctx->mutex);
+ ret = rdma_connect(ctx->cm_id, &conn_param);
++ mutex_unlock(&ctx->mutex);
+ ucma_put_ctx(ctx);
+ return ret;
+ }
+@@ -1097,7 +1117,9 @@ static ssize_t ucma_listen(struct ucma_file *file, const char __user *inbuf,
+
+ ctx->backlog = cmd.backlog > 0 && cmd.backlog < max_backlog ?
+ cmd.backlog : max_backlog;
++ mutex_lock(&ctx->mutex);
+ ret = rdma_listen(ctx->cm_id, ctx->backlog);
++ mutex_unlock(&ctx->mutex);
+ ucma_put_ctx(ctx);
+ return ret;
+ }
+@@ -1120,13 +1142,17 @@ static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf,
+ if (cmd.conn_param.valid) {
+ ucma_copy_conn_param(ctx->cm_id, &conn_param, &cmd.conn_param);
+ mutex_lock(&file->mut);
++ mutex_lock(&ctx->mutex);
+ ret = __rdma_accept(ctx->cm_id, &conn_param, NULL);
++ mutex_unlock(&ctx->mutex);
+ if (!ret)
+ ctx->uid = cmd.uid;
+ mutex_unlock(&file->mut);
+- } else
++ } else {
++ mutex_lock(&ctx->mutex);
+ ret = __rdma_accept(ctx->cm_id, NULL, NULL);
+-
++ mutex_unlock(&ctx->mutex);
++ }
+ ucma_put_ctx(ctx);
+ return ret;
+ }
+@@ -1145,7 +1171,9 @@ static ssize_t ucma_reject(struct ucma_file *file, const char __user *inbuf,
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+
++ mutex_lock(&ctx->mutex);
+ ret = rdma_reject(ctx->cm_id, cmd.private_data, cmd.private_data_len);
++ mutex_unlock(&ctx->mutex);
+ ucma_put_ctx(ctx);
+ return ret;
+ }
+@@ -1164,7 +1192,9 @@ static ssize_t ucma_disconnect(struct ucma_file *file, const char __user *inbuf,
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+
++ mutex_lock(&ctx->mutex);
+ ret = rdma_disconnect(ctx->cm_id);
++ mutex_unlock(&ctx->mutex);
+ ucma_put_ctx(ctx);
+ return ret;
+ }
+@@ -1195,7 +1225,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
+ resp.qp_attr_mask = 0;
+ memset(&qp_attr, 0, sizeof qp_attr);
+ qp_attr.qp_state = cmd.qp_state;
++ mutex_lock(&ctx->mutex);
+ ret = rdma_init_qp_attr(ctx->cm_id, &qp_attr, &resp.qp_attr_mask);
++ mutex_unlock(&ctx->mutex);
+ if (ret)
+ goto out;
+
+@@ -1274,9 +1306,13 @@ static int ucma_set_ib_path(struct ucma_context *ctx,
+ struct sa_path_rec opa;
+
+ sa_convert_path_ib_to_opa(&opa, &sa_path);
++ mutex_lock(&ctx->mutex);
+ ret = rdma_set_ib_path(ctx->cm_id, &opa);
++ mutex_unlock(&ctx->mutex);
+ } else {
++ mutex_lock(&ctx->mutex);
+ ret = rdma_set_ib_path(ctx->cm_id, &sa_path);
++ mutex_unlock(&ctx->mutex);
+ }
+ if (ret)
+ return ret;
+@@ -1309,7 +1345,9 @@ static int ucma_set_option_level(struct ucma_context *ctx, int level,
+
+ switch (level) {
+ case RDMA_OPTION_ID:
++ mutex_lock(&ctx->mutex);
+ ret = ucma_set_option_id(ctx, optname, optval, optlen);
++ mutex_unlock(&ctx->mutex);
+ break;
+ case RDMA_OPTION_IB:
+ ret = ucma_set_option_ib(ctx, optname, optval, optlen);
+@@ -1369,8 +1407,10 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf,
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+
++ mutex_lock(&ctx->mutex);
+ if (ctx->cm_id->device)
+ ret = rdma_notify(ctx->cm_id, (enum ib_event_type)cmd.event);
++ mutex_unlock(&ctx->mutex);
+
+ ucma_put_ctx(ctx);
+ return ret;
+@@ -1413,8 +1453,10 @@ static ssize_t ucma_process_join(struct ucma_file *file,
+ mc->join_state = join_state;
+ mc->uid = cmd->uid;
+ memcpy(&mc->addr, addr, cmd->addr_size);
++ mutex_lock(&ctx->mutex);
+ ret = rdma_join_multicast(ctx->cm_id, (struct sockaddr *)&mc->addr,
+ join_state, mc);
++ mutex_unlock(&ctx->mutex);
+ if (ret)
+ goto err2;
+
+@@ -1518,7 +1560,10 @@ static ssize_t ucma_leave_multicast(struct ucma_file *file,
+ goto out;
+ }
+
++ mutex_lock(&mc->ctx->mutex);
+ rdma_leave_multicast(mc->ctx->cm_id, (struct sockaddr *) &mc->addr);
++ mutex_unlock(&mc->ctx->mutex);
++
+ mutex_lock(&mc->ctx->file->mut);
+ ucma_cleanup_mc_events(mc);
+ list_del(&mc->list);
+diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c
+index 25e867393463..e3e8d65646e3 100644
+--- a/drivers/infiniband/hw/hfi1/sysfs.c
++++ b/drivers/infiniband/hw/hfi1/sysfs.c
+@@ -670,7 +670,11 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num,
+ dd_dev_err(dd,
+ "Skipping sc2vl sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail;
++ /*
++ * Based on the documentation for kobject_init_and_add(), the
++ * caller should call kobject_put even if this call fails.
++ */
++ goto bail_sc2vl;
+ }
+ kobject_uevent(&ppd->sc2vl_kobj, KOBJ_ADD);
+
+@@ -680,7 +684,7 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num,
+ dd_dev_err(dd,
+ "Skipping sl2sc sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_sc2vl;
++ goto bail_sl2sc;
+ }
+ kobject_uevent(&ppd->sl2sc_kobj, KOBJ_ADD);
+
+@@ -690,7 +694,7 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num,
+ dd_dev_err(dd,
+ "Skipping vl2mtu sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_sl2sc;
++ goto bail_vl2mtu;
+ }
+ kobject_uevent(&ppd->vl2mtu_kobj, KOBJ_ADD);
+
+@@ -700,7 +704,7 @@ int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num,
+ dd_dev_err(dd,
+ "Skipping Congestion Control sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_vl2mtu;
++ goto bail_cc;
+ }
+
+ kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD);
+@@ -738,7 +742,6 @@ bail_sl2sc:
+ kobject_put(&ppd->sl2sc_kobj);
+ bail_sc2vl:
+ kobject_put(&ppd->sc2vl_kobj);
+-bail:
+ return ret;
+ }
+
+@@ -858,8 +861,13 @@ bail:
+ for (i = 0; i < ARRAY_SIZE(hfi1_attributes); ++i)
+ device_remove_file(&dev->dev, hfi1_attributes[i]);
+
+- for (i = 0; i < dd->num_sdma; i++)
+- kobject_del(&dd->per_sdma[i].kobj);
++ /*
++ * The function kobject_put() will call kobject_del() if the kobject
++ * has been added successfully. The sysfs files created under the
++ * kobject directory will also be removed during the process.
++ */
++ for (; i >= 0; i--)
++ kobject_put(&dd->per_sdma[i].kobj);
+
+ return ret;
+ }
+@@ -872,6 +880,10 @@ void hfi1_verbs_unregister_sysfs(struct hfi1_devdata *dd)
+ struct hfi1_pportdata *ppd;
+ int i;
+
++ /* Unwind operations in hfi1_verbs_register_sysfs() */
++ for (i = 0; i < dd->num_sdma; i++)
++ kobject_put(&dd->per_sdma[i].kobj);
++
+ for (i = 0; i < dd->num_pports; i++) {
+ ppd = &dd->pport[i];
+
+diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
+index f862f1b7f996..d6f5f5b3f75f 100644
+--- a/drivers/media/rc/lirc_dev.c
++++ b/drivers/media/rc/lirc_dev.c
+@@ -29,7 +29,7 @@
+ #include "rc-core-priv.h"
+ #include <uapi/linux/lirc.h>
+
+-#define LIRCBUF_SIZE 256
++#define LIRCBUF_SIZE 1024
+
+ static dev_t lirc_base_dev;
+
+diff --git a/drivers/misc/cardreader/rts5227.c b/drivers/misc/cardreader/rts5227.c
+index 13645be5f3b5..f0e845c8e6a7 100644
+--- a/drivers/misc/cardreader/rts5227.c
++++ b/drivers/misc/cardreader/rts5227.c
+@@ -369,6 +369,7 @@ static const struct pcr_ops rts522a_pcr_ops = {
+ void rts522a_init_params(struct rtsx_pcr *pcr)
+ {
+ rts5227_init_params(pcr);
++ pcr->ops = &rts522a_pcr_ops;
+ pcr->tx_initial_phase = SET_CLOCK_PHASE(20, 20, 11);
+ pcr->reg_pm_ctrl3 = RTS522A_PM_CTRL3;
+ }
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index d80372d21c14..2ac1dc5104b7 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -147,6 +147,8 @@
+ #define MEI_DEV_ID_CMP_H 0x06e0 /* Comet Lake H */
+ #define MEI_DEV_ID_CMP_H_3 0x06e4 /* Comet Lake H 3 (iTouch) */
+
++#define MEI_DEV_ID_CDF 0x18D3 /* Cedar Fork */
++
+ #define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
+
+ #define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index 3498c10b8263..b4bf12f27caf 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -118,6 +118,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ {MEI_PCI_DEVICE(MEI_DEV_ID_MCC, MEI_ME_PCH12_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_MCC_4, MEI_ME_PCH8_CFG)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CDF, MEI_ME_PCH8_CFG)},
++
+ /* required last entry */
+ {0, }
+ };
+diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
+index fd33a3b9c66f..727dc6ec427d 100644
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -104,6 +104,7 @@ struct pci_endpoint_test {
+ struct completion irq_raised;
+ int last_irq;
+ int num_irqs;
++ int irq_type;
+ /* mutex to protect the ioctls */
+ struct mutex mutex;
+ struct miscdevice miscdev;
+@@ -163,6 +164,7 @@ static void pci_endpoint_test_free_irq_vectors(struct pci_endpoint_test *test)
+ struct pci_dev *pdev = test->pdev;
+
+ pci_free_irq_vectors(pdev);
++ test->irq_type = IRQ_TYPE_UNDEFINED;
+ }
+
+ static bool pci_endpoint_test_alloc_irq_vectors(struct pci_endpoint_test *test,
+@@ -197,6 +199,8 @@ static bool pci_endpoint_test_alloc_irq_vectors(struct pci_endpoint_test *test,
+ irq = 0;
+ res = false;
+ }
++
++ test->irq_type = type;
+ test->num_irqs = irq;
+
+ return res;
+@@ -336,6 +340,7 @@ static bool pci_endpoint_test_copy(struct pci_endpoint_test *test, size_t size)
+ dma_addr_t orig_dst_phys_addr;
+ size_t offset;
+ size_t alignment = test->alignment;
++ int irq_type = test->irq_type;
+ u32 src_crc32;
+ u32 dst_crc32;
+
+@@ -432,6 +437,7 @@ static bool pci_endpoint_test_write(struct pci_endpoint_test *test, size_t size)
+ dma_addr_t orig_phys_addr;
+ size_t offset;
+ size_t alignment = test->alignment;
++ int irq_type = test->irq_type;
+ u32 crc32;
+
+ if (size > SIZE_MAX - alignment)
+@@ -500,6 +506,7 @@ static bool pci_endpoint_test_read(struct pci_endpoint_test *test, size_t size)
+ dma_addr_t orig_phys_addr;
+ size_t offset;
+ size_t alignment = test->alignment;
++ int irq_type = test->irq_type;
+ u32 crc32;
+
+ if (size > SIZE_MAX - alignment)
+@@ -561,7 +568,7 @@ static bool pci_endpoint_test_set_irq(struct pci_endpoint_test *test,
+ return false;
+ }
+
+- if (irq_type == req_irq_type)
++ if (test->irq_type == req_irq_type)
+ return true;
+
+ pci_endpoint_test_release_irq(test);
+@@ -573,12 +580,10 @@ static bool pci_endpoint_test_set_irq(struct pci_endpoint_test *test,
+ if (!pci_endpoint_test_request_irq(test))
+ goto err;
+
+- irq_type = req_irq_type;
+ return true;
+
+ err:
+ pci_endpoint_test_free_irq_vectors(test);
+- irq_type = IRQ_TYPE_UNDEFINED;
+ return false;
+ }
+
+@@ -636,7 +641,7 @@ static int pci_endpoint_test_probe(struct pci_dev *pdev,
+ {
+ int err;
+ int id;
+- char name[20];
++ char name[24];
+ enum pci_barno bar;
+ void __iomem *base;
+ struct device *dev = &pdev->dev;
+@@ -655,6 +660,7 @@ static int pci_endpoint_test_probe(struct pci_dev *pdev,
+ test->test_reg_bar = 0;
+ test->alignment = 0;
+ test->pdev = pdev;
++ test->irq_type = IRQ_TYPE_UNDEFINED;
+
+ if (no_msi)
+ irq_type = IRQ_TYPE_LEGACY;
+diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
+index db9607809620..f99cd94509be 100644
+--- a/drivers/net/can/slcan.c
++++ b/drivers/net/can/slcan.c
+@@ -147,7 +147,7 @@ static void slc_bump(struct slcan *sl)
+ u32 tmpid;
+ char *cmd = sl->rbuff;
+
+- cf.can_id = 0;
++ memset(&cf, 0, sizeof(cf));
+
+ switch (*cmd) {
+ case 'r':
+@@ -186,8 +186,6 @@ static void slc_bump(struct slcan *sl)
+ else
+ return;
+
+- *(u64 *) (&cf.data) = 0; /* clear payload */
+-
+ /* RTR frames may have a dlc > 0 but they never have any data bytes */
+ if (!(cf.can_id & CAN_RTR_FLAG)) {
+ for (i = 0; i < cf.can_dlc; i++) {
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 8c69789fbe09..ccba648452c4 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -461,7 +461,7 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds)
+ priv->slave_mii_bus->parent = ds->dev->parent;
+ priv->slave_mii_bus->phy_mask = ~priv->indir_phy_mask;
+
+- err = of_mdiobus_register(priv->slave_mii_bus, dn);
++ err = mdiobus_register(priv->slave_mii_bus);
+ if (err && dn)
+ of_node_put(dn);
+
+@@ -1014,6 +1014,7 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev)
+ const struct bcm_sf2_of_data *data;
+ struct b53_platform_data *pdata;
+ struct dsa_switch_ops *ops;
++ struct device_node *ports;
+ struct bcm_sf2_priv *priv;
+ struct b53_device *dev;
+ struct dsa_switch *ds;
+@@ -1077,7 +1078,11 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev)
+ set_bit(0, priv->cfp.used);
+ set_bit(0, priv->cfp.unique);
+
+- bcm_sf2_identify_ports(priv, dn->child);
++ ports = of_find_node_by_name(dn, "ports");
++ if (ports) {
++ bcm_sf2_identify_ports(priv, ports);
++ of_node_put(ports);
++ }
+
+ priv->irq0 = irq_of_parse_and_map(dn, 0);
+ priv->irq1 = irq_of_parse_and_map(dn, 1);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+index 8d211972c5e9..9f4eb3cde93e 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+@@ -98,9 +98,11 @@ static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
+ u8 prio = tcf_vlan_push_prio(a);
+ u16 vid = tcf_vlan_push_vid(a);
+
+- return mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
+- action, vid,
+- proto, prio, extack);
++ err = mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
++ action, vid,
++ proto, prio, extack);
++ if (err)
++ return err;
+ } else {
+ NL_SET_ERR_MSG_MOD(extack, "Unsupported action");
+ dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n");
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+index 7b2a84320aab..e4e9a7591efe 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+@@ -218,7 +218,7 @@ static void dwmac1000_set_filter(struct mac_device_info *hw,
+ reg++;
+ }
+
+- while (reg <= perfect_addr_number) {
++ while (reg < perfect_addr_number) {
+ writel(0, ioaddr + GMAC_ADDR_HIGH(reg));
+ writel(0, ioaddr + GMAC_ADDR_LOW(reg));
+ reg++;
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index b4c67c3a928b..55caaaf969da 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -29,6 +29,7 @@
+ #include <linux/micrel_phy.h>
+ #include <linux/of.h>
+ #include <linux/clk.h>
++#include <linux/delay.h>
+
+ /* Operation Mode Strap Override */
+ #define MII_KSZPHY_OMSO 0x16
+@@ -738,6 +739,12 @@ static int kszphy_resume(struct phy_device *phydev)
+
+ genphy_resume(phydev);
+
++ /* After switching from power-down to normal mode, an internal global
++ * reset is automatically generated. Wait a minimum of 1 ms before
++ * read/write access to the PHY registers.
++ */
++ usleep_range(1000, 2000);
++
+ ret = kszphy_config_reset(phydev);
+ if (ret)
+ return ret;
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index e4f167e35353..9711bfbdf431 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -815,9 +815,11 @@ out_free_tagset:
+ if (new)
+ nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset);
+ out_free_async_qe:
+- nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
+- sizeof(struct nvme_command), DMA_TO_DEVICE);
+- ctrl->async_event_sqe.data = NULL;
++ if (ctrl->async_event_sqe.data) {
++ nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
++ sizeof(struct nvme_command), DMA_TO_DEVICE);
++ ctrl->async_event_sqe.data = NULL;
++ }
+ out_free_queue:
+ nvme_rdma_free_queue(&ctrl->queues[0]);
+ return error;
+diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
+index c60659fb21de..46eb7716c35c 100644
+--- a/drivers/power/supply/axp288_charger.c
++++ b/drivers/power/supply/axp288_charger.c
+@@ -28,6 +28,7 @@
+ #include <linux/property.h>
+ #include <linux/mfd/axp20x.h>
+ #include <linux/extcon.h>
++#include <linux/dmi.h>
+
+ #define PS_STAT_VBUS_TRIGGER (1 << 0)
+ #define PS_STAT_BAT_CHRG_DIR (1 << 2)
+@@ -552,6 +553,49 @@ out:
+ return IRQ_HANDLED;
+ }
+
++/*
++ * The HP Pavilion x2 10 series comes in a number of variants:
++ * Bay Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "815D"
++ * Cherry Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "813E"
++ * Cherry Trail SoC + TI PMIC, DMI_BOARD_NAME: "827C" or "82F4"
++ *
++ * The variants with the AXP288 PMIC are all kinds of special:
++ *
++ * 1. All variants use a Type-C connector which the AXP288 does not support, so
++ * when using a Type-C charger it is not recognized. Unlike most AXP288 devices,
++ * this model actually has mostly working ACPI AC / Battery code, the ACPI code
++ * "solves" this by simply setting the input_current_limit to 3A.
++ * There are still some issues with the ACPI code, so we use this native driver,
++ * and to solve the charging not working (500mA is not enough) issue we hardcode
++ * the 3A input_current_limit like the ACPI code does.
++ *
++ * 2. If no charger is connected the machine boots with the vbus-path disabled.
++ * Normally this is done when a 5V boost converter is active to avoid the PMIC
++ * trying to charge from the 5V boost converter's output. This is done when
++ * an OTG host cable is inserted and the ID pin on the micro-B receptacle is
++ * pulled low and the ID pin has an ACPI event handler associated with it
++ * which re-enables the vbus-path when the ID pin is pulled high when the
++ * OTG host cable is removed. The Type-C connector has no ID pin, there is
++ * no ID pin handler and there appears to be no 5V boost converter, so we
++ * end up not charging because the vbus-path is disabled, until we unplug
++ * the charger which automatically clears the vbus-path disable bit and then
++ * on the second plug-in of the adapter we start charging. To solve the not
++ * charging on first charger plugin we unconditionally enable the vbus-path at
++ * probe on this model, which is safe since there is no 5V boost converter.
++ */
++static const struct dmi_system_id axp288_hp_x2_dmi_ids[] = {
++ {
++ /*
++ * Bay Trail model has "Hewlett-Packard" as sys_vendor, Cherry
++ * Trail model has "HP", so we only match on product_name.
++ */
++ .matches = {
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++ },
++ },
++ {} /* Terminating entry */
++};
++
+ static void axp288_charger_extcon_evt_worker(struct work_struct *work)
+ {
+ struct axp288_chrg_info *info =
+@@ -575,7 +619,11 @@ static void axp288_charger_extcon_evt_worker(struct work_struct *work)
+ }
+
+ /* Determine cable/charger type */
+- if (extcon_get_state(edev, EXTCON_CHG_USB_SDP) > 0) {
++ if (dmi_check_system(axp288_hp_x2_dmi_ids)) {
++ /* See comment above axp288_hp_x2_dmi_ids declaration */
++ dev_dbg(&info->pdev->dev, "HP X2 with Type-C, setting inlmt to 3A\n");
++ current_limit = 3000000;
++ } else if (extcon_get_state(edev, EXTCON_CHG_USB_SDP) > 0) {
+ dev_dbg(&info->pdev->dev, "USB SDP charger is connected\n");
+ current_limit = 500000;
+ } else if (extcon_get_state(edev, EXTCON_CHG_USB_CDP) > 0) {
+@@ -692,6 +740,13 @@ static int charger_init_hw_regs(struct axp288_chrg_info *info)
+ return ret;
+ }
+
++ if (dmi_check_system(axp288_hp_x2_dmi_ids)) {
++ /* See comment above axp288_hp_x2_dmi_ids declaration */
++ ret = axp288_charger_vbus_path_select(info, true);
++ if (ret < 0)
++ return ret;
++ }
++
+ /* Read current charge voltage and current limit */
+ ret = regmap_read(info->regmap, AXP20X_CHRG_CTRL1, &val);
+ if (ret < 0) {
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index 25c394a7077b..facc577ab0ac 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -813,9 +813,6 @@ static int qcom_glink_rx_data(struct qcom_glink *glink, size_t avail)
+ return -EAGAIN;
+ }
+
+- if (WARN(chunk_size % 4, "Incoming data must be word aligned\n"))
+- return -EINVAL;
+-
+ rcid = le16_to_cpu(hdr.msg.param1);
+ spin_lock_irqsave(&glink->idr_lock, flags);
+ channel = idr_find(&glink->rcids, rcid);
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index d482f89ffae2..7b8b463676ad 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1369,7 +1369,7 @@ static void dwc3_gadget_ep_skip_trbs(struct dwc3_ep *dep, struct dwc3_request *r
+ for (i = 0; i < req->num_trbs; i++) {
+ struct dwc3_trb *trb;
+
+- trb = req->trb + i;
++ trb = &dep->trb_pool[dep->trb_dequeue];
+ trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+ dwc3_ep_inc_deq(dep);
+ }
+@@ -3166,7 +3166,6 @@ int dwc3_gadget_init(struct dwc3 *dwc)
+ dwc->gadget.speed = USB_SPEED_UNKNOWN;
+ dwc->gadget.sg_supported = true;
+ dwc->gadget.name = "dwc3-gadget";
+- dwc->gadget.is_otg = dwc->dr_mode == USB_DR_MODE_OTG;
+
+ /*
+ * FIXME We might be setting max_speed to <SUPER, however versions
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index b96d4e779333..cb93a6b38160 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -1243,6 +1243,9 @@ finished:
+ if (!con_is_bound(&fb_con))
+ fbcon_exit();
+
++ if (vc->vc_num == logo_shown)
++ logo_shown = FBCON_LOGO_CANSHOW;
++
+ return;
+ }
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index c4314f449240..18e967089aeb 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -105,7 +105,6 @@ static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf)
+ return 0;
+ }
+
+-
+ static int ceph_sync_fs(struct super_block *sb, int wait)
+ {
+ struct ceph_fs_client *fsc = ceph_sb_to_client(sb);
+@@ -206,6 +205,26 @@ static match_table_t fsopt_tokens = {
+ {-1, NULL}
+ };
+
++/*
++ * Remove adjacent slashes and then the trailing slash, unless it is
++ * the only remaining character.
++ *
++ * E.g. "//dir1////dir2///" --> "/dir1/dir2", "///" --> "/".
++ */
++static void canonicalize_path(char *path)
++{
++ int i, j = 0;
++
++ for (i = 0; path[i] != '\0'; i++) {
++ if (path[i] != '/' || j < 1 || path[j - 1] != '/')
++ path[j++] = path[i];
++ }
++
++ if (j > 1 && path[j - 1] == '/')
++ j--;
++ path[j] = '\0';
++}
++
+ static int parse_fsopt_token(char *c, void *private)
+ {
+ struct ceph_mount_options *fsopt = private;
+@@ -415,12 +434,15 @@ static int compare_mount_options(struct ceph_mount_options *new_fsopt,
+ ret = strcmp_null(fsopt1->snapdir_name, fsopt2->snapdir_name);
+ if (ret)
+ return ret;
++
+ ret = strcmp_null(fsopt1->mds_namespace, fsopt2->mds_namespace);
+ if (ret)
+ return ret;
++
+ ret = strcmp_null(fsopt1->server_path, fsopt2->server_path);
+ if (ret)
+ return ret;
++
+ ret = strcmp_null(fsopt1->fscache_uniq, fsopt2->fscache_uniq);
+ if (ret)
+ return ret;
+@@ -476,13 +498,17 @@ static int parse_mount_options(struct ceph_mount_options **pfsopt,
+ */
+ dev_name_end = strchr(dev_name, '/');
+ if (dev_name_end) {
+- if (strlen(dev_name_end) > 1) {
+- fsopt->server_path = kstrdup(dev_name_end, GFP_KERNEL);
+- if (!fsopt->server_path) {
+- err = -ENOMEM;
+- goto out;
+- }
++ /*
++ * The server_path will include the whole chars from userland
++ * including the leading '/'.
++ */
++ fsopt->server_path = kstrdup(dev_name_end, GFP_KERNEL);
++ if (!fsopt->server_path) {
++ err = -ENOMEM;
++ goto out;
+ }
++
++ canonicalize_path(fsopt->server_path);
+ } else {
+ dev_name_end = dev_name + strlen(dev_name);
+ }
+@@ -810,7 +836,6 @@ static void destroy_caches(void)
+ ceph_fscache_unregister();
+ }
+
+-
+ /*
+ * ceph_umount_begin - initiate forced umount. Tear down down the
+ * mount, skipping steps that may hang while waiting for server(s).
+@@ -897,9 +922,6 @@ out:
+ return root;
+ }
+
+-
+-
+-
+ /*
+ * mount: join the ceph cluster, and open root directory.
+ */
+@@ -913,7 +935,9 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc)
+ mutex_lock(&fsc->client->mount_mutex);
+
+ if (!fsc->sb->s_root) {
+- const char *path;
++ const char *path = fsc->mount_options->server_path ?
++ fsc->mount_options->server_path + 1 : "";
++
+ err = __ceph_open_session(fsc->client, started);
+ if (err < 0)
+ goto out;
+@@ -925,13 +949,7 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc)
+ goto out;
+ }
+
+- if (!fsc->mount_options->server_path) {
+- path = "";
+- dout("mount opening path \\t\n");
+- } else {
+- path = fsc->mount_options->server_path + 1;
+- dout("mount opening path %s\n", path);
+- }
++ dout("mount opening path '%s'\n", path);
+
+ err = ceph_fs_debugfs_init(fsc);
+ if (err < 0)
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index 8d3eabf06d66..65da12ff5449 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -86,7 +86,7 @@ struct ceph_mount_options {
+
+ char *snapdir_name; /* default ".snap" */
+ char *mds_namespace; /* default NULL */
+- char *server_path; /* default "/" */
++ char *server_path; /* default NULL (means "/") */
+ char *fscache_uniq; /* default NULL */
+ };
+
+diff --git a/include/linux/bitops.h b/include/linux/bitops.h
+index 7ac2e46112b7..e02cbca3cfaf 100644
+--- a/include/linux/bitops.h
++++ b/include/linux/bitops.h
+@@ -236,17 +236,17 @@ static __always_inline void __assign_bit(long nr, volatile unsigned long *addr,
+ #ifdef __KERNEL__
+
+ #ifndef set_mask_bits
+-#define set_mask_bits(ptr, _mask, _bits) \
++#define set_mask_bits(ptr, mask, bits) \
+ ({ \
+- const typeof(*ptr) mask = (_mask), bits = (_bits); \
+- typeof(*ptr) old, new; \
++ const typeof(*(ptr)) mask__ = (mask), bits__ = (bits); \
++ typeof(*(ptr)) old__, new__; \
+ \
+ do { \
+- old = READ_ONCE(*ptr); \
+- new = (old & ~mask) | bits; \
+- } while (cmpxchg(ptr, old, new) != old); \
++ old__ = READ_ONCE(*(ptr)); \
++ new__ = (old__ & ~mask__) | bits__; \
++ } while (cmpxchg(ptr, old__, new__) != old__); \
+ \
+- new; \
++ new__; \
+ })
+ #endif
+
+diff --git a/include/linux/notifier.h b/include/linux/notifier.h
+index f35c7bf76143..0096a05395e3 100644
+--- a/include/linux/notifier.h
++++ b/include/linux/notifier.h
+@@ -122,8 +122,7 @@ extern void srcu_init_notifier_head(struct srcu_notifier_head *nh);
+
+ #ifdef CONFIG_TREE_SRCU
+ #define _SRCU_NOTIFIER_HEAD(name, mod) \
+- static DEFINE_PER_CPU(struct srcu_data, \
+- name##_head_srcu_data); \
++ static DEFINE_PER_CPU(struct srcu_data, name##_head_srcu_data); \
+ mod struct srcu_notifier_head name = \
+ SRCU_NOTIFIER_INIT(name, name##_head_srcu_data)
+
+diff --git a/include/uapi/linux/coresight-stm.h b/include/uapi/linux/coresight-stm.h
+index aac550a52f80..8847dbf24151 100644
+--- a/include/uapi/linux/coresight-stm.h
++++ b/include/uapi/linux/coresight-stm.h
+@@ -2,8 +2,10 @@
+ #ifndef __UAPI_CORESIGHT_STM_H_
+ #define __UAPI_CORESIGHT_STM_H_
+
+-#define STM_FLAG_TIMESTAMPED BIT(3)
+-#define STM_FLAG_GUARANTEED BIT(7)
++#include <linux/const.h>
++
++#define STM_FLAG_TIMESTAMPED _BITUL(3)
++#define STM_FLAG_GUARANTEED _BITUL(7)
+
+ /*
+ * The CoreSight STM supports guaranteed and invariant timing
+diff --git a/kernel/padata.c b/kernel/padata.c
+index cfab62923c45..c280cb153915 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -671,8 +671,8 @@ int padata_set_cpumask(struct padata_instance *pinst, int cpumask_type,
+ struct cpumask *serial_mask, *parallel_mask;
+ int err = -EINVAL;
+
+- mutex_lock(&pinst->lock);
+ get_online_cpus();
++ mutex_lock(&pinst->lock);
+
+ switch (cpumask_type) {
+ case PADATA_CPU_PARALLEL:
+@@ -690,8 +690,8 @@ int padata_set_cpumask(struct padata_instance *pinst, int cpumask_type,
+ err = __padata_set_cpumasks(pinst, parallel_mask, serial_mask);
+
+ out:
+- put_online_cpus();
+ mutex_unlock(&pinst->lock);
++ put_online_cpus();
+
+ return err;
+ }
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index adeb163cd661..68c46da82aac 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2832,7 +2832,9 @@ int mpol_parse_str(char *str, struct mempolicy **mpol)
+ switch (mode) {
+ case MPOL_PREFERRED:
+ /*
+- * Insist on a nodelist of one node only
++ * Insist on a nodelist of one node only, although later
++ * we use first_node(nodes) to grab a single node, so here
++ * nodelist (or nodes) cannot be empty.
+ */
+ if (nodelist) {
+ char *rest = nodelist;
+@@ -2840,6 +2842,8 @@ int mpol_parse_str(char *str, struct mempolicy **mpol)
+ rest++;
+ if (*rest)
+ goto out;
++ if (nodes_empty(nodes))
++ goto out;
+ }
+ break;
+ case MPOL_INTERLEAVE:
+diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
+index 5e44d842cc5d..cf0ccd05329c 100644
+--- a/net/bluetooth/rfcomm/tty.c
++++ b/net/bluetooth/rfcomm/tty.c
+@@ -413,10 +413,8 @@ static int __rfcomm_create_dev(struct sock *sk, void __user *arg)
+ dlc = rfcomm_dlc_exists(&req.src, &req.dst, req.channel);
+ if (IS_ERR(dlc))
+ return PTR_ERR(dlc);
+- else if (dlc) {
+- rfcomm_dlc_put(dlc);
++ if (dlc)
+ return -EBUSY;
+- }
+ dlc = rfcomm_dlc_alloc(GFP_KERNEL);
+ if (!dlc)
+ return -ENOMEM;
+diff --git a/net/core/dev.c b/net/core/dev.c
+index c1a3baf16957..2f4d35101f4d 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2854,6 +2854,8 @@ static u16 skb_tx_hash(const struct net_device *dev,
+
+ if (skb_rx_queue_recorded(skb)) {
+ hash = skb_get_rx_queue(skb);
++ if (hash >= qoffset)
++ hash -= qoffset;
+ while (unlikely(hash >= qcount))
+ hash -= qcount;
+ return hash + qoffset;
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 3955a6d7ea66..3047fc4737c4 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -2337,6 +2337,7 @@ static int fib_triestat_seq_show(struct seq_file *seq, void *v)
+ " %zd bytes, size of tnode: %zd bytes.\n",
+ LEAF_SIZE, TNODE_SIZE(0));
+
++ rcu_read_lock();
+ for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
+ struct hlist_head *head = &net->ipv4.fib_table_hash[h];
+ struct fib_table *tb;
+@@ -2356,7 +2357,9 @@ static int fib_triestat_seq_show(struct seq_file *seq, void *v)
+ trie_show_usage(seq, t->stats);
+ #endif
+ }
++ cond_resched_rcu();
+ }
++ rcu_read_unlock();
+
+ return 0;
+ }
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 14fd8a37a729..b37abba3b369 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -155,11 +155,8 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
+ cand = t;
+ }
+
+- if (flags & TUNNEL_NO_KEY)
+- goto skip_key_lookup;
+-
+ hlist_for_each_entry_rcu(t, head, hash_node) {
+- if (t->parms.i_key != key ||
++ if ((!(flags & TUNNEL_NO_KEY) && t->parms.i_key != key) ||
+ t->parms.iph.saddr != 0 ||
+ t->parms.iph.daddr != 0 ||
+ !(t->dev->flags & IFF_UP))
+@@ -171,7 +168,6 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
+ cand = t;
+ }
+
+-skip_key_lookup:
+ if (cand)
+ return cand;
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 0c804716a2aa..627cd24b7c0d 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -3241,6 +3241,10 @@ static void addrconf_addr_gen(struct inet6_dev *idev, bool prefix_route)
+ if (netif_is_l3_master(idev->dev))
+ return;
+
++ /* no link local addresses on devices flagged as slaves */
++ if (idev->dev->flags & IFF_SLAVE)
++ return;
++
+ ipv6_addr_set(&addr, htonl(0xFE800000), 0, 0, 0);
+
+ switch (idev->cnf.addr_gen_mode) {
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index 3e54ead1e921..250d3dae8af4 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -62,8 +62,8 @@ static int rxrpc_wait_for_tx_window_nonintr(struct rxrpc_sock *rx,
+
+ rtt = READ_ONCE(call->peer->rtt);
+ rtt2 = nsecs_to_jiffies64(rtt) * 2;
+- if (rtt2 < 1)
+- rtt2 = 1;
++ if (rtt2 < 2)
++ rtt2 = 2;
+
+ timeout = rtt2;
+ tx_start = READ_ONCE(call->tx_hard_ack);
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 4fede55b9010..7657194f396e 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -240,7 +240,8 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ {
+ struct sctp_association *asoc = t->asoc;
+ struct dst_entry *dst = NULL;
+- struct flowi6 *fl6 = &fl->u.ip6;
++ struct flowi _fl;
++ struct flowi6 *fl6 = &_fl.u.ip6;
+ struct sctp_bind_addr *bp;
+ struct ipv6_pinfo *np = inet6_sk(sk);
+ struct sctp_sockaddr_entry *laddr;
+@@ -250,7 +251,7 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ enum sctp_scope scope;
+ __u8 matchlen = 0;
+
+- memset(fl6, 0, sizeof(struct flowi6));
++ memset(&_fl, 0, sizeof(_fl));
+ fl6->daddr = daddr->v6.sin6_addr;
+ fl6->fl6_dport = daddr->v6.sin6_port;
+ fl6->flowi6_proto = IPPROTO_SCTP;
+@@ -288,8 +289,11 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ rcu_read_unlock();
+
+ dst = ip6_dst_lookup_flow(sk, fl6, final_p);
+- if (!asoc || saddr)
++ if (!asoc || saddr) {
++ t->dst = dst;
++ memcpy(fl, &_fl, sizeof(_fl));
+ goto out;
++ }
+
+ bp = &asoc->base.bind_addr;
+ scope = sctp_scope(daddr);
+@@ -312,6 +316,8 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ if ((laddr->a.sa.sa_family == AF_INET6) &&
+ (sctp_v6_cmp_addr(&dst_saddr, &laddr->a))) {
+ rcu_read_unlock();
++ t->dst = dst;
++ memcpy(fl, &_fl, sizeof(_fl));
+ goto out;
+ }
+ }
+@@ -350,6 +356,8 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ if (!IS_ERR_OR_NULL(dst))
+ dst_release(dst);
+ dst = bdst;
++ t->dst = dst;
++ memcpy(fl, &_fl, sizeof(_fl));
+ break;
+ }
+
+@@ -363,6 +371,8 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ dst_release(dst);
+ dst = bdst;
+ matchlen = bmatchlen;
++ t->dst = dst;
++ memcpy(fl, &_fl, sizeof(_fl));
+ }
+ rcu_read_unlock();
+
+@@ -371,14 +381,12 @@ out:
+ struct rt6_info *rt;
+
+ rt = (struct rt6_info *)dst;
+- t->dst = dst;
+ t->dst_cookie = rt6_get_cookie(rt);
+ pr_debug("rt6_dst:%pI6/%d rt6_src:%pI6\n",
+ &rt->rt6i_dst.addr, rt->rt6i_dst.plen,
+- &fl6->saddr);
++ &fl->u.ip6.saddr);
+ } else {
+ t->dst = NULL;
+-
+ pr_debug("no route\n");
+ }
+ }
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index 269b528e50b9..787c59d798f4 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -424,7 +424,8 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ {
+ struct sctp_association *asoc = t->asoc;
+ struct rtable *rt;
+- struct flowi4 *fl4 = &fl->u.ip4;
++ struct flowi _fl;
++ struct flowi4 *fl4 = &_fl.u.ip4;
+ struct sctp_bind_addr *bp;
+ struct sctp_sockaddr_entry *laddr;
+ struct dst_entry *dst = NULL;
+@@ -434,7 +435,7 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+
+ if (t->dscp & SCTP_DSCP_SET_MASK)
+ tos = t->dscp & SCTP_DSCP_VAL_MASK;
+- memset(fl4, 0x0, sizeof(struct flowi4));
++ memset(&_fl, 0x0, sizeof(_fl));
+ fl4->daddr = daddr->v4.sin_addr.s_addr;
+ fl4->fl4_dport = daddr->v4.sin_port;
+ fl4->flowi4_proto = IPPROTO_SCTP;
+@@ -453,8 +454,11 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ &fl4->saddr);
+
+ rt = ip_route_output_key(sock_net(sk), fl4);
+- if (!IS_ERR(rt))
++ if (!IS_ERR(rt)) {
+ dst = &rt->dst;
++ t->dst = dst;
++ memcpy(fl, &_fl, sizeof(_fl));
++ }
+
+ /* If there is no association or if a source address is passed, no
+ * more validation is required.
+@@ -517,27 +521,33 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ odev = __ip_dev_find(sock_net(sk), laddr->a.v4.sin_addr.s_addr,
+ false);
+ if (!odev || odev->ifindex != fl4->flowi4_oif) {
+- if (!dst)
++ if (!dst) {
+ dst = &rt->dst;
+- else
++ t->dst = dst;
++ memcpy(fl, &_fl, sizeof(_fl));
++ } else {
+ dst_release(&rt->dst);
++ }
+ continue;
+ }
+
+ dst_release(dst);
+ dst = &rt->dst;
++ t->dst = dst;
++ memcpy(fl, &_fl, sizeof(_fl));
+ break;
+ }
+
+ out_unlock:
+ rcu_read_unlock();
+ out:
+- t->dst = dst;
+- if (dst)
++ if (dst) {
+ pr_debug("rt_dst:%pI4, rt_src:%pI4\n",
+- &fl4->daddr, &fl4->saddr);
+- else
++ &fl->u.ip4.daddr, &fl->u.ip4.saddr);
++ } else {
++ t->dst = NULL;
+ pr_debug("no route\n");
++ }
+ }
+
+ /* For v4, the source address is cached in the route entry(dst). So no need
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 95f9068b8549..c93be3ba5df2 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -165,29 +165,44 @@ static void sctp_clear_owner_w(struct sctp_chunk *chunk)
+ skb_orphan(chunk->skb);
+ }
+
++#define traverse_and_process() \
++do { \
++ msg = chunk->msg; \
++ if (msg == prev_msg) \
++ continue; \
++ list_for_each_entry(c, &msg->chunks, frag_list) { \
++ if ((clear && asoc->base.sk == c->skb->sk) || \
++ (!clear && asoc->base.sk != c->skb->sk)) \
++ cb(c); \
++ } \
++ prev_msg = msg; \
++} while (0)
++
+ static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
++ bool clear,
+ void (*cb)(struct sctp_chunk *))
+
+ {
++ struct sctp_datamsg *msg, *prev_msg = NULL;
+ struct sctp_outq *q = &asoc->outqueue;
++ struct sctp_chunk *chunk, *c;
+ struct sctp_transport *t;
+- struct sctp_chunk *chunk;
+
+ list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
+ list_for_each_entry(chunk, &t->transmitted, transmitted_list)
+- cb(chunk);
++ traverse_and_process();
+
+ list_for_each_entry(chunk, &q->retransmit, transmitted_list)
+- cb(chunk);
++ traverse_and_process();
+
+ list_for_each_entry(chunk, &q->sacked, transmitted_list)
+- cb(chunk);
++ traverse_and_process();
+
+ list_for_each_entry(chunk, &q->abandoned, transmitted_list)
+- cb(chunk);
++ traverse_and_process();
+
+ list_for_each_entry(chunk, &q->out_chunk_list, list)
+- cb(chunk);
++ traverse_and_process();
+ }
+
+ static void sctp_for_each_rx_skb(struct sctp_association *asoc, struct sock *sk,
+@@ -8899,9 +8914,9 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ * paths won't try to lock it and then oldsk.
+ */
+ lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
+- sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w);
++ sctp_for_each_tx_datachunk(assoc, true, sctp_clear_owner_w);
+ sctp_assoc_migrate(assoc, newsk);
+- sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w);
++ sctp_for_each_tx_datachunk(assoc, false, sctp_set_owner_w);
+
+ /* If the association on the newsk is already closed before accept()
+ * is called, set RCV_SHUTDOWN flag.
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index bc4edc5607c7..c9f3c002bd55 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -1069,6 +1069,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = {
+ SND_PCI_QUIRK(0x1458, 0xA016, "Recon3Di", QUIRK_R3DI),
+ SND_PCI_QUIRK(0x1458, 0xA026, "Gigabyte G1.Sniper Z97", QUIRK_R3DI),
+ SND_PCI_QUIRK(0x1458, 0xA036, "Gigabyte GA-Z170X-Gaming 7", QUIRK_R3DI),
++ SND_PCI_QUIRK(0x3842, 0x1038, "EVGA X99 Classified", QUIRK_R3DI),
+ SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D),
+ {}
+ };
+diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c
+index 99394c036998..e099c0505b76 100644
+--- a/sound/soc/jz4740/jz4740-i2s.c
++++ b/sound/soc/jz4740/jz4740-i2s.c
+@@ -92,7 +92,7 @@
+ #define JZ_AIC_I2S_STATUS_BUSY BIT(2)
+
+ #define JZ_AIC_CLK_DIV_MASK 0xf
+-#define I2SDIV_DV_SHIFT 8
++#define I2SDIV_DV_SHIFT 0
+ #define I2SDIV_DV_MASK (0xf << I2SDIV_DV_SHIFT)
+ #define I2SDIV_IDV_SHIFT 8
+ #define I2SDIV_IDV_MASK (0xf << I2SDIV_IDV_SHIFT)
+diff --git a/tools/accounting/getdelays.c b/tools/accounting/getdelays.c
+index 9f420d98b5fb..6bf6a204341e 100644
+--- a/tools/accounting/getdelays.c
++++ b/tools/accounting/getdelays.c
+@@ -136,7 +136,7 @@ static int send_cmd(int sd, __u16 nlmsg_type, __u32 nlmsg_pid,
+ msg.g.version = 0x1;
+ na = (struct nlattr *) GENLMSG_DATA(&msg);
+ na->nla_type = nla_type;
+- na->nla_len = nla_len + 1 + NLA_HDRLEN;
++ na->nla_len = nla_len + NLA_HDRLEN;
+ memcpy(NLA_DATA(na), nla_data, nla_len);
+ msg.n.nlmsg_len += NLMSG_ALIGN(na->nla_len);
+
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 02d123871ef9..2233cf722c69 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -299,6 +299,10 @@ int *irqs_per_cpu; /* indexed by cpu_num */
+
+ void setup_all_buffers(void);
+
++char *sys_lpi_file;
++char *sys_lpi_file_sysfs = "/sys/devices/system/cpu/cpuidle/low_power_idle_system_residency_us";
++char *sys_lpi_file_debugfs = "/sys/kernel/debug/pmc_core/slp_s0_residency_usec";
++
+ int cpu_is_not_present(int cpu)
+ {
+ return !CPU_ISSET_S(cpu, cpu_present_setsize, cpu_present_set);
+@@ -2844,8 +2848,6 @@ int snapshot_gfx_mhz(void)
+ *
+ * record snapshot of
+ * /sys/devices/system/cpu/cpuidle/low_power_idle_cpu_residency_us
+- *
+- * return 1 if config change requires a restart, else return 0
+ */
+ int snapshot_cpu_lpi_us(void)
+ {
+@@ -2865,17 +2867,14 @@ int snapshot_cpu_lpi_us(void)
+ /*
+ * snapshot_sys_lpi()
+ *
+- * record snapshot of
+- * /sys/devices/system/cpu/cpuidle/low_power_idle_system_residency_us
+- *
+- * return 1 if config change requires a restart, else return 0
++ * record snapshot of sys_lpi_file
+ */
+ int snapshot_sys_lpi_us(void)
+ {
+ FILE *fp;
+ int retval;
+
+- fp = fopen_or_die("/sys/devices/system/cpu/cpuidle/low_power_idle_system_residency_us", "r");
++ fp = fopen_or_die(sys_lpi_file, "r");
+
+ retval = fscanf(fp, "%lld", &cpuidle_cur_sys_lpi_us);
+ if (retval != 1)
+@@ -4743,10 +4742,16 @@ void process_cpuid()
+ else
+ BIC_NOT_PRESENT(BIC_CPU_LPI);
+
+- if (!access("/sys/devices/system/cpu/cpuidle/low_power_idle_system_residency_us", R_OK))
++ if (!access(sys_lpi_file_sysfs, R_OK)) {
++ sys_lpi_file = sys_lpi_file_sysfs;
+ BIC_PRESENT(BIC_SYS_LPI);
+- else
++ } else if (!access(sys_lpi_file_debugfs, R_OK)) {
++ sys_lpi_file = sys_lpi_file_debugfs;
++ BIC_PRESENT(BIC_SYS_LPI);
++ } else {
++ sys_lpi_file_sysfs = NULL;
+ BIC_NOT_PRESENT(BIC_SYS_LPI);
++ }
+
+ if (!quiet)
+ decode_misc_feature_control();
+@@ -5144,9 +5149,9 @@ int add_counter(unsigned int msr_num, char *path, char *name,
+ }
+
+ msrp->msr_num = msr_num;
+- strncpy(msrp->name, name, NAME_BYTES);
++ strncpy(msrp->name, name, NAME_BYTES - 1);
+ if (path)
+- strncpy(msrp->path, path, PATH_BYTES);
++ strncpy(msrp->path, path, PATH_BYTES - 1);
+ msrp->width = width;
+ msrp->type = type;
+ msrp->format = format;
+diff --git a/usr/Kconfig b/usr/Kconfig
+index 43658b8a975e..8b4826de1189 100644
+--- a/usr/Kconfig
++++ b/usr/Kconfig
+@@ -131,17 +131,6 @@ choice
+
+ If in doubt, select 'None'
+
+-config INITRAMFS_COMPRESSION_NONE
+- bool "None"
+- help
+- Do not compress the built-in initramfs at all. This may sound wasteful
+- in space, but, you should be aware that the built-in initramfs will be
+- compressed at a later stage anyways along with the rest of the kernel,
+- on those architectures that support this. However, not compressing the
+- initramfs may lead to slightly higher memory consumption during a
+- short time at boot, while both the cpio image and the unpacked
+- filesystem image will be present in memory simultaneously
+-
+ config INITRAMFS_COMPRESSION_GZIP
+ bool "Gzip"
+ depends on RD_GZIP
+@@ -214,6 +203,17 @@ config INITRAMFS_COMPRESSION_LZ4
+ If you choose this, keep in mind that most distros don't provide lz4
+ by default which could cause a build failure.
+
++config INITRAMFS_COMPRESSION_NONE
++ bool "None"
++ help
++ Do not compress the built-in initramfs at all. This may sound wasteful
++ in space, but, you should be aware that the built-in initramfs will be
++ compressed at a later stage anyways along with the rest of the kernel,
++ on those architectures that support this. However, not compressing the
++ initramfs may lead to slightly higher memory consumption during a
++ short time at boot, while both the cpio image and the unpacked
++ filesystem image will be present in memory simultaneously
++
+ endchoice
+
+ config INITRAMFS_COMPRESSION
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-04-15 17:09 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-04-15 17:09 UTC (permalink / raw
To: gentoo-commits
commit: 7cd0460613075882512bbc048bd79b9262146239
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 15 17:09:28 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 15 17:09:28 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7cd04606
Update config defaults in Gentoo distro kernel patch
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
4567_distro-Gentoo-Kconfig.patch | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index 25f36df..b5174db 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -6,9 +6,9 @@
source "lib/Kconfig.debug"
+
+source "distro/Kconfig"
---- /dev/null 2019-09-19 03:42:24.710222248 -0400
-+++ b/distro/Kconfig 2019-09-19 08:22:31.146930385 -0400
-@@ -0,0 +1,149 @@
+--- /dev/null 2020-04-15 02:49:37.900191585 -0400
++++ b/distro/Kconfig 2020-04-15 11:07:10.952929540 -0400
+@@ -0,0 +1,156 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -91,7 +91,12 @@
+ depends on GENTOO_LINUX
+
+ select BINFMT_SCRIPT
++ select CGROUPS
++ select EPOLL
+ select FILE_LOCKING
++ select INOTIFY_USER
++ select SIGNALFD
++ select TIMERFD
+
+ help
+ The init system is the first thing that loads after the kernel booted.
@@ -114,6 +119,8 @@
+
+ select AUTOFS4_FS
+ select BLK_DEV_BSG
++ select BPF_SYSCALL
++ select CGROUP_BPF
+ select CGROUPS
+ select CHECKPOINT_RESTORE
+ select CRYPTO_HMAC
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-04-17 11:45 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-04-17 11:45 UTC (permalink / raw
To: gentoo-commits
commit: 7030455eec2aa5ef288c04c76d5b9cd61dd6a529
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Apr 17 11:45:20 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Apr 17 11:45:20 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7030455e
Linux patch 4.19.116
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1115_linux-4.19.116.patch | 5582 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5586 insertions(+)
diff --git a/0000_README b/0000_README
index 65d1a80..d15813b 100644
--- a/0000_README
+++ b/0000_README
@@ -499,6 +499,10 @@ Patch: 1114_linux-4.19.115.patch
From: https://www.kernel.org
Desc: Linux 4.19.115
+Patch: 1115_linux-4.19.116.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.116
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1115_linux-4.19.116.patch b/1115_linux-4.19.116.patch
new file mode 100644
index 0000000..b5f61a1
--- /dev/null
+++ b/1115_linux-4.19.116.patch
@@ -0,0 +1,5582 @@
+diff --git a/Documentation/sound/hd-audio/index.rst b/Documentation/sound/hd-audio/index.rst
+index f8a72ffffe66..6e12de9fc34e 100644
+--- a/Documentation/sound/hd-audio/index.rst
++++ b/Documentation/sound/hd-audio/index.rst
+@@ -8,3 +8,4 @@ HD-Audio
+ models
+ controls
+ dp-mst
++ realtek-pc-beep
+diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst
+index e06238131f77..8c0de54b5649 100644
+--- a/Documentation/sound/hd-audio/models.rst
++++ b/Documentation/sound/hd-audio/models.rst
+@@ -216,8 +216,6 @@ alc298-dell-aio
+ ALC298 fixups on Dell AIO machines
+ alc275-dell-xps
+ ALC275 fixups on Dell XPS models
+-alc256-dell-xps13
+- ALC256 fixups on Dell XPS13
+ lenovo-spk-noise
+ Workaround for speaker noise on Lenovo machines
+ lenovo-hotkey
+diff --git a/Documentation/sound/hd-audio/realtek-pc-beep.rst b/Documentation/sound/hd-audio/realtek-pc-beep.rst
+new file mode 100644
+index 000000000000..be47c6f76a6e
+--- /dev/null
++++ b/Documentation/sound/hd-audio/realtek-pc-beep.rst
+@@ -0,0 +1,129 @@
++===============================
++Realtek PC Beep Hidden Register
++===============================
++
++This file documents the "PC Beep Hidden Register", which is present in certain
++Realtek HDA codecs and controls a muxer and pair of passthrough mixers that can
++route audio between pins but aren't themselves exposed as HDA widgets. As far
++as I can tell, these hidden routes are designed to allow flexible PC Beep output
++for codecs that don't have mixer widgets in their output paths. Why it's easier
++to hide a mixer behind an undocumented vendor register than to just expose it
++as a widget, I have no idea.
++
++Register Description
++====================
++
++The register is accessed via processing coefficient 0x36 on NID 20h. Bits not
++identified below have no discernible effect on my machine, a Dell XPS 13 9350::
++
++ MSB LSB
++ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++ | |h|S|L| | B |R| | Known bits
++ +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
++ |0|0|1|1| 0x7 |0|0x0|1| 0x7 | Reset value
++ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++
++1Ah input select (B): 2 bits
++ When zero, expose the PC Beep line (from the internal beep generator, when
++ enabled with the Set Beep Generation verb on NID 01h, or else from the
++ external PCBEEP pin) on the 1Ah pin node. When nonzero, expose the headphone
++ jack (or possibly Line In on some machines) input instead. If PC Beep is
++ selected, the 1Ah boost control has no effect.
++
++Amplify 1Ah loopback, left (L): 1 bit
++ Amplify the left channel of 1Ah before mixing it into outputs as specified
++ by h and S bits. Does not affect the level of 1Ah exposed to other widgets.
++
++Amplify 1Ah loopback, right (R): 1 bit
++ Amplify the right channel of 1Ah before mixing it into outputs as specified
++ by h and S bits. Does not affect the level of 1Ah exposed to other widgets.
++
++Loopback 1Ah to 21h [active low] (h): 1 bit
++ When zero, mix 1Ah (possibly with amplification, depending on L and R bits)
++ into 21h (headphone jack on my machine). Mixed signal respects the mute
++ setting on 21h.
++
++Loopback 1Ah to 14h (S): 1 bit
++ When one, mix 1Ah (possibly with amplification, depending on L and R bits)
++ into 14h (internal speaker on my machine). Mixed signal **ignores** the mute
++ setting on 14h and is present whenever 14h is configured as an output.
++
++Path diagrams
++=============
++
++1Ah input selection (DIV is the PC Beep divider set on NID 01h)::
++
++ <Beep generator> <PCBEEP pin> <Headphone jack>
++ | | |
++ +--DIV--+--!DIV--+ {1Ah boost control}
++ | |
++ +--(b == 0)--+--(b != 0)--+
++ |
++ >1Ah (Beep/Headphone Mic/Line In)<
++
++Loopback of 1Ah to 21h/14h::
++
++ <1Ah (Beep/Headphone Mic/Line In)>
++ |
++ {amplify if L/R}
++ |
++ +-----!h-----+-----S-----+
++ | |
++ {21h mute control} |
++ | |
++ >21h (Headphone)< >14h (Internal Speaker)<
++
++Background
++==========
++
++All Realtek HDA codecs have a vendor-defined widget with node ID 20h which
++provides access to a bank of registers that control various codec functions.
++Registers are read and written via the standard HDA processing coefficient
++verbs (Set/Get Coefficient Index, Set/Get Processing Coefficient). The node is
++named "Realtek Vendor Registers" in public datasheets' verb listings and,
++apart from that, is entirely undocumented.
++
++This particular register, exposed at coefficient 0x36 and named in commits from
++Realtek, is of note: unlike most registers, which seem to control detailed
++amplifier parameters not in scope of the HDA specification, it controls audio
++routing which could just as easily have been defined using standard HDA mixer
++and selector widgets.
++
++Specifically, it selects between two sources for the input pin widget with Node
++ID (NID) 1Ah: the widget's signal can come either from an audio jack (on my
++laptop, a Dell XPS 13 9350, it's the headphone jack, but comments in Realtek
++commits indicate that it might be a Line In on some machines) or from the PC
++Beep line (which is itself multiplexed between the codec's internal beep
++generator and external PCBEEP pin, depending on if the beep generator is
++enabled via verbs on NID 01h). Additionally, it can mix (with optional
++amplification) that signal onto the 21h and/or 14h output pins.
++
++The register's reset value is 0x3717, corresponding to PC Beep on 1Ah that is
++then amplified and mixed into both the headphones and the speakers. Not only
++does this violate the HDA specification, which says that "[a vendor defined
++beep input pin] connection may be maintained *only* while the Link reset
++(**RST#**) is asserted", it means that we cannot ignore the register if we care
++about the input that 1Ah would otherwise expose or if the PCBEEP trace is
++poorly shielded and picks up chassis noise (both of which are the case on my
++machine).
++
++Unfortunately, there are lots of ways to get this register configuration wrong.
++Linux, it seems, has gone through most of them. For one, the register resets
++after S3 suspend: judging by existing code, this isn't the case for all vendor
++registers, and it's led to some fixes that improve behavior on cold boot but
++don't last after suspend. Other fixes have successfully switched the 1Ah input
++away from PC Beep but have failed to disable both loopback paths. On my
++machine, this means that the headphone input is amplified and looped back to
++the headphone output, which uses the exact same pins! As you might expect, this
++causes terrible headphone noise, the character of which is controlled by the
++1Ah boost control. (If you've seen instructions online to fix XPS 13 headphone
++noise by changing "Headphone Mic Boost" in ALSA, now you know why.)
++
++The information here has been obtained through black-box reverse engineering of
++the ALC256 codec's behavior and is not guaranteed to be correct. It likely
++also applies for the ALC255, ALC257, ALC235, and ALC236, since those codecs
++seem to be close relatives of the ALC256. (They all share one initialization
++function.) Additionally, other codecs like the ALC225 and ALC285 also have this
++register, judging by existing fixups in ``patch_realtek.c``, but specific
++data (e.g. node IDs, bit positions, pin mappings) for those codecs may differ
++from what I've described here.
+diff --git a/Makefile b/Makefile
+index 9830a71e9192..d85ff698f5b9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 115
++SUBLEVEL = 116
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+index 49547a43cc90..54cbdaf7ffdc 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+@@ -318,8 +318,8 @@
+ };
+
+ ®_dldo3 {
+- regulator-min-microvolt = <2800000>;
+- regulator-max-microvolt = <2800000>;
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
+ regulator-name = "vdd-csi";
+ };
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index bd4391269611..6e4e45907738 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -70,8 +70,7 @@
+ };
+
+ pmu {
+- compatible = "arm,cortex-a53-pmu",
+- "arm,armv8-pmuv3";
++ compatible = "arm,cortex-a53-pmu";
+ interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
+diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
+index 39dc98dd78eb..181c29af5617 100644
+--- a/arch/arm64/kernel/armv8_deprecated.c
++++ b/arch/arm64/kernel/armv8_deprecated.c
+@@ -604,7 +604,7 @@ static struct undef_hook setend_hooks[] = {
+ },
+ {
+ /* Thumb mode */
+- .instr_mask = 0x0000fff7,
++ .instr_mask = 0xfffffff7,
+ .instr_val = 0x0000b650,
+ .pstate_mask = (PSR_AA32_T_BIT | PSR_AA32_MODE_MASK),
+ .pstate_val = (PSR_AA32_T_BIT | PSR_AA32_MODE_USR),
+diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
+index 8272d8c648ca..43e4fc1b373c 100644
+--- a/arch/mips/cavium-octeon/octeon-irq.c
++++ b/arch/mips/cavium-octeon/octeon-irq.c
+@@ -2199,6 +2199,9 @@ static int octeon_irq_cib_map(struct irq_domain *d,
+ }
+
+ cd = kzalloc(sizeof(*cd), GFP_KERNEL);
++ if (!cd)
++ return -ENOMEM;
++
+ cd->host_data = host_data;
+ cd->bit = hw;
+
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index 3944c49eee0c..620abc968624 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -1479,6 +1479,7 @@ static void build_r4000_tlb_refill_handler(void)
+
+ static void setup_pw(void)
+ {
++ unsigned int pwctl;
+ unsigned long pgd_i, pgd_w;
+ #ifndef __PAGETABLE_PMD_FOLDED
+ unsigned long pmd_i, pmd_w;
+@@ -1505,6 +1506,7 @@ static void setup_pw(void)
+
+ pte_i = ilog2(_PAGE_GLOBAL);
+ pte_w = 0;
++ pwctl = 1 << 30; /* Set PWDirExt */
+
+ #ifndef __PAGETABLE_PMD_FOLDED
+ write_c0_pwfield(pgd_i << 24 | pmd_i << 12 | pt_i << 6 | pte_i);
+@@ -1515,8 +1517,9 @@ static void setup_pw(void)
+ #endif
+
+ #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
+- write_c0_pwctl(1 << 6 | psn);
++ pwctl |= (1 << 6 | psn);
+ #endif
++ write_c0_pwctl(pwctl);
+ write_c0_kpgd((long)swapper_pg_dir);
+ kscratch_used_mask |= (1 << 7); /* KScratch6 is used for KPGD */
+ }
+diff --git a/arch/powerpc/include/asm/book3s/64/hash-4k.h b/arch/powerpc/include/asm/book3s/64/hash-4k.h
+index 9a3798660cef..fc68c0fc08b5 100644
+--- a/arch/powerpc/include/asm/book3s/64/hash-4k.h
++++ b/arch/powerpc/include/asm/book3s/64/hash-4k.h
+@@ -145,6 +145,12 @@ extern pmd_t hash__pmdp_huge_get_and_clear(struct mm_struct *mm,
+ extern int hash__has_transparent_hugepage(void);
+ #endif
+
++static inline pmd_t hash__pmd_mkdevmap(pmd_t pmd)
++{
++ BUG();
++ return pmd;
++}
++
+ #endif /* !__ASSEMBLY__ */
+
+ #endif /* _ASM_POWERPC_BOOK3S_64_HASH_4K_H */
+diff --git a/arch/powerpc/include/asm/book3s/64/hash-64k.h b/arch/powerpc/include/asm/book3s/64/hash-64k.h
+index f82ee8a3b561..790e4a946f6e 100644
+--- a/arch/powerpc/include/asm/book3s/64/hash-64k.h
++++ b/arch/powerpc/include/asm/book3s/64/hash-64k.h
+@@ -233,7 +233,7 @@ static inline void mark_hpte_slot_valid(unsigned char *hpte_slot_array,
+ */
+ static inline int hash__pmd_trans_huge(pmd_t pmd)
+ {
+- return !!((pmd_val(pmd) & (_PAGE_PTE | H_PAGE_THP_HUGE)) ==
++ return !!((pmd_val(pmd) & (_PAGE_PTE | H_PAGE_THP_HUGE | _PAGE_DEVMAP)) ==
+ (_PAGE_PTE | H_PAGE_THP_HUGE));
+ }
+
+@@ -259,6 +259,12 @@ extern pmd_t hash__pmdp_huge_get_and_clear(struct mm_struct *mm,
+ unsigned long addr, pmd_t *pmdp);
+ extern int hash__has_transparent_hugepage(void);
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
++
++static inline pmd_t hash__pmd_mkdevmap(pmd_t pmd)
++{
++ return __pmd(pmd_val(pmd) | (_PAGE_PTE | H_PAGE_THP_HUGE | _PAGE_DEVMAP));
++}
++
+ #endif /* __ASSEMBLY__ */
+
+ #endif /* _ASM_POWERPC_BOOK3S_64_HASH_64K_H */
+diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
+index 855dbae6d351..2aea6efc2e63 100644
+--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
++++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
+@@ -1253,7 +1253,9 @@ extern void serialize_against_pte_lookup(struct mm_struct *mm);
+
+ static inline pmd_t pmd_mkdevmap(pmd_t pmd)
+ {
+- return __pmd(pmd_val(pmd) | (_PAGE_PTE | _PAGE_DEVMAP));
++ if (radix_enabled())
++ return radix__pmd_mkdevmap(pmd);
++ return hash__pmd_mkdevmap(pmd);
+ }
+
+ static inline int pmd_devmap(pmd_t pmd)
+diff --git a/arch/powerpc/include/asm/book3s/64/radix.h b/arch/powerpc/include/asm/book3s/64/radix.h
+index 7d1a3d1543fc..da01badef0cb 100644
+--- a/arch/powerpc/include/asm/book3s/64/radix.h
++++ b/arch/powerpc/include/asm/book3s/64/radix.h
+@@ -255,6 +255,11 @@ extern pmd_t radix__pmdp_huge_get_and_clear(struct mm_struct *mm,
+ extern int radix__has_transparent_hugepage(void);
+ #endif
+
++static inline pmd_t radix__pmd_mkdevmap(pmd_t pmd)
++{
++ return __pmd(pmd_val(pmd) | (_PAGE_PTE | _PAGE_DEVMAP));
++}
++
+ extern int __meminit radix__vmemmap_create_mapping(unsigned long start,
+ unsigned long page_size,
+ unsigned long phys);
+diff --git a/arch/powerpc/include/asm/drmem.h b/arch/powerpc/include/asm/drmem.h
+index 7c1d8e74b25d..9e516fe3daab 100644
+--- a/arch/powerpc/include/asm/drmem.h
++++ b/arch/powerpc/include/asm/drmem.h
+@@ -28,12 +28,12 @@ struct drmem_lmb_info {
+ extern struct drmem_lmb_info *drmem_info;
+
+ #define for_each_drmem_lmb_in_range(lmb, start, end) \
+- for ((lmb) = (start); (lmb) <= (end); (lmb)++)
++ for ((lmb) = (start); (lmb) < (end); (lmb)++)
+
+ #define for_each_drmem_lmb(lmb) \
+ for_each_drmem_lmb_in_range((lmb), \
+ &drmem_info->lmbs[0], \
+- &drmem_info->lmbs[drmem_info->n_lmbs - 1])
++ &drmem_info->lmbs[drmem_info->n_lmbs])
+
+ /*
+ * The of_drconf_cell_v1 struct defines the layout of the LMB data
+diff --git a/arch/powerpc/include/asm/setjmp.h b/arch/powerpc/include/asm/setjmp.h
+index 279d03a1eec6..6941fe202bc8 100644
+--- a/arch/powerpc/include/asm/setjmp.h
++++ b/arch/powerpc/include/asm/setjmp.h
+@@ -12,7 +12,9 @@
+
+ #define JMP_BUF_LEN 23
+
+-extern long setjmp(long *);
+-extern void longjmp(long *, long);
++typedef long jmp_buf[JMP_BUF_LEN];
++
++extern int setjmp(jmp_buf env) __attribute__((returns_twice));
++extern void longjmp(jmp_buf env, int val) __attribute__((noreturn));
+
+ #endif /* _ASM_POWERPC_SETJMP_H */
+diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
+index d450280e5c29..1e64cfe22a83 100644
+--- a/arch/powerpc/kernel/Makefile
++++ b/arch/powerpc/kernel/Makefile
+@@ -5,9 +5,6 @@
+
+ CFLAGS_ptrace.o += -DUTS_MACHINE='"$(UTS_MACHINE)"'
+
+-# Avoid clang warnings around longjmp/setjmp declarations
+-CFLAGS_crash.o += -ffreestanding
+-
+ subdir-ccflags-$(CONFIG_PPC_WERROR) := -Werror
+
+ ifdef CONFIG_PPC64
+diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
+index 36178000a2f2..4a860d3b9229 100644
+--- a/arch/powerpc/kernel/idle_book3s.S
++++ b/arch/powerpc/kernel/idle_book3s.S
+@@ -170,8 +170,11 @@ core_idle_lock_held:
+ bne- core_idle_lock_held
+ blr
+
+-/* Reuse an unused pt_regs slot for IAMR */
++/* Reuse some unused pt_regs slots for AMR/IAMR/UAMOR/UAMOR */
++#define PNV_POWERSAVE_AMR _TRAP
+ #define PNV_POWERSAVE_IAMR _DAR
++#define PNV_POWERSAVE_UAMOR _DSISR
++#define PNV_POWERSAVE_AMOR RESULT
+
+ /*
+ * Pass requested state in r3:
+@@ -205,8 +208,16 @@ pnv_powersave_common:
+ SAVE_NVGPRS(r1)
+
+ BEGIN_FTR_SECTION
++ mfspr r4, SPRN_AMR
+ mfspr r5, SPRN_IAMR
++ mfspr r6, SPRN_UAMOR
++ std r4, PNV_POWERSAVE_AMR(r1)
+ std r5, PNV_POWERSAVE_IAMR(r1)
++ std r6, PNV_POWERSAVE_UAMOR(r1)
++BEGIN_FTR_SECTION_NESTED(42)
++ mfspr r7, SPRN_AMOR
++ std r7, PNV_POWERSAVE_AMOR(r1)
++END_FTR_SECTION_NESTED_IFSET(CPU_FTR_HVMODE, 42)
+ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+
+ mfcr r5
+@@ -935,12 +946,20 @@ END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)
+ REST_GPR(2, r1)
+
+ BEGIN_FTR_SECTION
+- /* IAMR was saved in pnv_powersave_common() */
++ /* These regs were saved in pnv_powersave_common() */
++ ld r4, PNV_POWERSAVE_AMR(r1)
+ ld r5, PNV_POWERSAVE_IAMR(r1)
++ ld r6, PNV_POWERSAVE_UAMOR(r1)
++ mtspr SPRN_AMR, r4
+ mtspr SPRN_IAMR, r5
++ mtspr SPRN_UAMOR, r6
++BEGIN_FTR_SECTION_NESTED(42)
++ ld r7, PNV_POWERSAVE_AMOR(r1)
++ mtspr SPRN_AMOR, r7
++END_FTR_SECTION_NESTED_IFSET(CPU_FTR_HVMODE, 42)
+ /*
+- * We don't need an isync here because the upcoming mtmsrd is
+- * execution synchronizing.
++ * We don't need an isync here after restoring IAMR because the upcoming
++ * mtmsrd is execution synchronizing.
+ */
+ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+
+diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
+index 5c60bb0f927f..53a39661eb13 100644
+--- a/arch/powerpc/kernel/kprobes.c
++++ b/arch/powerpc/kernel/kprobes.c
+@@ -277,6 +277,9 @@ int kprobe_handler(struct pt_regs *regs)
+ if (user_mode(regs))
+ return 0;
+
++ if (!(regs->msr & MSR_IR) || !(regs->msr & MSR_DR))
++ return 0;
++
+ /*
+ * We don't want to be preempted for the entire
+ * duration of kprobe processing
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
+index b088b0700d0d..7aba592bba36 100644
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -477,8 +477,10 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
+ err |= __get_user(tsk->thread.ckpt_regs.ccr,
+ &sc->gp_regs[PT_CCR]);
+
++ /* Don't allow userspace to set the trap value */
++ regs->trap = 0;
++
+ /* These regs are not checkpointed; they can go in 'regs'. */
+- err |= __get_user(regs->trap, &sc->gp_regs[PT_TRAP]);
+ err |= __get_user(regs->dar, &sc->gp_regs[PT_DAR]);
+ err |= __get_user(regs->dsisr, &sc->gp_regs[PT_DSISR]);
+ err |= __get_user(regs->result, &sc->gp_regs[PT_RESULT]);
+diff --git a/arch/powerpc/mm/tlb_nohash_low.S b/arch/powerpc/mm/tlb_nohash_low.S
+index e066a658acac..56f58a362ea5 100644
+--- a/arch/powerpc/mm/tlb_nohash_low.S
++++ b/arch/powerpc/mm/tlb_nohash_low.S
+@@ -402,7 +402,7 @@ _GLOBAL(set_context)
+ * extern void loadcam_entry(unsigned int index)
+ *
+ * Load TLBCAM[index] entry in to the L2 CAM MMU
+- * Must preserve r7, r8, r9, and r10
++ * Must preserve r7, r8, r9, r10 and r11
+ */
+ _GLOBAL(loadcam_entry)
+ mflr r5
+@@ -438,6 +438,10 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_BIG_PHYS)
+ */
+ _GLOBAL(loadcam_multi)
+ mflr r8
++ /* Don't switch to AS=1 if already there */
++ mfmsr r11
++ andi. r11,r11,MSR_IS
++ bne 10f
+
+ /*
+ * Set up temporary TLB entry that is the same as what we're
+@@ -463,6 +467,7 @@ _GLOBAL(loadcam_multi)
+ mtmsr r6
+ isync
+
++10:
+ mr r9,r3
+ add r10,r3,r4
+ 2: bl loadcam_entry
+@@ -471,6 +476,10 @@ _GLOBAL(loadcam_multi)
+ mr r3,r9
+ blt 2b
+
++ /* Don't return to AS=0 if we were in AS=1 at function start */
++ andi. r11,r11,MSR_IS
++ bne 3f
++
+ /* Return to AS=0 and clear the temporary entry */
+ mfmsr r6
+ rlwinm. r6,r6,0,~(MSR_IS|MSR_DS)
+@@ -486,6 +495,7 @@ _GLOBAL(loadcam_multi)
+ tlbwe
+ isync
+
++3:
+ mtlr r8
+ blr
+ #endif
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index fc01a2c0f8ed..b168c3742b43 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -227,7 +227,7 @@ static int get_lmb_range(u32 drc_index, int n_lmbs,
+ struct drmem_lmb **end_lmb)
+ {
+ struct drmem_lmb *lmb, *start, *end;
+- struct drmem_lmb *last_lmb;
++ struct drmem_lmb *limit;
+
+ start = NULL;
+ for_each_drmem_lmb(lmb) {
+@@ -240,10 +240,10 @@ static int get_lmb_range(u32 drc_index, int n_lmbs,
+ if (!start)
+ return -EINVAL;
+
+- end = &start[n_lmbs - 1];
++ end = &start[n_lmbs];
+
+- last_lmb = &drmem_info->lmbs[drmem_info->n_lmbs - 1];
+- if (end > last_lmb)
++ limit = &drmem_info->lmbs[drmem_info->n_lmbs];
++ if (end > limit)
+ return -EINVAL;
+
+ *start_lmb = start;
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index 49e3a88b6a0c..d660a90616cd 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -1056,7 +1056,7 @@ static int __init vpa_debugfs_init(void)
+ {
+ char name[16];
+ long i;
+- static struct dentry *vpa_dir;
++ struct dentry *vpa_dir;
+
+ if (!firmware_has_feature(FW_FEATURE_SPLPAR))
+ return 0;
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index 3c939b9de488..1c31a08cdd54 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -72,13 +72,6 @@ static u32 xive_ipi_irq;
+ /* Xive state for each CPU */
+ static DEFINE_PER_CPU(struct xive_cpu *, xive_cpu);
+
+-/*
+- * A "disabled" interrupt should never fire, to catch problems
+- * we set its logical number to this
+- */
+-#define XIVE_BAD_IRQ 0x7fffffff
+-#define XIVE_MAX_IRQ (XIVE_BAD_IRQ - 1)
+-
+ /* An invalid CPU target */
+ #define XIVE_INVALID_TARGET (-1)
+
+@@ -1074,7 +1067,7 @@ static int xive_setup_cpu_ipi(unsigned int cpu)
+ xc = per_cpu(xive_cpu, cpu);
+
+ /* Check if we are already setup */
+- if (xc->hw_ipi != 0)
++ if (xc->hw_ipi != XIVE_BAD_IRQ)
+ return 0;
+
+ /* Grab an IPI from the backend, this will populate xc->hw_ipi */
+@@ -1111,7 +1104,7 @@ static void xive_cleanup_cpu_ipi(unsigned int cpu, struct xive_cpu *xc)
+ /* Disable the IPI and free the IRQ data */
+
+ /* Already cleaned up ? */
+- if (xc->hw_ipi == 0)
++ if (xc->hw_ipi == XIVE_BAD_IRQ)
+ return;
+
+ /* Mask the IPI */
+@@ -1267,6 +1260,7 @@ static int xive_prepare_cpu(unsigned int cpu)
+ if (np)
+ xc->chip_id = of_get_ibm_chip_id(np);
+ of_node_put(np);
++ xc->hw_ipi = XIVE_BAD_IRQ;
+
+ per_cpu(xive_cpu, cpu) = xc;
+ }
+diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
+index 6d5b28022452..cb1f51ad48e4 100644
+--- a/arch/powerpc/sysdev/xive/native.c
++++ b/arch/powerpc/sysdev/xive/native.c
+@@ -311,7 +311,7 @@ static void xive_native_put_ipi(unsigned int cpu, struct xive_cpu *xc)
+ s64 rc;
+
+ /* Free the IPI */
+- if (!xc->hw_ipi)
++ if (xc->hw_ipi == XIVE_BAD_IRQ)
+ return;
+ for (;;) {
+ rc = opal_xive_free_irq(xc->hw_ipi);
+@@ -319,7 +319,7 @@ static void xive_native_put_ipi(unsigned int cpu, struct xive_cpu *xc)
+ msleep(OPAL_BUSY_DELAY_MS);
+ continue;
+ }
+- xc->hw_ipi = 0;
++ xc->hw_ipi = XIVE_BAD_IRQ;
+ break;
+ }
+ }
+diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
+index e3ebf6469392..5566bbc86f4a 100644
+--- a/arch/powerpc/sysdev/xive/spapr.c
++++ b/arch/powerpc/sysdev/xive/spapr.c
+@@ -509,11 +509,11 @@ static int xive_spapr_get_ipi(unsigned int cpu, struct xive_cpu *xc)
+
+ static void xive_spapr_put_ipi(unsigned int cpu, struct xive_cpu *xc)
+ {
+- if (!xc->hw_ipi)
++ if (xc->hw_ipi == XIVE_BAD_IRQ)
+ return;
+
+ xive_irq_bitmap_free(xc->hw_ipi);
+- xc->hw_ipi = 0;
++ xc->hw_ipi = XIVE_BAD_IRQ;
+ }
+ #endif /* CONFIG_SMP */
+
+diff --git a/arch/powerpc/sysdev/xive/xive-internal.h b/arch/powerpc/sysdev/xive/xive-internal.h
+index f34abed0c05f..48808dbb25dc 100644
+--- a/arch/powerpc/sysdev/xive/xive-internal.h
++++ b/arch/powerpc/sysdev/xive/xive-internal.h
+@@ -9,6 +9,13 @@
+ #ifndef __XIVE_INTERNAL_H
+ #define __XIVE_INTERNAL_H
+
++/*
++ * A "disabled" interrupt should never fire, to catch problems
++ * we set its logical number to this
++ */
++#define XIVE_BAD_IRQ 0x7fffffff
++#define XIVE_MAX_IRQ (XIVE_BAD_IRQ - 1)
++
+ /* Each CPU carry one of these with various per-CPU state */
+ struct xive_cpu {
+ #ifdef CONFIG_SMP
+diff --git a/arch/powerpc/xmon/Makefile b/arch/powerpc/xmon/Makefile
+index 365e711bebab..ab193cd7dbf9 100644
+--- a/arch/powerpc/xmon/Makefile
++++ b/arch/powerpc/xmon/Makefile
+@@ -1,9 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Makefile for xmon
+
+-# Avoid clang warnings around longjmp/setjmp declarations
+-subdir-ccflags-y := -ffreestanding
+-
+ subdir-ccflags-$(CONFIG_PPC_WERROR) += -Werror
+
+ GCOV_PROFILE := n
+diff --git a/arch/s390/kernel/diag.c b/arch/s390/kernel/diag.c
+index 53a5316cc4b7..35c842aa8705 100644
+--- a/arch/s390/kernel/diag.c
++++ b/arch/s390/kernel/diag.c
+@@ -79,7 +79,7 @@ static int show_diag_stat(struct seq_file *m, void *v)
+
+ static void *show_diag_stat_start(struct seq_file *m, loff_t *pos)
+ {
+- return *pos <= nr_cpu_ids ? (void *)((unsigned long) *pos + 1) : NULL;
++ return *pos <= NR_DIAG_STAT ? (void *)((unsigned long) *pos + 1) : NULL;
+ }
+
+ static void *show_diag_stat_next(struct seq_file *m, void *v, loff_t *pos)
+diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
+index a2b28cd1e3fe..17d73b71df1d 100644
+--- a/arch/s390/kvm/vsie.c
++++ b/arch/s390/kvm/vsie.c
+@@ -1024,6 +1024,7 @@ static int vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
+ scb_s->iprcc = PGM_ADDRESSING;
+ scb_s->pgmilc = 4;
+ scb_s->gpsw.addr = __rewind_psw(scb_s->gpsw, 4);
++ rc = 1;
+ }
+ return rc;
+ }
+diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
+index 911c7ded35f1..b56c4fdb1517 100644
+--- a/arch/s390/mm/gmap.c
++++ b/arch/s390/mm/gmap.c
+@@ -787,14 +787,18 @@ static void gmap_call_notifier(struct gmap *gmap, unsigned long start,
+ static inline unsigned long *gmap_table_walk(struct gmap *gmap,
+ unsigned long gaddr, int level)
+ {
++ const int asce_type = gmap->asce & _ASCE_TYPE_MASK;
+ unsigned long *table;
+
+ if ((gmap->asce & _ASCE_TYPE_MASK) + 4 < (level * 4))
+ return NULL;
+ if (gmap_is_shadow(gmap) && gmap->removed)
+ return NULL;
+- if (gaddr & (-1UL << (31 + ((gmap->asce & _ASCE_TYPE_MASK) >> 2)*11)))
++
++ if (asce_type != _ASCE_TYPE_REGION1 &&
++ gaddr & (-1UL << (31 + (asce_type >> 2) * 11)))
+ return NULL;
++
+ table = gmap->table;
+ switch (gmap->asce & _ASCE_TYPE_MASK) {
+ case _ASCE_TYPE_REGION1:
+diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
+index 37380c0d5999..01d628ea3402 100644
+--- a/arch/x86/boot/compressed/head_32.S
++++ b/arch/x86/boot/compressed/head_32.S
+@@ -106,7 +106,7 @@ ENTRY(startup_32)
+ notl %eax
+ andl %eax, %ebx
+ cmpl $LOAD_PHYSICAL_ADDR, %ebx
+- jge 1f
++ jae 1f
+ #endif
+ movl $LOAD_PHYSICAL_ADDR, %ebx
+ 1:
+diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
+index 4eaa724afce3..9fa644c62839 100644
+--- a/arch/x86/boot/compressed/head_64.S
++++ b/arch/x86/boot/compressed/head_64.S
+@@ -106,7 +106,7 @@ ENTRY(startup_32)
+ notl %eax
+ andl %eax, %ebx
+ cmpl $LOAD_PHYSICAL_ADDR, %ebx
+- jge 1f
++ jae 1f
+ #endif
+ movl $LOAD_PHYSICAL_ADDR, %ebx
+ 1:
+@@ -297,7 +297,7 @@ ENTRY(startup_64)
+ notq %rax
+ andq %rax, %rbp
+ cmpq $LOAD_PHYSICAL_ADDR, %rbp
+- jge 1f
++ jae 1f
+ #endif
+ movq $LOAD_PHYSICAL_ADDR, %rbp
+ 1:
+diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
+index d07432062ee6..37d9016d4768 100644
+--- a/arch/x86/entry/entry_32.S
++++ b/arch/x86/entry/entry_32.S
+@@ -1489,6 +1489,7 @@ ENTRY(int3)
+ END(int3)
+
+ ENTRY(general_protection)
++ ASM_CLAC
+ pushl $do_general_protection
+ jmp common_exception
+ END(general_protection)
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 067288d4ef6e..5c99b9bfce04 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1070,7 +1070,7 @@ struct kvm_x86_ops {
+ bool (*xsaves_supported)(void);
+ bool (*umip_emulated)(void);
+
+- int (*check_nested_events)(struct kvm_vcpu *vcpu, bool external_intr);
++ int (*check_nested_events)(struct kvm_vcpu *vcpu);
+ void (*request_immediate_exit)(struct kvm_vcpu *vcpu);
+
+ void (*sched_in)(struct kvm_vcpu *kvm, int cpu);
+diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
+index 690c0307afed..2e1ed12c65f8 100644
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -608,12 +608,15 @@ static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
+ return __pmd(val);
+ }
+
+-/* mprotect needs to preserve PAT bits when updating vm_page_prot */
++/*
++ * mprotect needs to preserve PAT and encryption bits when updating
++ * vm_page_prot
++ */
+ #define pgprot_modify pgprot_modify
+ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
+ {
+ pgprotval_t preservebits = pgprot_val(oldprot) & _PAGE_CHG_MASK;
+- pgprotval_t addbits = pgprot_val(newprot);
++ pgprotval_t addbits = pgprot_val(newprot) & ~_PAGE_CHG_MASK;
+ return __pgprot(preservebits | addbits);
+ }
+
+diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
+index 106b7d0e2dae..71ea49e7db74 100644
+--- a/arch/x86/include/asm/pgtable_types.h
++++ b/arch/x86/include/asm/pgtable_types.h
+@@ -124,7 +124,7 @@
+ */
+ #define _PAGE_CHG_MASK (PTE_PFN_MASK | _PAGE_PCD | _PAGE_PWT | \
+ _PAGE_SPECIAL | _PAGE_ACCESSED | _PAGE_DIRTY | \
+- _PAGE_SOFT_DIRTY | _PAGE_DEVMAP)
++ _PAGE_SOFT_DIRTY | _PAGE_DEVMAP | _PAGE_ENC)
+ #define _HPAGE_CHG_MASK (_PAGE_CHG_MASK | _PAGE_PSE)
+
+ /*
+diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
+index 3b20607d581b..7303bb398862 100644
+--- a/arch/x86/kernel/acpi/boot.c
++++ b/arch/x86/kernel/acpi/boot.c
+@@ -1752,7 +1752,7 @@ int __acpi_acquire_global_lock(unsigned int *lock)
+ new = (((old & ~0x3) + 2) + ((old >> 1) & 0x1));
+ val = cmpxchg(lock, old, new);
+ } while (unlikely (val != old));
+- return (new < 3) ? -1 : 0;
++ return ((new & 0x3) < 3) ? -1 : 0;
+ }
+
+ int __acpi_release_global_lock(unsigned int *lock)
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index cc8f3b41a1b2..df2274414640 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1917,6 +1917,10 @@ static void __unregister_enc_region_locked(struct kvm *kvm,
+ static struct kvm *svm_vm_alloc(void)
+ {
+ struct kvm_svm *kvm_svm = vzalloc(sizeof(struct kvm_svm));
++
++ if (!kvm_svm)
++ return NULL;
++
+ return &kvm_svm->kvm;
+ }
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index a81d7d9ce9d6..d37b48173e9c 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2156,43 +2156,15 @@ static void vmcs_load(struct vmcs *vmcs)
+ }
+
+ #ifdef CONFIG_KEXEC_CORE
+-/*
+- * This bitmap is used to indicate whether the vmclear
+- * operation is enabled on all cpus. All disabled by
+- * default.
+- */
+-static cpumask_t crash_vmclear_enabled_bitmap = CPU_MASK_NONE;
+-
+-static inline void crash_enable_local_vmclear(int cpu)
+-{
+- cpumask_set_cpu(cpu, &crash_vmclear_enabled_bitmap);
+-}
+-
+-static inline void crash_disable_local_vmclear(int cpu)
+-{
+- cpumask_clear_cpu(cpu, &crash_vmclear_enabled_bitmap);
+-}
+-
+-static inline int crash_local_vmclear_enabled(int cpu)
+-{
+- return cpumask_test_cpu(cpu, &crash_vmclear_enabled_bitmap);
+-}
+-
+ static void crash_vmclear_local_loaded_vmcss(void)
+ {
+ int cpu = raw_smp_processor_id();
+ struct loaded_vmcs *v;
+
+- if (!crash_local_vmclear_enabled(cpu))
+- return;
+-
+ list_for_each_entry(v, &per_cpu(loaded_vmcss_on_cpu, cpu),
+ loaded_vmcss_on_cpu_link)
+ vmcs_clear(v->vmcs);
+ }
+-#else
+-static inline void crash_enable_local_vmclear(int cpu) { }
+-static inline void crash_disable_local_vmclear(int cpu) { }
+ #endif /* CONFIG_KEXEC_CORE */
+
+ static void __loaded_vmcs_clear(void *arg)
+@@ -2204,19 +2176,24 @@ static void __loaded_vmcs_clear(void *arg)
+ return; /* vcpu migration can race with cpu offline */
+ if (per_cpu(current_vmcs, cpu) == loaded_vmcs->vmcs)
+ per_cpu(current_vmcs, cpu) = NULL;
+- crash_disable_local_vmclear(cpu);
++
++ vmcs_clear(loaded_vmcs->vmcs);
++ if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched)
++ vmcs_clear(loaded_vmcs->shadow_vmcs);
++
+ list_del(&loaded_vmcs->loaded_vmcss_on_cpu_link);
+
+ /*
+- * we should ensure updating loaded_vmcs->loaded_vmcss_on_cpu_link
+- * is before setting loaded_vmcs->vcpu to -1 which is done in
+- * loaded_vmcs_init. Otherwise, other cpu can see vcpu = -1 fist
+- * then adds the vmcs into percpu list before it is deleted.
++ * Ensure all writes to loaded_vmcs, including deleting it from its
++ * current percpu list, complete before setting loaded_vmcs->vcpu to
++ * -1, otherwise a different cpu can see vcpu == -1 first and add
++ * loaded_vmcs to its percpu list before it's deleted from this cpu's
++ * list. Pairs with the smp_rmb() in vmx_vcpu_load_vmcs().
+ */
+ smp_wmb();
+
+- loaded_vmcs_init(loaded_vmcs);
+- crash_enable_local_vmclear(cpu);
++ loaded_vmcs->cpu = -1;
++ loaded_vmcs->launched = 0;
+ }
+
+ static void loaded_vmcs_clear(struct loaded_vmcs *loaded_vmcs)
+@@ -3067,18 +3044,17 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+ if (!already_loaded) {
+ loaded_vmcs_clear(vmx->loaded_vmcs);
+ local_irq_disable();
+- crash_disable_local_vmclear(cpu);
+
+ /*
+- * Read loaded_vmcs->cpu should be before fetching
+- * loaded_vmcs->loaded_vmcss_on_cpu_link.
+- * See the comments in __loaded_vmcs_clear().
++ * Ensure loaded_vmcs->cpu is read before adding loaded_vmcs to
++ * this cpu's percpu list, otherwise it may not yet be deleted
++ * from its previous cpu's percpu list. Pairs with the
++ * smb_wmb() in __loaded_vmcs_clear().
+ */
+ smp_rmb();
+
+ list_add(&vmx->loaded_vmcs->loaded_vmcss_on_cpu_link,
+ &per_cpu(loaded_vmcss_on_cpu, cpu));
+- crash_enable_local_vmclear(cpu);
+ local_irq_enable();
+ }
+
+@@ -4422,21 +4398,6 @@ static int hardware_enable(void)
+ !hv_get_vp_assist_page(cpu))
+ return -EFAULT;
+
+- INIT_LIST_HEAD(&per_cpu(loaded_vmcss_on_cpu, cpu));
+- INIT_LIST_HEAD(&per_cpu(blocked_vcpu_on_cpu, cpu));
+- spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+-
+- /*
+- * Now we can enable the vmclear operation in kdump
+- * since the loaded_vmcss_on_cpu list on this cpu
+- * has been initialized.
+- *
+- * Though the cpu is not in VMX operation now, there
+- * is no problem to enable the vmclear operation
+- * for the loaded_vmcss_on_cpu list is empty!
+- */
+- crash_enable_local_vmclear(cpu);
+-
+ rdmsrl(MSR_IA32_FEATURE_CONTROL, old);
+
+ test_bits = FEATURE_CONTROL_LOCKED;
+@@ -6954,8 +6915,13 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+
+ static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu)
+ {
+- return (!to_vmx(vcpu)->nested.nested_run_pending &&
+- vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_IF) &&
++ if (to_vmx(vcpu)->nested.nested_run_pending)
++ return false;
++
++ if (is_guest_mode(vcpu) && nested_exit_on_intr(vcpu))
++ return true;
++
++ return (vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_IF) &&
+ !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+ (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS));
+ }
+@@ -11016,6 +10982,10 @@ STACK_FRAME_NON_STANDARD(vmx_vcpu_run);
+ static struct kvm *vmx_vm_alloc(void)
+ {
+ struct kvm_vmx *kvm_vmx = vzalloc(sizeof(struct kvm_vmx));
++
++ if (!kvm_vmx)
++ return NULL;
++
+ return &kvm_vmx->kvm;
+ }
+
+@@ -12990,7 +12960,7 @@ static void vmcs12_save_pending_event(struct kvm_vcpu *vcpu,
+ }
+ }
+
+-static int vmx_check_nested_events(struct kvm_vcpu *vcpu, bool external_intr)
++static int vmx_check_nested_events(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
+ unsigned long exit_qual;
+@@ -13028,8 +12998,7 @@ static int vmx_check_nested_events(struct kvm_vcpu *vcpu, bool external_intr)
+ return 0;
+ }
+
+- if ((kvm_cpu_has_interrupt(vcpu) || external_intr) &&
+- nested_exit_on_intr(vcpu)) {
++ if (kvm_cpu_has_interrupt(vcpu) && nested_exit_on_intr(vcpu)) {
+ if (block_nested_events)
+ return -EBUSY;
+ nested_vmx_vmexit(vcpu, EXIT_REASON_EXTERNAL_INTERRUPT, 0, 0);
+@@ -13607,17 +13576,8 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+ vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
+
+ if (likely(!vmx->fail)) {
+- /*
+- * TODO: SDM says that with acknowledge interrupt on
+- * exit, bit 31 of the VM-exit interrupt information
+- * (valid interrupt) is always set to 1 on
+- * EXIT_REASON_EXTERNAL_INTERRUPT, so we shouldn't
+- * need kvm_cpu_has_interrupt(). See the commit
+- * message for details.
+- */
+- if (nested_exit_intr_ack_set(vcpu) &&
+- exit_reason == EXIT_REASON_EXTERNAL_INTERRUPT &&
+- kvm_cpu_has_interrupt(vcpu)) {
++ if (exit_reason == EXIT_REASON_EXTERNAL_INTERRUPT &&
++ nested_exit_intr_ack_set(vcpu)) {
+ int irq = kvm_cpu_get_interrupt(vcpu);
+ WARN_ON(irq < 0);
+ vmcs12->vm_exit_intr_info = irq |
+@@ -14590,7 +14550,7 @@ module_exit(vmx_exit);
+
+ static int __init vmx_init(void)
+ {
+- int r;
++ int r, cpu;
+
+ #if IS_ENABLED(CONFIG_HYPERV)
+ /*
+@@ -14641,6 +14601,12 @@ static int __init vmx_init(void)
+ }
+ }
+
++ for_each_possible_cpu(cpu) {
++ INIT_LIST_HEAD(&per_cpu(loaded_vmcss_on_cpu, cpu));
++ INIT_LIST_HEAD(&per_cpu(blocked_vcpu_on_cpu, cpu));
++ spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
++ }
++
+ #ifdef CONFIG_KEXEC_CORE
+ rcu_assign_pointer(crash_vmclear_loaded_vmcss,
+ crash_vmclear_local_loaded_vmcss);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 2cb379e261c0..1a6e1aa2fb29 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -7124,7 +7124,7 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu)
+ kvm_x86_ops->update_cr8_intercept(vcpu, tpr, max_irr);
+ }
+
+-static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win)
++static int inject_pending_event(struct kvm_vcpu *vcpu)
+ {
+ int r;
+
+@@ -7160,7 +7160,7 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win)
+ * from L2 to L1.
+ */
+ if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events) {
+- r = kvm_x86_ops->check_nested_events(vcpu, req_int_win);
++ r = kvm_x86_ops->check_nested_events(vcpu);
+ if (r != 0)
+ return r;
+ }
+@@ -7210,7 +7210,7 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win)
+ * KVM_REQ_EVENT only on certain events and not unconditionally?
+ */
+ if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events) {
+- r = kvm_x86_ops->check_nested_events(vcpu, req_int_win);
++ r = kvm_x86_ops->check_nested_events(vcpu);
+ if (r != 0)
+ return r;
+ }
+@@ -7683,7 +7683,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ goto out;
+ }
+
+- if (inject_pending_event(vcpu, req_int_win) != 0)
++ if (inject_pending_event(vcpu) != 0)
+ req_immediate_exit = true;
+ else {
+ /* Enable SMI/NMI/IRQ window open exits if needed.
+@@ -7894,7 +7894,7 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
+ static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
+ {
+ if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events)
+- kvm_x86_ops->check_nested_events(vcpu, false);
++ kvm_x86_ops->check_nested_events(vcpu);
+
+ return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
+ !vcpu->arch.apf.halted);
+@@ -9229,6 +9229,13 @@ int kvm_arch_create_memslot(struct kvm *kvm, struct kvm_memory_slot *slot,
+ {
+ int i;
+
++ /*
++ * Clear out the previous array pointers for the KVM_MR_MOVE case. The
++ * old arrays will be freed by __kvm_set_memory_region() if installing
++ * the new memslot is successful.
++ */
++ memset(&slot->arch, 0, sizeof(slot->arch));
++
+ for (i = 0; i < KVM_NR_PAGE_SIZES; ++i) {
+ struct kvm_lpage_info *linfo;
+ unsigned long ugfn;
+@@ -9303,6 +9310,10 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
+ const struct kvm_userspace_memory_region *mem,
+ enum kvm_mr_change change)
+ {
++ if (change == KVM_MR_MOVE)
++ return kvm_arch_create_memslot(kvm, memslot,
++ mem->memory_size >> PAGE_SHIFT);
++
+ return 0;
+ }
+
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index 2a9a703ef4a0..52dd59af873e 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -833,7 +833,7 @@ efi_thunk_set_variable(efi_char16_t *name, efi_guid_t *vendor,
+ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_data = virt_to_phys_or_null_size(data, data_size);
+
+- if (!phys_name || !phys_data)
++ if (!phys_name || (data && !phys_data))
+ status = EFI_INVALID_PARAMETER;
+ else
+ status = efi_thunk(set_variable, phys_name, phys_vendor,
+@@ -864,7 +864,7 @@ efi_thunk_set_variable_nonblocking(efi_char16_t *name, efi_guid_t *vendor,
+ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_data = virt_to_phys_or_null_size(data, data_size);
+
+- if (!phys_name || !phys_data)
++ if (!phys_name || (data && !phys_data))
+ status = EFI_INVALID_PARAMETER;
+ else
+ status = efi_thunk(set_variable, phys_name, phys_vendor,
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 66b1ebc21ce4..5198ed1b3669 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -5156,20 +5156,28 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)
+ return bfqq;
+ }
+
+-static void bfq_idle_slice_timer_body(struct bfq_queue *bfqq)
++static void
++bfq_idle_slice_timer_body(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+ {
+- struct bfq_data *bfqd = bfqq->bfqd;
+ enum bfqq_expiration reason;
+ unsigned long flags;
+
+ spin_lock_irqsave(&bfqd->lock, flags);
+- bfq_clear_bfqq_wait_request(bfqq);
+
++ /*
++ * Considering that bfqq may be in race, we should firstly check
++ * whether bfqq is in service before doing something on it. If
++ * the bfqq in race is not in service, it has already been expired
++ * through __bfq_bfqq_expire func and its wait_request flags has
++ * been cleared in __bfq_bfqd_reset_in_service func.
++ */
+ if (bfqq != bfqd->in_service_queue) {
+ spin_unlock_irqrestore(&bfqd->lock, flags);
+ return;
+ }
+
++ bfq_clear_bfqq_wait_request(bfqq);
++
+ if (bfq_bfqq_budget_timeout(bfqq))
+ /*
+ * Also here the queue can be safely expired
+@@ -5214,7 +5222,7 @@ static enum hrtimer_restart bfq_idle_slice_timer(struct hrtimer *timer)
+ * early.
+ */
+ if (bfqq)
+- bfq_idle_slice_timer_body(bfqq);
++ bfq_idle_slice_timer_body(bfqd, bfqq);
+
+ return HRTIMER_NORESTART;
+ }
+diff --git a/block/blk-ioc.c b/block/blk-ioc.c
+index 01580f88fcb3..4c810969c3e2 100644
+--- a/block/blk-ioc.c
++++ b/block/blk-ioc.c
+@@ -87,6 +87,7 @@ static void ioc_destroy_icq(struct io_cq *icq)
+ * making it impossible to determine icq_cache. Record it in @icq.
+ */
+ icq->__rcu_icq_cache = et->icq_cache;
++ icq->flags |= ICQ_DESTROYED;
+ call_rcu(&icq->__rcu_head, icq_free_icq_rcu);
+ }
+
+@@ -230,15 +231,21 @@ static void __ioc_clear_queue(struct list_head *icq_list)
+ {
+ unsigned long flags;
+
++ rcu_read_lock();
+ while (!list_empty(icq_list)) {
+ struct io_cq *icq = list_entry(icq_list->next,
+ struct io_cq, q_node);
+ struct io_context *ioc = icq->ioc;
+
+ spin_lock_irqsave(&ioc->lock, flags);
++ if (icq->flags & ICQ_DESTROYED) {
++ spin_unlock_irqrestore(&ioc->lock, flags);
++ continue;
++ }
+ ioc_destroy_icq(icq);
+ spin_unlock_irqrestore(&ioc->lock, flags);
+ }
++ rcu_read_unlock();
+ }
+
+ /**
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index be9b39caadbd..01093b8f3e62 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -717,6 +717,9 @@ void disk_stack_limits(struct gendisk *disk, struct block_device *bdev,
+ printk(KERN_NOTICE "%s: Warning: Device %s is misaligned\n",
+ top, bottom);
+ }
++
++ t->backing_dev_info->io_pages =
++ t->limits.max_sectors >> (PAGE_SHIFT - 9);
+ }
+ EXPORT_SYMBOL(disk_stack_limits);
+
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 2ae1799f4992..51eeaea65833 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -764,6 +764,7 @@ static int sata_pmp_eh_recover_pmp(struct ata_port *ap,
+
+ if (dev->flags & ATA_DFLAG_DETACH) {
+ detach = 1;
++ rc = -ENODEV;
+ goto fail;
+ }
+
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 3a64fa4aaf7e..0c1572a1cc5e 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -4570,22 +4570,19 @@ int ata_scsi_add_hosts(struct ata_host *host, struct scsi_host_template *sht)
+ */
+ shost->max_host_blocked = 1;
+
+- rc = scsi_add_host_with_dma(ap->scsi_host,
+- &ap->tdev, ap->host->dev);
++ rc = scsi_add_host_with_dma(shost, &ap->tdev, ap->host->dev);
+ if (rc)
+- goto err_add;
++ goto err_alloc;
+ }
+
+ return 0;
+
+- err_add:
+- scsi_host_put(host->ports[i]->scsi_host);
+ err_alloc:
+ while (--i >= 0) {
+ struct Scsi_Host *shost = host->ports[i]->scsi_host;
+
++ /* scsi_host_put() is in ata_devres_release() */
+ scsi_remove_host(shost);
+- scsi_host_put(shost);
+ }
+ return rc;
+ }
+diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
+index 818d8c37d70a..3b7b748c4d4f 100644
+--- a/drivers/base/firmware_loader/fallback.c
++++ b/drivers/base/firmware_loader/fallback.c
+@@ -572,7 +572,7 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs,
+ }
+
+ retval = fw_sysfs_wait_timeout(fw_priv, timeout);
+- if (retval < 0) {
++ if (retval < 0 && retval != -ENOENT) {
+ mutex_lock(&fw_lock);
+ fw_load_abort(fw_sysfs);
+ mutex_unlock(&fw_lock);
+diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
+index c5c0b7c89481..d2d7dc9cd58d 100644
+--- a/drivers/block/null_blk_main.c
++++ b/drivers/block/null_blk_main.c
+@@ -571,6 +571,7 @@ static struct nullb_cmd *__alloc_cmd(struct nullb_queue *nq)
+ if (tag != -1U) {
+ cmd = &nq->cmds[tag];
+ cmd->tag = tag;
++ cmd->error = BLK_STS_OK;
+ cmd->nq = nq;
+ if (nq->dev->irqmode == NULL_IRQ_TIMER) {
+ hrtimer_init(&cmd->timer, CLOCK_MONOTONIC,
+@@ -1433,6 +1434,7 @@ static blk_status_t null_queue_rq(struct blk_mq_hw_ctx *hctx,
+ cmd->timer.function = null_cmd_timer_expired;
+ }
+ cmd->rq = bd->rq;
++ cmd->error = BLK_STS_OK;
+ cmd->nq = nq;
+
+ blk_mq_start_request(bd->rq);
+@@ -1480,7 +1482,12 @@ static void cleanup_queues(struct nullb *nullb)
+
+ static void null_del_dev(struct nullb *nullb)
+ {
+- struct nullb_device *dev = nullb->dev;
++ struct nullb_device *dev;
++
++ if (!nullb)
++ return;
++
++ dev = nullb->dev;
+
+ ida_simple_remove(&nullb_indexes, nullb->index);
+
+@@ -1844,6 +1851,7 @@ out_cleanup_queues:
+ cleanup_queues(nullb);
+ out_free_nullb:
+ kfree(nullb);
++ dev->nullb = NULL;
+ out:
+ return rv;
+ }
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 9a57af79f330..adc0e3ed01c2 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -47,6 +47,7 @@
+ #include <linux/bitmap.h>
+ #include <linux/list.h>
+ #include <linux/workqueue.h>
++#include <linux/sched/mm.h>
+
+ #include <xen/xen.h>
+ #include <xen/xenbus.h>
+@@ -2188,10 +2189,12 @@ static void blkfront_setup_discard(struct blkfront_info *info)
+
+ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo)
+ {
+- unsigned int psegs, grants;
++ unsigned int psegs, grants, memflags;
+ int err, i;
+ struct blkfront_info *info = rinfo->dev_info;
+
++ memflags = memalloc_noio_save();
++
+ if (info->max_indirect_segments == 0) {
+ if (!HAS_EXTRA_REQ)
+ grants = BLKIF_MAX_SEGMENTS_PER_REQUEST;
+@@ -2223,7 +2226,7 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo)
+
+ BUG_ON(!list_empty(&rinfo->indirect_pages));
+ for (i = 0; i < num; i++) {
+- struct page *indirect_page = alloc_page(GFP_NOIO);
++ struct page *indirect_page = alloc_page(GFP_KERNEL);
+ if (!indirect_page)
+ goto out_of_memory;
+ list_add(&indirect_page->lru, &rinfo->indirect_pages);
+@@ -2234,15 +2237,15 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo)
+ rinfo->shadow[i].grants_used =
+ kvcalloc(grants,
+ sizeof(rinfo->shadow[i].grants_used[0]),
+- GFP_NOIO);
++ GFP_KERNEL);
+ rinfo->shadow[i].sg = kvcalloc(psegs,
+ sizeof(rinfo->shadow[i].sg[0]),
+- GFP_NOIO);
++ GFP_KERNEL);
+ if (info->max_indirect_segments)
+ rinfo->shadow[i].indirect_grants =
+ kvcalloc(INDIRECT_GREFS(grants),
+ sizeof(rinfo->shadow[i].indirect_grants[0]),
+- GFP_NOIO);
++ GFP_KERNEL);
+ if ((rinfo->shadow[i].grants_used == NULL) ||
+ (rinfo->shadow[i].sg == NULL) ||
+ (info->max_indirect_segments &&
+@@ -2251,6 +2254,7 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo)
+ sg_init_table(rinfo->shadow[i].sg, psegs);
+ }
+
++ memalloc_noio_restore(memflags);
+
+ return 0;
+
+@@ -2270,6 +2274,9 @@ out_of_memory:
+ __free_page(indirect_page);
+ }
+ }
++
++ memalloc_noio_restore(memflags);
++
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
+index 1b76d9585902..2ca2cc56bcef 100644
+--- a/drivers/bus/sunxi-rsb.c
++++ b/drivers/bus/sunxi-rsb.c
+@@ -345,7 +345,7 @@ static int sunxi_rsb_read(struct sunxi_rsb *rsb, u8 rtaddr, u8 addr,
+ if (ret)
+ goto unlock;
+
+- *buf = readl(rsb->regs + RSB_DATA);
++ *buf = readl(rsb->regs + RSB_DATA) & GENMASK(len * 8 - 1, 0);
+
+ unlock:
+ mutex_unlock(&rsb->lock);
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 980eb7c60952..69734b1df792 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -3134,8 +3134,8 @@ static void __get_guid(struct ipmi_smi *intf)
+ if (rv)
+ /* Send failed, no GUID available. */
+ bmc->dyn_guid_set = 0;
+-
+- wait_event(intf->waitq, bmc->dyn_guid_set != 2);
++ else
++ wait_event(intf->waitq, bmc->dyn_guid_set != 2);
+
+ /* dyn_guid_set makes the guid data available. */
+ smp_rmb();
+diff --git a/drivers/char/tpm/eventlog/common.c b/drivers/char/tpm/eventlog/common.c
+index 5a8720df2b51..7d70b654df04 100644
+--- a/drivers/char/tpm/eventlog/common.c
++++ b/drivers/char/tpm/eventlog/common.c
+@@ -104,11 +104,8 @@ static int tpm_read_log(struct tpm_chip *chip)
+ *
+ * If an event log is found then the securityfs files are setup to
+ * export it to userspace, otherwise nothing is done.
+- *
+- * Returns -ENODEV if the firmware has no event log or securityfs is not
+- * supported.
+ */
+-int tpm_bios_log_setup(struct tpm_chip *chip)
++void tpm_bios_log_setup(struct tpm_chip *chip)
+ {
+ const char *name = dev_name(&chip->dev);
+ unsigned int cnt;
+@@ -117,7 +114,7 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
+
+ rc = tpm_read_log(chip);
+ if (rc < 0)
+- return rc;
++ return;
+ log_version = rc;
+
+ cnt = 0;
+@@ -163,13 +160,12 @@ int tpm_bios_log_setup(struct tpm_chip *chip)
+ cnt++;
+ }
+
+- return 0;
++ return;
+
+ err:
+- rc = PTR_ERR(chip->bios_dir[cnt]);
+ chip->bios_dir[cnt] = NULL;
+ tpm_bios_log_teardown(chip);
+- return rc;
++ return;
+ }
+
+ void tpm_bios_log_teardown(struct tpm_chip *chip)
+diff --git a/drivers/char/tpm/eventlog/tpm1.c b/drivers/char/tpm/eventlog/tpm1.c
+index 58c84784ba25..a4621c83e2bf 100644
+--- a/drivers/char/tpm/eventlog/tpm1.c
++++ b/drivers/char/tpm/eventlog/tpm1.c
+@@ -129,6 +129,7 @@ static void *tpm1_bios_measurements_next(struct seq_file *m, void *v,
+ u32 converted_event_size;
+ u32 converted_event_type;
+
++ (*pos)++;
+ converted_event_size = do_endian_conversion(event->event_size);
+
+ v += sizeof(struct tcpa_event) + converted_event_size;
+@@ -146,7 +147,6 @@ static void *tpm1_bios_measurements_next(struct seq_file *m, void *v,
+ ((v + sizeof(struct tcpa_event) + converted_event_size) >= limit))
+ return NULL;
+
+- (*pos)++;
+ return v;
+ }
+
+diff --git a/drivers/char/tpm/eventlog/tpm2.c b/drivers/char/tpm/eventlog/tpm2.c
+index 41b9f6c92da7..aec49c925cee 100644
+--- a/drivers/char/tpm/eventlog/tpm2.c
++++ b/drivers/char/tpm/eventlog/tpm2.c
+@@ -143,6 +143,7 @@ static void *tpm2_bios_measurements_next(struct seq_file *m, void *v,
+ size_t event_size;
+ void *marker;
+
++ (*pos)++;
+ event_header = log->bios_event_log;
+
+ if (v == SEQ_START_TOKEN) {
+@@ -167,7 +168,6 @@ static void *tpm2_bios_measurements_next(struct seq_file *m, void *v,
+ if (((v + event_size) >= limit) || (event_size == 0))
+ return NULL;
+
+- (*pos)++;
+ return v;
+ }
+
+diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
+index 0b01eb7b14e5..4946c5b37d04 100644
+--- a/drivers/char/tpm/tpm-chip.c
++++ b/drivers/char/tpm/tpm-chip.c
+@@ -463,9 +463,7 @@ int tpm_chip_register(struct tpm_chip *chip)
+
+ tpm_sysfs_add_device(chip);
+
+- rc = tpm_bios_log_setup(chip);
+- if (rc != 0 && rc != -ENODEV)
+- return rc;
++ tpm_bios_log_setup(chip);
+
+ tpm_add_ppi(chip);
+
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index f3501d05264f..289221d653cb 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -602,6 +602,6 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc,
+ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space,
+ u32 cc, u8 *buf, size_t *bufsiz);
+
+-int tpm_bios_log_setup(struct tpm_chip *chip);
++void tpm_bios_log_setup(struct tpm_chip *chip);
+ void tpm_bios_log_teardown(struct tpm_chip *chip);
+ #endif
+diff --git a/drivers/clk/ingenic/jz4770-cgu.c b/drivers/clk/ingenic/jz4770-cgu.c
+index bf46a0df2004..e3057bb5ffd8 100644
+--- a/drivers/clk/ingenic/jz4770-cgu.c
++++ b/drivers/clk/ingenic/jz4770-cgu.c
+@@ -436,8 +436,10 @@ static void __init jz4770_cgu_init(struct device_node *np)
+
+ cgu = ingenic_cgu_new(jz4770_cgu_clocks,
+ ARRAY_SIZE(jz4770_cgu_clocks), np);
+- if (!cgu)
++ if (!cgu) {
+ pr_err("%s: failed to initialise CGU\n", __func__);
++ return;
++ }
+
+ retval = ingenic_cgu_register_clocks(cgu);
+ if (retval)
+diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
+index d8c3595e9023..a0cbbdfc7735 100644
+--- a/drivers/cpufreq/imx6q-cpufreq.c
++++ b/drivers/cpufreq/imx6q-cpufreq.c
+@@ -310,6 +310,9 @@ static int imx6ul_opp_check_speed_grading(struct device *dev)
+ void __iomem *base;
+
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-ocotp");
++ if (!np)
++ np = of_find_compatible_node(NULL, NULL,
++ "fsl,imx6ull-ocotp");
+ if (!np)
+ return -ENOENT;
+
+diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
+index 5fff39dae625..687c92ef7644 100644
+--- a/drivers/cpufreq/powernv-cpufreq.c
++++ b/drivers/cpufreq/powernv-cpufreq.c
+@@ -1081,6 +1081,12 @@ free_and_return:
+
+ static inline void clean_chip_info(void)
+ {
++ int i;
++
++ /* flush any pending work items */
++ if (chips)
++ for (i = 0; i < nr_chips; i++)
++ cancel_work_sync(&chips[i].throttle);
+ kfree(chips);
+ }
+
+diff --git a/drivers/crypto/caam/caamalg_desc.c b/drivers/crypto/caam/caamalg_desc.c
+index edacf9b39b63..ceb033930535 100644
+--- a/drivers/crypto/caam/caamalg_desc.c
++++ b/drivers/crypto/caam/caamalg_desc.c
+@@ -1457,7 +1457,13 @@ EXPORT_SYMBOL(cnstr_shdsc_ablkcipher_givencap);
+ */
+ void cnstr_shdsc_xts_ablkcipher_encap(u32 * const desc, struct alginfo *cdata)
+ {
+- __be64 sector_size = cpu_to_be64(512);
++ /*
++ * Set sector size to a big value, practically disabling
++ * sector size segmentation in xts implementation. We cannot
++ * take full advantage of this HW feature with existing
++ * crypto API / dm-crypt SW architecture.
++ */
++ __be64 sector_size = cpu_to_be64(BIT(15));
+ u32 *key_jump_cmd;
+
+ init_sh_desc(desc, HDR_SHARE_SERIAL | HDR_SAVECTX);
+@@ -1509,7 +1515,13 @@ EXPORT_SYMBOL(cnstr_shdsc_xts_ablkcipher_encap);
+ */
+ void cnstr_shdsc_xts_ablkcipher_decap(u32 * const desc, struct alginfo *cdata)
+ {
+- __be64 sector_size = cpu_to_be64(512);
++ /*
++ * Set sector size to a big value, practically disabling
++ * sector size segmentation in xts implementation. We cannot
++ * take full advantage of this HW feature with existing
++ * crypto API / dm-crypt SW architecture.
++ */
++ __be64 sector_size = cpu_to_be64(BIT(15));
+ u32 *key_jump_cmd;
+
+ init_sh_desc(desc, HDR_SHARE_SERIAL | HDR_SAVECTX);
+diff --git a/drivers/crypto/ccree/cc_aead.c b/drivers/crypto/ccree/cc_aead.c
+index aa6b45bc13b9..57aac15a335f 100644
+--- a/drivers/crypto/ccree/cc_aead.c
++++ b/drivers/crypto/ccree/cc_aead.c
+@@ -731,7 +731,7 @@ static void cc_set_assoc_desc(struct aead_request *areq, unsigned int flow_mode,
+ dev_dbg(dev, "ASSOC buffer type DLLI\n");
+ hw_desc_init(&desc[idx]);
+ set_din_type(&desc[idx], DMA_DLLI, sg_dma_address(areq->src),
+- areq->assoclen, NS_BIT);
++ areq_ctx->assoclen, NS_BIT);
+ set_flow_mode(&desc[idx], flow_mode);
+ if (ctx->auth_mode == DRV_HASH_XCBC_MAC &&
+ areq_ctx->cryptlen > 0)
+@@ -1080,9 +1080,11 @@ static void cc_proc_header_desc(struct aead_request *req,
+ struct cc_hw_desc desc[],
+ unsigned int *seq_size)
+ {
++ struct aead_req_ctx *areq_ctx = aead_request_ctx(req);
+ unsigned int idx = *seq_size;
++
+ /* Hash associated data */
+- if (req->assoclen > 0)
++ if (areq_ctx->assoclen > 0)
+ cc_set_assoc_desc(req, DIN_HASH, desc, &idx);
+
+ /* Hash IV */
+@@ -1310,7 +1312,7 @@ static int validate_data_size(struct cc_aead_ctx *ctx,
+ {
+ struct aead_req_ctx *areq_ctx = aead_request_ctx(req);
+ struct device *dev = drvdata_to_dev(ctx->drvdata);
+- unsigned int assoclen = req->assoclen;
++ unsigned int assoclen = areq_ctx->assoclen;
+ unsigned int cipherlen = (direct == DRV_CRYPTO_DIRECTION_DECRYPT) ?
+ (req->cryptlen - ctx->authsize) : req->cryptlen;
+
+@@ -1469,7 +1471,7 @@ static int cc_ccm(struct aead_request *req, struct cc_hw_desc desc[],
+ idx++;
+
+ /* process assoc data */
+- if (req->assoclen > 0) {
++ if (req_ctx->assoclen > 0) {
+ cc_set_assoc_desc(req, DIN_HASH, desc, &idx);
+ } else {
+ hw_desc_init(&desc[idx]);
+@@ -1561,7 +1563,7 @@ static int config_ccm_adata(struct aead_request *req)
+ * NIST Special Publication 800-38C
+ */
+ *b0 |= (8 * ((m - 2) / 2));
+- if (req->assoclen > 0)
++ if (req_ctx->assoclen > 0)
+ *b0 |= 64; /* Enable bit 6 if Adata exists. */
+
+ rc = set_msg_len(b0 + 16 - l, cryptlen, l); /* Write L'. */
+@@ -1572,7 +1574,7 @@ static int config_ccm_adata(struct aead_request *req)
+ /* END of "taken from crypto/ccm.c" */
+
+ /* l(a) - size of associated data. */
+- req_ctx->ccm_hdr_size = format_ccm_a0(a0, req->assoclen);
++ req_ctx->ccm_hdr_size = format_ccm_a0(a0, req_ctx->assoclen);
+
+ memset(req->iv + 15 - req->iv[0], 0, req->iv[0] + 1);
+ req->iv[15] = 1;
+@@ -1604,7 +1606,7 @@ static void cc_proc_rfc4309_ccm(struct aead_request *req)
+ memcpy(areq_ctx->ctr_iv + CCM_BLOCK_IV_OFFSET, req->iv,
+ CCM_BLOCK_IV_SIZE);
+ req->iv = areq_ctx->ctr_iv;
+- req->assoclen -= CCM_BLOCK_IV_SIZE;
++ areq_ctx->assoclen -= CCM_BLOCK_IV_SIZE;
+ }
+
+ static void cc_set_ghash_desc(struct aead_request *req,
+@@ -1812,7 +1814,7 @@ static int cc_gcm(struct aead_request *req, struct cc_hw_desc desc[],
+ // for gcm and rfc4106.
+ cc_set_ghash_desc(req, desc, seq_size);
+ /* process(ghash) assoc data */
+- if (req->assoclen > 0)
++ if (req_ctx->assoclen > 0)
+ cc_set_assoc_desc(req, DIN_HASH, desc, seq_size);
+ cc_set_gctr_desc(req, desc, seq_size);
+ /* process(gctr+ghash) */
+@@ -1836,8 +1838,8 @@ static int config_gcm_context(struct aead_request *req)
+ (req->cryptlen - ctx->authsize);
+ __be32 counter = cpu_to_be32(2);
+
+- dev_dbg(dev, "%s() cryptlen = %d, req->assoclen = %d ctx->authsize = %d\n",
+- __func__, cryptlen, req->assoclen, ctx->authsize);
++ dev_dbg(dev, "%s() cryptlen = %d, req_ctx->assoclen = %d ctx->authsize = %d\n",
++ __func__, cryptlen, req_ctx->assoclen, ctx->authsize);
+
+ memset(req_ctx->hkey, 0, AES_BLOCK_SIZE);
+
+@@ -1853,7 +1855,7 @@ static int config_gcm_context(struct aead_request *req)
+ if (!req_ctx->plaintext_authenticate_only) {
+ __be64 temp64;
+
+- temp64 = cpu_to_be64(req->assoclen * 8);
++ temp64 = cpu_to_be64(req_ctx->assoclen * 8);
+ memcpy(&req_ctx->gcm_len_block.len_a, &temp64, sizeof(temp64));
+ temp64 = cpu_to_be64(cryptlen * 8);
+ memcpy(&req_ctx->gcm_len_block.len_c, &temp64, 8);
+@@ -1863,8 +1865,8 @@ static int config_gcm_context(struct aead_request *req)
+ */
+ __be64 temp64;
+
+- temp64 = cpu_to_be64((req->assoclen + GCM_BLOCK_RFC4_IV_SIZE +
+- cryptlen) * 8);
++ temp64 = cpu_to_be64((req_ctx->assoclen +
++ GCM_BLOCK_RFC4_IV_SIZE + cryptlen) * 8);
+ memcpy(&req_ctx->gcm_len_block.len_a, &temp64, sizeof(temp64));
+ temp64 = 0;
+ memcpy(&req_ctx->gcm_len_block.len_c, &temp64, 8);
+@@ -1884,7 +1886,7 @@ static void cc_proc_rfc4_gcm(struct aead_request *req)
+ memcpy(areq_ctx->ctr_iv + GCM_BLOCK_RFC4_IV_OFFSET, req->iv,
+ GCM_BLOCK_RFC4_IV_SIZE);
+ req->iv = areq_ctx->ctr_iv;
+- req->assoclen -= GCM_BLOCK_RFC4_IV_SIZE;
++ areq_ctx->assoclen -= GCM_BLOCK_RFC4_IV_SIZE;
+ }
+
+ static int cc_proc_aead(struct aead_request *req,
+@@ -1909,7 +1911,7 @@ static int cc_proc_aead(struct aead_request *req,
+ /* Check data length according to mode */
+ if (validate_data_size(ctx, direct, req)) {
+ dev_err(dev, "Unsupported crypt/assoc len %d/%d.\n",
+- req->cryptlen, req->assoclen);
++ req->cryptlen, areq_ctx->assoclen);
+ crypto_aead_set_flags(tfm, CRYPTO_TFM_RES_BAD_BLOCK_LEN);
+ return -EINVAL;
+ }
+@@ -2058,8 +2060,11 @@ static int cc_aead_encrypt(struct aead_request *req)
+ struct aead_req_ctx *areq_ctx = aead_request_ctx(req);
+ int rc;
+
++ memset(areq_ctx, 0, sizeof(*areq_ctx));
++
+ /* No generated IV required */
+ areq_ctx->backup_iv = req->iv;
++ areq_ctx->assoclen = req->assoclen;
+ areq_ctx->backup_giv = NULL;
+ areq_ctx->is_gcm4543 = false;
+
+@@ -2087,8 +2092,11 @@ static int cc_rfc4309_ccm_encrypt(struct aead_request *req)
+ goto out;
+ }
+
++ memset(areq_ctx, 0, sizeof(*areq_ctx));
++
+ /* No generated IV required */
+ areq_ctx->backup_iv = req->iv;
++ areq_ctx->assoclen = req->assoclen;
+ areq_ctx->backup_giv = NULL;
+ areq_ctx->is_gcm4543 = true;
+
+@@ -2106,8 +2114,11 @@ static int cc_aead_decrypt(struct aead_request *req)
+ struct aead_req_ctx *areq_ctx = aead_request_ctx(req);
+ int rc;
+
++ memset(areq_ctx, 0, sizeof(*areq_ctx));
++
+ /* No generated IV required */
+ areq_ctx->backup_iv = req->iv;
++ areq_ctx->assoclen = req->assoclen;
+ areq_ctx->backup_giv = NULL;
+ areq_ctx->is_gcm4543 = false;
+
+@@ -2133,8 +2144,11 @@ static int cc_rfc4309_ccm_decrypt(struct aead_request *req)
+ goto out;
+ }
+
++ memset(areq_ctx, 0, sizeof(*areq_ctx));
++
+ /* No generated IV required */
+ areq_ctx->backup_iv = req->iv;
++ areq_ctx->assoclen = req->assoclen;
+ areq_ctx->backup_giv = NULL;
+
+ areq_ctx->is_gcm4543 = true;
+@@ -2250,8 +2264,11 @@ static int cc_rfc4106_gcm_encrypt(struct aead_request *req)
+ goto out;
+ }
+
++ memset(areq_ctx, 0, sizeof(*areq_ctx));
++
+ /* No generated IV required */
+ areq_ctx->backup_iv = req->iv;
++ areq_ctx->assoclen = req->assoclen;
+ areq_ctx->backup_giv = NULL;
+
+ areq_ctx->plaintext_authenticate_only = false;
+@@ -2273,11 +2290,14 @@ static int cc_rfc4543_gcm_encrypt(struct aead_request *req)
+ struct aead_req_ctx *areq_ctx = aead_request_ctx(req);
+ int rc;
+
++ memset(areq_ctx, 0, sizeof(*areq_ctx));
++
+ //plaintext is not encryped with rfc4543
+ areq_ctx->plaintext_authenticate_only = true;
+
+ /* No generated IV required */
+ areq_ctx->backup_iv = req->iv;
++ areq_ctx->assoclen = req->assoclen;
+ areq_ctx->backup_giv = NULL;
+
+ cc_proc_rfc4_gcm(req);
+@@ -2305,8 +2325,11 @@ static int cc_rfc4106_gcm_decrypt(struct aead_request *req)
+ goto out;
+ }
+
++ memset(areq_ctx, 0, sizeof(*areq_ctx));
++
+ /* No generated IV required */
+ areq_ctx->backup_iv = req->iv;
++ areq_ctx->assoclen = req->assoclen;
+ areq_ctx->backup_giv = NULL;
+
+ areq_ctx->plaintext_authenticate_only = false;
+@@ -2328,11 +2351,14 @@ static int cc_rfc4543_gcm_decrypt(struct aead_request *req)
+ struct aead_req_ctx *areq_ctx = aead_request_ctx(req);
+ int rc;
+
++ memset(areq_ctx, 0, sizeof(*areq_ctx));
++
+ //plaintext is not decryped with rfc4543
+ areq_ctx->plaintext_authenticate_only = true;
+
+ /* No generated IV required */
+ areq_ctx->backup_iv = req->iv;
++ areq_ctx->assoclen = req->assoclen;
+ areq_ctx->backup_giv = NULL;
+
+ cc_proc_rfc4_gcm(req);
+diff --git a/drivers/crypto/ccree/cc_aead.h b/drivers/crypto/ccree/cc_aead.h
+index 5edf3b351fa4..74bc99067f18 100644
+--- a/drivers/crypto/ccree/cc_aead.h
++++ b/drivers/crypto/ccree/cc_aead.h
+@@ -67,6 +67,7 @@ struct aead_req_ctx {
+ u8 backup_mac[MAX_MAC_SIZE];
+ u8 *backup_iv; /*store iv for generated IV flow*/
+ u8 *backup_giv; /*store iv for rfc3686(ctr) flow*/
++ u32 assoclen; /* internal assoclen */
+ dma_addr_t mac_buf_dma_addr; /* internal ICV DMA buffer */
+ /* buffer for internal ccm configurations */
+ dma_addr_t ccm_iv0_dma_addr;
+diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c
+index 90b4870078fb..630020255941 100644
+--- a/drivers/crypto/ccree/cc_buffer_mgr.c
++++ b/drivers/crypto/ccree/cc_buffer_mgr.c
+@@ -65,7 +65,7 @@ static void cc_copy_mac(struct device *dev, struct aead_request *req,
+ {
+ struct aead_req_ctx *areq_ctx = aead_request_ctx(req);
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+- u32 skip = req->assoclen + req->cryptlen;
++ u32 skip = areq_ctx->assoclen + req->cryptlen;
+
+ if (areq_ctx->is_gcm4543)
+ skip += crypto_aead_ivsize(tfm);
+@@ -460,10 +460,8 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx,
+ /* Map the src SGL */
+ rc = cc_map_sg(dev, src, nbytes, DMA_BIDIRECTIONAL, &req_ctx->in_nents,
+ LLI_MAX_NUM_OF_DATA_ENTRIES, &dummy, &mapped_nents);
+- if (rc) {
+- rc = -ENOMEM;
++ if (rc)
+ goto cipher_exit;
+- }
+ if (mapped_nents > 1)
+ req_ctx->dma_buf_type = CC_DMA_BUF_MLLI;
+
+@@ -477,12 +475,11 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx,
+ }
+ } else {
+ /* Map the dst sg */
+- if (cc_map_sg(dev, dst, nbytes, DMA_BIDIRECTIONAL,
+- &req_ctx->out_nents, LLI_MAX_NUM_OF_DATA_ENTRIES,
+- &dummy, &mapped_nents)) {
+- rc = -ENOMEM;
++ rc = cc_map_sg(dev, dst, nbytes, DMA_BIDIRECTIONAL,
++ &req_ctx->out_nents, LLI_MAX_NUM_OF_DATA_ENTRIES,
++ &dummy, &mapped_nents);
++ if (rc)
+ goto cipher_exit;
+- }
+ if (mapped_nents > 1)
+ req_ctx->dma_buf_type = CC_DMA_BUF_MLLI;
+
+@@ -577,8 +574,8 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req)
+
+ dev_dbg(dev, "Unmapping src sgl: req->src=%pK areq_ctx->src.nents=%u areq_ctx->assoc.nents=%u assoclen:%u cryptlen=%u\n",
+ sg_virt(req->src), areq_ctx->src.nents, areq_ctx->assoc.nents,
+- req->assoclen, req->cryptlen);
+- size_to_unmap = req->assoclen + req->cryptlen;
++ areq_ctx->assoclen, req->cryptlen);
++ size_to_unmap = areq_ctx->assoclen + req->cryptlen;
+ if (areq_ctx->gen_ctx.op_type == DRV_CRYPTO_DIRECTION_ENCRYPT)
+ size_to_unmap += areq_ctx->req_authsize;
+ if (areq_ctx->is_gcm4543)
+@@ -720,7 +717,7 @@ static int cc_aead_chain_assoc(struct cc_drvdata *drvdata,
+ struct scatterlist *current_sg = req->src;
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ unsigned int sg_index = 0;
+- u32 size_of_assoc = req->assoclen;
++ u32 size_of_assoc = areq_ctx->assoclen;
+ struct device *dev = drvdata_to_dev(drvdata);
+
+ if (areq_ctx->is_gcm4543)
+@@ -731,7 +728,7 @@ static int cc_aead_chain_assoc(struct cc_drvdata *drvdata,
+ goto chain_assoc_exit;
+ }
+
+- if (req->assoclen == 0) {
++ if (areq_ctx->assoclen == 0) {
+ areq_ctx->assoc_buff_type = CC_DMA_BUF_NULL;
+ areq_ctx->assoc.nents = 0;
+ areq_ctx->assoc.mlli_nents = 0;
+@@ -791,7 +788,7 @@ static int cc_aead_chain_assoc(struct cc_drvdata *drvdata,
+ cc_dma_buf_type(areq_ctx->assoc_buff_type),
+ areq_ctx->assoc.nents);
+ cc_add_sg_entry(dev, sg_data, areq_ctx->assoc.nents, req->src,
+- req->assoclen, 0, is_last,
++ areq_ctx->assoclen, 0, is_last,
+ &areq_ctx->assoc.mlli_nents);
+ areq_ctx->assoc_buff_type = CC_DMA_BUF_MLLI;
+ }
+@@ -975,11 +972,11 @@ static int cc_aead_chain_data(struct cc_drvdata *drvdata,
+ u32 src_mapped_nents = 0, dst_mapped_nents = 0;
+ u32 offset = 0;
+ /* non-inplace mode */
+- unsigned int size_for_map = req->assoclen + req->cryptlen;
++ unsigned int size_for_map = areq_ctx->assoclen + req->cryptlen;
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ u32 sg_index = 0;
+ bool is_gcm4543 = areq_ctx->is_gcm4543;
+- u32 size_to_skip = req->assoclen;
++ u32 size_to_skip = areq_ctx->assoclen;
+
+ if (is_gcm4543)
+ size_to_skip += crypto_aead_ivsize(tfm);
+@@ -1023,9 +1020,13 @@ static int cc_aead_chain_data(struct cc_drvdata *drvdata,
+ areq_ctx->src_offset = offset;
+
+ if (req->src != req->dst) {
+- size_for_map = req->assoclen + req->cryptlen;
+- size_for_map += (direct == DRV_CRYPTO_DIRECTION_ENCRYPT) ?
+- authsize : 0;
++ size_for_map = areq_ctx->assoclen + req->cryptlen;
++
++ if (direct == DRV_CRYPTO_DIRECTION_ENCRYPT)
++ size_for_map += authsize;
++ else
++ size_for_map -= authsize;
++
+ if (is_gcm4543)
+ size_for_map += crypto_aead_ivsize(tfm);
+
+@@ -1033,10 +1034,8 @@ static int cc_aead_chain_data(struct cc_drvdata *drvdata,
+ &areq_ctx->dst.nents,
+ LLI_MAX_NUM_OF_DATA_ENTRIES, &dst_last_bytes,
+ &dst_mapped_nents);
+- if (rc) {
+- rc = -ENOMEM;
++ if (rc)
+ goto chain_data_exit;
+- }
+ }
+
+ dst_mapped_nents = cc_get_sgl_nents(dev, req->dst, size_for_map,
+@@ -1190,11 +1189,10 @@ int cc_map_aead_request(struct cc_drvdata *drvdata, struct aead_request *req)
+ }
+ areq_ctx->ccm_iv0_dma_addr = dma_addr;
+
+- if (cc_set_aead_conf_buf(dev, areq_ctx, areq_ctx->ccm_config,
+- &sg_data, req->assoclen)) {
+- rc = -ENOMEM;
++ rc = cc_set_aead_conf_buf(dev, areq_ctx, areq_ctx->ccm_config,
++ &sg_data, areq_ctx->assoclen);
++ if (rc)
+ goto aead_map_failure;
+- }
+ }
+
+ if (areq_ctx->cipher_mode == DRV_CIPHER_GCTR) {
+@@ -1243,10 +1241,12 @@ int cc_map_aead_request(struct cc_drvdata *drvdata, struct aead_request *req)
+ areq_ctx->gcm_iv_inc2_dma_addr = dma_addr;
+ }
+
+- size_to_map = req->cryptlen + req->assoclen;
+- if (areq_ctx->gen_ctx.op_type == DRV_CRYPTO_DIRECTION_ENCRYPT)
++ size_to_map = req->cryptlen + areq_ctx->assoclen;
++ /* If we do in-place encryption, we also need the auth tag */
++ if ((areq_ctx->gen_ctx.op_type == DRV_CRYPTO_DIRECTION_ENCRYPT) &&
++ (req->src == req->dst)) {
+ size_to_map += authsize;
+-
++ }
+ if (is_gcm4543)
+ size_to_map += crypto_aead_ivsize(tfm);
+ rc = cc_map_sg(dev, req->src, size_to_map, DMA_BIDIRECTIONAL,
+@@ -1254,10 +1254,8 @@ int cc_map_aead_request(struct cc_drvdata *drvdata, struct aead_request *req)
+ (LLI_MAX_NUM_OF_ASSOC_DATA_ENTRIES +
+ LLI_MAX_NUM_OF_DATA_ENTRIES),
+ &dummy, &mapped_nents);
+- if (rc) {
+- rc = -ENOMEM;
++ if (rc)
+ goto aead_map_failure;
+- }
+
+ if (areq_ctx->is_single_pass) {
+ /*
+@@ -1341,6 +1339,7 @@ int cc_map_hash_request_final(struct cc_drvdata *drvdata, void *ctx,
+ struct mlli_params *mlli_params = &areq_ctx->mlli_params;
+ struct buffer_array sg_data;
+ struct buff_mgr_handle *buff_mgr = drvdata->buff_mgr_handle;
++ int rc = 0;
+ u32 dummy = 0;
+ u32 mapped_nents = 0;
+
+@@ -1360,18 +1359,18 @@ int cc_map_hash_request_final(struct cc_drvdata *drvdata, void *ctx,
+ /*TODO: copy data in case that buffer is enough for operation */
+ /* map the previous buffer */
+ if (*curr_buff_cnt) {
+- if (cc_set_hash_buf(dev, areq_ctx, curr_buff, *curr_buff_cnt,
+- &sg_data)) {
+- return -ENOMEM;
+- }
++ rc = cc_set_hash_buf(dev, areq_ctx, curr_buff, *curr_buff_cnt,
++ &sg_data);
++ if (rc)
++ return rc;
+ }
+
+ if (src && nbytes > 0 && do_update) {
+- if (cc_map_sg(dev, src, nbytes, DMA_TO_DEVICE,
+- &areq_ctx->in_nents, LLI_MAX_NUM_OF_DATA_ENTRIES,
+- &dummy, &mapped_nents)) {
++ rc = cc_map_sg(dev, src, nbytes, DMA_TO_DEVICE,
++ &areq_ctx->in_nents, LLI_MAX_NUM_OF_DATA_ENTRIES,
++ &dummy, &mapped_nents);
++ if (rc)
+ goto unmap_curr_buff;
+- }
+ if (src && mapped_nents == 1 &&
+ areq_ctx->data_dma_buf_type == CC_DMA_BUF_NULL) {
+ memcpy(areq_ctx->buff_sg, src,
+@@ -1390,7 +1389,8 @@ int cc_map_hash_request_final(struct cc_drvdata *drvdata, void *ctx,
+ /* add the src data to the sg_data */
+ cc_add_sg_entry(dev, &sg_data, areq_ctx->in_nents, src, nbytes,
+ 0, true, &areq_ctx->mlli_nents);
+- if (cc_generate_mlli(dev, &sg_data, mlli_params, flags))
++ rc = cc_generate_mlli(dev, &sg_data, mlli_params, flags);
++ if (rc)
+ goto fail_unmap_din;
+ }
+ /* change the buffer index for the unmap function */
+@@ -1406,7 +1406,7 @@ unmap_curr_buff:
+ if (*curr_buff_cnt)
+ dma_unmap_sg(dev, areq_ctx->buff_sg, 1, DMA_TO_DEVICE);
+
+- return -ENOMEM;
++ return rc;
+ }
+
+ int cc_map_hash_request_update(struct cc_drvdata *drvdata, void *ctx,
+@@ -1425,6 +1425,7 @@ int cc_map_hash_request_update(struct cc_drvdata *drvdata, void *ctx,
+ struct buffer_array sg_data;
+ struct buff_mgr_handle *buff_mgr = drvdata->buff_mgr_handle;
+ unsigned int swap_index = 0;
++ int rc = 0;
+ u32 dummy = 0;
+ u32 mapped_nents = 0;
+
+@@ -1469,21 +1470,21 @@ int cc_map_hash_request_update(struct cc_drvdata *drvdata, void *ctx,
+ }
+
+ if (*curr_buff_cnt) {
+- if (cc_set_hash_buf(dev, areq_ctx, curr_buff, *curr_buff_cnt,
+- &sg_data)) {
+- return -ENOMEM;
+- }
++ rc = cc_set_hash_buf(dev, areq_ctx, curr_buff, *curr_buff_cnt,
++ &sg_data);
++ if (rc)
++ return rc;
+ /* change the buffer index for next operation */
+ swap_index = 1;
+ }
+
+ if (update_data_len > *curr_buff_cnt) {
+- if (cc_map_sg(dev, src, (update_data_len - *curr_buff_cnt),
+- DMA_TO_DEVICE, &areq_ctx->in_nents,
+- LLI_MAX_NUM_OF_DATA_ENTRIES, &dummy,
+- &mapped_nents)) {
++ rc = cc_map_sg(dev, src, (update_data_len - *curr_buff_cnt),
++ DMA_TO_DEVICE, &areq_ctx->in_nents,
++ LLI_MAX_NUM_OF_DATA_ENTRIES, &dummy,
++ &mapped_nents);
++ if (rc)
+ goto unmap_curr_buff;
+- }
+ if (mapped_nents == 1 &&
+ areq_ctx->data_dma_buf_type == CC_DMA_BUF_NULL) {
+ /* only one entry in the SG and no previous data */
+@@ -1503,7 +1504,8 @@ int cc_map_hash_request_update(struct cc_drvdata *drvdata, void *ctx,
+ cc_add_sg_entry(dev, &sg_data, areq_ctx->in_nents, src,
+ (update_data_len - *curr_buff_cnt), 0, true,
+ &areq_ctx->mlli_nents);
+- if (cc_generate_mlli(dev, &sg_data, mlli_params, flags))
++ rc = cc_generate_mlli(dev, &sg_data, mlli_params, flags);
++ if (rc)
+ goto fail_unmap_din;
+ }
+ areq_ctx->buff_index = (areq_ctx->buff_index ^ swap_index);
+@@ -1517,7 +1519,7 @@ unmap_curr_buff:
+ if (*curr_buff_cnt)
+ dma_unmap_sg(dev, areq_ctx->buff_sg, 1, DMA_TO_DEVICE);
+
+- return -ENOMEM;
++ return rc;
+ }
+
+ void cc_unmap_hash_request(struct device *dev, void *ctx,
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index b926098f70ff..5c5c504dacb6 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -25,6 +25,7 @@
+ #include <crypto/sha.h>
+ #include <crypto/internal/hash.h>
+ #include <crypto/internal/skcipher.h>
++#include <crypto/scatterwalk.h>
+
+ #define DCP_MAX_CHANS 4
+ #define DCP_BUF_SZ PAGE_SIZE
+@@ -621,49 +622,46 @@ static int dcp_sha_req_to_buf(struct crypto_async_request *arq)
+ struct dcp_async_ctx *actx = crypto_ahash_ctx(tfm);
+ struct dcp_sha_req_ctx *rctx = ahash_request_ctx(req);
+ struct hash_alg_common *halg = crypto_hash_alg_common(tfm);
+- const int nents = sg_nents(req->src);
+
+ uint8_t *in_buf = sdcp->coh->sha_in_buf;
+ uint8_t *out_buf = sdcp->coh->sha_out_buf;
+
+- uint8_t *src_buf;
+-
+ struct scatterlist *src;
+
+- unsigned int i, len, clen;
++ unsigned int i, len, clen, oft = 0;
+ int ret;
+
+ int fin = rctx->fini;
+ if (fin)
+ rctx->fini = 0;
+
+- for_each_sg(req->src, src, nents, i) {
+- src_buf = sg_virt(src);
+- len = sg_dma_len(src);
+-
+- do {
+- if (actx->fill + len > DCP_BUF_SZ)
+- clen = DCP_BUF_SZ - actx->fill;
+- else
+- clen = len;
+-
+- memcpy(in_buf + actx->fill, src_buf, clen);
+- len -= clen;
+- src_buf += clen;
+- actx->fill += clen;
++ src = req->src;
++ len = req->nbytes;
+
+- /*
+- * If we filled the buffer and still have some
+- * more data, submit the buffer.
+- */
+- if (len && actx->fill == DCP_BUF_SZ) {
+- ret = mxs_dcp_run_sha(req);
+- if (ret)
+- return ret;
+- actx->fill = 0;
+- rctx->init = 0;
+- }
+- } while (len);
++ while (len) {
++ if (actx->fill + len > DCP_BUF_SZ)
++ clen = DCP_BUF_SZ - actx->fill;
++ else
++ clen = len;
++
++ scatterwalk_map_and_copy(in_buf + actx->fill, src, oft, clen,
++ 0);
++
++ len -= clen;
++ oft += clen;
++ actx->fill += clen;
++
++ /*
++ * If we filled the buffer and still have some
++ * more data, submit the buffer.
++ */
++ if (len && actx->fill == DCP_BUF_SZ) {
++ ret = mxs_dcp_run_sha(req);
++ if (ret)
++ return ret;
++ actx->fill = 0;
++ rctx->init = 0;
++ }
+ }
+
+ if (fin) {
+diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
+index c64c7da73829..05b528c7ed8f 100644
+--- a/drivers/firmware/arm_sdei.c
++++ b/drivers/firmware/arm_sdei.c
+@@ -489,11 +489,6 @@ static int _sdei_event_unregister(struct sdei_event *event)
+ {
+ lockdep_assert_held(&sdei_events_lock);
+
+- spin_lock(&sdei_list_lock);
+- event->reregister = false;
+- event->reenable = false;
+- spin_unlock(&sdei_list_lock);
+-
+ if (event->type == SDEI_EVENT_TYPE_SHARED)
+ return sdei_api_event_unregister(event->event_num);
+
+@@ -516,6 +511,11 @@ int sdei_event_unregister(u32 event_num)
+ break;
+ }
+
++ spin_lock(&sdei_list_lock);
++ event->reregister = false;
++ event->reenable = false;
++ spin_unlock(&sdei_list_lock);
++
+ err = _sdei_event_unregister(event);
+ if (err)
+ break;
+@@ -583,26 +583,15 @@ static int _sdei_event_register(struct sdei_event *event)
+
+ lockdep_assert_held(&sdei_events_lock);
+
+- spin_lock(&sdei_list_lock);
+- event->reregister = true;
+- spin_unlock(&sdei_list_lock);
+-
+ if (event->type == SDEI_EVENT_TYPE_SHARED)
+ return sdei_api_event_register(event->event_num,
+ sdei_entry_point,
+ event->registered,
+ SDEI_EVENT_REGISTER_RM_ANY, 0);
+
+-
+ err = sdei_do_cross_call(_local_event_register, event);
+- if (err) {
+- spin_lock(&sdei_list_lock);
+- event->reregister = false;
+- event->reenable = false;
+- spin_unlock(&sdei_list_lock);
+-
++ if (err)
+ sdei_do_cross_call(_local_event_unregister, event);
+- }
+
+ return err;
+ }
+@@ -630,8 +619,17 @@ int sdei_event_register(u32 event_num, sdei_event_callback *cb, void *arg)
+ break;
+ }
+
++ spin_lock(&sdei_list_lock);
++ event->reregister = true;
++ spin_unlock(&sdei_list_lock);
++
+ err = _sdei_event_register(event);
+ if (err) {
++ spin_lock(&sdei_list_lock);
++ event->reregister = false;
++ event->reenable = false;
++ spin_unlock(&sdei_list_lock);
++
+ sdei_event_destroy(event);
+ pr_warn("Failed to register event %u: %d\n", event_num,
+ err);
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index d54fca902e64..f1e0a2715269 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -572,7 +572,7 @@ int __init efi_config_parse_tables(void *config_tables, int count, int sz,
+ }
+ }
+
+- if (efi_enabled(EFI_MEMMAP))
++ if (!IS_ENABLED(CONFIG_X86_32) && efi_enabled(EFI_MEMMAP))
+ efi_memattr_init();
+
+ efi_tpm_eventlog_init();
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 7c3c323773d3..5f508ec321fe 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2115,9 +2115,9 @@ static bool drm_dp_get_vc_payload_bw(int dp_link_bw,
+ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool mst_state)
+ {
+ int ret = 0;
+- int i = 0;
+ struct drm_dp_mst_branch *mstb = NULL;
+
++ mutex_lock(&mgr->payload_lock);
+ mutex_lock(&mgr->lock);
+ if (mst_state == mgr->mst_state)
+ goto out_unlock;
+@@ -2176,25 +2176,18 @@ int drm_dp_mst_topology_mgr_set_mst(struct drm_dp_mst_topology_mgr *mgr, bool ms
+ /* this can fail if the device is gone */
+ drm_dp_dpcd_writeb(mgr->aux, DP_MSTM_CTRL, 0);
+ ret = 0;
+- mutex_lock(&mgr->payload_lock);
+- memset(mgr->payloads, 0, mgr->max_payloads * sizeof(struct drm_dp_payload));
++ memset(mgr->payloads, 0,
++ mgr->max_payloads * sizeof(mgr->payloads[0]));
++ memset(mgr->proposed_vcpis, 0,
++ mgr->max_payloads * sizeof(mgr->proposed_vcpis[0]));
+ mgr->payload_mask = 0;
+ set_bit(0, &mgr->payload_mask);
+- for (i = 0; i < mgr->max_payloads; i++) {
+- struct drm_dp_vcpi *vcpi = mgr->proposed_vcpis[i];
+-
+- if (vcpi) {
+- vcpi->vcpi = 0;
+- vcpi->num_slots = 0;
+- }
+- mgr->proposed_vcpis[i] = NULL;
+- }
+ mgr->vcpi_mask = 0;
+- mutex_unlock(&mgr->payload_lock);
+ }
+
+ out_unlock:
+ mutex_unlock(&mgr->lock);
++ mutex_unlock(&mgr->payload_lock);
+ if (mstb)
+ drm_dp_put_mst_branch_device(mstb);
+ return ret;
+diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
+index 896e42a34895..d89a992829be 100644
+--- a/drivers/gpu/drm/drm_pci.c
++++ b/drivers/gpu/drm/drm_pci.c
+@@ -46,8 +46,6 @@
+ drm_dma_handle_t *drm_pci_alloc(struct drm_device * dev, size_t size, size_t align)
+ {
+ drm_dma_handle_t *dmah;
+- unsigned long addr;
+- size_t sz;
+
+ /* pci_alloc_consistent only guarantees alignment to the smallest
+ * PAGE_SIZE order which is greater than or equal to the requested size.
+@@ -61,22 +59,13 @@ drm_dma_handle_t *drm_pci_alloc(struct drm_device * dev, size_t size, size_t ali
+ return NULL;
+
+ dmah->size = size;
+- dmah->vaddr = dma_alloc_coherent(&dev->pdev->dev, size, &dmah->busaddr, GFP_KERNEL | __GFP_COMP);
++ dmah->vaddr = dma_alloc_coherent(&dev->pdev->dev, size, &dmah->busaddr, GFP_KERNEL);
+
+ if (dmah->vaddr == NULL) {
+ kfree(dmah);
+ return NULL;
+ }
+
+- memset(dmah->vaddr, 0, size);
+-
+- /* XXX - Is virt_to_page() legal for consistent mem? */
+- /* Reserve */
+- for (addr = (unsigned long)dmah->vaddr, sz = size;
+- sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) {
+- SetPageReserved(virt_to_page((void *)addr));
+- }
+-
+ return dmah;
+ }
+
+@@ -89,19 +78,9 @@ EXPORT_SYMBOL(drm_pci_alloc);
+ */
+ void __drm_legacy_pci_free(struct drm_device * dev, drm_dma_handle_t * dmah)
+ {
+- unsigned long addr;
+- size_t sz;
+-
+- if (dmah->vaddr) {
+- /* XXX - Is virt_to_page() legal for consistent mem? */
+- /* Unreserve */
+- for (addr = (unsigned long)dmah->vaddr, sz = dmah->size;
+- sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) {
+- ClearPageReserved(virt_to_page((void *)addr));
+- }
++ if (dmah->vaddr)
+ dma_free_coherent(&dev->pdev->dev, dmah->size, dmah->vaddr,
+ dmah->busaddr);
+- }
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
+index 4227a4006c34..3ce77cbad4ae 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
+@@ -4,6 +4,7 @@
+ * Copyright (C) 2017 Zodiac Inflight Innovations
+ */
+
++#include "common.xml.h"
+ #include "etnaviv_gpu.h"
+ #include "etnaviv_perfmon.h"
+ #include "state_hi.xml.h"
+@@ -31,17 +32,11 @@ struct etnaviv_pm_domain {
+ };
+
+ struct etnaviv_pm_domain_meta {
++ unsigned int feature;
+ const struct etnaviv_pm_domain *domains;
+ u32 nr_domains;
+ };
+
+-static u32 simple_reg_read(struct etnaviv_gpu *gpu,
+- const struct etnaviv_pm_domain *domain,
+- const struct etnaviv_pm_signal *signal)
+-{
+- return gpu_read(gpu, signal->data);
+-}
+-
+ static u32 perf_reg_read(struct etnaviv_gpu *gpu,
+ const struct etnaviv_pm_domain *domain,
+ const struct etnaviv_pm_signal *signal)
+@@ -75,6 +70,34 @@ static u32 pipe_reg_read(struct etnaviv_gpu *gpu,
+ return value;
+ }
+
++static u32 hi_total_cycle_read(struct etnaviv_gpu *gpu,
++ const struct etnaviv_pm_domain *domain,
++ const struct etnaviv_pm_signal *signal)
++{
++ u32 reg = VIVS_HI_PROFILE_TOTAL_CYCLES;
++
++ if (gpu->identity.model == chipModel_GC880 ||
++ gpu->identity.model == chipModel_GC2000 ||
++ gpu->identity.model == chipModel_GC2100)
++ reg = VIVS_MC_PROFILE_CYCLE_COUNTER;
++
++ return gpu_read(gpu, reg);
++}
++
++static u32 hi_total_idle_cycle_read(struct etnaviv_gpu *gpu,
++ const struct etnaviv_pm_domain *domain,
++ const struct etnaviv_pm_signal *signal)
++{
++ u32 reg = VIVS_HI_PROFILE_IDLE_CYCLES;
++
++ if (gpu->identity.model == chipModel_GC880 ||
++ gpu->identity.model == chipModel_GC2000 ||
++ gpu->identity.model == chipModel_GC2100)
++ reg = VIVS_HI_PROFILE_TOTAL_CYCLES;
++
++ return gpu_read(gpu, reg);
++}
++
+ static const struct etnaviv_pm_domain doms_3d[] = {
+ {
+ .name = "HI",
+@@ -84,13 +107,13 @@ static const struct etnaviv_pm_domain doms_3d[] = {
+ .signal = (const struct etnaviv_pm_signal[]) {
+ {
+ "TOTAL_CYCLES",
+- VIVS_HI_PROFILE_TOTAL_CYCLES,
+- &simple_reg_read
++ 0,
++ &hi_total_cycle_read
+ },
+ {
+ "IDLE_CYCLES",
+- VIVS_HI_PROFILE_IDLE_CYCLES,
+- &simple_reg_read
++ 0,
++ &hi_total_idle_cycle_read
+ },
+ {
+ "AXI_CYCLES_READ_REQUEST_STALLED",
+@@ -388,36 +411,78 @@ static const struct etnaviv_pm_domain doms_vg[] = {
+
+ static const struct etnaviv_pm_domain_meta doms_meta[] = {
+ {
++ .feature = chipFeatures_PIPE_3D,
+ .nr_domains = ARRAY_SIZE(doms_3d),
+ .domains = &doms_3d[0]
+ },
+ {
++ .feature = chipFeatures_PIPE_2D,
+ .nr_domains = ARRAY_SIZE(doms_2d),
+ .domains = &doms_2d[0]
+ },
+ {
++ .feature = chipFeatures_PIPE_VG,
+ .nr_domains = ARRAY_SIZE(doms_vg),
+ .domains = &doms_vg[0]
+ }
+ };
+
++static unsigned int num_pm_domains(const struct etnaviv_gpu *gpu)
++{
++ unsigned int num = 0, i;
++
++ for (i = 0; i < ARRAY_SIZE(doms_meta); i++) {
++ const struct etnaviv_pm_domain_meta *meta = &doms_meta[i];
++
++ if (gpu->identity.features & meta->feature)
++ num += meta->nr_domains;
++ }
++
++ return num;
++}
++
++static const struct etnaviv_pm_domain *pm_domain(const struct etnaviv_gpu *gpu,
++ unsigned int index)
++{
++ const struct etnaviv_pm_domain *domain = NULL;
++ unsigned int offset = 0, i;
++
++ for (i = 0; i < ARRAY_SIZE(doms_meta); i++) {
++ const struct etnaviv_pm_domain_meta *meta = &doms_meta[i];
++
++ if (!(gpu->identity.features & meta->feature))
++ continue;
++
++ if (meta->nr_domains < (index - offset)) {
++ offset += meta->nr_domains;
++ continue;
++ }
++
++ domain = meta->domains + (index - offset);
++ }
++
++ return domain;
++}
++
+ int etnaviv_pm_query_dom(struct etnaviv_gpu *gpu,
+ struct drm_etnaviv_pm_domain *domain)
+ {
+- const struct etnaviv_pm_domain_meta *meta = &doms_meta[domain->pipe];
++ const unsigned int nr_domains = num_pm_domains(gpu);
+ const struct etnaviv_pm_domain *dom;
+
+- if (domain->iter >= meta->nr_domains)
++ if (domain->iter >= nr_domains)
+ return -EINVAL;
+
+- dom = meta->domains + domain->iter;
++ dom = pm_domain(gpu, domain->iter);
++ if (!dom)
++ return -EINVAL;
+
+ domain->id = domain->iter;
+ domain->nr_signals = dom->nr_signals;
+ strncpy(domain->name, dom->name, sizeof(domain->name));
+
+ domain->iter++;
+- if (domain->iter == meta->nr_domains)
++ if (domain->iter == nr_domains)
+ domain->iter = 0xff;
+
+ return 0;
+@@ -426,14 +491,16 @@ int etnaviv_pm_query_dom(struct etnaviv_gpu *gpu,
+ int etnaviv_pm_query_sig(struct etnaviv_gpu *gpu,
+ struct drm_etnaviv_pm_signal *signal)
+ {
+- const struct etnaviv_pm_domain_meta *meta = &doms_meta[signal->pipe];
++ const unsigned int nr_domains = num_pm_domains(gpu);
+ const struct etnaviv_pm_domain *dom;
+ const struct etnaviv_pm_signal *sig;
+
+- if (signal->domain >= meta->nr_domains)
++ if (signal->domain >= nr_domains)
+ return -EINVAL;
+
+- dom = meta->domains + signal->domain;
++ dom = pm_domain(gpu, signal->domain);
++ if (!dom)
++ return -EINVAL;
+
+ if (signal->iter >= dom->nr_signals)
+ return -EINVAL;
+diff --git a/drivers/i2c/busses/i2c-st.c b/drivers/i2c/busses/i2c-st.c
+index 9e62f893958a..81158ae8bfe3 100644
+--- a/drivers/i2c/busses/i2c-st.c
++++ b/drivers/i2c/busses/i2c-st.c
+@@ -437,6 +437,7 @@ static void st_i2c_wr_fill_tx_fifo(struct st_i2c_dev *i2c_dev)
+ /**
+ * st_i2c_rd_fill_tx_fifo() - Fill the Tx FIFO in read mode
+ * @i2c_dev: Controller's private data
++ * @max: Maximum amount of data to fill into the Tx FIFO
+ *
+ * This functions fills the Tx FIFO with fixed pattern when
+ * in read mode to trigger clock.
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 2db34f7b5ced..f41f3ff689c5 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1070,12 +1070,10 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ if (MLX5_CAP_ETH(mdev, tunnel_stateless_gre))
+ resp.tunnel_offloads_caps |=
+ MLX5_IB_TUNNELED_OFFLOADS_GRE;
+- if (MLX5_CAP_GEN(mdev, flex_parser_protocols) &
+- MLX5_FLEX_PROTO_CW_MPLS_GRE)
++ if (MLX5_CAP_ETH(mdev, tunnel_stateless_mpls_over_gre))
+ resp.tunnel_offloads_caps |=
+ MLX5_IB_TUNNELED_OFFLOADS_MPLS_GRE;
+- if (MLX5_CAP_GEN(mdev, flex_parser_protocols) &
+- MLX5_FLEX_PROTO_CW_MPLS_UDP)
++ if (MLX5_CAP_ETH(mdev, tunnel_stateless_mpls_over_udp))
+ resp.tunnel_offloads_caps |=
+ MLX5_IB_TUNNELED_OFFLOADS_MPLS_UDP;
+ }
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 136f6e7bf797..0d0f977a2f39 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -534,6 +534,17 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo LaVie Z"),
+ },
+ },
++ {
++ /*
++ * Acer Aspire 5738z
++ * Touchpad stops working in mux mode when dis- + re-enabled
++ * with the touchpad enable/disable toggle hotkey
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"),
++ },
++ },
+ { }
+ };
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index f9b73336a39e..fe7d63cdfb1d 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2858,12 +2858,18 @@ static int its_vpe_set_irqchip_state(struct irq_data *d,
+ return 0;
+ }
+
++static int its_vpe_retrigger(struct irq_data *d)
++{
++ return !its_vpe_set_irqchip_state(d, IRQCHIP_STATE_PENDING, true);
++}
++
+ static struct irq_chip its_vpe_irq_chip = {
+ .name = "GICv4-vpe",
+ .irq_mask = its_vpe_mask_irq,
+ .irq_unmask = its_vpe_unmask_irq,
+ .irq_eoi = irq_chip_eoi_parent,
+ .irq_set_affinity = its_vpe_set_affinity,
++ .irq_retrigger = its_vpe_retrigger,
+ .irq_set_irqchip_state = its_vpe_set_irqchip_state,
+ .irq_set_vcpu_affinity = its_vpe_set_vcpu_affinity,
+ };
+diff --git a/drivers/irqchip/irq-versatile-fpga.c b/drivers/irqchip/irq-versatile-fpga.c
+index 928858dada75..f1386733d3bc 100644
+--- a/drivers/irqchip/irq-versatile-fpga.c
++++ b/drivers/irqchip/irq-versatile-fpga.c
+@@ -6,6 +6,7 @@
+ #include <linux/irq.h>
+ #include <linux/io.h>
+ #include <linux/irqchip.h>
++#include <linux/irqchip/chained_irq.h>
+ #include <linux/irqchip/versatile-fpga.h>
+ #include <linux/irqdomain.h>
+ #include <linux/module.h>
+@@ -68,12 +69,16 @@ static void fpga_irq_unmask(struct irq_data *d)
+
+ static void fpga_irq_handle(struct irq_desc *desc)
+ {
++ struct irq_chip *chip = irq_desc_get_chip(desc);
+ struct fpga_irq_data *f = irq_desc_get_handler_data(desc);
+- u32 status = readl(f->base + IRQ_STATUS);
++ u32 status;
++
++ chained_irq_enter(chip, desc);
+
++ status = readl(f->base + IRQ_STATUS);
+ if (status == 0) {
+ do_bad_IRQ(desc);
+- return;
++ goto out;
+ }
+
+ do {
+@@ -82,6 +87,9 @@ static void fpga_irq_handle(struct irq_desc *desc)
+ status &= ~(1 << irq);
+ generic_handle_irq(irq_find_mapping(f->domain, irq));
+ } while (status);
++
++out:
++ chained_irq_exit(chip, desc);
+ }
+
+ /*
+@@ -204,6 +212,9 @@ int __init fpga_irq_of_init(struct device_node *node,
+ if (of_property_read_u32(node, "valid-mask", &valid_mask))
+ valid_mask = 0;
+
++ writel(clear_mask, base + IRQ_ENABLE_CLEAR);
++ writel(clear_mask, base + FIQ_ENABLE_CLEAR);
++
+ /* Some chips are cascaded from a parent IRQ */
+ parent_irq = irq_of_parse_and_map(node, 0);
+ if (!parent_irq) {
+@@ -213,9 +224,6 @@ int __init fpga_irq_of_init(struct device_node *node,
+
+ fpga_irq_init(base, node->name, 0, parent_irq, valid_mask, node);
+
+- writel(clear_mask, base + IRQ_ENABLE_CLEAR);
+- writel(clear_mask, base + FIQ_ENABLE_CLEAR);
+-
+ /*
+ * On Versatile AB/PB, some secondary interrupts have a direct
+ * pass-thru to the primary controller for IRQs 20 and 22-31 which need
+diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
+index 684af08d0747..0f4a2143bf55 100644
+--- a/drivers/md/dm-verity-fec.c
++++ b/drivers/md/dm-verity-fec.c
+@@ -552,6 +552,7 @@ void verity_fec_dtr(struct dm_verity *v)
+ mempool_exit(&f->rs_pool);
+ mempool_exit(&f->prealloc_pool);
+ mempool_exit(&f->extra_pool);
++ mempool_exit(&f->output_pool);
+ kmem_cache_destroy(f->cache);
+
+ if (f->data_bufio)
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index 4e4a09054f85..a76eda50ad48 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -878,6 +878,7 @@ static int writecache_alloc_entries(struct dm_writecache *wc)
+ struct wc_entry *e = &wc->entries[b];
+ e->index = b;
+ e->write_in_progress = false;
++ cond_resched();
+ }
+
+ return 0;
+@@ -932,6 +933,7 @@ static void writecache_resume(struct dm_target *ti)
+ e->original_sector = le64_to_cpu(wme.original_sector);
+ e->seq_count = le64_to_cpu(wme.seq_count);
+ }
++ cond_resched();
+ }
+ #endif
+ for (b = 0; b < wc->n_blocks; b++) {
+@@ -1764,8 +1766,10 @@ static int init_memory(struct dm_writecache *wc)
+ pmem_assign(sb(wc)->n_blocks, cpu_to_le64(wc->n_blocks));
+ pmem_assign(sb(wc)->seq_count, cpu_to_le64(0));
+
+- for (b = 0; b < wc->n_blocks; b++)
++ for (b = 0; b < wc->n_blocks; b++) {
+ write_original_sector_seq_count(wc, &wc->entries[b], -1, -1);
++ cond_resched();
++ }
+
+ writecache_flush_all_metadata(wc);
+ writecache_commit_flushed(wc, false);
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index 086a870087cf..53eb21343b11 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -1105,7 +1105,6 @@ static int dmz_init_zone(struct dmz_metadata *zmd, struct dm_zone *zone,
+
+ if (blkz->type == BLK_ZONE_TYPE_CONVENTIONAL) {
+ set_bit(DMZ_RND, &zone->flags);
+- zmd->nr_rnd_zones++;
+ } else if (blkz->type == BLK_ZONE_TYPE_SEQWRITE_REQ ||
+ blkz->type == BLK_ZONE_TYPE_SEQWRITE_PREF) {
+ set_bit(DMZ_SEQ, &zone->flags);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 62f214d43e15..9426976e0860 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5874,7 +5874,7 @@ EXPORT_SYMBOL_GPL(md_stop_writes);
+ static void mddev_detach(struct mddev *mddev)
+ {
+ md_bitmap_wait_behind_writes(mddev);
+- if (mddev->pers && mddev->pers->quiesce) {
++ if (mddev->pers && mddev->pers->quiesce && !mddev->suspended) {
+ mddev->pers->quiesce(mddev, 1);
+ mddev->pers->quiesce(mddev, 0);
+ }
+diff --git a/drivers/media/i2c/ov5695.c b/drivers/media/i2c/ov5695.c
+index 5d107c53364d..be242bb8fefc 100644
+--- a/drivers/media/i2c/ov5695.c
++++ b/drivers/media/i2c/ov5695.c
+@@ -974,16 +974,9 @@ unlock_and_return:
+ return ret;
+ }
+
+-/* Calculate the delay in us by clock rate and clock cycles */
+-static inline u32 ov5695_cal_delay(u32 cycles)
+-{
+- return DIV_ROUND_UP(cycles, OV5695_XVCLK_FREQ / 1000 / 1000);
+-}
+-
+ static int __ov5695_power_on(struct ov5695 *ov5695)
+ {
+- int ret;
+- u32 delay_us;
++ int i, ret;
+ struct device *dev = &ov5695->client->dev;
+
+ ret = clk_prepare_enable(ov5695->xvclk);
+@@ -994,21 +987,28 @@ static int __ov5695_power_on(struct ov5695 *ov5695)
+
+ gpiod_set_value_cansleep(ov5695->reset_gpio, 1);
+
+- ret = regulator_bulk_enable(OV5695_NUM_SUPPLIES, ov5695->supplies);
+- if (ret < 0) {
+- dev_err(dev, "Failed to enable regulators\n");
+- goto disable_clk;
++ /*
++ * The hardware requires the regulators to be powered on in order,
++ * so enable them one by one.
++ */
++ for (i = 0; i < OV5695_NUM_SUPPLIES; i++) {
++ ret = regulator_enable(ov5695->supplies[i].consumer);
++ if (ret) {
++ dev_err(dev, "Failed to enable %s: %d\n",
++ ov5695->supplies[i].supply, ret);
++ goto disable_reg_clk;
++ }
+ }
+
+ gpiod_set_value_cansleep(ov5695->reset_gpio, 0);
+
+- /* 8192 cycles prior to first SCCB transaction */
+- delay_us = ov5695_cal_delay(8192);
+- usleep_range(delay_us, delay_us * 2);
++ usleep_range(1000, 1200);
+
+ return 0;
+
+-disable_clk:
++disable_reg_clk:
++ for (--i; i >= 0; i--)
++ regulator_disable(ov5695->supplies[i].consumer);
+ clk_disable_unprepare(ov5695->xvclk);
+
+ return ret;
+@@ -1016,9 +1016,22 @@ disable_clk:
+
+ static void __ov5695_power_off(struct ov5695 *ov5695)
+ {
++ struct device *dev = &ov5695->client->dev;
++ int i, ret;
++
+ clk_disable_unprepare(ov5695->xvclk);
+ gpiod_set_value_cansleep(ov5695->reset_gpio, 1);
+- regulator_bulk_disable(OV5695_NUM_SUPPLIES, ov5695->supplies);
++
++ /*
++ * The hardware requires the regulators to be powered off in order,
++ * so disable them one by one.
++ */
++ for (i = OV5695_NUM_SUPPLIES - 1; i >= 0; i--) {
++ ret = regulator_disable(ov5695->supplies[i].consumer);
++ if (ret)
++ dev_err(dev, "Failed to disable %s: %d\n",
++ ov5695->supplies[i].supply, ret);
++ }
+ }
+
+ static int __maybe_unused ov5695_runtime_resume(struct device *dev)
+@@ -1288,7 +1301,7 @@ static int ov5695_probe(struct i2c_client *client,
+ if (clk_get_rate(ov5695->xvclk) != OV5695_XVCLK_FREQ)
+ dev_warn(dev, "xvclk mismatched, modes are based on 24MHz\n");
+
+- ov5695->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW);
++ ov5695->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
+ if (IS_ERR(ov5695->reset_gpio)) {
+ dev_err(dev, "Failed to get reset-gpios\n");
+ return -EINVAL;
+diff --git a/drivers/media/i2c/video-i2c.c b/drivers/media/i2c/video-i2c.c
+index f27d294dcbef..dd50acc085d8 100644
+--- a/drivers/media/i2c/video-i2c.c
++++ b/drivers/media/i2c/video-i2c.c
+@@ -105,7 +105,7 @@ static int amg88xx_xfer(struct video_i2c_data *data, char *buf)
+ return (ret == 2) ? 0 : -EIO;
+ }
+
+-#if IS_ENABLED(CONFIG_HWMON)
++#if IS_REACHABLE(CONFIG_HWMON)
+
+ static const u32 amg88xx_temp_config[] = {
+ HWMON_T_INPUT,
+diff --git a/drivers/media/platform/qcom/venus/hfi_parser.c b/drivers/media/platform/qcom/venus/hfi_parser.c
+index 2293d936e49c..7f515a4b9bd1 100644
+--- a/drivers/media/platform/qcom/venus/hfi_parser.c
++++ b/drivers/media/platform/qcom/venus/hfi_parser.c
+@@ -181,6 +181,7 @@ static void parse_codecs(struct venus_core *core, void *data)
+ if (IS_V1(core)) {
+ core->dec_codecs &= ~HFI_VIDEO_CODEC_HEVC;
+ core->dec_codecs &= ~HFI_VIDEO_CODEC_SPARK;
++ core->enc_codecs &= ~HFI_VIDEO_CODEC_HEVC;
+ }
+ }
+
+diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
+index d1febe5baa6d..be3155275a6b 100644
+--- a/drivers/media/platform/ti-vpe/cal.c
++++ b/drivers/media/platform/ti-vpe/cal.c
+@@ -541,16 +541,16 @@ static void enable_irqs(struct cal_ctx *ctx)
+
+ static void disable_irqs(struct cal_ctx *ctx)
+ {
++ u32 val;
++
+ /* Disable IRQ_WDMA_END 0/1 */
+- reg_write_field(ctx->dev,
+- CAL_HL_IRQENABLE_CLR(2),
+- CAL_HL_IRQ_CLEAR,
+- CAL_HL_IRQ_MASK(ctx->csi2_port));
++ val = 0;
++ set_field(&val, CAL_HL_IRQ_CLEAR, CAL_HL_IRQ_MASK(ctx->csi2_port));
++ reg_write(ctx->dev, CAL_HL_IRQENABLE_CLR(2), val);
+ /* Disable IRQ_WDMA_START 0/1 */
+- reg_write_field(ctx->dev,
+- CAL_HL_IRQENABLE_CLR(3),
+- CAL_HL_IRQ_CLEAR,
+- CAL_HL_IRQ_MASK(ctx->csi2_port));
++ val = 0;
++ set_field(&val, CAL_HL_IRQ_CLEAR, CAL_HL_IRQ_MASK(ctx->csi2_port));
++ reg_write(ctx->dev, CAL_HL_IRQENABLE_CLR(3), val);
+ /* Todo: Add VC_IRQ and CSI2_COMPLEXIO_IRQ handling */
+ reg_write(ctx->dev, CAL_CSI2_VC_IRQENABLE(1), 0);
+ }
+diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
+index 1476465ce803..6ea0dd37b453 100644
+--- a/drivers/mfd/dln2.c
++++ b/drivers/mfd/dln2.c
+@@ -93,6 +93,11 @@ struct dln2_mod_rx_slots {
+ spinlock_t lock;
+ };
+
++enum dln2_endpoint {
++ DLN2_EP_OUT = 0,
++ DLN2_EP_IN = 1,
++};
++
+ struct dln2_dev {
+ struct usb_device *usb_dev;
+ struct usb_interface *interface;
+@@ -736,10 +741,10 @@ static int dln2_probe(struct usb_interface *interface,
+ hostif->desc.bNumEndpoints < 2)
+ return -ENODEV;
+
+- epin = &hostif->endpoint[0].desc;
+- epout = &hostif->endpoint[1].desc;
++ epout = &hostif->endpoint[DLN2_EP_OUT].desc;
+ if (!usb_endpoint_is_bulk_out(epout))
+ return -ENODEV;
++ epin = &hostif->endpoint[DLN2_EP_IN].desc;
+ if (!usb_endpoint_is_bulk_in(epin))
+ return -ENODEV;
+
+diff --git a/drivers/misc/echo/echo.c b/drivers/misc/echo/echo.c
+index 8a5adc0d2e88..3ebe5d75ad6a 100644
+--- a/drivers/misc/echo/echo.c
++++ b/drivers/misc/echo/echo.c
+@@ -381,7 +381,7 @@ int16_t oslec_update(struct oslec_state *ec, int16_t tx, int16_t rx)
+ */
+ ec->factor = 0;
+ ec->shift = 0;
+- if ((ec->nonupdate_dwell == 0)) {
++ if (!ec->nonupdate_dwell) {
+ int p, logp, shift;
+
+ /* Determine:
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index 48b3ab26b124..ee0c74b02220 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -629,18 +629,18 @@ static int spinand_mtd_write(struct mtd_info *mtd, loff_t to,
+ static bool spinand_isbad(struct nand_device *nand, const struct nand_pos *pos)
+ {
+ struct spinand_device *spinand = nand_to_spinand(nand);
++ u8 marker[2] = { };
+ struct nand_page_io_req req = {
+ .pos = *pos,
+- .ooblen = 2,
++ .ooblen = sizeof(marker),
+ .ooboffs = 0,
+- .oobbuf.in = spinand->oobbuf,
++ .oobbuf.in = marker,
+ .mode = MTD_OPS_RAW,
+ };
+
+- memset(spinand->oobbuf, 0, 2);
+ spinand_select_target(spinand, pos->target);
+ spinand_read_page(spinand, &req, false);
+- if (spinand->oobbuf[0] != 0xff || spinand->oobbuf[1] != 0xff)
++ if (marker[0] != 0xff || marker[1] != 0xff)
+ return true;
+
+ return false;
+@@ -664,15 +664,15 @@ static int spinand_mtd_block_isbad(struct mtd_info *mtd, loff_t offs)
+ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
+ {
+ struct spinand_device *spinand = nand_to_spinand(nand);
++ u8 marker[2] = { };
+ struct nand_page_io_req req = {
+ .pos = *pos,
+ .ooboffs = 0,
+- .ooblen = 2,
+- .oobbuf.out = spinand->oobbuf,
++ .ooblen = sizeof(marker),
++ .oobbuf.out = marker,
+ };
+ int ret;
+
+- /* Erase block before marking it bad. */
+ ret = spinand_select_target(spinand, pos->target);
+ if (ret)
+ return ret;
+@@ -681,9 +681,6 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
+ if (ret)
+ return ret;
+
+- spinand_erase_op(spinand, pos);
+-
+- memset(spinand->oobbuf, 0, 2);
+ return spinand_write_page(spinand, &req);
+ }
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
+index 9f9d6cae39d5..758f2b836328 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
+@@ -246,6 +246,9 @@ static int cxgb4_ptp_fineadjtime(struct adapter *adapter, s64 delta)
+ FW_PTP_CMD_PORTID_V(0));
+ c.retval_len16 = cpu_to_be32(FW_CMD_LEN16_V(sizeof(c) / 16));
+ c.u.ts.sc = FW_PTP_SC_ADJ_FTIME;
++ c.u.ts.sign = (delta < 0) ? 1 : 0;
++ if (delta < 0)
++ delta = -delta;
+ c.u.ts.tm = cpu_to_be64(delta);
+
+ err = t4_wr_mbox(adapter, adapter->mbox, &c, sizeof(c), NULL);
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
+index 4d09ea786b35..ee715bf785ad 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c
+@@ -398,7 +398,8 @@ static int cmdq_sync_cmd_direct_resp(struct hinic_cmdq *cmdq,
+
+ spin_unlock_bh(&cmdq->cmdq_lock);
+
+- if (!wait_for_completion_timeout(&done, CMDQ_TIMEOUT)) {
++ if (!wait_for_completion_timeout(&done,
++ msecs_to_jiffies(CMDQ_TIMEOUT))) {
+ spin_lock_bh(&cmdq->cmdq_lock);
+
+ if (cmdq->errcode[curr_prod_idx] == &errcode)
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c
+index 9deec13d98e9..4c91c8ceac5f 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c
+@@ -370,50 +370,6 @@ static int wait_for_db_state(struct hinic_hwdev *hwdev)
+ return -EFAULT;
+ }
+
+-static int wait_for_io_stopped(struct hinic_hwdev *hwdev)
+-{
+- struct hinic_cmd_io_status cmd_io_status;
+- struct hinic_hwif *hwif = hwdev->hwif;
+- struct pci_dev *pdev = hwif->pdev;
+- struct hinic_pfhwdev *pfhwdev;
+- unsigned long end;
+- u16 out_size;
+- int err;
+-
+- if (!HINIC_IS_PF(hwif) && !HINIC_IS_PPF(hwif)) {
+- dev_err(&pdev->dev, "Unsupported PCI Function type\n");
+- return -EINVAL;
+- }
+-
+- pfhwdev = container_of(hwdev, struct hinic_pfhwdev, hwdev);
+-
+- cmd_io_status.func_idx = HINIC_HWIF_FUNC_IDX(hwif);
+-
+- end = jiffies + msecs_to_jiffies(IO_STATUS_TIMEOUT);
+- do {
+- err = hinic_msg_to_mgmt(&pfhwdev->pf_to_mgmt, HINIC_MOD_COMM,
+- HINIC_COMM_CMD_IO_STATUS_GET,
+- &cmd_io_status, sizeof(cmd_io_status),
+- &cmd_io_status, &out_size,
+- HINIC_MGMT_MSG_SYNC);
+- if ((err) || (out_size != sizeof(cmd_io_status))) {
+- dev_err(&pdev->dev, "Failed to get IO status, ret = %d\n",
+- err);
+- return err;
+- }
+-
+- if (cmd_io_status.status == IO_STOPPED) {
+- dev_info(&pdev->dev, "IO stopped\n");
+- return 0;
+- }
+-
+- msleep(20);
+- } while (time_before(jiffies, end));
+-
+- dev_err(&pdev->dev, "Wait for IO stopped - Timeout\n");
+- return -ETIMEDOUT;
+-}
+-
+ /**
+ * clear_io_resource - set the IO resources as not active in the NIC
+ * @hwdev: the NIC HW device
+@@ -433,11 +389,8 @@ static int clear_io_resources(struct hinic_hwdev *hwdev)
+ return -EINVAL;
+ }
+
+- err = wait_for_io_stopped(hwdev);
+- if (err) {
+- dev_err(&pdev->dev, "IO has not stopped yet\n");
+- return err;
+- }
++ /* sleep 100ms to wait for firmware stopping I/O */
++ msleep(100);
+
+ cmd_clear_io_res.func_idx = HINIC_HWIF_FUNC_IDX(hwif);
+
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c
+index 278dc13f3dae..9fcf2e5e0003 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c
+@@ -52,7 +52,7 @@
+
+ #define MSG_NOT_RESP 0xFFFF
+
+-#define MGMT_MSG_TIMEOUT 1000
++#define MGMT_MSG_TIMEOUT 5000
+
+ #define mgmt_to_pfhwdev(pf_mgmt) \
+ container_of(pf_mgmt, struct hinic_pfhwdev, pf_to_mgmt)
+@@ -276,7 +276,8 @@ static int msg_to_mgmt_sync(struct hinic_pf_to_mgmt *pf_to_mgmt,
+ goto unlock_sync_msg;
+ }
+
+- if (!wait_for_completion_timeout(recv_done, MGMT_MSG_TIMEOUT)) {
++ if (!wait_for_completion_timeout(recv_done,
++ msecs_to_jiffies(MGMT_MSG_TIMEOUT))) {
+ dev_err(&pdev->dev, "MGMT timeout, MSG id = %d\n", msg_id);
+ err = -ETIMEDOUT;
+ goto unlock_sync_msg;
+diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.h b/drivers/net/ethernet/neterion/vxge/vxge-config.h
+index d743a37a3cee..e5dda2c27f18 100644
+--- a/drivers/net/ethernet/neterion/vxge/vxge-config.h
++++ b/drivers/net/ethernet/neterion/vxge/vxge-config.h
+@@ -2065,7 +2065,7 @@ vxge_hw_vpath_strip_fcs_check(struct __vxge_hw_device *hldev, u64 vpath_mask);
+ if ((level >= VXGE_ERR && VXGE_COMPONENT_LL & VXGE_DEBUG_ERR_MASK) || \
+ (level >= VXGE_TRACE && VXGE_COMPONENT_LL & VXGE_DEBUG_TRACE_MASK))\
+ if ((mask & VXGE_DEBUG_MASK) == mask) \
+- printk(fmt "\n", __VA_ARGS__); \
++ printk(fmt "\n", ##__VA_ARGS__); \
+ } while (0)
+ #else
+ #define vxge_debug_ll(level, mask, fmt, ...)
+diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.h b/drivers/net/ethernet/neterion/vxge/vxge-main.h
+index 59a57ff5e96a..9c86f4f9cd42 100644
+--- a/drivers/net/ethernet/neterion/vxge/vxge-main.h
++++ b/drivers/net/ethernet/neterion/vxge/vxge-main.h
+@@ -452,49 +452,49 @@ int vxge_fw_upgrade(struct vxgedev *vdev, char *fw_name, int override);
+
+ #if (VXGE_DEBUG_LL_CONFIG & VXGE_DEBUG_MASK)
+ #define vxge_debug_ll_config(level, fmt, ...) \
+- vxge_debug_ll(level, VXGE_DEBUG_LL_CONFIG, fmt, __VA_ARGS__)
++ vxge_debug_ll(level, VXGE_DEBUG_LL_CONFIG, fmt, ##__VA_ARGS__)
+ #else
+ #define vxge_debug_ll_config(level, fmt, ...)
+ #endif
+
+ #if (VXGE_DEBUG_INIT & VXGE_DEBUG_MASK)
+ #define vxge_debug_init(level, fmt, ...) \
+- vxge_debug_ll(level, VXGE_DEBUG_INIT, fmt, __VA_ARGS__)
++ vxge_debug_ll(level, VXGE_DEBUG_INIT, fmt, ##__VA_ARGS__)
+ #else
+ #define vxge_debug_init(level, fmt, ...)
+ #endif
+
+ #if (VXGE_DEBUG_TX & VXGE_DEBUG_MASK)
+ #define vxge_debug_tx(level, fmt, ...) \
+- vxge_debug_ll(level, VXGE_DEBUG_TX, fmt, __VA_ARGS__)
++ vxge_debug_ll(level, VXGE_DEBUG_TX, fmt, ##__VA_ARGS__)
+ #else
+ #define vxge_debug_tx(level, fmt, ...)
+ #endif
+
+ #if (VXGE_DEBUG_RX & VXGE_DEBUG_MASK)
+ #define vxge_debug_rx(level, fmt, ...) \
+- vxge_debug_ll(level, VXGE_DEBUG_RX, fmt, __VA_ARGS__)
++ vxge_debug_ll(level, VXGE_DEBUG_RX, fmt, ##__VA_ARGS__)
+ #else
+ #define vxge_debug_rx(level, fmt, ...)
+ #endif
+
+ #if (VXGE_DEBUG_MEM & VXGE_DEBUG_MASK)
+ #define vxge_debug_mem(level, fmt, ...) \
+- vxge_debug_ll(level, VXGE_DEBUG_MEM, fmt, __VA_ARGS__)
++ vxge_debug_ll(level, VXGE_DEBUG_MEM, fmt, ##__VA_ARGS__)
+ #else
+ #define vxge_debug_mem(level, fmt, ...)
+ #endif
+
+ #if (VXGE_DEBUG_ENTRYEXIT & VXGE_DEBUG_MASK)
+ #define vxge_debug_entryexit(level, fmt, ...) \
+- vxge_debug_ll(level, VXGE_DEBUG_ENTRYEXIT, fmt, __VA_ARGS__)
++ vxge_debug_ll(level, VXGE_DEBUG_ENTRYEXIT, fmt, ##__VA_ARGS__)
+ #else
+ #define vxge_debug_entryexit(level, fmt, ...)
+ #endif
+
+ #if (VXGE_DEBUG_INTR & VXGE_DEBUG_MASK)
+ #define vxge_debug_intr(level, fmt, ...) \
+- vxge_debug_ll(level, VXGE_DEBUG_INTR, fmt, __VA_ARGS__)
++ vxge_debug_ll(level, VXGE_DEBUG_INTR, fmt, ##__VA_ARGS__)
+ #else
+ #define vxge_debug_intr(level, fmt, ...)
+ #endif
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+index 07f9067affc6..cda5b0a9e948 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+@@ -1720,7 +1720,7 @@ static int qlcnic_83xx_get_reset_instruction_template(struct qlcnic_adapter *p_d
+
+ ahw->reset.seq_error = 0;
+ ahw->reset.buff = kzalloc(QLC_83XX_RESTART_TEMPLATE_SIZE, GFP_KERNEL);
+- if (p_dev->ahw->reset.buff == NULL)
++ if (ahw->reset.buff == NULL)
+ return -ENOMEM;
+
+ p_buff = p_dev->ahw->reset.buff;
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+index 37786affa975..7389648d0fea 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+@@ -288,7 +288,6 @@ static int rmnet_changelink(struct net_device *dev, struct nlattr *tb[],
+ {
+ struct rmnet_priv *priv = netdev_priv(dev);
+ struct net_device *real_dev;
+- struct rmnet_endpoint *ep;
+ struct rmnet_port *port;
+ u16 mux_id;
+
+@@ -303,19 +302,27 @@ static int rmnet_changelink(struct net_device *dev, struct nlattr *tb[],
+
+ if (data[IFLA_RMNET_MUX_ID]) {
+ mux_id = nla_get_u16(data[IFLA_RMNET_MUX_ID]);
+- if (rmnet_get_endpoint(port, mux_id)) {
+- NL_SET_ERR_MSG_MOD(extack, "MUX ID already exists");
+- return -EINVAL;
+- }
+- ep = rmnet_get_endpoint(port, priv->mux_id);
+- if (!ep)
+- return -ENODEV;
+
+- hlist_del_init_rcu(&ep->hlnode);
+- hlist_add_head_rcu(&ep->hlnode, &port->muxed_ep[mux_id]);
++ if (mux_id != priv->mux_id) {
++ struct rmnet_endpoint *ep;
++
++ ep = rmnet_get_endpoint(port, priv->mux_id);
++ if (!ep)
++ return -ENODEV;
+
+- ep->mux_id = mux_id;
+- priv->mux_id = mux_id;
++ if (rmnet_get_endpoint(port, mux_id)) {
++ NL_SET_ERR_MSG_MOD(extack,
++ "MUX ID already exists");
++ return -EINVAL;
++ }
++
++ hlist_del_init_rcu(&ep->hlnode);
++ hlist_add_head_rcu(&ep->hlnode,
++ &port->muxed_ep[mux_id]);
++
++ ep->mux_id = mux_id;
++ priv->mux_id = mux_id;
++ }
+ }
+
+ if (data[IFLA_RMNET_FLAGS]) {
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 74f98bbaea88..3e92b88045a5 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1457,6 +1457,9 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
+ ath_chanctx_set_channel(sc, ctx, &hw->conf.chandef);
+ }
+
++ if (changed & IEEE80211_CONF_CHANGE_POWER)
++ ath9k_set_txpower(sc, NULL);
++
+ mutex_unlock(&sc->mutex);
+ ath9k_ps_restore(sc);
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index a8132e8d72bb..d5359c7c811a 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2200,6 +2200,17 @@ static struct nvme_subsystem *__nvme_find_get_subsystem(const char *subsysnqn)
+
+ lockdep_assert_held(&nvme_subsystems_lock);
+
++ /*
++ * Fail matches for discovery subsystems. This results
++ * in each discovery controller bound to a unique subsystem.
++ * This avoids issues with validating controller values
++ * that can only be true when there is a single unique subsystem.
++ * There may be multiple and completely independent entities
++ * that provide discovery controllers.
++ */
++ if (!strcmp(subsysnqn, NVME_DISC_SUBSYS_NAME))
++ return NULL;
++
+ list_for_each_entry(subsys, &nvme_subsystems, entry) {
+ if (strcmp(subsys->subnqn, subsysnqn))
+ continue;
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 1875f6b8a907..ed43b06353a3 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -342,8 +342,7 @@ nvme_fc_register_localport(struct nvme_fc_port_info *pinfo,
+ !template->ls_req || !template->fcp_io ||
+ !template->ls_abort || !template->fcp_abort ||
+ !template->max_hw_queues || !template->max_sgl_segments ||
+- !template->max_dif_sgl_segments || !template->dma_boundary ||
+- !template->module) {
++ !template->max_dif_sgl_segments || !template->dma_boundary) {
+ ret = -EINVAL;
+ goto out_reghost_failed;
+ }
+@@ -1987,7 +1986,6 @@ nvme_fc_ctrl_free(struct kref *ref)
+ {
+ struct nvme_fc_ctrl *ctrl =
+ container_of(ref, struct nvme_fc_ctrl, ref);
+- struct nvme_fc_lport *lport = ctrl->lport;
+ unsigned long flags;
+
+ if (ctrl->ctrl.tagset) {
+@@ -2013,7 +2011,6 @@ nvme_fc_ctrl_free(struct kref *ref)
+ if (ctrl->ctrl.opts)
+ nvmf_free_options(ctrl->ctrl.opts);
+ kfree(ctrl);
+- module_put(lport->ops->module);
+ }
+
+ static void
+@@ -3055,15 +3052,10 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
+ goto out_fail;
+ }
+
+- if (!try_module_get(lport->ops->module)) {
+- ret = -EUNATCH;
+- goto out_free_ctrl;
+- }
+-
+ idx = ida_simple_get(&nvme_fc_ctrl_cnt, 0, 0, GFP_KERNEL);
+ if (idx < 0) {
+ ret = -ENOSPC;
+- goto out_mod_put;
++ goto out_free_ctrl;
+ }
+
+ ctrl->ctrl.opts = opts;
+@@ -3205,8 +3197,6 @@ out_free_queues:
+ out_free_ida:
+ put_device(ctrl->dev);
+ ida_simple_remove(&nvme_fc_ctrl_cnt, ctrl->cnum);
+-out_mod_put:
+- module_put(lport->ops->module);
+ out_free_ctrl:
+ kfree(ctrl);
+ out_fail:
+diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
+index f0536d341f2f..291f4121f516 100644
+--- a/drivers/nvme/target/fcloop.c
++++ b/drivers/nvme/target/fcloop.c
+@@ -825,7 +825,6 @@ fcloop_targetport_delete(struct nvmet_fc_target_port *targetport)
+ #define FCLOOP_DMABOUND_4G 0xFFFFFFFF
+
+ static struct nvme_fc_port_template fctemplate = {
+- .module = THIS_MODULE,
+ .localport_delete = fcloop_localport_delete,
+ .remoteport_delete = fcloop_remoteport_delete,
+ .create_queue = fcloop_create_queue,
+diff --git a/drivers/pci/endpoint/pci-epc-mem.c b/drivers/pci/endpoint/pci-epc-mem.c
+index 2bf8bd1f0563..0471643cf536 100644
+--- a/drivers/pci/endpoint/pci-epc-mem.c
++++ b/drivers/pci/endpoint/pci-epc-mem.c
+@@ -79,6 +79,7 @@ int __pci_epc_mem_init(struct pci_epc *epc, phys_addr_t phys_base, size_t size,
+ mem->page_size = page_size;
+ mem->pages = pages;
+ mem->size = size;
++ mutex_init(&mem->lock);
+
+ epc->mem = mem;
+
+@@ -122,7 +123,7 @@ void __iomem *pci_epc_mem_alloc_addr(struct pci_epc *epc,
+ phys_addr_t *phys_addr, size_t size)
+ {
+ int pageno;
+- void __iomem *virt_addr;
++ void __iomem *virt_addr = NULL;
+ struct pci_epc_mem *mem = epc->mem;
+ unsigned int page_shift = ilog2(mem->page_size);
+ int order;
+@@ -130,15 +131,18 @@ void __iomem *pci_epc_mem_alloc_addr(struct pci_epc *epc,
+ size = ALIGN(size, mem->page_size);
+ order = pci_epc_mem_get_order(mem, size);
+
++ mutex_lock(&mem->lock);
+ pageno = bitmap_find_free_region(mem->bitmap, mem->pages, order);
+ if (pageno < 0)
+- return NULL;
++ goto ret;
+
+ *phys_addr = mem->phys_base + (pageno << page_shift);
+ virt_addr = ioremap(*phys_addr, size);
+ if (!virt_addr)
+ bitmap_release_region(mem->bitmap, pageno, order);
+
++ret:
++ mutex_unlock(&mem->lock);
+ return virt_addr;
+ }
+ EXPORT_SYMBOL_GPL(pci_epc_mem_alloc_addr);
+@@ -164,7 +168,9 @@ void pci_epc_mem_free_addr(struct pci_epc *epc, phys_addr_t phys_addr,
+ pageno = (phys_addr - mem->phys_base) >> page_shift;
+ size = ALIGN(size, mem->page_size);
+ order = pci_epc_mem_get_order(mem, size);
++ mutex_lock(&mem->lock);
+ bitmap_release_region(mem->bitmap, pageno, order);
++ mutex_unlock(&mem->lock);
+ }
+ EXPORT_SYMBOL_GPL(pci_epc_mem_free_addr);
+
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index c3e3f5358b3b..07940d1d83b7 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -627,17 +627,15 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
+ if (atomic_fetch_and(~RERUN_ISR, &ctrl->pending_events) & RERUN_ISR) {
+ ret = pciehp_isr(irq, dev_id);
+ enable_irq(irq);
+- if (ret != IRQ_WAKE_THREAD) {
+- pci_config_pm_runtime_put(pdev);
+- return ret;
+- }
++ if (ret != IRQ_WAKE_THREAD)
++ goto out;
+ }
+
+ synchronize_hardirq(irq);
+ events = atomic_xchg(&ctrl->pending_events, 0);
+ if (!events) {
+- pci_config_pm_runtime_put(pdev);
+- return IRQ_NONE;
++ ret = IRQ_NONE;
++ goto out;
+ }
+
+ /* Check Attention Button Pressed */
+@@ -666,10 +664,12 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
+ pciehp_handle_presence_or_link_change(slot, events);
+ up_read(&ctrl->reset_lock);
+
++ ret = IRQ_HANDLED;
++out:
+ pci_config_pm_runtime_put(pdev);
+ ctrl->ist_running = false;
+ wake_up(&ctrl->requester);
+- return IRQ_HANDLED;
++ return ret;
+ }
+
+ static int pciehp_poll(void *data)
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 1117b25fbe0b..af79a7168677 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -747,9 +747,9 @@ static void pcie_config_aspm_l1ss(struct pcie_link_state *link, u32 state)
+
+ /* Enable what we need to enable */
+ pci_clear_and_set_dword(parent, up_cap_ptr + PCI_L1SS_CTL1,
+- PCI_L1SS_CAP_L1_PM_SS, val);
++ PCI_L1SS_CTL1_L1SS_MASK, val);
+ pci_clear_and_set_dword(child, dw_cap_ptr + PCI_L1SS_CTL1,
+- PCI_L1SS_CAP_L1_PM_SS, val);
++ PCI_L1SS_CTL1_L1SS_MASK, val);
+ }
+
+ static void pcie_config_aspm_dev(struct pci_dev *pdev, u32 val)
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 419dda6dbd16..9e20ace30b62 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1947,26 +1947,92 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_80332_1, quirk
+ /*
+ * IO-APIC1 on 6300ESB generates boot interrupts, see Intel order no
+ * 300641-004US, section 5.7.3.
++ *
++ * Core IO on Xeon E5 1600/2600/4600, see Intel order no 326509-003.
++ * Core IO on Xeon E5 v2, see Intel order no 329188-003.
++ * Core IO on Xeon E7 v2, see Intel order no 329595-002.
++ * Core IO on Xeon E5 v3, see Intel order no 330784-003.
++ * Core IO on Xeon E7 v3, see Intel order no 332315-001US.
++ * Core IO on Xeon E5 v4, see Intel order no 333810-002US.
++ * Core IO on Xeon E7 v4, see Intel order no 332315-001US.
++ * Core IO on Xeon D-1500, see Intel order no 332051-001.
++ * Core IO on Xeon Scalable, see Intel order no 610950.
+ */
+-#define INTEL_6300_IOAPIC_ABAR 0x40
++#define INTEL_6300_IOAPIC_ABAR 0x40 /* Bus 0, Dev 29, Func 5 */
+ #define INTEL_6300_DISABLE_BOOT_IRQ (1<<14)
+
++#define INTEL_CIPINTRC_CFG_OFFSET 0x14C /* Bus 0, Dev 5, Func 0 */
++#define INTEL_CIPINTRC_DIS_INTX_ICH (1<<25)
++
+ static void quirk_disable_intel_boot_interrupt(struct pci_dev *dev)
+ {
+ u16 pci_config_word;
++ u32 pci_config_dword;
+
+ if (noioapicquirk)
+ return;
+
+- pci_read_config_word(dev, INTEL_6300_IOAPIC_ABAR, &pci_config_word);
+- pci_config_word |= INTEL_6300_DISABLE_BOOT_IRQ;
+- pci_write_config_word(dev, INTEL_6300_IOAPIC_ABAR, pci_config_word);
+-
++ switch (dev->device) {
++ case PCI_DEVICE_ID_INTEL_ESB_10:
++ pci_read_config_word(dev, INTEL_6300_IOAPIC_ABAR,
++ &pci_config_word);
++ pci_config_word |= INTEL_6300_DISABLE_BOOT_IRQ;
++ pci_write_config_word(dev, INTEL_6300_IOAPIC_ABAR,
++ pci_config_word);
++ break;
++ case 0x3c28: /* Xeon E5 1600/2600/4600 */
++ case 0x0e28: /* Xeon E5/E7 V2 */
++ case 0x2f28: /* Xeon E5/E7 V3,V4 */
++ case 0x6f28: /* Xeon D-1500 */
++ case 0x2034: /* Xeon Scalable Family */
++ pci_read_config_dword(dev, INTEL_CIPINTRC_CFG_OFFSET,
++ &pci_config_dword);
++ pci_config_dword |= INTEL_CIPINTRC_DIS_INTX_ICH;
++ pci_write_config_dword(dev, INTEL_CIPINTRC_CFG_OFFSET,
++ pci_config_dword);
++ break;
++ default:
++ return;
++ }
+ pci_info(dev, "disabled boot interrupts on device [%04x:%04x]\n",
+ dev->vendor, dev->device);
+ }
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ESB_10, quirk_disable_intel_boot_interrupt);
+-DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ESB_10, quirk_disable_intel_boot_interrupt);
++/*
++ * Device 29 Func 5 Device IDs of IO-APIC
++ * containing ABAR—APIC1 Alternate Base Address Register
++ */
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ESB_10,
++ quirk_disable_intel_boot_interrupt);
++DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ESB_10,
++ quirk_disable_intel_boot_interrupt);
++
++/*
++ * Device 5 Func 0 Device IDs of Core IO modules/hubs
++ * containing Coherent Interface Protocol Interrupt Control
++ *
++ * Device IDs obtained from volume 2 datasheets of commented
++ * families above.
++ */
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x3c28,
++ quirk_disable_intel_boot_interrupt);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0e28,
++ quirk_disable_intel_boot_interrupt);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x2f28,
++ quirk_disable_intel_boot_interrupt);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x6f28,
++ quirk_disable_intel_boot_interrupt);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x2034,
++ quirk_disable_intel_boot_interrupt);
++DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL, 0x3c28,
++ quirk_disable_intel_boot_interrupt);
++DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL, 0x0e28,
++ quirk_disable_intel_boot_interrupt);
++DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL, 0x2f28,
++ quirk_disable_intel_boot_interrupt);
++DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL, 0x6f28,
++ quirk_disable_intel_boot_interrupt);
++DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL, 0x2034,
++ quirk_disable_intel_boot_interrupt);
+
+ /* Disable boot interrupts on HT-1000 */
+ #define BC_HT1000_FEATURE_REG 0x64
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index 43431816412c..291c0074ad6f 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -147,7 +147,7 @@ static int mrpc_queue_cmd(struct switchtec_user *stuser)
+ kref_get(&stuser->kref);
+ stuser->read_len = sizeof(stuser->data);
+ stuser_set_state(stuser, MRPC_QUEUED);
+- init_completion(&stuser->comp);
++ reinit_completion(&stuser->comp);
+ list_add_tail(&stuser->list, &stdev->mrpc_queue);
+
+ mrpc_cmd_submit(stdev);
+diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
+index 323ff55cc165..080211dd916a 100644
+--- a/drivers/rtc/rtc-omap.c
++++ b/drivers/rtc/rtc-omap.c
+@@ -561,9 +561,7 @@ static const struct pinctrl_ops rtc_pinctrl_ops = {
+ .dt_free_map = pinconf_generic_dt_free_map,
+ };
+
+-enum rtc_pin_config_param {
+- PIN_CONFIG_ACTIVE_HIGH = PIN_CONFIG_END + 1,
+-};
++#define PIN_CONFIG_ACTIVE_HIGH (PIN_CONFIG_END + 1)
+
+ static const struct pinconf_generic_params rtc_params[] = {
+ {"ti,active-high", PIN_CONFIG_ACTIVE_HIGH, 0},
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index f602b42b8343..7522aa06672d 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -738,7 +738,7 @@ static void zfcp_erp_enqueue_ptp_port(struct zfcp_adapter *adapter)
+ adapter->peer_d_id);
+ if (IS_ERR(port)) /* error or port already attached */
+ return;
+- _zfcp_erp_port_reopen(port, 0, "ereptp1");
++ zfcp_erp_port_reopen(port, 0, "ereptp1");
+ }
+
+ static int zfcp_erp_adapter_strat_fsf_xconf(struct zfcp_erp_action *erp_action)
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index 6c355d87c709..f73726e55e44 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -1903,8 +1903,6 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport,
+
+ /* Declare and initialization an instance of the FC NVME template. */
+ static struct nvme_fc_port_template lpfc_nvme_template = {
+- .module = THIS_MODULE,
+-
+ /* initiator-based functions */
+ .localport_delete = lpfc_nvme_localport_delete,
+ .remoteport_delete = lpfc_nvme_remoteport_delete,
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index d3c944d99703..5a5e5c3da657 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -9841,8 +9841,8 @@ static void scsih_remove(struct pci_dev *pdev)
+
+ ioc->remove_host = 1;
+
+- mpt3sas_wait_for_commands_to_complete(ioc);
+- _scsih_flush_running_cmds(ioc);
++ if (!pci_device_is_present(pdev))
++ _scsih_flush_running_cmds(ioc);
+
+ _scsih_fw_event_cleanup_queue(ioc);
+
+@@ -9919,8 +9919,8 @@ scsih_shutdown(struct pci_dev *pdev)
+
+ ioc->remove_host = 1;
+
+- mpt3sas_wait_for_commands_to_complete(ioc);
+- _scsih_flush_running_cmds(ioc);
++ if (!pci_device_is_present(pdev))
++ _scsih_flush_running_cmds(ioc);
+
+ _scsih_fw_event_cleanup_queue(ioc);
+
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index db367e428095..5590d6e8b576 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -560,7 +560,6 @@ static void qla_nvme_remoteport_delete(struct nvme_fc_remote_port *rport)
+ }
+
+ static struct nvme_fc_port_template qla_nvme_fc_transport = {
+- .module = THIS_MODULE,
+ .localport_delete = qla_nvme_localport_delete,
+ .remoteport_delete = qla_nvme_remoteport_delete,
+ .create_queue = qla_nvme_alloc_queue,
+diff --git a/drivers/staging/erofs/utils.c b/drivers/staging/erofs/utils.c
+index 2d96820da62e..4de9c39535eb 100644
+--- a/drivers/staging/erofs/utils.c
++++ b/drivers/staging/erofs/utils.c
+@@ -309,7 +309,7 @@ unsigned long erofs_shrink_scan(struct shrinker *shrink,
+ sbi->shrinker_run_no = run_no;
+
+ #ifdef CONFIG_EROFS_FS_ZIP
+- freed += erofs_shrink_workstation(sbi, nr, false);
++ freed += erofs_shrink_workstation(sbi, nr - freed, false);
+ #endif
+
+ spin_lock(&erofs_sb_list_lock);
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 6666d2a52bf5..60d08269ad9a 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -981,6 +981,9 @@ static int dwc3_core_init(struct dwc3 *dwc)
+ if (dwc->dis_tx_ipgap_linecheck_quirk)
+ reg |= DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS;
+
++ if (dwc->parkmode_disable_ss_quirk)
++ reg |= DWC3_GUCTL1_PARKMODE_DISABLE_SS;
++
+ dwc3_writel(dwc->regs, DWC3_GUCTL1, reg);
+ }
+
+@@ -1287,6 +1290,8 @@ static void dwc3_get_properties(struct dwc3 *dwc)
+ "snps,dis-del-phy-power-chg-quirk");
+ dwc->dis_tx_ipgap_linecheck_quirk = device_property_read_bool(dev,
+ "snps,dis-tx-ipgap-linecheck-quirk");
++ dwc->parkmode_disable_ss_quirk = device_property_read_bool(dev,
++ "snps,parkmode-disable-ss-quirk");
+
+ dwc->tx_de_emphasis_quirk = device_property_read_bool(dev,
+ "snps,tx_de_emphasis_quirk");
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index 131028501752..e34308d64619 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -242,6 +242,7 @@
+ #define DWC3_GUCTL_HSTINAUTORETRY BIT(14)
+
+ /* Global User Control 1 Register */
++#define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17)
+ #define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS BIT(28)
+ #define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW BIT(24)
+
+@@ -992,6 +993,8 @@ struct dwc3_scratchpad_array {
+ * change quirk.
+ * @dis_tx_ipgap_linecheck_quirk: set if we disable u2mac linestate
+ * check during HS transmit.
++ * @parkmode_disable_ss_quirk: set if we need to disable all SuperSpeed
++ * instances in park mode.
+ * @tx_de_emphasis_quirk: set if we enable Tx de-emphasis quirk
+ * @tx_de_emphasis: Tx de-emphasis value
+ * 0 - -6dB de-emphasis
+@@ -1163,6 +1166,7 @@ struct dwc3 {
+ unsigned dis_u2_freeclk_exists_quirk:1;
+ unsigned dis_del_phy_power_chg_quirk:1;
+ unsigned dis_tx_ipgap_linecheck_quirk:1;
++ unsigned parkmode_disable_ss_quirk:1;
+
+ unsigned tx_de_emphasis_quirk:1;
+ unsigned tx_de_emphasis:2;
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 30aefd1adbad..f3436913fd3f 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -847,6 +847,11 @@ static int set_config(struct usb_composite_dev *cdev,
+ else
+ power = min(power, 900U);
+ done:
++ if (power <= USB_SELF_POWER_VBUS_MAX_DRAW)
++ usb_gadget_set_selfpowered(gadget);
++ else
++ usb_gadget_clear_selfpowered(gadget);
++
+ usb_gadget_vbus_draw(gadget, power);
+ if (result >= 0 && cdev->delayed_status)
+ result = USB_GADGET_DELAYED_STATUS;
+@@ -2265,6 +2270,7 @@ void composite_suspend(struct usb_gadget *gadget)
+
+ cdev->suspended = 1;
+
++ usb_gadget_set_selfpowered(gadget);
+ usb_gadget_vbus_draw(gadget, 2);
+ }
+
+@@ -2293,6 +2299,9 @@ void composite_resume(struct usb_gadget *gadget)
+ else
+ maxpower = min(maxpower, 900U);
+
++ if (maxpower > USB_SELF_POWER_VBUS_MAX_DRAW)
++ usb_gadget_clear_selfpowered(gadget);
++
+ usb_gadget_vbus_draw(gadget, maxpower);
+ }
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index a9239455eb6d..31b3dda3089c 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1036,6 +1036,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
+
+ ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
+ if (unlikely(ret)) {
++ io_data->req = NULL;
+ usb_ep_free_request(ep->ep, req);
+ goto error_lock;
+ }
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 65cc362717fc..b4177287d7d0 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1147,8 +1147,10 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ xhci_dbg(xhci, "Stop HCD\n");
+ xhci_halt(xhci);
+ xhci_zero_64b_regs(xhci);
+- xhci_reset(xhci);
++ retval = xhci_reset(xhci);
+ spin_unlock_irq(&xhci->lock);
++ if (retval)
++ return retval;
+ xhci_cleanup_msix(xhci);
+
+ xhci_dbg(xhci, "// Disabling event ring interrupts\n");
+diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
+index 02e4e903dfe9..f79c0cb7697a 100644
+--- a/fs/btrfs/async-thread.c
++++ b/fs/btrfs/async-thread.c
+@@ -434,3 +434,11 @@ void btrfs_set_work_high_priority(struct btrfs_work *work)
+ {
+ set_bit(WORK_HIGH_PRIO_BIT, &work->flags);
+ }
++
++void btrfs_flush_workqueue(struct btrfs_workqueue *wq)
++{
++ if (wq->high)
++ flush_workqueue(wq->high->normal_wq);
++
++ flush_workqueue(wq->normal->normal_wq);
++}
+diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h
+index 7861c9feba5f..e87be7c8be58 100644
+--- a/fs/btrfs/async-thread.h
++++ b/fs/btrfs/async-thread.h
+@@ -73,5 +73,6 @@ void btrfs_set_work_high_priority(struct btrfs_work *work);
+ struct btrfs_fs_info *btrfs_work_owner(const struct btrfs_work *work);
+ struct btrfs_fs_info *btrfs_workqueue_owner(const struct __btrfs_workqueue *wq);
+ bool btrfs_workqueue_normal_congested(const struct btrfs_workqueue *wq);
++void btrfs_flush_workqueue(struct btrfs_workqueue *wq);
+
+ #endif
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index e9522f2f25cc..7374fb23381c 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -6,6 +6,7 @@
+
+ #include <linux/slab.h>
+ #include <linux/iversion.h>
++#include <linux/sched/mm.h>
+ #include "delayed-inode.h"
+ #include "disk-io.h"
+ #include "transaction.h"
+@@ -801,11 +802,14 @@ static int btrfs_insert_delayed_item(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_item *delayed_item)
+ {
+ struct extent_buffer *leaf;
++ unsigned int nofs_flag;
+ char *ptr;
+ int ret;
+
++ nofs_flag = memalloc_nofs_save();
+ ret = btrfs_insert_empty_item(trans, root, path, &delayed_item->key,
+ delayed_item->data_len);
++ memalloc_nofs_restore(nofs_flag);
+ if (ret < 0 && ret != -EEXIST)
+ return ret;
+
+@@ -933,6 +937,7 @@ static int btrfs_delete_delayed_items(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_node *node)
+ {
+ struct btrfs_delayed_item *curr, *prev;
++ unsigned int nofs_flag;
+ int ret = 0;
+
+ do_again:
+@@ -941,7 +946,9 @@ do_again:
+ if (!curr)
+ goto delete_fail;
+
++ nofs_flag = memalloc_nofs_save();
+ ret = btrfs_search_slot(trans, root, &curr->key, path, -1, 1);
++ memalloc_nofs_restore(nofs_flag);
+ if (ret < 0)
+ goto delete_fail;
+ else if (ret > 0) {
+@@ -1008,6 +1015,7 @@ static int __btrfs_update_delayed_inode(struct btrfs_trans_handle *trans,
+ struct btrfs_key key;
+ struct btrfs_inode_item *inode_item;
+ struct extent_buffer *leaf;
++ unsigned int nofs_flag;
+ int mod;
+ int ret;
+
+@@ -1020,7 +1028,9 @@ static int __btrfs_update_delayed_inode(struct btrfs_trans_handle *trans,
+ else
+ mod = 1;
+
++ nofs_flag = memalloc_nofs_save();
+ ret = btrfs_lookup_inode(trans, root, path, &key, mod);
++ memalloc_nofs_restore(nofs_flag);
+ if (ret > 0) {
+ btrfs_release_path(path);
+ return -ENOENT;
+@@ -1071,7 +1081,10 @@ search:
+
+ key.type = BTRFS_INODE_EXTREF_KEY;
+ key.offset = -1;
++
++ nofs_flag = memalloc_nofs_save();
+ ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
++ memalloc_nofs_restore(nofs_flag);
+ if (ret < 0)
+ goto err_out;
+ ASSERT(ret);
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index b5039b16de93..da7a2a530647 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -3007,6 +3007,18 @@ retry_root_backup:
+ fs_info->generation = generation;
+ fs_info->last_trans_committed = generation;
+
++ /*
++ * If we have a uuid root and we're not being told to rescan we need to
++ * check the generation here so we can set the
++ * BTRFS_FS_UPDATE_UUID_TREE_GEN bit. Otherwise we could commit the
++ * transaction during a balance or the log replay without updating the
++ * uuid generation, and then if we crash we would rescan the uuid tree,
++ * even though it was perfectly fine.
++ */
++ if (fs_info->uuid_root && !btrfs_test_opt(fs_info, RESCAN_UUID_TREE) &&
++ fs_info->generation == btrfs_super_uuid_tree_generation(disk_super))
++ set_bit(BTRFS_FS_UPDATE_UUID_TREE_GEN, &fs_info->flags);
++
+ ret = btrfs_verify_dev_extents(fs_info);
+ if (ret) {
+ btrfs_err(fs_info,
+@@ -3237,8 +3249,6 @@ retry_root_backup:
+ close_ctree(fs_info);
+ return ret;
+ }
+- } else {
+- set_bit(BTRFS_FS_UPDATE_UUID_TREE_GEN, &fs_info->flags);
+ }
+ set_bit(BTRFS_FS_OPEN, &fs_info->flags);
+
+@@ -3949,6 +3959,19 @@ void close_ctree(struct btrfs_fs_info *fs_info)
+ */
+ btrfs_delete_unused_bgs(fs_info);
+
++ /*
++ * There might be existing delayed inode workers still running
++ * and holding an empty delayed inode item. We must wait for
++ * them to complete first because they can create a transaction.
++ * This happens when someone calls btrfs_balance_delayed_items()
++ * and then a transaction commit runs the same delayed nodes
++ * before any delayed worker has done something with the nodes.
++ * We must wait for any worker here and not at transaction
++ * commit time since that could cause a deadlock.
++ * This is a very rare case.
++ */
++ btrfs_flush_workqueue(fs_info->delayed_workers);
++
+ ret = btrfs_commit_super(fs_info);
+ if (ret)
+ btrfs_err(fs_info, "commit super ret %d", ret);
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index c2c93fe9d7fd..dc1841855a69 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -2073,6 +2073,16 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+
+ btrfs_init_log_ctx(&ctx, inode);
+
++ /*
++ * Set the range to full if the NO_HOLES feature is not enabled.
++ * This is to avoid missing file extent items representing holes after
++ * replaying the log.
++ */
++ if (!btrfs_fs_incompat(fs_info, NO_HOLES)) {
++ start = 0;
++ end = LLONG_MAX;
++ }
++
+ /*
+ * We write the dirty pages in the range and wait until they complete
+ * out of the ->i_mutex. If so, we can flush the dirty pages by
+@@ -2127,6 +2137,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ */
+ ret = start_ordered_ops(inode, start, end);
+ if (ret) {
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+ goto out;
+ }
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 0cd043f03081..cbd40826f5dc 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -1032,6 +1032,7 @@ out_add_root:
+ ret = qgroup_rescan_init(fs_info, 0, 1);
+ if (!ret) {
+ qgroup_rescan_zero_tracking(fs_info);
++ fs_info->qgroup_rescan_running = true;
+ btrfs_queue_work(fs_info->qgroup_rescan_workers,
+ &fs_info->qgroup_rescan_work);
+ }
+@@ -2906,7 +2907,6 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid,
+ sizeof(fs_info->qgroup_rescan_progress));
+ fs_info->qgroup_rescan_progress.objectid = progress_objectid;
+ init_completion(&fs_info->qgroup_rescan_completion);
+- fs_info->qgroup_rescan_running = true;
+
+ spin_unlock(&fs_info->qgroup_lock);
+ mutex_unlock(&fs_info->qgroup_rescan_lock);
+@@ -2972,8 +2972,11 @@ btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info)
+
+ qgroup_rescan_zero_tracking(fs_info);
+
++ mutex_lock(&fs_info->qgroup_rescan_lock);
++ fs_info->qgroup_rescan_running = true;
+ btrfs_queue_work(fs_info->qgroup_rescan_workers,
+ &fs_info->qgroup_rescan_work);
++ mutex_unlock(&fs_info->qgroup_rescan_lock);
+
+ return 0;
+ }
+@@ -3009,9 +3012,13 @@ int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,
+ void
+ btrfs_qgroup_rescan_resume(struct btrfs_fs_info *fs_info)
+ {
+- if (fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN)
++ if (fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN) {
++ mutex_lock(&fs_info->qgroup_rescan_lock);
++ fs_info->qgroup_rescan_running = true;
+ btrfs_queue_work(fs_info->qgroup_rescan_workers,
+ &fs_info->qgroup_rescan_work);
++ mutex_unlock(&fs_info->qgroup_rescan_lock);
++ }
+ }
+
+ /*
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index f98913061a40..d1c5cd90b182 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1141,7 +1141,7 @@ out:
+ free_backref_node(cache, lower);
+ }
+
+- free_backref_node(cache, node);
++ remove_backref_node(cache, node);
+ return ERR_PTR(err);
+ }
+ ASSERT(!node || !node->detached);
+@@ -1253,7 +1253,7 @@ static int __must_check __add_reloc_root(struct btrfs_root *root)
+ if (!node)
+ return -ENOMEM;
+
+- node->bytenr = root->node->start;
++ node->bytenr = root->commit_root->start;
+ node->data = root;
+
+ spin_lock(&rc->reloc_root_tree.lock);
+@@ -1284,10 +1284,11 @@ static void __del_reloc_root(struct btrfs_root *root)
+ if (rc && root->node) {
+ spin_lock(&rc->reloc_root_tree.lock);
+ rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+- root->node->start);
++ root->commit_root->start);
+ if (rb_node) {
+ node = rb_entry(rb_node, struct mapping_node, rb_node);
+ rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
++ RB_CLEAR_NODE(&node->rb_node);
+ }
+ spin_unlock(&rc->reloc_root_tree.lock);
+ if (!node)
+@@ -1305,7 +1306,7 @@ static void __del_reloc_root(struct btrfs_root *root)
+ * helper to update the 'address of tree root -> reloc tree'
+ * mapping
+ */
+-static int __update_reloc_root(struct btrfs_root *root, u64 new_bytenr)
++static int __update_reloc_root(struct btrfs_root *root)
+ {
+ struct btrfs_fs_info *fs_info = root->fs_info;
+ struct rb_node *rb_node;
+@@ -1314,7 +1315,7 @@ static int __update_reloc_root(struct btrfs_root *root, u64 new_bytenr)
+
+ spin_lock(&rc->reloc_root_tree.lock);
+ rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+- root->node->start);
++ root->commit_root->start);
+ if (rb_node) {
+ node = rb_entry(rb_node, struct mapping_node, rb_node);
+ rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
+@@ -1326,7 +1327,7 @@ static int __update_reloc_root(struct btrfs_root *root, u64 new_bytenr)
+ BUG_ON((struct btrfs_root *)node->data != root);
+
+ spin_lock(&rc->reloc_root_tree.lock);
+- node->bytenr = new_bytenr;
++ node->bytenr = root->node->start;
+ rb_node = tree_insert(&rc->reloc_root_tree.rb_root,
+ node->bytenr, &node->rb_node);
+ spin_unlock(&rc->reloc_root_tree.lock);
+@@ -1471,6 +1472,7 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans,
+ }
+
+ if (reloc_root->commit_root != reloc_root->node) {
++ __update_reloc_root(reloc_root);
+ btrfs_set_root_node(root_item, reloc_root->node);
+ free_extent_buffer(reloc_root->commit_root);
+ reloc_root->commit_root = btrfs_root_node(reloc_root);
+@@ -2434,7 +2436,21 @@ out:
+ free_reloc_roots(&reloc_roots);
+ }
+
+- BUG_ON(!RB_EMPTY_ROOT(&rc->reloc_root_tree.rb_root));
++ /*
++ * We used to have
++ *
++ * BUG_ON(!RB_EMPTY_ROOT(&rc->reloc_root_tree.rb_root));
++ *
++ * here, but it's wrong. If we fail to start the transaction in
++ * prepare_to_merge() we will have only 0 ref reloc roots, none of which
++ * have actually been removed from the reloc_root_tree rb tree. This is
++ * fine because we're bailing here, and we hold a reference on the root
++ * for the list that holds it, so these roots will be cleaned up when we
++ * do the reloc_dirty_list afterwards. Meanwhile the root->reloc_root
++ * will be cleaned up on unmount.
++ *
++ * The remaining nodes will be cleaned up by free_reloc_control.
++ */
+ }
+
+ static void free_block_list(struct rb_root *blocks)
+@@ -4585,11 +4601,6 @@ int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,
+ BUG_ON(rc->stage == UPDATE_DATA_PTRS &&
+ root->root_key.objectid == BTRFS_DATA_RELOC_TREE_OBJECTID);
+
+- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
+- if (buf == root->node)
+- __update_reloc_root(root, cow->start);
+- }
+-
+ level = btrfs_header_level(buf);
+ if (btrfs_header_generation(buf) <=
+ btrfs_root_last_snapshot(&root->root_item))
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index ad93b063f866..cfb0d91289ec 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -3339,7 +3339,7 @@ again:
+ if (rc == -ENODATA)
+ rc = 0;
+
+- ctx->rc = (rc == 0) ? ctx->total_len : rc;
++ ctx->rc = (rc == 0) ? (ssize_t)ctx->total_len : rc;
+
+ mutex_unlock(&ctx->aio_mutex);
+
+diff --git a/fs/exec.c b/fs/exec.c
+index 561ea64829ec..3818813d725d 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1378,7 +1378,7 @@ void setup_new_exec(struct linux_binprm * bprm)
+
+ /* An exec changes our domain. We are no longer part of the thread
+ group */
+- current->self_exec_id++;
++ WRITE_ONCE(current->self_exec_id, current->self_exec_id + 1);
+ flush_signal_handlers(current, 0);
+ }
+ EXPORT_SYMBOL(setup_new_exec);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 23b4b1745a39..56218c79a856 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5140,7 +5140,7 @@ static int ext4_inode_blocks_set(handle_t *handle,
+ struct ext4_inode_info *ei)
+ {
+ struct inode *inode = &(ei->vfs_inode);
+- u64 i_blocks = inode->i_blocks;
++ u64 i_blocks = READ_ONCE(inode->i_blocks);
+ struct super_block *sb = inode->i_sb;
+
+ if (i_blocks <= ~0U) {
+diff --git a/fs/filesystems.c b/fs/filesystems.c
+index b03f57b1105b..181200daeeba 100644
+--- a/fs/filesystems.c
++++ b/fs/filesystems.c
+@@ -267,7 +267,9 @@ struct file_system_type *get_fs_type(const char *name)
+ fs = __get_fs_type(name, len);
+ if (!fs && (request_module("fs-%.*s", len, name) == 0)) {
+ fs = __get_fs_type(name, len);
+- WARN_ONCE(!fs, "request_module fs-%.*s succeeded, but still no fs?\n", len, name);
++ if (!fs)
++ pr_warn_once("request_module fs-%.*s succeeded, but still no fs?\n",
++ len, name);
+ }
+
+ if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index ccdd8c821abd..f8a5eef3d014 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -636,6 +636,9 @@ __acquires(&gl->gl_lockref.lock)
+ goto out_unlock;
+ if (nonblock)
+ goto out_sched;
++ smp_mb();
++ if (atomic_read(&gl->gl_revokes) != 0)
++ goto out_sched;
+ set_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
+ GLOCK_BUG_ON(gl, gl->gl_demote_state == LM_ST_EXCLUSIVE);
+ gl->gl_target = gl->gl_demote_state;
+diff --git a/fs/hfsplus/attributes.c b/fs/hfsplus/attributes.c
+index e6d554476db4..eeebe80c6be4 100644
+--- a/fs/hfsplus/attributes.c
++++ b/fs/hfsplus/attributes.c
+@@ -292,6 +292,10 @@ static int __hfsplus_delete_attr(struct inode *inode, u32 cnid,
+ return -ENOENT;
+ }
+
++ /* Avoid btree corruption */
++ hfs_bnode_read(fd->bnode, fd->search_key,
++ fd->keyoffset, fd->keylength);
++
+ err = hfs_brec_remove(fd);
+ if (err)
+ return err;
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index ce1da8cbac00..63d20308a9bb 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -432,6 +432,7 @@ nfs_destroy_unlinked_subrequests(struct nfs_page *destroy_list,
+ }
+
+ subreq->wb_head = subreq;
++ nfs_release_request(old_head);
+
+ if (test_and_clear_bit(PG_INODE_REF, &subreq->wb_flags)) {
+ nfs_release_request(subreq);
+diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
+index a342f008e42f..ff0e083ce2a1 100644
+--- a/fs/ocfs2/alloc.c
++++ b/fs/ocfs2/alloc.c
+@@ -7403,6 +7403,10 @@ int ocfs2_truncate_inline(struct inode *inode, struct buffer_head *di_bh,
+ struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
+ struct ocfs2_inline_data *idata = &di->id2.i_data;
+
++ /* No need to punch hole beyond i_size. */
++ if (start >= i_size_read(inode))
++ return 0;
++
+ if (end > i_size_read(inode))
+ end = i_size_read(inode);
+
+diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c
+index 6f90d91a8733..6f51c6d7b965 100644
+--- a/fs/pstore/inode.c
++++ b/fs/pstore/inode.c
+@@ -99,11 +99,11 @@ static void *pstore_ftrace_seq_next(struct seq_file *s, void *v, loff_t *pos)
+ struct pstore_private *ps = s->private;
+ struct pstore_ftrace_seq_data *data = v;
+
++ (*pos)++;
+ data->off += REC_SIZE;
+ if (data->off + REC_SIZE > ps->total_size)
+ return NULL;
+
+- (*pos)++;
+ return data;
+ }
+
+@@ -113,6 +113,9 @@ static int pstore_ftrace_seq_show(struct seq_file *s, void *v)
+ struct pstore_ftrace_seq_data *data = v;
+ struct pstore_ftrace_record *rec;
+
++ if (!data)
++ return 0;
++
+ rec = (struct pstore_ftrace_record *)(ps->record->buf + data->off);
+
+ seq_printf(s, "CPU:%d ts:%llu %08lx %08lx %pf <- %pF\n",
+diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
+index 4bae3f4fe829..dcd9c3163587 100644
+--- a/fs/pstore/platform.c
++++ b/fs/pstore/platform.c
+@@ -802,9 +802,9 @@ static int __init pstore_init(void)
+
+ ret = pstore_init_fs();
+ if (ret)
+- return ret;
++ free_buf_for_compression();
+
+- return 0;
++ return ret;
+ }
+ late_initcall(pstore_init);
+
+diff --git a/include/linux/devfreq_cooling.h b/include/linux/devfreq_cooling.h
+index 4635f95000a4..79a6e37a1d6f 100644
+--- a/include/linux/devfreq_cooling.h
++++ b/include/linux/devfreq_cooling.h
+@@ -75,7 +75,7 @@ void devfreq_cooling_unregister(struct thermal_cooling_device *dfc);
+
+ #else /* !CONFIG_DEVFREQ_THERMAL */
+
+-struct thermal_cooling_device *
++static inline struct thermal_cooling_device *
+ of_devfreq_cooling_register_power(struct device_node *np, struct devfreq *df,
+ struct devfreq_cooling_power *dfc_power)
+ {
+diff --git a/include/linux/iocontext.h b/include/linux/iocontext.h
+index dba15ca8e60b..1dcd9198beb7 100644
+--- a/include/linux/iocontext.h
++++ b/include/linux/iocontext.h
+@@ -8,6 +8,7 @@
+
+ enum {
+ ICQ_EXITED = 1 << 2,
++ ICQ_DESTROYED = 1 << 3,
+ };
+
+ /*
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index 76b76b6aa83d..b87b1569d15b 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -672,7 +672,14 @@ struct mlx5_ifc_per_protocol_networking_offload_caps_bits {
+ u8 swp[0x1];
+ u8 swp_csum[0x1];
+ u8 swp_lso[0x1];
+- u8 reserved_at_23[0xd];
++ u8 cqe_checksum_full[0x1];
++ u8 tunnel_stateless_geneve_tx[0x1];
++ u8 tunnel_stateless_mpls_over_udp[0x1];
++ u8 tunnel_stateless_mpls_over_gre[0x1];
++ u8 tunnel_stateless_vxlan_gpe[0x1];
++ u8 tunnel_stateless_ipv4_over_vxlan[0x1];
++ u8 tunnel_stateless_ip_over_ip[0x1];
++ u8 reserved_at_2a[0x6];
+ u8 max_vxlan_udp_ports[0x8];
+ u8 reserved_at_38[0x6];
+ u8 max_geneve_opt_len[0x1];
+diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h
+index 2f3ae41c212d..496ff759f84c 100644
+--- a/include/linux/nvme-fc-driver.h
++++ b/include/linux/nvme-fc-driver.h
+@@ -282,8 +282,6 @@ struct nvme_fc_remote_port {
+ *
+ * Host/Initiator Transport Entrypoints/Parameters:
+ *
+- * @module: The LLDD module using the interface
+- *
+ * @localport_delete: The LLDD initiates deletion of a localport via
+ * nvme_fc_deregister_localport(). However, the teardown is
+ * asynchronous. This routine is called upon the completion of the
+@@ -397,8 +395,6 @@ struct nvme_fc_remote_port {
+ * Value is Mandatory. Allowed to be zero.
+ */
+ struct nvme_fc_port_template {
+- struct module *module;
+-
+ /* initiator-based functions */
+ void (*localport_delete)(struct nvme_fc_local_port *);
+ void (*remoteport_delete)(struct nvme_fc_remote_port *);
+diff --git a/include/linux/pci-epc.h b/include/linux/pci-epc.h
+index 37dab8116901..931fda3e5e0d 100644
+--- a/include/linux/pci-epc.h
++++ b/include/linux/pci-epc.h
+@@ -69,6 +69,7 @@ struct pci_epc_ops {
+ * @bitmap: bitmap to manage the PCI address space
+ * @pages: number of bits representing the address region
+ * @page_size: size of each page
++ * @lock: mutex to protect bitmap
+ */
+ struct pci_epc_mem {
+ phys_addr_t phys_base;
+@@ -76,6 +77,8 @@ struct pci_epc_mem {
+ unsigned long *bitmap;
+ size_t page_size;
+ int pages;
++ /* mutex to protect against concurrent access for memory allocation*/
++ struct mutex lock;
+ };
+
+ /**
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 0530de9a4efc..c69f308f3a53 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -887,8 +887,8 @@ struct task_struct {
+ struct seccomp seccomp;
+
+ /* Thread group tracking: */
+- u32 parent_exec_id;
+- u32 self_exec_id;
++ u64 parent_exec_id;
++ u64 self_exec_id;
+
+ /* Protection against (de-)allocation: mm, files, fs, tty, keyrings, mems_allowed, mempolicy: */
+ spinlock_t alloc_lock;
+diff --git a/include/linux/swab.h b/include/linux/swab.h
+index e466fd159c85..bcff5149861a 100644
+--- a/include/linux/swab.h
++++ b/include/linux/swab.h
+@@ -7,6 +7,7 @@
+ # define swab16 __swab16
+ # define swab32 __swab32
+ # define swab64 __swab64
++# define swab __swab
+ # define swahw32 __swahw32
+ # define swahb32 __swahb32
+ # define swab16p __swab16p
+diff --git a/include/uapi/linux/swab.h b/include/uapi/linux/swab.h
+index 23cd84868cc3..fa7f97da5b76 100644
+--- a/include/uapi/linux/swab.h
++++ b/include/uapi/linux/swab.h
+@@ -4,6 +4,7 @@
+
+ #include <linux/types.h>
+ #include <linux/compiler.h>
++#include <asm/bitsperlong.h>
+ #include <asm/swab.h>
+
+ /*
+@@ -132,6 +133,15 @@ static inline __attribute_const__ __u32 __fswahb32(__u32 val)
+ __fswab64(x))
+ #endif
+
++static __always_inline unsigned long __swab(const unsigned long y)
++{
++#if BITS_PER_LONG == 64
++ return __swab64(y);
++#else /* BITS_PER_LONG == 32 */
++ return __swab32(y);
++#endif
++}
++
+ /**
+ * __swahw32 - return a word-swapped 32-bit value
+ * @x: value to wordswap
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 2d850eaaf82e..6d6c106a495c 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2070,10 +2070,8 @@ int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ */
+ cpuhp_offline_cpu_device(cpu);
+ }
+- if (!ret) {
++ if (!ret)
+ cpu_smt_control = ctrlval;
+- arch_smt_update();
+- }
+ cpu_maps_update_done();
+ return ret;
+ }
+@@ -2084,7 +2082,6 @@ int cpuhp_smt_enable(void)
+
+ cpu_maps_update_begin();
+ cpu_smt_control = CPU_SMT_ENABLED;
+- arch_smt_update();
+ for_each_present_cpu(cpu) {
+ /* Skip online CPUs and CPUs on offline nodes */
+ if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index e0eda2bd3975..0a76c44eb6b2 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -1255,6 +1255,11 @@ int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
+ unsigned int irq_base,
+ unsigned int nr_irqs, void *arg)
+ {
++ if (!domain->ops->alloc) {
++ pr_debug("domain->ops->alloc() is NULL\n");
++ return -ENOSYS;
++ }
++
+ return domain->ops->alloc(domain, irq_base, nr_irqs, arg);
+ }
+
+@@ -1292,11 +1297,6 @@ int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base,
+ return -EINVAL;
+ }
+
+- if (!domain->ops->alloc) {
+- pr_debug("domain->ops->alloc() is NULL\n");
+- return -ENOSYS;
+- }
+-
+ if (realloc && irq_base >= 0) {
+ virq = irq_base;
+ } else {
+diff --git a/kernel/kmod.c b/kernel/kmod.c
+index bc6addd9152b..a2de58de6ab6 100644
+--- a/kernel/kmod.c
++++ b/kernel/kmod.c
+@@ -120,7 +120,7 @@ out:
+ * invoke it.
+ *
+ * If module auto-loading support is disabled then this function
+- * becomes a no-operation.
++ * simply returns -ENOENT.
+ */
+ int __request_module(bool wait, const char *fmt, ...)
+ {
+@@ -137,7 +137,7 @@ int __request_module(bool wait, const char *fmt, ...)
+ WARN_ON_ONCE(wait && current_is_async());
+
+ if (!modprobe_path[0])
+- return 0;
++ return -ENOENT;
+
+ va_start(args, fmt);
+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 1e272f6a01e7..8a1758b094b7 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -1260,9 +1260,11 @@ unsigned long lockdep_count_forward_deps(struct lock_class *class)
+ this.class = class;
+
+ raw_local_irq_save(flags);
++ current->lockdep_recursion = 1;
+ arch_spin_lock(&lockdep_lock);
+ ret = __lockdep_count_forward_deps(&this);
+ arch_spin_unlock(&lockdep_lock);
++ current->lockdep_recursion = 0;
+ raw_local_irq_restore(flags);
+
+ return ret;
+@@ -1287,9 +1289,11 @@ unsigned long lockdep_count_backward_deps(struct lock_class *class)
+ this.class = class;
+
+ raw_local_irq_save(flags);
++ current->lockdep_recursion = 1;
+ arch_spin_lock(&lockdep_lock);
+ ret = __lockdep_count_backward_deps(&this);
+ arch_spin_unlock(&lockdep_lock);
++ current->lockdep_recursion = 0;
+ raw_local_irq_restore(flags);
+
+ return ret;
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 94bec97bd5e2..5f0eb4565957 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -123,7 +123,13 @@ static inline void cpu_load_update_active(struct rq *this_rq) { }
+ #ifdef CONFIG_64BIT
+ # define NICE_0_LOAD_SHIFT (SCHED_FIXEDPOINT_SHIFT + SCHED_FIXEDPOINT_SHIFT)
+ # define scale_load(w) ((w) << SCHED_FIXEDPOINT_SHIFT)
+-# define scale_load_down(w) ((w) >> SCHED_FIXEDPOINT_SHIFT)
++# define scale_load_down(w) \
++({ \
++ unsigned long __w = (w); \
++ if (__w) \
++ __w = max(2UL, __w >> SCHED_FIXEDPOINT_SHIFT); \
++ __w; \
++})
+ #else
+ # define NICE_0_LOAD_SHIFT (SCHED_FIXEDPOINT_SHIFT)
+ # define scale_load(w) (w)
+diff --git a/kernel/signal.c b/kernel/signal.c
+index c42eaf39b572..6a5692118139 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -1837,7 +1837,7 @@ bool do_notify_parent(struct task_struct *tsk, int sig)
+ * This is only possible if parent == real_parent.
+ * Check if it has changed security domain.
+ */
+- if (tsk->parent_exec_id != tsk->parent->self_exec_id)
++ if (tsk->parent_exec_id != READ_ONCE(tsk->parent->self_exec_id))
+ sig = SIGCHLD;
+ }
+
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index c61b2b0a99e9..65b4e28ff425 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -975,6 +975,8 @@ static int probes_seq_show(struct seq_file *m, void *v)
+ int i;
+
+ seq_putc(m, trace_kprobe_is_return(tk) ? 'r' : 'p');
++ if (trace_kprobe_is_return(tk) && tk->rp.maxactive)
++ seq_printf(m, "%d", tk->rp.maxactive);
+ seq_printf(m, ":%s/%s", tk->tp.call.class->system,
+ trace_event_name(&tk->tp.call));
+
+diff --git a/lib/find_bit.c b/lib/find_bit.c
+index ee3df93ba69a..8a5492173267 100644
+--- a/lib/find_bit.c
++++ b/lib/find_bit.c
+@@ -153,18 +153,6 @@ EXPORT_SYMBOL(find_last_bit);
+
+ #ifdef __BIG_ENDIAN
+
+-/* include/linux/byteorder does not support "unsigned long" type */
+-static inline unsigned long ext2_swab(const unsigned long y)
+-{
+-#if BITS_PER_LONG == 64
+- return (unsigned long) __swab64((u64) y);
+-#elif BITS_PER_LONG == 32
+- return (unsigned long) __swab32((u32) y);
+-#else
+-#error BITS_PER_LONG not defined
+-#endif
+-}
+-
+ #if !defined(find_next_bit_le) || !defined(find_next_zero_bit_le)
+ static inline unsigned long _find_next_bit_le(const unsigned long *addr1,
+ const unsigned long *addr2, unsigned long nbits,
+@@ -181,7 +169,7 @@ static inline unsigned long _find_next_bit_le(const unsigned long *addr1,
+ tmp ^= invert;
+
+ /* Handle 1st word. */
+- tmp &= ext2_swab(BITMAP_FIRST_WORD_MASK(start));
++ tmp &= swab(BITMAP_FIRST_WORD_MASK(start));
+ start = round_down(start, BITS_PER_LONG);
+
+ while (!tmp) {
+@@ -195,7 +183,7 @@ static inline unsigned long _find_next_bit_le(const unsigned long *addr1,
+ tmp ^= invert;
+ }
+
+- return min(start + __ffs(ext2_swab(tmp)), nbits);
++ return min(start + __ffs(swab(tmp)), nbits);
+ }
+ #endif
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index e5c610d711f3..57888cedf244 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4537,11 +4537,11 @@ refill:
+ /* Even if we own the page, we do not use atomic_set().
+ * This would break get_page_unless_zero() users.
+ */
+- page_ref_add(page, size);
++ page_ref_add(page, PAGE_FRAG_CACHE_MAX_SIZE);
+
+ /* reset page count bias and offset to start of new frag */
+ nc->pfmemalloc = page_is_pfmemalloc(page);
+- nc->pagecnt_bias = size + 1;
++ nc->pagecnt_bias = PAGE_FRAG_CACHE_MAX_SIZE + 1;
+ nc->offset = size;
+ }
+
+@@ -4557,10 +4557,10 @@ refill:
+ size = nc->size;
+ #endif
+ /* OK, page count is 0, we can safely set it */
+- set_page_count(page, size + 1);
++ set_page_count(page, PAGE_FRAG_CACHE_MAX_SIZE + 1);
+
+ /* reset page count bias and offset to start of new frag */
+- nc->pagecnt_bias = size + 1;
++ nc->pagecnt_bias = PAGE_FRAG_CACHE_MAX_SIZE + 1;
+ offset = size - fragsz;
+ }
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 9b7b989273d4..d8116a43a287 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -249,7 +249,7 @@ static inline void *freelist_ptr(const struct kmem_cache *s, void *ptr,
+ unsigned long ptr_addr)
+ {
+ #ifdef CONFIG_SLAB_FREELIST_HARDENED
+- return (void *)((unsigned long)ptr ^ s->random ^ ptr_addr);
++ return (void *)((unsigned long)ptr ^ s->random ^ swab(ptr_addr));
+ #else
+ return ptr;
+ #endif
+diff --git a/security/keys/key.c b/security/keys/key.c
+index 749a5cf27a19..d5fa8c4fc554 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -383,7 +383,7 @@ int key_payload_reserve(struct key *key, size_t datalen)
+ spin_lock(&key->user->lock);
+
+ if (delta > 0 &&
+- (key->user->qnbytes + delta >= maxbytes ||
++ (key->user->qnbytes + delta > maxbytes ||
+ key->user->qnbytes + delta < key->user->qnbytes)) {
+ ret = -EDQUOT;
+ }
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index ca31af186abd..e00e20204de0 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -882,8 +882,8 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group)
+ key_quota_root_maxbytes : key_quota_maxbytes;
+
+ spin_lock(&newowner->lock);
+- if (newowner->qnkeys + 1 >= maxkeys ||
+- newowner->qnbytes + key->quotalen >= maxbytes ||
++ if (newowner->qnkeys + 1 > maxkeys ||
++ newowner->qnbytes + key->quotalen > maxbytes ||
+ newowner->qnbytes + key->quotalen <
+ newowner->qnbytes)
+ goto quota_overrun;
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index 732bbede7ebf..8539047145de 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -196,7 +196,9 @@ int snd_pcm_plugin_free(struct snd_pcm_plugin *plugin)
+ return 0;
+ }
+
+-snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_pcm_uframes_t drv_frames)
++static snd_pcm_sframes_t plug_client_size(struct snd_pcm_substream *plug,
++ snd_pcm_uframes_t drv_frames,
++ bool check_size)
+ {
+ struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next;
+ int stream;
+@@ -209,7 +211,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p
+ if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ plugin = snd_pcm_plug_last(plug);
+ while (plugin && drv_frames > 0) {
+- if (drv_frames > plugin->buf_frames)
++ if (check_size && drv_frames > plugin->buf_frames)
+ drv_frames = plugin->buf_frames;
+ plugin_prev = plugin->prev;
+ if (plugin->src_frames)
+@@ -222,7 +224,7 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p
+ plugin_next = plugin->next;
+ if (plugin->dst_frames)
+ drv_frames = plugin->dst_frames(plugin, drv_frames);
+- if (drv_frames > plugin->buf_frames)
++ if (check_size && drv_frames > plugin->buf_frames)
+ drv_frames = plugin->buf_frames;
+ plugin = plugin_next;
+ }
+@@ -231,7 +233,9 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p
+ return drv_frames;
+ }
+
+-snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug, snd_pcm_uframes_t clt_frames)
++static snd_pcm_sframes_t plug_slave_size(struct snd_pcm_substream *plug,
++ snd_pcm_uframes_t clt_frames,
++ bool check_size)
+ {
+ struct snd_pcm_plugin *plugin, *plugin_prev, *plugin_next;
+ snd_pcm_sframes_t frames;
+@@ -252,14 +256,14 @@ snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug, snd_pc
+ if (frames < 0)
+ return frames;
+ }
+- if (frames > plugin->buf_frames)
++ if (check_size && frames > plugin->buf_frames)
+ frames = plugin->buf_frames;
+ plugin = plugin_next;
+ }
+ } else if (stream == SNDRV_PCM_STREAM_CAPTURE) {
+ plugin = snd_pcm_plug_last(plug);
+ while (plugin) {
+- if (frames > plugin->buf_frames)
++ if (check_size && frames > plugin->buf_frames)
+ frames = plugin->buf_frames;
+ plugin_prev = plugin->prev;
+ if (plugin->src_frames) {
+@@ -274,6 +278,18 @@ snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug, snd_pc
+ return frames;
+ }
+
++snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug,
++ snd_pcm_uframes_t drv_frames)
++{
++ return plug_client_size(plug, drv_frames, false);
++}
++
++snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug,
++ snd_pcm_uframes_t clt_frames)
++{
++ return plug_slave_size(plug, clt_frames, false);
++}
++
+ static int snd_pcm_plug_formats(const struct snd_mask *mask,
+ snd_pcm_format_t format)
+ {
+@@ -630,7 +646,7 @@ snd_pcm_sframes_t snd_pcm_plug_write_transfer(struct snd_pcm_substream *plug, st
+ src_channels = dst_channels;
+ plugin = next;
+ }
+- return snd_pcm_plug_client_size(plug, frames);
++ return plug_client_size(plug, frames, true);
+ }
+
+ snd_pcm_sframes_t snd_pcm_plug_read_transfer(struct snd_pcm_substream *plug, struct snd_pcm_plugin_channel *dst_channels_final, snd_pcm_uframes_t size)
+@@ -640,7 +656,7 @@ snd_pcm_sframes_t snd_pcm_plug_read_transfer(struct snd_pcm_substream *plug, str
+ snd_pcm_sframes_t frames = size;
+ int err;
+
+- frames = snd_pcm_plug_slave_size(plug, frames);
++ frames = plug_slave_size(plug, frames, true);
+ if (frames < 0)
+ return frames;
+
+diff --git a/sound/pci/hda/hda_beep.c b/sound/pci/hda/hda_beep.c
+index 066b5b59c4d7..0224011a240f 100644
+--- a/sound/pci/hda/hda_beep.c
++++ b/sound/pci/hda/hda_beep.c
+@@ -297,8 +297,12 @@ int snd_hda_mixer_amp_switch_get_beep(struct snd_kcontrol *kcontrol,
+ {
+ struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct hda_beep *beep = codec->beep;
++ int chs = get_amp_channels(kcontrol);
++
+ if (beep && (!beep->enabled || !ctl_has_mute(kcontrol))) {
+- ucontrol->value.integer.value[0] =
++ if (chs & 1)
++ ucontrol->value.integer.value[0] = beep->enabled;
++ if (chs & 2)
+ ucontrol->value.integer.value[1] = beep->enabled;
+ return 0;
+ }
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 3ee5b7b9b595..a2eeb08fa61d 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2219,6 +2219,17 @@ static const struct hdac_io_ops pci_hda_io_ops = {
+ .dma_free_pages = dma_free_pages,
+ };
+
++/* Blacklist for skipping the whole probe:
++ * some HD-audio PCI entries are exposed without any codecs, and such devices
++ * should be ignored from the beginning.
++ */
++static const struct snd_pci_quirk driver_blacklist[] = {
++ SND_PCI_QUIRK(0x1043, 0x874f, "ASUS ROG Zenith II / Strix", 0),
++ SND_PCI_QUIRK(0x1462, 0xcb59, "MSI TRX40 Creator", 0),
++ SND_PCI_QUIRK(0x1462, 0xcb60, "MSI TRX40", 0),
++ {}
++};
++
+ static const struct hda_controller_ops pci_hda_ops = {
+ .disable_msi_reset_irq = disable_msi_reset_irq,
+ .substream_alloc_pages = substream_alloc_pages,
+@@ -2238,6 +2249,11 @@ static int azx_probe(struct pci_dev *pci,
+ bool schedule_probe;
+ int err;
+
++ if (snd_pci_quirk_lookup(pci, driver_blacklist)) {
++ dev_info(&pci->dev, "Skipping the blacklisted device\n");
++ return -ENODEV;
++ }
++
+ if (dev >= SNDRV_CARDS)
+ return -ENODEV;
+ if (!enable[dev]) {
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 23aab2fdac46..ea439bee8e6f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -379,7 +379,9 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0215:
+ case 0x10ec0233:
+ case 0x10ec0235:
++ case 0x10ec0236:
+ case 0x10ec0255:
++ case 0x10ec0256:
+ case 0x10ec0257:
+ case 0x10ec0282:
+ case 0x10ec0283:
+@@ -391,11 +393,6 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0300:
+ alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+ break;
+- case 0x10ec0236:
+- case 0x10ec0256:
+- alc_write_coef_idx(codec, 0x36, 0x5757);
+- alc_update_coef_idx(codec, 0x10, 1<<9, 0);
+- break;
+ case 0x10ec0275:
+ alc_update_coef_idx(codec, 0xe, 0, 1<<0);
+ break;
+@@ -2444,6 +2441,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1462, 0x1275, "MSI-GL63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+@@ -3249,7 +3247,13 @@ static void alc256_init(struct hda_codec *codec)
+ alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
+ alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 1 << 15); /* Clear bit */
+ alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 0 << 15);
+- alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/
++ /*
++ * Expose headphone mic (or possibly Line In on some machines) instead
++ * of PC Beep on 1Ah, and disable 1Ah loopback for all outputs. See
++ * Documentation/sound/hd-audio/realtek-pc-beep.rst for details of
++ * this register.
++ */
++ alc_write_coef_idx(codec, 0x36, 0x5757);
+ }
+
+ static void alc256_shutup(struct hda_codec *codec)
+@@ -5269,17 +5273,6 @@ static void alc271_hp_gate_mic_jack(struct hda_codec *codec,
+ }
+ }
+
+-static void alc256_fixup_dell_xps_13_headphone_noise2(struct hda_codec *codec,
+- const struct hda_fixup *fix,
+- int action)
+-{
+- if (action != HDA_FIXUP_ACT_PRE_PROBE)
+- return;
+-
+- snd_hda_codec_amp_stereo(codec, 0x1a, HDA_INPUT, 0, HDA_AMP_VOLMASK, 1);
+- snd_hda_override_wcaps(codec, 0x1a, get_wcaps(codec, 0x1a) & ~AC_WCAP_IN_AMP);
+-}
+-
+ static void alc269_fixup_limit_int_mic_boost(struct hda_codec *codec,
+ const struct hda_fixup *fix,
+ int action)
+@@ -5671,8 +5664,6 @@ enum {
+ ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
+ ALC275_FIXUP_DELL_XPS,
+- ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
+- ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2,
+ ALC293_FIXUP_LENOVO_SPK_NOISE,
+ ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
+ ALC255_FIXUP_DELL_SPK_NOISE,
+@@ -6384,23 +6375,6 @@ static const struct hda_fixup alc269_fixups[] = {
+ {}
+ }
+ },
+- [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE] = {
+- .type = HDA_FIXUP_VERBS,
+- .v.verbs = (const struct hda_verb[]) {
+- /* Disable pass-through path for FRONT 14h */
+- {0x20, AC_VERB_SET_COEF_INDEX, 0x36},
+- {0x20, AC_VERB_SET_PROC_COEF, 0x1737},
+- {}
+- },
+- .chained = true,
+- .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+- },
+- [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2] = {
+- .type = HDA_FIXUP_FUNC,
+- .v.func = alc256_fixup_dell_xps_13_headphone_noise2,
+- .chained = true,
+- .chain_id = ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE
+- },
+ [ALC293_FIXUP_LENOVO_SPK_NOISE] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_disable_aamix,
+@@ -6868,17 +6842,14 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+ SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+ SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+- SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2),
+ SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP),
+- SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2),
+ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
+ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE),
+- SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2),
+ SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+@@ -7229,7 +7200,6 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc298-dell1"},
+ {.id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, .name = "alc298-dell-aio"},
+ {.id = ALC275_FIXUP_DELL_XPS, .name = "alc275-dell-xps"},
+- {.id = ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE, .name = "alc256-dell-xps13"},
+ {.id = ALC293_FIXUP_LENOVO_SPK_NOISE, .name = "lenovo-spk-noise"},
+ {.id = ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, .name = "lenovo-hotkey"},
+ {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"},
+diff --git a/sound/pci/ice1712/prodigy_hifi.c b/sound/pci/ice1712/prodigy_hifi.c
+index c97b5528e4b8..317bbb725b29 100644
+--- a/sound/pci/ice1712/prodigy_hifi.c
++++ b/sound/pci/ice1712/prodigy_hifi.c
+@@ -550,7 +550,7 @@ static int wm_adc_mux_enum_get(struct snd_kcontrol *kcontrol,
+ struct snd_ice1712 *ice = snd_kcontrol_chip(kcontrol);
+
+ mutex_lock(&ice->gpio_mutex);
+- ucontrol->value.integer.value[0] = wm_get(ice, WM_ADC_MUX) & 0x1f;
++ ucontrol->value.enumerated.item[0] = wm_get(ice, WM_ADC_MUX) & 0x1f;
+ mutex_unlock(&ice->gpio_mutex);
+ return 0;
+ }
+@@ -564,7 +564,7 @@ static int wm_adc_mux_enum_put(struct snd_kcontrol *kcontrol,
+
+ mutex_lock(&ice->gpio_mutex);
+ oval = wm_get(ice, WM_ADC_MUX);
+- nval = (oval & 0xe0) | ucontrol->value.integer.value[0];
++ nval = (oval & 0xe0) | ucontrol->value.enumerated.item[0];
+ if (nval != oval) {
+ wm_put(ice, WM_ADC_MUX, nval);
+ change = 1;
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index db5b005f4b1e..d61e954417d0 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -792,7 +792,13 @@ static void dapm_set_mixer_path_status(struct snd_soc_dapm_path *p, int i,
+ val = max - val;
+ p->connect = !!val;
+ } else {
+- p->connect = 0;
++ /* since a virtual mixer has no backing registers to
++ * decide which path to connect, it will try to match
++ * with initial state. This is to ensure
++ * that the default mixer choice will be
++ * correctly powered up during initialization.
++ */
++ p->connect = invert;
+ }
+ }
+
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index f4dc3d445aae..95fc24580f85 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -832,7 +832,7 @@ int snd_soc_get_xr_sx(struct snd_kcontrol *kcontrol,
+ unsigned int regbase = mc->regbase;
+ unsigned int regcount = mc->regcount;
+ unsigned int regwshift = component->val_bytes * BITS_PER_BYTE;
+- unsigned int regwmask = (1<<regwshift)-1;
++ unsigned int regwmask = (1UL<<regwshift)-1;
+ unsigned int invert = mc->invert;
+ unsigned long mask = (1UL<<mc->nbits)-1;
+ long min = mc->min;
+@@ -881,7 +881,7 @@ int snd_soc_put_xr_sx(struct snd_kcontrol *kcontrol,
+ unsigned int regbase = mc->regbase;
+ unsigned int regcount = mc->regcount;
+ unsigned int regwshift = component->val_bytes * BITS_PER_BYTE;
+- unsigned int regwmask = (1<<regwshift)-1;
++ unsigned int regwmask = (1UL<<regwshift)-1;
+ unsigned int invert = mc->invert;
+ unsigned long mask = (1UL<<mc->nbits)-1;
+ long max = mc->max;
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 356d4e754561..a0d1ce0edaf9 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2266,7 +2266,8 @@ int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream,
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
+ if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_PREPARE) &&
+- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP))
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) &&
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED))
+ continue;
+
+ ret = dpcm_do_trigger(dpcm, be_substream, cmd);
+@@ -2296,7 +2297,8 @@ int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream,
+ be->dpcm[stream].state = SND_SOC_DPCM_STATE_START;
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+- if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_START)
++ if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_START) &&
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED))
+ continue;
+
+ if (!snd_soc_dpcm_can_be_free_stop(fe, be, stream))
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 30fc45aa1869..756dd2303106 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -364,7 +364,7 @@ static int soc_tplg_add_kcontrol(struct soc_tplg *tplg,
+ struct snd_soc_component *comp = tplg->comp;
+
+ return soc_tplg_add_dcontrol(comp->card->snd_card,
+- comp->dev, k, NULL, comp, kcontrol);
++ comp->dev, k, comp->name_prefix, comp, kcontrol);
+ }
+
+ /* remove a mixer kcontrol */
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 71069e110897..f6e2cc66153a 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -363,6 +363,14 @@ static const struct usbmix_name_map dell_alc4020_map[] = {
+ { 0 }
+ };
+
++/* Some mobos shipped with a dummy HD-audio show the invalid GET_MIN/GET_MAX
++ * response for Input Gain Pad (id=19, control=12). Skip it.
++ */
++static const struct usbmix_name_map asus_rog_map[] = {
++ { 19, NULL, 12 }, /* FU, Input Gain Pad */
++ {}
++};
++
+ /*
+ * Control map entries
+ */
+@@ -482,6 +490,26 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .id = USB_ID(0x05a7, 0x1020),
+ .map = bose_companion5_map,
+ },
++ { /* Gigabyte TRX40 Aorus Pro WiFi */
++ .id = USB_ID(0x0414, 0xa002),
++ .map = asus_rog_map,
++ },
++ { /* ASUS ROG Zenith II */
++ .id = USB_ID(0x0b05, 0x1916),
++ .map = asus_rog_map,
++ },
++ { /* ASUS ROG Strix */
++ .id = USB_ID(0x0b05, 0x1917),
++ .map = asus_rog_map,
++ },
++ { /* MSI TRX40 Creator */
++ .id = USB_ID(0x0db0, 0x0d64),
++ .map = asus_rog_map,
++ },
++ { /* MSI TRX40 */
++ .id = USB_ID(0x0db0, 0x543d),
++ .map = asus_rog_map,
++ },
+ { 0 } /* terminator */
+ };
+
+diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
+index 6a73c06e069c..3dbf7e8b07a5 100644
+--- a/tools/gpio/Makefile
++++ b/tools/gpio/Makefile
+@@ -35,7 +35,7 @@ $(OUTPUT)include/linux/gpio.h: ../../include/uapi/linux/gpio.h
+
+ prepare: $(OUTPUT)include/linux/gpio.h
+
+-GPIO_UTILS_IN := $(output)gpio-utils-in.o
++GPIO_UTILS_IN := $(OUTPUT)gpio-utils-in.o
+ $(GPIO_UTILS_IN): prepare FORCE
+ $(Q)$(MAKE) $(build)=gpio-utils
+
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index 510caedd7319..ae0c5bee8014 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -205,8 +205,17 @@ strip-libs = $(filter-out -l%,$(1))
+
+ PYTHON_CONFIG_SQ := $(call shell-sq,$(PYTHON_CONFIG))
+
++# Python 3.8 changed the output of `python-config --ldflags` to not include the
++# '-lpythonX.Y' flag unless '--embed' is also passed. The feature check for
++# libpython fails if that flag is not included in LDFLAGS
++ifeq ($(shell $(PYTHON_CONFIG_SQ) --ldflags --embed 2>&1 1>/dev/null; echo $$?), 0)
++ PYTHON_CONFIG_LDFLAGS := --ldflags --embed
++else
++ PYTHON_CONFIG_LDFLAGS := --ldflags
++endif
++
+ ifdef PYTHON_CONFIG
+- PYTHON_EMBED_LDOPTS := $(shell $(PYTHON_CONFIG_SQ) --ldflags 2>/dev/null)
++ PYTHON_EMBED_LDOPTS := $(shell $(PYTHON_CONFIG_SQ) $(PYTHON_CONFIG_LDFLAGS) 2>/dev/null)
+ PYTHON_EMBED_LDFLAGS := $(call strip-libs,$(PYTHON_EMBED_LDOPTS))
+ PYTHON_EMBED_LIBADD := $(call grep-libs,$(PYTHON_EMBED_LDOPTS)) -lutil
+ PYTHON_EMBED_CCOPTS := $(shell $(PYTHON_CONFIG_SQ) --includes 2>/dev/null)
+diff --git a/tools/testing/selftests/vm/mlock2-tests.c b/tools/testing/selftests/vm/mlock2-tests.c
+index 637b6d0ac0d0..11b2301f3aa3 100644
+--- a/tools/testing/selftests/vm/mlock2-tests.c
++++ b/tools/testing/selftests/vm/mlock2-tests.c
+@@ -67,59 +67,6 @@ out:
+ return ret;
+ }
+
+-static uint64_t get_pageflags(unsigned long addr)
+-{
+- FILE *file;
+- uint64_t pfn;
+- unsigned long offset;
+-
+- file = fopen("/proc/self/pagemap", "r");
+- if (!file) {
+- perror("fopen pagemap");
+- _exit(1);
+- }
+-
+- offset = addr / getpagesize() * sizeof(pfn);
+-
+- if (fseek(file, offset, SEEK_SET)) {
+- perror("fseek pagemap");
+- _exit(1);
+- }
+-
+- if (fread(&pfn, sizeof(pfn), 1, file) != 1) {
+- perror("fread pagemap");
+- _exit(1);
+- }
+-
+- fclose(file);
+- return pfn;
+-}
+-
+-static uint64_t get_kpageflags(unsigned long pfn)
+-{
+- uint64_t flags;
+- FILE *file;
+-
+- file = fopen("/proc/kpageflags", "r");
+- if (!file) {
+- perror("fopen kpageflags");
+- _exit(1);
+- }
+-
+- if (fseek(file, pfn * sizeof(flags), SEEK_SET)) {
+- perror("fseek kpageflags");
+- _exit(1);
+- }
+-
+- if (fread(&flags, sizeof(flags), 1, file) != 1) {
+- perror("fread kpageflags");
+- _exit(1);
+- }
+-
+- fclose(file);
+- return flags;
+-}
+-
+ #define VMFLAGS "VmFlags:"
+
+ static bool is_vmflag_set(unsigned long addr, const char *vmflag)
+@@ -159,19 +106,13 @@ out:
+ #define RSS "Rss:"
+ #define LOCKED "lo"
+
+-static bool is_vma_lock_on_fault(unsigned long addr)
++static unsigned long get_value_for_name(unsigned long addr, const char *name)
+ {
+- bool ret = false;
+- bool locked;
+- FILE *smaps = NULL;
+- unsigned long vma_size, vma_rss;
+ char *line = NULL;
+- char *value;
+ size_t size = 0;
+-
+- locked = is_vmflag_set(addr, LOCKED);
+- if (!locked)
+- goto out;
++ char *value_ptr;
++ FILE *smaps = NULL;
++ unsigned long value = -1UL;
+
+ smaps = seek_to_smaps_entry(addr);
+ if (!smaps) {
+@@ -180,112 +121,70 @@ static bool is_vma_lock_on_fault(unsigned long addr)
+ }
+
+ while (getline(&line, &size, smaps) > 0) {
+- if (!strstr(line, SIZE)) {
++ if (!strstr(line, name)) {
+ free(line);
+ line = NULL;
+ size = 0;
+ continue;
+ }
+
+- value = line + strlen(SIZE);
+- if (sscanf(value, "%lu kB", &vma_size) < 1) {
++ value_ptr = line + strlen(name);
++ if (sscanf(value_ptr, "%lu kB", &value) < 1) {
+ printf("Unable to parse smaps entry for Size\n");
+ goto out;
+ }
+ break;
+ }
+
+- while (getline(&line, &size, smaps) > 0) {
+- if (!strstr(line, RSS)) {
+- free(line);
+- line = NULL;
+- size = 0;
+- continue;
+- }
+-
+- value = line + strlen(RSS);
+- if (sscanf(value, "%lu kB", &vma_rss) < 1) {
+- printf("Unable to parse smaps entry for Rss\n");
+- goto out;
+- }
+- break;
+- }
+-
+- ret = locked && (vma_rss < vma_size);
+ out:
+- free(line);
+ if (smaps)
+ fclose(smaps);
+- return ret;
++ free(line);
++ return value;
+ }
+
+-#define PRESENT_BIT 0x8000000000000000ULL
+-#define PFN_MASK 0x007FFFFFFFFFFFFFULL
+-#define UNEVICTABLE_BIT (1UL << 18)
+-
+-static int lock_check(char *map)
++static bool is_vma_lock_on_fault(unsigned long addr)
+ {
+- unsigned long page_size = getpagesize();
+- uint64_t page1_flags, page2_flags;
++ bool locked;
++ unsigned long vma_size, vma_rss;
+
+- page1_flags = get_pageflags((unsigned long)map);
+- page2_flags = get_pageflags((unsigned long)map + page_size);
++ locked = is_vmflag_set(addr, LOCKED);
++ if (!locked)
++ return false;
+
+- /* Both pages should be present */
+- if (((page1_flags & PRESENT_BIT) == 0) ||
+- ((page2_flags & PRESENT_BIT) == 0)) {
+- printf("Failed to make both pages present\n");
+- return 1;
+- }
++ vma_size = get_value_for_name(addr, SIZE);
++ vma_rss = get_value_for_name(addr, RSS);
+
+- page1_flags = get_kpageflags(page1_flags & PFN_MASK);
+- page2_flags = get_kpageflags(page2_flags & PFN_MASK);
++ /* only one page is faulted in */
++ return (vma_rss < vma_size);
++}
+
+- /* Both pages should be unevictable */
+- if (((page1_flags & UNEVICTABLE_BIT) == 0) ||
+- ((page2_flags & UNEVICTABLE_BIT) == 0)) {
+- printf("Failed to make both pages unevictable\n");
+- return 1;
+- }
++#define PRESENT_BIT 0x8000000000000000ULL
++#define PFN_MASK 0x007FFFFFFFFFFFFFULL
++#define UNEVICTABLE_BIT (1UL << 18)
+
+- if (!is_vmflag_set((unsigned long)map, LOCKED)) {
+- printf("VMA flag %s is missing on page 1\n", LOCKED);
+- return 1;
+- }
++static int lock_check(unsigned long addr)
++{
++ bool locked;
++ unsigned long vma_size, vma_rss;
+
+- if (!is_vmflag_set((unsigned long)map + page_size, LOCKED)) {
+- printf("VMA flag %s is missing on page 2\n", LOCKED);
+- return 1;
+- }
++ locked = is_vmflag_set(addr, LOCKED);
++ if (!locked)
++ return false;
+
+- return 0;
++ vma_size = get_value_for_name(addr, SIZE);
++ vma_rss = get_value_for_name(addr, RSS);
++
++ return (vma_rss == vma_size);
+ }
+
+ static int unlock_lock_check(char *map)
+ {
+- unsigned long page_size = getpagesize();
+- uint64_t page1_flags, page2_flags;
+-
+- page1_flags = get_pageflags((unsigned long)map);
+- page2_flags = get_pageflags((unsigned long)map + page_size);
+- page1_flags = get_kpageflags(page1_flags & PFN_MASK);
+- page2_flags = get_kpageflags(page2_flags & PFN_MASK);
+-
+- if ((page1_flags & UNEVICTABLE_BIT) || (page2_flags & UNEVICTABLE_BIT)) {
+- printf("A page is still marked unevictable after unlock\n");
+- return 1;
+- }
+-
+ if (is_vmflag_set((unsigned long)map, LOCKED)) {
+ printf("VMA flag %s is present on page 1 after unlock\n", LOCKED);
+ return 1;
+ }
+
+- if (is_vmflag_set((unsigned long)map + page_size, LOCKED)) {
+- printf("VMA flag %s is present on page 2 after unlock\n", LOCKED);
+- return 1;
+- }
+-
+ return 0;
+ }
+
+@@ -311,7 +210,7 @@ static int test_mlock_lock()
+ goto unmap;
+ }
+
+- if (lock_check(map))
++ if (!lock_check((unsigned long)map))
+ goto unmap;
+
+ /* Now unlock and recheck attributes */
+@@ -330,64 +229,18 @@ out:
+
+ static int onfault_check(char *map)
+ {
+- unsigned long page_size = getpagesize();
+- uint64_t page1_flags, page2_flags;
+-
+- page1_flags = get_pageflags((unsigned long)map);
+- page2_flags = get_pageflags((unsigned long)map + page_size);
+-
+- /* Neither page should be present */
+- if ((page1_flags & PRESENT_BIT) || (page2_flags & PRESENT_BIT)) {
+- printf("Pages were made present by MLOCK_ONFAULT\n");
+- return 1;
+- }
+-
+ *map = 'a';
+- page1_flags = get_pageflags((unsigned long)map);
+- page2_flags = get_pageflags((unsigned long)map + page_size);
+-
+- /* Only page 1 should be present */
+- if ((page1_flags & PRESENT_BIT) == 0) {
+- printf("Page 1 is not present after fault\n");
+- return 1;
+- } else if (page2_flags & PRESENT_BIT) {
+- printf("Page 2 was made present\n");
+- return 1;
+- }
+-
+- page1_flags = get_kpageflags(page1_flags & PFN_MASK);
+-
+- /* Page 1 should be unevictable */
+- if ((page1_flags & UNEVICTABLE_BIT) == 0) {
+- printf("Failed to make faulted page unevictable\n");
+- return 1;
+- }
+-
+ if (!is_vma_lock_on_fault((unsigned long)map)) {
+ printf("VMA is not marked for lock on fault\n");
+ return 1;
+ }
+
+- if (!is_vma_lock_on_fault((unsigned long)map + page_size)) {
+- printf("VMA is not marked for lock on fault\n");
+- return 1;
+- }
+-
+ return 0;
+ }
+
+ static int unlock_onfault_check(char *map)
+ {
+ unsigned long page_size = getpagesize();
+- uint64_t page1_flags;
+-
+- page1_flags = get_pageflags((unsigned long)map);
+- page1_flags = get_kpageflags(page1_flags & PFN_MASK);
+-
+- if (page1_flags & UNEVICTABLE_BIT) {
+- printf("Page 1 is still marked unevictable after unlock\n");
+- return 1;
+- }
+
+ if (is_vma_lock_on_fault((unsigned long)map) ||
+ is_vma_lock_on_fault((unsigned long)map + page_size)) {
+@@ -445,7 +298,6 @@ static int test_lock_onfault_of_present()
+ char *map;
+ int ret = 1;
+ unsigned long page_size = getpagesize();
+- uint64_t page1_flags, page2_flags;
+
+ map = mmap(NULL, 2 * page_size, PROT_READ | PROT_WRITE,
+ MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+@@ -465,17 +317,6 @@ static int test_lock_onfault_of_present()
+ goto unmap;
+ }
+
+- page1_flags = get_pageflags((unsigned long)map);
+- page2_flags = get_pageflags((unsigned long)map + page_size);
+- page1_flags = get_kpageflags(page1_flags & PFN_MASK);
+- page2_flags = get_kpageflags(page2_flags & PFN_MASK);
+-
+- /* Page 1 should be unevictable */
+- if ((page1_flags & UNEVICTABLE_BIT) == 0) {
+- printf("Failed to make present page unevictable\n");
+- goto unmap;
+- }
+-
+ if (!is_vma_lock_on_fault((unsigned long)map) ||
+ !is_vma_lock_on_fault((unsigned long)map + page_size)) {
+ printf("VMA with present pages is not marked lock on fault\n");
+@@ -507,7 +348,7 @@ static int test_munlockall()
+ goto out;
+ }
+
+- if (lock_check(map))
++ if (!lock_check((unsigned long)map))
+ goto unmap;
+
+ if (munlockall()) {
+@@ -549,7 +390,7 @@ static int test_munlockall()
+ goto out;
+ }
+
+- if (lock_check(map))
++ if (!lock_check((unsigned long)map))
+ goto unmap;
+
+ if (munlockall()) {
+diff --git a/tools/testing/selftests/x86/ptrace_syscall.c b/tools/testing/selftests/x86/ptrace_syscall.c
+index 6f22238f3217..12aaa063196e 100644
+--- a/tools/testing/selftests/x86/ptrace_syscall.c
++++ b/tools/testing/selftests/x86/ptrace_syscall.c
+@@ -414,8 +414,12 @@ int main()
+
+ #if defined(__i386__) && (!defined(__GLIBC__) || __GLIBC__ > 2 || __GLIBC_MINOR__ >= 16)
+ vsyscall32 = (void *)getauxval(AT_SYSINFO);
+- printf("[RUN]\tCheck AT_SYSINFO return regs\n");
+- test_sys32_regs(do_full_vsyscall32);
++ if (vsyscall32) {
++ printf("[RUN]\tCheck AT_SYSINFO return regs\n");
++ test_sys32_regs(do_full_vsyscall32);
++ } else {
++ printf("[SKIP]\tAT_SYSINFO is not available\n");
++ }
+ #endif
+
+ test_ptrace_syscall_restart();
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-04-21 11:15 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-04-21 11:15 UTC (permalink / raw
To: gentoo-commits
commit: b6cdb44c09d28dc9845d5502832c6eb6dca6b803
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Apr 21 11:15:07 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Apr 21 11:15:07 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b6cdb44c
Linux patch 4.19.117
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1116_linux-4.19.117.patch | 1368 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1372 insertions(+)
diff --git a/0000_README b/0000_README
index d15813b..8db7823 100644
--- a/0000_README
+++ b/0000_README
@@ -503,6 +503,10 @@ Patch: 1115_linux-4.19.116.patch
From: https://www.kernel.org
Desc: Linux 4.19.116
+Patch: 1116_linux-4.19.117.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.117
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1116_linux-4.19.117.patch b/1116_linux-4.19.117.patch
new file mode 100644
index 0000000..c3a7077
--- /dev/null
+++ b/1116_linux-4.19.117.patch
@@ -0,0 +1,1368 @@
+diff --git a/Makefile b/Makefile
+index d85ff698f5b9..555dbaab7bad 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 116
++SUBLEVEL = 117
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h
+index 209492849566..5c524d4f71cd 100644
+--- a/arch/x86/include/asm/microcode_amd.h
++++ b/arch/x86/include/asm/microcode_amd.h
+@@ -41,7 +41,7 @@ struct microcode_amd {
+ unsigned int mpb[0];
+ };
+
+-#define PATCH_MAX_SIZE PAGE_SIZE
++#define PATCH_MAX_SIZE (3 * PAGE_SIZE)
+
+ #ifdef CONFIG_MICROCODE_AMD
+ extern void __init load_ucode_amd_bsp(unsigned int family);
+diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
+index 1c92cd08c3b4..b32fa6bcf811 100644
+--- a/arch/x86/kernel/cpu/intel_rdt.c
++++ b/arch/x86/kernel/cpu/intel_rdt.c
+@@ -555,6 +555,8 @@ static void domain_add_cpu(int cpu, struct rdt_resource *r)
+ d->id = id;
+ cpumask_set_cpu(cpu, &d->cpu_mask);
+
++ rdt_domain_reconfigure_cdp(r);
++
+ if (r->alloc_capable && domain_setup_ctrlval(r, d)) {
+ kfree(d);
+ return;
+diff --git a/arch/x86/kernel/cpu/intel_rdt.h b/arch/x86/kernel/cpu/intel_rdt.h
+index 3736f6dc9545..2b483b739cf1 100644
+--- a/arch/x86/kernel/cpu/intel_rdt.h
++++ b/arch/x86/kernel/cpu/intel_rdt.h
+@@ -567,5 +567,6 @@ void cqm_setup_limbo_handler(struct rdt_domain *dom, unsigned long delay_ms);
+ void cqm_handle_limbo(struct work_struct *work);
+ bool has_busy_rmid(struct rdt_resource *r, struct rdt_domain *d);
+ void __check_limbo(struct rdt_domain *d, bool force_free);
++void rdt_domain_reconfigure_cdp(struct rdt_resource *r);
+
+ #endif /* _ASM_X86_INTEL_RDT_H */
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index 11c5accfa4db..cea7e01a346d 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -1777,6 +1777,19 @@ static int set_cache_qos_cfg(int level, bool enable)
+ return 0;
+ }
+
++/* Restore the qos cfg state when a domain comes online */
++void rdt_domain_reconfigure_cdp(struct rdt_resource *r)
++{
++ if (!r->alloc_capable)
++ return;
++
++ if (r == &rdt_resources_all[RDT_RESOURCE_L2DATA])
++ l2_qos_cfg_update(&r->alloc_enabled);
++
++ if (r == &rdt_resources_all[RDT_RESOURCE_L3DATA])
++ l3_qos_cfg_update(&r->alloc_enabled);
++}
++
+ /*
+ * Enable or disable the MBA software controller
+ * which helps user specify bandwidth in MBps.
+@@ -2910,7 +2923,8 @@ static int rdtgroup_rmdir(struct kernfs_node *kn)
+ * If the rdtgroup is a mon group and parent directory
+ * is a valid "mon_groups" directory, remove the mon group.
+ */
+- if (rdtgrp->type == RDTCTRL_GROUP && parent_kn == rdtgroup_default.kn) {
++ if (rdtgrp->type == RDTCTRL_GROUP && parent_kn == rdtgroup_default.kn &&
++ rdtgrp != &rdtgroup_default) {
+ if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP ||
+ rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) {
+ ret = rdtgroup_ctrl_remove(kn, rdtgrp);
+diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
+index 48c24d0e9e75..1fe9ccabc082 100644
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -509,7 +509,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ entry->edx |= F(SPEC_CTRL);
+ if (boot_cpu_has(X86_FEATURE_STIBP))
+ entry->edx |= F(INTEL_STIBP);
+- if (boot_cpu_has(X86_FEATURE_SSBD))
++ if (boot_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
++ boot_cpu_has(X86_FEATURE_AMD_SSBD))
+ entry->edx |= F(SPEC_CTRL_SSBD);
+ /*
+ * We emulate ARCH_CAPABILITIES in software even
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index 6bf032e81e39..219440bebd05 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -3788,9 +3788,12 @@ static int smu7_trim_single_dpm_states(struct pp_hwmgr *hwmgr,
+ {
+ uint32_t i;
+
++ /* force the trim if mclk_switching is disabled to prevent flicker */
++ bool force_trim = (low_limit == high_limit);
+ for (i = 0; i < dpm_table->count; i++) {
+ /*skip the trim if od is enabled*/
+- if (!hwmgr->od_enabled && (dpm_table->dpm_levels[i].value < low_limit
++ if ((!hwmgr->od_enabled || force_trim)
++ && (dpm_table->dpm_levels[i].value < low_limit
+ || dpm_table->dpm_levels[i].value > high_limit))
+ dpm_table->dpm_levels[i].enabled = false;
+ else
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 8aa3b0af9fc2..05982e9fb6bb 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -824,8 +824,9 @@ mt7530_port_set_vlan_unaware(struct dsa_switch *ds, int port)
+ */
+ mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK,
+ MT7530_PORT_MATRIX_MODE);
+- mt7530_rmw(priv, MT7530_PVC_P(port), VLAN_ATTR_MASK,
+- VLAN_ATTR(MT7530_VLAN_TRANSPARENT));
++ mt7530_rmw(priv, MT7530_PVC_P(port), VLAN_ATTR_MASK | PVC_EG_TAG_MASK,
++ VLAN_ATTR(MT7530_VLAN_TRANSPARENT) |
++ PVC_EG_TAG(MT7530_VLAN_EG_CONSISTENT));
+
+ priv->ports[port].vlan_filtering = false;
+
+@@ -843,8 +844,8 @@ mt7530_port_set_vlan_unaware(struct dsa_switch *ds, int port)
+ if (all_user_ports_removed) {
+ mt7530_write(priv, MT7530_PCR_P(MT7530_CPU_PORT),
+ PCR_MATRIX(dsa_user_ports(priv->ds)));
+- mt7530_write(priv, MT7530_PVC_P(MT7530_CPU_PORT),
+- PORT_SPEC_TAG);
++ mt7530_write(priv, MT7530_PVC_P(MT7530_CPU_PORT), PORT_SPEC_TAG
++ | PVC_EG_TAG(MT7530_VLAN_EG_CONSISTENT));
+ }
+ }
+
+@@ -870,8 +871,9 @@ mt7530_port_set_vlan_aware(struct dsa_switch *ds, int port)
+ /* Set the port as a user port which is to be able to recognize VID
+ * from incoming packets before fetching entry within the VLAN table.
+ */
+- mt7530_rmw(priv, MT7530_PVC_P(port), VLAN_ATTR_MASK,
+- VLAN_ATTR(MT7530_VLAN_USER));
++ mt7530_rmw(priv, MT7530_PVC_P(port), VLAN_ATTR_MASK | PVC_EG_TAG_MASK,
++ VLAN_ATTR(MT7530_VLAN_USER) |
++ PVC_EG_TAG(MT7530_VLAN_EG_DISABLED));
+ }
+
+ static void
+@@ -1297,6 +1299,10 @@ mt7530_setup(struct dsa_switch *ds)
+ mt7530_cpu_port_enable(priv, i);
+ else
+ mt7530_port_disable(ds, i, NULL);
++
++ /* Enable consistent egress tag */
++ mt7530_rmw(priv, MT7530_PVC_P(i), PVC_EG_TAG_MASK,
++ PVC_EG_TAG(MT7530_VLAN_EG_CONSISTENT));
+ }
+
+ /* Flush the FDB table */
+diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h
+index d9b407a22a58..ea30f10397aa 100644
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -167,9 +167,16 @@ enum mt7530_port_mode {
+ /* Register for port vlan control */
+ #define MT7530_PVC_P(x) (0x2010 + ((x) * 0x100))
+ #define PORT_SPEC_TAG BIT(5)
++#define PVC_EG_TAG(x) (((x) & 0x7) << 8)
++#define PVC_EG_TAG_MASK PVC_EG_TAG(7)
+ #define VLAN_ATTR(x) (((x) & 0x3) << 6)
+ #define VLAN_ATTR_MASK VLAN_ATTR(3)
+
++enum mt7530_vlan_port_eg_tag {
++ MT7530_VLAN_EG_DISABLED = 0,
++ MT7530_VLAN_EG_CONSISTENT = 1,
++};
++
+ enum mt7530_vlan_port_attr {
+ MT7530_VLAN_USER = 0,
+ MT7530_VLAN_TRANSPARENT = 3,
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index d96a84a62d78..5519eff58441 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -515,7 +515,7 @@ static void xgbe_isr_task(unsigned long data)
+ xgbe_disable_rx_tx_ints(pdata);
+
+ /* Turn on polling */
+- __napi_schedule_irqoff(&pdata->napi);
++ __napi_schedule(&pdata->napi);
+ }
+ } else {
+ /* Don't clear Rx/Tx status if doing per channel DMA
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+index fc1fa0f9f338..57694eada995 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+@@ -155,6 +155,8 @@ static int sun7i_gmac_probe(struct platform_device *pdev)
+ plat_dat->init = sun7i_gmac_init;
+ plat_dat->exit = sun7i_gmac_exit;
+ plat_dat->fix_mac_speed = sun7i_fix_speed;
++ plat_dat->tx_fifo_size = 4096;
++ plat_dat->rx_fifo_size = 16384;
+
+ ret = sun7i_gmac_init(pdev, plat_dat->bsp_priv);
+ if (ret)
+diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
+index 44296c015925..55a809cb3105 100644
+--- a/drivers/net/wireless/ath/wil6210/debugfs.c
++++ b/drivers/net/wireless/ath/wil6210/debugfs.c
+@@ -730,32 +730,6 @@ struct dentry *wil_debugfs_create_ioblob(const char *name,
+ return debugfs_create_file(name, mode, parent, wil_blob, &fops_ioblob);
+ }
+
+-/*---reset---*/
+-static ssize_t wil_write_file_reset(struct file *file, const char __user *buf,
+- size_t len, loff_t *ppos)
+-{
+- struct wil6210_priv *wil = file->private_data;
+- struct net_device *ndev = wil->main_ndev;
+-
+- /**
+- * BUG:
+- * this code does NOT sync device state with the rest of system
+- * use with care, debug only!!!
+- */
+- rtnl_lock();
+- dev_close(ndev);
+- ndev->flags &= ~IFF_UP;
+- rtnl_unlock();
+- wil_reset(wil, true);
+-
+- return len;
+-}
+-
+-static const struct file_operations fops_reset = {
+- .write = wil_write_file_reset,
+- .open = simple_open,
+-};
+-
+ /*---write channel 1..4 to rxon for it, 0 to rxoff---*/
+ static ssize_t wil_write_file_rxon(struct file *file, const char __user *buf,
+ size_t len, loff_t *ppos)
+@@ -991,6 +965,8 @@ static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf,
+ int rc;
+ void *frame;
+
++ memset(¶ms, 0, sizeof(params));
++
+ if (!len)
+ return -EINVAL;
+
+@@ -2459,7 +2435,6 @@ static const struct {
+ {"desc", 0444, &fops_txdesc},
+ {"bf", 0444, &fops_bf},
+ {"mem_val", 0644, &fops_memread},
+- {"reset", 0244, &fops_reset},
+ {"rxon", 0244, &fops_rxon},
+ {"tx_mgmt", 0244, &fops_txmgmt},
+ {"wmi_send", 0244, &fops_wmi},
+diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
+index 0655cd884514..d161dc930313 100644
+--- a/drivers/net/wireless/ath/wil6210/interrupt.c
++++ b/drivers/net/wireless/ath/wil6210/interrupt.c
+@@ -1,6 +1,6 @@
+ /*
+ * Copyright (c) 2012-2017 Qualcomm Atheros, Inc.
+- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+@@ -590,10 +590,14 @@ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
+ }
+
+ if (isr & BIT_DMA_EP_MISC_ICR_HALP) {
+- wil_dbg_irq(wil, "irq_misc: HALP IRQ invoked\n");
+- wil6210_mask_halp(wil);
+ isr &= ~BIT_DMA_EP_MISC_ICR_HALP;
+- complete(&wil->halp.comp);
++ if (wil->halp.handle_icr) {
++ /* no need to handle HALP ICRs until next vote */
++ wil->halp.handle_icr = false;
++ wil_dbg_irq(wil, "irq_misc: HALP IRQ invoked\n");
++ wil6210_mask_halp(wil);
++ complete(&wil->halp.comp);
++ }
+ }
+
+ wil->isr_misc = isr;
+diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
+index 10673fa9388e..fe91db3478dc 100644
+--- a/drivers/net/wireless/ath/wil6210/main.c
++++ b/drivers/net/wireless/ath/wil6210/main.c
+@@ -1687,7 +1687,7 @@ int __wil_up(struct wil6210_priv *wil)
+ return rc;
+
+ /* Rx RING. After MAC and beacon */
+- rc = wil->txrx_ops.rx_init(wil, 1 << rx_ring_order);
++ rc = wil->txrx_ops.rx_init(wil, rx_ring_order);
+ if (rc)
+ return rc;
+
+@@ -1814,11 +1814,14 @@ void wil_halp_vote(struct wil6210_priv *wil)
+
+ if (++wil->halp.ref_cnt == 1) {
+ reinit_completion(&wil->halp.comp);
++ /* mark to IRQ context to handle HALP ICR */
++ wil->halp.handle_icr = true;
+ wil6210_set_halp(wil);
+ rc = wait_for_completion_timeout(&wil->halp.comp, to_jiffies);
+ if (!rc) {
+ wil_err(wil, "HALP vote timed out\n");
+ /* Mask HALP as done in case the interrupt is raised */
++ wil->halp.handle_icr = false;
+ wil6210_mask_halp(wil);
+ } else {
+ wil_dbg_irq(wil,
+diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
+index 73cdf54521f9..236dcb6f5e84 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx.c
++++ b/drivers/net/wireless/ath/wil6210/txrx.c
+@@ -881,7 +881,7 @@ static void wil_rx_buf_len_init(struct wil6210_priv *wil)
+ }
+ }
+
+-static int wil_rx_init(struct wil6210_priv *wil, u16 size)
++static int wil_rx_init(struct wil6210_priv *wil, uint order)
+ {
+ struct wil_ring *vring = &wil->ring_rx;
+ int rc;
+@@ -895,7 +895,7 @@ static int wil_rx_init(struct wil6210_priv *wil, u16 size)
+
+ wil_rx_buf_len_init(wil);
+
+- vring->size = size;
++ vring->size = 1 << order;
+ vring->is_rx = true;
+ rc = wil_vring_alloc(wil, vring);
+ if (rc)
+diff --git a/drivers/net/wireless/ath/wil6210/txrx_edma.c b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+index 5fa8d6ad6648..fe666a3583c1 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx_edma.c
++++ b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+@@ -268,6 +268,9 @@ static void wil_move_all_rx_buff_to_free_list(struct wil6210_priv *wil,
+ struct list_head *active = &wil->rx_buff_mgmt.active;
+ dma_addr_t pa;
+
++ if (!wil->rx_buff_mgmt.buff_arr)
++ return;
++
+ while (!list_empty(active)) {
+ struct wil_rx_buff *rx_buff =
+ list_first_entry(active, struct wil_rx_buff, list);
+@@ -590,9 +593,9 @@ static void wil_rx_buf_len_init_edma(struct wil6210_priv *wil)
+ WIL_MAX_ETH_MTU : WIL_EDMA_RX_BUF_LEN_DEFAULT;
+ }
+
+-static int wil_rx_init_edma(struct wil6210_priv *wil, u16 desc_ring_size)
++static int wil_rx_init_edma(struct wil6210_priv *wil, uint desc_ring_order)
+ {
+- u16 status_ring_size;
++ u16 status_ring_size, desc_ring_size = 1 << desc_ring_order;
+ struct wil_ring *ring = &wil->ring_rx;
+ int rc;
+ size_t elem_size = wil->use_compressed_rx_status ?
+@@ -607,7 +610,12 @@ static int wil_rx_init_edma(struct wil6210_priv *wil, u16 desc_ring_size)
+ "compressed RX status cannot be used with SW reorder\n");
+ return -EINVAL;
+ }
+-
++ if (wil->rx_status_ring_order <= desc_ring_order)
++ /* make sure sring is larger than desc ring */
++ wil->rx_status_ring_order = desc_ring_order + 1;
++ if (wil->rx_buff_id_count <= desc_ring_size)
++ /* make sure we will not run out of buff_ids */
++ wil->rx_buff_id_count = desc_ring_size + 512;
+ if (wil->rx_status_ring_order < WIL_SRING_SIZE_ORDER_MIN ||
+ wil->rx_status_ring_order > WIL_SRING_SIZE_ORDER_MAX)
+ wil->rx_status_ring_order = WIL_RX_SRING_SIZE_ORDER_DEFAULT;
+diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
+index 75fe1a3b7046..bc89044d0b66 100644
+--- a/drivers/net/wireless/ath/wil6210/wil6210.h
++++ b/drivers/net/wireless/ath/wil6210/wil6210.h
+@@ -602,7 +602,7 @@ struct wil_txrx_ops {
+ struct wil_ring *ring, struct sk_buff *skb);
+ irqreturn_t (*irq_tx)(int irq, void *cookie);
+ /* RX ops */
+- int (*rx_init)(struct wil6210_priv *wil, u16 ring_size);
++ int (*rx_init)(struct wil6210_priv *wil, uint ring_order);
+ void (*rx_fini)(struct wil6210_priv *wil);
+ int (*wmi_addba_rx_resp)(struct wil6210_priv *wil, u8 mid, u8 cid,
+ u8 tid, u8 token, u16 status, bool amsdu,
+@@ -778,6 +778,7 @@ struct wil_halp {
+ struct mutex lock; /* protect halp ref_cnt */
+ unsigned int ref_cnt;
+ struct completion comp;
++ u8 handle_icr;
+ };
+
+ struct wil_blob_wrapper {
+diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
+index 8a603432f531..3928b13ae026 100644
+--- a/drivers/net/wireless/ath/wil6210/wmi.c
++++ b/drivers/net/wireless/ath/wil6210/wmi.c
+@@ -2802,7 +2802,7 @@ static void wmi_event_handle(struct wil6210_priv *wil,
+
+ if (mid == MID_BROADCAST)
+ mid = 0;
+- if (mid >= wil->max_vifs) {
++ if (mid >= ARRAY_SIZE(wil->vifs) || mid >= wil->max_vifs) {
+ wil_dbg_wmi(wil, "invalid mid %d, event skipped\n",
+ mid);
+ return;
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index ce2dd06af62e..3564f5869b44 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3327,9 +3327,9 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ param.no_vif = true;
+
+ if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
+- hwname = kasprintf(GFP_KERNEL, "%.*s",
+- nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
+- (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]));
++ hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
++ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
++ GFP_KERNEL);
+ if (!hwname)
+ return -ENOMEM;
+ param.hwname = hwname;
+@@ -3385,9 +3385,9 @@ static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
+ idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
+ } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
+- hwname = kasprintf(GFP_KERNEL, "%.*s",
+- nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
+- (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]));
++ hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]),
++ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
++ GFP_KERNEL);
+ if (!hwname)
+ return -ENOMEM;
+ } else
+diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
+index e1e5dfcb16f3..259fd58812ae 100644
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -31,6 +31,7 @@
+ #include <linux/slab.h>
+ #include <linux/delay.h>
+ #include <linux/pm_runtime.h>
++#include <linux/bitmap.h>
+
+ /*
+ * Because the PCA9685 has only one prescaler per chip, changing the period of
+@@ -85,6 +86,7 @@ struct pca9685 {
+ #if IS_ENABLED(CONFIG_GPIOLIB)
+ struct mutex lock;
+ struct gpio_chip gpio;
++ DECLARE_BITMAP(pwms_inuse, PCA9685_MAXCHAN + 1);
+ #endif
+ };
+
+@@ -94,51 +96,51 @@ static inline struct pca9685 *to_pca(struct pwm_chip *chip)
+ }
+
+ #if IS_ENABLED(CONFIG_GPIOLIB)
+-static int pca9685_pwm_gpio_request(struct gpio_chip *gpio, unsigned int offset)
++static bool pca9685_pwm_test_and_set_inuse(struct pca9685 *pca, int pwm_idx)
+ {
+- struct pca9685 *pca = gpiochip_get_data(gpio);
+- struct pwm_device *pwm;
++ bool is_inuse;
+
+ mutex_lock(&pca->lock);
+-
+- pwm = &pca->chip.pwms[offset];
+-
+- if (pwm->flags & (PWMF_REQUESTED | PWMF_EXPORTED)) {
+- mutex_unlock(&pca->lock);
+- return -EBUSY;
++ if (pwm_idx >= PCA9685_MAXCHAN) {
++ /*
++ * "all LEDs" channel:
++ * pretend already in use if any of the PWMs are requested
++ */
++ if (!bitmap_empty(pca->pwms_inuse, PCA9685_MAXCHAN)) {
++ is_inuse = true;
++ goto out;
++ }
++ } else {
++ /*
++ * regular channel:
++ * pretend already in use if the "all LEDs" channel is requested
++ */
++ if (test_bit(PCA9685_MAXCHAN, pca->pwms_inuse)) {
++ is_inuse = true;
++ goto out;
++ }
+ }
+-
+- pwm_set_chip_data(pwm, (void *)1);
+-
++ is_inuse = test_and_set_bit(pwm_idx, pca->pwms_inuse);
++out:
+ mutex_unlock(&pca->lock);
+- pm_runtime_get_sync(pca->chip.dev);
+- return 0;
++ return is_inuse;
+ }
+
+-static bool pca9685_pwm_is_gpio(struct pca9685 *pca, struct pwm_device *pwm)
++static void pca9685_pwm_clear_inuse(struct pca9685 *pca, int pwm_idx)
+ {
+- bool is_gpio = false;
+-
+ mutex_lock(&pca->lock);
++ clear_bit(pwm_idx, pca->pwms_inuse);
++ mutex_unlock(&pca->lock);
++}
+
+- if (pwm->hwpwm >= PCA9685_MAXCHAN) {
+- unsigned int i;
+-
+- /*
+- * Check if any of the GPIOs are requested and in that case
+- * prevent using the "all LEDs" channel.
+- */
+- for (i = 0; i < pca->gpio.ngpio; i++)
+- if (gpiochip_is_requested(&pca->gpio, i)) {
+- is_gpio = true;
+- break;
+- }
+- } else if (pwm_get_chip_data(pwm)) {
+- is_gpio = true;
+- }
++static int pca9685_pwm_gpio_request(struct gpio_chip *gpio, unsigned int offset)
++{
++ struct pca9685 *pca = gpiochip_get_data(gpio);
+
+- mutex_unlock(&pca->lock);
+- return is_gpio;
++ if (pca9685_pwm_test_and_set_inuse(pca, offset))
++ return -EBUSY;
++ pm_runtime_get_sync(pca->chip.dev);
++ return 0;
+ }
+
+ static int pca9685_pwm_gpio_get(struct gpio_chip *gpio, unsigned int offset)
+@@ -173,6 +175,7 @@ static void pca9685_pwm_gpio_free(struct gpio_chip *gpio, unsigned int offset)
+
+ pca9685_pwm_gpio_set(gpio, offset, 0);
+ pm_runtime_put(pca->chip.dev);
++ pca9685_pwm_clear_inuse(pca, offset);
+ }
+
+ static int pca9685_pwm_gpio_get_direction(struct gpio_chip *chip,
+@@ -224,12 +227,17 @@ static int pca9685_pwm_gpio_probe(struct pca9685 *pca)
+ return devm_gpiochip_add_data(dev, &pca->gpio, pca);
+ }
+ #else
+-static inline bool pca9685_pwm_is_gpio(struct pca9685 *pca,
+- struct pwm_device *pwm)
++static inline bool pca9685_pwm_test_and_set_inuse(struct pca9685 *pca,
++ int pwm_idx)
+ {
+ return false;
+ }
+
++static inline void
++pca9685_pwm_clear_inuse(struct pca9685 *pca, int pwm_idx)
++{
++}
++
+ static inline int pca9685_pwm_gpio_probe(struct pca9685 *pca)
+ {
+ return 0;
+@@ -413,7 +421,7 @@ static int pca9685_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm)
+ {
+ struct pca9685 *pca = to_pca(chip);
+
+- if (pca9685_pwm_is_gpio(pca, pwm))
++ if (pca9685_pwm_test_and_set_inuse(pca, pwm->hwpwm))
+ return -EBUSY;
+ pm_runtime_get_sync(chip->dev);
+
+@@ -422,8 +430,11 @@ static int pca9685_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm)
+
+ static void pca9685_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
+ {
++ struct pca9685 *pca = to_pca(chip);
++
+ pca9685_pwm_disable(chip, pwm);
+ pm_runtime_put(chip->dev);
++ pca9685_pwm_clear_inuse(pca, pwm->hwpwm);
+ }
+
+ static const struct pwm_ops pca9685_pwm_ops = {
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index b3dee24917a8..d91209ba18c8 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1563,6 +1563,11 @@ start:
+ */
+ if (ufshcd_can_hibern8_during_gating(hba) &&
+ ufshcd_is_link_hibern8(hba)) {
++ if (async) {
++ rc = -EAGAIN;
++ hba->clk_gating.active_reqs--;
++ break;
++ }
+ spin_unlock_irqrestore(hba->host->host_lock, flags);
+ flush_work(&hba->clk_gating.ungate_work);
+ spin_lock_irqsave(hba->host->host_lock, flags);
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 03e9cb156df9..1633e2666268 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4275,30 +4275,37 @@ int iscsit_close_connection(
+ if (!atomic_read(&sess->session_reinstatement) &&
+ atomic_read(&sess->session_fall_back_to_erl0)) {
+ spin_unlock_bh(&sess->conn_lock);
++ complete_all(&sess->session_wait_comp);
+ iscsit_close_session(sess);
+
+ return 0;
+ } else if (atomic_read(&sess->session_logout)) {
+ pr_debug("Moving to TARG_SESS_STATE_FREE.\n");
+ sess->session_state = TARG_SESS_STATE_FREE;
+- spin_unlock_bh(&sess->conn_lock);
+
+- if (atomic_read(&sess->sleep_on_sess_wait_comp))
+- complete(&sess->session_wait_comp);
++ if (atomic_read(&sess->session_close)) {
++ spin_unlock_bh(&sess->conn_lock);
++ complete_all(&sess->session_wait_comp);
++ iscsit_close_session(sess);
++ } else {
++ spin_unlock_bh(&sess->conn_lock);
++ }
+
+ return 0;
+ } else {
+ pr_debug("Moving to TARG_SESS_STATE_FAILED.\n");
+ sess->session_state = TARG_SESS_STATE_FAILED;
+
+- if (!atomic_read(&sess->session_continuation)) {
+- spin_unlock_bh(&sess->conn_lock);
++ if (!atomic_read(&sess->session_continuation))
+ iscsit_start_time2retain_handler(sess);
+- } else
+- spin_unlock_bh(&sess->conn_lock);
+
+- if (atomic_read(&sess->sleep_on_sess_wait_comp))
+- complete(&sess->session_wait_comp);
++ if (atomic_read(&sess->session_close)) {
++ spin_unlock_bh(&sess->conn_lock);
++ complete_all(&sess->session_wait_comp);
++ iscsit_close_session(sess);
++ } else {
++ spin_unlock_bh(&sess->conn_lock);
++ }
+
+ return 0;
+ }
+@@ -4404,9 +4411,9 @@ static void iscsit_logout_post_handler_closesession(
+ complete(&conn->conn_logout_comp);
+
+ iscsit_dec_conn_usage_count(conn);
++ atomic_set(&sess->session_close, 1);
+ iscsit_stop_session(sess, sleep, sleep);
+ iscsit_dec_session_usage_count(sess);
+- iscsit_close_session(sess);
+ }
+
+ static void iscsit_logout_post_handler_samecid(
+@@ -4541,49 +4548,6 @@ void iscsit_fail_session(struct iscsi_session *sess)
+ sess->session_state = TARG_SESS_STATE_FAILED;
+ }
+
+-int iscsit_free_session(struct iscsi_session *sess)
+-{
+- u16 conn_count = atomic_read(&sess->nconn);
+- struct iscsi_conn *conn, *conn_tmp = NULL;
+- int is_last;
+-
+- spin_lock_bh(&sess->conn_lock);
+- atomic_set(&sess->sleep_on_sess_wait_comp, 1);
+-
+- list_for_each_entry_safe(conn, conn_tmp, &sess->sess_conn_list,
+- conn_list) {
+- if (conn_count == 0)
+- break;
+-
+- if (list_is_last(&conn->conn_list, &sess->sess_conn_list)) {
+- is_last = 1;
+- } else {
+- iscsit_inc_conn_usage_count(conn_tmp);
+- is_last = 0;
+- }
+- iscsit_inc_conn_usage_count(conn);
+-
+- spin_unlock_bh(&sess->conn_lock);
+- iscsit_cause_connection_reinstatement(conn, 1);
+- spin_lock_bh(&sess->conn_lock);
+-
+- iscsit_dec_conn_usage_count(conn);
+- if (is_last == 0)
+- iscsit_dec_conn_usage_count(conn_tmp);
+-
+- conn_count--;
+- }
+-
+- if (atomic_read(&sess->nconn)) {
+- spin_unlock_bh(&sess->conn_lock);
+- wait_for_completion(&sess->session_wait_comp);
+- } else
+- spin_unlock_bh(&sess->conn_lock);
+-
+- iscsit_close_session(sess);
+- return 0;
+-}
+-
+ void iscsit_stop_session(
+ struct iscsi_session *sess,
+ int session_sleep,
+@@ -4594,8 +4558,6 @@ void iscsit_stop_session(
+ int is_last;
+
+ spin_lock_bh(&sess->conn_lock);
+- if (session_sleep)
+- atomic_set(&sess->sleep_on_sess_wait_comp, 1);
+
+ if (connection_sleep) {
+ list_for_each_entry_safe(conn, conn_tmp, &sess->sess_conn_list,
+@@ -4653,12 +4615,15 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ spin_lock(&sess->conn_lock);
+ if (atomic_read(&sess->session_fall_back_to_erl0) ||
+ atomic_read(&sess->session_logout) ||
++ atomic_read(&sess->session_close) ||
+ (sess->time2retain_timer_flags & ISCSI_TF_EXPIRED)) {
+ spin_unlock(&sess->conn_lock);
+ continue;
+ }
++ iscsit_inc_session_usage_count(sess);
+ atomic_set(&sess->session_reinstatement, 1);
+ atomic_set(&sess->session_fall_back_to_erl0, 1);
++ atomic_set(&sess->session_close, 1);
+ spin_unlock(&sess->conn_lock);
+
+ list_move_tail(&se_sess->sess_list, &free_list);
+@@ -4668,7 +4633,9 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
+ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
+
+- iscsit_free_session(sess);
++ list_del_init(&se_sess->sess_list);
++ iscsit_stop_session(sess, 1, 1);
++ iscsit_dec_session_usage_count(sess);
+ session_count++;
+ }
+
+diff --git a/drivers/target/iscsi/iscsi_target.h b/drivers/target/iscsi/iscsi_target.h
+index 48bac0acf8c7..11a481cf6ead 100644
+--- a/drivers/target/iscsi/iscsi_target.h
++++ b/drivers/target/iscsi/iscsi_target.h
+@@ -43,7 +43,6 @@ extern int iscsi_target_rx_thread(void *);
+ extern int iscsit_close_connection(struct iscsi_conn *);
+ extern int iscsit_close_session(struct iscsi_session *);
+ extern void iscsit_fail_session(struct iscsi_session *);
+-extern int iscsit_free_session(struct iscsi_session *);
+ extern void iscsit_stop_session(struct iscsi_session *, int, int);
+ extern int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *, int);
+
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index 95d0a22b2ad6..d25cadc4f4f1 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -1501,20 +1501,23 @@ static void lio_tpg_close_session(struct se_session *se_sess)
+ spin_lock(&sess->conn_lock);
+ if (atomic_read(&sess->session_fall_back_to_erl0) ||
+ atomic_read(&sess->session_logout) ||
++ atomic_read(&sess->session_close) ||
+ (sess->time2retain_timer_flags & ISCSI_TF_EXPIRED)) {
+ spin_unlock(&sess->conn_lock);
+ spin_unlock_bh(&se_tpg->session_lock);
+ return;
+ }
++ iscsit_inc_session_usage_count(sess);
+ atomic_set(&sess->session_reinstatement, 1);
+ atomic_set(&sess->session_fall_back_to_erl0, 1);
++ atomic_set(&sess->session_close, 1);
+ spin_unlock(&sess->conn_lock);
+
+ iscsit_stop_time2retain_timer(sess);
+ spin_unlock_bh(&se_tpg->session_lock);
+
+ iscsit_stop_session(sess, 1, 1);
+- iscsit_close_session(sess);
++ iscsit_dec_session_usage_count(sess);
+ }
+
+ static u32 lio_tpg_get_inst_index(struct se_portal_group *se_tpg)
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index bb90c80ff388..f25049ba4a85 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -164,6 +164,7 @@ int iscsi_check_for_session_reinstatement(struct iscsi_conn *conn)
+ spin_lock(&sess_p->conn_lock);
+ if (atomic_read(&sess_p->session_fall_back_to_erl0) ||
+ atomic_read(&sess_p->session_logout) ||
++ atomic_read(&sess_p->session_close) ||
+ (sess_p->time2retain_timer_flags & ISCSI_TF_EXPIRED)) {
+ spin_unlock(&sess_p->conn_lock);
+ continue;
+@@ -174,6 +175,7 @@ int iscsi_check_for_session_reinstatement(struct iscsi_conn *conn)
+ (sess_p->sess_ops->SessionType == sessiontype))) {
+ atomic_set(&sess_p->session_reinstatement, 1);
+ atomic_set(&sess_p->session_fall_back_to_erl0, 1);
++ atomic_set(&sess_p->session_close, 1);
+ spin_unlock(&sess_p->conn_lock);
+ iscsit_inc_session_usage_count(sess_p);
+ iscsit_stop_time2retain_timer(sess_p);
+@@ -198,7 +200,6 @@ int iscsi_check_for_session_reinstatement(struct iscsi_conn *conn)
+ if (sess->session_state == TARG_SESS_STATE_FAILED) {
+ spin_unlock_bh(&sess->conn_lock);
+ iscsit_dec_session_usage_count(sess);
+- iscsit_close_session(sess);
+ return 0;
+ }
+ spin_unlock_bh(&sess->conn_lock);
+@@ -206,7 +207,6 @@ int iscsi_check_for_session_reinstatement(struct iscsi_conn *conn)
+ iscsit_stop_session(sess, 1, 1);
+ iscsit_dec_session_usage_count(sess);
+
+- iscsit_close_session(sess);
+ return 0;
+ }
+
+@@ -494,6 +494,7 @@ static int iscsi_login_non_zero_tsih_s2(
+ sess_p = (struct iscsi_session *)se_sess->fabric_sess_ptr;
+ if (atomic_read(&sess_p->session_fall_back_to_erl0) ||
+ atomic_read(&sess_p->session_logout) ||
++ atomic_read(&sess_p->session_close) ||
+ (sess_p->time2retain_timer_flags & ISCSI_TF_EXPIRED))
+ continue;
+ if (!memcmp(sess_p->isid, pdu->isid, 6) &&
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 7b8b463676ad..8a4455d0af8b 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -688,12 +688,13 @@ out:
+ return 0;
+ }
+
+-static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force);
++static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force,
++ bool interrupt);
+ static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep)
+ {
+ struct dwc3_request *req;
+
+- dwc3_stop_active_transfer(dep, true);
++ dwc3_stop_active_transfer(dep, true, false);
+
+ /* - giveback all requests to gadget driver */
+ while (!list_empty(&dep->started_list)) {
+@@ -1416,7 +1417,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
+ }
+ if (r == req) {
+ /* wait until it is processed */
+- dwc3_stop_active_transfer(dep, true);
++ dwc3_stop_active_transfer(dep, true, true);
+
+ if (!r->trb)
+ goto out0;
+@@ -2365,10 +2366,8 @@ static void dwc3_gadget_endpoint_transfer_in_progress(struct dwc3_ep *dep,
+
+ dwc3_gadget_ep_cleanup_completed_requests(dep, event, status);
+
+- if (stop) {
+- dwc3_stop_active_transfer(dep, true);
+- dep->flags = DWC3_EP_ENABLED;
+- }
++ if (stop)
++ dwc3_stop_active_transfer(dep, true, true);
+
+ /*
+ * WORKAROUND: This is the 2nd half of U1/U2 -> U0 workaround.
+@@ -2488,7 +2487,8 @@ static void dwc3_reset_gadget(struct dwc3 *dwc)
+ }
+ }
+
+-static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force)
++static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force,
++ bool interrupt)
+ {
+ struct dwc3 *dwc = dep->dwc;
+ struct dwc3_gadget_ep_cmd_params params;
+@@ -2532,7 +2532,7 @@ static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force)
+
+ cmd = DWC3_DEPCMD_ENDTRANSFER;
+ cmd |= force ? DWC3_DEPCMD_HIPRI_FORCERM : 0;
+- cmd |= DWC3_DEPCMD_CMDIOC;
++ cmd |= interrupt ? DWC3_DEPCMD_CMDIOC : 0;
+ cmd |= DWC3_DEPCMD_PARAM(dep->resource_index);
+ memset(¶ms, 0, sizeof(params));
+ ret = dwc3_send_gadget_ep_cmd(dep, cmd, ¶ms);
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index d1c5cd90b182..eedcb7bf50e9 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -525,8 +525,8 @@ static int should_ignore_root(struct btrfs_root *root)
+ if (!reloc_root)
+ return 0;
+
+- if (btrfs_root_last_snapshot(&reloc_root->root_item) ==
+- root->fs_info->running_transaction->transid - 1)
++ if (btrfs_header_generation(reloc_root->commit_root) ==
++ root->fs_info->running_transaction->transid)
+ return 0;
+ /*
+ * if there is reloc tree and it was created in previous
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index f81eb1785af2..a289f4bcee45 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3438,8 +3438,8 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
+ (unsigned long long)map->m_lblk, map_len);
+
+ sbi = EXT4_SB(inode->i_sb);
+- eof_block = (inode->i_size + inode->i_sb->s_blocksize - 1) >>
+- inode->i_sb->s_blocksize_bits;
++ eof_block = (EXT4_I(inode)->i_disksize + inode->i_sb->s_blocksize - 1)
++ >> inode->i_sb->s_blocksize_bits;
+ if (eof_block < map->m_lblk + map_len)
+ eof_block = map->m_lblk + map_len;
+
+@@ -3694,8 +3694,8 @@ static int ext4_split_convert_extents(handle_t *handle,
+ __func__, inode->i_ino,
+ (unsigned long long)map->m_lblk, map->m_len);
+
+- eof_block = (inode->i_size + inode->i_sb->s_blocksize - 1) >>
+- inode->i_sb->s_blocksize_bits;
++ eof_block = (EXT4_I(inode)->i_disksize + inode->i_sb->s_blocksize - 1)
++ >> inode->i_sb->s_blocksize_bits;
+ if (eof_block < map->m_lblk + map->m_len)
+ eof_block = map->m_lblk + map->m_len;
+ /*
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index d44fc3f579e1..c76962eba5dd 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4031,7 +4031,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ if (sbi->s_inodes_per_group < sbi->s_inodes_per_block ||
+ sbi->s_inodes_per_group > blocksize * 8) {
+ ext4_msg(sb, KERN_ERR, "invalid inodes per group: %lu\n",
+- sbi->s_blocks_per_group);
++ sbi->s_inodes_per_group);
+ goto failed_mount;
+ }
+ sbi->s_itb_per_group = sbi->s_inodes_per_group /
+@@ -4162,9 +4162,9 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ EXT4_BLOCKS_PER_GROUP(sb) - 1);
+ do_div(blocks_count, EXT4_BLOCKS_PER_GROUP(sb));
+ if (blocks_count > ((uint64_t)1<<32) - EXT4_DESC_PER_BLOCK(sb)) {
+- ext4_msg(sb, KERN_WARNING, "groups count too large: %u "
++ ext4_msg(sb, KERN_WARNING, "groups count too large: %llu "
+ "(block count %llu, first data block %u, "
+- "blocks per group %lu)", sbi->s_groups_count,
++ "blocks per group %lu)", blocks_count,
+ ext4_blocks_count(es),
+ le32_to_cpu(es->s_first_data_block),
+ EXT4_BLOCKS_PER_GROUP(sb));
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 4200a6fe9599..97760cb9bcd7 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -992,9 +992,10 @@ restart_loop:
+ * journalled data) we need to unmap buffer and clear
+ * more bits. We also need to be careful about the check
+ * because the data page mapping can get cleared under
+- * out hands, which alse need not to clear more bits
+- * because the page and buffers will be freed and can
+- * never be reused once we are done with them.
++ * our hands. Note that if mapping == NULL, we don't
++ * need to make buffer unmapped because the page is
++ * already detached from the mapping and buffers cannot
++ * get reused.
+ */
+ mapping = READ_ONCE(bh->b_page->mapping);
+ if (mapping && !sb_is_blkdev_sb(mapping->host->i_sb)) {
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index a138bb3bc2a5..8b3c284ce92e 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -884,7 +884,7 @@ struct inode *ovl_get_inode(struct super_block *sb,
+ struct dentry *lowerdentry = lowerpath ? lowerpath->dentry : NULL;
+ bool bylower = ovl_hash_bylower(sb, upperdentry, lowerdentry,
+ oip->index);
+- int fsid = bylower ? oip->lowerpath->layer->fsid : 0;
++ int fsid = bylower ? lowerpath->layer->fsid : 0;
+ bool is_dir, metacopy = false;
+ unsigned long ino = 0;
+ int err = oip->newinode ? -EEXIST : -ENOMEM;
+@@ -934,6 +934,8 @@ struct inode *ovl_get_inode(struct super_block *sb,
+ err = -ENOMEM;
+ goto out_err;
+ }
++ ino = realinode->i_ino;
++ fsid = lowerpath->layer->fsid;
+ }
+ ovl_fill_inode(inode, realinode->i_mode, realinode->i_rdev, ino, fsid);
+ ovl_inode_init(inode, upperdentry, lowerdentry, oip->lowerdata);
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 7b9c82de11cc..5e26d61867b2 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -234,6 +234,7 @@ static inline bool ipv6_anycast_destination(const struct dst_entry *dst,
+
+ return rt->rt6i_flags & RTF_ANYCAST ||
+ (rt->rt6i_dst.plen < 127 &&
++ !(rt->rt6i_flags & (RTF_GATEWAY | RTF_NONEXTHOP)) &&
+ ipv6_addr_equal(&rt->rt6i_dst.addr, daddr));
+ }
+
+diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
+index f2e6abea8490..70d18444d18d 100644
+--- a/include/target/iscsi/iscsi_target_core.h
++++ b/include/target/iscsi/iscsi_target_core.h
+@@ -674,7 +674,7 @@ struct iscsi_session {
+ atomic_t session_logout;
+ atomic_t session_reinstatement;
+ atomic_t session_stop_active;
+- atomic_t sleep_on_sess_wait_comp;
++ atomic_t session_close;
+ /* connection list */
+ struct list_head sess_conn_list;
+ struct list_head cr_active_list;
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index 9300e8bbf08a..38a2a558e546 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -1081,14 +1081,10 @@ register_snapshot_trigger(char *glob, struct event_trigger_ops *ops,
+ struct event_trigger_data *data,
+ struct trace_event_file *file)
+ {
+- int ret = register_trigger(glob, ops, data, file);
+-
+- if (ret > 0 && tracing_alloc_snapshot_instance(file->tr) != 0) {
+- unregister_trigger(glob, ops, data, file);
+- ret = 0;
+- }
++ if (tracing_alloc_snapshot_instance(file->tr) != 0)
++ return 0;
+
+- return ret;
++ return register_trigger(glob, ops, data, file);
+ }
+
+ static int
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 958d6ba9ee2d..be65161f9753 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1668,7 +1668,6 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
+ nr_pages = get_vm_area_size(area) >> PAGE_SHIFT;
+ array_size = (nr_pages * sizeof(struct page *));
+
+- area->nr_pages = nr_pages;
+ /* Please note that the recursion is strictly bounded. */
+ if (array_size > PAGE_SIZE) {
+ pages = __vmalloc_node(array_size, 1, nested_gfp|highmem_mask,
+@@ -1676,13 +1675,16 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
+ } else {
+ pages = kmalloc_node(array_size, nested_gfp, node);
+ }
+- area->pages = pages;
+- if (!area->pages) {
++
++ if (!pages) {
+ remove_vm_area(area->addr);
+ kfree(area);
+ return NULL;
+ }
+
++ area->pages = pages;
++ area->nr_pages = nr_pages;
++
+ for (i = 0; i < area->nr_pages; i++) {
+ struct page *page;
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 2f4d35101f4d..426635e188fc 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3934,7 +3934,8 @@ EXPORT_SYMBOL(netdev_max_backlog);
+
+ int netdev_tstamp_prequeue __read_mostly = 1;
+ int netdev_budget __read_mostly = 300;
+-unsigned int __read_mostly netdev_budget_usecs = 2000;
++/* Must be at least 2 jiffes to guarantee 1 jiffy timeout */
++unsigned int __read_mostly netdev_budget_usecs = 2 * USEC_PER_SEC / HZ;
+ int weight_p __read_mostly = 64; /* old backlog weight */
+ int dev_weight_rx_bias __read_mostly = 1; /* bias for backlog weight */
+ int dev_weight_tx_bias __read_mostly = 1; /* bias for output_queue quota */
+diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
+index 37708dabebd1..606bc7fe5cc7 100644
+--- a/net/hsr/hsr_netlink.c
++++ b/net/hsr/hsr_netlink.c
+@@ -64,10 +64,16 @@ static int hsr_newlink(struct net *src_net, struct net_device *dev,
+ else
+ multicast_spec = nla_get_u8(data[IFLA_HSR_MULTICAST_SPEC]);
+
+- if (!data[IFLA_HSR_VERSION])
++ if (!data[IFLA_HSR_VERSION]) {
+ hsr_version = 0;
+- else
++ } else {
+ hsr_version = nla_get_u8(data[IFLA_HSR_VERSION]);
++ if (hsr_version > 1) {
++ NL_SET_ERR_MSG_MOD(extack,
++ "Only versions 0..1 are supported");
++ return -EINVAL;
++ }
++ }
+
+ return hsr_dev_finalize(dev, link, multicast_spec, hsr_version);
+ }
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index fabece4b8997..a08d682ba676 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -587,12 +587,15 @@ struct in_ifaddr *inet_ifa_byprefix(struct in_device *in_dev, __be32 prefix,
+ return NULL;
+ }
+
+-static int ip_mc_config(struct sock *sk, bool join, const struct in_ifaddr *ifa)
++static int ip_mc_autojoin_config(struct net *net, bool join,
++ const struct in_ifaddr *ifa)
+ {
++#if defined(CONFIG_IP_MULTICAST)
+ struct ip_mreqn mreq = {
+ .imr_multiaddr.s_addr = ifa->ifa_address,
+ .imr_ifindex = ifa->ifa_dev->dev->ifindex,
+ };
++ struct sock *sk = net->ipv4.mc_autojoin_sk;
+ int ret;
+
+ ASSERT_RTNL();
+@@ -605,6 +608,9 @@ static int ip_mc_config(struct sock *sk, bool join, const struct in_ifaddr *ifa)
+ release_sock(sk);
+
+ return ret;
++#else
++ return -EOPNOTSUPP;
++#endif
+ }
+
+ static int inet_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh,
+@@ -646,7 +652,7 @@ static int inet_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh,
+ continue;
+
+ if (ipv4_is_multicast(ifa->ifa_address))
+- ip_mc_config(net->ipv4.mc_autojoin_sk, false, ifa);
++ ip_mc_autojoin_config(net, false, ifa);
+ __inet_del_ifa(in_dev, ifap, 1, nlh, NETLINK_CB(skb).portid);
+ return 0;
+ }
+@@ -907,8 +913,7 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh,
+ */
+ set_ifa_lifetime(ifa, valid_lft, prefered_lft);
+ if (ifa->ifa_flags & IFA_F_MCAUTOJOIN) {
+- int ret = ip_mc_config(net->ipv4.mc_autojoin_sk,
+- true, ifa);
++ int ret = ip_mc_autojoin_config(net, true, ifa);
+
+ if (ret < 0) {
+ inet_free_ifa(ifa);
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 82d38f93c81a..518327dccb3c 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -769,20 +769,21 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+
+ node = NULL;
+ if (addr->sq_node == QRTR_NODE_BCAST) {
+- enqueue_fn = qrtr_bcast_enqueue;
+- if (addr->sq_port != QRTR_PORT_CTRL) {
++ if (addr->sq_port != QRTR_PORT_CTRL &&
++ qrtr_local_nid != QRTR_NODE_BCAST) {
+ release_sock(sk);
+ return -ENOTCONN;
+ }
++ enqueue_fn = qrtr_bcast_enqueue;
+ } else if (addr->sq_node == ipc->us.sq_node) {
+ enqueue_fn = qrtr_local_enqueue;
+ } else {
+- enqueue_fn = qrtr_node_enqueue;
+ node = qrtr_node_lookup(addr->sq_node);
+ if (!node) {
+ release_sock(sk);
+ return -ECONNRESET;
+ }
++ enqueue_fn = qrtr_node_enqueue;
+ }
+
+ plen = (len + 3) & ~3;
+diff --git a/security/keys/proc.c b/security/keys/proc.c
+index d38be9db2cc0..7ec2779cb089 100644
+--- a/security/keys/proc.c
++++ b/security/keys/proc.c
+@@ -144,6 +144,8 @@ static void *proc_keys_next(struct seq_file *p, void *v, loff_t *_pos)
+ n = key_serial_next(p, v);
+ if (n)
+ *_pos = key_node_serial(n);
++ else
++ (*_pos)++;
+ return n;
+ }
+
+diff --git a/sound/soc/intel/atom/sst-atom-controls.c b/sound/soc/intel/atom/sst-atom-controls.c
+index 3672d36b4b66..737f5d553313 100644
+--- a/sound/soc/intel/atom/sst-atom-controls.c
++++ b/sound/soc/intel/atom/sst-atom-controls.c
+@@ -1341,7 +1341,7 @@ int sst_send_pipe_gains(struct snd_soc_dai *dai, int stream, int mute)
+ dai->capture_widget->name);
+ w = dai->capture_widget;
+ snd_soc_dapm_widget_for_each_source_path(w, p) {
+- if (p->connected && !p->connected(w, p->sink))
++ if (p->connected && !p->connected(w, p->source))
+ continue;
+
+ if (p->connect && p->source->power &&
+diff --git a/sound/soc/intel/atom/sst/sst_pci.c b/sound/soc/intel/atom/sst/sst_pci.c
+index 6906ee624cf6..438c7bcd8c4c 100644
+--- a/sound/soc/intel/atom/sst/sst_pci.c
++++ b/sound/soc/intel/atom/sst/sst_pci.c
+@@ -107,7 +107,7 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
+ dev_dbg(ctx->dev, "DRAM Ptr %p\n", ctx->dram);
+ do_release_regions:
+ pci_release_regions(pci);
+- return 0;
++ return ret;
+ }
+
+ /*
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index f2e173b9691d..257da95a4ea6 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1461,7 +1461,7 @@ error:
+ usb_audio_err(chip,
+ "cannot get connectors status: req = %#x, wValue = %#x, wIndex = %#x, type = %d\n",
+ UAC_GET_CUR, validx, idx, cval->val_type);
+- return ret;
++ return filter_error(cval, ret);
+ }
+
+ ucontrol->value.integer.value[0] = val;
+@@ -1765,11 +1765,15 @@ static void get_connector_control_name(struct usb_mixer_interface *mixer,
+
+ /* Build a mixer control for a UAC connector control (jack-detect) */
+ static void build_connector_control(struct usb_mixer_interface *mixer,
++ const struct usbmix_name_map *imap,
+ struct usb_audio_term *term, bool is_input)
+ {
+ struct snd_kcontrol *kctl;
+ struct usb_mixer_elem_info *cval;
+
++ if (check_ignored_ctl(find_map(imap, term->id, 0)))
++ return;
++
+ cval = kzalloc(sizeof(*cval), GFP_KERNEL);
+ if (!cval)
+ return;
+@@ -2107,8 +2111,9 @@ static int parse_audio_input_terminal(struct mixer_build *state, int unitid,
+ check_input_term(state, term_id, &iterm);
+
+ /* Check for jack detection. */
+- if (uac_v2v3_control_is_readable(bmctls, control))
+- build_connector_control(state->mixer, &iterm, true);
++ if ((iterm.type & 0xff00) != 0x0100 &&
++ uac_v2v3_control_is_readable(bmctls, control))
++ build_connector_control(state->mixer, state->map, &iterm, true);
+
+ return 0;
+ }
+@@ -3069,13 +3074,13 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer,
+ memset(&iterm, 0, sizeof(iterm));
+ iterm.id = UAC3_BADD_IT_ID4;
+ iterm.type = UAC_BIDIR_TERMINAL_HEADSET;
+- build_connector_control(mixer, &iterm, true);
++ build_connector_control(mixer, map->map, &iterm, true);
+
+ /* Output Term - Insertion control */
+ memset(&oterm, 0, sizeof(oterm));
+ oterm.id = UAC3_BADD_OT_ID3;
+ oterm.type = UAC_BIDIR_TERMINAL_HEADSET;
+- build_connector_control(mixer, &oterm, false);
++ build_connector_control(mixer, map->map, &oterm, false);
+ }
+
+ return 0;
+@@ -3104,7 +3109,7 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ if (map->id == state.chip->usb_id) {
+ state.map = map->map;
+ state.selector_map = map->selector_map;
+- mixer->ignore_ctl_error = map->ignore_ctl_error;
++ mixer->ignore_ctl_error |= map->ignore_ctl_error;
+ break;
+ }
+ }
+@@ -3147,10 +3152,11 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ if (err < 0 && err != -EINVAL)
+ return err;
+
+- if (uac_v2v3_control_is_readable(le16_to_cpu(desc->bmControls),
++ if ((state.oterm.type & 0xff00) != 0x0100 &&
++ uac_v2v3_control_is_readable(le16_to_cpu(desc->bmControls),
+ UAC2_TE_CONNECTOR)) {
+- build_connector_control(state.mixer, &state.oterm,
+- false);
++ build_connector_control(state.mixer, state.map,
++ &state.oterm, false);
+ }
+ } else { /* UAC_VERSION_3 */
+ struct uac3_output_terminal_descriptor *desc = p;
+@@ -3172,10 +3178,11 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ if (err < 0 && err != -EINVAL)
+ return err;
+
+- if (uac_v2v3_control_is_readable(le32_to_cpu(desc->bmControls),
++ if ((state.oterm.type & 0xff00) != 0x0100 &&
++ uac_v2v3_control_is_readable(le32_to_cpu(desc->bmControls),
+ UAC3_TE_INSERTION)) {
+- build_connector_control(state.mixer, &state.oterm,
+- false);
++ build_connector_control(state.mixer, state.map,
++ &state.oterm, false);
+ }
+ }
+ }
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index f6e2cc66153a..bf000e54461b 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -364,9 +364,11 @@ static const struct usbmix_name_map dell_alc4020_map[] = {
+ };
+
+ /* Some mobos shipped with a dummy HD-audio show the invalid GET_MIN/GET_MAX
+- * response for Input Gain Pad (id=19, control=12). Skip it.
++ * response for Input Gain Pad (id=19, control=12) and the connector status
++ * for SPDIF terminal (id=18). Skip them.
+ */
+ static const struct usbmix_name_map asus_rog_map[] = {
++ { 18, NULL }, /* OT, connector control */
+ { 19, NULL, 12 }, /* FU, Input Gain Pad */
+ {}
+ };
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-04-23 11:44 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-04-23 11:44 UTC (permalink / raw
To: gentoo-commits
commit: 4904bc11bea920e7d4562f916355fd44ed6fa1b3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Apr 23 11:43:55 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Apr 23 11:43:55 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4904bc11
Linux patch 4.19.118
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1117_linux-4.19.118.patch | 2272 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2276 insertions(+)
diff --git a/0000_README b/0000_README
index 8db7823..5c6dcb8 100644
--- a/0000_README
+++ b/0000_README
@@ -507,6 +507,10 @@ Patch: 1116_linux-4.19.117.patch
From: https://www.kernel.org
Desc: Linux 4.19.117
+Patch: 1117_linux-4.19.118.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.118
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1117_linux-4.19.118.patch b/1117_linux-4.19.118.patch
new file mode 100644
index 0000000..53446f1
--- /dev/null
+++ b/1117_linux-4.19.118.patch
@@ -0,0 +1,2272 @@
+diff --git a/Makefile b/Makefile
+index 555dbaab7bad..72ae7e879077 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 117
++SUBLEVEL = 118
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
+index 00d44a60972f..e64ff80c83c5 100644
+--- a/arch/arm/boot/dts/imx6qdl.dtsi
++++ b/arch/arm/boot/dts/imx6qdl.dtsi
+@@ -1013,9 +1013,8 @@
+ compatible = "fsl,imx6q-fec";
+ reg = <0x02188000 0x4000>;
+ interrupt-names = "int0", "pps";
+- interrupts-extended =
+- <&intc 0 118 IRQ_TYPE_LEVEL_HIGH>,
+- <&intc 0 119 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>,
++ <0 119 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX6QDL_CLK_ENET>,
+ <&clks IMX6QDL_CLK_ENET>,
+ <&clks IMX6QDL_CLK_ENET_REF>;
+diff --git a/arch/arm/boot/dts/imx6qp.dtsi b/arch/arm/boot/dts/imx6qp.dtsi
+index 5f51f8e5c1fa..d91f92f944c5 100644
+--- a/arch/arm/boot/dts/imx6qp.dtsi
++++ b/arch/arm/boot/dts/imx6qp.dtsi
+@@ -77,7 +77,6 @@
+ };
+
+ &fec {
+- /delete-property/interrupts-extended;
+ interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>,
+ <0 119 IRQ_TYPE_LEVEL_HIGH>;
+ };
+diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
+index 25b3ee85066e..328ced7bfaf2 100644
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -930,7 +930,11 @@ static inline void emit_a32_rsh_i64(const s8 dst[],
+ rd = arm_bpf_get_reg64(dst, tmp, ctx);
+
+ /* Do LSR operation */
+- if (val < 32) {
++ if (val == 0) {
++ /* An immediate value of 0 encodes a shift amount of 32
++ * for LSR. To shift by 0, don't do anything.
++ */
++ } else if (val < 32) {
+ emit(ARM_MOV_SI(tmp2[1], rd[1], SRTYPE_LSR, val), ctx);
+ emit(ARM_ORR_SI(rd[1], tmp2[1], rd[0], SRTYPE_ASL, 32 - val), ctx);
+ emit(ARM_MOV_SI(rd[0], rd[0], SRTYPE_LSR, val), ctx);
+@@ -956,7 +960,11 @@ static inline void emit_a32_arsh_i64(const s8 dst[],
+ rd = arm_bpf_get_reg64(dst, tmp, ctx);
+
+ /* Do ARSH operation */
+- if (val < 32) {
++ if (val == 0) {
++ /* An immediate value of 0 encodes a shift amount of 32
++ * for ASR. To shift by 0, don't do anything.
++ */
++ } else if (val < 32) {
+ emit(ARM_MOV_SI(tmp2[1], rd[1], SRTYPE_LSR, val), ctx);
+ emit(ARM_ORR_SI(rd[1], tmp2[1], rd[0], SRTYPE_ASL, 32 - val), ctx);
+ emit(ARM_MOV_SI(rd[0], rd[0], SRTYPE_ASR, val), ctx);
+@@ -993,21 +1001,35 @@ static inline void emit_a32_mul_r64(const s8 dst[], const s8 src[],
+ arm_bpf_put_reg32(dst_hi, rd[0], ctx);
+ }
+
++static bool is_ldst_imm(s16 off, const u8 size)
++{
++ s16 off_max = 0;
++
++ switch (size) {
++ case BPF_B:
++ case BPF_W:
++ off_max = 0xfff;
++ break;
++ case BPF_H:
++ off_max = 0xff;
++ break;
++ case BPF_DW:
++ /* Need to make sure off+4 does not overflow. */
++ off_max = 0xfff - 4;
++ break;
++ }
++ return -off_max <= off && off <= off_max;
++}
++
+ /* *(size *)(dst + off) = src */
+ static inline void emit_str_r(const s8 dst, const s8 src[],
+- s32 off, struct jit_ctx *ctx, const u8 sz){
++ s16 off, struct jit_ctx *ctx, const u8 sz){
+ const s8 *tmp = bpf2a32[TMP_REG_1];
+- s32 off_max;
+ s8 rd;
+
+ rd = arm_bpf_get_reg32(dst, tmp[1], ctx);
+
+- if (sz == BPF_H)
+- off_max = 0xff;
+- else
+- off_max = 0xfff;
+-
+- if (off < 0 || off > off_max) {
++ if (!is_ldst_imm(off, sz)) {
+ emit_a32_mov_i(tmp[0], off, ctx);
+ emit(ARM_ADD_R(tmp[0], tmp[0], rd), ctx);
+ rd = tmp[0];
+@@ -1036,18 +1058,12 @@ static inline void emit_str_r(const s8 dst, const s8 src[],
+
+ /* dst = *(size*)(src + off) */
+ static inline void emit_ldx_r(const s8 dst[], const s8 src,
+- s32 off, struct jit_ctx *ctx, const u8 sz){
++ s16 off, struct jit_ctx *ctx, const u8 sz){
+ const s8 *tmp = bpf2a32[TMP_REG_1];
+ const s8 *rd = is_stacked(dst_lo) ? tmp : dst;
+ s8 rm = src;
+- s32 off_max;
+-
+- if (sz == BPF_H)
+- off_max = 0xff;
+- else
+- off_max = 0xfff;
+
+- if (off < 0 || off > off_max) {
++ if (!is_ldst_imm(off, sz)) {
+ emit_a32_mov_i(tmp[0], off, ctx);
+ emit(ARM_ADD_R(tmp[0], tmp[0], src), ctx);
+ rm = tmp[0];
+diff --git a/arch/powerpc/platforms/maple/setup.c b/arch/powerpc/platforms/maple/setup.c
+index b7f937563827..d1fee2d35b49 100644
+--- a/arch/powerpc/platforms/maple/setup.c
++++ b/arch/powerpc/platforms/maple/setup.c
+@@ -299,23 +299,6 @@ static int __init maple_probe(void)
+ return 1;
+ }
+
+-define_machine(maple) {
+- .name = "Maple",
+- .probe = maple_probe,
+- .setup_arch = maple_setup_arch,
+- .init_IRQ = maple_init_IRQ,
+- .pci_irq_fixup = maple_pci_irq_fixup,
+- .pci_get_legacy_ide_irq = maple_pci_get_legacy_ide_irq,
+- .restart = maple_restart,
+- .halt = maple_halt,
+- .get_boot_time = maple_get_boot_time,
+- .set_rtc_time = maple_set_rtc_time,
+- .get_rtc_time = maple_get_rtc_time,
+- .calibrate_decr = generic_calibrate_decr,
+- .progress = maple_progress,
+- .power_save = power4_idle,
+-};
+-
+ #ifdef CONFIG_EDAC
+ /*
+ * Register a platform device for CPC925 memory controller on
+@@ -372,3 +355,20 @@ static int __init maple_cpc925_edac_setup(void)
+ }
+ machine_device_initcall(maple, maple_cpc925_edac_setup);
+ #endif
++
++define_machine(maple) {
++ .name = "Maple",
++ .probe = maple_probe,
++ .setup_arch = maple_setup_arch,
++ .init_IRQ = maple_init_IRQ,
++ .pci_irq_fixup = maple_pci_irq_fixup,
++ .pci_get_legacy_ide_irq = maple_pci_get_legacy_ide_irq,
++ .restart = maple_restart,
++ .halt = maple_halt,
++ .get_boot_time = maple_get_boot_time,
++ .set_rtc_time = maple_set_rtc_time,
++ .get_rtc_time = maple_get_rtc_time,
++ .calibrate_decr = generic_calibrate_decr,
++ .progress = maple_progress,
++ .power_save = power4_idle,
++};
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index 5bfb1ce129f4..74a296cea21c 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -1537,6 +1537,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw)
+ perf_aux_output_end(handle, size);
+ num_sdb = aux->sfb.num_sdb;
+
++ num_sdb = aux->sfb.num_sdb;
+ while (!done) {
+ /* Get an output handle */
+ aux = perf_aux_output_begin(handle, cpuhw->event);
+diff --git a/arch/s390/kernel/processor.c b/arch/s390/kernel/processor.c
+index 6fe2e1875058..675d4be0c2b7 100644
+--- a/arch/s390/kernel/processor.c
++++ b/arch/s390/kernel/processor.c
+@@ -157,8 +157,9 @@ static void show_cpu_mhz(struct seq_file *m, unsigned long n)
+ static int show_cpuinfo(struct seq_file *m, void *v)
+ {
+ unsigned long n = (unsigned long) v - 1;
++ unsigned long first = cpumask_first(cpu_online_mask);
+
+- if (!n)
++ if (n == first)
+ show_cpu_summary(m, v);
+ if (!machine_has_cpu_mhz)
+ return 0;
+@@ -171,6 +172,8 @@ static inline void *c_update(loff_t *pos)
+ {
+ if (*pos)
+ *pos = cpumask_next(*pos - 1, cpu_online_mask);
++ else
++ *pos = cpumask_first(cpu_online_mask);
+ return *pos < nr_cpu_ids ? (void *)*pos + 1 : NULL;
+ }
+
+diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
+index b56c4fdb1517..7cde0f2f52e1 100644
+--- a/arch/s390/mm/gmap.c
++++ b/arch/s390/mm/gmap.c
+@@ -1838,6 +1838,7 @@ int gmap_shadow_r3t(struct gmap *sg, unsigned long saddr, unsigned long r3t,
+ goto out_free;
+ } else if (*table & _REGION_ENTRY_ORIGIN) {
+ rc = -EAGAIN; /* Race with shadow */
++ goto out_free;
+ }
+ crst_table_init(s_r3t, _REGION3_ENTRY_EMPTY);
+ /* mark as invalid as long as the parent table is not protected */
+diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
+index 83c470364dfb..748bd0921dff 100644
+--- a/arch/um/drivers/ubd_kern.c
++++ b/arch/um/drivers/ubd_kern.c
+@@ -1574,7 +1574,9 @@ int io_thread(void *arg)
+ written = 0;
+
+ do {
+- res = os_write_file(kernel_fd, ((char *) io_req_buffer) + written, n);
++ res = os_write_file(kernel_fd,
++ ((char *) io_req_buffer) + written,
++ n - written);
+ if (res >= 0) {
+ written += res;
+ } else {
+diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
+index 8a9cff1f129d..1663ad84778b 100644
+--- a/arch/x86/hyperv/hv_init.c
++++ b/arch/x86/hyperv/hv_init.c
+@@ -30,6 +30,7 @@
+ #include <linux/clockchips.h>
+ #include <linux/hyperv.h>
+ #include <linux/slab.h>
++#include <linux/kernel.h>
+ #include <linux/cpuhotplug.h>
+
+ #ifdef CONFIG_HYPERV_TSCPAGE
+@@ -427,11 +428,14 @@ void hyperv_cleanup(void)
+ }
+ EXPORT_SYMBOL_GPL(hyperv_cleanup);
+
+-void hyperv_report_panic(struct pt_regs *regs, long err)
++void hyperv_report_panic(struct pt_regs *regs, long err, bool in_die)
+ {
+ static bool panic_reported;
+ u64 guest_id;
+
++ if (in_die && !panic_on_oops)
++ return;
++
+ /*
+ * We prefer to report panic on 'die' chain as we have proper
+ * registers to report, but if we miss it (e.g. on BUG()) we need
+diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h
+index f37704497d8f..5b58a6cf487f 100644
+--- a/arch/x86/include/asm/mshyperv.h
++++ b/arch/x86/include/asm/mshyperv.h
+@@ -338,7 +338,7 @@ static inline int cpumask_to_vpset(struct hv_vpset *vpset,
+
+ void __init hyperv_init(void);
+ void hyperv_setup_mmu_ops(void);
+-void hyperv_report_panic(struct pt_regs *regs, long err);
++void hyperv_report_panic(struct pt_regs *regs, long err, bool in_die);
+ void hyperv_report_panic_msg(phys_addr_t pa, size_t size);
+ bool hv_is_hyperv_initialized(void);
+ void hyperv_cleanup(void);
+diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c
+index 158ad1483c43..92539a1c3e31 100644
+--- a/arch/x86/kernel/acpi/cstate.c
++++ b/arch/x86/kernel/acpi/cstate.c
+@@ -133,7 +133,8 @@ int acpi_processor_ffh_cstate_probe(unsigned int cpu,
+
+ /* Make sure we are running on right CPU */
+
+- retval = work_on_cpu(cpu, acpi_processor_ffh_cstate_probe_cpu, cx);
++ retval = call_on_cpu(cpu, acpi_processor_ffh_cstate_probe_cpu, cx,
++ false);
+ if (retval == 0) {
+ /* Use the hint in CST */
+ percpu_entry->states[cx->index].eax = cx->address;
+diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
+index 852e74e48890..fc93ae325515 100644
+--- a/arch/x86/kernel/cpu/mshyperv.c
++++ b/arch/x86/kernel/cpu/mshyperv.c
+@@ -250,6 +250,16 @@ static void __init ms_hyperv_init_platform(void)
+ cpuid_eax(HYPERV_CPUID_NESTED_FEATURES);
+ }
+
++ /*
++ * Hyper-V expects to get crash register data or kmsg when
++ * crash enlightment is available and system crashes. Set
++ * crash_kexec_post_notifiers to be true to make sure that
++ * calling crash enlightment interface before running kdump
++ * kernel.
++ */
++ if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE)
++ crash_kexec_post_notifiers = true;
++
+ #ifdef CONFIG_X86_LOCAL_APIC
+ if (ms_hyperv.features & HV_X64_ACCESS_FREQUENCY_MSRS &&
+ ms_hyperv.misc_features & HV_FEATURE_FREQUENCY_MSRS_AVAILABLE) {
+diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
+index fbc936cf2025..62c0fe9ef412 100644
+--- a/drivers/acpi/processor_throttling.c
++++ b/drivers/acpi/processor_throttling.c
+@@ -910,13 +910,6 @@ static long __acpi_processor_get_throttling(void *data)
+ return pr->throttling.acpi_processor_get_throttling(pr);
+ }
+
+-static int call_on_cpu(int cpu, long (*fn)(void *), void *arg, bool direct)
+-{
+- if (direct || (is_percpu_thread() && cpu == smp_processor_id()))
+- return fn(arg);
+- return work_on_cpu(cpu, fn, arg);
+-}
+-
+ static int acpi_processor_get_throttling(struct acpi_processor *pr)
+ {
+ if (!pr)
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index d3ad1b8c133e..110129097169 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -3427,6 +3427,10 @@ static void cancel_tasks_sync(struct rbd_device *rbd_dev)
+ cancel_work_sync(&rbd_dev->unlock_work);
+ }
+
++/*
++ * header_rwsem must not be held to avoid a deadlock with
++ * rbd_dev_refresh() when flushing notifies.
++ */
+ static void rbd_unregister_watch(struct rbd_device *rbd_dev)
+ {
+ WARN_ON(waitqueue_active(&rbd_dev->lock_waitq));
+@@ -5719,9 +5723,10 @@ static int rbd_dev_header_name(struct rbd_device *rbd_dev)
+
+ static void rbd_dev_image_release(struct rbd_device *rbd_dev)
+ {
+- rbd_dev_unprobe(rbd_dev);
+ if (rbd_dev->opts)
+ rbd_unregister_watch(rbd_dev);
++
++ rbd_dev_unprobe(rbd_dev);
+ rbd_dev->image_format = 0;
+ kfree(rbd_dev->spec->image_id);
+ rbd_dev->spec->image_id = NULL;
+@@ -5732,6 +5737,9 @@ static void rbd_dev_image_release(struct rbd_device *rbd_dev)
+ * device. If this image is the one being mapped (i.e., not a
+ * parent), initiate a watch on its header object before using that
+ * object to get detailed information about the rbd image.
++ *
++ * On success, returns with header_rwsem held for write if called
++ * with @depth == 0.
+ */
+ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)
+ {
+@@ -5764,9 +5772,12 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)
+ }
+ }
+
++ if (!depth)
++ down_write(&rbd_dev->header_rwsem);
++
+ ret = rbd_dev_header_info(rbd_dev);
+ if (ret)
+- goto err_out_watch;
++ goto err_out_probe;
+
+ /*
+ * If this image is the one being mapped, we have pool name and
+@@ -5812,10 +5823,11 @@ static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)
+ return 0;
+
+ err_out_probe:
+- rbd_dev_unprobe(rbd_dev);
+-err_out_watch:
++ if (!depth)
++ up_write(&rbd_dev->header_rwsem);
+ if (!depth)
+ rbd_unregister_watch(rbd_dev);
++ rbd_dev_unprobe(rbd_dev);
+ err_out_format:
+ rbd_dev->image_format = 0;
+ kfree(rbd_dev->spec->image_id);
+@@ -5872,12 +5884,9 @@ static ssize_t do_rbd_add(struct bus_type *bus,
+ goto err_out_rbd_dev;
+ }
+
+- down_write(&rbd_dev->header_rwsem);
+ rc = rbd_dev_image_probe(rbd_dev, 0);
+- if (rc < 0) {
+- up_write(&rbd_dev->header_rwsem);
++ if (rc < 0)
+ goto err_out_rbd_dev;
+- }
+
+ /* If we are mapping a snapshot it must be marked read-only */
+ if (rbd_dev->spec->snap_id != CEPH_NOSNAP)
+diff --git a/drivers/clk/at91/clk-usb.c b/drivers/clk/at91/clk-usb.c
+index 791770a563fc..6fac6383d024 100644
+--- a/drivers/clk/at91/clk-usb.c
++++ b/drivers/clk/at91/clk-usb.c
+@@ -78,6 +78,9 @@ static int at91sam9x5_clk_usb_determine_rate(struct clk_hw *hw,
+ tmp_parent_rate = req->rate * div;
+ tmp_parent_rate = clk_hw_round_rate(parent,
+ tmp_parent_rate);
++ if (!tmp_parent_rate)
++ continue;
++
+ tmp_rate = DIV_ROUND_CLOSEST(tmp_parent_rate, div);
+ if (tmp_rate < req->rate)
+ tmp_diff = req->rate - tmp_rate;
+diff --git a/drivers/clk/tegra/clk-tegra-pmc.c b/drivers/clk/tegra/clk-tegra-pmc.c
+index a35579a3f884..476dab494c44 100644
+--- a/drivers/clk/tegra/clk-tegra-pmc.c
++++ b/drivers/clk/tegra/clk-tegra-pmc.c
+@@ -60,16 +60,16 @@ struct pmc_clk_init_data {
+
+ static DEFINE_SPINLOCK(clk_out_lock);
+
+-static const char *clk_out1_parents[] = { "clk_m", "clk_m_div2",
+- "clk_m_div4", "extern1",
++static const char *clk_out1_parents[] = { "osc", "osc_div2",
++ "osc_div4", "extern1",
+ };
+
+-static const char *clk_out2_parents[] = { "clk_m", "clk_m_div2",
+- "clk_m_div4", "extern2",
++static const char *clk_out2_parents[] = { "osc", "osc_div2",
++ "osc_div4", "extern2",
+ };
+
+-static const char *clk_out3_parents[] = { "clk_m", "clk_m_div2",
+- "clk_m_div4", "extern3",
++static const char *clk_out3_parents[] = { "osc", "osc_div2",
++ "osc_div4", "extern3",
+ };
+
+ static struct pmc_clk_init_data pmc_clks[] = {
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 938d0053a820..28022d1cb0f0 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -921,9 +921,9 @@ kfd_gtt_out:
+ return 0;
+
+ kfd_gtt_no_free_chunk:
+- pr_debug("Allocation failed with mem_obj = %p\n", mem_obj);
++ pr_debug("Allocation failed with mem_obj = %p\n", *mem_obj);
+ mutex_unlock(&kfd->gtt_sa_lock);
+- kfree(mem_obj);
++ kfree(*mem_obj);
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index fd5522fd179e..86b98856756d 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -698,11 +698,23 @@ static enum drm_mode_status
+ vc4_hdmi_encoder_mode_valid(struct drm_encoder *crtc,
+ const struct drm_display_mode *mode)
+ {
+- /* HSM clock must be 108% of the pixel clock. Additionally,
+- * the AXI clock needs to be at least 25% of pixel clock, but
+- * HSM ends up being the limiting factor.
++ /*
++ * As stated in RPi's vc4 firmware "HDMI state machine (HSM) clock must
++ * be faster than pixel clock, infinitesimally faster, tested in
++ * simulation. Otherwise, exact value is unimportant for HDMI
++ * operation." This conflicts with bcm2835's vc4 documentation, which
++ * states HSM's clock has to be at least 108% of the pixel clock.
++ *
++ * Real life tests reveal that vc4's firmware statement holds up, and
++ * users are able to use pixel clocks closer to HSM's, namely for
++ * 1920x1200@60Hz. So it was decided to have leave a 1% margin between
++ * both clocks. Which, for RPi0-3 implies a maximum pixel clock of
++ * 162MHz.
++ *
++ * Additionally, the AXI clock needs to be at least 25% of
++ * pixel clock, but HSM ends up being the limiting factor.
+ */
+- if (mode->clock > HSM_CLOCK_FREQ / (1000 * 108 / 100))
++ if (mode->clock > HSM_CLOCK_FREQ / (1000 * 101 / 100))
+ return MODE_CLOCK_HIGH;
+
+ return MODE_OK;
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 16eb9b3f1cb1..3bf1f9ef8ea2 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -849,6 +849,9 @@ void vmbus_initiate_unload(bool crash)
+ {
+ struct vmbus_channel_message_header hdr;
+
++ if (xchg(&vmbus_connection.conn_state, DISCONNECTED) == DISCONNECTED)
++ return;
++
+ /* Pre-Win2012R2 hosts don't support reconnect */
+ if (vmbus_proto_version < VERSION_WIN8_1)
+ return;
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 9aa18f387a34..fb22b72fd535 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -43,6 +43,7 @@
+ #include <linux/kdebug.h>
+ #include <linux/efi.h>
+ #include <linux/random.h>
++#include <linux/kernel.h>
+ #include "hyperv_vmbus.h"
+
+ struct vmbus_dynid {
+@@ -58,14 +59,35 @@ static int hyperv_cpuhp_online;
+
+ static void *hv_panic_page;
+
++/*
++ * Boolean to control whether to report panic messages over Hyper-V.
++ *
++ * It can be set via /proc/sys/kernel/hyperv/record_panic_msg
++ */
++static int sysctl_record_panic_msg = 1;
++
++static int hyperv_report_reg(void)
++{
++ return !sysctl_record_panic_msg || !hv_panic_page;
++}
++
+ static int hyperv_panic_event(struct notifier_block *nb, unsigned long val,
+ void *args)
+ {
+ struct pt_regs *regs;
+
+- regs = current_pt_regs();
++ vmbus_initiate_unload(true);
+
+- hyperv_report_panic(regs, val);
++ /*
++ * Hyper-V should be notified only once about a panic. If we will be
++ * doing hyperv_report_panic_msg() later with kmsg data, don't do
++ * the notification here.
++ */
++ if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE
++ && hyperv_report_reg()) {
++ regs = current_pt_regs();
++ hyperv_report_panic(regs, val, false);
++ }
+ return NOTIFY_DONE;
+ }
+
+@@ -75,7 +97,13 @@ static int hyperv_die_event(struct notifier_block *nb, unsigned long val,
+ struct die_args *die = (struct die_args *)args;
+ struct pt_regs *regs = die->regs;
+
+- hyperv_report_panic(regs, val);
++ /*
++ * Hyper-V should be notified only once about a panic. If we will be
++ * doing hyperv_report_panic_msg() later with kmsg data, don't do
++ * the notification here.
++ */
++ if (hyperv_report_reg())
++ hyperv_report_panic(regs, val, true);
+ return NOTIFY_DONE;
+ }
+
+@@ -1088,13 +1116,6 @@ static void vmbus_isr(void)
+ add_interrupt_randomness(HYPERVISOR_CALLBACK_VECTOR, 0);
+ }
+
+-/*
+- * Boolean to control whether to report panic messages over Hyper-V.
+- *
+- * It can be set via /proc/sys/kernel/hyperv/record_panic_msg
+- */
+-static int sysctl_record_panic_msg = 1;
+-
+ /*
+ * Callback from kmsg_dump. Grab as much as possible from the end of the kmsg
+ * buffer and call into Hyper-V to transfer the data.
+@@ -1219,19 +1240,29 @@ static int vmbus_bus_init(void)
+ hv_panic_page = (void *)get_zeroed_page(GFP_KERNEL);
+ if (hv_panic_page) {
+ ret = kmsg_dump_register(&hv_kmsg_dumper);
+- if (ret)
++ if (ret) {
+ pr_err("Hyper-V: kmsg dump register "
+ "error 0x%x\n", ret);
++ free_page(
++ (unsigned long)hv_panic_page);
++ hv_panic_page = NULL;
++ }
+ } else
+ pr_err("Hyper-V: panic message page memory "
+ "allocation failed");
+ }
+
+ register_die_notifier(&hyperv_die_block);
+- atomic_notifier_chain_register(&panic_notifier_list,
+- &hyperv_panic_block);
+ }
+
++ /*
++ * Always register the panic notifier because we need to unload
++ * the VMbus channel connection to prevent any VMbus
++ * activity after the VM panics.
++ */
++ atomic_notifier_chain_register(&panic_notifier_list,
++ &hyperv_panic_block);
++
+ vmbus_request_offers();
+
+ return 0;
+@@ -1243,7 +1274,6 @@ err_alloc:
+ hv_remove_vmbus_irq();
+
+ bus_unregister(&hv_bus);
+- free_page((unsigned long)hv_panic_page);
+ unregister_sysctl_table(hv_ctl_table_hdr);
+ hv_ctl_table_hdr = NULL;
+ return ret;
+@@ -1875,7 +1905,6 @@ static void hv_kexec_handler(void)
+ {
+ hv_synic_clockevents_cleanup();
+ vmbus_initiate_unload(false);
+- vmbus_connection.conn_state = DISCONNECTED;
+ /* Make sure conn_state is set as hv_synic_cleanup checks for it */
+ mb();
+ cpuhp_remove_state(hyperv_cpuhp_online);
+@@ -1890,7 +1919,6 @@ static void hv_crash_handler(struct pt_regs *regs)
+ * doing the cleanup for current CPU only. This should be sufficient
+ * for kdump.
+ */
+- vmbus_connection.conn_state = DISCONNECTED;
+ hv_synic_cleanup(smp_processor_id());
+ hyperv_cleanup();
+ };
+diff --git a/drivers/iio/light/si1133.c b/drivers/iio/light/si1133.c
+index 015a21f0c2ef..9174ab928880 100644
+--- a/drivers/iio/light/si1133.c
++++ b/drivers/iio/light/si1133.c
+@@ -102,6 +102,9 @@
+ #define SI1133_INPUT_FRACTION_LOW 15
+ #define SI1133_LUX_OUTPUT_FRACTION 12
+ #define SI1133_LUX_BUFFER_SIZE 9
++#define SI1133_MEASURE_BUFFER_SIZE 3
++
++#define SI1133_SIGN_BIT_INDEX 23
+
+ static const int si1133_scale_available[] = {
+ 1, 2, 4, 8, 16, 32, 64, 128};
+@@ -234,13 +237,13 @@ static const struct si1133_lux_coeff lux_coeff = {
+ }
+ };
+
+-static int si1133_calculate_polynomial_inner(u32 input, u8 fraction, u16 mag,
++static int si1133_calculate_polynomial_inner(s32 input, u8 fraction, u16 mag,
+ s8 shift)
+ {
+ return ((input << fraction) / mag) << shift;
+ }
+
+-static int si1133_calculate_output(u32 x, u32 y, u8 x_order, u8 y_order,
++static int si1133_calculate_output(s32 x, s32 y, u8 x_order, u8 y_order,
+ u8 input_fraction, s8 sign,
+ const struct si1133_coeff *coeffs)
+ {
+@@ -276,7 +279,7 @@ static int si1133_calculate_output(u32 x, u32 y, u8 x_order, u8 y_order,
+ * The algorithm is from:
+ * https://siliconlabs.github.io/Gecko_SDK_Doc/efm32zg/html/si1133_8c_source.html#l00716
+ */
+-static int si1133_calc_polynomial(u32 x, u32 y, u8 input_fraction, u8 num_coeff,
++static int si1133_calc_polynomial(s32 x, s32 y, u8 input_fraction, u8 num_coeff,
+ const struct si1133_coeff *coeffs)
+ {
+ u8 x_order, y_order;
+@@ -614,7 +617,7 @@ static int si1133_measure(struct si1133_data *data,
+ {
+ int err;
+
+- __be16 resp;
++ u8 buffer[SI1133_MEASURE_BUFFER_SIZE];
+
+ err = si1133_set_adcmux(data, 0, chan->channel);
+ if (err)
+@@ -625,12 +628,13 @@ static int si1133_measure(struct si1133_data *data,
+ if (err)
+ return err;
+
+- err = si1133_bulk_read(data, SI1133_REG_HOSTOUT(0), sizeof(resp),
+- (u8 *)&resp);
++ err = si1133_bulk_read(data, SI1133_REG_HOSTOUT(0), sizeof(buffer),
++ buffer);
+ if (err)
+ return err;
+
+- *val = be16_to_cpu(resp);
++ *val = sign_extend32((buffer[0] << 16) | (buffer[1] << 8) | buffer[2],
++ SI1133_SIGN_BIT_INDEX);
+
+ return err;
+ }
+@@ -704,9 +708,9 @@ static int si1133_get_lux(struct si1133_data *data, int *val)
+ {
+ int err;
+ int lux;
+- u32 high_vis;
+- u32 low_vis;
+- u32 ir;
++ s32 high_vis;
++ s32 low_vis;
++ s32 ir;
+ u8 buffer[SI1133_LUX_BUFFER_SIZE];
+
+ /* Activate lux channels */
+@@ -719,9 +723,16 @@ static int si1133_get_lux(struct si1133_data *data, int *val)
+ if (err)
+ return err;
+
+- high_vis = (buffer[0] << 16) | (buffer[1] << 8) | buffer[2];
+- low_vis = (buffer[3] << 16) | (buffer[4] << 8) | buffer[5];
+- ir = (buffer[6] << 16) | (buffer[7] << 8) | buffer[8];
++ high_vis =
++ sign_extend32((buffer[0] << 16) | (buffer[1] << 8) | buffer[2],
++ SI1133_SIGN_BIT_INDEX);
++
++ low_vis =
++ sign_extend32((buffer[3] << 16) | (buffer[4] << 8) | buffer[5],
++ SI1133_SIGN_BIT_INDEX);
++
++ ir = sign_extend32((buffer[6] << 16) | (buffer[7] << 8) | buffer[8],
++ SI1133_SIGN_BIT_INDEX);
+
+ if (high_vis > SI1133_ADC_THRESHOLD || ir > SI1133_ADC_THRESHOLD)
+ lux = si1133_calc_polynomial(high_vis, ir,
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index 69f3d4c95b53..859b06424e5c 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -352,7 +352,7 @@
+
+ #define DTE_GCR3_VAL_A(x) (((x) >> 12) & 0x00007ULL)
+ #define DTE_GCR3_VAL_B(x) (((x) >> 15) & 0x0ffffULL)
+-#define DTE_GCR3_VAL_C(x) (((x) >> 31) & 0xfffffULL)
++#define DTE_GCR3_VAL_C(x) (((x) >> 31) & 0x1fffffULL)
+
+ #define DTE_GCR3_INDEX_A 0
+ #define DTE_GCR3_INDEX_B 1
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index 5944d3b4dca3..ef3aadec980e 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -620,14 +620,15 @@ static irqreturn_t prq_event_thread(int irq, void *d)
+ * any faults on kernel addresses. */
+ if (!svm->mm)
+ goto bad_req;
+- /* If the mm is already defunct, don't handle faults. */
+- if (!mmget_not_zero(svm->mm))
+- goto bad_req;
+
+ /* If address is not canonical, return invalid response */
+ if (!is_canonical_address(address))
+ goto bad_req;
+
++ /* If the mm is already defunct, don't handle faults. */
++ if (!mmget_not_zero(svm->mm))
++ goto bad_req;
++
+ down_read(&svm->mm->mmap_sem);
+ vma = find_extend_vma(svm->mm, address);
+ if (!vma || address < vma->vm_start)
+diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
+index f7fdbf5d183b..c98358be0bc8 100644
+--- a/drivers/irqchip/irq-mbigen.c
++++ b/drivers/irqchip/irq-mbigen.c
+@@ -231,10 +231,16 @@ static int mbigen_irq_domain_alloc(struct irq_domain *domain,
+ return 0;
+ }
+
++static void mbigen_irq_domain_free(struct irq_domain *domain, unsigned int virq,
++ unsigned int nr_irqs)
++{
++ platform_msi_domain_free(domain, virq, nr_irqs);
++}
++
+ static const struct irq_domain_ops mbigen_domain_ops = {
+ .translate = mbigen_domain_translate,
+ .alloc = mbigen_irq_domain_alloc,
+- .free = irq_domain_free_irqs_common,
++ .free = mbigen_irq_domain_free,
+ };
+
+ static int mbigen_of_create_domain(struct platform_device *pdev,
+diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
+index 9ee04b5f9311..5a04ff638688 100644
+--- a/drivers/mtd/devices/phram.c
++++ b/drivers/mtd/devices/phram.c
+@@ -240,22 +240,25 @@ static int phram_setup(const char *val)
+
+ ret = parse_num64(&start, token[1]);
+ if (ret) {
+- kfree(name);
+ parse_err("illegal start address\n");
++ goto error;
+ }
+
+ ret = parse_num64(&len, token[2]);
+ if (ret) {
+- kfree(name);
+ parse_err("illegal device length\n");
++ goto error;
+ }
+
+ ret = register_device(name, start, len);
+- if (!ret)
+- pr_info("%s device: %#llx at %#llx\n", name, len, start);
+- else
+- kfree(name);
++ if (ret)
++ goto error;
++
++ pr_info("%s device: %#llx at %#llx\n", name, len, start);
++ return 0;
+
++error:
++ kfree(name);
+ return ret;
+ }
+
+diff --git a/drivers/mtd/lpddr/lpddr_cmds.c b/drivers/mtd/lpddr/lpddr_cmds.c
+index b13557fe52bd..947bb710bf16 100644
+--- a/drivers/mtd/lpddr/lpddr_cmds.c
++++ b/drivers/mtd/lpddr/lpddr_cmds.c
+@@ -81,7 +81,6 @@ struct mtd_info *lpddr_cmdset(struct map_info *map)
+ shared = kmalloc_array(lpddr->numchips, sizeof(struct flchip_shared),
+ GFP_KERNEL);
+ if (!shared) {
+- kfree(lpddr);
+ kfree(mtd);
+ return NULL;
+ }
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index ee0c74b02220..a2f38b3b9776 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -670,6 +670,7 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
+ .ooboffs = 0,
+ .ooblen = sizeof(marker),
+ .oobbuf.out = marker,
++ .mode = MTD_OPS_RAW,
+ };
+ int ret;
+
+diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
+index 21db1804e85d..12156ab186a1 100644
+--- a/drivers/net/dsa/bcm_sf2_cfp.c
++++ b/drivers/net/dsa/bcm_sf2_cfp.c
+@@ -742,17 +742,14 @@ static int bcm_sf2_cfp_rule_set(struct dsa_switch *ds, int port,
+ fs->m_ext.data[1]))
+ return -EINVAL;
+
+- if (fs->location != RX_CLS_LOC_ANY && fs->location >= CFP_NUM_RULES)
++ if (fs->location != RX_CLS_LOC_ANY &&
++ fs->location > bcm_sf2_cfp_rule_size(priv))
+ return -EINVAL;
+
+ if (fs->location != RX_CLS_LOC_ANY &&
+ test_bit(fs->location, priv->cfp.used))
+ return -EBUSY;
+
+- if (fs->location != RX_CLS_LOC_ANY &&
+- fs->location > bcm_sf2_cfp_rule_size(priv))
+- return -EINVAL;
+-
+ /* This rule is a Wake-on-LAN filter and we must specifically
+ * target the CPU port in order for it to be working.
+ */
+@@ -839,7 +836,7 @@ static int bcm_sf2_cfp_rule_del(struct bcm_sf2_priv *priv, int port,
+ u32 next_loc = 0;
+ int ret;
+
+- if (loc >= CFP_NUM_RULES)
++ if (loc > bcm_sf2_cfp_rule_size(priv))
+ return -EINVAL;
+
+ /* Refuse deleting unused rules, and those that are not unique since
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 54a633e8cb5d..48a070a37ea9 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -984,8 +984,10 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ return -EFAULT;
+ }
+
+- if (!desc || (desc->out_num + desc->in_num == 0) ||
+- !test_bit(cmd, &cmd_mask))
++ if (!desc ||
++ (desc->out_num + desc->in_num == 0) ||
++ cmd > ND_CMD_CALL ||
++ !test_bit(cmd, &cmd_mask))
+ return -ENOTTY;
+
+ /* fail write commands (when read-only) */
+diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
+index 514528b3566f..a77bfeac867d 100644
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -261,6 +261,8 @@ static struct property *dup_and_fixup_symbol_prop(
+
+ of_property_set_flag(new_prop, OF_DYNAMIC);
+
++ kfree(target_path);
++
+ return new_prop;
+
+ err_free_new_prop:
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 808571f7f6ef..29f17c3449aa 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -772,6 +772,10 @@ static void __init of_unittest_changeset(void)
+ unittest(!of_changeset_revert(&chgset), "revert failed\n");
+
+ of_changeset_destroy(&chgset);
++
++ of_node_put(n1);
++ of_node_put(n2);
++ of_node_put(n21);
+ #endif
+ }
+
+@@ -1055,10 +1059,13 @@ static void __init of_unittest_platform_populate(void)
+
+ of_platform_populate(np, match, NULL, &test_bus->dev);
+ for_each_child_of_node(np, child) {
+- for_each_child_of_node(child, grandchild)
+- unittest(of_find_device_by_node(grandchild),
++ for_each_child_of_node(child, grandchild) {
++ pdev = of_find_device_by_node(grandchild);
++ unittest(pdev,
+ "Could not create device for node '%pOFn'\n",
+ grandchild);
++ of_dev_put(pdev);
++ }
+ }
+
+ of_platform_depopulate(&test_bus->dev);
+@@ -2441,8 +2448,11 @@ static __init void of_unittest_overlay_high_level(void)
+ goto err_unlock;
+ }
+ if (__of_add_property(of_symbols, new_prop)) {
++ kfree(new_prop->name);
++ kfree(new_prop->value);
++ kfree(new_prop);
+ /* "name" auto-generated by unflatten */
+- if (!strcmp(new_prop->name, "name"))
++ if (!strcmp(prop->name, "name"))
+ continue;
+ unittest(0, "duplicate property '%s' in overlay_base node __symbols__",
+ prop->name);
+diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c
+index ab0b6e78ca02..157cf5ec6b02 100644
+--- a/drivers/power/supply/axp288_fuel_gauge.c
++++ b/drivers/power/supply/axp288_fuel_gauge.c
+@@ -718,14 +718,14 @@ static const struct dmi_system_id axp288_fuel_gauge_blacklist[] = {
+ {
+ /* Intel Cherry Trail Compute Stick, Windows version */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "STK1AW32SC"),
+ },
+ },
+ {
+ /* Intel Cherry Trail Compute Stick, version without an OS */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "STK1A32SC"),
+ },
+ },
+diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
+index f022e1b550df..ff02a917556a 100644
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -1887,7 +1887,10 @@ int bq27xxx_battery_setup(struct bq27xxx_device_info *di)
+
+ di->bat = power_supply_register_no_ws(di->dev, psy_desc, &psy_cfg);
+ if (IS_ERR(di->bat)) {
+- dev_err(di->dev, "failed to register battery\n");
++ if (PTR_ERR(di->bat) == -EPROBE_DEFER)
++ dev_dbg(di->dev, "failed to register battery, deferring probe\n");
++ else
++ dev_err(di->dev, "failed to register battery\n");
+ return PTR_ERR(di->bat);
+ }
+
+diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
+index 73697e4b18a9..9d4a59aa29a1 100644
+--- a/drivers/rtc/rtc-88pm860x.c
++++ b/drivers/rtc/rtc-88pm860x.c
+@@ -341,6 +341,10 @@ static int pm860x_rtc_probe(struct platform_device *pdev)
+ info->dev = &pdev->dev;
+ dev_set_drvdata(&pdev->dev, info);
+
++ info->rtc_dev = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(info->rtc_dev))
++ return PTR_ERR(info->rtc_dev);
++
+ ret = devm_request_threaded_irq(&pdev->dev, info->irq, NULL,
+ rtc_update_handler, IRQF_ONESHOT, "rtc",
+ info);
+@@ -382,13 +386,11 @@ static int pm860x_rtc_probe(struct platform_device *pdev)
+ }
+ }
+
+- info->rtc_dev = devm_rtc_device_register(&pdev->dev, "88pm860x-rtc",
+- &pm860x_rtc_ops, THIS_MODULE);
+- ret = PTR_ERR(info->rtc_dev);
+- if (IS_ERR(info->rtc_dev)) {
+- dev_err(&pdev->dev, "Failed to register RTC device: %d\n", ret);
++ info->rtc_dev->ops = &pm860x_rtc_ops;
++
++ ret = rtc_register_device(info->rtc_dev);
++ if (ret)
+ return ret;
+- }
+
+ /*
+ * enable internal XO instead of internal 3.25MHz clock since it can
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 8a254bb46a9b..ac8535d2b41a 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -808,8 +808,10 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
+ "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n",
+ (int) cmnd[0], (int) hp->cmd_len));
+
+- if (hp->dxfer_len >= SZ_256M)
++ if (hp->dxfer_len >= SZ_256M) {
++ sg_remove_request(sfp, srp);
+ return -EINVAL;
++ }
+
+ k = sg_start_req(srp, cmnd);
+ if (k) {
+diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
+index d160fc2a7b7a..56c019ec7f14 100644
+--- a/drivers/soc/imx/gpc.c
++++ b/drivers/soc/imx/gpc.c
+@@ -93,8 +93,8 @@ static int imx6_pm_domain_power_off(struct generic_pm_domain *genpd)
+ static int imx6_pm_domain_power_on(struct generic_pm_domain *genpd)
+ {
+ struct imx_pm_domain *pd = to_imx_pm_domain(genpd);
+- int i, ret, sw, sw2iso;
+- u32 val;
++ int i, ret;
++ u32 val, req;
+
+ if (pd->supply) {
+ ret = regulator_enable(pd->supply);
+@@ -113,17 +113,18 @@ static int imx6_pm_domain_power_on(struct generic_pm_domain *genpd)
+ regmap_update_bits(pd->regmap, pd->reg_offs + GPC_PGC_CTRL_OFFS,
+ 0x1, 0x1);
+
+- /* Read ISO and ISO2SW power up delays */
+- regmap_read(pd->regmap, pd->reg_offs + GPC_PGC_PUPSCR_OFFS, &val);
+- sw = val & 0x3f;
+- sw2iso = (val >> 8) & 0x3f;
+-
+ /* Request GPC to power up domain */
+- val = BIT(pd->cntr_pdn_bit + 1);
+- regmap_update_bits(pd->regmap, GPC_CNTR, val, val);
++ req = BIT(pd->cntr_pdn_bit + 1);
++ regmap_update_bits(pd->regmap, GPC_CNTR, req, req);
+
+- /* Wait ISO + ISO2SW IPG clock cycles */
+- udelay(DIV_ROUND_UP(sw + sw2iso, pd->ipg_rate_mhz));
++ /* Wait for the PGC to handle the request */
++ ret = regmap_read_poll_timeout(pd->regmap, GPC_CNTR, val, !(val & req),
++ 1, 50);
++ if (ret)
++ pr_err("powerup request on domain %s timed out\n", genpd->name);
++
++ /* Wait for reset to propagate through peripherals */
++ usleep_range(5, 10);
+
+ /* Disable reset clocks for all devices in the domain */
+ for (i = 0; i < pd->num_clks; i++)
+@@ -345,6 +346,7 @@ static const struct regmap_config imx_gpc_regmap_config = {
+ .rd_table = &access_table,
+ .wr_table = &access_table,
+ .max_register = 0x2ac,
++ .fast_io = true,
+ };
+
+ static struct generic_pm_domain *imx_gpc_onecell_domains[] = {
+diff --git a/drivers/tty/ehv_bytechan.c b/drivers/tty/ehv_bytechan.c
+index eea4049b5dcc..ca5004ae3024 100644
+--- a/drivers/tty/ehv_bytechan.c
++++ b/drivers/tty/ehv_bytechan.c
+@@ -136,6 +136,21 @@ static int find_console_handle(void)
+ return 1;
+ }
+
++static unsigned int local_ev_byte_channel_send(unsigned int handle,
++ unsigned int *count,
++ const char *p)
++{
++ char buffer[EV_BYTE_CHANNEL_MAX_BYTES];
++ unsigned int c = *count;
++
++ if (c < sizeof(buffer)) {
++ memcpy(buffer, p, c);
++ memset(&buffer[c], 0, sizeof(buffer) - c);
++ p = buffer;
++ }
++ return ev_byte_channel_send(handle, count, p);
++}
++
+ /*************************** EARLY CONSOLE DRIVER ***************************/
+
+ #ifdef CONFIG_PPC_EARLY_DEBUG_EHV_BC
+@@ -154,7 +169,7 @@ static void byte_channel_spin_send(const char data)
+
+ do {
+ count = 1;
+- ret = ev_byte_channel_send(CONFIG_PPC_EARLY_DEBUG_EHV_BC_HANDLE,
++ ret = local_ev_byte_channel_send(CONFIG_PPC_EARLY_DEBUG_EHV_BC_HANDLE,
+ &count, &data);
+ } while (ret == EV_EAGAIN);
+ }
+@@ -221,7 +236,7 @@ static int ehv_bc_console_byte_channel_send(unsigned int handle, const char *s,
+ while (count) {
+ len = min_t(unsigned int, count, EV_BYTE_CHANNEL_MAX_BYTES);
+ do {
+- ret = ev_byte_channel_send(handle, &len, s);
++ ret = local_ev_byte_channel_send(handle, &len, s);
+ } while (ret == EV_EAGAIN);
+ count -= len;
+ s += len;
+@@ -401,7 +416,7 @@ static void ehv_bc_tx_dequeue(struct ehv_bc_data *bc)
+ CIRC_CNT_TO_END(bc->head, bc->tail, BUF_SIZE),
+ EV_BYTE_CHANNEL_MAX_BYTES);
+
+- ret = ev_byte_channel_send(bc->handle, &len, bc->buf + bc->tail);
++ ret = local_ev_byte_channel_send(bc->handle, &len, bc->buf + bc->tail);
+
+ /* 'len' is valid only if the return code is 0 or EV_EAGAIN */
+ if (!ret || (ret == EV_EAGAIN))
+diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
+index c48f083d522a..84845275dbef 100644
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -1122,7 +1122,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
+ case FBIOGET_FSCREENINFO:
+ if (!lock_fb_info(info))
+ return -ENODEV;
+- fix = info->fix;
++ memcpy(&fix, &info->fix, sizeof(fix));
+ unlock_fb_info(info);
+
+ ret = copy_to_user(argp, &fix, sizeof(fix)) ? -EFAULT : 0;
+diff --git a/drivers/video/fbdev/sis/init301.c b/drivers/video/fbdev/sis/init301.c
+index 27a2b72e50e8..a8fb41f1a258 100644
+--- a/drivers/video/fbdev/sis/init301.c
++++ b/drivers/video/fbdev/sis/init301.c
+@@ -848,9 +848,7 @@ SiS_PanelDelay(struct SiS_Private *SiS_Pr, unsigned short DelayTime)
+ SiS_DDC2Delay(SiS_Pr, 0x4000);
+ }
+
+- } else if((SiS_Pr->SiS_IF_DEF_LVDS == 1) /* ||
+- (SiS_Pr->SiS_CustomT == CUT_COMPAQ1280) ||
+- (SiS_Pr->SiS_CustomT == CUT_CLEVO1400) */ ) { /* 315 series, LVDS; Special */
++ } else if (SiS_Pr->SiS_IF_DEF_LVDS == 1) { /* 315 series, LVDS; Special */
+
+ if(SiS_Pr->SiS_IF_DEF_CH70xx == 0) {
+ PanelID = SiS_GetReg(SiS_Pr->SiS_P3d4,0x36);
+diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c
+index 072986d461b7..d8876fba686d 100644
+--- a/drivers/watchdog/sp805_wdt.c
++++ b/drivers/watchdog/sp805_wdt.c
+@@ -137,10 +137,14 @@ wdt_restart(struct watchdog_device *wdd, unsigned long mode, void *cmd)
+ {
+ struct sp805_wdt *wdt = watchdog_get_drvdata(wdd);
+
++ writel_relaxed(UNLOCK, wdt->base + WDTLOCK);
+ writel_relaxed(0, wdt->base + WDTCONTROL);
+ writel_relaxed(0, wdt->base + WDTLOAD);
+ writel_relaxed(INT_ENABLE | RESET_ENABLE, wdt->base + WDTCONTROL);
+
++ /* Flush posted writes. */
++ readl_relaxed(wdt->base + WDTLOCK);
++
+ return 0;
+ }
+
+diff --git a/fs/buffer.c b/fs/buffer.c
+index a550e0d8e965..c49fdab5cb36 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -1336,6 +1336,17 @@ void __breadahead(struct block_device *bdev, sector_t block, unsigned size)
+ }
+ EXPORT_SYMBOL(__breadahead);
+
++void __breadahead_gfp(struct block_device *bdev, sector_t block, unsigned size,
++ gfp_t gfp)
++{
++ struct buffer_head *bh = __getblk_gfp(bdev, block, size, gfp);
++ if (likely(bh)) {
++ ll_rw_block(REQ_OP_READ, REQ_RAHEAD, 1, &bh);
++ brelse(bh);
++ }
++}
++EXPORT_SYMBOL(__breadahead_gfp);
++
+ /**
+ * __bread_gfp() - reads a specified block and returns the bh
+ * @bdev: the block_device to read from
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 0c4df56c825a..70412944b267 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -392,7 +392,7 @@ smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
+ struct smb_rqst *rqst, int flags)
+ {
+ struct kvec iov;
+- struct smb2_transform_hdr tr_hdr;
++ struct smb2_transform_hdr *tr_hdr;
+ struct smb_rqst cur_rqst[MAX_COMPOUND];
+ int rc;
+
+@@ -402,28 +402,34 @@ smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
+ if (num_rqst > MAX_COMPOUND - 1)
+ return -ENOMEM;
+
+- memset(&cur_rqst[0], 0, sizeof(cur_rqst));
+- memset(&iov, 0, sizeof(iov));
+- memset(&tr_hdr, 0, sizeof(tr_hdr));
+-
+- iov.iov_base = &tr_hdr;
+- iov.iov_len = sizeof(tr_hdr);
+- cur_rqst[0].rq_iov = &iov;
+- cur_rqst[0].rq_nvec = 1;
+-
+ if (!server->ops->init_transform_rq) {
+ cifs_dbg(VFS, "Encryption requested but transform callback "
+ "is missing\n");
+ return -EIO;
+ }
+
++ tr_hdr = kmalloc(sizeof(*tr_hdr), GFP_NOFS);
++ if (!tr_hdr)
++ return -ENOMEM;
++
++ memset(&cur_rqst[0], 0, sizeof(cur_rqst));
++ memset(&iov, 0, sizeof(iov));
++ memset(tr_hdr, 0, sizeof(*tr_hdr));
++
++ iov.iov_base = tr_hdr;
++ iov.iov_len = sizeof(*tr_hdr);
++ cur_rqst[0].rq_iov = &iov;
++ cur_rqst[0].rq_nvec = 1;
++
+ rc = server->ops->init_transform_rq(server, num_rqst + 1,
+ &cur_rqst[0], rqst);
+ if (rc)
+- return rc;
++ goto out;
+
+ rc = __smb_send_rqst(server, num_rqst + 1, &cur_rqst[0]);
+ smb3_free_compound_rqst(num_rqst, &cur_rqst[1]);
++out:
++ kfree(tr_hdr);
+ return rc;
+ }
+
+diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
+index dd8f10db82e9..bd1d68ff3a9f 100644
+--- a/fs/ext2/xattr.c
++++ b/fs/ext2/xattr.c
+@@ -56,6 +56,7 @@
+
+ #include <linux/buffer_head.h>
+ #include <linux/init.h>
++#include <linux/printk.h>
+ #include <linux/slab.h>
+ #include <linux/mbcache.h>
+ #include <linux/quotaops.h>
+@@ -84,8 +85,8 @@
+ printk("\n"); \
+ } while (0)
+ #else
+-# define ea_idebug(f...)
+-# define ea_bdebug(f...)
++# define ea_idebug(inode, f...) no_printk(f)
++# define ea_bdebug(bh, f...) no_printk(f)
+ #endif
+
+ static int ext2_xattr_set2(struct inode *, struct buffer_head *,
+@@ -838,8 +839,7 @@ ext2_xattr_cache_insert(struct mb_cache *cache, struct buffer_head *bh)
+ error = mb_cache_entry_create(cache, GFP_NOFS, hash, bh->b_blocknr, 1);
+ if (error) {
+ if (error == -EBUSY) {
+- ea_bdebug(bh, "already in cache (%d cache entries)",
+- atomic_read(&ext2_xattr_cache->c_entry_count));
++ ea_bdebug(bh, "already in cache");
+ error = 0;
+ }
+ } else
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 56218c79a856..000fa0e39278 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4690,7 +4690,7 @@ make_io:
+ if (end > table)
+ end = table;
+ while (b <= end)
+- sb_breadahead(sb, b++);
++ sb_breadahead_unmovable(sb, b++);
+ }
+
+ /*
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index c76962eba5dd..bf949fcc970a 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -388,7 +388,8 @@ static void save_error_info(struct super_block *sb, const char *func,
+ unsigned int line)
+ {
+ __save_error_info(sb, func, line);
+- ext4_commit_super(sb, 1);
++ if (!bdev_read_only(sb->s_bdev))
++ ext4_commit_super(sb, 1);
+ }
+
+ /*
+@@ -4207,7 +4208,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ /* Pre-read the descriptors into the buffer cache */
+ for (i = 0; i < db_count; i++) {
+ block = descriptor_loc(sb, logical_sb_block, i);
+- sb_breadahead(sb, block);
++ sb_breadahead_unmovable(sb, block);
+ }
+
+ for (i = 0; i < db_count; i++) {
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index e5d474681471..f0714c1258c7 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1559,15 +1559,16 @@ static int __write_node_page(struct page *page, bool atomic, bool *submitted,
+ if (atomic && !test_opt(sbi, NOBARRIER))
+ fio.op_flags |= REQ_PREFLUSH | REQ_FUA;
+
+- set_page_writeback(page);
+- ClearPageError(page);
+-
++ /* should add to global list before clearing PAGECACHE status */
+ if (f2fs_in_warm_node_list(sbi, page)) {
+ seq = f2fs_add_fsync_node_entry(sbi, page);
+ if (seq_id)
+ *seq_id = seq;
+ }
+
++ set_page_writeback(page);
++ ClearPageError(page);
++
+ fio.old_blkaddr = ni.blk_addr;
+ f2fs_do_write_node_page(nid, &fio);
+ set_node_addr(sbi, &ni, fio.new_blkaddr, is_fsync_dnode(page));
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index da348cf4ff56..45f8f6ec22a5 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1648,6 +1648,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type,
+ int offset = off & (sb->s_blocksize - 1);
+ size_t towrite = len;
+ struct page *page;
++ void *fsdata = NULL;
+ char *kaddr;
+ int err = 0;
+ int tocopy;
+@@ -1657,7 +1658,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type,
+ towrite);
+ retry:
+ err = a_ops->write_begin(NULL, mapping, off, tocopy, 0,
+- &page, NULL);
++ &page, &fsdata);
+ if (unlikely(err)) {
+ if (err == -ENOMEM) {
+ congestion_wait(BLK_RW_ASYNC, HZ/50);
+@@ -1672,7 +1673,7 @@ retry:
+ flush_dcache_page(page);
+
+ a_ops->write_end(NULL, mapping, off, tocopy, tocopy,
+- page, NULL);
++ page, fsdata);
+ offset = 0;
+ towrite -= tocopy;
+ off += tocopy;
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index 315967354954..bcc51f131a49 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -130,6 +130,8 @@ static struct inode *nfs_layout_find_inode_by_stateid(struct nfs_client *clp,
+
+ list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+ list_for_each_entry(lo, &server->layouts, plh_layouts) {
++ if (!pnfs_layout_is_valid(lo))
++ continue;
+ if (stateid != NULL &&
+ !nfs4_stateid_match_other(stateid, &lo->plh_stateid))
+ continue;
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index c61bd3fc723e..e5da9d7fb69e 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -600,6 +600,7 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter)
+ l_ctx = nfs_get_lock_context(dreq->ctx);
+ if (IS_ERR(l_ctx)) {
+ result = PTR_ERR(l_ctx);
++ nfs_direct_req_release(dreq);
+ goto out_release;
+ }
+ dreq->l_ctx = l_ctx;
+@@ -1023,6 +1024,7 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter)
+ l_ctx = nfs_get_lock_context(dreq->ctx);
+ if (IS_ERR(l_ctx)) {
+ result = PTR_ERR(l_ctx);
++ nfs_direct_req_release(dreq);
+ goto out_release;
+ }
+ dreq->l_ctx = l_ctx;
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index 9cf59e2622f8..5dae7c85d9b6 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -865,15 +865,6 @@ static void nfs_pageio_setup_mirroring(struct nfs_pageio_descriptor *pgio,
+ pgio->pg_mirror_count = mirror_count;
+ }
+
+-/*
+- * nfs_pageio_stop_mirroring - stop using mirroring (set mirror count to 1)
+- */
+-void nfs_pageio_stop_mirroring(struct nfs_pageio_descriptor *pgio)
+-{
+- pgio->pg_mirror_count = 1;
+- pgio->pg_mirror_idx = 0;
+-}
+-
+ static void nfs_pageio_cleanup_mirroring(struct nfs_pageio_descriptor *pgio)
+ {
+ pgio->pg_mirror_count = 1;
+@@ -1302,6 +1293,14 @@ void nfs_pageio_cond_complete(struct nfs_pageio_descriptor *desc, pgoff_t index)
+ }
+ }
+
++/*
++ * nfs_pageio_stop_mirroring - stop using mirroring (set mirror count to 1)
++ */
++void nfs_pageio_stop_mirroring(struct nfs_pageio_descriptor *pgio)
++{
++ nfs_pageio_complete(pgio);
++}
++
+ int __init nfs_init_nfspagecache(void)
+ {
+ nfs_page_cachep = kmem_cache_create("nfs_page",
+diff --git a/include/acpi/processor.h b/include/acpi/processor.h
+index 1194a4c78d55..5b9eab15a1e6 100644
+--- a/include/acpi/processor.h
++++ b/include/acpi/processor.h
+@@ -293,6 +293,14 @@ static inline void acpi_processor_ffh_cstate_enter(struct acpi_processor_cx
+ }
+ #endif
+
++static inline int call_on_cpu(int cpu, long (*fn)(void *), void *arg,
++ bool direct)
++{
++ if (direct || (is_percpu_thread() && cpu == smp_processor_id()))
++ return fn(arg);
++ return work_on_cpu(cpu, fn, arg);
++}
++
+ /* in processor_perflib.c */
+
+ #ifdef CONFIG_CPU_FREQ
+diff --git a/include/keys/big_key-type.h b/include/keys/big_key-type.h
+index e0970a578188..a7207a965466 100644
+--- a/include/keys/big_key-type.h
++++ b/include/keys/big_key-type.h
+@@ -21,6 +21,6 @@ extern void big_key_free_preparse(struct key_preparsed_payload *prep);
+ extern void big_key_revoke(struct key *key);
+ extern void big_key_destroy(struct key *key);
+ extern void big_key_describe(const struct key *big_key, struct seq_file *m);
+-extern long big_key_read(const struct key *key, char __user *buffer, size_t buflen);
++extern long big_key_read(const struct key *key, char *buffer, size_t buflen);
+
+ #endif /* _KEYS_BIG_KEY_TYPE_H */
+diff --git a/include/keys/user-type.h b/include/keys/user-type.h
+index 12babe991594..0d8f3cd3056f 100644
+--- a/include/keys/user-type.h
++++ b/include/keys/user-type.h
+@@ -45,8 +45,7 @@ extern int user_update(struct key *key, struct key_preparsed_payload *prep);
+ extern void user_revoke(struct key *key);
+ extern void user_destroy(struct key *key);
+ extern void user_describe(const struct key *user, struct seq_file *m);
+-extern long user_read(const struct key *key,
+- char __user *buffer, size_t buflen);
++extern long user_read(const struct key *key, char *buffer, size_t buflen);
+
+ static inline const struct user_key_payload *user_key_payload_rcu(const struct key *key)
+ {
+diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
+index 96225a77c112..9168fc33a4f7 100644
+--- a/include/linux/buffer_head.h
++++ b/include/linux/buffer_head.h
+@@ -189,6 +189,8 @@ struct buffer_head *__getblk_gfp(struct block_device *bdev, sector_t block,
+ void __brelse(struct buffer_head *);
+ void __bforget(struct buffer_head *);
+ void __breadahead(struct block_device *, sector_t block, unsigned int size);
++void __breadahead_gfp(struct block_device *, sector_t block, unsigned int size,
++ gfp_t gfp);
+ struct buffer_head *__bread_gfp(struct block_device *,
+ sector_t block, unsigned size, gfp_t gfp);
+ void invalidate_bh_lrus(void);
+@@ -319,6 +321,12 @@ sb_breadahead(struct super_block *sb, sector_t block)
+ __breadahead(sb->s_bdev, block, sb->s_blocksize);
+ }
+
++static inline void
++sb_breadahead_unmovable(struct super_block *sb, sector_t block)
++{
++ __breadahead_gfp(sb->s_bdev, block, sb->s_blocksize, 0);
++}
++
+ static inline struct buffer_head *
+ sb_getblk(struct super_block *sb, sector_t block)
+ {
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index bb22908c79e8..75112aa8064e 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -345,7 +345,7 @@ static inline void *offset_to_ptr(const int *off)
+ * compiler has support to do so.
+ */
+ #define compiletime_assert(condition, msg) \
+- _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
++ _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
+
+ #define compiletime_assert_atomic_type(t) \
+ compiletime_assert(__native_word(t), \
+diff --git a/include/linux/key-type.h b/include/linux/key-type.h
+index d3c5ae8ad498..3341ddac2348 100644
+--- a/include/linux/key-type.h
++++ b/include/linux/key-type.h
+@@ -125,7 +125,7 @@ struct key_type {
+ * much is copied into the buffer
+ * - shouldn't do the copy if the buffer is NULL
+ */
+- long (*read)(const struct key *key, char __user *buffer, size_t buflen);
++ long (*read)(const struct key *key, char *buffer, size_t buflen);
+
+ /* handle request_key() for this type instead of invoking
+ * /sbin/request-key (optional)
+diff --git a/include/linux/percpu_counter.h b/include/linux/percpu_counter.h
+index 4f052496cdfd..0a4f54dd4737 100644
+--- a/include/linux/percpu_counter.h
++++ b/include/linux/percpu_counter.h
+@@ -78,9 +78,9 @@ static inline s64 percpu_counter_read(struct percpu_counter *fbc)
+ */
+ static inline s64 percpu_counter_read_positive(struct percpu_counter *fbc)
+ {
+- s64 ret = fbc->count;
++ /* Prevent reloads of fbc->count */
++ s64 ret = READ_ONCE(fbc->count);
+
+- barrier(); /* Prevent reloads of fbc->count */
+ if (ret >= 0)
+ return ret;
+ return 0;
+diff --git a/include/linux/swapops.h b/include/linux/swapops.h
+index 22af9d8a84ae..28d572b7ea73 100644
+--- a/include/linux/swapops.h
++++ b/include/linux/swapops.h
+@@ -368,7 +368,8 @@ static inline void num_poisoned_pages_inc(void)
+ }
+ #endif
+
+-#if defined(CONFIG_MEMORY_FAILURE) || defined(CONFIG_MIGRATION)
++#if defined(CONFIG_MEMORY_FAILURE) || defined(CONFIG_MIGRATION) || \
++ defined(CONFIG_DEVICE_PRIVATE)
+ static inline int non_swap_entry(swp_entry_t entry)
+ {
+ return swp_type(entry) >= MAX_SWAPFILES;
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index e85636fb81b9..daf0a9637d73 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -188,8 +188,7 @@ struct bpf_call_arg_meta {
+ bool pkt_access;
+ int regno;
+ int access_size;
+- s64 msize_smax_value;
+- u64 msize_umax_value;
++ u64 msize_max_value;
+ };
+
+ static DEFINE_MUTEX(bpf_verifier_lock);
+@@ -2076,8 +2075,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno,
+ /* remember the mem_size which may be used later
+ * to refine return values.
+ */
+- meta->msize_smax_value = reg->smax_value;
+- meta->msize_umax_value = reg->umax_value;
++ meta->msize_max_value = reg->umax_value;
+
+ /* The register is SCALAR_VALUE; the access check
+ * happens using its boundaries.
+@@ -2448,21 +2446,44 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
+ return 0;
+ }
+
+-static void do_refine_retval_range(struct bpf_reg_state *regs, int ret_type,
+- int func_id,
+- struct bpf_call_arg_meta *meta)
++static int do_refine_retval_range(struct bpf_verifier_env *env,
++ struct bpf_reg_state *regs, int ret_type,
++ int func_id, struct bpf_call_arg_meta *meta)
+ {
+ struct bpf_reg_state *ret_reg = ®s[BPF_REG_0];
++ struct bpf_reg_state tmp_reg = *ret_reg;
++ bool ret;
+
+ if (ret_type != RET_INTEGER ||
+ (func_id != BPF_FUNC_get_stack &&
+ func_id != BPF_FUNC_probe_read_str))
+- return;
++ return 0;
++
++ /* Error case where ret is in interval [S32MIN, -1]. */
++ ret_reg->smin_value = S32_MIN;
++ ret_reg->smax_value = -1;
++
++ __reg_deduce_bounds(ret_reg);
++ __reg_bound_offset(ret_reg);
++ __update_reg_bounds(ret_reg);
++
++ ret = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
++ if (!ret)
++ return -EFAULT;
++
++ *ret_reg = tmp_reg;
++
++ /* Success case where ret is in range [0, msize_max_value]. */
++ ret_reg->smin_value = 0;
++ ret_reg->smax_value = meta->msize_max_value;
++ ret_reg->umin_value = ret_reg->smin_value;
++ ret_reg->umax_value = ret_reg->smax_value;
+
+- ret_reg->smax_value = meta->msize_smax_value;
+- ret_reg->umax_value = meta->msize_umax_value;
+ __reg_deduce_bounds(ret_reg);
+ __reg_bound_offset(ret_reg);
++ __update_reg_bounds(ret_reg);
++
++ return 0;
+ }
+
+ static int
+@@ -2617,7 +2638,9 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
+ return -EINVAL;
+ }
+
+- do_refine_retval_range(regs, fn->ret_type, func_id, &meta);
++ err = do_refine_retval_range(env, regs, fn->ret_type, func_id, &meta);
++ if (err)
++ return err;
+
+ err = check_map_func_compatibility(env, meta.map_ptr, func_id);
+ if (err)
+diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c
+index 7d0b0ed74404..95395ef5922a 100644
+--- a/kernel/locking/locktorture.c
++++ b/kernel/locking/locktorture.c
+@@ -710,10 +710,10 @@ static void __torture_print_stats(char *page,
+ if (statp[i].n_lock_fail)
+ fail = true;
+ sum += statp[i].n_lock_acquired;
+- if (max < statp[i].n_lock_fail)
+- max = statp[i].n_lock_fail;
+- if (min > statp[i].n_lock_fail)
+- min = statp[i].n_lock_fail;
++ if (max < statp[i].n_lock_acquired)
++ max = statp[i].n_lock_acquired;
++ if (min > statp[i].n_lock_acquired)
++ min = statp[i].n_lock_acquired;
+ }
+ page += sprintf(page,
+ "%s: Total: %lld Max/Min: %ld/%ld %s Fail: %d %s\n",
+diff --git a/lib/raid6/neon.uc b/lib/raid6/neon.uc
+index d5242f544551..b7c68030da4f 100644
+--- a/lib/raid6/neon.uc
++++ b/lib/raid6/neon.uc
+@@ -28,7 +28,6 @@
+
+ typedef uint8x16_t unative_t;
+
+-#define NBYTES(x) ((unative_t){x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x})
+ #define NSIZE sizeof(unative_t)
+
+ /*
+@@ -61,7 +60,7 @@ void raid6_neon$#_gen_syndrome_real(int disks, unsigned long bytes, void **ptrs)
+ int d, z, z0;
+
+ register unative_t wd$$, wq$$, wp$$, w1$$, w2$$;
+- const unative_t x1d = NBYTES(0x1d);
++ const unative_t x1d = vdupq_n_u8(0x1d);
+
+ z0 = disks - 3; /* Highest data disk */
+ p = dptr[z0+1]; /* XOR parity */
+@@ -92,7 +91,7 @@ void raid6_neon$#_xor_syndrome_real(int disks, int start, int stop,
+ int d, z, z0;
+
+ register unative_t wd$$, wq$$, wp$$, w1$$, w2$$;
+- const unative_t x1d = NBYTES(0x1d);
++ const unative_t x1d = vdupq_n_u8(0x1d);
+
+ z0 = stop; /* P/Q right side optimization */
+ p = dptr[disks-2]; /* XOR parity */
+diff --git a/lib/raid6/recov_neon_inner.c b/lib/raid6/recov_neon_inner.c
+index 8cd20c9f834a..7d00c31a6547 100644
+--- a/lib/raid6/recov_neon_inner.c
++++ b/lib/raid6/recov_neon_inner.c
+@@ -10,11 +10,6 @@
+
+ #include <arm_neon.h>
+
+-static const uint8x16_t x0f = {
+- 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f,
+- 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f, 0x0f,
+-};
+-
+ #ifdef CONFIG_ARM
+ /*
+ * AArch32 does not provide this intrinsic natively because it does not
+@@ -41,6 +36,7 @@ void __raid6_2data_recov_neon(int bytes, uint8_t *p, uint8_t *q, uint8_t *dp,
+ uint8x16_t pm1 = vld1q_u8(pbmul + 16);
+ uint8x16_t qm0 = vld1q_u8(qmul);
+ uint8x16_t qm1 = vld1q_u8(qmul + 16);
++ uint8x16_t x0f = vdupq_n_u8(0x0f);
+
+ /*
+ * while ( bytes-- ) {
+@@ -87,6 +83,7 @@ void __raid6_datap_recov_neon(int bytes, uint8_t *p, uint8_t *q, uint8_t *dq,
+ {
+ uint8x16_t qm0 = vld1q_u8(qmul);
+ uint8x16_t qm1 = vld1q_u8(qmul + 16);
++ uint8x16_t x0f = vdupq_n_u8(0x0f);
+
+ /*
+ * while (bytes--) {
+diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
+index 7f4534828f6c..a0494206cfda 100644
+--- a/net/dns_resolver/dns_key.c
++++ b/net/dns_resolver/dns_key.c
+@@ -241,7 +241,7 @@ static void dns_resolver_describe(const struct key *key, struct seq_file *m)
+ * - the key's semaphore is read-locked
+ */
+ static long dns_resolver_read(const struct key *key,
+- char __user *buffer, size_t buflen)
++ char *buffer, size_t buflen)
+ {
+ int err = PTR_ERR(key->payload.data[dns_key_error]);
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 5881f6668817..1b8a53081632 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3450,7 +3450,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
+ NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
+ NFT_SET_MAP | NFT_SET_EVAL |
+ NFT_SET_OBJECT))
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ /* Only one of these operations is supported */
+ if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
+ (NFT_SET_MAP | NFT_SET_OBJECT))
+@@ -3488,7 +3488,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
+ objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
+ if (objtype == NFT_OBJECT_UNSPEC ||
+ objtype > NFT_OBJECT_MAX)
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ } else if (flags & NFT_SET_OBJECT)
+ return -EINVAL;
+ else
+diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
+index e7f6b8823eb6..ad9d1b21cb0b 100644
+--- a/net/rxrpc/key.c
++++ b/net/rxrpc/key.c
+@@ -35,7 +35,7 @@ static void rxrpc_free_preparse_s(struct key_preparsed_payload *);
+ static void rxrpc_destroy(struct key *);
+ static void rxrpc_destroy_s(struct key *);
+ static void rxrpc_describe(const struct key *, struct seq_file *);
+-static long rxrpc_read(const struct key *, char __user *, size_t);
++static long rxrpc_read(const struct key *, char *, size_t);
+
+ /*
+ * rxrpc defined keys take an arbitrary string as the description and an
+@@ -1044,12 +1044,12 @@ EXPORT_SYMBOL(rxrpc_get_null_key);
+ * - this returns the result in XDR form
+ */
+ static long rxrpc_read(const struct key *key,
+- char __user *buffer, size_t buflen)
++ char *buffer, size_t buflen)
+ {
+ const struct rxrpc_key_token *token;
+ const struct krb5_principal *princ;
+ size_t size;
+- __be32 __user *xdr, *oldxdr;
++ __be32 *xdr, *oldxdr;
+ u32 cnlen, toksize, ntoks, tok, zero;
+ u16 toksizes[AFSTOKEN_MAX];
+ int loop;
+@@ -1126,30 +1126,25 @@ static long rxrpc_read(const struct key *key,
+ if (!buffer || buflen < size)
+ return size;
+
+- xdr = (__be32 __user *) buffer;
++ xdr = (__be32 *)buffer;
+ zero = 0;
+ #define ENCODE(x) \
+ do { \
+- __be32 y = htonl(x); \
+- if (put_user(y, xdr++) < 0) \
+- goto fault; \
++ *xdr++ = htonl(x); \
+ } while(0)
+ #define ENCODE_DATA(l, s) \
+ do { \
+ u32 _l = (l); \
+ ENCODE(l); \
+- if (copy_to_user(xdr, (s), _l) != 0) \
+- goto fault; \
+- if (_l & 3 && \
+- copy_to_user((u8 __user *)xdr + _l, &zero, 4 - (_l & 3)) != 0) \
+- goto fault; \
++ memcpy(xdr, (s), _l); \
++ if (_l & 3) \
++ memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3)); \
+ xdr += (_l + 3) >> 2; \
+ } while(0)
+ #define ENCODE64(x) \
+ do { \
+ __be64 y = cpu_to_be64(x); \
+- if (copy_to_user(xdr, &y, 8) != 0) \
+- goto fault; \
++ memcpy(xdr, &y, 8); \
+ xdr += 8 >> 2; \
+ } while(0)
+ #define ENCODE_STR(s) \
+@@ -1240,8 +1235,4 @@ static long rxrpc_read(const struct key *key,
+ ASSERTCMP((char __user *) xdr - buffer, ==, size);
+ _leave(" = %zu", size);
+ return size;
+-
+-fault:
+- _leave(" = -EFAULT");
+- return -EFAULT;
+ }
+diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
+index 556a649512b6..706fad12f22c 100644
+--- a/net/xdp/xdp_umem.c
++++ b/net/xdp/xdp_umem.c
+@@ -260,7 +260,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
+ u32 chunk_size = mr->chunk_size, headroom = mr->headroom;
+ unsigned int chunks, chunks_per_page;
+ u64 addr = mr->addr, size = mr->len;
+- int size_chk, err, i;
++ int err, i;
+
+ if (chunk_size < XDP_UMEM_MIN_CHUNK_SIZE || chunk_size > PAGE_SIZE) {
+ /* Strictly speaking we could support this, if:
+@@ -295,8 +295,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
+
+ headroom = ALIGN(headroom, 64);
+
+- size_chk = chunk_size - headroom - XDP_PACKET_HEADROOM;
+- if (size_chk < 0)
++ if (headroom >= chunk_size - XDP_PACKET_HEADROOM)
+ return -EINVAL;
+
+ umem->address = (unsigned long)addr;
+diff --git a/security/keys/big_key.c b/security/keys/big_key.c
+index 2806e70d7f8f..630594a5b46e 100644
+--- a/security/keys/big_key.c
++++ b/security/keys/big_key.c
+@@ -356,7 +356,7 @@ void big_key_describe(const struct key *key, struct seq_file *m)
+ * read the key data
+ * - the key's semaphore is read-locked
+ */
+-long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
++long big_key_read(const struct key *key, char *buffer, size_t buflen)
+ {
+ size_t datalen = (size_t)key->payload.data[big_key_len];
+ long ret;
+@@ -395,9 +395,8 @@ long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
+
+ ret = datalen;
+
+- /* copy decrypted data to user */
+- if (copy_to_user(buffer, buf->virt, datalen) != 0)
+- ret = -EFAULT;
++ /* copy out decrypted data */
++ memcpy(buffer, buf->virt, datalen);
+
+ err_fput:
+ fput(file);
+@@ -405,9 +404,7 @@ error:
+ big_key_free_buffer(buf);
+ } else {
+ ret = datalen;
+- if (copy_to_user(buffer, key->payload.data[big_key_data],
+- datalen) != 0)
+- ret = -EFAULT;
++ memcpy(buffer, key->payload.data[big_key_data], datalen);
+ }
+
+ return ret;
+diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
+index d92cbf9687c3..571f6d486838 100644
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -895,14 +895,14 @@ out:
+ }
+
+ /*
+- * encrypted_read - format and copy the encrypted data to userspace
++ * encrypted_read - format and copy out the encrypted data
+ *
+ * The resulting datablob format is:
+ * <master-key name> <decrypted data length> <encrypted iv> <encrypted data>
+ *
+ * On success, return to userspace the encrypted key datablob size.
+ */
+-static long encrypted_read(const struct key *key, char __user *buffer,
++static long encrypted_read(const struct key *key, char *buffer,
+ size_t buflen)
+ {
+ struct encrypted_key_payload *epayload;
+@@ -950,8 +950,7 @@ static long encrypted_read(const struct key *key, char __user *buffer,
+ key_put(mkey);
+ memzero_explicit(derived_key, sizeof(derived_key));
+
+- if (copy_to_user(buffer, ascii_buf, asciiblob_len) != 0)
+- ret = -EFAULT;
++ memcpy(buffer, ascii_buf, asciiblob_len);
+ kzfree(ascii_buf);
+
+ return asciiblob_len;
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index e00e20204de0..4b6a084e323b 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -742,6 +742,21 @@ error:
+ return ret;
+ }
+
++/*
++ * Call the read method
++ */
++static long __keyctl_read_key(struct key *key, char *buffer, size_t buflen)
++{
++ long ret;
++
++ down_read(&key->sem);
++ ret = key_validate(key);
++ if (ret == 0)
++ ret = key->type->read(key, buffer, buflen);
++ up_read(&key->sem);
++ return ret;
++}
++
+ /*
+ * Read a key's payload.
+ *
+@@ -757,26 +772,27 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
+ struct key *key;
+ key_ref_t key_ref;
+ long ret;
++ char *key_data;
+
+ /* find the key first */
+ key_ref = lookup_user_key(keyid, 0, 0);
+ if (IS_ERR(key_ref)) {
+ ret = -ENOKEY;
+- goto error;
++ goto out;
+ }
+
+ key = key_ref_to_ptr(key_ref);
+
+ ret = key_read_state(key);
+ if (ret < 0)
+- goto error2; /* Negatively instantiated */
++ goto key_put_out; /* Negatively instantiated */
+
+ /* see if we can read it directly */
+ ret = key_permission(key_ref, KEY_NEED_READ);
+ if (ret == 0)
+ goto can_read_key;
+ if (ret != -EACCES)
+- goto error2;
++ goto key_put_out;
+
+ /* we can't; see if it's searchable from this process's keyrings
+ * - we automatically take account of the fact that it may be
+@@ -784,26 +800,51 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
+ */
+ if (!is_key_possessed(key_ref)) {
+ ret = -EACCES;
+- goto error2;
++ goto key_put_out;
+ }
+
+ /* the key is probably readable - now try to read it */
+ can_read_key:
+- ret = -EOPNOTSUPP;
+- if (key->type->read) {
+- /* Read the data with the semaphore held (since we might sleep)
+- * to protect against the key being updated or revoked.
+- */
+- down_read(&key->sem);
+- ret = key_validate(key);
+- if (ret == 0)
+- ret = key->type->read(key, buffer, buflen);
+- up_read(&key->sem);
++ if (!key->type->read) {
++ ret = -EOPNOTSUPP;
++ goto key_put_out;
+ }
+
+-error2:
++ if (!buffer || !buflen) {
++ /* Get the key length from the read method */
++ ret = __keyctl_read_key(key, NULL, 0);
++ goto key_put_out;
++ }
++
++ /*
++ * Read the data with the semaphore held (since we might sleep)
++ * to protect against the key being updated or revoked.
++ *
++ * Allocating a temporary buffer to hold the keys before
++ * transferring them to user buffer to avoid potential
++ * deadlock involving page fault and mmap_sem.
++ */
++ key_data = kmalloc(buflen, GFP_KERNEL);
++
++ if (!key_data) {
++ ret = -ENOMEM;
++ goto key_put_out;
++ }
++ ret = __keyctl_read_key(key, key_data, buflen);
++
++ /*
++ * Read methods will just return the required length without
++ * any copying if the provided length isn't large enough.
++ */
++ if (ret > 0 && ret <= buflen) {
++ if (copy_to_user(buffer, key_data, ret))
++ ret = -EFAULT;
++ }
++ kzfree(key_data);
++
++key_put_out:
+ key_put(key);
+-error:
++out:
+ return ret;
+ }
+
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index 99a55145ddcd..e8f2366021ea 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -432,7 +432,6 @@ static int keyring_read_iterator(const void *object, void *data)
+ {
+ struct keyring_read_iterator_context *ctx = data;
+ const struct key *key = keyring_ptr_to_key(object);
+- int ret;
+
+ kenter("{%s,%d},,{%zu/%zu}",
+ key->type->name, key->serial, ctx->count, ctx->buflen);
+@@ -440,10 +439,7 @@ static int keyring_read_iterator(const void *object, void *data)
+ if (ctx->count >= ctx->buflen)
+ return 1;
+
+- ret = put_user(key->serial, ctx->buffer);
+- if (ret < 0)
+- return ret;
+- ctx->buffer++;
++ *ctx->buffer++ = key->serial;
+ ctx->count += sizeof(key->serial);
+ return 0;
+ }
+diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
+index 1d34b2a5f485..13ac3b1e57da 100644
+--- a/security/keys/request_key_auth.c
++++ b/security/keys/request_key_auth.c
+@@ -27,7 +27,7 @@ static int request_key_auth_instantiate(struct key *,
+ static void request_key_auth_describe(const struct key *, struct seq_file *);
+ static void request_key_auth_revoke(struct key *);
+ static void request_key_auth_destroy(struct key *);
+-static long request_key_auth_read(const struct key *, char __user *, size_t);
++static long request_key_auth_read(const struct key *, char *, size_t);
+
+ /*
+ * The request-key authorisation key type definition.
+@@ -85,7 +85,7 @@ static void request_key_auth_describe(const struct key *key,
+ * - the key's semaphore is read-locked
+ */
+ static long request_key_auth_read(const struct key *key,
+- char __user *buffer, size_t buflen)
++ char *buffer, size_t buflen)
+ {
+ struct request_key_auth *rka = get_request_key_auth(key);
+ size_t datalen;
+@@ -102,8 +102,7 @@ static long request_key_auth_read(const struct key *key,
+ if (buflen > datalen)
+ buflen = datalen;
+
+- if (copy_to_user(buffer, rka->callout_info, buflen) != 0)
+- ret = -EFAULT;
++ memcpy(buffer, rka->callout_info, buflen);
+ }
+
+ return ret;
+diff --git a/security/keys/trusted.c b/security/keys/trusted.c
+index b69d3b1777c2..09545c42977e 100644
+--- a/security/keys/trusted.c
++++ b/security/keys/trusted.c
+@@ -1135,11 +1135,10 @@ out:
+ * trusted_read - copy the sealed blob data to userspace in hex.
+ * On success, return to userspace the trusted key datablob size.
+ */
+-static long trusted_read(const struct key *key, char __user *buffer,
++static long trusted_read(const struct key *key, char *buffer,
+ size_t buflen)
+ {
+ const struct trusted_key_payload *p;
+- char *ascii_buf;
+ char *bufp;
+ int i;
+
+@@ -1148,18 +1147,9 @@ static long trusted_read(const struct key *key, char __user *buffer,
+ return -EINVAL;
+
+ if (buffer && buflen >= 2 * p->blob_len) {
+- ascii_buf = kmalloc_array(2, p->blob_len, GFP_KERNEL);
+- if (!ascii_buf)
+- return -ENOMEM;
+-
+- bufp = ascii_buf;
++ bufp = buffer;
+ for (i = 0; i < p->blob_len; i++)
+ bufp = hex_byte_pack(bufp, p->blob[i]);
+- if (copy_to_user(buffer, ascii_buf, 2 * p->blob_len) != 0) {
+- kzfree(ascii_buf);
+- return -EFAULT;
+- }
+- kzfree(ascii_buf);
+ }
+ return 2 * p->blob_len;
+ }
+diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
+index 9f558bedba23..0e723b676aef 100644
+--- a/security/keys/user_defined.c
++++ b/security/keys/user_defined.c
+@@ -172,7 +172,7 @@ EXPORT_SYMBOL_GPL(user_describe);
+ * read the key data
+ * - the key's semaphore is read-locked
+ */
+-long user_read(const struct key *key, char __user *buffer, size_t buflen)
++long user_read(const struct key *key, char *buffer, size_t buflen)
+ {
+ const struct user_key_payload *upayload;
+ long ret;
+@@ -185,8 +185,7 @@ long user_read(const struct key *key, char __user *buffer, size_t buflen)
+ if (buflen > upayload->datalen)
+ buflen = upayload->datalen;
+
+- if (copy_to_user(buffer, upayload->data, buflen) != 0)
+- ret = -EFAULT;
++ memcpy(buffer, upayload->data, buflen);
+ }
+
+ return ret;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index a2eeb08fa61d..54a9b391ecce 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2076,24 +2076,15 @@ static void azx_firmware_cb(const struct firmware *fw, void *context)
+ {
+ struct snd_card *card = context;
+ struct azx *chip = card->private_data;
+- struct pci_dev *pci = chip->pci;
+-
+- if (!fw) {
+- dev_err(card->dev, "Cannot load firmware, aborting\n");
+- goto error;
+- }
+
+- chip->fw = fw;
++ if (fw)
++ chip->fw = fw;
++ else
++ dev_err(card->dev, "Cannot load firmware, continue without patching\n");
+ if (!chip->disabled) {
+ /* continue probing */
+- if (azx_probe_continue(chip))
+- goto error;
++ azx_probe_continue(chip);
+ }
+- return; /* OK */
+-
+- error:
+- snd_card_free(card);
+- pci_set_drvdata(pci, NULL);
+ }
+ #endif
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index ecf5fc77f50b..9479c74af9ba 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -938,10 +938,7 @@ static struct rela *find_switch_table(struct objtool_file *file,
+ * it.
+ */
+ for (;
+- &insn->list != &file->insn_list &&
+- insn->sec == func->sec &&
+- insn->offset >= func->offset;
+-
++ &insn->list != &file->insn_list && insn->func && insn->func->pfunc == func;
+ insn = insn->first_jump_src ?: list_prev_entry(insn, list)) {
+
+ if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-04-29 17:57 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-04-29 17:57 UTC (permalink / raw
To: gentoo-commits
commit: 27d7c2cb01376b49c16c731e901f2ce5bf8952ea
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 29 17:57:32 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 29 17:57:32 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=27d7c2cb
Linux patch 4.19.119
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1118_linux-4.19.119.patch | 5330 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5334 insertions(+)
diff --git a/0000_README b/0000_README
index 5c6dcb8..36e1c22 100644
--- a/0000_README
+++ b/0000_README
@@ -511,6 +511,10 @@ Patch: 1117_linux-4.19.118.patch
From: https://www.kernel.org
Desc: Linux 4.19.118
+Patch: 1118_linux-4.19.119.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.119
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1118_linux-4.19.119.patch b/1118_linux-4.19.119.patch
new file mode 100644
index 0000000..70f7790
--- /dev/null
+++ b/1118_linux-4.19.119.patch
@@ -0,0 +1,5330 @@
+diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt
+index eeb3fc9d777b..667ea906266e 100644
+--- a/Documentation/arm64/silicon-errata.txt
++++ b/Documentation/arm64/silicon-errata.txt
+@@ -59,6 +59,7 @@ stable kernels.
+ | ARM | Cortex-A73 | #858921 | ARM64_ERRATUM_858921 |
+ | ARM | Cortex-A55 | #1024718 | ARM64_ERRATUM_1024718 |
+ | ARM | Cortex-A76 | #1463225 | ARM64_ERRATUM_1463225 |
++| ARM | Neoverse-N1 | #1542419 | ARM64_ERRATUM_1542419 |
+ | ARM | MMU-500 | #841119,#826419 | N/A |
+ | | | | |
+ | Cavium | ThunderX ITS | #22375, #24313 | CAVIUM_ERRATUM_22375 |
+diff --git a/Makefile b/Makefile
+index 72ae7e879077..69c95fe6fba5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 118
++SUBLEVEL = 119
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/mach-imx/Makefile b/arch/arm/mach-imx/Makefile
+index e9cfe8e86f33..02bf3eab4196 100644
+--- a/arch/arm/mach-imx/Makefile
++++ b/arch/arm/mach-imx/Makefile
+@@ -89,8 +89,10 @@ AFLAGS_suspend-imx6.o :=-Wa,-march=armv7-a
+ obj-$(CONFIG_SOC_IMX6) += suspend-imx6.o
+ obj-$(CONFIG_SOC_IMX53) += suspend-imx53.o
+ endif
++ifeq ($(CONFIG_ARM_CPU_SUSPEND),y)
+ AFLAGS_resume-imx6.o :=-Wa,-march=armv7-a
+ obj-$(CONFIG_SOC_IMX6) += resume-imx6.o
++endif
+ obj-$(CONFIG_SOC_IMX6) += pm-imx6.o
+
+ obj-$(CONFIG_SOC_IMX1) += mach-imx1.o
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 51fe21f5d078..1fe3e5cb2927 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -499,6 +499,22 @@ config ARM64_ERRATUM_1463225
+
+ If unsure, say Y.
+
++config ARM64_ERRATUM_1542419
++ bool "Neoverse-N1: workaround mis-ordering of instruction fetches"
++ default y
++ help
++ This option adds a workaround for ARM Neoverse-N1 erratum
++ 1542419.
++
++ Affected Neoverse-N1 cores could execute a stale instruction when
++ modified by another CPU. The workaround depends on a firmware
++ counterpart.
++
++ Workaround the issue by hiding the DIC feature from EL0. This
++ forces user-space to perform cache maintenance.
++
++ If unsure, say Y.
++
+ config CAVIUM_ERRATUM_22375
+ bool "Cavium erratum 22375, 24313"
+ default y
+diff --git a/arch/arm64/include/asm/cache.h b/arch/arm64/include/asm/cache.h
+index 5ee5bca8c24b..baa684782358 100644
+--- a/arch/arm64/include/asm/cache.h
++++ b/arch/arm64/include/asm/cache.h
+@@ -22,6 +22,7 @@
+ #define CTR_L1IP_MASK 3
+ #define CTR_DMINLINE_SHIFT 16
+ #define CTR_IMINLINE_SHIFT 0
++#define CTR_IMINLINE_MASK 0xf
+ #define CTR_ERG_SHIFT 20
+ #define CTR_CWG_SHIFT 24
+ #define CTR_CWG_MASK 15
+@@ -29,7 +30,7 @@
+ #define CTR_DIC_SHIFT 29
+
+ #define CTR_CACHE_MINLINE_MASK \
+- (0xf << CTR_DMINLINE_SHIFT | 0xf << CTR_IMINLINE_SHIFT)
++ (0xf << CTR_DMINLINE_SHIFT | CTR_IMINLINE_MASK << CTR_IMINLINE_SHIFT)
+
+ #define CTR_L1IP(ctr) (((ctr) >> CTR_L1IP_SHIFT) & CTR_L1IP_MASK)
+
+diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h
+index c3de0bbf0e9a..df8fe8ecc37e 100644
+--- a/arch/arm64/include/asm/cpucaps.h
++++ b/arch/arm64/include/asm/cpucaps.h
+@@ -53,7 +53,8 @@
+ #define ARM64_HAS_STAGE2_FWB 32
+ #define ARM64_WORKAROUND_1463225 33
+ #define ARM64_SSBS 34
++#define ARM64_WORKAROUND_1542419 35
+
+-#define ARM64_NCAPS 35
++#define ARM64_NCAPS 36
+
+ #endif /* __ASM_CPUCAPS_H */
+diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
+index fa770c070fdd..3cd936b1c79c 100644
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -80,6 +80,7 @@
+ #define ARM_CPU_PART_CORTEX_A35 0xD04
+ #define ARM_CPU_PART_CORTEX_A55 0xD05
+ #define ARM_CPU_PART_CORTEX_A76 0xD0B
++#define ARM_CPU_PART_NEOVERSE_N1 0xD0C
+
+ #define APM_CPU_PART_POTENZA 0x000
+
+@@ -107,6 +108,7 @@
+ #define MIDR_CORTEX_A35 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A35)
+ #define MIDR_CORTEX_A55 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A55)
+ #define MIDR_CORTEX_A76 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76)
++#define MIDR_NEOVERSE_N1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N1)
+ #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
+ #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
+ #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index 71888808ded7..76490b0cefce 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -643,6 +643,18 @@ needs_tx2_tvm_workaround(const struct arm64_cpu_capabilities *entry,
+ return false;
+ }
+
++static bool __maybe_unused
++has_neoverse_n1_erratum_1542419(const struct arm64_cpu_capabilities *entry,
++ int scope)
++{
++ u32 midr = read_cpuid_id();
++ bool has_dic = read_cpuid_cachetype() & BIT(CTR_DIC_SHIFT);
++ const struct midr_range range = MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1);
++
++ WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible());
++ return is_midr_in_range(midr, &range) && has_dic;
++}
++
+ #ifdef CONFIG_HARDEN_EL2_VECTORS
+
+ static const struct midr_range arm64_harden_el2_vectors[] = {
+@@ -834,6 +846,16 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ ERRATA_MIDR_RANGE_LIST(tx2_family_cpus),
+ .matches = needs_tx2_tvm_workaround,
+ },
++#endif
++#ifdef CONFIG_ARM64_ERRATUM_1542419
++ {
++ /* we depend on the firmware portion for correctness */
++ .desc = "ARM erratum 1542419 (kernel portion)",
++ .capability = ARM64_WORKAROUND_1542419,
++ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
++ .matches = has_neoverse_n1_erratum_1542419,
++ .cpu_enable = cpu_enable_trap_ctr_access,
++ },
+ #endif
+ {
+ }
+diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
+index 010212d35700..3ef9d0a3ac1d 100644
+--- a/arch/arm64/kernel/sys_compat.c
++++ b/arch/arm64/kernel/sys_compat.c
+@@ -19,6 +19,7 @@
+ */
+
+ #include <linux/compat.h>
++#include <linux/cpufeature.h>
+ #include <linux/personality.h>
+ #include <linux/sched.h>
+ #include <linux/sched/signal.h>
+@@ -28,6 +29,7 @@
+
+ #include <asm/cacheflush.h>
+ #include <asm/system_misc.h>
++#include <asm/tlbflush.h>
+ #include <asm/unistd.h>
+
+ static long
+@@ -41,6 +43,15 @@ __do_compat_cache_op(unsigned long start, unsigned long end)
+ if (fatal_signal_pending(current))
+ return 0;
+
++ if (cpus_have_const_cap(ARM64_WORKAROUND_1542419)) {
++ /*
++ * The workaround requires an inner-shareable tlbi.
++ * We pick the reserved-ASID to minimise the impact.
++ */
++ __tlbi(aside1is, __TLBI_VADDR(0, 0));
++ dsb(ish);
++ }
++
+ ret = __flush_cache_user_range(start, start + chunk);
+ if (ret)
+ return ret;
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index c8dc3a3640e7..965595fe6804 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -481,6 +481,15 @@ static void ctr_read_handler(unsigned int esr, struct pt_regs *regs)
+ int rt = (esr & ESR_ELx_SYS64_ISS_RT_MASK) >> ESR_ELx_SYS64_ISS_RT_SHIFT;
+ unsigned long val = arm64_ftr_reg_user_value(&arm64_ftr_reg_ctrel0);
+
++ if (cpus_have_const_cap(ARM64_WORKAROUND_1542419)) {
++ /* Hide DIC so that we can trap the unnecessary maintenance...*/
++ val &= ~BIT(CTR_DIC_SHIFT);
++
++ /* ... and fake IminLine to reduce the number of traps. */
++ val &= ~CTR_IMINLINE_MASK;
++ val |= (PAGE_SHIFT - 2) & CTR_IMINLINE_MASK;
++ }
++
+ pt_regs_write_reg(regs, rt, val);
+
+ arm64_skip_faulting_instruction(regs, AARCH64_INSN_SIZE);
+diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
+index eaf7300be5ab..bd4996958b13 100644
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -518,6 +518,8 @@ static bool __init parse_cache_info(struct device_node *np,
+ lsizep = of_get_property(np, propnames[3], NULL);
+ if (bsizep == NULL)
+ bsizep = lsizep;
++ if (lsizep == NULL)
++ lsizep = bsizep;
+ if (lsizep != NULL)
+ lsize = be32_to_cpu(*lsizep);
+ if (bsizep != NULL)
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index 5449e76cf2df..f6c21f6af274 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -492,35 +492,6 @@ static inline void clear_irq_work_pending(void)
+ "i" (offsetof(struct paca_struct, irq_work_pending)));
+ }
+
+-void arch_irq_work_raise(void)
+-{
+- preempt_disable();
+- set_irq_work_pending_flag();
+- /*
+- * Non-nmi code running with interrupts disabled will replay
+- * irq_happened before it re-enables interrupts, so setthe
+- * decrementer there instead of causing a hardware exception
+- * which would immediately hit the masked interrupt handler
+- * and have the net effect of setting the decrementer in
+- * irq_happened.
+- *
+- * NMI interrupts can not check this when they return, so the
+- * decrementer hardware exception is raised, which will fire
+- * when interrupts are next enabled.
+- *
+- * BookE does not support this yet, it must audit all NMI
+- * interrupt handlers to ensure they call nmi_enter() so this
+- * check would be correct.
+- */
+- if (IS_ENABLED(CONFIG_BOOKE) || !irqs_disabled() || in_nmi()) {
+- set_dec(1);
+- } else {
+- hard_irq_disable();
+- local_paca->irq_happened |= PACA_IRQ_DEC;
+- }
+- preempt_enable();
+-}
+-
+ #else /* 32-bit */
+
+ DEFINE_PER_CPU(u8, irq_work_pending);
+@@ -529,16 +500,27 @@ DEFINE_PER_CPU(u8, irq_work_pending);
+ #define test_irq_work_pending() __this_cpu_read(irq_work_pending)
+ #define clear_irq_work_pending() __this_cpu_write(irq_work_pending, 0)
+
++#endif /* 32 vs 64 bit */
++
+ void arch_irq_work_raise(void)
+ {
++ /*
++ * 64-bit code that uses irq soft-mask can just cause an immediate
++ * interrupt here that gets soft masked, if this is called under
++ * local_irq_disable(). It might be possible to prevent that happening
++ * by noticing interrupts are disabled and setting decrementer pending
++ * to be replayed when irqs are enabled. The problem there is that
++ * tracing can call irq_work_raise, including in code that does low
++ * level manipulations of irq soft-mask state (e.g., trace_hardirqs_on)
++ * which could get tangled up if we're messing with the same state
++ * here.
++ */
+ preempt_disable();
+ set_irq_work_pending_flag();
+ set_dec(1);
+ preempt_enable();
+ }
+
+-#endif /* 32 vs 64 bit */
+-
+ #else /* CONFIG_IRQ_WORK */
+
+ #define test_irq_work_pending() 0
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 11c3cd906ab4..18662c1a9361 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -1666,6 +1666,9 @@ static int gfn_to_memslot_approx(struct kvm_memslots *slots, gfn_t gfn)
+ start = slot + 1;
+ }
+
++ if (start >= slots->used_slots)
++ return slots->used_slots - 1;
++
+ if (gfn >= memslots[start].base_gfn &&
+ gfn < memslots[start].base_gfn + memslots[start].npages) {
+ atomic_set(&slots->lru_slot, start);
+diff --git a/arch/s390/lib/uaccess.c b/arch/s390/lib/uaccess.c
+index c4f8039a35e8..0267405ab7c6 100644
+--- a/arch/s390/lib/uaccess.c
++++ b/arch/s390/lib/uaccess.c
+@@ -64,10 +64,13 @@ mm_segment_t enable_sacf_uaccess(void)
+ {
+ mm_segment_t old_fs;
+ unsigned long asce, cr;
++ unsigned long flags;
+
+ old_fs = current->thread.mm_segment;
+ if (old_fs & 1)
+ return old_fs;
++ /* protect against a concurrent page table upgrade */
++ local_irq_save(flags);
+ current->thread.mm_segment |= 1;
+ asce = S390_lowcore.kernel_asce;
+ if (likely(old_fs == USER_DS)) {
+@@ -83,6 +86,7 @@ mm_segment_t enable_sacf_uaccess(void)
+ __ctl_load(asce, 7, 7);
+ set_cpu_flag(CIF_ASCE_SECONDARY);
+ }
++ local_irq_restore(flags);
+ return old_fs;
+ }
+ EXPORT_SYMBOL(enable_sacf_uaccess);
+diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
+index 814f26520aa2..f3bc9c9305da 100644
+--- a/arch/s390/mm/pgalloc.c
++++ b/arch/s390/mm/pgalloc.c
+@@ -72,8 +72,20 @@ static void __crst_table_upgrade(void *arg)
+ {
+ struct mm_struct *mm = arg;
+
+- if (current->active_mm == mm)
+- set_user_asce(mm);
++ /* we must change all active ASCEs to avoid the creation of new TLBs */
++ if (current->active_mm == mm) {
++ S390_lowcore.user_asce = mm->context.asce;
++ if (current->thread.mm_segment == USER_DS) {
++ __ctl_load(S390_lowcore.user_asce, 1, 1);
++ /* Mark user-ASCE present in CR1 */
++ clear_cpu_flag(CIF_ASCE_PRIMARY);
++ }
++ if (current->thread.mm_segment == USER_DS_SACF) {
++ __ctl_load(S390_lowcore.user_asce, 7, 7);
++ /* enable_sacf_uaccess does all or nothing */
++ WARN_ON(!test_cpu_flag(CIF_ASCE_SECONDARY));
++ }
++ }
+ __tlb_flush_local();
+ }
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 5c99b9bfce04..33136395db8f 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -622,10 +622,10 @@ struct kvm_vcpu_arch {
+ bool pvclock_set_guest_stopped_request;
+
+ struct {
++ u8 preempted;
+ u64 msr_val;
+ u64 last_steal;
+- struct gfn_to_hva_cache stime;
+- struct kvm_steal_time steal;
++ struct gfn_to_pfn_cache cache;
+ } st;
+
+ u64 tsc_offset;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index d37b48173e9c..fe5036641c59 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -7015,7 +7015,7 @@ static int handle_rmode_exception(struct kvm_vcpu *vcpu,
+ */
+ static void kvm_machine_check(void)
+ {
+-#if defined(CONFIG_X86_MCE) && defined(CONFIG_X86_64)
++#if defined(CONFIG_X86_MCE)
+ struct pt_regs regs = {
+ .cs = 3, /* Fake ring 3 no matter what the guest ran on */
+ .flags = X86_EFLAGS_IF,
+@@ -10841,6 +10841,15 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ "mov %%r13, %c[r13](%0) \n\t"
+ "mov %%r14, %c[r14](%0) \n\t"
+ "mov %%r15, %c[r15](%0) \n\t"
++
++ /*
++ * Clear all general purpose registers (except RSP, which is loaded by
++ * the CPU during VM-Exit) to prevent speculative use of the guest's
++ * values, even those that are saved/loaded via the stack. In theory,
++ * an L1 cache miss when restoring registers could lead to speculative
++ * execution with the guest's values. Zeroing XORs are dirt cheap,
++ * i.e. the extra paranoia is essentially free.
++ */
+ "xor %%r8d, %%r8d \n\t"
+ "xor %%r9d, %%r9d \n\t"
+ "xor %%r10d, %%r10d \n\t"
+@@ -10855,8 +10864,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+
+ "xor %%eax, %%eax \n\t"
+ "xor %%ebx, %%ebx \n\t"
++ "xor %%ecx, %%ecx \n\t"
++ "xor %%edx, %%edx \n\t"
+ "xor %%esi, %%esi \n\t"
+ "xor %%edi, %%edi \n\t"
++ "xor %%ebp, %%ebp \n\t"
+ "pop %%" _ASM_BP "; pop %%" _ASM_DX " \n\t"
+ ".pushsection .rodata \n\t"
+ ".global vmx_return \n\t"
+@@ -12125,13 +12137,9 @@ static void prepare_vmcs02_full(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
+
+ set_cr4_guest_host_mask(vmx);
+
+- if (kvm_mpx_supported()) {
+- if (vmx->nested.nested_run_pending &&
+- (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))
+- vmcs_write64(GUEST_BNDCFGS, vmcs12->guest_bndcfgs);
+- else
+- vmcs_write64(GUEST_BNDCFGS, vmx->nested.vmcs01_guest_bndcfgs);
+- }
++ if (kvm_mpx_supported() && vmx->nested.nested_run_pending &&
++ (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))
++ vmcs_write64(GUEST_BNDCFGS, vmcs12->guest_bndcfgs);
+
+ if (enable_vpid) {
+ if (nested_cpu_has_vpid(vmcs12) && vmx->nested.vpid02)
+@@ -12195,6 +12203,9 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
+ kvm_set_dr(vcpu, 7, vcpu->arch.dr7);
+ vmcs_write64(GUEST_IA32_DEBUGCTL, vmx->nested.vmcs01_debugctl);
+ }
++ if (kvm_mpx_supported() && (!vmx->nested.nested_run_pending ||
++ !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS)))
++ vmcs_write64(GUEST_BNDCFGS, vmx->nested.vmcs01_guest_bndcfgs);
+ if (vmx->nested.nested_run_pending) {
+ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD,
+ vmcs12->vm_entry_intr_info_field);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 1a6e1aa2fb29..6bfc9eaf8dee 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2397,43 +2397,45 @@ static void kvm_vcpu_flush_tlb(struct kvm_vcpu *vcpu, bool invalidate_gpa)
+
+ static void record_steal_time(struct kvm_vcpu *vcpu)
+ {
++ struct kvm_host_map map;
++ struct kvm_steal_time *st;
++
+ if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
+ return;
+
+- if (unlikely(kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
+- &vcpu->arch.st.steal, sizeof(struct kvm_steal_time))))
++ /* -EAGAIN is returned in atomic context so we can just return. */
++ if (kvm_map_gfn(vcpu, vcpu->arch.st.msr_val >> PAGE_SHIFT,
++ &map, &vcpu->arch.st.cache, false))
+ return;
+
++ st = map.hva +
++ offset_in_page(vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS);
++
+ /*
+ * Doing a TLB flush here, on the guest's behalf, can avoid
+ * expensive IPIs.
+ */
+- if (xchg(&vcpu->arch.st.steal.preempted, 0) & KVM_VCPU_FLUSH_TLB)
++ if (xchg(&st->preempted, 0) & KVM_VCPU_FLUSH_TLB)
+ kvm_vcpu_flush_tlb(vcpu, false);
+
+- if (vcpu->arch.st.steal.version & 1)
+- vcpu->arch.st.steal.version += 1; /* first time write, random junk */
++ vcpu->arch.st.preempted = 0;
+
+- vcpu->arch.st.steal.version += 1;
++ if (st->version & 1)
++ st->version += 1; /* first time write, random junk */
+
+- kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
+- &vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
++ st->version += 1;
+
+ smp_wmb();
+
+- vcpu->arch.st.steal.steal += current->sched_info.run_delay -
++ st->steal += current->sched_info.run_delay -
+ vcpu->arch.st.last_steal;
+ vcpu->arch.st.last_steal = current->sched_info.run_delay;
+
+- kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
+- &vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
+-
+ smp_wmb();
+
+- vcpu->arch.st.steal.version += 1;
++ st->version += 1;
+
+- kvm_write_guest_cached(vcpu->kvm, &vcpu->arch.st.stime,
+- &vcpu->arch.st.steal, sizeof(struct kvm_steal_time));
++ kvm_unmap_gfn(vcpu, &map, &vcpu->arch.st.cache, true, false);
+ }
+
+ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+@@ -2575,11 +2577,6 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ if (data & KVM_STEAL_RESERVED_MASK)
+ return 1;
+
+- if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.st.stime,
+- data & KVM_STEAL_VALID_BITS,
+- sizeof(struct kvm_steal_time)))
+- return 1;
+-
+ vcpu->arch.st.msr_val = data;
+
+ if (!(data & KVM_MSR_ENABLED))
+@@ -3272,18 +3269,25 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+
+ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu)
+ {
++ struct kvm_host_map map;
++ struct kvm_steal_time *st;
++
+ if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
+ return;
+
+- if (vcpu->arch.st.steal.preempted)
++ if (vcpu->arch.st.preempted)
++ return;
++
++ if (kvm_map_gfn(vcpu, vcpu->arch.st.msr_val >> PAGE_SHIFT, &map,
++ &vcpu->arch.st.cache, true))
+ return;
+
+- vcpu->arch.st.steal.preempted = KVM_VCPU_PREEMPTED;
++ st = map.hva +
++ offset_in_page(vcpu->arch.st.msr_val & KVM_STEAL_VALID_BITS);
+
+- kvm_write_guest_offset_cached(vcpu->kvm, &vcpu->arch.st.stime,
+- &vcpu->arch.st.steal.preempted,
+- offsetof(struct kvm_steal_time, preempted),
+- sizeof(vcpu->arch.st.steal.preempted));
++ st->preempted = vcpu->arch.st.preempted = KVM_VCPU_PREEMPTED;
++
++ kvm_unmap_gfn(vcpu, &map, &vcpu->arch.st.cache, true, true);
+ }
+
+ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
+@@ -8634,6 +8638,9 @@ static void fx_init(struct kvm_vcpu *vcpu)
+ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
+ {
+ void *wbinvd_dirty_mask = vcpu->arch.wbinvd_dirty_mask;
++ struct gfn_to_pfn_cache *cache = &vcpu->arch.st.cache;
++
++ kvm_release_pfn(cache->pfn, cache->dirty, cache);
+
+ kvmclock_reset(vcpu);
+
+@@ -9298,11 +9305,18 @@ out_free:
+
+ void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen)
+ {
++ struct kvm_vcpu *vcpu;
++ int i;
++
+ /*
+ * memslots->generation has been incremented.
+ * mmio generation may have reached its maximum value.
+ */
+ kvm_mmu_invalidate_mmio_sptes(kvm, gen);
++
++ /* Force re-initialization of steal_time cache */
++ kvm_for_each_vcpu(i, vcpu, kvm)
++ kvm_vcpu_kick(vcpu);
+ }
+
+ int kvm_arch_prepare_memory_region(struct kvm *kvm,
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 9cd231a27328..c1341c86bcde 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -426,11 +426,12 @@ static int lo_fallocate(struct loop_device *lo, struct request *rq, loff_t pos,
+ * information.
+ */
+ struct file *file = lo->lo_backing_file;
++ struct request_queue *q = lo->lo_queue;
+ int ret;
+
+ mode |= FALLOC_FL_KEEP_SIZE;
+
+- if ((!file->f_op->fallocate) || lo->lo_encrypt_key_size) {
++ if (!blk_queue_discard(q)) {
+ ret = -EOPNOTSUPP;
+ goto out;
+ }
+@@ -864,28 +865,47 @@ static void loop_config_discard(struct loop_device *lo)
+ struct inode *inode = file->f_mapping->host;
+ struct request_queue *q = lo->lo_queue;
+
++ /*
++ * If the backing device is a block device, mirror its zeroing
++ * capability. Set the discard sectors to the block device's zeroing
++ * capabilities because loop discards result in blkdev_issue_zeroout(),
++ * not blkdev_issue_discard(). This maintains consistent behavior with
++ * file-backed loop devices: discarded regions read back as zero.
++ */
++ if (S_ISBLK(inode->i_mode) && !lo->lo_encrypt_key_size) {
++ struct request_queue *backingq;
++
++ backingq = bdev_get_queue(inode->i_bdev);
++ blk_queue_max_discard_sectors(q,
++ backingq->limits.max_write_zeroes_sectors);
++
++ blk_queue_max_write_zeroes_sectors(q,
++ backingq->limits.max_write_zeroes_sectors);
++
+ /*
+ * We use punch hole to reclaim the free space used by the
+ * image a.k.a. discard. However we do not support discard if
+ * encryption is enabled, because it may give an attacker
+ * useful information.
+ */
+- if ((!file->f_op->fallocate) ||
+- lo->lo_encrypt_key_size) {
++ } else if (!file->f_op->fallocate || lo->lo_encrypt_key_size) {
+ q->limits.discard_granularity = 0;
+ q->limits.discard_alignment = 0;
+ blk_queue_max_discard_sectors(q, 0);
+ blk_queue_max_write_zeroes_sectors(q, 0);
+- blk_queue_flag_clear(QUEUE_FLAG_DISCARD, q);
+- return;
+- }
+
+- q->limits.discard_granularity = inode->i_sb->s_blocksize;
+- q->limits.discard_alignment = 0;
++ } else {
++ q->limits.discard_granularity = inode->i_sb->s_blocksize;
++ q->limits.discard_alignment = 0;
+
+- blk_queue_max_discard_sectors(q, UINT_MAX >> 9);
+- blk_queue_max_write_zeroes_sectors(q, UINT_MAX >> 9);
+- blk_queue_flag_set(QUEUE_FLAG_DISCARD, q);
++ blk_queue_max_discard_sectors(q, UINT_MAX >> 9);
++ blk_queue_max_write_zeroes_sectors(q, UINT_MAX >> 9);
++ }
++
++ if (q->limits.max_write_zeroes_sectors)
++ blk_queue_flag_set(QUEUE_FLAG_DISCARD, q);
++ else
++ blk_queue_flag_clear(QUEUE_FLAG_DISCARD, q);
+ }
+
+ static void loop_unprepare_queue(struct loop_device *lo)
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 728c9a9609f0..9a3c2b14ac37 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -277,9 +277,14 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx,
+ if (err == -ENOSPC)
+ blk_mq_stop_hw_queue(hctx);
+ spin_unlock_irqrestore(&vblk->vqs[qid].lock, flags);
+- if (err == -ENOMEM || err == -ENOSPC)
++ switch (err) {
++ case -ENOSPC:
+ return BLK_STS_DEV_RESOURCE;
+- return BLK_STS_IOERR;
++ case -ENOMEM:
++ return BLK_STS_RESOURCE;
++ default:
++ return BLK_STS_IOERR;
++ }
+ }
+
+ if (bd->last && virtqueue_kick_prepare(vblk->vqs[qid].vq))
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index 77e47dc5aacc..569e93e1f06c 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (C) 2012 IBM Corporation
++ * Copyright (C) 2012-2020 IBM Corporation
+ *
+ * Author: Ashley Lai <ashleydlai@gmail.com>
+ *
+@@ -140,6 +140,64 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+ return len;
+ }
+
++/**
++ * ibmvtpm_crq_send_init - Send a CRQ initialize message
++ * @ibmvtpm: vtpm device struct
++ *
++ * Return:
++ * 0 on success.
++ * Non-zero on failure.
++ */
++static int ibmvtpm_crq_send_init(struct ibmvtpm_dev *ibmvtpm)
++{
++ int rc;
++
++ rc = ibmvtpm_send_crq_word(ibmvtpm->vdev, INIT_CRQ_CMD);
++ if (rc != H_SUCCESS)
++ dev_err(ibmvtpm->dev,
++ "%s failed rc=%d\n", __func__, rc);
++
++ return rc;
++}
++
++/**
++ * tpm_ibmvtpm_resume - Resume from suspend
++ *
++ * @dev: device struct
++ *
++ * Return: Always 0.
++ */
++static int tpm_ibmvtpm_resume(struct device *dev)
++{
++ struct tpm_chip *chip = dev_get_drvdata(dev);
++ struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
++ int rc = 0;
++
++ do {
++ if (rc)
++ msleep(100);
++ rc = plpar_hcall_norets(H_ENABLE_CRQ,
++ ibmvtpm->vdev->unit_address);
++ } while (rc == H_IN_PROGRESS || rc == H_BUSY || H_IS_LONG_BUSY(rc));
++
++ if (rc) {
++ dev_err(dev, "Error enabling ibmvtpm rc=%d\n", rc);
++ return rc;
++ }
++
++ rc = vio_enable_interrupts(ibmvtpm->vdev);
++ if (rc) {
++ dev_err(dev, "Error vio_enable_interrupts rc=%d\n", rc);
++ return rc;
++ }
++
++ rc = ibmvtpm_crq_send_init(ibmvtpm);
++ if (rc)
++ dev_err(dev, "Error send_init rc=%d\n", rc);
++
++ return rc;
++}
++
+ /**
+ * tpm_ibmvtpm_send() - Send a TPM command
+ * @chip: tpm chip struct
+@@ -153,6 +211,7 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ {
+ struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
++ bool retry = true;
+ int rc, sig;
+
+ if (!ibmvtpm->rtce_buf) {
+@@ -186,18 +245,27 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ */
+ ibmvtpm->tpm_processing_cmd = true;
+
++again:
+ rc = ibmvtpm_send_crq(ibmvtpm->vdev,
+ IBMVTPM_VALID_CMD, VTPM_TPM_COMMAND,
+ count, ibmvtpm->rtce_dma_handle);
+ if (rc != H_SUCCESS) {
++ /*
++ * H_CLOSED can be returned after LPM resume. Call
++ * tpm_ibmvtpm_resume() to re-enable the CRQ then retry
++ * ibmvtpm_send_crq() once before failing.
++ */
++ if (rc == H_CLOSED && retry) {
++ tpm_ibmvtpm_resume(ibmvtpm->dev);
++ retry = false;
++ goto again;
++ }
+ dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
+- rc = 0;
+ ibmvtpm->tpm_processing_cmd = false;
+- } else
+- rc = 0;
++ }
+
+ spin_unlock(&ibmvtpm->rtce_lock);
+- return rc;
++ return 0;
+ }
+
+ static void tpm_ibmvtpm_cancel(struct tpm_chip *chip)
+@@ -275,26 +343,6 @@ static int ibmvtpm_crq_send_init_complete(struct ibmvtpm_dev *ibmvtpm)
+ return rc;
+ }
+
+-/**
+- * ibmvtpm_crq_send_init - Send a CRQ initialize message
+- * @ibmvtpm: vtpm device struct
+- *
+- * Return:
+- * 0 on success.
+- * Non-zero on failure.
+- */
+-static int ibmvtpm_crq_send_init(struct ibmvtpm_dev *ibmvtpm)
+-{
+- int rc;
+-
+- rc = ibmvtpm_send_crq_word(ibmvtpm->vdev, INIT_CRQ_CMD);
+- if (rc != H_SUCCESS)
+- dev_err(ibmvtpm->dev,
+- "ibmvtpm_crq_send_init failed rc=%d\n", rc);
+-
+- return rc;
+-}
+-
+ /**
+ * tpm_ibmvtpm_remove - ibm vtpm remove entry point
+ * @vdev: vio device struct
+@@ -407,44 +455,6 @@ static int ibmvtpm_reset_crq(struct ibmvtpm_dev *ibmvtpm)
+ ibmvtpm->crq_dma_handle, CRQ_RES_BUF_SIZE);
+ }
+
+-/**
+- * tpm_ibmvtpm_resume - Resume from suspend
+- *
+- * @dev: device struct
+- *
+- * Return: Always 0.
+- */
+-static int tpm_ibmvtpm_resume(struct device *dev)
+-{
+- struct tpm_chip *chip = dev_get_drvdata(dev);
+- struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
+- int rc = 0;
+-
+- do {
+- if (rc)
+- msleep(100);
+- rc = plpar_hcall_norets(H_ENABLE_CRQ,
+- ibmvtpm->vdev->unit_address);
+- } while (rc == H_IN_PROGRESS || rc == H_BUSY || H_IS_LONG_BUSY(rc));
+-
+- if (rc) {
+- dev_err(dev, "Error enabling ibmvtpm rc=%d\n", rc);
+- return rc;
+- }
+-
+- rc = vio_enable_interrupts(ibmvtpm->vdev);
+- if (rc) {
+- dev_err(dev, "Error vio_enable_interrupts rc=%d\n", rc);
+- return rc;
+- }
+-
+- rc = ibmvtpm_crq_send_init(ibmvtpm);
+- if (rc)
+- dev_err(dev, "Error send_init rc=%d\n", rc);
+-
+- return rc;
+-}
+-
+ static bool tpm_ibmvtpm_req_canceled(struct tpm_chip *chip, u8 status)
+ {
+ return (status == 0);
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 0eaea3a7b8f4..5d8f8f018984 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -437,6 +437,9 @@ static void disable_interrupts(struct tpm_chip *chip)
+ u32 intmask;
+ int rc;
+
++ if (priv->irq == 0)
++ return;
++
+ rc = tpm_tis_read32(priv, TPM_INT_ENABLE(priv->locality), &intmask);
+ if (rc < 0)
+ intmask = 0;
+@@ -984,9 +987,12 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ if (irq) {
+ tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED,
+ irq);
+- if (!(chip->flags & TPM_CHIP_FLAG_IRQ))
++ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+ dev_err(&chip->dev, FW_BUG
+ "TPM interrupt not working, polling instead\n");
++
++ disable_interrupts(chip);
++ }
+ } else {
+ tpm_tis_probe_irq(chip, intmask);
+ }
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index 5c5c504dacb6..b0c592073a4a 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -37,11 +37,11 @@
+ * Null hashes to align with hw behavior on imx6sl and ull
+ * these are flipped for consistency with hw output
+ */
+-const uint8_t sha1_null_hash[] =
++static const uint8_t sha1_null_hash[] =
+ "\x09\x07\xd8\xaf\x90\x18\x60\x95\xef\xbf"
+ "\x55\x32\x0d\x4b\x6b\x5e\xee\xa3\x39\xda";
+
+-const uint8_t sha256_null_hash[] =
++static const uint8_t sha256_null_hash[] =
+ "\x55\xb8\x52\x78\x1b\x99\x95\xa4"
+ "\x4c\x93\x9b\x64\xe4\x41\xae\x27"
+ "\x24\xb9\x6f\x99\xc8\xf4\xfb\x9a"
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 2b2efe443c36..b64ad9e1f0c3 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -996,6 +996,26 @@ bool dc_commit_state(struct dc *dc, struct dc_state *context)
+ return (result == DC_OK);
+ }
+
++static bool is_flip_pending_in_pipes(struct dc *dc, struct dc_state *context)
++{
++ int i;
++ struct pipe_ctx *pipe;
++
++ for (i = 0; i < MAX_PIPES; i++) {
++ pipe = &context->res_ctx.pipe_ctx[i];
++
++ if (!pipe->plane_state)
++ continue;
++
++ /* Must set to false to start with, due to OR in update function */
++ pipe->plane_state->status.is_flip_pending = false;
++ dc->hwss.update_pending_status(pipe);
++ if (pipe->plane_state->status.is_flip_pending)
++ return true;
++ }
++ return false;
++}
++
+ bool dc_post_update_surfaces_to_stream(struct dc *dc)
+ {
+ int i;
+@@ -1003,6 +1023,9 @@ bool dc_post_update_surfaces_to_stream(struct dc *dc)
+
+ post_surface_trace(dc);
+
++ if (is_flip_pending_in_pipes(dc, context))
++ return true;
++
+ for (i = 0; i < dc->res_pool->pipe_count; i++)
+ if (context->res_ctx.pipe_ctx[i].stream == NULL ||
+ context->res_ctx.pipe_ctx[i].plane_state == NULL) {
+diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
+index e53b7cb2211d..7c0b30c955c3 100644
+--- a/drivers/gpu/drm/msm/msm_gem.c
++++ b/drivers/gpu/drm/msm/msm_gem.c
+@@ -61,7 +61,7 @@ static void sync_for_device(struct msm_gem_object *msm_obj)
+ {
+ struct device *dev = msm_obj->base.dev->dev;
+
+- if (get_dma_ops(dev)) {
++ if (get_dma_ops(dev) && IS_ENABLED(CONFIG_ARM64)) {
+ dma_sync_sg_for_device(dev, msm_obj->sgt->sgl,
+ msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
+ } else {
+@@ -74,7 +74,7 @@ static void sync_for_cpu(struct msm_gem_object *msm_obj)
+ {
+ struct device *dev = msm_obj->base.dev->dev;
+
+- if (get_dma_ops(dev)) {
++ if (get_dma_ops(dev) && IS_ENABLED(CONFIG_ARM64)) {
+ dma_sync_sg_for_cpu(dev, msm_obj->sgt->sgl,
+ msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
+ } else {
+diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
+index 0409dcf5b047..24d5d049567a 100644
+--- a/drivers/iio/adc/stm32-adc.c
++++ b/drivers/iio/adc/stm32-adc.c
+@@ -1308,8 +1308,30 @@ static unsigned int stm32_adc_dma_residue(struct stm32_adc *adc)
+ static void stm32_adc_dma_buffer_done(void *data)
+ {
+ struct iio_dev *indio_dev = data;
++ struct stm32_adc *adc = iio_priv(indio_dev);
++ int residue = stm32_adc_dma_residue(adc);
++
++ /*
++ * In DMA mode the trigger services of IIO are not used
++ * (e.g. no call to iio_trigger_poll).
++ * Calling irq handler associated to the hardware trigger is not
++ * relevant as the conversions have already been done. Data
++ * transfers are performed directly in DMA callback instead.
++ * This implementation avoids to call trigger irq handler that
++ * may sleep, in an atomic context (DMA irq handler context).
++ */
++ dev_dbg(&indio_dev->dev, "%s bufi=%d\n", __func__, adc->bufi);
+
+- iio_trigger_poll_chained(indio_dev->trig);
++ while (residue >= indio_dev->scan_bytes) {
++ u16 *buffer = (u16 *)&adc->rx_buf[adc->bufi];
++
++ iio_push_to_buffers(indio_dev, buffer);
++
++ residue -= indio_dev->scan_bytes;
++ adc->bufi += indio_dev->scan_bytes;
++ if (adc->bufi >= adc->rx_buf_sz)
++ adc->bufi = 0;
++ }
+ }
+
+ static int stm32_adc_dma_start(struct iio_dev *indio_dev)
+@@ -1703,6 +1725,7 @@ static int stm32_adc_probe(struct platform_device *pdev)
+ {
+ struct iio_dev *indio_dev;
+ struct device *dev = &pdev->dev;
++ irqreturn_t (*handler)(int irq, void *p) = NULL;
+ struct stm32_adc *adc;
+ int ret;
+
+@@ -1785,9 +1808,11 @@ static int stm32_adc_probe(struct platform_device *pdev)
+ if (ret < 0)
+ goto err_clk_disable;
+
++ if (!adc->dma_chan)
++ handler = &stm32_adc_trigger_handler;
++
+ ret = iio_triggered_buffer_setup(indio_dev,
+- &iio_pollfunc_store_time,
+- &stm32_adc_trigger_handler,
++ &iio_pollfunc_store_time, handler,
+ &stm32_adc_buffer_setup_ops);
+ if (ret) {
+ dev_err(&pdev->dev, "buffer setup failed\n");
+diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
+index 1ae86e7359f7..1b0046cc717b 100644
+--- a/drivers/iio/adc/xilinx-xadc-core.c
++++ b/drivers/iio/adc/xilinx-xadc-core.c
+@@ -103,6 +103,16 @@ static const unsigned int XADC_ZYNQ_UNMASK_TIMEOUT = 500;
+
+ #define XADC_FLAGS_BUFFERED BIT(0)
+
++/*
++ * The XADC hardware supports a samplerate of up to 1MSPS. Unfortunately it does
++ * not have a hardware FIFO. Which means an interrupt is generated for each
++ * conversion sequence. At 1MSPS sample rate the CPU in ZYNQ7000 is completely
++ * overloaded by the interrupts that it soft-lockups. For this reason the driver
++ * limits the maximum samplerate 150kSPS. At this rate the CPU is fairly busy,
++ * but still responsive.
++ */
++#define XADC_MAX_SAMPLERATE 150000
++
+ static void xadc_write_reg(struct xadc *xadc, unsigned int reg,
+ uint32_t val)
+ {
+@@ -675,7 +685,7 @@ static int xadc_trigger_set_state(struct iio_trigger *trigger, bool state)
+
+ spin_lock_irqsave(&xadc->lock, flags);
+ xadc_read_reg(xadc, XADC_AXI_REG_IPIER, &val);
+- xadc_write_reg(xadc, XADC_AXI_REG_IPISR, val & XADC_AXI_INT_EOS);
++ xadc_write_reg(xadc, XADC_AXI_REG_IPISR, XADC_AXI_INT_EOS);
+ if (state)
+ val |= XADC_AXI_INT_EOS;
+ else
+@@ -723,13 +733,14 @@ static int xadc_power_adc_b(struct xadc *xadc, unsigned int seq_mode)
+ {
+ uint16_t val;
+
++ /* Powerdown the ADC-B when it is not needed. */
+ switch (seq_mode) {
+ case XADC_CONF1_SEQ_SIMULTANEOUS:
+ case XADC_CONF1_SEQ_INDEPENDENT:
+- val = XADC_CONF2_PD_ADC_B;
++ val = 0;
+ break;
+ default:
+- val = 0;
++ val = XADC_CONF2_PD_ADC_B;
+ break;
+ }
+
+@@ -798,6 +809,16 @@ static int xadc_preenable(struct iio_dev *indio_dev)
+ if (ret)
+ goto err;
+
++ /*
++ * In simultaneous mode the upper and lower aux channels are samples at
++ * the same time. In this mode the upper 8 bits in the sequencer
++ * register are don't care and the lower 8 bits control two channels
++ * each. As such we must set the bit if either the channel in the lower
++ * group or the upper group is enabled.
++ */
++ if (seq_mode == XADC_CONF1_SEQ_SIMULTANEOUS)
++ scan_mask = ((scan_mask >> 8) | scan_mask) & 0xff0000;
++
+ ret = xadc_write_adc_reg(xadc, XADC_REG_SEQ(1), scan_mask >> 16);
+ if (ret)
+ goto err;
+@@ -824,11 +845,27 @@ static const struct iio_buffer_setup_ops xadc_buffer_ops = {
+ .postdisable = &xadc_postdisable,
+ };
+
++static int xadc_read_samplerate(struct xadc *xadc)
++{
++ unsigned int div;
++ uint16_t val16;
++ int ret;
++
++ ret = xadc_read_adc_reg(xadc, XADC_REG_CONF2, &val16);
++ if (ret)
++ return ret;
++
++ div = (val16 & XADC_CONF2_DIV_MASK) >> XADC_CONF2_DIV_OFFSET;
++ if (div < 2)
++ div = 2;
++
++ return xadc_get_dclk_rate(xadc) / div / 26;
++}
++
+ static int xadc_read_raw(struct iio_dev *indio_dev,
+ struct iio_chan_spec const *chan, int *val, int *val2, long info)
+ {
+ struct xadc *xadc = iio_priv(indio_dev);
+- unsigned int div;
+ uint16_t val16;
+ int ret;
+
+@@ -881,41 +918,31 @@ static int xadc_read_raw(struct iio_dev *indio_dev,
+ *val = -((273150 << 12) / 503975);
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_SAMP_FREQ:
+- ret = xadc_read_adc_reg(xadc, XADC_REG_CONF2, &val16);
+- if (ret)
++ ret = xadc_read_samplerate(xadc);
++ if (ret < 0)
+ return ret;
+
+- div = (val16 & XADC_CONF2_DIV_MASK) >> XADC_CONF2_DIV_OFFSET;
+- if (div < 2)
+- div = 2;
+-
+- *val = xadc_get_dclk_rate(xadc) / div / 26;
+-
++ *val = ret;
+ return IIO_VAL_INT;
+ default:
+ return -EINVAL;
+ }
+ }
+
+-static int xadc_write_raw(struct iio_dev *indio_dev,
+- struct iio_chan_spec const *chan, int val, int val2, long info)
++static int xadc_write_samplerate(struct xadc *xadc, int val)
+ {
+- struct xadc *xadc = iio_priv(indio_dev);
+ unsigned long clk_rate = xadc_get_dclk_rate(xadc);
+ unsigned int div;
+
+ if (!clk_rate)
+ return -EINVAL;
+
+- if (info != IIO_CHAN_INFO_SAMP_FREQ)
+- return -EINVAL;
+-
+ if (val <= 0)
+ return -EINVAL;
+
+ /* Max. 150 kSPS */
+- if (val > 150000)
+- val = 150000;
++ if (val > XADC_MAX_SAMPLERATE)
++ val = XADC_MAX_SAMPLERATE;
+
+ val *= 26;
+
+@@ -928,7 +955,7 @@ static int xadc_write_raw(struct iio_dev *indio_dev,
+ * limit.
+ */
+ div = clk_rate / val;
+- if (clk_rate / div / 26 > 150000)
++ if (clk_rate / div / 26 > XADC_MAX_SAMPLERATE)
+ div++;
+ if (div < 2)
+ div = 2;
+@@ -939,6 +966,17 @@ static int xadc_write_raw(struct iio_dev *indio_dev,
+ div << XADC_CONF2_DIV_OFFSET);
+ }
+
++static int xadc_write_raw(struct iio_dev *indio_dev,
++ struct iio_chan_spec const *chan, int val, int val2, long info)
++{
++ struct xadc *xadc = iio_priv(indio_dev);
++
++ if (info != IIO_CHAN_INFO_SAMP_FREQ)
++ return -EINVAL;
++
++ return xadc_write_samplerate(xadc, val);
++}
++
+ static const struct iio_event_spec xadc_temp_events[] = {
+ {
+ .type = IIO_EV_TYPE_THRESH,
+@@ -1226,6 +1264,21 @@ static int xadc_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_free_samplerate_trigger;
+
++ /*
++ * Make sure not to exceed the maximum samplerate since otherwise the
++ * resulting interrupt storm will soft-lock the system.
++ */
++ if (xadc->ops->flags & XADC_FLAGS_BUFFERED) {
++ ret = xadc_read_samplerate(xadc);
++ if (ret < 0)
++ goto err_free_samplerate_trigger;
++ if (ret > XADC_MAX_SAMPLERATE) {
++ ret = xadc_write_samplerate(xadc, XADC_MAX_SAMPLERATE);
++ if (ret < 0)
++ goto err_free_samplerate_trigger;
++ }
++ }
++
+ ret = request_irq(xadc->irq, xadc->ops->interrupt_handler, 0,
+ dev_name(&pdev->dev), indio_dev);
+ if (ret)
+diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
+index 26fbd1bd9413..09279e40c55c 100644
+--- a/drivers/iio/common/st_sensors/st_sensors_core.c
++++ b/drivers/iio/common/st_sensors/st_sensors_core.c
+@@ -93,7 +93,7 @@ int st_sensors_set_odr(struct iio_dev *indio_dev, unsigned int odr)
+ struct st_sensor_odr_avl odr_out = {0, 0};
+ struct st_sensor_data *sdata = iio_priv(indio_dev);
+
+- if (!sdata->sensor_settings->odr.addr)
++ if (!sdata->sensor_settings->odr.mask)
+ return 0;
+
+ err = st_sensors_match_odr(sdata->sensor_settings, odr, &odr_out);
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index 6e96a2fb97dc..df8f5ceea2dd 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -408,16 +408,15 @@ static int addr6_resolve(struct sockaddr_in6 *src_in,
+ struct flowi6 fl6;
+ struct dst_entry *dst;
+ struct rt6_info *rt;
+- int ret;
+
+ memset(&fl6, 0, sizeof fl6);
+ fl6.daddr = dst_in->sin6_addr;
+ fl6.saddr = src_in->sin6_addr;
+ fl6.flowi6_oif = addr->bound_dev_if;
+
+- ret = ipv6_stub->ipv6_dst_lookup(addr->net, NULL, &dst, &fl6);
+- if (ret < 0)
+- return ret;
++ dst = ipv6_stub->ipv6_dst_lookup_flow(addr->net, NULL, &fl6, NULL);
++ if (IS_ERR(dst))
++ return PTR_ERR(dst);
+
+ rt = (struct rt6_info *)dst;
+ if (ipv6_addr_any(&src_in->sin6_addr)) {
+diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
+index 54add70c22b5..7903bd5c639e 100644
+--- a/drivers/infiniband/sw/rxe/rxe_net.c
++++ b/drivers/infiniband/sw/rxe/rxe_net.c
+@@ -154,10 +154,12 @@ static struct dst_entry *rxe_find_route6(struct net_device *ndev,
+ memcpy(&fl6.daddr, daddr, sizeof(*daddr));
+ fl6.flowi6_proto = IPPROTO_UDP;
+
+- if (unlikely(ipv6_stub->ipv6_dst_lookup(sock_net(recv_sockets.sk6->sk),
+- recv_sockets.sk6->sk, &ndst, &fl6))) {
++ ndst = ipv6_stub->ipv6_dst_lookup_flow(sock_net(recv_sockets.sk6->sk),
++ recv_sockets.sk6->sk, &fl6,
++ NULL);
++ if (unlikely(IS_ERR(ndst))) {
+ pr_err_ratelimited("no route to %pI6\n", daddr);
+- goto put;
++ return NULL;
+ }
+
+ if (unlikely(ndst->error)) {
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index ac5d945b934a..11f3993ab7f3 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1253,6 +1253,10 @@ static int b53_arl_rw_op(struct b53_device *dev, unsigned int op)
+ reg |= ARLTBL_RW;
+ else
+ reg &= ~ARLTBL_RW;
++ if (dev->vlan_enabled)
++ reg &= ~ARLTBL_IVL_SVL_SELECT;
++ else
++ reg |= ARLTBL_IVL_SVL_SELECT;
+ b53_write8(dev, B53_ARLIO_PAGE, B53_ARLTBL_RW_CTRL, reg);
+
+ return b53_arl_op_wait(dev);
+@@ -1262,6 +1266,7 @@ static int b53_arl_read(struct b53_device *dev, u64 mac,
+ u16 vid, struct b53_arl_entry *ent, u8 *idx,
+ bool is_valid)
+ {
++ DECLARE_BITMAP(free_bins, B53_ARLTBL_MAX_BIN_ENTRIES);
+ unsigned int i;
+ int ret;
+
+@@ -1269,6 +1274,8 @@ static int b53_arl_read(struct b53_device *dev, u64 mac,
+ if (ret)
+ return ret;
+
++ bitmap_zero(free_bins, dev->num_arl_entries);
++
+ /* Read the bins */
+ for (i = 0; i < dev->num_arl_entries; i++) {
+ u64 mac_vid;
+@@ -1280,13 +1287,24 @@ static int b53_arl_read(struct b53_device *dev, u64 mac,
+ B53_ARLTBL_DATA_ENTRY(i), &fwd_entry);
+ b53_arl_to_entry(ent, mac_vid, fwd_entry);
+
+- if (!(fwd_entry & ARLTBL_VALID))
++ if (!(fwd_entry & ARLTBL_VALID)) {
++ set_bit(i, free_bins);
+ continue;
++ }
+ if ((mac_vid & ARLTBL_MAC_MASK) != mac)
+ continue;
++ if (dev->vlan_enabled &&
++ ((mac_vid >> ARLTBL_VID_S) & ARLTBL_VID_MASK) != vid)
++ continue;
+ *idx = i;
++ return 0;
+ }
+
++ if (bitmap_weight(free_bins, dev->num_arl_entries) == 0)
++ return -ENOSPC;
++
++ *idx = find_first_bit(free_bins, dev->num_arl_entries);
++
+ return -ENOENT;
+ }
+
+@@ -1316,10 +1334,21 @@ static int b53_arl_op(struct b53_device *dev, int op, int port,
+ if (op)
+ return ret;
+
+- /* We could not find a matching MAC, so reset to a new entry */
+- if (ret) {
++ switch (ret) {
++ case -ENOSPC:
++ dev_dbg(dev->dev, "{%pM,%.4d} no space left in ARL\n",
++ addr, vid);
++ return is_valid ? ret : 0;
++ case -ENOENT:
++ /* We could not find a matching MAC, so reset to a new entry */
++ dev_dbg(dev->dev, "{%pM,%.4d} not found, using idx: %d\n",
++ addr, vid, idx);
+ fwd_entry = 0;
+- idx = 1;
++ break;
++ default:
++ dev_dbg(dev->dev, "{%pM,%.4d} found, using idx: %d\n",
++ addr, vid, idx);
++ break;
+ }
+
+ memset(&ent, 0, sizeof(ent));
+diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
+index 2a9f421680aa..c90985c294a2 100644
+--- a/drivers/net/dsa/b53/b53_regs.h
++++ b/drivers/net/dsa/b53/b53_regs.h
+@@ -292,6 +292,7 @@
+ /* ARL Table Read/Write Register (8 bit) */
+ #define B53_ARLTBL_RW_CTRL 0x00
+ #define ARLTBL_RW BIT(0)
++#define ARLTBL_IVL_SVL_SELECT BIT(6)
+ #define ARLTBL_START_DONE BIT(7)
+
+ /* MAC Address Index Register (48 bit) */
+@@ -304,7 +305,7 @@
+ *
+ * BCM5325 and BCM5365 share most definitions below
+ */
+-#define B53_ARLTBL_MAC_VID_ENTRY(n) (0x10 * (n))
++#define B53_ARLTBL_MAC_VID_ENTRY(n) ((0x10 * (n)) + 0x10)
+ #define ARLTBL_MAC_MASK 0xffffffffffffULL
+ #define ARLTBL_VID_S 48
+ #define ARLTBL_VID_MASK_25 0xff
+@@ -316,13 +317,16 @@
+ #define ARLTBL_VALID_25 BIT(63)
+
+ /* ARL Table Data Entry N Registers (32 bit) */
+-#define B53_ARLTBL_DATA_ENTRY(n) ((0x10 * (n)) + 0x08)
++#define B53_ARLTBL_DATA_ENTRY(n) ((0x10 * (n)) + 0x18)
+ #define ARLTBL_DATA_PORT_ID_MASK 0x1ff
+ #define ARLTBL_TC(tc) ((3 & tc) << 11)
+ #define ARLTBL_AGE BIT(14)
+ #define ARLTBL_STATIC BIT(15)
+ #define ARLTBL_VALID BIT(16)
+
++/* Maximum number of bin entries in the ARL for all switches */
++#define B53_ARLTBL_MAX_BIN_ENTRIES 4
++
+ /* ARL Search Control Register (8 bit) */
+ #define B53_ARL_SRCH_CTL 0x50
+ #define B53_ARL_SRCH_CTL_25 0x20
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 736a6a5fbd98..789c206b515e 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -998,6 +998,8 @@ static void bcmgenet_get_ethtool_stats(struct net_device *dev,
+ if (netif_running(dev))
+ bcmgenet_update_mib_counters(priv);
+
++ dev->netdev_ops->ndo_get_stats(dev);
++
+ for (i = 0; i < BCMGENET_STATS_LEN; i++) {
+ const struct bcmgenet_stats *s;
+ char *p;
+@@ -3211,6 +3213,7 @@ static struct net_device_stats *bcmgenet_get_stats(struct net_device *dev)
+ dev->stats.rx_packets = rx_packets;
+ dev->stats.rx_errors = rx_errors;
+ dev->stats.rx_missed_errors = rx_errors;
++ dev->stats.rx_dropped = rx_dropped;
+ return &dev->stats;
+ }
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+index b766362031c3..5bc58429bb1c 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+@@ -1065,9 +1065,9 @@ static void cudbg_t4_fwcache(struct cudbg_init *pdbg_init,
+ }
+ }
+
+-static unsigned long cudbg_mem_region_size(struct cudbg_init *pdbg_init,
+- struct cudbg_error *cudbg_err,
+- u8 mem_type)
++static int cudbg_mem_region_size(struct cudbg_init *pdbg_init,
++ struct cudbg_error *cudbg_err,
++ u8 mem_type, unsigned long *region_size)
+ {
+ struct adapter *padap = pdbg_init->adap;
+ struct cudbg_meminfo mem_info;
+@@ -1076,15 +1076,23 @@ static unsigned long cudbg_mem_region_size(struct cudbg_init *pdbg_init,
+
+ memset(&mem_info, 0, sizeof(struct cudbg_meminfo));
+ rc = cudbg_fill_meminfo(padap, &mem_info);
+- if (rc)
++ if (rc) {
++ cudbg_err->sys_err = rc;
+ return rc;
++ }
+
+ cudbg_t4_fwcache(pdbg_init, cudbg_err);
+ rc = cudbg_meminfo_get_mem_index(padap, &mem_info, mem_type, &mc_idx);
+- if (rc)
++ if (rc) {
++ cudbg_err->sys_err = rc;
+ return rc;
++ }
++
++ if (region_size)
++ *region_size = mem_info.avail[mc_idx].limit -
++ mem_info.avail[mc_idx].base;
+
+- return mem_info.avail[mc_idx].limit - mem_info.avail[mc_idx].base;
++ return 0;
+ }
+
+ static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init,
+@@ -1092,7 +1100,12 @@ static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init,
+ struct cudbg_error *cudbg_err,
+ u8 mem_type)
+ {
+- unsigned long size = cudbg_mem_region_size(pdbg_init, cudbg_err, mem_type);
++ unsigned long size = 0;
++ int rc;
++
++ rc = cudbg_mem_region_size(pdbg_init, cudbg_err, mem_type, &size);
++ if (rc)
++ return rc;
+
+ return cudbg_read_fw_mem(pdbg_init, dbg_buff, mem_type, size,
+ cudbg_err);
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
+index 758f2b836328..ff7e58a8c90f 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
+@@ -311,32 +311,17 @@ static int cxgb4_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
+ */
+ static int cxgb4_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
+ {
+- struct adapter *adapter = (struct adapter *)container_of(ptp,
+- struct adapter, ptp_clock_info);
+- struct fw_ptp_cmd c;
++ struct adapter *adapter = container_of(ptp, struct adapter,
++ ptp_clock_info);
+ u64 ns;
+- int err;
+-
+- memset(&c, 0, sizeof(c));
+- c.op_to_portid = cpu_to_be32(FW_CMD_OP_V(FW_PTP_CMD) |
+- FW_CMD_REQUEST_F |
+- FW_CMD_READ_F |
+- FW_PTP_CMD_PORTID_V(0));
+- c.retval_len16 = cpu_to_be32(FW_CMD_LEN16_V(sizeof(c) / 16));
+- c.u.ts.sc = FW_PTP_SC_GET_TIME;
+
+- err = t4_wr_mbox(adapter, adapter->mbox, &c, sizeof(c), &c);
+- if (err < 0) {
+- dev_err(adapter->pdev_dev,
+- "PTP: %s error %d\n", __func__, -err);
+- return err;
+- }
++ ns = t4_read_reg(adapter, T5_PORT_REG(0, MAC_PORT_PTP_SUM_LO_A));
++ ns |= (u64)t4_read_reg(adapter,
++ T5_PORT_REG(0, MAC_PORT_PTP_SUM_HI_A)) << 32;
+
+ /* convert to timespec*/
+- ns = be64_to_cpu(c.u.ts.tm);
+ *ts = ns_to_timespec64(ns);
+-
+- return err;
++ return 0;
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+index eb222d40ddbf..a64eb6ac5c76 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+@@ -1896,6 +1896,9 @@
+
+ #define MAC_PORT_CFG2_A 0x818
+
++#define MAC_PORT_PTP_SUM_LO_A 0x990
++#define MAC_PORT_PTP_SUM_HI_A 0x994
++
+ #define MPS_CMN_CTL_A 0x9000
+
+ #define COUNTPAUSEMCRX_S 5
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index c8928ce69185..3050853774ee 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -2217,12 +2217,11 @@ static int mlx5e_route_lookup_ipv6(struct mlx5e_priv *priv,
+ #if IS_ENABLED(CONFIG_INET) && IS_ENABLED(CONFIG_IPV6)
+ struct mlx5e_rep_priv *uplink_rpriv;
+ struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+- int ret;
+
+- ret = ipv6_stub->ipv6_dst_lookup(dev_net(mirred_dev), NULL, &dst,
+- fl6);
+- if (ret < 0)
+- return ret;
++ dst = ipv6_stub->ipv6_dst_lookup_flow(dev_net(mirred_dev), NULL, fl6,
++ NULL);
++ if (IS_ERR(dst))
++ return PTR_ERR(dst);
+
+ if (!(*out_ttl))
+ *out_ttl = ip6_dst_hoplimit(dst);
+@@ -2428,7 +2427,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
+ int max_encap_size = MLX5_CAP_ESW(priv->mdev, max_encap_header_size);
+ int ipv6_encap_size = ETH_HLEN + sizeof(struct ipv6hdr) + VXLAN_HLEN;
+ struct ip_tunnel_key *tun_key = &e->tun_info.key;
+- struct net_device *out_dev;
++ struct net_device *out_dev = NULL;
+ struct neighbour *n = NULL;
+ struct flowi6 fl6 = {};
+ u8 nud_state, tos, ttl;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
+index c51b2adfc1e1..2cbfa5cfefab 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_actions.c
+@@ -316,7 +316,7 @@ struct mlxsw_afa_block *mlxsw_afa_block_create(struct mlxsw_afa *mlxsw_afa)
+
+ block = kzalloc(sizeof(*block), GFP_KERNEL);
+ if (!block)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ INIT_LIST_HEAD(&block->resource_list);
+ block->afa = mlxsw_afa;
+
+@@ -344,7 +344,7 @@ err_second_set_create:
+ mlxsw_afa_set_destroy(block->first_set);
+ err_first_set_create:
+ kfree(block);
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+ EXPORT_SYMBOL(mlxsw_afa_block_create);
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum2_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum2_acl_tcam.c
+index 8ca77f3e8f27..ffd4b055fead 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum2_acl_tcam.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum2_acl_tcam.c
+@@ -88,8 +88,8 @@ static int mlxsw_sp2_acl_tcam_init(struct mlxsw_sp *mlxsw_sp, void *priv,
+ * to be written using PEFA register to all indexes for all regions.
+ */
+ afa_block = mlxsw_afa_block_create(mlxsw_sp->afa);
+- if (!afa_block) {
+- err = -ENOMEM;
++ if (IS_ERR(afa_block)) {
++ err = PTR_ERR(afa_block);
+ goto err_afa_block;
+ }
+ err = mlxsw_afa_block_continue(afa_block);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
+index c4f9238591e6..c99f5542da1e 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c
+@@ -442,7 +442,8 @@ mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl *acl)
+
+ rulei = kzalloc(sizeof(*rulei), GFP_KERNEL);
+ if (!rulei)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
++
+ rulei->act_block = mlxsw_afa_block_create(acl->mlxsw_sp->afa);
+ if (IS_ERR(rulei->act_block)) {
+ err = PTR_ERR(rulei->act_block);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr_tcam.c
+index 346f4a5fe053..221aa6a474eb 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr_tcam.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr_tcam.c
+@@ -199,8 +199,8 @@ mlxsw_sp_mr_tcam_afa_block_create(struct mlxsw_sp *mlxsw_sp,
+ int err;
+
+ afa_block = mlxsw_afa_block_create(mlxsw_sp->afa);
+- if (!afa_block)
+- return ERR_PTR(-ENOMEM);
++ if (IS_ERR(afa_block))
++ return afa_block;
+
+ err = mlxsw_afa_block_append_allocated_counter(afa_block,
+ counter_index);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+index 0a17535f13ae..03bda2e0b7a8 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+@@ -125,6 +125,7 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac)
+ { .div = 5, .val = 5, },
+ { .div = 6, .val = 6, },
+ { .div = 7, .val = 7, },
++ { /* end of array */ }
+ };
+
+ clk_configs = devm_kzalloc(dev, sizeof(*clk_configs), GFP_KERNEL);
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index ff83408733d4..36444de701cd 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -801,7 +801,9 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb,
+ if (dst)
+ return dst;
+ }
+- if (ipv6_stub->ipv6_dst_lookup(geneve->net, gs6->sock->sk, &dst, fl6)) {
++ dst = ipv6_stub->ipv6_dst_lookup_flow(geneve->net, gs6->sock->sk, fl6,
++ NULL);
++ if (IS_ERR(dst)) {
+ netdev_dbg(dev, "no route to %pI6\n", &fl6->daddr);
+ return ERR_PTR(-ENETUNREACH);
+ }
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index df7d6de7c59c..9e2612562981 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -3238,11 +3238,11 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ struct netlink_ext_ack *extack)
+ {
+ struct macsec_dev *macsec = macsec_priv(dev);
++ rx_handler_func_t *rx_handler;
++ u8 icv_len = DEFAULT_ICV_LEN;
+ struct net_device *real_dev;
+- int err;
++ int err, mtu;
+ sci_t sci;
+- u8 icv_len = DEFAULT_ICV_LEN;
+- rx_handler_func_t *rx_handler;
+
+ if (!tb[IFLA_LINK])
+ return -EINVAL;
+@@ -3258,7 +3258,11 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+
+ if (data && data[IFLA_MACSEC_ICV_LEN])
+ icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]);
+- dev->mtu = real_dev->mtu - icv_len - macsec_extra_len(true);
++ mtu = real_dev->mtu - icv_len - macsec_extra_len(true);
++ if (mtu < 0)
++ dev->mtu = 0;
++ else
++ dev->mtu = mtu;
+
+ rx_handler = rtnl_dereference(real_dev->rx_handler);
+ if (rx_handler && rx_handler != macsec_handle_frame)
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index a8f338dc0dfa..225bfc808112 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -1676,7 +1676,7 @@ static int macvlan_device_event(struct notifier_block *unused,
+ struct macvlan_dev,
+ list);
+
+- if (macvlan_sync_address(vlan->dev, dev->dev_addr))
++ if (vlan && macvlan_sync_address(vlan->dev, dev->dev_addr))
+ return NOTIFY_BAD;
+
+ break;
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 95524c06e64c..53d9562a8818 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -475,6 +475,9 @@ static const struct team_mode *team_mode_get(const char *kind)
+ struct team_mode_item *mitem;
+ const struct team_mode *mode = NULL;
+
++ if (!try_module_get(THIS_MODULE))
++ return NULL;
++
+ spin_lock(&mode_list_lock);
+ mitem = __find_mode(kind);
+ if (!mitem) {
+@@ -490,6 +493,7 @@ static const struct team_mode *team_mode_get(const char *kind)
+ }
+
+ spin_unlock(&mode_list_lock);
++ module_put(THIS_MODULE);
+ return mode;
+ }
+
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index 9f895083bc0a..b55eeb8f8fa3 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -192,8 +192,8 @@ static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
+ fl6.flowi6_proto = iph->nexthdr;
+ fl6.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF;
+
+- dst = ip6_route_output(net, NULL, &fl6);
+- if (dst == dst_null)
++ dst = ip6_dst_lookup_flow(net, NULL, &fl6, NULL);
++ if (IS_ERR(dst) || dst == dst_null)
+ goto err;
+
+ skb_dst_drop(skb);
+@@ -478,7 +478,8 @@ static struct sk_buff *vrf_ip6_out(struct net_device *vrf_dev,
+ if (rt6_need_strict(&ipv6_hdr(skb)->daddr))
+ return skb;
+
+- if (qdisc_tx_is_default(vrf_dev))
++ if (qdisc_tx_is_default(vrf_dev) ||
++ IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
+ return vrf_ip6_out_direct(vrf_dev, sk, skb);
+
+ return vrf_ip6_out_redirect(vrf_dev, skb);
+@@ -692,7 +693,8 @@ static struct sk_buff *vrf_ip_out(struct net_device *vrf_dev,
+ ipv4_is_lbcast(ip_hdr(skb)->daddr))
+ return skb;
+
+- if (qdisc_tx_is_default(vrf_dev))
++ if (qdisc_tx_is_default(vrf_dev) ||
++ IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
+ return vrf_ip_out_direct(vrf_dev, sk, skb);
+
+ return vrf_ip_out_redirect(vrf_dev, skb);
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 64751b089482..7ee0bad18466 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -1963,7 +1963,6 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
+ bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
+ struct dst_entry *ndst;
+ struct flowi6 fl6;
+- int err;
+
+ if (!sock6)
+ return ERR_PTR(-EIO);
+@@ -1986,10 +1985,9 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
+ fl6.fl6_dport = dport;
+ fl6.fl6_sport = sport;
+
+- err = ipv6_stub->ipv6_dst_lookup(vxlan->net,
+- sock6->sock->sk,
+- &ndst, &fl6);
+- if (unlikely(err < 0)) {
++ ndst = ipv6_stub->ipv6_dst_lookup_flow(vxlan->net, sock6->sock->sk,
++ &fl6, NULL);
++ if (unlikely(IS_ERR(ndst))) {
+ netdev_dbg(dev, "no route to %pI6\n", daddr);
+ return ERR_PTR(-ENETUNREACH);
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+index e6a67bc02209..bdb87d8e9644 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+@@ -587,6 +587,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
+
+ struct iwl_mvm_stat_data {
+ struct iwl_mvm *mvm;
++ __le32 flags;
+ __le32 mac_id;
+ u8 beacon_filter_average_energy;
+ void *general;
+@@ -630,6 +631,13 @@ static void iwl_mvm_stat_iterator(void *_data, u8 *mac,
+ }
+ }
+
++ /* make sure that beacon statistics don't go backwards with TCM
++ * request to clear statistics
++ */
++ if (le32_to_cpu(data->flags) & IWL_STATISTICS_REPLY_FLG_CLEAR)
++ mvmvif->beacon_stats.accu_num_beacons +=
++ mvmvif->beacon_stats.num_beacons;
++
+ if (mvmvif->id != id)
+ return;
+
+@@ -790,6 +798,7 @@ void iwl_mvm_handle_rx_statistics(struct iwl_mvm *mvm,
+
+ flags = stats->flag;
+ }
++ data.flags = flags;
+
+ iwl_mvm_rx_stats_check_trigger(mvm, pkt);
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+index 7b1dff92b709..93f396d7e684 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+@@ -1231,6 +1231,9 @@ void iwl_trans_pcie_dyn_txq_free(struct iwl_trans *trans, int queue)
+
+ iwl_pcie_gen2_txq_unmap(trans, queue);
+
++ iwl_pcie_gen2_txq_free_memory(trans, trans_pcie->txq[queue]);
++ trans_pcie->txq[queue] = NULL;
++
+ IWL_DEBUG_TX_QUEUES(trans, "Deactivate queue %d\n", queue);
+ }
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index e8bc25aed44c..588864beabd8 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -402,7 +402,7 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
+ if (!nr_nsids)
+ return 0;
+
+- down_write(&ctrl->namespaces_rwsem);
++ down_read(&ctrl->namespaces_rwsem);
+ list_for_each_entry(ns, &ctrl->namespaces, list) {
+ unsigned nsid = le32_to_cpu(desc->nsids[n]);
+
+@@ -413,7 +413,7 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
+ if (++n == nr_nsids)
+ break;
+ }
+- up_write(&ctrl->namespaces_rwsem);
++ up_read(&ctrl->namespaces_rwsem);
+ return 0;
+ }
+
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index af79a7168677..db2efa219028 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -67,6 +67,7 @@ struct pcie_link_state {
+ u32 clkpm_capable:1; /* Clock PM capable? */
+ u32 clkpm_enabled:1; /* Current Clock PM state */
+ u32 clkpm_default:1; /* Default Clock PM state by BIOS */
++ u32 clkpm_disable:1; /* Clock PM disabled */
+
+ /* Exit latencies */
+ struct aspm_latency latency_up; /* Upstream direction exit latency */
+@@ -164,8 +165,11 @@ static void pcie_set_clkpm_nocheck(struct pcie_link_state *link, int enable)
+
+ static void pcie_set_clkpm(struct pcie_link_state *link, int enable)
+ {
+- /* Don't enable Clock PM if the link is not Clock PM capable */
+- if (!link->clkpm_capable)
++ /*
++ * Don't enable Clock PM if the link is not Clock PM capable
++ * or Clock PM is disabled
++ */
++ if (!link->clkpm_capable || link->clkpm_disable)
+ enable = 0;
+ /* Need nothing if the specified equals to current state */
+ if (link->clkpm_enabled == enable)
+@@ -195,7 +199,8 @@ static void pcie_clkpm_cap_init(struct pcie_link_state *link, int blacklist)
+ }
+ link->clkpm_enabled = enabled;
+ link->clkpm_default = enabled;
+- link->clkpm_capable = (blacklist) ? 0 : capable;
++ link->clkpm_capable = capable;
++ link->clkpm_disable = blacklist ? 1 : 0;
+ }
+
+ static bool pcie_retrain_link(struct pcie_link_state *link)
+@@ -1106,10 +1111,9 @@ static void __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem)
+ link->aspm_disable |= ASPM_STATE_L1;
+ pcie_config_aspm_link(link, policy_to_aspm_state(link));
+
+- if (state & PCIE_LINK_STATE_CLKPM) {
+- link->clkpm_capable = 0;
+- pcie_set_clkpm(link, 0);
+- }
++ if (state & PCIE_LINK_STATE_CLKPM)
++ link->clkpm_disable = 1;
++ pcie_set_clkpm(link, policy_to_clkpm_state(link));
+ mutex_unlock(&aspm_lock);
+ if (sem)
+ up_read(&pci_bus_sem);
+diff --git a/drivers/pwm/pwm-bcm2835.c b/drivers/pwm/pwm-bcm2835.c
+index db001cba937f..e340ad79a1ec 100644
+--- a/drivers/pwm/pwm-bcm2835.c
++++ b/drivers/pwm/pwm-bcm2835.c
+@@ -166,6 +166,7 @@ static int bcm2835_pwm_probe(struct platform_device *pdev)
+
+ pc->chip.dev = &pdev->dev;
+ pc->chip.ops = &bcm2835_pwm_ops;
++ pc->chip.base = -1;
+ pc->chip.npwm = 2;
+ pc->chip.of_xlate = of_pwm_xlate_with_flags;
+ pc->chip.of_pwm_n_cells = 3;
+diff --git a/drivers/pwm/pwm-rcar.c b/drivers/pwm/pwm-rcar.c
+index 748f614d5375..b7d71bf297d6 100644
+--- a/drivers/pwm/pwm-rcar.c
++++ b/drivers/pwm/pwm-rcar.c
+@@ -232,24 +232,28 @@ static int rcar_pwm_probe(struct platform_device *pdev)
+ rcar_pwm->chip.base = -1;
+ rcar_pwm->chip.npwm = 1;
+
++ pm_runtime_enable(&pdev->dev);
++
+ ret = pwmchip_add(&rcar_pwm->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to register PWM chip: %d\n", ret);
++ pm_runtime_disable(&pdev->dev);
+ return ret;
+ }
+
+- pm_runtime_enable(&pdev->dev);
+-
+ return 0;
+ }
+
+ static int rcar_pwm_remove(struct platform_device *pdev)
+ {
+ struct rcar_pwm_chip *rcar_pwm = platform_get_drvdata(pdev);
++ int ret;
++
++ ret = pwmchip_remove(&rcar_pwm->chip);
+
+ pm_runtime_disable(&pdev->dev);
+
+- return pwmchip_remove(&rcar_pwm->chip);
++ return ret;
+ }
+
+ static const struct of_device_id rcar_pwm_of_table[] = {
+diff --git a/drivers/pwm/pwm-renesas-tpu.c b/drivers/pwm/pwm-renesas-tpu.c
+index 29267d12fb4c..9c7962f2f0aa 100644
+--- a/drivers/pwm/pwm-renesas-tpu.c
++++ b/drivers/pwm/pwm-renesas-tpu.c
+@@ -423,16 +423,17 @@ static int tpu_probe(struct platform_device *pdev)
+ tpu->chip.base = -1;
+ tpu->chip.npwm = TPU_CHANNEL_MAX;
+
++ pm_runtime_enable(&pdev->dev);
++
+ ret = pwmchip_add(&tpu->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to register PWM chip\n");
++ pm_runtime_disable(&pdev->dev);
+ return ret;
+ }
+
+ dev_info(&pdev->dev, "TPU PWM %d registered\n", tpu->pdev->id);
+
+- pm_runtime_enable(&pdev->dev);
+-
+ return 0;
+ }
+
+@@ -442,12 +443,10 @@ static int tpu_remove(struct platform_device *pdev)
+ int ret;
+
+ ret = pwmchip_remove(&tpu->chip);
+- if (ret)
+- return ret;
+
+ pm_runtime_disable(&pdev->dev);
+
+- return 0;
++ return ret;
+ }
+
+ #ifdef CONFIG_OF
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index 1540229a37bb..c9bc9a6bd73b 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -827,8 +827,10 @@ static void io_subchannel_register(struct ccw_device *cdev)
+ * Now we know this subchannel will stay, we can throw
+ * our delayed uevent.
+ */
+- dev_set_uevent_suppress(&sch->dev, 0);
+- kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
++ if (dev_get_uevent_suppress(&sch->dev)) {
++ dev_set_uevent_suppress(&sch->dev, 0);
++ kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
++ }
+ /* make it known to the system */
+ ret = ccw_device_add(cdev);
+ if (ret) {
+@@ -1036,8 +1038,11 @@ static int io_subchannel_probe(struct subchannel *sch)
+ * Throw the delayed uevent for the subchannel, register
+ * the ccw_device and exit.
+ */
+- dev_set_uevent_suppress(&sch->dev, 0);
+- kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
++ if (dev_get_uevent_suppress(&sch->dev)) {
++ /* should always be the case for the console */
++ dev_set_uevent_suppress(&sch->dev, 0);
++ kobject_uevent(&sch->dev.kobj, KOBJ_ADD);
++ }
+ cdev = sch_get_cdev(sch);
+ rc = ccw_device_add(cdev);
+ if (rc) {
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index f73726e55e44..e3013858937b 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -342,13 +342,15 @@ lpfc_nvme_remoteport_delete(struct nvme_fc_remote_port *remoteport)
+ if (ndlp->upcall_flags & NLP_WAIT_FOR_UNREG) {
+ ndlp->nrport = NULL;
+ ndlp->upcall_flags &= ~NLP_WAIT_FOR_UNREG;
+- }
+- spin_unlock_irq(&vport->phba->hbalock);
++ spin_unlock_irq(&vport->phba->hbalock);
+
+- /* Remove original register reference. The host transport
+- * won't reference this rport/remoteport any further.
+- */
+- lpfc_nlp_put(ndlp);
++ /* Remove original register reference. The host transport
++ * won't reference this rport/remoteport any further.
++ */
++ lpfc_nlp_put(ndlp);
++ } else {
++ spin_unlock_irq(&vport->phba->hbalock);
++ }
+
+ rport_err:
+ return;
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index a801917d3c19..a56a939792ac 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -2472,6 +2472,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
+ !pmb->u.mb.mbxStatus) {
+ rpi = pmb->u.mb.un.varWords[0];
+ vpi = pmb->u.mb.un.varRegLogin.vpi;
++ if (phba->sli_rev == LPFC_SLI_REV4)
++ vpi -= phba->sli4_hba.max_cfg_param.vpi_base;
+ lpfc_unreg_login(phba, vpi, rpi, pmb);
+ pmb->vport = vport;
+ pmb->mbox_cmpl = lpfc_sli_def_mbox_cmpl;
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index c0fb9e789080..04d095488c76 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2010,7 +2010,7 @@ static void __iscsi_unbind_session(struct work_struct *work)
+ if (session->target_id == ISCSI_MAX_TARGET) {
+ spin_unlock_irqrestore(&session->lock, flags);
+ mutex_unlock(&ihost->mutex);
+- return;
++ goto unbind_session_exit;
+ }
+
+ target_id = session->target_id;
+@@ -2022,6 +2022,8 @@ static void __iscsi_unbind_session(struct work_struct *work)
+ ida_simple_remove(&iscsi_sess_ida, target_id);
+
+ scsi_remove_target(&session->dev);
++
++unbind_session_exit:
+ iscsi_session_event(session, ISCSI_KEVENT_UNBIND_SESSION);
+ ISCSI_DBG_TRANS_SESSION(session, "Completed target removal\n");
+ }
+diff --git a/drivers/scsi/smartpqi/smartpqi_sas_transport.c b/drivers/scsi/smartpqi/smartpqi_sas_transport.c
+index b209a35e482e..01dfb97b0778 100644
+--- a/drivers/scsi/smartpqi/smartpqi_sas_transport.c
++++ b/drivers/scsi/smartpqi/smartpqi_sas_transport.c
+@@ -50,9 +50,9 @@ static void pqi_free_sas_phy(struct pqi_sas_phy *pqi_sas_phy)
+ struct sas_phy *phy = pqi_sas_phy->phy;
+
+ sas_port_delete_phy(pqi_sas_phy->parent_port->port, phy);
+- sas_phy_free(phy);
+ if (pqi_sas_phy->added_to_port)
+ list_del(&pqi_sas_phy->phy_list_entry);
++ sas_phy_delete(phy);
+ kfree(pqi_sas_phy);
+ }
+
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index e18b61cdbdeb..636988248da2 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -2594,8 +2594,10 @@ static int comedi_open(struct inode *inode, struct file *file)
+ }
+
+ cfp = kzalloc(sizeof(*cfp), GFP_KERNEL);
+- if (!cfp)
++ if (!cfp) {
++ comedi_dev_put(dev);
+ return -ENOMEM;
++ }
+
+ cfp->dev = dev;
+
+diff --git a/drivers/staging/comedi/drivers/dt2815.c b/drivers/staging/comedi/drivers/dt2815.c
+index 83026ba63d1c..78a7c1b3448a 100644
+--- a/drivers/staging/comedi/drivers/dt2815.c
++++ b/drivers/staging/comedi/drivers/dt2815.c
+@@ -92,6 +92,7 @@ static int dt2815_ao_insn(struct comedi_device *dev, struct comedi_subdevice *s,
+ int ret;
+
+ for (i = 0; i < insn->n; i++) {
++ /* FIXME: lo bit 0 chooses voltage output or current output */
+ lo = ((data[i] & 0x0f) << 4) | (chan << 1) | 0x01;
+ hi = (data[i] & 0xff0) >> 4;
+
+@@ -105,6 +106,8 @@ static int dt2815_ao_insn(struct comedi_device *dev, struct comedi_subdevice *s,
+ if (ret)
+ return ret;
+
++ outb(hi, dev->iobase + DT2815_DATA);
++
+ devpriv->ao_readback[chan] = data[i];
+ }
+ return i;
+diff --git a/drivers/staging/vt6656/int.c b/drivers/staging/vt6656/int.c
+index af0060c74530..43f461f75b97 100644
+--- a/drivers/staging/vt6656/int.c
++++ b/drivers/staging/vt6656/int.c
+@@ -143,7 +143,8 @@ void vnt_int_process_data(struct vnt_private *priv)
+ priv->wake_up_count =
+ priv->hw->conf.listen_interval;
+
+- --priv->wake_up_count;
++ if (priv->wake_up_count)
++ --priv->wake_up_count;
+
+ /* Turn on wake up to listen next beacon */
+ if (priv->wake_up_count == 1)
+diff --git a/drivers/staging/vt6656/key.c b/drivers/staging/vt6656/key.c
+index 91dede54cc1f..be8dbf6c2c2f 100644
+--- a/drivers/staging/vt6656/key.c
++++ b/drivers/staging/vt6656/key.c
+@@ -81,9 +81,6 @@ static int vnt_set_keymode(struct ieee80211_hw *hw, u8 *mac_addr,
+ case VNT_KEY_PAIRWISE:
+ key_mode |= mode;
+ key_inx = 4;
+- /* Don't save entry for pairwise key for station mode */
+- if (priv->op_mode == NL80211_IFTYPE_STATION)
+- clear_bit(entry, &priv->key_entry_inuse);
+ break;
+ default:
+ return -EINVAL;
+@@ -107,7 +104,6 @@ static int vnt_set_keymode(struct ieee80211_hw *hw, u8 *mac_addr,
+ int vnt_set_keys(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
+ struct ieee80211_vif *vif, struct ieee80211_key_conf *key)
+ {
+- struct ieee80211_bss_conf *conf = &vif->bss_conf;
+ struct vnt_private *priv = hw->priv;
+ u8 *mac_addr = NULL;
+ u8 key_dec_mode = 0;
+@@ -149,16 +145,12 @@ int vnt_set_keys(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
+ key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+ }
+
+- if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
++ if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
+ vnt_set_keymode(hw, mac_addr, key, VNT_KEY_PAIRWISE,
+ key_dec_mode, true);
+- } else {
+- vnt_set_keymode(hw, mac_addr, key, VNT_KEY_DEFAULTKEY,
++ else
++ vnt_set_keymode(hw, mac_addr, key, VNT_KEY_GROUP_ADDRESS,
+ key_dec_mode, true);
+
+- vnt_set_keymode(hw, (u8 *)conf->bssid, key,
+- VNT_KEY_GROUP_ADDRESS, key_dec_mode, true);
+- }
+-
+ return 0;
+ }
+diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
+index 36562ac94c1f..586a3d331511 100644
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -595,8 +595,6 @@ static int vnt_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+
+ priv->op_mode = vif->type;
+
+- vnt_set_bss_mode(priv);
+-
+ /* LED blink on TX */
+ vnt_mac_set_led(priv, LEDSTS_STS, LEDSTS_INTER);
+
+@@ -683,7 +681,6 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
+ priv->basic_rates = conf->basic_rates;
+
+ vnt_update_top_rates(priv);
+- vnt_set_bss_mode(priv);
+
+ dev_dbg(&priv->usb->dev, "basic rates %x\n", conf->basic_rates);
+ }
+@@ -712,11 +709,14 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
+ priv->short_slot_time = false;
+
+ vnt_set_short_slot_time(priv);
+- vnt_update_ifs(priv);
+ vnt_set_vga_gain_offset(priv, priv->bb_vga[0]);
+ vnt_update_pre_ed_threshold(priv, false);
+ }
+
++ if (changed & (BSS_CHANGED_BASIC_RATES | BSS_CHANGED_ERP_PREAMBLE |
++ BSS_CHANGED_ERP_SLOT))
++ vnt_set_bss_mode(priv);
++
+ if (changed & BSS_CHANGED_TXPOWER)
+ vnt_rf_setpower(priv, priv->current_rate,
+ conf->chandef.chan->hw_value);
+@@ -740,12 +740,15 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
+ vnt_mac_reg_bits_on(priv, MAC_REG_TFTCTL,
+ TFTCTL_TSFCNTREN);
+
+- vnt_adjust_tsf(priv, conf->beacon_rate->hw_value,
+- conf->sync_tsf, priv->current_tsf);
+-
+ vnt_mac_set_beacon_interval(priv, conf->beacon_int);
+
+ vnt_reset_next_tbtt(priv, conf->beacon_int);
++
++ vnt_adjust_tsf(priv, conf->beacon_rate->hw_value,
++ conf->sync_tsf, priv->current_tsf);
++
++ vnt_update_next_tbtt(priv,
++ conf->sync_tsf, conf->beacon_int);
+ } else {
+ vnt_clear_current_tsf(priv);
+
+@@ -780,15 +783,11 @@ static void vnt_configure(struct ieee80211_hw *hw,
+ {
+ struct vnt_private *priv = hw->priv;
+ u8 rx_mode = 0;
+- int rc;
+
+ *total_flags &= FIF_ALLMULTI | FIF_OTHER_BSS | FIF_BCN_PRBRESP_PROMISC;
+
+- rc = vnt_control_in(priv, MESSAGE_TYPE_READ, MAC_REG_RCR,
+- MESSAGE_REQUEST_MACREG, sizeof(u8), &rx_mode);
+-
+- if (!rc)
+- rx_mode = RCR_MULTICAST | RCR_BROADCAST;
++ vnt_control_in(priv, MESSAGE_TYPE_READ, MAC_REG_RCR,
++ MESSAGE_REQUEST_MACREG, sizeof(u8), &rx_mode);
+
+ dev_dbg(&priv->usb->dev, "rx mode in = %x\n", rx_mode);
+
+@@ -829,8 +828,12 @@ static int vnt_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ return -EOPNOTSUPP;
+ break;
+ case DISABLE_KEY:
+- if (test_bit(key->hw_key_idx, &priv->key_entry_inuse))
++ if (test_bit(key->hw_key_idx, &priv->key_entry_inuse)) {
+ clear_bit(key->hw_key_idx, &priv->key_entry_inuse);
++
++ vnt_mac_disable_keyentry(priv, key->hw_key_idx);
++ }
++
+ default:
+ break;
+ }
+diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
+index 27284a2dcd2b..436cc51c92c3 100644
+--- a/drivers/tty/hvc/hvc_console.c
++++ b/drivers/tty/hvc/hvc_console.c
+@@ -302,10 +302,6 @@ int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
+ vtermnos[index] = vtermno;
+ cons_ops[index] = ops;
+
+- /* reserve all indices up to and including this index */
+- if (last_hvc < index)
+- last_hvc = index;
+-
+ /* check if we need to re-register the kernel console */
+ hvc_check_console(index);
+
+@@ -960,13 +956,22 @@ struct hvc_struct *hvc_alloc(uint32_t vtermno, int data,
+ cons_ops[i] == hp->ops)
+ break;
+
+- /* no matching slot, just use a counter */
+- if (i >= MAX_NR_HVC_CONSOLES)
+- i = ++last_hvc;
++ if (i >= MAX_NR_HVC_CONSOLES) {
++
++ /* find 'empty' slot for console */
++ for (i = 0; i < MAX_NR_HVC_CONSOLES && vtermnos[i] != -1; i++) {
++ }
++
++ /* no matching slot, just use a counter */
++ if (i == MAX_NR_HVC_CONSOLES)
++ i = ++last_hvc + MAX_NR_HVC_CONSOLES;
++ }
+
+ hp->index = i;
+- cons_ops[i] = ops;
+- vtermnos[i] = vtermno;
++ if (i < MAX_NR_HVC_CONSOLES) {
++ cons_ops[i] = ops;
++ vtermnos[i] = vtermno;
++ }
+
+ list_add_tail(&(hp->next), &hvc_structs);
+ mutex_unlock(&hvc_structs_mutex);
+diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c
+index 27aeca30eeae..6133830f52a3 100644
+--- a/drivers/tty/rocket.c
++++ b/drivers/tty/rocket.c
+@@ -632,18 +632,21 @@ init_r_port(int board, int aiop, int chan, struct pci_dev *pci_dev)
+ tty_port_init(&info->port);
+ info->port.ops = &rocket_port_ops;
+ info->flags &= ~ROCKET_MODE_MASK;
+- switch (pc104[board][line]) {
+- case 422:
+- info->flags |= ROCKET_MODE_RS422;
+- break;
+- case 485:
+- info->flags |= ROCKET_MODE_RS485;
+- break;
+- case 232:
+- default:
++ if (board < ARRAY_SIZE(pc104) && line < ARRAY_SIZE(pc104_1))
++ switch (pc104[board][line]) {
++ case 422:
++ info->flags |= ROCKET_MODE_RS422;
++ break;
++ case 485:
++ info->flags |= ROCKET_MODE_RS485;
++ break;
++ case 232:
++ default:
++ info->flags |= ROCKET_MODE_RS232;
++ break;
++ }
++ else
+ info->flags |= ROCKET_MODE_RS232;
+- break;
+- }
+
+ info->intmask = RXF_TRIG | TXFIFO_MT | SRC_INT | DELTA_CD | DELTA_CTS | DELTA_DSR;
+ if (sInitChan(ctlp, &info->channel, aiop, chan) == 0) {
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 9e1a6af23ca2..8aaa7900927a 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -873,9 +873,16 @@ static void sci_receive_chars(struct uart_port *port)
+ tty_insert_flip_char(tport, c, TTY_NORMAL);
+ } else {
+ for (i = 0; i < count; i++) {
+- char c = serial_port_in(port, SCxRDR);
+-
+- status = serial_port_in(port, SCxSR);
++ char c;
++
++ if (port->type == PORT_SCIF ||
++ port->type == PORT_HSCIF) {
++ status = serial_port_in(port, SCxSR);
++ c = serial_port_in(port, SCxRDR);
++ } else {
++ c = serial_port_in(port, SCxRDR);
++ status = serial_port_in(port, SCxSR);
++ }
+ if (uart_handle_sysrq_char(port, c)) {
+ count--; i--;
+ continue;
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 36c6f1b98372..ca8c6ddc1ca8 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -81,6 +81,7 @@
+ #include <linux/errno.h>
+ #include <linux/kd.h>
+ #include <linux/slab.h>
++#include <linux/vmalloc.h>
+ #include <linux/major.h>
+ #include <linux/mm.h>
+ #include <linux/console.h>
+@@ -350,7 +351,7 @@ static struct uni_screen *vc_uniscr_alloc(unsigned int cols, unsigned int rows)
+ /* allocate everything in one go */
+ memsize = cols * rows * sizeof(char32_t);
+ memsize += rows * sizeof(char32_t *);
+- p = kmalloc(memsize, GFP_KERNEL);
++ p = vmalloc(memsize);
+ if (!p)
+ return NULL;
+
+@@ -366,7 +367,7 @@ static struct uni_screen *vc_uniscr_alloc(unsigned int cols, unsigned int rows)
+
+ static void vc_uniscr_set(struct vc_data *vc, struct uni_screen *new_uniscr)
+ {
+- kfree(vc->vc_uni_screen);
++ vfree(vc->vc_uni_screen);
+ vc->vc_uni_screen = new_uniscr;
+ }
+
+@@ -1209,7 +1210,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
+ return 0;
+
+- if (new_screen_size > (4 << 20))
++ if (new_screen_size > KMALLOC_MAX_SIZE)
+ return -EINVAL;
+ newscreen = kzalloc(new_screen_size, GFP_USER);
+ if (!newscreen)
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 6e0b41861735..10ba1b4f0dbf 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -412,9 +412,12 @@ static void acm_ctrl_irq(struct urb *urb)
+
+ exit:
+ retval = usb_submit_urb(urb, GFP_ATOMIC);
+- if (retval && retval != -EPERM)
++ if (retval && retval != -EPERM && retval != -ENODEV)
+ dev_err(&acm->control->dev,
+ "%s - usb_submit_urb failed: %d\n", __func__, retval);
++ else
++ dev_vdbg(&acm->control->dev,
++ "control resubmission terminated %d\n", retval);
+ }
+
+ static int acm_submit_read_urb(struct acm *acm, int index, gfp_t mem_flags)
+@@ -430,6 +433,8 @@ static int acm_submit_read_urb(struct acm *acm, int index, gfp_t mem_flags)
+ dev_err(&acm->data->dev,
+ "urb %d failed submission with %d\n",
+ index, res);
++ } else {
++ dev_vdbg(&acm->data->dev, "intended failure %d\n", res);
+ }
+ set_bit(index, &acm->read_urbs_free);
+ return res;
+@@ -472,6 +477,7 @@ static void acm_read_bulk_callback(struct urb *urb)
+ int status = urb->status;
+ bool stopped = false;
+ bool stalled = false;
++ bool cooldown = false;
+
+ dev_vdbg(&acm->data->dev, "got urb %d, len %d, status %d\n",
+ rb->index, urb->actual_length, status);
+@@ -498,6 +504,14 @@ static void acm_read_bulk_callback(struct urb *urb)
+ __func__, status);
+ stopped = true;
+ break;
++ case -EOVERFLOW:
++ case -EPROTO:
++ dev_dbg(&acm->data->dev,
++ "%s - cooling babbling device\n", __func__);
++ usb_mark_last_busy(acm->dev);
++ set_bit(rb->index, &acm->urbs_in_error_delay);
++ cooldown = true;
++ break;
+ default:
+ dev_dbg(&acm->data->dev,
+ "%s - nonzero urb status received: %d\n",
+@@ -519,9 +533,11 @@ static void acm_read_bulk_callback(struct urb *urb)
+ */
+ smp_mb__after_atomic();
+
+- if (stopped || stalled) {
++ if (stopped || stalled || cooldown) {
+ if (stalled)
+ schedule_work(&acm->work);
++ else if (cooldown)
++ schedule_delayed_work(&acm->dwork, HZ / 2);
+ return;
+ }
+
+@@ -563,14 +579,20 @@ static void acm_softint(struct work_struct *work)
+ struct acm *acm = container_of(work, struct acm, work);
+
+ if (test_bit(EVENT_RX_STALL, &acm->flags)) {
+- if (!(usb_autopm_get_interface(acm->data))) {
++ smp_mb(); /* against acm_suspend() */
++ if (!acm->susp_count) {
+ for (i = 0; i < acm->rx_buflimit; i++)
+ usb_kill_urb(acm->read_urbs[i]);
+ usb_clear_halt(acm->dev, acm->in);
+ acm_submit_read_urbs(acm, GFP_KERNEL);
+- usb_autopm_put_interface(acm->data);
++ clear_bit(EVENT_RX_STALL, &acm->flags);
+ }
+- clear_bit(EVENT_RX_STALL, &acm->flags);
++ }
++
++ if (test_and_clear_bit(ACM_ERROR_DELAY, &acm->flags)) {
++ for (i = 0; i < ACM_NR; i++)
++ if (test_and_clear_bit(i, &acm->urbs_in_error_delay))
++ acm_submit_read_urb(acm, i, GFP_NOIO);
+ }
+
+ if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags))
+@@ -1365,6 +1387,7 @@ made_compressed_probe:
+ acm->readsize = readsize;
+ acm->rx_buflimit = num_rx_buf;
+ INIT_WORK(&acm->work, acm_softint);
++ INIT_DELAYED_WORK(&acm->dwork, acm_softint);
+ init_waitqueue_head(&acm->wioctl);
+ spin_lock_init(&acm->write_lock);
+ spin_lock_init(&acm->read_lock);
+@@ -1574,6 +1597,7 @@ static void acm_disconnect(struct usb_interface *intf)
+
+ acm_kill_urbs(acm);
+ cancel_work_sync(&acm->work);
++ cancel_delayed_work_sync(&acm->dwork);
+
+ tty_unregister_device(acm_tty_driver, acm->minor);
+
+@@ -1616,6 +1640,8 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message)
+
+ acm_kill_urbs(acm);
+ cancel_work_sync(&acm->work);
++ cancel_delayed_work_sync(&acm->dwork);
++ acm->urbs_in_error_delay = 0;
+
+ return 0;
+ }
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index 515aad0847ee..30380d28a504 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -108,8 +108,11 @@ struct acm {
+ unsigned long flags;
+ # define EVENT_TTY_WAKEUP 0
+ # define EVENT_RX_STALL 1
++# define ACM_ERROR_DELAY 3
++ unsigned long urbs_in_error_delay; /* these need to be restarted after a delay */
+ struct usb_cdc_line_coding line; /* bits, stop, parity */
+- struct work_struct work; /* work queue entry for line discipline waking up */
++ struct work_struct work; /* work queue entry for various purposes*/
++ struct delayed_work dwork; /* for cool downs needed in error recovery */
+ unsigned int ctrlin; /* input control lines (DCD, DSR, RI, break, overruns) */
+ unsigned int ctrlout; /* output control lines (DTR, RTS) */
+ struct async_icount iocount; /* counters for control line changes */
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 8cf2d2a5e266..fffe544d9e9f 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1196,6 +1196,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ #ifdef CONFIG_PM
+ udev->reset_resume = 1;
+ #endif
++ /* Don't set the change_bits when the device
++ * was powered off.
++ */
++ if (test_bit(port1, hub->power_bits))
++ set_bit(port1, hub->change_bits);
+
+ } else {
+ /* The power session is gone; tell hub_wq */
+@@ -3051,6 +3056,15 @@ static int check_port_resume_type(struct usb_device *udev,
+ if (portchange & USB_PORT_STAT_C_ENABLE)
+ usb_clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_ENABLE);
++
++ /*
++ * Whatever made this reset-resume necessary may have
++ * turned on the port1 bit in hub->change_bits. But after
++ * a successful reset-resume we want the bit to be clear;
++ * if it was on it would indicate that something happened
++ * following the reset-resume.
++ */
++ clear_bit(port1, hub->change_bits);
+ }
+
+ return status;
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index 0d3fd2083165..fcf84bfc08e3 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -588,12 +588,13 @@ void usb_sg_cancel(struct usb_sg_request *io)
+ int i, retval;
+
+ spin_lock_irqsave(&io->lock, flags);
+- if (io->status) {
++ if (io->status || io->count == 0) {
+ spin_unlock_irqrestore(&io->lock, flags);
+ return;
+ }
+ /* shut everything down */
+ io->status = -ECONNRESET;
++ io->count++; /* Keep the request alive until we're done */
+ spin_unlock_irqrestore(&io->lock, flags);
+
+ for (i = io->entries - 1; i >= 0; --i) {
+@@ -607,6 +608,12 @@ void usb_sg_cancel(struct usb_sg_request *io)
+ dev_warn(&io->dev->dev, "%s, unlink --> %d\n",
+ __func__, retval);
+ }
++
++ spin_lock_irqsave(&io->lock, flags);
++ io->count--;
++ if (!io->count)
++ complete(&io->complete);
++ spin_unlock_irqrestore(&io->lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(usb_sg_cancel);
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index da30b5664ff3..3e8efe759c3e 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -430,6 +430,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Corsair K70 LUX */
+ { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
+
++ /* Corsair K70 RGB RAPDIFIRE */
++ { USB_DEVICE(0x1b1c, 0x1b38), .driver_info = USB_QUIRK_DELAY_INIT |
++ USB_QUIRK_DELAY_CTRL_MSG },
++
+ /* MIDI keyboard WORLDE MINI */
+ { USB_DEVICE(0x1c75, 0x0204), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 8a4455d0af8b..8222e674c777 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2280,14 +2280,7 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep,
+
+ static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req)
+ {
+- /*
+- * For OUT direction, host may send less than the setup
+- * length. Return true for all OUT requests.
+- */
+- if (!req->direction)
+- return true;
+-
+- return req->request.actual == req->request.length;
++ return req->num_pending_sgs == 0;
+ }
+
+ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+@@ -2311,8 +2304,7 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+
+ req->request.actual = req->request.length - req->remaining;
+
+- if (!dwc3_gadget_ep_request_completed(req) ||
+- req->num_pending_sgs) {
++ if (!dwc3_gadget_ep_request_completed(req)) {
+ __dwc3_gadget_kick_transfer(dep);
+ goto out;
+ }
+diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c
+index e15e896f356c..97885eb57be6 100644
+--- a/drivers/usb/early/xhci-dbc.c
++++ b/drivers/usb/early/xhci-dbc.c
+@@ -735,19 +735,19 @@ static void xdbc_handle_tx_event(struct xdbc_trb *evt_trb)
+ case COMP_USB_TRANSACTION_ERROR:
+ case COMP_STALL_ERROR:
+ default:
+- if (ep_id == XDBC_EPID_OUT)
++ if (ep_id == XDBC_EPID_OUT || ep_id == XDBC_EPID_OUT_INTEL)
+ xdbc.flags |= XDBC_FLAGS_OUT_STALL;
+- if (ep_id == XDBC_EPID_IN)
++ if (ep_id == XDBC_EPID_IN || ep_id == XDBC_EPID_IN_INTEL)
+ xdbc.flags |= XDBC_FLAGS_IN_STALL;
+
+ xdbc_trace("endpoint %d stalled\n", ep_id);
+ break;
+ }
+
+- if (ep_id == XDBC_EPID_IN) {
++ if (ep_id == XDBC_EPID_IN || ep_id == XDBC_EPID_IN_INTEL) {
+ xdbc.flags &= ~XDBC_FLAGS_IN_PROCESS;
+ xdbc_bulk_transfer(NULL, XDBC_MAX_PACKET, true);
+- } else if (ep_id == XDBC_EPID_OUT) {
++ } else if (ep_id == XDBC_EPID_OUT || ep_id == XDBC_EPID_OUT_INTEL) {
+ xdbc.flags &= ~XDBC_FLAGS_OUT_PROCESS;
+ } else {
+ xdbc_trace("invalid endpoint id %d\n", ep_id);
+diff --git a/drivers/usb/early/xhci-dbc.h b/drivers/usb/early/xhci-dbc.h
+index 673686eeddd7..6e2b7266a695 100644
+--- a/drivers/usb/early/xhci-dbc.h
++++ b/drivers/usb/early/xhci-dbc.h
+@@ -120,8 +120,22 @@ struct xdbc_ring {
+ u32 cycle_state;
+ };
+
+-#define XDBC_EPID_OUT 2
+-#define XDBC_EPID_IN 3
++/*
++ * These are the "Endpoint ID" (also known as "Context Index") values for the
++ * OUT Transfer Ring and the IN Transfer Ring of a Debug Capability Context data
++ * structure.
++ * According to the "eXtensible Host Controller Interface for Universal Serial
++ * Bus (xHCI)" specification, section "7.6.3.2 Endpoint Contexts and Transfer
++ * Rings", these should be 0 and 1, and those are the values AMD machines give
++ * you; but Intel machines seem to use the formula from section "4.5.1 Device
++ * Context Index", which is supposed to be used for the Device Context only.
++ * Luckily the values from Intel don't overlap with those from AMD, so we can
++ * just test for both.
++ */
++#define XDBC_EPID_OUT 0
++#define XDBC_EPID_IN 1
++#define XDBC_EPID_OUT_INTEL 2
++#define XDBC_EPID_IN_INTEL 3
+
+ struct xdbc_state {
+ u16 vendor;
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 31b3dda3089c..11a501d0664c 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1737,6 +1737,10 @@ static void ffs_data_reset(struct ffs_data *ffs)
+ ffs->state = FFS_READ_DESCRIPTORS;
+ ffs->setup_state = FFS_NO_SETUP;
+ ffs->flags = 0;
++
++ ffs->ms_os_descs_ext_prop_count = 0;
++ ffs->ms_os_descs_ext_prop_name_len = 0;
++ ffs->ms_os_descs_ext_prop_data_len = 0;
+ }
+
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index a024230f00e2..a58ef53e4ae1 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1266,7 +1266,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ xhci_set_link_state(xhci, ports[wIndex], link_state);
+
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- msleep(20); /* wait device to enter */
++ if (link_state == USB_SS_PORT_LS_U3) {
++ int retries = 16;
++
++ while (retries--) {
++ usleep_range(4000, 8000);
++ temp = readl(ports[wIndex]->addr);
++ if ((temp & PORT_PLS_MASK) == XDEV_U3)
++ break;
++ }
++ }
+ spin_lock_irqsave(&xhci->lock, flags);
+
+ temp = readl(ports[wIndex]->addr);
+@@ -1472,6 +1481,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ }
+ if ((temp & PORT_RC))
+ reset_change = true;
++ if (temp & PORT_OC)
++ status = 1;
+ }
+ if (!status && !reset_change) {
+ xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
+@@ -1537,6 +1548,13 @@ retry:
+ port_index);
+ goto retry;
+ }
++ /* bail out if port detected a over-current condition */
++ if (t1 & PORT_OC) {
++ bus_state->bus_suspended = 0;
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ xhci_dbg(xhci, "Bus suspend bailout, port over-current detected\n");
++ return -EBUSY;
++ }
+ /* suspend ports in U0, or bail out for new connect changes */
+ if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) {
+ if ((t1 & PORT_CSC) && wake_enabled) {
+diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
+index c4f6ac5f035e..6376be1f5fd2 100644
+--- a/drivers/usb/misc/sisusbvga/sisusb.c
++++ b/drivers/usb/misc/sisusbvga/sisusb.c
+@@ -1199,18 +1199,18 @@ static int sisusb_read_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr,
+ /* High level: Gfx (indexed) register access */
+
+ #ifdef INCL_SISUSB_CON
+-int sisusb_setreg(struct sisusb_usb_data *sisusb, int port, u8 data)
++int sisusb_setreg(struct sisusb_usb_data *sisusb, u32 port, u8 data)
+ {
+ return sisusb_write_memio_byte(sisusb, SISUSB_TYPE_IO, port, data);
+ }
+
+-int sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 *data)
++int sisusb_getreg(struct sisusb_usb_data *sisusb, u32 port, u8 *data)
+ {
+ return sisusb_read_memio_byte(sisusb, SISUSB_TYPE_IO, port, data);
+ }
+ #endif
+
+-int sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port,
++int sisusb_setidxreg(struct sisusb_usb_data *sisusb, u32 port,
+ u8 index, u8 data)
+ {
+ int ret;
+@@ -1220,7 +1220,7 @@ int sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port,
+ return ret;
+ }
+
+-int sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port,
++int sisusb_getidxreg(struct sisusb_usb_data *sisusb, u32 port,
+ u8 index, u8 *data)
+ {
+ int ret;
+@@ -1230,7 +1230,7 @@ int sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port,
+ return ret;
+ }
+
+-int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, u8 idx,
++int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, u32 port, u8 idx,
+ u8 myand, u8 myor)
+ {
+ int ret;
+@@ -1245,7 +1245,7 @@ int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, u8 idx,
+ }
+
+ static int sisusb_setidxregmask(struct sisusb_usb_data *sisusb,
+- int port, u8 idx, u8 data, u8 mask)
++ u32 port, u8 idx, u8 data, u8 mask)
+ {
+ int ret;
+ u8 tmp;
+@@ -1258,13 +1258,13 @@ static int sisusb_setidxregmask(struct sisusb_usb_data *sisusb,
+ return ret;
+ }
+
+-int sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port,
++int sisusb_setidxregor(struct sisusb_usb_data *sisusb, u32 port,
+ u8 index, u8 myor)
+ {
+ return sisusb_setidxregandor(sisusb, port, index, 0xff, myor);
+ }
+
+-int sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port,
++int sisusb_setidxregand(struct sisusb_usb_data *sisusb, u32 port,
+ u8 idx, u8 myand)
+ {
+ return sisusb_setidxregandor(sisusb, port, idx, myand, 0x00);
+@@ -2787,8 +2787,8 @@ static loff_t sisusb_lseek(struct file *file, loff_t offset, int orig)
+ static int sisusb_handle_command(struct sisusb_usb_data *sisusb,
+ struct sisusb_command *y, unsigned long arg)
+ {
+- int retval, port, length;
+- u32 address;
++ int retval, length;
++ u32 port, address;
+
+ /* All our commands require the device
+ * to be initialized.
+diff --git a/drivers/usb/misc/sisusbvga/sisusb_init.h b/drivers/usb/misc/sisusbvga/sisusb_init.h
+index 1782c759c4ad..ace09985dae4 100644
+--- a/drivers/usb/misc/sisusbvga/sisusb_init.h
++++ b/drivers/usb/misc/sisusbvga/sisusb_init.h
+@@ -812,17 +812,17 @@ static const struct SiS_VCLKData SiSUSB_VCLKData[] = {
+ int SiSUSBSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo);
+ int SiSUSBSetVESAMode(struct SiS_Private *SiS_Pr, unsigned short VModeNo);
+
+-extern int sisusb_setreg(struct sisusb_usb_data *sisusb, int port, u8 data);
+-extern int sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 * data);
+-extern int sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port,
++extern int sisusb_setreg(struct sisusb_usb_data *sisusb, u32 port, u8 data);
++extern int sisusb_getreg(struct sisusb_usb_data *sisusb, u32 port, u8 * data);
++extern int sisusb_setidxreg(struct sisusb_usb_data *sisusb, u32 port,
+ u8 index, u8 data);
+-extern int sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port,
++extern int sisusb_getidxreg(struct sisusb_usb_data *sisusb, u32 port,
+ u8 index, u8 * data);
+-extern int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port,
++extern int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, u32 port,
+ u8 idx, u8 myand, u8 myor);
+-extern int sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port,
++extern int sisusb_setidxregor(struct sisusb_usb_data *sisusb, u32 port,
+ u8 index, u8 myor);
+-extern int sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port,
++extern int sisusb_setidxregand(struct sisusb_usb_data *sisusb, u32 port,
+ u8 idx, u8 myand);
+
+ void sisusb_delete(struct kref *kref);
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index 62ca8e29da48..27d8b4b6ff59 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -81,6 +81,19 @@ static void uas_free_streams(struct uas_dev_info *devinfo);
+ static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *prefix,
+ int status);
+
++/*
++ * This driver needs its own workqueue, as we need to control memory allocation.
++ *
++ * In the course of error handling and power management uas_wait_for_pending_cmnds()
++ * needs to flush pending work items. In these contexts we cannot allocate memory
++ * by doing block IO as we would deadlock. For the same reason we cannot wait
++ * for anything allocating memory not heeding these constraints.
++ *
++ * So we have to control all work items that can be on the workqueue we flush.
++ * Hence we cannot share a queue and need our own.
++ */
++static struct workqueue_struct *workqueue;
++
+ static void uas_do_work(struct work_struct *work)
+ {
+ struct uas_dev_info *devinfo =
+@@ -109,7 +122,7 @@ static void uas_do_work(struct work_struct *work)
+ if (!err)
+ cmdinfo->state &= ~IS_IN_WORK_LIST;
+ else
+- schedule_work(&devinfo->work);
++ queue_work(workqueue, &devinfo->work);
+ }
+ out:
+ spin_unlock_irqrestore(&devinfo->lock, flags);
+@@ -134,7 +147,7 @@ static void uas_add_work(struct uas_cmd_info *cmdinfo)
+
+ lockdep_assert_held(&devinfo->lock);
+ cmdinfo->state |= IS_IN_WORK_LIST;
+- schedule_work(&devinfo->work);
++ queue_work(workqueue, &devinfo->work);
+ }
+
+ static void uas_zap_pending(struct uas_dev_info *devinfo, int result)
+@@ -190,6 +203,9 @@ static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *prefix,
+ struct uas_cmd_info *ci = (void *)&cmnd->SCp;
+ struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
+
++ if (status == -ENODEV) /* too late */
++ return;
++
+ scmd_printk(KERN_INFO, cmnd,
+ "%s %d uas-tag %d inflight:%s%s%s%s%s%s%s%s%s%s%s%s ",
+ prefix, status, cmdinfo->uas_tag,
+@@ -1233,7 +1249,31 @@ static struct usb_driver uas_driver = {
+ .id_table = uas_usb_ids,
+ };
+
+-module_usb_driver(uas_driver);
++static int __init uas_init(void)
++{
++ int rv;
++
++ workqueue = alloc_workqueue("uas", WQ_MEM_RECLAIM, 0);
++ if (!workqueue)
++ return -ENOMEM;
++
++ rv = usb_register(&uas_driver);
++ if (rv) {
++ destroy_workqueue(workqueue);
++ return -ENOMEM;
++ }
++
++ return 0;
++}
++
++static void __exit uas_exit(void)
++{
++ usb_deregister(&uas_driver);
++ destroy_workqueue(workqueue);
++}
++
++module_init(uas_init);
++module_exit(uas_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR(
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 1880f3e13f57..f6c3681fa2e9 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2323,6 +2323,13 @@ UNUSUAL_DEV( 0x3340, 0xffff, 0x0000, 0x0000,
+ USB_SC_DEVICE,USB_PR_DEVICE,NULL,
+ US_FL_MAX_SECTORS_64 ),
+
++/* Reported by Cyril Roelandt <tipecaml@gmail.com> */
++UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x0114,
++ "JMicron",
++ "USB to ATA/ATAPI Bridge",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_BROKEN_FUA ),
++
+ /* Reported by Andrey Rahmatullin <wrar@altlinux.org> */
+ UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100,
+ "iRiver",
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index e64aa88e99da..10b2090f3e5e 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -264,6 +264,7 @@ static int watchdog_start(struct watchdog_device *wdd)
+ if (err == 0) {
+ set_bit(WDOG_ACTIVE, &wdd->status);
+ wd_data->last_keepalive = started_at;
++ wd_data->last_hw_keepalive = started_at;
+ watchdog_update_worker(wdd);
+ }
+
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 4c0b220e20ba..5241102b81a8 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1972,8 +1972,12 @@ retry_locked:
+ }
+
+ /* want more caps from mds? */
+- if (want & ~(cap->mds_wanted | cap->issued))
+- goto ack;
++ if (want & ~cap->mds_wanted) {
++ if (want & ~(cap->mds_wanted | cap->issued))
++ goto ack;
++ if (!__cap_is_valid(cap))
++ goto ack;
++ }
+
+ /* things we might delay */
+ if ((cap->issued & ~retain) == 0 &&
+diff --git a/fs/ceph/export.c b/fs/ceph/export.c
+index 3c59ad180ef0..4cfe1154d4c7 100644
+--- a/fs/ceph/export.c
++++ b/fs/ceph/export.c
+@@ -151,6 +151,11 @@ static struct dentry *__get_parent(struct super_block *sb,
+
+ req->r_num_caps = 1;
+ err = ceph_mdsc_do_request(mdsc, NULL, req);
++ if (err) {
++ ceph_mdsc_put_request(req);
++ return ERR_PTR(err);
++ }
++
+ inode = req->r_target_inode;
+ if (inode)
+ ihold(inode);
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index a289f4bcee45..6e8049031c1a 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -498,6 +498,30 @@ int ext4_ext_check_inode(struct inode *inode)
+ return ext4_ext_check(inode, ext_inode_hdr(inode), ext_depth(inode), 0);
+ }
+
++static void ext4_cache_extents(struct inode *inode,
++ struct ext4_extent_header *eh)
++{
++ struct ext4_extent *ex = EXT_FIRST_EXTENT(eh);
++ ext4_lblk_t prev = 0;
++ int i;
++
++ for (i = le16_to_cpu(eh->eh_entries); i > 0; i--, ex++) {
++ unsigned int status = EXTENT_STATUS_WRITTEN;
++ ext4_lblk_t lblk = le32_to_cpu(ex->ee_block);
++ int len = ext4_ext_get_actual_len(ex);
++
++ if (prev && (prev != lblk))
++ ext4_es_cache_extent(inode, prev, lblk - prev, ~0,
++ EXTENT_STATUS_HOLE);
++
++ if (ext4_ext_is_unwritten(ex))
++ status = EXTENT_STATUS_UNWRITTEN;
++ ext4_es_cache_extent(inode, lblk, len,
++ ext4_ext_pblock(ex), status);
++ prev = lblk + len;
++ }
++}
++
+ static struct buffer_head *
+ __read_extent_tree_block(const char *function, unsigned int line,
+ struct inode *inode, ext4_fsblk_t pblk, int depth,
+@@ -532,26 +556,7 @@ __read_extent_tree_block(const char *function, unsigned int line,
+ */
+ if (!(flags & EXT4_EX_NOCACHE) && depth == 0) {
+ struct ext4_extent_header *eh = ext_block_hdr(bh);
+- struct ext4_extent *ex = EXT_FIRST_EXTENT(eh);
+- ext4_lblk_t prev = 0;
+- int i;
+-
+- for (i = le16_to_cpu(eh->eh_entries); i > 0; i--, ex++) {
+- unsigned int status = EXTENT_STATUS_WRITTEN;
+- ext4_lblk_t lblk = le32_to_cpu(ex->ee_block);
+- int len = ext4_ext_get_actual_len(ex);
+-
+- if (prev && (prev != lblk))
+- ext4_es_cache_extent(inode, prev,
+- lblk - prev, ~0,
+- EXTENT_STATUS_HOLE);
+-
+- if (ext4_ext_is_unwritten(ex))
+- status = EXTENT_STATUS_UNWRITTEN;
+- ext4_es_cache_extent(inode, lblk, len,
+- ext4_ext_pblock(ex), status);
+- prev = lblk + len;
+- }
++ ext4_cache_extents(inode, eh);
+ }
+ return bh;
+ errout:
+@@ -899,6 +904,8 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block,
+ path[0].p_bh = NULL;
+
+ i = depth;
++ if (!(flags & EXT4_EX_NOCACHE) && depth == 0)
++ ext4_cache_extents(inode, eh);
+ /* walk through the tree */
+ while (i) {
+ ext_debug("depth %d: num %d, max %d\n",
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 1dae74f7ccca..201e9da1692a 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -538,8 +538,9 @@ out:
+ ssize_t f2fs_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
+ {
+ struct inode *inode = d_inode(dentry);
++ nid_t xnid = F2FS_I(inode)->i_xattr_nid;
+ struct f2fs_xattr_entry *entry;
+- void *base_addr;
++ void *base_addr, *last_base_addr;
+ int error = 0;
+ size_t rest = buffer_size;
+
+@@ -549,6 +550,8 @@ ssize_t f2fs_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
+ if (error)
+ return error;
+
++ last_base_addr = (void *)base_addr + XATTR_SIZE(xnid, inode);
++
+ list_for_each_xattr(entry, base_addr) {
+ const struct xattr_handler *handler =
+ f2fs_xattr_handler(entry->e_name_index);
+@@ -556,6 +559,16 @@ ssize_t f2fs_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
+ size_t prefix_len;
+ size_t size;
+
++ if ((void *)(entry) + sizeof(__u32) > last_base_addr ||
++ (void *)XATTR_NEXT_ENTRY(entry) > last_base_addr) {
++ f2fs_msg(dentry->d_sb, KERN_ERR,
++ "inode (%lu) has corrupted xattr",
++ inode->i_ino);
++ set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
++ error = -EFSCORRUPTED;
++ goto cleanup;
++ }
++
+ if (!handler || (handler->list && !handler->list(dentry)))
+ continue;
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 1fce41ba3535..741f40cd955e 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -3142,8 +3142,8 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+ /* make certain new is below the root */
+ if (!is_path_reachable(new_mnt, new.dentry, &root))
+ goto out4;
+- root_mp->m_count++; /* pin it so it won't go away */
+ lock_mount_hash();
++ root_mp->m_count++; /* pin it so it won't go away */
+ detach_mnt(new_mnt, &parent_path);
+ detach_mnt(root_mnt, &root_parent);
+ if (root_mnt->mnt.mnt_flags & MNT_LOCKED) {
+diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
+index 5c5f161763c8..c4147e50af98 100644
+--- a/fs/proc/vmcore.c
++++ b/fs/proc/vmcore.c
+@@ -250,7 +250,8 @@ static int vmcoredd_mmap_dumps(struct vm_area_struct *vma, unsigned long dst,
+ if (start < offset + dump->size) {
+ tsz = min(offset + (u64)dump->size - start, (u64)size);
+ buf = dump->buf + start - offset;
+- if (remap_vmalloc_range_partial(vma, dst, buf, tsz)) {
++ if (remap_vmalloc_range_partial(vma, dst, buf, 0,
++ tsz)) {
+ ret = -EFAULT;
+ goto out_unlock;
+ }
+@@ -607,7 +608,7 @@ static int mmap_vmcore(struct file *file, struct vm_area_struct *vma)
+ tsz = min(elfcorebuf_sz + elfnotes_sz - (size_t)start, size);
+ kaddr = elfnotes_buf + start - elfcorebuf_sz - vmcoredd_orig_sz;
+ if (remap_vmalloc_range_partial(vma, vma->vm_start + len,
+- kaddr, tsz))
++ kaddr, 0, tsz))
+ goto fail;
+
+ size -= tsz;
+diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
+index 5ed84d6c7059..f2d06e1e4906 100644
+--- a/fs/xfs/xfs_inode.c
++++ b/fs/xfs/xfs_inode.c
+@@ -2949,7 +2949,8 @@ xfs_rename(
+ spaceres);
+
+ /*
+- * Set up the target.
++ * Check for expected errors before we dirty the transaction
++ * so we can return an error without a transaction abort.
+ */
+ if (target_ip == NULL) {
+ /*
+@@ -2961,6 +2962,46 @@ xfs_rename(
+ if (error)
+ goto out_trans_cancel;
+ }
++ } else {
++ /*
++ * If target exists and it's a directory, check that whether
++ * it can be destroyed.
++ */
++ if (S_ISDIR(VFS_I(target_ip)->i_mode) &&
++ (!xfs_dir_isempty(target_ip) ||
++ (VFS_I(target_ip)->i_nlink > 2))) {
++ error = -EEXIST;
++ goto out_trans_cancel;
++ }
++ }
++
++ /*
++ * Directory entry creation below may acquire the AGF. Remove
++ * the whiteout from the unlinked list first to preserve correct
++ * AGI/AGF locking order. This dirties the transaction so failures
++ * after this point will abort and log recovery will clean up the
++ * mess.
++ *
++ * For whiteouts, we need to bump the link count on the whiteout
++ * inode. After this point, we have a real link, clear the tmpfile
++ * state flag from the inode so it doesn't accidentally get misused
++ * in future.
++ */
++ if (wip) {
++ ASSERT(VFS_I(wip)->i_nlink == 0);
++ error = xfs_iunlink_remove(tp, wip);
++ if (error)
++ goto out_trans_cancel;
++
++ xfs_bumplink(tp, wip);
++ xfs_trans_log_inode(tp, wip, XFS_ILOG_CORE);
++ VFS_I(wip)->i_state &= ~I_LINKABLE;
++ }
++
++ /*
++ * Set up the target.
++ */
++ if (target_ip == NULL) {
+ /*
+ * If target does not exist and the rename crosses
+ * directories, adjust the target directory link count
+@@ -2980,22 +3021,6 @@ xfs_rename(
+ goto out_trans_cancel;
+ }
+ } else { /* target_ip != NULL */
+- /*
+- * If target exists and it's a directory, check that both
+- * target and source are directories and that target can be
+- * destroyed, or that neither is a directory.
+- */
+- if (S_ISDIR(VFS_I(target_ip)->i_mode)) {
+- /*
+- * Make sure target dir is empty.
+- */
+- if (!(xfs_dir_isempty(target_ip)) ||
+- (VFS_I(target_ip)->i_nlink > 2)) {
+- error = -EEXIST;
+- goto out_trans_cancel;
+- }
+- }
+-
+ /*
+ * Link the source inode under the target name.
+ * If the source inode is a directory and we are moving
+@@ -3086,32 +3111,6 @@ xfs_rename(
+ if (error)
+ goto out_trans_cancel;
+
+- /*
+- * For whiteouts, we need to bump the link count on the whiteout inode.
+- * This means that failures all the way up to this point leave the inode
+- * on the unlinked list and so cleanup is a simple matter of dropping
+- * the remaining reference to it. If we fail here after bumping the link
+- * count, we're shutting down the filesystem so we'll never see the
+- * intermediate state on disk.
+- */
+- if (wip) {
+- ASSERT(VFS_I(wip)->i_nlink == 0);
+- error = xfs_bumplink(tp, wip);
+- if (error)
+- goto out_trans_cancel;
+- error = xfs_iunlink_remove(tp, wip);
+- if (error)
+- goto out_trans_cancel;
+- xfs_trans_log_inode(tp, wip, XFS_ILOG_CORE);
+-
+- /*
+- * Now we have a real link, clear the "I'm a tmpfile" state
+- * flag from the inode so it doesn't accidentally get misused in
+- * future.
+- */
+- VFS_I(wip)->i_state &= ~I_LINKABLE;
+- }
+-
+ xfs_trans_ichgtime(tp, src_dp, XFS_ICHGTIME_MOD | XFS_ICHGTIME_CHG);
+ xfs_trans_log_inode(tp, src_dp, XFS_ILOG_CORE);
+ if (new_parent)
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 6e67aeb56928..745b2d0dcf78 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -624,7 +624,7 @@ struct request_queue {
+ unsigned int sg_reserved_size;
+ int node;
+ #ifdef CONFIG_BLK_DEV_IO_TRACE
+- struct blk_trace *blk_trace;
++ struct blk_trace __rcu *blk_trace;
+ struct mutex blk_trace_mutex;
+ #endif
+ /*
+diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
+index 7bb2d8de9f30..3b6ff5902edc 100644
+--- a/include/linux/blktrace_api.h
++++ b/include/linux/blktrace_api.h
+@@ -51,9 +51,13 @@ void __trace_note_message(struct blk_trace *, struct blkcg *blkcg, const char *f
+ **/
+ #define blk_add_cgroup_trace_msg(q, cg, fmt, ...) \
+ do { \
+- struct blk_trace *bt = (q)->blk_trace; \
++ struct blk_trace *bt; \
++ \
++ rcu_read_lock(); \
++ bt = rcu_dereference((q)->blk_trace); \
+ if (unlikely(bt)) \
+ __trace_note_message(bt, cg, fmt, ##__VA_ARGS__);\
++ rcu_read_unlock(); \
+ } while (0)
+ #define blk_add_trace_msg(q, fmt, ...) \
+ blk_add_cgroup_trace_msg(q, NULL, fmt, ##__VA_ARGS__)
+@@ -61,10 +65,14 @@ void __trace_note_message(struct blk_trace *, struct blkcg *blkcg, const char *f
+
+ static inline bool blk_trace_note_message_enabled(struct request_queue *q)
+ {
+- struct blk_trace *bt = q->blk_trace;
+- if (likely(!bt))
+- return false;
+- return bt->act_mask & BLK_TC_NOTIFY;
++ struct blk_trace *bt;
++ bool ret;
++
++ rcu_read_lock();
++ bt = rcu_dereference(q->blk_trace);
++ ret = bt && (bt->act_mask & BLK_TC_NOTIFY);
++ rcu_read_unlock();
++ return ret;
+ }
+
+ extern void blk_add_driver_data(struct request_queue *q, struct request *rq,
+diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h
+index a74cb177dc6f..136ce51548a8 100644
+--- a/include/linux/iio/iio.h
++++ b/include/linux/iio/iio.h
+@@ -599,7 +599,7 @@ void iio_device_unregister(struct iio_dev *indio_dev);
+ * 0 on success, negative error number on failure.
+ */
+ #define devm_iio_device_register(dev, indio_dev) \
+- __devm_iio_device_register((dev), (indio_dev), THIS_MODULE);
++ __devm_iio_device_register((dev), (indio_dev), THIS_MODULE)
+ int __devm_iio_device_register(struct device *dev, struct iio_dev *indio_dev,
+ struct module *this_mod);
+ void devm_iio_device_unregister(struct device *dev, struct iio_dev *indio_dev);
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 0f99ecc01bc7..92c6f80e6327 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -206,6 +206,32 @@ enum {
+ READING_SHADOW_PAGE_TABLES,
+ };
+
++#define KVM_UNMAPPED_PAGE ((void *) 0x500 + POISON_POINTER_DELTA)
++
++struct kvm_host_map {
++ /*
++ * Only valid if the 'pfn' is managed by the host kernel (i.e. There is
++ * a 'struct page' for it. When using mem= kernel parameter some memory
++ * can be used as guest memory but they are not managed by host
++ * kernel).
++ * If 'pfn' is not managed by the host kernel, this field is
++ * initialized to KVM_UNMAPPED_PAGE.
++ */
++ struct page *page;
++ void *hva;
++ kvm_pfn_t pfn;
++ kvm_pfn_t gfn;
++};
++
++/*
++ * Used to check if the mapping is valid or not. Never use 'kvm_host_map'
++ * directly to check for that.
++ */
++static inline bool kvm_vcpu_mapped(struct kvm_host_map *map)
++{
++ return !!map->hva;
++}
++
+ /*
+ * Sometimes a large or cross-page mmio needs to be broken up into separate
+ * exits for userspace servicing.
+@@ -682,6 +708,7 @@ void kvm_set_pfn_dirty(kvm_pfn_t pfn);
+ void kvm_set_pfn_accessed(kvm_pfn_t pfn);
+ void kvm_get_pfn(kvm_pfn_t pfn);
+
++void kvm_release_pfn(kvm_pfn_t pfn, bool dirty, struct gfn_to_pfn_cache *cache);
+ int kvm_read_guest_page(struct kvm *kvm, gfn_t gfn, void *data, int offset,
+ int len);
+ int kvm_read_guest_atomic(struct kvm *kvm, gpa_t gpa, void *data,
+@@ -711,7 +738,13 @@ struct kvm_memslots *kvm_vcpu_memslots(struct kvm_vcpu *vcpu);
+ struct kvm_memory_slot *kvm_vcpu_gfn_to_memslot(struct kvm_vcpu *vcpu, gfn_t gfn);
+ kvm_pfn_t kvm_vcpu_gfn_to_pfn_atomic(struct kvm_vcpu *vcpu, gfn_t gfn);
+ kvm_pfn_t kvm_vcpu_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn);
++int kvm_vcpu_map(struct kvm_vcpu *vcpu, gpa_t gpa, struct kvm_host_map *map);
++int kvm_map_gfn(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map,
++ struct gfn_to_pfn_cache *cache, bool atomic);
+ struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn);
++void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty);
++int kvm_unmap_gfn(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
++ struct gfn_to_pfn_cache *cache, bool dirty, bool atomic);
+ unsigned long kvm_vcpu_gfn_to_hva(struct kvm_vcpu *vcpu, gfn_t gfn);
+ unsigned long kvm_vcpu_gfn_to_hva_prot(struct kvm_vcpu *vcpu, gfn_t gfn, bool *writable);
+ int kvm_vcpu_read_guest_page(struct kvm_vcpu *vcpu, gfn_t gfn, void *data, int offset,
+@@ -966,7 +999,7 @@ search_memslots(struct kvm_memslots *slots, gfn_t gfn)
+ start = slot + 1;
+ }
+
+- if (gfn >= memslots[start].base_gfn &&
++ if (start < slots->used_slots && gfn >= memslots[start].base_gfn &&
+ gfn < memslots[start].base_gfn + memslots[start].npages) {
+ atomic_set(&slots->lru_slot, start);
+ return &memslots[start];
+diff --git a/include/linux/kvm_types.h b/include/linux/kvm_types.h
+index 8bf259dae9f6..a38729c8296f 100644
+--- a/include/linux/kvm_types.h
++++ b/include/linux/kvm_types.h
+@@ -32,7 +32,7 @@ struct kvm_memslots;
+
+ enum kvm_mr_change;
+
+-#include <asm/types.h>
++#include <linux/types.h>
+
+ /*
+ * Address types:
+@@ -63,4 +63,11 @@ struct gfn_to_hva_cache {
+ struct kvm_memory_slot *memslot;
+ };
+
++struct gfn_to_pfn_cache {
++ u64 generation;
++ gfn_t gfn;
++ kvm_pfn_t pfn;
++ bool dirty;
++};
++
+ #endif /* __KVM_TYPES_H__ */
+diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
+index 6ae8dd1d784f..206957b1b54d 100644
+--- a/include/linux/vmalloc.h
++++ b/include/linux/vmalloc.h
+@@ -103,7 +103,7 @@ extern void vunmap(const void *addr);
+
+ extern int remap_vmalloc_range_partial(struct vm_area_struct *vma,
+ unsigned long uaddr, void *kaddr,
+- unsigned long size);
++ unsigned long pgoff, unsigned long size);
+
+ extern int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
+ unsigned long pgoff);
+diff --git a/include/net/addrconf.h b/include/net/addrconf.h
+index 6def0351bcc3..c8d5bb8b3616 100644
+--- a/include/net/addrconf.h
++++ b/include/net/addrconf.h
+@@ -235,8 +235,10 @@ struct ipv6_stub {
+ const struct in6_addr *addr);
+ int (*ipv6_sock_mc_drop)(struct sock *sk, int ifindex,
+ const struct in6_addr *addr);
+- int (*ipv6_dst_lookup)(struct net *net, struct sock *sk,
+- struct dst_entry **dst, struct flowi6 *fl6);
++ struct dst_entry *(*ipv6_dst_lookup_flow)(struct net *net,
++ const struct sock *sk,
++ struct flowi6 *fl6,
++ const struct in6_addr *final_dst);
+
+ struct fib6_table *(*fib6_get_table)(struct net *net, u32 id);
+ struct fib6_info *(*fib6_lookup)(struct net *net, int oif,
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index ff33f498c137..4c2e40882e88 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -959,7 +959,7 @@ static inline struct sk_buff *ip6_finish_skb(struct sock *sk)
+
+ int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
+ struct flowi6 *fl6);
+-struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6,
++struct dst_entry *ip6_dst_lookup_flow(struct net *net, const struct sock *sk, struct flowi6 *fl6,
+ const struct in6_addr *final_dst);
+ struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
+ const struct in6_addr *final_dst,
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 918bfd0d7d1f..e43df898d3db 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -53,7 +53,7 @@ extern struct inet_hashinfo tcp_hashinfo;
+ extern struct percpu_counter tcp_orphan_count;
+ void tcp_time_wait(struct sock *sk, int state, int timeo);
+
+-#define MAX_TCP_HEADER (128 + MAX_HEADER)
++#define MAX_TCP_HEADER L1_CACHE_ALIGN(128 + MAX_HEADER)
+ #define MAX_TCP_OPTION_SPACE 40
+ #define TCP_MIN_SND_MSS 48
+ #define TCP_MIN_GSO_SIZE (TCP_MIN_SND_MSS - MAX_TCP_OPTION_SPACE)
+diff --git a/ipc/util.c b/ipc/util.c
+index 0af05752969f..b111e792b312 100644
+--- a/ipc/util.c
++++ b/ipc/util.c
+@@ -735,13 +735,13 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos,
+ total++;
+ }
+
++ *new_pos = pos + 1;
+ if (total >= ids->in_use)
+ return NULL;
+
+ for (; pos < IPCMNI; pos++) {
+ ipc = idr_find(&ids->ipcs_idr, pos);
+ if (ipc != NULL) {
+- *new_pos = pos + 1;
+ rcu_read_lock();
+ ipc_lock_object(ipc);
+ return ipc;
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 1f08c38e604a..7afec5f43c63 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -1331,6 +1331,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
+ if (!audit_enabled && msg_type != AUDIT_USER_AVC)
+ return 0;
++ /* exit early if there isn't at least one character to print */
++ if (data_len < 2)
++ return -EINVAL;
+
+ err = audit_filter(msg_type, AUDIT_FILTER_USER);
+ if (err == 1) { /* match or error */
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 8c70ee23fbe9..00fb2fe92c4d 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -6411,9 +6411,12 @@ static u64 perf_virt_to_phys(u64 virt)
+ * Try IRQ-safe __get_user_pages_fast first.
+ * If failed, leave phys_addr as 0.
+ */
+- if ((current->mm != NULL) &&
+- (__get_user_pages_fast(virt, 1, 0, &p) == 1))
+- phys_addr = page_to_phys(p) + virt % PAGE_SIZE;
++ if (current->mm != NULL) {
++ pagefault_disable();
++ if (__get_user_pages_fast(virt, 1, 0, &p) == 1)
++ phys_addr = page_to_phys(p) + virt % PAGE_SIZE;
++ pagefault_enable();
++ }
+
+ if (p)
+ put_page(p);
+diff --git a/kernel/gcov/fs.c b/kernel/gcov/fs.c
+index 6e40ff6be083..291e0797125b 100644
+--- a/kernel/gcov/fs.c
++++ b/kernel/gcov/fs.c
+@@ -109,9 +109,9 @@ static void *gcov_seq_next(struct seq_file *seq, void *data, loff_t *pos)
+ {
+ struct gcov_iterator *iter = data;
+
++ (*pos)++;
+ if (gcov_iter_next(iter))
+ return NULL;
+- (*pos)++;
+
+ return iter;
+ }
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 2868d85f1fb1..6cea8bbca03c 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -336,6 +336,7 @@ static void put_probe_ref(void)
+
+ static void blk_trace_cleanup(struct blk_trace *bt)
+ {
++ synchronize_rcu();
+ blk_trace_free(bt);
+ put_probe_ref();
+ }
+@@ -636,8 +637,10 @@ static int compat_blk_trace_setup(struct request_queue *q, char *name,
+ static int __blk_trace_startstop(struct request_queue *q, int start)
+ {
+ int ret;
+- struct blk_trace *bt = q->blk_trace;
++ struct blk_trace *bt;
+
++ bt = rcu_dereference_protected(q->blk_trace,
++ lockdep_is_held(&q->blk_trace_mutex));
+ if (bt == NULL)
+ return -EINVAL;
+
+@@ -746,8 +749,8 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
+ void blk_trace_shutdown(struct request_queue *q)
+ {
+ mutex_lock(&q->blk_trace_mutex);
+-
+- if (q->blk_trace) {
++ if (rcu_dereference_protected(q->blk_trace,
++ lockdep_is_held(&q->blk_trace_mutex))) {
+ __blk_trace_startstop(q, 0);
+ __blk_trace_remove(q);
+ }
+@@ -759,8 +762,10 @@ void blk_trace_shutdown(struct request_queue *q)
+ static union kernfs_node_id *
+ blk_trace_bio_get_cgid(struct request_queue *q, struct bio *bio)
+ {
+- struct blk_trace *bt = q->blk_trace;
++ struct blk_trace *bt;
+
++ /* We don't use the 'bt' value here except as an optimization... */
++ bt = rcu_dereference_protected(q->blk_trace, 1);
+ if (!bt || !(blk_tracer_flags.val & TRACE_BLK_OPT_CGROUP))
+ return NULL;
+
+@@ -805,10 +810,14 @@ static void blk_add_trace_rq(struct request *rq, int error,
+ unsigned int nr_bytes, u32 what,
+ union kernfs_node_id *cgid)
+ {
+- struct blk_trace *bt = rq->q->blk_trace;
++ struct blk_trace *bt;
+
+- if (likely(!bt))
++ rcu_read_lock();
++ bt = rcu_dereference(rq->q->blk_trace);
++ if (likely(!bt)) {
++ rcu_read_unlock();
+ return;
++ }
+
+ if (blk_rq_is_passthrough(rq))
+ what |= BLK_TC_ACT(BLK_TC_PC);
+@@ -817,6 +826,7 @@ static void blk_add_trace_rq(struct request *rq, int error,
+
+ __blk_add_trace(bt, blk_rq_trace_sector(rq), nr_bytes, req_op(rq),
+ rq->cmd_flags, what, error, 0, NULL, cgid);
++ rcu_read_unlock();
+ }
+
+ static void blk_add_trace_rq_insert(void *ignore,
+@@ -862,14 +872,19 @@ static void blk_add_trace_rq_complete(void *ignore, struct request *rq,
+ static void blk_add_trace_bio(struct request_queue *q, struct bio *bio,
+ u32 what, int error)
+ {
+- struct blk_trace *bt = q->blk_trace;
++ struct blk_trace *bt;
+
+- if (likely(!bt))
++ rcu_read_lock();
++ bt = rcu_dereference(q->blk_trace);
++ if (likely(!bt)) {
++ rcu_read_unlock();
+ return;
++ }
+
+ __blk_add_trace(bt, bio->bi_iter.bi_sector, bio->bi_iter.bi_size,
+ bio_op(bio), bio->bi_opf, what, error, 0, NULL,
+ blk_trace_bio_get_cgid(q, bio));
++ rcu_read_unlock();
+ }
+
+ static void blk_add_trace_bio_bounce(void *ignore,
+@@ -914,11 +929,14 @@ static void blk_add_trace_getrq(void *ignore,
+ if (bio)
+ blk_add_trace_bio(q, bio, BLK_TA_GETRQ, 0);
+ else {
+- struct blk_trace *bt = q->blk_trace;
++ struct blk_trace *bt;
+
++ rcu_read_lock();
++ bt = rcu_dereference(q->blk_trace);
+ if (bt)
+ __blk_add_trace(bt, 0, 0, rw, 0, BLK_TA_GETRQ, 0, 0,
+ NULL, NULL);
++ rcu_read_unlock();
+ }
+ }
+
+@@ -930,27 +948,35 @@ static void blk_add_trace_sleeprq(void *ignore,
+ if (bio)
+ blk_add_trace_bio(q, bio, BLK_TA_SLEEPRQ, 0);
+ else {
+- struct blk_trace *bt = q->blk_trace;
++ struct blk_trace *bt;
+
++ rcu_read_lock();
++ bt = rcu_dereference(q->blk_trace);
+ if (bt)
+ __blk_add_trace(bt, 0, 0, rw, 0, BLK_TA_SLEEPRQ,
+ 0, 0, NULL, NULL);
++ rcu_read_unlock();
+ }
+ }
+
+ static void blk_add_trace_plug(void *ignore, struct request_queue *q)
+ {
+- struct blk_trace *bt = q->blk_trace;
++ struct blk_trace *bt;
+
++ rcu_read_lock();
++ bt = rcu_dereference(q->blk_trace);
+ if (bt)
+ __blk_add_trace(bt, 0, 0, 0, 0, BLK_TA_PLUG, 0, 0, NULL, NULL);
++ rcu_read_unlock();
+ }
+
+ static void blk_add_trace_unplug(void *ignore, struct request_queue *q,
+ unsigned int depth, bool explicit)
+ {
+- struct blk_trace *bt = q->blk_trace;
++ struct blk_trace *bt;
+
++ rcu_read_lock();
++ bt = rcu_dereference(q->blk_trace);
+ if (bt) {
+ __be64 rpdu = cpu_to_be64(depth);
+ u32 what;
+@@ -962,14 +988,17 @@ static void blk_add_trace_unplug(void *ignore, struct request_queue *q,
+
+ __blk_add_trace(bt, 0, 0, 0, 0, what, 0, sizeof(rpdu), &rpdu, NULL);
+ }
++ rcu_read_unlock();
+ }
+
+ static void blk_add_trace_split(void *ignore,
+ struct request_queue *q, struct bio *bio,
+ unsigned int pdu)
+ {
+- struct blk_trace *bt = q->blk_trace;
++ struct blk_trace *bt;
+
++ rcu_read_lock();
++ bt = rcu_dereference(q->blk_trace);
+ if (bt) {
+ __be64 rpdu = cpu_to_be64(pdu);
+
+@@ -978,6 +1007,7 @@ static void blk_add_trace_split(void *ignore,
+ BLK_TA_SPLIT, bio->bi_status, sizeof(rpdu),
+ &rpdu, blk_trace_bio_get_cgid(q, bio));
+ }
++ rcu_read_unlock();
+ }
+
+ /**
+@@ -997,11 +1027,15 @@ static void blk_add_trace_bio_remap(void *ignore,
+ struct request_queue *q, struct bio *bio,
+ dev_t dev, sector_t from)
+ {
+- struct blk_trace *bt = q->blk_trace;
++ struct blk_trace *bt;
+ struct blk_io_trace_remap r;
+
+- if (likely(!bt))
++ rcu_read_lock();
++ bt = rcu_dereference(q->blk_trace);
++ if (likely(!bt)) {
++ rcu_read_unlock();
+ return;
++ }
+
+ r.device_from = cpu_to_be32(dev);
+ r.device_to = cpu_to_be32(bio_dev(bio));
+@@ -1010,6 +1044,7 @@ static void blk_add_trace_bio_remap(void *ignore,
+ __blk_add_trace(bt, bio->bi_iter.bi_sector, bio->bi_iter.bi_size,
+ bio_op(bio), bio->bi_opf, BLK_TA_REMAP, bio->bi_status,
+ sizeof(r), &r, blk_trace_bio_get_cgid(q, bio));
++ rcu_read_unlock();
+ }
+
+ /**
+@@ -1030,11 +1065,15 @@ static void blk_add_trace_rq_remap(void *ignore,
+ struct request *rq, dev_t dev,
+ sector_t from)
+ {
+- struct blk_trace *bt = q->blk_trace;
++ struct blk_trace *bt;
+ struct blk_io_trace_remap r;
+
+- if (likely(!bt))
++ rcu_read_lock();
++ bt = rcu_dereference(q->blk_trace);
++ if (likely(!bt)) {
++ rcu_read_unlock();
+ return;
++ }
+
+ r.device_from = cpu_to_be32(dev);
+ r.device_to = cpu_to_be32(disk_devt(rq->rq_disk));
+@@ -1043,6 +1082,7 @@ static void blk_add_trace_rq_remap(void *ignore,
+ __blk_add_trace(bt, blk_rq_pos(rq), blk_rq_bytes(rq),
+ rq_data_dir(rq), 0, BLK_TA_REMAP, 0,
+ sizeof(r), &r, blk_trace_request_get_cgid(q, rq));
++ rcu_read_unlock();
+ }
+
+ /**
+@@ -1060,14 +1100,19 @@ void blk_add_driver_data(struct request_queue *q,
+ struct request *rq,
+ void *data, size_t len)
+ {
+- struct blk_trace *bt = q->blk_trace;
++ struct blk_trace *bt;
+
+- if (likely(!bt))
++ rcu_read_lock();
++ bt = rcu_dereference(q->blk_trace);
++ if (likely(!bt)) {
++ rcu_read_unlock();
+ return;
++ }
+
+ __blk_add_trace(bt, blk_rq_trace_sector(rq), blk_rq_bytes(rq), 0, 0,
+ BLK_TA_DRV_DATA, 0, len, data,
+ blk_trace_request_get_cgid(q, rq));
++ rcu_read_unlock();
+ }
+ EXPORT_SYMBOL_GPL(blk_add_driver_data);
+
+@@ -1594,6 +1639,7 @@ static int blk_trace_remove_queue(struct request_queue *q)
+ return -EINVAL;
+
+ put_probe_ref();
++ synchronize_rcu();
+ blk_trace_free(bt);
+ return 0;
+ }
+@@ -1755,6 +1801,7 @@ static ssize_t sysfs_blk_trace_attr_show(struct device *dev,
+ struct hd_struct *p = dev_to_part(dev);
+ struct request_queue *q;
+ struct block_device *bdev;
++ struct blk_trace *bt;
+ ssize_t ret = -ENXIO;
+
+ bdev = bdget(part_devt(p));
+@@ -1767,21 +1814,23 @@ static ssize_t sysfs_blk_trace_attr_show(struct device *dev,
+
+ mutex_lock(&q->blk_trace_mutex);
+
++ bt = rcu_dereference_protected(q->blk_trace,
++ lockdep_is_held(&q->blk_trace_mutex));
+ if (attr == &dev_attr_enable) {
+- ret = sprintf(buf, "%u\n", !!q->blk_trace);
++ ret = sprintf(buf, "%u\n", !!bt);
+ goto out_unlock_bdev;
+ }
+
+- if (q->blk_trace == NULL)
++ if (bt == NULL)
+ ret = sprintf(buf, "disabled\n");
+ else if (attr == &dev_attr_act_mask)
+- ret = blk_trace_mask2str(buf, q->blk_trace->act_mask);
++ ret = blk_trace_mask2str(buf, bt->act_mask);
+ else if (attr == &dev_attr_pid)
+- ret = sprintf(buf, "%u\n", q->blk_trace->pid);
++ ret = sprintf(buf, "%u\n", bt->pid);
+ else if (attr == &dev_attr_start_lba)
+- ret = sprintf(buf, "%llu\n", q->blk_trace->start_lba);
++ ret = sprintf(buf, "%llu\n", bt->start_lba);
+ else if (attr == &dev_attr_end_lba)
+- ret = sprintf(buf, "%llu\n", q->blk_trace->end_lba);
++ ret = sprintf(buf, "%llu\n", bt->end_lba);
+
+ out_unlock_bdev:
+ mutex_unlock(&q->blk_trace_mutex);
+@@ -1798,6 +1847,7 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
+ struct block_device *bdev;
+ struct request_queue *q;
+ struct hd_struct *p;
++ struct blk_trace *bt;
+ u64 value;
+ ssize_t ret = -EINVAL;
+
+@@ -1828,8 +1878,10 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
+
+ mutex_lock(&q->blk_trace_mutex);
+
++ bt = rcu_dereference_protected(q->blk_trace,
++ lockdep_is_held(&q->blk_trace_mutex));
+ if (attr == &dev_attr_enable) {
+- if (!!value == !!q->blk_trace) {
++ if (!!value == !!bt) {
+ ret = 0;
+ goto out_unlock_bdev;
+ }
+@@ -1841,18 +1893,21 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
+ }
+
+ ret = 0;
+- if (q->blk_trace == NULL)
++ if (bt == NULL) {
+ ret = blk_trace_setup_queue(q, bdev);
++ bt = rcu_dereference_protected(q->blk_trace,
++ lockdep_is_held(&q->blk_trace_mutex));
++ }
+
+ if (ret == 0) {
+ if (attr == &dev_attr_act_mask)
+- q->blk_trace->act_mask = value;
++ bt->act_mask = value;
+ else if (attr == &dev_attr_pid)
+- q->blk_trace->pid = value;
++ bt->pid = value;
+ else if (attr == &dev_attr_start_lba)
+- q->blk_trace->start_lba = value;
++ bt->start_lba = value;
+ else if (attr == &dev_attr_end_lba)
+- q->blk_trace->end_lba = value;
++ bt->end_lba = value;
+ }
+
+ out_unlock_bdev:
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 6f4ce9547658..e068c7f75a84 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4820,8 +4820,8 @@ pte_t *huge_pte_offset(struct mm_struct *mm,
+ {
+ pgd_t *pgd;
+ p4d_t *p4d;
+- pud_t *pud;
+- pmd_t *pmd;
++ pud_t *pud, pud_entry;
++ pmd_t *pmd, pmd_entry;
+
+ pgd = pgd_offset(mm, addr);
+ if (!pgd_present(*pgd))
+@@ -4831,17 +4831,19 @@ pte_t *huge_pte_offset(struct mm_struct *mm,
+ return NULL;
+
+ pud = pud_offset(p4d, addr);
+- if (sz != PUD_SIZE && pud_none(*pud))
++ pud_entry = READ_ONCE(*pud);
++ if (sz != PUD_SIZE && pud_none(pud_entry))
+ return NULL;
+ /* hugepage or swap? */
+- if (pud_huge(*pud) || !pud_present(*pud))
++ if (pud_huge(pud_entry) || !pud_present(pud_entry))
+ return (pte_t *)pud;
+
+ pmd = pmd_offset(pud, addr);
+- if (sz != PMD_SIZE && pmd_none(*pmd))
++ pmd_entry = READ_ONCE(*pmd);
++ if (sz != PMD_SIZE && pmd_none(pmd_entry))
+ return NULL;
+ /* hugepage or swap? */
+- if (pmd_huge(*pmd) || !pmd_present(*pmd))
++ if (pmd_huge(pmd_entry) || !pmd_present(pmd_entry))
+ return (pte_t *)pmd;
+
+ return NULL;
+diff --git a/mm/ksm.c b/mm/ksm.c
+index b3ea0f0316eb..d021bcf94c41 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -2106,8 +2106,16 @@ static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item)
+
+ down_read(&mm->mmap_sem);
+ vma = find_mergeable_vma(mm, rmap_item->address);
+- err = try_to_merge_one_page(vma, page,
+- ZERO_PAGE(rmap_item->address));
++ if (vma) {
++ err = try_to_merge_one_page(vma, page,
++ ZERO_PAGE(rmap_item->address));
++ } else {
++ /*
++ * If the vma is out of date, we do not need to
++ * continue.
++ */
++ err = 0;
++ }
+ up_read(&mm->mmap_sem);
+ /*
+ * In case of failure, the page was not really empty, so we
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index be65161f9753..11d0f0b6ec79 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -31,6 +31,7 @@
+ #include <linux/compiler.h>
+ #include <linux/llist.h>
+ #include <linux/bitops.h>
++#include <linux/overflow.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/tlbflush.h>
+@@ -2228,6 +2229,7 @@ finished:
+ * @vma: vma to cover
+ * @uaddr: target user address to start at
+ * @kaddr: virtual address of vmalloc kernel memory
++ * @pgoff: offset from @kaddr to start at
+ * @size: size of map area
+ *
+ * Returns: 0 for success, -Exxx on failure
+@@ -2240,9 +2242,15 @@ finished:
+ * Similar to remap_pfn_range() (see mm/memory.c)
+ */
+ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
+- void *kaddr, unsigned long size)
++ void *kaddr, unsigned long pgoff,
++ unsigned long size)
+ {
+ struct vm_struct *area;
++ unsigned long off;
++ unsigned long end_index;
++
++ if (check_shl_overflow(pgoff, PAGE_SHIFT, &off))
++ return -EINVAL;
+
+ size = PAGE_ALIGN(size);
+
+@@ -2256,8 +2264,10 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
+ if (!(area->flags & VM_USERMAP))
+ return -EINVAL;
+
+- if (kaddr + size > area->addr + get_vm_area_size(area))
++ if (check_add_overflow(size, off, &end_index) ||
++ end_index > get_vm_area_size(area))
+ return -EINVAL;
++ kaddr += off;
+
+ do {
+ struct page *page = vmalloc_to_page(kaddr);
+@@ -2296,7 +2306,7 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
+ unsigned long pgoff)
+ {
+ return remap_vmalloc_range_partial(vma, vma->vm_start,
+- addr + (pgoff << PAGE_SHIFT),
++ addr, pgoff,
+ vma->vm_end - vma->vm_start);
+ }
+ EXPORT_SYMBOL(remap_vmalloc_range);
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 58a401e9cf09..b438bed6749d 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -211,7 +211,7 @@ static int dccp_v6_send_response(const struct sock *sk, struct request_sock *req
+ final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final);
+ rcu_read_unlock();
+
+- dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
+ if (IS_ERR(dst)) {
+ err = PTR_ERR(dst);
+ dst = NULL;
+@@ -282,7 +282,7 @@ static void dccp_v6_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb)
+ security_skb_classify_flow(rxskb, flowi6_to_flowi(&fl6));
+
+ /* sk = NULL, but it is safe for now. RST socket required. */
+- dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
++ dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);
+ if (!IS_ERR(dst)) {
+ skb_dst_set(skb, dst);
+ ip6_xmit(ctl_sk, skb, &fl6, 0, NULL, 0);
+@@ -912,7 +912,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+ opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
+ final_p = fl6_update_dst(&fl6, opt, &final);
+
+- dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
+ if (IS_ERR(dst)) {
+ err = PTR_ERR(dst);
+ goto failure;
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index ccb1d97dfa05..d4c4eabd02b6 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -677,10 +677,8 @@ static int __init vti_init(void)
+
+ msg = "ipip tunnel";
+ err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
+- if (err < 0) {
+- pr_info("%s: cant't register tunnel\n",__func__);
++ if (err < 0)
+ goto xfrm_tunnel_failed;
+- }
+
+ msg = "netlink interface";
+ err = rtnl_link_register(&vti_link_ops);
+diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
+index be980c195fc5..510d2ec4c76a 100644
+--- a/net/ipv4/xfrm4_output.c
++++ b/net/ipv4/xfrm4_output.c
+@@ -77,9 +77,7 @@ int xfrm4_output_finish(struct sock *sk, struct sk_buff *skb)
+ {
+ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+
+-#ifdef CONFIG_NETFILTER
+ IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
+-#endif
+
+ return xfrm_output(sk, skb);
+ }
+diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
+index 5cd0029d930e..66a1a0eb2ed0 100644
+--- a/net/ipv6/addrconf_core.c
++++ b/net/ipv6/addrconf_core.c
+@@ -127,11 +127,12 @@ int inet6addr_validator_notifier_call_chain(unsigned long val, void *v)
+ }
+ EXPORT_SYMBOL(inet6addr_validator_notifier_call_chain);
+
+-static int eafnosupport_ipv6_dst_lookup(struct net *net, struct sock *u1,
+- struct dst_entry **u2,
+- struct flowi6 *u3)
++static struct dst_entry *eafnosupport_ipv6_dst_lookup_flow(struct net *net,
++ const struct sock *sk,
++ struct flowi6 *fl6,
++ const struct in6_addr *final_dst)
+ {
+- return -EAFNOSUPPORT;
++ return ERR_PTR(-EAFNOSUPPORT);
+ }
+
+ static struct fib6_table *eafnosupport_fib6_get_table(struct net *net, u32 id)
+@@ -169,7 +170,7 @@ eafnosupport_ip6_mtu_from_fib6(struct fib6_info *f6i, struct in6_addr *daddr,
+ }
+
+ const struct ipv6_stub *ipv6_stub __read_mostly = &(struct ipv6_stub) {
+- .ipv6_dst_lookup = eafnosupport_ipv6_dst_lookup,
++ .ipv6_dst_lookup_flow = eafnosupport_ipv6_dst_lookup_flow,
+ .fib6_get_table = eafnosupport_fib6_get_table,
+ .fib6_table_lookup = eafnosupport_fib6_table_lookup,
+ .fib6_lookup = eafnosupport_fib6_lookup,
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index 79fcd9550fd2..5c2351deedc8 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -740,7 +740,7 @@ int inet6_sk_rebuild_header(struct sock *sk)
+ &final);
+ rcu_read_unlock();
+
+- dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
+ if (IS_ERR(dst)) {
+ sk->sk_route_caps = 0;
+ sk->sk_err_soft = -PTR_ERR(dst);
+@@ -904,7 +904,7 @@ static struct pernet_operations inet6_net_ops = {
+ static const struct ipv6_stub ipv6_stub_impl = {
+ .ipv6_sock_mc_join = ipv6_sock_mc_join,
+ .ipv6_sock_mc_drop = ipv6_sock_mc_drop,
+- .ipv6_dst_lookup = ip6_dst_lookup,
++ .ipv6_dst_lookup_flow = ip6_dst_lookup_flow,
+ .fib6_get_table = fib6_get_table,
+ .fib6_table_lookup = fib6_table_lookup,
+ .fib6_lookup = fib6_lookup,
+diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
+index 971a0fdf1fbc..727f958dd869 100644
+--- a/net/ipv6/datagram.c
++++ b/net/ipv6/datagram.c
+@@ -89,7 +89,7 @@ int ip6_datagram_dst_update(struct sock *sk, bool fix_sk_saddr)
+ final_p = fl6_update_dst(&fl6, opt, &final);
+ rcu_read_unlock();
+
+- dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
+ if (IS_ERR(dst)) {
+ err = PTR_ERR(dst);
+ goto out;
+diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
+index 890adadcda16..92fe9e565da0 100644
+--- a/net/ipv6/inet6_connection_sock.c
++++ b/net/ipv6/inet6_connection_sock.c
+@@ -52,7 +52,7 @@ struct dst_entry *inet6_csk_route_req(const struct sock *sk,
+ fl6->flowi6_uid = sk->sk_uid;
+ security_req_classify_flow(req, flowi6_to_flowi(fl6));
+
+- dst = ip6_dst_lookup_flow(sk, fl6, final_p);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_p);
+ if (IS_ERR(dst))
+ return NULL;
+
+@@ -107,7 +107,7 @@ static struct dst_entry *inet6_csk_route_socket(struct sock *sk,
+
+ dst = __inet6_csk_dst_check(sk, np->dst_cookie);
+ if (!dst) {
+- dst = ip6_dst_lookup_flow(sk, fl6, final_p);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_p);
+
+ if (!IS_ERR(dst))
+ ip6_dst_store(sk, dst, NULL, NULL);
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 9886a84c2511..22665e3638ac 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1071,19 +1071,19 @@ EXPORT_SYMBOL_GPL(ip6_dst_lookup);
+ * It returns a valid dst pointer on success, or a pointer encoded
+ * error code.
+ */
+-struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6,
++struct dst_entry *ip6_dst_lookup_flow(struct net *net, const struct sock *sk, struct flowi6 *fl6,
+ const struct in6_addr *final_dst)
+ {
+ struct dst_entry *dst = NULL;
+ int err;
+
+- err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
++ err = ip6_dst_lookup_tail(net, sk, &dst, fl6);
+ if (err)
+ return ERR_PTR(err);
+ if (final_dst)
+ fl6->daddr = *final_dst;
+
+- return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
++ return xfrm_lookup_route(net, dst, flowi6_to_flowi(fl6), sk, 0);
+ }
+ EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
+
+@@ -1115,7 +1115,7 @@ struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
+ if (dst)
+ return dst;
+
+- dst = ip6_dst_lookup_flow(sk, fl6, final_dst);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_dst);
+ if (connected && !IS_ERR(dst))
+ ip6_sk_dst_store_flow(sk, dst_clone(dst), fl6);
+
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index a20be08f0e0b..231c489128e4 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -185,15 +185,14 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ retv = -EBUSY;
+ break;
+ }
+- } else if (sk->sk_protocol == IPPROTO_TCP) {
+- if (sk->sk_prot != &tcpv6_prot) {
+- retv = -EBUSY;
+- break;
+- }
+- break;
+- } else {
++ }
++ if (sk->sk_protocol == IPPROTO_TCP &&
++ sk->sk_prot != &tcpv6_prot) {
++ retv = -EBUSY;
+ break;
+ }
++ if (sk->sk_protocol != IPPROTO_TCP)
++ break;
+ if (sk->sk_state != TCP_ESTABLISHED) {
+ retv = -ENOTCONN;
+ break;
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index a41156a00dd4..8d19729f8516 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -928,7 +928,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+
+ fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
+
+- dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
+ if (IS_ERR(dst)) {
+ err = PTR_ERR(dst);
+ goto out;
+diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
+index e997141aed8c..a377be8a9fb4 100644
+--- a/net/ipv6/syncookies.c
++++ b/net/ipv6/syncookies.c
+@@ -240,7 +240,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
+ fl6.flowi6_uid = sk->sk_uid;
+ security_req_classify_flow(req, flowi6_to_flowi(&fl6));
+
+- dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
+ if (IS_ERR(dst))
+ goto out_free;
+ }
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 7b0c2498f461..2e76ebfdc907 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -268,7 +268,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+
+ security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+
+- dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
+ if (IS_ERR(dst)) {
+ err = PTR_ERR(dst);
+ goto failure;
+@@ -885,7 +885,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
+ * Underlying function will use this to retrieve the network
+ * namespace
+ */
+- dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
++ dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);
+ if (!IS_ERR(dst)) {
+ skb_dst_set(buff, dst);
+ ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
+diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
+index 6a74080005cf..71d022704923 100644
+--- a/net/ipv6/xfrm6_output.c
++++ b/net/ipv6/xfrm6_output.c
+@@ -130,9 +130,7 @@ int xfrm6_output_finish(struct sock *sk, struct sk_buff *skb)
+ {
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+
+-#ifdef CONFIG_NETFILTER
+ IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
+-#endif
+
+ return xfrm_output(sk, skb);
+ }
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index 37a69df17cab..2f28f9910b92 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -619,7 +619,7 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+
+ fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
+
+- dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
+ if (IS_ERR(dst)) {
+ err = PTR_ERR(dst);
+ goto out;
+diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
+index d5a4db5b3fe7..7623d9aec636 100644
+--- a/net/mpls/af_mpls.c
++++ b/net/mpls/af_mpls.c
+@@ -618,16 +618,15 @@ static struct net_device *inet6_fib_lookup_dev(struct net *net,
+ struct net_device *dev;
+ struct dst_entry *dst;
+ struct flowi6 fl6;
+- int err;
+
+ if (!ipv6_stub)
+ return ERR_PTR(-EAFNOSUPPORT);
+
+ memset(&fl6, 0, sizeof(fl6));
+ memcpy(&fl6.daddr, addr, sizeof(struct in6_addr));
+- err = ipv6_stub->ipv6_dst_lookup(net, NULL, &dst, &fl6);
+- if (err)
+- return ERR_PTR(err);
++ dst = ipv6_stub->ipv6_dst_lookup_flow(net, NULL, &fl6, NULL);
++ if (IS_ERR(dst))
++ return ERR_CAST(dst);
+
+ dev = dst->dev;
+ dev_hold(dev);
+diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
+index b76aa668a94b..53ced34a1fdd 100644
+--- a/net/netrom/nr_route.c
++++ b/net/netrom/nr_route.c
+@@ -211,6 +211,7 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,
+ /* refcount initialized at 1 */
+ spin_unlock_bh(&nr_node_list_lock);
+
++ nr_neigh_put(nr_neigh);
+ return 0;
+ }
+ nr_node_lock(nr_node);
+diff --git a/net/sched/sch_etf.c b/net/sched/sch_etf.c
+index 1538d6fa8165..2278f3d420cd 100644
+--- a/net/sched/sch_etf.c
++++ b/net/sched/sch_etf.c
+@@ -77,7 +77,7 @@ static bool is_packet_valid(struct Qdisc *sch, struct sk_buff *nskb)
+ struct sock *sk = nskb->sk;
+ ktime_t now;
+
+- if (!sk)
++ if (!sk || !sk_fullsock(sk))
+ return false;
+
+ if (!sock_flag(sk, SOCK_TXTIME))
+@@ -129,8 +129,9 @@ static void report_sock_error(struct sk_buff *skb, u32 err, u8 code)
+ struct sock_exterr_skb *serr;
+ struct sk_buff *clone;
+ ktime_t txtime = skb->tstamp;
++ struct sock *sk = skb->sk;
+
+- if (!skb->sk || !(skb->sk->sk_txtime_report_errors))
++ if (!sk || !sk_fullsock(sk) || !(sk->sk_txtime_report_errors))
+ return;
+
+ clone = skb_clone(skb, GFP_ATOMIC);
+@@ -146,7 +147,7 @@ static void report_sock_error(struct sk_buff *skb, u32 err, u8 code)
+ serr->ee.ee_data = (txtime >> 32); /* high part of tstamp */
+ serr->ee.ee_info = txtime; /* low part of tstamp */
+
+- if (sock_queue_err_skb(skb->sk, clone))
++ if (sock_queue_err_skb(sk, clone))
+ kfree_skb(clone);
+ }
+
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 7657194f396e..736d8ca9821b 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -288,7 +288,7 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);
+ rcu_read_unlock();
+
+- dst = ip6_dst_lookup_flow(sk, fl6, final_p);
++ dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_p);
+ if (!asoc || saddr) {
+ t->dst = dst;
+ memcpy(fl, &_fl, sizeof(_fl));
+@@ -346,7 +346,7 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ fl6->saddr = laddr->a.v6.sin6_addr;
+ fl6->fl6_sport = laddr->a.v6.sin6_port;
+ final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);
+- bdst = ip6_dst_lookup_flow(sk, fl6, final_p);
++ bdst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_p);
+
+ if (IS_ERR(bdst))
+ continue;
+diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
+index 382c84d9339d..1d6235479706 100644
+--- a/net/tipc/udp_media.c
++++ b/net/tipc/udp_media.c
+@@ -189,10 +189,13 @@ static int tipc_udp_xmit(struct net *net, struct sk_buff *skb,
+ .saddr = src->ipv6,
+ .flowi6_proto = IPPROTO_UDP
+ };
+- err = ipv6_stub->ipv6_dst_lookup(net, ub->ubsock->sk, &ndst,
+- &fl6);
+- if (err)
++ ndst = ipv6_stub->ipv6_dst_lookup_flow(net,
++ ub->ubsock->sk,
++ &fl6, NULL);
++ if (IS_ERR(ndst)) {
++ err = PTR_ERR(ndst);
+ goto tx_error;
++ }
+ ttl = ip6_dst_hoplimit(ndst);
+ err = udp_tunnel6_xmit_skb(ndst, ub->ubsock->sk, skb, NULL,
+ &src->ipv6, &dst->ipv6, 0, ttl, 0,
+diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
+index 39231237e1c3..30f71620d4e3 100644
+--- a/net/x25/x25_dev.c
++++ b/net/x25/x25_dev.c
+@@ -120,8 +120,10 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev,
+ goto drop;
+ }
+
+- if (!pskb_may_pull(skb, 1))
++ if (!pskb_may_pull(skb, 1)) {
++ x25_neigh_put(nb);
+ return 0;
++ }
+
+ switch (skb->data[0]) {
+
+diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
+index 96e7969c473a..d774717cd906 100644
+--- a/samples/vfio-mdev/mdpy.c
++++ b/samples/vfio-mdev/mdpy.c
+@@ -418,7 +418,7 @@ static int mdpy_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
+ return -EINVAL;
+
+ return remap_vmalloc_range_partial(vma, vma->vm_start,
+- mdev_state->memblk,
++ mdev_state->memblk, 0,
+ vma->vm_end - vma->vm_start);
+ }
+
+diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
+index ef4310f2558b..8f004db6f603 100644
+--- a/scripts/kconfig/qconf.cc
++++ b/scripts/kconfig/qconf.cc
+@@ -627,7 +627,7 @@ void ConfigList::updateMenuList(ConfigItem *parent, struct menu* menu)
+ last = item;
+ continue;
+ }
+- hide:
++hide:
+ if (item && item->menu == child) {
+ last = parent->firstChild();
+ if (last == item)
+@@ -692,7 +692,7 @@ void ConfigList::updateMenuList(ConfigList *parent, struct menu* menu)
+ last = item;
+ continue;
+ }
+- hide:
++hide:
+ if (item && item->menu == child) {
+ last = (ConfigItem*)parent->topLevelItem(0);
+ if (last == item)
+@@ -1225,10 +1225,11 @@ QMenu* ConfigInfoView::createStandardContextMenu(const QPoint & pos)
+ {
+ QMenu* popup = Parent::createStandardContextMenu(pos);
+ QAction* action = new QAction("Show Debug Info", popup);
+- action->setCheckable(true);
+- connect(action, SIGNAL(toggled(bool)), SLOT(setShowDebug(bool)));
+- connect(this, SIGNAL(showDebugChanged(bool)), action, SLOT(setOn(bool)));
+- action->setChecked(showDebug());
++
++ action->setCheckable(true);
++ connect(action, SIGNAL(toggled(bool)), SLOT(setShowDebug(bool)));
++ connect(this, SIGNAL(showDebugChanged(bool)), action, SLOT(setOn(bool)));
++ action->setChecked(showDebug());
+ popup->addSeparator();
+ popup->addAction(action);
+ return popup;
+diff --git a/security/keys/internal.h b/security/keys/internal.h
+index a02742621c8d..eb50212fbbf8 100644
+--- a/security/keys/internal.h
++++ b/security/keys/internal.h
+@@ -20,6 +20,8 @@
+ #include <linux/keyctl.h>
+ #include <linux/refcount.h>
+ #include <linux/compat.h>
++#include <linux/mm.h>
++#include <linux/vmalloc.h>
+
+ struct iovec;
+
+@@ -305,4 +307,14 @@ static inline void key_check(const struct key *key)
+
+ #endif
+
++/*
++ * Helper function to clear and free a kvmalloc'ed memory object.
++ */
++static inline void __kvzfree(const void *addr, size_t len)
++{
++ if (addr) {
++ memset((void *)addr, 0, len);
++ kvfree(addr);
++ }
++}
+ #endif /* _INTERNAL_H */
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index 4b6a084e323b..c07c2e2b2478 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -330,7 +330,7 @@ long keyctl_update_key(key_serial_t id,
+ payload = NULL;
+ if (plen) {
+ ret = -ENOMEM;
+- payload = kmalloc(plen, GFP_KERNEL);
++ payload = kvmalloc(plen, GFP_KERNEL);
+ if (!payload)
+ goto error;
+
+@@ -351,7 +351,7 @@ long keyctl_update_key(key_serial_t id,
+
+ key_ref_put(key_ref);
+ error2:
+- kzfree(payload);
++ __kvzfree(payload, plen);
+ error:
+ return ret;
+ }
+@@ -772,7 +772,8 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
+ struct key *key;
+ key_ref_t key_ref;
+ long ret;
+- char *key_data;
++ char *key_data = NULL;
++ size_t key_data_len;
+
+ /* find the key first */
+ key_ref = lookup_user_key(keyid, 0, 0);
+@@ -823,24 +824,51 @@ can_read_key:
+ * Allocating a temporary buffer to hold the keys before
+ * transferring them to user buffer to avoid potential
+ * deadlock involving page fault and mmap_sem.
++ *
++ * key_data_len = (buflen <= PAGE_SIZE)
++ * ? buflen : actual length of key data
++ *
++ * This prevents allocating arbitrary large buffer which can
++ * be much larger than the actual key length. In the latter case,
++ * at least 2 passes of this loop is required.
+ */
+- key_data = kmalloc(buflen, GFP_KERNEL);
++ key_data_len = (buflen <= PAGE_SIZE) ? buflen : 0;
++ for (;;) {
++ if (key_data_len) {
++ key_data = kvmalloc(key_data_len, GFP_KERNEL);
++ if (!key_data) {
++ ret = -ENOMEM;
++ goto key_put_out;
++ }
++ }
+
+- if (!key_data) {
+- ret = -ENOMEM;
+- goto key_put_out;
+- }
+- ret = __keyctl_read_key(key, key_data, buflen);
++ ret = __keyctl_read_key(key, key_data, key_data_len);
++
++ /*
++ * Read methods will just return the required length without
++ * any copying if the provided length isn't large enough.
++ */
++ if (ret <= 0 || ret > buflen)
++ break;
++
++ /*
++ * The key may change (unlikely) in between 2 consecutive
++ * __keyctl_read_key() calls. In this case, we reallocate
++ * a larger buffer and redo the key read when
++ * key_data_len < ret <= buflen.
++ */
++ if (ret > key_data_len) {
++ if (unlikely(key_data))
++ __kvzfree(key_data, key_data_len);
++ key_data_len = ret;
++ continue; /* Allocate buffer */
++ }
+
+- /*
+- * Read methods will just return the required length without
+- * any copying if the provided length isn't large enough.
+- */
+- if (ret > 0 && ret <= buflen) {
+ if (copy_to_user(buffer, key_data, ret))
+ ret = -EFAULT;
++ break;
+ }
+- kzfree(key_data);
++ __kvzfree(key_data, key_data_len);
+
+ key_put_out:
+ key_put(key);
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 54a9b391ecce..0502042c1616 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2215,7 +2215,6 @@ static const struct hdac_io_ops pci_hda_io_ops = {
+ * should be ignored from the beginning.
+ */
+ static const struct snd_pci_quirk driver_blacklist[] = {
+- SND_PCI_QUIRK(0x1043, 0x874f, "ASUS ROG Zenith II / Strix", 0),
+ SND_PCI_QUIRK(0x1462, 0xcb59, "MSI TRX40 Creator", 0),
+ SND_PCI_QUIRK(0x1462, 0xcb60, "MSI TRX40", 0),
+ {}
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index ea439bee8e6f..9620a8461d91 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -380,6 +380,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0233:
+ case 0x10ec0235:
+ case 0x10ec0236:
++ case 0x10ec0245:
+ case 0x10ec0255:
+ case 0x10ec0256:
+ case 0x10ec0257:
+@@ -801,9 +802,11 @@ static void alc_ssid_check(struct hda_codec *codec, const hda_nid_t *ports)
+ {
+ if (!alc_subsystem_id(codec, ports)) {
+ struct alc_spec *spec = codec->spec;
+- codec_dbg(codec,
+- "realtek: Enable default setup for auto mode as fallback\n");
+- spec->init_amp = ALC_INIT_DEFAULT;
++ if (spec->init_amp == ALC_INIT_UNDEFINED) {
++ codec_dbg(codec,
++ "realtek: Enable default setup for auto mode as fallback\n");
++ spec->init_amp = ALC_INIT_DEFAULT;
++ }
+ }
+ }
+
+@@ -7790,6 +7793,7 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->gen.mixer_nid = 0;
+ break;
+ case 0x10ec0215:
++ case 0x10ec0245:
+ case 0x10ec0285:
+ case 0x10ec0289:
+ spec->codec_variant = ALC269_TYPE_ALC215;
+@@ -8911,6 +8915,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ HDA_CODEC_ENTRY(0x10ec0234, "ALC234", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0235, "ALC233", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0236, "ALC236", patch_alc269),
++ HDA_CODEC_ENTRY(0x10ec0245, "ALC245", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0255, "ALC255", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0256, "ALC256", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0257, "ALC257", patch_alc269),
+diff --git a/sound/soc/intel/atom/sst-atom-controls.c b/sound/soc/intel/atom/sst-atom-controls.c
+index 737f5d553313..a1d7f93a0805 100644
+--- a/sound/soc/intel/atom/sst-atom-controls.c
++++ b/sound/soc/intel/atom/sst-atom-controls.c
+@@ -974,7 +974,9 @@ static int sst_set_be_modules(struct snd_soc_dapm_widget *w,
+ dev_dbg(c->dev, "Enter: widget=%s\n", w->name);
+
+ if (SND_SOC_DAPM_EVENT_ON(event)) {
++ mutex_lock(&drv->lock);
+ ret = sst_send_slot_map(drv);
++ mutex_unlock(&drv->lock);
+ if (ret)
+ return ret;
+ ret = sst_send_pipe_module_params(w, k);
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index e58240e18b30..f29014a7d672 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -588,6 +588,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ {
++ /* MPMAN MPWIN895CL */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MPMAN"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MPWIN8900CL"),
++ },
++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS |
++ BYT_RT5640_MONO_SPEAKER |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ { /* MSI S100 tablet */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Micro-Star International Co., Ltd."),
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index d61e954417d0..96800b7c82f6 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -410,7 +410,7 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
+
+ memset(&template, 0, sizeof(template));
+ template.reg = e->reg;
+- template.mask = e->mask << e->shift_l;
++ template.mask = e->mask;
+ template.shift = e->shift_l;
+ template.off_val = snd_soc_enum_item_to_val(e, 0);
+ template.on_val = template.off_val;
+@@ -536,8 +536,22 @@ static bool dapm_kcontrol_set_value(const struct snd_kcontrol *kcontrol,
+ if (data->value == value)
+ return false;
+
+- if (data->widget)
+- data->widget->on_val = value;
++ if (data->widget) {
++ switch (dapm_kcontrol_get_wlist(kcontrol)->widgets[0]->id) {
++ case snd_soc_dapm_switch:
++ case snd_soc_dapm_mixer:
++ case snd_soc_dapm_mixer_named_ctl:
++ data->widget->on_val = value & data->widget->mask;
++ break;
++ case snd_soc_dapm_demux:
++ case snd_soc_dapm_mux:
++ data->widget->on_val = value >> data->widget->shift;
++ break;
++ default:
++ data->widget->on_val = value;
++ break;
++ }
++ }
+
+ data->value = value;
+
+diff --git a/sound/usb/format.c b/sound/usb/format.c
+index 9d27429ed403..c8207b52c651 100644
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -237,6 +237,52 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof
+ return 0;
+ }
+
++/*
++ * Many Focusrite devices supports a limited set of sampling rates per
++ * altsetting. Maximum rate is exposed in the last 4 bytes of Format Type
++ * descriptor which has a non-standard bLength = 10.
++ */
++static bool focusrite_valid_sample_rate(struct snd_usb_audio *chip,
++ struct audioformat *fp,
++ unsigned int rate)
++{
++ struct usb_interface *iface;
++ struct usb_host_interface *alts;
++ unsigned char *fmt;
++ unsigned int max_rate;
++
++ iface = usb_ifnum_to_if(chip->dev, fp->iface);
++ if (!iface)
++ return true;
++
++ alts = &iface->altsetting[fp->altset_idx];
++ fmt = snd_usb_find_csint_desc(alts->extra, alts->extralen,
++ NULL, UAC_FORMAT_TYPE);
++ if (!fmt)
++ return true;
++
++ if (fmt[0] == 10) { /* bLength */
++ max_rate = combine_quad(&fmt[6]);
++
++ /* Validate max rate */
++ if (max_rate != 48000 &&
++ max_rate != 96000 &&
++ max_rate != 192000 &&
++ max_rate != 384000) {
++
++ usb_audio_info(chip,
++ "%u:%d : unexpected max rate: %u\n",
++ fp->iface, fp->altsetting, max_rate);
++
++ return true;
++ }
++
++ return rate <= max_rate;
++ }
++
++ return true;
++}
++
+ /*
+ * Helper function to walk the array of sample rate triplets reported by
+ * the device. The problem is that we need to parse whole array first to
+@@ -273,6 +319,11 @@ static int parse_uac2_sample_rate_range(struct snd_usb_audio *chip,
+ }
+
+ for (rate = min; rate <= max; rate += res) {
++ /* Filter out invalid rates on Focusrite devices */
++ if (USB_ID_VENDOR(chip->usb_id) == 0x1235 &&
++ !focusrite_valid_sample_rate(chip, fp, rate))
++ goto skip_rate;
++
+ if (fp->rate_table)
+ fp->rate_table[nr_rates] = rate;
+ if (!fp->rate_min || rate < fp->rate_min)
+@@ -287,6 +338,7 @@ static int parse_uac2_sample_rate_range(struct snd_usb_audio *chip,
+ break;
+ }
+
++skip_rate:
+ /* avoid endless loop */
+ if (res == 0)
+ break;
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 257da95a4ea6..7a5c665cf4e4 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1770,8 +1770,10 @@ static void build_connector_control(struct usb_mixer_interface *mixer,
+ {
+ struct snd_kcontrol *kctl;
+ struct usb_mixer_elem_info *cval;
++ const struct usbmix_name_map *map;
+
+- if (check_ignored_ctl(find_map(imap, term->id, 0)))
++ map = find_map(imap, term->id, 0);
++ if (check_ignored_ctl(map))
+ return;
+
+ cval = kzalloc(sizeof(*cval), GFP_KERNEL);
+@@ -1803,8 +1805,12 @@ static void build_connector_control(struct usb_mixer_interface *mixer,
+ usb_mixer_elem_info_free(cval);
+ return;
+ }
+- get_connector_control_name(mixer, term, is_input, kctl->id.name,
+- sizeof(kctl->id.name));
++
++ if (check_mapped_name(map, kctl->id.name, sizeof(kctl->id.name)))
++ strlcat(kctl->id.name, " Jack", sizeof(kctl->id.name));
++ else
++ get_connector_control_name(mixer, term, is_input, kctl->id.name,
++ sizeof(kctl->id.name));
+ kctl->private_free = snd_usb_mixer_elem_free;
+ snd_usb_mixer_add_control(&cval->head, kctl);
+ }
+@@ -3109,6 +3115,7 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ if (map->id == state.chip->usb_id) {
+ state.map = map->map;
+ state.selector_map = map->selector_map;
++ mixer->connector_map = map->connector_map;
+ mixer->ignore_ctl_error |= map->ignore_ctl_error;
+ break;
+ }
+@@ -3190,10 +3197,32 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
+ return 0;
+ }
+
++static int delegate_notify(struct usb_mixer_interface *mixer, int unitid,
++ u8 *control, u8 *channel)
++{
++ const struct usbmix_connector_map *map = mixer->connector_map;
++
++ if (!map)
++ return unitid;
++
++ for (; map->id; map++) {
++ if (map->id == unitid) {
++ if (control && map->control)
++ *control = map->control;
++ if (channel && map->channel)
++ *channel = map->channel;
++ return map->delegated_id;
++ }
++ }
++ return unitid;
++}
++
+ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid)
+ {
+ struct usb_mixer_elem_list *list;
+
++ unitid = delegate_notify(mixer, unitid, NULL, NULL);
++
+ for_each_mixer_elem(list, mixer, unitid) {
+ struct usb_mixer_elem_info *info =
+ mixer_elem_list_to_info(list);
+@@ -3263,6 +3292,8 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer,
+ return;
+ }
+
++ unitid = delegate_notify(mixer, unitid, &control, &channel);
++
+ for_each_mixer_elem(list, mixer, unitid)
+ count++;
+
+diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
+index 3d12af8bf191..15ec90e96d4d 100644
+--- a/sound/usb/mixer.h
++++ b/sound/usb/mixer.h
+@@ -4,6 +4,13 @@
+
+ #include <sound/info.h>
+
++struct usbmix_connector_map {
++ u8 id;
++ u8 delegated_id;
++ u8 control;
++ u8 channel;
++};
++
+ struct usb_mixer_interface {
+ struct snd_usb_audio *chip;
+ struct usb_host_interface *hostif;
+@@ -16,6 +23,9 @@ struct usb_mixer_interface {
+ /* the usb audio specification version this interface complies to */
+ int protocol;
+
++ /* optional connector delegation map */
++ const struct usbmix_connector_map *connector_map;
++
+ /* Sound Blaster remote control stuff */
+ const struct rc_config *rc_cfg;
+ u32 rc_code;
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index bf000e54461b..1689e4f242df 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -41,6 +41,7 @@ struct usbmix_ctl_map {
+ u32 id;
+ const struct usbmix_name_map *map;
+ const struct usbmix_selector_map *selector_map;
++ const struct usbmix_connector_map *connector_map;
+ int ignore_ctl_error;
+ };
+
+@@ -373,6 +374,33 @@ static const struct usbmix_name_map asus_rog_map[] = {
+ {}
+ };
+
++/* TRX40 mobos with Realtek ALC1220-VB */
++static const struct usbmix_name_map trx40_mobo_map[] = {
++ { 18, NULL }, /* OT, IEC958 - broken response, disabled */
++ { 19, NULL, 12 }, /* FU, Input Gain Pad - broken response, disabled */
++ { 16, "Speaker" }, /* OT */
++ { 22, "Speaker Playback" }, /* FU */
++ { 7, "Line" }, /* IT */
++ { 19, "Line Capture" }, /* FU */
++ { 17, "Front Headphone" }, /* OT */
++ { 23, "Front Headphone Playback" }, /* FU */
++ { 8, "Mic" }, /* IT */
++ { 20, "Mic Capture" }, /* FU */
++ { 9, "Front Mic" }, /* IT */
++ { 21, "Front Mic Capture" }, /* FU */
++ { 24, "IEC958 Playback" }, /* FU */
++ {}
++};
++
++static const struct usbmix_connector_map trx40_mobo_connector_map[] = {
++ { 10, 16 }, /* (Back) Speaker */
++ { 11, 17 }, /* Front Headphone */
++ { 13, 7 }, /* Line */
++ { 14, 8 }, /* Mic */
++ { 15, 9 }, /* Front Mic */
++ {}
++};
++
+ /*
+ * Control map entries
+ */
+@@ -494,7 +522,8 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ },
+ { /* Gigabyte TRX40 Aorus Pro WiFi */
+ .id = USB_ID(0x0414, 0xa002),
+- .map = asus_rog_map,
++ .map = trx40_mobo_map,
++ .connector_map = trx40_mobo_connector_map,
+ },
+ { /* ASUS ROG Zenith II */
+ .id = USB_ID(0x0b05, 0x1916),
+@@ -506,11 +535,13 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ },
+ { /* MSI TRX40 Creator */
+ .id = USB_ID(0x0db0, 0x0d64),
+- .map = asus_rog_map,
++ .map = trx40_mobo_map,
++ .connector_map = trx40_mobo_connector_map,
+ },
+ { /* MSI TRX40 */
+ .id = USB_ID(0x0db0, 0x543d),
+- .map = asus_rog_map,
++ .map = trx40_mobo_map,
++ .connector_map = trx40_mobo_connector_map,
+ },
+ { 0 } /* terminator */
+ };
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 10c6971cf477..983e8a3ebfcf 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -1519,11 +1519,15 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol,
+
+ /* use known values for that card: interface#1 altsetting#1 */
+ iface = usb_ifnum_to_if(chip->dev, 1);
+- if (!iface || iface->num_altsetting < 2)
+- return -EINVAL;
++ if (!iface || iface->num_altsetting < 2) {
++ err = -EINVAL;
++ goto end;
++ }
+ alts = &iface->altsetting[1];
+- if (get_iface_desc(alts)->bNumEndpoints < 1)
+- return -EINVAL;
++ if (get_iface_desc(alts)->bNumEndpoints < 1) {
++ err = -EINVAL;
++ goto end;
++ }
+ ep = get_endpoint(alts, 0)->bEndpointAddress;
+
+ err = snd_usb_ctl_msg(chip->dev,
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 90d4f61cc230..774aeedde071 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3400,4 +3400,18 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ }
+ },
+
++#define ALC1220_VB_DESKTOP(vend, prod) { \
++ USB_DEVICE(vend, prod), \
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { \
++ .vendor_name = "Realtek", \
++ .product_name = "ALC1220-VB-DT", \
++ .profile_name = "Realtek-ALC1220-VB-Desktop", \
++ .ifnum = QUIRK_NO_INTERFACE \
++ } \
++}
++ALC1220_VB_DESKTOP(0x0414, 0xa002), /* Gigabyte TRX40 Aorus Pro WiFi */
++ALC1220_VB_DESKTOP(0x0db0, 0x0d64), /* MSI TRX40 Creator */
++ALC1220_VB_DESKTOP(0x0db0, 0x543d), /* MSI TRX40 */
++#undef ALC1220_VB_DESKTOP
++
+ #undef USB_DEVICE_VENDOR_SPEC
+diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
+index 2b833054e3b0..bdb28e0229e6 100644
+--- a/sound/usb/usx2y/usbusx2yaudio.c
++++ b/sound/usb/usx2y/usbusx2yaudio.c
+@@ -695,6 +695,8 @@ static int usX2Y_rate_set(struct usX2Ydev *usX2Y, int rate)
+ us->submitted = 2*NOOF_SETRATE_URBS;
+ for (i = 0; i < NOOF_SETRATE_URBS; ++i) {
+ struct urb *urb = us->urb[i];
++ if (!urb)
++ continue;
+ if (urb->status) {
+ if (!err)
+ err = -ENODEV;
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index ff0cc3c17141..1e7c619228a2 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -26,7 +26,7 @@ static void btf_dumper_ptr(const void *data, json_writer_t *jw,
+ bool is_plain_text)
+ {
+ if (is_plain_text)
+- jsonw_printf(jw, "%p", data);
++ jsonw_printf(jw, "%p", *(void **)data);
+ else
+ jsonw_printf(jw, "%lu", *(unsigned long *)data);
+ }
+diff --git a/tools/testing/selftests/ftrace/settings b/tools/testing/selftests/ftrace/settings
+new file mode 100644
+index 000000000000..e7b9417537fb
+--- /dev/null
++++ b/tools/testing/selftests/ftrace/settings
+@@ -0,0 +1 @@
++timeout=0
+diff --git a/tools/testing/selftests/kmod/kmod.sh b/tools/testing/selftests/kmod/kmod.sh
+index 0a76314b4414..1f118916a83e 100755
+--- a/tools/testing/selftests/kmod/kmod.sh
++++ b/tools/testing/selftests/kmod/kmod.sh
+@@ -505,18 +505,23 @@ function test_num()
+ fi
+ }
+
+-function get_test_count()
++function get_test_data()
+ {
+ test_num $1
+- TEST_DATA=$(echo $ALL_TESTS | awk '{print $'$1'}')
++ local field_num=$(echo $1 | sed 's/^0*//')
++ echo $ALL_TESTS | awk '{print $'$field_num'}'
++}
++
++function get_test_count()
++{
++ TEST_DATA=$(get_test_data $1)
+ LAST_TWO=${TEST_DATA#*:*}
+ echo ${LAST_TWO%:*}
+ }
+
+ function get_test_enabled()
+ {
+- test_num $1
+- TEST_DATA=$(echo $ALL_TESTS | awk '{print $'$1'}')
++ TEST_DATA=$(get_test_data $1)
+ echo ${TEST_DATA#*:*:}
+ }
+
+diff --git a/tools/vm/Makefile b/tools/vm/Makefile
+index 20f6cf04377f..9860622cbb15 100644
+--- a/tools/vm/Makefile
++++ b/tools/vm/Makefile
+@@ -1,6 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Makefile for vm tools
+ #
++include ../scripts/Makefile.include
++
+ TARGETS=page-types slabinfo page_owner_sort
+
+ LIB_DIR = ../lib/api
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 4e499b78569b..aca15bd1cc4c 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -52,9 +52,9 @@
+ #include <linux/sort.h>
+ #include <linux/bsearch.h>
+ #include <linux/kthread.h>
++#include <linux/io.h>
+
+ #include <asm/processor.h>
+-#include <asm/io.h>
+ #include <asm/ioctl.h>
+ #include <linux/uaccess.h>
+ #include <asm/pgtable.h>
+@@ -1705,6 +1705,153 @@ struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn)
+ }
+ EXPORT_SYMBOL_GPL(gfn_to_page);
+
++void kvm_release_pfn(kvm_pfn_t pfn, bool dirty, struct gfn_to_pfn_cache *cache)
++{
++ if (pfn == 0)
++ return;
++
++ if (cache)
++ cache->pfn = cache->gfn = 0;
++
++ if (dirty)
++ kvm_release_pfn_dirty(pfn);
++ else
++ kvm_release_pfn_clean(pfn);
++}
++
++static void kvm_cache_gfn_to_pfn(struct kvm_memory_slot *slot, gfn_t gfn,
++ struct gfn_to_pfn_cache *cache, u64 gen)
++{
++ kvm_release_pfn(cache->pfn, cache->dirty, cache);
++
++ cache->pfn = gfn_to_pfn_memslot(slot, gfn);
++ cache->gfn = gfn;
++ cache->dirty = false;
++ cache->generation = gen;
++}
++
++static int __kvm_map_gfn(struct kvm_memslots *slots, gfn_t gfn,
++ struct kvm_host_map *map,
++ struct gfn_to_pfn_cache *cache,
++ bool atomic)
++{
++ kvm_pfn_t pfn;
++ void *hva = NULL;
++ struct page *page = KVM_UNMAPPED_PAGE;
++ struct kvm_memory_slot *slot = __gfn_to_memslot(slots, gfn);
++ u64 gen = slots->generation;
++
++ if (!map)
++ return -EINVAL;
++
++ if (cache) {
++ if (!cache->pfn || cache->gfn != gfn ||
++ cache->generation != gen) {
++ if (atomic)
++ return -EAGAIN;
++ kvm_cache_gfn_to_pfn(slot, gfn, cache, gen);
++ }
++ pfn = cache->pfn;
++ } else {
++ if (atomic)
++ return -EAGAIN;
++ pfn = gfn_to_pfn_memslot(slot, gfn);
++ }
++ if (is_error_noslot_pfn(pfn))
++ return -EINVAL;
++
++ if (pfn_valid(pfn)) {
++ page = pfn_to_page(pfn);
++ if (atomic)
++ hva = kmap_atomic(page);
++ else
++ hva = kmap(page);
++#ifdef CONFIG_HAS_IOMEM
++ } else if (!atomic) {
++ hva = memremap(pfn_to_hpa(pfn), PAGE_SIZE, MEMREMAP_WB);
++ } else {
++ return -EINVAL;
++#endif
++ }
++
++ if (!hva)
++ return -EFAULT;
++
++ map->page = page;
++ map->hva = hva;
++ map->pfn = pfn;
++ map->gfn = gfn;
++
++ return 0;
++}
++
++int kvm_map_gfn(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map,
++ struct gfn_to_pfn_cache *cache, bool atomic)
++{
++ return __kvm_map_gfn(kvm_memslots(vcpu->kvm), gfn, map,
++ cache, atomic);
++}
++EXPORT_SYMBOL_GPL(kvm_map_gfn);
++
++int kvm_vcpu_map(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map)
++{
++ return __kvm_map_gfn(kvm_vcpu_memslots(vcpu), gfn, map,
++ NULL, false);
++}
++EXPORT_SYMBOL_GPL(kvm_vcpu_map);
++
++static void __kvm_unmap_gfn(struct kvm_memory_slot *memslot,
++ struct kvm_host_map *map,
++ struct gfn_to_pfn_cache *cache,
++ bool dirty, bool atomic)
++{
++ if (!map)
++ return;
++
++ if (!map->hva)
++ return;
++
++ if (map->page != KVM_UNMAPPED_PAGE) {
++ if (atomic)
++ kunmap_atomic(map->hva);
++ else
++ kunmap(map->page);
++ }
++#ifdef CONFIG_HAS_IOMEM
++ else if (!atomic)
++ memunmap(map->hva);
++ else
++ WARN_ONCE(1, "Unexpected unmapping in atomic context");
++#endif
++
++ if (dirty)
++ mark_page_dirty_in_slot(memslot, map->gfn);
++
++ if (cache)
++ cache->dirty |= dirty;
++ else
++ kvm_release_pfn(map->pfn, dirty, NULL);
++
++ map->hva = NULL;
++ map->page = NULL;
++}
++
++int kvm_unmap_gfn(struct kvm_vcpu *vcpu, struct kvm_host_map *map,
++ struct gfn_to_pfn_cache *cache, bool dirty, bool atomic)
++{
++ __kvm_unmap_gfn(gfn_to_memslot(vcpu->kvm, map->gfn), map,
++ cache, dirty, atomic);
++ return 0;
++}
++EXPORT_SYMBOL_GPL(kvm_unmap_gfn);
++
++void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map, bool dirty)
++{
++ __kvm_unmap_gfn(kvm_vcpu_gfn_to_memslot(vcpu, map->gfn), map, NULL,
++ dirty, false);
++}
++EXPORT_SYMBOL_GPL(kvm_vcpu_unmap);
++
+ struct page *kvm_vcpu_gfn_to_page(struct kvm_vcpu *vcpu, gfn_t gfn)
+ {
+ kvm_pfn_t pfn;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-05-02 19:24 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-05-02 19:24 UTC (permalink / raw
To: gentoo-commits
commit: d2975282a07e1079c8befdd23086852956fe4493
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat May 2 19:23:44 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat May 2 19:23:44 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d2975282
Linux patch 4.19.120
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1119_linux-4.19.120.patch | 1834 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1838 insertions(+)
diff --git a/0000_README b/0000_README
index 36e1c22..8850298 100644
--- a/0000_README
+++ b/0000_README
@@ -515,6 +515,10 @@ Patch: 1118_linux-4.19.119.patch
From: https://www.kernel.org
Desc: Linux 4.19.119
+Patch: 1119_linux-4.19.120.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.120
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1119_linux-4.19.120.patch b/1119_linux-4.19.120.patch
new file mode 100644
index 0000000..6f1d761
--- /dev/null
+++ b/1119_linux-4.19.120.patch
@@ -0,0 +1,1834 @@
+diff --git a/Makefile b/Makefile
+index 69c95fe6fba5..74b60bf2ff79 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 119
++SUBLEVEL = 120
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
+index c9322a56300d..f9add515301f 100644
+--- a/arch/arm/boot/dts/bcm283x.dtsi
++++ b/arch/arm/boot/dts/bcm283x.dtsi
+@@ -476,6 +476,7 @@
+ "dsi0_ddr2",
+ "dsi0_ddr";
+
++ status = "disabled";
+ };
+
+ thermal: thermal@7e212000 {
+diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
+index 3091ae5975a3..ed99d941c462 100644
+--- a/arch/arm64/include/asm/sysreg.h
++++ b/arch/arm64/include/asm/sysreg.h
+@@ -60,7 +60,9 @@
+ #ifndef CONFIG_BROKEN_GAS_INST
+
+ #ifdef __ASSEMBLY__
+-#define __emit_inst(x) .inst (x)
++// The space separator is omitted so that __emit_inst(x) can be parsed as
++// either an assembler directive or an assembler macro argument.
++#define __emit_inst(x) .inst(x)
+ #else
+ #define __emit_inst(x) ".inst " __stringify((x)) "\n\t"
+ #endif
+diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
+index fc93ae325515..f8b0fa2dbe37 100644
+--- a/arch/x86/kernel/cpu/mshyperv.c
++++ b/arch/x86/kernel/cpu/mshyperv.c
+@@ -214,8 +214,8 @@ static void __init ms_hyperv_init_platform(void)
+ ms_hyperv.misc_features = cpuid_edx(HYPERV_CPUID_FEATURES);
+ ms_hyperv.hints = cpuid_eax(HYPERV_CPUID_ENLIGHTMENT_INFO);
+
+- pr_info("Hyper-V: features 0x%x, hints 0x%x\n",
+- ms_hyperv.features, ms_hyperv.hints);
++ pr_info("Hyper-V: features 0x%x, hints 0x%x, misc 0x%x\n",
++ ms_hyperv.features, ms_hyperv.hints, ms_hyperv.misc_features);
+
+ ms_hyperv.max_vp_index = cpuid_eax(HYPERV_CPUID_IMPLEMENT_LIMITS);
+ ms_hyperv.max_lp_index = cpuid_ebx(HYPERV_CPUID_IMPLEMENT_LIMITS);
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index a32fc3d99407..46ab92831251 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -142,6 +142,19 @@ static bool is_ereg(u32 reg)
+ BIT(BPF_REG_AX));
+ }
+
++/*
++ * is_ereg_8l() == true if BPF register 'reg' is mapped to access x86-64
++ * lower 8-bit registers dil,sil,bpl,spl,r8b..r15b, which need extra byte
++ * of encoding. al,cl,dl,bl have simpler encoding.
++ */
++static bool is_ereg_8l(u32 reg)
++{
++ return is_ereg(reg) ||
++ (1 << reg) & (BIT(BPF_REG_1) |
++ BIT(BPF_REG_2) |
++ BIT(BPF_REG_FP));
++}
++
+ static bool is_axreg(u32 reg)
+ {
+ return reg == BPF_REG_0;
+@@ -751,9 +764,8 @@ st: if (is_imm8(insn->off))
+ /* STX: *(u8*)(dst_reg + off) = src_reg */
+ case BPF_STX | BPF_MEM | BPF_B:
+ /* Emit 'mov byte ptr [rax + off], al' */
+- if (is_ereg(dst_reg) || is_ereg(src_reg) ||
+- /* We have to add extra byte for x86 SIL, DIL regs */
+- src_reg == BPF_REG_1 || src_reg == BPF_REG_2)
++ if (is_ereg(dst_reg) || is_ereg_8l(src_reg))
++ /* Add extra byte for eregs or SIL,DIL,BPL in src_reg */
+ EMIT2(add_2mod(0x40, dst_reg, src_reg), 0x88);
+ else
+ EMIT1(0x88);
+diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
+index 24d573bc550d..2eaf1900ba67 100644
+--- a/arch/x86/net/bpf_jit_comp32.c
++++ b/arch/x86/net/bpf_jit_comp32.c
+@@ -1830,7 +1830,9 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ STACK_VAR(dst_hi));
+ EMIT(0x0, 4);
+ } else {
+- EMIT3(0xC7, add_1reg(0xC0, dst_hi), 0);
++ /* xor dst_hi,dst_hi */
++ EMIT2(0x33,
++ add_2reg(0xC0, dst_hi, dst_hi));
+ }
+ break;
+ case BPF_DW:
+@@ -1968,8 +1970,8 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ goto emit_cond_jmp_signed;
+ }
+ case BPF_JMP | BPF_JSET | BPF_X: {
+- u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
+- u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
++ u8 dreg_lo = IA32_EAX;
++ u8 dreg_hi = IA32_EDX;
+ u8 sreg_lo = sstk ? IA32_ECX : src_lo;
+ u8 sreg_hi = sstk ? IA32_EBX : src_hi;
+
+@@ -1978,6 +1980,12 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ STACK_VAR(dst_lo));
+ EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EDX),
+ STACK_VAR(dst_hi));
++ } else {
++ /* mov dreg_lo,dst_lo */
++ EMIT2(0x89, add_2reg(0xC0, dreg_lo, dst_lo));
++ /* mov dreg_hi,dst_hi */
++ EMIT2(0x89,
++ add_2reg(0xC0, dreg_hi, dst_hi));
+ }
+
+ if (sstk) {
+@@ -1996,8 +2004,8 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ }
+ case BPF_JMP | BPF_JSET | BPF_K: {
+ u32 hi;
+- u8 dreg_lo = dstk ? IA32_EAX : dst_lo;
+- u8 dreg_hi = dstk ? IA32_EDX : dst_hi;
++ u8 dreg_lo = IA32_EAX;
++ u8 dreg_hi = IA32_EDX;
+ u8 sreg_lo = IA32_ECX;
+ u8 sreg_hi = IA32_EBX;
+
+@@ -2006,6 +2014,12 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ STACK_VAR(dst_lo));
+ EMIT3(0x8B, add_2reg(0x40, IA32_EBP, IA32_EDX),
+ STACK_VAR(dst_hi));
++ } else {
++ /* mov dreg_lo,dst_lo */
++ EMIT2(0x89, add_2reg(0xC0, dreg_lo, dst_lo));
++ /* mov dreg_hi,dst_hi */
++ EMIT2(0x89,
++ add_2reg(0xC0, dreg_hi, dst_hi));
+ }
+ hi = imm32 & (1<<31) ? (u32)~0 : 0;
+
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index c3fdd79c4082..6e5e6fb7e4c9 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -970,8 +970,8 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
+ mm = alloc->vma_vm_mm;
+ if (!mmget_not_zero(mm))
+ goto err_mmget;
+- if (!down_write_trylock(&mm->mmap_sem))
+- goto err_down_write_mmap_sem_failed;
++ if (!down_read_trylock(&mm->mmap_sem))
++ goto err_down_read_mmap_sem_failed;
+ vma = binder_alloc_get_vma(alloc);
+
+ list_lru_isolate(lru, item);
+@@ -986,7 +986,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
+
+ trace_binder_unmap_user_end(alloc, index);
+ }
+- up_write(&mm->mmap_sem);
++ up_read(&mm->mmap_sem);
+ mmput(mm);
+
+ trace_binder_unmap_kernel_start(alloc, index);
+@@ -1001,7 +1001,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
+ mutex_unlock(&alloc->mutex);
+ return LRU_REMOVED_RETRY;
+
+-err_down_write_mmap_sem_failed:
++err_down_read_mmap_sem_failed:
+ mmput_async(mm);
+ err_mmget:
+ err_page_already_freed:
+diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
+index e5234f953a6d..b6e5aaa54963 100644
+--- a/drivers/hwmon/jc42.c
++++ b/drivers/hwmon/jc42.c
+@@ -527,7 +527,7 @@ static int jc42_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ }
+ data->config = config;
+
+- hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name,
++ hwmon_dev = devm_hwmon_device_register_with_info(dev, "jc42",
+ data, &jc42_chip_info,
+ NULL);
+ return PTR_ERR_OR_ZERO(hwmon_dev);
+diff --git a/drivers/i2c/busses/i2c-altera.c b/drivers/i2c/busses/i2c-altera.c
+index a1cdcfc74acf..8915ee30a5b4 100644
+--- a/drivers/i2c/busses/i2c-altera.c
++++ b/drivers/i2c/busses/i2c-altera.c
+@@ -395,7 +395,6 @@ static int altr_i2c_probe(struct platform_device *pdev)
+ struct altr_i2c_dev *idev = NULL;
+ struct resource *res;
+ int irq, ret;
+- u32 val;
+
+ idev = devm_kzalloc(&pdev->dev, sizeof(*idev), GFP_KERNEL);
+ if (!idev)
+@@ -422,17 +421,17 @@ static int altr_i2c_probe(struct platform_device *pdev)
+ init_completion(&idev->msg_complete);
+ spin_lock_init(&idev->lock);
+
+- val = device_property_read_u32(idev->dev, "fifo-size",
++ ret = device_property_read_u32(idev->dev, "fifo-size",
+ &idev->fifo_size);
+- if (val) {
++ if (ret) {
+ dev_err(&pdev->dev, "FIFO size set to default of %d\n",
+ ALTR_I2C_DFLT_FIFO_SZ);
+ idev->fifo_size = ALTR_I2C_DFLT_FIFO_SZ;
+ }
+
+- val = device_property_read_u32(idev->dev, "clock-frequency",
++ ret = device_property_read_u32(idev->dev, "clock-frequency",
+ &idev->bus_clk_rate);
+- if (val) {
++ if (ret) {
+ dev_err(&pdev->dev, "Default to 100kHz\n");
+ idev->bus_clk_rate = 100000; /* default clock rate */
+ }
+diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
+index d4bbe5b53318..23a6e7baa396 100644
+--- a/drivers/iio/adc/ad7793.c
++++ b/drivers/iio/adc/ad7793.c
+@@ -542,7 +542,7 @@ static const struct iio_info ad7797_info = {
+ .read_raw = &ad7793_read_raw,
+ .write_raw = &ad7793_write_raw,
+ .write_raw_get_fmt = &ad7793_write_raw_get_fmt,
+- .attrs = &ad7793_attribute_group,
++ .attrs = &ad7797_attribute_group,
+ .validate_trigger = ad_sd_validate_trigger,
+ };
+
+diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
+index ba44ea6d497e..1dbc9554a078 100644
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -1882,7 +1882,11 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
+ continue;
+ }
+
+- if (time_after(jiffies, timeo) && !chip_ready(map, adr))
++ /*
++ * We check "time_after" and "!chip_good" before checking "chip_good" to avoid
++ * the failure due to scheduling.
++ */
++ if (time_after(jiffies, timeo) && !chip_good(map, adr, datum))
+ break;
+
+ if (chip_good(map, adr, datum)) {
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index 8350c0c9b89d..5934ec9b6a31 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -3748,7 +3748,7 @@ int t4_phy_fw_ver(struct adapter *adap, int *phy_fw_ver)
+ FW_PARAMS_PARAM_Z_V(FW_PARAMS_PARAM_DEV_PHYFW_VERSION));
+ ret = t4_query_params(adap, adap->mbox, adap->pf, 0, 1,
+ ¶m, &val);
+- if (ret < 0)
++ if (ret)
+ return ret;
+ *phy_fw_ver = val;
+ return 0;
+diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
+index bf80855dd0dd..d06a89e99872 100644
+--- a/drivers/net/ethernet/freescale/fec.h
++++ b/drivers/net/ethernet/freescale/fec.h
+@@ -488,6 +488,12 @@ struct fec_enet_priv_rx_q {
+ struct sk_buff *rx_skbuff[RX_RING_SIZE];
+ };
+
++struct fec_stop_mode_gpr {
++ struct regmap *gpr;
++ u8 reg;
++ u8 bit;
++};
++
+ /* The FEC buffer descriptors track the ring buffers. The rx_bd_base and
+ * tx_bd_base always point to the base of the buffer descriptors. The
+ * cur_rx and cur_tx point to the currently available buffer.
+@@ -563,6 +569,7 @@ struct fec_enet_private {
+ int hwts_tx_en;
+ struct delayed_work time_keep;
+ struct regulator *reg_phy;
++ struct fec_stop_mode_gpr stop_gpr;
+
+ unsigned int tx_align;
+ unsigned int rx_align;
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 9142992ccd5a..48c58f93b124 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -62,6 +62,8 @@
+ #include <linux/if_vlan.h>
+ #include <linux/pinctrl/consumer.h>
+ #include <linux/prefetch.h>
++#include <linux/mfd/syscon.h>
++#include <linux/regmap.h>
+ #include <soc/imx/cpuidle.h>
+
+ #include <asm/cacheflush.h>
+@@ -84,6 +86,56 @@ static void fec_enet_itr_coal_init(struct net_device *ndev);
+ #define FEC_ENET_OPD_V 0xFFF0
+ #define FEC_MDIO_PM_TIMEOUT 100 /* ms */
+
++struct fec_devinfo {
++ u32 quirks;
++ u8 stop_gpr_reg;
++ u8 stop_gpr_bit;
++};
++
++static const struct fec_devinfo fec_imx25_info = {
++ .quirks = FEC_QUIRK_USE_GASKET | FEC_QUIRK_MIB_CLEAR |
++ FEC_QUIRK_HAS_FRREG,
++};
++
++static const struct fec_devinfo fec_imx27_info = {
++ .quirks = FEC_QUIRK_MIB_CLEAR | FEC_QUIRK_HAS_FRREG,
++};
++
++static const struct fec_devinfo fec_imx28_info = {
++ .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_SWAP_FRAME |
++ FEC_QUIRK_SINGLE_MDIO | FEC_QUIRK_HAS_RACC |
++ FEC_QUIRK_HAS_FRREG,
++};
++
++static const struct fec_devinfo fec_imx6q_info = {
++ .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
++ FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
++ FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR006358 |
++ FEC_QUIRK_HAS_RACC,
++ .stop_gpr_reg = 0x34,
++ .stop_gpr_bit = 27,
++};
++
++static const struct fec_devinfo fec_mvf600_info = {
++ .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_RACC,
++};
++
++static const struct fec_devinfo fec_imx6x_info = {
++ .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
++ FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
++ FEC_QUIRK_HAS_VLAN | FEC_QUIRK_HAS_AVB |
++ FEC_QUIRK_ERR007885 | FEC_QUIRK_BUG_CAPTURE |
++ FEC_QUIRK_HAS_RACC | FEC_QUIRK_HAS_COALESCE,
++};
++
++static const struct fec_devinfo fec_imx6ul_info = {
++ .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
++ FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
++ FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR007885 |
++ FEC_QUIRK_BUG_CAPTURE | FEC_QUIRK_HAS_RACC |
++ FEC_QUIRK_HAS_COALESCE,
++};
++
+ static struct platform_device_id fec_devtype[] = {
+ {
+ /* keep it for coldfire */
+@@ -91,39 +143,25 @@ static struct platform_device_id fec_devtype[] = {
+ .driver_data = 0,
+ }, {
+ .name = "imx25-fec",
+- .driver_data = FEC_QUIRK_USE_GASKET | FEC_QUIRK_MIB_CLEAR |
+- FEC_QUIRK_HAS_FRREG,
++ .driver_data = (kernel_ulong_t)&fec_imx25_info,
+ }, {
+ .name = "imx27-fec",
+- .driver_data = FEC_QUIRK_MIB_CLEAR | FEC_QUIRK_HAS_FRREG,
++ .driver_data = (kernel_ulong_t)&fec_imx27_info,
+ }, {
+ .name = "imx28-fec",
+- .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_SWAP_FRAME |
+- FEC_QUIRK_SINGLE_MDIO | FEC_QUIRK_HAS_RACC |
+- FEC_QUIRK_HAS_FRREG,
++ .driver_data = (kernel_ulong_t)&fec_imx28_info,
+ }, {
+ .name = "imx6q-fec",
+- .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
+- FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
+- FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR006358 |
+- FEC_QUIRK_HAS_RACC,
++ .driver_data = (kernel_ulong_t)&fec_imx6q_info,
+ }, {
+ .name = "mvf600-fec",
+- .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_RACC,
++ .driver_data = (kernel_ulong_t)&fec_mvf600_info,
+ }, {
+ .name = "imx6sx-fec",
+- .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
+- FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
+- FEC_QUIRK_HAS_VLAN | FEC_QUIRK_HAS_AVB |
+- FEC_QUIRK_ERR007885 | FEC_QUIRK_BUG_CAPTURE |
+- FEC_QUIRK_HAS_RACC | FEC_QUIRK_HAS_COALESCE,
++ .driver_data = (kernel_ulong_t)&fec_imx6x_info,
+ }, {
+ .name = "imx6ul-fec",
+- .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
+- FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
+- FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR007885 |
+- FEC_QUIRK_BUG_CAPTURE | FEC_QUIRK_HAS_RACC |
+- FEC_QUIRK_HAS_COALESCE,
++ .driver_data = (kernel_ulong_t)&fec_imx6ul_info,
+ }, {
+ /* sentinel */
+ }
+@@ -1089,11 +1127,28 @@ fec_restart(struct net_device *ndev)
+
+ }
+
++static void fec_enet_stop_mode(struct fec_enet_private *fep, bool enabled)
++{
++ struct fec_platform_data *pdata = fep->pdev->dev.platform_data;
++ struct fec_stop_mode_gpr *stop_gpr = &fep->stop_gpr;
++
++ if (stop_gpr->gpr) {
++ if (enabled)
++ regmap_update_bits(stop_gpr->gpr, stop_gpr->reg,
++ BIT(stop_gpr->bit),
++ BIT(stop_gpr->bit));
++ else
++ regmap_update_bits(stop_gpr->gpr, stop_gpr->reg,
++ BIT(stop_gpr->bit), 0);
++ } else if (pdata && pdata->sleep_mode_enable) {
++ pdata->sleep_mode_enable(enabled);
++ }
++}
++
+ static void
+ fec_stop(struct net_device *ndev)
+ {
+ struct fec_enet_private *fep = netdev_priv(ndev);
+- struct fec_platform_data *pdata = fep->pdev->dev.platform_data;
+ u32 rmii_mode = readl(fep->hwp + FEC_R_CNTRL) & (1 << 8);
+ u32 val;
+
+@@ -1122,9 +1177,7 @@ fec_stop(struct net_device *ndev)
+ val = readl(fep->hwp + FEC_ECNTRL);
+ val |= (FEC_ECR_MAGICEN | FEC_ECR_SLEEP);
+ writel(val, fep->hwp + FEC_ECNTRL);
+-
+- if (pdata && pdata->sleep_mode_enable)
+- pdata->sleep_mode_enable(true);
++ fec_enet_stop_mode(fep, true);
+ }
+ writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED);
+
+@@ -3347,6 +3400,37 @@ static int fec_enet_get_irq_cnt(struct platform_device *pdev)
+ return irq_cnt;
+ }
+
++static int fec_enet_init_stop_mode(struct fec_enet_private *fep,
++ struct fec_devinfo *dev_info,
++ struct device_node *np)
++{
++ struct device_node *gpr_np;
++ int ret = 0;
++
++ if (!dev_info)
++ return 0;
++
++ gpr_np = of_parse_phandle(np, "gpr", 0);
++ if (!gpr_np)
++ return 0;
++
++ fep->stop_gpr.gpr = syscon_node_to_regmap(gpr_np);
++ if (IS_ERR(fep->stop_gpr.gpr)) {
++ dev_err(&fep->pdev->dev, "could not find gpr regmap\n");
++ ret = PTR_ERR(fep->stop_gpr.gpr);
++ fep->stop_gpr.gpr = NULL;
++ goto out;
++ }
++
++ fep->stop_gpr.reg = dev_info->stop_gpr_reg;
++ fep->stop_gpr.bit = dev_info->stop_gpr_bit;
++
++out:
++ of_node_put(gpr_np);
++
++ return ret;
++}
++
+ static int
+ fec_probe(struct platform_device *pdev)
+ {
+@@ -3362,6 +3446,7 @@ fec_probe(struct platform_device *pdev)
+ int num_rx_qs;
+ char irq_name[8];
+ int irq_cnt;
++ struct fec_devinfo *dev_info;
+
+ fec_enet_get_queue_num(pdev, &num_tx_qs, &num_rx_qs);
+
+@@ -3379,7 +3464,9 @@ fec_probe(struct platform_device *pdev)
+ of_id = of_match_device(fec_dt_ids, &pdev->dev);
+ if (of_id)
+ pdev->id_entry = of_id->data;
+- fep->quirks = pdev->id_entry->driver_data;
++ dev_info = (struct fec_devinfo *)pdev->id_entry->driver_data;
++ if (dev_info)
++ fep->quirks = dev_info->quirks;
+
+ fep->netdev = ndev;
+ fep->num_rx_queues = num_rx_qs;
+@@ -3414,6 +3501,10 @@ fec_probe(struct platform_device *pdev)
+ if (of_get_property(np, "fsl,magic-packet", NULL))
+ fep->wol_flag |= FEC_WOL_HAS_MAGIC_PACKET;
+
++ ret = fec_enet_init_stop_mode(fep, dev_info, np);
++ if (ret)
++ goto failed_stop_mode;
++
+ phy_node = of_parse_phandle(np, "phy-handle", 0);
+ if (!phy_node && of_phy_is_fixed_link(np)) {
+ ret = of_phy_register_fixed_link(np);
+@@ -3583,6 +3674,7 @@ failed_clk:
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(phy_node);
++failed_stop_mode:
+ failed_phy:
+ dev_id--;
+ failed_ioremap:
+@@ -3660,7 +3752,6 @@ static int __maybe_unused fec_resume(struct device *dev)
+ {
+ struct net_device *ndev = dev_get_drvdata(dev);
+ struct fec_enet_private *fep = netdev_priv(ndev);
+- struct fec_platform_data *pdata = fep->pdev->dev.platform_data;
+ int ret;
+ int val;
+
+@@ -3678,8 +3769,8 @@ static int __maybe_unused fec_resume(struct device *dev)
+ goto failed_clk;
+ }
+ if (fep->wol_flag & FEC_WOL_FLAG_ENABLE) {
+- if (pdata && pdata->sleep_mode_enable)
+- pdata->sleep_mode_enable(false);
++ fec_enet_stop_mode(fep, false);
++
+ val = readl(fep->hwp + FEC_ECNTRL);
+ val &= ~(FEC_ECR_MAGICEN | FEC_ECR_SLEEP);
+ writel(val, fep->hwp + FEC_ECNTRL);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+index d4ec93bde4de..2266c09b741a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+@@ -796,7 +796,7 @@ struct mlx5_fw_tracer *mlx5_fw_tracer_create(struct mlx5_core_dev *dev)
+ return NULL;
+ }
+
+- tracer = kzalloc(sizeof(*tracer), GFP_KERNEL);
++ tracer = kvzalloc(sizeof(*tracer), GFP_KERNEL);
+ if (!tracer)
+ return ERR_PTR(-ENOMEM);
+
+@@ -842,7 +842,7 @@ destroy_workqueue:
+ tracer->dev = NULL;
+ destroy_workqueue(tracer->work_queue);
+ free_tracer:
+- kfree(tracer);
++ kvfree(tracer);
+ return ERR_PTR(err);
+ }
+
+@@ -919,7 +919,7 @@ void mlx5_fw_tracer_destroy(struct mlx5_fw_tracer *tracer)
+ mlx5_fw_tracer_destroy_log_buf(tracer);
+ flush_workqueue(tracer->work_queue);
+ destroy_workqueue(tracer->work_queue);
+- kfree(tracer);
++ kvfree(tracer);
+ }
+
+ void mlx5_fw_tracer_event(struct mlx5_core_dev *dev, struct mlx5_eqe *eqe)
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+index a6a9688db307..e50fc8f714dc 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -3316,26 +3316,20 @@ static void qed_chain_free_single(struct qed_dev *cdev,
+
+ static void qed_chain_free_pbl(struct qed_dev *cdev, struct qed_chain *p_chain)
+ {
+- void **pp_virt_addr_tbl = p_chain->pbl.pp_virt_addr_tbl;
++ struct addr_tbl_entry *pp_addr_tbl = p_chain->pbl.pp_addr_tbl;
+ u32 page_cnt = p_chain->page_cnt, i, pbl_size;
+- u8 *p_pbl_virt = p_chain->pbl_sp.p_virt_table;
+
+- if (!pp_virt_addr_tbl)
++ if (!pp_addr_tbl)
+ return;
+
+- if (!p_pbl_virt)
+- goto out;
+-
+ for (i = 0; i < page_cnt; i++) {
+- if (!pp_virt_addr_tbl[i])
++ if (!pp_addr_tbl[i].virt_addr || !pp_addr_tbl[i].dma_map)
+ break;
+
+ dma_free_coherent(&cdev->pdev->dev,
+ QED_CHAIN_PAGE_SIZE,
+- pp_virt_addr_tbl[i],
+- *(dma_addr_t *)p_pbl_virt);
+-
+- p_pbl_virt += QED_CHAIN_PBL_ENTRY_SIZE;
++ pp_addr_tbl[i].virt_addr,
++ pp_addr_tbl[i].dma_map);
+ }
+
+ pbl_size = page_cnt * QED_CHAIN_PBL_ENTRY_SIZE;
+@@ -3345,9 +3339,9 @@ static void qed_chain_free_pbl(struct qed_dev *cdev, struct qed_chain *p_chain)
+ pbl_size,
+ p_chain->pbl_sp.p_virt_table,
+ p_chain->pbl_sp.p_phys_table);
+-out:
+- vfree(p_chain->pbl.pp_virt_addr_tbl);
+- p_chain->pbl.pp_virt_addr_tbl = NULL;
++
++ vfree(p_chain->pbl.pp_addr_tbl);
++ p_chain->pbl.pp_addr_tbl = NULL;
+ }
+
+ void qed_chain_free(struct qed_dev *cdev, struct qed_chain *p_chain)
+@@ -3448,19 +3442,19 @@ qed_chain_alloc_pbl(struct qed_dev *cdev,
+ {
+ u32 page_cnt = p_chain->page_cnt, size, i;
+ dma_addr_t p_phys = 0, p_pbl_phys = 0;
+- void **pp_virt_addr_tbl = NULL;
++ struct addr_tbl_entry *pp_addr_tbl;
+ u8 *p_pbl_virt = NULL;
+ void *p_virt = NULL;
+
+- size = page_cnt * sizeof(*pp_virt_addr_tbl);
+- pp_virt_addr_tbl = vzalloc(size);
+- if (!pp_virt_addr_tbl)
++ size = page_cnt * sizeof(*pp_addr_tbl);
++ pp_addr_tbl = vzalloc(size);
++ if (!pp_addr_tbl)
+ return -ENOMEM;
+
+ /* The allocation of the PBL table is done with its full size, since it
+ * is expected to be successive.
+ * qed_chain_init_pbl_mem() is called even in a case of an allocation
+- * failure, since pp_virt_addr_tbl was previously allocated, and it
++ * failure, since tbl was previously allocated, and it
+ * should be saved to allow its freeing during the error flow.
+ */
+ size = page_cnt * QED_CHAIN_PBL_ENTRY_SIZE;
+@@ -3474,8 +3468,7 @@ qed_chain_alloc_pbl(struct qed_dev *cdev,
+ p_chain->b_external_pbl = true;
+ }
+
+- qed_chain_init_pbl_mem(p_chain, p_pbl_virt, p_pbl_phys,
+- pp_virt_addr_tbl);
++ qed_chain_init_pbl_mem(p_chain, p_pbl_virt, p_pbl_phys, pp_addr_tbl);
+ if (!p_pbl_virt)
+ return -ENOMEM;
+
+@@ -3494,7 +3487,8 @@ qed_chain_alloc_pbl(struct qed_dev *cdev,
+ /* Fill the PBL table with the physical address of the page */
+ *(dma_addr_t *)p_pbl_virt = p_phys;
+ /* Keep the virtual address of the page */
+- p_chain->pbl.pp_virt_addr_tbl[i] = p_virt;
++ p_chain->pbl.pp_addr_tbl[i].virt_addr = p_virt;
++ p_chain->pbl.pp_addr_tbl[i].dma_map = p_phys;
+
+ p_pbl_virt += QED_CHAIN_PBL_ENTRY_SIZE;
+ }
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 9e20ace30b62..ca41cff2e68c 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5282,3 +5282,21 @@ out_disable:
+ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, 0x13b1,
+ PCI_CLASS_DISPLAY_VGA, 8,
+ quirk_reset_lenovo_thinkpad_p50_nvgpu);
++
++/*
++ * Device [1b21:2142]
++ * When in D0, PME# doesn't get asserted when plugging USB 3.0 device.
++ */
++static void pci_fixup_no_d0_pme(struct pci_dev *dev)
++{
++ pci_info(dev, "PME# does not work under D0, disabling it\n");
++ dev->pme_support &= ~(PCI_PM_CAP_PME_D0 >> PCI_PM_CAP_PME_SHIFT);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x2142, pci_fixup_no_d0_pme);
++
++static void apex_pci_fixup_class(struct pci_dev *pdev)
++{
++ pdev->class = (PCI_CLASS_SYSTEM_OTHER << 8) | pdev->class;
++}
++DECLARE_PCI_FIXUP_CLASS_HEADER(0x1ac1, 0x089a,
++ PCI_CLASS_NOT_DEFINED, 8, apex_pci_fixup_class);
+diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
+index abbef17c97ee..d5ff272fde34 100644
+--- a/drivers/remoteproc/remoteproc_core.c
++++ b/drivers/remoteproc/remoteproc_core.c
+@@ -289,7 +289,7 @@ void rproc_free_vring(struct rproc_vring *rvring)
+ {
+ int size = PAGE_ALIGN(vring_size(rvring->len, rvring->align));
+ struct rproc *rproc = rvring->rvdev->rproc;
+- int idx = rvring->rvdev->vring - rvring;
++ int idx = rvring - rvring->rvdev->vring;
+ struct fw_rsc_vdev *rsc;
+
+ dma_free_coherent(rproc->dev.parent, size, rvring->va, rvring->dma);
+diff --git a/drivers/staging/gasket/apex_driver.c b/drivers/staging/gasket/apex_driver.c
+index 0cef1d6d2e2b..99da735bdf6d 100644
+--- a/drivers/staging/gasket/apex_driver.c
++++ b/drivers/staging/gasket/apex_driver.c
+@@ -578,13 +578,6 @@ static const struct pci_device_id apex_pci_ids[] = {
+ { PCI_DEVICE(APEX_PCI_VENDOR_ID, APEX_PCI_DEVICE_ID) }, { 0 }
+ };
+
+-static void apex_pci_fixup_class(struct pci_dev *pdev)
+-{
+- pdev->class = (PCI_CLASS_SYSTEM_OTHER << 8) | pdev->class;
+-}
+-DECLARE_PCI_FIXUP_CLASS_HEADER(APEX_PCI_VENDOR_ID, APEX_PCI_DEVICE_ID,
+- PCI_CLASS_NOT_DEFINED, 8, apex_pci_fixup_class);
+-
+ static int apex_pci_probe(struct pci_dev *pci_dev,
+ const struct pci_device_id *id)
+ {
+diff --git a/drivers/target/target_core_fabric_lib.c b/drivers/target/target_core_fabric_lib.c
+index 10fae26b44ad..939c6212d2ac 100644
+--- a/drivers/target/target_core_fabric_lib.c
++++ b/drivers/target/target_core_fabric_lib.c
+@@ -76,7 +76,7 @@ static int fc_get_pr_transport_id(
+ * encoded TransportID.
+ */
+ ptr = &se_nacl->initiatorname[0];
+- for (i = 0; i < 24; ) {
++ for (i = 0; i < 23; ) {
+ if (!strncmp(&ptr[i], ":", 1)) {
+ i++;
+ continue;
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 7ee0a75ce452..eff1e36ca03c 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -2067,6 +2067,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
+ mb->cmd_tail = 0;
+ mb->cmd_head = 0;
+ tcmu_flush_dcache_range(mb, sizeof(*mb));
++ clear_bit(TCMU_DEV_BIT_BROKEN, &udev->flags);
+
+ del_timer(&udev->cmd_timer);
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 8222e674c777..1a6c973da487 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1577,7 +1577,6 @@ static int __dwc3_gadget_wakeup(struct dwc3 *dwc)
+ u32 reg;
+
+ u8 link_state;
+- u8 speed;
+
+ /*
+ * According to the Databook Remote wakeup request should
+@@ -1587,16 +1586,13 @@ static int __dwc3_gadget_wakeup(struct dwc3 *dwc)
+ */
+ reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+
+- speed = reg & DWC3_DSTS_CONNECTSPD;
+- if ((speed == DWC3_DSTS_SUPERSPEED) ||
+- (speed == DWC3_DSTS_SUPERSPEED_PLUS))
+- return 0;
+-
+ link_state = DWC3_DSTS_USBLNKST(reg);
+
+ switch (link_state) {
++ case DWC3_LINK_STATE_RESET:
+ case DWC3_LINK_STATE_RX_DET: /* in HS, means Early Suspend */
+ case DWC3_LINK_STATE_U3: /* in HS, means SUSPEND */
++ case DWC3_LINK_STATE_RESUME:
+ break;
+ default:
+ return -EINVAL;
+diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
+index a4d9b5e1e50e..d49c6dc1082d 100644
+--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
+@@ -540,7 +540,7 @@ static void bdc_req_complete(struct bdc_ep *ep, struct bdc_req *req,
+ {
+ struct bdc *bdc = ep->bdc;
+
+- if (req == NULL || &req->queue == NULL || &req->usb_req == NULL)
++ if (req == NULL)
+ return;
+
+ dev_dbg(bdc->dev, "%s ep:%s status:%d\n", __func__, ep->name, status);
+diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
+index a1c17000129b..e94a61eaeceb 100644
+--- a/drivers/xen/xenbus/xenbus_client.c
++++ b/drivers/xen/xenbus/xenbus_client.c
+@@ -450,7 +450,14 @@ EXPORT_SYMBOL_GPL(xenbus_free_evtchn);
+ int xenbus_map_ring_valloc(struct xenbus_device *dev, grant_ref_t *gnt_refs,
+ unsigned int nr_grefs, void **vaddr)
+ {
+- return ring_ops->map(dev, gnt_refs, nr_grefs, vaddr);
++ int err;
++
++ err = ring_ops->map(dev, gnt_refs, nr_grefs, vaddr);
++ /* Some hypervisors are buggy and can return 1. */
++ if (err > 0)
++ err = GNTST_general_error;
++
++ return err;
+ }
+ EXPORT_SYMBOL_GPL(xenbus_map_ring_valloc);
+
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index dafa7e4aaecb..8876eaad10f6 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -665,7 +665,7 @@ static int find_group_other(struct super_block *sb, struct inode *parent,
+ * block has been written back to disk. (Yes, these values are
+ * somewhat arbitrary...)
+ */
+-#define RECENTCY_MIN 5
++#define RECENTCY_MIN 60
+ #define RECENTCY_DIRTY 300
+
+ static int recently_deleted(struct super_block *sb, ext4_group_t group, int ino)
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 000fa0e39278..3b1a7597af15 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -2128,7 +2128,7 @@ static int ext4_writepage(struct page *page,
+ bool keep_towrite = false;
+
+ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) {
+- ext4_invalidatepage(page, 0, PAGE_SIZE);
++ inode->i_mapping->a_ops->invalidatepage(page, 0, PAGE_SIZE);
+ unlock_page(page);
+ return -EIO;
+ }
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 71121fcf9e8c..8dd54a8a0361 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -1936,7 +1936,8 @@ void ext4_mb_complex_scan_group(struct ext4_allocation_context *ac,
+ int free;
+
+ free = e4b->bd_info->bb_free;
+- BUG_ON(free <= 0);
++ if (WARN_ON(free <= 0))
++ return;
+
+ i = e4b->bd_info->bb_first_free;
+
+@@ -1959,7 +1960,8 @@ void ext4_mb_complex_scan_group(struct ext4_allocation_context *ac,
+ }
+
+ mb_find_extent(e4b, i, ac->ac_g_ex.fe_len, &ex);
+- BUG_ON(ex.fe_len <= 0);
++ if (WARN_ON(ex.fe_len <= 0))
++ break;
+ if (free < ex.fe_len) {
+ ext4_grp_locked_error(sb, e4b->bd_group, 0, 0,
+ "%d free clusters as per "
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index bf949fcc970a..93c14ecac831 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3524,7 +3524,8 @@ int ext4_calculate_overhead(struct super_block *sb)
+ */
+ if (sbi->s_journal && !sbi->journal_bdev)
+ overhead += EXT4_NUM_B2C(sbi, sbi->s_journal->j_maxlen);
+- else if (ext4_has_feature_journal(sb) && !sbi->s_journal) {
++ else if (ext4_has_feature_journal(sb) && !sbi->s_journal && j_inum) {
++ /* j_inum for internal journal is non-zero */
+ j_inode = ext4_get_journal_inode(sb, j_inum);
+ if (j_inode) {
+ j_blocks = j_inode->i_size >> sb->s_blocksize_bits;
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index ed73e86194fa..c24306af9758 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -252,6 +252,8 @@ find_or_allocate_block(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
+ if (!nbl) {
+ nbl= kmalloc(sizeof(*nbl), GFP_KERNEL);
+ if (nbl) {
++ INIT_LIST_HEAD(&nbl->nbl_list);
++ INIT_LIST_HEAD(&nbl->nbl_lru);
+ fh_copy_shallow(&nbl->nbl_fh, fh);
+ locks_init_lock(&nbl->nbl_lock);
+ nfsd4_init_cb(&nbl->nbl_cb, lo->lo_owner.so_client,
+diff --git a/fs/pnode.c b/fs/pnode.c
+index 53d411a371ce..7910ae91f17e 100644
+--- a/fs/pnode.c
++++ b/fs/pnode.c
+@@ -266,14 +266,13 @@ static int propagate_one(struct mount *m)
+ if (IS_ERR(child))
+ return PTR_ERR(child);
+ child->mnt.mnt_flags &= ~MNT_LOCKED;
++ read_seqlock_excl(&mount_lock);
+ mnt_set_mountpoint(m, mp, child);
++ if (m->mnt_master != dest_master)
++ SET_MNT_MARK(m->mnt_master);
++ read_sequnlock_excl(&mount_lock);
+ last_dest = m;
+ last_source = child;
+- if (m->mnt_master != dest_master) {
+- read_seqlock_excl(&mount_lock);
+- SET_MNT_MARK(m->mnt_master);
+- read_sequnlock_excl(&mount_lock);
+- }
+ hlist_add_head(&child->mnt_hash, list);
+ return count_mounts(m->mnt_ns, child);
+ }
+diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
+index 245483cc282b..901f27ac94ab 100644
+--- a/fs/xfs/xfs_icache.c
++++ b/fs/xfs/xfs_icache.c
+@@ -902,7 +902,12 @@ xfs_eofblocks_worker(
+ {
+ struct xfs_mount *mp = container_of(to_delayed_work(work),
+ struct xfs_mount, m_eofblocks_work);
++
++ if (!sb_start_write_trylock(mp->m_super))
++ return;
+ xfs_icache_free_eofblocks(mp, NULL);
++ sb_end_write(mp->m_super);
++
+ xfs_queue_eofblocks(mp);
+ }
+
+@@ -929,7 +934,12 @@ xfs_cowblocks_worker(
+ {
+ struct xfs_mount *mp = container_of(to_delayed_work(work),
+ struct xfs_mount, m_cowblocks_work);
++
++ if (!sb_start_write_trylock(mp->m_super))
++ return;
+ xfs_icache_free_cowblocks(mp, NULL);
++ sb_end_write(mp->m_super);
++
+ xfs_queue_cowblocks(mp);
+ }
+
+diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
+index bad90479ade2..6ffb53edf1b4 100644
+--- a/fs/xfs/xfs_ioctl.c
++++ b/fs/xfs/xfs_ioctl.c
+@@ -2182,7 +2182,10 @@ xfs_file_ioctl(
+ if (error)
+ return error;
+
+- return xfs_icache_free_eofblocks(mp, &keofb);
++ sb_start_write(mp->m_super);
++ error = xfs_icache_free_eofblocks(mp, &keofb);
++ sb_end_write(mp->m_super);
++ return error;
+ }
+
+ default:
+diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
+index f3c393f309e1..6622652a85a8 100644
+--- a/fs/xfs/xfs_reflink.c
++++ b/fs/xfs/xfs_reflink.c
+@@ -1058,6 +1058,7 @@ xfs_reflink_remap_extent(
+ uirec.br_startblock = irec->br_startblock + rlen;
+ uirec.br_startoff = irec->br_startoff + rlen;
+ uirec.br_blockcount = unmap_len - rlen;
++ uirec.br_state = irec->br_state;
+ unmap_len = rlen;
+
+ /* If this isn't a real mapping, we're done. */
+diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
+index d3a4e89bf4a0..66f167aefd94 100644
+--- a/fs/xfs/xfs_trans_ail.c
++++ b/fs/xfs/xfs_trans_ail.c
+@@ -520,8 +520,9 @@ xfsaild(
+ {
+ struct xfs_ail *ailp = data;
+ long tout = 0; /* milliseconds */
++ unsigned int noreclaim_flag;
+
+- current->flags |= PF_MEMALLOC;
++ noreclaim_flag = memalloc_noreclaim_save();
+ set_freezable();
+
+ while (1) {
+@@ -592,6 +593,7 @@ xfsaild(
+ tout = xfsaild_push(ailp);
+ }
+
++ memalloc_noreclaim_restore(noreclaim_flag);
+ return 0;
+ }
+
+diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h
+index 2dd0a9ed5b36..733fad7dfbed 100644
+--- a/include/linux/qed/qed_chain.h
++++ b/include/linux/qed/qed_chain.h
+@@ -97,6 +97,11 @@ struct qed_chain_u32 {
+ u32 cons_idx;
+ };
+
++struct addr_tbl_entry {
++ void *virt_addr;
++ dma_addr_t dma_map;
++};
++
+ struct qed_chain {
+ /* fastpath portion of the chain - required for commands such
+ * as produce / consume.
+@@ -107,10 +112,11 @@ struct qed_chain {
+
+ /* Fastpath portions of the PBL [if exists] */
+ struct {
+- /* Table for keeping the virtual addresses of the chain pages,
+- * respectively to the physical addresses in the pbl table.
++ /* Table for keeping the virtual and physical addresses of the
++ * chain pages, respectively to the physical addresses
++ * in the pbl table.
+ */
+- void **pp_virt_addr_tbl;
++ struct addr_tbl_entry *pp_addr_tbl;
+
+ union {
+ struct qed_chain_pbl_u16 u16;
+@@ -287,7 +293,7 @@ qed_chain_advance_page(struct qed_chain *p_chain,
+ *(u32 *)page_to_inc = 0;
+ page_index = *(u32 *)page_to_inc;
+ }
+- *p_next_elem = p_chain->pbl.pp_virt_addr_tbl[page_index];
++ *p_next_elem = p_chain->pbl.pp_addr_tbl[page_index].virt_addr;
+ }
+ }
+
+@@ -537,7 +543,7 @@ static inline void qed_chain_init_params(struct qed_chain *p_chain,
+
+ p_chain->pbl_sp.p_phys_table = 0;
+ p_chain->pbl_sp.p_virt_table = NULL;
+- p_chain->pbl.pp_virt_addr_tbl = NULL;
++ p_chain->pbl.pp_addr_tbl = NULL;
+ }
+
+ /**
+@@ -575,11 +581,11 @@ static inline void qed_chain_init_mem(struct qed_chain *p_chain,
+ static inline void qed_chain_init_pbl_mem(struct qed_chain *p_chain,
+ void *p_virt_pbl,
+ dma_addr_t p_phys_pbl,
+- void **pp_virt_addr_tbl)
++ struct addr_tbl_entry *pp_addr_tbl)
+ {
+ p_chain->pbl_sp.p_phys_table = p_phys_pbl;
+ p_chain->pbl_sp.p_virt_table = p_virt_pbl;
+- p_chain->pbl.pp_virt_addr_tbl = pp_virt_addr_tbl;
++ p_chain->pbl.pp_addr_tbl = pp_addr_tbl;
+ }
+
+ /**
+@@ -644,7 +650,7 @@ static inline void *qed_chain_get_last_elem(struct qed_chain *p_chain)
+ break;
+ case QED_CHAIN_MODE_PBL:
+ last_page_idx = p_chain->page_cnt - 1;
+- p_virt_addr = p_chain->pbl.pp_virt_addr_tbl[last_page_idx];
++ p_virt_addr = p_chain->pbl.pp_addr_tbl[last_page_idx].virt_addr;
+ break;
+ }
+ /* p_virt_addr points at this stage to the last page of the chain */
+@@ -716,7 +722,7 @@ static inline void qed_chain_pbl_zero_mem(struct qed_chain *p_chain)
+ page_cnt = qed_chain_get_page_cnt(p_chain);
+
+ for (i = 0; i < page_cnt; i++)
+- memset(p_chain->pbl.pp_virt_addr_tbl[i], 0,
++ memset(p_chain->pbl.pp_addr_tbl[i].virt_addr, 0,
+ QED_CHAIN_PAGE_SIZE);
+ }
+
+diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
+index fd78f78df5c6..3e3214cca447 100644
+--- a/include/linux/sunrpc/svc_rdma.h
++++ b/include/linux/sunrpc/svc_rdma.h
+@@ -159,6 +159,7 @@ extern bool svc_rdma_post_recvs(struct svcxprt_rdma *rdma);
+ extern void svc_rdma_recv_ctxt_put(struct svcxprt_rdma *rdma,
+ struct svc_rdma_recv_ctxt *ctxt);
+ extern void svc_rdma_flush_recv_queues(struct svcxprt_rdma *rdma);
++extern void svc_rdma_release_rqst(struct svc_rqst *rqstp);
+ extern int svc_rdma_recvfrom(struct svc_rqst *);
+
+ /* svc_rdma_rw.c */
+diff --git a/include/trace/events/rpcrdma.h b/include/trace/events/rpcrdma.h
+index 4c91cadd1871..4a0b18921e06 100644
+--- a/include/trace/events/rpcrdma.h
++++ b/include/trace/events/rpcrdma.h
+@@ -1322,17 +1322,15 @@ DECLARE_EVENT_CLASS(svcrdma_sendcomp_event,
+
+ TRACE_EVENT(svcrdma_post_send,
+ TP_PROTO(
+- const struct ib_send_wr *wr,
+- int status
++ const struct ib_send_wr *wr
+ ),
+
+- TP_ARGS(wr, status),
++ TP_ARGS(wr),
+
+ TP_STRUCT__entry(
+ __field(const void *, cqe)
+ __field(unsigned int, num_sge)
+ __field(u32, inv_rkey)
+- __field(int, status)
+ ),
+
+ TP_fast_assign(
+@@ -1340,12 +1338,11 @@ TRACE_EVENT(svcrdma_post_send,
+ __entry->num_sge = wr->num_sge;
+ __entry->inv_rkey = (wr->opcode == IB_WR_SEND_WITH_INV) ?
+ wr->ex.invalidate_rkey : 0;
+- __entry->status = status;
+ ),
+
+- TP_printk("cqe=%p num_sge=%u inv_rkey=0x%08x status=%d",
++ TP_printk("cqe=%p num_sge=%u inv_rkey=0x%08x",
+ __entry->cqe, __entry->num_sge,
+- __entry->inv_rkey, __entry->status
++ __entry->inv_rkey
+ )
+ );
+
+@@ -1410,26 +1407,23 @@ TRACE_EVENT(svcrdma_wc_receive,
+ TRACE_EVENT(svcrdma_post_rw,
+ TP_PROTO(
+ const void *cqe,
+- int sqecount,
+- int status
++ int sqecount
+ ),
+
+- TP_ARGS(cqe, sqecount, status),
++ TP_ARGS(cqe, sqecount),
+
+ TP_STRUCT__entry(
+ __field(const void *, cqe)
+ __field(int, sqecount)
+- __field(int, status)
+ ),
+
+ TP_fast_assign(
+ __entry->cqe = cqe;
+ __entry->sqecount = sqecount;
+- __entry->status = status;
+ ),
+
+- TP_printk("cqe=%p sqecount=%d status=%d",
+- __entry->cqe, __entry->sqecount, __entry->status
++ TP_printk("cqe=%p sqecount=%d",
++ __entry->cqe, __entry->sqecount
+ )
+ );
+
+@@ -1525,6 +1519,34 @@ DECLARE_EVENT_CLASS(svcrdma_sendqueue_event,
+ DEFINE_SQ_EVENT(full);
+ DEFINE_SQ_EVENT(retry);
+
++TRACE_EVENT(svcrdma_sq_post_err,
++ TP_PROTO(
++ const struct svcxprt_rdma *rdma,
++ int status
++ ),
++
++ TP_ARGS(rdma, status),
++
++ TP_STRUCT__entry(
++ __field(int, avail)
++ __field(int, depth)
++ __field(int, status)
++ __string(addr, rdma->sc_xprt.xpt_remotebuf)
++ ),
++
++ TP_fast_assign(
++ __entry->avail = atomic_read(&rdma->sc_sq_avail);
++ __entry->depth = rdma->sc_sq_depth;
++ __entry->status = status;
++ __assign_str(addr, rdma->sc_xprt.xpt_remotebuf);
++ ),
++
++ TP_printk("addr=%s sc_sq_avail=%d/%d status=%d",
++ __get_str(addr), __entry->avail, __entry->depth,
++ __entry->status
++ )
++);
++
+ #endif /* _TRACE_RPCRDMA_H */
+
+ #include <trace/define_trace.h>
+diff --git a/include/uapi/linux/swab.h b/include/uapi/linux/swab.h
+index fa7f97da5b76..7272f85d6d6a 100644
+--- a/include/uapi/linux/swab.h
++++ b/include/uapi/linux/swab.h
+@@ -135,9 +135,9 @@ static inline __attribute_const__ __u32 __fswahb32(__u32 val)
+
+ static __always_inline unsigned long __swab(const unsigned long y)
+ {
+-#if BITS_PER_LONG == 64
++#if __BITS_PER_LONG == 64
+ return __swab64(y);
+-#else /* BITS_PER_LONG == 32 */
++#else /* __BITS_PER_LONG == 32 */
+ return __swab32(y);
+ #endif
+ }
+diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
+index 3c18260403dd..61fbcae82f0a 100644
+--- a/kernel/bpf/cpumap.c
++++ b/kernel/bpf/cpumap.c
+@@ -455,7 +455,7 @@ static int cpu_map_update_elem(struct bpf_map *map, void *key, void *value,
+ return -EOVERFLOW;
+
+ /* Make sure CPU is a valid possible cpu */
+- if (!cpu_possible(key_cpu))
++ if (key_cpu >= nr_cpumask_bits || !cpu_possible(key_cpu))
+ return -ENODEV;
+
+ if (qsize == 0) {
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 00fb2fe92c4d..21e3c65abc76 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -6923,10 +6923,17 @@ static void perf_event_task_output(struct perf_event *event,
+ goto out;
+
+ task_event->event_id.pid = perf_event_pid(event, task);
+- task_event->event_id.ppid = perf_event_pid(event, current);
+-
+ task_event->event_id.tid = perf_event_tid(event, task);
+- task_event->event_id.ptid = perf_event_tid(event, current);
++
++ if (task_event->event_id.header.type == PERF_RECORD_EXIT) {
++ task_event->event_id.ppid = perf_event_pid(event,
++ task->real_parent);
++ task_event->event_id.ptid = perf_event_pid(event,
++ task->real_parent);
++ } else { /* PERF_RECORD_FORK */
++ task_event->event_id.ppid = perf_event_pid(event, current);
++ task_event->event_id.ptid = perf_event_tid(event, current);
++ }
+
+ task_event->event_id.time = perf_event_clock(event);
+
+diff --git a/mm/shmem.c b/mm/shmem.c
+index a6fc82a1ab6b..0a2e1e7801d6 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2350,11 +2350,11 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
+
+ lru_cache_add_anon(page);
+
+- spin_lock(&info->lock);
++ spin_lock_irq(&info->lock);
+ info->alloced++;
+ inode->i_blocks += BLOCKS_PER_PAGE;
+ shmem_recalc_inode(inode);
+- spin_unlock(&info->lock);
++ spin_unlock_irq(&info->lock);
+
+ inc_mm_counter(dst_mm, mm_counter_file(page));
+ page_add_file_rmap(page, false);
+diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
+index 4c0087a48e87..fe190a691872 100644
+--- a/net/rxrpc/local_object.c
++++ b/net/rxrpc/local_object.c
+@@ -169,15 +169,6 @@ static int rxrpc_open_socket(struct rxrpc_local *local, struct net *net)
+ goto error;
+ }
+
+- /* we want to set the don't fragment bit */
+- opt = IPV6_PMTUDISC_DO;
+- ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER,
+- (char *) &opt, sizeof(opt));
+- if (ret < 0) {
+- _debug("setsockopt failed");
+- goto error;
+- }
+-
+ /* Fall through and set IPv4 options too otherwise we don't get
+ * errors from IPv4 packets sent through the IPv6 socket.
+ */
+diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
+index b0aa08e3796d..da8a555ec3f6 100644
+--- a/net/rxrpc/output.c
++++ b/net/rxrpc/output.c
+@@ -480,41 +480,21 @@ send_fragmentable:
+ skb->tstamp = ktime_get_real();
+
+ switch (conn->params.local->srx.transport.family) {
++ case AF_INET6:
+ case AF_INET:
+ opt = IP_PMTUDISC_DONT;
+- ret = kernel_setsockopt(conn->params.local->socket,
+- SOL_IP, IP_MTU_DISCOVER,
+- (char *)&opt, sizeof(opt));
+- if (ret == 0) {
+- ret = kernel_sendmsg(conn->params.local->socket, &msg,
+- iov, 2, len);
+- conn->params.peer->last_tx_at = ktime_get_seconds();
+-
+- opt = IP_PMTUDISC_DO;
+- kernel_setsockopt(conn->params.local->socket, SOL_IP,
+- IP_MTU_DISCOVER,
+- (char *)&opt, sizeof(opt));
+- }
+- break;
+-
+-#ifdef CONFIG_AF_RXRPC_IPV6
+- case AF_INET6:
+- opt = IPV6_PMTUDISC_DONT;
+- ret = kernel_setsockopt(conn->params.local->socket,
+- SOL_IPV6, IPV6_MTU_DISCOVER,
+- (char *)&opt, sizeof(opt));
+- if (ret == 0) {
+- ret = kernel_sendmsg(conn->params.local->socket, &msg,
+- iov, 2, len);
+- conn->params.peer->last_tx_at = ktime_get_seconds();
+-
+- opt = IPV6_PMTUDISC_DO;
+- kernel_setsockopt(conn->params.local->socket,
+- SOL_IPV6, IPV6_MTU_DISCOVER,
+- (char *)&opt, sizeof(opt));
+- }
++ kernel_setsockopt(conn->params.local->socket,
++ SOL_IP, IP_MTU_DISCOVER,
++ (char *)&opt, sizeof(opt));
++ ret = kernel_sendmsg(conn->params.local->socket, &msg,
++ iov, 2, len);
++ conn->params.peer->last_tx_at = ktime_get_seconds();
++
++ opt = IP_PMTUDISC_DO;
++ kernel_setsockopt(conn->params.local->socket,
++ SOL_IP, IP_MTU_DISCOVER,
++ (char *)&opt, sizeof(opt));
+ break;
+-#endif
+
+ default:
+ BUG();
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 6cf0fd37cbf0..c8ee8e801edb 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -878,9 +878,6 @@ int svc_send(struct svc_rqst *rqstp)
+ if (!xprt)
+ goto out;
+
+- /* release the receive skb before sending the reply */
+- xprt->xpt_ops->xpo_release_rqst(rqstp);
+-
+ /* calculate over-all length */
+ xb = &rqstp->rq_res;
+ xb->len = xb->head[0].iov_len +
+diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
+index 8566531c2f10..d0b5a1c47a32 100644
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -636,6 +636,8 @@ svc_udp_sendto(struct svc_rqst *rqstp)
+ {
+ int error;
+
++ svc_release_udp_skb(rqstp);
++
+ error = svc_sendto(rqstp, &rqstp->rq_res);
+ if (error == -ECONNREFUSED)
+ /* ICMP error on earlier request. */
+@@ -1173,6 +1175,8 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
+ int sent;
+ __be32 reclen;
+
++ svc_release_skb(rqstp);
++
+ /* Set up the first element of the reply kvec.
+ * Any other kvecs that may be in use have been taken
+ * care of by the server implementation itself.
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+index b24d5b8f2fee..16c8174658fd 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+@@ -226,6 +226,26 @@ void svc_rdma_recv_ctxt_put(struct svcxprt_rdma *rdma,
+ svc_rdma_recv_ctxt_destroy(rdma, ctxt);
+ }
+
++/**
++ * svc_rdma_release_rqst - Release transport-specific per-rqst resources
++ * @rqstp: svc_rqst being released
++ *
++ * Ensure that the recv_ctxt is released whether or not a Reply
++ * was sent. For example, the client could close the connection,
++ * or svc_process could drop an RPC, before the Reply is sent.
++ */
++void svc_rdma_release_rqst(struct svc_rqst *rqstp)
++{
++ struct svc_rdma_recv_ctxt *ctxt = rqstp->rq_xprt_ctxt;
++ struct svc_xprt *xprt = rqstp->rq_xprt;
++ struct svcxprt_rdma *rdma =
++ container_of(xprt, struct svcxprt_rdma, sc_xprt);
++
++ rqstp->rq_xprt_ctxt = NULL;
++ if (ctxt)
++ svc_rdma_recv_ctxt_put(rdma, ctxt);
++}
++
+ static int __svc_rdma_post_recv(struct svcxprt_rdma *rdma,
+ struct svc_rdma_recv_ctxt *ctxt)
+ {
+@@ -704,6 +724,8 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
+ __be32 *p;
+ int ret;
+
++ rqstp->rq_xprt_ctxt = NULL;
++
+ spin_lock(&rdma_xprt->sc_rq_dto_lock);
+ ctxt = svc_rdma_next_recv_ctxt(&rdma_xprt->sc_read_complete_q);
+ if (ctxt) {
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
+index dc1951759a8e..4fc0ce127089 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
+@@ -331,8 +331,6 @@ static int svc_rdma_post_chunk_ctxt(struct svc_rdma_chunk_ctxt *cc)
+ if (atomic_sub_return(cc->cc_sqecount,
+ &rdma->sc_sq_avail) > 0) {
+ ret = ib_post_send(rdma->sc_qp, first_wr, &bad_wr);
+- trace_svcrdma_post_rw(&cc->cc_cqe,
+- cc->cc_sqecount, ret);
+ if (ret)
+ break;
+ return 0;
+@@ -345,6 +343,7 @@ static int svc_rdma_post_chunk_ctxt(struct svc_rdma_chunk_ctxt *cc)
+ trace_svcrdma_sq_retry(rdma);
+ } while (1);
+
++ trace_svcrdma_sq_post_err(rdma, ret);
+ set_bit(XPT_CLOSE, &xprt->xpt_flags);
+
+ /* If even one was posted, there will be a completion. */
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+index e8ad7ddf347a..aa4d19a780d7 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+@@ -310,15 +310,17 @@ int svc_rdma_send(struct svcxprt_rdma *rdma, struct ib_send_wr *wr)
+ }
+
+ svc_xprt_get(&rdma->sc_xprt);
++ trace_svcrdma_post_send(wr);
+ ret = ib_post_send(rdma->sc_qp, wr, NULL);
+- trace_svcrdma_post_send(wr, ret);
+- if (ret) {
+- set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
+- svc_xprt_put(&rdma->sc_xprt);
+- wake_up(&rdma->sc_send_wait);
+- }
+- break;
++ if (ret)
++ break;
++ return 0;
+ }
++
++ trace_svcrdma_sq_post_err(rdma, ret);
++ set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
++ svc_xprt_put(&rdma->sc_xprt);
++ wake_up(&rdma->sc_send_wait);
+ return ret;
+ }
+
+@@ -906,12 +908,7 @@ int svc_rdma_sendto(struct svc_rqst *rqstp)
+ wr_lst, rp_ch);
+ if (ret < 0)
+ goto err1;
+- ret = 0;
+-
+-out:
+- rqstp->rq_xprt_ctxt = NULL;
+- svc_rdma_recv_ctxt_put(rdma, rctxt);
+- return ret;
++ return 0;
+
+ err2:
+ if (ret != -E2BIG && ret != -EINVAL)
+@@ -920,14 +917,12 @@ out:
+ ret = svc_rdma_send_error_msg(rdma, sctxt, rqstp);
+ if (ret < 0)
+ goto err1;
+- ret = 0;
+- goto out;
++ return 0;
+
+ err1:
+ svc_rdma_send_ctxt_put(rdma, sctxt);
+ err0:
+ trace_svcrdma_send_failed(rqstp, ret);
+ set_bit(XPT_CLOSE, &xprt->xpt_flags);
+- ret = -ENOTCONN;
+- goto out;
++ return -ENOTCONN;
+ }
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+index 7308992b7a18..f1824303e076 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+@@ -71,7 +71,6 @@ static struct svc_xprt *svc_rdma_create(struct svc_serv *serv,
+ struct sockaddr *sa, int salen,
+ int flags);
+ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt);
+-static void svc_rdma_release_rqst(struct svc_rqst *);
+ static void svc_rdma_detach(struct svc_xprt *xprt);
+ static void svc_rdma_free(struct svc_xprt *xprt);
+ static int svc_rdma_has_wspace(struct svc_xprt *xprt);
+@@ -616,10 +615,6 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
+ return NULL;
+ }
+
+-static void svc_rdma_release_rqst(struct svc_rqst *rqstp)
+-{
+-}
+-
+ /*
+ * When connected, an svc_xprt has at least two references:
+ *
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 0502042c1616..0d7981eda2c4 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2054,7 +2054,7 @@ static int azx_first_init(struct azx *chip)
+ /* codec detection */
+ if (!azx_bus(chip)->codec_mask) {
+ dev_err(card->dev, "no codecs found!\n");
+- return -ENODEV;
++ /* keep running the rest for the runtime PM */
+ }
+
+ if (azx_acquire_irq(chip, 0) < 0)
+@@ -2440,9 +2440,11 @@ static int azx_probe_continue(struct azx *chip)
+ #endif
+
+ /* create codec instances */
+- err = azx_probe_codecs(chip, azx_max_codecs[chip->driver_type]);
+- if (err < 0)
+- goto out_free;
++ if (bus->codec_mask) {
++ err = azx_probe_codecs(chip, azx_max_codecs[chip->driver_type]);
++ if (err < 0)
++ goto out_free;
++ }
+
+ #ifdef CONFIG_SND_HDA_PATCH_LOADER
+ if (chip->fw) {
+@@ -2456,7 +2458,7 @@ static int azx_probe_continue(struct azx *chip)
+ #endif
+ }
+ #endif
+- if ((probe_only[dev] & 1) == 0) {
++ if (bus->codec_mask && !(probe_only[dev] & 1)) {
+ err = azx_codec_configure(chip);
+ if (err < 0)
+ goto out_free;
+@@ -2473,8 +2475,11 @@ static int azx_probe_continue(struct azx *chip)
+
+ set_default_power_save(chip);
+
+- if (azx_has_pm_runtime(chip))
++ if (azx_has_pm_runtime(chip)) {
++ pm_runtime_use_autosuspend(&pci->dev);
++ pm_runtime_allow(&pci->dev);
+ pm_runtime_put_autosuspend(&pci->dev);
++ }
+
+ out_free:
+ if ((chip->driver_caps & AZX_DCAPS_I915_POWERWELL)
+diff --git a/sound/soc/codecs/tas571x.c b/sound/soc/codecs/tas571x.c
+index ca2dfe12344e..354f17a2fa5c 100644
+--- a/sound/soc/codecs/tas571x.c
++++ b/sound/soc/codecs/tas571x.c
+@@ -824,8 +824,10 @@ static int tas571x_i2c_probe(struct i2c_client *client,
+
+ priv->regmap = devm_regmap_init(dev, NULL, client,
+ priv->chip->regmap_config);
+- if (IS_ERR(priv->regmap))
+- return PTR_ERR(priv->regmap);
++ if (IS_ERR(priv->regmap)) {
++ ret = PTR_ERR(priv->regmap);
++ goto disable_regs;
++ }
+
+ priv->pdn_gpio = devm_gpiod_get_optional(dev, "pdn", GPIOD_OUT_LOW);
+ if (IS_ERR(priv->pdn_gpio)) {
+@@ -849,7 +851,7 @@ static int tas571x_i2c_probe(struct i2c_client *client,
+
+ ret = regmap_write(priv->regmap, TAS571X_OSC_TRIM_REG, 0);
+ if (ret)
+- return ret;
++ goto disable_regs;
+
+ usleep_range(50000, 60000);
+
+@@ -865,12 +867,20 @@ static int tas571x_i2c_probe(struct i2c_client *client,
+ */
+ ret = regmap_update_bits(priv->regmap, TAS571X_MVOL_REG, 1, 0);
+ if (ret)
+- return ret;
++ goto disable_regs;
+ }
+
+- return devm_snd_soc_register_component(&client->dev,
++ ret = devm_snd_soc_register_component(&client->dev,
+ &priv->component_driver,
+ &tas571x_dai, 1);
++ if (ret)
++ goto disable_regs;
++
++ return ret;
++
++disable_regs:
++ regulator_bulk_disable(priv->chip->num_supply_names, priv->supplies);
++ return ret;
+ }
+
+ static int tas571x_i2c_remove(struct i2c_client *client)
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 8dc1f3d6a988..c4c00297ada6 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -863,8 +863,7 @@ static int wm8960_hw_params(struct snd_pcm_substream *substream,
+
+ wm8960->is_stream_in_use[tx] = true;
+
+- if (snd_soc_component_get_bias_level(component) == SND_SOC_BIAS_ON &&
+- !wm8960->is_stream_in_use[!tx])
++ if (!wm8960->is_stream_in_use[!tx])
+ return wm8960_configure_clocking(component);
+
+ return 0;
+diff --git a/sound/soc/qcom/qdsp6/q6afe-dai.c b/sound/soc/qcom/qdsp6/q6afe-dai.c
+index 8f6c8fc073a9..1fc1939b90c2 100644
+--- a/sound/soc/qcom/qdsp6/q6afe-dai.c
++++ b/sound/soc/qcom/qdsp6/q6afe-dai.c
+@@ -899,6 +899,8 @@ static struct snd_soc_dai_driver q6afe_dais[] = {
+ SNDRV_PCM_RATE_16000,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE |
+ SNDRV_PCM_FMTBIT_S24_LE,
++ .channels_min = 1,
++ .channels_max = 8,
+ .rate_min = 8000,
+ .rate_max = 48000,
+ },
+@@ -914,6 +916,8 @@ static struct snd_soc_dai_driver q6afe_dais[] = {
+ SNDRV_PCM_RATE_16000,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE |
+ SNDRV_PCM_FMTBIT_S24_LE,
++ .channels_min = 1,
++ .channels_max = 8,
+ .rate_min = 8000,
+ .rate_max = 48000,
+ },
+@@ -928,6 +932,8 @@ static struct snd_soc_dai_driver q6afe_dais[] = {
+ .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+ SNDRV_PCM_RATE_16000,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE,
++ .channels_min = 1,
++ .channels_max = 8,
+ .rate_min = 8000,
+ .rate_max = 48000,
+ },
+@@ -943,6 +949,8 @@ static struct snd_soc_dai_driver q6afe_dais[] = {
+ SNDRV_PCM_RATE_16000,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE |
+ SNDRV_PCM_FMTBIT_S24_LE,
++ .channels_min = 1,
++ .channels_max = 8,
+ .rate_min = 8000,
+ .rate_max = 48000,
+ },
+@@ -957,6 +965,8 @@ static struct snd_soc_dai_driver q6afe_dais[] = {
+ .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+ SNDRV_PCM_RATE_16000,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE,
++ .channels_min = 1,
++ .channels_max = 8,
+ .rate_min = 8000,
+ .rate_max = 48000,
+ },
+@@ -972,6 +982,8 @@ static struct snd_soc_dai_driver q6afe_dais[] = {
+ SNDRV_PCM_RATE_16000,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE |
+ SNDRV_PCM_FMTBIT_S24_LE,
++ .channels_min = 1,
++ .channels_max = 8,
+ .rate_min = 8000,
+ .rate_max = 48000,
+ },
+@@ -986,6 +998,8 @@ static struct snd_soc_dai_driver q6afe_dais[] = {
+ .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_8000 |
+ SNDRV_PCM_RATE_16000,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE,
++ .channels_min = 1,
++ .channels_max = 8,
+ .rate_min = 8000,
+ .rate_max = 48000,
+ },
+@@ -1001,6 +1015,8 @@ static struct snd_soc_dai_driver q6afe_dais[] = {
+ SNDRV_PCM_RATE_16000,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE |
+ SNDRV_PCM_FMTBIT_S24_LE,
++ .channels_min = 1,
++ .channels_max = 8,
+ .rate_min = 8000,
+ .rate_max = 48000,
+ },
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 9479c74af9ba..4613d796492a 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -2086,14 +2086,27 @@ static bool ignore_unreachable_insn(struct instruction *insn)
+ !strcmp(insn->sec->name, ".altinstr_aux"))
+ return true;
+
++ if (!insn->func)
++ return false;
++
++ /*
++ * CONFIG_UBSAN_TRAP inserts a UD2 when it sees
++ * __builtin_unreachable(). The BUG() macro has an unreachable() after
++ * the UD2, which causes GCC's undefined trap logic to emit another UD2
++ * (or occasionally a JMP to UD2).
++ */
++ if (list_prev_entry(insn, list)->dead_end &&
++ (insn->type == INSN_BUG ||
++ (insn->type == INSN_JUMP_UNCONDITIONAL &&
++ insn->jump_dest && insn->jump_dest->type == INSN_BUG)))
++ return true;
++
+ /*
+ * Check if this (or a subsequent) instruction is related to
+ * CONFIG_UBSAN or CONFIG_KASAN.
+ *
+ * End the search at 5 instructions to avoid going into the weeds.
+ */
+- if (!insn->func)
+- return false;
+ for (i = 0; i < 5; i++) {
+
+ if (is_kasan_insn(insn) || is_ubsan_insn(insn))
+diff --git a/tools/objtool/orc_dump.c b/tools/objtool/orc_dump.c
+index faa444270ee3..1a3e774941f8 100644
+--- a/tools/objtool/orc_dump.c
++++ b/tools/objtool/orc_dump.c
+@@ -78,7 +78,7 @@ int orc_dump(const char *_objname)
+ char *name;
+ size_t nr_sections;
+ Elf64_Addr orc_ip_addr = 0;
+- size_t shstrtab_idx;
++ size_t shstrtab_idx, strtab_idx = 0;
+ Elf *elf;
+ Elf_Scn *scn;
+ GElf_Shdr sh;
+@@ -139,6 +139,8 @@ int orc_dump(const char *_objname)
+
+ if (!strcmp(name, ".symtab")) {
+ symtab = data;
++ } else if (!strcmp(name, ".strtab")) {
++ strtab_idx = i;
+ } else if (!strcmp(name, ".orc_unwind")) {
+ orc = data->d_buf;
+ orc_size = sh.sh_size;
+@@ -150,7 +152,7 @@ int orc_dump(const char *_objname)
+ }
+ }
+
+- if (!symtab || !orc || !orc_ip)
++ if (!symtab || !strtab_idx || !orc || !orc_ip)
+ return 0;
+
+ if (orc_size % sizeof(*orc) != 0) {
+@@ -171,21 +173,29 @@ int orc_dump(const char *_objname)
+ return -1;
+ }
+
+- scn = elf_getscn(elf, sym.st_shndx);
+- if (!scn) {
+- WARN_ELF("elf_getscn");
+- return -1;
+- }
+-
+- if (!gelf_getshdr(scn, &sh)) {
+- WARN_ELF("gelf_getshdr");
+- return -1;
+- }
+-
+- name = elf_strptr(elf, shstrtab_idx, sh.sh_name);
+- if (!name || !*name) {
+- WARN_ELF("elf_strptr");
+- return -1;
++ if (GELF_ST_TYPE(sym.st_info) == STT_SECTION) {
++ scn = elf_getscn(elf, sym.st_shndx);
++ if (!scn) {
++ WARN_ELF("elf_getscn");
++ return -1;
++ }
++
++ if (!gelf_getshdr(scn, &sh)) {
++ WARN_ELF("gelf_getshdr");
++ return -1;
++ }
++
++ name = elf_strptr(elf, shstrtab_idx, sh.sh_name);
++ if (!name) {
++ WARN_ELF("elf_strptr");
++ return -1;
++ }
++ } else {
++ name = elf_strptr(elf, strtab_idx, sym.st_name);
++ if (!name) {
++ WARN_ELF("elf_strptr");
++ return -1;
++ }
+ }
+
+ printf("%s+%llx:", name, (unsigned long long)rela.r_addend);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-05-06 11:46 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-05-06 11:46 UTC (permalink / raw
To: gentoo-commits
commit: 2e017bc50a517d56fd00d782673e75d6309b5746
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 6 11:46:07 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 6 11:46:07 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2e017bc5
Linux patch 4.19.121
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1120_linux-4.19.121.patch | 1136 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1140 insertions(+)
diff --git a/0000_README b/0000_README
index 8850298..bc85fe6 100644
--- a/0000_README
+++ b/0000_README
@@ -519,6 +519,10 @@ Patch: 1119_linux-4.19.120.patch
From: https://www.kernel.org
Desc: Linux 4.19.120
+Patch: 1120_linux-4.19.121.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.121
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1120_linux-4.19.121.patch b/1120_linux-4.19.121.patch
new file mode 100644
index 0000000..c8ea7c7
--- /dev/null
+++ b/1120_linux-4.19.121.patch
@@ -0,0 +1,1136 @@
+diff --git a/Makefile b/Makefile
+index 74b60bf2ff79..f7406a6f8330 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 120
++SUBLEVEL = 121
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index 54b6547d32b2..3837cad94f35 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -227,13 +227,13 @@ int acpi_device_set_power(struct acpi_device *device, int state)
+ end:
+ if (result) {
+ dev_warn(&device->dev, "Failed to change power state to %s\n",
+- acpi_power_state_string(state));
++ acpi_power_state_string(target_state));
+ } else {
+ device->power.state = target_state;
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ "Device [%s] transitioned to %s\n",
+ device->pnp.bus_id,
+- acpi_power_state_string(state)));
++ acpi_power_state_string(target_state)));
+ }
+
+ return result;
+diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
+index 7b7fba0c9253..e38a653dd208 100644
+--- a/drivers/dma/dmatest.c
++++ b/drivers/dma/dmatest.c
+@@ -567,8 +567,8 @@ static int dmatest_func(void *data)
+ flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT;
+
+ ktime = ktime_get();
+- while (!kthread_should_stop()
+- && !(params->iterations && total_tests >= params->iterations)) {
++ while (!(kthread_should_stop() ||
++ (params->iterations && total_tests >= params->iterations))) {
+ struct dma_async_tx_descriptor *tx = NULL;
+ struct dmaengine_unmap_data *um;
+ dma_addr_t *dsts;
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index f5926bf5dabd..d5dcee7f1fc8 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -4706,7 +4706,7 @@ static struct drm_display_mode *drm_mode_displayid_detailed(struct drm_device *d
+ struct drm_display_mode *mode;
+ unsigned pixel_clock = (timings->pixel_clock[0] |
+ (timings->pixel_clock[1] << 8) |
+- (timings->pixel_clock[2] << 16));
++ (timings->pixel_clock[2] << 16)) + 1;
+ unsigned hactive = (timings->hactive[0] | timings->hactive[1] << 8) + 1;
+ unsigned hblank = (timings->hblank[0] | timings->hblank[1] << 8) + 1;
+ unsigned hsync = (timings->hsync[0] | (timings->hsync[1] & 0x7f) << 8) + 1;
+diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
+index 208af9f37914..5177e37d81e6 100644
+--- a/drivers/gpu/drm/qxl/qxl_cmd.c
++++ b/drivers/gpu/drm/qxl/qxl_cmd.c
+@@ -472,9 +472,10 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
+ return ret;
+
+ ret = qxl_release_reserve_list(release, true);
+- if (ret)
++ if (ret) {
++ qxl_release_free(qdev, release);
+ return ret;
+-
++ }
+ cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
+ cmd->type = QXL_SURFACE_CMD_CREATE;
+ cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
+@@ -500,8 +501,8 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
+ /* no need to add a release to the fence for this surface bo,
+ since it is only released when we ask to destroy the surface
+ and it would never signal otherwise */
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
+ qxl_release_fence_buffer_objects(release);
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
+
+ surf->hw_surf_alloc = true;
+ spin_lock(&qdev->surf_id_idr_lock);
+@@ -543,9 +544,8 @@ int qxl_hw_surface_dealloc(struct qxl_device *qdev,
+ cmd->surface_id = id;
+ qxl_release_unmap(qdev, release, &cmd->release_info);
+
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
+-
+ qxl_release_fence_buffer_objects(release);
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
+index 0570c6826bff..769e12b4c13c 100644
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -532,8 +532,8 @@ static int qxl_primary_apply_cursor(struct drm_plane *plane)
+ cmd->u.set.visible = 1;
+ qxl_release_unmap(qdev, release, &cmd->release_info);
+
+- qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+ qxl_release_fence_buffer_objects(release);
++ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+
+ return ret;
+
+@@ -694,8 +694,8 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
+ cmd->u.position.y = plane->state->crtc_y + fb->hot_y;
+
+ qxl_release_unmap(qdev, release, &cmd->release_info);
+- qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+ qxl_release_fence_buffer_objects(release);
++ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+
+ if (old_cursor_bo)
+ qxl_bo_unref(&old_cursor_bo);
+@@ -740,8 +740,8 @@ static void qxl_cursor_atomic_disable(struct drm_plane *plane,
+ cmd->type = QXL_CURSOR_HIDE;
+ qxl_release_unmap(qdev, release, &cmd->release_info);
+
+- qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+ qxl_release_fence_buffer_objects(release);
++ qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+ }
+
+ static int qxl_plane_prepare_fb(struct drm_plane *plane,
+diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c
+index 4d8681e84e68..d009f2bc28e9 100644
+--- a/drivers/gpu/drm/qxl/qxl_draw.c
++++ b/drivers/gpu/drm/qxl/qxl_draw.c
+@@ -241,8 +241,8 @@ void qxl_draw_opaque_fb(const struct qxl_fb_image *qxl_fb_image,
+ qxl_bo_physical_address(qdev, dimage->bo, 0);
+ qxl_release_unmap(qdev, release, &drawable->release_info);
+
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+ qxl_release_fence_buffer_objects(release);
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+
+ out_free_palette:
+ if (palette_bo)
+@@ -348,9 +348,10 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev,
+ goto out_release_backoff;
+
+ rects = drawable_set_clipping(qdev, num_clips, clips_bo);
+- if (!rects)
++ if (!rects) {
++ ret = -EINVAL;
+ goto out_release_backoff;
+-
++ }
+ drawable = (struct qxl_drawable *)qxl_release_map(qdev, release);
+
+ drawable->clip.type = SPICE_CLIP_TYPE_RECTS;
+@@ -381,8 +382,8 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev,
+ }
+ qxl_bo_kunmap(clips_bo);
+
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+ qxl_release_fence_buffer_objects(release);
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+
+ out_release_backoff:
+ if (ret)
+@@ -432,8 +433,8 @@ void qxl_draw_copyarea(struct qxl_device *qdev,
+ drawable->u.copy_bits.src_pos.y = sy;
+ qxl_release_unmap(qdev, release, &drawable->release_info);
+
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+ qxl_release_fence_buffer_objects(release);
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+
+ out_free_release:
+ if (ret)
+@@ -476,8 +477,8 @@ void qxl_draw_fill(struct qxl_draw_fill *qxl_draw_fill_rec)
+
+ qxl_release_unmap(qdev, release, &drawable->release_info);
+
+- qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+ qxl_release_fence_buffer_objects(release);
++ qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
+
+ out_free_release:
+ if (ret)
+diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
+index 6cc9f3367fa0..5536b2f7b7b0 100644
+--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
++++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
+@@ -257,11 +257,8 @@ static int qxl_process_single_command(struct qxl_device *qdev,
+ apply_surf_reloc(qdev, &reloc_info[i]);
+ }
+
++ qxl_release_fence_buffer_objects(release);
+ ret = qxl_push_command_ring_release(qdev, release, cmd->type, true);
+- if (ret)
+- qxl_release_backoff_reserve_list(release);
+- else
+- qxl_release_fence_buffer_objects(release);
+
+ out_free_bos:
+ out_free_release:
+diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
+index c4118bcd5103..bf937fec50dc 100644
+--- a/drivers/infiniband/core/rdma_core.c
++++ b/drivers/infiniband/core/rdma_core.c
+@@ -381,7 +381,7 @@ lookup_get_fd_uobject(const struct uverbs_api_object *obj,
+ * and the caller is expected to ensure that uverbs_close_fd is never
+ * done while a call top lookup is possible.
+ */
+- if (f->f_op != fd_type->fops) {
++ if (f->f_op != fd_type->fops || uobject->ufile != ufile) {
+ fput(f);
+ return ERR_PTR(-EBADF);
+ }
+@@ -697,7 +697,6 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj,
+ enum rdma_lookup_mode mode)
+ {
+ assert_uverbs_usecnt(uobj, mode);
+- uobj->uapi_object->type_class->lookup_put(uobj, mode);
+ /*
+ * In order to unlock an object, either decrease its usecnt for
+ * read access or zero it in case of exclusive access. See
+@@ -714,6 +713,7 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj,
+ break;
+ }
+
++ uobj->uapi_object->type_class->lookup_put(uobj, mode);
+ /* Pairs with the kref obtained by type->lookup_get */
+ uverbs_uobject_put(uobj);
+ }
+diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
+index a19d3ad14dc3..eac4ade45611 100644
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -1606,8 +1606,9 @@ static int __mlx4_ib_create_default_rules(
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(pdefault_rules->rules_create_list); i++) {
++ union ib_flow_spec ib_spec = {};
+ int ret;
+- union ib_flow_spec ib_spec;
++
+ switch (pdefault_rules->rules_create_list[i]) {
+ case 0:
+ /* no rule */
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 4fc9278d0dde..10f6ae4f8f3f 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -4887,7 +4887,9 @@ static void to_rdma_ah_attr(struct mlx5_ib_dev *ibdev,
+ rdma_ah_set_path_bits(ah_attr, path->grh_mlid & 0x7f);
+ rdma_ah_set_static_rate(ah_attr,
+ path->static_rate ? path->static_rate - 5 : 0);
+- if (path->grh_mlid & (1 << 7)) {
++
++ if (path->grh_mlid & (1 << 7) ||
++ ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE) {
+ u32 tc_fl = be32_to_cpu(path->tclass_flowlabel);
+
+ rdma_ah_set_grh(ah_attr, NULL,
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 465f28a7844c..2557ed112bc2 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -2836,7 +2836,7 @@ static int __init parse_amd_iommu_intr(char *str)
+ {
+ for (; *str; ++str) {
+ if (strncmp(str, "legacy", 6) == 0) {
+- amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY;
++ amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY_GA;
+ break;
+ }
+ if (strncmp(str, "vapic", 5) == 0) {
+diff --git a/drivers/iommu/qcom_iommu.c b/drivers/iommu/qcom_iommu.c
+index 9a6ed5eeaad1..b0a4a3d2f60e 100644
+--- a/drivers/iommu/qcom_iommu.c
++++ b/drivers/iommu/qcom_iommu.c
+@@ -797,8 +797,11 @@ static int qcom_iommu_device_probe(struct platform_device *pdev)
+ qcom_iommu->dev = dev;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- if (res)
++ if (res) {
+ qcom_iommu->local_base = devm_ioremap_resource(dev, res);
++ if (IS_ERR(qcom_iommu->local_base))
++ return PTR_ERR(qcom_iommu->local_base);
++ }
+
+ qcom_iommu->iface_clk = devm_clk_get(dev, "iface");
+ if (IS_ERR(qcom_iommu->iface_clk)) {
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index def4f6ec290b..207ca0ad0b59 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -586,10 +586,12 @@ static struct pgpath *__map_bio(struct multipath *m, struct bio *bio)
+
+ /* Do we need to select a new pgpath? */
+ pgpath = READ_ONCE(m->current_pgpath);
+- queue_io = test_bit(MPATHF_QUEUE_IO, &m->flags);
+- if (!pgpath || !queue_io)
++ if (!pgpath || !test_bit(MPATHF_QUEUE_IO, &m->flags))
+ pgpath = choose_pgpath(m, bio->bi_iter.bi_size);
+
++ /* MPATHF_QUEUE_IO might have been cleared by choose_pgpath. */
++ queue_io = test_bit(MPATHF_QUEUE_IO, &m->flags);
++
+ if ((pgpath && queue_io) ||
+ (!pgpath && test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))) {
+ /* Queue for the daemon to resubmit */
+diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
+index 0f4a2143bf55..bb8327999705 100644
+--- a/drivers/md/dm-verity-fec.c
++++ b/drivers/md/dm-verity-fec.c
+@@ -436,7 +436,7 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io,
+ fio->level++;
+
+ if (type == DM_VERITY_BLOCK_TYPE_METADATA)
+- block += v->data_blocks;
++ block = block - v->hash_start + v->data_blocks;
+
+ /*
+ * For RS(M, N), the continuous FEC data is divided into blocks of N
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index a76eda50ad48..4321c48eba6b 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -884,6 +884,24 @@ static int writecache_alloc_entries(struct dm_writecache *wc)
+ return 0;
+ }
+
++static int writecache_read_metadata(struct dm_writecache *wc, sector_t n_sectors)
++{
++ struct dm_io_region region;
++ struct dm_io_request req;
++
++ region.bdev = wc->ssd_dev->bdev;
++ region.sector = wc->start_sector;
++ region.count = n_sectors;
++ req.bi_op = REQ_OP_READ;
++ req.bi_op_flags = REQ_SYNC;
++ req.mem.type = DM_IO_VMA;
++ req.mem.ptr.vma = (char *)wc->memory_map;
++ req.client = wc->dm_io;
++ req.notify.fn = NULL;
++
++ return dm_io(&req, 1, ®ion, NULL);
++}
++
+ static void writecache_resume(struct dm_target *ti)
+ {
+ struct dm_writecache *wc = ti->private;
+@@ -894,8 +912,18 @@ static void writecache_resume(struct dm_target *ti)
+
+ wc_lock(wc);
+
+- if (WC_MODE_PMEM(wc))
++ if (WC_MODE_PMEM(wc)) {
+ persistent_memory_invalidate_cache(wc->memory_map, wc->memory_map_size);
++ } else {
++ r = writecache_read_metadata(wc, wc->metadata_sectors);
++ if (r) {
++ size_t sb_entries_offset;
++ writecache_error(wc, r, "unable to read metadata: %d", r);
++ sb_entries_offset = offsetof(struct wc_memory_superblock, entries);
++ memset((char *)wc->memory_map + sb_entries_offset, -1,
++ (wc->metadata_sectors << SECTOR_SHIFT) - sb_entries_offset);
++ }
++ }
+
+ wc->tree = RB_ROOT;
+ INIT_LIST_HEAD(&wc->lru);
+@@ -1978,6 +2006,12 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ ti->error = "Invalid block size";
+ goto bad;
+ }
++ if (wc->block_size < bdev_logical_block_size(wc->dev->bdev) ||
++ wc->block_size < bdev_logical_block_size(wc->ssd_dev->bdev)) {
++ r = -EINVAL;
++ ti->error = "Block size is smaller than device logical block size";
++ goto bad;
++ }
+ wc->block_size_bits = __ffs(wc->block_size);
+
+ wc->max_writeback_jobs = MAX_WRITEBACK_JOBS;
+@@ -2066,8 +2100,6 @@ invalid_optional:
+ goto bad;
+ }
+ } else {
+- struct dm_io_region region;
+- struct dm_io_request req;
+ size_t n_blocks, n_metadata_blocks;
+ uint64_t n_bitmap_bits;
+
+@@ -2124,19 +2156,9 @@ invalid_optional:
+ goto bad;
+ }
+
+- region.bdev = wc->ssd_dev->bdev;
+- region.sector = wc->start_sector;
+- region.count = wc->metadata_sectors;
+- req.bi_op = REQ_OP_READ;
+- req.bi_op_flags = REQ_SYNC;
+- req.mem.type = DM_IO_VMA;
+- req.mem.ptr.vma = (char *)wc->memory_map;
+- req.client = wc->dm_io;
+- req.notify.fn = NULL;
+-
+- r = dm_io(&req, 1, ®ion, NULL);
++ r = writecache_read_metadata(wc, wc->block_size >> SECTOR_SHIFT);
+ if (r) {
+- ti->error = "Unable to read metadata";
++ ti->error = "Unable to read first block of metadata";
+ goto bad;
+ }
+ }
+diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
+index 28f5aaca505a..2c5a6e7aadc0 100644
+--- a/drivers/mmc/host/cqhci.c
++++ b/drivers/mmc/host/cqhci.c
+@@ -13,6 +13,7 @@
+ #include <linux/delay.h>
+ #include <linux/highmem.h>
+ #include <linux/io.h>
++#include <linux/iopoll.h>
+ #include <linux/module.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
+@@ -351,12 +352,16 @@ static int cqhci_enable(struct mmc_host *mmc, struct mmc_card *card)
+ /* CQHCI is idle and should halt immediately, so set a small timeout */
+ #define CQHCI_OFF_TIMEOUT 100
+
++static u32 cqhci_read_ctl(struct cqhci_host *cq_host)
++{
++ return cqhci_readl(cq_host, CQHCI_CTL);
++}
++
+ static void cqhci_off(struct mmc_host *mmc)
+ {
+ struct cqhci_host *cq_host = mmc->cqe_private;
+- ktime_t timeout;
+- bool timed_out;
+ u32 reg;
++ int err;
+
+ if (!cq_host->enabled || !mmc->cqe_on || cq_host->recovery_halt)
+ return;
+@@ -366,15 +371,9 @@ static void cqhci_off(struct mmc_host *mmc)
+
+ cqhci_writel(cq_host, CQHCI_HALT, CQHCI_CTL);
+
+- timeout = ktime_add_us(ktime_get(), CQHCI_OFF_TIMEOUT);
+- while (1) {
+- timed_out = ktime_compare(ktime_get(), timeout) > 0;
+- reg = cqhci_readl(cq_host, CQHCI_CTL);
+- if ((reg & CQHCI_HALT) || timed_out)
+- break;
+- }
+-
+- if (timed_out)
++ err = readx_poll_timeout(cqhci_read_ctl, cq_host, reg,
++ reg & CQHCI_HALT, 0, CQHCI_OFF_TIMEOUT);
++ if (err < 0)
+ pr_err("%s: cqhci: CQE stuck on\n", mmc_hostname(mmc));
+ else
+ pr_debug("%s: cqhci: CQE off\n", mmc_hostname(mmc));
+diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c
+index f6c76be2be0d..1c062473b1c2 100644
+--- a/drivers/mmc/host/meson-mx-sdio.c
++++ b/drivers/mmc/host/meson-mx-sdio.c
+@@ -360,14 +360,6 @@ static void meson_mx_mmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
+ meson_mx_mmc_start_cmd(mmc, mrq->cmd);
+ }
+
+-static int meson_mx_mmc_card_busy(struct mmc_host *mmc)
+-{
+- struct meson_mx_mmc_host *host = mmc_priv(mmc);
+- u32 irqc = readl(host->base + MESON_MX_SDIO_IRQC);
+-
+- return !!(irqc & MESON_MX_SDIO_IRQC_FORCE_DATA_DAT_MASK);
+-}
+-
+ static void meson_mx_mmc_read_response(struct mmc_host *mmc,
+ struct mmc_command *cmd)
+ {
+@@ -509,7 +501,6 @@ static void meson_mx_mmc_timeout(struct timer_list *t)
+ static struct mmc_host_ops meson_mx_mmc_ops = {
+ .request = meson_mx_mmc_request,
+ .set_ios = meson_mx_mmc_set_ios,
+- .card_busy = meson_mx_mmc_card_busy,
+ .get_cd = mmc_gpio_get_cd,
+ .get_ro = mmc_gpio_get_ro,
+ };
+@@ -573,7 +564,7 @@ static int meson_mx_mmc_add_host(struct meson_mx_mmc_host *host)
+ mmc->f_max = clk_round_rate(host->cfg_div_clk,
+ clk_get_rate(host->parent_clk));
+
+- mmc->caps |= MMC_CAP_ERASE | MMC_CAP_CMD23;
++ mmc->caps |= MMC_CAP_ERASE | MMC_CAP_CMD23 | MMC_CAP_WAIT_WHILE_BUSY;
+ mmc->ops = &meson_mx_mmc_ops;
+
+ ret = mmc_of_parse(mmc);
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 17b2054d9b62..19ae527ecc72 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -1909,6 +1909,8 @@ static int sdhci_msm_probe(struct platform_device *pdev)
+ goto clk_disable;
+ }
+
++ msm_host->mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_NEED_RSP_BUSY;
++
+ pm_runtime_get_noresume(&pdev->dev);
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index 65985dc3e1a7..35168b47afe6 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -556,6 +556,9 @@ static int intel_select_drive_strength(struct mmc_card *card,
+ struct sdhci_pci_slot *slot = sdhci_priv(host);
+ struct intel_host *intel_host = sdhci_pci_priv(slot);
+
++ if (!(mmc_driver_type_mask(intel_host->drv_strength) & card_drv))
++ return 0;
++
+ return intel_host->drv_strength;
+ }
+
+diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
+index a0b5089b3274..fafb02644efd 100644
+--- a/drivers/mmc/host/sdhci-xenon.c
++++ b/drivers/mmc/host/sdhci-xenon.c
+@@ -238,6 +238,16 @@ static void xenon_voltage_switch(struct sdhci_host *host)
+ {
+ /* Wait for 5ms after set 1.8V signal enable bit */
+ usleep_range(5000, 5500);
++
++ /*
++ * For some reason the controller's Host Control2 register reports
++ * the bit representing 1.8V signaling as 0 when read after it was
++ * written as 1. Subsequent read reports 1.
++ *
++ * Since this may cause some issues, do an empty read of the Host
++ * Control2 register here to circumvent this.
++ */
++ sdhci_readw(host, SDHCI_HOST_CONTROL2);
+ }
+
+ static const struct sdhci_ops sdhci_xenon_ops = {
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index fff20a370767..59b8681842be 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3654,6 +3654,13 @@ qla2x00_remove_one(struct pci_dev *pdev)
+ }
+ qla2x00_wait_for_hba_ready(base_vha);
+
++ /*
++ * if UNLOADING flag is already set, then continue unload,
++ * where it was set first.
++ */
++ if (test_and_set_bit(UNLOADING, &base_vha->dpc_flags))
++ return;
++
+ if (IS_QLA25XX(ha) || IS_QLA2031(ha) || IS_QLA27XX(ha)) {
+ if (ha->flags.fw_started)
+ qla2x00_abort_isp_cleanup(base_vha);
+@@ -3671,15 +3678,6 @@ qla2x00_remove_one(struct pci_dev *pdev)
+
+ qla2x00_wait_for_sess_deletion(base_vha);
+
+- /*
+- * if UNLOAD flag is already set, then continue unload,
+- * where it was set first.
+- */
+- if (test_bit(UNLOADING, &base_vha->dpc_flags))
+- return;
+-
+- set_bit(UNLOADING, &base_vha->dpc_flags);
+-
+ qla_nvme_delete(base_vha);
+
+ dma_free_coherent(&ha->pdev->dev,
+@@ -4647,6 +4645,9 @@ qla2x00_alloc_work(struct scsi_qla_host *vha, enum qla_work_type type)
+ struct qla_work_evt *e;
+ uint8_t bail;
+
++ if (test_bit(UNLOADING, &vha->dpc_flags))
++ return NULL;
++
+ QLA_VHA_MARK_BUSY(vha, bail);
+ if (bail)
+ return NULL;
+@@ -5845,13 +5846,6 @@ qla2x00_disable_board_on_pci_error(struct work_struct *work)
+ struct pci_dev *pdev = ha->pdev;
+ scsi_qla_host_t *base_vha = pci_get_drvdata(ha->pdev);
+
+- /*
+- * if UNLOAD flag is already set, then continue unload,
+- * where it was set first.
+- */
+- if (test_bit(UNLOADING, &base_vha->dpc_flags))
+- return;
+-
+ ql_log(ql_log_warn, base_vha, 0x015b,
+ "Disabling adapter.\n");
+
+@@ -5862,9 +5856,14 @@ qla2x00_disable_board_on_pci_error(struct work_struct *work)
+ return;
+ }
+
+- qla2x00_wait_for_sess_deletion(base_vha);
++ /*
++ * if UNLOADING flag is already set, then continue unload,
++ * where it was set first.
++ */
++ if (test_and_set_bit(UNLOADING, &base_vha->dpc_flags))
++ return;
+
+- set_bit(UNLOADING, &base_vha->dpc_flags);
++ qla2x00_wait_for_sess_deletion(base_vha);
+
+ qla2x00_delete_all_vps(ha, base_vha);
+
+diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
+index 854b2bcca7c1..5668d02de10b 100644
+--- a/drivers/target/target_core_iblock.c
++++ b/drivers/target/target_core_iblock.c
+@@ -445,7 +445,7 @@ iblock_execute_zero_out(struct block_device *bdev, struct se_cmd *cmd)
+ target_to_linux_sector(dev, cmd->t_task_lba),
+ target_to_linux_sector(dev,
+ sbc_get_write_same_sectors(cmd)),
+- GFP_KERNEL, false);
++ GFP_KERNEL, BLKDEV_ZERO_NOUNMAP);
+ if (ret)
+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index c36275754086..6dbdadb936a8 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -385,8 +385,8 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr,
+ vma = find_vma_intersection(mm, vaddr, vaddr + 1);
+
+ if (vma && vma->vm_flags & VM_PFNMAP) {
+- *pfn = ((vaddr - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
+- if (is_invalid_reserved_pfn(*pfn))
++ if (!follow_pfn(vma, vaddr, pfn) &&
++ is_invalid_reserved_pfn(*pfn))
+ ret = 0;
+ }
+
+@@ -598,7 +598,7 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
+ continue;
+ }
+
+- remote_vaddr = dma->vaddr + iova - dma->iova;
++ remote_vaddr = dma->vaddr + (iova - dma->iova);
+ ret = vfio_pin_page_external(dma, remote_vaddr, &phys_pfn[i],
+ do_accounting);
+ if (ret)
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 47ca1ebda056..271e70c45d5b 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10286,7 +10286,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ path = btrfs_alloc_path();
+ if (!path) {
+ ret = -ENOMEM;
+- goto out;
++ goto out_put_group;
+ }
+
+ /*
+@@ -10323,7 +10323,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ ret = btrfs_orphan_add(trans, BTRFS_I(inode));
+ if (ret) {
+ btrfs_add_delayed_iput(inode);
+- goto out;
++ goto out_put_group;
+ }
+ clear_nlink(inode);
+ /* One for the block groups ref */
+@@ -10346,13 +10346,13 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+
+ ret = btrfs_search_slot(trans, tree_root, &key, path, -1, 1);
+ if (ret < 0)
+- goto out;
++ goto out_put_group;
+ if (ret > 0)
+ btrfs_release_path(path);
+ if (ret == 0) {
+ ret = btrfs_del_item(trans, tree_root, path);
+ if (ret)
+- goto out;
++ goto out_put_group;
+ btrfs_release_path(path);
+ }
+
+@@ -10494,9 +10494,9 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+
+ ret = remove_block_group_free_space(trans, block_group);
+ if (ret)
+- goto out;
++ goto out_put_group;
+
+- btrfs_put_block_group(block_group);
++ /* Once for the block groups rbtree */
+ btrfs_put_block_group(block_group);
+
+ ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
+@@ -10524,6 +10524,10 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ /* once for the tree */
+ free_extent_map(em);
+ }
++
++out_put_group:
++ /* Once for the lookup reference */
++ btrfs_put_block_group(block_group);
+ out:
+ btrfs_free_path(path);
+ return ret;
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 4b1491e1b803..8829d89eb4af 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -572,10 +572,19 @@ again:
+ }
+
+ got_it:
+- btrfs_record_root_in_trans(h, root);
+-
+ if (!current->journal_info)
+ current->journal_info = h;
++
++ /*
++ * btrfs_record_root_in_trans() needs to alloc new extents, and may
++ * call btrfs_join_transaction() while we're also starting a
++ * transaction.
++ *
++ * Thus it need to be called after current->journal_info initialized,
++ * or we can deadlock.
++ */
++ btrfs_record_root_in_trans(h, root);
++
+ return h;
+
+ join_fail:
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index d4c86c6cbe39..928ac2c4899e 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -4182,6 +4182,9 @@ static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans,
+ const u64 ino = btrfs_ino(inode);
+ struct btrfs_path *dst_path = NULL;
+ bool dropped_extents = false;
++ u64 truncate_offset = i_size;
++ struct extent_buffer *leaf;
++ int slot;
+ int ins_nr = 0;
+ int start_slot;
+ int ret;
+@@ -4196,9 +4199,43 @@ static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans,
+ if (ret < 0)
+ goto out;
+
++ /*
++ * We must check if there is a prealloc extent that starts before the
++ * i_size and crosses the i_size boundary. This is to ensure later we
++ * truncate down to the end of that extent and not to the i_size, as
++ * otherwise we end up losing part of the prealloc extent after a log
++ * replay and with an implicit hole if there is another prealloc extent
++ * that starts at an offset beyond i_size.
++ */
++ ret = btrfs_previous_item(root, path, ino, BTRFS_EXTENT_DATA_KEY);
++ if (ret < 0)
++ goto out;
++
++ if (ret == 0) {
++ struct btrfs_file_extent_item *ei;
++
++ leaf = path->nodes[0];
++ slot = path->slots[0];
++ ei = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item);
++
++ if (btrfs_file_extent_type(leaf, ei) ==
++ BTRFS_FILE_EXTENT_PREALLOC) {
++ u64 extent_end;
++
++ btrfs_item_key_to_cpu(leaf, &key, slot);
++ extent_end = key.offset +
++ btrfs_file_extent_num_bytes(leaf, ei);
++
++ if (extent_end > i_size)
++ truncate_offset = extent_end;
++ }
++ } else {
++ ret = 0;
++ }
++
+ while (true) {
+- struct extent_buffer *leaf = path->nodes[0];
+- int slot = path->slots[0];
++ leaf = path->nodes[0];
++ slot = path->slots[0];
+
+ if (slot >= btrfs_header_nritems(leaf)) {
+ if (ins_nr > 0) {
+@@ -4236,7 +4273,7 @@ static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans,
+ ret = btrfs_truncate_inode_items(trans,
+ root->log_root,
+ &inode->vfs_inode,
+- i_size,
++ truncate_offset,
+ BTRFS_EXTENT_DATA_KEY);
+ } while (ret == -EAGAIN);
+ if (ret)
+diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
+index 9fce18548f7e..24d39cce8ba4 100644
+--- a/fs/nfs/nfs3acl.c
++++ b/fs/nfs/nfs3acl.c
+@@ -255,37 +255,45 @@ int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
+
+ int nfs3_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ {
+- struct posix_acl *alloc = NULL, *dfacl = NULL;
++ struct posix_acl *orig = acl, *dfacl = NULL, *alloc;
+ int status;
+
+ if (S_ISDIR(inode->i_mode)) {
+ switch(type) {
+ case ACL_TYPE_ACCESS:
+- alloc = dfacl = get_acl(inode, ACL_TYPE_DEFAULT);
++ alloc = get_acl(inode, ACL_TYPE_DEFAULT);
+ if (IS_ERR(alloc))
+ goto fail;
++ dfacl = alloc;
+ break;
+
+ case ACL_TYPE_DEFAULT:
+- dfacl = acl;
+- alloc = acl = get_acl(inode, ACL_TYPE_ACCESS);
++ alloc = get_acl(inode, ACL_TYPE_ACCESS);
+ if (IS_ERR(alloc))
+ goto fail;
++ dfacl = acl;
++ acl = alloc;
+ break;
+ }
+ }
+
+ if (acl == NULL) {
+- alloc = acl = posix_acl_from_mode(inode->i_mode, GFP_KERNEL);
++ alloc = posix_acl_from_mode(inode->i_mode, GFP_KERNEL);
+ if (IS_ERR(alloc))
+ goto fail;
++ acl = alloc;
+ }
+ status = __nfs3_proc_setacls(inode, acl, dfacl);
+- posix_acl_release(alloc);
++out:
++ if (acl != orig)
++ posix_acl_release(acl);
++ if (dfacl != orig)
++ posix_acl_release(dfacl);
+ return status;
+
+ fail:
+- return PTR_ERR(alloc);
++ status = PTR_ERR(alloc);
++ goto out;
+ }
+
+ const struct xattr_handler *nfs3_xattr_handlers[] = {
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index f5ce9f7ec132..537a2a3c1dea 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -901,6 +901,13 @@ static int software_resume(void)
+ error = freeze_processes();
+ if (error)
+ goto Close_Finish;
++
++ error = freeze_kernel_threads();
++ if (error) {
++ thaw_processes();
++ goto Close_Finish;
++ }
++
+ error = load_image_and_restore();
+ thaw_processes();
+ Finish:
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index c574285966f9..452254fd89f8 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -5595,40 +5595,60 @@ static int selinux_tun_dev_open(void *security)
+
+ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
+ {
+- int err = 0;
+- u32 perm;
++ int rc = 0;
++ unsigned int msg_len;
++ unsigned int data_len = skb->len;
++ unsigned char *data = skb->data;
+ struct nlmsghdr *nlh;
+ struct sk_security_struct *sksec = sk->sk_security;
++ u16 sclass = sksec->sclass;
++ u32 perm;
+
+- if (skb->len < NLMSG_HDRLEN) {
+- err = -EINVAL;
+- goto out;
+- }
+- nlh = nlmsg_hdr(skb);
++ while (data_len >= nlmsg_total_size(0)) {
++ nlh = (struct nlmsghdr *)data;
++
++ /* NOTE: the nlmsg_len field isn't reliably set by some netlink
++ * users which means we can't reject skb's with bogus
++ * length fields; our solution is to follow what
++ * netlink_rcv_skb() does and simply skip processing at
++ * messages with length fields that are clearly junk
++ */
++ if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
++ return 0;
+
+- err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
+- if (err) {
+- if (err == -EINVAL) {
++ rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
++ if (rc == 0) {
++ rc = sock_has_perm(sk, perm);
++ if (rc)
++ return rc;
++ } else if (rc == -EINVAL) {
++ /* -EINVAL is a missing msg/perm mapping */
+ pr_warn_ratelimited("SELinux: unrecognized netlink"
+- " message: protocol=%hu nlmsg_type=%hu sclass=%s"
+- " pig=%d comm=%s\n",
+- sk->sk_protocol, nlh->nlmsg_type,
+- secclass_map[sksec->sclass - 1].name,
+- task_pid_nr(current), current->comm);
+- if (!enforcing_enabled(&selinux_state) ||
+- security_get_allow_unknown(&selinux_state))
+- err = 0;
++ " message: protocol=%hu nlmsg_type=%hu sclass=%s"
++ " pid=%d comm=%s\n",
++ sk->sk_protocol, nlh->nlmsg_type,
++ secclass_map[sclass - 1].name,
++ task_pid_nr(current), current->comm);
++ if (enforcing_enabled(&selinux_state) &&
++ !security_get_allow_unknown(&selinux_state))
++ return rc;
++ rc = 0;
++ } else if (rc == -ENOENT) {
++ /* -ENOENT is a missing socket/class mapping, ignore */
++ rc = 0;
++ } else {
++ return rc;
+ }
+
+- /* Ignore */
+- if (err == -ENOENT)
+- err = 0;
+- goto out;
++ /* move to the next message after applying netlink padding */
++ msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
++ if (msg_len >= data_len)
++ return 0;
++ data_len -= msg_len;
++ data += msg_len;
+ }
+
+- err = sock_has_perm(sk, perm);
+-out:
+- return err;
++ return rc;
+ }
+
+ #ifdef CONFIG_NETFILTER
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index 8539047145de..da400da1fafe 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -211,21 +211,23 @@ static snd_pcm_sframes_t plug_client_size(struct snd_pcm_substream *plug,
+ if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ plugin = snd_pcm_plug_last(plug);
+ while (plugin && drv_frames > 0) {
+- if (check_size && drv_frames > plugin->buf_frames)
+- drv_frames = plugin->buf_frames;
+ plugin_prev = plugin->prev;
+ if (plugin->src_frames)
+ drv_frames = plugin->src_frames(plugin, drv_frames);
++ if (check_size && plugin->buf_frames &&
++ drv_frames > plugin->buf_frames)
++ drv_frames = plugin->buf_frames;
+ plugin = plugin_prev;
+ }
+ } else if (stream == SNDRV_PCM_STREAM_CAPTURE) {
+ plugin = snd_pcm_plug_first(plug);
+ while (plugin && drv_frames > 0) {
+ plugin_next = plugin->next;
++ if (check_size && plugin->buf_frames &&
++ drv_frames > plugin->buf_frames)
++ drv_frames = plugin->buf_frames;
+ if (plugin->dst_frames)
+ drv_frames = plugin->dst_frames(plugin, drv_frames);
+- if (check_size && drv_frames > plugin->buf_frames)
+- drv_frames = plugin->buf_frames;
+ plugin = plugin_next;
+ }
+ } else
+@@ -251,26 +253,28 @@ static snd_pcm_sframes_t plug_slave_size(struct snd_pcm_substream *plug,
+ plugin = snd_pcm_plug_first(plug);
+ while (plugin && frames > 0) {
+ plugin_next = plugin->next;
++ if (check_size && plugin->buf_frames &&
++ frames > plugin->buf_frames)
++ frames = plugin->buf_frames;
+ if (plugin->dst_frames) {
+ frames = plugin->dst_frames(plugin, frames);
+ if (frames < 0)
+ return frames;
+ }
+- if (check_size && frames > plugin->buf_frames)
+- frames = plugin->buf_frames;
+ plugin = plugin_next;
+ }
+ } else if (stream == SNDRV_PCM_STREAM_CAPTURE) {
+ plugin = snd_pcm_plug_last(plug);
+ while (plugin) {
+- if (check_size && frames > plugin->buf_frames)
+- frames = plugin->buf_frames;
+ plugin_prev = plugin->prev;
+ if (plugin->src_frames) {
+ frames = plugin->src_frames(plugin, frames);
+ if (frames < 0)
+ return frames;
+ }
++ if (check_size && plugin->buf_frames &&
++ frames > plugin->buf_frames)
++ frames = plugin->buf_frames;
+ plugin = plugin_prev;
+ }
+ } else
+diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c
+index c6136c6b0214..81eb9c89428d 100644
+--- a/sound/isa/opti9xx/miro.c
++++ b/sound/isa/opti9xx/miro.c
+@@ -880,10 +880,13 @@ static void snd_miro_write(struct snd_miro *chip, unsigned char reg,
+ spin_unlock_irqrestore(&chip->lock, flags);
+ }
+
++static inline void snd_miro_write_mask(struct snd_miro *chip,
++ unsigned char reg, unsigned char value, unsigned char mask)
++{
++ unsigned char oldval = snd_miro_read(chip, reg);
+
+-#define snd_miro_write_mask(chip, reg, value, mask) \
+- snd_miro_write(chip, reg, \
+- (snd_miro_read(chip, reg) & ~(mask)) | ((value) & (mask)))
++ snd_miro_write(chip, reg, (oldval & ~mask) | (value & mask));
++}
+
+ /*
+ * Proc Interface
+diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c
+index ac0ab6eb40f0..0d0fa6f54bdd 100644
+--- a/sound/isa/opti9xx/opti92x-ad1848.c
++++ b/sound/isa/opti9xx/opti92x-ad1848.c
+@@ -329,10 +329,13 @@ static void snd_opti9xx_write(struct snd_opti9xx *chip, unsigned char reg,
+ }
+
+
+-#define snd_opti9xx_write_mask(chip, reg, value, mask) \
+- snd_opti9xx_write(chip, reg, \
+- (snd_opti9xx_read(chip, reg) & ~(mask)) | ((value) & (mask)))
++static inline void snd_opti9xx_write_mask(struct snd_opti9xx *chip,
++ unsigned char reg, unsigned char value, unsigned char mask)
++{
++ unsigned char oldval = snd_opti9xx_read(chip, reg);
+
++ snd_opti9xx_write(chip, reg, (oldval & ~mask) | (value & mask));
++}
+
+ static int snd_opti9xx_configure(struct snd_opti9xx *chip,
+ long port,
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index c67fadd5aae5..12a064f994b1 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1848,8 +1848,10 @@ static bool check_non_pcm_per_cvt(struct hda_codec *codec, hda_nid_t cvt_nid)
+ /* Add sanity check to pass klockwork check.
+ * This should never happen.
+ */
+- if (WARN_ON(spdif == NULL))
++ if (WARN_ON(spdif == NULL)) {
++ mutex_unlock(&codec->spdif_mutex);
+ return true;
++ }
+ non_pcm = !!(spdif->status & IEC958_AES0_NONAUDIO);
+ mutex_unlock(&codec->spdif_mutex);
+ return non_pcm;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9620a8461d91..fc39550f6c5d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6991,6 +6991,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x8560, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1558, 0x8561, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
++ SND_PCI_QUIRK(0x17aa, 0x1048, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 5bbfd7577b33..6836f827965c 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1385,7 +1385,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+
+ case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
+ case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */
+- case USB_ID(0x16b0, 0x06b2): /* NuPrime DAC-10 */
++ case USB_ID(0x16d0, 0x06b2): /* NuPrime DAC-10 */
+ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
+ case USB_ID(0x16d0, 0x0733): /* Furutech ADL Stratos */
+ case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-05-09 22:20 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-05-09 22:20 UTC (permalink / raw
To: gentoo-commits
commit: bfcd8160b6ac76fd60a4427690bb5c3115d96888
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat May 9 22:19:41 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat May 9 22:19:41 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bfcd8160
x86: Fix early boot crash on gcc-10
Bug: https://bugs.gentoo.org/721734
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1700_x86-gcc-10-early-boot-crash-fix.patch | 131 +++++++++++++++++++++++++++++
2 files changed, 135 insertions(+)
diff --git a/0000_README b/0000_README
index bc85fe6..fc9a335 100644
--- a/0000_README
+++ b/0000_README
@@ -531,6 +531,10 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default.
+Patch: 1700_x86-gcc-10-early-boot-crash-fix.patch
+From: https://https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/patch/?id=f670269a42bfdd2c83a1118cc3d1b475547eac22
+Desc: x86: Fix early boot crash on gcc-10
+
Patch: 2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
From: https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-marcel@holtmann.org/raw
Desc: Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758
diff --git a/1700_x86-gcc-10-early-boot-crash-fix.patch b/1700_x86-gcc-10-early-boot-crash-fix.patch
new file mode 100644
index 0000000..8cdf651
--- /dev/null
+++ b/1700_x86-gcc-10-early-boot-crash-fix.patch
@@ -0,0 +1,131 @@
+From f670269a42bfdd2c83a1118cc3d1b475547eac22 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <bp@suse.de>
+Date: Wed, 22 Apr 2020 18:11:30 +0200
+Subject: x86: Fix early boot crash on gcc-10, next try
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+... or the odyssey of trying to disable the stack protector for the
+function which generates the stack canary value.
+
+The whole story started with Sergei reporting a boot crash with a kernel
+built with gcc-10:
+
+ Kernel panic — not syncing: stack-protector: Kernel stack is corrupted in: start_secondary
+ CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5—00235—gfffb08b37df9 #139
+ Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77M—D3H, BIOS F12 11/14/2013
+ Call Trace:
+ dump_stack
+ panic
+ ? start_secondary
+ __stack_chk_fail
+ start_secondary
+ secondary_startup_64
+ -—-[ end Kernel panic — not syncing: stack—protector: Kernel stack is corrupted in: start_secondary
+
+This happens because gcc-10 tail-call optimizes the last function call
+in start_secondary() - cpu_startup_entry() - and thus emits a stack
+canary check which fails because the canary value changes after the
+boot_init_stack_canary() call.
+
+To fix that, the initial attempt was to mark the one function which
+generates the stack canary with:
+
+ __attribute__((optimize("-fno-stack-protector"))) ... start_secondary(void *unused)
+
+however, using the optimize attribute doesn't work cumulatively
+as the attribute does not add to but rather replaces previously
+supplied optimization options - roughly all -fxxx options.
+
+The key one among them being -fno-omit-frame-pointer and thus leading to
+not present frame pointer - frame pointer which the kernel needs.
+
+The next attempt to prevent compilers from tail-call optimizing
+the last function call cpu_startup_entry(), shy of carving out
+start_secondary() into a separate compilation unit and building it with
+-fno-stack-protector, is this one.
+
+The current solution is short and sweet, and reportedly, is supported by
+both compilers so let's see how far we'll get this time.
+
+Reported-by: Sergei Trofimovich <slyfox@gentoo.org>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Link: https://lkml.kernel.org/r/20200314164451.346497-1-slyfox@gentoo.org
+---
+ arch/x86/include/asm/stackprotector.h | 7 ++++++-
+ arch/x86/kernel/smpboot.c | 8 ++++++++
+ arch/x86/xen/smp_pv.c | 1 +
+ include/linux/compiler.h | 6 ++++++
+ 4 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
+index 91e29b6a86a5..9804a7957f4e 100644
+--- a/arch/x86/include/asm/stackprotector.h
++++ b/arch/x86/include/asm/stackprotector.h
+@@ -55,8 +55,13 @@
+ /*
+ * Initialize the stackprotector canary value.
+ *
+- * NOTE: this must only be called from functions that never return,
++ * NOTE: this must only be called from functions that never return
+ * and it must always be inlined.
++ *
++ * In addition, it should be called from a compilation unit for which
++ * stack protector is disabled. Alternatively, the caller should not end
++ * with a function call which gets tail-call optimized as that would
++ * lead to checking a modified canary value.
+ */
+ static __always_inline void boot_init_stack_canary(void)
+ {
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index fe3ab9632f3b..4f275ac7830b 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -266,6 +266,14 @@ static void notrace start_secondary(void *unused)
+
+ wmb();
+ cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
++
++ /*
++ * Prevent tail call to cpu_startup_entry() because the stack protector
++ * guard has been changed a couple of function calls up, in
++ * boot_init_stack_canary() and must not be checked before tail calling
++ * another function.
++ */
++ prevent_tail_call_optimization();
+ }
+
+ /**
+diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
+index 8fb8a50a28b4..f2adb63b2d7c 100644
+--- a/arch/x86/xen/smp_pv.c
++++ b/arch/x86/xen/smp_pv.c
+@@ -93,6 +93,7 @@ asmlinkage __visible void cpu_bringup_and_idle(void)
+ cpu_bringup();
+ boot_init_stack_canary();
+ cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
++ prevent_tail_call_optimization();
+ }
+
+ void xen_smp_intr_free_pv(unsigned int cpu)
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 034b0a644efc..732754d96039 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -356,4 +356,10 @@ static inline void *offset_to_ptr(const int *off)
+ /* &a[0] degrades to a pointer: a different type from an array */
+ #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
+
++/*
++ * This is needed in functions which generate the stack canary, see
++ * arch/x86/kernel/smpboot.c::start_secondary() for an example.
++ */
++#define prevent_tail_call_optimization() asm("")
++
+ #endif /* __LINUX_COMPILER_H */
+--
+cgit 1.2-0.3.lf.el7
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-05-11 22:50 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-05-11 22:50 UTC (permalink / raw
To: gentoo-commits
commit: 658b60846c40c965b05ab664549c1eb1e4f0b213
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon May 11 22:50:23 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon May 11 22:50:23 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=658b6084
Linux patch 4.19.122
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1121_linux-4.19.122.patch | 939 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 943 insertions(+)
diff --git a/0000_README b/0000_README
index fc9a335..1a8557c 100644
--- a/0000_README
+++ b/0000_README
@@ -523,6 +523,10 @@ Patch: 1120_linux-4.19.121.patch
From: https://www.kernel.org
Desc: Linux 4.19.121
+Patch: 1121_linux-4.19.122.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.122
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1121_linux-4.19.122.patch b/1121_linux-4.19.122.patch
new file mode 100644
index 0000000..de5ed49
--- /dev/null
+++ b/1121_linux-4.19.122.patch
@@ -0,0 +1,939 @@
+diff --git a/Makefile b/Makefile
+index f7406a6f8330..2a4ee629f011 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 121
++SUBLEVEL = 122
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/hexagon/include/asm/io.h b/arch/hexagon/include/asm/io.h
+index e17262ad125e..bd429d6a3163 100644
+--- a/arch/hexagon/include/asm/io.h
++++ b/arch/hexagon/include/asm/io.h
+@@ -186,16 +186,10 @@ static inline void writel(u32 data, volatile void __iomem *addr)
+
+ #define mmiowb()
+
+-/*
+- * Need an mtype somewhere in here, for cache type deals?
+- * This is probably too long for an inline.
+- */
+-void __iomem *ioremap_nocache(unsigned long phys_addr, unsigned long size);
++void __iomem *ioremap(unsigned long phys_addr, unsigned long size);
++#define ioremap_nocache ioremap
++#define ioremap_uc(X, Y) ioremap((X), (Y))
+
+-static inline void __iomem *ioremap(unsigned long phys_addr, unsigned long size)
+-{
+- return ioremap_nocache(phys_addr, size);
+-}
+
+ static inline void iounmap(volatile void __iomem *addr)
+ {
+diff --git a/arch/hexagon/kernel/hexagon_ksyms.c b/arch/hexagon/kernel/hexagon_ksyms.c
+index aa248f595431..d13d4a06ee38 100644
+--- a/arch/hexagon/kernel/hexagon_ksyms.c
++++ b/arch/hexagon/kernel/hexagon_ksyms.c
+@@ -33,7 +33,7 @@ EXPORT_SYMBOL(__vmgetie);
+ EXPORT_SYMBOL(__vmsetie);
+ EXPORT_SYMBOL(__vmyield);
+ EXPORT_SYMBOL(empty_zero_page);
+-EXPORT_SYMBOL(ioremap_nocache);
++EXPORT_SYMBOL(ioremap);
+ EXPORT_SYMBOL(memcpy);
+ EXPORT_SYMBOL(memset);
+
+diff --git a/arch/hexagon/mm/ioremap.c b/arch/hexagon/mm/ioremap.c
+index d27d67224046..370ade265e58 100644
+--- a/arch/hexagon/mm/ioremap.c
++++ b/arch/hexagon/mm/ioremap.c
+@@ -22,7 +22,7 @@
+ #include <linux/vmalloc.h>
+ #include <linux/mm.h>
+
+-void __iomem *ioremap_nocache(unsigned long phys_addr, unsigned long size)
++void __iomem *ioremap(unsigned long phys_addr, unsigned long size)
+ {
+ unsigned long last_addr, addr;
+ unsigned long offset = phys_addr & ~PAGE_MASK;
+diff --git a/arch/powerpc/kernel/pci_of_scan.c b/arch/powerpc/kernel/pci_of_scan.c
+index c101b321dece..7765837ba203 100644
+--- a/arch/powerpc/kernel/pci_of_scan.c
++++ b/arch/powerpc/kernel/pci_of_scan.c
+@@ -82,10 +82,16 @@ static void of_pci_parse_addrs(struct device_node *node, struct pci_dev *dev)
+ const __be32 *addrs;
+ u32 i;
+ int proplen;
++ bool mark_unset = false;
+
+ addrs = of_get_property(node, "assigned-addresses", &proplen);
+- if (!addrs)
+- return;
++ if (!addrs || !proplen) {
++ addrs = of_get_property(node, "reg", &proplen);
++ if (!addrs || !proplen)
++ return;
++ mark_unset = true;
++ }
++
+ pr_debug(" parse addresses (%d bytes) @ %p\n", proplen, addrs);
+ for (; proplen >= 20; proplen -= 20, addrs += 5) {
+ flags = pci_parse_of_flags(of_read_number(addrs, 1), 0);
+@@ -110,6 +116,8 @@ static void of_pci_parse_addrs(struct device_node *node, struct pci_dev *dev)
+ continue;
+ }
+ res->flags = flags;
++ if (mark_unset)
++ res->flags |= IORESOURCE_UNSET;
+ res->name = pci_name(dev);
+ region.start = base;
+ region.end = base + size - 1;
+diff --git a/arch/s390/kernel/diag.c b/arch/s390/kernel/diag.c
+index 35c842aa8705..4c7cf8787a84 100644
+--- a/arch/s390/kernel/diag.c
++++ b/arch/s390/kernel/diag.c
+@@ -128,7 +128,7 @@ void diag_stat_inc(enum diag_stat_enum nr)
+ }
+ EXPORT_SYMBOL(diag_stat_inc);
+
+-void diag_stat_inc_norecursion(enum diag_stat_enum nr)
++void notrace diag_stat_inc_norecursion(enum diag_stat_enum nr)
+ {
+ this_cpu_inc(diag_stat.counter[nr]);
+ trace_s390_diagnose_norecursion(diag_map[nr].code);
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index ecd24711f3aa..8e31dfd85de3 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -393,7 +393,7 @@ int smp_find_processor_id(u16 address)
+ return -1;
+ }
+
+-bool arch_vcpu_is_preempted(int cpu)
++bool notrace arch_vcpu_is_preempted(int cpu)
+ {
+ if (test_cpu_flag_of(CIF_ENABLED_WAIT, cpu))
+ return false;
+@@ -403,7 +403,7 @@ bool arch_vcpu_is_preempted(int cpu)
+ }
+ EXPORT_SYMBOL(arch_vcpu_is_preempted);
+
+-void smp_yield_cpu(int cpu)
++void notrace smp_yield_cpu(int cpu)
+ {
+ if (MACHINE_HAS_DIAG9C) {
+ diag_stat_inc_norecursion(DIAG_STAT_X09C);
+diff --git a/arch/s390/kernel/trace.c b/arch/s390/kernel/trace.c
+index 490b52e85014..11a669f3cc93 100644
+--- a/arch/s390/kernel/trace.c
++++ b/arch/s390/kernel/trace.c
+@@ -14,7 +14,7 @@ EXPORT_TRACEPOINT_SYMBOL(s390_diagnose);
+
+ static DEFINE_PER_CPU(unsigned int, diagnose_trace_depth);
+
+-void trace_s390_diagnose_norecursion(int diag_nr)
++void notrace trace_s390_diagnose_norecursion(int diag_nr)
+ {
+ unsigned long flags;
+ unsigned int *depth;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+index c3df75a9f65d..e63a253eb425 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+@@ -71,7 +71,8 @@ void amdgpu_pm_acpi_event_handler(struct amdgpu_device *adev)
+ adev->pm.ac_power = true;
+ else
+ adev->pm.ac_power = false;
+- if (adev->powerplay.pp_funcs->enable_bapm)
++ if (adev->powerplay.pp_funcs &&
++ adev->powerplay.pp_funcs->enable_bapm)
+ amdgpu_dpm_enable_bapm(adev, adev->pm.ac_power);
+ mutex_unlock(&adev->pm.mutex);
+ }
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/processpptables.c
+index 925e17104f90..b9e08b06ed5d 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/processpptables.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/processpptables.c
+@@ -983,6 +983,32 @@ static int init_thermal_controller(
+ struct pp_hwmgr *hwmgr,
+ const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table)
+ {
++ hwmgr->thermal_controller.ucType =
++ powerplay_table->sThermalController.ucType;
++ hwmgr->thermal_controller.ucI2cLine =
++ powerplay_table->sThermalController.ucI2cLine;
++ hwmgr->thermal_controller.ucI2cAddress =
++ powerplay_table->sThermalController.ucI2cAddress;
++
++ hwmgr->thermal_controller.fanInfo.bNoFan =
++ (0 != (powerplay_table->sThermalController.ucFanParameters &
++ ATOM_PP_FANPARAMETERS_NOFAN));
++
++ hwmgr->thermal_controller.fanInfo.ucTachometerPulsesPerRevolution =
++ powerplay_table->sThermalController.ucFanParameters &
++ ATOM_PP_FANPARAMETERS_TACHOMETER_PULSES_PER_REVOLUTION_MASK;
++
++ hwmgr->thermal_controller.fanInfo.ulMinRPM
++ = powerplay_table->sThermalController.ucFanMinRPM * 100UL;
++ hwmgr->thermal_controller.fanInfo.ulMaxRPM
++ = powerplay_table->sThermalController.ucFanMaxRPM * 100UL;
++
++ set_hw_cap(hwmgr,
++ ATOM_PP_THERMALCONTROLLER_NONE != hwmgr->thermal_controller.ucType,
++ PHM_PlatformCaps_ThermalController);
++
++ hwmgr->thermal_controller.use_hw_fan_control = 1;
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
+index ba129b64b61f..b92682f037b2 100644
+--- a/drivers/gpu/drm/drm_ioctl.c
++++ b/drivers/gpu/drm/drm_ioctl.c
+@@ -321,7 +321,12 @@ drm_setclientcap(struct drm_device *dev, void *data, struct drm_file *file_priv)
+ case DRM_CLIENT_CAP_ATOMIC:
+ if (!drm_core_check_feature(dev, DRIVER_ATOMIC))
+ return -EINVAL;
+- if (req->value > 1)
++ /* The modesetting DDX has a totally broken idea of atomic. */
++ if (current->comm[0] == 'X' && req->value == 1) {
++ pr_info("broken atomic modeset userspace detected, disabling atomic\n");
++ return -EOPNOTSUPP;
++ }
++ if (req->value > 2)
+ return -EINVAL;
+ file_priv->atomic = req->value;
+ file_priv->universal_planes = req->value;
+diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
+index 95e217e6b6d7..7577afd42842 100644
+--- a/drivers/mfd/intel-lpss.c
++++ b/drivers/mfd/intel-lpss.c
+@@ -397,7 +397,7 @@ int intel_lpss_probe(struct device *dev,
+ if (!lpss)
+ return -ENOMEM;
+
+- lpss->priv = devm_ioremap(dev, info->mem->start + LPSS_PRIV_OFFSET,
++ lpss->priv = devm_ioremap_uc(dev, info->mem->start + LPSS_PRIV_OFFSET,
+ LPSS_PRIV_SIZE);
+ if (!lpss->priv)
+ return -ENOMEM;
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 3fdf135bad56..6b761f6b8fd5 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -677,7 +677,8 @@ static struct sk_buff *bcm_sysport_rx_refill(struct bcm_sysport_priv *priv,
+ dma_addr_t mapping;
+
+ /* Allocate a new SKB for a new packet */
+- skb = netdev_alloc_skb(priv->netdev, RX_BUF_LENGTH);
++ skb = __netdev_alloc_skb(priv->netdev, RX_BUF_LENGTH,
++ GFP_ATOMIC | __GFP_NOWARN);
+ if (!skb) {
+ priv->mib.alloc_rx_buff_failed++;
+ netif_err(priv, rx_err, ndev, "SKB alloc failed\n");
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 789c206b515e..89cc146d2c5c 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1699,7 +1699,8 @@ static struct sk_buff *bcmgenet_rx_refill(struct bcmgenet_priv *priv,
+ dma_addr_t mapping;
+
+ /* Allocate a new Rx skb */
+- skb = netdev_alloc_skb(priv->dev, priv->rx_buf_len + SKB_ALIGNMENT);
++ skb = __netdev_alloc_skb(priv->dev, priv->rx_buf_len + SKB_ALIGNMENT,
++ GFP_ATOMIC | __GFP_NOWARN);
+ if (!skb) {
+ priv->mib.alloc_rx_buff_failed++;
+ netif_err(priv, rx_err, priv->dev,
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+index 5b3b06a0a3bf..33407df6bea6 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+@@ -274,16 +274,19 @@ static int socfpga_dwmac_set_phy_mode(struct socfpga_dwmac *dwmac)
+ phymode == PHY_INTERFACE_MODE_MII ||
+ phymode == PHY_INTERFACE_MODE_GMII ||
+ phymode == PHY_INTERFACE_MODE_SGMII) {
+- ctrl |= SYSMGR_EMACGRP_CTRL_PTP_REF_CLK_MASK << (reg_shift / 2);
+ regmap_read(sys_mgr_base_addr, SYSMGR_FPGAGRP_MODULE_REG,
+ &module);
+ module |= (SYSMGR_FPGAGRP_MODULE_EMAC << (reg_shift / 2));
+ regmap_write(sys_mgr_base_addr, SYSMGR_FPGAGRP_MODULE_REG,
+ module);
+- } else {
+- ctrl &= ~(SYSMGR_EMACGRP_CTRL_PTP_REF_CLK_MASK << (reg_shift / 2));
+ }
+
++ if (dwmac->f2h_ptp_ref_clk)
++ ctrl |= SYSMGR_EMACGRP_CTRL_PTP_REF_CLK_MASK << (reg_shift / 2);
++ else
++ ctrl &= ~(SYSMGR_EMACGRP_CTRL_PTP_REF_CLK_MASK <<
++ (reg_shift / 2));
++
+ regmap_write(sys_mgr_base_addr, reg_offset, ctrl);
+
+ /* Deassert reset for the phy configuration to be sampled by
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+index 7423262ce590..e1fbd7c81bfa 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+@@ -36,12 +36,16 @@ static void config_sub_second_increment(void __iomem *ioaddr,
+ unsigned long data;
+ u32 reg_value;
+
+- /* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
+- * formula = (1/ptp_clock) * 1000000000
+- * where ptp_clock is 50MHz if fine method is used to update system
++ /* For GMAC3.x, 4.x versions, in "fine adjustement mode" set sub-second
++ * increment to twice the number of nanoseconds of a clock cycle.
++ * The calculation of the default_addend value by the caller will set it
++ * to mid-range = 2^31 when the remainder of this division is zero,
++ * which will make the accumulator overflow once every 2 ptp_clock
++ * cycles, adding twice the number of nanoseconds of a clock cycle :
++ * 2000000000ULL / ptp_clock.
+ */
+ if (value & PTP_TCR_TSCFUPDT)
+- data = (1000000000ULL / 50000000);
++ data = (2000000000ULL / ptp_clock);
+ else
+ data = (1000000000ULL / ptp_clock);
+
+diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
+index 529ebca1e9e1..1f7709d24f35 100644
+--- a/drivers/net/wimax/i2400m/usb-fw.c
++++ b/drivers/net/wimax/i2400m/usb-fw.c
+@@ -354,6 +354,7 @@ out:
+ usb_autopm_put_interface(i2400mu->usb_iface);
+ d_fnend(8, dev, "(i2400m %p ack %p size %zu) = %ld\n",
+ i2400m, ack, ack_size, (long) result);
++ usb_put_urb(¬if_urb);
+ return result;
+
+ error_exceeded:
+diff --git a/drivers/platform/x86/gpd-pocket-fan.c b/drivers/platform/x86/gpd-pocket-fan.c
+index b471b86c28fe..5b516e4c2bfb 100644
+--- a/drivers/platform/x86/gpd-pocket-fan.c
++++ b/drivers/platform/x86/gpd-pocket-fan.c
+@@ -128,7 +128,7 @@ static int gpd_pocket_fan_probe(struct platform_device *pdev)
+
+ for (i = 0; i < ARRAY_SIZE(temp_limits); i++) {
+ if (temp_limits[i] < 20000 || temp_limits[i] > 90000) {
+- dev_err(&pdev->dev, "Invalid temp-limit %d (must be between 40000 and 70000)\n",
++ dev_err(&pdev->dev, "Invalid temp-limit %d (must be between 20000 and 90000)\n",
+ temp_limits[i]);
+ temp_limits[0] = TEMP_LIMIT0_DEFAULT;
+ temp_limits[1] = TEMP_LIMIT1_DEFAULT;
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index e34308d64619..d6968b90ee6b 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -300,6 +300,10 @@
+ #define DWC3_GTXFIFOSIZ_TXFDEF(n) ((n) & 0xffff)
+ #define DWC3_GTXFIFOSIZ_TXFSTADDR(n) ((n) & 0xffff0000)
+
++/* Global RX Fifo Size Register */
++#define DWC31_GRXFIFOSIZ_RXFDEP(n) ((n) & 0x7fff) /* DWC_usb31 only */
++#define DWC3_GRXFIFOSIZ_RXFDEP(n) ((n) & 0xffff)
++
+ /* Global Event Size Registers */
+ #define DWC3_GEVNTSIZ_INTMASK BIT(31)
+ #define DWC3_GEVNTSIZ_SIZE(n) ((n) & 0xffff)
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 1a6c973da487..99f6a5aa0109 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2032,7 +2032,6 @@ static int dwc3_gadget_init_in_endpoint(struct dwc3_ep *dep)
+ {
+ struct dwc3 *dwc = dep->dwc;
+ int mdwidth;
+- int kbytes;
+ int size;
+
+ mdwidth = DWC3_MDWIDTH(dwc->hwparams.hwparams0);
+@@ -2048,17 +2047,17 @@ static int dwc3_gadget_init_in_endpoint(struct dwc3_ep *dep)
+ /* FIFO Depth is in MDWDITH bytes. Multiply */
+ size *= mdwidth;
+
+- kbytes = size / 1024;
+- if (kbytes == 0)
+- kbytes = 1;
+-
+ /*
+- * FIFO sizes account an extra MDWIDTH * (kbytes + 1) bytes for
+- * internal overhead. We don't really know how these are used,
+- * but documentation say it exists.
++ * To meet performance requirement, a minimum TxFIFO size of 3x
++ * MaxPacketSize is recommended for endpoints that support burst and a
++ * minimum TxFIFO size of 2x MaxPacketSize for endpoints that don't
++ * support burst. Use those numbers and we can calculate the max packet
++ * limit as below.
+ */
+- size -= mdwidth * (kbytes + 1);
+- size /= kbytes;
++ if (dwc->maximum_speed >= USB_SPEED_SUPER)
++ size /= 3;
++ else
++ size /= 2;
+
+ usb_ep_set_maxpacket_limit(&dep->endpoint, size);
+
+@@ -2076,8 +2075,39 @@ static int dwc3_gadget_init_in_endpoint(struct dwc3_ep *dep)
+ static int dwc3_gadget_init_out_endpoint(struct dwc3_ep *dep)
+ {
+ struct dwc3 *dwc = dep->dwc;
++ int mdwidth;
++ int size;
++
++ mdwidth = DWC3_MDWIDTH(dwc->hwparams.hwparams0);
++
++ /* MDWIDTH is represented in bits, convert to bytes */
++ mdwidth /= 8;
+
+- usb_ep_set_maxpacket_limit(&dep->endpoint, 1024);
++ /* All OUT endpoints share a single RxFIFO space */
++ size = dwc3_readl(dwc->regs, DWC3_GRXFIFOSIZ(0));
++ if (dwc3_is_usb31(dwc))
++ size = DWC31_GRXFIFOSIZ_RXFDEP(size);
++ else
++ size = DWC3_GRXFIFOSIZ_RXFDEP(size);
++
++ /* FIFO depth is in MDWDITH bytes */
++ size *= mdwidth;
++
++ /*
++ * To meet performance requirement, a minimum recommended RxFIFO size
++ * is defined as follow:
++ * RxFIFO size >= (3 x MaxPacketSize) +
++ * (3 x 8 bytes setup packets size) + (16 bytes clock crossing margin)
++ *
++ * Then calculate the max packet limit as below.
++ */
++ size -= (3 * 8) + 16;
++ if (size < 0)
++ size = 0;
++ else
++ size /= 3;
++
++ usb_ep_set_maxpacket_limit(&dep->endpoint, size);
+ dep->endpoint.max_streams = 15;
+ dep->endpoint.ops = &dwc3_gadget_ep_ops;
+ list_add_tail(&dep->endpoint.ep_list,
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 5f5c5de31f10..bac1365cc81b 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -499,6 +499,11 @@ static int vhost_vsock_start(struct vhost_vsock *vsock)
+ mutex_unlock(&vq->mutex);
+ }
+
++ /* Some packets may have been queued before the device was started,
++ * let's kick the send worker to send them.
++ */
++ vhost_work_queue(&vsock->dev, &vsock->send_pkt_work);
++
+ mutex_unlock(&vsock->dev.mutex);
+ return 0;
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 975f800b9dd4..9e569d60c636 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -353,8 +353,10 @@ static int reconn_set_ipaddr(struct TCP_Server_Info *server)
+ return rc;
+ }
+
++ spin_lock(&cifs_tcp_ses_lock);
+ rc = cifs_convert_address((struct sockaddr *)&server->dstaddr, ipaddr,
+ strlen(ipaddr));
++ spin_unlock(&cifs_tcp_ses_lock);
+ kfree(ipaddr);
+
+ return !rc ? -1 : 0;
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index c83478271c2e..778d3ef939d8 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -622,6 +622,15 @@ static inline bool ieee80211_is_qos_nullfunc(__le16 fc)
+ cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_NULLFUNC);
+ }
+
++/**
++ * ieee80211_is_any_nullfunc - check if frame is regular or QoS nullfunc frame
++ * @fc: frame control bytes in little-endian byteorder
++ */
++static inline bool ieee80211_is_any_nullfunc(__le16 fc)
++{
++ return (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc));
++}
++
+ /**
+ * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
+ * @fc: frame control field in little-endian byteorder
+diff --git a/include/linux/io.h b/include/linux/io.h
+index 32e30e8fb9db..da39ff89df65 100644
+--- a/include/linux/io.h
++++ b/include/linux/io.h
+@@ -75,6 +75,8 @@ static inline void devm_ioport_unmap(struct device *dev, void __iomem *addr)
+
+ void __iomem *devm_ioremap(struct device *dev, resource_size_t offset,
+ resource_size_t size);
++void __iomem *devm_ioremap_uc(struct device *dev, resource_size_t offset,
++ resource_size_t size);
+ void __iomem *devm_ioremap_nocache(struct device *dev, resource_size_t offset,
+ resource_size_t size);
+ void __iomem *devm_ioremap_wc(struct device *dev, resource_size_t offset,
+diff --git a/lib/devres.c b/lib/devres.c
+index aa0f5308ac6b..75ea32d9b661 100644
+--- a/lib/devres.c
++++ b/lib/devres.c
+@@ -9,6 +9,7 @@
+ enum devm_ioremap_type {
+ DEVM_IOREMAP = 0,
+ DEVM_IOREMAP_NC,
++ DEVM_IOREMAP_UC,
+ DEVM_IOREMAP_WC,
+ };
+
+@@ -39,6 +40,9 @@ static void __iomem *__devm_ioremap(struct device *dev, resource_size_t offset,
+ case DEVM_IOREMAP_NC:
+ addr = ioremap_nocache(offset, size);
+ break;
++ case DEVM_IOREMAP_UC:
++ addr = ioremap_uc(offset, size);
++ break;
+ case DEVM_IOREMAP_WC:
+ addr = ioremap_wc(offset, size);
+ break;
+@@ -68,6 +72,21 @@ void __iomem *devm_ioremap(struct device *dev, resource_size_t offset,
+ }
+ EXPORT_SYMBOL(devm_ioremap);
+
++/**
++ * devm_ioremap_uc - Managed ioremap_uc()
++ * @dev: Generic device to remap IO address for
++ * @offset: Resource address to map
++ * @size: Size of map
++ *
++ * Managed ioremap_uc(). Map is automatically unmapped on driver detach.
++ */
++void __iomem *devm_ioremap_uc(struct device *dev, resource_size_t offset,
++ resource_size_t size)
++{
++ return __devm_ioremap(dev, offset, size, DEVM_IOREMAP_UC);
++}
++EXPORT_SYMBOL_GPL(devm_ioremap_uc);
++
+ /**
+ * devm_ioremap_nocache - Managed ioremap_nocache()
+ * @dev: Generic device to remap IO address for
+diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
+index 08c60d10747f..e01b705556aa 100644
+--- a/lib/mpi/longlong.h
++++ b/lib/mpi/longlong.h
+@@ -756,22 +756,22 @@ do { \
+ do { \
+ if (__builtin_constant_p(bh) && (bh) == 0) \
+ __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "%r" ((USItype)(ah)), \
+ "%r" ((USItype)(al)), \
+ "rI" ((USItype)(bl))); \
+ else if (__builtin_constant_p(bh) && (bh) == ~(USItype) 0) \
+ __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "%r" ((USItype)(ah)), \
+ "%r" ((USItype)(al)), \
+ "rI" ((USItype)(bl))); \
+ else \
+ __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "%r" ((USItype)(ah)), \
+ "r" ((USItype)(bh)), \
+ "%r" ((USItype)(al)), \
+@@ -781,36 +781,36 @@ do { \
+ do { \
+ if (__builtin_constant_p(ah) && (ah) == 0) \
+ __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "r" ((USItype)(bh)), \
+ "rI" ((USItype)(al)), \
+ "r" ((USItype)(bl))); \
+ else if (__builtin_constant_p(ah) && (ah) == ~(USItype) 0) \
+ __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "r" ((USItype)(bh)), \
+ "rI" ((USItype)(al)), \
+ "r" ((USItype)(bl))); \
+ else if (__builtin_constant_p(bh) && (bh) == 0) \
+ __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "r" ((USItype)(ah)), \
+ "rI" ((USItype)(al)), \
+ "r" ((USItype)(bl))); \
+ else if (__builtin_constant_p(bh) && (bh) == ~(USItype) 0) \
+ __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "r" ((USItype)(ah)), \
+ "rI" ((USItype)(al)), \
+ "r" ((USItype)(bl))); \
+ else \
+ __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "r" ((USItype)(ah)), \
+ "r" ((USItype)(bh)), \
+ "rI" ((USItype)(al)), \
+@@ -821,7 +821,7 @@ do { \
+ do { \
+ USItype __m0 = (m0), __m1 = (m1); \
+ __asm__ ("mulhwu %0,%1,%2" \
+- : "=r" ((USItype) ph) \
++ : "=r" (ph) \
+ : "%r" (__m0), \
+ "r" (__m1)); \
+ (pl) = __m0 * __m1; \
+diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
+index 67feeb207dad..668330ace961 100644
+--- a/net/core/netclassid_cgroup.c
++++ b/net/core/netclassid_cgroup.c
+@@ -131,10 +131,8 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft,
+ cs->classid = (u32)value;
+
+ css_task_iter_start(css, 0, &it);
+- while ((p = css_task_iter_next(&it))) {
++ while ((p = css_task_iter_next(&it)))
+ update_classid_task(p, cs->classid);
+- cond_resched();
+- }
+ css_task_iter_end(&it);
+
+ return 0;
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index b0667467337d..c53a332f7d65 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2384,7 +2384,7 @@ void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
+ if (!ieee80211_is_data(hdr->frame_control))
+ return;
+
+- if (ieee80211_is_nullfunc(hdr->frame_control) &&
++ if (ieee80211_is_any_nullfunc(hdr->frame_control) &&
+ sdata->u.mgd.probe_send_count > 0) {
+ if (ack)
+ ieee80211_sta_reset_conn_monitor(sdata);
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index c7c456c86b0d..c17e148e06e7 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1373,8 +1373,7 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
+ return RX_CONTINUE;
+
+ if (ieee80211_is_ctl(hdr->frame_control) ||
+- ieee80211_is_nullfunc(hdr->frame_control) ||
+- ieee80211_is_qos_nullfunc(hdr->frame_control) ||
++ ieee80211_is_any_nullfunc(hdr->frame_control) ||
+ is_multicast_ether_addr(hdr->addr1))
+ return RX_CONTINUE;
+
+@@ -1753,8 +1752,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
+ * Drop (qos-)data::nullfunc frames silently, since they
+ * are used only to control station power saving mode.
+ */
+- if (ieee80211_is_nullfunc(hdr->frame_control) ||
+- ieee80211_is_qos_nullfunc(hdr->frame_control)) {
++ if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
+ I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
+
+ /*
+@@ -2244,7 +2242,7 @@ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
+
+ /* Drop unencrypted frames if key is set. */
+ if (unlikely(!ieee80211_has_protected(fc) &&
+- !ieee80211_is_nullfunc(fc) &&
++ !ieee80211_is_any_nullfunc(fc) &&
+ ieee80211_is_data(fc) && rx->key))
+ return -EACCES;
+
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index f895c656407b..aeb51e385f25 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -487,8 +487,7 @@ static void ieee80211_report_ack_skb(struct ieee80211_local *local,
+ rcu_read_lock();
+ sdata = ieee80211_sdata_from_skb(local, skb);
+ if (sdata) {
+- if (ieee80211_is_nullfunc(hdr->frame_control) ||
+- ieee80211_is_qos_nullfunc(hdr->frame_control))
++ if (ieee80211_is_any_nullfunc(hdr->frame_control))
+ cfg80211_probe_status(sdata->dev, hdr->addr1,
+ cookie, acked,
+ info->status.ack_signal,
+@@ -867,7 +866,7 @@ static void __ieee80211_tx_status(struct ieee80211_hw *hw,
+ I802_DEBUG_INC(local->dot11FailedCount);
+ }
+
+- if ((ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) &&
++ if (ieee80211_is_any_nullfunc(fc) &&
+ ieee80211_has_pm(fc) &&
+ ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
+ !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 84639363173b..3160ffd93a15 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -300,7 +300,7 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
+ if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
+ test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
+ !ieee80211_is_probe_req(hdr->frame_control) &&
+- !ieee80211_is_nullfunc(hdr->frame_control))
++ !ieee80211_is_any_nullfunc(hdr->frame_control))
+ /*
+ * When software scanning only nullfunc frames (to notify
+ * the sleep state to the AP) and probe requests (for the
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index fb546b2d67ca..ce6053be60bc 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -871,7 +871,11 @@ struct sctp_chunk *sctp_make_shutdown(const struct sctp_association *asoc,
+ struct sctp_chunk *retval;
+ __u32 ctsn;
+
+- ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
++ if (chunk && chunk->asoc)
++ ctsn = sctp_tsnmap_get_ctsn(&chunk->asoc->peer.tsn_map);
++ else
++ ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
++
+ shut.cum_tsn_ack = htonl(ctsn);
+
+ retval = sctp_make_control(asoc, SCTP_CID_SHUTDOWN, 0,
+diff --git a/scripts/config b/scripts/config
+index e0e39826dae9..eee5b7f3a092 100755
+--- a/scripts/config
++++ b/scripts/config
+@@ -7,6 +7,9 @@ myname=${0##*/}
+ # If no prefix forced, use the default CONFIG_
+ CONFIG_="${CONFIG_-CONFIG_}"
+
++# We use an uncommon delimiter for sed substitutions
++SED_DELIM=$(echo -en "\001")
++
+ usage() {
+ cat >&2 <<EOL
+ Manipulate options in a .config file from the command line.
+@@ -83,7 +86,7 @@ txt_subst() {
+ local infile="$3"
+ local tmpfile="$infile.swp"
+
+- sed -e "s:$before:$after:" "$infile" >"$tmpfile"
++ sed -e "s$SED_DELIM$before$SED_DELIM$after$SED_DELIM" "$infile" >"$tmpfile"
+ # replace original file with the edited one
+ mv "$tmpfile" "$infile"
+ }
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 0d7981eda2c4..8e1eb5f243a2 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2214,9 +2214,10 @@ static const struct hdac_io_ops pci_hda_io_ops = {
+ * some HD-audio PCI entries are exposed without any codecs, and such devices
+ * should be ignored from the beginning.
+ */
+-static const struct snd_pci_quirk driver_blacklist[] = {
+- SND_PCI_QUIRK(0x1462, 0xcb59, "MSI TRX40 Creator", 0),
+- SND_PCI_QUIRK(0x1462, 0xcb60, "MSI TRX40", 0),
++static const struct pci_device_id driver_blacklist[] = {
++ { PCI_DEVICE_SUB(0x1022, 0x1487, 0x1043, 0x874f) }, /* ASUS ROG Zenith II / Strix */
++ { PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb59) }, /* MSI TRX40 Creator */
++ { PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb60) }, /* MSI TRX40 */
+ {}
+ };
+
+@@ -2239,7 +2240,7 @@ static int azx_probe(struct pci_dev *pci,
+ bool schedule_probe;
+ int err;
+
+- if (snd_pci_quirk_lookup(pci, driver_blacklist)) {
++ if (pci_match_id(driver_blacklist, pci)) {
+ dev_info(&pci->dev, "Skipping the blacklisted device\n");
+ return -ENODEV;
+ }
+diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
+index be2473166bfa..4594b1447900 100644
+--- a/sound/soc/codecs/hdac_hdmi.c
++++ b/sound/soc/codecs/hdac_hdmi.c
+@@ -148,14 +148,14 @@ static struct hdac_hdmi_pcm *
+ hdac_hdmi_get_pcm_from_cvt(struct hdac_hdmi_priv *hdmi,
+ struct hdac_hdmi_cvt *cvt)
+ {
+- struct hdac_hdmi_pcm *pcm = NULL;
++ struct hdac_hdmi_pcm *pcm;
+
+ list_for_each_entry(pcm, &hdmi->pcm_list, head) {
+ if (pcm->cvt == cvt)
+- break;
++ return pcm;
+ }
+
+- return pcm;
++ return NULL;
+ }
+
+ static void hdac_hdmi_jack_report(struct hdac_hdmi_pcm *pcm,
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 896412d11a31..7c0a06b487f7 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1633,6 +1633,40 @@ static int sgtl5000_i2c_probe(struct i2c_client *client,
+ dev_err(&client->dev,
+ "Error %d initializing CHIP_CLK_CTRL\n", ret);
+
++ /* Mute everything to avoid pop from the following power-up */
++ ret = regmap_write(sgtl5000->regmap, SGTL5000_CHIP_ANA_CTRL,
++ SGTL5000_CHIP_ANA_CTRL_DEFAULT);
++ if (ret) {
++ dev_err(&client->dev,
++ "Error %d muting outputs via CHIP_ANA_CTRL\n", ret);
++ goto disable_clk;
++ }
++
++ /*
++ * If VAG is powered-on (e.g. from previous boot), it would be disabled
++ * by the write to ANA_POWER in later steps of the probe code. This
++ * may create a loud pop even with all outputs muted. The proper way
++ * to circumvent this is disabling the bit first and waiting the proper
++ * cool-down time.
++ */
++ ret = regmap_read(sgtl5000->regmap, SGTL5000_CHIP_ANA_POWER, &value);
++ if (ret) {
++ dev_err(&client->dev, "Failed to read ANA_POWER: %d\n", ret);
++ goto disable_clk;
++ }
++ if (value & SGTL5000_VAG_POWERUP) {
++ ret = regmap_update_bits(sgtl5000->regmap,
++ SGTL5000_CHIP_ANA_POWER,
++ SGTL5000_VAG_POWERUP,
++ 0);
++ if (ret) {
++ dev_err(&client->dev, "Error %d disabling VAG\n", ret);
++ goto disable_clk;
++ }
++
++ msleep(SGTL5000_VAG_POWERDOWN_DELAY);
++ }
++
+ /* Follow section 2.2.1.1 of AN3663 */
+ ana_pwr = SGTL5000_ANA_POWER_DEFAULT;
+ if (sgtl5000->num_supplies <= VDDD) {
+diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h
+index 18cae08bbd3a..066517e352a7 100644
+--- a/sound/soc/codecs/sgtl5000.h
++++ b/sound/soc/codecs/sgtl5000.h
+@@ -233,6 +233,7 @@
+ /*
+ * SGTL5000_CHIP_ANA_CTRL
+ */
++#define SGTL5000_CHIP_ANA_CTRL_DEFAULT 0x0133
+ #define SGTL5000_LINE_OUT_MUTE 0x0100
+ #define SGTL5000_HP_SEL_MASK 0x0040
+ #define SGTL5000_HP_SEL_SHIFT 6
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index 33dc8d6ad35b..a6cf2ac223e4 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -566,10 +566,16 @@ static int rsnd_ssi_stop(struct rsnd_mod *mod,
+ * Capture: It might not receave data. Do nothing
+ */
+ if (rsnd_io_is_play(io)) {
+- rsnd_mod_write(mod, SSICR, cr | EN);
++ rsnd_mod_write(mod, SSICR, cr | ssi->cr_en);
+ rsnd_ssi_status_check(mod, DIRQ);
+ }
+
++ /* In multi-SSI mode, stop is performed by setting ssi0129 in
++ * SSI_CONTROL to 0 (in rsnd_ssio_stop_gen2). Do nothing here.
++ */
++ if (rsnd_ssi_multi_slaves_runtime(io))
++ return 0;
++
+ /*
+ * disable SSI,
+ * and, wait idle state
+@@ -674,6 +680,9 @@ static void rsnd_ssi_parent_attach(struct rsnd_mod *mod,
+ if (!rsnd_rdai_is_clk_master(rdai))
+ return;
+
++ if (rsnd_ssi_is_multi_slave(mod, io))
++ return;
++
+ switch (rsnd_mod_id(mod)) {
+ case 1:
+ case 2:
+diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
+index 016fbf5ac242..7b5eb316c366 100644
+--- a/sound/soc/sh/rcar/ssiu.c
++++ b/sound/soc/sh/rcar/ssiu.c
+@@ -172,7 +172,7 @@ static int rsnd_ssiu_init_gen2(struct rsnd_mod *mod,
+ i;
+
+ for_each_rsnd_mod_array(i, pos, io, rsnd_ssi_array) {
+- shift = (i * 4) + 16;
++ shift = (i * 4) + 20;
+ val = (val & ~(0xF << shift)) |
+ rsnd_mod_id(pos) << shift;
+ }
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 756dd2303106..2c6598e07dde 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1923,7 +1923,9 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg,
+ _pcm = pcm;
+ } else {
+ abi_match = false;
+- pcm_new_ver(tplg, pcm, &_pcm);
++ ret = pcm_new_ver(tplg, pcm, &_pcm);
++ if (ret < 0)
++ return ret;
+ }
+
+ /* create the FE DAIs and DAI links */
+diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
+index 4c156aeab6b8..5ec4d9e18806 100644
+--- a/tools/testing/selftests/ipc/msgque.c
++++ b/tools/testing/selftests/ipc/msgque.c
+@@ -137,7 +137,7 @@ int dump_queue(struct msgque_data *msgque)
+ for (kern_id = 0; kern_id < 256; kern_id++) {
+ ret = msgctl(kern_id, MSG_STAT, &ds);
+ if (ret < 0) {
+- if (errno == -EINVAL)
++ if (errno == EINVAL)
+ continue;
+ printf("Failed to get stats for IPC queue with id %d\n",
+ kern_id);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-05-13 12:33 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-05-13 12:33 UTC (permalink / raw
To: gentoo-commits
commit: 9e83199d8117b7c9e58469c96d8ca3ef90f05f4c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 13 12:32:46 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 13 12:32:46 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9e83199d
Add UTS_NS to GENTOO_LINUX_PORTAGE as required by portage since 2.3.99
Bug: https://bugs.gentoo.org/722772
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
4567_distro-Gentoo-Kconfig.patch | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index b5174db..10c164e 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -6,9 +6,9 @@
source "lib/Kconfig.debug"
+
+source "distro/Kconfig"
---- /dev/null 2020-04-15 02:49:37.900191585 -0400
-+++ b/distro/Kconfig 2020-04-15 11:07:10.952929540 -0400
-@@ -0,0 +1,156 @@
+--- /dev/null 2020-05-13 03:13:57.920193259 -0400
++++ b/distro/Kconfig 2020-05-13 08:21:40.704254967 -0400
+@@ -0,0 +1,157 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -65,6 +65,7 @@
+ select NET_NS
+ select PID_NS
+ select SYSVIPC
++ select UTS_NS
+
+ help
+ This enables options required by various Portage FEATURES.
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-05-14 11:30 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-05-14 11:30 UTC (permalink / raw
To: gentoo-commits
commit: 3ba8a94069c6064059af744ab1d794fd5145f8b9
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu May 14 11:29:47 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu May 14 11:29:47 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3ba8a940
Linux patch 4.19.123
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1122_linux-4.19.123.patch | 1475 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1479 insertions(+)
diff --git a/0000_README b/0000_README
index 1a8557c..18ae34a 100644
--- a/0000_README
+++ b/0000_README
@@ -527,6 +527,10 @@ Patch: 1121_linux-4.19.122.patch
From: https://www.kernel.org
Desc: Linux 4.19.122
+Patch: 1122_linux-4.19.123.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.123
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1122_linux-4.19.123.patch b/1122_linux-4.19.123.patch
new file mode 100644
index 0000000..8b532c1
--- /dev/null
+++ b/1122_linux-4.19.123.patch
@@ -0,0 +1,1475 @@
+diff --git a/Makefile b/Makefile
+index 2a4ee629f011..68fa15edd662 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 122
++SUBLEVEL = 123
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
+index a6c9fbaeaefc..870e594f95ed 100644
+--- a/arch/arm64/kvm/guest.c
++++ b/arch/arm64/kvm/guest.c
+@@ -179,6 +179,13 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+ }
+
+ memcpy((u32 *)regs + off, valp, KVM_REG_SIZE(reg->id));
++
++ if (*vcpu_cpsr(vcpu) & PSR_MODE32_BIT) {
++ int i;
++
++ for (i = 0; i < 16; i++)
++ *vcpu_reg32(vcpu, i) = (u32)*vcpu_reg32(vcpu, i);
++ }
+ out:
+ return err;
+ }
+diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
+index f58ea503ad01..1d7656761316 100644
+--- a/arch/arm64/mm/hugetlbpage.c
++++ b/arch/arm64/mm/hugetlbpage.c
+@@ -218,6 +218,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
+ ptep = (pte_t *)pudp;
+ } else if (sz == (PAGE_SIZE * CONT_PTES)) {
+ pmdp = pmd_alloc(mm, pudp, addr);
++ if (!pmdp)
++ return NULL;
+
+ WARN_ON(addr & (sz - 1));
+ /*
+diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
+index 31fbb4a7d9f6..993dd06c8923 100644
+--- a/arch/x86/entry/calling.h
++++ b/arch/x86/entry/calling.h
+@@ -98,13 +98,6 @@ For 32-bit we have the following conventions - kernel is built with
+ #define SIZEOF_PTREGS 21*8
+
+ .macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax save_ret=0
+- /*
+- * Push registers and sanitize registers of values that a
+- * speculation attack might otherwise want to exploit. The
+- * lower registers are likely clobbered well before they
+- * could be put to use in a speculative execution gadget.
+- * Interleave XOR with PUSH for better uop scheduling:
+- */
+ .if \save_ret
+ pushq %rsi /* pt_regs->si */
+ movq 8(%rsp), %rsi /* temporarily store the return address in %rsi */
+@@ -114,34 +107,43 @@ For 32-bit we have the following conventions - kernel is built with
+ pushq %rsi /* pt_regs->si */
+ .endif
+ pushq \rdx /* pt_regs->dx */
+- xorl %edx, %edx /* nospec dx */
+ pushq %rcx /* pt_regs->cx */
+- xorl %ecx, %ecx /* nospec cx */
+ pushq \rax /* pt_regs->ax */
+ pushq %r8 /* pt_regs->r8 */
+- xorl %r8d, %r8d /* nospec r8 */
+ pushq %r9 /* pt_regs->r9 */
+- xorl %r9d, %r9d /* nospec r9 */
+ pushq %r10 /* pt_regs->r10 */
+- xorl %r10d, %r10d /* nospec r10 */
+ pushq %r11 /* pt_regs->r11 */
+- xorl %r11d, %r11d /* nospec r11*/
+ pushq %rbx /* pt_regs->rbx */
+- xorl %ebx, %ebx /* nospec rbx*/
+ pushq %rbp /* pt_regs->rbp */
+- xorl %ebp, %ebp /* nospec rbp*/
+ pushq %r12 /* pt_regs->r12 */
+- xorl %r12d, %r12d /* nospec r12*/
+ pushq %r13 /* pt_regs->r13 */
+- xorl %r13d, %r13d /* nospec r13*/
+ pushq %r14 /* pt_regs->r14 */
+- xorl %r14d, %r14d /* nospec r14*/
+ pushq %r15 /* pt_regs->r15 */
+- xorl %r15d, %r15d /* nospec r15*/
+ UNWIND_HINT_REGS
++
+ .if \save_ret
+ pushq %rsi /* return address on top of stack */
+ .endif
++
++ /*
++ * Sanitize registers of values that a speculation attack might
++ * otherwise want to exploit. The lower registers are likely clobbered
++ * well before they could be put to use in a speculative execution
++ * gadget.
++ */
++ xorl %edx, %edx /* nospec dx */
++ xorl %ecx, %ecx /* nospec cx */
++ xorl %r8d, %r8d /* nospec r8 */
++ xorl %r9d, %r9d /* nospec r9 */
++ xorl %r10d, %r10d /* nospec r10 */
++ xorl %r11d, %r11d /* nospec r11 */
++ xorl %ebx, %ebx /* nospec rbx */
++ xorl %ebp, %ebp /* nospec rbp */
++ xorl %r12d, %r12d /* nospec r12 */
++ xorl %r13d, %r13d /* nospec r13 */
++ xorl %r14d, %r14d /* nospec r14 */
++ xorl %r15d, %r15d /* nospec r15 */
++
+ .endm
+
+ .macro POP_REGS pop_rdi=1 skip_r11rcx=0
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index ccb5e3486aee..dfe26f3cfffc 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -312,7 +312,6 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
+ */
+ syscall_return_via_sysret:
+ /* rcx and r11 are already restored (see code above) */
+- UNWIND_HINT_EMPTY
+ POP_REGS pop_rdi=0 skip_r11rcx=1
+
+ /*
+@@ -321,6 +320,7 @@ syscall_return_via_sysret:
+ */
+ movq %rsp, %rdi
+ movq PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp
++ UNWIND_HINT_EMPTY
+
+ pushq RSP-RDI(%rdi) /* RSP */
+ pushq (%rdi) /* RDI */
+@@ -575,7 +575,7 @@ END(spurious_entries_start)
+ * +----------------------------------------------------+
+ */
+ ENTRY(interrupt_entry)
+- UNWIND_HINT_FUNC
++ UNWIND_HINT_IRET_REGS offset=16
+ ASM_CLAC
+ cld
+
+@@ -607,9 +607,9 @@ ENTRY(interrupt_entry)
+ pushq 5*8(%rdi) /* regs->eflags */
+ pushq 4*8(%rdi) /* regs->cs */
+ pushq 3*8(%rdi) /* regs->ip */
++ UNWIND_HINT_IRET_REGS
+ pushq 2*8(%rdi) /* regs->orig_ax */
+ pushq 8(%rdi) /* return address */
+- UNWIND_HINT_FUNC
+
+ movq (%rdi), %rdi
+ jmp 2f
+@@ -700,6 +700,7 @@ GLOBAL(swapgs_restore_regs_and_return_to_usermode)
+ */
+ movq %rsp, %rdi
+ movq PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp
++ UNWIND_HINT_EMPTY
+
+ /* Copy the IRET frame to the trampoline stack. */
+ pushq 6*8(%rdi) /* SS */
+@@ -1744,7 +1745,7 @@ ENTRY(rewind_stack_do_exit)
+
+ movq PER_CPU_VAR(cpu_current_top_of_stack), %rax
+ leaq -PTREGS_SIZE(%rax), %rsp
+- UNWIND_HINT_FUNC sp_offset=PTREGS_SIZE
++ UNWIND_HINT_REGS
+
+ call do_exit
+ END(rewind_stack_do_exit)
+diff --git a/arch/x86/include/asm/unwind.h b/arch/x86/include/asm/unwind.h
+index 499578f7e6d7..70fc159ebe69 100644
+--- a/arch/x86/include/asm/unwind.h
++++ b/arch/x86/include/asm/unwind.h
+@@ -19,7 +19,7 @@ struct unwind_state {
+ #if defined(CONFIG_UNWINDER_ORC)
+ bool signal, full_regs;
+ unsigned long sp, bp, ip;
+- struct pt_regs *regs;
++ struct pt_regs *regs, *prev_regs;
+ #elif defined(CONFIG_UNWINDER_FRAME_POINTER)
+ bool got_irq;
+ unsigned long *bp, *orig_sp, ip;
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 89be1be1790c..169b96492b7c 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -131,9 +131,6 @@ static struct orc_entry *orc_find(unsigned long ip)
+ {
+ static struct orc_entry *orc;
+
+- if (!orc_init)
+- return NULL;
+-
+ if (ip == 0)
+ return &null_orc_entry;
+
+@@ -367,9 +364,38 @@ static bool deref_stack_iret_regs(struct unwind_state *state, unsigned long addr
+ return true;
+ }
+
++/*
++ * If state->regs is non-NULL, and points to a full pt_regs, just get the reg
++ * value from state->regs.
++ *
++ * Otherwise, if state->regs just points to IRET regs, and the previous frame
++ * had full regs, it's safe to get the value from the previous regs. This can
++ * happen when early/late IRQ entry code gets interrupted by an NMI.
++ */
++static bool get_reg(struct unwind_state *state, unsigned int reg_off,
++ unsigned long *val)
++{
++ unsigned int reg = reg_off/8;
++
++ if (!state->regs)
++ return false;
++
++ if (state->full_regs) {
++ *val = ((unsigned long *)state->regs)[reg];
++ return true;
++ }
++
++ if (state->prev_regs) {
++ *val = ((unsigned long *)state->prev_regs)[reg];
++ return true;
++ }
++
++ return false;
++}
++
+ bool unwind_next_frame(struct unwind_state *state)
+ {
+- unsigned long ip_p, sp, orig_ip = state->ip, prev_sp = state->sp;
++ unsigned long ip_p, sp, tmp, orig_ip = state->ip, prev_sp = state->sp;
+ enum stack_type prev_type = state->stack_info.type;
+ struct orc_entry *orc;
+ bool indirect = false;
+@@ -423,39 +449,35 @@ bool unwind_next_frame(struct unwind_state *state)
+ break;
+
+ case ORC_REG_R10:
+- if (!state->regs || !state->full_regs) {
++ if (!get_reg(state, offsetof(struct pt_regs, r10), &sp)) {
+ orc_warn("missing regs for base reg R10 at ip %pB\n",
+ (void *)state->ip);
+ goto err;
+ }
+- sp = state->regs->r10;
+ break;
+
+ case ORC_REG_R13:
+- if (!state->regs || !state->full_regs) {
++ if (!get_reg(state, offsetof(struct pt_regs, r13), &sp)) {
+ orc_warn("missing regs for base reg R13 at ip %pB\n",
+ (void *)state->ip);
+ goto err;
+ }
+- sp = state->regs->r13;
+ break;
+
+ case ORC_REG_DI:
+- if (!state->regs || !state->full_regs) {
++ if (!get_reg(state, offsetof(struct pt_regs, di), &sp)) {
+ orc_warn("missing regs for base reg DI at ip %pB\n",
+ (void *)state->ip);
+ goto err;
+ }
+- sp = state->regs->di;
+ break;
+
+ case ORC_REG_DX:
+- if (!state->regs || !state->full_regs) {
++ if (!get_reg(state, offsetof(struct pt_regs, dx), &sp)) {
+ orc_warn("missing regs for base reg DX at ip %pB\n",
+ (void *)state->ip);
+ goto err;
+ }
+- sp = state->regs->dx;
+ break;
+
+ default:
+@@ -482,6 +504,7 @@ bool unwind_next_frame(struct unwind_state *state)
+
+ state->sp = sp;
+ state->regs = NULL;
++ state->prev_regs = NULL;
+ state->signal = false;
+ break;
+
+@@ -493,6 +516,7 @@ bool unwind_next_frame(struct unwind_state *state)
+ }
+
+ state->regs = (struct pt_regs *)sp;
++ state->prev_regs = NULL;
+ state->full_regs = true;
+ state->signal = true;
+ break;
+@@ -504,6 +528,8 @@ bool unwind_next_frame(struct unwind_state *state)
+ goto err;
+ }
+
++ if (state->full_regs)
++ state->prev_regs = state->regs;
+ state->regs = (void *)sp - IRET_FRAME_OFFSET;
+ state->full_regs = false;
+ state->signal = true;
+@@ -512,14 +538,14 @@ bool unwind_next_frame(struct unwind_state *state)
+ default:
+ orc_warn("unknown .orc_unwind entry type %d for ip %pB\n",
+ orc->type, (void *)orig_ip);
+- break;
++ goto err;
+ }
+
+ /* Find BP: */
+ switch (orc->bp_reg) {
+ case ORC_REG_UNDEFINED:
+- if (state->regs && state->full_regs)
+- state->bp = state->regs->bp;
++ if (get_reg(state, offsetof(struct pt_regs, bp), &tmp))
++ state->bp = tmp;
+ break;
+
+ case ORC_REG_PREV_SP:
+@@ -563,6 +589,9 @@ EXPORT_SYMBOL_GPL(unwind_next_frame);
+ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ struct pt_regs *regs, unsigned long *first_frame)
+ {
++ if (!orc_init)
++ goto done;
++
+ memset(state, 0, sizeof(*state));
+ state->task = task;
+
+@@ -629,7 +658,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ /* Otherwise, skip ahead to the user-specified starting frame: */
+ while (!unwind_done(state) &&
+ (!on_stack(&state->stack_info, first_frame, sizeof(long)) ||
+- state->sp <= (unsigned long)first_frame))
++ state->sp < (unsigned long)first_frame))
+ unwind_next_frame(state);
+
+ return;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index fe5036641c59..f08c287b6242 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10771,14 +10771,14 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ else if (static_branch_unlikely(&mds_user_clear))
+ mds_clear_cpu_buffers();
+
+- asm(
++ asm volatile (
+ /* Store host registers */
+ "push %%" _ASM_DX "; push %%" _ASM_BP ";"
+ "push %%" _ASM_CX " \n\t" /* placeholder for guest rcx */
+ "push %%" _ASM_CX " \n\t"
+- "cmp %%" _ASM_SP ", %c[host_rsp](%0) \n\t"
++ "cmp %%" _ASM_SP ", %c[host_rsp](%%" _ASM_CX ") \n\t"
+ "je 1f \n\t"
+- "mov %%" _ASM_SP ", %c[host_rsp](%0) \n\t"
++ "mov %%" _ASM_SP ", %c[host_rsp](%%" _ASM_CX ") \n\t"
+ /* Avoid VMWRITE when Enlightened VMCS is in use */
+ "test %%" _ASM_SI ", %%" _ASM_SI " \n\t"
+ "jz 2f \n\t"
+@@ -10788,32 +10788,33 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ __ex(ASM_VMX_VMWRITE_RSP_RDX) "\n\t"
+ "1: \n\t"
+ /* Reload cr2 if changed */
+- "mov %c[cr2](%0), %%" _ASM_AX " \n\t"
++ "mov %c[cr2](%%" _ASM_CX "), %%" _ASM_AX " \n\t"
+ "mov %%cr2, %%" _ASM_DX " \n\t"
+ "cmp %%" _ASM_AX ", %%" _ASM_DX " \n\t"
+ "je 3f \n\t"
+ "mov %%" _ASM_AX", %%cr2 \n\t"
+ "3: \n\t"
+ /* Check if vmlaunch of vmresume is needed */
+- "cmpb $0, %c[launched](%0) \n\t"
++ "cmpb $0, %c[launched](%%" _ASM_CX ") \n\t"
+ /* Load guest registers. Don't clobber flags. */
+- "mov %c[rax](%0), %%" _ASM_AX " \n\t"
+- "mov %c[rbx](%0), %%" _ASM_BX " \n\t"
+- "mov %c[rdx](%0), %%" _ASM_DX " \n\t"
+- "mov %c[rsi](%0), %%" _ASM_SI " \n\t"
+- "mov %c[rdi](%0), %%" _ASM_DI " \n\t"
+- "mov %c[rbp](%0), %%" _ASM_BP " \n\t"
++ "mov %c[rax](%%" _ASM_CX "), %%" _ASM_AX " \n\t"
++ "mov %c[rbx](%%" _ASM_CX "), %%" _ASM_BX " \n\t"
++ "mov %c[rdx](%%" _ASM_CX "), %%" _ASM_DX " \n\t"
++ "mov %c[rsi](%%" _ASM_CX "), %%" _ASM_SI " \n\t"
++ "mov %c[rdi](%%" _ASM_CX "), %%" _ASM_DI " \n\t"
++ "mov %c[rbp](%%" _ASM_CX "), %%" _ASM_BP " \n\t"
+ #ifdef CONFIG_X86_64
+- "mov %c[r8](%0), %%r8 \n\t"
+- "mov %c[r9](%0), %%r9 \n\t"
+- "mov %c[r10](%0), %%r10 \n\t"
+- "mov %c[r11](%0), %%r11 \n\t"
+- "mov %c[r12](%0), %%r12 \n\t"
+- "mov %c[r13](%0), %%r13 \n\t"
+- "mov %c[r14](%0), %%r14 \n\t"
+- "mov %c[r15](%0), %%r15 \n\t"
++ "mov %c[r8](%%" _ASM_CX "), %%r8 \n\t"
++ "mov %c[r9](%%" _ASM_CX "), %%r9 \n\t"
++ "mov %c[r10](%%" _ASM_CX "), %%r10 \n\t"
++ "mov %c[r11](%%" _ASM_CX "), %%r11 \n\t"
++ "mov %c[r12](%%" _ASM_CX "), %%r12 \n\t"
++ "mov %c[r13](%%" _ASM_CX "), %%r13 \n\t"
++ "mov %c[r14](%%" _ASM_CX "), %%r14 \n\t"
++ "mov %c[r15](%%" _ASM_CX "), %%r15 \n\t"
+ #endif
+- "mov %c[rcx](%0), %%" _ASM_CX " \n\t" /* kills %0 (ecx) */
++ /* Load guest RCX. This kills the vmx_vcpu pointer! */
++ "mov %c[rcx](%%" _ASM_CX "), %%" _ASM_CX " \n\t"
+
+ /* Enter guest mode */
+ "jne 1f \n\t"
+@@ -10821,26 +10822,33 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ "jmp 2f \n\t"
+ "1: " __ex(ASM_VMX_VMRESUME) "\n\t"
+ "2: "
+- /* Save guest registers, load host registers, keep flags */
+- "mov %0, %c[wordsize](%%" _ASM_SP ") \n\t"
+- "pop %0 \n\t"
+- "setbe %c[fail](%0)\n\t"
+- "mov %%" _ASM_AX ", %c[rax](%0) \n\t"
+- "mov %%" _ASM_BX ", %c[rbx](%0) \n\t"
+- __ASM_SIZE(pop) " %c[rcx](%0) \n\t"
+- "mov %%" _ASM_DX ", %c[rdx](%0) \n\t"
+- "mov %%" _ASM_SI ", %c[rsi](%0) \n\t"
+- "mov %%" _ASM_DI ", %c[rdi](%0) \n\t"
+- "mov %%" _ASM_BP ", %c[rbp](%0) \n\t"
++
++ /* Save guest's RCX to the stack placeholder (see above) */
++ "mov %%" _ASM_CX ", %c[wordsize](%%" _ASM_SP ") \n\t"
++
++ /* Load host's RCX, i.e. the vmx_vcpu pointer */
++ "pop %%" _ASM_CX " \n\t"
++
++ /* Set vmx->fail based on EFLAGS.{CF,ZF} */
++ "setbe %c[fail](%%" _ASM_CX ")\n\t"
++
++ /* Save all guest registers, including RCX from the stack */
++ "mov %%" _ASM_AX ", %c[rax](%%" _ASM_CX ") \n\t"
++ "mov %%" _ASM_BX ", %c[rbx](%%" _ASM_CX ") \n\t"
++ __ASM_SIZE(pop) " %c[rcx](%%" _ASM_CX ") \n\t"
++ "mov %%" _ASM_DX ", %c[rdx](%%" _ASM_CX ") \n\t"
++ "mov %%" _ASM_SI ", %c[rsi](%%" _ASM_CX ") \n\t"
++ "mov %%" _ASM_DI ", %c[rdi](%%" _ASM_CX ") \n\t"
++ "mov %%" _ASM_BP ", %c[rbp](%%" _ASM_CX ") \n\t"
+ #ifdef CONFIG_X86_64
+- "mov %%r8, %c[r8](%0) \n\t"
+- "mov %%r9, %c[r9](%0) \n\t"
+- "mov %%r10, %c[r10](%0) \n\t"
+- "mov %%r11, %c[r11](%0) \n\t"
+- "mov %%r12, %c[r12](%0) \n\t"
+- "mov %%r13, %c[r13](%0) \n\t"
+- "mov %%r14, %c[r14](%0) \n\t"
+- "mov %%r15, %c[r15](%0) \n\t"
++ "mov %%r8, %c[r8](%%" _ASM_CX ") \n\t"
++ "mov %%r9, %c[r9](%%" _ASM_CX ") \n\t"
++ "mov %%r10, %c[r10](%%" _ASM_CX ") \n\t"
++ "mov %%r11, %c[r11](%%" _ASM_CX ") \n\t"
++ "mov %%r12, %c[r12](%%" _ASM_CX ") \n\t"
++ "mov %%r13, %c[r13](%%" _ASM_CX ") \n\t"
++ "mov %%r14, %c[r14](%%" _ASM_CX ") \n\t"
++ "mov %%r15, %c[r15](%%" _ASM_CX ") \n\t"
+
+ /*
+ * Clear all general purpose registers (except RSP, which is loaded by
+@@ -10860,7 +10868,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ "xor %%r15d, %%r15d \n\t"
+ #endif
+ "mov %%cr2, %%" _ASM_AX " \n\t"
+- "mov %%" _ASM_AX ", %c[cr2](%0) \n\t"
++ "mov %%" _ASM_AX ", %c[cr2](%%" _ASM_CX ") \n\t"
+
+ "xor %%eax, %%eax \n\t"
+ "xor %%ebx, %%ebx \n\t"
+@@ -10874,7 +10882,8 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ ".global vmx_return \n\t"
+ "vmx_return: " _ASM_PTR " 2b \n\t"
+ ".popsection"
+- : : "c"(vmx), "d"((unsigned long)HOST_RSP), "S"(evmcs_rsp),
++ : "=c"((int){0}), "=d"((int){0}), "=S"((int){0})
++ : "c"(vmx), "d"((unsigned long)HOST_RSP), "S"(evmcs_rsp),
+ [launched]"i"(offsetof(struct vcpu_vmx, __launched)),
+ [fail]"i"(offsetof(struct vcpu_vmx, fail)),
+ [host_rsp]"i"(offsetof(struct vcpu_vmx, host_rsp)),
+diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
+index 11103efebbaa..1e6f8b0d00fb 100644
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -685,16 +685,21 @@ static int usbhid_open(struct hid_device *hid)
+ struct usbhid_device *usbhid = hid->driver_data;
+ int res;
+
++ mutex_lock(&usbhid->mutex);
++
+ set_bit(HID_OPENED, &usbhid->iofl);
+
+- if (hid->quirks & HID_QUIRK_ALWAYS_POLL)
+- return 0;
++ if (hid->quirks & HID_QUIRK_ALWAYS_POLL) {
++ res = 0;
++ goto Done;
++ }
+
+ res = usb_autopm_get_interface(usbhid->intf);
+ /* the device must be awake to reliably request remote wakeup */
+ if (res < 0) {
+ clear_bit(HID_OPENED, &usbhid->iofl);
+- return -EIO;
++ res = -EIO;
++ goto Done;
+ }
+
+ usbhid->intf->needs_remote_wakeup = 1;
+@@ -728,6 +733,9 @@ static int usbhid_open(struct hid_device *hid)
+ msleep(50);
+
+ clear_bit(HID_RESUME_RUNNING, &usbhid->iofl);
++
++ Done:
++ mutex_unlock(&usbhid->mutex);
+ return res;
+ }
+
+@@ -735,6 +743,8 @@ static void usbhid_close(struct hid_device *hid)
+ {
+ struct usbhid_device *usbhid = hid->driver_data;
+
++ mutex_lock(&usbhid->mutex);
++
+ /*
+ * Make sure we don't restart data acquisition due to
+ * a resumption we no longer care about by avoiding racing
+@@ -746,12 +756,13 @@ static void usbhid_close(struct hid_device *hid)
+ clear_bit(HID_IN_POLLING, &usbhid->iofl);
+ spin_unlock_irq(&usbhid->lock);
+
+- if (hid->quirks & HID_QUIRK_ALWAYS_POLL)
+- return;
++ if (!(hid->quirks & HID_QUIRK_ALWAYS_POLL)) {
++ hid_cancel_delayed_stuff(usbhid);
++ usb_kill_urb(usbhid->urbin);
++ usbhid->intf->needs_remote_wakeup = 0;
++ }
+
+- hid_cancel_delayed_stuff(usbhid);
+- usb_kill_urb(usbhid->urbin);
+- usbhid->intf->needs_remote_wakeup = 0;
++ mutex_unlock(&usbhid->mutex);
+ }
+
+ /*
+@@ -1060,6 +1071,8 @@ static int usbhid_start(struct hid_device *hid)
+ unsigned int n, insize = 0;
+ int ret;
+
++ mutex_lock(&usbhid->mutex);
++
+ clear_bit(HID_DISCONNECTED, &usbhid->iofl);
+
+ usbhid->bufsize = HID_MIN_BUFFER_SIZE;
+@@ -1180,6 +1193,8 @@ static int usbhid_start(struct hid_device *hid)
+ usbhid_set_leds(hid);
+ device_set_wakeup_enable(&dev->dev, 1);
+ }
++
++ mutex_unlock(&usbhid->mutex);
+ return 0;
+
+ fail:
+@@ -1190,6 +1205,7 @@ fail:
+ usbhid->urbout = NULL;
+ usbhid->urbctrl = NULL;
+ hid_free_buffers(dev, hid);
++ mutex_unlock(&usbhid->mutex);
+ return ret;
+ }
+
+@@ -1205,6 +1221,8 @@ static void usbhid_stop(struct hid_device *hid)
+ usbhid->intf->needs_remote_wakeup = 0;
+ }
+
++ mutex_lock(&usbhid->mutex);
++
+ clear_bit(HID_STARTED, &usbhid->iofl);
+ spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */
+ set_bit(HID_DISCONNECTED, &usbhid->iofl);
+@@ -1225,6 +1243,8 @@ static void usbhid_stop(struct hid_device *hid)
+ usbhid->urbout = NULL;
+
+ hid_free_buffers(hid_to_usb_dev(hid), hid);
++
++ mutex_unlock(&usbhid->mutex);
+ }
+
+ static int usbhid_power(struct hid_device *hid, int lvl)
+@@ -1385,6 +1405,7 @@ static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *
+ INIT_WORK(&usbhid->reset_work, hid_reset);
+ timer_setup(&usbhid->io_retry, hid_retry_timeout, 0);
+ spin_lock_init(&usbhid->lock);
++ mutex_init(&usbhid->mutex);
+
+ ret = hid_add_device(hid);
+ if (ret) {
+diff --git a/drivers/hid/usbhid/usbhid.h b/drivers/hid/usbhid/usbhid.h
+index da9c61d54be6..caa0ee639581 100644
+--- a/drivers/hid/usbhid/usbhid.h
++++ b/drivers/hid/usbhid/usbhid.h
+@@ -93,6 +93,7 @@ struct usbhid_device {
+ dma_addr_t outbuf_dma; /* Output buffer dma */
+ unsigned long last_out; /* record of last output for timeouts */
+
++ struct mutex mutex; /* start/stop/open/close */
+ spinlock_t lock; /* fifo spinlock */
+ unsigned long iofl; /* I/O flags (CTRL_RUNNING, OUT_RUNNING) */
+ struct timer_list io_retry; /* Retry timer */
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 3038c975e417..8249ff3a5a8d 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -290,9 +290,11 @@ static void wacom_feature_mapping(struct hid_device *hdev,
+ data[0] = field->report->id;
+ ret = wacom_get_report(hdev, HID_FEATURE_REPORT,
+ data, n, WAC_CMD_RETRIES);
+- if (ret == n) {
++ if (ret == n && features->type == HID_GENERIC) {
+ ret = hid_report_raw_event(hdev,
+ HID_FEATURE_REPORT, data, n, 0);
++ } else if (ret == 2 && features->type != HID_GENERIC) {
++ features->touch_max = data[1];
+ } else {
+ features->touch_max = 16;
+ hid_warn(hdev, "wacom_feature_mapping: "
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index f008c91d4566..dca58d28d82f 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -7562,6 +7562,7 @@ static netdev_features_t bnxt_fix_features(struct net_device *dev,
+ netdev_features_t features)
+ {
+ struct bnxt *bp = netdev_priv(dev);
++ netdev_features_t vlan_features;
+
+ if ((features & NETIF_F_NTUPLE) && !bnxt_rfs_capable(bp))
+ features &= ~NETIF_F_NTUPLE;
+@@ -7578,12 +7579,14 @@ static netdev_features_t bnxt_fix_features(struct net_device *dev,
+ /* Both CTAG and STAG VLAN accelaration on the RX side have to be
+ * turned on or off together.
+ */
+- if ((features & (NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_STAG_RX)) !=
+- (NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_STAG_RX)) {
++ vlan_features = features & (NETIF_F_HW_VLAN_CTAG_RX |
++ NETIF_F_HW_VLAN_STAG_RX);
++ if (vlan_features != (NETIF_F_HW_VLAN_CTAG_RX |
++ NETIF_F_HW_VLAN_STAG_RX)) {
+ if (dev->features & NETIF_F_HW_VLAN_CTAG_RX)
+ features &= ~(NETIF_F_HW_VLAN_CTAG_RX |
+ NETIF_F_HW_VLAN_STAG_RX);
+- else
++ else if (vlan_features)
+ features |= NETIF_F_HW_VLAN_CTAG_RX |
+ NETIF_F_HW_VLAN_STAG_RX;
+ }
+@@ -9297,8 +9300,11 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev)
+ }
+ }
+
+- if (result != PCI_ERS_RESULT_RECOVERED && netif_running(netdev))
+- dev_close(netdev);
++ if (result != PCI_ERS_RESULT_RECOVERED) {
++ if (netif_running(netdev))
++ dev_close(netdev);
++ pci_disable_device(pdev);
++ }
+
+ rtnl_unlock();
+
+@@ -9309,7 +9315,7 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev)
+ err); /* non-fatal, continue */
+ }
+
+- return PCI_ERS_RESULT_RECOVERED;
++ return result;
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 585f5aef0a45..f3f5484c43e4 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -839,7 +839,6 @@ struct bnxt_vf_info {
+ #define BNXT_VF_LINK_FORCED 0x4
+ #define BNXT_VF_LINK_UP 0x8
+ #define BNXT_VF_TRUST 0x10
+- u32 func_flags; /* func cfg flags */
+ u32 min_tx_rate;
+ u32 max_tx_rate;
+ void *hwrm_cmd_req_addr;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+index 3962f6fd543c..bba6f09279d5 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+@@ -99,11 +99,10 @@ int bnxt_set_vf_spoofchk(struct net_device *dev, int vf_id, bool setting)
+ if (old_setting == setting)
+ return 0;
+
+- func_flags = vf->func_flags;
+ if (setting)
+- func_flags |= FUNC_CFG_REQ_FLAGS_SRC_MAC_ADDR_CHECK_ENABLE;
++ func_flags = FUNC_CFG_REQ_FLAGS_SRC_MAC_ADDR_CHECK_ENABLE;
+ else
+- func_flags |= FUNC_CFG_REQ_FLAGS_SRC_MAC_ADDR_CHECK_DISABLE;
++ func_flags = FUNC_CFG_REQ_FLAGS_SRC_MAC_ADDR_CHECK_DISABLE;
+ /*TODO: if the driver supports VLAN filter on guest VLAN,
+ * the spoof check should also include vlan anti-spoofing
+ */
+@@ -112,7 +111,6 @@ int bnxt_set_vf_spoofchk(struct net_device *dev, int vf_id, bool setting)
+ req.flags = cpu_to_le32(func_flags);
+ rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+ if (!rc) {
+- vf->func_flags = func_flags;
+ if (setting)
+ vf->flags |= BNXT_VF_SPOOFCHK;
+ else
+@@ -197,7 +195,6 @@ int bnxt_set_vf_mac(struct net_device *dev, int vf_id, u8 *mac)
+ memcpy(vf->mac_addr, mac, ETH_ALEN);
+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_CFG, -1, -1);
+ req.fid = cpu_to_le16(vf->fw_fid);
+- req.flags = cpu_to_le32(vf->func_flags);
+ req.enables = cpu_to_le32(FUNC_CFG_REQ_ENABLES_DFLT_MAC_ADDR);
+ memcpy(req.dflt_mac_addr, mac, ETH_ALEN);
+ return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+@@ -235,7 +232,6 @@ int bnxt_set_vf_vlan(struct net_device *dev, int vf_id, u16 vlan_id, u8 qos,
+
+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_CFG, -1, -1);
+ req.fid = cpu_to_le16(vf->fw_fid);
+- req.flags = cpu_to_le32(vf->func_flags);
+ req.dflt_vlan = cpu_to_le16(vlan_tag);
+ req.enables = cpu_to_le32(FUNC_CFG_REQ_ENABLES_DFLT_VLAN);
+ rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+@@ -274,7 +270,6 @@ int bnxt_set_vf_bw(struct net_device *dev, int vf_id, int min_tx_rate,
+ return 0;
+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FUNC_CFG, -1, -1);
+ req.fid = cpu_to_le16(vf->fw_fid);
+- req.flags = cpu_to_le32(vf->func_flags);
+ req.enables = cpu_to_le32(FUNC_CFG_REQ_ENABLES_MAX_BW);
+ req.max_bw = cpu_to_le32(max_tx_rate);
+ req.enables |= cpu_to_le32(FUNC_CFG_REQ_ENABLES_MIN_BW);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index 4afe56a6eedf..f7825c7b92fe 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -2539,6 +2539,7 @@ static int mlx4_allocate_default_counters(struct mlx4_dev *dev)
+
+ if (!err || err == -ENOSPC) {
+ priv->def_counter[port] = idx;
++ err = 0;
+ } else if (err == -ENOENT) {
+ err = 0;
+ continue;
+@@ -2589,7 +2590,8 @@ int mlx4_counter_alloc(struct mlx4_dev *dev, u32 *idx, u8 usage)
+ MLX4_CMD_TIME_CLASS_A, MLX4_CMD_WRAPPED);
+ if (!err)
+ *idx = get_param_l(&out_param);
+-
++ if (WARN_ON(err == -ENOSPC))
++ err = -EINVAL;
+ return err;
+ }
+ return __mlx4_counter_alloc(dev, idx);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index a53736c26c0c..300456684728 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -862,7 +862,6 @@ static void cmd_work_handler(struct work_struct *work)
+ }
+
+ cmd->ent_arr[ent->idx] = ent;
+- set_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, &ent->state);
+ lay = get_inst(cmd, ent->idx);
+ ent->lay = lay;
+ memset(lay, 0, sizeof(*lay));
+@@ -884,6 +883,7 @@ static void cmd_work_handler(struct work_struct *work)
+
+ if (ent->callback)
+ schedule_delayed_work(&ent->cb_timeout_work, cb_timeout);
++ set_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, &ent->state);
+
+ /* Skip sending command to fw if internal error */
+ if (pci_channel_offline(dev->pdev) ||
+@@ -896,6 +896,10 @@ static void cmd_work_handler(struct work_struct *work)
+ MLX5_SET(mbox_out, ent->out, syndrome, drv_synd);
+
+ mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
++ /* no doorbell, no need to keep the entry */
++ free_ent(cmd, ent->idx);
++ if (ent->callback)
++ free_cmd(ent);
+ return;
+ }
+
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 9e2612562981..4ad3b877e5fd 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -1313,7 +1313,8 @@ static struct crypto_aead *macsec_alloc_tfm(char *key, int key_len, int icv_len)
+ struct crypto_aead *tfm;
+ int ret;
+
+- tfm = crypto_alloc_aead("gcm(aes)", 0, 0);
++ /* Pick a sync gcm(aes) cipher to ensure order is preserved. */
++ tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
+
+ if (IS_ERR(tfm))
+ return tfm;
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index 59b3f1fbabd4..4fed77833157 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -1114,7 +1114,7 @@ static struct dp83640_clock *dp83640_clock_get_bus(struct mii_bus *bus)
+ goto out;
+ }
+ dp83640_clock_init(clock, bus);
+- list_add_tail(&phyter_clocks, &clock->list);
++ list_add_tail(&clock->list, &phyter_clocks);
+ out:
+ mutex_unlock(&phyter_clocks_lock);
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index a7804def1120..c8222cdf755d 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1294,6 +1294,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x413c, 0x81b3, 8)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+ {QMI_FIXED_INTF(0x413c, 0x81b6, 8)}, /* Dell Wireless 5811e */
+ {QMI_FIXED_INTF(0x413c, 0x81b6, 10)}, /* Dell Wireless 5811e */
++ {QMI_FIXED_INTF(0x413c, 0x81cc, 8)}, /* Dell Wireless 5816e */
+ {QMI_FIXED_INTF(0x413c, 0x81d7, 0)}, /* Dell Wireless 5821e */
+ {QMI_FIXED_INTF(0x413c, 0x81d7, 1)}, /* Dell Wireless 5821e preproduction config */
+ {QMI_FIXED_INTF(0x413c, 0x81e0, 0)}, /* Dell Wireless 5821e with eSIM support*/
+diff --git a/drivers/staging/gasket/gasket_core.c b/drivers/staging/gasket/gasket_core.c
+index d12ab560411f..9396aeb3f431 100644
+--- a/drivers/staging/gasket/gasket_core.c
++++ b/drivers/staging/gasket/gasket_core.c
+@@ -933,6 +933,10 @@ do_map_region(const struct gasket_dev *gasket_dev, struct vm_area_struct *vma,
+ gasket_get_bar_index(gasket_dev,
+ (vma->vm_pgoff << PAGE_SHIFT) +
+ driver_desc->legacy_mmap_address_offset);
++
++ if (bar_index < 0)
++ return DO_MAP_REGION_INVALID;
++
+ phys_base = gasket_dev->bar_data[bar_index].phys_base + phys_offset;
+ while (mapped_bytes < map_length) {
+ /*
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index ca8c6ddc1ca8..5c7a968a5ea6 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -365,9 +365,14 @@ static struct uni_screen *vc_uniscr_alloc(unsigned int cols, unsigned int rows)
+ return uniscr;
+ }
+
++static void vc_uniscr_free(struct uni_screen *uniscr)
++{
++ vfree(uniscr);
++}
++
+ static void vc_uniscr_set(struct vc_data *vc, struct uni_screen *new_uniscr)
+ {
+- vfree(vc->vc_uni_screen);
++ vc_uniscr_free(vc->vc_uni_screen);
+ vc->vc_uni_screen = new_uniscr;
+ }
+
+@@ -1233,7 +1238,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ err = resize_screen(vc, new_cols, new_rows, user);
+ if (err) {
+ kfree(newscreen);
+- kfree(new_uniscr);
++ vc_uniscr_free(new_uniscr);
+ return err;
+ }
+
+diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
+index 633550ec3025..f29c3a936a08 100644
+--- a/drivers/usb/serial/garmin_gps.c
++++ b/drivers/usb/serial/garmin_gps.c
+@@ -1138,8 +1138,8 @@ static void garmin_read_process(struct garmin_data *garmin_data_p,
+ send it directly to the tty port */
+ if (garmin_data_p->flags & FLAGS_QUEUING) {
+ pkt_add(garmin_data_p, data, data_length);
+- } else if (bulk_data ||
+- getLayerId(data) == GARMIN_LAYERID_APPL) {
++ } else if (bulk_data || (data_length >= sizeof(u32) &&
++ getLayerId(data) == GARMIN_LAYERID_APPL)) {
+
+ spin_lock_irqsave(&garmin_data_p->lock, flags);
+ garmin_data_p->flags |= APP_RESP_SEEN;
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index 613f91add03d..ce0401d3137f 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -173,6 +173,7 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+ {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */
+ {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */
++ {DEVICE_SWI(0x413c, 0x81cc)}, /* Dell Wireless 5816e */
+ {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */
+ {DEVICE_SWI(0x413c, 0x81d0)}, /* Dell Wireless 5819 */
+ {DEVICE_SWI(0x413c, 0x81d1)}, /* Dell Wireless 5818 */
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 1b23741036ee..37157ed9a881 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -28,6 +28,13 @@
+ * and don't forget to CC: the USB development list <linux-usb@vger.kernel.org>
+ */
+
++/* Reported-by: Julian Groß <julian.g@posteo.de> */
++UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
++ "LaCie",
++ "2Big Quadra USB3",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_REPORT_OPCODES),
++
+ /*
+ * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI
+ * commands in UAS mode. Observed with the 1.28 firmware; are there others?
+diff --git a/fs/coredump.c b/fs/coredump.c
+index 1e2c87acac9b..ef7ed64947e9 100644
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -753,6 +753,14 @@ void do_coredump(const siginfo_t *siginfo)
+ if (displaced)
+ put_files_struct(displaced);
+ if (!dump_interrupted()) {
++ /*
++ * umh disabled with CONFIG_STATIC_USERMODEHELPER_PATH="" would
++ * have this set to NULL.
++ */
++ if (!cprm.file) {
++ pr_info("Core dump to |%s disabled\n", cn.corename);
++ goto close_fail;
++ }
+ file_start_write(cprm.file);
+ core_dumped = binfmt->core_dump(&cprm);
+ file_end_write(cprm.file);
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index e0348cb0a1dd..f36727098df8 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -3,6 +3,8 @@
+ #define _LINUX_VIRTIO_NET_H
+
+ #include <linux/if_vlan.h>
++#include <uapi/linux/tcp.h>
++#include <uapi/linux/udp.h>
+ #include <uapi/linux/virtio_net.h>
+
+ static inline int virtio_net_hdr_set_proto(struct sk_buff *skb,
+@@ -28,17 +30,25 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ bool little_endian)
+ {
+ unsigned int gso_type = 0;
++ unsigned int thlen = 0;
++ unsigned int ip_proto;
+
+ if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+ switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
+ case VIRTIO_NET_HDR_GSO_TCPV4:
+ gso_type = SKB_GSO_TCPV4;
++ ip_proto = IPPROTO_TCP;
++ thlen = sizeof(struct tcphdr);
+ break;
+ case VIRTIO_NET_HDR_GSO_TCPV6:
+ gso_type = SKB_GSO_TCPV6;
++ ip_proto = IPPROTO_TCP;
++ thlen = sizeof(struct tcphdr);
+ break;
+ case VIRTIO_NET_HDR_GSO_UDP:
+ gso_type = SKB_GSO_UDP;
++ ip_proto = IPPROTO_UDP;
++ thlen = sizeof(struct udphdr);
+ break;
+ default:
+ return -EINVAL;
+@@ -57,16 +67,22 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+
+ if (!skb_partial_csum_set(skb, start, off))
+ return -EINVAL;
++
++ if (skb_transport_offset(skb) + thlen > skb_headlen(skb))
++ return -EINVAL;
+ } else {
+ /* gso packets without NEEDS_CSUM do not set transport_offset.
+ * probe and drop if does not match one of the above types.
+ */
+ if (gso_type && skb->network_header) {
++ struct flow_keys_basic keys;
++
+ if (!skb->protocol)
+ virtio_net_hdr_set_proto(skb, hdr);
+ retry:
+- skb_probe_transport_header(skb, -1);
+- if (!skb_transport_header_was_set(skb)) {
++ if (!skb_flow_dissect_flow_keys_basic(skb, &keys,
++ NULL, 0, 0, 0,
++ 0)) {
+ /* UFO does not specify ipv4 or 6: try both */
+ if (gso_type & SKB_GSO_UDP &&
+ skb->protocol == htons(ETH_P_IP)) {
+@@ -75,6 +91,12 @@ retry:
+ }
+ return -EINVAL;
+ }
++
++ if (keys.control.thoff + thlen > skb_headlen(skb) ||
++ keys.basic.ip_proto != ip_proto)
++ return -EINVAL;
++
++ skb_set_transport_header(skb, keys.control.thoff);
+ }
+ }
+
+diff --git a/ipc/mqueue.c b/ipc/mqueue.c
+index de4070d5472f..46d0265423f5 100644
+--- a/ipc/mqueue.c
++++ b/ipc/mqueue.c
+@@ -76,6 +76,7 @@ struct mqueue_inode_info {
+
+ struct sigevent notify;
+ struct pid *notify_owner;
++ u32 notify_self_exec_id;
+ struct user_namespace *notify_user_ns;
+ struct user_struct *user; /* user who created, for accounting */
+ struct sock *notify_sock;
+@@ -662,28 +663,44 @@ static void __do_notify(struct mqueue_inode_info *info)
+ * synchronously. */
+ if (info->notify_owner &&
+ info->attr.mq_curmsgs == 1) {
+- struct siginfo sig_i;
+ switch (info->notify.sigev_notify) {
+ case SIGEV_NONE:
+ break;
+- case SIGEV_SIGNAL:
+- /* sends signal */
++ case SIGEV_SIGNAL: {
++ struct siginfo sig_i;
++ struct task_struct *task;
++
++ /* do_mq_notify() accepts sigev_signo == 0, why?? */
++ if (!info->notify.sigev_signo)
++ break;
+
+ clear_siginfo(&sig_i);
+ sig_i.si_signo = info->notify.sigev_signo;
+ sig_i.si_errno = 0;
+ sig_i.si_code = SI_MESGQ;
+ sig_i.si_value = info->notify.sigev_value;
+- /* map current pid/uid into info->owner's namespaces */
+ rcu_read_lock();
++ /* map current pid/uid into info->owner's namespaces */
+ sig_i.si_pid = task_tgid_nr_ns(current,
+ ns_of_pid(info->notify_owner));
+- sig_i.si_uid = from_kuid_munged(info->notify_user_ns, current_uid());
++ sig_i.si_uid = from_kuid_munged(info->notify_user_ns,
++ current_uid());
++ /*
++ * We can't use kill_pid_info(), this signal should
++ * bypass check_kill_permission(). It is from kernel
++ * but si_fromuser() can't know this.
++ * We do check the self_exec_id, to avoid sending
++ * signals to programs that don't expect them.
++ */
++ task = pid_task(info->notify_owner, PIDTYPE_TGID);
++ if (task && task->self_exec_id ==
++ info->notify_self_exec_id) {
++ do_send_sig_info(info->notify.sigev_signo,
++ &sig_i, task, PIDTYPE_TGID);
++ }
+ rcu_read_unlock();
+-
+- kill_pid_info(info->notify.sigev_signo,
+- &sig_i, info->notify_owner);
+ break;
++ }
+ case SIGEV_THREAD:
+ set_cookie(info->notify_cookie, NOTIFY_WOKENUP);
+ netlink_sendskb(info->notify_sock, info->notify_cookie);
+@@ -1273,6 +1290,7 @@ retry:
+ info->notify.sigev_signo = notification->sigev_signo;
+ info->notify.sigev_value = notification->sigev_value;
+ info->notify.sigev_notify = SIGEV_SIGNAL;
++ info->notify_self_exec_id = current->self_exec_id;
+ break;
+ }
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index c41f7d1ab5fa..4966410bb0f4 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -7750,6 +7750,19 @@ static int allocate_trace_buffers(struct trace_array *tr, int size)
+ */
+ allocate_snapshot = false;
+ #endif
++
++ /*
++ * Because of some magic with the way alloc_percpu() works on
++ * x86_64, we need to synchronize the pgd of all the tables,
++ * otherwise the trace events that happen in x86_64 page fault
++ * handlers can't cope with accessing the chance that a
++ * alloc_percpu()'d memory might be touched in the page fault trace
++ * event. Oh, and we need to audit all other alloc_percpu() and vmalloc()
++ * calls in tracing, because something might get triggered within a
++ * page fault trace event!
++ */
++ vmalloc_sync_mappings();
++
+ return 0;
+ }
+
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index 65b4e28ff425..c45b017bacd4 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -538,7 +538,7 @@ static bool __within_notrace_func(unsigned long addr)
+
+ static bool within_notrace_func(struct trace_kprobe *tk)
+ {
+- unsigned long addr = addr = trace_kprobe_address(tk);
++ unsigned long addr = trace_kprobe_address(tk);
+ char symname[KSYM_NAME_LEN], *p;
+
+ if (!__within_notrace_func(addr))
+diff --git a/kernel/umh.c b/kernel/umh.c
+index c449858946af..52a9084f8541 100644
+--- a/kernel/umh.c
++++ b/kernel/umh.c
+@@ -522,6 +522,11 @@ EXPORT_SYMBOL_GPL(fork_usermode_blob);
+ * Runs a user-space application. The application is started
+ * asynchronously if wait is not set, and runs as a child of system workqueues.
+ * (ie. it runs with full root capabilities and optimized affinity).
++ *
++ * Note: successful return value does not guarantee the helper was called at
++ * all. You can't rely on sub_info->{init,cleanup} being called even for
++ * UMH_WAIT_* wait modes as STATIC_USERMODEHELPER_PATH="" turns all helpers
++ * into a successful no-op.
+ */
+ int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait)
+ {
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 57888cedf244..d8c3051387d1 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1422,6 +1422,7 @@ void set_zone_contiguous(struct zone *zone)
+ if (!__pageblock_pfn_to_page(block_start_pfn,
+ block_end_pfn, zone))
+ return;
++ cond_resched();
+ }
+
+ /* We confirm that there is no hole */
+diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
+index bf9ea404abe7..0458de53cb64 100644
+--- a/net/batman-adv/bat_v_ogm.c
++++ b/net/batman-adv/bat_v_ogm.c
+@@ -735,7 +735,7 @@ static void batadv_v_ogm_process(const struct sk_buff *skb, int ogm_offset,
+
+ orig_node = batadv_v_ogm_orig_get(bat_priv, ogm_packet->orig);
+ if (!orig_node)
+- return;
++ goto out;
+
+ neigh_node = batadv_neigh_node_get_or_create(orig_node, if_incoming,
+ ethhdr->h_source);
+diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
+index 34caf129a9bf..7f1be5a28757 100644
+--- a/net/batman-adv/network-coding.c
++++ b/net/batman-adv/network-coding.c
+@@ -1021,15 +1021,8 @@ static struct batadv_nc_path *batadv_nc_get_path(struct batadv_priv *bat_priv,
+ */
+ static u8 batadv_nc_random_weight_tq(u8 tq)
+ {
+- u8 rand_val, rand_tq;
+-
+- get_random_bytes(&rand_val, sizeof(rand_val));
+-
+ /* randomize the estimated packet loss (max TQ - estimated TQ) */
+- rand_tq = rand_val * (BATADV_TQ_MAX_VALUE - tq);
+-
+- /* normalize the randomized packet loss */
+- rand_tq /= BATADV_TQ_MAX_VALUE;
++ u8 rand_tq = prandom_u32_max(BATADV_TQ_MAX_VALUE + 1 - tq);
+
+ /* convert to (randomized) estimated tq again */
+ return BATADV_TQ_MAX_VALUE - rand_tq;
+diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c
+index 09427fc6494a..976b038e53bf 100644
+--- a/net/batman-adv/sysfs.c
++++ b/net/batman-adv/sysfs.c
+@@ -1093,7 +1093,7 @@ static ssize_t batadv_store_throughput_override(struct kobject *kobj,
+ ret = batadv_parse_throughput(net_dev, buff, "throughput_override",
+ &tp_override);
+ if (!ret)
+- return count;
++ goto out;
+
+ old_tp_override = atomic_read(&hard_iface->bat_v.throughput_override);
+ if (old_tp_override == tp_override)
+@@ -1126,6 +1126,7 @@ static ssize_t batadv_show_throughput_override(struct kobject *kobj,
+
+ tp_override = atomic_read(&hard_iface->bat_v.throughput_override);
+
++ batadv_hardif_put(hard_iface);
+ return sprintf(buff, "%u.%u MBit\n", tp_override / 10,
+ tp_override % 10);
+ }
+diff --git a/net/netfilter/nf_nat_proto_udp.c b/net/netfilter/nf_nat_proto_udp.c
+index 5790f70a83b2..d85c31c2433c 100644
+--- a/net/netfilter/nf_nat_proto_udp.c
++++ b/net/netfilter/nf_nat_proto_udp.c
+@@ -66,15 +66,14 @@ static bool udp_manip_pkt(struct sk_buff *skb,
+ enum nf_nat_manip_type maniptype)
+ {
+ struct udphdr *hdr;
+- bool do_csum;
+
+ if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
+ return false;
+
+ hdr = (struct udphdr *)(skb->data + hdroff);
+- do_csum = hdr->check || skb->ip_summed == CHECKSUM_PARTIAL;
++ __udp_manip_pkt(skb, l3proto, iphdroff, hdr, tuple, maniptype,
++ !!hdr->check);
+
+- __udp_manip_pkt(skb, l3proto, iphdroff, hdr, tuple, maniptype, do_csum);
+ return true;
+ }
+
+diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
+index b0bc130947c9..131f9f8c0b09 100644
+--- a/net/netfilter/nfnetlink_osf.c
++++ b/net/netfilter/nfnetlink_osf.c
+@@ -170,12 +170,12 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
+ static const struct tcphdr *nf_osf_hdr_ctx_init(struct nf_osf_hdr_ctx *ctx,
+ const struct sk_buff *skb,
+ const struct iphdr *ip,
+- unsigned char *opts)
++ unsigned char *opts,
++ struct tcphdr *_tcph)
+ {
+ const struct tcphdr *tcp;
+- struct tcphdr _tcph;
+
+- tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), &_tcph);
++ tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), _tcph);
+ if (!tcp)
+ return NULL;
+
+@@ -210,10 +210,11 @@ nf_osf_match(const struct sk_buff *skb, u_int8_t family,
+ int fmatch = FMATCH_WRONG;
+ struct nf_osf_hdr_ctx ctx;
+ const struct tcphdr *tcp;
++ struct tcphdr _tcph;
+
+ memset(&ctx, 0, sizeof(ctx));
+
+- tcp = nf_osf_hdr_ctx_init(&ctx, skb, ip, opts);
++ tcp = nf_osf_hdr_ctx_init(&ctx, skb, ip, opts, &_tcph);
+ if (!tcp)
+ return false;
+
+@@ -270,10 +271,11 @@ const char *nf_osf_find(const struct sk_buff *skb,
+ struct nf_osf_hdr_ctx ctx;
+ const struct tcphdr *tcp;
+ const char *genre = NULL;
++ struct tcphdr _tcph;
+
+ memset(&ctx, 0, sizeof(ctx));
+
+- tcp = nf_osf_hdr_ctx_init(&ctx, skb, ip, opts);
++ tcp = nf_osf_hdr_ctx_init(&ctx, skb, ip, opts, &_tcph);
+ if (!tcp)
+ return NULL;
+
+diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
+index eafc0d17d174..63bfceeb8e3c 100644
+--- a/net/sched/sch_choke.c
++++ b/net/sched/sch_choke.c
+@@ -327,7 +327,8 @@ static void choke_reset(struct Qdisc *sch)
+
+ sch->q.qlen = 0;
+ sch->qstats.backlog = 0;
+- memset(q->tab, 0, (q->tab_mask + 1) * sizeof(struct sk_buff *));
++ if (q->tab)
++ memset(q->tab, 0, (q->tab_mask + 1) * sizeof(struct sk_buff *));
+ q->head = q->tail = 0;
+ red_restart(&q->vars);
+ }
+diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
+index 137692cb8b4f..a862d9990be7 100644
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -429,7 +429,7 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,
+ q->quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));
+
+ if (tb[TCA_FQ_CODEL_DROP_BATCH_SIZE])
+- q->drop_batch_size = min(1U, nla_get_u32(tb[TCA_FQ_CODEL_DROP_BATCH_SIZE]));
++ q->drop_batch_size = max(1U, nla_get_u32(tb[TCA_FQ_CODEL_DROP_BATCH_SIZE]));
+
+ if (tb[TCA_FQ_CODEL_MEMORY_LIMIT])
+ q->memory_limit = min(1U << 31, nla_get_u32(tb[TCA_FQ_CODEL_MEMORY_LIMIT]));
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index d483d6ba59b7..b89cf0971d3d 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -641,6 +641,15 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
+ if (ctl->divisor &&
+ (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536))
+ return -EINVAL;
++
++ /* slot->allot is a short, make sure quantum is not too big. */
++ if (ctl->quantum) {
++ unsigned int scaled = SFQ_ALLOT_SIZE(ctl->quantum);
++
++ if (scaled <= 0 || scaled > SHRT_MAX)
++ return -EINVAL;
++ }
++
+ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
+ ctl_v1->Wlog))
+ return -EINVAL;
+diff --git a/net/sched/sch_skbprio.c b/net/sched/sch_skbprio.c
+index 52c0b6d8f1d7..3d9de52849bc 100644
+--- a/net/sched/sch_skbprio.c
++++ b/net/sched/sch_skbprio.c
+@@ -173,6 +173,9 @@ static int skbprio_change(struct Qdisc *sch, struct nlattr *opt,
+ {
+ struct tc_skbprio_qopt *ctl = nla_data(opt);
+
++ if (opt->nla_len != nla_attr_size(sizeof(*ctl)))
++ return -EINVAL;
++
+ sch->limit = ctl->limit;
+ return 0;
+ }
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 9f4d325f3a79..c437ae93b5a9 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -1880,7 +1880,7 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
+ */
+ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
+ return sctp_sf_do_9_2_start_shutdown(net, ep, asoc,
+- SCTP_ST_CHUNK(0), NULL,
++ SCTP_ST_CHUNK(0), repl,
+ commands);
+ } else {
+ sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
+@@ -5483,7 +5483,7 @@ enum sctp_disposition sctp_sf_do_9_2_start_shutdown(
+ * in the Cumulative TSN Ack field the last sequential TSN it
+ * has received from the peer.
+ */
+- reply = sctp_make_shutdown(asoc, NULL);
++ reply = sctp_make_shutdown(asoc, arg);
+ if (!reply)
+ goto nomem;
+
+@@ -6081,7 +6081,7 @@ enum sctp_disposition sctp_sf_autoclose_timer_expire(
+ disposition = SCTP_DISPOSITION_CONSUME;
+ if (sctp_outq_is_empty(&asoc->outqueue)) {
+ disposition = sctp_sf_do_9_2_start_shutdown(net, ep, asoc, type,
+- arg, commands);
++ NULL, commands);
+ }
+
+ return disposition;
+diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
+index 35558656fe02..41f4464ac6cc 100644
+--- a/net/tipc/topsrv.c
++++ b/net/tipc/topsrv.c
+@@ -409,10 +409,11 @@ static int tipc_conn_rcv_from_sock(struct tipc_conn *con)
+ read_lock_bh(&sk->sk_callback_lock);
+ ret = tipc_conn_rcv_sub(srv, con, &s);
+ read_unlock_bh(&sk->sk_callback_lock);
++ if (!ret)
++ return 0;
+ }
+- if (ret < 0)
+- tipc_conn_close(con);
+
++ tipc_conn_close(con);
+ return ret;
+ }
+
+diff --git a/scripts/decodecode b/scripts/decodecode
+index 9cef558528aa..eeaa435d1bd2 100755
+--- a/scripts/decodecode
++++ b/scripts/decodecode
+@@ -119,7 +119,7 @@ faultlinenum=$(( $(wc -l $T.oo | cut -d" " -f1) - \
+ faultline=`cat $T.dis | head -1 | cut -d":" -f2-`
+ faultline=`echo "$faultline" | sed -e 's/\[/\\\[/g; s/\]/\\\]/g'`
+
+-cat $T.oo | sed -e "${faultlinenum}s/^\(.*:\)\(.*\)/\1\*\2\t\t<-- trapping instruction/"
++cat $T.oo | sed -e "${faultlinenum}s/^\([^:]*:\)\(.*\)/\1\*\2\t\t<-- trapping instruction/"
+ echo
+ cat $T.aa
+ cleanup
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 4613d796492a..4d509734b695 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -1315,7 +1315,7 @@ static int update_insn_state_regs(struct instruction *insn, struct insn_state *s
+ struct cfi_reg *cfa = &state->cfa;
+ struct stack_op *op = &insn->stack_op;
+
+- if (cfa->base != CFI_SP)
++ if (cfa->base != CFI_SP && cfa->base != CFI_SP_INDIRECT)
+ return 0;
+
+ /* push */
+diff --git a/virt/kvm/arm/hyp/aarch32.c b/virt/kvm/arm/hyp/aarch32.c
+index d31f267961e7..25c0e47d57cb 100644
+--- a/virt/kvm/arm/hyp/aarch32.c
++++ b/virt/kvm/arm/hyp/aarch32.c
+@@ -125,12 +125,16 @@ static void __hyp_text kvm_adjust_itstate(struct kvm_vcpu *vcpu)
+ */
+ void __hyp_text kvm_skip_instr32(struct kvm_vcpu *vcpu, bool is_wide_instr)
+ {
++ u32 pc = *vcpu_pc(vcpu);
+ bool is_thumb;
+
+ is_thumb = !!(*vcpu_cpsr(vcpu) & PSR_AA32_T_BIT);
+ if (is_thumb && !is_wide_instr)
+- *vcpu_pc(vcpu) += 2;
++ pc += 2;
+ else
+- *vcpu_pc(vcpu) += 4;
++ pc += 4;
++
++ *vcpu_pc(vcpu) = pc;
++
+ kvm_adjust_itstate(vcpu);
+ }
+diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
+index 762f81900529..9d06a1f8e6c0 100644
+--- a/virt/kvm/arm/vgic/vgic-mmio.c
++++ b/virt/kvm/arm/vgic/vgic-mmio.c
+@@ -381,7 +381,7 @@ static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
+ static void vgic_change_active_prepare(struct kvm_vcpu *vcpu, u32 intid)
+ {
+ if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
+- intid > VGIC_NR_PRIVATE_IRQS)
++ intid >= VGIC_NR_PRIVATE_IRQS)
+ kvm_arm_halt_guest(vcpu->kvm);
+ }
+
+@@ -389,7 +389,7 @@ static void vgic_change_active_prepare(struct kvm_vcpu *vcpu, u32 intid)
+ static void vgic_change_active_finish(struct kvm_vcpu *vcpu, u32 intid)
+ {
+ if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
+- intid > VGIC_NR_PRIVATE_IRQS)
++ intid >= VGIC_NR_PRIVATE_IRQS)
+ kvm_arm_resume_guest(vcpu->kvm);
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-05-20 11:27 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-05-20 11:27 UTC (permalink / raw
To: gentoo-commits
commit: 221eb616a00bf5d759ee8d7c604ad57cb24e890a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 20 11:27:34 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 20 11:27:34 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=221eb616
Linux patch 4.19.124
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1123_linux-4.19.124.patch | 2125 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2129 insertions(+)
diff --git a/0000_README b/0000_README
index 18ae34a..4cf06a4 100644
--- a/0000_README
+++ b/0000_README
@@ -531,6 +531,10 @@ Patch: 1122_linux-4.19.123.patch
From: https://www.kernel.org
Desc: Linux 4.19.123
+Patch: 1123_linux-4.19.124.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.124
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1123_linux-4.19.124.patch b/1123_linux-4.19.124.patch
new file mode 100644
index 0000000..38dc1e7
--- /dev/null
+++ b/1123_linux-4.19.124.patch
@@ -0,0 +1,2125 @@
+diff --git a/Makefile b/Makefile
+index 68fa15edd662..292c92c8369d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 123
++SUBLEVEL = 124
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -657,20 +657,14 @@ KBUILD_CFLAGS += $(call cc-disable-warning, int-in-bool-context)
+ KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member)
+
+ ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+-KBUILD_CFLAGS += -Os $(call cc-disable-warning,maybe-uninitialized,)
+-else
+-ifdef CONFIG_PROFILE_ALL_BRANCHES
+-KBUILD_CFLAGS += -O2 $(call cc-disable-warning,maybe-uninitialized,)
++KBUILD_CFLAGS += -Os
+ else
+ KBUILD_CFLAGS += -O2
+ endif
+-endif
+-
+-KBUILD_CFLAGS += $(call cc-ifversion, -lt, 0409, \
+- $(call cc-disable-warning,maybe-uninitialized,))
+
+ # Tell gcc to never replace conditional load with a non-conditional one
+ KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0)
++KBUILD_CFLAGS += $(call cc-option,-fno-allow-store-data-races)
+
+ include scripts/Makefile.kcov
+ include scripts/Makefile.gcc-plugins
+@@ -799,6 +793,17 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
+ # disable stringop warnings in gcc 8+
+ KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation)
+
++# We'll want to enable this eventually, but it's not going away for 5.7 at least
++KBUILD_CFLAGS += $(call cc-disable-warning, zero-length-bounds)
++KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds)
++KBUILD_CFLAGS += $(call cc-disable-warning, stringop-overflow)
++
++# Another good warning that we'll want to enable eventually
++KBUILD_CFLAGS += $(call cc-disable-warning, restrict)
++
++# Enabled with W=2, disabled by default as noisy
++KBUILD_CFLAGS += $(call cc-disable-warning, maybe-uninitialized)
++
+ # disable invalid "can't wrap" optimizations for signed / pointers
+ KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow)
+
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index e97ef16ce68a..0c0781a37c5a 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -312,6 +312,7 @@
+ #address-cells = <1>;
+ ranges = <0x51000000 0x51000000 0x3000
+ 0x0 0x20000000 0x10000000>;
++ dma-ranges;
+ /**
+ * To enable PCI endpoint mode, disable the pcie1_rc
+ * node and enable pcie1_ep mode.
+@@ -325,7 +326,6 @@
+ device_type = "pci";
+ ranges = <0x81000000 0 0 0x03000 0 0x00010000
+ 0x82000000 0 0x20013000 0x13000 0 0xffed000>;
+- dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
+ bus-range = <0x00 0xff>;
+ #interrupt-cells = <1>;
+ num-lanes = <1>;
+@@ -368,6 +368,7 @@
+ #address-cells = <1>;
+ ranges = <0x51800000 0x51800000 0x3000
+ 0x0 0x30000000 0x10000000>;
++ dma-ranges;
+ status = "disabled";
+ pcie2_rc: pcie@51800000 {
+ reg = <0x51800000 0x2000>, <0x51802000 0x14c>, <0x1000 0x2000>;
+@@ -378,7 +379,6 @@
+ device_type = "pci";
+ ranges = <0x81000000 0 0 0x03000 0 0x00010000
+ 0x82000000 0 0x30013000 0x13000 0 0xffed000>;
+- dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
+ bus-range = <0x00 0xff>;
+ #interrupt-cells = <1>;
+ num-lanes = <1>;
+diff --git a/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts b/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts
+index bfd4946cf9fe..8b63b6593d3a 100644
+--- a/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts
++++ b/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts
+@@ -81,8 +81,8 @@
+ imx27-phycard-s-rdk {
+ pinctrl_i2c1: i2c1grp {
+ fsl,pins = <
+- MX27_PAD_I2C2_SDA__I2C2_SDA 0x0
+- MX27_PAD_I2C2_SCL__I2C2_SCL 0x0
++ MX27_PAD_I2C_DATA__I2C_DATA 0x0
++ MX27_PAD_I2C_CLK__I2C_CLK 0x0
+ >;
+ };
+
+diff --git a/arch/arm/boot/dts/r8a73a4.dtsi b/arch/arm/boot/dts/r8a73a4.dtsi
+index dd865f3c2eda..4447f45f0cba 100644
+--- a/arch/arm/boot/dts/r8a73a4.dtsi
++++ b/arch/arm/boot/dts/r8a73a4.dtsi
+@@ -131,7 +131,14 @@
+ cmt1: timer@e6130000 {
+ compatible = "renesas,r8a73a4-cmt1", "renesas,rcar-gen2-cmt1";
+ reg = <0 0xe6130000 0 0x1004>;
+- interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&mstp3_clks R8A73A4_CLK_CMT1>;
+ clock-names = "fck";
+ power-domains = <&pd_c5>;
+diff --git a/arch/arm/boot/dts/r8a7740.dtsi b/arch/arm/boot/dts/r8a7740.dtsi
+index 383cba68dbba..e12ea97eae27 100644
+--- a/arch/arm/boot/dts/r8a7740.dtsi
++++ b/arch/arm/boot/dts/r8a7740.dtsi
+@@ -479,7 +479,7 @@
+ cpg_clocks: cpg_clocks@e6150000 {
+ compatible = "renesas,r8a7740-cpg-clocks";
+ reg = <0xe6150000 0x10000>;
+- clocks = <&extal1_clk>, <&extalr_clk>;
++ clocks = <&extal1_clk>, <&extal2_clk>, <&extalr_clk>;
+ #clock-cells = <1>;
+ clock-output-names = "system", "pllc0", "pllc1",
+ "pllc2", "r",
+diff --git a/arch/arm64/boot/dts/renesas/r8a77980.dtsi b/arch/arm64/boot/dts/renesas/r8a77980.dtsi
+index b8c9a56562f2..da5453307d94 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77980.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77980.dtsi
+@@ -454,6 +454,7 @@
+ ipmmu_vip0: mmu@e7b00000 {
+ compatible = "renesas,ipmmu-r8a77980";
+ reg = <0 0xe7b00000 0 0x1000>;
++ renesas,ipmmu-main = <&ipmmu_mm 4>;
+ power-domains = <&sysc R8A77980_PD_ALWAYS_ON>;
+ #iommu-cells = <1>;
+ };
+@@ -461,6 +462,7 @@
+ ipmmu_vip1: mmu@e7960000 {
+ compatible = "renesas,ipmmu-r8a77980";
+ reg = <0 0xe7960000 0 0x1000>;
++ renesas,ipmmu-main = <&ipmmu_mm 11>;
+ power-domains = <&sysc R8A77980_PD_ALWAYS_ON>;
+ #iommu-cells = <1>;
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-evb.dts b/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
+index 8302d86d35c4..212dd8159da9 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
+@@ -92,7 +92,7 @@
+ &i2c1 {
+ status = "okay";
+
+- rk805: rk805@18 {
++ rk805: pmic@18 {
+ compatible = "rockchip,rk805";
+ reg = <0x18>;
+ interrupt-parent = <&gpio2>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+index e9147e35b739..03f2bc7d30d8 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+@@ -112,7 +112,7 @@
+ &i2c1 {
+ status = "okay";
+
+- rk805: rk805@18 {
++ rk805: pmic@18 {
+ compatible = "rockchip,rk805";
+ reg = <0x18>;
+ interrupt-parent = <&gpio2>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index cea44a7c7cf9..451f00a631c4 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -376,7 +376,7 @@
+ reset-names = "usb3-otg";
+ status = "disabled";
+
+- usbdrd_dwc3_0: dwc3 {
++ usbdrd_dwc3_0: usb@fe800000 {
+ compatible = "snps,dwc3";
+ reg = <0x0 0xfe800000 0x0 0x100000>;
+ interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH 0>;
+@@ -409,7 +409,7 @@
+ reset-names = "usb3-otg";
+ status = "disabled";
+
+- usbdrd_dwc3_1: dwc3 {
++ usbdrd_dwc3_1: usb@fe900000 {
+ compatible = "snps,dwc3";
+ reg = <0x0 0xfe900000 0x0 0x100000>;
+ interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH 0>;
+diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c
+index 922add8adb74..5e26ef007863 100644
+--- a/arch/arm64/kernel/machine_kexec.c
++++ b/arch/arm64/kernel/machine_kexec.c
+@@ -192,6 +192,7 @@ void machine_kexec(struct kimage *kimage)
+ * the offline CPUs. Therefore, we must use the __* variant here.
+ */
+ __flush_icache_range((uintptr_t)reboot_code_buffer,
++ (uintptr_t)reboot_code_buffer +
+ arm64_relocate_new_kernel_size);
+
+ /* Flush the kimage list and its buffers. */
+diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
+index 87f71a6cd3ef..1dd134fc0d84 100644
+--- a/arch/riscv/kernel/vdso/Makefile
++++ b/arch/riscv/kernel/vdso/Makefile
+@@ -30,15 +30,15 @@ $(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE
+ $(call if_changed,vdsold)
+
+ # We also create a special relocatable object that should mirror the symbol
+-# table and layout of the linked DSO. With ld -R we can then refer to
+-# these symbols in the kernel code rather than hand-coded addresses.
++# table and layout of the linked DSO. With ld --just-symbols we can then
++# refer to these symbols in the kernel code rather than hand-coded addresses.
+
+ SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \
+ $(call cc-ldoption, -Wl$(comma)--hash-style=both)
+ $(obj)/vdso-dummy.o: $(src)/vdso.lds $(obj)/rt_sigreturn.o FORCE
+ $(call if_changed,vdsold)
+
+-LDFLAGS_vdso-syms.o := -r -R
++LDFLAGS_vdso-syms.o := -r --just-symbols
+ $(obj)/vdso-syms.o: $(obj)/vdso-dummy.o FORCE
+ $(call if_changed,ld)
+
+diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
+index 8ec97a62c245..9c556ea2eaa7 100644
+--- a/arch/x86/include/asm/stackprotector.h
++++ b/arch/x86/include/asm/stackprotector.h
+@@ -55,8 +55,13 @@
+ /*
+ * Initialize the stackprotector canary value.
+ *
+- * NOTE: this must only be called from functions that never return,
++ * NOTE: this must only be called from functions that never return
+ * and it must always be inlined.
++ *
++ * In addition, it should be called from a compilation unit for which
++ * stack protector is disabled. Alternatively, the caller should not end
++ * with a function call which gets tail-call optimized as that would
++ * lead to checking a modified canary value.
+ */
+ static __always_inline void boot_init_stack_canary(void)
+ {
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 6489067b78a4..8783d065f927 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -269,6 +269,14 @@ static void notrace start_secondary(void *unused)
+
+ wmb();
+ cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
++
++ /*
++ * Prevent tail call to cpu_startup_entry() because the stack protector
++ * guard has been changed a couple of function calls up, in
++ * boot_init_stack_canary() and must not be checked before tail calling
++ * another function.
++ */
++ prevent_tail_call_optimization();
+ }
+
+ /**
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 169b96492b7c..b48e2686440b 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -589,23 +589,23 @@ EXPORT_SYMBOL_GPL(unwind_next_frame);
+ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ struct pt_regs *regs, unsigned long *first_frame)
+ {
+- if (!orc_init)
+- goto done;
+-
+ memset(state, 0, sizeof(*state));
+ state->task = task;
+
++ if (!orc_init)
++ goto err;
++
+ /*
+ * Refuse to unwind the stack of a task while it's executing on another
+ * CPU. This check is racy, but that's ok: the unwinder has other
+ * checks to prevent it from going off the rails.
+ */
+ if (task_on_another_cpu(task))
+- goto done;
++ goto err;
+
+ if (regs) {
+ if (user_mode(regs))
+- goto done;
++ goto the_end;
+
+ state->ip = regs->ip;
+ state->sp = kernel_stack_pointer(regs);
+@@ -638,6 +638,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ * generate some kind of backtrace if this happens.
+ */
+ void *next_page = (void *)PAGE_ALIGN((unsigned long)state->sp);
++ state->error = true;
+ if (get_stack_info(next_page, state->task, &state->stack_info,
+ &state->stack_mask))
+ return;
+@@ -663,8 +664,9 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+
+ return;
+
+-done:
++err:
++ state->error = true;
++the_end:
+ state->stack_info.type = STACK_TYPE_UNKNOWN;
+- return;
+ }
+ EXPORT_SYMBOL_GPL(__unwind_start);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 6bfc9eaf8dee..b0fd24ee08d2 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3423,7 +3423,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(struct kvm_vcpu *vcpu,
+ unsigned bank_num = mcg_cap & 0xff, bank;
+
+ r = -EINVAL;
+- if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS)
++ if (!bank_num || bank_num > KVM_MAX_MCE_BANKS)
+ goto out;
+ if (mcg_cap & ~(kvm_mce_cap_supported | 0xff | 0xff0000))
+ goto out;
+diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
+index e3b18ad49889..41fd4c123165 100644
+--- a/arch/x86/xen/smp_pv.c
++++ b/arch/x86/xen/smp_pv.c
+@@ -89,6 +89,7 @@ asmlinkage __visible void cpu_bringup_and_idle(void)
+ {
+ cpu_bringup();
+ cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
++ prevent_tail_call_optimization();
+ }
+
+ void xen_smp_intr_free_pv(unsigned int cpu)
+diff --git a/crypto/lrw.c b/crypto/lrw.c
+index 5504d1325a56..d55c9ee18817 100644
+--- a/crypto/lrw.c
++++ b/crypto/lrw.c
+@@ -453,7 +453,7 @@ static void exit_tfm(struct crypto_skcipher *tfm)
+ crypto_free_skcipher(ctx->child);
+ }
+
+-static void free(struct skcipher_instance *inst)
++static void free_inst(struct skcipher_instance *inst)
+ {
+ crypto_drop_skcipher(skcipher_instance_ctx(inst));
+ kfree(inst);
+@@ -565,7 +565,7 @@ static int create(struct crypto_template *tmpl, struct rtattr **tb)
+ inst->alg.encrypt = encrypt;
+ inst->alg.decrypt = decrypt;
+
+- inst->free = free;
++ inst->free = free_inst;
+
+ err = skcipher_register_instance(tmpl, inst);
+ if (err)
+diff --git a/crypto/xts.c b/crypto/xts.c
+index ccf55fbb8bc2..5542dd10aedf 100644
+--- a/crypto/xts.c
++++ b/crypto/xts.c
+@@ -393,7 +393,7 @@ static void exit_tfm(struct crypto_skcipher *tfm)
+ crypto_free_cipher(ctx->tweak);
+ }
+
+-static void free(struct skcipher_instance *inst)
++static void free_inst(struct skcipher_instance *inst)
+ {
+ crypto_drop_skcipher(skcipher_instance_ctx(inst));
+ kfree(inst);
+@@ -504,7 +504,7 @@ static int create(struct crypto_template *tmpl, struct rtattr **tb)
+ inst->alg.encrypt = encrypt;
+ inst->alg.decrypt = decrypt;
+
+- inst->free = free;
++ inst->free = free_inst;
+
+ err = skcipher_register_instance(tmpl, inst);
+ if (err)
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 9a3c2b14ac37..9be54e5ef96a 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -31,6 +31,15 @@ struct virtio_blk_vq {
+ } ____cacheline_aligned_in_smp;
+
+ struct virtio_blk {
++ /*
++ * This mutex must be held by anything that may run after
++ * virtblk_remove() sets vblk->vdev to NULL.
++ *
++ * blk-mq, virtqueue processing, and sysfs attribute code paths are
++ * shut down before vblk->vdev is set to NULL and therefore do not need
++ * to hold this mutex.
++ */
++ struct mutex vdev_mutex;
+ struct virtio_device *vdev;
+
+ /* The disk structure for the kernel. */
+@@ -42,6 +51,13 @@ struct virtio_blk {
+ /* Process context for config space updates */
+ struct work_struct config_work;
+
++ /*
++ * Tracks references from block_device_operations open/release and
++ * virtio_driver probe/remove so this object can be freed once no
++ * longer in use.
++ */
++ refcount_t refs;
++
+ /* What host tells us, plus 2 for header & tailer. */
+ unsigned int sg_elems;
+
+@@ -320,10 +336,55 @@ out:
+ return err;
+ }
+
++static void virtblk_get(struct virtio_blk *vblk)
++{
++ refcount_inc(&vblk->refs);
++}
++
++static void virtblk_put(struct virtio_blk *vblk)
++{
++ if (refcount_dec_and_test(&vblk->refs)) {
++ ida_simple_remove(&vd_index_ida, vblk->index);
++ mutex_destroy(&vblk->vdev_mutex);
++ kfree(vblk);
++ }
++}
++
++static int virtblk_open(struct block_device *bd, fmode_t mode)
++{
++ struct virtio_blk *vblk = bd->bd_disk->private_data;
++ int ret = 0;
++
++ mutex_lock(&vblk->vdev_mutex);
++
++ if (vblk->vdev)
++ virtblk_get(vblk);
++ else
++ ret = -ENXIO;
++
++ mutex_unlock(&vblk->vdev_mutex);
++ return ret;
++}
++
++static void virtblk_release(struct gendisk *disk, fmode_t mode)
++{
++ struct virtio_blk *vblk = disk->private_data;
++
++ virtblk_put(vblk);
++}
++
+ /* We provide getgeo only to please some old bootloader/partitioning tools */
+ static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo)
+ {
+ struct virtio_blk *vblk = bd->bd_disk->private_data;
++ int ret = 0;
++
++ mutex_lock(&vblk->vdev_mutex);
++
++ if (!vblk->vdev) {
++ ret = -ENXIO;
++ goto out;
++ }
+
+ /* see if the host passed in geometry config */
+ if (virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_GEOMETRY)) {
+@@ -339,12 +400,16 @@ static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo)
+ geo->sectors = 1 << 5;
+ geo->cylinders = get_capacity(bd->bd_disk) >> 11;
+ }
+- return 0;
++out:
++ mutex_unlock(&vblk->vdev_mutex);
++ return ret;
+ }
+
+ static const struct block_device_operations virtblk_fops = {
+ .ioctl = virtblk_ioctl,
+ .owner = THIS_MODULE,
++ .open = virtblk_open,
++ .release = virtblk_release,
+ .getgeo = virtblk_getgeo,
+ };
+
+@@ -672,6 +737,10 @@ static int virtblk_probe(struct virtio_device *vdev)
+ goto out_free_index;
+ }
+
++ /* This reference is dropped in virtblk_remove(). */
++ refcount_set(&vblk->refs, 1);
++ mutex_init(&vblk->vdev_mutex);
++
+ vblk->vdev = vdev;
+ vblk->sg_elems = sg_elems;
+
+@@ -824,8 +893,6 @@ out:
+ static void virtblk_remove(struct virtio_device *vdev)
+ {
+ struct virtio_blk *vblk = vdev->priv;
+- int index = vblk->index;
+- int refc;
+
+ /* Make sure no work handler is accessing the device. */
+ flush_work(&vblk->config_work);
+@@ -835,18 +902,21 @@ static void virtblk_remove(struct virtio_device *vdev)
+
+ blk_mq_free_tag_set(&vblk->tag_set);
+
++ mutex_lock(&vblk->vdev_mutex);
++
+ /* Stop all the virtqueues. */
+ vdev->config->reset(vdev);
+
+- refc = kref_read(&disk_to_dev(vblk->disk)->kobj.kref);
++ /* Virtqueues are stopped, nothing can use vblk->vdev anymore. */
++ vblk->vdev = NULL;
++
+ put_disk(vblk->disk);
+ vdev->config->del_vqs(vdev);
+ kfree(vblk->vqs);
+- kfree(vblk);
+
+- /* Only free device id if we don't have any users */
+- if (refc == 1)
+- ida_simple_remove(&vd_index_ida, index);
++ mutex_unlock(&vblk->vdev_mutex);
++
++ virtblk_put(vblk);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 71621a171f8a..a102eb1abe4b 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3105,6 +3105,9 @@ static int __clk_core_init(struct clk_core *core)
+ out:
+ clk_pm_runtime_put(core);
+ unlock:
++ if (ret)
++ hlist_del_init(&core->child_node);
++
+ clk_prepare_unlock();
+
+ if (!ret)
+diff --git a/drivers/clk/rockchip/clk-rk3228.c b/drivers/clk/rockchip/clk-rk3228.c
+index 7af48184b022..04f4f3739e3b 100644
+--- a/drivers/clk/rockchip/clk-rk3228.c
++++ b/drivers/clk/rockchip/clk-rk3228.c
+@@ -163,8 +163,6 @@ PNAME(mux_i2s_out_p) = { "i2s1_pre", "xin12m" };
+ PNAME(mux_i2s2_p) = { "i2s2_src", "i2s2_frac", "xin12m" };
+ PNAME(mux_sclk_spdif_p) = { "sclk_spdif_src", "spdif_frac", "xin12m" };
+
+-PNAME(mux_aclk_gpu_pre_p) = { "cpll_gpu", "gpll_gpu", "hdmiphy_gpu", "usb480m_gpu" };
+-
+ PNAME(mux_uart0_p) = { "uart0_src", "uart0_frac", "xin24m" };
+ PNAME(mux_uart1_p) = { "uart1_src", "uart1_frac", "xin24m" };
+ PNAME(mux_uart2_p) = { "uart2_src", "uart2_frac", "xin24m" };
+@@ -475,16 +473,9 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = {
+ RK2928_CLKSEL_CON(24), 6, 10, DFLAGS,
+ RK2928_CLKGATE_CON(2), 8, GFLAGS),
+
+- GATE(0, "cpll_gpu", "cpll", 0,
+- RK2928_CLKGATE_CON(3), 13, GFLAGS),
+- GATE(0, "gpll_gpu", "gpll", 0,
+- RK2928_CLKGATE_CON(3), 13, GFLAGS),
+- GATE(0, "hdmiphy_gpu", "hdmiphy", 0,
+- RK2928_CLKGATE_CON(3), 13, GFLAGS),
+- GATE(0, "usb480m_gpu", "usb480m", 0,
++ COMPOSITE(0, "aclk_gpu_pre", mux_pll_src_4plls_p, 0,
++ RK2928_CLKSEL_CON(34), 5, 2, MFLAGS, 0, 5, DFLAGS,
+ RK2928_CLKGATE_CON(3), 13, GFLAGS),
+- COMPOSITE_NOGATE(0, "aclk_gpu_pre", mux_aclk_gpu_pre_p, 0,
+- RK2928_CLKSEL_CON(34), 5, 2, MFLAGS, 0, 5, DFLAGS),
+
+ COMPOSITE(SCLK_SPI0, "sclk_spi0", mux_pll_src_2plls_p, 0,
+ RK2928_CLKSEL_CON(25), 8, 1, MFLAGS, 0, 7, DFLAGS,
+@@ -589,8 +580,8 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = {
+ GATE(0, "pclk_peri_noc", "pclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(12), 2, GFLAGS),
+
+ /* PD_GPU */
+- GATE(ACLK_GPU, "aclk_gpu", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(13), 14, GFLAGS),
+- GATE(0, "aclk_gpu_noc", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(13), 15, GFLAGS),
++ GATE(ACLK_GPU, "aclk_gpu", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(7), 14, GFLAGS),
++ GATE(0, "aclk_gpu_noc", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(7), 15, GFLAGS),
+
+ /* PD_BUS */
+ GATE(0, "sclk_initmem_mbist", "aclk_cpu", 0, RK2928_CLKGATE_CON(8), 1, GFLAGS),
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 29f25d5d65e0..e7b3d4ed8eff 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -957,7 +957,7 @@ static ssize_t store_no_turbo(struct kobject *a, struct kobj_attribute *b,
+
+ update_turbo_state();
+ if (global.turbo_disabled) {
+- pr_warn("Turbo disabled by BIOS or unavailable on processor\n");
++ pr_notice_once("Turbo disabled by BIOS or unavailable on processor\n");
+ mutex_unlock(&intel_pstate_limits_lock);
+ mutex_unlock(&intel_pstate_driver_lock);
+ return -EPERM;
+diff --git a/drivers/dma/mmp_tdma.c b/drivers/dma/mmp_tdma.c
+index 13c68b6434ce..15b4a44e6006 100644
+--- a/drivers/dma/mmp_tdma.c
++++ b/drivers/dma/mmp_tdma.c
+@@ -362,6 +362,8 @@ static void mmp_tdma_free_descriptor(struct mmp_tdma_chan *tdmac)
+ gen_pool_free(gpool, (unsigned long)tdmac->desc_arr,
+ size);
+ tdmac->desc_arr = NULL;
++ if (tdmac->status == DMA_ERROR)
++ tdmac->status = DMA_COMPLETE;
+
+ return;
+ }
+diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
+index afd8f27bda96..6e91584c3677 100644
+--- a/drivers/dma/pch_dma.c
++++ b/drivers/dma/pch_dma.c
+@@ -873,6 +873,7 @@ static int pch_dma_probe(struct pci_dev *pdev,
+ }
+
+ pci_set_master(pdev);
++ pd->dma.dev = &pdev->dev;
+
+ err = request_irq(pdev->irq, pd_irq, IRQF_SHARED, DRV_NAME, pd);
+ if (err) {
+@@ -888,7 +889,6 @@ static int pch_dma_probe(struct pci_dev *pdev,
+ goto err_free_irq;
+ }
+
+- pd->dma.dev = &pdev->dev;
+
+ INIT_LIST_HEAD(&pd->dma.channels);
+
+diff --git a/drivers/gpu/drm/qxl/qxl_image.c b/drivers/gpu/drm/qxl/qxl_image.c
+index 7fbcc35e8ad3..c89c10055641 100644
+--- a/drivers/gpu/drm/qxl/qxl_image.c
++++ b/drivers/gpu/drm/qxl/qxl_image.c
+@@ -210,7 +210,8 @@ qxl_image_init_helper(struct qxl_device *qdev,
+ break;
+ default:
+ DRM_ERROR("unsupported image bit depth\n");
+- return -EINVAL; /* TODO: cleanup */
++ qxl_bo_kunmap_atomic_page(qdev, image_bo, ptr);
++ return -EINVAL;
+ }
+ image->u.bitmap.flags = QXL_BITMAP_TOP_DOWN;
+ image->u.bitmap.x = width;
+diff --git a/drivers/hwmon/da9052-hwmon.c b/drivers/hwmon/da9052-hwmon.c
+index a973eb6a2890..9e44d2385e6f 100644
+--- a/drivers/hwmon/da9052-hwmon.c
++++ b/drivers/hwmon/da9052-hwmon.c
+@@ -250,9 +250,9 @@ static ssize_t da9052_read_tsi(struct device *dev,
+ int channel = to_sensor_dev_attr(devattr)->index;
+ int ret;
+
+- mutex_lock(&hwmon->hwmon_lock);
++ mutex_lock(&hwmon->da9052->auxadc_lock);
+ ret = __da9052_read_tsi(dev, channel);
+- mutex_unlock(&hwmon->hwmon_lock);
++ mutex_unlock(&hwmon->da9052->auxadc_lock);
+
+ if (ret < 0)
+ return ret;
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c
+index 55a1fbf0e670..ae8b97c30665 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c
+@@ -534,7 +534,7 @@ void i40iw_manage_arp_cache(struct i40iw_device *iwdev,
+ int arp_index;
+
+ arp_index = i40iw_arp_table(iwdev, ip_addr, ipv4, mac_addr, action);
+- if (arp_index == -1)
++ if (arp_index < 0)
+ return;
+ cqp_request = i40iw_get_cqp_request(&iwdev->cqp, false);
+ if (!cqp_request)
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index 6dd3cd2c2f80..73bd35d34a25 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -2807,6 +2807,7 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp,
+ int send_size;
+ int header_size;
+ int spc;
++ int err;
+ int i;
+
+ if (wr->wr.opcode != IB_WR_SEND)
+@@ -2841,7 +2842,9 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp,
+
+ sqp->ud_header.lrh.virtual_lane = 0;
+ sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED);
+- ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey);
++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey);
++ if (err)
++ return err;
+ sqp->ud_header.bth.pkey = cpu_to_be16(pkey);
+ if (sqp->qp.mlx4_ib_qp_type == MLX4_IB_QPT_TUN_SMI_OWNER)
+ sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn);
+@@ -3128,9 +3131,14 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, const struct ib_ud_wr *wr,
+ }
+ sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED);
+ if (!sqp->qp.ibqp.qp_num)
+- ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, &pkey);
++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index,
++ &pkey);
+ else
+- ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, &pkey);
++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index,
++ &pkey);
++ if (err)
++ return err;
++
+ sqp->ud_header.bth.pkey = cpu_to_be16(pkey);
+ sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn);
+ sqp->ud_header.bth.psn = cpu_to_be32((sqp->send_psn++) & ((1 << 24) - 1));
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 60eac66dc9f0..23bcdbba0cab 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1424,6 +1424,7 @@ static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req)
+ struct mmc_request *mrq = &mqrq->brq.mrq;
+ struct request_queue *q = req->q;
+ struct mmc_host *host = mq->card->host;
++ enum mmc_issue_type issue_type = mmc_issue_type(mq, req);
+ unsigned long flags;
+ bool put_card;
+ int err;
+@@ -1453,7 +1454,7 @@ static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req)
+
+ spin_lock_irqsave(q->queue_lock, flags);
+
+- mq->in_flight[mmc_issue_type(mq, req)] -= 1;
++ mq->in_flight[issue_type] -= 1;
+
+ put_card = (mmc_tot_in_flight(mq) == 0);
+
+diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
+index becc6594a8a4..03f3d9c80fba 100644
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -111,8 +111,7 @@ static enum blk_eh_timer_return mmc_cqe_timed_out(struct request *req)
+ __mmc_cqe_recovery_notifier(mq);
+ return BLK_EH_RESET_TIMER;
+ }
+- /* No timeout (XXX: huh? comment doesn't make much sense) */
+- blk_mq_complete_request(req);
++ /* The request has gone already */
+ return BLK_EH_DONE;
+ default:
+ /* Timeout is handled by mmc core */
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index 57c1ec322e42..145143b6a0e6 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -552,10 +552,12 @@ static int sdhci_acpi_emmc_amd_probe_slot(struct platform_device *pdev,
+ }
+
+ static const struct sdhci_acpi_slot sdhci_acpi_slot_amd_emmc = {
+- .chip = &sdhci_acpi_chip_amd,
+- .caps = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE,
+- .quirks = SDHCI_QUIRK_32BIT_DMA_ADDR | SDHCI_QUIRK_32BIT_DMA_SIZE |
+- SDHCI_QUIRK_32BIT_ADMA_SIZE,
++ .chip = &sdhci_acpi_chip_amd,
++ .caps = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE,
++ .quirks = SDHCI_QUIRK_32BIT_DMA_ADDR |
++ SDHCI_QUIRK_32BIT_DMA_SIZE |
++ SDHCI_QUIRK_32BIT_ADMA_SIZE,
++ .quirks2 = SDHCI_QUIRK2_BROKEN_64_BIT_DMA,
+ .probe_slot = sdhci_acpi_emmc_amd_probe_slot,
+ };
+
+diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
+index 816f34d64736..990de7c54b46 100644
+--- a/drivers/net/dsa/dsa_loop.c
++++ b/drivers/net/dsa/dsa_loop.c
+@@ -360,6 +360,7 @@ static void __exit dsa_loop_exit(void)
+ }
+ module_exit(dsa_loop_exit);
+
++MODULE_SOFTDEP("pre: dsa_loop_bdinfo");
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Florian Fainelli");
+ MODULE_DESCRIPTION("DSA loopback driver");
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c b/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c
+index 9fcf2e5e0003..0e40d647093c 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c
+@@ -54,6 +54,8 @@
+
+ #define MGMT_MSG_TIMEOUT 5000
+
++#define SET_FUNC_PORT_MGMT_TIMEOUT 25000
++
+ #define mgmt_to_pfhwdev(pf_mgmt) \
+ container_of(pf_mgmt, struct hinic_pfhwdev, pf_to_mgmt)
+
+@@ -247,12 +249,13 @@ static int msg_to_mgmt_sync(struct hinic_pf_to_mgmt *pf_to_mgmt,
+ u8 *buf_in, u16 in_size,
+ u8 *buf_out, u16 *out_size,
+ enum mgmt_direction_type direction,
+- u16 resp_msg_id)
++ u16 resp_msg_id, u32 timeout)
+ {
+ struct hinic_hwif *hwif = pf_to_mgmt->hwif;
+ struct pci_dev *pdev = hwif->pdev;
+ struct hinic_recv_msg *recv_msg;
+ struct completion *recv_done;
++ unsigned long timeo;
+ u16 msg_id;
+ int err;
+
+@@ -276,8 +279,9 @@ static int msg_to_mgmt_sync(struct hinic_pf_to_mgmt *pf_to_mgmt,
+ goto unlock_sync_msg;
+ }
+
+- if (!wait_for_completion_timeout(recv_done,
+- msecs_to_jiffies(MGMT_MSG_TIMEOUT))) {
++ timeo = msecs_to_jiffies(timeout ? timeout : MGMT_MSG_TIMEOUT);
++
++ if (!wait_for_completion_timeout(recv_done, timeo)) {
+ dev_err(&pdev->dev, "MGMT timeout, MSG id = %d\n", msg_id);
+ err = -ETIMEDOUT;
+ goto unlock_sync_msg;
+@@ -351,6 +355,7 @@ int hinic_msg_to_mgmt(struct hinic_pf_to_mgmt *pf_to_mgmt,
+ {
+ struct hinic_hwif *hwif = pf_to_mgmt->hwif;
+ struct pci_dev *pdev = hwif->pdev;
++ u32 timeout = 0;
+
+ if (sync != HINIC_MGMT_MSG_SYNC) {
+ dev_err(&pdev->dev, "Invalid MGMT msg type\n");
+@@ -362,9 +367,12 @@ int hinic_msg_to_mgmt(struct hinic_pf_to_mgmt *pf_to_mgmt,
+ return -EINVAL;
+ }
+
++ if (cmd == HINIC_PORT_CMD_SET_FUNC_STATE)
++ timeout = SET_FUNC_PORT_MGMT_TIMEOUT;
++
+ return msg_to_mgmt_sync(pf_to_mgmt, mod, cmd, buf_in, in_size,
+ buf_out, out_size, MGMT_DIRECT_SEND,
+- MSG_NOT_RESP);
++ MSG_NOT_RESP, timeout);
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+index 2352046971a4..23de5fa3d885 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+@@ -475,7 +475,6 @@ static int hinic_close(struct net_device *netdev)
+ {
+ struct hinic_dev *nic_dev = netdev_priv(netdev);
+ unsigned int flags;
+- int err;
+
+ down(&nic_dev->mgmt_lock);
+
+@@ -489,20 +488,9 @@ static int hinic_close(struct net_device *netdev)
+
+ up(&nic_dev->mgmt_lock);
+
+- err = hinic_port_set_func_state(nic_dev, HINIC_FUNC_PORT_DISABLE);
+- if (err) {
+- netif_err(nic_dev, drv, netdev,
+- "Failed to set func port state\n");
+- nic_dev->flags |= (flags & HINIC_INTF_UP);
+- return err;
+- }
++ hinic_port_set_state(nic_dev, HINIC_PORT_DISABLE);
+
+- err = hinic_port_set_state(nic_dev, HINIC_PORT_DISABLE);
+- if (err) {
+- netif_err(nic_dev, drv, netdev, "Failed to set port state\n");
+- nic_dev->flags |= (flags & HINIC_INTF_UP);
+- return err;
+- }
++ hinic_port_set_func_state(nic_dev, HINIC_FUNC_PORT_DISABLE);
+
+ free_rxqs(nic_dev);
+ free_txqs(nic_dev);
+diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
+index b34055ac476f..4db3431b79ac 100644
+--- a/drivers/net/ethernet/moxa/moxart_ether.c
++++ b/drivers/net/ethernet/moxa/moxart_ether.c
+@@ -561,7 +561,7 @@ static int moxart_remove(struct platform_device *pdev)
+ struct net_device *ndev = platform_get_drvdata(pdev);
+
+ unregister_netdev(ndev);
+- free_irq(ndev->irq, ndev);
++ devm_free_irq(&pdev->dev, ndev->irq, ndev);
+ moxart_mac_free_memory(ndev);
+ free_netdev(ndev);
+
+diff --git a/drivers/net/ethernet/natsemi/jazzsonic.c b/drivers/net/ethernet/natsemi/jazzsonic.c
+index 51fa82b429a3..40970352d208 100644
+--- a/drivers/net/ethernet/natsemi/jazzsonic.c
++++ b/drivers/net/ethernet/natsemi/jazzsonic.c
+@@ -235,11 +235,13 @@ static int jazz_sonic_probe(struct platform_device *pdev)
+
+ err = register_netdev(dev);
+ if (err)
+- goto out1;
++ goto undo_probe1;
+
+ return 0;
+
+-out1:
++undo_probe1:
++ dma_free_coherent(lp->device, SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
++ lp->descriptors, lp->descriptors_laddr);
+ release_mem_region(dev->base_addr, SONIC_MEM_SIZE);
+ out:
+ free_netdev(dev);
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index 1ee25877c4d1..cc454b8c032c 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -1302,9 +1302,11 @@ int phy_ethtool_set_eee(struct phy_device *phydev, struct ethtool_eee *data)
+ /* Restart autonegotiation so the new modes get sent to the
+ * link partner.
+ */
+- ret = phy_restart_aneg(phydev);
+- if (ret < 0)
+- return ret;
++ if (phydev->autoneg == AUTONEG_ENABLE) {
++ ret = phy_restart_aneg(phydev);
++ if (ret < 0)
++ return ret;
++ }
+ }
+
+ return 0;
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index c04f3dc17d76..b8342162f3a0 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -497,6 +497,9 @@ static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev,
+ if (!skb)
+ goto out;
+
++ if (skb->pkt_type != PACKET_HOST)
++ goto abort;
++
+ if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
+ goto abort;
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index c88ee376a2eb..b21223be93c8 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1242,9 +1242,11 @@ static bool try_fill_recv(struct virtnet_info *vi, struct receive_queue *rq,
+ break;
+ } while (rq->vq->num_free);
+ if (virtqueue_kick_prepare(rq->vq) && virtqueue_notify(rq->vq)) {
+- u64_stats_update_begin(&rq->stats.syncp);
++ unsigned long flags;
++
++ flags = u64_stats_update_begin_irqsave(&rq->stats.syncp);
+ rq->stats.kicks++;
+- u64_stats_update_end(&rq->stats.syncp);
++ u64_stats_update_end_irqrestore(&rq->stats.syncp, flags);
+ }
+
+ return !oom;
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index a760d8bda0af..acb02a7aa949 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -1495,6 +1495,7 @@ static const struct gpio_chip byt_gpio_chip = {
+ .direction_output = byt_gpio_direction_output,
+ .get = byt_gpio_get,
+ .set = byt_gpio_set,
++ .set_config = gpiochip_generic_config,
+ .dbg_show = byt_gpio_dbg_show,
+ };
+
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index f16baf9b8696..25932d2a7154 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1485,11 +1485,15 @@ static void chv_gpio_irq_handler(struct irq_desc *desc)
+ struct chv_pinctrl *pctrl = gpiochip_get_data(gc);
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+ unsigned long pending;
++ unsigned long flags;
+ u32 intr_line;
+
+ chained_irq_enter(chip, desc);
+
++ raw_spin_lock_irqsave(&chv_lock, flags);
+ pending = readl(pctrl->regs + CHV_INTSTAT);
++ raw_spin_unlock_irqrestore(&chv_lock, flags);
++
+ for_each_set_bit(intr_line, &pending, pctrl->community->nirqs) {
+ unsigned irq, offset;
+
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index ac8535d2b41a..6bb45ae19d58 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -694,8 +694,10 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
+ hp->flags = input_size; /* structure abuse ... */
+ hp->pack_id = old_hdr.pack_id;
+ hp->usr_ptr = NULL;
+- if (__copy_from_user(cmnd, buf, cmd_size))
++ if (__copy_from_user(cmnd, buf, cmd_size)) {
++ sg_remove_request(sfp, srp);
+ return -EFAULT;
++ }
+ /*
+ * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV,
+ * but is is possible that the app intended SG_DXFER_TO_DEV, because there
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index fffe544d9e9f..fa28f23a4a33 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -37,6 +37,7 @@
+
+ #define USB_VENDOR_GENESYS_LOGIC 0x05e3
+ #define USB_VENDOR_SMSC 0x0424
++#define USB_PRODUCT_USB5534B 0x5534
+ #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01
+ #define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02
+
+@@ -5434,8 +5435,11 @@ out_hdev_lock:
+ }
+
+ static const struct usb_device_id hub_id_table[] = {
+- { .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_CLASS,
++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++ | USB_DEVICE_ID_MATCH_PRODUCT
++ | USB_DEVICE_ID_MATCH_INT_CLASS,
+ .idVendor = USB_VENDOR_SMSC,
++ .idProduct = USB_PRODUCT_USB5534B,
+ .bInterfaceClass = USB_CLASS_HUB,
+ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
+ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 99f6a5aa0109..8e66954dfcd4 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2279,9 +2279,6 @@ static int dwc3_gadget_ep_reclaim_trb_sg(struct dwc3_ep *dep,
+ for_each_sg(sg, s, pending, i) {
+ trb = &dep->trb_pool[dep->trb_dequeue];
+
+- if (trb->ctrl & DWC3_TRB_CTRL_HWO)
+- break;
+-
+ req->sg = sg_next(s);
+ req->num_pending_sgs--;
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index ab9ac48a751a..a7709d126b29 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -260,6 +260,9 @@ static ssize_t gadget_dev_desc_UDC_store(struct config_item *item,
+ char *name;
+ int ret;
+
++ if (strlen(page) < len)
++ return -EOVERFLOW;
++
+ name = kstrdup(page, GFP_KERNEL);
+ if (!name)
+ return -ENOMEM;
+diff --git a/drivers/usb/gadget/legacy/audio.c b/drivers/usb/gadget/legacy/audio.c
+index dd81fd538cb8..a748ed0842e8 100644
+--- a/drivers/usb/gadget/legacy/audio.c
++++ b/drivers/usb/gadget/legacy/audio.c
+@@ -300,8 +300,10 @@ static int audio_bind(struct usb_composite_dev *cdev)
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(cdev->gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto fail;
++ }
+ usb_otg_descriptor_init(cdev->gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
+diff --git a/drivers/usb/gadget/legacy/cdc2.c b/drivers/usb/gadget/legacy/cdc2.c
+index 8d7a556ece30..563363aba48f 100644
+--- a/drivers/usb/gadget/legacy/cdc2.c
++++ b/drivers/usb/gadget/legacy/cdc2.c
+@@ -179,8 +179,10 @@ static int cdc_bind(struct usb_composite_dev *cdev)
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto fail1;
++ }
+ usb_otg_descriptor_init(gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
+diff --git a/drivers/usb/gadget/legacy/ncm.c b/drivers/usb/gadget/legacy/ncm.c
+index c61e71ba7045..0f1b45e3abd1 100644
+--- a/drivers/usb/gadget/legacy/ncm.c
++++ b/drivers/usb/gadget/legacy/ncm.c
+@@ -156,8 +156,10 @@ static int gncm_bind(struct usb_composite_dev *cdev)
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto fail;
++ }
+ usb_otg_descriptor_init(gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
+diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c
+index c2011cd7df8c..077fa9304618 100644
+--- a/drivers/usb/gadget/udc/net2272.c
++++ b/drivers/usb/gadget/udc/net2272.c
+@@ -2653,6 +2653,8 @@ net2272_plat_probe(struct platform_device *pdev)
+ err_req:
+ release_mem_region(base, len);
+ err:
++ kfree(dev);
++
+ return ret;
+ }
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 9602241e4371..adc437ca83b8 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -361,6 +361,7 @@ static int xhci_plat_remove(struct platform_device *dev)
+ struct clk *reg_clk = xhci->reg_clk;
+ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
++ pm_runtime_get_sync(&dev->dev);
+ xhci->xhc_state |= XHCI_STATE_REMOVING;
+
+ usb_remove_hcd(shared_hcd);
+@@ -374,8 +375,9 @@ static int xhci_plat_remove(struct platform_device *dev)
+ clk_disable_unprepare(reg_clk);
+ usb_put_hcd(hcd);
+
+- pm_runtime_set_suspended(&dev->dev);
+ pm_runtime_disable(&dev->dev);
++ pm_runtime_put_noidle(&dev->dev);
++ pm_runtime_set_suspended(&dev->dev);
+
+ return 0;
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 509a7fce8f05..2a19d9a37a6a 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3331,8 +3331,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ /* New sg entry */
+ --num_sgs;
+ sent_len -= block_len;
+- if (num_sgs != 0) {
+- sg = sg_next(sg);
++ sg = sg_next(sg);
++ if (num_sgs != 0 && sg) {
+ block_len = sg_dma_len(sg);
+ addr = (u64) sg_dma_address(sg);
+ addr += sent_len;
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 8b9471904f67..cb70f0c6aa1b 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -2051,8 +2051,8 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
+ }
+ }
+
++ kref_put(&wdata2->refcount, cifs_writedata_release);
+ if (rc) {
+- kref_put(&wdata2->refcount, cifs_writedata_release);
+ if (is_retryable_error(rc))
+ continue;
+ i += nr_pages;
+diff --git a/fs/exec.c b/fs/exec.c
+index 3818813d725d..cece8c14f377 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1269,6 +1269,8 @@ int flush_old_exec(struct linux_binprm * bprm)
+ */
+ set_mm_exe_file(bprm->mm, bprm->file);
+
++ would_dump(bprm, bprm->file);
++
+ /*
+ * Release all of the old mmap stuff
+ */
+@@ -1814,8 +1816,6 @@ static int __do_execve_file(int fd, struct filename *filename,
+ if (retval < 0)
+ goto out;
+
+- would_dump(bprm, bprm->file);
+-
+ retval = exec_binprm(bprm);
+ if (retval < 0)
+ goto out;
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 096b47972139..43f53020553b 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -530,10 +530,12 @@ lower_metapath:
+
+ /* Advance in metadata tree. */
+ (mp->mp_list[hgt])++;
+- if (mp->mp_list[hgt] >= sdp->sd_inptrs) {
+- if (!hgt)
++ if (hgt) {
++ if (mp->mp_list[hgt] >= sdp->sd_inptrs)
++ goto lower_metapath;
++ } else {
++ if (mp->mp_list[hgt] >= sdp->sd_diptrs)
+ break;
+- goto lower_metapath;
+ }
+
+ fill_up_metapath:
+@@ -879,10 +881,9 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length,
+ ret = -ENOENT;
+ goto unlock;
+ } else {
+- /* report a hole */
+ iomap->offset = pos;
+ iomap->length = length;
+- goto do_alloc;
++ goto hole_found;
+ }
+ }
+ iomap->length = size;
+@@ -936,8 +937,6 @@ unlock:
+ return ret;
+
+ do_alloc:
+- iomap->addr = IOMAP_NULL_ADDR;
+- iomap->type = IOMAP_HOLE;
+ if (flags & IOMAP_REPORT) {
+ if (pos >= size)
+ ret = -ENOENT;
+@@ -959,6 +958,9 @@ do_alloc:
+ if (pos < size && height == ip->i_height)
+ ret = gfs2_hole_size(inode, lblock, len, mp, iomap);
+ }
++hole_found:
++ iomap->addr = IOMAP_NULL_ADDR;
++ iomap->type = IOMAP_HOLE;
+ goto out;
+ }
+
+diff --git a/fs/nfs/fscache-index.c b/fs/nfs/fscache-index.c
+index 666415d13d52..b7ca0b85b1fe 100644
+--- a/fs/nfs/fscache-index.c
++++ b/fs/nfs/fscache-index.c
+@@ -88,8 +88,10 @@ enum fscache_checkaux nfs_fscache_inode_check_aux(void *cookie_netfs_data,
+ return FSCACHE_CHECKAUX_OBSOLETE;
+
+ memset(&auxdata, 0, sizeof(auxdata));
+- auxdata.mtime = timespec64_to_timespec(nfsi->vfs_inode.i_mtime);
+- auxdata.ctime = timespec64_to_timespec(nfsi->vfs_inode.i_ctime);
++ auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec;
++ auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec;
++ auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec;
++ auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec;
+
+ if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4)
+ auxdata.change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode);
+diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
+index 6f45b1a95739..7dfa45a38088 100644
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -192,7 +192,8 @@ void nfs_fscache_get_super_cookie(struct super_block *sb, const char *uniq, int
+ /* create a cache index for looking up filehandles */
+ nfss->fscache = fscache_acquire_cookie(nfss->nfs_client->fscache,
+ &nfs_fscache_super_index_def,
+- key, sizeof(*key) + ulen,
++ &key->key,
++ sizeof(key->key) + ulen,
+ NULL, 0,
+ nfss, 0, true);
+ dfprintk(FSCACHE, "NFS: get superblock cookie (0x%p/0x%p)\n",
+@@ -230,6 +231,19 @@ void nfs_fscache_release_super_cookie(struct super_block *sb)
+ }
+ }
+
++static void nfs_fscache_update_auxdata(struct nfs_fscache_inode_auxdata *auxdata,
++ struct nfs_inode *nfsi)
++{
++ memset(auxdata, 0, sizeof(*auxdata));
++ auxdata->mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec;
++ auxdata->mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec;
++ auxdata->ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec;
++ auxdata->ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec;
++
++ if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4)
++ auxdata->change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode);
++}
++
+ /*
+ * Initialise the per-inode cache cookie pointer for an NFS inode.
+ */
+@@ -243,12 +257,7 @@ void nfs_fscache_init_inode(struct inode *inode)
+ if (!(nfss->fscache && S_ISREG(inode->i_mode)))
+ return;
+
+- memset(&auxdata, 0, sizeof(auxdata));
+- auxdata.mtime = timespec64_to_timespec(nfsi->vfs_inode.i_mtime);
+- auxdata.ctime = timespec64_to_timespec(nfsi->vfs_inode.i_ctime);
+-
+- if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4)
+- auxdata.change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode);
++ nfs_fscache_update_auxdata(&auxdata, nfsi);
+
+ nfsi->fscache = fscache_acquire_cookie(NFS_SB(inode->i_sb)->fscache,
+ &nfs_fscache_inode_object_def,
+@@ -268,9 +277,7 @@ void nfs_fscache_clear_inode(struct inode *inode)
+
+ dfprintk(FSCACHE, "NFS: clear cookie (0x%p/0x%p)\n", nfsi, cookie);
+
+- memset(&auxdata, 0, sizeof(auxdata));
+- auxdata.mtime = timespec64_to_timespec(nfsi->vfs_inode.i_mtime);
+- auxdata.ctime = timespec64_to_timespec(nfsi->vfs_inode.i_ctime);
++ nfs_fscache_update_auxdata(&auxdata, nfsi);
+ fscache_relinquish_cookie(cookie, &auxdata, false);
+ nfsi->fscache = NULL;
+ }
+@@ -310,9 +317,7 @@ void nfs_fscache_open_file(struct inode *inode, struct file *filp)
+ if (!fscache_cookie_valid(cookie))
+ return;
+
+- memset(&auxdata, 0, sizeof(auxdata));
+- auxdata.mtime = timespec64_to_timespec(nfsi->vfs_inode.i_mtime);
+- auxdata.ctime = timespec64_to_timespec(nfsi->vfs_inode.i_ctime);
++ nfs_fscache_update_auxdata(&auxdata, nfsi);
+
+ if (inode_is_open_for_write(inode)) {
+ dfprintk(FSCACHE, "NFS: nfsi 0x%p disabling cache\n", nfsi);
+diff --git a/fs/nfs/fscache.h b/fs/nfs/fscache.h
+index 6363ea956858..89d2f956668f 100644
+--- a/fs/nfs/fscache.h
++++ b/fs/nfs/fscache.h
+@@ -66,9 +66,11 @@ struct nfs_fscache_key {
+ * cache object.
+ */
+ struct nfs_fscache_inode_auxdata {
+- struct timespec mtime;
+- struct timespec ctime;
+- u64 change_attr;
++ s64 mtime_sec;
++ s64 mtime_nsec;
++ s64 ctime_sec;
++ s64 ctime_nsec;
++ u64 change_attr;
+ };
+
+ /*
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 75112aa8064e..fbb6490c1e09 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -351,4 +351,10 @@ static inline void *offset_to_ptr(const int *off)
+ compiletime_assert(__native_word(t), \
+ "Need native word sized stores/loads for atomicity.")
+
++/*
++ * This is needed in functions which generate the stack canary, see
++ * arch/x86/kernel/smpboot.c::start_secondary() for an example.
++ */
++#define prevent_tail_call_optimization() mb()
++
+ #endif /* __LINUX_COMPILER_H */
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 15b8e02880c3..8d568b51778b 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -934,7 +934,7 @@ struct file_handle {
+ __u32 handle_bytes;
+ int handle_type;
+ /* file identifier */
+- unsigned char f_handle[0];
++ unsigned char f_handle[];
+ };
+
+ static inline struct file *get_file(struct file *f)
+diff --git a/include/linux/pnp.h b/include/linux/pnp.h
+index 3b12fd28af78..fc4df3ccefc9 100644
+--- a/include/linux/pnp.h
++++ b/include/linux/pnp.h
+@@ -220,10 +220,8 @@ struct pnp_card {
+ #define global_to_pnp_card(n) list_entry(n, struct pnp_card, global_list)
+ #define protocol_to_pnp_card(n) list_entry(n, struct pnp_card, protocol_list)
+ #define to_pnp_card(n) container_of(n, struct pnp_card, dev)
+-#define pnp_for_each_card(card) \
+- for((card) = global_to_pnp_card(pnp_cards.next); \
+- (card) != global_to_pnp_card(&pnp_cards); \
+- (card) = global_to_pnp_card((card)->global_list.next))
++#define pnp_for_each_card(card) \
++ list_for_each_entry(card, &pnp_cards, global_list)
+
+ struct pnp_card_link {
+ struct pnp_card *card;
+@@ -276,14 +274,9 @@ struct pnp_dev {
+ #define card_to_pnp_dev(n) list_entry(n, struct pnp_dev, card_list)
+ #define protocol_to_pnp_dev(n) list_entry(n, struct pnp_dev, protocol_list)
+ #define to_pnp_dev(n) container_of(n, struct pnp_dev, dev)
+-#define pnp_for_each_dev(dev) \
+- for((dev) = global_to_pnp_dev(pnp_global.next); \
+- (dev) != global_to_pnp_dev(&pnp_global); \
+- (dev) = global_to_pnp_dev((dev)->global_list.next))
+-#define card_for_each_dev(card,dev) \
+- for((dev) = card_to_pnp_dev((card)->devices.next); \
+- (dev) != card_to_pnp_dev(&(card)->devices); \
+- (dev) = card_to_pnp_dev((dev)->card_list.next))
++#define pnp_for_each_dev(dev) list_for_each_entry(dev, &pnp_global, global_list)
++#define card_for_each_dev(card, dev) \
++ list_for_each_entry(dev, &(card)->devices, card_list)
+ #define pnp_dev_name(dev) (dev)->name
+
+ static inline void *pnp_get_drvdata(struct pnp_dev *pdev)
+@@ -437,14 +430,10 @@ struct pnp_protocol {
+ };
+
+ #define to_pnp_protocol(n) list_entry(n, struct pnp_protocol, protocol_list)
+-#define protocol_for_each_card(protocol,card) \
+- for((card) = protocol_to_pnp_card((protocol)->cards.next); \
+- (card) != protocol_to_pnp_card(&(protocol)->cards); \
+- (card) = protocol_to_pnp_card((card)->protocol_list.next))
+-#define protocol_for_each_dev(protocol,dev) \
+- for((dev) = protocol_to_pnp_dev((protocol)->devices.next); \
+- (dev) != protocol_to_pnp_dev(&(protocol)->devices); \
+- (dev) = protocol_to_pnp_dev((dev)->protocol_list.next))
++#define protocol_for_each_card(protocol, card) \
++ list_for_each_entry(card, &(protocol)->cards, protocol_list)
++#define protocol_for_each_dev(protocol, dev) \
++ list_for_each_entry(dev, &(protocol)->devices, protocol_list)
+
+ extern struct bus_type pnp_bus_type;
+
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index 248a137112e8..74226a8f919c 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -66,7 +66,7 @@ struct tty_buffer {
+ int read;
+ int flags;
+ /* Data points here */
+- unsigned long data[0];
++ unsigned long data[];
+ };
+
+ /* Values for .flags field of tty_buffer */
+diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
+index f45141bdbb83..ac4d70aeee12 100644
+--- a/include/net/netfilter/nf_conntrack.h
++++ b/include/net/netfilter/nf_conntrack.h
+@@ -85,7 +85,7 @@ struct nf_conn {
+ struct hlist_node nat_bysource;
+ #endif
+ /* all members below initialized via memset */
+- u8 __nfct_init_offset[0];
++ struct { } __nfct_init_offset;
+
+ /* If we were expected by an expectation, this will be it */
+ struct nf_conn *master;
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index e43df898d3db..0d4501f44e00 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1373,6 +1373,19 @@ static inline int tcp_full_space(const struct sock *sk)
+ return tcp_win_from_space(sk, sk->sk_rcvbuf);
+ }
+
++/* We provision sk_rcvbuf around 200% of sk_rcvlowat.
++ * If 87.5 % (7/8) of the space has been consumed, we want to override
++ * SO_RCVLOWAT constraint, since we are receiving skbs with too small
++ * len/truesize ratio.
++ */
++static inline bool tcp_rmem_pressure(const struct sock *sk)
++{
++ int rcvbuf = READ_ONCE(sk->sk_rcvbuf);
++ int threshold = rcvbuf - (rcvbuf >> 3);
++
++ return atomic_read(&sk->sk_rmem_alloc) > threshold;
++}
++
+ extern void tcp_openreq_init_rwin(struct request_sock *req,
+ const struct sock *sk_listener,
+ const struct dst_entry *dst);
+diff --git a/include/sound/rawmidi.h b/include/sound/rawmidi.h
+index c2a71fd8dfaf..1894af415b20 100644
+--- a/include/sound/rawmidi.h
++++ b/include/sound/rawmidi.h
+@@ -76,6 +76,7 @@ struct snd_rawmidi_runtime {
+ size_t avail_min; /* min avail for wakeup */
+ size_t avail; /* max used buffer for wakeup */
+ size_t xruns; /* over/underruns counter */
++ int buffer_ref; /* buffer reference count */
+ /* misc */
+ spinlock_t lock;
+ wait_queue_head_t sleep;
+diff --git a/init/main.c b/init/main.c
+index 38a603f62b7b..ec78f2312610 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -735,6 +735,8 @@ asmlinkage __visible void __init start_kernel(void)
+
+ /* Do the rest non-__init'ed, we're now alive */
+ rest_init();
++
++ prevent_tail_call_optimization();
+ }
+
+ /* Call all constructor functions linked into the kernel. */
+diff --git a/ipc/util.c b/ipc/util.c
+index b111e792b312..af1b572effb1 100644
+--- a/ipc/util.c
++++ b/ipc/util.c
+@@ -735,21 +735,21 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos,
+ total++;
+ }
+
+- *new_pos = pos + 1;
++ ipc = NULL;
+ if (total >= ids->in_use)
+- return NULL;
++ goto out;
+
+ for (; pos < IPCMNI; pos++) {
+ ipc = idr_find(&ids->ipcs_idr, pos);
+ if (ipc != NULL) {
+ rcu_read_lock();
+ ipc_lock_object(ipc);
+- return ipc;
++ break;
+ }
+ }
+-
+- /* Out of range - return NULL to terminate iteration */
+- return NULL;
++out:
++ *new_pos = pos + 1;
++ return ipc;
+ }
+
+ static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos)
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 0a2e1e7801d6..dea5120565d3 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2149,7 +2149,11 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
+ struct shmem_inode_info *info = SHMEM_I(inode);
+ int retval = -ENOMEM;
+
+- spin_lock_irq(&info->lock);
++ /*
++ * What serializes the accesses to info->flags?
++ * ipc_lock_object() when called from shmctl_do_lock(),
++ * no serialization needed when called from shm_destroy().
++ */
+ if (lock && !(info->flags & VM_LOCKED)) {
+ if (!user_shm_lock(inode->i_size, user))
+ goto out_nomem;
+@@ -2164,7 +2168,6 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
+ retval = 0;
+
+ out_nomem:
+- spin_unlock_irq(&info->lock);
+ return retval;
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 426635e188fc..9ccc14200b80 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -8259,11 +8259,13 @@ static void netdev_sync_lower_features(struct net_device *upper,
+ netdev_dbg(upper, "Disabling feature %pNF on lower dev %s.\n",
+ &feature, lower->name);
+ lower->wanted_features &= ~feature;
+- netdev_update_features(lower);
++ __netdev_update_features(lower);
+
+ if (unlikely(lower->features & feature))
+ netdev_WARN(upper, "failed to disable %pNF on %s!\n",
+ &feature, lower->name);
++ else
++ netdev_features_change(lower);
+ }
+ }
+ }
+diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
+index c7785efeea57..3978a5e8d261 100644
+--- a/net/core/drop_monitor.c
++++ b/net/core/drop_monitor.c
+@@ -154,6 +154,7 @@ static void sched_send_work(struct timer_list *t)
+ static void trace_drop_common(struct sk_buff *skb, void *location)
+ {
+ struct net_dm_alert_msg *msg;
++ struct net_dm_drop_point *point;
+ struct nlmsghdr *nlh;
+ struct nlattr *nla;
+ int i;
+@@ -172,11 +173,13 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
+ nlh = (struct nlmsghdr *)dskb->data;
+ nla = genlmsg_data(nlmsg_data(nlh));
+ msg = nla_data(nla);
++ point = msg->points;
+ for (i = 0; i < msg->entries; i++) {
+- if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
+- msg->points[i].count++;
++ if (!memcmp(&location, &point->pc, sizeof(void *))) {
++ point->count++;
+ goto out;
+ }
++ point++;
+ }
+ if (msg->entries == dm_hit_limit)
+ goto out;
+@@ -185,8 +188,8 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
+ */
+ __nla_reserve_nohdr(dskb, sizeof(struct net_dm_drop_point));
+ nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point));
+- memcpy(msg->points[msg->entries].pc, &location, sizeof(void *));
+- msg->points[msg->entries].count = 1;
++ memcpy(point->pc, &location, sizeof(void *));
++ point->count = 1;
+ msg->entries++;
+
+ if (!timer_pending(&data->send_timer)) {
+diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
+index b9057478d69c..239786608ee4 100644
+--- a/net/core/netprio_cgroup.c
++++ b/net/core/netprio_cgroup.c
+@@ -240,6 +240,8 @@ static void net_prio_attach(struct cgroup_taskset *tset)
+ struct task_struct *p;
+ struct cgroup_subsys_state *css;
+
++ cgroup_sk_alloc_disable();
++
+ cgroup_taskset_for_each(p, css, tset) {
+ void *v = (void *)(unsigned long)css->cgroup->id;
+
+diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
+index 46ae4dee522a..b036c55f5cb1 100644
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -412,7 +412,7 @@ static int dsa_tree_setup_switches(struct dsa_switch_tree *dst)
+
+ err = dsa_switch_setup(ds);
+ if (err)
+- return err;
++ continue;
+
+ for (port = 0; port < ds->num_ports; port++) {
+ dp = &ds->ports[port];
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index 1c21dc5d6dd4..5535b722f66d 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -1272,7 +1272,8 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
+ return ret_val;
+ }
+
+- secattr->flags |= NETLBL_SECATTR_MLS_CAT;
++ if (secattr->attr.mls.cat)
++ secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+ }
+
+ return 0;
+@@ -1453,7 +1454,8 @@ static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
+ return ret_val;
+ }
+
+- secattr->flags |= NETLBL_SECATTR_MLS_CAT;
++ if (secattr->attr.mls.cat)
++ secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+ }
+
+ return 0;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 4590af506244..84ddb16f4fc0 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -906,7 +906,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
+ /* Check for load limit; set rate_last to the latest sent
+ * redirect.
+ */
+- if (peer->rate_tokens == 0 ||
++ if (peer->n_redirects == 0 ||
+ time_after(jiffies,
+ (peer->rate_last +
+ (ip_rt_redirect_load << peer->n_redirects)))) {
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 54dda47a9a56..d31a4f5d25e8 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -488,9 +488,17 @@ static void tcp_tx_timestamp(struct sock *sk, u16 tsflags)
+ static inline bool tcp_stream_is_readable(const struct tcp_sock *tp,
+ int target, struct sock *sk)
+ {
+- return (READ_ONCE(tp->rcv_nxt) - tp->copied_seq >= target) ||
+- (sk->sk_prot->stream_memory_read ?
+- sk->sk_prot->stream_memory_read(sk) : false);
++ int avail = READ_ONCE(tp->rcv_nxt) - READ_ONCE(tp->copied_seq);
++
++ if (avail > 0) {
++ if (avail >= target)
++ return true;
++ if (tcp_rmem_pressure(sk))
++ return true;
++ }
++ if (sk->sk_prot->stream_memory_read)
++ return sk->sk_prot->stream_memory_read(sk);
++ return false;
+ }
+
+ /*
+@@ -1774,10 +1782,11 @@ static int tcp_zerocopy_receive(struct sock *sk,
+
+ down_read(¤t->mm->mmap_sem);
+
+- ret = -EINVAL;
+ vma = find_vma(current->mm, address);
+- if (!vma || vma->vm_start > address || vma->vm_ops != &tcp_vm_ops)
+- goto out;
++ if (!vma || vma->vm_start > address || vma->vm_ops != &tcp_vm_ops) {
++ up_read(¤t->mm->mmap_sem);
++ return -EINVAL;
++ }
+ zc->length = min_t(unsigned long, zc->length, vma->vm_end - address);
+
+ tp = tcp_sk(sk);
+@@ -2134,14 +2143,16 @@ skip_copy:
+ tp->urg_data = 0;
+ tcp_fast_path_check(sk);
+ }
+- if (used + offset < skb->len)
+- continue;
+
+ if (TCP_SKB_CB(skb)->has_rxtstamp) {
+ tcp_update_recv_tstamps(skb, &tss);
+ has_tss = true;
+ has_cmsg = true;
+ }
++
++ if (used + offset < skb->len)
++ continue;
++
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+ goto found_fin_ok;
+ if (!(flags & MSG_PEEK))
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 38b6d8f90a44..12e1ea7344d9 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4683,7 +4683,8 @@ void tcp_data_ready(struct sock *sk)
+ const struct tcp_sock *tp = tcp_sk(sk);
+ int avail = tp->rcv_nxt - tp->copied_seq;
+
+- if (avail < sk->sk_rcvlowat && !sock_flag(sk, SOCK_DONE))
++ if (avail < sk->sk_rcvlowat && !tcp_rmem_pressure(sk) &&
++ !sock_flag(sk, SOCK_DONE))
+ return;
+
+ sk->sk_data_ready(sk);
+diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
+index 1c0bb9fb76e6..70611784c071 100644
+--- a/net/ipv6/calipso.c
++++ b/net/ipv6/calipso.c
+@@ -1061,7 +1061,8 @@ static int calipso_opt_getattr(const unsigned char *calipso,
+ goto getattr_return;
+ }
+
+- secattr->flags |= NETLBL_SECATTR_MLS_CAT;
++ if (secattr->attr.mls.cat)
++ secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+ }
+
+ secattr->type = NETLBL_NLTYPE_CALIPSO;
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 9c36a743ddbc..dad35cd48807 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2360,8 +2360,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
+ const struct in6_addr *daddr, *saddr;
+ struct rt6_info *rt6 = (struct rt6_info *)dst;
+
+- if (dst_metric_locked(dst, RTAX_MTU))
+- return;
++ /* Note: do *NOT* check dst_metric_locked(dst, RTAX_MTU)
++ * IPv6 pmtu discovery isn't optional, so 'mtu lock' cannot disable it.
++ * [see also comment in rt6_mtu_change_route()]
++ */
+
+ if (iph) {
+ daddr = &iph->daddr;
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index c6073d17c324..ad1da6b2fb60 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1352,9 +1352,9 @@ __nf_conntrack_alloc(struct net *net,
+ *(unsigned long *)(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev) = hash;
+ ct->status = 0;
+ write_pnet(&ct->ct_net, net);
+- memset(&ct->__nfct_init_offset[0], 0,
++ memset(&ct->__nfct_init_offset, 0,
+ offsetof(struct nf_conn, proto) -
+- offsetof(struct nf_conn, __nfct_init_offset[0]));
++ offsetof(struct nf_conn, __nfct_init_offset));
+
+ nf_ct_zone_add(ct, zone);
+
+diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
+index 0221510328d4..84d317418d18 100644
+--- a/net/netfilter/nft_set_rbtree.c
++++ b/net/netfilter/nft_set_rbtree.c
+@@ -36,6 +36,11 @@ static bool nft_rbtree_interval_end(const struct nft_rbtree_elem *rbe)
+ (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END);
+ }
+
++static bool nft_rbtree_interval_start(const struct nft_rbtree_elem *rbe)
++{
++ return !nft_rbtree_interval_end(rbe);
++}
++
+ static bool nft_rbtree_equal(const struct nft_set *set, const void *this,
+ const struct nft_rbtree_elem *interval)
+ {
+@@ -67,7 +72,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set
+ if (interval &&
+ nft_rbtree_equal(set, this, interval) &&
+ nft_rbtree_interval_end(rbe) &&
+- !nft_rbtree_interval_end(interval))
++ nft_rbtree_interval_start(interval))
+ continue;
+ interval = rbe;
+ } else if (d > 0)
+@@ -92,7 +97,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set
+
+ if (set->flags & NFT_SET_INTERVAL && interval != NULL &&
+ nft_set_elem_active(&interval->ext, genmask) &&
+- !nft_rbtree_interval_end(interval)) {
++ nft_rbtree_interval_start(interval)) {
+ *ext = &interval->ext;
+ return true;
+ }
+@@ -221,9 +226,9 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
+ p = &parent->rb_right;
+ else {
+ if (nft_rbtree_interval_end(rbe) &&
+- !nft_rbtree_interval_end(new)) {
++ nft_rbtree_interval_start(new)) {
+ p = &parent->rb_left;
+- } else if (!nft_rbtree_interval_end(rbe) &&
++ } else if (nft_rbtree_interval_start(rbe) &&
+ nft_rbtree_interval_end(new)) {
+ p = &parent->rb_right;
+ } else if (nft_set_elem_active(&rbe->ext, genmask)) {
+@@ -314,10 +319,10 @@ static void *nft_rbtree_deactivate(const struct net *net,
+ parent = parent->rb_right;
+ else {
+ if (nft_rbtree_interval_end(rbe) &&
+- !nft_rbtree_interval_end(this)) {
++ nft_rbtree_interval_start(this)) {
+ parent = parent->rb_left;
+ continue;
+- } else if (!nft_rbtree_interval_end(rbe) &&
++ } else if (nft_rbtree_interval_start(rbe) &&
+ nft_rbtree_interval_end(this)) {
+ parent = parent->rb_right;
+ continue;
+diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
+index ee3e5b6471a6..15fe2120b310 100644
+--- a/net/netlabel/netlabel_kapi.c
++++ b/net/netlabel/netlabel_kapi.c
+@@ -748,6 +748,12 @@ int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap,
+ if ((off & (BITS_PER_LONG - 1)) != 0)
+ return -EINVAL;
+
++ /* a null catmap is equivalent to an empty one */
++ if (!catmap) {
++ *offset = (u32)-1;
++ return 0;
++ }
++
+ if (off < catmap->startbit) {
+ off = catmap->startbit;
+ *offset = off;
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index a52d6d16efc4..9b26973fe697 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -112,6 +112,17 @@ static void snd_rawmidi_input_event_work(struct work_struct *work)
+ runtime->event(runtime->substream);
+ }
+
++/* buffer refcount management: call with runtime->lock held */
++static inline void snd_rawmidi_buffer_ref(struct snd_rawmidi_runtime *runtime)
++{
++ runtime->buffer_ref++;
++}
++
++static inline void snd_rawmidi_buffer_unref(struct snd_rawmidi_runtime *runtime)
++{
++ runtime->buffer_ref--;
++}
++
+ static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream)
+ {
+ struct snd_rawmidi_runtime *runtime;
+@@ -661,6 +672,11 @@ static int resize_runtime_buffer(struct snd_rawmidi_runtime *runtime,
+ if (!newbuf)
+ return -ENOMEM;
+ spin_lock_irq(&runtime->lock);
++ if (runtime->buffer_ref) {
++ spin_unlock_irq(&runtime->lock);
++ kvfree(newbuf);
++ return -EBUSY;
++ }
+ oldbuf = runtime->buffer;
+ runtime->buffer = newbuf;
+ runtime->buffer_size = params->buffer_size;
+@@ -960,8 +976,10 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream,
+ long result = 0, count1;
+ struct snd_rawmidi_runtime *runtime = substream->runtime;
+ unsigned long appl_ptr;
++ int err = 0;
+
+ spin_lock_irqsave(&runtime->lock, flags);
++ snd_rawmidi_buffer_ref(runtime);
+ while (count > 0 && runtime->avail) {
+ count1 = runtime->buffer_size - runtime->appl_ptr;
+ if (count1 > count)
+@@ -980,16 +998,19 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream,
+ if (userbuf) {
+ spin_unlock_irqrestore(&runtime->lock, flags);
+ if (copy_to_user(userbuf + result,
+- runtime->buffer + appl_ptr, count1)) {
+- return result > 0 ? result : -EFAULT;
+- }
++ runtime->buffer + appl_ptr, count1))
++ err = -EFAULT;
+ spin_lock_irqsave(&runtime->lock, flags);
++ if (err)
++ goto out;
+ }
+ result += count1;
+ count -= count1;
+ }
++ out:
++ snd_rawmidi_buffer_unref(runtime);
+ spin_unlock_irqrestore(&runtime->lock, flags);
+- return result;
++ return result > 0 ? result : err;
+ }
+
+ long snd_rawmidi_kernel_read(struct snd_rawmidi_substream *substream,
+@@ -1261,6 +1282,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
+ return -EAGAIN;
+ }
+ }
++ snd_rawmidi_buffer_ref(runtime);
+ while (count > 0 && runtime->avail > 0) {
+ count1 = runtime->buffer_size - runtime->appl_ptr;
+ if (count1 > count)
+@@ -1292,6 +1314,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
+ }
+ __end:
+ count1 = runtime->avail < runtime->buffer_size;
++ snd_rawmidi_buffer_unref(runtime);
+ spin_unlock_irqrestore(&runtime->lock, flags);
+ if (count1)
+ snd_rawmidi_output_trigger(substream, 1);
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 12a064f994b1..1d83c3c59e1a 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2211,7 +2211,9 @@ static int generic_hdmi_build_controls(struct hda_codec *codec)
+
+ for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
+ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
++ struct hdmi_eld *pin_eld = &per_pin->sink_eld;
+
++ pin_eld->eld_valid = false;
+ hdmi_present_sense(per_pin, 0);
+ }
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index fc39550f6c5d..ffe1340890c9 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5524,6 +5524,15 @@ static void alc233_alc662_fixup_lenovo_dual_codecs(struct hda_codec *codec,
+ }
+ }
+
++static void alc225_fixup_s3_pop_noise(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action != HDA_FIXUP_ACT_PRE_PROBE)
++ return;
++
++ codec->power_save_node = 1;
++}
++
+ /* Forcibly assign NID 0x03 to HP/LO while NID 0x02 to SPK for EQ */
+ static void alc274_fixup_bind_dacs(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+@@ -5607,6 +5616,7 @@ enum {
+ ALC269_FIXUP_HP_LINE1_MIC1_LED,
+ ALC269_FIXUP_INV_DMIC,
+ ALC269_FIXUP_LENOVO_DOCK,
++ ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST,
+ ALC269_FIXUP_NO_SHUTUP,
+ ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
+ ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
+@@ -5690,6 +5700,7 @@ enum {
+ ALC233_FIXUP_ACER_HEADSET_MIC,
+ ALC294_FIXUP_LENOVO_MIC_LOCATION,
+ ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE,
++ ALC225_FIXUP_S3_POP_NOISE,
+ ALC700_FIXUP_INTEL_REFERENCE,
+ ALC274_FIXUP_DELL_BIND_DACS,
+ ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
+@@ -5918,6 +5929,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT
+ },
++ [ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc269_fixup_limit_int_mic_boost,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_LENOVO_DOCK,
++ },
+ [ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
+@@ -6546,6 +6563,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ { }
+ },
+ .chained = true,
++ .chain_id = ALC225_FIXUP_S3_POP_NOISE
++ },
++ [ALC225_FIXUP_S3_POP_NOISE] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc225_fixup_s3_pop_noise,
++ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+ },
+ [ALC700_FIXUP_INTEL_REFERENCE] = {
+@@ -6997,7 +7020,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
+- SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
+@@ -7134,6 +7157,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC269_FIXUP_HEADSET_MODE, .name = "headset-mode"},
+ {.id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, .name = "headset-mode-no-hp-mic"},
+ {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"},
++ {.id = ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST, .name = "lenovo-dock-limit-boost"},
+ {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
+ {.id = ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, .name = "hp-dock-gpio-mic1-led"},
+ {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
+@@ -7803,8 +7827,6 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->gen.mixer_nid = 0;
+ break;
+ case 0x10ec0225:
+- codec->power_save_node = 1;
+- /* fall through */
+ case 0x10ec0295:
+ case 0x10ec0299:
+ spec->codec_variant = ALC269_TYPE_ALC225;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 6836f827965c..aac23acfdd36 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1334,13 +1334,14 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+ && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ msleep(20);
+
+- /* Zoom R16/24, Logitech H650e, Jabra 550a needs a tiny delay here,
+- * otherwise requests like get/set frequency return as failed despite
+- * actually succeeding.
++ /* Zoom R16/24, Logitech H650e, Jabra 550a, Kingston HyperX needs a tiny
++ * delay here, otherwise requests like get/set frequency return as
++ * failed despite actually succeeding.
+ */
+ if ((chip->usb_id == USB_ID(0x1686, 0x00dd) ||
+ chip->usb_id == USB_ID(0x046d, 0x0a46) ||
+- chip->usb_id == USB_ID(0x0b0e, 0x0349)) &&
++ chip->usb_id == USB_ID(0x0b0e, 0x0349) ||
++ chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ usleep_range(1000, 2000);
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-05-20 11:30 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-05-20 11:30 UTC (permalink / raw
To: gentoo-commits
commit: f342d08590afb25979bde4bf6cde10542a9f27e7
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 20 11:29:45 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 20 11:29:45 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f342d085
Remove redundant patch: x86: Fix early boot crash on gcc-10
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 -
1700_x86-gcc-10-early-boot-crash-fix.patch | 131 -----------------------------
2 files changed, 135 deletions(-)
diff --git a/0000_README b/0000_README
index 4cf06a4..63f9a11 100644
--- a/0000_README
+++ b/0000_README
@@ -543,10 +543,6 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default.
-Patch: 1700_x86-gcc-10-early-boot-crash-fix.patch
-From: https://https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/patch/?id=f670269a42bfdd2c83a1118cc3d1b475547eac22
-Desc: x86: Fix early boot crash on gcc-10
-
Patch: 2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
From: https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-marcel@holtmann.org/raw
Desc: Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758
diff --git a/1700_x86-gcc-10-early-boot-crash-fix.patch b/1700_x86-gcc-10-early-boot-crash-fix.patch
deleted file mode 100644
index 8cdf651..0000000
--- a/1700_x86-gcc-10-early-boot-crash-fix.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-From f670269a42bfdd2c83a1118cc3d1b475547eac22 Mon Sep 17 00:00:00 2001
-From: Borislav Petkov <bp@suse.de>
-Date: Wed, 22 Apr 2020 18:11:30 +0200
-Subject: x86: Fix early boot crash on gcc-10, next try
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-... or the odyssey of trying to disable the stack protector for the
-function which generates the stack canary value.
-
-The whole story started with Sergei reporting a boot crash with a kernel
-built with gcc-10:
-
- Kernel panic — not syncing: stack-protector: Kernel stack is corrupted in: start_secondary
- CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5—00235—gfffb08b37df9 #139
- Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77M—D3H, BIOS F12 11/14/2013
- Call Trace:
- dump_stack
- panic
- ? start_secondary
- __stack_chk_fail
- start_secondary
- secondary_startup_64
- -—-[ end Kernel panic — not syncing: stack—protector: Kernel stack is corrupted in: start_secondary
-
-This happens because gcc-10 tail-call optimizes the last function call
-in start_secondary() - cpu_startup_entry() - and thus emits a stack
-canary check which fails because the canary value changes after the
-boot_init_stack_canary() call.
-
-To fix that, the initial attempt was to mark the one function which
-generates the stack canary with:
-
- __attribute__((optimize("-fno-stack-protector"))) ... start_secondary(void *unused)
-
-however, using the optimize attribute doesn't work cumulatively
-as the attribute does not add to but rather replaces previously
-supplied optimization options - roughly all -fxxx options.
-
-The key one among them being -fno-omit-frame-pointer and thus leading to
-not present frame pointer - frame pointer which the kernel needs.
-
-The next attempt to prevent compilers from tail-call optimizing
-the last function call cpu_startup_entry(), shy of carving out
-start_secondary() into a separate compilation unit and building it with
--fno-stack-protector, is this one.
-
-The current solution is short and sweet, and reportedly, is supported by
-both compilers so let's see how far we'll get this time.
-
-Reported-by: Sergei Trofimovich <slyfox@gentoo.org>
-Signed-off-by: Borislav Petkov <bp@suse.de>
-Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
-Reviewed-by: Kees Cook <keescook@chromium.org>
-Link: https://lkml.kernel.org/r/20200314164451.346497-1-slyfox@gentoo.org
----
- arch/x86/include/asm/stackprotector.h | 7 ++++++-
- arch/x86/kernel/smpboot.c | 8 ++++++++
- arch/x86/xen/smp_pv.c | 1 +
- include/linux/compiler.h | 6 ++++++
- 4 files changed, 21 insertions(+), 1 deletion(-)
-
-diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
-index 91e29b6a86a5..9804a7957f4e 100644
---- a/arch/x86/include/asm/stackprotector.h
-+++ b/arch/x86/include/asm/stackprotector.h
-@@ -55,8 +55,13 @@
- /*
- * Initialize the stackprotector canary value.
- *
-- * NOTE: this must only be called from functions that never return,
-+ * NOTE: this must only be called from functions that never return
- * and it must always be inlined.
-+ *
-+ * In addition, it should be called from a compilation unit for which
-+ * stack protector is disabled. Alternatively, the caller should not end
-+ * with a function call which gets tail-call optimized as that would
-+ * lead to checking a modified canary value.
- */
- static __always_inline void boot_init_stack_canary(void)
- {
-diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index fe3ab9632f3b..4f275ac7830b 100644
---- a/arch/x86/kernel/smpboot.c
-+++ b/arch/x86/kernel/smpboot.c
-@@ -266,6 +266,14 @@ static void notrace start_secondary(void *unused)
-
- wmb();
- cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
-+
-+ /*
-+ * Prevent tail call to cpu_startup_entry() because the stack protector
-+ * guard has been changed a couple of function calls up, in
-+ * boot_init_stack_canary() and must not be checked before tail calling
-+ * another function.
-+ */
-+ prevent_tail_call_optimization();
- }
-
- /**
-diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
-index 8fb8a50a28b4..f2adb63b2d7c 100644
---- a/arch/x86/xen/smp_pv.c
-+++ b/arch/x86/xen/smp_pv.c
-@@ -93,6 +93,7 @@ asmlinkage __visible void cpu_bringup_and_idle(void)
- cpu_bringup();
- boot_init_stack_canary();
- cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
-+ prevent_tail_call_optimization();
- }
-
- void xen_smp_intr_free_pv(unsigned int cpu)
-diff --git a/include/linux/compiler.h b/include/linux/compiler.h
-index 034b0a644efc..732754d96039 100644
---- a/include/linux/compiler.h
-+++ b/include/linux/compiler.h
-@@ -356,4 +356,10 @@ static inline void *offset_to_ptr(const int *off)
- /* &a[0] degrades to a pointer: a different type from an array */
- #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
-
-+/*
-+ * This is needed in functions which generate the stack canary, see
-+ * arch/x86/kernel/smpboot.c::start_secondary() for an example.
-+ */
-+#define prevent_tail_call_optimization() asm("")
-+
- #endif /* __LINUX_COMPILER_H */
---
-cgit 1.2-0.3.lf.el7
-
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-05-27 16:25 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-05-27 16:25 UTC (permalink / raw
To: gentoo-commits
commit: 1169eada98fc086c3d9e56cfa8212f7ee5f73dc7
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 27 16:24:47 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 27 16:24:47 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=1169eada
Linux patch 4.19.125
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1124_linux-4.19.125.patch | 2436 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2440 insertions(+)
diff --git a/0000_README b/0000_README
index 63f9a11..a36c8a4 100644
--- a/0000_README
+++ b/0000_README
@@ -535,6 +535,10 @@ Patch: 1123_linux-4.19.124.patch
From: https://www.kernel.org
Desc: Linux 4.19.124
+Patch: 1124_linux-4.19.125.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.125
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1124_linux-4.19.125.patch b/1124_linux-4.19.125.patch
new file mode 100644
index 0000000..d340902
--- /dev/null
+++ b/1124_linux-4.19.125.patch
@@ -0,0 +1,2436 @@
+diff --git a/Makefile b/Makefile
+index 292c92c8369d..93c63bda7115 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 124
++SUBLEVEL = 125
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h
+index ffebe7b7a5b7..91ca80035fc4 100644
+--- a/arch/arm/include/asm/futex.h
++++ b/arch/arm/include/asm/futex.h
+@@ -163,8 +163,13 @@ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
+ preempt_enable();
+ #endif
+
+- if (!ret)
+- *oval = oldval;
++ /*
++ * Store unconditionally. If ret != 0 the extra store is the least
++ * of the worries but GCC cannot figure out that __futex_atomic_op()
++ * is either setting ret to -EFAULT or storing the old value in
++ * oldval which results in a uninitialized warning at the call site.
++ */
++ *oval = oldval;
+
+ return ret;
+ }
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index 6f475dc5829b..f38d153d2586 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -139,7 +139,7 @@ config PPC
+ select ARCH_HAS_MEMBARRIER_CALLBACKS
+ select ARCH_HAS_SCALED_CPUTIME if VIRT_CPU_ACCOUNTING_NATIVE
+ select ARCH_HAS_SG_CHAIN
+- select ARCH_HAS_STRICT_KERNEL_RWX if ((PPC_BOOK3S_64 || PPC32) && !RELOCATABLE && !HIBERNATION)
++ select ARCH_HAS_STRICT_KERNEL_RWX if (PPC32 && !HIBERNATION)
+ select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
+ select ARCH_HAS_UACCESS_FLUSHCACHE if PPC64
+ select ARCH_HAS_UBSAN_SANITIZE_ALL
+diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
+index 9713d4e8c22b..6558617bd2ce 100644
+--- a/arch/riscv/kernel/setup.c
++++ b/arch/riscv/kernel/setup.c
+@@ -19,6 +19,7 @@
+ * to the Free Software Foundation, Inc.,
+ */
+
++#include <linux/bootmem.h>
+ #include <linux/init.h>
+ #include <linux/mm.h>
+ #include <linux/memblock.h>
+@@ -187,6 +188,7 @@ static void __init setup_bootmem(void)
+
+ set_max_mapnr(PFN_DOWN(mem_size));
+ max_low_pfn = PFN_DOWN(memblock_end_of_DRAM());
++ max_pfn = max_low_pfn;
+
+ #ifdef CONFIG_BLK_DEV_INITRD
+ setup_initrd();
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 1ca76ca944ba..53dc8492f02f 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -345,8 +345,6 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
+ * According to Intel, MFENCE can do the serialization here.
+ */
+ asm volatile("mfence" : : : "memory");
+-
+- printk_once(KERN_DEBUG "TSC deadline timer enabled\n");
+ return;
+ }
+
+@@ -545,7 +543,7 @@ static DEFINE_PER_CPU(struct clock_event_device, lapic_events);
+ #define DEADLINE_MODEL_MATCH_REV(model, rev) \
+ { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long)rev }
+
+-static u32 hsx_deadline_rev(void)
++static __init u32 hsx_deadline_rev(void)
+ {
+ switch (boot_cpu_data.x86_stepping) {
+ case 0x02: return 0x3a; /* EP */
+@@ -555,7 +553,7 @@ static u32 hsx_deadline_rev(void)
+ return ~0U;
+ }
+
+-static u32 bdx_deadline_rev(void)
++static __init u32 bdx_deadline_rev(void)
+ {
+ switch (boot_cpu_data.x86_stepping) {
+ case 0x02: return 0x00000011;
+@@ -567,7 +565,7 @@ static u32 bdx_deadline_rev(void)
+ return ~0U;
+ }
+
+-static u32 skx_deadline_rev(void)
++static __init u32 skx_deadline_rev(void)
+ {
+ switch (boot_cpu_data.x86_stepping) {
+ case 0x03: return 0x01000136;
+@@ -580,7 +578,7 @@ static u32 skx_deadline_rev(void)
+ return ~0U;
+ }
+
+-static const struct x86_cpu_id deadline_match[] = {
++static const struct x86_cpu_id deadline_match[] __initconst = {
+ DEADLINE_MODEL_MATCH_FUNC( INTEL_FAM6_HASWELL_X, hsx_deadline_rev),
+ DEADLINE_MODEL_MATCH_REV ( INTEL_FAM6_BROADWELL_X, 0x0b000020),
+ DEADLINE_MODEL_MATCH_FUNC( INTEL_FAM6_BROADWELL_XEON_D, bdx_deadline_rev),
+@@ -602,18 +600,19 @@ static const struct x86_cpu_id deadline_match[] = {
+ {},
+ };
+
+-static void apic_check_deadline_errata(void)
++static __init bool apic_validate_deadline_timer(void)
+ {
+ const struct x86_cpu_id *m;
+ u32 rev;
+
+- if (!boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER) ||
+- boot_cpu_has(X86_FEATURE_HYPERVISOR))
+- return;
++ if (!boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER))
++ return false;
++ if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
++ return true;
+
+ m = x86_match_cpu(deadline_match);
+ if (!m)
+- return;
++ return true;
+
+ /*
+ * Function pointers will have the MSB set due to address layout,
+@@ -625,11 +624,12 @@ static void apic_check_deadline_errata(void)
+ rev = (u32)m->driver_data;
+
+ if (boot_cpu_data.microcode >= rev)
+- return;
++ return true;
+
+ setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER);
+ pr_err(FW_BUG "TSC_DEADLINE disabled due to Errata; "
+ "please update microcode to version: 0x%x (or later)\n", rev);
++ return false;
+ }
+
+ /*
+@@ -2023,7 +2023,8 @@ void __init init_apic_mappings(void)
+ {
+ unsigned int new_apicid;
+
+- apic_check_deadline_errata();
++ if (apic_validate_deadline_timer())
++ pr_debug("TSC deadline timer available\n");
+
+ if (x2apic_mode) {
+ boot_cpu_physical_apicid = read_apic_id();
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index b48e2686440b..2701b370e58f 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -300,12 +300,19 @@ EXPORT_SYMBOL_GPL(unwind_get_return_address);
+
+ unsigned long *unwind_get_return_address_ptr(struct unwind_state *state)
+ {
++ struct task_struct *task = state->task;
++
+ if (unwind_done(state))
+ return NULL;
+
+ if (state->regs)
+ return &state->regs->ip;
+
++ if (task != current && state->sp == task->thread.sp) {
++ struct inactive_task_frame *frame = (void *)task->thread.sp;
++ return &frame->ret_addr;
++ }
++
+ if (state->sp)
+ return (unsigned long *)state->sp - 1;
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index df2274414640..226db3dc490b 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -998,33 +998,32 @@ static void svm_cpu_uninit(int cpu)
+ static int svm_cpu_init(int cpu)
+ {
+ struct svm_cpu_data *sd;
+- int r;
+
+ sd = kzalloc(sizeof(struct svm_cpu_data), GFP_KERNEL);
+ if (!sd)
+ return -ENOMEM;
+ sd->cpu = cpu;
+- r = -ENOMEM;
+ sd->save_area = alloc_page(GFP_KERNEL);
+ if (!sd->save_area)
+- goto err_1;
++ goto free_cpu_data;
+
+ if (svm_sev_enabled()) {
+- r = -ENOMEM;
+ sd->sev_vmcbs = kmalloc_array(max_sev_asid + 1,
+ sizeof(void *),
+ GFP_KERNEL);
+ if (!sd->sev_vmcbs)
+- goto err_1;
++ goto free_save_area;
+ }
+
+ per_cpu(svm_data, cpu) = sd;
+
+ return 0;
+
+-err_1:
++free_save_area:
++ __free_page(sd->save_area);
++free_cpu_data:
+ kfree(sd);
+- return r;
++ return -ENOMEM;
+
+ }
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 8340c81b258b..dd4c7289610e 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -1773,9 +1773,17 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
+ dev_set_drvdata(&adev_dimm->dev, nfit_mem);
+
+ /*
+- * Until standardization materializes we need to consider 4
+- * different command sets. Note, that checking for function0 (bit0)
+- * tells us if any commands are reachable through this GUID.
++ * There are 4 "legacy" NVDIMM command sets
++ * (NVDIMM_FAMILY_{INTEL,MSFT,HPE1,HPE2}) that were created before
++ * an EFI working group was established to constrain this
++ * proliferation. The nfit driver probes for the supported command
++ * set by GUID. Note, if you're a platform developer looking to add
++ * a new command set to this probe, consider using an existing set,
++ * or otherwise seek approval to publish the command set at
++ * http://www.uefi.org/RFIC_LIST.
++ *
++ * Note, that checking for function0 (bit0) tells us if any commands
++ * are reachable through this GUID.
+ */
+ for (i = 0; i <= NVDIMM_FAMILY_MAX; i++)
+ if (acpi_check_dsm(adev_dimm->handle, to_nfit_uuid(i), 1, 1))
+@@ -1798,6 +1806,8 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
+ dsm_mask &= ~(1 << 8);
+ } else if (nfit_mem->family == NVDIMM_FAMILY_MSFT) {
+ dsm_mask = 0xffffffff;
++ } else if (nfit_mem->family == NVDIMM_FAMILY_HYPERV) {
++ dsm_mask = 0x1f;
+ } else {
+ dev_dbg(dev, "unknown dimm command family\n");
+ nfit_mem->family = -1;
+@@ -3622,6 +3632,7 @@ static __init int nfit_init(void)
+ guid_parse(UUID_NFIT_DIMM_N_HPE1, &nfit_uuid[NFIT_DEV_DIMM_N_HPE1]);
+ guid_parse(UUID_NFIT_DIMM_N_HPE2, &nfit_uuid[NFIT_DEV_DIMM_N_HPE2]);
+ guid_parse(UUID_NFIT_DIMM_N_MSFT, &nfit_uuid[NFIT_DEV_DIMM_N_MSFT]);
++ guid_parse(UUID_NFIT_DIMM_N_HYPERV, &nfit_uuid[NFIT_DEV_DIMM_N_HYPERV]);
+
+ nfit_wq = create_singlethread_workqueue("nfit");
+ if (!nfit_wq)
+diff --git a/drivers/acpi/nfit/nfit.h b/drivers/acpi/nfit/nfit.h
+index 68848fc4b7c9..cc2ec62951de 100644
+--- a/drivers/acpi/nfit/nfit.h
++++ b/drivers/acpi/nfit/nfit.h
+@@ -34,11 +34,14 @@
+ /* https://msdn.microsoft.com/library/windows/hardware/mt604741 */
+ #define UUID_NFIT_DIMM_N_MSFT "1ee68b36-d4bd-4a1a-9a16-4f8e53d46e05"
+
++/* http://www.uefi.org/RFIC_LIST (see "Virtual NVDIMM 0x1901") */
++#define UUID_NFIT_DIMM_N_HYPERV "5746c5f2-a9a2-4264-ad0e-e4ddc9e09e80"
++
+ #define ACPI_NFIT_MEM_FAILED_MASK (ACPI_NFIT_MEM_SAVE_FAILED \
+ | ACPI_NFIT_MEM_RESTORE_FAILED | ACPI_NFIT_MEM_FLUSH_FAILED \
+ | ACPI_NFIT_MEM_NOT_ARMED | ACPI_NFIT_MEM_MAP_FAILED)
+
+-#define NVDIMM_FAMILY_MAX NVDIMM_FAMILY_MSFT
++#define NVDIMM_FAMILY_MAX NVDIMM_FAMILY_HYPERV
+
+ #define NVDIMM_STANDARD_CMDMASK \
+ (1 << ND_CMD_SMART | 1 << ND_CMD_SMART_THRESHOLD | 1 << ND_CMD_DIMM_FLAGS \
+@@ -75,6 +78,7 @@ enum nfit_uuids {
+ NFIT_DEV_DIMM_N_HPE1 = NVDIMM_FAMILY_HPE1,
+ NFIT_DEV_DIMM_N_HPE2 = NVDIMM_FAMILY_HPE2,
+ NFIT_DEV_DIMM_N_MSFT = NVDIMM_FAMILY_MSFT,
++ NFIT_DEV_DIMM_N_HYPERV = NVDIMM_FAMILY_HYPERV,
+ NFIT_SPA_VOLATILE,
+ NFIT_SPA_PM,
+ NFIT_SPA_DCR,
+diff --git a/drivers/base/component.c b/drivers/base/component.c
+index 7f7c4233cd31..ee4d3b388f44 100644
+--- a/drivers/base/component.c
++++ b/drivers/base/component.c
+@@ -235,7 +235,8 @@ static int try_to_bring_up_master(struct master *master,
+ ret = master->ops->bind(master->dev);
+ if (ret < 0) {
+ devres_release_group(master->dev, NULL);
+- dev_info(master->dev, "master bind failed: %d\n", ret);
++ if (ret != -EPROBE_DEFER)
++ dev_info(master->dev, "master bind failed: %d\n", ret);
+ return ret;
+ }
+
+@@ -506,8 +507,9 @@ static int component_bind(struct component *component, struct master *master,
+ devres_release_group(component->dev, NULL);
+ devres_release_group(master->dev, NULL);
+
+- dev_err(master->dev, "failed to bind %s (ops %ps): %d\n",
+- dev_name(component->dev), component->ops, ret);
++ if (ret != -EPROBE_DEFER)
++ dev_err(master->dev, "failed to bind %s (ops %ps): %d\n",
++ dev_name(component->dev), component->ops, ret);
+ }
+
+ return ret;
+diff --git a/drivers/dma/owl-dma.c b/drivers/dma/owl-dma.c
+index 7812a6338acd..7ff04bf04b31 100644
+--- a/drivers/dma/owl-dma.c
++++ b/drivers/dma/owl-dma.c
+@@ -172,13 +172,11 @@ struct owl_dma_txd {
+ * @id: physical index to this channel
+ * @base: virtual memory base for the dma channel
+ * @vchan: the virtual channel currently being served by this physical channel
+- * @lock: a lock to use when altering an instance of this struct
+ */
+ struct owl_dma_pchan {
+ u32 id;
+ void __iomem *base;
+ struct owl_dma_vchan *vchan;
+- spinlock_t lock;
+ };
+
+ /**
+@@ -396,14 +394,14 @@ static struct owl_dma_pchan *owl_dma_get_pchan(struct owl_dma *od,
+ for (i = 0; i < od->nr_pchans; i++) {
+ pchan = &od->pchans[i];
+
+- spin_lock_irqsave(&pchan->lock, flags);
++ spin_lock_irqsave(&od->lock, flags);
+ if (!pchan->vchan) {
+ pchan->vchan = vchan;
+- spin_unlock_irqrestore(&pchan->lock, flags);
++ spin_unlock_irqrestore(&od->lock, flags);
+ break;
+ }
+
+- spin_unlock_irqrestore(&pchan->lock, flags);
++ spin_unlock_irqrestore(&od->lock, flags);
+ }
+
+ return pchan;
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index 4f4733d831a1..045351f3549c 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -793,7 +793,7 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ ret = dma_async_device_register(&tdma->dma_dev);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "ADMA registration failed: %d\n", ret);
+- goto irq_dispose;
++ goto rpm_put;
+ }
+
+ ret = of_dma_controller_register(pdev->dev.of_node,
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
+index 3ce77cbad4ae..b3464d2dc2b4 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
+@@ -453,7 +453,7 @@ static const struct etnaviv_pm_domain *pm_domain(const struct etnaviv_gpu *gpu,
+ if (!(gpu->identity.features & meta->feature))
+ continue;
+
+- if (meta->nr_domains < (index - offset)) {
++ if (index - offset >= meta->nr_domains) {
+ offset += meta->nr_domains;
+ continue;
+ }
+diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
+index 3019dbc39aef..83f30d7b6abe 100644
+--- a/drivers/gpu/drm/i915/gvt/display.c
++++ b/drivers/gpu/drm/i915/gvt/display.c
+@@ -206,14 +206,41 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
+ SKL_FUSE_PG_DIST_STATUS(SKL_PG0) |
+ SKL_FUSE_PG_DIST_STATUS(SKL_PG1) |
+ SKL_FUSE_PG_DIST_STATUS(SKL_PG2);
+- vgpu_vreg_t(vgpu, LCPLL1_CTL) |=
+- LCPLL_PLL_ENABLE |
+- LCPLL_PLL_LOCK;
+- vgpu_vreg_t(vgpu, LCPLL2_CTL) |= LCPLL_PLL_ENABLE;
+-
++ /*
++ * Only 1 PIPE enabled in current vGPU display and PIPE_A is
++ * tied to TRANSCODER_A in HW, so it's safe to assume PIPE_A,
++ * TRANSCODER_A can be enabled. PORT_x depends on the input of
++ * setup_virtual_dp_monitor, we can bind DPLL0 to any PORT_x
++ * so we fixed to DPLL0 here.
++ * Setup DPLL0: DP link clk 1620 MHz, non SSC, DP Mode
++ */
++ vgpu_vreg_t(vgpu, DPLL_CTRL1) =
++ DPLL_CTRL1_OVERRIDE(DPLL_ID_SKL_DPLL0);
++ vgpu_vreg_t(vgpu, DPLL_CTRL1) |=
++ DPLL_CTRL1_LINK_RATE(DPLL_CTRL1_LINK_RATE_1620, DPLL_ID_SKL_DPLL0);
++ vgpu_vreg_t(vgpu, LCPLL1_CTL) =
++ LCPLL_PLL_ENABLE | LCPLL_PLL_LOCK;
++ vgpu_vreg_t(vgpu, DPLL_STATUS) = DPLL_LOCK(DPLL_ID_SKL_DPLL0);
++ /*
++ * Golden M/N are calculated based on:
++ * 24 bpp, 4 lanes, 154000 pixel clk (from virtual EDID),
++ * DP link clk 1620 MHz and non-constant_n.
++ * TODO: calculate DP link symbol clk and stream clk m/n.
++ */
++ vgpu_vreg_t(vgpu, PIPE_DATA_M1(TRANSCODER_A)) = 63 << TU_SIZE_SHIFT;
++ vgpu_vreg_t(vgpu, PIPE_DATA_M1(TRANSCODER_A)) |= 0x5b425e;
++ vgpu_vreg_t(vgpu, PIPE_DATA_N1(TRANSCODER_A)) = 0x800000;
++ vgpu_vreg_t(vgpu, PIPE_LINK_M1(TRANSCODER_A)) = 0x3cd6e;
++ vgpu_vreg_t(vgpu, PIPE_LINK_N1(TRANSCODER_A)) = 0x80000;
+ }
+
+ if (intel_vgpu_has_monitor_on_port(vgpu, PORT_B)) {
++ vgpu_vreg_t(vgpu, DPLL_CTRL2) &=
++ ~DPLL_CTRL2_DDI_CLK_OFF(PORT_B);
++ vgpu_vreg_t(vgpu, DPLL_CTRL2) |=
++ DPLL_CTRL2_DDI_CLK_SEL(DPLL_ID_SKL_DPLL0, PORT_B);
++ vgpu_vreg_t(vgpu, DPLL_CTRL2) |=
++ DPLL_CTRL2_DDI_SEL_OVERRIDE(PORT_B);
+ vgpu_vreg_t(vgpu, SFUSE_STRAP) |= SFUSE_STRAP_DDIB_DETECTED;
+ vgpu_vreg_t(vgpu, TRANS_DDI_FUNC_CTL(TRANSCODER_A)) &=
+ ~(TRANS_DDI_BPC_MASK | TRANS_DDI_MODE_SELECT_MASK |
+@@ -234,6 +261,12 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
+ }
+
+ if (intel_vgpu_has_monitor_on_port(vgpu, PORT_C)) {
++ vgpu_vreg_t(vgpu, DPLL_CTRL2) &=
++ ~DPLL_CTRL2_DDI_CLK_OFF(PORT_C);
++ vgpu_vreg_t(vgpu, DPLL_CTRL2) |=
++ DPLL_CTRL2_DDI_CLK_SEL(DPLL_ID_SKL_DPLL0, PORT_C);
++ vgpu_vreg_t(vgpu, DPLL_CTRL2) |=
++ DPLL_CTRL2_DDI_SEL_OVERRIDE(PORT_C);
+ vgpu_vreg_t(vgpu, SDEISR) |= SDE_PORTC_HOTPLUG_CPT;
+ vgpu_vreg_t(vgpu, TRANS_DDI_FUNC_CTL(TRANSCODER_A)) &=
+ ~(TRANS_DDI_BPC_MASK | TRANS_DDI_MODE_SELECT_MASK |
+@@ -254,6 +287,12 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
+ }
+
+ if (intel_vgpu_has_monitor_on_port(vgpu, PORT_D)) {
++ vgpu_vreg_t(vgpu, DPLL_CTRL2) &=
++ ~DPLL_CTRL2_DDI_CLK_OFF(PORT_D);
++ vgpu_vreg_t(vgpu, DPLL_CTRL2) |=
++ DPLL_CTRL2_DDI_CLK_SEL(DPLL_ID_SKL_DPLL0, PORT_D);
++ vgpu_vreg_t(vgpu, DPLL_CTRL2) |=
++ DPLL_CTRL2_DDI_SEL_OVERRIDE(PORT_D);
+ vgpu_vreg_t(vgpu, SDEISR) |= SDE_PORTD_HOTPLUG_CPT;
+ vgpu_vreg_t(vgpu, TRANS_DDI_FUNC_CTL(TRANSCODER_A)) &=
+ ~(TRANS_DDI_BPC_MASK | TRANS_DDI_MODE_SELECT_MASK |
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index 895f49b565ee..3489f0af7409 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -806,6 +806,7 @@ static int alps_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ break;
+ case HID_DEVICE_ID_ALPS_U1_DUAL:
+ case HID_DEVICE_ID_ALPS_U1:
++ case HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY:
+ data->dev_type = U1;
+ break;
+ default:
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index b2fff44c8109..c1fed1aaecdf 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -81,10 +81,10 @@
+ #define HID_DEVICE_ID_ALPS_U1_DUAL_PTP 0x121F
+ #define HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP 0x1220
+ #define HID_DEVICE_ID_ALPS_U1 0x1215
++#define HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY 0x121E
+ #define HID_DEVICE_ID_ALPS_T4_BTNLESS 0x120C
+ #define HID_DEVICE_ID_ALPS_1222 0x1222
+
+-
+ #define USB_VENDOR_ID_AMI 0x046b
+ #define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE 0xff10
+
+@@ -378,6 +378,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002
+
+ #define USB_VENDOR_ID_ELAN 0x04f3
+ #define USB_DEVICE_ID_TOSHIBA_CLICK_L9W 0x0401
+@@ -1063,6 +1064,9 @@
+ #define USB_DEVICE_ID_SYMBOL_SCANNER_2 0x1300
+ #define USB_DEVICE_ID_SYMBOL_SCANNER_3 0x1200
+
++#define I2C_VENDOR_ID_SYNAPTICS 0x06cb
++#define I2C_PRODUCT_ID_SYNAPTICS_SYNA2393 0x7a13
++
+ #define USB_VENDOR_ID_SYNAPTICS 0x06cb
+ #define USB_DEVICE_ID_SYNAPTICS_TP 0x0001
+ #define USB_DEVICE_ID_SYNAPTICS_INT_TP 0x0002
+@@ -1077,6 +1081,7 @@
+ #define USB_DEVICE_ID_SYNAPTICS_LTS2 0x1d10
+ #define USB_DEVICE_ID_SYNAPTICS_HD 0x0ac3
+ #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD 0x1ac3
++#define USB_DEVICE_ID_SYNAPTICS_DELL_K12A 0x2819
+ #define USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012 0x2968
+ #define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 19dfd8acd0da..8baf10beb1d5 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1909,6 +1909,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_EGALAX_SERIAL,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
++ { .driver_data = MT_CLS_EGALAX,
++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) },
+
+ /* Elitegroup panel */
+ { .driver_data = MT_CLS_SERIAL,
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index b9529bed4d76..e5beee3e8582 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -163,6 +163,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103), HID_QUIRK_NO_INIT_REPORTS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DELL_K12A), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TOPMAX, USB_DEVICE_ID_TOPMAX_COBRAPAD), HID_QUIRK_BADPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8882), HID_QUIRK_NOGET },
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index f2c8c59fc582..f17ebbe53abf 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -187,6 +187,8 @@ static const struct i2c_hid_quirks {
+ I2C_HID_QUIRK_BOGUS_IRQ },
+ { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID,
+ I2C_HID_QUIRK_RESET_ON_RESUME },
++ { I2C_VENDOR_ID_SYNAPTICS, I2C_PRODUCT_ID_SYNAPTICS_SYNA2393,
++ I2C_HID_QUIRK_RESET_ON_RESUME },
+ { USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720,
+ I2C_HID_QUIRK_BAD_INPUT_SIZE },
+ { 0, 0 }
+diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
+index cb07651f4b46..cbda91a0cb5f 100644
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -48,7 +48,7 @@
+ struct i2c_dev {
+ struct list_head list;
+ struct i2c_adapter *adap;
+- struct device *dev;
++ struct device dev;
+ struct cdev cdev;
+ };
+
+@@ -92,12 +92,14 @@ static struct i2c_dev *get_free_i2c_dev(struct i2c_adapter *adap)
+ return i2c_dev;
+ }
+
+-static void put_i2c_dev(struct i2c_dev *i2c_dev)
++static void put_i2c_dev(struct i2c_dev *i2c_dev, bool del_cdev)
+ {
+ spin_lock(&i2c_dev_list_lock);
+ list_del(&i2c_dev->list);
+ spin_unlock(&i2c_dev_list_lock);
+- kfree(i2c_dev);
++ if (del_cdev)
++ cdev_device_del(&i2c_dev->cdev, &i2c_dev->dev);
++ put_device(&i2c_dev->dev);
+ }
+
+ static ssize_t name_show(struct device *dev,
+@@ -636,6 +638,14 @@ static const struct file_operations i2cdev_fops = {
+
+ static struct class *i2c_dev_class;
+
++static void i2cdev_dev_release(struct device *dev)
++{
++ struct i2c_dev *i2c_dev;
++
++ i2c_dev = container_of(dev, struct i2c_dev, dev);
++ kfree(i2c_dev);
++}
++
+ static int i2cdev_attach_adapter(struct device *dev, void *dummy)
+ {
+ struct i2c_adapter *adap;
+@@ -652,27 +662,23 @@ static int i2cdev_attach_adapter(struct device *dev, void *dummy)
+
+ cdev_init(&i2c_dev->cdev, &i2cdev_fops);
+ i2c_dev->cdev.owner = THIS_MODULE;
+- res = cdev_add(&i2c_dev->cdev, MKDEV(I2C_MAJOR, adap->nr), 1);
+- if (res)
+- goto error_cdev;
+-
+- /* register this i2c device with the driver core */
+- i2c_dev->dev = device_create(i2c_dev_class, &adap->dev,
+- MKDEV(I2C_MAJOR, adap->nr), NULL,
+- "i2c-%d", adap->nr);
+- if (IS_ERR(i2c_dev->dev)) {
+- res = PTR_ERR(i2c_dev->dev);
+- goto error;
++
++ device_initialize(&i2c_dev->dev);
++ i2c_dev->dev.devt = MKDEV(I2C_MAJOR, adap->nr);
++ i2c_dev->dev.class = i2c_dev_class;
++ i2c_dev->dev.parent = &adap->dev;
++ i2c_dev->dev.release = i2cdev_dev_release;
++ dev_set_name(&i2c_dev->dev, "i2c-%d", adap->nr);
++
++ res = cdev_device_add(&i2c_dev->cdev, &i2c_dev->dev);
++ if (res) {
++ put_i2c_dev(i2c_dev, false);
++ return res;
+ }
+
+ pr_debug("i2c-dev: adapter [%s] registered as minor %d\n",
+ adap->name, adap->nr);
+ return 0;
+-error:
+- cdev_del(&i2c_dev->cdev);
+-error_cdev:
+- put_i2c_dev(i2c_dev);
+- return res;
+ }
+
+ static int i2cdev_detach_adapter(struct device *dev, void *dummy)
+@@ -688,9 +694,7 @@ static int i2cdev_detach_adapter(struct device *dev, void *dummy)
+ if (!i2c_dev) /* attach_adapter must have failed */
+ return 0;
+
+- cdev_del(&i2c_dev->cdev);
+- put_i2c_dev(i2c_dev);
+- device_destroy(i2c_dev_class, MKDEV(I2C_MAJOR, adap->nr));
++ put_i2c_dev(i2c_dev, true);
+
+ pr_debug("i2c-dev: adapter [%s] unregistered\n", adap->name);
+ return 0;
+diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+index 035032e20327..9ba9ce5696e1 100644
+--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+@@ -273,6 +273,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ err_rollback_available:
+ device_remove_file(&pdev->dev, &dev_attr_available_masters);
+ err_rollback:
++ i2c_demux_deactivate_master(priv);
+ for (j = 0; j < i; j++) {
+ of_node_put(priv->chan[j].parent_np);
+ of_changeset_destroy(&priv->chan[j].chgset);
+diff --git a/drivers/iio/accel/sca3000.c b/drivers/iio/accel/sca3000.c
+index 4964561595f5..7218acf1a907 100644
+--- a/drivers/iio/accel/sca3000.c
++++ b/drivers/iio/accel/sca3000.c
+@@ -982,7 +982,7 @@ static int sca3000_read_data(struct sca3000_state *st,
+ st->tx[0] = SCA3000_READ_REG(reg_address_high);
+ ret = spi_sync_transfer(st->us, xfer, ARRAY_SIZE(xfer));
+ if (ret) {
+- dev_err(get_device(&st->us->dev), "problem reading register");
++ dev_err(&st->us->dev, "problem reading register\n");
+ return ret;
+ }
+
+diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
+index 24d5d049567a..59fd8b620c50 100644
+--- a/drivers/iio/adc/stm32-adc.c
++++ b/drivers/iio/adc/stm32-adc.c
+@@ -1682,15 +1682,27 @@ static int stm32_adc_chan_of_init(struct iio_dev *indio_dev)
+ return 0;
+ }
+
+-static int stm32_adc_dma_request(struct iio_dev *indio_dev)
++static int stm32_adc_dma_request(struct device *dev, struct iio_dev *indio_dev)
+ {
+ struct stm32_adc *adc = iio_priv(indio_dev);
+ struct dma_slave_config config;
+ int ret;
+
+- adc->dma_chan = dma_request_slave_channel(&indio_dev->dev, "rx");
+- if (!adc->dma_chan)
++ adc->dma_chan = dma_request_chan(dev, "rx");
++ if (IS_ERR(adc->dma_chan)) {
++ ret = PTR_ERR(adc->dma_chan);
++ if (ret != -ENODEV) {
++ if (ret != -EPROBE_DEFER)
++ dev_err(dev,
++ "DMA channel request failed with %d\n",
++ ret);
++ return ret;
++ }
++
++ /* DMA is optional: fall back to IRQ mode */
++ adc->dma_chan = NULL;
+ return 0;
++ }
+
+ adc->rx_buf = dma_alloc_coherent(adc->dma_chan->device->dev,
+ STM32_DMA_BUFFER_SIZE,
+@@ -1804,7 +1816,7 @@ static int stm32_adc_probe(struct platform_device *pdev)
+ if (ret < 0)
+ goto err_clk_disable;
+
+- ret = stm32_adc_dma_request(indio_dev);
++ ret = stm32_adc_dma_request(dev, indio_dev);
+ if (ret < 0)
+ goto err_clk_disable;
+
+diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
+index f5586dd6414d..1c492a7f4587 100644
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -45,7 +45,7 @@ enum sd_converter_type {
+
+ struct stm32_dfsdm_dev_data {
+ int type;
+- int (*init)(struct iio_dev *indio_dev);
++ int (*init)(struct device *dev, struct iio_dev *indio_dev);
+ unsigned int num_channels;
+ const struct regmap_config *regmap_cfg;
+ };
+@@ -923,7 +923,8 @@ static void stm32_dfsdm_dma_release(struct iio_dev *indio_dev)
+ }
+ }
+
+-static int stm32_dfsdm_dma_request(struct iio_dev *indio_dev)
++static int stm32_dfsdm_dma_request(struct device *dev,
++ struct iio_dev *indio_dev)
+ {
+ struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+ struct dma_slave_config config = {
+@@ -933,9 +934,13 @@ static int stm32_dfsdm_dma_request(struct iio_dev *indio_dev)
+ };
+ int ret;
+
+- adc->dma_chan = dma_request_slave_channel(&indio_dev->dev, "rx");
+- if (!adc->dma_chan)
+- return -EINVAL;
++ adc->dma_chan = dma_request_chan(dev, "rx");
++ if (IS_ERR(adc->dma_chan)) {
++ int ret = PTR_ERR(adc->dma_chan);
++
++ adc->dma_chan = NULL;
++ return ret;
++ }
+
+ adc->rx_buf = dma_alloc_coherent(adc->dma_chan->device->dev,
+ DFSDM_DMA_BUFFER_SIZE,
+@@ -993,7 +998,7 @@ static int stm32_dfsdm_adc_chan_init_one(struct iio_dev *indio_dev,
+ &adc->dfsdm->ch_list[ch->channel]);
+ }
+
+-static int stm32_dfsdm_audio_init(struct iio_dev *indio_dev)
++static int stm32_dfsdm_audio_init(struct device *dev, struct iio_dev *indio_dev)
+ {
+ struct iio_chan_spec *ch;
+ struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+@@ -1023,10 +1028,10 @@ static int stm32_dfsdm_audio_init(struct iio_dev *indio_dev)
+ indio_dev->num_channels = 1;
+ indio_dev->channels = ch;
+
+- return stm32_dfsdm_dma_request(indio_dev);
++ return stm32_dfsdm_dma_request(dev, indio_dev);
+ }
+
+-static int stm32_dfsdm_adc_init(struct iio_dev *indio_dev)
++static int stm32_dfsdm_adc_init(struct device *dev, struct iio_dev *indio_dev)
+ {
+ struct iio_chan_spec *ch;
+ struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+@@ -1170,7 +1175,7 @@ static int stm32_dfsdm_adc_probe(struct platform_device *pdev)
+ adc->dfsdm->fl_list[adc->fl_id].sync_mode = val;
+
+ adc->dev_data = dev_data;
+- ret = dev_data->init(iio);
++ ret = dev_data->init(dev, iio);
+ if (ret < 0)
+ return ret;
+
+diff --git a/drivers/iio/dac/vf610_dac.c b/drivers/iio/dac/vf610_dac.c
+index 5dccdd16cab3..9cf2e2933b66 100644
+--- a/drivers/iio/dac/vf610_dac.c
++++ b/drivers/iio/dac/vf610_dac.c
+@@ -234,6 +234,7 @@ static int vf610_dac_probe(struct platform_device *pdev)
+ return 0;
+
+ error_iio_device_register:
++ vf610_dac_exit(info);
+ clk_disable_unprepare(info->clk);
+
+ return ret;
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 2557ed112bc2..c7d0bb3b4a30 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -1334,8 +1334,8 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ }
+ case IVHD_DEV_ACPI_HID: {
+ u16 devid;
+- u8 hid[ACPIHID_HID_LEN] = {0};
+- u8 uid[ACPIHID_UID_LEN] = {0};
++ u8 hid[ACPIHID_HID_LEN];
++ u8 uid[ACPIHID_UID_LEN];
+ int ret;
+
+ if (h->type != 0x40) {
+@@ -1352,6 +1352,7 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ break;
+ }
+
++ uid[0] = '\0';
+ switch (e->uidf) {
+ case UID_NOT_PRESENT:
+
+@@ -1366,8 +1367,8 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ break;
+ case UID_IS_CHARACTER:
+
+- memcpy(uid, (u8 *)(&e->uid), ACPIHID_UID_LEN - 1);
+- uid[ACPIHID_UID_LEN - 1] = '\0';
++ memcpy(uid, &e->uid, e->uidl);
++ uid[e->uidl] = '\0';
+
+ break;
+ default:
+diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c
+index 8a9c169b6f99..b5eec18ad59a 100644
+--- a/drivers/ipack/carriers/tpci200.c
++++ b/drivers/ipack/carriers/tpci200.c
+@@ -309,6 +309,7 @@ static int tpci200_register(struct tpci200_board *tpci200)
+ "(bn 0x%X, sn 0x%X) failed to map driver user space!",
+ tpci200->info->pdev->bus->number,
+ tpci200->info->pdev->devfn);
++ res = -ENOMEM;
+ goto out_release_mem8_space;
+ }
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 5a30f1d84fe1..2bd5898a6204 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2368,7 +2368,7 @@ static int fdp1_probe(struct platform_device *pdev)
+ dprintk(fdp1, "FDP1 Version R-Car H3\n");
+ break;
+ case FD1_IP_M3N:
+- dprintk(fdp1, "FDP1 Version R-Car M3N\n");
++ dprintk(fdp1, "FDP1 Version R-Car M3-N\n");
+ break;
+ case FD1_IP_E3:
+ dprintk(fdp1, "FDP1 Version R-Car E3\n");
+diff --git a/drivers/misc/cardreader/rtsx_pcr.c b/drivers/misc/cardreader/rtsx_pcr.c
+index da445223f4cc..5c5d0241603a 100644
+--- a/drivers/misc/cardreader/rtsx_pcr.c
++++ b/drivers/misc/cardreader/rtsx_pcr.c
+@@ -155,6 +155,9 @@ static void rtsx_comm_pm_full_on(struct rtsx_pcr *pcr)
+
+ rtsx_disable_aspm(pcr);
+
++ /* Fixes DMA transfer timout issue after disabling ASPM on RTS5260 */
++ msleep(1);
++
+ if (option->ltr_enabled)
+ rtsx_set_ltr_latency(pcr, option->ltr_active_latency);
+
+diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
+index ebdcf0b450e2..524b8c0d371b 100644
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -276,6 +276,7 @@ void mei_me_cl_rm_by_uuid(struct mei_device *dev, const uuid_le *uuid)
+ down_write(&dev->me_clients_rwsem);
+ me_cl = __mei_me_cl_by_uuid(dev, uuid);
+ __mei_me_cl_del(dev, me_cl);
++ mei_me_cl_put(me_cl);
+ up_write(&dev->me_clients_rwsem);
+ }
+
+@@ -297,6 +298,7 @@ void mei_me_cl_rm_by_uuid_id(struct mei_device *dev, const uuid_le *uuid, u8 id)
+ down_write(&dev->me_clients_rwsem);
+ me_cl = __mei_me_cl_by_uuid_id(dev, uuid, id);
+ __mei_me_cl_del(dev, me_cl);
++ mei_me_cl_put(me_cl);
+ up_write(&dev->me_clients_rwsem);
+ }
+
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index a2f38b3b9776..1d61ae7aaa66 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -1045,6 +1045,10 @@ static int spinand_init(struct spinand_device *spinand)
+
+ mtd->oobavail = ret;
+
++ /* Propagate ECC information to mtd_info */
++ mtd->ecc_strength = nand->eccreq.strength;
++ mtd->ecc_step_size = nand->eccreq.step_size;
++
+ return 0;
+
+ err_cleanup_nanddev:
+diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c
+index 7bc96294ae4d..b108e1f04bf6 100644
+--- a/drivers/mtd/ubi/debug.c
++++ b/drivers/mtd/ubi/debug.c
+@@ -405,9 +405,6 @@ static void *eraseblk_count_seq_start(struct seq_file *s, loff_t *pos)
+ {
+ struct ubi_device *ubi = s->private;
+
+- if (*pos == 0)
+- return SEQ_START_TOKEN;
+-
+ if (*pos < ubi->peb_count)
+ return pos;
+
+@@ -421,8 +418,6 @@ static void *eraseblk_count_seq_next(struct seq_file *s, void *v, loff_t *pos)
+ {
+ struct ubi_device *ubi = s->private;
+
+- if (v == SEQ_START_TOKEN)
+- return pos;
+ (*pos)++;
+
+ if (*pos < ubi->peb_count)
+@@ -444,11 +439,8 @@ static int eraseblk_count_seq_show(struct seq_file *s, void *iter)
+ int err;
+
+ /* If this is the start, print a header */
+- if (iter == SEQ_START_TOKEN) {
+- seq_puts(s,
+- "physical_block_number\terase_count\tblock_status\tread_status\n");
+- return 0;
+- }
++ if (*block_number == 0)
++ seq_puts(s, "physical_block_number\terase_count\n");
+
+ err = ubi_io_is_bad(ubi, *block_number);
+ if (err)
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+index 750007513f9d..43dbfb228b0e 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+@@ -60,7 +60,7 @@ static const struct aq_board_revision_s hw_atl_boards[] = {
+ { AQ_DEVICE_ID_D108, AQ_HWREV_2, &hw_atl_ops_b0, &hw_atl_b0_caps_aqc108, },
+ { AQ_DEVICE_ID_D109, AQ_HWREV_2, &hw_atl_ops_b0, &hw_atl_b0_caps_aqc109, },
+
+- { AQ_DEVICE_ID_AQC100, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc107, },
++ { AQ_DEVICE_ID_AQC100, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc100, },
+ { AQ_DEVICE_ID_AQC107, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc107, },
+ { AQ_DEVICE_ID_AQC108, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc108, },
+ { AQ_DEVICE_ID_AQC109, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc109, },
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 89cc146d2c5c..047fc0cf0263 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -3616,36 +3616,6 @@ static int bcmgenet_remove(struct platform_device *pdev)
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+-static int bcmgenet_suspend(struct device *d)
+-{
+- struct net_device *dev = dev_get_drvdata(d);
+- struct bcmgenet_priv *priv = netdev_priv(dev);
+- int ret = 0;
+-
+- if (!netif_running(dev))
+- return 0;
+-
+- netif_device_detach(dev);
+-
+- bcmgenet_netif_stop(dev);
+-
+- if (!device_may_wakeup(d))
+- phy_suspend(dev->phydev);
+-
+- /* Prepare the device for Wake-on-LAN and switch to the slow clock */
+- if (device_may_wakeup(d) && priv->wolopts) {
+- ret = bcmgenet_power_down(priv, GENET_POWER_WOL_MAGIC);
+- clk_prepare_enable(priv->clk_wol);
+- } else if (priv->internal_phy) {
+- ret = bcmgenet_power_down(priv, GENET_POWER_PASSIVE);
+- }
+-
+- /* Turn off the clocks */
+- clk_disable_unprepare(priv->clk);
+-
+- return ret;
+-}
+-
+ static int bcmgenet_resume(struct device *d)
+ {
+ struct net_device *dev = dev_get_drvdata(d);
+@@ -3724,6 +3694,39 @@ out_clk_disable:
+ clk_disable_unprepare(priv->clk);
+ return ret;
+ }
++
++static int bcmgenet_suspend(struct device *d)
++{
++ struct net_device *dev = dev_get_drvdata(d);
++ struct bcmgenet_priv *priv = netdev_priv(dev);
++ int ret = 0;
++
++ if (!netif_running(dev))
++ return 0;
++
++ netif_device_detach(dev);
++
++ bcmgenet_netif_stop(dev);
++
++ if (!device_may_wakeup(d))
++ phy_suspend(dev->phydev);
++
++ /* Prepare the device for Wake-on-LAN and switch to the slow clock */
++ if (device_may_wakeup(d) && priv->wolopts) {
++ ret = bcmgenet_power_down(priv, GENET_POWER_WOL_MAGIC);
++ clk_prepare_enable(priv->clk_wol);
++ } else if (priv->internal_phy) {
++ ret = bcmgenet_power_down(priv, GENET_POWER_PASSIVE);
++ }
++
++ /* Turn off the clocks */
++ clk_disable_unprepare(priv->clk);
++
++ if (ret)
++ bcmgenet_resume(d);
++
++ return ret;
++}
+ #endif /* CONFIG_PM_SLEEP */
+
+ static SIMPLE_DEV_PM_OPS(bcmgenet_pm_ops, bcmgenet_suspend, bcmgenet_resume);
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+index 2fbd027f0148..b3596e0ee47b 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+@@ -186,9 +186,15 @@ void bcmgenet_wol_power_up_cfg(struct bcmgenet_priv *priv,
+ }
+
+ reg = bcmgenet_umac_readl(priv, UMAC_MPD_CTRL);
++ if (!(reg & MPD_EN))
++ return; /* already powered up so skip the rest */
+ reg &= ~MPD_EN;
+ bcmgenet_umac_writel(priv, reg, UMAC_MPD_CTRL);
+
++ reg = bcmgenet_hfb_reg_readl(priv, HFB_CTRL);
++ reg &= ~(RBUF_HFB_EN | RBUF_ACPI_EN);
++ bcmgenet_hfb_reg_writel(priv, reg, HFB_CTRL);
++
+ /* Disable CRC Forward */
+ reg = bcmgenet_umac_readl(priv, UMAC_CMD);
+ reg &= ~CMD_CRC_FWD;
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+index c81d6c330548..9d1d77125826 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -2281,8 +2281,6 @@ static int cxgb_up(struct adapter *adap)
+ #if IS_ENABLED(CONFIG_IPV6)
+ update_clip(adap);
+ #endif
+- /* Initialize hash mac addr list*/
+- INIT_LIST_HEAD(&adap->mac_hlist);
+ return err;
+
+ irq_err:
+@@ -2304,6 +2302,7 @@ static void cxgb_down(struct adapter *adapter)
+
+ t4_sge_stop(adapter);
+ t4_free_sge_resources(adapter);
++
+ adapter->flags &= ~FULL_INIT_DONE;
+ }
+
+@@ -5602,6 +5601,9 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ (is_t5(adapter->params.chip) ? STATMODE_V(0) :
+ T6_STATMODE_V(0)));
+
++ /* Initialize hash mac addr list */
++ INIT_LIST_HEAD(&adapter->mac_hlist);
++
+ for_each_port(adapter, i) {
+ netdev = alloc_etherdev_mq(sizeof(struct port_info),
+ MAX_ETH_QSETS);
+@@ -5876,6 +5878,7 @@ fw_attach_fail:
+ static void remove_one(struct pci_dev *pdev)
+ {
+ struct adapter *adapter = pci_get_drvdata(pdev);
++ struct hash_mac_addr *entry, *tmp;
+
+ if (!adapter) {
+ pci_release_regions(pdev);
+@@ -5923,6 +5926,12 @@ static void remove_one(struct pci_dev *pdev)
+ if (adapter->num_uld || adapter->num_ofld_uld)
+ t4_uld_mem_free(adapter);
+ free_some_resources(adapter);
++ list_for_each_entry_safe(entry, tmp, &adapter->mac_hlist,
++ list) {
++ list_del(&entry->list);
++ kfree(entry);
++ }
++
+ #if IS_ENABLED(CONFIG_IPV6)
+ t4_cleanup_clip_tbl(adapter);
+ #endif
+diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+index 972dc7bd721d..15029a5e62b9 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+@@ -723,9 +723,6 @@ static int adapter_up(struct adapter *adapter)
+ if (adapter->flags & USING_MSIX)
+ name_msix_vecs(adapter);
+
+- /* Initialize hash mac addr list*/
+- INIT_LIST_HEAD(&adapter->mac_hlist);
+-
+ adapter->flags |= FULL_INIT_DONE;
+ }
+
+@@ -3038,6 +3035,9 @@ static int cxgb4vf_pci_probe(struct pci_dev *pdev,
+ if (err)
+ goto err_unmap_bar;
+
++ /* Initialize hash mac addr list */
++ INIT_LIST_HEAD(&adapter->mac_hlist);
++
+ /*
+ * Allocate our "adapter ports" and stitch everything together.
+ */
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 8a1916443235..abfd990ba4d8 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2731,10 +2731,12 @@ static int enable_scrq_irq(struct ibmvnic_adapter *adapter,
+
+ if (adapter->resetting &&
+ adapter->reset_reason == VNIC_RESET_MOBILITY) {
+- struct irq_desc *desc = irq_to_desc(scrq->irq);
+- struct irq_chip *chip = irq_desc_get_chip(desc);
++ u64 val = (0xff000000) | scrq->hw_irq;
+
+- chip->irq_eoi(&desc->irq_data);
++ rc = plpar_hcall_norets(H_EOI, val);
++ if (rc)
++ dev_err(dev, "H_EOI FAILED irq 0x%llx. rc=%ld\n",
++ val, rc);
+ }
+
+ rc = plpar_hcall_norets(H_VIOCTL, adapter->vdev->unit_address,
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 9c7b1d8e8220..c41879a955b5 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3684,7 +3684,7 @@ static int stmmac_set_features(struct net_device *netdev,
+ /**
+ * stmmac_interrupt - main ISR
+ * @irq: interrupt number.
+- * @dev_id: to pass the net device pointer.
++ * @dev_id: to pass the net device pointer (must be valid).
+ * Description: this is the main driver interrupt service routine.
+ * It can call:
+ * o DMA service routine (to manage incoming frame reception and transmission
+@@ -3708,11 +3708,6 @@ static irqreturn_t stmmac_interrupt(int irq, void *dev_id)
+ if (priv->irq_wake)
+ pm_wakeup_event(priv->device, 0);
+
+- if (unlikely(!dev)) {
+- netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__);
+- return IRQ_NONE;
+- }
+-
+ /* Check if adapter is up */
+ if (test_bit(STMMAC_DOWN, &priv->state))
+ return IRQ_HANDLED;
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index eab9984f73a8..d73850ebb671 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -1177,11 +1177,11 @@ out_unlock:
+ static struct genl_family gtp_genl_family;
+
+ static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq,
+- u32 type, struct pdp_ctx *pctx)
++ int flags, u32 type, struct pdp_ctx *pctx)
+ {
+ void *genlh;
+
+- genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, 0,
++ genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, flags,
+ type);
+ if (genlh == NULL)
+ goto nlmsg_failure;
+@@ -1235,8 +1235,8 @@ static int gtp_genl_get_pdp(struct sk_buff *skb, struct genl_info *info)
+ goto err_unlock;
+ }
+
+- err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid,
+- info->snd_seq, info->nlhdr->nlmsg_type, pctx);
++ err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid, info->snd_seq,
++ 0, info->nlhdr->nlmsg_type, pctx);
+ if (err < 0)
+ goto err_unlock_free;
+
+@@ -1279,6 +1279,7 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb,
+ gtp_genl_fill_info(skb,
+ NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq,
++ NLM_F_MULTI,
+ cb->nlh->nlmsg_type, pctx)) {
+ cb->args[0] = i;
+ cb->args[1] = j;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index e0211321fe9e..96870d1b3b73 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1933,6 +1933,8 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
+ if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
+ BRCMF_SDIO_FT_NORMAL)) {
+ rd->len = 0;
++ brcmf_sdio_rxfail(bus, true, true);
++ sdio_release_host(bus->sdiodev->func1);
+ brcmu_pkt_buf_free_skb(pkt);
+ continue;
+ }
+diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
+index 75ae2c508a04..1064a703ccec 100644
+--- a/drivers/nvdimm/btt.c
++++ b/drivers/nvdimm/btt.c
+@@ -541,9 +541,9 @@ static int arena_clear_freelist_error(struct arena_info *arena, u32 lane)
+
+ static int btt_freelist_init(struct arena_info *arena)
+ {
+- int old, new, ret;
+- u32 i, map_entry;
+- struct log_entry log_new, log_old;
++ int new, ret;
++ struct log_entry log_new;
++ u32 i, map_entry, log_oldmap, log_newmap;
+
+ arena->freelist = kcalloc(arena->nfree, sizeof(struct free_entry),
+ GFP_KERNEL);
+@@ -551,24 +551,26 @@ static int btt_freelist_init(struct arena_info *arena)
+ return -ENOMEM;
+
+ for (i = 0; i < arena->nfree; i++) {
+- old = btt_log_read(arena, i, &log_old, LOG_OLD_ENT);
+- if (old < 0)
+- return old;
+-
+ new = btt_log_read(arena, i, &log_new, LOG_NEW_ENT);
+ if (new < 0)
+ return new;
+
++ /* old and new map entries with any flags stripped out */
++ log_oldmap = ent_lba(le32_to_cpu(log_new.old_map));
++ log_newmap = ent_lba(le32_to_cpu(log_new.new_map));
++
+ /* sub points to the next one to be overwritten */
+ arena->freelist[i].sub = 1 - new;
+ arena->freelist[i].seq = nd_inc_seq(le32_to_cpu(log_new.seq));
+- arena->freelist[i].block = le32_to_cpu(log_new.old_map);
++ arena->freelist[i].block = log_oldmap;
+
+ /*
+ * FIXME: if error clearing fails during init, we want to make
+ * the BTT read-only
+ */
+- if (ent_e_flag(log_new.old_map)) {
++ if (ent_e_flag(log_new.old_map) &&
++ !ent_normal(log_new.old_map)) {
++ arena->freelist[i].has_err = 1;
+ ret = arena_clear_freelist_error(arena, i);
+ if (ret)
+ dev_err_ratelimited(to_dev(arena),
+@@ -576,7 +578,7 @@ static int btt_freelist_init(struct arena_info *arena)
+ }
+
+ /* This implies a newly created or untouched flog entry */
+- if (log_new.old_map == log_new.new_map)
++ if (log_oldmap == log_newmap)
+ continue;
+
+ /* Check if map recovery is needed */
+@@ -584,8 +586,15 @@ static int btt_freelist_init(struct arena_info *arena)
+ NULL, NULL, 0);
+ if (ret)
+ return ret;
+- if ((le32_to_cpu(log_new.new_map) != map_entry) &&
+- (le32_to_cpu(log_new.old_map) == map_entry)) {
++
++ /*
++ * The map_entry from btt_read_map is stripped of any flag bits,
++ * so use the stripped out versions from the log as well for
++ * testing whether recovery is needed. For restoration, use the
++ * 'raw' version of the log entries as that captured what we
++ * were going to write originally.
++ */
++ if ((log_newmap != map_entry) && (log_oldmap == map_entry)) {
+ /*
+ * Last transaction wrote the flog, but wasn't able
+ * to complete the map write. So fix up the map.
+diff --git a/drivers/nvdimm/btt.h b/drivers/nvdimm/btt.h
+index db3cb6d4d0d4..ddff49c707b0 100644
+--- a/drivers/nvdimm/btt.h
++++ b/drivers/nvdimm/btt.h
+@@ -44,6 +44,8 @@
+ #define ent_e_flag(ent) (!!(ent & MAP_ERR_MASK))
+ #define ent_z_flag(ent) (!!(ent & MAP_TRIM_MASK))
+ #define set_e_flag(ent) (ent |= MAP_ERR_MASK)
++/* 'normal' is both e and z flags set */
++#define ent_normal(ent) (ent_e_flag(ent) && ent_z_flag(ent))
+
+ enum btt_init_state {
+ INIT_UNCHECKED = 0,
+diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c
+index e341498876ca..9486acc08402 100644
+--- a/drivers/nvdimm/btt_devs.c
++++ b/drivers/nvdimm/btt_devs.c
+@@ -159,11 +159,19 @@ static ssize_t size_show(struct device *dev,
+ }
+ static DEVICE_ATTR_RO(size);
+
++static ssize_t log_zero_flags_show(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ return sprintf(buf, "Y\n");
++}
++static DEVICE_ATTR_RO(log_zero_flags);
++
+ static struct attribute *nd_btt_attributes[] = {
+ &dev_attr_sector_size.attr,
+ &dev_attr_namespace.attr,
+ &dev_attr_uuid.attr,
+ &dev_attr_size.attr,
++ &dev_attr_log_zero_flags.attr,
+ NULL,
+ };
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index 59f3a37a44d7..8db2dc05b8cf 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -517,9 +517,33 @@ static struct asus_wmi_driver asus_nb_wmi_driver = {
+ .detect_quirks = asus_nb_wmi_quirks,
+ };
+
++static const struct dmi_system_id asus_nb_wmi_blacklist[] __initconst = {
++ {
++ /*
++ * asus-nb-wm adds no functionality. The T100TA has a detachable
++ * USB kbd, so no hotkeys and it has no WMI rfkill; and loading
++ * asus-nb-wm causes the camera LED to turn and _stay_ on.
++ */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TA"),
++ },
++ },
++ {
++ /* The Asus T200TA has the same issue as the T100TA */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T200TA"),
++ },
++ },
++ {} /* Terminating entry */
++};
+
+ static int __init asus_nb_wmi_init(void)
+ {
++ if (dmi_check_system(asus_nb_wmi_blacklist))
++ return -ENODEV;
++
+ return asus_wmi_register_driver(&asus_nb_wmi_driver);
+ }
+
+diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
+index fa0bbda4b3f2..5940780648e0 100644
+--- a/drivers/rapidio/devices/rio_mport_cdev.c
++++ b/drivers/rapidio/devices/rio_mport_cdev.c
+@@ -879,6 +879,11 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
+ rmcd_error("pinned %ld out of %ld pages",
+ pinned, nr_pages);
+ ret = -EFAULT;
++ /*
++ * Set nr_pages up to mean "how many pages to unpin, in
++ * the error handler:
++ */
++ nr_pages = pinned;
+ goto err_pg;
+ }
+
+diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
+index e60822f07653..b99ded6b9e0b 100644
+--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
+@@ -2296,16 +2296,12 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+ static int ibmvscsi_remove(struct vio_dev *vdev)
+ {
+ struct ibmvscsi_host_data *hostdata = dev_get_drvdata(&vdev->dev);
+- unsigned long flags;
+
+ srp_remove_host(hostdata->host);
+ scsi_remove_host(hostdata->host);
+
+ purge_requests(hostdata, DID_ERROR);
+-
+- spin_lock_irqsave(hostdata->host->host_lock, flags);
+ release_event_pool(&hostdata->pool, hostdata);
+- spin_unlock_irqrestore(hostdata->host->host_lock, flags);
+
+ ibmvscsi_release_crq_queue(&hostdata->queue, hostdata,
+ max_events);
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index b008d583dd6e..0ab9d2fd4a14 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -2162,11 +2162,11 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
+ test_bit(FCPORT_UPDATE_NEEDED, &vha->dpc_flags))
+ msleep(1000);
+
+- qla_nvme_delete(vha);
+
+ qla24xx_disable_vp(vha);
+ qla2x00_wait_for_sess_deletion(vha);
+
++ qla_nvme_delete(vha);
+ vha->flags.delete_progress = 1;
+
+ qlt_remove_target(ha, vha);
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index bef9faea5eee..ac5d2d34aeea 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -3077,7 +3077,7 @@ qla24xx_abort_command(srb_t *sp)
+ ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x108c,
+ "Entered %s.\n", __func__);
+
+- if (vha->flags.qpairs_available && sp->qpair)
++ if (sp->qpair)
+ req = sp->qpair->req;
+
+ if (ql2xasynctmfenable)
+diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c
+index 8a006323c3c1..f36d470aed24 100644
+--- a/drivers/staging/greybus/uart.c
++++ b/drivers/staging/greybus/uart.c
+@@ -537,9 +537,9 @@ static void gb_tty_set_termios(struct tty_struct *tty,
+ }
+
+ if (C_CRTSCTS(tty) && C_BAUD(tty) != B0)
+- newline.flow_control |= GB_SERIAL_AUTO_RTSCTS_EN;
++ newline.flow_control = GB_SERIAL_AUTO_RTSCTS_EN;
+ else
+- newline.flow_control &= ~GB_SERIAL_AUTO_RTSCTS_EN;
++ newline.flow_control = 0;
+
+ if (memcmp(&gb_tty->line_coding, &newline, sizeof(newline))) {
+ memcpy(&gb_tty->line_coding, &newline, sizeof(newline));
+diff --git a/drivers/staging/iio/resolver/ad2s1210.c b/drivers/staging/iio/resolver/ad2s1210.c
+index ac13b99bd9cb..aca983f34f5e 100644
+--- a/drivers/staging/iio/resolver/ad2s1210.c
++++ b/drivers/staging/iio/resolver/ad2s1210.c
+@@ -114,17 +114,24 @@ static int ad2s1210_config_write(struct ad2s1210_state *st, u8 data)
+ static int ad2s1210_config_read(struct ad2s1210_state *st,
+ unsigned char address)
+ {
+- struct spi_transfer xfer = {
+- .len = 2,
+- .rx_buf = st->rx,
+- .tx_buf = st->tx,
++ struct spi_transfer xfers[] = {
++ {
++ .len = 1,
++ .rx_buf = &st->rx[0],
++ .tx_buf = &st->tx[0],
++ .cs_change = 1,
++ }, {
++ .len = 1,
++ .rx_buf = &st->rx[1],
++ .tx_buf = &st->tx[1],
++ },
+ };
+ int ret = 0;
+
+ ad2s1210_set_mode(MOD_CONFIG, st);
+ st->tx[0] = address | AD2S1210_MSB_IS_HIGH;
+ st->tx[1] = AD2S1210_REG_FAULT;
+- ret = spi_sync_transfer(st->sdev, &xfer, 1);
++ ret = spi_sync_transfer(st->sdev, xfers, 2);
+ if (ret < 0)
+ return ret;
+
+diff --git a/drivers/staging/most/core.c b/drivers/staging/most/core.c
+index 25a077f4ea94..08f60ce6293d 100644
+--- a/drivers/staging/most/core.c
++++ b/drivers/staging/most/core.c
+@@ -1412,7 +1412,7 @@ int most_register_interface(struct most_interface *iface)
+
+ INIT_LIST_HEAD(&iface->p->channel_list);
+ iface->p->dev_id = id;
+- strcpy(iface->p->name, iface->description);
++ strscpy(iface->p->name, iface->description, sizeof(iface->p->name));
+ iface->dev.init_name = iface->p->name;
+ iface->dev.bus = &mc.bus;
+ iface->dev.parent = &mc.dev;
+diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
+index 8490a1b6b615..2b83d8b02f81 100644
+--- a/drivers/thunderbolt/icm.c
++++ b/drivers/thunderbolt/icm.c
+@@ -801,9 +801,11 @@ icm_fr_xdomain_connected(struct tb *tb, const struct icm_pkg_header *hdr)
+ * connected another host to the same port, remove the switch
+ * first.
+ */
+- sw = get_switch_at_route(tb->root_switch, route);
+- if (sw)
++ sw = tb_switch_find_by_route(tb, route);
++ if (sw) {
+ remove_switch(sw);
++ tb_switch_put(sw);
++ }
+
+ sw = tb_switch_find_by_link_depth(tb, link, depth);
+ if (!sw) {
+@@ -1146,9 +1148,11 @@ icm_tr_xdomain_connected(struct tb *tb, const struct icm_pkg_header *hdr)
+ * connected another host to the same port, remove the switch
+ * first.
+ */
+- sw = get_switch_at_route(tb->root_switch, route);
+- if (sw)
++ sw = tb_switch_find_by_route(tb, route);
++ if (sw) {
+ remove_switch(sw);
++ tb_switch_put(sw);
++ }
+
+ sw = tb_switch_find_by_route(tb, get_parent_route(route));
+ if (!sw) {
+diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
+index 42d90ceec279..010a50ac4881 100644
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -664,24 +664,6 @@ int tb_switch_reset(struct tb *tb, u64 route)
+ return res.err;
+ }
+
+-struct tb_switch *get_switch_at_route(struct tb_switch *sw, u64 route)
+-{
+- u8 next_port = route; /*
+- * Routes use a stride of 8 bits,
+- * eventhough a port index has 6 bits at most.
+- * */
+- if (route == 0)
+- return sw;
+- if (next_port > sw->config.max_port_number)
+- return NULL;
+- if (tb_is_upstream_port(&sw->ports[next_port]))
+- return NULL;
+- if (!sw->ports[next_port].remote)
+- return NULL;
+- return get_switch_at_route(sw->ports[next_port].remote->sw,
+- route >> TB_ROUTE_SHIFT);
+-}
+-
+ /**
+ * tb_plug_events_active() - enable/disable plug events on a switch
+ *
+diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
+index 1424581fd9af..146f261bf2c3 100644
+--- a/drivers/thunderbolt/tb.c
++++ b/drivers/thunderbolt/tb.c
+@@ -258,7 +258,7 @@ static void tb_handle_hotplug(struct work_struct *work)
+ if (!tcm->hotplug_active)
+ goto out; /* during init, suspend or shutdown */
+
+- sw = get_switch_at_route(tb->root_switch, ev->route);
++ sw = tb_switch_find_by_route(tb, ev->route);
+ if (!sw) {
+ tb_warn(tb,
+ "hotplug event from non existent switch %llx:%x (unplug: %d)\n",
+@@ -269,14 +269,14 @@ static void tb_handle_hotplug(struct work_struct *work)
+ tb_warn(tb,
+ "hotplug event from non existent port %llx:%x (unplug: %d)\n",
+ ev->route, ev->port, ev->unplug);
+- goto out;
++ goto put_sw;
+ }
+ port = &sw->ports[ev->port];
+ if (tb_is_upstream_port(port)) {
+ tb_warn(tb,
+ "hotplug event for upstream port %llx:%x (unplug: %d)\n",
+ ev->route, ev->port, ev->unplug);
+- goto out;
++ goto put_sw;
+ }
+ if (ev->unplug) {
+ if (port->remote) {
+@@ -306,6 +306,9 @@ static void tb_handle_hotplug(struct work_struct *work)
+ tb_activate_pcie_devices(tb);
+ }
+ }
++
++put_sw:
++ tb_switch_put(sw);
+ out:
+ mutex_unlock(&tb->lock);
+ kfree(ev);
+diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h
+index 7a0ee9836a8a..d927cf7b14d2 100644
+--- a/drivers/thunderbolt/tb.h
++++ b/drivers/thunderbolt/tb.h
+@@ -397,7 +397,6 @@ void tb_switch_suspend(struct tb_switch *sw);
+ int tb_switch_resume(struct tb_switch *sw);
+ int tb_switch_reset(struct tb *tb, u64 route);
+ void tb_sw_set_unplugged(struct tb_switch *sw);
+-struct tb_switch *get_switch_at_route(struct tb_switch *sw, u64 route);
+ struct tb_switch *tb_switch_find_by_link_depth(struct tb *tb, u8 link,
+ u8 depth);
+ struct tb_switch *tb_switch_find_by_uuid(struct tb *tb, const uuid_t *uuid);
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 4458419f053b..0d405cc58e72 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -705,7 +705,7 @@ static void qcom_geni_serial_handle_tx(struct uart_port *uport, bool done,
+ avail *= port->tx_bytes_pw;
+
+ tail = xmit->tail;
+- chunk = min3(avail, pending, (size_t)(UART_XMIT_SIZE - tail));
++ chunk = min(avail, pending);
+ if (!chunk)
+ goto out_write_wakeup;
+
+@@ -727,19 +727,21 @@ static void qcom_geni_serial_handle_tx(struct uart_port *uport, bool done,
+
+ memset(buf, 0, ARRAY_SIZE(buf));
+ tx_bytes = min_t(size_t, remaining, port->tx_bytes_pw);
+- for (c = 0; c < tx_bytes ; c++)
+- buf[c] = xmit->buf[tail + c];
++
++ for (c = 0; c < tx_bytes ; c++) {
++ buf[c] = xmit->buf[tail++];
++ tail &= UART_XMIT_SIZE - 1;
++ }
+
+ iowrite32_rep(uport->membase + SE_GENI_TX_FIFOn, buf, 1);
+
+ i += tx_bytes;
+- tail += tx_bytes;
+ uport->icount.tx += tx_bytes;
+ remaining -= tx_bytes;
+ port->tx_remaining -= tx_bytes;
+ }
+
+- xmit->tail = tail & (UART_XMIT_SIZE - 1);
++ xmit->tail = tail;
+
+ /*
+ * The tx fifo watermark is level triggered and latched. Though we had
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index fcf84bfc08e3..f705ea52eb97 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1143,11 +1143,11 @@ void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr,
+
+ if (usb_endpoint_out(epaddr)) {
+ ep = dev->ep_out[epnum];
+- if (reset_hardware)
++ if (reset_hardware && epnum != 0)
+ dev->ep_out[epnum] = NULL;
+ } else {
+ ep = dev->ep_in[epnum];
+- if (reset_hardware)
++ if (reset_hardware && epnum != 0)
+ dev->ep_in[epnum] = NULL;
+ }
+ if (ep) {
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index bac1365cc81b..7891bd40ebd8 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -182,14 +182,14 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
+ break;
+ }
+
+- vhost_add_used(vq, head, sizeof(pkt->hdr) + payload_len);
+- added = true;
+-
+- /* Deliver to monitoring devices all correctly transmitted
+- * packets.
++ /* Deliver to monitoring devices all packets that we
++ * will transmit.
+ */
+ virtio_transport_deliver_tap_pkt(pkt);
+
++ vhost_add_used(vq, head, sizeof(pkt->hdr) + payload_len);
++ added = true;
++
+ pkt->off += payload_len;
+ total_len += payload_len;
+
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 5241102b81a8..a2d4eed27f80 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -3632,6 +3632,7 @@ retry:
+ WARN_ON(1);
+ tsession = NULL;
+ target = -1;
++ mutex_lock(&session->s_mutex);
+ }
+ goto retry;
+
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index 2cc6b1c49d34..f9628fc20fec 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -1537,6 +1537,7 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry)
+ spin_lock(&configfs_dirent_lock);
+ configfs_detach_rollback(dentry);
+ spin_unlock(&configfs_dirent_lock);
++ config_item_put(parent_item);
+ return -EINTR;
+ }
+ frag->frag_dead = true;
+diff --git a/fs/file.c b/fs/file.c
+index 780d29e58847..3762a3f136fd 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -70,7 +70,7 @@ static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt,
+ */
+ static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt)
+ {
+- unsigned int cpy, set;
++ size_t cpy, set;
+
+ BUG_ON(nfdt->max_fds < ofdt->max_fds);
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index f8a5eef3d014..ccdd8c821abd 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -636,9 +636,6 @@ __acquires(&gl->gl_lockref.lock)
+ goto out_unlock;
+ if (nonblock)
+ goto out_sched;
+- smp_mb();
+- if (atomic_read(&gl->gl_revokes) != 0)
+- goto out_sched;
+ set_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
+ GLOCK_BUG_ON(gl, gl->gl_demote_state == LM_ST_EXCLUSIVE);
+ gl->gl_target = gl->gl_demote_state;
+diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
+index 65b4f63349c7..d7d2fdda4bbd 100644
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -1391,7 +1391,6 @@ int ubifs_update_time(struct inode *inode, struct timespec64 *time,
+ struct ubifs_info *c = inode->i_sb->s_fs_info;
+ struct ubifs_budget_req req = { .dirtied_ino = 1,
+ .dirtied_ino_d = ALIGN(ui->data_len, 8) };
+- int iflags = I_DIRTY_TIME;
+ int err, release;
+
+ err = ubifs_budget_space(c, &req);
+@@ -1406,11 +1405,8 @@ int ubifs_update_time(struct inode *inode, struct timespec64 *time,
+ if (flags & S_MTIME)
+ inode->i_mtime = *time;
+
+- if (!(inode->i_sb->s_flags & SB_LAZYTIME))
+- iflags |= I_DIRTY_SYNC;
+-
+ release = ui->dirty;
+- __mark_inode_dirty(inode, iflags);
++ __mark_inode_dirty(inode, I_DIRTY_SYNC);
+ mutex_unlock(&ui->ui_mutex);
+ if (release)
+ ubifs_release_budget(c, &req);
+diff --git a/include/linux/padata.h b/include/linux/padata.h
+index 5d13d25da2c8..d803397a28f7 100644
+--- a/include/linux/padata.h
++++ b/include/linux/padata.h
+@@ -24,7 +24,6 @@
+ #include <linux/workqueue.h>
+ #include <linux/spinlock.h>
+ #include <linux/list.h>
+-#include <linux/timer.h>
+ #include <linux/notifier.h>
+ #include <linux/kobject.h>
+
+@@ -85,18 +84,14 @@ struct padata_serial_queue {
+ * @serial: List to wait for serialization after reordering.
+ * @pwork: work struct for parallelization.
+ * @swork: work struct for serialization.
+- * @pd: Backpointer to the internal control structure.
+ * @work: work struct for parallelization.
+- * @reorder_work: work struct for reordering.
+ * @num_obj: Number of objects that are processed by this cpu.
+ * @cpu_index: Index of the cpu.
+ */
+ struct padata_parallel_queue {
+ struct padata_list parallel;
+ struct padata_list reorder;
+- struct parallel_data *pd;
+ struct work_struct work;
+- struct work_struct reorder_work;
+ atomic_t num_obj;
+ int cpu_index;
+ };
+@@ -122,10 +117,10 @@ struct padata_cpumask {
+ * @reorder_objects: Number of objects waiting in the reorder queues.
+ * @refcnt: Number of objects holding a reference on this parallel_data.
+ * @max_seq_nr: Maximal used sequence number.
++ * @cpu: Next CPU to be processed.
+ * @cpumask: The cpumasks in use for parallel and serial workers.
++ * @reorder_work: work struct for reordering.
+ * @lock: Reorder lock.
+- * @processed: Number of already processed objects.
+- * @timer: Reorder timer.
+ */
+ struct parallel_data {
+ struct padata_instance *pinst;
+@@ -134,10 +129,10 @@ struct parallel_data {
+ atomic_t reorder_objects;
+ atomic_t refcnt;
+ atomic_t seq_nr;
++ int cpu;
+ struct padata_cpumask cpumask;
++ struct work_struct reorder_work;
+ spinlock_t lock ____cacheline_aligned;
+- unsigned int processed;
+- struct timer_list timer;
+ };
+
+ /**
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index 0924119bcfa4..bc5b232440b6 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -1549,6 +1549,41 @@ TRACE_EVENT(rxrpc_notify_socket,
+ __entry->serial)
+ );
+
++TRACE_EVENT(rxrpc_rx_discard_ack,
++ TP_PROTO(unsigned int debug_id, rxrpc_serial_t serial,
++ rxrpc_seq_t first_soft_ack, rxrpc_seq_t call_ackr_first,
++ rxrpc_seq_t prev_pkt, rxrpc_seq_t call_ackr_prev),
++
++ TP_ARGS(debug_id, serial, first_soft_ack, call_ackr_first,
++ prev_pkt, call_ackr_prev),
++
++ TP_STRUCT__entry(
++ __field(unsigned int, debug_id )
++ __field(rxrpc_serial_t, serial )
++ __field(rxrpc_seq_t, first_soft_ack)
++ __field(rxrpc_seq_t, call_ackr_first)
++ __field(rxrpc_seq_t, prev_pkt)
++ __field(rxrpc_seq_t, call_ackr_prev)
++ ),
++
++ TP_fast_assign(
++ __entry->debug_id = debug_id;
++ __entry->serial = serial;
++ __entry->first_soft_ack = first_soft_ack;
++ __entry->call_ackr_first = call_ackr_first;
++ __entry->prev_pkt = prev_pkt;
++ __entry->call_ackr_prev = call_ackr_prev;
++ ),
++
++ TP_printk("c=%08x r=%08x %08x<%08x %08x<%08x",
++ __entry->debug_id,
++ __entry->serial,
++ __entry->first_soft_ack,
++ __entry->call_ackr_first,
++ __entry->prev_pkt,
++ __entry->call_ackr_prev)
++ );
++
+ #endif /* _TRACE_RXRPC_H */
+
+ /* This part must be outside protection */
+diff --git a/include/uapi/linux/ndctl.h b/include/uapi/linux/ndctl.h
+index 2f2c43d633c5..7b0189d6dfa9 100644
+--- a/include/uapi/linux/ndctl.h
++++ b/include/uapi/linux/ndctl.h
+@@ -247,6 +247,7 @@ struct nd_cmd_pkg {
+ #define NVDIMM_FAMILY_HPE1 1
+ #define NVDIMM_FAMILY_HPE2 2
+ #define NVDIMM_FAMILY_MSFT 3
++#define NVDIMM_FAMILY_HYPERV 4
+
+ #define ND_IOCTL_CALL _IOWR(ND_IOCTL, ND_CMD_CALL,\
+ struct nd_cmd_pkg)
+diff --git a/kernel/padata.c b/kernel/padata.c
+index c280cb153915..93e4fb2d9f2e 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -167,23 +167,12 @@ EXPORT_SYMBOL(padata_do_parallel);
+ */
+ static struct padata_priv *padata_get_next(struct parallel_data *pd)
+ {
+- int cpu, num_cpus;
+- unsigned int next_nr, next_index;
+ struct padata_parallel_queue *next_queue;
+ struct padata_priv *padata;
+ struct padata_list *reorder;
++ int cpu = pd->cpu;
+
+- num_cpus = cpumask_weight(pd->cpumask.pcpu);
+-
+- /*
+- * Calculate the percpu reorder queue and the sequence
+- * number of the next object.
+- */
+- next_nr = pd->processed;
+- next_index = next_nr % num_cpus;
+- cpu = padata_index_to_cpu(pd, next_index);
+ next_queue = per_cpu_ptr(pd->pqueue, cpu);
+-
+ reorder = &next_queue->reorder;
+
+ spin_lock(&reorder->lock);
+@@ -194,7 +183,8 @@ static struct padata_priv *padata_get_next(struct parallel_data *pd)
+ list_del_init(&padata->list);
+ atomic_dec(&pd->reorder_objects);
+
+- pd->processed++;
++ pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1,
++ false);
+
+ spin_unlock(&reorder->lock);
+ goto out;
+@@ -217,6 +207,7 @@ static void padata_reorder(struct parallel_data *pd)
+ struct padata_priv *padata;
+ struct padata_serial_queue *squeue;
+ struct padata_instance *pinst = pd->pinst;
++ struct padata_parallel_queue *next_queue;
+
+ /*
+ * We need to ensure that only one cpu can work on dequeueing of
+@@ -248,7 +239,6 @@ static void padata_reorder(struct parallel_data *pd)
+ * so exit immediately.
+ */
+ if (PTR_ERR(padata) == -ENODATA) {
+- del_timer(&pd->timer);
+ spin_unlock_bh(&pd->lock);
+ return;
+ }
+@@ -267,70 +257,29 @@ static void padata_reorder(struct parallel_data *pd)
+
+ /*
+ * The next object that needs serialization might have arrived to
+- * the reorder queues in the meantime, we will be called again
+- * from the timer function if no one else cares for it.
++ * the reorder queues in the meantime.
+ *
+- * Ensure reorder_objects is read after pd->lock is dropped so we see
+- * an increment from another task in padata_do_serial. Pairs with
++ * Ensure reorder queue is read after pd->lock is dropped so we see
++ * new objects from another task in padata_do_serial. Pairs with
+ * smp_mb__after_atomic in padata_do_serial.
+ */
+ smp_mb();
+- if (atomic_read(&pd->reorder_objects)
+- && !(pinst->flags & PADATA_RESET))
+- mod_timer(&pd->timer, jiffies + HZ);
+- else
+- del_timer(&pd->timer);
+
+- return;
++ next_queue = per_cpu_ptr(pd->pqueue, pd->cpu);
++ if (!list_empty(&next_queue->reorder.list))
++ queue_work(pinst->wq, &pd->reorder_work);
+ }
+
+ static void invoke_padata_reorder(struct work_struct *work)
+ {
+- struct padata_parallel_queue *pqueue;
+ struct parallel_data *pd;
+
+ local_bh_disable();
+- pqueue = container_of(work, struct padata_parallel_queue, reorder_work);
+- pd = pqueue->pd;
++ pd = container_of(work, struct parallel_data, reorder_work);
+ padata_reorder(pd);
+ local_bh_enable();
+ }
+
+-static void padata_reorder_timer(struct timer_list *t)
+-{
+- struct parallel_data *pd = from_timer(pd, t, timer);
+- unsigned int weight;
+- int target_cpu, cpu;
+-
+- cpu = get_cpu();
+-
+- /* We don't lock pd here to not interfere with parallel processing
+- * padata_reorder() calls on other CPUs. We just need any CPU out of
+- * the cpumask.pcpu set. It would be nice if it's the right one but
+- * it doesn't matter if we're off to the next one by using an outdated
+- * pd->processed value.
+- */
+- weight = cpumask_weight(pd->cpumask.pcpu);
+- target_cpu = padata_index_to_cpu(pd, pd->processed % weight);
+-
+- /* ensure to call the reorder callback on the correct CPU */
+- if (cpu != target_cpu) {
+- struct padata_parallel_queue *pqueue;
+- struct padata_instance *pinst;
+-
+- /* The timer function is serialized wrt itself -- no locking
+- * needed.
+- */
+- pinst = pd->pinst;
+- pqueue = per_cpu_ptr(pd->pqueue, target_cpu);
+- queue_work_on(target_cpu, pinst->wq, &pqueue->reorder_work);
+- } else {
+- padata_reorder(pd);
+- }
+-
+- put_cpu();
+-}
+-
+ static void padata_serial_worker(struct work_struct *serial_work)
+ {
+ struct padata_serial_queue *squeue;
+@@ -375,47 +324,23 @@ static void padata_serial_worker(struct work_struct *serial_work)
+ */
+ void padata_do_serial(struct padata_priv *padata)
+ {
+- int cpu;
+- struct padata_parallel_queue *pqueue;
+- struct parallel_data *pd;
+- int reorder_via_wq = 0;
+-
+- pd = padata->pd;
+-
+- cpu = get_cpu();
+-
+- /* We need to run on the same CPU padata_do_parallel(.., padata, ..)
+- * was called on -- or, at least, enqueue the padata object into the
+- * correct per-cpu queue.
+- */
+- if (cpu != padata->cpu) {
+- reorder_via_wq = 1;
+- cpu = padata->cpu;
+- }
+-
+- pqueue = per_cpu_ptr(pd->pqueue, cpu);
++ struct parallel_data *pd = padata->pd;
++ struct padata_parallel_queue *pqueue = per_cpu_ptr(pd->pqueue,
++ padata->cpu);
+
+ spin_lock(&pqueue->reorder.lock);
+- atomic_inc(&pd->reorder_objects);
+ list_add_tail(&padata->list, &pqueue->reorder.list);
++ atomic_inc(&pd->reorder_objects);
+ spin_unlock(&pqueue->reorder.lock);
+
+ /*
+- * Ensure the atomic_inc of reorder_objects above is ordered correctly
++ * Ensure the addition to the reorder list is ordered correctly
+ * with the trylock of pd->lock in padata_reorder. Pairs with smp_mb
+ * in padata_reorder.
+ */
+ smp_mb__after_atomic();
+
+- put_cpu();
+-
+- /* If we're running on the wrong CPU, call padata_reorder() via a
+- * kernel worker.
+- */
+- if (reorder_via_wq)
+- queue_work_on(cpu, pd->pinst->wq, &pqueue->reorder_work);
+- else
+- padata_reorder(pd);
++ padata_reorder(pd);
+ }
+ EXPORT_SYMBOL(padata_do_serial);
+
+@@ -471,14 +396,12 @@ static void padata_init_pqueues(struct parallel_data *pd)
+ continue;
+ }
+
+- pqueue->pd = pd;
+ pqueue->cpu_index = cpu_index;
+ cpu_index++;
+
+ __padata_list_init(&pqueue->reorder);
+ __padata_list_init(&pqueue->parallel);
+ INIT_WORK(&pqueue->work, padata_parallel_worker);
+- INIT_WORK(&pqueue->reorder_work, invoke_padata_reorder);
+ atomic_set(&pqueue->num_obj, 0);
+ }
+ }
+@@ -506,12 +429,13 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,
+
+ padata_init_pqueues(pd);
+ padata_init_squeues(pd);
+- timer_setup(&pd->timer, padata_reorder_timer, 0);
+ atomic_set(&pd->seq_nr, -1);
+ atomic_set(&pd->reorder_objects, 0);
+ atomic_set(&pd->refcnt, 1);
+ pd->pinst = pinst;
+ spin_lock_init(&pd->lock);
++ pd->cpu = cpumask_first(pd->cpumask.pcpu);
++ INIT_WORK(&pd->reorder_work, invoke_padata_reorder);
+
+ return pd;
+
+diff --git a/lib/Makefile b/lib/Makefile
+index 0ab808318202..1d7a705d7207 100644
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -269,6 +269,8 @@ obj-$(CONFIG_UCS2_STRING) += ucs2_string.o
+ obj-$(CONFIG_UBSAN) += ubsan.o
+
+ UBSAN_SANITIZE_ubsan.o := n
++KASAN_SANITIZE_ubsan.o := n
++CFLAGS_ubsan.o := $(call cc-option, -fno-stack-protector) $(DISABLE_STACKLEAK_PLUGIN)
+
+ obj-$(CONFIG_SBITMAP) += sbitmap.o
+
+diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
+index d9beb28fc32f..e65b230fce4c 100644
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -814,6 +814,30 @@ static void rxrpc_input_soft_acks(struct rxrpc_call *call, u8 *acks,
+ }
+ }
+
++/*
++ * Return true if the ACK is valid - ie. it doesn't appear to have regressed
++ * with respect to the ack state conveyed by preceding ACKs.
++ */
++static bool rxrpc_is_ack_valid(struct rxrpc_call *call,
++ rxrpc_seq_t first_pkt, rxrpc_seq_t prev_pkt)
++{
++ rxrpc_seq_t base = READ_ONCE(call->ackr_first_seq);
++
++ if (after(first_pkt, base))
++ return true; /* The window advanced */
++
++ if (before(first_pkt, base))
++ return false; /* firstPacket regressed */
++
++ if (after_eq(prev_pkt, call->ackr_prev_seq))
++ return true; /* previousPacket hasn't regressed. */
++
++ /* Some rx implementations put a serial number in previousPacket. */
++ if (after_eq(prev_pkt, base + call->tx_winsize))
++ return false;
++ return true;
++}
++
+ /*
+ * Process an ACK packet.
+ *
+@@ -878,9 +902,12 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+ }
+
+ /* Discard any out-of-order or duplicate ACKs (outside lock). */
+- if (before(first_soft_ack, call->ackr_first_seq) ||
+- before(prev_pkt, call->ackr_prev_seq))
++ if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) {
++ trace_rxrpc_rx_discard_ack(call->debug_id, sp->hdr.serial,
++ first_soft_ack, call->ackr_first_seq,
++ prev_pkt, call->ackr_prev_seq);
+ return;
++ }
+
+ buf.info.rxMTU = 0;
+ ioffset = offset + nr_acks + 3;
+@@ -891,9 +918,12 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+ spin_lock(&call->input_lock);
+
+ /* Discard any out-of-order or duplicate ACKs (inside lock). */
+- if (before(first_soft_ack, call->ackr_first_seq) ||
+- before(prev_pkt, call->ackr_prev_seq))
++ if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) {
++ trace_rxrpc_rx_discard_ack(call->debug_id, sp->hdr.serial,
++ first_soft_ack, call->ackr_first_seq,
++ prev_pkt, call->ackr_prev_seq);
+ goto out;
++ }
+ call->acks_latest_ts = skb->tstamp;
+ call->acks_latest = sp->hdr.serial;
+
+diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
+index cea16838d588..dce7bdc73de4 100644
+--- a/net/rxrpc/rxkad.c
++++ b/net/rxrpc/rxkad.c
+@@ -1118,7 +1118,7 @@ static int rxkad_verify_response(struct rxrpc_connection *conn,
+ ret = rxkad_decrypt_ticket(conn, skb, ticket, ticket_len, &session_key,
+ &expiry, _abort_code);
+ if (ret < 0)
+- goto temporary_error_free_resp;
++ goto temporary_error_free_ticket;
+
+ /* use the session key from inside the ticket to decrypt the
+ * response */
+@@ -1200,7 +1200,6 @@ protocol_error:
+
+ temporary_error_free_ticket:
+ kfree(ticket);
+-temporary_error_free_resp:
+ kfree(response);
+ temporary_error:
+ /* Ignore the response packet if we got a temporary error such as
+diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile
+index aa0d0ec6936d..9e95862f2788 100644
+--- a/scripts/gcc-plugins/Makefile
++++ b/scripts/gcc-plugins/Makefile
+@@ -11,6 +11,7 @@ else
+ HOST_EXTRACXXFLAGS += -I$(GCC_PLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti
+ HOST_EXTRACXXFLAGS += -fno-exceptions -fasynchronous-unwind-tables -ggdb
+ HOST_EXTRACXXFLAGS += -Wno-narrowing -Wno-unused-variable
++ HOST_EXTRACXXFLAGS += -Wno-format-diag
+ export HOST_EXTRACXXFLAGS
+ endif
+
+diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h
+index 17f06079a712..9ad76b7f3f10 100644
+--- a/scripts/gcc-plugins/gcc-common.h
++++ b/scripts/gcc-plugins/gcc-common.h
+@@ -35,7 +35,9 @@
+ #include "ggc.h"
+ #include "timevar.h"
+
++#if BUILDING_GCC_VERSION < 10000
+ #include "params.h"
++#endif
+
+ #if BUILDING_GCC_VERSION <= 4009
+ #include "pointer-set.h"
+@@ -847,6 +849,7 @@ static inline gimple gimple_build_assign_with_ops(enum tree_code subcode, tree l
+ return gimple_build_assign(lhs, subcode, op1, op2 PASS_MEM_STAT);
+ }
+
++#if BUILDING_GCC_VERSION < 10000
+ template <>
+ template <>
+ inline bool is_a_helper<const ggoto *>::test(const_gimple gs)
+@@ -860,6 +863,7 @@ inline bool is_a_helper<const greturn *>::test(const_gimple gs)
+ {
+ return gs->code == GIMPLE_RETURN;
+ }
++#endif
+
+ static inline gasm *as_a_gasm(gimple stmt)
+ {
+diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
+index 0a57d105cc5b..1ec1e928cc09 100644
+--- a/security/apparmor/apparmorfs.c
++++ b/security/apparmor/apparmorfs.c
+@@ -424,7 +424,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
+ */
+ error = aa_may_manage_policy(label, ns, mask);
+ if (error)
+- return error;
++ goto end_section;
+
+ data = aa_simple_write_to_buffer(buf, size, size, pos);
+ error = PTR_ERR(data);
+@@ -432,6 +432,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
+ error = aa_replace_profiles(ns, label, mask, data);
+ aa_put_loaddata(data);
+ }
++end_section:
+ end_current_label_crit_section(label);
+
+ return error;
+diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c
+index eeaddfe0c0fb..70b9730c0be6 100644
+--- a/security/apparmor/audit.c
++++ b/security/apparmor/audit.c
+@@ -201,8 +201,9 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
+ rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
+ GFP_KERNEL, true, false);
+ if (IS_ERR(rule->label)) {
++ int err = PTR_ERR(rule->label);
+ aa_audit_rule_free(rule);
+- return PTR_ERR(rule->label);
++ return err;
+ }
+
+ *vrule = rule;
+diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
+index bdf9e4cefe25..b9d5b3459705 100644
+--- a/security/apparmor/domain.c
++++ b/security/apparmor/domain.c
+@@ -1338,6 +1338,7 @@ int aa_change_profile(const char *fqname, int flags)
+ ctx->nnp = aa_get_label(label);
+
+ if (!fqname || !*fqname) {
++ aa_put_label(label);
+ AA_DEBUG("no profile name");
+ return -EINVAL;
+ }
+@@ -1356,8 +1357,6 @@ int aa_change_profile(const char *fqname, int flags)
+ op = OP_CHANGE_PROFILE;
+ }
+
+- label = aa_get_current_label();
+-
+ if (*fqname == '&') {
+ stack = true;
+ /* don't have label_parse() do stacking */
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index 6a314fb0d480..f0878d81dcef 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -96,7 +96,7 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
+ algo = hash_algo_name[hash_algo];
+ }
+
+- if (*tfm == NULL) {
++ if (IS_ERR_OR_NULL(*tfm)) {
+ mutex_lock(&mutex);
+ if (*tfm)
+ goto out;
+diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
+index f63b4bd45d60..6a6d19ada66a 100644
+--- a/security/integrity/ima/ima_crypto.c
++++ b/security/integrity/ima/ima_crypto.c
+@@ -415,7 +415,7 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ loff_t i_size;
+ int rc;
+ struct file *f = file;
+- bool new_file_instance = false, modified_flags = false;
++ bool new_file_instance = false, modified_mode = false;
+
+ /*
+ * For consistency, fail file's opened with the O_DIRECT flag on
+@@ -435,13 +435,13 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ f = dentry_open(&file->f_path, flags, file->f_cred);
+ if (IS_ERR(f)) {
+ /*
+- * Cannot open the file again, lets modify f_flags
++ * Cannot open the file again, lets modify f_mode
+ * of original and continue
+ */
+ pr_info_ratelimited("Unable to reopen file for reading.\n");
+ f = file;
+- f->f_flags |= FMODE_READ;
+- modified_flags = true;
++ f->f_mode |= FMODE_READ;
++ modified_mode = true;
+ } else {
+ new_file_instance = true;
+ }
+@@ -459,8 +459,8 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ out:
+ if (new_file_instance)
+ fput(f);
+- else if (modified_flags)
+- f->f_flags &= ~FMODE_READ;
++ else if (modified_mode)
++ f->f_mode &= ~FMODE_READ;
+ return rc;
+ }
+
+diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
+index cfb8cc3b975e..604cdac63d84 100644
+--- a/security/integrity/ima/ima_fs.c
++++ b/security/integrity/ima/ima_fs.c
+@@ -343,8 +343,7 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf,
+ integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
+ "policy_update", "signed policy required",
+ 1, 0);
+- if (ima_appraise & IMA_APPRAISE_ENFORCE)
+- result = -EACCES;
++ result = -EACCES;
+ } else {
+ result = ima_parse_add_rule(data);
+ }
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index ad52126d3d22..56295936387c 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -438,6 +438,7 @@ static int snd_pcm_update_hw_ptr0(struct snd_pcm_substream *substream,
+
+ no_delta_check:
+ if (runtime->status->hw_ptr == new_hw_ptr) {
++ runtime->hw_ptr_jiffies = curr_jiffies;
+ update_audio_tstamp(substream, &curr_tstamp, &audio_tstamp);
+ return 0;
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index ffe1340890c9..09a37d4c81ec 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2443,6 +2443,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1275, "MSI-GL63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+@@ -2458,6 +2459,9 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x97e1, "Clevo P970[ER][CDFN]", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
+diff --git a/sound/pci/ice1712/ice1712.c b/sound/pci/ice1712/ice1712.c
+index f1fe497c2f9d..7702b62dc18b 100644
+--- a/sound/pci/ice1712/ice1712.c
++++ b/sound/pci/ice1712/ice1712.c
+@@ -2377,7 +2377,8 @@ static int snd_ice1712_chip_init(struct snd_ice1712 *ice)
+ pci_write_config_byte(ice->pci, 0x61, ice->eeprom.data[ICE_EEP1_ACLINK]);
+ pci_write_config_byte(ice->pci, 0x62, ice->eeprom.data[ICE_EEP1_I2SID]);
+ pci_write_config_byte(ice->pci, 0x63, ice->eeprom.data[ICE_EEP1_SPDIF]);
+- if (ice->eeprom.subvendor != ICE1712_SUBDEVICE_STDSP24) {
++ if (ice->eeprom.subvendor != ICE1712_SUBDEVICE_STDSP24 &&
++ ice->eeprom.subvendor != ICE1712_SUBDEVICE_STAUDIO_ADCIII) {
+ ice->gpio.write_mask = ice->eeprom.gpiomask;
+ ice->gpio.direction = ice->eeprom.gpiodir;
+ snd_ice1712_write(ice, ICE1712_IREG_GPIO_WRITE_MASK,
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-06-03 11:41 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-06-03 11:41 UTC (permalink / raw
To: gentoo-commits
commit: dfe0c2ff7fdae9e0680e678931049d7b1df3d35d
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 3 11:41:00 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jun 3 11:41:00 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dfe0c2ff
Linux patch 4.19.126
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1125_linux-4.19.126.patch | 3160 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3164 insertions(+)
diff --git a/0000_README b/0000_README
index a36c8a4..4d5b261 100644
--- a/0000_README
+++ b/0000_README
@@ -539,6 +539,10 @@ Patch: 1124_linux-4.19.125.patch
From: https://www.kernel.org
Desc: Linux 4.19.125
+Patch: 1125_linux-4.19.126.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.126
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1125_linux-4.19.126.patch b/1125_linux-4.19.126.patch
new file mode 100644
index 0000000..6cd993d
--- /dev/null
+++ b/1125_linux-4.19.126.patch
@@ -0,0 +1,3160 @@
+diff --git a/Makefile b/Makefile
+index 93c63bda7115..f8da10c40271 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 125
++SUBLEVEL = 126
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/compressed/vmlinux.lds.S b/arch/arm/boot/compressed/vmlinux.lds.S
+index 2b963d8e76dd..89a8f7588c78 100644
+--- a/arch/arm/boot/compressed/vmlinux.lds.S
++++ b/arch/arm/boot/compressed/vmlinux.lds.S
+@@ -46,7 +46,7 @@ SECTIONS
+ }
+ .table : ALIGN(4) {
+ _table_start = .;
+- LONG(ZIMAGE_MAGIC(2))
++ LONG(ZIMAGE_MAGIC(4))
+ LONG(ZIMAGE_MAGIC(0x5a534c4b))
+ LONG(ZIMAGE_MAGIC(__piggy_size_addr - _start))
+ LONG(ZIMAGE_MAGIC(_kernel_bss_size))
+diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
+index e4d49731287f..e35398cc60a0 100644
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -75,7 +75,7 @@
+ timer@20200 {
+ compatible = "arm,cortex-a9-global-timer";
+ reg = <0x20200 0x100>;
+- interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_PPI 11 IRQ_TYPE_EDGE_RISING>;
+ clocks = <&periph_clk>;
+ };
+
+@@ -83,7 +83,7 @@
+ compatible = "arm,cortex-a9-twd-timer";
+ reg = <0x20600 0x20>;
+ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(1) |
+- IRQ_TYPE_LEVEL_HIGH)>;
++ IRQ_TYPE_EDGE_RISING)>;
+ clocks = <&periph_clk>;
+ };
+
+@@ -91,7 +91,7 @@
+ compatible = "arm,cortex-a9-twd-wdt";
+ reg = <0x20620 0x20>;
+ interrupts = <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) |
+- IRQ_TYPE_LEVEL_HIGH)>;
++ IRQ_TYPE_EDGE_RISING)>;
+ clocks = <&periph_clk>;
+ };
+
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+index 5fcadb9cf992..9f7145b1cc5e 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+@@ -25,7 +25,7 @@
+
+ leds {
+ act {
+- gpios = <&gpio 47 GPIO_ACTIVE_HIGH>;
++ gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/imx6q-b450v3.dts b/arch/arm/boot/dts/imx6q-b450v3.dts
+index 3ec58500e9c2..25bf45659737 100644
+--- a/arch/arm/boot/dts/imx6q-b450v3.dts
++++ b/arch/arm/boot/dts/imx6q-b450v3.dts
+@@ -65,13 +65,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>,
+- <&clks IMX6QDL_CLK_PLL3_USB_OTG>;
+-};
+-
+ &ldb {
+ status = "okay";
+
+diff --git a/arch/arm/boot/dts/imx6q-b650v3.dts b/arch/arm/boot/dts/imx6q-b650v3.dts
+index 5650a9b11091..0326711a8700 100644
+--- a/arch/arm/boot/dts/imx6q-b650v3.dts
++++ b/arch/arm/boot/dts/imx6q-b650v3.dts
+@@ -65,13 +65,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>,
+- <&clks IMX6QDL_CLK_PLL3_USB_OTG>;
+-};
+-
+ &ldb {
+ status = "okay";
+
+diff --git a/arch/arm/boot/dts/imx6q-b850v3.dts b/arch/arm/boot/dts/imx6q-b850v3.dts
+index 044a5bebe1c5..612f782ddaaa 100644
+--- a/arch/arm/boot/dts/imx6q-b850v3.dts
++++ b/arch/arm/boot/dts/imx6q-b850v3.dts
+@@ -53,17 +53,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>,
+- <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>,
+- <&clks IMX6QDL_CLK_IPU2_DI0_PRE_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
+- <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
+- <&clks IMX6QDL_CLK_PLL2_PFD2_396M>,
+- <&clks IMX6QDL_CLK_PLL2_PFD2_396M>;
+-};
+-
+ &ldb {
+ fsl,dual-channel;
+ status = "okay";
+diff --git a/arch/arm/boot/dts/imx6q-bx50v3.dtsi b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
+index d3cba09be0cb..c1f554348187 100644
+--- a/arch/arm/boot/dts/imx6q-bx50v3.dtsi
++++ b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
+@@ -391,3 +391,18 @@
+ #interrupt-cells = <1>;
+ };
+ };
++
++&clks {
++ assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
++ <&clks IMX6QDL_CLK_LDB_DI1_SEL>,
++ <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU1_DI1_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU2_DI0_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU2_DI1_PRE_SEL>;
++ assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
++ <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>;
++};
+diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi
+index d560fc4051c5..db612271371b 100644
+--- a/arch/arm/boot/dts/rk3036.dtsi
++++ b/arch/arm/boot/dts/rk3036.dtsi
+@@ -128,7 +128,7 @@
+ assigned-clocks = <&cru SCLK_GPU>;
+ assigned-clock-rates = <100000000>;
+ clocks = <&cru SCLK_GPU>, <&cru SCLK_GPU>;
+- clock-names = "core", "bus";
++ clock-names = "bus", "core";
+ resets = <&cru SRST_GPU>;
+ status = "disabled";
+ };
+diff --git a/arch/arm/boot/dts/rk3228-evb.dts b/arch/arm/boot/dts/rk3228-evb.dts
+index 5670b33fd1bd..aed879db6c15 100644
+--- a/arch/arm/boot/dts/rk3228-evb.dts
++++ b/arch/arm/boot/dts/rk3228-evb.dts
+@@ -46,7 +46,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- phy: phy@0 {
++ phy: ethernet-phy@0 {
+ compatible = "ethernet-phy-id1234.d400", "ethernet-phy-ieee802.3-c22";
+ reg = <0>;
+ clocks = <&cru SCLK_MAC_PHY>;
+diff --git a/arch/arm/boot/dts/rk322x.dtsi b/arch/arm/boot/dts/rk322x.dtsi
+index cd8f2a3b0e91..2aa74267ae51 100644
+--- a/arch/arm/boot/dts/rk322x.dtsi
++++ b/arch/arm/boot/dts/rk322x.dtsi
+@@ -539,7 +539,7 @@
+ "pp1",
+ "ppmmu1";
+ clocks = <&cru ACLK_GPU>, <&cru ACLK_GPU>;
+- clock-names = "core", "bus";
++ clock-names = "bus", "core";
+ resets = <&cru SRST_GPU_A>;
+ status = "disabled";
+ };
+@@ -944,7 +944,7 @@
+ };
+ };
+
+- spi-0 {
++ spi0 {
+ spi0_clk: spi0-clk {
+ rockchip,pins = <0 9 RK_FUNC_2 &pcfg_pull_up>;
+ };
+@@ -962,7 +962,7 @@
+ };
+ };
+
+- spi-1 {
++ spi1 {
+ spi1_clk: spi1-clk {
+ rockchip,pins = <0 23 RK_FUNC_2 &pcfg_pull_up>;
+ };
+diff --git a/arch/arm/boot/dts/rk3xxx.dtsi b/arch/arm/boot/dts/rk3xxx.dtsi
+index d752dc611fd7..86a0d98d28ff 100644
+--- a/arch/arm/boot/dts/rk3xxx.dtsi
++++ b/arch/arm/boot/dts/rk3xxx.dtsi
+@@ -84,7 +84,7 @@
+ compatible = "arm,mali-400";
+ reg = <0x10090000 0x10000>;
+ clocks = <&cru ACLK_GPU>, <&cru ACLK_GPU>;
+- clock-names = "core", "bus";
++ clock-names = "bus", "core";
+ assigned-clocks = <&cru ACLK_GPU>;
+ assigned-clock-rates = <100000000>;
+ resets = <&cru SRST_GPU>;
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index 88286dd483ff..1935b580f0e8 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -21,11 +21,11 @@
+ #endif
+
+ #include <asm/ptrace.h>
+-#include <asm/domain.h>
+ #include <asm/opcodes-virt.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/page.h>
+ #include <asm/thread_info.h>
++#include <asm/uaccess-asm.h>
+
+ #define IOMEM(x) (x)
+
+@@ -374,9 +374,9 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .macro usraccoff, instr, reg, ptr, inc, off, cond, abort, t=TUSER()
+ 9999:
+ .if \inc == 1
+- \instr\cond\()b\()\t\().w \reg, [\ptr, #\off]
++ \instr\()b\t\cond\().w \reg, [\ptr, #\off]
+ .elseif \inc == 4
+- \instr\cond\()\t\().w \reg, [\ptr, #\off]
++ \instr\t\cond\().w \reg, [\ptr, #\off]
+ .else
+ .error "Unsupported inc macro argument"
+ .endif
+@@ -415,9 +415,9 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .rept \rept
+ 9999:
+ .if \inc == 1
+- \instr\cond\()b\()\t \reg, [\ptr], #\inc
++ \instr\()b\t\cond \reg, [\ptr], #\inc
+ .elseif \inc == 4
+- \instr\cond\()\t \reg, [\ptr], #\inc
++ \instr\t\cond \reg, [\ptr], #\inc
+ .else
+ .error "Unsupported inc macro argument"
+ .endif
+@@ -447,79 +447,6 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .size \name , . - \name
+ .endm
+
+- .macro csdb
+-#ifdef CONFIG_THUMB2_KERNEL
+- .inst.w 0xf3af8014
+-#else
+- .inst 0xe320f014
+-#endif
+- .endm
+-
+- .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
+-#ifndef CONFIG_CPU_USE_DOMAINS
+- adds \tmp, \addr, #\size - 1
+- sbcccs \tmp, \tmp, \limit
+- bcs \bad
+-#ifdef CONFIG_CPU_SPECTRE
+- movcs \addr, #0
+- csdb
+-#endif
+-#endif
+- .endm
+-
+- .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
+-#ifdef CONFIG_CPU_SPECTRE
+- sub \tmp, \limit, #1
+- subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
+- addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
+- subhss \tmp, \tmp, \size @ tmp = limit - (addr + size) }
+- movlo \addr, #0 @ if (tmp < 0) addr = NULL
+- csdb
+-#endif
+- .endm
+-
+- .macro uaccess_disable, tmp, isb=1
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- /*
+- * Whenever we re-enter userspace, the domains should always be
+- * set appropriately.
+- */
+- mov \tmp, #DACR_UACCESS_DISABLE
+- mcr p15, 0, \tmp, c3, c0, 0 @ Set domain register
+- .if \isb
+- instr_sync
+- .endif
+-#endif
+- .endm
+-
+- .macro uaccess_enable, tmp, isb=1
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- /*
+- * Whenever we re-enter userspace, the domains should always be
+- * set appropriately.
+- */
+- mov \tmp, #DACR_UACCESS_ENABLE
+- mcr p15, 0, \tmp, c3, c0, 0
+- .if \isb
+- instr_sync
+- .endif
+-#endif
+- .endm
+-
+- .macro uaccess_save, tmp
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- mrc p15, 0, \tmp, c3, c0, 0
+- str \tmp, [sp, #SVC_DACR]
+-#endif
+- .endm
+-
+- .macro uaccess_restore
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- ldr r0, [sp, #SVC_DACR]
+- mcr p15, 0, r0, c3, c0, 0
+-#endif
+- .endm
+-
+ .irp c,,eq,ne,cs,cc,mi,pl,vs,vc,hi,ls,ge,lt,gt,le,hs,lo
+ .macro ret\c, reg
+ #if __LINUX_ARM_ARCH__ < 6
+diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h
+new file mode 100644
+index 000000000000..907571fd05c6
+--- /dev/null
++++ b/arch/arm/include/asm/uaccess-asm.h
+@@ -0,0 +1,117 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#ifndef __ASM_UACCESS_ASM_H__
++#define __ASM_UACCESS_ASM_H__
++
++#include <asm/asm-offsets.h>
++#include <asm/domain.h>
++#include <asm/memory.h>
++#include <asm/thread_info.h>
++
++ .macro csdb
++#ifdef CONFIG_THUMB2_KERNEL
++ .inst.w 0xf3af8014
++#else
++ .inst 0xe320f014
++#endif
++ .endm
++
++ .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
++#ifndef CONFIG_CPU_USE_DOMAINS
++ adds \tmp, \addr, #\size - 1
++ sbcscc \tmp, \tmp, \limit
++ bcs \bad
++#ifdef CONFIG_CPU_SPECTRE
++ movcs \addr, #0
++ csdb
++#endif
++#endif
++ .endm
++
++ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
++#ifdef CONFIG_CPU_SPECTRE
++ sub \tmp, \limit, #1
++ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
++ addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
++ subshs \tmp, \tmp, \size @ tmp = limit - (addr + size) }
++ movlo \addr, #0 @ if (tmp < 0) addr = NULL
++ csdb
++#endif
++ .endm
++
++ .macro uaccess_disable, tmp, isb=1
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ /*
++ * Whenever we re-enter userspace, the domains should always be
++ * set appropriately.
++ */
++ mov \tmp, #DACR_UACCESS_DISABLE
++ mcr p15, 0, \tmp, c3, c0, 0 @ Set domain register
++ .if \isb
++ instr_sync
++ .endif
++#endif
++ .endm
++
++ .macro uaccess_enable, tmp, isb=1
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ /*
++ * Whenever we re-enter userspace, the domains should always be
++ * set appropriately.
++ */
++ mov \tmp, #DACR_UACCESS_ENABLE
++ mcr p15, 0, \tmp, c3, c0, 0
++ .if \isb
++ instr_sync
++ .endif
++#endif
++ .endm
++
++#if defined(CONFIG_CPU_SW_DOMAIN_PAN) || defined(CONFIG_CPU_USE_DOMAINS)
++#define DACR(x...) x
++#else
++#define DACR(x...)
++#endif
++
++ /*
++ * Save the address limit on entry to a privileged exception.
++ *
++ * If we are using the DACR for kernel access by the user accessors
++ * (CONFIG_CPU_USE_DOMAINS=y), always reset the DACR kernel domain
++ * back to client mode, whether or not \disable is set.
++ *
++ * If we are using SW PAN, set the DACR user domain to no access
++ * if \disable is set.
++ */
++ .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable
++ ldr \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ mov \tmp2, #TASK_SIZE
++ str \tmp2, [\tsk, #TI_ADDR_LIMIT]
++ DACR( mrc p15, 0, \tmp0, c3, c0, 0)
++ DACR( str \tmp0, [sp, #SVC_DACR])
++ str \tmp1, [sp, #SVC_ADDR_LIMIT]
++ .if \disable && IS_ENABLED(CONFIG_CPU_SW_DOMAIN_PAN)
++ /* kernel=client, user=no access */
++ mov \tmp2, #DACR_UACCESS_DISABLE
++ mcr p15, 0, \tmp2, c3, c0, 0
++ instr_sync
++ .elseif IS_ENABLED(CONFIG_CPU_USE_DOMAINS)
++ /* kernel=client */
++ bic \tmp2, \tmp0, #domain_mask(DOMAIN_KERNEL)
++ orr \tmp2, \tmp2, #domain_val(DOMAIN_KERNEL, DOMAIN_CLIENT)
++ mcr p15, 0, \tmp2, c3, c0, 0
++ instr_sync
++ .endif
++ .endm
++
++ /* Restore the user access state previously saved by uaccess_entry */
++ .macro uaccess_exit, tsk, tmp0, tmp1
++ ldr \tmp1, [sp, #SVC_ADDR_LIMIT]
++ DACR( ldr \tmp0, [sp, #SVC_DACR])
++ str \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ DACR( mcr p15, 0, \tmp0, c3, c0, 0)
++ .endm
++
++#undef DACR
++
++#endif /* __ASM_UACCESS_ASM_H__ */
+diff --git a/arch/arm/include/asm/vfpmacros.h b/arch/arm/include/asm/vfpmacros.h
+index ef5dfedacd8d..628c336e8e3b 100644
+--- a/arch/arm/include/asm/vfpmacros.h
++++ b/arch/arm/include/asm/vfpmacros.h
+@@ -29,13 +29,13 @@
+ ldr \tmp, =elf_hwcap @ may not have MVFR regs
+ ldr \tmp, [\tmp, #0]
+ tst \tmp, #HWCAP_VFPD32
+- ldcnel p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
++ ldclne p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
+ addeq \base, \base, #32*4 @ step over unused register space
+ #else
+ VFPFMRX \tmp, MVFR0 @ Media and VFP Feature Register 0
+ and \tmp, \tmp, #MVFR0_A_SIMD_MASK @ A_SIMD field
+ cmp \tmp, #2 @ 32 x 64bit registers?
+- ldceql p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
++ ldcleq p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
+ addne \base, \base, #32*4 @ step over unused register space
+ #endif
+ #endif
+@@ -53,13 +53,13 @@
+ ldr \tmp, =elf_hwcap @ may not have MVFR regs
+ ldr \tmp, [\tmp, #0]
+ tst \tmp, #HWCAP_VFPD32
+- stcnel p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
++ stclne p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
+ addeq \base, \base, #32*4 @ step over unused register space
+ #else
+ VFPFMRX \tmp, MVFR0 @ Media and VFP Feature Register 0
+ and \tmp, \tmp, #MVFR0_A_SIMD_MASK @ A_SIMD field
+ cmp \tmp, #2 @ 32 x 64bit registers?
+- stceql p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
++ stcleq p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
+ addne \base, \base, #32*4 @ step over unused register space
+ #endif
+ #endif
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index e85a3af9ddeb..89e551eebff1 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -30,6 +30,7 @@
+ #include <asm/unistd.h>
+ #include <asm/tls.h>
+ #include <asm/system_info.h>
++#include <asm/uaccess-asm.h>
+
+ #include "entry-header.S"
+ #include <asm/entry-macro-multi.S>
+@@ -182,15 +183,7 @@ ENDPROC(__und_invalid)
+ stmia r7, {r2 - r6}
+
+ get_thread_info tsk
+- ldr r0, [tsk, #TI_ADDR_LIMIT]
+- mov r1, #TASK_SIZE
+- str r1, [tsk, #TI_ADDR_LIMIT]
+- str r0, [sp, #SVC_ADDR_LIMIT]
+-
+- uaccess_save r0
+- .if \uaccess
+- uaccess_disable r0
+- .endif
++ uaccess_entry tsk, r0, r1, r2, \uaccess
+
+ .if \trace
+ #ifdef CONFIG_TRACE_IRQFLAGS
+diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
+index 62db1c9746cb..7b595f2d4a28 100644
+--- a/arch/arm/kernel/entry-header.S
++++ b/arch/arm/kernel/entry-header.S
+@@ -6,6 +6,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/errno.h>
+ #include <asm/thread_info.h>
++#include <asm/uaccess-asm.h>
+ #include <asm/v7m.h>
+
+ @ Bad Abort numbers
+@@ -217,9 +218,7 @@
+ blne trace_hardirqs_off
+ #endif
+ .endif
+- ldr r1, [sp, #SVC_ADDR_LIMIT]
+- uaccess_restore
+- str r1, [tsk, #TI_ADDR_LIMIT]
++ uaccess_exit tsk, r0, r1
+
+ #ifndef CONFIG_THUMB2_KERNEL
+ @ ARM mode SVC restore
+@@ -263,9 +262,7 @@
+ @ on the stack remains correct).
+ @
+ .macro svc_exit_via_fiq
+- ldr r1, [sp, #SVC_ADDR_LIMIT]
+- uaccess_restore
+- str r1, [tsk, #TI_ADDR_LIMIT]
++ uaccess_exit tsk, r0, r1
+ #ifndef CONFIG_THUMB2_KERNEL
+ @ ARM mode restore
+ mov r0, sp
+diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
+index 93cddab73072..95bd35991288 100644
+--- a/arch/arm/lib/bitops.h
++++ b/arch/arm/lib/bitops.h
+@@ -7,7 +7,7 @@
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ mov r2, #1
+ and r3, r0, #31 @ Get bit offset
+ mov r0, r0, lsr #5
+@@ -32,7 +32,7 @@ ENDPROC(\name )
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ mov r2, #1
+ and r3, r0, #31 @ Get bit offset
+ mov r0, r0, lsr #5
+@@ -62,7 +62,7 @@ ENDPROC(\name )
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ and r2, r0, #31
+ mov r0, r0, lsr #5
+ mov r3, #1
+@@ -89,7 +89,7 @@ ENDPROC(\name )
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ and r3, r0, #31
+ mov r0, r0, lsr #5
+ save_and_disable_irqs ip
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-evb.dts b/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
+index 212dd8159da9..d89f3451ace5 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
+@@ -86,7 +86,7 @@
+ assigned-clock-rate = <50000000>;
+ assigned-clocks = <&cru SCLK_MAC2PHY>;
+ assigned-clock-parents = <&cru SCLK_MAC2PHY_SRC>;
+-
++ status = "okay";
+ };
+
+ &i2c1 {
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index 451f00a631c4..f14e8c5c41ac 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -1817,10 +1817,10 @@
+ gpu: gpu@ff9a0000 {
+ compatible = "rockchip,rk3399-mali", "arm,mali-t860";
+ reg = <0x0 0xff9a0000 0x0 0x10000>;
+- interrupts = <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH 0>,
+- <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH 0>,
+- <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH 0>;
+- interrupt-names = "gpu", "job", "mmu";
++ interrupts = <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH 0>,
++ <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH 0>,
++ <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH 0>;
++ interrupt-names = "job", "mmu", "gpu";
+ clocks = <&cru ACLK_GPU>;
+ power-domains = <&power RK3399_PD_GPU>;
+ status = "disabled";
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index aae9b0d71c1e..10a52664e29f 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -607,7 +607,7 @@ void __init mem_init(void)
+ > BITS_PER_LONG);
+
+ high_memory = __va((max_pfn << PAGE_SHIFT));
+- set_max_mapnr(page_to_pfn(virt_to_page(high_memory - 1)) + 1);
++ set_max_mapnr(max_low_pfn);
+ free_all_bootmem();
+
+ #ifdef CONFIG_PA11
+diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c
+index a4b1d94371a0..74b2168d7298 100644
+--- a/arch/riscv/kernel/stacktrace.c
++++ b/arch/riscv/kernel/stacktrace.c
+@@ -75,7 +75,7 @@ static void notrace walk_stackframe(struct task_struct *task,
+
+ #else /* !CONFIG_FRAME_POINTER */
+
+-static void notrace walk_stackframe(struct task_struct *task,
++void notrace walk_stackframe(struct task_struct *task,
+ struct pt_regs *regs, bool (*fn)(unsigned long, void *), void *arg)
+ {
+ unsigned long sp, pc;
+diff --git a/arch/x86/include/asm/dma.h b/arch/x86/include/asm/dma.h
+index 00f7cf45e699..8e95aa4b0d17 100644
+--- a/arch/x86/include/asm/dma.h
++++ b/arch/x86/include/asm/dma.h
+@@ -74,7 +74,7 @@
+ #define MAX_DMA_PFN ((16UL * 1024 * 1024) >> PAGE_SHIFT)
+
+ /* 4GB broken PCI/AGP hardware bus master zone */
+-#define MAX_DMA32_PFN ((4UL * 1024 * 1024 * 1024) >> PAGE_SHIFT)
++#define MAX_DMA32_PFN (1UL << (32 - PAGE_SHIFT))
+
+ #ifdef CONFIG_X86_32
+ /* The maximum address that we can perform a DMA transfer to on this platform */
+diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
+index 87a57b7642d3..61c2fb8b1f8e 100644
+--- a/arch/x86/kernel/fpu/xstate.c
++++ b/arch/x86/kernel/fpu/xstate.c
+@@ -964,18 +964,31 @@ static inline bool xfeatures_mxcsr_quirk(u64 xfeatures)
+ return true;
+ }
+
+-/*
+- * This is similar to user_regset_copyout(), but will not add offset to
+- * the source data pointer or increment pos, count, kbuf, and ubuf.
+- */
+-static inline void
+-__copy_xstate_to_kernel(void *kbuf, const void *data,
+- unsigned int offset, unsigned int size, unsigned int size_total)
++static void fill_gap(unsigned to, void **kbuf, unsigned *pos, unsigned *count)
+ {
+- if (offset < size_total) {
+- unsigned int copy = min(size, size_total - offset);
++ if (*pos < to) {
++ unsigned size = to - *pos;
++
++ if (size > *count)
++ size = *count;
++ memcpy(*kbuf, (void *)&init_fpstate.xsave + *pos, size);
++ *kbuf += size;
++ *pos += size;
++ *count -= size;
++ }
++}
+
+- memcpy(kbuf + offset, data, copy);
++static void copy_part(unsigned offset, unsigned size, void *from,
++ void **kbuf, unsigned *pos, unsigned *count)
++{
++ fill_gap(offset, kbuf, pos, count);
++ if (size > *count)
++ size = *count;
++ if (size) {
++ memcpy(*kbuf, from, size);
++ *kbuf += size;
++ *pos += size;
++ *count -= size;
+ }
+ }
+
+@@ -988,8 +1001,9 @@ __copy_xstate_to_kernel(void *kbuf, const void *data,
+ */
+ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int offset_start, unsigned int size_total)
+ {
+- unsigned int offset, size;
+ struct xstate_header header;
++ const unsigned off_mxcsr = offsetof(struct fxregs_state, mxcsr);
++ unsigned count = size_total;
+ int i;
+
+ /*
+@@ -1005,46 +1019,42 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of
+ header.xfeatures = xsave->header.xfeatures;
+ header.xfeatures &= ~XFEATURE_MASK_SUPERVISOR;
+
++ if (header.xfeatures & XFEATURE_MASK_FP)
++ copy_part(0, off_mxcsr,
++ &xsave->i387, &kbuf, &offset_start, &count);
++ if (header.xfeatures & (XFEATURE_MASK_SSE | XFEATURE_MASK_YMM))
++ copy_part(off_mxcsr, MXCSR_AND_FLAGS_SIZE,
++ &xsave->i387.mxcsr, &kbuf, &offset_start, &count);
++ if (header.xfeatures & XFEATURE_MASK_FP)
++ copy_part(offsetof(struct fxregs_state, st_space), 128,
++ &xsave->i387.st_space, &kbuf, &offset_start, &count);
++ if (header.xfeatures & XFEATURE_MASK_SSE)
++ copy_part(xstate_offsets[XFEATURE_MASK_SSE], 256,
++ &xsave->i387.xmm_space, &kbuf, &offset_start, &count);
++ /*
++ * Fill xsave->i387.sw_reserved value for ptrace frame:
++ */
++ copy_part(offsetof(struct fxregs_state, sw_reserved), 48,
++ xstate_fx_sw_bytes, &kbuf, &offset_start, &count);
+ /*
+ * Copy xregs_state->header:
+ */
+- offset = offsetof(struct xregs_state, header);
+- size = sizeof(header);
+-
+- __copy_xstate_to_kernel(kbuf, &header, offset, size, size_total);
++ copy_part(offsetof(struct xregs_state, header), sizeof(header),
++ &header, &kbuf, &offset_start, &count);
+
+- for (i = 0; i < XFEATURE_MAX; i++) {
++ for (i = FIRST_EXTENDED_XFEATURE; i < XFEATURE_MAX; i++) {
+ /*
+ * Copy only in-use xstates:
+ */
+ if ((header.xfeatures >> i) & 1) {
+ void *src = __raw_xsave_addr(xsave, 1 << i);
+
+- offset = xstate_offsets[i];
+- size = xstate_sizes[i];
+-
+- /* The next component has to fit fully into the output buffer: */
+- if (offset + size > size_total)
+- break;
+-
+- __copy_xstate_to_kernel(kbuf, src, offset, size, size_total);
++ copy_part(xstate_offsets[i], xstate_sizes[i],
++ src, &kbuf, &offset_start, &count);
+ }
+
+ }
+-
+- if (xfeatures_mxcsr_quirk(header.xfeatures)) {
+- offset = offsetof(struct fxregs_state, mxcsr);
+- size = MXCSR_AND_FLAGS_SIZE;
+- __copy_xstate_to_kernel(kbuf, &xsave->i387.mxcsr, offset, size, size_total);
+- }
+-
+- /*
+- * Fill xsave->i387.sw_reserved value for ptrace frame:
+- */
+- offset = offsetof(struct fxregs_state, sw_reserved);
+- size = sizeof(xstate_fx_sw_bytes);
+-
+- __copy_xstate_to_kernel(kbuf, xstate_fx_sw_bytes, offset, size, size_total);
++ fill_gap(size_total, &kbuf, &offset_start, &count);
+
+ return 0;
+ }
+diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c
+index 1587f4ac6821..1e0cc96306dd 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_io.c
++++ b/drivers/crypto/chelsio/chtls/chtls_io.c
+@@ -686,7 +686,7 @@ int chtls_push_frames(struct chtls_sock *csk, int comp)
+ make_tx_data_wr(sk, skb, immdlen, len,
+ credits_needed, completion);
+ tp->snd_nxt += len;
+- tp->lsndtime = tcp_time_stamp(tp);
++ tp->lsndtime = tcp_jiffies32;
+ if (completion)
+ ULP_SKB_CB(skb)->flags &= ~ULPCB_FLAG_NEED_HDR;
+ } else {
+diff --git a/drivers/gpio/gpio-exar.c b/drivers/gpio/gpio-exar.c
+index a09d2f9ebacc..695c19901eff 100644
+--- a/drivers/gpio/gpio-exar.c
++++ b/drivers/gpio/gpio-exar.c
+@@ -148,8 +148,10 @@ static int gpio_exar_probe(struct platform_device *pdev)
+ mutex_init(&exar_gpio->lock);
+
+ index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL);
+- if (index < 0)
+- goto err_destroy;
++ if (index < 0) {
++ ret = index;
++ goto err_mutex_destroy;
++ }
+
+ sprintf(exar_gpio->name, "exar_gpio%d", index);
+ exar_gpio->gpio_chip.label = exar_gpio->name;
+@@ -176,6 +178,7 @@ static int gpio_exar_probe(struct platform_device *pdev)
+
+ err_destroy:
+ ida_simple_remove(&ida_index, index);
++err_mutex_destroy:
+ mutex_destroy(&exar_gpio->lock);
+ return ret;
+ }
+diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c
+index 47dbd19751d0..57903501821e 100644
+--- a/drivers/gpio/gpio-tegra.c
++++ b/drivers/gpio/gpio-tegra.c
+@@ -357,6 +357,7 @@ static void tegra_gpio_irq_shutdown(struct irq_data *d)
+ struct tegra_gpio_info *tgi = bank->tgi;
+ unsigned int gpio = d->hwirq;
+
++ tegra_gpio_irq_mask(d);
+ gpiochip_unlock_as_irq(&tgi->gc, gpio);
+ }
+
+diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
+index bf937fec50dc..5819a2fb027d 100644
+--- a/drivers/infiniband/core/rdma_core.c
++++ b/drivers/infiniband/core/rdma_core.c
+@@ -158,9 +158,9 @@ static int uverbs_destroy_uobject(struct ib_uobject *uobj,
+ uobj->context = NULL;
+
+ /*
+- * For DESTROY the usecnt is held write locked, the caller is expected
+- * to put it unlock and put the object when done with it. Only DESTROY
+- * can remove the IDR handle.
++ * For DESTROY the usecnt is not changed, the caller is expected to
++ * manage it via uobj_put_destroy(). Only DESTROY can remove the IDR
++ * handle.
+ */
+ if (reason != RDMA_REMOVE_DESTROY)
+ atomic_set(&uobj->usecnt, 0);
+@@ -192,7 +192,7 @@ static int uverbs_destroy_uobject(struct ib_uobject *uobj,
+ /*
+ * This calls uverbs_destroy_uobject() using the RDMA_REMOVE_DESTROY
+ * sequence. It should only be used from command callbacks. On success the
+- * caller must pair this with rdma_lookup_put_uobject(LOOKUP_WRITE). This
++ * caller must pair this with uobj_put_destroy(). This
+ * version requires the caller to have already obtained an
+ * LOOKUP_DESTROY uobject kref.
+ */
+@@ -203,6 +203,13 @@ int uobj_destroy(struct ib_uobject *uobj)
+
+ down_read(&ufile->hw_destroy_rwsem);
+
++ /*
++ * Once the uobject is destroyed by RDMA_REMOVE_DESTROY then it is left
++ * write locked as the callers put it back with UVERBS_LOOKUP_DESTROY.
++ * This is because any other concurrent thread can still see the object
++ * in the xarray due to RCU. Leaving it locked ensures nothing else will
++ * touch it.
++ */
+ ret = uverbs_try_lock_object(uobj, UVERBS_LOOKUP_WRITE);
+ if (ret)
+ goto out_unlock;
+@@ -221,7 +228,7 @@ out_unlock:
+ /*
+ * uobj_get_destroy destroys the HW object and returns a handle to the uobj
+ * with a NULL object pointer. The caller must pair this with
+- * uverbs_put_destroy.
++ * uobj_put_destroy().
+ */
+ struct ib_uobject *__uobj_get_destroy(const struct uverbs_api_object *obj,
+ u32 id, struct ib_uverbs_file *ufile)
+@@ -256,7 +263,7 @@ int __uobj_perform_destroy(const struct uverbs_api_object *obj, u32 id,
+ if (IS_ERR(uobj))
+ return PTR_ERR(uobj);
+
+- rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_WRITE);
++ uobj_put_destroy(uobj);
+ return success_res;
+ }
+
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+index 771eb6bd0785..4321b9e3dbb4 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+@@ -1984,7 +1984,6 @@ static int i40iw_addr_resolve_neigh(struct i40iw_device *iwdev,
+ struct rtable *rt;
+ struct neighbour *neigh;
+ int rc = arpindex;
+- struct net_device *netdev = iwdev->netdev;
+ __be32 dst_ipaddr = htonl(dst_ip);
+ __be32 src_ipaddr = htonl(src_ip);
+
+@@ -1994,9 +1993,6 @@ static int i40iw_addr_resolve_neigh(struct i40iw_device *iwdev,
+ return rc;
+ }
+
+- if (netif_is_bond_slave(netdev))
+- netdev = netdev_master_upper_dev_get(netdev);
+-
+ neigh = dst_neigh_lookup(&rt->dst, &dst_ipaddr);
+
+ rcu_read_lock();
+@@ -2062,7 +2058,6 @@ static int i40iw_addr_resolve_neigh_ipv6(struct i40iw_device *iwdev,
+ {
+ struct neighbour *neigh;
+ int rc = arpindex;
+- struct net_device *netdev = iwdev->netdev;
+ struct dst_entry *dst;
+ struct sockaddr_in6 dst_addr;
+ struct sockaddr_in6 src_addr;
+@@ -2083,9 +2078,6 @@ static int i40iw_addr_resolve_neigh_ipv6(struct i40iw_device *iwdev,
+ return rc;
+ }
+
+- if (netif_is_bond_slave(netdev))
+- netdev = netdev_master_upper_dev_get(netdev);
+-
+ neigh = dst_neigh_lookup(dst, dst_addr.sin6_addr.in6_u.u6_addr32);
+
+ rcu_read_lock();
+diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c
+index d831f3e61ae8..2626205780ee 100644
+--- a/drivers/infiniband/hw/qib/qib_sysfs.c
++++ b/drivers/infiniband/hw/qib/qib_sysfs.c
+@@ -756,7 +756,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping linkcontrol sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail;
++ goto bail_link;
+ }
+ kobject_uevent(&ppd->pport_kobj, KOBJ_ADD);
+
+@@ -766,7 +766,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping sl2vl sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_link;
++ goto bail_sl;
+ }
+ kobject_uevent(&ppd->sl2vl_kobj, KOBJ_ADD);
+
+@@ -776,7 +776,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping diag_counters sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_sl;
++ goto bail_diagc;
+ }
+ kobject_uevent(&ppd->diagc_kobj, KOBJ_ADD);
+
+@@ -789,7 +789,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping Congestion Control sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_diagc;
++ goto bail_cc;
+ }
+
+ kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD);
+@@ -871,6 +871,7 @@ void qib_verbs_unregister_sysfs(struct qib_devdata *dd)
+ &cc_table_bin_attr);
+ kobject_put(&ppd->pport_cc_kobj);
+ }
++ kobject_put(&ppd->diagc_kobj);
+ kobject_put(&ppd->sl2vl_kobj);
+ kobject_put(&ppd->pport_kobj);
+ }
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+index ed99f0a08dc4..0a414c5329ce 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+@@ -833,7 +833,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
+ !(pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) {
+ dev_err(&pdev->dev, "PCI BAR region not MMIO\n");
+ ret = -ENOMEM;
+- goto err_free_device;
++ goto err_disable_pdev;
+ }
+
+ ret = pci_request_regions(pdev, DRV_NAME);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
+index b22d02c9de90..85267bbf4836 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib.h
++++ b/drivers/infiniband/ulp/ipoib/ipoib.h
+@@ -377,8 +377,12 @@ struct ipoib_dev_priv {
+ struct ipoib_rx_buf *rx_ring;
+
+ struct ipoib_tx_buf *tx_ring;
++ /* cyclic ring variables for managing tx_ring, for UD only */
+ unsigned int tx_head;
+ unsigned int tx_tail;
++ /* cyclic ring variables for counting overall outstanding send WRs */
++ unsigned int global_tx_head;
++ unsigned int global_tx_tail;
+ struct ib_sge tx_sge[MAX_SKB_FRAGS + 1];
+ struct ib_ud_wr tx_wr;
+ struct ib_wc send_wc[MAX_SEND_CQE];
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index aa9dcfc36cd3..196f1e6b5396 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -756,7 +756,8 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
+ return;
+ }
+
+- if ((priv->tx_head - priv->tx_tail) == ipoib_sendq_size - 1) {
++ if ((priv->global_tx_head - priv->global_tx_tail) ==
++ ipoib_sendq_size - 1) {
+ ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
+ tx->qp->qp_num);
+ netif_stop_queue(dev);
+@@ -786,7 +787,7 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
+ } else {
+ netif_trans_update(dev);
+ ++tx->tx_head;
+- ++priv->tx_head;
++ ++priv->global_tx_head;
+ }
+ }
+
+@@ -820,10 +821,11 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
+ netif_tx_lock(dev);
+
+ ++tx->tx_tail;
+- ++priv->tx_tail;
++ ++priv->global_tx_tail;
+
+ if (unlikely(netif_queue_stopped(dev) &&
+- (priv->tx_head - priv->tx_tail) <= ipoib_sendq_size >> 1 &&
++ ((priv->global_tx_head - priv->global_tx_tail) <=
++ ipoib_sendq_size >> 1) &&
+ test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)))
+ netif_wake_queue(dev);
+
+@@ -1233,8 +1235,9 @@ timeout:
+ dev_kfree_skb_any(tx_req->skb);
+ netif_tx_lock_bh(p->dev);
+ ++p->tx_tail;
+- ++priv->tx_tail;
+- if (unlikely(priv->tx_head - priv->tx_tail == ipoib_sendq_size >> 1) &&
++ ++priv->global_tx_tail;
++ if (unlikely((priv->global_tx_head - priv->global_tx_tail) <=
++ ipoib_sendq_size >> 1) &&
+ netif_queue_stopped(p->dev) &&
+ test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))
+ netif_wake_queue(p->dev);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index 9006a13af1de..0f2e80f54d33 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -406,9 +406,11 @@ static void ipoib_ib_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
+ dev_kfree_skb_any(tx_req->skb);
+
+ ++priv->tx_tail;
++ ++priv->global_tx_tail;
+
+ if (unlikely(netif_queue_stopped(dev) &&
+- ((priv->tx_head - priv->tx_tail) <= ipoib_sendq_size >> 1) &&
++ ((priv->global_tx_head - priv->global_tx_tail) <=
++ ipoib_sendq_size >> 1) &&
+ test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)))
+ netif_wake_queue(dev);
+
+@@ -633,7 +635,8 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb,
+ else
+ priv->tx_wr.wr.send_flags &= ~IB_SEND_IP_CSUM;
+ /* increase the tx_head after send success, but use it for queue state */
+- if (priv->tx_head - priv->tx_tail == ipoib_sendq_size - 1) {
++ if ((priv->global_tx_head - priv->global_tx_tail) ==
++ ipoib_sendq_size - 1) {
+ ipoib_dbg(priv, "TX ring full, stopping kernel net queue\n");
+ netif_stop_queue(dev);
+ }
+@@ -661,6 +664,7 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb,
+
+ rc = priv->tx_head;
+ ++priv->tx_head;
++ ++priv->global_tx_head;
+ }
+ return rc;
+ }
+@@ -807,6 +811,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)
+ ipoib_dma_unmap_tx(priv, tx_req);
+ dev_kfree_skb_any(tx_req->skb);
+ ++priv->tx_tail;
++ ++priv->global_tx_tail;
+ }
+
+ for (i = 0; i < ipoib_recvq_size; ++i) {
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index d8cb5bbe6eb5..6093e8268583 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1188,9 +1188,11 @@ static void ipoib_timeout(struct net_device *dev)
+
+ ipoib_warn(priv, "transmit timeout: latency %d msecs\n",
+ jiffies_to_msecs(jiffies - dev_trans_start(dev)));
+- ipoib_warn(priv, "queue stopped %d, tx_head %u, tx_tail %u\n",
+- netif_queue_stopped(dev),
+- priv->tx_head, priv->tx_tail);
++ ipoib_warn(priv,
++ "queue stopped %d, tx_head %u, tx_tail %u, global_tx_head %u, global_tx_tail %u\n",
++ netif_queue_stopped(dev), priv->tx_head, priv->tx_tail,
++ priv->global_tx_head, priv->global_tx_tail);
++
+ /* XXX reset QP, etc. */
+ }
+
+@@ -1705,7 +1707,7 @@ static int ipoib_dev_init_default(struct net_device *dev)
+ goto out_rx_ring_cleanup;
+ }
+
+- /* priv->tx_head, tx_tail & tx_outstanding are already 0 */
++ /* priv->tx_head, tx_tail and global_tx_tail/head are already 0 */
+
+ if (ipoib_transport_dev_init(dev, priv->ca)) {
+ pr_warn("%s: ipoib_transport_dev_init failed\n",
+diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
+index 4263e905cafb..3362dcb3ec0e 100644
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -348,20 +348,6 @@ static int evdev_fasync(int fd, struct file *file, int on)
+ return fasync_helper(fd, file, on, &client->fasync);
+ }
+
+-static int evdev_flush(struct file *file, fl_owner_t id)
+-{
+- struct evdev_client *client = file->private_data;
+- struct evdev *evdev = client->evdev;
+-
+- mutex_lock(&evdev->mutex);
+-
+- if (evdev->exist && !client->revoked)
+- input_flush_device(&evdev->handle, file);
+-
+- mutex_unlock(&evdev->mutex);
+- return 0;
+-}
+-
+ static void evdev_free(struct device *dev)
+ {
+ struct evdev *evdev = container_of(dev, struct evdev, dev);
+@@ -475,6 +461,10 @@ static int evdev_release(struct inode *inode, struct file *file)
+ unsigned int i;
+
+ mutex_lock(&evdev->mutex);
++
++ if (evdev->exist && !client->revoked)
++ input_flush_device(&evdev->handle, file);
++
+ evdev_ungrab(evdev, client);
+ mutex_unlock(&evdev->mutex);
+
+@@ -1336,7 +1326,6 @@ static const struct file_operations evdev_fops = {
+ .compat_ioctl = evdev_ioctl_compat,
+ #endif
+ .fasync = evdev_fasync,
+- .flush = evdev_flush,
+ .llseek = no_llseek,
+ };
+
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index aa4e431cbcd3..9adc72d65c63 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -472,6 +472,16 @@ static const u8 xboxone_fw2015_init[] = {
+ 0x05, 0x20, 0x00, 0x01, 0x00
+ };
+
++/*
++ * This packet is required for Xbox One S (0x045e:0x02ea)
++ * and Xbox One Elite Series 2 (0x045e:0x0b00) pads to
++ * initialize the controller that was previously used in
++ * Bluetooth mode.
++ */
++static const u8 xboxone_s_init[] = {
++ 0x05, 0x20, 0x00, 0x0f, 0x06
++};
++
+ /*
+ * This packet is required for the Titanfall 2 Xbox One pads
+ * (0x0e6f:0x0165) to finish initialization and for Hori pads
+@@ -530,6 +540,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
+ XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
+ XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
+ XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
++ XBOXONE_INIT_PKT(0x045e, 0x02ea, xboxone_s_init),
++ XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init),
+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1),
+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2),
+ XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
+diff --git a/drivers/input/keyboard/dlink-dir685-touchkeys.c b/drivers/input/keyboard/dlink-dir685-touchkeys.c
+index 88e321b76397..6fe4062e3ac2 100644
+--- a/drivers/input/keyboard/dlink-dir685-touchkeys.c
++++ b/drivers/input/keyboard/dlink-dir685-touchkeys.c
+@@ -142,7 +142,7 @@ MODULE_DEVICE_TABLE(of, dir685_tk_of_match);
+
+ static struct i2c_driver dir685_tk_i2c_driver = {
+ .driver = {
+- .name = "dlin-dir685-touchkeys",
++ .name = "dlink-dir685-touchkeys",
+ .of_match_table = of_match_ptr(dir685_tk_of_match),
+ },
+ .probe = dir685_tk_probe,
+diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
+index 162526a0d463..ac6a20f7afdf 100644
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -208,7 +208,7 @@ static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
+
+ if (count) {
+ kfree(attn_data.data);
+- attn_data.data = NULL;
++ drvdata->attn_data.data = NULL;
+ }
+
+ if (!kfifo_is_empty(&drvdata->attn_fifo))
+@@ -1213,7 +1213,8 @@ static int rmi_driver_probe(struct device *dev)
+ if (data->input) {
+ rmi_driver_set_input_name(rmi_dev, data->input);
+ if (!rmi_dev->xport->input) {
+- if (input_register_device(data->input)) {
++ retval = input_register_device(data->input);
++ if (retval) {
+ dev_err(dev, "%s: Failed to register input device.\n",
+ __func__);
+ goto err_destroy_functions;
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 0d0f977a2f39..c4201d1da239 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -666,6 +666,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"),
+ },
+ },
++ {
++ /* Lenovo ThinkPad Twist S230u */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
++ },
++ },
+ { }
+ };
+
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index 48304e26f988..d939c1798518 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -195,6 +195,7 @@ static const struct usb_device_id usbtouch_devices[] = {
+ #endif
+
+ #ifdef CONFIG_TOUCHSCREEN_USB_IRTOUCH
++ {USB_DEVICE(0x255e, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x595a, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x6615, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x6615, 0x0012), .driver_info = DEVTYPE_IRTOUCH_HIRES},
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 00e1c908cd8e..85ef6c9bc898 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -392,7 +392,7 @@ struct iommu_group *iommu_group_alloc(void)
+ NULL, "%d", group->id);
+ if (ret) {
+ ida_simple_remove(&iommu_group_ida, group->id);
+- kfree(group);
++ kobject_put(&group->kobj);
+ return ERR_PTR(ret);
+ }
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 23bcdbba0cab..c723a1e54b18 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2485,8 +2485,8 @@ static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp)
+ struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
+ struct mmc_rpmb_data, chrdev);
+
+- put_device(&rpmb->dev);
+ mmc_blk_put(rpmb->md);
++ put_device(&rpmb->dev);
+
+ return 0;
+ }
+diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
+index 03f3d9c80fba..2a788169cbb8 100644
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -108,7 +108,7 @@ static enum blk_eh_timer_return mmc_cqe_timed_out(struct request *req)
+ case MMC_ISSUE_DCMD:
+ if (host->cqe_ops->cqe_timeout(host, mrq, &recovery_needed)) {
+ if (recovery_needed)
+- __mmc_cqe_recovery_notifier(mq);
++ mmc_cqe_recovery_notifier(mrq);
+ return BLK_EH_RESET_TIMER;
+ }
+ /* The request has gone already */
+@@ -125,18 +125,13 @@ static enum blk_eh_timer_return mmc_mq_timed_out(struct request *req,
+ struct request_queue *q = req->q;
+ struct mmc_queue *mq = q->queuedata;
+ unsigned long flags;
+- int ret;
++ bool ignore_tout;
+
+ spin_lock_irqsave(q->queue_lock, flags);
+-
+- if (mq->recovery_needed || !mq->use_cqe)
+- ret = BLK_EH_RESET_TIMER;
+- else
+- ret = mmc_cqe_timed_out(req);
+-
++ ignore_tout = mq->recovery_needed || !mq->use_cqe;
+ spin_unlock_irqrestore(q->queue_lock, flags);
+
+- return ret;
++ return ignore_tout ? BLK_EH_RESET_TIMER : mmc_cqe_timed_out(req);
+ }
+
+ static void mmc_mq_recovery_handler(struct work_struct *work)
+diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
+index 4985268e2273..36dee305c687 100644
+--- a/drivers/net/bonding/bond_sysfs_slave.c
++++ b/drivers/net/bonding/bond_sysfs_slave.c
+@@ -153,8 +153,10 @@ int bond_sysfs_slave_add(struct slave *slave)
+
+ err = kobject_init_and_add(&slave->kobj, &slave_ktype,
+ &(slave->dev->dev.kobj), "bonding_slave");
+- if (err)
++ if (err) {
++ kobject_put(&slave->kobj);
+ return err;
++ }
+
+ for (a = slave_attrs; *a; ++a) {
+ err = sysfs_create_file(&slave->kobj, &((*a)->attr));
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 05982e9fb6bb..8b39a211ecb6 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -685,11 +685,8 @@ mt7530_cpu_port_enable(struct mt7530_priv *priv,
+ /* Setup the MAC by default for the cpu port */
+ mt7530_write(priv, MT7530_PMCR_P(port), PMCR_CPUP_LINK);
+
+- /* Disable auto learning on the cpu port */
+- mt7530_set(priv, MT7530_PSC_P(port), SA_DIS);
+-
+- /* Unknown unicast frame fordwarding to the cpu port */
+- mt7530_set(priv, MT7530_MFC, UNU_FFP(BIT(port)));
++ /* Unknown multicast frame forwarding to the cpu port */
++ mt7530_rmw(priv, MT7530_MFC, UNM_FFP_MASK, UNM_FFP(BIT(port)));
+
+ /* CPU port gets connected to all user ports of
+ * the switch
+@@ -1288,8 +1285,6 @@ mt7530_setup(struct dsa_switch *ds)
+ /* Enable and reset MIB counters */
+ mt7530_mib_reset(ds);
+
+- mt7530_clear(priv, MT7530_MFC, UNU_FFP_MASK);
+-
+ for (i = 0; i < MT7530_NUM_PORTS; i++) {
+ /* Disable forwarding by default on all ports */
+ mt7530_rmw(priv, MT7530_PCR_P(i), PCR_MATRIX_MASK,
+diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h
+index ea30f10397aa..403adbe5a4b4 100644
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -34,6 +34,7 @@
+ #define MT7530_MFC 0x10
+ #define BC_FFP(x) (((x) & 0xff) << 24)
+ #define UNM_FFP(x) (((x) & 0xff) << 16)
++#define UNM_FFP_MASK UNM_FFP(~0)
+ #define UNU_FFP(x) (((x) & 0xff) << 8)
+ #define UNU_FFP_MASK UNU_FFP(~0)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index dca58d28d82f..ab4d1dacb585 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -7177,7 +7177,7 @@ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init,
+ bnxt_free_skbs(bp);
+
+ /* Save ring stats before shutdown */
+- if (bp->bnapi)
++ if (bp->bnapi && irq_re_init)
+ bnxt_get_ring_stats(bp, &bp->net_stats_prev);
+ if (irq_re_init) {
+ bnxt_free_irq(bp);
+diff --git a/drivers/net/ethernet/freescale/Kconfig b/drivers/net/ethernet/freescale/Kconfig
+index a580a3dcbe59..e9f4326a0afa 100644
+--- a/drivers/net/ethernet/freescale/Kconfig
++++ b/drivers/net/ethernet/freescale/Kconfig
+@@ -76,6 +76,7 @@ config UCC_GETH
+ depends on QUICC_ENGINE
+ select FSL_PQ_MDIO
+ select PHYLIB
++ select FIXED_PHY
+ ---help---
+ This driver supports the Gigabit Ethernet mode of the QUICC Engine,
+ which is available on some Freescale SOCs.
+@@ -89,6 +90,7 @@ config GIANFAR
+ depends on HAS_DMA
+ select FSL_PQ_MDIO
+ select PHYLIB
++ select FIXED_PHY
+ select CRC32
+ ---help---
+ This driver supports the Gigabit TSEC on the MPC83xx, MPC85xx,
+diff --git a/drivers/net/ethernet/freescale/dpaa/Kconfig b/drivers/net/ethernet/freescale/dpaa/Kconfig
+index a654736237a9..8fec41e57178 100644
+--- a/drivers/net/ethernet/freescale/dpaa/Kconfig
++++ b/drivers/net/ethernet/freescale/dpaa/Kconfig
+@@ -2,6 +2,7 @@ menuconfig FSL_DPAA_ETH
+ tristate "DPAA Ethernet"
+ depends on FSL_DPAA && FSL_FMAN
+ select PHYLIB
++ select FIXED_PHY
+ select FSL_FMAN_MAC
+ ---help---
+ Data Path Acceleration Architecture Ethernet driver,
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 4b21ae27a9fd..6683409fbd4a 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2796,7 +2796,7 @@ static int dpaa_eth_probe(struct platform_device *pdev)
+ }
+
+ /* Do this here, so we can be verbose early */
+- SET_NETDEV_DEV(net_dev, dev);
++ SET_NETDEV_DEV(net_dev, dev->parent);
+ dev_set_drvdata(dev, net_dev);
+
+ priv = netdev_priv(net_dev);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
+index 75213046563c..04ebce738db9 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
+@@ -2731,7 +2731,7 @@ void mlx4_opreq_action(struct work_struct *work)
+ if (err) {
+ mlx4_err(dev, "Failed to retrieve required operation: %d\n",
+ err);
+- return;
++ goto out;
+ }
+ MLX4_GET(modifier, outbox, GET_OP_REQ_MODIFIER_OFFSET);
+ MLX4_GET(token, outbox, GET_OP_REQ_TOKEN_OFFSET);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index 300456684728..a686082762df 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -835,6 +835,7 @@ static void cmd_work_handler(struct work_struct *work)
+ int alloc_ret;
+ int cmd_mode;
+
++ complete(&ent->handling);
+ sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem;
+ down(sem);
+ if (!ent->page_queue) {
+@@ -953,6 +954,11 @@ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
+ struct mlx5_cmd *cmd = &dev->cmd;
+ int err;
+
++ if (!wait_for_completion_timeout(&ent->handling, timeout) &&
++ cancel_work_sync(&ent->work)) {
++ ent->ret = -ECANCELED;
++ goto out_err;
++ }
+ if (cmd->mode == CMD_MODE_POLLING || ent->polling) {
+ wait_for_completion(&ent->done);
+ } else if (!wait_for_completion_timeout(&ent->done, timeout)) {
+@@ -960,12 +966,17 @@ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
+ mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
+ }
+
++out_err:
+ err = ent->ret;
+
+ if (err == -ETIMEDOUT) {
+ mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n",
+ mlx5_command_str(msg_to_opcode(ent->in)),
+ msg_to_opcode(ent->in));
++ } else if (err == -ECANCELED) {
++ mlx5_core_warn(dev, "%s(0x%x) canceled on out of queue timeout.\n",
++ mlx5_command_str(msg_to_opcode(ent->in)),
++ msg_to_opcode(ent->in));
+ }
+ mlx5_core_dbg(dev, "err %d, delivery status %s(%d)\n",
+ err, deliv_status_to_str(ent->status), ent->status);
+@@ -1001,6 +1012,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
+ ent->token = token;
+ ent->polling = force_polling;
+
++ init_completion(&ent->handling);
+ if (!callback)
+ init_completion(&ent->done);
+
+@@ -1020,6 +1032,8 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
+ err = wait_func(dev, ent);
+ if (err == -ETIMEDOUT)
+ goto out;
++ if (err == -ECANCELED)
++ goto out_free;
+
+ ds = ent->ts2 - ent->ts1;
+ op = MLX5_GET(mbox_in, in->first.data, opcode);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+index 73dce92c41c4..52d3989bb8e2 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+@@ -595,8 +595,9 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
+ void mlx5e_free_txqsq_descs(struct mlx5e_txqsq *sq)
+ {
+ struct mlx5e_tx_wqe_info *wi;
++ u32 nbytes = 0;
++ u16 ci, npkts = 0;
+ struct sk_buff *skb;
+- u16 ci;
+ int i;
+
+ while (sq->cc != sq->pc) {
+@@ -617,8 +618,11 @@ void mlx5e_free_txqsq_descs(struct mlx5e_txqsq *sq)
+ }
+
+ dev_kfree_skb_any(skb);
++ npkts++;
++ nbytes += wi->num_bytes;
+ sq->cc += wi->num_wqebbs;
+ }
++ netdev_tx_completed_queue(sq->txq, npkts, nbytes);
+ }
+
+ #ifdef CONFIG_MLX5_CORE_IPOIB
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index b16e0f45d28c..2f6c3353055d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -364,6 +364,12 @@ static void del_sw_ns(struct fs_node *node)
+
+ static void del_sw_prio(struct fs_node *node)
+ {
++ struct mlx5_flow_root_namespace *root_ns;
++ struct mlx5_flow_namespace *ns;
++
++ fs_get_obj(ns, node);
++ root_ns = container_of(ns, struct mlx5_flow_root_namespace, ns);
++ mutex_destroy(&root_ns->chain_lock);
+ kfree(node);
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index 5df9b25cab27..1019c9efedea 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -3126,6 +3126,7 @@ static void mlxsw_sp_ports_remove(struct mlxsw_sp *mlxsw_sp)
+ mlxsw_sp_port_remove(mlxsw_sp, i);
+ kfree(mlxsw_sp->port_to_module);
+ kfree(mlxsw_sp->ports);
++ mlxsw_sp->ports = NULL;
+ }
+
+ static int mlxsw_sp_ports_create(struct mlxsw_sp *mlxsw_sp)
+@@ -3174,6 +3175,7 @@ err_port_module_info_get:
+ kfree(mlxsw_sp->port_to_module);
+ err_port_to_module_alloc:
+ kfree(mlxsw_sp->ports);
++ mlxsw_sp->ports = NULL;
+ return err;
+ }
+
+@@ -3228,6 +3230,14 @@ static void mlxsw_sp_port_unsplit_create(struct mlxsw_sp *mlxsw_sp,
+ }
+ }
+
++static struct mlxsw_sp_port *
++mlxsw_sp_port_get_by_local_port(struct mlxsw_sp *mlxsw_sp, u8 local_port)
++{
++ if (mlxsw_sp->ports && mlxsw_sp->ports[local_port])
++ return mlxsw_sp->ports[local_port];
++ return NULL;
++}
++
+ static int mlxsw_sp_port_split(struct mlxsw_core *mlxsw_core, u8 local_port,
+ unsigned int count,
+ struct netlink_ext_ack *extack)
+@@ -3238,7 +3248,7 @@ static int mlxsw_sp_port_split(struct mlxsw_core *mlxsw_core, u8 local_port,
+ int i;
+ int err;
+
+- mlxsw_sp_port = mlxsw_sp->ports[local_port];
++ mlxsw_sp_port = mlxsw_sp_port_get_by_local_port(mlxsw_sp, local_port);
+ if (!mlxsw_sp_port) {
+ dev_err(mlxsw_sp->bus_info->dev, "Port number \"%d\" does not exist\n",
+ local_port);
+@@ -3305,7 +3315,7 @@ static int mlxsw_sp_port_unsplit(struct mlxsw_core *mlxsw_core, u8 local_port,
+ unsigned int count;
+ int i;
+
+- mlxsw_sp_port = mlxsw_sp->ports[local_port];
++ mlxsw_sp_port = mlxsw_sp_port_get_by_local_port(mlxsw_sp, local_port);
+ if (!mlxsw_sp_port) {
+ dev_err(mlxsw_sp->bus_info->dev, "Port number \"%d\" does not exist\n",
+ local_port);
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
+index 2d4f213e154d..b22c190e001d 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
+@@ -1289,6 +1289,7 @@ static void mlxsw_sx_ports_remove(struct mlxsw_sx *mlxsw_sx)
+ if (mlxsw_sx_port_created(mlxsw_sx, i))
+ mlxsw_sx_port_remove(mlxsw_sx, i);
+ kfree(mlxsw_sx->ports);
++ mlxsw_sx->ports = NULL;
+ }
+
+ static int mlxsw_sx_ports_create(struct mlxsw_sx *mlxsw_sx)
+@@ -1323,6 +1324,7 @@ err_port_module_info_get:
+ if (mlxsw_sx_port_created(mlxsw_sx, i))
+ mlxsw_sx_port_remove(mlxsw_sx, i);
+ kfree(mlxsw_sx->ports);
++ mlxsw_sx->ports = NULL;
+ return err;
+ }
+
+@@ -1406,6 +1408,12 @@ static int mlxsw_sx_port_type_set(struct mlxsw_core *mlxsw_core, u8 local_port,
+ u8 module, width;
+ int err;
+
++ if (!mlxsw_sx->ports || !mlxsw_sx->ports[local_port]) {
++ dev_err(mlxsw_sx->bus_info->dev, "Port number \"%d\" does not exist\n",
++ local_port);
++ return -EINVAL;
++ }
++
+ if (new_type == DEVLINK_PORT_TYPE_AUTO)
+ return -EOPNOTSUPP;
+
+diff --git a/drivers/net/ethernet/microchip/encx24j600.c b/drivers/net/ethernet/microchip/encx24j600.c
+index f831238d9793..84b6ad76f5bc 100644
+--- a/drivers/net/ethernet/microchip/encx24j600.c
++++ b/drivers/net/ethernet/microchip/encx24j600.c
+@@ -1075,7 +1075,7 @@ static int encx24j600_spi_probe(struct spi_device *spi)
+ if (unlikely(ret)) {
+ netif_err(priv, probe, ndev, "Error %d initializing card encx24j600 card\n",
+ ret);
+- goto out_free;
++ goto out_stop;
+ }
+
+ eidled = encx24j600_read_reg(priv, EIDLED);
+@@ -1093,6 +1093,8 @@ static int encx24j600_spi_probe(struct spi_device *spi)
+
+ out_unregister:
+ unregister_netdev(priv->ndev);
++out_stop:
++ kthread_stop(priv->kworker_task);
+ out_free:
+ free_netdev(ndev);
+
+@@ -1105,6 +1107,7 @@ static int encx24j600_spi_remove(struct spi_device *spi)
+ struct encx24j600_priv *priv = dev_get_drvdata(&spi->dev);
+
+ unregister_netdev(priv->ndev);
++ kthread_stop(priv->kworker_task);
+
+ free_netdev(priv->ndev);
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+index a79d84f99102..6ed8294f7df8 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+@@ -3651,7 +3651,7 @@ int qlcnic_83xx_interrupt_test(struct net_device *netdev)
+ ahw->diag_cnt = 0;
+ ret = qlcnic_alloc_mbx_args(&cmd, adapter, QLCNIC_CMD_INTRPT_TEST);
+ if (ret)
+- goto fail_diag_irq;
++ goto fail_mbx_args;
+
+ if (adapter->flags & QLCNIC_MSIX_ENABLED)
+ intrpt_id = ahw->intr_tbl[0].id;
+@@ -3681,6 +3681,8 @@ int qlcnic_83xx_interrupt_test(struct net_device *netdev)
+
+ done:
+ qlcnic_free_mbx_args(&cmd);
++
++fail_mbx_args:
+ qlcnic_83xx_diag_free_res(netdev, drv_sds_rings);
+
+ fail_diag_irq:
+diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
+index 7ec4eb74fe21..d323dd9daccb 100644
+--- a/drivers/net/ethernet/sun/cassini.c
++++ b/drivers/net/ethernet/sun/cassini.c
+@@ -4971,7 +4971,7 @@ static int cas_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ cas_cacheline_size)) {
+ dev_err(&pdev->dev, "Could not set PCI cache "
+ "line size\n");
+- goto err_write_cacheline;
++ goto err_out_free_res;
+ }
+ }
+ #endif
+@@ -5144,7 +5144,6 @@ err_out_iounmap:
+ err_out_free_res:
+ pci_release_regions(pdev);
+
+-err_write_cacheline:
+ /* Try to restore it in case the error occurred after we
+ * set it.
+ */
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index c3cf9ae6d1df..1de97b69ce4e 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -821,14 +821,21 @@ static const struct usb_device_id products[] = {
+ .driver_info = 0,
+ },
+
+-/* Microsoft Surface 3 dock (based on Realtek RTL8153) */
++/* Microsoft Surface Ethernet Adapter (based on Realtek RTL8153) */
+ {
+ USB_DEVICE_AND_INTERFACE_INFO(MICROSOFT_VENDOR_ID, 0x07c6, USB_CLASS_COMM,
+ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+ .driver_info = 0,
+ },
+
+- /* TP-LINK UE300 USB 3.0 Ethernet Adapters (based on Realtek RTL8153) */
++/* Microsoft Surface Ethernet Adapter (based on Realtek RTL8153B) */
++{
++ USB_DEVICE_AND_INTERFACE_INFO(MICROSOFT_VENDOR_ID, 0x0927, USB_CLASS_COMM,
++ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
++ .driver_info = 0,
++},
++
++/* TP-LINK UE300 USB 3.0 Ethernet Adapters (based on Realtek RTL8153) */
+ {
+ USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, 0x0601, USB_CLASS_COMM,
+ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 0639178cb009..1b1ec4197830 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -5344,6 +5344,7 @@ static const struct usb_device_id rtl8152_table[] = {
+ {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8153)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07ab)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07c6)},
++ {REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x0927)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x304f)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3062)},
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index edf7984707b7..b2fd505938a0 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -112,6 +112,7 @@ static const struct property_entry dwc3_pci_intel_properties[] = {
+
+ static const struct property_entry dwc3_pci_mrfld_properties[] = {
+ PROPERTY_ENTRY_STRING("dr_mode", "otg"),
++ PROPERTY_ENTRY_STRING("linux,extcon-name", "mrfld_bcove_pwrsrc"),
+ PROPERTY_ENTRY_BOOL("linux,sysdev_is_parent"),
+ {}
+ };
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index 37ca0e669bd8..25d417ad9000 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -1360,7 +1360,6 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+
+ req->buf = dev->rbuf;
+ req->context = NULL;
+- value = -EOPNOTSUPP;
+ switch (ctrl->bRequest) {
+
+ case USB_REQ_GET_DESCRIPTOR:
+@@ -1783,7 +1782,7 @@ static ssize_t
+ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+ {
+ struct dev_data *dev = fd->private_data;
+- ssize_t value = len, length = len;
++ ssize_t value, length = len;
+ unsigned total;
+ u32 tag;
+ char *kbuf;
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index e7fd0b5b9234..975dd0dbc252 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1766,7 +1766,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
+ (!regset->active || regset->active(t->task, regset) > 0)) {
+ int ret;
+ size_t size = regset_size(t->task, regset);
+- void *data = kmalloc(size, GFP_KERNEL);
++ void *data = kzalloc(size, GFP_KERNEL);
+ if (unlikely(!data))
+ return 0;
+ ret = regset->get(t->task, regset,
+diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
+index 8a577409d030..f822ac9e3cb0 100644
+--- a/fs/cachefiles/rdwr.c
++++ b/fs/cachefiles/rdwr.c
+@@ -64,9 +64,9 @@ static int cachefiles_read_waiter(wait_queue_entry_t *wait, unsigned mode,
+ object = container_of(op->op.object, struct cachefiles_object, fscache);
+ spin_lock(&object->work_lock);
+ list_add_tail(&monitor->op_link, &op->to_do);
++ fscache_enqueue_retrieval(op);
+ spin_unlock(&object->work_lock);
+
+- fscache_enqueue_retrieval(op);
+ fscache_put_retrieval(op);
+ return 0;
+ }
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index cfb0d91289ec..128cbd69911b 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -3532,7 +3532,7 @@ cifs_read(struct file *file, char *read_data, size_t read_size, loff_t *offset)
+ * than it negotiated since it will refuse the read
+ * then.
+ */
+- if ((tcon->ses) && !(tcon->ses->capabilities &
++ if (!(tcon->ses->capabilities &
+ tcon->ses->server->vals->cap_large_files)) {
+ current_read_size = min_t(uint,
+ current_read_size, CIFSMaxBufSize);
+diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
+index 0efae7a0ee80..dd0f9bc13164 100644
+--- a/fs/gfs2/quota.c
++++ b/fs/gfs2/quota.c
+@@ -1043,8 +1043,7 @@ int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid)
+ u32 x;
+ int error = 0;
+
+- if (capable(CAP_SYS_RESOURCE) ||
+- sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
++ if (sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
+ return 0;
+
+ error = gfs2_quota_hold(ip, uid, gid);
+diff --git a/fs/gfs2/quota.h b/fs/gfs2/quota.h
+index 836f29480be6..e3a6e2404d11 100644
+--- a/fs/gfs2/quota.h
++++ b/fs/gfs2/quota.h
+@@ -47,7 +47,8 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip,
+ int ret;
+
+ ap->allowed = UINT_MAX; /* Assume we are permitted a whole lot */
+- if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
++ if (capable(CAP_SYS_RESOURCE) ||
++ sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
+ return 0;
+ ret = gfs2_quota_lock(ip, NO_UID_QUOTA_CHANGE, NO_GID_QUOTA_CHANGE);
+ if (ret)
+diff --git a/include/asm-generic/topology.h b/include/asm-generic/topology.h
+index 238873739550..5aa8705df87e 100644
+--- a/include/asm-generic/topology.h
++++ b/include/asm-generic/topology.h
+@@ -48,7 +48,7 @@
+ #ifdef CONFIG_NEED_MULTIPLE_NODES
+ #define cpumask_of_node(node) ((node) == 0 ? cpu_online_mask : cpu_none_mask)
+ #else
+- #define cpumask_of_node(node) ((void)node, cpu_online_mask)
++ #define cpumask_of_node(node) ((void)(node), cpu_online_mask)
+ #endif
+ #endif
+ #ifndef pcibus_to_node
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index ae64fced188d..dc89a964c1f3 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -902,6 +902,7 @@ struct mlx5_cmd_work_ent {
+ struct delayed_work cb_timeout_work;
+ void *context;
+ int idx;
++ struct completion handling;
+ struct completion done;
+ struct mlx5_cmd *cmd;
+ struct work_struct work;
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 45f10f5896b7..b1092046ebef 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -602,6 +602,11 @@ static inline void *kvcalloc(size_t n, size_t size, gfp_t flags)
+
+ extern void kvfree(const void *addr);
+
++/*
++ * Mapcount of compound page as a whole, does not include mapped sub-pages.
++ *
++ * Must be called only for compound pages or any their tail sub-pages.
++ */
+ static inline int compound_mapcount(struct page *page)
+ {
+ VM_BUG_ON_PAGE(!PageCompound(page), page);
+@@ -621,10 +626,16 @@ static inline void page_mapcount_reset(struct page *page)
+
+ int __page_mapcount(struct page *page);
+
++/*
++ * Mapcount of 0-order page; when compound sub-page, includes
++ * compound_mapcount().
++ *
++ * Result is undefined for pages which cannot be mapped into userspace.
++ * For example SLAB or special types of pages. See function page_has_type().
++ * They use this place in struct page differently.
++ */
+ static inline int page_mapcount(struct page *page)
+ {
+- VM_BUG_ON_PAGE(PageSlab(page), page);
+-
+ if (unlikely(PageCompound(page)))
+ return __page_mapcount(page);
+ return atomic_read(&page->_mapcount) + 1;
+diff --git a/include/linux/netfilter/nf_conntrack_pptp.h b/include/linux/netfilter/nf_conntrack_pptp.h
+index 833a5b2255ea..ade993809ebc 100644
+--- a/include/linux/netfilter/nf_conntrack_pptp.h
++++ b/include/linux/netfilter/nf_conntrack_pptp.h
+@@ -5,7 +5,7 @@
+
+ #include <linux/netfilter/nf_conntrack_common.h>
+
+-extern const char *const pptp_msg_name[];
++const char *pptp_msg_name(u_int16_t msg);
+
+ /* state of the control session */
+ enum pptp_ctrlsess_state {
+diff --git a/include/net/act_api.h b/include/net/act_api.h
+index 0c82d7ea6ee1..c48b750de2fc 100644
+--- a/include/net/act_api.h
++++ b/include/net/act_api.h
+@@ -67,7 +67,8 @@ static inline void tcf_tm_dump(struct tcf_t *dtm, const struct tcf_t *stm)
+ {
+ dtm->install = jiffies_to_clock_t(jiffies - stm->install);
+ dtm->lastuse = jiffies_to_clock_t(jiffies - stm->lastuse);
+- dtm->firstuse = jiffies_to_clock_t(jiffies - stm->firstuse);
++ dtm->firstuse = stm->firstuse ?
++ jiffies_to_clock_t(jiffies - stm->firstuse) : 0;
+ dtm->expires = jiffies_to_clock_t(stm->expires);
+ }
+
+diff --git a/include/rdma/uverbs_std_types.h b/include/rdma/uverbs_std_types.h
+index 3b00231cc084..62f851569936 100644
+--- a/include/rdma/uverbs_std_types.h
++++ b/include/rdma/uverbs_std_types.h
+@@ -95,7 +95,7 @@ struct ib_uobject *__uobj_get_destroy(const struct uverbs_api_object *obj,
+
+ static inline void uobj_put_destroy(struct ib_uobject *uobj)
+ {
+- rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_WRITE);
++ rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_DESTROY);
+ }
+
+ static inline void uobj_put_read(struct ib_uobject *uobj)
+diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
+index 5f3b9fec7b5f..ff7cfdc6cb44 100644
+--- a/include/uapi/linux/xfrm.h
++++ b/include/uapi/linux/xfrm.h
+@@ -304,7 +304,7 @@ enum xfrm_attr_type_t {
+ XFRMA_PROTO, /* __u8 */
+ XFRMA_ADDRESS_FILTER, /* struct xfrm_address_filter */
+ XFRMA_PAD,
+- XFRMA_OFFLOAD_DEV, /* struct xfrm_state_offload */
++ XFRMA_OFFLOAD_DEV, /* struct xfrm_user_offload */
+ XFRMA_SET_MARK, /* __u32 */
+ XFRMA_SET_MARK_MASK, /* __u32 */
+ XFRMA_IF_ID, /* __u32 */
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 11d0f0b6ec79..1817871b0239 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1510,7 +1510,7 @@ static void __vunmap(const void *addr, int deallocate_pages)
+ addr))
+ return;
+
+- area = find_vmap_area((unsigned long)addr)->vm;
++ area = find_vm_area(addr);
+ if (unlikely(!area)) {
+ WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
+ addr);
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index 44ec492f3dc2..5c7a513bbaaa 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -638,8 +638,10 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
+ break;
+
+ case SO_BINDTODEVICE:
+- if (optlen > IFNAMSIZ)
+- optlen = IFNAMSIZ;
++ if (optlen > IFNAMSIZ - 1)
++ optlen = IFNAMSIZ - 1;
++
++ memset(devname, 0, sizeof(devname));
+
+ if (copy_from_user(devname, optval, optlen)) {
+ res = -EFAULT;
+diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
+index 419e8edf23ba..c9ec46f5313f 100644
+--- a/net/bridge/netfilter/nft_reject_bridge.c
++++ b/net/bridge/netfilter/nft_reject_bridge.c
+@@ -34,6 +34,12 @@ static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
+ ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
+ eth->h_proto = eth_hdr(oldskb)->h_proto;
+ skb_pull(nskb, ETH_HLEN);
++
++ if (skb_vlan_tag_present(oldskb)) {
++ u16 vid = skb_vlan_tag_get(oldskb);
++
++ __vlan_hwaccel_put_tag(nskb, oldskb->vlan_proto, vid);
++ }
+ }
+
+ static int nft_bridge_iphdr_validate(struct sk_buff *skb)
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 76c41a84550e..b8c4aea42917 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -3540,7 +3540,9 @@ static void handle_reply(struct ceph_osd *osd, struct ceph_msg *msg)
+ * supported.
+ */
+ req->r_t.target_oloc.pool = m.redirect.oloc.pool;
+- req->r_flags |= CEPH_OSD_FLAG_REDIRECTED;
++ req->r_flags |= CEPH_OSD_FLAG_REDIRECTED |
++ CEPH_OSD_FLAG_IGNORE_OVERLAY |
++ CEPH_OSD_FLAG_IGNORE_CACHE;
+ req->r_tid = 0;
+ __submit_request(req, false);
+ goto out_unlock_osdc;
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 9ccc14200b80..50498a75c04b 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4778,11 +4778,12 @@ static inline int nf_ingress(struct sk_buff *skb, struct packet_type **pt_prev,
+ return 0;
+ }
+
+-static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc,
++static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
+ struct packet_type **ppt_prev)
+ {
+ struct packet_type *ptype, *pt_prev;
+ rx_handler_func_t *rx_handler;
++ struct sk_buff *skb = *pskb;
+ struct net_device *orig_dev;
+ bool deliver_exact = false;
+ int ret = NET_RX_DROP;
+@@ -4813,8 +4814,10 @@ another_round:
+ ret2 = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
+ preempt_enable();
+
+- if (ret2 != XDP_PASS)
+- return NET_RX_DROP;
++ if (ret2 != XDP_PASS) {
++ ret = NET_RX_DROP;
++ goto out;
++ }
+ skb_reset_mac_len(skb);
+ }
+
+@@ -4936,6 +4939,13 @@ drop:
+ }
+
+ out:
++ /* The invariant here is that if *ppt_prev is not NULL
++ * then skb should also be non-NULL.
++ *
++ * Apparently *ppt_prev assignment above holds this invariant due to
++ * skb dereferencing near it.
++ */
++ *pskb = skb;
+ return ret;
+ }
+
+@@ -4945,7 +4955,7 @@ static int __netif_receive_skb_one_core(struct sk_buff *skb, bool pfmemalloc)
+ struct packet_type *pt_prev = NULL;
+ int ret;
+
+- ret = __netif_receive_skb_core(skb, pfmemalloc, &pt_prev);
++ ret = __netif_receive_skb_core(&skb, pfmemalloc, &pt_prev);
+ if (pt_prev)
+ ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
+ return ret;
+@@ -5021,7 +5031,7 @@ static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemallo
+ struct packet_type *pt_prev = NULL;
+
+ skb_list_del_init(skb);
+- __netif_receive_skb_core(skb, pfmemalloc, &pt_prev);
++ __netif_receive_skb_core(&skb, pfmemalloc, &pt_prev);
+ if (!pt_prev)
+ continue;
+ if (pt_curr != pt_prev || od_curr != orig_dev) {
+diff --git a/net/dsa/tag_mtk.c b/net/dsa/tag_mtk.c
+index 11535bc70743..6574425ad94c 100644
+--- a/net/dsa/tag_mtk.c
++++ b/net/dsa/tag_mtk.c
+@@ -22,6 +22,7 @@
+ #define MTK_HDR_XMIT_TAGGED_TPID_8100 1
+ #define MTK_HDR_RECV_SOURCE_PORT_MASK GENMASK(2, 0)
+ #define MTK_HDR_XMIT_DP_BIT_MASK GENMASK(5, 0)
++#define MTK_HDR_XMIT_SA_DIS BIT(6)
+
+ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb,
+ struct net_device *dev)
+@@ -29,6 +30,9 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb,
+ struct dsa_port *dp = dsa_slave_to_port(dev);
+ u8 *mtk_tag;
+ bool is_vlan_skb = true;
++ unsigned char *dest = eth_hdr(skb)->h_dest;
++ bool is_multicast_skb = is_multicast_ether_addr(dest) &&
++ !is_broadcast_ether_addr(dest);
+
+ /* Build the special tag after the MAC Source Address. If VLAN header
+ * is present, it's required that VLAN header and special tag is
+@@ -54,6 +58,10 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb,
+ MTK_HDR_XMIT_UNTAGGED;
+ mtk_tag[1] = (1 << dp->index) & MTK_HDR_XMIT_DP_BIT_MASK;
+
++ /* Disable SA learning for multicast frames */
++ if (unlikely(is_multicast_skb))
++ mtk_tag[1] |= MTK_HDR_XMIT_SA_DIS;
++
+ /* Tag control information is kept for 802.1Q */
+ if (!is_vlan_skb) {
+ mtk_tag[2] = 0;
+@@ -68,6 +76,9 @@ static struct sk_buff *mtk_tag_rcv(struct sk_buff *skb, struct net_device *dev,
+ {
+ int port;
+ __be16 *phdr, hdr;
++ unsigned char *dest = eth_hdr(skb)->h_dest;
++ bool is_multicast_skb = is_multicast_ether_addr(dest) &&
++ !is_broadcast_ether_addr(dest);
+
+ if (unlikely(!pskb_may_pull(skb, MTK_HDR_LEN)))
+ return NULL;
+@@ -93,6 +104,10 @@ static struct sk_buff *mtk_tag_rcv(struct sk_buff *skb, struct net_device *dev,
+ if (!skb->dev)
+ return NULL;
+
++ /* Only unicast or broadcast frames are offloaded */
++ if (likely(!is_multicast_skb))
++ skb->offload_fwd_mark = 1;
++
+ return skb;
+ }
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 34bd6230e9f4..ddbe58f0d597 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -28,17 +28,19 @@
+ #include <net/addrconf.h>
+
+ #if IS_ENABLED(CONFIG_IPV6)
+-/* match_wildcard == true: IPV6_ADDR_ANY equals to any IPv6 addresses if IPv6
+- * only, and any IPv4 addresses if not IPv6 only
+- * match_wildcard == false: addresses must be exactly the same, i.e.
+- * IPV6_ADDR_ANY only equals to IPV6_ADDR_ANY,
+- * and 0.0.0.0 equals to 0.0.0.0 only
++/* match_sk*_wildcard == true: IPV6_ADDR_ANY equals to any IPv6 addresses
++ * if IPv6 only, and any IPv4 addresses
++ * if not IPv6 only
++ * match_sk*_wildcard == false: addresses must be exactly the same, i.e.
++ * IPV6_ADDR_ANY only equals to IPV6_ADDR_ANY,
++ * and 0.0.0.0 equals to 0.0.0.0 only
+ */
+ static bool ipv6_rcv_saddr_equal(const struct in6_addr *sk1_rcv_saddr6,
+ const struct in6_addr *sk2_rcv_saddr6,
+ __be32 sk1_rcv_saddr, __be32 sk2_rcv_saddr,
+ bool sk1_ipv6only, bool sk2_ipv6only,
+- bool match_wildcard)
++ bool match_sk1_wildcard,
++ bool match_sk2_wildcard)
+ {
+ int addr_type = ipv6_addr_type(sk1_rcv_saddr6);
+ int addr_type2 = sk2_rcv_saddr6 ? ipv6_addr_type(sk2_rcv_saddr6) : IPV6_ADDR_MAPPED;
+@@ -48,8 +50,8 @@ static bool ipv6_rcv_saddr_equal(const struct in6_addr *sk1_rcv_saddr6,
+ if (!sk2_ipv6only) {
+ if (sk1_rcv_saddr == sk2_rcv_saddr)
+ return true;
+- if (!sk1_rcv_saddr || !sk2_rcv_saddr)
+- return match_wildcard;
++ return (match_sk1_wildcard && !sk1_rcv_saddr) ||
++ (match_sk2_wildcard && !sk2_rcv_saddr);
+ }
+ return false;
+ }
+@@ -57,11 +59,11 @@ static bool ipv6_rcv_saddr_equal(const struct in6_addr *sk1_rcv_saddr6,
+ if (addr_type == IPV6_ADDR_ANY && addr_type2 == IPV6_ADDR_ANY)
+ return true;
+
+- if (addr_type2 == IPV6_ADDR_ANY && match_wildcard &&
++ if (addr_type2 == IPV6_ADDR_ANY && match_sk2_wildcard &&
+ !(sk2_ipv6only && addr_type == IPV6_ADDR_MAPPED))
+ return true;
+
+- if (addr_type == IPV6_ADDR_ANY && match_wildcard &&
++ if (addr_type == IPV6_ADDR_ANY && match_sk1_wildcard &&
+ !(sk1_ipv6only && addr_type2 == IPV6_ADDR_MAPPED))
+ return true;
+
+@@ -73,18 +75,19 @@ static bool ipv6_rcv_saddr_equal(const struct in6_addr *sk1_rcv_saddr6,
+ }
+ #endif
+
+-/* match_wildcard == true: 0.0.0.0 equals to any IPv4 addresses
+- * match_wildcard == false: addresses must be exactly the same, i.e.
+- * 0.0.0.0 only equals to 0.0.0.0
++/* match_sk*_wildcard == true: 0.0.0.0 equals to any IPv4 addresses
++ * match_sk*_wildcard == false: addresses must be exactly the same, i.e.
++ * 0.0.0.0 only equals to 0.0.0.0
+ */
+ static bool ipv4_rcv_saddr_equal(__be32 sk1_rcv_saddr, __be32 sk2_rcv_saddr,
+- bool sk2_ipv6only, bool match_wildcard)
++ bool sk2_ipv6only, bool match_sk1_wildcard,
++ bool match_sk2_wildcard)
+ {
+ if (!sk2_ipv6only) {
+ if (sk1_rcv_saddr == sk2_rcv_saddr)
+ return true;
+- if (!sk1_rcv_saddr || !sk2_rcv_saddr)
+- return match_wildcard;
++ return (match_sk1_wildcard && !sk1_rcv_saddr) ||
++ (match_sk2_wildcard && !sk2_rcv_saddr);
+ }
+ return false;
+ }
+@@ -100,10 +103,12 @@ bool inet_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2,
+ sk2->sk_rcv_saddr,
+ ipv6_only_sock(sk),
+ ipv6_only_sock(sk2),
++ match_wildcard,
+ match_wildcard);
+ #endif
+ return ipv4_rcv_saddr_equal(sk->sk_rcv_saddr, sk2->sk_rcv_saddr,
+- ipv6_only_sock(sk2), match_wildcard);
++ ipv6_only_sock(sk2), match_wildcard,
++ match_wildcard);
+ }
+ EXPORT_SYMBOL(inet_rcv_saddr_equal);
+
+@@ -274,10 +279,10 @@ static inline int sk_reuseport_match(struct inet_bind_bucket *tb,
+ tb->fast_rcv_saddr,
+ sk->sk_rcv_saddr,
+ tb->fast_ipv6_only,
+- ipv6_only_sock(sk), true);
++ ipv6_only_sock(sk), true, false);
+ #endif
+ return ipv4_rcv_saddr_equal(tb->fast_rcv_saddr, sk->sk_rcv_saddr,
+- ipv6_only_sock(sk), true);
++ ipv6_only_sock(sk), true, false);
+ }
+
+ /* Obtain a reference to a local port for the given sock,
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index d4c4eabd02b6..15c71b08c2df 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -50,7 +50,7 @@ static unsigned int vti_net_id __read_mostly;
+ static int vti_tunnel_init(struct net_device *dev);
+
+ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
+- int encap_type)
++ int encap_type, bool update_skb_dev)
+ {
+ struct ip_tunnel *tunnel;
+ const struct iphdr *iph = ip_hdr(skb);
+@@ -65,6 +65,9 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
+
+ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
+
++ if (update_skb_dev)
++ skb->dev = tunnel->dev;
++
+ return xfrm_input(skb, nexthdr, spi, encap_type);
+ }
+
+@@ -74,25 +77,43 @@ drop:
+ return 0;
+ }
+
+-static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi,
+- int encap_type)
++static int vti_input_proto(struct sk_buff *skb, int nexthdr, __be32 spi,
++ int encap_type)
+ {
+- struct ip_tunnel *tunnel;
++ return vti_input(skb, nexthdr, spi, encap_type, false);
++}
++
++static int vti_rcv(struct sk_buff *skb, __be32 spi, bool update_skb_dev)
++{
++ XFRM_SPI_SKB_CB(skb)->family = AF_INET;
++ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
++
++ return vti_input(skb, ip_hdr(skb)->protocol, spi, 0, update_skb_dev);
++}
++
++static int vti_rcv_proto(struct sk_buff *skb)
++{
++ return vti_rcv(skb, 0, false);
++}
++
++static int vti_rcv_tunnel(struct sk_buff *skb)
++{
++ struct ip_tunnel_net *itn = net_generic(dev_net(skb->dev), vti_net_id);
+ const struct iphdr *iph = ip_hdr(skb);
+- struct net *net = dev_net(skb->dev);
+- struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
++ struct ip_tunnel *tunnel;
+
+ tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
+ iph->saddr, iph->daddr, 0);
+ if (tunnel) {
++ struct tnl_ptk_info tpi = {
++ .proto = htons(ETH_P_IP),
++ };
++
+ if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+ goto drop;
+-
+- XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
+-
+- skb->dev = tunnel->dev;
+-
+- return xfrm_input(skb, nexthdr, spi, encap_type);
++ if (iptunnel_pull_header(skb, 0, tpi.proto, false))
++ goto drop;
++ return ip_tunnel_rcv(tunnel, skb, &tpi, NULL, false);
+ }
+
+ return -EINVAL;
+@@ -101,22 +122,6 @@ drop:
+ return 0;
+ }
+
+-static int vti_rcv(struct sk_buff *skb)
+-{
+- XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+- XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
+-
+- return vti_input(skb, ip_hdr(skb)->protocol, 0, 0);
+-}
+-
+-static int vti_rcv_ipip(struct sk_buff *skb)
+-{
+- XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+- XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
+-
+- return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0);
+-}
+-
+ static int vti_rcv_cb(struct sk_buff *skb, int err)
+ {
+ unsigned short family;
+@@ -478,31 +483,31 @@ static void __net_init vti_fb_tunnel_init(struct net_device *dev)
+ }
+
+ static struct xfrm4_protocol vti_esp4_protocol __read_mostly = {
+- .handler = vti_rcv,
+- .input_handler = vti_input,
++ .handler = vti_rcv_proto,
++ .input_handler = vti_input_proto,
+ .cb_handler = vti_rcv_cb,
+ .err_handler = vti4_err,
+ .priority = 100,
+ };
+
+ static struct xfrm4_protocol vti_ah4_protocol __read_mostly = {
+- .handler = vti_rcv,
+- .input_handler = vti_input,
++ .handler = vti_rcv_proto,
++ .input_handler = vti_input_proto,
+ .cb_handler = vti_rcv_cb,
+ .err_handler = vti4_err,
+ .priority = 100,
+ };
+
+ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = {
+- .handler = vti_rcv,
+- .input_handler = vti_input,
++ .handler = vti_rcv_proto,
++ .input_handler = vti_input_proto,
+ .cb_handler = vti_rcv_cb,
+ .err_handler = vti4_err,
+ .priority = 100,
+ };
+
+ static struct xfrm_tunnel ipip_handler __read_mostly = {
+- .handler = vti_rcv_ipip,
++ .handler = vti_rcv_tunnel,
+ .err_handler = vti4_err,
+ .priority = 0,
+ };
+diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
+index 4368282eb6f8..da2e92380d78 100644
+--- a/net/ipv4/ipip.c
++++ b/net/ipv4/ipip.c
+@@ -704,7 +704,7 @@ out:
+
+ rtnl_link_failed:
+ #if IS_ENABLED(CONFIG_MPLS)
+- xfrm4_tunnel_deregister(&mplsip_handler, AF_INET);
++ xfrm4_tunnel_deregister(&mplsip_handler, AF_MPLS);
+ xfrm_tunnel_mplsip_failed:
+
+ #endif
+diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
+index 5d259a12e25f..2518c1ca63ae 100644
+--- a/net/ipv4/netfilter/nf_nat_pptp.c
++++ b/net/ipv4/netfilter/nf_nat_pptp.c
+@@ -165,8 +165,7 @@ pptp_outbound_pkt(struct sk_buff *skb,
+ break;
+ default:
+ pr_debug("unknown outbound packet 0x%04x:%s\n", msg,
+- msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] :
+- pptp_msg_name[0]);
++ pptp_msg_name(msg));
+ /* fall through */
+ case PPTP_SET_LINK_INFO:
+ /* only need to NAT in case PAC is behind NAT box */
+@@ -267,9 +266,7 @@ pptp_inbound_pkt(struct sk_buff *skb,
+ pcid_off = offsetof(union pptp_ctrl_union, setlink.peersCallID);
+ break;
+ default:
+- pr_debug("unknown inbound packet %s\n",
+- msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] :
+- pptp_msg_name[0]);
++ pr_debug("unknown inbound packet %s\n", pptp_msg_name(msg));
+ /* fall through */
+ case PPTP_START_SESSION_REQUEST:
+ case PPTP_START_SESSION_REPLY:
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 84ddb16f4fc0..f752d22cc8a5 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -484,18 +484,16 @@ u32 ip_idents_reserve(u32 hash, int segs)
+ atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
+ u32 old = READ_ONCE(*p_tstamp);
+ u32 now = (u32)jiffies;
+- u32 new, delta = 0;
++ u32 delta = 0;
+
+ if (old != now && cmpxchg(p_tstamp, old, now) == old)
+ delta = prandom_u32_max(now - old);
+
+- /* Do not use atomic_add_return() as it makes UBSAN unhappy */
+- do {
+- old = (u32)atomic_read(p_id);
+- new = old + delta + segs;
+- } while (atomic_cmpxchg(p_id, old, new) != old);
+-
+- return new - segs;
++ /* If UBSAN reports an error there, please make sure your compiler
++ * supports -fno-strict-overflow before reporting it that was a bug
++ * in UBSAN, and it has been fixed in GCC-8.
++ */
++ return atomic_add_return(segs + delta, p_id) - segs;
+ }
+ EXPORT_SYMBOL(ip_idents_reserve);
+
+diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
+index 6177e2171171..eeee64a8a72c 100644
+--- a/net/ipv6/esp6_offload.c
++++ b/net/ipv6/esp6_offload.c
+@@ -121,9 +121,16 @@ static void esp6_gso_encap(struct xfrm_state *x, struct sk_buff *skb)
+ struct ip_esp_hdr *esph;
+ struct ipv6hdr *iph = ipv6_hdr(skb);
+ struct xfrm_offload *xo = xfrm_offload(skb);
+- int proto = iph->nexthdr;
++ u8 proto = iph->nexthdr;
+
+ skb_push(skb, -skb_network_offset(skb));
++
++ if (x->outer_mode->encap == XFRM_MODE_TRANSPORT) {
++ __be16 frag;
++
++ ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &proto, &frag);
++ }
++
+ esph = ip_esp_hdr(skb);
+ *skb_mac_header(skb) = IPPROTO_ESP;
+
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index 433d136282de..6219b6b0c7e1 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -1088,7 +1088,14 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
+ mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->vif.addr, ifmsh->sn,
+ target_flags, mpath->dst, mpath->sn, da, 0,
+ ttl, lifetime, 0, ifmsh->preq_id++, sdata);
++
++ spin_lock_bh(&mpath->state_lock);
++ if (mpath->flags & MESH_PATH_DELETED) {
++ spin_unlock_bh(&mpath->state_lock);
++ goto enddiscovery;
++ }
+ mod_timer(&mpath->timer, jiffies + mpath->discovery_timeout);
++ spin_unlock_bh(&mpath->state_lock);
+
+ enddiscovery:
+ rcu_read_unlock();
+diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
+index 8da228da53ae..993ce04e6ea0 100644
+--- a/net/netfilter/ipset/ip_set_list_set.c
++++ b/net/netfilter/ipset/ip_set_list_set.c
+@@ -63,7 +63,7 @@ list_set_ktest(struct ip_set *set, const struct sk_buff *skb,
+ /* Don't lookup sub-counters at all */
+ opt->cmdflags &= ~IPSET_FLAG_MATCH_COUNTERS;
+ if (opt->cmdflags & IPSET_FLAG_SKIP_SUBCOUNTER_UPDATE)
+- opt->cmdflags &= ~IPSET_FLAG_SKIP_COUNTER_UPDATE;
++ opt->cmdflags |= IPSET_FLAG_SKIP_COUNTER_UPDATE;
+ list_for_each_entry_rcu(e, &map->members, list) {
+ ret = ip_set_test(e->id, skb, par, opt);
+ if (ret <= 0)
+diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
+index 11562f2a08bb..203107ce2455 100644
+--- a/net/netfilter/nf_conntrack_pptp.c
++++ b/net/netfilter/nf_conntrack_pptp.c
+@@ -71,24 +71,32 @@ EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_expectfn);
+
+ #if defined(DEBUG) || defined(CONFIG_DYNAMIC_DEBUG)
+ /* PptpControlMessageType names */
+-const char *const pptp_msg_name[] = {
+- "UNKNOWN_MESSAGE",
+- "START_SESSION_REQUEST",
+- "START_SESSION_REPLY",
+- "STOP_SESSION_REQUEST",
+- "STOP_SESSION_REPLY",
+- "ECHO_REQUEST",
+- "ECHO_REPLY",
+- "OUT_CALL_REQUEST",
+- "OUT_CALL_REPLY",
+- "IN_CALL_REQUEST",
+- "IN_CALL_REPLY",
+- "IN_CALL_CONNECT",
+- "CALL_CLEAR_REQUEST",
+- "CALL_DISCONNECT_NOTIFY",
+- "WAN_ERROR_NOTIFY",
+- "SET_LINK_INFO"
++static const char *const pptp_msg_name_array[PPTP_MSG_MAX + 1] = {
++ [0] = "UNKNOWN_MESSAGE",
++ [PPTP_START_SESSION_REQUEST] = "START_SESSION_REQUEST",
++ [PPTP_START_SESSION_REPLY] = "START_SESSION_REPLY",
++ [PPTP_STOP_SESSION_REQUEST] = "STOP_SESSION_REQUEST",
++ [PPTP_STOP_SESSION_REPLY] = "STOP_SESSION_REPLY",
++ [PPTP_ECHO_REQUEST] = "ECHO_REQUEST",
++ [PPTP_ECHO_REPLY] = "ECHO_REPLY",
++ [PPTP_OUT_CALL_REQUEST] = "OUT_CALL_REQUEST",
++ [PPTP_OUT_CALL_REPLY] = "OUT_CALL_REPLY",
++ [PPTP_IN_CALL_REQUEST] = "IN_CALL_REQUEST",
++ [PPTP_IN_CALL_REPLY] = "IN_CALL_REPLY",
++ [PPTP_IN_CALL_CONNECT] = "IN_CALL_CONNECT",
++ [PPTP_CALL_CLEAR_REQUEST] = "CALL_CLEAR_REQUEST",
++ [PPTP_CALL_DISCONNECT_NOTIFY] = "CALL_DISCONNECT_NOTIFY",
++ [PPTP_WAN_ERROR_NOTIFY] = "WAN_ERROR_NOTIFY",
++ [PPTP_SET_LINK_INFO] = "SET_LINK_INFO"
+ };
++
++const char *pptp_msg_name(u_int16_t msg)
++{
++ if (msg > PPTP_MSG_MAX)
++ return pptp_msg_name_array[0];
++
++ return pptp_msg_name_array[msg];
++}
+ EXPORT_SYMBOL(pptp_msg_name);
+ #endif
+
+@@ -275,7 +283,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
+ typeof(nf_nat_pptp_hook_inbound) nf_nat_pptp_inbound;
+
+ msg = ntohs(ctlh->messageType);
+- pr_debug("inbound control message %s\n", pptp_msg_name[msg]);
++ pr_debug("inbound control message %s\n", pptp_msg_name(msg));
+
+ switch (msg) {
+ case PPTP_START_SESSION_REPLY:
+@@ -310,7 +318,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
+ pcid = pptpReq->ocack.peersCallID;
+ if (info->pns_call_id != pcid)
+ goto invalid;
+- pr_debug("%s, CID=%X, PCID=%X\n", pptp_msg_name[msg],
++ pr_debug("%s, CID=%X, PCID=%X\n", pptp_msg_name(msg),
+ ntohs(cid), ntohs(pcid));
+
+ if (pptpReq->ocack.resultCode == PPTP_OUTCALL_CONNECT) {
+@@ -327,7 +335,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
+ goto invalid;
+
+ cid = pptpReq->icreq.callID;
+- pr_debug("%s, CID=%X\n", pptp_msg_name[msg], ntohs(cid));
++ pr_debug("%s, CID=%X\n", pptp_msg_name(msg), ntohs(cid));
+ info->cstate = PPTP_CALL_IN_REQ;
+ info->pac_call_id = cid;
+ break;
+@@ -346,7 +354,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
+ if (info->pns_call_id != pcid)
+ goto invalid;
+
+- pr_debug("%s, PCID=%X\n", pptp_msg_name[msg], ntohs(pcid));
++ pr_debug("%s, PCID=%X\n", pptp_msg_name(msg), ntohs(pcid));
+ info->cstate = PPTP_CALL_IN_CONF;
+
+ /* we expect a GRE connection from PAC to PNS */
+@@ -356,7 +364,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
+ case PPTP_CALL_DISCONNECT_NOTIFY:
+ /* server confirms disconnect */
+ cid = pptpReq->disc.callID;
+- pr_debug("%s, CID=%X\n", pptp_msg_name[msg], ntohs(cid));
++ pr_debug("%s, CID=%X\n", pptp_msg_name(msg), ntohs(cid));
+ info->cstate = PPTP_CALL_NONE;
+
+ /* untrack this call id, unexpect GRE packets */
+@@ -383,7 +391,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
+ invalid:
+ pr_debug("invalid %s: type=%d cid=%u pcid=%u "
+ "cstate=%d sstate=%d pns_cid=%u pac_cid=%u\n",
+- msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : pptp_msg_name[0],
++ pptp_msg_name(msg),
+ msg, ntohs(cid), ntohs(pcid), info->cstate, info->sstate,
+ ntohs(info->pns_call_id), ntohs(info->pac_call_id));
+ return NF_ACCEPT;
+@@ -403,7 +411,7 @@ pptp_outbound_pkt(struct sk_buff *skb, unsigned int protoff,
+ typeof(nf_nat_pptp_hook_outbound) nf_nat_pptp_outbound;
+
+ msg = ntohs(ctlh->messageType);
+- pr_debug("outbound control message %s\n", pptp_msg_name[msg]);
++ pr_debug("outbound control message %s\n", pptp_msg_name(msg));
+
+ switch (msg) {
+ case PPTP_START_SESSION_REQUEST:
+@@ -425,7 +433,7 @@ pptp_outbound_pkt(struct sk_buff *skb, unsigned int protoff,
+ info->cstate = PPTP_CALL_OUT_REQ;
+ /* track PNS call id */
+ cid = pptpReq->ocreq.callID;
+- pr_debug("%s, CID=%X\n", pptp_msg_name[msg], ntohs(cid));
++ pr_debug("%s, CID=%X\n", pptp_msg_name(msg), ntohs(cid));
+ info->pns_call_id = cid;
+ break;
+
+@@ -439,7 +447,7 @@ pptp_outbound_pkt(struct sk_buff *skb, unsigned int protoff,
+ pcid = pptpReq->icack.peersCallID;
+ if (info->pac_call_id != pcid)
+ goto invalid;
+- pr_debug("%s, CID=%X PCID=%X\n", pptp_msg_name[msg],
++ pr_debug("%s, CID=%X PCID=%X\n", pptp_msg_name(msg),
+ ntohs(cid), ntohs(pcid));
+
+ if (pptpReq->icack.resultCode == PPTP_INCALL_ACCEPT) {
+@@ -479,7 +487,7 @@ pptp_outbound_pkt(struct sk_buff *skb, unsigned int protoff,
+ invalid:
+ pr_debug("invalid %s: type=%d cid=%u pcid=%u "
+ "cstate=%d sstate=%d pns_cid=%u pac_cid=%u\n",
+- msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : pptp_msg_name[0],
++ pptp_msg_name(msg),
+ msg, ntohs(cid), ntohs(pcid), info->cstate, info->sstate,
+ ntohs(info->pns_call_id), ntohs(info->pac_call_id));
+ return NF_ACCEPT;
+diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
+index 66154dafa305..ddcb1b607474 100644
+--- a/net/netfilter/nfnetlink_cthelper.c
++++ b/net/netfilter/nfnetlink_cthelper.c
+@@ -106,7 +106,7 @@ nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct)
+ if (help->helper->data_len == 0)
+ return -EINVAL;
+
+- nla_memcpy(help->data, nla_data(attr), sizeof(help->data));
++ nla_memcpy(help->data, attr, sizeof(help->data));
+ return 0;
+ }
+
+@@ -242,6 +242,7 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
+ ret = -ENOMEM;
+ goto err2;
+ }
++ helper->data_len = size;
+
+ helper->flags |= NF_CT_HELPER_F_USERSPACE;
+ memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple));
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 518327dccb3c..9605979a349e 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -718,7 +718,7 @@ static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+ }
+ mutex_unlock(&qrtr_node_lock);
+
+- qrtr_local_enqueue(node, skb, type, from, to);
++ qrtr_local_enqueue(NULL, skb, type, from, to);
+
+ return 0;
+ }
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 0234a64b3b19..567517e44811 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -1537,9 +1537,17 @@ static int sctp_cmd_interpreter(enum sctp_event event_type,
+ timeout = asoc->timeouts[cmd->obj.to];
+ BUG_ON(!timeout);
+
+- timer->expires = jiffies + timeout;
+- sctp_association_hold(asoc);
+- add_timer(timer);
++ /*
++ * SCTP has a hard time with timer starts. Because we process
++ * timer starts as side effects, it can be hard to tell if we
++ * have already started a timer or not, which leads to BUG
++ * halts when we call add_timer. So here, instead of just starting
++ * a timer, if the timer is already started, and just mod
++ * the timer with the shorter of the two expiration times
++ */
++ if (!timer_pending(timer))
++ sctp_association_hold(asoc);
++ timer_reduce(timer, jiffies + timeout);
+ break;
+
+ case SCTP_CMD_TIMER_RESTART:
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index c437ae93b5a9..a3033b74df54 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -1871,12 +1871,13 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
+ /* Update the content of current association. */
+ sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
+ sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
+- if (sctp_state(asoc, SHUTDOWN_PENDING) &&
++ if ((sctp_state(asoc, SHUTDOWN_PENDING) ||
++ sctp_state(asoc, SHUTDOWN_SENT)) &&
+ (sctp_sstate(asoc->base.sk, CLOSING) ||
+ sock_flag(asoc->base.sk, SOCK_DEAD))) {
+- /* if were currently in SHUTDOWN_PENDING, but the socket
+- * has been closed by user, don't transition to ESTABLISHED.
+- * Instead trigger SHUTDOWN bundled with COOKIE_ACK.
++ /* If the socket has been closed by user, don't
++ * transition to ESTABLISHED. Instead trigger SHUTDOWN
++ * bundled with COOKIE_ACK.
+ */
+ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
+ return sctp_sf_do_9_2_start_shutdown(net, ep, asoc,
+diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
+index 706fad12f22c..b87e63cb55be 100644
+--- a/net/xdp/xdp_umem.c
++++ b/net/xdp/xdp_umem.c
+@@ -258,8 +258,8 @@ static int xdp_umem_account_pages(struct xdp_umem *umem)
+ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
+ {
+ u32 chunk_size = mr->chunk_size, headroom = mr->headroom;
++ u64 npgs, addr = mr->addr, size = mr->len;
+ unsigned int chunks, chunks_per_page;
+- u64 addr = mr->addr, size = mr->len;
+ int err, i;
+
+ if (chunk_size < XDP_UMEM_MIN_CHUNK_SIZE || chunk_size > PAGE_SIZE) {
+@@ -285,6 +285,10 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
+ if ((addr + size) < addr)
+ return -EINVAL;
+
++ npgs = div_u64(size, PAGE_SIZE);
++ if (npgs > U32_MAX)
++ return -EINVAL;
++
+ chunks = (unsigned int)div_u64(size, chunk_size);
+ if (chunks == 0)
+ return -EINVAL;
+@@ -303,7 +307,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
+ umem->props.size = size;
+ umem->headroom = headroom;
+ umem->chunk_size_nohr = chunk_size - headroom;
+- umem->npgs = size / PAGE_SIZE;
++ umem->npgs = (u32)npgs;
+ umem->pgs = NULL;
+ umem->user = NULL;
+ INIT_LIST_HEAD(&umem->xsk_list);
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index 82b0a99ee1f4..0ee13d12782f 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -407,7 +407,7 @@ resume:
+ dev_put(skb->dev);
+
+ spin_lock(&x->lock);
+- if (nexthdr <= 0) {
++ if (nexthdr < 0) {
+ if (nexthdr == -EBADMSG) {
+ xfrm_audit_state_icvfail(x, skb,
+ x->type->proto);
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 317fe9c92932..6f00f88adab9 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -780,7 +780,28 @@ static void __net_exit xfrmi_exit_net(struct net *net)
+ rtnl_unlock();
+ }
+
++static void __net_exit xfrmi_exit_batch_net(struct list_head *net_exit_list)
++{
++ struct net *net;
++ LIST_HEAD(list);
++
++ rtnl_lock();
++ list_for_each_entry(net, net_exit_list, exit_list) {
++ struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
++ struct xfrm_if __rcu **xip;
++ struct xfrm_if *xi;
++
++ for (xip = &xfrmn->xfrmi[0];
++ (xi = rtnl_dereference(*xip)) != NULL;
++ xip = &xi->next)
++ unregister_netdevice_queue(xi->dev, &list);
++ }
++ unregister_netdevice_many(&list);
++ rtnl_unlock();
++}
++
+ static struct pernet_operations xfrmi_net_ops = {
++ .exit_batch = xfrmi_exit_batch_net,
+ .init = xfrmi_init_net,
+ .exit = xfrmi_exit_net,
+ .id = &xfrmi_net_id,
+diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
+index 6d20fbcde000..c46162887b94 100644
+--- a/net/xfrm/xfrm_output.c
++++ b/net/xfrm/xfrm_output.c
+@@ -235,18 +235,20 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
+ xfrm_state_hold(x);
+
+ if (skb_is_gso(skb)) {
+- skb_shinfo(skb)->gso_type |= SKB_GSO_ESP;
++ if (skb->inner_protocol)
++ return xfrm_output_gso(net, sk, skb);
+
+- return xfrm_output2(net, sk, skb);
++ skb_shinfo(skb)->gso_type |= SKB_GSO_ESP;
++ goto out;
+ }
+
+ if (x->xso.dev && x->xso.dev->features & NETIF_F_HW_ESP_TX_CSUM)
+ goto out;
++ } else {
++ if (skb_is_gso(skb))
++ return xfrm_output_gso(net, sk, skb);
+ }
+
+- if (skb_is_gso(skb))
+- return xfrm_output_gso(net, sk, skb);
+-
+ if (skb->ip_summed == CHECKSUM_PARTIAL) {
+ err = skb_checksum_help(skb);
+ if (err) {
+@@ -283,7 +285,8 @@ void xfrm_local_error(struct sk_buff *skb, int mtu)
+
+ if (skb->protocol == htons(ETH_P_IP))
+ proto = AF_INET;
+- else if (skb->protocol == htons(ETH_P_IPV6))
++ else if (skb->protocol == htons(ETH_P_IPV6) &&
++ skb->sk->sk_family == AF_INET6)
+ proto = AF_INET6;
+ else
+ return;
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index b30c074160e3..939f3adf075a 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -730,12 +730,7 @@ static void xfrm_policy_requeue(struct xfrm_policy *old,
+ static bool xfrm_policy_mark_match(struct xfrm_policy *policy,
+ struct xfrm_policy *pol)
+ {
+- u32 mark = policy->mark.v & policy->mark.m;
+-
+- if (policy->mark.v == pol->mark.v && policy->mark.m == pol->mark.m)
+- return true;
+-
+- if ((mark & pol->mark.m) == pol->mark.v &&
++ if (policy->mark.v == pol->mark.v &&
+ policy->priority == pol->priority)
+ return true;
+
+diff --git a/samples/bpf/lwt_len_hist_user.c b/samples/bpf/lwt_len_hist_user.c
+index 587b68b1f8dd..430a4b7e353e 100644
+--- a/samples/bpf/lwt_len_hist_user.c
++++ b/samples/bpf/lwt_len_hist_user.c
+@@ -15,8 +15,6 @@
+ #define MAX_INDEX 64
+ #define MAX_STARS 38
+
+-char bpf_log_buf[BPF_LOG_BUF_SIZE];
+-
+ static void stars(char *str, long val, long max, int width)
+ {
+ int i;
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 3023b4ad38a7..f86557a8e43f 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -819,6 +819,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
+ int ret;
+ kuid_t root_uid;
+
++ new->cap_ambient = old->cap_ambient;
+ if (WARN_ON(!cap_ambient_invariant_ok(old)))
+ return -EPERM;
+
+diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
+index 26e71cf05f1e..600ab2eb1b50 100644
+--- a/sound/core/hwdep.c
++++ b/sound/core/hwdep.c
+@@ -231,12 +231,12 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw,
+ if (info.index >= 32)
+ return -EINVAL;
+ /* check whether the dsp was already loaded */
+- if (hw->dsp_loaded & (1 << info.index))
++ if (hw->dsp_loaded & (1u << info.index))
+ return -EBUSY;
+ err = hw->ops.dsp_load(hw, &info);
+ if (err < 0)
+ return err;
+- hw->dsp_loaded |= (1 << info.index);
++ hw->dsp_loaded |= (1u << info.index);
+ return 0;
+ }
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 09a37d4c81ec..b06f7d52faad 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -387,6 +387,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0282:
+ case 0x10ec0283:
+ case 0x10ec0286:
++ case 0x10ec0287:
+ case 0x10ec0288:
+ case 0x10ec0285:
+ case 0x10ec0298:
+@@ -5152,18 +5153,9 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
+ { 0x19, 0x21a11010 }, /* dock mic */
+ { }
+ };
+- /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise
+- * the speaker output becomes too low by some reason on Thinkpads with
+- * ALC298 codec
+- */
+- static hda_nid_t preferred_pairs[] = {
+- 0x14, 0x03, 0x17, 0x02, 0x21, 0x02,
+- 0
+- };
+ struct alc_spec *spec = codec->spec;
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+- spec->gen.preferred_dacs = preferred_pairs;
+ spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+ snd_hda_apply_pincfgs(codec, pincfgs);
+ } else if (action == HDA_FIXUP_ACT_INIT) {
+@@ -5176,6 +5168,23 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
+ }
+ }
+
++static void alc_fixup_tpt470_dacs(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise
++ * the speaker output becomes too low by some reason on Thinkpads with
++ * ALC298 codec
++ */
++ static hda_nid_t preferred_pairs[] = {
++ 0x14, 0x03, 0x17, 0x02, 0x21, 0x02,
++ 0
++ };
++ struct alc_spec *spec = codec->spec;
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE)
++ spec->gen.preferred_dacs = preferred_pairs;
++}
++
+ static void alc_shutup_dell_xps13(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+@@ -5708,6 +5717,7 @@ enum {
+ ALC700_FIXUP_INTEL_REFERENCE,
+ ALC274_FIXUP_DELL_BIND_DACS,
+ ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
++ ALC298_FIXUP_TPT470_DOCK_FIX,
+ ALC298_FIXUP_TPT470_DOCK,
+ ALC255_FIXUP_DUMMY_LINEOUT_VERB,
+ ALC255_FIXUP_DELL_HEADSET_MIC,
+@@ -6605,12 +6615,18 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC274_FIXUP_DELL_BIND_DACS
+ },
+- [ALC298_FIXUP_TPT470_DOCK] = {
++ [ALC298_FIXUP_TPT470_DOCK_FIX] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_tpt470_dock,
+ .chained = true,
+ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE
+ },
++ [ALC298_FIXUP_TPT470_DOCK] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_tpt470_dacs,
++ .chained = true,
++ .chain_id = ALC298_FIXUP_TPT470_DOCK_FIX
++ },
+ [ALC255_FIXUP_DUMMY_LINEOUT_VERB] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -7173,6 +7189,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
+ {.id = ALC292_FIXUP_TPT440, .name = "tpt440"},
+ {.id = ALC292_FIXUP_TPT460, .name = "tpt460"},
++ {.id = ALC298_FIXUP_TPT470_DOCK_FIX, .name = "tpt470-dock-fix"},
+ {.id = ALC298_FIXUP_TPT470_DOCK, .name = "tpt470-dock"},
+ {.id = ALC233_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"},
+ {.id = ALC700_FIXUP_INTEL_REFERENCE, .name = "alc700-ref"},
+@@ -7824,6 +7841,7 @@ static int patch_alc269(struct hda_codec *codec)
+ case 0x10ec0215:
+ case 0x10ec0245:
+ case 0x10ec0285:
++ case 0x10ec0287:
+ case 0x10ec0289:
+ spec->codec_variant = ALC269_TYPE_ALC215;
+ spec->shutup = alc225_shutup;
+@@ -8962,6 +8980,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ HDA_CODEC_ENTRY(0x10ec0284, "ALC284", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0285, "ALC285", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0286, "ALC286", patch_alc269),
++ HDA_CODEC_ENTRY(0x10ec0287, "ALC287", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0288, "ALC288", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0289, "ALC289", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0290, "ALC290", patch_alc269),
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 7a5c665cf4e4..8a0211131fc6 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1186,6 +1186,14 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ cval->res = 384;
+ }
+ break;
++ case USB_ID(0x0495, 0x3042): /* ESS Technology Asus USB DAC */
++ if ((strstr(kctl->id.name, "Playback Volume") != NULL) ||
++ strstr(kctl->id.name, "Capture Volume") != NULL) {
++ cval->min >>= 8;
++ cval->max = 0;
++ cval->res = 1;
++ }
++ break;
+ }
+ }
+
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 1689e4f242df..10323e6f7f97 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -401,6 +401,21 @@ static const struct usbmix_connector_map trx40_mobo_connector_map[] = {
+ {}
+ };
+
++/* Rear panel + front mic on Gigabyte TRX40 Aorus Master with ALC1220-VB */
++static const struct usbmix_name_map aorus_master_alc1220vb_map[] = {
++ { 17, NULL }, /* OT, IEC958?, disabled */
++ { 19, NULL, 12 }, /* FU, Input Gain Pad - broken response, disabled */
++ { 16, "Line Out" }, /* OT */
++ { 22, "Line Out Playback" }, /* FU */
++ { 7, "Line" }, /* IT */
++ { 19, "Line Capture" }, /* FU */
++ { 8, "Mic" }, /* IT */
++ { 20, "Mic Capture" }, /* FU */
++ { 9, "Front Mic" }, /* IT */
++ { 21, "Front Mic Capture" }, /* FU */
++ {}
++};
++
+ /*
+ * Control map entries
+ */
+@@ -520,6 +535,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .id = USB_ID(0x05a7, 0x1020),
+ .map = bose_companion5_map,
+ },
++ { /* Gigabyte TRX40 Aorus Master (rear panel + front mic) */
++ .id = USB_ID(0x0414, 0xa001),
++ .map = aorus_master_alc1220vb_map,
++ },
+ { /* Gigabyte TRX40 Aorus Pro WiFi */
+ .id = USB_ID(0x0414, 0xa002),
+ .map = trx40_mobo_map,
+@@ -543,6 +562,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .map = trx40_mobo_map,
+ .connector_map = trx40_mobo_connector_map,
+ },
++ { /* Asrock TRX40 Creator */
++ .id = USB_ID(0x26ce, 0x0a01),
++ .map = trx40_mobo_map,
++ .connector_map = trx40_mobo_connector_map,
++ },
+ { 0 } /* terminator */
+ };
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 774aeedde071..b798eae0a785 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3412,6 +3412,32 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ ALC1220_VB_DESKTOP(0x0414, 0xa002), /* Gigabyte TRX40 Aorus Pro WiFi */
+ ALC1220_VB_DESKTOP(0x0db0, 0x0d64), /* MSI TRX40 Creator */
+ ALC1220_VB_DESKTOP(0x0db0, 0x543d), /* MSI TRX40 */
++ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */
+ #undef ALC1220_VB_DESKTOP
+
++/* Two entries for Gigabyte TRX40 Aorus Master:
++ * TRX40 Aorus Master has two USB-audio devices, one for the front headphone
++ * with ESS SABRE9218 DAC chip, while another for the rest I/O (the rear
++ * panel and the front mic) with Realtek ALC1220-VB.
++ * Here we provide two distinct names for making UCM profiles easier.
++ */
++{
++ USB_DEVICE(0x0414, 0xa000),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .vendor_name = "Gigabyte",
++ .product_name = "Aorus Master Front Headphone",
++ .profile_name = "Gigabyte-Aorus-Master-Front-Headphone",
++ .ifnum = QUIRK_NO_INTERFACE
++ }
++},
++{
++ USB_DEVICE(0x0414, 0xa001),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .vendor_name = "Gigabyte",
++ .product_name = "Aorus Master Main Audio",
++ .profile_name = "Gigabyte-Aorus-Master-Main-Audio",
++ .ifnum = QUIRK_NO_INTERFACE
++ }
++},
++
+ #undef USB_DEVICE_VENDOR_SPEC
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-06-07 21:52 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-06-07 21:52 UTC (permalink / raw
To: gentoo-commits
commit: 87ab5b81783b4aefcc76370436fd8dbf7f3794c2
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jun 7 21:52:00 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jun 7 21:52:31 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=87ab5b81
Linux patch 4.19.127
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1126_linux-4.19.127.patch | 880 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 884 insertions(+)
diff --git a/0000_README b/0000_README
index 4d5b261..730cc1c 100644
--- a/0000_README
+++ b/0000_README
@@ -543,6 +543,10 @@ Patch: 1125_linux-4.19.126.patch
From: https://www.kernel.org
Desc: Linux 4.19.126
+Patch: 1126_linux-4.19.127.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.127
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1126_linux-4.19.127.patch b/1126_linux-4.19.127.patch
new file mode 100644
index 0000000..24f200b
--- /dev/null
+++ b/1126_linux-4.19.127.patch
@@ -0,0 +1,880 @@
+diff --git a/Makefile b/Makefile
+index f8da10c40271..a93e38cdd61b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 126
++SUBLEVEL = 127
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
+index 89c97dcfa360..c10994daee39 100644
+--- a/arch/arc/kernel/setup.c
++++ b/arch/arc/kernel/setup.c
+@@ -15,6 +15,7 @@
+ #include <linux/clocksource.h>
+ #include <linux/console.h>
+ #include <linux/module.h>
++#include <linux/sizes.h>
+ #include <linux/cpu.h>
+ #include <linux/of_fdt.h>
+ #include <linux/of.h>
+@@ -406,12 +407,12 @@ static void arc_chk_core_config(void)
+ if ((unsigned int)__arc_dccm_base != cpu->dccm.base_addr)
+ panic("Linux built with incorrect DCCM Base address\n");
+
+- if (CONFIG_ARC_DCCM_SZ != cpu->dccm.sz)
++ if (CONFIG_ARC_DCCM_SZ * SZ_1K != cpu->dccm.sz)
+ panic("Linux built with incorrect DCCM Size\n");
+ #endif
+
+ #ifdef CONFIG_ARC_HAS_ICCM
+- if (CONFIG_ARC_ICCM_SZ != cpu->iccm.sz)
++ if (CONFIG_ARC_ICCM_SZ * SZ_1K != cpu->iccm.sz)
+ panic("Linux built with incorrect ICCM Size\n");
+ #endif
+
+diff --git a/arch/arc/plat-eznps/Kconfig b/arch/arc/plat-eznps/Kconfig
+index ce908e2c5282..71378bfec8d0 100644
+--- a/arch/arc/plat-eznps/Kconfig
++++ b/arch/arc/plat-eznps/Kconfig
+@@ -6,6 +6,7 @@
+
+ menuconfig ARC_PLAT_EZNPS
+ bool "\"EZchip\" ARC dev platform"
++ depends on ISA_ARCOMPACT
+ select CPU_BIG_ENDIAN
+ select CLKSRC_NPS if !PHYS_ADDR_T_64BIT
+ select EZNPS_GIC
+diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c
+index 649fb268f446..5399682797d0 100644
+--- a/arch/powerpc/platforms/powernv/opal-imc.c
++++ b/arch/powerpc/platforms/powernv/opal-imc.c
+@@ -63,10 +63,6 @@ static void export_imc_mode_and_cmd(struct device_node *node,
+
+ imc_debugfs_parent = debugfs_create_dir("imc", powerpc_debugfs_root);
+
+- /*
+- * Return here, either because 'imc' directory already exists,
+- * Or failed to create a new one.
+- */
+ if (!imc_debugfs_parent)
+ return;
+
+@@ -139,7 +135,6 @@ static int imc_get_mem_addr_nest(struct device_node *node,
+ }
+
+ pmu_ptr->imc_counter_mmaped = true;
+- export_imc_mode_and_cmd(node, pmu_ptr);
+ kfree(base_addr_arr);
+ kfree(chipid_arr);
+ return 0;
+@@ -155,7 +150,7 @@ error:
+ * and domain as the inputs.
+ * Allocates memory for the struct imc_pmu, sets up its domain, size and offsets
+ */
+-static int imc_pmu_create(struct device_node *parent, int pmu_index, int domain)
++static struct imc_pmu *imc_pmu_create(struct device_node *parent, int pmu_index, int domain)
+ {
+ int ret = 0;
+ struct imc_pmu *pmu_ptr;
+@@ -163,27 +158,23 @@ static int imc_pmu_create(struct device_node *parent, int pmu_index, int domain)
+
+ /* Return for unknown domain */
+ if (domain < 0)
+- return -EINVAL;
++ return NULL;
+
+ /* memory for pmu */
+ pmu_ptr = kzalloc(sizeof(*pmu_ptr), GFP_KERNEL);
+ if (!pmu_ptr)
+- return -ENOMEM;
++ return NULL;
+
+ /* Set the domain */
+ pmu_ptr->domain = domain;
+
+ ret = of_property_read_u32(parent, "size", &pmu_ptr->counter_mem_size);
+- if (ret) {
+- ret = -EINVAL;
++ if (ret)
+ goto free_pmu;
+- }
+
+ if (!of_property_read_u32(parent, "offset", &offset)) {
+- if (imc_get_mem_addr_nest(parent, pmu_ptr, offset)) {
+- ret = -EINVAL;
++ if (imc_get_mem_addr_nest(parent, pmu_ptr, offset))
+ goto free_pmu;
+- }
+ }
+
+ /* Function to register IMC pmu */
+@@ -194,14 +185,14 @@ static int imc_pmu_create(struct device_node *parent, int pmu_index, int domain)
+ if (pmu_ptr->domain == IMC_DOMAIN_NEST)
+ kfree(pmu_ptr->mem_info);
+ kfree(pmu_ptr);
+- return ret;
++ return NULL;
+ }
+
+- return 0;
++ return pmu_ptr;
+
+ free_pmu:
+ kfree(pmu_ptr);
+- return ret;
++ return NULL;
+ }
+
+ static void disable_nest_pmu_counters(void)
+@@ -258,6 +249,7 @@ int get_max_nest_dev(void)
+ static int opal_imc_counters_probe(struct platform_device *pdev)
+ {
+ struct device_node *imc_dev = pdev->dev.of_node;
++ struct imc_pmu *pmu;
+ int pmu_count = 0, domain;
+ bool core_imc_reg = false, thread_imc_reg = false;
+ u32 type;
+@@ -273,6 +265,7 @@ static int opal_imc_counters_probe(struct platform_device *pdev)
+ }
+
+ for_each_compatible_node(imc_dev, NULL, IMC_DTB_UNIT_COMPAT) {
++ pmu = NULL;
+ if (of_property_read_u32(imc_dev, "type", &type)) {
+ pr_warn("IMC Device without type property\n");
+ continue;
+@@ -294,9 +287,13 @@ static int opal_imc_counters_probe(struct platform_device *pdev)
+ break;
+ }
+
+- if (!imc_pmu_create(imc_dev, pmu_count, domain)) {
+- if (domain == IMC_DOMAIN_NEST)
++ pmu = imc_pmu_create(imc_dev, pmu_count, domain);
++ if (pmu != NULL) {
++ if (domain == IMC_DOMAIN_NEST) {
++ if (!imc_debugfs_parent)
++ export_imc_mode_and_cmd(imc_dev, pmu);
+ pmu_count++;
++ }
+ if (domain == IMC_DOMAIN_CORE)
+ core_imc_reg = true;
+ if (domain == IMC_DOMAIN_THREAD)
+@@ -304,10 +301,6 @@ static int opal_imc_counters_probe(struct platform_device *pdev)
+ }
+ }
+
+- /* If none of the nest units are registered, remove debugfs interface */
+- if (pmu_count == 0)
+- debugfs_remove_recursive(imc_debugfs_parent);
+-
+ /* If core imc is not registered, unregister thread-imc */
+ if (!core_imc_reg && thread_imc_reg)
+ unregister_thread_imc();
+diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
+index 83afd5b78e16..020f9aac7dc0 100644
+--- a/arch/s390/kernel/mcount.S
++++ b/arch/s390/kernel/mcount.S
+@@ -40,6 +40,7 @@ EXPORT_SYMBOL(_mcount)
+ ENTRY(ftrace_caller)
+ .globl ftrace_regs_caller
+ .set ftrace_regs_caller,ftrace_caller
++ stg %r14,(__SF_GPRS+8*8)(%r15) # save traced function caller
+ lgr %r1,%r15
+ #if !(defined(CC_USING_HOTPATCH) || defined(CC_USING_NOP_MCOUNT))
+ aghi %r0,MCOUNT_RETURN_FIXUP
+diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
+index 5674710a4841..7dfae86afa47 100644
+--- a/arch/s390/mm/hugetlbpage.c
++++ b/arch/s390/mm/hugetlbpage.c
+@@ -159,10 +159,13 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
+ rste &= ~_SEGMENT_ENTRY_NOEXEC;
+
+ /* Set correct table type for 2G hugepages */
+- if ((pte_val(*ptep) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R3)
+- rste |= _REGION_ENTRY_TYPE_R3 | _REGION3_ENTRY_LARGE;
+- else
++ if ((pte_val(*ptep) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R3) {
++ if (likely(pte_present(pte)))
++ rste |= _REGION3_ENTRY_LARGE;
++ rste |= _REGION_ENTRY_TYPE_R3;
++ } else if (likely(pte_present(pte)))
+ rste |= _SEGMENT_ENTRY_LARGE;
++
+ clear_huge_pte_skeys(mm, rste);
+ pte_val(*ptep) = rste;
+ }
+diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
+index 2e1ed12c65f8..2a9c12ffb5cb 100644
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -237,6 +237,7 @@ static inline int pmd_large(pmd_t pte)
+ }
+
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
++/* NOTE: when predicate huge page, consider also pmd_devmap, or use pmd_large */
+ static inline int pmd_trans_huge(pmd_t pmd)
+ {
+ return (pmd_val(pmd) & (_PAGE_PSE|_PAGE_DEVMAP)) == _PAGE_PSE;
+diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
+index 2c1ecf4763c4..e32b003e064a 100644
+--- a/arch/x86/mm/mmio-mod.c
++++ b/arch/x86/mm/mmio-mod.c
+@@ -384,7 +384,7 @@ static void enter_uniprocessor(void)
+ int cpu;
+ int err;
+
+- if (downed_cpus == NULL &&
++ if (!cpumask_available(downed_cpus) &&
+ !alloc_cpumask_var(&downed_cpus, GFP_KERNEL)) {
+ pr_notice("Failed to allocate mask\n");
+ goto out;
+@@ -414,7 +414,7 @@ static void leave_uniprocessor(void)
+ int cpu;
+ int err;
+
+- if (downed_cpus == NULL || cpumask_weight(downed_cpus) == 0)
++ if (!cpumask_available(downed_cpus) || cpumask_weight(downed_cpus) == 0)
+ return;
+ pr_notice("Re-enabling CPUs...\n");
+ for_each_cpu(cpu, downed_cpus) {
+diff --git a/drivers/block/null_blk_zoned.c b/drivers/block/null_blk_zoned.c
+index 7c6b86d98700..d1725ac636c0 100644
+--- a/drivers/block/null_blk_zoned.c
++++ b/drivers/block/null_blk_zoned.c
+@@ -20,6 +20,10 @@ int null_zone_init(struct nullb_device *dev)
+ pr_err("null_blk: zone_size must be power-of-two\n");
+ return -EINVAL;
+ }
++ if (dev->zone_size > dev->size) {
++ pr_err("Zone size larger than device capacity\n");
++ return -EINVAL;
++ }
+
+ dev->zone_size_sects = dev->zone_size << ZONE_SIZE_SHIFT;
+ dev->nr_zones = dev_size >>
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index d5dcee7f1fc8..108f542176b8 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -198,10 +198,11 @@ static const struct edid_quirk {
+ { "HVR", 0xaa01, EDID_QUIRK_NON_DESKTOP },
+ { "HVR", 0xaa02, EDID_QUIRK_NON_DESKTOP },
+
+- /* Oculus Rift DK1, DK2, and CV1 VR Headsets */
++ /* Oculus Rift DK1, DK2, CV1 and Rift S VR Headsets */
+ { "OVR", 0x0001, EDID_QUIRK_NON_DESKTOP },
+ { "OVR", 0x0003, EDID_QUIRK_NON_DESKTOP },
+ { "OVR", 0x0004, EDID_QUIRK_NON_DESKTOP },
++ { "OVR", 0x0012, EDID_QUIRK_NON_DESKTOP },
+
+ /* Windows Mixed Reality Headsets */
+ { "ACR", 0x7fce, EDID_QUIRK_NON_DESKTOP },
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 20cd4c8acecc..77a2f7fc2b37 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -6288,11 +6288,8 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
+ intel_connector->get_hw_state = intel_connector_get_hw_state;
+
+ /* init MST on ports that can support it */
+- if (HAS_DP_MST(dev_priv) && !intel_dp_is_edp(intel_dp) &&
+- (port == PORT_B || port == PORT_C ||
+- port == PORT_D || port == PORT_F))
+- intel_dp_mst_encoder_init(intel_dig_port,
+- intel_connector->base.base.id);
++ intel_dp_mst_encoder_init(intel_dig_port,
++ intel_connector->base.base.id);
+
+ if (!intel_edp_init_connector(intel_dp, intel_connector)) {
+ intel_dp_aux_fini(intel_dp);
+diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
+index 58ba14966d4f..c7d52c66ff29 100644
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -588,21 +588,31 @@ intel_dp_create_fake_mst_encoders(struct intel_digital_port *intel_dig_port)
+ int
+ intel_dp_mst_encoder_init(struct intel_digital_port *intel_dig_port, int conn_base_id)
+ {
++ struct drm_i915_private *i915 = to_i915(intel_dig_port->base.base.dev);
+ struct intel_dp *intel_dp = &intel_dig_port->dp;
+- struct drm_device *dev = intel_dig_port->base.base.dev;
++ enum port port = intel_dig_port->base.port;
+ int ret;
+
+- intel_dp->can_mst = true;
++ if (!HAS_DP_MST(i915) || intel_dp_is_edp(intel_dp))
++ return 0;
++
++ if (INTEL_GEN(i915) < 12 && port == PORT_A)
++ return 0;
++
++ if (INTEL_GEN(i915) < 11 && port == PORT_E)
++ return 0;
++
+ intel_dp->mst_mgr.cbs = &mst_cbs;
+
+ /* create encoders */
+ intel_dp_create_fake_mst_encoders(intel_dig_port);
+- ret = drm_dp_mst_topology_mgr_init(&intel_dp->mst_mgr, dev,
++ ret = drm_dp_mst_topology_mgr_init(&intel_dp->mst_mgr, &i915->drm,
+ &intel_dp->aux, 16, 3, conn_base_id);
+- if (ret) {
+- intel_dp->can_mst = false;
++ if (ret)
+ return ret;
+- }
++
++ intel_dp->can_mst = true;
++
+ return 0;
+ }
+
+diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
+index d05c387a588e..3c6eda0c5596 100644
+--- a/drivers/hid/hid-sony.c
++++ b/drivers/hid/hid-sony.c
+@@ -869,6 +869,23 @@ static u8 *sony_report_fixup(struct hid_device *hdev, u8 *rdesc,
+ if (sc->quirks & PS3REMOTE)
+ return ps3remote_fixup(hdev, rdesc, rsize);
+
++ /*
++ * Some knock-off USB dongles incorrectly report their button count
++ * as 13 instead of 16 causing three non-functional buttons.
++ */
++ if ((sc->quirks & SIXAXIS_CONTROLLER_USB) && *rsize >= 45 &&
++ /* Report Count (13) */
++ rdesc[23] == 0x95 && rdesc[24] == 0x0D &&
++ /* Usage Maximum (13) */
++ rdesc[37] == 0x29 && rdesc[38] == 0x0D &&
++ /* Report Count (3) */
++ rdesc[43] == 0x95 && rdesc[44] == 0x03) {
++ hid_info(hdev, "Fixing up USB dongle report descriptor\n");
++ rdesc[24] = 0x10;
++ rdesc[38] = 0x10;
++ rdesc[44] = 0x00;
++ }
++
+ return rdesc;
+ }
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index 95052373a828..681ac9bc68b3 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -381,6 +381,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ .ident = "Schneider SCL142ALM",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SCHNEIDER"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SCL142ALM"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ { } /* Terminate list */
+ };
+
+diff --git a/drivers/i2c/busses/i2c-altera.c b/drivers/i2c/busses/i2c-altera.c
+index 8915ee30a5b4..1d59eede537b 100644
+--- a/drivers/i2c/busses/i2c-altera.c
++++ b/drivers/i2c/busses/i2c-altera.c
+@@ -81,6 +81,7 @@
+ * @isr_mask: cached copy of local ISR enables.
+ * @isr_status: cached copy of local ISR status.
+ * @lock: spinlock for IRQ synchronization.
++ * @isr_mutex: mutex for IRQ thread.
+ */
+ struct altr_i2c_dev {
+ void __iomem *base;
+@@ -97,6 +98,7 @@ struct altr_i2c_dev {
+ u32 isr_mask;
+ u32 isr_status;
+ spinlock_t lock; /* IRQ synchronization */
++ struct mutex isr_mutex;
+ };
+
+ static void
+@@ -256,10 +258,11 @@ static irqreturn_t altr_i2c_isr(int irq, void *_dev)
+ struct altr_i2c_dev *idev = _dev;
+ u32 status = idev->isr_status;
+
++ mutex_lock(&idev->isr_mutex);
+ if (!idev->msg) {
+ dev_warn(idev->dev, "unexpected interrupt\n");
+ altr_i2c_int_clear(idev, ALTR_I2C_ALL_IRQ);
+- return IRQ_HANDLED;
++ goto out;
+ }
+ read = (idev->msg->flags & I2C_M_RD) != 0;
+
+@@ -312,6 +315,8 @@ static irqreturn_t altr_i2c_isr(int irq, void *_dev)
+ complete(&idev->msg_complete);
+ dev_dbg(idev->dev, "Message Complete\n");
+ }
++out:
++ mutex_unlock(&idev->isr_mutex);
+
+ return IRQ_HANDLED;
+ }
+@@ -323,6 +328,7 @@ static int altr_i2c_xfer_msg(struct altr_i2c_dev *idev, struct i2c_msg *msg)
+ u32 value;
+ u8 addr = i2c_8bit_addr_from_msg(msg);
+
++ mutex_lock(&idev->isr_mutex);
+ idev->msg = msg;
+ idev->msg_len = msg->len;
+ idev->buf = msg->buf;
+@@ -347,6 +353,7 @@ static int altr_i2c_xfer_msg(struct altr_i2c_dev *idev, struct i2c_msg *msg)
+ altr_i2c_int_enable(idev, imask, true);
+ altr_i2c_fill_tx_fifo(idev);
+ }
++ mutex_unlock(&idev->isr_mutex);
+
+ time_left = wait_for_completion_timeout(&idev->msg_complete,
+ ALTR_I2C_XFER_TIMEOUT);
+@@ -420,6 +427,7 @@ static int altr_i2c_probe(struct platform_device *pdev)
+ idev->dev = &pdev->dev;
+ init_completion(&idev->msg_complete);
+ spin_lock_init(&idev->lock);
++ mutex_init(&idev->isr_mutex);
+
+ ret = device_property_read_u32(idev->dev, "fifo-size",
+ &idev->fifo_size);
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 8b39a211ecb6..616afd81536a 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -860,10 +860,15 @@ mt7530_port_set_vlan_aware(struct dsa_switch *ds, int port)
+ PCR_MATRIX_MASK, PCR_MATRIX(MT7530_ALL_MEMBERS));
+
+ /* Trapped into security mode allows packet forwarding through VLAN
+- * table lookup.
++ * table lookup. CPU port is set to fallback mode to let untagged
++ * frames pass through.
+ */
+- mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK,
+- MT7530_PORT_SECURITY_MODE);
++ if (dsa_is_cpu_port(ds, port))
++ mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK,
++ MT7530_PORT_FALLBACK_MODE);
++ else
++ mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK,
++ MT7530_PORT_SECURITY_MODE);
+
+ /* Set the port as a user port which is to be able to recognize VID
+ * from incoming packets before fetching entry within the VLAN table.
+diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h
+index 403adbe5a4b4..101d309ee445 100644
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -148,6 +148,12 @@ enum mt7530_port_mode {
+ /* Port Matrix Mode: Frames are forwarded by the PCR_MATRIX members. */
+ MT7530_PORT_MATRIX_MODE = PORT_VLAN(0),
+
++ /* Fallback Mode: Forward received frames with ingress ports that do
++ * not belong to the VLAN member. Frames whose VID is not listed on
++ * the VLAN table are forwarded by the PCR_MATRIX members.
++ */
++ MT7530_PORT_FALLBACK_MODE = PORT_VLAN(1),
++
+ /* Security Mode: Discard any frame due to ingress membership
+ * violation or VID missed on the VLAN table.
+ */
+diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c
+index 6a8e2567f2bd..ab6ce85540b8 100644
+--- a/drivers/net/ethernet/apple/bmac.c
++++ b/drivers/net/ethernet/apple/bmac.c
+@@ -1181,7 +1181,7 @@ bmac_get_station_address(struct net_device *dev, unsigned char *ea)
+ int i;
+ unsigned short data;
+
+- for (i = 0; i < 6; i++)
++ for (i = 0; i < 3; i++)
+ {
+ reset_and_select_srom(dev);
+ data = read_srom(dev, i + EnetAddressOffset/2, SROMAddressBits);
+diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
+index a5bf02ae4bc5..5de6f7c73c1f 100644
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -45,6 +45,7 @@
+ #include <soc/fsl/qe/ucc.h>
+ #include <soc/fsl/qe/ucc_fast.h>
+ #include <asm/machdep.h>
++#include <net/sch_generic.h>
+
+ #include "ucc_geth.h"
+
+@@ -1551,11 +1552,8 @@ static int ugeth_disable(struct ucc_geth_private *ugeth, enum comm_dir mode)
+
+ static void ugeth_quiesce(struct ucc_geth_private *ugeth)
+ {
+- /* Prevent any further xmits, plus detach the device. */
+- netif_device_detach(ugeth->ndev);
+-
+- /* Wait for any current xmits to finish. */
+- netif_tx_disable(ugeth->ndev);
++ /* Prevent any further xmits */
++ netif_tx_stop_all_queues(ugeth->ndev);
+
+ /* Disable the interrupt to avoid NAPI rescheduling. */
+ disable_irq(ugeth->ug_info->uf_info.irq);
+@@ -1568,7 +1566,10 @@ static void ugeth_activate(struct ucc_geth_private *ugeth)
+ {
+ napi_enable(&ugeth->napi);
+ enable_irq(ugeth->ug_info->uf_info.irq);
+- netif_device_attach(ugeth->ndev);
++
++ /* allow to xmit again */
++ netif_tx_wake_all_queues(ugeth->ndev);
++ __netdev_watchdog_up(ugeth->ndev);
+ }
+
+ /* Called every time the controller might need to be made
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index ce4bfecc26c7..ae80a223975d 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -2515,20 +2515,20 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
+
+ retval = smsc911x_init(dev);
+ if (retval < 0)
+- goto out_disable_resources;
++ goto out_init_fail;
+
+ netif_carrier_off(dev);
+
+ retval = smsc911x_mii_init(pdev, dev);
+ if (retval) {
+ SMSC_WARN(pdata, probe, "Error %i initialising mii", retval);
+- goto out_disable_resources;
++ goto out_init_fail;
+ }
+
+ retval = register_netdev(dev);
+ if (retval) {
+ SMSC_WARN(pdata, probe, "Error %i registering device", retval);
+- goto out_disable_resources;
++ goto out_init_fail;
+ } else {
+ SMSC_TRACE(pdata, probe,
+ "Network interface: \"%s\"", dev->name);
+@@ -2569,9 +2569,10 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
+
+ return 0;
+
+-out_disable_resources:
++out_init_fail:
+ pm_runtime_put(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++out_disable_resources:
+ (void)smsc911x_disable_resources(pdev);
+ out_enable_resources_fail:
+ smsc911x_free_resources(pdev);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+index 0d21082ceb93..4d75158c64b2 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -318,6 +318,19 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
+ /* Enable PTP clock */
+ regmap_read(gmac->nss_common, NSS_COMMON_CLK_GATE, &val);
+ val |= NSS_COMMON_CLK_GATE_PTP_EN(gmac->id);
++ switch (gmac->phy_mode) {
++ case PHY_INTERFACE_MODE_RGMII:
++ val |= NSS_COMMON_CLK_GATE_RGMII_RX_EN(gmac->id) |
++ NSS_COMMON_CLK_GATE_RGMII_TX_EN(gmac->id);
++ break;
++ case PHY_INTERFACE_MODE_SGMII:
++ val |= NSS_COMMON_CLK_GATE_GMII_RX_EN(gmac->id) |
++ NSS_COMMON_CLK_GATE_GMII_TX_EN(gmac->id);
++ break;
++ default:
++ /* We don't get here; the switch above will have errored out */
++ unreachable();
++ }
+ regmap_write(gmac->nss_common, NSS_COMMON_CLK_GATE, val);
+
+ if (gmac->phy_mode == PHY_INTERFACE_MODE_SGMII) {
+diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
+index c3fe9bfff812..5a6ee0b014da 100644
+--- a/drivers/net/wireless/cisco/airo.c
++++ b/drivers/net/wireless/cisco/airo.c
+@@ -1928,6 +1928,10 @@ static netdev_tx_t mpi_start_xmit(struct sk_buff *skb,
+ airo_print_err(dev->name, "%s: skb == NULL!",__func__);
+ return NETDEV_TX_OK;
+ }
++ if (skb_padto(skb, ETH_ZLEN)) {
++ dev->stats.tx_dropped++;
++ return NETDEV_TX_OK;
++ }
+ npacks = skb_queue_len (&ai->txq);
+
+ if (npacks >= MAXTXQ - 1) {
+@@ -2130,6 +2134,10 @@ static netdev_tx_t airo_start_xmit(struct sk_buff *skb,
+ airo_print_err(dev->name, "%s: skb == NULL!", __func__);
+ return NETDEV_TX_OK;
+ }
++ if (skb_padto(skb, ETH_ZLEN)) {
++ dev->stats.tx_dropped++;
++ return NETDEV_TX_OK;
++ }
+
+ /* Find a vacant FID */
+ for( i = 0; i < MAX_FIDS / 2 && (fids[i] & 0xffff0000); i++ );
+@@ -2204,6 +2212,10 @@ static netdev_tx_t airo_start_xmit11(struct sk_buff *skb,
+ airo_print_err(dev->name, "%s: skb == NULL!", __func__);
+ return NETDEV_TX_OK;
+ }
++ if (skb_padto(skb, ETH_ZLEN)) {
++ dev->stats.tx_dropped++;
++ return NETDEV_TX_OK;
++ }
+
+ /* Find a vacant FID */
+ for( i = MAX_FIDS / 2; i < MAX_FIDS && (fids[i] & 0xffff0000); i++ );
+diff --git a/drivers/net/wireless/intersil/p54/p54usb.c b/drivers/net/wireless/intersil/p54/p54usb.c
+index 15661da6eedc..39cfabf968d4 100644
+--- a/drivers/net/wireless/intersil/p54/p54usb.c
++++ b/drivers/net/wireless/intersil/p54/p54usb.c
+@@ -64,6 +64,7 @@ static const struct usb_device_id p54u_table[] = {
+ {USB_DEVICE(0x0db0, 0x6826)}, /* MSI UB54G (MS-6826) */
+ {USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
+ {USB_DEVICE(0x124a, 0x4023)}, /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
++ {USB_DEVICE(0x124a, 0x4026)}, /* AirVasT USB wireless device */
+ {USB_DEVICE(0x1435, 0x0210)}, /* Inventel UR054G */
+ {USB_DEVICE(0x15a9, 0x0002)}, /* Gemtek WUBI-100GW 802.11g */
+ {USB_DEVICE(0x1630, 0x0005)}, /* 2Wire 802.11g USB (v1) / Z-Com */
+diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
+index 1064a703ccec..853edc649ed4 100644
+--- a/drivers/nvdimm/btt.c
++++ b/drivers/nvdimm/btt.c
+@@ -400,9 +400,9 @@ static int btt_flog_write(struct arena_info *arena, u32 lane, u32 sub,
+ arena->freelist[lane].sub = 1 - arena->freelist[lane].sub;
+ if (++(arena->freelist[lane].seq) == 4)
+ arena->freelist[lane].seq = 1;
+- if (ent_e_flag(ent->old_map))
++ if (ent_e_flag(le32_to_cpu(ent->old_map)))
+ arena->freelist[lane].has_err = 1;
+- arena->freelist[lane].block = le32_to_cpu(ent_lba(ent->old_map));
++ arena->freelist[lane].block = ent_lba(le32_to_cpu(ent->old_map));
+
+ return ret;
+ }
+@@ -568,8 +568,8 @@ static int btt_freelist_init(struct arena_info *arena)
+ * FIXME: if error clearing fails during init, we want to make
+ * the BTT read-only
+ */
+- if (ent_e_flag(log_new.old_map) &&
+- !ent_normal(log_new.old_map)) {
++ if (ent_e_flag(le32_to_cpu(log_new.old_map)) &&
++ !ent_normal(le32_to_cpu(log_new.old_map))) {
+ arena->freelist[i].has_err = 1;
+ ret = arena_clear_freelist_error(arena, i);
+ if (ret)
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index 5dc3b407d7bd..63640c315d93 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -1996,7 +1996,7 @@ static struct device *create_namespace_pmem(struct nd_region *nd_region,
+ nd_mapping = &nd_region->mapping[i];
+ label_ent = list_first_entry_or_null(&nd_mapping->labels,
+ typeof(*label_ent), list);
+- label0 = label_ent ? label_ent->label : 0;
++ label0 = label_ent ? label_ent->label : NULL;
+
+ if (!label0) {
+ WARN_ON(1);
+@@ -2332,8 +2332,9 @@ static struct device **scan_labels(struct nd_region *nd_region)
+ continue;
+
+ /* skip labels that describe extents outside of the region */
+- if (nd_label->dpa < nd_mapping->start || nd_label->dpa > map_end)
+- continue;
++ if (__le64_to_cpu(nd_label->dpa) < nd_mapping->start ||
++ __le64_to_cpu(nd_label->dpa) > map_end)
++ continue;
+
+ i = add_namespace_resource(nd_region, nd_label, devs, count);
+ if (i < 0)
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
+index 33191673249c..de4f41bce8e9 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -789,12 +789,13 @@ static void hisi_sas_port_notify_formed(struct asd_sas_phy *sas_phy)
+ struct hisi_hba *hisi_hba = sas_ha->lldd_ha;
+ struct hisi_sas_phy *phy = sas_phy->lldd_phy;
+ struct asd_sas_port *sas_port = sas_phy->port;
+- struct hisi_sas_port *port = to_hisi_sas_port(sas_port);
++ struct hisi_sas_port *port;
+ unsigned long flags;
+
+ if (!sas_port)
+ return;
+
++ port = to_hisi_sas_port(sas_port);
+ spin_lock_irqsave(&hisi_hba->lock, flags);
+ port->port_attached = 1;
+ port->id = phy->port_id;
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index d91209ba18c8..803d67b3a166 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -2505,6 +2505,7 @@ static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
+
+ err = ufshcd_map_sg(hba, lrbp);
+ if (err) {
++ ufshcd_release(hba);
+ lrbp->cmd = NULL;
+ clear_bit_unlock(tag, &hba->lrb_in_use);
+ goto out;
+diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
+index 5a47e28e38c1..6f0f6b99953d 100644
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -304,6 +304,9 @@ static int dw_spi_transfer_one(struct spi_controller *master,
+ dws->len = transfer->len;
+ spin_unlock_irqrestore(&dws->buf_lock, flags);
+
++ /* Ensure dw->rx and dw->rx_end are visible */
++ smp_mb();
++
+ spi_enable_chip(dws, 0);
+
+ /* Handle per transfer options for bpw and speed */
+diff --git a/include/uapi/linux/mmc/ioctl.h b/include/uapi/linux/mmc/ioctl.h
+index 45f369dc0a42..83a8c10fd104 100644
+--- a/include/uapi/linux/mmc/ioctl.h
++++ b/include/uapi/linux/mmc/ioctl.h
+@@ -3,6 +3,7 @@
+ #define LINUX_MMC_IOCTL_H
+
+ #include <linux/types.h>
++#include <linux/major.h>
+
+ struct mmc_ioc_cmd {
+ /* Implies direction of data. true = write, false = read */
+diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c
+index bb95a35e8c2d..d0ed410b4127 100644
+--- a/kernel/cgroup/rstat.c
++++ b/kernel/cgroup/rstat.c
+@@ -32,12 +32,9 @@ void cgroup_rstat_updated(struct cgroup *cgrp, int cpu)
+ return;
+
+ /*
+- * Paired with the one in cgroup_rstat_cpu_pop_upated(). Either we
+- * see NULL updated_next or they see our updated stat.
+- */
+- smp_mb();
+-
+- /*
++ * Speculative already-on-list test. This may race leading to
++ * temporary inaccuracies, which is fine.
++ *
+ * Because @parent's updated_children is terminated with @parent
+ * instead of NULL, we can tell whether @cgrp is on the list by
+ * testing the next pointer for NULL.
+@@ -133,13 +130,6 @@ static struct cgroup *cgroup_rstat_cpu_pop_updated(struct cgroup *pos,
+ *nextp = rstatc->updated_next;
+ rstatc->updated_next = NULL;
+
+- /*
+- * Paired with the one in cgroup_rstat_cpu_updated().
+- * Either they see NULL updated_next or we see their
+- * updated stat.
+- */
+- smp_mb();
+-
+ return pos;
+ }
+
+diff --git a/kernel/relay.c b/kernel/relay.c
+index 9e0f52375487..13c19f39e31e 100644
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -581,6 +581,11 @@ struct rchan *relay_open(const char *base_filename,
+ return NULL;
+
+ chan->buf = alloc_percpu(struct rchan_buf *);
++ if (!chan->buf) {
++ kfree(chan);
++ return NULL;
++ }
++
+ chan->version = RELAYFS_CHANNEL_VERSION;
+ chan->n_subbufs = n_subbufs;
+ chan->subbuf_size = subbuf_size;
+diff --git a/mm/mremap.c b/mm/mremap.c
+index a9617e72e6b7..33d8bbe24ddd 100644
+--- a/mm/mremap.c
++++ b/mm/mremap.c
+@@ -221,7 +221,7 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
+ new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr);
+ if (!new_pmd)
+ break;
+- if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd)) {
++ if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd) || pmd_devmap(*old_pmd)) {
+ if (extent == HPAGE_PMD_SIZE) {
+ bool moved;
+ /* See comment in move_ptes() */
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index f0878d81dcef..d20f5792761c 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -215,7 +215,7 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry,
+ data->hdr.length = crypto_shash_digestsize(desc->tfm);
+
+ error = -ENODATA;
+- list_for_each_entry_rcu(xattr, &evm_config_xattrnames, list) {
++ list_for_each_entry_lockless(xattr, &evm_config_xattrnames, list) {
+ bool is_ima = false;
+
+ if (strcmp(xattr->name, XATTR_NAME_IMA) == 0)
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index 7f3f54d89a6e..e11d860fdce4 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -102,7 +102,7 @@ static int evm_find_protected_xattrs(struct dentry *dentry)
+ if (!(inode->i_opflags & IOP_XATTR))
+ return -EOPNOTSUPP;
+
+- list_for_each_entry_rcu(xattr, &evm_config_xattrnames, list) {
++ list_for_each_entry_lockless(xattr, &evm_config_xattrnames, list) {
+ error = __vfs_getxattr(dentry, inode, xattr->name, NULL, 0);
+ if (error < 0) {
+ if (error == -ENODATA)
+@@ -233,7 +233,7 @@ static int evm_protected_xattr(const char *req_xattr_name)
+ struct xattr_list *xattr;
+
+ namelen = strlen(req_xattr_name);
+- list_for_each_entry_rcu(xattr, &evm_config_xattrnames, list) {
++ list_for_each_entry_lockless(xattr, &evm_config_xattrnames, list) {
+ if ((strlen(xattr->name) == namelen)
+ && (strncmp(req_xattr_name, xattr->name, namelen) == 0)) {
+ found = 1;
+diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
+index 77de71b7794c..f112ca593adc 100644
+--- a/security/integrity/evm/evm_secfs.c
++++ b/security/integrity/evm/evm_secfs.c
+@@ -237,7 +237,14 @@ static ssize_t evm_write_xattrs(struct file *file, const char __user *buf,
+ goto out;
+ }
+
+- /* Guard against races in evm_read_xattrs */
++ /*
++ * xattr_list_mutex guards against races in evm_read_xattrs().
++ * Entries are only added to the evm_config_xattrnames list
++ * and never deleted. Therefore, the list is traversed
++ * using list_for_each_entry_lockless() without holding
++ * the mutex in evm_calc_hmac_or_hash(), evm_find_protected_xattrs()
++ * and evm_protected_xattr().
++ */
+ mutex_lock(&xattr_list_mutex);
+ list_for_each_entry(tmp, &evm_config_xattrnames, list) {
+ if (strcmp(xattr->name, tmp->name) == 0) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-06-10 21:27 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-06-10 21:27 UTC (permalink / raw
To: gentoo-commits
commit: 069298453b1b7c35b1eefed4761dcd07e2b48c5d
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 10 21:27:28 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jun 10 21:27:28 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=06929845
Linux patch 4.19.128
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1127_linux-4.19.128.patch | 1255 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1259 insertions(+)
diff --git a/0000_README b/0000_README
index 730cc1c..123365d 100644
--- a/0000_README
+++ b/0000_README
@@ -547,6 +547,10 @@ Patch: 1126_linux-4.19.127.patch
From: https://www.kernel.org
Desc: Linux 4.19.127
+Patch: 1127_linux-4.19.128.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.128
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1127_linux-4.19.128.patch b/1127_linux-4.19.128.patch
new file mode 100644
index 0000000..f2b9711
--- /dev/null
+++ b/1127_linux-4.19.128.patch
@@ -0,0 +1,1255 @@
+diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
+index b492fb6057c9..b9c14c11efc5 100644
+--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
++++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
+@@ -478,6 +478,7 @@ What: /sys/devices/system/cpu/vulnerabilities
+ /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
+ /sys/devices/system/cpu/vulnerabilities/l1tf
+ /sys/devices/system/cpu/vulnerabilities/mds
++ /sys/devices/system/cpu/vulnerabilities/srbds
+ /sys/devices/system/cpu/vulnerabilities/tsx_async_abort
+ /sys/devices/system/cpu/vulnerabilities/itlb_multihit
+ Date: January 2018
+diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst
+index 0795e3c2643f..ca4dbdd9016d 100644
+--- a/Documentation/admin-guide/hw-vuln/index.rst
++++ b/Documentation/admin-guide/hw-vuln/index.rst
+@@ -14,3 +14,4 @@ are configurable at compile, boot or run time.
+ mds
+ tsx_async_abort
+ multihit.rst
++ special-register-buffer-data-sampling.rst
+diff --git a/Documentation/admin-guide/hw-vuln/special-register-buffer-data-sampling.rst b/Documentation/admin-guide/hw-vuln/special-register-buffer-data-sampling.rst
+new file mode 100644
+index 000000000000..47b1b3afac99
+--- /dev/null
++++ b/Documentation/admin-guide/hw-vuln/special-register-buffer-data-sampling.rst
+@@ -0,0 +1,149 @@
++.. SPDX-License-Identifier: GPL-2.0
++
++SRBDS - Special Register Buffer Data Sampling
++=============================================
++
++SRBDS is a hardware vulnerability that allows MDS :doc:`mds` techniques to
++infer values returned from special register accesses. Special register
++accesses are accesses to off core registers. According to Intel's evaluation,
++the special register reads that have a security expectation of privacy are
++RDRAND, RDSEED and SGX EGETKEY.
++
++When RDRAND, RDSEED and EGETKEY instructions are used, the data is moved
++to the core through the special register mechanism that is susceptible
++to MDS attacks.
++
++Affected processors
++--------------------
++Core models (desktop, mobile, Xeon-E3) that implement RDRAND and/or RDSEED may
++be affected.
++
++A processor is affected by SRBDS if its Family_Model and stepping is
++in the following list, with the exception of the listed processors
++exporting MDS_NO while Intel TSX is available yet not enabled. The
++latter class of processors are only affected when Intel TSX is enabled
++by software using TSX_CTRL_MSR otherwise they are not affected.
++
++ ============= ============ ========
++ common name Family_Model Stepping
++ ============= ============ ========
++ IvyBridge 06_3AH All
++
++ Haswell 06_3CH All
++ Haswell_L 06_45H All
++ Haswell_G 06_46H All
++
++ Broadwell_G 06_47H All
++ Broadwell 06_3DH All
++
++ Skylake_L 06_4EH All
++ Skylake 06_5EH All
++
++ Kabylake_L 06_8EH <= 0xC
++ Kabylake 06_9EH <= 0xD
++ ============= ============ ========
++
++Related CVEs
++------------
++
++The following CVE entry is related to this SRBDS issue:
++
++ ============== ===== =====================================
++ CVE-2020-0543 SRBDS Special Register Buffer Data Sampling
++ ============== ===== =====================================
++
++Attack scenarios
++----------------
++An unprivileged user can extract values returned from RDRAND and RDSEED
++executed on another core or sibling thread using MDS techniques.
++
++
++Mitigation mechanism
++-------------------
++Intel will release microcode updates that modify the RDRAND, RDSEED, and
++EGETKEY instructions to overwrite secret special register data in the shared
++staging buffer before the secret data can be accessed by another logical
++processor.
++
++During execution of the RDRAND, RDSEED, or EGETKEY instructions, off-core
++accesses from other logical processors will be delayed until the special
++register read is complete and the secret data in the shared staging buffer is
++overwritten.
++
++This has three effects on performance:
++
++#. RDRAND, RDSEED, or EGETKEY instructions have higher latency.
++
++#. Executing RDRAND at the same time on multiple logical processors will be
++ serialized, resulting in an overall reduction in the maximum RDRAND
++ bandwidth.
++
++#. Executing RDRAND, RDSEED or EGETKEY will delay memory accesses from other
++ logical processors that miss their core caches, with an impact similar to
++ legacy locked cache-line-split accesses.
++
++The microcode updates provide an opt-out mechanism (RNGDS_MITG_DIS) to disable
++the mitigation for RDRAND and RDSEED instructions executed outside of Intel
++Software Guard Extensions (Intel SGX) enclaves. On logical processors that
++disable the mitigation using this opt-out mechanism, RDRAND and RDSEED do not
++take longer to execute and do not impact performance of sibling logical
++processors memory accesses. The opt-out mechanism does not affect Intel SGX
++enclaves (including execution of RDRAND or RDSEED inside an enclave, as well
++as EGETKEY execution).
++
++IA32_MCU_OPT_CTRL MSR Definition
++--------------------------------
++Along with the mitigation for this issue, Intel added a new thread-scope
++IA32_MCU_OPT_CTRL MSR, (address 0x123). The presence of this MSR and
++RNGDS_MITG_DIS (bit 0) is enumerated by CPUID.(EAX=07H,ECX=0).EDX[SRBDS_CTRL =
++9]==1. This MSR is introduced through the microcode update.
++
++Setting IA32_MCU_OPT_CTRL[0] (RNGDS_MITG_DIS) to 1 for a logical processor
++disables the mitigation for RDRAND and RDSEED executed outside of an Intel SGX
++enclave on that logical processor. Opting out of the mitigation for a
++particular logical processor does not affect the RDRAND and RDSEED mitigations
++for other logical processors.
++
++Note that inside of an Intel SGX enclave, the mitigation is applied regardless
++of the value of RNGDS_MITG_DS.
++
++Mitigation control on the kernel command line
++---------------------------------------------
++The kernel command line allows control over the SRBDS mitigation at boot time
++with the option "srbds=". The option for this is:
++
++ ============= =============================================================
++ off This option disables SRBDS mitigation for RDRAND and RDSEED on
++ affected platforms.
++ ============= =============================================================
++
++SRBDS System Information
++-----------------------
++The Linux kernel provides vulnerability status information through sysfs. For
++SRBDS this can be accessed by the following sysfs file:
++/sys/devices/system/cpu/vulnerabilities/srbds
++
++The possible values contained in this file are:
++
++ ============================== =============================================
++ Not affected Processor not vulnerable
++ Vulnerable Processor vulnerable and mitigation disabled
++ Vulnerable: No microcode Processor vulnerable and microcode is missing
++ mitigation
++ Mitigation: Microcode Processor is vulnerable and mitigation is in
++ effect.
++ Mitigation: TSX disabled Processor is only vulnerable when TSX is
++ enabled while this system was booted with TSX
++ disabled.
++ Unknown: Dependent on
++ hypervisor status Running on virtual guest processor that is
++ affected but with no way to know if host
++ processor is mitigated or vulnerable.
++ ============================== =============================================
++
++SRBDS Default mitigation
++------------------------
++This new microcode serializes processor access during execution of RDRAND,
++RDSEED ensures that the shared buffer is overwritten before it is released for
++reuse. Use the "srbds=off" kernel command line to disable the mitigation for
++RDRAND and RDSEED.
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 1a5101b7e853..30752db57587 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -4415,6 +4415,26 @@
+ spia_pedr=
+ spia_peddr=
+
++ srbds= [X86,INTEL]
++ Control the Special Register Buffer Data Sampling
++ (SRBDS) mitigation.
++
++ Certain CPUs are vulnerable to an MDS-like
++ exploit which can leak bits from the random
++ number generator.
++
++ By default, this issue is mitigated by
++ microcode. However, the microcode fix can cause
++ the RDRAND and RDSEED instructions to become
++ much slower. Among other effects, this will
++ result in reduced throughput from /dev/urandom.
++
++ The microcode mitigation can be disabled with
++ the following option:
++
++ off: Disable mitigation and remove
++ performance impact to RDRAND and RDSEED
++
+ srcutree.counter_wrap_check [KNL]
+ Specifies how frequently to check for
+ grace-period sequence counter wrap for the
+diff --git a/Makefile b/Makefile
+index a93e38cdd61b..af0558a79c41 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 127
++SUBLEVEL = 128
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/include/asm/cpu_device_id.h b/arch/x86/include/asm/cpu_device_id.h
+index baeba0567126..884466592943 100644
+--- a/arch/x86/include/asm/cpu_device_id.h
++++ b/arch/x86/include/asm/cpu_device_id.h
+@@ -9,6 +9,33 @@
+
+ #include <linux/mod_devicetable.h>
+
++#define X86_STEPPINGS(mins, maxs) GENMASK(maxs, mins)
++
++/**
++ * X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE - Base macro for CPU matching
++ * @_vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
++ * The name is expanded to X86_VENDOR_@_vendor
++ * @_family: The family number or X86_FAMILY_ANY
++ * @_model: The model number, model constant or X86_MODEL_ANY
++ * @_steppings: Bitmask for steppings, stepping constant or X86_STEPPING_ANY
++ * @_feature: A X86_FEATURE bit or X86_FEATURE_ANY
++ * @_data: Driver specific data or NULL. The internal storage
++ * format is unsigned long. The supplied value, pointer
++ * etc. is casted to unsigned long internally.
++ *
++ * Backport version to keep the SRBDS pile consistant. No shorter variants
++ * required for this.
++ */
++#define X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(_vendor, _family, _model, \
++ _steppings, _feature, _data) { \
++ .vendor = X86_VENDOR_##_vendor, \
++ .family = _family, \
++ .model = _model, \
++ .steppings = _steppings, \
++ .feature = _feature, \
++ .driver_data = (unsigned long) _data \
++}
++
+ extern const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match);
+
+ #endif
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 8c13b99b9507..9f03ac233566 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -347,6 +347,7 @@
+ /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
+ #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */
+ #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
++#define X86_FEATURE_SRBDS_CTRL (18*32+ 9) /* "" SRBDS mitigation MSR available */
+ #define X86_FEATURE_TSX_FORCE_ABORT (18*32+13) /* "" TSX_FORCE_ABORT */
+ #define X86_FEATURE_MD_CLEAR (18*32+10) /* VERW clears CPU buffers */
+ #define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */
+@@ -391,5 +392,6 @@
+ #define X86_BUG_SWAPGS X86_BUG(21) /* CPU is affected by speculation through SWAPGS */
+ #define X86_BUG_TAA X86_BUG(22) /* CPU is affected by TSX Async Abort(TAA) */
+ #define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
++#define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */
+
+ #endif /* _ASM_X86_CPUFEATURES_H */
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index d2c25a13e1ce..5bb11a8c245e 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -110,6 +110,10 @@
+ #define TSX_CTRL_RTM_DISABLE BIT(0) /* Disable RTM feature */
+ #define TSX_CTRL_CPUID_CLEAR BIT(1) /* Disable TSX enumeration */
+
++/* SRBDS support */
++#define MSR_IA32_MCU_OPT_CTRL 0x00000123
++#define RNGDS_MITG_DIS BIT(0)
++
+ #define MSR_IA32_SYSENTER_CS 0x00000174
+ #define MSR_IA32_SYSENTER_ESP 0x00000175
+ #define MSR_IA32_SYSENTER_EIP 0x00000176
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 2d23a448e72d..cf07437cd106 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -41,6 +41,7 @@ static void __init l1tf_select_mitigation(void);
+ static void __init mds_select_mitigation(void);
+ static void __init mds_print_mitigation(void);
+ static void __init taa_select_mitigation(void);
++static void __init srbds_select_mitigation(void);
+
+ /* The base value of the SPEC_CTRL MSR that always has to be preserved. */
+ u64 x86_spec_ctrl_base;
+@@ -108,6 +109,7 @@ void __init check_bugs(void)
+ l1tf_select_mitigation();
+ mds_select_mitigation();
+ taa_select_mitigation();
++ srbds_select_mitigation();
+
+ /*
+ * As MDS and TAA mitigations are inter-related, print MDS
+@@ -390,6 +392,97 @@ static int __init tsx_async_abort_parse_cmdline(char *str)
+ }
+ early_param("tsx_async_abort", tsx_async_abort_parse_cmdline);
+
++#undef pr_fmt
++#define pr_fmt(fmt) "SRBDS: " fmt
++
++enum srbds_mitigations {
++ SRBDS_MITIGATION_OFF,
++ SRBDS_MITIGATION_UCODE_NEEDED,
++ SRBDS_MITIGATION_FULL,
++ SRBDS_MITIGATION_TSX_OFF,
++ SRBDS_MITIGATION_HYPERVISOR,
++};
++
++static enum srbds_mitigations srbds_mitigation __ro_after_init = SRBDS_MITIGATION_FULL;
++
++static const char * const srbds_strings[] = {
++ [SRBDS_MITIGATION_OFF] = "Vulnerable",
++ [SRBDS_MITIGATION_UCODE_NEEDED] = "Vulnerable: No microcode",
++ [SRBDS_MITIGATION_FULL] = "Mitigation: Microcode",
++ [SRBDS_MITIGATION_TSX_OFF] = "Mitigation: TSX disabled",
++ [SRBDS_MITIGATION_HYPERVISOR] = "Unknown: Dependent on hypervisor status",
++};
++
++static bool srbds_off;
++
++void update_srbds_msr(void)
++{
++ u64 mcu_ctrl;
++
++ if (!boot_cpu_has_bug(X86_BUG_SRBDS))
++ return;
++
++ if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
++ return;
++
++ if (srbds_mitigation == SRBDS_MITIGATION_UCODE_NEEDED)
++ return;
++
++ rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
++
++ switch (srbds_mitigation) {
++ case SRBDS_MITIGATION_OFF:
++ case SRBDS_MITIGATION_TSX_OFF:
++ mcu_ctrl |= RNGDS_MITG_DIS;
++ break;
++ case SRBDS_MITIGATION_FULL:
++ mcu_ctrl &= ~RNGDS_MITG_DIS;
++ break;
++ default:
++ break;
++ }
++
++ wrmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
++}
++
++static void __init srbds_select_mitigation(void)
++{
++ u64 ia32_cap;
++
++ if (!boot_cpu_has_bug(X86_BUG_SRBDS))
++ return;
++
++ /*
++ * Check to see if this is one of the MDS_NO systems supporting
++ * TSX that are only exposed to SRBDS when TSX is enabled.
++ */
++ ia32_cap = x86_read_arch_cap_msr();
++ if ((ia32_cap & ARCH_CAP_MDS_NO) && !boot_cpu_has(X86_FEATURE_RTM))
++ srbds_mitigation = SRBDS_MITIGATION_TSX_OFF;
++ else if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
++ srbds_mitigation = SRBDS_MITIGATION_HYPERVISOR;
++ else if (!boot_cpu_has(X86_FEATURE_SRBDS_CTRL))
++ srbds_mitigation = SRBDS_MITIGATION_UCODE_NEEDED;
++ else if (cpu_mitigations_off() || srbds_off)
++ srbds_mitigation = SRBDS_MITIGATION_OFF;
++
++ update_srbds_msr();
++ pr_info("%s\n", srbds_strings[srbds_mitigation]);
++}
++
++static int __init srbds_parse_cmdline(char *str)
++{
++ if (!str)
++ return -EINVAL;
++
++ if (!boot_cpu_has_bug(X86_BUG_SRBDS))
++ return 0;
++
++ srbds_off = !strcmp(str, "off");
++ return 0;
++}
++early_param("srbds", srbds_parse_cmdline);
++
+ #undef pr_fmt
+ #define pr_fmt(fmt) "Spectre V1 : " fmt
+
+@@ -1491,6 +1584,11 @@ static char *ibpb_state(void)
+ return "";
+ }
+
++static ssize_t srbds_show_state(char *buf)
++{
++ return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]);
++}
++
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+ char *buf, unsigned int bug)
+ {
+@@ -1535,6 +1633,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ case X86_BUG_ITLB_MULTIHIT:
+ return itlb_multihit_show_state(buf);
+
++ case X86_BUG_SRBDS:
++ return srbds_show_state(buf);
++
+ default:
+ break;
+ }
+@@ -1581,4 +1682,9 @@ ssize_t cpu_show_itlb_multihit(struct device *dev, struct device_attribute *attr
+ {
+ return cpu_show_common(dev, attr, buf, X86_BUG_ITLB_MULTIHIT);
+ }
++
++ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ return cpu_show_common(dev, attr, buf, X86_BUG_SRBDS);
++}
+ #endif
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 7f43eba8d0c1..2058e8c0e61d 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1013,9 +1013,30 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+ {}
+ };
+
+-static bool __init cpu_matches(unsigned long which)
++#define VULNBL_INTEL_STEPPINGS(model, steppings, issues) \
++ X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, \
++ INTEL_FAM6_##model, steppings, \
++ X86_FEATURE_ANY, issues)
++
++#define SRBDS BIT(0)
++
++static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
++ VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(HASWELL_CORE, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(HASWELL_ULT, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(HASWELL_GT3E, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(BROADWELL_GT3E, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(BROADWELL_CORE, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPINGS(0x0, 0xC), SRBDS),
++ VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x0, 0xD), SRBDS),
++ {}
++};
++
++static bool __init cpu_matches(const struct x86_cpu_id *table, unsigned long which)
+ {
+- const struct x86_cpu_id *m = x86_match_cpu(cpu_vuln_whitelist);
++ const struct x86_cpu_id *m = x86_match_cpu(table);
+
+ return m && !!(m->driver_data & which);
+ }
+@@ -1035,29 +1056,32 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ u64 ia32_cap = x86_read_arch_cap_msr();
+
+ /* Set ITLB_MULTIHIT bug if cpu is not in the whitelist and not mitigated */
+- if (!cpu_matches(NO_ITLB_MULTIHIT) && !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO))
++ if (!cpu_matches(cpu_vuln_whitelist, NO_ITLB_MULTIHIT) &&
++ !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO))
+ setup_force_cpu_bug(X86_BUG_ITLB_MULTIHIT);
+
+- if (cpu_matches(NO_SPECULATION))
++ if (cpu_matches(cpu_vuln_whitelist, NO_SPECULATION))
+ return;
+
+ setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
+ setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
+
+- if (!cpu_matches(NO_SSB) && !(ia32_cap & ARCH_CAP_SSB_NO) &&
++ if (!cpu_matches(cpu_vuln_whitelist, NO_SSB) &&
++ !(ia32_cap & ARCH_CAP_SSB_NO) &&
+ !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
+ setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
+
+ if (ia32_cap & ARCH_CAP_IBRS_ALL)
+ setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
+
+- if (!cpu_matches(NO_MDS) && !(ia32_cap & ARCH_CAP_MDS_NO)) {
++ if (!cpu_matches(cpu_vuln_whitelist, NO_MDS) &&
++ !(ia32_cap & ARCH_CAP_MDS_NO)) {
+ setup_force_cpu_bug(X86_BUG_MDS);
+- if (cpu_matches(MSBDS_ONLY))
++ if (cpu_matches(cpu_vuln_whitelist, MSBDS_ONLY))
+ setup_force_cpu_bug(X86_BUG_MSBDS_ONLY);
+ }
+
+- if (!cpu_matches(NO_SWAPGS))
++ if (!cpu_matches(cpu_vuln_whitelist, NO_SWAPGS))
+ setup_force_cpu_bug(X86_BUG_SWAPGS);
+
+ /*
+@@ -1075,7 +1099,16 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ (ia32_cap & ARCH_CAP_TSX_CTRL_MSR)))
+ setup_force_cpu_bug(X86_BUG_TAA);
+
+- if (cpu_matches(NO_MELTDOWN))
++ /*
++ * SRBDS affects CPUs which support RDRAND or RDSEED and are listed
++ * in the vulnerability blacklist.
++ */
++ if ((cpu_has(c, X86_FEATURE_RDRAND) ||
++ cpu_has(c, X86_FEATURE_RDSEED)) &&
++ cpu_matches(cpu_vuln_blacklist, SRBDS))
++ setup_force_cpu_bug(X86_BUG_SRBDS);
++
++ if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
+ return;
+
+ /* Rogue Data Cache Load? No! */
+@@ -1084,7 +1117,7 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+
+ setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
+
+- if (cpu_matches(NO_L1TF))
++ if (cpu_matches(cpu_vuln_whitelist, NO_L1TF))
+ return;
+
+ setup_force_cpu_bug(X86_BUG_L1TF);
+@@ -1519,6 +1552,7 @@ void identify_secondary_cpu(struct cpuinfo_x86 *c)
+ mtrr_ap_init();
+ validate_apic_and_package_id(c);
+ x86_spec_ctrl_setup_ap();
++ update_srbds_msr();
+ }
+
+ static __init int setup_noclflush(char *arg)
+diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
+index 236582c90d3f..e89602d2aff5 100644
+--- a/arch/x86/kernel/cpu/cpu.h
++++ b/arch/x86/kernel/cpu/cpu.h
+@@ -80,6 +80,7 @@ extern void detect_ht(struct cpuinfo_x86 *c);
+ unsigned int aperfmperf_get_khz(int cpu);
+
+ extern void x86_spec_ctrl_setup_ap(void);
++extern void update_srbds_msr(void);
+
+ extern u64 x86_read_arch_cap_msr(void);
+
+diff --git a/arch/x86/kernel/cpu/match.c b/arch/x86/kernel/cpu/match.c
+index 3fed38812eea..751e59057466 100644
+--- a/arch/x86/kernel/cpu/match.c
++++ b/arch/x86/kernel/cpu/match.c
+@@ -34,13 +34,18 @@ const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match)
+ const struct x86_cpu_id *m;
+ struct cpuinfo_x86 *c = &boot_cpu_data;
+
+- for (m = match; m->vendor | m->family | m->model | m->feature; m++) {
++ for (m = match;
++ m->vendor | m->family | m->model | m->steppings | m->feature;
++ m++) {
+ if (m->vendor != X86_VENDOR_ANY && c->x86_vendor != m->vendor)
+ continue;
+ if (m->family != X86_FAMILY_ANY && c->x86 != m->family)
+ continue;
+ if (m->model != X86_MODEL_ANY && c->x86_model != m->model)
+ continue;
++ if (m->steppings != X86_STEPPING_ANY &&
++ !(BIT(c->x86_stepping) & m->steppings))
++ continue;
+ if (m->feature != X86_FEATURE_ANY && !cpu_has(c, m->feature))
+ continue;
+ return m;
+diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
+index f3ecf7418ed4..1df057486176 100644
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -565,6 +565,12 @@ ssize_t __weak cpu_show_itlb_multihit(struct device *dev,
+ return sprintf(buf, "Not affected\n");
+ }
+
++ssize_t __weak cpu_show_srbds(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ return sprintf(buf, "Not affected\n");
++}
++
+ static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
+ static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
+ static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
+@@ -573,6 +579,7 @@ static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL);
+ static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL);
+ static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL);
+ static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL);
++static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL);
+
+ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_meltdown.attr,
+@@ -583,6 +590,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_mds.attr,
+ &dev_attr_tsx_async_abort.attr,
+ &dev_attr_itlb_multihit.attr,
++ &dev_attr_srbds.attr,
+ NULL
+ };
+
+diff --git a/drivers/iio/light/vcnl4000.c b/drivers/iio/light/vcnl4000.c
+index d3d65ecb30a5..a3fdffa4ef84 100644
+--- a/drivers/iio/light/vcnl4000.c
++++ b/drivers/iio/light/vcnl4000.c
+@@ -166,7 +166,6 @@ static int vcnl4000_measure(struct vcnl4000_data *data, u8 req_mask,
+ u8 rdy_mask, u8 data_reg, int *val)
+ {
+ int tries = 20;
+- __be16 buf;
+ int ret;
+
+ mutex_lock(&data->vcnl4000_lock);
+@@ -193,13 +192,12 @@ static int vcnl4000_measure(struct vcnl4000_data *data, u8 req_mask,
+ goto fail;
+ }
+
+- ret = i2c_smbus_read_i2c_block_data(data->client,
+- data_reg, sizeof(buf), (u8 *) &buf);
++ ret = i2c_smbus_read_word_swapped(data->client, data_reg);
+ if (ret < 0)
+ goto fail;
+
+ mutex_unlock(&data->vcnl4000_lock);
+- *val = be16_to_cpu(buf);
++ *val = ret;
+
+ return 0;
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 2f6c3353055d..b16e0f45d28c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -364,12 +364,6 @@ static void del_sw_ns(struct fs_node *node)
+
+ static void del_sw_prio(struct fs_node *node)
+ {
+- struct mlx5_flow_root_namespace *root_ns;
+- struct mlx5_flow_namespace *ns;
+-
+- fs_get_obj(ns, node);
+- root_ns = container_of(ns, struct mlx5_flow_root_namespace, ns);
+- mutex_destroy(&root_ns->chain_lock);
+ kfree(node);
+ }
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index c8222cdf755d..1f70e00838f2 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1260,6 +1260,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */
+ {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
+ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
+ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */
+ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */
+diff --git a/drivers/nfc/st21nfca/dep.c b/drivers/nfc/st21nfca/dep.c
+index fd08be2917e6..7399eb2c5e1d 100644
+--- a/drivers/nfc/st21nfca/dep.c
++++ b/drivers/nfc/st21nfca/dep.c
+@@ -184,8 +184,10 @@ static int st21nfca_tm_send_atr_res(struct nfc_hci_dev *hdev,
+ memcpy(atr_res->gbi, atr_req->gbi, gb_len);
+ r = nfc_set_remote_general_bytes(hdev->ndev, atr_res->gbi,
+ gb_len);
+- if (r < 0)
++ if (r < 0) {
++ kfree_skb(skb);
+ return r;
++ }
+ }
+
+ info->dep_info.curr_nfc_dep_pni = 0;
+diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c
+index fbb1f1df6fc7..e62926b295db 100644
+--- a/drivers/nvmem/qfprom.c
++++ b/drivers/nvmem/qfprom.c
+@@ -35,25 +35,11 @@ static int qfprom_reg_read(void *context,
+ return 0;
+ }
+
+-static int qfprom_reg_write(void *context,
+- unsigned int reg, void *_val, size_t bytes)
+-{
+- struct qfprom_priv *priv = context;
+- u8 *val = _val;
+- int i = 0, words = bytes;
+-
+- while (words--)
+- writeb(*val++, priv->base + reg + i++);
+-
+- return 0;
+-}
+-
+ static struct nvmem_config econfig = {
+ .name = "qfprom",
+ .stride = 1,
+ .word_size = 1,
+ .reg_read = qfprom_reg_read,
+- .reg_write = qfprom_reg_write,
+ };
+
+ static int qfprom_probe(struct platform_device *pdev)
+diff --git a/drivers/staging/rtl8712/wifi.h b/drivers/staging/rtl8712/wifi.h
+index 00a4302e9983..0ea21f889be6 100644
+--- a/drivers/staging/rtl8712/wifi.h
++++ b/drivers/staging/rtl8712/wifi.h
+@@ -468,7 +468,7 @@ static inline unsigned char *get_hdr_bssid(unsigned char *pframe)
+ /* block-ack parameters */
+ #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
+ #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
+-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
++#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0
+ #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
+ #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
+
+@@ -562,13 +562,6 @@ struct ieee80211_ht_addt_info {
+ #define IEEE80211_HT_IE_NON_GF_STA_PRSNT 0x0004
+ #define IEEE80211_HT_IE_NON_HT_STA_PRSNT 0x0010
+
+-/* block-ack parameters */
+-#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
+-#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
+-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
+-#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
+-#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
+-
+ /*
+ * A-PMDU buffer sizes
+ * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2)
+diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
+index 436cc51c92c3..cdcc64ea2554 100644
+--- a/drivers/tty/hvc/hvc_console.c
++++ b/drivers/tty/hvc/hvc_console.c
+@@ -371,15 +371,14 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
+ * tty fields and return the kref reference.
+ */
+ if (rc) {
+- tty_port_tty_set(&hp->port, NULL);
+- tty->driver_data = NULL;
+- tty_port_put(&hp->port);
+ printk(KERN_ERR "hvc_open: request_irq failed with rc %d.\n", rc);
+- } else
++ } else {
+ /* We are ready... raise DTR/RTS */
+ if (C_BAUD(tty))
+ if (hp->ops->dtr_rts)
+ hp->ops->dtr_rts(hp, 1);
++ tty_port_set_initialized(&hp->port, true);
++ }
+
+ /* Force wakeup of the polling thread */
+ hvc_kick();
+@@ -389,22 +388,12 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
+
+ static void hvc_close(struct tty_struct *tty, struct file * filp)
+ {
+- struct hvc_struct *hp;
++ struct hvc_struct *hp = tty->driver_data;
+ unsigned long flags;
+
+ if (tty_hung_up_p(filp))
+ return;
+
+- /*
+- * No driver_data means that this close was issued after a failed
+- * hvc_open by the tty layer's release_dev() function and we can just
+- * exit cleanly because the kref reference wasn't made.
+- */
+- if (!tty->driver_data)
+- return;
+-
+- hp = tty->driver_data;
+-
+ spin_lock_irqsave(&hp->port.lock, flags);
+
+ if (--hp->port.count == 0) {
+@@ -412,6 +401,9 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
+ /* We are done with the tty pointer now. */
+ tty_port_tty_set(&hp->port, NULL);
+
++ if (!tty_port_initialized(&hp->port))
++ return;
++
+ if (C_HUPCL(tty))
+ if (hp->ops->dtr_rts)
+ hp->ops->dtr_rts(hp, 0);
+@@ -428,6 +420,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
+ * waking periodically to check chars_in_buffer().
+ */
+ tty_wait_until_sent(tty, HVC_CLOSE_WAIT);
++ tty_port_set_initialized(&hp->port, false);
+ } else {
+ if (hp->port.count < 0)
+ printk(KERN_ERR "hvc_close %X: oops, count is %d\n",
+diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
+index 8d6074f8ba41..a7455f8a4235 100644
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -127,7 +127,11 @@ static DEFINE_SPINLOCK(func_buf_lock); /* guard 'func_buf' and friends */
+ static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)]; /* keyboard key bitmap */
+ static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */
+ static bool dead_key_next;
+-static int npadch = -1; /* -1 or number assembled on pad */
++
++/* Handles a number being assembled on the number pad */
++static bool npadch_active;
++static unsigned int npadch_value;
++
+ static unsigned int diacr;
+ static char rep; /* flag telling character repeat */
+
+@@ -845,12 +849,12 @@ static void k_shift(struct vc_data *vc, unsigned char value, char up_flag)
+ shift_state &= ~(1 << value);
+
+ /* kludge */
+- if (up_flag && shift_state != old_state && npadch != -1) {
++ if (up_flag && shift_state != old_state && npadch_active) {
+ if (kbd->kbdmode == VC_UNICODE)
+- to_utf8(vc, npadch);
++ to_utf8(vc, npadch_value);
+ else
+- put_queue(vc, npadch & 0xff);
+- npadch = -1;
++ put_queue(vc, npadch_value & 0xff);
++ npadch_active = false;
+ }
+ }
+
+@@ -868,7 +872,7 @@ static void k_meta(struct vc_data *vc, unsigned char value, char up_flag)
+
+ static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag)
+ {
+- int base;
++ unsigned int base;
+
+ if (up_flag)
+ return;
+@@ -882,10 +886,12 @@ static void k_ascii(struct vc_data *vc, unsigned char value, char up_flag)
+ base = 16;
+ }
+
+- if (npadch == -1)
+- npadch = value;
+- else
+- npadch = npadch * base + value;
++ if (!npadch_active) {
++ npadch_value = 0;
++ npadch_active = true;
++ }
++
++ npadch_value = npadch_value * base + value;
+ }
+
+ static void k_lock(struct vc_data *vc, unsigned char value, char up_flag)
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 10ba1b4f0dbf..e8b9b27937ed 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -590,7 +590,7 @@ static void acm_softint(struct work_struct *work)
+ }
+
+ if (test_and_clear_bit(ACM_ERROR_DELAY, &acm->flags)) {
+- for (i = 0; i < ACM_NR; i++)
++ for (i = 0; i < acm->rx_buflimit; i++)
+ if (test_and_clear_bit(i, &acm->urbs_in_error_delay))
+ acm_submit_read_urb(acm, i, GFP_NOIO);
+ }
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index b6b4f99a399c..28b4cacf7a78 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -2737,6 +2737,13 @@ static int musb_resume(struct device *dev)
+ musb_enable_interrupts(musb);
+ musb_platform_enable(musb);
+
++ /* session might be disabled in suspend */
++ if (musb->port_mode == MUSB_HOST &&
++ !(musb->ops->quirks & MUSB_PRESERVE_SESSION)) {
++ devctl |= MUSB_DEVCTL_SESSION;
++ musb_writeb(musb->mregs, MUSB_DEVCTL, devctl);
++ }
++
+ spin_lock_irqsave(&musb->lock, flags);
+ error = musb_run_resume_work(musb);
+ if (error)
+diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c
+index f42858e2b54c..0c6204add616 100644
+--- a/drivers/usb/musb/musb_debugfs.c
++++ b/drivers/usb/musb/musb_debugfs.c
+@@ -168,6 +168,11 @@ static ssize_t musb_test_mode_write(struct file *file,
+ u8 test;
+ char buf[24];
+
++ memset(buf, 0x00, sizeof(buf));
++
++ if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
++ return -EFAULT;
++
+ pm_runtime_get_sync(musb->controller);
+ test = musb_readb(musb->mregs, MUSB_TESTMODE);
+ if (test) {
+@@ -176,11 +181,6 @@ static ssize_t musb_test_mode_write(struct file *file,
+ goto ret;
+ }
+
+- memset(buf, 0x00, sizeof(buf));
+-
+- if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
+- return -EFAULT;
+-
+ if (strstarts(buf, "force host full-speed"))
+ test = MUSB_TEST_FORCE_HOST | MUSB_TEST_FORCE_FS;
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 8dad374ec81d..d2174a5fb420 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1157,6 +1157,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1031, 0xff), /* Telit LE910C1-EUX */
++ .driver_info = NCTRL(0) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1033, 0xff), /* Telit LE910C1-EUX (ECM) */
++ .driver_info = NCTRL(0) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),
+ .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1),
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index ce0401d3137f..d147feae83e6 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -173,6 +173,7 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+ {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */
+ {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */
++ {DEVICE_SWI(0x413c, 0x81cb)}, /* Dell Wireless 5816e QDL */
+ {DEVICE_SWI(0x413c, 0x81cc)}, /* Dell Wireless 5816e */
+ {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */
+ {DEVICE_SWI(0x413c, 0x81d0)}, /* Dell Wireless 5819 */
+diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
+index 35406cb4a726..997ff88ec04b 100644
+--- a/drivers/usb/serial/usb_wwan.c
++++ b/drivers/usb/serial/usb_wwan.c
+@@ -299,6 +299,10 @@ static void usb_wwan_indat_callback(struct urb *urb)
+ if (status) {
+ dev_dbg(dev, "%s: nonzero status: %d on endpoint %02x.\n",
+ __func__, status, endpoint);
++
++ /* don't resubmit on fatal errors */
++ if (status == -ESHUTDOWN || status == -ENOENT)
++ return;
+ } else {
+ if (urb->actual_length) {
+ tty_insert_flip_string(&port->port, data,
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index 867db9b9384c..84e4e20352d9 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -621,6 +621,10 @@ struct mips_cdmm_device_id {
+ /*
+ * MODULE_DEVICE_TABLE expects this struct to be called x86cpu_device_id.
+ * Although gcc seems to ignore this error, clang fails without this define.
++ *
++ * Note: The ordering of the struct is different from upstream because the
++ * static initializers in kernels < 5.7 still use C89 style while upstream
++ * has been converted to proper C99 initializers.
+ */
+ #define x86cpu_device_id x86_cpu_id
+ struct x86_cpu_id {
+@@ -629,6 +633,7 @@ struct x86_cpu_id {
+ __u16 model;
+ __u16 feature; /* bit index */
+ kernel_ulong_t driver_data;
++ __u16 steppings;
+ };
+
+ #define X86_FEATURE_MATCH(x) \
+@@ -637,6 +642,7 @@ struct x86_cpu_id {
+ #define X86_VENDOR_ANY 0xffff
+ #define X86_FAMILY_ANY 0
+ #define X86_MODEL_ANY 0
++#define X86_STEPPING_ANY 0
+ #define X86_FEATURE_ANY 0 /* Same as FPU, you can't test for that */
+
+ /*
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index f36727098df8..1c296f370e46 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -31,6 +31,7 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ {
+ unsigned int gso_type = 0;
+ unsigned int thlen = 0;
++ unsigned int p_off = 0;
+ unsigned int ip_proto;
+
+ if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+@@ -68,7 +69,8 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ if (!skb_partial_csum_set(skb, start, off))
+ return -EINVAL;
+
+- if (skb_transport_offset(skb) + thlen > skb_headlen(skb))
++ p_off = skb_transport_offset(skb) + thlen;
++ if (p_off > skb_headlen(skb))
+ return -EINVAL;
+ } else {
+ /* gso packets without NEEDS_CSUM do not set transport_offset.
+@@ -92,17 +94,25 @@ retry:
+ return -EINVAL;
+ }
+
+- if (keys.control.thoff + thlen > skb_headlen(skb) ||
++ p_off = keys.control.thoff + thlen;
++ if (p_off > skb_headlen(skb) ||
+ keys.basic.ip_proto != ip_proto)
+ return -EINVAL;
+
+ skb_set_transport_header(skb, keys.control.thoff);
++ } else if (gso_type) {
++ p_off = thlen;
++ if (p_off > skb_headlen(skb))
++ return -EINVAL;
+ }
+ }
+
+ if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+ u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size);
+
++ if (skb->len - p_off <= gso_size)
++ return -EINVAL;
++
+ skb_shinfo(skb)->gso_size = gso_size;
+ skb_shinfo(skb)->gso_type = gso_type;
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index c173e4131df8..02d82013c334 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -612,10 +612,6 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
+ if (ret)
+ goto out;
+
+- /* uprobe_write_opcode() assumes we don't cross page boundary */
+- BUG_ON((uprobe->offset & ~PAGE_MASK) +
+- UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
+-
+ smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */
+ set_bit(UPROBE_COPY_INSN, &uprobe->flags);
+
+@@ -911,6 +907,13 @@ static int __uprobe_register(struct inode *inode, loff_t offset,
+ if (offset > i_size_read(inode))
+ return -EINVAL;
+
++ /*
++ * This ensures that copy_from_page() and copy_to_page()
++ * can't cross page boundary.
++ */
++ if (!IS_ALIGNED(offset, UPROBE_SWBP_INSN_SIZE))
++ return -EINVAL;
++
+ retry:
+ uprobe = alloc_uprobe(inode, offset);
+ if (!uprobe)
+@@ -1708,6 +1711,9 @@ static int is_trap_at_addr(struct mm_struct *mm, unsigned long vaddr)
+ uprobe_opcode_t opcode;
+ int result;
+
++ if (WARN_ON_ONCE(!IS_ALIGNED(vaddr, UPROBE_SWBP_INSN_SIZE)))
++ return -EINVAL;
++
+ pagefault_disable();
+ result = __get_user(opcode, (uprobe_opcode_t __user *)vaddr);
+ pagefault_enable();
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index a08d682ba676..12a2cea9d606 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -269,6 +269,7 @@ static struct in_device *inetdev_init(struct net_device *dev)
+ err = devinet_sysctl_register(in_dev);
+ if (err) {
+ in_dev->dead = 1;
++ neigh_parms_release(&arp_tbl, in_dev->arp_parms);
+ in_dev_put(in_dev);
+ in_dev = NULL;
+ goto out;
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index d0a295cd71ef..9aa1c1fcb77c 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1463,6 +1463,9 @@ static int l2tp_validate_socket(const struct sock *sk, const struct net *net,
+ if (sk->sk_type != SOCK_DGRAM)
+ return -EPROTONOSUPPORT;
+
++ if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
++ return -EPROTONOSUPPORT;
++
+ if ((encap == L2TP_ENCAPTYPE_UDP && sk->sk_protocol != IPPROTO_UDP) ||
+ (encap == L2TP_ENCAPTYPE_IP && sk->sk_protocol != IPPROTO_L2TP))
+ return -EPROTONOSUPPORT;
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index d4c60523c549..99881b81f302 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -24,7 +24,6 @@
+ #include <net/icmp.h>
+ #include <net/udp.h>
+ #include <net/inet_common.h>
+-#include <net/inet_hashtables.h>
+ #include <net/tcp_states.h>
+ #include <net/protocol.h>
+ #include <net/xfrm.h>
+@@ -213,15 +212,31 @@ discard:
+ return 0;
+ }
+
+-static int l2tp_ip_open(struct sock *sk)
++static int l2tp_ip_hash(struct sock *sk)
+ {
+- /* Prevent autobind. We don't have ports. */
+- inet_sk(sk)->inet_num = IPPROTO_L2TP;
++ if (sk_unhashed(sk)) {
++ write_lock_bh(&l2tp_ip_lock);
++ sk_add_node(sk, &l2tp_ip_table);
++ write_unlock_bh(&l2tp_ip_lock);
++ }
++ return 0;
++}
+
++static void l2tp_ip_unhash(struct sock *sk)
++{
++ if (sk_unhashed(sk))
++ return;
+ write_lock_bh(&l2tp_ip_lock);
+- sk_add_node(sk, &l2tp_ip_table);
++ sk_del_node_init(sk);
+ write_unlock_bh(&l2tp_ip_lock);
++}
++
++static int l2tp_ip_open(struct sock *sk)
++{
++ /* Prevent autobind. We don't have ports. */
++ inet_sk(sk)->inet_num = IPPROTO_L2TP;
+
++ l2tp_ip_hash(sk);
+ return 0;
+ }
+
+@@ -598,8 +613,8 @@ static struct proto l2tp_ip_prot = {
+ .sendmsg = l2tp_ip_sendmsg,
+ .recvmsg = l2tp_ip_recvmsg,
+ .backlog_rcv = l2tp_ip_backlog_recv,
+- .hash = inet_hash,
+- .unhash = inet_unhash,
++ .hash = l2tp_ip_hash,
++ .unhash = l2tp_ip_unhash,
+ .obj_size = sizeof(struct l2tp_ip_sock),
+ #ifdef CONFIG_COMPAT
+ .compat_setsockopt = compat_ip_setsockopt,
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index 2f28f9910b92..2ff25c445b82 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -24,8 +24,6 @@
+ #include <net/icmp.h>
+ #include <net/udp.h>
+ #include <net/inet_common.h>
+-#include <net/inet_hashtables.h>
+-#include <net/inet6_hashtables.h>
+ #include <net/tcp_states.h>
+ #include <net/protocol.h>
+ #include <net/xfrm.h>
+@@ -226,15 +224,31 @@ discard:
+ return 0;
+ }
+
+-static int l2tp_ip6_open(struct sock *sk)
++static int l2tp_ip6_hash(struct sock *sk)
+ {
+- /* Prevent autobind. We don't have ports. */
+- inet_sk(sk)->inet_num = IPPROTO_L2TP;
++ if (sk_unhashed(sk)) {
++ write_lock_bh(&l2tp_ip6_lock);
++ sk_add_node(sk, &l2tp_ip6_table);
++ write_unlock_bh(&l2tp_ip6_lock);
++ }
++ return 0;
++}
+
++static void l2tp_ip6_unhash(struct sock *sk)
++{
++ if (sk_unhashed(sk))
++ return;
+ write_lock_bh(&l2tp_ip6_lock);
+- sk_add_node(sk, &l2tp_ip6_table);
++ sk_del_node_init(sk);
+ write_unlock_bh(&l2tp_ip6_lock);
++}
++
++static int l2tp_ip6_open(struct sock *sk)
++{
++ /* Prevent autobind. We don't have ports. */
++ inet_sk(sk)->inet_num = IPPROTO_L2TP;
+
++ l2tp_ip6_hash(sk);
+ return 0;
+ }
+
+@@ -732,8 +746,8 @@ static struct proto l2tp_ip6_prot = {
+ .sendmsg = l2tp_ip6_sendmsg,
+ .recvmsg = l2tp_ip6_recvmsg,
+ .backlog_rcv = l2tp_ip6_backlog_recv,
+- .hash = inet6_hash,
+- .unhash = inet_unhash,
++ .hash = l2tp_ip6_hash,
++ .unhash = l2tp_ip6_unhash,
+ .obj_size = sizeof(struct l2tp_ip6_sock),
+ #ifdef CONFIG_COMPAT
+ .compat_setsockopt = compat_ipv6_setsockopt,
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 62ec9182f234..c88dc8ee3144 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1283,7 +1283,7 @@ static int vsock_accept(struct socket *sock, struct socket *newsock, int flags,
+ /* Wait for children sockets to appear; these are the new sockets
+ * created upon connection establishment.
+ */
+- timeout = sock_sndtimeo(listener, flags & O_NONBLOCK);
++ timeout = sock_rcvtimeo(listener, flags & O_NONBLOCK);
+ prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE);
+
+ while ((connected = vsock_dequeue_accept(listener)) == NULL &&
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-06-22 14:47 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-06-22 14:47 UTC (permalink / raw
To: gentoo-commits
commit: 6209421e45223d6aa85060dca4d113d6815139d1
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Jun 22 14:47:04 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Jun 22 14:47:04 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6209421e
Linux patch 4.19.129
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1128_linux-4.19.129.patch | 9428 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 9432 insertions(+)
diff --git a/0000_README b/0000_README
index 123365d..afec7d2 100644
--- a/0000_README
+++ b/0000_README
@@ -551,6 +551,10 @@ Patch: 1127_linux-4.19.128.patch
From: https://www.kernel.org
Desc: Linux 4.19.128
+Patch: 1128_linux-4.19.129.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.129
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1128_linux-4.19.129.patch b/1128_linux-4.19.129.patch
new file mode 100644
index 0000000..37c6b1f
--- /dev/null
+++ b/1128_linux-4.19.129.patch
@@ -0,0 +1,9428 @@
+diff --git a/Documentation/devicetree/bindings/display/mediatek/mediatek,dpi.txt b/Documentation/devicetree/bindings/display/mediatek/mediatek,dpi.txt
+index b6a7e7397b8b..b944fe067188 100644
+--- a/Documentation/devicetree/bindings/display/mediatek/mediatek,dpi.txt
++++ b/Documentation/devicetree/bindings/display/mediatek/mediatek,dpi.txt
+@@ -16,6 +16,9 @@ Required properties:
+ Documentation/devicetree/bindings/graph.txt. This port should be connected
+ to the input port of an attached HDMI or LVDS encoder chip.
+
++Optional properties:
++- pinctrl-names: Contain "default" and "sleep".
++
+ Example:
+
+ dpi0: dpi@1401d000 {
+@@ -26,6 +29,9 @@ dpi0: dpi@1401d000 {
+ <&mmsys CLK_MM_DPI_ENGINE>,
+ <&apmixedsys CLK_APMIXED_TVDPLL>;
+ clock-names = "pixel", "engine", "pll";
++ pinctrl-names = "default", "sleep";
++ pinctrl-0 = <&dpi_pin_func>;
++ pinctrl-1 = <&dpi_pin_idle>;
+
+ port {
+ dpi0_out: endpoint {
+diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
+index 8e16017ff397..d2f265a9dc0d 100644
+--- a/Documentation/virtual/kvm/api.txt
++++ b/Documentation/virtual/kvm/api.txt
+@@ -3999,9 +3999,11 @@ EOI was received.
+ #define KVM_EXIT_HYPERV_SYNIC 1
+ #define KVM_EXIT_HYPERV_HCALL 2
+ __u32 type;
++ __u32 pad1;
+ union {
+ struct {
+ __u32 msr;
++ __u32 pad2;
+ __u64 control;
+ __u64 evt_page;
+ __u64 msg_page;
+diff --git a/Makefile b/Makefile
+index af0558a79c41..e6066502e9cc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 128
++SUBLEVEL = 129
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -554,12 +554,8 @@ KBUILD_MODULES :=
+ KBUILD_BUILTIN := 1
+
+ # If we have only "make modules", don't compile built-in objects.
+-# When we're building modules with modversions, we need to consider
+-# the built-in objects during the descend as well, in order to
+-# make sure the checksums are up to date before we record them.
+-
+ ifeq ($(MAKECMDGOALS),modules)
+- KBUILD_BUILTIN := $(if $(CONFIG_MODVERSIONS),1)
++ KBUILD_BUILTIN :=
+ endif
+
+ # If we have "make <whatever> modules", compile modules
+@@ -1229,6 +1225,13 @@ ifdef CONFIG_MODULES
+
+ all: modules
+
++# When we're building modules with modversions, we need to consider
++# the built-in objects during the descend as well, in order to
++# make sure the checksums are up to date before we record them.
++ifdef CONFIG_MODVERSIONS
++ KBUILD_BUILTIN := 1
++endif
++
+ # Build modules
+ #
+ # A module can be listed more than once in obj-m resulting in
+diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h
+index 4c533fc94d62..eb09d5aee910 100644
+--- a/arch/alpha/include/asm/io.h
++++ b/arch/alpha/include/asm/io.h
+@@ -327,14 +327,18 @@ static inline int __is_mmio(const volatile void __iomem *addr)
+ #if IO_CONCAT(__IO_PREFIX,trivial_io_bw)
+ extern inline unsigned int ioread8(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr);
+ mb();
+ return ret;
+ }
+
+ extern inline unsigned int ioread16(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr);
+ mb();
+ return ret;
+ }
+@@ -375,7 +379,9 @@ extern inline void outw(u16 b, unsigned long port)
+ #if IO_CONCAT(__IO_PREFIX,trivial_io_lq)
+ extern inline unsigned int ioread32(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr);
+ mb();
+ return ret;
+ }
+@@ -420,14 +426,18 @@ extern inline void __raw_writew(u16 b, volatile void __iomem *addr)
+
+ extern inline u8 readb(const volatile void __iomem *addr)
+ {
+- u8 ret = __raw_readb(addr);
++ u8 ret;
++ mb();
++ ret = __raw_readb(addr);
+ mb();
+ return ret;
+ }
+
+ extern inline u16 readw(const volatile void __iomem *addr)
+ {
+- u16 ret = __raw_readw(addr);
++ u16 ret;
++ mb();
++ ret = __raw_readw(addr);
+ mb();
+ return ret;
+ }
+@@ -468,14 +478,18 @@ extern inline void __raw_writeq(u64 b, volatile void __iomem *addr)
+
+ extern inline u32 readl(const volatile void __iomem *addr)
+ {
+- u32 ret = __raw_readl(addr);
++ u32 ret;
++ mb();
++ ret = __raw_readl(addr);
+ mb();
+ return ret;
+ }
+
+ extern inline u64 readq(const volatile void __iomem *addr)
+ {
+- u64 ret = __raw_readq(addr);
++ u64 ret;
++ mb();
++ ret = __raw_readq(addr);
+ mb();
+ return ret;
+ }
+@@ -504,14 +518,44 @@ extern inline void writeq(u64 b, volatile void __iomem *addr)
+ #define outb_p outb
+ #define outw_p outw
+ #define outl_p outl
+-#define readb_relaxed(addr) __raw_readb(addr)
+-#define readw_relaxed(addr) __raw_readw(addr)
+-#define readl_relaxed(addr) __raw_readl(addr)
+-#define readq_relaxed(addr) __raw_readq(addr)
+-#define writeb_relaxed(b, addr) __raw_writeb(b, addr)
+-#define writew_relaxed(b, addr) __raw_writew(b, addr)
+-#define writel_relaxed(b, addr) __raw_writel(b, addr)
+-#define writeq_relaxed(b, addr) __raw_writeq(b, addr)
++
++extern u8 readb_relaxed(const volatile void __iomem *addr);
++extern u16 readw_relaxed(const volatile void __iomem *addr);
++extern u32 readl_relaxed(const volatile void __iomem *addr);
++extern u64 readq_relaxed(const volatile void __iomem *addr);
++
++#if IO_CONCAT(__IO_PREFIX,trivial_io_bw)
++extern inline u8 readb_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readb(addr);
++}
++
++extern inline u16 readw_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readw(addr);
++}
++#endif
++
++#if IO_CONCAT(__IO_PREFIX,trivial_io_lq)
++extern inline u32 readl_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readl(addr);
++}
++
++extern inline u64 readq_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readq(addr);
++}
++#endif
++
++#define writeb_relaxed writeb
++#define writew_relaxed writew
++#define writel_relaxed writel
++#define writeq_relaxed writeq
+
+ #define mmiowb()
+
+diff --git a/arch/alpha/include/asm/uaccess.h b/arch/alpha/include/asm/uaccess.h
+index 87d8c4f0307d..7295967b5028 100644
+--- a/arch/alpha/include/asm/uaccess.h
++++ b/arch/alpha/include/asm/uaccess.h
+@@ -30,11 +30,13 @@
+ * Address valid if:
+ * - "addr" doesn't have any high-bits set
+ * - AND "size" doesn't have any high-bits set
+- * - AND "addr+size" doesn't have any high-bits set
++ * - AND "addr+size-(size != 0)" doesn't have any high-bits set
+ * - OR we are in kernel mode.
+ */
+-#define __access_ok(addr, size) \
+- ((get_fs().seg & (addr | size | (addr+size))) == 0)
++#define __access_ok(addr, size) ({ \
++ unsigned long __ao_a = (addr), __ao_b = (size); \
++ unsigned long __ao_end = __ao_a + __ao_b - !!__ao_b; \
++ (get_fs().seg & (__ao_a | __ao_b | __ao_end)) == 0; })
+
+ #define access_ok(type, addr, size) \
+ ({ \
+diff --git a/arch/alpha/kernel/io.c b/arch/alpha/kernel/io.c
+index c025a3e5e357..938de13adfbf 100644
+--- a/arch/alpha/kernel/io.c
++++ b/arch/alpha/kernel/io.c
+@@ -16,21 +16,27 @@
+ unsigned int
+ ioread8(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr);
+ mb();
+ return ret;
+ }
+
+ unsigned int ioread16(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr);
+ mb();
+ return ret;
+ }
+
+ unsigned int ioread32(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr);
+ mb();
+ return ret;
+ }
+@@ -148,28 +154,36 @@ EXPORT_SYMBOL(__raw_writeq);
+
+ u8 readb(const volatile void __iomem *addr)
+ {
+- u8 ret = __raw_readb(addr);
++ u8 ret;
++ mb();
++ ret = __raw_readb(addr);
+ mb();
+ return ret;
+ }
+
+ u16 readw(const volatile void __iomem *addr)
+ {
+- u16 ret = __raw_readw(addr);
++ u16 ret;
++ mb();
++ ret = __raw_readw(addr);
+ mb();
+ return ret;
+ }
+
+ u32 readl(const volatile void __iomem *addr)
+ {
+- u32 ret = __raw_readl(addr);
++ u32 ret;
++ mb();
++ ret = __raw_readl(addr);
+ mb();
+ return ret;
+ }
+
+ u64 readq(const volatile void __iomem *addr)
+ {
+- u64 ret = __raw_readq(addr);
++ u64 ret;
++ mb();
++ ret = __raw_readq(addr);
+ mb();
+ return ret;
+ }
+@@ -207,6 +221,38 @@ EXPORT_SYMBOL(writew);
+ EXPORT_SYMBOL(writel);
+ EXPORT_SYMBOL(writeq);
+
++/*
++ * The _relaxed functions must be ordered w.r.t. each other, but they don't
++ * have to be ordered w.r.t. other memory accesses.
++ */
++u8 readb_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readb(addr);
++}
++
++u16 readw_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readw(addr);
++}
++
++u32 readl_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readl(addr);
++}
++
++u64 readq_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readq(addr);
++}
++
++EXPORT_SYMBOL(readb_relaxed);
++EXPORT_SYMBOL(readw_relaxed);
++EXPORT_SYMBOL(readl_relaxed);
++EXPORT_SYMBOL(readq_relaxed);
+
+ /*
+ * Read COUNT 8-bit bytes from port PORT into memory starting at SRC.
+diff --git a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
+index 2214bfe7aa20..7c611f5555a4 100644
+--- a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
++++ b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
+@@ -40,7 +40,7 @@
+
+ ahb {
+ usb0: gadget@300000 {
+- atmel,vbus-gpio = <&pioA PIN_PA27 GPIO_ACTIVE_HIGH>;
++ atmel,vbus-gpio = <&pioA PIN_PB11 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usba_vbus>;
+ status = "okay";
+@@ -125,8 +125,6 @@
+ bus-width = <8>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_sdmmc0_default>;
+- non-removable;
+- mmc-ddr-1_8v;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi b/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi
+index 30eee5942eff..945ee8f55e65 100644
+--- a/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi
++++ b/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi
+@@ -50,7 +50,7 @@
+
+ i2c_cm36651: i2c-gpio-2 {
+ compatible = "i2c-gpio";
+- gpios = <&gpf0 0 GPIO_ACTIVE_LOW>, <&gpf0 1 GPIO_ACTIVE_LOW>;
++ gpios = <&gpf0 0 GPIO_ACTIVE_HIGH>, <&gpf0 1 GPIO_ACTIVE_HIGH>;
+ i2c-gpio,delay-us = <2>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/s5pv210-aries.dtsi b/arch/arm/boot/dts/s5pv210-aries.dtsi
+index 575094ea7024..7b62c381d3c8 100644
+--- a/arch/arm/boot/dts/s5pv210-aries.dtsi
++++ b/arch/arm/boot/dts/s5pv210-aries.dtsi
+@@ -374,6 +374,7 @@
+ pinctrl-names = "default";
+ cap-sd-highspeed;
+ cap-mmc-highspeed;
++ keep-power-in-suspend;
+
+ mmc-pwrseq = <&wifi_pwrseq>;
+ non-removable;
+diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
+index d0d0227fc70d..c9128bb187f9 100644
+--- a/arch/arm/include/asm/kvm_host.h
++++ b/arch/arm/include/asm/kvm_host.h
+@@ -364,4 +364,6 @@ static inline void kvm_vcpu_put_sysregs(struct kvm_vcpu *vcpu) {}
+ struct kvm *kvm_arch_alloc_vm(void);
+ void kvm_arch_free_vm(struct kvm *kvm);
+
++#define kvm_arm_vcpu_loaded(vcpu) (false)
++
+ #endif /* __ARM_KVM_HOST_H__ */
+diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
+index 36718a424358..492ac74a63f4 100644
+--- a/arch/arm/kernel/ptrace.c
++++ b/arch/arm/kernel/ptrace.c
+@@ -229,8 +229,8 @@ static struct undef_hook arm_break_hook = {
+ };
+
+ static struct undef_hook thumb_break_hook = {
+- .instr_mask = 0xffff,
+- .instr_val = 0xde01,
++ .instr_mask = 0xffffffff,
++ .instr_val = 0x0000de01,
+ .cpsr_mask = PSR_T_BIT,
+ .cpsr_val = PSR_T_BIT,
+ .fn = break_trap,
+diff --git a/arch/arm/mach-tegra/tegra.c b/arch/arm/mach-tegra/tegra.c
+index f9587be48235..37a2aaeb44cc 100644
+--- a/arch/arm/mach-tegra/tegra.c
++++ b/arch/arm/mach-tegra/tegra.c
+@@ -112,8 +112,8 @@ static const char * const tegra_dt_board_compat[] = {
+ };
+
+ DT_MACHINE_START(TEGRA_DT, "NVIDIA Tegra SoC (Flattened Device Tree)")
+- .l2c_aux_val = 0x3c400001,
+- .l2c_aux_mask = 0xc20fc3fe,
++ .l2c_aux_val = 0x3c400000,
++ .l2c_aux_mask = 0xc20fc3ff,
+ .smp = smp_ops(tegra_smp_ops),
+ .map_io = tegra_map_common_io,
+ .init_early = tegra_init_early,
+diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
+index 5461d589a1e2..60ac7c5999a9 100644
+--- a/arch/arm/mm/proc-macros.S
++++ b/arch/arm/mm/proc-macros.S
+@@ -5,6 +5,7 @@
+ * VMA_VM_FLAGS
+ * VM_EXEC
+ */
++#include <linux/const.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
+
+@@ -30,7 +31,7 @@
+ * act_mm - get current->active_mm
+ */
+ .macro act_mm, rd
+- bic \rd, sp, #8128
++ bic \rd, sp, #(THREAD_SIZE - 1) & ~63
+ bic \rd, \rd, #63
+ ldr \rd, [\rd, #TI_TASK]
+ .if (TSK_ACTIVE_MM > IMM12_MASK)
+diff --git a/arch/arm64/include/asm/cacheflush.h b/arch/arm64/include/asm/cacheflush.h
+index 19844211a4e6..a449a1c602d3 100644
+--- a/arch/arm64/include/asm/cacheflush.h
++++ b/arch/arm64/include/asm/cacheflush.h
+@@ -90,7 +90,7 @@ static inline void flush_icache_range(unsigned long start, unsigned long end)
+ * IPI all online CPUs so that they undergo a context synchronization
+ * event and are forced to refetch the new instructions.
+ */
+-#ifdef CONFIG_KGDB
++
+ /*
+ * KGDB performs cache maintenance with interrupts disabled, so we
+ * will deadlock trying to IPI the secondary CPUs. In theory, we can
+@@ -100,9 +100,9 @@ static inline void flush_icache_range(unsigned long start, unsigned long end)
+ * the patching operation, so we don't need extra IPIs here anyway.
+ * In which case, add a KGDB-specific bodge and return early.
+ */
+- if (kgdb_connected && irqs_disabled())
++ if (in_dbg_master())
+ return;
+-#endif
++
+ kick_all_cpus_sync();
+ }
+
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index 367b2e0b6d76..e9afdfcb8403 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -335,8 +335,10 @@ void vcpu_write_sys_reg(struct kvm_vcpu *vcpu, u64 val, int reg);
+ * CP14 and CP15 live in the same array, as they are backed by the
+ * same system registers.
+ */
+-#define vcpu_cp14(v,r) ((v)->arch.ctxt.copro[(r)])
+-#define vcpu_cp15(v,r) ((v)->arch.ctxt.copro[(r)])
++#define CPx_BIAS IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)
++
++#define vcpu_cp14(v,r) ((v)->arch.ctxt.copro[(r) ^ CPx_BIAS])
++#define vcpu_cp15(v,r) ((v)->arch.ctxt.copro[(r) ^ CPx_BIAS])
+
+ struct kvm_vm_stat {
+ ulong remote_tlb_flush;
+@@ -535,4 +537,6 @@ void kvm_vcpu_put_sysregs(struct kvm_vcpu *vcpu);
+ struct kvm *kvm_arch_alloc_vm(void);
+ void kvm_arch_free_vm(struct kvm *kvm);
+
++#define kvm_arm_vcpu_loaded(vcpu) ((vcpu)->arch.sysregs_loaded_on_cpu)
++
+ #endif /* __ARM64_KVM_HOST_H__ */
+diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
+index 3e6229e30109..cd37edbdedcb 100644
+--- a/arch/arm64/kernel/insn.c
++++ b/arch/arm64/kernel/insn.c
+@@ -1490,16 +1490,10 @@ static u32 aarch64_encode_immediate(u64 imm,
+ u32 insn)
+ {
+ unsigned int immr, imms, n, ones, ror, esz, tmp;
+- u64 mask = ~0UL;
+-
+- /* Can't encode full zeroes or full ones */
+- if (!imm || !~imm)
+- return AARCH64_BREAK_FAULT;
++ u64 mask;
+
+ switch (variant) {
+ case AARCH64_INSN_VARIANT_32BIT:
+- if (upper_32_bits(imm))
+- return AARCH64_BREAK_FAULT;
+ esz = 32;
+ break;
+ case AARCH64_INSN_VARIANT_64BIT:
+@@ -1511,6 +1505,12 @@ static u32 aarch64_encode_immediate(u64 imm,
+ return AARCH64_BREAK_FAULT;
+ }
+
++ mask = GENMASK(esz - 1, 0);
++
++ /* Can't encode full zeroes, full ones, or value wider than the mask */
++ if (!imm || imm == mask || imm & ~mask)
++ return AARCH64_BREAK_FAULT;
++
+ /*
+ * Inverse of Replicate(). Try to spot a repeating pattern
+ * with a pow2 stride.
+diff --git a/arch/m68k/include/asm/mac_via.h b/arch/m68k/include/asm/mac_via.h
+index de1470c4d829..1149251ea58d 100644
+--- a/arch/m68k/include/asm/mac_via.h
++++ b/arch/m68k/include/asm/mac_via.h
+@@ -257,6 +257,7 @@ extern int rbv_present,via_alt_mapping;
+
+ struct irq_desc;
+
++extern void via_l2_flush(int writeback);
+ extern void via_register_interrupts(void);
+ extern void via_irq_enable(int);
+ extern void via_irq_disable(int);
+diff --git a/arch/m68k/mac/config.c b/arch/m68k/mac/config.c
+index cd9317d53276..a4f91bea6c88 100644
+--- a/arch/m68k/mac/config.c
++++ b/arch/m68k/mac/config.c
+@@ -61,7 +61,6 @@ extern void iop_preinit(void);
+ extern void iop_init(void);
+ extern void via_init(void);
+ extern void via_init_clock(irq_handler_t func);
+-extern void via_flush_cache(void);
+ extern void oss_init(void);
+ extern void psc_init(void);
+ extern void baboon_init(void);
+@@ -132,21 +131,6 @@ int __init mac_parse_bootinfo(const struct bi_record *record)
+ return unknown;
+ }
+
+-/*
+- * Flip into 24bit mode for an instant - flushes the L2 cache card. We
+- * have to disable interrupts for this. Our IRQ handlers will crap
+- * themselves if they take an IRQ in 24bit mode!
+- */
+-
+-static void mac_cache_card_flush(int writeback)
+-{
+- unsigned long flags;
+-
+- local_irq_save(flags);
+- via_flush_cache();
+- local_irq_restore(flags);
+-}
+-
+ void __init config_mac(void)
+ {
+ if (!MACH_IS_MAC)
+@@ -178,9 +162,8 @@ void __init config_mac(void)
+ * not.
+ */
+
+- if (macintosh_config->ident == MAC_MODEL_IICI
+- || macintosh_config->ident == MAC_MODEL_IIFX)
+- mach_l2_flush = mac_cache_card_flush;
++ if (macintosh_config->ident == MAC_MODEL_IICI)
++ mach_l2_flush = via_l2_flush;
+ }
+
+
+diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
+index 038d5a1c4d48..8307da441a10 100644
+--- a/arch/m68k/mac/via.c
++++ b/arch/m68k/mac/via.c
+@@ -289,10 +289,14 @@ void via_debug_dump(void)
+ * the system into 24-bit mode for an instant.
+ */
+
+-void via_flush_cache(void)
++void via_l2_flush(int writeback)
+ {
++ unsigned long flags;
++
++ local_irq_save(flags);
+ via2[gBufB] &= ~VIA2B_vMode32;
+ via2[gBufB] |= VIA2B_vMode32;
++ local_irq_restore(flags);
+ }
+
+ /*
+diff --git a/arch/mips/Makefile b/arch/mips/Makefile
+index ad0a92f95af1..63e2ad43bd6a 100644
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -290,12 +290,23 @@ ifdef CONFIG_64BIT
+ endif
+ endif
+
++# When linking a 32-bit executable the LLVM linker cannot cope with a
++# 32-bit load address that has been sign-extended to 64 bits. Simply
++# remove the upper 32 bits then, as it is safe to do so with other
++# linkers.
++ifdef CONFIG_64BIT
++ load-ld = $(load-y)
++else
++ load-ld = $(subst 0xffffffff,0x,$(load-y))
++endif
++
+ KBUILD_AFLAGS += $(cflags-y)
+ KBUILD_CFLAGS += $(cflags-y)
+-KBUILD_CPPFLAGS += -DVMLINUX_LOAD_ADDRESS=$(load-y)
++KBUILD_CPPFLAGS += -DVMLINUX_LOAD_ADDRESS=$(load-y) -DLINKER_LOAD_ADDRESS=$(load-ld)
+ KBUILD_CPPFLAGS += -DDATAOFFSET=$(if $(dataoffset-y),$(dataoffset-y),0)
+
+ bootvars-y = VMLINUX_LOAD_ADDRESS=$(load-y) \
++ LINKER_LOAD_ADDRESS=$(load-ld) \
+ VMLINUX_ENTRY_ADDRESS=$(entry-y) \
+ PLATFORM="$(platform-y)" \
+ ITS_INPUTS="$(its-y)"
+diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
+index d859f079b771..378cbfb31ee7 100644
+--- a/arch/mips/boot/compressed/Makefile
++++ b/arch/mips/boot/compressed/Makefile
+@@ -90,7 +90,7 @@ ifneq ($(zload-y),)
+ VMLINUZ_LOAD_ADDRESS := $(zload-y)
+ else
+ VMLINUZ_LOAD_ADDRESS = $(shell $(obj)/calc_vmlinuz_load_addr \
+- $(obj)/vmlinux.bin $(VMLINUX_LOAD_ADDRESS))
++ $(obj)/vmlinux.bin $(LINKER_LOAD_ADDRESS))
+ endif
+ UIMAGE_LOADADDR = $(VMLINUZ_LOAD_ADDRESS)
+
+diff --git a/arch/mips/configs/loongson3_defconfig b/arch/mips/configs/loongson3_defconfig
+index 324dfee23dfb..c871e40b8878 100644
+--- a/arch/mips/configs/loongson3_defconfig
++++ b/arch/mips/configs/loongson3_defconfig
+@@ -250,7 +250,7 @@ CONFIG_MEDIA_CAMERA_SUPPORT=y
+ CONFIG_MEDIA_USB_SUPPORT=y
+ CONFIG_USB_VIDEO_CLASS=m
+ CONFIG_DRM=y
+-CONFIG_DRM_RADEON=y
++CONFIG_DRM_RADEON=m
+ CONFIG_FB_RADEON=y
+ CONFIG_LCD_CLASS_DEVICE=y
+ CONFIG_LCD_PLATFORM=m
+diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
+index f567ace7a9e9..2b3fdfc9e0e7 100644
+--- a/arch/mips/include/asm/kvm_host.h
++++ b/arch/mips/include/asm/kvm_host.h
+@@ -274,8 +274,12 @@ enum emulation_result {
+ #define MIPS3_PG_SHIFT 6
+ #define MIPS3_PG_FRAME 0x3fffffc0
+
++#if defined(CONFIG_64BIT)
++#define VPN2_MASK GENMASK(cpu_vmbits - 1, 13)
++#else
+ #define VPN2_MASK 0xffffe000
+-#define KVM_ENTRYHI_ASID MIPS_ENTRYHI_ASID
++#endif
++#define KVM_ENTRYHI_ASID cpu_asid_mask(&boot_cpu_data)
+ #define TLB_IS_GLOBAL(x) ((x).tlb_lo[0] & (x).tlb_lo[1] & ENTRYLO_G)
+ #define TLB_VPN2(x) ((x).tlb_hi & VPN2_MASK)
+ #define TLB_ASID(x) ((x).tlb_hi & KVM_ENTRYHI_ASID)
+diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
+index 1bb9448777c5..f9a7c137be9f 100644
+--- a/arch/mips/include/asm/mipsregs.h
++++ b/arch/mips/include/asm/mipsregs.h
+@@ -749,7 +749,7 @@
+
+ /* MAAR bit definitions */
+ #define MIPS_MAAR_VH (_U64CAST_(1) << 63)
+-#define MIPS_MAAR_ADDR ((BIT_ULL(BITS_PER_LONG - 12) - 1) << 12)
++#define MIPS_MAAR_ADDR GENMASK_ULL(55, 12)
+ #define MIPS_MAAR_ADDR_SHIFT 12
+ #define MIPS_MAAR_S (_ULCAST_(1) << 1)
+ #define MIPS_MAAR_VL (_ULCAST_(1) << 0)
+diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
+index 6c257b52f57f..7fad007fe025 100644
+--- a/arch/mips/kernel/genex.S
++++ b/arch/mips/kernel/genex.S
+@@ -477,20 +477,20 @@ NESTED(nmi_handler, PT_SIZE, sp)
+ .endm
+
+ .macro __build_clear_fpe
++ CLI
++ TRACE_IRQS_OFF
+ .set push
+ /* gas fails to assemble cfc1 for some archs (octeon).*/ \
+ .set mips1
+ SET_HARDFLOAT
+ cfc1 a1, fcr31
+ .set pop
+- CLI
+- TRACE_IRQS_OFF
+ .endm
+
+ .macro __build_clear_msa_fpe
+- _cfcmsa a1, MSA_CSR
+ CLI
+ TRACE_IRQS_OFF
++ _cfcmsa a1, MSA_CSR
+ .endm
+
+ .macro __build_clear_ade
+diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
+index 7f3f136572de..50d3d74001cb 100644
+--- a/arch/mips/kernel/mips-cm.c
++++ b/arch/mips/kernel/mips-cm.c
+@@ -123,9 +123,9 @@ static char *cm2_causes[32] = {
+ "COH_RD_ERR", "MMIO_WR_ERR", "MMIO_RD_ERR", "0x07",
+ "0x08", "0x09", "0x0a", "0x0b",
+ "0x0c", "0x0d", "0x0e", "0x0f",
+- "0x10", "0x11", "0x12", "0x13",
+- "0x14", "0x15", "0x16", "INTVN_WR_ERR",
+- "INTVN_RD_ERR", "0x19", "0x1a", "0x1b",
++ "0x10", "INTVN_WR_ERR", "INTVN_RD_ERR", "0x13",
++ "0x14", "0x15", "0x16", "0x17",
++ "0x18", "0x19", "0x1a", "0x1b",
+ "0x1c", "0x1d", "0x1e", "0x1f"
+ };
+
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index e87c98b8a72c..2c2480be3f36 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -933,7 +933,17 @@ static void __init arch_mem_init(char **cmdline_p)
+ BOOTMEM_DEFAULT);
+ #endif
+ device_tree_init();
++
++ /*
++ * In order to reduce the possibility of kernel panic when failed to
++ * get IO TLB memory under CONFIG_SWIOTLB, it is better to allocate
++ * low memory as small as possible before plat_swiotlb_setup(), so
++ * make sparse_init() using top-down allocation.
++ */
++ memblock_set_bottom_up(false);
+ sparse_init();
++ memblock_set_bottom_up(true);
++
+ plat_swiotlb_setup();
+
+ dma_contiguous_reserve(PFN_PHYS(max_low_pfn));
+diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
+index bfe02ded25d1..1e631a484ddf 100644
+--- a/arch/mips/kernel/time.c
++++ b/arch/mips/kernel/time.c
+@@ -22,12 +22,82 @@
+ #include <linux/smp.h>
+ #include <linux/spinlock.h>
+ #include <linux/export.h>
++#include <linux/cpufreq.h>
++#include <linux/delay.h>
+
+ #include <asm/cpu-features.h>
+ #include <asm/cpu-type.h>
+ #include <asm/div64.h>
+ #include <asm/time.h>
+
++#ifdef CONFIG_CPU_FREQ
++
++static DEFINE_PER_CPU(unsigned long, pcp_lpj_ref);
++static DEFINE_PER_CPU(unsigned long, pcp_lpj_ref_freq);
++static unsigned long glb_lpj_ref;
++static unsigned long glb_lpj_ref_freq;
++
++static int cpufreq_callback(struct notifier_block *nb,
++ unsigned long val, void *data)
++{
++ struct cpufreq_freqs *freq = data;
++ struct cpumask *cpus = freq->policy->cpus;
++ unsigned long lpj;
++ int cpu;
++
++ /*
++ * Skip lpj numbers adjustment if the CPU-freq transition is safe for
++ * the loops delay. (Is this possible?)
++ */
++ if (freq->flags & CPUFREQ_CONST_LOOPS)
++ return NOTIFY_OK;
++
++ /* Save the initial values of the lpjes for future scaling. */
++ if (!glb_lpj_ref) {
++ glb_lpj_ref = boot_cpu_data.udelay_val;
++ glb_lpj_ref_freq = freq->old;
++
++ for_each_online_cpu(cpu) {
++ per_cpu(pcp_lpj_ref, cpu) =
++ cpu_data[cpu].udelay_val;
++ per_cpu(pcp_lpj_ref_freq, cpu) = freq->old;
++ }
++ }
++
++ /*
++ * Adjust global lpj variable and per-CPU udelay_val number in
++ * accordance with the new CPU frequency.
++ */
++ if ((val == CPUFREQ_PRECHANGE && freq->old < freq->new) ||
++ (val == CPUFREQ_POSTCHANGE && freq->old > freq->new)) {
++ loops_per_jiffy = cpufreq_scale(glb_lpj_ref,
++ glb_lpj_ref_freq,
++ freq->new);
++
++ for_each_cpu(cpu, cpus) {
++ lpj = cpufreq_scale(per_cpu(pcp_lpj_ref, cpu),
++ per_cpu(pcp_lpj_ref_freq, cpu),
++ freq->new);
++ cpu_data[cpu].udelay_val = (unsigned int)lpj;
++ }
++ }
++
++ return NOTIFY_OK;
++}
++
++static struct notifier_block cpufreq_notifier = {
++ .notifier_call = cpufreq_callback,
++};
++
++static int __init register_cpufreq_notifier(void)
++{
++ return cpufreq_register_notifier(&cpufreq_notifier,
++ CPUFREQ_TRANSITION_NOTIFIER);
++}
++core_initcall(register_cpufreq_notifier);
++
++#endif /* CONFIG_CPU_FREQ */
++
+ /*
+ * forward reference
+ */
+diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
+index 36f2e860ba3e..be63fff95b2a 100644
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -50,7 +50,7 @@ SECTIONS
+ /* . = 0xa800000000300000; */
+ . = 0xffffffff80300000;
+ #endif
+- . = VMLINUX_LOAD_ADDRESS;
++ . = LINKER_LOAD_ADDRESS;
+ /* read-only */
+ _text = .; /* Text and read-only data */
+ .text : {
+diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h
+index bbf5c79cce7a..8b204cd1f531 100644
+--- a/arch/openrisc/include/asm/uaccess.h
++++ b/arch/openrisc/include/asm/uaccess.h
+@@ -58,8 +58,12 @@
+ /* Ensure that addr is below task's addr_limit */
+ #define __addr_ok(addr) ((unsigned long) addr < get_fs())
+
+-#define access_ok(type, addr, size) \
+- __range_ok((unsigned long)addr, (unsigned long)size)
++#define access_ok(type, addr, size) \
++({ \
++ unsigned long __ao_addr = (unsigned long)(addr); \
++ unsigned long __ao_size = (unsigned long)(size); \
++ __range_ok(__ao_addr, __ao_size); \
++})
+
+ /*
+ * These are the main single-value transfer routines. They automatically
+diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
+index a4b31e17492d..5195a4fc3e41 100644
+--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
+@@ -346,6 +346,14 @@ static int __init feat_enable_dscr(struct dt_cpu_feature *f)
+ {
+ u64 lpcr;
+
++ /*
++ * Linux relies on FSCR[DSCR] being clear, so that we can take the
++ * facility unavailable interrupt and track the task's usage of DSCR.
++ * See facility_unavailable_exception().
++ * Clear the bit here so that feat_enable() doesn't set it.
++ */
++ f->fscr_bit_nr = -1;
++
+ feat_enable(f);
+
+ lpcr = mfspr(SPRN_LPCR);
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index 8e88f78e57db..fd04692412db 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -685,6 +685,23 @@ static void __init tm_init(void)
+ static void tm_init(void) { }
+ #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
+
++#ifdef CONFIG_PPC64
++static void __init save_fscr_to_task(void)
++{
++ /*
++ * Ensure the init_task (pid 0, aka swapper) uses the value of FSCR we
++ * have configured via the device tree features or via __init_FSCR().
++ * That value will then be propagated to pid 1 (init) and all future
++ * processes.
++ */
++ if (early_cpu_has_feature(CPU_FTR_ARCH_207S))
++ init_task.thread.fscr = mfspr(SPRN_FSCR);
++}
++#else
++static inline void save_fscr_to_task(void) {};
++#endif
++
++
+ void __init early_init_devtree(void *params)
+ {
+ phys_addr_t limit;
+@@ -770,6 +787,8 @@ void __init early_init_devtree(void *params)
+ BUG();
+ }
+
++ save_fscr_to_task();
++
+ #if defined(CONFIG_SMP) && defined(CONFIG_PPC64)
+ /* We'll later wait for secondaries to check in; there are
+ * NCPUS-1 non-boot CPUs :-)
+diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
+index 43e7b93f27c7..d16adcd93921 100644
+--- a/arch/powerpc/platforms/cell/spufs/file.c
++++ b/arch/powerpc/platforms/cell/spufs/file.c
+@@ -1991,8 +1991,9 @@ static ssize_t __spufs_mbox_info_read(struct spu_context *ctx,
+ static ssize_t spufs_mbox_info_read(struct file *file, char __user *buf,
+ size_t len, loff_t *pos)
+ {
+- int ret;
+ struct spu_context *ctx = file->private_data;
++ u32 stat, data;
++ int ret;
+
+ if (!access_ok(VERIFY_WRITE, buf, len))
+ return -EFAULT;
+@@ -2001,11 +2002,16 @@ static ssize_t spufs_mbox_info_read(struct file *file, char __user *buf,
+ if (ret)
+ return ret;
+ spin_lock(&ctx->csa.register_lock);
+- ret = __spufs_mbox_info_read(ctx, buf, len, pos);
++ stat = ctx->csa.prob.mb_stat_R;
++ data = ctx->csa.prob.pu_mb_R;
+ spin_unlock(&ctx->csa.register_lock);
+ spu_release_saved(ctx);
+
+- return ret;
++ /* EOF if there's no entry in the mbox */
++ if (!(stat & 0x0000ff))
++ return 0;
++
++ return simple_read_from_buffer(buf, len, pos, &data, sizeof(data));
+ }
+
+ static const struct file_operations spufs_mbox_info_fops = {
+@@ -2032,6 +2038,7 @@ static ssize_t spufs_ibox_info_read(struct file *file, char __user *buf,
+ size_t len, loff_t *pos)
+ {
+ struct spu_context *ctx = file->private_data;
++ u32 stat, data;
+ int ret;
+
+ if (!access_ok(VERIFY_WRITE, buf, len))
+@@ -2041,11 +2048,16 @@ static ssize_t spufs_ibox_info_read(struct file *file, char __user *buf,
+ if (ret)
+ return ret;
+ spin_lock(&ctx->csa.register_lock);
+- ret = __spufs_ibox_info_read(ctx, buf, len, pos);
++ stat = ctx->csa.prob.mb_stat_R;
++ data = ctx->csa.priv2.puint_mb_R;
+ spin_unlock(&ctx->csa.register_lock);
+ spu_release_saved(ctx);
+
+- return ret;
++ /* EOF if there's no entry in the ibox */
++ if (!(stat & 0xff0000))
++ return 0;
++
++ return simple_read_from_buffer(buf, len, pos, &data, sizeof(data));
+ }
+
+ static const struct file_operations spufs_ibox_info_fops = {
+@@ -2054,6 +2066,11 @@ static const struct file_operations spufs_ibox_info_fops = {
+ .llseek = generic_file_llseek,
+ };
+
++static size_t spufs_wbox_info_cnt(struct spu_context *ctx)
++{
++ return (4 - ((ctx->csa.prob.mb_stat_R & 0x00ff00) >> 8)) * sizeof(u32);
++}
++
+ static ssize_t __spufs_wbox_info_read(struct spu_context *ctx,
+ char __user *buf, size_t len, loff_t *pos)
+ {
+@@ -2062,7 +2079,7 @@ static ssize_t __spufs_wbox_info_read(struct spu_context *ctx,
+ u32 wbox_stat;
+
+ wbox_stat = ctx->csa.prob.mb_stat_R;
+- cnt = 4 - ((wbox_stat & 0x00ff00) >> 8);
++ cnt = spufs_wbox_info_cnt(ctx);
+ for (i = 0; i < cnt; i++) {
+ data[i] = ctx->csa.spu_mailbox_data[i];
+ }
+@@ -2075,7 +2092,8 @@ static ssize_t spufs_wbox_info_read(struct file *file, char __user *buf,
+ size_t len, loff_t *pos)
+ {
+ struct spu_context *ctx = file->private_data;
+- int ret;
++ u32 data[ARRAY_SIZE(ctx->csa.spu_mailbox_data)];
++ int ret, count;
+
+ if (!access_ok(VERIFY_WRITE, buf, len))
+ return -EFAULT;
+@@ -2084,11 +2102,13 @@ static ssize_t spufs_wbox_info_read(struct file *file, char __user *buf,
+ if (ret)
+ return ret;
+ spin_lock(&ctx->csa.register_lock);
+- ret = __spufs_wbox_info_read(ctx, buf, len, pos);
++ count = spufs_wbox_info_cnt(ctx);
++ memcpy(&data, &ctx->csa.spu_mailbox_data, sizeof(data));
+ spin_unlock(&ctx->csa.register_lock);
+ spu_release_saved(ctx);
+
+- return ret;
++ return simple_read_from_buffer(buf, len, pos, &data,
++ count * sizeof(u32));
+ }
+
+ static const struct file_operations spufs_wbox_info_fops = {
+@@ -2097,27 +2117,33 @@ static const struct file_operations spufs_wbox_info_fops = {
+ .llseek = generic_file_llseek,
+ };
+
+-static ssize_t __spufs_dma_info_read(struct spu_context *ctx,
+- char __user *buf, size_t len, loff_t *pos)
++static void spufs_get_dma_info(struct spu_context *ctx,
++ struct spu_dma_info *info)
+ {
+- struct spu_dma_info info;
+- struct mfc_cq_sr *qp, *spuqp;
+ int i;
+
+- info.dma_info_type = ctx->csa.priv2.spu_tag_status_query_RW;
+- info.dma_info_mask = ctx->csa.lscsa->tag_mask.slot[0];
+- info.dma_info_status = ctx->csa.spu_chnldata_RW[24];
+- info.dma_info_stall_and_notify = ctx->csa.spu_chnldata_RW[25];
+- info.dma_info_atomic_command_status = ctx->csa.spu_chnldata_RW[27];
++ info->dma_info_type = ctx->csa.priv2.spu_tag_status_query_RW;
++ info->dma_info_mask = ctx->csa.lscsa->tag_mask.slot[0];
++ info->dma_info_status = ctx->csa.spu_chnldata_RW[24];
++ info->dma_info_stall_and_notify = ctx->csa.spu_chnldata_RW[25];
++ info->dma_info_atomic_command_status = ctx->csa.spu_chnldata_RW[27];
+ for (i = 0; i < 16; i++) {
+- qp = &info.dma_info_command_data[i];
+- spuqp = &ctx->csa.priv2.spuq[i];
++ struct mfc_cq_sr *qp = &info->dma_info_command_data[i];
++ struct mfc_cq_sr *spuqp = &ctx->csa.priv2.spuq[i];
+
+ qp->mfc_cq_data0_RW = spuqp->mfc_cq_data0_RW;
+ qp->mfc_cq_data1_RW = spuqp->mfc_cq_data1_RW;
+ qp->mfc_cq_data2_RW = spuqp->mfc_cq_data2_RW;
+ qp->mfc_cq_data3_RW = spuqp->mfc_cq_data3_RW;
+ }
++}
++
++static ssize_t __spufs_dma_info_read(struct spu_context *ctx,
++ char __user *buf, size_t len, loff_t *pos)
++{
++ struct spu_dma_info info;
++
++ spufs_get_dma_info(ctx, &info);
+
+ return simple_read_from_buffer(buf, len, pos, &info,
+ sizeof info);
+@@ -2127,6 +2153,7 @@ static ssize_t spufs_dma_info_read(struct file *file, char __user *buf,
+ size_t len, loff_t *pos)
+ {
+ struct spu_context *ctx = file->private_data;
++ struct spu_dma_info info;
+ int ret;
+
+ if (!access_ok(VERIFY_WRITE, buf, len))
+@@ -2136,11 +2163,12 @@ static ssize_t spufs_dma_info_read(struct file *file, char __user *buf,
+ if (ret)
+ return ret;
+ spin_lock(&ctx->csa.register_lock);
+- ret = __spufs_dma_info_read(ctx, buf, len, pos);
++ spufs_get_dma_info(ctx, &info);
+ spin_unlock(&ctx->csa.register_lock);
+ spu_release_saved(ctx);
+
+- return ret;
++ return simple_read_from_buffer(buf, len, pos, &info,
++ sizeof(info));
+ }
+
+ static const struct file_operations spufs_dma_info_fops = {
+@@ -2149,13 +2177,31 @@ static const struct file_operations spufs_dma_info_fops = {
+ .llseek = no_llseek,
+ };
+
++static void spufs_get_proxydma_info(struct spu_context *ctx,
++ struct spu_proxydma_info *info)
++{
++ int i;
++
++ info->proxydma_info_type = ctx->csa.prob.dma_querytype_RW;
++ info->proxydma_info_mask = ctx->csa.prob.dma_querymask_RW;
++ info->proxydma_info_status = ctx->csa.prob.dma_tagstatus_R;
++
++ for (i = 0; i < 8; i++) {
++ struct mfc_cq_sr *qp = &info->proxydma_info_command_data[i];
++ struct mfc_cq_sr *puqp = &ctx->csa.priv2.puq[i];
++
++ qp->mfc_cq_data0_RW = puqp->mfc_cq_data0_RW;
++ qp->mfc_cq_data1_RW = puqp->mfc_cq_data1_RW;
++ qp->mfc_cq_data2_RW = puqp->mfc_cq_data2_RW;
++ qp->mfc_cq_data3_RW = puqp->mfc_cq_data3_RW;
++ }
++}
++
+ static ssize_t __spufs_proxydma_info_read(struct spu_context *ctx,
+ char __user *buf, size_t len, loff_t *pos)
+ {
+ struct spu_proxydma_info info;
+- struct mfc_cq_sr *qp, *puqp;
+ int ret = sizeof info;
+- int i;
+
+ if (len < ret)
+ return -EINVAL;
+@@ -2163,18 +2209,7 @@ static ssize_t __spufs_proxydma_info_read(struct spu_context *ctx,
+ if (!access_ok(VERIFY_WRITE, buf, len))
+ return -EFAULT;
+
+- info.proxydma_info_type = ctx->csa.prob.dma_querytype_RW;
+- info.proxydma_info_mask = ctx->csa.prob.dma_querymask_RW;
+- info.proxydma_info_status = ctx->csa.prob.dma_tagstatus_R;
+- for (i = 0; i < 8; i++) {
+- qp = &info.proxydma_info_command_data[i];
+- puqp = &ctx->csa.priv2.puq[i];
+-
+- qp->mfc_cq_data0_RW = puqp->mfc_cq_data0_RW;
+- qp->mfc_cq_data1_RW = puqp->mfc_cq_data1_RW;
+- qp->mfc_cq_data2_RW = puqp->mfc_cq_data2_RW;
+- qp->mfc_cq_data3_RW = puqp->mfc_cq_data3_RW;
+- }
++ spufs_get_proxydma_info(ctx, &info);
+
+ return simple_read_from_buffer(buf, len, pos, &info,
+ sizeof info);
+@@ -2184,17 +2219,19 @@ static ssize_t spufs_proxydma_info_read(struct file *file, char __user *buf,
+ size_t len, loff_t *pos)
+ {
+ struct spu_context *ctx = file->private_data;
++ struct spu_proxydma_info info;
+ int ret;
+
+ ret = spu_acquire_saved(ctx);
+ if (ret)
+ return ret;
+ spin_lock(&ctx->csa.register_lock);
+- ret = __spufs_proxydma_info_read(ctx, buf, len, pos);
++ spufs_get_proxydma_info(ctx, &info);
+ spin_unlock(&ctx->csa.register_lock);
+ spu_release_saved(ctx);
+
+- return ret;
++ return simple_read_from_buffer(buf, len, pos, &info,
++ sizeof(info));
+ }
+
+ static const struct file_operations spufs_proxydma_info_fops = {
+diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
+index 3d3c989e44dd..8d49ba370c50 100644
+--- a/arch/powerpc/platforms/powernv/smp.c
++++ b/arch/powerpc/platforms/powernv/smp.c
+@@ -171,7 +171,6 @@ static void pnv_smp_cpu_kill_self(void)
+ /* Standard hot unplug procedure */
+
+ idle_task_exit();
+- current->active_mm = NULL; /* for sanity */
+ cpu = smp_processor_id();
+ DBG("CPU%d offline\n", cpu);
+ generic_set_cpu_dead(cpu);
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index 1c31a08cdd54..2aa9f3de223c 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -23,6 +23,7 @@
+ #include <linux/slab.h>
+ #include <linux/spinlock.h>
+ #include <linux/msi.h>
++#include <linux/vmalloc.h>
+
+ #include <asm/prom.h>
+ #include <asm/io.h>
+@@ -933,12 +934,16 @@ EXPORT_SYMBOL_GPL(is_xive_irq);
+ void xive_cleanup_irq_data(struct xive_irq_data *xd)
+ {
+ if (xd->eoi_mmio) {
++ unmap_kernel_range((unsigned long)xd->eoi_mmio,
++ 1u << xd->esb_shift);
+ iounmap(xd->eoi_mmio);
+ if (xd->eoi_mmio == xd->trig_mmio)
+ xd->trig_mmio = NULL;
+ xd->eoi_mmio = NULL;
+ }
+ if (xd->trig_mmio) {
++ unmap_kernel_range((unsigned long)xd->trig_mmio,
++ 1u << xd->esb_shift);
+ iounmap(xd->trig_mmio);
+ xd->trig_mmio = NULL;
+ }
+diff --git a/arch/sh/include/asm/uaccess.h b/arch/sh/include/asm/uaccess.h
+index 32eb56e00c11..6e7816360a75 100644
+--- a/arch/sh/include/asm/uaccess.h
++++ b/arch/sh/include/asm/uaccess.h
+@@ -16,8 +16,11 @@
+ * sum := addr + size; carry? --> flag = true;
+ * if (sum >= addr_limit) flag = true;
+ */
+-#define __access_ok(addr, size) \
+- (__addr_ok((addr) + (size)))
++#define __access_ok(addr, size) ({ \
++ unsigned long __ao_a = (addr), __ao_b = (size); \
++ unsigned long __ao_end = __ao_a + __ao_b - !!__ao_b; \
++ __ao_end >= __ao_a && __addr_ok(__ao_end); })
++
+ #define access_ok(type, addr, size) \
+ (__chk_user_ptr(addr), \
+ __access_ok((unsigned long __force)(addr), (size)))
+diff --git a/arch/sparc/kernel/ptrace_32.c b/arch/sparc/kernel/ptrace_32.c
+index 16b50afe7b52..60f7205ebe40 100644
+--- a/arch/sparc/kernel/ptrace_32.c
++++ b/arch/sparc/kernel/ptrace_32.c
+@@ -46,82 +46,79 @@ enum sparc_regset {
+ REGSET_FP,
+ };
+
++static int regwindow32_get(struct task_struct *target,
++ const struct pt_regs *regs,
++ u32 *uregs)
++{
++ unsigned long reg_window = regs->u_regs[UREG_I6];
++ int size = 16 * sizeof(u32);
++
++ if (target == current) {
++ if (copy_from_user(uregs, (void __user *)reg_window, size))
++ return -EFAULT;
++ } else {
++ if (access_process_vm(target, reg_window, uregs, size,
++ FOLL_FORCE) != size)
++ return -EFAULT;
++ }
++ return 0;
++}
++
++static int regwindow32_set(struct task_struct *target,
++ const struct pt_regs *regs,
++ u32 *uregs)
++{
++ unsigned long reg_window = regs->u_regs[UREG_I6];
++ int size = 16 * sizeof(u32);
++
++ if (target == current) {
++ if (copy_to_user((void __user *)reg_window, uregs, size))
++ return -EFAULT;
++ } else {
++ if (access_process_vm(target, reg_window, uregs, size,
++ FOLL_FORCE | FOLL_WRITE) != size)
++ return -EFAULT;
++ }
++ return 0;
++}
++
+ static int genregs32_get(struct task_struct *target,
+ const struct user_regset *regset,
+ unsigned int pos, unsigned int count,
+ void *kbuf, void __user *ubuf)
+ {
+ const struct pt_regs *regs = target->thread.kregs;
+- unsigned long __user *reg_window;
+- unsigned long *k = kbuf;
+- unsigned long __user *u = ubuf;
+- unsigned long reg;
++ u32 uregs[16];
++ int ret;
+
+ if (target == current)
+ flush_user_windows();
+
+- pos /= sizeof(reg);
+- count /= sizeof(reg);
+-
+- if (kbuf) {
+- for (; count > 0 && pos < 16; count--)
+- *k++ = regs->u_regs[pos++];
+-
+- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6];
+- reg_window -= 16;
+- for (; count > 0 && pos < 32; count--) {
+- if (get_user(*k++, ®_window[pos++]))
+- return -EFAULT;
+- }
+- } else {
+- for (; count > 0 && pos < 16; count--) {
+- if (put_user(regs->u_regs[pos++], u++))
+- return -EFAULT;
+- }
+-
+- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6];
+- reg_window -= 16;
+- for (; count > 0 && pos < 32; count--) {
+- if (get_user(reg, ®_window[pos++]) ||
+- put_user(reg, u++))
+- return -EFAULT;
+- }
+- }
+- while (count > 0) {
+- switch (pos) {
+- case 32: /* PSR */
+- reg = regs->psr;
+- break;
+- case 33: /* PC */
+- reg = regs->pc;
+- break;
+- case 34: /* NPC */
+- reg = regs->npc;
+- break;
+- case 35: /* Y */
+- reg = regs->y;
+- break;
+- case 36: /* WIM */
+- case 37: /* TBR */
+- reg = 0;
+- break;
+- default:
+- goto finish;
+- }
++ ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
++ regs->u_regs,
++ 0, 16 * sizeof(u32));
++ if (ret || !count)
++ return ret;
+
+- if (kbuf)
+- *k++ = reg;
+- else if (put_user(reg, u++))
++ if (pos < 32 * sizeof(u32)) {
++ if (regwindow32_get(target, regs, uregs))
+ return -EFAULT;
+- pos++;
+- count--;
++ ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
++ uregs,
++ 16 * sizeof(u32), 32 * sizeof(u32));
++ if (ret || !count)
++ return ret;
+ }
+-finish:
+- pos *= sizeof(reg);
+- count *= sizeof(reg);
+
+- return user_regset_copyout_zero(&pos, &count, &kbuf, &ubuf,
+- 38 * sizeof(reg), -1);
++ uregs[0] = regs->psr;
++ uregs[1] = regs->pc;
++ uregs[2] = regs->npc;
++ uregs[3] = regs->y;
++ uregs[4] = 0; /* WIM */
++ uregs[5] = 0; /* TBR */
++ return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
++ uregs,
++ 32 * sizeof(u32), 38 * sizeof(u32));
+ }
+
+ static int genregs32_set(struct task_struct *target,
+@@ -130,82 +127,53 @@ static int genregs32_set(struct task_struct *target,
+ const void *kbuf, const void __user *ubuf)
+ {
+ struct pt_regs *regs = target->thread.kregs;
+- unsigned long __user *reg_window;
+- const unsigned long *k = kbuf;
+- const unsigned long __user *u = ubuf;
+- unsigned long reg;
++ u32 uregs[16];
++ u32 psr;
++ int ret;
+
+ if (target == current)
+ flush_user_windows();
+
+- pos /= sizeof(reg);
+- count /= sizeof(reg);
+-
+- if (kbuf) {
+- for (; count > 0 && pos < 16; count--)
+- regs->u_regs[pos++] = *k++;
+-
+- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6];
+- reg_window -= 16;
+- for (; count > 0 && pos < 32; count--) {
+- if (put_user(*k++, ®_window[pos++]))
+- return -EFAULT;
+- }
+- } else {
+- for (; count > 0 && pos < 16; count--) {
+- if (get_user(reg, u++))
+- return -EFAULT;
+- regs->u_regs[pos++] = reg;
+- }
+-
+- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6];
+- reg_window -= 16;
+- for (; count > 0 && pos < 32; count--) {
+- if (get_user(reg, u++) ||
+- put_user(reg, ®_window[pos++]))
+- return -EFAULT;
+- }
+- }
+- while (count > 0) {
+- unsigned long psr;
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ regs->u_regs,
++ 0, 16 * sizeof(u32));
++ if (ret || !count)
++ return ret;
+
+- if (kbuf)
+- reg = *k++;
+- else if (get_user(reg, u++))
++ if (pos < 32 * sizeof(u32)) {
++ if (regwindow32_get(target, regs, uregs))
+ return -EFAULT;
+-
+- switch (pos) {
+- case 32: /* PSR */
+- psr = regs->psr;
+- psr &= ~(PSR_ICC | PSR_SYSCALL);
+- psr |= (reg & (PSR_ICC | PSR_SYSCALL));
+- regs->psr = psr;
+- break;
+- case 33: /* PC */
+- regs->pc = reg;
+- break;
+- case 34: /* NPC */
+- regs->npc = reg;
+- break;
+- case 35: /* Y */
+- regs->y = reg;
+- break;
+- case 36: /* WIM */
+- case 37: /* TBR */
+- break;
+- default:
+- goto finish;
+- }
+-
+- pos++;
+- count--;
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ uregs,
++ 16 * sizeof(u32), 32 * sizeof(u32));
++ if (ret)
++ return ret;
++ if (regwindow32_set(target, regs, uregs))
++ return -EFAULT;
++ if (!count)
++ return 0;
+ }
+-finish:
+- pos *= sizeof(reg);
+- count *= sizeof(reg);
+-
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ &psr,
++ 32 * sizeof(u32), 33 * sizeof(u32));
++ if (ret)
++ return ret;
++ regs->psr = (regs->psr & ~(PSR_ICC | PSR_SYSCALL)) |
++ (psr & (PSR_ICC | PSR_SYSCALL));
++ if (!count)
++ return 0;
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ ®s->pc,
++ 33 * sizeof(u32), 34 * sizeof(u32));
++ if (ret || !count)
++ return ret;
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ ®s->y,
++ 34 * sizeof(u32), 35 * sizeof(u32));
++ if (ret || !count)
++ return ret;
+ return user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
+- 38 * sizeof(reg), -1);
++ 35 * sizeof(u32), 38 * sizeof(u32));
+ }
+
+ static int fpregs32_get(struct task_struct *target,
+diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
+index e1d965e90e16..0c478c85e380 100644
+--- a/arch/sparc/kernel/ptrace_64.c
++++ b/arch/sparc/kernel/ptrace_64.c
+@@ -571,19 +571,13 @@ static int genregs32_get(struct task_struct *target,
+ for (; count > 0 && pos < 32; count--) {
+ if (access_process_vm(target,
+ (unsigned long)
+- ®_window[pos],
++ ®_window[pos++],
+ ®, sizeof(reg),
+ FOLL_FORCE)
+ != sizeof(reg))
+ return -EFAULT;
+- if (access_process_vm(target,
+- (unsigned long) u,
+- ®, sizeof(reg),
+- FOLL_FORCE | FOLL_WRITE)
+- != sizeof(reg))
++ if (put_user(reg, u++))
+ return -EFAULT;
+- pos++;
+- u++;
+ }
+ }
+ }
+@@ -683,12 +677,7 @@ static int genregs32_set(struct task_struct *target,
+ }
+ } else {
+ for (; count > 0 && pos < 32; count--) {
+- if (access_process_vm(target,
+- (unsigned long)
+- u,
+- ®, sizeof(reg),
+- FOLL_FORCE)
+- != sizeof(reg))
++ if (get_user(reg, u++))
+ return -EFAULT;
+ if (access_process_vm(target,
+ (unsigned long)
+diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
+index 01d628ea3402..c6c4b877f3d2 100644
+--- a/arch/x86/boot/compressed/head_32.S
++++ b/arch/x86/boot/compressed/head_32.S
+@@ -49,16 +49,17 @@
+ * Position Independent Executable (PIE) so that linker won't optimize
+ * R_386_GOT32X relocation to its fixed symbol address. Older
+ * linkers generate R_386_32 relocations against locally defined symbols,
+- * _bss, _ebss, _got and _egot, in PIE. It isn't wrong, just less
++ * _bss, _ebss, _got, _egot and _end, in PIE. It isn't wrong, just less
+ * optimal than R_386_RELATIVE. But the x86 kernel fails to properly handle
+ * R_386_32 relocations when relocating the kernel. To generate
+- * R_386_RELATIVE relocations, we mark _bss, _ebss, _got and _egot as
++ * R_386_RELATIVE relocations, we mark _bss, _ebss, _got, _egot and _end as
+ * hidden:
+ */
+ .hidden _bss
+ .hidden _ebss
+ .hidden _got
+ .hidden _egot
++ .hidden _end
+
+ __HEAD
+ ENTRY(startup_32)
+diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
+index 9fa644c62839..474733f8b330 100644
+--- a/arch/x86/boot/compressed/head_64.S
++++ b/arch/x86/boot/compressed/head_64.S
+@@ -42,6 +42,7 @@
+ .hidden _ebss
+ .hidden _got
+ .hidden _egot
++ .hidden _end
+
+ __HEAD
+ .code32
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 9f03ac233566..f7f9604b10cc 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -291,6 +291,7 @@
+ #define X86_FEATURE_AMD_IBPB (13*32+12) /* "" Indirect Branch Prediction Barrier */
+ #define X86_FEATURE_AMD_IBRS (13*32+14) /* "" Indirect Branch Restricted Speculation */
+ #define X86_FEATURE_AMD_STIBP (13*32+15) /* "" Single Thread Indirect Branch Predictors */
++#define X86_FEATURE_AMD_STIBP_ALWAYS_ON (13*32+17) /* "" Single Thread Indirect Branch Predictors always-on preferred */
+ #define X86_FEATURE_AMD_SSBD (13*32+24) /* "" Speculative Store Bypass Disable */
+ #define X86_FEATURE_VIRT_SSBD (13*32+25) /* Virtualized Speculative Store Bypass Disable */
+ #define X86_FEATURE_AMD_SSB_NO (13*32+26) /* "" Speculative Store Bypass is fixed in hardware. */
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 09c7466c4880..e3f70c60e8cc 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -232,6 +232,7 @@ enum spectre_v2_mitigation {
+ enum spectre_v2_user_mitigation {
+ SPECTRE_V2_USER_NONE,
+ SPECTRE_V2_USER_STRICT,
++ SPECTRE_V2_USER_STRICT_PREFERRED,
+ SPECTRE_V2_USER_PRCTL,
+ SPECTRE_V2_USER_SECCOMP,
+ };
+diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h
+index 07a25753e85c..bc97b8c0fdf7 100644
+--- a/arch/x86/include/asm/set_memory.h
++++ b/arch/x86/include/asm/set_memory.h
+@@ -90,28 +90,35 @@ void set_kernel_text_rw(void);
+ void set_kernel_text_ro(void);
+
+ #ifdef CONFIG_X86_64
+-static inline int set_mce_nospec(unsigned long pfn)
++/*
++ * Prevent speculative access to the page by either unmapping
++ * it (if we do not require access to any part of the page) or
++ * marking it uncacheable (if we want to try to retrieve data
++ * from non-poisoned lines in the page).
++ */
++static inline int set_mce_nospec(unsigned long pfn, bool unmap)
+ {
+ unsigned long decoy_addr;
+ int rc;
+
+ /*
+- * Mark the linear address as UC to make sure we don't log more
+- * errors because of speculative access to the page.
+ * We would like to just call:
+- * set_memory_uc((unsigned long)pfn_to_kaddr(pfn), 1);
++ * set_memory_XX((unsigned long)pfn_to_kaddr(pfn), 1);
+ * but doing that would radically increase the odds of a
+ * speculative access to the poison page because we'd have
+ * the virtual address of the kernel 1:1 mapping sitting
+ * around in registers.
+ * Instead we get tricky. We create a non-canonical address
+ * that looks just like the one we want, but has bit 63 flipped.
+- * This relies on set_memory_uc() properly sanitizing any __pa()
++ * This relies on set_memory_XX() properly sanitizing any __pa()
+ * results with __PHYSICAL_MASK or PTE_PFN_MASK.
+ */
+ decoy_addr = (pfn << PAGE_SHIFT) + (PAGE_OFFSET ^ BIT(63));
+
+- rc = set_memory_uc(decoy_addr, 1);
++ if (unmap)
++ rc = set_memory_np(decoy_addr, 1);
++ else
++ rc = set_memory_uc(decoy_addr, 1);
+ if (rc)
+ pr_warn("Could not invalidate pfn=0x%lx from 1:1 map\n", pfn);
+ return rc;
+diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
+index 971830341061..82b0ff6cac97 100644
+--- a/arch/x86/include/asm/uaccess.h
++++ b/arch/x86/include/asm/uaccess.h
+@@ -711,7 +711,17 @@ extern struct movsl_mask {
+ * checking before using them, but you have to surround them with the
+ * user_access_begin/end() pair.
+ */
+-#define user_access_begin() __uaccess_begin()
++static __must_check inline bool user_access_begin(int type,
++ const void __user *ptr,
++ size_t len)
++{
++ if (unlikely(!access_ok(type, ptr, len)))
++ return 0;
++ __uaccess_begin_nospec();
++ return 1;
++}
++
++#define user_access_begin(a, b, c) user_access_begin(a, b, c)
+ #define user_access_end() __uaccess_end()
+
+ #define unsafe_put_user(x, ptr, err_label) \
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index b481b95bd8f6..923b4bac9613 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -11,14 +11,17 @@
+ #include <linux/errno.h>
+ #include <linux/export.h>
+ #include <linux/spinlock.h>
++#include <linux/pci_ids.h>
+ #include <asm/amd_nb.h>
+
+ #define PCI_DEVICE_ID_AMD_17H_ROOT 0x1450
+ #define PCI_DEVICE_ID_AMD_17H_M10H_ROOT 0x15d0
+-#define PCI_DEVICE_ID_AMD_17H_DF_F3 0x1463
++#define PCI_DEVICE_ID_AMD_17H_M30H_ROOT 0x1480
+ #define PCI_DEVICE_ID_AMD_17H_DF_F4 0x1464
+-#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F3 0x15eb
+ #define PCI_DEVICE_ID_AMD_17H_M10H_DF_F4 0x15ec
++#define PCI_DEVICE_ID_AMD_17H_M30H_DF_F4 0x1494
++#define PCI_DEVICE_ID_AMD_17H_M70H_DF_F4 0x1444
++#define PCI_DEVICE_ID_AMD_19H_DF_F4 0x1654
+
+ /* Protect the PCI config register pairs used for SMN and DF indirect access. */
+ static DEFINE_MUTEX(smn_mutex);
+@@ -28,9 +31,11 @@ static u32 *flush_words;
+ static const struct pci_device_id amd_root_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_ROOT) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M10H_ROOT) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M30H_ROOT) },
+ {}
+ };
+
++
+ #define PCI_DEVICE_ID_AMD_CNB17H_F4 0x1704
+
+ const struct pci_device_id amd_nb_misc_ids[] = {
+@@ -44,7 +49,10 @@ const struct pci_device_id amd_nb_misc_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M10H_DF_F3) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M30H_DF_F3) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M70H_DF_F3) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_DF_F3) },
+ {}
+ };
+ EXPORT_SYMBOL_GPL(amd_nb_misc_ids);
+@@ -57,6 +65,9 @@ static const struct pci_device_id amd_nb_link_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F4) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_DF_F4) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M10H_DF_F4) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M30H_DF_F4) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M70H_DF_F4) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_DF_F4) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F4) },
+ {}
+ };
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 120769955687..de69090ca142 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -1122,8 +1122,7 @@ static const int amd_erratum_383[] =
+
+ /* #1054: Instructions Retired Performance Counter May Be Inaccurate */
+ static const int amd_erratum_1054[] =
+- AMD_OSVW_ERRATUM(0, AMD_MODEL_RANGE(0x17, 0, 0, 0x2f, 0xf));
+-
++ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0, 0, 0x2f, 0xf));
+
+ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
+ {
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index cf07437cd106..bf554ed2fd51 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -61,7 +61,7 @@ static u64 __ro_after_init x86_spec_ctrl_mask = SPEC_CTRL_IBRS;
+ u64 __ro_after_init x86_amd_ls_cfg_base;
+ u64 __ro_after_init x86_amd_ls_cfg_ssbd_mask;
+
+-/* Control conditional STIPB in switch_to() */
++/* Control conditional STIBP in switch_to() */
+ DEFINE_STATIC_KEY_FALSE(switch_to_cond_stibp);
+ /* Control conditional IBPB in switch_mm() */
+ DEFINE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
+@@ -581,7 +581,9 @@ early_param("nospectre_v1", nospectre_v1_cmdline);
+ static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+ SPECTRE_V2_NONE;
+
+-static enum spectre_v2_user_mitigation spectre_v2_user __ro_after_init =
++static enum spectre_v2_user_mitigation spectre_v2_user_stibp __ro_after_init =
++ SPECTRE_V2_USER_NONE;
++static enum spectre_v2_user_mitigation spectre_v2_user_ibpb __ro_after_init =
+ SPECTRE_V2_USER_NONE;
+
+ #ifdef CONFIG_RETPOLINE
+@@ -633,10 +635,11 @@ enum spectre_v2_user_cmd {
+ };
+
+ static const char * const spectre_v2_user_strings[] = {
+- [SPECTRE_V2_USER_NONE] = "User space: Vulnerable",
+- [SPECTRE_V2_USER_STRICT] = "User space: Mitigation: STIBP protection",
+- [SPECTRE_V2_USER_PRCTL] = "User space: Mitigation: STIBP via prctl",
+- [SPECTRE_V2_USER_SECCOMP] = "User space: Mitigation: STIBP via seccomp and prctl",
++ [SPECTRE_V2_USER_NONE] = "User space: Vulnerable",
++ [SPECTRE_V2_USER_STRICT] = "User space: Mitigation: STIBP protection",
++ [SPECTRE_V2_USER_STRICT_PREFERRED] = "User space: Mitigation: STIBP always-on protection",
++ [SPECTRE_V2_USER_PRCTL] = "User space: Mitigation: STIBP via prctl",
++ [SPECTRE_V2_USER_SECCOMP] = "User space: Mitigation: STIBP via seccomp and prctl",
+ };
+
+ static const struct {
+@@ -748,23 +751,36 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
+ static_key_enabled(&switch_mm_always_ibpb) ?
+ "always-on" : "conditional");
++
++ spectre_v2_user_ibpb = mode;
+ }
+
+- /* If enhanced IBRS is enabled no STIPB required */
+- if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
++ /*
++ * If enhanced IBRS is enabled or SMT impossible, STIBP is not
++ * required.
++ */
++ if (!smt_possible || spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+ return;
+
+ /*
+- * If SMT is not possible or STIBP is not available clear the STIPB
+- * mode.
++ * At this point, an STIBP mode other than "off" has been set.
++ * If STIBP support is not being forced, check if STIBP always-on
++ * is preferred.
+ */
+- if (!smt_possible || !boot_cpu_has(X86_FEATURE_STIBP))
++ if (mode != SPECTRE_V2_USER_STRICT &&
++ boot_cpu_has(X86_FEATURE_AMD_STIBP_ALWAYS_ON))
++ mode = SPECTRE_V2_USER_STRICT_PREFERRED;
++
++ /*
++ * If STIBP is not available, clear the STIBP mode.
++ */
++ if (!boot_cpu_has(X86_FEATURE_STIBP))
+ mode = SPECTRE_V2_USER_NONE;
++
++ spectre_v2_user_stibp = mode;
++
+ set_mode:
+- spectre_v2_user = mode;
+- /* Only print the STIBP mode when SMT possible */
+- if (smt_possible)
+- pr_info("%s\n", spectre_v2_user_strings[mode]);
++ pr_info("%s\n", spectre_v2_user_strings[mode]);
+ }
+
+ static const char * const spectre_v2_strings[] = {
+@@ -995,10 +1011,11 @@ void arch_smt_update(void)
+ {
+ mutex_lock(&spec_ctrl_mutex);
+
+- switch (spectre_v2_user) {
++ switch (spectre_v2_user_stibp) {
+ case SPECTRE_V2_USER_NONE:
+ break;
+ case SPECTRE_V2_USER_STRICT:
++ case SPECTRE_V2_USER_STRICT_PREFERRED:
+ update_stibp_strict();
+ break;
+ case SPECTRE_V2_USER_PRCTL:
+@@ -1227,13 +1244,19 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
+ {
+ switch (ctrl) {
+ case PR_SPEC_ENABLE:
+- if (spectre_v2_user == SPECTRE_V2_USER_NONE)
++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
++ spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
+ return 0;
+ /*
+ * Indirect branch speculation is always disabled in strict
+- * mode.
++ * mode. It can neither be enabled if it was force-disabled
++ * by a previous prctl call.
++
+ */
+- if (spectre_v2_user == SPECTRE_V2_USER_STRICT)
++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED ||
++ task_spec_ib_force_disable(task))
+ return -EPERM;
+ task_clear_spec_ib_disable(task);
+ task_update_spec_tif(task);
+@@ -1244,9 +1267,12 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
+ * Indirect branch speculation is always allowed when
+ * mitigation is force disabled.
+ */
+- if (spectre_v2_user == SPECTRE_V2_USER_NONE)
++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
++ spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
+ return -EPERM;
+- if (spectre_v2_user == SPECTRE_V2_USER_STRICT)
++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED)
+ return 0;
+ task_set_spec_ib_disable(task);
+ if (ctrl == PR_SPEC_FORCE_DISABLE)
+@@ -1277,7 +1303,8 @@ void arch_seccomp_spec_mitigate(struct task_struct *task)
+ {
+ if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP)
+ ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE);
+- if (spectre_v2_user == SPECTRE_V2_USER_SECCOMP)
++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP)
+ ib_prctl_set(task, PR_SPEC_FORCE_DISABLE);
+ }
+ #endif
+@@ -1306,21 +1333,24 @@ static int ib_prctl_get(struct task_struct *task)
+ if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+ return PR_SPEC_NOT_AFFECTED;
+
+- switch (spectre_v2_user) {
+- case SPECTRE_V2_USER_NONE:
++ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
++ spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
+ return PR_SPEC_ENABLE;
+- case SPECTRE_V2_USER_PRCTL:
+- case SPECTRE_V2_USER_SECCOMP:
++ else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED)
++ return PR_SPEC_DISABLE;
++ else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_PRCTL ||
++ spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_PRCTL ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP) {
+ if (task_spec_ib_force_disable(task))
+ return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
+ if (task_spec_ib_disable(task))
+ return PR_SPEC_PRCTL | PR_SPEC_DISABLE;
+ return PR_SPEC_PRCTL | PR_SPEC_ENABLE;
+- case SPECTRE_V2_USER_STRICT:
+- return PR_SPEC_DISABLE;
+- default:
++ } else
+ return PR_SPEC_NOT_AFFECTED;
+- }
+ }
+
+ int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which)
+@@ -1559,11 +1589,13 @@ static char *stibp_state(void)
+ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+ return "";
+
+- switch (spectre_v2_user) {
++ switch (spectre_v2_user_stibp) {
+ case SPECTRE_V2_USER_NONE:
+ return ", STIBP: disabled";
+ case SPECTRE_V2_USER_STRICT:
+ return ", STIBP: forced";
++ case SPECTRE_V2_USER_STRICT_PREFERRED:
++ return ", STIBP: always-on";
+ case SPECTRE_V2_USER_PRCTL:
+ case SPECTRE_V2_USER_SECCOMP:
+ if (static_key_enabled(&switch_to_cond_stibp))
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 1f69b12d5bb8..2a13468f8773 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -535,6 +535,13 @@ bool mce_is_memory_error(struct mce *m)
+ }
+ EXPORT_SYMBOL_GPL(mce_is_memory_error);
+
++static bool whole_page(struct mce *m)
++{
++ if (!mca_cfg.ser || !(m->status & MCI_STATUS_MISCV))
++ return true;
++ return MCI_MISC_ADDR_LSB(m->misc) >= PAGE_SHIFT;
++}
++
+ bool mce_is_correctable(struct mce *m)
+ {
+ if (m->cpuvendor == X86_VENDOR_AMD && m->status & MCI_STATUS_DEFERRED)
+@@ -600,7 +607,7 @@ static int srao_decode_notifier(struct notifier_block *nb, unsigned long val,
+ if (mce_usable_address(mce) && (mce->severity == MCE_AO_SEVERITY)) {
+ pfn = mce->addr >> PAGE_SHIFT;
+ if (!memory_failure(pfn, 0))
+- set_mce_nospec(pfn);
++ set_mce_nospec(pfn, whole_page(mce));
+ }
+
+ return NOTIFY_OK;
+@@ -1101,7 +1108,7 @@ static int do_memory_failure(struct mce *m)
+ if (ret)
+ pr_err("Memory error not recovered");
+ else
+- set_mce_nospec(m->addr >> PAGE_SHIFT);
++ set_mce_nospec(m->addr >> PAGE_SHIFT, whole_page(m));
+ return ret;
+ }
+
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index b8b08e61ac73..cd138bfd926c 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -413,28 +413,20 @@ static __always_inline void __speculation_ctrl_update(unsigned long tifp,
+
+ lockdep_assert_irqs_disabled();
+
+- /*
+- * If TIF_SSBD is different, select the proper mitigation
+- * method. Note that if SSBD mitigation is disabled or permanentely
+- * enabled this branch can't be taken because nothing can set
+- * TIF_SSBD.
+- */
+- if (tif_diff & _TIF_SSBD) {
+- if (static_cpu_has(X86_FEATURE_VIRT_SSBD)) {
++ /* Handle change of TIF_SSBD depending on the mitigation method. */
++ if (static_cpu_has(X86_FEATURE_VIRT_SSBD)) {
++ if (tif_diff & _TIF_SSBD)
+ amd_set_ssb_virt_state(tifn);
+- } else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD)) {
++ } else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD)) {
++ if (tif_diff & _TIF_SSBD)
+ amd_set_core_ssb_state(tifn);
+- } else if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
+- static_cpu_has(X86_FEATURE_AMD_SSBD)) {
+- msr |= ssbd_tif_to_spec_ctrl(tifn);
+- updmsr = true;
+- }
++ } else if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
++ static_cpu_has(X86_FEATURE_AMD_SSBD)) {
++ updmsr |= !!(tif_diff & _TIF_SSBD);
++ msr |= ssbd_tif_to_spec_ctrl(tifn);
+ }
+
+- /*
+- * Only evaluate TIF_SPEC_IB if conditional STIBP is enabled,
+- * otherwise avoid the MSR write.
+- */
++ /* Only evaluate TIF_SPEC_IB if conditional STIBP is enabled. */
+ if (IS_ENABLED(CONFIG_SMP) &&
+ static_branch_unlikely(&switch_to_cond_stibp)) {
+ updmsr |= !!(tif_diff & _TIF_SPEC_IB);
+diff --git a/arch/x86/kernel/process.h b/arch/x86/kernel/process.h
+index 898e97cf6629..320ab978fb1f 100644
+--- a/arch/x86/kernel/process.h
++++ b/arch/x86/kernel/process.h
+@@ -19,7 +19,7 @@ static inline void switch_to_extra(struct task_struct *prev,
+ if (IS_ENABLED(CONFIG_SMP)) {
+ /*
+ * Avoid __switch_to_xtra() invocation when conditional
+- * STIPB is disabled and the only different bit is
++ * STIBP is disabled and the only different bit is
+ * TIF_SPEC_IB. For CONFIG_SMP=n TIF_SPEC_IB is not
+ * in the TIF_WORK_CTXSW masks.
+ */
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 8fd3cedd9acc..39f3cad58b6c 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -197,6 +197,14 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBook5"),
+ },
+ },
++ { /* Handle problems with rebooting on Apple MacBook6,1 */
++ .callback = set_pci_reboot,
++ .ident = "Apple MacBook6,1",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MacBook6,1"),
++ },
++ },
+ { /* Handle problems with rebooting on Apple MacBookPro5 */
+ .callback = set_pci_reboot,
+ .ident = "Apple MacBookPro5",
+diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
+index fddaefc51fb6..0680a2e9e06b 100644
+--- a/arch/x86/kernel/time.c
++++ b/arch/x86/kernel/time.c
+@@ -24,10 +24,6 @@
+ #include <asm/hpet.h>
+ #include <asm/time.h>
+
+-#ifdef CONFIG_X86_64
+-__visible volatile unsigned long jiffies __cacheline_aligned_in_smp = INITIAL_JIFFIES;
+-#endif
+-
+ unsigned long profile_pc(struct pt_regs *regs)
+ {
+ unsigned long pc = instruction_pointer(regs);
+diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
+index 85e6d5620188..36593fd7dbe3 100644
+--- a/arch/x86/kernel/vmlinux.lds.S
++++ b/arch/x86/kernel/vmlinux.lds.S
+@@ -36,13 +36,13 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT, CONFIG_OUTPUT_FORMAT)
+ #ifdef CONFIG_X86_32
+ OUTPUT_ARCH(i386)
+ ENTRY(phys_startup_32)
+-jiffies = jiffies_64;
+ #else
+ OUTPUT_ARCH(i386:x86-64)
+ ENTRY(phys_startup_64)
+-jiffies_64 = jiffies;
+ #endif
+
++jiffies = jiffies_64;
++
+ #if defined(CONFIG_X86_64)
+ /*
+ * On 64-bit, align RODATA to 2MB so we retain large page mappings for
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 62f1e4663bc3..18632f15b29f 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -294,11 +294,18 @@ kvm_mmu_calc_root_page_role(struct kvm_vcpu *vcpu);
+ void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask, u64 mmio_value)
+ {
+ BUG_ON((mmio_mask & mmio_value) != mmio_value);
++ WARN_ON(mmio_value & (shadow_nonpresent_or_rsvd_mask << shadow_nonpresent_or_rsvd_mask_len));
++ WARN_ON(mmio_value & shadow_nonpresent_or_rsvd_lower_gfn_mask);
+ shadow_mmio_value = mmio_value | SPTE_SPECIAL_MASK;
+ shadow_mmio_mask = mmio_mask | SPTE_SPECIAL_MASK;
+ }
+ EXPORT_SYMBOL_GPL(kvm_mmu_set_mmio_spte_mask);
+
++static bool is_mmio_spte(u64 spte)
++{
++ return (spte & shadow_mmio_mask) == shadow_mmio_value;
++}
++
+ static inline bool sp_ad_disabled(struct kvm_mmu_page *sp)
+ {
+ return sp->role.ad_disabled;
+@@ -306,7 +313,7 @@ static inline bool sp_ad_disabled(struct kvm_mmu_page *sp)
+
+ static inline bool spte_ad_enabled(u64 spte)
+ {
+- MMU_WARN_ON((spte & shadow_mmio_mask) == shadow_mmio_value);
++ MMU_WARN_ON(is_mmio_spte(spte));
+ return !(spte & shadow_acc_track_value);
+ }
+
+@@ -317,13 +324,13 @@ static bool is_nx_huge_page_enabled(void)
+
+ static inline u64 spte_shadow_accessed_mask(u64 spte)
+ {
+- MMU_WARN_ON((spte & shadow_mmio_mask) == shadow_mmio_value);
++ MMU_WARN_ON(is_mmio_spte(spte));
+ return spte_ad_enabled(spte) ? shadow_accessed_mask : 0;
+ }
+
+ static inline u64 spte_shadow_dirty_mask(u64 spte)
+ {
+- MMU_WARN_ON((spte & shadow_mmio_mask) == shadow_mmio_value);
++ MMU_WARN_ON(is_mmio_spte(spte));
+ return spte_ad_enabled(spte) ? shadow_dirty_mask : 0;
+ }
+
+@@ -393,11 +400,6 @@ static void mark_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, u64 gfn,
+ mmu_spte_set(sptep, mask);
+ }
+
+-static bool is_mmio_spte(u64 spte)
+-{
+- return (spte & shadow_mmio_mask) == shadow_mmio_value;
+-}
+-
+ static gfn_t get_mmio_spte_gfn(u64 spte)
+ {
+ u64 gpa = spte & shadow_nonpresent_or_rsvd_lower_gfn_mask;
+@@ -479,16 +481,23 @@ static void kvm_mmu_reset_all_pte_masks(void)
+ * If the CPU has 46 or less physical address bits, then set an
+ * appropriate mask to guard against L1TF attacks. Otherwise, it is
+ * assumed that the CPU is not vulnerable to L1TF.
++ *
++ * Some Intel CPUs address the L1 cache using more PA bits than are
++ * reported by CPUID. Use the PA width of the L1 cache when possible
++ * to achieve more effective mitigation, e.g. if system RAM overlaps
++ * the most significant bits of legal physical address space.
+ */
++ shadow_nonpresent_or_rsvd_mask = 0;
+ low_phys_bits = boot_cpu_data.x86_phys_bits;
+- if (boot_cpu_data.x86_phys_bits <
+- 52 - shadow_nonpresent_or_rsvd_mask_len) {
++ if (boot_cpu_has_bug(X86_BUG_L1TF) &&
++ !WARN_ON_ONCE(boot_cpu_data.x86_cache_bits >=
++ 52 - shadow_nonpresent_or_rsvd_mask_len)) {
++ low_phys_bits = boot_cpu_data.x86_cache_bits
++ - shadow_nonpresent_or_rsvd_mask_len;
+ shadow_nonpresent_or_rsvd_mask =
+- rsvd_bits(boot_cpu_data.x86_phys_bits -
+- shadow_nonpresent_or_rsvd_mask_len,
+- boot_cpu_data.x86_phys_bits - 1);
+- low_phys_bits -= shadow_nonpresent_or_rsvd_mask_len;
++ rsvd_bits(low_phys_bits, boot_cpu_data.x86_cache_bits - 1);
+ }
++
+ shadow_nonpresent_or_rsvd_lower_gfn_mask =
+ GENMASK_ULL(low_phys_bits - 1, PAGE_SHIFT);
+ }
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 226db3dc490b..2aafb6c79134 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3229,8 +3229,8 @@ static int nested_svm_exit_special(struct vcpu_svm *svm)
+ return NESTED_EXIT_HOST;
+ break;
+ case SVM_EXIT_EXCP_BASE + PF_VECTOR:
+- /* When we're shadowing, trap PFs, but not async PF */
+- if (!npt_enabled && svm->vcpu.arch.apf.host_apf_reason == 0)
++ /* Trap async PF even if not shadowing */
++ if (!npt_enabled || svm->vcpu.arch.apf.host_apf_reason)
+ return NESTED_EXIT_HOST;
+ break;
+ default:
+@@ -3319,7 +3319,7 @@ static inline void copy_vmcb_control_area(struct vmcb *dst_vmcb, struct vmcb *fr
+ dst->iopm_base_pa = from->iopm_base_pa;
+ dst->msrpm_base_pa = from->msrpm_base_pa;
+ dst->tsc_offset = from->tsc_offset;
+- dst->asid = from->asid;
++ /* asid not copied, it is handled manually for svm->vmcb. */
+ dst->tlb_ctl = from->tlb_ctl;
+ dst->int_ctl = from->int_ctl;
+ dst->int_vector = from->int_vector;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index f08c287b6242..2c4baff7553b 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -9683,7 +9683,7 @@ static bool nested_vmx_exit_reflected(struct kvm_vcpu *vcpu, u32 exit_reason)
+ vmcs_read32(VM_EXIT_INTR_ERROR_CODE),
+ KVM_ISA_VMX);
+
+- switch (exit_reason) {
++ switch ((u16)exit_reason) {
+ case EXIT_REASON_EXCEPTION_NMI:
+ if (is_nmi(intr_info))
+ return false;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index b0fd24ee08d2..c53df0b95385 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -7525,9 +7525,8 @@ static void vcpu_load_eoi_exitmap(struct kvm_vcpu *vcpu)
+ kvm_x86_ops->load_eoi_exitmap(vcpu, eoi_exit_bitmap);
+ }
+
+-int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
+- unsigned long start, unsigned long end,
+- bool blockable)
++void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
++ unsigned long start, unsigned long end)
+ {
+ unsigned long apic_address;
+
+@@ -7538,8 +7537,6 @@ int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
+ apic_address = gfn_to_hva(kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT);
+ if (start <= apic_address && apic_address < end)
+ kvm_make_all_cpus_request(kvm, KVM_REQ_APIC_PAGE_RELOAD);
+-
+- return 0;
+ }
+
+ void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu)
+diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
+index fb5f29c60019..b1dba0987565 100644
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -120,8 +120,6 @@ __ref void *alloc_low_pages(unsigned int num)
+ } else {
+ pfn = pgt_buf_end;
+ pgt_buf_end += num;
+- printk(KERN_DEBUG "BRK [%#010lx, %#010lx] PGTABLE\n",
+- pfn << PAGE_SHIFT, (pgt_buf_end << PAGE_SHIFT) - 1);
+ }
+
+ for (i = 0; i < num; i++) {
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index e723559c386a..0c67a5a94de3 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -572,6 +572,10 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2fc0, pci_invalid_bar);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_invalid_bar);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_invalid_bar);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_invalid_bar);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0xa1ec, pci_invalid_bar);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0xa1ed, pci_invalid_bar);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0xa26c, pci_invalid_bar);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0xa26d, pci_invalid_bar);
+
+ /*
+ * Device [1022:7808]
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index 41228e545e82..5c6ecbb66608 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -869,6 +869,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
+ "acpi_cppc");
+ if (ret) {
+ per_cpu(cpc_desc_ptr, pr->id) = NULL;
++ kobject_put(&cpc_ptr->kobj);
+ goto out_free;
+ }
+
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index 3837cad94f35..ca735dc24d37 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -172,7 +172,7 @@ int acpi_device_set_power(struct acpi_device *device, int state)
+ * possibly drop references to the power resources in use.
+ */
+ state = ACPI_STATE_D3_HOT;
+- /* If _PR3 is not available, use D3hot as the target state. */
++ /* If D3cold is not supported, use D3hot as the target state. */
+ if (!device->power.states[ACPI_STATE_D3_COLD].flags.valid)
+ target_state = state;
+ } else if (!device->power.states[state].flags.valid) {
+diff --git a/drivers/acpi/evged.c b/drivers/acpi/evged.c
+index f13ba2c07667..73f6093a5c16 100644
+--- a/drivers/acpi/evged.c
++++ b/drivers/acpi/evged.c
+@@ -88,6 +88,8 @@ static acpi_status acpi_ged_request_interrupt(struct acpi_resource *ares,
+ struct resource r;
+ struct acpi_resource_irq *p = &ares->data.irq;
+ struct acpi_resource_extended_irq *pext = &ares->data.extended_irq;
++ char ev_name[5];
++ u8 trigger;
+
+ if (ares->type == ACPI_RESOURCE_TYPE_END_TAG)
+ return AE_OK;
+@@ -96,14 +98,28 @@ static acpi_status acpi_ged_request_interrupt(struct acpi_resource *ares,
+ dev_err(dev, "unable to parse IRQ resource\n");
+ return AE_ERROR;
+ }
+- if (ares->type == ACPI_RESOURCE_TYPE_IRQ)
++ if (ares->type == ACPI_RESOURCE_TYPE_IRQ) {
+ gsi = p->interrupts[0];
+- else
++ trigger = p->triggering;
++ } else {
+ gsi = pext->interrupts[0];
++ trigger = pext->triggering;
++ }
+
+ irq = r.start;
+
+- if (ACPI_FAILURE(acpi_get_handle(handle, "_EVT", &evt_handle))) {
++ switch (gsi) {
++ case 0 ... 255:
++ sprintf(ev_name, "_%c%02hhX",
++ trigger == ACPI_EDGE_SENSITIVE ? 'E' : 'L', gsi);
++
++ if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle)))
++ break;
++ /* fall through */
++ default:
++ if (ACPI_SUCCESS(acpi_get_handle(handle, "_EVT", &evt_handle)))
++ break;
++
+ dev_err(dev, "cannot locate _EVT method\n");
+ return AE_ERROR;
+ }
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 1dcc48b9d33c..1cfa3ac1d91f 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -921,12 +921,9 @@ static void acpi_bus_init_power_state(struct acpi_device *device, int state)
+
+ if (buffer.length && package
+ && package->type == ACPI_TYPE_PACKAGE
+- && package->package.count) {
+- int err = acpi_extract_power_resources(package, 0,
+- &ps->resources);
+- if (!err)
+- device->power.flags.power_resources = 1;
+- }
++ && package->package.count)
++ acpi_extract_power_resources(package, 0, &ps->resources);
++
+ ACPI_FREE(buffer.pointer);
+ }
+
+@@ -973,14 +970,27 @@ static void acpi_bus_get_power_flags(struct acpi_device *device)
+ acpi_bus_init_power_state(device, i);
+
+ INIT_LIST_HEAD(&device->power.states[ACPI_STATE_D3_COLD].resources);
+- if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources))
+- device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1;
+
+- /* Set defaults for D0 and D3hot states (always valid) */
++ /* Set the defaults for D0 and D3hot (always supported). */
+ device->power.states[ACPI_STATE_D0].flags.valid = 1;
+ device->power.states[ACPI_STATE_D0].power = 100;
+ device->power.states[ACPI_STATE_D3_HOT].flags.valid = 1;
+
++ /*
++ * Use power resources only if the D0 list of them is populated, because
++ * some platforms may provide _PR3 only to indicate D3cold support and
++ * in those cases the power resources list returned by it may be bogus.
++ */
++ if (!list_empty(&device->power.states[ACPI_STATE_D0].resources)) {
++ device->power.flags.power_resources = 1;
++ /*
++ * D3cold is supported if the D3hot list of power resources is
++ * not empty.
++ */
++ if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources))
++ device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1;
++ }
++
+ if (acpi_bus_init_power(device))
+ device->flags.power_manageable = 0;
+ }
+diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
+index f8150c7bfe88..0a8eb8961770 100644
+--- a/drivers/acpi/sysfs.c
++++ b/drivers/acpi/sysfs.c
+@@ -990,8 +990,10 @@ void acpi_sysfs_add_hotplug_profile(struct acpi_hotplug_profile *hotplug,
+
+ error = kobject_init_and_add(&hotplug->kobj,
+ &acpi_hotplug_profile_ktype, hotplug_kobj, "%s", name);
+- if (error)
++ if (error) {
++ kobject_put(&hotplug->kobj);
+ goto err_out;
++ }
+
+ kobject_uevent(&hotplug->kobj, KOBJ_ADD);
+ return;
+diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
+index e3e4d929e74f..ff6203c331ff 100644
+--- a/drivers/bluetooth/btbcm.c
++++ b/drivers/bluetooth/btbcm.c
+@@ -324,6 +324,7 @@ static const struct bcm_subver_table bcm_uart_subver_table[] = {
+ { 0x4103, "BCM4330B1" }, /* 002.001.003 */
+ { 0x410e, "BCM43341B0" }, /* 002.001.014 */
+ { 0x4406, "BCM4324B3" }, /* 002.004.006 */
++ { 0x4606, "BCM4324B5" }, /* 002.006.006 */
+ { 0x6109, "BCM4335C0" }, /* 003.001.009 */
+ { 0x610c, "BCM4354" }, /* 003.001.012 */
+ { 0x2122, "BCM4343A0" }, /* 001.001.034 */
+@@ -334,6 +335,7 @@ static const struct bcm_subver_table bcm_uart_subver_table[] = {
+ };
+
+ static const struct bcm_subver_table bcm_usb_subver_table[] = {
++ { 0x2105, "BCM20703A1" }, /* 001.001.005 */
+ { 0x210b, "BCM43142A0" }, /* 001.001.011 */
+ { 0x2112, "BCM4314A0" }, /* 001.001.018 */
+ { 0x2118, "BCM20702A0" }, /* 001.001.024 */
+diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
+index 59e5fc5eec8f..3e386f68faa0 100644
+--- a/drivers/bluetooth/hci_bcm.c
++++ b/drivers/bluetooth/hci_bcm.c
+@@ -115,6 +115,7 @@ struct bcm_device {
+ u32 oper_speed;
+ int irq;
+ bool irq_active_low;
++ bool irq_acquired;
+
+ #ifdef CONFIG_PM
+ struct hci_uart *hu;
+@@ -288,6 +289,8 @@ static int bcm_request_irq(struct bcm_data *bcm)
+ goto unlock;
+ }
+
++ bdev->irq_acquired = true;
++
+ device_init_wakeup(bdev->dev, true);
+
+ pm_runtime_set_autosuspend_delay(bdev->dev,
+@@ -456,7 +459,7 @@ static int bcm_close(struct hci_uart *hu)
+ }
+
+ if (bdev) {
+- if (IS_ENABLED(CONFIG_PM) && bdev->irq > 0) {
++ if (IS_ENABLED(CONFIG_PM) && bdev->irq_acquired) {
+ devm_free_irq(bdev->dev, bdev->irq, bdev);
+ device_init_wakeup(bdev->dev, false);
+ pm_runtime_disable(bdev->dev);
+diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
+index c6271ce250b3..b161bdf60000 100644
+--- a/drivers/char/agp/intel-gtt.c
++++ b/drivers/char/agp/intel-gtt.c
+@@ -846,6 +846,7 @@ void intel_gtt_insert_page(dma_addr_t addr,
+ unsigned int flags)
+ {
+ intel_private.driver->write_entry(addr, pg, flags);
++ readl(intel_private.gtt + pg);
+ if (intel_private.driver->chipset_flush)
+ intel_private.driver->chipset_flush();
+ }
+@@ -871,7 +872,7 @@ void intel_gtt_insert_sg_entries(struct sg_table *st,
+ j++;
+ }
+ }
+- wmb();
++ readl(intel_private.gtt + j - 1);
+ if (intel_private.driver->chipset_flush)
+ intel_private.driver->chipset_flush();
+ }
+@@ -1105,6 +1106,7 @@ static void i9xx_cleanup(void)
+
+ static void i9xx_chipset_flush(void)
+ {
++ wmb();
+ if (intel_private.i9xx_flush_page)
+ writel(1, intel_private.i9xx_flush_page);
+ }
+diff --git a/drivers/char/ipmi/ipmi_si_pci.c b/drivers/char/ipmi/ipmi_si_pci.c
+index 022e03634ce2..9e9700b1a8e6 100644
+--- a/drivers/char/ipmi/ipmi_si_pci.c
++++ b/drivers/char/ipmi/ipmi_si_pci.c
+@@ -18,11 +18,6 @@ module_param_named(trypci, si_trypci, bool, 0);
+ MODULE_PARM_DESC(trypci, "Setting this to zero will disable the"
+ " default scan of the interfaces identified via pci");
+
+-#define PCI_CLASS_SERIAL_IPMI 0x0c07
+-#define PCI_CLASS_SERIAL_IPMI_SMIC 0x0c0700
+-#define PCI_CLASS_SERIAL_IPMI_KCS 0x0c0701
+-#define PCI_CLASS_SERIAL_IPMI_BT 0x0c0702
+-
+ #define PCI_DEVICE_ID_HP_MMC 0x121A
+
+ static void ipmi_pci_cleanup(struct si_sm_io *io)
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index a102eb1abe4b..8353ab9bd31b 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -101,7 +101,11 @@ static int clk_pm_runtime_get(struct clk_core *core)
+ return 0;
+
+ ret = pm_runtime_get_sync(core->dev);
+- return ret < 0 ? ret : 0;
++ if (ret < 0) {
++ pm_runtime_put_noidle(core->dev);
++ return ret;
++ }
++ return 0;
+ }
+
+ static void clk_pm_runtime_put(struct clk_core *core)
+diff --git a/drivers/clocksource/dw_apb_timer.c b/drivers/clocksource/dw_apb_timer.c
+index 1f5f734e4919..a018199575e3 100644
+--- a/drivers/clocksource/dw_apb_timer.c
++++ b/drivers/clocksource/dw_apb_timer.c
+@@ -225,7 +225,8 @@ static int apbt_next_event(unsigned long delta,
+ /**
+ * dw_apb_clockevent_init() - use an APB timer as a clock_event_device
+ *
+- * @cpu: The CPU the events will be targeted at.
++ * @cpu: The CPU the events will be targeted at or -1 if CPU affiliation
++ * isn't required.
+ * @name: The name used for the timer and the IRQ for it.
+ * @rating: The rating to give the timer.
+ * @base: I/O base for the timer registers.
+@@ -260,7 +261,7 @@ dw_apb_clockevent_init(int cpu, const char *name, unsigned rating,
+ dw_ced->ced.max_delta_ticks = 0x7fffffff;
+ dw_ced->ced.min_delta_ns = clockevent_delta2ns(5000, &dw_ced->ced);
+ dw_ced->ced.min_delta_ticks = 5000;
+- dw_ced->ced.cpumask = cpumask_of(cpu);
++ dw_ced->ced.cpumask = cpu < 0 ? cpu_possible_mask : cpumask_of(cpu);
+ dw_ced->ced.features = CLOCK_EVT_FEAT_PERIODIC |
+ CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_DYNIRQ;
+ dw_ced->ced.set_state_shutdown = apbt_shutdown;
+diff --git a/drivers/clocksource/dw_apb_timer_of.c b/drivers/clocksource/dw_apb_timer_of.c
+index 69866cd8f4bb..3e4d0e5733d3 100644
+--- a/drivers/clocksource/dw_apb_timer_of.c
++++ b/drivers/clocksource/dw_apb_timer_of.c
+@@ -146,10 +146,6 @@ static int num_called;
+ static int __init dw_apb_timer_init(struct device_node *timer)
+ {
+ switch (num_called) {
+- case 0:
+- pr_debug("%s: found clockevent timer\n", __func__);
+- add_clockevent(timer);
+- break;
+ case 1:
+ pr_debug("%s: found clocksource timer\n", __func__);
+ add_clocksource(timer);
+@@ -160,6 +156,8 @@ static int __init dw_apb_timer_init(struct device_node *timer)
+ #endif
+ break;
+ default:
++ pr_debug("%s: found clockevent timer\n", __func__);
++ add_clockevent(timer);
+ break;
+ }
+
+diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
+index e754c7aae7f7..66979dc33680 100644
+--- a/drivers/cpuidle/sysfs.c
++++ b/drivers/cpuidle/sysfs.c
+@@ -467,7 +467,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device)
+ ret = kobject_init_and_add(&kobj->kobj, &ktype_state_cpuidle,
+ &kdev->kobj, "state%d", i);
+ if (ret) {
+- kfree(kobj);
++ kobject_put(&kobj->kobj);
+ goto error_state;
+ }
+ cpuidle_add_s2idle_attr_group(kobj);
+@@ -598,7 +598,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev)
+ ret = kobject_init_and_add(&kdrv->kobj, &ktype_driver_cpuidle,
+ &kdev->kobj, "driver");
+ if (ret) {
+- kfree(kdrv);
++ kobject_put(&kdrv->kobj);
+ return ret;
+ }
+
+@@ -692,7 +692,7 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
+ error = kobject_init_and_add(&kdev->kobj, &ktype_cpuidle, &cpu_dev->kobj,
+ "cpuidle");
+ if (error) {
+- kfree(kdev);
++ kobject_put(&kdev->kobj);
+ return error;
+ }
+
+diff --git a/drivers/crypto/cavium/nitrox/nitrox_main.c b/drivers/crypto/cavium/nitrox/nitrox_main.c
+index fee7cb2ce747..a81f3c7e941d 100644
+--- a/drivers/crypto/cavium/nitrox/nitrox_main.c
++++ b/drivers/crypto/cavium/nitrox/nitrox_main.c
+@@ -183,7 +183,7 @@ static void nitrox_remove_from_devlist(struct nitrox_device *ndev)
+
+ struct nitrox_device *nitrox_get_first_device(void)
+ {
+- struct nitrox_device *ndev = NULL;
++ struct nitrox_device *ndev;
+
+ mutex_lock(&devlist_lock);
+ list_for_each_entry(ndev, &ndevlist, list) {
+@@ -191,7 +191,7 @@ struct nitrox_device *nitrox_get_first_device(void)
+ break;
+ }
+ mutex_unlock(&devlist_lock);
+- if (!ndev)
++ if (&ndev->list == &ndevlist)
+ return NULL;
+
+ refcount_inc(&ndev->refcnt);
+diff --git a/drivers/crypto/ccp/Kconfig b/drivers/crypto/ccp/Kconfig
+index b9dfae47aefd..7f5fc705503d 100644
+--- a/drivers/crypto/ccp/Kconfig
++++ b/drivers/crypto/ccp/Kconfig
+@@ -9,10 +9,9 @@ config CRYPTO_DEV_CCP_DD
+ config CRYPTO_DEV_SP_CCP
+ bool "Cryptographic Coprocessor device"
+ default y
+- depends on CRYPTO_DEV_CCP_DD
++ depends on CRYPTO_DEV_CCP_DD && DMADEVICES
+ select HW_RANDOM
+ select DMA_ENGINE
+- select DMADEVICES
+ select CRYPTO_SHA1
+ select CRYPTO_SHA256
+ help
+diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
+index c435f89f34e3..9b3c259f081d 100644
+--- a/drivers/crypto/chelsio/chcr_algo.c
++++ b/drivers/crypto/chelsio/chcr_algo.c
+@@ -2764,7 +2764,7 @@ static void fill_sec_cpl_for_aead(struct cpl_tx_sec_pdu *sec_cpl,
+ unsigned int mac_mode = CHCR_SCMD_AUTH_MODE_CBCMAC;
+ unsigned int c_id = a_ctx(tfm)->dev->rx_channel_id;
+ unsigned int ccm_xtra;
+- unsigned char tag_offset = 0, auth_offset = 0;
++ unsigned int tag_offset = 0, auth_offset = 0;
+ unsigned int assoclen;
+
+ if (get_aead_subtype(tfm) == CRYPTO_ALG_SUB_TYPE_AEAD_RFC4309)
+diff --git a/drivers/crypto/stm32/stm32_crc32.c b/drivers/crypto/stm32/stm32_crc32.c
+index 29d2095d9dfd..47d31335c2d4 100644
+--- a/drivers/crypto/stm32/stm32_crc32.c
++++ b/drivers/crypto/stm32/stm32_crc32.c
+@@ -28,8 +28,10 @@
+
+ /* Registers values */
+ #define CRC_CR_RESET BIT(0)
+-#define CRC_CR_REVERSE (BIT(7) | BIT(6) | BIT(5))
+-#define CRC_INIT_DEFAULT 0xFFFFFFFF
++#define CRC_CR_REV_IN_WORD (BIT(6) | BIT(5))
++#define CRC_CR_REV_IN_BYTE BIT(5)
++#define CRC_CR_REV_OUT BIT(7)
++#define CRC32C_INIT_DEFAULT 0xFFFFFFFF
+
+ #define CRC_AUTOSUSPEND_DELAY 50
+
+@@ -38,8 +40,6 @@ struct stm32_crc {
+ struct device *dev;
+ void __iomem *regs;
+ struct clk *clk;
+- u8 pending_data[sizeof(u32)];
+- size_t nb_pending_bytes;
+ };
+
+ struct stm32_crc_list {
+@@ -59,14 +59,13 @@ struct stm32_crc_ctx {
+
+ struct stm32_crc_desc_ctx {
+ u32 partial; /* crc32c: partial in first 4 bytes of that struct */
+- struct stm32_crc *crc;
+ };
+
+ static int stm32_crc32_cra_init(struct crypto_tfm *tfm)
+ {
+ struct stm32_crc_ctx *mctx = crypto_tfm_ctx(tfm);
+
+- mctx->key = CRC_INIT_DEFAULT;
++ mctx->key = 0;
+ mctx->poly = CRC32_POLY_LE;
+ return 0;
+ }
+@@ -75,7 +74,7 @@ static int stm32_crc32c_cra_init(struct crypto_tfm *tfm)
+ {
+ struct stm32_crc_ctx *mctx = crypto_tfm_ctx(tfm);
+
+- mctx->key = CRC_INIT_DEFAULT;
++ mctx->key = CRC32C_INIT_DEFAULT;
+ mctx->poly = CRC32C_POLY_LE;
+ return 0;
+ }
+@@ -94,32 +93,42 @@ static int stm32_crc_setkey(struct crypto_shash *tfm, const u8 *key,
+ return 0;
+ }
+
++static struct stm32_crc *stm32_crc_get_next_crc(void)
++{
++ struct stm32_crc *crc;
++
++ spin_lock_bh(&crc_list.lock);
++ crc = list_first_entry(&crc_list.dev_list, struct stm32_crc, list);
++ if (crc)
++ list_move_tail(&crc->list, &crc_list.dev_list);
++ spin_unlock_bh(&crc_list.lock);
++
++ return crc;
++}
++
+ static int stm32_crc_init(struct shash_desc *desc)
+ {
+ struct stm32_crc_desc_ctx *ctx = shash_desc_ctx(desc);
+ struct stm32_crc_ctx *mctx = crypto_shash_ctx(desc->tfm);
+ struct stm32_crc *crc;
+
+- spin_lock_bh(&crc_list.lock);
+- list_for_each_entry(crc, &crc_list.dev_list, list) {
+- ctx->crc = crc;
+- break;
+- }
+- spin_unlock_bh(&crc_list.lock);
++ crc = stm32_crc_get_next_crc();
++ if (!crc)
++ return -ENODEV;
+
+- pm_runtime_get_sync(ctx->crc->dev);
++ pm_runtime_get_sync(crc->dev);
+
+ /* Reset, set key, poly and configure in bit reverse mode */
+- writel_relaxed(bitrev32(mctx->key), ctx->crc->regs + CRC_INIT);
+- writel_relaxed(bitrev32(mctx->poly), ctx->crc->regs + CRC_POL);
+- writel_relaxed(CRC_CR_RESET | CRC_CR_REVERSE, ctx->crc->regs + CRC_CR);
++ writel_relaxed(bitrev32(mctx->key), crc->regs + CRC_INIT);
++ writel_relaxed(bitrev32(mctx->poly), crc->regs + CRC_POL);
++ writel_relaxed(CRC_CR_RESET | CRC_CR_REV_IN_WORD | CRC_CR_REV_OUT,
++ crc->regs + CRC_CR);
+
+ /* Store partial result */
+- ctx->partial = readl_relaxed(ctx->crc->regs + CRC_DR);
+- ctx->crc->nb_pending_bytes = 0;
++ ctx->partial = readl_relaxed(crc->regs + CRC_DR);
+
+- pm_runtime_mark_last_busy(ctx->crc->dev);
+- pm_runtime_put_autosuspend(ctx->crc->dev);
++ pm_runtime_mark_last_busy(crc->dev);
++ pm_runtime_put_autosuspend(crc->dev);
+
+ return 0;
+ }
+@@ -128,31 +137,49 @@ static int stm32_crc_update(struct shash_desc *desc, const u8 *d8,
+ unsigned int length)
+ {
+ struct stm32_crc_desc_ctx *ctx = shash_desc_ctx(desc);
+- struct stm32_crc *crc = ctx->crc;
+- u32 *d32;
+- unsigned int i;
++ struct stm32_crc_ctx *mctx = crypto_shash_ctx(desc->tfm);
++ struct stm32_crc *crc;
++
++ crc = stm32_crc_get_next_crc();
++ if (!crc)
++ return -ENODEV;
+
+ pm_runtime_get_sync(crc->dev);
+
+- if (unlikely(crc->nb_pending_bytes)) {
+- while (crc->nb_pending_bytes != sizeof(u32) && length) {
+- /* Fill in pending data */
+- crc->pending_data[crc->nb_pending_bytes++] = *(d8++);
++ /*
++ * Restore previously calculated CRC for this context as init value
++ * Restore polynomial configuration
++ * Configure in register for word input data,
++ * Configure out register in reversed bit mode data.
++ */
++ writel_relaxed(bitrev32(ctx->partial), crc->regs + CRC_INIT);
++ writel_relaxed(bitrev32(mctx->poly), crc->regs + CRC_POL);
++ writel_relaxed(CRC_CR_RESET | CRC_CR_REV_IN_WORD | CRC_CR_REV_OUT,
++ crc->regs + CRC_CR);
++
++ if (d8 != PTR_ALIGN(d8, sizeof(u32))) {
++ /* Configure for byte data */
++ writel_relaxed(CRC_CR_REV_IN_BYTE | CRC_CR_REV_OUT,
++ crc->regs + CRC_CR);
++ while (d8 != PTR_ALIGN(d8, sizeof(u32)) && length) {
++ writeb_relaxed(*d8++, crc->regs + CRC_DR);
+ length--;
+ }
+-
+- if (crc->nb_pending_bytes == sizeof(u32)) {
+- /* Process completed pending data */
+- writel_relaxed(*(u32 *)crc->pending_data,
+- crc->regs + CRC_DR);
+- crc->nb_pending_bytes = 0;
+- }
++ /* Configure for word data */
++ writel_relaxed(CRC_CR_REV_IN_WORD | CRC_CR_REV_OUT,
++ crc->regs + CRC_CR);
+ }
+
+- d32 = (u32 *)d8;
+- for (i = 0; i < length >> 2; i++)
+- /* Process 32 bits data */
+- writel_relaxed(*(d32++), crc->regs + CRC_DR);
++ for (; length >= sizeof(u32); d8 += sizeof(u32), length -= sizeof(u32))
++ writel_relaxed(*((u32 *)d8), crc->regs + CRC_DR);
++
++ if (length) {
++ /* Configure for byte data */
++ writel_relaxed(CRC_CR_REV_IN_BYTE | CRC_CR_REV_OUT,
++ crc->regs + CRC_CR);
++ while (length--)
++ writeb_relaxed(*d8++, crc->regs + CRC_DR);
++ }
+
+ /* Store partial result */
+ ctx->partial = readl_relaxed(crc->regs + CRC_DR);
+@@ -160,22 +187,6 @@ static int stm32_crc_update(struct shash_desc *desc, const u8 *d8,
+ pm_runtime_mark_last_busy(crc->dev);
+ pm_runtime_put_autosuspend(crc->dev);
+
+- /* Check for pending data (non 32 bits) */
+- length &= 3;
+- if (likely(!length))
+- return 0;
+-
+- if ((crc->nb_pending_bytes + length) >= sizeof(u32)) {
+- /* Shall not happen */
+- dev_err(crc->dev, "Pending data overflow\n");
+- return -EINVAL;
+- }
+-
+- d8 = (const u8 *)d32;
+- for (i = 0; i < length; i++)
+- /* Store pending data */
+- crc->pending_data[crc->nb_pending_bytes++] = *(d8++);
+-
+ return 0;
+ }
+
+@@ -204,6 +215,8 @@ static int stm32_crc_digest(struct shash_desc *desc, const u8 *data,
+ return stm32_crc_init(desc) ?: stm32_crc_finup(desc, data, length, out);
+ }
+
++static unsigned int refcnt;
++static DEFINE_MUTEX(refcnt_lock);
+ static struct shash_alg algs[] = {
+ /* CRC-32 */
+ {
+@@ -296,12 +309,18 @@ static int stm32_crc_probe(struct platform_device *pdev)
+ list_add(&crc->list, &crc_list.dev_list);
+ spin_unlock(&crc_list.lock);
+
+- ret = crypto_register_shashes(algs, ARRAY_SIZE(algs));
+- if (ret) {
+- dev_err(dev, "Failed to register\n");
+- clk_disable_unprepare(crc->clk);
+- return ret;
++ mutex_lock(&refcnt_lock);
++ if (!refcnt) {
++ ret = crypto_register_shashes(algs, ARRAY_SIZE(algs));
++ if (ret) {
++ mutex_unlock(&refcnt_lock);
++ dev_err(dev, "Failed to register\n");
++ clk_disable_unprepare(crc->clk);
++ return ret;
++ }
+ }
++ refcnt++;
++ mutex_unlock(&refcnt_lock);
+
+ dev_info(dev, "Initialized\n");
+
+@@ -322,7 +341,10 @@ static int stm32_crc_remove(struct platform_device *pdev)
+ list_del(&crc->list);
+ spin_unlock(&crc_list.lock);
+
+- crypto_unregister_shashes(algs, ARRAY_SIZE(algs));
++ mutex_lock(&refcnt_lock);
++ if (!--refcnt)
++ crypto_unregister_shashes(algs, ARRAY_SIZE(algs));
++ mutex_unlock(&refcnt_lock);
+
+ pm_runtime_disable(crc->dev);
+ pm_runtime_put_noidle(crc->dev);
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index db5f939f5aa3..ea16308fae0a 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -2670,7 +2670,6 @@ static struct talitos_alg_template driver_algs[] = {
+ .cra_ablkcipher = {
+ .min_keysize = AES_MIN_KEY_SIZE,
+ .max_keysize = AES_MAX_KEY_SIZE,
+- .ivsize = AES_BLOCK_SIZE,
+ }
+ },
+ .desc_hdr_template = DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU |
+@@ -2704,6 +2703,7 @@ static struct talitos_alg_template driver_algs[] = {
+ .cra_ablkcipher = {
+ .min_keysize = AES_MIN_KEY_SIZE,
+ .max_keysize = AES_MAX_KEY_SIZE,
++ .ivsize = AES_BLOCK_SIZE,
+ .setkey = ablkcipher_aes_setkey,
+ }
+ },
+diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c
+index 38432721069f..ab4700e4b409 100644
+--- a/drivers/crypto/virtio/virtio_crypto_algs.c
++++ b/drivers/crypto/virtio/virtio_crypto_algs.c
+@@ -367,13 +367,18 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req,
+ int err;
+ unsigned long flags;
+ struct scatterlist outhdr, iv_sg, status_sg, **sgs;
+- int i;
+ u64 dst_len;
+ unsigned int num_out = 0, num_in = 0;
+ int sg_total;
+ uint8_t *iv;
++ struct scatterlist *sg;
+
+ src_nents = sg_nents_for_len(req->src, req->nbytes);
++ if (src_nents < 0) {
++ pr_err("Invalid number of src SG.\n");
++ return src_nents;
++ }
++
+ dst_nents = sg_nents(req->dst);
+
+ pr_debug("virtio_crypto: Number of sgs (src_nents: %d, dst_nents: %d)\n",
+@@ -419,6 +424,7 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req,
+ goto free;
+ }
+
++ dst_len = min_t(unsigned int, req->nbytes, dst_len);
+ pr_debug("virtio_crypto: src_len: %u, dst_len: %llu\n",
+ req->nbytes, dst_len);
+
+@@ -459,12 +465,12 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req,
+ vc_sym_req->iv = iv;
+
+ /* Source data */
+- for (i = 0; i < src_nents; i++)
+- sgs[num_out++] = &req->src[i];
++ for (sg = req->src; src_nents; sg = sg_next(sg), src_nents--)
++ sgs[num_out++] = sg;
+
+ /* Destination data */
+- for (i = 0; i < dst_nents; i++)
+- sgs[num_out + num_in++] = &req->dst[i];
++ for (sg = req->dst; sg; sg = sg_next(sg))
++ sgs[num_out + num_in++] = sg;
+
+ /* Status */
+ sg_init_one(&status_sg, &vc_req->status, sizeof(vc_req->status));
+@@ -594,10 +600,11 @@ static void virtio_crypto_ablkcipher_finalize_req(
+ scatterwalk_map_and_copy(req->info, req->dst,
+ req->nbytes - AES_BLOCK_SIZE,
+ AES_BLOCK_SIZE, 0);
+- crypto_finalize_ablkcipher_request(vc_sym_req->base.dataq->engine,
+- req, err);
+ kzfree(vc_sym_req->iv);
+ virtcrypto_clear_request(&vc_sym_req->base);
++
++ crypto_finalize_ablkcipher_request(vc_sym_req->base.dataq->engine,
++ req, err);
+ }
+
+ static struct virtio_crypto_algo virtio_crypto_algs[] = { {
+diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
+index 6e91584c3677..47c6e3ceac4d 100644
+--- a/drivers/dma/pch_dma.c
++++ b/drivers/dma/pch_dma.c
+@@ -972,7 +972,6 @@ static void pch_dma_remove(struct pci_dev *pdev)
+ }
+
+ /* PCI Device ID of DMA device */
+-#define PCI_VENDOR_ID_ROHM 0x10DB
+ #define PCI_DEVICE_ID_EG20T_PCH_DMA_8CH 0x8810
+ #define PCI_DEVICE_ID_EG20T_PCH_DMA_4CH 0x8815
+ #define PCI_DEVICE_ID_ML7213_DMA1_8CH 0x8026
+diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
+index 1c65f5ac4368..6529addd1e82 100644
+--- a/drivers/firmware/efi/efivars.c
++++ b/drivers/firmware/efi/efivars.c
+@@ -586,8 +586,10 @@ efivar_create_sysfs_entry(struct efivar_entry *new_var)
+ ret = kobject_init_and_add(&new_var->kobj, &efivar_ktype,
+ NULL, "%s", short_name);
+ kfree(short_name);
+- if (ret)
++ if (ret) {
++ kobject_put(&new_var->kobj);
+ return ret;
++ }
+
+ kobject_uevent(&new_var->kobj, KOBJ_ADD);
+ if (efivar_entry_add(new_var, &efivar_sysfs_list)) {
+diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
+index d9845099635e..d3777d754984 100644
+--- a/drivers/firmware/efi/libstub/Makefile
++++ b/drivers/firmware/efi/libstub/Makefile
+@@ -28,6 +28,7 @@ KBUILD_CFLAGS := $(cflags-y) -DDISABLE_BRANCH_PROFILING \
+ -D__NO_FORTIFY \
+ $(call cc-option,-ffreestanding) \
+ $(call cc-option,-fno-stack-protector) \
++ $(call cc-option,-fno-addrsig) \
+ -D__DISABLE_EXPORTS
+
+ GCOV_PROFILE := n
+diff --git a/drivers/gnss/sirf.c b/drivers/gnss/sirf.c
+index 4596fde16dfe..3e88e79d1053 100644
+--- a/drivers/gnss/sirf.c
++++ b/drivers/gnss/sirf.c
+@@ -292,14 +292,18 @@ static int sirf_probe(struct serdev_device *serdev)
+
+ data->on_off = devm_gpiod_get_optional(dev, "sirf,onoff",
+ GPIOD_OUT_LOW);
+- if (IS_ERR(data->on_off))
++ if (IS_ERR(data->on_off)) {
++ ret = PTR_ERR(data->on_off);
+ goto err_put_device;
++ }
+
+ if (data->on_off) {
+ data->wakeup = devm_gpiod_get_optional(dev, "sirf,wakeup",
+ GPIOD_IN);
+- if (IS_ERR(data->wakeup))
++ if (IS_ERR(data->wakeup)) {
++ ret = PTR_ERR(data->wakeup);
+ goto err_put_device;
++ }
+
+ /*
+ * Configurations where WAKEUP has been left not connected,
+diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c
+index 51c7d1b84c2e..0c076dce9e17 100644
+--- a/drivers/gpio/gpio-ml-ioh.c
++++ b/drivers/gpio/gpio-ml-ioh.c
+@@ -31,8 +31,6 @@
+
+ #define IOH_IRQ_BASE 0
+
+-#define PCI_VENDOR_ID_ROHM 0x10DB
+-
+ struct ioh_reg_comn {
+ u32 ien;
+ u32 istatus;
+diff --git a/drivers/gpio/gpio-pch.c b/drivers/gpio/gpio-pch.c
+index ffce0ab912ed..8c7f3d20e30e 100644
+--- a/drivers/gpio/gpio-pch.c
++++ b/drivers/gpio/gpio-pch.c
+@@ -524,7 +524,6 @@ static int pch_gpio_resume(struct pci_dev *pdev)
+ #define pch_gpio_resume NULL
+ #endif
+
+-#define PCI_VENDOR_ID_ROHM 0x10DB
+ static const struct pci_device_id pch_gpio_pcidev_id[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x8803) },
+ { PCI_DEVICE(PCI_VENDOR_ID_ROHM, 0x8014) },
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
+index 1b4783d45c53..3a218b56a008 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
+@@ -20,13 +20,15 @@ static void adv7511_calc_cts_n(unsigned int f_tmds, unsigned int fs,
+ {
+ switch (fs) {
+ case 32000:
+- *n = 4096;
++ case 48000:
++ case 96000:
++ case 192000:
++ *n = fs * 128 / 1000;
+ break;
+ case 44100:
+- *n = 6272;
+- break;
+- case 48000:
+- *n = 6144;
++ case 88200:
++ case 176400:
++ *n = fs * 128 / 900;
+ break;
+ }
+
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index f08c54740cbe..52894816167c 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -1604,7 +1604,9 @@ static int eb_copy_relocations(const struct i915_execbuffer *eb)
+ * happened we would make the mistake of assuming that the
+ * relocations were valid.
+ */
+- user_access_begin();
++ if (!user_access_begin(VERIFY_WRITE, urelocs, size))
++ goto end_user;
++
+ for (copied = 0; copied < nreloc; copied++)
+ unsafe_put_user(-1,
+ &urelocs[copied].presumed_offset,
+@@ -2649,7 +2651,17 @@ i915_gem_execbuffer2_ioctl(struct drm_device *dev, void *data,
+ unsigned int i;
+
+ /* Copy the new buffer offsets back to the user's exec list. */
+- user_access_begin();
++ /*
++ * Note: count * sizeof(*user_exec_list) does not overflow,
++ * because we checked 'count' in check_buffer_count().
++ *
++ * And this range already got effectively checked earlier
++ * when we did the "copy_from_user()" above.
++ */
++ if (!user_access_begin(VERIFY_WRITE, user_exec_list,
++ count * sizeof(*user_exec_list)))
++ goto end_user;
++
+ for (i = 0; i < args->buffer_count; i++) {
+ if (!(exec2_list[i].offset & UPDATE))
+ continue;
+diff --git a/drivers/gpu/drm/vkms/vkms_drv.h b/drivers/gpu/drm/vkms/vkms_drv.h
+index e018752d57bb..b46c31e25c27 100644
+--- a/drivers/gpu/drm/vkms/vkms_drv.h
++++ b/drivers/gpu/drm/vkms/vkms_drv.h
+@@ -62,11 +62,6 @@ int vkms_output_init(struct vkms_device *vkmsdev);
+ struct drm_plane *vkms_plane_init(struct vkms_device *vkmsdev);
+
+ /* Gem stuff */
+-struct drm_gem_object *vkms_gem_create(struct drm_device *dev,
+- struct drm_file *file,
+- u32 *handle,
+- u64 size);
+-
+ int vkms_gem_fault(struct vm_fault *vmf);
+
+ int vkms_dumb_create(struct drm_file *file, struct drm_device *dev,
+diff --git a/drivers/gpu/drm/vkms/vkms_gem.c b/drivers/gpu/drm/vkms/vkms_gem.c
+index ce394009a36c..f731683c932e 100644
+--- a/drivers/gpu/drm/vkms/vkms_gem.c
++++ b/drivers/gpu/drm/vkms/vkms_gem.c
+@@ -93,10 +93,10 @@ int vkms_gem_fault(struct vm_fault *vmf)
+ return ret;
+ }
+
+-struct drm_gem_object *vkms_gem_create(struct drm_device *dev,
+- struct drm_file *file,
+- u32 *handle,
+- u64 size)
++static struct drm_gem_object *vkms_gem_create(struct drm_device *dev,
++ struct drm_file *file,
++ u32 *handle,
++ u64 size)
+ {
+ struct vkms_gem_object *obj;
+ int ret;
+@@ -109,7 +109,6 @@ struct drm_gem_object *vkms_gem_create(struct drm_device *dev,
+ return ERR_CAST(obj);
+
+ ret = drm_gem_handle_create(file, &obj->gem, handle);
+- drm_gem_object_put_unlocked(&obj->gem);
+ if (ret)
+ return ERR_PTR(ret);
+
+@@ -138,6 +137,8 @@ int vkms_dumb_create(struct drm_file *file, struct drm_device *dev,
+ args->size = gem_obj->size;
+ args->pitch = pitch;
+
++ drm_gem_object_put_unlocked(gem_obj);
++
+ DRM_DEBUG_DRIVER("Created object of size %lld\n", size);
+
+ return 0;
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index 2cef0c37ff6f..bc6871c8dd4e 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -23,6 +23,7 @@
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/pci.h>
++#include <linux/pci_ids.h>
+ #include <asm/amd_nb.h>
+ #include <asm/processor.h>
+
+@@ -41,14 +42,6 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+ #define PCI_DEVICE_ID_AMD_15H_M70H_NB_F3 0x15b3
+ #endif
+
+-#ifndef PCI_DEVICE_ID_AMD_17H_DF_F3
+-#define PCI_DEVICE_ID_AMD_17H_DF_F3 0x1463
+-#endif
+-
+-#ifndef PCI_DEVICE_ID_AMD_17H_M10H_DF_F3
+-#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F3 0x15eb
+-#endif
+-
+ /* CPUID function 0x80000001, ebx */
+ #define CPUID_PKGTYPE_MASK 0xf0000000
+ #define CPUID_PKGTYPE_F 0x00000000
+diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
+index 835d54ac2971..231675b10376 100644
+--- a/drivers/i2c/busses/i2c-eg20t.c
++++ b/drivers/i2c/busses/i2c-eg20t.c
+@@ -177,7 +177,6 @@ static wait_queue_head_t pch_event;
+ static DEFINE_MUTEX(pch_mutex);
+
+ /* Definition for ML7213 by LAPIS Semiconductor */
+-#define PCI_VENDOR_ID_ROHM 0x10DB
+ #define PCI_DEVICE_ID_ML7213_I2C 0x802D
+ #define PCI_DEVICE_ID_ML7223_I2C 0x8010
+ #define PCI_DEVICE_ID_ML7831_I2C 0x8817
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 5404717998b0..fc4b46258c75 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -360,6 +360,8 @@ static __poll_t ib_uverbs_event_poll(struct ib_uverbs_event_queue *ev_queue,
+ spin_lock_irq(&ev_queue->lock);
+ if (!list_empty(&ev_queue->event_list))
+ pollflags = EPOLLIN | EPOLLRDNORM;
++ else if (ev_queue->is_closed)
++ pollflags = EPOLLERR;
+ spin_unlock_irq(&ev_queue->lock);
+
+ return pollflags;
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index d9042d0566ab..671e018eb363 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -173,6 +173,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN005b", /* P50 */
+ "LEN005e", /* T560 */
+ "LEN006c", /* T470s */
++ "LEN007a", /* T470s */
+ "LEN0071", /* T480 */
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN0073", /* X1 Carbon G5 (Elantech) */
+diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
+index a5ab774da4cc..fca908ba4841 100644
+--- a/drivers/input/touchscreen/mms114.c
++++ b/drivers/input/touchscreen/mms114.c
+@@ -91,15 +91,15 @@ static int __mms114_read_reg(struct mms114_data *data, unsigned int reg,
+ if (reg <= MMS114_MODE_CONTROL && reg + len > MMS114_MODE_CONTROL)
+ BUG();
+
+- /* Write register: use repeated start */
++ /* Write register */
+ xfer[0].addr = client->addr;
+- xfer[0].flags = I2C_M_TEN | I2C_M_NOSTART;
++ xfer[0].flags = client->flags & I2C_M_TEN;
+ xfer[0].len = 1;
+ xfer[0].buf = &buf;
+
+ /* Read data */
+ xfer[1].addr = client->addr;
+- xfer[1].flags = I2C_M_RD;
++ xfer[1].flags = (client->flags & I2C_M_TEN) | I2C_M_RD;
+ xfer[1].len = len;
+ xfer[1].buf = val;
+
+@@ -428,10 +428,8 @@ static int mms114_probe(struct i2c_client *client,
+ const void *match_data;
+ int error;
+
+- if (!i2c_check_functionality(client->adapter,
+- I2C_FUNC_PROTOCOL_MANGLING)) {
+- dev_err(&client->dev,
+- "Need i2c bus that supports protocol mangling\n");
++ if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
++ dev_err(&client->dev, "Not supported I2C adapter\n");
+ return -ENODEV;
+ }
+
+diff --git a/drivers/isdn/hardware/mISDN/w6692.c b/drivers/isdn/hardware/mISDN/w6692.c
+index 5acf6ab67cd3..6f60aced11c5 100644
+--- a/drivers/isdn/hardware/mISDN/w6692.c
++++ b/drivers/isdn/hardware/mISDN/w6692.c
+@@ -52,10 +52,7 @@ static const struct w6692map w6692_map[] =
+ {W6692_USR, "USR W6692"}
+ };
+
+-#ifndef PCI_VENDOR_ID_USR
+-#define PCI_VENDOR_ID_USR 0x16ec
+ #define PCI_DEVICE_ID_USR_6692 0x3409
+-#endif
+
+ struct w6692_ch {
+ struct bchannel bch;
+diff --git a/drivers/macintosh/windfarm_pm112.c b/drivers/macintosh/windfarm_pm112.c
+index fec91db1142e..6ece5c1a7840 100644
+--- a/drivers/macintosh/windfarm_pm112.c
++++ b/drivers/macintosh/windfarm_pm112.c
+@@ -133,14 +133,6 @@ static int create_cpu_loop(int cpu)
+ s32 tmax;
+ int fmin;
+
+- /* Get PID params from the appropriate SAT */
+- hdr = smu_sat_get_sdb_partition(chip, 0xC8 + core, NULL);
+- if (hdr == NULL) {
+- printk(KERN_WARNING"windfarm: can't get CPU PID fan config\n");
+- return -EINVAL;
+- }
+- piddata = (struct smu_sdbp_cpupiddata *)&hdr[1];
+-
+ /* Get FVT params to get Tmax; if not found, assume default */
+ hdr = smu_sat_get_sdb_partition(chip, 0xC4 + core, NULL);
+ if (hdr) {
+@@ -153,6 +145,16 @@ static int create_cpu_loop(int cpu)
+ if (tmax < cpu_all_tmax)
+ cpu_all_tmax = tmax;
+
++ kfree(hdr);
++
++ /* Get PID params from the appropriate SAT */
++ hdr = smu_sat_get_sdb_partition(chip, 0xC8 + core, NULL);
++ if (hdr == NULL) {
++ printk(KERN_WARNING"windfarm: can't get CPU PID fan config\n");
++ return -EINVAL;
++ }
++ piddata = (struct smu_sdbp_cpupiddata *)&hdr[1];
++
+ /*
+ * Darwin has a minimum fan speed of 1000 rpm for the 4-way and
+ * 515 for the 2-way. That appears to be overkill, so for now,
+@@ -175,6 +177,9 @@ static int create_cpu_loop(int cpu)
+ pid.min = fmin;
+
+ wf_cpu_pid_init(&cpu_pid[cpu], &pid);
++
++ kfree(hdr);
++
+ return 0;
+ }
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 5b5cbfadd003..68ebc2759c2e 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -775,7 +775,9 @@ static void bcache_device_free(struct bcache_device *d)
+ bcache_device_detach(d);
+
+ if (disk) {
+- if (disk->flags & GENHD_FL_UP)
++ bool disk_added = (disk->flags & GENHD_FL_UP) != 0;
++
++ if (disk_added)
+ del_gendisk(disk);
+
+ if (disk->queue)
+@@ -783,7 +785,8 @@ static void bcache_device_free(struct bcache_device *d)
+
+ ida_simple_remove(&bcache_device_idx,
+ first_minor_to_idx(disk->first_minor));
+- put_disk(disk);
++ if (disk_added)
++ put_disk(disk);
+ }
+
+ bioset_exit(&d->bio_split);
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 750f8b34e693..07661c3c1513 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -3078,7 +3078,7 @@ static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits)
+ limits->max_segment_size = PAGE_SIZE;
+
+ limits->logical_block_size =
+- max_t(unsigned short, limits->logical_block_size, cc->sector_size);
++ max_t(unsigned, limits->logical_block_size, cc->sector_size);
+ limits->physical_block_size =
+ max_t(unsigned, limits->physical_block_size, cc->sector_size);
+ limits->io_min = max_t(unsigned, limits->io_min, cc->sector_size);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 9426976e0860..a6db4fd267aa 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7438,7 +7438,8 @@ static int md_open(struct block_device *bdev, fmode_t mode)
+ */
+ mddev_put(mddev);
+ /* Wait until bdev->bd_disk is definitely gone */
+- flush_workqueue(md_misc_wq);
++ if (work_pending(&mddev->del_work))
++ flush_workqueue(md_misc_wq);
+ /* Then retry the open from the top */
+ return -ERESTARTSYS;
+ }
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index ba7e976bf6dc..60b20ae02b05 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -1668,6 +1668,10 @@ int __cec_s_log_addrs(struct cec_adapter *adap,
+ unsigned j;
+
+ log_addrs->log_addr[i] = CEC_LOG_ADDR_INVALID;
++ if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
++ dprintk(1, "unknown logical address type\n");
++ return -EINVAL;
++ }
+ if (type_mask & (1 << log_addrs->log_addr_type[i])) {
+ dprintk(1, "duplicate logical address type\n");
+ return -EINVAL;
+@@ -1688,10 +1692,6 @@ int __cec_s_log_addrs(struct cec_adapter *adap,
+ dprintk(1, "invalid primary device type\n");
+ return -EINVAL;
+ }
+- if (log_addrs->log_addr_type[i] > CEC_LOG_ADDR_TYPE_UNREGISTERED) {
+- dprintk(1, "unknown logical address type\n");
+- return -EINVAL;
+- }
+ for (j = 0; j < feature_sz; j++) {
+ if ((features[j] & 0x80) == 0) {
+ if (op_is_dev_features)
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 2023df14f828..aa9c0b7ee7a2 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -2829,8 +2829,8 @@ static int ov5640_probe(struct i2c_client *client,
+ free_ctrls:
+ v4l2_ctrl_handler_free(&sensor->ctrls.handler);
+ entity_cleanup:
+- mutex_destroy(&sensor->lock);
+ media_entity_cleanup(&sensor->sd.entity);
++ mutex_destroy(&sensor->lock);
+ return ret;
+ }
+
+@@ -2840,9 +2840,9 @@ static int ov5640_remove(struct i2c_client *client)
+ struct ov5640_dev *sensor = to_ov5640_dev(sd);
+
+ v4l2_async_unregister_subdev(&sensor->sd);
+- mutex_destroy(&sensor->lock);
+ media_entity_cleanup(&sensor->sd.entity);
+ v4l2_ctrl_handler_free(&sensor->ctrls.handler);
++ mutex_destroy(&sensor->lock);
+
+ return 0;
+ }
+diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c
+index 43c78620c9d8..5c6b00737fe7 100644
+--- a/drivers/media/platform/rcar-fcp.c
++++ b/drivers/media/platform/rcar-fcp.c
+@@ -8,6 +8,7 @@
+ */
+
+ #include <linux/device.h>
++#include <linux/dma-mapping.h>
+ #include <linux/list.h>
+ #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
+@@ -21,6 +22,7 @@
+ struct rcar_fcp_device {
+ struct list_head list;
+ struct device *dev;
++ struct device_dma_parameters dma_parms;
+ };
+
+ static LIST_HEAD(fcp_devices);
+@@ -136,6 +138,9 @@ static int rcar_fcp_probe(struct platform_device *pdev)
+
+ fcp->dev = &pdev->dev;
+
++ fcp->dev->dma_parms = &fcp->dma_parms;
++ dma_set_max_seg_size(fcp->dev, DMA_BIT_MASK(32));
++
+ pm_runtime_enable(&pdev->dev);
+
+ mutex_lock(&fcp_lock);
+diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c
+index a08d8fe2bb1b..13770b038048 100644
+--- a/drivers/media/tuners/si2157.c
++++ b/drivers/media/tuners/si2157.c
+@@ -84,24 +84,23 @@ static int si2157_init(struct dvb_frontend *fe)
+ struct si2157_cmd cmd;
+ const struct firmware *fw;
+ const char *fw_name;
+- unsigned int uitmp, chip_id;
++ unsigned int chip_id, xtal_trim;
+
+ dev_dbg(&client->dev, "\n");
+
+- /* Returned IF frequency is garbage when firmware is not running */
+- memcpy(cmd.args, "\x15\x00\x06\x07", 4);
++ /* Try to get Xtal trim property, to verify tuner still running */
++ memcpy(cmd.args, "\x15\x00\x04\x02", 4);
+ cmd.wlen = 4;
+ cmd.rlen = 4;
+ ret = si2157_cmd_execute(client, &cmd);
+- if (ret)
+- goto err;
+
+- uitmp = cmd.args[2] << 0 | cmd.args[3] << 8;
+- dev_dbg(&client->dev, "if_frequency kHz=%u\n", uitmp);
++ xtal_trim = cmd.args[2] | (cmd.args[3] << 8);
+
+- if (uitmp == dev->if_frequency / 1000)
++ if (ret == 0 && xtal_trim < 16)
+ goto warm;
+
++ dev->if_frequency = 0; /* we no longer know current tuner state */
++
+ /* power up */
+ if (dev->chiptype == SI2157_CHIPTYPE_SI2146) {
+ memcpy(cmd.args, "\xc0\x05\x01\x00\x00\x0b\x00\x00\x01", 9);
+diff --git a/drivers/media/usb/dvb-usb/dibusb-mb.c b/drivers/media/usb/dvb-usb/dibusb-mb.c
+index 408920577716..94f59c7765dc 100644
+--- a/drivers/media/usb/dvb-usb/dibusb-mb.c
++++ b/drivers/media/usb/dvb-usb/dibusb-mb.c
+@@ -84,7 +84,7 @@ static int dibusb_tuner_probe_and_attach(struct dvb_usb_adapter *adap)
+
+ if (i2c_transfer(&adap->dev->i2c_adap, msg, 2) != 2) {
+ err("tuner i2c write failed.");
+- ret = -EREMOTEIO;
++ return -EREMOTEIO;
+ }
+
+ if (adap->fe_adap[0].fe->ops.i2c_gate_ctrl)
+diff --git a/drivers/media/usb/go7007/snd-go7007.c b/drivers/media/usb/go7007/snd-go7007.c
+index 137fc253b122..96c37a131deb 100644
+--- a/drivers/media/usb/go7007/snd-go7007.c
++++ b/drivers/media/usb/go7007/snd-go7007.c
+@@ -244,22 +244,18 @@ int go7007_snd_init(struct go7007 *go)
+ gosnd->capturing = 0;
+ ret = snd_card_new(go->dev, index[dev], id[dev], THIS_MODULE, 0,
+ &gosnd->card);
+- if (ret < 0) {
+- kfree(gosnd);
+- return ret;
+- }
++ if (ret < 0)
++ goto free_snd;
++
+ ret = snd_device_new(gosnd->card, SNDRV_DEV_LOWLEVEL, go,
+ &go7007_snd_device_ops);
+- if (ret < 0) {
+- kfree(gosnd);
+- return ret;
+- }
++ if (ret < 0)
++ goto free_card;
++
+ ret = snd_pcm_new(gosnd->card, "go7007", 0, 0, 1, &gosnd->pcm);
+- if (ret < 0) {
+- snd_card_free(gosnd->card);
+- kfree(gosnd);
+- return ret;
+- }
++ if (ret < 0)
++ goto free_card;
++
+ strlcpy(gosnd->card->driver, "go7007", sizeof(gosnd->card->driver));
+ strlcpy(gosnd->card->shortname, go->name, sizeof(gosnd->card->driver));
+ strlcpy(gosnd->card->longname, gosnd->card->shortname,
+@@ -270,11 +266,8 @@ int go7007_snd_init(struct go7007 *go)
+ &go7007_snd_capture_ops);
+
+ ret = snd_card_register(gosnd->card);
+- if (ret < 0) {
+- snd_card_free(gosnd->card);
+- kfree(gosnd);
+- return ret;
+- }
++ if (ret < 0)
++ goto free_card;
+
+ gosnd->substream = NULL;
+ go->snd_context = gosnd;
+@@ -282,6 +275,12 @@ int go7007_snd_init(struct go7007 *go)
+ ++dev;
+
+ return 0;
++
++free_card:
++ snd_card_free(gosnd->card);
++free_snd:
++ kfree(gosnd);
++ return ret;
+ }
+ EXPORT_SYMBOL(go7007_snd_init);
+
+diff --git a/drivers/misc/pch_phub.c b/drivers/misc/pch_phub.c
+index 540845651b8c..309703e9c42e 100644
+--- a/drivers/misc/pch_phub.c
++++ b/drivers/misc/pch_phub.c
+@@ -64,7 +64,6 @@
+ #define CLKCFG_UARTCLKSEL (1 << 18)
+
+ /* Macros for ML7213 */
+-#define PCI_VENDOR_ID_ROHM 0x10db
+ #define PCI_DEVICE_ID_ROHM_ML7213_PHUB 0x801A
+
+ /* Macros for ML7223 */
+diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
+index 727dc6ec427d..7d166f57f624 100644
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -75,6 +75,11 @@
+ #define PCI_ENDPOINT_TEST_IRQ_TYPE 0x24
+ #define PCI_ENDPOINT_TEST_IRQ_NUMBER 0x28
+
++#define PCI_DEVICE_ID_TI_AM654 0xb00c
++
++#define is_am654_pci_dev(pdev) \
++ ((pdev)->device == PCI_DEVICE_ID_TI_AM654)
++
+ static DEFINE_IDA(pci_endpoint_test_ida);
+
+ #define to_endpoint_test(priv) container_of((priv), struct pci_endpoint_test, \
+@@ -593,6 +598,7 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd,
+ int ret = -EINVAL;
+ enum pci_barno bar;
+ struct pci_endpoint_test *test = to_endpoint_test(file->private_data);
++ struct pci_dev *pdev = test->pdev;
+
+ mutex_lock(&test->mutex);
+ switch (cmd) {
+@@ -600,6 +606,8 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd,
+ bar = arg;
+ if (bar < 0 || bar > 5)
+ goto ret;
++ if (is_am654_pci_dev(pdev) && bar == BAR_0)
++ goto ret;
+ ret = pci_endpoint_test_bar(test, bar);
+ break;
+ case PCITEST_LEGACY_IRQ:
+@@ -792,10 +800,20 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev)
+ pci_disable_device(pdev);
+ }
+
++static const struct pci_endpoint_test_data am654_data = {
++ .test_reg_bar = BAR_2,
++ .alignment = SZ_64K,
++ .irq_type = IRQ_TYPE_MSI,
++};
++
+ static const struct pci_device_id pci_endpoint_test_tbl[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_DRA74x) },
+ { PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_DRA72x) },
+- { PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS, 0xedda) },
++ { PCI_DEVICE(PCI_VENDOR_ID_FREESCALE, 0x81c0) },
++ { PCI_DEVICE_DATA(SYNOPSYS, EDDA, NULL) },
++ { PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_AM654),
++ .driver_data = (kernel_ulong_t)&am654_data
++ },
+ { }
+ };
+ MODULE_DEVICE_TABLE(pci, pci_endpoint_test_tbl);
+diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
+index 0aa99694b937..4e72ad24322f 100644
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -720,9 +720,8 @@ try_again:
+ /* Retry init sequence, but without R4_18V_PRESENT. */
+ retries = 0;
+ goto try_again;
+- } else {
+- goto remove;
+ }
++ return err;
+ }
+
+ /*
+diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c
+index 1c062473b1c2..27837a794e7b 100644
+--- a/drivers/mmc/host/meson-mx-sdio.c
++++ b/drivers/mmc/host/meson-mx-sdio.c
+@@ -249,6 +249,9 @@ static void meson_mx_mmc_request_done(struct meson_mx_mmc_host *host)
+
+ mrq = host->mrq;
+
++ if (host->cmd->error)
++ meson_mx_mmc_soft_reset(host);
++
+ host->mrq = NULL;
+ host->cmd = NULL;
+
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index 629860f7327c..bd502f4f4704 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -82,7 +82,7 @@
+ #define ESDHC_STD_TUNING_EN (1 << 24)
+ /* NOTE: the minimum valid tuning start tap for mx6sl is 1 */
+ #define ESDHC_TUNING_START_TAP_DEFAULT 0x1
+-#define ESDHC_TUNING_START_TAP_MASK 0xff
++#define ESDHC_TUNING_START_TAP_MASK 0x7f
+ #define ESDHC_TUNING_STEP_MASK 0x00070000
+ #define ESDHC_TUNING_STEP_SHIFT 16
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 19ae527ecc72..643fd1a1b88b 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -1083,6 +1083,12 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ /* Clock-Data-Recovery used to dynamically adjust RX sampling point */
+ msm_host->use_cdr = true;
+
++ /*
++ * Clear tuning_done flag before tuning to ensure proper
++ * HS400 settings.
++ */
++ msm_host->tuning_done = 0;
++
+ /*
+ * For HS400 tuning in HS200 timing requires:
+ * - select MCLK/2 in VENDOR_SPEC
+@@ -1700,7 +1706,9 @@ static const struct sdhci_ops sdhci_msm_ops = {
+ static const struct sdhci_pltfm_data sdhci_msm_pdata = {
+ .quirks = SDHCI_QUIRK_BROKEN_CARD_DETECTION |
+ SDHCI_QUIRK_SINGLE_POWER_WRITE |
+- SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN,
++ SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN |
++ SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12,
++
+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
+ .ops = &sdhci_msm_ops,
+ };
+diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c
+index 32c4211506fc..246dc6255e69 100644
+--- a/drivers/mmc/host/via-sdmmc.c
++++ b/drivers/mmc/host/via-sdmmc.c
+@@ -323,6 +323,8 @@ struct via_crdr_mmc_host {
+ /* some devices need a very long delay for power to stabilize */
+ #define VIA_CRDR_QUIRK_300MS_PWRDELAY 0x0001
+
++#define VIA_CMD_TIMEOUT_MS 1000
++
+ static const struct pci_device_id via_ids[] = {
+ {PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_9530,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0,},
+@@ -555,14 +557,17 @@ static void via_sdc_send_command(struct via_crdr_mmc_host *host,
+ {
+ void __iomem *addrbase;
+ struct mmc_data *data;
++ unsigned int timeout_ms;
+ u32 cmdctrl = 0;
+
+ WARN_ON(host->cmd);
+
+ data = cmd->data;
+- mod_timer(&host->timer, jiffies + HZ);
+ host->cmd = cmd;
+
++ timeout_ms = cmd->busy_timeout ? cmd->busy_timeout : VIA_CMD_TIMEOUT_MS;
++ mod_timer(&host->timer, jiffies + msecs_to_jiffies(timeout_ms));
++
+ /*Command index*/
+ cmdctrl = cmd->opcode << 8;
+
+diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+index 4b90d5b380c2..8002a2a390e5 100644
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -911,11 +911,14 @@ static int brcmnand_hamming_ooblayout_free(struct mtd_info *mtd, int section,
+ if (!section) {
+ /*
+ * Small-page NAND use byte 6 for BBI while large-page
+- * NAND use byte 0.
++ * NAND use bytes 0 and 1.
+ */
+- if (cfg->page_size > 512)
+- oobregion->offset++;
+- oobregion->length--;
++ if (cfg->page_size > 512) {
++ oobregion->offset += 2;
++ oobregion->length -= 2;
++ } else {
++ oobregion->length--;
++ }
+ }
+ }
+
+diff --git a/drivers/mtd/nand/raw/pasemi_nand.c b/drivers/mtd/nand/raw/pasemi_nand.c
+index a47a7e4bd25a..d69e5bae541e 100644
+--- a/drivers/mtd/nand/raw/pasemi_nand.c
++++ b/drivers/mtd/nand/raw/pasemi_nand.c
+@@ -163,7 +163,7 @@ static int pasemi_nand_probe(struct platform_device *ofdev)
+ if (mtd_device_register(pasemi_nand_mtd, NULL, 0)) {
+ dev_err(dev, "Unable to register MTD device\n");
+ err = -ENODEV;
+- goto out_lpc;
++ goto out_cleanup_nand;
+ }
+
+ dev_info(dev, "PA Semi NAND flash at %pR, control at I/O %x\n", &res,
+@@ -171,6 +171,8 @@ static int pasemi_nand_probe(struct platform_device *ofdev)
+
+ return 0;
+
++ out_cleanup_nand:
++ nand_cleanup(chip);
+ out_lpc:
+ release_region(lpcctl, 4);
+ out_ior:
+diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
+index 3143de45baaa..c458b81ba63a 100644
+--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
+@@ -433,7 +433,7 @@ static void emac_timeout(struct net_device *dev)
+ /* Hardware start transmission.
+ * Send a packet to media from the upper layer.
+ */
+-static int emac_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t emac_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct emac_board_info *db = netdev_priv(dev);
+ unsigned long channel;
+@@ -441,7 +441,7 @@ static int emac_start_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ channel = db->tx_fifo_stat & 3;
+ if (channel == 3)
+- return 1;
++ return NETDEV_TX_BUSY;
+
+ channel = (channel == 1 ? 1 : 0);
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
+index 3afc0e59a2bd..d07f7f65169a 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -2137,6 +2137,9 @@ int ena_com_get_hash_function(struct ena_com_dev *ena_dev,
+ rss->hash_key;
+ int rc;
+
++ if (unlikely(!func))
++ return -EINVAL;
++
+ rc = ena_com_get_feature_ex(ena_dev, &get_resp,
+ ENA_ADMIN_RSS_HASH_FUNCTION,
+ rss->hash_key_dma_addr,
+@@ -2149,8 +2152,7 @@ int ena_com_get_hash_function(struct ena_com_dev *ena_dev,
+ if (rss->hash_func)
+ rss->hash_func--;
+
+- if (func)
+- *func = rss->hash_func;
++ *func = rss->hash_func;
+
+ if (key)
+ memcpy(key, hash_key->key, (size_t)(hash_key->keys_num) << 2);
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index 15dcfb6704e5..adac5df0d6b4 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -620,6 +620,9 @@ int aq_nic_get_regs(struct aq_nic_s *self, struct ethtool_regs *regs, void *p)
+ u32 *regs_buff = p;
+ int err = 0;
+
++ if (unlikely(!self->aq_hw_ops->hw_get_regs))
++ return -EOPNOTSUPP;
++
+ regs->version = 1;
+
+ err = self->aq_hw_ops->hw_get_regs(self->aq_hw,
+@@ -634,6 +637,9 @@ err_exit:
+
+ int aq_nic_get_regs_count(struct aq_nic_s *self)
+ {
++ if (unlikely(!self->aq_hw_ops->hw_get_regs))
++ return 0;
++
+ return self->aq_nic_cfg.aq_hw_caps->mac_regs_count;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 047fc0cf0263..40e8ef984b62 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -72,6 +72,9 @@
+ #define GENET_RDMA_REG_OFF (priv->hw_params->rdma_offset + \
+ TOTAL_DESC * DMA_DESC_SIZE)
+
++/* Forward declarations */
++static void bcmgenet_set_rx_mode(struct net_device *dev);
++
+ static inline void bcmgenet_writel(u32 value, void __iomem *offset)
+ {
+ /* MIPS chips strapped for BE will automagically configure the
+@@ -2859,6 +2862,7 @@ static void bcmgenet_netif_start(struct net_device *dev)
+ struct bcmgenet_priv *priv = netdev_priv(dev);
+
+ /* Start the network engine */
++ bcmgenet_set_rx_mode(dev);
+ bcmgenet_enable_rx_napi(priv);
+
+ umac_enable_set(priv, CMD_TX_EN | CMD_RX_EN, true);
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index abfd990ba4d8..645298628b6f 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -4295,12 +4295,10 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
+ dev_err(dev, "Error %ld in VERSION_EXCHG_RSP\n", rc);
+ break;
+ }
+- dev_info(dev, "Partner protocol version is %d\n",
+- crq->version_exchange_rsp.version);
+- if (be16_to_cpu(crq->version_exchange_rsp.version) <
+- ibmvnic_version)
+- ibmvnic_version =
++ ibmvnic_version =
+ be16_to_cpu(crq->version_exchange_rsp.version);
++ dev_info(dev, "Partner protocol version is %d\n",
++ ibmvnic_version);
+ send_cap_queries(adapter);
+ break;
+ case QUERY_CAPABILITY_RSP:
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index 2110d5f2da19..47b867c64b14 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -3144,8 +3144,9 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
+ hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
+ if (skb->data_len && hdr_len == len) {
+ switch (hw->mac_type) {
++ case e1000_82544: {
+ unsigned int pull_size;
+- case e1000_82544:
++
+ /* Make sure we have room to chop off 4 bytes,
+ * and that the end alignment will work out to
+ * this hardware's requirements
+@@ -3166,6 +3167,7 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
+ }
+ len = skb_headlen(skb);
+ break;
++ }
+ default:
+ /* do nothing */
+ break;
+diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
+index c760dc72c520..c5a119daa7f3 100644
+--- a/drivers/net/ethernet/intel/e1000e/e1000.h
++++ b/drivers/net/ethernet/intel/e1000e/e1000.h
+@@ -574,7 +574,6 @@ static inline u32 __er32(struct e1000_hw *hw, unsigned long reg)
+
+ #define er32(reg) __er32(hw, E1000_##reg)
+
+-s32 __ew32_prepare(struct e1000_hw *hw);
+ void __ew32(struct e1000_hw *hw, unsigned long reg, u32 val);
+
+ #define ew32(reg, val) __ew32(hw, E1000_##reg, (val))
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index a7b5a47ab83d..589a5296da4b 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -119,14 +119,12 @@ static const struct e1000_reg_info e1000_reg_info_tbl[] = {
+ * has bit 24 set while ME is accessing MAC CSR registers, wait if it is set
+ * and try again a number of times.
+ **/
+-s32 __ew32_prepare(struct e1000_hw *hw)
++static void __ew32_prepare(struct e1000_hw *hw)
+ {
+ s32 i = E1000_ICH_FWSM_PCIM2PCI_COUNT;
+
+ while ((er32(FWSM) & E1000_ICH_FWSM_PCIM2PCI) && --i)
+ udelay(50);
+-
+- return i;
+ }
+
+ void __ew32(struct e1000_hw *hw, unsigned long reg, u32 val)
+@@ -607,11 +605,11 @@ static void e1000e_update_rdt_wa(struct e1000_ring *rx_ring, unsigned int i)
+ {
+ struct e1000_adapter *adapter = rx_ring->adapter;
+ struct e1000_hw *hw = &adapter->hw;
+- s32 ret_val = __ew32_prepare(hw);
+
++ __ew32_prepare(hw);
+ writel(i, rx_ring->tail);
+
+- if (unlikely(!ret_val && (i != readl(rx_ring->tail)))) {
++ if (unlikely(i != readl(rx_ring->tail))) {
+ u32 rctl = er32(RCTL);
+
+ ew32(RCTL, rctl & ~E1000_RCTL_EN);
+@@ -624,11 +622,11 @@ static void e1000e_update_tdt_wa(struct e1000_ring *tx_ring, unsigned int i)
+ {
+ struct e1000_adapter *adapter = tx_ring->adapter;
+ struct e1000_hw *hw = &adapter->hw;
+- s32 ret_val = __ew32_prepare(hw);
+
++ __ew32_prepare(hw);
+ writel(i, tx_ring->tail);
+
+- if (unlikely(!ret_val && (i != readl(tx_ring->tail)))) {
++ if (unlikely(i != readl(tx_ring->tail))) {
+ u32 tctl = er32(TCTL);
+
+ ew32(TCTL, tctl & ~E1000_TCTL_EN);
+@@ -5251,6 +5249,10 @@ static void e1000_watchdog_task(struct work_struct *work)
+ /* oops */
+ break;
+ }
++ if (hw->mac.type == e1000_pch_spt) {
++ netdev->features &= ~NETIF_F_TSO;
++ netdev->features &= ~NETIF_F_TSO6;
++ }
+ }
+
+ /* enable transmits in the hardware, need to do this
+diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+index 50954e444985..2e17625e6c35 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+@@ -143,7 +143,8 @@ static int igb_get_link_ksettings(struct net_device *netdev,
+ u32 speed;
+ u32 supported, advertising;
+
+- status = rd32(E1000_STATUS);
++ status = pm_runtime_suspended(&adapter->pdev->dev) ?
++ 0 : rd32(E1000_STATUS);
+ if (hw->phy.media_type == e1000_media_type_copper) {
+
+ supported = (SUPPORTED_10baseT_Half |
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+index 0bd1294ba517..39c5e6fdb72c 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+@@ -2243,7 +2243,7 @@ s32 ixgbe_fc_enable_generic(struct ixgbe_hw *hw)
+ }
+
+ /* Configure pause time (2 TCs per register) */
+- reg = hw->fc.pause_time * 0x00010001;
++ reg = hw->fc.pause_time * 0x00010001U;
+ for (i = 0; i < (MAX_TRAFFIC_CLASS / 2); i++)
+ IXGBE_WRITE_REG(hw, IXGBE_FCTTV(i), reg);
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 8177276500f5..7d723b70fcf6 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -2258,7 +2258,8 @@ static void ixgbe_rx_buffer_flip(struct ixgbe_ring *rx_ring,
+ rx_buffer->page_offset ^= truesize;
+ #else
+ unsigned int truesize = ring_uses_build_skb(rx_ring) ?
+- SKB_DATA_ALIGN(IXGBE_SKB_PAD + size) :
++ SKB_DATA_ALIGN(IXGBE_SKB_PAD + size) +
++ SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) :
+ SKB_DATA_ALIGN(size);
+
+ rx_buffer->page_offset += truesize;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index 044687a1f27c..9d86e49a7f44 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -1314,6 +1314,7 @@ out:
+
+ #ifdef CONFIG_MLX5_CORE_IPOIB
+
++#define MLX5_IB_GRH_SGID_OFFSET 8
+ #define MLX5_IB_GRH_DGID_OFFSET 24
+ #define MLX5_GID_SIZE 16
+
+@@ -1327,6 +1328,7 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
+ struct net_device *netdev;
+ struct mlx5e_priv *priv;
+ char *pseudo_header;
++ u32 flags_rqpn;
+ u32 qpn;
+ u8 *dgid;
+ u8 g;
+@@ -1347,7 +1349,8 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
+ priv = mlx5i_epriv(netdev);
+ tstamp = &priv->tstamp;
+
+- g = (be32_to_cpu(cqe->flags_rqpn) >> 28) & 3;
++ flags_rqpn = be32_to_cpu(cqe->flags_rqpn);
++ g = (flags_rqpn >> 28) & 3;
+ dgid = skb->data + MLX5_IB_GRH_DGID_OFFSET;
+ if ((!g) || dgid[0] != 0xff)
+ skb->pkt_type = PACKET_HOST;
+@@ -1356,9 +1359,15 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
+ else
+ skb->pkt_type = PACKET_MULTICAST;
+
+- /* TODO: IB/ipoib: Allow mcast packets from other VFs
+- * 68996a6e760e5c74654723eeb57bf65628ae87f4
++ /* Drop packets that this interface sent, ie multicast packets
++ * that the HCA has replicated.
+ */
++ if (g && (qpn == (flags_rqpn & 0xffffff)) &&
++ (memcmp(netdev->dev_addr + 4, skb->data + MLX5_IB_GRH_SGID_OFFSET,
++ MLX5_GID_SIZE) == 0)) {
++ skb->dev = NULL;
++ return;
++ }
+
+ skb_pull(skb, MLX5_IB_GRH_BYTES);
+
+diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
+index 41d30f55c946..6bd6c261f2ba 100644
+--- a/drivers/net/ethernet/nxp/lpc_eth.c
++++ b/drivers/net/ethernet/nxp/lpc_eth.c
+@@ -845,7 +845,8 @@ static int lpc_mii_init(struct netdata_local *pldat)
+ if (mdiobus_register(pldat->mii_bus))
+ goto err_out_unregister_bus;
+
+- if (lpc_mii_probe(pldat->ndev) != 0)
++ err = lpc_mii_probe(pldat->ndev);
++ if (err)
+ goto err_out_unregister_bus;
+
+ return 0;
+diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+index 43c0c10dfeb7..3a4225837049 100644
+--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
++++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+@@ -27,7 +27,6 @@
+ #define DRV_VERSION "1.01"
+ const char pch_driver_version[] = DRV_VERSION;
+
+-#define PCI_DEVICE_ID_INTEL_IOH1_GBE 0x8802 /* Pci device ID */
+ #define PCH_GBE_MAR_ENTRIES 16
+ #define PCH_GBE_SHORT_PKT 64
+ #define DSC_INIT16 0xC000
+@@ -37,11 +36,9 @@ const char pch_driver_version[] = DRV_VERSION;
+ #define PCH_GBE_PCI_BAR 1
+ #define PCH_GBE_RESERVE_MEMORY 0x200000 /* 2MB */
+
+-/* Macros for ML7223 */
+-#define PCI_VENDOR_ID_ROHM 0x10db
+-#define PCI_DEVICE_ID_ROHM_ML7223_GBE 0x8013
++#define PCI_DEVICE_ID_INTEL_IOH1_GBE 0x8802
+
+-/* Macros for ML7831 */
++#define PCI_DEVICE_ID_ROHM_ML7223_GBE 0x8013
+ #define PCI_DEVICE_ID_ROHM_ML7831_GBE 0x8802
+
+ #define PCH_GBE_TX_WEIGHT 64
+diff --git a/drivers/net/ethernet/qlogic/qede/qede.h b/drivers/net/ethernet/qlogic/qede/qede.h
+index dc3be8a4acf4..2bdc410d1144 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede.h
++++ b/drivers/net/ethernet/qlogic/qede/qede.h
+@@ -550,12 +550,14 @@ int qede_add_tc_flower_fltr(struct qede_dev *edev, __be16 proto,
+ #define RX_RING_SIZE ((u16)BIT(RX_RING_SIZE_POW))
+ #define NUM_RX_BDS_MAX (RX_RING_SIZE - 1)
+ #define NUM_RX_BDS_MIN 128
++#define NUM_RX_BDS_KDUMP_MIN 63
+ #define NUM_RX_BDS_DEF ((u16)BIT(10) - 1)
+
+ #define TX_RING_SIZE_POW 13
+ #define TX_RING_SIZE ((u16)BIT(TX_RING_SIZE_POW))
+ #define NUM_TX_BDS_MAX (TX_RING_SIZE - 1)
+ #define NUM_TX_BDS_MIN 128
++#define NUM_TX_BDS_KDUMP_MIN 63
+ #define NUM_TX_BDS_DEF NUM_TX_BDS_MAX
+
+ #define QEDE_MIN_PKT_LEN 64
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
+index 0d8e39ffbcd1..1aabb2e7a38b 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
+@@ -29,6 +29,7 @@
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
++#include <linux/crash_dump.h>
+ #include <linux/module.h>
+ #include <linux/pci.h>
+ #include <linux/version.h>
+@@ -730,8 +731,14 @@ static struct qede_dev *qede_alloc_etherdev(struct qed_dev *cdev,
+ edev->dp_module = dp_module;
+ edev->dp_level = dp_level;
+ edev->ops = qed_ops;
+- edev->q_num_rx_buffers = NUM_RX_BDS_DEF;
+- edev->q_num_tx_buffers = NUM_TX_BDS_DEF;
++
++ if (is_kdump_kernel()) {
++ edev->q_num_rx_buffers = NUM_RX_BDS_KDUMP_MIN;
++ edev->q_num_tx_buffers = NUM_TX_BDS_KDUMP_MIN;
++ } else {
++ edev->q_num_rx_buffers = NUM_RX_BDS_DEF;
++ edev->q_num_tx_buffers = NUM_TX_BDS_DEF;
++ }
+
+ DP_INFO(edev, "Allocated netdev with %d tx queues and %d rx queues\n",
+ info->num_queues, info->num_queues);
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 807ef43a3cda..6df404e3dd27 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -229,7 +229,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4300), 0, 0, RTL_CFG_0 },
+ { PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4302), 0, 0, RTL_CFG_0 },
+ { PCI_DEVICE(PCI_VENDOR_ID_AT, 0xc107), 0, 0, RTL_CFG_0 },
+- { PCI_DEVICE(0x16ec, 0x0116), 0, 0, RTL_CFG_0 },
++ { PCI_DEVICE(PCI_VENDOR_ID_USR, 0x0116), 0, 0, RTL_CFG_0 },
+ { PCI_VENDOR_ID_LINKSYS, 0x1032,
+ PCI_ANY_ID, 0x0024, 0, 0, RTL_CFG_0 },
+ { 0x0001, 0x8168,
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 225bfc808112..349123592af0 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -451,6 +451,10 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
+ int ret;
+ rx_handler_result_t handle_res;
+
++ /* Packets from dev_loopback_xmit() do not have L2 header, bail out */
++ if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
++ return RX_HANDLER_PASS;
++
+ port = macvlan_port_get_rcu(skb->dev);
+ if (is_multicast_ether_addr(eth->h_dest)) {
+ unsigned int hash;
+diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c
+index beeb7eb76ca3..57273188b71e 100644
+--- a/drivers/net/net_failover.c
++++ b/drivers/net/net_failover.c
+@@ -62,7 +62,8 @@ static int net_failover_open(struct net_device *dev)
+ return 0;
+
+ err_standby_open:
+- dev_close(primary_dev);
++ if (primary_dev)
++ dev_close(primary_dev);
+ err_primary_open:
+ netif_tx_disable(dev);
+ return err;
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 09c444d3b496..d84a09172ddb 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1870,8 +1870,11 @@ drop:
+ skb->dev = tun->dev;
+ break;
+ case IFF_TAP:
+- if (!frags)
+- skb->protocol = eth_type_trans(skb, tun->dev);
++ if (frags && !pskb_may_pull(skb, ETH_HLEN)) {
++ err = -ENOMEM;
++ goto drop;
++ }
++ skb->protocol = eth_type_trans(skb, tun->dev);
+ break;
+ }
+
+@@ -1927,8 +1930,11 @@ drop:
+ }
+
+ if (frags) {
++ u32 headlen;
++
+ /* Exercise flow dissector code path. */
+- u32 headlen = eth_get_headlen(skb->data, skb_headlen(skb));
++ skb_push(skb, ETH_HLEN);
++ headlen = eth_get_headlen(skb->data, skb_headlen(skb));
+
+ if (unlikely(headlen > skb_headlen(skb))) {
+ this_cpu_inc(tun->pcpu_stats->rx_dropped);
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c
+index 41a00cd76955..2abbad1abaf2 100644
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -377,13 +377,15 @@ static struct sk_buff *veth_xdp_rcv_one(struct veth_rq *rq,
+ unsigned int *xdp_xmit)
+ {
+ void *hard_start = frame->data - frame->headroom;
+- void *head = hard_start - sizeof(struct xdp_frame);
+ int len = frame->len, delta = 0;
+ struct xdp_frame orig_frame;
+ struct bpf_prog *xdp_prog;
+ unsigned int headroom;
+ struct sk_buff *skb;
+
++ /* bpf_xdp_adjust_head() assures BPF cannot access xdp_frame area */
++ hard_start -= sizeof(struct xdp_frame);
++
+ rcu_read_lock();
+ xdp_prog = rcu_dereference(rq->xdp_prog);
+ if (likely(xdp_prog)) {
+@@ -405,7 +407,6 @@ static struct sk_buff *veth_xdp_rcv_one(struct veth_rq *rq,
+ break;
+ case XDP_TX:
+ orig_frame = *frame;
+- xdp.data_hard_start = head;
+ xdp.rxq->mem = frame->mem;
+ if (unlikely(veth_xdp_tx(rq->dev, &xdp) < 0)) {
+ trace_xdp_exception(rq->dev, xdp_prog, act);
+@@ -417,7 +418,6 @@ static struct sk_buff *veth_xdp_rcv_one(struct veth_rq *rq,
+ goto xdp_xmit;
+ case XDP_REDIRECT:
+ orig_frame = *frame;
+- xdp.data_hard_start = head;
+ xdp.rxq->mem = frame->mem;
+ if (xdp_do_redirect(rq->dev, &xdp, xdp_prog)) {
+ frame = &orig_frame;
+@@ -437,7 +437,7 @@ static struct sk_buff *veth_xdp_rcv_one(struct veth_rq *rq,
+ rcu_read_unlock();
+
+ headroom = sizeof(struct xdp_frame) + frame->headroom - delta;
+- skb = veth_build_skb(head, headroom, len, 0);
++ skb = veth_build_skb(hard_start, headroom, len, 0);
+ if (!skb) {
+ xdp_return_frame(frame);
+ goto err;
+diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
+index 559db051a500..88d18ab83e54 100644
+--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
++++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
+@@ -692,6 +692,8 @@ vmxnet3_get_rss(struct net_device *netdev, u32 *p, u8 *key, u8 *hfunc)
+ *hfunc = ETH_RSS_HASH_TOP;
+ if (!p)
+ return 0;
++ if (n > UPT1_RSS_MAX_IND_TABLE_SIZE)
++ return 0;
+ while (n--)
+ p[n] = rssConf->indTable[n];
+ return 0;
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 7ee0bad18466..09f0b53b2b77 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -1611,6 +1611,10 @@ static struct sk_buff *vxlan_na_create(struct sk_buff *request,
+ ns_olen = request->len - skb_network_offset(request) -
+ sizeof(struct ipv6hdr) - sizeof(*ns);
+ for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
++ if (!ns->opt[i + 1]) {
++ kfree_skb(reply);
++ return NULL;
++ }
+ if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
+ daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
+ break;
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index a09d7a07e90a..81af403c19c2 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -3852,6 +3852,9 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
+ if (ret) {
+ ath10k_warn(ar, "failed to transmit management frame by ref via WMI: %d\n",
+ ret);
++ /* remove this msdu from idr tracking */
++ ath10k_wmi_cleanup_mgmt_tx_send(ar, skb);
++
+ dma_unmap_single(ar->dev, paddr, skb->len,
+ DMA_TO_DEVICE);
+ ieee80211_free_txskb(ar->hw, skb);
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-ops.h b/drivers/net/wireless/ath/ath10k/wmi-ops.h
+index 7fd63bbf8e24..b6cd33fa79f8 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-ops.h
++++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h
+@@ -139,6 +139,7 @@ struct wmi_ops {
+ struct sk_buff *(*gen_mgmt_tx_send)(struct ath10k *ar,
+ struct sk_buff *skb,
+ dma_addr_t paddr);
++ int (*cleanup_mgmt_tx_send)(struct ath10k *ar, struct sk_buff *msdu);
+ struct sk_buff *(*gen_dbglog_cfg)(struct ath10k *ar, u64 module_enable,
+ u32 log_level);
+ struct sk_buff *(*gen_pktlog_enable)(struct ath10k *ar, u32 filter);
+@@ -431,6 +432,15 @@ ath10k_wmi_get_txbf_conf_scheme(struct ath10k *ar)
+ return ar->wmi.ops->get_txbf_conf_scheme(ar);
+ }
+
++static inline int
++ath10k_wmi_cleanup_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu)
++{
++ if (!ar->wmi.ops->cleanup_mgmt_tx_send)
++ return -EOPNOTSUPP;
++
++ return ar->wmi.ops->cleanup_mgmt_tx_send(ar, msdu);
++}
++
+ static inline int
+ ath10k_wmi_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu,
+ dma_addr_t paddr)
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index 248decb494c2..7f435fa29f75 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -2638,6 +2638,18 @@ ath10k_wmi_tlv_op_gen_request_stats(struct ath10k *ar, u32 stats_mask)
+ return skb;
+ }
+
++static int
++ath10k_wmi_tlv_op_cleanup_mgmt_tx_send(struct ath10k *ar,
++ struct sk_buff *msdu)
++{
++ struct ath10k_skb_cb *cb = ATH10K_SKB_CB(msdu);
++ struct ath10k_wmi *wmi = &ar->wmi;
++
++ idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id);
++
++ return 0;
++}
++
+ static int
+ ath10k_wmi_mgmt_tx_alloc_msdu_id(struct ath10k *ar, struct sk_buff *skb,
+ dma_addr_t paddr)
+@@ -2710,6 +2722,8 @@ ath10k_wmi_tlv_op_gen_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu,
+ if (desc_id < 0)
+ goto err_free_skb;
+
++ cb->msdu_id = desc_id;
++
+ ptr = (void *)skb->data;
+ tlv = ptr;
+ tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_MGMT_TX_CMD);
+@@ -3949,6 +3963,7 @@ static const struct wmi_ops wmi_tlv_ops = {
+ .gen_force_fw_hang = ath10k_wmi_tlv_op_gen_force_fw_hang,
+ /* .gen_mgmt_tx = not implemented; HTT is used */
+ .gen_mgmt_tx_send = ath10k_wmi_tlv_op_gen_mgmt_tx_send,
++ .cleanup_mgmt_tx_send = ath10k_wmi_tlv_op_cleanup_mgmt_tx_send,
+ .gen_dbglog_cfg = ath10k_wmi_tlv_op_gen_dbglog_cfg,
+ .gen_pktlog_enable = ath10k_wmi_tlv_op_gen_pktlog_enable,
+ .gen_pktlog_disable = ath10k_wmi_tlv_op_gen_pktlog_disable,
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index dd0c32379375..4ed21dad6a8e 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -612,6 +612,11 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ hif_dev->remain_skb = nskb;
+ spin_unlock(&hif_dev->rx_lock);
+ } else {
++ if (pool_index == MAX_PKT_NUM_IN_TRANSFER) {
++ dev_err(&hif_dev->udev->dev,
++ "ath9k_htc: over RX MAX_PKT_NUM\n");
++ goto err;
++ }
+ nskb = __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC);
+ if (!nskb) {
+ dev_err(&hif_dev->udev->dev,
+@@ -638,9 +643,9 @@ err:
+
+ static void ath9k_hif_usb_rx_cb(struct urb *urb)
+ {
+- struct sk_buff *skb = (struct sk_buff *) urb->context;
+- struct hif_device_usb *hif_dev =
+- usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
++ struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
++ struct hif_device_usb *hif_dev = rx_buf->hif_dev;
++ struct sk_buff *skb = rx_buf->skb;
+ int ret;
+
+ if (!skb)
+@@ -680,14 +685,15 @@ resubmit:
+ return;
+ free:
+ kfree_skb(skb);
++ kfree(rx_buf);
+ }
+
+ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+ {
+- struct sk_buff *skb = (struct sk_buff *) urb->context;
++ struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
++ struct hif_device_usb *hif_dev = rx_buf->hif_dev;
++ struct sk_buff *skb = rx_buf->skb;
+ struct sk_buff *nskb;
+- struct hif_device_usb *hif_dev =
+- usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+ int ret;
+
+ if (!skb)
+@@ -745,6 +751,7 @@ resubmit:
+ return;
+ free:
+ kfree_skb(skb);
++ kfree(rx_buf);
+ urb->context = NULL;
+ }
+
+@@ -790,7 +797,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
+ init_usb_anchor(&hif_dev->mgmt_submitted);
+
+ for (i = 0; i < MAX_TX_URB_NUM; i++) {
+- tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
++ tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL);
+ if (!tx_buf)
+ goto err;
+
+@@ -827,8 +834,9 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
+
+ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+ {
+- struct urb *urb = NULL;
++ struct rx_buf *rx_buf = NULL;
+ struct sk_buff *skb = NULL;
++ struct urb *urb = NULL;
+ int i, ret;
+
+ init_usb_anchor(&hif_dev->rx_submitted);
+@@ -836,6 +844,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+
+ for (i = 0; i < MAX_RX_URB_NUM; i++) {
+
++ rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
++ if (!rx_buf) {
++ ret = -ENOMEM;
++ goto err_rxb;
++ }
++
+ /* Allocate URB */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (urb == NULL) {
+@@ -850,11 +864,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+ goto err_skb;
+ }
+
++ rx_buf->hif_dev = hif_dev;
++ rx_buf->skb = skb;
++
+ usb_fill_bulk_urb(urb, hif_dev->udev,
+ usb_rcvbulkpipe(hif_dev->udev,
+ USB_WLAN_RX_PIPE),
+ skb->data, MAX_RX_BUF_SIZE,
+- ath9k_hif_usb_rx_cb, skb);
++ ath9k_hif_usb_rx_cb, rx_buf);
+
+ /* Anchor URB */
+ usb_anchor_urb(urb, &hif_dev->rx_submitted);
+@@ -880,6 +897,8 @@ err_submit:
+ err_skb:
+ usb_free_urb(urb);
+ err_urb:
++ kfree(rx_buf);
++err_rxb:
+ ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
+ return ret;
+ }
+@@ -891,14 +910,21 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+
+ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+ {
+- struct urb *urb = NULL;
++ struct rx_buf *rx_buf = NULL;
+ struct sk_buff *skb = NULL;
++ struct urb *urb = NULL;
+ int i, ret;
+
+ init_usb_anchor(&hif_dev->reg_in_submitted);
+
+ for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
+
++ rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
++ if (!rx_buf) {
++ ret = -ENOMEM;
++ goto err_rxb;
++ }
++
+ /* Allocate URB */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (urb == NULL) {
+@@ -913,11 +939,14 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+ goto err_skb;
+ }
+
++ rx_buf->hif_dev = hif_dev;
++ rx_buf->skb = skb;
++
+ usb_fill_int_urb(urb, hif_dev->udev,
+ usb_rcvintpipe(hif_dev->udev,
+ USB_REG_IN_PIPE),
+ skb->data, MAX_REG_IN_BUF_SIZE,
+- ath9k_hif_usb_reg_in_cb, skb, 1);
++ ath9k_hif_usb_reg_in_cb, rx_buf, 1);
+
+ /* Anchor URB */
+ usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
+@@ -943,6 +972,8 @@ err_submit:
+ err_skb:
+ usb_free_urb(urb);
+ err_urb:
++ kfree(rx_buf);
++err_rxb:
+ ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
+ return ret;
+ }
+@@ -973,7 +1004,7 @@ err:
+ return -ENOMEM;
+ }
+
+-static void ath9k_hif_usb_dealloc_urbs(struct hif_device_usb *hif_dev)
++void ath9k_hif_usb_dealloc_urbs(struct hif_device_usb *hif_dev)
+ {
+ usb_kill_anchored_urbs(&hif_dev->regout_submitted);
+ ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
+@@ -1341,8 +1372,9 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
+
+ if (hif_dev->flags & HIF_USB_READY) {
+ ath9k_htc_hw_deinit(hif_dev->htc_handle, unplugged);
+- ath9k_htc_hw_free(hif_dev->htc_handle);
+ ath9k_hif_usb_dev_deinit(hif_dev);
++ ath9k_destoy_wmi(hif_dev->htc_handle->drv_priv);
++ ath9k_htc_hw_free(hif_dev->htc_handle);
+ }
+
+ usb_set_intfdata(interface, NULL);
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
+index 7846916aa01d..5985aa15ca93 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
+@@ -86,6 +86,11 @@ struct tx_buf {
+ struct list_head list;
+ };
+
++struct rx_buf {
++ struct sk_buff *skb;
++ struct hif_device_usb *hif_dev;
++};
++
+ #define HIF_USB_TX_STOP BIT(0)
+ #define HIF_USB_TX_FLUSH BIT(1)
+
+@@ -133,5 +138,6 @@ struct hif_device_usb {
+
+ int ath9k_hif_usb_init(void);
+ void ath9k_hif_usb_exit(void);
++void ath9k_hif_usb_dealloc_urbs(struct hif_device_usb *hif_dev);
+
+ #endif /* HTC_USB_H */
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 214c68269a69..27d9fe6799f5 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -933,8 +933,9 @@ err_init:
+ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
+ u16 devid, char *product, u32 drv_info)
+ {
+- struct ieee80211_hw *hw;
++ struct hif_device_usb *hif_dev;
+ struct ath9k_htc_priv *priv;
++ struct ieee80211_hw *hw;
+ int ret;
+
+ hw = ieee80211_alloc_hw(sizeof(struct ath9k_htc_priv), &ath9k_htc_ops);
+@@ -969,7 +970,10 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
+ return 0;
+
+ err_init:
+- ath9k_deinit_wmi(priv);
++ ath9k_stop_wmi(priv);
++ hif_dev = (struct hif_device_usb *)htc_handle->hif_dev;
++ ath9k_hif_usb_dealloc_urbs(hif_dev);
++ ath9k_destoy_wmi(priv);
+ err_free:
+ ieee80211_free_hw(hw);
+ return ret;
+@@ -984,7 +988,7 @@ void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug)
+ htc_handle->drv_priv->ah->ah_flags |= AH_UNPLUGGED;
+
+ ath9k_deinit_device(htc_handle->drv_priv);
+- ath9k_deinit_wmi(htc_handle->drv_priv);
++ ath9k_stop_wmi(htc_handle->drv_priv);
+ ieee80211_free_hw(htc_handle->drv_priv->hw);
+ }
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index b5d7ef4da17f..f19393e584dc 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -999,9 +999,9 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
+ * which are not PHY_ERROR (short radar pulses have a length of 3)
+ */
+ if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) {
+- ath_warn(common,
+- "Short RX data len, dropping (dlen: %d)\n",
+- rs_datalen);
++ ath_dbg(common, ANY,
++ "Short RX data len, dropping (dlen: %d)\n",
++ rs_datalen);
+ goto rx_next;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index 1bf63a4efb4c..d2e062eaf561 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -113,6 +113,9 @@ static void htc_process_conn_rsp(struct htc_target *target,
+
+ if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) {
+ epid = svc_rspmsg->endpoint_id;
++ if (epid < 0 || epid >= ENDPOINT_MAX)
++ return;
++
+ service_id = be16_to_cpu(svc_rspmsg->service_id);
+ max_msglen = be16_to_cpu(svc_rspmsg->max_msg_len);
+ endpoint = &target->endpoint[epid];
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
+index d1f6710ca63b..e7a3127395be 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.c
++++ b/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -112,14 +112,17 @@ struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv)
+ return wmi;
+ }
+
+-void ath9k_deinit_wmi(struct ath9k_htc_priv *priv)
++void ath9k_stop_wmi(struct ath9k_htc_priv *priv)
+ {
+ struct wmi *wmi = priv->wmi;
+
+ mutex_lock(&wmi->op_mutex);
+ wmi->stopped = true;
+ mutex_unlock(&wmi->op_mutex);
++}
+
++void ath9k_destoy_wmi(struct ath9k_htc_priv *priv)
++{
+ kfree(priv->wmi);
+ }
+
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h
+index 380175d5ecd7..d8b912206232 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.h
++++ b/drivers/net/wireless/ath/ath9k/wmi.h
+@@ -179,7 +179,6 @@ struct wmi {
+ };
+
+ struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv);
+-void ath9k_deinit_wmi(struct ath9k_htc_priv *priv);
+ int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi,
+ enum htc_endpoint_id *wmi_ctrl_epid);
+ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+@@ -189,6 +188,8 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+ void ath9k_wmi_event_tasklet(unsigned long data);
+ void ath9k_fatal_work(struct work_struct *work);
+ void ath9k_wmi_event_drain(struct ath9k_htc_priv *priv);
++void ath9k_stop_wmi(struct ath9k_htc_priv *priv);
++void ath9k_destoy_wmi(struct ath9k_htc_priv *priv);
+
+ #define WMI_CMD(_wmi_cmd) \
+ do { \
+diff --git a/drivers/net/wireless/ath/carl9170/fw.c b/drivers/net/wireless/ath/carl9170/fw.c
+index 88045f93a76c..62ed0977f32c 100644
+--- a/drivers/net/wireless/ath/carl9170/fw.c
++++ b/drivers/net/wireless/ath/carl9170/fw.c
+@@ -351,9 +351,7 @@ static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len)
+ ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
+
+ if (SUPP(CARL9170FW_WLANTX_CAB)) {
+- if_comb_types |=
+- BIT(NL80211_IFTYPE_AP) |
+- BIT(NL80211_IFTYPE_P2P_GO);
++ if_comb_types |= BIT(NL80211_IFTYPE_AP);
+
+ #ifdef CONFIG_MAC80211_MESH
+ if_comb_types |=
+diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
+index 7f1bdea742b8..7064e6fc5dbb 100644
+--- a/drivers/net/wireless/ath/carl9170/main.c
++++ b/drivers/net/wireless/ath/carl9170/main.c
+@@ -582,11 +582,10 @@ static int carl9170_init_interface(struct ar9170 *ar,
+ ar->disable_offload |= ((vif->type != NL80211_IFTYPE_STATION) &&
+ (vif->type != NL80211_IFTYPE_AP));
+
+- /* While the driver supports HW offload in a single
+- * P2P client configuration, it doesn't support HW
+- * offload in the favourit, concurrent P2P GO+CLIENT
+- * configuration. Hence, HW offload will always be
+- * disabled for P2P.
++ /* The driver used to have P2P GO+CLIENT support,
++ * but since this was dropped and we don't know if
++ * there are any gremlins lurking in the shadows,
++ * so best we keep HW offload disabled for P2P.
+ */
+ ar->disable_offload |= vif->p2p;
+
+@@ -639,18 +638,6 @@ static int carl9170_op_add_interface(struct ieee80211_hw *hw,
+ if (vif->type == NL80211_IFTYPE_STATION)
+ break;
+
+- /* P2P GO [master] use-case
+- * Because the P2P GO station is selected dynamically
+- * by all participating peers of a WIFI Direct network,
+- * the driver has be able to change the main interface
+- * operating mode on the fly.
+- */
+- if (main_vif->p2p && vif->p2p &&
+- vif->type == NL80211_IFTYPE_AP) {
+- old_main = main_vif;
+- break;
+- }
+-
+ err = -EBUSY;
+ rcu_read_unlock();
+
+diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
+index 79998a3ddb7a..ad051f34e65b 100644
+--- a/drivers/net/wireless/ath/wcn36xx/main.c
++++ b/drivers/net/wireless/ath/wcn36xx/main.c
+@@ -1341,7 +1341,7 @@ static int wcn36xx_probe(struct platform_device *pdev)
+ if (addr && ret != ETH_ALEN) {
+ wcn36xx_err("invalid local-mac-address\n");
+ ret = -EINVAL;
+- goto out_wq;
++ goto out_destroy_ept;
+ } else if (addr) {
+ wcn36xx_info("mac address: %pM\n", addr);
+ SET_IEEE80211_PERM_ADDR(wcn->hw, addr);
+@@ -1349,7 +1349,7 @@ static int wcn36xx_probe(struct platform_device *pdev)
+
+ ret = wcn36xx_platform_get_resources(wcn, pdev);
+ if (ret)
+- goto out_wq;
++ goto out_destroy_ept;
+
+ wcn36xx_init_ieee80211(wcn);
+ ret = ieee80211_register_hw(wcn->hw);
+@@ -1361,6 +1361,8 @@ static int wcn36xx_probe(struct platform_device *pdev)
+ out_unmap:
+ iounmap(wcn->ccu_base);
+ iounmap(wcn->dxe_base);
++out_destroy_ept:
++ rpmsg_destroy_ept(wcn->smd_channel);
+ out_wq:
+ ieee80211_free_hw(hw);
+ out_err:
+diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
+index b37e7391f55d..8a226a9d755e 100644
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -5596,7 +5596,7 @@ static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
+ /* fill hw info */
+ ieee80211_hw_set(hw, RX_INCLUDES_FCS);
+ ieee80211_hw_set(hw, SIGNAL_DBM);
+-
++ ieee80211_hw_set(hw, MFP_CAPABLE);
+ hw->wiphy->interface_modes =
+ BIT(NL80211_IFTYPE_AP) |
+ BIT(NL80211_IFTYPE_MESH_POINT) |
+diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c
+index 770cc218ca4b..ef1f1b5d63b1 100644
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -3835,6 +3835,7 @@ static int b43legacy_wireless_init(struct ssb_device *dev)
+ /* fill hw info */
+ ieee80211_hw_set(hw, RX_INCLUDES_FCS);
+ ieee80211_hw_set(hw, SIGNAL_DBM);
++ ieee80211_hw_set(hw, MFP_CAPABLE); /* Allow WPA3 in software */
+
+ hw->wiphy->interface_modes =
+ BIT(NL80211_IFTYPE_AP) |
+diff --git a/drivers/net/wireless/broadcom/b43legacy/xmit.c b/drivers/net/wireless/broadcom/b43legacy/xmit.c
+index 35ccf400b02c..87045e30e585 100644
+--- a/drivers/net/wireless/broadcom/b43legacy/xmit.c
++++ b/drivers/net/wireless/broadcom/b43legacy/xmit.c
+@@ -571,6 +571,7 @@ void b43legacy_rx(struct b43legacy_wldev *dev,
+ default:
+ b43legacywarn(dev->wl, "Unexpected value for chanstat (0x%X)\n",
+ chanstat);
++ goto drop;
+ }
+
+ memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+index 4c5a3995dc35..d7f41caa0b0b 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -281,13 +281,14 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
+ if (!err)
+ ifp->drvr->feat_flags |= BIT(BRCMF_FEAT_SCAN_RANDOM_MAC);
+
++ brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_FWSUP, "sup_wpa");
++
+ if (drvr->settings->feature_disable) {
+ brcmf_dbg(INFO, "Features: 0x%02x, disable: 0x%02x\n",
+ ifp->drvr->feat_flags,
+ drvr->settings->feature_disable);
+ ifp->drvr->feat_flags &= ~drvr->settings->feature_disable;
+ }
+- brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_FWSUP, "sup_wpa");
+
+ brcmf_feat_firmware_overrides(drvr);
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 7b74ef71bef1..650191db25cb 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -1468,7 +1468,8 @@ mwifiex_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
+ int idx, u8 *mac, struct station_info *sinfo)
+ {
+ struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+- static struct mwifiex_sta_node *node;
++ struct mwifiex_sta_node *node;
++ int i;
+
+ if ((GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA) &&
+ priv->media_connected && idx == 0) {
+@@ -1478,13 +1479,10 @@ mwifiex_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
+ mwifiex_send_cmd(priv, HOST_CMD_APCMD_STA_LIST,
+ HostCmd_ACT_GEN_GET, 0, NULL, true);
+
+- if (node && (&node->list == &priv->sta_list)) {
+- node = NULL;
+- return -ENOENT;
+- }
+-
+- node = list_prepare_entry(node, &priv->sta_list, list);
+- list_for_each_entry_continue(node, &priv->sta_list, list) {
++ i = 0;
++ list_for_each_entry(node, &priv->sta_list, list) {
++ if (i++ != idx)
++ continue;
+ ether_addr_copy(mac, node->mac_addr);
+ return mwifiex_dump_station_info(priv, node, sinfo);
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/agg-rx.c b/drivers/net/wireless/mediatek/mt76/agg-rx.c
+index 73c8b2805c97..d44d57e6eb27 100644
+--- a/drivers/net/wireless/mediatek/mt76/agg-rx.c
++++ b/drivers/net/wireless/mediatek/mt76/agg-rx.c
+@@ -154,8 +154,8 @@ void mt76_rx_aggr_reorder(struct sk_buff *skb, struct sk_buff_head *frames)
+ struct ieee80211_sta *sta;
+ struct mt76_rx_tid *tid;
+ bool sn_less;
+- u16 seqno, head, size;
+- u8 ackp, idx;
++ u16 seqno, head, size, idx;
++ u8 ackp;
+
+ __skb_queue_tail(frames, skb);
+
+@@ -240,7 +240,7 @@ out:
+ }
+
+ int mt76_rx_aggr_start(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tidno,
+- u16 ssn, u8 size)
++ u16 ssn, u16 size)
+ {
+ struct mt76_rx_tid *tid;
+
+@@ -264,7 +264,7 @@ EXPORT_SYMBOL_GPL(mt76_rx_aggr_start);
+
+ static void mt76_rx_aggr_shutdown(struct mt76_dev *dev, struct mt76_rx_tid *tid)
+ {
+- u8 size = tid->size;
++ u16 size = tid->size;
+ int i;
+
+ cancel_delayed_work(&tid->reorder_work);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
+index 2eab35879163..7b1667ec619e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76.h
+@@ -193,8 +193,8 @@ struct mt76_rx_tid {
+ struct delayed_work reorder_work;
+
+ u16 head;
+- u8 size;
+- u8 nframes;
++ u16 size;
++ u16 nframes;
+
+ u8 started:1, stopped:1, timer_pending:1;
+
+@@ -537,7 +537,7 @@ int mt76_get_survey(struct ieee80211_hw *hw, int idx,
+ void mt76_set_stream_caps(struct mt76_dev *dev, bool vht);
+
+ int mt76_rx_aggr_start(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tid,
+- u16 ssn, u8 size);
++ u16 ssn, u16 size);
+ void mt76_rx_aggr_stop(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tid);
+
+ void mt76_wcid_key_setup(struct mt76_dev *dev, struct mt76_wcid *wcid,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 1181b725f503..1893640555c1 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -910,10 +910,8 @@ static struct urb *_rtl_usb_tx_urb_setup(struct ieee80211_hw *hw,
+
+ WARN_ON(NULL == skb);
+ _urb = usb_alloc_urb(0, GFP_ATOMIC);
+- if (!_urb) {
+- kfree_skb(skb);
++ if (!_urb)
+ return NULL;
+- }
+ _rtl_install_trx_info(rtlusb, skb, ep_num);
+ usb_fill_bulk_urb(_urb, rtlusb->udev, usb_sndbulkpipe(rtlusb->udev,
+ ep_num), skb->data, skb->len, _rtl_tx_complete, skb);
+@@ -927,7 +925,6 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb,
+ struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));
+ u32 ep_num;
+ struct urb *_urb = NULL;
+- struct sk_buff *_skb = NULL;
+
+ WARN_ON(NULL == rtlusb->usb_tx_aggregate_hdl);
+ if (unlikely(IS_USB_STOP(rtlusb))) {
+@@ -936,8 +933,7 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb,
+ return;
+ }
+ ep_num = rtlusb->ep_map.ep_mapping[qnum];
+- _skb = skb;
+- _urb = _rtl_usb_tx_urb_setup(hw, _skb, ep_num);
++ _urb = _rtl_usb_tx_urb_setup(hw, skb, ep_num);
+ if (unlikely(!_urb)) {
+ pr_err("Can't allocate urb. Drop skb!\n");
+ kfree_skb(skb);
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index d5359c7c811a..0d60f2f8f3ee 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -926,6 +926,19 @@ void nvme_stop_keep_alive(struct nvme_ctrl *ctrl)
+ }
+ EXPORT_SYMBOL_GPL(nvme_stop_keep_alive);
+
++/*
++ * In NVMe 1.0 the CNS field was just a binary controller or namespace
++ * flag, thus sending any new CNS opcodes has a big chance of not working.
++ * Qemu unfortunately had that bug after reporting a 1.1 version compliance
++ * (but not for any later version).
++ */
++static bool nvme_ctrl_limited_cns(struct nvme_ctrl *ctrl)
++{
++ if (ctrl->quirks & NVME_QUIRK_IDENTIFY_CNS)
++ return ctrl->vs < NVME_VS(1, 2, 0);
++ return ctrl->vs < NVME_VS(1, 1, 0);
++}
++
+ static int nvme_identify_ctrl(struct nvme_ctrl *dev, struct nvme_id_ctrl **id)
+ {
+ struct nvme_command c = { };
+@@ -3368,8 +3381,7 @@ static void nvme_scan_work(struct work_struct *work)
+
+ mutex_lock(&ctrl->scan_lock);
+ nn = le32_to_cpu(id->nn);
+- if (ctrl->vs >= NVME_VS(1, 1, 0) &&
+- !(ctrl->quirks & NVME_QUIRK_IDENTIFY_CNS)) {
++ if (!nvme_ctrl_limited_cns(ctrl)) {
+ if (!nvme_scan_ns_list(ctrl, nn))
+ goto out_free_id;
+ }
+diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
+index 1bfbceb9f445..ca06d8bc01e7 100644
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -72,6 +72,7 @@
+ #define PCIE_MSI_VECTOR 0x0c0
+
+ #define PCIE_CONF_VEND_ID 0x100
++#define PCIE_CONF_DEVICE_ID 0x102
+ #define PCIE_CONF_CLASS_ID 0x106
+
+ #define PCIE_INT_MASK 0x420
+@@ -134,12 +135,16 @@ struct mtk_pcie_port;
+ /**
+ * struct mtk_pcie_soc - differentiate between host generations
+ * @need_fix_class_id: whether this host's class ID needed to be fixed or not
++ * @need_fix_device_id: whether this host's device ID needed to be fixed or not
++ * @device_id: device ID which this host need to be fixed
+ * @ops: pointer to configuration access functions
+ * @startup: pointer to controller setting functions
+ * @setup_irq: pointer to initialize IRQ functions
+ */
+ struct mtk_pcie_soc {
+ bool need_fix_class_id;
++ bool need_fix_device_id;
++ unsigned int device_id;
+ struct pci_ops *ops;
+ int (*startup)(struct mtk_pcie_port *port);
+ int (*setup_irq)(struct mtk_pcie_port *port, struct device_node *node);
+@@ -678,6 +683,9 @@ static int mtk_pcie_startup_port_v2(struct mtk_pcie_port *port)
+ writew(val, port->base + PCIE_CONF_CLASS_ID);
+ }
+
++ if (soc->need_fix_device_id)
++ writew(soc->device_id, port->base + PCIE_CONF_DEVICE_ID);
++
+ /* 100ms timeout value should be enough for Gen1/2 training */
+ err = readl_poll_timeout(port->base + PCIE_LINK_STATUS_V2, val,
+ !!(val & PCIE_PORT_LINKUP_V2), 20,
+@@ -1213,11 +1221,21 @@ static const struct mtk_pcie_soc mtk_pcie_soc_mt7622 = {
+ .setup_irq = mtk_pcie_setup_irq,
+ };
+
++static const struct mtk_pcie_soc mtk_pcie_soc_mt7629 = {
++ .need_fix_class_id = true,
++ .need_fix_device_id = true,
++ .device_id = PCI_DEVICE_ID_MEDIATEK_7629,
++ .ops = &mtk_pcie_ops_v2,
++ .startup = mtk_pcie_startup_port_v2,
++ .setup_irq = mtk_pcie_setup_irq,
++};
++
+ static const struct of_device_id mtk_pcie_ids[] = {
+ { .compatible = "mediatek,mt2701-pcie", .data = &mtk_pcie_soc_v1 },
+ { .compatible = "mediatek,mt7623-pcie", .data = &mtk_pcie_soc_v1 },
+ { .compatible = "mediatek,mt2712-pcie", .data = &mtk_pcie_soc_mt2712 },
+ { .compatible = "mediatek,mt7622-pcie", .data = &mtk_pcie_soc_mt7622 },
++ { .compatible = "mediatek,mt7629-pcie", .data = &mtk_pcie_soc_mt7629 },
+ {},
+ };
+
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index ab36e5ca1aca..b52885020c85 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -866,6 +866,8 @@ static const struct pci_device_id vmd_ids[] = {
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_VMD_28C0),
+ .driver_data = VMD_FEAT_HAS_MEMBAR_SHADOW |
+ VMD_FEAT_HAS_BUS_RESTRICTIONS,},
++ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_VMD_9A0B),
++ .driver_data = VMD_FEAT_HAS_BUS_RESTRICTIONS,},
+ {0,}
+ };
+ MODULE_DEVICE_TABLE(pci, vmd_ids);
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index fa4c386c8cd8..243b65f3c282 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1634,7 +1634,7 @@ int pci_setup_device(struct pci_dev *dev)
+ /* Device class may be changed after fixup */
+ class = dev->class >> 8;
+
+- if (dev->non_compliant_bars) {
++ if (dev->non_compliant_bars && !dev->mmio_always_on) {
+ pci_read_config_word(dev, PCI_COMMAND, &cmd);
+ if (cmd & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) {
+ pci_info(dev, "device has non-compliant BARs; disabling IO/MEM decoding\n");
+@@ -1748,13 +1748,33 @@ static void pci_configure_mps(struct pci_dev *dev)
+ struct pci_dev *bridge = pci_upstream_bridge(dev);
+ int mps, mpss, p_mps, rc;
+
+- if (!pci_is_pcie(dev) || !bridge || !pci_is_pcie(bridge))
++ if (!pci_is_pcie(dev))
+ return;
+
+ /* MPS and MRRS fields are of type 'RsvdP' for VFs, short-circuit out */
+ if (dev->is_virtfn)
+ return;
+
++ /*
++ * For Root Complex Integrated Endpoints, program the maximum
++ * supported value unless limited by the PCIE_BUS_PEER2PEER case.
++ */
++ if (pci_pcie_type(dev) == PCI_EXP_TYPE_RC_END) {
++ if (pcie_bus_config == PCIE_BUS_PEER2PEER)
++ mps = 128;
++ else
++ mps = 128 << dev->pcie_mpss;
++ rc = pcie_set_mps(dev, mps);
++ if (rc) {
++ pci_warn(dev, "can't set Max Payload Size to %d; if necessary, use \"pci=pcie_bus_safe\" and report a bug\n",
++ mps);
++ }
++ return;
++ }
++
++ if (!bridge || !pci_is_pcie(bridge))
++ return;
++
+ mps = pcie_get_mps(dev);
+ p_mps = pcie_get_mps(bridge);
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index ca41cff2e68c..0862cb633849 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4263,6 +4263,24 @@ static void quirk_chelsio_T5_disable_root_port_attributes(struct pci_dev *pdev)
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID,
+ quirk_chelsio_T5_disable_root_port_attributes);
+
++/*
++ * pci_acs_ctrl_enabled - compare desired ACS controls with those provided
++ * by a device
++ * @acs_ctrl_req: Bitmask of desired ACS controls
++ * @acs_ctrl_ena: Bitmask of ACS controls enabled or provided implicitly by
++ * the hardware design
++ *
++ * Return 1 if all ACS controls in the @acs_ctrl_req bitmask are included
++ * in @acs_ctrl_ena, i.e., the device provides all the access controls the
++ * caller desires. Return 0 otherwise.
++ */
++static int pci_acs_ctrl_enabled(u16 acs_ctrl_req, u16 acs_ctrl_ena)
++{
++ if ((acs_ctrl_req & acs_ctrl_ena) == acs_ctrl_req)
++ return 1;
++ return 0;
++}
++
+ /*
+ * AMD has indicated that the devices below do not support peer-to-peer
+ * in any system where they are found in the southbridge with an AMD
+@@ -4306,7 +4324,7 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags)
+ /* Filter out flags not applicable to multifunction */
+ acs_flags &= (PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_EC | PCI_ACS_DT);
+
+- return acs_flags & ~(PCI_ACS_RR | PCI_ACS_CR) ? 0 : 1;
++ return pci_acs_ctrl_enabled(acs_flags, PCI_ACS_RR | PCI_ACS_CR);
+ #else
+ return -ENODEV;
+ #endif
+@@ -4333,20 +4351,19 @@ static bool pci_quirk_cavium_acs_match(struct pci_dev *dev)
+
+ static int pci_quirk_cavium_acs(struct pci_dev *dev, u16 acs_flags)
+ {
++ if (!pci_quirk_cavium_acs_match(dev))
++ return -ENOTTY;
++
+ /*
+- * Cavium root ports don't advertise an ACS capability. However,
++ * Cavium Root Ports don't advertise an ACS capability. However,
+ * the RTL internally implements similar protection as if ACS had
+- * Request Redirection, Completion Redirection, Source Validation,
++ * Source Validation, Request Redirection, Completion Redirection,
+ * and Upstream Forwarding features enabled. Assert that the
+ * hardware implements and enables equivalent ACS functionality for
+ * these flags.
+ */
+- acs_flags &= ~(PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_SV | PCI_ACS_UF);
+-
+- if (!pci_quirk_cavium_acs_match(dev))
+- return -ENOTTY;
+-
+- return acs_flags ? 0 : 1;
++ return pci_acs_ctrl_enabled(acs_flags,
++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
+ }
+
+ static int pci_quirk_xgene_acs(struct pci_dev *dev, u16 acs_flags)
+@@ -4356,13 +4373,12 @@ static int pci_quirk_xgene_acs(struct pci_dev *dev, u16 acs_flags)
+ * transactions with others, allowing masking out these bits as if they
+ * were unimplemented in the ACS capability.
+ */
+- acs_flags &= ~(PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
+-
+- return acs_flags ? 0 : 1;
++ return pci_acs_ctrl_enabled(acs_flags,
++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
+ }
+
+ /*
+- * Many Intel PCH root ports do provide ACS-like features to disable peer
++ * Many Intel PCH Root Ports do provide ACS-like features to disable peer
+ * transactions and validate bus numbers in requests, but do not provide an
+ * actual PCIe ACS capability. This is the list of device IDs known to fall
+ * into that category as provided by Intel in Red Hat bugzilla 1037684.
+@@ -4410,37 +4426,32 @@ static bool pci_quirk_intel_pch_acs_match(struct pci_dev *dev)
+ return false;
+ }
+
+-#define INTEL_PCH_ACS_FLAGS (PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_SV)
+-
+ static int pci_quirk_intel_pch_acs(struct pci_dev *dev, u16 acs_flags)
+ {
+- u16 flags = dev->dev_flags & PCI_DEV_FLAGS_ACS_ENABLED_QUIRK ?
+- INTEL_PCH_ACS_FLAGS : 0;
+-
+ if (!pci_quirk_intel_pch_acs_match(dev))
+ return -ENOTTY;
+
+- return acs_flags & ~flags ? 0 : 1;
++ if (dev->dev_flags & PCI_DEV_FLAGS_ACS_ENABLED_QUIRK)
++ return pci_acs_ctrl_enabled(acs_flags,
++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
++
++ return pci_acs_ctrl_enabled(acs_flags, 0);
+ }
+
+ /*
+- * These QCOM root ports do provide ACS-like features to disable peer
++ * These QCOM Root Ports do provide ACS-like features to disable peer
+ * transactions and validate bus numbers in requests, but do not provide an
+ * actual PCIe ACS capability. Hardware supports source validation but it
+ * will report the issue as Completer Abort instead of ACS Violation.
+- * Hardware doesn't support peer-to-peer and each root port is a root
+- * complex with unique segment numbers. It is not possible for one root
+- * port to pass traffic to another root port. All PCIe transactions are
+- * terminated inside the root port.
++ * Hardware doesn't support peer-to-peer and each Root Port is a Root
++ * Complex with unique segment numbers. It is not possible for one Root
++ * Port to pass traffic to another Root Port. All PCIe transactions are
++ * terminated inside the Root Port.
+ */
+ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags)
+ {
+- u16 flags = (PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_SV);
+- int ret = acs_flags & ~flags ? 0 : 1;
+-
+- pci_info(dev, "Using QCOM ACS Quirk (%d)\n", ret);
+-
+- return ret;
++ return pci_acs_ctrl_enabled(acs_flags,
++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
+ }
+
+ /*
+@@ -4523,7 +4534,7 @@ static int pci_quirk_intel_spt_pch_acs(struct pci_dev *dev, u16 acs_flags)
+
+ pci_read_config_dword(dev, pos + INTEL_SPT_ACS_CTRL, &ctrl);
+
+- return acs_flags & ~ctrl ? 0 : 1;
++ return pci_acs_ctrl_enabled(acs_flags, ctrl);
+ }
+
+ static int pci_quirk_mf_endpoint_acs(struct pci_dev *dev, u16 acs_flags)
+@@ -4537,10 +4548,35 @@ static int pci_quirk_mf_endpoint_acs(struct pci_dev *dev, u16 acs_flags)
+ * perform peer-to-peer with other functions, allowing us to mask out
+ * these bits as if they were unimplemented in the ACS capability.
+ */
+- acs_flags &= ~(PCI_ACS_SV | PCI_ACS_TB | PCI_ACS_RR |
+- PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_DT);
++ return pci_acs_ctrl_enabled(acs_flags,
++ PCI_ACS_SV | PCI_ACS_TB | PCI_ACS_RR |
++ PCI_ACS_CR | PCI_ACS_UF | PCI_ACS_DT);
++}
++
++static int pci_quirk_rciep_acs(struct pci_dev *dev, u16 acs_flags)
++{
++ /*
++ * Intel RCiEP's are required to allow p2p only on translated
++ * addresses. Refer to Intel VT-d specification, r3.1, sec 3.16,
++ * "Root-Complex Peer to Peer Considerations".
++ */
++ if (pci_pcie_type(dev) != PCI_EXP_TYPE_RC_END)
++ return -ENOTTY;
+
+- return acs_flags ? 0 : 1;
++ return pci_acs_ctrl_enabled(acs_flags,
++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
++}
++
++static int pci_quirk_brcm_acs(struct pci_dev *dev, u16 acs_flags)
++{
++ /*
++ * iProc PAXB Root Ports don't advertise an ACS capability, but
++ * they do not allow peer-to-peer transactions between Root Ports.
++ * Allow each Root Port to be in a separate IOMMU group by masking
++ * SV/RR/CR/UF bits.
++ */
++ return pci_acs_ctrl_enabled(acs_flags,
++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
+ }
+
+ static const struct pci_dev_acs_enabled {
+@@ -4613,6 +4649,7 @@ static const struct pci_dev_acs_enabled {
+ /* I219 */
+ { PCI_VENDOR_ID_INTEL, 0x15b7, pci_quirk_mf_endpoint_acs },
+ { PCI_VENDOR_ID_INTEL, 0x15b8, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_INTEL, PCI_ANY_ID, pci_quirk_rciep_acs },
+ /* QCOM QDF2xxx root ports */
+ { PCI_VENDOR_ID_QCOM, 0x0400, pci_quirk_qcom_rp_acs },
+ { PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs },
+@@ -4634,9 +4671,21 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_AMPERE, 0xE00A, pci_quirk_xgene_acs },
+ { PCI_VENDOR_ID_AMPERE, 0xE00B, pci_quirk_xgene_acs },
+ { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs },
+ { 0 }
+ };
+
++/*
++ * pci_dev_specific_acs_enabled - check whether device provides ACS controls
++ * @dev: PCI device
++ * @acs_flags: Bitmask of desired ACS controls
++ *
++ * Returns:
++ * -ENOTTY: No quirk applies to this device; we can't tell whether the
++ * device provides the desired controls
++ * 0: Device does not provide all the desired controls
++ * >0: Device provides all the controls in @acs_flags
++ */
+ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags)
+ {
+ const struct pci_dev_acs_enabled *i;
+@@ -4956,13 +5005,25 @@ static void quirk_intel_qat_vf_cap(struct pci_dev *pdev)
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x443, quirk_intel_qat_vf_cap);
+
+-/* FLR may cause some 82579 devices to hang */
+-static void quirk_intel_no_flr(struct pci_dev *dev)
++/*
++ * FLR may cause the following to devices to hang:
++ *
++ * AMD Starship/Matisse HD Audio Controller 0x1487
++ * AMD Starship USB 3.0 Host Controller 0x148c
++ * AMD Matisse USB 3.0 Host Controller 0x149c
++ * Intel 82579LM Gigabit Ethernet Controller 0x1502
++ * Intel 82579V Gigabit Ethernet Controller 0x1503
++ *
++ */
++static void quirk_no_flr(struct pci_dev *dev)
+ {
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_FLR_RESET;
+ }
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_intel_no_flr);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_intel_no_flr);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1487, quirk_no_flr);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x148c, quirk_no_flr);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x149c, quirk_no_flr);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_no_flr);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_no_flr);
+
+ static void quirk_no_ext_tags(struct pci_dev *pdev)
+ {
+@@ -5016,35 +5077,49 @@ static void quirk_fsl_no_msi(struct pci_dev *pdev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_FREESCALE, PCI_ANY_ID, quirk_fsl_no_msi);
+
+ /*
+- * GPUs with integrated HDA controller for streaming audio to attached displays
+- * need a device link from the HDA controller (consumer) to the GPU (supplier)
+- * so that the GPU is powered up whenever the HDA controller is accessed.
+- * The GPU and HDA controller are functions 0 and 1 of the same PCI device.
+- * The device link stays in place until shutdown (or removal of the PCI device
+- * if it's hotplugged). Runtime PM is allowed by default on the HDA controller
+- * to prevent it from permanently keeping the GPU awake.
++ * Although not allowed by the spec, some multi-function devices have
++ * dependencies of one function (consumer) on another (supplier). For the
++ * consumer to work in D0, the supplier must also be in D0. Create a
++ * device link from the consumer to the supplier to enforce this
++ * dependency. Runtime PM is allowed by default on the consumer to prevent
++ * it from permanently keeping the supplier awake.
+ */
+-static void quirk_gpu_hda(struct pci_dev *hda)
++static void pci_create_device_link(struct pci_dev *pdev, unsigned int consumer,
++ unsigned int supplier, unsigned int class,
++ unsigned int class_shift)
+ {
+- struct pci_dev *gpu;
++ struct pci_dev *supplier_pdev;
+
+- if (PCI_FUNC(hda->devfn) != 1)
++ if (PCI_FUNC(pdev->devfn) != consumer)
+ return;
+
+- gpu = pci_get_domain_bus_and_slot(pci_domain_nr(hda->bus),
+- hda->bus->number,
+- PCI_DEVFN(PCI_SLOT(hda->devfn), 0));
+- if (!gpu || (gpu->class >> 16) != PCI_BASE_CLASS_DISPLAY) {
+- pci_dev_put(gpu);
++ supplier_pdev = pci_get_domain_bus_and_slot(pci_domain_nr(pdev->bus),
++ pdev->bus->number,
++ PCI_DEVFN(PCI_SLOT(pdev->devfn), supplier));
++ if (!supplier_pdev || (supplier_pdev->class >> class_shift) != class) {
++ pci_dev_put(supplier_pdev);
+ return;
+ }
+
+- if (!device_link_add(&hda->dev, &gpu->dev,
+- DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME))
+- pci_err(hda, "cannot link HDA to GPU %s\n", pci_name(gpu));
++ if (device_link_add(&pdev->dev, &supplier_pdev->dev,
++ DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME))
++ pci_info(pdev, "D0 power state depends on %s\n",
++ pci_name(supplier_pdev));
++ else
++ pci_err(pdev, "Cannot enforce power dependency on %s\n",
++ pci_name(supplier_pdev));
+
+- pm_runtime_allow(&hda->dev);
+- pci_dev_put(gpu);
++ pm_runtime_allow(&pdev->dev);
++ pci_dev_put(supplier_pdev);
++}
++
++/*
++ * Create device link for GPUs with integrated HDA controller for streaming
++ * audio to attached displays.
++ */
++static void quirk_gpu_hda(struct pci_dev *hda)
++{
++ pci_create_device_link(hda, 1, 0, PCI_BASE_CLASS_DISPLAY, 16);
+ }
+ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_ATI, PCI_ANY_ID,
+ PCI_CLASS_MULTIMEDIA_HD_AUDIO, 8, quirk_gpu_hda);
+@@ -5053,6 +5128,62 @@ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_AMD, PCI_ANY_ID,
+ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
+ PCI_CLASS_MULTIMEDIA_HD_AUDIO, 8, quirk_gpu_hda);
+
++/*
++ * Create device link for NVIDIA GPU with integrated USB xHCI Host
++ * controller to VGA.
++ */
++static void quirk_gpu_usb(struct pci_dev *usb)
++{
++ pci_create_device_link(usb, 2, 0, PCI_BASE_CLASS_DISPLAY, 16);
++}
++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
++ PCI_CLASS_SERIAL_USB, 8, quirk_gpu_usb);
++
++/*
++ * Create device link for NVIDIA GPU with integrated Type-C UCSI controller
++ * to VGA. Currently there is no class code defined for UCSI device over PCI
++ * so using UNKNOWN class for now and it will be updated when UCSI
++ * over PCI gets a class code.
++ */
++#define PCI_CLASS_SERIAL_UNKNOWN 0x0c80
++static void quirk_gpu_usb_typec_ucsi(struct pci_dev *ucsi)
++{
++ pci_create_device_link(ucsi, 3, 0, PCI_BASE_CLASS_DISPLAY, 16);
++}
++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
++ PCI_CLASS_SERIAL_UNKNOWN, 8,
++ quirk_gpu_usb_typec_ucsi);
++
++/*
++ * Enable the NVIDIA GPU integrated HDA controller if the BIOS left it
++ * disabled. https://devtalk.nvidia.com/default/topic/1024022
++ */
++static void quirk_nvidia_hda(struct pci_dev *gpu)
++{
++ u8 hdr_type;
++ u32 val;
++
++ /* There was no integrated HDA controller before MCP89 */
++ if (gpu->device < PCI_DEVICE_ID_NVIDIA_GEFORCE_320M)
++ return;
++
++ /* Bit 25 at offset 0x488 enables the HDA controller */
++ pci_read_config_dword(gpu, 0x488, &val);
++ if (val & BIT(25))
++ return;
++
++ pci_info(gpu, "Enabling HDA controller\n");
++ pci_write_config_dword(gpu, 0x488, val | BIT(25));
++
++ /* The GPU becomes a multi-function device when the HDA is enabled */
++ pci_read_config_byte(gpu, PCI_HEADER_TYPE, &hdr_type);
++ gpu->multifunction = !!(hdr_type & 0x80);
++}
++DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
++ PCI_BASE_CLASS_DISPLAY, 16, quirk_nvidia_hda);
++DECLARE_PCI_FIXUP_CLASS_RESUME_EARLY(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
++ PCI_BASE_CLASS_DISPLAY, 16, quirk_nvidia_hda);
++
+ /*
+ * Some IDT switches incorrectly flag an ACS Source Validation error on
+ * completions for config read requests even though PCIe r4.0, sec
+@@ -5294,6 +5425,19 @@ static void pci_fixup_no_d0_pme(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x2142, pci_fixup_no_d0_pme);
+
++/*
++ * Device [12d8:0x400e] and [12d8:0x400f]
++ * These devices advertise PME# support in all power states but don't
++ * reliably assert it.
++ */
++static void pci_fixup_no_pme(struct pci_dev *dev)
++{
++ pci_info(dev, "PME# is unreliable, disabling it\n");
++ dev->pme_support = 0;
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400e, pci_fixup_no_pme);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_PERICOM, 0x400f, pci_fixup_no_pme);
++
+ static void apex_pci_fixup_class(struct pci_dev *pdev)
+ {
+ pdev->class = (PCI_CLASS_SYSTEM_OTHER << 8) | pdev->class;
+diff --git a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
+index 443906e0aff3..0393c4471227 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
+@@ -290,7 +290,7 @@ static struct attribute *hisi_hha_pmu_events_attr[] = {
+ HISI_PMU_EVENT_ATTR(rx_wbip, 0x05),
+ HISI_PMU_EVENT_ATTR(rx_wtistash, 0x11),
+ HISI_PMU_EVENT_ATTR(rd_ddr_64b, 0x1c),
+- HISI_PMU_EVENT_ATTR(wr_dr_64b, 0x1d),
++ HISI_PMU_EVENT_ATTR(wr_ddr_64b, 0x1d),
+ HISI_PMU_EVENT_ATTR(rd_ddr_128b, 0x1e),
+ HISI_PMU_EVENT_ATTR(wr_ddr_128b, 0x1f),
+ HISI_PMU_EVENT_ATTR(spill_num, 0x20),
+diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c
+index e87ee43efa16..24956f6c6324 100644
+--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
+@@ -40,6 +40,8 @@ struct exynos_irq_chip {
+ u32 eint_pend;
+ u32 eint_wake_mask_value;
+ u32 eint_wake_mask_reg;
++ void (*set_eint_wakeup_mask)(struct samsung_pinctrl_drv_data *drvdata,
++ struct exynos_irq_chip *irq_chip);
+ };
+
+ static inline struct exynos_irq_chip *to_exynos_irq_chip(struct irq_chip *chip)
+@@ -265,6 +267,7 @@ struct exynos_eint_gpio_save {
+ u32 eint_con;
+ u32 eint_fltcon0;
+ u32 eint_fltcon1;
++ u32 eint_mask;
+ };
+
+ /*
+@@ -350,6 +353,47 @@ static int exynos_wkup_irq_set_wake(struct irq_data *irqd, unsigned int on)
+ return 0;
+ }
+
++static void
++exynos_pinctrl_set_eint_wakeup_mask(struct samsung_pinctrl_drv_data *drvdata,
++ struct exynos_irq_chip *irq_chip)
++{
++ struct regmap *pmu_regs;
++
++ if (!drvdata->retention_ctrl || !drvdata->retention_ctrl->priv) {
++ dev_warn(drvdata->dev,
++ "No retention data configured bank with external wakeup interrupt. Wake-up mask will not be set.\n");
++ return;
++ }
++
++ pmu_regs = drvdata->retention_ctrl->priv;
++ dev_info(drvdata->dev,
++ "Setting external wakeup interrupt mask: 0x%x\n",
++ irq_chip->eint_wake_mask_value);
++
++ regmap_write(pmu_regs, irq_chip->eint_wake_mask_reg,
++ irq_chip->eint_wake_mask_value);
++}
++
++static void
++s5pv210_pinctrl_set_eint_wakeup_mask(struct samsung_pinctrl_drv_data *drvdata,
++ struct exynos_irq_chip *irq_chip)
++
++{
++ void __iomem *clk_base;
++
++ if (!drvdata->retention_ctrl || !drvdata->retention_ctrl->priv) {
++ dev_warn(drvdata->dev,
++ "No retention data configured bank with external wakeup interrupt. Wake-up mask will not be set.\n");
++ return;
++ }
++
++
++ clk_base = (void __iomem *) drvdata->retention_ctrl->priv;
++
++ __raw_writel(irq_chip->eint_wake_mask_value,
++ clk_base + irq_chip->eint_wake_mask_reg);
++}
++
+ /*
+ * irq_chip for wakeup interrupts
+ */
+@@ -368,8 +412,9 @@ static const struct exynos_irq_chip s5pv210_wkup_irq_chip __initconst = {
+ .eint_mask = EXYNOS_WKUP_EMASK_OFFSET,
+ .eint_pend = EXYNOS_WKUP_EPEND_OFFSET,
+ .eint_wake_mask_value = EXYNOS_EINT_WAKEUP_MASK_DISABLED,
+- /* Only difference with exynos4210_wkup_irq_chip: */
++ /* Only differences with exynos4210_wkup_irq_chip: */
+ .eint_wake_mask_reg = S5PV210_EINT_WAKEUP_MASK,
++ .set_eint_wakeup_mask = s5pv210_pinctrl_set_eint_wakeup_mask,
+ };
+
+ static const struct exynos_irq_chip exynos4210_wkup_irq_chip __initconst = {
+@@ -388,6 +433,7 @@ static const struct exynos_irq_chip exynos4210_wkup_irq_chip __initconst = {
+ .eint_pend = EXYNOS_WKUP_EPEND_OFFSET,
+ .eint_wake_mask_value = EXYNOS_EINT_WAKEUP_MASK_DISABLED,
+ .eint_wake_mask_reg = EXYNOS_EINT_WAKEUP_MASK,
++ .set_eint_wakeup_mask = exynos_pinctrl_set_eint_wakeup_mask,
+ };
+
+ static const struct exynos_irq_chip exynos7_wkup_irq_chip __initconst = {
+@@ -406,6 +452,7 @@ static const struct exynos_irq_chip exynos7_wkup_irq_chip __initconst = {
+ .eint_pend = EXYNOS7_WKUP_EPEND_OFFSET,
+ .eint_wake_mask_value = EXYNOS_EINT_WAKEUP_MASK_DISABLED,
+ .eint_wake_mask_reg = EXYNOS5433_EINT_WAKEUP_MASK,
++ .set_eint_wakeup_mask = exynos_pinctrl_set_eint_wakeup_mask,
+ };
+
+ /* list of external wakeup controllers supported */
+@@ -582,27 +629,6 @@ int exynos_eint_wkup_init(struct samsung_pinctrl_drv_data *d)
+ return 0;
+ }
+
+-static void
+-exynos_pinctrl_set_eint_wakeup_mask(struct samsung_pinctrl_drv_data *drvdata,
+- struct exynos_irq_chip *irq_chip)
+-{
+- struct regmap *pmu_regs;
+-
+- if (!drvdata->retention_ctrl || !drvdata->retention_ctrl->priv) {
+- dev_warn(drvdata->dev,
+- "No retention data configured bank with external wakeup interrupt. Wake-up mask will not be set.\n");
+- return;
+- }
+-
+- pmu_regs = drvdata->retention_ctrl->priv;
+- dev_info(drvdata->dev,
+- "Setting external wakeup interrupt mask: 0x%x\n",
+- irq_chip->eint_wake_mask_value);
+-
+- regmap_write(pmu_regs, irq_chip->eint_wake_mask_reg,
+- irq_chip->eint_wake_mask_value);
+-}
+-
+ static void exynos_pinctrl_suspend_bank(
+ struct samsung_pinctrl_drv_data *drvdata,
+ struct samsung_pin_bank *bank)
+@@ -616,10 +642,13 @@ static void exynos_pinctrl_suspend_bank(
+ + 2 * bank->eint_offset);
+ save->eint_fltcon1 = readl(regs + EXYNOS_GPIO_EFLTCON_OFFSET
+ + 2 * bank->eint_offset + 4);
++ save->eint_mask = readl(regs + bank->irq_chip->eint_mask
++ + bank->eint_offset);
+
+ pr_debug("%s: save con %#010x\n", bank->name, save->eint_con);
+ pr_debug("%s: save fltcon0 %#010x\n", bank->name, save->eint_fltcon0);
+ pr_debug("%s: save fltcon1 %#010x\n", bank->name, save->eint_fltcon1);
++ pr_debug("%s: save mask %#010x\n", bank->name, save->eint_mask);
+ }
+
+ void exynos_pinctrl_suspend(struct samsung_pinctrl_drv_data *drvdata)
+@@ -634,8 +663,8 @@ void exynos_pinctrl_suspend(struct samsung_pinctrl_drv_data *drvdata)
+ else if (bank->eint_type == EINT_TYPE_WKUP) {
+ if (!irq_chip) {
+ irq_chip = bank->irq_chip;
+- exynos_pinctrl_set_eint_wakeup_mask(drvdata,
+- irq_chip);
++ irq_chip->set_eint_wakeup_mask(drvdata,
++ irq_chip);
+ } else if (bank->irq_chip != irq_chip) {
+ dev_warn(drvdata->dev,
+ "More than one external wakeup interrupt chip configured (bank: %s). This is not supported by hardware nor by driver.\n",
+@@ -661,6 +690,9 @@ static void exynos_pinctrl_resume_bank(
+ pr_debug("%s: fltcon1 %#010x => %#010x\n", bank->name,
+ readl(regs + EXYNOS_GPIO_EFLTCON_OFFSET
+ + 2 * bank->eint_offset + 4), save->eint_fltcon1);
++ pr_debug("%s: mask %#010x => %#010x\n", bank->name,
++ readl(regs + bank->irq_chip->eint_mask
++ + bank->eint_offset), save->eint_mask);
+
+ writel(save->eint_con, regs + EXYNOS_GPIO_ECON_OFFSET
+ + bank->eint_offset);
+@@ -668,6 +700,8 @@ static void exynos_pinctrl_resume_bank(
+ + 2 * bank->eint_offset);
+ writel(save->eint_fltcon1, regs + EXYNOS_GPIO_EFLTCON_OFFSET
+ + 2 * bank->eint_offset + 4);
++ writel(save->eint_mask, regs + bank->irq_chip->eint_mask
++ + bank->eint_offset);
+ }
+
+ void exynos_pinctrl_resume(struct samsung_pinctrl_drv_data *drvdata)
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index 06a3c1ef8eee..952544ca0d84 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -474,8 +474,14 @@ static ssize_t postcode_show(struct device *dev, struct device_attribute *attr,
+ static ssize_t als_store(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
+- u32 tmp = simple_strtoul(buf, NULL, 10);
+- int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, HPWMI_WRITE, &tmp,
++ u32 tmp;
++ int ret;
++
++ ret = kstrtou32(buf, 10, &tmp);
++ if (ret)
++ return ret;
++
++ ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, HPWMI_WRITE, &tmp,
+ sizeof(tmp), sizeof(tmp));
+ if (ret)
+ return ret < 0 ? ret : -EINVAL;
+diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
+index 3201a83073b5..c514cb73bb50 100644
+--- a/drivers/platform/x86/intel-hid.c
++++ b/drivers/platform/x86/intel-hid.c
+@@ -87,6 +87,13 @@ static const struct dmi_system_id button_array_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Wacom MobileStudio Pro 16"),
+ },
+ },
++ {
++ .ident = "HP Spectre x2 (2015)",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x2 Detachable"),
++ },
++ },
+ { }
+ };
+
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index a0d0cecff55f..d122f33d43ac 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -39,28 +39,51 @@ static const struct key_entry intel_vbtn_keymap[] = {
+ { KE_IGNORE, 0xC7, { KEY_VOLUMEDOWN } }, /* volume-down key release */
+ { KE_KEY, 0xC8, { KEY_ROTATE_LOCK_TOGGLE } }, /* rotate-lock key press */
+ { KE_KEY, 0xC9, { KEY_ROTATE_LOCK_TOGGLE } }, /* rotate-lock key release */
++};
++
++static const struct key_entry intel_vbtn_switchmap[] = {
+ { KE_SW, 0xCA, { .sw = { SW_DOCK, 1 } } }, /* Docked */
+ { KE_SW, 0xCB, { .sw = { SW_DOCK, 0 } } }, /* Undocked */
+ { KE_SW, 0xCC, { .sw = { SW_TABLET_MODE, 1 } } }, /* Tablet */
+ { KE_SW, 0xCD, { .sw = { SW_TABLET_MODE, 0 } } }, /* Laptop */
+- { KE_END },
+ };
+
++#define KEYMAP_LEN \
++ (ARRAY_SIZE(intel_vbtn_keymap) + ARRAY_SIZE(intel_vbtn_switchmap) + 1)
++
+ struct intel_vbtn_priv {
++ struct key_entry keymap[KEYMAP_LEN];
+ struct input_dev *input_dev;
++ bool has_switches;
+ bool wakeup_mode;
+ };
+
+ static int intel_vbtn_input_setup(struct platform_device *device)
+ {
+ struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev);
+- int ret;
++ int ret, keymap_len = 0;
++
++ if (true) {
++ memcpy(&priv->keymap[keymap_len], intel_vbtn_keymap,
++ ARRAY_SIZE(intel_vbtn_keymap) *
++ sizeof(struct key_entry));
++ keymap_len += ARRAY_SIZE(intel_vbtn_keymap);
++ }
++
++ if (priv->has_switches) {
++ memcpy(&priv->keymap[keymap_len], intel_vbtn_switchmap,
++ ARRAY_SIZE(intel_vbtn_switchmap) *
++ sizeof(struct key_entry));
++ keymap_len += ARRAY_SIZE(intel_vbtn_switchmap);
++ }
++
++ priv->keymap[keymap_len].type = KE_END;
+
+ priv->input_dev = devm_input_allocate_device(&device->dev);
+ if (!priv->input_dev)
+ return -ENOMEM;
+
+- ret = sparse_keymap_setup(priv->input_dev, intel_vbtn_keymap, NULL);
++ ret = sparse_keymap_setup(priv->input_dev, priv->keymap, NULL);
+ if (ret)
+ return ret;
+
+@@ -115,31 +138,40 @@ out_unknown:
+
+ static void detect_tablet_mode(struct platform_device *device)
+ {
+- const char *chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
+ struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev);
+ acpi_handle handle = ACPI_HANDLE(&device->dev);
+- struct acpi_buffer vgbs_output = { ACPI_ALLOCATE_BUFFER, NULL };
+- union acpi_object *obj;
++ unsigned long long vgbs;
+ acpi_status status;
+ int m;
+
+- if (!(chassis_type && strcmp(chassis_type, "31") == 0))
+- goto out;
+-
+- status = acpi_evaluate_object(handle, "VGBS", NULL, &vgbs_output);
++ status = acpi_evaluate_integer(handle, "VGBS", NULL, &vgbs);
+ if (ACPI_FAILURE(status))
+- goto out;
+-
+- obj = vgbs_output.pointer;
+- if (!(obj && obj->type == ACPI_TYPE_INTEGER))
+- goto out;
++ return;
+
+- m = !(obj->integer.value & TABLET_MODE_FLAG);
++ m = !(vgbs & TABLET_MODE_FLAG);
+ input_report_switch(priv->input_dev, SW_TABLET_MODE, m);
+- m = (obj->integer.value & DOCK_MODE_FLAG) ? 1 : 0;
++ m = (vgbs & DOCK_MODE_FLAG) ? 1 : 0;
+ input_report_switch(priv->input_dev, SW_DOCK, m);
+-out:
+- kfree(vgbs_output.pointer);
++}
++
++static bool intel_vbtn_has_switches(acpi_handle handle)
++{
++ const char *chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
++ unsigned long long vgbs;
++ acpi_status status;
++
++ /*
++ * Some normal laptops have a VGBS method despite being non-convertible
++ * and their VGBS method always returns 0, causing detect_tablet_mode()
++ * to report SW_TABLET_MODE=1 to userspace, which causes issues.
++ * These laptops have a DMI chassis_type of 9 ("Laptop"), do not report
++ * switches on any devices with a DMI chassis_type of 9.
++ */
++ if (chassis_type && strcmp(chassis_type, "9") == 0)
++ return false;
++
++ status = acpi_evaluate_integer(handle, "VGBS", NULL, &vgbs);
++ return ACPI_SUCCESS(status);
+ }
+
+ static int intel_vbtn_probe(struct platform_device *device)
+@@ -160,13 +192,16 @@ static int intel_vbtn_probe(struct platform_device *device)
+ return -ENOMEM;
+ dev_set_drvdata(&device->dev, priv);
+
++ priv->has_switches = intel_vbtn_has_switches(handle);
++
+ err = intel_vbtn_input_setup(device);
+ if (err) {
+ pr_err("Failed to setup Intel Virtual Button\n");
+ return err;
+ }
+
+- detect_tablet_mode(device);
++ if (priv->has_switches)
++ detect_tablet_mode(device);
+
+ status = acpi_install_notify_handler(handle,
+ ACPI_DEVICE_NOTIFY,
+diff --git a/drivers/power/reset/vexpress-poweroff.c b/drivers/power/reset/vexpress-poweroff.c
+index e9e749f87517..8fb43c4438e6 100644
+--- a/drivers/power/reset/vexpress-poweroff.c
++++ b/drivers/power/reset/vexpress-poweroff.c
+@@ -150,6 +150,7 @@ static struct platform_driver vexpress_reset_driver = {
+ .driver = {
+ .name = "vexpress-reset",
+ .of_match_table = vexpress_reset_of_match,
++ .suppress_bind_attrs = true,
+ },
+ };
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index 81bd824bb9d9..bdb12bf0d5c7 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -3940,6 +3940,7 @@ void megasas_refire_mgmt_cmd(struct megasas_instance *instance)
+ struct fusion_context *fusion;
+ struct megasas_cmd *cmd_mfi;
+ union MEGASAS_REQUEST_DESCRIPTOR_UNION *req_desc;
++ struct MPI2_RAID_SCSI_IO_REQUEST *scsi_io_req;
+ u16 smid;
+ bool refire_cmd = 0;
+ u8 result;
+@@ -3990,6 +3991,11 @@ void megasas_refire_mgmt_cmd(struct megasas_instance *instance)
+ break;
+ }
+
++ scsi_io_req = (struct MPI2_RAID_SCSI_IO_REQUEST *)
++ cmd_fusion->io_request;
++ if (scsi_io_req->Function == MPI2_FUNCTION_SCSI_TASK_MGMT)
++ result = RETURN_CMD;
++
+ switch (result) {
+ case REFIRE_CMD:
+ megasas_fire_cmd_fusion(instance, req_desc);
+@@ -4187,7 +4193,6 @@ megasas_issue_tm(struct megasas_instance *instance, u16 device_handle,
+ if (!timeleft) {
+ dev_err(&instance->pdev->dev,
+ "task mgmt type 0x%x timed out\n", type);
+- cmd_mfi->flags |= DRV_DCMD_SKIP_REFIRE;
+ mutex_unlock(&instance->reset_mutex);
+ rc = megasas_reset_fusion(instance->host, MFI_IO_TIMEOUT_OCR);
+ mutex_lock(&instance->reset_mutex);
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 285a6f463013..2145a70dac69 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -681,7 +681,7 @@ static void read_from_hw(struct bcm_qspi *qspi, int slots)
+ if (buf)
+ buf[tp.byte] = read_rxram_slot_u8(qspi, slot);
+ dev_dbg(&qspi->pdev->dev, "RD %02x\n",
+- buf ? buf[tp.byte] : 0xff);
++ buf ? buf[tp.byte] : 0x0);
+ } else {
+ u16 *buf = tp.trans->rx_buf;
+
+@@ -689,7 +689,7 @@ static void read_from_hw(struct bcm_qspi *qspi, int slots)
+ buf[tp.byte / 2] = read_rxram_slot_u16(qspi,
+ slot);
+ dev_dbg(&qspi->pdev->dev, "RD %04x\n",
+- buf ? buf[tp.byte] : 0xffff);
++ buf ? buf[tp.byte / 2] : 0x0);
+ }
+
+ update_qspi_trans_byte_count(qspi, &tp,
+@@ -744,13 +744,13 @@ static int write_to_hw(struct bcm_qspi *qspi, struct spi_device *spi)
+ while (!tstatus && slot < MSPI_NUM_CDRAM) {
+ if (tp.trans->bits_per_word <= 8) {
+ const u8 *buf = tp.trans->tx_buf;
+- u8 val = buf ? buf[tp.byte] : 0xff;
++ u8 val = buf ? buf[tp.byte] : 0x00;
+
+ write_txram_slot_u8(qspi, slot, val);
+ dev_dbg(&qspi->pdev->dev, "WR %02x\n", val);
+ } else {
+ const u16 *buf = tp.trans->tx_buf;
+- u16 val = buf ? buf[tp.byte / 2] : 0xffff;
++ u16 val = buf ? buf[tp.byte / 2] : 0x0000;
+
+ write_txram_slot_u16(qspi, slot, val);
+ dev_dbg(&qspi->pdev->dev, "WR %04x\n", val);
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index eab27d41ba83..df6abc75bc16 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -793,7 +793,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
+ goto out_clk_disable;
+ }
+
+- err = devm_spi_register_master(&pdev->dev, master);
++ err = spi_register_master(master);
+ if (err) {
+ dev_err(&pdev->dev, "could not register SPI master: %d\n", err);
+ goto out_clk_disable;
+@@ -813,6 +813,8 @@ static int bcm2835_spi_remove(struct platform_device *pdev)
+ struct spi_master *master = platform_get_drvdata(pdev);
+ struct bcm2835_spi *bs = spi_master_get_devdata(master);
+
++ spi_unregister_master(master);
++
+ /* Clear FIFOs, and disable the HW block */
+ bcm2835_wr(bs, BCM2835_SPI_CS,
+ BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX);
+diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
+index c63ed402cf86..11895c98aae3 100644
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -485,7 +485,7 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
+ goto out_clk_disable;
+ }
+
+- err = devm_spi_register_master(&pdev->dev, master);
++ err = spi_register_master(master);
+ if (err) {
+ dev_err(&pdev->dev, "could not register SPI master: %d\n", err);
+ goto out_clk_disable;
+@@ -505,6 +505,8 @@ static int bcm2835aux_spi_remove(struct platform_device *pdev)
+ struct spi_master *master = platform_get_drvdata(pdev);
+ struct bcm2835aux_spi *bs = spi_master_get_devdata(master);
+
++ spi_unregister_master(master);
++
+ bcm2835aux_spi_reset_hw(bs);
+
+ /* disable the HW block by releasing the clock */
+diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
+index 3db905f5f345..10f328558d55 100644
+--- a/drivers/spi/spi-dw-mid.c
++++ b/drivers/spi/spi-dw-mid.c
+@@ -155,6 +155,7 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_tx(struct dw_spi *dws,
+ if (!xfer->tx_buf)
+ return NULL;
+
++ memset(&txconf, 0, sizeof(txconf));
+ txconf.direction = DMA_MEM_TO_DEV;
+ txconf.dst_addr = dws->dma_addr;
+ txconf.dst_maxburst = 16;
+@@ -201,6 +202,7 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws,
+ if (!xfer->rx_buf)
+ return NULL;
+
++ memset(&rxconf, 0, sizeof(rxconf));
+ rxconf.direction = DMA_DEV_TO_MEM;
+ rxconf.src_addr = dws->dma_addr;
+ rxconf.src_maxburst = 16;
+@@ -226,19 +228,23 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws,
+
+ static int mid_spi_dma_setup(struct dw_spi *dws, struct spi_transfer *xfer)
+ {
+- u16 dma_ctrl = 0;
++ u16 imr = 0, dma_ctrl = 0;
+
+ dw_writel(dws, DW_SPI_DMARDLR, 0xf);
+ dw_writel(dws, DW_SPI_DMATDLR, 0x10);
+
+- if (xfer->tx_buf)
++ if (xfer->tx_buf) {
+ dma_ctrl |= SPI_DMA_TDMAE;
+- if (xfer->rx_buf)
++ imr |= SPI_INT_TXOI;
++ }
++ if (xfer->rx_buf) {
+ dma_ctrl |= SPI_DMA_RDMAE;
++ imr |= SPI_INT_RXUI | SPI_INT_RXOI;
++ }
+ dw_writel(dws, DW_SPI_DMACR, dma_ctrl);
+
+ /* Set the interrupt mask */
+- spi_umask_intr(dws, SPI_INT_TXOI | SPI_INT_RXUI | SPI_INT_RXOI);
++ spi_umask_intr(dws, imr);
+
+ dws->transfer_handler = dma_transfer;
+
+@@ -268,7 +274,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, struct spi_transfer *xfer)
+ dma_async_issue_pending(dws->txchan);
+ }
+
+- return 0;
++ return 1;
+ }
+
+ static void mid_spi_dma_stop(struct dw_spi *dws)
+diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
+index 6f0f6b99953d..b1c137261d0f 100644
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -383,11 +383,8 @@ static int dw_spi_transfer_one(struct spi_controller *master,
+
+ spi_enable_chip(dws, 1);
+
+- if (dws->dma_mapped) {
+- ret = dws->dma_ops->dma_transfer(dws, transfer);
+- if (ret < 0)
+- return ret;
+- }
++ if (dws->dma_mapped)
++ return dws->dma_ops->dma_transfer(dws, transfer);
+
+ if (chip->poll_mode)
+ return poll_transfer(dws);
+@@ -533,10 +530,11 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws)
+ dws->dma_inited = 0;
+ } else {
+ master->can_dma = dws->dma_ops->can_dma;
++ master->flags |= SPI_CONTROLLER_MUST_TX;
+ }
+ }
+
+- ret = devm_spi_register_controller(dev, master);
++ ret = spi_register_controller(master);
+ if (ret) {
+ dev_err(&master->dev, "problem registering spi master\n");
+ goto err_dma_exit;
+@@ -560,6 +558,8 @@ void dw_spi_remove_host(struct dw_spi *dws)
+ {
+ dw_spi_debugfs_remove(dws);
+
++ spi_unregister_controller(dws->master);
++
+ if (dws->dma_ops && dws->dma_ops->dma_exit)
+ dws->dma_ops->dma_exit(dws);
+
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index e4482823d8d7..eafd0c2135a1 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -156,6 +156,7 @@ static const struct lpss_config lpss_platforms[] = {
+ .tx_threshold_hi = 48,
+ .cs_sel_shift = 8,
+ .cs_sel_mask = 3 << 8,
++ .cs_clk_stays_gated = true,
+ },
+ { /* LPSS_CNL_SSP */
+ .offset = 0x200,
+@@ -1739,17 +1740,18 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
+
+ /* Register with the SPI framework */
+ platform_set_drvdata(pdev, drv_data);
+- status = devm_spi_register_controller(&pdev->dev, master);
++ status = spi_register_controller(master);
+ if (status != 0) {
+ dev_err(&pdev->dev, "problem registering spi master\n");
+- goto out_error_clock_enabled;
++ goto out_error_pm_runtime_enabled;
+ }
+
+ return status;
+
+-out_error_clock_enabled:
+- pm_runtime_put_noidle(&pdev->dev);
++out_error_pm_runtime_enabled:
+ pm_runtime_disable(&pdev->dev);
++
++out_error_clock_enabled:
+ clk_disable_unprepare(ssp->clk);
+
+ out_error_dma_irq_alloc:
+@@ -1773,6 +1775,8 @@ static int pxa2xx_spi_remove(struct platform_device *pdev)
+
+ pm_runtime_get_sync(&pdev->dev);
+
++ spi_unregister_controller(drv_data->master);
++
+ /* Disable the SSP at the peripheral and SOC level */
+ pxa2xx_spi_write(drv_data, SSCR0, 0);
+ clk_disable_unprepare(ssp->clk);
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index fa730a871d25..8a5966963834 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -92,7 +92,6 @@
+ #define PCH_MAX_SPBR 1023
+
+ /* Definition for ML7213/ML7223/ML7831 by LAPIS Semiconductor */
+-#define PCI_VENDOR_ID_ROHM 0x10DB
+ #define PCI_DEVICE_ID_ML7213_SPI 0x802c
+ #define PCI_DEVICE_ID_ML7223_SPI 0x800F
+ #define PCI_DEVICE_ID_ML7831_SPI 0x8816
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 88a8a8edd44b..f589d8100e95 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2305,7 +2305,8 @@ void spi_unregister_controller(struct spi_controller *ctlr)
+ {
+ struct spi_controller *found;
+ int id = ctlr->bus_num;
+- int dummy;
++
++ device_for_each_child(&ctlr->dev, NULL, __unregister);
+
+ /* First make sure that this controller was ever added */
+ mutex_lock(&board_lock);
+@@ -2319,7 +2320,6 @@ void spi_unregister_controller(struct spi_controller *ctlr)
+ list_del(&ctlr->list);
+ mutex_unlock(&board_lock);
+
+- dummy = device_for_each_child(&ctlr->dev, NULL, __unregister);
+ device_unregister(&ctlr->dev);
+ /* free bus id */
+ mutex_lock(&board_lock);
+diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c
+index 31db510018a9..6babcdb4d7d2 100644
+--- a/drivers/staging/android/ion/ion_heap.c
++++ b/drivers/staging/android/ion/ion_heap.c
+@@ -97,12 +97,12 @@ int ion_heap_map_user(struct ion_heap *heap, struct ion_buffer *buffer,
+
+ static int ion_heap_clear_pages(struct page **pages, int num, pgprot_t pgprot)
+ {
+- void *addr = vm_map_ram(pages, num, -1, pgprot);
++ void *addr = vmap(pages, num, VM_MAP, pgprot);
+
+ if (!addr)
+ return -ENOMEM;
+ memset(addr, 0, PAGE_SIZE * num);
+- vm_unmap_ram(addr, num);
++ vunmap(addr);
+
+ return 0;
+ }
+diff --git a/drivers/staging/greybus/sdio.c b/drivers/staging/greybus/sdio.c
+index 38e85033fc4b..afb2e5e5111a 100644
+--- a/drivers/staging/greybus/sdio.c
++++ b/drivers/staging/greybus/sdio.c
+@@ -411,6 +411,7 @@ static int gb_sdio_command(struct gb_sdio_host *host, struct mmc_command *cmd)
+ struct gb_sdio_command_request request = {0};
+ struct gb_sdio_command_response response;
+ struct mmc_data *data = host->mrq->data;
++ unsigned int timeout_ms;
+ u8 cmd_flags;
+ u8 cmd_type;
+ int i;
+@@ -469,9 +470,12 @@ static int gb_sdio_command(struct gb_sdio_host *host, struct mmc_command *cmd)
+ request.data_blksz = cpu_to_le16(data->blksz);
+ }
+
+- ret = gb_operation_sync(host->connection, GB_SDIO_TYPE_COMMAND,
+- &request, sizeof(request), &response,
+- sizeof(response));
++ timeout_ms = cmd->busy_timeout ? cmd->busy_timeout :
++ GB_OPERATION_TIMEOUT_DEFAULT;
++
++ ret = gb_operation_sync_timeout(host->connection, GB_SDIO_TYPE_COMMAND,
++ &request, sizeof(request), &response,
++ sizeof(response), timeout_ms);
+ if (ret < 0)
+ goto out;
+
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index bbe5cba21522..02091782bc1e 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1690,12 +1690,6 @@ pci_wch_ch38x_setup(struct serial_private *priv,
+ #define PCIE_DEVICE_ID_WCH_CH384_4S 0x3470
+ #define PCIE_DEVICE_ID_WCH_CH382_2S 0x3253
+
+-#define PCI_VENDOR_ID_PERICOM 0x12D8
+-#define PCI_DEVICE_ID_PERICOM_PI7C9X7951 0x7951
+-#define PCI_DEVICE_ID_PERICOM_PI7C9X7952 0x7952
+-#define PCI_DEVICE_ID_PERICOM_PI7C9X7954 0x7954
+-#define PCI_DEVICE_ID_PERICOM_PI7C9X7958 0x7958
+-
+ #define PCI_VENDOR_ID_ACCESIO 0x494f
+ #define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB 0x1051
+ #define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S 0x1053
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index 3245cdbf9116..e5ff30544bd0 100644
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -192,8 +192,6 @@ enum {
+ #define PCH_UART_HAL_LOOP (PCH_UART_MCR_LOOP)
+ #define PCH_UART_HAL_AFE (PCH_UART_MCR_AFE)
+
+-#define PCI_VENDOR_ID_ROHM 0x10DB
+-
+ #define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
+
+ #define DEFAULT_UARTCLK 1843200 /* 1.8432 MHz */
+diff --git a/drivers/usb/dwc3/dwc3-haps.c b/drivers/usb/dwc3/dwc3-haps.c
+index c9cc33881bef..02d57d98ef9b 100644
+--- a/drivers/usb/dwc3/dwc3-haps.c
++++ b/drivers/usb/dwc3/dwc3-haps.c
+@@ -15,10 +15,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/property.h>
+
+-#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd
+-#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3_AXI 0xabce
+-#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB31 0xabcf
+-
+ /**
+ * struct dwc3_haps - Driver private structure
+ * @dwc3: child dwc3 platform_device
+diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
+index 991184b8bb41..667011c99372 100644
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -368,7 +368,6 @@ struct pch_udc_dev {
+ #define PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC 0x0939
+ #define PCI_DEVICE_ID_INTEL_EG20T_UDC 0x8808
+
+-#define PCI_VENDOR_ID_ROHM 0x10DB
+ #define PCI_DEVICE_ID_ML7213_IOH_UDC 0x801D
+ #define PCI_DEVICE_ID_ML7831_IOH_UDC 0x8808
+
+diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c
+index 696106ecdff0..967030176d87 100644
+--- a/drivers/video/fbdev/w100fb.c
++++ b/drivers/video/fbdev/w100fb.c
+@@ -583,6 +583,7 @@ static void w100fb_restore_vidmem(struct w100fb_par *par)
+ memsize=par->mach->mem->size;
+ memcpy_toio(remapped_fbuf + (W100_FB_BASE-MEM_WINDOW_BASE), par->saved_extmem, memsize);
+ vfree(par->saved_extmem);
++ par->saved_extmem = NULL;
+ }
+ if (par->saved_intmem) {
+ memsize=MEM_INT_SIZE;
+@@ -591,6 +592,7 @@ static void w100fb_restore_vidmem(struct w100fb_par *par)
+ else
+ memcpy_toio(remapped_fbuf + (W100_FB_BASE-MEM_WINDOW_BASE), par->saved_intmem, memsize);
+ vfree(par->saved_intmem);
++ par->saved_intmem = NULL;
+ }
+ }
+
+diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
+index 3099052e1243..0667bc6e7d23 100644
+--- a/drivers/w1/masters/omap_hdq.c
++++ b/drivers/w1/masters/omap_hdq.c
+@@ -176,7 +176,7 @@ static int hdq_write_byte(struct hdq_data *hdq_data, u8 val, u8 *status)
+ /* check irqstatus */
+ if (!(*status & OMAP_HDQ_INT_STATUS_TXCOMPLETE)) {
+ dev_dbg(hdq_data->dev, "timeout waiting for"
+- " TXCOMPLETE/RXCOMPLETE, %x", *status);
++ " TXCOMPLETE/RXCOMPLETE, %x\n", *status);
+ ret = -ETIMEDOUT;
+ goto out;
+ }
+@@ -187,7 +187,7 @@ static int hdq_write_byte(struct hdq_data *hdq_data, u8 val, u8 *status)
+ OMAP_HDQ_FLAG_CLEAR, &tmp_status);
+ if (ret) {
+ dev_dbg(hdq_data->dev, "timeout waiting GO bit"
+- " return to zero, %x", tmp_status);
++ " return to zero, %x\n", tmp_status);
+ }
+
+ out:
+@@ -203,7 +203,7 @@ static irqreturn_t hdq_isr(int irq, void *_hdq)
+ spin_lock_irqsave(&hdq_data->hdq_spinlock, irqflags);
+ hdq_data->hdq_irqstatus = hdq_reg_in(hdq_data, OMAP_HDQ_INT_STATUS);
+ spin_unlock_irqrestore(&hdq_data->hdq_spinlock, irqflags);
+- dev_dbg(hdq_data->dev, "hdq_isr: %x", hdq_data->hdq_irqstatus);
++ dev_dbg(hdq_data->dev, "hdq_isr: %x\n", hdq_data->hdq_irqstatus);
+
+ if (hdq_data->hdq_irqstatus &
+ (OMAP_HDQ_INT_STATUS_TXCOMPLETE | OMAP_HDQ_INT_STATUS_RXCOMPLETE
+@@ -311,7 +311,7 @@ static int omap_hdq_break(struct hdq_data *hdq_data)
+ tmp_status = hdq_data->hdq_irqstatus;
+ /* check irqstatus */
+ if (!(tmp_status & OMAP_HDQ_INT_STATUS_TIMEOUT)) {
+- dev_dbg(hdq_data->dev, "timeout waiting for TIMEOUT, %x",
++ dev_dbg(hdq_data->dev, "timeout waiting for TIMEOUT, %x\n",
+ tmp_status);
+ ret = -ETIMEDOUT;
+ goto out;
+@@ -338,7 +338,7 @@ static int omap_hdq_break(struct hdq_data *hdq_data)
+ &tmp_status);
+ if (ret)
+ dev_dbg(hdq_data->dev, "timeout waiting INIT&GO bits"
+- " return to zero, %x", tmp_status);
++ " return to zero, %x\n", tmp_status);
+
+ out:
+ mutex_unlock(&hdq_data->hdq_mutex);
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index b3fbfed28682..398fd8b1639d 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -1096,7 +1096,8 @@ static void set_backend_state(struct xenbus_device *dev,
+ case XenbusStateInitialised:
+ switch (state) {
+ case XenbusStateConnected:
+- backend_connect(dev);
++ if (backend_connect(dev))
++ return;
+ xenbus_switch_state(dev, XenbusStateConnected);
+ break;
+ case XenbusStateClosing:
+diff --git a/fs/aio.c b/fs/aio.c
+index b5fbf2061868..413ec289bfa1 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -169,6 +169,7 @@ struct fsync_iocb {
+ struct file *file;
+ struct work_struct work;
+ bool datasync;
++ struct cred *creds;
+ };
+
+ struct poll_iocb {
+@@ -1579,8 +1580,11 @@ static ssize_t aio_write(struct kiocb *req, const struct iocb *iocb,
+ static void aio_fsync_work(struct work_struct *work)
+ {
+ struct aio_kiocb *iocb = container_of(work, struct aio_kiocb, fsync.work);
++ const struct cred *old_cred = override_creds(iocb->fsync.creds);
+
+ iocb->ki_res.res = vfs_fsync(iocb->fsync.file, iocb->fsync.datasync);
++ revert_creds(old_cred);
++ put_cred(iocb->fsync.creds);
+ iocb_put(iocb);
+ }
+
+@@ -1594,6 +1598,10 @@ static int aio_fsync(struct fsync_iocb *req, const struct iocb *iocb,
+ if (unlikely(!req->file->f_op->fsync))
+ return -EINVAL;
+
++ req->creds = prepare_creds();
++ if (!req->creds)
++ return -ENOMEM;
++
+ req->datasync = datasync;
+ INIT_WORK(&req->work, aio_fsync_work);
+ schedule_work(&req->work);
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index 96763805787e..1b9c8ffb038f 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -112,11 +112,11 @@ no_valid_dev_replace_entry_found:
+ break;
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED:
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED:
+- dev_replace->srcdev = btrfs_find_device(fs_info, src_devid,
+- NULL, NULL);
+- dev_replace->tgtdev = btrfs_find_device(fs_info,
++ dev_replace->srcdev = btrfs_find_device(fs_info->fs_devices,
++ src_devid, NULL, NULL, true);
++ dev_replace->tgtdev = btrfs_find_device(fs_info->fs_devices,
+ BTRFS_DEV_REPLACE_DEVID,
+- NULL, NULL);
++ NULL, NULL, true);
+ /*
+ * allow 'btrfs dev replace_cancel' if src/tgt device is
+ * missing
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index da7a2a530647..9740f7b5d4fb 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -438,6 +438,16 @@ int btrfs_verify_level_key(struct btrfs_fs_info *fs_info,
+ */
+ if (btrfs_header_generation(eb) > fs_info->last_trans_committed)
+ return 0;
++
++ /* We have @first_key, so this @eb must have at least one item */
++ if (btrfs_header_nritems(eb) == 0) {
++ btrfs_err(fs_info,
++ "invalid tree nritems, bytenr=%llu nritems=0 expect >0",
++ eb->start);
++ WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG));
++ return -EUCLEAN;
++ }
++
+ if (found_level)
+ btrfs_node_key_to_cpu(eb, &found_key, 0);
+ else
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index f9e280d0b44f..1b8a04b767ff 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -785,10 +785,12 @@ again:
+ nritems = btrfs_header_nritems(path->nodes[0]);
+ if (!nritems || (path->slots[0] >= nritems - 1)) {
+ ret = btrfs_next_leaf(root, path);
+- if (ret == 1)
++ if (ret < 0) {
++ goto out;
++ } else if (ret > 0) {
+ found_next = 1;
+- if (ret != 0)
+ goto insert;
++ }
+ slot = path->slots[0];
+ }
+ btrfs_item_key_to_cpu(path->nodes[0], &found_key, slot);
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index c69e5b255745..887f9ebc2bc2 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1136,8 +1136,8 @@ out_unlock:
+ */
+ if (extent_reserved) {
+ extent_clear_unlock_delalloc(inode, start,
+- start + cur_alloc_size,
+- start + cur_alloc_size,
++ start + cur_alloc_size - 1,
++ start + cur_alloc_size - 1,
+ locked_page,
+ clear_bits,
+ page_ops);
+@@ -8399,7 +8399,6 @@ static int btrfs_submit_direct_hook(struct btrfs_dio_private *dip)
+
+ /* bio split */
+ ASSERT(map_length <= INT_MAX);
+- atomic_inc(&dip->pending_bios);
+ do {
+ clone_len = min_t(int, submit_len, map_length);
+
+@@ -8450,7 +8449,8 @@ submit:
+ if (!status)
+ return 0;
+
+- bio_put(bio);
++ if (bio != orig_bio)
++ bio_put(bio);
+ out_err:
+ dip->errors = 1;
+ /*
+@@ -8491,7 +8491,7 @@ static void btrfs_submit_direct(struct bio *dio_bio, struct inode *inode,
+ bio->bi_private = dip;
+ dip->orig_bio = bio;
+ dip->dio_bio = dio_bio;
+- atomic_set(&dip->pending_bios, 0);
++ atomic_set(&dip->pending_bios, 1);
+ io_bio = btrfs_io_bio(bio);
+ io_bio->logical = file_offset;
+
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 199c70b8f7d8..a5ae02bf3652 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1642,7 +1642,7 @@ static noinline int btrfs_ioctl_resize(struct file *file,
+ btrfs_info(fs_info, "resizing devid %llu", devid);
+ }
+
+- device = btrfs_find_device(fs_info, devid, NULL, NULL);
++ device = btrfs_find_device(fs_info->fs_devices, devid, NULL, NULL, true);
+ if (!device) {
+ btrfs_info(fs_info, "resizer unable to find device %llu",
+ devid);
+@@ -3178,7 +3178,8 @@ static long btrfs_ioctl_dev_info(struct btrfs_fs_info *fs_info,
+ s_uuid = di_args->uuid;
+
+ rcu_read_lock();
+- dev = btrfs_find_device(fs_info, di_args->devid, s_uuid, NULL);
++ dev = btrfs_find_device(fs_info->fs_devices, di_args->devid, s_uuid,
++ NULL, true);
+
+ if (!dev) {
+ ret = -ENODEV;
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index cbd40826f5dc..c8ed4db73b84 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2259,6 +2259,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
+ struct btrfs_root *quota_root;
+ struct btrfs_qgroup *srcgroup;
+ struct btrfs_qgroup *dstgroup;
++ bool need_rescan = false;
+ u32 level_size = 0;
+ u64 nums;
+
+@@ -2402,6 +2403,13 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
+ goto unlock;
+ }
+ ++i_qgroups;
++
++ /*
++ * If we're doing a snapshot, and adding the snapshot to a new
++ * qgroup, the numbers are guaranteed to be incorrect.
++ */
++ if (srcid)
++ need_rescan = true;
+ }
+
+ for (i = 0; i < inherit->num_ref_copies; ++i, i_qgroups += 2) {
+@@ -2421,6 +2429,9 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
+
+ dst->rfer = src->rfer - level_size;
+ dst->rfer_cmpr = src->rfer_cmpr - level_size;
++
++ /* Manually tweaking numbers certainly needs a rescan */
++ need_rescan = true;
+ }
+ for (i = 0; i < inherit->num_excl_copies; ++i, i_qgroups += 2) {
+ struct btrfs_qgroup *src;
+@@ -2439,6 +2450,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
+
+ dst->excl = src->excl + level_size;
+ dst->excl_cmpr = src->excl_cmpr + level_size;
++ need_rescan = true;
+ }
+
+ unlock:
+@@ -2446,6 +2458,8 @@ unlock:
+ out:
+ if (!committing)
+ mutex_unlock(&fs_info->qgroup_ioctl_lock);
++ if (need_rescan)
++ fs_info->qgroup_flags |= BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT;
+ return ret;
+ }
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index 6b6008db3e03..fee8995c9a0c 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -3835,7 +3835,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ return PTR_ERR(sctx);
+
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+- dev = btrfs_find_device(fs_info, devid, NULL, NULL);
++ dev = btrfs_find_device(fs_info->fs_devices, devid, NULL, NULL, true);
+ if (!dev || (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state) &&
+ !is_dev_replace)) {
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+@@ -4019,7 +4019,7 @@ int btrfs_scrub_progress(struct btrfs_fs_info *fs_info, u64 devid,
+ struct scrub_ctx *sctx = NULL;
+
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+- dev = btrfs_find_device(fs_info, devid, NULL, NULL);
++ dev = btrfs_find_device(fs_info->fs_devices, devid, NULL, NULL, true);
+ if (dev)
+ sctx = dev->scrub_ctx;
+ if (sctx)
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 931a7d1ddc95..2bc80d0b56db 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -23,6 +23,7 @@
+ #include "btrfs_inode.h"
+ #include "transaction.h"
+ #include "compression.h"
++#include "xattr.h"
+
+ /*
+ * Maximum number of references an extent can have in order for us to attempt to
+@@ -4543,6 +4544,10 @@ static int __process_new_xattr(int num, struct btrfs_key *di_key,
+ struct fs_path *p;
+ struct posix_acl_xattr_header dummy_acl;
+
++ /* Capabilities are emitted by finish_inode_if_needed */
++ if (!strncmp(name, XATTR_NAME_CAPS, name_len))
++ return 0;
++
+ p = fs_path_alloc();
+ if (!p)
+ return -ENOMEM;
+@@ -5105,6 +5110,64 @@ static int send_extent_data(struct send_ctx *sctx,
+ return 0;
+ }
+
++/*
++ * Search for a capability xattr related to sctx->cur_ino. If the capability is
++ * found, call send_set_xattr function to emit it.
++ *
++ * Return 0 if there isn't a capability, or when the capability was emitted
++ * successfully, or < 0 if an error occurred.
++ */
++static int send_capabilities(struct send_ctx *sctx)
++{
++ struct fs_path *fspath = NULL;
++ struct btrfs_path *path;
++ struct btrfs_dir_item *di;
++ struct extent_buffer *leaf;
++ unsigned long data_ptr;
++ char *buf = NULL;
++ int buf_len;
++ int ret = 0;
++
++ path = alloc_path_for_send();
++ if (!path)
++ return -ENOMEM;
++
++ di = btrfs_lookup_xattr(NULL, sctx->send_root, path, sctx->cur_ino,
++ XATTR_NAME_CAPS, strlen(XATTR_NAME_CAPS), 0);
++ if (!di) {
++ /* There is no xattr for this inode */
++ goto out;
++ } else if (IS_ERR(di)) {
++ ret = PTR_ERR(di);
++ goto out;
++ }
++
++ leaf = path->nodes[0];
++ buf_len = btrfs_dir_data_len(leaf, di);
++
++ fspath = fs_path_alloc();
++ buf = kmalloc(buf_len, GFP_KERNEL);
++ if (!fspath || !buf) {
++ ret = -ENOMEM;
++ goto out;
++ }
++
++ ret = get_cur_path(sctx, sctx->cur_ino, sctx->cur_inode_gen, fspath);
++ if (ret < 0)
++ goto out;
++
++ data_ptr = (unsigned long)(di + 1) + btrfs_dir_name_len(leaf, di);
++ read_extent_buffer(leaf, buf, data_ptr, buf_len);
++
++ ret = send_set_xattr(sctx, fspath, XATTR_NAME_CAPS,
++ strlen(XATTR_NAME_CAPS), buf, buf_len);
++out:
++ kfree(buf);
++ fs_path_free(fspath);
++ btrfs_free_path(path);
++ return ret;
++}
++
+ static int clone_range(struct send_ctx *sctx,
+ struct clone_root *clone_root,
+ const u64 disk_byte,
+@@ -5936,6 +5999,10 @@ static int finish_inode_if_needed(struct send_ctx *sctx, int at_end)
+ goto out;
+ }
+
++ ret = send_capabilities(sctx);
++ if (ret < 0)
++ goto out;
++
+ /*
+ * If other directory inodes depended on our current directory
+ * inode's move/rename, now do their move/rename operations.
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index 3ec712cba58e..d98ec885b72a 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -485,6 +485,13 @@ static int check_leaf(struct btrfs_fs_info *fs_info, struct extent_buffer *leaf,
+ u32 nritems = btrfs_header_nritems(leaf);
+ int slot;
+
++ if (btrfs_header_level(leaf) != 0) {
++ generic_err(fs_info, leaf, 0,
++ "invalid level for leaf, have %d expect 0",
++ btrfs_header_level(leaf));
++ return -EUCLEAN;
++ }
++
+ /*
+ * Extent buffers from a relocation tree have a owner field that
+ * corresponds to the subvolume tree they are based on. So just from an
+@@ -509,6 +516,12 @@ static int check_leaf(struct btrfs_fs_info *fs_info, struct extent_buffer *leaf,
+ owner);
+ return -EUCLEAN;
+ }
++ /* Unknown tree */
++ if (owner == 0) {
++ generic_err(fs_info, leaf, 0,
++ "invalid owner, root 0 is not defined");
++ return -EUCLEAN;
++ }
+ key.objectid = owner;
+ key.type = BTRFS_ROOT_ITEM_KEY;
+ key.offset = (u64)-1;
+@@ -643,9 +656,16 @@ int btrfs_check_node(struct btrfs_fs_info *fs_info, struct extent_buffer *node)
+ unsigned long nr = btrfs_header_nritems(node);
+ struct btrfs_key key, next_key;
+ int slot;
++ int level = btrfs_header_level(node);
+ u64 bytenr;
+ int ret = 0;
+
++ if (level <= 0 || level >= BTRFS_MAX_LEVEL) {
++ generic_err(fs_info, node, 0,
++ "invalid level for node, have %d expect [1, %d]",
++ level, BTRFS_MAX_LEVEL - 1);
++ return -EUCLEAN;
++ }
+ if (nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(fs_info)) {
+ btrfs_crit(fs_info,
+ "corrupt node: root=%llu block=%llu, nritems too %s, have %lu expect range [1,%u]",
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 9c3b394b99fa..b9ce42877e46 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -347,27 +347,6 @@ static struct btrfs_device *__alloc_device(void)
+ return dev;
+ }
+
+-/*
+- * Find a device specified by @devid or @uuid in the list of @fs_devices, or
+- * return NULL.
+- *
+- * If devid and uuid are both specified, the match must be exact, otherwise
+- * only devid is used.
+- */
+-static struct btrfs_device *find_device(struct btrfs_fs_devices *fs_devices,
+- u64 devid, const u8 *uuid)
+-{
+- struct btrfs_device *dev;
+-
+- list_for_each_entry(dev, &fs_devices->devices, dev_list) {
+- if (dev->devid == devid &&
+- (!uuid || !memcmp(dev->uuid, uuid, BTRFS_UUID_SIZE))) {
+- return dev;
+- }
+- }
+- return NULL;
+-}
+-
+ static noinline struct btrfs_fs_devices *find_fsid(u8 *fsid)
+ {
+ struct btrfs_fs_devices *fs_devices;
+@@ -772,8 +751,8 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ device = NULL;
+ } else {
+ mutex_lock(&fs_devices->device_list_mutex);
+- device = find_device(fs_devices, devid,
+- disk_super->dev_item.uuid);
++ device = btrfs_find_device(fs_devices, devid,
++ disk_super->dev_item.uuid, NULL, false);
+ }
+
+ if (!device) {
+@@ -972,6 +951,8 @@ again:
+ &device->dev_state)) {
+ if (!test_bit(BTRFS_DEV_STATE_REPLACE_TGT,
+ &device->dev_state) &&
++ !test_bit(BTRFS_DEV_STATE_MISSING,
++ &device->dev_state) &&
+ (!latest_dev ||
+ device->generation > latest_dev->generation)) {
+ latest_dev = device;
+@@ -2144,7 +2125,8 @@ static int btrfs_find_device_by_path(struct btrfs_fs_info *fs_info,
+ disk_super = (struct btrfs_super_block *)bh->b_data;
+ devid = btrfs_stack_device_id(&disk_super->dev_item);
+ dev_uuid = disk_super->dev_item.uuid;
+- *device = btrfs_find_device(fs_info, devid, dev_uuid, disk_super->fsid);
++ *device = btrfs_find_device(fs_info->fs_devices, devid, dev_uuid,
++ disk_super->fsid, true);
+ brelse(bh);
+ if (!*device)
+ ret = -ENOENT;
+@@ -2190,7 +2172,8 @@ int btrfs_find_device_by_devspec(struct btrfs_fs_info *fs_info, u64 devid,
+
+ if (devid) {
+ ret = 0;
+- *device = btrfs_find_device(fs_info, devid, NULL, NULL);
++ *device = btrfs_find_device(fs_info->fs_devices, devid,
++ NULL, NULL, true);
+ if (!*device)
+ ret = -ENOENT;
+ } else {
+@@ -2322,7 +2305,8 @@ next_slot:
+ BTRFS_UUID_SIZE);
+ read_extent_buffer(leaf, fs_uuid, btrfs_device_fsid(dev_item),
+ BTRFS_FSID_SIZE);
+- device = btrfs_find_device(fs_info, devid, dev_uuid, fs_uuid);
++ device = btrfs_find_device(fs_info->fs_devices, devid, dev_uuid,
++ fs_uuid, true);
+ BUG_ON(!device); /* Logic error */
+
+ if (device->fs_devices->seeding) {
+@@ -6254,21 +6238,36 @@ blk_status_t btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
+ return BLK_STS_OK;
+ }
+
+-struct btrfs_device *btrfs_find_device(struct btrfs_fs_info *fs_info, u64 devid,
+- u8 *uuid, u8 *fsid)
++/*
++ * Find a device specified by @devid or @uuid in the list of @fs_devices, or
++ * return NULL.
++ *
++ * If devid and uuid are both specified, the match must be exact, otherwise
++ * only devid is used.
++ *
++ * If @seed is true, traverse through the seed devices.
++ */
++struct btrfs_device *btrfs_find_device(struct btrfs_fs_devices *fs_devices,
++ u64 devid, u8 *uuid, u8 *fsid,
++ bool seed)
+ {
+ struct btrfs_device *device;
+- struct btrfs_fs_devices *cur_devices;
+
+- cur_devices = fs_info->fs_devices;
+- while (cur_devices) {
++ while (fs_devices) {
+ if (!fsid ||
+- !memcmp(cur_devices->fsid, fsid, BTRFS_FSID_SIZE)) {
+- device = find_device(cur_devices, devid, uuid);
+- if (device)
+- return device;
++ !memcmp(fs_devices->fsid, fsid, BTRFS_FSID_SIZE)) {
++ list_for_each_entry(device, &fs_devices->devices,
++ dev_list) {
++ if (device->devid == devid &&
++ (!uuid || memcmp(device->uuid, uuid,
++ BTRFS_UUID_SIZE) == 0))
++ return device;
++ }
+ }
+- cur_devices = cur_devices->seed;
++ if (seed)
++ fs_devices = fs_devices->seed;
++ else
++ return NULL;
+ }
+ return NULL;
+ }
+@@ -6513,8 +6512,8 @@ static int read_one_chunk(struct btrfs_fs_info *fs_info, struct btrfs_key *key,
+ read_extent_buffer(leaf, uuid, (unsigned long)
+ btrfs_stripe_dev_uuid_nr(chunk, i),
+ BTRFS_UUID_SIZE);
+- map->stripes[i].dev = btrfs_find_device(fs_info, devid,
+- uuid, NULL);
++ map->stripes[i].dev = btrfs_find_device(fs_info->fs_devices,
++ devid, uuid, NULL, true);
+ if (!map->stripes[i].dev &&
+ !btrfs_test_opt(fs_info, DEGRADED)) {
+ free_extent_map(em);
+@@ -6653,7 +6652,8 @@ static int read_one_dev(struct btrfs_fs_info *fs_info,
+ return PTR_ERR(fs_devices);
+ }
+
+- device = btrfs_find_device(fs_info, devid, dev_uuid, fs_uuid);
++ device = btrfs_find_device(fs_info->fs_devices, devid, dev_uuid,
++ fs_uuid, true);
+ if (!device) {
+ if (!btrfs_test_opt(fs_info, DEGRADED)) {
+ btrfs_report_missing_device(fs_info, devid,
+@@ -7243,7 +7243,8 @@ int btrfs_get_dev_stats(struct btrfs_fs_info *fs_info,
+ int i;
+
+ mutex_lock(&fs_devices->device_list_mutex);
+- dev = btrfs_find_device(fs_info, stats->devid, NULL, NULL);
++ dev = btrfs_find_device(fs_info->fs_devices, stats->devid,
++ NULL, NULL, true);
+ mutex_unlock(&fs_devices->device_list_mutex);
+
+ if (!dev) {
+@@ -7460,7 +7461,7 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info,
+ }
+
+ /* Make sure no dev extent is beyond device bondary */
+- dev = btrfs_find_device(fs_info, devid, NULL, NULL);
++ dev = btrfs_find_device(fs_info->fs_devices, devid, NULL, NULL, true);
+ if (!dev) {
+ btrfs_err(fs_info, "failed to find devid %llu", devid);
+ ret = -EUCLEAN;
+@@ -7469,7 +7470,8 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info,
+
+ /* It's possible this device is a dummy for seed device */
+ if (dev->disk_total_bytes == 0) {
+- dev = find_device(fs_info->fs_devices->seed, devid, NULL);
++ dev = btrfs_find_device(fs_info->fs_devices->seed, devid,
++ NULL, NULL, false);
+ if (!dev) {
+ btrfs_err(fs_info, "failed to find seed devid %llu",
+ devid);
+diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
+index ac703b15d679..8e8bf3246de1 100644
+--- a/fs/btrfs/volumes.h
++++ b/fs/btrfs/volumes.h
+@@ -430,8 +430,8 @@ void __exit btrfs_cleanup_fs_uuids(void);
+ int btrfs_num_copies(struct btrfs_fs_info *fs_info, u64 logical, u64 len);
+ int btrfs_grow_device(struct btrfs_trans_handle *trans,
+ struct btrfs_device *device, u64 new_size);
+-struct btrfs_device *btrfs_find_device(struct btrfs_fs_info *fs_info, u64 devid,
+- u8 *uuid, u8 *fsid);
++struct btrfs_device *btrfs_find_device(struct btrfs_fs_devices *fs_devices,
++ u64 devid, u8 *uuid, u8 *fsid, bool seed);
+ int btrfs_shrink_device(struct btrfs_device *device, u64 new_size);
+ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *path);
+ int btrfs_balance(struct btrfs_fs_info *fs_info,
+diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
+index adf6668b596f..c5794ff64a01 100644
+--- a/fs/ext4/ext4_extents.h
++++ b/fs/ext4/ext4_extents.h
+@@ -157,10 +157,13 @@ struct ext4_ext_path {
+ (EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1)
+ #define EXT_LAST_INDEX(__hdr__) \
+ (EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1)
+-#define EXT_MAX_EXTENT(__hdr__) \
+- (EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)
++#define EXT_MAX_EXTENT(__hdr__) \
++ ((le16_to_cpu((__hdr__)->eh_max)) ? \
++ ((EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)) \
++ : 0)
+ #define EXT_MAX_INDEX(__hdr__) \
+- (EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)
++ ((le16_to_cpu((__hdr__)->eh_max)) ? \
++ ((EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)) : 0)
+
+ static inline struct ext4_extent_header *ext_inode_hdr(struct inode *inode)
+ {
+diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
+index 5508baa11bb6..8a28d47bd502 100644
+--- a/fs/ext4/fsync.c
++++ b/fs/ext4/fsync.c
+@@ -44,30 +44,28 @@
+ */
+ static int ext4_sync_parent(struct inode *inode)
+ {
+- struct dentry *dentry = NULL;
+- struct inode *next;
++ struct dentry *dentry, *next;
+ int ret = 0;
+
+ if (!ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY))
+ return 0;
+- inode = igrab(inode);
++ dentry = d_find_any_alias(inode);
++ if (!dentry)
++ return 0;
+ while (ext4_test_inode_state(inode, EXT4_STATE_NEWENTRY)) {
+ ext4_clear_inode_state(inode, EXT4_STATE_NEWENTRY);
+- dentry = d_find_any_alias(inode);
+- if (!dentry)
+- break;
+- next = igrab(d_inode(dentry->d_parent));
++
++ next = dget_parent(dentry);
+ dput(dentry);
+- if (!next)
+- break;
+- iput(inode);
+- inode = next;
++ dentry = next;
++ inode = dentry->d_inode;
++
+ /*
+ * The directory inode may have gone through rmdir by now. But
+ * the inode itself and its blocks are still allocated (we hold
+- * a reference to the inode so it didn't go through
+- * ext4_evict_inode()) and so we are safe to flush metadata
+- * blocks and the inode.
++ * a reference to the inode via its dentry), so it didn't go
++ * through ext4_evict_inode()) and so we are safe to flush
++ * metadata blocks and the inode.
+ */
+ ret = sync_mapping_buffers(inode->i_mapping);
+ if (ret)
+@@ -76,7 +74,7 @@ static int ext4_sync_parent(struct inode *inode)
+ if (ret)
+ break;
+ }
+- iput(inode);
++ dput(dentry);
+ return ret;
+ }
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index f73fc90e5daa..899567d74c2a 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1824,8 +1824,11 @@ ext4_xattr_block_find(struct inode *inode, struct ext4_xattr_info *i,
+ if (EXT4_I(inode)->i_file_acl) {
+ /* The inode already has an extended attribute block. */
+ bs->bh = ext4_sb_bread(sb, EXT4_I(inode)->i_file_acl, REQ_PRIO);
+- if (IS_ERR(bs->bh))
+- return PTR_ERR(bs->bh);
++ if (IS_ERR(bs->bh)) {
++ error = PTR_ERR(bs->bh);
++ bs->bh = NULL;
++ return error;
++ }
+ ea_bdebug(bs->bh, "b_count=%d, refcount=%d",
+ atomic_read(&(bs->bh->b_count)),
+ le32_to_cpu(BHDR(bs->bh)->h_refcount));
+diff --git a/fs/fat/inode.c b/fs/fat/inode.c
+index 70d37a5fd72c..607e1d124062 100644
+--- a/fs/fat/inode.c
++++ b/fs/fat/inode.c
+@@ -1519,6 +1519,12 @@ static int fat_read_bpb(struct super_block *sb, struct fat_boot_sector *b,
+ goto out;
+ }
+
++ if (bpb->fat_fat_length == 0 && bpb->fat32_length == 0) {
++ if (!silent)
++ fat_msg(sb, KERN_ERR, "bogus number of FAT sectors");
++ goto out;
++ }
++
+ error = 0;
+
+ out:
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index a89e27367e34..7bfeb1643c1f 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -269,6 +269,7 @@ void __inode_attach_wb(struct inode *inode, struct page *page)
+ if (unlikely(cmpxchg(&inode->i_wb, NULL, wb)))
+ wb_put(wb);
+ }
++EXPORT_SYMBOL_GPL(__inode_attach_wb);
+
+ /**
+ * locked_inode_to_wb_and_lock_list - determine a locked inode's wb and lock it
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 445eef41bfaf..91b58c897f92 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -2780,6 +2780,8 @@ int nilfs_attach_log_writer(struct super_block *sb, struct nilfs_root *root)
+ if (!nilfs->ns_writer)
+ return -ENOMEM;
+
++ inode_attach_wb(nilfs->ns_bdev->bd_inode, NULL);
++
+ err = nilfs_segctor_start_thread(nilfs->ns_writer);
+ if (err) {
+ kfree(nilfs->ns_writer);
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index ffc73600216b..6eb0b882ad23 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -43,7 +43,7 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+ {
+ ssize_t list_size, size, value_size = 0;
+ char *buf, *name, *value = NULL;
+- int uninitialized_var(error);
++ int error = 0;
+ size_t slen;
+
+ if (!(old->d_inode->i_opflags & IOP_XATTR) ||
+diff --git a/fs/proc/inode.c b/fs/proc/inode.c
+index fc5306a31a1d..31bf3bb8ddae 100644
+--- a/fs/proc/inode.c
++++ b/fs/proc/inode.c
+@@ -451,7 +451,7 @@ const struct inode_operations proc_link_inode_operations = {
+
+ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
+ {
+- struct inode *inode = new_inode_pseudo(sb);
++ struct inode *inode = new_inode(sb);
+
+ if (inode) {
+ inode->i_ino = de->low_ino;
+diff --git a/fs/proc/self.c b/fs/proc/self.c
+index 127265e5c55f..cc6d4253399d 100644
+--- a/fs/proc/self.c
++++ b/fs/proc/self.c
+@@ -42,7 +42,7 @@ int proc_setup_self(struct super_block *s)
+ inode_lock(root_inode);
+ self = d_alloc_name(s->s_root, "self");
+ if (self) {
+- struct inode *inode = new_inode_pseudo(s);
++ struct inode *inode = new_inode(s);
+ if (inode) {
+ inode->i_ino = self_inum;
+ inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
+diff --git a/fs/proc/thread_self.c b/fs/proc/thread_self.c
+index b905010ca9eb..ed009aa135dd 100644
+--- a/fs/proc/thread_self.c
++++ b/fs/proc/thread_self.c
+@@ -42,7 +42,7 @@ int proc_setup_thread_self(struct super_block *s)
+ inode_lock(root_inode);
+ thread_self = d_alloc_name(s->s_root, "thread-self");
+ if (thread_self) {
+- struct inode *inode = new_inode_pseudo(s);
++ struct inode *inode = new_inode(s);
+ if (inode) {
+ inode->i_ino = thread_self_inum;
+ inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
+diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
+index e638740f1681..3e1dd66bd676 100644
+--- a/fs/xfs/xfs_bmap_util.c
++++ b/fs/xfs/xfs_bmap_util.c
+@@ -1823,7 +1823,7 @@ xfs_swap_extents(
+ if (xfs_inode_has_cow_data(tip)) {
+ error = xfs_reflink_cancel_cow_range(tip, 0, NULLFILEOFF, true);
+ if (error)
+- return error;
++ goto out_unlock;
+ }
+
+ /*
+diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
+index c1f7c0d5d608..b33a9cd4fe94 100644
+--- a/fs/xfs/xfs_buf.c
++++ b/fs/xfs/xfs_buf.c
+@@ -1202,8 +1202,10 @@ xfs_buf_ioend(
+ bp->b_ops->verify_read(bp);
+ }
+
+- if (!bp->b_error)
++ if (!bp->b_error) {
++ bp->b_flags &= ~XBF_WRITE_FAIL;
+ bp->b_flags |= XBF_DONE;
++ }
+
+ if (bp->b_iodone)
+ (*(bp->b_iodone))(bp);
+@@ -1263,7 +1265,7 @@ xfs_bwrite(
+
+ bp->b_flags |= XBF_WRITE;
+ bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q |
+- XBF_WRITE_FAIL | XBF_DONE);
++ XBF_DONE);
+
+ error = xfs_buf_submit(bp);
+ if (error) {
+@@ -2000,7 +2002,7 @@ xfs_buf_delwri_submit_buffers(
+ * synchronously. Otherwise, drop the buffer from the delwri
+ * queue and submit async.
+ */
+- bp->b_flags &= ~(_XBF_DELWRI_Q | XBF_WRITE_FAIL);
++ bp->b_flags &= ~_XBF_DELWRI_Q;
+ bp->b_flags |= XBF_WRITE;
+ if (wait_list) {
+ bp->b_flags &= ~XBF_ASYNC;
+diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
+index a1af984e4913..59b2b29542f4 100644
+--- a/fs/xfs/xfs_dquot.c
++++ b/fs/xfs/xfs_dquot.c
+@@ -1120,13 +1120,12 @@ xfs_qm_dqflush(
+ dqb = bp->b_addr + dqp->q_bufoffset;
+ ddqp = &dqb->dd_diskdq;
+
+- /*
+- * A simple sanity check in case we got a corrupted dquot.
+- */
+- fa = xfs_dqblk_verify(mp, dqb, be32_to_cpu(ddqp->d_id), 0);
++ /* sanity check the in-core structure before we flush */
++ fa = xfs_dquot_verify(mp, &dqp->q_core, be32_to_cpu(dqp->q_core.d_id),
++ 0);
+ if (fa) {
+ xfs_alert(mp, "corrupt dquot ID 0x%x in memory at %pS",
+- be32_to_cpu(ddqp->d_id), fa);
++ be32_to_cpu(dqp->q_core.d_id), fa);
+ xfs_buf_relse(bp);
+ xfs_dqfunlock(dqp);
+ xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
+diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
+index e465bb15912d..6be5545d3584 100644
+--- a/include/linux/kgdb.h
++++ b/include/linux/kgdb.h
+@@ -317,7 +317,7 @@ extern void gdbstub_exit(int status);
+ extern int kgdb_single_step;
+ extern atomic_t kgdb_active;
+ #define in_dbg_master() \
+- (raw_smp_processor_id() == atomic_read(&kgdb_active))
++ (irqs_disabled() && (smp_processor_id() == atomic_read(&kgdb_active)))
+ extern bool dbg_is_early;
+ extern void __init dbg_late_init(void);
+ #else /* ! CONFIG_KGDB */
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 92c6f80e6327..a0de4c7dc9d3 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -1327,8 +1327,8 @@ static inline long kvm_arch_vcpu_async_ioctl(struct file *filp,
+ }
+ #endif /* CONFIG_HAVE_KVM_VCPU_ASYNC_IOCTL */
+
+-int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
+- unsigned long start, unsigned long end, bool blockable);
++void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
++ unsigned long start, unsigned long end);
+
+ #ifdef CONFIG_HAVE_KVM_VCPU_RUN_PID_CHANGE
+ int kvm_arch_vcpu_run_pid_change(struct kvm_vcpu *vcpu);
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index b1092046ebef..05bc5f25ab85 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -601,6 +601,7 @@ static inline void *kvcalloc(size_t n, size_t size, gfp_t flags)
+ }
+
+ extern void kvfree(const void *addr);
++extern void kvfree_sensitive(const void *addr, size_t len);
+
+ /*
+ * Mapcount of compound page as a whole, does not include mapped sub-pages.
+diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
+index d6791e2df30a..fdd93a39f1fa 100644
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -638,6 +638,8 @@ typedef struct pglist_data {
+ /*
+ * Must be held any time you expect node_start_pfn, node_present_pages
+ * or node_spanned_pages stay constant.
++ * Also synchronizes pgdat->first_deferred_pfn during deferred page
++ * init.
+ *
+ * pgdat_resize_lock() and pgdat_resize_unlock() are provided to
+ * manipulate node_size_lock without checking for CONFIG_MEMORY_HOTPLUG
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index d157983b84cf..c0dd2f749d3f 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -117,6 +117,10 @@
+ #define PCI_CLASS_SERIAL_USB_DEVICE 0x0c03fe
+ #define PCI_CLASS_SERIAL_FIBER 0x0c04
+ #define PCI_CLASS_SERIAL_SMBUS 0x0c05
++#define PCI_CLASS_SERIAL_IPMI 0x0c07
++#define PCI_CLASS_SERIAL_IPMI_SMIC 0x0c0700
++#define PCI_CLASS_SERIAL_IPMI_KCS 0x0c0701
++#define PCI_CLASS_SERIAL_IPMI_BT 0x0c0702
+
+ #define PCI_BASE_CLASS_WIRELESS 0x0d
+ #define PCI_CLASS_WIRELESS_RF_CONTROLLER 0x0d10
+@@ -144,6 +148,8 @@
+
+ /* Vendors and devices. Sort key: vendor first, device next. */
+
++#define PCI_VENDOR_ID_LOONGSON 0x0014
++
+ #define PCI_VENDOR_ID_TTTECH 0x0357
+ #define PCI_DEVICE_ID_TTTECH_MC322 0x000a
+
+@@ -541,6 +547,11 @@
+ #define PCI_DEVICE_ID_AMD_16H_NB_F4 0x1534
+ #define PCI_DEVICE_ID_AMD_16H_M30H_NB_F3 0x1583
+ #define PCI_DEVICE_ID_AMD_16H_M30H_NB_F4 0x1584
++#define PCI_DEVICE_ID_AMD_17H_DF_F3 0x1463
++#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F3 0x15eb
++#define PCI_DEVICE_ID_AMD_17H_M30H_DF_F3 0x1493
++#define PCI_DEVICE_ID_AMD_17H_M70H_DF_F3 0x1443
++#define PCI_DEVICE_ID_AMD_19H_DF_F3 0x1653
+ #define PCI_DEVICE_ID_AMD_CNB17H_F3 0x1703
+ #define PCI_DEVICE_ID_AMD_LANCE 0x2000
+ #define PCI_DEVICE_ID_AMD_LANCE_HOME 0x2001
+@@ -1133,6 +1144,8 @@
+ #define PCI_VENDOR_ID_TCONRAD 0x10da
+ #define PCI_DEVICE_ID_TCONRAD_TOKENRING 0x0508
+
++#define PCI_VENDOR_ID_ROHM 0x10db
++
+ #define PCI_VENDOR_ID_NVIDIA 0x10de
+ #define PCI_DEVICE_ID_NVIDIA_TNT 0x0020
+ #define PCI_DEVICE_ID_NVIDIA_TNT2 0x0028
+@@ -1327,6 +1340,7 @@
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP78S_SMBUS 0x0752
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE 0x0759
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_SMBUS 0x07D8
++#define PCI_DEVICE_ID_NVIDIA_GEFORCE_320M 0x08A0
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP79_SMBUS 0x0AA2
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA 0x0D85
+
+@@ -1819,6 +1833,12 @@
+ #define PCI_VENDOR_ID_NVIDIA_SGS 0x12d2
+ #define PCI_DEVICE_ID_NVIDIA_SGS_RIVA128 0x0018
+
++#define PCI_VENDOR_ID_PERICOM 0x12D8
++#define PCI_DEVICE_ID_PERICOM_PI7C9X7951 0x7951
++#define PCI_DEVICE_ID_PERICOM_PI7C9X7952 0x7952
++#define PCI_DEVICE_ID_PERICOM_PI7C9X7954 0x7954
++#define PCI_DEVICE_ID_PERICOM_PI7C9X7958 0x7958
++
+ #define PCI_SUBVENDOR_ID_CHASE_PCIFAST 0x12E0
+ #define PCI_SUBDEVICE_ID_CHASE_PCIFAST4 0x0031
+ #define PCI_SUBDEVICE_ID_CHASE_PCIFAST8 0x0021
+@@ -1941,6 +1961,8 @@
+ #define PCI_VENDOR_ID_DIGIGRAM 0x1369
+ #define PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ES_SERIAL_SUBSYSTEM 0xc001
+ #define PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ES_CAE_SERIAL_SUBSYSTEM 0xc002
++#define PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ESE_SERIAL_SUBSYSTEM 0xc021
++#define PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ESE_CAE_SERIAL_SUBSYSTEM 0xc022
+
+ #define PCI_VENDOR_ID_KAWASAKI 0x136b
+ #define PCI_DEVICE_ID_MCHIP_KL5A72002 0xff01
+@@ -2122,6 +2144,7 @@
+ #define PCI_VENDOR_ID_MYRICOM 0x14c1
+
+ #define PCI_VENDOR_ID_MEDIATEK 0x14c3
++#define PCI_DEVICE_ID_MEDIATEK_7629 0x7629
+
+ #define PCI_VENDOR_ID_TITAN 0x14D2
+ #define PCI_DEVICE_ID_TITAN_010L 0x8001
+@@ -2354,6 +2377,12 @@
+ #define PCI_DEVICE_ID_CENATEK_IDE 0x0001
+
+ #define PCI_VENDOR_ID_SYNOPSYS 0x16c3
++#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd
++#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3_AXI 0xabce
++#define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB31 0xabcf
++#define PCI_DEVICE_ID_SYNOPSYS_EDDA 0xedda
++
++#define PCI_VENDOR_ID_USR 0x16ec
+
+ #define PCI_VENDOR_ID_VITESSE 0x1725
+ #define PCI_DEVICE_ID_VITESSE_VSC7174 0x7174
+@@ -2389,6 +2418,8 @@
+ #define PCI_DEVICE_ID_RDC_R6061 0x6061
+ #define PCI_DEVICE_ID_RDC_D1010 0x1010
+
++#define PCI_VENDOR_ID_GLI 0x17a0
++
+ #define PCI_VENDOR_ID_LENOVO 0x17aa
+
+ #define PCI_VENDOR_ID_QCOM 0x17cb
+@@ -2539,8 +2570,6 @@
+ #define PCI_VENDOR_ID_HUAWEI 0x19e5
+
+ #define PCI_VENDOR_ID_NETRONOME 0x19ee
+-#define PCI_DEVICE_ID_NETRONOME_NFP3200 0x3200
+-#define PCI_DEVICE_ID_NETRONOME_NFP3240 0x3240
+ #define PCI_DEVICE_ID_NETRONOME_NFP4000 0x4000
+ #define PCI_DEVICE_ID_NETRONOME_NFP5000 0x5000
+ #define PCI_DEVICE_ID_NETRONOME_NFP6000 0x6000
+@@ -2556,6 +2585,8 @@
+
+ #define PCI_VENDOR_ID_ASMEDIA 0x1b21
+
++#define PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS 0x1c36
++
+ #define PCI_VENDOR_ID_CIRCUITCO 0x1cc8
+ #define PCI_SUBSYSTEM_ID_CIRCUITCO_MINNOWBOARD 0x0001
+
+@@ -2981,6 +3012,7 @@
+ #define PCI_DEVICE_ID_INTEL_84460GX 0x84ea
+ #define PCI_DEVICE_ID_INTEL_IXP4XX 0x8500
+ #define PCI_DEVICE_ID_INTEL_IXP2800 0x9004
++#define PCI_DEVICE_ID_INTEL_VMD_9A0B 0x9a0b
+ #define PCI_DEVICE_ID_INTEL_S21152BB 0xb152
+
+ #define PCI_VENDOR_ID_SCALEMP 0x8686
+diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
+index e9d4e389aed9..766bbe813861 100644
+--- a/include/linux/sched/mm.h
++++ b/include/linux/sched/mm.h
+@@ -49,6 +49,8 @@ static inline void mmdrop(struct mm_struct *mm)
+ __mmdrop(mm);
+ }
+
++void mmdrop(struct mm_struct *mm);
++
+ /*
+ * This has to be called after a get_task_mm()/mmget_not_zero()
+ * followed by taking the mmap_sem for writing before modifying the
+diff --git a/include/linux/set_memory.h b/include/linux/set_memory.h
+index 2a986d282a97..a0e15e7b0b99 100644
+--- a/include/linux/set_memory.h
++++ b/include/linux/set_memory.h
+@@ -18,7 +18,7 @@ static inline int set_memory_nx(unsigned long addr, int numpages) { return 0; }
+ #endif
+
+ #ifndef set_mce_nospec
+-static inline int set_mce_nospec(unsigned long pfn)
++static inline int set_mce_nospec(unsigned long pfn, bool unmap)
+ {
+ return 0;
+ }
+diff --git a/include/linux/string.h b/include/linux/string.h
+index f58e1ef76572..4db285b83f44 100644
+--- a/include/linux/string.h
++++ b/include/linux/string.h
+@@ -239,6 +239,31 @@ void __read_overflow3(void) __compiletime_error("detected read beyond size of ob
+ void __write_overflow(void) __compiletime_error("detected write beyond size of object passed as 1st parameter");
+
+ #if !defined(__NO_FORTIFY) && defined(__OPTIMIZE__) && defined(CONFIG_FORTIFY_SOURCE)
++
++#ifdef CONFIG_KASAN
++extern void *__underlying_memchr(const void *p, int c, __kernel_size_t size) __RENAME(memchr);
++extern int __underlying_memcmp(const void *p, const void *q, __kernel_size_t size) __RENAME(memcmp);
++extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy);
++extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove);
++extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset);
++extern char *__underlying_strcat(char *p, const char *q) __RENAME(strcat);
++extern char *__underlying_strcpy(char *p, const char *q) __RENAME(strcpy);
++extern __kernel_size_t __underlying_strlen(const char *p) __RENAME(strlen);
++extern char *__underlying_strncat(char *p, const char *q, __kernel_size_t count) __RENAME(strncat);
++extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) __RENAME(strncpy);
++#else
++#define __underlying_memchr __builtin_memchr
++#define __underlying_memcmp __builtin_memcmp
++#define __underlying_memcpy __builtin_memcpy
++#define __underlying_memmove __builtin_memmove
++#define __underlying_memset __builtin_memset
++#define __underlying_strcat __builtin_strcat
++#define __underlying_strcpy __builtin_strcpy
++#define __underlying_strlen __builtin_strlen
++#define __underlying_strncat __builtin_strncat
++#define __underlying_strncpy __builtin_strncpy
++#endif
++
+ __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size)
+ {
+ size_t p_size = __builtin_object_size(p, 0);
+@@ -246,14 +271,14 @@ __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size)
+ __write_overflow();
+ if (p_size < size)
+ fortify_panic(__func__);
+- return __builtin_strncpy(p, q, size);
++ return __underlying_strncpy(p, q, size);
+ }
+
+ __FORTIFY_INLINE char *strcat(char *p, const char *q)
+ {
+ size_t p_size = __builtin_object_size(p, 0);
+ if (p_size == (size_t)-1)
+- return __builtin_strcat(p, q);
++ return __underlying_strcat(p, q);
+ if (strlcat(p, q, p_size) >= p_size)
+ fortify_panic(__func__);
+ return p;
+@@ -267,7 +292,7 @@ __FORTIFY_INLINE __kernel_size_t strlen(const char *p)
+ /* Work around gcc excess stack consumption issue */
+ if (p_size == (size_t)-1 ||
+ (__builtin_constant_p(p[p_size - 1]) && p[p_size - 1] == '\0'))
+- return __builtin_strlen(p);
++ return __underlying_strlen(p);
+ ret = strnlen(p, p_size);
+ if (p_size <= ret)
+ fortify_panic(__func__);
+@@ -300,7 +325,7 @@ __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size)
+ __write_overflow();
+ if (len >= p_size)
+ fortify_panic(__func__);
+- __builtin_memcpy(p, q, len);
++ __underlying_memcpy(p, q, len);
+ p[len] = '\0';
+ }
+ return ret;
+@@ -313,12 +338,12 @@ __FORTIFY_INLINE char *strncat(char *p, const char *q, __kernel_size_t count)
+ size_t p_size = __builtin_object_size(p, 0);
+ size_t q_size = __builtin_object_size(q, 0);
+ if (p_size == (size_t)-1 && q_size == (size_t)-1)
+- return __builtin_strncat(p, q, count);
++ return __underlying_strncat(p, q, count);
+ p_len = strlen(p);
+ copy_len = strnlen(q, count);
+ if (p_size < p_len + copy_len + 1)
+ fortify_panic(__func__);
+- __builtin_memcpy(p + p_len, q, copy_len);
++ __underlying_memcpy(p + p_len, q, copy_len);
+ p[p_len + copy_len] = '\0';
+ return p;
+ }
+@@ -330,7 +355,7 @@ __FORTIFY_INLINE void *memset(void *p, int c, __kernel_size_t size)
+ __write_overflow();
+ if (p_size < size)
+ fortify_panic(__func__);
+- return __builtin_memset(p, c, size);
++ return __underlying_memset(p, c, size);
+ }
+
+ __FORTIFY_INLINE void *memcpy(void *p, const void *q, __kernel_size_t size)
+@@ -345,7 +370,7 @@ __FORTIFY_INLINE void *memcpy(void *p, const void *q, __kernel_size_t size)
+ }
+ if (p_size < size || q_size < size)
+ fortify_panic(__func__);
+- return __builtin_memcpy(p, q, size);
++ return __underlying_memcpy(p, q, size);
+ }
+
+ __FORTIFY_INLINE void *memmove(void *p, const void *q, __kernel_size_t size)
+@@ -360,7 +385,7 @@ __FORTIFY_INLINE void *memmove(void *p, const void *q, __kernel_size_t size)
+ }
+ if (p_size < size || q_size < size)
+ fortify_panic(__func__);
+- return __builtin_memmove(p, q, size);
++ return __underlying_memmove(p, q, size);
+ }
+
+ extern void *__real_memscan(void *, int, __kernel_size_t) __RENAME(memscan);
+@@ -386,7 +411,7 @@ __FORTIFY_INLINE int memcmp(const void *p, const void *q, __kernel_size_t size)
+ }
+ if (p_size < size || q_size < size)
+ fortify_panic(__func__);
+- return __builtin_memcmp(p, q, size);
++ return __underlying_memcmp(p, q, size);
+ }
+
+ __FORTIFY_INLINE void *memchr(const void *p, int c, __kernel_size_t size)
+@@ -396,7 +421,7 @@ __FORTIFY_INLINE void *memchr(const void *p, int c, __kernel_size_t size)
+ __read_overflow();
+ if (p_size < size)
+ fortify_panic(__func__);
+- return __builtin_memchr(p, c, size);
++ return __underlying_memchr(p, c, size);
+ }
+
+ void *__real_memchr_inv(const void *s, int c, size_t n) __RENAME(memchr_inv);
+@@ -427,11 +452,22 @@ __FORTIFY_INLINE char *strcpy(char *p, const char *q)
+ size_t p_size = __builtin_object_size(p, 0);
+ size_t q_size = __builtin_object_size(q, 0);
+ if (p_size == (size_t)-1 && q_size == (size_t)-1)
+- return __builtin_strcpy(p, q);
++ return __underlying_strcpy(p, q);
+ memcpy(p, q, strlen(q) + 1);
+ return p;
+ }
+
++/* Don't use these outside the FORITFY_SOURCE implementation */
++#undef __underlying_memchr
++#undef __underlying_memcmp
++#undef __underlying_memcpy
++#undef __underlying_memmove
++#undef __underlying_memset
++#undef __underlying_strcat
++#undef __underlying_strcpy
++#undef __underlying_strlen
++#undef __underlying_strncat
++#undef __underlying_strncpy
+ #endif
+
+ /**
+diff --git a/include/linux/sunrpc/gss_api.h b/include/linux/sunrpc/gss_api.h
+index 5ac5db4d295f..566d5f547567 100644
+--- a/include/linux/sunrpc/gss_api.h
++++ b/include/linux/sunrpc/gss_api.h
+@@ -83,6 +83,7 @@ struct pf_desc {
+ u32 service;
+ char *name;
+ char *auth_domain_name;
++ struct auth_domain *domain;
+ bool datatouch;
+ };
+
+diff --git a/include/linux/sunrpc/svcauth_gss.h b/include/linux/sunrpc/svcauth_gss.h
+index a4528b26c8aa..d229d27ab19e 100644
+--- a/include/linux/sunrpc/svcauth_gss.h
++++ b/include/linux/sunrpc/svcauth_gss.h
+@@ -21,7 +21,8 @@ int gss_svc_init(void);
+ void gss_svc_shutdown(void);
+ int gss_svc_init_net(struct net *net);
+ void gss_svc_shutdown_net(struct net *net);
+-int svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name);
++struct auth_domain *svcauth_gss_register_pseudoflavor(u32 pseudoflavor,
++ char *name);
+ u32 svcauth_gss_flavor(struct auth_domain *dom);
+
+ #endif /* __KERNEL__ */
+diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
+index efe79c1cdd47..d55b68b113de 100644
+--- a/include/linux/uaccess.h
++++ b/include/linux/uaccess.h
+@@ -267,7 +267,7 @@ extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count);
+ probe_kernel_read(&retval, addr, sizeof(retval))
+
+ #ifndef user_access_begin
+-#define user_access_begin() do { } while (0)
++#define user_access_begin(type, ptr, len) access_ok(type, ptr, len)
+ #define user_access_end() do { } while (0)
+ #define unsafe_get_user(x, ptr, err) do { if (unlikely(__get_user(x, ptr))) goto err; } while (0)
+ #define unsafe_put_user(x, ptr, err) do { if (unlikely(__put_user(x, ptr))) goto err; } while (0)
+diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
+index 251be353f950..66ce6659ecb6 100644
+--- a/include/uapi/linux/kvm.h
++++ b/include/uapi/linux/kvm.h
+@@ -189,9 +189,11 @@ struct kvm_hyperv_exit {
+ #define KVM_EXIT_HYPERV_SYNIC 1
+ #define KVM_EXIT_HYPERV_HCALL 2
+ __u32 type;
++ __u32 pad1;
+ union {
+ struct {
+ __u32 msr;
++ __u32 pad2;
+ __u64 control;
+ __u64 evt_page;
+ __u64 msg_page;
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 7afec5f43c63..45741c3c48a4 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -893,7 +893,7 @@ main_queue:
+ return 0;
+ }
+
+-int audit_send_list(void *_dest)
++int audit_send_list_thread(void *_dest)
+ {
+ struct audit_netlink_list *dest = _dest;
+ struct sk_buff *skb;
+@@ -937,19 +937,30 @@ out_kfree_skb:
+ return NULL;
+ }
+
++static void audit_free_reply(struct audit_reply *reply)
++{
++ if (!reply)
++ return;
++
++ if (reply->skb)
++ kfree_skb(reply->skb);
++ if (reply->net)
++ put_net(reply->net);
++ kfree(reply);
++}
++
+ static int audit_send_reply_thread(void *arg)
+ {
+ struct audit_reply *reply = (struct audit_reply *)arg;
+- struct sock *sk = audit_get_sk(reply->net);
+
+ audit_ctl_lock();
+ audit_ctl_unlock();
+
+ /* Ignore failure. It'll only happen if the sender goes away,
+ because our timeout is set to infinite. */
+- netlink_unicast(sk, reply->skb, reply->portid, 0);
+- put_net(reply->net);
+- kfree(reply);
++ netlink_unicast(audit_get_sk(reply->net), reply->skb, reply->portid, 0);
++ reply->skb = NULL;
++ audit_free_reply(reply);
+ return 0;
+ }
+
+@@ -963,35 +974,32 @@ static int audit_send_reply_thread(void *arg)
+ * @payload: payload data
+ * @size: payload size
+ *
+- * Allocates an skb, builds the netlink message, and sends it to the port id.
+- * No failure notifications.
++ * Allocates a skb, builds the netlink message, and sends it to the port id.
+ */
+ static void audit_send_reply(struct sk_buff *request_skb, int seq, int type, int done,
+ int multi, const void *payload, int size)
+ {
+- struct net *net = sock_net(NETLINK_CB(request_skb).sk);
+- struct sk_buff *skb;
+ struct task_struct *tsk;
+- struct audit_reply *reply = kmalloc(sizeof(struct audit_reply),
+- GFP_KERNEL);
++ struct audit_reply *reply;
+
++ reply = kzalloc(sizeof(*reply), GFP_KERNEL);
+ if (!reply)
+ return;
+
+- skb = audit_make_reply(seq, type, done, multi, payload, size);
+- if (!skb)
+- goto out;
+-
+- reply->net = get_net(net);
++ reply->skb = audit_make_reply(seq, type, done, multi, payload, size);
++ if (!reply->skb)
++ goto err;
++ reply->net = get_net(sock_net(NETLINK_CB(request_skb).sk));
+ reply->portid = NETLINK_CB(request_skb).portid;
+- reply->skb = skb;
+
+ tsk = kthread_run(audit_send_reply_thread, reply, "audit_send_reply");
+- if (!IS_ERR(tsk))
+- return;
+- kfree_skb(skb);
+-out:
+- kfree(reply);
++ if (IS_ERR(tsk))
++ goto err;
++
++ return;
++
++err:
++ audit_free_reply(reply);
+ }
+
+ /*
+diff --git a/kernel/audit.h b/kernel/audit.h
+index 214e14948370..99badd7ba56f 100644
+--- a/kernel/audit.h
++++ b/kernel/audit.h
+@@ -248,7 +248,7 @@ struct audit_netlink_list {
+ struct sk_buff_head q;
+ };
+
+-int audit_send_list(void *_dest);
++int audit_send_list_thread(void *_dest);
+
+ extern int selinux_audit_rule_update(void);
+
+diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
+index 1c8a48abda80..b2cc63ca0068 100644
+--- a/kernel/auditfilter.c
++++ b/kernel/auditfilter.c
+@@ -1157,11 +1157,8 @@ int audit_rule_change(int type, int seq, void *data, size_t datasz)
+ */
+ int audit_list_rules_send(struct sk_buff *request_skb, int seq)
+ {
+- u32 portid = NETLINK_CB(request_skb).portid;
+- struct net *net = sock_net(NETLINK_CB(request_skb).sk);
+ struct task_struct *tsk;
+ struct audit_netlink_list *dest;
+- int err = 0;
+
+ /* We can't just spew out the rules here because we might fill
+ * the available socket buffer space and deadlock waiting for
+@@ -1169,25 +1166,26 @@ int audit_list_rules_send(struct sk_buff *request_skb, int seq)
+ * happen if we're actually running in the context of auditctl
+ * trying to _send_ the stuff */
+
+- dest = kmalloc(sizeof(struct audit_netlink_list), GFP_KERNEL);
++ dest = kmalloc(sizeof(*dest), GFP_KERNEL);
+ if (!dest)
+ return -ENOMEM;
+- dest->net = get_net(net);
+- dest->portid = portid;
++ dest->net = get_net(sock_net(NETLINK_CB(request_skb).sk));
++ dest->portid = NETLINK_CB(request_skb).portid;
+ skb_queue_head_init(&dest->q);
+
+ mutex_lock(&audit_filter_mutex);
+ audit_list_rules(seq, &dest->q);
+ mutex_unlock(&audit_filter_mutex);
+
+- tsk = kthread_run(audit_send_list, dest, "audit_send_list");
++ tsk = kthread_run(audit_send_list_thread, dest, "audit_send_list");
+ if (IS_ERR(tsk)) {
+ skb_queue_purge(&dest->q);
++ put_net(dest->net);
+ kfree(dest);
+- err = PTR_ERR(tsk);
++ return PTR_ERR(tsk);
+ }
+
+- return err;
++ return 0;
+ }
+
+ int audit_comparator(u32 left, u32 op, u32 right)
+diff --git a/kernel/compat.c b/kernel/compat.c
+index 8e40efc2928a..e4548a9e9c52 100644
+--- a/kernel/compat.c
++++ b/kernel/compat.c
+@@ -354,10 +354,9 @@ long compat_get_bitmap(unsigned long *mask, const compat_ulong_t __user *umask,
+ bitmap_size = ALIGN(bitmap_size, BITS_PER_COMPAT_LONG);
+ nr_compat_longs = BITS_TO_COMPAT_LONGS(bitmap_size);
+
+- if (!access_ok(VERIFY_READ, umask, bitmap_size / 8))
++ if (!user_access_begin(VERIFY_READ, umask, bitmap_size / 8))
+ return -EFAULT;
+
+- user_access_begin();
+ while (nr_compat_longs > 1) {
+ compat_ulong_t l1, l2;
+ unsafe_get_user(l1, umask++, Efault);
+@@ -384,10 +383,9 @@ long compat_put_bitmap(compat_ulong_t __user *umask, unsigned long *mask,
+ bitmap_size = ALIGN(bitmap_size, BITS_PER_COMPAT_LONG);
+ nr_compat_longs = BITS_TO_COMPAT_LONGS(bitmap_size);
+
+- if (!access_ok(VERIFY_WRITE, umask, bitmap_size / 8))
++ if (!user_access_begin(VERIFY_WRITE, umask, bitmap_size / 8))
+ return -EFAULT;
+
+- user_access_begin();
+ while (nr_compat_longs > 1) {
+ unsigned long m = *mask++;
+ unsafe_put_user((compat_ulong_t)m, umask++, Efault);
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 6d6c106a495c..08b9d6ba0807 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -3,6 +3,7 @@
+ *
+ * This code is licenced under the GPL.
+ */
++#include <linux/sched/mm.h>
+ #include <linux/proc_fs.h>
+ #include <linux/smp.h>
+ #include <linux/init.h>
+@@ -532,6 +533,21 @@ static int bringup_cpu(unsigned int cpu)
+ return bringup_wait_for_ap(cpu);
+ }
+
++static int finish_cpu(unsigned int cpu)
++{
++ struct task_struct *idle = idle_thread_get(cpu);
++ struct mm_struct *mm = idle->active_mm;
++
++ /*
++ * idle_task_exit() will have switched to &init_mm, now
++ * clean up any remaining active_mm state.
++ */
++ if (mm != &init_mm)
++ idle->active_mm = &init_mm;
++ mmdrop(mm);
++ return 0;
++}
++
+ /*
+ * Hotplug state machine related functions
+ */
+@@ -1379,7 +1395,7 @@ static struct cpuhp_step cpuhp_hp_states[] = {
+ [CPUHP_BRINGUP_CPU] = {
+ .name = "cpu:bringup",
+ .startup.single = bringup_cpu,
+- .teardown.single = NULL,
++ .teardown.single = finish_cpu,
+ .cant_stop = true,
+ },
+ /* Final state before CPU kills itself */
+diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c
+index 67b02e138a47..2ed6351e2a7e 100644
+--- a/kernel/cpu_pm.c
++++ b/kernel/cpu_pm.c
+@@ -89,7 +89,7 @@ EXPORT_SYMBOL_GPL(cpu_pm_unregister_notifier);
+ */
+ int cpu_pm_enter(void)
+ {
+- int nr_calls;
++ int nr_calls = 0;
+ int ret = 0;
+
+ ret = cpu_pm_notify(CPU_PM_ENTER, -1, &nr_calls);
+@@ -140,7 +140,7 @@ EXPORT_SYMBOL_GPL(cpu_pm_exit);
+ */
+ int cpu_cluster_pm_enter(void)
+ {
+- int nr_calls;
++ int nr_calls = 0;
+ int ret = 0;
+
+ ret = cpu_pm_notify(CPU_CLUSTER_PM_ENTER, -1, &nr_calls);
+diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
+index 94aa9ae0007a..6a1dc2613bb9 100644
+--- a/kernel/debug/debug_core.c
++++ b/kernel/debug/debug_core.c
+@@ -444,6 +444,7 @@ static int kgdb_reenter_check(struct kgdb_state *ks)
+
+ if (exception_level > 1) {
+ dump_stack();
++ kgdb_io_module_registered = false;
+ panic("Recursive entry to debugger");
+ }
+
+@@ -577,6 +578,8 @@ return_normal:
+ if (kgdb_skipexception(ks->ex_vector, ks->linux_regs))
+ goto kgdb_restore;
+
++ atomic_inc(&ignore_console_lock_warning);
++
+ /* Call the I/O driver's pre_exception routine */
+ if (dbg_io_ops->pre_exception)
+ dbg_io_ops->pre_exception();
+@@ -649,6 +652,8 @@ cpu_master_loop:
+ if (dbg_io_ops->post_exception)
+ dbg_io_ops->post_exception();
+
++ atomic_dec(&ignore_console_lock_warning);
++
+ if (!kgdb_single_step) {
+ raw_spin_unlock(&dbg_slave_lock);
+ /* Wait till all the CPUs have quit from the debugger. */
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 21e3c65abc76..a17e6302ded5 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -94,11 +94,11 @@ static void remote_function(void *data)
+ * @info: the function call argument
+ *
+ * Calls the function @func when the task is currently running. This might
+- * be on the current CPU, which just calls the function directly
++ * be on the current CPU, which just calls the function directly. This will
++ * retry due to any failures in smp_call_function_single(), such as if the
++ * task_cpu() goes offline concurrently.
+ *
+- * returns: @func return value, or
+- * -ESRCH - when the process isn't running
+- * -EAGAIN - when the process moved away
++ * returns @func return value or -ESRCH when the process isn't running
+ */
+ static int
+ task_function_call(struct task_struct *p, remote_function_f func, void *info)
+@@ -111,11 +111,16 @@ task_function_call(struct task_struct *p, remote_function_f func, void *info)
+ };
+ int ret;
+
+- do {
+- ret = smp_call_function_single(task_cpu(p), remote_function, &data, 1);
+- if (!ret)
+- ret = data.ret;
+- } while (ret == -EAGAIN);
++ for (;;) {
++ ret = smp_call_function_single(task_cpu(p), remote_function,
++ &data, 1);
++ ret = !ret ? data.ret : -EAGAIN;
++
++ if (ret != -EAGAIN)
++ break;
++
++ cond_resched();
++ }
+
+ return ret;
+ }
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 54c3269b8dda..eeaafd4064c9 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -772,8 +772,12 @@ void __noreturn do_exit(long code)
+ struct task_struct *tsk = current;
+ int group_dead;
+
+- profile_task_exit(tsk);
+- kcov_task_exit(tsk);
++ /*
++ * We can get here from a kernel oops, sometimes with preemption off.
++ * Start by checking for critical errors.
++ * Then fix up important state like USER_DS and preemption.
++ * Then do everything else.
++ */
+
+ WARN_ON(blk_needs_flush_plug(tsk));
+
+@@ -791,6 +795,16 @@ void __noreturn do_exit(long code)
+ */
+ set_fs(USER_DS);
+
++ if (unlikely(in_atomic())) {
++ pr_info("note: %s[%d] exited with preempt_count %d\n",
++ current->comm, task_pid_nr(current),
++ preempt_count());
++ preempt_count_set(PREEMPT_ENABLED);
++ }
++
++ profile_task_exit(tsk);
++ kcov_task_exit(tsk);
++
+ ptrace_event(PTRACE_EVENT_EXIT, code);
+
+ validate_creds_for_do_exit(tsk);
+@@ -828,13 +842,6 @@ void __noreturn do_exit(long code)
+ raw_spin_lock_irq(&tsk->pi_lock);
+ raw_spin_unlock_irq(&tsk->pi_lock);
+
+- if (unlikely(in_atomic())) {
+- pr_info("note: %s[%d] exited with preempt_count %d\n",
+- current->comm, task_pid_nr(current),
+- preempt_count());
+- preempt_count_set(PREEMPT_ENABLED);
+- }
+-
+ /* sync mm's RSS info before statistics gathering */
+ if (tsk->mm)
+ sync_mm_rss(tsk->mm);
+@@ -1617,10 +1624,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
+ if (!infop)
+ return err;
+
+- if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
++ if (!user_access_begin(VERIFY_WRITE, infop, sizeof(*infop)))
+ return -EFAULT;
+
+- user_access_begin();
+ unsafe_put_user(signo, &infop->si_signo, Efault);
+ unsafe_put_user(0, &infop->si_errno, Efault);
+ unsafe_put_user(info.cause, &infop->si_code, Efault);
+@@ -1745,10 +1751,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
+ if (!infop)
+ return err;
+
+- if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
++ if (!user_access_begin(VERIFY_WRITE, infop, sizeof(*infop)))
+ return -EFAULT;
+
+- user_access_begin();
+ unsafe_put_user(signo, &infop->si_signo, Efault);
+ unsafe_put_user(0, &infop->si_errno, Efault);
+ unsafe_put_user(info.cause, &infop->si_code, Efault);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 2befd2c4ce9e..0325ccf3a8e4 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5571,13 +5571,14 @@ void idle_task_exit(void)
+ struct mm_struct *mm = current->active_mm;
+
+ BUG_ON(cpu_online(smp_processor_id()));
++ BUG_ON(current != this_rq()->idle);
+
+ if (mm != &init_mm) {
+ switch_mm(mm, &init_mm, current);
+- current->active_mm = &init_mm;
+ finish_arch_post_lock_switch();
+ }
+- mmdrop(mm);
++
++ /* finish_cpu(), as ran on the BP, will clean up the active_mm state */
+ }
+
+ /*
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 86ccaaf0c1bf..92b1e71f13c8 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -2697,7 +2697,7 @@ void task_tick_numa(struct rq *rq, struct task_struct *curr)
+ /*
+ * We don't care about NUMA placement if we don't have memory.
+ */
+- if (!curr->mm || (curr->flags & PF_EXITING) || work->next != work)
++ if ((curr->flags & (PF_EXITING | PF_KTHREAD)) || work->next != work)
+ return;
+
+ /*
+diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
+index e01b705556aa..6c5229f98c9e 100644
+--- a/lib/mpi/longlong.h
++++ b/lib/mpi/longlong.h
+@@ -671,7 +671,7 @@ do { \
+ ************** MIPS/64 **************
+ ***************************************/
+ #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64
+-#if defined(__mips_isa_rev) && __mips_isa_rev >= 6
++#if defined(__mips_isa_rev) && __mips_isa_rev >= 6 && defined(CONFIG_CC_IS_GCC)
+ /*
+ * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C
+ * code below, so we special case MIPS64r6 until the compiler can do better.
+diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
+index e304b54c9c7d..fc5b1e2d997d 100644
+--- a/lib/strncpy_from_user.c
++++ b/lib/strncpy_from_user.c
+@@ -29,13 +29,6 @@ static inline long do_strncpy_from_user(char *dst, const char __user *src,
+ const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
+ unsigned long res = 0;
+
+- /*
+- * Truncate 'max' to the user-specified limit, so that
+- * we only have one limit we need to check in the loop
+- */
+- if (max > count)
+- max = count;
+-
+ if (IS_UNALIGNED(src, dst))
+ goto byte_at_a_time;
+
+@@ -113,12 +106,20 @@ long strncpy_from_user(char *dst, const char __user *src, long count)
+ unsigned long max = max_addr - src_addr;
+ long retval;
+
++ /*
++ * Truncate 'max' to the user-specified limit, so that
++ * we only have one limit we need to check in the loop
++ */
++ if (max > count)
++ max = count;
++
+ kasan_check_write(dst, count);
+ check_object_size(dst, count, false);
+- user_access_begin();
+- retval = do_strncpy_from_user(dst, src, count, max);
+- user_access_end();
+- return retval;
++ if (user_access_begin(VERIFY_READ, src, max)) {
++ retval = do_strncpy_from_user(dst, src, count, max);
++ user_access_end();
++ return retval;
++ }
+ }
+ return -EFAULT;
+ }
+diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c
+index 184f80f7bacf..0bf7c06ebdad 100644
+--- a/lib/strnlen_user.c
++++ b/lib/strnlen_user.c
+@@ -31,13 +31,6 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
+ unsigned long align, res = 0;
+ unsigned long c;
+
+- /*
+- * Truncate 'max' to the user-specified limit, so that
+- * we only have one limit we need to check in the loop
+- */
+- if (max > count)
+- max = count;
+-
+ /*
+ * Do everything aligned. But that means that we
+ * need to also expand the maximum..
+@@ -114,10 +107,18 @@ long strnlen_user(const char __user *str, long count)
+ unsigned long max = max_addr - src_addr;
+ long retval;
+
+- user_access_begin();
+- retval = do_strnlen_user(str, count, max);
+- user_access_end();
+- return retval;
++ /*
++ * Truncate 'max' to the user-specified limit, so that
++ * we only have one limit we need to check in the loop
++ */
++ if (max > count)
++ max = count;
++
++ if (user_access_begin(VERIFY_READ, str, max)) {
++ retval = do_strnlen_user(str, count, max);
++ user_access_end();
++ return retval;
++ }
+ }
+ return 0;
+ }
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 280b0e71b783..1443ae6fee9b 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2273,6 +2273,8 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
+ spinlock_t *ptl;
+ struct mm_struct *mm = vma->vm_mm;
+ unsigned long haddr = address & HPAGE_PMD_MASK;
++ bool was_locked = false;
++ pmd_t _pmd;
+
+ mmu_notifier_invalidate_range_start(mm, haddr, haddr + HPAGE_PMD_SIZE);
+ ptl = pmd_lock(mm, pmd);
+@@ -2282,11 +2284,32 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
+ * pmd against. Otherwise we can end up replacing wrong page.
+ */
+ VM_BUG_ON(freeze && !page);
+- if (page && page != pmd_page(*pmd))
+- goto out;
++ if (page) {
++ VM_WARN_ON_ONCE(!PageLocked(page));
++ was_locked = true;
++ if (page != pmd_page(*pmd))
++ goto out;
++ }
+
++repeat:
+ if (pmd_trans_huge(*pmd)) {
+- page = pmd_page(*pmd);
++ if (!page) {
++ page = pmd_page(*pmd);
++ if (unlikely(!trylock_page(page))) {
++ get_page(page);
++ _pmd = *pmd;
++ spin_unlock(ptl);
++ lock_page(page);
++ spin_lock(ptl);
++ if (unlikely(!pmd_same(*pmd, _pmd))) {
++ unlock_page(page);
++ put_page(page);
++ page = NULL;
++ goto repeat;
++ }
++ put_page(page);
++ }
++ }
+ if (PageMlocked(page))
+ clear_page_mlock(page);
+ } else if (!(pmd_devmap(*pmd) || is_pmd_migration_entry(*pmd)))
+@@ -2294,6 +2317,8 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
+ __split_huge_pmd_locked(vma, pmd, haddr, freeze);
+ out:
+ spin_unlock(ptl);
++ if (!was_locked && page)
++ unlock_page(page);
+ /*
+ * No need to double call mmu_notifier->invalidate_range() callback.
+ * They are 3 cases to consider inside __split_huge_pmd_locked():
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index d8c3051387d1..7181dfe76440 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1586,6 +1586,13 @@ static int __init deferred_init_memmap(void *data)
+ BUG_ON(pgdat->first_deferred_pfn > pgdat_end_pfn(pgdat));
+ pgdat->first_deferred_pfn = ULONG_MAX;
+
++ /*
++ * Once we unlock here, the zone cannot be grown anymore, thus if an
++ * interrupt thread must allocate this early in boot, zone must be
++ * pre-grown prior to start of deferred page initialization.
++ */
++ pgdat_resize_unlock(pgdat, &flags);
++
+ /* Only the highest zone is deferred so find it */
+ for (zid = 0; zid < MAX_NR_ZONES; zid++) {
+ zone = pgdat->node_zones + zid;
+@@ -1610,7 +1617,6 @@ static int __init deferred_init_memmap(void *data)
+ epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa));
+ deferred_free_pages(nid, zid, spfn, epfn);
+ }
+- pgdat_resize_unlock(pgdat, &flags);
+
+ /* Sanity check that the next zone really is unpopulated */
+ WARN_ON(++zid < MAX_NR_ZONES && populated_zone(++zone));
+@@ -1656,17 +1662,6 @@ deferred_grow_zone(struct zone *zone, unsigned int order)
+
+ pgdat_resize_lock(pgdat, &flags);
+
+- /*
+- * If deferred pages have been initialized while we were waiting for
+- * the lock, return true, as the zone was grown. The caller will retry
+- * this zone. We won't return to this function since the caller also
+- * has this static branch.
+- */
+- if (!static_branch_unlikely(&deferred_pages)) {
+- pgdat_resize_unlock(pgdat, &flags);
+- return true;
+- }
+-
+ /*
+ * If someone grew this zone while we were waiting for spinlock, return
+ * true, as there might be enough pages already.
+diff --git a/mm/slub.c b/mm/slub.c
+index d8116a43a287..b94ba8d35a02 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -5738,8 +5738,10 @@ static int sysfs_slab_add(struct kmem_cache *s)
+
+ s->kobj.kset = kset;
+ err = kobject_init_and_add(&s->kobj, &slab_ktype, NULL, "%s", name);
+- if (err)
++ if (err) {
++ kobject_put(&s->kobj);
+ goto out;
++ }
+
+ err = sysfs_create_group(&s->kobj, &slab_attr_group);
+ if (err)
+diff --git a/mm/util.c b/mm/util.c
+index 6a24a1025d77..621afcea2bfa 100644
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -453,6 +453,24 @@ void kvfree(const void *addr)
+ }
+ EXPORT_SYMBOL(kvfree);
+
++/**
++ * kvfree_sensitive - Free a data object containing sensitive information.
++ * @addr: address of the data object to be freed.
++ * @len: length of the data object.
++ *
++ * Use the special memzero_explicit() function to clear the content of a
++ * kvmalloc'ed object containing sensitive data to make sure that the
++ * compiler won't optimize out the data clearing.
++ */
++void kvfree_sensitive(const void *addr, size_t len)
++{
++ if (likely(!ZERO_OR_NULL_PTR(addr))) {
++ memzero_explicit((void *)addr, len);
++ kvfree(addr);
++ }
++}
++EXPORT_SYMBOL(kvfree_sensitive);
++
+ static inline void *__page_rmapping(struct page *page)
+ {
+ unsigned long mapping;
+diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
+index 5da183b2f4c9..af3da6cdfc79 100644
+--- a/net/batman-adv/bat_v_elp.c
++++ b/net/batman-adv/bat_v_elp.c
+@@ -132,20 +132,7 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh)
+ rtnl_lock();
+ ret = __ethtool_get_link_ksettings(hard_iface->net_dev, &link_settings);
+ rtnl_unlock();
+-
+- /* Virtual interface drivers such as tun / tap interfaces, VLAN, etc
+- * tend to initialize the interface throughput with some value for the
+- * sake of having a throughput number to export via ethtool. This
+- * exported throughput leaves batman-adv to conclude the interface
+- * throughput is genuine (reflecting reality), thus no measurements
+- * are necessary.
+- *
+- * Based on the observation that those interface types also tend to set
+- * the link auto-negotiation to 'off', batman-adv shall check this
+- * setting to differentiate between genuine link throughput information
+- * and placeholders installed by virtual interfaces.
+- */
+- if (ret == 0 && link_settings.base.autoneg == AUTONEG_ENABLE) {
++ if (ret == 0) {
+ /* link characteristics might change over time */
+ if (link_settings.base.duplex == DUPLEX_FULL)
+ hard_iface->bat_v.flags |= BATADV_FULL_DUPLEX;
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 3e7badb3ac2d..a044e6bb12b8 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -4097,6 +4097,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
+ case 0x11: /* Unsupported Feature or Parameter Value */
+ case 0x1c: /* SCO interval rejected */
+ case 0x1a: /* Unsupported Remote Feature */
++ case 0x1e: /* Invalid LMP Parameters */
+ case 0x1f: /* Unspecified error */
+ case 0x20: /* Unsupported LMP Parameter value */
+ if (conn->out) {
+diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
+index d42e3904b498..eb44ae05abaa 100644
+--- a/net/bridge/br_arp_nd_proxy.c
++++ b/net/bridge/br_arp_nd_proxy.c
+@@ -277,6 +277,10 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
+ ns_olen = request->len - (skb_network_offset(request) +
+ sizeof(struct ipv6hdr)) - sizeof(*ns);
+ for (i = 0; i < ns_olen - 1; i += (ns->opt[i + 1] << 3)) {
++ if (!ns->opt[i + 1]) {
++ kfree_skb(reply);
++ return;
++ }
+ if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
+ daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
+ break;
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index 231c489128e4..aa54303c43a6 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -185,14 +185,15 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ retv = -EBUSY;
+ break;
+ }
+- }
+- if (sk->sk_protocol == IPPROTO_TCP &&
+- sk->sk_prot != &tcpv6_prot) {
+- retv = -EBUSY;
++ } else if (sk->sk_protocol == IPPROTO_TCP) {
++ if (sk->sk_prot != &tcpv6_prot) {
++ retv = -EBUSY;
++ break;
++ }
++ } else {
+ break;
+ }
+- if (sk->sk_protocol != IPPROTO_TCP)
+- break;
++
+ if (sk->sk_state != TCP_ESTABLISHED) {
+ retv = -ENOTCONN;
+ break;
+diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
+index c15807d10b91..3e82a7d0df2a 100644
+--- a/net/netfilter/nft_nat.c
++++ b/net/netfilter/nft_nat.c
+@@ -135,7 +135,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ priv->type = NF_NAT_MANIP_DST;
+ break;
+ default:
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ }
+
+ if (tb[NFTA_NAT_FAMILY] == NULL)
+@@ -202,7 +202,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ if (tb[NFTA_NAT_FLAGS]) {
+ priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
+ if (priv->flags & ~NF_NAT_RANGE_MASK)
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ }
+
+ return nf_ct_netns_get(ctx->net, family);
+diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
+index 5fec3abbe19b..c7d88f979c56 100644
+--- a/net/sunrpc/auth_gss/gss_mech_switch.c
++++ b/net/sunrpc/auth_gss/gss_mech_switch.c
+@@ -61,6 +61,8 @@ gss_mech_free(struct gss_api_mech *gm)
+
+ for (i = 0; i < gm->gm_pf_num; i++) {
+ pf = &gm->gm_pfs[i];
++ if (pf->domain)
++ auth_domain_put(pf->domain);
+ kfree(pf->auth_domain_name);
+ pf->auth_domain_name = NULL;
+ }
+@@ -83,6 +85,7 @@ make_auth_domain_name(char *name)
+ static int
+ gss_mech_svc_setup(struct gss_api_mech *gm)
+ {
++ struct auth_domain *dom;
+ struct pf_desc *pf;
+ int i, status;
+
+@@ -92,10 +95,13 @@ gss_mech_svc_setup(struct gss_api_mech *gm)
+ status = -ENOMEM;
+ if (pf->auth_domain_name == NULL)
+ goto out;
+- status = svcauth_gss_register_pseudoflavor(pf->pseudoflavor,
+- pf->auth_domain_name);
+- if (status)
++ dom = svcauth_gss_register_pseudoflavor(
++ pf->pseudoflavor, pf->auth_domain_name);
++ if (IS_ERR(dom)) {
++ status = PTR_ERR(dom);
+ goto out;
++ }
++ pf->domain = dom;
+ }
+ return 0;
+ out:
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index 68830e88b6e9..68259eec6afd 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -779,7 +779,7 @@ u32 svcauth_gss_flavor(struct auth_domain *dom)
+
+ EXPORT_SYMBOL_GPL(svcauth_gss_flavor);
+
+-int
++struct auth_domain *
+ svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
+ {
+ struct gss_domain *new;
+@@ -796,21 +796,23 @@ svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
+ new->h.flavour = &svcauthops_gss;
+ new->pseudoflavor = pseudoflavor;
+
+- stat = 0;
+ test = auth_domain_lookup(name, &new->h);
+- if (test != &new->h) { /* Duplicate registration */
++ if (test != &new->h) {
++ pr_warn("svc: duplicate registration of gss pseudo flavour %s.\n",
++ name);
++ stat = -EADDRINUSE;
+ auth_domain_put(test);
+- kfree(new->h.name);
+- goto out_free_dom;
++ goto out_free_name;
+ }
+- return 0;
++ return test;
+
++out_free_name:
++ kfree(new->h.name);
+ out_free_dom:
+ kfree(new);
+ out:
+- return stat;
++ return ERR_PTR(stat);
+ }
+-
+ EXPORT_SYMBOL_GPL(svcauth_gss_register_pseudoflavor);
+
+ static inline int
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index d20f5792761c..fc142d04d365 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -249,7 +249,7 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry,
+
+ /* Portable EVM signatures must include an IMA hash */
+ if (type == EVM_XATTR_PORTABLE_DIGSIG && !ima_present)
+- return -EPERM;
++ error = -EPERM;
+ out:
+ kfree(xattr_value);
+ kfree(desc);
+diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
+index 67db9d9454ca..d12b07eb3a58 100644
+--- a/security/integrity/ima/ima.h
++++ b/security/integrity/ima/ima.h
+@@ -40,7 +40,7 @@ enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 };
+ #define IMA_DIGEST_SIZE SHA1_DIGEST_SIZE
+ #define IMA_EVENT_NAME_LEN_MAX 255
+
+-#define IMA_HASH_BITS 9
++#define IMA_HASH_BITS 10
+ #define IMA_MEASURE_HTABLE_SIZE (1 << IMA_HASH_BITS)
+
+ #define IMA_TEMPLATE_FIELD_ID_MAX_LEN 16
+@@ -56,6 +56,7 @@ extern int ima_policy_flag;
+ extern int ima_hash_algo;
+ extern int ima_appraise;
+ extern struct tpm_chip *ima_tpm_chip;
++extern const char boot_aggregate_name[];
+
+ /* IMA event related data */
+ struct ima_event_data {
+@@ -139,7 +140,7 @@ int ima_calc_buffer_hash(const void *buf, loff_t len,
+ int ima_calc_field_array_hash(struct ima_field_data *field_data,
+ struct ima_template_desc *desc, int num_fields,
+ struct ima_digest_data *hash);
+-int __init ima_calc_boot_aggregate(struct ima_digest_data *hash);
++int ima_calc_boot_aggregate(struct ima_digest_data *hash);
+ void ima_add_violation(struct file *file, const unsigned char *filename,
+ struct integrity_iint_cache *iint,
+ const char *op, const char *cause);
+@@ -166,9 +167,10 @@ struct ima_h_table {
+ };
+ extern struct ima_h_table ima_htable;
+
+-static inline unsigned long ima_hash_key(u8 *digest)
++static inline unsigned int ima_hash_key(u8 *digest)
+ {
+- return hash_long(*digest, IMA_HASH_BITS);
++ /* there is no point in taking a hash of part of a digest */
++ return (digest[0] | digest[1] << 8) % IMA_MEASURE_HTABLE_SIZE;
+ }
+
+ #define __ima_hooks(hook) \
+diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
+index 6a6d19ada66a..c5dd05ace28c 100644
+--- a/security/integrity/ima/ima_crypto.c
++++ b/security/integrity/ima/ima_crypto.c
+@@ -663,8 +663,8 @@ static void __init ima_pcrread(int idx, u8 *pcr)
+ /*
+ * Calculate the boot aggregate hash
+ */
+-static int __init ima_calc_boot_aggregate_tfm(char *digest,
+- struct crypto_shash *tfm)
++static int ima_calc_boot_aggregate_tfm(char *digest,
++ struct crypto_shash *tfm)
+ {
+ u8 pcr_i[TPM_DIGEST_SIZE];
+ int rc, i;
+@@ -688,7 +688,7 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest,
+ return rc;
+ }
+
+-int __init ima_calc_boot_aggregate(struct ima_digest_data *hash)
++int ima_calc_boot_aggregate(struct ima_digest_data *hash)
+ {
+ struct crypto_shash *tfm;
+ int rc;
+diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c
+index faac9ecaa0ae..a2bc4cb4482a 100644
+--- a/security/integrity/ima/ima_init.c
++++ b/security/integrity/ima/ima_init.c
+@@ -25,7 +25,7 @@
+ #include "ima.h"
+
+ /* name for boot aggregate entry */
+-static const char *boot_aggregate_name = "boot_aggregate";
++const char boot_aggregate_name[] = "boot_aggregate";
+ struct tpm_chip *ima_tpm_chip;
+
+ /* Add the boot aggregate to the IMA measurement list and extend
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 93babb60b05a..2d5a3daa02f9 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -196,7 +196,7 @@ static struct ima_rule_entry secure_boot_rules[] __ro_after_init = {
+ static LIST_HEAD(ima_default_rules);
+ static LIST_HEAD(ima_policy_rules);
+ static LIST_HEAD(ima_temp_rules);
+-static struct list_head *ima_rules;
++static struct list_head *ima_rules = &ima_default_rules;
+
+ static int ima_policy __initdata;
+
+@@ -544,7 +544,6 @@ void __init ima_init_policy(void)
+ temp_ima_appraise |= IMA_APPRAISE_POLICY;
+ }
+
+- ima_rules = &ima_default_rules;
+ ima_update_policy_flag();
+ }
+
+diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
+index 43752002c222..48c5a1be88ac 100644
+--- a/security/integrity/ima/ima_template_lib.c
++++ b/security/integrity/ima/ima_template_lib.c
+@@ -284,6 +284,24 @@ int ima_eventdigest_init(struct ima_event_data *event_data,
+ goto out;
+ }
+
++ if ((const char *)event_data->filename == boot_aggregate_name) {
++ if (ima_tpm_chip) {
++ hash.hdr.algo = HASH_ALGO_SHA1;
++ result = ima_calc_boot_aggregate(&hash.hdr);
++
++ /* algo can change depending on available PCR banks */
++ if (!result && hash.hdr.algo != HASH_ALGO_SHA1)
++ result = -EINVAL;
++
++ if (result < 0)
++ memset(&hash, 0, sizeof(hash));
++ }
++
++ cur_digest = hash.hdr.digest;
++ cur_digestsize = hash_digest_size[HASH_ALGO_SHA1];
++ goto out;
++ }
++
+ if (!event_data->file) /* missing info to re-calculate the digest */
+ return -EINVAL;
+
+diff --git a/security/keys/internal.h b/security/keys/internal.h
+index eb50212fbbf8..d1b9c5957000 100644
+--- a/security/keys/internal.h
++++ b/security/keys/internal.h
+@@ -306,15 +306,4 @@ static inline void key_check(const struct key *key)
+ #define key_check(key) do {} while(0)
+
+ #endif
+-
+-/*
+- * Helper function to clear and free a kvmalloc'ed memory object.
+- */
+-static inline void __kvzfree(const void *addr, size_t len)
+-{
+- if (addr) {
+- memset((void *)addr, 0, len);
+- kvfree(addr);
+- }
+-}
+ #endif /* _INTERNAL_H */
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index c07c2e2b2478..9394d72a77e8 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -133,10 +133,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
+
+ key_ref_put(keyring_ref);
+ error3:
+- if (payload) {
+- memzero_explicit(payload, plen);
+- kvfree(payload);
+- }
++ kvfree_sensitive(payload, plen);
+ error2:
+ kfree(description);
+ error:
+@@ -351,7 +348,7 @@ long keyctl_update_key(key_serial_t id,
+
+ key_ref_put(key_ref);
+ error2:
+- __kvzfree(payload, plen);
++ kvfree_sensitive(payload, plen);
+ error:
+ return ret;
+ }
+@@ -859,7 +856,7 @@ can_read_key:
+ */
+ if (ret > key_data_len) {
+ if (unlikely(key_data))
+- __kvzfree(key_data, key_data_len);
++ kvfree_sensitive(key_data, key_data_len);
+ key_data_len = ret;
+ continue; /* Allocate buffer */
+ }
+@@ -868,7 +865,7 @@ can_read_key:
+ ret = -EFAULT;
+ break;
+ }
+- __kvzfree(key_data, key_data_len);
++ kvfree_sensitive(key_data, key_data_len);
+
+ key_put_out:
+ key_put(key);
+@@ -1170,10 +1167,7 @@ long keyctl_instantiate_key_common(key_serial_t id,
+ keyctl_change_reqkey_auth(NULL);
+
+ error2:
+- if (payload) {
+- memzero_explicit(payload, plen);
+- kvfree(payload);
+- }
++ kvfree_sensitive(payload, plen);
+ error:
+ return ret;
+ }
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index f6482e53d55a..371ae368da35 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -906,11 +906,21 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
+ else
+ rule += strlen(skp->smk_known) + 1;
+
++ if (rule > data + count) {
++ rc = -EOVERFLOW;
++ goto out;
++ }
++
+ ret = sscanf(rule, "%d", &maplevel);
+ if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
+ goto out;
+
+ rule += SMK_DIGITLEN;
++ if (rule > data + count) {
++ rc = -EOVERFLOW;
++ goto out;
++ }
++
+ ret = sscanf(rule, "%d", &catlen);
+ if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
+ goto out;
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index f03ceaff75b5..7c12b0deb4eb 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -1982,6 +1982,11 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd)
+ }
+ pcm_file = f.file->private_data;
+ substream1 = pcm_file->substream;
++ if (substream == substream1) {
++ res = -EINVAL;
++ goto _badf;
++ }
++
+ group = kmalloc(sizeof(*group), GFP_KERNEL);
+ if (!group) {
+ res = -ENOMEM;
+diff --git a/sound/isa/es1688/es1688.c b/sound/isa/es1688/es1688.c
+index 3dfe7e592c25..5a69314413b6 100644
+--- a/sound/isa/es1688/es1688.c
++++ b/sound/isa/es1688/es1688.c
+@@ -282,8 +282,10 @@ static int snd_es968_pnp_detect(struct pnp_card_link *pcard,
+ return error;
+ }
+ error = snd_es1688_probe(card, dev);
+- if (error < 0)
++ if (error < 0) {
++ snd_card_free(card);
+ return error;
++ }
+ pnp_set_card_drvdata(pcard, card);
+ snd_es968_pnp_is_probed = 1;
+ return 0;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b06f7d52faad..b4f802013f74 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7694,6 +7694,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ ALC225_STANDARD_PINS,
+ {0x12, 0xb7a60130},
+ {0x17, 0x90170110}),
++ SND_HDA_PIN_QUIRK(0x10ec0623, 0x17aa, "Lenovo", ALC283_FIXUP_HEADSET_MIC,
++ {0x14, 0x01014010},
++ {0x17, 0x90170120},
++ {0x18, 0x02a11030},
++ {0x19, 0x02a1103f},
++ {0x21, 0x0221101f}),
+ {}
+ };
+
+diff --git a/sound/pci/lx6464es/lx6464es.c b/sound/pci/lx6464es/lx6464es.c
+index 54f6252faca6..daf25655f635 100644
+--- a/sound/pci/lx6464es/lx6464es.c
++++ b/sound/pci/lx6464es/lx6464es.c
+@@ -65,6 +65,14 @@ static const struct pci_device_id snd_lx6464es_ids[] = {
+ PCI_VENDOR_ID_DIGIGRAM,
+ PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ES_CAE_SERIAL_SUBSYSTEM),
+ }, /* LX6464ES-CAE */
++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_LX6464ES,
++ PCI_VENDOR_ID_DIGIGRAM,
++ PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ESE_SERIAL_SUBSYSTEM),
++ }, /* LX6464ESe */
++ { PCI_DEVICE_SUB(PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_LX6464ES,
++ PCI_VENDOR_ID_DIGIGRAM,
++ PCI_SUBDEVICE_ID_DIGIGRAM_LX6464ESE_CAE_SERIAL_SUBSYSTEM),
++ }, /* LX6464ESe-CAE */
+ { 0, },
+ };
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 746a72e23cf9..2644a5ae2b75 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -806,9 +806,6 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message)
+ if (chip == (void *)-1L)
+ return 0;
+
+- chip->autosuspended = !!PMSG_IS_AUTO(message);
+- if (!chip->autosuspended)
+- snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot);
+ if (!chip->num_suspended_intf++) {
+ list_for_each_entry(as, &chip->pcm_list, list) {
+ snd_pcm_suspend_all(as->pcm);
+@@ -822,6 +819,11 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message)
+ snd_usb_mixer_suspend(mixer);
+ }
+
++ if (!PMSG_IS_AUTO(message) && !chip->system_suspend) {
++ snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot);
++ chip->system_suspend = chip->num_suspended_intf;
++ }
++
+ return 0;
+ }
+
+@@ -835,10 +837,10 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)
+
+ if (chip == (void *)-1L)
+ return 0;
+- if (--chip->num_suspended_intf)
+- return 0;
+
+ atomic_inc(&chip->active); /* avoid autopm */
++ if (chip->num_suspended_intf > 1)
++ goto out;
+
+ list_for_each_entry(as, &chip->pcm_list, list) {
+ err = snd_usb_pcm_resume(as);
+@@ -860,9 +862,12 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)
+ snd_usbmidi_resume(p);
+ }
+
+- if (!chip->autosuspended)
++ out:
++ if (chip->num_suspended_intf == chip->system_suspend) {
+ snd_power_change_state(chip->card, SNDRV_CTL_POWER_D0);
+- chip->autosuspended = 0;
++ chip->system_suspend = 0;
++ }
++ chip->num_suspended_intf--;
+
+ err_out:
+ atomic_dec(&chip->active); /* allow autopm after this point */
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index b798eae0a785..e2725ab4d985 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -39,6 +39,26 @@
+ .idProduct = prod, \
+ .bInterfaceClass = USB_CLASS_VENDOR_SPEC
+
++/* HP Thunderbolt Dock Audio Headset */
++{
++ USB_DEVICE(0x03f0, 0x0269),
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .vendor_name = "HP",
++ .product_name = "Thunderbolt Dock Audio Headset",
++ .profile_name = "HP-Thunderbolt-Dock-Audio-Headset",
++ .ifnum = QUIRK_NO_INTERFACE
++ }
++},
++/* HP Thunderbolt Dock Audio Module */
++{
++ USB_DEVICE(0x03f0, 0x0567),
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .vendor_name = "HP",
++ .product_name = "Thunderbolt Dock Audio Module",
++ .profile_name = "HP-Thunderbolt-Dock-Audio-Module",
++ .ifnum = QUIRK_NO_INTERFACE
++ }
++},
+ /* FTDI devices */
+ {
+ USB_DEVICE(0x0403, 0xb8d8),
+diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
+index 4a0a5a071d51..0d620c267e7a 100644
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -37,7 +37,7 @@ struct snd_usb_audio {
+ struct usb_interface *pm_intf;
+ u32 usb_id;
+ struct mutex mutex;
+- unsigned int autosuspended:1;
++ unsigned int system_suspend;
+ atomic_t active;
+ atomic_t shutdown;
+ atomic_t usage_count;
+diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
+index bd021a0eeef8..4cc69675c2a9 100644
+--- a/tools/lib/api/fs/fs.c
++++ b/tools/lib/api/fs/fs.c
+@@ -90,6 +90,7 @@ struct fs {
+ const char * const *mounts;
+ char path[PATH_MAX];
+ bool found;
++ bool checked;
+ long magic;
+ };
+
+@@ -111,31 +112,37 @@ static struct fs fs__entries[] = {
+ .name = "sysfs",
+ .mounts = sysfs__fs_known_mountpoints,
+ .magic = SYSFS_MAGIC,
++ .checked = false,
+ },
+ [FS__PROCFS] = {
+ .name = "proc",
+ .mounts = procfs__known_mountpoints,
+ .magic = PROC_SUPER_MAGIC,
++ .checked = false,
+ },
+ [FS__DEBUGFS] = {
+ .name = "debugfs",
+ .mounts = debugfs__known_mountpoints,
+ .magic = DEBUGFS_MAGIC,
++ .checked = false,
+ },
+ [FS__TRACEFS] = {
+ .name = "tracefs",
+ .mounts = tracefs__known_mountpoints,
+ .magic = TRACEFS_MAGIC,
++ .checked = false,
+ },
+ [FS__HUGETLBFS] = {
+ .name = "hugetlbfs",
+ .mounts = hugetlbfs__known_mountpoints,
+ .magic = HUGETLBFS_MAGIC,
++ .checked = false,
+ },
+ [FS__BPF_FS] = {
+ .name = "bpf",
+ .mounts = bpf_fs__known_mountpoints,
+ .magic = BPF_FS_MAGIC,
++ .checked = false,
+ },
+ };
+
+@@ -158,6 +165,7 @@ static bool fs__read_mounts(struct fs *fs)
+ }
+
+ fclose(fp);
++ fs->checked = true;
+ return fs->found = found;
+ }
+
+@@ -220,6 +228,7 @@ static bool fs__env_override(struct fs *fs)
+ return false;
+
+ fs->found = true;
++ fs->checked = true;
+ strncpy(fs->path, override_path, sizeof(fs->path) - 1);
+ fs->path[sizeof(fs->path) - 1] = '\0';
+ return true;
+@@ -246,6 +255,14 @@ static const char *fs__mountpoint(int idx)
+ if (fs->found)
+ return (const char *)fs->path;
+
++ /* the mount point was already checked for the mount point
++ * but and did not exist, so return NULL to avoid scanning again.
++ * This makes the found and not found paths cost equivalent
++ * in case of multiple calls.
++ */
++ if (fs->checked)
++ return NULL;
++
+ return fs__get_mountpoint(fs);
+ }
+
+diff --git a/tools/lib/api/fs/fs.h b/tools/lib/api/fs/fs.h
+index 92d03b8396b1..3b70003e7cfb 100644
+--- a/tools/lib/api/fs/fs.h
++++ b/tools/lib/api/fs/fs.h
+@@ -18,6 +18,18 @@
+ const char *name##__mount(void); \
+ bool name##__configured(void); \
+
++/*
++ * The xxxx__mountpoint() entry points find the first match mount point for each
++ * filesystems listed below, where xxxx is the filesystem type.
++ *
++ * The interface is as follows:
++ *
++ * - If a mount point is found on first call, it is cached and used for all
++ * subsequent calls.
++ *
++ * - If a mount point is not found, NULL is returned on first call and all
++ * subsequent calls.
++ */
+ FS(sysfs)
+ FS(procfs)
+ FS(debugfs)
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 4d509734b695..fd3071d83dea 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -801,6 +801,12 @@ static int add_special_section_alts(struct objtool_file *file)
+ }
+
+ if (special_alt->group) {
++ if (!special_alt->orig_len) {
++ WARN_FUNC("empty alternative entry",
++ orig_insn->sec, orig_insn->offset);
++ continue;
++ }
++
+ ret = handle_group_alt(file, special_alt, orig_insn,
+ &new_insn);
+ if (ret)
+diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
+index 0bdb34fee9d8..215da628d60b 100644
+--- a/tools/perf/builtin-probe.c
++++ b/tools/perf/builtin-probe.c
+@@ -376,6 +376,9 @@ static int perf_add_probe_events(struct perf_probe_event *pevs, int npevs)
+
+ for (k = 0; k < pev->ntevs; k++) {
+ struct probe_trace_event *tev = &pev->tevs[k];
++ /* Skipped events have no event name */
++ if (!tev->event)
++ continue;
+
+ /* We use tev's name for showing new events */
+ show_perf_probe_event(tev->group, tev->event, pev,
+diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
+index cee717a3794f..56f86317694d 100644
+--- a/tools/perf/util/dso.c
++++ b/tools/perf/util/dso.c
+@@ -38,6 +38,7 @@ char dso__symtab_origin(const struct dso *dso)
+ [DSO_BINARY_TYPE__BUILD_ID_CACHE_DEBUGINFO] = 'D',
+ [DSO_BINARY_TYPE__FEDORA_DEBUGINFO] = 'f',
+ [DSO_BINARY_TYPE__UBUNTU_DEBUGINFO] = 'u',
++ [DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO] = 'x',
+ [DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO] = 'o',
+ [DSO_BINARY_TYPE__BUILDID_DEBUGINFO] = 'b',
+ [DSO_BINARY_TYPE__SYSTEM_PATH_DSO] = 'd',
+@@ -120,6 +121,21 @@ int dso__read_binary_type_filename(const struct dso *dso,
+ snprintf(filename + len, size - len, "%s", dso->long_name);
+ break;
+
++ case DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO:
++ /*
++ * Ubuntu can mixup /usr/lib with /lib, putting debuginfo in
++ * /usr/lib/debug/lib when it is expected to be in
++ * /usr/lib/debug/usr/lib
++ */
++ if (strlen(dso->long_name) < 9 ||
++ strncmp(dso->long_name, "/usr/lib/", 9)) {
++ ret = -1;
++ break;
++ }
++ len = __symbol__join_symfs(filename, size, "/usr/lib/debug");
++ snprintf(filename + len, size - len, "%s", dso->long_name + 4);
++ break;
++
+ case DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO:
+ {
+ const char *last_slash;
+diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
+index c5380500bed4..0b474c7ef1e1 100644
+--- a/tools/perf/util/dso.h
++++ b/tools/perf/util/dso.h
+@@ -25,6 +25,7 @@ enum dso_binary_type {
+ DSO_BINARY_TYPE__BUILD_ID_CACHE_DEBUGINFO,
+ DSO_BINARY_TYPE__FEDORA_DEBUGINFO,
+ DSO_BINARY_TYPE__UBUNTU_DEBUGINFO,
++ DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO,
+ DSO_BINARY_TYPE__BUILDID_DEBUGINFO,
+ DSO_BINARY_TYPE__SYSTEM_PATH_DSO,
+ DSO_BINARY_TYPE__GUEST_KMODULE,
+diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
+index a22e1f538aea..4ac3c89bfac8 100644
+--- a/tools/perf/util/probe-event.c
++++ b/tools/perf/util/probe-event.c
+@@ -111,7 +111,7 @@ void exit_probe_symbol_maps(void)
+ symbol__exit();
+ }
+
+-static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void)
++static struct ref_reloc_sym *kernel_get_ref_reloc_sym(struct map **pmap)
+ {
+ /* kmap->ref_reloc_sym should be set if host_machine is initialized */
+ struct kmap *kmap;
+@@ -123,6 +123,10 @@ static struct ref_reloc_sym *kernel_get_ref_reloc_sym(void)
+ kmap = map__kmap(map);
+ if (!kmap)
+ return NULL;
++
++ if (pmap)
++ *pmap = map;
++
+ return kmap->ref_reloc_sym;
+ }
+
+@@ -134,7 +138,7 @@ static int kernel_get_symbol_address_by_name(const char *name, u64 *addr,
+ struct map *map;
+
+ /* ref_reloc_sym is just a label. Need a special fix*/
+- reloc_sym = kernel_get_ref_reloc_sym();
++ reloc_sym = kernel_get_ref_reloc_sym(NULL);
+ if (reloc_sym && strcmp(name, reloc_sym->name) == 0)
+ *addr = (reloc) ? reloc_sym->addr : reloc_sym->unrelocated_addr;
+ else {
+@@ -241,21 +245,22 @@ static void clear_probe_trace_events(struct probe_trace_event *tevs, int ntevs)
+ static bool kprobe_blacklist__listed(unsigned long address);
+ static bool kprobe_warn_out_range(const char *symbol, unsigned long address)
+ {
+- u64 etext_addr = 0;
+- int ret;
+-
+- /* Get the address of _etext for checking non-probable text symbol */
+- ret = kernel_get_symbol_address_by_name("_etext", &etext_addr,
+- false, false);
++ struct map *map;
++ bool ret = false;
+
+- if (ret == 0 && etext_addr < address)
+- pr_warning("%s is out of .text, skip it.\n", symbol);
+- else if (kprobe_blacklist__listed(address))
++ map = kernel_get_module_map(NULL);
++ if (map) {
++ ret = address <= map->start || map->end < address;
++ if (ret)
++ pr_warning("%s is out of .text, skip it.\n", symbol);
++ map__put(map);
++ }
++ if (!ret && kprobe_blacklist__listed(address)) {
+ pr_warning("%s is blacklisted function, skip it.\n", symbol);
+- else
+- return false;
++ ret = true;
++ }
+
+- return true;
++ return ret;
+ }
+
+ /*
+@@ -751,6 +756,7 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs,
+ int ntevs)
+ {
+ struct ref_reloc_sym *reloc_sym;
++ struct map *map;
+ char *tmp;
+ int i, skipped = 0;
+
+@@ -759,7 +765,7 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs,
+ return post_process_offline_probe_trace_events(tevs, ntevs,
+ symbol_conf.vmlinux_name);
+
+- reloc_sym = kernel_get_ref_reloc_sym();
++ reloc_sym = kernel_get_ref_reloc_sym(&map);
+ if (!reloc_sym) {
+ pr_warning("Relocated base symbol is not found!\n");
+ return -EINVAL;
+@@ -770,9 +776,13 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs,
+ continue;
+ if (tevs[i].point.retprobe && !kretprobe_offset_is_supported())
+ continue;
+- /* If we found a wrong one, mark it by NULL symbol */
++ /*
++ * If we found a wrong one, mark it by NULL symbol.
++ * Since addresses in debuginfo is same as objdump, we need
++ * to convert it to addresses on memory.
++ */
+ if (kprobe_warn_out_range(tevs[i].point.symbol,
+- tevs[i].point.address)) {
++ map__objdump_2mem(map, tevs[i].point.address))) {
+ tmp = NULL;
+ skipped++;
+ } else {
+@@ -1753,8 +1763,7 @@ int parse_probe_trace_command(const char *cmd, struct probe_trace_event *tev)
+ fmt1_str = strtok_r(argv0_str, ":", &fmt);
+ fmt2_str = strtok_r(NULL, "/", &fmt);
+ fmt3_str = strtok_r(NULL, " \t", &fmt);
+- if (fmt1_str == NULL || strlen(fmt1_str) != 1 || fmt2_str == NULL
+- || fmt3_str == NULL) {
++ if (fmt1_str == NULL || fmt2_str == NULL || fmt3_str == NULL) {
+ semantic_error("Failed to parse event name: %s\n", argv[0]);
+ ret = -EINVAL;
+ goto out;
+@@ -2888,7 +2897,7 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
+ /* Note that the symbols in the kmodule are not relocated */
+ if (!pev->uprobes && !pev->target &&
+ (!pp->retprobe || kretprobe_offset_is_supported())) {
+- reloc_sym = kernel_get_ref_reloc_sym();
++ reloc_sym = kernel_get_ref_reloc_sym(NULL);
+ if (!reloc_sym) {
+ pr_warning("Relocated base symbol is not found!\n");
+ ret = -EINVAL;
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index 876787de7959..60169196b948 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -114,6 +114,7 @@ enum dso_binary_type distro_dwarf_types[] = {
+ DSO_BINARY_TYPE__UBUNTU_DEBUGINFO,
+ DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO,
+ DSO_BINARY_TYPE__BUILDID_DEBUGINFO,
++ DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO,
+ DSO_BINARY_TYPE__NOT_FOUND,
+ };
+
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index 91404bacc3df..b6f8349abc67 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -65,6 +65,7 @@ static enum dso_binary_type binary_type_symtab[] = {
+ DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE,
+ DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE_COMP,
+ DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO,
++ DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO,
+ DSO_BINARY_TYPE__NOT_FOUND,
+ };
+
+@@ -1419,6 +1420,7 @@ static bool dso__is_compatible_symtab_type(struct dso *dso, bool kmod,
+ case DSO_BINARY_TYPE__SYSTEM_PATH_DSO:
+ case DSO_BINARY_TYPE__FEDORA_DEBUGINFO:
+ case DSO_BINARY_TYPE__UBUNTU_DEBUGINFO:
++ case DSO_BINARY_TYPE__MIXEDUP_UBUNTU_DEBUGINFO:
+ case DSO_BINARY_TYPE__BUILDID_DEBUGINFO:
+ case DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO:
+ return !kmod && dso->kernel == DSO_TYPE_USER;
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 89f8b0dae7ef..bad3505d66e0 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -1118,6 +1118,7 @@ static int extract_build_id(char *build_id, size_t size)
+ len = size;
+ memcpy(build_id, line, len);
+ build_id[len] = '\0';
++ free(line);
+ return 0;
+ err:
+ fclose(fp);
+diff --git a/tools/testing/selftests/bpf/test_select_reuseport.c b/tools/testing/selftests/bpf/test_select_reuseport.c
+index cdbbdab2725f..b14d25bfa830 100644
+--- a/tools/testing/selftests/bpf/test_select_reuseport.c
++++ b/tools/testing/selftests/bpf/test_select_reuseport.c
+@@ -616,13 +616,13 @@ static void cleanup_per_test(void)
+
+ for (i = 0; i < NR_RESULTS; i++) {
+ err = bpf_map_update_elem(result_map, &i, &zero, BPF_ANY);
+- RET_IF(err, "reset elem in result_map",
+- "i:%u err:%d errno:%d\n", i, err, errno);
++ CHECK(err, "reset elem in result_map",
++ "i:%u err:%d errno:%d\n", i, err, errno);
+ }
+
+ err = bpf_map_update_elem(linum_map, &zero, &zero, BPF_ANY);
+- RET_IF(err, "reset line number in linum_map", "err:%d errno:%d\n",
+- err, errno);
++ CHECK(err, "reset line number in linum_map", "err:%d errno:%d\n",
++ err, errno);
+
+ for (i = 0; i < REUSEPORT_ARRAY_SIZE; i++)
+ close(sk_fds[i]);
+diff --git a/tools/testing/selftests/networking/timestamping/rxtimestamp.c b/tools/testing/selftests/networking/timestamping/rxtimestamp.c
+index dd4162fc0419..7a573fb4c1c4 100644
+--- a/tools/testing/selftests/networking/timestamping/rxtimestamp.c
++++ b/tools/testing/selftests/networking/timestamping/rxtimestamp.c
+@@ -114,6 +114,7 @@ static struct option long_options[] = {
+ { "tcp", no_argument, 0, 't' },
+ { "udp", no_argument, 0, 'u' },
+ { "ip", no_argument, 0, 'i' },
++ { NULL, 0, NULL, 0 },
+ };
+
+ static int next_port = 19999;
+diff --git a/virt/kvm/arm/aarch32.c b/virt/kvm/arm/aarch32.c
+index 18d6d5124397..92c9ad6c0182 100644
+--- a/virt/kvm/arm/aarch32.c
++++ b/virt/kvm/arm/aarch32.c
+@@ -44,6 +44,26 @@ static const u8 return_offsets[8][2] = {
+ [7] = { 4, 4 }, /* FIQ, unused */
+ };
+
++static bool pre_fault_synchronize(struct kvm_vcpu *vcpu)
++{
++ preempt_disable();
++ if (kvm_arm_vcpu_loaded(vcpu)) {
++ kvm_arch_vcpu_put(vcpu);
++ return true;
++ }
++
++ preempt_enable();
++ return false;
++}
++
++static void post_fault_synchronize(struct kvm_vcpu *vcpu, bool loaded)
++{
++ if (loaded) {
++ kvm_arch_vcpu_load(vcpu, smp_processor_id());
++ preempt_enable();
++ }
++}
++
+ /*
+ * When an exception is taken, most CPSR fields are left unchanged in the
+ * handler. However, some are explicitly overridden (e.g. M[4:0]).
+@@ -166,7 +186,10 @@ static void prepare_fault32(struct kvm_vcpu *vcpu, u32 mode, u32 vect_offset)
+
+ void kvm_inject_undef32(struct kvm_vcpu *vcpu)
+ {
++ bool loaded = pre_fault_synchronize(vcpu);
++
+ prepare_fault32(vcpu, PSR_AA32_MODE_UND, 4);
++ post_fault_synchronize(vcpu, loaded);
+ }
+
+ /*
+@@ -179,6 +202,9 @@ static void inject_abt32(struct kvm_vcpu *vcpu, bool is_pabt,
+ u32 vect_offset;
+ u32 *far, *fsr;
+ bool is_lpae;
++ bool loaded;
++
++ loaded = pre_fault_synchronize(vcpu);
+
+ if (is_pabt) {
+ vect_offset = 12;
+@@ -202,6 +228,8 @@ static void inject_abt32(struct kvm_vcpu *vcpu, bool is_pabt,
+ /* no need to shuffle FS[4] into DFSR[10] as its 0 */
+ *fsr = DFSR_FSC_EXTABT_nLPAE;
+ }
++
++ post_fault_synchronize(vcpu, loaded);
+ }
+
+ void kvm_inject_dabt32(struct kvm_vcpu *vcpu, unsigned long addr)
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index aca15bd1cc4c..1218ea663c6d 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -141,10 +141,9 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm);
+ static unsigned long long kvm_createvm_count;
+ static unsigned long long kvm_active_vms;
+
+-__weak int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
+- unsigned long start, unsigned long end, bool blockable)
++__weak void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
++ unsigned long start, unsigned long end)
+ {
+- return 0;
+ }
+
+ bool kvm_is_zone_device_pfn(kvm_pfn_t pfn)
+@@ -366,6 +365,18 @@ static inline struct kvm *mmu_notifier_to_kvm(struct mmu_notifier *mn)
+ return container_of(mn, struct kvm, mmu_notifier);
+ }
+
++static void kvm_mmu_notifier_invalidate_range(struct mmu_notifier *mn,
++ struct mm_struct *mm,
++ unsigned long start, unsigned long end)
++{
++ struct kvm *kvm = mmu_notifier_to_kvm(mn);
++ int idx;
++
++ idx = srcu_read_lock(&kvm->srcu);
++ kvm_arch_mmu_notifier_invalidate_range(kvm, start, end);
++ srcu_read_unlock(&kvm->srcu, idx);
++}
++
+ static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn,
+ struct mm_struct *mm,
+ unsigned long address,
+@@ -390,7 +401,6 @@ static int kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
+ {
+ struct kvm *kvm = mmu_notifier_to_kvm(mn);
+ int need_tlb_flush = 0, idx;
+- int ret;
+
+ idx = srcu_read_lock(&kvm->srcu);
+ spin_lock(&kvm->mmu_lock);
+@@ -407,12 +417,9 @@ static int kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
+ kvm_flush_remote_tlbs(kvm);
+
+ spin_unlock(&kvm->mmu_lock);
+-
+- ret = kvm_arch_mmu_notifier_invalidate_range(kvm, start, end, blockable);
+-
+ srcu_read_unlock(&kvm->srcu, idx);
+
+- return ret;
++ return 0;
+ }
+
+ static void kvm_mmu_notifier_invalidate_range_end(struct mmu_notifier *mn,
+@@ -521,6 +528,7 @@ static void kvm_mmu_notifier_release(struct mmu_notifier *mn,
+
+ static const struct mmu_notifier_ops kvm_mmu_notifier_ops = {
+ .flags = MMU_INVALIDATE_DOES_NOT_BLOCK,
++ .invalidate_range = kvm_mmu_notifier_invalidate_range,
+ .invalidate_range_start = kvm_mmu_notifier_invalidate_range_start,
+ .invalidate_range_end = kvm_mmu_notifier_invalidate_range_end,
+ .clear_flush_young = kvm_mmu_notifier_clear_flush_young,
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-06-25 15:07 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-06-25 15:07 UTC (permalink / raw
To: gentoo-commits
commit: 6fb39a1d5c9f18666678eed32623770f85ee3255
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 25 15:07:12 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jun 25 15:07:12 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6fb39a1d
Linux patch 4.19.130
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1129_linux-4.19.130.patch | 7297 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 7301 insertions(+)
diff --git a/0000_README b/0000_README
index afec7d2..3fde3ae 100644
--- a/0000_README
+++ b/0000_README
@@ -555,6 +555,10 @@ Patch: 1128_linux-4.19.129.patch
From: https://www.kernel.org
Desc: Linux 4.19.129
+Patch: 1129_linux-4.19.130.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.130
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1129_linux-4.19.130.patch b/1129_linux-4.19.130.patch
new file mode 100644
index 0000000..67290f1
--- /dev/null
+++ b/1129_linux-4.19.130.patch
@@ -0,0 +1,7297 @@
+diff --git a/Documentation/driver-api/mtdnand.rst b/Documentation/driver-api/mtdnand.rst
+index c55a6034c397..5470a3d6bd9e 100644
+--- a/Documentation/driver-api/mtdnand.rst
++++ b/Documentation/driver-api/mtdnand.rst
+@@ -246,7 +246,7 @@ necessary information about the device.
+ this->eccmode = NAND_ECC_SOFT;
+
+ /* Scan to find existence of the device */
+- if (nand_scan (board_mtd, 1)) {
++ if (nand_scan (this, 1)) {
+ err = -ENXIO;
+ goto out_ior;
+ }
+@@ -277,7 +277,7 @@ unregisters the partitions in the MTD layer.
+ static void __exit board_cleanup (void)
+ {
+ /* Release resources, unregister device */
+- nand_release (board_mtd);
++ nand_release (mtd_to_nand(board_mtd));
+
+ /* unmap physical address */
+ iounmap(baseaddr);
+diff --git a/Makefile b/Makefile
+index e6066502e9cc..6443cbd51f70 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 129
++SUBLEVEL = 130
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/sun8i-h2-plus-bananapi-m2-zero.dts b/arch/arm/boot/dts/sun8i-h2-plus-bananapi-m2-zero.dts
+index 1db2541135a7..00e0d6940c30 100644
+--- a/arch/arm/boot/dts/sun8i-h2-plus-bananapi-m2-zero.dts
++++ b/arch/arm/boot/dts/sun8i-h2-plus-bananapi-m2-zero.dts
+@@ -32,7 +32,7 @@
+
+ pwr_led {
+ label = "bananapi-m2-zero:red:pwr";
+- gpios = <&r_pio 0 10 GPIO_ACTIVE_HIGH>; /* PL10 */
++ gpios = <&r_pio 0 10 GPIO_ACTIVE_LOW>; /* PL10 */
+ default-state = "on";
+ };
+ };
+diff --git a/arch/arm/mach-integrator/Kconfig b/arch/arm/mach-integrator/Kconfig
+index cefe44f6889b..ba124f8704fa 100644
+--- a/arch/arm/mach-integrator/Kconfig
++++ b/arch/arm/mach-integrator/Kconfig
+@@ -3,6 +3,8 @@ menuconfig ARCH_INTEGRATOR
+ depends on ARCH_MULTI_V4T || ARCH_MULTI_V5 || ARCH_MULTI_V6
+ select ARM_AMBA
+ select COMMON_CLK_VERSATILE
++ select CMA
++ select DMA_CMA
+ select HAVE_TCM
+ select ICST
+ select MFD_SYSCON
+@@ -34,14 +36,13 @@ config INTEGRATOR_IMPD1
+ select ARM_VIC
+ select GPIO_PL061
+ select GPIOLIB
++ select REGULATOR
++ select REGULATOR_FIXED_VOLTAGE
+ help
+ The IM-PD1 is an add-on logic module for the Integrator which
+ allows ARM(R) Ltd PrimeCells to be developed and evaluated.
+ The IM-PD1 can be found on the Integrator/PP2 platform.
+
+- To compile this driver as a module, choose M here: the
+- module will be called impd1.
+-
+ config INTEGRATOR_CM7TDMI
+ bool "Integrator/CM7TDMI core module"
+ depends on ARCH_INTEGRATOR_AP
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+index abd2f15a544b..bd9fc50ac154 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+@@ -223,21 +223,21 @@
+ cpu_on = <0x84000003>;
+ };
+
+- clk26m: oscillator@0 {
++ clk26m: oscillator0 {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <26000000>;
+ clock-output-names = "clk26m";
+ };
+
+- clk32k: oscillator@1 {
++ clk32k: oscillator1 {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <32000>;
+ clock-output-names = "clk32k";
+ };
+
+- cpum_ck: oscillator@2 {
++ cpum_ck: oscillator2 {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <0>;
+@@ -253,19 +253,19 @@
+ sustainable-power = <1500>; /* milliwatts */
+
+ trips {
+- threshold: trip-point@0 {
++ threshold: trip-point0 {
+ temperature = <68000>;
+ hysteresis = <2000>;
+ type = "passive";
+ };
+
+- target: trip-point@1 {
++ target: trip-point1 {
+ temperature = <85000>;
+ hysteresis = <2000>;
+ type = "passive";
+ };
+
+- cpu_crit: cpu_crit@0 {
++ cpu_crit: cpu_crit0 {
+ temperature = <115000>;
+ hysteresis = <2000>;
+ type = "critical";
+@@ -273,12 +273,12 @@
+ };
+
+ cooling-maps {
+- map@0 {
++ map0 {
+ trip = <&target>;
+ cooling-device = <&cpu0 0 0>;
+ contribution = <3072>;
+ };
+- map@1 {
++ map1 {
+ trip = <&target>;
+ cooling-device = <&cpu2 0 0>;
+ contribution = <1024>;
+@@ -291,7 +291,7 @@
+ #address-cells = <2>;
+ #size-cells = <2>;
+ ranges;
+- vpu_dma_reserved: vpu_dma_mem_region {
++ vpu_dma_reserved: vpu_dma_mem_region@b7000000 {
+ compatible = "shared-dma-pool";
+ reg = <0 0xb7000000 0 0x500000>;
+ alignment = <0x1000>;
+@@ -343,7 +343,7 @@
+ reg = <0 0x10005000 0 0x1000>;
+ };
+
+- pio: pinctrl@10005000 {
++ pio: pinctrl@1000b000 {
+ compatible = "mediatek,mt8173-pinctrl";
+ reg = <0 0x1000b000 0 0x1000>;
+ mediatek,pctl-regmap = <&syscfg_pctl_a>;
+@@ -541,7 +541,7 @@
+ status = "disabled";
+ };
+
+- gic: interrupt-controller@10220000 {
++ gic: interrupt-controller@10221000 {
+ compatible = "arm,gic-400";
+ #interrupt-cells = <3>;
+ interrupt-parent = <&gic>;
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi
+index 57d3f00464ce..7352954e12be 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi
+@@ -32,7 +32,7 @@
+
+ phy-reset-gpios = <&gpio TEGRA194_MAIN_GPIO(G, 5) GPIO_ACTIVE_LOW>;
+ phy-handle = <&phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+
+ mdio {
+ #address-cells = <1>;
+diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
+index 7c0611f5d2ce..9f105fe58595 100644
+--- a/arch/arm64/kernel/hw_breakpoint.c
++++ b/arch/arm64/kernel/hw_breakpoint.c
+@@ -737,6 +737,27 @@ static u64 get_distance_from_watchpoint(unsigned long addr, u64 val,
+ return 0;
+ }
+
++static int watchpoint_report(struct perf_event *wp, unsigned long addr,
++ struct pt_regs *regs)
++{
++ int step = is_default_overflow_handler(wp);
++ struct arch_hw_breakpoint *info = counter_arch_bp(wp);
++
++ info->trigger = addr;
++
++ /*
++ * If we triggered a user watchpoint from a uaccess routine, then
++ * handle the stepping ourselves since userspace really can't help
++ * us with this.
++ */
++ if (!user_mode(regs) && info->ctrl.privilege == AARCH64_BREAKPOINT_EL0)
++ step = 1;
++ else
++ perf_bp_event(wp, regs);
++
++ return step;
++}
++
+ static int watchpoint_handler(unsigned long addr, unsigned int esr,
+ struct pt_regs *regs)
+ {
+@@ -746,7 +767,6 @@ static int watchpoint_handler(unsigned long addr, unsigned int esr,
+ u64 val;
+ struct perf_event *wp, **slots;
+ struct debug_info *debug_info;
+- struct arch_hw_breakpoint *info;
+ struct arch_hw_breakpoint_ctrl ctrl;
+
+ slots = this_cpu_ptr(wp_on_reg);
+@@ -784,25 +804,13 @@ static int watchpoint_handler(unsigned long addr, unsigned int esr,
+ if (dist != 0)
+ continue;
+
+- info = counter_arch_bp(wp);
+- info->trigger = addr;
+- perf_bp_event(wp, regs);
+-
+- /* Do we need to handle the stepping? */
+- if (is_default_overflow_handler(wp))
+- step = 1;
++ step = watchpoint_report(wp, addr, regs);
+ }
+- if (min_dist > 0 && min_dist != -1) {
+- /* No exact match found. */
+- wp = slots[closest_match];
+- info = counter_arch_bp(wp);
+- info->trigger = addr;
+- perf_bp_event(wp, regs);
+
+- /* Do we need to handle the stepping? */
+- if (is_default_overflow_handler(wp))
+- step = 1;
+- }
++ /* No exact match found? */
++ if (min_dist > 0 && min_dist != -1)
++ step = watchpoint_report(slots[closest_match], addr, regs);
++
+ rcu_read_unlock();
+
+ if (!step)
+diff --git a/arch/m68k/coldfire/pci.c b/arch/m68k/coldfire/pci.c
+index 62b0eb6cf69a..84eab0f5e00a 100644
+--- a/arch/m68k/coldfire/pci.c
++++ b/arch/m68k/coldfire/pci.c
+@@ -216,8 +216,10 @@ static int __init mcf_pci_init(void)
+
+ /* Keep a virtual mapping to IO/config space active */
+ iospace = (unsigned long) ioremap(PCI_IO_PA, PCI_IO_SIZE);
+- if (iospace == 0)
++ if (iospace == 0) {
++ pci_free_host_bridge(bridge);
+ return -ENODEV;
++ }
+ pr_info("Coldfire: PCI IO/config window mapped to 0x%x\n",
+ (u32) iospace);
+
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index ee6159d2ed22..01b59d2ce174 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -1170,13 +1170,13 @@ ENTRY(__sys_clone)
+ l.movhi r29,hi(sys_clone)
+ l.ori r29,r29,lo(sys_clone)
+ l.j _fork_save_extra_regs_and_call
+- l.addi r7,r1,0
++ l.nop
+
+ ENTRY(__sys_fork)
+ l.movhi r29,hi(sys_fork)
+ l.ori r29,r29,lo(sys_fork)
+ l.j _fork_save_extra_regs_and_call
+- l.addi r3,r1,0
++ l.nop
+
+ ENTRY(sys_rt_sigreturn)
+ l.jal _sys_rt_sigreturn
+diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
+index 2aea6efc2e63..008eb63fa851 100644
+--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
++++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
+@@ -985,10 +985,25 @@ extern struct page *pgd_page(pgd_t pgd);
+ #define pud_page_vaddr(pud) __va(pud_val(pud) & ~PUD_MASKED_BITS)
+ #define pgd_page_vaddr(pgd) __va(pgd_val(pgd) & ~PGD_MASKED_BITS)
+
+-#define pgd_index(address) (((address) >> (PGDIR_SHIFT)) & (PTRS_PER_PGD - 1))
+-#define pud_index(address) (((address) >> (PUD_SHIFT)) & (PTRS_PER_PUD - 1))
+-#define pmd_index(address) (((address) >> (PMD_SHIFT)) & (PTRS_PER_PMD - 1))
+-#define pte_index(address) (((address) >> (PAGE_SHIFT)) & (PTRS_PER_PTE - 1))
++static inline unsigned long pgd_index(unsigned long address)
++{
++ return (address >> PGDIR_SHIFT) & (PTRS_PER_PGD - 1);
++}
++
++static inline unsigned long pud_index(unsigned long address)
++{
++ return (address >> PUD_SHIFT) & (PTRS_PER_PUD - 1);
++}
++
++static inline unsigned long pmd_index(unsigned long address)
++{
++ return (address >> PMD_SHIFT) & (PTRS_PER_PMD - 1);
++}
++
++static inline unsigned long pte_index(unsigned long address)
++{
++ return (address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1);
++}
+
+ /*
+ * Find an entry in a page-table-directory. We combine the address region
+diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
+index 52fadded5c1e..45bbcffcb7b6 100644
+--- a/arch/powerpc/include/asm/processor.h
++++ b/arch/powerpc/include/asm/processor.h
+@@ -386,7 +386,6 @@ struct thread_struct {
+ #else
+ #define INIT_THREAD { \
+ .ksp = INIT_SP, \
+- .regs = (struct pt_regs *)INIT_SP - 1, /* XXX bogus, I think */ \
+ .addr_limit = KERNEL_DS, \
+ .fpexc_mode = 0, \
+ .ppr = INIT_PPR, \
+diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
+index 3fb564f3e887..389da790c129 100644
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -950,15 +950,8 @@ start_here_multiplatform:
+ std r0,0(r4)
+ #endif
+
+- /* The following gets the stack set up with the regs */
+- /* pointing to the real addr of the kernel stack. This is */
+- /* all done to support the C function call below which sets */
+- /* up the htab. This is done because we have relocated the */
+- /* kernel but are still running in real mode. */
+-
+- LOAD_REG_ADDR(r3,init_thread_union)
+-
+ /* set up a stack pointer */
++ LOAD_REG_ADDR(r3,init_thread_union)
+ LOAD_REG_IMMEDIATE(r1,THREAD_SIZE)
+ add r1,r3,r1
+ li r0,0
+diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
+index 63f5a9311a29..094c37fb07a9 100644
+--- a/arch/powerpc/kernel/machine_kexec.c
++++ b/arch/powerpc/kernel/machine_kexec.c
+@@ -116,11 +116,12 @@ void machine_kexec(struct kimage *image)
+
+ void __init reserve_crashkernel(void)
+ {
+- unsigned long long crash_size, crash_base;
++ unsigned long long crash_size, crash_base, total_mem_sz;
+ int ret;
+
++ total_mem_sz = memory_limit ? memory_limit : memblock_phys_mem_size();
+ /* use common parsing */
+- ret = parse_crashkernel(boot_command_line, memblock_phys_mem_size(),
++ ret = parse_crashkernel(boot_command_line, total_mem_sz,
+ &crash_size, &crash_base);
+ if (ret == 0 && crash_size > 0) {
+ crashk_res.start = crash_base;
+@@ -179,6 +180,7 @@ void __init reserve_crashkernel(void)
+ /* Crash kernel trumps memory limit */
+ if (memory_limit && memory_limit <= crashk_res.end) {
+ memory_limit = crashk_res.end + 1;
++ total_mem_sz = memory_limit;
+ printk("Adjusted memory limit for crashkernel, now 0x%llx\n",
+ memory_limit);
+ }
+@@ -187,7 +189,7 @@ void __init reserve_crashkernel(void)
+ "for crashkernel (System RAM: %ldMB)\n",
+ (unsigned long)(crash_size >> 20),
+ (unsigned long)(crashk_res.start >> 20),
+- (unsigned long)(memblock_phys_mem_size() >> 20));
++ (unsigned long)(total_mem_sz >> 20));
+
+ if (!memblock_is_region_memory(crashk_res.start, crash_size) ||
+ memblock_reserve(crashk_res.start, crash_size)) {
+diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
+index 998f8d089ac7..df0f08cb821b 100644
+--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
++++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
+@@ -171,7 +171,13 @@ static struct kmem_cache *kvm_pmd_cache;
+
+ static pte_t *kvmppc_pte_alloc(void)
+ {
+- return kmem_cache_alloc(kvm_pte_cache, GFP_KERNEL);
++ pte_t *pte;
++
++ pte = kmem_cache_alloc(kvm_pte_cache, GFP_KERNEL);
++ /* pmd_populate() will only reference _pa(pte). */
++ kmemleak_ignore(pte);
++
++ return pte;
+ }
+
+ static void kvmppc_pte_free(pte_t *ptep)
+@@ -187,7 +193,13 @@ static inline int pmd_is_leaf(pmd_t pmd)
+
+ static pmd_t *kvmppc_pmd_alloc(void)
+ {
+- return kmem_cache_alloc(kvm_pmd_cache, GFP_KERNEL);
++ pmd_t *pmd;
++
++ pmd = kmem_cache_alloc(kvm_pmd_cache, GFP_KERNEL);
++ /* pud_populate() will only reference _pa(pmd). */
++ kmemleak_ignore(pmd);
++
++ return pmd;
+ }
+
+ static void kvmppc_pmd_free(pmd_t *pmdp)
+diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c
+index 72238eedc360..2bb798918483 100644
+--- a/arch/powerpc/perf/hv-24x7.c
++++ b/arch/powerpc/perf/hv-24x7.c
+@@ -1413,16 +1413,6 @@ static void h_24x7_event_read(struct perf_event *event)
+ h24x7hw = &get_cpu_var(hv_24x7_hw);
+ h24x7hw->events[i] = event;
+ put_cpu_var(h24x7hw);
+- /*
+- * Clear the event count so we can compute the _change_
+- * in the 24x7 raw counter value at the end of the txn.
+- *
+- * Note that we could alternatively read the 24x7 value
+- * now and save its value in event->hw.prev_count. But
+- * that would require issuing a hcall, which would then
+- * defeat the purpose of using the txn interface.
+- */
+- local64_set(&event->count, 0);
+ }
+
+ put_cpu_var(hv_24x7_reqb);
+diff --git a/arch/powerpc/platforms/4xx/pci.c b/arch/powerpc/platforms/4xx/pci.c
+index 5aca523551ae..2f237027fdcc 100644
+--- a/arch/powerpc/platforms/4xx/pci.c
++++ b/arch/powerpc/platforms/4xx/pci.c
+@@ -1242,7 +1242,7 @@ static void __init ppc460sx_pciex_check_link(struct ppc4xx_pciex_port *port)
+ if (mbase == NULL) {
+ printk(KERN_ERR "%pOF: Can't map internal config space !",
+ port->node);
+- goto done;
++ return;
+ }
+
+ while (attempt && (0 == (in_le32(mbase + PECFG_460SX_DLLSTA)
+@@ -1252,9 +1252,7 @@ static void __init ppc460sx_pciex_check_link(struct ppc4xx_pciex_port *port)
+ }
+ if (attempt)
+ port->link = 1;
+-done:
+ iounmap(mbase);
+-
+ }
+
+ static struct ppc4xx_pciex_hwops ppc460sx_pcie_hwops __initdata = {
+diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c
+index 8c7009d001d9..894f62d77a77 100644
+--- a/arch/powerpc/platforms/ps3/mm.c
++++ b/arch/powerpc/platforms/ps3/mm.c
+@@ -212,13 +212,14 @@ void ps3_mm_vas_destroy(void)
+ {
+ int result;
+
+- DBG("%s:%d: map.vas_id = %llu\n", __func__, __LINE__, map.vas_id);
+-
+ if (map.vas_id) {
+ result = lv1_select_virtual_address_space(0);
+- BUG_ON(result);
+- result = lv1_destruct_virtual_address_space(map.vas_id);
+- BUG_ON(result);
++ result += lv1_destruct_virtual_address_space(map.vas_id);
++
++ if (result) {
++ lv1_panic(0);
++ }
++
+ map.vas_id = 0;
+ }
+ }
+@@ -316,19 +317,20 @@ static void ps3_mm_region_destroy(struct mem_region *r)
+ int result;
+
+ if (!r->destroy) {
+- pr_info("%s:%d: Not destroying high region: %llxh %llxh\n",
+- __func__, __LINE__, r->base, r->size);
+ return;
+ }
+
+- DBG("%s:%d: r->base = %llxh\n", __func__, __LINE__, r->base);
+-
+ if (r->base) {
+ result = lv1_release_memory(r->base);
+- BUG_ON(result);
++
++ if (result) {
++ lv1_panic(0);
++ }
++
+ r->size = r->base = r->offset = 0;
+ map.total = map.rm.size;
+ }
++
+ ps3_mm_set_repository_highmem(NULL);
+ }
+
+diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
+index 851ce326874a..e81a285f3a6c 100644
+--- a/arch/powerpc/platforms/pseries/ras.c
++++ b/arch/powerpc/platforms/pseries/ras.c
+@@ -328,10 +328,11 @@ static irqreturn_t ras_error_interrupt(int irq, void *dev_id)
+ /*
+ * Some versions of FWNMI place the buffer inside the 4kB page starting at
+ * 0x7000. Other versions place it inside the rtas buffer. We check both.
++ * Minimum size of the buffer is 16 bytes.
+ */
+ #define VALID_FWNMI_BUFFER(A) \
+- ((((A) >= 0x7000) && ((A) < 0x7ff0)) || \
+- (((A) >= rtas.base) && ((A) < (rtas.base + rtas.size - 16))))
++ ((((A) >= 0x7000) && ((A) <= 0x8000 - 16)) || \
++ (((A) >= rtas.base) && ((A) <= (rtas.base + rtas.size - 16))))
+
+ static inline struct rtas_error_log *fwnmi_get_errlog(void)
+ {
+diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h
+index 96f9a9151fde..2becba8008c4 100644
+--- a/arch/s390/include/asm/syscall.h
++++ b/arch/s390/include/asm/syscall.h
+@@ -38,7 +38,17 @@ static inline void syscall_rollback(struct task_struct *task,
+ static inline long syscall_get_error(struct task_struct *task,
+ struct pt_regs *regs)
+ {
+- return IS_ERR_VALUE(regs->gprs[2]) ? regs->gprs[2] : 0;
++ unsigned long error = regs->gprs[2];
++#ifdef CONFIG_COMPAT
++ if (test_tsk_thread_flag(task, TIF_31BIT)) {
++ /*
++ * Sign-extend the value so (int)-EFOO becomes (long)-EFOO
++ * and will match correctly in comparisons.
++ */
++ error = (long)(int)error;
++ }
++#endif
++ return IS_ERR_VALUE(error) ? error : 0;
+ }
+
+ static inline long syscall_get_return_value(struct task_struct *task,
+diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
+index e2839b5c246c..6539c50fb9aa 100644
+--- a/arch/x86/boot/Makefile
++++ b/arch/x86/boot/Makefile
+@@ -87,7 +87,7 @@ $(obj)/vmlinux.bin: $(obj)/compressed/vmlinux FORCE
+
+ SETUP_OBJS = $(addprefix $(obj)/,$(setup-y))
+
+-sed-zoffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|_end\|_ehead\|_text\|z_.*\)$$/\#define ZO_\2 0x\1/p'
++sed-zoffset := -e 's/^\([0-9a-fA-F]*\) [a-zA-Z] \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|_end\|_ehead\|_text\|z_.*\)$$/\#define ZO_\2 0x\1/p'
+
+ quiet_cmd_zoffset = ZOFFSET $@
+ cmd_zoffset = $(NM) $< | sed -n $(sed-zoffset) > $@
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 53dc8492f02f..e9456a2eef58 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -2024,7 +2024,7 @@ void __init init_apic_mappings(void)
+ unsigned int new_apicid;
+
+ if (apic_validate_deadline_timer())
+- pr_debug("TSC deadline timer available\n");
++ pr_info("TSC deadline timer available\n");
+
+ if (x2apic_mode) {
+ boot_cpu_physical_apicid = read_apic_id();
+diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c
+index a7e0e975043f..e1f9355307b8 100644
+--- a/arch/x86/kernel/idt.c
++++ b/arch/x86/kernel/idt.c
+@@ -320,7 +320,11 @@ void __init idt_setup_apic_and_irq_gates(void)
+
+ #ifdef CONFIG_X86_LOCAL_APIC
+ for_each_clear_bit_from(i, system_vectors, NR_VECTORS) {
+- set_bit(i, system_vectors);
++ /*
++ * Don't set the non assigned system vectors in the
++ * system_vectors bitmap. Otherwise they show up in
++ * /proc/interrupts.
++ */
+ entry = spurious_entries_start + 8 * (i - FIRST_SYSTEM_VECTOR);
+ set_intr_gate(i, entry);
+ }
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 173e915e11d5..07e290244ca9 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -765,16 +765,11 @@ asm(
+ NOKPROBE_SYMBOL(kretprobe_trampoline);
+ STACK_FRAME_NON_STANDARD(kretprobe_trampoline);
+
+-static struct kprobe kretprobe_kprobe = {
+- .addr = (void *)kretprobe_trampoline,
+-};
+-
+ /*
+ * Called from kretprobe_trampoline
+ */
+ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ {
+- struct kprobe_ctlblk *kcb;
+ struct kretprobe_instance *ri = NULL;
+ struct hlist_head *head, empty_rp;
+ struct hlist_node *tmp;
+@@ -784,16 +779,12 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ void *frame_pointer;
+ bool skipped = false;
+
+- preempt_disable();
+-
+ /*
+ * Set a dummy kprobe for avoiding kretprobe recursion.
+ * Since kretprobe never run in kprobe handler, kprobe must not
+ * be running at this point.
+ */
+- kcb = get_kprobe_ctlblk();
+- __this_cpu_write(current_kprobe, &kretprobe_kprobe);
+- kcb->kprobe_status = KPROBE_HIT_ACTIVE;
++ kprobe_busy_begin();
+
+ INIT_HLIST_HEAD(&empty_rp);
+ kretprobe_hash_lock(current, &head, &flags);
+@@ -872,7 +863,7 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ __this_cpu_write(current_kprobe, &ri->rp->kp);
+ ri->ret_addr = correct_ret_addr;
+ ri->rp->handler(ri, regs);
+- __this_cpu_write(current_kprobe, &kretprobe_kprobe);
++ __this_cpu_write(current_kprobe, &kprobe_busy);
+ }
+
+ recycle_rp_inst(ri, &empty_rp);
+@@ -888,8 +879,7 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+
+ kretprobe_hash_unlock(current, &flags);
+
+- __this_cpu_write(current_kprobe, NULL);
+- preempt_enable();
++ kprobe_busy_end();
+
+ hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
+ hlist_del(&ri->hlist);
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 18632f15b29f..0679303e5f3d 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -281,6 +281,11 @@ static const u64 shadow_nonpresent_or_rsvd_mask_len = 5;
+ */
+ static u64 __read_mostly shadow_nonpresent_or_rsvd_lower_gfn_mask;
+
++/*
++ * The number of non-reserved physical address bits irrespective of features
++ * that repurpose legal bits, e.g. MKTME.
++ */
++static u8 __read_mostly shadow_phys_bits;
+
+ static void mmu_spte_set(u64 *sptep, u64 spte);
+ static bool is_executable_pte(u64 spte);
+@@ -464,6 +469,21 @@ void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask,
+ }
+ EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes);
+
++static u8 kvm_get_shadow_phys_bits(void)
++{
++ /*
++ * boot_cpu_data.x86_phys_bits is reduced when MKTME is detected
++ * in CPU detection code, but MKTME treats those reduced bits as
++ * 'keyID' thus they are not reserved bits. Therefore for MKTME
++ * we should still return physical address bits reported by CPUID.
++ */
++ if (!boot_cpu_has(X86_FEATURE_TME) ||
++ WARN_ON_ONCE(boot_cpu_data.extended_cpuid_level < 0x80000008))
++ return boot_cpu_data.x86_phys_bits;
++
++ return cpuid_eax(0x80000008) & 0xff;
++}
++
+ static void kvm_mmu_reset_all_pte_masks(void)
+ {
+ u8 low_phys_bits;
+@@ -477,6 +497,8 @@ static void kvm_mmu_reset_all_pte_masks(void)
+ shadow_present_mask = 0;
+ shadow_acc_track_mask = 0;
+
++ shadow_phys_bits = kvm_get_shadow_phys_bits();
++
+ /*
+ * If the CPU has 46 or less physical address bits, then set an
+ * appropriate mask to guard against L1TF attacks. Otherwise, it is
+@@ -4544,7 +4566,7 @@ reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
+ */
+ shadow_zero_check = &context->shadow_zero_check;
+ __reset_rsvds_bits_mask(vcpu, shadow_zero_check,
+- boot_cpu_data.x86_phys_bits,
++ shadow_phys_bits,
+ context->shadow_root_level, uses_nx,
+ guest_cpuid_has(vcpu, X86_FEATURE_GBPAGES),
+ is_pse(vcpu), true);
+@@ -4581,13 +4603,13 @@ reset_tdp_shadow_zero_bits_mask(struct kvm_vcpu *vcpu,
+
+ if (boot_cpu_is_amd())
+ __reset_rsvds_bits_mask(vcpu, shadow_zero_check,
+- boot_cpu_data.x86_phys_bits,
++ shadow_phys_bits,
+ context->shadow_root_level, false,
+ boot_cpu_has(X86_FEATURE_GBPAGES),
+ true, true);
+ else
+ __reset_rsvds_bits_mask_ept(shadow_zero_check,
+- boot_cpu_data.x86_phys_bits,
++ shadow_phys_bits,
+ false);
+
+ if (!shadow_me_mask)
+@@ -4608,7 +4630,7 @@ reset_ept_shadow_zero_bits_mask(struct kvm_vcpu *vcpu,
+ struct kvm_mmu *context, bool execonly)
+ {
+ __reset_rsvds_bits_mask_ept(&context->shadow_zero_check,
+- boot_cpu_data.x86_phys_bits, execonly);
++ shadow_phys_bits, execonly);
+ }
+
+ #define BYTE_MASK(access) \
+@@ -6050,6 +6072,25 @@ static int set_nx_huge_pages(const char *val, const struct kernel_param *kp)
+ return 0;
+ }
+
++static void kvm_set_mmio_spte_mask(void)
++{
++ u64 mask;
++
++ /*
++ * Set a reserved PA bit in MMIO SPTEs to generate page faults with
++ * PFEC.RSVD=1 on MMIO accesses. 64-bit PTEs (PAE, x86-64, and EPT
++ * paging) support a maximum of 52 bits of PA, i.e. if the CPU supports
++ * 52-bit physical addresses then there are no reserved PA bits in the
++ * PTEs and so the reserved PA approach must be disabled.
++ */
++ if (shadow_phys_bits < 52)
++ mask = BIT_ULL(51) | PT_PRESENT_MASK;
++ else
++ mask = 0;
++
++ kvm_mmu_set_mmio_spte_mask(mask, mask);
++}
++
+ int kvm_mmu_module_init(void)
+ {
+ int ret = -ENOMEM;
+@@ -6059,6 +6100,8 @@ int kvm_mmu_module_init(void)
+
+ kvm_mmu_reset_all_pte_masks();
+
++ kvm_set_mmio_spte_mask();
++
+ pte_list_desc_cache = kmem_cache_create("pte_list_desc",
+ sizeof(struct pte_list_desc),
+ 0, SLAB_ACCOUNT, NULL);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index c53df0b95385..50d59ad34619 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6775,35 +6775,6 @@ static struct perf_guest_info_callbacks kvm_guest_cbs = {
+ .get_guest_ip = kvm_get_guest_ip,
+ };
+
+-static void kvm_set_mmio_spte_mask(void)
+-{
+- u64 mask;
+- int maxphyaddr = boot_cpu_data.x86_phys_bits;
+-
+- /*
+- * Set the reserved bits and the present bit of an paging-structure
+- * entry to generate page fault with PFER.RSV = 1.
+- */
+-
+- /*
+- * Mask the uppermost physical address bit, which would be reserved as
+- * long as the supported physical address width is less than 52.
+- */
+- mask = 1ull << 51;
+-
+- /* Set the present bit. */
+- mask |= 1ull;
+-
+- /*
+- * If reserved bit is not supported, clear the present bit to disable
+- * mmio page fault.
+- */
+- if (maxphyaddr == 52)
+- mask &= ~1ull;
+-
+- kvm_mmu_set_mmio_spte_mask(mask, mask);
+-}
+-
+ #ifdef CONFIG_X86_64
+ static void pvclock_gtod_update_fn(struct work_struct *work)
+ {
+@@ -6881,8 +6852,6 @@ int kvm_arch_init(void *opaque)
+ if (r)
+ goto out_free_percpu;
+
+- kvm_set_mmio_spte_mask();
+-
+ kvm_x86_ops = ops;
+
+ kvm_mmu_set_mask_ptes(PT_USER_MASK, PT_ACCESSED_MASK,
+diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
+index b81b5172cf99..2cfa0caef133 100644
+--- a/arch/x86/purgatory/Makefile
++++ b/arch/x86/purgatory/Makefile
+@@ -15,7 +15,10 @@ $(obj)/sha256.o: $(srctree)/lib/sha256.c FORCE
+ LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined -nostdlib -z nodefaultlib
+ targets += purgatory.ro
+
++# Sanitizer, etc. runtimes are unavailable and cannot be linked here.
++GCOV_PROFILE := n
+ KASAN_SANITIZE := n
++UBSAN_SANITIZE := n
+ KCOV_INSTRUMENT := n
+
+ # These are adjustments to the compiler flags used for objects that
+@@ -23,7 +26,7 @@ KCOV_INSTRUMENT := n
+
+ PURGATORY_CFLAGS_REMOVE := -mcmodel=kernel
+ PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss
+-PURGATORY_CFLAGS += $(DISABLE_STACKLEAK_PLUGIN)
++PURGATORY_CFLAGS += $(DISABLE_STACKLEAK_PLUGIN) -DDISABLE_BRANCH_PROFILING
+
+ # Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
+ # in turn leaves some undefined symbols like __fentry__ in purgatory and not
+diff --git a/crypto/algboss.c b/crypto/algboss.c
+index 5e6df2a087fa..445da4a0618f 100644
+--- a/crypto/algboss.c
++++ b/crypto/algboss.c
+@@ -193,8 +193,6 @@ static int cryptomgr_schedule_probe(struct crypto_larval *larval)
+ if (IS_ERR(thread))
+ goto err_put_larval;
+
+- wait_for_completion_interruptible(&larval->completion);
+-
+ return NOTIFY_STOP;
+
+ err_put_larval:
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index cfdaab2b7d76..1380a208b8ca 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -78,14 +78,10 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
+ return PTR_ERR(areq);
+
+ /* convert iovecs of output buffers into RX SGL */
+- err = af_alg_get_rsgl(sk, msg, flags, areq, -1, &len);
++ err = af_alg_get_rsgl(sk, msg, flags, areq, ctx->used, &len);
+ if (err)
+ goto free;
+
+- /* Process only as much RX buffers for which we have TX data */
+- if (len > ctx->used)
+- len = ctx->used;
+-
+ /*
+ * If more buffers are to be expected to be processed, process only
+ * full block size buffers.
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 75d582ca917f..6b372fa58382 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -57,7 +57,6 @@
+ #include <linux/workqueue.h>
+ #include <linux/scatterlist.h>
+ #include <linux/io.h>
+-#include <linux/async.h>
+ #include <linux/log2.h>
+ #include <linux/slab.h>
+ #include <linux/glob.h>
+@@ -6610,7 +6609,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
+ /* perform each probe asynchronously */
+ for (i = 0; i < host->n_ports; i++) {
+ struct ata_port *ap = host->ports[i];
+- async_schedule(async_port_probe, ap);
++ ap->cookie = async_schedule(async_port_probe, ap);
+ }
+
+ return 0;
+@@ -6750,11 +6749,11 @@ void ata_host_detach(struct ata_host *host)
+ {
+ int i;
+
+- /* Ensure ata_port probe has completed */
+- async_synchronize_full();
+-
+- for (i = 0; i < host->n_ports; i++)
++ for (i = 0; i < host->n_ports; i++) {
++ /* Ensure ata_port probe has completed */
++ async_synchronize_cookie(host->ports[i]->cookie + 1);
+ ata_port_detach(host->ports[i]);
++ }
+
+ /* the host is dead now, dissociate ACPI */
+ ata_acpi_dissociate(host);
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index d1f901b58f75..349c2754eed7 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -700,6 +700,8 @@ int __init_or_module __platform_driver_probe(struct platform_driver *drv,
+ /* temporary section violation during probe() */
+ drv->probe = probe;
+ retval = code = __platform_driver_register(drv, module);
++ if (retval)
++ return retval;
+
+ /*
+ * Fixup that section violation, being paranoid about code scanning
+diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c
+index afe1508d82c6..bd1c66f5631a 100644
+--- a/drivers/block/ps3disk.c
++++ b/drivers/block/ps3disk.c
+@@ -466,7 +466,6 @@ static int ps3disk_probe(struct ps3_system_bus_device *_dev)
+ queue->queuedata = dev;
+
+ blk_queue_max_hw_sectors(queue, dev->bounce_size >> 9);
+- blk_queue_segment_boundary(queue, -1UL);
+ blk_queue_dma_alignment(queue, dev->blk_size-1);
+ blk_queue_logical_block_size(queue, dev->blk_size);
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 69734b1df792..cb85516e1eb3 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -30,6 +30,7 @@
+ #include <linux/workqueue.h>
+ #include <linux/uuid.h>
+ #include <linux/nospec.h>
++#include <linux/vmalloc.h>
+
+ #define PFX "IPMI message handler: "
+
+@@ -1089,7 +1090,7 @@ static void free_user_work(struct work_struct *work)
+ remove_work);
+
+ cleanup_srcu_struct(&user->release_barrier);
+- kfree(user);
++ vfree(user);
+ }
+
+ int ipmi_create_user(unsigned int if_num,
+@@ -1121,7 +1122,7 @@ int ipmi_create_user(unsigned int if_num,
+ if (rv)
+ return rv;
+
+- new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
++ new_user = vzalloc(sizeof(*new_user));
+ if (!new_user)
+ return -ENOMEM;
+
+@@ -1170,7 +1171,7 @@ int ipmi_create_user(unsigned int if_num,
+
+ out_kfree:
+ srcu_read_unlock(&ipmi_interfaces_srcu, index);
+- kfree(new_user);
++ vfree(new_user);
+ return rv;
+ }
+ EXPORT_SYMBOL(ipmi_create_user);
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index 7bef0666ae7e..1c093fb35ebe 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1447,13 +1447,13 @@ static struct clk_hw *bcm2835_register_clock(struct bcm2835_cprman *cprman,
+ return &clock->hw;
+ }
+
+-static struct clk *bcm2835_register_gate(struct bcm2835_cprman *cprman,
++static struct clk_hw *bcm2835_register_gate(struct bcm2835_cprman *cprman,
+ const struct bcm2835_gate_data *data)
+ {
+- return clk_register_gate(cprman->dev, data->name, data->parent,
+- CLK_IGNORE_UNUSED | CLK_SET_RATE_GATE,
+- cprman->regs + data->ctl_reg,
+- CM_GATE_BIT, 0, &cprman->regs_lock);
++ return clk_hw_register_gate(cprman->dev, data->name, data->parent,
++ CLK_IGNORE_UNUSED | CLK_SET_RATE_GATE,
++ cprman->regs + data->ctl_reg,
++ CM_GATE_BIT, 0, &cprman->regs_lock);
+ }
+
+ typedef struct clk_hw *(*bcm2835_clk_register)(struct bcm2835_cprman *cprman,
+diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c
+index ac2b0aa1e8b5..03e0ade7a6f3 100644
+--- a/drivers/clk/qcom/gcc-msm8916.c
++++ b/drivers/clk/qcom/gcc-msm8916.c
+@@ -268,7 +268,7 @@ static struct clk_pll gpll0 = {
+ .l_reg = 0x21004,
+ .m_reg = 0x21008,
+ .n_reg = 0x2100c,
+- .config_reg = 0x21014,
++ .config_reg = 0x21010,
+ .mode_reg = 0x21000,
+ .status_reg = 0x2101c,
+ .status_bit = 17,
+@@ -295,7 +295,7 @@ static struct clk_pll gpll1 = {
+ .l_reg = 0x20004,
+ .m_reg = 0x20008,
+ .n_reg = 0x2000c,
+- .config_reg = 0x20014,
++ .config_reg = 0x20010,
+ .mode_reg = 0x20000,
+ .status_reg = 0x2001c,
+ .status_bit = 17,
+@@ -322,7 +322,7 @@ static struct clk_pll gpll2 = {
+ .l_reg = 0x4a004,
+ .m_reg = 0x4a008,
+ .n_reg = 0x4a00c,
+- .config_reg = 0x4a014,
++ .config_reg = 0x4a010,
+ .mode_reg = 0x4a000,
+ .status_reg = 0x4a01c,
+ .status_bit = 17,
+@@ -349,7 +349,7 @@ static struct clk_pll bimc_pll = {
+ .l_reg = 0x23004,
+ .m_reg = 0x23008,
+ .n_reg = 0x2300c,
+- .config_reg = 0x23014,
++ .config_reg = 0x23010,
+ .mode_reg = 0x23000,
+ .status_reg = 0x2301c,
+ .status_bit = 17,
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index 6473af8903c5..662bb441f139 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -597,7 +597,7 @@ static const struct samsung_div_clock exynos5800_div_clks[] __initconst = {
+
+ static const struct samsung_gate_clock exynos5800_gate_clks[] __initconst = {
+ GATE(CLK_ACLK550_CAM, "aclk550_cam", "mout_user_aclk550_cam",
+- GATE_BUS_TOP, 24, 0, 0),
++ GATE_BUS_TOP, 24, CLK_IS_CRITICAL, 0),
+ GATE(CLK_ACLK432_SCALER, "aclk432_scaler", "mout_user_aclk432_scaler",
+ GATE_BUS_TOP, 27, CLK_IS_CRITICAL, 0),
+ GATE(CLK_MAU_EPLL, "mau_epll", "mout_user_mau_epll",
+@@ -984,25 +984,25 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
+ GATE(0, "aclk300_jpeg", "mout_user_aclk300_jpeg",
+ GATE_BUS_TOP, 4, CLK_IGNORE_UNUSED, 0),
+ GATE(0, "aclk333_432_isp0", "mout_user_aclk333_432_isp0",
+- GATE_BUS_TOP, 5, 0, 0),
++ GATE_BUS_TOP, 5, CLK_IS_CRITICAL, 0),
+ GATE(0, "aclk300_gscl", "mout_user_aclk300_gscl",
+ GATE_BUS_TOP, 6, CLK_IS_CRITICAL, 0),
+ GATE(0, "aclk333_432_gscl", "mout_user_aclk333_432_gscl",
+ GATE_BUS_TOP, 7, CLK_IGNORE_UNUSED, 0),
+ GATE(0, "aclk333_432_isp", "mout_user_aclk333_432_isp",
+- GATE_BUS_TOP, 8, 0, 0),
++ GATE_BUS_TOP, 8, CLK_IS_CRITICAL, 0),
+ GATE(CLK_PCLK66_GPIO, "pclk66_gpio", "mout_user_pclk66_gpio",
+ GATE_BUS_TOP, 9, CLK_IGNORE_UNUSED, 0),
+ GATE(0, "aclk66_psgen", "mout_user_aclk66_psgen",
+ GATE_BUS_TOP, 10, CLK_IGNORE_UNUSED, 0),
+ GATE(0, "aclk266_isp", "mout_user_aclk266_isp",
+- GATE_BUS_TOP, 13, 0, 0),
++ GATE_BUS_TOP, 13, CLK_IS_CRITICAL, 0),
+ GATE(0, "aclk166", "mout_user_aclk166",
+ GATE_BUS_TOP, 14, CLK_IGNORE_UNUSED, 0),
+ GATE(CLK_ACLK333, "aclk333", "mout_user_aclk333",
+ GATE_BUS_TOP, 15, CLK_IS_CRITICAL, 0),
+ GATE(0, "aclk400_isp", "mout_user_aclk400_isp",
+- GATE_BUS_TOP, 16, 0, 0),
++ GATE_BUS_TOP, 16, CLK_IS_CRITICAL, 0),
+ GATE(0, "aclk400_mscl", "mout_user_aclk400_mscl",
+ GATE_BUS_TOP, 17, CLK_IS_CRITICAL, 0),
+ GATE(0, "aclk200_disp1", "mout_user_aclk200_disp1",
+@@ -1208,8 +1208,10 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
+ GATE_IP_GSCL1, 3, 0, 0),
+ GATE(CLK_SMMU_FIMCL1, "smmu_fimcl1", "dout_gscl_blk_333",
+ GATE_IP_GSCL1, 4, 0, 0),
+- GATE(CLK_GSCL_WA, "gscl_wa", "sclk_gscl_wa", GATE_IP_GSCL1, 12, 0, 0),
+- GATE(CLK_GSCL_WB, "gscl_wb", "sclk_gscl_wb", GATE_IP_GSCL1, 13, 0, 0),
++ GATE(CLK_GSCL_WA, "gscl_wa", "sclk_gscl_wa", GATE_IP_GSCL1, 12,
++ CLK_IS_CRITICAL, 0),
++ GATE(CLK_GSCL_WB, "gscl_wb", "sclk_gscl_wb", GATE_IP_GSCL1, 13,
++ CLK_IS_CRITICAL, 0),
+ GATE(CLK_SMMU_FIMCL3, "smmu_fimcl3,", "dout_gscl_blk_333",
+ GATE_IP_GSCL1, 16, 0, 0),
+ GATE(CLK_FIMC_LITE3, "fimc_lite3", "aclk333_432_gscl",
+diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
+index 302596dc79a2..0f2a9d767eef 100644
+--- a/drivers/clk/samsung/clk-exynos5433.c
++++ b/drivers/clk/samsung/clk-exynos5433.c
+@@ -1680,7 +1680,8 @@ static const struct samsung_gate_clock peric_gate_clks[] __initconst = {
+ GATE(CLK_SCLK_PCM1, "sclk_pcm1", "sclk_pcm1_peric",
+ ENABLE_SCLK_PERIC, 7, CLK_SET_RATE_PARENT, 0),
+ GATE(CLK_SCLK_I2S1, "sclk_i2s1", "sclk_i2s1_peric",
+- ENABLE_SCLK_PERIC, 6, CLK_SET_RATE_PARENT, 0),
++ ENABLE_SCLK_PERIC, 6,
++ CLK_SET_RATE_PARENT | CLK_IGNORE_UNUSED, 0),
+ GATE(CLK_SCLK_SPI2, "sclk_spi2", "sclk_spi2_peric", ENABLE_SCLK_PERIC,
+ 5, CLK_SET_RATE_PARENT, 0),
+ GATE(CLK_SCLK_SPI1, "sclk_spi1", "sclk_spi1_peric", ENABLE_SCLK_PERIC,
+diff --git a/drivers/clk/sprd/pll.c b/drivers/clk/sprd/pll.c
+index 640270f51aa5..eb8862752c2b 100644
+--- a/drivers/clk/sprd/pll.c
++++ b/drivers/clk/sprd/pll.c
+@@ -105,7 +105,7 @@ static unsigned long _sprd_pll_recalc_rate(const struct sprd_pll *pll,
+
+ cfg = kcalloc(regs_num, sizeof(*cfg), GFP_KERNEL);
+ if (!cfg)
+- return -ENOMEM;
++ return parent_rate;
+
+ for (i = 0; i < regs_num; i++)
+ cfg[i] = sprd_pll_read(pll, i);
+diff --git a/drivers/clk/st/clk-flexgen.c b/drivers/clk/st/clk-flexgen.c
+index 918ba3164da9..cd856210db58 100644
+--- a/drivers/clk/st/clk-flexgen.c
++++ b/drivers/clk/st/clk-flexgen.c
+@@ -373,6 +373,7 @@ static void __init st_of_flexgen_setup(struct device_node *np)
+ break;
+ }
+
++ flex_flags &= ~CLK_IS_CRITICAL;
+ of_clk_detect_critical(np, i, &flex_flags);
+
+ /*
+diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
+index 004b411b640b..2bd035d48816 100644
+--- a/drivers/clk/sunxi/clk-sunxi.c
++++ b/drivers/clk/sunxi/clk-sunxi.c
+@@ -98,7 +98,7 @@ static void sun6i_a31_get_pll1_factors(struct factors_request *req)
+ * Round down the frequency to the closest multiple of either
+ * 6 or 16
+ */
+- u32 round_freq_6 = round_down(freq_mhz, 6);
++ u32 round_freq_6 = rounddown(freq_mhz, 6);
+ u32 round_freq_16 = round_down(freq_mhz, 16);
+
+ if (round_freq_6 > round_freq_16)
+diff --git a/drivers/clk/ti/composite.c b/drivers/clk/ti/composite.c
+index 030e8b2c1050..c6478d0b996b 100644
+--- a/drivers/clk/ti/composite.c
++++ b/drivers/clk/ti/composite.c
+@@ -196,6 +196,7 @@ cleanup:
+ if (!cclk->comp_clks[i])
+ continue;
+ list_del(&cclk->comp_clks[i]->link);
++ kfree(cclk->comp_clks[i]->parent_names);
+ kfree(cclk->comp_clks[i]);
+ }
+
+diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
+index 0641185bd82f..2faaa4069cdd 100644
+--- a/drivers/crypto/omap-sham.c
++++ b/drivers/crypto/omap-sham.c
+@@ -168,8 +168,6 @@ struct omap_sham_hmac_ctx {
+ };
+
+ struct omap_sham_ctx {
+- struct omap_sham_dev *dd;
+-
+ unsigned long flags;
+
+ /* fallback stuff */
+@@ -921,27 +919,35 @@ static int omap_sham_update_dma_stop(struct omap_sham_dev *dd)
+ return 0;
+ }
+
++struct omap_sham_dev *omap_sham_find_dev(struct omap_sham_reqctx *ctx)
++{
++ struct omap_sham_dev *dd;
++
++ if (ctx->dd)
++ return ctx->dd;
++
++ spin_lock_bh(&sham.lock);
++ dd = list_first_entry(&sham.dev_list, struct omap_sham_dev, list);
++ list_move_tail(&dd->list, &sham.dev_list);
++ ctx->dd = dd;
++ spin_unlock_bh(&sham.lock);
++
++ return dd;
++}
++
+ static int omap_sham_init(struct ahash_request *req)
+ {
+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+ struct omap_sham_ctx *tctx = crypto_ahash_ctx(tfm);
+ struct omap_sham_reqctx *ctx = ahash_request_ctx(req);
+- struct omap_sham_dev *dd = NULL, *tmp;
++ struct omap_sham_dev *dd;
+ int bs = 0;
+
+- spin_lock_bh(&sham.lock);
+- if (!tctx->dd) {
+- list_for_each_entry(tmp, &sham.dev_list, list) {
+- dd = tmp;
+- break;
+- }
+- tctx->dd = dd;
+- } else {
+- dd = tctx->dd;
+- }
+- spin_unlock_bh(&sham.lock);
++ ctx->dd = NULL;
+
+- ctx->dd = dd;
++ dd = omap_sham_find_dev(ctx);
++ if (!dd)
++ return -ENODEV;
+
+ ctx->flags = 0;
+
+@@ -1191,8 +1197,7 @@ err1:
+ static int omap_sham_enqueue(struct ahash_request *req, unsigned int op)
+ {
+ struct omap_sham_reqctx *ctx = ahash_request_ctx(req);
+- struct omap_sham_ctx *tctx = crypto_tfm_ctx(req->base.tfm);
+- struct omap_sham_dev *dd = tctx->dd;
++ struct omap_sham_dev *dd = ctx->dd;
+
+ ctx->op = op;
+
+@@ -1202,7 +1207,7 @@ static int omap_sham_enqueue(struct ahash_request *req, unsigned int op)
+ static int omap_sham_update(struct ahash_request *req)
+ {
+ struct omap_sham_reqctx *ctx = ahash_request_ctx(req);
+- struct omap_sham_dev *dd = ctx->dd;
++ struct omap_sham_dev *dd = omap_sham_find_dev(ctx);
+
+ if (!req->nbytes)
+ return 0;
+@@ -1307,21 +1312,8 @@ static int omap_sham_setkey(struct crypto_ahash *tfm, const u8 *key,
+ struct omap_sham_hmac_ctx *bctx = tctx->base;
+ int bs = crypto_shash_blocksize(bctx->shash);
+ int ds = crypto_shash_digestsize(bctx->shash);
+- struct omap_sham_dev *dd = NULL, *tmp;
+ int err, i;
+
+- spin_lock_bh(&sham.lock);
+- if (!tctx->dd) {
+- list_for_each_entry(tmp, &sham.dev_list, list) {
+- dd = tmp;
+- break;
+- }
+- tctx->dd = dd;
+- } else {
+- dd = tctx->dd;
+- }
+- spin_unlock_bh(&sham.lock);
+-
+ err = crypto_shash_setkey(tctx->fallback, key, keylen);
+ if (err)
+ return err;
+@@ -1339,7 +1331,7 @@ static int omap_sham_setkey(struct crypto_ahash *tfm, const u8 *key,
+
+ memset(bctx->ipad + keylen, 0, bs - keylen);
+
+- if (!test_bit(FLAGS_AUTO_XOR, &dd->flags)) {
++ if (!test_bit(FLAGS_AUTO_XOR, &sham.flags)) {
+ memcpy(bctx->opad, bctx->ipad, bs);
+
+ for (i = 0; i < bs; i++) {
+@@ -2142,6 +2134,7 @@ static int omap_sham_probe(struct platform_device *pdev)
+ }
+
+ dd->flags |= dd->pdata->flags;
++ sham.flags |= dd->pdata->flags;
+
+ pm_runtime_use_autosuspend(dev);
+ pm_runtime_set_autosuspend_delay(dev, DEFAULT_AUTOSUSPEND_DELAY);
+@@ -2169,6 +2162,9 @@ static int omap_sham_probe(struct platform_device *pdev)
+ spin_unlock(&sham.lock);
+
+ for (i = 0; i < dd->pdata->algs_info_size; i++) {
++ if (dd->pdata->algs_info[i].registered)
++ break;
++
+ for (j = 0; j < dd->pdata->algs_info[i].size; j++) {
+ struct ahash_alg *alg;
+
+@@ -2220,9 +2216,11 @@ static int omap_sham_remove(struct platform_device *pdev)
+ list_del(&dd->list);
+ spin_unlock(&sham.lock);
+ for (i = dd->pdata->algs_info_size - 1; i >= 0; i--)
+- for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--)
++ for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--) {
+ crypto_unregister_ahash(
+ &dd->pdata->algs_info[i].algs_list[j]);
++ dd->pdata->algs_info[i].registered--;
++ }
+ tasklet_kill(&dd->done_task);
+ pm_runtime_disable(&pdev->dev);
+
+diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
+index 18026354c332..b1fb38b7f270 100644
+--- a/drivers/extcon/extcon-adc-jack.c
++++ b/drivers/extcon/extcon-adc-jack.c
+@@ -128,7 +128,7 @@ static int adc_jack_probe(struct platform_device *pdev)
+ for (i = 0; data->adc_conditions[i].id != EXTCON_NONE; i++);
+ data->num_conditions = i;
+
+- data->chan = iio_channel_get(&pdev->dev, pdata->consumer_channel);
++ data->chan = devm_iio_channel_get(&pdev->dev, pdata->consumer_channel);
+ if (IS_ERR(data->chan))
+ return PTR_ERR(data->chan);
+
+@@ -170,7 +170,6 @@ static int adc_jack_remove(struct platform_device *pdev)
+
+ free_irq(data->irq, data);
+ cancel_work_sync(&data->handler.work);
+- iio_channel_release(data->chan);
+
+ return 0;
+ }
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index 98c987188835..513908a0c262 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -18,7 +18,6 @@
+ #include <linux/init.h>
+ #include <linux/cpumask.h>
+ #include <linux/export.h>
+-#include <linux/dma-direct.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/module.h>
+ #include <linux/types.h>
+@@ -449,8 +448,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ struct qcom_scm_mem_map_info *mem_to_map;
+ phys_addr_t mem_to_map_phys;
+ phys_addr_t dest_phys;
+- phys_addr_t ptr_phys;
+- dma_addr_t ptr_dma;
++ dma_addr_t ptr_phys;
+ size_t mem_to_map_sz;
+ size_t dest_sz;
+ size_t src_sz;
+@@ -468,10 +466,9 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ ptr_sz = ALIGN(src_sz, SZ_64) + ALIGN(mem_to_map_sz, SZ_64) +
+ ALIGN(dest_sz, SZ_64);
+
+- ptr = dma_alloc_coherent(__scm->dev, ptr_sz, &ptr_dma, GFP_KERNEL);
++ ptr = dma_alloc_coherent(__scm->dev, ptr_sz, &ptr_phys, GFP_KERNEL);
+ if (!ptr)
+ return -ENOMEM;
+- ptr_phys = dma_to_phys(__scm->dev, ptr_dma);
+
+ /* Fill source vmid detail */
+ src = ptr;
+@@ -501,7 +498,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+
+ ret = __qcom_scm_assign_mem(__scm->dev, mem_to_map_phys, mem_to_map_sz,
+ ptr_phys, src_sz, dest_phys, dest_sz);
+- dma_free_coherent(__scm->dev, ptr_sz, ptr, ptr_dma);
++ dma_free_coherent(__scm->dev, ptr_sz, ptr, ptr_phys);
+ if (ret) {
+ dev_err(__scm->dev,
+ "Assign memory protection call failed %d.\n", ret);
+diff --git a/drivers/fpga/dfl-afu-dma-region.c b/drivers/fpga/dfl-afu-dma-region.c
+index c9a613dc9eb7..e056965ef97b 100644
+--- a/drivers/fpga/dfl-afu-dma-region.c
++++ b/drivers/fpga/dfl-afu-dma-region.c
+@@ -106,10 +106,10 @@ static int afu_dma_pin_pages(struct dfl_feature_platform_data *pdata,
+ region->pages);
+ if (pinned < 0) {
+ ret = pinned;
+- goto put_pages;
++ goto free_pages;
+ } else if (pinned != npages) {
+ ret = -EFAULT;
+- goto free_pages;
++ goto put_pages;
+ }
+
+ dev_dbg(dev, "%d pages pinned\n", pinned);
+diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c
+index 044888fd96a1..2a56efced798 100644
+--- a/drivers/gpio/gpio-dwapb.c
++++ b/drivers/gpio/gpio-dwapb.c
+@@ -51,7 +51,9 @@
+ #define GPIO_EXT_PORTC 0x58
+ #define GPIO_EXT_PORTD 0x5c
+
++#define DWAPB_DRIVER_NAME "gpio-dwapb"
+ #define DWAPB_MAX_PORTS 4
++
+ #define GPIO_EXT_PORT_STRIDE 0x04 /* register stride 32 bits */
+ #define GPIO_SWPORT_DR_STRIDE 0x0c /* register stride 3*32 bits */
+ #define GPIO_SWPORT_DDR_STRIDE 0x0c /* register stride 3*32 bits */
+@@ -400,7 +402,7 @@ static void dwapb_configure_irqs(struct dwapb_gpio *gpio,
+ return;
+
+ err = irq_alloc_domain_generic_chips(gpio->domain, ngpio, 2,
+- "gpio-dwapb", handle_level_irq,
++ DWAPB_DRIVER_NAME, handle_level_irq,
+ IRQ_NOREQUEST, 0,
+ IRQ_GC_INIT_NESTED_LOCK);
+ if (err) {
+@@ -457,7 +459,7 @@ static void dwapb_configure_irqs(struct dwapb_gpio *gpio,
+ */
+ err = devm_request_irq(gpio->dev, pp->irq[0],
+ dwapb_irq_handler_mfd,
+- IRQF_SHARED, "gpio-dwapb-mfd", gpio);
++ IRQF_SHARED, DWAPB_DRIVER_NAME, gpio);
+ if (err) {
+ dev_err(gpio->dev, "error requesting IRQ\n");
+ irq_domain_remove(gpio->domain);
+@@ -535,26 +537,33 @@ static int dwapb_gpio_add_port(struct dwapb_gpio *gpio,
+ dwapb_configure_irqs(gpio, port, pp);
+
+ err = gpiochip_add_data(&port->gc, port);
+- if (err)
++ if (err) {
+ dev_err(gpio->dev, "failed to register gpiochip for port%d\n",
+ port->idx);
+- else
+- port->is_registered = true;
++ return err;
++ }
+
+ /* Add GPIO-signaled ACPI event support */
+- if (pp->has_irq)
+- acpi_gpiochip_request_interrupts(&port->gc);
++ acpi_gpiochip_request_interrupts(&port->gc);
+
+- return err;
++ port->is_registered = true;
++
++ return 0;
+ }
+
+ static void dwapb_gpio_unregister(struct dwapb_gpio *gpio)
+ {
+ unsigned int m;
+
+- for (m = 0; m < gpio->nr_ports; ++m)
+- if (gpio->ports[m].is_registered)
+- gpiochip_remove(&gpio->ports[m].gc);
++ for (m = 0; m < gpio->nr_ports; ++m) {
++ struct dwapb_gpio_port *port = &gpio->ports[m];
++
++ if (!port->is_registered)
++ continue;
++
++ acpi_gpiochip_free_interrupts(&port->gc);
++ gpiochip_remove(&port->gc);
++ }
+ }
+
+ static struct dwapb_platform_data *
+@@ -842,7 +851,7 @@ static SIMPLE_DEV_PM_OPS(dwapb_gpio_pm_ops, dwapb_gpio_suspend,
+
+ static struct platform_driver dwapb_gpio_driver = {
+ .driver = {
+- .name = "gpio-dwapb",
++ .name = DWAPB_DRIVER_NAME,
+ .pm = &dwapb_gpio_pm_ops,
+ .of_match_table = of_match_ptr(dwapb_of_match),
+ .acpi_match_table = ACPI_PTR(dwapb_acpi_match),
+@@ -856,3 +865,4 @@ module_platform_driver(dwapb_gpio_driver);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Jamie Iles");
+ MODULE_DESCRIPTION("Synopsys DesignWare APB GPIO driver");
++MODULE_ALIAS("platform:" DWAPB_DRIVER_NAME);
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+index 924788772b07..083aa71487e8 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+@@ -238,7 +238,7 @@ static void ci_initialize_power_tune_defaults(struct pp_hwmgr *hwmgr)
+
+ switch (dev_id) {
+ case 0x67BA:
+- case 0x66B1:
++ case 0x67B1:
+ smu_data->power_tune_defaults = &defaults_hawaii_pro;
+ break;
+ case 0x67B8:
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 5f508ec321fe..a0aafd9a37e6 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -29,6 +29,7 @@
+ #include <linux/i2c.h>
+ #include <drm/drm_dp_mst_helper.h>
+ #include <drm/drmP.h>
++#include <linux/iopoll.h>
+
+ #include <drm/drm_fixed.h>
+ #include <drm/drm_atomic.h>
+@@ -2828,6 +2829,17 @@ fail:
+ return ret;
+ }
+
++static int do_get_act_status(struct drm_dp_aux *aux)
++{
++ int ret;
++ u8 status;
++
++ ret = drm_dp_dpcd_readb(aux, DP_PAYLOAD_TABLE_UPDATE_STATUS, &status);
++ if (ret < 0)
++ return ret;
++
++ return status;
++}
+
+ /**
+ * drm_dp_check_act_status() - Check ACT handled status.
+@@ -2837,33 +2849,29 @@ fail:
+ */
+ int drm_dp_check_act_status(struct drm_dp_mst_topology_mgr *mgr)
+ {
+- u8 status;
+- int ret;
+- int count = 0;
+-
+- do {
+- ret = drm_dp_dpcd_readb(mgr->aux, DP_PAYLOAD_TABLE_UPDATE_STATUS, &status);
+-
+- if (ret < 0) {
+- DRM_DEBUG_KMS("failed to read payload table status %d\n", ret);
+- goto fail;
+- }
+-
+- if (status & DP_PAYLOAD_ACT_HANDLED)
+- break;
+- count++;
+- udelay(100);
+-
+- } while (count < 30);
+-
+- if (!(status & DP_PAYLOAD_ACT_HANDLED)) {
+- DRM_DEBUG_KMS("failed to get ACT bit %d after %d retries\n", status, count);
+- ret = -EINVAL;
+- goto fail;
++ /*
++ * There doesn't seem to be any recommended retry count or timeout in
++ * the MST specification. Since some hubs have been observed to take
++ * over 1 second to update their payload allocations under certain
++ * conditions, we use a rather large timeout value.
++ */
++ const int timeout_ms = 3000;
++ int ret, status;
++
++ ret = readx_poll_timeout(do_get_act_status, mgr->aux, status,
++ status & DP_PAYLOAD_ACT_HANDLED || status < 0,
++ 200, timeout_ms * USEC_PER_MSEC);
++ if (ret < 0 && status >= 0) {
++ DRM_DEBUG_KMS("Failed to get ACT after %dms, last status: %02x\n",
++ timeout_ms, status);
++ return -EINVAL;
++ } else if (status < 0) {
++ DRM_DEBUG_KMS("Failed to read payload table status: %d\n",
++ status);
++ return status;
+ }
++
+ return 0;
+-fail:
+- return ret;
+ }
+ EXPORT_SYMBOL(drm_dp_check_act_status);
+
+diff --git a/drivers/gpu/drm/drm_encoder_slave.c b/drivers/gpu/drm/drm_encoder_slave.c
+index cf804389f5ec..d50a7884e69e 100644
+--- a/drivers/gpu/drm/drm_encoder_slave.c
++++ b/drivers/gpu/drm/drm_encoder_slave.c
+@@ -84,7 +84,7 @@ int drm_i2c_encoder_init(struct drm_device *dev,
+
+ err = encoder_drv->encoder_init(client, dev, encoder);
+ if (err)
+- goto fail_unregister;
++ goto fail_module_put;
+
+ if (info->platform_data)
+ encoder->slave_funcs->set_config(&encoder->base,
+@@ -92,9 +92,10 @@ int drm_i2c_encoder_init(struct drm_device *dev,
+
+ return 0;
+
++fail_module_put:
++ module_put(module);
+ fail_unregister:
+ i2c_unregister_device(client);
+- module_put(module);
+ fail:
+ return err;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c
+index e4b9eb1f6b60..f6b81f3256cf 100644
+--- a/drivers/gpu/drm/i915/i915_cmd_parser.c
++++ b/drivers/gpu/drm/i915/i915_cmd_parser.c
+@@ -570,6 +570,9 @@ struct drm_i915_reg_descriptor {
+ #define REG32(_reg, ...) \
+ { .addr = (_reg), __VA_ARGS__ }
+
++#define REG32_IDX(_reg, idx) \
++ { .addr = _reg(idx) }
++
+ /*
+ * Convenience macro for adding 64-bit registers.
+ *
+@@ -667,6 +670,7 @@ static const struct drm_i915_reg_descriptor gen9_blt_regs[] = {
+ REG64_IDX(RING_TIMESTAMP, BSD_RING_BASE),
+ REG32(BCS_SWCTRL),
+ REG64_IDX(RING_TIMESTAMP, BLT_RING_BASE),
++ REG32_IDX(RING_CTX_TIMESTAMP, BLT_RING_BASE),
+ REG64_IDX(BCS_GPR, 0),
+ REG64_IDX(BCS_GPR, 1),
+ REG64_IDX(BCS_GPR, 2),
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index 29877969310d..b7c398232136 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -3821,6 +3821,7 @@ static void gen11_hpd_irq_setup(struct drm_i915_private *dev_priv)
+
+ val = I915_READ(GEN11_DE_HPD_IMR);
+ val &= ~hotplug_irqs;
++ val |= ~enabled_irqs & hotplug_irqs;
+ I915_WRITE(GEN11_DE_HPD_IMR, val);
+ POSTING_READ(GEN11_DE_HPD_IMR);
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c
+index bddd625ab91b..25691b7cece1 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c
+@@ -1021,7 +1021,8 @@ static int mdp5_init(struct platform_device *pdev, struct drm_device *dev)
+
+ return 0;
+ fail:
+- mdp5_destroy(pdev);
++ if (mdp5_kms)
++ mdp5_destroy(pdev);
+ return ret;
+ }
+
+diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c
+index 771250aed78d..2412d317d992 100644
+--- a/drivers/gpu/drm/qxl/qxl_kms.c
++++ b/drivers/gpu/drm/qxl/qxl_kms.c
+@@ -181,7 +181,7 @@ int qxl_device_init(struct qxl_device *qdev,
+ &(qdev->ram_header->cursor_ring_hdr),
+ sizeof(struct qxl_command),
+ QXL_CURSOR_RING_SIZE,
+- qdev->io_base + QXL_IO_NOTIFY_CMD,
++ qdev->io_base + QXL_IO_NOTIFY_CURSOR,
+ false,
+ &qdev->cursor_event);
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi.h b/drivers/gpu/drm/sun4i/sun4i_hdmi.h
+index b685ee11623d..a13e14dd7746 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi.h
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi.h
+@@ -152,7 +152,7 @@
+ #define SUN4I_HDMI_DDC_CMD_IMPLICIT_WRITE 3
+
+ #define SUN4I_HDMI_DDC_CLK_REG 0x528
+-#define SUN4I_HDMI_DDC_CLK_M(m) (((m) & 0x7) << 3)
++#define SUN4I_HDMI_DDC_CLK_M(m) (((m) & 0xf) << 3)
+ #define SUN4I_HDMI_DDC_CLK_N(n) ((n) & 0x7)
+
+ #define SUN4I_HDMI_DDC_LINE_CTRL_REG 0x540
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_ddc_clk.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_ddc_clk.c
+index e826da34e919..14b6762567fb 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_ddc_clk.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_ddc_clk.c
+@@ -37,7 +37,7 @@ static unsigned long sun4i_ddc_calc_divider(unsigned long rate,
+ unsigned long best_rate = 0;
+ u8 best_m = 0, best_n = 0, _m, _n;
+
+- for (_m = 0; _m < 8; _m++) {
++ for (_m = 0; _m < 16; _m++) {
+ for (_n = 0; _n < 8; _n++) {
+ unsigned long tmp_rate;
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index c1fed1aaecdf..f8026c71e2e4 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1121,6 +1121,9 @@
+ #define USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8882 0x8882
+ #define USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8883 0x8883
+
++#define USB_VENDOR_ID_TRUST 0x145f
++#define USB_DEVICE_ID_TRUST_PANORA_TABLET 0x0212
++
+ #define USB_VENDOR_ID_TURBOX 0x062a
+ #define USB_DEVICE_ID_TURBOX_KEYBOARD 0x0201
+ #define USB_DEVICE_ID_ASUS_MD_5110 0x5110
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index e5beee3e8582..f4bab7004aff 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -168,6 +168,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8882), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8883), HID_QUIRK_NOGET },
++ { HID_USB_DEVICE(USB_VENDOR_ID_TRUST, USB_DEVICE_ID_TRUST_PANORA_TABLET), HID_QUIRK_MULTI_INPUT | HID_QUIRK_HIDINPUT_FORCE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT },
+diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
+index 9ff3371ec385..f1c79f9b3919 100644
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -958,7 +958,8 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ }
+
+ if (dev->vendor == PCI_VENDOR_ID_AMD &&
+- dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) {
++ (dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS ||
++ dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)) {
+ retval = piix4_setup_sb800(dev, id, 1);
+ }
+
+diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
+index fbf91d383b40..c10ae4778d35 100644
+--- a/drivers/i2c/busses/i2c-pxa.c
++++ b/drivers/i2c/busses/i2c-pxa.c
+@@ -315,11 +315,10 @@ static void i2c_pxa_scream_blue_murder(struct pxa_i2c *i2c, const char *why)
+ dev_err(dev, "IBMR: %08x IDBR: %08x ICR: %08x ISR: %08x\n",
+ readl(_IBMR(i2c)), readl(_IDBR(i2c)), readl(_ICR(i2c)),
+ readl(_ISR(i2c)));
+- dev_dbg(dev, "log: ");
++ dev_err(dev, "log:");
+ for (i = 0; i < i2c->irqlogidx; i++)
+- pr_debug("[%08x:%08x] ", i2c->isrlog[i], i2c->icrlog[i]);
+-
+- pr_debug("\n");
++ pr_cont(" [%03x:%05x]", i2c->isrlog[i], i2c->icrlog[i]);
++ pr_cont("\n");
+ }
+
+ #else /* ifdef DEBUG */
+@@ -709,11 +708,9 @@ static inline void i2c_pxa_stop_message(struct pxa_i2c *i2c)
+ {
+ u32 icr;
+
+- /*
+- * Clear the STOP and ACK flags
+- */
++ /* Clear the START, STOP, ACK, TB and MA flags */
+ icr = readl(_ICR(i2c));
+- icr &= ~(ICR_STOP | ICR_ACKNAK);
++ icr &= ~(ICR_START | ICR_STOP | ICR_ACKNAK | ICR_TB | ICR_MA);
+ writel(icr, _ICR(i2c));
+ }
+
+diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
+index fe87d27779d9..074f6f865008 100644
+--- a/drivers/iio/pressure/bmp280-core.c
++++ b/drivers/iio/pressure/bmp280-core.c
+@@ -261,6 +261,8 @@ static u32 bmp280_compensate_humidity(struct bmp280_data *data,
+ + (s32)2097152) * calib->H2 + 8192) >> 14);
+ var -= ((((var >> 15) * (var >> 15)) >> 7) * (s32)calib->H1) >> 4;
+
++ var = clamp_val(var, 0, 419430400);
++
+ return var >> 12;
+ };
+
+@@ -703,7 +705,7 @@ static int bmp180_measure(struct bmp280_data *data, u8 ctrl_meas)
+ unsigned int ctrl;
+
+ if (data->use_eoc)
+- init_completion(&data->done);
++ reinit_completion(&data->done);
+
+ ret = regmap_write(data->regmap, BMP280_REG_CTRL_MEAS, ctrl_meas);
+ if (ret)
+@@ -959,6 +961,9 @@ static int bmp085_fetch_eoc_irq(struct device *dev,
+ "trying to enforce it\n");
+ irq_trig = IRQF_TRIGGER_RISING;
+ }
++
++ init_completion(&data->done);
++
+ ret = devm_request_threaded_irq(dev,
+ irq,
+ bmp085_eoc_irq,
+diff --git a/drivers/infiniband/core/cma_configfs.c b/drivers/infiniband/core/cma_configfs.c
+index eee38b40be99..ce183d054785 100644
+--- a/drivers/infiniband/core/cma_configfs.c
++++ b/drivers/infiniband/core/cma_configfs.c
+@@ -319,8 +319,21 @@ fail:
+ return ERR_PTR(err);
+ }
+
++static void drop_cma_dev(struct config_group *cgroup, struct config_item *item)
++{
++ struct config_group *group =
++ container_of(item, struct config_group, cg_item);
++ struct cma_dev_group *cma_dev_group =
++ container_of(group, struct cma_dev_group, device_group);
++
++ configfs_remove_default_groups(&cma_dev_group->ports_group);
++ configfs_remove_default_groups(&cma_dev_group->device_group);
++ config_item_put(item);
++}
++
+ static struct configfs_group_operations cma_subsys_group_ops = {
+ .make_group = make_cma_dev,
++ .drop_item = drop_cma_dev,
+ };
+
+ static const struct config_item_type cma_subsys_type = {
+diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
+index c13c0ba30f63..af974a257086 100644
+--- a/drivers/infiniband/hw/cxgb4/device.c
++++ b/drivers/infiniband/hw/cxgb4/device.c
+@@ -945,6 +945,7 @@ void c4iw_dealloc(struct uld_ctx *ctx)
+ static void c4iw_remove(struct uld_ctx *ctx)
+ {
+ pr_debug("c4iw_dev %p\n", ctx->dev);
++ debugfs_remove_recursive(ctx->dev->debugfs_root);
+ c4iw_unregister_device(ctx->dev);
+ c4iw_dealloc(ctx);
+ }
+diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
+index 02f36ab72ad4..4c90a007e09d 100644
+--- a/drivers/infiniband/hw/mlx5/devx.c
++++ b/drivers/infiniband/hw/mlx5/devx.c
+@@ -328,6 +328,7 @@ static bool devx_is_obj_modify_cmd(const void *in)
+ case MLX5_CMD_OP_SET_L2_TABLE_ENTRY:
+ case MLX5_CMD_OP_RST2INIT_QP:
+ case MLX5_CMD_OP_INIT2RTR_QP:
++ case MLX5_CMD_OP_INIT2INIT_QP:
+ case MLX5_CMD_OP_RTR2RTS_QP:
+ case MLX5_CMD_OP_RTS2RTS_QP:
+ case MLX5_CMD_OP_SQERR2RTS_QP:
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index bb40bd66a10e..38a8f8d2a908 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -1432,7 +1432,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
+ if (__set_blocks(n1, n1->keys + n2->keys,
+ block_bytes(b->c)) >
+ btree_blocks(new_nodes[i]))
+- goto out_nocoalesce;
++ goto out_unlock_nocoalesce;
+
+ keys = n2->keys;
+ /* Take the key of the node we're getting rid of */
+@@ -1461,7 +1461,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
+
+ if (__bch_keylist_realloc(&keylist,
+ bkey_u64s(&new_nodes[i]->key)))
+- goto out_nocoalesce;
++ goto out_unlock_nocoalesce;
+
+ bch_btree_node_write(new_nodes[i], &cl);
+ bch_keylist_add(&keylist, &new_nodes[i]->key);
+@@ -1507,6 +1507,10 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
+ /* Invalidated our iterator */
+ return -EINTR;
+
++out_unlock_nocoalesce:
++ for (i = 0; i < nodes; i++)
++ mutex_unlock(&new_nodes[i]->write_lock);
++
+ out_nocoalesce:
+ closure_sync(&cl);
+ bch_keylist_free(&keylist);
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 207ca0ad0b59..c1ad84f3414c 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -1868,7 +1868,7 @@ static int multipath_prepare_ioctl(struct dm_target *ti,
+ int r;
+
+ current_pgpath = READ_ONCE(m->current_pgpath);
+- if (!current_pgpath)
++ if (!current_pgpath || !test_bit(MPATHF_QUEUE_IO, &m->flags))
+ current_pgpath = choose_pgpath(m, 0);
+
+ if (current_pgpath) {
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index 53eb21343b11..5c2bbdf67f25 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -1580,7 +1580,7 @@ static struct dm_zone *dmz_get_rnd_zone_for_reclaim(struct dmz_metadata *zmd)
+ return dzone;
+ }
+
+- return ERR_PTR(-EBUSY);
++ return NULL;
+ }
+
+ /*
+@@ -1600,7 +1600,7 @@ static struct dm_zone *dmz_get_seq_zone_for_reclaim(struct dmz_metadata *zmd)
+ return zone;
+ }
+
+- return ERR_PTR(-EBUSY);
++ return NULL;
+ }
+
+ /*
+diff --git a/drivers/md/dm-zoned-reclaim.c b/drivers/md/dm-zoned-reclaim.c
+index 84ac671acd2e..879848aad97a 100644
+--- a/drivers/md/dm-zoned-reclaim.c
++++ b/drivers/md/dm-zoned-reclaim.c
+@@ -348,8 +348,8 @@ static int dmz_do_reclaim(struct dmz_reclaim *zrc)
+
+ /* Get a data zone */
+ dzone = dmz_get_zone_for_reclaim(zmd);
+- if (IS_ERR(dzone))
+- return PTR_ERR(dzone);
++ if (!dzone)
++ return -EBUSY;
+
+ start = jiffies;
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index a6db4fd267aa..a4e7e6c025d9 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1182,6 +1182,8 @@ static int super_90_validate(struct mddev *mddev, struct md_rdev *rdev)
+ mddev->new_layout = mddev->layout;
+ mddev->new_chunk_sectors = mddev->chunk_sectors;
+ }
++ if (mddev->level == 0)
++ mddev->layout = -1;
+
+ if (sb->state & (1<<MD_SB_CLEAN))
+ mddev->recovery_cp = MaxSector;
+@@ -1598,6 +1600,10 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
+ rdev->ppl.sector = rdev->sb_start + rdev->ppl.offset;
+ }
+
++ if ((le32_to_cpu(sb->feature_map) & MD_FEATURE_RAID0_LAYOUT) &&
++ sb->level != 0)
++ return -EINVAL;
++
+ if (!refdev) {
+ ret = 1;
+ } else {
+@@ -1708,6 +1714,10 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
+ mddev->new_chunk_sectors = mddev->chunk_sectors;
+ }
+
++ if (mddev->level == 0 &&
++ !(le32_to_cpu(sb->feature_map) & MD_FEATURE_RAID0_LAYOUT))
++ mddev->layout = -1;
++
+ if (le32_to_cpu(sb->feature_map) & MD_FEATURE_JOURNAL)
+ set_bit(MD_HAS_JOURNAL, &mddev->flags);
+
+@@ -6784,6 +6794,9 @@ static int set_array_info(struct mddev *mddev, mdu_array_info_t *info)
+ mddev->external = 0;
+
+ mddev->layout = info->layout;
++ if (mddev->level == 0)
++ /* Cannot trust RAID0 layout info here */
++ mddev->layout = -1;
+ mddev->chunk_sectors = info->chunk_size >> 9;
+
+ if (mddev->persistent) {
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index efa9df2336da..0272102b207e 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -152,6 +152,9 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+
+ if (conf->nr_strip_zones == 1) {
+ conf->layout = RAID0_ORIG_LAYOUT;
++ } else if (mddev->layout == RAID0_ORIG_LAYOUT ||
++ mddev->layout == RAID0_ALT_MULTIZONE_LAYOUT) {
++ conf->layout = mddev->layout;
+ } else if (default_layout == RAID0_ORIG_LAYOUT ||
+ default_layout == RAID0_ALT_MULTIZONE_LAYOUT) {
+ conf->layout = default_layout;
+diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
+index 22bd6525e09c..933a50049d72 100644
+--- a/drivers/mfd/wm8994-core.c
++++ b/drivers/mfd/wm8994-core.c
+@@ -704,3 +704,4 @@ module_i2c_driver(wm8994_i2c_driver);
+ MODULE_DESCRIPTION("Core support for the WM8994 audio CODEC");
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Mark Brown <broonie@opensource.wolfsonmicro.com>");
++MODULE_SOFTDEP("pre: wm8994_regulator");
+diff --git a/drivers/mtd/nand/raw/ams-delta.c b/drivers/mtd/nand/raw/ams-delta.c
+index 37a3cc21c7bc..acf7971e815d 100644
+--- a/drivers/mtd/nand/raw/ams-delta.c
++++ b/drivers/mtd/nand/raw/ams-delta.c
+@@ -235,7 +235,7 @@ static int ams_delta_init(struct platform_device *pdev)
+ goto out_gpio;
+
+ /* Scan to find existence of the device */
+- err = nand_scan(ams_delta_mtd, 1);
++ err = nand_scan(this, 1);
+ if (err)
+ goto out_mtd;
+
+@@ -264,7 +264,7 @@ static int ams_delta_cleanup(struct platform_device *pdev)
+ void __iomem *io_base = platform_get_drvdata(pdev);
+
+ /* Release resources, unregister device */
+- nand_release(ams_delta_mtd);
++ nand_release(mtd_to_nand(ams_delta_mtd));
+
+ gpio_free_array(_mandatory_gpio, ARRAY_SIZE(_mandatory_gpio));
+ gpio_free(AMS_DELTA_GPIO_PIN_NAND_RB);
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index ea022712edee..ee1c401f131f 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -1694,7 +1694,7 @@ atmel_nand_controller_add_nand(struct atmel_nand_controller *nc,
+
+ nc->caps->ops->nand_init(nc, nand);
+
+- ret = nand_scan(mtd, nand->numcs);
++ ret = nand_scan(chip, nand->numcs);
+ if (ret) {
+ dev_err(nc->dev, "NAND scan failed: %d\n", ret);
+ return ret;
+diff --git a/drivers/mtd/nand/raw/au1550nd.c b/drivers/mtd/nand/raw/au1550nd.c
+index 35f5c84cd331..b45fb36537e7 100644
+--- a/drivers/mtd/nand/raw/au1550nd.c
++++ b/drivers/mtd/nand/raw/au1550nd.c
+@@ -466,7 +466,7 @@ static int au1550nd_probe(struct platform_device *pdev)
+ this->write_buf = (pd->devwidth) ? au_write_buf16 : au_write_buf;
+ this->read_buf = (pd->devwidth) ? au_read_buf16 : au_read_buf;
+
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(this, 1);
+ if (ret) {
+ dev_err(&pdev->dev, "NAND scan failed with %d\n", ret);
+ goto out3;
+@@ -492,7 +492,7 @@ static int au1550nd_remove(struct platform_device *pdev)
+ struct au1550nd_ctx *ctx = platform_get_drvdata(pdev);
+ struct resource *r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+- nand_release(nand_to_mtd(&ctx->chip));
++ nand_release(&ctx->chip);
+ iounmap(ctx->base);
+ release_mem_region(r->start, 0x1000);
+ kfree(ctx);
+diff --git a/drivers/mtd/nand/raw/bcm47xxnflash/main.c b/drivers/mtd/nand/raw/bcm47xxnflash/main.c
+index fb31429b70a9..d79694160845 100644
+--- a/drivers/mtd/nand/raw/bcm47xxnflash/main.c
++++ b/drivers/mtd/nand/raw/bcm47xxnflash/main.c
+@@ -65,7 +65,7 @@ static int bcm47xxnflash_remove(struct platform_device *pdev)
+ {
+ struct bcm47xxnflash *nflash = platform_get_drvdata(pdev);
+
+- nand_release(nand_to_mtd(&nflash->nand_chip));
++ nand_release(&nflash->nand_chip);
+
+ return 0;
+ }
+diff --git a/drivers/mtd/nand/raw/bcm47xxnflash/ops_bcm4706.c b/drivers/mtd/nand/raw/bcm47xxnflash/ops_bcm4706.c
+index 60874de430eb..9b62bc2d25a0 100644
+--- a/drivers/mtd/nand/raw/bcm47xxnflash/ops_bcm4706.c
++++ b/drivers/mtd/nand/raw/bcm47xxnflash/ops_bcm4706.c
+@@ -423,7 +423,7 @@ int bcm47xxnflash_ops_bcm4706_init(struct bcm47xxnflash *b47n)
+ (w4 << 24 | w3 << 18 | w2 << 12 | w1 << 6 | w0));
+
+ /* Scan NAND */
+- err = nand_scan(nand_to_mtd(&b47n->nand_chip), 1);
++ err = nand_scan(&b47n->nand_chip, 1);
+ if (err) {
+ pr_err("Could not scan NAND flash: %d\n", err);
+ goto exit;
+diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+index 8002a2a390e5..bd20f4521036 100644
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -2304,7 +2304,7 @@ static int brcmnand_init_cs(struct brcmnand_host *host, struct device_node *dn)
+ nand_writereg(ctrl, cfg_offs,
+ nand_readreg(ctrl, cfg_offs) & ~CFG_BUS_WIDTH);
+
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(chip, 1);
+ if (ret)
+ return ret;
+
+@@ -2619,7 +2619,7 @@ int brcmnand_remove(struct platform_device *pdev)
+ struct brcmnand_host *host;
+
+ list_for_each_entry(host, &ctrl->host_list, node)
+- nand_release(nand_to_mtd(&host->chip));
++ nand_release(&host->chip);
+
+ clk_disable_unprepare(ctrl->clk);
+
+diff --git a/drivers/mtd/nand/raw/cafe_nand.c b/drivers/mtd/nand/raw/cafe_nand.c
+index 1dbe43adcfe7..3304594177c6 100644
+--- a/drivers/mtd/nand/raw/cafe_nand.c
++++ b/drivers/mtd/nand/raw/cafe_nand.c
+@@ -783,7 +783,7 @@ static int cafe_nand_probe(struct pci_dev *pdev,
+
+ /* Scan to find existence of the device */
+ cafe->nand.dummy_controller.ops = &cafe_nand_controller_ops;
+- err = nand_scan(mtd, 2);
++ err = nand_scan(&cafe->nand, 2);
+ if (err)
+ goto out_irq;
+
+@@ -819,7 +819,7 @@ static void cafe_nand_remove(struct pci_dev *pdev)
+ /* Disable NAND IRQ in global IRQ mask register */
+ cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK);
+ free_irq(pdev->irq, mtd);
+- nand_release(mtd);
++ nand_release(chip);
+ free_rs(cafe->rs);
+ pci_iounmap(pdev, cafe->mmio);
+ dma_free_coherent(&cafe->pdev->dev, 2112, cafe->dmabuf, cafe->dmaaddr);
+diff --git a/drivers/mtd/nand/raw/cmx270_nand.c b/drivers/mtd/nand/raw/cmx270_nand.c
+index b66e254b6802..2eb933a8f99e 100644
+--- a/drivers/mtd/nand/raw/cmx270_nand.c
++++ b/drivers/mtd/nand/raw/cmx270_nand.c
+@@ -193,7 +193,7 @@ static int __init cmx270_init(void)
+ this->write_buf = cmx270_write_buf;
+
+ /* Scan to find existence of the device */
+- ret = nand_scan(cmx270_nand_mtd, 1);
++ ret = nand_scan(this, 1);
+ if (ret) {
+ pr_notice("No NAND device\n");
+ goto err_scan;
+@@ -228,7 +228,7 @@ module_init(cmx270_init);
+ static void __exit cmx270_cleanup(void)
+ {
+ /* Release resources, unregister device */
+- nand_release(cmx270_nand_mtd);
++ nand_release(mtd_to_nand(cmx270_nand_mtd));
+
+ gpio_free(GPIO_NAND_RB);
+ gpio_free(GPIO_NAND_CS);
+diff --git a/drivers/mtd/nand/raw/cs553x_nand.c b/drivers/mtd/nand/raw/cs553x_nand.c
+index beafad62e7d5..d4be416bb2fa 100644
+--- a/drivers/mtd/nand/raw/cs553x_nand.c
++++ b/drivers/mtd/nand/raw/cs553x_nand.c
+@@ -241,7 +241,7 @@ static int __init cs553x_init_one(int cs, int mmio, unsigned long adr)
+ }
+
+ /* Scan to find existence of the device */
+- err = nand_scan(new_mtd, 1);
++ err = nand_scan(this, 1);
+ if (err)
+ goto out_free;
+
+@@ -336,7 +336,7 @@ static void __exit cs553x_cleanup(void)
+ mmio_base = this->IO_ADDR_R;
+
+ /* Release resources, unregister device */
+- nand_release(mtd);
++ nand_release(this);
+ kfree(mtd->name);
+ cs553x_mtd[i] = NULL;
+
+diff --git a/drivers/mtd/nand/raw/davinci_nand.c b/drivers/mtd/nand/raw/davinci_nand.c
+index 40145e206a6b..66d3d5966013 100644
+--- a/drivers/mtd/nand/raw/davinci_nand.c
++++ b/drivers/mtd/nand/raw/davinci_nand.c
+@@ -807,7 +807,7 @@ static int nand_davinci_probe(struct platform_device *pdev)
+
+ /* Scan to find existence of the device(s) */
+ info->chip.dummy_controller.ops = &davinci_nand_controller_ops;
+- ret = nand_scan(mtd, pdata->mask_chipsel ? 2 : 1);
++ ret = nand_scan(&info->chip, pdata->mask_chipsel ? 2 : 1);
+ if (ret < 0) {
+ dev_dbg(&pdev->dev, "no NAND chip(s) found\n");
+ return ret;
+@@ -841,7 +841,7 @@ static int nand_davinci_remove(struct platform_device *pdev)
+ ecc4_busy = false;
+ spin_unlock_irq(&davinci_nand_lock);
+
+- nand_release(nand_to_mtd(&info->chip));
++ nand_release(&info->chip);
+
+ return 0;
+ }
+diff --git a/drivers/mtd/nand/raw/denali.c b/drivers/mtd/nand/raw/denali.c
+index 2242e999a76b..277e84aa6166 100644
+--- a/drivers/mtd/nand/raw/denali.c
++++ b/drivers/mtd/nand/raw/denali.c
+@@ -1384,7 +1384,7 @@ int denali_init(struct denali_nand_info *denali)
+ chip->setup_data_interface = denali_setup_data_interface;
+
+ chip->dummy_controller.ops = &denali_controller_ops;
+- ret = nand_scan(mtd, denali->max_banks);
++ ret = nand_scan(chip, denali->max_banks);
+ if (ret)
+ goto disable_irq;
+
+@@ -1407,9 +1407,7 @@ EXPORT_SYMBOL(denali_init);
+
+ void denali_remove(struct denali_nand_info *denali)
+ {
+- struct mtd_info *mtd = nand_to_mtd(&denali->nand);
+-
+- nand_release(mtd);
++ nand_release(&denali->nand);
+ denali_disable_irq(denali);
+ }
+ EXPORT_SYMBOL(denali_remove);
+diff --git a/drivers/mtd/nand/raw/diskonchip.c b/drivers/mtd/nand/raw/diskonchip.c
+index 3c46188dd6d2..ac3792b6fb33 100644
+--- a/drivers/mtd/nand/raw/diskonchip.c
++++ b/drivers/mtd/nand/raw/diskonchip.c
+@@ -1620,14 +1620,11 @@ static int __init doc_probe(unsigned long physadr)
+ else
+ numchips = doc2001_init(mtd);
+
+- if ((ret = nand_scan(mtd, numchips)) || (ret = doc->late_init(mtd))) {
+- /* DBB note: i believe nand_release is necessary here, as
++ if ((ret = nand_scan(nand, numchips)) || (ret = doc->late_init(mtd))) {
++ /* DBB note: i believe nand_cleanup is necessary here, as
+ buffers may have been allocated in nand_base. Check with
+ Thomas. FIX ME! */
+- /* nand_release will call mtd_device_unregister, but we
+- haven't yet added it. This is handled without incident by
+- mtd_device_unregister, as far as I can tell. */
+- nand_release(mtd);
++ nand_cleanup(nand);
+ goto fail;
+ }
+
+@@ -1662,7 +1659,7 @@ static void release_nanddoc(void)
+ doc = nand_get_controller_data(nand);
+
+ nextmtd = doc->nextdoc;
+- nand_release(mtd);
++ nand_release(nand);
+ iounmap(doc->virtadr);
+ release_mem_region(doc->physadr, DOC_IOREMAP_LEN);
+ free_rs(doc->rs_decoder);
+diff --git a/drivers/mtd/nand/raw/docg4.c b/drivers/mtd/nand/raw/docg4.c
+index 427fcbc1b71c..2d86bc5a886d 100644
+--- a/drivers/mtd/nand/raw/docg4.c
++++ b/drivers/mtd/nand/raw/docg4.c
+@@ -1391,7 +1391,7 @@ static int __init probe_docg4(struct platform_device *pdev)
+ * ->attach_chip callback.
+ */
+ nand->dummy_controller.ops = &docg4_controller_ops;
+- retval = nand_scan(mtd, 0);
++ retval = nand_scan(nand, 0);
+ if (retval)
+ goto free_nand;
+
+@@ -1420,7 +1420,7 @@ unmap:
+ static int __exit cleanup_docg4(struct platform_device *pdev)
+ {
+ struct docg4_priv *doc = platform_get_drvdata(pdev);
+- nand_release(doc->mtd);
++ nand_release(mtd_to_nand(doc->mtd));
+ kfree(mtd_to_nand(doc->mtd));
+ iounmap(doc->virtadr);
+ return 0;
+diff --git a/drivers/mtd/nand/raw/fsl_elbc_nand.c b/drivers/mtd/nand/raw/fsl_elbc_nand.c
+index 55f449b711fd..22bcd64a66c8 100644
+--- a/drivers/mtd/nand/raw/fsl_elbc_nand.c
++++ b/drivers/mtd/nand/raw/fsl_elbc_nand.c
+@@ -915,7 +915,7 @@ static int fsl_elbc_nand_probe(struct platform_device *pdev)
+ goto err;
+
+ priv->chip.controller->ops = &fsl_elbc_controller_ops;
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(&priv->chip, 1);
+ if (ret)
+ goto err;
+
+@@ -942,9 +942,8 @@ static int fsl_elbc_nand_remove(struct platform_device *pdev)
+ {
+ struct fsl_elbc_fcm_ctrl *elbc_fcm_ctrl = fsl_lbc_ctrl_dev->nand;
+ struct fsl_elbc_mtd *priv = dev_get_drvdata(&pdev->dev);
+- struct mtd_info *mtd = nand_to_mtd(&priv->chip);
+
+- nand_release(mtd);
++ nand_release(&priv->chip);
+ fsl_elbc_chip_remove(priv);
+
+ mutex_lock(&fsl_elbc_nand_mutex);
+diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+index 7e7729df7827..70bf8e1552a5 100644
+--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+@@ -1079,7 +1079,7 @@ static int fsl_ifc_nand_probe(struct platform_device *dev)
+ goto err;
+
+ priv->chip.controller->ops = &fsl_ifc_controller_ops;
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(&priv->chip, 1);
+ if (ret)
+ goto err;
+
+@@ -1105,9 +1105,8 @@ err:
+ static int fsl_ifc_nand_remove(struct platform_device *dev)
+ {
+ struct fsl_ifc_mtd *priv = dev_get_drvdata(&dev->dev);
+- struct mtd_info *mtd = nand_to_mtd(&priv->chip);
+
+- nand_release(mtd);
++ nand_release(&priv->chip);
+ fsl_ifc_chip_remove(priv);
+
+ mutex_lock(&fsl_ifc_nand_mutex);
+diff --git a/drivers/mtd/nand/raw/fsl_upm.c b/drivers/mtd/nand/raw/fsl_upm.c
+index a88e2cf66e0f..2763fd3ad512 100644
+--- a/drivers/mtd/nand/raw/fsl_upm.c
++++ b/drivers/mtd/nand/raw/fsl_upm.c
+@@ -191,7 +191,7 @@ static int fun_chip_init(struct fsl_upm_nand *fun,
+ goto err;
+ }
+
+- ret = nand_scan(mtd, fun->mchip_count);
++ ret = nand_scan(&fun->chip, fun->mchip_count);
+ if (ret)
+ goto err;
+
+@@ -326,7 +326,7 @@ static int fun_remove(struct platform_device *ofdev)
+ struct mtd_info *mtd = nand_to_mtd(&fun->chip);
+ int i;
+
+- nand_release(mtd);
++ nand_release(&fun->chip);
+ kfree(mtd->name);
+
+ for (i = 0; i < fun->mchip_count; i++) {
+diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c
+index f418236fa020..25d354e9448e 100644
+--- a/drivers/mtd/nand/raw/fsmc_nand.c
++++ b/drivers/mtd/nand/raw/fsmc_nand.c
+@@ -1125,7 +1125,7 @@ static int __init fsmc_nand_probe(struct platform_device *pdev)
+ * Scan to find existence of the device
+ */
+ nand->dummy_controller.ops = &fsmc_nand_controller_ops;
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(nand, 1);
+ if (ret)
+ goto release_dma_write_chan;
+
+@@ -1161,7 +1161,7 @@ static int fsmc_nand_remove(struct platform_device *pdev)
+ struct fsmc_nand_data *host = platform_get_drvdata(pdev);
+
+ if (host) {
+- nand_release(nand_to_mtd(&host->nand));
++ nand_release(&host->nand);
+
+ if (host->mode == USE_DMA_ACCESS) {
+ dma_release_channel(host->write_dma_chan);
+diff --git a/drivers/mtd/nand/raw/gpio.c b/drivers/mtd/nand/raw/gpio.c
+index 2780af26d9ab..0e7d00faf33c 100644
+--- a/drivers/mtd/nand/raw/gpio.c
++++ b/drivers/mtd/nand/raw/gpio.c
+@@ -194,7 +194,7 @@ static int gpio_nand_remove(struct platform_device *pdev)
+ {
+ struct gpiomtd *gpiomtd = platform_get_drvdata(pdev);
+
+- nand_release(nand_to_mtd(&gpiomtd->nand_chip));
++ nand_release(&gpiomtd->nand_chip);
+
+ /* Enable write protection and disable the chip */
+ if (gpiomtd->nwp && !IS_ERR(gpiomtd->nwp))
+@@ -289,7 +289,7 @@ static int gpio_nand_probe(struct platform_device *pdev)
+ if (gpiomtd->nwp && !IS_ERR(gpiomtd->nwp))
+ gpiod_direction_output(gpiomtd->nwp, 1);
+
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(chip, 1);
+ if (ret)
+ goto err_wp;
+
+diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+index 1c1ebbc82824..fe99d9323d4a 100644
+--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+@@ -1934,7 +1934,7 @@ static int gpmi_nand_init(struct gpmi_nand_data *this)
+ goto err_out;
+
+ chip->dummy_controller.ops = &gpmi_nand_controller_ops;
+- ret = nand_scan(mtd, GPMI_IS_MX6(this) ? 2 : 1);
++ ret = nand_scan(chip, GPMI_IS_MX6(this) ? 2 : 1);
+ if (ret)
+ goto err_out;
+
+@@ -2026,7 +2026,7 @@ static int gpmi_nand_remove(struct platform_device *pdev)
+ {
+ struct gpmi_nand_data *this = platform_get_drvdata(pdev);
+
+- nand_release(nand_to_mtd(&this->nand));
++ nand_release(&this->nand);
+ gpmi_free_dma_buffer(this);
+ release_resources(this);
+ return 0;
+diff --git a/drivers/mtd/nand/raw/hisi504_nand.c b/drivers/mtd/nand/raw/hisi504_nand.c
+index 950dc7789296..6833fc82e6b1 100644
+--- a/drivers/mtd/nand/raw/hisi504_nand.c
++++ b/drivers/mtd/nand/raw/hisi504_nand.c
+@@ -811,7 +811,7 @@ static int hisi_nfc_probe(struct platform_device *pdev)
+ }
+
+ chip->dummy_controller.ops = &hisi_nfc_controller_ops;
+- ret = nand_scan(mtd, max_chips);
++ ret = nand_scan(chip, max_chips);
+ if (ret)
+ return ret;
+
+@@ -828,9 +828,8 @@ static int hisi_nfc_probe(struct platform_device *pdev)
+ static int hisi_nfc_remove(struct platform_device *pdev)
+ {
+ struct hinfc_host *host = platform_get_drvdata(pdev);
+- struct mtd_info *mtd = nand_to_mtd(&host->chip);
+
+- nand_release(mtd);
++ nand_release(&host->chip);
+
+ return 0;
+ }
+diff --git a/drivers/mtd/nand/raw/jz4740_nand.c b/drivers/mtd/nand/raw/jz4740_nand.c
+index a7515452bc59..27603d78b157 100644
+--- a/drivers/mtd/nand/raw/jz4740_nand.c
++++ b/drivers/mtd/nand/raw/jz4740_nand.c
+@@ -331,7 +331,7 @@ static int jz_nand_detect_bank(struct platform_device *pdev,
+
+ if (chipnr == 0) {
+ /* Detect first chip. */
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(chip, 1);
+ if (ret)
+ goto notfound_id;
+
+@@ -507,7 +507,7 @@ static int jz_nand_remove(struct platform_device *pdev)
+ struct jz_nand *nand = platform_get_drvdata(pdev);
+ size_t i;
+
+- nand_release(nand_to_mtd(&nand->chip));
++ nand_release(&nand->chip);
+
+ /* Deassert and disable all chips */
+ writel(0, nand->base + JZ_REG_NAND_CTRL);
+diff --git a/drivers/mtd/nand/raw/jz4780_nand.c b/drivers/mtd/nand/raw/jz4780_nand.c
+index db4fa60bd52a..b072bd5dd7a0 100644
+--- a/drivers/mtd/nand/raw/jz4780_nand.c
++++ b/drivers/mtd/nand/raw/jz4780_nand.c
+@@ -286,13 +286,13 @@ static int jz4780_nand_init_chip(struct platform_device *pdev,
+ nand_set_flash_node(chip, np);
+
+ chip->controller->ops = &jz4780_nand_controller_ops;
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(chip, 1);
+ if (ret)
+ return ret;
+
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret) {
+- nand_release(mtd);
++ nand_release(chip);
+ return ret;
+ }
+
+@@ -307,7 +307,7 @@ static void jz4780_nand_cleanup_chips(struct jz4780_nand_controller *nfc)
+
+ while (!list_empty(&nfc->chips)) {
+ chip = list_first_entry(&nfc->chips, struct jz4780_nand_chip, chip_list);
+- nand_release(nand_to_mtd(&chip->chip));
++ nand_release(&chip->chip);
+ list_del(&chip->chip_list);
+ }
+ }
+diff --git a/drivers/mtd/nand/raw/lpc32xx_mlc.c b/drivers/mtd/nand/raw/lpc32xx_mlc.c
+index e82abada130a..d240b8ff40ca 100644
+--- a/drivers/mtd/nand/raw/lpc32xx_mlc.c
++++ b/drivers/mtd/nand/raw/lpc32xx_mlc.c
+@@ -802,7 +802,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev)
+ * SMALL block or LARGE block.
+ */
+ nand_chip->dummy_controller.ops = &lpc32xx_nand_controller_ops;
+- res = nand_scan(mtd, 1);
++ res = nand_scan(nand_chip, 1);
+ if (res)
+ goto free_irq;
+
+@@ -839,9 +839,8 @@ free_gpio:
+ static int lpc32xx_nand_remove(struct platform_device *pdev)
+ {
+ struct lpc32xx_nand_host *host = platform_get_drvdata(pdev);
+- struct mtd_info *mtd = nand_to_mtd(&host->nand_chip);
+
+- nand_release(mtd);
++ nand_release(&host->nand_chip);
+ free_irq(host->irq, host);
+ if (use_dma)
+ dma_release_channel(host->dma_chan);
+diff --git a/drivers/mtd/nand/raw/lpc32xx_slc.c b/drivers/mtd/nand/raw/lpc32xx_slc.c
+index a4e8b7e75135..607e4bdfae03 100644
+--- a/drivers/mtd/nand/raw/lpc32xx_slc.c
++++ b/drivers/mtd/nand/raw/lpc32xx_slc.c
+@@ -925,7 +925,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev)
+
+ /* Find NAND device */
+ chip->dummy_controller.ops = &lpc32xx_nand_controller_ops;
+- res = nand_scan(mtd, 1);
++ res = nand_scan(chip, 1);
+ if (res)
+ goto release_dma;
+
+@@ -956,9 +956,8 @@ static int lpc32xx_nand_remove(struct platform_device *pdev)
+ {
+ uint32_t tmp;
+ struct lpc32xx_nand_host *host = platform_get_drvdata(pdev);
+- struct mtd_info *mtd = nand_to_mtd(&host->nand_chip);
+
+- nand_release(mtd);
++ nand_release(&host->nand_chip);
+ dma_release_channel(host->dma_chan);
+
+ /* Force CE high */
+diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
+index 7a84a8f05b46..3e542224dd11 100644
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -2551,7 +2551,7 @@ static int marvell_nand_chip_init(struct device *dev, struct marvell_nfc *nfc,
+
+ chip->options |= NAND_BUSWIDTH_AUTO;
+
+- ret = nand_scan(mtd, marvell_nand->nsels);
++ ret = nand_scan(chip, marvell_nand->nsels);
+ if (ret) {
+ dev_err(dev, "could not scan the nand chip\n");
+ return ret;
+@@ -2564,7 +2564,7 @@ static int marvell_nand_chip_init(struct device *dev, struct marvell_nfc *nfc,
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret) {
+ dev_err(dev, "failed to register mtd device: %d\n", ret);
+- nand_release(mtd);
++ nand_release(chip);
+ return ret;
+ }
+
+@@ -2619,7 +2619,7 @@ static void marvell_nand_chips_cleanup(struct marvell_nfc *nfc)
+ struct marvell_nand_chip *entry, *temp;
+
+ list_for_each_entry_safe(entry, temp, &nfc->chips, node) {
+- nand_release(nand_to_mtd(&entry->chip));
++ nand_release(&entry->chip);
+ list_del(&entry->node);
+ }
+ }
+diff --git a/drivers/mtd/nand/raw/mpc5121_nfc.c b/drivers/mtd/nand/raw/mpc5121_nfc.c
+index 6d1740d54e0d..b3d6effb3486 100644
+--- a/drivers/mtd/nand/raw/mpc5121_nfc.c
++++ b/drivers/mtd/nand/raw/mpc5121_nfc.c
+@@ -778,7 +778,7 @@ static int mpc5121_nfc_probe(struct platform_device *op)
+ }
+
+ /* Detect NAND chips */
+- retval = nand_scan(mtd, be32_to_cpup(chips_no));
++ retval = nand_scan(chip, be32_to_cpup(chips_no));
+ if (retval) {
+ dev_err(dev, "NAND Flash not found !\n");
+ goto error;
+@@ -828,7 +828,7 @@ static int mpc5121_nfc_remove(struct platform_device *op)
+ struct device *dev = &op->dev;
+ struct mtd_info *mtd = dev_get_drvdata(dev);
+
+- nand_release(mtd);
++ nand_release(mtd_to_nand(mtd));
+ mpc5121_nfc_free(dev, mtd);
+
+ return 0;
+diff --git a/drivers/mtd/nand/raw/mtk_nand.c b/drivers/mtd/nand/raw/mtk_nand.c
+index ab5a8778c4b2..bb40022e109f 100644
+--- a/drivers/mtd/nand/raw/mtk_nand.c
++++ b/drivers/mtd/nand/raw/mtk_nand.c
+@@ -1382,14 +1382,14 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc,
+
+ mtk_nfc_hw_init(nfc);
+
+- ret = nand_scan(mtd, nsels);
++ ret = nand_scan(nand, nsels);
+ if (ret)
+ return ret;
+
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret) {
+ dev_err(dev, "mtd parse partition error\n");
+- nand_release(mtd);
++ nand_cleanup(nand);
+ return ret;
+ }
+
+@@ -1555,7 +1555,7 @@ static int mtk_nfc_remove(struct platform_device *pdev)
+ while (!list_empty(&nfc->chips)) {
+ chip = list_first_entry(&nfc->chips, struct mtk_nfc_nand_chip,
+ node);
+- nand_release(nand_to_mtd(&chip->nand));
++ nand_release(&chip->nand);
+ list_del(&chip->node);
+ }
+
+diff --git a/drivers/mtd/nand/raw/mxc_nand.c b/drivers/mtd/nand/raw/mxc_nand.c
+index 4c9214dea424..334578d9f4a8 100644
+--- a/drivers/mtd/nand/raw/mxc_nand.c
++++ b/drivers/mtd/nand/raw/mxc_nand.c
+@@ -1900,7 +1900,7 @@ static int mxcnd_probe(struct platform_device *pdev)
+
+ /* Scan the NAND device */
+ this->dummy_controller.ops = &mxcnd_controller_ops;
+- err = nand_scan(mtd, is_imx25_nfc(host) ? 4 : 1);
++ err = nand_scan(this, is_imx25_nfc(host) ? 4 : 1);
+ if (err)
+ goto escan;
+
+@@ -1928,7 +1928,7 @@ static int mxcnd_remove(struct platform_device *pdev)
+ {
+ struct mxc_nand_host *host = platform_get_drvdata(pdev);
+
+- nand_release(nand_to_mtd(&host->nand));
++ nand_release(&host->nand);
+ if (host->clk_act)
+ clk_disable_unprepare(host->clk);
+
+diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
+index d527e448ce19..de3926eaec13 100644
+--- a/drivers/mtd/nand/raw/nand_base.c
++++ b/drivers/mtd/nand/raw/nand_base.c
+@@ -5953,7 +5953,7 @@ static int nand_dt_init(struct nand_chip *chip)
+
+ /**
+ * nand_scan_ident - Scan for the NAND device
+- * @mtd: MTD device structure
++ * @chip: NAND chip object
+ * @maxchips: number of chips to scan for
+ * @table: alternative NAND ID table
+ *
+@@ -5965,11 +5965,11 @@ static int nand_dt_init(struct nand_chip *chip)
+ * prevented dynamic allocations during this phase which was unconvenient and
+ * as been banned for the benefit of the ->init_ecc()/cleanup_ecc() hooks.
+ */
+-static int nand_scan_ident(struct mtd_info *mtd, int maxchips,
++static int nand_scan_ident(struct nand_chip *chip, int maxchips,
+ struct nand_flash_dev *table)
+ {
++ struct mtd_info *mtd = nand_to_mtd(chip);
+ int i, nand_maf_id, nand_dev_id;
+- struct nand_chip *chip = mtd_to_nand(mtd);
+ int ret;
+
+ /* Enforce the right timings for reset/detection */
+@@ -6423,15 +6423,15 @@ static bool nand_ecc_strength_good(struct mtd_info *mtd)
+
+ /**
+ * nand_scan_tail - Scan for the NAND device
+- * @mtd: MTD device structure
++ * @chip: NAND chip object
+ *
+ * This is the second phase of the normal nand_scan() function. It fills out
+ * all the uninitialized function pointers with the defaults and scans for a
+ * bad block table if appropriate.
+ */
+-static int nand_scan_tail(struct mtd_info *mtd)
++static int nand_scan_tail(struct nand_chip *chip)
+ {
+- struct nand_chip *chip = mtd_to_nand(mtd);
++ struct mtd_info *mtd = nand_to_mtd(chip);
+ struct nand_ecc_ctrl *ecc = &chip->ecc;
+ int ret, i;
+
+@@ -6770,7 +6770,7 @@ static void nand_detach(struct nand_chip *chip)
+
+ /**
+ * nand_scan_with_ids - [NAND Interface] Scan for the NAND device
+- * @mtd: MTD device structure
++ * @chip: NAND chip object
+ * @maxchips: number of chips to scan for. @nand_scan_ident() will not be run if
+ * this parameter is zero (useful for specific drivers that must
+ * handle this part of the process themselves, e.g docg4).
+@@ -6780,14 +6780,13 @@ static void nand_detach(struct nand_chip *chip)
+ * The flash ID is read and the mtd/chip structures are filled with the
+ * appropriate values.
+ */
+-int nand_scan_with_ids(struct mtd_info *mtd, int maxchips,
++int nand_scan_with_ids(struct nand_chip *chip, int maxchips,
+ struct nand_flash_dev *ids)
+ {
+- struct nand_chip *chip = mtd_to_nand(mtd);
+ int ret;
+
+ if (maxchips) {
+- ret = nand_scan_ident(mtd, maxchips, ids);
++ ret = nand_scan_ident(chip, maxchips, ids);
+ if (ret)
+ return ret;
+ }
+@@ -6796,7 +6795,7 @@ int nand_scan_with_ids(struct mtd_info *mtd, int maxchips,
+ if (ret)
+ goto cleanup_ident;
+
+- ret = nand_scan_tail(mtd);
++ ret = nand_scan_tail(chip);
+ if (ret)
+ goto detach_chip;
+
+@@ -6847,12 +6846,12 @@ EXPORT_SYMBOL_GPL(nand_cleanup);
+ /**
+ * nand_release - [NAND Interface] Unregister the MTD device and free resources
+ * held by the NAND device
+- * @mtd: MTD device structure
++ * @chip: NAND chip object
+ */
+-void nand_release(struct mtd_info *mtd)
++void nand_release(struct nand_chip *chip)
+ {
+- mtd_device_unregister(mtd);
+- nand_cleanup(mtd_to_nand(mtd));
++ mtd_device_unregister(nand_to_mtd(chip));
++ nand_cleanup(chip);
+ }
+ EXPORT_SYMBOL_GPL(nand_release);
+
+diff --git a/drivers/mtd/nand/raw/nandsim.c b/drivers/mtd/nand/raw/nandsim.c
+index 71ac034aee9c..6e908e4fa8e8 100644
+--- a/drivers/mtd/nand/raw/nandsim.c
++++ b/drivers/mtd/nand/raw/nandsim.c
+@@ -2319,7 +2319,7 @@ static int __init ns_init_module(void)
+ goto error;
+
+ chip->dummy_controller.ops = &ns_controller_ops;
+- retval = nand_scan(nsmtd, 1);
++ retval = nand_scan(chip, 1);
+ if (retval) {
+ NS_ERR("Could not scan NAND Simulator device\n");
+ goto error;
+@@ -2364,7 +2364,7 @@ static int __init ns_init_module(void)
+
+ err_exit:
+ free_nandsim(nand);
+- nand_release(nsmtd);
++ nand_release(chip);
+ for (i = 0;i < ARRAY_SIZE(nand->partitions); ++i)
+ kfree(nand->partitions[i].name);
+ error:
+@@ -2386,7 +2386,7 @@ static void __exit ns_cleanup_module(void)
+ int i;
+
+ free_nandsim(ns); /* Free nandsim private resources */
+- nand_release(nsmtd); /* Unregister driver */
++ nand_release(chip); /* Unregister driver */
+ for (i = 0;i < ARRAY_SIZE(ns->partitions); ++i)
+ kfree(ns->partitions[i].name);
+ kfree(mtd_to_nand(nsmtd)); /* Free other structures */
+diff --git a/drivers/mtd/nand/raw/ndfc.c b/drivers/mtd/nand/raw/ndfc.c
+index 540fa1a0ea24..6e96c633ac29 100644
+--- a/drivers/mtd/nand/raw/ndfc.c
++++ b/drivers/mtd/nand/raw/ndfc.c
+@@ -181,7 +181,7 @@ static int ndfc_chip_init(struct ndfc_controller *ndfc,
+ goto err;
+ }
+
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(chip, 1);
+ if (ret)
+ goto err;
+
+@@ -258,7 +258,7 @@ static int ndfc_remove(struct platform_device *ofdev)
+ struct ndfc_controller *ndfc = dev_get_drvdata(&ofdev->dev);
+ struct mtd_info *mtd = nand_to_mtd(&ndfc->chip);
+
+- nand_release(mtd);
++ nand_release(&ndfc->chip);
+ kfree(mtd->name);
+
+ return 0;
+diff --git a/drivers/mtd/nand/raw/nuc900_nand.c b/drivers/mtd/nand/raw/nuc900_nand.c
+index af5b32c9a791..0c675b6c0b6e 100644
+--- a/drivers/mtd/nand/raw/nuc900_nand.c
++++ b/drivers/mtd/nand/raw/nuc900_nand.c
+@@ -270,7 +270,7 @@ static int nuc900_nand_probe(struct platform_device *pdev)
+
+ nuc900_nand_enable(nuc900_nand);
+
+- if (nand_scan(mtd, 1))
++ if (nand_scan(chip, 1))
+ return -ENXIO;
+
+ mtd_device_register(mtd, partitions, ARRAY_SIZE(partitions));
+@@ -284,7 +284,7 @@ static int nuc900_nand_remove(struct platform_device *pdev)
+ {
+ struct nuc900_nand *nuc900_nand = platform_get_drvdata(pdev);
+
+- nand_release(nand_to_mtd(&nuc900_nand->chip));
++ nand_release(&nuc900_nand->chip);
+ clk_disable(nuc900_nand->clk);
+
+ return 0;
+diff --git a/drivers/mtd/nand/raw/omap2.c b/drivers/mtd/nand/raw/omap2.c
+index b1683d7a7e04..7a4af5f3e3d3 100644
+--- a/drivers/mtd/nand/raw/omap2.c
++++ b/drivers/mtd/nand/raw/omap2.c
+@@ -2254,7 +2254,7 @@ static int omap_nand_probe(struct platform_device *pdev)
+ /* scan NAND device connected to chip controller */
+ nand_chip->options |= info->devsize & NAND_BUSWIDTH_16;
+
+- err = nand_scan(mtd, 1);
++ err = nand_scan(nand_chip, 1);
+ if (err)
+ goto return_error;
+
+@@ -2290,7 +2290,7 @@ static int omap_nand_remove(struct platform_device *pdev)
+ }
+ if (info->dma)
+ dma_release_channel(info->dma);
+- nand_release(mtd);
++ nand_release(nand_chip);
+ return 0;
+ }
+
+diff --git a/drivers/mtd/nand/raw/orion_nand.c b/drivers/mtd/nand/raw/orion_nand.c
+index 52d435285a3f..caffebab6c9b 100644
+--- a/drivers/mtd/nand/raw/orion_nand.c
++++ b/drivers/mtd/nand/raw/orion_nand.c
+@@ -174,14 +174,14 @@ static int __init orion_nand_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(nc, 1);
+ if (ret)
+ goto no_dev;
+
+ mtd->name = "orion_nand";
+ ret = mtd_device_register(mtd, board->parts, board->nr_parts);
+ if (ret) {
+- nand_release(mtd);
++ nand_cleanup(nc);
+ goto no_dev;
+ }
+
+@@ -196,9 +196,8 @@ static int orion_nand_remove(struct platform_device *pdev)
+ {
+ struct orion_nand_info *info = platform_get_drvdata(pdev);
+ struct nand_chip *chip = &info->chip;
+- struct mtd_info *mtd = nand_to_mtd(chip);
+
+- nand_release(mtd);
++ nand_release(chip);
+
+ clk_disable_unprepare(info->clk);
+
+diff --git a/drivers/mtd/nand/raw/oxnas_nand.c b/drivers/mtd/nand/raw/oxnas_nand.c
+index 01b00bb69c1e..d3f274b2e56d 100644
+--- a/drivers/mtd/nand/raw/oxnas_nand.c
++++ b/drivers/mtd/nand/raw/oxnas_nand.c
+@@ -123,7 +123,7 @@ static int oxnas_nand_probe(struct platform_device *pdev)
+ GFP_KERNEL);
+ if (!chip) {
+ err = -ENOMEM;
+- goto err_clk_unprepare;
++ goto err_release_child;
+ }
+
+ chip->controller = &oxnas->base;
+@@ -142,15 +142,13 @@ static int oxnas_nand_probe(struct platform_device *pdev)
+ chip->chip_delay = 30;
+
+ /* Scan to find existence of the device */
+- err = nand_scan(mtd, 1);
++ err = nand_scan(chip, 1);
+ if (err)
+- goto err_clk_unprepare;
++ goto err_release_child;
+
+ err = mtd_device_register(mtd, NULL, 0);
+- if (err) {
+- nand_release(mtd);
+- goto err_clk_unprepare;
+- }
++ if (err)
++ goto err_cleanup_nand;
+
+ oxnas->chips[nchips] = chip;
+ ++nchips;
+@@ -166,6 +164,10 @@ static int oxnas_nand_probe(struct platform_device *pdev)
+
+ return 0;
+
++err_cleanup_nand:
++ nand_cleanup(chip);
++err_release_child:
++ of_node_put(nand_np);
+ err_clk_unprepare:
+ clk_disable_unprepare(oxnas->clk);
+ return err;
+@@ -176,7 +178,7 @@ static int oxnas_nand_remove(struct platform_device *pdev)
+ struct oxnas_nand_ctrl *oxnas = platform_get_drvdata(pdev);
+
+ if (oxnas->chips[0])
+- nand_release(nand_to_mtd(oxnas->chips[0]));
++ nand_release(oxnas->chips[0]);
+
+ clk_disable_unprepare(oxnas->clk);
+
+diff --git a/drivers/mtd/nand/raw/pasemi_nand.c b/drivers/mtd/nand/raw/pasemi_nand.c
+index d69e5bae541e..8713ea770006 100644
+--- a/drivers/mtd/nand/raw/pasemi_nand.c
++++ b/drivers/mtd/nand/raw/pasemi_nand.c
+@@ -156,7 +156,7 @@ static int pasemi_nand_probe(struct platform_device *ofdev)
+ chip->bbt_options = NAND_BBT_USE_FLASH;
+
+ /* Scan to find existence of the device */
+- err = nand_scan(pasemi_nand_mtd, 1);
++ err = nand_scan(chip, 1);
+ if (err)
+ goto out_lpc;
+
+@@ -193,7 +193,7 @@ static int pasemi_nand_remove(struct platform_device *ofdev)
+ chip = mtd_to_nand(pasemi_nand_mtd);
+
+ /* Release resources, unregister device */
+- nand_release(pasemi_nand_mtd);
++ nand_release(chip);
+
+ release_region(lpcctl, 4);
+
+diff --git a/drivers/mtd/nand/raw/plat_nand.c b/drivers/mtd/nand/raw/plat_nand.c
+index 222626df4b96..27365bd8675c 100644
+--- a/drivers/mtd/nand/raw/plat_nand.c
++++ b/drivers/mtd/nand/raw/plat_nand.c
+@@ -84,7 +84,7 @@ static int plat_nand_probe(struct platform_device *pdev)
+ }
+
+ /* Scan to find existence of the device */
+- err = nand_scan(mtd, pdata->chip.nr_chips);
++ err = nand_scan(&data->chip, pdata->chip.nr_chips);
+ if (err)
+ goto out;
+
+@@ -97,7 +97,7 @@ static int plat_nand_probe(struct platform_device *pdev)
+ if (!err)
+ return err;
+
+- nand_release(mtd);
++ nand_cleanup(&data->chip);
+ out:
+ if (pdata->ctrl.remove)
+ pdata->ctrl.remove(pdev);
+@@ -112,7 +112,7 @@ static int plat_nand_remove(struct platform_device *pdev)
+ struct plat_nand_data *data = platform_get_drvdata(pdev);
+ struct platform_nand_data *pdata = dev_get_platdata(&pdev->dev);
+
+- nand_release(nand_to_mtd(&data->chip));
++ nand_release(&data->chip);
+ if (pdata->ctrl.remove)
+ pdata->ctrl.remove(pdev);
+
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index 07d8750313fd..1f9d64aeb863 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -2834,7 +2834,7 @@ static int qcom_nand_host_init_and_register(struct qcom_nand_controller *nandc,
+ /* set up initial status value */
+ host->status = NAND_STATUS_READY | NAND_STATUS_WP;
+
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(chip, 1);
+ if (ret)
+ return ret;
+
+@@ -2999,7 +2999,7 @@ static int qcom_nandc_remove(struct platform_device *pdev)
+ struct qcom_nand_host *host;
+
+ list_for_each_entry(host, &nandc->host_list, node)
+- nand_release(nand_to_mtd(&host->chip));
++ nand_release(&host->chip);
+
+
+ qcom_nandc_unalloc(nandc);
+diff --git a/drivers/mtd/nand/raw/r852.c b/drivers/mtd/nand/raw/r852.c
+index dcdeb0660e5e..bb74a0ac697e 100644
+--- a/drivers/mtd/nand/raw/r852.c
++++ b/drivers/mtd/nand/raw/r852.c
+@@ -656,7 +656,7 @@ static int r852_register_nand_device(struct r852_device *dev)
+ dev->card_registred = 1;
+ return 0;
+ error3:
+- nand_release(mtd);
++ nand_release(dev->chip);
+ error1:
+ /* Force card redetect */
+ dev->card_detected = 0;
+@@ -675,7 +675,7 @@ static void r852_unregister_nand_device(struct r852_device *dev)
+ return;
+
+ device_remove_file(&mtd->dev, &dev_attr_media_type);
+- nand_release(mtd);
++ nand_release(dev->chip);
+ r852_engine_disable(dev);
+ dev->card_registred = 0;
+ }
+diff --git a/drivers/mtd/nand/raw/s3c2410.c b/drivers/mtd/nand/raw/s3c2410.c
+index c21e8892394a..cf045813c160 100644
+--- a/drivers/mtd/nand/raw/s3c2410.c
++++ b/drivers/mtd/nand/raw/s3c2410.c
+@@ -781,7 +781,7 @@ static int s3c24xx_nand_remove(struct platform_device *pdev)
+
+ for (mtdno = 0; mtdno < info->mtd_count; mtdno++, ptr++) {
+ pr_debug("releasing mtd %d (%p)\n", mtdno, ptr);
+- nand_release(nand_to_mtd(&ptr->chip));
++ nand_release(&ptr->chip);
+ }
+ }
+
+@@ -1170,7 +1170,7 @@ static int s3c24xx_nand_probe(struct platform_device *pdev)
+ mtd->dev.parent = &pdev->dev;
+ s3c2410_nand_init_chip(info, nmtd, sets);
+
+- err = nand_scan(mtd, sets ? sets->nr_chips : 1);
++ err = nand_scan(&nmtd->chip, sets ? sets->nr_chips : 1);
+ if (err)
+ goto exit_error;
+
+diff --git a/drivers/mtd/nand/raw/sh_flctl.c b/drivers/mtd/nand/raw/sh_flctl.c
+index 1e7273263c4b..683df1a12989 100644
+--- a/drivers/mtd/nand/raw/sh_flctl.c
++++ b/drivers/mtd/nand/raw/sh_flctl.c
+@@ -1203,7 +1203,7 @@ static int flctl_probe(struct platform_device *pdev)
+ flctl_setup_dma(flctl);
+
+ nand->dummy_controller.ops = &flctl_nand_controller_ops;
+- ret = nand_scan(flctl_mtd, 1);
++ ret = nand_scan(nand, 1);
+ if (ret)
+ goto err_chip;
+
+@@ -1226,7 +1226,7 @@ static int flctl_remove(struct platform_device *pdev)
+ struct sh_flctl *flctl = platform_get_drvdata(pdev);
+
+ flctl_release_dma(flctl);
+- nand_release(nand_to_mtd(&flctl->chip));
++ nand_release(&flctl->chip);
+ pm_runtime_disable(&pdev->dev);
+
+ return 0;
+diff --git a/drivers/mtd/nand/raw/sharpsl.c b/drivers/mtd/nand/raw/sharpsl.c
+index fc171b17a39b..4544753e6a1b 100644
+--- a/drivers/mtd/nand/raw/sharpsl.c
++++ b/drivers/mtd/nand/raw/sharpsl.c
+@@ -171,7 +171,7 @@ static int sharpsl_nand_probe(struct platform_device *pdev)
+ this->ecc.correct = nand_correct_data;
+
+ /* Scan to find existence of the device */
+- err = nand_scan(mtd, 1);
++ err = nand_scan(this, 1);
+ if (err)
+ goto err_scan;
+
+@@ -187,7 +187,7 @@ static int sharpsl_nand_probe(struct platform_device *pdev)
+ return 0;
+
+ err_add:
+- nand_release(mtd);
++ nand_cleanup(this);
+
+ err_scan:
+ iounmap(sharpsl->io);
+@@ -205,7 +205,7 @@ static int sharpsl_nand_remove(struct platform_device *pdev)
+ struct sharpsl_nand *sharpsl = platform_get_drvdata(pdev);
+
+ /* Release resources, unregister device */
+- nand_release(nand_to_mtd(&sharpsl->chip));
++ nand_release(&sharpsl->chip);
+
+ iounmap(sharpsl->io);
+
+diff --git a/drivers/mtd/nand/raw/sm_common.c b/drivers/mtd/nand/raw/sm_common.c
+index 73aafe8c3ef3..02ac6e9b2d16 100644
+--- a/drivers/mtd/nand/raw/sm_common.c
++++ b/drivers/mtd/nand/raw/sm_common.c
+@@ -195,7 +195,7 @@ int sm_register_device(struct mtd_info *mtd, int smartmedia)
+ /* Scan for card properties */
+ chip->dummy_controller.ops = &sm_controller_ops;
+ flash_ids = smartmedia ? nand_smartmedia_flash_ids : nand_xd_flash_ids;
+- ret = nand_scan_with_ids(mtd, 1, flash_ids);
++ ret = nand_scan_with_ids(chip, 1, flash_ids);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/mtd/nand/raw/socrates_nand.c b/drivers/mtd/nand/raw/socrates_nand.c
+index 9824a9923583..274b3521a1dc 100644
+--- a/drivers/mtd/nand/raw/socrates_nand.c
++++ b/drivers/mtd/nand/raw/socrates_nand.c
+@@ -185,7 +185,7 @@ static int socrates_nand_probe(struct platform_device *ofdev)
+
+ dev_set_drvdata(&ofdev->dev, host);
+
+- res = nand_scan(mtd, 1);
++ res = nand_scan(nand_chip, 1);
+ if (res)
+ goto out;
+
+@@ -193,7 +193,7 @@ static int socrates_nand_probe(struct platform_device *ofdev)
+ if (!res)
+ return res;
+
+- nand_release(mtd);
++ nand_cleanup(nand_chip);
+
+ out:
+ iounmap(host->io_base);
+@@ -206,9 +206,8 @@ out:
+ static int socrates_nand_remove(struct platform_device *ofdev)
+ {
+ struct socrates_nand_host *host = dev_get_drvdata(&ofdev->dev);
+- struct mtd_info *mtd = nand_to_mtd(&host->nand_chip);
+
+- nand_release(mtd);
++ nand_release(&host->nand_chip);
+
+ iounmap(host->io_base);
+
+diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
+index 5b5f4d25a3e1..5b8502fd50cb 100644
+--- a/drivers/mtd/nand/raw/sunxi_nand.c
++++ b/drivers/mtd/nand/raw/sunxi_nand.c
+@@ -1940,14 +1940,14 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc,
+ mtd = nand_to_mtd(nand);
+ mtd->dev.parent = dev;
+
+- ret = nand_scan(mtd, nsels);
++ ret = nand_scan(nand, nsels);
+ if (ret)
+ return ret;
+
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret) {
+ dev_err(dev, "failed to register mtd device: %d\n", ret);
+- nand_release(mtd);
++ nand_release(nand);
+ return ret;
+ }
+
+@@ -1986,7 +1986,7 @@ static void sunxi_nand_chips_cleanup(struct sunxi_nfc *nfc)
+ while (!list_empty(&nfc->chips)) {
+ chip = list_first_entry(&nfc->chips, struct sunxi_nand_chip,
+ node);
+- nand_release(nand_to_mtd(&chip->nand));
++ nand_release(&chip->nand);
+ sunxi_nand_ecc_cleanup(&chip->nand.ecc);
+ list_del(&chip->node);
+ }
+diff --git a/drivers/mtd/nand/raw/tango_nand.c b/drivers/mtd/nand/raw/tango_nand.c
+index 72698691727d..1061eb60ee60 100644
+--- a/drivers/mtd/nand/raw/tango_nand.c
++++ b/drivers/mtd/nand/raw/tango_nand.c
+@@ -588,7 +588,7 @@ static int chip_init(struct device *dev, struct device_node *np)
+ mtd_set_ooblayout(mtd, &tango_nand_ooblayout_ops);
+ mtd->dev.parent = dev;
+
+- err = nand_scan(mtd, 1);
++ err = nand_scan(chip, 1);
+ if (err)
+ return err;
+
+@@ -617,7 +617,7 @@ static int tango_nand_remove(struct platform_device *pdev)
+
+ for (cs = 0; cs < MAX_CS; ++cs) {
+ if (nfc->chips[cs])
+- nand_release(nand_to_mtd(&nfc->chips[cs]->nand_chip));
++ nand_release(&nfc->chips[cs]->nand_chip);
+ }
+
+ return 0;
+diff --git a/drivers/mtd/nand/raw/tegra_nand.c b/drivers/mtd/nand/raw/tegra_nand.c
+index 79da1efc88d1..5dcee20e2a8c 100644
+--- a/drivers/mtd/nand/raw/tegra_nand.c
++++ b/drivers/mtd/nand/raw/tegra_nand.c
+@@ -1119,7 +1119,7 @@ static int tegra_nand_chips_init(struct device *dev,
+ chip->select_chip = tegra_nand_select_chip;
+ chip->setup_data_interface = tegra_nand_setup_data_interface;
+
+- ret = nand_scan(mtd, 1);
++ ret = nand_scan(chip, 1);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/mtd/nand/raw/tmio_nand.c b/drivers/mtd/nand/raw/tmio_nand.c
+index dcaa924502de..2a9a966ff2b9 100644
+--- a/drivers/mtd/nand/raw/tmio_nand.c
++++ b/drivers/mtd/nand/raw/tmio_nand.c
+@@ -436,7 +436,7 @@ static int tmio_probe(struct platform_device *dev)
+ nand_chip->waitfunc = tmio_nand_wait;
+
+ /* Scan to find existence of the device */
+- retval = nand_scan(mtd, 1);
++ retval = nand_scan(nand_chip, 1);
+ if (retval)
+ goto err_irq;
+
+@@ -449,7 +449,7 @@ static int tmio_probe(struct platform_device *dev)
+ if (!retval)
+ return retval;
+
+- nand_release(mtd);
++ nand_cleanup(nand_chip);
+
+ err_irq:
+ tmio_hw_stop(dev, tmio);
+@@ -460,7 +460,7 @@ static int tmio_remove(struct platform_device *dev)
+ {
+ struct tmio_nand *tmio = platform_get_drvdata(dev);
+
+- nand_release(nand_to_mtd(&tmio->chip));
++ nand_release(&tmio->chip);
+ tmio_hw_stop(dev, tmio);
+ return 0;
+ }
+diff --git a/drivers/mtd/nand/raw/txx9ndfmc.c b/drivers/mtd/nand/raw/txx9ndfmc.c
+index 4d61a14fcb65..f722aae2b244 100644
+--- a/drivers/mtd/nand/raw/txx9ndfmc.c
++++ b/drivers/mtd/nand/raw/txx9ndfmc.c
+@@ -359,7 +359,7 @@ static int __init txx9ndfmc_probe(struct platform_device *dev)
+ if (plat->wide_mask & (1 << i))
+ chip->options |= NAND_BUSWIDTH_16;
+
+- if (nand_scan(mtd, 1)) {
++ if (nand_scan(chip, 1)) {
+ kfree(txx9_priv->mtdname);
+ kfree(txx9_priv);
+ continue;
+@@ -390,7 +390,7 @@ static int __exit txx9ndfmc_remove(struct platform_device *dev)
+ chip = mtd_to_nand(mtd);
+ txx9_priv = nand_get_controller_data(chip);
+
+- nand_release(mtd);
++ nand_release(chip);
+ kfree(txx9_priv->mtdname);
+ kfree(txx9_priv);
+ }
+diff --git a/drivers/mtd/nand/raw/vf610_nfc.c b/drivers/mtd/nand/raw/vf610_nfc.c
+index 6f6dcbf9095b..a73213c835a5 100644
+--- a/drivers/mtd/nand/raw/vf610_nfc.c
++++ b/drivers/mtd/nand/raw/vf610_nfc.c
+@@ -892,7 +892,7 @@ static int vf610_nfc_probe(struct platform_device *pdev)
+
+ /* Scan the NAND chip */
+ chip->dummy_controller.ops = &vf610_nfc_controller_ops;
+- err = nand_scan(mtd, 1);
++ err = nand_scan(chip, 1);
+ if (err)
+ goto err_disable_clk;
+
+@@ -916,7 +916,7 @@ static int vf610_nfc_remove(struct platform_device *pdev)
+ struct mtd_info *mtd = platform_get_drvdata(pdev);
+ struct vf610_nfc *nfc = mtd_to_nfc(mtd);
+
+- nand_release(mtd);
++ nand_release(mtd_to_nand(mtd));
+ clk_disable_unprepare(nfc->clk);
+ return 0;
+ }
+diff --git a/drivers/mtd/nand/raw/xway_nand.c b/drivers/mtd/nand/raw/xway_nand.c
+index 9926b4e3d69d..bfa43fdc3c54 100644
+--- a/drivers/mtd/nand/raw/xway_nand.c
++++ b/drivers/mtd/nand/raw/xway_nand.c
+@@ -205,13 +205,13 @@ static int xway_nand_probe(struct platform_device *pdev)
+ | cs_flag, EBU_NAND_CON);
+
+ /* Scan to find existence of the device */
+- err = nand_scan(mtd, 1);
++ err = nand_scan(&data->chip, 1);
+ if (err)
+ return err;
+
+ err = mtd_device_register(mtd, NULL, 0);
+ if (err)
+- nand_release(mtd);
++ nand_cleanup(&data->chip);
+
+ return err;
+ }
+@@ -223,7 +223,7 @@ static int xway_nand_remove(struct platform_device *pdev)
+ {
+ struct xway_nand_data *data = platform_get_drvdata(pdev);
+
+- nand_release(nand_to_mtd(&data->chip));
++ nand_release(&data->chip);
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+index 0957e735cdc4..cf4c92bdd9b8 100644
+--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
++++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+@@ -235,6 +235,11 @@ static void octeon_mgmt_rx_fill_ring(struct net_device *netdev)
+
+ /* Put it in the ring. */
+ p->rx_ring[p->rx_next_fill] = re.d64;
++ /* Make sure there is no reorder of filling the ring and ringing
++ * the bell
++ */
++ wmb();
++
+ dma_sync_single_for_device(p->dev, p->rx_ring_handle,
+ ring_size_to_bytes(OCTEON_MGMT_RX_RING_SIZE),
+ DMA_BIDIRECTIONAL);
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 6683409fbd4a..4b21ae27a9fd 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2796,7 +2796,7 @@ static int dpaa_eth_probe(struct platform_device *pdev)
+ }
+
+ /* Do this here, so we can be verbose early */
+- SET_NETDEV_DEV(net_dev, dev->parent);
++ SET_NETDEV_DEV(net_dev, dev);
+ dev_set_drvdata(dev, net_dev);
+
+ priv = netdev_priv(net_dev);
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 589a5296da4b..7216825e049c 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -6308,11 +6308,17 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)
+ struct net_device *netdev = pci_get_drvdata(pdev);
+ struct e1000_adapter *adapter = netdev_priv(netdev);
+ struct e1000_hw *hw = &adapter->hw;
+- u32 ctrl, ctrl_ext, rctl, status;
+- /* Runtime suspend should only enable wakeup for link changes */
+- u32 wufc = runtime ? E1000_WUFC_LNKC : adapter->wol;
++ u32 ctrl, ctrl_ext, rctl, status, wufc;
+ int retval = 0;
+
++ /* Runtime suspend should only enable wakeup for link changes */
++ if (runtime)
++ wufc = E1000_WUFC_LNKC;
++ else if (device_may_wakeup(&pdev->dev))
++ wufc = adapter->wol;
++ else
++ wufc = 0;
++
+ status = er32(STATUS);
+ if (status & E1000_STATUS_LU)
+ wufc &= ~E1000_WUFC_LNKC;
+@@ -6369,7 +6375,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)
+ if (adapter->hw.phy.type == e1000_phy_igp_3) {
+ e1000e_igp3_phy_powerdown_workaround_ich8lan(&adapter->hw);
+ } else if (hw->mac.type >= e1000_pch_lpt) {
+- if (!(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC)))
++ if (wufc && !(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC)))
+ /* ULP does not support wake from unicast, multicast
+ * or broadcast.
+ */
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 36444de701cd..817c290b78cd 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -911,9 +911,10 @@ static netdev_tx_t geneve_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (geneve->collect_md) {
+ info = skb_tunnel_info(skb);
+ if (unlikely(!info || !(info->mode & IP_TUNNEL_INFO_TX))) {
+- err = -EINVAL;
+ netdev_dbg(dev, "no tunnel metadata\n");
+- goto tx_error;
++ dev_kfree_skb(skb);
++ dev->stats.tx_dropped++;
++ return NETDEV_TX_OK;
+ }
+ } else {
+ info = &geneve->info;
+@@ -930,7 +931,7 @@ static netdev_tx_t geneve_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ if (likely(!err))
+ return NETDEV_TX_OK;
+-tx_error:
++
+ dev_kfree_skb(skb);
+
+ if (err == -ELOOP)
+diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
+index ba9df430fca6..fdab49872587 100644
+--- a/drivers/net/hamradio/yam.c
++++ b/drivers/net/hamradio/yam.c
+@@ -1148,6 +1148,7 @@ static int __init yam_init_driver(void)
+ err = register_netdev(dev);
+ if (err) {
+ printk(KERN_WARNING "yam: cannot register net device %s\n", dev->name);
++ free_netdev(dev);
+ goto error;
+ }
+ yam_devs[i] = dev;
+diff --git a/drivers/ntb/ntb.c b/drivers/ntb/ntb.c
+index 2581ab724c34..f8f75a504a58 100644
+--- a/drivers/ntb/ntb.c
++++ b/drivers/ntb/ntb.c
+@@ -214,10 +214,8 @@ int ntb_default_port_number(struct ntb_dev *ntb)
+ case NTB_TOPO_B2B_DSD:
+ return NTB_PORT_SEC_DSD;
+ default:
+- break;
++ return 0;
+ }
+-
+- return -EINVAL;
+ }
+ EXPORT_SYMBOL(ntb_default_port_number);
+
+@@ -240,10 +238,8 @@ int ntb_default_peer_port_number(struct ntb_dev *ntb, int pidx)
+ case NTB_TOPO_B2B_DSD:
+ return NTB_PORT_PRI_USD;
+ default:
+- break;
++ return 0;
+ }
+-
+- return -EINVAL;
+ }
+ EXPORT_SYMBOL(ntb_default_peer_port_number);
+
+@@ -315,4 +311,3 @@ static void __exit ntb_driver_exit(void)
+ bus_unregister(&ntb_bus);
+ }
+ module_exit(ntb_driver_exit);
+-
+diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
+index 80508da3c8b5..ad5d3919435c 100644
+--- a/drivers/ntb/test/ntb_perf.c
++++ b/drivers/ntb/test/ntb_perf.c
+@@ -158,6 +158,8 @@ struct perf_peer {
+ /* NTB connection setup service */
+ struct work_struct service;
+ unsigned long sts;
++
++ struct completion init_comp;
+ };
+ #define to_peer_service(__work) \
+ container_of(__work, struct perf_peer, service)
+@@ -549,6 +551,7 @@ static int perf_setup_outbuf(struct perf_peer *peer)
+
+ /* Initialization is finally done */
+ set_bit(PERF_STS_DONE, &peer->sts);
++ complete_all(&peer->init_comp);
+
+ return 0;
+ }
+@@ -559,7 +562,7 @@ static void perf_free_inbuf(struct perf_peer *peer)
+ return;
+
+ (void)ntb_mw_clear_trans(peer->perf->ntb, peer->pidx, peer->gidx);
+- dma_free_coherent(&peer->perf->ntb->dev, peer->inbuf_size,
++ dma_free_coherent(&peer->perf->ntb->pdev->dev, peer->inbuf_size,
+ peer->inbuf, peer->inbuf_xlat);
+ peer->inbuf = NULL;
+ }
+@@ -588,8 +591,9 @@ static int perf_setup_inbuf(struct perf_peer *peer)
+
+ perf_free_inbuf(peer);
+
+- peer->inbuf = dma_alloc_coherent(&perf->ntb->dev, peer->inbuf_size,
+- &peer->inbuf_xlat, GFP_KERNEL);
++ peer->inbuf = dma_alloc_coherent(&perf->ntb->pdev->dev,
++ peer->inbuf_size, &peer->inbuf_xlat,
++ GFP_KERNEL);
+ if (!peer->inbuf) {
+ dev_err(&perf->ntb->dev, "Failed to alloc inbuf of %pa\n",
+ &peer->inbuf_size);
+@@ -639,6 +643,7 @@ static void perf_service_work(struct work_struct *work)
+ perf_setup_outbuf(peer);
+
+ if (test_and_clear_bit(PERF_CMD_CLEAR, &peer->sts)) {
++ init_completion(&peer->init_comp);
+ clear_bit(PERF_STS_DONE, &peer->sts);
+ if (test_bit(0, &peer->perf->busy_flag) &&
+ peer == peer->perf->test_peer) {
+@@ -655,7 +660,7 @@ static int perf_init_service(struct perf_ctx *perf)
+ {
+ u64 mask;
+
+- if (ntb_peer_mw_count(perf->ntb) < perf->pcnt + 1) {
++ if (ntb_peer_mw_count(perf->ntb) < perf->pcnt) {
+ dev_err(&perf->ntb->dev, "Not enough memory windows\n");
+ return -EINVAL;
+ }
+@@ -1046,8 +1051,9 @@ static int perf_submit_test(struct perf_peer *peer)
+ struct perf_thread *pthr;
+ int tidx, ret;
+
+- if (!test_bit(PERF_STS_DONE, &peer->sts))
+- return -ENOLINK;
++ ret = wait_for_completion_interruptible(&peer->init_comp);
++ if (ret < 0)
++ return ret;
+
+ if (test_and_set_bit_lock(0, &perf->busy_flag))
+ return -EBUSY;
+@@ -1413,10 +1419,21 @@ static int perf_init_peers(struct perf_ctx *perf)
+ peer->gidx = pidx;
+ }
+ INIT_WORK(&peer->service, perf_service_work);
++ init_completion(&peer->init_comp);
+ }
+ if (perf->gidx == -1)
+ perf->gidx = pidx;
+
++ /*
++ * Hardware with only two ports may not have unique port
++ * numbers. In this case, the gidxs should all be zero.
++ */
++ if (perf->pcnt == 1 && ntb_port_number(perf->ntb) == 0 &&
++ ntb_peer_port_number(perf->ntb, 0) == 0) {
++ perf->gidx = 0;
++ perf->peers[0].gidx = 0;
++ }
++
+ for (pidx = 0; pidx < perf->pcnt; pidx++) {
+ ret = perf_setup_peer_mw(&perf->peers[pidx]);
+ if (ret)
+@@ -1512,4 +1529,3 @@ static void __exit perf_exit(void)
+ destroy_workqueue(perf_wq);
+ }
+ module_exit(perf_exit);
+-
+diff --git a/drivers/ntb/test/ntb_pingpong.c b/drivers/ntb/test/ntb_pingpong.c
+index 65865e460ab8..18d00eec7b02 100644
+--- a/drivers/ntb/test/ntb_pingpong.c
++++ b/drivers/ntb/test/ntb_pingpong.c
+@@ -121,15 +121,14 @@ static int pp_find_next_peer(struct pp_ctx *pp)
+ link = ntb_link_is_up(pp->ntb, NULL, NULL);
+
+ /* Find next available peer */
+- if (link & pp->nmask) {
++ if (link & pp->nmask)
+ pidx = __ffs64(link & pp->nmask);
+- out_db = BIT_ULL(pidx + 1);
+- } else if (link & pp->pmask) {
++ else if (link & pp->pmask)
+ pidx = __ffs64(link & pp->pmask);
+- out_db = BIT_ULL(pidx);
+- } else {
++ else
+ return -ENODEV;
+- }
++
++ out_db = BIT_ULL(ntb_peer_port_number(pp->ntb, pidx));
+
+ spin_lock(&pp->lock);
+ pp->out_pidx = pidx;
+@@ -303,7 +302,7 @@ static void pp_init_flds(struct pp_ctx *pp)
+ break;
+ }
+
+- pp->in_db = BIT_ULL(pidx);
++ pp->in_db = BIT_ULL(lport);
+ pp->pmask = GENMASK_ULL(pidx, 0) >> 1;
+ pp->nmask = GENMASK_ULL(pcnt - 1, pidx);
+
+@@ -435,4 +434,3 @@ static void __exit pp_exit(void)
+ debugfs_remove_recursive(pp_dbgfs_topdir);
+ }
+ module_exit(pp_exit);
+-
+diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
+index d592c0ffbd19..311d6ab8d016 100644
+--- a/drivers/ntb/test/ntb_tool.c
++++ b/drivers/ntb/test/ntb_tool.c
+@@ -504,7 +504,7 @@ static ssize_t tool_peer_link_read(struct file *filep, char __user *ubuf,
+ buf[1] = '\n';
+ buf[2] = '\0';
+
+- return simple_read_from_buffer(ubuf, size, offp, buf, 3);
++ return simple_read_from_buffer(ubuf, size, offp, buf, 2);
+ }
+
+ static TOOL_FOPS_RDWR(tool_peer_link_fops,
+@@ -590,7 +590,7 @@ static int tool_setup_mw(struct tool_ctx *tc, int pidx, int widx,
+ inmw->size = min_t(resource_size_t, req_size, size);
+ inmw->size = round_up(inmw->size, addr_align);
+ inmw->size = round_up(inmw->size, size_align);
+- inmw->mm_base = dma_alloc_coherent(&tc->ntb->dev, inmw->size,
++ inmw->mm_base = dma_alloc_coherent(&tc->ntb->pdev->dev, inmw->size,
+ &inmw->dma_base, GFP_KERNEL);
+ if (!inmw->mm_base)
+ return -ENOMEM;
+@@ -612,7 +612,7 @@ static int tool_setup_mw(struct tool_ctx *tc, int pidx, int widx,
+ return 0;
+
+ err_free_dma:
+- dma_free_coherent(&tc->ntb->dev, inmw->size, inmw->mm_base,
++ dma_free_coherent(&tc->ntb->pdev->dev, inmw->size, inmw->mm_base,
+ inmw->dma_base);
+ inmw->mm_base = NULL;
+ inmw->dma_base = 0;
+@@ -629,7 +629,7 @@ static void tool_free_mw(struct tool_ctx *tc, int pidx, int widx)
+
+ if (inmw->mm_base != NULL) {
+ ntb_mw_clear_trans(tc->ntb, pidx, widx);
+- dma_free_coherent(&tc->ntb->dev, inmw->size,
++ dma_free_coherent(&tc->ntb->pdev->dev, inmw->size,
+ inmw->mm_base, inmw->dma_base);
+ }
+
+@@ -1690,4 +1690,3 @@ static void __exit tool_exit(void)
+ debugfs_remove_recursive(tool_dbgfs_topdir);
+ }
+ module_exit(tool_exit);
+-
+diff --git a/drivers/of/kobj.c b/drivers/of/kobj.c
+index c72eef988041..a32e60b024b8 100644
+--- a/drivers/of/kobj.c
++++ b/drivers/of/kobj.c
+@@ -134,8 +134,6 @@ int __of_attach_node_sysfs(struct device_node *np)
+ if (!name)
+ return -ENOMEM;
+
+- of_node_get(np);
+-
+ rc = kobject_add(&np->kobj, parent, "%s", name);
+ kfree(name);
+ if (rc)
+@@ -144,6 +142,7 @@ int __of_attach_node_sysfs(struct device_node *np)
+ for_each_property_of_node(np, pp)
+ __of_add_property_sysfs(np, pp);
+
++ of_node_get(np);
+ return 0;
+ }
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
+index 6d4ef0101ef6..be62f654c8eb 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -285,6 +285,8 @@ int dw_pcie_allocate_domains(struct pcie_port *pp)
+ return -ENOMEM;
+ }
+
++ irq_domain_update_bus_token(pp->irq_domain, DOMAIN_BUS_NEXUS);
++
+ pp->msi_domain = pci_msi_create_irq_domain(fwnode,
+ &dw_pcie_msi_domain_info,
+ pp->irq_domain);
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index 6b4555ff2548..0235b6e7dcd1 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -321,10 +321,6 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
+
+ advk_pcie_wait_for_link(pcie);
+
+- reg = PCIE_CORE_LINK_L0S_ENTRY |
+- (1 << PCIE_CORE_LINK_WIDTH_SHIFT);
+- advk_writel(pcie, reg, PCIE_CORE_LINK_CTRL_STAT_REG);
+-
+ reg = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG);
+ reg |= PCIE_CORE_CMD_MEM_ACCESS_EN |
+ PCIE_CORE_CMD_IO_ACCESS_EN |
+diff --git a/drivers/pci/controller/pci-v3-semi.c b/drivers/pci/controller/pci-v3-semi.c
+index d219404bad92..9a86bb7448ac 100644
+--- a/drivers/pci/controller/pci-v3-semi.c
++++ b/drivers/pci/controller/pci-v3-semi.c
+@@ -743,7 +743,7 @@ static int v3_pci_probe(struct platform_device *pdev)
+ int ret;
+ LIST_HEAD(res);
+
+- host = pci_alloc_host_bridge(sizeof(*v3));
++ host = devm_pci_alloc_host_bridge(dev, sizeof(*v3));
+ if (!host)
+ return -ENOMEM;
+
+diff --git a/drivers/pci/controller/pcie-rcar.c b/drivers/pci/controller/pcie-rcar.c
+index 333ab6092f17..00296c5eacb9 100644
+--- a/drivers/pci/controller/pcie-rcar.c
++++ b/drivers/pci/controller/pcie-rcar.c
+@@ -335,11 +335,12 @@ static struct pci_ops rcar_pcie_ops = {
+ };
+
+ static void rcar_pcie_setup_window(int win, struct rcar_pcie *pcie,
+- struct resource *res)
++ struct resource_entry *window)
+ {
+ /* Setup PCIe address space mappings for each resource */
+ resource_size_t size;
+ resource_size_t res_start;
++ struct resource *res = window->res;
+ u32 mask;
+
+ rcar_pci_write_reg(pcie, 0x00000000, PCIEPTCTLR(win));
+@@ -353,9 +354,9 @@ static void rcar_pcie_setup_window(int win, struct rcar_pcie *pcie,
+ rcar_pci_write_reg(pcie, mask << 7, PCIEPAMR(win));
+
+ if (res->flags & IORESOURCE_IO)
+- res_start = pci_pio_to_address(res->start);
++ res_start = pci_pio_to_address(res->start) - window->offset;
+ else
+- res_start = res->start;
++ res_start = res->start - window->offset;
+
+ rcar_pci_write_reg(pcie, upper_32_bits(res_start), PCIEPAUR(win));
+ rcar_pci_write_reg(pcie, lower_32_bits(res_start) & ~0x7F,
+@@ -384,7 +385,7 @@ static int rcar_pcie_setup(struct list_head *resource, struct rcar_pcie *pci)
+ switch (resource_type(res)) {
+ case IORESOURCE_IO:
+ case IORESOURCE_MEM:
+- rcar_pcie_setup_window(i, pci, res);
++ rcar_pcie_setup_window(i, pci, win);
+ i++;
+ break;
+ case IORESOURCE_BUS:
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index b52885020c85..c3ac7f094a39 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -617,9 +617,11 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+ if (!membar2)
+ return -ENOMEM;
+ offset[0] = vmd->dev->resource[VMD_MEMBAR1].start -
+- readq(membar2 + MB2_SHADOW_OFFSET);
++ (readq(membar2 + MB2_SHADOW_OFFSET) &
++ PCI_BASE_ADDRESS_MEM_MASK);
+ offset[1] = vmd->dev->resource[VMD_MEMBAR2].start -
+- readq(membar2 + MB2_SHADOW_OFFSET + 8);
++ (readq(membar2 + MB2_SHADOW_OFFSET + 8) &
++ PCI_BASE_ADDRESS_MEM_MASK);
+ pci_iounmap(vmd->dev, membar2);
+ }
+ }
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index db2efa219028..6e50f84733b7 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -633,16 +633,6 @@ static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist)
+
+ /* Setup initial capable state. Will be updated later */
+ link->aspm_capable = link->aspm_support;
+- /*
+- * If the downstream component has pci bridge function, don't
+- * do ASPM for now.
+- */
+- list_for_each_entry(child, &linkbus->devices, bus_list) {
+- if (pci_pcie_type(child) == PCI_EXP_TYPE_PCI_BRIDGE) {
+- link->aspm_disable = ASPM_STATE_ALL;
+- break;
+- }
+- }
+
+ /* Get and check endpoint acceptable latencies */
+ list_for_each_entry(child, &linkbus->devices, bus_list) {
+diff --git a/drivers/pci/pcie/ptm.c b/drivers/pci/pcie/ptm.c
+index 9361f3aa26ab..357a454cafa0 100644
+--- a/drivers/pci/pcie/ptm.c
++++ b/drivers/pci/pcie/ptm.c
+@@ -39,10 +39,6 @@ void pci_ptm_init(struct pci_dev *dev)
+ if (!pci_is_pcie(dev))
+ return;
+
+- pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_PTM);
+- if (!pos)
+- return;
+-
+ /*
+ * Enable PTM only on interior devices (root ports, switch ports,
+ * etc.) on the assumption that it causes no link traffic until an
+@@ -52,6 +48,23 @@ void pci_ptm_init(struct pci_dev *dev)
+ pci_pcie_type(dev) == PCI_EXP_TYPE_RC_END))
+ return;
+
++ /*
++ * Switch Downstream Ports are not permitted to have a PTM
++ * capability; their PTM behavior is controlled by the Upstream
++ * Port (PCIe r5.0, sec 7.9.16).
++ */
++ ups = pci_upstream_bridge(dev);
++ if (pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM &&
++ ups && ups->ptm_enabled) {
++ dev->ptm_granularity = ups->ptm_granularity;
++ dev->ptm_enabled = 1;
++ return;
++ }
++
++ pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_PTM);
++ if (!pos)
++ return;
++
+ pci_read_config_dword(dev, pos + PCI_PTM_CAP, &cap);
+ local_clock = (cap & PCI_PTM_GRANULARITY_MASK) >> 8;
+
+@@ -61,7 +74,6 @@ void pci_ptm_init(struct pci_dev *dev)
+ * the spec recommendation (PCIe r3.1, sec 7.32.3), select the
+ * furthest upstream Time Source as the PTM Root.
+ */
+- ups = pci_upstream_bridge(dev);
+ if (ups && ups->ptm_enabled) {
+ ctrl = PCI_PTM_CTRL_ENABLE;
+ if (ups->ptm_granularity == 0)
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 243b65f3c282..cbc0d8da7483 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -818,9 +818,10 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
+ goto free;
+
+ err = device_register(&bridge->dev);
+- if (err)
++ if (err) {
+ put_device(&bridge->dev);
+-
++ goto free;
++ }
+ bus->bridge = get_device(&bridge->dev);
+ device_enable_async_suspend(bus->bridge);
+ pci_set_bus_of_node(bus);
+diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
+index d8ca40a97693..d21fa04fa44d 100644
+--- a/drivers/pci/setup-res.c
++++ b/drivers/pci/setup-res.c
+@@ -439,10 +439,11 @@ int pci_resize_resource(struct pci_dev *dev, int resno, int size)
+ res->end = res->start + pci_rebar_size_to_bytes(size) - 1;
+
+ /* Check if the new config works by trying to assign everything. */
+- ret = pci_reassign_bridge_resources(dev->bus->self, res->flags);
+- if (ret)
+- goto error_resize;
+-
++ if (dev->bus->self) {
++ ret = pci_reassign_bridge_resources(dev->bus->self, res->flags);
++ if (ret)
++ goto error_resize;
++ }
+ return 0;
+
+ error_resize:
+diff --git a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
+index 0bde5d919b2e..4aff69cbb903 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
+@@ -38,7 +38,7 @@
+ /* L3C has 8-counters */
+ #define L3C_NR_COUNTERS 0x8
+
+-#define L3C_PERF_CTRL_EN 0x20000
++#define L3C_PERF_CTRL_EN 0x10000
+ #define L3C_EVTYPE_NONE 0xff
+
+ /*
+diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
+index b04edc22dad7..90d414dd792c 100644
+--- a/drivers/pinctrl/freescale/pinctrl-imx.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx.c
+@@ -662,16 +662,6 @@ static int imx_pinctrl_probe_dt(struct platform_device *pdev,
+ return 0;
+ }
+
+-/*
+- * imx_free_resources() - free memory used by this driver
+- * @info: info driver instance
+- */
+-static void imx_free_resources(struct imx_pinctrl *ipctl)
+-{
+- if (ipctl->pctl)
+- pinctrl_unregister(ipctl->pctl);
+-}
+-
+ int imx_pinctrl_probe(struct platform_device *pdev,
+ const struct imx_pinctrl_soc_info *info)
+ {
+@@ -762,21 +752,16 @@ int imx_pinctrl_probe(struct platform_device *pdev,
+ &ipctl->pctl);
+ if (ret) {
+ dev_err(&pdev->dev, "could not register IMX pinctrl driver\n");
+- goto free;
++ return ret;
+ }
+
+ ret = imx_pinctrl_probe_dt(pdev, ipctl);
+ if (ret) {
+ dev_err(&pdev->dev, "fail to probe dt properties\n");
+- goto free;
++ return ret;
+ }
+
+ dev_info(&pdev->dev, "initialized IMX pinctrl driver\n");
+
+ return pinctrl_enable(ipctl->pctl);
+-
+-free:
+- imx_free_resources(ipctl);
+-
+- return ret;
+ }
+diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+index deb7870b3d1a..961c24e0cc8f 100644
+--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+@@ -638,7 +638,6 @@ int imx1_pinctrl_core_probe(struct platform_device *pdev,
+
+ ret = of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev);
+ if (ret) {
+- pinctrl_unregister(ipctl->pctl);
+ dev_err(&pdev->dev, "Failed to populate subdevices\n");
+ return ret;
+ }
+diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
+index 8d83817935da..005df24f5b3f 100644
+--- a/drivers/pinctrl/pinctrl-rockchip.c
++++ b/drivers/pinctrl/pinctrl-rockchip.c
+@@ -507,8 +507,8 @@ static int rockchip_dt_node_to_map(struct pinctrl_dev *pctldev,
+ }
+
+ map_num += grp->npins;
+- new_map = devm_kcalloc(pctldev->dev, map_num, sizeof(*new_map),
+- GFP_KERNEL);
++
++ new_map = kcalloc(map_num, sizeof(*new_map), GFP_KERNEL);
+ if (!new_map)
+ return -ENOMEM;
+
+@@ -518,7 +518,7 @@ static int rockchip_dt_node_to_map(struct pinctrl_dev *pctldev,
+ /* create mux map */
+ parent = of_get_parent(np);
+ if (!parent) {
+- devm_kfree(pctldev->dev, new_map);
++ kfree(new_map);
+ return -EINVAL;
+ }
+ new_map[0].type = PIN_MAP_TYPE_MUX_GROUP;
+@@ -545,6 +545,7 @@ static int rockchip_dt_node_to_map(struct pinctrl_dev *pctldev,
+ static void rockchip_dt_free_map(struct pinctrl_dev *pctldev,
+ struct pinctrl_map *map, unsigned num_maps)
+ {
++ kfree(map);
+ }
+
+ static const struct pinctrl_ops rockchip_pctrl_ops = {
+diff --git a/drivers/pinctrl/pinctrl-rza1.c b/drivers/pinctrl/pinctrl-rza1.c
+index f76edf664539..021c19eaf12d 100644
+--- a/drivers/pinctrl/pinctrl-rza1.c
++++ b/drivers/pinctrl/pinctrl-rza1.c
+@@ -421,7 +421,7 @@ static const struct rza1_bidir_entry rza1l_bidir_entries[RZA1_NPORTS] = {
+ };
+
+ static const struct rza1_swio_entry rza1l_swio_entries[] = {
+- [0] = { ARRAY_SIZE(rza1h_swio_pins), rza1h_swio_pins },
++ [0] = { ARRAY_SIZE(rza1l_swio_pins), rza1l_swio_pins },
+ };
+
+ /* RZ/A1L (r7s72102x) pinmux flags table */
+diff --git a/drivers/power/supply/Kconfig b/drivers/power/supply/Kconfig
+index ff6dab0bf0dd..76c699b5abda 100644
+--- a/drivers/power/supply/Kconfig
++++ b/drivers/power/supply/Kconfig
+@@ -555,7 +555,7 @@ config CHARGER_BQ24257
+ tristate "TI BQ24250/24251/24257 battery charger driver"
+ depends on I2C
+ depends on GPIOLIB || COMPILE_TEST
+- depends on REGMAP_I2C
++ select REGMAP_I2C
+ help
+ Say Y to enable support for the TI BQ24250, BQ24251, and BQ24257 battery
+ chargers.
+diff --git a/drivers/power/supply/lp8788-charger.c b/drivers/power/supply/lp8788-charger.c
+index 0f3432795f3c..b8f7dac7ac3f 100644
+--- a/drivers/power/supply/lp8788-charger.c
++++ b/drivers/power/supply/lp8788-charger.c
+@@ -600,27 +600,14 @@ static void lp8788_setup_adc_channel(struct device *dev,
+ return;
+
+ /* ADC channel for battery voltage */
+- chan = iio_channel_get(dev, pdata->adc_vbatt);
++ chan = devm_iio_channel_get(dev, pdata->adc_vbatt);
+ pchg->chan[LP8788_VBATT] = IS_ERR(chan) ? NULL : chan;
+
+ /* ADC channel for battery temperature */
+- chan = iio_channel_get(dev, pdata->adc_batt_temp);
++ chan = devm_iio_channel_get(dev, pdata->adc_batt_temp);
+ pchg->chan[LP8788_BATT_TEMP] = IS_ERR(chan) ? NULL : chan;
+ }
+
+-static void lp8788_release_adc_channel(struct lp8788_charger *pchg)
+-{
+- int i;
+-
+- for (i = 0; i < LP8788_NUM_CHG_ADC; i++) {
+- if (!pchg->chan[i])
+- continue;
+-
+- iio_channel_release(pchg->chan[i]);
+- pchg->chan[i] = NULL;
+- }
+-}
+-
+ static ssize_t lp8788_show_charger_status(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+@@ -747,7 +734,6 @@ static int lp8788_charger_remove(struct platform_device *pdev)
+ lp8788_irq_unregister(pdev, pchg);
+ sysfs_remove_group(&pdev->dev.kobj, &lp8788_attr_group);
+ lp8788_psy_unregister(pchg);
+- lp8788_release_adc_channel(pchg);
+
+ return 0;
+ }
+diff --git a/drivers/power/supply/smb347-charger.c b/drivers/power/supply/smb347-charger.c
+index 072c5189bd6d..0655dbdc7000 100644
+--- a/drivers/power/supply/smb347-charger.c
++++ b/drivers/power/supply/smb347-charger.c
+@@ -1141,6 +1141,7 @@ static bool smb347_volatile_reg(struct device *dev, unsigned int reg)
+ switch (reg) {
+ case IRQSTAT_A:
+ case IRQSTAT_C:
++ case IRQSTAT_D:
+ case IRQSTAT_E:
+ case IRQSTAT_F:
+ case STAT_A:
+diff --git a/drivers/pwm/pwm-img.c b/drivers/pwm/pwm-img.c
+index 815f5333bb8f..da72b2866e88 100644
+--- a/drivers/pwm/pwm-img.c
++++ b/drivers/pwm/pwm-img.c
+@@ -132,8 +132,10 @@ static int img_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ duty = DIV_ROUND_UP(timebase * duty_ns, period_ns);
+
+ ret = pm_runtime_get_sync(chip->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(chip->dev);
+ return ret;
++ }
+
+ val = img_pwm_readl(pwm_chip, PWM_CTRL_CFG);
+ val &= ~(PWM_CTRL_CFG_DIV_MASK << PWM_CTRL_CFG_DIV_SHIFT(pwm->hwpwm));
+@@ -334,8 +336,10 @@ static int img_pwm_remove(struct platform_device *pdev)
+ int ret;
+
+ ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put(&pdev->dev);
+ return ret;
++ }
+
+ for (i = 0; i < pwm_chip->chip.npwm; i++) {
+ val = img_pwm_readl(pwm_chip, PWM_CTRL_CFG);
+diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
+index d5ff272fde34..e48069db1703 100644
+--- a/drivers/remoteproc/remoteproc_core.c
++++ b/drivers/remoteproc/remoteproc_core.c
+@@ -1598,6 +1598,7 @@ struct rproc *rproc_alloc(struct device *dev, const char *name,
+ rproc->dev.type = &rproc_type;
+ rproc->dev.class = &rproc_class;
+ rproc->dev.driver_data = rproc;
++ idr_init(&rproc->notifyids);
+
+ /* Assign a unique device index and name */
+ rproc->index = ida_simple_get(&rproc_dev_index, 0, 0, GFP_KERNEL);
+@@ -1622,8 +1623,6 @@ struct rproc *rproc_alloc(struct device *dev, const char *name,
+
+ mutex_init(&rproc->lock);
+
+- idr_init(&rproc->notifyids);
+-
+ INIT_LIST_HEAD(&rproc->carveouts);
+ INIT_LIST_HEAD(&rproc->mappings);
+ INIT_LIST_HEAD(&rproc->traces);
+diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
+index a6f7c2986b94..ed60b8d4efe6 100644
+--- a/drivers/s390/cio/qdio.h
++++ b/drivers/s390/cio/qdio.h
+@@ -377,7 +377,6 @@ static inline int multicast_outbound(struct qdio_q *q)
+ extern u64 last_ai_time;
+
+ /* prototypes for thin interrupt */
+-void qdio_setup_thinint(struct qdio_irq *irq_ptr);
+ int qdio_establish_thinint(struct qdio_irq *irq_ptr);
+ void qdio_shutdown_thinint(struct qdio_irq *irq_ptr);
+ void tiqdio_add_input_queues(struct qdio_irq *irq_ptr);
+diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
+index d040c4920ee7..b8955e20f246 100644
+--- a/drivers/s390/cio/qdio_setup.c
++++ b/drivers/s390/cio/qdio_setup.c
+@@ -480,7 +480,6 @@ int qdio_setup_irq(struct qdio_initialize *init_data)
+ setup_queues(irq_ptr, init_data);
+
+ setup_qib(irq_ptr, init_data);
+- qdio_setup_thinint(irq_ptr);
+ set_impl_params(irq_ptr, init_data->qib_param_field_format,
+ init_data->qib_param_field,
+ init_data->input_slib_elements,
+diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
+index 6628e0c9e70e..e6b22a58150a 100644
+--- a/drivers/s390/cio/qdio_thinint.c
++++ b/drivers/s390/cio/qdio_thinint.c
+@@ -267,17 +267,19 @@ int __init tiqdio_register_thinints(void)
+
+ int qdio_establish_thinint(struct qdio_irq *irq_ptr)
+ {
++ int rc;
++
+ if (!is_thinint_irq(irq_ptr))
+ return 0;
+- return set_subchannel_ind(irq_ptr, 0);
+-}
+
+-void qdio_setup_thinint(struct qdio_irq *irq_ptr)
+-{
+- if (!is_thinint_irq(irq_ptr))
+- return;
+ irq_ptr->dsci = get_indicator();
+ DBF_HEX(&irq_ptr->dsci, sizeof(void *));
++
++ rc = set_subchannel_ind(irq_ptr, 0);
++ if (rc)
++ put_indicator(irq_ptr->dsci);
++
++ return rc;
+ }
+
+ void qdio_shutdown_thinint(struct qdio_irq *irq_ptr)
+diff --git a/drivers/scsi/arm/acornscsi.c b/drivers/scsi/arm/acornscsi.c
+index 421fe869a11e..ef9d907f2df5 100644
+--- a/drivers/scsi/arm/acornscsi.c
++++ b/drivers/scsi/arm/acornscsi.c
+@@ -2914,8 +2914,10 @@ static int acornscsi_probe(struct expansion_card *ec, const struct ecard_id *id)
+
+ ashost->base = ecardm_iomap(ec, ECARD_RES_MEMC, 0, 0);
+ ashost->fast = ecardm_iomap(ec, ECARD_RES_IOCFAST, 0, 0);
+- if (!ashost->base || !ashost->fast)
++ if (!ashost->base || !ashost->fast) {
++ ret = -ENOMEM;
+ goto out_put;
++ }
+
+ host->irq = ec->irq;
+ ashost->host = host;
+diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
+index b99ded6b9e0b..036508a4bd5a 100644
+--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
+@@ -429,6 +429,8 @@ static int ibmvscsi_reenable_crq_queue(struct crq_queue *queue,
+ int rc = 0;
+ struct vio_dev *vdev = to_vio_dev(hostdata->dev);
+
++ set_adapter_info(hostdata);
++
+ /* Re-enable the CRQ */
+ do {
+ if (rc)
+diff --git a/drivers/scsi/iscsi_boot_sysfs.c b/drivers/scsi/iscsi_boot_sysfs.c
+index d453667612f8..15d64f96e623 100644
+--- a/drivers/scsi/iscsi_boot_sysfs.c
++++ b/drivers/scsi/iscsi_boot_sysfs.c
+@@ -360,7 +360,7 @@ iscsi_boot_create_kobj(struct iscsi_boot_kset *boot_kset,
+ boot_kobj->kobj.kset = boot_kset->kset;
+ if (kobject_init_and_add(&boot_kobj->kobj, &iscsi_boot_ktype,
+ NULL, name, index)) {
+- kfree(boot_kobj);
++ kobject_put(&boot_kobj->kobj);
+ return NULL;
+ }
+ boot_kobj->data = data;
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 7398350b08b4..9032793c405e 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -7949,6 +7949,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
+ spin_lock_irq(shost->host_lock);
+ if (ndlp->nlp_flag & NLP_IN_DEV_LOSS) {
+ spin_unlock_irq(shost->host_lock);
++ if (newnode)
++ lpfc_nlp_put(ndlp);
+ goto dropit;
+ }
+ spin_unlock_irq(shost->host_lock);
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 2c556c7fcf0d..9fbe20e38ad0 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -4284,7 +4284,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
+ }
+
+ kfree(ioc->hpr_lookup);
++ ioc->hpr_lookup = NULL;
+ kfree(ioc->internal_lookup);
++ ioc->internal_lookup = NULL;
+ if (ioc->chain_lookup) {
+ for (i = 0; i < ioc->scsiio_depth; i++) {
+ for (j = ioc->chains_per_prp_buffer;
+diff --git a/drivers/scsi/qedf/qedf.h b/drivers/scsi/qedf/qedf.h
+index 2c78d8fb9122..fc06be4fd10c 100644
+--- a/drivers/scsi/qedf/qedf.h
++++ b/drivers/scsi/qedf/qedf.h
+@@ -335,6 +335,7 @@ struct qedf_ctx {
+ #define QEDF_GRCDUMP_CAPTURE 4
+ #define QEDF_IN_RECOVERY 5
+ #define QEDF_DBG_STOP_IO 6
++#define QEDF_PROBING 8
+ unsigned long flags; /* Miscellaneous state flags */
+ int fipvlan_retries;
+ u8 num_queues;
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index cd61905ca2f5..b253523217b8 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -2961,7 +2961,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
+ {
+ int rc = -EINVAL;
+ struct fc_lport *lport;
+- struct qedf_ctx *qedf;
++ struct qedf_ctx *qedf = NULL;
+ struct Scsi_Host *host;
+ bool is_vf = false;
+ struct qed_ll2_params params;
+@@ -2989,6 +2989,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
+
+ /* Initialize qedf_ctx */
+ qedf = lport_priv(lport);
++ set_bit(QEDF_PROBING, &qedf->flags);
+ qedf->lport = lport;
+ qedf->ctlr.lp = lport;
+ qedf->pdev = pdev;
+@@ -3011,9 +3012,12 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
+ } else {
+ /* Init pointers during recovery */
+ qedf = pci_get_drvdata(pdev);
++ set_bit(QEDF_PROBING, &qedf->flags);
+ lport = qedf->lport;
+ }
+
++ QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC, "Probe started.\n");
++
+ host = lport->host;
+
+ /* Allocate mempool for qedf_io_work structs */
+@@ -3312,6 +3316,10 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
+ else
+ fc_fabric_login(lport);
+
++ QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC, "Probe done.\n");
++
++ clear_bit(QEDF_PROBING, &qedf->flags);
++
+ /* All good */
+ return 0;
+
+@@ -3337,6 +3345,11 @@ err2:
+ err1:
+ scsi_host_put(lport->host);
+ err0:
++ if (qedf) {
++ QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC, "Probe done.\n");
++
++ clear_bit(QEDF_PROBING, &qedf->flags);
++ }
+ return rc;
+ }
+
+@@ -3484,11 +3497,25 @@ void qedf_get_protocol_tlv_data(void *dev, void *data)
+ {
+ struct qedf_ctx *qedf = dev;
+ struct qed_mfw_tlv_fcoe *fcoe = data;
+- struct fc_lport *lport = qedf->lport;
+- struct Scsi_Host *host = lport->host;
+- struct fc_host_attrs *fc_host = shost_to_fc_host(host);
++ struct fc_lport *lport;
++ struct Scsi_Host *host;
++ struct fc_host_attrs *fc_host;
+ struct fc_host_statistics *hst;
+
++ if (!qedf) {
++ QEDF_ERR(NULL, "qedf is null.\n");
++ return;
++ }
++
++ if (test_bit(QEDF_PROBING, &qedf->flags)) {
++ QEDF_ERR(&qedf->dbg_ctx, "Function is still probing.\n");
++ return;
++ }
++
++ lport = qedf->lport;
++ host = lport->host;
++ fc_host = shost_to_fc_host(host);
++
+ /* Force a refresh of the fc_host stats including offload stats */
+ hst = qedf_fc_get_host_stats(host);
+
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index 1b7049dce169..751941a3ed30 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -1000,7 +1000,8 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
+ if (qedi_ep->state == EP_STATE_OFLDCONN_START)
+ goto ep_exit_recover;
+
+- flush_work(&qedi_ep->offload_work);
++ if (qedi_ep->state != EP_STATE_OFLDCONN_NONE)
++ flush_work(&qedi_ep->offload_work);
+
+ if (qedi_ep->conn) {
+ qedi_conn = qedi_ep->conn;
+@@ -1217,6 +1218,10 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
+ }
+
+ iscsi_cid = (u32)path_data->handle;
++ if (iscsi_cid >= qedi->max_active_conns) {
++ ret = -EINVAL;
++ goto set_path_exit;
++ }
+ qedi_ep = qedi->ep_tbl[iscsi_cid];
+ QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
+ "iscsi_cid=0x%x, qedi_ep=%p\n", iscsi_cid, qedi_ep);
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 59b8681842be..b56cf790587e 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -6085,6 +6085,7 @@ qla2x00_do_dpc(void *data)
+
+ if (do_reset && !(test_and_set_bit(ABORT_ISP_ACTIVE,
+ &base_vha->dpc_flags))) {
++ base_vha->flags.online = 1;
+ ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
+ "ISP abort scheduled.\n");
+ if (ha->isp_ops->abort_isp(base_vha)) {
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 654e1af7f542..b51dba35bcf7 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -960,6 +960,7 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+
+ atomic_set(&tpg->lport_tpg_enabled, 0);
+ qlt_stop_phase1(vha->vha_tgt.qla_tgt);
++ qlt_stop_phase2(vha->vha_tgt.qla_tgt);
+ }
+
+ return count;
+@@ -1122,6 +1123,7 @@ static ssize_t tcm_qla2xxx_npiv_tpg_enable_store(struct config_item *item,
+
+ atomic_set(&tpg->lport_tpg_enabled, 0);
+ qlt_stop_phase1(vha->vha_tgt.qla_tgt);
++ qlt_stop_phase2(vha->vha_tgt.qla_tgt);
+ }
+
+ return count;
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index d0389b20574d..5be3d6b7991b 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -748,7 +748,7 @@ static int sr_probe(struct device *dev)
+ cd->cdi.disk = disk;
+
+ if (register_cdrom(&cd->cdi))
+- goto fail_put;
++ goto fail_minor;
+
+ /*
+ * Initialize block layer runtime PM stuffs before the
+@@ -766,6 +766,10 @@ static int sr_probe(struct device *dev)
+
+ return 0;
+
++fail_minor:
++ spin_lock(&sr_index_lock);
++ clear_bit(minor, sr_index_bits);
++ spin_unlock(&sr_index_lock);
+ fail_put:
+ put_disk(disk);
+ fail_free:
+diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c
+index 75ee5906b966..21e3ff590ec9 100644
+--- a/drivers/scsi/ufs/ufs-qcom.c
++++ b/drivers/scsi/ufs/ufs-qcom.c
+@@ -1635,11 +1635,11 @@ static void ufs_qcom_dump_dbg_regs(struct ufs_hba *hba)
+
+ /* sleep a bit intermittently as we are dumping too much data */
+ ufs_qcom_print_hw_debug_reg_all(hba, NULL, ufs_qcom_dump_regs_wrapper);
+- usleep_range(1000, 1100);
++ udelay(1000);
+ ufs_qcom_testbus_read(hba);
+- usleep_range(1000, 1100);
++ udelay(1000);
+ ufs_qcom_print_unipro_testbus(hba);
+- usleep_range(1000, 1100);
++ udelay(1000);
+ }
+
+ /**
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 803d67b3a166..bd21c9cdf818 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -5122,7 +5122,6 @@ static int ufshcd_bkops_ctrl(struct ufs_hba *hba,
+ err = ufshcd_enable_auto_bkops(hba);
+ else
+ err = ufshcd_disable_auto_bkops(hba);
+- hba->urgent_bkops_lvl = curr_status;
+ out:
+ return err;
+ }
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 9221ba7b7863..f40ac8dcb081 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1350,7 +1350,6 @@ static int of_qcom_slim_ngd_register(struct device *parent,
+ ngd->pdev->driver_override = QCOM_SLIM_NGD_DRV_NAME;
+ ngd->pdev->dev.of_node = node;
+ ctrl->ngd = ngd;
+- platform_set_drvdata(ngd->pdev, ctrl);
+
+ platform_device_add(ngd->pdev);
+ ngd->base = ctrl->base + ngd->id * data->offset +
+@@ -1365,12 +1364,13 @@ static int of_qcom_slim_ngd_register(struct device *parent,
+
+ static int qcom_slim_ngd_probe(struct platform_device *pdev)
+ {
+- struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+ struct device *dev = &pdev->dev;
++ struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev->parent);
+ int ret;
+
+ ctrl->ctrl.dev = dev;
+
++ platform_set_drvdata(pdev, ctrl);
+ pm_runtime_use_autosuspend(dev);
+ pm_runtime_set_autosuspend_delay(dev, QCOM_SLIM_NGD_AUTOSUSPEND);
+ pm_runtime_set_suspended(dev);
+diff --git a/drivers/staging/gasket/gasket_sysfs.c b/drivers/staging/gasket/gasket_sysfs.c
+index fc45f0d13e87..5986c67bc7ec 100644
+--- a/drivers/staging/gasket/gasket_sysfs.c
++++ b/drivers/staging/gasket/gasket_sysfs.c
+@@ -343,6 +343,7 @@ void gasket_sysfs_put_attr(struct device *device,
+
+ dev_err(device, "Unable to put unknown attribute: %s\n",
+ attr->attr.attr.name);
++ put_mapping(mapping);
+ }
+ EXPORT_SYMBOL(gasket_sysfs_put_attr);
+
+@@ -376,6 +377,7 @@ ssize_t gasket_sysfs_register_store(struct device *device,
+ gasket_dev = mapping->gasket_dev;
+ if (!gasket_dev) {
+ dev_err(device, "Device driver may have been removed\n");
++ put_mapping(mapping);
+ return 0;
+ }
+
+diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
+index 40680eaf3974..db06cd544af5 100644
+--- a/drivers/staging/greybus/light.c
++++ b/drivers/staging/greybus/light.c
+@@ -1028,7 +1028,8 @@ static int gb_lights_light_config(struct gb_lights *glights, u8 id)
+
+ light->channels_count = conf.channel_count;
+ light->name = kstrndup(conf.name, NAMES_MAX, GFP_KERNEL);
+-
++ if (!light->name)
++ return -ENOMEM;
+ light->channels = kcalloc(light->channels_count,
+ sizeof(struct gb_channel), GFP_KERNEL);
+ if (!light->channels)
+diff --git a/drivers/staging/mt29f_spinand/mt29f_spinand.c b/drivers/staging/mt29f_spinand/mt29f_spinand.c
+index 448478451c4c..b50788b2d1d9 100644
+--- a/drivers/staging/mt29f_spinand/mt29f_spinand.c
++++ b/drivers/staging/mt29f_spinand/mt29f_spinand.c
+@@ -934,7 +934,7 @@ static int spinand_probe(struct spi_device *spi_nand)
+ mtd_set_ooblayout(mtd, &spinand_oob_64_ops);
+ #endif
+
+- if (nand_scan(mtd, 1))
++ if (nand_scan(chip, 1))
+ return -ENXIO;
+
+ return mtd_device_register(mtd, NULL, 0);
+diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
+index 846d7d243994..3972e215128e 100644
+--- a/drivers/staging/sm750fb/sm750.c
++++ b/drivers/staging/sm750fb/sm750.c
+@@ -897,6 +897,7 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
+ fix->visual = FB_VISUAL_PSEUDOCOLOR;
+ break;
+ case 16:
++ case 24:
+ case 32:
+ fix->visual = FB_VISUAL_TRUECOLOR;
+ break;
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index eff1e36ca03c..8da89925a874 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -893,41 +893,24 @@ static inline size_t tcmu_cmd_get_cmd_size(struct tcmu_cmd *tcmu_cmd,
+ return command_size;
+ }
+
+-static int tcmu_setup_cmd_timer(struct tcmu_cmd *tcmu_cmd, unsigned int tmo,
+- struct timer_list *timer)
++static void tcmu_setup_cmd_timer(struct tcmu_cmd *tcmu_cmd, unsigned int tmo,
++ struct timer_list *timer)
+ {
+- struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
+- int cmd_id;
+-
+- if (tcmu_cmd->cmd_id)
+- goto setup_timer;
+-
+- cmd_id = idr_alloc(&udev->commands, tcmu_cmd, 1, USHRT_MAX, GFP_NOWAIT);
+- if (cmd_id < 0) {
+- pr_err("tcmu: Could not allocate cmd id.\n");
+- return cmd_id;
+- }
+- tcmu_cmd->cmd_id = cmd_id;
+-
+- pr_debug("allocated cmd %u for dev %s tmo %lu\n", tcmu_cmd->cmd_id,
+- udev->name, tmo / MSEC_PER_SEC);
+-
+-setup_timer:
+ if (!tmo)
+- return 0;
++ return;
+
+ tcmu_cmd->deadline = round_jiffies_up(jiffies + msecs_to_jiffies(tmo));
+ if (!timer_pending(timer))
+ mod_timer(timer, tcmu_cmd->deadline);
+
+- return 0;
++ pr_debug("Timeout set up for cmd %p, dev = %s, tmo = %lu\n", tcmu_cmd,
++ tcmu_cmd->tcmu_dev->name, tmo / MSEC_PER_SEC);
+ }
+
+ static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd)
+ {
+ struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
+ unsigned int tmo;
+- int ret;
+
+ /*
+ * For backwards compat if qfull_time_out is not set use
+@@ -942,13 +925,11 @@ static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd)
+ else
+ tmo = TCMU_TIME_OUT;
+
+- ret = tcmu_setup_cmd_timer(tcmu_cmd, tmo, &udev->qfull_timer);
+- if (ret)
+- return ret;
++ tcmu_setup_cmd_timer(tcmu_cmd, tmo, &udev->qfull_timer);
+
+ list_add_tail(&tcmu_cmd->queue_entry, &udev->qfull_queue);
+- pr_debug("adding cmd %u on dev %s to ring space wait queue\n",
+- tcmu_cmd->cmd_id, udev->name);
++ pr_debug("adding cmd %p on dev %s to ring space wait queue\n",
++ tcmu_cmd, udev->name);
+ return 0;
+ }
+
+@@ -970,7 +951,7 @@ static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err)
+ struct tcmu_mailbox *mb;
+ struct tcmu_cmd_entry *entry;
+ struct iovec *iov;
+- int iov_cnt, ret;
++ int iov_cnt, cmd_id;
+ uint32_t cmd_head;
+ uint64_t cdb_off;
+ bool copy_to_data_area;
+@@ -1071,14 +1052,21 @@ static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err)
+ }
+ entry->req.iov_bidi_cnt = iov_cnt;
+
+- ret = tcmu_setup_cmd_timer(tcmu_cmd, udev->cmd_time_out,
+- &udev->cmd_timer);
+- if (ret) {
+- tcmu_cmd_free_data(tcmu_cmd, tcmu_cmd->dbi_cnt);
++ cmd_id = idr_alloc(&udev->commands, tcmu_cmd, 1, USHRT_MAX, GFP_NOWAIT);
++ if (cmd_id < 0) {
++ pr_err("tcmu: Could not allocate cmd id.\n");
+
++ tcmu_cmd_free_data(tcmu_cmd, tcmu_cmd->dbi_cnt);
+ *scsi_err = TCM_OUT_OF_RESOURCES;
+ return -1;
+ }
++ tcmu_cmd->cmd_id = cmd_id;
++
++ pr_debug("allocated cmd id %u for cmd %p dev %s\n", tcmu_cmd->cmd_id,
++ tcmu_cmd, udev->name);
++
++ tcmu_setup_cmd_timer(tcmu_cmd, udev->cmd_time_out, &udev->cmd_timer);
++
+ entry->hdr.cmd_id = tcmu_cmd->cmd_id;
+
+ /*
+@@ -1290,50 +1278,39 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ return handled;
+ }
+
+-static int tcmu_check_expired_cmd(int id, void *p, void *data)
++static void tcmu_check_expired_ring_cmd(struct tcmu_cmd *cmd)
+ {
+- struct tcmu_cmd *cmd = p;
+- struct tcmu_dev *udev = cmd->tcmu_dev;
+- u8 scsi_status;
+ struct se_cmd *se_cmd;
+- bool is_running;
+-
+- if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
+- return 0;
+
+ if (!time_after(jiffies, cmd->deadline))
+- return 0;
++ return;
+
+- is_running = test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags);
++ set_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags);
++ list_del_init(&cmd->queue_entry);
+ se_cmd = cmd->se_cmd;
++ cmd->se_cmd = NULL;
+
+- if (is_running) {
+- /*
+- * If cmd_time_out is disabled but qfull is set deadline
+- * will only reflect the qfull timeout. Ignore it.
+- */
+- if (!udev->cmd_time_out)
+- return 0;
++ pr_debug("Timing out inflight cmd %u on dev %s.\n",
++ cmd->cmd_id, cmd->tcmu_dev->name);
+
+- set_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags);
+- /*
+- * target_complete_cmd will translate this to LUN COMM FAILURE
+- */
+- scsi_status = SAM_STAT_CHECK_CONDITION;
+- list_del_init(&cmd->queue_entry);
+- cmd->se_cmd = NULL;
+- } else {
+- list_del_init(&cmd->queue_entry);
+- idr_remove(&udev->commands, id);
+- tcmu_free_cmd(cmd);
+- scsi_status = SAM_STAT_TASK_SET_FULL;
+- }
++ target_complete_cmd(se_cmd, SAM_STAT_CHECK_CONDITION);
++}
+
+- pr_debug("Timing out cmd %u on dev %s that is %s.\n",
+- id, udev->name, is_running ? "inflight" : "queued");
++static void tcmu_check_expired_queue_cmd(struct tcmu_cmd *cmd)
++{
++ struct se_cmd *se_cmd;
+
+- target_complete_cmd(se_cmd, scsi_status);
+- return 0;
++ if (!time_after(jiffies, cmd->deadline))
++ return;
++
++ pr_debug("Timing out queued cmd %p on dev %s.\n",
++ cmd, cmd->tcmu_dev->name);
++
++ list_del_init(&cmd->queue_entry);
++ se_cmd = cmd->se_cmd;
++ tcmu_free_cmd(cmd);
++
++ target_complete_cmd(se_cmd, SAM_STAT_TASK_SET_FULL);
+ }
+
+ static void tcmu_device_timedout(struct tcmu_dev *udev)
+@@ -1418,16 +1395,15 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
+ return &udev->se_dev;
+ }
+
+-static bool run_qfull_queue(struct tcmu_dev *udev, bool fail)
++static void run_qfull_queue(struct tcmu_dev *udev, bool fail)
+ {
+ struct tcmu_cmd *tcmu_cmd, *tmp_cmd;
+ LIST_HEAD(cmds);
+- bool drained = true;
+ sense_reason_t scsi_ret;
+ int ret;
+
+ if (list_empty(&udev->qfull_queue))
+- return true;
++ return;
+
+ pr_debug("running %s's cmdr queue forcefail %d\n", udev->name, fail);
+
+@@ -1436,11 +1412,10 @@ static bool run_qfull_queue(struct tcmu_dev *udev, bool fail)
+ list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, queue_entry) {
+ list_del_init(&tcmu_cmd->queue_entry);
+
+- pr_debug("removing cmd %u on dev %s from queue\n",
+- tcmu_cmd->cmd_id, udev->name);
++ pr_debug("removing cmd %p on dev %s from queue\n",
++ tcmu_cmd, udev->name);
+
+ if (fail) {
+- idr_remove(&udev->commands, tcmu_cmd->cmd_id);
+ /*
+ * We were not able to even start the command, so
+ * fail with busy to allow a retry in case runner
+@@ -1455,10 +1430,8 @@ static bool run_qfull_queue(struct tcmu_dev *udev, bool fail)
+
+ ret = queue_cmd_ring(tcmu_cmd, &scsi_ret);
+ if (ret < 0) {
+- pr_debug("cmd %u on dev %s failed with %u\n",
+- tcmu_cmd->cmd_id, udev->name, scsi_ret);
+-
+- idr_remove(&udev->commands, tcmu_cmd->cmd_id);
++ pr_debug("cmd %p on dev %s failed with %u\n",
++ tcmu_cmd, udev->name, scsi_ret);
+ /*
+ * Ignore scsi_ret for now. target_complete_cmd
+ * drops it.
+@@ -1473,13 +1446,11 @@ static bool run_qfull_queue(struct tcmu_dev *udev, bool fail)
+ * the queue
+ */
+ list_splice_tail(&cmds, &udev->qfull_queue);
+- drained = false;
+ break;
+ }
+ }
+
+ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
+- return drained;
+ }
+
+ static int tcmu_irqcontrol(struct uio_info *info, s32 irq_on)
+@@ -1663,6 +1634,8 @@ static void tcmu_dev_kref_release(struct kref *kref)
+ if (tcmu_check_and_free_pending_cmd(cmd) != 0)
+ all_expired = false;
+ }
++ if (!list_empty(&udev->qfull_queue))
++ all_expired = false;
+ idr_destroy(&udev->commands);
+ WARN_ON(!all_expired);
+
+@@ -2031,9 +2004,6 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
+ mutex_lock(&udev->cmdr_lock);
+
+ idr_for_each_entry(&udev->commands, cmd, i) {
+- if (!test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags))
+- continue;
+-
+ pr_debug("removing cmd %u on dev %s from ring (is expired %d)\n",
+ cmd->cmd_id, udev->name,
+ test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags));
+@@ -2071,6 +2041,8 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
+
+ del_timer(&udev->cmd_timer);
+
++ run_qfull_queue(udev, false);
++
+ mutex_unlock(&udev->cmdr_lock);
+ }
+
+@@ -2692,6 +2664,7 @@ static void find_free_blocks(void)
+ static void check_timedout_devices(void)
+ {
+ struct tcmu_dev *udev, *tmp_dev;
++ struct tcmu_cmd *cmd, *tmp_cmd;
+ LIST_HEAD(devs);
+
+ spin_lock_bh(&timed_out_udevs_lock);
+@@ -2702,9 +2675,24 @@ static void check_timedout_devices(void)
+ spin_unlock_bh(&timed_out_udevs_lock);
+
+ mutex_lock(&udev->cmdr_lock);
+- idr_for_each(&udev->commands, tcmu_check_expired_cmd, NULL);
+
+- tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer);
++ /*
++ * If cmd_time_out is disabled but qfull is set deadline
++ * will only reflect the qfull timeout. Ignore it.
++ */
++ if (udev->cmd_time_out) {
++ list_for_each_entry_safe(cmd, tmp_cmd,
++ &udev->inflight_queue,
++ queue_entry) {
++ tcmu_check_expired_ring_cmd(cmd);
++ }
++ tcmu_set_next_deadline(&udev->inflight_queue,
++ &udev->cmd_timer);
++ }
++ list_for_each_entry_safe(cmd, tmp_cmd, &udev->qfull_queue,
++ queue_entry) {
++ tcmu_check_expired_queue_cmd(cmd);
++ }
+ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
+
+ mutex_unlock(&udev->cmdr_lock);
+diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+index b4f981daeaf2..452e034aedc1 100644
+--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
++++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+@@ -183,7 +183,7 @@ int ti_thermal_expose_sensor(struct ti_bandgap *bgp, int id,
+
+ data = ti_bandgap_get_sensor_data(bgp, id);
+
+- if (!data || IS_ERR(data))
++ if (!IS_ERR_OR_NULL(data))
+ data = ti_thermal_build_data(bgp, id);
+
+ if (!data)
+@@ -210,7 +210,7 @@ int ti_thermal_remove_sensor(struct ti_bandgap *bgp, int id)
+
+ data = ti_bandgap_get_sensor_data(bgp, id);
+
+- if (data && data->ti_thermal) {
++ if (!IS_ERR_OR_NULL(data) && data->ti_thermal) {
+ if (data->our_zone)
+ thermal_zone_device_unregister(data->ti_thermal);
+ }
+@@ -276,7 +276,7 @@ int ti_thermal_unregister_cpu_cooling(struct ti_bandgap *bgp, int id)
+
+ data = ti_bandgap_get_sensor_data(bgp, id);
+
+- if (data) {
++ if (!IS_ERR_OR_NULL(data)) {
+ cpufreq_cooling_unregister(data->cool_dev);
+ if (data->policy)
+ cpufreq_cpu_put(data->policy);
+diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
+index cdcc64ea2554..f8e43a6faea9 100644
+--- a/drivers/tty/hvc/hvc_console.c
++++ b/drivers/tty/hvc/hvc_console.c
+@@ -75,6 +75,8 @@ static LIST_HEAD(hvc_structs);
+ */
+ static DEFINE_MUTEX(hvc_structs_mutex);
+
++/* Mutex to serialize hvc_open */
++static DEFINE_MUTEX(hvc_open_mutex);
+ /*
+ * This value is used to assign a tty->index value to a hvc_struct based
+ * upon order of exposure via hvc_probe(), when we can not match it to
+@@ -346,16 +348,24 @@ static int hvc_install(struct tty_driver *driver, struct tty_struct *tty)
+ */
+ static int hvc_open(struct tty_struct *tty, struct file * filp)
+ {
+- struct hvc_struct *hp = tty->driver_data;
++ struct hvc_struct *hp;
+ unsigned long flags;
+ int rc = 0;
+
++ mutex_lock(&hvc_open_mutex);
++
++ hp = tty->driver_data;
++ if (!hp) {
++ rc = -EIO;
++ goto out;
++ }
++
+ spin_lock_irqsave(&hp->port.lock, flags);
+ /* Check and then increment for fast path open. */
+ if (hp->port.count++ > 0) {
+ spin_unlock_irqrestore(&hp->port.lock, flags);
+ hvc_kick();
+- return 0;
++ goto out;
+ } /* else count == 0 */
+ spin_unlock_irqrestore(&hp->port.lock, flags);
+
+@@ -383,6 +393,8 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
+ /* Force wakeup of the polling thread */
+ hvc_kick();
+
++out:
++ mutex_unlock(&hvc_open_mutex);
+ return rc;
+ }
+
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 86b7e20ffd7f..5e9457d19927 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -665,11 +665,10 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len,
+ * FIXME: lock against link layer control transmissions
+ */
+
+-static void gsm_data_kick(struct gsm_mux *gsm)
++static void gsm_data_kick(struct gsm_mux *gsm, struct gsm_dlci *dlci)
+ {
+ struct gsm_msg *msg, *nmsg;
+ int len;
+- int skip_sof = 0;
+
+ list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) {
+ if (gsm->constipated && msg->addr)
+@@ -691,18 +690,23 @@ static void gsm_data_kick(struct gsm_mux *gsm)
+ print_hex_dump_bytes("gsm_data_kick: ",
+ DUMP_PREFIX_OFFSET,
+ gsm->txframe, len);
+-
+- if (gsm->output(gsm, gsm->txframe + skip_sof,
+- len - skip_sof) < 0)
++ if (gsm->output(gsm, gsm->txframe, len) < 0)
+ break;
+ /* FIXME: Can eliminate one SOF in many more cases */
+ gsm->tx_bytes -= msg->len;
+- /* For a burst of frames skip the extra SOF within the
+- burst */
+- skip_sof = 1;
+
+ list_del(&msg->list);
+ kfree(msg);
++
++ if (dlci) {
++ tty_port_tty_wakeup(&dlci->port);
++ } else {
++ int i = 0;
++
++ for (i = 0; i < NUM_DLCI; i++)
++ if (gsm->dlci[i])
++ tty_port_tty_wakeup(&gsm->dlci[i]->port);
++ }
+ }
+ }
+
+@@ -754,7 +758,7 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
+ /* Add to the actual output queue */
+ list_add_tail(&msg->list, &gsm->tx_list);
+ gsm->tx_bytes += msg->len;
+- gsm_data_kick(gsm);
++ gsm_data_kick(gsm, dlci);
+ }
+
+ /**
+@@ -1215,7 +1219,7 @@ static void gsm_control_message(struct gsm_mux *gsm, unsigned int command,
+ gsm_control_reply(gsm, CMD_FCON, NULL, 0);
+ /* Kick the link in case it is idling */
+ spin_lock_irqsave(&gsm->tx_lock, flags);
+- gsm_data_kick(gsm);
++ gsm_data_kick(gsm, NULL);
+ spin_unlock_irqrestore(&gsm->tx_lock, flags);
+ break;
+ case CMD_FCOFF:
+@@ -2412,7 +2416,7 @@ static void gsmld_write_wakeup(struct tty_struct *tty)
+ /* Queue poll */
+ clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+ spin_lock_irqsave(&gsm->tx_lock, flags);
+- gsm_data_kick(gsm);
++ gsm_data_kick(gsm, NULL);
+ if (gsm->tx_bytes < TX_THRESH_LO) {
+ gsm_dlci_data_sweep(gsm);
+ }
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 5a04d4ddca73..20b799219826 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -2628,6 +2628,8 @@ static unsigned int serial8250_get_baud_rate(struct uart_port *port,
+ struct ktermios *termios,
+ struct ktermios *old)
+ {
++ unsigned int tolerance = port->uartclk / 100;
++
+ /*
+ * Ask the core to calculate the divisor for us.
+ * Allow 1% tolerance at the upper limit so uart clks marginally
+@@ -2636,7 +2638,7 @@ static unsigned int serial8250_get_baud_rate(struct uart_port *port,
+ */
+ return uart_get_baud_rate(port, termios, old,
+ port->uartclk / 16 / UART_DIV_MAX,
+- port->uartclk);
++ (port->uartclk + tolerance) / 16);
+ }
+
+ void
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index af21122dfade..1d501154e9f7 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -2585,6 +2585,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap,
+ uap->port.fifosize = uap->fifosize;
+ uap->port.flags = UPF_BOOT_AUTOCONF;
+ uap->port.line = index;
++ spin_lock_init(&uap->port.lock);
+
+ amba_ports[index] = uap;
+
+diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
+index 4a80103675d5..419804c9c974 100644
+--- a/drivers/usb/class/usblp.c
++++ b/drivers/usb/class/usblp.c
+@@ -468,7 +468,8 @@ static int usblp_release(struct inode *inode, struct file *file)
+ usb_autopm_put_interface(usblp->intf);
+
+ if (!usblp->present) /* finish cleanup from disconnect */
+- usblp_cleanup(usblp);
++ usblp_cleanup(usblp); /* any URBs must be dead */
++
+ mutex_unlock(&usblp_mutex);
+ return 0;
+ }
+@@ -1375,9 +1376,11 @@ static void usblp_disconnect(struct usb_interface *intf)
+
+ usblp_unlink_urbs(usblp);
+ mutex_unlock(&usblp->mut);
++ usb_poison_anchored_urbs(&usblp->urbs);
+
+ if (!usblp->used)
+ usblp_cleanup(usblp);
++
+ mutex_unlock(&usblp_mutex);
+ }
+
+diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
+index 19ae2595f1c3..b23ce535c12e 100644
+--- a/drivers/usb/dwc2/core_intr.c
++++ b/drivers/usb/dwc2/core_intr.c
+@@ -421,10 +421,13 @@ static void dwc2_handle_wakeup_detected_intr(struct dwc2_hsotg *hsotg)
+ if (ret && (ret != -ENOTSUPP))
+ dev_err(hsotg->dev, "exit power_down failed\n");
+
++ /* Change to L0 state */
++ hsotg->lx_state = DWC2_L0;
+ call_gadget(hsotg, resume);
++ } else {
++ /* Change to L0 state */
++ hsotg->lx_state = DWC2_L0;
+ }
+- /* Change to L0 state */
+- hsotg->lx_state = DWC2_L0;
+ } else {
+ if (hsotg->params.power_down)
+ return;
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 8e66954dfcd4..2f5f4ca5c0d0 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1217,6 +1217,8 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep)
+ }
+ }
+
++static void dwc3_gadget_ep_cleanup_cancelled_requests(struct dwc3_ep *dep);
++
+ static int __dwc3_gadget_kick_transfer(struct dwc3_ep *dep)
+ {
+ struct dwc3_gadget_ep_cmd_params params;
+@@ -1253,14 +1255,20 @@ static int __dwc3_gadget_kick_transfer(struct dwc3_ep *dep)
+
+ ret = dwc3_send_gadget_ep_cmd(dep, cmd, ¶ms);
+ if (ret < 0) {
+- /*
+- * FIXME we need to iterate over the list of requests
+- * here and stop, unmap, free and del each of the linked
+- * requests instead of what we do now.
+- */
+- if (req->trb)
+- memset(req->trb, 0, sizeof(struct dwc3_trb));
+- dwc3_gadget_del_and_unmap_request(dep, req, ret);
++ struct dwc3_request *tmp;
++
++ if (ret == -EAGAIN)
++ return ret;
++
++ dwc3_stop_active_transfer(dep, true, true);
++
++ list_for_each_entry_safe(req, tmp, &dep->started_list, list)
++ dwc3_gadget_move_cancelled_request(req);
++
++ /* If ep isn't started, then there's no end transfer pending */
++ if (!(dep->flags & DWC3_EP_END_TRANSFER_PENDING))
++ dwc3_gadget_ep_cleanup_cancelled_requests(dep);
++
+ return ret;
+ }
+
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index f3436913fd3f..40b3ed93596a 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -96,40 +96,43 @@ function_descriptors(struct usb_function *f,
+ }
+
+ /**
+- * next_ep_desc() - advance to the next EP descriptor
++ * next_desc() - advance to the next desc_type descriptor
+ * @t: currect pointer within descriptor array
++ * @desc_type: descriptor type
+ *
+- * Return: next EP descriptor or NULL
++ * Return: next desc_type descriptor or NULL
+ *
+- * Iterate over @t until either EP descriptor found or
++ * Iterate over @t until either desc_type descriptor found or
+ * NULL (that indicates end of list) encountered
+ */
+ static struct usb_descriptor_header**
+-next_ep_desc(struct usb_descriptor_header **t)
++next_desc(struct usb_descriptor_header **t, u8 desc_type)
+ {
+ for (; *t; t++) {
+- if ((*t)->bDescriptorType == USB_DT_ENDPOINT)
++ if ((*t)->bDescriptorType == desc_type)
+ return t;
+ }
+ return NULL;
+ }
+
+ /*
+- * for_each_ep_desc()- iterate over endpoint descriptors in the
+- * descriptors list
+- * @start: pointer within descriptor array.
+- * @ep_desc: endpoint descriptor to use as the loop cursor
++ * for_each_desc() - iterate over desc_type descriptors in the
++ * descriptors list
++ * @start: pointer within descriptor array.
++ * @iter_desc: desc_type descriptor to use as the loop cursor
++ * @desc_type: wanted descriptr type
+ */
+-#define for_each_ep_desc(start, ep_desc) \
+- for (ep_desc = next_ep_desc(start); \
+- ep_desc; ep_desc = next_ep_desc(ep_desc+1))
++#define for_each_desc(start, iter_desc, desc_type) \
++ for (iter_desc = next_desc(start, desc_type); \
++ iter_desc; iter_desc = next_desc(iter_desc + 1, desc_type))
+
+ /**
+- * config_ep_by_speed() - configures the given endpoint
++ * config_ep_by_speed_and_alt() - configures the given endpoint
+ * according to gadget speed.
+ * @g: pointer to the gadget
+ * @f: usb function
+ * @_ep: the endpoint to configure
++ * @alt: alternate setting number
+ *
+ * Return: error code, 0 on success
+ *
+@@ -142,11 +145,13 @@ next_ep_desc(struct usb_descriptor_header **t)
+ * Note: the supplied function should hold all the descriptors
+ * for supported speeds
+ */
+-int config_ep_by_speed(struct usb_gadget *g,
+- struct usb_function *f,
+- struct usb_ep *_ep)
++int config_ep_by_speed_and_alt(struct usb_gadget *g,
++ struct usb_function *f,
++ struct usb_ep *_ep,
++ u8 alt)
+ {
+ struct usb_endpoint_descriptor *chosen_desc = NULL;
++ struct usb_interface_descriptor *int_desc = NULL;
+ struct usb_descriptor_header **speed_desc = NULL;
+
+ struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
+@@ -182,8 +187,21 @@ int config_ep_by_speed(struct usb_gadget *g,
+ default:
+ speed_desc = f->fs_descriptors;
+ }
++
++ /* find correct alternate setting descriptor */
++ for_each_desc(speed_desc, d_spd, USB_DT_INTERFACE) {
++ int_desc = (struct usb_interface_descriptor *)*d_spd;
++
++ if (int_desc->bAlternateSetting == alt) {
++ speed_desc = d_spd;
++ goto intf_found;
++ }
++ }
++ return -EIO;
++
++intf_found:
+ /* find descriptors */
+- for_each_ep_desc(speed_desc, d_spd) {
++ for_each_desc(speed_desc, d_spd, USB_DT_ENDPOINT) {
+ chosen_desc = (struct usb_endpoint_descriptor *)*d_spd;
+ if (chosen_desc->bEndpointAddress == _ep->address)
+ goto ep_found;
+@@ -237,6 +255,32 @@ ep_found:
+ }
+ return 0;
+ }
++EXPORT_SYMBOL_GPL(config_ep_by_speed_and_alt);
++
++/**
++ * config_ep_by_speed() - configures the given endpoint
++ * according to gadget speed.
++ * @g: pointer to the gadget
++ * @f: usb function
++ * @_ep: the endpoint to configure
++ *
++ * Return: error code, 0 on success
++ *
++ * This function chooses the right descriptors for a given
++ * endpoint according to gadget speed and saves it in the
++ * endpoint desc field. If the endpoint already has a descriptor
++ * assigned to it - overwrites it with currently corresponding
++ * descriptor. The endpoint maxpacket field is updated according
++ * to the chosen descriptor.
++ * Note: the supplied function should hold all the descriptors
++ * for supported speeds
++ */
++int config_ep_by_speed(struct usb_gadget *g,
++ struct usb_function *f,
++ struct usb_ep *_ep)
++{
++ return config_ep_by_speed_and_alt(g, f, _ep, 0);
++}
+ EXPORT_SYMBOL_GPL(config_ep_by_speed);
+
+ /**
+diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
+index 21921db068f6..cf56819f16e4 100644
+--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
+@@ -1602,17 +1602,17 @@ static int lpc32xx_ep_enable(struct usb_ep *_ep,
+ const struct usb_endpoint_descriptor *desc)
+ {
+ struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);
+- struct lpc32xx_udc *udc = ep->udc;
++ struct lpc32xx_udc *udc;
+ u16 maxpacket;
+ u32 tmp;
+ unsigned long flags;
+
+ /* Verify EP data */
+ if ((!_ep) || (!ep) || (!desc) ||
+- (desc->bDescriptorType != USB_DT_ENDPOINT)) {
+- dev_dbg(udc->dev, "bad ep or descriptor\n");
++ (desc->bDescriptorType != USB_DT_ENDPOINT))
+ return -EINVAL;
+- }
++
++ udc = ep->udc;
+ maxpacket = usb_endpoint_maxp(desc);
+ if ((maxpacket == 0) || (maxpacket > ep->maxpacket)) {
+ dev_dbg(udc->dev, "bad ep descriptor's packet size\n");
+@@ -1860,7 +1860,7 @@ static int lpc32xx_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+ static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value)
+ {
+ struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep);
+- struct lpc32xx_udc *udc = ep->udc;
++ struct lpc32xx_udc *udc;
+ unsigned long flags;
+
+ if ((!ep) || (ep->hwep_num <= 1))
+@@ -1870,6 +1870,7 @@ static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value)
+ if (ep->is_in)
+ return -EAGAIN;
+
++ udc = ep->udc;
+ spin_lock_irqsave(&udc->lock, flags);
+
+ if (value == 1) {
+diff --git a/drivers/usb/gadget/udc/m66592-udc.c b/drivers/usb/gadget/udc/m66592-udc.c
+index a8288df6aadf..ea59b56e5402 100644
+--- a/drivers/usb/gadget/udc/m66592-udc.c
++++ b/drivers/usb/gadget/udc/m66592-udc.c
+@@ -1667,7 +1667,7 @@ static int m66592_probe(struct platform_device *pdev)
+
+ err_add_udc:
+ m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req);
+-
++ m66592->ep0_req = NULL;
+ clean_up3:
+ if (m66592->pdata->on_chip) {
+ clk_disable(m66592->clk);
+diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c
+index 8bf5ad7a59ad..6cc63e317aba 100644
+--- a/drivers/usb/gadget/udc/s3c2410_udc.c
++++ b/drivers/usb/gadget/udc/s3c2410_udc.c
+@@ -264,10 +264,6 @@ static void s3c2410_udc_done(struct s3c2410_ep *ep,
+ static void s3c2410_udc_nuke(struct s3c2410_udc *udc,
+ struct s3c2410_ep *ep, int status)
+ {
+- /* Sanity check */
+- if (&ep->queue == NULL)
+- return;
+-
+ while (!list_empty(&ep->queue)) {
+ struct s3c2410_request *req;
+ req = list_entry(ep->queue.next, struct s3c2410_request,
+diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
+index c9f91e6c72b6..7f65c86047dd 100644
+--- a/drivers/usb/host/ehci-mxc.c
++++ b/drivers/usb/host/ehci-mxc.c
+@@ -50,6 +50,8 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
+ }
+
+ irq = platform_get_irq(pdev, 0);
++ if (irq < 0)
++ return irq;
+
+ hcd = usb_create_hcd(&ehci_mxc_hc_driver, dev, dev_name(dev));
+ if (!hcd)
+diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
+index 4c306fb6b069..cbc45941a699 100644
+--- a/drivers/usb/host/ehci-platform.c
++++ b/drivers/usb/host/ehci-platform.c
+@@ -29,6 +29,8 @@
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/reset.h>
++#include <linux/sys_soc.h>
++#include <linux/timer.h>
+ #include <linux/usb.h>
+ #include <linux/usb/hcd.h>
+ #include <linux/usb/ehci_pdriver.h>
+@@ -44,6 +46,9 @@ struct ehci_platform_priv {
+ struct clk *clks[EHCI_MAX_CLKS];
+ struct reset_control *rsts;
+ bool reset_on_resume;
++ bool quirk_poll;
++ struct timer_list poll_timer;
++ struct delayed_work poll_work;
+ };
+
+ static const char hcd_name[] = "ehci-platform";
+@@ -118,6 +123,111 @@ static struct usb_ehci_pdata ehci_platform_defaults = {
+ .power_off = ehci_platform_power_off,
+ };
+
++/**
++ * quirk_poll_check_port_status - Poll port_status if the device sticks
++ * @ehci: the ehci hcd pointer
++ *
++ * Since EHCI/OHCI controllers on R-Car Gen3 SoCs are possible to be getting
++ * stuck very rarely after a full/low usb device was disconnected. To
++ * detect such a situation, the controllers require a special way which poll
++ * the EHCI PORTSC register.
++ *
++ * Return: true if the controller's port_status indicated getting stuck
++ */
++static bool quirk_poll_check_port_status(struct ehci_hcd *ehci)
++{
++ u32 port_status = ehci_readl(ehci, &ehci->regs->port_status[0]);
++
++ if (!(port_status & PORT_OWNER) &&
++ (port_status & PORT_POWER) &&
++ !(port_status & PORT_CONNECT) &&
++ (port_status & PORT_LS_MASK))
++ return true;
++
++ return false;
++}
++
++/**
++ * quirk_poll_rebind_companion - rebind comanion device to recover
++ * @ehci: the ehci hcd pointer
++ *
++ * Since EHCI/OHCI controllers on R-Car Gen3 SoCs are possible to be getting
++ * stuck very rarely after a full/low usb device was disconnected. To
++ * recover from such a situation, the controllers require changing the OHCI
++ * functional state.
++ */
++static void quirk_poll_rebind_companion(struct ehci_hcd *ehci)
++{
++ struct device *companion_dev;
++ struct usb_hcd *hcd = ehci_to_hcd(ehci);
++
++ companion_dev = usb_of_get_companion_dev(hcd->self.controller);
++ if (!companion_dev)
++ return;
++
++ device_release_driver(companion_dev);
++ if (device_attach(companion_dev) < 0)
++ ehci_err(ehci, "%s: failed\n", __func__);
++
++ put_device(companion_dev);
++}
++
++static void quirk_poll_work(struct work_struct *work)
++{
++ struct ehci_platform_priv *priv =
++ container_of(to_delayed_work(work), struct ehci_platform_priv,
++ poll_work);
++ struct ehci_hcd *ehci = container_of((void *)priv, struct ehci_hcd,
++ priv);
++
++ /* check the status twice to reduce misdetection rate */
++ if (!quirk_poll_check_port_status(ehci))
++ return;
++ udelay(10);
++ if (!quirk_poll_check_port_status(ehci))
++ return;
++
++ ehci_dbg(ehci, "%s: detected getting stuck. rebind now!\n", __func__);
++ quirk_poll_rebind_companion(ehci);
++}
++
++static void quirk_poll_timer(struct timer_list *t)
++{
++ struct ehci_platform_priv *priv = from_timer(priv, t, poll_timer);
++ struct ehci_hcd *ehci = container_of((void *)priv, struct ehci_hcd,
++ priv);
++
++ if (quirk_poll_check_port_status(ehci)) {
++ /*
++ * Now scheduling the work for testing the port more. Note that
++ * updating the status is possible to be delayed when
++ * reconnection. So, this uses delayed work with 5 ms delay
++ * to avoid misdetection.
++ */
++ schedule_delayed_work(&priv->poll_work, msecs_to_jiffies(5));
++ }
++
++ mod_timer(&priv->poll_timer, jiffies + HZ);
++}
++
++static void quirk_poll_init(struct ehci_platform_priv *priv)
++{
++ INIT_DELAYED_WORK(&priv->poll_work, quirk_poll_work);
++ timer_setup(&priv->poll_timer, quirk_poll_timer, 0);
++ mod_timer(&priv->poll_timer, jiffies + HZ);
++}
++
++static void quirk_poll_end(struct ehci_platform_priv *priv)
++{
++ del_timer_sync(&priv->poll_timer);
++ cancel_delayed_work(&priv->poll_work);
++}
++
++static const struct soc_device_attribute quirk_poll_match[] = {
++ { .family = "R-Car Gen3" },
++ { /* sentinel*/ }
++};
++
+ static int ehci_platform_probe(struct platform_device *dev)
+ {
+ struct usb_hcd *hcd;
+@@ -178,6 +288,9 @@ static int ehci_platform_probe(struct platform_device *dev)
+ "has-transaction-translator"))
+ hcd->has_tt = 1;
+
++ if (soc_device_match(quirk_poll_match))
++ priv->quirk_poll = true;
++
+ for (clk = 0; clk < EHCI_MAX_CLKS; clk++) {
+ priv->clks[clk] = of_clk_get(dev->dev.of_node, clk);
+ if (IS_ERR(priv->clks[clk])) {
+@@ -249,6 +362,9 @@ static int ehci_platform_probe(struct platform_device *dev)
+ device_enable_async_suspend(hcd->self.controller);
+ platform_set_drvdata(dev, hcd);
+
++ if (priv->quirk_poll)
++ quirk_poll_init(priv);
++
+ return err;
+
+ err_power:
+@@ -275,6 +391,9 @@ static int ehci_platform_remove(struct platform_device *dev)
+ struct ehci_platform_priv *priv = hcd_to_ehci_priv(hcd);
+ int clk;
+
++ if (priv->quirk_poll)
++ quirk_poll_end(priv);
++
+ usb_remove_hcd(hcd);
+
+ if (pdata->power_off)
+@@ -299,9 +418,13 @@ static int ehci_platform_suspend(struct device *dev)
+ struct usb_hcd *hcd = dev_get_drvdata(dev);
+ struct usb_ehci_pdata *pdata = dev_get_platdata(dev);
+ struct platform_device *pdev = to_platform_device(dev);
++ struct ehci_platform_priv *priv = hcd_to_ehci_priv(hcd);
+ bool do_wakeup = device_may_wakeup(dev);
+ int ret;
+
++ if (priv->quirk_poll)
++ quirk_poll_end(priv);
++
+ ret = ehci_suspend(hcd, do_wakeup);
+ if (ret)
+ return ret;
+@@ -333,6 +456,14 @@ static int ehci_platform_resume(struct device *dev)
+ }
+
+ ehci_resume(hcd, priv->reset_on_resume);
++
++ pm_runtime_disable(dev);
++ pm_runtime_set_active(dev);
++ pm_runtime_enable(dev);
++
++ if (priv->quirk_poll)
++ quirk_poll_init(priv);
++
+ return 0;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+diff --git a/drivers/usb/host/ohci-platform.c b/drivers/usb/host/ohci-platform.c
+index 65a1c3fdc88c..f40112c5920d 100644
+--- a/drivers/usb/host/ohci-platform.c
++++ b/drivers/usb/host/ohci-platform.c
+@@ -301,6 +301,11 @@ static int ohci_platform_resume(struct device *dev)
+ }
+
+ ohci_resume(hcd, false);
++
++ pm_runtime_disable(dev);
++ pm_runtime_set_active(dev);
++ pm_runtime_enable(dev);
++
+ return 0;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index adc437ca83b8..65972c186c64 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -408,7 +408,15 @@ static int __maybe_unused xhci_plat_resume(struct device *dev)
+ if (ret)
+ return ret;
+
+- return xhci_resume(xhci, 0);
++ ret = xhci_resume(xhci, 0);
++ if (ret)
++ return ret;
++
++ pm_runtime_disable(dev);
++ pm_runtime_set_active(dev);
++ pm_runtime_enable(dev);
++
++ return 0;
+ }
+
+ static int __maybe_unused xhci_plat_runtime_suspend(struct device *dev)
+diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c
+index e7770b511d03..1692a0cc3036 100644
+--- a/drivers/vfio/mdev/mdev_sysfs.c
++++ b/drivers/vfio/mdev/mdev_sysfs.c
+@@ -113,7 +113,7 @@ struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent,
+ "%s-%s", dev_driver_string(parent->dev),
+ group->name);
+ if (ret) {
+- kfree(type);
++ kobject_put(&type->kobj);
+ return ERR_PTR(ret);
+ }
+
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index 423ea1f98441..36bc8f104e42 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -1464,7 +1464,12 @@ static int vfio_cap_init(struct vfio_pci_device *vdev)
+ if (ret)
+ return ret;
+
+- if (cap <= PCI_CAP_ID_MAX) {
++ /*
++ * ID 0 is a NULL capability, conflicting with our fake
++ * PCI_CAP_ID_BASIC. As it has no content, consider it
++ * hidden for now.
++ */
++ if (cap && cap <= PCI_CAP_ID_MAX) {
+ len = pci_cap_length[cap];
+ if (len == 0xFF) { /* Variable length */
+ len = vfio_cap_len(vdev, cap, pos);
+@@ -1732,8 +1737,11 @@ void vfio_config_free(struct vfio_pci_device *vdev)
+ vdev->vconfig = NULL;
+ kfree(vdev->pci_config_map);
+ vdev->pci_config_map = NULL;
+- kfree(vdev->msi_perm);
+- vdev->msi_perm = NULL;
++ if (vdev->msi_perm) {
++ free_perm_bits(vdev->msi_perm);
++ kfree(vdev->msi_perm);
++ vdev->msi_perm = NULL;
++ }
+ }
+
+ /*
+diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
+index 73612485ed07..bd43d8cff389 100644
+--- a/drivers/video/backlight/lp855x_bl.c
++++ b/drivers/video/backlight/lp855x_bl.c
+@@ -460,7 +460,7 @@ static int lp855x_probe(struct i2c_client *cl, const struct i2c_device_id *id)
+ ret = regulator_enable(lp->enable);
+ if (ret < 0) {
+ dev_err(lp->dev, "failed to enable vddio: %d\n", ret);
+- return ret;
++ goto disable_supply;
+ }
+
+ /*
+@@ -475,24 +475,34 @@ static int lp855x_probe(struct i2c_client *cl, const struct i2c_device_id *id)
+ ret = lp855x_configure(lp);
+ if (ret) {
+ dev_err(lp->dev, "device config err: %d", ret);
+- return ret;
++ goto disable_vddio;
+ }
+
+ ret = lp855x_backlight_register(lp);
+ if (ret) {
+ dev_err(lp->dev,
+ "failed to register backlight. err: %d\n", ret);
+- return ret;
++ goto disable_vddio;
+ }
+
+ ret = sysfs_create_group(&lp->dev->kobj, &lp855x_attr_group);
+ if (ret) {
+ dev_err(lp->dev, "failed to register sysfs. err: %d\n", ret);
+- return ret;
++ goto disable_vddio;
+ }
+
+ backlight_update_status(lp->bl);
++
+ return 0;
++
++disable_vddio:
++ if (lp->enable)
++ regulator_disable(lp->enable);
++disable_supply:
++ if (lp->supply)
++ regulator_disable(lp->supply);
++
++ return ret;
+ }
+
+ static int lp855x_remove(struct i2c_client *cl)
+@@ -501,6 +511,8 @@ static int lp855x_remove(struct i2c_client *cl)
+
+ lp->bl->props.brightness = 0;
+ backlight_update_status(lp->bl);
++ if (lp->enable)
++ regulator_disable(lp->enable);
+ if (lp->supply)
+ regulator_disable(lp->supply);
+ sysfs_remove_group(&lp->dev->kobj, &lp855x_attr_group);
+diff --git a/drivers/watchdog/da9062_wdt.c b/drivers/watchdog/da9062_wdt.c
+index 7f0a8e635286..132d45d003ce 100644
+--- a/drivers/watchdog/da9062_wdt.c
++++ b/drivers/watchdog/da9062_wdt.c
+@@ -60,11 +60,6 @@ static int da9062_wdt_update_timeout_register(struct da9062_watchdog *wdt,
+ unsigned int regval)
+ {
+ struct da9062 *chip = wdt->hw;
+- int ret;
+-
+- ret = da9062_reset_watchdog_timer(wdt);
+- if (ret)
+- return ret;
+
+ regmap_update_bits(chip->regmap,
+ DA9062AA_CONTROL_D,
+diff --git a/fs/afs/proc.c b/fs/afs/proc.c
+index 9101f62707af..e445c02dea3d 100644
+--- a/fs/afs/proc.c
++++ b/fs/afs/proc.c
+@@ -512,6 +512,7 @@ void afs_put_sysnames(struct afs_sysnames *sysnames)
+ if (sysnames->subs[i] != afs_init_sysname &&
+ sysnames->subs[i] != sysnames->blank)
+ kfree(sysnames->subs[i]);
++ kfree(sysnames);
+ }
+ }
+
+diff --git a/fs/afs/write.c b/fs/afs/write.c
+index e00461a6de9a..ec8d27cf92a5 100644
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -188,11 +188,11 @@ int afs_write_end(struct file *file, struct address_space *mapping,
+
+ i_size = i_size_read(&vnode->vfs_inode);
+ if (maybe_i_size > i_size) {
+- spin_lock(&vnode->wb_lock);
++ write_seqlock(&vnode->cb_lock);
+ i_size = i_size_read(&vnode->vfs_inode);
+ if (maybe_i_size > i_size)
+ i_size_write(&vnode->vfs_inode, maybe_i_size);
+- spin_unlock(&vnode->wb_lock);
++ write_sequnlock(&vnode->cb_lock);
+ }
+
+ if (!PageUptodate(page)) {
+@@ -792,6 +792,7 @@ vm_fault_t afs_page_mkwrite(struct vm_fault *vmf)
+ vmf->page->index, priv);
+ SetPagePrivate(vmf->page);
+ set_page_private(vmf->page, priv);
++ file_update_time(file);
+
+ sb_end_pagefault(inode->i_sb);
+ return VM_FAULT_LOCKED;
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index c158bad9a075..8ac8f7469354 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1463,10 +1463,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ */
+ if (!for_part) {
+ ret = devcgroup_inode_permission(bdev->bd_inode, perm);
+- if (ret != 0) {
+- bdput(bdev);
++ if (ret != 0)
+ return ret;
+- }
+ }
+
+ restart:
+@@ -1535,8 +1533,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ goto out_clear;
+ BUG_ON(for_part);
+ ret = __blkdev_get(whole, mode, 1);
+- if (ret)
++ if (ret) {
++ bdput(whole);
+ goto out_clear;
++ }
+ bdev->bd_contains = whole;
+ bdev->bd_part = disk_get_part(disk, partno);
+ if (!(disk->flags & GENHD_FL_UP) ||
+@@ -1586,7 +1586,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ disk_unblock_events(disk);
+ put_disk_and_module(disk);
+ out:
+- bdput(bdev);
+
+ return ret;
+ }
+@@ -1672,6 +1671,9 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder)
+ bdput(whole);
+ }
+
++ if (res)
++ bdput(bdev);
++
+ return res;
+ }
+ EXPORT_SYMBOL(blkdev_get);
+diff --git a/fs/dlm/dlm_internal.h b/fs/dlm/dlm_internal.h
+index 748e8d59e611..cb287df13a7a 100644
+--- a/fs/dlm/dlm_internal.h
++++ b/fs/dlm/dlm_internal.h
+@@ -99,7 +99,6 @@ do { \
+ __LINE__, __FILE__, #x, jiffies); \
+ {do} \
+ printk("\n"); \
+- BUG(); \
+ panic("DLM: Record message above and reboot.\n"); \
+ } \
+ }
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 6e8049031c1a..3a4570e37cb0 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2905,7 +2905,7 @@ again:
+ * in use to avoid freeing it when removing blocks.
+ */
+ if (sbi->s_cluster_ratio > 1) {
+- pblk = ext4_ext_pblock(ex) + end - ee_block + 2;
++ pblk = ext4_ext_pblock(ex) + end - ee_block + 1;
+ partial_cluster =
+ -(long long) EXT4_B2C(sbi, pblk);
+ }
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 93c14ecac831..1428dab2afff 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1989,6 +1989,16 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
+ #endif
+ } else if (token == Opt_dax) {
+ #ifdef CONFIG_FS_DAX
++ if (is_remount && test_opt(sb, DAX)) {
++ ext4_msg(sb, KERN_ERR, "can't mount with "
++ "both data=journal and dax");
++ return -1;
++ }
++ if (is_remount && !(sbi->s_mount_opt & EXT4_MOUNT_DAX)) {
++ ext4_msg(sb, KERN_ERR, "can't change "
++ "dax mount option while remounting");
++ return -1;
++ }
+ ext4_msg(sb, KERN_WARNING,
+ "DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
+ sbi->s_mount_opt |= m->mount_opt;
+@@ -2249,6 +2259,7 @@ static int ext4_setup_super(struct super_block *sb, struct ext4_super_block *es,
+ ext4_msg(sb, KERN_ERR, "revision level too high, "
+ "forcing read-only mode");
+ err = -EROFS;
++ goto done;
+ }
+ if (read_only)
+ goto done;
+@@ -5273,12 +5284,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ err = -EINVAL;
+ goto restore_opts;
+ }
+- if (test_opt(sb, DAX)) {
+- ext4_msg(sb, KERN_ERR, "can't mount with "
+- "both data=journal and dax");
+- err = -EINVAL;
+- goto restore_opts;
+- }
+ } else if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA) {
+ if (test_opt(sb, JOURNAL_ASYNC_COMMIT)) {
+ ext4_msg(sb, KERN_ERR, "can't mount with "
+@@ -5294,12 +5299,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ goto restore_opts;
+ }
+
+- if ((sbi->s_mount_opt ^ old_opts.s_mount_opt) & EXT4_MOUNT_DAX) {
+- ext4_msg(sb, KERN_WARNING, "warning: refusing change of "
+- "dax flag with busy inodes while remounting");
+- sbi->s_mount_opt ^= EXT4_MOUNT_DAX;
+- }
+-
+ if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED)
+ ext4_abort(sb, "Abort forced by user");
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 45f8f6ec22a5..9782250c9815 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1154,7 +1154,8 @@ static int f2fs_statfs_project(struct super_block *sb,
+ limit >>= sb->s_blocksize_bits;
+
+ if (limit && buf->f_blocks > limit) {
+- curblock = dquot->dq_dqb.dqb_curspace >> sb->s_blocksize_bits;
++ curblock = (dquot->dq_dqb.dqb_curspace +
++ dquot->dq_dqb.dqb_rsvspace) >> sb->s_blocksize_bits;
+ buf->f_blocks = limit;
+ buf->f_bfree = buf->f_bavail =
+ (buf->f_blocks > curblock) ?
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index d3f0612e3347..06752db213d2 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -877,8 +877,10 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)
+ * @new: New transaction to be merged
+ */
+
+-static void gfs2_merge_trans(struct gfs2_trans *old, struct gfs2_trans *new)
++static void gfs2_merge_trans(struct gfs2_sbd *sdp, struct gfs2_trans *new)
+ {
++ struct gfs2_trans *old = sdp->sd_log_tr;
++
+ WARN_ON_ONCE(!test_bit(TR_ATTACHED, &old->tr_flags));
+
+ old->tr_num_buf_new += new->tr_num_buf_new;
+@@ -890,6 +892,11 @@ static void gfs2_merge_trans(struct gfs2_trans *old, struct gfs2_trans *new)
+
+ list_splice_tail_init(&new->tr_databuf, &old->tr_databuf);
+ list_splice_tail_init(&new->tr_buf, &old->tr_buf);
++
++ spin_lock(&sdp->sd_ail_lock);
++ list_splice_tail_init(&new->tr_ail1_list, &old->tr_ail1_list);
++ list_splice_tail_init(&new->tr_ail2_list, &old->tr_ail2_list);
++ spin_unlock(&sdp->sd_ail_lock);
+ }
+
+ static void log_refund(struct gfs2_sbd *sdp, struct gfs2_trans *tr)
+@@ -901,7 +908,7 @@ static void log_refund(struct gfs2_sbd *sdp, struct gfs2_trans *tr)
+ gfs2_log_lock(sdp);
+
+ if (sdp->sd_log_tr) {
+- gfs2_merge_trans(sdp->sd_log_tr, tr);
++ gfs2_merge_trans(sdp, tr);
+ } else if (tr->tr_num_buf_new || tr->tr_num_databuf_new) {
+ gfs2_assert_withdraw(sdp, test_bit(TR_ALLOCED, &tr->tr_flags));
+ sdp->sd_log_tr = tr;
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index b041cb8ae383..ed77b10bdfb5 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -903,7 +903,7 @@ fail:
+ }
+
+ static const match_table_t nolock_tokens = {
+- { Opt_jid, "jid=%d\n", },
++ { Opt_jid, "jid=%d", },
+ { Opt_err, NULL },
+ };
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 668b648064b7..05cb68ca1ba1 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7624,7 +7624,7 @@ nfs4_bind_one_conn_to_session_done(struct rpc_task *task, void *calldata)
+ }
+
+ static const struct rpc_call_ops nfs4_bind_one_conn_to_session_ops = {
+- .rpc_call_done = &nfs4_bind_one_conn_to_session_done,
++ .rpc_call_done = nfs4_bind_one_conn_to_session_done,
+ };
+
+ /*
+diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
+index ebbb0285addb..7ee417b685e9 100644
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -1149,6 +1149,8 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb)
+ err = setup_callback_client(clp, &conn, ses);
+ if (err) {
+ nfsd4_mark_cb_down(clp, err);
++ if (c)
++ svc_xprt_put(c->cn_xprt);
+ return;
+ }
+ }
+diff --git a/include/linux/bitops.h b/include/linux/bitops.h
+index e02cbca3cfaf..5c1522ed2d7c 100644
+--- a/include/linux/bitops.h
++++ b/include/linux/bitops.h
+@@ -50,7 +50,7 @@ static inline int get_bitmask_order(unsigned int count)
+
+ static __always_inline unsigned long hweight_long(unsigned long w)
+ {
+- return sizeof(w) == 4 ? hweight32(w) : hweight64(w);
++ return sizeof(w) == 4 ? hweight32(w) : hweight64((__u64)w);
+ }
+
+ /**
+diff --git a/include/linux/elfnote.h b/include/linux/elfnote.h
+index f236f5b931b2..7fdd7f355b52 100644
+--- a/include/linux/elfnote.h
++++ b/include/linux/elfnote.h
+@@ -54,7 +54,7 @@
+ .popsection ;
+
+ #define ELFNOTE(name, type, desc) \
+- ELFNOTE_START(name, type, "") \
++ ELFNOTE_START(name, type, "a") \
+ desc ; \
+ ELFNOTE_END
+
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index f13272d84332..f993bc86f3ba 100644
+--- a/include/linux/genhd.h
++++ b/include/linux/genhd.h
+@@ -729,9 +729,11 @@ static inline sector_t part_nr_sects_read(struct hd_struct *part)
+ static inline void part_nr_sects_write(struct hd_struct *part, sector_t size)
+ {
+ #if BITS_PER_LONG==32 && defined(CONFIG_LBDAF) && defined(CONFIG_SMP)
++ preempt_disable();
+ write_seqcount_begin(&part->nr_sects_seq);
+ part->nr_sects = size;
+ write_seqcount_end(&part->nr_sects_seq);
++ preempt_enable();
+ #elif BITS_PER_LONG==32 && defined(CONFIG_LBDAF) && defined(CONFIG_PREEMPT)
+ preempt_disable();
+ part->nr_sects = size;
+diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
+index 9adb92ad24d3..9f22652d69bb 100644
+--- a/include/linux/kprobes.h
++++ b/include/linux/kprobes.h
+@@ -363,6 +363,10 @@ static inline struct kprobe_ctlblk *get_kprobe_ctlblk(void)
+ return this_cpu_ptr(&kprobe_ctlblk);
+ }
+
++extern struct kprobe kprobe_busy;
++void kprobe_busy_begin(void);
++void kprobe_busy_end(void);
++
+ kprobe_opcode_t *kprobe_lookup_name(const char *name, unsigned int offset);
+ int register_kprobe(struct kprobe *p);
+ void unregister_kprobe(struct kprobe *p);
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 75a916d7ab2a..ed1453c15041 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -38,6 +38,7 @@
+ #include <linux/acpi.h>
+ #include <linux/cdrom.h>
+ #include <linux/sched.h>
++#include <linux/async.h>
+
+ /*
+ * Define if arch has non-standard setup. This is a _PCI_ standard
+@@ -887,6 +888,8 @@ struct ata_port {
+ struct timer_list fastdrain_timer;
+ unsigned long fastdrain_cnt;
+
++ async_cookie_t cookie;
++
+ int em_message_type;
+ void *private_data;
+
+diff --git a/include/linux/mtd/rawnand.h b/include/linux/mtd/rawnand.h
+index efb2345359bb..a4be6b2bcc35 100644
+--- a/include/linux/mtd/rawnand.h
++++ b/include/linux/mtd/rawnand.h
+@@ -24,15 +24,16 @@
+ #include <linux/of.h>
+ #include <linux/types.h>
+
++struct nand_chip;
+ struct nand_flash_dev;
+
+ /* Scan and identify a NAND device */
+-int nand_scan_with_ids(struct mtd_info *mtd, int max_chips,
++int nand_scan_with_ids(struct nand_chip *chip, int max_chips,
+ struct nand_flash_dev *ids);
+
+-static inline int nand_scan(struct mtd_info *mtd, int max_chips)
++static inline int nand_scan(struct nand_chip *chip, int max_chips)
+ {
+- return nand_scan_with_ids(mtd, max_chips, NULL);
++ return nand_scan_with_ids(chip, max_chips, NULL);
+ }
+
+ /* Internal helper for board drivers which need to override command function */
+@@ -1740,7 +1741,7 @@ int nand_write_data_op(struct nand_chip *chip, const void *buf,
+ */
+ void nand_cleanup(struct nand_chip *chip);
+ /* Unregister the MTD device and calls nand_cleanup() */
+-void nand_release(struct mtd_info *mtd);
++void nand_release(struct nand_chip *chip);
+
+ /* Default extended ID decoding function */
+ void nand_decode_ext_id(struct nand_chip *chip);
+diff --git a/include/linux/usb/composite.h b/include/linux/usb/composite.h
+index 8675e145ea8b..2040696d75b6 100644
+--- a/include/linux/usb/composite.h
++++ b/include/linux/usb/composite.h
+@@ -249,6 +249,9 @@ int usb_function_activate(struct usb_function *);
+
+ int usb_interface_id(struct usb_configuration *, struct usb_function *);
+
++int config_ep_by_speed_and_alt(struct usb_gadget *g, struct usb_function *f,
++ struct usb_ep *_ep, u8 alt);
++
+ int config_ep_by_speed(struct usb_gadget *g, struct usb_function *f,
+ struct usb_ep *_ep);
+
+diff --git a/include/linux/usb/ehci_def.h b/include/linux/usb/ehci_def.h
+index a15ce99dfc2d..78e006355557 100644
+--- a/include/linux/usb/ehci_def.h
++++ b/include/linux/usb/ehci_def.h
+@@ -151,7 +151,7 @@ struct ehci_regs {
+ #define PORT_OWNER (1<<13) /* true: companion hc owns this port */
+ #define PORT_POWER (1<<12) /* true: has power (see PPC) */
+ #define PORT_USB11(x) (((x)&(3<<10)) == (1<<10)) /* USB 1.1 device */
+-/* 11:10 for detecting lowspeed devices (reset vs release ownership) */
++#define PORT_LS_MASK (3<<10) /* Link status (SE0, K or J */
+ /* 9 reserved */
+ #define PORT_LPM (1<<9) /* LPM transaction */
+ #define PORT_RESET (1<<8) /* reset port */
+diff --git a/include/uapi/linux/raid/md_p.h b/include/uapi/linux/raid/md_p.h
+index b0d15c73f6d7..1f2d8c81f0e0 100644
+--- a/include/uapi/linux/raid/md_p.h
++++ b/include/uapi/linux/raid/md_p.h
+@@ -329,6 +329,7 @@ struct mdp_superblock_1 {
+ #define MD_FEATURE_JOURNAL 512 /* support write cache */
+ #define MD_FEATURE_PPL 1024 /* support PPL */
+ #define MD_FEATURE_MULTIPLE_PPLS 2048 /* support for multiple PPLs */
++#define MD_FEATURE_RAID0_LAYOUT 4096 /* layout is meaningful for RAID0 */
+ #define MD_FEATURE_ALL (MD_FEATURE_BITMAP_OFFSET \
+ |MD_FEATURE_RECOVERY_OFFSET \
+ |MD_FEATURE_RESHAPE_ACTIVE \
+@@ -341,6 +342,7 @@ struct mdp_superblock_1 {
+ |MD_FEATURE_JOURNAL \
+ |MD_FEATURE_PPL \
+ |MD_FEATURE_MULTIPLE_PPLS \
++ |MD_FEATURE_RAID0_LAYOUT \
+ )
+
+ struct r5l_payload_header {
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 92aad49b82f9..97de04a52c9f 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -599,11 +599,12 @@ static void kprobe_optimizer(struct work_struct *work)
+ mutex_unlock(&module_mutex);
+ mutex_unlock(&text_mutex);
+ cpus_read_unlock();
+- mutex_unlock(&kprobe_mutex);
+
+ /* Step 5: Kick optimizer again if needed */
+ if (!list_empty(&optimizing_list) || !list_empty(&unoptimizing_list))
+ kick_kprobe_optimizer();
++
++ mutex_unlock(&kprobe_mutex);
+ }
+
+ /* Wait for completing optimization and unoptimization */
+@@ -1226,6 +1227,26 @@ __releases(hlist_lock)
+ }
+ NOKPROBE_SYMBOL(kretprobe_table_unlock);
+
++struct kprobe kprobe_busy = {
++ .addr = (void *) get_kprobe,
++};
++
++void kprobe_busy_begin(void)
++{
++ struct kprobe_ctlblk *kcb;
++
++ preempt_disable();
++ __this_cpu_write(current_kprobe, &kprobe_busy);
++ kcb = get_kprobe_ctlblk();
++ kcb->kprobe_status = KPROBE_HIT_ACTIVE;
++}
++
++void kprobe_busy_end(void)
++{
++ __this_cpu_write(current_kprobe, NULL);
++ preempt_enable();
++}
++
+ /*
+ * This function is called from finish_task_switch when task tk becomes dead,
+ * so that we can recycle any function-return probe instances associated
+@@ -1243,6 +1264,8 @@ void kprobe_flush_task(struct task_struct *tk)
+ /* Early boot. kretprobe_table_locks not yet initialized. */
+ return;
+
++ kprobe_busy_begin();
++
+ INIT_HLIST_HEAD(&empty_rp);
+ hash = hash_ptr(tk, KPROBE_HASH_BITS);
+ head = &kretprobe_inst_table[hash];
+@@ -1256,6 +1279,8 @@ void kprobe_flush_task(struct task_struct *tk)
+ hlist_del(&ri->hlist);
+ kfree(ri);
+ }
++
++ kprobe_busy_end();
+ }
+ NOKPROBE_SYMBOL(kprobe_flush_task);
+
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 6cea8bbca03c..b7e1e09a0bef 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -1004,8 +1004,10 @@ static void blk_add_trace_split(void *ignore,
+
+ __blk_add_trace(bt, bio->bi_iter.bi_sector,
+ bio->bi_iter.bi_size, bio_op(bio), bio->bi_opf,
+- BLK_TA_SPLIT, bio->bi_status, sizeof(rpdu),
+- &rpdu, blk_trace_bio_get_cgid(q, bio));
++ BLK_TA_SPLIT,
++ blk_status_to_errno(bio->bi_status),
++ sizeof(rpdu), &rpdu,
++ blk_trace_bio_get_cgid(q, bio));
+ }
+ rcu_read_unlock();
+ }
+@@ -1042,7 +1044,8 @@ static void blk_add_trace_bio_remap(void *ignore,
+ r.sector_from = cpu_to_be64(from);
+
+ __blk_add_trace(bt, bio->bi_iter.bi_sector, bio->bi_iter.bi_size,
+- bio_op(bio), bio->bi_opf, BLK_TA_REMAP, bio->bi_status,
++ bio_op(bio), bio->bi_opf, BLK_TA_REMAP,
++ blk_status_to_errno(bio->bi_status),
+ sizeof(r), &r, blk_trace_bio_get_cgid(q, bio));
+ rcu_read_unlock();
+ }
+@@ -1264,21 +1267,10 @@ static inline __u16 t_error(const struct trace_entry *ent)
+
+ static __u64 get_pdu_int(const struct trace_entry *ent, bool has_cg)
+ {
+- const __u64 *val = pdu_start(ent, has_cg);
++ const __be64 *val = pdu_start(ent, has_cg);
+ return be64_to_cpu(*val);
+ }
+
+-static void get_pdu_remap(const struct trace_entry *ent,
+- struct blk_io_trace_remap *r, bool has_cg)
+-{
+- const struct blk_io_trace_remap *__r = pdu_start(ent, has_cg);
+- __u64 sector_from = __r->sector_from;
+-
+- r->device_from = be32_to_cpu(__r->device_from);
+- r->device_to = be32_to_cpu(__r->device_to);
+- r->sector_from = be64_to_cpu(sector_from);
+-}
+-
+ typedef void (blk_log_action_t) (struct trace_iterator *iter, const char *act,
+ bool has_cg);
+
+@@ -1404,13 +1396,13 @@ static void blk_log_with_error(struct trace_seq *s,
+
+ static void blk_log_remap(struct trace_seq *s, const struct trace_entry *ent, bool has_cg)
+ {
+- struct blk_io_trace_remap r = { .device_from = 0, };
++ const struct blk_io_trace_remap *__r = pdu_start(ent, has_cg);
+
+- get_pdu_remap(ent, &r, has_cg);
+ trace_seq_printf(s, "%llu + %u <- (%d,%d) %llu\n",
+ t_sector(ent), t_sec(ent),
+- MAJOR(r.device_from), MINOR(r.device_from),
+- (unsigned long long)r.sector_from);
++ MAJOR(be32_to_cpu(__r->device_from)),
++ MINOR(be32_to_cpu(__r->device_from)),
++ be64_to_cpu(__r->sector_from));
+ }
+
+ static void blk_log_plug(struct trace_seq *s, const struct trace_entry *ent, bool has_cg)
+diff --git a/lib/zlib_inflate/inffast.c b/lib/zlib_inflate/inffast.c
+index 2c13ecc5bb2c..ed1f3df27260 100644
+--- a/lib/zlib_inflate/inffast.c
++++ b/lib/zlib_inflate/inffast.c
+@@ -10,17 +10,6 @@
+
+ #ifndef ASMINF
+
+-/* Allow machine dependent optimization for post-increment or pre-increment.
+- Based on testing to date,
+- Pre-increment preferred for:
+- - PowerPC G3 (Adler)
+- - MIPS R5000 (Randers-Pehrson)
+- Post-increment preferred for:
+- - none
+- No measurable difference:
+- - Pentium III (Anderson)
+- - M68060 (Nikl)
+- */
+ union uu {
+ unsigned short us;
+ unsigned char b[2];
+@@ -38,16 +27,6 @@ get_unaligned16(const unsigned short *p)
+ return mm.us;
+ }
+
+-#ifdef POSTINC
+-# define OFF 0
+-# define PUP(a) *(a)++
+-# define UP_UNALIGNED(a) get_unaligned16((a)++)
+-#else
+-# define OFF 1
+-# define PUP(a) *++(a)
+-# define UP_UNALIGNED(a) get_unaligned16(++(a))
+-#endif
+-
+ /*
+ Decode literal, length, and distance codes and write out the resulting
+ literal and match bytes until either not enough input or output is
+@@ -115,9 +94,9 @@ void inflate_fast(z_streamp strm, unsigned start)
+
+ /* copy state to local variables */
+ state = (struct inflate_state *)strm->state;
+- in = strm->next_in - OFF;
++ in = strm->next_in;
+ last = in + (strm->avail_in - 5);
+- out = strm->next_out - OFF;
++ out = strm->next_out;
+ beg = out - (start - strm->avail_out);
+ end = out + (strm->avail_out - 257);
+ #ifdef INFLATE_STRICT
+@@ -138,9 +117,9 @@ void inflate_fast(z_streamp strm, unsigned start)
+ input data or output space */
+ do {
+ if (bits < 15) {
+- hold += (unsigned long)(PUP(in)) << bits;
++ hold += (unsigned long)(*in++) << bits;
+ bits += 8;
+- hold += (unsigned long)(PUP(in)) << bits;
++ hold += (unsigned long)(*in++) << bits;
+ bits += 8;
+ }
+ this = lcode[hold & lmask];
+@@ -150,14 +129,14 @@ void inflate_fast(z_streamp strm, unsigned start)
+ bits -= op;
+ op = (unsigned)(this.op);
+ if (op == 0) { /* literal */
+- PUP(out) = (unsigned char)(this.val);
++ *out++ = (unsigned char)(this.val);
+ }
+ else if (op & 16) { /* length base */
+ len = (unsigned)(this.val);
+ op &= 15; /* number of extra bits */
+ if (op) {
+ if (bits < op) {
+- hold += (unsigned long)(PUP(in)) << bits;
++ hold += (unsigned long)(*in++) << bits;
+ bits += 8;
+ }
+ len += (unsigned)hold & ((1U << op) - 1);
+@@ -165,9 +144,9 @@ void inflate_fast(z_streamp strm, unsigned start)
+ bits -= op;
+ }
+ if (bits < 15) {
+- hold += (unsigned long)(PUP(in)) << bits;
++ hold += (unsigned long)(*in++) << bits;
+ bits += 8;
+- hold += (unsigned long)(PUP(in)) << bits;
++ hold += (unsigned long)(*in++) << bits;
+ bits += 8;
+ }
+ this = dcode[hold & dmask];
+@@ -180,10 +159,10 @@ void inflate_fast(z_streamp strm, unsigned start)
+ dist = (unsigned)(this.val);
+ op &= 15; /* number of extra bits */
+ if (bits < op) {
+- hold += (unsigned long)(PUP(in)) << bits;
++ hold += (unsigned long)(*in++) << bits;
+ bits += 8;
+ if (bits < op) {
+- hold += (unsigned long)(PUP(in)) << bits;
++ hold += (unsigned long)(*in++) << bits;
+ bits += 8;
+ }
+ }
+@@ -205,13 +184,13 @@ void inflate_fast(z_streamp strm, unsigned start)
+ state->mode = BAD;
+ break;
+ }
+- from = window - OFF;
++ from = window;
+ if (write == 0) { /* very common case */
+ from += wsize - op;
+ if (op < len) { /* some from window */
+ len -= op;
+ do {
+- PUP(out) = PUP(from);
++ *out++ = *from++;
+ } while (--op);
+ from = out - dist; /* rest from output */
+ }
+@@ -222,14 +201,14 @@ void inflate_fast(z_streamp strm, unsigned start)
+ if (op < len) { /* some from end of window */
+ len -= op;
+ do {
+- PUP(out) = PUP(from);
++ *out++ = *from++;
+ } while (--op);
+- from = window - OFF;
++ from = window;
+ if (write < len) { /* some from start of window */
+ op = write;
+ len -= op;
+ do {
+- PUP(out) = PUP(from);
++ *out++ = *from++;
+ } while (--op);
+ from = out - dist; /* rest from output */
+ }
+@@ -240,21 +219,21 @@ void inflate_fast(z_streamp strm, unsigned start)
+ if (op < len) { /* some from window */
+ len -= op;
+ do {
+- PUP(out) = PUP(from);
++ *out++ = *from++;
+ } while (--op);
+ from = out - dist; /* rest from output */
+ }
+ }
+ while (len > 2) {
+- PUP(out) = PUP(from);
+- PUP(out) = PUP(from);
+- PUP(out) = PUP(from);
++ *out++ = *from++;
++ *out++ = *from++;
++ *out++ = *from++;
+ len -= 3;
+ }
+ if (len) {
+- PUP(out) = PUP(from);
++ *out++ = *from++;
+ if (len > 1)
+- PUP(out) = PUP(from);
++ *out++ = *from++;
+ }
+ }
+ else {
+@@ -264,29 +243,29 @@ void inflate_fast(z_streamp strm, unsigned start)
+ from = out - dist; /* copy direct from output */
+ /* minimum length is three */
+ /* Align out addr */
+- if (!((long)(out - 1 + OFF) & 1)) {
+- PUP(out) = PUP(from);
++ if (!((long)(out - 1) & 1)) {
++ *out++ = *from++;
+ len--;
+ }
+- sout = (unsigned short *)(out - OFF);
++ sout = (unsigned short *)(out);
+ if (dist > 2) {
+ unsigned short *sfrom;
+
+- sfrom = (unsigned short *)(from - OFF);
++ sfrom = (unsigned short *)(from);
+ loops = len >> 1;
+ do
+ #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+- PUP(sout) = PUP(sfrom);
++ *sout++ = *sfrom++;
+ #else
+- PUP(sout) = UP_UNALIGNED(sfrom);
++ *sout++ = get_unaligned16(sfrom++);
+ #endif
+ while (--loops);
+- out = (unsigned char *)sout + OFF;
+- from = (unsigned char *)sfrom + OFF;
++ out = (unsigned char *)sout;
++ from = (unsigned char *)sfrom;
+ } else { /* dist == 1 or dist == 2 */
+ unsigned short pat16;
+
+- pat16 = *(sout-1+OFF);
++ pat16 = *(sout-1);
+ if (dist == 1) {
+ union uu mm;
+ /* copy one char pattern to both bytes */
+@@ -296,12 +275,12 @@ void inflate_fast(z_streamp strm, unsigned start)
+ }
+ loops = len >> 1;
+ do
+- PUP(sout) = pat16;
++ *sout++ = pat16;
+ while (--loops);
+- out = (unsigned char *)sout + OFF;
++ out = (unsigned char *)sout;
+ }
+ if (len & 1)
+- PUP(out) = PUP(from);
++ *out++ = *from++;
+ }
+ }
+ else if ((op & 64) == 0) { /* 2nd level distance code */
+@@ -336,8 +315,8 @@ void inflate_fast(z_streamp strm, unsigned start)
+ hold &= (1U << bits) - 1;
+
+ /* update state and return */
+- strm->next_in = in + OFF;
+- strm->next_out = out + OFF;
++ strm->next_in = in;
++ strm->next_out = out;
+ strm->avail_in = (unsigned)(in < last ? 5 + (last - in) : 5 - (in - last));
+ strm->avail_out = (unsigned)(out < end ?
+ 257 + (end - out) : 257 - (out - end));
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 50498a75c04b..1618d5a676c4 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -83,6 +83,7 @@
+ #include <linux/sched.h>
+ #include <linux/sched/mm.h>
+ #include <linux/mutex.h>
++#include <linux/rwsem.h>
+ #include <linux/string.h>
+ #include <linux/mm.h>
+ #include <linux/socket.h>
+@@ -195,7 +196,7 @@ static DEFINE_SPINLOCK(napi_hash_lock);
+ static unsigned int napi_gen_id = NR_CPUS;
+ static DEFINE_READ_MOSTLY_HASHTABLE(napi_hash, 8);
+
+-static seqcount_t devnet_rename_seq;
++static DECLARE_RWSEM(devnet_rename_sem);
+
+ static inline void dev_base_seq_inc(struct net *net)
+ {
+@@ -899,33 +900,28 @@ EXPORT_SYMBOL(dev_get_by_napi_id);
+ * @net: network namespace
+ * @name: a pointer to the buffer where the name will be stored.
+ * @ifindex: the ifindex of the interface to get the name from.
+- *
+- * The use of raw_seqcount_begin() and cond_resched() before
+- * retrying is required as we want to give the writers a chance
+- * to complete when CONFIG_PREEMPT is not set.
+ */
+ int netdev_get_name(struct net *net, char *name, int ifindex)
+ {
+ struct net_device *dev;
+- unsigned int seq;
++ int ret;
+
+-retry:
+- seq = raw_seqcount_begin(&devnet_rename_seq);
++ down_read(&devnet_rename_sem);
+ rcu_read_lock();
++
+ dev = dev_get_by_index_rcu(net, ifindex);
+ if (!dev) {
+- rcu_read_unlock();
+- return -ENODEV;
++ ret = -ENODEV;
++ goto out;
+ }
+
+ strcpy(name, dev->name);
+- rcu_read_unlock();
+- if (read_seqcount_retry(&devnet_rename_seq, seq)) {
+- cond_resched();
+- goto retry;
+- }
+
+- return 0;
++ ret = 0;
++out:
++ rcu_read_unlock();
++ up_read(&devnet_rename_sem);
++ return ret;
+ }
+
+ /**
+@@ -1198,10 +1194,10 @@ int dev_change_name(struct net_device *dev, const char *newname)
+ likely(!(dev->priv_flags & IFF_LIVE_RENAME_OK)))
+ return -EBUSY;
+
+- write_seqcount_begin(&devnet_rename_seq);
++ down_write(&devnet_rename_sem);
+
+ if (strncmp(newname, dev->name, IFNAMSIZ) == 0) {
+- write_seqcount_end(&devnet_rename_seq);
++ up_write(&devnet_rename_sem);
+ return 0;
+ }
+
+@@ -1209,7 +1205,7 @@ int dev_change_name(struct net_device *dev, const char *newname)
+
+ err = dev_get_valid_name(net, dev, newname);
+ if (err < 0) {
+- write_seqcount_end(&devnet_rename_seq);
++ up_write(&devnet_rename_sem);
+ return err;
+ }
+
+@@ -1224,11 +1220,11 @@ rollback:
+ if (ret) {
+ memcpy(dev->name, oldname, IFNAMSIZ);
+ dev->name_assign_type = old_assign_type;
+- write_seqcount_end(&devnet_rename_seq);
++ up_write(&devnet_rename_sem);
+ return ret;
+ }
+
+- write_seqcount_end(&devnet_rename_seq);
++ up_write(&devnet_rename_sem);
+
+ netdev_adjacent_rename_links(dev, oldname);
+
+@@ -1249,7 +1245,7 @@ rollback:
+ /* err >= 0 after dev_alloc_name() or stores the first errno */
+ if (err >= 0) {
+ err = ret;
+- write_seqcount_begin(&devnet_rename_seq);
++ down_write(&devnet_rename_sem);
+ memcpy(dev->name, oldname, IFNAMSIZ);
+ memcpy(oldname, newname, IFNAMSIZ);
+ dev->name_assign_type = old_assign_type;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 40b3af05c883..b5521b60a2d4 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -1730,25 +1730,27 @@ BPF_CALL_5(bpf_skb_load_bytes_relative, const struct sk_buff *, skb,
+ u32, offset, void *, to, u32, len, u32, start_header)
+ {
+ u8 *end = skb_tail_pointer(skb);
+- u8 *net = skb_network_header(skb);
+- u8 *mac = skb_mac_header(skb);
+- u8 *ptr;
++ u8 *start, *ptr;
+
+- if (unlikely(offset > 0xffff || len > (end - mac)))
++ if (unlikely(offset > 0xffff))
+ goto err_clear;
+
+ switch (start_header) {
+ case BPF_HDR_START_MAC:
+- ptr = mac + offset;
++ if (unlikely(!skb_mac_header_was_set(skb)))
++ goto err_clear;
++ start = skb_mac_header(skb);
+ break;
+ case BPF_HDR_START_NET:
+- ptr = net + offset;
++ start = skb_network_header(skb);
+ break;
+ default:
+ goto err_clear;
+ }
+
+- if (likely(ptr >= mac && ptr + len <= end)) {
++ ptr = start + offset;
++
++ if (likely(ptr + len <= end)) {
+ memcpy(to, ptr, len);
+ return 0;
+ }
+diff --git a/net/rxrpc/proc.c b/net/rxrpc/proc.c
+index 9805e3b85c36..81a765dd8c9b 100644
+--- a/net/rxrpc/proc.c
++++ b/net/rxrpc/proc.c
+@@ -72,7 +72,7 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
+ "Proto Local "
+ " Remote "
+ " SvID ConnID CallID End Use State Abort "
+- " UserID TxSeq TW RxSeq RW RxSerial RxTimo\n");
++ " DebugId TxSeq TW RxSeq RW RxSerial RxTimo\n");
+ return 0;
+ }
+
+@@ -104,7 +104,7 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
+ rx_hard_ack = READ_ONCE(call->rx_hard_ack);
+ seq_printf(seq,
+ "UDP %-47.47s %-47.47s %4x %08x %08x %s %3u"
+- " %-8.8s %08x %lx %08x %02x %08x %02x %08x %06lx\n",
++ " %-8.8s %08x %08x %08x %02x %08x %02x %08x %06lx\n",
+ lbuff,
+ rbuff,
+ call->service_id,
+@@ -114,7 +114,7 @@ static int rxrpc_call_seq_show(struct seq_file *seq, void *v)
+ atomic_read(&call->usage),
+ rxrpc_call_states[call->state],
+ call->abort_code,
+- call->user_call_ID,
++ call->debug_id,
+ tx_hard_ack, READ_ONCE(call->tx_top) - tx_hard_ack,
+ rx_hard_ack, READ_ONCE(call->rx_top) - rx_hard_ack,
+ call->rx_serial,
+diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
+index 2e0a6f92e563..8391c2785550 100644
+--- a/net/sunrpc/addr.c
++++ b/net/sunrpc/addr.c
+@@ -81,11 +81,11 @@ static size_t rpc_ntop6(const struct sockaddr *sap,
+
+ rc = snprintf(scopebuf, sizeof(scopebuf), "%c%u",
+ IPV6_SCOPE_DELIMITER, sin6->sin6_scope_id);
+- if (unlikely((size_t)rc > sizeof(scopebuf)))
++ if (unlikely((size_t)rc >= sizeof(scopebuf)))
+ return 0;
+
+ len += rc;
+- if (unlikely(len > buflen))
++ if (unlikely(len >= buflen))
+ return 0;
+
+ strcat(buf, scopebuf);
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 72caa4fb13f4..9ff2ab63e639 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -233,10 +233,8 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
+
+ len = desc.len;
+ skb = sock_alloc_send_skb(sk, len, 1, &err);
+- if (unlikely(!skb)) {
+- err = -EAGAIN;
++ if (unlikely(!skb))
+ goto out;
+- }
+
+ skb_put(skb, len);
+ addr = desc.addr;
+diff --git a/scripts/mksysmap b/scripts/mksysmap
+index a35acc0d0b82..9aa23d15862a 100755
+--- a/scripts/mksysmap
++++ b/scripts/mksysmap
+@@ -41,4 +41,4 @@
+ # so we just ignore them to let readprofile continue to work.
+ # (At least sparc64 has __crc_ in the middle).
+
+-$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( .L\)' > $2
++$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)' > $2
+diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
+index b9d5b3459705..13b33490e079 100644
+--- a/security/apparmor/domain.c
++++ b/security/apparmor/domain.c
+@@ -939,7 +939,8 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
+ * aways results in a further reduction of permissions.
+ */
+ if ((bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) &&
+- !unconfined(label) && !aa_label_is_subset(new, ctx->nnp)) {
++ !unconfined(label) &&
++ !aa_label_is_unconfined_subset(new, ctx->nnp)) {
+ error = -EPERM;
+ info = "no new privs";
+ goto audit;
+@@ -1217,7 +1218,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, int flags)
+ * reduce restrictions.
+ */
+ if (task_no_new_privs(current) && !unconfined(label) &&
+- !aa_label_is_subset(new, ctx->nnp)) {
++ !aa_label_is_unconfined_subset(new, ctx->nnp)) {
+ /* not an apparmor denial per se, so don't log it */
+ AA_DEBUG("no_new_privs - change_hat denied");
+ error = -EPERM;
+@@ -1238,7 +1239,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, int flags)
+ * reduce restrictions.
+ */
+ if (task_no_new_privs(current) && !unconfined(label) &&
+- !aa_label_is_subset(previous, ctx->nnp)) {
++ !aa_label_is_unconfined_subset(previous, ctx->nnp)) {
+ /* not an apparmor denial per se, so don't log it */
+ AA_DEBUG("no_new_privs - change_hat denied");
+ error = -EPERM;
+@@ -1433,7 +1434,7 @@ check:
+ * reduce restrictions.
+ */
+ if (task_no_new_privs(current) && !unconfined(label) &&
+- !aa_label_is_subset(new, ctx->nnp)) {
++ !aa_label_is_unconfined_subset(new, ctx->nnp)) {
+ /* not an apparmor denial per se, so don't log it */
+ AA_DEBUG("no_new_privs - change_hat denied");
+ error = -EPERM;
+diff --git a/security/apparmor/include/label.h b/security/apparmor/include/label.h
+index 7ce5fe73ae7f..cecbd3f5429c 100644
+--- a/security/apparmor/include/label.h
++++ b/security/apparmor/include/label.h
+@@ -285,6 +285,7 @@ bool aa_label_init(struct aa_label *label, int size, gfp_t gfp);
+ struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp);
+
+ bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub);
++bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub);
+ struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
+ struct aa_label *set,
+ struct aa_label *sub);
+diff --git a/security/apparmor/label.c b/security/apparmor/label.c
+index 2469549842d2..6727e6fb69df 100644
+--- a/security/apparmor/label.c
++++ b/security/apparmor/label.c
+@@ -554,6 +554,39 @@ bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
+ return __aa_label_next_not_in_set(&i, set, sub) == NULL;
+ }
+
++/**
++ * aa_label_is_unconfined_subset - test if @sub is a subset of @set
++ * @set: label to test against
++ * @sub: label to test if is subset of @set
++ *
++ * This checks for subset but taking into account unconfined. IF
++ * @sub contains an unconfined profile that does not have a matching
++ * unconfined in @set then this will not cause the test to fail.
++ * Conversely we don't care about an unconfined in @set that is not in
++ * @sub
++ *
++ * Returns: true if @sub is special_subset of @set
++ * else false
++ */
++bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
++{
++ struct label_it i = { };
++ struct aa_profile *p;
++
++ AA_BUG(!set);
++ AA_BUG(!sub);
++
++ if (sub == set)
++ return true;
++
++ do {
++ p = __aa_label_next_not_in_set(&i, set, sub);
++ if (p && !profile_unconfined(p))
++ break;
++ } while (p);
++
++ return p == NULL;
++}
+
+
+ /**
+@@ -1535,13 +1568,13 @@ static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
+
+ label_for_each(i, label, profile) {
+ if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
+- if (profile->mode == APPARMOR_UNCONFINED)
++ count++;
++ if (profile == profile->ns->unconfined)
+ /* special case unconfined so stacks with
+ * unconfined don't report as mixed. ie.
+ * profile_foo//&:ns1:unconfined (mixed)
+ */
+ continue;
+- count++;
+ if (mode == -1)
+ mode = profile->mode;
+ else if (mode != profile->mode)
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index 730de4638b4e..5e32fe434140 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -797,7 +797,12 @@ static void apparmor_sk_clone_security(const struct sock *sk,
+ struct aa_sk_ctx *ctx = SK_CTX(sk);
+ struct aa_sk_ctx *new = SK_CTX(newsk);
+
++ if (new->label)
++ aa_put_label(new->label);
+ new->label = aa_get_label(ctx->label);
++
++ if (new->peer)
++ aa_put_label(new->peer);
+ new->peer = aa_get_label(ctx->peer);
+ }
+
+diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
+index f3def298a90e..a9f2bc8443bd 100644
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -2857,8 +2857,12 @@ err:
+ if (*names) {
+ for (i = 0; i < *len; i++)
+ kfree((*names)[i]);
++ kfree(*names);
+ }
+ kfree(*values);
++ *len = 0;
++ *names = NULL;
++ *values = NULL;
+ goto out;
+ }
+
+diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
+index 0b1e4b34b299..13c8e6542a2f 100644
+--- a/sound/isa/wavefront/wavefront_synth.c
++++ b/sound/isa/wavefront/wavefront_synth.c
+@@ -1175,7 +1175,10 @@ wavefront_send_alias (snd_wavefront_t *dev, wavefront_patch_info *header)
+ "alias for %d\n",
+ header->number,
+ header->hdr.a.OriginalSample);
+-
++
++ if (header->number >= WF_MAX_SAMPLE)
++ return -EINVAL;
++
+ munge_int32 (header->number, &alias_hdr[0], 2);
+ munge_int32 (header->hdr.a.OriginalSample, &alias_hdr[2], 2);
+ munge_int32 (*((unsigned int *)&header->hdr.a.sampleStartOffset),
+@@ -1206,6 +1209,9 @@ wavefront_send_multisample (snd_wavefront_t *dev, wavefront_patch_info *header)
+ int num_samples;
+ unsigned char *msample_hdr;
+
++ if (header->number >= WF_MAX_SAMPLE)
++ return -EINVAL;
++
+ msample_hdr = kmalloc(WF_MSAMPLE_BYTES, GFP_KERNEL);
+ if (! msample_hdr)
+ return -ENOMEM;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b4f802013f74..623ebe2e7db4 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -94,6 +94,7 @@ struct alc_spec {
+
+ /* mute LED for HP laptops, see alc269_fixup_mic_mute_hook() */
+ int mute_led_polarity;
++ int micmute_led_polarity;
+ hda_nid_t mute_led_nid;
+ hda_nid_t cap_mute_led_nid;
+
+@@ -3862,11 +3863,9 @@ static void alc269_fixup_hp_mute_led_mic3(struct hda_codec *codec,
+
+ /* update LED status via GPIO */
+ static void alc_update_gpio_led(struct hda_codec *codec, unsigned int mask,
+- bool enabled)
++ int polarity, bool enabled)
+ {
+- struct alc_spec *spec = codec->spec;
+-
+- if (spec->mute_led_polarity)
++ if (polarity)
+ enabled = !enabled;
+ alc_update_gpio_data(codec, mask, !enabled); /* muted -> LED on */
+ }
+@@ -3877,7 +3876,8 @@ static void alc_fixup_gpio_mute_hook(void *private_data, int enabled)
+ struct hda_codec *codec = private_data;
+ struct alc_spec *spec = codec->spec;
+
+- alc_update_gpio_led(codec, spec->gpio_mute_led_mask, enabled);
++ alc_update_gpio_led(codec, spec->gpio_mute_led_mask,
++ spec->mute_led_polarity, enabled);
+ }
+
+ /* turn on/off mic-mute LED via GPIO per capture hook */
+@@ -3886,6 +3886,7 @@ static void alc_gpio_micmute_update(struct hda_codec *codec)
+ struct alc_spec *spec = codec->spec;
+
+ alc_update_gpio_led(codec, spec->gpio_mic_led_mask,
++ spec->micmute_led_polarity,
+ spec->gen.micmute_led.led_value);
+ }
+
+@@ -5476,7 +5477,8 @@ static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
+
+ snd_hda_gen_hp_automute(codec, jack);
+ /* mute_led_polarity is set to 0, so we pass inverted value here */
+- alc_update_gpio_led(codec, 0x10, !spec->gen.hp_jack_present);
++ alc_update_gpio_led(codec, 0x10, spec->mute_led_polarity,
++ !spec->gen.hp_jack_present);
+ }
+
+ /* Manage GPIOs for HP EliteBook Folio 9480m.
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index 7e3b47eeea04..9185bd7c5a6d 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3656,6 +3656,12 @@ static const struct rt5645_platform_data asus_t100ha_platform_data = {
+ .inv_jd1_1 = true,
+ };
+
++static const struct rt5645_platform_data asus_t101ha_platform_data = {
++ .dmic1_data_pin = RT5645_DMIC_DATA_IN2N,
++ .dmic2_data_pin = RT5645_DMIC2_DISABLE,
++ .jd_mode = 3,
++};
++
+ static const struct rt5645_platform_data lenovo_ideapad_miix_310_pdata = {
+ .jd_mode = 3,
+ .in2_diff = true,
+@@ -3733,6 +3739,14 @@ static const struct dmi_system_id dmi_platform_data[] = {
+ },
+ .driver_data = (void *)&asus_t100ha_platform_data,
+ },
++ {
++ .ident = "ASUS T101HA",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "T101HA"),
++ },
++ .driver_data = (void *)&asus_t101ha_platform_data,
++ },
+ {
+ .ident = "MINIX Z83-4",
+ .matches = {
+diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
+index 14ab16e1369f..1203de8aab99 100644
+--- a/sound/soc/davinci/davinci-mcasp.c
++++ b/sound/soc/davinci/davinci-mcasp.c
+@@ -1758,8 +1758,10 @@ static int davinci_mcasp_get_dma_type(struct davinci_mcasp *mcasp)
+ PTR_ERR(chan));
+ return PTR_ERR(chan);
+ }
+- if (WARN_ON(!chan->device || !chan->device->dev))
++ if (WARN_ON(!chan->device || !chan->device->dev)) {
++ dma_release_channel(chan);
+ return -EINVAL;
++ }
+
+ if (chan->device->dev->of_node)
+ ret = of_property_read_string(chan->device->dev->of_node,
+diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c
+index 1033ac6631b0..b9ac448989ed 100644
+--- a/sound/soc/fsl/fsl_asrc_dma.c
++++ b/sound/soc/fsl/fsl_asrc_dma.c
+@@ -241,6 +241,7 @@ static int fsl_asrc_dma_hw_params(struct snd_pcm_substream *substream,
+ ret = dmaengine_slave_config(pair->dma_chan[dir], &config_be);
+ if (ret) {
+ dev_err(dev, "failed to config DMA channel for Back-End\n");
++ dma_release_channel(pair->dma_chan[dir]);
+ return ret;
+ }
+
+diff --git a/sound/soc/img/img-i2s-in.c b/sound/soc/img/img-i2s-in.c
+index 388cefd7340a..c22880aea82a 100644
+--- a/sound/soc/img/img-i2s-in.c
++++ b/sound/soc/img/img-i2s-in.c
+@@ -485,6 +485,7 @@ static int img_i2s_in_probe(struct platform_device *pdev)
+ if (IS_ERR(rst)) {
+ if (PTR_ERR(rst) == -EPROBE_DEFER) {
+ ret = -EPROBE_DEFER;
++ pm_runtime_put(&pdev->dev);
+ goto err_suspend;
+ }
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index f29014a7d672..0dcd249877c5 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -712,6 +712,30 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Toshiba Encore WT8-A */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "TOSHIBA WT8-A"),
++ },
++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_JD_NOT_INV |
++ BYT_RT5640_MCLK_EN),
++ },
++ { /* Toshiba Encore WT10-A */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "TOSHIBA WT10-A-103"),
++ },
++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP |
++ BYT_RT5640_JD_SRC_JD1_IN4P |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_SSP0_AIF2 |
++ BYT_RT5640_MCLK_EN),
++ },
+ { /* Catch-all for generic Insyde tablets, must be last */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
+diff --git a/sound/soc/meson/axg-fifo.c b/sound/soc/meson/axg-fifo.c
+index 0e4f65e654c4..b229c182b7c3 100644
+--- a/sound/soc/meson/axg-fifo.c
++++ b/sound/soc/meson/axg-fifo.c
+@@ -209,7 +209,7 @@ static int axg_fifo_pcm_open(struct snd_pcm_substream *ss)
+ /* Enable pclk to access registers and clock the fifo ip */
+ ret = clk_prepare_enable(fifo->pclk);
+ if (ret)
+- return ret;
++ goto free_irq;
+
+ /* Setup status2 so it reports the memory pointer */
+ regmap_update_bits(fifo->map, FIFO_CTRL1,
+@@ -229,8 +229,14 @@ static int axg_fifo_pcm_open(struct snd_pcm_substream *ss)
+ /* Take memory arbitror out of reset */
+ ret = reset_control_deassert(fifo->arb);
+ if (ret)
+- clk_disable_unprepare(fifo->pclk);
++ goto free_clk;
++
++ return 0;
+
++free_clk:
++ clk_disable_unprepare(fifo->pclk);
++free_irq:
++ free_irq(fifo->irq, ss);
+ return ret;
+ }
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index e45dfcb62b6a..595fe20bbc6d 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1920,9 +1920,25 @@ static void soc_check_tplg_fes(struct snd_soc_card *card)
+ dai_link->platform_name = component->name;
+
+ /* convert non BE into BE */
+- dai_link->no_pcm = 1;
+- dai_link->dpcm_playback = 1;
+- dai_link->dpcm_capture = 1;
++ if (!dai_link->no_pcm) {
++ dai_link->no_pcm = 1;
++
++ if (dai_link->dpcm_playback)
++ dev_warn(card->dev,
++ "invalid configuration, dailink %s has flags no_pcm=0 and dpcm_playback=1\n",
++ dai_link->name);
++ if (dai_link->dpcm_capture)
++ dev_warn(card->dev,
++ "invalid configuration, dailink %s has flags no_pcm=0 and dpcm_capture=1\n",
++ dai_link->name);
++
++ /* convert normal link into DPCM one */
++ if (!(dai_link->dpcm_playback ||
++ dai_link->dpcm_capture)) {
++ dai_link->dpcm_playback = !dai_link->capture_only;
++ dai_link->dpcm_capture = !dai_link->playback_only;
++ }
++ }
+
+ /* override any BE fixups */
+ dai_link->be_hw_params_fixup =
+diff --git a/sound/soc/tegra/tegra_wm8903.c b/sound/soc/tegra/tegra_wm8903.c
+index 69bc9461974b..301850df368d 100644
+--- a/sound/soc/tegra/tegra_wm8903.c
++++ b/sound/soc/tegra/tegra_wm8903.c
+@@ -173,6 +173,7 @@ static int tegra_wm8903_init(struct snd_soc_pcm_runtime *rtd)
+ struct snd_soc_component *component = codec_dai->component;
+ struct snd_soc_card *card = rtd->card;
+ struct tegra_wm8903 *machine = snd_soc_card_get_drvdata(card);
++ int shrt = 0;
+
+ if (gpio_is_valid(machine->gpio_hp_det)) {
+ tegra_wm8903_hp_jack_gpio.gpio = machine->gpio_hp_det;
+@@ -185,12 +186,15 @@ static int tegra_wm8903_init(struct snd_soc_pcm_runtime *rtd)
+ &tegra_wm8903_hp_jack_gpio);
+ }
+
++ if (of_property_read_bool(card->dev->of_node, "nvidia,headset"))
++ shrt = SND_JACK_MICROPHONE;
++
+ snd_soc_card_jack_new(rtd->card, "Mic Jack", SND_JACK_MICROPHONE,
+ &tegra_wm8903_mic_jack,
+ tegra_wm8903_mic_jack_pins,
+ ARRAY_SIZE(tegra_wm8903_mic_jack_pins));
+ wm8903_mic_detect(component, &tegra_wm8903_mic_jack, SND_JACK_MICROPHONE,
+- 0);
++ shrt);
+
+ snd_soc_dapm_force_enable_pin(&card->dapm, "MICBIAS");
+
+diff --git a/sound/usb/card.h b/sound/usb/card.h
+index 7f11655bde50..36198ddb4754 100644
+--- a/sound/usb/card.h
++++ b/sound/usb/card.h
+@@ -83,6 +83,10 @@ struct snd_usb_endpoint {
+ dma_addr_t sync_dma; /* DMA address of syncbuf */
+
+ unsigned int pipe; /* the data i/o pipe */
++ unsigned int framesize[2]; /* small/large frame sizes in samples */
++ unsigned int sample_rem; /* remainder from division fs/fps */
++ unsigned int sample_accum; /* sample accumulator */
++ unsigned int fps; /* frames per second */
+ unsigned int freqn; /* nominal sampling rate in fs/fps in Q16.16 format */
+ unsigned int freqm; /* momentary sampling rate in fs/fps in Q16.16 format */
+ int freqshift; /* how much to shift the feedback value to get Q16.16 */
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index aeb74cc6ceff..48611849b79b 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -137,12 +137,12 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep)
+
+ /*
+ * For streaming based on information derived from sync endpoints,
+- * prepare_outbound_urb_sizes() will call next_packet_size() to
++ * prepare_outbound_urb_sizes() will call slave_next_packet_size() to
+ * determine the number of samples to be sent in the next packet.
+ *
+- * For implicit feedback, next_packet_size() is unused.
++ * For implicit feedback, slave_next_packet_size() is unused.
+ */
+-int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
++int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep)
+ {
+ unsigned long flags;
+ int ret;
+@@ -159,6 +159,29 @@ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
+ return ret;
+ }
+
++/*
++ * For adaptive and synchronous endpoints, prepare_outbound_urb_sizes()
++ * will call next_packet_size() to determine the number of samples to be
++ * sent in the next packet.
++ */
++int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
++{
++ int ret;
++
++ if (ep->fill_max)
++ return ep->maxframesize;
++
++ ep->sample_accum += ep->sample_rem;
++ if (ep->sample_accum >= ep->fps) {
++ ep->sample_accum -= ep->fps;
++ ret = ep->framesize[1];
++ } else {
++ ret = ep->framesize[0];
++ }
++
++ return ret;
++}
++
+ static void retire_outbound_urb(struct snd_usb_endpoint *ep,
+ struct snd_urb_ctx *urb_ctx)
+ {
+@@ -203,6 +226,8 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+
+ if (ctx->packet_size[i])
+ counts = ctx->packet_size[i];
++ else if (ep->sync_master)
++ counts = snd_usb_endpoint_slave_next_packet_size(ep);
+ else
+ counts = snd_usb_endpoint_next_packet_size(ep);
+
+@@ -334,17 +359,17 @@ static void queue_pending_output_urbs(struct snd_usb_endpoint *ep)
+ ep->next_packet_read_pos %= MAX_URBS;
+
+ /* take URB out of FIFO */
+- if (!list_empty(&ep->ready_playback_urbs))
++ if (!list_empty(&ep->ready_playback_urbs)) {
+ ctx = list_first_entry(&ep->ready_playback_urbs,
+ struct snd_urb_ctx, ready_list);
++ list_del_init(&ctx->ready_list);
++ }
+ }
+ spin_unlock_irqrestore(&ep->lock, flags);
+
+ if (ctx == NULL)
+ return;
+
+- list_del_init(&ctx->ready_list);
+-
+ /* copy over the length information */
+ for (i = 0; i < packet->packets; i++)
+ ctx->packet_size[i] = packet->packet_size[i];
+@@ -887,10 +912,17 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
+ ep->maxpacksize = fmt->maxpacksize;
+ ep->fill_max = !!(fmt->attributes & UAC_EP_CS_ATTR_FILL_MAX);
+
+- if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL)
++ if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) {
+ ep->freqn = get_usb_full_speed_rate(rate);
+- else
++ ep->fps = 1000;
++ } else {
+ ep->freqn = get_usb_high_speed_rate(rate);
++ ep->fps = 8000;
++ }
++
++ ep->sample_rem = rate % ep->fps;
++ ep->framesize[0] = rate / ep->fps;
++ ep->framesize[1] = (rate + (ep->fps - 1)) / ep->fps;
+
+ /* calculate the frequency in 16.16 format */
+ ep->freqm = ep->freqn;
+@@ -949,6 +981,7 @@ int snd_usb_endpoint_start(struct snd_usb_endpoint *ep)
+ ep->active_mask = 0;
+ ep->unlink_mask = 0;
+ ep->phase = 0;
++ ep->sample_accum = 0;
+
+ snd_usb_endpoint_start_quirk(ep);
+
+diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
+index 63a39d4fa8d8..d23fa0a8c11b 100644
+--- a/sound/usb/endpoint.h
++++ b/sound/usb/endpoint.h
+@@ -28,6 +28,7 @@ void snd_usb_endpoint_release(struct snd_usb_endpoint *ep);
+ void snd_usb_endpoint_free(struct snd_usb_endpoint *ep);
+
+ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep);
++int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep);
+ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep);
+
+ void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 8b91be394407..42ae774f6db7 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1558,6 +1558,8 @@ static void prepare_playback_urb(struct snd_usb_substream *subs,
+ for (i = 0; i < ctx->packets; i++) {
+ if (ctx->packet_size[i])
+ counts = ctx->packet_size[i];
++ else if (ep->sync_master)
++ counts = snd_usb_endpoint_slave_next_packet_size(ep);
+ else
+ counts = snd_usb_endpoint_next_packet_size(ep);
+
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index 5312c761a5db..05eae94d09cb 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -447,8 +447,7 @@ static size_t hists__fprintf_nr_sample_events(struct hists *hists, struct report
+ if (rep->time_str)
+ ret += fprintf(fp, " (time slices: %s)", rep->time_str);
+
+- if (symbol_conf.show_ref_callgraph &&
+- strstr(evname, "call-graph=no")) {
++ if (symbol_conf.show_ref_callgraph && evname && strstr(evname, "call-graph=no")) {
+ ret += fprintf(fp, ", show reference callgraph");
+ }
+
+diff --git a/tools/testing/selftests/networking/timestamping/timestamping.c b/tools/testing/selftests/networking/timestamping/timestamping.c
+index 5cdfd743447b..900ed4b47899 100644
+--- a/tools/testing/selftests/networking/timestamping/timestamping.c
++++ b/tools/testing/selftests/networking/timestamping/timestamping.c
+@@ -332,10 +332,16 @@ int main(int argc, char **argv)
+ int val;
+ socklen_t len;
+ struct timeval next;
++ size_t if_len;
+
+ if (argc < 2)
+ usage(0);
+ interface = argv[1];
++ if_len = strlen(interface);
++ if (if_len >= IFNAMSIZ) {
++ printf("interface name exceeds IFNAMSIZ\n");
++ exit(1);
++ }
+
+ for (i = 2; i < argc; i++) {
+ if (!strcasecmp(argv[i], "SO_TIMESTAMP"))
+@@ -369,12 +375,12 @@ int main(int argc, char **argv)
+ bail("socket");
+
+ memset(&device, 0, sizeof(device));
+- strncpy(device.ifr_name, interface, sizeof(device.ifr_name));
++ memcpy(device.ifr_name, interface, if_len + 1);
+ if (ioctl(sock, SIOCGIFADDR, &device) < 0)
+ bail("getting interface IP address");
+
+ memset(&hwtstamp, 0, sizeof(hwtstamp));
+- strncpy(hwtstamp.ifr_name, interface, sizeof(hwtstamp.ifr_name));
++ memcpy(hwtstamp.ifr_name, interface, if_len + 1);
+ hwtstamp.ifr_data = (void *)&hwconfig;
+ memset(&hwconfig, 0, sizeof(hwconfig));
+ hwconfig.tx_type =
+diff --git a/tools/testing/selftests/ntb/ntb_test.sh b/tools/testing/selftests/ntb/ntb_test.sh
+index 08cbfbbc7029..17ca36403d04 100755
+--- a/tools/testing/selftests/ntb/ntb_test.sh
++++ b/tools/testing/selftests/ntb/ntb_test.sh
+@@ -250,7 +250,7 @@ function get_files_count()
+ split_remote $LOC
+
+ if [[ "$REMOTE" == "" ]]; then
+- echo $(ls -1 "$LOC"/${NAME}* 2>/dev/null | wc -l)
++ echo $(ls -1 "$VPATH"/${NAME}* 2>/dev/null | wc -l)
+ else
+ echo $(ssh "$REMOTE" "ls -1 \"$VPATH\"/${NAME}* | \
+ wc -l" 2> /dev/null)
+diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
+index 5d546dcdbc80..b8778960da10 100644
+--- a/tools/testing/selftests/x86/protection_keys.c
++++ b/tools/testing/selftests/x86/protection_keys.c
+@@ -24,6 +24,7 @@
+ #define _GNU_SOURCE
+ #include <errno.h>
+ #include <linux/futex.h>
++#include <time.h>
+ #include <sys/time.h>
+ #include <sys/syscall.h>
+ #include <string.h>
+@@ -612,10 +613,10 @@ int alloc_random_pkey(void)
+ int nr_alloced = 0;
+ int random_index;
+ memset(alloced_pkeys, 0, sizeof(alloced_pkeys));
++ srand((unsigned int)time(NULL));
+
+ /* allocate every possible key and make a note of which ones we got */
+ max_nr_pkey_allocs = NR_PKEYS;
+- max_nr_pkey_allocs = 1;
+ for (i = 0; i < max_nr_pkey_allocs; i++) {
+ int new_pkey = alloc_pkey();
+ if (new_pkey < 0)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-06-29 17:41 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-06-29 17:41 UTC (permalink / raw
To: gentoo-commits
commit: 915801955493b731f4996c28a247c177da85b6dc
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Jun 29 17:41:23 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Jun 29 17:41:23 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=91580195
Kernel patch enables gcc = v10.1+ optimizations for additional CPUs.
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
5013_enable-cpu-optimizations-for-gcc10.patch | 671 ++++++++++++++++++++++++++
2 files changed, 675 insertions(+)
diff --git a/0000_README b/0000_README
index 3fde3ae..d1af7f9 100644
--- a/0000_README
+++ b/0000_README
@@ -598,3 +598,7 @@ Desc: Kernel patch for >= gccv8 enables kernel >= v4.13 optimizations for addi
Patch: 5012_enable-cpu-optimizations-for-gcc91.patch
From: https://github.com/graysky2/kernel_gcc_patch/
Desc: Kernel patch enables gcc >= v9.1 optimizations for additional CPUs.
+
+Patch: 5013_enable-cpu-optimizations-for-gcc10.patch
+From: https://github.com/graysky2/kernel_gcc_patch/
+Desc: Kernel patch enables gcc = v10.1+ optimizations for additional CPUs.
diff --git a/5013_enable-cpu-optimizations-for-gcc10.patch b/5013_enable-cpu-optimizations-for-gcc10.patch
new file mode 100644
index 0000000..2a1e27d
--- /dev/null
+++ b/5013_enable-cpu-optimizations-for-gcc10.patch
@@ -0,0 +1,671 @@
+WARNING
+This patch works with gcc versions 10.1+ and with kernel versions 4.19-5.4 and should
+NOT be applied when compiling on older versions of gcc due to key name changes
+of the march flags introduced with the version 4.9 release of gcc.[1]
+
+Use the older version of this patch hosted on the same github for older
+versions of gcc.
+
+FEATURES
+This patch adds additional CPU options to the Linux kernel accessible under:
+ Processor type and features --->
+ Processor family --->
+
+The expanded microarchitectures include:
+* AMD Improved K8-family
+* AMD K10-family
+* AMD Family 10h (Barcelona)
+* AMD Family 14h (Bobcat)
+* AMD Family 16h (Jaguar)
+* AMD Family 15h (Bulldozer)
+* AMD Family 15h (Piledriver)
+* AMD Family 15h (Steamroller)
+* AMD Family 15h (Excavator)
+* AMD Family 17h (Zen)
+* AMD Family 17h (Zen 2)
+* Intel Silvermont low-power processors
+* Intel Goldmont low-power processors (Apollo Lake and Denverton)
+* Intel Goldmont Plus low-power processors (Gemini Lake)
+* Intel 1st Gen Core i3/i5/i7 (Nehalem)
+* Intel 1.5 Gen Core i3/i5/i7 (Westmere)
+* Intel 2nd Gen Core i3/i5/i7 (Sandybridge)
+* Intel 3rd Gen Core i3/i5/i7 (Ivybridge)
+* Intel 4th Gen Core i3/i5/i7 (Haswell)
+* Intel 5th Gen Core i3/i5/i7 (Broadwell)
+* Intel 6th Gen Core i3/i5/i7 (Skylake)
+* Intel 6th Gen Core i7/i9 (Skylake X)
+* Intel 8th Gen Core i3/i5/i7 (Cannon Lake)
+* Intel 10th Gen Core i7/i9 (Ice Lake)
+* Intel Xeon (Cascade Lake)
+* Intel Xeon (Cooper Lake)
+* Intel 3rd Gen 10nm++ i3/i5/i7/i9-family (Tiger Lake)
+
+It also offers to compile passing the 'native' option which, "selects the CPU
+to generate code for at compilation time by determining the processor type of
+the compiling machine. Using -march=native enables all instruction subsets
+supported by the local machine and will produce code optimized for the local
+machine under the constraints of the selected instruction set."[2]
+
+Do NOT try using the 'native' option on AMD Piledriver, Steamroller, or
+Excavator CPUs (-march=bdver{2,3,4} flag). The build will error out due the
+kernel's objtool issue with these.[3a,b]
+
+MINOR NOTES
+This patch also changes 'atom' to 'bonnell' in accordance with the gcc v4.9
+changes. Note that upstream is using the deprecated 'match=atom' flags when I
+believe it should use the newer 'march=bonnell' flag for atom processors.[4]
+
+It is not recommended to compile on Atom-CPUs with the 'native' option.[5] The
+recommendation is to use the 'atom' option instead.
+
+BENEFITS
+Small but real speed increases are measurable using a make endpoint comparing
+a generic kernel to one built with one of the respective microarchs.
+
+See the following experimental evidence supporting this statement:
+https://github.com/graysky2/kernel_gcc_patch
+
+REQUIREMENTS
+linux version 4.19-lts and 5.4-lts
+gcc version >=10.1
+
+ACKNOWLEDGMENTS
+This patch builds on the seminal work by Jeroen.[6]
+
+REFERENCES
+1. https://gcc.gnu.org/gcc-4.9/changes.html
+2. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
+3a. https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95671#c11
+3b. https://github.com/graysky2/kernel_gcc_patch/issues/55
+4. https://bugzilla.kernel.org/show_bug.cgi?id=77461
+5. https://github.com/graysky2/kernel_gcc_patch/issues/15
+6. http://www.linuxforge.net/docs/linux/linux-gcc.php
+
+--- a/arch/x86/include/asm/module.h 2020-06-10 15:35:02.000000000 -0400
++++ b/arch/x86/include/asm/module.h 2020-06-15 10:31:48.627486708 -0400
+@@ -25,6 +25,40 @@ struct mod_arch_specific {
+ #define MODULE_PROC_FAMILY "586MMX "
+ #elif defined CONFIG_MCORE2
+ #define MODULE_PROC_FAMILY "CORE2 "
++#elif defined CONFIG_MNATIVE
++#define MODULE_PROC_FAMILY "NATIVE "
++#elif defined CONFIG_MNEHALEM
++#define MODULE_PROC_FAMILY "NEHALEM "
++#elif defined CONFIG_MWESTMERE
++#define MODULE_PROC_FAMILY "WESTMERE "
++#elif defined CONFIG_MSILVERMONT
++#define MODULE_PROC_FAMILY "SILVERMONT "
++#elif defined CONFIG_MGOLDMONT
++#define MODULE_PROC_FAMILY "GOLDMONT "
++#elif defined CONFIG_MGOLDMONTPLUS
++#define MODULE_PROC_FAMILY "GOLDMONTPLUS "
++#elif defined CONFIG_MSANDYBRIDGE
++#define MODULE_PROC_FAMILY "SANDYBRIDGE "
++#elif defined CONFIG_MIVYBRIDGE
++#define MODULE_PROC_FAMILY "IVYBRIDGE "
++#elif defined CONFIG_MHASWELL
++#define MODULE_PROC_FAMILY "HASWELL "
++#elif defined CONFIG_MBROADWELL
++#define MODULE_PROC_FAMILY "BROADWELL "
++#elif defined CONFIG_MSKYLAKE
++#define MODULE_PROC_FAMILY "SKYLAKE "
++#elif defined CONFIG_MSKYLAKEX
++#define MODULE_PROC_FAMILY "SKYLAKEX "
++#elif defined CONFIG_MCANNONLAKE
++#define MODULE_PROC_FAMILY "CANNONLAKE "
++#elif defined CONFIG_MICELAKE
++#define MODULE_PROC_FAMILY "ICELAKE "
++#elif defined CONFIG_MCASCADELAKE
++#define MODULE_PROC_FAMILY "CASCADELAKE "
++#elif defined CONFIG_MCOOPERLAKE
++#define MODULE_PROC_FAMILY "COOPERLAKE "
++#elif defined CONFIG_MTIGERLAKE
++#define MODULE_PROC_FAMILY "TIGERLAKE "
+ #elif defined CONFIG_MATOM
+ #define MODULE_PROC_FAMILY "ATOM "
+ #elif defined CONFIG_M686
+@@ -43,6 +77,28 @@ struct mod_arch_specific {
+ #define MODULE_PROC_FAMILY "K7 "
+ #elif defined CONFIG_MK8
+ #define MODULE_PROC_FAMILY "K8 "
++#elif defined CONFIG_MK8SSE3
++#define MODULE_PROC_FAMILY "K8SSE3 "
++#elif defined CONFIG_MK10
++#define MODULE_PROC_FAMILY "K10 "
++#elif defined CONFIG_MBARCELONA
++#define MODULE_PROC_FAMILY "BARCELONA "
++#elif defined CONFIG_MBOBCAT
++#define MODULE_PROC_FAMILY "BOBCAT "
++#elif defined CONFIG_MBULLDOZER
++#define MODULE_PROC_FAMILY "BULLDOZER "
++#elif defined CONFIG_MPILEDRIVER
++#define MODULE_PROC_FAMILY "PILEDRIVER "
++#elif defined CONFIG_MSTEAMROLLER
++#define MODULE_PROC_FAMILY "STEAMROLLER "
++#elif defined CONFIG_MJAGUAR
++#define MODULE_PROC_FAMILY "JAGUAR "
++#elif defined CONFIG_MEXCAVATOR
++#define MODULE_PROC_FAMILY "EXCAVATOR "
++#elif defined CONFIG_MZEN
++#define MODULE_PROC_FAMILY "ZEN "
++#elif defined CONFIG_MZEN2
++#define MODULE_PROC_FAMILY "ZEN2 "
+ #elif defined CONFIG_MELAN
+ #define MODULE_PROC_FAMILY "ELAN "
+ #elif defined CONFIG_MCRUSOE
+--- a/arch/x86/Kconfig.cpu 2020-06-10 15:35:02.000000000 -0400
++++ b/arch/x86/Kconfig.cpu 2020-06-15 10:31:48.627486708 -0400
+@@ -116,6 +116,7 @@ config MPENTIUMM
+ config MPENTIUM4
+ bool "Pentium-4/Celeron(P4-based)/Pentium-4 M/older Xeon"
+ depends on X86_32
++ select X86_P6_NOP
+ ---help---
+ Select this for Intel Pentium 4 chips. This includes the
+ Pentium 4, Pentium D, P4-based Celeron and Xeon, and
+@@ -148,9 +149,8 @@ config MPENTIUM4
+ -Paxville
+ -Dempsey
+
+-
+ config MK6
+- bool "K6/K6-II/K6-III"
++ bool "AMD K6/K6-II/K6-III"
+ depends on X86_32
+ ---help---
+ Select this for an AMD K6-family processor. Enables use of
+@@ -158,7 +158,7 @@ config MK6
+ flags to GCC.
+
+ config MK7
+- bool "Athlon/Duron/K7"
++ bool "AMD Athlon/Duron/K7"
+ depends on X86_32
+ ---help---
+ Select this for an AMD Athlon K7-family processor. Enables use of
+@@ -166,12 +166,90 @@ config MK7
+ flags to GCC.
+
+ config MK8
+- bool "Opteron/Athlon64/Hammer/K8"
++ bool "AMD Opteron/Athlon64/Hammer/K8"
+ ---help---
+ Select this for an AMD Opteron or Athlon64 Hammer-family processor.
+ Enables use of some extended instructions, and passes appropriate
+ optimization flags to GCC.
+
++config MK8SSE3
++ bool "AMD Opteron/Athlon64/Hammer/K8 with SSE3"
++ ---help---
++ Select this for improved AMD Opteron or Athlon64 Hammer-family processors.
++ Enables use of some extended instructions, and passes appropriate
++ optimization flags to GCC.
++
++config MK10
++ bool "AMD 61xx/7x50/PhenomX3/X4/II/K10"
++ ---help---
++ Select this for an AMD 61xx Eight-Core Magny-Cours, Athlon X2 7x50,
++ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
++ Enables use of some extended instructions, and passes appropriate
++ optimization flags to GCC.
++
++config MBARCELONA
++ bool "AMD Barcelona"
++ ---help---
++ Select this for AMD Family 10h Barcelona processors.
++
++ Enables -march=barcelona
++
++config MBOBCAT
++ bool "AMD Bobcat"
++ ---help---
++ Select this for AMD Family 14h Bobcat processors.
++
++ Enables -march=btver1
++
++config MJAGUAR
++ bool "AMD Jaguar"
++ ---help---
++ Select this for AMD Family 16h Jaguar processors.
++
++ Enables -march=btver2
++
++config MBULLDOZER
++ bool "AMD Bulldozer"
++ ---help---
++ Select this for AMD Family 15h Bulldozer processors.
++
++ Enables -march=bdver1
++
++config MPILEDRIVER
++ bool "AMD Piledriver"
++ ---help---
++ Select this for AMD Family 15h Piledriver processors.
++
++ Enables -march=bdver2
++
++config MSTEAMROLLER
++ bool "AMD Steamroller"
++ ---help---
++ Select this for AMD Family 15h Steamroller processors.
++
++ Enables -march=bdver3
++
++config MEXCAVATOR
++ bool "AMD Excavator"
++ ---help---
++ Select this for AMD Family 15h Excavator processors.
++
++ Enables -march=bdver4
++
++config MZEN
++ bool "AMD Zen"
++ ---help---
++ Select this for AMD Family 17h Zen processors.
++
++ Enables -march=znver1
++
++config MZEN2
++ bool "AMD Zen 2"
++ ---help---
++ Select this for AMD Family 17h Zen 2 processors.
++
++ Enables -march=znver2
++
+ config MCRUSOE
+ bool "Crusoe"
+ depends on X86_32
+@@ -253,6 +331,7 @@ config MVIAC7
+
+ config MPSC
+ bool "Intel P4 / older Netburst based Xeon"
++ select X86_P6_NOP
+ depends on X86_64
+ ---help---
+ Optimize for Intel Pentium 4, Pentium D and older Nocona/Dempsey
+@@ -262,8 +341,19 @@ config MPSC
+ using the cpu family field
+ in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
+
++config MATOM
++ bool "Intel Atom"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Atom platform. Intel Atom CPUs have an
++ in-order pipelining architecture and thus can benefit from
++ accordingly optimized code. Use a recent GCC with specific Atom
++ support in order to fully benefit from selecting this option.
++
+ config MCORE2
+- bool "Core 2/newer Xeon"
++ bool "Intel Core 2"
++ select X86_P6_NOP
+ ---help---
+
+ Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
+@@ -271,14 +361,151 @@ config MCORE2
+ family in /proc/cpuinfo. Newer ones have 6 and older ones 15
+ (not a typo)
+
+-config MATOM
+- bool "Intel Atom"
++ Enables -march=core2
++
++config MNEHALEM
++ bool "Intel Nehalem"
++ select X86_P6_NOP
+ ---help---
+
+- Select this for the Intel Atom platform. Intel Atom CPUs have an
+- in-order pipelining architecture and thus can benefit from
+- accordingly optimized code. Use a recent GCC with specific Atom
+- support in order to fully benefit from selecting this option.
++ Select this for 1st Gen Core processors in the Nehalem family.
++
++ Enables -march=nehalem
++
++config MWESTMERE
++ bool "Intel Westmere"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Westmere formerly Nehalem-C family.
++
++ Enables -march=westmere
++
++config MSILVERMONT
++ bool "Intel Silvermont"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Silvermont platform.
++
++ Enables -march=silvermont
++
++config MGOLDMONT
++ bool "Intel Goldmont"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Goldmont platform including Apollo Lake and Denverton.
++
++ Enables -march=goldmont
++
++config MGOLDMONTPLUS
++ bool "Intel Goldmont Plus"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for the Intel Goldmont Plus platform including Gemini Lake.
++
++ Enables -march=goldmont-plus
++
++config MSANDYBRIDGE
++ bool "Intel Sandy Bridge"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 2nd Gen Core processors in the Sandy Bridge family.
++
++ Enables -march=sandybridge
++
++config MIVYBRIDGE
++ bool "Intel Ivy Bridge"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 3rd Gen Core processors in the Ivy Bridge family.
++
++ Enables -march=ivybridge
++
++config MHASWELL
++ bool "Intel Haswell"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 4th Gen Core processors in the Haswell family.
++
++ Enables -march=haswell
++
++config MBROADWELL
++ bool "Intel Broadwell"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 5th Gen Core processors in the Broadwell family.
++
++ Enables -march=broadwell
++
++config MSKYLAKE
++ bool "Intel Skylake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 6th Gen Core processors in the Skylake family.
++
++ Enables -march=skylake
++
++config MSKYLAKEX
++ bool "Intel Skylake X"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 6th Gen Core processors in the Skylake X family.
++
++ Enables -march=skylake-avx512
++
++config MCANNONLAKE
++ bool "Intel Cannon Lake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 8th Gen Core processors
++
++ Enables -march=cannonlake
++
++config MICELAKE
++ bool "Intel Ice Lake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for 10th Gen Core processors in the Ice Lake family.
++
++ Enables -march=icelake-client
++
++config MCASCADELAKE
++ bool "Intel Cascade Lake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for Xeon processors in the Cascade Lake family.
++
++ Enables -march=cascadelake
++
++config MCOOPERLAKE
++ bool "Intel Cooper Lake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for Xeon processors in the Cooper Lake family.
++
++ Enables -march=cooperlake
++
++config MTIGERLAKE
++ bool "Intel Tiger Lake"
++ select X86_P6_NOP
++ ---help---
++
++ Select this for third-generation 10 nm process processors in the Tiger Lake family.
++
++ Enables -march=tigerlake
+
+ config GENERIC_CPU
+ bool "Generic-x86-64"
+@@ -287,6 +514,19 @@ config GENERIC_CPU
+ Generic x86-64 CPU.
+ Run equally well on all x86-64 CPUs.
+
++config MNATIVE
++ bool "Native optimizations autodetected by GCC"
++ ---help---
++
++ GCC 4.2 and above support -march=native, which automatically detects
++ the optimum settings to use based on your processor. -march=native
++ also detects and applies additional settings beyond -march specific
++ to your CPU, (eg. -msse4). Unless you have a specific reason not to
++ (e.g. distcc cross-compiling), you should probably be using
++ -march=native rather than anything listed below.
++
++ Enables -march=native
++
+ endchoice
+
+ config X86_GENERIC
+@@ -311,7 +551,7 @@ config X86_INTERNODE_CACHE_SHIFT
+ config X86_L1_CACHE_SHIFT
+ int
+ default "7" if MPENTIUM4 || MPSC
+- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
++ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
+ default "4" if MELAN || M486 || MGEODEGX1
+ default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
+
+@@ -329,35 +569,36 @@ config X86_ALIGNMENT_16
+
+ config X86_INTEL_USERCOPY
+ def_bool y
+- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
++ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE
+
+ config X86_USE_PPRO_CHECKSUM
+ def_bool y
+- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
++ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MATOM || MNATIVE
+
+ config X86_USE_3DNOW
+ def_bool y
+ depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
+
+-#
+-# P6_NOPs are a relatively minor optimization that require a family >=
+-# 6 processor, except that it is broken on certain VIA chips.
+-# Furthermore, AMD chips prefer a totally different sequence of NOPs
+-# (which work on all CPUs). In addition, it looks like Virtual PC
+-# does not understand them.
+-#
+-# As a result, disallow these if we're not compiling for X86_64 (these
+-# NOPs do work on all x86-64 capable chips); the list of processors in
+-# the right-hand clause are the cores that benefit from this optimization.
+-#
+ config X86_P6_NOP
+- def_bool y
+- depends on X86_64
+- depends on (MCORE2 || MPENTIUM4 || MPSC)
++ default n
++ bool "Support for P6_NOPs on Intel chips"
++ depends on (MCORE2 || MPENTIUM4 || MPSC || MATOM || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE)
++ ---help---
++ P6_NOPs are a relatively minor optimization that require a family >=
++ 6 processor, except that it is broken on certain VIA chips.
++ Furthermore, AMD chips prefer a totally different sequence of NOPs
++ (which work on all CPUs). In addition, it looks like Virtual PC
++ does not understand them.
++
++ As a result, disallow these if we're not compiling for X86_64 (these
++ NOPs do work on all x86-64 capable chips); the list of processors in
++ the right-hand clause are the cores that benefit from this optimization.
++
++ Say Y if you have Intel CPU newer than Pentium Pro, N otherwise.
+
+ config X86_TSC
+ def_bool y
+- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
++ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE || MATOM) || X86_64
+
+ config X86_CMPXCHG64
+ def_bool y
+@@ -367,7 +608,7 @@ config X86_CMPXCHG64
+ # generates cmov.
+ config X86_CMOV
+ def_bool y
+- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
++ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
+
+ config X86_MINIMUM_CPU_FAMILY
+ int
+--- a/arch/x86/Makefile 2020-06-10 15:35:02.000000000 -0400
++++ b/arch/x86/Makefile 2020-06-15 10:32:39.508648036 -0400
+@@ -119,13 +119,60 @@ else
+ KBUILD_CFLAGS += $(call cc-option,-mskip-rax-setup)
+
+ # FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
++ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
+ cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
++ cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-mtune=k8)
++ cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10)
++ cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona)
++ cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1)
++ cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2)
++ cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1)
++ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2)
++ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-mno-tbm)
++ cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3)
++ cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-mno-tbm)
++ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4)
++ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-mno-tbm)
++ cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1)
++ cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2)
+ cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
+
+ cflags-$(CONFIG_MCORE2) += \
+- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
+- cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
+- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
++ $(call cc-option,-march=core2,$(call cc-option,-mtune=core2))
++ cflags-$(CONFIG_MNEHALEM) += \
++ $(call cc-option,-march=nehalem,$(call cc-option,-mtune=nehalem))
++ cflags-$(CONFIG_MWESTMERE) += \
++ $(call cc-option,-march=westmere,$(call cc-option,-mtune=westmere))
++ cflags-$(CONFIG_MSILVERMONT) += \
++ $(call cc-option,-march=silvermont,$(call cc-option,-mtune=silvermont))
++ cflags-$(CONFIG_MGOLDMONT) += \
++ $(call cc-option,-march=goldmont,$(call cc-option,-mtune=goldmont))
++ cflags-$(CONFIG_MGOLDMONTPLUS) += \
++ $(call cc-option,-march=goldmont-plus,$(call cc-option,-mtune=goldmont-plus))
++ cflags-$(CONFIG_MSANDYBRIDGE) += \
++ $(call cc-option,-march=sandybridge,$(call cc-option,-mtune=sandybridge))
++ cflags-$(CONFIG_MIVYBRIDGE) += \
++ $(call cc-option,-march=ivybridge,$(call cc-option,-mtune=ivybridge))
++ cflags-$(CONFIG_MHASWELL) += \
++ $(call cc-option,-march=haswell,$(call cc-option,-mtune=haswell))
++ cflags-$(CONFIG_MBROADWELL) += \
++ $(call cc-option,-march=broadwell,$(call cc-option,-mtune=broadwell))
++ cflags-$(CONFIG_MSKYLAKE) += \
++ $(call cc-option,-march=skylake,$(call cc-option,-mtune=skylake))
++ cflags-$(CONFIG_MSKYLAKEX) += \
++ $(call cc-option,-march=skylake-avx512,$(call cc-option,-mtune=skylake-avx512))
++ cflags-$(CONFIG_MCANNONLAKE) += \
++ $(call cc-option,-march=cannonlake,$(call cc-option,-mtune=cannonlake))
++ cflags-$(CONFIG_MICELAKE) += \
++ $(call cc-option,-march=icelake-client,$(call cc-option,-mtune=icelake-client))
++ cflags-$(CONFIG_MCASCADELAKE) += \
++ $(call cc-option,-march=cascadelake,$(call cc-option,-mtune=cascadelake))
++ cflags-$(CONFIG_MCOOPERLAKE) += \
++ $(call cc-option,-march=cooperlake,$(call cc-option,-mtune=cooperlake))
++ cflags-$(CONFIG_MTIGERLAKE) += \
++ $(call cc-option,-march=tigerlake,$(call cc-option,-mtune=tigerlake))
++ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell) \
++ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
+ cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
+ KBUILD_CFLAGS += $(cflags-y)
+
+--- a/arch/x86/Makefile_32.cpu 2020-06-10 15:35:02.000000000 -0400
++++ b/arch/x86/Makefile_32.cpu 2020-06-15 10:31:48.627486708 -0400
+@@ -23,7 +23,19 @@ cflags-$(CONFIG_MK6) += -march=k6
+ # Please note, that patches that add -march=athlon-xp and friends are pointless.
+ # They make zero difference whatsosever to performance at this time.
+ cflags-$(CONFIG_MK7) += -march=athlon
++cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
+ cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8,-march=athlon)
++cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-march=athlon)
++cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10,-march=athlon)
++cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona,-march=athlon)
++cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1,-march=athlon)
++cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2,-march=athlon)
++cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1,-march=athlon)
++cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2,-march=athlon)
++cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3,-march=athlon)
++cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4,-march=athlon)
++cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1,-march=athlon)
++cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2,-march=athlon)
+ cflags-$(CONFIG_MCRUSOE) += -march=i686 -falign-functions=0 -falign-jumps=0 -falign-loops=0
+ cflags-$(CONFIG_MEFFICEON) += -march=i686 $(call tune,pentium3) -falign-functions=0 -falign-jumps=0 -falign-loops=0
+ cflags-$(CONFIG_MWINCHIPC6) += $(call cc-option,-march=winchip-c6,-march=i586)
+@@ -32,8 +44,24 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
+ cflags-$(CONFIG_MVIAC3_2) += $(call cc-option,-march=c3-2,-march=i686)
+ cflags-$(CONFIG_MVIAC7) += -march=i686
+ cflags-$(CONFIG_MCORE2) += -march=i686 $(call tune,core2)
+-cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom,$(call cc-option,-march=core2,-march=i686)) \
+- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
++cflags-$(CONFIG_MNEHALEM) += -march=i686 $(call tune,nehalem)
++cflags-$(CONFIG_MWESTMERE) += -march=i686 $(call tune,westmere)
++cflags-$(CONFIG_MSILVERMONT) += -march=i686 $(call tune,silvermont)
++cflags-$(CONFIG_MGOLDMONT) += -march=i686 $(call tune,goldmont)
++cflags-$(CONFIG_MGOLDMONTPLUS) += -march=i686 $(call tune,goldmont-plus)
++cflags-$(CONFIG_MSANDYBRIDGE) += -march=i686 $(call tune,sandybridge)
++cflags-$(CONFIG_MIVYBRIDGE) += -march=i686 $(call tune,ivybridge)
++cflags-$(CONFIG_MHASWELL) += -march=i686 $(call tune,haswell)
++cflags-$(CONFIG_MBROADWELL) += -march=i686 $(call tune,broadwell)
++cflags-$(CONFIG_MSKYLAKE) += -march=i686 $(call tune,skylake)
++cflags-$(CONFIG_MSKYLAKEX) += -march=i686 $(call tune,skylake-avx512)
++cflags-$(CONFIG_MCANNONLAKE) += -march=i686 $(call tune,cannonlake)
++cflags-$(CONFIG_MICELAKE) += -march=i686 $(call tune,icelake-client)
++cflags-$(CONFIG_MCASCADELAKE) += -march=i686 $(call tune,cascadelake)
++cflags-$(CONFIG_MCOOPERLAKE) += -march=i686 $(call tune,cooperlake)
++cflags-$(CONFIG_MTIGERLAKE) += -march=i686 $(call tune,tigerlake)
++cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell,$(call cc-option,-march=core2,-march=i686)) \
++ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
+
+ # AMD Elan support
+ cflags-$(CONFIG_MELAN) += -march=i486
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-07-01 12:14 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-07-01 12:14 UTC (permalink / raw
To: gentoo-commits
commit: 106ad7a70dd251d2984bf8cc3ce3600b3bd224a4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 1 12:14:31 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 1 12:14:31 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=106ad7a7
Linux patch 4.19.131
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1130_linux-4.19.131.patch | 3602 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3606 insertions(+)
diff --git a/0000_README b/0000_README
index d1af7f9..6975213 100644
--- a/0000_README
+++ b/0000_README
@@ -559,6 +559,10 @@ Patch: 1129_linux-4.19.130.patch
From: https://www.kernel.org
Desc: Linux 4.19.130
+Patch: 1130_linux-4.19.131.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.131
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1130_linux-4.19.131.patch b/1130_linux-4.19.131.patch
new file mode 100644
index 0000000..7356bd1
--- /dev/null
+++ b/1130_linux-4.19.131.patch
@@ -0,0 +1,3602 @@
+diff --git a/Makefile b/Makefile
+index 6443cbd51f70..605a6a2e03dc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 130
++SUBLEVEL = 131
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
+index 2b219addeb44..273a31604579 100644
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -249,10 +249,10 @@
+ status = "disabled";
+ };
+
+- mailbox: mailbox@25000 {
++ mailbox: mailbox@25c00 {
+ compatible = "brcm,iproc-fa2-mbox";
+- reg = <0x25000 0x445>;
+- interrupts = <GIC_SPI 150 IRQ_TYPE_LEVEL_HIGH>;
++ reg = <0x25c00 0x400>;
++ interrupts = <GIC_SPI 151 IRQ_TYPE_LEVEL_HIGH>;
+ #mbox-cells = <1>;
+ brcm,rx-status-len = <32>;
+ brcm,use-bcm-hdr;
+diff --git a/arch/arm/boot/dts/omap4-duovero-parlor.dts b/arch/arm/boot/dts/omap4-duovero-parlor.dts
+index cfcac0d73851..93d6fb6db578 100644
+--- a/arch/arm/boot/dts/omap4-duovero-parlor.dts
++++ b/arch/arm/boot/dts/omap4-duovero-parlor.dts
+@@ -142,7 +142,7 @@
+ ethernet@gpmc {
+ reg = <5 0 0xff>;
+ interrupt-parent = <&gpio2>;
+- interrupts = <12 IRQ_TYPE_EDGE_FALLING>; /* gpio_44 */
++ interrupts = <12 IRQ_TYPE_LEVEL_LOW>; /* gpio_44 */
+
+ phy-mode = "mii";
+
+diff --git a/arch/arm/mach-imx/pm-imx5.c b/arch/arm/mach-imx/pm-imx5.c
+index 868781fd460c..14c630c899c5 100644
+--- a/arch/arm/mach-imx/pm-imx5.c
++++ b/arch/arm/mach-imx/pm-imx5.c
+@@ -301,14 +301,14 @@ static int __init imx_suspend_alloc_ocram(
+ if (!ocram_pool) {
+ pr_warn("%s: ocram pool unavailable!\n", __func__);
+ ret = -ENODEV;
+- goto put_node;
++ goto put_device;
+ }
+
+ ocram_base = gen_pool_alloc(ocram_pool, size);
+ if (!ocram_base) {
+ pr_warn("%s: unable to alloc ocram!\n", __func__);
+ ret = -ENOMEM;
+- goto put_node;
++ goto put_device;
+ }
+
+ phys = gen_pool_virt_to_phys(ocram_pool, ocram_base);
+@@ -318,6 +318,8 @@ static int __init imx_suspend_alloc_ocram(
+ if (virt_out)
+ *virt_out = virt;
+
++put_device:
++ put_device(&pdev->dev);
+ put_node:
+ of_node_put(node);
+
+diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
+index 14fdbaa6ee3a..19c87b52c001 100644
+--- a/arch/arm64/kernel/fpsimd.c
++++ b/arch/arm64/kernel/fpsimd.c
+@@ -304,7 +304,7 @@ static unsigned int find_supported_vector_length(unsigned int vl)
+ return sve_vl_from_vq(bit_to_vq(bit));
+ }
+
+-#ifdef CONFIG_SYSCTL
++#if defined(CONFIG_ARM64_SVE) && defined(CONFIG_SYSCTL)
+
+ static int sve_proc_do_default_vl(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp,
+@@ -350,9 +350,9 @@ static int __init sve_sysctl_init(void)
+ return 0;
+ }
+
+-#else /* ! CONFIG_SYSCTL */
++#else /* ! (CONFIG_ARM64_SVE && CONFIG_SYSCTL) */
+ static int __init sve_sysctl_init(void) { return 0; }
+-#endif /* ! CONFIG_SYSCTL */
++#endif /* ! (CONFIG_ARM64_SVE && CONFIG_SYSCTL) */
+
+ #define ZREG(sve_state, vq, n) ((char *)(sve_state) + \
+ (SVE_SIG_ZREG_OFFSET(vq, n) - SVE_SIG_REGS_OFFSET))
+diff --git a/arch/arm64/kernel/perf_regs.c b/arch/arm64/kernel/perf_regs.c
+index 0bbac612146e..666b225aeb3a 100644
+--- a/arch/arm64/kernel/perf_regs.c
++++ b/arch/arm64/kernel/perf_regs.c
+@@ -15,15 +15,34 @@ u64 perf_reg_value(struct pt_regs *regs, int idx)
+ return 0;
+
+ /*
+- * Compat (i.e. 32 bit) mode:
+- * - PC has been set in the pt_regs struct in kernel_entry,
+- * - Handle SP and LR here.
++ * Our handling of compat tasks (PERF_SAMPLE_REGS_ABI_32) is weird, but
++ * we're stuck with it for ABI compatability reasons.
++ *
++ * For a 32-bit consumer inspecting a 32-bit task, then it will look at
++ * the first 16 registers (see arch/arm/include/uapi/asm/perf_regs.h).
++ * These correspond directly to a prefix of the registers saved in our
++ * 'struct pt_regs', with the exception of the PC, so we copy that down
++ * (x15 corresponds to SP_hyp in the architecture).
++ *
++ * So far, so good.
++ *
++ * The oddity arises when a 64-bit consumer looks at a 32-bit task and
++ * asks for registers beyond PERF_REG_ARM_MAX. In this case, we return
++ * SP_usr, LR_usr and PC in the positions where the AArch64 SP, LR and
++ * PC registers would normally live. The initial idea was to allow a
++ * 64-bit unwinder to unwind a 32-bit task and, although it's not clear
++ * how well that works in practice, somebody might be relying on it.
++ *
++ * At the time we make a sample, we don't know whether the consumer is
++ * 32-bit or 64-bit, so we have to cater for both possibilities.
+ */
+ if (compat_user_mode(regs)) {
+ if ((u32)idx == PERF_REG_ARM64_SP)
+ return regs->compat_sp;
+ if ((u32)idx == PERF_REG_ARM64_LR)
+ return regs->compat_lr;
++ if (idx == 15)
++ return regs->pc;
+ }
+
+ if ((u32)idx == PERF_REG_ARM64_SP)
+diff --git a/arch/riscv/include/asm/cmpxchg.h b/arch/riscv/include/asm/cmpxchg.h
+index c12833f7b6bd..42978aac99d5 100644
+--- a/arch/riscv/include/asm/cmpxchg.h
++++ b/arch/riscv/include/asm/cmpxchg.h
+@@ -187,7 +187,7 @@
+ " bnez %1, 0b\n" \
+ "1:\n" \
+ : "=&r" (__ret), "=&r" (__rc), "+A" (*__ptr) \
+- : "rJ" (__old), "rJ" (__new) \
++ : "rJ" ((long)__old), "rJ" (__new) \
+ : "memory"); \
+ break; \
+ case 8: \
+@@ -232,7 +232,7 @@
+ RISCV_ACQUIRE_BARRIER \
+ "1:\n" \
+ : "=&r" (__ret), "=&r" (__rc), "+A" (*__ptr) \
+- : "rJ" (__old), "rJ" (__new) \
++ : "rJ" ((long)__old), "rJ" (__new) \
+ : "memory"); \
+ break; \
+ case 8: \
+@@ -278,7 +278,7 @@
+ " bnez %1, 0b\n" \
+ "1:\n" \
+ : "=&r" (__ret), "=&r" (__rc), "+A" (*__ptr) \
+- : "rJ" (__old), "rJ" (__new) \
++ : "rJ" ((long)__old), "rJ" (__new) \
+ : "memory"); \
+ break; \
+ case 8: \
+@@ -324,7 +324,7 @@
+ " fence rw, rw\n" \
+ "1:\n" \
+ : "=&r" (__ret), "=&r" (__rc), "+A" (*__ptr) \
+- : "rJ" (__old), "rJ" (__new) \
++ : "rJ" ((long)__old), "rJ" (__new) \
+ : "memory"); \
+ break; \
+ case 8: \
+diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
+index fb03a4482ad6..db44da32701f 100644
+--- a/arch/riscv/kernel/sys_riscv.c
++++ b/arch/riscv/kernel/sys_riscv.c
+@@ -16,6 +16,7 @@
+ #include <linux/syscalls.h>
+ #include <asm/unistd.h>
+ #include <asm/cacheflush.h>
++#include <asm-generic/mman-common.h>
+
+ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
+ unsigned long prot, unsigned long flags,
+@@ -24,6 +25,11 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
+ {
+ if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
+ return -EINVAL;
++
++ if ((prot & PROT_WRITE) && (prot & PROT_EXEC))
++ if (unlikely(!(prot & PROT_READ)))
++ return -EINVAL;
++
+ return ksys_mmap_pgoff(addr, len, prot, flags, fd,
+ offset >> (PAGE_SHIFT - page_shift_offset));
+ }
+diff --git a/arch/s390/include/asm/vdso.h b/arch/s390/include/asm/vdso.h
+index 169d7604eb80..f3ba84fa9bd1 100644
+--- a/arch/s390/include/asm/vdso.h
++++ b/arch/s390/include/asm/vdso.h
+@@ -36,6 +36,7 @@ struct vdso_data {
+ __u32 tk_shift; /* Shift used for xtime_nsec 0x60 */
+ __u32 ts_dir; /* TOD steering direction 0x64 */
+ __u64 ts_end; /* TOD steering end 0x68 */
++ __u32 hrtimer_res; /* hrtimer resolution 0x70 */
+ };
+
+ struct vdso_per_cpu_data {
+diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
+index 66e830f1c7bf..e9d09f6e81d2 100644
+--- a/arch/s390/kernel/asm-offsets.c
++++ b/arch/s390/kernel/asm-offsets.c
+@@ -75,6 +75,7 @@ int main(void)
+ OFFSET(__VDSO_TK_SHIFT, vdso_data, tk_shift);
+ OFFSET(__VDSO_TS_DIR, vdso_data, ts_dir);
+ OFFSET(__VDSO_TS_END, vdso_data, ts_end);
++ OFFSET(__VDSO_CLOCK_REALTIME_RES, vdso_data, hrtimer_res);
+ OFFSET(__VDSO_ECTG_BASE, vdso_per_cpu_data, ectg_timer_base);
+ OFFSET(__VDSO_ECTG_USER, vdso_per_cpu_data, ectg_user_time);
+ OFFSET(__VDSO_CPU_NR, vdso_per_cpu_data, cpu_nr);
+@@ -86,7 +87,6 @@ int main(void)
+ DEFINE(__CLOCK_REALTIME_COARSE, CLOCK_REALTIME_COARSE);
+ DEFINE(__CLOCK_MONOTONIC_COARSE, CLOCK_MONOTONIC_COARSE);
+ DEFINE(__CLOCK_THREAD_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID);
+- DEFINE(__CLOCK_REALTIME_RES, MONOTONIC_RES_NSEC);
+ DEFINE(__CLOCK_COARSE_RES, LOW_RES_NSEC);
+ BLANK();
+ /* idle data offsets */
+diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
+index cd3df5514552..65fefbf61e1c 100644
+--- a/arch/s390/kernel/ptrace.c
++++ b/arch/s390/kernel/ptrace.c
+@@ -325,6 +325,25 @@ static inline void __poke_user_per(struct task_struct *child,
+ child->thread.per_user.end = data;
+ }
+
++static void fixup_int_code(struct task_struct *child, addr_t data)
++{
++ struct pt_regs *regs = task_pt_regs(child);
++ int ilc = regs->int_code >> 16;
++ u16 insn;
++
++ if (ilc > 6)
++ return;
++
++ if (ptrace_access_vm(child, regs->psw.addr - (regs->int_code >> 16),
++ &insn, sizeof(insn), FOLL_FORCE) != sizeof(insn))
++ return;
++
++ /* double check that tracee stopped on svc instruction */
++ if ((insn >> 8) != 0xa)
++ return;
++
++ regs->int_code = 0x20000 | (data & 0xffff);
++}
+ /*
+ * Write a word to the user area of a process at location addr. This
+ * operation does have an additional problem compared to peek_user.
+@@ -336,7 +355,9 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
+ struct user *dummy = NULL;
+ addr_t offset;
+
++
+ if (addr < (addr_t) &dummy->regs.acrs) {
++ struct pt_regs *regs = task_pt_regs(child);
+ /*
+ * psw and gprs are stored on the stack
+ */
+@@ -354,7 +375,11 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
+ /* Invalid addressing mode bits */
+ return -EINVAL;
+ }
+- *(addr_t *)((addr_t) &task_pt_regs(child)->psw + addr) = data;
++
++ if (test_pt_regs_flag(regs, PIF_SYSCALL) &&
++ addr == offsetof(struct user, regs.gprs[2]))
++ fixup_int_code(child, data);
++ *(addr_t *)((addr_t) ®s->psw + addr) = data;
+
+ } else if (addr < (addr_t) (&dummy->regs.orig_gpr2)) {
+ /*
+@@ -720,6 +745,10 @@ static int __poke_user_compat(struct task_struct *child,
+ regs->psw.mask = (regs->psw.mask & ~PSW_MASK_BA) |
+ (__u64)(tmp & PSW32_ADDR_AMODE);
+ } else {
++
++ if (test_pt_regs_flag(regs, PIF_SYSCALL) &&
++ addr == offsetof(struct compat_user, regs.gprs[2]))
++ fixup_int_code(child, data);
+ /* gpr 0-15 */
+ *(__u32*)((addr_t) ®s->psw + addr*2 + 4) = tmp;
+ }
+diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
+index e8766beee5ad..8ea9db599d38 100644
+--- a/arch/s390/kernel/time.c
++++ b/arch/s390/kernel/time.c
+@@ -310,6 +310,7 @@ void update_vsyscall(struct timekeeper *tk)
+
+ vdso_data->tk_mult = tk->tkr_mono.mult;
+ vdso_data->tk_shift = tk->tkr_mono.shift;
++ vdso_data->hrtimer_res = hrtimer_resolution;
+ smp_wmb();
+ ++vdso_data->tb_update_count;
+ }
+diff --git a/arch/s390/kernel/vdso64/clock_getres.S b/arch/s390/kernel/vdso64/clock_getres.S
+index 081435398e0a..0c79caa32b59 100644
+--- a/arch/s390/kernel/vdso64/clock_getres.S
++++ b/arch/s390/kernel/vdso64/clock_getres.S
+@@ -17,12 +17,14 @@
+ .type __kernel_clock_getres,@function
+ __kernel_clock_getres:
+ CFI_STARTPROC
+- larl %r1,4f
++ larl %r1,3f
++ lg %r0,0(%r1)
+ cghi %r2,__CLOCK_REALTIME_COARSE
+ je 0f
+ cghi %r2,__CLOCK_MONOTONIC_COARSE
+ je 0f
+- larl %r1,3f
++ larl %r1,_vdso_data
++ llgf %r0,__VDSO_CLOCK_REALTIME_RES(%r1)
+ cghi %r2,__CLOCK_REALTIME
+ je 0f
+ cghi %r2,__CLOCK_MONOTONIC
+@@ -36,7 +38,6 @@ __kernel_clock_getres:
+ jz 2f
+ 0: ltgr %r3,%r3
+ jz 1f /* res == NULL */
+- lg %r0,0(%r1)
+ xc 0(8,%r3),0(%r3) /* set tp->tv_sec to zero */
+ stg %r0,8(%r3) /* store tp->tv_usec */
+ 1: lghi %r2,0
+@@ -45,6 +46,5 @@ __kernel_clock_getres:
+ svc 0
+ br %r14
+ CFI_ENDPROC
+-3: .quad __CLOCK_REALTIME_RES
+-4: .quad __CLOCK_COARSE_RES
++3: .quad __CLOCK_COARSE_RES
+ .size __kernel_clock_getres,.-__kernel_clock_getres
+diff --git a/arch/sparc/kernel/ptrace_32.c b/arch/sparc/kernel/ptrace_32.c
+index 60f7205ebe40..646dd58169ec 100644
+--- a/arch/sparc/kernel/ptrace_32.c
++++ b/arch/sparc/kernel/ptrace_32.c
+@@ -168,12 +168,17 @@ static int genregs32_set(struct task_struct *target,
+ if (ret || !count)
+ return ret;
+ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+- ®s->y,
++ ®s->npc,
+ 34 * sizeof(u32), 35 * sizeof(u32));
+ if (ret || !count)
+ return ret;
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ ®s->y,
++ 35 * sizeof(u32), 36 * sizeof(u32));
++ if (ret || !count)
++ return ret;
+ return user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
+- 35 * sizeof(u32), 38 * sizeof(u32));
++ 36 * sizeof(u32), 38 * sizeof(u32));
+ }
+
+ static int fpregs32_get(struct task_struct *target,
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 33136395db8f..ce7b3b22ae86 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1099,7 +1099,7 @@ struct kvm_x86_ops {
+ void (*enable_log_dirty_pt_masked)(struct kvm *kvm,
+ struct kvm_memory_slot *slot,
+ gfn_t offset, unsigned long mask);
+- int (*write_log_dirty)(struct kvm_vcpu *vcpu);
++ int (*write_log_dirty)(struct kvm_vcpu *vcpu, gpa_t l2_gpa);
+
+ /* pmu operations of sub-arch */
+ const struct kvm_pmu_ops *pmu_ops;
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index cea7e01a346d..e62e416dd116 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -1035,6 +1035,7 @@ static int rdt_cdp_peer_get(struct rdt_resource *r, struct rdt_domain *d,
+ _d_cdp = rdt_find_domain(_r_cdp, d->id, NULL);
+ if (WARN_ON(IS_ERR_OR_NULL(_d_cdp))) {
+ _r_cdp = NULL;
++ _d_cdp = NULL;
+ ret = -EINVAL;
+ }
+
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 0679303e5f3d..712bc103ef3a 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -1732,10 +1732,10 @@ void kvm_arch_mmu_enable_log_dirty_pt_masked(struct kvm *kvm,
+ * Emulate arch specific page modification logging for the
+ * nested hypervisor
+ */
+-int kvm_arch_write_log_dirty(struct kvm_vcpu *vcpu)
++int kvm_arch_write_log_dirty(struct kvm_vcpu *vcpu, gpa_t l2_gpa)
+ {
+ if (kvm_x86_ops->write_log_dirty)
+- return kvm_x86_ops->write_log_dirty(vcpu);
++ return kvm_x86_ops->write_log_dirty(vcpu, l2_gpa);
+
+ return 0;
+ }
+diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
+index f7b2de7b6382..0b62c817f63f 100644
+--- a/arch/x86/kvm/mmu.h
++++ b/arch/x86/kvm/mmu.h
+@@ -215,7 +215,7 @@ void kvm_mmu_gfn_disallow_lpage(struct kvm_memory_slot *slot, gfn_t gfn);
+ void kvm_mmu_gfn_allow_lpage(struct kvm_memory_slot *slot, gfn_t gfn);
+ bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm,
+ struct kvm_memory_slot *slot, u64 gfn);
+-int kvm_arch_write_log_dirty(struct kvm_vcpu *vcpu);
++int kvm_arch_write_log_dirty(struct kvm_vcpu *vcpu, gpa_t l2_gpa);
+
+ int kvm_mmu_post_init_vm(struct kvm *kvm);
+ void kvm_mmu_pre_destroy_vm(struct kvm *kvm);
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index 61f10a4fd807..8220190b0605 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -202,7 +202,7 @@ static inline unsigned FNAME(gpte_access)(u64 gpte)
+ static int FNAME(update_accessed_dirty_bits)(struct kvm_vcpu *vcpu,
+ struct kvm_mmu *mmu,
+ struct guest_walker *walker,
+- int write_fault)
++ gpa_t addr, int write_fault)
+ {
+ unsigned level, index;
+ pt_element_t pte, orig_pte;
+@@ -227,7 +227,7 @@ static int FNAME(update_accessed_dirty_bits)(struct kvm_vcpu *vcpu,
+ !(pte & PT_GUEST_DIRTY_MASK)) {
+ trace_kvm_mmu_set_dirty_bit(table_gfn, index, sizeof(pte));
+ #if PTTYPE == PTTYPE_EPT
+- if (kvm_arch_write_log_dirty(vcpu))
++ if (kvm_arch_write_log_dirty(vcpu, addr))
+ return -EINVAL;
+ #endif
+ pte |= PT_GUEST_DIRTY_MASK;
+@@ -424,7 +424,8 @@ retry_walk:
+ (PT_GUEST_DIRTY_SHIFT - PT_GUEST_ACCESSED_SHIFT);
+
+ if (unlikely(!accessed_dirty)) {
+- ret = FNAME(update_accessed_dirty_bits)(vcpu, mmu, walker, write_fault);
++ ret = FNAME(update_accessed_dirty_bits)(vcpu, mmu, walker,
++ addr, write_fault);
+ if (unlikely(ret < 0))
+ goto error;
+ else if (ret)
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 2c4baff7553b..f90a9d4d1641 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -13845,11 +13845,10 @@ static void vmx_flush_log_dirty(struct kvm *kvm)
+ kvm_flush_pml_buffers(kvm);
+ }
+
+-static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu)
++static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu, gpa_t gpa)
+ {
+ struct vmcs12 *vmcs12;
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
+- gpa_t gpa;
+ struct page *page = NULL;
+ u64 *pml_address;
+
+@@ -13870,7 +13869,7 @@ static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu)
+ return 1;
+ }
+
+- gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS) & ~0xFFFull;
++ gpa &= ~0xFFFull;
+
+ page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->pml_address);
+ if (is_error_page(page))
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 50d59ad34619..0aa5c4134b90 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2499,7 +2499,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ return kvm_mtrr_set_msr(vcpu, msr, data);
+ case MSR_IA32_APICBASE:
+ return kvm_set_apic_base(vcpu, msr_info);
+- case APIC_BASE_MSR ... APIC_BASE_MSR + 0x3ff:
++ case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff:
+ return kvm_x2apic_msr_write(vcpu, msr, data);
+ case MSR_IA32_TSCDEADLINE:
+ kvm_set_lapic_tscdeadline_msr(vcpu, data);
+@@ -2797,7 +2797,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ case MSR_IA32_APICBASE:
+ msr_info->data = kvm_get_apic_base(vcpu);
+ break;
+- case APIC_BASE_MSR ... APIC_BASE_MSR + 0x3ff:
++ case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff:
+ return kvm_x2apic_msr_read(vcpu, msr_info->index, &msr_info->data);
+ break;
+ case MSR_IA32_TSCDEADLINE:
+diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
+index 9c5606d88f61..7077b3e28241 100644
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -23,6 +23,7 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
+ asm volatile(
+ " testq %[size8],%[size8]\n"
+ " jz 4f\n"
++ " .align 16\n"
+ "0: movq $0,(%[dst])\n"
+ " addq $8,%[dst]\n"
+ " decl %%ecx ; jnz 0b\n"
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index 5bd90cd4b51e..a059fad53f1b 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -293,7 +293,6 @@ bool bio_integrity_prep(struct bio *bio)
+
+ if (ret == 0) {
+ printk(KERN_ERR "could not attach integrity payload\n");
+- kfree(buf);
+ status = BLK_STS_RESOURCE;
+ goto err_end_io;
+ }
+diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
+index 0a8eb8961770..39ee0ca636aa 100644
+--- a/drivers/acpi/sysfs.c
++++ b/drivers/acpi/sysfs.c
+@@ -935,13 +935,13 @@ static void __exit interrupt_stats_exit(void)
+ }
+
+ static ssize_t
+-acpi_show_profile(struct device *dev, struct device_attribute *attr,
++acpi_show_profile(struct kobject *kobj, struct kobj_attribute *attr,
+ char *buf)
+ {
+ return sprintf(buf, "%d\n", acpi_gbl_FADT.preferred_profile);
+ }
+
+-static const struct device_attribute pm_profile_attr =
++static const struct kobj_attribute pm_profile_attr =
+ __ATTR(pm_profile, S_IRUGO, acpi_show_profile, NULL);
+
+ static ssize_t hotplug_enabled_show(struct kobject *kobj,
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 0c1572a1cc5e..6c2c2b07f029 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -3995,12 +3995,13 @@ static unsigned int ata_scsi_mode_select_xlat(struct ata_queued_cmd *qc)
+ {
+ struct scsi_cmnd *scmd = qc->scsicmd;
+ const u8 *cdb = scmd->cmnd;
+- const u8 *p;
+ u8 pg, spg;
+ unsigned six_byte, pg_len, hdr_len, bd_len;
+ int len;
+ u16 fp = (u16)-1;
+ u8 bp = 0xff;
++ u8 buffer[64];
++ const u8 *p = buffer;
+
+ VPRINTK("ENTER\n");
+
+@@ -4034,12 +4035,14 @@ static unsigned int ata_scsi_mode_select_xlat(struct ata_queued_cmd *qc)
+ if (!scsi_sg_count(scmd) || scsi_sglist(scmd)->length < len)
+ goto invalid_param_len;
+
+- p = page_address(sg_page(scsi_sglist(scmd)));
+-
+ /* Move past header and block descriptors. */
+ if (len < hdr_len)
+ goto invalid_param_len;
+
++ if (!sg_copy_to_buffer(scsi_sglist(scmd), scsi_sg_count(scmd),
++ buffer, sizeof(buffer)))
++ goto invalid_param_len;
++
+ if (six_byte)
+ bd_len = p[3];
+ else
+diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
+index 03867f539f3a..50ebd779d975 100644
+--- a/drivers/ata/sata_rcar.c
++++ b/drivers/ata/sata_rcar.c
+@@ -909,7 +909,7 @@ static int sata_rcar_probe(struct platform_device *pdev)
+ pm_runtime_enable(dev);
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0)
+- goto err_pm_disable;
++ goto err_pm_put;
+
+ host = ata_host_alloc(dev, 1);
+ if (!host) {
+@@ -940,7 +940,6 @@ static int sata_rcar_probe(struct platform_device *pdev)
+
+ err_pm_put:
+ pm_runtime_put(dev);
+-err_pm_disable:
+ pm_runtime_disable(dev);
+ return ret;
+ }
+@@ -994,8 +993,10 @@ static int sata_rcar_resume(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put(dev);
+ return ret;
++ }
+
+ if (priv->type == RCAR_GEN3_SATA) {
+ sata_rcar_init_module(priv);
+@@ -1020,8 +1021,10 @@ static int sata_rcar_restore(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put(dev);
+ return ret;
++ }
+
+ sata_rcar_setup_port(host);
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 6c9f6988bc09..b38b2d8c333d 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1336,6 +1336,7 @@ void regmap_exit(struct regmap *map)
+ if (map->hwlock)
+ hwspin_lock_free(map->hwlock);
+ kfree_const(map->name);
++ kfree(map->patch);
+ kfree(map);
+ }
+ EXPORT_SYMBOL_GPL(regmap_exit);
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index c1341c86bcde..728681a20b7f 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1238,7 +1238,7 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
+ if (lo->lo_offset != info->lo_offset ||
+ lo->lo_sizelimit != info->lo_sizelimit) {
+ sync_blockdev(lo->lo_device);
+- kill_bdev(lo->lo_device);
++ invalidate_bdev(lo->lo_device);
+ }
+
+ /* I/O need to be drained during transfer transition */
+@@ -1512,12 +1512,12 @@ static int loop_set_block_size(struct loop_device *lo, unsigned long arg)
+
+ if (lo->lo_queue->limits.logical_block_size != arg) {
+ sync_blockdev(lo->lo_device);
+- kill_bdev(lo->lo_device);
++ invalidate_bdev(lo->lo_device);
+ }
+
+ blk_mq_freeze_queue(lo->lo_queue);
+
+- /* kill_bdev should have truncated all the pages */
++ /* invalidate_bdev should have truncated all the pages */
+ if (lo->lo_queue->limits.logical_block_size != arg &&
+ lo->lo_device->bd_inode->i_mapping->nrpages) {
+ err = -EAGAIN;
+diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
+index 62c6696c1dbd..b6d7db362b21 100644
+--- a/drivers/char/hw_random/ks-sa-rng.c
++++ b/drivers/char/hw_random/ks-sa-rng.c
+@@ -216,6 +216,7 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0) {
+ dev_err(dev, "Failed to enable SA power-domain\n");
++ pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+ return ret;
+ }
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 05d6f9c86ac3..268ada29cd98 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2209,6 +2209,15 @@ static struct amd64_family_type family_types[] = {
+ .dbam_to_cs = f17_base_addr_to_cs_size,
+ }
+ },
++ [F17_M30H_CPUS] = {
++ .ctl_name = "F17h_M30h",
++ .f0_id = PCI_DEVICE_ID_AMD_17H_M30H_DF_F0,
++ .f6_id = PCI_DEVICE_ID_AMD_17H_M30H_DF_F6,
++ .ops = {
++ .early_channel_count = f17_early_channel_count,
++ .dbam_to_cs = f17_base_addr_to_cs_size,
++ }
++ },
+ };
+
+ /*
+@@ -3212,6 +3221,10 @@ static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt)
+ fam_type = &family_types[F17_M10H_CPUS];
+ pvt->ops = &family_types[F17_M10H_CPUS].ops;
+ break;
++ } else if (pvt->model >= 0x30 && pvt->model <= 0x3f) {
++ fam_type = &family_types[F17_M30H_CPUS];
++ pvt->ops = &family_types[F17_M30H_CPUS].ops;
++ break;
+ }
+ fam_type = &family_types[F17_CPUS];
+ pvt->ops = &family_types[F17_CPUS].ops;
+diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
+index 4242f8e39c18..de8dbb0b42b5 100644
+--- a/drivers/edac/amd64_edac.h
++++ b/drivers/edac/amd64_edac.h
+@@ -117,6 +117,8 @@
+ #define PCI_DEVICE_ID_AMD_17H_DF_F6 0x1466
+ #define PCI_DEVICE_ID_AMD_17H_M10H_DF_F0 0x15e8
+ #define PCI_DEVICE_ID_AMD_17H_M10H_DF_F6 0x15ee
++#define PCI_DEVICE_ID_AMD_17H_M30H_DF_F0 0x1490
++#define PCI_DEVICE_ID_AMD_17H_M30H_DF_F6 0x1496
+
+ /*
+ * Function 1 - Address Map
+@@ -284,6 +286,7 @@ enum amd_families {
+ F16_M30H_CPUS,
+ F17_CPUS,
+ F17_M10H_CPUS,
++ F17_M30H_CPUS,
+ NUM_FAMILIES,
+ };
+
+diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
+index 5d06bd247d07..2f6204b2fdd3 100644
+--- a/drivers/firmware/efi/esrt.c
++++ b/drivers/firmware/efi/esrt.c
+@@ -180,7 +180,7 @@ static int esre_create_sysfs_entry(void *esre, int entry_num)
+ rc = kobject_init_and_add(&entry->kobj, &esre1_ktype, NULL,
+ "entry%d", entry_num);
+ if (rc) {
+- kfree(entry);
++ kobject_put(&entry->kobj);
+ return rc;
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+index 962900932bee..11ea1a0e629b 100644
+--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
++++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+@@ -1561,7 +1561,7 @@ bool calculate_user_regamma_ramp(struct dc_transfer_func *output_tf,
+
+ kfree(rgb_regamma);
+ rgb_regamma_alloc_fail:
+- kvfree(rgb_user);
++ kfree(rgb_user);
+ rgb_user_alloc_fail:
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
+index 0fd8d6ba9828..f86ca163dcf3 100644
+--- a/drivers/gpu/drm/radeon/ni_dpm.c
++++ b/drivers/gpu/drm/radeon/ni_dpm.c
+@@ -2126,7 +2126,7 @@ static int ni_init_smc_spll_table(struct radeon_device *rdev)
+ if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT))
+ ret = -EINVAL;
+
+- if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT))
++ if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT))
+ ret = -EINVAL;
+
+ if (clk_v & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_SHIFT))
+diff --git a/drivers/gpu/drm/rcar-du/Kconfig b/drivers/gpu/drm/rcar-du/Kconfig
+index edde8d4b87a3..ddda84cdeb47 100644
+--- a/drivers/gpu/drm/rcar-du/Kconfig
++++ b/drivers/gpu/drm/rcar-du/Kconfig
+@@ -21,6 +21,7 @@ config DRM_RCAR_DW_HDMI
+ config DRM_RCAR_LVDS
+ tristate "R-Car DU LVDS Encoder Support"
+ depends on DRM && DRM_BRIDGE && OF
++ select DRM_KMS_HELPER
+ select DRM_PANEL
+ select OF_FLATTREE
+ select OF_OVERLAY
+diff --git a/drivers/i2c/busses/i2c-fsi.c b/drivers/i2c/busses/i2c-fsi.c
+index 1e2be2219a60..46aef609fb70 100644
+--- a/drivers/i2c/busses/i2c-fsi.c
++++ b/drivers/i2c/busses/i2c-fsi.c
+@@ -98,7 +98,7 @@
+ #define I2C_STAT_DAT_REQ BIT(25)
+ #define I2C_STAT_CMD_COMP BIT(24)
+ #define I2C_STAT_STOP_ERR BIT(23)
+-#define I2C_STAT_MAX_PORT GENMASK(19, 16)
++#define I2C_STAT_MAX_PORT GENMASK(22, 16)
+ #define I2C_STAT_ANY_INT BIT(15)
+ #define I2C_STAT_SCL_IN BIT(11)
+ #define I2C_STAT_SDA_IN BIT(10)
+diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
+index 47d196c026ba..af06198851f1 100644
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -145,8 +145,8 @@ enum msg_end_type {
+ * @has_continue_xfer_support: Continue transfer supports.
+ * @has_per_pkt_xfer_complete_irq: Has enable/disable capability for transfer
+ * complete interrupt per packet basis.
+- * @has_single_clk_source: The i2c controller has single clock source. Tegra30
+- * and earlier Socs has two clock sources i.e. div-clk and
++ * @has_single_clk_source: The I2C controller has single clock source. Tegra30
++ * and earlier SoCs have two clock sources i.e. div-clk and
+ * fast-clk.
+ * @has_config_load_reg: Has the config load register to load the new
+ * configuration.
+@@ -154,8 +154,19 @@ enum msg_end_type {
+ * @clk_divisor_std_fast_mode: Clock divisor in standard/fast mode. It is
+ * applicable if there is no fast clock source i.e. single clock
+ * source.
++ * @clk_divisor_fast_plus_mode: Clock divisor in fast mode plus. It is
++ * applicable if there is no fast clock source (i.e. single
++ * clock source).
++ * @has_multi_master_mode: The I2C controller supports running in single-master
++ * or multi-master mode.
++ * @has_slcg_override_reg: The I2C controller supports a register that
++ * overrides the second level clock gating.
++ * @has_mst_fifo: The I2C controller contains the new MST FIFO interface that
++ * provides additional features and allows for longer messages to
++ * be transferred in one go.
++ * @quirks: i2c adapter quirks for limiting write/read transfer size and not
++ * allowing 0 length transfers.
+ */
+-
+ struct tegra_i2c_hw_feature {
+ bool has_continue_xfer_support;
+ bool has_per_pkt_xfer_complete_irq;
+@@ -167,25 +178,31 @@ struct tegra_i2c_hw_feature {
+ bool has_multi_master_mode;
+ bool has_slcg_override_reg;
+ bool has_mst_fifo;
++ const struct i2c_adapter_quirks *quirks;
+ };
+
+ /**
+- * struct tegra_i2c_dev - per device i2c context
++ * struct tegra_i2c_dev - per device I2C context
+ * @dev: device reference for power management
+- * @hw: Tegra i2c hw feature.
+- * @adapter: core i2c layer adapter information
+- * @div_clk: clock reference for div clock of i2c controller.
+- * @fast_clk: clock reference for fast clock of i2c controller.
++ * @hw: Tegra I2C HW feature
++ * @adapter: core I2C layer adapter information
++ * @div_clk: clock reference for div clock of I2C controller
++ * @fast_clk: clock reference for fast clock of I2C controller
++ * @rst: reset control for the I2C controller
+ * @base: ioremapped registers cookie
+- * @cont_id: i2c controller id, used for for packet header
+- * @irq: irq number of transfer complete interrupt
+- * @is_dvc: identifies the DVC i2c controller, has a different register layout
++ * @cont_id: I2C controller ID, used for packet header
++ * @irq: IRQ number of transfer complete interrupt
++ * @irq_disabled: used to track whether or not the interrupt is enabled
++ * @is_dvc: identifies the DVC I2C controller, has a different register layout
+ * @msg_complete: transfer completion notifier
+ * @msg_err: error code for completed message
+ * @msg_buf: pointer to current message data
+ * @msg_buf_remaining: size of unsent data in the message buffer
+ * @msg_read: identifies read transfers
+- * @bus_clk_rate: current i2c bus clock rate
++ * @bus_clk_rate: current I2C bus clock rate
++ * @clk_divisor_non_hs_mode: clock divider for non-high-speed modes
++ * @is_multimaster_mode: track if I2C controller is in multi-master mode
++ * @xfer_lock: lock to serialize transfer submission and processing
+ */
+ struct tegra_i2c_dev {
+ struct device *dev;
+@@ -833,6 +850,10 @@ static const struct i2c_adapter_quirks tegra_i2c_quirks = {
+ .max_write_len = 4096 - 12,
+ };
+
++static const struct i2c_adapter_quirks tegra194_i2c_quirks = {
++ .flags = I2C_AQ_NO_ZERO_LEN,
++};
++
+ static const struct tegra_i2c_hw_feature tegra20_i2c_hw = {
+ .has_continue_xfer_support = false,
+ .has_per_pkt_xfer_complete_irq = false,
+@@ -844,6 +865,7 @@ static const struct tegra_i2c_hw_feature tegra20_i2c_hw = {
+ .has_multi_master_mode = false,
+ .has_slcg_override_reg = false,
+ .has_mst_fifo = false,
++ .quirks = &tegra_i2c_quirks,
+ };
+
+ static const struct tegra_i2c_hw_feature tegra30_i2c_hw = {
+@@ -857,6 +879,7 @@ static const struct tegra_i2c_hw_feature tegra30_i2c_hw = {
+ .has_multi_master_mode = false,
+ .has_slcg_override_reg = false,
+ .has_mst_fifo = false,
++ .quirks = &tegra_i2c_quirks,
+ };
+
+ static const struct tegra_i2c_hw_feature tegra114_i2c_hw = {
+@@ -870,6 +893,7 @@ static const struct tegra_i2c_hw_feature tegra114_i2c_hw = {
+ .has_multi_master_mode = false,
+ .has_slcg_override_reg = false,
+ .has_mst_fifo = false,
++ .quirks = &tegra_i2c_quirks,
+ };
+
+ static const struct tegra_i2c_hw_feature tegra124_i2c_hw = {
+@@ -883,6 +907,7 @@ static const struct tegra_i2c_hw_feature tegra124_i2c_hw = {
+ .has_multi_master_mode = false,
+ .has_slcg_override_reg = true,
+ .has_mst_fifo = false,
++ .quirks = &tegra_i2c_quirks,
+ };
+
+ static const struct tegra_i2c_hw_feature tegra210_i2c_hw = {
+@@ -896,6 +921,7 @@ static const struct tegra_i2c_hw_feature tegra210_i2c_hw = {
+ .has_multi_master_mode = true,
+ .has_slcg_override_reg = true,
+ .has_mst_fifo = false,
++ .quirks = &tegra_i2c_quirks,
+ };
+
+ static const struct tegra_i2c_hw_feature tegra194_i2c_hw = {
+@@ -909,6 +935,7 @@ static const struct tegra_i2c_hw_feature tegra194_i2c_hw = {
+ .has_multi_master_mode = true,
+ .has_slcg_override_reg = true,
+ .has_mst_fifo = true,
++ .quirks = &tegra194_i2c_quirks,
+ };
+
+ /* Match table for of_platform binding */
+@@ -960,7 +987,6 @@ static int tegra_i2c_probe(struct platform_device *pdev)
+ i2c_dev->base = base;
+ i2c_dev->div_clk = div_clk;
+ i2c_dev->adapter.algo = &tegra_i2c_algo;
+- i2c_dev->adapter.quirks = &tegra_i2c_quirks;
+ i2c_dev->irq = irq;
+ i2c_dev->cont_id = pdev->id;
+ i2c_dev->dev = &pdev->dev;
+@@ -976,6 +1002,7 @@ static int tegra_i2c_probe(struct platform_device *pdev)
+ i2c_dev->hw = of_device_get_match_data(&pdev->dev);
+ i2c_dev->is_dvc = of_device_is_compatible(pdev->dev.of_node,
+ "nvidia,tegra20-i2c-dvc");
++ i2c_dev->adapter.quirks = i2c_dev->hw->quirks;
+ init_completion(&i2c_dev->msg_complete);
+ spin_lock_init(&i2c_dev->xfer_lock);
+
+diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c
+index 9cd66cabb84f..8d6fad05b0c7 100644
+--- a/drivers/i2c/i2c-core-smbus.c
++++ b/drivers/i2c/i2c-core-smbus.c
+@@ -497,6 +497,13 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
+ break;
+ case I2C_SMBUS_BLOCK_DATA:
+ case I2C_SMBUS_BLOCK_PROC_CALL:
++ if (msg[1].buf[0] > I2C_SMBUS_BLOCK_MAX) {
++ dev_err(&adapter->dev,
++ "Invalid block size returned: %d\n",
++ msg[1].buf[0]);
++ status = -EPROTO;
++ goto cleanup;
++ }
+ for (i = 0; i < msg[1].buf[0] + 1; i++)
+ data->block[i] = msg[1].buf[i];
+ break;
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 5c03f4701ece..1f14cd4ce3db 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -1507,6 +1507,8 @@ static struct rdma_id_private *cma_find_listener(
+ {
+ struct rdma_id_private *id_priv, *id_priv_dev;
+
++ lockdep_assert_held(&lock);
++
+ if (!bind_list)
+ return ERR_PTR(-EINVAL);
+
+@@ -1552,6 +1554,7 @@ cma_ib_id_from_event(struct ib_cm_id *cm_id,
+ }
+ }
+
++ mutex_lock(&lock);
+ /*
+ * Net namespace might be getting deleted while route lookup,
+ * cm_id lookup is in progress. Therefore, perform netdevice
+@@ -1593,6 +1596,7 @@ cma_ib_id_from_event(struct ib_cm_id *cm_id,
+ id_priv = cma_find_listener(bind_list, cm_id, ib_event, &req, *net_dev);
+ err:
+ rcu_read_unlock();
++ mutex_unlock(&lock);
+ if (IS_ERR(id_priv) && *net_dev) {
+ dev_put(*net_dev);
+ *net_dev = NULL;
+@@ -2346,6 +2350,8 @@ static void cma_listen_on_dev(struct rdma_id_private *id_priv,
+ struct net *net = id_priv->id.route.addr.dev_addr.net;
+ int ret;
+
++ lockdep_assert_held(&lock);
++
+ if (cma_family(id_priv) == AF_IB && !rdma_cap_ib_cm(cma_dev->device, 1))
+ return;
+
+@@ -3081,6 +3087,8 @@ static void cma_bind_port(struct rdma_bind_list *bind_list,
+ u64 sid, mask;
+ __be16 port;
+
++ lockdep_assert_held(&lock);
++
+ addr = cma_src_addr(id_priv);
+ port = htons(bind_list->port);
+
+@@ -3109,6 +3117,8 @@ static int cma_alloc_port(enum rdma_ucm_port_space ps,
+ struct rdma_bind_list *bind_list;
+ int ret;
+
++ lockdep_assert_held(&lock);
++
+ bind_list = kzalloc(sizeof *bind_list, GFP_KERNEL);
+ if (!bind_list)
+ return -ENOMEM;
+@@ -3135,6 +3145,8 @@ static int cma_port_is_unique(struct rdma_bind_list *bind_list,
+ struct sockaddr *saddr = cma_src_addr(id_priv);
+ __be16 dport = cma_port(daddr);
+
++ lockdep_assert_held(&lock);
++
+ hlist_for_each_entry(cur_id, &bind_list->owners, node) {
+ struct sockaddr *cur_daddr = cma_dst_addr(cur_id);
+ struct sockaddr *cur_saddr = cma_src_addr(cur_id);
+@@ -3174,6 +3186,8 @@ static int cma_alloc_any_port(enum rdma_ucm_port_space ps,
+ unsigned int rover;
+ struct net *net = id_priv->id.route.addr.dev_addr.net;
+
++ lockdep_assert_held(&lock);
++
+ inet_get_local_port_range(net, &low, &high);
+ remaining = (high - low) + 1;
+ rover = prandom_u32() % remaining + low;
+@@ -3221,6 +3235,8 @@ static int cma_check_port(struct rdma_bind_list *bind_list,
+ struct rdma_id_private *cur_id;
+ struct sockaddr *addr, *cur_addr;
+
++ lockdep_assert_held(&lock);
++
+ addr = cma_src_addr(id_priv);
+ hlist_for_each_entry(cur_id, &bind_list->owners, node) {
+ if (id_priv == cur_id)
+@@ -3251,6 +3267,8 @@ static int cma_use_port(enum rdma_ucm_port_space ps,
+ unsigned short snum;
+ int ret;
+
++ lockdep_assert_held(&lock);
++
+ snum = ntohs(cma_port(cma_src_addr(id_priv)));
+ if (snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))
+ return -EACCES;
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index 218411282069..a36b3b4f5c0a 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -615,10 +615,10 @@ static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
+ idr_unlock(&ib_mad_clients);
+
+ flush_workqueue(port_priv->wq);
+- ib_cancel_rmpp_recvs(mad_agent_priv);
+
+ deref_mad_agent(mad_agent_priv);
+ wait_for_completion(&mad_agent_priv->comp);
++ ib_cancel_rmpp_recvs(mad_agent_priv);
+
+ ib_mad_agent_security_cleanup(&mad_agent_priv->agent);
+
+@@ -2920,6 +2920,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
+ DMA_FROM_DEVICE);
+ if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device,
+ sg_list.addr))) {
++ kfree(mad_priv);
+ ret = -ENOMEM;
+ break;
+ }
+diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+index 93b16237b767..256671577367 100644
+--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c
++++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+@@ -128,8 +128,17 @@ qedr_iw_issue_event(void *context,
+ if (params->cm_info) {
+ event.ird = params->cm_info->ird;
+ event.ord = params->cm_info->ord;
+- event.private_data_len = params->cm_info->private_data_len;
+- event.private_data = (void *)params->cm_info->private_data;
++ /* Only connect_request and reply have valid private data
++ * the rest of the events this may be left overs from
++ * connection establishment. CONNECT_REQUEST is issued via
++ * qedr_iw_mpa_request
++ */
++ if (event_type == IW_CM_EVENT_CONNECT_REPLY) {
++ event.private_data_len =
++ params->cm_info->private_data_len;
++ event.private_data =
++ (void *)params->cm_info->private_data;
++ }
+ }
+
+ if (ep->cm_id)
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index 4321c48eba6b..cc028353f9d5 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -281,6 +281,8 @@ static int persistent_memory_claim(struct dm_writecache *wc)
+ while (daa-- && i < p) {
+ pages[i++] = pfn_t_to_page(pfn);
+ pfn.val++;
++ if (!(i & 15))
++ cond_resched();
+ }
+ } while (i < p);
+ wc->memory_map = vmap(pages, p, VM_MAP, PAGE_KERNEL);
+@@ -811,6 +813,8 @@ static void writecache_discard(struct dm_writecache *wc, sector_t start, sector_
+ writecache_wait_for_ios(wc, WRITE);
+ discarded_something = true;
+ }
++ if (!writecache_entry_is_committed(wc, e))
++ wc->uncommitted_blocks--;
+ writecache_free_entry(wc, e);
+ }
+
+diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
+index 3e542224dd11..a917bc242c9c 100644
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -637,7 +637,7 @@ static int marvell_nfc_wait_op(struct nand_chip *chip, unsigned int timeout_ms)
+ * In case the interrupt was not served in the required time frame,
+ * check if the ISR was not served or if something went actually wrong.
+ */
+- if (ret && !pending) {
++ if (!ret && !pending) {
+ dev_err(nfc->dev, "Timeout waiting for RB signal\n");
+ return -ETIMEDOUT;
+ }
+diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
+index 6d3221134927..dd63b993ce7b 100644
+--- a/drivers/net/ethernet/atheros/alx/main.c
++++ b/drivers/net/ethernet/atheros/alx/main.c
+@@ -1250,8 +1250,12 @@ out_disable_adv_intr:
+
+ static void __alx_stop(struct alx_priv *alx)
+ {
+- alx_halt(alx);
+ alx_free_irq(alx);
++
++ cancel_work_sync(&alx->link_check_wk);
++ cancel_work_sync(&alx->reset_wk);
++
++ alx_halt(alx);
+ alx_free_rings(alx);
+ alx_free_napis(alx);
+ }
+@@ -1861,9 +1865,6 @@ static void alx_remove(struct pci_dev *pdev)
+ struct alx_priv *alx = pci_get_drvdata(pdev);
+ struct alx_hw *hw = &alx->hw;
+
+- cancel_work_sync(&alx->link_check_wk);
+- cancel_work_sync(&alx->reset_wk);
+-
+ /* restore permanent mac address */
+ alx_set_macaddr(hw, hw->perm_addr);
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 40e8ef984b62..c7667017c1a3 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1593,11 +1593,6 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
+ goto out;
+ }
+
+- if (skb_padto(skb, ETH_ZLEN)) {
+- ret = NETDEV_TX_OK;
+- goto out;
+- }
+-
+ /* Retain how many bytes will be sent on the wire, without TSB inserted
+ * by transmit checksum offload
+ */
+@@ -1646,6 +1641,9 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
+ len_stat = (size << DMA_BUFLENGTH_SHIFT) |
+ (priv->hw_params->qtag_mask << DMA_TX_QTAG_SHIFT);
+
++ /* Note: if we ever change from DMA_TX_APPEND_CRC below we
++ * will need to restore software padding of "runt" packets
++ */
+ if (!i) {
+ len_stat |= DMA_TX_APPEND_CRC | DMA_SOP;
+ if (skb->ip_summed == CHECKSUM_PARTIAL)
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+index b3596e0ee47b..57582efa362d 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+@@ -191,10 +191,6 @@ void bcmgenet_wol_power_up_cfg(struct bcmgenet_priv *priv,
+ reg &= ~MPD_EN;
+ bcmgenet_umac_writel(priv, reg, UMAC_MPD_CTRL);
+
+- reg = bcmgenet_hfb_reg_readl(priv, HFB_CTRL);
+- reg &= ~(RBUF_HFB_EN | RBUF_ACPI_EN);
+- bcmgenet_hfb_reg_writel(priv, reg, HFB_CTRL);
+-
+ /* Disable CRC Forward */
+ reg = bcmgenet_umac_readl(priv, UMAC_CMD);
+ reg &= ~CMD_CRC_FWD;
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index a12962702611..be845df05039 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -18229,8 +18229,8 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
+
+ rtnl_lock();
+
+- /* We probably don't have netdev yet */
+- if (!netdev || !netif_running(netdev))
++ /* Could be second call or maybe we don't have netdev yet */
++ if (!netdev || tp->pcierr_recovery || !netif_running(netdev))
+ goto done;
+
+ /* We needn't recover from permanent error */
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+index 986277744611..08f4780e7fe7 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+@@ -507,41 +507,20 @@ u64 cxgb4_select_ntuple(struct net_device *dev,
+ }
+ EXPORT_SYMBOL(cxgb4_select_ntuple);
+
+-/*
+- * Called when address resolution fails for an L2T entry to handle packets
+- * on the arpq head. If a packet specifies a failure handler it is invoked,
+- * otherwise the packet is sent to the device.
+- */
+-static void handle_failed_resolution(struct adapter *adap, struct l2t_entry *e)
+-{
+- struct sk_buff *skb;
+-
+- while ((skb = __skb_dequeue(&e->arpq)) != NULL) {
+- const struct l2t_skb_cb *cb = L2T_SKB_CB(skb);
+-
+- spin_unlock(&e->lock);
+- if (cb->arp_err_handler)
+- cb->arp_err_handler(cb->handle, skb);
+- else
+- t4_ofld_send(adap, skb);
+- spin_lock(&e->lock);
+- }
+-}
+-
+ /*
+ * Called when the host's neighbor layer makes a change to some entry that is
+ * loaded into the HW L2 table.
+ */
+ void t4_l2t_update(struct adapter *adap, struct neighbour *neigh)
+ {
+- struct l2t_entry *e;
+- struct sk_buff_head *arpq = NULL;
+- struct l2t_data *d = adap->l2t;
+ unsigned int addr_len = neigh->tbl->key_len;
+ u32 *addr = (u32 *) neigh->primary_key;
+- int ifidx = neigh->dev->ifindex;
+- int hash = addr_hash(d, addr, addr_len, ifidx);
++ int hash, ifidx = neigh->dev->ifindex;
++ struct sk_buff_head *arpq = NULL;
++ struct l2t_data *d = adap->l2t;
++ struct l2t_entry *e;
+
++ hash = addr_hash(d, addr, addr_len, ifidx);
+ read_lock_bh(&d->lock);
+ for (e = d->l2tab[hash].first; e; e = e->next)
+ if (!addreq(e, addr) && e->ifindex == ifidx) {
+@@ -574,8 +553,25 @@ void t4_l2t_update(struct adapter *adap, struct neighbour *neigh)
+ write_l2e(adap, e, 0);
+ }
+
+- if (arpq)
+- handle_failed_resolution(adap, e);
++ if (arpq) {
++ struct sk_buff *skb;
++
++ /* Called when address resolution fails for an L2T
++ * entry to handle packets on the arpq head. If a
++ * packet specifies a failure handler it is invoked,
++ * otherwise the packet is sent to the device.
++ */
++ while ((skb = __skb_dequeue(&e->arpq)) != NULL) {
++ const struct l2t_skb_cb *cb = L2T_SKB_CB(skb);
++
++ spin_unlock(&e->lock);
++ if (cb->arp_err_handler)
++ cb->arp_err_handler(cb->handle, skb);
++ else
++ t4_ofld_send(adap, skb);
++ spin_lock(&e->lock);
++ }
++ }
+ spin_unlock_bh(&e->lock);
+ }
+
+diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
+index 40ad1e503255..e2f6670d6eaf 100644
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -1695,7 +1695,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
+ }
+
+ netdev->min_mtu = IBMVETH_MIN_MTU;
+- netdev->max_mtu = ETH_MAX_MTU;
++ netdev->max_mtu = ETH_MAX_MTU - IBMVETH_BUFF_OH;
+
+ memcpy(netdev->dev_addr, mac_addr_p, ETH_ALEN);
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 645298628b6f..5e9e45befc87 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -792,12 +792,13 @@ static int ibmvnic_login(struct net_device *netdev)
+ struct ibmvnic_adapter *adapter = netdev_priv(netdev);
+ unsigned long timeout = msecs_to_jiffies(30000);
+ int retry_count = 0;
++ int retries = 10;
+ bool retry;
+ int rc;
+
+ do {
+ retry = false;
+- if (retry_count > IBMVNIC_MAX_QUEUES) {
++ if (retry_count > retries) {
+ netdev_warn(netdev, "Login attempts exceeded\n");
+ return -1;
+ }
+@@ -812,11 +813,23 @@ static int ibmvnic_login(struct net_device *netdev)
+
+ if (!wait_for_completion_timeout(&adapter->init_done,
+ timeout)) {
+- netdev_warn(netdev, "Login timed out\n");
+- return -1;
++ netdev_warn(netdev, "Login timed out, retrying...\n");
++ retry = true;
++ adapter->init_done_rc = 0;
++ retry_count++;
++ continue;
+ }
+
+- if (adapter->init_done_rc == PARTIALSUCCESS) {
++ if (adapter->init_done_rc == ABORTED) {
++ netdev_warn(netdev, "Login aborted, retrying...\n");
++ retry = true;
++ adapter->init_done_rc = 0;
++ retry_count++;
++ /* FW or device may be busy, so
++ * wait a bit before retrying login
++ */
++ msleep(500);
++ } else if (adapter->init_done_rc == PARTIALSUCCESS) {
+ retry_count++;
+ release_sub_crqs(adapter, 1);
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+index f1977aa440e5..f3d7c38f539a 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+@@ -397,7 +397,7 @@ static void qed_cxt_qm_iids(struct qed_hwfn *p_hwfn,
+ vf_tids += segs[NUM_TASK_PF_SEGMENTS].count;
+ }
+
+- iids->vf_cids += vf_cids * p_mngr->vf_count;
++ iids->vf_cids = vf_cids;
+ iids->tids += vf_tids * p_mngr->vf_count;
+
+ DP_VERBOSE(p_hwfn, QED_MSG_ILT,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+index 5dda547772c1..93a0fbf6a132 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+@@ -81,12 +81,17 @@ static void qed_vf_pf_req_end(struct qed_hwfn *p_hwfn, int req_status)
+ mutex_unlock(&(p_hwfn->vf_iov_info->mutex));
+ }
+
++#define QED_VF_CHANNEL_USLEEP_ITERATIONS 90
++#define QED_VF_CHANNEL_USLEEP_DELAY 100
++#define QED_VF_CHANNEL_MSLEEP_ITERATIONS 10
++#define QED_VF_CHANNEL_MSLEEP_DELAY 25
++
+ static int qed_send_msg2pf(struct qed_hwfn *p_hwfn, u8 *done, u32 resp_size)
+ {
+ union vfpf_tlvs *p_req = p_hwfn->vf_iov_info->vf2pf_request;
+ struct ustorm_trigger_vf_zone trigger;
+ struct ustorm_vf_zone *zone_data;
+- int rc = 0, time = 100;
++ int iter, rc = 0;
+
+ zone_data = (struct ustorm_vf_zone *)PXP_VF_BAR0_START_USDM_ZONE_B;
+
+@@ -126,11 +131,19 @@ static int qed_send_msg2pf(struct qed_hwfn *p_hwfn, u8 *done, u32 resp_size)
+ REG_WR(p_hwfn, (uintptr_t)&zone_data->trigger, *((u32 *)&trigger));
+
+ /* When PF would be done with the response, it would write back to the
+- * `done' address. Poll until then.
++ * `done' address from a coherent DMA zone. Poll until then.
+ */
+- while ((!*done) && time) {
+- msleep(25);
+- time--;
++
++ iter = QED_VF_CHANNEL_USLEEP_ITERATIONS;
++ while (!*done && iter--) {
++ udelay(QED_VF_CHANNEL_USLEEP_DELAY);
++ dma_rmb();
++ }
++
++ iter = QED_VF_CHANNEL_MSLEEP_ITERATIONS;
++ while (!*done && iter--) {
++ msleep(QED_VF_CHANNEL_MSLEEP_DELAY);
++ dma_rmb();
+ }
+
+ if (!*done) {
+diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c
+index aeafdb9ac015..b13ab4eee4c7 100644
+--- a/drivers/net/ethernet/rocker/rocker_main.c
++++ b/drivers/net/ethernet/rocker/rocker_main.c
+@@ -651,10 +651,10 @@ static int rocker_dma_rings_init(struct rocker *rocker)
+ err_dma_event_ring_bufs_alloc:
+ rocker_dma_ring_destroy(rocker, &rocker->event_ring);
+ err_dma_event_ring_create:
++ rocker_dma_cmd_ring_waits_free(rocker);
++err_dma_cmd_ring_waits_alloc:
+ rocker_dma_ring_bufs_free(rocker, &rocker->cmd_ring,
+ PCI_DMA_BIDIRECTIONAL);
+-err_dma_cmd_ring_waits_alloc:
+- rocker_dma_cmd_ring_waits_free(rocker);
+ err_dma_cmd_ring_bufs_alloc:
+ rocker_dma_ring_destroy(rocker, &rocker->cmd_ring);
+ return err;
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 302d183beb9e..54ac599cffb4 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -606,8 +606,10 @@ static int get_phy_id(struct mii_bus *bus, int addr, u32 *phy_id,
+
+ /* Grab the bits from PHYIR2, and put them in the lower half */
+ phy_reg = mdiobus_read(bus, addr, MII_PHYSID2);
+- if (phy_reg < 0)
+- return -EIO;
++ if (phy_reg < 0) {
++ /* returning -ENODEV doesn't stop bus scanning */
++ return (phy_reg == -EIO || phy_reg == -ENODEV) ? -ENODEV : -EIO;
++ }
+
+ *phy_id |= (phy_reg & 0xffff);
+
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index 2207f7a7d1ff..8455f72007b9 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1400,10 +1400,10 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ }
+
+ if (pkt_cnt == 0) {
+- /* Skip IP alignment psudo header */
+- skb_pull(skb, 2);
+ skb->len = pkt_len;
+- skb_set_tail_pointer(skb, pkt_len);
++ /* Skip IP alignment pseudo header */
++ skb_pull(skb, 2);
++ skb_set_tail_pointer(skb, skb->len);
+ skb->truesize = pkt_len + sizeof(struct sk_buff);
+ ax88179_rx_checksum(skb, pkt_hdr);
+ return 1;
+@@ -1412,8 +1412,9 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ ax_skb = skb_clone(skb, GFP_ATOMIC);
+ if (ax_skb) {
+ ax_skb->len = pkt_len;
+- ax_skb->data = skb->data + 2;
+- skb_set_tail_pointer(ax_skb, pkt_len);
++ /* Skip IP alignment pseudo header */
++ skb_pull(ax_skb, 2);
++ skb_set_tail_pointer(ax_skb, ax_skb->len);
+ ax_skb->truesize = pkt_len + sizeof(struct sk_buff);
+ ax88179_rx_checksum(ax_skb, pkt_hdr);
+ usbnet_skb_return(dev, ax_skb);
+diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
+index 69a377ab2604..30e92a9cc97e 100644
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -196,6 +196,19 @@ static const struct regulator_ops pfuze100_swb_regulator_ops = {
+
+ };
+
++static const struct regulator_ops pfuze3000_sw_regulator_ops = {
++ .enable = regulator_enable_regmap,
++ .disable = regulator_disable_regmap,
++ .is_enabled = regulator_is_enabled_regmap,
++ .list_voltage = regulator_list_voltage_table,
++ .map_voltage = regulator_map_voltage_ascend,
++ .set_voltage_sel = regulator_set_voltage_sel_regmap,
++ .get_voltage_sel = regulator_get_voltage_sel_regmap,
++ .set_voltage_time_sel = regulator_set_voltage_time_sel,
++ .set_ramp_delay = pfuze100_set_ramp_delay,
++
++};
++
+ #define PFUZE100_FIXED_REG(_chip, _name, base, voltage) \
+ [_chip ## _ ## _name] = { \
+ .desc = { \
+@@ -305,23 +318,28 @@ static const struct regulator_ops pfuze100_swb_regulator_ops = {
+ .stby_mask = 0x20, \
+ }
+
+-
+-#define PFUZE3000_SW2_REG(_chip, _name, base, min, max, step) { \
+- .desc = { \
+- .name = #_name,\
+- .n_voltages = ((max) - (min)) / (step) + 1, \
+- .ops = &pfuze100_sw_regulator_ops, \
+- .type = REGULATOR_VOLTAGE, \
+- .id = _chip ## _ ## _name, \
+- .owner = THIS_MODULE, \
+- .min_uV = (min), \
+- .uV_step = (step), \
+- .vsel_reg = (base) + PFUZE100_VOL_OFFSET, \
+- .vsel_mask = 0x7, \
+- }, \
+- .stby_reg = (base) + PFUZE100_STANDBY_OFFSET, \
+- .stby_mask = 0x7, \
+-}
++/* No linar case for the some switches of PFUZE3000 */
++#define PFUZE3000_SW_REG(_chip, _name, base, mask, voltages) \
++ [_chip ## _ ## _name] = { \
++ .desc = { \
++ .name = #_name, \
++ .n_voltages = ARRAY_SIZE(voltages), \
++ .ops = &pfuze3000_sw_regulator_ops, \
++ .type = REGULATOR_VOLTAGE, \
++ .id = _chip ## _ ## _name, \
++ .owner = THIS_MODULE, \
++ .volt_table = voltages, \
++ .vsel_reg = (base) + PFUZE100_VOL_OFFSET, \
++ .vsel_mask = (mask), \
++ .enable_reg = (base) + PFUZE100_MODE_OFFSET, \
++ .enable_mask = 0xf, \
++ .enable_val = 0x8, \
++ .enable_time = 500, \
++ }, \
++ .stby_reg = (base) + PFUZE100_STANDBY_OFFSET, \
++ .stby_mask = (mask), \
++ .sw_reg = true, \
++ }
+
+ #define PFUZE3000_SW3_REG(_chip, _name, base, min, max, step) { \
+ .desc = { \
+@@ -377,9 +395,9 @@ static struct pfuze_regulator pfuze200_regulators[] = {
+ };
+
+ static struct pfuze_regulator pfuze3000_regulators[] = {
+- PFUZE100_SWB_REG(PFUZE3000, SW1A, PFUZE100_SW1ABVOL, 0x1f, pfuze3000_sw1a),
++ PFUZE3000_SW_REG(PFUZE3000, SW1A, PFUZE100_SW1ABVOL, 0x1f, pfuze3000_sw1a),
+ PFUZE100_SW_REG(PFUZE3000, SW1B, PFUZE100_SW1CVOL, 700000, 1475000, 25000),
+- PFUZE100_SWB_REG(PFUZE3000, SW2, PFUZE100_SW2VOL, 0x7, pfuze3000_sw2lo),
++ PFUZE3000_SW_REG(PFUZE3000, SW2, PFUZE100_SW2VOL, 0x7, pfuze3000_sw2lo),
+ PFUZE3000_SW3_REG(PFUZE3000, SW3, PFUZE100_SW3AVOL, 900000, 1650000, 50000),
+ PFUZE100_SWB_REG(PFUZE3000, SWBST, PFUZE100_SWBSTCON1, 0x3, pfuze100_swbst),
+ PFUZE100_SWB_REG(PFUZE3000, VSNVS, PFUZE100_VSNVSVOL, 0x7, pfuze100_vsnvs),
+@@ -393,8 +411,8 @@ static struct pfuze_regulator pfuze3000_regulators[] = {
+ };
+
+ static struct pfuze_regulator pfuze3001_regulators[] = {
+- PFUZE100_SWB_REG(PFUZE3001, SW1, PFUZE100_SW1ABVOL, 0x1f, pfuze3000_sw1a),
+- PFUZE100_SWB_REG(PFUZE3001, SW2, PFUZE100_SW2VOL, 0x7, pfuze3000_sw2lo),
++ PFUZE3000_SW_REG(PFUZE3001, SW1, PFUZE100_SW1ABVOL, 0x1f, pfuze3000_sw1a),
++ PFUZE3000_SW_REG(PFUZE3001, SW2, PFUZE100_SW2VOL, 0x7, pfuze3000_sw2lo),
+ PFUZE3000_SW3_REG(PFUZE3001, SW3, PFUZE100_SW3AVOL, 900000, 1650000, 50000),
+ PFUZE100_SWB_REG(PFUZE3001, VSNVS, PFUZE100_VSNVSVOL, 0x7, pfuze100_vsnvs),
+ PFUZE100_VGEN_REG(PFUZE3001, VLDO1, PFUZE100_VGEN1VOL, 1800000, 3300000, 100000),
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index 7522aa06672d..b7afdb55a459 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -592,7 +592,10 @@ static void zfcp_erp_strategy_check_fsfreq(struct zfcp_erp_action *act)
+ ZFCP_STATUS_ERP_TIMEDOUT)) {
+ req->status |= ZFCP_STATUS_FSFREQ_DISMISSED;
+ zfcp_dbf_rec_run("erscf_1", act);
+- req->erp_action = NULL;
++ /* lock-free concurrent access with
++ * zfcp_erp_timeout_handler()
++ */
++ WRITE_ONCE(req->erp_action, NULL);
+ }
+ if (act->status & ZFCP_STATUS_ERP_TIMEDOUT)
+ zfcp_dbf_rec_run("erscf_2", act);
+@@ -628,8 +631,14 @@ void zfcp_erp_notify(struct zfcp_erp_action *erp_action, unsigned long set_mask)
+ void zfcp_erp_timeout_handler(struct timer_list *t)
+ {
+ struct zfcp_fsf_req *fsf_req = from_timer(fsf_req, t, timer);
+- struct zfcp_erp_action *act = fsf_req->erp_action;
++ struct zfcp_erp_action *act;
+
++ if (fsf_req->status & ZFCP_STATUS_FSFREQ_DISMISSED)
++ return;
++ /* lock-free concurrent access with zfcp_erp_strategy_check_fsfreq() */
++ act = READ_ONCE(fsf_req->erp_action);
++ if (!act)
++ return;
+ zfcp_erp_notify(act, ZFCP_STATUS_ERP_TIMEDOUT);
+ }
+
+diff --git a/drivers/staging/erofs/unzip_vle.h b/drivers/staging/erofs/unzip_vle.h
+index 684ff06fc7bf..630fd1f4f123 100644
+--- a/drivers/staging/erofs/unzip_vle.h
++++ b/drivers/staging/erofs/unzip_vle.h
+@@ -169,22 +169,22 @@ static inline void z_erofs_onlinepage_init(struct page *page)
+ static inline void z_erofs_onlinepage_fixup(struct page *page,
+ uintptr_t index, bool down)
+ {
+- unsigned long *p, o, v, id;
+-repeat:
+- p = &page_private(page);
+- o = READ_ONCE(*p);
++ union z_erofs_onlinepage_converter u = { .v = &page_private(page) };
++ int orig, orig_index, val;
+
+- id = o >> Z_EROFS_ONLINEPAGE_INDEX_SHIFT;
+- if (id) {
++repeat:
++ orig = atomic_read(u.o);
++ orig_index = orig >> Z_EROFS_ONLINEPAGE_INDEX_SHIFT;
++ if (orig_index) {
+ if (!index)
+ return;
+
+- BUG_ON(id != index);
++ DBG_BUGON(orig_index != index);
+ }
+
+- v = (index << Z_EROFS_ONLINEPAGE_INDEX_SHIFT) |
+- ((o & Z_EROFS_ONLINEPAGE_COUNT_MASK) + (unsigned)down);
+- if (cmpxchg(p, o, v) != o)
++ val = (index << Z_EROFS_ONLINEPAGE_INDEX_SHIFT) |
++ ((orig & Z_EROFS_ONLINEPAGE_COUNT_MASK) + (unsigned int)down);
++ if (atomic_cmpxchg(u.o, orig, val) != orig)
+ goto repeat;
+ }
+
+diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+index 2c65af319a60..6c6bf03ac38a 100644
+--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
++++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+@@ -1856,12 +1856,14 @@ int update_sta_support_rate(struct adapter *padapter, u8 *pvar_ie, uint var_ie_l
+ pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
+ if (!pIE)
+ return _FAIL;
++ if (ie_len > sizeof(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates))
++ return _FAIL;
+
+ memcpy(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates, pIE->data, ie_len);
+ supportRateNum = ie_len;
+
+ pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _EXT_SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
+- if (pIE)
++ if (pIE && (ie_len <= sizeof(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates) - supportRateNum))
+ memcpy((pmlmeinfo->FW_sta_info[cam_idx].SupportedRates + supportRateNum), pIE->data, ie_len);
+
+ return _SUCCESS;
+diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
+index f8e43a6faea9..cdcc64ea2554 100644
+--- a/drivers/tty/hvc/hvc_console.c
++++ b/drivers/tty/hvc/hvc_console.c
+@@ -75,8 +75,6 @@ static LIST_HEAD(hvc_structs);
+ */
+ static DEFINE_MUTEX(hvc_structs_mutex);
+
+-/* Mutex to serialize hvc_open */
+-static DEFINE_MUTEX(hvc_open_mutex);
+ /*
+ * This value is used to assign a tty->index value to a hvc_struct based
+ * upon order of exposure via hvc_probe(), when we can not match it to
+@@ -348,24 +346,16 @@ static int hvc_install(struct tty_driver *driver, struct tty_struct *tty)
+ */
+ static int hvc_open(struct tty_struct *tty, struct file * filp)
+ {
+- struct hvc_struct *hp;
++ struct hvc_struct *hp = tty->driver_data;
+ unsigned long flags;
+ int rc = 0;
+
+- mutex_lock(&hvc_open_mutex);
+-
+- hp = tty->driver_data;
+- if (!hp) {
+- rc = -EIO;
+- goto out;
+- }
+-
+ spin_lock_irqsave(&hp->port.lock, flags);
+ /* Check and then increment for fast path open. */
+ if (hp->port.count++ > 0) {
+ spin_unlock_irqrestore(&hp->port.lock, flags);
+ hvc_kick();
+- goto out;
++ return 0;
+ } /* else count == 0 */
+ spin_unlock_irqrestore(&hp->port.lock, flags);
+
+@@ -393,8 +383,6 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
+ /* Force wakeup of the polling thread */
+ hvc_kick();
+
+-out:
+- mutex_unlock(&hvc_open_mutex);
+ return rc;
+ }
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index e8b9b27937ed..ea7883e1fbe2 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1721,6 +1721,8 @@ static int acm_pre_reset(struct usb_interface *intf)
+
+ static const struct usb_device_id acm_ids[] = {
+ /* quirky and broken devices */
++ { USB_DEVICE(0x0424, 0x274e), /* Microchip Technology, Inc. (formerly SMSC) */
++ .driver_info = DISABLE_ECHO, }, /* DISABLE ECHO in termios flag */
+ { USB_DEVICE(0x076d, 0x0006), /* Denso Cradle CU-321 */
+ .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */
+ { USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 3e8efe759c3e..e0b77674869c 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -218,11 +218,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Logitech HD Webcam C270 */
+ { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME },
+
+- /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
++ /* Logitech HD Pro Webcams C920, C920-C, C922, C925e and C930e */
+ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x046d, 0x085c), .driver_info = USB_QUIRK_DELAY_INIT },
+
+ /* Logitech ConferenceCam CC3000e */
+ { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index d8424834902d..f18aa3f59e51 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -4759,12 +4759,6 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg)
+ epnum, 0);
+ }
+
+- ret = usb_add_gadget_udc(dev, &hsotg->gadget);
+- if (ret) {
+- dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep,
+- hsotg->ctrl_req);
+- return ret;
+- }
+ dwc2_hsotg_dump(hsotg);
+
+ return 0;
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
+index 577642895b57..c3383f30b37a 100644
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -492,6 +492,17 @@ static int dwc2_driver_probe(struct platform_device *dev)
+ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL)
+ dwc2_lowlevel_hw_disable(hsotg);
+
++#if IS_ENABLED(CONFIG_USB_DWC2_PERIPHERAL) || \
++ IS_ENABLED(CONFIG_USB_DWC2_DUAL_ROLE)
++ /* Postponed adding a new gadget to the udc class driver list */
++ if (hsotg->gadget_enabled) {
++ retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget);
++ if (retval) {
++ dwc2_hsotg_remove(hsotg);
++ goto error;
++ }
++ }
++#endif /* CONFIG_USB_DWC2_PERIPHERAL || CONFIG_USB_DWC2_DUAL_ROLE */
+ return 0;
+
+ error:
+diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
+index 95f52232493b..83e98b59910e 100644
+--- a/drivers/usb/gadget/udc/mv_udc_core.c
++++ b/drivers/usb/gadget/udc/mv_udc_core.c
+@@ -2313,7 +2313,8 @@ static int mv_udc_probe(struct platform_device *pdev)
+ return 0;
+
+ err_create_workqueue:
+- destroy_workqueue(udc->qwork);
++ if (udc->qwork)
++ destroy_workqueue(udc->qwork);
+ err_destroy_dma:
+ dma_pool_destroy(udc->dtd_pool);
+ err_free_dma:
+diff --git a/drivers/usb/host/ehci-exynos.c b/drivers/usb/host/ehci-exynos.c
+index 8e3bab1e0c1f..f433883ca2bf 100644
+--- a/drivers/usb/host/ehci-exynos.c
++++ b/drivers/usb/host/ehci-exynos.c
+@@ -188,9 +188,8 @@ static int exynos_ehci_probe(struct platform_device *pdev)
+ hcd->rsrc_len = resource_size(res);
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq) {
+- dev_err(&pdev->dev, "Failed to get IRQ\n");
+- err = -ENODEV;
++ if (irq < 0) {
++ err = irq;
+ goto fail_io;
+ }
+
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index fe9422d3bcdc..fcfad5c298a9 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -216,6 +216,13 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
+ ehci_info(ehci, "applying MosChip frame-index workaround\n");
+ ehci->frame_index_bug = 1;
+ break;
++ case PCI_VENDOR_ID_HUAWEI:
++ /* Synopsys HC bug */
++ if (pdev->device == 0xa239) {
++ ehci_info(ehci, "applying Synopsys HC workaround\n");
++ ehci->has_synopsys_hc_bug = 1;
++ }
++ break;
+ }
+
+ /* optional debug port, normally in the first BAR */
+diff --git a/drivers/usb/host/ohci-sm501.c b/drivers/usb/host/ohci-sm501.c
+index c9233cddf9a2..0a39dc58f376 100644
+--- a/drivers/usb/host/ohci-sm501.c
++++ b/drivers/usb/host/ohci-sm501.c
+@@ -196,6 +196,7 @@ static int ohci_hcd_sm501_drv_remove(struct platform_device *pdev)
+ struct resource *mem;
+
+ usb_remove_hcd(hcd);
++ iounmap(hcd->regs);
+ release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+ usb_put_hcd(hcd);
+ dma_release_declared_memory(&pdev->dev);
+diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
+index 60987c787e44..2c3b31109e16 100644
+--- a/drivers/usb/host/xhci-mtk.c
++++ b/drivers/usb/host/xhci-mtk.c
+@@ -592,6 +592,9 @@ static int xhci_mtk_remove(struct platform_device *dev)
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
++ pm_runtime_put_noidle(&dev->dev);
++ pm_runtime_disable(&dev->dev);
++
+ usb_remove_hcd(shared_hcd);
+ xhci->shared_hcd = NULL;
+ device_init_wakeup(&dev->dev, false);
+@@ -602,8 +605,6 @@ static int xhci_mtk_remove(struct platform_device *dev)
+ xhci_mtk_sch_exit(mtk);
+ xhci_mtk_clks_disable(mtk);
+ xhci_mtk_ldos_disable(mtk);
+- pm_runtime_put_sync(&dev->dev);
+- pm_runtime_disable(&dev->dev);
+
+ return 0;
+ }
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index b4177287d7d0..f8e71c7aba6e 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1405,6 +1405,7 @@ static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id,
+ xhci->devs[slot_id]->out_ctx, ep_index);
+
+ ep_ctx = xhci_get_ep_ctx(xhci, command->in_ctx, ep_index);
++ ep_ctx->ep_info &= cpu_to_le32(~EP_STATE_MASK);/* must clear */
+ ep_ctx->ep_info2 &= cpu_to_le32(~MAX_PACKET_MASK);
+ ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet_size));
+
+@@ -4304,6 +4305,9 @@ static int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
+ int hird, exit_latency;
+ int ret;
+
++ if (xhci->quirks & XHCI_HW_LPM_DISABLE)
++ return -EPERM;
++
+ if (hcd->speed >= HCD_USB3 || !xhci->hw_lpm_support ||
+ !udev->lpm_capable)
+ return -EPERM;
+@@ -4326,7 +4330,7 @@ static int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
+ xhci_dbg(xhci, "%s port %d USB2 hardware LPM\n",
+ enable ? "enable" : "disable", port_num + 1);
+
+- if (enable && !(xhci->quirks & XHCI_HW_LPM_DISABLE)) {
++ if (enable) {
+ /* Host supports BESL timeout instead of HIRD */
+ if (udev->usb2_hw_lpm_besl_capable) {
+ /* if device doesn't have a preferred BESL value use a
+@@ -4385,6 +4389,9 @@ static int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd,
+ mutex_lock(hcd->bandwidth_mutex);
+ xhci_change_max_exit_latency(xhci, udev, 0);
+ mutex_unlock(hcd->bandwidth_mutex);
++ readl_poll_timeout(ports[port_num]->addr, pm_val,
++ (pm_val & PORT_PLS_MASK) == XDEV_U0,
++ 100, 10000);
+ return 0;
+ }
+ }
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 4dedc822237f..39efbcf63c11 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -716,7 +716,7 @@ struct xhci_ep_ctx {
+ * 4 - TRB error
+ * 5-7 - reserved
+ */
+-#define EP_STATE_MASK (0xf)
++#define EP_STATE_MASK (0x7)
+ #define EP_STATE_DISABLED 0
+ #define EP_STATE_RUNNING 1
+ #define EP_STATE_HALTED 2
+diff --git a/drivers/usb/typec/tcpci_rt1711h.c b/drivers/usb/typec/tcpci_rt1711h.c
+index 017389021b96..b56a0880a044 100644
+--- a/drivers/usb/typec/tcpci_rt1711h.c
++++ b/drivers/usb/typec/tcpci_rt1711h.c
+@@ -179,26 +179,6 @@ out:
+ return tcpci_irq(chip->tcpci);
+ }
+
+-static int rt1711h_init_alert(struct rt1711h_chip *chip,
+- struct i2c_client *client)
+-{
+- int ret;
+-
+- /* Disable chip interrupts before requesting irq */
+- ret = rt1711h_write16(chip, TCPC_ALERT_MASK, 0);
+- if (ret < 0)
+- return ret;
+-
+- ret = devm_request_threaded_irq(chip->dev, client->irq, NULL,
+- rt1711h_irq,
+- IRQF_ONESHOT | IRQF_TRIGGER_LOW,
+- dev_name(chip->dev), chip);
+- if (ret < 0)
+- return ret;
+- enable_irq_wake(client->irq);
+- return 0;
+-}
+-
+ static int rt1711h_sw_reset(struct rt1711h_chip *chip)
+ {
+ int ret;
+@@ -260,7 +240,8 @@ static int rt1711h_probe(struct i2c_client *client,
+ if (ret < 0)
+ return ret;
+
+- ret = rt1711h_init_alert(chip, client);
++ /* Disable chip interrupts before requesting irq */
++ ret = rt1711h_write16(chip, TCPC_ALERT_MASK, 0);
+ if (ret < 0)
+ return ret;
+
+@@ -271,6 +252,14 @@ static int rt1711h_probe(struct i2c_client *client,
+ if (IS_ERR_OR_NULL(chip->tcpci))
+ return PTR_ERR(chip->tcpci);
+
++ ret = devm_request_threaded_irq(chip->dev, client->irq, NULL,
++ rt1711h_irq,
++ IRQF_ONESHOT | IRQF_TRIGGER_LOW,
++ dev_name(chip->dev), chip);
++ if (ret < 0)
++ return ret;
++ enable_irq_wake(client->irq);
++
+ return 0;
+ }
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 887f9ebc2bc2..8dd2702ce859 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -977,6 +977,7 @@ static noinline int cow_file_range(struct inode *inode,
+ u64 num_bytes;
+ unsigned long ram_size;
+ u64 cur_alloc_size = 0;
++ u64 min_alloc_size;
+ u64 blocksize = fs_info->sectorsize;
+ struct btrfs_key ins;
+ struct extent_map *em;
+@@ -1028,10 +1029,26 @@ static noinline int cow_file_range(struct inode *inode,
+ btrfs_drop_extent_cache(BTRFS_I(inode), start,
+ start + num_bytes - 1, 0);
+
++ /*
++ * Relocation relies on the relocated extents to have exactly the same
++ * size as the original extents. Normally writeback for relocation data
++ * extents follows a NOCOW path because relocation preallocates the
++ * extents. However, due to an operation such as scrub turning a block
++ * group to RO mode, it may fallback to COW mode, so we must make sure
++ * an extent allocated during COW has exactly the requested size and can
++ * not be split into smaller extents, otherwise relocation breaks and
++ * fails during the stage where it updates the bytenr of file extent
++ * items.
++ */
++ if (root->root_key.objectid == BTRFS_DATA_RELOC_TREE_OBJECTID)
++ min_alloc_size = num_bytes;
++ else
++ min_alloc_size = fs_info->sectorsize;
++
+ while (num_bytes > 0) {
+ cur_alloc_size = num_bytes;
+ ret = btrfs_reserve_extent(root, cur_alloc_size, cur_alloc_size,
+- fs_info->sectorsize, 0, alloc_hint,
++ min_alloc_size, 0, alloc_hint,
+ &ins, 1, 1);
+ if (ret < 0)
+ goto out_unlock;
+@@ -8639,9 +8656,6 @@ static ssize_t btrfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
+ dio_data.overwrite = 1;
+ inode_unlock(inode);
+ relock = true;
+- } else if (iocb->ki_flags & IOCB_NOWAIT) {
+- ret = -EAGAIN;
+- goto out;
+ }
+ ret = btrfs_delalloc_reserve_space(inode, &data_reserved,
+ offset, count);
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 6fc16329ceb4..2a523139a05f 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2180,6 +2180,12 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon,
+ inode = d_inode(cfile->dentry);
+ cifsi = CIFS_I(inode);
+
++ /*
++ * We zero the range through ioctl, so we need remove the page caches
++ * first, otherwise the data may be inconsistent with the server.
++ */
++ truncate_pagecache_range(inode, offset, offset + len - 1);
++
+ /* if file not oplocked can't be sure whether asking to extend size */
+ if (!CIFS_CACHE_READ(cifsi))
+ if (keep_size == false) {
+@@ -2248,6 +2254,12 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon,
+ return rc;
+ }
+
++ /*
++ * We implement the punch hole through ioctl, so we need remove the page
++ * caches first, otherwise the data may be inconsistent with the server.
++ */
++ truncate_pagecache_range(inode, offset, offset + len - 1);
++
+ cifs_dbg(FYI, "offset %lld len %lld", offset, len);
+
+ fsctl_buf.FileOffset = cpu_to_le64(offset);
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index e5da9d7fb69e..1e883df26d4a 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -396,8 +396,6 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq)
+ {
+ struct inode *inode = dreq->inode;
+
+- inode_dio_end(inode);
+-
+ if (dreq->iocb) {
+ long res = (long) dreq->error;
+ if (dreq->count != 0) {
+@@ -409,7 +407,10 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq)
+
+ complete(&dreq->completion);
+
++ igrab(inode);
+ nfs_direct_req_release(dreq);
++ inode_dio_end(inode);
++ iput(inode);
+ }
+
+ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
+@@ -539,8 +540,10 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
+ * generic layer handle the completion.
+ */
+ if (requested_bytes == 0) {
+- inode_dio_end(inode);
++ igrab(inode);
+ nfs_direct_req_release(dreq);
++ inode_dio_end(inode);
++ iput(inode);
+ return result < 0 ? result : -EIO;
+ }
+
+@@ -957,8 +960,10 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
+ * generic layer handle the completion.
+ */
+ if (requested_bytes == 0) {
+- inode_dio_end(inode);
++ igrab(inode);
+ nfs_direct_req_release(dreq);
++ inode_dio_end(inode);
++ iput(inode);
+ return result < 0 ? result : -EIO;
+ }
+
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index 29553fdba8af..b2257fa209ac 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -82,6 +82,7 @@ nfs_file_release(struct inode *inode, struct file *filp)
+ dprintk("NFS: release(%pD2)\n", filp);
+
+ nfs_inc_stats(inode, NFSIOS_VFSRELEASE);
++ inode_dio_wait(inode);
+ nfs_file_clear_open_context(filp);
+ return 0;
+ }
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index e0fe9a0f1bf1..d8cba46a9395 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -915,9 +915,8 @@ retry:
+ goto out_mds;
+
+ /* Use a direct mapping of ds_idx to pgio mirror_idx */
+- if (WARN_ON_ONCE(pgio->pg_mirror_count !=
+- FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg)))
+- goto out_mds;
++ if (pgio->pg_mirror_count != FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg))
++ goto out_eagain;
+
+ for (i = 0; i < pgio->pg_mirror_count; i++) {
+ ds = nfs4_ff_layout_prepare_ds(pgio->pg_lseg, i, true);
+@@ -936,11 +935,15 @@ retry:
+ }
+
+ return;
+-
++out_eagain:
++ pnfs_generic_pg_cleanup(pgio);
++ pgio->pg_error = -EAGAIN;
++ return;
+ out_mds:
+ pnfs_put_lseg(pgio->pg_lseg);
+ pgio->pg_lseg = NULL;
+ nfs_pageio_reset_write_mds(pgio);
++ pgio->pg_error = -EAGAIN;
+ }
+
+ static unsigned int
+diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
+index a18b8d7a3075..ca3405f73264 100644
+--- a/fs/notify/fanotify/fanotify.c
++++ b/fs/notify/fanotify/fanotify.c
+@@ -114,6 +114,10 @@ static bool fanotify_should_send_event(struct fsnotify_iter_info *iter_info,
+ if (!fsnotify_iter_should_report_type(iter_info, type))
+ continue;
+ mark = iter_info->marks[type];
++
++ /* Apply ignore mask regardless of ISDIR and ON_CHILD flags */
++ marks_ignored_mask |= mark->ignored_mask;
++
+ /*
+ * If the event is for a child and this mark doesn't care about
+ * events on a child, don't send it!
+@@ -124,7 +128,6 @@ static bool fanotify_should_send_event(struct fsnotify_iter_info *iter_info,
+ continue;
+
+ marks_mask |= mark->mask;
+- marks_ignored_mask |= mark->ignored_mask;
+ }
+
+ if (d_is_dir(path->dentry) &&
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index 178cb9e6772a..c141b06811a6 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -682,6 +682,12 @@ static void ocfs2_nfs_sync_lock_res_init(struct ocfs2_lock_res *res,
+ &ocfs2_nfs_sync_lops, osb);
+ }
+
++static void ocfs2_nfs_sync_lock_init(struct ocfs2_super *osb)
++{
++ ocfs2_nfs_sync_lock_res_init(&osb->osb_nfs_sync_lockres, osb);
++ init_rwsem(&osb->nfs_sync_rwlock);
++}
++
+ void ocfs2_trim_fs_lock_res_init(struct ocfs2_super *osb)
+ {
+ struct ocfs2_lock_res *lockres = &osb->osb_trim_fs_lockres;
+@@ -2851,6 +2857,11 @@ int ocfs2_nfs_sync_lock(struct ocfs2_super *osb, int ex)
+ if (ocfs2_is_hard_readonly(osb))
+ return -EROFS;
+
++ if (ex)
++ down_write(&osb->nfs_sync_rwlock);
++ else
++ down_read(&osb->nfs_sync_rwlock);
++
+ if (ocfs2_mount_local(osb))
+ return 0;
+
+@@ -2869,6 +2880,10 @@ void ocfs2_nfs_sync_unlock(struct ocfs2_super *osb, int ex)
+ if (!ocfs2_mount_local(osb))
+ ocfs2_cluster_unlock(osb, lockres,
+ ex ? LKM_EXMODE : LKM_PRMODE);
++ if (ex)
++ up_write(&osb->nfs_sync_rwlock);
++ else
++ up_read(&osb->nfs_sync_rwlock);
+ }
+
+ int ocfs2_trim_fs_lock(struct ocfs2_super *osb,
+@@ -3314,7 +3329,7 @@ int ocfs2_dlm_init(struct ocfs2_super *osb)
+ local:
+ ocfs2_super_lock_res_init(&osb->osb_super_lockres, osb);
+ ocfs2_rename_lock_res_init(&osb->osb_rename_lockres, osb);
+- ocfs2_nfs_sync_lock_res_init(&osb->osb_nfs_sync_lockres, osb);
++ ocfs2_nfs_sync_lock_init(osb);
+ ocfs2_orphan_scan_lock_res_init(&osb->osb_orphan_scan.os_lockres, osb);
+
+ osb->cconn = conn;
+diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
+index 4f86ac0027b5..231933618300 100644
+--- a/fs/ocfs2/ocfs2.h
++++ b/fs/ocfs2/ocfs2.h
+@@ -406,6 +406,7 @@ struct ocfs2_super
+ struct ocfs2_lock_res osb_super_lockres;
+ struct ocfs2_lock_res osb_rename_lockres;
+ struct ocfs2_lock_res osb_nfs_sync_lockres;
++ struct rw_semaphore nfs_sync_rwlock;
+ struct ocfs2_lock_res osb_trim_fs_lockres;
+ struct ocfs2_dlm_debug *osb_dlm_debug;
+
+diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
+index 7071ad0dec90..d50b7f2c7395 100644
+--- a/fs/ocfs2/ocfs2_fs.h
++++ b/fs/ocfs2/ocfs2_fs.h
+@@ -303,7 +303,7 @@
+ #define OCFS2_MAX_SLOTS 255
+
+ /* Slot map indicator for an empty slot */
+-#define OCFS2_INVALID_SLOT -1
++#define OCFS2_INVALID_SLOT ((u16)-1)
+
+ #define OCFS2_VOL_UUID_LEN 16
+ #define OCFS2_MAX_VOL_LABEL_LEN 64
+@@ -339,8 +339,8 @@ struct ocfs2_system_inode_info {
+ enum {
+ BAD_BLOCK_SYSTEM_INODE = 0,
+ GLOBAL_INODE_ALLOC_SYSTEM_INODE,
++#define OCFS2_FIRST_ONLINE_SYSTEM_INODE GLOBAL_INODE_ALLOC_SYSTEM_INODE
+ SLOT_MAP_SYSTEM_INODE,
+-#define OCFS2_FIRST_ONLINE_SYSTEM_INODE SLOT_MAP_SYSTEM_INODE
+ HEARTBEAT_SYSTEM_INODE,
+ GLOBAL_BITMAP_SYSTEM_INODE,
+ USER_QUOTA_SYSTEM_INODE,
+diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
+index f7c972fbed6a..15a89c513da2 100644
+--- a/fs/ocfs2/suballoc.c
++++ b/fs/ocfs2/suballoc.c
+@@ -2841,9 +2841,12 @@ int ocfs2_test_inode_bit(struct ocfs2_super *osb, u64 blkno, int *res)
+ goto bail;
+ }
+
+- inode_alloc_inode =
+- ocfs2_get_system_file_inode(osb, INODE_ALLOC_SYSTEM_INODE,
+- suballoc_slot);
++ if (suballoc_slot == (u16)OCFS2_INVALID_SLOT)
++ inode_alloc_inode = ocfs2_get_system_file_inode(osb,
++ GLOBAL_INODE_ALLOC_SYSTEM_INODE, suballoc_slot);
++ else
++ inode_alloc_inode = ocfs2_get_system_file_inode(osb,
++ INODE_ALLOC_SYSTEM_INODE, suballoc_slot);
+ if (!inode_alloc_inode) {
+ /* the error code could be inaccurate, but we are not able to
+ * get the correct one. */
+diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
+index e1c0c0d2f1b0..1eb7933dac83 100644
+--- a/fs/xfs/libxfs/xfs_alloc.c
++++ b/fs/xfs/libxfs/xfs_alloc.c
+@@ -2596,6 +2596,13 @@ xfs_agf_verify(
+ be32_to_cpu(agf->agf_flcount) <= xfs_agfl_size(mp)))
+ return __this_address;
+
++ if (be32_to_cpu(agf->agf_length) > mp->m_sb.sb_dblocks)
++ return __this_address;
++
++ if (be32_to_cpu(agf->agf_freeblks) < be32_to_cpu(agf->agf_longest) ||
++ be32_to_cpu(agf->agf_freeblks) > be32_to_cpu(agf->agf_length))
++ return __this_address;
++
+ if (be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) < 1 ||
+ be32_to_cpu(agf->agf_levels[XFS_BTNUM_CNT]) < 1 ||
+ be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) > XFS_BTREE_MAXLEVELS ||
+@@ -2607,6 +2614,10 @@ xfs_agf_verify(
+ be32_to_cpu(agf->agf_levels[XFS_BTNUM_RMAP]) > XFS_BTREE_MAXLEVELS))
+ return __this_address;
+
++ if (xfs_sb_version_hasrmapbt(&mp->m_sb) &&
++ be32_to_cpu(agf->agf_rmap_blocks) > be32_to_cpu(agf->agf_length))
++ return __this_address;
++
+ /*
+ * during growfs operations, the perag is not fully initialised,
+ * so we can't use it for any useful checking. growfs ensures we can't
+@@ -2620,6 +2631,11 @@ xfs_agf_verify(
+ be32_to_cpu(agf->agf_btreeblks) > be32_to_cpu(agf->agf_length))
+ return __this_address;
+
++ if (xfs_sb_version_hasreflink(&mp->m_sb) &&
++ be32_to_cpu(agf->agf_refcount_blocks) >
++ be32_to_cpu(agf->agf_length))
++ return __this_address;
++
+ if (xfs_sb_version_hasreflink(&mp->m_sb) &&
+ (be32_to_cpu(agf->agf_refcount_level) < 1 ||
+ be32_to_cpu(agf->agf_refcount_level) > XFS_BTREE_MAXLEVELS))
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 84bbdcbb199a..4e14926433ed 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2620,14 +2620,6 @@ void netdev_freemem(struct net_device *dev);
+ void synchronize_net(void);
+ int init_dummy_netdev(struct net_device *dev);
+
+-DECLARE_PER_CPU(int, xmit_recursion);
+-#define XMIT_RECURSION_LIMIT 10
+-
+-static inline int dev_recursion_level(void)
+-{
+- return this_cpu_read(xmit_recursion);
+-}
+-
+ struct net_device *dev_get_by_index(struct net *net, int ifindex);
+ struct net_device *__dev_get_by_index(struct net *net, int ifindex);
+ struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex);
+@@ -2967,6 +2959,11 @@ struct softnet_data {
+ #ifdef CONFIG_XFRM_OFFLOAD
+ struct sk_buff_head xfrm_backlog;
+ #endif
++ /* written and read only by owning cpu: */
++ struct {
++ u16 recursion;
++ u8 more;
++ } xmit;
+ #ifdef CONFIG_RPS
+ /* input_queue_head should be written by cpu owning this struct,
+ * and only read by other cpus. Worth using a cache line.
+@@ -3002,6 +2999,28 @@ static inline void input_queue_tail_incr_save(struct softnet_data *sd,
+
+ DECLARE_PER_CPU_ALIGNED(struct softnet_data, softnet_data);
+
++static inline int dev_recursion_level(void)
++{
++ return this_cpu_read(softnet_data.xmit.recursion);
++}
++
++#define XMIT_RECURSION_LIMIT 8
++static inline bool dev_xmit_recursion(void)
++{
++ return unlikely(__this_cpu_read(softnet_data.xmit.recursion) >
++ XMIT_RECURSION_LIMIT);
++}
++
++static inline void dev_xmit_recursion_inc(void)
++{
++ __this_cpu_inc(softnet_data.xmit.recursion);
++}
++
++static inline void dev_xmit_recursion_dec(void)
++{
++ __this_cpu_dec(softnet_data.xmit.recursion);
++}
++
+ void __netif_schedule(struct Qdisc *q);
+ void netif_schedule_queue(struct netdev_queue *txq);
+
+@@ -4314,6 +4333,11 @@ static inline netdev_tx_t __netdev_start_xmit(const struct net_device_ops *ops,
+ return ops->ndo_start_xmit(skb, dev);
+ }
+
++static inline bool netdev_xmit_more(void)
++{
++ return __this_cpu_read(softnet_data.xmit.more);
++}
++
+ static inline netdev_tx_t netdev_start_xmit(struct sk_buff *skb, struct net_device *dev,
+ struct netdev_queue *txq, bool more)
+ {
+diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h
+index 733fad7dfbed..6d15040c642c 100644
+--- a/include/linux/qed/qed_chain.h
++++ b/include/linux/qed/qed_chain.h
+@@ -207,28 +207,34 @@ static inline u32 qed_chain_get_cons_idx_u32(struct qed_chain *p_chain)
+
+ static inline u16 qed_chain_get_elem_left(struct qed_chain *p_chain)
+ {
++ u16 elem_per_page = p_chain->elem_per_page;
++ u32 prod = p_chain->u.chain16.prod_idx;
++ u32 cons = p_chain->u.chain16.cons_idx;
+ u16 used;
+
+- used = (u16) (((u32)0x10000 +
+- (u32)p_chain->u.chain16.prod_idx) -
+- (u32)p_chain->u.chain16.cons_idx);
++ if (prod < cons)
++ prod += (u32)U16_MAX + 1;
++
++ used = (u16)(prod - cons);
+ if (p_chain->mode == QED_CHAIN_MODE_NEXT_PTR)
+- used -= p_chain->u.chain16.prod_idx / p_chain->elem_per_page -
+- p_chain->u.chain16.cons_idx / p_chain->elem_per_page;
++ used -= prod / elem_per_page - cons / elem_per_page;
+
+ return (u16)(p_chain->capacity - used);
+ }
+
+ static inline u32 qed_chain_get_elem_left_u32(struct qed_chain *p_chain)
+ {
++ u16 elem_per_page = p_chain->elem_per_page;
++ u64 prod = p_chain->u.chain32.prod_idx;
++ u64 cons = p_chain->u.chain32.cons_idx;
+ u32 used;
+
+- used = (u32) (((u64)0x100000000ULL +
+- (u64)p_chain->u.chain32.prod_idx) -
+- (u64)p_chain->u.chain32.cons_idx);
++ if (prod < cons)
++ prod += (u64)U32_MAX + 1;
++
++ used = (u32)(prod - cons);
+ if (p_chain->mode == QED_CHAIN_MODE_NEXT_PTR)
+- used -= p_chain->u.chain32.prod_idx / p_chain->elem_per_page -
+- p_chain->u.chain32.cons_idx / p_chain->elem_per_page;
++ used -= (u32)(prod / elem_per_page - cons / elem_per_page);
+
+ return p_chain->capacity - used;
+ }
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index 1c296f370e46..f32fe7080d2e 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -109,16 +109,17 @@ retry:
+
+ if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+ u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size);
++ struct skb_shared_info *shinfo = skb_shinfo(skb);
+
+- if (skb->len - p_off <= gso_size)
+- return -EINVAL;
+-
+- skb_shinfo(skb)->gso_size = gso_size;
+- skb_shinfo(skb)->gso_type = gso_type;
++ /* Too small packets are not really GSO ones. */
++ if (skb->len - p_off > gso_size) {
++ shinfo->gso_size = gso_size;
++ shinfo->gso_type = gso_type;
+
+- /* Header must be checked, and gso_segs computed. */
+- skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
+- skb_shinfo(skb)->gso_segs = 0;
++ /* Header must be checked, and gso_segs computed. */
++ shinfo->gso_type |= SKB_GSO_DODGY;
++ shinfo->gso_segs = 0;
++ }
+ }
+
+ return 0;
+diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
+index 86f034b524d4..48d74674d5e9 100644
+--- a/include/net/sctp/constants.h
++++ b/include/net/sctp/constants.h
+@@ -361,11 +361,13 @@ enum {
+ ipv4_is_anycast_6to4(a))
+
+ /* Flags used for the bind address copy functions. */
+-#define SCTP_ADDR6_ALLOWED 0x00000001 /* IPv6 address is allowed by
++#define SCTP_ADDR4_ALLOWED 0x00000001 /* IPv4 address is allowed by
+ local sock family */
+-#define SCTP_ADDR4_PEERSUPP 0x00000002 /* IPv4 address is supported by
++#define SCTP_ADDR6_ALLOWED 0x00000002 /* IPv6 address is allowed by
++ local sock family */
++#define SCTP_ADDR4_PEERSUPP 0x00000004 /* IPv4 address is supported by
+ peer */
+-#define SCTP_ADDR6_PEERSUPP 0x00000004 /* IPv6 address is supported by
++#define SCTP_ADDR6_PEERSUPP 0x00000008 /* IPv6 address is supported by
+ peer */
+
+ /* Reasons to retransmit. */
+diff --git a/include/net/sock.h b/include/net/sock.h
+index f359e5c94762..e2df102e669e 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1775,7 +1775,6 @@ static inline int sk_rx_queue_get(const struct sock *sk)
+
+ static inline void sk_set_socket(struct sock *sk, struct socket *sock)
+ {
+- sk_tx_queue_clear(sk);
+ sk->sk_socket = sock;
+ }
+
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index 48dc1ce2170d..f087c8d125b8 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1083,6 +1083,7 @@ struct xfrm_offload {
+ #define XFRM_GRO 32
+ #define XFRM_ESP_NO_TRAILER 64
+ #define XFRM_DEV_RESUME 128
++#define XFRM_XMIT 256
+
+ __u32 status;
+ #define CRYPTO_SUCCESS 1
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 0325ccf3a8e4..843394d0ea42 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3862,7 +3862,8 @@ void rt_mutex_setprio(struct task_struct *p, struct task_struct *pi_task)
+ */
+ if (dl_prio(prio)) {
+ if (!dl_prio(p->normal_prio) ||
+- (pi_task && dl_entity_preempt(&pi_task->dl, &p->dl))) {
++ (pi_task && dl_prio(pi_task->prio) &&
++ dl_entity_preempt(&pi_task->dl, &p->dl))) {
+ p->dl.dl_boosted = 1;
+ queue_flag |= ENQUEUE_REPLENISH;
+ } else
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index ebec37cb3be9..8aecfb143859 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2688,6 +2688,7 @@ void __dl_clear_params(struct task_struct *p)
+ dl_se->dl_bw = 0;
+ dl_se->dl_density = 0;
+
++ dl_se->dl_boosted = 0;
+ dl_se->dl_throttled = 0;
+ dl_se->dl_yielded = 0;
+ dl_se->dl_non_contending = 0;
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index b7e1e09a0bef..7a4ca2deb39b 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -3,6 +3,9 @@
+ * Copyright (C) 2006 Jens Axboe <axboe@kernel.dk>
+ *
+ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
+ #include <linux/kernel.h>
+ #include <linux/blkdev.h>
+ #include <linux/blktrace_api.h>
+@@ -495,6 +498,16 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ */
+ strreplace(buts->name, '/', '_');
+
++ /*
++ * bdev can be NULL, as with scsi-generic, this is a helpful as
++ * we can be.
++ */
++ if (q->blk_trace) {
++ pr_warn("Concurrent blktraces are not allowed on %s\n",
++ buts->name);
++ return -EBUSY;
++ }
++
+ bt = kzalloc(sizeof(*bt), GFP_KERNEL);
+ if (!bt)
+ return -ENOMEM;
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 805aef83b5cf..564d22691dd7 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2333,7 +2333,7 @@ rb_update_event(struct ring_buffer_per_cpu *cpu_buffer,
+ if (unlikely(info->add_timestamp)) {
+ bool abs = ring_buffer_time_stamp_abs(cpu_buffer->buffer);
+
+- event = rb_add_time_stamp(event, info->delta, abs);
++ event = rb_add_time_stamp(event, abs ? info->delta : delta, abs);
+ length -= RB_LEN_TIME_EXTEND;
+ delta = 0;
+ }
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index 38a2a558e546..0c3b1551cfca 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -211,11 +211,17 @@ static int event_trigger_regex_open(struct inode *inode, struct file *file)
+
+ static int trigger_process_regex(struct trace_event_file *file, char *buff)
+ {
+- char *command, *next = buff;
++ char *command, *next;
+ struct event_command *p;
+ int ret = -EINVAL;
+
++ next = buff = skip_spaces(buff);
+ command = strsep(&next, ": \t");
++ if (next) {
++ next = skip_spaces(next);
++ if (!*next)
++ next = NULL;
++ }
+ command = (command[0] != '!') ? command : command + 1;
+
+ mutex_lock(&trigger_cmd_mutex);
+@@ -624,8 +630,14 @@ event_trigger_callback(struct event_command *cmd_ops,
+ int ret;
+
+ /* separate the trigger from the filter (t:n [if filter]) */
+- if (param && isdigit(param[0]))
++ if (param && isdigit(param[0])) {
+ trigger = strsep(¶m, " \t");
++ if (param) {
++ param = skip_spaces(param);
++ if (!*param)
++ param = NULL;
++ }
++ }
+
+ trigger_ops = cmd_ops->get_trigger_ops(cmd, trigger);
+
+@@ -1361,6 +1373,11 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
+ trigger = strsep(¶m, " \t");
+ if (!trigger)
+ return -EINVAL;
++ if (param) {
++ param = skip_spaces(param);
++ if (!*param)
++ param = NULL;
++ }
+
+ system = strsep(&trigger, ":");
+ if (!trigger)
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index 39e382acb0b8..b5776b1301f0 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -1540,7 +1540,7 @@ void kzfree(const void *p)
+ if (unlikely(ZERO_OR_NULL_PTR(mem)))
+ return;
+ ks = ksize(mem);
+- memset(mem, 0, ks);
++ memzero_explicit(mem, ks);
+ kfree(mem);
+ }
+ EXPORT_SYMBOL(kzfree);
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index 11ed2029985f..33b8222db75c 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -202,8 +202,8 @@ struct net_bridge_port_group {
+ struct rcu_head rcu;
+ struct timer_list timer;
+ struct br_ip addr;
++ unsigned char eth_addr[ETH_ALEN] __aligned(2);
+ unsigned char flags;
+- unsigned char eth_addr[ETH_ALEN];
+ };
+
+ struct net_bridge_mdb_entry
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 1618d5a676c4..4b1053057ca6 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3534,9 +3534,6 @@ static void skb_update_prio(struct sk_buff *skb)
+ #define skb_update_prio(skb)
+ #endif
+
+-DEFINE_PER_CPU(int, xmit_recursion);
+-EXPORT_SYMBOL(xmit_recursion);
+-
+ /**
+ * dev_loopback_xmit - loop back @skb
+ * @net: network namespace this loopback is happening in
+@@ -3827,8 +3824,7 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev)
+ int cpu = smp_processor_id(); /* ok because BHs are off */
+
+ if (txq->xmit_lock_owner != cpu) {
+- if (unlikely(__this_cpu_read(xmit_recursion) >
+- XMIT_RECURSION_LIMIT))
++ if (dev_xmit_recursion())
+ goto recursion_alert;
+
+ skb = validate_xmit_skb(skb, dev, &again);
+@@ -3838,9 +3834,9 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev)
+ HARD_TX_LOCK(dev, txq, cpu);
+
+ if (!netif_xmit_stopped(txq)) {
+- __this_cpu_inc(xmit_recursion);
++ dev_xmit_recursion_inc();
+ skb = dev_hard_start_xmit(skb, dev, txq, &rc);
+- __this_cpu_dec(xmit_recursion);
++ dev_xmit_recursion_dec();
+ if (dev_xmit_complete(rc)) {
+ HARD_TX_UNLOCK(dev, txq);
+ goto out;
+@@ -3903,10 +3899,12 @@ int dev_direct_xmit(struct sk_buff *skb, u16 queue_id)
+
+ local_bh_disable();
+
++ dev_xmit_recursion_inc();
+ HARD_TX_LOCK(dev, txq, smp_processor_id());
+ if (!netif_xmit_frozen_or_drv_stopped(txq))
+ ret = netdev_start_xmit(skb, dev, txq, false);
+ HARD_TX_UNLOCK(dev, txq);
++ dev_xmit_recursion_dec();
+
+ local_bh_enable();
+
+@@ -8753,6 +8751,13 @@ int register_netdevice(struct net_device *dev)
+ rcu_barrier();
+
+ dev->reg_state = NETREG_UNREGISTERED;
++ /* We should put the kobject that hold in
++ * netdev_unregister_kobject(), otherwise
++ * the net device cannot be freed when
++ * driver calls free_netdev(), because the
++ * kobject is being hold.
++ */
++ kobject_put(&dev->dev.kobj);
+ }
+ /*
+ * Prevent userspace races by waiting until the network
+diff --git a/net/core/filter.c b/net/core/filter.c
+index b5521b60a2d4..636e67a92847 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2002,7 +2002,7 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb)
+ {
+ int ret;
+
+- if (unlikely(__this_cpu_read(xmit_recursion) > XMIT_RECURSION_LIMIT)) {
++ if (dev_xmit_recursion()) {
+ net_crit_ratelimited("bpf: recursion limit reached on datapath, buggy bpf program?\n");
+ kfree_skb(skb);
+ return -ENETDOWN;
+@@ -2011,9 +2011,9 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb)
+ skb->dev = dev;
+ skb->tstamp = 0;
+
+- __this_cpu_inc(xmit_recursion);
++ dev_xmit_recursion_inc();
+ ret = dev_queue_xmit(skb);
+- __this_cpu_dec(xmit_recursion);
++ dev_xmit_recursion_dec();
+
+ return ret;
+ }
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 8abfde0d28ee..8721264a2b39 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -640,7 +640,7 @@ bool sk_mc_loop(struct sock *sk)
+ return inet6_sk(sk)->mc_loop;
+ #endif
+ }
+- WARN_ON(1);
++ WARN_ON_ONCE(1);
+ return true;
+ }
+ EXPORT_SYMBOL(sk_mc_loop);
+@@ -1540,6 +1540,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
+ cgroup_sk_alloc(&sk->sk_cgrp_data);
+ sock_update_classid(&sk->sk_cgrp_data);
+ sock_update_netprioidx(&sk->sk_cgrp_data);
++ sk_tx_queue_clear(sk);
+ }
+
+ return sk;
+@@ -1747,6 +1748,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
+ */
+ sk_refcnt_debug_inc(newsk);
+ sk_set_socket(newsk, NULL);
++ sk_tx_queue_clear(newsk);
+ newsk->sk_wq = NULL;
+
+ if (newsk->sk_prot->sockets_allocated)
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index a8fc4e83cd95..9573cd242b90 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -831,7 +831,7 @@ static int fib_check_nh(struct fib_config *cfg, struct fib_nh *nh,
+ if (fl4.flowi4_scope < RT_SCOPE_LINK)
+ fl4.flowi4_scope = RT_SCOPE_LINK;
+
+- if (cfg->fc_table)
++ if (cfg->fc_table && cfg->fc_table != RT_TABLE_MAIN)
+ tbl = fib_get_table(net, cfg->fc_table);
+
+ if (tbl)
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index b37abba3b369..375d0e516d85 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -98,9 +98,10 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
+ __be32 remote, __be32 local,
+ __be32 key)
+ {
+- unsigned int hash;
+ struct ip_tunnel *t, *cand = NULL;
+ struct hlist_head *head;
++ struct net_device *ndev;
++ unsigned int hash;
+
+ hash = ip_tunnel_hash(key, remote);
+ head = &itn->tunnels[hash];
+@@ -175,8 +176,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
+ if (t && t->dev->flags & IFF_UP)
+ return t;
+
+- if (itn->fb_tunnel_dev && itn->fb_tunnel_dev->flags & IFF_UP)
+- return netdev_priv(itn->fb_tunnel_dev);
++ ndev = READ_ONCE(itn->fb_tunnel_dev);
++ if (ndev && ndev->flags & IFF_UP)
++ return netdev_priv(ndev);
+
+ return NULL;
+ }
+@@ -1212,9 +1214,9 @@ void ip_tunnel_uninit(struct net_device *dev)
+ struct ip_tunnel_net *itn;
+
+ itn = net_generic(net, tunnel->ip_tnl_net_id);
+- /* fb_tunnel_dev will be unregisted in net-exit call. */
+- if (itn->fb_tunnel_dev != dev)
+- ip_tunnel_del(itn, netdev_priv(dev));
++ ip_tunnel_del(itn, netdev_priv(dev));
++ if (itn->fb_tunnel_dev == dev)
++ WRITE_ONCE(itn->fb_tunnel_dev, NULL);
+
+ dst_cache_reset(&tunnel->dst_cache);
+ }
+diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
+index 78bfadfcf342..8b5ba0a5cd38 100644
+--- a/net/ipv4/tcp_cubic.c
++++ b/net/ipv4/tcp_cubic.c
+@@ -403,6 +403,8 @@ static void hystart_update(struct sock *sk, u32 delay)
+
+ if (hystart_detect & HYSTART_DELAY) {
+ /* obtain the minimum delay of more than sampling packets */
++ if (ca->curr_rtt > delay)
++ ca->curr_rtt = delay;
+ if (ca->sample_cnt < HYSTART_MIN_SAMPLES) {
+ if (ca->curr_rtt == 0 || ca->curr_rtt > delay)
+ ca->curr_rtt = delay;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 12e1ea7344d9..7441ecfc8320 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -254,7 +254,8 @@ static void tcp_ecn_accept_cwr(struct sock *sk, const struct sk_buff *skb)
+ * cwnd may be very low (even just 1 packet), so we should ACK
+ * immediately.
+ */
+- inet_csk(sk)->icsk_ack.pending |= ICSK_ACK_NOW;
++ if (TCP_SKB_CB(skb)->seq != TCP_SKB_CB(skb)->end_seq)
++ inet_csk(sk)->icsk_ack.pending |= ICSK_ACK_NOW;
+ }
+ }
+
+@@ -3665,6 +3666,15 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
+ tcp_in_ack_event(sk, ack_ev_flags);
+ }
+
++ /* This is a deviation from RFC3168 since it states that:
++ * "When the TCP data sender is ready to set the CWR bit after reducing
++ * the congestion window, it SHOULD set the CWR bit only on the first
++ * new data packet that it transmits."
++ * We accept CWR on pure ACKs to be more robust
++ * with widely-deployed TCP implementations that do this.
++ */
++ tcp_ecn_accept_cwr(sk, skb);
++
+ /* We passed data and got it acked, remove any soft error
+ * log. Something worked...
+ */
+@@ -4518,7 +4528,11 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
+ if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb,
+ skb, &fragstolen)) {
+ coalesce_done:
+- tcp_grow_window(sk, skb);
++ /* For non sack flows, do not grow window to force DUPACK
++ * and trigger fast retransmit.
++ */
++ if (tcp_is_sack(tp))
++ tcp_grow_window(sk, skb);
+ kfree_skb_partial(skb, fragstolen);
+ skb = NULL;
+ goto add_sack;
+@@ -4602,7 +4616,11 @@ add_sack:
+ tcp_sack_new_ofo_skb(sk, seq, end_seq);
+ end:
+ if (skb) {
+- tcp_grow_window(sk, skb);
++ /* For non sack flows, do not grow window to force DUPACK
++ * and trigger fast retransmit.
++ */
++ if (tcp_is_sack(tp))
++ tcp_grow_window(sk, skb);
+ skb_condense(skb);
+ skb_set_owner_r(skb, sk);
+ }
+@@ -4703,8 +4721,6 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
+ skb_dst_drop(skb);
+ __skb_pull(skb, tcp_hdr(skb)->doff * 4);
+
+- tcp_ecn_accept_cwr(sk, skb);
+-
+ tp->rx_opt.dsack = 0;
+
+ /* Queue data for delivery to the user.
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 90621d498fd1..f5144573c45c 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -132,6 +132,7 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
+ gre_proto == htons(ETH_P_ERSPAN2)) ?
+ ARPHRD_ETHER : ARPHRD_IP6GRE;
+ int score, cand_score = 4;
++ struct net_device *ndev;
+
+ for_each_ip_tunnel_rcu(t, ign->tunnels_r_l[h0 ^ h1]) {
+ if (!ipv6_addr_equal(local, &t->parms.laddr) ||
+@@ -243,9 +244,9 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
+ if (t && t->dev->flags & IFF_UP)
+ return t;
+
+- dev = ign->fb_tunnel_dev;
+- if (dev && dev->flags & IFF_UP)
+- return netdev_priv(dev);
++ ndev = READ_ONCE(ign->fb_tunnel_dev);
++ if (ndev && ndev->flags & IFF_UP)
++ return netdev_priv(ndev);
+
+ return NULL;
+ }
+@@ -418,6 +419,8 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
+
+ ip6gre_tunnel_unlink_md(ign, t);
+ ip6gre_tunnel_unlink(ign, t);
++ if (ign->fb_tunnel_dev == dev)
++ WRITE_ONCE(ign->fb_tunnel_dev, NULL);
+ dst_cache_reset(&t->dst_cache);
+ dev_put(dev);
+ }
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 2d80e913b82f..f2f8551416c3 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2620,6 +2620,7 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
+ idev->mc_list = i->next;
+
+ write_unlock_bh(&idev->lock);
++ ip6_mc_clear_src(i);
+ ma_put(i);
+ write_lock_bh(&idev->lock);
+ }
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index 21eb53f6d4fe..36ebc40a4313 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -385,6 +385,8 @@ ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len,
+ for (id = 0; id < IPSET_EXT_ID_MAX; id++) {
+ if (!add_extension(id, cadt_flags, tb))
+ continue;
++ if (align < ip_set_extensions[id].align)
++ align = ip_set_extensions[id].align;
+ len = ALIGN(len, ip_set_extensions[id].align);
+ set->offset[id] = len;
+ set->extensions |= ip_set_extensions[id].type;
+diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
+index c5566bc4aaca..7778f0fb48cf 100644
+--- a/net/rxrpc/call_accept.c
++++ b/net/rxrpc/call_accept.c
+@@ -26,6 +26,11 @@
+ #include <net/ip.h>
+ #include "ar-internal.h"
+
++static void rxrpc_dummy_notify(struct sock *sk, struct rxrpc_call *call,
++ unsigned long user_call_ID)
++{
++}
++
+ /*
+ * Preallocate a single service call, connection and peer and, if possible,
+ * give them a user ID and attach the user's side of the ID to them.
+@@ -232,6 +237,8 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)
+ if (rx->discard_new_call) {
+ _debug("discard %lx", call->user_call_ID);
+ rx->discard_new_call(call, call->user_call_ID);
++ if (call->notify_rx)
++ call->notify_rx = rxrpc_dummy_notify;
+ rxrpc_put_call(call, rxrpc_call_put_kernel);
+ }
+ rxrpc_call_completed(call);
+diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
+index e65b230fce4c..58bd558a277a 100644
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -735,13 +735,12 @@ static void rxrpc_input_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
+ ntohl(ackinfo->rxMTU), ntohl(ackinfo->maxMTU),
+ rwind, ntohl(ackinfo->jumbo_max));
+
++ if (rwind > RXRPC_RXTX_BUFF_SIZE - 1)
++ rwind = RXRPC_RXTX_BUFF_SIZE - 1;
+ if (call->tx_winsize != rwind) {
+- if (rwind > RXRPC_RXTX_BUFF_SIZE - 1)
+- rwind = RXRPC_RXTX_BUFF_SIZE - 1;
+ if (rwind > call->tx_winsize)
+ wake = true;
+- trace_rxrpc_rx_rwind_change(call, sp->hdr.serial,
+- ntohl(ackinfo->rwind), wake);
++ trace_rxrpc_rx_rwind_change(call, sp->hdr.serial, rwind, wake);
+ call->tx_winsize = rwind;
+ }
+
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index 824e3c37e5dd..d03f843647ae 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -1508,32 +1508,51 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free)
+ return idx + (tin << 16);
+ }
+
+-static u8 cake_handle_diffserv(struct sk_buff *skb, u16 wash)
++static u8 cake_handle_diffserv(struct sk_buff *skb, bool wash)
+ {
+- int wlen = skb_network_offset(skb);
++ const int offset = skb_network_offset(skb);
++ u16 *buf, buf_;
+ u8 dscp;
+
+ switch (tc_skb_protocol(skb)) {
+ case htons(ETH_P_IP):
+- wlen += sizeof(struct iphdr);
+- if (!pskb_may_pull(skb, wlen) ||
+- skb_try_make_writable(skb, wlen))
++ buf = skb_header_pointer(skb, offset, sizeof(buf_), &buf_);
++ if (unlikely(!buf))
+ return 0;
+
+- dscp = ipv4_get_dsfield(ip_hdr(skb)) >> 2;
+- if (wash && dscp)
++ /* ToS is in the second byte of iphdr */
++ dscp = ipv4_get_dsfield((struct iphdr *)buf) >> 2;
++
++ if (wash && dscp) {
++ const int wlen = offset + sizeof(struct iphdr);
++
++ if (!pskb_may_pull(skb, wlen) ||
++ skb_try_make_writable(skb, wlen))
++ return 0;
++
+ ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, 0);
++ }
++
+ return dscp;
+
+ case htons(ETH_P_IPV6):
+- wlen += sizeof(struct ipv6hdr);
+- if (!pskb_may_pull(skb, wlen) ||
+- skb_try_make_writable(skb, wlen))
++ buf = skb_header_pointer(skb, offset, sizeof(buf_), &buf_);
++ if (unlikely(!buf))
+ return 0;
+
+- dscp = ipv6_get_dsfield(ipv6_hdr(skb)) >> 2;
+- if (wash && dscp)
++ /* Traffic class is in the first and second bytes of ipv6hdr */
++ dscp = ipv6_get_dsfield((struct ipv6hdr *)buf) >> 2;
++
++ if (wash && dscp) {
++ const int wlen = offset + sizeof(struct ipv6hdr);
++
++ if (!pskb_may_pull(skb, wlen) ||
++ skb_try_make_writable(skb, wlen))
++ return 0;
++
+ ipv6_change_dsfield(ipv6_hdr(skb), INET_ECN_MASK, 0);
++ }
++
+ return dscp;
+
+ case htons(ETH_P_ARP):
+@@ -1550,13 +1569,16 @@ static struct cake_tin_data *cake_select_tin(struct Qdisc *sch,
+ {
+ struct cake_sched_data *q = qdisc_priv(sch);
+ u32 tin;
++ bool wash;
+ u8 dscp;
+
+ /* Tin selection: Default to diffserv-based selection, allow overriding
+- * using firewall marks or skb->priority.
++ * using firewall marks or skb->priority. Call DSCP parsing early if
++ * wash is enabled, otherwise defer to below to skip unneeded parsing.
+ */
+- dscp = cake_handle_diffserv(skb,
+- q->rate_flags & CAKE_FLAG_WASH);
++ wash = !!(q->rate_flags & CAKE_FLAG_WASH);
++ if (wash)
++ dscp = cake_handle_diffserv(skb, wash);
+
+ if (q->tin_mode == CAKE_DIFFSERV_BESTEFFORT)
+ tin = 0;
+@@ -1567,6 +1589,8 @@ static struct cake_tin_data *cake_select_tin(struct Qdisc *sch,
+ tin = q->tin_order[TC_H_MIN(skb->priority) - 1];
+
+ else {
++ if (!wash)
++ dscp = cake_handle_diffserv(skb, wash);
+ tin = q->tin_index[dscp];
+
+ if (unlikely(tin >= q->tin_cnt))
+@@ -2630,7 +2654,7 @@ static int cake_init(struct Qdisc *sch, struct nlattr *opt,
+ qdisc_watchdog_init(&q->watchdog, sch);
+
+ if (opt) {
+- int err = cake_change(sch, opt, extack);
++ err = cake_change(sch, opt, extack);
+
+ if (err)
+ return err;
+@@ -2944,7 +2968,7 @@ static int cake_dump_class_stats(struct Qdisc *sch, unsigned long cl,
+ PUT_STAT_S32(BLUE_TIMER_US,
+ ktime_to_us(
+ ktime_sub(now,
+- flow->cvars.blue_timer)));
++ flow->cvars.blue_timer)));
+ }
+ if (flow->cvars.dropping) {
+ PUT_STAT_S32(DROP_NEXT_US,
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 8a4d01e427a2..119e20cad662 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -487,6 +487,7 @@ void __netdev_watchdog_up(struct net_device *dev)
+ dev_hold(dev);
+ }
+ }
++EXPORT_SYMBOL_GPL(__netdev_watchdog_up);
+
+ static void dev_watchdog_up(struct net_device *dev)
+ {
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index f68ccd1f4860..d17708800652 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1593,12 +1593,15 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
+ int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc,
+ enum sctp_scope scope, gfp_t gfp)
+ {
++ struct sock *sk = asoc->base.sk;
+ int flags;
+
+ /* Use scoping rules to determine the subset of addresses from
+ * the endpoint.
+ */
+- flags = (PF_INET6 == asoc->base.sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0;
++ flags = (PF_INET6 == sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0;
++ if (!inet_v6_ipv6only(sk))
++ flags |= SCTP_ADDR4_ALLOWED;
+ if (asoc->peer.ipv4_address)
+ flags |= SCTP_ADDR4_PEERSUPP;
+ if (asoc->peer.ipv6_address)
+diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
+index 7df3704982f5..38d01cfb313e 100644
+--- a/net/sctp/bind_addr.c
++++ b/net/sctp/bind_addr.c
+@@ -453,6 +453,7 @@ static int sctp_copy_one_addr(struct net *net, struct sctp_bind_addr *dest,
+ * well as the remote peer.
+ */
+ if ((((AF_INET == addr->sa.sa_family) &&
++ (flags & SCTP_ADDR4_ALLOWED) &&
+ (flags & SCTP_ADDR4_PEERSUPP))) ||
+ (((AF_INET6 == addr->sa.sa_family) &&
+ (flags & SCTP_ADDR6_ALLOWED) &&
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index 787c59d798f4..af054f38341b 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -163,7 +163,8 @@ int sctp_copy_local_addr_list(struct net *net, struct sctp_bind_addr *bp,
+ * sock as well as the remote peer.
+ */
+ if (addr->a.sa.sa_family == AF_INET &&
+- !(copy_flags & SCTP_ADDR4_PEERSUPP))
++ (!(copy_flags & SCTP_ADDR4_ALLOWED) ||
++ !(copy_flags & SCTP_ADDR4_PEERSUPP)))
+ continue;
+ if (addr->a.sa.sa_family == AF_INET6 &&
+ (!(copy_flags & SCTP_ADDR6_ALLOWED) ||
+diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
+index 4fda18d47e2c..285eab5b43c8 100644
+--- a/net/sunrpc/rpc_pipe.c
++++ b/net/sunrpc/rpc_pipe.c
+@@ -1331,6 +1331,7 @@ rpc_gssd_dummy_populate(struct dentry *root, struct rpc_pipe *pipe_data)
+ q.len = strlen(gssd_dummy_clnt_dir[0].name);
+ clnt_dentry = d_hash_and_lookup(gssd_dentry, &q);
+ if (!clnt_dentry) {
++ __rpc_depopulate(gssd_dentry, gssd_dummy_clnt_dir, 0, 1);
+ pipe_dentry = ERR_PTR(-ENOENT);
+ goto out;
+ }
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index ac16f509c95c..540e340e2565 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -1036,6 +1036,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
+ base = 0;
+ } else {
+ base -= buf->head[0].iov_len;
++ subbuf->head[0].iov_base = buf->head[0].iov_base;
+ subbuf->head[0].iov_len = 0;
+ }
+
+@@ -1048,6 +1049,8 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
+ base = 0;
+ } else {
+ base -= buf->page_len;
++ subbuf->pages = buf->pages;
++ subbuf->page_base = 0;
+ subbuf->page_len = 0;
+ }
+
+@@ -1059,6 +1062,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
+ base = 0;
+ } else {
+ base -= buf->tail[0].iov_len;
++ subbuf->tail[0].iov_base = buf->tail[0].iov_base;
+ subbuf->tail[0].iov_len = 0;
+ }
+
+diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
+index 8634ce677142..e7a0ce98479f 100644
+--- a/net/xfrm/xfrm_device.c
++++ b/net/xfrm/xfrm_device.c
+@@ -33,7 +33,7 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur
+ netdev_features_t esp_features = features;
+ struct xfrm_offload *xo = xfrm_offload(skb);
+
+- if (!xo)
++ if (!xo || (xo->flags & XFRM_XMIT))
+ return skb;
+
+ if (!(features & NETIF_F_HW_ESP))
+@@ -53,6 +53,8 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur
+ return skb;
+ }
+
++ xo->flags |= XFRM_XMIT;
++
+ if (skb_is_gso(skb)) {
+ struct net_device *dev = skb->dev;
+
+diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
+index ce53639a864a..c830750d725b 100644
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -81,20 +81,21 @@ cc-cross-prefix = \
+ fi)))
+
+ # output directory for tests below
+-TMPOUT := $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/)
++TMPOUT = $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/).tmp_$$$$
+
+ # try-run
+ # Usage: option = $(call try-run, $(CC)...-o "$$TMP",option-ok,otherwise)
+ # Exit code chooses option. "$$TMP" serves as a temporary file and is
+ # automatically cleaned up.
+ try-run = $(shell set -e; \
+- TMP="$(TMPOUT).$$$$.tmp"; \
+- TMPO="$(TMPOUT).$$$$.o"; \
++ TMP=$(TMPOUT)/tmp; \
++ TMPO=$(TMPOUT)/tmp.o; \
++ mkdir -p $(TMPOUT); \
++ trap "rm -rf $(TMPOUT)" EXIT; \
+ if ($(1)) >/dev/null 2>&1; \
+ then echo "$(2)"; \
+ else echo "$(3)"; \
+- fi; \
+- rm -f "$$TMP" "$$TMPO")
++ fi)
+
+ # as-option
+ # Usage: cflags-y += $(call as-option,-Wa$(comma)-isa=foo,)
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index 5e32fe434140..898752b818dc 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -130,11 +130,11 @@ static int apparmor_ptrace_traceme(struct task_struct *parent)
+ struct aa_label *tracer, *tracee;
+ int error;
+
+- tracee = begin_current_label_crit_section();
++ tracee = __begin_current_label_crit_section();
+ tracer = aa_get_task_label(parent);
+ error = aa_may_ptrace(tracer, tracee, AA_PTRACE_TRACE);
+ aa_put_label(tracer);
+- end_current_label_crit_section(tracee);
++ __end_current_label_crit_section(tracee);
+
+ return error;
+ }
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 1d83c3c59e1a..419d099b5582 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3898,6 +3898,11 @@ HDA_CODEC_ENTRY(0x10de0095, "GPU 95 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0097, "GPU 97 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0098, "GPU 98 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0099, "GPU 99 HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de009a, "GPU 9a HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de009d, "GPU 9d HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de009e, "GPU 9e HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de009f, "GPU 9f HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de00a0, "GPU a0 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch),
+ HDA_CODEC_ENTRY(0x10de8067, "MCP67/68 HDMI", patch_nvhdmi_2ch),
+ HDA_CODEC_ENTRY(0x11069f80, "VX900 HDMI/DP", patch_via_hdmi),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 623ebe2e7db4..beec9e3b6205 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2446,6 +2446,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1462, 0x11f7, "MSI-GE63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1275, "MSI-GL63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+@@ -3918,6 +3919,16 @@ static void alc269_fixup_hp_gpio_led(struct hda_codec *codec,
+ alc_fixup_hp_gpio_led(codec, action, 0x08, 0x10);
+ }
+
++static void alc285_fixup_hp_gpio_led(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++
++ spec->micmute_led_polarity = 1;
++
++ alc_fixup_hp_gpio_led(codec, action, 0x04, 0x01);
++}
++
+ static void alc286_fixup_hp_gpio_led(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -5747,7 +5758,8 @@ enum {
+ ALC289_FIXUP_DUAL_SPK,
+ ALC294_FIXUP_SPK2_TO_DAC1,
+ ALC294_FIXUP_ASUS_DUAL_SPK,
+-
++ ALC294_FIXUP_ASUS_HPE,
++ ALC285_FIXUP_HP_GPIO_LED,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6836,7 +6848,21 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC294_FIXUP_SPK2_TO_DAC1
+ },
+-
++ [ALC294_FIXUP_ASUS_HPE] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* Set EAPD high */
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x0f },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x7774 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
++ },
++ [ALC285_FIXUP_HP_GPIO_LED] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc285_fixup_hp_gpio_led,
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6981,6 +7007,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
++ SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+@@ -6999,6 +7026,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK),
+ SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
+diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
+index d83be26d6446..0e2bdad373d6 100644
+--- a/sound/soc/fsl/fsl_ssi.c
++++ b/sound/soc/fsl/fsl_ssi.c
+@@ -678,8 +678,9 @@ static int fsl_ssi_set_bclk(struct snd_pcm_substream *substream,
+ struct regmap *regs = ssi->regs;
+ u32 pm = 999, div2, psr, stccr, mask, afreq, factor, i;
+ unsigned long clkrate, baudrate, tmprate;
+- unsigned int slots = params_channels(hw_params);
+- unsigned int slot_width = 32;
++ unsigned int channels = params_channels(hw_params);
++ unsigned int slot_width = params_width(hw_params);
++ unsigned int slots = 2;
+ u64 sub, savesub = 100000;
+ unsigned int freq;
+ bool baudclk_is_used;
+@@ -688,10 +689,14 @@ static int fsl_ssi_set_bclk(struct snd_pcm_substream *substream,
+ /* Override slots and slot_width if being specifically set... */
+ if (ssi->slots)
+ slots = ssi->slots;
+- /* ...but keep 32 bits if slots is 2 -- I2S Master mode */
+- if (ssi->slot_width && slots != 2)
++ if (ssi->slot_width)
+ slot_width = ssi->slot_width;
+
++ /* ...but force 32 bits for stereo audio using I2S Master Mode */
++ if (channels == 2 &&
++ (ssi->i2s_net & SSI_SCR_I2S_MODE_MASK) == SSI_SCR_I2S_MODE_MASTER)
++ slot_width = 32;
++
+ /* Generate bit clock based on the slot number and slot width */
+ freq = slots * slot_width * params_rate(hw_params);
+
+diff --git a/sound/soc/qcom/qdsp6/q6asm.c b/sound/soc/qcom/qdsp6/q6asm.c
+index 2b2c7233bb5f..1bdacf797613 100644
+--- a/sound/soc/qcom/qdsp6/q6asm.c
++++ b/sound/soc/qcom/qdsp6/q6asm.c
+@@ -25,6 +25,7 @@
+ #define ASM_STREAM_CMD_FLUSH 0x00010BCE
+ #define ASM_SESSION_CMD_PAUSE 0x00010BD3
+ #define ASM_DATA_CMD_EOS 0x00010BDB
++#define ASM_DATA_EVENT_RENDERED_EOS 0x00010C1C
+ #define ASM_NULL_POPP_TOPOLOGY 0x00010C68
+ #define ASM_STREAM_CMD_FLUSH_READBUFS 0x00010C09
+ #define ASM_STREAM_CMD_SET_ENCDEC_PARAM 0x00010C10
+@@ -545,9 +546,6 @@ static int32_t q6asm_stream_callback(struct apr_device *adev,
+ case ASM_SESSION_CMD_SUSPEND:
+ client_event = ASM_CLIENT_EVENT_CMD_SUSPEND_DONE;
+ break;
+- case ASM_DATA_CMD_EOS:
+- client_event = ASM_CLIENT_EVENT_CMD_EOS_DONE;
+- break;
+ case ASM_STREAM_CMD_FLUSH:
+ client_event = ASM_CLIENT_EVENT_CMD_FLUSH_DONE;
+ break;
+@@ -650,6 +648,9 @@ static int32_t q6asm_stream_callback(struct apr_device *adev,
+ spin_unlock_irqrestore(&ac->lock, flags);
+ }
+
++ break;
++ case ASM_DATA_EVENT_RENDERED_EOS:
++ client_event = ASM_CLIENT_EVENT_CMD_EOS_DONE;
+ break;
+ }
+
+diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c
+index 8a2e3bbce3a1..ad16c8310dd3 100644
+--- a/sound/soc/rockchip/rockchip_pdm.c
++++ b/sound/soc/rockchip/rockchip_pdm.c
+@@ -478,8 +478,10 @@ static int rockchip_pdm_resume(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put(dev);
+ return ret;
++ }
+
+ ret = regcache_sync(pdm->regmap);
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 8a0211131fc6..45bd3d54be54 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -591,8 +591,9 @@ static int check_matrix_bitmap(unsigned char *bmap,
+ * if failed, give up and free the control instance.
+ */
+
+-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
+- struct snd_kcontrol *kctl)
++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
++ struct snd_kcontrol *kctl,
++ bool is_std_info)
+ {
+ struct usb_mixer_interface *mixer = list->mixer;
+ int err;
+@@ -606,6 +607,7 @@ int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
+ return err;
+ }
+ list->kctl = kctl;
++ list->is_std_info = is_std_info;
+ list->next_id_elem = mixer->id_elems[list->id];
+ mixer->id_elems[list->id] = list;
+ return 0;
+@@ -3232,8 +3234,11 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid)
+ unitid = delegate_notify(mixer, unitid, NULL, NULL);
+
+ for_each_mixer_elem(list, mixer, unitid) {
+- struct usb_mixer_elem_info *info =
+- mixer_elem_list_to_info(list);
++ struct usb_mixer_elem_info *info;
++
++ if (!list->is_std_info)
++ continue;
++ info = mixer_elem_list_to_info(list);
+ /* invalidate cache, so the value is read from the device */
+ info->cached = 0;
+ snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+@@ -3313,6 +3318,8 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer,
+
+ if (!list->kctl)
+ continue;
++ if (!list->is_std_info)
++ continue;
+
+ info = mixer_elem_list_to_info(list);
+ if (count > 1 && info->control != control)
+diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
+index 15ec90e96d4d..f7e6fe1a96f9 100644
+--- a/sound/usb/mixer.h
++++ b/sound/usb/mixer.h
+@@ -59,6 +59,7 @@ struct usb_mixer_elem_list {
+ struct usb_mixer_elem_list *next_id_elem; /* list of controls with same id */
+ struct snd_kcontrol *kctl;
+ unsigned int id;
++ bool is_std_info;
+ usb_mixer_elem_dump_func_t dump;
+ usb_mixer_elem_resume_func_t resume;
+ };
+@@ -96,8 +97,12 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid);
+ int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval,
+ int request, int validx, int value_set);
+
+-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list,
+- struct snd_kcontrol *kctl);
++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list,
++ struct snd_kcontrol *kctl,
++ bool is_std_info);
++
++#define snd_usb_mixer_add_control(list, kctl) \
++ snd_usb_mixer_add_list(list, kctl, true)
+
+ void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list,
+ struct usb_mixer_interface *mixer,
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 983e8a3ebfcf..21c1135bb89b 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -168,7 +168,8 @@ static int add_single_ctl_with_resume(struct usb_mixer_interface *mixer,
+ return -ENOMEM;
+ }
+ kctl->private_free = snd_usb_mixer_elem_free;
+- return snd_usb_mixer_add_control(list, kctl);
++ /* don't use snd_usb_mixer_add_control() here, this is a special list element */
++ return snd_usb_mixer_add_list(list, kctl, false);
+ }
+
+ /*
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index aac23acfdd36..8b5bc809efd3 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1203,6 +1203,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ static bool is_itf_usb_dsd_dac(unsigned int id)
+ {
+ switch (id) {
++ case USB_ID(0x154e, 0x1002): /* Denon DCD-1500RE */
+ case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */
+ case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */
+ case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */
+@@ -1344,6 +1345,14 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+ chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ usleep_range(1000, 2000);
++
++ /*
++ * Samsung USBC Headset (AKG) need a tiny delay after each
++ * class compliant request. (Model number: AAM625R or AAM627R)
++ */
++ if (chip->usb_id == USB_ID(0x04e8, 0xa051) &&
++ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
++ usleep_range(5000, 6000);
+ }
+
+ /*
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-07-09 12:12 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-07-09 12:12 UTC (permalink / raw
To: gentoo-commits
commit: 510b56b3fdede5aece9a97da8fe7c80519691285
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jul 9 12:11:58 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jul 9 12:11:58 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=510b56b3
Linux patch 4.19.132
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1131_linux-4.19.132.patch | 1293 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1297 insertions(+)
diff --git a/0000_README b/0000_README
index 6975213..32e6309 100644
--- a/0000_README
+++ b/0000_README
@@ -563,6 +563,10 @@ Patch: 1130_linux-4.19.131.patch
From: https://www.kernel.org
Desc: Linux 4.19.131
+Patch: 1131_linux-4.19.132.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.132
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1131_linux-4.19.132.patch b/1131_linux-4.19.132.patch
new file mode 100644
index 0000000..f07851f
--- /dev/null
+++ b/1131_linux-4.19.132.patch
@@ -0,0 +1,1293 @@
+diff --git a/Makefile b/Makefile
+index 605a6a2e03dc..c46ce2ef8b57 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 131
++SUBLEVEL = 132
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
+index 9dab0ed1b227..b9da2cefb564 100644
+--- a/arch/mips/kernel/traps.c
++++ b/arch/mips/kernel/traps.c
+@@ -2096,6 +2096,7 @@ static void configure_status(void)
+
+ change_c0_status(ST0_CU|ST0_MX|ST0_RE|ST0_FR|ST0_BEV|ST0_TS|ST0_KX|ST0_SX|ST0_UX,
+ status_set);
++ back_to_back_c0_hazard();
+ }
+
+ unsigned int hwrena;
+diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
+index d374f9b218b4..04bbf7e97fea 100644
+--- a/arch/s390/kernel/debug.c
++++ b/arch/s390/kernel/debug.c
+@@ -198,9 +198,10 @@ static debug_entry_t ***debug_areas_alloc(int pages_per_area, int nr_areas)
+ if (!areas)
+ goto fail_malloc_areas;
+ for (i = 0; i < nr_areas; i++) {
++ /* GFP_NOWARN to avoid user triggerable WARN, we handle fails */
+ areas[i] = kmalloc_array(pages_per_area,
+ sizeof(debug_entry_t *),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (!areas[i])
+ goto fail_malloc_areas2;
+ for (j = 0; j < pages_per_area; j++) {
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index 4fc8e6a7abb2..272879d7b0d1 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -133,21 +133,15 @@ EXPORT_SYMBOL_GPL(af_alg_release);
+ void af_alg_release_parent(struct sock *sk)
+ {
+ struct alg_sock *ask = alg_sk(sk);
+- unsigned int nokey = ask->nokey_refcnt;
+- bool last = nokey && !ask->refcnt;
++ unsigned int nokey = atomic_read(&ask->nokey_refcnt);
+
+ sk = ask->parent;
+ ask = alg_sk(sk);
+
+- local_bh_disable();
+- bh_lock_sock(sk);
+- ask->nokey_refcnt -= nokey;
+- if (!last)
+- last = !--ask->refcnt;
+- bh_unlock_sock(sk);
+- local_bh_enable();
++ if (nokey)
++ atomic_dec(&ask->nokey_refcnt);
+
+- if (last)
++ if (atomic_dec_and_test(&ask->refcnt))
+ sock_put(sk);
+ }
+ EXPORT_SYMBOL_GPL(af_alg_release_parent);
+@@ -192,7 +186,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+
+ err = -EBUSY;
+ lock_sock(sk);
+- if (ask->refcnt | ask->nokey_refcnt)
++ if (atomic_read(&ask->refcnt))
+ goto unlock;
+
+ swap(ask->type, type);
+@@ -241,7 +235,7 @@ static int alg_setsockopt(struct socket *sock, int level, int optname,
+ int err = -EBUSY;
+
+ lock_sock(sk);
+- if (ask->refcnt)
++ if (atomic_read(&ask->refcnt) != atomic_read(&ask->nokey_refcnt))
+ goto unlock;
+
+ type = ask->type;
+@@ -308,12 +302,14 @@ int af_alg_accept(struct sock *sk, struct socket *newsock, bool kern)
+
+ sk2->sk_family = PF_ALG;
+
+- if (nokey || !ask->refcnt++)
++ if (atomic_inc_return_relaxed(&ask->refcnt) == 1)
+ sock_hold(sk);
+- ask->nokey_refcnt += nokey;
++ if (nokey) {
++ atomic_inc(&ask->nokey_refcnt);
++ atomic_set(&alg_sk(sk2)->nokey_refcnt, 1);
++ }
+ alg_sk(sk2)->parent = sk;
+ alg_sk(sk2)->type = type;
+- alg_sk(sk2)->nokey_refcnt = nokey;
+
+ newsock->ops = type->ops;
+ newsock->state = SS_CONNECTED;
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index c40a8c7ee8ae..b4f16202ab7a 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -388,7 +388,7 @@ static int aead_check_key(struct socket *sock)
+ struct alg_sock *ask = alg_sk(sk);
+
+ lock_sock(sk);
+- if (ask->refcnt)
++ if (!atomic_read(&ask->nokey_refcnt))
+ goto unlock_child;
+
+ psk = ask->parent;
+@@ -400,11 +400,8 @@ static int aead_check_key(struct socket *sock)
+ if (crypto_aead_get_flags(tfm->aead) & CRYPTO_TFM_NEED_KEY)
+ goto unlock;
+
+- if (!pask->refcnt++)
+- sock_hold(psk);
+-
+- ask->refcnt = 1;
+- sock_put(psk);
++ atomic_dec(&pask->nokey_refcnt);
++ atomic_set(&ask->nokey_refcnt, 0);
+
+ err = 0;
+
+diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
+index bfcf595fd8f9..42521d0d7bfe 100644
+--- a/crypto/algif_hash.c
++++ b/crypto/algif_hash.c
+@@ -306,7 +306,7 @@ static int hash_check_key(struct socket *sock)
+ struct alg_sock *ask = alg_sk(sk);
+
+ lock_sock(sk);
+- if (ask->refcnt)
++ if (!atomic_read(&ask->nokey_refcnt))
+ goto unlock_child;
+
+ psk = ask->parent;
+@@ -318,11 +318,8 @@ static int hash_check_key(struct socket *sock)
+ if (crypto_ahash_get_flags(tfm) & CRYPTO_TFM_NEED_KEY)
+ goto unlock;
+
+- if (!pask->refcnt++)
+- sock_hold(psk);
+-
+- ask->refcnt = 1;
+- sock_put(psk);
++ atomic_dec(&pask->nokey_refcnt);
++ atomic_set(&ask->nokey_refcnt, 0);
+
+ err = 0;
+
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index 1380a208b8ca..1cb106c46043 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -215,7 +215,7 @@ static int skcipher_check_key(struct socket *sock)
+ struct alg_sock *ask = alg_sk(sk);
+
+ lock_sock(sk);
+- if (ask->refcnt)
++ if (!atomic_read(&ask->nokey_refcnt))
+ goto unlock_child;
+
+ psk = ask->parent;
+@@ -227,11 +227,8 @@ static int skcipher_check_key(struct socket *sock)
+ if (crypto_skcipher_get_flags(tfm) & CRYPTO_TFM_NEED_KEY)
+ goto unlock;
+
+- if (!pask->refcnt++)
+- sock_hold(psk);
+-
+- ask->refcnt = 1;
+- sock_put(psk);
++ atomic_dec(&pask->nokey_refcnt);
++ atomic_set(&ask->nokey_refcnt, 0);
+
+ err = 0;
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 9be54e5ef96a..075523777a4a 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -882,6 +882,7 @@ out_put_disk:
+ put_disk(vblk->disk);
+ out_free_vq:
+ vdev->config->del_vqs(vdev);
++ kfree(vblk->vqs);
+ out_free_vblk:
+ kfree(vblk);
+ out_free_index:
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 268ada29cd98..cbe415853197 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -261,6 +261,8 @@ static int get_scrub_rate(struct mem_ctl_info *mci)
+
+ if (pvt->model == 0x60)
+ amd64_read_pci_cfg(pvt->F2, F15H_M60H_SCRCTRL, &scrubval);
++ else
++ amd64_read_pci_cfg(pvt->F3, SCRCTRL, &scrubval);
+ break;
+
+ case 0x17:
+diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
+index 89110dfc7127..6fbe598693aa 100644
+--- a/drivers/firmware/efi/Kconfig
++++ b/drivers/firmware/efi/Kconfig
+@@ -179,6 +179,17 @@ config RESET_ATTACK_MITIGATION
+ have been evicted, since otherwise it will trigger even on clean
+ reboots.
+
++config EFI_CUSTOM_SSDT_OVERLAYS
++ bool "Load custom ACPI SSDT overlay from an EFI variable"
++ depends on EFI_VARS && ACPI
++ default ACPI_TABLE_UPGRADE
++ help
++ Allow loading of an ACPI SSDT overlay from an EFI variable specified
++ by a kernel command line option.
++
++ See Documentation/admin-guide/acpi/ssdt-overlays.rst for more
++ information.
++
+ endmenu
+
+ config UEFI_CPER
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index f1e0a2715269..de1bc38ab39f 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -236,7 +236,7 @@ static void generic_ops_unregister(void)
+ efivars_unregister(&generic_efivars);
+ }
+
+-#if IS_ENABLED(CONFIG_ACPI)
++#ifdef CONFIG_EFI_CUSTOM_SSDT_OVERLAYS
+ #define EFIVAR_SSDT_NAME_MAX 16
+ static char efivar_ssdt[EFIVAR_SSDT_NAME_MAX] __initdata;
+ static int __init efivar_ssdt_setup(char *str)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index ec3fd67378c1..19e2753ffe07 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -2412,7 +2412,7 @@ struct drm_encoder *dpu_encoder_init(struct drm_device *dev,
+
+ dpu_enc = devm_kzalloc(dev->dev, sizeof(*dpu_enc), GFP_KERNEL);
+ if (!dpu_enc)
+- return ERR_PTR(ENOMEM);
++ return ERR_PTR(-ENOMEM);
+
+ rc = drm_encoder_init(dev, &dpu_enc->base, &dpu_encoder_funcs,
+ drm_enc_mode, NULL);
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+index 8ad36f574df8..7e7fa8cef2ad 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+@@ -242,9 +242,8 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force)
+ struct sun4i_hdmi *hdmi = drm_connector_to_sun4i_hdmi(connector);
+ unsigned long reg;
+
+- if (readl_poll_timeout(hdmi->base + SUN4I_HDMI_HPD_REG, reg,
+- reg & SUN4I_HDMI_HPD_HIGH,
+- 0, 500000)) {
++ reg = readl(hdmi->base + SUN4I_HDMI_HPD_REG);
++ if (reg & SUN4I_HDMI_HPD_HIGH) {
+ cec_phys_addr_invalidate(hdmi->cec_adap);
+ return connector_status_disconnected;
+ }
+diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
+index 2f2fb1966958..2f40da04a944 100644
+--- a/drivers/hwmon/acpi_power_meter.c
++++ b/drivers/hwmon/acpi_power_meter.c
+@@ -896,7 +896,7 @@ static int acpi_power_meter_add(struct acpi_device *device)
+
+ res = setup_attrs(resource);
+ if (res)
+- goto exit_free;
++ goto exit_free_capability;
+
+ resource->hwmon_dev = hwmon_device_register(&device->dev);
+ if (IS_ERR(resource->hwmon_dev)) {
+@@ -909,6 +909,8 @@ static int acpi_power_meter_add(struct acpi_device *device)
+
+ exit_remove:
+ remove_attrs(resource);
++exit_free_capability:
++ free_capabilities(resource);
+ exit_free:
+ kfree(resource);
+ exit:
+diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c
+index 221fd1492057..6df28fe0577d 100644
+--- a/drivers/hwmon/max6697.c
++++ b/drivers/hwmon/max6697.c
+@@ -47,8 +47,9 @@ static const u8 MAX6697_REG_CRIT[] = {
+ * Map device tree / platform data register bit map to chip bit map.
+ * Applies to alert register and over-temperature register.
+ */
+-#define MAX6697_MAP_BITS(reg) ((((reg) & 0x7e) >> 1) | \
++#define MAX6697_ALERT_MAP_BITS(reg) ((((reg) & 0x7e) >> 1) | \
+ (((reg) & 0x01) << 6) | ((reg) & 0x80))
++#define MAX6697_OVERT_MAP_BITS(reg) (((reg) >> 1) | (((reg) & 0x01) << 7))
+
+ #define MAX6697_REG_STAT(n) (0x44 + (n))
+
+@@ -587,12 +588,12 @@ static int max6697_init_chip(struct max6697_data *data,
+ return ret;
+
+ ret = i2c_smbus_write_byte_data(client, MAX6697_REG_ALERT_MASK,
+- MAX6697_MAP_BITS(pdata->alert_mask));
++ MAX6697_ALERT_MAP_BITS(pdata->alert_mask));
+ if (ret < 0)
+ return ret;
+
+ ret = i2c_smbus_write_byte_data(client, MAX6697_REG_OVERT_MASK,
+- MAX6697_MAP_BITS(pdata->over_temperature_mask));
++ MAX6697_OVERT_MAP_BITS(pdata->over_temperature_mask));
+ if (ret < 0)
+ return ret;
+
+diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
+index 883a290f6a4d..0e745f82d6a5 100644
+--- a/drivers/i2c/algos/i2c-algo-pca.c
++++ b/drivers/i2c/algos/i2c-algo-pca.c
+@@ -323,7 +323,8 @@ static int pca_xfer(struct i2c_adapter *i2c_adap,
+ DEB2("BUS ERROR - SDA Stuck low\n");
+ pca_reset(adap);
+ goto out;
+- case 0x90: /* Bus error - SCL stuck low */
++ case 0x78: /* Bus error - SCL stuck low (PCA9665) */
++ case 0x90: /* Bus error - SCL stuck low (PCA9564) */
+ DEB2("BUS ERROR - SCL Stuck low\n");
+ pca_reset(adap);
+ goto out;
+diff --git a/drivers/i2c/busses/i2c-mlxcpld.c b/drivers/i2c/busses/i2c-mlxcpld.c
+index 2fd717d8dd30..71d7bae2cbca 100644
+--- a/drivers/i2c/busses/i2c-mlxcpld.c
++++ b/drivers/i2c/busses/i2c-mlxcpld.c
+@@ -337,9 +337,9 @@ static int mlxcpld_i2c_wait_for_tc(struct mlxcpld_i2c_priv *priv)
+ if (priv->smbus_block && (val & MLXCPLD_I2C_SMBUS_BLK_BIT)) {
+ mlxcpld_i2c_read_comm(priv, MLXCPLD_LPCI2C_NUM_DAT_REG,
+ &datalen, 1);
+- if (unlikely(datalen > (I2C_SMBUS_BLOCK_MAX + 1))) {
++ if (unlikely(datalen > I2C_SMBUS_BLOCK_MAX)) {
+ dev_err(priv->dev, "Incorrect smbus block read message len\n");
+- return -E2BIG;
++ return -EPROTO;
+ }
+ } else {
+ datalen = priv->xfer.data_len;
+diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
+index ced10c44b68a..b5417012afc8 100644
+--- a/drivers/irqchip/irq-gic.c
++++ b/drivers/irqchip/irq-gic.c
+@@ -324,10 +324,8 @@ static int gic_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu)
+ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
+ bool force)
+ {
+- void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
+- unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
+- u32 val, mask, bit;
+- unsigned long flags;
++ void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + gic_irq(d);
++ unsigned int cpu;
+
+ if (!force)
+ cpu = cpumask_any_and(mask_val, cpu_online_mask);
+@@ -337,13 +335,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
+ if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
+ return -EINVAL;
+
+- gic_lock_irqsave(flags);
+- mask = 0xff << shift;
+- bit = gic_cpu_map[cpu] << shift;
+- val = readl_relaxed(reg) & ~mask;
+- writel_relaxed(val | bit, reg);
+- gic_unlock_irqrestore(flags);
+-
++ writeb_relaxed(gic_cpu_map[cpu], reg);
+ irq_data_update_effective_affinity(d, cpumask_of(cpu));
+
+ return IRQ_SET_MASK_OK_DONE;
+diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
+index 971a2da43cbf..185397272586 100644
+--- a/drivers/md/dm-zoned-target.c
++++ b/drivers/md/dm-zoned-target.c
+@@ -789,7 +789,7 @@ static int dmz_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ }
+
+ /* Set target (no write same support) */
+- ti->max_io_len = dev->zone_nr_sectors << 9;
++ ti->max_io_len = dev->zone_nr_sectors;
+ ti->num_flush_bios = 1;
+ ti->num_discard_bios = 1;
+ ti->num_write_zeroes_bios = 1;
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+index 5bc58429bb1c..c91e155c147c 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+@@ -1987,7 +1987,6 @@ int cudbg_collect_dump_context(struct cudbg_init *pdbg_init,
+ u8 mem_type[CTXT_INGRESS + 1] = { 0 };
+ struct cudbg_buffer temp_buff = { 0 };
+ struct cudbg_ch_cntxt *buff;
+- u64 *dst_off, *src_off;
+ u8 *ctx_buf;
+ u8 i, k;
+ int rc;
+@@ -2056,8 +2055,11 @@ int cudbg_collect_dump_context(struct cudbg_init *pdbg_init,
+ }
+
+ for (j = 0; j < max_ctx_qid; j++) {
++ __be64 *dst_off;
++ u64 *src_off;
++
+ src_off = (u64 *)(ctx_buf + j * SGE_CTXT_SIZE);
+- dst_off = (u64 *)buff->data;
++ dst_off = (__be64 *)buff->data;
+
+ /* The data is stored in 64-bit cpu order. Convert it
+ * to big endian before parsing.
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+index 7dddb9e748b8..86745f33a252 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+@@ -810,16 +810,16 @@ static bool is_addr_all_mask(u8 *ipmask, int family)
+ struct in_addr *addr;
+
+ addr = (struct in_addr *)ipmask;
+- if (addr->s_addr == 0xffffffff)
++ if (ntohl(addr->s_addr) == 0xffffffff)
+ return true;
+ } else if (family == AF_INET6) {
+ struct in6_addr *addr6;
+
+ addr6 = (struct in6_addr *)ipmask;
+- if (addr6->s6_addr32[0] == 0xffffffff &&
+- addr6->s6_addr32[1] == 0xffffffff &&
+- addr6->s6_addr32[2] == 0xffffffff &&
+- addr6->s6_addr32[3] == 0xffffffff)
++ if (ntohl(addr6->s6_addr32[0]) == 0xffffffff &&
++ ntohl(addr6->s6_addr32[1]) == 0xffffffff &&
++ ntohl(addr6->s6_addr32[2]) == 0xffffffff &&
++ ntohl(addr6->s6_addr32[3]) == 0xffffffff)
+ return true;
+ }
+ return false;
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
+index c7d2b4dc7568..9fd0acd1cbd1 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
+@@ -47,7 +47,7 @@ static int fill_match_fields(struct adapter *adap,
+ bool next_header)
+ {
+ unsigned int i, j;
+- u32 val, mask;
++ __be32 val, mask;
+ int off, err;
+ bool found;
+
+@@ -216,7 +216,7 @@ int cxgb4_config_knode(struct net_device *dev, struct tc_cls_u32_offload *cls)
+ const struct cxgb4_next_header *next;
+ bool found = false;
+ unsigned int i, j;
+- u32 val, mask;
++ __be32 val, mask;
+ int off;
+
+ if (t->table[link_uhtid - 1].link_handle) {
+@@ -230,10 +230,10 @@ int cxgb4_config_knode(struct net_device *dev, struct tc_cls_u32_offload *cls)
+
+ /* Try to find matches that allow jumps to next header. */
+ for (i = 0; next[i].jump; i++) {
+- if (next[i].offoff != cls->knode.sel->offoff ||
+- next[i].shift != cls->knode.sel->offshift ||
+- next[i].mask != cls->knode.sel->offmask ||
+- next[i].offset != cls->knode.sel->off)
++ if (next[i].sel.offoff != cls->knode.sel->offoff ||
++ next[i].sel.offshift != cls->knode.sel->offshift ||
++ next[i].sel.offmask != cls->knode.sel->offmask ||
++ next[i].sel.off != cls->knode.sel->off)
+ continue;
+
+ /* Found a possible candidate. Find a key that
+@@ -245,9 +245,9 @@ int cxgb4_config_knode(struct net_device *dev, struct tc_cls_u32_offload *cls)
+ val = cls->knode.sel->keys[j].val;
+ mask = cls->knode.sel->keys[j].mask;
+
+- if (next[i].match_off == off &&
+- next[i].match_val == val &&
+- next[i].match_mask == mask) {
++ if (next[i].key.off == off &&
++ next[i].key.val == val &&
++ next[i].key.mask == mask) {
+ found = true;
+ break;
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h
+index a4b99edcc339..141085e159e5 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h
+@@ -38,12 +38,12 @@
+ struct cxgb4_match_field {
+ int off; /* Offset from the beginning of the header to match */
+ /* Fill the value/mask pair in the spec if matched */
+- int (*val)(struct ch_filter_specification *f, u32 val, u32 mask);
++ int (*val)(struct ch_filter_specification *f, __be32 val, __be32 mask);
+ };
+
+ /* IPv4 match fields */
+ static inline int cxgb4_fill_ipv4_tos(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ f->val.tos = (ntohl(val) >> 16) & 0x000000FF;
+ f->mask.tos = (ntohl(mask) >> 16) & 0x000000FF;
+@@ -52,7 +52,7 @@ static inline int cxgb4_fill_ipv4_tos(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv4_frag(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ u32 mask_val;
+ u8 frag_val;
+@@ -74,7 +74,7 @@ static inline int cxgb4_fill_ipv4_frag(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv4_proto(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ f->val.proto = (ntohl(val) >> 16) & 0x000000FF;
+ f->mask.proto = (ntohl(mask) >> 16) & 0x000000FF;
+@@ -83,7 +83,7 @@ static inline int cxgb4_fill_ipv4_proto(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv4_src_ip(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.fip[0], &val, sizeof(u32));
+ memcpy(&f->mask.fip[0], &mask, sizeof(u32));
+@@ -92,7 +92,7 @@ static inline int cxgb4_fill_ipv4_src_ip(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv4_dst_ip(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.lip[0], &val, sizeof(u32));
+ memcpy(&f->mask.lip[0], &mask, sizeof(u32));
+@@ -111,7 +111,7 @@ static const struct cxgb4_match_field cxgb4_ipv4_fields[] = {
+
+ /* IPv6 match fields */
+ static inline int cxgb4_fill_ipv6_tos(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ f->val.tos = (ntohl(val) >> 20) & 0x000000FF;
+ f->mask.tos = (ntohl(mask) >> 20) & 0x000000FF;
+@@ -120,7 +120,7 @@ static inline int cxgb4_fill_ipv6_tos(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_proto(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ f->val.proto = (ntohl(val) >> 8) & 0x000000FF;
+ f->mask.proto = (ntohl(mask) >> 8) & 0x000000FF;
+@@ -129,7 +129,7 @@ static inline int cxgb4_fill_ipv6_proto(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_src_ip0(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.fip[0], &val, sizeof(u32));
+ memcpy(&f->mask.fip[0], &mask, sizeof(u32));
+@@ -138,7 +138,7 @@ static inline int cxgb4_fill_ipv6_src_ip0(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_src_ip1(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.fip[4], &val, sizeof(u32));
+ memcpy(&f->mask.fip[4], &mask, sizeof(u32));
+@@ -147,7 +147,7 @@ static inline int cxgb4_fill_ipv6_src_ip1(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_src_ip2(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.fip[8], &val, sizeof(u32));
+ memcpy(&f->mask.fip[8], &mask, sizeof(u32));
+@@ -156,7 +156,7 @@ static inline int cxgb4_fill_ipv6_src_ip2(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_src_ip3(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.fip[12], &val, sizeof(u32));
+ memcpy(&f->mask.fip[12], &mask, sizeof(u32));
+@@ -165,7 +165,7 @@ static inline int cxgb4_fill_ipv6_src_ip3(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_dst_ip0(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.lip[0], &val, sizeof(u32));
+ memcpy(&f->mask.lip[0], &mask, sizeof(u32));
+@@ -174,7 +174,7 @@ static inline int cxgb4_fill_ipv6_dst_ip0(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_dst_ip1(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.lip[4], &val, sizeof(u32));
+ memcpy(&f->mask.lip[4], &mask, sizeof(u32));
+@@ -183,7 +183,7 @@ static inline int cxgb4_fill_ipv6_dst_ip1(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_dst_ip2(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.lip[8], &val, sizeof(u32));
+ memcpy(&f->mask.lip[8], &mask, sizeof(u32));
+@@ -192,7 +192,7 @@ static inline int cxgb4_fill_ipv6_dst_ip2(struct ch_filter_specification *f,
+ }
+
+ static inline int cxgb4_fill_ipv6_dst_ip3(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ memcpy(&f->val.lip[12], &val, sizeof(u32));
+ memcpy(&f->mask.lip[12], &mask, sizeof(u32));
+@@ -216,7 +216,7 @@ static const struct cxgb4_match_field cxgb4_ipv6_fields[] = {
+
+ /* TCP/UDP match */
+ static inline int cxgb4_fill_l4_ports(struct ch_filter_specification *f,
+- u32 val, u32 mask)
++ __be32 val, __be32 mask)
+ {
+ f->val.fport = ntohl(val) >> 16;
+ f->mask.fport = ntohl(mask) >> 16;
+@@ -237,19 +237,13 @@ static const struct cxgb4_match_field cxgb4_udp_fields[] = {
+ };
+
+ struct cxgb4_next_header {
+- unsigned int offset; /* Offset to next header */
+- /* offset, shift, and mask added to offset above
++ /* Offset, shift, and mask added to beginning of the header
+ * to get to next header. Useful when using a header
+ * field's value to jump to next header such as IHL field
+ * in IPv4 header.
+ */
+- unsigned int offoff;
+- u32 shift;
+- u32 mask;
+- /* match criteria to make this jump */
+- unsigned int match_off;
+- u32 match_val;
+- u32 match_mask;
++ struct tc_u32_sel sel;
++ struct tc_u32_key key;
+ /* location of jump to make */
+ const struct cxgb4_match_field *jump;
+ };
+@@ -258,26 +252,74 @@ struct cxgb4_next_header {
+ * IPv4 header.
+ */
+ static const struct cxgb4_next_header cxgb4_ipv4_jumps[] = {
+- { .offset = 0, .offoff = 0, .shift = 6, .mask = 0xF,
+- .match_off = 8, .match_val = 0x600, .match_mask = 0xFF00,
+- .jump = cxgb4_tcp_fields },
+- { .offset = 0, .offoff = 0, .shift = 6, .mask = 0xF,
+- .match_off = 8, .match_val = 0x1100, .match_mask = 0xFF00,
+- .jump = cxgb4_udp_fields },
+- { .jump = NULL }
++ {
++ /* TCP Jump */
++ .sel = {
++ .off = 0,
++ .offoff = 0,
++ .offshift = 6,
++ .offmask = cpu_to_be16(0x0f00),
++ },
++ .key = {
++ .off = 8,
++ .val = cpu_to_be32(0x00060000),
++ .mask = cpu_to_be32(0x00ff0000),
++ },
++ .jump = cxgb4_tcp_fields,
++ },
++ {
++ /* UDP Jump */
++ .sel = {
++ .off = 0,
++ .offoff = 0,
++ .offshift = 6,
++ .offmask = cpu_to_be16(0x0f00),
++ },
++ .key = {
++ .off = 8,
++ .val = cpu_to_be32(0x00110000),
++ .mask = cpu_to_be32(0x00ff0000),
++ },
++ .jump = cxgb4_udp_fields,
++ },
++ { .jump = NULL },
+ };
+
+ /* Accept a rule with a jump directly past the 40 Bytes of IPv6 fixed header
+ * to get to transport layer header.
+ */
+ static const struct cxgb4_next_header cxgb4_ipv6_jumps[] = {
+- { .offset = 0x28, .offoff = 0, .shift = 0, .mask = 0,
+- .match_off = 4, .match_val = 0x60000, .match_mask = 0xFF0000,
+- .jump = cxgb4_tcp_fields },
+- { .offset = 0x28, .offoff = 0, .shift = 0, .mask = 0,
+- .match_off = 4, .match_val = 0x110000, .match_mask = 0xFF0000,
+- .jump = cxgb4_udp_fields },
+- { .jump = NULL }
++ {
++ /* TCP Jump */
++ .sel = {
++ .off = 40,
++ .offoff = 0,
++ .offshift = 0,
++ .offmask = 0,
++ },
++ .key = {
++ .off = 4,
++ .val = cpu_to_be32(0x00000600),
++ .mask = cpu_to_be32(0x0000ff00),
++ },
++ .jump = cxgb4_tcp_fields,
++ },
++ {
++ /* UDP Jump */
++ .sel = {
++ .off = 40,
++ .offoff = 0,
++ .offshift = 0,
++ .offmask = 0,
++ },
++ .key = {
++ .off = 4,
++ .val = cpu_to_be32(0x00001100),
++ .mask = cpu_to_be32(0x0000ff00),
++ },
++ .jump = cxgb4_udp_fields,
++ },
++ { .jump = NULL },
+ };
+
+ struct cxgb4_link {
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+index 6807bc3a44fb..3d4a765e9e61 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+@@ -2742,7 +2742,7 @@ static noinline int t4_systim_to_hwstamp(struct adapter *adapter,
+
+ hwtstamps = skb_hwtstamps(skb);
+ memset(hwtstamps, 0, sizeof(*hwtstamps));
+- hwtstamps->hwtstamp = ns_to_ktime(be64_to_cpu(*((u64 *)data)));
++ hwtstamps->hwtstamp = ns_to_ktime(get_unaligned_be64(data));
+
+ return RX_PTP_PKT_SUC;
+ }
+diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
+index 6e971628bb50..c3389bd87c65 100644
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -1338,7 +1338,7 @@ static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf)
+ struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+
+ if (pdata) {
+- cancel_delayed_work(&pdata->carrier_check);
++ cancel_delayed_work_sync(&pdata->carrier_check);
+ netif_dbg(dev, ifdown, dev->net, "free pdata\n");
+ kfree(pdata);
+ pdata = NULL;
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 588864beabd8..2e63c1106030 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -11,6 +11,7 @@
+ * more details.
+ */
+
++#include <linux/backing-dev.h>
+ #include <linux/moduleparam.h>
+ #include <trace/events/block.h>
+ #include "nvme.h"
+@@ -495,32 +496,48 @@ static ssize_t ana_state_show(struct device *dev, struct device_attribute *attr,
+ }
+ DEVICE_ATTR_RO(ana_state);
+
+-static int nvme_set_ns_ana_state(struct nvme_ctrl *ctrl,
++static int nvme_lookup_ana_group_desc(struct nvme_ctrl *ctrl,
+ struct nvme_ana_group_desc *desc, void *data)
+ {
+- struct nvme_ns *ns = data;
++ struct nvme_ana_group_desc *dst = data;
+
+- if (ns->ana_grpid == le32_to_cpu(desc->grpid)) {
+- nvme_update_ns_ana_state(desc, ns);
+- return -ENXIO; /* just break out of the loop */
+- }
++ if (desc->grpid != dst->grpid)
++ return 0;
+
+- return 0;
++ *dst = *desc;
++ return -ENXIO; /* just break out of the loop */
+ }
+
+ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id)
+ {
+ if (nvme_ctrl_use_ana(ns->ctrl)) {
++ struct nvme_ana_group_desc desc = {
++ .grpid = id->anagrpid,
++ .state = 0,
++ };
++
+ mutex_lock(&ns->ctrl->ana_lock);
+ ns->ana_grpid = le32_to_cpu(id->anagrpid);
+- nvme_parse_ana_log(ns->ctrl, ns, nvme_set_ns_ana_state);
++ nvme_parse_ana_log(ns->ctrl, &desc, nvme_lookup_ana_group_desc);
+ mutex_unlock(&ns->ctrl->ana_lock);
++ if (desc.state) {
++ /* found the group desc: update */
++ nvme_update_ns_ana_state(&desc, ns);
++ }
+ } else {
+ mutex_lock(&ns->head->lock);
+ ns->ana_state = NVME_ANA_OPTIMIZED;
+ nvme_mpath_set_live(ns);
+ mutex_unlock(&ns->head->lock);
+ }
++
++ if (bdi_cap_stable_pages_required(ns->queue->backing_dev_info)) {
++ struct gendisk *disk = ns->head->disk;
++
++ if (disk)
++ disk->queue->backing_dev_info->capabilities |=
++ BDI_CAP_STABLE_WRITES;
++ }
+ }
+
+ void nvme_mpath_remove_disk(struct nvme_ns_head *head)
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index c7f82310e73e..fc3fc9d48a55 100644
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -2853,6 +2853,7 @@ static void usbtest_disconnect(struct usb_interface *intf)
+
+ usb_set_intfdata(intf, NULL);
+ dev_dbg(&intf->dev, "disconnect\n");
++ kfree(dev->buf);
+ kfree(dev);
+ }
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 271e70c45d5b..ec3aa76d19b7 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10286,7 +10286,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ path = btrfs_alloc_path();
+ if (!path) {
+ ret = -ENOMEM;
+- goto out_put_group;
++ goto out;
+ }
+
+ /*
+@@ -10323,7 +10323,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ ret = btrfs_orphan_add(trans, BTRFS_I(inode));
+ if (ret) {
+ btrfs_add_delayed_iput(inode);
+- goto out_put_group;
++ goto out;
+ }
+ clear_nlink(inode);
+ /* One for the block groups ref */
+@@ -10346,13 +10346,13 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+
+ ret = btrfs_search_slot(trans, tree_root, &key, path, -1, 1);
+ if (ret < 0)
+- goto out_put_group;
++ goto out;
+ if (ret > 0)
+ btrfs_release_path(path);
+ if (ret == 0) {
+ ret = btrfs_del_item(trans, tree_root, path);
+ if (ret)
+- goto out_put_group;
++ goto out;
+ btrfs_release_path(path);
+ }
+
+@@ -10361,6 +10361,9 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ &fs_info->block_group_cache_tree);
+ RB_CLEAR_NODE(&block_group->cache_node);
+
++ /* Once for the block groups rbtree */
++ btrfs_put_block_group(block_group);
++
+ if (fs_info->first_logical_byte == block_group->key.objectid)
+ fs_info->first_logical_byte = (u64)-1;
+ spin_unlock(&fs_info->block_group_cache_lock);
+@@ -10494,10 +10497,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+
+ ret = remove_block_group_free_space(trans, block_group);
+ if (ret)
+- goto out_put_group;
+-
+- /* Once for the block groups rbtree */
+- btrfs_put_block_group(block_group);
++ goto out;
+
+ ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
+ if (ret > 0)
+@@ -10525,10 +10525,9 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ free_extent_map(em);
+ }
+
+-out_put_group:
++out:
+ /* Once for the lookup reference */
+ btrfs_put_block_group(block_group);
+-out:
+ btrfs_free_path(path);
+ return ret;
+ }
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 9e569d60c636..6335ca143292 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -4601,9 +4601,14 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
+ vol_info->nocase = master_tcon->nocase;
+ vol_info->nohandlecache = master_tcon->nohandlecache;
+ vol_info->local_lease = master_tcon->local_lease;
++ vol_info->no_lease = master_tcon->no_lease;
++ vol_info->resilient = master_tcon->use_resilient;
++ vol_info->persistent = master_tcon->use_persistent;
+ vol_info->no_linux_ext = !master_tcon->unix_ext;
++ vol_info->linux_ext = master_tcon->posix_extensions;
+ vol_info->sectype = master_tcon->ses->sectype;
+ vol_info->sign = master_tcon->ses->sign;
++ vol_info->seal = master_tcon->seal;
+
+ rc = cifs_set_vol_auth(vol_info, master_tcon->ses);
+ if (rc) {
+@@ -4629,10 +4634,6 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid)
+ goto out;
+ }
+
+- /* if new SMB3.11 POSIX extensions are supported do not remap / and \ */
+- if (tcon->posix_extensions)
+- cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_POSIX_PATHS;
+-
+ if (cap_unix(ses))
+ reset_cifs_unix_caps(0, tcon, NULL, vol_info);
+
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 51d410c6f6a4..44fb9ae6d105 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1783,6 +1783,7 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
+ FILE_UNIX_BASIC_INFO *info_buf_target;
+ unsigned int xid;
+ int rc, tmprc;
++ bool new_target = d_really_is_negative(target_dentry);
+
+ if (flags & ~RENAME_NOREPLACE)
+ return -EINVAL;
+@@ -1859,8 +1860,13 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
+ */
+
+ unlink_target:
+- /* Try unlinking the target dentry if it's not negative */
+- if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) {
++ /*
++ * If the target dentry was created during the rename, try
++ * unlinking it if it's not negative
++ */
++ if (new_target &&
++ d_really_is_positive(target_dentry) &&
++ (rc == -EACCES || rc == -EEXIST)) {
+ if (d_is_dir(target_dentry))
+ tmprc = cifs_rmdir(target_dir, target_dentry);
+ else
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 80cededcd10d..28e7f86c8c94 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -1206,6 +1206,9 @@ nfsd_create_locked(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ iap->ia_mode = 0;
+ iap->ia_mode = (iap->ia_mode & S_IALLUGO) | type;
+
++ if (!IS_POSIXACL(dirp))
++ iap->ia_mode &= ~current_umask();
++
+ err = 0;
+ host_err = 0;
+ switch (type) {
+@@ -1439,6 +1442,9 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ goto out;
+ }
+
++ if (!IS_POSIXACL(dirp))
++ iap->ia_mode &= ~current_umask();
++
+ host_err = vfs_create(dirp, dchild, iap->ia_mode, true);
+ if (host_err < 0) {
+ fh_drop_write(fhp);
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index 482461d8931d..11f107df78dc 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -34,8 +34,8 @@ struct alg_sock {
+
+ struct sock *parent;
+
+- unsigned int refcnt;
+- unsigned int nokey_refcnt;
++ atomic_t refcnt;
++ atomic_t nokey_refcnt;
+
+ const struct af_alg_type *type;
+ void *private;
+diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
+index 6a1dc2613bb9..fbb1bfdd2fa5 100644
+--- a/kernel/debug/debug_core.c
++++ b/kernel/debug/debug_core.c
+@@ -489,6 +489,7 @@ static int kgdb_cpu_enter(struct kgdb_state *ks, struct pt_regs *regs,
+ arch_kgdb_ops.disable_hw_break(regs);
+
+ acquirelock:
++ rcu_read_lock();
+ /*
+ * Interrupts will be restored by the 'trap return' code, except when
+ * single stepping.
+@@ -545,6 +546,7 @@ return_normal:
+ atomic_dec(&slaves_in_kgdb);
+ dbg_touch_watchdogs();
+ local_irq_restore(flags);
++ rcu_read_unlock();
+ return 0;
+ }
+ cpu_relax();
+@@ -563,6 +565,7 @@ return_normal:
+ raw_spin_unlock(&dbg_master_lock);
+ dbg_touch_watchdogs();
+ local_irq_restore(flags);
++ rcu_read_unlock();
+
+ goto acquirelock;
+ }
+@@ -686,6 +689,7 @@ kgdb_restore:
+ raw_spin_unlock(&dbg_master_lock);
+ dbg_touch_watchdogs();
+ local_irq_restore(flags);
++ rcu_read_unlock();
+
+ return kgdb_info[cpu].ret_state;
+ }
+diff --git a/mm/slub.c b/mm/slub.c
+index b94ba8d35a02..882a1e0ae89c 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -645,6 +645,20 @@ static void slab_fix(struct kmem_cache *s, char *fmt, ...)
+ va_end(args);
+ }
+
++static bool freelist_corrupted(struct kmem_cache *s, struct page *page,
++ void *freelist, void *nextfree)
++{
++ if ((s->flags & SLAB_CONSISTENCY_CHECKS) &&
++ !check_valid_pointer(s, page, nextfree)) {
++ object_err(s, page, freelist, "Freechain corrupt");
++ freelist = NULL;
++ slab_fix(s, "Isolate corrupted freechain");
++ return true;
++ }
++
++ return false;
++}
++
+ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
+ {
+ unsigned int off; /* Offset of last byte */
+@@ -1328,6 +1342,11 @@ static inline void inc_slabs_node(struct kmem_cache *s, int node,
+ static inline void dec_slabs_node(struct kmem_cache *s, int node,
+ int objects) {}
+
++static bool freelist_corrupted(struct kmem_cache *s, struct page *page,
++ void *freelist, void *nextfree)
++{
++ return false;
++}
+ #endif /* CONFIG_SLUB_DEBUG */
+
+ /*
+@@ -2013,6 +2032,14 @@ static void deactivate_slab(struct kmem_cache *s, struct page *page,
+ void *prior;
+ unsigned long counters;
+
++ /*
++ * If 'nextfree' is invalid, it is possible that the object at
++ * 'freelist' is already corrupted. So isolate all objects
++ * starting at 'freelist'.
++ */
++ if (freelist_corrupted(s, page, freelist, nextfree))
++ break;
++
+ do {
+ prior = page->freelist;
+ counters = page->counters;
+@@ -5583,7 +5610,8 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
+ */
+ if (buffer)
+ buf = buffer;
+- else if (root_cache->max_attr_size < ARRAY_SIZE(mbuf))
++ else if (root_cache->max_attr_size < ARRAY_SIZE(mbuf) &&
++ !IS_ENABLED(CONFIG_SLUB_STATS))
+ buf = mbuf;
+ else {
+ buffer = (char *) get_zeroed_page(GFP_KERNEL);
+diff --git a/mm/swap_state.c b/mm/swap_state.c
+index ecee9c6c4cc1..09731f4174c7 100644
+--- a/mm/swap_state.c
++++ b/mm/swap_state.c
+@@ -23,6 +23,7 @@
+ #include <linux/huge_mm.h>
+
+ #include <asm/pgtable.h>
++#include "internal.h"
+
+ /*
+ * swapper_space is a fiction, retained to simplify the path through
+@@ -416,7 +417,7 @@ struct page *__read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
+ /*
+ * call radix_tree_preload() while we can wait.
+ */
+- err = radix_tree_maybe_preload(gfp_mask & GFP_KERNEL);
++ err = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
+ if (err)
+ break;
+
+diff --git a/sound/usb/card.h b/sound/usb/card.h
+index 36198ddb4754..7f11655bde50 100644
+--- a/sound/usb/card.h
++++ b/sound/usb/card.h
+@@ -83,10 +83,6 @@ struct snd_usb_endpoint {
+ dma_addr_t sync_dma; /* DMA address of syncbuf */
+
+ unsigned int pipe; /* the data i/o pipe */
+- unsigned int framesize[2]; /* small/large frame sizes in samples */
+- unsigned int sample_rem; /* remainder from division fs/fps */
+- unsigned int sample_accum; /* sample accumulator */
+- unsigned int fps; /* frames per second */
+ unsigned int freqn; /* nominal sampling rate in fs/fps in Q16.16 format */
+ unsigned int freqm; /* momentary sampling rate in fs/fps in Q16.16 format */
+ int freqshift; /* how much to shift the feedback value to get Q16.16 */
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 48611849b79b..727ef9889e94 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -137,12 +137,12 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep)
+
+ /*
+ * For streaming based on information derived from sync endpoints,
+- * prepare_outbound_urb_sizes() will call slave_next_packet_size() to
++ * prepare_outbound_urb_sizes() will call next_packet_size() to
+ * determine the number of samples to be sent in the next packet.
+ *
+- * For implicit feedback, slave_next_packet_size() is unused.
++ * For implicit feedback, next_packet_size() is unused.
+ */
+-int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep)
++int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
+ {
+ unsigned long flags;
+ int ret;
+@@ -159,29 +159,6 @@ int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep)
+ return ret;
+ }
+
+-/*
+- * For adaptive and synchronous endpoints, prepare_outbound_urb_sizes()
+- * will call next_packet_size() to determine the number of samples to be
+- * sent in the next packet.
+- */
+-int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep)
+-{
+- int ret;
+-
+- if (ep->fill_max)
+- return ep->maxframesize;
+-
+- ep->sample_accum += ep->sample_rem;
+- if (ep->sample_accum >= ep->fps) {
+- ep->sample_accum -= ep->fps;
+- ret = ep->framesize[1];
+- } else {
+- ret = ep->framesize[0];
+- }
+-
+- return ret;
+-}
+-
+ static void retire_outbound_urb(struct snd_usb_endpoint *ep,
+ struct snd_urb_ctx *urb_ctx)
+ {
+@@ -226,8 +203,6 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
+
+ if (ctx->packet_size[i])
+ counts = ctx->packet_size[i];
+- else if (ep->sync_master)
+- counts = snd_usb_endpoint_slave_next_packet_size(ep);
+ else
+ counts = snd_usb_endpoint_next_packet_size(ep);
+
+@@ -912,17 +887,10 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
+ ep->maxpacksize = fmt->maxpacksize;
+ ep->fill_max = !!(fmt->attributes & UAC_EP_CS_ATTR_FILL_MAX);
+
+- if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) {
++ if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL)
+ ep->freqn = get_usb_full_speed_rate(rate);
+- ep->fps = 1000;
+- } else {
++ else
+ ep->freqn = get_usb_high_speed_rate(rate);
+- ep->fps = 8000;
+- }
+-
+- ep->sample_rem = rate % ep->fps;
+- ep->framesize[0] = rate / ep->fps;
+- ep->framesize[1] = (rate + (ep->fps - 1)) / ep->fps;
+
+ /* calculate the frequency in 16.16 format */
+ ep->freqm = ep->freqn;
+@@ -981,7 +949,6 @@ int snd_usb_endpoint_start(struct snd_usb_endpoint *ep)
+ ep->active_mask = 0;
+ ep->unlink_mask = 0;
+ ep->phase = 0;
+- ep->sample_accum = 0;
+
+ snd_usb_endpoint_start_quirk(ep);
+
+diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
+index d23fa0a8c11b..63a39d4fa8d8 100644
+--- a/sound/usb/endpoint.h
++++ b/sound/usb/endpoint.h
+@@ -28,7 +28,6 @@ void snd_usb_endpoint_release(struct snd_usb_endpoint *ep);
+ void snd_usb_endpoint_free(struct snd_usb_endpoint *ep);
+
+ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep);
+-int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep);
+ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep);
+
+ void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 42ae774f6db7..8b91be394407 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1558,8 +1558,6 @@ static void prepare_playback_urb(struct snd_usb_substream *subs,
+ for (i = 0; i < ctx->packets; i++) {
+ if (ctx->packet_size[i])
+ counts = ctx->packet_size[i];
+- else if (ep->sync_master)
+- counts = snd_usb_endpoint_slave_next_packet_size(ep);
+ else
+ counts = snd_usb_endpoint_next_packet_size(ep);
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-07-16 11:17 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-07-16 11:17 UTC (permalink / raw
To: gentoo-commits
commit: f34853528f4ca6bac49dc07963829415f5345ea5
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jul 16 11:17:09 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jul 16 11:17:09 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f3485352
Linux patch 4.19.133
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1132_linux-4.19.133.patch | 2229 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2233 insertions(+)
diff --git a/0000_README b/0000_README
index 32e6309..ab738e3 100644
--- a/0000_README
+++ b/0000_README
@@ -567,6 +567,10 @@ Patch: 1131_linux-4.19.132.patch
From: https://www.kernel.org
Desc: Linux 4.19.132
+Patch: 1132_linux-4.19.133.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.133
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1132_linux-4.19.133.patch b/1132_linux-4.19.133.patch
new file mode 100644
index 0000000..fe44653
--- /dev/null
+++ b/1132_linux-4.19.133.patch
@@ -0,0 +1,2229 @@
+diff --git a/Makefile b/Makefile
+index c46ce2ef8b57..a17c413ee5d6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 132
++SUBLEVEL = 133
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/include/asm/elf.h b/arch/arc/include/asm/elf.h
+index aa2d6da9d187..12c74e826530 100644
+--- a/arch/arc/include/asm/elf.h
++++ b/arch/arc/include/asm/elf.h
+@@ -26,7 +26,7 @@
+ #define R_ARC_32_PCREL 0x31
+
+ /*to set parameters in the core dumps */
+-#define ELF_ARCH EM_ARCOMPACT
++#define ELF_ARCH EM_ARC_INUSE
+ #define ELF_CLASS ELFCLASS32
+
+ #ifdef CONFIG_CPU_BIG_ENDIAN
+diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
+index 85d9ea4a0acc..705a68208423 100644
+--- a/arch/arc/kernel/entry.S
++++ b/arch/arc/kernel/entry.S
+@@ -156,7 +156,6 @@ END(EV_Extension)
+ tracesys:
+ ; save EFA in case tracer wants the PC of traced task
+ ; using ERET won't work since next-PC has already committed
+- lr r12, [efa]
+ GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11
+ st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address
+
+@@ -199,15 +198,9 @@ tracesys_exit:
+ ; Breakpoint TRAP
+ ; ---------------------------------------------
+ trap_with_param:
+-
+- ; stop_pc info by gdb needs this info
+- lr r0, [efa]
++ mov r0, r12 ; EFA in case ptracer/gdb wants stop_pc
+ mov r1, sp
+
+- ; Now that we have read EFA, it is safe to do "fake" rtie
+- ; and get out of CPU exception mode
+- FAKE_RET_FROM_EXCPN
+-
+ ; Save callee regs in case gdb wants to have a look
+ ; SP will grow up by size of CALLEE Reg-File
+ ; NOTE: clobbers r12
+@@ -234,6 +227,10 @@ ENTRY(EV_Trap)
+
+ EXCEPTION_PROLOGUE
+
++ lr r12, [efa]
++
++ FAKE_RET_FROM_EXCPN
++
+ ;============ TRAP 1 :breakpoints
+ ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR)
+ bmsk.f 0, r9, 7
+@@ -241,9 +238,6 @@ ENTRY(EV_Trap)
+
+ ;============ TRAP (no param): syscall top level
+
+- ; First return from Exception to pure K mode (Exception/IRQs renabled)
+- FAKE_RET_FROM_EXCPN
+-
+ ; If syscall tracing ongoing, invoke pre-post-hooks
+ GET_CURR_THR_INFO_FLAGS r10
+ btst r10, TIF_SYSCALL_TRACE
+diff --git a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
+index f57acf8f66b9..75de8134b1d1 100644
+--- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
++++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
+@@ -16,8 +16,10 @@
+ #interrupt-cells = <2>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+- spi-max-frequency = <3000000>;
++ spi-max-frequency = <9600000>;
+ spi-cs-high;
++ spi-cpol;
++ spi-cpha;
+
+ cpcap_adc: adc {
+ compatible = "motorola,mapphone-cpcap-adc";
+diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
+index 529f4b5bbd3a..4bfefbec971a 100644
+--- a/arch/arm/mach-imx/pm-imx6.c
++++ b/arch/arm/mach-imx/pm-imx6.c
+@@ -497,14 +497,14 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata)
+ if (!ocram_pool) {
+ pr_warn("%s: ocram pool unavailable!\n", __func__);
+ ret = -ENODEV;
+- goto put_node;
++ goto put_device;
+ }
+
+ ocram_base = gen_pool_alloc(ocram_pool, MX6Q_SUSPEND_OCRAM_SIZE);
+ if (!ocram_base) {
+ pr_warn("%s: unable to alloc ocram!\n", __func__);
+ ret = -ENOMEM;
+- goto put_node;
++ goto put_device;
+ }
+
+ ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base);
+@@ -527,7 +527,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata)
+ ret = imx6_pm_get_base(&pm_info->mmdc_base, socdata->mmdc_compat);
+ if (ret) {
+ pr_warn("%s: failed to get mmdc base %d!\n", __func__, ret);
+- goto put_node;
++ goto put_device;
+ }
+
+ ret = imx6_pm_get_base(&pm_info->src_base, socdata->src_compat);
+@@ -574,7 +574,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata)
+ &imx6_suspend,
+ MX6Q_SUSPEND_OCRAM_SIZE - sizeof(*pm_info));
+
+- goto put_node;
++ goto put_device;
+
+ pl310_cache_map_failed:
+ iounmap(pm_info->gpc_base.vbase);
+@@ -584,6 +584,8 @@ iomuxc_map_failed:
+ iounmap(pm_info->src_base.vbase);
+ src_map_failed:
+ iounmap(pm_info->mmdc_base.vbase);
++put_device:
++ put_device(&pdev->dev);
+ put_node:
+ of_node_put(node);
+
+diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h
+index 5be015e2133a..af547be1779b 100644
+--- a/arch/arm64/include/asm/pgtable-prot.h
++++ b/arch/arm64/include/asm/pgtable-prot.h
+@@ -65,7 +65,7 @@
+ #define PAGE_HYP __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_HYP_XN)
+ #define PAGE_HYP_EXEC __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_RDONLY)
+ #define PAGE_HYP_RO __pgprot(_HYP_PAGE_DEFAULT | PTE_HYP | PTE_RDONLY | PTE_HYP_XN)
+-#define PAGE_HYP_DEVICE __pgprot(PROT_DEVICE_nGnRE | PTE_HYP)
++#define PAGE_HYP_DEVICE __pgprot(_PROT_DEFAULT | PTE_ATTRINDX(MT_DEVICE_nGnRE) | PTE_HYP | PTE_HYP_XN)
+
+ #define PAGE_S2_MEMATTR(attr) \
+ ({ \
+diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
+index 35f184a8fd85..8815b5457dd0 100644
+--- a/arch/arm64/kernel/kgdb.c
++++ b/arch/arm64/kernel/kgdb.c
+@@ -269,7 +269,7 @@ static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr)
+ if (user_mode(regs) || !kgdb_single_step)
+ return DBG_HOOK_ERROR;
+
+- kgdb_handle_exception(1, SIGTRAP, 0, regs);
++ kgdb_handle_exception(0, SIGTRAP, 0, regs);
+ return DBG_HOOK_HANDLED;
+ }
+ NOKPROBE_SYMBOL(kgdb_step_brk_fn);
+diff --git a/arch/arm64/kvm/hyp-init.S b/arch/arm64/kvm/hyp-init.S
+index ea9225160786..6ef670f189bc 100644
+--- a/arch/arm64/kvm/hyp-init.S
++++ b/arch/arm64/kvm/hyp-init.S
+@@ -144,11 +144,15 @@ ENTRY(__kvm_handle_stub_hvc)
+
+ 1: cmp x0, #HVC_RESET_VECTORS
+ b.ne 1f
+-reset:
++
+ /*
+- * Reset kvm back to the hyp stub. Do not clobber x0-x4 in
+- * case we coming via HVC_SOFT_RESTART.
++ * Set the HVC_RESET_VECTORS return code before entering the common
++ * path so that we do not clobber x0-x2 in case we are coming via
++ * HVC_SOFT_RESTART.
+ */
++ mov x0, xzr
++reset:
++ /* Reset kvm back to the hyp stub. */
+ mrs x5, sctlr_el2
+ ldr x6, =SCTLR_ELx_FLAGS
+ bic x5, x5, x6 // Clear SCTL_M and etc
+@@ -159,7 +163,6 @@ reset:
+ /* Install stub vectors */
+ adr_l x5, __hyp_stub_vectors
+ msr vbar_el2, x5
+- mov x0, xzr
+ eret
+
+ 1: /* Bad stub call */
+diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
+index dad110e9f41b..be8fa30a6ea6 100644
+--- a/arch/s390/include/asm/kvm_host.h
++++ b/arch/s390/include/asm/kvm_host.h
+@@ -30,12 +30,12 @@
+ #define KVM_USER_MEM_SLOTS 32
+
+ /*
+- * These seem to be used for allocating ->chip in the routing table,
+- * which we don't use. 4096 is an out-of-thin-air value. If we need
+- * to look at ->chip later on, we'll need to revisit this.
++ * These seem to be used for allocating ->chip in the routing table, which we
++ * don't use. 1 is as small as we can get to reduce the needed memory. If we
++ * need to look at ->chip later on, we'll need to revisit this.
+ */
+ #define KVM_NR_IRQCHIPS 1
+-#define KVM_IRQCHIP_NUM_PINS 4096
++#define KVM_IRQCHIP_NUM_PINS 1
+ #define KVM_HALT_POLL_NS_DEFAULT 80000
+
+ /* s390-specific vcpu->requests bit members */
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index e7e6608b996c..ad88bed74395 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -155,6 +155,8 @@ static noinline __init void setup_lowcore_early(void)
+ psw_t psw;
+
+ psw.mask = PSW_MASK_BASE | PSW_DEFAULT_KEY | PSW_MASK_EA | PSW_MASK_BA;
++ if (IS_ENABLED(CONFIG_KASAN))
++ psw.mask |= PSW_MASK_DAT;
+ psw.addr = (unsigned long) s390_base_ext_handler;
+ S390_lowcore.external_new_psw = psw;
+ psw.addr = (unsigned long) s390_base_pgm_handler;
+diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
+index 7dfae86afa47..ff8234bca56c 100644
+--- a/arch/s390/mm/hugetlbpage.c
++++ b/arch/s390/mm/hugetlbpage.c
+@@ -117,7 +117,7 @@ static inline pte_t __rste_to_pte(unsigned long rste)
+ _PAGE_YOUNG);
+ #ifdef CONFIG_MEM_SOFT_DIRTY
+ pte_val(pte) |= move_set_bit(rste, _SEGMENT_ENTRY_SOFT_DIRTY,
+- _PAGE_DIRTY);
++ _PAGE_SOFT_DIRTY);
+ #endif
+ pte_val(pte) |= move_set_bit(rste, _SEGMENT_ENTRY_NOEXEC,
+ _PAGE_NOEXEC);
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index efb44bd3a714..0f750e7b2407 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -336,7 +336,7 @@ struct x86_hw_tss {
+ #define INVALID_IO_BITMAP_OFFSET 0x8000
+
+ struct entry_stack {
+- unsigned long words[64];
++ char stack[PAGE_SIZE];
+ };
+
+ struct entry_stack_page {
+diff --git a/arch/x86/kvm/kvm_cache_regs.h b/arch/x86/kvm/kvm_cache_regs.h
+index 9619dcc2b325..7df600410d69 100644
+--- a/arch/x86/kvm/kvm_cache_regs.h
++++ b/arch/x86/kvm/kvm_cache_regs.h
+@@ -5,7 +5,7 @@
+ #define KVM_POSSIBLE_CR0_GUEST_BITS X86_CR0_TS
+ #define KVM_POSSIBLE_CR4_GUEST_BITS \
+ (X86_CR4_PVI | X86_CR4_DE | X86_CR4_PCE | X86_CR4_OSFXSR \
+- | X86_CR4_OSXMMEXCPT | X86_CR4_LA57 | X86_CR4_PGE)
++ | X86_CR4_OSXMMEXCPT | X86_CR4_LA57 | X86_CR4_PGE | X86_CR4_TSD)
+
+ static inline unsigned long kvm_register_read(struct kvm_vcpu *vcpu,
+ enum kvm_reg reg)
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 712bc103ef3a..92ff656e1810 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -4474,7 +4474,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
+ nonleaf_bit8_rsvd | rsvd_bits(7, 7) |
+ rsvd_bits(maxphyaddr, 51);
+ rsvd_check->rsvd_bits_mask[0][2] = exb_bit_rsvd |
+- nonleaf_bit8_rsvd | gbpages_bit_rsvd |
++ gbpages_bit_rsvd |
+ rsvd_bits(maxphyaddr, 51);
+ rsvd_check->rsvd_bits_mask[0][1] = exb_bit_rsvd |
+ rsvd_bits(maxphyaddr, 51);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index f90a9d4d1641..2f823f35dee5 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6335,6 +6335,8 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+
+ static void set_cr4_guest_host_mask(struct vcpu_vmx *vmx)
+ {
++ BUILD_BUG_ON(KVM_CR4_GUEST_OWNED_BITS & ~KVM_POSSIBLE_CR4_GUEST_BITS);
++
+ vmx->vcpu.arch.cr4_guest_owned_bits = KVM_CR4_GUEST_OWNED_BITS;
+ if (enable_ept)
+ vmx->vcpu.arch.cr4_guest_owned_bits |= X86_CR4_PGE;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 0aa5c4134b90..5b2440e591fc 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -865,6 +865,8 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ if (is_long_mode(vcpu)) {
+ if (!(cr4 & X86_CR4_PAE))
+ return 1;
++ if ((cr4 ^ old_cr4) & X86_CR4_LA57)
++ return 1;
+ } else if (is_paging(vcpu) && (cr4 & X86_CR4_PAE)
+ && ((cr4 ^ old_cr4) & pdptr_bits)
+ && !load_pdptrs(vcpu, vcpu->arch.walk_mmu,
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index a059fad53f1b..0b96220d0efd 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -38,6 +38,18 @@ void blk_flush_integrity(void)
+ flush_workqueue(kintegrityd_wq);
+ }
+
++void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip)
++{
++ if (bs && mempool_initialized(&bs->bio_integrity_pool)) {
++ if (bip->bip_vec)
++ bvec_free(&bs->bvec_integrity_pool, bip->bip_vec,
++ bip->bip_slab);
++ mempool_free(bip, &bs->bio_integrity_pool);
++ } else {
++ kfree(bip);
++ }
++}
++
+ /**
+ * bio_integrity_alloc - Allocate integrity payload and attach it to bio
+ * @bio: bio to attach integrity metadata to
+@@ -90,7 +102,7 @@ struct bio_integrity_payload *bio_integrity_alloc(struct bio *bio,
+
+ return bip;
+ err:
+- mempool_free(bip, &bs->bio_integrity_pool);
++ __bio_integrity_free(bs, bip);
+ return ERR_PTR(-ENOMEM);
+ }
+ EXPORT_SYMBOL(bio_integrity_alloc);
+@@ -111,14 +123,7 @@ static void bio_integrity_free(struct bio *bio)
+ kfree(page_address(bip->bip_vec->bv_page) +
+ bip->bip_vec->bv_offset);
+
+- if (bs && mempool_initialized(&bs->bio_integrity_pool)) {
+- bvec_free(&bs->bvec_integrity_pool, bip->bip_vec, bip->bip_slab);
+-
+- mempool_free(bip, &bs->bio_integrity_pool);
+- } else {
+- kfree(bip);
+- }
+-
++ __bio_integrity_free(bs, bip);
+ bio->bi_integrity = NULL;
+ bio->bi_opf &= ~REQ_INTEGRITY;
+ }
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index b38b2d8c333d..c7d946b745ef 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -21,6 +21,7 @@
+ #include <linux/delay.h>
+ #include <linux/log2.h>
+ #include <linux/hwspinlock.h>
++#include <asm/unaligned.h>
+
+ #define CREATE_TRACE_POINTS
+ #include "trace.h"
+@@ -232,22 +233,20 @@ static void regmap_format_8(void *buf, unsigned int val, unsigned int shift)
+
+ static void regmap_format_16_be(void *buf, unsigned int val, unsigned int shift)
+ {
+- __be16 *b = buf;
+-
+- b[0] = cpu_to_be16(val << shift);
++ put_unaligned_be16(val << shift, buf);
+ }
+
+ static void regmap_format_16_le(void *buf, unsigned int val, unsigned int shift)
+ {
+- __le16 *b = buf;
+-
+- b[0] = cpu_to_le16(val << shift);
++ put_unaligned_le16(val << shift, buf);
+ }
+
+ static void regmap_format_16_native(void *buf, unsigned int val,
+ unsigned int shift)
+ {
+- *(u16 *)buf = val << shift;
++ u16 v = val << shift;
++
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static void regmap_format_24(void *buf, unsigned int val, unsigned int shift)
+@@ -263,43 +262,39 @@ static void regmap_format_24(void *buf, unsigned int val, unsigned int shift)
+
+ static void regmap_format_32_be(void *buf, unsigned int val, unsigned int shift)
+ {
+- __be32 *b = buf;
+-
+- b[0] = cpu_to_be32(val << shift);
++ put_unaligned_be32(val << shift, buf);
+ }
+
+ static void regmap_format_32_le(void *buf, unsigned int val, unsigned int shift)
+ {
+- __le32 *b = buf;
+-
+- b[0] = cpu_to_le32(val << shift);
++ put_unaligned_le32(val << shift, buf);
+ }
+
+ static void regmap_format_32_native(void *buf, unsigned int val,
+ unsigned int shift)
+ {
+- *(u32 *)buf = val << shift;
++ u32 v = val << shift;
++
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ #ifdef CONFIG_64BIT
+ static void regmap_format_64_be(void *buf, unsigned int val, unsigned int shift)
+ {
+- __be64 *b = buf;
+-
+- b[0] = cpu_to_be64((u64)val << shift);
++ put_unaligned_be64((u64) val << shift, buf);
+ }
+
+ static void regmap_format_64_le(void *buf, unsigned int val, unsigned int shift)
+ {
+- __le64 *b = buf;
+-
+- b[0] = cpu_to_le64((u64)val << shift);
++ put_unaligned_le64((u64) val << shift, buf);
+ }
+
+ static void regmap_format_64_native(void *buf, unsigned int val,
+ unsigned int shift)
+ {
+- *(u64 *)buf = (u64)val << shift;
++ u64 v = (u64) val << shift;
++
++ memcpy(buf, &v, sizeof(v));
+ }
+ #endif
+
+@@ -316,35 +311,34 @@ static unsigned int regmap_parse_8(const void *buf)
+
+ static unsigned int regmap_parse_16_be(const void *buf)
+ {
+- const __be16 *b = buf;
+-
+- return be16_to_cpu(b[0]);
++ return get_unaligned_be16(buf);
+ }
+
+ static unsigned int regmap_parse_16_le(const void *buf)
+ {
+- const __le16 *b = buf;
+-
+- return le16_to_cpu(b[0]);
++ return get_unaligned_le16(buf);
+ }
+
+ static void regmap_parse_16_be_inplace(void *buf)
+ {
+- __be16 *b = buf;
++ u16 v = get_unaligned_be16(buf);
+
+- b[0] = be16_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static void regmap_parse_16_le_inplace(void *buf)
+ {
+- __le16 *b = buf;
++ u16 v = get_unaligned_le16(buf);
+
+- b[0] = le16_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static unsigned int regmap_parse_16_native(const void *buf)
+ {
+- return *(u16 *)buf;
++ u16 v;
++
++ memcpy(&v, buf, sizeof(v));
++ return v;
+ }
+
+ static unsigned int regmap_parse_24(const void *buf)
+@@ -359,69 +353,67 @@ static unsigned int regmap_parse_24(const void *buf)
+
+ static unsigned int regmap_parse_32_be(const void *buf)
+ {
+- const __be32 *b = buf;
+-
+- return be32_to_cpu(b[0]);
++ return get_unaligned_be32(buf);
+ }
+
+ static unsigned int regmap_parse_32_le(const void *buf)
+ {
+- const __le32 *b = buf;
+-
+- return le32_to_cpu(b[0]);
++ return get_unaligned_le32(buf);
+ }
+
+ static void regmap_parse_32_be_inplace(void *buf)
+ {
+- __be32 *b = buf;
++ u32 v = get_unaligned_be32(buf);
+
+- b[0] = be32_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static void regmap_parse_32_le_inplace(void *buf)
+ {
+- __le32 *b = buf;
++ u32 v = get_unaligned_le32(buf);
+
+- b[0] = le32_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static unsigned int regmap_parse_32_native(const void *buf)
+ {
+- return *(u32 *)buf;
++ u32 v;
++
++ memcpy(&v, buf, sizeof(v));
++ return v;
+ }
+
+ #ifdef CONFIG_64BIT
+ static unsigned int regmap_parse_64_be(const void *buf)
+ {
+- const __be64 *b = buf;
+-
+- return be64_to_cpu(b[0]);
++ return get_unaligned_be64(buf);
+ }
+
+ static unsigned int regmap_parse_64_le(const void *buf)
+ {
+- const __le64 *b = buf;
+-
+- return le64_to_cpu(b[0]);
++ return get_unaligned_le64(buf);
+ }
+
+ static void regmap_parse_64_be_inplace(void *buf)
+ {
+- __be64 *b = buf;
++ u64 v = get_unaligned_be64(buf);
+
+- b[0] = be64_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static void regmap_parse_64_le_inplace(void *buf)
+ {
+- __le64 *b = buf;
++ u64 v = get_unaligned_le64(buf);
+
+- b[0] = le64_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static unsigned int regmap_parse_64_native(const void *buf)
+ {
+- return *(u64 *)buf;
++ u64 v;
++
++ memcpy(&v, buf, sizeof(v));
++ return v;
+ }
+ #endif
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 226103af30f0..d7c7232e438c 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -974,25 +974,26 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+ test_bit(NBD_BOUND, &config->runtime_flags))) {
+ dev_err(disk_to_dev(nbd->disk),
+ "Device being setup by another task");
+- sockfd_put(sock);
+- return -EBUSY;
++ err = -EBUSY;
++ goto put_socket;
++ }
++
++ nsock = kzalloc(sizeof(*nsock), GFP_KERNEL);
++ if (!nsock) {
++ err = -ENOMEM;
++ goto put_socket;
+ }
+
+ socks = krealloc(config->socks, (config->num_connections + 1) *
+ sizeof(struct nbd_sock *), GFP_KERNEL);
+ if (!socks) {
+- sockfd_put(sock);
+- return -ENOMEM;
++ kfree(nsock);
++ err = -ENOMEM;
++ goto put_socket;
+ }
+
+ config->socks = socks;
+
+- nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL);
+- if (!nsock) {
+- sockfd_put(sock);
+- return -ENOMEM;
+- }
+-
+ nsock->fallback_index = -1;
+ nsock->dead = false;
+ mutex_init(&nsock->tx_lock);
+@@ -1004,6 +1005,10 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+ atomic_inc(&config->live_connections);
+
+ return 0;
++
++put_socket:
++ sockfd_put(sock);
++ return err;
+ }
+
+ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg)
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index cc354b491774..fa5c25d36d3d 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -30,12 +30,6 @@ struct drm_dmi_panel_orientation_data {
+ int orientation;
+ };
+
+-static const struct drm_dmi_panel_orientation_data acer_s1003 = {
+- .width = 800,
+- .height = 1280,
+- .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+-};
+-
+ static const struct drm_dmi_panel_orientation_data asus_t100ha = {
+ .width = 800,
+ .height = 1280,
+@@ -100,13 +94,19 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"),
+ },
+- .driver_data = (void *)&acer_s1003,
++ .driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* Asus T100HA */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"),
+ },
+ .driver_data = (void *)&asus_t100ha,
++ }, { /* Asus T101HA */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"),
++ },
++ .driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* GPD MicroPC (generic strings, also match on bios date) */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_plane.c b/drivers/gpu/drm/mediatek/mtk_drm_plane.c
+index f7e6aa1b5b7d..83d4a710601d 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_plane.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_plane.c
+@@ -108,6 +108,16 @@ static int mtk_plane_atomic_check(struct drm_plane *plane,
+ true, true);
+ }
+
++static void mtk_plane_atomic_disable(struct drm_plane *plane,
++ struct drm_plane_state *old_state)
++{
++ struct mtk_plane_state *state = to_mtk_plane_state(plane->state);
++
++ state->pending.enable = false;
++ wmb(); /* Make sure the above parameter is set before update */
++ state->pending.dirty = true;
++}
++
+ static void mtk_plane_atomic_update(struct drm_plane *plane,
+ struct drm_plane_state *old_state)
+ {
+@@ -122,6 +132,11 @@ static void mtk_plane_atomic_update(struct drm_plane *plane,
+ if (!crtc || WARN_ON(!fb))
+ return;
+
++ if (!plane->state->visible) {
++ mtk_plane_atomic_disable(plane, old_state);
++ return;
++ }
++
+ gem = fb->obj[0];
+ mtk_gem = to_mtk_gem_obj(gem);
+ addr = mtk_gem->dma_addr;
+@@ -143,16 +158,6 @@ static void mtk_plane_atomic_update(struct drm_plane *plane,
+ state->pending.dirty = true;
+ }
+
+-static void mtk_plane_atomic_disable(struct drm_plane *plane,
+- struct drm_plane_state *old_state)
+-{
+- struct mtk_plane_state *state = to_mtk_plane_state(plane->state);
+-
+- state->pending.enable = false;
+- wmb(); /* Make sure the above parameter is set before update */
+- state->pending.dirty = true;
+-}
+-
+ static const struct drm_plane_helper_funcs mtk_plane_helper_funcs = {
+ .atomic_check = mtk_plane_atomic_check,
+ .atomic_update = mtk_plane_atomic_update,
+diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
+index a97294ac96d5..9e7d5e44a12f 100644
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -5574,6 +5574,7 @@ static int ci_parse_power_table(struct radeon_device *rdev)
+ if (!rdev->pm.dpm.ps)
+ return -ENOMEM;
+ power_state_offset = (u8 *)state_array->states;
++ rdev->pm.dpm.num_ps = 0;
+ for (i = 0; i < state_array->ucNumEntries; i++) {
+ u8 *idx;
+ power_state = (union pplib_power_state *)power_state_offset;
+@@ -5583,10 +5584,8 @@ static int ci_parse_power_table(struct radeon_device *rdev)
+ if (!rdev->pm.power_state[i].clock_info)
+ return -EINVAL;
+ ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL);
+- if (ps == NULL) {
+- kfree(rdev->pm.dpm.ps);
++ if (ps == NULL)
+ return -ENOMEM;
+- }
+ rdev->pm.dpm.ps[i].ps_priv = ps;
+ ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i],
+ non_clock_info,
+@@ -5608,8 +5607,8 @@ static int ci_parse_power_table(struct radeon_device *rdev)
+ k++;
+ }
+ power_state_offset += 2 + power_state->v2.ucNumDPMLevels;
++ rdev->pm.dpm.num_ps = i + 1;
+ }
+- rdev->pm.dpm.num_ps = state_array->ucNumEntries;
+
+ /* fill in the vce power states */
+ for (i = 0; i < RADEON_MAX_VCE_LEVELS; i++) {
+diff --git a/drivers/gpu/drm/tegra/hub.c b/drivers/gpu/drm/tegra/hub.c
+index bb97cad1eb69..b08ce1125996 100644
+--- a/drivers/gpu/drm/tegra/hub.c
++++ b/drivers/gpu/drm/tegra/hub.c
+@@ -143,7 +143,9 @@ int tegra_display_hub_prepare(struct tegra_display_hub *hub)
+ for (i = 0; i < hub->soc->num_wgrps; i++) {
+ struct tegra_windowgroup *wgrp = &hub->wgrps[i];
+
+- tegra_windowgroup_enable(wgrp);
++ /* Skip orphaned window group whose parent DC is disabled */
++ if (wgrp->parent)
++ tegra_windowgroup_enable(wgrp);
+ }
+
+ return 0;
+@@ -160,7 +162,9 @@ void tegra_display_hub_cleanup(struct tegra_display_hub *hub)
+ for (i = 0; i < hub->soc->num_wgrps; i++) {
+ struct tegra_windowgroup *wgrp = &hub->wgrps[i];
+
+- tegra_windowgroup_disable(wgrp);
++ /* Skip orphaned window group whose parent DC is disabled */
++ if (wgrp->parent)
++ tegra_windowgroup_disable(wgrp);
+ }
+ }
+
+diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
+index 0121fe7a4548..02f896b50ed0 100644
+--- a/drivers/gpu/host1x/bus.c
++++ b/drivers/gpu/host1x/bus.c
+@@ -632,8 +632,17 @@ EXPORT_SYMBOL(host1x_driver_register_full);
+ */
+ void host1x_driver_unregister(struct host1x_driver *driver)
+ {
++ struct host1x *host1x;
++
+ driver_unregister(&driver->driver);
+
++ mutex_lock(&devices_lock);
++
++ list_for_each_entry(host1x, &devices, list)
++ host1x_detach_driver(host1x, driver);
++
++ mutex_unlock(&devices_lock);
++
+ mutex_lock(&drivers_lock);
+ list_del_init(&driver->list);
+ mutex_unlock(&drivers_lock);
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 43643151584a..afc9f8406dce 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -12,6 +12,7 @@
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/mutex.h>
++#include <linux/sched/mm.h>
+ #include <linux/sched/signal.h>
+ #include <linux/blkpg.h>
+ #include <linux/bio.h>
+@@ -2853,17 +2854,25 @@ EXPORT_SYMBOL_GPL(dm_internal_resume_fast);
+ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+ unsigned cookie)
+ {
++ int r;
++ unsigned noio_flag;
+ char udev_cookie[DM_COOKIE_LENGTH];
+ char *envp[] = { udev_cookie, NULL };
+
++ noio_flag = memalloc_noio_save();
++
+ if (!cookie)
+- return kobject_uevent(&disk_to_dev(md->disk)->kobj, action);
++ r = kobject_uevent(&disk_to_dev(md->disk)->kobj, action);
+ else {
+ snprintf(udev_cookie, DM_COOKIE_LENGTH, "%s=%u",
+ DM_COOKIE_ENV_VAR_NAME, cookie);
+- return kobject_uevent_env(&disk_to_dev(md->disk)->kobj,
+- action, envp);
++ r = kobject_uevent_env(&disk_to_dev(md->disk)->kobj,
++ action, envp);
+ }
++
++ memalloc_noio_restore(noio_flag);
++
++ return r;
+ }
+
+ uint32_t dm_next_uevent_seq(struct mapped_device *md)
+diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
+index 6ba07c7feb92..2af7ae13449d 100644
+--- a/drivers/message/fusion/mptscsih.c
++++ b/drivers/message/fusion/mptscsih.c
+@@ -118,8 +118,6 @@ int mptscsih_suspend(struct pci_dev *pdev, pm_message_t state);
+ int mptscsih_resume(struct pci_dev *pdev);
+ #endif
+
+-#define SNS_LEN(scp) SCSI_SENSE_BUFFERSIZE
+-
+
+ /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+ /*
+@@ -2420,7 +2418,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
+ /* Copy the sense received into the scsi command block. */
+ req_index = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
+ sense_data = ((u8 *)ioc->sense_buf_pool + (req_index * MPT_SENSE_BUFFER_ALLOC));
+- memcpy(sc->sense_buffer, sense_data, SNS_LEN(sc));
++ memcpy(sc->sense_buffer, sense_data, MPT_SENSE_BUFFER_ALLOC);
+
+ /* Log SMART data (asc = 0x5D, non-IM case only) if required.
+ */
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+index bba6f09279d5..ff53e597938a 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+@@ -365,6 +365,7 @@ static void bnxt_free_vf_resources(struct bnxt *bp)
+ }
+ }
+
++ bp->pf.active_vfs = 0;
+ kfree(bp->pf.vf);
+ bp->pf.vf = NULL;
+ }
+@@ -750,7 +751,6 @@ void bnxt_sriov_disable(struct bnxt *bp)
+
+ bnxt_free_vf_resources(bp);
+
+- bp->pf.active_vfs = 0;
+ /* Reclaim all resources for the PF. */
+ rtnl_lock();
+ bnxt_restore_pf_fw_resources(bp);
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index d1ff317f3b18..acae87f548a1 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -4060,7 +4060,7 @@ static int macb_probe(struct platform_device *pdev)
+ bp->wol = 0;
+ if (of_get_property(np, "magic-packet", NULL))
+ bp->wol |= MACB_WOL_HAS_MAGIC_PACKET;
+- device_init_wakeup(&pdev->dev, bp->wol & MACB_WOL_HAS_MAGIC_PACKET);
++ device_set_wakeup_capable(&pdev->dev, bp->wol & MACB_WOL_HAS_MAGIC_PACKET);
+
+ spin_lock_init(&bp->lock);
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+index 86745f33a252..97d97de9accc 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+@@ -810,16 +810,16 @@ static bool is_addr_all_mask(u8 *ipmask, int family)
+ struct in_addr *addr;
+
+ addr = (struct in_addr *)ipmask;
+- if (ntohl(addr->s_addr) == 0xffffffff)
++ if (addr->s_addr == htonl(0xffffffff))
+ return true;
+ } else if (family == AF_INET6) {
+ struct in6_addr *addr6;
+
+ addr6 = (struct in6_addr *)ipmask;
+- if (ntohl(addr6->s6_addr32[0]) == 0xffffffff &&
+- ntohl(addr6->s6_addr32[1]) == 0xffffffff &&
+- ntohl(addr6->s6_addr32[2]) == 0xffffffff &&
+- ntohl(addr6->s6_addr32[3]) == 0xffffffff)
++ if (addr6->s6_addr32[0] == htonl(0xffffffff) &&
++ addr6->s6_addr32[1] == htonl(0xffffffff) &&
++ addr6->s6_addr32[2] == htonl(0xffffffff) &&
++ addr6->s6_addr32[3] == htonl(0xffffffff))
+ return true;
+ }
+ return false;
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index 5934ec9b6a31..abc2a66754bd 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -3499,7 +3499,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
+ drv_fw = &fw_info->fw_hdr;
+
+ /* Read the header of the firmware on the card */
+- ret = -t4_read_flash(adap, FLASH_FW_START,
++ ret = t4_read_flash(adap, FLASH_FW_START,
+ sizeof(*card_fw) / sizeof(uint32_t),
+ (uint32_t *)card_fw, 1);
+ if (ret == 0) {
+@@ -3528,8 +3528,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
+ should_install_fs_fw(adap, card_fw_usable,
+ be32_to_cpu(fs_fw->fw_ver),
+ be32_to_cpu(card_fw->fw_ver))) {
+- ret = -t4_fw_upgrade(adap, adap->mbox, fw_data,
+- fw_size, 0);
++ ret = t4_fw_upgrade(adap, adap->mbox, fw_data,
++ fw_size, 0);
+ if (ret != 0) {
+ dev_err(adap->pdev_dev,
+ "failed to install firmware: %d\n", ret);
+@@ -3560,7 +3560,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
+ FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c),
+ FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k),
+ FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k));
+- ret = EINVAL;
++ ret = -EINVAL;
+ goto bye;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+index 0c34ea122358..1cb6f95f3a94 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+@@ -151,18 +151,21 @@ static void hns3_lb_check_skb_data(struct hns3_enet_ring *ring,
+ {
+ struct hns3_enet_tqp_vector *tqp_vector = ring->tqp_vector;
+ unsigned char *packet = skb->data;
++ u32 len = skb_headlen(skb);
+ u32 i;
+
+- for (i = 0; i < skb->len; i++)
++ len = min_t(u32, len, HNS3_NIC_LB_TEST_PACKET_SIZE);
++
++ for (i = 0; i < len; i++)
+ if (packet[i] != (unsigned char)(i & 0xff))
+ break;
+
+ /* The packet is correctly received */
+- if (i == skb->len)
++ if (i == HNS3_NIC_LB_TEST_PACKET_SIZE)
+ tqp_vector->rx_group.total_packets++;
+ else
+ print_hex_dump(KERN_ERR, "selftest:", DUMP_PREFIX_OFFSET, 16, 1,
+- skb->data, skb->len, true);
++ skb->data, len, true);
+
+ dev_kfree_skb_any(skb);
+ }
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 23b31b2ff5cc..a74b01bf581e 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -446,11 +446,15 @@ static void i40e_get_netdev_stats_struct(struct net_device *netdev,
+ i40e_get_netdev_stats_struct_tx(ring, stats);
+
+ if (i40e_enabled_xdp_vsi(vsi)) {
+- ring++;
++ ring = READ_ONCE(vsi->xdp_rings[i]);
++ if (!ring)
++ continue;
+ i40e_get_netdev_stats_struct_tx(ring, stats);
+ }
+
+- ring++;
++ ring = READ_ONCE(vsi->rx_rings[i]);
++ if (!ring)
++ continue;
+ do {
+ start = u64_stats_fetch_begin_irq(&ring->syncp);
+ packets = ring->stats.packets;
+@@ -793,6 +797,8 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi)
+ for (q = 0; q < vsi->num_queue_pairs; q++) {
+ /* locate Tx ring */
+ p = READ_ONCE(vsi->tx_rings[q]);
++ if (!p)
++ continue;
+
+ do {
+ start = u64_stats_fetch_begin_irq(&p->syncp);
+@@ -806,8 +812,11 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi)
+ tx_linearize += p->tx_stats.tx_linearize;
+ tx_force_wb += p->tx_stats.tx_force_wb;
+
+- /* Rx queue is part of the same block as Tx queue */
+- p = &p[1];
++ /* locate Rx ring */
++ p = READ_ONCE(vsi->rx_rings[q]);
++ if (!p)
++ continue;
++
+ do {
+ start = u64_stats_fetch_begin_irq(&p->syncp);
+ packets = p->stats.packets;
+@@ -10196,10 +10205,10 @@ static void i40e_vsi_clear_rings(struct i40e_vsi *vsi)
+ if (vsi->tx_rings && vsi->tx_rings[0]) {
+ for (i = 0; i < vsi->alloc_queue_pairs; i++) {
+ kfree_rcu(vsi->tx_rings[i], rcu);
+- vsi->tx_rings[i] = NULL;
+- vsi->rx_rings[i] = NULL;
++ WRITE_ONCE(vsi->tx_rings[i], NULL);
++ WRITE_ONCE(vsi->rx_rings[i], NULL);
+ if (vsi->xdp_rings)
+- vsi->xdp_rings[i] = NULL;
++ WRITE_ONCE(vsi->xdp_rings[i], NULL);
+ }
+ }
+ }
+@@ -10233,7 +10242,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi)
+ if (vsi->back->hw_features & I40E_HW_WB_ON_ITR_CAPABLE)
+ ring->flags = I40E_TXR_FLAGS_WB_ON_ITR;
+ ring->itr_setting = pf->tx_itr_default;
+- vsi->tx_rings[i] = ring++;
++ WRITE_ONCE(vsi->tx_rings[i], ring++);
+
+ if (!i40e_enabled_xdp_vsi(vsi))
+ goto setup_rx;
+@@ -10251,7 +10260,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi)
+ ring->flags = I40E_TXR_FLAGS_WB_ON_ITR;
+ set_ring_xdp(ring);
+ ring->itr_setting = pf->tx_itr_default;
+- vsi->xdp_rings[i] = ring++;
++ WRITE_ONCE(vsi->xdp_rings[i], ring++);
+
+ setup_rx:
+ ring->queue_index = i;
+@@ -10264,7 +10273,7 @@ setup_rx:
+ ring->size = 0;
+ ring->dcb_tc = 0;
+ ring->itr_setting = pf->rx_itr_default;
+- vsi->rx_rings[i] = ring;
++ WRITE_ONCE(vsi->rx_rings[i], ring);
+ }
+
+ return 0;
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+index d361f570ca37..952630cb882c 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+@@ -923,7 +923,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter,
+ ring->queue_index = txr_idx;
+
+ /* assign ring to adapter */
+- adapter->tx_ring[txr_idx] = ring;
++ WRITE_ONCE(adapter->tx_ring[txr_idx], ring);
+
+ /* update count and index */
+ txr_count--;
+@@ -950,7 +950,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter,
+ set_ring_xdp(ring);
+
+ /* assign ring to adapter */
+- adapter->xdp_ring[xdp_idx] = ring;
++ WRITE_ONCE(adapter->xdp_ring[xdp_idx], ring);
+
+ /* update count and index */
+ xdp_count--;
+@@ -993,7 +993,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter,
+ ring->queue_index = rxr_idx;
+
+ /* assign ring to adapter */
+- adapter->rx_ring[rxr_idx] = ring;
++ WRITE_ONCE(adapter->rx_ring[rxr_idx], ring);
+
+ /* update count and index */
+ rxr_count--;
+@@ -1022,13 +1022,13 @@ static void ixgbe_free_q_vector(struct ixgbe_adapter *adapter, int v_idx)
+
+ ixgbe_for_each_ring(ring, q_vector->tx) {
+ if (ring_is_xdp(ring))
+- adapter->xdp_ring[ring->queue_index] = NULL;
++ WRITE_ONCE(adapter->xdp_ring[ring->queue_index], NULL);
+ else
+- adapter->tx_ring[ring->queue_index] = NULL;
++ WRITE_ONCE(adapter->tx_ring[ring->queue_index], NULL);
+ }
+
+ ixgbe_for_each_ring(ring, q_vector->rx)
+- adapter->rx_ring[ring->queue_index] = NULL;
++ WRITE_ONCE(adapter->rx_ring[ring->queue_index], NULL);
+
+ adapter->q_vector[v_idx] = NULL;
+ napi_hash_del(&q_vector->napi);
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 7d723b70fcf6..4243ff4ec4b1 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -7005,7 +7005,10 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
+ }
+
+ for (i = 0; i < adapter->num_rx_queues; i++) {
+- struct ixgbe_ring *rx_ring = adapter->rx_ring[i];
++ struct ixgbe_ring *rx_ring = READ_ONCE(adapter->rx_ring[i]);
++
++ if (!rx_ring)
++ continue;
+ non_eop_descs += rx_ring->rx_stats.non_eop_descs;
+ alloc_rx_page += rx_ring->rx_stats.alloc_rx_page;
+ alloc_rx_page_failed += rx_ring->rx_stats.alloc_rx_page_failed;
+@@ -7026,15 +7029,20 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
+ packets = 0;
+ /* gather some stats to the adapter struct that are per queue */
+ for (i = 0; i < adapter->num_tx_queues; i++) {
+- struct ixgbe_ring *tx_ring = adapter->tx_ring[i];
++ struct ixgbe_ring *tx_ring = READ_ONCE(adapter->tx_ring[i]);
++
++ if (!tx_ring)
++ continue;
+ restart_queue += tx_ring->tx_stats.restart_queue;
+ tx_busy += tx_ring->tx_stats.tx_busy;
+ bytes += tx_ring->stats.bytes;
+ packets += tx_ring->stats.packets;
+ }
+ for (i = 0; i < adapter->num_xdp_queues; i++) {
+- struct ixgbe_ring *xdp_ring = adapter->xdp_ring[i];
++ struct ixgbe_ring *xdp_ring = READ_ONCE(adapter->xdp_ring[i]);
+
++ if (!xdp_ring)
++ continue;
+ restart_queue += xdp_ring->tx_stats.restart_queue;
+ tx_busy += xdp_ring->tx_stats.tx_busy;
+ bytes += xdp_ring->stats.bytes;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+index 76960d3adfc0..93d662de106e 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -5982,7 +5982,7 @@ static int mlxsw_sp_router_fib_event(struct notifier_block *nb,
+ }
+
+ fib_work = kzalloc(sizeof(*fib_work), GFP_ATOMIC);
+- if (WARN_ON(!fib_work))
++ if (!fib_work)
+ return NOTIFY_BAD;
+
+ fib_work->mlxsw_sp = router->mlxsw_sp;
+diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
+index c3389bd87c65..4f29010e1aef 100644
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -1301,11 +1301,14 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
+
+ /* Init all registers */
+ ret = smsc95xx_reset(dev);
++ if (ret)
++ goto free_pdata;
+
+ /* detect device revision as different features may be available */
+ ret = smsc95xx_read_reg(dev, ID_REV, &val);
+ if (ret < 0)
+- return ret;
++ goto free_pdata;
++
+ val >>= 16;
+ pdata->chip_id = val;
+ pdata->mdix_ctrl = get_mdix_status(dev->net);
+@@ -1331,6 +1334,10 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ schedule_delayed_work(&pdata->carrier_check, CARRIER_CHECK_DELAY);
+
+ return 0;
++
++free_pdata:
++ kfree(pdata);
++ return ret;
+ }
+
+ static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf)
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index 4ed21dad6a8e..6049d3766c64 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -643,9 +643,9 @@ err:
+
+ static void ath9k_hif_usb_rx_cb(struct urb *urb)
+ {
+- struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
+- struct hif_device_usb *hif_dev = rx_buf->hif_dev;
+- struct sk_buff *skb = rx_buf->skb;
++ struct sk_buff *skb = (struct sk_buff *) urb->context;
++ struct hif_device_usb *hif_dev =
++ usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+ int ret;
+
+ if (!skb)
+@@ -685,15 +685,14 @@ resubmit:
+ return;
+ free:
+ kfree_skb(skb);
+- kfree(rx_buf);
+ }
+
+ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+ {
+- struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
+- struct hif_device_usb *hif_dev = rx_buf->hif_dev;
+- struct sk_buff *skb = rx_buf->skb;
++ struct sk_buff *skb = (struct sk_buff *) urb->context;
+ struct sk_buff *nskb;
++ struct hif_device_usb *hif_dev =
++ usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+ int ret;
+
+ if (!skb)
+@@ -751,7 +750,6 @@ resubmit:
+ return;
+ free:
+ kfree_skb(skb);
+- kfree(rx_buf);
+ urb->context = NULL;
+ }
+
+@@ -797,7 +795,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
+ init_usb_anchor(&hif_dev->mgmt_submitted);
+
+ for (i = 0; i < MAX_TX_URB_NUM; i++) {
+- tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL);
++ tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
+ if (!tx_buf)
+ goto err;
+
+@@ -834,9 +832,8 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
+
+ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+ {
+- struct rx_buf *rx_buf = NULL;
+- struct sk_buff *skb = NULL;
+ struct urb *urb = NULL;
++ struct sk_buff *skb = NULL;
+ int i, ret;
+
+ init_usb_anchor(&hif_dev->rx_submitted);
+@@ -844,12 +841,6 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+
+ for (i = 0; i < MAX_RX_URB_NUM; i++) {
+
+- rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
+- if (!rx_buf) {
+- ret = -ENOMEM;
+- goto err_rxb;
+- }
+-
+ /* Allocate URB */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (urb == NULL) {
+@@ -864,14 +855,11 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+ goto err_skb;
+ }
+
+- rx_buf->hif_dev = hif_dev;
+- rx_buf->skb = skb;
+-
+ usb_fill_bulk_urb(urb, hif_dev->udev,
+ usb_rcvbulkpipe(hif_dev->udev,
+ USB_WLAN_RX_PIPE),
+ skb->data, MAX_RX_BUF_SIZE,
+- ath9k_hif_usb_rx_cb, rx_buf);
++ ath9k_hif_usb_rx_cb, skb);
+
+ /* Anchor URB */
+ usb_anchor_urb(urb, &hif_dev->rx_submitted);
+@@ -897,8 +885,6 @@ err_submit:
+ err_skb:
+ usb_free_urb(urb);
+ err_urb:
+- kfree(rx_buf);
+-err_rxb:
+ ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
+ return ret;
+ }
+@@ -910,21 +896,14 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+
+ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+ {
+- struct rx_buf *rx_buf = NULL;
+- struct sk_buff *skb = NULL;
+ struct urb *urb = NULL;
++ struct sk_buff *skb = NULL;
+ int i, ret;
+
+ init_usb_anchor(&hif_dev->reg_in_submitted);
+
+ for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
+
+- rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
+- if (!rx_buf) {
+- ret = -ENOMEM;
+- goto err_rxb;
+- }
+-
+ /* Allocate URB */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (urb == NULL) {
+@@ -939,14 +918,11 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+ goto err_skb;
+ }
+
+- rx_buf->hif_dev = hif_dev;
+- rx_buf->skb = skb;
+-
+ usb_fill_int_urb(urb, hif_dev->udev,
+ usb_rcvintpipe(hif_dev->udev,
+ USB_REG_IN_PIPE),
+ skb->data, MAX_REG_IN_BUF_SIZE,
+- ath9k_hif_usb_reg_in_cb, rx_buf, 1);
++ ath9k_hif_usb_reg_in_cb, skb, 1);
+
+ /* Anchor URB */
+ usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
+@@ -972,8 +948,6 @@ err_submit:
+ err_skb:
+ usb_free_urb(urb);
+ err_urb:
+- kfree(rx_buf);
+-err_rxb:
+ ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
+ return ret;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
+index 5985aa15ca93..a94e7e1c86e9 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
+@@ -86,11 +86,6 @@ struct tx_buf {
+ struct list_head list;
+ };
+
+-struct rx_buf {
+- struct sk_buff *skb;
+- struct hif_device_usb *hif_dev;
+-};
+-
+ #define HIF_USB_TX_STOP BIT(0)
+ #define HIF_USB_TX_FLUSH BIT(1)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 9711bfbdf431..f393a6193252 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -447,7 +447,7 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue)
+ * Spread I/O queues completion vectors according their queue index.
+ * Admin queues can always go on completion vector 0.
+ */
+- comp_vector = idx == 0 ? idx : idx - 1;
++ comp_vector = (idx == 0 ? idx : idx - 1) % ibdev->num_comp_vectors;
+
+ /* +1 for ib_stop_cq */
+ queue->ib_cq = ib_alloc_cq(ibdev, queue,
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 3082e72e4f6c..2844c9a72a98 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ //
+ // Copyright 2013 Freescale Semiconductor, Inc.
++// Copyright 2020 NXP
+ //
+ // Freescale DSPI driver
+ // This file contains a driver for the Freescale DSPI
+@@ -43,6 +44,9 @@
+ #define SPI_MCR_CLR_TXF (1 << 11)
+ #define SPI_MCR_CLR_RXF (1 << 10)
+ #define SPI_MCR_XSPI (1 << 3)
++#define SPI_MCR_DIS_TXF (1 << 13)
++#define SPI_MCR_DIS_RXF (1 << 12)
++#define SPI_MCR_HALT (1 << 0)
+
+ #define SPI_TCR 0x08
+ #define SPI_TCR_GET_TCNT(x) (((x) & 0xffff0000) >> 16)
+@@ -893,6 +897,8 @@ static int dspi_suspend(struct device *dev)
+ struct spi_master *master = dev_get_drvdata(dev);
+ struct fsl_dspi *dspi = spi_master_get_devdata(master);
+
++ if (dspi->irq)
++ disable_irq(dspi->irq);
+ spi_master_suspend(master);
+ clk_disable_unprepare(dspi->clk);
+
+@@ -913,6 +919,8 @@ static int dspi_resume(struct device *dev)
+ if (ret)
+ return ret;
+ spi_master_resume(master);
++ if (dspi->irq)
++ enable_irq(dspi->irq);
+
+ return 0;
+ }
+@@ -1090,8 +1098,8 @@ static int dspi_probe(struct platform_device *pdev)
+ goto out_clk_put;
+ }
+
+- ret = devm_request_irq(&pdev->dev, dspi->irq, dspi_interrupt, 0,
+- pdev->name, dspi);
++ ret = request_threaded_irq(dspi->irq, dspi_interrupt, NULL,
++ IRQF_SHARED, pdev->name, dspi);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Unable to attach DSPI interrupt\n");
+ goto out_clk_put;
+@@ -1101,7 +1109,7 @@ static int dspi_probe(struct platform_device *pdev)
+ ret = dspi_request_dma(dspi, res->start);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "can't get dma channels\n");
+- goto out_clk_put;
++ goto out_free_irq;
+ }
+ }
+
+@@ -1114,11 +1122,14 @@ static int dspi_probe(struct platform_device *pdev)
+ ret = spi_register_master(master);
+ if (ret != 0) {
+ dev_err(&pdev->dev, "Problem registering DSPI master\n");
+- goto out_clk_put;
++ goto out_free_irq;
+ }
+
+ return ret;
+
++out_free_irq:
++ if (dspi->irq)
++ free_irq(dspi->irq, dspi);
+ out_clk_put:
+ clk_disable_unprepare(dspi->clk);
+ out_master_put:
+@@ -1133,13 +1144,42 @@ static int dspi_remove(struct platform_device *pdev)
+ struct fsl_dspi *dspi = spi_master_get_devdata(master);
+
+ /* Disconnect from the SPI framework */
++ spi_unregister_controller(dspi->master);
++
++ /* Disable RX and TX */
++ regmap_update_bits(dspi->regmap, SPI_MCR,
++ SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF,
++ SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF);
++
++ /* Stop Running */
++ regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, SPI_MCR_HALT);
++
+ dspi_release_dma(dspi);
++ if (dspi->irq)
++ free_irq(dspi->irq, dspi);
+ clk_disable_unprepare(dspi->clk);
+- spi_unregister_master(dspi->master);
+
+ return 0;
+ }
+
++static void dspi_shutdown(struct platform_device *pdev)
++{
++ struct spi_controller *ctlr = platform_get_drvdata(pdev);
++ struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr);
++
++ /* Disable RX and TX */
++ regmap_update_bits(dspi->regmap, SPI_MCR,
++ SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF,
++ SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF);
++
++ /* Stop Running */
++ regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, SPI_MCR_HALT);
++
++ dspi_release_dma(dspi);
++ clk_disable_unprepare(dspi->clk);
++ spi_unregister_controller(dspi->master);
++}
++
+ static struct platform_driver fsl_dspi_driver = {
+ .driver.name = DRIVER_NAME,
+ .driver.of_match_table = fsl_dspi_dt_ids,
+@@ -1147,6 +1187,7 @@ static struct platform_driver fsl_dspi_driver = {
+ .driver.pm = &dspi_pm,
+ .probe = dspi_probe,
+ .remove = dspi_remove,
++ .shutdown = dspi_shutdown,
+ };
+ module_platform_driver(fsl_dspi_driver);
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 028725573e63..167047760d79 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -607,15 +607,20 @@ err_find_dev:
+ static int spidev_release(struct inode *inode, struct file *filp)
+ {
+ struct spidev_data *spidev;
++ int dofree;
+
+ mutex_lock(&device_list_lock);
+ spidev = filp->private_data;
+ filp->private_data = NULL;
+
++ spin_lock_irq(&spidev->spi_lock);
++ /* ... after we unbound from the underlying device? */
++ dofree = (spidev->spi == NULL);
++ spin_unlock_irq(&spidev->spi_lock);
++
+ /* last close? */
+ spidev->users--;
+ if (!spidev->users) {
+- int dofree;
+
+ kfree(spidev->tx_buffer);
+ spidev->tx_buffer = NULL;
+@@ -623,19 +628,14 @@ static int spidev_release(struct inode *inode, struct file *filp)
+ kfree(spidev->rx_buffer);
+ spidev->rx_buffer = NULL;
+
+- spin_lock_irq(&spidev->spi_lock);
+- if (spidev->spi)
+- spidev->speed_hz = spidev->spi->max_speed_hz;
+-
+- /* ... after we unbound from the underlying device? */
+- dofree = (spidev->spi == NULL);
+- spin_unlock_irq(&spidev->spi_lock);
+-
+ if (dofree)
+ kfree(spidev);
++ else
++ spidev->speed_hz = spidev->spi->max_speed_hz;
+ }
+ #ifdef CONFIG_SPI_SLAVE
+- spi_slave_abort(spidev->spi);
++ if (!dofree)
++ spi_slave_abort(spidev->spi);
+ #endif
+ mutex_unlock(&device_list_lock);
+
+@@ -782,13 +782,13 @@ static int spidev_remove(struct spi_device *spi)
+ {
+ struct spidev_data *spidev = spi_get_drvdata(spi);
+
++ /* prevent new opens */
++ mutex_lock(&device_list_lock);
+ /* make sure ops on existing fds can abort cleanly */
+ spin_lock_irq(&spidev->spi_lock);
+ spidev->spi = NULL;
+ spin_unlock_irq(&spidev->spi_lock);
+
+- /* prevent new opens */
+- mutex_lock(&device_list_lock);
+ list_del(&spidev->device_entry);
+ device_destroy(spidev_class, spidev->devt);
+ clear_bit(MINOR(spidev->devt), minors);
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index b2fd505938a0..389ec4c689c4 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -204,8 +204,10 @@ static void dwc3_pci_resume_work(struct work_struct *work)
+ int ret;
+
+ ret = pm_runtime_get_sync(&dwc3->dev);
+- if (ret)
++ if (ret) {
++ pm_runtime_put_sync_autosuspend(&dwc3->dev);
+ return;
++ }
+
+ pm_runtime_mark_last_busy(&dwc3->dev);
+ pm_runtime_put_sync_autosuspend(&dwc3->dev);
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 11efb4f5041c..8b6dbaa59c36 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -4801,25 +4801,28 @@ struct extent_buffer *alloc_dummy_extent_buffer(struct btrfs_fs_info *fs_info,
+ static void check_buffer_tree_ref(struct extent_buffer *eb)
+ {
+ int refs;
+- /* the ref bit is tricky. We have to make sure it is set
+- * if we have the buffer dirty. Otherwise the
+- * code to free a buffer can end up dropping a dirty
+- * page
++ /*
++ * The TREE_REF bit is first set when the extent_buffer is added
++ * to the radix tree. It is also reset, if unset, when a new reference
++ * is created by find_extent_buffer.
+ *
+- * Once the ref bit is set, it won't go away while the
+- * buffer is dirty or in writeback, and it also won't
+- * go away while we have the reference count on the
+- * eb bumped.
++ * It is only cleared in two cases: freeing the last non-tree
++ * reference to the extent_buffer when its STALE bit is set or
++ * calling releasepage when the tree reference is the only reference.
+ *
+- * We can't just set the ref bit without bumping the
+- * ref on the eb because free_extent_buffer might
+- * see the ref bit and try to clear it. If this happens
+- * free_extent_buffer might end up dropping our original
+- * ref by mistake and freeing the page before we are able
+- * to add one more ref.
++ * In both cases, care is taken to ensure that the extent_buffer's
++ * pages are not under io. However, releasepage can be concurrently
++ * called with creating new references, which is prone to race
++ * conditions between the calls to check_buffer_tree_ref in those
++ * codepaths and clearing TREE_REF in try_release_extent_buffer.
+ *
+- * So bump the ref count first, then set the bit. If someone
+- * beat us to it, drop the ref we added.
++ * The actual lifetime of the extent_buffer in the radix tree is
++ * adequately protected by the refcount, but the TREE_REF bit and
++ * its corresponding reference are not. To protect against this
++ * class of races, we call check_buffer_tree_ref from the codepaths
++ * which trigger io after they set eb->io_pages. Note that once io is
++ * initiated, TREE_REF can no longer be cleared, so that is the
++ * moment at which any such race is best fixed.
+ */
+ refs = atomic_read(&eb->refs);
+ if (refs >= 2 && test_bit(EXTENT_BUFFER_TREE_REF, &eb->bflags))
+@@ -5273,6 +5276,11 @@ int read_extent_buffer_pages(struct extent_io_tree *tree,
+ clear_bit(EXTENT_BUFFER_READ_ERR, &eb->bflags);
+ eb->read_mirror = 0;
+ atomic_set(&eb->io_pages, num_reads);
++ /*
++ * It is possible for releasepage to clear the TREE_REF bit before we
++ * set io_pages. See check_buffer_tree_ref for a more detailed comment.
++ */
++ check_buffer_tree_ref(eb);
+ for (i = 0; i < num_pages; i++) {
+ page = eb->pages[i];
+
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 44fb9ae6d105..1d951936b092 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -2225,6 +2225,15 @@ set_size_out:
+ if (rc == 0) {
+ cifsInode->server_eof = attrs->ia_size;
+ cifs_setsize(inode, attrs->ia_size);
++
++ /*
++ * The man page of truncate says if the size changed,
++ * then the st_ctime and st_mtime fields for the file
++ * are updated.
++ */
++ attrs->ia_ctime = attrs->ia_mtime = current_time(inode);
++ attrs->ia_valid |= ATTR_CTIME | ATTR_MTIME;
++
+ cifs_truncate_page(inode->i_mapping, inode->i_size);
+ }
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 3705c6f10b17..d61dc72ebb96 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -752,12 +752,12 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog);
+ void bpf_jit_compile(struct bpf_prog *prog);
+ bool bpf_helper_changes_pkt_data(void *func);
+
+-static inline bool bpf_dump_raw_ok(void)
++static inline bool bpf_dump_raw_ok(const struct cred *cred)
+ {
+ /* Reconstruction of call-sites is dependent on kallsyms,
+ * thus make dump the same restriction.
+ */
+- return kallsyms_show_value() == 1;
++ return kallsyms_show_value(cred);
+ }
+
+ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
+diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
+index 657a83b943f0..1f96ce2b47df 100644
+--- a/include/linux/kallsyms.h
++++ b/include/linux/kallsyms.h
+@@ -18,6 +18,7 @@
+ #define KSYM_SYMBOL_LEN (sizeof("%s+%#lx/%#lx [%s]") + (KSYM_NAME_LEN - 1) + \
+ 2*(BITS_PER_LONG*3/10) + (MODULE_NAME_LEN - 1) + 1)
+
++struct cred;
+ struct module;
+
+ static inline int is_kernel_inittext(unsigned long addr)
+@@ -98,7 +99,7 @@ int lookup_symbol_name(unsigned long addr, char *symname);
+ int lookup_symbol_attrs(unsigned long addr, unsigned long *size, unsigned long *offset, char *modname, char *name);
+
+ /* How and when do we show kallsyms values? */
+-extern int kallsyms_show_value(void);
++extern bool kallsyms_show_value(const struct cred *cred);
+
+ #else /* !CONFIG_KALLSYMS */
+
+@@ -158,7 +159,7 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u
+ return -ERANGE;
+ }
+
+-static inline int kallsyms_show_value(void)
++static inline bool kallsyms_show_value(const struct cred *cred)
+ {
+ return false;
+ }
+diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
+index 127c2713b543..99855d1c7476 100644
+--- a/include/sound/compress_driver.h
++++ b/include/sound/compress_driver.h
+@@ -57,6 +57,7 @@ struct snd_compr_runtime {
+ * @direction: stream direction, playback/recording
+ * @metadata_set: metadata set flag, true when set
+ * @next_track: has userspace signal next track transition, true when set
++ * @partial_drain: undergoing partial_drain for stream, true when set
+ * @private_data: pointer to DSP private data
+ */
+ struct snd_compr_stream {
+@@ -68,6 +69,7 @@ struct snd_compr_stream {
+ enum snd_compr_direction direction;
+ bool metadata_set;
+ bool next_track;
++ bool partial_drain;
+ void *private_data;
+ };
+
+@@ -171,7 +173,13 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)
+ if (snd_BUG_ON(!stream))
+ return;
+
+- stream->runtime->state = SNDRV_PCM_STATE_SETUP;
++ /* for partial_drain case we are back to running state on success */
++ if (stream->partial_drain) {
++ stream->runtime->state = SNDRV_PCM_STATE_RUNNING;
++ stream->partial_drain = false; /* clear this flag as well */
++ } else {
++ stream->runtime->state = SNDRV_PCM_STATE_SETUP;
++ }
+
+ wake_up(&stream->runtime->sleep);
+ }
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index b766265cf37d..21a366a661ac 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1903,7 +1903,8 @@ static const struct bpf_map *bpf_map_from_imm(const struct bpf_prog *prog,
+ return NULL;
+ }
+
+-static struct bpf_insn *bpf_insn_prepare_dump(const struct bpf_prog *prog)
++static struct bpf_insn *bpf_insn_prepare_dump(const struct bpf_prog *prog,
++ const struct cred *f_cred)
+ {
+ const struct bpf_map *map;
+ struct bpf_insn *insns;
+@@ -1925,7 +1926,7 @@ static struct bpf_insn *bpf_insn_prepare_dump(const struct bpf_prog *prog)
+ insns[i].code == (BPF_JMP | BPF_CALL_ARGS)) {
+ if (insns[i].code == (BPF_JMP | BPF_CALL_ARGS))
+ insns[i].code = BPF_JMP | BPF_CALL;
+- if (!bpf_dump_raw_ok())
++ if (!bpf_dump_raw_ok(f_cred))
+ insns[i].imm = 0;
+ continue;
+ }
+@@ -1942,7 +1943,7 @@ static struct bpf_insn *bpf_insn_prepare_dump(const struct bpf_prog *prog)
+ continue;
+ }
+
+- if (!bpf_dump_raw_ok() &&
++ if (!bpf_dump_raw_ok(f_cred) &&
+ imm == (unsigned long)prog->aux) {
+ insns[i].imm = 0;
+ insns[i + 1].imm = 0;
+@@ -1953,7 +1954,8 @@ static struct bpf_insn *bpf_insn_prepare_dump(const struct bpf_prog *prog)
+ return insns;
+ }
+
+-static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
++static int bpf_prog_get_info_by_fd(struct file *file,
++ struct bpf_prog *prog,
+ const union bpf_attr *attr,
+ union bpf_attr __user *uattr)
+ {
+@@ -2010,11 +2012,11 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
+ struct bpf_insn *insns_sanitized;
+ bool fault;
+
+- if (prog->blinded && !bpf_dump_raw_ok()) {
++ if (prog->blinded && !bpf_dump_raw_ok(file->f_cred)) {
+ info.xlated_prog_insns = 0;
+ goto done;
+ }
+- insns_sanitized = bpf_insn_prepare_dump(prog);
++ insns_sanitized = bpf_insn_prepare_dump(prog, file->f_cred);
+ if (!insns_sanitized)
+ return -ENOMEM;
+ uinsns = u64_to_user_ptr(info.xlated_prog_insns);
+@@ -2048,7 +2050,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
+ }
+
+ if (info.jited_prog_len && ulen) {
+- if (bpf_dump_raw_ok()) {
++ if (bpf_dump_raw_ok(file->f_cred)) {
+ uinsns = u64_to_user_ptr(info.jited_prog_insns);
+ ulen = min_t(u32, info.jited_prog_len, ulen);
+
+@@ -2083,7 +2085,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
+ ulen = info.nr_jited_ksyms;
+ info.nr_jited_ksyms = prog->aux->func_cnt;
+ if (info.nr_jited_ksyms && ulen) {
+- if (bpf_dump_raw_ok()) {
++ if (bpf_dump_raw_ok(file->f_cred)) {
+ u64 __user *user_ksyms;
+ ulong ksym_addr;
+ u32 i;
+@@ -2107,7 +2109,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
+ ulen = info.nr_jited_func_lens;
+ info.nr_jited_func_lens = prog->aux->func_cnt;
+ if (info.nr_jited_func_lens && ulen) {
+- if (bpf_dump_raw_ok()) {
++ if (bpf_dump_raw_ok(file->f_cred)) {
+ u32 __user *user_lens;
+ u32 func_len, i;
+
+@@ -2132,7 +2134,8 @@ done:
+ return 0;
+ }
+
+-static int bpf_map_get_info_by_fd(struct bpf_map *map,
++static int bpf_map_get_info_by_fd(struct file *file,
++ struct bpf_map *map,
+ const union bpf_attr *attr,
+ union bpf_attr __user *uattr)
+ {
+@@ -2174,7 +2177,8 @@ static int bpf_map_get_info_by_fd(struct bpf_map *map,
+ return 0;
+ }
+
+-static int bpf_btf_get_info_by_fd(struct btf *btf,
++static int bpf_btf_get_info_by_fd(struct file *file,
++ struct btf *btf,
+ const union bpf_attr *attr,
+ union bpf_attr __user *uattr)
+ {
+@@ -2206,13 +2210,13 @@ static int bpf_obj_get_info_by_fd(const union bpf_attr *attr,
+ return -EBADFD;
+
+ if (f.file->f_op == &bpf_prog_fops)
+- err = bpf_prog_get_info_by_fd(f.file->private_data, attr,
++ err = bpf_prog_get_info_by_fd(f.file, f.file->private_data, attr,
+ uattr);
+ else if (f.file->f_op == &bpf_map_fops)
+- err = bpf_map_get_info_by_fd(f.file->private_data, attr,
++ err = bpf_map_get_info_by_fd(f.file, f.file->private_data, attr,
+ uattr);
+ else if (f.file->f_op == &btf_fops)
+- err = bpf_btf_get_info_by_fd(f.file->private_data, attr, uattr);
++ err = bpf_btf_get_info_by_fd(f.file, f.file->private_data, attr, uattr);
+ else
+ err = -EINVAL;
+
+diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
+index ed87dac8378c..6df6d62e2db8 100644
+--- a/kernel/kallsyms.c
++++ b/kernel/kallsyms.c
+@@ -644,19 +644,20 @@ static inline int kallsyms_for_perf(void)
+ * Otherwise, require CAP_SYSLOG (assuming kptr_restrict isn't set to
+ * block even that).
+ */
+-int kallsyms_show_value(void)
++bool kallsyms_show_value(const struct cred *cred)
+ {
+ switch (kptr_restrict) {
+ case 0:
+ if (kallsyms_for_perf())
+- return 1;
++ return true;
+ /* fallthrough */
+ case 1:
+- if (has_capability_noaudit(current, CAP_SYSLOG))
+- return 1;
++ if (security_capable(cred, &init_user_ns, CAP_SYSLOG,
++ CAP_OPT_NOAUDIT) == 0)
++ return true;
+ /* fallthrough */
+ default:
+- return 0;
++ return false;
+ }
+ }
+
+@@ -673,7 +674,11 @@ static int kallsyms_open(struct inode *inode, struct file *file)
+ return -ENOMEM;
+ reset_iter(iter, 0);
+
+- iter->show_value = kallsyms_show_value();
++ /*
++ * Instead of checking this on every s_show() call, cache
++ * the result here at open time.
++ */
++ iter->show_value = kallsyms_show_value(file->f_cred);
+ return 0;
+ }
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 97de04a52c9f..178327a75e73 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2334,7 +2334,7 @@ static void report_probe(struct seq_file *pi, struct kprobe *p,
+ else
+ kprobe_type = "k";
+
+- if (!kallsyms_show_value())
++ if (!kallsyms_show_value(pi->file->f_cred))
+ addr = NULL;
+
+ if (sym)
+@@ -2435,7 +2435,7 @@ static int kprobe_blacklist_seq_show(struct seq_file *m, void *v)
+ * If /proc/kallsyms is not showing kernel address, we won't
+ * show them here either.
+ */
+- if (!kallsyms_show_value())
++ if (!kallsyms_show_value(m->file->f_cred))
+ seq_printf(m, "0x%px-0x%px\t%ps\n", NULL, NULL,
+ (void *)ent->start_addr);
+ else
+diff --git a/kernel/module.c b/kernel/module.c
+index 20fc0efc679c..ae8e7a1fa74a 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1451,8 +1451,7 @@ static inline bool sect_empty(const Elf_Shdr *sect)
+ }
+
+ struct module_sect_attr {
+- struct module_attribute mattr;
+- char *name;
++ struct bin_attribute battr;
+ unsigned long address;
+ };
+
+@@ -1462,13 +1461,18 @@ struct module_sect_attrs {
+ struct module_sect_attr attrs[0];
+ };
+
+-static ssize_t module_sect_show(struct module_attribute *mattr,
+- struct module_kobject *mk, char *buf)
++static ssize_t module_sect_read(struct file *file, struct kobject *kobj,
++ struct bin_attribute *battr,
++ char *buf, loff_t pos, size_t count)
+ {
+ struct module_sect_attr *sattr =
+- container_of(mattr, struct module_sect_attr, mattr);
+- return sprintf(buf, "0x%px\n", kptr_restrict < 2 ?
+- (void *)sattr->address : NULL);
++ container_of(battr, struct module_sect_attr, battr);
++
++ if (pos != 0)
++ return -EINVAL;
++
++ return sprintf(buf, "0x%px\n",
++ kallsyms_show_value(file->f_cred) ? (void *)sattr->address : NULL);
+ }
+
+ static void free_sect_attrs(struct module_sect_attrs *sect_attrs)
+@@ -1476,7 +1480,7 @@ static void free_sect_attrs(struct module_sect_attrs *sect_attrs)
+ unsigned int section;
+
+ for (section = 0; section < sect_attrs->nsections; section++)
+- kfree(sect_attrs->attrs[section].name);
++ kfree(sect_attrs->attrs[section].battr.attr.name);
+ kfree(sect_attrs);
+ }
+
+@@ -1485,43 +1489,41 @@ static void add_sect_attrs(struct module *mod, const struct load_info *info)
+ unsigned int nloaded = 0, i, size[2];
+ struct module_sect_attrs *sect_attrs;
+ struct module_sect_attr *sattr;
+- struct attribute **gattr;
++ struct bin_attribute **gattr;
+
+ /* Count loaded sections and allocate structures */
+ for (i = 0; i < info->hdr->e_shnum; i++)
+ if (!sect_empty(&info->sechdrs[i]))
+ nloaded++;
+- size[0] = ALIGN(sizeof(*sect_attrs)
+- + nloaded * sizeof(sect_attrs->attrs[0]),
+- sizeof(sect_attrs->grp.attrs[0]));
+- size[1] = (nloaded + 1) * sizeof(sect_attrs->grp.attrs[0]);
++ size[0] = ALIGN(struct_size(sect_attrs, attrs, nloaded),
++ sizeof(sect_attrs->grp.bin_attrs[0]));
++ size[1] = (nloaded + 1) * sizeof(sect_attrs->grp.bin_attrs[0]);
+ sect_attrs = kzalloc(size[0] + size[1], GFP_KERNEL);
+ if (sect_attrs == NULL)
+ return;
+
+ /* Setup section attributes. */
+ sect_attrs->grp.name = "sections";
+- sect_attrs->grp.attrs = (void *)sect_attrs + size[0];
++ sect_attrs->grp.bin_attrs = (void *)sect_attrs + size[0];
+
+ sect_attrs->nsections = 0;
+ sattr = §_attrs->attrs[0];
+- gattr = §_attrs->grp.attrs[0];
++ gattr = §_attrs->grp.bin_attrs[0];
+ for (i = 0; i < info->hdr->e_shnum; i++) {
+ Elf_Shdr *sec = &info->sechdrs[i];
+ if (sect_empty(sec))
+ continue;
++ sysfs_bin_attr_init(&sattr->battr);
+ sattr->address = sec->sh_addr;
+- sattr->name = kstrdup(info->secstrings + sec->sh_name,
+- GFP_KERNEL);
+- if (sattr->name == NULL)
++ sattr->battr.attr.name =
++ kstrdup(info->secstrings + sec->sh_name, GFP_KERNEL);
++ if (sattr->battr.attr.name == NULL)
+ goto out;
+ sect_attrs->nsections++;
+- sysfs_attr_init(&sattr->mattr.attr);
+- sattr->mattr.show = module_sect_show;
+- sattr->mattr.store = NULL;
+- sattr->mattr.attr.name = sattr->name;
+- sattr->mattr.attr.mode = S_IRUSR;
+- *(gattr++) = &(sattr++)->mattr.attr;
++ sattr->battr.read = module_sect_read;
++ sattr->battr.size = 3 /* "0x", "\n" */ + (BITS_PER_LONG / 4);
++ sattr->battr.attr.mode = 0400;
++ *(gattr++) = &(sattr++)->battr;
+ }
+ *gattr = NULL;
+
+@@ -1611,7 +1613,7 @@ static void add_notes_attrs(struct module *mod, const struct load_info *info)
+ continue;
+ if (info->sechdrs[i].sh_type == SHT_NOTE) {
+ sysfs_bin_attr_init(nattr);
+- nattr->attr.name = mod->sect_attrs->attrs[loaded].name;
++ nattr->attr.name = mod->sect_attrs->attrs[loaded].battr.attr.name;
+ nattr->attr.mode = S_IRUGO;
+ nattr->size = info->sechdrs[i].sh_size;
+ nattr->private = (void *) info->sechdrs[i].sh_addr;
+@@ -4258,7 +4260,7 @@ static int modules_open(struct inode *inode, struct file *file)
+
+ if (!err) {
+ struct seq_file *m = file->private_data;
+- m->private = kallsyms_show_value() ? NULL : (void *)8ul;
++ m->private = kallsyms_show_value(file->f_cred) ? NULL : (void *)8ul;
+ }
+
+ return err;
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index 6cec08cd0bb9..2597449ae9b4 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -270,7 +270,7 @@ static int proc_dointvec_minmax_bpf_enable(struct ctl_table *table, int write,
+ ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
+ if (write && !ret) {
+ if (jit_enable < 2 ||
+- (jit_enable == 2 && bpf_dump_raw_ok())) {
++ (jit_enable == 2 && bpf_dump_raw_ok(current_cred()))) {
+ *(int *)table->data = jit_enable;
+ if (jit_enable == 2)
+ pr_warn("bpf_jit_enable = 2 was set! NEVER use this in production, only for JIT debugging!\n");
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 9605979a349e..0baffc9666e6 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -266,7 +266,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
+ unsigned int ver;
+ size_t hdrlen;
+
+- if (len & 3)
++ if (len == 0 || len & 3)
+ return -EINVAL;
+
+ skb = netdev_alloc_skb(NULL, len);
+@@ -280,6 +280,8 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
+
+ switch (ver) {
+ case QRTR_PROTO_VER_1:
++ if (len < sizeof(*v1))
++ goto err;
+ v1 = data;
+ hdrlen = sizeof(*v1);
+
+@@ -293,6 +295,8 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
+ size = le32_to_cpu(v1->size);
+ break;
+ case QRTR_PROTO_VER_2:
++ if (len < sizeof(*v2))
++ goto err;
+ v2 = data;
+ hdrlen = sizeof(*v2) + v2->optlen;
+
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 509038d6bccd..68f016e4929a 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -723,6 +723,9 @@ static int snd_compr_stop(struct snd_compr_stream *stream)
+
+ retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP);
+ if (!retval) {
++ /* clear flags and stop any drain wait */
++ stream->partial_drain = false;
++ stream->metadata_set = false;
+ snd_compr_drain_notify(stream);
+ stream->runtime->total_bytes_available = 0;
+ stream->runtime->total_bytes_transferred = 0;
+@@ -880,6 +883,7 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream)
+ if (stream->next_track == false)
+ return -EPERM;
+
++ stream->partial_drain = true;
+ retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_PARTIAL_DRAIN);
+ if (retval) {
+ pr_debug("Partial drain returned failure\n");
+diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c
+index d522925fc5c0..1a87f8ea074b 100644
+--- a/sound/drivers/opl3/opl3_synth.c
++++ b/sound/drivers/opl3/opl3_synth.c
+@@ -105,6 +105,8 @@ int snd_opl3_ioctl(struct snd_hwdep * hw, struct file *file,
+ {
+ struct snd_dm_fm_info info;
+
++ memset(&info, 0, sizeof(info));
++
+ info.fm_mode = opl3->fm_mode;
+ info.rhythm = opl3->rhythm;
+ if (copy_to_user(argp, &info, sizeof(struct snd_dm_fm_info)))
+diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
+index d8ba3a6d5042..d23d61dbc20f 100644
+--- a/sound/pci/hda/hda_auto_parser.c
++++ b/sound/pci/hda/hda_auto_parser.c
+@@ -76,6 +76,12 @@ static int compare_input_type(const void *ap, const void *bp)
+ if (a->type != b->type)
+ return (int)(a->type - b->type);
+
++ /* If has both hs_mic and hp_mic, pick the hs_mic ahead of hp_mic. */
++ if (a->is_headset_mic && b->is_headphone_mic)
++ return -1; /* don't swap */
++ else if (a->is_headphone_mic && b->is_headset_mic)
++ return 1; /* swap */
++
+ /* In case one has boost and the other one has not,
+ pick the one with boost first. */
+ return (int)(b->has_boost_on_pin - a->has_boost_on_pin);
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index e2725ab4d985..41a5e38b7870 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3460,4 +3460,56 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */
+ }
+ },
+
++/*
++ * MacroSilicon MS2109 based HDMI capture cards
++ *
++ * These claim 96kHz 1ch in the descriptors, but are actually 48kHz 2ch.
++ * They also need QUIRK_AUDIO_ALIGN_TRANSFER, which makes one wonder if
++ * they pretend to be 96kHz mono as a workaround for stereo being broken
++ * by that...
++ *
++ * They also have swapped L-R channels, but that's for userspace to deal
++ * with.
++ */
++{
++ USB_DEVICE(0x534d, 0x2109),
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .vendor_name = "MacroSilicon",
++ .product_name = "MS2109",
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = &(const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_ALIGN_TRANSFER,
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_MIXER,
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_AUDIO_FIXED_ENDPOINT,
++ .data = &(const struct audioformat) {
++ .formats = SNDRV_PCM_FMTBIT_S16_LE,
++ .channels = 2,
++ .iface = 3,
++ .altsetting = 1,
++ .altset_idx = 1,
++ .attributes = 0,
++ .endpoint = 0x82,
++ .ep_attr = USB_ENDPOINT_XFER_ISOC |
++ USB_ENDPOINT_SYNC_ASYNC,
++ .rates = SNDRV_PCM_RATE_CONTINUOUS,
++ .rate_min = 48000,
++ .rate_max = 48000,
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++
+ #undef USB_DEVICE_VENDOR_SPEC
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-07-22 12:42 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-07-22 12:42 UTC (permalink / raw
To: gentoo-commits
commit: 5915afbc404046371aae4017f7185811b08133b0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 22 12:42:07 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 22 12:42:07 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5915afbc
Linux patch 4.19.134
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1133_linux-4.19.134.patch | 5023 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5027 insertions(+)
diff --git a/0000_README b/0000_README
index ab738e3..ceb4a9f 100644
--- a/0000_README
+++ b/0000_README
@@ -571,6 +571,10 @@ Patch: 1132_linux-4.19.133.patch
From: https://www.kernel.org
Desc: Linux 4.19.133
+Patch: 1133_linux-4.19.134.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.134
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1133_linux-4.19.134.patch b/1133_linux-4.19.134.patch
new file mode 100644
index 0000000..1718423
--- /dev/null
+++ b/1133_linux-4.19.134.patch
@@ -0,0 +1,5023 @@
+diff --git a/Documentation/devicetree/bindings/usb/dwc3.txt b/Documentation/devicetree/bindings/usb/dwc3.txt
+index 3e4c38b806ac..ae46c0ac9f11 100644
+--- a/Documentation/devicetree/bindings/usb/dwc3.txt
++++ b/Documentation/devicetree/bindings/usb/dwc3.txt
+@@ -68,6 +68,8 @@ Optional properties:
+ from P0 to P1/P2/P3 without delay.
+ - snps,dis-tx-ipgap-linecheck-quirk: when set, disable u2mac linestate check
+ during HS transmit.
++ - snps,parkmode-disable-ss-quirk: when set, all SuperSpeed bus instances in
++ park mode are disabled.
+ - snps,dis_metastability_quirk: when set, disable metastability workaround.
+ CAUTION: use only if you are absolutely sure of it.
+ - snps,is-utmi-l1-suspend: true when DWC3 asserts output signal
+diff --git a/Makefile b/Makefile
+index a17c413ee5d6..1e195471eb91 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 133
++SUBLEVEL = 134
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/defconfig b/arch/alpha/defconfig
+index f4ec420d7f2d..3a132c91d45b 100644
+--- a/arch/alpha/defconfig
++++ b/arch/alpha/defconfig
+@@ -36,7 +36,6 @@ CONFIG_BLK_DEV_CY82C693=y
+ CONFIG_SCSI=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_SCSI_AIC7XXX=m
+ CONFIG_AIC7XXX_CMDS_PER_DEVICE=253
+ # CONFIG_AIC7XXX_DEBUG_ENABLE is not set
+diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
+index b38f8c240558..602511ccad6f 100644
+--- a/arch/arm/boot/dts/socfpga.dtsi
++++ b/arch/arm/boot/dts/socfpga.dtsi
+@@ -710,7 +710,7 @@
+ };
+ };
+
+- L2: l2-cache@fffef000 {
++ L2: cache-controller@fffef000 {
+ compatible = "arm,pl310-cache";
+ reg = <0xfffef000 0x1000>;
+ interrupts = <0 38 0x04>;
+diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
+index b4dd3846e8cc..ba5657574d9b 100644
+--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
+@@ -618,7 +618,7 @@
+ reg = <0xffcfb100 0x80>;
+ };
+
+- L2: l2-cache@fffff000 {
++ L2: cache-controller@fffff000 {
+ compatible = "arm,pl310-cache";
+ reg = <0xfffff000 0x1000>;
+ interrupts = <0 18 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/configs/rpc_defconfig b/arch/arm/configs/rpc_defconfig
+index 3b82b64950d9..c090643b1ecb 100644
+--- a/arch/arm/configs/rpc_defconfig
++++ b/arch/arm/configs/rpc_defconfig
+@@ -32,7 +32,6 @@ CONFIG_BLK_DEV_RAM=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_LOGGING=y
+diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig
+index bd71d5bf98c9..9c69a9020e77 100644
+--- a/arch/arm/configs/s3c2410_defconfig
++++ b/arch/arm/configs/s3c2410_defconfig
+@@ -206,7 +206,6 @@ CONFIG_EEPROM_AT24=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_CHR_DEV_SCH=m
+ CONFIG_SCSI_CONSTANTS=y
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index a7c6ae13c945..d650a5a1dfee 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -220,6 +220,10 @@ ENDPROC(at91_backup_mode)
+ orr tmp1, tmp1, #AT91_PMC_KEY
+ str tmp1, [pmc, #AT91_CKGR_MOR]
+
++ /* Quirk for SAM9X60's PMC */
++ nop
++ nop
++
+ wait_mckrdy
+
+ /* Enable the crystal oscillator */
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+index 8f0bb3c44bd6..5d7724b3a612 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+@@ -266,6 +266,11 @@
+ };
+ };
+
++&hwrng {
++ clocks = <&clkc CLKID_RNG0>;
++ clock-names = "core";
++};
++
+ &i2c_A {
+ clocks = <&clkc CLKID_I2C>;
+ };
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+index 1a7ba3de7079..849d891c60a8 100644
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -73,11 +73,11 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ ".pushsection .altinstructions,\"a\"\n" \
+ ALTINSTR_ENTRY(feature) \
+ ".popsection\n" \
+- ".pushsection .altinstr_replacement, \"a\"\n" \
++ ".subsection 1\n" \
+ "663:\n\t" \
+ newinstr "\n" \
+ "664:\n\t" \
+- ".popsection\n\t" \
++ ".previous\n\t" \
+ ".org . - (664b-663b) + (662b-661b)\n\t" \
+ ".org . - (662b-661b) + (664b-663b)\n" \
+ ".endif\n"
+@@ -117,9 +117,9 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ 662: .pushsection .altinstructions, "a"
+ altinstruction_entry 661b, 663f, \cap, 662b-661b, 664f-663f
+ .popsection
+- .pushsection .altinstr_replacement, "ax"
++ .subsection 1
+ 663: \insn2
+-664: .popsection
++664: .previous
+ .org . - (664b-663b) + (662b-661b)
+ .org . - (662b-661b) + (664b-663b)
+ .endif
+@@ -160,7 +160,7 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ .pushsection .altinstructions, "a"
+ altinstruction_entry 663f, 661f, \cap, 664f-663f, 662f-661f
+ .popsection
+- .pushsection .altinstr_replacement, "ax"
++ .subsection 1
+ .align 2 /* So GAS knows label 661 is suitably aligned */
+ 661:
+ .endm
+@@ -179,9 +179,9 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ .macro alternative_else
+ 662:
+ .if .Lasm_alt_mode==0
+- .pushsection .altinstr_replacement, "ax"
++ .subsection 1
+ .else
+- .popsection
++ .previous
+ .endif
+ 663:
+ .endm
+@@ -192,7 +192,7 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ .macro alternative_endif
+ 664:
+ .if .Lasm_alt_mode==0
+- .popsection
++ .previous
+ .endif
+ .org . - (664b-663b) + (662b-661b)
+ .org . - (662b-661b) + (664b-663b)
+diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h
+index a44cf5225429..41b065f1be88 100644
+--- a/arch/arm64/include/asm/debug-monitors.h
++++ b/arch/arm64/include/asm/debug-monitors.h
+@@ -119,6 +119,8 @@ void disable_debug_monitors(enum dbg_active_el el);
+
+ void user_rewind_single_step(struct task_struct *task);
+ void user_fastforward_single_step(struct task_struct *task);
++void user_regs_reset_single_step(struct user_pt_regs *regs,
++ struct task_struct *task);
+
+ void kernel_enable_single_step(struct pt_regs *regs);
+ void kernel_disable_single_step(void);
+diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h
+index 58102652bf9e..615376030aba 100644
+--- a/arch/arm64/include/asm/syscall.h
++++ b/arch/arm64/include/asm/syscall.h
+@@ -45,6 +45,10 @@ static inline long syscall_get_error(struct task_struct *task,
+ struct pt_regs *regs)
+ {
+ unsigned long error = regs->regs[0];
++
++ if (is_compat_thread(task_thread_info(task)))
++ error = sign_extend64(error, 31);
++
+ return IS_ERR_VALUE(error) ? error : 0;
+ }
+
+@@ -58,7 +62,13 @@ static inline void syscall_set_return_value(struct task_struct *task,
+ struct pt_regs *regs,
+ int error, long val)
+ {
+- regs->regs[0] = (long) error ? error : val;
++ if (error)
++ val = error;
++
++ if (is_compat_thread(task_thread_info(task)))
++ val = lower_32_bits(val);
++
++ regs->regs[0] = val;
+ }
+
+ #define SYSCALL_MAX_ARGS 6
+diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h
+index cb2c10a8f0a8..69ac5262cccd 100644
+--- a/arch/arm64/include/asm/thread_info.h
++++ b/arch/arm64/include/asm/thread_info.h
+@@ -101,6 +101,7 @@ void arch_release_task_struct(struct task_struct *tsk);
+ #define _TIF_SECCOMP (1 << TIF_SECCOMP)
+ #define _TIF_UPROBE (1 << TIF_UPROBE)
+ #define _TIF_FSCHECK (1 << TIF_FSCHECK)
++#define _TIF_SINGLESTEP (1 << TIF_SINGLESTEP)
+ #define _TIF_32BIT (1 << TIF_32BIT)
+ #define _TIF_SVE (1 << TIF_SVE)
+
+diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c
+index b5d603992d40..0d345622bbba 100644
+--- a/arch/arm64/kernel/alternative.c
++++ b/arch/arm64/kernel/alternative.c
+@@ -44,20 +44,8 @@ struct alt_region {
+ */
+ static bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc)
+ {
+- unsigned long replptr;
+-
+- if (kernel_text_address(pc))
+- return true;
+-
+- replptr = (unsigned long)ALT_REPL_PTR(alt);
+- if (pc >= replptr && pc <= (replptr + alt->alt_len))
+- return false;
+-
+- /*
+- * Branching into *another* alternate sequence is doomed, and
+- * we're not even trying to fix it up.
+- */
+- BUG();
++ unsigned long replptr = (unsigned long)ALT_REPL_PTR(alt);
++ return !(pc >= replptr && pc <= (replptr + alt->alt_len));
+ }
+
+ #define align_down(x, a) ((unsigned long)(x) & ~(((unsigned long)(a)) - 1))
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index 262925b98f42..93ee34dee9f2 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -152,17 +152,20 @@ postcore_initcall(debug_monitors_init);
+ /*
+ * Single step API and exception handling.
+ */
+-static void set_regs_spsr_ss(struct pt_regs *regs)
++static void set_user_regs_spsr_ss(struct user_pt_regs *regs)
+ {
+ regs->pstate |= DBG_SPSR_SS;
+ }
+-NOKPROBE_SYMBOL(set_regs_spsr_ss);
++NOKPROBE_SYMBOL(set_user_regs_spsr_ss);
+
+-static void clear_regs_spsr_ss(struct pt_regs *regs)
++static void clear_user_regs_spsr_ss(struct user_pt_regs *regs)
+ {
+ regs->pstate &= ~DBG_SPSR_SS;
+ }
+-NOKPROBE_SYMBOL(clear_regs_spsr_ss);
++NOKPROBE_SYMBOL(clear_user_regs_spsr_ss);
++
++#define set_regs_spsr_ss(r) set_user_regs_spsr_ss(&(r)->user_regs)
++#define clear_regs_spsr_ss(r) clear_user_regs_spsr_ss(&(r)->user_regs)
+
+ /* EL1 Single Step Handler hooks */
+ static LIST_HEAD(step_hook);
+@@ -400,6 +403,15 @@ void user_fastforward_single_step(struct task_struct *task)
+ clear_regs_spsr_ss(task_pt_regs(task));
+ }
+
++void user_regs_reset_single_step(struct user_pt_regs *regs,
++ struct task_struct *task)
++{
++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
++ set_user_regs_spsr_ss(regs);
++ else
++ clear_user_regs_spsr_ss(regs);
++}
++
+ /* Kernel API */
+ void kernel_enable_single_step(struct pt_regs *regs)
+ {
+diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
+index 38aab5b34cc4..9579968e7222 100644
+--- a/arch/arm64/kernel/ptrace.c
++++ b/arch/arm64/kernel/ptrace.c
+@@ -1647,12 +1647,23 @@ static void tracehook_report_syscall(struct pt_regs *regs,
+ saved_reg = regs->regs[regno];
+ regs->regs[regno] = dir;
+
+- if (dir == PTRACE_SYSCALL_EXIT)
++ if (dir == PTRACE_SYSCALL_ENTER) {
++ if (tracehook_report_syscall_entry(regs))
++ forget_syscall(regs);
++ regs->regs[regno] = saved_reg;
++ } else if (!test_thread_flag(TIF_SINGLESTEP)) {
+ tracehook_report_syscall_exit(regs, 0);
+- else if (tracehook_report_syscall_entry(regs))
+- forget_syscall(regs);
++ regs->regs[regno] = saved_reg;
++ } else {
++ regs->regs[regno] = saved_reg;
+
+- regs->regs[regno] = saved_reg;
++ /*
++ * Signal a pseudo-step exception since we are stepping but
++ * tracer modifications to the registers may have rewound the
++ * state machine.
++ */
++ tracehook_report_syscall_exit(regs, 1);
++ }
+ }
+
+ int syscall_trace_enter(struct pt_regs *regs)
+@@ -1675,12 +1686,14 @@ int syscall_trace_enter(struct pt_regs *regs)
+
+ void syscall_trace_exit(struct pt_regs *regs)
+ {
++ unsigned long flags = READ_ONCE(current_thread_info()->flags);
++
+ audit_syscall_exit(regs);
+
+- if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
++ if (flags & _TIF_SYSCALL_TRACEPOINT)
+ trace_sys_exit(regs, regs_return_value(regs));
+
+- if (test_thread_flag(TIF_SYSCALL_TRACE))
++ if (flags & (_TIF_SYSCALL_TRACE | _TIF_SINGLESTEP))
+ tracehook_report_syscall(regs, PTRACE_SYSCALL_EXIT);
+
+ rseq_syscall(regs);
+@@ -1758,8 +1771,8 @@ static int valid_native_regs(struct user_pt_regs *regs)
+ */
+ int valid_user_regs(struct user_pt_regs *regs, struct task_struct *task)
+ {
+- if (!test_tsk_thread_flag(task, TIF_SINGLESTEP))
+- regs->pstate &= ~DBG_SPSR_SS;
++ /* https://lore.kernel.org/lkml/20191118131525.GA4180@willie-the-truck */
++ user_regs_reset_single_step(regs, task);
+
+ if (is_compat_thread(task_thread_info(task)))
+ return valid_compat_regs(regs);
+diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c
+index 5dcc942906db..ca565853dea6 100644
+--- a/arch/arm64/kernel/signal.c
++++ b/arch/arm64/kernel/signal.c
+@@ -798,7 +798,6 @@ static void setup_restart_syscall(struct pt_regs *regs)
+ */
+ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
+ {
+- struct task_struct *tsk = current;
+ sigset_t *oldset = sigmask_to_save();
+ int usig = ksig->sig;
+ int ret;
+@@ -822,14 +821,8 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
+ */
+ ret |= !valid_user_regs(®s->user_regs, current);
+
+- /*
+- * Fast forward the stepping logic so we step into the signal
+- * handler.
+- */
+- if (!ret)
+- user_fastforward_single_step(tsk);
+-
+- signal_setup_done(ret, ksig, 0);
++ /* Step into the signal handler if we are stepping */
++ signal_setup_done(ret, ksig, test_thread_flag(TIF_SINGLESTEP));
+ }
+
+ /*
+diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
+index 871c739f060a..1457a0ba83db 100644
+--- a/arch/arm64/kernel/syscall.c
++++ b/arch/arm64/kernel/syscall.c
+@@ -50,6 +50,9 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno,
+ ret = do_ni_syscall(regs, scno);
+ }
+
++ if (is_compat_task())
++ ret = lower_32_bits(ret);
++
+ regs->regs[0] = ret;
+ }
+
+@@ -121,7 +124,7 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
+ if (!has_syscall_work(flags) && !IS_ENABLED(CONFIG_DEBUG_RSEQ)) {
+ local_daif_mask();
+ flags = current_thread_info()->flags;
+- if (!has_syscall_work(flags)) {
++ if (!has_syscall_work(flags) && !(flags & _TIF_SINGLESTEP)) {
+ /*
+ * We're off to userspace, where interrupts are
+ * always enabled after we restore the flags from
+diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
+index 74e469f8a850..d6050c6e65bc 100644
+--- a/arch/arm64/kernel/vmlinux.lds.S
++++ b/arch/arm64/kernel/vmlinux.lds.S
+@@ -154,9 +154,6 @@ SECTIONS
+ *(.altinstructions)
+ __alt_instructions_end = .;
+ }
+- .altinstr_replacement : {
+- *(.altinstr_replacement)
+- }
+
+ . = ALIGN(PAGE_SIZE);
+ __inittext_end = .;
+diff --git a/arch/ia64/configs/zx1_defconfig b/arch/ia64/configs/zx1_defconfig
+index b504c8e2fd52..7fd4176ea0f6 100644
+--- a/arch/ia64/configs/zx1_defconfig
++++ b/arch/ia64/configs/zx1_defconfig
+@@ -36,7 +36,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=y
+ CONFIG_CHR_DEV_OSST=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_LOGGING=y
+diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
+index 93a3c3c0238c..bd55d9ba7049 100644
+--- a/arch/m68k/configs/amiga_defconfig
++++ b/arch/m68k/configs/amiga_defconfig
+@@ -341,7 +341,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
+index e3d0efd6397d..83789fd6780d 100644
+--- a/arch/m68k/configs/apollo_defconfig
++++ b/arch/m68k/configs/apollo_defconfig
+@@ -328,7 +328,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
+index 75ac0c76e884..db0c0fa6075b 100644
+--- a/arch/m68k/configs/atari_defconfig
++++ b/arch/m68k/configs/atari_defconfig
+@@ -336,7 +336,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
+index c6e492700188..6a64904a5a4c 100644
+--- a/arch/m68k/configs/bvme6000_defconfig
++++ b/arch/m68k/configs/bvme6000_defconfig
+@@ -326,7 +326,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
+index b00d1c477432..dcfa9a3d1a0b 100644
+--- a/arch/m68k/configs/hp300_defconfig
++++ b/arch/m68k/configs/hp300_defconfig
+@@ -328,7 +328,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
+index 85cac3770d89..916dbe2d61c3 100644
+--- a/arch/m68k/configs/mac_defconfig
++++ b/arch/m68k/configs/mac_defconfig
+@@ -335,7 +335,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
+index b3a5d1e99d27..2f5c02089574 100644
+--- a/arch/m68k/configs/multi_defconfig
++++ b/arch/m68k/configs/multi_defconfig
+@@ -358,7 +358,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
+index 0ca22608453f..40240c32418e 100644
+--- a/arch/m68k/configs/mvme147_defconfig
++++ b/arch/m68k/configs/mvme147_defconfig
+@@ -325,7 +325,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
+index 8e3d10d12d9c..34b7038f7de7 100644
+--- a/arch/m68k/configs/mvme16x_defconfig
++++ b/arch/m68k/configs/mvme16x_defconfig
+@@ -326,7 +326,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
+index ff7e653ec7fa..6375a7c86471 100644
+--- a/arch/m68k/configs/q40_defconfig
++++ b/arch/m68k/configs/q40_defconfig
+@@ -333,7 +333,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
+index 612cf46f6d0c..0c38799e9a67 100644
+--- a/arch/m68k/configs/sun3_defconfig
++++ b/arch/m68k/configs/sun3_defconfig
+@@ -323,7 +323,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
+index a6a7bb6dc3fd..8180ef6b6983 100644
+--- a/arch/m68k/configs/sun3x_defconfig
++++ b/arch/m68k/configs/sun3x_defconfig
+@@ -323,7 +323,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SAS_ATTRS=m
+diff --git a/arch/m68k/kernel/setup_no.c b/arch/m68k/kernel/setup_no.c
+index cfd5475bfc31..4625acc1e7c4 100644
+--- a/arch/m68k/kernel/setup_no.c
++++ b/arch/m68k/kernel/setup_no.c
+@@ -140,7 +140,8 @@ void __init setup_arch(char **cmdline_p)
+ pr_debug("MEMORY -> ROMFS=0x%p-0x%06lx MEM=0x%06lx-0x%06lx\n ",
+ __bss_stop, memory_start, memory_start, memory_end);
+
+- memblock_add(memory_start, memory_end - memory_start);
++ memblock_add(_rambase, memory_end - _rambase);
++ memblock_reserve(_rambase, memory_start - _rambase);
+
+ /* Keep a copy of command line */
+ *cmdline_p = &command_line[0];
+diff --git a/arch/m68k/mm/mcfmmu.c b/arch/m68k/mm/mcfmmu.c
+index f5453d944ff5..c5e26222979a 100644
+--- a/arch/m68k/mm/mcfmmu.c
++++ b/arch/m68k/mm/mcfmmu.c
+@@ -160,7 +160,7 @@ void __init cf_bootmem_alloc(void)
+ m68k_memory[0].addr = _rambase;
+ m68k_memory[0].size = _ramend - _rambase;
+
+- memblock_add(m68k_memory[0].addr, m68k_memory[0].size);
++ memblock_add_node(m68k_memory[0].addr, m68k_memory[0].size, 0);
+
+ /* compute total pages in system */
+ num_pages = PFN_DOWN(_ramend - _rambase);
+diff --git a/arch/mips/configs/bigsur_defconfig b/arch/mips/configs/bigsur_defconfig
+index 5e73fe755be6..bd6654299a9c 100644
+--- a/arch/mips/configs/bigsur_defconfig
++++ b/arch/mips/configs/bigsur_defconfig
+@@ -123,7 +123,6 @@ CONFIG_BLK_DEV_TC86C001=m
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_CHR_DEV_SCH=m
+ CONFIG_ATA=y
+diff --git a/arch/mips/configs/fuloong2e_defconfig b/arch/mips/configs/fuloong2e_defconfig
+index 499f51498ecb..8f3e08d8607b 100644
+--- a/arch/mips/configs/fuloong2e_defconfig
++++ b/arch/mips/configs/fuloong2e_defconfig
+@@ -111,7 +111,6 @@ CONFIG_CDROM_PKTCDVD=m
+ CONFIG_ATA_OVER_ETH=m
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ # CONFIG_SCSI_LOWLEVEL is not set
+diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig
+index 91a9c13e2c82..9855addcd7d5 100644
+--- a/arch/mips/configs/ip27_defconfig
++++ b/arch/mips/configs/ip27_defconfig
+@@ -107,7 +107,6 @@ CONFIG_SCSI=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=y
+ CONFIG_BLK_DEV_SR=m
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_CHR_DEV_SCH=m
+ CONFIG_SCSI_CONSTANTS=y
+diff --git a/arch/mips/configs/ip32_defconfig b/arch/mips/configs/ip32_defconfig
+index ebff297328ae..a5f6be4b949b 100644
+--- a/arch/mips/configs/ip32_defconfig
++++ b/arch/mips/configs/ip32_defconfig
+@@ -54,7 +54,6 @@ CONFIG_RAID_ATTRS=y
+ CONFIG_SCSI=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_MULTI_LUN=y
+ CONFIG_SCSI_CONSTANTS=y
+diff --git a/arch/mips/configs/jazz_defconfig b/arch/mips/configs/jazz_defconfig
+index 9ad1c94376c8..aa101c27ed25 100644
+--- a/arch/mips/configs/jazz_defconfig
++++ b/arch/mips/configs/jazz_defconfig
+@@ -206,7 +206,6 @@ CONFIG_SCSI=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_BLK_DEV_SR=m
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SCAN_ASYNC=y
+ CONFIG_SCSI_FC_ATTRS=y
+diff --git a/arch/mips/configs/malta_defconfig b/arch/mips/configs/malta_defconfig
+index 81058295d35f..4338c2189c0f 100644
+--- a/arch/mips/configs/malta_defconfig
++++ b/arch/mips/configs/malta_defconfig
+@@ -245,7 +245,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_LOGGING=y
+diff --git a/arch/mips/configs/malta_kvm_defconfig b/arch/mips/configs/malta_kvm_defconfig
+index 5c10cddc39d3..224718f45393 100644
+--- a/arch/mips/configs/malta_kvm_defconfig
++++ b/arch/mips/configs/malta_kvm_defconfig
+@@ -252,7 +252,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_MULTI_LUN=y
+ CONFIG_SCSI_CONSTANTS=y
+diff --git a/arch/mips/configs/malta_kvm_guest_defconfig b/arch/mips/configs/malta_kvm_guest_defconfig
+index bb694f5065f1..03cf2abe2d65 100644
+--- a/arch/mips/configs/malta_kvm_guest_defconfig
++++ b/arch/mips/configs/malta_kvm_guest_defconfig
+@@ -254,7 +254,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_MULTI_LUN=y
+ CONFIG_SCSI_CONSTANTS=y
+diff --git a/arch/mips/configs/maltaup_xpa_defconfig b/arch/mips/configs/maltaup_xpa_defconfig
+index 99a19cf5f9ba..f64074aa06b6 100644
+--- a/arch/mips/configs/maltaup_xpa_defconfig
++++ b/arch/mips/configs/maltaup_xpa_defconfig
+@@ -250,7 +250,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_LOGGING=y
+diff --git a/arch/mips/configs/rm200_defconfig b/arch/mips/configs/rm200_defconfig
+index 1a3e1fec4e86..194df200daad 100644
+--- a/arch/mips/configs/rm200_defconfig
++++ b/arch/mips/configs/rm200_defconfig
+@@ -218,7 +218,6 @@ CONFIG_SCSI=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_BLK_DEV_SR=m
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SCAN_ASYNC=y
+ CONFIG_SCSI_FC_ATTRS=y
+diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
+index 1e631a484ddf..a0d994a4aaa9 100644
+--- a/arch/mips/kernel/time.c
++++ b/arch/mips/kernel/time.c
+@@ -40,10 +40,8 @@ static unsigned long glb_lpj_ref_freq;
+ static int cpufreq_callback(struct notifier_block *nb,
+ unsigned long val, void *data)
+ {
+- struct cpufreq_freqs *freq = data;
+- struct cpumask *cpus = freq->policy->cpus;
+- unsigned long lpj;
+ int cpu;
++ struct cpufreq_freqs *freq = data;
+
+ /*
+ * Skip lpj numbers adjustment if the CPU-freq transition is safe for
+@@ -64,6 +62,7 @@ static int cpufreq_callback(struct notifier_block *nb,
+ }
+ }
+
++ cpu = freq->cpu;
+ /*
+ * Adjust global lpj variable and per-CPU udelay_val number in
+ * accordance with the new CPU frequency.
+@@ -74,12 +73,8 @@ static int cpufreq_callback(struct notifier_block *nb,
+ glb_lpj_ref_freq,
+ freq->new);
+
+- for_each_cpu(cpu, cpus) {
+- lpj = cpufreq_scale(per_cpu(pcp_lpj_ref, cpu),
+- per_cpu(pcp_lpj_ref_freq, cpu),
+- freq->new);
+- cpu_data[cpu].udelay_val = (unsigned int)lpj;
+- }
++ cpu_data[cpu].udelay_val = cpufreq_scale(per_cpu(pcp_lpj_ref, cpu),
++ per_cpu(pcp_lpj_ref_freq, cpu), freq->new);
+ }
+
+ return NOTIFY_OK;
+diff --git a/arch/powerpc/configs/85xx-hw.config b/arch/powerpc/configs/85xx-hw.config
+index c03d0fb16665..9144e4cbc42e 100644
+--- a/arch/powerpc/configs/85xx-hw.config
++++ b/arch/powerpc/configs/85xx-hw.config
+@@ -2,7 +2,6 @@ CONFIG_AQUANTIA_PHY=y
+ CONFIG_AT803X_PHY=y
+ CONFIG_ATA=y
+ CONFIG_BLK_DEV_SD=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_BLK_DEV_SR=y
+ CONFIG_BROADCOM_PHY=y
+ CONFIG_C293_PCIE=y
+diff --git a/arch/powerpc/configs/amigaone_defconfig b/arch/powerpc/configs/amigaone_defconfig
+index 12f397d403c6..8ddab7c240d9 100644
+--- a/arch/powerpc/configs/amigaone_defconfig
++++ b/arch/powerpc/configs/amigaone_defconfig
+@@ -48,7 +48,6 @@ CONFIG_BLK_DEV_RAM=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SYM53C8XX_2=y
+diff --git a/arch/powerpc/configs/chrp32_defconfig b/arch/powerpc/configs/chrp32_defconfig
+index a203b1cf67d3..796d34734b91 100644
+--- a/arch/powerpc/configs/chrp32_defconfig
++++ b/arch/powerpc/configs/chrp32_defconfig
+@@ -46,7 +46,6 @@ CONFIG_BLK_DEV_RAM=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SYM53C8XX_2=y
+diff --git a/arch/powerpc/configs/g5_defconfig b/arch/powerpc/configs/g5_defconfig
+index 67c39f4acede..0123e3b00901 100644
+--- a/arch/powerpc/configs/g5_defconfig
++++ b/arch/powerpc/configs/g5_defconfig
+@@ -63,7 +63,6 @@ CONFIG_CDROM_PKTCDVD=m
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SPI_ATTRS=y
+diff --git a/arch/powerpc/configs/maple_defconfig b/arch/powerpc/configs/maple_defconfig
+index 59e47ec85336..9df11592880d 100644
+--- a/arch/powerpc/configs/maple_defconfig
++++ b/arch/powerpc/configs/maple_defconfig
+@@ -42,7 +42,6 @@ CONFIG_BLK_DEV_RAM_SIZE=8192
+ # CONFIG_SCSI_PROC_FS is not set
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_IPR=y
+ CONFIG_ATA=y
+diff --git a/arch/powerpc/configs/pasemi_defconfig b/arch/powerpc/configs/pasemi_defconfig
+index 6daa56f8895c..4504380c7a92 100644
+--- a/arch/powerpc/configs/pasemi_defconfig
++++ b/arch/powerpc/configs/pasemi_defconfig
+@@ -61,7 +61,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=y
+ CONFIG_CHR_DEV_OSST=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_CHR_DEV_SCH=y
+ CONFIG_SCSI_CONSTANTS=y
+diff --git a/arch/powerpc/configs/pmac32_defconfig b/arch/powerpc/configs/pmac32_defconfig
+index 62948d198d7f..212a68b65d9f 100644
+--- a/arch/powerpc/configs/pmac32_defconfig
++++ b/arch/powerpc/configs/pmac32_defconfig
+@@ -121,7 +121,6 @@ CONFIG_BLK_DEV_RAM=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_FC_ATTRS=y
+diff --git a/arch/powerpc/configs/powernv_defconfig b/arch/powerpc/configs/powernv_defconfig
+index 6ab34e60495f..5a533c9f6b3d 100644
+--- a/arch/powerpc/configs/powernv_defconfig
++++ b/arch/powerpc/configs/powernv_defconfig
+@@ -109,7 +109,6 @@ CONFIG_BLK_DEV_NVME=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_BLK_DEV_SR=m
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SCAN_ASYNC=y
+diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
+index 5033e630afea..d9fdf05599c9 100644
+--- a/arch/powerpc/configs/ppc64_defconfig
++++ b/arch/powerpc/configs/ppc64_defconfig
+@@ -93,7 +93,6 @@ CONFIG_VIRTIO_BLK=m
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_FC_ATTRS=y
+diff --git a/arch/powerpc/configs/ppc64e_defconfig b/arch/powerpc/configs/ppc64e_defconfig
+index 41d85cb3c9a2..a5e36faef391 100644
+--- a/arch/powerpc/configs/ppc64e_defconfig
++++ b/arch/powerpc/configs/ppc64e_defconfig
+@@ -61,7 +61,6 @@ CONFIG_BLK_DEV_RAM_SIZE=65536
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_FC_ATTRS=y
+diff --git a/arch/powerpc/configs/ppc6xx_defconfig b/arch/powerpc/configs/ppc6xx_defconfig
+index 7ee736f20774..7032d4244ec5 100644
+--- a/arch/powerpc/configs/ppc6xx_defconfig
++++ b/arch/powerpc/configs/ppc6xx_defconfig
+@@ -374,7 +374,6 @@ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_CHR_DEV_OSST=m
+ CONFIG_BLK_DEV_SR=m
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_CHR_DEV_SCH=m
+ CONFIG_SCSI_ENCLOSURE=m
+diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
+index 0dd5cf7b566d..780552be29f9 100644
+--- a/arch/powerpc/configs/pseries_defconfig
++++ b/arch/powerpc/configs/pseries_defconfig
+@@ -97,7 +97,6 @@ CONFIG_VIRTIO_BLK=m
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_ST=m
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_FC_ATTRS=y
+diff --git a/arch/powerpc/configs/skiroot_defconfig b/arch/powerpc/configs/skiroot_defconfig
+index ffeaed63675b..82611dea62bd 100644
+--- a/arch/powerpc/configs/skiroot_defconfig
++++ b/arch/powerpc/configs/skiroot_defconfig
+@@ -77,7 +77,6 @@ CONFIG_EEPROM_AT24=y
+ # CONFIG_CXL is not set
+ CONFIG_BLK_DEV_SD=m
+ CONFIG_BLK_DEV_SR=m
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SCAN_ASYNC=y
+diff --git a/arch/powerpc/mm/pkeys.c b/arch/powerpc/mm/pkeys.c
+index 25a8dd9cd71d..7124af17da72 100644
+--- a/arch/powerpc/mm/pkeys.c
++++ b/arch/powerpc/mm/pkeys.c
+@@ -365,12 +365,14 @@ static bool pkey_access_permitted(int pkey, bool write, bool execute)
+ return true;
+
+ pkey_shift = pkeyshift(pkey);
+- if (execute && !(read_iamr() & (IAMR_EX_BIT << pkey_shift)))
+- return true;
++ if (execute)
++ return !(read_iamr() & (IAMR_EX_BIT << pkey_shift));
++
++ amr = read_amr();
++ if (write)
++ return !(amr & (AMR_WR_BIT << pkey_shift));
+
+- amr = read_amr(); /* Delay reading amr until absolutely needed */
+- return ((!write && !(amr & (AMR_RD_BIT << pkey_shift))) ||
+- (write && !(amr & (AMR_WR_BIT << pkey_shift))));
++ return !(amr & (AMR_RD_BIT << pkey_shift));
+ }
+
+ bool arch_pte_access_permitted(u64 pte, bool write, bool execute)
+diff --git a/arch/riscv/include/asm/thread_info.h b/arch/riscv/include/asm/thread_info.h
+index f8fa1cd2dad9..131f58b26b8f 100644
+--- a/arch/riscv/include/asm/thread_info.h
++++ b/arch/riscv/include/asm/thread_info.h
+@@ -20,7 +20,11 @@
+ #include <linux/const.h>
+
+ /* thread information allocation */
++#ifdef CONFIG_64BIT
++#define THREAD_SIZE_ORDER (2)
++#else
+ #define THREAD_SIZE_ORDER (1)
++#endif
+ #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER)
+
+ #ifndef __ASSEMBLY__
+diff --git a/arch/sh/configs/sh03_defconfig b/arch/sh/configs/sh03_defconfig
+index 2156223405a1..ecc736504a04 100644
+--- a/arch/sh/configs/sh03_defconfig
++++ b/arch/sh/configs/sh03_defconfig
+@@ -47,7 +47,6 @@ CONFIG_BLK_DEV_IDETAPE=m
+ CONFIG_SCSI=m
+ CONFIG_BLK_DEV_SD=m
+ CONFIG_BLK_DEV_SR=m
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_NETDEVICES=y
+ CONFIG_NET_ETHERNET=y
+diff --git a/arch/sparc/configs/sparc64_defconfig b/arch/sparc/configs/sparc64_defconfig
+index 4d4e1cc6402f..fc45ec682e7a 100644
+--- a/arch/sparc/configs/sparc64_defconfig
++++ b/arch/sparc/configs/sparc64_defconfig
+@@ -74,7 +74,6 @@ CONFIG_RAID_ATTRS=m
+ CONFIG_SCSI=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_BLK_DEV_SR=m
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=m
+ CONFIG_SCSI_MULTI_LUN=y
+ CONFIG_SCSI_CONSTANTS=y
+diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig
+index 0eb9f92f3717..ce75be940567 100644
+--- a/arch/x86/configs/i386_defconfig
++++ b/arch/x86/configs/i386_defconfig
+@@ -149,7 +149,6 @@ CONFIG_CONNECTOR=y
+ CONFIG_BLK_DEV_LOOP=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SPI_ATTRS=y
+diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
+index e32fc1f274d8..45b0f4d84d83 100644
+--- a/arch/x86/configs/x86_64_defconfig
++++ b/arch/x86/configs/x86_64_defconfig
+@@ -148,7 +148,6 @@ CONFIG_CONNECTOR=y
+ CONFIG_BLK_DEV_LOOP=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_BLK_DEV_SR=y
+-CONFIG_BLK_DEV_SR_VENDOR=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_SCSI_CONSTANTS=y
+ CONFIG_SCSI_SPI_ATTRS=y
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index c352ca2e1456..e41be2c25da8 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -448,12 +448,10 @@ static int x86_vector_activate(struct irq_domain *dom, struct irq_data *irqd,
+ trace_vector_activate(irqd->irq, apicd->is_managed,
+ apicd->can_reserve, reserve);
+
+- /* Nothing to do for fixed assigned vectors */
+- if (!apicd->can_reserve && !apicd->is_managed)
+- return 0;
+-
+ raw_spin_lock_irqsave(&vector_lock, flags);
+- if (reserve || irqd_is_managed_and_shutdown(irqd))
++ if (!apicd->can_reserve && !apicd->is_managed)
++ assign_irq_vector_any_locked(irqd);
++ else if (reserve || irqd_is_managed_and_shutdown(irqd))
+ vector_assign_managed_shutdown(irqd);
+ else if (apicd->is_managed)
+ ret = activate_managed(irqd);
+@@ -771,20 +769,10 @@ void lapic_offline(void)
+ static int apic_set_affinity(struct irq_data *irqd,
+ const struct cpumask *dest, bool force)
+ {
+- struct apic_chip_data *apicd = apic_chip_data(irqd);
+ int err;
+
+- /*
+- * Core code can call here for inactive interrupts. For inactive
+- * interrupts which use managed or reservation mode there is no
+- * point in going through the vector assignment right now as the
+- * activation will assign a vector which fits the destination
+- * cpumask. Let the core code store the destination mask and be
+- * done with it.
+- */
+- if (!irqd_is_activated(irqd) &&
+- (apicd->is_managed || apicd->can_reserve))
+- return IRQ_SET_MASK_OK;
++ if (WARN_ON_ONCE(!irqd_is_activated(irqd)))
++ return -EIO;
+
+ raw_spin_lock(&vector_lock);
+ cpumask_and(vector_searchmask, dest, cpu_online_mask);
+diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
+index 61c2fb8b1f8e..4b900035f220 100644
+--- a/arch/x86/kernel/fpu/xstate.c
++++ b/arch/x86/kernel/fpu/xstate.c
+@@ -1029,7 +1029,7 @@ int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int of
+ copy_part(offsetof(struct fxregs_state, st_space), 128,
+ &xsave->i387.st_space, &kbuf, &offset_start, &count);
+ if (header.xfeatures & XFEATURE_MASK_SSE)
+- copy_part(xstate_offsets[XFEATURE_MASK_SSE], 256,
++ copy_part(xstate_offsets[XFEATURE_SSE], 256,
+ &xsave->i387.xmm_space, &kbuf, &offset_start, &count);
+ /*
+ * Fill xsave->i387.sw_reserved value for ptrace frame:
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 214c4e2e8ade..ab1da5e6e7e3 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -328,6 +328,25 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 7510"),
+ },
+ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "Acer Aspire 5738z",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"),
++ DMI_MATCH(DMI_BOARD_NAME, "JV50"),
++ },
++ },
++ {
++ /* https://bugzilla.kernel.org/show_bug.cgi?id=207835 */
++ .callback = video_detect_force_native,
++ .ident = "Acer TravelMate 5735Z",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 5735Z"),
++ DMI_MATCH(DMI_BOARD_NAME, "BA51_MV"),
++ },
++ },
+
+ /*
+ * Desktops which falsely report a backlight and which our heuristics
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index c9687c8b2347..056e34ce1edd 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -453,29 +453,31 @@ static ssize_t regmap_cache_only_write_file(struct file *file,
+ {
+ struct regmap *map = container_of(file->private_data,
+ struct regmap, cache_only);
+- ssize_t result;
+- bool was_enabled, require_sync = false;
++ bool new_val, require_sync = false;
+ int err;
+
+- map->lock(map->lock_arg);
++ err = kstrtobool_from_user(user_buf, count, &new_val);
++ /* Ignore malforned data like debugfs_write_file_bool() */
++ if (err)
++ return count;
+
+- was_enabled = map->cache_only;
++ err = debugfs_file_get(file->f_path.dentry);
++ if (err)
++ return err;
+
+- result = debugfs_write_file_bool(file, user_buf, count, ppos);
+- if (result < 0) {
+- map->unlock(map->lock_arg);
+- return result;
+- }
++ map->lock(map->lock_arg);
+
+- if (map->cache_only && !was_enabled) {
++ if (new_val && !map->cache_only) {
+ dev_warn(map->dev, "debugfs cache_only=Y forced\n");
+ add_taint(TAINT_USER, LOCKDEP_STILL_OK);
+- } else if (!map->cache_only && was_enabled) {
++ } else if (!new_val && map->cache_only) {
+ dev_warn(map->dev, "debugfs cache_only=N forced: syncing cache\n");
+ require_sync = true;
+ }
++ map->cache_only = new_val;
+
+ map->unlock(map->lock_arg);
++ debugfs_file_put(file->f_path.dentry);
+
+ if (require_sync) {
+ err = regcache_sync(map);
+@@ -483,7 +485,7 @@ static ssize_t regmap_cache_only_write_file(struct file *file,
+ dev_err(map->dev, "Failed to sync cache %d\n", err);
+ }
+
+- return result;
++ return count;
+ }
+
+ static const struct file_operations regmap_cache_only_fops = {
+@@ -498,28 +500,32 @@ static ssize_t regmap_cache_bypass_write_file(struct file *file,
+ {
+ struct regmap *map = container_of(file->private_data,
+ struct regmap, cache_bypass);
+- ssize_t result;
+- bool was_enabled;
++ bool new_val;
++ int err;
+
+- map->lock(map->lock_arg);
++ err = kstrtobool_from_user(user_buf, count, &new_val);
++ /* Ignore malforned data like debugfs_write_file_bool() */
++ if (err)
++ return count;
+
+- was_enabled = map->cache_bypass;
++ err = debugfs_file_get(file->f_path.dentry);
++ if (err)
++ return err;
+
+- result = debugfs_write_file_bool(file, user_buf, count, ppos);
+- if (result < 0)
+- goto out;
++ map->lock(map->lock_arg);
+
+- if (map->cache_bypass && !was_enabled) {
++ if (new_val && !map->cache_bypass) {
+ dev_warn(map->dev, "debugfs cache_bypass=Y forced\n");
+ add_taint(TAINT_USER, LOCKDEP_STILL_OK);
+- } else if (!map->cache_bypass && was_enabled) {
++ } else if (!new_val && map->cache_bypass) {
+ dev_warn(map->dev, "debugfs cache_bypass=N forced\n");
+ }
++ map->cache_bypass = new_val;
+
+-out:
+ map->unlock(map->lock_arg);
++ debugfs_file_put(file->f_path.dentry);
+
+- return result;
++ return count;
+ }
+
+ static const struct file_operations regmap_cache_bypass_fops = {
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 76abe40bfa83..52850c10165e 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -1802,7 +1802,8 @@ static ssize_t hot_add_show(struct class *class,
+ return ret;
+ return scnprintf(buf, PAGE_SIZE, "%d\n", ret);
+ }
+-static CLASS_ATTR_RO(hot_add);
++static struct class_attribute class_attr_hot_add =
++ __ATTR(hot_add, 0400, hot_add_show, NULL);
+
+ static ssize_t hot_remove_store(struct class *class,
+ struct class_attribute *attr,
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 5d8f8f018984..280d60cba1f8 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -1007,7 +1007,7 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+
+ return 0;
+ out_err:
+- if ((chip->ops != NULL) && (chip->ops->clk_enable != NULL))
++ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, false);
+
+ tpm_tis_remove(chip);
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index b353a5e5f8b1..ca71ee939533 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -2142,6 +2142,7 @@ static struct virtio_device_id id_table[] = {
+ { VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID },
+ { 0 },
+ };
++MODULE_DEVICE_TABLE(virtio, id_table);
+
+ static unsigned int features[] = {
+ VIRTIO_CONSOLE_F_SIZE,
+@@ -2154,6 +2155,7 @@ static struct virtio_device_id rproc_serial_id_table[] = {
+ #endif
+ { 0 },
+ };
++MODULE_DEVICE_TABLE(virtio, rproc_serial_id_table);
+
+ static unsigned int rproc_serial_features[] = {
+ };
+@@ -2306,6 +2308,5 @@ static void __exit fini(void)
+ module_init(init);
+ module_exit(fini);
+
+-MODULE_DEVICE_TABLE(virtio, id_table);
+ MODULE_DESCRIPTION("Virtio console driver");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c
+index c7568869284e..0d2c6e13a01f 100644
+--- a/drivers/dma/fsl-edma.c
++++ b/drivers/dma/fsl-edma.c
+@@ -682,6 +682,13 @@ static irqreturn_t fsl_edma_tx_handler(int irq, void *dev_id)
+ fsl_chan = &fsl_edma->chans[ch];
+
+ spin_lock(&fsl_chan->vchan.lock);
++
++ if (!fsl_chan->edesc) {
++ /* terminate_all called before */
++ spin_unlock(&fsl_chan->vchan.lock);
++ continue;
++ }
++
+ if (!fsl_chan->edesc->iscyclic) {
+ list_del(&fsl_chan->edesc->vdesc.node);
+ vchan_cookie_complete(&fsl_chan->edesc->vdesc);
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_mic.c b/drivers/gpu/drm/exynos/exynos_drm_mic.c
+index 2fd299a58297..cd5530bbfe2e 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_mic.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_mic.c
+@@ -267,8 +267,10 @@ static void mic_pre_enable(struct drm_bridge *bridge)
+ goto unlock;
+
+ ret = pm_runtime_get_sync(mic->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(mic->dev);
+ goto unlock;
++ }
+
+ mic_set_path(mic, 1);
+
+diff --git a/drivers/gpu/drm/msm/msm_submitqueue.c b/drivers/gpu/drm/msm/msm_submitqueue.c
+index 5115f75b5b7f..325da440264a 100644
+--- a/drivers/gpu/drm/msm/msm_submitqueue.c
++++ b/drivers/gpu/drm/msm/msm_submitqueue.c
+@@ -78,8 +78,10 @@ int msm_submitqueue_create(struct drm_device *drm, struct msm_file_private *ctx,
+ queue->flags = flags;
+
+ if (priv->gpu) {
+- if (prio >= priv->gpu->nr_rings)
++ if (prio >= priv->gpu->nr_rings) {
++ kfree(queue);
+ return -EINVAL;
++ }
+
+ queue->prio = prio;
+ }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index f8026c71e2e4..20530d8adfbb 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -609,6 +609,7 @@
+ #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081 0xa081
+ #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2 0xa0c2
+ #define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096 0xa096
++#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293 0xa293
+
+ #define USB_VENDOR_ID_IMATION 0x0718
+ #define USB_DEVICE_ID_DISC_STAKKA 0xd000
+@@ -972,6 +973,8 @@
+ #define USB_DEVICE_ID_ROCCAT_RYOS_MK_PRO 0x3232
+ #define USB_DEVICE_ID_ROCCAT_SAVU 0x2d5a
+
++#define USB_VENDOR_ID_SAI 0x17dd
++
+ #define USB_VENDOR_ID_SAITEK 0x06a3
+ #define USB_DEVICE_ID_SAITEK_RUMBLEPAD 0xff17
+ #define USB_DEVICE_ID_SAITEK_PS1000 0x0621
+diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
+index b454c4386157..8af62696f2ca 100644
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -452,6 +452,12 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
+ __set_bit(MSC_RAW, input->mscbit);
+ }
+
++ /*
++ * hid-input may mark device as using autorepeat, but neither
++ * the trackpad, nor the mouse actually want it.
++ */
++ __clear_bit(EV_REP, input->evbit);
++
+ return 0;
+ }
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index f4bab7004aff..bdde16395b2c 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -90,6 +90,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096), HID_QUIRK_NO_INIT_REPORTS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+@@ -400,9 +401,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) },
+ #endif
+-#if IS_ENABLED(CONFIG_HID_ITE)
+- { HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE8595) },
+-#endif
+ #if IS_ENABLED(CONFIG_HID_ICADE)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
+ #endif
+@@ -878,6 +876,7 @@ static const struct hid_device_id hid_ignore_list[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_PETZL, USB_DEVICE_ID_PETZL_HEADLAMP) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PHILIPS, USB_DEVICE_ID_PHILIPS_IEEE802154_DONGLE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_POWERCOM, USB_DEVICE_ID_POWERCOM_UPS) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAI, USB_DEVICE_ID_CYPRESS_HIDCOM) },
+ #if IS_ENABLED(CONFIG_MOUSE_SYNAPTICS_USB)
+ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_INT_TP) },
+diff --git a/drivers/hwmon/emc2103.c b/drivers/hwmon/emc2103.c
+index 1ed9a7aa953d..f4985622b179 100644
+--- a/drivers/hwmon/emc2103.c
++++ b/drivers/hwmon/emc2103.c
+@@ -454,7 +454,7 @@ static ssize_t pwm1_enable_store(struct device *dev,
+ }
+
+ result = read_u8_from_i2c(client, REG_FAN_CONF1, &conf_reg);
+- if (result) {
++ if (result < 0) {
+ count = result;
+ goto err;
+ }
+diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
+index a8e750291643..6c723b57dfc0 100644
+--- a/drivers/hwtracing/intel_th/core.c
++++ b/drivers/hwtracing/intel_th/core.c
+@@ -944,15 +944,30 @@ int intel_th_set_output(struct intel_th_device *thdev,
+ {
+ struct intel_th_device *hub = to_intel_th_hub(thdev);
+ struct intel_th_driver *hubdrv = to_intel_th_driver(hub->dev.driver);
++ int ret;
+
+ /* In host mode, this is up to the external debugger, do nothing. */
+ if (hub->host_mode)
+ return 0;
+
+- if (!hubdrv->set_output)
+- return -ENOTSUPP;
++ /*
++ * hub is instantiated together with the source device that
++ * calls here, so guaranteed to be present.
++ */
++ hubdrv = to_intel_th_driver(hub->dev.driver);
++ if (!hubdrv || !try_module_get(hubdrv->driver.owner))
++ return -EINVAL;
++
++ if (!hubdrv->set_output) {
++ ret = -ENOTSUPP;
++ goto out;
++ }
++
++ ret = hubdrv->set_output(hub, master);
+
+- return hubdrv->set_output(hub, master);
++out:
++ module_put(hubdrv->driver.owner);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(intel_th_set_output);
+
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 8424c8c61355..a775d7acfa47 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -205,11 +205,21 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Tiger Lake PCH-H */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x43a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ {
+ /* Jasper Lake PCH */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Jasper Lake CPU */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4e29),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ {
+ /* Elkhart Lake CPU */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4529),
+@@ -220,6 +230,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Emmitsburg PCH */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x1bcc),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ { 0 },
+ };
+
+diff --git a/drivers/hwtracing/intel_th/sth.c b/drivers/hwtracing/intel_th/sth.c
+index 4b7ae47789d2..61e631358e9d 100644
+--- a/drivers/hwtracing/intel_th/sth.c
++++ b/drivers/hwtracing/intel_th/sth.c
+@@ -157,9 +157,7 @@ static int sth_stm_link(struct stm_data *stm_data, unsigned int master,
+ {
+ struct sth_device *sth = container_of(stm_data, struct sth_device, stm);
+
+- intel_th_set_output(to_intel_th_device(sth->dev), master);
+-
+- return 0;
++ return intel_th_set_output(to_intel_th_device(sth->dev), master);
+ }
+
+ static int intel_th_sw_init(struct sth_device *sth)
+diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
+index 231675b10376..44025507b8f7 100644
+--- a/drivers/i2c/busses/i2c-eg20t.c
++++ b/drivers/i2c/busses/i2c-eg20t.c
+@@ -188,6 +188,7 @@ static const struct pci_device_id pch_pcidev_id[] = {
+ { PCI_VDEVICE(ROHM, PCI_DEVICE_ID_ML7831_I2C), 1, },
+ {0,}
+ };
++MODULE_DEVICE_TABLE(pci, pch_pcidev_id);
+
+ static irqreturn_t pch_i2c_handler(int irq, void *pData);
+
+diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
+index 421a0a8a1379..fcfec758fec6 100644
+--- a/drivers/iio/accel/mma8452.c
++++ b/drivers/iio/accel/mma8452.c
+@@ -1651,10 +1651,13 @@ static int mma8452_probe(struct i2c_client *client,
+
+ ret = mma8452_set_freefall_mode(data, false);
+ if (ret < 0)
+- goto buffer_cleanup;
++ goto unregister_device;
+
+ return 0;
+
++unregister_device:
++ iio_device_unregister(indio_dev);
++
+ buffer_cleanup:
+ iio_triggered_buffer_cleanup(indio_dev);
+
+diff --git a/drivers/iio/health/afe4403.c b/drivers/iio/health/afe4403.c
+index a739fff01c6b..63210a3b1b87 100644
+--- a/drivers/iio/health/afe4403.c
++++ b/drivers/iio/health/afe4403.c
+@@ -71,6 +71,7 @@ static const struct reg_field afe4403_reg_fields[] = {
+ * @regulator: Pointer to the regulator for the IC
+ * @trig: IIO trigger for this device
+ * @irq: ADC_RDY line interrupt number
++ * @buffer: Used to construct data layout to push into IIO buffer.
+ */
+ struct afe4403_data {
+ struct device *dev;
+@@ -80,6 +81,8 @@ struct afe4403_data {
+ struct regulator *regulator;
+ struct iio_trigger *trig;
+ int irq;
++ /* Ensure suitable alignment for timestamp */
++ s32 buffer[8] __aligned(8);
+ };
+
+ enum afe4403_chan_id {
+@@ -317,7 +320,6 @@ static irqreturn_t afe4403_trigger_handler(int irq, void *private)
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct afe4403_data *afe = iio_priv(indio_dev);
+ int ret, bit, i = 0;
+- s32 buffer[8];
+ u8 tx[4] = {AFE440X_CONTROL0, 0x0, 0x0, AFE440X_CONTROL0_READ};
+ u8 rx[3];
+
+@@ -334,9 +336,9 @@ static irqreturn_t afe4403_trigger_handler(int irq, void *private)
+ if (ret)
+ goto err;
+
+- buffer[i++] = (rx[0] << 16) |
+- (rx[1] << 8) |
+- (rx[2]);
++ afe->buffer[i++] = (rx[0] << 16) |
++ (rx[1] << 8) |
++ (rx[2]);
+ }
+
+ /* Disable reading from the device */
+@@ -345,7 +347,8 @@ static irqreturn_t afe4403_trigger_handler(int irq, void *private)
+ if (ret)
+ goto err;
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp);
++ iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer,
++ pf->timestamp);
+ err:
+ iio_trigger_notify_done(indio_dev->trig);
+
+diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c
+index 11910922e655..23e1ac6501a1 100644
+--- a/drivers/iio/health/afe4404.c
++++ b/drivers/iio/health/afe4404.c
+@@ -91,6 +91,7 @@ static const struct reg_field afe4404_reg_fields[] = {
+ * @regulator: Pointer to the regulator for the IC
+ * @trig: IIO trigger for this device
+ * @irq: ADC_RDY line interrupt number
++ * @buffer: Used to construct a scan to push to the iio buffer.
+ */
+ struct afe4404_data {
+ struct device *dev;
+@@ -99,6 +100,7 @@ struct afe4404_data {
+ struct regulator *regulator;
+ struct iio_trigger *trig;
+ int irq;
++ s32 buffer[10] __aligned(8);
+ };
+
+ enum afe4404_chan_id {
+@@ -336,17 +338,17 @@ static irqreturn_t afe4404_trigger_handler(int irq, void *private)
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct afe4404_data *afe = iio_priv(indio_dev);
+ int ret, bit, i = 0;
+- s32 buffer[10];
+
+ for_each_set_bit(bit, indio_dev->active_scan_mask,
+ indio_dev->masklength) {
+ ret = regmap_read(afe->regmap, afe4404_channel_values[bit],
+- &buffer[i++]);
++ &afe->buffer[i++]);
+ if (ret)
+ goto err;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp);
++ iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer,
++ pf->timestamp);
+ err:
+ iio_trigger_notify_done(indio_dev->trig);
+
+diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c
+index ff6666ac5d68..0fcaa2c0b2f4 100644
+--- a/drivers/iio/humidity/hdc100x.c
++++ b/drivers/iio/humidity/hdc100x.c
+@@ -38,6 +38,11 @@ struct hdc100x_data {
+
+ /* integration time of the sensor */
+ int adc_int_us[2];
++ /* Ensure natural alignment of timestamp */
++ struct {
++ __be16 channels[2];
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ /* integration time in us */
+@@ -319,7 +324,6 @@ static irqreturn_t hdc100x_trigger_handler(int irq, void *p)
+ struct i2c_client *client = data->client;
+ int delay = data->adc_int_us[0] + data->adc_int_us[1];
+ int ret;
+- s16 buf[8]; /* 2x s16 + padding + 8 byte timestamp */
+
+ /* dual read starts at temp register */
+ mutex_lock(&data->lock);
+@@ -330,13 +334,13 @@ static irqreturn_t hdc100x_trigger_handler(int irq, void *p)
+ }
+ usleep_range(delay, delay + 1000);
+
+- ret = i2c_master_recv(client, (u8 *)buf, 4);
++ ret = i2c_master_recv(client, (u8 *)data->scan.channels, 4);
+ if (ret < 0) {
+ dev_err(&client->dev, "cannot read sensor data\n");
+ goto err;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buf,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ iio_get_time_ns(indio_dev));
+ err:
+ mutex_unlock(&data->lock);
+diff --git a/drivers/iio/humidity/hts221.h b/drivers/iio/humidity/hts221.h
+index e41a3d83e95d..838c05056075 100644
+--- a/drivers/iio/humidity/hts221.h
++++ b/drivers/iio/humidity/hts221.h
+@@ -15,8 +15,6 @@
+
+ #include <linux/iio/iio.h>
+
+-#define HTS221_DATA_SIZE 2
+-
+ enum hts221_sensor_type {
+ HTS221_SENSOR_H,
+ HTS221_SENSOR_T,
+@@ -40,6 +38,11 @@ struct hts221_hw {
+
+ bool enabled;
+ u8 odr;
++ /* Ensure natural alignment of timestamp */
++ struct {
++ __le16 channels[2];
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ extern const struct dev_pm_ops hts221_pm_ops;
+diff --git a/drivers/iio/humidity/hts221_buffer.c b/drivers/iio/humidity/hts221_buffer.c
+index 1a94b0b91721..910a5d4eae23 100644
+--- a/drivers/iio/humidity/hts221_buffer.c
++++ b/drivers/iio/humidity/hts221_buffer.c
+@@ -163,7 +163,6 @@ static const struct iio_buffer_setup_ops hts221_buffer_ops = {
+
+ static irqreturn_t hts221_buffer_handler_thread(int irq, void *p)
+ {
+- u8 buffer[ALIGN(2 * HTS221_DATA_SIZE, sizeof(s64)) + sizeof(s64)];
+ struct iio_poll_func *pf = p;
+ struct iio_dev *iio_dev = pf->indio_dev;
+ struct hts221_hw *hw = iio_priv(iio_dev);
+@@ -173,18 +172,20 @@ static irqreturn_t hts221_buffer_handler_thread(int irq, void *p)
+ /* humidity data */
+ ch = &iio_dev->channels[HTS221_SENSOR_H];
+ err = regmap_bulk_read(hw->regmap, ch->address,
+- buffer, HTS221_DATA_SIZE);
++ &hw->scan.channels[0],
++ sizeof(hw->scan.channels[0]));
+ if (err < 0)
+ goto out;
+
+ /* temperature data */
+ ch = &iio_dev->channels[HTS221_SENSOR_T];
+ err = regmap_bulk_read(hw->regmap, ch->address,
+- buffer + HTS221_DATA_SIZE, HTS221_DATA_SIZE);
++ &hw->scan.channels[1],
++ sizeof(hw->scan.channels[1]));
+ if (err < 0)
+ goto out;
+
+- iio_push_to_buffers_with_timestamp(iio_dev, buffer,
++ iio_push_to_buffers_with_timestamp(iio_dev, &hw->scan,
+ iio_get_time_ns(iio_dev));
+
+ out:
+diff --git a/drivers/iio/magnetometer/ak8974.c b/drivers/iio/magnetometer/ak8974.c
+index 806a3185b66d..d3f09405c00b 100644
+--- a/drivers/iio/magnetometer/ak8974.c
++++ b/drivers/iio/magnetometer/ak8974.c
+@@ -184,6 +184,11 @@ struct ak8974 {
+ bool drdy_irq;
+ struct completion drdy_complete;
+ bool drdy_active_low;
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ __le16 channels[3];
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ static const char ak8974_reg_avdd[] = "avdd";
+@@ -580,7 +585,6 @@ static void ak8974_fill_buffer(struct iio_dev *indio_dev)
+ {
+ struct ak8974 *ak8974 = iio_priv(indio_dev);
+ int ret;
+- __le16 hw_values[8]; /* Three axes + 64bit padding */
+
+ pm_runtime_get_sync(&ak8974->i2c->dev);
+ mutex_lock(&ak8974->lock);
+@@ -590,13 +594,13 @@ static void ak8974_fill_buffer(struct iio_dev *indio_dev)
+ dev_err(&ak8974->i2c->dev, "error triggering measure\n");
+ goto out_unlock;
+ }
+- ret = ak8974_getresult(ak8974, hw_values);
++ ret = ak8974_getresult(ak8974, ak8974->scan.channels);
+ if (ret) {
+ dev_err(&ak8974->i2c->dev, "error getting measures\n");
+ goto out_unlock;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, hw_values,
++ iio_push_to_buffers_with_timestamp(indio_dev, &ak8974->scan,
+ iio_get_time_ns(indio_dev));
+
+ out_unlock:
+@@ -764,19 +768,21 @@ static int ak8974_probe(struct i2c_client *i2c,
+ ak8974->map = devm_regmap_init_i2c(i2c, &ak8974_regmap_config);
+ if (IS_ERR(ak8974->map)) {
+ dev_err(&i2c->dev, "failed to allocate register map\n");
++ pm_runtime_put_noidle(&i2c->dev);
++ pm_runtime_disable(&i2c->dev);
+ return PTR_ERR(ak8974->map);
+ }
+
+ ret = ak8974_set_power(ak8974, AK8974_PWR_ON);
+ if (ret) {
+ dev_err(&i2c->dev, "could not power on\n");
+- goto power_off;
++ goto disable_pm;
+ }
+
+ ret = ak8974_detect(ak8974);
+ if (ret) {
+ dev_err(&i2c->dev, "neither AK8974 nor AMI30x found\n");
+- goto power_off;
++ goto disable_pm;
+ }
+
+ ret = ak8974_selftest(ak8974);
+@@ -786,14 +792,9 @@ static int ak8974_probe(struct i2c_client *i2c,
+ ret = ak8974_reset(ak8974);
+ if (ret) {
+ dev_err(&i2c->dev, "AK8974 reset failed\n");
+- goto power_off;
++ goto disable_pm;
+ }
+
+- pm_runtime_set_autosuspend_delay(&i2c->dev,
+- AK8974_AUTOSUSPEND_DELAY);
+- pm_runtime_use_autosuspend(&i2c->dev);
+- pm_runtime_put(&i2c->dev);
+-
+ indio_dev->dev.parent = &i2c->dev;
+ indio_dev->channels = ak8974_channels;
+ indio_dev->num_channels = ARRAY_SIZE(ak8974_channels);
+@@ -846,6 +847,11 @@ no_irq:
+ goto cleanup_buffer;
+ }
+
++ pm_runtime_set_autosuspend_delay(&i2c->dev,
++ AK8974_AUTOSUSPEND_DELAY);
++ pm_runtime_use_autosuspend(&i2c->dev);
++ pm_runtime_put(&i2c->dev);
++
+ return 0;
+
+ cleanup_buffer:
+@@ -854,7 +860,6 @@ disable_pm:
+ pm_runtime_put_noidle(&i2c->dev);
+ pm_runtime_disable(&i2c->dev);
+ ak8974_set_power(ak8974, AK8974_PWR_OFF);
+-power_off:
+ regulator_bulk_disable(ARRAY_SIZE(ak8974->regs), ak8974->regs);
+
+ return ret;
+diff --git a/drivers/iio/pressure/ms5611_core.c b/drivers/iio/pressure/ms5611_core.c
+index f950cfde5db9..f4ea886fdde4 100644
+--- a/drivers/iio/pressure/ms5611_core.c
++++ b/drivers/iio/pressure/ms5611_core.c
+@@ -215,16 +215,21 @@ static irqreturn_t ms5611_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct ms5611_state *st = iio_priv(indio_dev);
+- s32 buf[4]; /* s32 (pressure) + s32 (temp) + 2 * s32 (timestamp) */
++ /* Ensure buffer elements are naturally aligned */
++ struct {
++ s32 channels[2];
++ s64 ts __aligned(8);
++ } scan;
+ int ret;
+
+ mutex_lock(&st->lock);
+- ret = ms5611_read_temp_and_pressure(indio_dev, &buf[1], &buf[0]);
++ ret = ms5611_read_temp_and_pressure(indio_dev, &scan.channels[1],
++ &scan.channels[0]);
+ mutex_unlock(&st->lock);
+ if (ret < 0)
+ goto err;
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buf,
++ iio_push_to_buffers_with_timestamp(indio_dev, &scan,
+ iio_get_time_ns(indio_dev));
+
+ err:
+diff --git a/drivers/iio/pressure/zpa2326.c b/drivers/iio/pressure/zpa2326.c
+index 81d8f24eaeb4..23b4fa81e783 100644
+--- a/drivers/iio/pressure/zpa2326.c
++++ b/drivers/iio/pressure/zpa2326.c
+@@ -672,8 +672,10 @@ static int zpa2326_resume(const struct iio_dev *indio_dev)
+ int err;
+
+ err = pm_runtime_get_sync(indio_dev->dev.parent);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put(indio_dev->dev.parent);
+ return err;
++ }
+
+ if (err > 0) {
+ /*
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index c4201d1da239..8134c7f92816 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -429,6 +429,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "076804U"),
+ },
+ },
++ {
++ /* Lenovo XiaoXin Air 12 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "80UN"),
++ },
++ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+diff --git a/drivers/input/touchscreen/mms114.c b/drivers/input/touchscreen/mms114.c
+index fca908ba4841..fb28fd2d6f1c 100644
+--- a/drivers/input/touchscreen/mms114.c
++++ b/drivers/input/touchscreen/mms114.c
+@@ -54,6 +54,7 @@
+ enum mms_type {
+ TYPE_MMS114 = 114,
+ TYPE_MMS152 = 152,
++ TYPE_MMS345L = 345,
+ };
+
+ struct mms114_data {
+@@ -250,6 +251,15 @@ static int mms114_get_version(struct mms114_data *data)
+ int error;
+
+ switch (data->type) {
++ case TYPE_MMS345L:
++ error = __mms114_read_reg(data, MMS152_FW_REV, 3, buf);
++ if (error)
++ return error;
++
++ dev_info(dev, "TSP FW Rev: bootloader 0x%x / core 0x%x / config 0x%x\n",
++ buf[0], buf[1], buf[2]);
++ break;
++
+ case TYPE_MMS152:
+ error = __mms114_read_reg(data, MMS152_FW_REV, 3, buf);
+ if (error)
+@@ -287,8 +297,8 @@ static int mms114_setup_regs(struct mms114_data *data)
+ if (error < 0)
+ return error;
+
+- /* MMS152 has no configuration or power on registers */
+- if (data->type == TYPE_MMS152)
++ /* Only MMS114 has configuration and power on registers */
++ if (data->type != TYPE_MMS114)
+ return 0;
+
+ error = mms114_set_active(data, true);
+@@ -598,6 +608,9 @@ static const struct of_device_id mms114_dt_match[] = {
+ }, {
+ .compatible = "melfas,mms152",
+ .data = (void *)TYPE_MMS152,
++ }, {
++ .compatible = "melfas,mms345l",
++ .data = (void *)TYPE_MMS345L,
+ },
+ { }
+ };
+diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
+index d8e3cc2dc747..f9caf233e2cc 100644
+--- a/drivers/misc/atmel-ssc.c
++++ b/drivers/misc/atmel-ssc.c
+@@ -13,7 +13,7 @@
+ #include <linux/clk.h>
+ #include <linux/err.h>
+ #include <linux/io.h>
+-#include <linux/spinlock.h>
++#include <linux/mutex.h>
+ #include <linux/atmel-ssc.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
+@@ -23,7 +23,7 @@
+ #include "../../sound/soc/atmel/atmel_ssc_dai.h"
+
+ /* Serialize access to ssc_list and user count */
+-static DEFINE_SPINLOCK(user_lock);
++static DEFINE_MUTEX(user_lock);
+ static LIST_HEAD(ssc_list);
+
+ struct ssc_device *ssc_request(unsigned int ssc_num)
+@@ -31,7 +31,7 @@ struct ssc_device *ssc_request(unsigned int ssc_num)
+ int ssc_valid = 0;
+ struct ssc_device *ssc;
+
+- spin_lock(&user_lock);
++ mutex_lock(&user_lock);
+ list_for_each_entry(ssc, &ssc_list, list) {
+ if (ssc->pdev->dev.of_node) {
+ if (of_alias_get_id(ssc->pdev->dev.of_node, "ssc")
+@@ -47,18 +47,18 @@ struct ssc_device *ssc_request(unsigned int ssc_num)
+ }
+
+ if (!ssc_valid) {
+- spin_unlock(&user_lock);
++ mutex_unlock(&user_lock);
+ pr_err("ssc: ssc%d platform device is missing\n", ssc_num);
+ return ERR_PTR(-ENODEV);
+ }
+
+ if (ssc->user) {
+- spin_unlock(&user_lock);
++ mutex_unlock(&user_lock);
+ dev_dbg(&ssc->pdev->dev, "module busy\n");
+ return ERR_PTR(-EBUSY);
+ }
+ ssc->user++;
+- spin_unlock(&user_lock);
++ mutex_unlock(&user_lock);
+
+ clk_prepare(ssc->clk);
+
+@@ -70,14 +70,14 @@ void ssc_free(struct ssc_device *ssc)
+ {
+ bool disable_clk = true;
+
+- spin_lock(&user_lock);
++ mutex_lock(&user_lock);
+ if (ssc->user)
+ ssc->user--;
+ else {
+ disable_clk = false;
+ dev_dbg(&ssc->pdev->dev, "device already free\n");
+ }
+- spin_unlock(&user_lock);
++ mutex_unlock(&user_lock);
+
+ if (disable_clk)
+ clk_unprepare(ssc->clk);
+@@ -240,9 +240,9 @@ static int ssc_probe(struct platform_device *pdev)
+ return -ENXIO;
+ }
+
+- spin_lock(&user_lock);
++ mutex_lock(&user_lock);
+ list_add_tail(&ssc->list, &ssc_list);
+- spin_unlock(&user_lock);
++ mutex_unlock(&user_lock);
+
+ platform_set_drvdata(pdev, ssc);
+
+@@ -261,9 +261,9 @@ static int ssc_remove(struct platform_device *pdev)
+
+ ssc_sound_dai_remove(ssc);
+
+- spin_lock(&user_lock);
++ mutex_lock(&user_lock);
+ list_del(&ssc->list);
+- spin_unlock(&user_lock);
++ mutex_unlock(&user_lock);
+
+ return 0;
+ }
+diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
+index bb2e1387b119..57b5868c9e8b 100644
+--- a/drivers/misc/mei/bus.c
++++ b/drivers/misc/mei/bus.c
+@@ -755,9 +755,8 @@ static int mei_cl_device_remove(struct device *dev)
+
+ mei_cl_bus_module_put(cldev);
+ module_put(THIS_MODULE);
+- dev->driver = NULL;
+- return ret;
+
++ return ret;
+ }
+
+ static ssize_t name_show(struct device *dev, struct device_attribute *a,
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 5a7fd89a8f2b..499a3d2a8e31 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -133,7 +133,7 @@ static void sdhci_set_card_detection(struct sdhci_host *host, bool enable)
+ u32 present;
+
+ if ((host->quirks & SDHCI_QUIRK_BROKEN_CARD_DETECTION) ||
+- !mmc_card_is_removable(host->mmc))
++ !mmc_card_is_removable(host->mmc) || mmc_can_gpio_cd(host->mmc))
+ return;
+
+ if (enable) {
+diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+index bd20f4521036..aad8d107b85d 100644
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -491,8 +491,9 @@ static int brcmnand_revision_init(struct brcmnand_controller *ctrl)
+ } else {
+ ctrl->cs_offsets = brcmnand_cs_offsets;
+
+- /* v5.0 and earlier has a different CS0 offset layout */
+- if (ctrl->nand_version <= 0x0500)
++ /* v3.3-5.0 have a different CS0 offset layout */
++ if (ctrl->nand_version >= 0x0303 &&
++ ctrl->nand_version <= 0x0500)
+ ctrl->cs0_offsets = brcmnand_cs_offsets_cs0;
+ }
+
+diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
+index a917bc242c9c..00b1adcfad86 100644
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -2564,7 +2564,7 @@ static int marvell_nand_chip_init(struct device *dev, struct marvell_nfc *nfc,
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret) {
+ dev_err(dev, "failed to register mtd device: %d\n", ret);
+- nand_release(chip);
++ nand_cleanup(chip);
+ return ret;
+ }
+
+@@ -2573,6 +2573,16 @@ static int marvell_nand_chip_init(struct device *dev, struct marvell_nfc *nfc,
+ return 0;
+ }
+
++static void marvell_nand_chips_cleanup(struct marvell_nfc *nfc)
++{
++ struct marvell_nand_chip *entry, *temp;
++
++ list_for_each_entry_safe(entry, temp, &nfc->chips, node) {
++ nand_release(&entry->chip);
++ list_del(&entry->node);
++ }
++}
++
+ static int marvell_nand_chips_init(struct device *dev, struct marvell_nfc *nfc)
+ {
+ struct device_node *np = dev->of_node;
+@@ -2607,21 +2617,16 @@ static int marvell_nand_chips_init(struct device *dev, struct marvell_nfc *nfc)
+ ret = marvell_nand_chip_init(dev, nfc, nand_np);
+ if (ret) {
+ of_node_put(nand_np);
+- return ret;
++ goto cleanup_chips;
+ }
+ }
+
+ return 0;
+-}
+
+-static void marvell_nand_chips_cleanup(struct marvell_nfc *nfc)
+-{
+- struct marvell_nand_chip *entry, *temp;
++cleanup_chips:
++ marvell_nand_chips_cleanup(nfc);
+
+- list_for_each_entry_safe(entry, temp, &nfc->chips, node) {
+- nand_release(&entry->chip);
+- list_del(&entry->node);
+- }
++ return ret;
+ }
+
+ static int marvell_nfc_init_dma(struct marvell_nfc *nfc)
+diff --git a/drivers/mtd/nand/raw/nand_timings.c b/drivers/mtd/nand/raw/nand_timings.c
+index ebc7b5f76f77..efc92ec4d52f 100644
+--- a/drivers/mtd/nand/raw/nand_timings.c
++++ b/drivers/mtd/nand/raw/nand_timings.c
+@@ -331,10 +331,9 @@ int onfi_fill_data_interface(struct nand_chip *chip,
+ /* microseconds -> picoseconds */
+ timings->tPROG_max = 1000000ULL * ONFI_DYN_TIMING_MAX;
+ timings->tBERS_max = 1000000ULL * ONFI_DYN_TIMING_MAX;
+- timings->tR_max = 1000000ULL * 200000000ULL;
+
+- /* nanoseconds -> picoseconds */
+- timings->tCCS_min = 1000UL * 500000;
++ timings->tR_max = 200000000;
++ timings->tCCS_min = 500000;
+ }
+
+ return 0;
+diff --git a/drivers/mtd/nand/raw/oxnas_nand.c b/drivers/mtd/nand/raw/oxnas_nand.c
+index d3f274b2e56d..c58269c12759 100644
+--- a/drivers/mtd/nand/raw/oxnas_nand.c
++++ b/drivers/mtd/nand/raw/oxnas_nand.c
+@@ -36,6 +36,7 @@ struct oxnas_nand_ctrl {
+ void __iomem *io_base;
+ struct clk *clk;
+ struct nand_chip *chips[OXNAS_NAND_MAX_CHIPS];
++ unsigned int nchips;
+ };
+
+ static uint8_t oxnas_nand_read_byte(struct mtd_info *mtd)
+@@ -86,9 +87,9 @@ static int oxnas_nand_probe(struct platform_device *pdev)
+ struct nand_chip *chip;
+ struct mtd_info *mtd;
+ struct resource *res;
+- int nchips = 0;
+ int count = 0;
+ int err = 0;
++ int i;
+
+ /* Allocate memory for the device structure (and zero it) */
+ oxnas = devm_kzalloc(&pdev->dev, sizeof(*oxnas),
+@@ -150,12 +151,12 @@ static int oxnas_nand_probe(struct platform_device *pdev)
+ if (err)
+ goto err_cleanup_nand;
+
+- oxnas->chips[nchips] = chip;
+- ++nchips;
++ oxnas->chips[oxnas->nchips] = chip;
++ ++oxnas->nchips;
+ }
+
+ /* Exit if no chips found */
+- if (!nchips) {
++ if (!oxnas->nchips) {
+ err = -ENODEV;
+ goto err_clk_unprepare;
+ }
+@@ -168,6 +169,13 @@ err_cleanup_nand:
+ nand_cleanup(chip);
+ err_release_child:
+ of_node_put(nand_np);
++
++ for (i = 0; i < oxnas->nchips; i++) {
++ chip = oxnas->chips[i];
++ WARN_ON(mtd_device_unregister(nand_to_mtd(chip)));
++ nand_cleanup(chip);
++ }
++
+ err_clk_unprepare:
+ clk_disable_unprepare(oxnas->clk);
+ return err;
+@@ -176,9 +184,13 @@ err_clk_unprepare:
+ static int oxnas_nand_remove(struct platform_device *pdev)
+ {
+ struct oxnas_nand_ctrl *oxnas = platform_get_drvdata(pdev);
++ struct nand_chip *chip;
++ int i;
+
+- if (oxnas->chips[0])
+- nand_release(oxnas->chips[0]);
++ for (i = 0; i < oxnas->nchips; i++) {
++ chip = oxnas->chips[i];
++ nand_release(chip);
++ }
+
+ clk_disable_unprepare(oxnas->clk);
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index ccba648452c4..c0bba680d4a8 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -1078,6 +1078,8 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev)
+ set_bit(0, priv->cfp.used);
+ set_bit(0, priv->cfp.unique);
+
++ /* Balance of_node_put() done by of_find_node_by_name() */
++ of_node_get(dn);
+ ports = of_find_node_by_name(dn, "ports");
+ if (ports) {
+ bcm_sf2_identify_ports(priv, ports);
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+index 7389648d0fea..05c438f47ff1 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+@@ -56,15 +56,23 @@ static int rmnet_unregister_real_device(struct net_device *real_dev)
+ return 0;
+ }
+
+-static int rmnet_register_real_device(struct net_device *real_dev)
++static int rmnet_register_real_device(struct net_device *real_dev,
++ struct netlink_ext_ack *extack)
+ {
+ struct rmnet_port *port;
+ int rc, entry;
+
+ ASSERT_RTNL();
+
+- if (rmnet_is_real_dev_registered(real_dev))
++ if (rmnet_is_real_dev_registered(real_dev)) {
++ port = rmnet_get_port_rtnl(real_dev);
++ if (port->rmnet_mode != RMNET_EPMODE_VND) {
++ NL_SET_ERR_MSG_MOD(extack, "bridge device already exists");
++ return -EINVAL;
++ }
++
+ return 0;
++ }
+
+ port = kzalloc(sizeof(*port), GFP_ATOMIC);
+ if (!port)
+@@ -143,7 +151,7 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
+
+ mux_id = nla_get_u16(data[IFLA_RMNET_MUX_ID]);
+
+- err = rmnet_register_real_device(real_dev);
++ err = rmnet_register_real_device(real_dev, extack);
+ if (err)
+ goto err0;
+
+@@ -425,13 +433,10 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
+ if (port->nr_rmnet_devs > 1)
+ return -EINVAL;
+
+- if (port->rmnet_mode != RMNET_EPMODE_VND)
+- return -EINVAL;
+-
+ if (rmnet_is_real_dev_registered(slave_dev))
+ return -EBUSY;
+
+- err = rmnet_register_real_device(slave_dev);
++ err = rmnet_register_real_device(slave_dev, extack);
+ if (err)
+ return -EBUSY;
+
+diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
+index fef701bfad62..1fe7783c2871 100644
+--- a/drivers/net/phy/sfp-bus.c
++++ b/drivers/net/phy/sfp-bus.c
+@@ -8,6 +8,12 @@
+
+ #include "sfp.h"
+
++struct sfp_quirk {
++ const char *vendor;
++ const char *part;
++ void (*modes)(const struct sfp_eeprom_id *id, unsigned long *modes);
++};
++
+ /**
+ * struct sfp_bus - internal representation of a sfp bus
+ */
+@@ -20,6 +26,7 @@ struct sfp_bus {
+ const struct sfp_socket_ops *socket_ops;
+ struct device *sfp_dev;
+ struct sfp *sfp;
++ const struct sfp_quirk *sfp_quirk;
+
+ const struct sfp_upstream_ops *upstream_ops;
+ void *upstream;
+@@ -30,6 +37,71 @@ struct sfp_bus {
+ bool started;
+ };
+
++static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id,
++ unsigned long *modes)
++{
++ phylink_set(modes, 2500baseX_Full);
++}
++
++static const struct sfp_quirk sfp_quirks[] = {
++ {
++ // Alcatel Lucent G-010S-P can operate at 2500base-X, but
++ // incorrectly report 2500MBd NRZ in their EEPROM
++ .vendor = "ALCATELLUCENT",
++ .part = "G010SP",
++ .modes = sfp_quirk_2500basex,
++ }, {
++ // Alcatel Lucent G-010S-A can operate at 2500base-X, but
++ // report 3.2GBd NRZ in their EEPROM
++ .vendor = "ALCATELLUCENT",
++ .part = "3FE46541AA",
++ .modes = sfp_quirk_2500basex,
++ }, {
++ // Huawei MA5671A can operate at 2500base-X, but report 1.2GBd
++ // NRZ in their EEPROM
++ .vendor = "HUAWEI",
++ .part = "MA5671A",
++ .modes = sfp_quirk_2500basex,
++ },
++};
++
++static size_t sfp_strlen(const char *str, size_t maxlen)
++{
++ size_t size, i;
++
++ /* Trailing characters should be filled with space chars */
++ for (i = 0, size = 0; i < maxlen; i++)
++ if (str[i] != ' ')
++ size = i + 1;
++
++ return size;
++}
++
++static bool sfp_match(const char *qs, const char *str, size_t len)
++{
++ if (!qs)
++ return true;
++ if (strlen(qs) != len)
++ return false;
++ return !strncmp(qs, str, len);
++}
++
++static const struct sfp_quirk *sfp_lookup_quirk(const struct sfp_eeprom_id *id)
++{
++ const struct sfp_quirk *q;
++ unsigned int i;
++ size_t vs, ps;
++
++ vs = sfp_strlen(id->base.vendor_name, ARRAY_SIZE(id->base.vendor_name));
++ ps = sfp_strlen(id->base.vendor_pn, ARRAY_SIZE(id->base.vendor_pn));
++
++ for (i = 0, q = sfp_quirks; i < ARRAY_SIZE(sfp_quirks); i++, q++)
++ if (sfp_match(q->vendor, id->base.vendor_name, vs) &&
++ sfp_match(q->part, id->base.vendor_pn, ps))
++ return q;
++
++ return NULL;
++}
+ /**
+ * sfp_parse_port() - Parse the EEPROM base ID, setting the port type
+ * @bus: a pointer to the &struct sfp_bus structure for the sfp module
+@@ -233,6 +305,9 @@ void sfp_parse_support(struct sfp_bus *bus, const struct sfp_eeprom_id *id,
+ phylink_set(modes, 1000baseX_Full);
+ }
+
++ if (bus->sfp_quirk)
++ bus->sfp_quirk->modes(id, modes);
++
+ bitmap_or(support, support, modes, __ETHTOOL_LINK_MODE_MASK_NBITS);
+
+ phylink_set(support, Autoneg);
+@@ -556,6 +631,8 @@ int sfp_module_insert(struct sfp_bus *bus, const struct sfp_eeprom_id *id)
+ const struct sfp_upstream_ops *ops = sfp_get_upstream_ops(bus);
+ int ret = 0;
+
++ bus->sfp_quirk = sfp_lookup_quirk(id);
++
+ if (ops && ops->module_insert)
+ ret = ops->module_insert(bus->upstream, id);
+
+@@ -569,6 +646,8 @@ void sfp_module_remove(struct sfp_bus *bus)
+
+ if (ops && ops->module_remove)
+ ops->module_remove(bus->upstream);
++
++ bus->sfp_quirk = NULL;
+ }
+ EXPORT_SYMBOL_GPL(sfp_module_remove);
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 1f70e00838f2..ea3c89118614 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1305,6 +1305,7 @@ static const struct usb_device_id products[] = {
+ {QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
++ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */
+ {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */
+ {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */
+ {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index af7572fe090f..100adacfdca9 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -267,10 +267,15 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
+ child, addr);
+
+ if (of_mdiobus_child_is_phy(child)) {
++ /* -ENODEV is the return code that PHYLIB has
++ * standardized on to indicate that bus
++ * scanning should continue.
++ */
+ rc = of_mdiobus_register_phy(mdio, child, addr);
+- if (rc && rc != -ENODEV)
++ if (!rc)
++ break;
++ if (rc != -ENODEV)
+ goto unregister;
+- break;
+ }
+ }
+ }
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index 1f8809bab002..920f61eff9cd 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -550,13 +550,14 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
+ struct sun4i_usb_phy_data *data =
+ container_of(work, struct sun4i_usb_phy_data, detect.work);
+ struct phy *phy0 = data->phys[0].phy;
+- struct sun4i_usb_phy *phy = phy_get_drvdata(phy0);
++ struct sun4i_usb_phy *phy;
+ bool force_session_end, id_notify = false, vbus_notify = false;
+ int id_det, vbus_det;
+
+- if (phy0 == NULL)
++ if (!phy0)
+ return;
+
++ phy = phy_get_drvdata(phy0);
+ id_det = sun4i_usb_phy0_get_id_det(data);
+ vbus_det = sun4i_usb_phy0_get_vbus_det(data);
+
+diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
+index a8ac48027632..7cb6e2b9e180 100644
+--- a/drivers/scsi/Kconfig
++++ b/drivers/scsi/Kconfig
+@@ -144,15 +144,6 @@ config BLK_DEV_SR
+ <file:Documentation/scsi/scsi.txt>.
+ The module will be called sr_mod.
+
+-config BLK_DEV_SR_VENDOR
+- bool "Enable vendor-specific extensions (for SCSI CDROM)"
+- depends on BLK_DEV_SR
+- help
+- This enables the usage of vendor specific SCSI commands. This is
+- required to support multisession CDs with old NEC/TOSHIBA cdrom
+- drives (and HP Writers). If you have such a drive and get the first
+- session only, try saying Y here; everybody else says N.
+-
+ config CHR_DEV_SG
+ tristate "SCSI generic support"
+ depends on SCSI
+diff --git a/drivers/scsi/sr_vendor.c b/drivers/scsi/sr_vendor.c
+index e3b0ce25162b..b9db2ec6d036 100644
+--- a/drivers/scsi/sr_vendor.c
++++ b/drivers/scsi/sr_vendor.c
+@@ -66,9 +66,6 @@
+
+ void sr_vendor_init(Scsi_CD *cd)
+ {
+-#ifndef CONFIG_BLK_DEV_SR_VENDOR
+- cd->vendor = VENDOR_SCSI3;
+-#else
+ const char *vendor = cd->device->vendor;
+ const char *model = cd->device->model;
+
+@@ -100,7 +97,6 @@ void sr_vendor_init(Scsi_CD *cd)
+ cd->vendor = VENDOR_TOSHIBA;
+
+ }
+-#endif
+ }
+
+
+@@ -114,10 +110,8 @@ int sr_set_blocklength(Scsi_CD *cd, int blocklength)
+ struct ccs_modesel_head *modesel;
+ int rc, density = 0;
+
+-#ifdef CONFIG_BLK_DEV_SR_VENDOR
+ if (cd->vendor == VENDOR_TOSHIBA)
+ density = (blocklength > 2048) ? 0x81 : 0x83;
+-#endif
+
+ buffer = kmalloc(512, GFP_KERNEL | GFP_DMA);
+ if (!buffer)
+@@ -205,7 +199,6 @@ int sr_cd_check(struct cdrom_device_info *cdi)
+ }
+ break;
+
+-#ifdef CONFIG_BLK_DEV_SR_VENDOR
+ case VENDOR_NEC:{
+ unsigned long min, sec, frame;
+ cgc.cmd[0] = 0xde;
+@@ -298,7 +291,6 @@ int sr_cd_check(struct cdrom_device_info *cdi)
+ sector = buffer[11] + (buffer[10] << 8) +
+ (buffer[9] << 16) + (buffer[8] << 24);
+ break;
+-#endif /* CONFIG_BLK_DEV_SR_VENDOR */
+
+ default:
+ /* should not happen */
+diff --git a/drivers/slimbus/core.c b/drivers/slimbus/core.c
+index 95b00d28ad6e..943172806a8a 100644
+--- a/drivers/slimbus/core.c
++++ b/drivers/slimbus/core.c
+@@ -236,6 +236,7 @@ EXPORT_SYMBOL_GPL(slim_register_controller);
+ /* slim_remove_device: Remove the effect of slim_add_device() */
+ static void slim_remove_device(struct slim_device *sbdev)
+ {
++ of_node_put(sbdev->dev.of_node);
+ device_unregister(&sbdev->dev);
+ }
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index 75bd9a83aef0..3c6f920535ea 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -148,7 +148,7 @@ int rpmh_rsc_invalidate(struct rsc_drv *drv)
+ static struct tcs_group *get_tcs_for_msg(struct rsc_drv *drv,
+ const struct tcs_request *msg)
+ {
+- int type, ret;
++ int type;
+ struct tcs_group *tcs;
+
+ switch (msg->state) {
+@@ -169,19 +169,10 @@ static struct tcs_group *get_tcs_for_msg(struct rsc_drv *drv,
+ * If we are making an active request on a RSC that does not have a
+ * dedicated TCS for active state use, then re-purpose a wake TCS to
+ * send active votes.
+- * NOTE: The driver must be aware that this RSC does not have a
+- * dedicated AMC, and therefore would invalidate the sleep and wake
+- * TCSes before making an active state request.
+ */
+ tcs = get_tcs_of_type(drv, type);
+- if (msg->state == RPMH_ACTIVE_ONLY_STATE && !tcs->num_tcs) {
++ if (msg->state == RPMH_ACTIVE_ONLY_STATE && !tcs->num_tcs)
+ tcs = get_tcs_of_type(drv, WAKE_TCS);
+- if (tcs->num_tcs) {
+- ret = rpmh_rsc_invalidate(drv);
+- if (ret)
+- return ERR_PTR(ret);
+- }
+- }
+
+ return tcs;
+ }
+@@ -201,6 +192,42 @@ static const struct tcs_request *get_req_from_tcs(struct rsc_drv *drv,
+ return NULL;
+ }
+
++static void __tcs_set_trigger(struct rsc_drv *drv, int tcs_id, bool trigger)
++{
++ u32 enable;
++
++ /*
++ * HW req: Clear the DRV_CONTROL and enable TCS again
++ * While clearing ensure that the AMC mode trigger is cleared
++ * and then the mode enable is cleared.
++ */
++ enable = read_tcs_reg(drv, RSC_DRV_CONTROL, tcs_id, 0);
++ enable &= ~TCS_AMC_MODE_TRIGGER;
++ write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
++ enable &= ~TCS_AMC_MODE_ENABLE;
++ write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
++
++ if (trigger) {
++ /* Enable the AMC mode on the TCS and then trigger the TCS */
++ enable = TCS_AMC_MODE_ENABLE;
++ write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
++ enable |= TCS_AMC_MODE_TRIGGER;
++ write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
++ }
++}
++
++static void enable_tcs_irq(struct rsc_drv *drv, int tcs_id, bool enable)
++{
++ u32 data;
++
++ data = read_tcs_reg(drv, RSC_DRV_IRQ_ENABLE, 0, 0);
++ if (enable)
++ data |= BIT(tcs_id);
++ else
++ data &= ~BIT(tcs_id);
++ write_tcs_reg(drv, RSC_DRV_IRQ_ENABLE, 0, data);
++}
++
+ /**
+ * tcs_tx_done: TX Done interrupt handler
+ */
+@@ -237,6 +264,14 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
+ }
+
+ trace_rpmh_tx_done(drv, i, req, err);
++
++ /*
++ * If wake tcs was re-purposed for sending active
++ * votes, clear AMC trigger & enable modes and
++ * disable interrupt for this TCS
++ */
++ if (!drv->tcs[ACTIVE_TCS].num_tcs)
++ __tcs_set_trigger(drv, i, false);
+ skip:
+ /* Reclaim the TCS */
+ write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0);
+@@ -244,6 +279,13 @@ skip:
+ write_tcs_reg(drv, RSC_DRV_IRQ_CLEAR, 0, BIT(i));
+ spin_lock(&drv->lock);
+ clear_bit(i, drv->tcs_in_use);
++ /*
++ * Disable interrupt for WAKE TCS to avoid being
++ * spammed with interrupts coming when the solver
++ * sends its wake votes.
++ */
++ if (!drv->tcs[ACTIVE_TCS].num_tcs)
++ enable_tcs_irq(drv, i, false);
+ spin_unlock(&drv->lock);
+ if (req)
+ rpmh_tx_done(req, err);
+@@ -285,28 +327,6 @@ static void __tcs_buffer_write(struct rsc_drv *drv, int tcs_id, int cmd_id,
+ write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, tcs_id, cmd_enable);
+ }
+
+-static void __tcs_trigger(struct rsc_drv *drv, int tcs_id)
+-{
+- u32 enable;
+-
+- /*
+- * HW req: Clear the DRV_CONTROL and enable TCS again
+- * While clearing ensure that the AMC mode trigger is cleared
+- * and then the mode enable is cleared.
+- */
+- enable = read_tcs_reg(drv, RSC_DRV_CONTROL, tcs_id, 0);
+- enable &= ~TCS_AMC_MODE_TRIGGER;
+- write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
+- enable &= ~TCS_AMC_MODE_ENABLE;
+- write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
+-
+- /* Enable the AMC mode on the TCS and then trigger the TCS */
+- enable = TCS_AMC_MODE_ENABLE;
+- write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
+- enable |= TCS_AMC_MODE_TRIGGER;
+- write_tcs_reg_sync(drv, RSC_DRV_CONTROL, tcs_id, enable);
+-}
+-
+ static int check_for_req_inflight(struct rsc_drv *drv, struct tcs_group *tcs,
+ const struct tcs_request *msg)
+ {
+@@ -377,10 +397,20 @@ static int tcs_write(struct rsc_drv *drv, const struct tcs_request *msg)
+
+ tcs->req[tcs_id - tcs->offset] = msg;
+ set_bit(tcs_id, drv->tcs_in_use);
++ if (msg->state == RPMH_ACTIVE_ONLY_STATE && tcs->type != ACTIVE_TCS) {
++ /*
++ * Clear previously programmed WAKE commands in selected
++ * repurposed TCS to avoid triggering them. tcs->slots will be
++ * cleaned from rpmh_flush() by invoking rpmh_rsc_invalidate()
++ */
++ write_tcs_reg_sync(drv, RSC_DRV_CMD_ENABLE, tcs_id, 0);
++ write_tcs_reg_sync(drv, RSC_DRV_CMD_WAIT_FOR_CMPL, tcs_id, 0);
++ enable_tcs_irq(drv, tcs_id, true);
++ }
+ spin_unlock(&drv->lock);
+
+ __tcs_buffer_write(drv, tcs_id, 0, msg);
+- __tcs_trigger(drv, tcs_id);
++ __tcs_set_trigger(drv, tcs_id, true);
+
+ done_write:
+ spin_unlock_irqrestore(&tcs->lock, flags);
+diff --git a/drivers/soc/qcom/rpmh.c b/drivers/soc/qcom/rpmh.c
+index ab8f731a3426..b208073e0ab6 100644
+--- a/drivers/soc/qcom/rpmh.c
++++ b/drivers/soc/qcom/rpmh.c
+@@ -119,6 +119,7 @@ static struct cache_req *cache_rpm_request(struct rpmh_ctrlr *ctrlr,
+ {
+ struct cache_req *req;
+ unsigned long flags;
++ u32 old_sleep_val, old_wake_val;
+
+ spin_lock_irqsave(&ctrlr->cache_lock, flags);
+ req = __find_req(ctrlr, cmd->addr);
+@@ -133,26 +134,27 @@ static struct cache_req *cache_rpm_request(struct rpmh_ctrlr *ctrlr,
+
+ req->addr = cmd->addr;
+ req->sleep_val = req->wake_val = UINT_MAX;
+- INIT_LIST_HEAD(&req->list);
+ list_add_tail(&req->list, &ctrlr->cache);
+
+ existing:
++ old_sleep_val = req->sleep_val;
++ old_wake_val = req->wake_val;
++
+ switch (state) {
+ case RPMH_ACTIVE_ONLY_STATE:
+- if (req->sleep_val != UINT_MAX)
+- req->wake_val = cmd->data;
+- break;
+ case RPMH_WAKE_ONLY_STATE:
+ req->wake_val = cmd->data;
+ break;
+ case RPMH_SLEEP_STATE:
+ req->sleep_val = cmd->data;
+ break;
+- default:
+- break;
+ }
+
+- ctrlr->dirty = true;
++ ctrlr->dirty = (req->sleep_val != old_sleep_val ||
++ req->wake_val != old_wake_val) &&
++ req->sleep_val != UINT_MAX &&
++ req->wake_val != UINT_MAX;
++
+ unlock:
+ spin_unlock_irqrestore(&ctrlr->cache_lock, flags);
+
+@@ -288,6 +290,7 @@ static void cache_batch(struct rpmh_ctrlr *ctrlr, struct batch_cache_req *req)
+
+ spin_lock_irqsave(&ctrlr->cache_lock, flags);
+ list_add_tail(&req->list, &ctrlr->batch_cache);
++ ctrlr->dirty = true;
+ spin_unlock_irqrestore(&ctrlr->cache_lock, flags);
+ }
+
+@@ -315,18 +318,6 @@ static int flush_batch(struct rpmh_ctrlr *ctrlr)
+ return ret;
+ }
+
+-static void invalidate_batch(struct rpmh_ctrlr *ctrlr)
+-{
+- struct batch_cache_req *req, *tmp;
+- unsigned long flags;
+-
+- spin_lock_irqsave(&ctrlr->cache_lock, flags);
+- list_for_each_entry_safe(req, tmp, &ctrlr->batch_cache, list)
+- kfree(req);
+- INIT_LIST_HEAD(&ctrlr->batch_cache);
+- spin_unlock_irqrestore(&ctrlr->cache_lock, flags);
+-}
+-
+ /**
+ * rpmh_write_batch: Write multiple sets of RPMH commands and wait for the
+ * batch to finish.
+@@ -466,6 +457,13 @@ int rpmh_flush(const struct device *dev)
+ return 0;
+ }
+
++ /* Invalidate the TCSes first to avoid stale data */
++ do {
++ ret = rpmh_rsc_invalidate(ctrlr_to_drv(ctrlr));
++ } while (ret == -EAGAIN);
++ if (ret)
++ return ret;
++
+ /* First flush the cached batch requests */
+ ret = flush_batch(ctrlr);
+ if (ret)
+@@ -497,25 +495,25 @@ int rpmh_flush(const struct device *dev)
+ EXPORT_SYMBOL(rpmh_flush);
+
+ /**
+- * rpmh_invalidate: Invalidate all sleep and active sets
+- * sets.
++ * rpmh_invalidate: Invalidate sleep and wake sets in batch_cache
+ *
+ * @dev: The device making the request
+ *
+- * Invalidate the sleep and active values in the TCS blocks.
++ * Invalidate the sleep and wake values in batch_cache.
+ */
+ int rpmh_invalidate(const struct device *dev)
+ {
+ struct rpmh_ctrlr *ctrlr = get_rpmh_ctrlr(dev);
+- int ret;
++ struct batch_cache_req *req, *tmp;
++ unsigned long flags;
+
+- invalidate_batch(ctrlr);
++ spin_lock_irqsave(&ctrlr->cache_lock, flags);
++ list_for_each_entry_safe(req, tmp, &ctrlr->batch_cache, list)
++ kfree(req);
++ INIT_LIST_HEAD(&ctrlr->batch_cache);
+ ctrlr->dirty = true;
++ spin_unlock_irqrestore(&ctrlr->cache_lock, flags);
+
+- do {
+- ret = rpmh_rsc_invalidate(ctrlr_to_drv(ctrlr));
+- } while (ret == -EAGAIN);
+-
+- return ret;
++ return 0;
+ }
+ EXPORT_SYMBOL(rpmh_invalidate);
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 2844c9a72a98..43809fad250b 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -71,7 +71,7 @@
+ #define SPI_SR 0x2c
+ #define SPI_SR_EOQF 0x10000000
+ #define SPI_SR_TCFQF 0x80000000
+-#define SPI_SR_CLEAR 0xdaad0000
++#define SPI_SR_CLEAR 0x9aaf0000
+
+ #define SPI_RSER_TFFFE BIT(25)
+ #define SPI_RSER_TFFFD BIT(24)
+@@ -1164,20 +1164,7 @@ static int dspi_remove(struct platform_device *pdev)
+
+ static void dspi_shutdown(struct platform_device *pdev)
+ {
+- struct spi_controller *ctlr = platform_get_drvdata(pdev);
+- struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr);
+-
+- /* Disable RX and TX */
+- regmap_update_bits(dspi->regmap, SPI_MCR,
+- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF,
+- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF);
+-
+- /* Stop Running */
+- regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, SPI_MCR_HALT);
+-
+- dspi_release_dma(dspi);
+- clk_disable_unprepare(dspi->clk);
+- spi_unregister_controller(dspi->master);
++ dspi_remove(pdev);
+ }
+
+ static struct platform_driver fsl_dspi_driver = {
+diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
+index f1fc2bde6ef3..e41976010dc4 100644
+--- a/drivers/spi/spi-sprd-adi.c
++++ b/drivers/spi/spi-sprd-adi.c
+@@ -358,9 +358,9 @@ static int sprd_adi_restart_handler(struct notifier_block *this,
+ sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOCK, WDG_UNLOCK_KEY);
+
+ /* Load the watchdog timeout value, 50ms is always enough. */
++ sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOAD_HIGH, 0);
+ sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOAD_LOW,
+ WDG_LOAD_VAL & WDG_LOAD_MASK);
+- sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOAD_HIGH, 0);
+
+ /* Start the watchdog to reset system */
+ sprd_adi_read(sadi, sadi->slave_pbase + REG_WDG_CTRL, &val);
+diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
+index 8533f4edd00a..21a22d42818c 100644
+--- a/drivers/spi/spi-sun6i.c
++++ b/drivers/spi/spi-sun6i.c
+@@ -202,7 +202,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ struct spi_transfer *tfr)
+ {
+ struct sun6i_spi *sspi = spi_master_get_devdata(master);
+- unsigned int mclk_rate, div, timeout;
++ unsigned int mclk_rate, div, div_cdr1, div_cdr2, timeout;
+ unsigned int start, end, tx_time;
+ unsigned int trig_level;
+ unsigned int tx_len = 0;
+@@ -291,14 +291,12 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ * First try CDR2, and if we can't reach the expected
+ * frequency, fall back to CDR1.
+ */
+- div = mclk_rate / (2 * tfr->speed_hz);
+- if (div <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) {
+- if (div > 0)
+- div--;
+-
+- reg = SUN6I_CLK_CTL_CDR2(div) | SUN6I_CLK_CTL_DRS;
++ div_cdr1 = DIV_ROUND_UP(mclk_rate, tfr->speed_hz);
++ div_cdr2 = DIV_ROUND_UP(div_cdr1, 2);
++ if (div_cdr2 <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) {
++ reg = SUN6I_CLK_CTL_CDR2(div_cdr2 - 1) | SUN6I_CLK_CTL_DRS;
+ } else {
+- div = ilog2(mclk_rate) - ilog2(tfr->speed_hz);
++ div = min(SUN6I_CLK_CTL_CDR1_MASK, order_base_2(div_cdr1));
+ reg = SUN6I_CLK_CTL_CDR1(div);
+ }
+
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
+index 45ad4ba92f94..689acd69a1b9 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
+@@ -456,9 +456,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
+ unsigned int lo_mask = data[5] << shift;
+ unsigned int chan_mask = hi_mask | lo_mask;
+ unsigned int old_mask = (1 << shift) - 1;
+- unsigned int pm = devpriv->pm[trig] & old_mask;
+- unsigned int pt = devpriv->pt[trig] & old_mask;
+- unsigned int pp = devpriv->pp[trig] & old_mask;
++ unsigned int pm;
++ unsigned int pt;
++ unsigned int pp;
+
+ if (trig > 1) {
+ dev_dbg(dev->class_dev,
+@@ -471,6 +471,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
+ return -EINVAL;
+ }
+
++ pm = devpriv->pm[trig] & old_mask;
++ pt = devpriv->pt[trig] & old_mask;
++ pp = devpriv->pp[trig] & old_mask;
++
+ switch (data[2]) {
+ case COMEDI_DIGITAL_TRIG_DISABLE:
+ /* clear trigger configuration */
+diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
+index 9df6b7260466..8592ef694a5a 100644
+--- a/drivers/thermal/cpu_cooling.c
++++ b/drivers/thermal/cpu_cooling.c
+@@ -278,11 +278,11 @@ static u32 cpu_power_to_freq(struct cpufreq_cooling_device *cpufreq_cdev,
+ int i;
+ struct freq_table *freq_table = cpufreq_cdev->freq_table;
+
+- for (i = 1; i <= cpufreq_cdev->max_level; i++)
+- if (power > freq_table[i].power)
++ for (i = 0; i < cpufreq_cdev->max_level; i++)
++ if (power >= freq_table[i].power)
+ break;
+
+- return freq_table[i - 1].frequency;
++ return freq_table[i].frequency;
+ }
+
+ /**
+diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
+index f64643629d8b..0691f260f6ea 100644
+--- a/drivers/thermal/mtk_thermal.c
++++ b/drivers/thermal/mtk_thermal.c
+@@ -431,8 +431,7 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank)
+ u32 raw;
+
+ for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) {
+- raw = readl(mt->thermal_base +
+- conf->msr[conf->bank_data[bank->id].sensors[i]]);
++ raw = readl(mt->thermal_base + conf->msr[i]);
+
+ temp = raw_to_mcelsius(mt,
+ conf->bank_data[bank->id].sensors[i],
+@@ -569,8 +568,7 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num,
+
+ for (i = 0; i < conf->bank_data[num].num_sensors; i++)
+ writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]],
+- mt->thermal_base +
+- conf->adcpnp[conf->bank_data[num].sensors[i]]);
++ mt->thermal_base + conf->adcpnp[i]);
+
+ writel((1 << conf->bank_data[num].num_sensors) - 1,
+ mt->thermal_base + TEMP_MONCTL0);
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 4c188f4079b3..63810eefa44b 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -1703,21 +1703,21 @@ static int mxs_auart_probe(struct platform_device *pdev)
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0) {
+ ret = irq;
+- goto out_disable_clks;
++ goto out_iounmap;
+ }
+
+ s->port.irq = irq;
+ ret = devm_request_irq(&pdev->dev, irq, mxs_auart_irq_handle, 0,
+ dev_name(&pdev->dev), s);
+ if (ret)
+- goto out_disable_clks;
++ goto out_iounmap;
+
+ platform_set_drvdata(pdev, s);
+
+ ret = mxs_auart_init_gpios(s, &pdev->dev);
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to initialize GPIOs.\n");
+- goto out_disable_clks;
++ goto out_iounmap;
+ }
+
+ /*
+@@ -1725,7 +1725,7 @@ static int mxs_auart_probe(struct platform_device *pdev)
+ */
+ ret = mxs_auart_request_gpio_irq(s);
+ if (ret)
+- goto out_disable_clks;
++ goto out_iounmap;
+
+ auart_port[s->port.line] = s;
+
+@@ -1751,6 +1751,9 @@ out_free_qpio_irq:
+ mxs_auart_free_gpio_irq(s);
+ auart_port[pdev->id] = NULL;
+
++out_iounmap:
++ iounmap(s->port.membase);
++
+ out_disable_clks:
+ if (is_asm9260_auart(s)) {
+ clk_disable_unprepare(s->clk);
+@@ -1766,6 +1769,7 @@ static int mxs_auart_remove(struct platform_device *pdev)
+ uart_remove_one_port(&auart_driver, &s->port);
+ auart_port[pdev->id] = NULL;
+ mxs_auart_free_gpio_irq(s);
++ iounmap(s->port.membase);
+ if (is_asm9260_auart(s)) {
+ clk_disable_unprepare(s->clk);
+ clk_disable_unprepare(s->clk_ahb);
+diff --git a/drivers/uio/uio_pdrv_genirq.c b/drivers/uio/uio_pdrv_genirq.c
+index f598ecddc8a7..b58a504240c4 100644
+--- a/drivers/uio/uio_pdrv_genirq.c
++++ b/drivers/uio/uio_pdrv_genirq.c
+@@ -148,7 +148,7 @@ static int uio_pdrv_genirq_probe(struct platform_device *pdev)
+ if (!uioinfo->irq) {
+ ret = platform_get_irq(pdev, 0);
+ uioinfo->irq = ret;
+- if (ret == -ENXIO && pdev->dev.of_node)
++ if (ret == -ENXIO)
+ uioinfo->irq = UIO_IRQ_NONE;
+ else if (ret < 0) {
+ dev_err(&pdev->dev, "failed to get IRQ\n");
+diff --git a/drivers/usb/c67x00/c67x00-sched.c b/drivers/usb/c67x00/c67x00-sched.c
+index 633c52de3bb3..9865750bc31e 100644
+--- a/drivers/usb/c67x00/c67x00-sched.c
++++ b/drivers/usb/c67x00/c67x00-sched.c
+@@ -486,7 +486,7 @@ c67x00_giveback_urb(struct c67x00_hcd *c67x00, struct urb *urb, int status)
+ c67x00_release_urb(c67x00, urb);
+ usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
+ spin_unlock(&c67x00->lock);
+- usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
++ usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, status);
+ spin_lock(&c67x00->lock);
+ }
+
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index 159b897c5e80..befd9235bcad 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -1154,6 +1154,29 @@ static void ci_controller_suspend(struct ci_hdrc *ci)
+ enable_irq(ci->irq);
+ }
+
++/*
++ * Handle the wakeup interrupt triggered by extcon connector
++ * We need to call ci_irq again for extcon since the first
++ * interrupt (wakeup int) only let the controller be out of
++ * low power mode, but not handle any interrupts.
++ */
++static void ci_extcon_wakeup_int(struct ci_hdrc *ci)
++{
++ struct ci_hdrc_cable *cable_id, *cable_vbus;
++ u32 otgsc = hw_read_otgsc(ci, ~0);
++
++ cable_id = &ci->platdata->id_extcon;
++ cable_vbus = &ci->platdata->vbus_extcon;
++
++ if (!IS_ERR(cable_id->edev) && ci->is_otg &&
++ (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS))
++ ci_irq(ci->irq, ci);
++
++ if (!IS_ERR(cable_vbus->edev) && ci->is_otg &&
++ (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS))
++ ci_irq(ci->irq, ci);
++}
++
+ static int ci_controller_resume(struct device *dev)
+ {
+ struct ci_hdrc *ci = dev_get_drvdata(dev);
+@@ -1186,6 +1209,7 @@ static int ci_controller_resume(struct device *dev)
+ enable_irq(ci->irq);
+ if (ci_otg_is_fsm_mode(ci))
+ ci_otg_fsm_wakeup_by_srp(ci);
++ ci_extcon_wakeup_int(ci);
+ }
+
+ return 0;
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
+index c3383f30b37a..c35c93f16a49 100644
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -349,7 +349,8 @@ static void dwc2_driver_shutdown(struct platform_device *dev)
+ {
+ struct dwc2_hsotg *hsotg = platform_get_drvdata(dev);
+
+- disable_irq(hsotg->irq);
++ dwc2_disable_global_interrupts(hsotg);
++ synchronize_irq(hsotg->irq);
+ }
+
+ /**
+diff --git a/drivers/usb/gadget/function/f_uac1_legacy.c b/drivers/usb/gadget/function/f_uac1_legacy.c
+index 24c086bcdeaa..56c724cfc439 100644
+--- a/drivers/usb/gadget/function/f_uac1_legacy.c
++++ b/drivers/usb/gadget/function/f_uac1_legacy.c
+@@ -336,7 +336,9 @@ static int f_audio_out_ep_complete(struct usb_ep *ep, struct usb_request *req)
+
+ /* Copy buffer is full, add it to the play_queue */
+ if (audio_buf_size - copy_buf->actual < req->actual) {
++ spin_lock_irq(&audio->lock);
+ list_add_tail(©_buf->list, &audio->play_queue);
++ spin_unlock_irq(&audio->lock);
+ schedule_work(&audio->playback_work);
+ copy_buf = f_audio_buffer_alloc(audio_buf_size);
+ if (IS_ERR(copy_buf))
+diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
+index a4ab23033578..23691a32759f 100644
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -860,7 +860,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+ u32 status;
+
+ DBG(DBG_GADGET | DBG_QUEUE, "ep_dequeue: %s, req %p\n",
+- ep->ep.name, req);
++ ep->ep.name, _req);
+
+ spin_lock_irqsave(&udc->lock, flags);
+
+diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
+index cbc45941a699..8a45362155c5 100644
+--- a/drivers/usb/host/ehci-platform.c
++++ b/drivers/usb/host/ehci-platform.c
+@@ -457,10 +457,6 @@ static int ehci_platform_resume(struct device *dev)
+
+ ehci_resume(hcd, priv->reset_on_resume);
+
+- pm_runtime_disable(dev);
+- pm_runtime_set_active(dev);
+- pm_runtime_enable(dev);
+-
+ if (priv->quirk_poll)
+ quirk_poll_init(priv);
+
+diff --git a/drivers/usb/host/ohci-platform.c b/drivers/usb/host/ohci-platform.c
+index f40112c5920d..65a1c3fdc88c 100644
+--- a/drivers/usb/host/ohci-platform.c
++++ b/drivers/usb/host/ohci-platform.c
+@@ -301,11 +301,6 @@ static int ohci_platform_resume(struct device *dev)
+ }
+
+ ohci_resume(hcd, false);
+-
+- pm_runtime_disable(dev);
+- pm_runtime_set_active(dev);
+- pm_runtime_enable(dev);
+-
+ return 0;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 65972c186c64..adc437ca83b8 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -408,15 +408,7 @@ static int __maybe_unused xhci_plat_resume(struct device *dev)
+ if (ret)
+ return ret;
+
+- ret = xhci_resume(xhci, 0);
+- if (ret)
+- return ret;
+-
+- pm_runtime_disable(dev);
+- pm_runtime_set_active(dev);
+- pm_runtime_enable(dev);
+-
+- return 0;
++ return xhci_resume(xhci, 0);
+ }
+
+ static int __maybe_unused xhci_plat_runtime_suspend(struct device *dev)
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index 955ab97b9b22..efadf2f6afa1 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -81,6 +81,7 @@
+
+ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x4348, 0x5523) },
++ { USB_DEVICE(0x1a86, 0x7522) },
+ { USB_DEVICE(0x1a86, 0x7523) },
+ { USB_DEVICE(0x1a86, 0x5523) },
+ { },
+diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
+index 2c58649fd47a..4ed8de1e5991 100644
+--- a/drivers/usb/serial/cypress_m8.c
++++ b/drivers/usb/serial/cypress_m8.c
+@@ -59,6 +59,7 @@ static const struct usb_device_id id_table_earthmate[] = {
+
+ static const struct usb_device_id id_table_cyphidcomrs232[] = {
+ { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) },
+ { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
+ { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) },
+ { } /* Terminating entry */
+@@ -73,6 +74,7 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) },
+ { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) },
+ { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) },
+ { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
+ { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) },
+ { USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) },
+diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h
+index 35e223751c0e..16b7410ad057 100644
+--- a/drivers/usb/serial/cypress_m8.h
++++ b/drivers/usb/serial/cypress_m8.h
+@@ -25,6 +25,9 @@
+ #define VENDOR_ID_CYPRESS 0x04b4
+ #define PRODUCT_ID_CYPHIDCOM 0x5500
+
++/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */
++#define VENDOR_ID_SAI 0x17dd
++
+ /* FRWD Dongle - a GPS sports watch */
+ #define VENDOR_ID_FRWD 0x6737
+ #define PRODUCT_ID_CYPHIDCOM_FRWD 0x0001
+diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
+index 449e89db9cea..e287fd52c575 100644
+--- a/drivers/usb/serial/iuu_phoenix.c
++++ b/drivers/usb/serial/iuu_phoenix.c
+@@ -697,14 +697,16 @@ static int iuu_uart_write(struct tty_struct *tty, struct usb_serial_port *port,
+ struct iuu_private *priv = usb_get_serial_port_data(port);
+ unsigned long flags;
+
+- if (count > 256)
+- return -ENOMEM;
+-
+ spin_lock_irqsave(&priv->lock, flags);
+
++ count = min(count, 256 - priv->writelen);
++ if (count == 0)
++ goto out;
++
+ /* fill the buffer */
+ memcpy(priv->writebuf + priv->writelen, buf, count);
+ priv->writelen += count;
++out:
+ spin_unlock_irqrestore(&priv->lock, flags);
+
+ return count;
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index d2174a5fb420..6e44aaafdcb1 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -245,6 +245,7 @@ static void option_instat_callback(struct urb *urb);
+ /* These Quectel products use Quectel's vendor ID */
+ #define QUECTEL_PRODUCT_EC21 0x0121
+ #define QUECTEL_PRODUCT_EC25 0x0125
++#define QUECTEL_PRODUCT_EG95 0x0195
+ #define QUECTEL_PRODUCT_BG96 0x0296
+ #define QUECTEL_PRODUCT_EP06 0x0306
+ #define QUECTEL_PRODUCT_EM12 0x0512
+@@ -1097,6 +1098,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(4) },
+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
+ .driver_info = RSVD(4) },
++ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95),
++ .driver_info = RSVD(4) },
+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
+@@ -2028,6 +2031,9 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(4) | RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */
+ .driver_info = RSVD(6) },
++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */
++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
+index 0afef60d0638..b3bc70a505fa 100644
+--- a/drivers/virt/vboxguest/vboxguest_core.c
++++ b/drivers/virt/vboxguest/vboxguest_core.c
+@@ -1408,7 +1408,7 @@ static int vbg_ioctl_change_guest_capabilities(struct vbg_dev *gdev,
+ or_mask = caps->u.in.or_mask;
+ not_mask = caps->u.in.not_mask;
+
+- if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK)
++ if ((or_mask | not_mask) & ~VMMDEV_GUEST_CAPABILITIES_MASK)
+ return -EINVAL;
+
+ ret = vbg_set_session_capabilities(gdev, session, or_mask, not_mask,
+@@ -1482,7 +1482,8 @@ int vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data)
+
+ /* For VMMDEV_REQUEST hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT */
+ if (req_no_size == VBG_IOCTL_VMMDEV_REQUEST(0) ||
+- req == VBG_IOCTL_VMMDEV_REQUEST_BIG)
++ req == VBG_IOCTL_VMMDEV_REQUEST_BIG ||
++ req == VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT)
+ return vbg_ioctl_vmmrequest(gdev, session, data);
+
+ if (hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT)
+@@ -1520,6 +1521,7 @@ int vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data)
+ case VBG_IOCTL_HGCM_CALL(0):
+ return vbg_ioctl_hgcm_call(gdev, session, f32bit, data);
+ case VBG_IOCTL_LOG(0):
++ case VBG_IOCTL_LOG_ALT(0):
+ return vbg_ioctl_log(data);
+ }
+
+diff --git a/drivers/virt/vboxguest/vboxguest_core.h b/drivers/virt/vboxguest/vboxguest_core.h
+index 7ad9ec45bfa9..61059e4d142b 100644
+--- a/drivers/virt/vboxguest/vboxguest_core.h
++++ b/drivers/virt/vboxguest/vboxguest_core.h
+@@ -15,6 +15,21 @@
+ #include <linux/vboxguest.h>
+ #include "vmmdev.h"
+
++/*
++ * The mainline kernel version (this version) of the vboxguest module
++ * contained a bug where it defined VBGL_IOCTL_VMMDEV_REQUEST_BIG and
++ * VBGL_IOCTL_LOG using _IOC(_IOC_READ | _IOC_WRITE, 'V', ...) instead
++ * of _IO(V, ...) as the out of tree VirtualBox upstream version does.
++ *
++ * These _ALT definitions keep compatibility with the wrong defines the
++ * mainline kernel version used for a while.
++ * Note the VirtualBox userspace bits have always been built against
++ * VirtualBox upstream's headers, so this is likely not necessary. But
++ * we must never break our ABI so we keep these around to be 100% sure.
++ */
++#define VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT _IOC(_IOC_READ | _IOC_WRITE, 'V', 3, 0)
++#define VBG_IOCTL_LOG_ALT(s) _IOC(_IOC_READ | _IOC_WRITE, 'V', 9, s)
++
+ struct vbg_session;
+
+ /** VBox guest memory balloon. */
+diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
+index 6e2a9619192d..94e055ee7ad6 100644
+--- a/drivers/virt/vboxguest/vboxguest_linux.c
++++ b/drivers/virt/vboxguest/vboxguest_linux.c
+@@ -112,7 +112,8 @@ static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
+ * the need for a bounce-buffer and another copy later on.
+ */
+ is_vmmdev_req = (req & ~IOCSIZE_MASK) == VBG_IOCTL_VMMDEV_REQUEST(0) ||
+- req == VBG_IOCTL_VMMDEV_REQUEST_BIG;
++ req == VBG_IOCTL_VMMDEV_REQUEST_BIG ||
++ req == VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT;
+
+ if (is_vmmdev_req)
+ buf = vbg_req_alloc(size, VBG_IOCTL_HDR_TYPE_DEFAULT);
+diff --git a/drivers/virt/vboxguest/vmmdev.h b/drivers/virt/vboxguest/vmmdev.h
+index 5e2ae978935d..63733ab2ab38 100644
+--- a/drivers/virt/vboxguest/vmmdev.h
++++ b/drivers/virt/vboxguest/vmmdev.h
+@@ -206,6 +206,8 @@ VMMDEV_ASSERT_SIZE(vmmdev_mask, 24 + 8);
+ * not.
+ */
+ #define VMMDEV_GUEST_SUPPORTS_GRAPHICS BIT(2)
++/* The mask of valid capabilities, for sanity checking. */
++#define VMMDEV_GUEST_CAPABILITIES_MASK 0x00000007U
+
+ /** struct vmmdev_hypervisorinfo - Hypervisor info structure. */
+ struct vmmdev_hypervisorinfo {
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 3964325432ae..6a3d89672ff7 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -18,6 +18,7 @@
+ #include <linux/swap.h>
+ #include <linux/falloc.h>
+ #include <linux/uio.h>
++#include <linux/fs.h>
+
+ static const struct file_operations fuse_direct_io_file_operations;
+
+@@ -2535,7 +2536,16 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
+ struct iovec *iov = iov_page;
+
+ iov->iov_base = (void __user *)arg;
+- iov->iov_len = _IOC_SIZE(cmd);
++
++ switch (cmd) {
++ case FS_IOC_GETFLAGS:
++ case FS_IOC_SETFLAGS:
++ iov->iov_len = sizeof(int);
++ break;
++ default:
++ iov->iov_len = _IOC_SIZE(cmd);
++ break;
++ }
+
+ if (_IOC_DIR(cmd) & _IOC_WRITE) {
+ in_iov = iov;
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index ed77b10bdfb5..9448c8461e57 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -1160,7 +1160,17 @@ static int fill_super(struct super_block *sb, struct gfs2_args *args, int silent
+ goto fail_per_node;
+ }
+
+- if (!sb_rdonly(sb)) {
++ if (sb_rdonly(sb)) {
++ struct gfs2_holder freeze_gh;
++
++ error = gfs2_glock_nq_init(sdp->sd_freeze_gl, LM_ST_SHARED,
++ GL_EXACT, &freeze_gh);
++ if (error) {
++ fs_err(sdp, "can't make FS RO: %d\n", error);
++ goto fail_per_node;
++ }
++ gfs2_glock_dq_uninit(&freeze_gh);
++ } else {
+ error = gfs2_make_fs_rw(sdp);
+ if (error) {
+ fs_err(sdp, "can't make FS RW: %d\n", error);
+diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c
+index 6fe303850c9e..ba6c7c59261a 100644
+--- a/fs/overlayfs/export.c
++++ b/fs/overlayfs/export.c
+@@ -485,7 +485,7 @@ static struct dentry *ovl_lookup_real_inode(struct super_block *sb,
+ if (IS_ERR_OR_NULL(this))
+ return this;
+
+- if (WARN_ON(ovl_dentry_real_at(this, layer->idx) != real)) {
++ if (ovl_dentry_real_at(this, layer->idx) != real) {
+ dput(this);
+ this = ERR_PTR(-EIO);
+ }
+diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
+index fa5ac5de807c..73c3e2c21edb 100644
+--- a/fs/overlayfs/file.c
++++ b/fs/overlayfs/file.c
+@@ -24,13 +24,16 @@ static char ovl_whatisit(struct inode *inode, struct inode *realinode)
+ return 'm';
+ }
+
++/* No atime modificaton nor notify on underlying */
++#define OVL_OPEN_FLAGS (O_NOATIME | FMODE_NONOTIFY)
++
+ static struct file *ovl_open_realfile(const struct file *file,
+ struct inode *realinode)
+ {
+ struct inode *inode = file_inode(file);
+ struct file *realfile;
+ const struct cred *old_cred;
+- int flags = file->f_flags | O_NOATIME | FMODE_NONOTIFY;
++ int flags = file->f_flags | OVL_OPEN_FLAGS;
+
+ old_cred = ovl_override_creds(inode->i_sb);
+ realfile = open_with_fake_path(&file->f_path, flags, realinode,
+@@ -51,8 +54,7 @@ static int ovl_change_flags(struct file *file, unsigned int flags)
+ struct inode *inode = file_inode(file);
+ int err;
+
+- /* No atime modificaton on underlying */
+- flags |= O_NOATIME | FMODE_NONOTIFY;
++ flags |= OVL_OPEN_FLAGS;
+
+ /* If some flag changed that cannot be changed then something's amiss */
+ if (WARN_ON((file->f_flags ^ flags) & ~OVL_SETFL_MASK))
+@@ -105,7 +107,7 @@ static int ovl_real_fdget_meta(const struct file *file, struct fd *real,
+ }
+
+ /* Did the flags change since open? */
+- if (unlikely((file->f_flags ^ real->file->f_flags) & ~O_NOATIME))
++ if (unlikely((file->f_flags ^ real->file->f_flags) & ~OVL_OPEN_FLAGS))
+ return ovl_change_flags(real->file, file->f_flags);
+
+ return 0;
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 127df4a85c8a..246623406db9 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -1310,14 +1310,23 @@ static int ovl_get_lower_layers(struct super_block *sb, struct ovl_fs *ofs,
+ if (err < 0)
+ goto out;
+
++ /*
++ * Check if lower root conflicts with this overlay layers before
++ * checking if it is in-use as upperdir/workdir of "another"
++ * mount, because we do not bother to check in ovl_is_inuse() if
++ * the upperdir/workdir is in fact in-use by our
++ * upperdir/workdir.
++ */
+ err = ovl_setup_trap(sb, stack[i].dentry, &trap, "lowerdir");
+ if (err)
+ goto out;
+
+ if (ovl_is_inuse(stack[i].dentry)) {
+ err = ovl_report_in_use(ofs, "lowerdir");
+- if (err)
++ if (err) {
++ iput(trap);
+ goto out;
++ }
+ }
+
+ mnt = clone_private_mount(&stack[i]);
+diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
+index a01ebb630abc..f92264d1ed4f 100644
+--- a/include/linux/cgroup-defs.h
++++ b/include/linux/cgroup-defs.h
+@@ -755,7 +755,9 @@ struct sock_cgroup_data {
+ union {
+ #ifdef __LITTLE_ENDIAN
+ struct {
+- u8 is_data;
++ u8 is_data : 1;
++ u8 no_refcnt : 1;
++ u8 unused : 6;
+ u8 padding;
+ u16 prioidx;
+ u32 classid;
+@@ -765,7 +767,9 @@ struct sock_cgroup_data {
+ u32 classid;
+ u16 prioidx;
+ u8 padding;
+- u8 is_data;
++ u8 unused : 6;
++ u8 no_refcnt : 1;
++ u8 is_data : 1;
+ } __packed;
+ #endif
+ u64 val;
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index 5ed1a2b285cd..02da4e1def61 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -810,6 +810,7 @@ extern spinlock_t cgroup_sk_update_lock;
+
+ void cgroup_sk_alloc_disable(void);
+ void cgroup_sk_alloc(struct sock_cgroup_data *skcd);
++void cgroup_sk_clone(struct sock_cgroup_data *skcd);
+ void cgroup_sk_free(struct sock_cgroup_data *skcd);
+
+ static inline struct cgroup *sock_cgroup_ptr(struct sock_cgroup_data *skcd)
+@@ -823,7 +824,7 @@ static inline struct cgroup *sock_cgroup_ptr(struct sock_cgroup_data *skcd)
+ */
+ v = READ_ONCE(skcd->val);
+
+- if (v & 1)
++ if (v & 3)
+ return &cgrp_dfl_root.cgrp;
+
+ return (struct cgroup *)(unsigned long)v ?: &cgrp_dfl_root.cgrp;
+@@ -835,6 +836,7 @@ static inline struct cgroup *sock_cgroup_ptr(struct sock_cgroup_data *skcd)
+ #else /* CONFIG_CGROUP_DATA */
+
+ static inline void cgroup_sk_alloc(struct sock_cgroup_data *skcd) {}
++static inline void cgroup_sk_clone(struct sock_cgroup_data *skcd) {}
+ static inline void cgroup_sk_free(struct sock_cgroup_data *skcd) {}
+
+ #endif /* CONFIG_CGROUP_DATA */
+diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
+index 83ea4df6ab81..60afff19d7fc 100644
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -30,6 +30,8 @@
+ #define VLAN_ETH_DATA_LEN 1500 /* Max. octets in payload */
+ #define VLAN_ETH_FRAME_LEN 1518 /* Max. octets in frame sans FCS */
+
++#define VLAN_MAX_DEPTH 8 /* Max. number of nested VLAN tags parsed */
++
+ /*
+ * struct vlan_hdr - vlan header
+ * @h_vlan_TCI: priority and VLAN ID
+@@ -558,10 +560,10 @@ static inline int vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)
+ * Returns the EtherType of the packet, regardless of whether it is
+ * vlan encapsulated (normal or hardware accelerated) or not.
+ */
+-static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
++static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type,
+ int *depth)
+ {
+- unsigned int vlan_depth = skb->mac_len;
++ unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH;
+
+ /* if type is 802.1Q/AD then the header should already be
+ * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
+@@ -576,13 +578,12 @@ static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
+ vlan_depth = ETH_HLEN;
+ }
+ do {
+- struct vlan_hdr *vh;
++ struct vlan_hdr vhdr, *vh;
+
+- if (unlikely(!pskb_may_pull(skb,
+- vlan_depth + VLAN_HLEN)))
++ vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), &vhdr);
++ if (unlikely(!vh || !--parse_depth))
+ return 0;
+
+- vh = (struct vlan_hdr *)(skb->data + vlan_depth);
+ type = vh->h_vlan_encapsulated_proto;
+ vlan_depth += VLAN_HLEN;
+ } while (eth_type_vlan(type));
+@@ -601,11 +602,25 @@ static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
+ * Returns the EtherType of the packet, regardless of whether it is
+ * vlan encapsulated (normal or hardware accelerated) or not.
+ */
+-static inline __be16 vlan_get_protocol(struct sk_buff *skb)
++static inline __be16 vlan_get_protocol(const struct sk_buff *skb)
+ {
+ return __vlan_get_protocol(skb, skb->protocol, NULL);
+ }
+
++/* A getter for the SKB protocol field which will handle VLAN tags consistently
++ * whether VLAN acceleration is enabled or not.
++ */
++static inline __be16 skb_protocol(const struct sk_buff *skb, bool skip_vlan)
++{
++ if (!skip_vlan)
++ /* VLAN acceleration strips the VLAN header from the skb and
++ * moves it to skb->vlan_proto
++ */
++ return skb_vlan_tag_present(skb) ? skb->vlan_proto : skb->protocol;
++
++ return vlan_get_protocol(skb);
++}
++
+ static inline void vlan_set_encap_proto(struct sk_buff *skb,
+ struct vlan_hdr *vhdr)
+ {
+diff --git a/include/linux/printk.h b/include/linux/printk.h
+index cf3eccfe1543..6dd867e39365 100644
+--- a/include/linux/printk.h
++++ b/include/linux/printk.h
+@@ -206,7 +206,6 @@ __printf(1, 2) void dump_stack_set_arch_desc(const char *fmt, ...);
+ void dump_stack_print_info(const char *log_lvl);
+ void show_regs_print_info(const char *log_lvl);
+ extern asmlinkage void dump_stack(void) __cold;
+-extern void printk_safe_init(void);
+ extern void printk_safe_flush(void);
+ extern void printk_safe_flush_on_panic(void);
+ #else
+@@ -273,10 +272,6 @@ static inline asmlinkage void dump_stack(void)
+ {
+ }
+
+-static inline void printk_safe_init(void)
+-{
+-}
+-
+ static inline void printk_safe_flush(void)
+ {
+ }
+diff --git a/include/net/dst.h b/include/net/dst.h
+index 35ae45fa0758..d2728525df5a 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -412,7 +412,15 @@ static inline struct neighbour *dst_neigh_lookup(const struct dst_entry *dst, co
+ static inline struct neighbour *dst_neigh_lookup_skb(const struct dst_entry *dst,
+ struct sk_buff *skb)
+ {
+- struct neighbour *n = dst->ops->neigh_lookup(dst, skb, NULL);
++ struct neighbour *n = NULL;
++
++ /* The packets from tunnel devices (eg bareudp) may have only
++ * metadata in the dst pointer of skb. Hence a pointer check of
++ * neigh_lookup is needed.
++ */
++ if (dst->ops->neigh_lookup)
++ n = dst->ops->neigh_lookup(dst, skb, NULL);
++
+ return IS_ERR(n) ? NULL : n;
+ }
+
+diff --git a/include/net/genetlink.h b/include/net/genetlink.h
+index decf6012a401..3e3a1a38884a 100644
+--- a/include/net/genetlink.h
++++ b/include/net/genetlink.h
+@@ -34,12 +34,6 @@ struct genl_info;
+ * do additional, common, filtering and return an error
+ * @post_doit: called after an operation's doit callback, it may
+ * undo operations done by pre_doit, for example release locks
+- * @mcast_bind: a socket bound to the given multicast group (which
+- * is given as the offset into the groups array)
+- * @mcast_unbind: a socket was unbound from the given multicast group.
+- * Note that unbind() will not be called symmetrically if the
+- * generic netlink family is removed while there are still open
+- * sockets.
+ * @attrbuf: buffer to store parsed attributes (private)
+ * @mcgrps: multicast groups used by this family
+ * @n_mcgrps: number of multicast groups
+@@ -62,8 +56,6 @@ struct genl_family {
+ void (*post_doit)(const struct genl_ops *ops,
+ struct sk_buff *skb,
+ struct genl_info *info);
+- int (*mcast_bind)(struct net *net, int group);
+- void (*mcast_unbind)(struct net *net, int group);
+ struct nlattr ** attrbuf; /* private */
+ const struct genl_ops * ops;
+ const struct genl_multicast_group *mcgrps;
+diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
+index 482a1b705362..f667db202a3e 100644
+--- a/include/net/inet_ecn.h
++++ b/include/net/inet_ecn.h
+@@ -4,6 +4,7 @@
+
+ #include <linux/ip.h>
+ #include <linux/skbuff.h>
++#include <linux/if_vlan.h>
+
+ #include <net/inet_sock.h>
+ #include <net/dsfield.h>
+@@ -142,7 +143,7 @@ static inline void ipv6_copy_dscp(unsigned int dscp, struct ipv6hdr *inner)
+
+ static inline int INET_ECN_set_ce(struct sk_buff *skb)
+ {
+- switch (skb->protocol) {
++ switch (skb_protocol(skb, true)) {
+ case cpu_to_be16(ETH_P_IP):
+ if (skb_network_header(skb) + sizeof(struct iphdr) <=
+ skb_tail_pointer(skb))
+@@ -209,12 +210,16 @@ static inline int IP_ECN_decapsulate(const struct iphdr *oiph,
+ {
+ __u8 inner;
+
+- if (skb->protocol == htons(ETH_P_IP))
++ switch (skb_protocol(skb, true)) {
++ case htons(ETH_P_IP):
+ inner = ip_hdr(skb)->tos;
+- else if (skb->protocol == htons(ETH_P_IPV6))
++ break;
++ case htons(ETH_P_IPV6):
+ inner = ipv6_get_dsfield(ipv6_hdr(skb));
+- else
++ break;
++ default:
+ return 0;
++ }
+
+ return INET_ECN_decapsulate(skb, oiph->tos, inner);
+ }
+@@ -224,12 +229,16 @@ static inline int IP6_ECN_decapsulate(const struct ipv6hdr *oipv6h,
+ {
+ __u8 inner;
+
+- if (skb->protocol == htons(ETH_P_IP))
++ switch (skb_protocol(skb, true)) {
++ case htons(ETH_P_IP):
+ inner = ip_hdr(skb)->tos;
+- else if (skb->protocol == htons(ETH_P_IPV6))
++ break;
++ case htons(ETH_P_IPV6):
+ inner = ipv6_get_dsfield(ipv6_hdr(skb));
+- else
++ break;
++ default:
+ return 0;
++ }
+
+ return INET_ECN_decapsulate(skb, ipv6_get_dsfield(oipv6h), inner);
+ }
+diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
+index 7dc769e5452b..5e99771a5dcc 100644
+--- a/include/net/pkt_sched.h
++++ b/include/net/pkt_sched.h
+@@ -122,17 +122,6 @@ static inline void qdisc_run(struct Qdisc *q)
+ }
+ }
+
+-static inline __be16 tc_skb_protocol(const struct sk_buff *skb)
+-{
+- /* We need to take extra care in case the skb came via
+- * vlan accelerated path. In that case, use skb->vlan_proto
+- * as the original vlan header was already stripped.
+- */
+- if (skb_vlan_tag_present(skb))
+- return skb->vlan_proto;
+- return skb->protocol;
+-}
+-
+ /* Calculate maximal size of packet seen by hard_start_xmit
+ routine of this device.
+ */
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index bc5b232440b6..ca29a5b8603c 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -408,7 +408,7 @@ enum rxrpc_tx_point {
+ EM(rxrpc_cong_begin_retransmission, " Retrans") \
+ EM(rxrpc_cong_cleared_nacks, " Cleared") \
+ EM(rxrpc_cong_new_low_nack, " NewLowN") \
+- EM(rxrpc_cong_no_change, "") \
++ EM(rxrpc_cong_no_change, " -") \
+ EM(rxrpc_cong_progress, " Progres") \
+ EM(rxrpc_cong_retransmit_again, " ReTxAgn") \
+ EM(rxrpc_cong_rtt_window_end, " RttWinE") \
+diff --git a/include/uapi/linux/vboxguest.h b/include/uapi/linux/vboxguest.h
+index 612f0c7d3558..ded39da305d0 100644
+--- a/include/uapi/linux/vboxguest.h
++++ b/include/uapi/linux/vboxguest.h
+@@ -103,7 +103,7 @@ VMMDEV_ASSERT_SIZE(vbg_ioctl_driver_version_info, 24 + 20);
+
+
+ /* IOCTL to perform a VMM Device request larger then 1KB. */
+-#define VBG_IOCTL_VMMDEV_REQUEST_BIG _IOC(_IOC_READ | _IOC_WRITE, 'V', 3, 0)
++#define VBG_IOCTL_VMMDEV_REQUEST_BIG _IO('V', 3)
+
+
+ /** VBG_IOCTL_HGCM_CONNECT data structure. */
+@@ -198,7 +198,7 @@ struct vbg_ioctl_log {
+ } u;
+ };
+
+-#define VBG_IOCTL_LOG(s) _IOC(_IOC_READ | _IOC_WRITE, 'V', 9, s)
++#define VBG_IOCTL_LOG(s) _IO('V', 9)
+
+
+ /** VBG_IOCTL_WAIT_FOR_EVENTS data structure. */
+diff --git a/init/main.c b/init/main.c
+index ec78f2312610..fdfef08da0c4 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -641,7 +641,6 @@ asmlinkage __visible void __init start_kernel(void)
+ softirq_init();
+ timekeeping_init();
+ time_init();
+- printk_safe_init();
+ perf_event_init();
+ profile_init();
+ call_function_init();
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 877ba6dacca8..6ae98c714edd 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -5928,17 +5928,8 @@ void cgroup_sk_alloc_disable(void)
+
+ void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
+ {
+- if (cgroup_sk_alloc_disabled)
+- return;
+-
+- /* Socket clone path */
+- if (skcd->val) {
+- /*
+- * We might be cloning a socket which is left in an empty
+- * cgroup and the cgroup might have already been rmdir'd.
+- * Don't use cgroup_get_live().
+- */
+- cgroup_get(sock_cgroup_ptr(skcd));
++ if (cgroup_sk_alloc_disabled) {
++ skcd->no_refcnt = 1;
+ return;
+ }
+
+@@ -5962,8 +5953,24 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
+ rcu_read_unlock();
+ }
+
++void cgroup_sk_clone(struct sock_cgroup_data *skcd)
++{
++ /* Socket clone path */
++ if (skcd->val) {
++ /*
++ * We might be cloning a socket which is left in an empty
++ * cgroup and the cgroup might have already been rmdir'd.
++ * Don't use cgroup_get_live().
++ */
++ cgroup_get(sock_cgroup_ptr(skcd));
++ }
++}
++
+ void cgroup_sk_free(struct sock_cgroup_data *skcd)
+ {
++ if (skcd->no_refcnt)
++ return;
++
+ cgroup_put(sock_cgroup_ptr(skcd));
+ }
+
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index efcb54ee0922..025fcd029f83 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -194,9 +194,9 @@ void irq_set_thread_affinity(struct irq_desc *desc)
+ set_bit(IRQTF_AFFINITY, &action->thread_flags);
+ }
+
++#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
+ static void irq_validate_effective_affinity(struct irq_data *data)
+ {
+-#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
+ const struct cpumask *m = irq_data_get_effective_affinity_mask(data);
+ struct irq_chip *chip = irq_data_get_irq_chip(data);
+
+@@ -204,9 +204,19 @@ static void irq_validate_effective_affinity(struct irq_data *data)
+ return;
+ pr_warn_once("irq_chip %s did not update eff. affinity mask of irq %u\n",
+ chip->name, data->irq);
+-#endif
+ }
+
++static inline void irq_init_effective_affinity(struct irq_data *data,
++ const struct cpumask *mask)
++{
++ cpumask_copy(irq_data_get_effective_affinity_mask(data), mask);
++}
++#else
++static inline void irq_validate_effective_affinity(struct irq_data *data) { }
++static inline void irq_init_effective_affinity(struct irq_data *data,
++ const struct cpumask *mask) { }
++#endif
++
+ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
+ bool force)
+ {
+@@ -264,6 +274,26 @@ static int irq_try_set_affinity(struct irq_data *data,
+ return ret;
+ }
+
++static bool irq_set_affinity_deactivated(struct irq_data *data,
++ const struct cpumask *mask, bool force)
++{
++ struct irq_desc *desc = irq_data_to_desc(data);
++
++ /*
++ * If the interrupt is not yet activated, just store the affinity
++ * mask and do not call the chip driver at all. On activation the
++ * driver has to make sure anyway that the interrupt is in a
++ * useable state so startup works.
++ */
++ if (!IS_ENABLED(CONFIG_IRQ_DOMAIN_HIERARCHY) || irqd_is_activated(data))
++ return false;
++
++ cpumask_copy(desc->irq_common_data.affinity, mask);
++ irq_init_effective_affinity(data, mask);
++ irqd_set(data, IRQD_AFFINITY_SET);
++ return true;
++}
++
+ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
+ bool force)
+ {
+@@ -274,6 +304,9 @@ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
+ if (!chip || !chip->irq_set_affinity)
+ return -EINVAL;
+
++ if (irq_set_affinity_deactivated(data, mask, force))
++ return 0;
++
+ if (irq_can_move_pcntxt(data) && !irqd_is_setaffinity_pending(data)) {
+ ret = irq_try_set_affinity(data, mask, force);
+ } else {
+diff --git a/kernel/printk/internal.h b/kernel/printk/internal.h
+index 0f1898820cba..c27d47058841 100644
+--- a/kernel/printk/internal.h
++++ b/kernel/printk/internal.h
+@@ -35,6 +35,9 @@ __printf(1, 0) int vprintk_func(const char *fmt, va_list args);
+ void __printk_safe_enter(void);
+ void __printk_safe_exit(void);
+
++void printk_safe_init(void);
++bool printk_percpu_data_ready(void);
++
+ #define printk_safe_enter_irqsave(flags) \
+ do { \
+ local_irq_save(flags); \
+@@ -76,4 +79,6 @@ __printf(1, 0) int vprintk_func(const char *fmt, va_list args) { return 0; }
+ #define printk_safe_enter_irq() local_irq_disable()
+ #define printk_safe_exit_irq() local_irq_enable()
+
++static inline void printk_safe_init(void) { }
++static inline bool printk_percpu_data_ready(void) { return false; }
+ #endif /* CONFIG_PRINTK */
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 7a2fdc097c8c..3cb0e5b479ff 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -443,6 +443,18 @@ static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN);
+ static char *log_buf = __log_buf;
+ static u32 log_buf_len = __LOG_BUF_LEN;
+
++/*
++ * We cannot access per-CPU data (e.g. per-CPU flush irq_work) before
++ * per_cpu_areas are initialised. This variable is set to true when
++ * it's safe to access per-CPU data.
++ */
++static bool __printk_percpu_data_ready __read_mostly;
++
++bool printk_percpu_data_ready(void)
++{
++ return __printk_percpu_data_ready;
++}
++
+ /* Return log buffer address */
+ char *log_buf_addr_get(void)
+ {
+@@ -1101,12 +1113,28 @@ static void __init log_buf_add_cpu(void)
+ static inline void log_buf_add_cpu(void) {}
+ #endif /* CONFIG_SMP */
+
++static void __init set_percpu_data_ready(void)
++{
++ printk_safe_init();
++ /* Make sure we set this flag only after printk_safe() init is done */
++ barrier();
++ __printk_percpu_data_ready = true;
++}
++
+ void __init setup_log_buf(int early)
+ {
+ unsigned long flags;
+ char *new_log_buf;
+ unsigned int free;
+
++ /*
++ * Some archs call setup_log_buf() multiple times - first is very
++ * early, e.g. from setup_arch(), and second - when percpu_areas
++ * are initialised.
++ */
++ if (!early)
++ set_percpu_data_ready();
++
+ if (log_buf != __log_buf)
+ return;
+
+@@ -2913,6 +2941,9 @@ static DEFINE_PER_CPU(struct irq_work, wake_up_klogd_work) = {
+
+ void wake_up_klogd(void)
+ {
++ if (!printk_percpu_data_ready())
++ return;
++
+ preempt_disable();
+ if (waitqueue_active(&log_wait)) {
+ this_cpu_or(printk_pending, PRINTK_PENDING_WAKEUP);
+@@ -2923,6 +2954,9 @@ void wake_up_klogd(void)
+
+ void defer_console_output(void)
+ {
++ if (!printk_percpu_data_ready())
++ return;
++
+ preempt_disable();
+ __this_cpu_or(printk_pending, PRINTK_PENDING_OUTPUT);
+ irq_work_queue(this_cpu_ptr(&wake_up_klogd_work));
+diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c
+index 0913b4d385de..82003d0d2e9f 100644
+--- a/kernel/printk/printk_safe.c
++++ b/kernel/printk/printk_safe.c
+@@ -39,7 +39,6 @@
+ * There are situations when we want to make sure that all buffers
+ * were handled or when IRQs are blocked.
+ */
+-static int printk_safe_irq_ready __read_mostly;
+
+ #define SAFE_LOG_BUF_LEN ((1 << CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT) - \
+ sizeof(atomic_t) - \
+@@ -63,7 +62,7 @@ static DEFINE_PER_CPU(struct printk_safe_seq_buf, nmi_print_seq);
+ /* Get flushed in a more safe context. */
+ static void queue_flush_work(struct printk_safe_seq_buf *s)
+ {
+- if (printk_safe_irq_ready)
++ if (printk_percpu_data_ready())
+ irq_work_queue(&s->work);
+ }
+
+@@ -414,14 +413,6 @@ void __init printk_safe_init(void)
+ #endif
+ }
+
+- /*
+- * In the highly unlikely event that a NMI were to trigger at
+- * this moment. Make sure IRQ work is set up before this
+- * variable is set.
+- */
+- barrier();
+- printk_safe_irq_ready = 1;
+-
+ /* Flush pending messages that did not have scheduled IRQ works. */
+ printk_safe_flush();
+ }
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 843394d0ea42..faef74f63262 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -2345,6 +2345,7 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p)
+ * Silence PROVE_RCU.
+ */
+ raw_spin_lock_irqsave(&p->pi_lock, flags);
++ rseq_migrate(p);
+ /*
+ * We're setting the CPU for the first time, we don't migrate,
+ * so use __set_task_cpu().
+@@ -2409,6 +2410,7 @@ void wake_up_new_task(struct task_struct *p)
+ * as we're not fully set-up yet.
+ */
+ p->recent_used_cpu = task_cpu(p);
++ rseq_migrate(p);
+ __set_task_cpu(p, select_task_rq(p, task_cpu(p), SD_BALANCE_FORK, 0));
+ #endif
+ rq = __task_rq_lock(p, &rf);
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 92b1e71f13c8..d8c249e6dcb7 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7337,7 +7337,15 @@ static int detach_tasks(struct lb_env *env)
+ if (!can_migrate_task(p, env))
+ goto next;
+
+- load = task_h_load(p);
++ /*
++ * Depending of the number of CPUs and tasks and the
++ * cgroup hierarchy, task_h_load() can return a null
++ * value. Make sure that env->imbalance decreases
++ * otherwise detach_tasks() will stop only after
++ * detaching up to loop_max tasks.
++ */
++ load = max_t(unsigned long, task_h_load(p), 1);
++
+
+ if (sched_feat(LB_MIN) && load < 16 && !env->sd->nr_balance_failed)
+ goto next;
+diff --git a/kernel/time/timer.c b/kernel/time/timer.c
+index ae64cb819a9a..6c54cf481fde 100644
+--- a/kernel/time/timer.c
++++ b/kernel/time/timer.c
+@@ -519,8 +519,8 @@ static int calc_wheel_index(unsigned long expires, unsigned long clk)
+ * Force expire obscene large timeouts to expire at the
+ * capacity limit of the wheel.
+ */
+- if (expires >= WHEEL_TIMEOUT_CUTOFF)
+- expires = WHEEL_TIMEOUT_MAX;
++ if (delta >= WHEEL_TIMEOUT_CUTOFF)
++ expires = clk + WHEEL_TIMEOUT_MAX;
+
+ idx = calc_index(expires, LVL_DEPTH - 1);
+ }
+@@ -580,7 +580,15 @@ trigger_dyntick_cpu(struct timer_base *base, struct timer_list *timer)
+ * Set the next expiry time and kick the CPU so it can reevaluate the
+ * wheel:
+ */
+- base->next_expiry = timer->expires;
++ if (time_before(timer->expires, base->clk)) {
++ /*
++ * Prevent from forward_timer_base() moving the base->clk
++ * backward
++ */
++ base->next_expiry = base->clk;
++ } else {
++ base->next_expiry = timer->expires;
++ }
+ wake_up_nohz_cpu(base->cpu);
+ }
+
+@@ -899,10 +907,13 @@ static inline void forward_timer_base(struct timer_base *base)
+ * If the next expiry value is > jiffies, then we fast forward to
+ * jiffies otherwise we forward to the next expiry value.
+ */
+- if (time_after(base->next_expiry, jnow))
++ if (time_after(base->next_expiry, jnow)) {
+ base->clk = jnow;
+- else
++ } else {
++ if (WARN_ON_ONCE(time_before(base->next_expiry, base->clk)))
++ return;
+ base->clk = base->next_expiry;
++ }
+ #endif
+ }
+
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index b8c4aea42917..713fe1fbcb18 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -442,6 +442,7 @@ static void target_copy(struct ceph_osd_request_target *dest,
+ dest->size = src->size;
+ dest->min_size = src->min_size;
+ dest->sort_bitwise = src->sort_bitwise;
++ dest->recovery_deletes = src->recovery_deletes;
+
+ dest->flags = src->flags;
+ dest->paused = src->paused;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 636e67a92847..25a2c3186e14 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2695,7 +2695,7 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
+
+ static int bpf_skb_proto_xlat(struct sk_buff *skb, __be16 to_proto)
+ {
+- __be16 from_proto = skb->protocol;
++ __be16 from_proto = skb_protocol(skb, true);
+
+ if (from_proto == htons(ETH_P_IP) &&
+ to_proto == htons(ETH_P_IPV6))
+@@ -2768,7 +2768,7 @@ static const struct bpf_func_proto bpf_skb_change_type_proto = {
+
+ static u32 bpf_skb_net_base_len(const struct sk_buff *skb)
+ {
+- switch (skb->protocol) {
++ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
+ return sizeof(struct iphdr);
+ case htons(ETH_P_IPV6):
+@@ -2848,7 +2848,7 @@ static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff)
+ u32 len_cur, len_diff_abs = abs(len_diff);
+ u32 len_min = bpf_skb_net_base_len(skb);
+ u32 len_max = __bpf_skb_max_len(skb);
+- __be16 proto = skb->protocol;
++ __be16 proto = skb_protocol(skb, true);
+ bool shrink = len_diff < 0;
+ int ret;
+
+@@ -4552,7 +4552,7 @@ static int bpf_push_seg6_encap(struct sk_buff *skb, u32 type, void *hdr, u32 len
+
+ switch (type) {
+ case BPF_LWT_ENCAP_SEG6_INLINE:
+- if (skb->protocol != htons(ETH_P_IPV6))
++ if (skb_protocol(skb, true) != htons(ETH_P_IPV6))
+ return -EBADMSG;
+
+ err = seg6_do_srh_inline(skb, srh);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 8721264a2b39..6c3b031b6ad6 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1694,7 +1694,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
+ /* sk->sk_memcg will be populated at accept() time */
+ newsk->sk_memcg = NULL;
+
+- cgroup_sk_alloc(&newsk->sk_cgrp_data);
++ cgroup_sk_clone(&newsk->sk_cgrp_data);
+
+ rcu_read_lock();
+ filter = rcu_dereference(sk->sk_filter);
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 8d7aaf118a30..c59144502ee8 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -791,6 +791,9 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ inet_sk_flowi_flags(sk), faddr, saddr, 0, 0,
+ sk->sk_uid);
+
++ fl4.fl4_icmp_type = user_icmph.type;
++ fl4.fl4_icmp_code = user_icmph.code;
++
+ security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
+ rt = ip_route_output_flow(net, &fl4, sk);
+ if (IS_ERR(rt)) {
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index d31a4f5d25e8..616ff2970f4f 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2601,6 +2601,9 @@ int tcp_disconnect(struct sock *sk, int flags)
+ tp->window_clamp = 0;
+ tp->delivered = 0;
+ tp->delivered_ce = 0;
++ if (icsk->icsk_ca_ops->release)
++ icsk->icsk_ca_ops->release(sk);
++ memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
+ tcp_set_ca_state(sk, TCP_CA_Open);
+ tp->is_sack_reneg = 0;
+ tcp_clear_retrans(tp);
+@@ -3012,10 +3015,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ #ifdef CONFIG_TCP_MD5SIG
+ case TCP_MD5SIG:
+ case TCP_MD5SIG_EXT:
+- if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
+- err = tp->af_specific->md5_parse(sk, optname, optval, optlen);
+- else
+- err = -EINVAL;
++ err = tp->af_specific->md5_parse(sk, optname, optval, optlen);
+ break;
+ #endif
+ case TCP_USER_TIMEOUT:
+@@ -3753,10 +3753,13 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data);
+
+ int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *key)
+ {
++ u8 keylen = READ_ONCE(key->keylen); /* paired with WRITE_ONCE() in tcp_md5_do_add */
+ struct scatterlist sg;
+
+- sg_init_one(&sg, key->key, key->keylen);
+- ahash_request_set_crypt(hp->md5_req, &sg, NULL, key->keylen);
++ sg_init_one(&sg, key->key, keylen);
++ ahash_request_set_crypt(hp->md5_req, &sg, NULL, keylen);
++
++ /* tcp_md5_do_add() might change key->key under us */
+ return crypto_ahash_update(hp->md5_req);
+ }
+ EXPORT_SYMBOL(tcp_md5_hash_key);
+diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
+index 48f79db446a0..32c3162baf3e 100644
+--- a/net/ipv4/tcp_cong.c
++++ b/net/ipv4/tcp_cong.c
+@@ -196,7 +196,7 @@ static void tcp_reinit_congestion_control(struct sock *sk,
+ icsk->icsk_ca_setsockopt = 1;
+ memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
+
+- if (sk->sk_state != TCP_CLOSE)
++ if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
+ tcp_init_congestion_control(sk);
+ }
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 7441ecfc8320..2896840618fa 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4494,6 +4494,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
+
+ if (unlikely(tcp_try_rmem_schedule(sk, skb, skb->truesize))) {
+ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPOFODROP);
++ sk->sk_data_ready(sk);
+ tcp_drop(sk, skb);
+ return;
+ }
+@@ -4739,6 +4740,7 @@ queue_and_out:
+ sk_forced_mem_schedule(sk, skb->truesize);
+ else if (tcp_try_rmem_schedule(sk, skb, skb->truesize)) {
+ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRCVQDROP);
++ sk->sk_data_ready(sk);
+ goto drop;
+ }
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 6da393016c11..7536f4c0bbf4 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1063,9 +1063,18 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
+
+ key = tcp_md5_do_lookup_exact(sk, addr, family, prefixlen);
+ if (key) {
+- /* Pre-existing entry - just update that one. */
++ /* Pre-existing entry - just update that one.
++ * Note that the key might be used concurrently.
++ */
+ memcpy(key->key, newkey, newkeylen);
+- key->keylen = newkeylen;
++
++ /* Pairs with READ_ONCE() in tcp_md5_hash_key().
++ * Also note that a reader could catch new key->keylen value
++ * but old key->key[], this is the reason we use __GFP_ZERO
++ * at sock_kmalloc() time below these lines.
++ */
++ WRITE_ONCE(key->keylen, newkeylen);
++
+ return 0;
+ }
+
+@@ -1081,7 +1090,7 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
+ rcu_assign_pointer(tp->md5sig_info, md5sig);
+ }
+
+- key = sock_kmalloc(sk, sizeof(*key), gfp);
++ key = sock_kmalloc(sk, sizeof(*key), gfp | __GFP_ZERO);
+ if (!key)
+ return -ENOMEM;
+ if (!tcp_alloc_md5sig_pool()) {
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index cc4ba42052c2..b4d0d0aa6b38 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -648,7 +648,8 @@ static unsigned int tcp_synack_options(const struct sock *sk,
+ unsigned int mss, struct sk_buff *skb,
+ struct tcp_out_options *opts,
+ const struct tcp_md5sig_key *md5,
+- struct tcp_fastopen_cookie *foc)
++ struct tcp_fastopen_cookie *foc,
++ enum tcp_synack_type synack_type)
+ {
+ struct inet_request_sock *ireq = inet_rsk(req);
+ unsigned int remaining = MAX_TCP_OPTION_SPACE;
+@@ -663,7 +664,8 @@ static unsigned int tcp_synack_options(const struct sock *sk,
+ * rather than TS in order to fit in better with old,
+ * buggy kernels, but that was deemed to be unnecessary.
+ */
+- ireq->tstamp_ok &= !ireq->sack_ok;
++ if (synack_type != TCP_SYNACK_COOKIE)
++ ireq->tstamp_ok &= !ireq->sack_ok;
+ }
+ #endif
+
+@@ -3246,7 +3248,7 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst,
+ #endif
+ skb_set_hash(skb, tcp_rsk(req)->txhash, PKT_HASH_TYPE_L4);
+ tcp_header_size = tcp_synack_options(sk, req, mss, skb, &opts, md5,
+- foc) + sizeof(*th);
++ foc, synack_type) + sizeof(*th);
+
+ skb_push(skb, tcp_header_size);
+ skb_reset_transport_header(skb);
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 9aa1c1fcb77c..9abdc0a04d99 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1033,6 +1033,7 @@ static void l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
+
+ /* Queue the packet to IP for output */
+ skb->ignore_df = 1;
++ skb_dst_drop(skb);
+ #if IS_ENABLED(CONFIG_IPV6)
+ if (l2tp_sk_is_v6(tunnel->sock))
+ error = inet6_csk_xmit(tunnel->sock, skb, NULL);
+@@ -1104,10 +1105,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
+ goto out_unlock;
+ }
+
+- /* Get routing info from the tunnel socket */
+- skb_dst_drop(skb);
+- skb_dst_set(skb, sk_dst_check(sk, 0));
+-
+ inet = inet_sk(sk);
+ fl = &inet->cork.fl;
+ switch (tunnel->encap) {
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index ce841d59bc72..6ead3c39f356 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -273,6 +273,10 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
+
+ if (!sock_flag(sk, SOCK_ZAPPED))
+ goto out;
++ if (!addr->sllc_arphrd)
++ addr->sllc_arphrd = ARPHRD_ETHER;
++ if (addr->sllc_arphrd != ARPHRD_ETHER)
++ goto out;
+ rc = -ENODEV;
+ if (sk->sk_bound_dev_if) {
+ llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+@@ -330,15 +334,15 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
+ if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
+ goto out;
+ rc = -EAFNOSUPPORT;
+- if (unlikely(addr->sllc_family != AF_LLC))
++ if (!addr->sllc_arphrd)
++ addr->sllc_arphrd = ARPHRD_ETHER;
++ if (unlikely(addr->sllc_family != AF_LLC || addr->sllc_arphrd != ARPHRD_ETHER))
+ goto out;
+ rc = -ENODEV;
+ rcu_read_lock();
+ if (sk->sk_bound_dev_if) {
+ llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
+ if (llc->dev) {
+- if (!addr->sllc_arphrd)
+- addr->sllc_arphrd = llc->dev->type;
+ if (is_zero_ether_addr(addr->sllc_mac))
+ memcpy(addr->sllc_mac, llc->dev->dev_addr,
+ IFHWADDRLEN);
+diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
+index f0ec068e1d02..ede73ecfb1f5 100644
+--- a/net/netlink/genetlink.c
++++ b/net/netlink/genetlink.c
+@@ -961,60 +961,11 @@ static struct genl_family genl_ctrl __ro_after_init = {
+ .netnsok = true,
+ };
+
+-static int genl_bind(struct net *net, int group)
+-{
+- struct genl_family *f;
+- int err = -ENOENT;
+- unsigned int id;
+-
+- down_read(&cb_lock);
+-
+- idr_for_each_entry(&genl_fam_idr, f, id) {
+- if (group >= f->mcgrp_offset &&
+- group < f->mcgrp_offset + f->n_mcgrps) {
+- int fam_grp = group - f->mcgrp_offset;
+-
+- if (!f->netnsok && net != &init_net)
+- err = -ENOENT;
+- else if (f->mcast_bind)
+- err = f->mcast_bind(net, fam_grp);
+- else
+- err = 0;
+- break;
+- }
+- }
+- up_read(&cb_lock);
+-
+- return err;
+-}
+-
+-static void genl_unbind(struct net *net, int group)
+-{
+- struct genl_family *f;
+- unsigned int id;
+-
+- down_read(&cb_lock);
+-
+- idr_for_each_entry(&genl_fam_idr, f, id) {
+- if (group >= f->mcgrp_offset &&
+- group < f->mcgrp_offset + f->n_mcgrps) {
+- int fam_grp = group - f->mcgrp_offset;
+-
+- if (f->mcast_unbind)
+- f->mcast_unbind(net, fam_grp);
+- break;
+- }
+- }
+- up_read(&cb_lock);
+-}
+-
+ static int __net_init genl_pernet_init(struct net *net)
+ {
+ struct netlink_kernel_cfg cfg = {
+ .input = genl_rcv,
+ .flags = NL_CFG_F_NONROOT_RECV,
+- .bind = genl_bind,
+- .unbind = genl_unbind,
+ };
+
+ /* we'll bump the group number right afterwards */
+diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
+index 538dedd84e21..6485f421c091 100644
+--- a/net/sched/act_connmark.c
++++ b/net/sched/act_connmark.c
+@@ -46,17 +46,20 @@ static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a,
+ tcf_lastuse_update(&ca->tcf_tm);
+ bstats_update(&ca->tcf_bstats, skb);
+
+- if (skb->protocol == htons(ETH_P_IP)) {
++ switch (skb_protocol(skb, true)) {
++ case htons(ETH_P_IP):
+ if (skb->len < sizeof(struct iphdr))
+ goto out;
+
+ proto = NFPROTO_IPV4;
+- } else if (skb->protocol == htons(ETH_P_IPV6)) {
++ break;
++ case htons(ETH_P_IPV6):
+ if (skb->len < sizeof(struct ipv6hdr))
+ goto out;
+
+ proto = NFPROTO_IPV6;
+- } else {
++ break;
++ default:
+ goto out;
+ }
+
+diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
+index 9ecbf8edcf39..24ad4ceaca27 100644
+--- a/net/sched/act_csum.c
++++ b/net/sched/act_csum.c
+@@ -577,7 +577,7 @@ static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
+ goto drop;
+
+ update_flags = params->update_flags;
+- protocol = tc_skb_protocol(skb);
++ protocol = skb_protocol(skb, false);
+ again:
+ switch (protocol) {
+ case cpu_to_be16(ETH_P_IP):
+diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
+index a80179c1075f..06648b79968e 100644
+--- a/net/sched/act_skbedit.c
++++ b/net/sched/act_skbedit.c
+@@ -51,7 +51,7 @@ static int tcf_skbedit_act(struct sk_buff *skb, const struct tc_action *a,
+ if (params->flags & SKBEDIT_F_INHERITDSFIELD) {
+ int wlen = skb_network_offset(skb);
+
+- switch (tc_skb_protocol(skb)) {
++ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
+ wlen += sizeof(struct iphdr);
+ if (!pskb_may_pull(skb, wlen))
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index e217ebc693f8..184c20b86393 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -969,7 +969,7 @@ int tcf_classify(struct sk_buff *skb, const struct tcf_proto *tp,
+ reclassify:
+ #endif
+ for (; tp; tp = rcu_dereference_bh(tp->next)) {
+- __be16 protocol = tc_skb_protocol(skb);
++ __be16 protocol = skb_protocol(skb, false);
+ int err;
+
+ if (tp->protocol != protocol &&
+diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
+index 2bb043cd436b..55bf75cb1f16 100644
+--- a/net/sched/cls_flow.c
++++ b/net/sched/cls_flow.c
+@@ -84,7 +84,7 @@ static u32 flow_get_dst(const struct sk_buff *skb, const struct flow_keys *flow)
+ if (dst)
+ return ntohl(dst);
+
+- return addr_fold(skb_dst(skb)) ^ (__force u16) tc_skb_protocol(skb);
++ return addr_fold(skb_dst(skb)) ^ (__force u16)skb_protocol(skb, true);
+ }
+
+ static u32 flow_get_proto(const struct sk_buff *skb,
+@@ -108,7 +108,7 @@ static u32 flow_get_proto_dst(const struct sk_buff *skb,
+ if (flow->ports.ports)
+ return ntohs(flow->ports.dst);
+
+- return addr_fold(skb_dst(skb)) ^ (__force u16) tc_skb_protocol(skb);
++ return addr_fold(skb_dst(skb)) ^ (__force u16)skb_protocol(skb, true);
+ }
+
+ static u32 flow_get_iif(const struct sk_buff *skb)
+@@ -155,7 +155,7 @@ static u32 flow_get_nfct(const struct sk_buff *skb)
+ static u32 flow_get_nfct_src(const struct sk_buff *skb,
+ const struct flow_keys *flow)
+ {
+- switch (tc_skb_protocol(skb)) {
++ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
+ return ntohl(CTTUPLE(skb, src.u3.ip));
+ case htons(ETH_P_IPV6):
+@@ -168,7 +168,7 @@ fallback:
+ static u32 flow_get_nfct_dst(const struct sk_buff *skb,
+ const struct flow_keys *flow)
+ {
+- switch (tc_skb_protocol(skb)) {
++ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
+ return ntohl(CTTUPLE(skb, dst.u3.ip));
+ case htons(ETH_P_IPV6):
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index 44ca31f8538d..208436eb107c 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -203,7 +203,7 @@ static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp,
+ /* skb_flow_dissect() does not set n_proto in case an unknown
+ * protocol, so do it rather here.
+ */
+- skb_key.basic.n_proto = skb->protocol;
++ skb_key.basic.n_proto = skb_protocol(skb, false);
+ skb_flow_dissect_tunnel_info(skb, &mask->dissector, &skb_key);
+ skb_flow_dissect(skb, &mask->dissector, &skb_key, 0);
+
+diff --git a/net/sched/em_ipset.c b/net/sched/em_ipset.c
+index c1b23e3060b8..ef3b6b66c26a 100644
+--- a/net/sched/em_ipset.c
++++ b/net/sched/em_ipset.c
+@@ -62,7 +62,7 @@ static int em_ipset_match(struct sk_buff *skb, struct tcf_ematch *em,
+ };
+ int ret, network_offset;
+
+- switch (tc_skb_protocol(skb)) {
++ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
+ state.pf = NFPROTO_IPV4;
+ if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
+diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
+index d6e97115500b..e36fa9272259 100644
+--- a/net/sched/em_meta.c
++++ b/net/sched/em_meta.c
+@@ -199,7 +199,7 @@ META_COLLECTOR(int_priority)
+ META_COLLECTOR(int_protocol)
+ {
+ /* Let userspace take care of the byte ordering */
+- dst->value = tc_skb_protocol(skb);
++ dst->value = skb_protocol(skb, false);
+ }
+
+ META_COLLECTOR(int_pkttype)
+diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
+index cd49afca9617..91bd5c839303 100644
+--- a/net/sched/sch_atm.c
++++ b/net/sched/sch_atm.c
+@@ -551,16 +551,16 @@ static int atm_tc_init(struct Qdisc *sch, struct nlattr *opt,
+ if (!p->link.q)
+ p->link.q = &noop_qdisc;
+ pr_debug("atm_tc_init: link (%p) qdisc %p\n", &p->link, p->link.q);
++ p->link.vcc = NULL;
++ p->link.sock = NULL;
++ p->link.common.classid = sch->handle;
++ p->link.ref = 1;
+
+ err = tcf_block_get(&p->link.block, &p->link.filter_list, sch,
+ extack);
+ if (err)
+ return err;
+
+- p->link.vcc = NULL;
+- p->link.sock = NULL;
+- p->link.common.classid = sch->handle;
+- p->link.ref = 1;
+ tasklet_init(&p->task, sch_atm_dequeue, (unsigned long)sch);
+ return 0;
+ }
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index d03f843647ae..32712e7dcbdc 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -589,7 +589,7 @@ static void cake_update_flowkeys(struct flow_keys *keys,
+ struct nf_conntrack_tuple tuple = {};
+ bool rev = !skb->_nfct;
+
+- if (tc_skb_protocol(skb) != htons(ETH_P_IP))
++ if (skb_protocol(skb, true) != htons(ETH_P_IP))
+ return;
+
+ if (!nf_ct_get_tuple_skb(&tuple, skb))
+@@ -1514,7 +1514,7 @@ static u8 cake_handle_diffserv(struct sk_buff *skb, bool wash)
+ u16 *buf, buf_;
+ u8 dscp;
+
+- switch (tc_skb_protocol(skb)) {
++ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
+ buf = skb_header_pointer(skb, offset, sizeof(buf_), &buf_);
+ if (unlikely(!buf))
+diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
+index 84c948c91914..1c2fce8c45b2 100644
+--- a/net/sched/sch_dsmark.c
++++ b/net/sched/sch_dsmark.c
+@@ -207,7 +207,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ if (p->set_tc_index) {
+ int wlen = skb_network_offset(skb);
+
+- switch (tc_skb_protocol(skb)) {
++ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
+ wlen += sizeof(struct iphdr);
+ if (!pskb_may_pull(skb, wlen) ||
+@@ -300,7 +300,7 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
+ index = skb->tc_index & (p->indices - 1);
+ pr_debug("index %d->%d\n", skb->tc_index, index);
+
+- switch (tc_skb_protocol(skb)) {
++ switch (skb_protocol(skb, true)) {
+ case htons(ETH_P_IP):
+ ipv4_change_dsfield(ip_hdr(skb), p->mv[index].mask,
+ p->mv[index].value);
+@@ -317,7 +317,7 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
+ */
+ if (p->mv[index].mask != 0xff || p->mv[index].value)
+ pr_warn("%s: unsupported protocol %d\n",
+- __func__, ntohs(tc_skb_protocol(skb)));
++ __func__, ntohs(skb_protocol(skb, true)));
+ break;
+ }
+
+diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
+index 93f04cf5cac1..7ed53124069c 100644
+--- a/net/sched/sch_teql.c
++++ b/net/sched/sch_teql.c
+@@ -243,7 +243,7 @@ __teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res,
+ char haddr[MAX_ADDR_LEN];
+
+ neigh_ha_snapshot(haddr, n, dev);
+- err = dev_hard_header(skb, dev, ntohs(tc_skb_protocol(skb)),
++ err = dev_hard_header(skb, dev, ntohs(skb_protocol(skb, false)),
+ haddr, NULL, skb->len);
+
+ if (err < 0)
+diff --git a/security/apparmor/match.c b/security/apparmor/match.c
+index 55f2ee505a01..c1b96a3841da 100644
+--- a/security/apparmor/match.c
++++ b/security/apparmor/match.c
+@@ -101,6 +101,9 @@ static struct table_header *unpack_table(char *blob, size_t bsize)
+ th.td_flags == YYTD_DATA8))
+ goto out;
+
++ /* if we have a table it must have some entries */
++ if (th.td_lolen == 0)
++ goto out;
+ tsize = table_size(th.td_lolen, th.td_flags);
+ if (bsize < tsize)
+ goto out;
+@@ -202,6 +205,8 @@ static int verify_dfa(struct aa_dfa *dfa)
+
+ state_count = dfa->tables[YYTD_ID_BASE]->td_lolen;
+ trans_count = dfa->tables[YYTD_ID_NXT]->td_lolen;
++ if (state_count == 0)
++ goto out;
+ for (i = 0; i < state_count; i++) {
+ if (!(BASE_TABLE(dfa)[i] & MATCH_FLAG_DIFF_ENCODE) &&
+ (DEFAULT_TABLE(dfa)[i] >= state_count))
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index beec9e3b6205..fed9df479ef8 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6701,7 +6701,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ { }
+ },
+ .chained = true,
+- .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
++ .chain_id = ALC269_FIXUP_HEADSET_MIC
+ },
+ [ALC294_FIXUP_ASUS_HEADSET_MIC] = {
+ .type = HDA_FIXUP_PINS,
+@@ -6710,7 +6710,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ { }
+ },
+ .chained = true,
+- .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
++ .chain_id = ALC269_FIXUP_HEADSET_MIC
+ },
+ [ALC294_FIXUP_ASUS_SPK] = {
+ .type = HDA_FIXUP_VERBS,
+@@ -6718,6 +6718,8 @@ static const struct hda_fixup alc269_fixups[] = {
+ /* Set EAPD high */
+ { 0x20, AC_VERB_SET_COEF_INDEX, 0x40 },
+ { 0x20, AC_VERB_SET_PROC_COEF, 0x8800 },
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x0f },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x7774 },
+ { }
+ },
+ .chained = true,
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 2644a5ae2b75..ba096cb4a53e 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -668,10 +668,14 @@ static int usb_audio_probe(struct usb_interface *intf,
+ goto __error;
+ }
+
+- /* we are allowed to call snd_card_register() many times */
+- err = snd_card_register(chip->card);
+- if (err < 0)
+- goto __error;
++ /* we are allowed to call snd_card_register() many times, but first
++ * check to see if a device needs to skip it or do anything special
++ */
++ if (!snd_usb_registration_quirk(chip, ifnum)) {
++ err = snd_card_register(chip->card);
++ if (err < 0)
++ goto __error;
++ }
+
+ usb_chip[chip->index] = chip;
+ chip->num_interfaces++;
+diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c
+index d8a14d769f48..8efd9f00cb72 100644
+--- a/sound/usb/line6/capture.c
++++ b/sound/usb/line6/capture.c
+@@ -291,6 +291,8 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm)
+ urb->interval = LINE6_ISO_INTERVAL;
+ urb->error_count = 0;
+ urb->complete = audio_in_callback;
++ if (usb_urb_ep_type_check(urb))
++ return -EINVAL;
+ }
+
+ return 0;
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index 0193d4989107..18b436e7a2cc 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -835,7 +835,7 @@ void line6_disconnect(struct usb_interface *interface)
+ if (WARN_ON(usbdev != line6->usbdev))
+ return;
+
+- cancel_delayed_work(&line6->startup_work);
++ cancel_delayed_work_sync(&line6->startup_work);
+
+ if (line6->urb_listen != NULL)
+ line6_stop_listen(line6);
+diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c
+index dec89d2beb57..3fb86318f9c6 100644
+--- a/sound/usb/line6/playback.c
++++ b/sound/usb/line6/playback.c
+@@ -436,6 +436,8 @@ int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm)
+ urb->interval = LINE6_ISO_INTERVAL;
+ urb->error_count = 0;
+ urb->complete = audio_out_callback;
++ if (usb_urb_ep_type_check(urb))
++ return -EINVAL;
+ }
+
+ return 0;
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index dcfc546d81b9..28a3ad8b1d74 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1500,6 +1500,8 @@ void snd_usbmidi_disconnect(struct list_head *p)
+ spin_unlock_irq(&umidi->disc_lock);
+ up_write(&umidi->disc_rwsem);
+
++ del_timer_sync(&umidi->error_timer);
++
+ for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) {
+ struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i];
+ if (ep->out)
+@@ -1526,7 +1528,6 @@ void snd_usbmidi_disconnect(struct list_head *p)
+ ep->in = NULL;
+ }
+ }
+- del_timer_sync(&umidi->error_timer);
+ }
+ EXPORT_SYMBOL(snd_usbmidi_disconnect);
+
+@@ -2283,16 +2284,22 @@ void snd_usbmidi_input_stop(struct list_head *p)
+ }
+ EXPORT_SYMBOL(snd_usbmidi_input_stop);
+
+-static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint *ep)
++static void snd_usbmidi_input_start_ep(struct snd_usb_midi *umidi,
++ struct snd_usb_midi_in_endpoint *ep)
+ {
+ unsigned int i;
++ unsigned long flags;
+
+ if (!ep)
+ return;
+ for (i = 0; i < INPUT_URBS; ++i) {
+ struct urb *urb = ep->urbs[i];
+- urb->dev = ep->umidi->dev;
+- snd_usbmidi_submit_urb(urb, GFP_KERNEL);
++ spin_lock_irqsave(&umidi->disc_lock, flags);
++ if (!atomic_read(&urb->use_count)) {
++ urb->dev = ep->umidi->dev;
++ snd_usbmidi_submit_urb(urb, GFP_ATOMIC);
++ }
++ spin_unlock_irqrestore(&umidi->disc_lock, flags);
+ }
+ }
+
+@@ -2308,7 +2315,7 @@ void snd_usbmidi_input_start(struct list_head *p)
+ if (umidi->input_running || !umidi->opened[1])
+ return;
+ for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i)
+- snd_usbmidi_input_start_ep(umidi->endpoints[i].in);
++ snd_usbmidi_input_start_ep(umidi, umidi->endpoints[i].in);
+ umidi->input_running = 1;
+ }
+ EXPORT_SYMBOL(snd_usbmidi_input_start);
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 8b5bc809efd3..e9ec6166acc6 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1508,3 +1508,39 @@ void snd_usb_audioformat_attributes_quirk(struct snd_usb_audio *chip,
+ break;
+ }
+ }
++
++/*
++ * registration quirk:
++ * the registration is skipped if a device matches with the given ID,
++ * unless the interface reaches to the defined one. This is for delaying
++ * the registration until the last known interface, so that the card and
++ * devices appear at the same time.
++ */
++
++struct registration_quirk {
++ unsigned int usb_id; /* composed via USB_ID() */
++ unsigned int interface; /* the interface to trigger register */
++};
++
++#define REG_QUIRK_ENTRY(vendor, product, iface) \
++ { .usb_id = USB_ID(vendor, product), .interface = (iface) }
++
++static const struct registration_quirk registration_quirks[] = {
++ REG_QUIRK_ENTRY(0x0951, 0x16d8, 2), /* Kingston HyperX AMP */
++ REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */
++ REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
++ { 0 } /* terminator */
++};
++
++/* return true if skipping registration */
++bool snd_usb_registration_quirk(struct snd_usb_audio *chip, int iface)
++{
++ const struct registration_quirk *q;
++
++ for (q = registration_quirks; q->usb_id; q++)
++ if (chip->usb_id == q->usb_id)
++ return iface != q->interface;
++
++ /* Register as normal */
++ return false;
++}
+diff --git a/sound/usb/quirks.h b/sound/usb/quirks.h
+index a80e0ddd0736..1efa6c968532 100644
+--- a/sound/usb/quirks.h
++++ b/sound/usb/quirks.h
+@@ -46,4 +46,6 @@ void snd_usb_audioformat_attributes_quirk(struct snd_usb_audio *chip,
+ struct audioformat *fp,
+ int stream);
+
++bool snd_usb_registration_quirk(struct snd_usb_audio *chip, int iface);
++
+ #endif /* __USBAUDIO_QUIRKS_H */
+diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
+index af3f9b9f1e8b..b8e77617fdc4 100644
+--- a/tools/perf/util/srcline.c
++++ b/tools/perf/util/srcline.c
+@@ -191,16 +191,30 @@ static void find_address_in_section(bfd *abfd, asection *section, void *data)
+ bfd_vma pc, vma;
+ bfd_size_type size;
+ struct a2l_data *a2l = data;
++ flagword flags;
+
+ if (a2l->found)
+ return;
+
+- if ((bfd_get_section_flags(abfd, section) & SEC_ALLOC) == 0)
++#ifdef bfd_get_section_flags
++ flags = bfd_get_section_flags(abfd, section);
++#else
++ flags = bfd_section_flags(section);
++#endif
++ if ((flags & SEC_ALLOC) == 0)
+ return;
+
+ pc = a2l->addr;
++#ifdef bfd_get_section_vma
+ vma = bfd_get_section_vma(abfd, section);
++#else
++ vma = bfd_section_vma(section);
++#endif
++#ifdef bfd_get_section_size
+ size = bfd_get_section_size(section);
++#else
++ size = bfd_section_size(section);
++#endif
+
+ if (pc < vma || pc >= vma + size)
+ return;
+diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
+index 6917ba8a0024..b254bee701de 100644
+--- a/tools/perf/util/stat.c
++++ b/tools/perf/util/stat.c
+@@ -358,8 +358,10 @@ int perf_stat_process_counter(struct perf_stat_config *config,
+ * interval mode, otherwise overall avg running
+ * averages will be shown for each interval.
+ */
+- if (config->interval)
+- init_stats(ps->res_stats);
++ if (config->interval) {
++ for (i = 0; i < 3; i++)
++ init_stats(&ps->res_stats[i]);
++ }
+
+ if (counter->per_pkg)
+ zero_per_pkg(counter);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-07-29 12:33 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-07-29 12:33 UTC (permalink / raw
To: gentoo-commits
commit: 3331206aec5172babd799da4bcdba9dce0414836
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 29 12:32:52 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 29 12:32:52 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3331206a
Linux patch 4.19.135
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1134_linux-4.19.135.patch | 2787 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2791 insertions(+)
diff --git a/0000_README b/0000_README
index ceb4a9f..ea4b4c9 100644
--- a/0000_README
+++ b/0000_README
@@ -575,6 +575,10 @@ Patch: 1133_linux-4.19.134.patch
From: https://www.kernel.org
Desc: Linux 4.19.134
+Patch: 1134_linux-4.19.135.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.135
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1134_linux-4.19.135.patch b/1134_linux-4.19.135.patch
new file mode 100644
index 0000000..6a3f927
--- /dev/null
+++ b/1134_linux-4.19.135.patch
@@ -0,0 +1,2787 @@
+diff --git a/Makefile b/Makefile
+index 1e195471eb91..1253143f3f6f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 134
++SUBLEVEL = 135
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -485,7 +485,7 @@ ifeq ($(cc-name),clang)
+ ifneq ($(CROSS_COMPILE),)
+ CLANG_FLAGS += --target=$(notdir $(CROSS_COMPILE:%-=%))
+ GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit))
+-CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)
++CLANG_FLAGS += --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
+ GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..)
+ endif
+ ifneq ($(GCC_TOOLCHAIN),)
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index 93ee34dee9f2..501e835c6500 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -392,14 +392,14 @@ void user_rewind_single_step(struct task_struct *task)
+ * If single step is active for this thread, then set SPSR.SS
+ * to 1 to avoid returning to the active-pending state.
+ */
+- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
+ set_regs_spsr_ss(task_pt_regs(task));
+ }
+ NOKPROBE_SYMBOL(user_rewind_single_step);
+
+ void user_fastforward_single_step(struct task_struct *task)
+ {
+- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
+ clear_regs_spsr_ss(task_pt_regs(task));
+ }
+
+diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
+index 118953d41763..6dd4171c9530 100644
+--- a/arch/parisc/include/asm/atomic.h
++++ b/arch/parisc/include/asm/atomic.h
+@@ -212,6 +212,8 @@ atomic64_set(atomic64_t *v, s64 i)
+ _atomic_spin_unlock_irqrestore(v, flags);
+ }
+
++#define atomic64_set_release(v, i) atomic64_set((v), (i))
++
+ static __inline__ s64
+ atomic64_read(const atomic64_t *v)
+ {
+diff --git a/arch/riscv/include/asm/barrier.h b/arch/riscv/include/asm/barrier.h
+index d4628e4b3a5e..f4c92c91aa04 100644
+--- a/arch/riscv/include/asm/barrier.h
++++ b/arch/riscv/include/asm/barrier.h
+@@ -69,8 +69,16 @@ do { \
+ * The AQ/RL pair provides a RCpc critical section, but there's not really any
+ * way we can take advantage of that here because the ordering is only enforced
+ * on that one lock. Thus, we're just doing a full fence.
++ *
++ * Since we allow writeX to be called from preemptive regions we need at least
++ * an "o" in the predecessor set to ensure device writes are visible before the
++ * task is marked as available for scheduling on a new hart. While I don't see
++ * any concrete reason we need a full IO fence, it seems safer to just upgrade
++ * this in order to avoid any IO crossing a scheduling boundary. In both
++ * instances the scheduler pairs this with an mb(), so nothing is necessary on
++ * the new hart.
+ */
+-#define smp_mb__after_spinlock() RISCV_FENCE(rw,rw)
++#define smp_mb__after_spinlock() RISCV_FENCE(iorw,iorw)
+
+ #include <asm-generic/barrier.h>
+
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index fa3b85b222e3..08e2f3a5f124 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2323,12 +2323,12 @@ static int mp_irqdomain_create(int ioapic)
+ ip->irqdomain = irq_domain_create_linear(fn, hwirqs, cfg->ops,
+ (void *)(long)ioapic);
+
+- /* Release fw handle if it was allocated above */
+- if (!cfg->dev)
+- irq_domain_free_fwnode(fn);
+-
+- if (!ip->irqdomain)
++ if (!ip->irqdomain) {
++ /* Release fw handle if it was allocated above */
++ if (!cfg->dev)
++ irq_domain_free_fwnode(fn);
+ return -ENOMEM;
++ }
+
+ ip->irqdomain->parent = parent;
+
+diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c
+index 1f5df339e48f..fb26c956c442 100644
+--- a/arch/x86/kernel/apic/msi.c
++++ b/arch/x86/kernel/apic/msi.c
+@@ -265,12 +265,13 @@ void __init arch_init_msi_domain(struct irq_domain *parent)
+ msi_default_domain =
+ pci_msi_create_irq_domain(fn, &pci_msi_domain_info,
+ parent);
+- irq_domain_free_fwnode(fn);
+ }
+- if (!msi_default_domain)
++ if (!msi_default_domain) {
++ irq_domain_free_fwnode(fn);
+ pr_warn("failed to initialize irqdomain for MSI/MSI-x.\n");
+- else
++ } else {
+ msi_default_domain->flags |= IRQ_DOMAIN_MSI_NOMASK_QUIRK;
++ }
+ }
+
+ #ifdef CONFIG_IRQ_REMAP
+@@ -303,7 +304,8 @@ struct irq_domain *arch_create_remap_msi_irq_domain(struct irq_domain *parent,
+ if (!fn)
+ return NULL;
+ d = pci_msi_create_irq_domain(fn, &pci_msi_ir_domain_info, parent);
+- irq_domain_free_fwnode(fn);
++ if (!d)
++ irq_domain_free_fwnode(fn);
+ return d;
+ }
+ #endif
+@@ -366,7 +368,8 @@ static struct irq_domain *dmar_get_irq_domain(void)
+ if (fn) {
+ dmar_domain = msi_create_irq_domain(fn, &dmar_msi_domain_info,
+ x86_vector_domain);
+- irq_domain_free_fwnode(fn);
++ if (!dmar_domain)
++ irq_domain_free_fwnode(fn);
+ }
+ out:
+ mutex_unlock(&dmar_lock);
+@@ -491,7 +494,10 @@ struct irq_domain *hpet_create_irq_domain(int hpet_id)
+ }
+
+ d = msi_create_irq_domain(fn, domain_info, parent);
+- irq_domain_free_fwnode(fn);
++ if (!d) {
++ irq_domain_free_fwnode(fn);
++ kfree(domain_info);
++ }
+ return d;
+ }
+
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index e41be2c25da8..99c28c02b7a5 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -703,7 +703,6 @@ int __init arch_early_irq_init(void)
+ x86_vector_domain = irq_domain_create_tree(fn, &x86_vector_domain_ops,
+ NULL);
+ BUG_ON(x86_vector_domain == NULL);
+- irq_domain_free_fwnode(fn);
+ irq_set_default_host(x86_vector_domain);
+
+ arch_init_msi_domain(x86_vector_domain);
+diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
+index 36593fd7dbe3..34c0652ca8b4 100644
+--- a/arch/x86/kernel/vmlinux.lds.S
++++ b/arch/x86/kernel/vmlinux.lds.S
+@@ -372,6 +372,7 @@ SECTIONS
+ .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
+ __bss_start = .;
+ *(.bss..page_aligned)
++ . = ALIGN(PAGE_SIZE);
+ *(BSS_MAIN)
+ BSS_DECRYPTED
+ . = ALIGN(PAGE_SIZE);
+diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S
+index f031c0e19356..515cdee90df7 100644
+--- a/arch/x86/math-emu/wm_sqrt.S
++++ b/arch/x86/math-emu/wm_sqrt.S
+@@ -209,7 +209,7 @@ sqrt_stage_2_finish:
+
+ #ifdef PARANOID
+ /* It should be possible to get here only if the arg is ffff....ffff */
+- cmp $0xffffffff,FPU_fsqrt_arg_1
++ cmpl $0xffffffff,FPU_fsqrt_arg_1
+ jnz sqrt_stage_2_error
+ #endif /* PARANOID */
+
+diff --git a/arch/x86/platform/uv/uv_irq.c b/arch/x86/platform/uv/uv_irq.c
+index fc13cbbb2dce..abb6075397f0 100644
+--- a/arch/x86/platform/uv/uv_irq.c
++++ b/arch/x86/platform/uv/uv_irq.c
+@@ -167,9 +167,10 @@ static struct irq_domain *uv_get_irq_domain(void)
+ goto out;
+
+ uv_domain = irq_domain_create_tree(fn, &uv_domain_ops, NULL);
+- irq_domain_free_fwnode(fn);
+ if (uv_domain)
+ uv_domain->parent = x86_vector_domain;
++ else
++ irq_domain_free_fwnode(fn);
+ out:
+ mutex_unlock(&uv_lock);
+
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index 15580e4fc766..6a0167ac803c 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -720,7 +720,8 @@ c_start(struct seq_file *f, loff_t *pos)
+ static void *
+ c_next(struct seq_file *f, void *v, loff_t *pos)
+ {
+- return NULL;
++ ++*pos;
++ return c_start(f, pos);
+ }
+
+ static void
+diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
+index 4092555828b1..24cf6972eace 100644
+--- a/arch/xtensa/kernel/xtensa_ksyms.c
++++ b/arch/xtensa/kernel/xtensa_ksyms.c
+@@ -87,13 +87,13 @@ void __xtensa_libgcc_window_spill(void)
+ }
+ EXPORT_SYMBOL(__xtensa_libgcc_window_spill);
+
+-unsigned long __sync_fetch_and_and_4(unsigned long *p, unsigned long v)
++unsigned int __sync_fetch_and_and_4(volatile void *p, unsigned int v)
+ {
+ BUG();
+ }
+ EXPORT_SYMBOL(__sync_fetch_and_and_4);
+
+-unsigned long __sync_fetch_and_or_4(unsigned long *p, unsigned long v)
++unsigned int __sync_fetch_and_or_4(volatile void *p, unsigned int v)
+ {
+ BUG();
+ }
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 6e5e6fb7e4c9..3371b986e3b4 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -987,7 +987,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
+ trace_binder_unmap_user_end(alloc, index);
+ }
+ up_read(&mm->mmap_sem);
+- mmput(mm);
++ mmput_async(mm);
+
+ trace_binder_unmap_kernel_start(alloc, index);
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index c7d946b745ef..d26b485ccc7d 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1343,7 +1343,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data)
+
+ /* If the user didn't specify a name match any */
+ if (data)
+- return (*r)->name == data;
++ return !strcmp((*r)->name, data);
+ else
+ return 1;
+ }
+diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
+index b94cece58b98..890cadf3ec5d 100644
+--- a/drivers/dma/ioat/dma.c
++++ b/drivers/dma/ioat/dma.c
+@@ -38,6 +38,18 @@
+
+ #include "../dmaengine.h"
+
++int completion_timeout = 200;
++module_param(completion_timeout, int, 0644);
++MODULE_PARM_DESC(completion_timeout,
++ "set ioat completion timeout [msec] (default 200 [msec])");
++int idle_timeout = 2000;
++module_param(idle_timeout, int, 0644);
++MODULE_PARM_DESC(idle_timeout,
++ "set ioat idel timeout [msec] (default 2000 [msec])");
++
++#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout)
++#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout)
++
+ static char *chanerr_str[] = {
+ "DMA Transfer Source Address Error",
+ "DMA Transfer Destination Address Error",
+diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
+index 1ab42ec2b7ff..b061db201332 100644
+--- a/drivers/dma/ioat/dma.h
++++ b/drivers/dma/ioat/dma.h
+@@ -111,8 +111,6 @@ struct ioatdma_chan {
+ #define IOAT_RUN 5
+ #define IOAT_CHAN_ACTIVE 6
+ struct timer_list timer;
+- #define COMPLETION_TIMEOUT msecs_to_jiffies(100)
+- #define IDLE_TIMEOUT msecs_to_jiffies(2000)
+ #define RESET_DELAY msecs_to_jiffies(100)
+ struct ioatdma_device *ioat_dma;
+ dma_addr_t completion_dma;
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index 045351f3549c..86b45198fb96 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -583,6 +583,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan *dc)
+
+ ret = pm_runtime_get_sync(tdc2dev(tdc));
+ if (ret < 0) {
++ pm_runtime_put_noidle(tdc2dev(tdc));
+ free_irq(tdc->irq, tdc);
+ return ret;
+ }
+@@ -764,8 +765,10 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ pm_runtime_enable(&pdev->dev);
+
+ ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(&pdev->dev);
+ goto rpm_disable;
++ }
+
+ ret = tegra_adma_init(tdma);
+ if (ret)
+diff --git a/drivers/firmware/psci_checker.c b/drivers/firmware/psci_checker.c
+index cbd53cb1b2d4..9f1a913933d5 100644
+--- a/drivers/firmware/psci_checker.c
++++ b/drivers/firmware/psci_checker.c
+@@ -164,8 +164,10 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups)
+
+ cpu_groups = kcalloc(nb_available_cpus, sizeof(cpu_groups),
+ GFP_KERNEL);
+- if (!cpu_groups)
++ if (!cpu_groups) {
++ free_cpumask_var(tmp);
+ return -ENOMEM;
++ }
+
+ cpumask_copy(tmp, cpu_online_mask);
+
+@@ -174,6 +176,7 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups)
+ topology_core_cpumask(cpumask_any(tmp));
+
+ if (!alloc_cpumask_var(&cpu_groups[num_groups], GFP_KERNEL)) {
++ free_cpumask_var(tmp);
+ free_cpu_groups(num_groups, &cpu_groups);
+ return -ENOMEM;
+ }
+diff --git a/drivers/fpga/dfl-afu-main.c b/drivers/fpga/dfl-afu-main.c
+index 02baa6a227c0..fc048f9a99b1 100644
+--- a/drivers/fpga/dfl-afu-main.c
++++ b/drivers/fpga/dfl-afu-main.c
+@@ -79,7 +79,8 @@ static int port_disable(struct platform_device *pdev)
+ * on this port and minimum soft reset pulse width has elapsed.
+ * Driver polls port_soft_reset_ack to determine if reset done by HW.
+ */
+- if (readq_poll_timeout(base + PORT_HDR_CTRL, v, v & PORT_CTRL_SFTRST,
++ if (readq_poll_timeout(base + PORT_HDR_CTRL, v,
++ v & PORT_CTRL_SFTRST_ACK,
+ RST_POLL_INVL, RST_POLL_TIMEOUT)) {
+ dev_err(&pdev->dev, "timeout, fail to reset device\n");
+ return -ETIMEDOUT;
+diff --git a/drivers/gpio/gpio-arizona.c b/drivers/gpio/gpio-arizona.c
+index ba51ea15f379..c6cf270035b5 100644
+--- a/drivers/gpio/gpio-arizona.c
++++ b/drivers/gpio/gpio-arizona.c
+@@ -69,6 +69,7 @@ static int arizona_gpio_get(struct gpio_chip *chip, unsigned offset)
+ ret = pm_runtime_get_sync(chip->parent);
+ if (ret < 0) {
+ dev_err(chip->parent, "Failed to resume: %d\n", ret);
++ pm_runtime_put_autosuspend(chip->parent);
+ return ret;
+ }
+
+@@ -77,12 +78,15 @@ static int arizona_gpio_get(struct gpio_chip *chip, unsigned offset)
+ if (ret < 0) {
+ dev_err(chip->parent, "Failed to drop cache: %d\n",
+ ret);
++ pm_runtime_put_autosuspend(chip->parent);
+ return ret;
+ }
+
+ ret = regmap_read(arizona->regmap, reg, &val);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(chip->parent);
+ return ret;
++ }
+
+ pm_runtime_mark_last_busy(chip->parent);
+ pm_runtime_put_autosuspend(chip->parent);
+@@ -111,6 +115,7 @@ static int arizona_gpio_direction_out(struct gpio_chip *chip,
+ ret = pm_runtime_get_sync(chip->parent);
+ if (ret < 0) {
+ dev_err(chip->parent, "Failed to resume: %d\n", ret);
++ pm_runtime_put(chip->parent);
+ return ret;
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+index e63a253eb425..7bea8ba89e88 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+@@ -529,8 +529,7 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
+
+ while (isspace(*++tmp_str));
+
+- while (tmp_str[0]) {
+- sub_str = strsep(&tmp_str, delimiter);
++ while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
+ ret = kstrtol(sub_str, 0, ¶meter[parameter_size]);
+ if (ret)
+ return -EINVAL;
+@@ -630,8 +629,7 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
+ memcpy(buf_cpy, buf, bytes);
+ buf_cpy[bytes] = '\0';
+ tmp = buf_cpy;
+- while (tmp[0]) {
+- sub_str = strsep(&tmp, delimiter);
++ while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
+ if (strlen(sub_str)) {
+ ret = kstrtol(sub_str, 0, &level);
+ if (ret)
+@@ -882,8 +880,7 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev,
+ i++;
+ memcpy(buf_cpy, buf, count-i);
+ tmp_str = buf_cpy;
+- while (tmp_str[0]) {
+- sub_str = strsep(&tmp_str, delimiter);
++ while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
+ ret = kstrtol(sub_str, 0, ¶meter[parameter_size]);
+ if (ret) {
+ count = -EINVAL;
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
+index 59113fdd1c1c..2cd0f8d8470e 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
+@@ -643,9 +643,6 @@ static int vegam_get_dependency_volt_by_clk(struct pp_hwmgr *hwmgr,
+
+ /* sclk is bigger than max sclk in the dependence table */
+ *voltage |= (dep_table->entries[i - 1].vddc * VOLTAGE_SCALE) << VDDC_SHIFT;
+- vddci = phm_find_closest_vddci(&(data->vddci_voltage_table),
+- (dep_table->entries[i - 1].vddc -
+- (uint16_t)VDDC_VDDCI_DELTA));
+
+ if (SMU7_VOLTAGE_CONTROL_NONE == data->vddci_control)
+ *voltage |= (data->vbios_boot_state.vddci_bootup_value *
+@@ -653,8 +650,13 @@ static int vegam_get_dependency_volt_by_clk(struct pp_hwmgr *hwmgr,
+ else if (dep_table->entries[i - 1].vddci)
+ *voltage |= (dep_table->entries[i - 1].vddci *
+ VOLTAGE_SCALE) << VDDC_SHIFT;
+- else
++ else {
++ vddci = phm_find_closest_vddci(&(data->vddci_voltage_table),
++ (dep_table->entries[i - 1].vddc -
++ (uint16_t)VDDC_VDDCI_DELTA));
++
+ *voltage |= (vddci * VOLTAGE_SCALE) << VDDCI_SHIFT;
++ }
+
+ if (SMU7_VOLTAGE_CONTROL_NONE == data->mvdd_control)
+ *mvdd = data->vbios_boot_state.mvdd_bootup_value * VOLTAGE_SCALE;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
+index c8ab1b5741a3..db7769cb33eb 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c
+@@ -118,10 +118,10 @@ g94_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
+ if (retries)
+ udelay(400);
+
+- /* transaction request, wait up to 1ms for it to complete */
++ /* transaction request, wait up to 2ms for it to complete */
+ nvkm_wr32(device, 0x00e4e4 + base, 0x00010000 | ctrl);
+
+- timeout = 1000;
++ timeout = 2000;
+ do {
+ ctrl = nvkm_rd32(device, 0x00e4e4 + base);
+ udelay(1);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
+index 7ef60895f43a..edb6148cbca0 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
+@@ -118,10 +118,10 @@ gm200_i2c_aux_xfer(struct nvkm_i2c_aux *obj, bool retry,
+ if (retries)
+ udelay(400);
+
+- /* transaction request, wait up to 1ms for it to complete */
++ /* transaction request, wait up to 2ms for it to complete */
+ nvkm_wr32(device, 0x00d954 + base, 0x00010000 | ctrl);
+
+- timeout = 1000;
++ timeout = 2000;
+ do {
+ ctrl = nvkm_rd32(device, 0x00d954 + base);
+ udelay(1);
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+index 7e7fa8cef2ad..8ba19a8ca40f 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+@@ -243,7 +243,7 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force)
+ unsigned long reg;
+
+ reg = readl(hdmi->base + SUN4I_HDMI_HPD_REG);
+- if (reg & SUN4I_HDMI_HPD_HIGH) {
++ if (!(reg & SUN4I_HDMI_HPD_HIGH)) {
+ cec_phys_addr_invalidate(hdmi->cec_adap);
+ return connector_status_disconnected;
+ }
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index 3489f0af7409..f4cf541d13e0 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -29,6 +29,7 @@
+
+ #define U1_MOUSE_REPORT_ID 0x01 /* Mouse data ReportID */
+ #define U1_ABSOLUTE_REPORT_ID 0x03 /* Absolute data ReportID */
++#define U1_ABSOLUTE_REPORT_ID_SECD 0x02 /* FW-PTP Absolute data ReportID */
+ #define U1_FEATURE_REPORT_ID 0x05 /* Feature ReportID */
+ #define U1_SP_ABSOLUTE_REPORT_ID 0x06 /* Feature ReportID */
+
+@@ -372,6 +373,7 @@ static int u1_raw_event(struct alps_dev *hdata, u8 *data, int size)
+ case U1_FEATURE_REPORT_ID:
+ break;
+ case U1_ABSOLUTE_REPORT_ID:
++ case U1_ABSOLUTE_REPORT_ID_SECD:
+ for (i = 0; i < hdata->max_fingers; i++) {
+ u8 *contact = &data[i * 5];
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 8ab8f2350bbc..b58ab769aa7b 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -57,6 +57,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\")
+ struct apple_sc {
+ unsigned long quirks;
+ unsigned int fn_on;
++ unsigned int fn_found;
+ DECLARE_BITMAP(pressed_numlock, KEY_CNT);
+ };
+
+@@ -342,12 +343,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ struct hid_field *field, struct hid_usage *usage,
+ unsigned long **bit, int *max)
+ {
++ struct apple_sc *asc = hid_get_drvdata(hdev);
++
+ if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
+ usage->hid == (HID_UP_MSVENDOR | 0x0003) ||
+ usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) {
+ /* The fn key on Apple USB keyboards */
+ set_bit(EV_REP, hi->input->evbit);
+ hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
++ asc->fn_found = true;
+ apple_setup_input(hi->input);
+ return 1;
+ }
+@@ -374,6 +378,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ return 0;
+ }
+
++static int apple_input_configured(struct hid_device *hdev,
++ struct hid_input *hidinput)
++{
++ struct apple_sc *asc = hid_get_drvdata(hdev);
++
++ if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) {
++ hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n");
++ asc->quirks = 0;
++ }
++
++ return 0;
++}
++
+ static int apple_probe(struct hid_device *hdev,
+ const struct hid_device_id *id)
+ {
+@@ -588,6 +605,7 @@ static struct hid_driver apple_driver = {
+ .event = apple_event,
+ .input_mapping = apple_input_mapping,
+ .input_mapped = apple_input_mapped,
++ .input_configured = apple_input_configured,
+ };
+ module_hid_driver(apple_driver);
+
+diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
+index 6286204d4c56..a3b151b29bd7 100644
+--- a/drivers/hid/hid-steam.c
++++ b/drivers/hid/hid-steam.c
+@@ -526,7 +526,8 @@ static int steam_register(struct steam_device *steam)
+ steam_battery_register(steam);
+
+ mutex_lock(&steam_devices_lock);
+- list_add(&steam->list, &steam_devices);
++ if (list_empty(&steam->list))
++ list_add(&steam->list, &steam_devices);
+ mutex_unlock(&steam_devices_lock);
+ }
+
+@@ -552,7 +553,7 @@ static void steam_unregister(struct steam_device *steam)
+ hid_info(steam->hdev, "Steam Controller '%s' disconnected",
+ steam->serial_no);
+ mutex_lock(&steam_devices_lock);
+- list_del(&steam->list);
++ list_del_init(&steam->list);
+ mutex_unlock(&steam_devices_lock);
+ steam->serial_no[0] = 0;
+ }
+@@ -738,6 +739,7 @@ static int steam_probe(struct hid_device *hdev,
+ mutex_init(&steam->mutex);
+ steam->quirks = id->driver_data;
+ INIT_WORK(&steam->work_connect, steam_work_connect_cb);
++ INIT_LIST_HEAD(&steam->list);
+
+ steam->client_hdev = steam_create_client_hid(hdev);
+ if (IS_ERR(steam->client_hdev)) {
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index 681ac9bc68b3..f98c1e1b1dbd 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -373,6 +373,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ .ident = "Mediacom FlexBook edge 13",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook_edge13-M-FBE13"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ {
+ .ident = "Odys Winbook 13",
+ .matches = {
+diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c
+index 5e449eac788a..a43fa730a513 100644
+--- a/drivers/hwmon/aspeed-pwm-tacho.c
++++ b/drivers/hwmon/aspeed-pwm-tacho.c
+@@ -880,6 +880,8 @@ static int aspeed_create_fan(struct device *dev,
+ ret = of_property_read_u32(child, "reg", &pwm_port);
+ if (ret)
+ return ret;
++ if (pwm_port >= ARRAY_SIZE(pwm_port_params))
++ return -EINVAL;
+ aspeed_create_pwm_port(priv, (u8)pwm_port);
+
+ ret = of_property_count_u8_elems(child, "cooling-levels");
+diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c
+index 13600fa79e7f..a19cf9052fc6 100644
+--- a/drivers/hwmon/pmbus/adm1275.c
++++ b/drivers/hwmon/pmbus/adm1275.c
+@@ -364,6 +364,7 @@ MODULE_DEVICE_TABLE(i2c, adm1275_id);
+ static int adm1275_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
++ s32 (*config_read_fn)(const struct i2c_client *client, u8 reg);
+ u8 block_buffer[I2C_SMBUS_BLOCK_MAX + 1];
+ int config, device_config;
+ int ret;
+@@ -408,11 +409,16 @@ static int adm1275_probe(struct i2c_client *client,
+ "Device mismatch: Configured %s, detected %s\n",
+ id->name, mid->name);
+
+- config = i2c_smbus_read_byte_data(client, ADM1275_PMON_CONFIG);
++ if (mid->driver_data == adm1272 || mid->driver_data == adm1278 ||
++ mid->driver_data == adm1293 || mid->driver_data == adm1294)
++ config_read_fn = i2c_smbus_read_word_data;
++ else
++ config_read_fn = i2c_smbus_read_byte_data;
++ config = config_read_fn(client, ADM1275_PMON_CONFIG);
+ if (config < 0)
+ return config;
+
+- device_config = i2c_smbus_read_byte_data(client, ADM1275_DEVICE_CONFIG);
++ device_config = config_read_fn(client, ADM1275_DEVICE_CONFIG);
+ if (device_config < 0)
+ return device_config;
+
+diff --git a/drivers/hwmon/scmi-hwmon.c b/drivers/hwmon/scmi-hwmon.c
+index 91976b6ca300..91bfecdb3f5b 100644
+--- a/drivers/hwmon/scmi-hwmon.c
++++ b/drivers/hwmon/scmi-hwmon.c
+@@ -99,7 +99,7 @@ static enum hwmon_sensor_types scmi_types[] = {
+ [ENERGY] = hwmon_energy,
+ };
+
+-static u32 hwmon_attributes[] = {
++static u32 hwmon_attributes[hwmon_max] = {
+ [hwmon_chip] = HWMON_C_REGISTER_TZ,
+ [hwmon_temp] = HWMON_T_INPUT | HWMON_T_LABEL,
+ [hwmon_in] = HWMON_I_INPUT | HWMON_I_LABEL,
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 2c29f901d309..6e49e438ef5a 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -863,6 +863,7 @@ static int rcar_unreg_slave(struct i2c_client *slave)
+ /* disable irqs and ensure none is running before clearing ptr */
+ rcar_i2c_write(priv, ICSIER, 0);
+ rcar_i2c_write(priv, ICSCR, 0);
++ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+
+ synchronize_irq(priv->irq);
+ priv->slave = NULL;
+@@ -966,6 +967,8 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ if (ret < 0)
+ goto out_pm_put;
+
++ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
++
+ if (priv->devtype == I2C_RCAR_GEN3) {
+ priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+ if (!IS_ERR(priv->rstc)) {
+diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
+index 4bda1242df87..fd6ec56c17f9 100644
+--- a/drivers/infiniband/core/umem_odp.c
++++ b/drivers/infiniband/core/umem_odp.c
+@@ -356,7 +356,8 @@ int ib_umem_odp_get(struct ib_ucontext *context, struct ib_umem *umem,
+ vma = find_vma(mm, ib_umem_start(umem));
+ if (!vma || !is_vm_hugetlb_page(vma)) {
+ up_read(&mm->mmap_sem);
+- return -EINVAL;
++ ret_val = -EINVAL;
++ goto out_mm;
+ }
+ h = hstate_vma(vma);
+ umem->page_shift = huge_page_shift(h);
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 671e018eb363..c6d393114502 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -182,6 +182,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0093", /* T480 */
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
++ "LEN0099", /* X1 Extreme 1st */
+ "LEN009b", /* T580 */
+ "LEN200f", /* T450s */
+ "LEN2044", /* L470 */
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 0783f44e9afe..d0cbe910ee9d 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -4508,9 +4508,10 @@ int amd_iommu_create_irq_domain(struct amd_iommu *iommu)
+ if (!fn)
+ return -ENOMEM;
+ iommu->ir_domain = irq_domain_create_tree(fn, &amd_ir_domain_ops, iommu);
+- irq_domain_free_fwnode(fn);
+- if (!iommu->ir_domain)
++ if (!iommu->ir_domain) {
++ irq_domain_free_fwnode(fn);
+ return -ENOMEM;
++ }
+
+ iommu->ir_domain->parent = arch_get_ir_parent_domain();
+ iommu->msi_domain = arch_create_remap_msi_irq_domain(iommu->ir_domain,
+diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
+index 967450bd421a..852e2841395b 100644
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -536,8 +536,8 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)
+ 0, INTR_REMAP_TABLE_ENTRIES,
+ fn, &intel_ir_domain_ops,
+ iommu);
+- irq_domain_free_fwnode(fn);
+ if (!iommu->ir_domain) {
++ irq_domain_free_fwnode(fn);
+ pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id);
+ goto out_free_bitmap;
+ }
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index d75a4ce7d12a..e8eeee680750 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -2068,7 +2068,7 @@ static void integrity_writer(struct work_struct *w)
+ unsigned prev_free_sectors;
+
+ /* the following test is not needed, but it tests the replay code */
+- if (unlikely(dm_suspended(ic->ti)) && !ic->meta_dev)
++ if (unlikely(dm_post_suspending(ic->ti)) && !ic->meta_dev)
+ return;
+
+ spin_lock_irq(&ic->endio_wait.lock);
+@@ -2127,7 +2127,7 @@ static void integrity_recalc(struct work_struct *w)
+
+ next_chunk:
+
+- if (unlikely(dm_suspended(ic->ti)))
++ if (unlikely(dm_post_suspending(ic->ti)))
+ goto unlock_ret;
+
+ range.logical_sector = le64_to_cpu(ic->sb->recalc_sector);
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index afc9f8406dce..874bd542a744 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -141,6 +141,7 @@ EXPORT_SYMBOL_GPL(dm_bio_get_target_bio_nr);
+ #define DMF_NOFLUSH_SUSPENDING 5
+ #define DMF_DEFERRED_REMOVE 6
+ #define DMF_SUSPENDED_INTERNALLY 7
++#define DMF_POST_SUSPENDING 8
+
+ #define DM_NUMA_NODE NUMA_NO_NODE
+ static int dm_numa_node = DM_NUMA_NODE;
+@@ -2355,6 +2356,7 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
+ if (!dm_suspended_md(md)) {
+ dm_table_presuspend_targets(map);
+ set_bit(DMF_SUSPENDED, &md->flags);
++ set_bit(DMF_POST_SUSPENDING, &md->flags);
+ dm_table_postsuspend_targets(map);
+ }
+ /* dm_put_live_table must be before msleep, otherwise deadlock is possible */
+@@ -2680,7 +2682,9 @@ retry:
+ if (r)
+ goto out_unlock;
+
++ set_bit(DMF_POST_SUSPENDING, &md->flags);
+ dm_table_postsuspend_targets(map);
++ clear_bit(DMF_POST_SUSPENDING, &md->flags);
+
+ out_unlock:
+ mutex_unlock(&md->suspend_lock);
+@@ -2777,7 +2781,9 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned suspend_fla
+ (void) __dm_suspend(md, map, suspend_flags, TASK_UNINTERRUPTIBLE,
+ DMF_SUSPENDED_INTERNALLY);
+
++ set_bit(DMF_POST_SUSPENDING, &md->flags);
+ dm_table_postsuspend_targets(map);
++ clear_bit(DMF_POST_SUSPENDING, &md->flags);
+ }
+
+ static void __dm_internal_resume(struct mapped_device *md)
+@@ -2938,6 +2944,11 @@ int dm_suspended_md(struct mapped_device *md)
+ return test_bit(DMF_SUSPENDED, &md->flags);
+ }
+
++static int dm_post_suspending_md(struct mapped_device *md)
++{
++ return test_bit(DMF_POST_SUSPENDING, &md->flags);
++}
++
+ int dm_suspended_internally_md(struct mapped_device *md)
+ {
+ return test_bit(DMF_SUSPENDED_INTERNALLY, &md->flags);
+@@ -2954,6 +2965,12 @@ int dm_suspended(struct dm_target *ti)
+ }
+ EXPORT_SYMBOL_GPL(dm_suspended);
+
++int dm_post_suspending(struct dm_target *ti)
++{
++ return dm_post_suspending_md(dm_table_get_md(ti->table));
++}
++EXPORT_SYMBOL_GPL(dm_post_suspending);
++
+ int dm_noflush_suspending(struct dm_target *ti)
+ {
+ return __noflush_suspending(dm_table_get_md(ti->table));
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index f57b86f1373d..11429df74306 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4817,15 +4817,19 @@ int bond_create(struct net *net, const char *name)
+ bond_dev->rtnl_link_ops = &bond_link_ops;
+
+ res = register_netdevice(bond_dev);
++ if (res < 0) {
++ free_netdev(bond_dev);
++ rtnl_unlock();
++
++ return res;
++ }
+
+ netif_carrier_off(bond_dev);
+
+ bond_work_init_all(bond);
+
+ rtnl_unlock();
+- if (res < 0)
+- free_netdev(bond_dev);
+- return res;
++ return 0;
+ }
+
+ static int __net_init bond_net_init(struct net *net)
+diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
+index 6b9ad8673218..fbcd8a752ee7 100644
+--- a/drivers/net/bonding/bond_netlink.c
++++ b/drivers/net/bonding/bond_netlink.c
+@@ -451,11 +451,10 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev,
+ return err;
+
+ err = register_netdevice(bond_dev);
+-
+- netif_carrier_off(bond_dev);
+ if (!err) {
+ struct bonding *bond = netdev_priv(bond_dev);
+
++ netif_carrier_off(bond_dev);
+ bond_work_init_all(bond);
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 047024717d65..63730e449e08 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1392,8 +1392,11 @@ static int bnxt_set_pauseparam(struct net_device *dev,
+ if (epause->tx_pause)
+ link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX;
+
+- if (netif_running(dev))
++ if (netif_running(dev)) {
++ mutex_lock(&bp->link_lock);
+ rc = bnxt_hwrm_set_pause(bp);
++ mutex_unlock(&bp->link_lock);
++ }
+ return rc;
+ }
+
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index d013f30019b6..2452d8ba4073 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -215,7 +215,7 @@ io_error:
+
+ static inline u16 gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg)
+ {
+- u16 v;
++ u16 v = 0;
+ __gm_phy_read(hw, port, reg, &v);
+ return v;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index 2e6df5804b35..e180ec4f1a24 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -587,7 +587,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
+ err = mlxsw_core_trap_register(mlxsw_core, &mlxsw_emad_rx_listener,
+ mlxsw_core);
+ if (err)
+- return err;
++ goto err_trap_register;
+
+ err = mlxsw_core->driver->basic_trap_groups_set(mlxsw_core);
+ if (err)
+@@ -599,6 +599,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
+ err_emad_trap_set:
+ mlxsw_core_trap_unregister(mlxsw_core, &mlxsw_emad_rx_listener,
+ mlxsw_core);
++err_trap_register:
+ destroy_workqueue(mlxsw_core->emad_wq);
+ return err;
+ }
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+index f3d7c38f539a..734462f8d881 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+@@ -2074,8 +2074,8 @@ static void qed_rdma_set_pf_params(struct qed_hwfn *p_hwfn,
+ num_srqs = min_t(u32, QED_RDMA_MAX_SRQS, p_params->num_srqs);
+
+ if (p_hwfn->mcp_info->func_info.protocol == QED_PCI_ETH_RDMA) {
+- DP_NOTICE(p_hwfn,
+- "Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n");
++ DP_VERBOSE(p_hwfn, QED_MSG_SP,
++ "Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n");
+ p_hwfn->hw_info.personality = QED_PCI_ETH_ROCE;
+ }
+
+diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
+index 8d6cff8bd162..0f870ed5a9c8 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -2287,7 +2287,7 @@ static int smc_drv_probe(struct platform_device *pdev)
+ ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio,
+ "power", 0, 0, 100);
+ if (ret)
+- return ret;
++ goto out_free_netdev;
+
+ /*
+ * Optional reset GPIO configured? Minimum 100 ns reset needed
+@@ -2296,7 +2296,7 @@ static int smc_drv_probe(struct platform_device *pdev)
+ ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio,
+ "reset", 0, 0, 100);
+ if (ret)
+- return ret;
++ goto out_free_netdev;
+
+ /*
+ * Need to wait for optional EEPROM to load, max 750 us according
+diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
+index c309accc6797..01cde5f27ead 100644
+--- a/drivers/net/ethernet/socionext/sni_ave.c
++++ b/drivers/net/ethernet/socionext/sni_ave.c
+@@ -1196,7 +1196,7 @@ static int ave_init(struct net_device *ndev)
+ ret = regmap_update_bits(priv->regmap, SG_ETPINMODE,
+ priv->pinmode_mask, priv->pinmode_val);
+ if (ret)
+- return ret;
++ goto out_reset_assert;
+
+ ave_global_reset(ndev);
+
+diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
+index 029206e4da3b..2a8c33abb363 100644
+--- a/drivers/net/hippi/rrunner.c
++++ b/drivers/net/hippi/rrunner.c
+@@ -1248,7 +1248,7 @@ static int rr_open(struct net_device *dev)
+ rrpriv->info = NULL;
+ }
+ if (rrpriv->rx_ctrl) {
+- pci_free_consistent(pdev, sizeof(struct ring_ctrl),
++ pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl),
+ rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma);
+ rrpriv->rx_ctrl = NULL;
+ }
+diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
+index cd6b95e673a5..71be8524cca8 100644
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -1270,7 +1270,7 @@ static int adf7242_probe(struct spi_device *spi)
+ WQ_MEM_RECLAIM);
+ if (unlikely(!lp->wqueue)) {
+ ret = -ENOMEM;
+- goto err_hw_init;
++ goto err_alloc_wq;
+ }
+
+ ret = adf7242_hw_init(lp);
+@@ -1302,6 +1302,8 @@ static int adf7242_probe(struct spi_device *spi)
+ return ret;
+
+ err_hw_init:
++ destroy_workqueue(lp->wqueue);
++err_alloc_wq:
+ mutex_destroy(&lp->bmux);
+ ieee802154_free_hw(lp->hw);
+
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index 4fed77833157..dd0a658c843d 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -1343,6 +1343,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L4;
+ dp83640->version = PTP_CLASS_V1;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
+ break;
+ case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
+ case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
+@@ -1350,6 +1351,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L4;
+ dp83640->version = PTP_CLASS_V2;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
+ break;
+ case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
+ case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
+@@ -1357,6 +1359,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L2;
+ dp83640->version = PTP_CLASS_V2;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+ break;
+ case HWTSTAMP_FILTER_PTP_V2_EVENT:
+ case HWTSTAMP_FILTER_PTP_V2_SYNC:
+@@ -1364,6 +1367,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2;
+ dp83640->version = PTP_CLASS_V2;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+ break;
+ default:
+ return -ERANGE;
+diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
+index 914cac55a7ae..909755ef71ac 100644
+--- a/drivers/net/usb/ax88172a.c
++++ b/drivers/net/usb/ax88172a.c
+@@ -210,6 +210,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
+ ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
+ if (ret < ETH_ALEN) {
+ netdev_err(dev->net, "Failed to read MAC address: %d\n", ret);
++ ret = -EIO;
+ goto free;
+ }
+ memcpy(dev->net->dev_addr, buf, ETH_ALEN);
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 0e3f8ed84660..ac34257e9f20 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -308,7 +308,6 @@ static void lapbeth_setup(struct net_device *dev)
+ dev->netdev_ops = &lapbeth_netdev_ops;
+ dev->needs_free_netdev = true;
+ dev->type = ARPHRD_X25;
+- dev->hard_header_len = 3;
+ dev->mtu = 1000;
+ dev->addr_len = 0;
+ }
+@@ -329,6 +328,14 @@ static int lapbeth_new_device(struct net_device *dev)
+ if (!ndev)
+ goto out;
+
++ /* When transmitting data:
++ * first this driver removes a pseudo header of 1 byte,
++ * then the lapb module prepends an LAPB header of at most 3 bytes,
++ * then this driver prepends a length field of 2 bytes,
++ * then the underlying Ethernet device prepends its own header.
++ */
++ ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len;
++
+ lapbeth = netdev_priv(ndev);
+ lapbeth->axdev = ndev;
+
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index 6049d3766c64..3f563e02d17d 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -643,9 +643,9 @@ err:
+
+ static void ath9k_hif_usb_rx_cb(struct urb *urb)
+ {
+- struct sk_buff *skb = (struct sk_buff *) urb->context;
+- struct hif_device_usb *hif_dev =
+- usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
++ struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
++ struct hif_device_usb *hif_dev = rx_buf->hif_dev;
++ struct sk_buff *skb = rx_buf->skb;
+ int ret;
+
+ if (!skb)
+@@ -685,14 +685,15 @@ resubmit:
+ return;
+ free:
+ kfree_skb(skb);
++ kfree(rx_buf);
+ }
+
+ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+ {
+- struct sk_buff *skb = (struct sk_buff *) urb->context;
++ struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
++ struct hif_device_usb *hif_dev = rx_buf->hif_dev;
++ struct sk_buff *skb = rx_buf->skb;
+ struct sk_buff *nskb;
+- struct hif_device_usb *hif_dev =
+- usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+ int ret;
+
+ if (!skb)
+@@ -732,11 +733,13 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+ return;
+ }
+
++ rx_buf->skb = nskb;
++
+ usb_fill_int_urb(urb, hif_dev->udev,
+ usb_rcvintpipe(hif_dev->udev,
+ USB_REG_IN_PIPE),
+ nskb->data, MAX_REG_IN_BUF_SIZE,
+- ath9k_hif_usb_reg_in_cb, nskb, 1);
++ ath9k_hif_usb_reg_in_cb, rx_buf, 1);
+ }
+
+ resubmit:
+@@ -750,6 +753,7 @@ resubmit:
+ return;
+ free:
+ kfree_skb(skb);
++ kfree(rx_buf);
+ urb->context = NULL;
+ }
+
+@@ -795,7 +799,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
+ init_usb_anchor(&hif_dev->mgmt_submitted);
+
+ for (i = 0; i < MAX_TX_URB_NUM; i++) {
+- tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
++ tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL);
+ if (!tx_buf)
+ goto err;
+
+@@ -832,8 +836,9 @@ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
+
+ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+ {
+- struct urb *urb = NULL;
++ struct rx_buf *rx_buf = NULL;
+ struct sk_buff *skb = NULL;
++ struct urb *urb = NULL;
+ int i, ret;
+
+ init_usb_anchor(&hif_dev->rx_submitted);
+@@ -841,6 +846,12 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+
+ for (i = 0; i < MAX_RX_URB_NUM; i++) {
+
++ rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
++ if (!rx_buf) {
++ ret = -ENOMEM;
++ goto err_rxb;
++ }
++
+ /* Allocate URB */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (urb == NULL) {
+@@ -855,11 +866,14 @@ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+ goto err_skb;
+ }
+
++ rx_buf->hif_dev = hif_dev;
++ rx_buf->skb = skb;
++
+ usb_fill_bulk_urb(urb, hif_dev->udev,
+ usb_rcvbulkpipe(hif_dev->udev,
+ USB_WLAN_RX_PIPE),
+ skb->data, MAX_RX_BUF_SIZE,
+- ath9k_hif_usb_rx_cb, skb);
++ ath9k_hif_usb_rx_cb, rx_buf);
+
+ /* Anchor URB */
+ usb_anchor_urb(urb, &hif_dev->rx_submitted);
+@@ -885,6 +899,8 @@ err_submit:
+ err_skb:
+ usb_free_urb(urb);
+ err_urb:
++ kfree(rx_buf);
++err_rxb:
+ ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
+ return ret;
+ }
+@@ -896,14 +912,21 @@ static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+
+ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+ {
+- struct urb *urb = NULL;
++ struct rx_buf *rx_buf = NULL;
+ struct sk_buff *skb = NULL;
++ struct urb *urb = NULL;
+ int i, ret;
+
+ init_usb_anchor(&hif_dev->reg_in_submitted);
+
+ for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
+
++ rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
++ if (!rx_buf) {
++ ret = -ENOMEM;
++ goto err_rxb;
++ }
++
+ /* Allocate URB */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (urb == NULL) {
+@@ -918,11 +941,14 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
+ goto err_skb;
+ }
+
++ rx_buf->hif_dev = hif_dev;
++ rx_buf->skb = skb;
++
+ usb_fill_int_urb(urb, hif_dev->udev,
+ usb_rcvintpipe(hif_dev->udev,
+ USB_REG_IN_PIPE),
+ skb->data, MAX_REG_IN_BUF_SIZE,
+- ath9k_hif_usb_reg_in_cb, skb, 1);
++ ath9k_hif_usb_reg_in_cb, rx_buf, 1);
+
+ /* Anchor URB */
+ usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
+@@ -948,6 +974,8 @@ err_submit:
+ err_skb:
+ usb_free_urb(urb);
+ err_urb:
++ kfree(rx_buf);
++err_rxb:
+ ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
+ return ret;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
+index a94e7e1c86e9..5985aa15ca93 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
+@@ -86,6 +86,11 @@ struct tx_buf {
+ struct list_head list;
+ };
+
++struct rx_buf {
++ struct sk_buff *skb;
++ struct hif_device_usb *hif_dev;
++};
++
+ #define HIF_USB_TX_STOP BIT(0)
+ #define HIF_USB_TX_FLUSH BIT(1)
+
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index c3ac7f094a39..ad39b404f10a 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -704,9 +704,10 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+
+ vmd->irq_domain = pci_msi_create_irq_domain(fn, &vmd_msi_domain_info,
+ x86_vector_domain);
+- irq_domain_free_fwnode(fn);
+- if (!vmd->irq_domain)
++ if (!vmd->irq_domain) {
++ irq_domain_free_fwnode(fn);
+ return -ENODEV;
++ }
+
+ pci_add_resource(&resources, &vmd->resources[0]);
+ pci_add_resource_offset(&resources, &vmd->resources[1], offset[0]);
+diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h
+index 22af7edfdb38..91da7527f002 100644
+--- a/drivers/pinctrl/pinctrl-amd.h
++++ b/drivers/pinctrl/pinctrl-amd.h
+@@ -256,7 +256,7 @@ static const struct amd_pingroup kerncz_groups[] = {
+ {
+ .name = "uart0",
+ .pins = uart0_pins,
+- .npins = 9,
++ .npins = 5,
+ },
+ {
+ .name = "uart1",
+diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c
+index 40b85b752b79..69213842e63e 100644
+--- a/drivers/scsi/scsi_transport_spi.c
++++ b/drivers/scsi/scsi_transport_spi.c
+@@ -352,7 +352,7 @@ store_spi_transport_##field(struct device *dev, \
+ struct spi_transport_attrs *tp \
+ = (struct spi_transport_attrs *)&starget->starget_data; \
+ \
+- if (i->f->set_##field) \
++ if (!i->f->set_##field) \
+ return -EINVAL; \
+ val = simple_strtoul(buf, NULL, 0); \
+ if (val > tp->max_##field) \
+diff --git a/drivers/soc/qcom/rpmh.c b/drivers/soc/qcom/rpmh.c
+index b208073e0ab6..8e19a8bdfd2c 100644
+--- a/drivers/soc/qcom/rpmh.c
++++ b/drivers/soc/qcom/rpmh.c
+@@ -150,10 +150,10 @@ existing:
+ break;
+ }
+
+- ctrlr->dirty = (req->sleep_val != old_sleep_val ||
+- req->wake_val != old_wake_val) &&
+- req->sleep_val != UINT_MAX &&
+- req->wake_val != UINT_MAX;
++ ctrlr->dirty |= (req->sleep_val != old_sleep_val ||
++ req->wake_val != old_wake_val) &&
++ req->sleep_val != UINT_MAX &&
++ req->wake_val != UINT_MAX;
+
+ unlock:
+ spin_unlock_irqrestore(&ctrlr->cache_lock, flags);
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 43809fad250b..1b003dba86f9 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -878,9 +878,11 @@ static irqreturn_t dspi_interrupt(int irq, void *dev_id)
+ trans_mode);
+ }
+ }
++
++ return IRQ_HANDLED;
+ }
+
+- return IRQ_HANDLED;
++ return IRQ_NONE;
+ }
+
+ static const struct of_device_id fsl_dspi_dt_ids[] = {
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index 0c2867deb36f..da28c52c9da1 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -41,7 +41,6 @@
+ #define SPI_CFG0_SCK_LOW_OFFSET 8
+ #define SPI_CFG0_CS_HOLD_OFFSET 16
+ #define SPI_CFG0_CS_SETUP_OFFSET 24
+-#define SPI_ADJUST_CFG0_SCK_LOW_OFFSET 16
+ #define SPI_ADJUST_CFG0_CS_HOLD_OFFSET 0
+ #define SPI_ADJUST_CFG0_CS_SETUP_OFFSET 16
+
+@@ -53,6 +52,8 @@
+ #define SPI_CFG1_CS_IDLE_MASK 0xff
+ #define SPI_CFG1_PACKET_LOOP_MASK 0xff00
+ #define SPI_CFG1_PACKET_LENGTH_MASK 0x3ff0000
++#define SPI_CFG2_SCK_HIGH_OFFSET 0
++#define SPI_CFG2_SCK_LOW_OFFSET 16
+
+ #define SPI_CMD_ACT BIT(0)
+ #define SPI_CMD_RESUME BIT(1)
+@@ -259,7 +260,7 @@ static void mtk_spi_set_cs(struct spi_device *spi, bool enable)
+ static void mtk_spi_prepare_transfer(struct spi_master *master,
+ struct spi_transfer *xfer)
+ {
+- u32 spi_clk_hz, div, sck_time, cs_time, reg_val = 0;
++ u32 spi_clk_hz, div, sck_time, cs_time, reg_val;
+ struct mtk_spi *mdata = spi_master_get_devdata(master);
+
+ spi_clk_hz = clk_get_rate(mdata->spi_clk);
+@@ -272,18 +273,18 @@ static void mtk_spi_prepare_transfer(struct spi_master *master,
+ cs_time = sck_time * 2;
+
+ if (mdata->dev_comp->enhance_timing) {
++ reg_val = (((sck_time - 1) & 0xffff)
++ << SPI_CFG2_SCK_HIGH_OFFSET);
+ reg_val |= (((sck_time - 1) & 0xffff)
+- << SPI_CFG0_SCK_HIGH_OFFSET);
+- reg_val |= (((sck_time - 1) & 0xffff)
+- << SPI_ADJUST_CFG0_SCK_LOW_OFFSET);
++ << SPI_CFG2_SCK_LOW_OFFSET);
+ writel(reg_val, mdata->base + SPI_CFG2_REG);
+- reg_val |= (((cs_time - 1) & 0xffff)
++ reg_val = (((cs_time - 1) & 0xffff)
+ << SPI_ADJUST_CFG0_CS_HOLD_OFFSET);
+ reg_val |= (((cs_time - 1) & 0xffff)
+ << SPI_ADJUST_CFG0_CS_SETUP_OFFSET);
+ writel(reg_val, mdata->base + SPI_CFG0_REG);
+ } else {
+- reg_val |= (((sck_time - 1) & 0xff)
++ reg_val = (((sck_time - 1) & 0xff)
+ << SPI_CFG0_SCK_HIGH_OFFSET);
+ reg_val |= (((sck_time - 1) & 0xff) << SPI_CFG0_SCK_LOW_OFFSET);
+ reg_val |= (((cs_time - 1) & 0xff) << SPI_CFG0_CS_HOLD_OFFSET);
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c
+index 560649be9d13..e035c9f757a1 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1032.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1032.c
+@@ -106,14 +106,22 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
+ unsigned int *data)
+ {
+ struct apci1032_private *devpriv = dev->private;
+- unsigned int shift, oldmask;
++ unsigned int shift, oldmask, himask, lomask;
+
+ switch (data[0]) {
+ case INSN_CONFIG_DIGITAL_TRIG:
+ if (data[1] != 0)
+ return -EINVAL;
+ shift = data[3];
+- oldmask = (1U << shift) - 1;
++ if (shift < 32) {
++ oldmask = (1U << shift) - 1;
++ himask = data[4] << shift;
++ lomask = data[5] << shift;
++ } else {
++ oldmask = 0xffffffffu;
++ himask = 0;
++ lomask = 0;
++ }
+ switch (data[2]) {
+ case COMEDI_DIGITAL_TRIG_DISABLE:
+ devpriv->ctrl = 0;
+@@ -136,8 +144,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
+ devpriv->mode2 &= oldmask;
+ }
+ /* configure specified channels */
+- devpriv->mode1 |= data[4] << shift;
+- devpriv->mode2 |= data[5] << shift;
++ devpriv->mode1 |= himask;
++ devpriv->mode2 |= lomask;
+ break;
+ case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
+ if (devpriv->ctrl != (APCI1032_CTRL_INT_ENA |
+@@ -154,8 +162,8 @@ static int apci1032_cos_insn_config(struct comedi_device *dev,
+ devpriv->mode2 &= oldmask;
+ }
+ /* configure specified channels */
+- devpriv->mode1 |= data[4] << shift;
+- devpriv->mode2 |= data[5] << shift;
++ devpriv->mode1 |= himask;
++ devpriv->mode2 |= lomask;
+ break;
+ default:
+ return -EINVAL;
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
+index 689acd69a1b9..816dd25b9d0e 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
+@@ -452,13 +452,14 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
+ struct apci1500_private *devpriv = dev->private;
+ unsigned int trig = data[1];
+ unsigned int shift = data[3];
+- unsigned int hi_mask = data[4] << shift;
+- unsigned int lo_mask = data[5] << shift;
+- unsigned int chan_mask = hi_mask | lo_mask;
+- unsigned int old_mask = (1 << shift) - 1;
++ unsigned int hi_mask;
++ unsigned int lo_mask;
++ unsigned int chan_mask;
++ unsigned int old_mask;
+ unsigned int pm;
+ unsigned int pt;
+ unsigned int pp;
++ unsigned int invalid_chan;
+
+ if (trig > 1) {
+ dev_dbg(dev->class_dev,
+@@ -466,7 +467,20 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,
+ return -EINVAL;
+ }
+
+- if (chan_mask > 0xffff) {
++ if (shift <= 16) {
++ hi_mask = data[4] << shift;
++ lo_mask = data[5] << shift;
++ old_mask = (1U << shift) - 1;
++ invalid_chan = (data[4] | data[5]) >> (16 - shift);
++ } else {
++ hi_mask = 0;
++ lo_mask = 0;
++ old_mask = 0xffff;
++ invalid_chan = data[4] | data[5];
++ }
++ chan_mask = hi_mask | lo_mask;
++
++ if (invalid_chan) {
+ dev_dbg(dev->class_dev, "invalid digital trigger channel\n");
+ return -EINVAL;
+ }
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1564.c b/drivers/staging/comedi/drivers/addi_apci_1564.c
+index 10501fe6bb25..1268ba34be5f 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1564.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1564.c
+@@ -331,14 +331,22 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
+ unsigned int *data)
+ {
+ struct apci1564_private *devpriv = dev->private;
+- unsigned int shift, oldmask;
++ unsigned int shift, oldmask, himask, lomask;
+
+ switch (data[0]) {
+ case INSN_CONFIG_DIGITAL_TRIG:
+ if (data[1] != 0)
+ return -EINVAL;
+ shift = data[3];
+- oldmask = (1U << shift) - 1;
++ if (shift < 32) {
++ oldmask = (1U << shift) - 1;
++ himask = data[4] << shift;
++ lomask = data[5] << shift;
++ } else {
++ oldmask = 0xffffffffu;
++ himask = 0;
++ lomask = 0;
++ }
+ switch (data[2]) {
+ case COMEDI_DIGITAL_TRIG_DISABLE:
+ devpriv->ctrl = 0;
+@@ -362,8 +370,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
+ devpriv->mode2 &= oldmask;
+ }
+ /* configure specified channels */
+- devpriv->mode1 |= data[4] << shift;
+- devpriv->mode2 |= data[5] << shift;
++ devpriv->mode1 |= himask;
++ devpriv->mode2 |= lomask;
+ break;
+ case COMEDI_DIGITAL_TRIG_ENABLE_LEVELS:
+ if (devpriv->ctrl != (APCI1564_DI_IRQ_ENA |
+@@ -380,8 +388,8 @@ static int apci1564_cos_insn_config(struct comedi_device *dev,
+ devpriv->mode2 &= oldmask;
+ }
+ /* configure specified channels */
+- devpriv->mode1 |= data[4] << shift;
+- devpriv->mode2 |= data[5] << shift;
++ devpriv->mode1 |= himask;
++ devpriv->mode2 |= lomask;
+ break;
+ default:
+ return -EINVAL;
+diff --git a/drivers/staging/comedi/drivers/ni_6527.c b/drivers/staging/comedi/drivers/ni_6527.c
+index 4d1eccb5041d..4518c2680b7c 100644
+--- a/drivers/staging/comedi/drivers/ni_6527.c
++++ b/drivers/staging/comedi/drivers/ni_6527.c
+@@ -332,7 +332,7 @@ static int ni6527_intr_insn_config(struct comedi_device *dev,
+ case COMEDI_DIGITAL_TRIG_ENABLE_EDGES:
+ /* check shift amount */
+ shift = data[3];
+- if (shift >= s->n_chan) {
++ if (shift >= 32) {
+ mask = 0;
+ rising = 0;
+ falling = 0;
+diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c
+index d8d86761b790..8d32b1603d10 100644
+--- a/drivers/staging/wlan-ng/prism2usb.c
++++ b/drivers/staging/wlan-ng/prism2usb.c
+@@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
+ const struct usb_device_id *id)
+ {
+ struct usb_device *dev;
+-
++ const struct usb_endpoint_descriptor *epd;
++ const struct usb_host_interface *iface_desc = interface->cur_altsetting;
+ struct wlandevice *wlandev = NULL;
+ struct hfa384x *hw = NULL;
+ int result = 0;
+
++ if (iface_desc->desc.bNumEndpoints != 2) {
++ result = -ENODEV;
++ goto failed;
++ }
++
++ result = -EINVAL;
++ epd = &iface_desc->endpoint[1].desc;
++ if (!usb_endpoint_is_bulk_in(epd))
++ goto failed;
++ epd = &iface_desc->endpoint[2].desc;
++ if (!usb_endpoint_is_bulk_out(epd))
++ goto failed;
++
+ dev = interface_to_usbdev(interface);
+ wlandev = create_wlan();
+ if (!wlandev) {
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index b9567ef843fc..e1a5887b6d91 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -527,6 +527,7 @@ static void __init serial8250_isa_init_ports(void)
+ */
+ up->mcr_mask = ~ALPHA_KLUDGE_MCR;
+ up->mcr_force = ALPHA_KLUDGE_MCR;
++ serial8250_set_defaults(up);
+ }
+
+ /* chain base port ops to support Remote Supervisor Adapter */
+@@ -550,7 +551,6 @@ static void __init serial8250_isa_init_ports(void)
+ port->membase = old_serial_port[i].iomem_base;
+ port->iotype = old_serial_port[i].io_type;
+ port->regshift = old_serial_port[i].iomem_reg_shift;
+- serial8250_set_defaults(up);
+
+ port->irqflags |= irqflag;
+ if (serial8250_isa_config != NULL)
+diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
+index 870735776437..d39162e71f59 100644
+--- a/drivers/tty/serial/8250/8250_exar.c
++++ b/drivers/tty/serial/8250/8250_exar.c
+@@ -227,7 +227,17 @@ static void setup_gpio(struct pci_dev *pcidev, u8 __iomem *p)
+ * devices will export them as GPIOs, so we pre-configure them safely
+ * as inputs.
+ */
+- u8 dir = pcidev->vendor == PCI_VENDOR_ID_EXAR ? 0xff : 0x00;
++
++ u8 dir = 0x00;
++
++ if ((pcidev->vendor == PCI_VENDOR_ID_EXAR) &&
++ (pcidev->subsystem_vendor != PCI_VENDOR_ID_SEALEVEL)) {
++ // Configure GPIO as inputs for Commtech adapters
++ dir = 0xff;
++ } else {
++ // Configure GPIO as outputs for SeaLevel adapters
++ dir = 0x00;
++ }
+
+ writeb(0x00, p + UART_EXAR_MPIOINT_7_0);
+ writeb(0x00, p + UART_EXAR_MPIOLVL_7_0);
+diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
+index c3f933d10295..159169a48deb 100644
+--- a/drivers/tty/serial/8250/8250_mtk.c
++++ b/drivers/tty/serial/8250/8250_mtk.c
+@@ -36,8 +36,21 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
+ unsigned long flags;
+ unsigned int baud, quot;
+
++ /*
++ * Store the requested baud rate before calling the generic 8250
++ * set_termios method. Standard 8250 port expects bauds to be
++ * no higher than (uartclk / 16) so the baud will be clamped if it
++ * gets out of that bound. Mediatek 8250 port supports speed
++ * higher than that, therefore we'll get original baud rate back
++ * after calling the generic set_termios method and recalculate
++ * the speed later in this method.
++ */
++ baud = tty_termios_baud_rate(termios);
++
+ serial8250_do_set_termios(port, termios, old);
+
++ tty_termios_encode_baud_rate(termios, baud, baud);
++
+ /*
+ * Mediatek UARTs use an extra highspeed register (UART_MTK_HIGHS)
+ *
+@@ -76,6 +89,11 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
+ */
+ spin_lock_irqsave(&port->lock, flags);
+
++ /*
++ * Update the per-port timeout.
++ */
++ uart_update_timeout(port, termios->c_cflag, baud);
++
+ /* set DLAB we have cval saved in up->lcr from the call to the core */
+ serial_port_out(port, UART_LCR, up->lcr | UART_LCR_DLAB);
+ serial_dl_write(up, quot);
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 5c7a968a5ea6..982d9684c65e 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1095,10 +1095,19 @@ static const struct tty_port_operations vc_port_ops = {
+ .destruct = vc_port_destruct,
+ };
+
++/*
++ * Change # of rows and columns (0 means unchanged/the size of fg_console)
++ * [this is to be used together with some user program
++ * like resize that changes the hardware videomode]
++ */
++#define VC_MAXCOL (32767)
++#define VC_MAXROW (32767)
++
+ int vc_allocate(unsigned int currcons) /* return 0 on success */
+ {
+ struct vt_notifier_param param;
+ struct vc_data *vc;
++ int err;
+
+ WARN_CONSOLE_UNLOCKED();
+
+@@ -1128,6 +1137,11 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */
+ if (!*vc->vc_uni_pagedir_loc)
+ con_set_default_unimap(vc);
+
++ err = -EINVAL;
++ if (vc->vc_cols > VC_MAXCOL || vc->vc_rows > VC_MAXROW ||
++ vc->vc_screenbuf_size > KMALLOC_MAX_SIZE || !vc->vc_screenbuf_size)
++ goto err_free;
++ err = -ENOMEM;
+ vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_KERNEL);
+ if (!vc->vc_screenbuf)
+ goto err_free;
+@@ -1146,7 +1160,7 @@ err_free:
+ visual_deinit(vc);
+ kfree(vc);
+ vc_cons[currcons].d = NULL;
+- return -ENOMEM;
++ return err;
+ }
+
+ static inline int resize_screen(struct vc_data *vc, int width, int height,
+@@ -1161,14 +1175,6 @@ static inline int resize_screen(struct vc_data *vc, int width, int height,
+ return err;
+ }
+
+-/*
+- * Change # of rows and columns (0 means unchanged/the size of fg_console)
+- * [this is to be used together with some user program
+- * like resize that changes the hardware videomode]
+- */
+-#define VC_RESIZE_MAXCOL (32767)
+-#define VC_RESIZE_MAXROW (32767)
+-
+ /**
+ * vc_do_resize - resizing method for the tty
+ * @tty: tty being resized
+@@ -1204,7 +1210,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ user = vc->vc_resize_user;
+ vc->vc_resize_user = 0;
+
+- if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW)
++ if (cols > VC_MAXCOL || lines > VC_MAXROW)
+ return -EINVAL;
+
+ new_cols = (cols ? cols : vc->vc_cols);
+@@ -1215,7 +1221,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
+ return 0;
+
+- if (new_screen_size > KMALLOC_MAX_SIZE)
++ if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size)
+ return -EINVAL;
+ newscreen = kzalloc(new_screen_size, GFP_USER);
+ if (!newscreen)
+@@ -3371,6 +3377,7 @@ static int __init con_init(void)
+ INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
+ tty_port_init(&vc->port);
+ visual_init(vc, currcons, 1);
++ /* Assuming vc->vc_{cols,rows,screenbuf_size} are sane here. */
+ vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);
+ vc_init(vc, vc->vc_rows, vc->vc_cols,
+ currcons || !vc->vc_sw->con_save_screen);
+diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
+index e50108f9a374..e0b2fb33ed0d 100644
+--- a/drivers/usb/gadget/udc/gr_udc.c
++++ b/drivers/usb/gadget/udc/gr_udc.c
+@@ -1980,9 +1980,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit)
+
+ if (num == 0) {
+ _req = gr_alloc_request(&ep->ep, GFP_ATOMIC);
++ if (!_req)
++ return -ENOMEM;
++
+ buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC);
+- if (!_req || !buf) {
+- /* possible _req freed by gr_probe via gr_remove */
++ if (!buf) {
++ gr_free_request(&ep->ep, _req);
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
+index d04fdd173ed2..4bda7e7ee342 100644
+--- a/drivers/usb/host/xhci-mtk-sch.c
++++ b/drivers/usb/host/xhci-mtk-sch.c
+@@ -275,6 +275,10 @@ static bool need_bw_sch(struct usb_host_endpoint *ep,
+ if (is_fs_or_ls(speed) && !has_tt)
+ return false;
+
++ /* skip endpoint with zero maxpkt */
++ if (usb_endpoint_maxp(&ep->desc) == 0)
++ return false;
++
+ return true;
+ }
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index d87f48e6b0c7..9b02e3e3f998 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -231,6 +231,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+ pdev->device == 0x1142)
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
++ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
++ pdev->device == 0x2142)
++ xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
+
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI)
+diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
+index ca935c09a261..35ebeeccde4d 100644
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
+ region.color = color;
+ region.rop = ROP_COPY;
+
+- if (rw && !bottom_only) {
++ if ((int) rw > 0 && !bottom_only) {
+ region.dx = info->var.xoffset + rs;
+ region.dy = 0;
+ region.width = rw;
+@@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
+ info->fbops->fb_fillrect(info, ®ion);
+ }
+
+- if (bh) {
++ if ((int) bh > 0) {
+ region.dx = info->var.xoffset;
+ region.dy = info->var.yoffset + bs;
+ region.width = rs;
+diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c
+index dfa9a8aa4509..78f3a5621478 100644
+--- a/drivers/video/fbdev/core/fbcon_ccw.c
++++ b/drivers/video/fbdev/core/fbcon_ccw.c
+@@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ region.color = color;
+ region.rop = ROP_COPY;
+
+- if (rw && !bottom_only) {
++ if ((int) rw > 0 && !bottom_only) {
+ region.dx = 0;
+ region.dy = info->var.yoffset;
+ region.height = rw;
+@@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ info->fbops->fb_fillrect(info, ®ion);
+ }
+
+- if (bh) {
++ if ((int) bh > 0) {
+ region.dx = info->var.xoffset + bs;
+ region.dy = 0;
+ region.height = info->var.yres_virtual;
+diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c
+index ce08251bfd38..fd098ff17574 100644
+--- a/drivers/video/fbdev/core/fbcon_cw.c
++++ b/drivers/video/fbdev/core/fbcon_cw.c
+@@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ region.color = color;
+ region.rop = ROP_COPY;
+
+- if (rw && !bottom_only) {
++ if ((int) rw > 0 && !bottom_only) {
+ region.dx = 0;
+ region.dy = info->var.yoffset + rs;
+ region.height = rw;
+@@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ info->fbops->fb_fillrect(info, ®ion);
+ }
+
+- if (bh) {
++ if ((int) bh > 0) {
+ region.dx = info->var.xoffset;
+ region.dy = info->var.yoffset;
+ region.height = info->var.yres;
+diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c
+index 1936afc78fec..e165a3fad29a 100644
+--- a/drivers/video/fbdev/core/fbcon_ud.c
++++ b/drivers/video/fbdev/core/fbcon_ud.c
+@@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
+ region.color = color;
+ region.rop = ROP_COPY;
+
+- if (rw && !bottom_only) {
++ if ((int) rw > 0 && !bottom_only) {
+ region.dy = 0;
+ region.dx = info->var.xoffset;
+ region.width = rw;
+@@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
+ info->fbops->fb_fillrect(info, ®ion);
+ }
+
+- if (bh) {
++ if ((int) bh > 0) {
+ region.dy = info->var.yoffset;
+ region.dx = info->var.xoffset;
+ region.height = bh;
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 19855659f650..6b8824de2abb 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -1419,6 +1419,7 @@ static int btrfs_find_all_roots_safe(struct btrfs_trans_handle *trans,
+ if (ret < 0 && ret != -ENOENT) {
+ ulist_free(tmp);
+ ulist_free(*roots);
++ *roots = NULL;
+ return ret;
+ }
+ node = ulist_next(tmp, &uiter);
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 8b6dbaa59c36..520b70b54331 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -1707,7 +1707,8 @@ static int __process_pages_contig(struct address_space *mapping,
+ if (!PageDirty(pages[i]) ||
+ pages[i]->mapping != mapping) {
+ unlock_page(pages[i]);
+- put_page(pages[i]);
++ for (; i < ret; i++)
++ put_page(pages[i]);
+ err = -EAGAIN;
+ goto out;
+ }
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index b9ce42877e46..e0ba1e9ddcdf 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -6934,6 +6934,14 @@ int btrfs_read_chunk_tree(struct btrfs_fs_info *fs_info)
+ mutex_lock(&uuid_mutex);
+ mutex_lock(&fs_info->chunk_mutex);
+
++ /*
++ * It is possible for mount and umount to race in such a way that
++ * we execute this code path, but open_fs_devices failed to clear
++ * total_rw_bytes. We certainly want it cleared before reading the
++ * device items, so clear it here.
++ */
++ fs_info->fs_devices->total_rw_bytes = 0;
++
+ /*
+ * Read all device items, and then all the chunk items. All
+ * device items are found before any chunk item (their object id
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 1d951936b092..4a38f16d944d 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1783,7 +1783,6 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
+ FILE_UNIX_BASIC_INFO *info_buf_target;
+ unsigned int xid;
+ int rc, tmprc;
+- bool new_target = d_really_is_negative(target_dentry);
+
+ if (flags & ~RENAME_NOREPLACE)
+ return -EINVAL;
+@@ -1860,13 +1859,8 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
+ */
+
+ unlink_target:
+- /*
+- * If the target dentry was created during the rename, try
+- * unlinking it if it's not negative
+- */
+- if (new_target &&
+- d_really_is_positive(target_dentry) &&
+- (rc == -EACCES || rc == -EEXIST)) {
++ /* Try unlinking the target dentry if it's not negative */
++ if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) {
+ if (d_is_dir(target_dentry))
+ tmprc = cifs_rmdir(target_dir, target_dentry);
+ else
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 6d39143cfa09..01e6ea11822b 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -838,7 +838,8 @@ static int fuse_check_page(struct page *page)
+ 1 << PG_uptodate |
+ 1 << PG_lru |
+ 1 << PG_active |
+- 1 << PG_reclaim))) {
++ 1 << PG_reclaim |
++ 1 << PG_waiters))) {
+ printk(KERN_WARNING "fuse: trying to steal weird page\n");
+ printk(KERN_WARNING " page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n", page, page->index, page->flags, page_count(page), page_mapcount(page), page->mapping);
+ return 1;
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index 1e883df26d4a..e5da9d7fb69e 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -396,6 +396,8 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq)
+ {
+ struct inode *inode = dreq->inode;
+
++ inode_dio_end(inode);
++
+ if (dreq->iocb) {
+ long res = (long) dreq->error;
+ if (dreq->count != 0) {
+@@ -407,10 +409,7 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq)
+
+ complete(&dreq->completion);
+
+- igrab(inode);
+ nfs_direct_req_release(dreq);
+- inode_dio_end(inode);
+- iput(inode);
+ }
+
+ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
+@@ -540,10 +539,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
+ * generic layer handle the completion.
+ */
+ if (requested_bytes == 0) {
+- igrab(inode);
+- nfs_direct_req_release(dreq);
+ inode_dio_end(inode);
+- iput(inode);
++ nfs_direct_req_release(dreq);
+ return result < 0 ? result : -EIO;
+ }
+
+@@ -960,10 +957,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
+ * generic layer handle the completion.
+ */
+ if (requested_bytes == 0) {
+- igrab(inode);
+- nfs_direct_req_release(dreq);
+ inode_dio_end(inode);
+- iput(inode);
++ nfs_direct_req_release(dreq);
+ return result < 0 ? result : -EIO;
+ }
+
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index b2257fa209ac..29553fdba8af 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -82,7 +82,6 @@ nfs_file_release(struct inode *inode, struct file *filp)
+ dprintk("NFS: release(%pD2)\n", filp);
+
+ nfs_inc_stats(inode, NFSIOS_VFSRELEASE);
+- inode_dio_wait(inode);
+ nfs_file_clear_open_context(filp);
+ return 0;
+ }
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index dd38c97933f1..95479f35e239 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -279,7 +279,8 @@
+
+ #define PAGE_ALIGNED_DATA(page_align) \
+ . = ALIGN(page_align); \
+- *(.data..page_aligned)
++ *(.data..page_aligned) \
++ . = ALIGN(page_align);
+
+ #define READ_MOSTLY_DATA(align) \
+ . = ALIGN(align); \
+@@ -650,7 +651,9 @@
+ . = ALIGN(bss_align); \
+ .bss : AT(ADDR(.bss) - LOAD_OFFSET) { \
+ BSS_FIRST_SECTIONS \
++ . = ALIGN(PAGE_SIZE); \
+ *(.bss..page_aligned) \
++ . = ALIGN(PAGE_SIZE); \
+ *(.dynbss) \
+ *(BSS_MAIN) \
+ *(COMMON) \
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index 91f9f95ad506..ff60ba537cf2 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -419,6 +419,7 @@ const char *dm_device_name(struct mapped_device *md);
+ int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid);
+ struct gendisk *dm_disk(struct mapped_device *md);
+ int dm_suspended(struct dm_target *ti);
++int dm_post_suspending(struct dm_target *ti);
+ int dm_noflush_suspending(struct dm_target *ti);
+ void dm_accept_partial_bio(struct bio *bio, unsigned n_sectors);
+ void dm_remap_zone_report(struct dm_target *ti, struct bio *bio,
+diff --git a/include/linux/io-mapping.h b/include/linux/io-mapping.h
+index 58df02bd93c9..fa46183b163b 100644
+--- a/include/linux/io-mapping.h
++++ b/include/linux/io-mapping.h
+@@ -120,9 +120,12 @@ io_mapping_init_wc(struct io_mapping *iomap,
+ resource_size_t base,
+ unsigned long size)
+ {
++ iomap->iomem = ioremap_wc(base, size);
++ if (!iomap->iomem)
++ return NULL;
++
+ iomap->base = base;
+ iomap->size = size;
+- iomap->iomem = ioremap_wc(base, size);
+ #if defined(pgprot_noncached_wc) /* archs can't agree on a name ... */
+ iomap->prot = pgprot_noncached_wc(PAGE_KERNEL);
+ #elif defined(pgprot_writecombine)
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index 84e4e20352d9..610cdf8082f2 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -299,7 +299,7 @@ struct pcmcia_device_id {
+ #define INPUT_DEVICE_ID_LED_MAX 0x0f
+ #define INPUT_DEVICE_ID_SND_MAX 0x07
+ #define INPUT_DEVICE_ID_FF_MAX 0x7f
+-#define INPUT_DEVICE_ID_SW_MAX 0x0f
++#define INPUT_DEVICE_ID_SW_MAX 0x10
+ #define INPUT_DEVICE_ID_PROP_MAX 0x1f
+
+ #define INPUT_DEVICE_ID_MATCH_BUS 1
+diff --git a/include/sound/rt5670.h b/include/sound/rt5670.h
+index b7d60510819b..491c7a8fd2bb 100644
+--- a/include/sound/rt5670.h
++++ b/include/sound/rt5670.h
+@@ -15,6 +15,7 @@ struct rt5670_platform_data {
+ int jd_mode;
+ bool in2_diff;
+ bool dev_gpio;
++ bool gpio1_is_ext_spk_en;
+
+ bool dmic_en;
+ unsigned int dmic1_data_pin;
+diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
+index 61a5799b440b..c3e84f7c8261 100644
+--- a/include/uapi/linux/input-event-codes.h
++++ b/include/uapi/linux/input-event-codes.h
+@@ -795,7 +795,8 @@
+ #define SW_LINEIN_INSERT 0x0d /* set = inserted */
+ #define SW_MUTE_DEVICE 0x0e /* set = device disabled */
+ #define SW_PEN_INSERTED 0x0f /* set = pen inserted */
+-#define SW_MAX 0x0f
++#define SW_MACHINE_COVER 0x10 /* set = cover closed */
++#define SW_MAX 0x10
+ #define SW_CNT (SW_MAX+1)
+
+ /*
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 02d82013c334..24342bca11f2 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1897,7 +1897,7 @@ static void handle_swbp(struct pt_regs *regs)
+ if (!uprobe) {
+ if (is_swbp > 0) {
+ /* No matching uprobe; signal SIGTRAP. */
+- send_sig(SIGTRAP, current, 0);
++ force_sig(SIGTRAP, current);
+ } else {
+ /*
+ * Either we raced with uprobe_unregister() or we can't
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 3b78b6af353b..aa730a3d5c25 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -5147,7 +5147,6 @@ static void __mem_cgroup_clear_mc(void)
+ if (!mem_cgroup_is_root(mc.to))
+ page_counter_uncharge(&mc.to->memory, mc.moved_swap);
+
+- mem_cgroup_id_get_many(mc.to, mc.moved_swap);
+ css_put_many(&mc.to->css, mc.moved_swap);
+
+ mc.moved_swap = 0;
+@@ -5338,7 +5337,8 @@ put: /* get_mctgt_type() gets the page */
+ ent = target.ent;
+ if (!mem_cgroup_move_swap_account(ent, mc.from, mc.to)) {
+ mc.precharge--;
+- /* we fixup refcnts and charges later. */
++ mem_cgroup_id_get_many(mc.to, 1);
++ /* we fixup other refcnts and charges later. */
+ mc.moved_swap++;
+ }
+ break;
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index b5776b1301f0..a94b9981eb17 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -130,6 +130,7 @@ int __kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t nr,
+ #ifdef CONFIG_MEMCG_KMEM
+
+ LIST_HEAD(slab_root_caches);
++static DEFINE_SPINLOCK(memcg_kmem_wq_lock);
+
+ void slab_init_memcg_params(struct kmem_cache *s)
+ {
+@@ -310,6 +311,14 @@ int slab_unmergeable(struct kmem_cache *s)
+ if (s->refcount < 0)
+ return 1;
+
++#ifdef CONFIG_MEMCG_KMEM
++ /*
++ * Skip the dying kmem_cache.
++ */
++ if (s->memcg_params.dying)
++ return 1;
++#endif
++
+ return 0;
+ }
+
+@@ -717,14 +726,22 @@ void slab_deactivate_memcg_cache_rcu_sched(struct kmem_cache *s,
+ WARN_ON_ONCE(s->memcg_params.deact_fn))
+ return;
+
++ /*
++ * memcg_kmem_wq_lock is used to synchronize memcg_params.dying
++ * flag and make sure that no new kmem_cache deactivation tasks
++ * are queued (see flush_memcg_workqueue() ).
++ */
++ spin_lock_irq(&memcg_kmem_wq_lock);
+ if (s->memcg_params.root_cache->memcg_params.dying)
+- return;
++ goto unlock;
+
+ /* pin memcg so that @s doesn't get destroyed in the middle */
+ css_get(&s->memcg_params.memcg->css);
+
+ s->memcg_params.deact_fn = deact_fn;
+ call_rcu_sched(&s->memcg_params.deact_rcu_head, kmemcg_deactivate_rcufn);
++unlock:
++ spin_unlock_irq(&memcg_kmem_wq_lock);
+ }
+
+ void memcg_deactivate_kmem_caches(struct mem_cgroup *memcg)
+@@ -832,12 +849,15 @@ static int shutdown_memcg_caches(struct kmem_cache *s)
+ return 0;
+ }
+
+-static void flush_memcg_workqueue(struct kmem_cache *s)
++static void memcg_set_kmem_cache_dying(struct kmem_cache *s)
+ {
+- mutex_lock(&slab_mutex);
++ spin_lock_irq(&memcg_kmem_wq_lock);
+ s->memcg_params.dying = true;
+- mutex_unlock(&slab_mutex);
++ spin_unlock_irq(&memcg_kmem_wq_lock);
++}
+
++static void flush_memcg_workqueue(struct kmem_cache *s)
++{
+ /*
+ * SLUB deactivates the kmem_caches through call_rcu_sched. Make
+ * sure all registered rcu callbacks have been invoked.
+@@ -858,10 +878,6 @@ static inline int shutdown_memcg_caches(struct kmem_cache *s)
+ {
+ return 0;
+ }
+-
+-static inline void flush_memcg_workqueue(struct kmem_cache *s)
+-{
+-}
+ #endif /* CONFIG_MEMCG_KMEM */
+
+ void slab_kmem_cache_release(struct kmem_cache *s)
+@@ -879,8 +895,6 @@ void kmem_cache_destroy(struct kmem_cache *s)
+ if (unlikely(!s))
+ return;
+
+- flush_memcg_workqueue(s);
+-
+ get_online_cpus();
+ get_online_mems();
+
+@@ -890,6 +904,22 @@ void kmem_cache_destroy(struct kmem_cache *s)
+ if (s->refcount)
+ goto out_unlock;
+
++#ifdef CONFIG_MEMCG_KMEM
++ memcg_set_kmem_cache_dying(s);
++
++ mutex_unlock(&slab_mutex);
++
++ put_online_mems();
++ put_online_cpus();
++
++ flush_memcg_workqueue(s);
++
++ get_online_cpus();
++ get_online_mems();
++
++ mutex_lock(&slab_mutex);
++#endif
++
+ err = shutdown_memcg_caches(s);
+ if (!err)
+ err = shutdown_cache(s);
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index c17e148e06e7..5e56719f999c 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2230,6 +2230,7 @@ static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
+
+ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
+ {
++ struct ieee80211_hdr *hdr = (void *)rx->skb->data;
+ struct sk_buff *skb = rx->skb;
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+
+@@ -2240,6 +2241,31 @@ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
+ if (status->flag & RX_FLAG_DECRYPTED)
+ return 0;
+
++ /* check mesh EAPOL frames first */
++ if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) &&
++ ieee80211_is_data(fc))) {
++ struct ieee80211s_hdr *mesh_hdr;
++ u16 hdr_len = ieee80211_hdrlen(fc);
++ u16 ethertype_offset;
++ __be16 ethertype;
++
++ if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr))
++ goto drop_check;
++
++ /* make sure fixed part of mesh header is there, also checks skb len */
++ if (!pskb_may_pull(rx->skb, hdr_len + 6))
++ goto drop_check;
++
++ mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len);
++ ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) +
++ sizeof(rfc1042_header);
++
++ if (skb_copy_bits(rx->skb, ethertype_offset, ðertype, 2) == 0 &&
++ ethertype == rx->sdata->control_port_protocol)
++ return 0;
++ }
++
++drop_check:
+ /* Drop unencrypted frames if key is set. */
+ if (unlikely(!ieee80211_has_protected(fc) &&
+ !ieee80211_is_any_nullfunc(fc) &&
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index 5acd99f83166..f6af13c16cf5 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -1717,6 +1717,8 @@ static int sync_thread_backup(void *data)
+ {
+ struct ip_vs_sync_thread_data *tinfo = data;
+ struct netns_ipvs *ipvs = tinfo->ipvs;
++ struct sock *sk = tinfo->sock->sk;
++ struct udp_sock *up = udp_sk(sk);
+ int len;
+
+ pr_info("sync thread started: state = BACKUP, mcast_ifn = %s, "
+@@ -1724,12 +1726,14 @@ static int sync_thread_backup(void *data)
+ ipvs->bcfg.mcast_ifn, ipvs->bcfg.syncid, tinfo->id);
+
+ while (!kthread_should_stop()) {
+- wait_event_interruptible(*sk_sleep(tinfo->sock->sk),
+- !skb_queue_empty(&tinfo->sock->sk->sk_receive_queue)
+- || kthread_should_stop());
++ wait_event_interruptible(*sk_sleep(sk),
++ !skb_queue_empty_lockless(&sk->sk_receive_queue) ||
++ !skb_queue_empty_lockless(&up->reader_queue) ||
++ kthread_should_stop());
+
+ /* do we have data now? */
+- while (!skb_queue_empty(&(tinfo->sock->sk->sk_receive_queue))) {
++ while (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
++ !skb_queue_empty_lockless(&up->reader_queue)) {
+ len = ip_vs_receive(tinfo->sock, tinfo->buf,
+ ipvs->bcfg.sync_maxlen);
+ if (len <= 0) {
+diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
+index d8026543bf4c..68107bf92c7e 100644
+--- a/net/tipc/bcast.c
++++ b/net/tipc/bcast.c
+@@ -181,7 +181,7 @@ static void tipc_bcbase_xmit(struct net *net, struct sk_buff_head *xmitq)
+ }
+
+ /* We have to transmit across all bearers */
+- skb_queue_head_init(&_xmitq);
++ __skb_queue_head_init(&_xmitq);
+ for (bearer_id = 0; bearer_id < MAX_BEARERS; bearer_id++) {
+ if (!bb->dests[bearer_id])
+ continue;
+@@ -237,7 +237,7 @@ static int tipc_bcast_xmit(struct net *net, struct sk_buff_head *pkts,
+ struct sk_buff_head xmitq;
+ int rc = 0;
+
+- skb_queue_head_init(&xmitq);
++ __skb_queue_head_init(&xmitq);
+ tipc_bcast_lock(net);
+ if (tipc_link_bc_peers(l))
+ rc = tipc_link_xmit(l, pkts, &xmitq);
+@@ -267,7 +267,7 @@ static int tipc_rcast_xmit(struct net *net, struct sk_buff_head *pkts,
+ u32 dnode, selector;
+
+ selector = msg_link_selector(buf_msg(skb_peek(pkts)));
+- skb_queue_head_init(&_pkts);
++ __skb_queue_head_init(&_pkts);
+
+ list_for_each_entry_safe(dst, tmp, &dests->list, list) {
+ dnode = dst->node;
+@@ -299,7 +299,7 @@ int tipc_mcast_xmit(struct net *net, struct sk_buff_head *pkts,
+ int rc = 0;
+
+ skb_queue_head_init(&inputq);
+- skb_queue_head_init(&localq);
++ __skb_queue_head_init(&localq);
+
+ /* Clone packets before they are consumed by next call */
+ if (dests->local && !tipc_msg_reassemble(pkts, &localq)) {
+diff --git a/net/tipc/group.c b/net/tipc/group.c
+index 3ee93b5c19b6..9a9138de4eca 100644
+--- a/net/tipc/group.c
++++ b/net/tipc/group.c
+@@ -199,7 +199,7 @@ void tipc_group_join(struct net *net, struct tipc_group *grp, int *sk_rcvbuf)
+ struct tipc_member *m, *tmp;
+ struct sk_buff_head xmitq;
+
+- skb_queue_head_init(&xmitq);
++ __skb_queue_head_init(&xmitq);
+ rbtree_postorder_for_each_entry_safe(m, tmp, tree, tree_node) {
+ tipc_group_proto_xmit(grp, m, GRP_JOIN_MSG, &xmitq);
+ tipc_group_update_member(m, 0);
+@@ -435,7 +435,7 @@ bool tipc_group_cong(struct tipc_group *grp, u32 dnode, u32 dport,
+ return true;
+ if (state == MBR_PENDING && adv == ADV_IDLE)
+ return true;
+- skb_queue_head_init(&xmitq);
++ __skb_queue_head_init(&xmitq);
+ tipc_group_proto_xmit(grp, m, GRP_ADV_MSG, &xmitq);
+ tipc_node_distr_xmit(grp->net, &xmitq);
+ return true;
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index cc9a0485536b..f756b721f93e 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -928,7 +928,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
+ int rc = 0;
+
+ if (unlikely(msg_size(hdr) > mtu)) {
+- skb_queue_purge(list);
++ __skb_queue_purge(list);
+ return -EMSGSIZE;
+ }
+
+@@ -957,7 +957,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
+ if (likely(skb_queue_len(transmq) < maxwin)) {
+ _skb = skb_clone(skb, GFP_ATOMIC);
+ if (!_skb) {
+- skb_queue_purge(list);
++ __skb_queue_purge(list);
+ return -ENOBUFS;
+ }
+ __skb_dequeue(list);
+@@ -1429,7 +1429,7 @@ void tipc_link_create_dummy_tnl_msg(struct tipc_link *l,
+ struct sk_buff *skb;
+ u32 dnode = l->addr;
+
+- skb_queue_head_init(&tnlq);
++ __skb_queue_head_init(&tnlq);
+ skb = tipc_msg_create(TUNNEL_PROTOCOL, FAILOVER_MSG,
+ INT_H_SIZE, BASIC_H_SIZE,
+ dnode, onode, 0, 0, 0);
+@@ -1465,8 +1465,8 @@ void tipc_link_tnl_prepare(struct tipc_link *l, struct tipc_link *tnl,
+ if (!tnl)
+ return;
+
+- skb_queue_head_init(&tnlq);
+- skb_queue_head_init(&tmpxq);
++ __skb_queue_head_init(&tnlq);
++ __skb_queue_head_init(&tmpxq);
+
+ /* At least one packet required for safe algorithm => add dummy */
+ skb = tipc_msg_create(TIPC_LOW_IMPORTANCE, TIPC_DIRECT_MSG,
+@@ -1476,7 +1476,7 @@ void tipc_link_tnl_prepare(struct tipc_link *l, struct tipc_link *tnl,
+ pr_warn("%sunable to create tunnel packet\n", link_co_err);
+ return;
+ }
+- skb_queue_tail(&tnlq, skb);
++ __skb_queue_tail(&tnlq, skb);
+ tipc_link_xmit(l, &tnlq, &tmpxq);
+ __skb_queue_purge(&tmpxq);
+
+diff --git a/net/tipc/node.c b/net/tipc/node.c
+index e67ffd194927..a188c2590137 100644
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -1368,13 +1368,14 @@ int tipc_node_xmit(struct net *net, struct sk_buff_head *list,
+ int rc;
+
+ if (in_own_node(net, dnode)) {
++ spin_lock_init(&list->lock);
+ tipc_sk_rcv(net, list);
+ return 0;
+ }
+
+ n = tipc_node_find(net, dnode);
+ if (unlikely(!n)) {
+- skb_queue_purge(list);
++ __skb_queue_purge(list);
+ return -EHOSTUNREACH;
+ }
+
+@@ -1383,7 +1384,7 @@ int tipc_node_xmit(struct net *net, struct sk_buff_head *list,
+ if (unlikely(bearer_id == INVALID_BEARER_ID)) {
+ tipc_node_read_unlock(n);
+ tipc_node_put(n);
+- skb_queue_purge(list);
++ __skb_queue_purge(list);
+ return -EHOSTUNREACH;
+ }
+
+@@ -1415,7 +1416,7 @@ int tipc_node_xmit_skb(struct net *net, struct sk_buff *skb, u32 dnode,
+ {
+ struct sk_buff_head head;
+
+- skb_queue_head_init(&head);
++ __skb_queue_head_init(&head);
+ __skb_queue_tail(&head, skb);
+ tipc_node_xmit(net, &head, dnode, selector);
+ return 0;
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 40947ad90222..f0184a5e83aa 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -800,7 +800,7 @@ static int tipc_sendmcast(struct socket *sock, struct tipc_name_seq *seq,
+ msg_set_nameupper(hdr, seq->upper);
+
+ /* Build message as chain of buffers */
+- skb_queue_head_init(&pkts);
++ __skb_queue_head_init(&pkts);
+ rc = tipc_msg_build(hdr, msg, 0, dlen, mtu, &pkts);
+
+ /* Send message if build was successful */
+@@ -841,7 +841,7 @@ static int tipc_send_group_msg(struct net *net, struct tipc_sock *tsk,
+ msg_set_grp_bc_seqno(hdr, bc_snd_nxt);
+
+ /* Build message as chain of buffers */
+- skb_queue_head_init(&pkts);
++ __skb_queue_head_init(&pkts);
+ mtu = tipc_node_get_mtu(net, dnode, tsk->portid);
+ rc = tipc_msg_build(hdr, m, 0, dlen, mtu, &pkts);
+ if (unlikely(rc != dlen))
+@@ -1046,7 +1046,7 @@ static int tipc_send_group_bcast(struct socket *sock, struct msghdr *m,
+ msg_set_grp_bc_ack_req(hdr, ack);
+
+ /* Build message as chain of buffers */
+- skb_queue_head_init(&pkts);
++ __skb_queue_head_init(&pkts);
+ rc = tipc_msg_build(hdr, m, 0, dlen, mtu, &pkts);
+ if (unlikely(rc != dlen))
+ return rc;
+@@ -1372,7 +1372,7 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen)
+ if (unlikely(rc))
+ return rc;
+
+- skb_queue_head_init(&pkts);
++ __skb_queue_head_init(&pkts);
+ mtu = tipc_node_get_mtu(net, dnode, tsk->portid);
+ rc = tipc_msg_build(hdr, m, 0, dlen, mtu, &pkts);
+ if (unlikely(rc != dlen))
+@@ -1427,7 +1427,7 @@ static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dlen)
+ int send, sent = 0;
+ int rc = 0;
+
+- skb_queue_head_init(&pkts);
++ __skb_queue_head_init(&pkts);
+
+ if (unlikely(dlen > INT_MAX))
+ return -EMSGSIZE;
+@@ -1782,7 +1782,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
+
+ /* Send group flow control advertisement when applicable */
+ if (tsk->group && msg_in_group(hdr) && !grp_evt) {
+- skb_queue_head_init(&xmitq);
++ __skb_queue_head_init(&xmitq);
+ tipc_group_update_rcv_win(tsk->group, tsk_blocks(hlen + dlen),
+ msg_orignode(hdr), msg_origport(hdr),
+ &xmitq);
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index 5aa75a0a1ced..946735bd5a25 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -77,8 +77,8 @@ parse_symbol() {
+ return
+ fi
+
+- # Strip out the base of the path
+- code=${code#$basepath/}
++ # Strip out the base of the path on each line
++ code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code")
+
+ # In the case of inlines, move everything to same line
+ code=${code//$'\n'/' '}
+diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
+index 4644f1a83b57..aa4f87e3ddb1 100644
+--- a/scripts/gdb/linux/symbols.py
++++ b/scripts/gdb/linux/symbols.py
+@@ -96,7 +96,7 @@ lx-symbols command."""
+ return ""
+ attrs = sect_attrs['attrs']
+ section_name_to_address = {
+- attrs[n]['name'].string(): attrs[n]['address']
++ attrs[n]['battr']['attr']['name'].string(): attrs[n]['address']
+ for n in range(int(sect_attrs['nsections']))}
+ args = []
+ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
+diff --git a/sound/core/info.c b/sound/core/info.c
+index 679136fba730..3fa8336794f8 100644
+--- a/sound/core/info.c
++++ b/sound/core/info.c
+@@ -634,7 +634,9 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len)
+ {
+ int c = -1;
+
+- if (snd_BUG_ON(!buffer || !buffer->buffer))
++ if (snd_BUG_ON(!buffer))
++ return 1;
++ if (!buffer->buffer)
+ return 1;
+ if (len <= 0 || buffer->stop || buffer->error)
+ return 1;
+diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
+index 732ef928b25d..6a2a58e107e3 100644
+--- a/sound/soc/codecs/rt5670.c
++++ b/sound/soc/codecs/rt5670.c
+@@ -34,18 +34,19 @@
+ #include "rt5670.h"
+ #include "rt5670-dsp.h"
+
+-#define RT5670_DEV_GPIO BIT(0)
+-#define RT5670_IN2_DIFF BIT(1)
+-#define RT5670_DMIC_EN BIT(2)
+-#define RT5670_DMIC1_IN2P BIT(3)
+-#define RT5670_DMIC1_GPIO6 BIT(4)
+-#define RT5670_DMIC1_GPIO7 BIT(5)
+-#define RT5670_DMIC2_INR BIT(6)
+-#define RT5670_DMIC2_GPIO8 BIT(7)
+-#define RT5670_DMIC3_GPIO5 BIT(8)
+-#define RT5670_JD_MODE1 BIT(9)
+-#define RT5670_JD_MODE2 BIT(10)
+-#define RT5670_JD_MODE3 BIT(11)
++#define RT5670_DEV_GPIO BIT(0)
++#define RT5670_IN2_DIFF BIT(1)
++#define RT5670_DMIC_EN BIT(2)
++#define RT5670_DMIC1_IN2P BIT(3)
++#define RT5670_DMIC1_GPIO6 BIT(4)
++#define RT5670_DMIC1_GPIO7 BIT(5)
++#define RT5670_DMIC2_INR BIT(6)
++#define RT5670_DMIC2_GPIO8 BIT(7)
++#define RT5670_DMIC3_GPIO5 BIT(8)
++#define RT5670_JD_MODE1 BIT(9)
++#define RT5670_JD_MODE2 BIT(10)
++#define RT5670_JD_MODE3 BIT(11)
++#define RT5670_GPIO1_IS_EXT_SPK_EN BIT(12)
+
+ static unsigned long rt5670_quirk;
+ static unsigned int quirk_override;
+@@ -1504,6 +1505,33 @@ static int rt5670_hp_event(struct snd_soc_dapm_widget *w,
+ return 0;
+ }
+
++static int rt5670_spk_event(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
++{
++ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
++ struct rt5670_priv *rt5670 = snd_soc_component_get_drvdata(component);
++
++ if (!rt5670->pdata.gpio1_is_ext_spk_en)
++ return 0;
++
++ switch (event) {
++ case SND_SOC_DAPM_POST_PMU:
++ regmap_update_bits(rt5670->regmap, RT5670_GPIO_CTRL2,
++ RT5670_GP1_OUT_MASK, RT5670_GP1_OUT_HI);
++ break;
++
++ case SND_SOC_DAPM_PRE_PMD:
++ regmap_update_bits(rt5670->regmap, RT5670_GPIO_CTRL2,
++ RT5670_GP1_OUT_MASK, RT5670_GP1_OUT_LO);
++ break;
++
++ default:
++ return 0;
++ }
++
++ return 0;
++}
++
+ static int rt5670_bst1_event(struct snd_soc_dapm_widget *w,
+ struct snd_kcontrol *kcontrol, int event)
+ {
+@@ -1917,7 +1945,9 @@ static const struct snd_soc_dapm_widget rt5670_specific_dapm_widgets[] = {
+ };
+
+ static const struct snd_soc_dapm_widget rt5672_specific_dapm_widgets[] = {
+- SND_SOC_DAPM_PGA("SPO Amp", SND_SOC_NOPM, 0, 0, NULL, 0),
++ SND_SOC_DAPM_PGA_E("SPO Amp", SND_SOC_NOPM, 0, 0, NULL, 0,
++ rt5670_spk_event, SND_SOC_DAPM_PRE_PMD |
++ SND_SOC_DAPM_POST_PMU),
+ SND_SOC_DAPM_OUTPUT("SPOLP"),
+ SND_SOC_DAPM_OUTPUT("SPOLN"),
+ SND_SOC_DAPM_OUTPUT("SPORP"),
+@@ -2901,14 +2931,14 @@ static const struct dmi_system_id dmi_platform_intel_quirks[] = {
+ },
+ {
+ .callback = rt5670_quirk_cb,
+- .ident = "Lenovo Thinkpad Tablet 10",
++ .ident = "Lenovo Miix 2 10",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Miix 2 10"),
+ },
+ .driver_data = (unsigned long *)(RT5670_DMIC_EN |
+ RT5670_DMIC1_IN2P |
+- RT5670_DEV_GPIO |
++ RT5670_GPIO1_IS_EXT_SPK_EN |
+ RT5670_JD_MODE2),
+ },
+ {
+@@ -2956,6 +2986,10 @@ static int rt5670_i2c_probe(struct i2c_client *i2c,
+ rt5670->pdata.dev_gpio = true;
+ dev_info(&i2c->dev, "quirk dev_gpio\n");
+ }
++ if (rt5670_quirk & RT5670_GPIO1_IS_EXT_SPK_EN) {
++ rt5670->pdata.gpio1_is_ext_spk_en = true;
++ dev_info(&i2c->dev, "quirk GPIO1 is external speaker enable\n");
++ }
+ if (rt5670_quirk & RT5670_IN2_DIFF) {
+ rt5670->pdata.in2_diff = true;
+ dev_info(&i2c->dev, "quirk IN2_DIFF\n");
+@@ -3055,6 +3089,13 @@ static int rt5670_i2c_probe(struct i2c_client *i2c,
+ RT5670_GP1_PF_MASK, RT5670_GP1_PF_OUT);
+ }
+
++ if (rt5670->pdata.gpio1_is_ext_spk_en) {
++ regmap_update_bits(rt5670->regmap, RT5670_GPIO_CTRL1,
++ RT5670_GP1_PIN_MASK, RT5670_GP1_PIN_GPIO1);
++ regmap_update_bits(rt5670->regmap, RT5670_GPIO_CTRL2,
++ RT5670_GP1_PF_MASK, RT5670_GP1_PF_OUT);
++ }
++
+ if (rt5670->pdata.jd_mode) {
+ regmap_update_bits(rt5670->regmap, RT5670_GLB_CLK,
+ RT5670_SCLK_SRC_MASK, RT5670_SCLK_SRC_RCCLK);
+diff --git a/sound/soc/codecs/rt5670.h b/sound/soc/codecs/rt5670.h
+index 97e8eebe63fa..563edd60fd04 100644
+--- a/sound/soc/codecs/rt5670.h
++++ b/sound/soc/codecs/rt5670.h
+@@ -760,7 +760,7 @@
+ #define RT5670_PWR_VREF2_BIT 4
+ #define RT5670_PWR_FV2 (0x1 << 3)
+ #define RT5670_PWR_FV2_BIT 3
+-#define RT5670_LDO_SEL_MASK (0x3)
++#define RT5670_LDO_SEL_MASK (0x7)
+ #define RT5670_LDO_SEL_SFT 0
+
+ /* Power Management for Analog 2 (0x64) */
+diff --git a/sound/soc/qcom/Kconfig b/sound/soc/qcom/Kconfig
+index 2a4c912d1e48..57941413de8b 100644
+--- a/sound/soc/qcom/Kconfig
++++ b/sound/soc/qcom/Kconfig
+@@ -70,7 +70,7 @@ config SND_SOC_QDSP6_ASM_DAI
+
+ config SND_SOC_QDSP6
+ tristate "SoC ALSA audio driver for QDSP6"
+- depends on QCOM_APR && HAS_DMA
++ depends on QCOM_APR
+ select SND_SOC_QDSP6_COMMON
+ select SND_SOC_QDSP6_CORE
+ select SND_SOC_QDSP6_AFE
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-07-31 18:00 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-07-31 18:00 UTC (permalink / raw
To: gentoo-commits
commit: 4be1d21e5760af6acabcd96eb6f872b1e6ceb10e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jul 31 18:00:16 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jul 31 18:00:16 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4be1d21e
Linux patch 4.19.136
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1135_linux-4.19.136.patch | 507 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 511 insertions(+)
diff --git a/0000_README b/0000_README
index ea4b4c9..b50ea6d 100644
--- a/0000_README
+++ b/0000_README
@@ -579,6 +579,10 @@ Patch: 1134_linux-4.19.135.patch
From: https://www.kernel.org
Desc: Linux 4.19.135
+Patch: 1135_linux-4.19.136.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.136
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1135_linux-4.19.136.patch b/1135_linux-4.19.136.patch
new file mode 100644
index 0000000..3e3d251
--- /dev/null
+++ b/1135_linux-4.19.136.patch
@@ -0,0 +1,507 @@
+diff --git a/Makefile b/Makefile
+index 1253143f3f6f..a76c159bb605 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 135
++SUBLEVEL = 136
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index 056e34ce1edd..182b1908edec 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -209,6 +209,9 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from,
+ if (*ppos < 0 || !count)
+ return -EINVAL;
+
++ if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
++ count = PAGE_SIZE << (MAX_ORDER - 1);
++
+ buf = kmalloc(count, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+@@ -357,6 +360,9 @@ static ssize_t regmap_reg_ranges_read_file(struct file *file,
+ if (*ppos < 0 || !count)
+ return -EINVAL;
+
++ if (count > (PAGE_SIZE << (MAX_ORDER - 1)))
++ count = PAGE_SIZE << (MAX_ORDER - 1);
++
+ buf = kmalloc(count, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
+index 4f25c2d8fff0..6fe9695a5f18 100644
+--- a/drivers/net/wan/x25_asy.c
++++ b/drivers/net/wan/x25_asy.c
+@@ -183,7 +183,7 @@ static inline void x25_asy_unlock(struct x25_asy *sl)
+ netif_wake_queue(sl->dev);
+ }
+
+-/* Send one completely decapsulated IP datagram to the IP layer. */
++/* Send an LAPB frame to the LAPB module to process. */
+
+ static void x25_asy_bump(struct x25_asy *sl)
+ {
+@@ -195,13 +195,12 @@ static void x25_asy_bump(struct x25_asy *sl)
+ count = sl->rcount;
+ dev->stats.rx_bytes += count;
+
+- skb = dev_alloc_skb(count+1);
++ skb = dev_alloc_skb(count);
+ if (skb == NULL) {
+ netdev_warn(sl->dev, "memory squeeze, dropping packet\n");
+ dev->stats.rx_dropped++;
+ return;
+ }
+- skb_push(skb, 1); /* LAPB internal control */
+ skb_put_data(skb, sl->rbuff, count);
+ skb->protocol = x25_type_trans(skb, sl->dev);
+ err = lapb_data_received(skb->dev, skb);
+@@ -209,7 +208,6 @@ static void x25_asy_bump(struct x25_asy *sl)
+ kfree_skb(skb);
+ printk(KERN_DEBUG "x25_asy: data received err - %d\n", err);
+ } else {
+- netif_rx(skb);
+ dev->stats.rx_packets++;
+ }
+ }
+@@ -356,12 +354,21 @@ static netdev_tx_t x25_asy_xmit(struct sk_buff *skb,
+ */
+
+ /*
+- * Called when I frame data arrives. We did the work above - throw it
+- * at the net layer.
++ * Called when I frame data arrive. We add a pseudo header for upper
++ * layers and pass it to upper layers.
+ */
+
+ static int x25_asy_data_indication(struct net_device *dev, struct sk_buff *skb)
+ {
++ if (skb_cow(skb, 1)) {
++ kfree_skb(skb);
++ return NET_RX_DROP;
++ }
++ skb_push(skb, 1);
++ skb->data[0] = X25_IFACE_DATA;
++
++ skb->protocol = x25_type_trans(skb, dev);
++
+ return netif_rx(skb);
+ }
+
+@@ -657,7 +664,7 @@ static void x25_asy_unesc(struct x25_asy *sl, unsigned char s)
+ switch (s) {
+ case X25_END:
+ if (!test_and_clear_bit(SLF_ERROR, &sl->flags) &&
+- sl->rcount > 2)
++ sl->rcount >= 2)
+ x25_asy_bump(sl);
+ clear_bit(SLF_ESCAPE, &sl->flags);
+ sl->rcount = 0;
+diff --git a/include/linux/tcp.h b/include/linux/tcp.h
+index 4374196b98ea..1192f1e76015 100644
+--- a/include/linux/tcp.h
++++ b/include/linux/tcp.h
+@@ -225,6 +225,8 @@ struct tcp_sock {
+ } rack;
+ u16 advmss; /* Advertised MSS */
+ u8 compressed_ack;
++ u8 tlp_retrans:1, /* TLP is a retransmission */
++ unused_1:7;
+ u32 chrono_start; /* Start time in jiffies of a TCP chrono */
+ u32 chrono_stat[3]; /* Time in jiffies for chrono_stat stats */
+ u8 chrono_type:2, /* current chronograph type */
+@@ -247,7 +249,7 @@ struct tcp_sock {
+ save_syn:1, /* Save headers of SYN packet */
+ is_cwnd_limited:1,/* forward progress limited by snd_cwnd? */
+ syn_smc:1; /* SYN includes SMC */
+- u32 tlp_high_seq; /* snd_nxt at the time of TLP retransmit. */
++ u32 tlp_high_seq; /* snd_nxt at the time of TLP */
+
+ /* RTT measurement */
+ u64 tcp_mstamp; /* most recent packet received/sent */
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index 5c7a513bbaaa..a45db78eaf00 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -1190,7 +1190,10 @@ static int __must_check ax25_connect(struct socket *sock,
+ if (addr_len > sizeof(struct sockaddr_ax25) &&
+ fsa->fsa_ax25.sax25_ndigis != 0) {
+ /* Valid number of digipeaters ? */
+- if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) {
++ if (fsa->fsa_ax25.sax25_ndigis < 1 ||
++ fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS ||
++ addr_len < sizeof(struct sockaddr_ax25) +
++ sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) {
+ err = -EINVAL;
+ goto out_release;
+ }
+@@ -1510,7 +1513,10 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax;
+
+ /* Valid number of digipeaters ? */
+- if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) {
++ if (usax->sax25_ndigis < 1 ||
++ usax->sax25_ndigis > AX25_MAX_DIGIS ||
++ addr_len < sizeof(struct sockaddr_ax25) +
++ sizeof(ax25_address) * usax->sax25_ndigis) {
+ err = -EINVAL;
+ goto out;
+ }
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 4b1053057ca6..42ba150fa18d 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5252,7 +5252,7 @@ static void flush_backlog(struct work_struct *work)
+ skb_queue_walk_safe(&sd->input_pkt_queue, skb, tmp) {
+ if (skb->dev->reg_state == NETREG_UNREGISTERING) {
+ __skb_unlink(skb, &sd->input_pkt_queue);
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ input_queue_head_incr(sd);
+ }
+ }
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index 7614a4f42bfc..001d7f07e780 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1045,7 +1045,7 @@ static ssize_t tx_timeout_show(struct netdev_queue *queue, char *buf)
+ trans_timeout = queue->trans_timeout;
+ spin_unlock_irq(&queue->_xmit_lock);
+
+- return sprintf(buf, "%lu", trans_timeout);
++ return sprintf(buf, fmt_ulong, trans_timeout);
+ }
+
+ static unsigned int get_netdev_queue_index(struct netdev_queue *queue)
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index f51973f458e4..935053ee7765 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -3146,7 +3146,8 @@ replay:
+ */
+ if (err < 0) {
+ /* If device is not registered at all, free it now */
+- if (dev->reg_state == NETREG_UNINITIALIZED)
++ if (dev->reg_state == NETREG_UNINITIALIZED ||
++ dev->reg_state == NETREG_UNREGISTERED)
+ free_netdev(dev);
+ goto out;
+ }
+diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
+index fd38cf1d2b02..9c85ef2b7e1d 100644
+--- a/net/core/sock_reuseport.c
++++ b/net/core/sock_reuseport.c
+@@ -112,6 +112,7 @@ static struct sock_reuseport *reuseport_grow(struct sock_reuseport *reuse)
+ more_reuse->prog = reuse->prog;
+ more_reuse->reuseport_id = reuse->reuseport_id;
+ more_reuse->bind_inany = reuse->bind_inany;
++ more_reuse->has_conns = reuse->has_conns;
+
+ memcpy(more_reuse->socks, reuse->socks,
+ reuse->num_socks * sizeof(struct sock *));
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 2896840618fa..9813d62de631 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3489,10 +3489,8 @@ static void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq)
+ }
+ }
+
+-/* This routine deals with acks during a TLP episode.
+- * We mark the end of a TLP episode on receiving TLP dupack or when
+- * ack is after tlp_high_seq.
+- * Ref: loss detection algorithm in draft-dukkipati-tcpm-tcp-loss-probe.
++/* This routine deals with acks during a TLP episode and ends an episode by
++ * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack
+ */
+ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
+ {
+@@ -3501,7 +3499,10 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
+ if (before(ack, tp->tlp_high_seq))
+ return;
+
+- if (flag & FLAG_DSACKING_ACK) {
++ if (!tp->tlp_retrans) {
++ /* TLP of new data has been acknowledged */
++ tp->tlp_high_seq = 0;
++ } else if (flag & FLAG_DSACKING_ACK) {
+ /* This DSACK means original and TLP probe arrived; no loss */
+ tp->tlp_high_seq = 0;
+ } else if (after(ack, tp->tlp_high_seq)) {
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index b4d0d0aa6b38..74fb211e0ea6 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2495,6 +2495,11 @@ void tcp_send_loss_probe(struct sock *sk)
+ int pcount;
+ int mss = tcp_current_mss(sk);
+
++ /* At most one outstanding TLP */
++ if (tp->tlp_high_seq)
++ goto rearm_timer;
++
++ tp->tlp_retrans = 0;
+ skb = tcp_send_head(sk);
+ if (skb && tcp_snd_wnd_test(tp, skb, mss)) {
+ pcount = tp->packets_out;
+@@ -2512,10 +2517,6 @@ void tcp_send_loss_probe(struct sock *sk)
+ return;
+ }
+
+- /* At most one outstanding TLP retransmission. */
+- if (tp->tlp_high_seq)
+- goto rearm_timer;
+-
+ if (skb_still_in_host_queue(sk, skb))
+ goto rearm_timer;
+
+@@ -2537,10 +2538,12 @@ void tcp_send_loss_probe(struct sock *sk)
+ if (__tcp_retransmit_skb(sk, skb, 1))
+ goto rearm_timer;
+
++ tp->tlp_retrans = 1;
++
++probe_sent:
+ /* Record snd_nxt for loss detection. */
+ tp->tlp_high_seq = tp->snd_nxt;
+
+-probe_sent:
+ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPLOSSPROBES);
+ /* Reset s.t. tcp_rearm_rto will restart timer from now */
+ inet_csk(sk)->icsk_pending = 0;
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 0ef04cda1b27..2aacf2b34834 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -433,7 +433,7 @@ static struct sock *udp4_lib_lookup2(struct net *net,
+ struct udp_hslot *hslot2,
+ struct sk_buff *skb)
+ {
+- struct sock *sk, *result;
++ struct sock *sk, *result, *reuseport_result;
+ int score, badness;
+ u32 hash = 0;
+
+@@ -443,17 +443,20 @@ static struct sock *udp4_lib_lookup2(struct net *net,
+ score = compute_score(sk, net, saddr, sport,
+ daddr, hnum, dif, sdif, exact_dif);
+ if (score > badness) {
++ reuseport_result = NULL;
++
+ if (sk->sk_reuseport &&
+ sk->sk_state != TCP_ESTABLISHED) {
+ hash = udp_ehashfn(net, daddr, hnum,
+ saddr, sport);
+- result = reuseport_select_sock(sk, hash, skb,
+- sizeof(struct udphdr));
+- if (result && !reuseport_has_conns(sk, false))
+- return result;
++ reuseport_result = reuseport_select_sock(sk, hash, skb,
++ sizeof(struct udphdr));
++ if (reuseport_result && !reuseport_has_conns(sk, false))
++ return reuseport_result;
+ }
++
++ result = reuseport_result ? : sk;
+ badness = score;
+- result = sk;
+ }
+ }
+ return result;
+@@ -1986,7 +1989,7 @@ static int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ /*
+ * UDP-Lite specific tests, ignored on UDP sockets
+ */
+- if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
++ if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
+
+ /*
+ * MIB statistics other than incrementing the error count are
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index f5144573c45c..7cc9cd83ecb5 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1580,17 +1580,18 @@ static void ip6gre_destroy_tunnels(struct net *net, struct list_head *head)
+ static int __net_init ip6gre_init_net(struct net *net)
+ {
+ struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
++ struct net_device *ndev;
+ int err;
+
+ if (!net_has_fallback_tunnels(net))
+ return 0;
+- ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
+- NET_NAME_UNKNOWN,
+- ip6gre_tunnel_setup);
+- if (!ign->fb_tunnel_dev) {
++ ndev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
++ NET_NAME_UNKNOWN, ip6gre_tunnel_setup);
++ if (!ndev) {
+ err = -ENOMEM;
+ goto err_alloc_dev;
+ }
++ ign->fb_tunnel_dev = ndev;
+ dev_net_set(ign->fb_tunnel_dev, net);
+ /* FB netdevice is special: we have one, and only one per netns.
+ * Allowing to move it to another netns is clearly unsafe.
+@@ -1610,7 +1611,7 @@ static int __net_init ip6gre_init_net(struct net *net)
+ return 0;
+
+ err_reg_dev:
+- free_netdev(ign->fb_tunnel_dev);
++ free_netdev(ndev);
+ err_alloc_dev:
+ return err;
+ }
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 1979922bcf67..6799ad462be3 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -167,7 +167,7 @@ static struct sock *udp6_lib_lookup2(struct net *net,
+ int dif, int sdif, bool exact_dif,
+ struct udp_hslot *hslot2, struct sk_buff *skb)
+ {
+- struct sock *sk, *result;
++ struct sock *sk, *result, *reuseport_result;
+ int score, badness;
+ u32 hash = 0;
+
+@@ -177,17 +177,20 @@ static struct sock *udp6_lib_lookup2(struct net *net,
+ score = compute_score(sk, net, saddr, sport,
+ daddr, hnum, dif, sdif, exact_dif);
+ if (score > badness) {
++ reuseport_result = NULL;
++
+ if (sk->sk_reuseport &&
+ sk->sk_state != TCP_ESTABLISHED) {
+ hash = udp6_ehashfn(net, daddr, hnum,
+ saddr, sport);
+
+- result = reuseport_select_sock(sk, hash, skb,
+- sizeof(struct udphdr));
+- if (result && !reuseport_has_conns(sk, false))
+- return result;
++ reuseport_result = reuseport_select_sock(sk, hash, skb,
++ sizeof(struct udphdr));
++ if (reuseport_result && !reuseport_has_conns(sk, false))
++ return reuseport_result;
+ }
+- result = sk;
++
++ result = reuseport_result ? : sk;
+ badness = score;
+ }
+ }
+@@ -606,7 +609,7 @@ static int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+ /*
+ * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c).
+ */
+- if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
++ if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
+
+ if (up->pcrlen == 0) { /* full coverage was set */
+ net_dbg_ratelimited("UDPLITE6: partial coverage %d while full coverage %d requested\n",
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 0baffc9666e6..b5671966fa03 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -1013,6 +1013,7 @@ static int qrtr_release(struct socket *sock)
+ sk->sk_state_change(sk);
+
+ sock_set_flag(sk, SOCK_DEAD);
++ sock_orphan(sk);
+ sock->sk = NULL;
+
+ if (!sock_flag(sk, SOCK_ZAPPED))
+diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
+index 0374b0623c8b..6e9d977f0797 100644
+--- a/net/rxrpc/recvmsg.c
++++ b/net/rxrpc/recvmsg.c
+@@ -453,7 +453,7 @@ try_again:
+ list_empty(&rx->recvmsg_q) &&
+ rx->sk.sk_state != RXRPC_SERVER_LISTENING) {
+ release_sock(&rx->sk);
+- return -ENODATA;
++ return -EAGAIN;
+ }
+
+ if (list_empty(&rx->recvmsg_q)) {
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index 250d3dae8af4..caee7632c257 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -278,7 +278,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
+ /* this should be in poll */
+ sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
+
+- if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
++ if (sk->sk_shutdown & SEND_SHUTDOWN)
+ return -EPIPE;
+
+ more = msg->msg_flags & MSG_MORE;
+diff --git a/net/sctp/stream.c b/net/sctp/stream.c
+index 87061a4bb44b..516bc48be5bc 100644
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -97,17 +97,11 @@ static size_t fa_index(struct flex_array *fa, void *elem, size_t count)
+ return index;
+ }
+
+-/* Migrates chunks from stream queues to new stream queues if needed,
+- * but not across associations. Also, removes those chunks to streams
+- * higher than the new max.
+- */
+-static void sctp_stream_outq_migrate(struct sctp_stream *stream,
+- struct sctp_stream *new, __u16 outcnt)
++static void sctp_stream_shrink_out(struct sctp_stream *stream, __u16 outcnt)
+ {
+ struct sctp_association *asoc;
+ struct sctp_chunk *ch, *temp;
+ struct sctp_outq *outq;
+- int i;
+
+ asoc = container_of(stream, struct sctp_association, stream);
+ outq = &asoc->outqueue;
+@@ -131,6 +125,19 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream,
+
+ sctp_chunk_free(ch);
+ }
++}
++
++/* Migrates chunks from stream queues to new stream queues if needed,
++ * but not across associations. Also, removes those chunks to streams
++ * higher than the new max.
++ */
++static void sctp_stream_outq_migrate(struct sctp_stream *stream,
++ struct sctp_stream *new, __u16 outcnt)
++{
++ int i;
++
++ if (stream->outcnt > outcnt)
++ sctp_stream_shrink_out(stream, outcnt);
+
+ if (new) {
+ /* Here we actually move the old ext stuff into the new
+@@ -1136,11 +1143,13 @@ struct sctp_chunk *sctp_process_strreset_resp(
+ nums = ntohs(addstrm->number_of_streams);
+ number = stream->outcnt - nums;
+
+- if (result == SCTP_STRRESET_PERFORMED)
++ if (result == SCTP_STRRESET_PERFORMED) {
+ for (i = number; i < stream->outcnt; i++)
+ SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN;
+- else
++ } else {
++ sctp_stream_shrink_out(stream, number);
+ stream->outcnt = number;
++ }
+
+ *evp = sctp_ulpevent_make_stream_change_event(asoc, flags,
+ 0, nums, GFP_ATOMIC);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-08-05 14:51 Thomas Deutschmann
0 siblings, 0 replies; 332+ messages in thread
From: Thomas Deutschmann @ 2020-08-05 14:51 UTC (permalink / raw
To: gentoo-commits
commit: 0d53102c63ad653cc05e1f84cfa532b49dc52ac3
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 5 14:51:33 2020 +0000
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Wed Aug 5 14:51:33 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0d53102c
Linux patch 4.19.137
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>
0000_README | 4 +
1136_linux-4.19.137.patch | 1486 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1490 insertions(+)
diff --git a/0000_README b/0000_README
index b50ea6d..d6fa27c 100644
--- a/0000_README
+++ b/0000_README
@@ -583,6 +583,10 @@ Patch: 1135_linux-4.19.136.patch
From: https://www.kernel.org
Desc: Linux 4.19.136
+Patch: 1136_linux-4.19.137.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.137
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1136_linux-4.19.137.patch b/1136_linux-4.19.137.patch
new file mode 100644
index 0000000..6f2e949
--- /dev/null
+++ b/1136_linux-4.19.137.patch
@@ -0,0 +1,1486 @@
+diff --git a/Makefile b/Makefile
+index a76c159bb605..edf1799c08d2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 136
++SUBLEVEL = 137
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
+index 1d5fbf1d1c67..8a8470d36c65 100644
+--- a/arch/arm/kernel/hw_breakpoint.c
++++ b/arch/arm/kernel/hw_breakpoint.c
+@@ -688,6 +688,12 @@ static void disable_single_step(struct perf_event *bp)
+ arch_install_hw_breakpoint(bp);
+ }
+
++static int watchpoint_fault_on_uaccess(struct pt_regs *regs,
++ struct arch_hw_breakpoint *info)
++{
++ return !user_mode(regs) && info->ctrl.privilege == ARM_BREAKPOINT_USER;
++}
++
+ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
+ struct pt_regs *regs)
+ {
+@@ -747,16 +753,27 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
+ }
+
+ pr_debug("watchpoint fired: address = 0x%x\n", info->trigger);
++
++ /*
++ * If we triggered a user watchpoint from a uaccess routine,
++ * then handle the stepping ourselves since userspace really
++ * can't help us with this.
++ */
++ if (watchpoint_fault_on_uaccess(regs, info))
++ goto step;
++
+ perf_bp_event(wp, regs);
+
+ /*
+- * If no overflow handler is present, insert a temporary
+- * mismatch breakpoint so we can single-step over the
+- * watchpoint trigger.
++ * Defer stepping to the overflow handler if one is installed.
++ * Otherwise, insert a temporary mismatch breakpoint so that
++ * we can single-step over the watchpoint trigger.
+ */
+- if (is_default_overflow_handler(wp))
+- enable_single_step(wp, instruction_pointer(regs));
++ if (!is_default_overflow_handler(wp))
++ goto unlock;
+
++step:
++ enable_single_step(wp, instruction_pointer(regs));
+ unlock:
+ rcu_read_unlock();
+ }
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+index 849d891c60a8..844f05b23115 100644
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -77,9 +77,9 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ "663:\n\t" \
+ newinstr "\n" \
+ "664:\n\t" \
+- ".previous\n\t" \
+ ".org . - (664b-663b) + (662b-661b)\n\t" \
+- ".org . - (662b-661b) + (664b-663b)\n" \
++ ".org . - (662b-661b) + (664b-663b)\n\t" \
++ ".previous\n" \
+ ".endif\n"
+
+ #define __ALTERNATIVE_CFG_CB(oldinstr, feature, cfg_enabled, cb) \
+diff --git a/arch/arm64/include/asm/checksum.h b/arch/arm64/include/asm/checksum.h
+index 0b6f5a7d4027..fd11e0d70e44 100644
+--- a/arch/arm64/include/asm/checksum.h
++++ b/arch/arm64/include/asm/checksum.h
+@@ -30,16 +30,17 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl)
+ {
+ __uint128_t tmp;
+ u64 sum;
++ int n = ihl; /* we want it signed */
+
+ tmp = *(const __uint128_t *)iph;
+ iph += 16;
+- ihl -= 4;
++ n -= 4;
+ tmp += ((tmp >> 64) | (tmp << 64));
+ sum = tmp >> 64;
+ do {
+ sum += *(const u32 *)iph;
+ iph += 4;
+- } while (--ihl);
++ } while (--n > 0);
+
+ sum += ((sum >> 32) | (sum << 32));
+ return csum_fold((__force u32)(sum >> 32));
+diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h
+index ab5c215cf46c..068958575871 100644
+--- a/arch/parisc/include/asm/cmpxchg.h
++++ b/arch/parisc/include/asm/cmpxchg.h
+@@ -60,6 +60,7 @@ extern void __cmpxchg_called_with_bad_pointer(void);
+ extern unsigned long __cmpxchg_u32(volatile unsigned int *m, unsigned int old,
+ unsigned int new_);
+ extern u64 __cmpxchg_u64(volatile u64 *ptr, u64 old, u64 new_);
++extern u8 __cmpxchg_u8(volatile u8 *ptr, u8 old, u8 new_);
+
+ /* don't worry...optimizer will get rid of most of this */
+ static inline unsigned long
+@@ -71,6 +72,7 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new_, int size)
+ #endif
+ case 4: return __cmpxchg_u32((unsigned int *)ptr,
+ (unsigned int)old, (unsigned int)new_);
++ case 1: return __cmpxchg_u8((u8 *)ptr, (u8)old, (u8)new_);
+ }
+ __cmpxchg_called_with_bad_pointer();
+ return old;
+diff --git a/arch/parisc/lib/bitops.c b/arch/parisc/lib/bitops.c
+index 70ffbcf889b8..2e4d1f05a926 100644
+--- a/arch/parisc/lib/bitops.c
++++ b/arch/parisc/lib/bitops.c
+@@ -79,3 +79,15 @@ unsigned long __cmpxchg_u32(volatile unsigned int *ptr, unsigned int old, unsign
+ _atomic_spin_unlock_irqrestore(ptr, flags);
+ return (unsigned long)prev;
+ }
++
++u8 __cmpxchg_u8(volatile u8 *ptr, u8 old, u8 new)
++{
++ unsigned long flags;
++ u8 prev;
++
++ _atomic_spin_lock_irqsave(ptr, flags);
++ if ((prev = *ptr) == old)
++ *ptr = new;
++ _atomic_spin_unlock_irqrestore(ptr, flags);
++ return prev;
++}
+diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
+index 28cc61216b64..ed5b758c650d 100644
+--- a/arch/sh/kernel/entry-common.S
++++ b/arch/sh/kernel/entry-common.S
+@@ -203,7 +203,7 @@ syscall_trace_entry:
+ mov.l @(OFF_R7,r15), r7 ! arg3
+ mov.l @(OFF_R3,r15), r3 ! syscall_nr
+ !
+- mov.l 2f, r10 ! Number of syscalls
++ mov.l 6f, r10 ! Number of syscalls
+ cmp/hs r10, r3
+ bf syscall_call
+ mov #-ENOSYS, r0
+@@ -357,7 +357,7 @@ ENTRY(system_call)
+ tst r9, r8
+ bf syscall_trace_entry
+ !
+- mov.l 2f, r8 ! Number of syscalls
++ mov.l 6f, r8 ! Number of syscalls
+ cmp/hs r8, r3
+ bt syscall_badsys
+ !
+@@ -396,7 +396,7 @@ syscall_exit:
+ #if !defined(CONFIG_CPU_SH2)
+ 1: .long TRA
+ #endif
+-2: .long NR_syscalls
++6: .long NR_syscalls
+ 3: .long sys_call_table
+ 7: .long do_syscall_trace_enter
+ 8: .long do_syscall_trace_leave
+diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
+index 519649ddf100..fe522691ac71 100644
+--- a/arch/x86/kernel/i8259.c
++++ b/arch/x86/kernel/i8259.c
+@@ -207,7 +207,7 @@ spurious_8259A_irq:
+ * lets ACK and report it. [once per IRQ]
+ */
+ if (!(spurious_irq_mask & irqmask)) {
+- printk(KERN_DEBUG
++ printk_deferred(KERN_DEBUG
+ "spurious 8259A interrupt: IRQ%d.\n", irq);
+ spurious_irq_mask |= irqmask;
+ }
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 2701b370e58f..1d264ba1e56d 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -420,8 +420,11 @@ bool unwind_next_frame(struct unwind_state *state)
+ /*
+ * Find the orc_entry associated with the text address.
+ *
+- * Decrement call return addresses by one so they work for sibling
+- * calls and calls to noreturn functions.
++ * For a call frame (as opposed to a signal frame), state->ip points to
++ * the instruction after the call. That instruction's stack layout
++ * could be different from the call instruction's layout, for example
++ * if the call was to a noreturn function. So get the ORC data for the
++ * call instruction itself.
+ */
+ orc = orc_find(state->signal ? state->ip : state->ip - 1);
+ if (!orc)
+@@ -634,6 +637,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ state->sp = task->thread.sp;
+ state->bp = READ_ONCE_NOCHECK(frame->bp);
+ state->ip = READ_ONCE_NOCHECK(frame->ret_addr);
++ state->signal = (void *)state->ip == ret_from_fork;
+ }
+
+ if (get_stack_info((unsigned long *)state->sp, state->task,
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 8c6392534d14..bba2f76c356d 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2034,7 +2034,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data)
+ {
+ struct kvm_lapic *apic = vcpu->arch.apic;
+
+- if (!lapic_in_kernel(vcpu) || apic_lvtt_oneshot(apic) ||
++ if (!kvm_apic_present(vcpu) || apic_lvtt_oneshot(apic) ||
+ apic_lvtt_period(apic))
+ return;
+
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 330853a2702f..43b74cf0787e 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -1783,8 +1783,9 @@ ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ LSB_ITEM_SIZE);
+ break;
+ default:
++ kfree(hmac_buf);
+ ret = -EINVAL;
+- goto e_ctx;
++ goto e_data;
+ }
+
+ memset(&hmac_cmd, 0, sizeof(hmac_cmd));
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+index 71efcf38f11b..94cd8a261091 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+@@ -276,7 +276,7 @@ static int acp_hw_init(void *handle)
+ u32 val = 0;
+ u32 count = 0;
+ struct device *dev;
+- struct i2s_platform_data *i2s_pdata;
++ struct i2s_platform_data *i2s_pdata = NULL;
+
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+@@ -317,20 +317,21 @@ static int acp_hw_init(void *handle)
+ adev->acp.acp_cell = kcalloc(ACP_DEVS, sizeof(struct mfd_cell),
+ GFP_KERNEL);
+
+- if (adev->acp.acp_cell == NULL)
+- return -ENOMEM;
++ if (adev->acp.acp_cell == NULL) {
++ r = -ENOMEM;
++ goto failure;
++ }
+
+ adev->acp.acp_res = kcalloc(5, sizeof(struct resource), GFP_KERNEL);
+ if (adev->acp.acp_res == NULL) {
+- kfree(adev->acp.acp_cell);
+- return -ENOMEM;
++ r = -ENOMEM;
++ goto failure;
+ }
+
+ i2s_pdata = kcalloc(3, sizeof(struct i2s_platform_data), GFP_KERNEL);
+ if (i2s_pdata == NULL) {
+- kfree(adev->acp.acp_res);
+- kfree(adev->acp.acp_cell);
+- return -ENOMEM;
++ r = -ENOMEM;
++ goto failure;
+ }
+
+ switch (adev->asic_type) {
+@@ -427,7 +428,7 @@ static int acp_hw_init(void *handle)
+ r = mfd_add_hotplug_devices(adev->acp.parent, adev->acp.acp_cell,
+ ACP_DEVS);
+ if (r)
+- return r;
++ goto failure;
+
+ if (adev->asic_type != CHIP_STONEY) {
+ for (i = 0; i < ACP_DEVS ; i++) {
+@@ -435,7 +436,7 @@ static int acp_hw_init(void *handle)
+ r = pm_genpd_add_device(&adev->acp.acp_genpd->gpd, dev);
+ if (r) {
+ dev_err(dev, "Failed to add dev to genpd\n");
+- return r;
++ goto failure;
+ }
+ }
+ }
+@@ -454,7 +455,8 @@ static int acp_hw_init(void *handle)
+ break;
+ if (--count == 0) {
+ dev_err(&adev->pdev->dev, "Failed to reset ACP\n");
+- return -ETIMEDOUT;
++ r = -ETIMEDOUT;
++ goto failure;
+ }
+ udelay(100);
+ }
+@@ -471,7 +473,8 @@ static int acp_hw_init(void *handle)
+ break;
+ if (--count == 0) {
+ dev_err(&adev->pdev->dev, "Failed to reset ACP\n");
+- return -ETIMEDOUT;
++ r = -ETIMEDOUT;
++ goto failure;
+ }
+ udelay(100);
+ }
+@@ -480,6 +483,13 @@ static int acp_hw_init(void *handle)
+ val &= ~ACP_SOFT_RESET__SoftResetAud_MASK;
+ cgs_write_register(adev->acp.cgs_device, mmACP_SOFT_RESET, val);
+ return 0;
++
++failure:
++ kfree(i2s_pdata);
++ kfree(adev->acp.acp_res);
++ kfree(adev->acp.acp_cell);
++ kfree(adev->acp.acp_genpd);
++ return r;
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index ba10577569f8..bb41936df0d9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -549,9 +549,10 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ return n ? -EFAULT : 0;
+ }
+ case AMDGPU_INFO_DEV_INFO: {
+- struct drm_amdgpu_info_device dev_info = {};
++ struct drm_amdgpu_info_device dev_info;
+ uint64_t vm_size;
+
++ memset(&dev_info, 0, sizeof(dev_info));
+ dev_info.device_id = dev->pdev->device;
+ dev_info.chip_rev = adev->rev_id;
+ dev_info.external_rev = adev->external_rev_id;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+index 7bea8ba89e88..e63a253eb425 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+@@ -529,7 +529,8 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
+
+ while (isspace(*++tmp_str));
+
+- while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
++ while (tmp_str[0]) {
++ sub_str = strsep(&tmp_str, delimiter);
+ ret = kstrtol(sub_str, 0, ¶meter[parameter_size]);
+ if (ret)
+ return -EINVAL;
+@@ -629,7 +630,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
+ memcpy(buf_cpy, buf, bytes);
+ buf_cpy[bytes] = '\0';
+ tmp = buf_cpy;
+- while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
++ while (tmp[0]) {
++ sub_str = strsep(&tmp, delimiter);
+ if (strlen(sub_str)) {
+ ret = kstrtol(sub_str, 0, &level);
+ if (ret)
+@@ -880,7 +882,8 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev,
+ i++;
+ memcpy(buf_cpy, buf, count-i);
+ tmp_str = buf_cpy;
+- while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
++ while (tmp_str[0]) {
++ sub_str = strsep(&tmp_str, delimiter);
+ ret = kstrtol(sub_str, 0, ¶meter[parameter_size]);
+ if (ret) {
+ count = -EINVAL;
+diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+index 3f76e6019546..5a2f29bd3508 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+@@ -1001,6 +1001,7 @@ struct resource_pool *dce100_create_resource_pool(
+ if (construct(num_virtual_links, dc, pool))
+ return &pool->base;
+
++ kfree(pool);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
+index e5e9e92521e9..17d936c260d9 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
+@@ -1344,6 +1344,7 @@ struct resource_pool *dce110_create_resource_pool(
+ if (construct(num_virtual_links, dc, pool, asic_id))
+ return &pool->base;
+
++ kfree(pool);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
+index 288129343c77..71adab8bf31b 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
+@@ -1287,6 +1287,7 @@ struct resource_pool *dce112_create_resource_pool(
+ if (construct(num_virtual_links, dc, pool))
+ return &pool->base;
+
++ kfree(pool);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
+index d43f37d99c7d..f0f2ce6da827 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
+@@ -1076,6 +1076,7 @@ struct resource_pool *dce120_create_resource_pool(
+ if (construct(num_virtual_links, dc, pool))
+ return &pool->base;
+
++ kfree(pool);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
+index 6b44ed3697a4..e6d556881140 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
+@@ -1361,6 +1361,7 @@ struct resource_pool *dcn10_create_resource_pool(
+ if (construct(num_virtual_links, dc, pool))
+ return &pool->base;
+
++ kfree(pool);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
+index bf90625df3c5..ac545c88a6f3 100644
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -731,9 +731,6 @@ err:
+ * @file_priv: drm file-private structure
+ *
+ * Open an object using the global name, returning a handle and the size.
+- *
+- * This handle (of course) holds a reference to the object, so the object
+- * will not go away until the handle is deleted.
+ */
+ int
+ drm_gem_open_ioctl(struct drm_device *dev, void *data,
+@@ -758,14 +755,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
+
+ /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
+ ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
+- drm_gem_object_put_unlocked(obj);
+ if (ret)
+- return ret;
++ goto err;
+
+ args->handle = handle;
+ args->size = obj->size;
+
+- return 0;
++err:
++ drm_gem_object_put_unlocked(obj);
++ return ret;
+ }
+
+ /**
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index d917cefc5a19..b13605718291 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -382,10 +382,8 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)
+ * Check for the message size against FIFO depth and set the
+ * 'hold bus' bit if it is greater than FIFO depth.
+ */
+- if ((id->recv_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
++ if (id->recv_count > CDNS_I2C_FIFO_DEPTH)
+ ctrl_reg |= CDNS_I2C_CR_HOLD;
+- else
+- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
+
+ cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
+
+@@ -442,11 +440,8 @@ static void cdns_i2c_msend(struct cdns_i2c *id)
+ * Check for the message size against FIFO depth and set the
+ * 'hold bus' bit if it is greater than FIFO depth.
+ */
+- if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
++ if (id->send_count > CDNS_I2C_FIFO_DEPTH)
+ ctrl_reg |= CDNS_I2C_CR_HOLD;
+- else
+- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
+-
+ cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
+
+ /* Clear the interrupts in interrupt status register. */
+diff --git a/drivers/iio/imu/adis16400_buffer.c b/drivers/iio/imu/adis16400_buffer.c
+index e70a5339acb1..3fc11aec98b9 100644
+--- a/drivers/iio/imu/adis16400_buffer.c
++++ b/drivers/iio/imu/adis16400_buffer.c
+@@ -38,8 +38,11 @@ int adis16400_update_scan_mode(struct iio_dev *indio_dev,
+ return -ENOMEM;
+
+ adis->buffer = kzalloc(burst_length + sizeof(u16), GFP_KERNEL);
+- if (!adis->buffer)
++ if (!adis->buffer) {
++ kfree(adis->xfer);
++ adis->xfer = NULL;
+ return -ENOMEM;
++ }
+
+ tx = adis->buffer + burst_length;
+ tx[0] = ADIS_READ_REG(ADIS16400_GLOB_CMD);
+diff --git a/drivers/media/pci/cx23885/cx23888-ir.c b/drivers/media/pci/cx23885/cx23888-ir.c
+index 00329f668b59..5177479d13d3 100644
+--- a/drivers/media/pci/cx23885/cx23888-ir.c
++++ b/drivers/media/pci/cx23885/cx23888-ir.c
+@@ -1178,8 +1178,11 @@ int cx23888_ir_probe(struct cx23885_dev *dev)
+ return -ENOMEM;
+
+ spin_lock_init(&state->rx_kfifo_lock);
+- if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, GFP_KERNEL))
++ if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE,
++ GFP_KERNEL)) {
++ kfree(state);
+ return -ENOMEM;
++ }
+
+ state->dev = dev;
+ sd = &state->sd;
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+index 3d4a765e9e61..7801f2aeeb30 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+@@ -2367,6 +2367,7 @@ static inline int uld_send(struct adapter *adap, struct sk_buff *skb,
+ txq_info = adap->sge.uld_txq_info[tx_uld_type];
+ if (unlikely(!txq_info)) {
+ WARN_ON(true);
++ kfree_skb(skb);
+ return NET_XMIT_DROP;
+ }
+
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index 01a212097836..f402af39da42 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -2451,6 +2451,7 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
+ port->reset = devm_reset_control_get_exclusive(dev, NULL);
+ if (IS_ERR(port->reset)) {
+ dev_err(dev, "no reset\n");
++ clk_disable_unprepare(port->pclk);
+ return PTR_ERR(port->reset);
+ }
+ reset_control_reset(port->reset);
+@@ -2506,8 +2507,10 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
+ IRQF_SHARED,
+ port_names[port->id],
+ port);
+- if (ret)
++ if (ret) {
++ clk_disable_unprepare(port->pclk);
+ return ret;
++ }
+
+ ret = register_netdev(netdev);
+ if (!ret) {
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 5e9e45befc87..d8115a9333e0 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2926,7 +2926,7 @@ req_rx_irq_failed:
+ req_tx_irq_failed:
+ for (j = 0; j < i; j++) {
+ free_irq(adapter->tx_scrq[j]->irq, adapter->tx_scrq[j]);
+- irq_dispose_mapping(adapter->rx_scrq[j]->irq);
++ irq_dispose_mapping(adapter->tx_scrq[j]->irq);
+ }
+ release_sub_crqs(adapter, 1);
+ return rc;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index f7825c7b92fe..8d7bb9a88967 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -4311,12 +4311,14 @@ end:
+ static void mlx4_shutdown(struct pci_dev *pdev)
+ {
+ struct mlx4_dev_persistent *persist = pci_get_drvdata(pdev);
++ struct mlx4_dev *dev = persist->dev;
+
+ mlx4_info(persist->dev, "mlx4_shutdown was called\n");
+ mutex_lock(&persist->interface_state_mutex);
+ if (persist->interface_state & MLX4_INTERFACE_STATE_UP)
+ mlx4_unload_one(pdev);
+ mutex_unlock(&persist->interface_state_mutex);
++ mlx4_pci_disable_device(dev);
+ }
+
+ static const struct pci_error_handlers mlx4_err_handler = {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 7e6706333fa8..51edc507b7b5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -519,7 +519,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
+ err = mlx5_wq_ll_create(mdev, &rqp->wq, rqc_wq, &rq->mpwqe.wq,
+ &rq->wq_ctrl);
+ if (err)
+- return err;
++ goto err_rq_wq_destroy;
+
+ rq->mpwqe.wq.db = &rq->mpwqe.wq.db[MLX5_RCV_DBR];
+
+@@ -564,7 +564,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
+ err = mlx5_wq_cyc_create(mdev, &rqp->wq, rqc_wq, &rq->wqe.wq,
+ &rq->wq_ctrl);
+ if (err)
+- return err;
++ goto err_rq_wq_destroy;
+
+ rq->wqe.wq.db = &rq->wqe.wq.db[MLX5_RCV_DBR];
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+index 54f1a40a68ed..d359e850dbf0 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+@@ -366,10 +366,31 @@ static int mlx5_ptp_enable(struct ptp_clock_info *ptp,
+ return 0;
+ }
+
++enum {
++ MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_IN = BIT(0),
++ MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_OUT = BIT(1),
++};
++
+ static int mlx5_ptp_verify(struct ptp_clock_info *ptp, unsigned int pin,
+ enum ptp_pin_function func, unsigned int chan)
+ {
+- return (func == PTP_PF_PHYSYNC) ? -EOPNOTSUPP : 0;
++ struct mlx5_clock *clock = container_of(ptp, struct mlx5_clock,
++ ptp_info);
++
++ switch (func) {
++ case PTP_PF_NONE:
++ return 0;
++ case PTP_PF_EXTTS:
++ return !(clock->pps_info.pin_caps[pin] &
++ MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_IN);
++ case PTP_PF_PEROUT:
++ return !(clock->pps_info.pin_caps[pin] &
++ MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_OUT);
++ default:
++ return -EOPNOTSUPP;
++ }
++
++ return -EOPNOTSUPP;
+ }
+
+ static const struct ptp_clock_info mlx5_ptp_clock_info = {
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index e180ec4f1a24..d8e7ca48753f 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -1384,7 +1384,7 @@ static int mlxsw_core_reg_access_emad(struct mlxsw_core *mlxsw_core,
+ err = mlxsw_emad_reg_access(mlxsw_core, reg, payload, type, trans,
+ bulk_list, cb, cb_priv, tid);
+ if (err) {
+- kfree(trans);
++ kfree_rcu(trans, rcu);
+ return err;
+ }
+ return 0;
+@@ -1605,11 +1605,13 @@ void mlxsw_core_skb_receive(struct mlxsw_core *mlxsw_core, struct sk_buff *skb,
+ break;
+ }
+ }
+- rcu_read_unlock();
+- if (!found)
++ if (!found) {
++ rcu_read_unlock();
+ goto drop;
++ }
+
+ rxl->func(skb, local_port, rxl_item->priv);
++ rcu_read_unlock();
+ return;
+
+ drop:
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
+index f9e475075d3e..61d5d7654568 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
+@@ -1015,7 +1015,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn)
+ index, attn_bits, attn_acks, asserted_bits,
+ deasserted_bits, p_sb_attn_sw->known_attn);
+ } else if (asserted_bits == 0x100) {
+- DP_INFO(p_hwfn, "MFW indication via attention\n");
++ DP_VERBOSE(p_hwfn, NETIF_MSG_INTR,
++ "MFW indication via attention\n");
+ } else {
+ DP_VERBOSE(p_hwfn, NETIF_MSG_INTR,
+ "MFW indication [deassertion]\n");
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index faaf74073a12..569e698b5c80 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1445,6 +1445,7 @@ static void ravb_tx_timeout_work(struct work_struct *work)
+ struct ravb_private *priv = container_of(work, struct ravb_private,
+ work);
+ struct net_device *ndev = priv->ndev;
++ int error;
+
+ netif_tx_stop_all_queues(ndev);
+
+@@ -1453,15 +1454,36 @@ static void ravb_tx_timeout_work(struct work_struct *work)
+ ravb_ptp_stop(ndev);
+
+ /* Wait for DMA stopping */
+- ravb_stop_dma(ndev);
++ if (ravb_stop_dma(ndev)) {
++ /* If ravb_stop_dma() fails, the hardware is still operating
++ * for TX and/or RX. So, this should not call the following
++ * functions because ravb_dmac_init() is possible to fail too.
++ * Also, this should not retry ravb_stop_dma() again and again
++ * here because it's possible to wait forever. So, this just
++ * re-enables the TX and RX and skip the following
++ * re-initialization procedure.
++ */
++ ravb_rcv_snd_enable(ndev);
++ goto out;
++ }
+
+ ravb_ring_free(ndev, RAVB_BE);
+ ravb_ring_free(ndev, RAVB_NC);
+
+ /* Device init */
+- ravb_dmac_init(ndev);
++ error = ravb_dmac_init(ndev);
++ if (error) {
++ /* If ravb_dmac_init() fails, descriptors are freed. So, this
++ * should return here to avoid re-enabling the TX and RX in
++ * ravb_emac_init().
++ */
++ netdev_err(ndev, "%s: ravb_dmac_init() failed, error %d\n",
++ __func__, error);
++ return;
++ }
+ ravb_emac_init(ndev);
+
++out:
+ /* Initialise PTP Clock driver */
+ if (priv->chip_id == RCAR_GEN2)
+ ravb_ptp_init(ndev, priv->pdev);
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index 5251c5f6f96e..61b9d3368148 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -1403,8 +1403,9 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
+ unsigned long flags;
+
+ if (old)
+- hso_dbg(0x16, "Termios called with: cflags new[%d] - old[%d]\n",
+- tty->termios.c_cflag, old->c_cflag);
++ hso_dbg(0x16, "Termios called with: cflags new[%u] - old[%u]\n",
++ (unsigned int)tty->termios.c_cflag,
++ (unsigned int)old->c_cflag);
+
+ /* the actual setup */
+ spin_lock_irqsave(&serial->serial_lock, flags);
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 92548887df2f..d198f36785a4 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -3786,6 +3786,11 @@ static int lan78xx_probe(struct usb_interface *intf,
+ netdev->max_mtu = MAX_SINGLE_PACKET_SIZE;
+ netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
+
++ if (intf->cur_altsetting->desc.bNumEndpoints < 3) {
++ ret = -ENODEV;
++ goto out3;
++ }
++
+ dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;
+ dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;
+ dev->ep_intr = (intf->cur_altsetting)->endpoint + 2;
+@@ -3810,6 +3815,7 @@ static int lan78xx_probe(struct usb_interface *intf,
+ usb_fill_int_urb(dev->urb_intr, dev->udev,
+ dev->pipe_intr, buf, maxp,
+ intr_complete, dev, period);
++ dev->urb_intr->transfer_flags |= URB_FREE_BUFFER;
+ }
+ }
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index d2e062eaf561..f705f0e1cb5b 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -173,6 +173,7 @@ static int htc_config_pipe_credits(struct htc_target *target)
+ time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
+ if (!time_left) {
+ dev_err(target->dev, "HTC credit config timeout\n");
++ kfree_skb(skb);
+ return -ETIMEDOUT;
+ }
+
+@@ -208,6 +209,7 @@ static int htc_setup_complete(struct htc_target *target)
+ time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
+ if (!time_left) {
+ dev_err(target->dev, "HTC start timeout\n");
++ kfree_skb(skb);
+ return -ETIMEDOUT;
+ }
+
+@@ -280,6 +282,7 @@ int htc_connect_service(struct htc_target *target,
+ if (!time_left) {
+ dev_err(target->dev, "Service connection timeout for: %d\n",
+ service_connreq->service_id);
++ kfree_skb(skb);
+ return -ETIMEDOUT;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
+index e7a3127395be..066677bb83eb 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.c
++++ b/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -339,6 +339,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+ ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
+ wmi_cmd_to_name(cmd_id));
+ mutex_unlock(&wmi->op_mutex);
++ kfree_skb(skb);
+ return -ETIMEDOUT;
+ }
+
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 6b4675a9494b..c8e84276e639 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -63,6 +63,8 @@ module_param_named(max_queues, xennet_max_queues, uint, 0644);
+ MODULE_PARM_DESC(max_queues,
+ "Maximum number of queues per virtual interface");
+
++#define XENNET_TIMEOUT (5 * HZ)
++
+ static const struct ethtool_ops xennet_ethtool_ops;
+
+ struct netfront_cb {
+@@ -1337,12 +1339,15 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
+
+ netif_carrier_off(netdev);
+
+- xenbus_switch_state(dev, XenbusStateInitialising);
+- wait_event(module_wq,
+- xenbus_read_driver_state(dev->otherend) !=
+- XenbusStateClosed &&
+- xenbus_read_driver_state(dev->otherend) !=
+- XenbusStateUnknown);
++ do {
++ xenbus_switch_state(dev, XenbusStateInitialising);
++ err = wait_event_timeout(module_wq,
++ xenbus_read_driver_state(dev->otherend) !=
++ XenbusStateClosed &&
++ xenbus_read_driver_state(dev->otherend) !=
++ XenbusStateUnknown, XENNET_TIMEOUT);
++ } while (!err);
++
+ return netdev;
+
+ exit:
+@@ -2142,28 +2147,43 @@ static const struct attribute_group xennet_dev_group = {
+ };
+ #endif /* CONFIG_SYSFS */
+
+-static int xennet_remove(struct xenbus_device *dev)
++static void xennet_bus_close(struct xenbus_device *dev)
+ {
+- struct netfront_info *info = dev_get_drvdata(&dev->dev);
+-
+- dev_dbg(&dev->dev, "%s\n", dev->nodename);
++ int ret;
+
+- if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
++ if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed)
++ return;
++ do {
+ xenbus_switch_state(dev, XenbusStateClosing);
+- wait_event(module_wq,
+- xenbus_read_driver_state(dev->otherend) ==
+- XenbusStateClosing ||
+- xenbus_read_driver_state(dev->otherend) ==
+- XenbusStateUnknown);
++ ret = wait_event_timeout(module_wq,
++ xenbus_read_driver_state(dev->otherend) ==
++ XenbusStateClosing ||
++ xenbus_read_driver_state(dev->otherend) ==
++ XenbusStateClosed ||
++ xenbus_read_driver_state(dev->otherend) ==
++ XenbusStateUnknown,
++ XENNET_TIMEOUT);
++ } while (!ret);
++
++ if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed)
++ return;
+
++ do {
+ xenbus_switch_state(dev, XenbusStateClosed);
+- wait_event(module_wq,
+- xenbus_read_driver_state(dev->otherend) ==
+- XenbusStateClosed ||
+- xenbus_read_driver_state(dev->otherend) ==
+- XenbusStateUnknown);
+- }
++ ret = wait_event_timeout(module_wq,
++ xenbus_read_driver_state(dev->otherend) ==
++ XenbusStateClosed ||
++ xenbus_read_driver_state(dev->otherend) ==
++ XenbusStateUnknown,
++ XENNET_TIMEOUT);
++ } while (!ret);
++}
++
++static int xennet_remove(struct xenbus_device *dev)
++{
++ struct netfront_info *info = dev_get_drvdata(&dev->dev);
+
++ xennet_bus_close(dev);
+ xennet_disconnect_backend(info);
+
+ if (info->netdev->reg_state == NETREG_REGISTERED)
+diff --git a/drivers/nfc/s3fwrn5/core.c b/drivers/nfc/s3fwrn5/core.c
+index 9d9c8d57a042..64b58455e620 100644
+--- a/drivers/nfc/s3fwrn5/core.c
++++ b/drivers/nfc/s3fwrn5/core.c
+@@ -209,6 +209,7 @@ int s3fwrn5_recv_frame(struct nci_dev *ndev, struct sk_buff *skb,
+ case S3FWRN5_MODE_FW:
+ return s3fwrn5_fw_recv_frame(ndev, skb);
+ default:
++ kfree_skb(skb);
+ return -ENODEV;
+ }
+ }
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 0862cb633849..8f856657dac2 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2307,6 +2307,19 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s);
+
++static void quirk_disable_aspm_l0s_l1(struct pci_dev *dev)
++{
++ pci_info(dev, "Disabling ASPM L0s/L1\n");
++ pci_disable_link_state(dev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1);
++}
++
++/*
++ * ASM1083/1085 PCIe-PCI bridge devices cause AER timeout errors on the
++ * upstream PCIe root port when ASPM is enabled. At least L0s mode is affected;
++ * disable both L0s and L1 for now to be safe.
++ */
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x1080, quirk_disable_aspm_l0s_l1);
++
+ /*
+ * Some Pericom PCIe-to-PCI bridges in reverse mode need the PCIe Retrain
+ * Link bit cleared after starting the link retrain process to allow this
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 8dd2702ce859..7befb7c12bd3 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -5553,12 +5553,14 @@ no_delete:
+ }
+
+ /*
+- * this returns the key found in the dir entry in the location pointer.
++ * Return the key found in the dir entry in the location pointer, fill @type
++ * with BTRFS_FT_*, and return 0.
++ *
+ * If no dir entries were found, returns -ENOENT.
+ * If found a corrupted location in dir entry, returns -EUCLEAN.
+ */
+ static int btrfs_inode_by_name(struct inode *dir, struct dentry *dentry,
+- struct btrfs_key *location)
++ struct btrfs_key *location, u8 *type)
+ {
+ const char *name = dentry->d_name.name;
+ int namelen = dentry->d_name.len;
+@@ -5591,6 +5593,8 @@ static int btrfs_inode_by_name(struct inode *dir, struct dentry *dentry,
+ __func__, name, btrfs_ino(BTRFS_I(dir)),
+ location->objectid, location->type, location->offset);
+ }
++ if (!ret)
++ *type = btrfs_dir_type(path->nodes[0], di);
+ out:
+ btrfs_free_path(path);
+ return ret;
+@@ -5826,6 +5830,11 @@ static struct inode *new_simple_dir(struct super_block *s,
+ return inode;
+ }
+
++static inline u8 btrfs_inode_type(struct inode *inode)
++{
++ return btrfs_type_by_mode[(inode->i_mode & S_IFMT) >> S_SHIFT];
++}
++
+ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
+ {
+ struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb);
+@@ -5833,18 +5842,31 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
+ struct btrfs_root *root = BTRFS_I(dir)->root;
+ struct btrfs_root *sub_root = root;
+ struct btrfs_key location;
++ u8 di_type = 0;
+ int index;
+ int ret = 0;
+
+ if (dentry->d_name.len > BTRFS_NAME_LEN)
+ return ERR_PTR(-ENAMETOOLONG);
+
+- ret = btrfs_inode_by_name(dir, dentry, &location);
++ ret = btrfs_inode_by_name(dir, dentry, &location, &di_type);
+ if (ret < 0)
+ return ERR_PTR(ret);
+
+ if (location.type == BTRFS_INODE_ITEM_KEY) {
+ inode = btrfs_iget(dir->i_sb, &location, root, NULL);
++ if (IS_ERR(inode))
++ return inode;
++
++ /* Do extra check against inode mode with di_type */
++ if (btrfs_inode_type(inode) != di_type) {
++ btrfs_crit(fs_info,
++"inode mode mismatch with dir: inode mode=0%o btrfs type=%u dir type=%u",
++ inode->i_mode, btrfs_inode_type(inode),
++ di_type);
++ iput(inode);
++ return ERR_PTR(-EUCLEAN);
++ }
+ return inode;
+ }
+
+@@ -6455,11 +6477,6 @@ fail:
+ return ERR_PTR(ret);
+ }
+
+-static inline u8 btrfs_inode_type(struct inode *inode)
+-{
+- return btrfs_type_by_mode[(inode->i_mode & S_IFMT) >> S_SHIFT];
+-}
+-
+ /*
+ * utility function to add 'inode' into 'parent_inode' with
+ * a give name and a given sequence number.
+@@ -6993,6 +7010,14 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode,
+ extent_start = found_key.offset;
+ if (found_type == BTRFS_FILE_EXTENT_REG ||
+ found_type == BTRFS_FILE_EXTENT_PREALLOC) {
++ /* Only regular file could have regular/prealloc extent */
++ if (!S_ISREG(inode->vfs_inode.i_mode)) {
++ ret = -EUCLEAN;
++ btrfs_crit(fs_info,
++ "regular/prealloc extent found for non-regular inode %llu",
++ btrfs_ino(inode));
++ goto out;
++ }
+ extent_end = extent_start +
+ btrfs_file_extent_num_bytes(leaf, item);
+
+diff --git a/fs/btrfs/tests/btrfs-tests.c b/fs/btrfs/tests/btrfs-tests.c
+index 2eec1dd3803a..82d874b10438 100644
+--- a/fs/btrfs/tests/btrfs-tests.c
++++ b/fs/btrfs/tests/btrfs-tests.c
+@@ -38,7 +38,13 @@ static struct file_system_type test_type = {
+
+ struct inode *btrfs_new_test_inode(void)
+ {
+- return new_inode(test_mnt->mnt_sb);
++ struct inode *inode;
++
++ inode = new_inode(test_mnt->mnt_sb);
++ if (inode)
++ inode_init_owner(inode, NULL, S_IFREG);
++
++ return inode;
+ }
+
+ static int btrfs_init_test_fs(void)
+diff --git a/fs/btrfs/tests/inode-tests.c b/fs/btrfs/tests/inode-tests.c
+index 64043f028820..648633aae968 100644
+--- a/fs/btrfs/tests/inode-tests.c
++++ b/fs/btrfs/tests/inode-tests.c
+@@ -232,6 +232,7 @@ static noinline int test_btrfs_get_extent(u32 sectorsize, u32 nodesize)
+ return ret;
+ }
+
++ inode->i_mode = S_IFREG;
+ BTRFS_I(inode)->location.type = BTRFS_INODE_ITEM_KEY;
+ BTRFS_I(inode)->location.objectid = BTRFS_FIRST_FREE_OBJECTID;
+ BTRFS_I(inode)->location.offset = 0;
+diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
+index 7bba551cbf90..8b1b0862e869 100644
+--- a/fs/xfs/xfs_log.c
++++ b/fs/xfs/xfs_log.c
+@@ -2712,7 +2712,6 @@ xlog_state_do_callback(
+ int funcdidcallbacks; /* flag: function did callbacks */
+ int repeats; /* for issuing console warnings if
+ * looping too many times */
+- int wake = 0;
+
+ spin_lock(&log->l_icloglock);
+ first_iclog = iclog = log->l_iclog;
+@@ -2914,11 +2913,9 @@ xlog_state_do_callback(
+ #endif
+
+ if (log->l_iclog->ic_state & (XLOG_STATE_ACTIVE|XLOG_STATE_IOERROR))
+- wake = 1;
+- spin_unlock(&log->l_icloglock);
+-
+- if (wake)
+ wake_up_all(&log->l_flush_wait);
++
++ spin_unlock(&log->l_icloglock);
+ }
+
+
+@@ -4026,7 +4023,9 @@ xfs_log_force_umount(
+ * item committed callback functions will do this again under lock to
+ * avoid races.
+ */
++ spin_lock(&log->l_cilp->xc_push_lock);
+ wake_up_all(&log->l_cilp->xc_commit_wait);
++ spin_unlock(&log->l_cilp->xc_push_lock);
+ xlog_state_do_callback(log, XFS_LI_ABORTED, NULL);
+
+ #ifdef XFSERRORDEBUG
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index f087c8d125b8..3a0b5de742e9 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1016,7 +1016,7 @@ struct xfrm_dst {
+ static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst)
+ {
+ #ifdef CONFIG_XFRM
+- if (dst->xfrm) {
++ if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
+ const struct xfrm_dst *xdst = (const struct xfrm_dst *) dst;
+
+ return xdst->path;
+@@ -1028,7 +1028,7 @@ static inline struct dst_entry *xfrm_dst_path(const struct dst_entry *dst)
+ static inline struct dst_entry *xfrm_dst_child(const struct dst_entry *dst)
+ {
+ #ifdef CONFIG_XFRM
+- if (dst->xfrm) {
++ if (dst->xfrm || (dst->flags & DST_XFRM_QUEUE)) {
+ struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
+ return xdst->child;
+ }
+diff --git a/include/uapi/linux/wireless.h b/include/uapi/linux/wireless.h
+index 86eca3208b6b..a2c006a364e0 100644
+--- a/include/uapi/linux/wireless.h
++++ b/include/uapi/linux/wireless.h
+@@ -74,6 +74,8 @@
+ #include <linux/socket.h> /* for "struct sockaddr" et al */
+ #include <linux/if.h> /* for IFNAMSIZ and co... */
+
++#include <stddef.h> /* for offsetof */
++
+ /***************************** VERSION *****************************/
+ /*
+ * This constant is used to know the availability of the wireless
+@@ -1090,8 +1092,7 @@ struct iw_event {
+ /* iw_point events are special. First, the payload (extra data) come at
+ * the end of the event, so they are bigger than IW_EV_POINT_LEN. Second,
+ * we omit the pointer, so start at an offset. */
+-#define IW_EV_POINT_OFF (((char *) &(((struct iw_point *) NULL)->length)) - \
+- (char *) NULL)
++#define IW_EV_POINT_OFF offsetof(struct iw_point, length)
+ #define IW_EV_POINT_LEN (IW_EV_LCP_LEN + sizeof(struct iw_point) - \
+ IW_EV_POINT_OFF)
+
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index 6fe72792312d..1b28fb006763 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -678,15 +678,20 @@ static void htab_elem_free_rcu(struct rcu_head *head)
+ preempt_enable();
+ }
+
+-static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
++static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
+ {
+ struct bpf_map *map = &htab->map;
++ void *ptr;
+
+ if (map->ops->map_fd_put_ptr) {
+- void *ptr = fd_htab_map_get_ptr(map, l);
+-
++ ptr = fd_htab_map_get_ptr(map, l);
+ map->ops->map_fd_put_ptr(ptr);
+ }
++}
++
++static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
++{
++ htab_put_fd_value(htab, l);
+
+ if (htab_is_prealloc(htab)) {
+ __pcpu_freelist_push(&htab->freelist, &l->fnode);
+@@ -747,6 +752,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
+ */
+ pl_new = this_cpu_ptr(htab->extra_elems);
+ l_new = *pl_new;
++ htab_put_fd_value(htab, old_elem);
+ *pl_new = old_elem;
+ } else {
+ struct pcpu_freelist_node *l;
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index b949c3917c67..9be3d1d1fcb4 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -451,8 +451,10 @@ predicate_parse(const char *str, int nr_parens, int nr_preds,
+
+ switch (*next) {
+ case '(': /* #2 */
+- if (top - op_stack > nr_parens)
+- return ERR_PTR(-EINVAL);
++ if (top - op_stack > nr_parens) {
++ ret = -EINVAL;
++ goto out_free;
++ }
+ *(++top) = invert;
+ continue;
+ case '!': /* #3 */
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index f868cf6fba79..d28c2cc9618f 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -377,6 +377,10 @@ static void p9_read_work(struct work_struct *work)
+ if (m->rreq->status == REQ_STATUS_SENT) {
+ list_del(&m->rreq->req_list);
+ p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);
++ } else if (m->rreq->status == REQ_STATUS_FLSHD) {
++ /* Ignore replies associated with a cancelled request. */
++ p9_debug(P9_DEBUG_TRANS,
++ "Ignore replies associated with a cancelled request\n");
+ } else {
+ spin_unlock(&m->client->lock);
+ p9_debug(P9_DEBUG_ERROR,
+@@ -718,11 +722,20 @@ static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req)
+ {
+ p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
+
++ spin_lock(&client->lock);
++ /* Ignore cancelled request if message has been received
++ * before lock.
++ */
++ if (req->status == REQ_STATUS_RCVD) {
++ spin_unlock(&client->lock);
++ return 0;
++ }
++
+ /* we haven't received a response for oldreq,
+ * remove it from the list.
+ */
+- spin_lock(&client->lock);
+ list_del(&req->req_list);
++ req->status = REQ_STATUS_FLSHD;
+ spin_unlock(&client->lock);
+ p9_req_put(req);
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index a044e6bb12b8..cdb92b129906 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -1229,6 +1229,9 @@ static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
+ {
+ struct discovery_state *d = &hdev->discovery;
+
++ if (len > HCI_MAX_AD_LENGTH)
++ return;
++
+ bacpy(&d->last_adv_addr, bdaddr);
+ d->last_adv_addr_type = bdaddr_type;
+ d->last_adv_rssi = rssi;
+@@ -5116,7 +5119,8 @@ static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
+
+ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ u8 bdaddr_type, bdaddr_t *direct_addr,
+- u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
++ u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
++ bool ext_adv)
+ {
+ struct discovery_state *d = &hdev->discovery;
+ struct smp_irk *irk;
+@@ -5138,6 +5142,11 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ return;
+ }
+
++ if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
++ bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
++ return;
++ }
++
+ /* Find the end of the data in case the report contains padded zero
+ * bytes at the end causing an invalid length value.
+ *
+@@ -5197,7 +5206,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ */
+ conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
+ direct_addr);
+- if (conn && type == LE_ADV_IND) {
++ if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
+ /* Store report for later inclusion by
+ * mgmt_device_connected
+ */
+@@ -5251,7 +5260,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ * event or send an immediate device found event if the data
+ * should not be stored for later.
+ */
+- if (!has_pending_adv_report(hdev)) {
++ if (!ext_adv && !has_pending_adv_report(hdev)) {
+ /* If the report will trigger a SCAN_REQ store it for
+ * later merging.
+ */
+@@ -5286,7 +5295,8 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+ /* If the new report will trigger a SCAN_REQ store it for
+ * later merging.
+ */
+- if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
++ if (!ext_adv && (type == LE_ADV_IND ||
++ type == LE_ADV_SCAN_IND)) {
+ store_pending_adv_report(hdev, bdaddr, bdaddr_type,
+ rssi, flags, data, len);
+ return;
+@@ -5326,7 +5336,7 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ rssi = ev->data[ev->length];
+ process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
+ ev->bdaddr_type, NULL, 0, rssi,
+- ev->data, ev->length);
++ ev->data, ev->length, false);
+ } else {
+ bt_dev_err(hdev, "Dropping invalid advertising data");
+ }
+@@ -5400,7 +5410,8 @@ static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ if (legacy_evt_type != LE_ADV_INVALID) {
+ process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
+ ev->bdaddr_type, NULL, 0, ev->rssi,
+- ev->data, ev->length);
++ ev->data, ev->length,
++ !(evt_type & LE_EXT_ADV_LEGACY_PDU));
+ }
+
+ ptr += sizeof(*ev) + ev->length + 1;
+@@ -5598,7 +5609,8 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
+
+ process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
+ ev->bdaddr_type, &ev->direct_addr,
+- ev->direct_addr_type, ev->rssi, NULL, 0);
++ ev->direct_addr_type, ev->rssi, NULL, 0,
++ false);
+
+ ptr += sizeof(*ev);
+ }
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index cb7076d9a769..b6670e74aeb7 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2011,6 +2011,7 @@ static int ieee80211_leave_mesh(struct wiphy *wiphy, struct net_device *dev)
+ ieee80211_stop_mesh(sdata);
+ mutex_lock(&sdata->local->mtx);
+ ieee80211_vif_release_channel(sdata);
++ kfree(sdata->u.mesh.ie);
+ mutex_unlock(&sdata->local->mtx);
+
+ return 0;
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index ac1f5db52994..4fc720c77e37 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -532,6 +532,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl,
+ del_timer_sync(&mpath->timer);
+ atomic_dec(&sdata->u.mesh.mpaths);
+ atomic_dec(&tbl->entries);
++ mesh_path_flush_pending(mpath);
+ kfree_rcu(mpath, rcu);
+ }
+
+diff --git a/net/rds/recv.c b/net/rds/recv.c
+index c0b945516cdb..3ca278988b52 100644
+--- a/net/rds/recv.c
++++ b/net/rds/recv.c
+@@ -455,12 +455,13 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
+ int rds_notify_queue_get(struct rds_sock *rs, struct msghdr *msghdr)
+ {
+ struct rds_notifier *notifier;
+- struct rds_rdma_notify cmsg = { 0 }; /* fill holes with zero */
++ struct rds_rdma_notify cmsg;
+ unsigned int count = 0, max_messages = ~0U;
+ unsigned long flags;
+ LIST_HEAD(copy);
+ int err = 0;
+
++ memset(&cmsg, 0, sizeof(cmsg)); /* fill holes with zero */
+
+ /* put_cmsg copies to user space and thus may sleep. We can't do this
+ * with rs_lock held, so first grab as many notifications as we can stuff
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index c93be3ba5df2..df4a7d7c5ec0 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1931,7 +1931,10 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
+ if (sctp_wspace(asoc) < (int)msg_len)
+ sctp_prsctp_prune(asoc, sinfo, msg_len - sctp_wspace(asoc));
+
+- if (sctp_wspace(asoc) <= 0) {
++ if (sk_under_memory_pressure(sk))
++ sk_mem_reclaim(sk);
++
++ if (sctp_wspace(asoc) <= 0 || !sk_wmem_schedule(sk, msg_len)) {
+ timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
+ err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
+ if (err)
+@@ -8515,7 +8518,10 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
+ goto do_error;
+ if (signal_pending(current))
+ goto do_interrupted;
+- if ((int)msg_len <= sctp_wspace(asoc))
++ if (sk_under_memory_pressure(sk))
++ sk_mem_reclaim(sk);
++ if ((int)msg_len <= sctp_wspace(asoc) &&
++ sk_wmem_schedule(sk, msg_len))
+ break;
+
+ /* Let another process have a go. Since we are going
+diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
+index 743103786652..f3d34582581b 100644
+--- a/net/x25/x25_subr.c
++++ b/net/x25/x25_subr.c
+@@ -362,6 +362,12 @@ void x25_disconnect(struct sock *sk, int reason, unsigned char cause,
+ sk->sk_state_change(sk);
+ sock_set_flag(sk, SOCK_DEAD);
+ }
++ if (x25->neighbour) {
++ read_lock_bh(&x25_list_lock);
++ x25_neigh_put(x25->neighbour);
++ x25->neighbour = NULL;
++ read_unlock_bh(&x25_list_lock);
++ }
+ }
+
+ /*
+diff --git a/tools/testing/selftests/net/psock_fanout.c b/tools/testing/selftests/net/psock_fanout.c
+index bd9b9632c72b..f496ba3b1cd3 100644
+--- a/tools/testing/selftests/net/psock_fanout.c
++++ b/tools/testing/selftests/net/psock_fanout.c
+@@ -364,7 +364,8 @@ static int test_datapath(uint16_t typeflags, int port_off,
+ int fds[2], fds_udp[2][2], ret;
+
+ fprintf(stderr, "\ntest: datapath 0x%hx ports %hu,%hu\n",
+- typeflags, PORT_BASE, PORT_BASE + port_off);
++ typeflags, (uint16_t)PORT_BASE,
++ (uint16_t)(PORT_BASE + port_off));
+
+ fds[0] = sock_fanout_open(typeflags, 0);
+ fds[1] = sock_fanout_open(typeflags, 0);
+diff --git a/tools/testing/selftests/networking/timestamping/rxtimestamp.c b/tools/testing/selftests/networking/timestamping/rxtimestamp.c
+index 7a573fb4c1c4..c6428f1ac22f 100644
+--- a/tools/testing/selftests/networking/timestamping/rxtimestamp.c
++++ b/tools/testing/selftests/networking/timestamping/rxtimestamp.c
+@@ -328,8 +328,7 @@ int main(int argc, char **argv)
+ bool all_tests = true;
+ int arg_index = 0;
+ int failures = 0;
+- int s, t;
+- char opt;
++ int s, t, opt;
+
+ while ((opt = getopt_long(argc, argv, "", long_options,
+ &arg_index)) != -1) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-08-07 19:16 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-08-07 19:16 UTC (permalink / raw
To: gentoo-commits
commit: db2e8ae94cabc877b43000900c80c31552838371
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 7 19:15:49 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug 7 19:15:49 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=db2e8ae9
Linux patch 4.19.138
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1137_linux-4.19.138.patch | 258 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 262 insertions(+)
diff --git a/0000_README b/0000_README
index d6fa27c..c72d2c2 100644
--- a/0000_README
+++ b/0000_README
@@ -587,6 +587,10 @@ Patch: 1136_linux-4.19.137.patch
From: https://www.kernel.org
Desc: Linux 4.19.137
+Patch: 1137_linux-4.19.138.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.138
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1137_linux-4.19.138.patch b/1137_linux-4.19.138.patch
new file mode 100644
index 0000000..cad026c
--- /dev/null
+++ b/1137_linux-4.19.138.patch
@@ -0,0 +1,258 @@
+diff --git a/Makefile b/Makefile
+index edf1799c08d2..daaa8ab2f550 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 137
++SUBLEVEL = 138
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/include/asm/percpu.h b/arch/arm/include/asm/percpu.h
+index a89b4076cde4..72821b4721ad 100644
+--- a/arch/arm/include/asm/percpu.h
++++ b/arch/arm/include/asm/percpu.h
+@@ -16,6 +16,8 @@
+ #ifndef _ASM_ARM_PERCPU_H_
+ #define _ASM_ARM_PERCPU_H_
+
++#include <asm/thread_info.h>
++
+ /*
+ * Same as asm-generic/percpu.h, except that we store the per cpu offset
+ * in the TPIDRPRW. TPIDRPRW only exists on V6K and V7
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index d5f970d039bb..6a5d4dfafc47 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1257,6 +1257,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
+
+ fast_mix(fast_pool);
+ add_interrupt_bench(cycles);
++ this_cpu_add(net_rand_state.s1, fast_pool->pool[cycles & 3]);
+
+ if (unlikely(crng_init == 0)) {
+ if ((fast_pool->count >= 64) &&
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 3b1a7597af15..cd833f4e64ef 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -3848,6 +3848,11 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter)
+ struct inode *inode = mapping->host;
+ size_t count = iov_iter_count(iter);
+ ssize_t ret;
++ loff_t offset = iocb->ki_pos;
++ loff_t size = i_size_read(inode);
++
++ if (offset >= size)
++ return 0;
+
+ /*
+ * Shared inode_lock is enough for us - it protects against concurrent
+diff --git a/include/linux/prandom.h b/include/linux/prandom.h
+new file mode 100644
+index 000000000000..aa16e6468f91
+--- /dev/null
++++ b/include/linux/prandom.h
+@@ -0,0 +1,78 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * include/linux/prandom.h
++ *
++ * Include file for the fast pseudo-random 32-bit
++ * generation.
++ */
++#ifndef _LINUX_PRANDOM_H
++#define _LINUX_PRANDOM_H
++
++#include <linux/types.h>
++#include <linux/percpu.h>
++
++u32 prandom_u32(void);
++void prandom_bytes(void *buf, size_t nbytes);
++void prandom_seed(u32 seed);
++void prandom_reseed_late(void);
++
++struct rnd_state {
++ __u32 s1, s2, s3, s4;
++};
++
++DECLARE_PER_CPU(struct rnd_state, net_rand_state);
++
++u32 prandom_u32_state(struct rnd_state *state);
++void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
++void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state);
++
++#define prandom_init_once(pcpu_state) \
++ DO_ONCE(prandom_seed_full_state, (pcpu_state))
++
++/**
++ * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro)
++ * @ep_ro: right open interval endpoint
++ *
++ * Returns a pseudo-random number that is in interval [0, ep_ro). Note
++ * that the result depends on PRNG being well distributed in [0, ~0U]
++ * u32 space. Here we use maximally equidistributed combined Tausworthe
++ * generator, that is, prandom_u32(). This is useful when requesting a
++ * random index of an array containing ep_ro elements, for example.
++ *
++ * Returns: pseudo-random number in interval [0, ep_ro)
++ */
++static inline u32 prandom_u32_max(u32 ep_ro)
++{
++ return (u32)(((u64) prandom_u32() * ep_ro) >> 32);
++}
++
++/*
++ * Handle minimum values for seeds
++ */
++static inline u32 __seed(u32 x, u32 m)
++{
++ return (x < m) ? x + m : x;
++}
++
++/**
++ * prandom_seed_state - set seed for prandom_u32_state().
++ * @state: pointer to state structure to receive the seed.
++ * @seed: arbitrary 64-bit value to use as a seed.
++ */
++static inline void prandom_seed_state(struct rnd_state *state, u64 seed)
++{
++ u32 i = (seed >> 32) ^ (seed << 10) ^ seed;
++
++ state->s1 = __seed(i, 2U);
++ state->s2 = __seed(i, 8U);
++ state->s3 = __seed(i, 16U);
++ state->s4 = __seed(i, 128U);
++}
++
++/* Pseudo random number generator from numerical recipes. */
++static inline u32 next_pseudo_random32(u32 seed)
++{
++ return seed * 1664525 + 1013904223;
++}
++
++#endif
+diff --git a/include/linux/random.h b/include/linux/random.h
+index 445a0ea4ff49..37209b3b22ae 100644
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -106,61 +106,12 @@ declare_get_random_var_wait(long)
+
+ unsigned long randomize_page(unsigned long start, unsigned long range);
+
+-u32 prandom_u32(void);
+-void prandom_bytes(void *buf, size_t nbytes);
+-void prandom_seed(u32 seed);
+-void prandom_reseed_late(void);
+-
+-struct rnd_state {
+- __u32 s1, s2, s3, s4;
+-};
+-
+-u32 prandom_u32_state(struct rnd_state *state);
+-void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
+-void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state);
+-
+-#define prandom_init_once(pcpu_state) \
+- DO_ONCE(prandom_seed_full_state, (pcpu_state))
+-
+-/**
+- * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro)
+- * @ep_ro: right open interval endpoint
+- *
+- * Returns a pseudo-random number that is in interval [0, ep_ro). Note
+- * that the result depends on PRNG being well distributed in [0, ~0U]
+- * u32 space. Here we use maximally equidistributed combined Tausworthe
+- * generator, that is, prandom_u32(). This is useful when requesting a
+- * random index of an array containing ep_ro elements, for example.
+- *
+- * Returns: pseudo-random number in interval [0, ep_ro)
+- */
+-static inline u32 prandom_u32_max(u32 ep_ro)
+-{
+- return (u32)(((u64) prandom_u32() * ep_ro) >> 32);
+-}
+-
+ /*
+- * Handle minimum values for seeds
++ * This is designed to be standalone for just prandom
++ * users, but for now we include it from <linux/random.h>
++ * for legacy reasons.
+ */
+-static inline u32 __seed(u32 x, u32 m)
+-{
+- return (x < m) ? x + m : x;
+-}
+-
+-/**
+- * prandom_seed_state - set seed for prandom_u32_state().
+- * @state: pointer to state structure to receive the seed.
+- * @seed: arbitrary 64-bit value to use as a seed.
+- */
+-static inline void prandom_seed_state(struct rnd_state *state, u64 seed)
+-{
+- u32 i = (seed >> 32) ^ (seed << 10) ^ seed;
+-
+- state->s1 = __seed(i, 2U);
+- state->s2 = __seed(i, 8U);
+- state->s3 = __seed(i, 16U);
+- state->s4 = __seed(i, 128U);
+-}
++#include <linux/prandom.h>
+
+ #ifdef CONFIG_ARCH_RANDOM
+ # include <asm/archrandom.h>
+@@ -191,10 +142,4 @@ static inline bool arch_has_random_seed(void)
+ }
+ #endif
+
+-/* Pseudo random number generator from numerical recipes. */
+-static inline u32 next_pseudo_random32(u32 seed)
+-{
+- return seed * 1664525 + 1013904223;
+-}
+-
+ #endif /* _LINUX_RANDOM_H */
+diff --git a/kernel/time/timer.c b/kernel/time/timer.c
+index 6c54cf481fde..61e41ea3a96e 100644
+--- a/kernel/time/timer.c
++++ b/kernel/time/timer.c
+@@ -44,6 +44,7 @@
+ #include <linux/sched/debug.h>
+ #include <linux/slab.h>
+ #include <linux/compat.h>
++#include <linux/random.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/unistd.h>
+@@ -1654,6 +1655,13 @@ void update_process_times(int user_tick)
+ scheduler_tick();
+ if (IS_ENABLED(CONFIG_POSIX_TIMERS))
+ run_posix_cpu_timers(p);
++
++ /* The current CPU might make use of net randoms without receiving IRQs
++ * to renew them often enough. Let's update the net_rand_state from a
++ * non-constant value that's not affine to the number of calls to make
++ * sure it's updated when there's some activity (we don't care in idle).
++ */
++ this_cpu_add(net_rand_state.s1, rol32(jiffies, 24) + user_tick);
+ }
+
+ /**
+diff --git a/lib/random32.c b/lib/random32.c
+index 4aaa76404d56..036de0c93e22 100644
+--- a/lib/random32.c
++++ b/lib/random32.c
+@@ -48,7 +48,7 @@ static inline void prandom_state_selftest(void)
+ }
+ #endif
+
+-static DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
++DEFINE_PER_CPU(struct rnd_state, net_rand_state);
+
+ /**
+ * prandom_u32_state - seeded pseudo-random number generator.
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-08-12 23:36 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2020-08-12 23:36 UTC (permalink / raw
To: gentoo-commits
commit: 77d4994b057e94128881c4219ff9431f8b22ff8a
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 12 23:36:35 2020 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Aug 12 23:36:44 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=77d4994b
Linux patch 4.19.139
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1138_linux-4.19.139.patch | 1713 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1717 insertions(+)
diff --git a/0000_README b/0000_README
index c72d2c2..b90eb63 100644
--- a/0000_README
+++ b/0000_README
@@ -591,6 +591,10 @@ Patch: 1137_linux-4.19.138.patch
From: https://www.kernel.org
Desc: Linux 4.19.138
+Patch: 1138_linux-4.19.139.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.139
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1138_linux-4.19.139.patch b/1138_linux-4.19.139.patch
new file mode 100644
index 0000000..7235e09
--- /dev/null
+++ b/1138_linux-4.19.139.patch
@@ -0,0 +1,1713 @@
+diff --git a/Makefile b/Makefile
+index daaa8ab2f550..f6012170995e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 138
++SUBLEVEL = 139
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index cf4367135a00..112b5b50ad3c 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -2862,6 +2862,12 @@ static void binder_transaction(struct binder_proc *proc,
+ goto err_dead_binder;
+ }
+ e->to_node = target_node->debug_id;
++ if (WARN_ON(proc == target_proc)) {
++ return_error = BR_FAILED_REPLY;
++ return_error_param = -EINVAL;
++ return_error_line = __LINE__;
++ goto err_invalid_target_handle;
++ }
+ if (security_binder_transaction(proc->tsk,
+ target_proc->tsk) < 0) {
+ return_error = BR_FAILED_REPLY;
+@@ -3366,10 +3372,17 @@ static int binder_thread_write(struct binder_proc *proc,
+ struct binder_node *ctx_mgr_node;
+ mutex_lock(&context->context_mgr_node_lock);
+ ctx_mgr_node = context->binder_context_mgr_node;
+- if (ctx_mgr_node)
++ if (ctx_mgr_node) {
++ if (ctx_mgr_node->proc == proc) {
++ binder_user_error("%d:%d context manager tried to acquire desc 0\n",
++ proc->pid, thread->pid);
++ mutex_unlock(&context->context_mgr_node_lock);
++ return -EINVAL;
++ }
+ ret = binder_inc_ref_for_node(
+ proc, ctx_mgr_node,
+ strong, NULL, &rdata);
++ }
+ mutex_unlock(&context->context_mgr_node_lock);
+ }
+ if (ret)
+diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
+index afebeb1c3e1e..723bad1201cc 100644
+--- a/drivers/atm/atmtcp.c
++++ b/drivers/atm/atmtcp.c
+@@ -432,9 +432,15 @@ static int atmtcp_remove_persistent(int itf)
+ return -EMEDIUMTYPE;
+ }
+ dev_data = PRIV(dev);
+- if (!dev_data->persist) return 0;
++ if (!dev_data->persist) {
++ atm_dev_put(dev);
++ return 0;
++ }
+ dev_data->persist = 0;
+- if (PRIV(dev)->vcc) return 0;
++ if (PRIV(dev)->vcc) {
++ atm_dev_put(dev);
++ return 0;
++ }
+ kfree(dev_data);
+ atm_dev_put(dev);
+ atm_dev_deregister(dev);
+diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
+index 039e0f91dba8..6945c3c96637 100644
+--- a/drivers/firmware/qemu_fw_cfg.c
++++ b/drivers/firmware/qemu_fw_cfg.c
+@@ -605,8 +605,10 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
+ /* register entry under "/sys/firmware/qemu_fw_cfg/by_key/" */
+ err = kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype,
+ fw_cfg_sel_ko, "%d", entry->select);
+- if (err)
+- goto err_register;
++ if (err) {
++ kobject_put(&entry->kobj);
++ return err;
++ }
+
+ /* add raw binary content access */
+ err = sysfs_create_bin_file(&entry->kobj, &fw_cfg_sysfs_attr_raw);
+@@ -622,7 +624,6 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
+
+ err_add_raw:
+ kobject_del(&entry->kobj);
+-err_register:
+ kfree(entry);
+ return err;
+ }
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+index 0f64c0a1d4b3..406cb99af7f2 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+@@ -315,7 +315,7 @@ nouveau_fbcon_create(struct drm_fb_helper *helper,
+ struct nouveau_framebuffer *fb;
+ struct nouveau_channel *chan;
+ struct nouveau_bo *nvbo;
+- struct drm_mode_fb_cmd2 mode_cmd;
++ struct drm_mode_fb_cmd2 mode_cmd = {};
+ int ret;
+
+ mode_cmd.width = sizes->surface_width;
+@@ -599,6 +599,7 @@ fini:
+ drm_fb_helper_fini(&fbcon->helper);
+ free:
+ kfree(fbcon);
++ drm->fbcon = NULL;
+ return ret;
+ }
+
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 3bf1f9ef8ea2..c83361a8e203 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -1249,6 +1249,8 @@ channel_message_table[CHANNELMSG_COUNT] = {
+ { CHANNELMSG_19, 0, NULL },
+ { CHANNELMSG_20, 0, NULL },
+ { CHANNELMSG_TL_CONNECT_REQUEST, 0, NULL },
++ { CHANNELMSG_22, 0, NULL },
++ { CHANNELMSG_TL_CONNECT_RESULT, 0, NULL },
+ };
+
+ /*
+@@ -1260,25 +1262,16 @@ void vmbus_onmessage(void *context)
+ {
+ struct hv_message *msg = context;
+ struct vmbus_channel_message_header *hdr;
+- int size;
+
+ hdr = (struct vmbus_channel_message_header *)msg->u.payload;
+- size = msg->header.payload_size;
+
+ trace_vmbus_on_message(hdr);
+
+- if (hdr->msgtype >= CHANNELMSG_COUNT) {
+- pr_err("Received invalid channel message type %d size %d\n",
+- hdr->msgtype, size);
+- print_hex_dump_bytes("", DUMP_PREFIX_NONE,
+- (unsigned char *)msg->u.payload, size);
+- return;
+- }
+-
+- if (channel_message_table[hdr->msgtype].message_handler)
+- channel_message_table[hdr->msgtype].message_handler(hdr);
+- else
+- pr_err("Unhandled channel message type %d\n", hdr->msgtype);
++ /*
++ * vmbus_on_msg_dpc() makes sure the hdr->msgtype here can not go
++ * out of bound and the message_handler pointer can not be NULL.
++ */
++ channel_message_table[hdr->msgtype].message_handler(hdr);
+ }
+
+ /*
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index fb22b72fd535..0699c6018889 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -939,6 +939,10 @@ void vmbus_on_msg_dpc(unsigned long data)
+ }
+
+ entry = &channel_message_table[hdr->msgtype];
++
++ if (!entry->message_handler)
++ goto msg_handled;
++
+ if (entry->handler_type == VMHT_BLOCKING) {
+ ctx = kmalloc(sizeof(*ctx), GFP_ATOMIC);
+ if (ctx == NULL)
+diff --git a/drivers/i2c/i2c-core-slave.c b/drivers/i2c/i2c-core-slave.c
+index 47a9f70a24a9..f2e7e373ee47 100644
+--- a/drivers/i2c/i2c-core-slave.c
++++ b/drivers/i2c/i2c-core-slave.c
+@@ -22,10 +22,8 @@ int i2c_slave_register(struct i2c_client *client, i2c_slave_cb_t slave_cb)
+ {
+ int ret;
+
+- if (!client || !slave_cb) {
+- WARN(1, "insufficient data\n");
++ if (WARN(IS_ERR_OR_NULL(client) || !slave_cb, "insufficient data\n"))
+ return -EINVAL;
+- }
+
+ if (!(client->flags & I2C_CLIENT_SLAVE))
+ dev_warn(&client->dev, "%s: client slave flag not set. You might see address collisions\n",
+@@ -64,6 +62,9 @@ int i2c_slave_unregister(struct i2c_client *client)
+ {
+ int ret;
+
++ if (IS_ERR_OR_NULL(client))
++ return -EINVAL;
++
+ if (!client->adapter->algo->unreg_slave) {
+ dev_err(&client->dev, "%s: not supported by adapter\n", __func__);
+ return -EOPNOTSUPP;
+diff --git a/drivers/leds/leds-88pm860x.c b/drivers/leds/leds-88pm860x.c
+index 77a104d2b124..13f414ff6fd0 100644
+--- a/drivers/leds/leds-88pm860x.c
++++ b/drivers/leds/leds-88pm860x.c
+@@ -207,21 +207,33 @@ static int pm860x_led_probe(struct platform_device *pdev)
+ data->cdev.brightness_set_blocking = pm860x_led_set;
+ mutex_init(&data->lock);
+
+- ret = devm_led_classdev_register(chip->dev, &data->cdev);
++ ret = led_classdev_register(chip->dev, &data->cdev);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Failed to register LED: %d\n", ret);
+ return ret;
+ }
+ pm860x_led_set(&data->cdev, 0);
++
++ platform_set_drvdata(pdev, data);
++
+ return 0;
+ }
+
++static int pm860x_led_remove(struct platform_device *pdev)
++{
++ struct pm860x_led *data = platform_get_drvdata(pdev);
++
++ led_classdev_unregister(&data->cdev);
++
++ return 0;
++}
+
+ static struct platform_driver pm860x_led_driver = {
+ .driver = {
+ .name = "88pm860x-led",
+ },
+ .probe = pm860x_led_probe,
++ .remove = pm860x_led_remove,
+ };
+
+ module_platform_driver(pm860x_led_driver);
+diff --git a/drivers/leds/leds-da903x.c b/drivers/leds/leds-da903x.c
+index 5ff7d72f73aa..ecc265bb69a0 100644
+--- a/drivers/leds/leds-da903x.c
++++ b/drivers/leds/leds-da903x.c
+@@ -113,12 +113,23 @@ static int da903x_led_probe(struct platform_device *pdev)
+ led->flags = pdata->flags;
+ led->master = pdev->dev.parent;
+
+- ret = devm_led_classdev_register(led->master, &led->cdev);
++ ret = led_classdev_register(led->master, &led->cdev);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to register LED %d\n", id);
+ return ret;
+ }
+
++ platform_set_drvdata(pdev, led);
++
++ return 0;
++}
++
++static int da903x_led_remove(struct platform_device *pdev)
++{
++ struct da903x_led *led = platform_get_drvdata(pdev);
++
++ led_classdev_unregister(&led->cdev);
++
+ return 0;
+ }
+
+@@ -127,6 +138,7 @@ static struct platform_driver da903x_led_driver = {
+ .name = "da903x-led",
+ },
+ .probe = da903x_led_probe,
++ .remove = da903x_led_remove,
+ };
+
+ module_platform_driver(da903x_led_driver);
+diff --git a/drivers/leds/leds-lm3533.c b/drivers/leds/leds-lm3533.c
+index 72224b599ffc..c1e562a4d6ad 100644
+--- a/drivers/leds/leds-lm3533.c
++++ b/drivers/leds/leds-lm3533.c
+@@ -698,7 +698,7 @@ static int lm3533_led_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, led);
+
+- ret = devm_led_classdev_register(pdev->dev.parent, &led->cdev);
++ ret = led_classdev_register(pdev->dev.parent, &led->cdev);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to register LED %d\n", pdev->id);
+ return ret;
+@@ -708,13 +708,18 @@ static int lm3533_led_probe(struct platform_device *pdev)
+
+ ret = lm3533_led_setup(led, pdata);
+ if (ret)
+- return ret;
++ goto err_deregister;
+
+ ret = lm3533_ctrlbank_enable(&led->cb);
+ if (ret)
+- return ret;
++ goto err_deregister;
+
+ return 0;
++
++err_deregister:
++ led_classdev_unregister(&led->cdev);
++
++ return ret;
+ }
+
+ static int lm3533_led_remove(struct platform_device *pdev)
+@@ -724,6 +729,7 @@ static int lm3533_led_remove(struct platform_device *pdev)
+ dev_dbg(&pdev->dev, "%s\n", __func__);
+
+ lm3533_ctrlbank_disable(&led->cb);
++ led_classdev_unregister(&led->cdev);
+
+ return 0;
+ }
+diff --git a/drivers/leds/leds-wm831x-status.c b/drivers/leds/leds-wm831x-status.c
+index c5798b92e4d3..d926edcb04ee 100644
+--- a/drivers/leds/leds-wm831x-status.c
++++ b/drivers/leds/leds-wm831x-status.c
+@@ -273,12 +273,23 @@ static int wm831x_status_probe(struct platform_device *pdev)
+ drvdata->cdev.blink_set = wm831x_status_blink_set;
+ drvdata->cdev.groups = wm831x_status_groups;
+
+- ret = devm_led_classdev_register(wm831x->dev, &drvdata->cdev);
++ ret = led_classdev_register(wm831x->dev, &drvdata->cdev);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Failed to register LED: %d\n", ret);
+ return ret;
+ }
+
++ platform_set_drvdata(pdev, drvdata);
++
++ return 0;
++}
++
++static int wm831x_status_remove(struct platform_device *pdev)
++{
++ struct wm831x_status *drvdata = platform_get_drvdata(pdev);
++
++ led_classdev_unregister(&drvdata->cdev);
++
+ return 0;
+ }
+
+@@ -287,6 +298,7 @@ static struct platform_driver wm831x_status_driver = {
+ .name = "wm831x-status",
+ },
+ .probe = wm831x_status_probe,
++ .remove = wm831x_status_remove,
+ };
+
+ module_platform_driver(wm831x_status_driver);
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index 02389528f622..5afc653c09e2 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -368,9 +368,6 @@ static int mtdchar_writeoob(struct file *file, struct mtd_info *mtd,
+ uint32_t retlen;
+ int ret = 0;
+
+- if (!(file->f_mode & FMODE_WRITE))
+- return -EPERM;
+-
+ if (length > 4096)
+ return -EINVAL;
+
+@@ -655,6 +652,48 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+
+ pr_debug("MTD_ioctl\n");
+
++ /*
++ * Check the file mode to require "dangerous" commands to have write
++ * permissions.
++ */
++ switch (cmd) {
++ /* "safe" commands */
++ case MEMGETREGIONCOUNT:
++ case MEMGETREGIONINFO:
++ case MEMGETINFO:
++ case MEMREADOOB:
++ case MEMREADOOB64:
++ case MEMLOCK:
++ case MEMUNLOCK:
++ case MEMISLOCKED:
++ case MEMGETOOBSEL:
++ case MEMGETBADBLOCK:
++ case MEMSETBADBLOCK:
++ case OTPSELECT:
++ case OTPGETREGIONCOUNT:
++ case OTPGETREGIONINFO:
++ case OTPLOCK:
++ case ECCGETLAYOUT:
++ case ECCGETSTATS:
++ case MTDFILEMODE:
++ case BLKPG:
++ case BLKRRPART:
++ break;
++
++ /* "dangerous" commands */
++ case MEMERASE:
++ case MEMERASE64:
++ case MEMWRITEOOB:
++ case MEMWRITEOOB64:
++ case MEMWRITE:
++ if (!(file->f_mode & FMODE_WRITE))
++ return -EPERM;
++ break;
++
++ default:
++ return -ENOTTY;
++ }
++
+ switch (cmd) {
+ case MEMGETREGIONCOUNT:
+ if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int)))
+@@ -702,9 +741,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ {
+ struct erase_info *erase;
+
+- if(!(file->f_mode & FMODE_WRITE))
+- return -EPERM;
+-
+ erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL);
+ if (!erase)
+ ret = -ENOMEM;
+@@ -997,9 +1033,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ ret = 0;
+ break;
+ }
+-
+- default:
+- ret = -ENOTTY;
+ }
+
+ return ret;
+@@ -1043,6 +1076,11 @@ static long mtdchar_compat_ioctl(struct file *file, unsigned int cmd,
+ struct mtd_oob_buf32 buf;
+ struct mtd_oob_buf32 __user *buf_user = argp;
+
++ if (!(file->f_mode & FMODE_WRITE)) {
++ ret = -EPERM;
++ break;
++ }
++
+ if (copy_from_user(&buf, argp, sizeof(buf)))
+ ret = -EFAULT;
+ else
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+index dca02b35c231..99eea9e6a8ea 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -2015,11 +2015,11 @@ static void nicvf_set_rx_mode_task(struct work_struct *work_arg)
+ /* Save message data locally to prevent them from
+ * being overwritten by next ndo_set_rx_mode call().
+ */
+- spin_lock(&nic->rx_mode_wq_lock);
++ spin_lock_bh(&nic->rx_mode_wq_lock);
+ mode = vf_work->mode;
+ mc = vf_work->mc;
+ vf_work->mc = NULL;
+- spin_unlock(&nic->rx_mode_wq_lock);
++ spin_unlock_bh(&nic->rx_mode_wq_lock);
+
+ __nicvf_set_rx_mode_task(mode, mc, nic);
+ }
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 6a677fd540d6..bc4eda52372a 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -181,7 +181,7 @@ static inline bool i40e_vc_isvalid_vsi_id(struct i40e_vf *vf, u16 vsi_id)
+ * check for the valid queue id
+ **/
+ static inline bool i40e_vc_isvalid_queue_id(struct i40e_vf *vf, u16 vsi_id,
+- u8 qid)
++ u16 qid)
+ {
+ struct i40e_pf *pf = vf->pf;
+ struct i40e_vsi *vsi = i40e_find_vsi_from_id(pf, vsi_id);
+@@ -196,7 +196,7 @@ static inline bool i40e_vc_isvalid_queue_id(struct i40e_vf *vf, u16 vsi_id,
+ *
+ * check for the valid vector id
+ **/
+-static inline bool i40e_vc_isvalid_vector_id(struct i40e_vf *vf, u8 vector_id)
++static inline bool i40e_vc_isvalid_vector_id(struct i40e_vf *vf, u32 vector_id)
+ {
+ struct i40e_pf *pf = vf->pf;
+
+@@ -441,14 +441,28 @@ static int i40e_config_iwarp_qvlist(struct i40e_vf *vf,
+ u32 v_idx, i, reg_idx, reg;
+ u32 next_q_idx, next_q_type;
+ u32 msix_vf, size;
++ int ret = 0;
++
++ msix_vf = pf->hw.func_caps.num_msix_vectors_vf;
++
++ if (qvlist_info->num_vectors > msix_vf) {
++ dev_warn(&pf->pdev->dev,
++ "Incorrect number of iwarp vectors %u. Maximum %u allowed.\n",
++ qvlist_info->num_vectors,
++ msix_vf);
++ ret = -EINVAL;
++ goto err_out;
++ }
+
+ size = sizeof(struct virtchnl_iwarp_qvlist_info) +
+ (sizeof(struct virtchnl_iwarp_qv_info) *
+ (qvlist_info->num_vectors - 1));
++ kfree(vf->qvlist_info);
+ vf->qvlist_info = kzalloc(size, GFP_KERNEL);
+- if (!vf->qvlist_info)
+- return -ENOMEM;
+-
++ if (!vf->qvlist_info) {
++ ret = -ENOMEM;
++ goto err_out;
++ }
+ vf->qvlist_info->num_vectors = qvlist_info->num_vectors;
+
+ msix_vf = pf->hw.func_caps.num_msix_vectors_vf;
+@@ -459,8 +473,10 @@ static int i40e_config_iwarp_qvlist(struct i40e_vf *vf,
+ v_idx = qv_info->v_idx;
+
+ /* Validate vector id belongs to this vf */
+- if (!i40e_vc_isvalid_vector_id(vf, v_idx))
+- goto err;
++ if (!i40e_vc_isvalid_vector_id(vf, v_idx)) {
++ ret = -EINVAL;
++ goto err_free;
++ }
+
+ vf->qvlist_info->qv_info[i] = *qv_info;
+
+@@ -502,10 +518,11 @@ static int i40e_config_iwarp_qvlist(struct i40e_vf *vf,
+ }
+
+ return 0;
+-err:
++err_free:
+ kfree(vf->qvlist_info);
+ vf->qvlist_info = NULL;
+- return -EINVAL;
++err_out:
++ return ret;
+ }
+
+ /**
+@@ -3335,7 +3352,7 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg)
+
+ if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
+ aq_ret = I40E_ERR_PARAM;
+- goto err;
++ goto err_out;
+ }
+
+ if (!vf->adq_enabled) {
+@@ -3343,15 +3360,15 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg)
+ "VF %d: ADq is not enabled, can't apply cloud filter\n",
+ vf->vf_id);
+ aq_ret = I40E_ERR_PARAM;
+- goto err;
++ goto err_out;
+ }
+
+ if (i40e_validate_cloud_filter(vf, vcf)) {
+ dev_info(&pf->pdev->dev,
+ "VF %d: Invalid input/s, can't apply cloud filter\n",
+ vf->vf_id);
+- aq_ret = I40E_ERR_PARAM;
+- goto err;
++ aq_ret = I40E_ERR_PARAM;
++ goto err_out;
+ }
+
+ cfilter = kzalloc(sizeof(*cfilter), GFP_KERNEL);
+@@ -3412,13 +3429,17 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg)
+ "VF %d: Failed to add cloud filter, err %s aq_err %s\n",
+ vf->vf_id, i40e_stat_str(&pf->hw, ret),
+ i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
+- goto err;
++ goto err_free;
+ }
+
+ INIT_HLIST_NODE(&cfilter->cloud_node);
+ hlist_add_head(&cfilter->cloud_node, &vf->cloud_filter_list);
++ /* release the pointer passing it to the collection */
++ cfilter = NULL;
+ vf->num_cloud_filters++;
+-err:
++err_free:
++ kfree(cfilter);
++err_out:
+ return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_ADD_CLOUD_FILTER,
+ aq_ret);
+ }
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 36db874f3c92..d85eb80d8249 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -6226,9 +6226,18 @@ static void igb_reset_task(struct work_struct *work)
+ struct igb_adapter *adapter;
+ adapter = container_of(work, struct igb_adapter, reset_task);
+
++ rtnl_lock();
++ /* If we're already down or resetting, just bail */
++ if (test_bit(__IGB_DOWN, &adapter->state) ||
++ test_bit(__IGB_RESETTING, &adapter->state)) {
++ rtnl_unlock();
++ return;
++ }
++
+ igb_dump(adapter);
+ netdev_err(adapter->netdev, "Reset adapter\n");
+ igb_reinit_locked(adapter);
++ rtnl_unlock();
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 1d55f014725e..b72a4fad7bc8 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -2452,6 +2452,8 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
+ eth->netdev[id]->irq = eth->irq[0];
+ eth->netdev[id]->dev.of_node = np;
+
++ eth->netdev[id]->max_mtu = MTK_MAX_RX_LENGTH - MTK_RX_ETH_HLEN;
++
+ return 0;
+
+ free_netdev:
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index bdb55db4523b..e33cbb793b63 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -543,12 +543,13 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net)
+ u32 hash;
+ struct hv_page_buffer pb[MAX_PAGE_BUFFER_COUNT];
+
+- /* if VF is present and up then redirect packets
+- * already called with rcu_read_lock_bh
++ /* If VF is present and up then redirect packets to it.
++ * Skip the VF if it is marked down or has no carrier.
++ * If netpoll is in uses, then VF can not be used either.
+ */
+ vf_netdev = rcu_dereference_bh(net_device_ctx->vf_netdev);
+ if (vf_netdev && netif_running(vf_netdev) &&
+- !netpoll_tx_running(net))
++ netif_carrier_ok(vf_netdev) && !netpoll_tx_running(net))
+ return netvsc_vf_xmit(net, vf_netdev, skb);
+
+ /* We will atmost need two pages to describe the rndis
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index 61b9d3368148..bff268b4a9a4 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -2274,12 +2274,14 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
+
+ minor = get_free_serial_index();
+ if (minor < 0)
+- goto exit;
++ goto exit2;
+
+ /* register our minor number */
+ serial->parent->dev = tty_port_register_device_attr(&serial->port,
+ tty_drv, minor, &serial->parent->interface->dev,
+ serial->parent, hso_serial_dev_groups);
++ if (IS_ERR(serial->parent->dev))
++ goto exit2;
+
+ /* fill in specific data for later use */
+ serial->minor = minor;
+@@ -2324,6 +2326,7 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
+ return 0;
+ exit:
+ hso_serial_tty_unregister(serial);
++exit2:
+ hso_serial_common_free(serial);
+ return -1;
+ }
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index d198f36785a4..5bd07cdb3e6e 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -388,10 +388,6 @@ struct lan78xx_net {
+ struct tasklet_struct bh;
+ struct delayed_work wq;
+
+- struct usb_host_endpoint *ep_blkin;
+- struct usb_host_endpoint *ep_blkout;
+- struct usb_host_endpoint *ep_intr;
+-
+ int msg_enable;
+
+ struct urb *urb_intr;
+@@ -2883,78 +2879,12 @@ lan78xx_start_xmit(struct sk_buff *skb, struct net_device *net)
+ return NETDEV_TX_OK;
+ }
+
+-static int
+-lan78xx_get_endpoints(struct lan78xx_net *dev, struct usb_interface *intf)
+-{
+- int tmp;
+- struct usb_host_interface *alt = NULL;
+- struct usb_host_endpoint *in = NULL, *out = NULL;
+- struct usb_host_endpoint *status = NULL;
+-
+- for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
+- unsigned ep;
+-
+- in = NULL;
+- out = NULL;
+- status = NULL;
+- alt = intf->altsetting + tmp;
+-
+- for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
+- struct usb_host_endpoint *e;
+- int intr = 0;
+-
+- e = alt->endpoint + ep;
+- switch (e->desc.bmAttributes) {
+- case USB_ENDPOINT_XFER_INT:
+- if (!usb_endpoint_dir_in(&e->desc))
+- continue;
+- intr = 1;
+- /* FALLTHROUGH */
+- case USB_ENDPOINT_XFER_BULK:
+- break;
+- default:
+- continue;
+- }
+- if (usb_endpoint_dir_in(&e->desc)) {
+- if (!intr && !in)
+- in = e;
+- else if (intr && !status)
+- status = e;
+- } else {
+- if (!out)
+- out = e;
+- }
+- }
+- if (in && out)
+- break;
+- }
+- if (!alt || !in || !out)
+- return -EINVAL;
+-
+- dev->pipe_in = usb_rcvbulkpipe(dev->udev,
+- in->desc.bEndpointAddress &
+- USB_ENDPOINT_NUMBER_MASK);
+- dev->pipe_out = usb_sndbulkpipe(dev->udev,
+- out->desc.bEndpointAddress &
+- USB_ENDPOINT_NUMBER_MASK);
+- dev->ep_intr = status;
+-
+- return 0;
+-}
+-
+ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
+ {
+ struct lan78xx_priv *pdata = NULL;
+ int ret;
+ int i;
+
+- ret = lan78xx_get_endpoints(dev, intf);
+- if (ret) {
+- netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n",
+- ret);
+- return ret;
+- }
+-
+ dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL);
+
+ pdata = (struct lan78xx_priv *)(dev->data[0]);
+@@ -3726,6 +3656,7 @@ static void lan78xx_stat_monitor(struct timer_list *t)
+ static int lan78xx_probe(struct usb_interface *intf,
+ const struct usb_device_id *id)
+ {
++ struct usb_host_endpoint *ep_blkin, *ep_blkout, *ep_intr;
+ struct lan78xx_net *dev;
+ struct net_device *netdev;
+ struct usb_device *udev;
+@@ -3774,6 +3705,34 @@ static int lan78xx_probe(struct usb_interface *intf,
+
+ mutex_init(&dev->stats.access_lock);
+
++ if (intf->cur_altsetting->desc.bNumEndpoints < 3) {
++ ret = -ENODEV;
++ goto out2;
++ }
++
++ dev->pipe_in = usb_rcvbulkpipe(udev, BULK_IN_PIPE);
++ ep_blkin = usb_pipe_endpoint(udev, dev->pipe_in);
++ if (!ep_blkin || !usb_endpoint_is_bulk_in(&ep_blkin->desc)) {
++ ret = -ENODEV;
++ goto out2;
++ }
++
++ dev->pipe_out = usb_sndbulkpipe(udev, BULK_OUT_PIPE);
++ ep_blkout = usb_pipe_endpoint(udev, dev->pipe_out);
++ if (!ep_blkout || !usb_endpoint_is_bulk_out(&ep_blkout->desc)) {
++ ret = -ENODEV;
++ goto out2;
++ }
++
++ ep_intr = &intf->cur_altsetting->endpoint[2];
++ if (!usb_endpoint_is_int_in(&ep_intr->desc)) {
++ ret = -ENODEV;
++ goto out2;
++ }
++
++ dev->pipe_intr = usb_rcvintpipe(dev->udev,
++ usb_endpoint_num(&ep_intr->desc));
++
+ ret = lan78xx_bind(dev, intf);
+ if (ret < 0)
+ goto out2;
+@@ -3786,23 +3745,7 @@ static int lan78xx_probe(struct usb_interface *intf,
+ netdev->max_mtu = MAX_SINGLE_PACKET_SIZE;
+ netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
+
+- if (intf->cur_altsetting->desc.bNumEndpoints < 3) {
+- ret = -ENODEV;
+- goto out3;
+- }
+-
+- dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;
+- dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;
+- dev->ep_intr = (intf->cur_altsetting)->endpoint + 2;
+-
+- dev->pipe_in = usb_rcvbulkpipe(udev, BULK_IN_PIPE);
+- dev->pipe_out = usb_sndbulkpipe(udev, BULK_OUT_PIPE);
+-
+- dev->pipe_intr = usb_rcvintpipe(dev->udev,
+- dev->ep_intr->desc.bEndpointAddress &
+- USB_ENDPOINT_NUMBER_MASK);
+- period = dev->ep_intr->desc.bInterval;
+-
++ period = ep_intr->desc.bInterval;
+ maxp = usb_maxpacket(dev->udev, dev->pipe_intr, 0);
+ buf = kmalloc(maxp, GFP_KERNEL);
+ if (buf) {
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 09f0b53b2b77..abf85f0ab72f 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -975,6 +975,7 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
+ for (h = 0; h < FDB_HASH_SIZE; ++h) {
+ struct vxlan_fdb *f;
+
++ rcu_read_lock();
+ hlist_for_each_entry_rcu(f, &vxlan->fdb_head[h], hlist) {
+ struct vxlan_rdst *rd;
+
+@@ -987,12 +988,15 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
+ cb->nlh->nlmsg_seq,
+ RTM_NEWNEIGH,
+ NLM_F_MULTI, rd);
+- if (err < 0)
++ if (err < 0) {
++ rcu_read_unlock();
+ goto out;
++ }
+ skip:
+ *idx += 1;
+ }
+ }
++ rcu_read_unlock();
+ }
+ out:
+ return err;
+@@ -2219,7 +2223,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ ndst = &rt->dst;
+ skb_tunnel_check_pmtu(skb, ndst, VXLAN_HEADROOM);
+
+- tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb);
++ tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+ ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
+ err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
+ vni, md, flags, udp_sum);
+@@ -2256,7 +2260,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+
+ skb_tunnel_check_pmtu(skb, ndst, VXLAN6_HEADROOM);
+
+- tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb);
++ tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+ ttl = ttl ? : ip6_dst_hoplimit(ndst);
+ skb_scrub_packet(skb, xnet);
+ err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr),
+diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
+index e3df4bf521b5..a97bbd89fae2 100644
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -95,6 +95,15 @@ static DEFINE_MUTEX(ashmem_mutex);
+ static struct kmem_cache *ashmem_area_cachep __read_mostly;
+ static struct kmem_cache *ashmem_range_cachep __read_mostly;
+
++/*
++ * A separate lockdep class for the backing shmem inodes to resolve the lockdep
++ * warning about the race between kswapd taking fs_reclaim before inode_lock
++ * and write syscall taking inode_lock and then fs_reclaim.
++ * Note that such race is impossible because ashmem does not support write
++ * syscalls operating on the backing shmem.
++ */
++static struct lock_class_key backing_shmem_inode_class;
++
+ static inline unsigned long range_size(struct ashmem_range *range)
+ {
+ return range->pgend - range->pgstart + 1;
+@@ -395,6 +404,7 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
+ if (!asma->file) {
+ char *name = ASHMEM_NAME_DEF;
+ struct file *vmfile;
++ struct inode *inode;
+
+ if (asma->name[ASHMEM_NAME_PREFIX_LEN] != '\0')
+ name = asma->name;
+@@ -406,6 +416,8 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
+ goto out;
+ }
+ vmfile->f_mode |= FMODE_LSEEK;
++ inode = file_inode(vmfile);
++ lockdep_set_class(&inode->i_rwsem, &backing_shmem_inode_class);
+ asma->file = vmfile;
+ /*
+ * override mmap operation of the vmfile so that it can't be
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 9b02e3e3f998..1a6a23e57201 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -47,7 +47,10 @@
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc
++#define PCI_DEVICE_ID_ASMEDIA_1042_XHCI 0x1042
+ #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142
++#define PCI_DEVICE_ID_ASMEDIA_1142_XHCI 0x1242
++#define PCI_DEVICE_ID_ASMEDIA_2142_XHCI 0x2142
+
+ static const char hcd_name[] = "xhci_hcd";
+
+@@ -226,13 +229,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_BROKEN_STREAMS;
+
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+- pdev->device == 0x1042)
++ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI)
+ xhci->quirks |= XHCI_BROKEN_STREAMS;
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+- pdev->device == 0x1142)
++ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI)
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+- pdev->device == 0x2142)
++ (pdev->device == PCI_DEVICE_ID_ASMEDIA_1142_XHCI ||
++ pdev->device == PCI_DEVICE_ID_ASMEDIA_2142_XHCI))
+ xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
+
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index 92875a264b14..9c1ca20d4139 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -2,8 +2,9 @@
+ /*
+ * Native support for the I/O-Warrior USB devices
+ *
+- * Copyright (c) 2003-2005 Code Mercenaries GmbH
+- * written by Christian Lucht <lucht@codemercs.com>
++ * Copyright (c) 2003-2005, 2020 Code Mercenaries GmbH
++ * written by Christian Lucht <lucht@codemercs.com> and
++ * Christoph Jung <jung@codemercs.com>
+ *
+ * based on
+
+@@ -817,14 +818,28 @@ static int iowarrior_probe(struct usb_interface *interface,
+
+ /* we have to check the report_size often, so remember it in the endianness suitable for our machine */
+ dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
+- if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&
+- ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) ||
+- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) ||
+- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) ||
+- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L) ||
+- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW100)))
+- /* IOWarrior56 has wMaxPacketSize different from report size */
+- dev->report_size = 7;
++
++ /*
++ * Some devices need the report size to be different than the
++ * endpoint size.
++ */
++ if (dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) {
++ switch (dev->product_id) {
++ case USB_DEVICE_ID_CODEMERCS_IOW56:
++ case USB_DEVICE_ID_CODEMERCS_IOW56AM:
++ dev->report_size = 7;
++ break;
++
++ case USB_DEVICE_ID_CODEMERCS_IOW28:
++ case USB_DEVICE_ID_CODEMERCS_IOW28L:
++ dev->report_size = 4;
++ break;
++
++ case USB_DEVICE_ID_CODEMERCS_IOW100:
++ dev->report_size = 13;
++ break;
++ }
++ }
+
+ /* create the urb and buffer for reading */
+ dev->int_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index d147feae83e6..0f60363c1bbc 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -155,6 +155,7 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x1199, 0x9056)}, /* Sierra Wireless Modem */
+ {DEVICE_SWI(0x1199, 0x9060)}, /* Sierra Wireless Modem */
+ {DEVICE_SWI(0x1199, 0x9061)}, /* Sierra Wireless Modem */
++ {DEVICE_SWI(0x1199, 0x9062)}, /* Sierra Wireless EM7305 QDL */
+ {DEVICE_SWI(0x1199, 0x9063)}, /* Sierra Wireless EM7305 */
+ {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx */
+ {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx */
+diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
+index bfaa9ec4bc1f..e079b910feb2 100644
+--- a/drivers/video/console/vgacon.c
++++ b/drivers/video/console/vgacon.c
+@@ -251,6 +251,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
+ p = (void *) (c->vc_origin + t * c->vc_size_row);
+
+ while (count--) {
++ if ((vgacon_scrollback_cur->tail + c->vc_size_row) >
++ vgacon_scrollback_cur->size)
++ vgacon_scrollback_cur->tail = 0;
++
+ scr_memcpyw(vgacon_scrollback_cur->data +
+ vgacon_scrollback_cur->tail,
+ p, c->vc_size_row);
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss.c b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
+index f0cac9e0eb94..b6c6c24979dd 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
+@@ -844,7 +844,7 @@ static const struct dss_features omap34xx_dss_feats = {
+ };
+
+ static const struct dss_features omap3630_dss_feats = {
+- .fck_div_max = 32,
++ .fck_div_max = 31,
+ .dss_fck_multiplier = 1,
+ .parent_clk_name = "dpll4_ck",
+ .dpi_select_source = &dss_dpi_select_source_omap2_omap3,
+diff --git a/fs/xattr.c b/fs/xattr.c
+index 0d6a6a4af861..470ee0af3200 100644
+--- a/fs/xattr.c
++++ b/fs/xattr.c
+@@ -203,10 +203,22 @@ int __vfs_setxattr_noperm(struct dentry *dentry, const char *name,
+ return error;
+ }
+
+-
++/**
++ * __vfs_setxattr_locked: set an extended attribute while holding the inode
++ * lock
++ *
++ * @dentry - object to perform setxattr on
++ * @name - xattr name to set
++ * @value - value to set @name to
++ * @size - size of @value
++ * @flags - flags to pass into filesystem operations
++ * @delegated_inode - on return, will contain an inode pointer that
++ * a delegation was broken on, NULL if none.
++ */
+ int
+-vfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+- size_t size, int flags)
++__vfs_setxattr_locked(struct dentry *dentry, const char *name,
++ const void *value, size_t size, int flags,
++ struct inode **delegated_inode)
+ {
+ struct inode *inode = dentry->d_inode;
+ int error;
+@@ -215,15 +227,40 @@ vfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ if (error)
+ return error;
+
+- inode_lock(inode);
+ error = security_inode_setxattr(dentry, name, value, size, flags);
+ if (error)
+ goto out;
+
++ error = try_break_deleg(inode, delegated_inode);
++ if (error)
++ goto out;
++
+ error = __vfs_setxattr_noperm(dentry, name, value, size, flags);
+
+ out:
++ return error;
++}
++EXPORT_SYMBOL_GPL(__vfs_setxattr_locked);
++
++int
++vfs_setxattr(struct dentry *dentry, const char *name, const void *value,
++ size_t size, int flags)
++{
++ struct inode *inode = dentry->d_inode;
++ struct inode *delegated_inode = NULL;
++ int error;
++
++retry_deleg:
++ inode_lock(inode);
++ error = __vfs_setxattr_locked(dentry, name, value, size, flags,
++ &delegated_inode);
+ inode_unlock(inode);
++
++ if (delegated_inode) {
++ error = break_deleg_wait(&delegated_inode);
++ if (!error)
++ goto retry_deleg;
++ }
+ return error;
+ }
+ EXPORT_SYMBOL_GPL(vfs_setxattr);
+@@ -377,8 +414,18 @@ __vfs_removexattr(struct dentry *dentry, const char *name)
+ }
+ EXPORT_SYMBOL(__vfs_removexattr);
+
++/**
++ * __vfs_removexattr_locked: set an extended attribute while holding the inode
++ * lock
++ *
++ * @dentry - object to perform setxattr on
++ * @name - name of xattr to remove
++ * @delegated_inode - on return, will contain an inode pointer that
++ * a delegation was broken on, NULL if none.
++ */
+ int
+-vfs_removexattr(struct dentry *dentry, const char *name)
++__vfs_removexattr_locked(struct dentry *dentry, const char *name,
++ struct inode **delegated_inode)
+ {
+ struct inode *inode = dentry->d_inode;
+ int error;
+@@ -387,11 +434,14 @@ vfs_removexattr(struct dentry *dentry, const char *name)
+ if (error)
+ return error;
+
+- inode_lock(inode);
+ error = security_inode_removexattr(dentry, name);
+ if (error)
+ goto out;
+
++ error = try_break_deleg(inode, delegated_inode);
++ if (error)
++ goto out;
++
+ error = __vfs_removexattr(dentry, name);
+
+ if (!error) {
+@@ -400,12 +450,32 @@ vfs_removexattr(struct dentry *dentry, const char *name)
+ }
+
+ out:
++ return error;
++}
++EXPORT_SYMBOL_GPL(__vfs_removexattr_locked);
++
++int
++vfs_removexattr(struct dentry *dentry, const char *name)
++{
++ struct inode *inode = dentry->d_inode;
++ struct inode *delegated_inode = NULL;
++ int error;
++
++retry_deleg:
++ inode_lock(inode);
++ error = __vfs_removexattr_locked(dentry, name, &delegated_inode);
+ inode_unlock(inode);
++
++ if (delegated_inode) {
++ error = break_deleg_wait(&delegated_inode);
++ if (!error)
++ goto retry_deleg;
++ }
++
+ return error;
+ }
+ EXPORT_SYMBOL_GPL(vfs_removexattr);
+
+-
+ /*
+ * Extended attribute SET operations
+ */
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index c43e694fef7d..35461d49d3ae 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -428,6 +428,8 @@ enum vmbus_channel_message_type {
+ CHANNELMSG_19 = 19,
+ CHANNELMSG_20 = 20,
+ CHANNELMSG_TL_CONNECT_REQUEST = 21,
++ CHANNELMSG_22 = 22,
++ CHANNELMSG_TL_CONNECT_RESULT = 23,
+ CHANNELMSG_COUNT
+ };
+
+diff --git a/include/linux/xattr.h b/include/linux/xattr.h
+index 6dad031be3c2..3a71ad716da5 100644
+--- a/include/linux/xattr.h
++++ b/include/linux/xattr.h
+@@ -51,8 +51,10 @@ ssize_t vfs_getxattr(struct dentry *, const char *, void *, size_t);
+ ssize_t vfs_listxattr(struct dentry *d, char *list, size_t size);
+ int __vfs_setxattr(struct dentry *, struct inode *, const char *, const void *, size_t, int);
+ int __vfs_setxattr_noperm(struct dentry *, const char *, const void *, size_t, int);
++int __vfs_setxattr_locked(struct dentry *, const char *, const void *, size_t, int, struct inode **);
+ int vfs_setxattr(struct dentry *, const char *, const void *, size_t, int);
+ int __vfs_removexattr(struct dentry *, const char *);
++int __vfs_removexattr_locked(struct dentry *, const char *, struct inode **);
+ int vfs_removexattr(struct dentry *, const char *);
+
+ ssize_t generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size);
+diff --git a/include/net/addrconf.h b/include/net/addrconf.h
+index c8d5bb8b3616..db2a87981dd4 100644
+--- a/include/net/addrconf.h
++++ b/include/net/addrconf.h
+@@ -305,6 +305,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex,
+ const struct in6_addr *addr);
+ int ipv6_sock_ac_drop(struct sock *sk, int ifindex,
+ const struct in6_addr *addr);
++void __ipv6_sock_ac_close(struct sock *sk);
+ void ipv6_sock_ac_close(struct sock *sk);
+
+ int __ipv6_dev_ac_inc(struct inet6_dev *idev, const struct in6_addr *addr);
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index d28c2cc9618f..b6dcb40fa8a7 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -831,20 +831,28 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
+ return -ENOMEM;
+
+ ts->rd = fget(rfd);
++ if (!ts->rd)
++ goto out_free_ts;
++ if (!(ts->rd->f_mode & FMODE_READ))
++ goto out_put_rd;
+ ts->wr = fget(wfd);
+- if (!ts->rd || !ts->wr) {
+- if (ts->rd)
+- fput(ts->rd);
+- if (ts->wr)
+- fput(ts->wr);
+- kfree(ts);
+- return -EIO;
+- }
++ if (!ts->wr)
++ goto out_put_rd;
++ if (!(ts->wr->f_mode & FMODE_WRITE))
++ goto out_put_wr;
+
+ client->trans = ts;
+ client->status = Connected;
+
+ return 0;
++
++out_put_wr:
++ fput(ts->wr);
++out_put_rd:
++ fput(ts->rd);
++out_free_ts:
++ kfree(ts);
++ return -EIO;
+ }
+
+ static int p9_socket_open(struct p9_client *client, struct socket *csocket)
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index cdb92b129906..2b4a7cf03041 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -2360,7 +2360,7 @@ static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
+
+ BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
+
+- if (!num_rsp)
++ if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
+ return;
+
+ if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
+@@ -3948,6 +3948,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
+ struct inquiry_info_with_rssi_and_pscan_mode *info;
+ info = (void *) (skb->data + 1);
+
++ if (skb->len < num_rsp * sizeof(*info) + 1)
++ goto unlock;
++
+ for (; num_rsp; num_rsp--, info++) {
+ u32 flags;
+
+@@ -3969,6 +3972,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
+ } else {
+ struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
+
++ if (skb->len < num_rsp * sizeof(*info) + 1)
++ goto unlock;
++
+ for (; num_rsp; num_rsp--, info++) {
+ u32 flags;
+
+@@ -3989,6 +3995,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
+ }
+ }
+
++unlock:
+ hci_dev_unlock(hdev);
+ }
+
+@@ -4151,7 +4158,7 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
+
+ BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
+
+- if (!num_rsp)
++ if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
+ return;
+
+ if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 3047fc4737c4..48d7125501b4 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1749,7 +1749,7 @@ struct fib_table *fib_trie_unmerge(struct fib_table *oldtb)
+ while ((l = leaf_walk_rcu(&tp, key)) != NULL) {
+ struct key_vector *local_l = NULL, *local_tp;
+
+- hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) {
++ hlist_for_each_entry(fa, &l->leaf, fa_list) {
+ struct fib_alias *new_fa;
+
+ if (local_tb->tb_id != fa->tb_id)
+diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
+index 6c63524f598a..89c613f19566 100644
+--- a/net/ipv4/gre_offload.c
++++ b/net/ipv4/gre_offload.c
+@@ -19,12 +19,12 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
+ netdev_features_t features)
+ {
+ int tnl_hlen = skb_inner_mac_header(skb) - skb_transport_header(skb);
++ bool need_csum, need_recompute_csum, gso_partial;
+ struct sk_buff *segs = ERR_PTR(-EINVAL);
+ u16 mac_offset = skb->mac_header;
+ __be16 protocol = skb->protocol;
+ u16 mac_len = skb->mac_len;
+ int gre_offset, outer_hlen;
+- bool need_csum, gso_partial;
+
+ if (!skb->encapsulation)
+ goto out;
+@@ -45,6 +45,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
+ skb->protocol = skb->inner_protocol;
+
+ need_csum = !!(skb_shinfo(skb)->gso_type & SKB_GSO_GRE_CSUM);
++ need_recompute_csum = skb->csum_not_inet;
+ skb->encap_hdr_csum = need_csum;
+
+ features &= skb->dev->hw_enc_features;
+@@ -102,7 +103,15 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
+ }
+
+ *(pcsum + 1) = 0;
+- *pcsum = gso_make_checksum(skb, 0);
++ if (need_recompute_csum && !skb_is_gso(skb)) {
++ __wsum csum;
++
++ csum = skb_checksum(skb, gre_offset,
++ skb->len - gre_offset, 0);
++ *pcsum = csum_fold(csum);
++ } else {
++ *pcsum = gso_make_checksum(skb, 0);
++ }
+ } while ((skb = skb->next));
+ out:
+ return segs;
+diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
+index 4e0ff7031edd..55fbe330471c 100644
+--- a/net/ipv6/anycast.c
++++ b/net/ipv6/anycast.c
+@@ -173,7 +173,7 @@ int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
+ return 0;
+ }
+
+-void ipv6_sock_ac_close(struct sock *sk)
++void __ipv6_sock_ac_close(struct sock *sk)
+ {
+ struct ipv6_pinfo *np = inet6_sk(sk);
+ struct net_device *dev = NULL;
+@@ -181,10 +181,7 @@ void ipv6_sock_ac_close(struct sock *sk)
+ struct net *net = sock_net(sk);
+ int prev_index;
+
+- if (!np->ipv6_ac_list)
+- return;
+-
+- rtnl_lock();
++ ASSERT_RTNL();
+ pac = np->ipv6_ac_list;
+ np->ipv6_ac_list = NULL;
+
+@@ -201,6 +198,16 @@ void ipv6_sock_ac_close(struct sock *sk)
+ sock_kfree_s(sk, pac, sizeof(*pac));
+ pac = next;
+ }
++}
++
++void ipv6_sock_ac_close(struct sock *sk)
++{
++ struct ipv6_pinfo *np = inet6_sk(sk);
++
++ if (!np->ipv6_ac_list)
++ return;
++ rtnl_lock();
++ __ipv6_sock_ac_close(sk);
+ rtnl_unlock();
+ }
+
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index aa54303c43a6..4e1da6cb9ed7 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -207,6 +207,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+
+ fl6_free_socklist(sk);
+ __ipv6_sock_mc_close(sk);
++ __ipv6_sock_ac_close(sk);
+
+ /*
+ * Sock is moving from IPv6 to IPv4 (sk_prot), so
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 6dcb59f272e1..f8e073ef1a67 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -283,10 +283,6 @@ void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
+ ovs_ct_update_key(skb, NULL, key, false, false);
+ }
+
+-#define IN6_ADDR_INITIALIZER(ADDR) \
+- { (ADDR).s6_addr32[0], (ADDR).s6_addr32[1], \
+- (ADDR).s6_addr32[2], (ADDR).s6_addr32[3] }
+-
+ int ovs_ct_put_key(const struct sw_flow_key *swkey,
+ const struct sw_flow_key *output, struct sk_buff *skb)
+ {
+@@ -308,24 +304,30 @@ int ovs_ct_put_key(const struct sw_flow_key *swkey,
+
+ if (swkey->ct_orig_proto) {
+ if (swkey->eth.type == htons(ETH_P_IP)) {
+- struct ovs_key_ct_tuple_ipv4 orig = {
+- output->ipv4.ct_orig.src,
+- output->ipv4.ct_orig.dst,
+- output->ct.orig_tp.src,
+- output->ct.orig_tp.dst,
+- output->ct_orig_proto,
+- };
++ struct ovs_key_ct_tuple_ipv4 orig;
++
++ memset(&orig, 0, sizeof(orig));
++ orig.ipv4_src = output->ipv4.ct_orig.src;
++ orig.ipv4_dst = output->ipv4.ct_orig.dst;
++ orig.src_port = output->ct.orig_tp.src;
++ orig.dst_port = output->ct.orig_tp.dst;
++ orig.ipv4_proto = output->ct_orig_proto;
++
+ if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4,
+ sizeof(orig), &orig))
+ return -EMSGSIZE;
+ } else if (swkey->eth.type == htons(ETH_P_IPV6)) {
+- struct ovs_key_ct_tuple_ipv6 orig = {
+- IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.src),
+- IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.dst),
+- output->ct.orig_tp.src,
+- output->ct.orig_tp.dst,
+- output->ct_orig_proto,
+- };
++ struct ovs_key_ct_tuple_ipv6 orig;
++
++ memset(&orig, 0, sizeof(orig));
++ memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32,
++ sizeof(orig.ipv6_src));
++ memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32,
++ sizeof(orig.ipv6_dst));
++ orig.src_port = output->ct.orig_tp.src;
++ orig.dst_port = output->ct.orig_tp.dst;
++ orig.ipv6_proto = output->ct_orig_proto;
++
+ if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6,
+ sizeof(orig), &orig))
+ return -EMSGSIZE;
+diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
+index 964c4e45de11..39f5fa3501ff 100644
+--- a/net/rxrpc/call_object.c
++++ b/net/rxrpc/call_object.c
+@@ -290,7 +290,7 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx,
+ */
+ ret = rxrpc_connect_call(rx, call, cp, srx, gfp);
+ if (ret < 0)
+- goto error;
++ goto error_attached_to_socket;
+
+ trace_rxrpc_call(call, rxrpc_call_connected, atomic_read(&call->usage),
+ here, NULL);
+@@ -310,18 +310,29 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx,
+ error_dup_user_ID:
+ write_unlock(&rx->call_lock);
+ release_sock(&rx->sk);
+- ret = -EEXIST;
+-
+-error:
+ __rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR,
+- RX_CALL_DEAD, ret);
++ RX_CALL_DEAD, -EEXIST);
+ trace_rxrpc_call(call, rxrpc_call_error, atomic_read(&call->usage),
+- here, ERR_PTR(ret));
++ here, ERR_PTR(-EEXIST));
+ rxrpc_release_call(rx, call);
+ mutex_unlock(&call->user_mutex);
+ rxrpc_put_call(call, rxrpc_call_put);
+- _leave(" = %d", ret);
+- return ERR_PTR(ret);
++ _leave(" = -EEXIST");
++ return ERR_PTR(-EEXIST);
++
++ /* We got an error, but the call is attached to the socket and is in
++ * need of release. However, we might now race with recvmsg() when
++ * completing the call queues it. Return 0 from sys_sendmsg() and
++ * leave the error to recvmsg() to deal with.
++ */
++error_attached_to_socket:
++ trace_rxrpc_call(call, rxrpc_call_error, atomic_read(&call->usage),
++ here, ERR_PTR(ret));
++ set_bit(RXRPC_CALL_DISCONNECTED, &call->flags);
++ __rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR,
++ RX_CALL_DEAD, ret);
++ _leave(" = c=%08x [err]", call->debug_id);
++ return call;
+ }
+
+ /*
+diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
+index c4c4450891e0..2adb7c5c8966 100644
+--- a/net/rxrpc/conn_object.c
++++ b/net/rxrpc/conn_object.c
+@@ -215,9 +215,11 @@ void rxrpc_disconnect_call(struct rxrpc_call *call)
+
+ call->peer->cong_cwnd = call->cong_cwnd;
+
+- spin_lock_bh(&conn->params.peer->lock);
+- hlist_del_rcu(&call->error_link);
+- spin_unlock_bh(&conn->params.peer->lock);
++ if (!hlist_unhashed(&call->error_link)) {
++ spin_lock_bh(&call->peer->lock);
++ hlist_del_rcu(&call->error_link);
++ spin_unlock_bh(&call->peer->lock);
++ }
+
+ if (rxrpc_is_client_call(call))
+ return rxrpc_disconnect_client_call(call);
+diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
+index 6e9d977f0797..e4fde33b887e 100644
+--- a/net/rxrpc/recvmsg.c
++++ b/net/rxrpc/recvmsg.c
+@@ -530,7 +530,7 @@ try_again:
+ goto error_unlock_call;
+ }
+
+- if (msg->msg_name) {
++ if (msg->msg_name && call->peer) {
+ struct sockaddr_rxrpc *srx = msg->msg_name;
+ size_t len = sizeof(call->peer->srx);
+
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index caee7632c257..edd76c41765f 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -654,6 +654,9 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
+ if (IS_ERR(call))
+ return PTR_ERR(call);
+ /* ... and we have the call lock. */
++ ret = 0;
++ if (READ_ONCE(call->state) == RXRPC_CALL_COMPLETE)
++ goto out_put_unlock;
+ } else {
+ switch (READ_ONCE(call->state)) {
+ case RXRPC_CALL_UNINITIALISED:
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 0221849b7218..996b68b48a87 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -12392,13 +12392,13 @@ static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
+ if (!wdev_running(wdev))
+ return -ENETDOWN;
+ }
+-
+- if (!vcmd->doit)
+- return -EOPNOTSUPP;
+ } else {
+ wdev = NULL;
+ }
+
++ if (!vcmd->doit)
++ return -EOPNOTSUPP;
++
+ if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
+ data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
+ len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index 371ae368da35..10ee51d04492 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -2746,7 +2746,6 @@ static int smk_open_relabel_self(struct inode *inode, struct file *file)
+ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
+ size_t count, loff_t *ppos)
+ {
+- struct task_smack *tsp = current_security();
+ char *data;
+ int rc;
+ LIST_HEAD(list_tmp);
+@@ -2771,11 +2770,21 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
+ kfree(data);
+
+ if (!rc || (rc == -EINVAL && list_empty(&list_tmp))) {
++ struct cred *new;
++ struct task_smack *tsp;
++
++ new = prepare_creds();
++ if (!new) {
++ rc = -ENOMEM;
++ goto out;
++ }
++ tsp = new->security;
+ smk_destroy_label_list(&tsp->smk_relabel);
+ list_splice(&list_tmp, &tsp->smk_relabel);
++ commit_creds(new);
+ return count;
+ }
+-
++out:
+ smk_destroy_label_list(&list_tmp);
+ return rc;
+ }
+diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c
+index e1f44fc86885..ed5bca0db3e7 100644
+--- a/sound/core/seq/oss/seq_oss.c
++++ b/sound/core/seq/oss/seq_oss.c
+@@ -181,10 +181,16 @@ static long
+ odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ {
+ struct seq_oss_devinfo *dp;
++ long rc;
++
+ dp = file->private_data;
+ if (snd_BUG_ON(!dp))
+ return -ENXIO;
+- return snd_seq_oss_ioctl(dp, cmd, arg);
++
++ mutex_lock(®ister_mutex);
++ rc = snd_seq_oss_ioctl(dp, cmd, arg);
++ mutex_unlock(®ister_mutex);
++ return rc;
+ }
+
+ #ifdef CONFIG_COMPAT
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 8e1eb5f243a2..d43245937db7 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2478,7 +2478,6 @@ static int azx_probe_continue(struct azx *chip)
+
+ if (azx_has_pm_runtime(chip)) {
+ pm_runtime_use_autosuspend(&pci->dev);
+- pm_runtime_allow(&pci->dev);
+ pm_runtime_put_autosuspend(&pci->dev);
+ }
+
+diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
+index 382e476629fb..c0fcc8af2a3e 100644
+--- a/tools/lib/traceevent/event-parse.c
++++ b/tools/lib/traceevent/event-parse.c
+@@ -2766,6 +2766,7 @@ process_dynamic_array_len(struct event_format *event, struct print_arg *arg,
+ if (read_expected(EVENT_DELIM, ")") < 0)
+ goto out_err;
+
++ free_token(token);
+ type = read_token(&token);
+ *tok = token;
+
+diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c
+index 406cc70c571d..c539591937a1 100644
+--- a/tools/testing/selftests/net/msg_zerocopy.c
++++ b/tools/testing/selftests/net/msg_zerocopy.c
+@@ -125,9 +125,8 @@ static int do_setcpu(int cpu)
+ CPU_ZERO(&mask);
+ CPU_SET(cpu, &mask);
+ if (sched_setaffinity(0, sizeof(mask), &mask))
+- error(1, 0, "setaffinity %d", cpu);
+-
+- if (cfg_verbose)
++ fprintf(stderr, "cpu: unable to pin, may increase variance.\n");
++ else if (cfg_verbose)
+ fprintf(stderr, "cpu: %u\n", cpu);
+
+ return 0;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-08-19 9:36 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2020-08-19 9:36 UTC (permalink / raw
To: gentoo-commits
commit: 6d1a8845fcc13034b366f55c1caf5dff4fc57a9e
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 19 09:35:17 2020 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Aug 19 09:36:29 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6d1a8845
Linux patch 4.19.140
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1139_linux-4.19.140.patch | 4937 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4941 insertions(+)
diff --git a/0000_README b/0000_README
index b90eb63..1b514b0 100644
--- a/0000_README
+++ b/0000_README
@@ -595,6 +595,10 @@ Patch: 1138_linux-4.19.139.patch
From: https://www.kernel.org
Desc: Linux 4.19.139
+Patch: 1139_linux-4.19.140.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.140
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1139_linux-4.19.140.patch b/1139_linux-4.19.140.patch
new file mode 100644
index 0000000..7af331f
--- /dev/null
+++ b/1139_linux-4.19.140.patch
@@ -0,0 +1,4937 @@
+diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
+index 8127a08e366d..d10bcca6c3fb 100644
+--- a/Documentation/ABI/testing/sysfs-bus-iio
++++ b/Documentation/ABI/testing/sysfs-bus-iio
+@@ -1559,7 +1559,8 @@ What: /sys/bus/iio/devices/iio:deviceX/in_concentrationX_voc_raw
+ KernelVersion: 4.3
+ Contact: linux-iio@vger.kernel.org
+ Description:
+- Raw (unscaled no offset etc.) percentage reading of a substance.
++ Raw (unscaled no offset etc.) reading of a substance. Units
++ after application of scale and offset are percents.
+
+ What: /sys/bus/iio/devices/iio:deviceX/in_resistance_raw
+ What: /sys/bus/iio/devices/iio:deviceX/in_resistanceX_raw
+diff --git a/Makefile b/Makefile
+index f6012170995e..c5ee1c10a39c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 139
++SUBLEVEL = 140
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/r8a7793-gose.dts b/arch/arm/boot/dts/r8a7793-gose.dts
+index 6b2f3a4fd13d..7802ce842a73 100644
+--- a/arch/arm/boot/dts/r8a7793-gose.dts
++++ b/arch/arm/boot/dts/r8a7793-gose.dts
+@@ -339,7 +339,7 @@
+ reg = <0x20>;
+ remote = <&vin1>;
+
+- port {
++ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+@@ -399,7 +399,7 @@
+ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ default-input = <0>;
+
+- port {
++ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
+index a56e7c856ab5..a4d4a28fe07d 100644
+--- a/arch/arm/kernel/stacktrace.c
++++ b/arch/arm/kernel/stacktrace.c
+@@ -21,6 +21,19 @@
+ * A simple function epilogue looks like this:
+ * ldm sp, {fp, sp, pc}
+ *
++ * When compiled with clang, pc and sp are not pushed. A simple function
++ * prologue looks like this when built with clang:
++ *
++ * stmdb {..., fp, lr}
++ * add fp, sp, #x
++ * sub sp, sp, #y
++ *
++ * A simple function epilogue looks like this when built with clang:
++ *
++ * sub sp, fp, #x
++ * ldm {..., fp, pc}
++ *
++ *
+ * Note that with framepointer enabled, even the leaf functions have the same
+ * prologue and epilogue, therefore we can ignore the LR value in this case.
+ */
+@@ -33,6 +46,16 @@ int notrace unwind_frame(struct stackframe *frame)
+ low = frame->sp;
+ high = ALIGN(low, THREAD_SIZE);
+
++#ifdef CONFIG_CC_IS_CLANG
++ /* check current frame pointer is within bounds */
++ if (fp < low + 4 || fp > high - 4)
++ return -EINVAL;
++
++ frame->sp = frame->fp;
++ frame->fp = *(unsigned long *)(fp);
++ frame->pc = frame->lr;
++ frame->lr = *(unsigned long *)(fp + 4);
++#else
+ /* check current frame pointer is within bounds */
+ if (fp < low + 12 || fp > high - 4)
+ return -EINVAL;
+@@ -41,6 +64,7 @@ int notrace unwind_frame(struct stackframe *frame)
+ frame->fp = *(unsigned long *)(fp - 12);
+ frame->sp = *(unsigned long *)(fp - 8);
+ frame->pc = *(unsigned long *)(fp - 4);
++#endif
+
+ return 0;
+ }
+diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
+index e2e4df3d11e5..21bfe9b6e16a 100644
+--- a/arch/arm/mach-at91/pm.c
++++ b/arch/arm/mach-at91/pm.c
+@@ -542,13 +542,13 @@ static void __init at91_pm_sram_init(void)
+ sram_pool = gen_pool_get(&pdev->dev, NULL);
+ if (!sram_pool) {
+ pr_warn("%s: sram pool unavailable!\n", __func__);
+- return;
++ goto out_put_device;
+ }
+
+ sram_base = gen_pool_alloc(sram_pool, at91_pm_suspend_in_sram_sz);
+ if (!sram_base) {
+ pr_warn("%s: unable to alloc sram!\n", __func__);
+- return;
++ goto out_put_device;
+ }
+
+ sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_base);
+@@ -556,12 +556,17 @@ static void __init at91_pm_sram_init(void)
+ at91_pm_suspend_in_sram_sz, false);
+ if (!at91_suspend_sram_fn) {
+ pr_warn("SRAM: Could not map\n");
+- return;
++ goto out_put_device;
+ }
+
+ /* Copy the pm suspend handler to SRAM */
+ at91_suspend_sram_fn = fncpy(at91_suspend_sram_fn,
+ &at91_pm_suspend_in_sram, at91_pm_suspend_in_sram_sz);
++ return;
++
++out_put_device:
++ put_device(&pdev->dev);
++ return;
+ }
+
+ static bool __init at91_is_pm_mode_active(int pm_mode)
+diff --git a/arch/arm/mach-socfpga/pm.c b/arch/arm/mach-socfpga/pm.c
+index d4866788702c..b782294ee30b 100644
+--- a/arch/arm/mach-socfpga/pm.c
++++ b/arch/arm/mach-socfpga/pm.c
+@@ -60,14 +60,14 @@ static int socfpga_setup_ocram_self_refresh(void)
+ if (!ocram_pool) {
+ pr_warn("%s: ocram pool unavailable!\n", __func__);
+ ret = -ENODEV;
+- goto put_node;
++ goto put_device;
+ }
+
+ ocram_base = gen_pool_alloc(ocram_pool, socfpga_sdram_self_refresh_sz);
+ if (!ocram_base) {
+ pr_warn("%s: unable to alloc ocram!\n", __func__);
+ ret = -ENOMEM;
+- goto put_node;
++ goto put_device;
+ }
+
+ ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base);
+@@ -78,7 +78,7 @@ static int socfpga_setup_ocram_self_refresh(void)
+ if (!suspend_ocram_base) {
+ pr_warn("%s: __arm_ioremap_exec failed!\n", __func__);
+ ret = -ENOMEM;
+- goto put_node;
++ goto put_device;
+ }
+
+ /* Copy the code that puts DDR in self refresh to ocram */
+@@ -92,6 +92,8 @@ static int socfpga_setup_ocram_self_refresh(void)
+ if (!socfpga_sdram_self_refresh_in_ocram)
+ ret = -EFAULT;
+
++put_device:
++ put_device(&pdev->dev);
+ put_node:
+ of_node_put(np);
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+index 00dd89b92b42..d991eae5202f 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
++++ b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+@@ -152,6 +152,7 @@
+ regulator-min-microvolt = <700000>;
+ regulator-max-microvolt = <1150000>;
+ regulator-enable-ramp-delay = <125>;
++ regulator-always-on;
+ };
+
+ ldo8_reg: LDO8 {
+diff --git a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts
+index c98bcbc8dfba..53848e0e5e0c 100644
+--- a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts
++++ b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts
+@@ -530,6 +530,17 @@
+ status = "ok";
+ compatible = "adi,adv7533";
+ reg = <0x39>;
++ adi,dsi-lanes = <4>;
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++ port@0 {
++ reg = <0>;
++ };
++ port@1 {
++ reg = <1>;
++ };
++ };
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+index e80a792827ed..60568392d21e 100644
+--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
++++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+@@ -515,7 +515,7 @@
+ reg = <0x39>;
+ interrupt-parent = <&gpio1>;
+ interrupts = <1 2>;
+- pd-gpio = <&gpio0 4 0>;
++ pd-gpios = <&gpio0 4 0>;
+ adi,dsi-lanes = <4>;
+ #sound-dai-cells = <0>;
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
+index 390a2fa28514..60d218c5275c 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
+@@ -516,7 +516,7 @@
+ pins = "gpio63", "gpio64", "gpio65", "gpio66",
+ "gpio67", "gpio68";
+ drive-strength = <8>;
+- bias-pull-none;
++ bias-disable;
+ };
+ };
+ cdc_pdm_lines_sus: pdm_lines_off {
+@@ -545,7 +545,7 @@
+ pins = "gpio113", "gpio114", "gpio115",
+ "gpio116";
+ drive-strength = <8>;
+- bias-pull-none;
++ bias-disable;
+ };
+ };
+
+@@ -573,7 +573,7 @@
+ pinconf {
+ pins = "gpio110";
+ drive-strength = <8>;
+- bias-pull-none;
++ bias-disable;
+ };
+ };
+
+@@ -599,7 +599,7 @@
+ pinconf {
+ pins = "gpio116";
+ drive-strength = <8>;
+- bias-pull-none;
++ bias-disable;
+ };
+ };
+ ext_mclk_tlmm_lines_sus: mclk_lines_off {
+@@ -627,7 +627,7 @@
+ pins = "gpio112", "gpio117", "gpio118",
+ "gpio119";
+ drive-strength = <8>;
+- bias-pull-none;
++ bias-disable;
+ };
+ };
+ ext_sec_tlmm_lines_sus: tlmm_lines_off {
+diff --git a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
+index 1315972412df..23098c13ad83 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
+@@ -159,7 +159,7 @@
+ pinctrl-0 = <&rgmii_pins>;
+ snps,reset-active-low;
+ snps,reset-delays-us = <0 10000 50000>;
+- snps,reset-gpio = <&gpio3 RK_PB3 GPIO_ACTIVE_HIGH>;
++ snps,reset-gpio = <&gpio3 RK_PB3 GPIO_ACTIVE_LOW>;
+ tx_delay = <0x10>;
+ rx_delay = <0x10>;
+ status = "okay";
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+index 0130b9f98c9d..b155f657292b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+@@ -101,7 +101,7 @@
+
+ vcc5v0_host: vcc5v0-host-regulator {
+ compatible = "regulator-fixed";
+- gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_HIGH>;
++ gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_LOW>;
+ enable-active-low;
+ pinctrl-names = "default";
+ pinctrl-0 = <&vcc5v0_host_en>;
+@@ -156,7 +156,7 @@
+ phy-mode = "rgmii";
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_pins>;
+- snps,reset-gpio = <&gpio3 RK_PC0 GPIO_ACTIVE_HIGH>;
++ snps,reset-gpio = <&gpio3 RK_PC0 GPIO_ACTIVE_LOW>;
+ snps,reset-active-low;
+ snps,reset-delays-us = <0 10000 50000>;
+ tx_delay = <0x10>;
+diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c
+index 9bfa17015768..c432bfafe63e 100644
+--- a/arch/m68k/mac/iop.c
++++ b/arch/m68k/mac/iop.c
+@@ -183,7 +183,7 @@ static __inline__ void iop_writeb(volatile struct mac_iop *iop, __u16 addr, __u8
+
+ static __inline__ void iop_stop(volatile struct mac_iop *iop)
+ {
+- iop->status_ctrl &= ~IOP_RUN;
++ iop->status_ctrl = IOP_AUTOINC;
+ }
+
+ static __inline__ void iop_start(volatile struct mac_iop *iop)
+@@ -191,14 +191,9 @@ static __inline__ void iop_start(volatile struct mac_iop *iop)
+ iop->status_ctrl = IOP_RUN | IOP_AUTOINC;
+ }
+
+-static __inline__ void iop_bypass(volatile struct mac_iop *iop)
+-{
+- iop->status_ctrl |= IOP_BYPASS;
+-}
+-
+ static __inline__ void iop_interrupt(volatile struct mac_iop *iop)
+ {
+- iop->status_ctrl |= IOP_IRQ;
++ iop->status_ctrl = IOP_IRQ | IOP_RUN | IOP_AUTOINC;
+ }
+
+ static int iop_alive(volatile struct mac_iop *iop)
+@@ -244,7 +239,6 @@ void __init iop_preinit(void)
+ } else {
+ iop_base[IOP_NUM_SCC] = (struct mac_iop *) SCC_IOP_BASE_QUADRA;
+ }
+- iop_base[IOP_NUM_SCC]->status_ctrl = 0x87;
+ iop_scc_present = 1;
+ } else {
+ iop_base[IOP_NUM_SCC] = NULL;
+@@ -256,7 +250,7 @@ void __init iop_preinit(void)
+ } else {
+ iop_base[IOP_NUM_ISM] = (struct mac_iop *) ISM_IOP_BASE_QUADRA;
+ }
+- iop_base[IOP_NUM_ISM]->status_ctrl = 0;
++ iop_stop(iop_base[IOP_NUM_ISM]);
+ iop_ism_present = 1;
+ } else {
+ iop_base[IOP_NUM_ISM] = NULL;
+@@ -416,7 +410,8 @@ static void iop_handle_send(uint iop_num, uint chan)
+ msg->status = IOP_MSGSTATUS_UNUSED;
+ msg = msg->next;
+ iop_send_queue[iop_num][chan] = msg;
+- if (msg) iop_do_send(msg);
++ if (msg && iop_readb(iop, IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE)
++ iop_do_send(msg);
+ }
+
+ /*
+@@ -490,16 +485,12 @@ int iop_send_message(uint iop_num, uint chan, void *privdata,
+
+ if (!(q = iop_send_queue[iop_num][chan])) {
+ iop_send_queue[iop_num][chan] = msg;
++ iop_do_send(msg);
+ } else {
+ while (q->next) q = q->next;
+ q->next = msg;
+ }
+
+- if (iop_readb(iop_base[iop_num],
+- IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE) {
+- iop_do_send(msg);
+- }
+-
+ return 0;
+ }
+
+diff --git a/arch/mips/cavium-octeon/octeon-usb.c b/arch/mips/cavium-octeon/octeon-usb.c
+index bfdfaf32d2c4..75189ff2f3c7 100644
+--- a/arch/mips/cavium-octeon/octeon-usb.c
++++ b/arch/mips/cavium-octeon/octeon-usb.c
+@@ -517,6 +517,7 @@ static int __init dwc3_octeon_device_init(void)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (res == NULL) {
++ put_device(&pdev->dev);
+ dev_err(&pdev->dev, "No memory resources\n");
+ return -ENXIO;
+ }
+@@ -528,8 +529,10 @@ static int __init dwc3_octeon_device_init(void)
+ * know the difference.
+ */
+ base = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(base))
++ if (IS_ERR(base)) {
++ put_device(&pdev->dev);
+ return PTR_ERR(base);
++ }
+
+ mutex_lock(&dwc3_octeon_clocks_mutex);
+ dwc3_octeon_clocks_start(&pdev->dev, (u64)base);
+diff --git a/arch/parisc/include/asm/barrier.h b/arch/parisc/include/asm/barrier.h
+index dbaaca84f27f..640d46edf32e 100644
+--- a/arch/parisc/include/asm/barrier.h
++++ b/arch/parisc/include/asm/barrier.h
+@@ -26,6 +26,67 @@
+ #define __smp_rmb() mb()
+ #define __smp_wmb() mb()
+
++#define __smp_store_release(p, v) \
++do { \
++ typeof(p) __p = (p); \
++ union { typeof(*p) __val; char __c[1]; } __u = \
++ { .__val = (__force typeof(*p)) (v) }; \
++ compiletime_assert_atomic_type(*p); \
++ switch (sizeof(*p)) { \
++ case 1: \
++ asm volatile("stb,ma %0,0(%1)" \
++ : : "r"(*(__u8 *)__u.__c), "r"(__p) \
++ : "memory"); \
++ break; \
++ case 2: \
++ asm volatile("sth,ma %0,0(%1)" \
++ : : "r"(*(__u16 *)__u.__c), "r"(__p) \
++ : "memory"); \
++ break; \
++ case 4: \
++ asm volatile("stw,ma %0,0(%1)" \
++ : : "r"(*(__u32 *)__u.__c), "r"(__p) \
++ : "memory"); \
++ break; \
++ case 8: \
++ if (IS_ENABLED(CONFIG_64BIT)) \
++ asm volatile("std,ma %0,0(%1)" \
++ : : "r"(*(__u64 *)__u.__c), "r"(__p) \
++ : "memory"); \
++ break; \
++ } \
++} while (0)
++
++#define __smp_load_acquire(p) \
++({ \
++ union { typeof(*p) __val; char __c[1]; } __u; \
++ typeof(p) __p = (p); \
++ compiletime_assert_atomic_type(*p); \
++ switch (sizeof(*p)) { \
++ case 1: \
++ asm volatile("ldb,ma 0(%1),%0" \
++ : "=r"(*(__u8 *)__u.__c) : "r"(__p) \
++ : "memory"); \
++ break; \
++ case 2: \
++ asm volatile("ldh,ma 0(%1),%0" \
++ : "=r"(*(__u16 *)__u.__c) : "r"(__p) \
++ : "memory"); \
++ break; \
++ case 4: \
++ asm volatile("ldw,ma 0(%1),%0" \
++ : "=r"(*(__u32 *)__u.__c) : "r"(__p) \
++ : "memory"); \
++ break; \
++ case 8: \
++ if (IS_ENABLED(CONFIG_64BIT)) \
++ asm volatile("ldd,ma 0(%1),%0" \
++ : "=r"(*(__u64 *)__u.__c) : "r"(__p) \
++ : "memory"); \
++ break; \
++ } \
++ __u.__val; \
++})
+ #include <asm-generic/barrier.h>
+
+ #endif /* !__ASSEMBLY__ */
+diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
+index 7d5ddf53750c..7a83b5e136e0 100644
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -122,7 +122,7 @@ src-wlib-y := string.S crt0.S stdio.c decompress.c main.c \
+ elf_util.c $(zlib-y) devtree.c stdlib.c \
+ oflib.c ofconsole.c cuboot.c
+
+-src-wlib-$(CONFIG_PPC_MPC52XX) += mpc52xx-psc.c
++src-wlib-$(CONFIG_PPC_MPC52xx) += mpc52xx-psc.c
+ src-wlib-$(CONFIG_PPC64_BOOT_WRAPPER) += opal-calls.S opal.c
+ ifndef CONFIG_PPC64_BOOT_WRAPPER
+ src-wlib-y += crtsavres.S
+diff --git a/arch/powerpc/boot/serial.c b/arch/powerpc/boot/serial.c
+index 48e3743faedf..83c78427c20b 100644
+--- a/arch/powerpc/boot/serial.c
++++ b/arch/powerpc/boot/serial.c
+@@ -127,7 +127,7 @@ int serial_console_init(void)
+ dt_is_compatible(devp, "fsl,cpm2-smc-uart"))
+ rc = cpm_console_init(devp, &serial_cd);
+ #endif
+-#ifdef CONFIG_PPC_MPC52XX
++#ifdef CONFIG_PPC_MPC52xx
+ else if (dt_is_compatible(devp, "fsl,mpc5200-psc-uart"))
+ rc = mpc5200_psc_console_init(devp, &serial_cd);
+ #endif
+diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
+index 65b3bdb99f0b..31ab6eb61e26 100644
+--- a/arch/powerpc/kernel/vdso.c
++++ b/arch/powerpc/kernel/vdso.c
+@@ -705,7 +705,7 @@ int vdso_getcpu_init(void)
+ node = cpu_to_node(cpu);
+ WARN_ON_ONCE(node > 0xffff);
+
+- val = (cpu & 0xfff) | ((node & 0xffff) << 16);
++ val = (cpu & 0xffff) | ((node & 0xffff) << 16);
+ mtspr(SPRN_SPRG_VDSO_WRITE, val);
+ get_paca()->sprg_vdso = val;
+
+diff --git a/arch/powerpc/mm/pkeys.c b/arch/powerpc/mm/pkeys.c
+index 7124af17da72..a587f9013988 100644
+--- a/arch/powerpc/mm/pkeys.c
++++ b/arch/powerpc/mm/pkeys.c
+@@ -81,13 +81,17 @@ int pkey_initialize(void)
+ scan_pkey_feature();
+
+ /*
+- * Let's assume 32 pkeys on P8 bare metal, if its not defined by device
+- * tree. We make this exception since skiboot forgot to expose this
+- * property on power8.
++ * Let's assume 32 pkeys on P8/P9 bare metal, if its not defined by device
++ * tree. We make this exception since some version of skiboot forgot to
++ * expose this property on power8/9.
+ */
+- if (!pkeys_devtree_defined && !firmware_has_feature(FW_FEATURE_LPAR) &&
+- cpu_has_feature(CPU_FTRS_POWER8))
+- pkeys_total = 32;
++ if (!pkeys_devtree_defined && !firmware_has_feature(FW_FEATURE_LPAR)) {
++ unsigned long pvr = mfspr(SPRN_PVR);
++
++ if (PVR_VER(pvr) == PVR_POWER8 || PVR_VER(pvr) == PVR_POWER8E ||
++ PVR_VER(pvr) == PVR_POWER8NVL || PVR_VER(pvr) == PVR_POWER9)
++ pkeys_total = 32;
++ }
+
+ /*
+ * Adjust the upper limit, based on the number of bits supported by
+diff --git a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
+index 5f6a5af9c489..77043a82da51 100644
+--- a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
++++ b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
+@@ -127,10 +127,6 @@ ddq_add_8:
+
+ /* generate a unique variable for ddq_add_x */
+
+-.macro setddq n
+- var_ddq_add = ddq_add_\n
+-.endm
+-
+ /* generate a unique variable for xmm register */
+ .macro setxdata n
+ var_xdata = %xmm\n
+@@ -140,9 +136,7 @@ ddq_add_8:
+
+ .macro club name, id
+ .altmacro
+- .if \name == DDQ_DATA
+- setddq %\id
+- .elseif \name == XDATA
++ .if \name == XDATA
+ setxdata %\id
+ .endif
+ .noaltmacro
+@@ -165,9 +159,8 @@ ddq_add_8:
+
+ .set i, 1
+ .rept (by - 1)
+- club DDQ_DATA, i
+ club XDATA, i
+- vpaddq var_ddq_add(%rip), xcounter, var_xdata
++ vpaddq (ddq_add_1 + 16 * (i - 1))(%rip), xcounter, var_xdata
+ vptest ddq_low_msk(%rip), var_xdata
+ jnz 1f
+ vpaddq ddq_high_add_1(%rip), var_xdata, var_xdata
+@@ -180,8 +173,7 @@ ddq_add_8:
+ vmovdqa 1*16(p_keys), xkeyA
+
+ vpxor xkey0, xdata0, xdata0
+- club DDQ_DATA, by
+- vpaddq var_ddq_add(%rip), xcounter, xcounter
++ vpaddq (ddq_add_1 + 16 * (by - 1))(%rip), xcounter, xcounter
+ vptest ddq_low_msk(%rip), xcounter
+ jnz 1f
+ vpaddq ddq_high_add_1(%rip), xcounter, xcounter
+diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
+index cb2deb61c5d9..29b27f9a6e1e 100644
+--- a/arch/x86/crypto/aesni-intel_asm.S
++++ b/arch/x86/crypto/aesni-intel_asm.S
+@@ -270,7 +270,7 @@ ALL_F: .octa 0xffffffffffffffffffffffffffffffff
+ PSHUFB_XMM %xmm2, %xmm0
+ movdqu %xmm0, CurCount(%arg2) # ctx_data.current_counter = iv
+
+- PRECOMPUTE \SUBKEY, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7,
++ PRECOMPUTE \SUBKEY, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7
+ movdqu HashKey(%arg2), %xmm13
+
+ CALC_AAD_HASH %xmm13, \AAD, \AADLEN, %xmm0, %xmm1, %xmm2, %xmm3, \
+@@ -982,7 +982,7 @@ _initial_blocks_done\@:
+ * arg1, %arg3, %arg4 are used as pointers only, not modified
+ * %r11 is the data offset value
+ */
+-.macro GHASH_4_ENCRYPT_4_PARALLEL_ENC TMP1 TMP2 TMP3 TMP4 TMP5 \
++.macro GHASH_4_ENCRYPT_4_PARALLEL_enc TMP1 TMP2 TMP3 TMP4 TMP5 \
+ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+
+ movdqa \XMM1, \XMM5
+@@ -1190,7 +1190,7 @@ aes_loop_par_enc_done\@:
+ * arg1, %arg3, %arg4 are used as pointers only, not modified
+ * %r11 is the data offset value
+ */
+-.macro GHASH_4_ENCRYPT_4_PARALLEL_DEC TMP1 TMP2 TMP3 TMP4 TMP5 \
++.macro GHASH_4_ENCRYPT_4_PARALLEL_dec TMP1 TMP2 TMP3 TMP4 TMP5 \
+ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation
+
+ movdqa \XMM1, \XMM5
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 08e2f3a5f124..95e21c438012 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2342,8 +2342,13 @@ static int mp_irqdomain_create(int ioapic)
+
+ static void ioapic_destroy_irqdomain(int idx)
+ {
++ struct ioapic_domain_cfg *cfg = &ioapics[idx].irqdomain_cfg;
++ struct fwnode_handle *fn = ioapics[idx].irqdomain->fwnode;
++
+ if (ioapics[idx].irqdomain) {
+ irq_domain_remove(ioapics[idx].irqdomain);
++ if (!cfg->dev)
++ irq_domain_free_fwnode(fn);
+ ioapics[idx].irqdomain = NULL;
+ }
+ }
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+index 1ceccc4a5472..9cc524be3c94 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+@@ -518,7 +518,7 @@ static void do_inject(void)
+ */
+ if (inj_type == DFR_INT_INJ) {
+ i_mce.status |= MCI_STATUS_DEFERRED;
+- i_mce.status |= (i_mce.status & ~MCI_STATUS_UC);
++ i_mce.status &= ~MCI_STATUS_UC;
+ }
+
+ /*
+diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
+index 8d4d50645310..1401f86e4007 100644
+--- a/arch/x86/kernel/ptrace.c
++++ b/arch/x86/kernel/ptrace.c
+@@ -374,7 +374,7 @@ static unsigned long task_seg_base(struct task_struct *task,
+ */
+ mutex_lock(&task->mm->context.lock);
+ ldt = task->mm->context.ldt;
+- if (unlikely(idx >= ldt->nr_entries))
++ if (unlikely(!ldt || idx >= ldt->nr_entries))
+ base = 0;
+ else
+ base = get_desc_base(ldt->entries + idx);
+diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c
+index 738f3c732363..228feeea555f 100644
+--- a/drivers/acpi/acpica/exprep.c
++++ b/drivers/acpi/acpica/exprep.c
+@@ -473,10 +473,6 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info)
+ (u8)access_byte_width;
+ }
+ }
+- /* An additional reference for the container */
+-
+- acpi_ut_add_reference(obj_desc->field.region_obj);
+-
+ ACPI_DEBUG_PRINT((ACPI_DB_BFIELD,
+ "RegionField: BitOff %X, Off %X, Gran %X, Region %p\n",
+ obj_desc->field.start_field_bit_offset,
+diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c
+index 8cc4392c61f3..0dc8dea81582 100644
+--- a/drivers/acpi/acpica/utdelete.c
++++ b/drivers/acpi/acpica/utdelete.c
+@@ -563,11 +563,6 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
+ next_object = object->buffer_field.buffer_obj;
+ break;
+
+- case ACPI_TYPE_LOCAL_REGION_FIELD:
+-
+- next_object = object->field.region_obj;
+- break;
+-
+ case ACPI_TYPE_LOCAL_BANK_FIELD:
+
+ next_object = object->bank_field.bank_obj;
+@@ -608,6 +603,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
+ }
+ break;
+
++ case ACPI_TYPE_LOCAL_REGION_FIELD:
+ case ACPI_TYPE_REGION:
+ default:
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 728681a20b7f..da68c42aed68 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -2279,6 +2279,8 @@ static void __exit loop_exit(void)
+
+ range = max_loop ? max_loop << part_shift : 1UL << MINORBITS;
+
++ mutex_lock(&loop_ctl_mutex);
++
+ idr_for_each(&loop_index_idr, &loop_exit_cb, NULL);
+ idr_destroy(&loop_index_idr);
+
+@@ -2286,6 +2288,8 @@ static void __exit loop_exit(void)
+ unregister_blkdev(LOOP_MAJOR, "loop");
+
+ misc_deregister(&loop_misc);
++
++ mutex_unlock(&loop_ctl_mutex);
+ }
+
+ module_init(loop_init);
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index 8eede1197cd2..5a68cd4dd71c 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -803,7 +803,7 @@ static int h5_serdev_probe(struct serdev_device *serdev)
+ if (!h5)
+ return -ENOMEM;
+
+- set_bit(HCI_UART_RESET_ON_INIT, &h5->serdev_hu.flags);
++ set_bit(HCI_UART_RESET_ON_INIT, &h5->serdev_hu.hdev_flags);
+
+ h5->hu = &h5->serdev_hu;
+ h5->serdev_hu.serdev = serdev;
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index 46e20444ba19..d3fb0d657fa5 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -369,7 +369,8 @@ void hci_uart_unregister_device(struct hci_uart *hu)
+ struct hci_dev *hdev = hu->hdev;
+
+ clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+- hci_unregister_dev(hdev);
++ if (test_bit(HCI_UART_REGISTERED, &hu->flags))
++ hci_unregister_dev(hdev);
+ hci_free_dev(hdev);
+
+ cancel_work_sync(&hu->write_work);
+diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
+index b161bdf60000..0941d38b2d32 100644
+--- a/drivers/char/agp/intel-gtt.c
++++ b/drivers/char/agp/intel-gtt.c
+@@ -304,8 +304,10 @@ static int intel_gtt_setup_scratch_page(void)
+ if (intel_private.needs_dmar) {
+ dma_addr = pci_map_page(intel_private.pcidev, page, 0,
+ PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+- if (pci_dma_mapping_error(intel_private.pcidev, dma_addr))
++ if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) {
++ __free_page(page);
+ return -EINVAL;
++ }
+
+ intel_private.scratch_page_dma = dma_addr;
+ } else
+diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c
+index a985bf5e1ac6..c65d30bba700 100644
+--- a/drivers/clk/clk-scmi.c
++++ b/drivers/clk/clk-scmi.c
+@@ -103,6 +103,8 @@ static const struct clk_ops scmi_clk_ops = {
+ static int scmi_clk_ops_init(struct device *dev, struct scmi_clk *sclk)
+ {
+ int ret;
++ unsigned long min_rate, max_rate;
++
+ struct clk_init_data init = {
+ .flags = CLK_GET_RATE_NOCACHE,
+ .num_parents = 0,
+@@ -112,9 +114,23 @@ static int scmi_clk_ops_init(struct device *dev, struct scmi_clk *sclk)
+
+ sclk->hw.init = &init;
+ ret = devm_clk_hw_register(dev, &sclk->hw);
+- if (!ret)
+- clk_hw_set_rate_range(&sclk->hw, sclk->info->range.min_rate,
+- sclk->info->range.max_rate);
++ if (ret)
++ return ret;
++
++ if (sclk->info->rate_discrete) {
++ int num_rates = sclk->info->list.num_rates;
++
++ if (num_rates <= 0)
++ return -EINVAL;
++
++ min_rate = sclk->info->list.rates[0];
++ max_rate = sclk->info->list.rates[num_rates - 1];
++ } else {
++ min_rate = sclk->info->range.min_rate;
++ max_rate = sclk->info->range.max_rate;
++ }
++
++ clk_hw_set_rate_range(&sclk->hw, min_rate, max_rate);
+ return ret;
+ }
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index 0df16eb1eb3c..c5f98cafc25c 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -458,6 +458,7 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ /* Now that everything is setup, enable the DVFS at hardware level */
+ armada37xx_cpufreq_enable_dvfs(nb_pm_base);
+
++ memset(&pdata, 0, sizeof(pdata));
+ pdata.suspend = armada37xx_cpufreq_suspend;
+ pdata.resume = armada37xx_cpufreq_resume;
+
+diff --git a/drivers/crypto/cavium/cpt/cptvf_algs.c b/drivers/crypto/cavium/cpt/cptvf_algs.c
+index 600336d169a9..cd4d60d318ba 100644
+--- a/drivers/crypto/cavium/cpt/cptvf_algs.c
++++ b/drivers/crypto/cavium/cpt/cptvf_algs.c
+@@ -205,6 +205,7 @@ static inline int cvm_enc_dec(struct ablkcipher_request *req, u32 enc)
+ int status;
+
+ memset(req_info, 0, sizeof(struct cpt_request_info));
++ req_info->may_sleep = (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) != 0;
+ memset(fctx, 0, sizeof(struct fc_context));
+ create_input_list(req, enc, enc_iv_len);
+ create_output_list(req, enc_iv_len);
+diff --git a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c
+index b0ba4331944b..43fe69d0981a 100644
+--- a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c
++++ b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c
+@@ -136,7 +136,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf,
+
+ /* Setup gather (input) components */
+ g_sz_bytes = ((req->incnt + 3) / 4) * sizeof(struct sglist_component);
+- info->gather_components = kzalloc(g_sz_bytes, GFP_KERNEL);
++ info->gather_components = kzalloc(g_sz_bytes, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC);
+ if (!info->gather_components) {
+ ret = -ENOMEM;
+ goto scatter_gather_clean;
+@@ -153,7 +153,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf,
+
+ /* Setup scatter (output) components */
+ s_sz_bytes = ((req->outcnt + 3) / 4) * sizeof(struct sglist_component);
+- info->scatter_components = kzalloc(s_sz_bytes, GFP_KERNEL);
++ info->scatter_components = kzalloc(s_sz_bytes, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC);
+ if (!info->scatter_components) {
+ ret = -ENOMEM;
+ goto scatter_gather_clean;
+@@ -170,7 +170,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf,
+
+ /* Create and initialize DPTR */
+ info->dlen = g_sz_bytes + s_sz_bytes + SG_LIST_HDR_SIZE;
+- info->in_buffer = kzalloc(info->dlen, GFP_KERNEL);
++ info->in_buffer = kzalloc(info->dlen, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC);
+ if (!info->in_buffer) {
+ ret = -ENOMEM;
+ goto scatter_gather_clean;
+@@ -198,7 +198,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf,
+ }
+
+ /* Create and initialize RPTR */
+- info->out_buffer = kzalloc(COMPLETION_CODE_SIZE, GFP_KERNEL);
++ info->out_buffer = kzalloc(COMPLETION_CODE_SIZE, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC);
+ if (!info->out_buffer) {
+ ret = -ENOMEM;
+ goto scatter_gather_clean;
+@@ -434,7 +434,7 @@ int process_request(struct cpt_vf *cptvf, struct cpt_request_info *req)
+ struct cpt_vq_command vq_cmd;
+ union cpt_inst_s cptinst;
+
+- info = kzalloc(sizeof(*info), GFP_KERNEL);
++ info = kzalloc(sizeof(*info), req->may_sleep ? GFP_KERNEL : GFP_ATOMIC);
+ if (unlikely(!info)) {
+ dev_err(&pdev->dev, "Unable to allocate memory for info_buffer\n");
+ return -ENOMEM;
+@@ -456,7 +456,7 @@ int process_request(struct cpt_vf *cptvf, struct cpt_request_info *req)
+ * Get buffer for union cpt_res_s response
+ * structure and its physical address
+ */
+- info->completion_addr = kzalloc(sizeof(union cpt_res_s), GFP_KERNEL);
++ info->completion_addr = kzalloc(sizeof(union cpt_res_s), req->may_sleep ? GFP_KERNEL : GFP_ATOMIC);
+ if (unlikely(!info->completion_addr)) {
+ dev_err(&pdev->dev, "Unable to allocate memory for completion_addr\n");
+ ret = -ENOMEM;
+diff --git a/drivers/crypto/cavium/cpt/request_manager.h b/drivers/crypto/cavium/cpt/request_manager.h
+index 80ee074c6e0c..09930d95ad24 100644
+--- a/drivers/crypto/cavium/cpt/request_manager.h
++++ b/drivers/crypto/cavium/cpt/request_manager.h
+@@ -65,6 +65,8 @@ struct cpt_request_info {
+ union ctrl_info ctrl; /* User control information */
+ struct cptvf_request req; /* Request Information (Core specific) */
+
++ bool may_sleep;
++
+ struct buf_ptr in[MAX_BUF_CNT];
+ struct buf_ptr out[MAX_BUF_CNT];
+
+diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
+index 7442b0422f8a..bd43b5c1450c 100644
+--- a/drivers/crypto/ccp/ccp-dev.h
++++ b/drivers/crypto/ccp/ccp-dev.h
+@@ -471,6 +471,7 @@ struct ccp_sg_workarea {
+ unsigned int sg_used;
+
+ struct scatterlist *dma_sg;
++ struct scatterlist *dma_sg_head;
+ struct device *dma_dev;
+ unsigned int dma_count;
+ enum dma_data_direction dma_dir;
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 43b74cf0787e..626b643d610e 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -67,7 +67,7 @@ static u32 ccp_gen_jobid(struct ccp_device *ccp)
+ static void ccp_sg_free(struct ccp_sg_workarea *wa)
+ {
+ if (wa->dma_count)
+- dma_unmap_sg(wa->dma_dev, wa->dma_sg, wa->nents, wa->dma_dir);
++ dma_unmap_sg(wa->dma_dev, wa->dma_sg_head, wa->nents, wa->dma_dir);
+
+ wa->dma_count = 0;
+ }
+@@ -96,6 +96,7 @@ static int ccp_init_sg_workarea(struct ccp_sg_workarea *wa, struct device *dev,
+ return 0;
+
+ wa->dma_sg = sg;
++ wa->dma_sg_head = sg;
+ wa->dma_dev = dev;
+ wa->dma_dir = dma_dir;
+ wa->dma_count = dma_map_sg(dev, sg, wa->nents, dma_dir);
+@@ -108,14 +109,28 @@ static int ccp_init_sg_workarea(struct ccp_sg_workarea *wa, struct device *dev,
+ static void ccp_update_sg_workarea(struct ccp_sg_workarea *wa, unsigned int len)
+ {
+ unsigned int nbytes = min_t(u64, len, wa->bytes_left);
++ unsigned int sg_combined_len = 0;
+
+ if (!wa->sg)
+ return;
+
+ wa->sg_used += nbytes;
+ wa->bytes_left -= nbytes;
+- if (wa->sg_used == wa->sg->length) {
+- wa->sg = sg_next(wa->sg);
++ if (wa->sg_used == sg_dma_len(wa->dma_sg)) {
++ /* Advance to the next DMA scatterlist entry */
++ wa->dma_sg = sg_next(wa->dma_sg);
++
++ /* In the case that the DMA mapped scatterlist has entries
++ * that have been merged, the non-DMA mapped scatterlist
++ * must be advanced multiple times for each merged entry.
++ * This ensures that the current non-DMA mapped entry
++ * corresponds to the current DMA mapped entry.
++ */
++ do {
++ sg_combined_len += wa->sg->length;
++ wa->sg = sg_next(wa->sg);
++ } while (wa->sg_used > sg_combined_len);
++
+ wa->sg_used = 0;
+ }
+ }
+@@ -304,7 +319,7 @@ static unsigned int ccp_queue_buf(struct ccp_data *data, unsigned int from)
+ /* Update the structures and generate the count */
+ buf_count = 0;
+ while (sg_wa->bytes_left && (buf_count < dm_wa->length)) {
+- nbytes = min(sg_wa->sg->length - sg_wa->sg_used,
++ nbytes = min(sg_dma_len(sg_wa->dma_sg) - sg_wa->sg_used,
+ dm_wa->length - buf_count);
+ nbytes = min_t(u64, sg_wa->bytes_left, nbytes);
+
+@@ -336,11 +351,11 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst,
+ * and destination. The resulting len values will always be <= UINT_MAX
+ * because the dma length is an unsigned int.
+ */
+- sg_src_len = sg_dma_len(src->sg_wa.sg) - src->sg_wa.sg_used;
++ sg_src_len = sg_dma_len(src->sg_wa.dma_sg) - src->sg_wa.sg_used;
+ sg_src_len = min_t(u64, src->sg_wa.bytes_left, sg_src_len);
+
+ if (dst) {
+- sg_dst_len = sg_dma_len(dst->sg_wa.sg) - dst->sg_wa.sg_used;
++ sg_dst_len = sg_dma_len(dst->sg_wa.dma_sg) - dst->sg_wa.sg_used;
+ sg_dst_len = min_t(u64, src->sg_wa.bytes_left, sg_dst_len);
+ op_len = min(sg_src_len, sg_dst_len);
+ } else {
+@@ -370,7 +385,7 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst,
+ /* Enough data in the sg element, but we need to
+ * adjust for any previously copied data
+ */
+- op->src.u.dma.address = sg_dma_address(src->sg_wa.sg);
++ op->src.u.dma.address = sg_dma_address(src->sg_wa.dma_sg);
+ op->src.u.dma.offset = src->sg_wa.sg_used;
+ op->src.u.dma.length = op_len & ~(block_size - 1);
+
+@@ -391,7 +406,7 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst,
+ /* Enough room in the sg element, but we need to
+ * adjust for any previously used area
+ */
+- op->dst.u.dma.address = sg_dma_address(dst->sg_wa.sg);
++ op->dst.u.dma.address = sg_dma_address(dst->sg_wa.dma_sg);
+ op->dst.u.dma.offset = dst->sg_wa.sg_used;
+ op->dst.u.dma.length = op->src.u.dma.length;
+ }
+@@ -2034,7 +2049,7 @@ ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ dst.sg_wa.sg_used = 0;
+ for (i = 1; i <= src.sg_wa.dma_count; i++) {
+ if (!dst.sg_wa.sg ||
+- (dst.sg_wa.sg->length < src.sg_wa.sg->length)) {
++ (sg_dma_len(dst.sg_wa.sg) < sg_dma_len(src.sg_wa.sg))) {
+ ret = -EINVAL;
+ goto e_dst;
+ }
+@@ -2060,8 +2075,8 @@ ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ goto e_dst;
+ }
+
+- dst.sg_wa.sg_used += src.sg_wa.sg->length;
+- if (dst.sg_wa.sg_used == dst.sg_wa.sg->length) {
++ dst.sg_wa.sg_used += sg_dma_len(src.sg_wa.sg);
++ if (dst.sg_wa.sg_used == sg_dma_len(dst.sg_wa.sg)) {
+ dst.sg_wa.sg = sg_next(dst.sg_wa.sg);
+ dst.sg_wa.sg_used = 0;
+ }
+diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c
+index 28a5b8b38fa2..1bcb6f0157b0 100644
+--- a/drivers/crypto/ccree/cc_cipher.c
++++ b/drivers/crypto/ccree/cc_cipher.c
+@@ -137,7 +137,6 @@ static int cc_cipher_init(struct crypto_tfm *tfm)
+ skcipher_alg.base);
+ struct device *dev = drvdata_to_dev(cc_alg->drvdata);
+ unsigned int max_key_buf_size = cc_alg->skcipher_alg.max_keysize;
+- int rc = 0;
+
+ dev_dbg(dev, "Initializing context @%p for %s\n", ctx_p,
+ crypto_tfm_alg_name(tfm));
+@@ -149,10 +148,19 @@ static int cc_cipher_init(struct crypto_tfm *tfm)
+ ctx_p->flow_mode = cc_alg->flow_mode;
+ ctx_p->drvdata = cc_alg->drvdata;
+
++ if (ctx_p->cipher_mode == DRV_CIPHER_ESSIV) {
++ /* Alloc hash tfm for essiv */
++ ctx_p->shash_tfm = crypto_alloc_shash("sha256-generic", 0, 0);
++ if (IS_ERR(ctx_p->shash_tfm)) {
++ dev_err(dev, "Error allocating hash tfm for ESSIV.\n");
++ return PTR_ERR(ctx_p->shash_tfm);
++ }
++ }
++
+ /* Allocate key buffer, cache line aligned */
+ ctx_p->user.key = kmalloc(max_key_buf_size, GFP_KERNEL);
+ if (!ctx_p->user.key)
+- return -ENOMEM;
++ goto free_shash;
+
+ dev_dbg(dev, "Allocated key buffer in context. key=@%p\n",
+ ctx_p->user.key);
+@@ -164,21 +172,19 @@ static int cc_cipher_init(struct crypto_tfm *tfm)
+ if (dma_mapping_error(dev, ctx_p->user.key_dma_addr)) {
+ dev_err(dev, "Mapping Key %u B at va=%pK for DMA failed\n",
+ max_key_buf_size, ctx_p->user.key);
+- return -ENOMEM;
++ goto free_key;
+ }
+ dev_dbg(dev, "Mapped key %u B at va=%pK to dma=%pad\n",
+ max_key_buf_size, ctx_p->user.key, &ctx_p->user.key_dma_addr);
+
+- if (ctx_p->cipher_mode == DRV_CIPHER_ESSIV) {
+- /* Alloc hash tfm for essiv */
+- ctx_p->shash_tfm = crypto_alloc_shash("sha256-generic", 0, 0);
+- if (IS_ERR(ctx_p->shash_tfm)) {
+- dev_err(dev, "Error allocating hash tfm for ESSIV.\n");
+- return PTR_ERR(ctx_p->shash_tfm);
+- }
+- }
++ return 0;
+
+- return rc;
++free_key:
++ kfree(ctx_p->user.key);
++free_shash:
++ crypto_free_shash(ctx_p->shash_tfm);
++
++ return -ENOMEM;
+ }
+
+ static void cc_cipher_exit(struct crypto_tfm *tfm)
+diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c
+index bf9658800bda..3e3cc28d5cfe 100644
+--- a/drivers/crypto/hisilicon/sec/sec_algs.c
++++ b/drivers/crypto/hisilicon/sec/sec_algs.c
+@@ -175,7 +175,8 @@ static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl,
+ dma_addr_t *psec_sgl,
+ struct scatterlist *sgl,
+ int count,
+- struct sec_dev_info *info)
++ struct sec_dev_info *info,
++ gfp_t gfp)
+ {
+ struct sec_hw_sgl *sgl_current = NULL;
+ struct sec_hw_sgl *sgl_next;
+@@ -190,7 +191,7 @@ static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl,
+ sge_index = i % SEC_MAX_SGE_NUM;
+ if (sge_index == 0) {
+ sgl_next = dma_pool_zalloc(info->hw_sgl_pool,
+- GFP_KERNEL, &sgl_next_dma);
++ gfp, &sgl_next_dma);
+ if (!sgl_next) {
+ ret = -ENOMEM;
+ goto err_free_hw_sgls;
+@@ -553,14 +554,14 @@ void sec_alg_callback(struct sec_bd_info *resp, void *shadow)
+ }
+
+ static int sec_alg_alloc_and_calc_split_sizes(int length, size_t **split_sizes,
+- int *steps)
++ int *steps, gfp_t gfp)
+ {
+ size_t *sizes;
+ int i;
+
+ /* Split into suitable sized blocks */
+ *steps = roundup(length, SEC_REQ_LIMIT) / SEC_REQ_LIMIT;
+- sizes = kcalloc(*steps, sizeof(*sizes), GFP_KERNEL);
++ sizes = kcalloc(*steps, sizeof(*sizes), gfp);
+ if (!sizes)
+ return -ENOMEM;
+
+@@ -576,7 +577,7 @@ static int sec_map_and_split_sg(struct scatterlist *sgl, size_t *split_sizes,
+ int steps, struct scatterlist ***splits,
+ int **splits_nents,
+ int sgl_len_in,
+- struct device *dev)
++ struct device *dev, gfp_t gfp)
+ {
+ int ret, count;
+
+@@ -584,12 +585,12 @@ static int sec_map_and_split_sg(struct scatterlist *sgl, size_t *split_sizes,
+ if (!count)
+ return -EINVAL;
+
+- *splits = kcalloc(steps, sizeof(struct scatterlist *), GFP_KERNEL);
++ *splits = kcalloc(steps, sizeof(struct scatterlist *), gfp);
+ if (!*splits) {
+ ret = -ENOMEM;
+ goto err_unmap_sg;
+ }
+- *splits_nents = kcalloc(steps, sizeof(int), GFP_KERNEL);
++ *splits_nents = kcalloc(steps, sizeof(int), gfp);
+ if (!*splits_nents) {
+ ret = -ENOMEM;
+ goto err_free_splits;
+@@ -597,7 +598,7 @@ static int sec_map_and_split_sg(struct scatterlist *sgl, size_t *split_sizes,
+
+ /* output the scatter list before and after this */
+ ret = sg_split(sgl, count, 0, steps, split_sizes,
+- *splits, *splits_nents, GFP_KERNEL);
++ *splits, *splits_nents, gfp);
+ if (ret) {
+ ret = -ENOMEM;
+ goto err_free_splits_nents;
+@@ -638,13 +639,13 @@ static struct sec_request_el
+ int el_size, bool different_dest,
+ struct scatterlist *sgl_in, int n_ents_in,
+ struct scatterlist *sgl_out, int n_ents_out,
+- struct sec_dev_info *info)
++ struct sec_dev_info *info, gfp_t gfp)
+ {
+ struct sec_request_el *el;
+ struct sec_bd_info *req;
+ int ret;
+
+- el = kzalloc(sizeof(*el), GFP_KERNEL);
++ el = kzalloc(sizeof(*el), gfp);
+ if (!el)
+ return ERR_PTR(-ENOMEM);
+ el->el_length = el_size;
+@@ -676,7 +677,7 @@ static struct sec_request_el
+ el->sgl_in = sgl_in;
+
+ ret = sec_alloc_and_fill_hw_sgl(&el->in, &el->dma_in, el->sgl_in,
+- n_ents_in, info);
++ n_ents_in, info, gfp);
+ if (ret)
+ goto err_free_el;
+
+@@ -687,7 +688,7 @@ static struct sec_request_el
+ el->sgl_out = sgl_out;
+ ret = sec_alloc_and_fill_hw_sgl(&el->out, &el->dma_out,
+ el->sgl_out,
+- n_ents_out, info);
++ n_ents_out, info, gfp);
+ if (ret)
+ goto err_free_hw_sgl_in;
+
+@@ -728,6 +729,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ int *splits_out_nents = NULL;
+ struct sec_request_el *el, *temp;
+ bool split = skreq->src != skreq->dst;
++ gfp_t gfp = skreq->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL : GFP_ATOMIC;
+
+ mutex_init(&sec_req->lock);
+ sec_req->req_base = &skreq->base;
+@@ -736,13 +738,13 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ sec_req->len_in = sg_nents(skreq->src);
+
+ ret = sec_alg_alloc_and_calc_split_sizes(skreq->cryptlen, &split_sizes,
+- &steps);
++ &steps, gfp);
+ if (ret)
+ return ret;
+ sec_req->num_elements = steps;
+ ret = sec_map_and_split_sg(skreq->src, split_sizes, steps, &splits_in,
+ &splits_in_nents, sec_req->len_in,
+- info->dev);
++ info->dev, gfp);
+ if (ret)
+ goto err_free_split_sizes;
+
+@@ -750,7 +752,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ sec_req->len_out = sg_nents(skreq->dst);
+ ret = sec_map_and_split_sg(skreq->dst, split_sizes, steps,
+ &splits_out, &splits_out_nents,
+- sec_req->len_out, info->dev);
++ sec_req->len_out, info->dev, gfp);
+ if (ret)
+ goto err_unmap_in_sg;
+ }
+@@ -783,7 +785,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ splits_in[i], splits_in_nents[i],
+ split ? splits_out[i] : NULL,
+ split ? splits_out_nents[i] : 0,
+- info);
++ info, gfp);
+ if (IS_ERR(el)) {
+ ret = PTR_ERR(el);
+ goto err_free_elements;
+diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c
+index 6bd8f6a2a24f..aeb03081415c 100644
+--- a/drivers/crypto/qat/qat_common/qat_uclo.c
++++ b/drivers/crypto/qat/qat_common/qat_uclo.c
+@@ -332,13 +332,18 @@ static int qat_uclo_create_batch_init_list(struct icp_qat_fw_loader_handle
+ }
+ return 0;
+ out_err:
++ /* Do not free the list head unless we allocated it. */
++ tail_old = tail_old->next;
++ if (flag) {
++ kfree(*init_tab_base);
++ *init_tab_base = NULL;
++ }
++
+ while (tail_old) {
+ mem_init = tail_old->next;
+ kfree(tail_old);
+ tail_old = mem_init;
+ }
+- if (flag)
+- kfree(*init_tab_base);
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
+index 0e7ea3591b78..5e7593753799 100644
+--- a/drivers/edac/edac_device_sysfs.c
++++ b/drivers/edac/edac_device_sysfs.c
+@@ -275,6 +275,7 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
+
+ /* Error exit stack */
+ err_kobj_reg:
++ kobject_put(&edac_dev->kobj);
+ module_put(edac_dev->owner);
+
+ err_out:
+diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
+index 72c9eb9fdffb..53042af7262e 100644
+--- a/drivers/edac/edac_pci_sysfs.c
++++ b/drivers/edac/edac_pci_sysfs.c
+@@ -386,7 +386,7 @@ static int edac_pci_main_kobj_setup(void)
+
+ /* Error unwind statck */
+ kobject_init_and_add_fail:
+- kfree(edac_pci_top_main_kobj);
++ kobject_put(edac_pci_top_main_kobj);
+
+ kzalloc_fail:
+ module_put(THIS_MODULE);
+diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+index 87f737e01473..041f8152272b 100644
+--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c
++++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+@@ -85,7 +85,10 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev)
+ for (i = 0; i < num_domains; i++, scmi_pd++) {
+ u32 state;
+
+- domains[i] = &scmi_pd->genpd;
++ if (handle->power_ops->state_get(handle, i, &state)) {
++ dev_warn(dev, "failed to get state for domain %d\n", i);
++ continue;
++ }
+
+ scmi_pd->domain = i;
+ scmi_pd->handle = handle;
+@@ -94,13 +97,10 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev)
+ scmi_pd->genpd.power_off = scmi_pd_power_off;
+ scmi_pd->genpd.power_on = scmi_pd_power_on;
+
+- if (handle->power_ops->state_get(handle, i, &state)) {
+- dev_warn(dev, "failed to get state for domain %d\n", i);
+- continue;
+- }
+-
+ pm_genpd_init(&scmi_pd->genpd, NULL,
+ state == SCMI_POWER_STATE_GENERIC_OFF);
++
++ domains[i] = &scmi_pd->genpd;
+ }
+
+ scmi_pd_data->domains = domains;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+index 869ff624b108..e5e51e4d4f3d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+@@ -396,7 +396,9 @@ int amdgpu_fence_driver_start_ring(struct amdgpu_ring *ring,
+ ring->fence_drv.gpu_addr = adev->uvd.inst[ring->me].gpu_addr + index;
+ }
+ amdgpu_fence_write(ring, atomic_read(&ring->fence_drv.last_seq));
+- amdgpu_irq_get(adev, irq_src, irq_type);
++
++ if (irq_src)
++ amdgpu_irq_get(adev, irq_src, irq_type);
+
+ ring->fence_drv.irq_src = irq_src;
+ ring->fence_drv.irq_type = irq_type;
+@@ -508,8 +510,9 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev)
+ /* no need to trigger GPU reset as we are unloading */
+ amdgpu_fence_driver_force_completion(ring);
+ }
+- amdgpu_irq_put(adev, ring->fence_drv.irq_src,
+- ring->fence_drv.irq_type);
++ if (ring->fence_drv.irq_src)
++ amdgpu_irq_put(adev, ring->fence_drv.irq_src,
++ ring->fence_drv.irq_type);
+ drm_sched_fini(&ring->sched);
+ del_timer_sync(&ring->fence_drv.fallback_timer);
+ for (j = 0; j <= ring->fence_drv.num_fences_mask; ++j)
+@@ -545,8 +548,9 @@ void amdgpu_fence_driver_suspend(struct amdgpu_device *adev)
+ }
+
+ /* disable the interrupt */
+- amdgpu_irq_put(adev, ring->fence_drv.irq_src,
+- ring->fence_drv.irq_type);
++ if (ring->fence_drv.irq_src)
++ amdgpu_irq_put(adev, ring->fence_drv.irq_src,
++ ring->fence_drv.irq_type);
+ }
+ }
+
+@@ -572,8 +576,9 @@ void amdgpu_fence_driver_resume(struct amdgpu_device *adev)
+ continue;
+
+ /* enable the interrupt */
+- amdgpu_irq_get(adev, ring->fence_drv.irq_src,
+- ring->fence_drv.irq_type);
++ if (ring->fence_drv.irq_src)
++ amdgpu_irq_get(adev, ring->fence_drv.irq_src,
++ ring->fence_drv.irq_type);
+ }
+ }
+
+diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
+index 29409a65d864..a347b27405d8 100644
+--- a/drivers/gpu/drm/arm/malidp_planes.c
++++ b/drivers/gpu/drm/arm/malidp_planes.c
+@@ -446,7 +446,7 @@ int malidp_de_planes_init(struct drm_device *drm)
+ const struct malidp_hw_regmap *map = &malidp->dev->hw->map;
+ struct malidp_plane *plane = NULL;
+ enum drm_plane_type plane_type;
+- unsigned long crtcs = 1 << drm->mode_config.num_crtc;
++ unsigned long crtcs = BIT(drm->mode_config.num_crtc);
+ unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 |
+ DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y;
+ u32 *formats;
+diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
+index a6e8f4591e63..1ea2a1b0fe37 100644
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -180,7 +180,7 @@ static void sii8620_read_buf(struct sii8620 *ctx, u16 addr, u8 *buf, int len)
+
+ static u8 sii8620_readb(struct sii8620 *ctx, u16 addr)
+ {
+- u8 ret;
++ u8 ret = 0;
+
+ sii8620_read_buf(ctx, addr, &ret, 1);
+ return ret;
+diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
+index 373bd4c2b698..84b7b22a9590 100644
+--- a/drivers/gpu/drm/drm_debugfs.c
++++ b/drivers/gpu/drm/drm_debugfs.c
+@@ -265,13 +265,13 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf,
+
+ buf[len] = '\0';
+
+- if (!strcmp(buf, "on"))
++ if (sysfs_streq(buf, "on"))
+ connector->force = DRM_FORCE_ON;
+- else if (!strcmp(buf, "digital"))
++ else if (sysfs_streq(buf, "digital"))
+ connector->force = DRM_FORCE_ON_DIGITAL;
+- else if (!strcmp(buf, "off"))
++ else if (sysfs_streq(buf, "off"))
+ connector->force = DRM_FORCE_OFF;
+- else if (!strcmp(buf, "unspecified"))
++ else if (sysfs_streq(buf, "unspecified"))
+ connector->force = DRM_FORCE_UNSPECIFIED;
+ else
+ return -EINVAL;
+diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c
+index 80b75501f5c6..7ed8e510565e 100644
+--- a/drivers/gpu/drm/drm_mipi_dsi.c
++++ b/drivers/gpu/drm/drm_mipi_dsi.c
+@@ -1034,11 +1034,11 @@ EXPORT_SYMBOL(mipi_dsi_dcs_set_pixel_format);
+ */
+ int mipi_dsi_dcs_set_tear_scanline(struct mipi_dsi_device *dsi, u16 scanline)
+ {
+- u8 payload[3] = { MIPI_DCS_SET_TEAR_SCANLINE, scanline >> 8,
+- scanline & 0xff };
++ u8 payload[2] = { scanline >> 8, scanline & 0xff };
+ ssize_t err;
+
+- err = mipi_dsi_generic_write(dsi, payload, sizeof(payload));
++ err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_TEAR_SCANLINE, payload,
++ sizeof(payload));
+ if (err < 0)
+ return err;
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+index 6a859e077ea0..37ae15dc4fc6 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+@@ -694,7 +694,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+ ret = pm_runtime_get_sync(gpu->dev);
+ if (ret < 0) {
+ dev_err(gpu->dev, "Failed to enable GPU power domain\n");
+- return ret;
++ goto pm_put;
+ }
+
+ etnaviv_hw_identify(gpu);
+@@ -808,6 +808,7 @@ destroy_iommu:
+ gpu->mmu = NULL;
+ fail:
+ pm_runtime_mark_last_busy(gpu->dev);
++pm_put:
+ pm_runtime_put_autosuspend(gpu->dev);
+
+ return ret;
+@@ -848,7 +849,7 @@ int etnaviv_gpu_debugfs(struct etnaviv_gpu *gpu, struct seq_file *m)
+
+ ret = pm_runtime_get_sync(gpu->dev);
+ if (ret < 0)
+- return ret;
++ goto pm_put;
+
+ dma_lo = gpu_read(gpu, VIVS_FE_DMA_LOW);
+ dma_hi = gpu_read(gpu, VIVS_FE_DMA_HIGH);
+@@ -971,6 +972,7 @@ int etnaviv_gpu_debugfs(struct etnaviv_gpu *gpu, struct seq_file *m)
+ ret = 0;
+
+ pm_runtime_mark_last_busy(gpu->dev);
++pm_put:
+ pm_runtime_put_autosuspend(gpu->dev);
+
+ return ret;
+@@ -985,7 +987,7 @@ void etnaviv_gpu_recover_hang(struct etnaviv_gpu *gpu)
+ dev_err(gpu->dev, "recover hung GPU!\n");
+
+ if (pm_runtime_get_sync(gpu->dev) < 0)
+- return;
++ goto pm_put;
+
+ mutex_lock(&gpu->lock);
+
+@@ -1005,6 +1007,7 @@ void etnaviv_gpu_recover_hang(struct etnaviv_gpu *gpu)
+
+ mutex_unlock(&gpu->lock);
+ pm_runtime_mark_last_busy(gpu->dev);
++pm_put:
+ pm_runtime_put_autosuspend(gpu->dev);
+ }
+
+@@ -1278,8 +1281,10 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit)
+
+ if (!submit->runtime_resumed) {
+ ret = pm_runtime_get_sync(gpu->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(gpu->dev);
+ return NULL;
++ }
+ submit->runtime_resumed = true;
+ }
+
+@@ -1296,6 +1301,7 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit)
+ ret = event_alloc(gpu, nr_events, event);
+ if (ret) {
+ DRM_ERROR("no free events\n");
++ pm_runtime_put_noidle(gpu->dev);
+ return NULL;
+ }
+
+@@ -1459,7 +1465,7 @@ static int etnaviv_gpu_clk_enable(struct etnaviv_gpu *gpu)
+ if (gpu->clk_bus) {
+ ret = clk_prepare_enable(gpu->clk_bus);
+ if (ret)
+- return ret;
++ goto disable_clk_reg;
+ }
+
+ if (gpu->clk_core) {
+@@ -1482,6 +1488,9 @@ disable_clk_core:
+ disable_clk_bus:
+ if (gpu->clk_bus)
+ clk_disable_unprepare(gpu->clk_bus);
++disable_clk_reg:
++ if (gpu->clk_reg)
++ clk_disable_unprepare(gpu->clk_reg);
+
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c
+index cffd3310240e..c19c1dfbfcdc 100644
+--- a/drivers/gpu/drm/imx/imx-tve.c
++++ b/drivers/gpu/drm/imx/imx-tve.c
+@@ -498,6 +498,13 @@ static int imx_tve_register(struct drm_device *drm, struct imx_tve *tve)
+ return 0;
+ }
+
++static void imx_tve_disable_regulator(void *data)
++{
++ struct imx_tve *tve = data;
++
++ regulator_disable(tve->dac_reg);
++}
++
+ static bool imx_tve_readable_reg(struct device *dev, unsigned int reg)
+ {
+ return (reg % 4 == 0) && (reg <= 0xdc);
+@@ -622,6 +629,9 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)
+ ret = regulator_enable(tve->dac_reg);
+ if (ret)
+ return ret;
++ ret = devm_add_action_or_reset(dev, imx_tve_disable_regulator, tve);
++ if (ret)
++ return ret;
+ }
+
+ tve->clk = devm_clk_get(dev, "tve");
+@@ -668,18 +678,8 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data)
+ return 0;
+ }
+
+-static void imx_tve_unbind(struct device *dev, struct device *master,
+- void *data)
+-{
+- struct imx_tve *tve = dev_get_drvdata(dev);
+-
+- if (!IS_ERR(tve->dac_reg))
+- regulator_disable(tve->dac_reg);
+-}
+-
+ static const struct component_ops imx_tve_ops = {
+ .bind = imx_tve_bind,
+- .unbind = imx_tve_unbind,
+ };
+
+ static int imx_tve_probe(struct platform_device *pdev)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index 4752f08f0884..3c3b7f7013e8 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -659,7 +659,7 @@ static void dpu_crtc_frame_event_cb(void *data, u32 event)
+ spin_unlock_irqrestore(&dpu_crtc->spin_lock, flags);
+
+ if (!fevent) {
+- DRM_ERROR("crtc%d event %d overflow\n", crtc->base.id, event);
++ DRM_ERROR_RATELIMITED("crtc%d event %d overflow\n", crtc->base.id, event);
+ return;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index 2b7a54cc3c9e..81999bed1e4a 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -899,8 +899,10 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv)
+
+ /* need to bring up power immediately if opening device */
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
++ }
+
+ get_task_comm(tmpname, current);
+ snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid));
+@@ -980,8 +982,10 @@ nouveau_drm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ long ret;
+
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
++ }
+
+ switch (_IOC_NR(cmd) - DRM_COMMAND_BASE) {
+ case DRM_NOUVEAU_NVIF:
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index b56524d343c3..791f970714ed 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -46,8 +46,10 @@ nouveau_gem_object_del(struct drm_gem_object *gem)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (WARN_ON(ret < 0 && ret != -EACCES))
++ if (WARN_ON(ret < 0 && ret != -EACCES)) {
++ pm_runtime_put_autosuspend(dev);
+ return;
++ }
+
+ if (gem->import_attach)
+ drm_prime_gem_destroy(gem, nvbo->bo.sg);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+index 8ebdc74cc0ad..326948b65542 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
++++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+@@ -96,12 +96,9 @@ nouveau_sgdma_create_ttm(struct ttm_buffer_object *bo, uint32_t page_flags)
+ else
+ nvbe->ttm.ttm.func = &nv50_sgdma_backend;
+
+- if (ttm_dma_tt_init(&nvbe->ttm, bo, page_flags))
+- /*
+- * A failing ttm_dma_tt_init() will call ttm_tt_destroy()
+- * and thus our nouveau_sgdma_destroy() hook, so we don't need
+- * to free nvbe here.
+- */
++ if (ttm_dma_tt_init(&nvbe->ttm, bo, page_flags)) {
++ kfree(nvbe);
+ return NULL;
++ }
+ return &nvbe->ttm.ttm;
+ }
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 654fea2b4312..8814aa38c5e7 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -1503,7 +1503,7 @@ static const struct drm_display_mode lg_lb070wv8_mode = {
+ static const struct panel_desc lg_lb070wv8 = {
+ .modes = &lg_lb070wv8_mode,
+ .num_modes = 1,
+- .bpc = 16,
++ .bpc = 8,
+ .size = {
+ .width = 151,
+ .height = 91,
+diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
+index 9e7d5e44a12f..90c1afe498be 100644
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -4364,7 +4364,7 @@ static int ci_set_mc_special_registers(struct radeon_device *rdev,
+ table->mc_reg_table_entry[k].mc_data[j] |= 0x100;
+ }
+ j++;
+- if (j > SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE)
++ if (j >= SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE)
+ return -EINVAL;
+
+ if (!pi->mem_gddr5) {
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 7d1e14f0140a..3f0f3a578ddf 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -625,8 +625,10 @@ radeon_crtc_set_config(struct drm_mode_set *set,
+ dev = set->crtc->dev;
+
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
++ }
+
+ ret = drm_crtc_helper_set_config(set, ctx);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
+index c26f09b47ecb..0cd33289c2b6 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -168,12 +168,7 @@ int radeon_no_wb;
+ int radeon_modeset = -1;
+ int radeon_dynclks = -1;
+ int radeon_r4xx_atom = 0;
+-#ifdef __powerpc__
+-/* Default to PCI on PowerPC (fdo #95017) */
+ int radeon_agpmode = -1;
+-#else
+-int radeon_agpmode = 0;
+-#endif
+ int radeon_vram_limit = 0;
+ int radeon_gart_size = -1; /* auto */
+ int radeon_benchmarking = 0;
+@@ -523,8 +518,10 @@ long radeon_drm_ioctl(struct file *filp,
+ long ret;
+ dev = file_priv->minor->dev;
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
++ }
+
+ ret = drm_ioctl(filp, cmd, arg);
+
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index 3ff835767ac5..34b3cb6c146f 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -627,8 +627,10 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
+ file_priv->driver_priv = NULL;
+
+ r = pm_runtime_get_sync(dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return r;
++ }
+
+ /* new gpu have virtual address space support */
+ if (rdev->family >= CHIP_CAYMAN) {
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+index a1acab39d87f..096a33f12c61 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+@@ -150,12 +150,16 @@ static int panel_connector_get_modes(struct drm_connector *connector)
+ int i;
+
+ for (i = 0; i < timings->num_timings; i++) {
+- struct drm_display_mode *mode = drm_mode_create(dev);
++ struct drm_display_mode *mode;
+ struct videomode vm;
+
+ if (videomode_from_timings(timings, &vm, i))
+ break;
+
++ mode = drm_mode_create(dev);
++ if (!mode)
++ break;
++
+ drm_display_mode_from_videomode(&vm, mode);
+
+ mode->type = DRM_MODE_TYPE_DRIVER;
+diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c
+index e3a0691582ff..68cfa25674e5 100644
+--- a/drivers/gpu/drm/ttm/ttm_tt.c
++++ b/drivers/gpu/drm/ttm/ttm_tt.c
+@@ -241,7 +241,6 @@ int ttm_tt_init(struct ttm_tt *ttm, struct ttm_buffer_object *bo,
+ ttm_tt_init_fields(ttm, bo, page_flags);
+
+ if (ttm_tt_alloc_page_directory(ttm)) {
+- ttm_tt_destroy(ttm);
+ pr_err("Failed allocating page table\n");
+ return -ENOMEM;
+ }
+@@ -265,7 +264,6 @@ int ttm_dma_tt_init(struct ttm_dma_tt *ttm_dma, struct ttm_buffer_object *bo,
+
+ INIT_LIST_HEAD(&ttm_dma->pages_list);
+ if (ttm_dma_tt_alloc_page_directory(ttm_dma)) {
+- ttm_tt_destroy(ttm);
+ pr_err("Failed allocating page table\n");
+ return -ENOMEM;
+ }
+@@ -287,7 +285,6 @@ int ttm_sg_tt_init(struct ttm_dma_tt *ttm_dma, struct ttm_buffer_object *bo,
+ else
+ ret = ttm_dma_tt_alloc_page_directory(ttm_dma);
+ if (ret) {
+- ttm_tt_destroy(ttm);
+ pr_err("Failed allocating page table\n");
+ return -ENOMEM;
+ }
+diff --git a/drivers/gpu/host1x/debug.c b/drivers/gpu/host1x/debug.c
+index 329e4a3d8ae7..6c9ad4533999 100644
+--- a/drivers/gpu/host1x/debug.c
++++ b/drivers/gpu/host1x/debug.c
+@@ -25,6 +25,8 @@
+ #include "debug.h"
+ #include "channel.h"
+
++static DEFINE_MUTEX(debug_lock);
++
+ unsigned int host1x_debug_trace_cmdbuf;
+
+ static pid_t host1x_debug_force_timeout_pid;
+@@ -61,12 +63,14 @@ static int show_channel(struct host1x_channel *ch, void *data, bool show_fifo)
+ struct output *o = data;
+
+ mutex_lock(&ch->cdma.lock);
++ mutex_lock(&debug_lock);
+
+ if (show_fifo)
+ host1x_hw_show_channel_fifo(m, ch, o);
+
+ host1x_hw_show_channel_cdma(m, ch, o);
+
++ mutex_unlock(&debug_lock);
+ mutex_unlock(&ch->cdma.lock);
+
+ return 0;
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index dbb0cbe65fc9..51bfe23d00bc 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -362,13 +362,13 @@ static int hidinput_query_battery_capacity(struct hid_device *dev)
+ u8 *buf;
+ int ret;
+
+- buf = kmalloc(2, GFP_KERNEL);
++ buf = kmalloc(4, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+- ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 2,
++ ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 4,
+ dev->battery_report_type, HID_REQ_GET_REPORT);
+- if (ret != 2) {
++ if (ret < 2) {
+ kfree(buf);
+ return -ENODATA;
+ }
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+index e90af39283b1..29dc2eac5b06 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+@@ -583,15 +583,14 @@ int tmc_read_unprepare_etb(struct tmc_drvdata *drvdata)
+
+ spin_lock_irqsave(&drvdata->spinlock, flags);
+
+- /* There is no point in reading a TMC in HW FIFO mode */
+- mode = readl_relaxed(drvdata->base + TMC_MODE);
+- if (mode != TMC_MODE_CIRCULAR_BUFFER) {
+- spin_unlock_irqrestore(&drvdata->spinlock, flags);
+- return -EINVAL;
+- }
+-
+ /* Re-enable the TMC if need be */
+ if (drvdata->mode == CS_MODE_SYSFS) {
++ /* There is no point in reading a TMC in HW FIFO mode */
++ mode = readl_relaxed(drvdata->base + TMC_MODE);
++ if (mode != TMC_MODE_CIRCULAR_BUFFER) {
++ spin_unlock_irqrestore(&drvdata->spinlock, flags);
++ return -EINVAL;
++ }
+ /*
+ * The trace run will continue with the same allocated trace
+ * buffer. As such zero-out the buffer so that we don't end
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index 82f309fb3ce5..e8432876cc86 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1617,7 +1617,7 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr,
+ if (!(rdma_protocol_ib(qp->device,
+ attr->alt_ah_attr.port_num) &&
+ rdma_protocol_ib(qp->device, port))) {
+- ret = EINVAL;
++ ret = -EINVAL;
+ goto out;
+ }
+ }
+diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
+index a2d708dceb8d..cca12100c583 100644
+--- a/drivers/infiniband/hw/qedr/qedr.h
++++ b/drivers/infiniband/hw/qedr/qedr.h
+@@ -351,10 +351,10 @@ struct qedr_srq_hwq_info {
+ u32 wqe_prod;
+ u32 sge_prod;
+ u32 wr_prod_cnt;
+- u32 wr_cons_cnt;
++ atomic_t wr_cons_cnt;
+ u32 num_elems;
+
+- u32 *virt_prod_pair_addr;
++ struct rdma_srq_producers *virt_prod_pair_addr;
+ dma_addr_t phy_prod_pair_addr;
+ };
+
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 38fe2f741375..7b26afc7fef3 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -3577,7 +3577,7 @@ static u32 qedr_srq_elem_left(struct qedr_srq_hwq_info *hw_srq)
+ * count and consumer count and subtract it from max
+ * work request supported so that we get elements left.
+ */
+- used = hw_srq->wr_prod_cnt - hw_srq->wr_cons_cnt;
++ used = hw_srq->wr_prod_cnt - (u32)atomic_read(&hw_srq->wr_cons_cnt);
+
+ return hw_srq->max_wr - used;
+ }
+@@ -3592,7 +3592,6 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr,
+ unsigned long flags;
+ int status = 0;
+ u32 num_sge;
+- u32 offset;
+
+ spin_lock_irqsave(&srq->lock, flags);
+
+@@ -3605,7 +3604,8 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr,
+ if (!qedr_srq_elem_left(hw_srq) ||
+ wr->num_sge > srq->hw_srq.max_sges) {
+ DP_ERR(dev, "Can't post WR (%d,%d) || (%d > %d)\n",
+- hw_srq->wr_prod_cnt, hw_srq->wr_cons_cnt,
++ hw_srq->wr_prod_cnt,
++ atomic_read(&hw_srq->wr_cons_cnt),
+ wr->num_sge, srq->hw_srq.max_sges);
+ status = -ENOMEM;
+ *bad_wr = wr;
+@@ -3639,22 +3639,20 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr,
+ hw_srq->sge_prod++;
+ }
+
+- /* Flush WQE and SGE information before
++ /* Update WQE and SGE information before
+ * updating producer.
+ */
+- wmb();
++ dma_wmb();
+
+ /* SRQ producer is 8 bytes. Need to update SGE producer index
+ * in first 4 bytes and need to update WQE producer in
+ * next 4 bytes.
+ */
+- *srq->hw_srq.virt_prod_pair_addr = hw_srq->sge_prod;
+- offset = offsetof(struct rdma_srq_producers, wqe_prod);
+- *((u8 *)srq->hw_srq.virt_prod_pair_addr + offset) =
+- hw_srq->wqe_prod;
++ srq->hw_srq.virt_prod_pair_addr->sge_prod = hw_srq->sge_prod;
++ /* Make sure sge producer is updated first */
++ dma_wmb();
++ srq->hw_srq.virt_prod_pair_addr->wqe_prod = hw_srq->wqe_prod;
+
+- /* Flush producer after updating it. */
+- wmb();
+ wr = wr->next;
+ }
+
+@@ -4077,7 +4075,7 @@ static int process_resp_one_srq(struct qedr_dev *dev, struct qedr_qp *qp,
+ } else {
+ __process_resp_one(dev, qp, cq, wc, resp, wr_id);
+ }
+- srq->hw_srq.wr_cons_cnt++;
++ atomic_inc(&srq->hw_srq.wr_cons_cnt);
+
+ return 1;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
+index 695a607e2d14..b8f3e65402d1 100644
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -332,10 +332,14 @@ err1:
+
+ static int rxe_match_dgid(struct rxe_dev *rxe, struct sk_buff *skb)
+ {
++ struct rxe_pkt_info *pkt = SKB_TO_PKT(skb);
+ const struct ib_gid_attr *gid_attr;
+ union ib_gid dgid;
+ union ib_gid *pdgid;
+
++ if (pkt->mask & RXE_LOOPBACK_MASK)
++ return 0;
++
+ if (skb->protocol == htons(ETH_P_IP)) {
+ ipv6_addr_set_v4mapped(ip_hdr(skb)->daddr,
+ (struct in6_addr *)&dgid);
+@@ -368,7 +372,7 @@ void rxe_rcv(struct sk_buff *skb)
+ if (unlikely(skb->len < pkt->offset + RXE_BTH_BYTES))
+ goto drop;
+
+- if (unlikely(rxe_match_dgid(rxe, skb) < 0)) {
++ if (rxe_match_dgid(rxe, skb) < 0) {
+ pr_warn_ratelimited("failed matching dgid\n");
+ goto drop;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index f5b1e0ad6142..3a94eb5edcf9 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -733,6 +733,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr,
+ unsigned int mask;
+ unsigned int length = 0;
+ int i;
++ struct ib_send_wr *next;
+
+ while (wr) {
+ mask = wr_opcode_mask(wr->opcode, qp);
+@@ -749,6 +750,8 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr,
+ break;
+ }
+
++ next = wr->next;
++
+ length = 0;
+ for (i = 0; i < wr->num_sge; i++)
+ length += wr->sg_list[i].length;
+@@ -759,7 +762,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr,
+ *bad_wr = wr;
+ break;
+ }
+- wr = wr->next;
++ wr = next;
+ }
+
+ rxe_run_task(&qp->req.task, 1);
+diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
+index 852e2841395b..15a4ad31c510 100644
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -601,13 +601,21 @@ out_free_table:
+
+ static void intel_teardown_irq_remapping(struct intel_iommu *iommu)
+ {
++ struct fwnode_handle *fn;
++
+ if (iommu && iommu->ir_table) {
+ if (iommu->ir_msi_domain) {
++ fn = iommu->ir_msi_domain->fwnode;
++
+ irq_domain_remove(iommu->ir_msi_domain);
++ irq_domain_free_fwnode(fn);
+ iommu->ir_msi_domain = NULL;
+ }
+ if (iommu->ir_domain) {
++ fn = iommu->ir_domain->fwnode;
++
+ irq_domain_remove(iommu->ir_domain);
++ irq_domain_free_fwnode(fn);
+ iommu->ir_domain = NULL;
+ }
+ free_pages((unsigned long)iommu->ir_table->base,
+diff --git a/drivers/irqchip/irq-mtk-sysirq.c b/drivers/irqchip/irq-mtk-sysirq.c
+index 90aaf190157f..42455f31b061 100644
+--- a/drivers/irqchip/irq-mtk-sysirq.c
++++ b/drivers/irqchip/irq-mtk-sysirq.c
+@@ -23,7 +23,7 @@
+ #include <linux/spinlock.h>
+
+ struct mtk_sysirq_chip_data {
+- spinlock_t lock;
++ raw_spinlock_t lock;
+ u32 nr_intpol_bases;
+ void __iomem **intpol_bases;
+ u32 *intpol_words;
+@@ -45,7 +45,7 @@ static int mtk_sysirq_set_type(struct irq_data *data, unsigned int type)
+ reg_index = chip_data->which_word[hwirq];
+ offset = hwirq & 0x1f;
+
+- spin_lock_irqsave(&chip_data->lock, flags);
++ raw_spin_lock_irqsave(&chip_data->lock, flags);
+ value = readl_relaxed(base + reg_index * 4);
+ if (type == IRQ_TYPE_LEVEL_LOW || type == IRQ_TYPE_EDGE_FALLING) {
+ if (type == IRQ_TYPE_LEVEL_LOW)
+@@ -61,7 +61,7 @@ static int mtk_sysirq_set_type(struct irq_data *data, unsigned int type)
+
+ data = data->parent_data;
+ ret = data->chip->irq_set_type(data, type);
+- spin_unlock_irqrestore(&chip_data->lock, flags);
++ raw_spin_unlock_irqrestore(&chip_data->lock, flags);
+ return ret;
+ }
+
+@@ -220,7 +220,7 @@ static int __init mtk_sysirq_of_init(struct device_node *node,
+ ret = -ENOMEM;
+ goto out_free_which_word;
+ }
+- spin_lock_init(&chip_data->lock);
++ raw_spin_lock_init(&chip_data->lock);
+
+ return 0;
+
+diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
+index 3c7e3487b373..4e63dd2bfcf8 100644
+--- a/drivers/leds/led-class.c
++++ b/drivers/leds/led-class.c
+@@ -173,6 +173,7 @@ void led_classdev_suspend(struct led_classdev *led_cdev)
+ {
+ led_cdev->flags |= LED_SUSPENDED;
+ led_set_brightness_nopm(led_cdev, 0);
++ flush_work(&led_cdev->set_brightness_work);
+ }
+ EXPORT_SYMBOL_GPL(led_classdev_suspend);
+
+diff --git a/drivers/leds/leds-lm355x.c b/drivers/leds/leds-lm355x.c
+index 6cb94f9a2f3f..b9c60dd2b132 100644
+--- a/drivers/leds/leds-lm355x.c
++++ b/drivers/leds/leds-lm355x.c
+@@ -168,18 +168,19 @@ static int lm355x_chip_init(struct lm355x_chip_data *chip)
+ /* input and output pins configuration */
+ switch (chip->type) {
+ case CHIP_LM3554:
+- reg_val = pdata->pin_tx2 | pdata->ntc_pin;
++ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin;
+ ret = regmap_update_bits(chip->regmap, 0xE0, 0x28, reg_val);
+ if (ret < 0)
+ goto out;
+- reg_val = pdata->pass_mode;
++ reg_val = (u32)pdata->pass_mode;
+ ret = regmap_update_bits(chip->regmap, 0xA0, 0x04, reg_val);
+ if (ret < 0)
+ goto out;
+ break;
+
+ case CHIP_LM3556:
+- reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode;
++ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin |
++ (u32)pdata->pass_mode;
+ ret = regmap_update_bits(chip->regmap, 0x0A, 0xC4, reg_val);
+ if (ret < 0)
+ goto out;
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 68ebc2759c2e..46ad0bf18e1f 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2013,7 +2013,14 @@ found:
+ sysfs_create_link(&c->kobj, &ca->kobj, buf))
+ goto err;
+
+- if (ca->sb.seq > c->sb.seq) {
++ /*
++ * A special case is both ca->sb.seq and c->sb.seq are 0,
++ * such condition happens on a new created cache device whose
++ * super block is never flushed yet. In this case c->sb.version
++ * and other members should be updated too, otherwise we will
++ * have a mistaken super block version in cache set.
++ */
++ if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) {
+ c->sb.version = ca->sb.version;
+ memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16);
+ c->sb.flags = ca->sb.flags;
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index 0b2af6e74fc3..4522e87d9d68 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -1443,6 +1443,7 @@ static void unlock_all_bitmaps(struct mddev *mddev)
+ }
+ }
+ kfree(cinfo->other_bitmap_lockres);
++ cinfo->other_bitmap_lockres = NULL;
+ }
+ }
+
+diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c
+index 92f4112d2e37..eaf94b817dbc 100644
+--- a/drivers/media/firewire/firedtv-fw.c
++++ b/drivers/media/firewire/firedtv-fw.c
+@@ -271,6 +271,8 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
+
+ name_len = fw_csr_string(unit->directory, CSR_MODEL,
+ name, sizeof(name));
++ if (name_len < 0)
++ return name_len;
+ for (i = ARRAY_SIZE(model_names); --i; )
+ if (strlen(model_names[i]) <= name_len &&
+ strncmp(name, model_names[i], name_len) == 0)
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index b5993532831d..2d25a197dc65 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -1259,6 +1259,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd)
+
+ pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl,
+ PINCTRL_STATE_IDLE);
++ if (IS_ERR(pctl->state_idle))
++ return PTR_ERR(pctl->state_idle);
++
+ return 0;
+ }
+
+diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c
+index 591c6de498f8..20857ae42a77 100644
+--- a/drivers/media/platform/omap3isp/isppreview.c
++++ b/drivers/media/platform/omap3isp/isppreview.c
+@@ -2290,7 +2290,7 @@ static int preview_init_entities(struct isp_prev_device *prev)
+ me->ops = &preview_media_ops;
+ ret = media_entity_pads_init(me, PREV_PADS_NUM, pads);
+ if (ret < 0)
+- return ret;
++ goto error_handler_free;
+
+ preview_init_formats(sd, NULL);
+
+@@ -2323,6 +2323,8 @@ error_video_out:
+ omap3isp_video_cleanup(&prev->video_in);
+ error_video_in:
+ media_entity_cleanup(&prev->subdev.entity);
++error_handler_free:
++ v4l2_ctrl_handler_free(&prev->ctrls);
+ return ret;
+ }
+
+diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
+index 629e2e156412..0baa229d2b7d 100644
+--- a/drivers/misc/cxl/sysfs.c
++++ b/drivers/misc/cxl/sysfs.c
+@@ -628,7 +628,7 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c
+ rc = kobject_init_and_add(&cr->kobj, &afu_config_record_type,
+ &afu->dev.kobj, "cr%i", cr->cr);
+ if (rc)
+- goto err;
++ goto err1;
+
+ rc = sysfs_create_bin_file(&cr->kobj, &cr->config_attr);
+ if (rc)
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index 1f9d64aeb863..9fcbcf4b217b 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -466,11 +466,13 @@ struct qcom_nand_host {
+ * among different NAND controllers.
+ * @ecc_modes - ecc mode for NAND
+ * @is_bam - whether NAND controller is using BAM
++ * @is_qpic - whether NAND CTRL is part of qpic IP
+ * @dev_cmd_reg_start - NAND_DEV_CMD_* registers starting offset
+ */
+ struct qcom_nandc_props {
+ u32 ecc_modes;
+ bool is_bam;
++ bool is_qpic;
+ u32 dev_cmd_reg_start;
+ };
+
+@@ -2766,7 +2768,8 @@ static int qcom_nandc_setup(struct qcom_nand_controller *nandc)
+ u32 nand_ctrl;
+
+ /* kill onenand */
+- nandc_write(nandc, SFLASHC_BURST_CFG, 0);
++ if (!nandc->props->is_qpic)
++ nandc_write(nandc, SFLASHC_BURST_CFG, 0);
+ nandc_write(nandc, dev_cmd_reg_addr(nandc, NAND_DEV_CMD_VLD),
+ NAND_DEV_CMD_VLD_VAL);
+
+@@ -3022,12 +3025,14 @@ static const struct qcom_nandc_props ipq806x_nandc_props = {
+ static const struct qcom_nandc_props ipq4019_nandc_props = {
+ .ecc_modes = (ECC_BCH_4BIT | ECC_BCH_8BIT),
+ .is_bam = true,
++ .is_qpic = true,
+ .dev_cmd_reg_start = 0x0,
+ };
+
+ static const struct qcom_nandc_props ipq8074_nandc_props = {
+ .ecc_modes = (ECC_BCH_4BIT | ECC_BCH_8BIT),
+ .is_bam = true,
++ .is_qpic = true,
+ .dev_cmd_reg_start = 0x7000,
+ };
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 43b00e8bcdcd..6fa8aa69b418 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2930,7 +2930,6 @@ static const struct mv88e6xxx_ops mv88e6097_ops = {
+ .port_set_frame_mode = mv88e6351_port_set_frame_mode,
+ .port_set_egress_floods = mv88e6352_port_set_egress_floods,
+ .port_set_ether_type = mv88e6351_port_set_ether_type,
+- .port_set_jumbo_size = mv88e6165_port_set_jumbo_size,
+ .port_egress_rate_limiting = mv88e6095_port_egress_rate_limiting,
+ .port_pause_limit = mv88e6097_port_pause_limit,
+ .port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
+diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c
+index c281c488a306..7e27c9aff9b7 100644
+--- a/drivers/net/dsa/rtl8366.c
++++ b/drivers/net/dsa/rtl8366.c
+@@ -43,18 +43,26 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member,
+ int ret;
+ int i;
+
++ dev_dbg(smi->dev,
++ "setting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n",
++ vid, member, untag);
++
+ /* Update the 4K table */
+ ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k);
+ if (ret)
+ return ret;
+
+- vlan4k.member = member;
+- vlan4k.untag = untag;
++ vlan4k.member |= member;
++ vlan4k.untag |= untag;
+ vlan4k.fid = fid;
+ ret = smi->ops->set_vlan_4k(smi, &vlan4k);
+ if (ret)
+ return ret;
+
++ dev_dbg(smi->dev,
++ "resulting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n",
++ vid, vlan4k.member, vlan4k.untag);
++
+ /* Try to find an existing MC entry for this VID */
+ for (i = 0; i < smi->num_vlan_mc; i++) {
+ struct rtl8366_vlan_mc vlanmc;
+@@ -65,11 +73,16 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member,
+
+ if (vid == vlanmc.vid) {
+ /* update the MC entry */
+- vlanmc.member = member;
+- vlanmc.untag = untag;
++ vlanmc.member |= member;
++ vlanmc.untag |= untag;
+ vlanmc.fid = fid;
+
+ ret = smi->ops->set_vlan_mc(smi, i, &vlanmc);
++
++ dev_dbg(smi->dev,
++ "resulting VLAN%d MC members: 0x%02x, untagged: 0x%02x\n",
++ vid, vlanmc.member, vlanmc.untag);
++
+ break;
+ }
+ }
+@@ -384,7 +397,7 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port,
+ if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port))
+ dev_err(smi->dev, "port is DSA or CPU port\n");
+
+- for (vid = vlan->vid_begin; vid <= vlan->vid_end; ++vid) {
++ for (vid = vlan->vid_begin; vid <= vlan->vid_end; vid++) {
+ int pvid_val = 0;
+
+ dev_info(smi->dev, "add VLAN %04x\n", vid);
+@@ -407,13 +420,13 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port,
+ if (ret < 0)
+ return;
+ }
+- }
+
+- ret = rtl8366_set_vlan(smi, port, member, untag, 0);
+- if (ret)
+- dev_err(smi->dev,
+- "failed to set up VLAN %04x",
+- vid);
++ ret = rtl8366_set_vlan(smi, vid, member, untag, 0);
++ if (ret)
++ dev_err(smi->dev,
++ "failed to set up VLAN %04x",
++ vid);
++ }
+ }
+ EXPORT_SYMBOL_GPL(rtl8366_vlan_add);
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+index dab5891b9714..d48595470ec8 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+@@ -774,7 +774,7 @@ static int hw_atl_a0_hw_multicast_list_set(struct aq_hw_s *self,
+ int err = 0;
+
+ if (count > (HW_ATL_A0_MAC_MAX - HW_ATL_A0_MAC_MIN)) {
+- err = EBADRQC;
++ err = -EBADRQC;
+ goto err_exit;
+ }
+ for (self->aq_nic_cfg->mc_list_count = 0U;
+diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+index 9f4f3c1d5043..55fe80ca10d3 100644
+--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+@@ -1167,7 +1167,7 @@ static int cn23xx_get_pf_num(struct octeon_device *oct)
+ oct->pf_num = ((fdl_bit >> CN23XX_PCIE_SRIOV_FDL_BIT_POS) &
+ CN23XX_PCIE_SRIOV_FDL_MASK);
+ } else {
+- ret = EINVAL;
++ ret = -EINVAL;
+
+ /* Under some virtual environments, extended PCI regs are
+ * inaccessible, in which case the above read will have failed.
+diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
+index 21d8023535ae..eba7e54ecf85 100644
+--- a/drivers/net/ethernet/freescale/fman/fman.c
++++ b/drivers/net/ethernet/freescale/fman/fman.c
+@@ -1396,8 +1396,7 @@ static void enable_time_stamp(struct fman *fman)
+ {
+ struct fman_fpm_regs __iomem *fpm_rg = fman->fpm_regs;
+ u16 fm_clk_freq = fman->state->fm_clk_freq;
+- u32 tmp, intgr, ts_freq;
+- u64 frac;
++ u32 tmp, intgr, ts_freq, frac;
+
+ ts_freq = (u32)(1 << fman->state->count1_micro_bit);
+ /* configure timestamp so that bit 8 will count 1 microsecond
+diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
+index 1ca543ac8f2c..d2de9ea80c43 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c
++++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
+@@ -1205,7 +1205,7 @@ int dtsec_del_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr)
+ list_for_each(pos,
+ &dtsec->multicast_addr_hash->lsts[bucket]) {
+ hash_entry = ETH_HASH_ENTRY_OBJ(pos);
+- if (hash_entry->addr == addr) {
++ if (hash_entry && hash_entry->addr == addr) {
+ list_del_init(&hash_entry->node);
+ kfree(hash_entry);
+ break;
+@@ -1218,7 +1218,7 @@ int dtsec_del_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr)
+ list_for_each(pos,
+ &dtsec->unicast_addr_hash->lsts[bucket]) {
+ hash_entry = ETH_HASH_ENTRY_OBJ(pos);
+- if (hash_entry->addr == addr) {
++ if (hash_entry && hash_entry->addr == addr) {
+ list_del_init(&hash_entry->node);
+ kfree(hash_entry);
+ break;
+diff --git a/drivers/net/ethernet/freescale/fman/fman_mac.h b/drivers/net/ethernet/freescale/fman/fman_mac.h
+index dd6d0526f6c1..19f327efdaff 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_mac.h
++++ b/drivers/net/ethernet/freescale/fman/fman_mac.h
+@@ -252,7 +252,7 @@ static inline struct eth_hash_t *alloc_hash_table(u16 size)
+ struct eth_hash_t *hash;
+
+ /* Allocate address hash table */
+- hash = kmalloc_array(size, sizeof(struct eth_hash_t *), GFP_KERNEL);
++ hash = kmalloc(sizeof(*hash), GFP_KERNEL);
+ if (!hash)
+ return NULL;
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
+index e1901874c19f..9088b4f4b4b8 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
+@@ -856,7 +856,6 @@ int memac_set_tx_pause_frames(struct fman_mac *memac, u8 priority,
+
+ tmp = ioread32be(®s->command_config);
+ tmp &= ~CMD_CFG_PFC_MODE;
+- priority = 0;
+
+ iowrite32be(tmp, ®s->command_config);
+
+@@ -986,7 +985,7 @@ int memac_del_hash_mac_address(struct fman_mac *memac, enet_addr_t *eth_addr)
+
+ list_for_each(pos, &memac->multicast_addr_hash->lsts[hash]) {
+ hash_entry = ETH_HASH_ENTRY_OBJ(pos);
+- if (hash_entry->addr == addr) {
++ if (hash_entry && hash_entry->addr == addr) {
+ list_del_init(&hash_entry->node);
+ kfree(hash_entry);
+ break;
+diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c
+index ee82ee1384eb..47f6fee1f396 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_port.c
++++ b/drivers/net/ethernet/freescale/fman/fman_port.c
+@@ -1756,6 +1756,7 @@ static int fman_port_probe(struct platform_device *of_dev)
+ struct fman_port *port;
+ struct fman *fman;
+ struct device_node *fm_node, *port_node;
++ struct platform_device *fm_pdev;
+ struct resource res;
+ struct resource *dev_res;
+ u32 val;
+@@ -1780,8 +1781,14 @@ static int fman_port_probe(struct platform_device *of_dev)
+ goto return_err;
+ }
+
+- fman = dev_get_drvdata(&of_find_device_by_node(fm_node)->dev);
++ fm_pdev = of_find_device_by_node(fm_node);
+ of_node_put(fm_node);
++ if (!fm_pdev) {
++ err = -EINVAL;
++ goto return_err;
++ }
++
++ fman = dev_get_drvdata(&fm_pdev->dev);
+ if (!fman) {
+ err = -EINVAL;
+ goto return_err;
+diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c
+index f75b9c11b2d2..ac5a281e0ec3 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_tgec.c
++++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c
+@@ -630,7 +630,7 @@ int tgec_del_hash_mac_address(struct fman_mac *tgec, enet_addr_t *eth_addr)
+
+ list_for_each(pos, &tgec->multicast_addr_hash->lsts[hash]) {
+ hash_entry = ETH_HASH_ENTRY_OBJ(pos);
+- if (hash_entry->addr == addr) {
++ if (hash_entry && hash_entry->addr == addr) {
+ list_del_init(&hash_entry->node);
+ kfree(hash_entry);
+ break;
+diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c
+index 23417266b7ec..e66014e0427f 100644
+--- a/drivers/net/ethernet/toshiba/spider_net.c
++++ b/drivers/net/ethernet/toshiba/spider_net.c
+@@ -296,8 +296,8 @@ spider_net_free_chain(struct spider_net_card *card,
+ descr = descr->next;
+ } while (descr != chain->ring);
+
+- dma_free_coherent(&card->pdev->dev, chain->num_desc,
+- chain->hwring, chain->dma_addr);
++ dma_free_coherent(&card->pdev->dev, chain->num_desc * sizeof(struct spider_net_hw_descr),
++ chain->hwring, chain->dma_addr);
+ }
+
+ /**
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index ac34257e9f20..c94dfa70f2a3 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -160,6 +160,12 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
+ if (!netif_running(dev))
+ goto drop;
+
++ /* There should be a pseudo header of 1 byte added by upper layers.
++ * Check to make sure it is there before reading it.
++ */
++ if (skb->len < 1)
++ goto drop;
++
+ switch (skb->data[0]) {
+ case X25_IFACE_DATA:
+ break;
+@@ -308,6 +314,7 @@ static void lapbeth_setup(struct net_device *dev)
+ dev->netdev_ops = &lapbeth_netdev_ops;
+ dev->needs_free_netdev = true;
+ dev->type = ARPHRD_X25;
++ dev->hard_header_len = 0;
+ dev->mtu = 1000;
+ dev->addr_len = 0;
+ }
+@@ -334,7 +341,8 @@ static int lapbeth_new_device(struct net_device *dev)
+ * then this driver prepends a length field of 2 bytes,
+ * then the underlying Ethernet device prepends its own header.
+ */
+- ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len;
++ ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len
++ + dev->needed_headroom;
+
+ lapbeth = netdev_priv(ndev);
+ lapbeth->axdev = ndev;
+diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
+index 7cff0d52338f..fd011bdabb96 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
+@@ -1329,7 +1329,9 @@ static int ath10k_htt_tx_32(struct ath10k_htt *htt,
+ err_unmap_msdu:
+ dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ err_free_msdu_id:
++ spin_lock_bh(&htt->tx_lock);
+ ath10k_htt_tx_free_msdu_id(htt, msdu_id);
++ spin_unlock_bh(&htt->tx_lock);
+ err:
+ return res;
+ }
+@@ -1536,7 +1538,9 @@ static int ath10k_htt_tx_64(struct ath10k_htt *htt,
+ err_unmap_msdu:
+ dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+ err_free_msdu_id:
++ spin_lock_bh(&htt->tx_lock);
+ ath10k_htt_tx_free_msdu_id(htt, msdu_id);
++ spin_unlock_bh(&htt->tx_lock);
+ err:
+ return res;
+ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+index d5bb81e88762..9d2367133c7c 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -30,7 +30,7 @@
+ #define BRCMF_ARP_OL_PEER_AUTO_REPLY 0x00000008
+
+ #define BRCMF_BSS_INFO_VERSION 109 /* curr ver of brcmf_bss_info_le struct */
+-#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0002
++#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0004
+
+ #define BRCMF_STA_BRCM 0x00000001 /* Running a Broadcom driver */
+ #define BRCMF_STA_WME 0x00000002 /* WMM association */
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+index 1de8497d92b8..dc7c970257d2 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -653,6 +653,7 @@ static inline int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h,
+ static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
+ int ifidx)
+ {
++ struct brcmf_fws_hanger_item *hi;
+ bool (*matchfn)(struct sk_buff *, void *) = NULL;
+ struct sk_buff *skb;
+ int prec;
+@@ -664,6 +665,9 @@ static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
+ skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+ while (skb) {
+ hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
++ hi = &fws->hanger.items[hslot];
++ WARN_ON(skb != hi->pkt);
++ hi->state = BRCMF_FWS_HANGER_ITEM_STATE_FREE;
+ brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
+ true);
+ brcmu_pkt_buf_free_skb(skb);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 96870d1b3b73..a5195bdb4d9b 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3633,7 +3633,11 @@ static void brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
+ if (bus->idlecount > bus->idletime) {
+ brcmf_dbg(SDIO, "idle\n");
+ sdio_claim_host(bus->sdiodev->func1);
+- brcmf_sdio_wd_timer(bus, false);
++#ifdef DEBUG
++ if (!BRCMF_FWCON_ON() ||
++ bus->console_interval == 0)
++#endif
++ brcmf_sdio_wd_timer(bus, false);
+ bus->idlecount = 0;
+ brcmf_sdio_bus_sleep(bus, true, false);
+ sdio_release_host(bus->sdiodev->func1);
+diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
+index e16f2597c219..c1c1cf330de7 100644
+--- a/drivers/net/wireless/intel/iwlegacy/common.c
++++ b/drivers/net/wireless/intel/iwlegacy/common.c
+@@ -4302,8 +4302,8 @@ il_apm_init(struct il_priv *il)
+ * power savings, even without L1.
+ */
+ if (il->cfg->set_l0s) {
+- pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl);
+- if (lctl & PCI_EXP_LNKCTL_ASPM_L1) {
++ ret = pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl);
++ if (!ret && (lctl & PCI_EXP_LNKCTL_ASPM_L1)) {
+ /* L1-ASPM enabled; disable(!) L0S */
+ il_set_bit(il, CSR_GIO_REG,
+ CSR_GIO_REG_VAL_L0S_ENABLED);
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+index 69e3b624adbb..797c2e978394 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+@@ -581,6 +581,11 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv,
+ {
+ struct host_cmd_ds_802_11_key_material *key =
+ &resp->params.key_material;
++ int len;
++
++ len = le16_to_cpu(key->key_param_set.key_len);
++ if (len > sizeof(key->key_param_set.key))
++ return -EINVAL;
+
+ if (le16_to_cpu(key->action) == HostCmd_ACT_GEN_SET) {
+ if ((le16_to_cpu(key->key_param_set.key_info) & KEY_MCAST)) {
+@@ -594,9 +599,8 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv,
+
+ memset(priv->aes_key.key_param_set.key, 0,
+ sizeof(key->key_param_set.key));
+- priv->aes_key.key_param_set.key_len = key->key_param_set.key_len;
+- memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key,
+- le16_to_cpu(priv->aes_key.key_param_set.key_len));
++ priv->aes_key.key_param_set.key_len = cpu_to_le16(len);
++ memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, len);
+
+ return 0;
+ }
+@@ -611,9 +615,14 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
+ struct host_cmd_ds_command *resp)
+ {
+ struct host_cmd_ds_802_11_key_material_v2 *key_v2;
+- __le16 len;
++ int len;
+
+ key_v2 = &resp->params.key_material_v2;
++
++ len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len);
++ if (len > WLAN_KEY_LEN_CCMP)
++ return -EINVAL;
++
+ if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) {
+ if ((le16_to_cpu(key_v2->key_param_set.key_info) & KEY_MCAST)) {
+ mwifiex_dbg(priv->adapter, INFO, "info: key: GTK is set\n");
+@@ -629,10 +638,9 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
+ memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0,
+ WLAN_KEY_LEN_CCMP);
+ priv->aes_key_v2.key_param_set.key_params.aes.key_len =
+- key_v2->key_param_set.key_params.aes.key_len;
+- len = priv->aes_key_v2.key_param_set.key_params.aes.key_len;
++ cpu_to_le16(len);
+ memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key,
+- key_v2->key_param_set.key_params.aes.key, le16_to_cpu(len));
++ key_v2->key_param_set.key_params.aes.key, len);
+
+ return 0;
+ }
+diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
+index f5acd24d0e2b..988abb49771f 100644
+--- a/drivers/net/wireless/ti/wl1251/event.c
++++ b/drivers/net/wireless/ti/wl1251/event.c
+@@ -84,7 +84,7 @@ static int wl1251_event_ps_report(struct wl1251 *wl,
+ break;
+ }
+
+- return 0;
++ return ret;
+ }
+
+ static void wl1251_event_mbox_dump(struct event_mailbox *mbox)
+diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
+index 6dd1780a5885..0f19cc75cc0c 100644
+--- a/drivers/parisc/sba_iommu.c
++++ b/drivers/parisc/sba_iommu.c
+@@ -1291,7 +1291,7 @@ sba_ioc_init_pluto(struct parisc_device *sba, struct ioc *ioc, int ioc_num)
+ ** (one that doesn't overlap memory or LMMIO space) in the
+ ** IBASE and IMASK registers.
+ */
+- ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE);
++ ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE) & ~0x1fffffULL;
+ iova_space_size = ~(READ_REG(ioc->ioc_hpa + IOC_IMASK) & 0xFFFFFFFFUL) + 1;
+
+ if ((ioc->ibase < 0xfed00000UL) && ((ioc->ibase + iova_space_size) > 0xfee00000UL)) {
+diff --git a/drivers/pci/access.c b/drivers/pci/access.c
+index a3ad2fe185b9..3c8ffd62dc00 100644
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -204,17 +204,13 @@ EXPORT_SYMBOL(pci_bus_set_ops);
+ static DECLARE_WAIT_QUEUE_HEAD(pci_cfg_wait);
+
+ static noinline void pci_wait_cfg(struct pci_dev *dev)
++ __must_hold(&pci_lock)
+ {
+- DECLARE_WAITQUEUE(wait, current);
+-
+- __add_wait_queue(&pci_cfg_wait, &wait);
+ do {
+- set_current_state(TASK_UNINTERRUPTIBLE);
+ raw_spin_unlock_irq(&pci_lock);
+- schedule();
++ wait_event(pci_cfg_wait, !dev->block_cfg_access);
+ raw_spin_lock_irq(&pci_lock);
+ } while (dev->block_cfg_access);
+- __remove_wait_queue(&pci_cfg_wait, &wait);
+ }
+
+ /* Returns 0 on success, negative values indicate error. */
+diff --git a/drivers/pci/controller/pcie-cadence-host.c b/drivers/pci/controller/pcie-cadence-host.c
+index ec394f6a19c8..ae7affcb1a81 100644
+--- a/drivers/pci/controller/pcie-cadence-host.c
++++ b/drivers/pci/controller/pcie-cadence-host.c
+@@ -102,6 +102,7 @@ static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc)
+ {
+ struct cdns_pcie *pcie = &rc->pcie;
+ u32 value, ctrl;
++ u32 id;
+
+ /*
+ * Set the root complex BAR configuration register:
+@@ -121,8 +122,12 @@ static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc)
+ cdns_pcie_writel(pcie, CDNS_PCIE_LM_RC_BAR_CFG, value);
+
+ /* Set root port configuration space */
+- if (rc->vendor_id != 0xffff)
+- cdns_pcie_rp_writew(pcie, PCI_VENDOR_ID, rc->vendor_id);
++ if (rc->vendor_id != 0xffff) {
++ id = CDNS_PCIE_LM_ID_VENDOR(rc->vendor_id) |
++ CDNS_PCIE_LM_ID_SUBSYS(rc->vendor_id);
++ cdns_pcie_writel(pcie, CDNS_PCIE_LM_ID, id);
++ }
++
+ if (rc->device_id != 0xffff)
+ cdns_pcie_rp_writew(pcie, PCI_DEVICE_ID, rc->device_id);
+
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index ad39b404f10a..3d1b004a58f8 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -718,6 +718,7 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+ if (!vmd->bus) {
+ pci_free_resource_list(&resources);
+ irq_domain_remove(vmd->irq_domain);
++ irq_domain_free_fwnode(fn);
+ return -ENODEV;
+ }
+
+@@ -820,6 +821,7 @@ static void vmd_cleanup_srcu(struct vmd_dev *vmd)
+ static void vmd_remove(struct pci_dev *dev)
+ {
+ struct vmd_dev *vmd = pci_get_drvdata(dev);
++ struct fwnode_handle *fn = vmd->irq_domain->fwnode;
+
+ sysfs_remove_link(&vmd->dev->dev.kobj, "domain");
+ pci_stop_root_bus(vmd->bus);
+@@ -828,6 +830,7 @@ static void vmd_remove(struct pci_dev *dev)
+ vmd_teardown_dma_ops(vmd);
+ vmd_detach_resources(vmd);
+ irq_domain_remove(vmd->irq_domain);
++ irq_domain_free_fwnode(fn);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 6e50f84733b7..279f9f0197b0 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -1164,6 +1164,7 @@ static int pcie_aspm_get_policy(char *buffer, const struct kernel_param *kp)
+ cnt += sprintf(buffer + cnt, "[%s] ", policy_str[i]);
+ else
+ cnt += sprintf(buffer + cnt, "%s ", policy_str[i]);
++ cnt += sprintf(buffer + cnt, "\n");
+ return cnt;
+ }
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 8f856657dac2..9129ccd593d1 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4334,6 +4334,8 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags)
+ if (ACPI_FAILURE(status))
+ return -ENODEV;
+
++ acpi_put_table(header);
++
+ /* Filter out flags not applicable to multifunction */
+ acs_flags &= (PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_EC | PCI_ACS_DT);
+
+diff --git a/drivers/phy/samsung/phy-exynos5-usbdrd.c b/drivers/phy/samsung/phy-exynos5-usbdrd.c
+index b8b226a20014..1feb1e1bf85e 100644
+--- a/drivers/phy/samsung/phy-exynos5-usbdrd.c
++++ b/drivers/phy/samsung/phy-exynos5-usbdrd.c
+@@ -717,7 +717,9 @@ static int exynos5_usbdrd_phy_calibrate(struct phy *phy)
+ struct phy_usb_instance *inst = phy_get_drvdata(phy);
+ struct exynos5_usbdrd_phy *phy_drd = to_usbdrd_phy(inst);
+
+- return exynos5420_usbdrd_phy_calibrate(phy_drd);
++ if (inst->phy_cfg->id == EXYNOS5_DRDPHY_UTMI)
++ return exynos5420_usbdrd_phy_calibrate(phy_drd);
++ return 0;
+ }
+
+ static const struct phy_ops exynos5_usbdrd_phy_ops = {
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 7ec72ff2419a..04a4e761e9a9 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -916,7 +916,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np,
+
+ /* If pinconf isn't supported, don't parse properties in below. */
+ if (!PCS_HAS_PINCONF)
+- return 0;
++ return -ENOTSUPP;
+
+ /* cacluate how much properties are supported in current node */
+ for (i = 0; i < ARRAY_SIZE(prop2); i++) {
+@@ -928,7 +928,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np,
+ nconfs++;
+ }
+ if (!nconfs)
+- return 0;
++ return -ENOTSUPP;
+
+ func->conf = devm_kcalloc(pcs->dev,
+ nconfs, sizeof(struct pcs_conf_vals),
+@@ -1056,9 +1056,12 @@ static int pcs_parse_one_pinctrl_entry(struct pcs_device *pcs,
+
+ if (PCS_HAS_PINCONF && function) {
+ res = pcs_parse_pinconf(pcs, np, function, map);
+- if (res)
++ if (res == 0)
++ *num_maps = 2;
++ else if (res == -ENOTSUPP)
++ *num_maps = 1;
++ else
+ goto free_pingroups;
+- *num_maps = 2;
+ } else {
+ *num_maps = 1;
+ }
+diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
+index c514cb73bb50..d7d69eadb9bb 100644
+--- a/drivers/platform/x86/intel-hid.c
++++ b/drivers/platform/x86/intel-hid.c
+@@ -564,7 +564,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv)
+ return AE_OK;
+
+ if (acpi_match_device_ids(dev, ids) == 0)
+- if (acpi_create_platform_device(dev, NULL))
++ if (!IS_ERR_OR_NULL(acpi_create_platform_device(dev, NULL)))
+ dev_info(&dev->dev,
+ "intel-hid: created platform device\n");
+
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index d122f33d43ac..c7c8b432c163 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -272,7 +272,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv)
+ return AE_OK;
+
+ if (acpi_match_device_ids(dev, ids) == 0)
+- if (acpi_create_platform_device(dev, NULL))
++ if (!IS_ERR_OR_NULL(acpi_create_platform_device(dev, NULL)))
+ dev_info(&dev->dev,
+ "intel-vbtn: created platform device\n");
+
+diff --git a/drivers/power/supply/88pm860x_battery.c b/drivers/power/supply/88pm860x_battery.c
+index 63c57dc82ac1..4eda5065b5bb 100644
+--- a/drivers/power/supply/88pm860x_battery.c
++++ b/drivers/power/supply/88pm860x_battery.c
+@@ -436,7 +436,7 @@ static void pm860x_init_battery(struct pm860x_battery_info *info)
+ int ret;
+ int data;
+ int bat_remove;
+- int soc;
++ int soc = 0;
+
+ /* measure enable on GPADC1 */
+ data = MEAS1_GP1;
+@@ -499,7 +499,9 @@ static void pm860x_init_battery(struct pm860x_battery_info *info)
+ }
+ mutex_unlock(&info->lock);
+
+- calc_soc(info, OCV_MODE_ACTIVE, &soc);
++ ret = calc_soc(info, OCV_MODE_ACTIVE, &soc);
++ if (ret < 0)
++ goto out;
+
+ data = pm860x_reg_read(info->i2c, PM8607_POWER_UP_LOG);
+ bat_remove = data & BAT_WU_LOG;
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index eb917e93fa72..8d30f9ac3e9d 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -1463,6 +1463,10 @@ static void qeth_bridge_state_change(struct qeth_card *card,
+ int extrasize;
+
+ QETH_CARD_TEXT(card, 2, "brstchng");
++ if (qports->num_entries == 0) {
++ QETH_CARD_TEXT(card, 2, "BPempty");
++ return;
++ }
+ if (qports->entry_length != sizeof(struct qeth_sbp_port_entry)) {
+ QETH_CARD_TEXT_(card, 2, "BPsz%04x", qports->entry_length);
+ return;
+diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c
+index edce5f3cfdba..93ba83e3148e 100644
+--- a/drivers/scsi/arm/cumana_2.c
++++ b/drivers/scsi/arm/cumana_2.c
+@@ -454,7 +454,7 @@ static int cumanascsi2_probe(struct expansion_card *ec,
+
+ if (info->info.scsi.dma != NO_DMA)
+ free_dma(info->info.scsi.dma);
+- free_irq(ec->irq, host);
++ free_irq(ec->irq, info);
+
+ out_release:
+ fas216_release(host);
+diff --git a/drivers/scsi/arm/eesox.c b/drivers/scsi/arm/eesox.c
+index e93e047f4316..65bb34ce93b9 100644
+--- a/drivers/scsi/arm/eesox.c
++++ b/drivers/scsi/arm/eesox.c
+@@ -575,7 +575,7 @@ static int eesoxscsi_probe(struct expansion_card *ec, const struct ecard_id *id)
+
+ if (info->info.scsi.dma != NO_DMA)
+ free_dma(info->info.scsi.dma);
+- free_irq(ec->irq, host);
++ free_irq(ec->irq, info);
+
+ out_remove:
+ fas216_remove(host);
+diff --git a/drivers/scsi/arm/powertec.c b/drivers/scsi/arm/powertec.c
+index 79aa88911b7f..b5e4a25ea1ef 100644
+--- a/drivers/scsi/arm/powertec.c
++++ b/drivers/scsi/arm/powertec.c
+@@ -382,7 +382,7 @@ static int powertecscsi_probe(struct expansion_card *ec,
+
+ if (info->info.scsi.dma != NO_DMA)
+ free_dma(info->info.scsi.dma);
+- free_irq(ec->irq, host);
++ free_irq(ec->irq, info);
+
+ out_release:
+ fas216_release(host);
+diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c
+index 82e01dbe90af..7c0eaa9ea1ed 100644
+--- a/drivers/scsi/mesh.c
++++ b/drivers/scsi/mesh.c
+@@ -1044,6 +1044,8 @@ static void handle_error(struct mesh_state *ms)
+ while ((in_8(&mr->bus_status1) & BS1_RST) != 0)
+ udelay(1);
+ printk("done\n");
++ if (ms->dma_started)
++ halt_dma(ms);
+ handle_reset(ms);
+ /* request_q is empty, no point in mesh_start() */
+ return;
+@@ -1356,7 +1358,8 @@ static void halt_dma(struct mesh_state *ms)
+ ms->conn_tgt, ms->data_ptr, scsi_bufflen(cmd),
+ ms->tgts[ms->conn_tgt].data_goes_out);
+ }
+- scsi_dma_unmap(cmd);
++ if (cmd)
++ scsi_dma_unmap(cmd);
+ ms->dma_started = 0;
+ }
+
+@@ -1711,6 +1714,9 @@ static int mesh_host_reset(struct scsi_cmnd *cmd)
+
+ spin_lock_irqsave(ms->host->host_lock, flags);
+
++ if (ms->dma_started)
++ halt_dma(ms);
++
+ /* Reset the controller & dbdma channel */
+ out_le32(&md->control, (RUN|PAUSE|FLUSH|WAKE) << 16); /* stop dma */
+ out_8(&mr->exception, 0xff); /* clear all exception bits */
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index a1dbae806fde..d2b045eb7274 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -5384,6 +5384,12 @@ static int __init scsi_debug_init(void)
+ pr_err("submit_queues must be 1 or more\n");
+ return -EINVAL;
+ }
++
++ if ((sdebug_max_queue > SDEBUG_CANQUEUE) || (sdebug_max_queue < 1)) {
++ pr_err("max_queue must be in range [1, %d]\n", SDEBUG_CANQUEUE);
++ return -EINVAL;
++ }
++
+ sdebug_q_arr = kcalloc(submit_queues, sizeof(struct sdebug_queue),
+ GFP_KERNEL);
+ if (sdebug_q_arr == NULL)
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index 3c6f920535ea..519d19f57eee 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -715,6 +715,7 @@ static struct platform_driver rpmh_driver = {
+ .driver = {
+ .name = "rpmh",
+ .of_match_table = rpmh_drv_match,
++ .suppress_bind_attrs = true,
+ },
+ };
+
+diff --git a/drivers/spi/spi-lantiq-ssc.c b/drivers/spi/spi-lantiq-ssc.c
+index d5976615d924..dc740b5f720b 100644
+--- a/drivers/spi/spi-lantiq-ssc.c
++++ b/drivers/spi/spi-lantiq-ssc.c
+@@ -187,6 +187,7 @@ struct lantiq_ssc_spi {
+ unsigned int tx_fifo_size;
+ unsigned int rx_fifo_size;
+ unsigned int base_cs;
++ unsigned int fdx_tx_level;
+ };
+
+ static u32 lantiq_ssc_readl(const struct lantiq_ssc_spi *spi, u32 reg)
+@@ -484,6 +485,7 @@ static void tx_fifo_write(struct lantiq_ssc_spi *spi)
+ u32 data;
+ unsigned int tx_free = tx_fifo_free(spi);
+
++ spi->fdx_tx_level = 0;
+ while (spi->tx_todo && tx_free) {
+ switch (spi->bits_per_word) {
+ case 2 ... 8:
+@@ -512,6 +514,7 @@ static void tx_fifo_write(struct lantiq_ssc_spi *spi)
+
+ lantiq_ssc_writel(spi, data, LTQ_SPI_TB);
+ tx_free--;
++ spi->fdx_tx_level++;
+ }
+ }
+
+@@ -523,6 +526,13 @@ static void rx_fifo_read_full_duplex(struct lantiq_ssc_spi *spi)
+ u32 data;
+ unsigned int rx_fill = rx_fifo_level(spi);
+
++ /*
++ * Wait until all expected data to be shifted in.
++ * Otherwise, rx overrun may occur.
++ */
++ while (rx_fill != spi->fdx_tx_level)
++ rx_fill = rx_fifo_level(spi);
++
+ while (rx_fill) {
+ data = lantiq_ssc_readl(spi, LTQ_SPI_RB);
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 167047760d79..e444e7cc6968 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -232,6 +232,11 @@ static int spidev_message(struct spidev_data *spidev,
+ for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers;
+ n;
+ n--, k_tmp++, u_tmp++) {
++ /* Ensure that also following allocations from rx_buf/tx_buf will meet
++ * DMA alignment requirements.
++ */
++ unsigned int len_aligned = ALIGN(u_tmp->len, ARCH_KMALLOC_MINALIGN);
++
+ k_tmp->len = u_tmp->len;
+
+ total += k_tmp->len;
+@@ -247,17 +252,17 @@ static int spidev_message(struct spidev_data *spidev,
+
+ if (u_tmp->rx_buf) {
+ /* this transfer needs space in RX bounce buffer */
+- rx_total += k_tmp->len;
++ rx_total += len_aligned;
+ if (rx_total > bufsiz) {
+ status = -EMSGSIZE;
+ goto done;
+ }
+ k_tmp->rx_buf = rx_buf;
+- rx_buf += k_tmp->len;
++ rx_buf += len_aligned;
+ }
+ if (u_tmp->tx_buf) {
+ /* this transfer needs space in TX bounce buffer */
+- tx_total += k_tmp->len;
++ tx_total += len_aligned;
+ if (tx_total > bufsiz) {
+ status = -EMSGSIZE;
+ goto done;
+@@ -267,7 +272,7 @@ static int spidev_message(struct spidev_data *spidev,
+ (uintptr_t) u_tmp->tx_buf,
+ u_tmp->len))
+ goto done;
+- tx_buf += k_tmp->len;
++ tx_buf += len_aligned;
+ }
+
+ k_tmp->cs_change = !!u_tmp->cs_change;
+@@ -297,16 +302,16 @@ static int spidev_message(struct spidev_data *spidev,
+ goto done;
+
+ /* copy any rx data out of bounce buffer */
+- rx_buf = spidev->rx_buffer;
+- for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) {
++ for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers;
++ n;
++ n--, k_tmp++, u_tmp++) {
+ if (u_tmp->rx_buf) {
+ if (copy_to_user((u8 __user *)
+- (uintptr_t) u_tmp->rx_buf, rx_buf,
++ (uintptr_t) u_tmp->rx_buf, k_tmp->rx_buf,
+ u_tmp->len)) {
+ status = -EFAULT;
+ goto done;
+ }
+- rx_buf += u_tmp->len;
+ }
+ }
+ status = total;
+diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
+index 2066a1d9bc84..87244a208976 100644
+--- a/drivers/staging/rtl8192u/r8192U_core.c
++++ b/drivers/staging/rtl8192u/r8192U_core.c
+@@ -2484,7 +2484,7 @@ static int rtl8192_read_eeprom_info(struct net_device *dev)
+ ret = eprom_read(dev, (EEPROM_TxPwIndex_CCK >> 1));
+ if (ret < 0)
+ return ret;
+- priv->EEPROMTxPowerLevelCCK = ((u16)ret & 0xff) >> 8;
++ priv->EEPROMTxPowerLevelCCK = ((u16)ret & 0xff00) >> 8;
+ } else
+ priv->EEPROMTxPowerLevelCCK = 0x10;
+ RT_TRACE(COMP_EPROM, "CCK Tx Power Levl: 0x%02x\n", priv->EEPROMTxPowerLevelCCK);
+diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+index 452e034aedc1..343da0031299 100644
+--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
++++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+@@ -183,7 +183,7 @@ int ti_thermal_expose_sensor(struct ti_bandgap *bgp, int id,
+
+ data = ti_bandgap_get_sensor_data(bgp, id);
+
+- if (!IS_ERR_OR_NULL(data))
++ if (IS_ERR_OR_NULL(data))
+ data = ti_thermal_build_data(bgp, id);
+
+ if (!data)
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index e0b77674869c..c96c50faccf7 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -25,17 +25,23 @@ static unsigned int quirk_count;
+
+ static char quirks_param[128];
+
+-static int quirks_param_set(const char *val, const struct kernel_param *kp)
++static int quirks_param_set(const char *value, const struct kernel_param *kp)
+ {
+- char *p, *field;
++ char *val, *p, *field;
+ u16 vid, pid;
+ u32 flags;
+ size_t i;
+ int err;
+
++ val = kstrdup(value, GFP_KERNEL);
++ if (!val)
++ return -ENOMEM;
++
+ err = param_set_copystring(val, kp);
+- if (err)
++ if (err) {
++ kfree(val);
+ return err;
++ }
+
+ mutex_lock(&quirk_mutex);
+
+@@ -60,10 +66,11 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
+ if (!quirk_list) {
+ quirk_count = 0;
+ mutex_unlock(&quirk_mutex);
++ kfree(val);
+ return -ENOMEM;
+ }
+
+- for (i = 0, p = (char *)val; p && *p;) {
++ for (i = 0, p = val; p && *p;) {
+ /* Each entry consists of VID:PID:flags */
+ field = strsep(&p, ":");
+ if (!field)
+@@ -144,6 +151,7 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp)
+
+ unlock:
+ mutex_unlock(&quirk_mutex);
++ kfree(val);
+
+ return 0;
+ }
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
+index c35c93f16a49..a9e86f5e6eaa 100644
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -499,6 +499,7 @@ static int dwc2_driver_probe(struct platform_device *dev)
+ if (hsotg->gadget_enabled) {
+ retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget);
+ if (retval) {
++ hsotg->gadget.udc = NULL;
+ dwc2_hsotg_remove(hsotg);
+ goto error;
+ }
+@@ -507,7 +508,8 @@ static int dwc2_driver_probe(struct platform_device *dev)
+ return 0;
+
+ error:
+- dwc2_lowlevel_hw_disable(hsotg);
++ if (hsotg->dr_mode != USB_DR_MODE_PERIPHERAL)
++ dwc2_lowlevel_hw_disable(hsotg);
+ return retval;
+ }
+
+diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c
+index 01b44e159623..e174b1b889da 100644
+--- a/drivers/usb/gadget/udc/bdc/bdc_core.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c
+@@ -283,6 +283,7 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit)
+ * in that case reinit is passed as 1
+ */
+ if (reinit) {
++ int i;
+ /* Enable interrupts */
+ temp = bdc_readl(bdc->regs, BDC_BDCSC);
+ temp |= BDC_GIE;
+@@ -292,6 +293,9 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit)
+ /* Initialize SRR to 0 */
+ memset(bdc->srr.sr_bds, 0,
+ NUM_SR_ENTRIES * sizeof(struct bdc_bd));
++ /* clear ep flags to avoid post disconnect stops/deconfigs */
++ for (i = 1; i < bdc->num_eps; ++i)
++ bdc->bdc_ep_array[i]->flags = 0;
+ } else {
+ /* One time initiaization only */
+ /* Enable status report function pointers */
+@@ -604,9 +608,14 @@ static int bdc_remove(struct platform_device *pdev)
+ static int bdc_suspend(struct device *dev)
+ {
+ struct bdc *bdc = dev_get_drvdata(dev);
++ int ret;
+
+- clk_disable_unprepare(bdc->clk);
+- return 0;
++ /* Halt the controller */
++ ret = bdc_stop(bdc);
++ if (!ret)
++ clk_disable_unprepare(bdc->clk);
++
++ return ret;
+ }
+
+ static int bdc_resume(struct device *dev)
+diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
+index d49c6dc1082d..9ddc0b4e92c9 100644
+--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
+@@ -615,7 +615,6 @@ int bdc_ep_enable(struct bdc_ep *ep)
+ }
+ bdc_dbg_bd_list(bdc, ep);
+ /* only for ep0: config ep is called for ep0 from connect event */
+- ep->flags |= BDC_EP_ENABLED;
+ if (ep->ep_num == 1)
+ return ret;
+
+@@ -759,10 +758,13 @@ static int ep_dequeue(struct bdc_ep *ep, struct bdc_req *req)
+ __func__, ep->name, start_bdi, end_bdi);
+ dev_dbg(bdc->dev, "ep_dequeue ep=%p ep->desc=%p\n",
+ ep, (void *)ep->usb_ep.desc);
+- /* Stop the ep to see where the HW is ? */
+- ret = bdc_stop_ep(bdc, ep->ep_num);
+- /* if there is an issue with stopping ep, then no need to go further */
+- if (ret)
++ /* if still connected, stop the ep to see where the HW is ? */
++ if (!(bdc_readl(bdc->regs, BDC_USPC) & BDC_PST_MASK)) {
++ ret = bdc_stop_ep(bdc, ep->ep_num);
++ /* if there is an issue, then no need to go further */
++ if (ret)
++ return 0;
++ } else
+ return 0;
+
+ /*
+@@ -1911,7 +1913,9 @@ static int bdc_gadget_ep_disable(struct usb_ep *_ep)
+ __func__, ep->name, ep->flags);
+
+ if (!(ep->flags & BDC_EP_ENABLED)) {
+- dev_warn(bdc->dev, "%s is already disabled\n", ep->name);
++ if (bdc->gadget.speed != USB_SPEED_UNKNOWN)
++ dev_warn(bdc->dev, "%s is already disabled\n",
++ ep->name);
+ return 0;
+ }
+ spin_lock_irqsave(&bdc->lock, flags);
+diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
+index ee872cad5270..a87caad8d1c7 100644
+--- a/drivers/usb/gadget/udc/net2280.c
++++ b/drivers/usb/gadget/udc/net2280.c
+@@ -3782,8 +3782,10 @@ static int net2280_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ return 0;
+
+ done:
+- if (dev)
++ if (dev) {
+ net2280_remove(pdev);
++ kfree(dev);
++ }
+ return retval;
+ }
+
+diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
+index 860693520132..408e964522ab 100644
+--- a/drivers/usb/mtu3/mtu3_core.c
++++ b/drivers/usb/mtu3/mtu3_core.c
+@@ -128,8 +128,12 @@ static void mtu3_device_disable(struct mtu3 *mtu)
+ mtu3_setbits(ibase, SSUSB_U2_CTRL(0),
+ SSUSB_U2_PORT_DIS | SSUSB_U2_PORT_PDN);
+
+- if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG)
++ if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG) {
+ mtu3_clrbits(ibase, SSUSB_U2_CTRL(0), SSUSB_U2_PORT_OTG_SEL);
++ if (mtu->is_u3_ip)
++ mtu3_clrbits(ibase, SSUSB_U3_CTRL(0),
++ SSUSB_U3_PORT_DUAL_MODE);
++ }
+
+ mtu3_setbits(ibase, U3D_SSUSB_IP_PW_CTRL2, SSUSB_IP_DEV_PDN);
+ }
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 7ae121567098..46ec30a2c516 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -271,6 +271,8 @@ static struct usb_serial_driver cp210x_device = {
+ .break_ctl = cp210x_break_ctl,
+ .set_termios = cp210x_set_termios,
+ .tx_empty = cp210x_tx_empty,
++ .throttle = usb_serial_generic_throttle,
++ .unthrottle = usb_serial_generic_unthrottle,
+ .tiocmget = cp210x_tiocmget,
+ .tiocmset = cp210x_tiocmset,
+ .attach = cp210x_attach,
+@@ -893,6 +895,7 @@ static void cp210x_get_termios_port(struct usb_serial_port *port,
+ u32 baud;
+ u16 bits;
+ u32 ctl_hs;
++ u32 flow_repl;
+
+ cp210x_read_u32_reg(port, CP210X_GET_BAUDRATE, &baud);
+
+@@ -993,6 +996,22 @@ static void cp210x_get_termios_port(struct usb_serial_port *port,
+ ctl_hs = le32_to_cpu(flow_ctl.ulControlHandshake);
+ if (ctl_hs & CP210X_SERIAL_CTS_HANDSHAKE) {
+ dev_dbg(dev, "%s - flow control = CRTSCTS\n", __func__);
++ /*
++ * When the port is closed, the CP210x hardware disables
++ * auto-RTS and RTS is deasserted but it leaves auto-CTS when
++ * in hardware flow control mode. When re-opening the port, if
++ * auto-CTS is enabled on the cp210x, then auto-RTS must be
++ * re-enabled in the driver.
++ */
++ flow_repl = le32_to_cpu(flow_ctl.ulFlowReplace);
++ flow_repl &= ~CP210X_SERIAL_RTS_MASK;
++ flow_repl |= CP210X_SERIAL_RTS_SHIFT(CP210X_SERIAL_RTS_FLOW_CTL);
++ flow_ctl.ulFlowReplace = cpu_to_le32(flow_repl);
++ cp210x_write_reg_block(port,
++ CP210X_SET_FLOW,
++ &flow_ctl,
++ sizeof(flow_ctl));
++
+ cflag |= CRTSCTS;
+ } else {
+ dev_dbg(dev, "%s - flow control = NONE\n", __func__);
+diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
+index e287fd52c575..734f18d0a7f7 100644
+--- a/drivers/usb/serial/iuu_phoenix.c
++++ b/drivers/usb/serial/iuu_phoenix.c
+@@ -353,10 +353,11 @@ static void iuu_led_activity_on(struct urb *urb)
+ struct usb_serial_port *port = urb->context;
+ int result;
+ char *buf_ptr = port->write_urb->transfer_buffer;
+- *buf_ptr++ = IUU_SET_LED;
++
+ if (xmas) {
+- get_random_bytes(buf_ptr, 6);
+- *(buf_ptr+7) = 1;
++ buf_ptr[0] = IUU_SET_LED;
++ get_random_bytes(buf_ptr + 1, 6);
++ buf_ptr[7] = 1;
+ } else {
+ iuu_rgbf_fill_buffer(buf_ptr, 255, 255, 0, 0, 0, 0, 255);
+ }
+@@ -374,13 +375,14 @@ static void iuu_led_activity_off(struct urb *urb)
+ struct usb_serial_port *port = urb->context;
+ int result;
+ char *buf_ptr = port->write_urb->transfer_buffer;
++
+ if (xmas) {
+ iuu_rxcmd(urb);
+ return;
+- } else {
+- *buf_ptr++ = IUU_SET_LED;
+- iuu_rgbf_fill_buffer(buf_ptr, 0, 0, 255, 255, 0, 0, 255);
+ }
++
++ iuu_rgbf_fill_buffer(buf_ptr, 0, 0, 255, 255, 0, 0, 255);
++
+ usb_fill_bulk_urb(port->write_urb, port->serial->dev,
+ usb_sndbulkpipe(port->serial->dev,
+ port->bulk_out_endpointAddress),
+diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
+index 7f2526b43b33..cc2fb5043184 100644
+--- a/drivers/video/console/newport_con.c
++++ b/drivers/video/console/newport_con.c
+@@ -31,6 +31,8 @@
+ #include <linux/linux_logo.h>
+ #include <linux/font.h>
+
++#define NEWPORT_LEN 0x10000
++
+ #define FONT_DATA ((unsigned char *)font_vga_8x16.data)
+
+ /* borrowed from fbcon.c */
+@@ -42,6 +44,7 @@
+ static unsigned char *font_data[MAX_NR_CONSOLES];
+
+ static struct newport_regs *npregs;
++static unsigned long newport_addr;
+
+ static int logo_active;
+ static int topscan;
+@@ -701,7 +704,6 @@ const struct consw newport_con = {
+ static int newport_probe(struct gio_device *dev,
+ const struct gio_device_id *id)
+ {
+- unsigned long newport_addr;
+ int err;
+
+ if (!dev->resource.start)
+@@ -711,7 +713,7 @@ static int newport_probe(struct gio_device *dev,
+ return -EBUSY; /* we only support one Newport as console */
+
+ newport_addr = dev->resource.start + 0xF0000;
+- if (!request_mem_region(newport_addr, 0x10000, "Newport"))
++ if (!request_mem_region(newport_addr, NEWPORT_LEN, "Newport"))
+ return -ENODEV;
+
+ npregs = (struct newport_regs *)/* ioremap cannot fail */
+@@ -719,6 +721,11 @@ static int newport_probe(struct gio_device *dev,
+ console_lock();
+ err = do_take_over_console(&newport_con, 0, MAX_NR_CONSOLES - 1, 1);
+ console_unlock();
++
++ if (err) {
++ iounmap((void *)npregs);
++ release_mem_region(newport_addr, NEWPORT_LEN);
++ }
+ return err;
+ }
+
+@@ -726,6 +733,7 @@ static void newport_remove(struct gio_device *dev)
+ {
+ give_up_console(&newport_con);
+ iounmap((void *)npregs);
++ release_mem_region(newport_addr, NEWPORT_LEN);
+ }
+
+ static struct gio_device_id newport_ids[] = {
+diff --git a/drivers/video/fbdev/neofb.c b/drivers/video/fbdev/neofb.c
+index 5d3a444083f7..2018e1ca33eb 100644
+--- a/drivers/video/fbdev/neofb.c
++++ b/drivers/video/fbdev/neofb.c
+@@ -1820,6 +1820,7 @@ static int neo_scan_monitor(struct fb_info *info)
+ #else
+ printk(KERN_ERR
+ "neofb: Only 640x480, 800x600/480 and 1024x768 panels are currently supported\n");
++ kfree(info->monspecs.modedb);
+ return -1;
+ #endif
+ default:
+diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
+index d59c8a59f582..90dee3e6f8bc 100644
+--- a/drivers/video/fbdev/pxafb.c
++++ b/drivers/video/fbdev/pxafb.c
+@@ -2446,8 +2446,8 @@ static int pxafb_remove(struct platform_device *dev)
+
+ free_pages_exact(fbi->video_mem, fbi->video_mem_size);
+
+- dma_free_wc(&dev->dev, fbi->dma_buff_size, fbi->dma_buff,
+- fbi->dma_buff_phys);
++ dma_free_coherent(&dev->dev, fbi->dma_buff_size, fbi->dma_buff,
++ fbi->dma_buff_phys);
+
+ return 0;
+ }
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index f1dcc6766d1e..1781ca697f66 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1429,6 +1429,8 @@ static int smtc_map_smem(struct smtcfb_info *sfb,
+ static void smtc_unmap_smem(struct smtcfb_info *sfb)
+ {
+ if (sfb && sfb->fb->screen_base) {
++ if (sfb->chip_id == 0x720)
++ sfb->fb->screen_base -= 0x00200000;
+ iounmap(sfb->fb->screen_base);
+ sfb->fb->screen_base = NULL;
+ }
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index 6fa7209f24f4..b23edf64c2b2 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -570,11 +570,13 @@ static int add_ballooned_pages(int nr_pages)
+ if (xen_hotplug_unpopulated) {
+ st = reserve_additional_memory();
+ if (st != BP_ECANCELED) {
++ int rc;
++
+ mutex_unlock(&balloon_mutex);
+- wait_event(balloon_wq,
++ rc = wait_event_interruptible(balloon_wq,
+ !list_empty(&ballooned_pages));
+ mutex_lock(&balloon_mutex);
+- return 0;
++ return rc ? -ENOMEM : 0;
+ }
+ }
+
+@@ -632,6 +634,12 @@ int alloc_xenballooned_pages(int nr_pages, struct page **pages)
+ out_undo:
+ mutex_unlock(&balloon_mutex);
+ free_xenballooned_pages(pgno, pages);
++ /*
++ * NB: free_xenballooned_pages will only subtract pgno pages, but since
++ * target_unpopulated is incremented with nr_pages at the start we need
++ * to remove the remaining ones also, or accounting will be screwed.
++ */
++ balloon_stats.target_unpopulated -= nr_pages - pgno;
+ return ret;
+ }
+ EXPORT_SYMBOL(alloc_xenballooned_pages);
+diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c
+index d97fcfc5e558..f6589563ff71 100644
+--- a/drivers/xen/gntdev-dmabuf.c
++++ b/drivers/xen/gntdev-dmabuf.c
+@@ -641,6 +641,14 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev,
+ goto fail_detach;
+ }
+
++ /* Check that we have zero offset. */
++ if (sgt->sgl->offset) {
++ ret = ERR_PTR(-EINVAL);
++ pr_debug("DMA buffer has %d bytes offset, user-space expects 0\n",
++ sgt->sgl->offset);
++ goto fail_unmap;
++ }
++
+ /* Check number of pages that imported buffer has. */
+ if (attach->dmabuf->size != gntdev_dmabuf->nr_pages << PAGE_SHIFT) {
+ ret = ERR_PTR(-EINVAL);
+diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
+index 619128b55837..c579966a0e5c 100644
+--- a/fs/9p/v9fs.c
++++ b/fs/9p/v9fs.c
+@@ -515,10 +515,9 @@ void v9fs_session_close(struct v9fs_session_info *v9ses)
+ }
+
+ #ifdef CONFIG_9P_FSCACHE
+- if (v9ses->fscache) {
++ if (v9ses->fscache)
+ v9fs_cache_session_put_cookie(v9ses);
+- kfree(v9ses->cachetag);
+- }
++ kfree(v9ses->cachetag);
+ #endif
+ kfree(v9ses->uname);
+ kfree(v9ses->aname);
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 520b70b54331..fbcd18d96c52 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -4270,6 +4270,8 @@ int try_release_extent_mapping(struct page *page, gfp_t mask)
+
+ /* once for us */
+ free_extent_map(em);
++
++ cond_resched(); /* Allow large-extent preemption. */
+ }
+ }
+ return try_release_extent_state(tree, page, mask);
+diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
+index f1261fa0af8a..244b87e4dfe7 100644
+--- a/fs/dlm/lockspace.c
++++ b/fs/dlm/lockspace.c
+@@ -633,6 +633,9 @@ static int new_lockspace(const char *name, const char *cluster,
+ wait_event(ls->ls_recover_lock_wait,
+ test_bit(LSFL_RECOVER_LOCK, &ls->ls_flags));
+
++ /* let kobject handle freeing of ls if there's an error */
++ do_unreg = 1;
++
+ ls->ls_kobj.kset = dlm_kset;
+ error = kobject_init_and_add(&ls->ls_kobj, &dlm_ktype, NULL,
+ "%s", ls->ls_name);
+@@ -640,9 +643,6 @@ static int new_lockspace(const char *name, const char *cluster,
+ goto out_recoverd;
+ kobject_uevent(&ls->ls_kobj, KOBJ_ADD);
+
+- /* let kobject handle freeing of ls if there's an error */
+- do_unreg = 1;
+-
+ /* This uevent triggers dlm_controld in userspace to add us to the
+ group of nodes that are members of this lockspace (managed by the
+ cluster infrastructure.) Once it's done that, it tells us who the
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index 72e308c3e66b..4f994de46e6b 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -155,6 +155,23 @@ static int minix_remount (struct super_block * sb, int * flags, char * data)
+ return 0;
+ }
+
++static bool minix_check_superblock(struct minix_sb_info *sbi)
++{
++ if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
++ return false;
++
++ /*
++ * s_max_size must not exceed the block mapping limitation. This check
++ * is only needed for V1 filesystems, since V2/V3 support an extra level
++ * of indirect blocks which places the limit well above U32_MAX.
++ */
++ if (sbi->s_version == MINIX_V1 &&
++ sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE)
++ return false;
++
++ return true;
++}
++
+ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ {
+ struct buffer_head *bh;
+@@ -233,11 +250,12 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ } else
+ goto out_no_fs;
+
++ if (!minix_check_superblock(sbi))
++ goto out_illegal_sb;
++
+ /*
+ * Allocate the buffer map to keep the superblock small.
+ */
+- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
+- goto out_illegal_sb;
+ i = (sbi->s_imap_blocks + sbi->s_zmap_blocks) * sizeof(bh);
+ map = kzalloc(i, GFP_KERNEL);
+ if (!map)
+@@ -471,6 +489,13 @@ static struct inode *V1_minix_iget(struct inode *inode)
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
++ if (raw_inode->i_nlinks == 0) {
++ printk("MINIX-fs: deleted inode referenced: %lu\n",
++ inode->i_ino);
++ brelse(bh);
++ iget_failed(inode);
++ return ERR_PTR(-ESTALE);
++ }
+ inode->i_mode = raw_inode->i_mode;
+ i_uid_write(inode, raw_inode->i_uid);
+ i_gid_write(inode, raw_inode->i_gid);
+@@ -504,6 +529,13 @@ static struct inode *V2_minix_iget(struct inode *inode)
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
++ if (raw_inode->i_nlinks == 0) {
++ printk("MINIX-fs: deleted inode referenced: %lu\n",
++ inode->i_ino);
++ brelse(bh);
++ iget_failed(inode);
++ return ERR_PTR(-ESTALE);
++ }
+ inode->i_mode = raw_inode->i_mode;
+ i_uid_write(inode, raw_inode->i_uid);
+ i_gid_write(inode, raw_inode->i_gid);
+diff --git a/fs/minix/itree_common.c b/fs/minix/itree_common.c
+index 043c3fdbc8e7..446148792f41 100644
+--- a/fs/minix/itree_common.c
++++ b/fs/minix/itree_common.c
+@@ -75,6 +75,7 @@ static int alloc_branch(struct inode *inode,
+ int n = 0;
+ int i;
+ int parent = minix_new_block(inode);
++ int err = -ENOSPC;
+
+ branch[0].key = cpu_to_block(parent);
+ if (parent) for (n = 1; n < num; n++) {
+@@ -85,6 +86,11 @@ static int alloc_branch(struct inode *inode,
+ break;
+ branch[n].key = cpu_to_block(nr);
+ bh = sb_getblk(inode->i_sb, parent);
++ if (!bh) {
++ minix_free_block(inode, nr);
++ err = -ENOMEM;
++ break;
++ }
+ lock_buffer(bh);
+ memset(bh->b_data, 0, bh->b_size);
+ branch[n].bh = bh;
+@@ -103,7 +109,7 @@ static int alloc_branch(struct inode *inode,
+ bforget(branch[i].bh);
+ for (i = 0; i < n; i++)
+ minix_free_block(inode, block_to_cpu(branch[i].key));
+- return -ENOSPC;
++ return err;
+ }
+
+ static inline int splice_branch(struct inode *inode,
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 66f699e18755..2b9e139a2997 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1181,31 +1181,27 @@ out:
+ return status;
+ }
+
++static bool
++pnfs_layout_segments_returnable(struct pnfs_layout_hdr *lo,
++ enum pnfs_iomode iomode,
++ u32 seq)
++{
++ struct pnfs_layout_range recall_range = {
++ .length = NFS4_MAX_UINT64,
++ .iomode = iomode,
++ };
++ return pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs,
++ &recall_range, seq) != -EBUSY;
++}
++
+ /* Return true if layoutreturn is needed */
+ static bool
+ pnfs_layout_need_return(struct pnfs_layout_hdr *lo)
+ {
+- struct pnfs_layout_segment *s;
+- enum pnfs_iomode iomode;
+- u32 seq;
+-
+ if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags))
+ return false;
+-
+- seq = lo->plh_return_seq;
+- iomode = lo->plh_return_iomode;
+-
+- /* Defer layoutreturn until all recalled lsegs are done */
+- list_for_each_entry(s, &lo->plh_segs, pls_list) {
+- if (seq && pnfs_seqid_is_newer(s->pls_seq, seq))
+- continue;
+- if (iomode != IOMODE_ANY && s->pls_range.iomode != iomode)
+- continue;
+- if (test_bit(NFS_LSEG_LAYOUTRETURN, &s->pls_flags))
+- return false;
+- }
+-
+- return true;
++ return pnfs_layout_segments_returnable(lo, lo->plh_return_iomode,
++ lo->plh_return_seq);
+ }
+
+ static void pnfs_layoutreturn_before_put_layout_hdr(struct pnfs_layout_hdr *lo)
+@@ -2291,16 +2287,6 @@ out_forget:
+ return ERR_PTR(-EAGAIN);
+ }
+
+-static int
+-mark_lseg_invalid_or_return(struct pnfs_layout_segment *lseg,
+- struct list_head *tmp_list)
+-{
+- if (!mark_lseg_invalid(lseg, tmp_list))
+- return 0;
+- pnfs_cache_lseg_for_layoutreturn(lseg->pls_layout, lseg);
+- return 1;
+-}
+-
+ /**
+ * pnfs_mark_matching_lsegs_return - Free or return matching layout segments
+ * @lo: pointer to layout header
+@@ -2337,7 +2323,7 @@ pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo,
+ lseg, lseg->pls_range.iomode,
+ lseg->pls_range.offset,
+ lseg->pls_range.length);
+- if (mark_lseg_invalid_or_return(lseg, tmp_list))
++ if (mark_lseg_invalid(lseg, tmp_list))
+ continue;
+ remaining++;
+ set_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags);
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index c141b06811a6..8149fb6f1f0d 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -2867,9 +2867,15 @@ int ocfs2_nfs_sync_lock(struct ocfs2_super *osb, int ex)
+
+ status = ocfs2_cluster_lock(osb, lockres, ex ? LKM_EXMODE : LKM_PRMODE,
+ 0, 0);
+- if (status < 0)
++ if (status < 0) {
+ mlog(ML_ERROR, "lock on nfs sync lock failed %d\n", status);
+
++ if (ex)
++ up_write(&osb->nfs_sync_rwlock);
++ else
++ up_read(&osb->nfs_sync_rwlock);
++ }
++
+ return status;
+ }
+
+diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
+index dcd9c3163587..2197bf68f278 100644
+--- a/fs/pstore/platform.c
++++ b/fs/pstore/platform.c
+@@ -250,6 +250,9 @@ static int pstore_compress(const void *in, void *out,
+ {
+ int ret;
+
++ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION))
++ return -EINVAL;
++
+ ret = crypto_comp_compress(tfm, in, inlen, out, &outlen);
+ if (ret) {
+ pr_err("crypto_comp_compress failed, ret = %d!\n", ret);
+@@ -647,7 +650,7 @@ static void decompress_record(struct pstore_record *record)
+ int unzipped_len;
+ char *decompressed;
+
+- if (!record->compressed)
++ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION) || !record->compressed)
+ return;
+
+ /* Only PSTORE_TYPE_DMESG support compression. */
+diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c
+index e1d11f3223e3..f84a58e523bc 100644
+--- a/fs/xfs/scrub/bmap.c
++++ b/fs/xfs/scrub/bmap.c
+@@ -53,9 +53,27 @@ xchk_setup_inode_bmap(
+ */
+ if (S_ISREG(VFS_I(sc->ip)->i_mode) &&
+ sc->sm->sm_type == XFS_SCRUB_TYPE_BMBTD) {
++ struct address_space *mapping = VFS_I(sc->ip)->i_mapping;
++
+ inode_dio_wait(VFS_I(sc->ip));
+- error = filemap_write_and_wait(VFS_I(sc->ip)->i_mapping);
+- if (error)
++
++ /*
++ * Try to flush all incore state to disk before we examine the
++ * space mappings for the data fork. Leave accumulated errors
++ * in the mapping for the writer threads to consume.
++ *
++ * On ENOSPC or EIO writeback errors, we continue into the
++ * extent mapping checks because write failures do not
++ * necessarily imply anything about the correctness of the file
++ * metadata. The metadata and the file data could be on
++ * completely separate devices; a media failure might only
++ * affect a subset of the disk, etc. We can handle delalloc
++ * extents in the scrubber, so leaving them in memory is fine.
++ */
++ error = filemap_fdatawrite(mapping);
++ if (!error)
++ error = filemap_fdatawait_keep_errors(mapping);
++ if (error && (error != -ENOSPC && error != -EIO))
+ goto out;
+ }
+
+diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
+index 6622652a85a8..0b159a79a17c 100644
+--- a/fs/xfs/xfs_reflink.c
++++ b/fs/xfs/xfs_reflink.c
+@@ -1010,6 +1010,7 @@ xfs_reflink_remap_extent(
+ xfs_filblks_t rlen;
+ xfs_filblks_t unmap_len;
+ xfs_off_t newlen;
++ int64_t qres;
+ int error;
+
+ unmap_len = irec->br_startoff + irec->br_blockcount - destoff;
+@@ -1032,13 +1033,19 @@ xfs_reflink_remap_extent(
+ xfs_ilock(ip, XFS_ILOCK_EXCL);
+ xfs_trans_ijoin(tp, ip, 0);
+
+- /* If we're not just clearing space, then do we have enough quota? */
+- if (real_extent) {
+- error = xfs_trans_reserve_quota_nblks(tp, ip,
+- irec->br_blockcount, 0, XFS_QMOPT_RES_REGBLKS);
+- if (error)
+- goto out_cancel;
+- }
++ /*
++ * Reserve quota for this operation. We don't know if the first unmap
++ * in the dest file will cause a bmap btree split, so we always reserve
++ * at least enough blocks for that split. If the extent being mapped
++ * in is written, we need to reserve quota for that too.
++ */
++ qres = XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK);
++ if (real_extent)
++ qres += irec->br_blockcount;
++ error = xfs_trans_reserve_quota_nblks(tp, ip, qres, 0,
++ XFS_QMOPT_RES_REGBLKS);
++ if (error)
++ goto out_cancel;
+
+ trace_xfs_reflink_remap(ip, irec->br_startoff,
+ irec->br_blockcount, irec->br_startblock);
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index 95479f35e239..4976f4d30f55 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -307,6 +307,7 @@
+ */
+ #ifndef RO_AFTER_INIT_DATA
+ #define RO_AFTER_INIT_DATA \
++ . = ALIGN(8); \
+ __start_ro_after_init = .; \
+ *(.data..ro_after_init) \
+ __end_ro_after_init = .;
+diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
+index 3f1ef4450a7c..775cd10c04b0 100644
+--- a/include/linux/bitfield.h
++++ b/include/linux/bitfield.h
+@@ -72,7 +72,7 @@
+ */
+ #define FIELD_FIT(_mask, _val) \
+ ({ \
+- __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_FIT: "); \
++ __BF_FIELD_CHECK(_mask, 0ULL, 0ULL, "FIELD_FIT: "); \
+ !((((typeof(_mask))_val) << __bf_shf(_mask)) & ~(_mask)); \
+ })
+
+diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
+index e9de8ad0bad7..444aa73037f1 100644
+--- a/include/linux/tracepoint.h
++++ b/include/linux/tracepoint.h
+@@ -364,7 +364,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
+ static const char *___tp_str __tracepoint_string = str; \
+ ___tp_str; \
+ })
+-#define __tracepoint_string __attribute__((section("__tracepoint_str")))
++#define __tracepoint_string __attribute__((section("__tracepoint_str"), used))
+ #else
+ /*
+ * tracepoint_string() is used to save the string address for userspace
+diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
+index 371b3b45fd5c..2d5220ab0600 100644
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -313,5 +313,9 @@ int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname,
+ int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname,
+ char __user *optval, unsigned int optlen);
+
++/* update the fast reuse flag when adding a socket */
++void inet_csk_update_fastreuse(struct inet_bind_bucket *tb,
++ struct sock *sk);
++
+ struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu);
+ #endif /* _INET_CONNECTION_SOCK_H */
+diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
+index af0ede9ad4d0..c31e54a41b5c 100644
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -1614,18 +1614,16 @@ static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp)
+ }
+ #endif /* CONFIG_IP_VS_NFCT */
+
+-/* Really using conntrack? */
+-static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp,
+- struct sk_buff *skb)
++/* Using old conntrack that can not be redirected to another real server? */
++static inline bool ip_vs_conn_uses_old_conntrack(struct ip_vs_conn *cp,
++ struct sk_buff *skb)
+ {
+ #ifdef CONFIG_IP_VS_NFCT
+ enum ip_conntrack_info ctinfo;
+ struct nf_conn *ct;
+
+- if (!(cp->flags & IP_VS_CONN_F_NFCT))
+- return false;
+ ct = nf_ct_get(skb, &ctinfo);
+- if (ct)
++ if (ct && nf_ct_is_confirmed(ct))
+ return true;
+ #endif
+ return false;
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 6ae98c714edd..2a879d34bbe5 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -5957,6 +5957,8 @@ void cgroup_sk_clone(struct sock_cgroup_data *skcd)
+ {
+ /* Socket clone path */
+ if (skcd->val) {
++ if (skcd->no_refcnt)
++ return;
+ /*
+ * We might be cloning a socket which is left in an empty
+ * cgroup and the cgroup might have already been rmdir'd.
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index d8c249e6dcb7..696d08a4593e 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9208,7 +9208,12 @@ static void kick_ilb(unsigned int flags)
+ {
+ int ilb_cpu;
+
+- nohz.next_balance++;
++ /*
++ * Increase nohz.next_balance only when if full ilb is triggered but
++ * not if we only update stats.
++ */
++ if (flags & NOHZ_BALANCE_KICK)
++ nohz.next_balance = jiffies+1;
+
+ ilb_cpu = find_new_ilb();
+
+@@ -9503,6 +9508,14 @@ static bool _nohz_idle_balance(struct rq *this_rq, unsigned int flags,
+ }
+ }
+
++ /*
++ * next_balance will be updated only when there is a need.
++ * When the CPU is attached to null domain for ex, it will not be
++ * updated.
++ */
++ if (likely(update_next_balance))
++ nohz.next_balance = next_balance;
++
+ /* Newly idle CPU doesn't need an update */
+ if (idle != CPU_NEWLY_IDLE) {
+ update_blocked_averages(this_cpu);
+@@ -9523,14 +9536,6 @@ abort:
+ if (has_blocked_load)
+ WRITE_ONCE(nohz.has_blocked, 1);
+
+- /*
+- * next_balance will be updated only when there is a need.
+- * When the CPU is attached to null domain for ex, it will not be
+- * updated.
+- */
+- if (likely(update_next_balance))
+- nohz.next_balance = next_balance;
+-
+ return ret;
+ }
+
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index 74b694392f2f..f58efa5cc647 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -1098,7 +1098,7 @@ sd_init(struct sched_domain_topology_level *tl,
+ sd_flags = (*tl->sd_flags)();
+ if (WARN_ONCE(sd_flags & ~TOPOLOGY_SD_FLAGS,
+ "wrong sd_flags in topology description\n"))
+- sd_flags &= ~TOPOLOGY_SD_FLAGS;
++ sd_flags &= TOPOLOGY_SD_FLAGS;
+
+ *sd = (struct sched_domain){
+ .min_interval = sd_weight,
+diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
+index dbf2b457e47e..9305ff43fc15 100644
+--- a/lib/dynamic_debug.c
++++ b/lib/dynamic_debug.c
+@@ -85,22 +85,22 @@ static struct { unsigned flag:8; char opt_char; } opt_array[] = {
+ { _DPRINTK_FLAGS_NONE, '_' },
+ };
+
++struct flagsbuf { char buf[ARRAY_SIZE(opt_array)+1]; };
++
+ /* format a string into buf[] which describes the _ddebug's flags */
+-static char *ddebug_describe_flags(struct _ddebug *dp, char *buf,
+- size_t maxlen)
++static char *ddebug_describe_flags(unsigned int flags, struct flagsbuf *fb)
+ {
+- char *p = buf;
++ char *p = fb->buf;
+ int i;
+
+- BUG_ON(maxlen < 6);
+ for (i = 0; i < ARRAY_SIZE(opt_array); ++i)
+- if (dp->flags & opt_array[i].flag)
++ if (flags & opt_array[i].flag)
+ *p++ = opt_array[i].opt_char;
+- if (p == buf)
++ if (p == fb->buf)
+ *p++ = '_';
+ *p = '\0';
+
+- return buf;
++ return fb->buf;
+ }
+
+ #define vpr_info(fmt, ...) \
+@@ -142,7 +142,7 @@ static int ddebug_change(const struct ddebug_query *query,
+ struct ddebug_table *dt;
+ unsigned int newflags;
+ unsigned int nfound = 0;
+- char flagbuf[10];
++ struct flagsbuf fbuf;
+
+ /* search for matching ddebugs */
+ mutex_lock(&ddebug_lock);
+@@ -199,8 +199,7 @@ static int ddebug_change(const struct ddebug_query *query,
+ vpr_info("changed %s:%d [%s]%s =%s\n",
+ trim_prefix(dp->filename), dp->lineno,
+ dt->mod_name, dp->function,
+- ddebug_describe_flags(dp, flagbuf,
+- sizeof(flagbuf)));
++ ddebug_describe_flags(dp->flags, &fbuf));
+ }
+ }
+ mutex_unlock(&ddebug_lock);
+@@ -779,7 +778,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p)
+ {
+ struct ddebug_iter *iter = m->private;
+ struct _ddebug *dp = p;
+- char flagsbuf[10];
++ struct flagsbuf flags;
+
+ vpr_info("called m=%p p=%p\n", m, p);
+
+@@ -792,7 +791,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p)
+ seq_printf(m, "%s:%u [%s]%s =%s \"",
+ trim_prefix(dp->filename), dp->lineno,
+ iter->table->mod_name, dp->function,
+- ddebug_describe_flags(dp, flagsbuf, sizeof(flagsbuf)));
++ ddebug_describe_flags(dp->flags, &flags));
+ seq_escape(m, dp->format, "\t\r\n\"");
+ seq_puts(m, "\"\n");
+
+diff --git a/mm/mmap.c b/mm/mmap.c
+index a98f09b83019..e84fd3347a51 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -3100,6 +3100,7 @@ void exit_mmap(struct mm_struct *mm)
+ if (vma->vm_flags & VM_ACCOUNT)
+ nr_accounted += vma_pages(vma);
+ vma = remove_vma(vma);
++ cond_resched();
+ }
+ vm_unacct_memory(nr_accounted);
+ }
+diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
+index 357475cceec6..9a75f9b00b51 100644
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -57,6 +57,7 @@ static bool enable_6lowpan;
+ /* We are listening incoming connections via this channel
+ */
+ static struct l2cap_chan *listen_chan;
++static DEFINE_MUTEX(set_lock);
+
+ struct lowpan_peer {
+ struct list_head list;
+@@ -1082,12 +1083,14 @@ static void do_enable_set(struct work_struct *work)
+
+ enable_6lowpan = set_enable->flag;
+
++ mutex_lock(&set_lock);
+ if (listen_chan) {
+ l2cap_chan_close(listen_chan, 0);
+ l2cap_chan_put(listen_chan);
+ }
+
+ listen_chan = bt_6lowpan_listen();
++ mutex_unlock(&set_lock);
+
+ kfree(set_enable);
+ }
+@@ -1139,11 +1142,13 @@ static ssize_t lowpan_control_write(struct file *fp,
+ if (ret == -EINVAL)
+ return ret;
+
++ mutex_lock(&set_lock);
+ if (listen_chan) {
+ l2cap_chan_close(listen_chan, 0);
+ l2cap_chan_put(listen_chan);
+ listen_chan = NULL;
+ }
++ mutex_unlock(&set_lock);
+
+ if (conn) {
+ struct lowpan_peer *peer;
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index ddbe58f0d597..534e2598981d 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -285,51 +285,12 @@ static inline int sk_reuseport_match(struct inet_bind_bucket *tb,
+ ipv6_only_sock(sk), true, false);
+ }
+
+-/* Obtain a reference to a local port for the given sock,
+- * if snum is zero it means select any available local port.
+- * We try to allocate an odd port (and leave even ports for connect())
+- */
+-int inet_csk_get_port(struct sock *sk, unsigned short snum)
++void inet_csk_update_fastreuse(struct inet_bind_bucket *tb,
++ struct sock *sk)
+ {
+- bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN;
+- struct inet_hashinfo *hinfo = sk->sk_prot->h.hashinfo;
+- int ret = 1, port = snum;
+- struct inet_bind_hashbucket *head;
+- struct net *net = sock_net(sk);
+- struct inet_bind_bucket *tb = NULL;
+ kuid_t uid = sock_i_uid(sk);
++ bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN;
+
+- if (!port) {
+- head = inet_csk_find_open_port(sk, &tb, &port);
+- if (!head)
+- return ret;
+- if (!tb)
+- goto tb_not_found;
+- goto success;
+- }
+- head = &hinfo->bhash[inet_bhashfn(net, port,
+- hinfo->bhash_size)];
+- spin_lock_bh(&head->lock);
+- inet_bind_bucket_for_each(tb, &head->chain)
+- if (net_eq(ib_net(tb), net) && tb->port == port)
+- goto tb_found;
+-tb_not_found:
+- tb = inet_bind_bucket_create(hinfo->bind_bucket_cachep,
+- net, head, port);
+- if (!tb)
+- goto fail_unlock;
+-tb_found:
+- if (!hlist_empty(&tb->owners)) {
+- if (sk->sk_reuse == SK_FORCE_REUSE)
+- goto success;
+-
+- if ((tb->fastreuse > 0 && reuse) ||
+- sk_reuseport_match(tb, sk))
+- goto success;
+- if (inet_csk_bind_conflict(sk, tb, true, true))
+- goto fail_unlock;
+- }
+-success:
+ if (hlist_empty(&tb->owners)) {
+ tb->fastreuse = reuse;
+ if (sk->sk_reuseport) {
+@@ -373,6 +334,54 @@ success:
+ tb->fastreuseport = 0;
+ }
+ }
++}
++
++/* Obtain a reference to a local port for the given sock,
++ * if snum is zero it means select any available local port.
++ * We try to allocate an odd port (and leave even ports for connect())
++ */
++int inet_csk_get_port(struct sock *sk, unsigned short snum)
++{
++ bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN;
++ struct inet_hashinfo *hinfo = sk->sk_prot->h.hashinfo;
++ int ret = 1, port = snum;
++ struct inet_bind_hashbucket *head;
++ struct net *net = sock_net(sk);
++ struct inet_bind_bucket *tb = NULL;
++
++ if (!port) {
++ head = inet_csk_find_open_port(sk, &tb, &port);
++ if (!head)
++ return ret;
++ if (!tb)
++ goto tb_not_found;
++ goto success;
++ }
++ head = &hinfo->bhash[inet_bhashfn(net, port,
++ hinfo->bhash_size)];
++ spin_lock_bh(&head->lock);
++ inet_bind_bucket_for_each(tb, &head->chain)
++ if (net_eq(ib_net(tb), net) && tb->port == port)
++ goto tb_found;
++tb_not_found:
++ tb = inet_bind_bucket_create(hinfo->bind_bucket_cachep,
++ net, head, port);
++ if (!tb)
++ goto fail_unlock;
++tb_found:
++ if (!hlist_empty(&tb->owners)) {
++ if (sk->sk_reuse == SK_FORCE_REUSE)
++ goto success;
++
++ if ((tb->fastreuse > 0 && reuse) ||
++ sk_reuseport_match(tb, sk))
++ goto success;
++ if (inet_csk_bind_conflict(sk, tb, true, true))
++ goto fail_unlock;
++ }
++success:
++ inet_csk_update_fastreuse(tb, sk);
++
+ if (!inet_csk(sk)->icsk_bind_hash)
+ inet_bind_hash(sk, tb, port);
+ WARN_ON(inet_csk(sk)->icsk_bind_hash != tb);
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index b53da2691adb..3a5f12f011cb 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -161,6 +161,7 @@ int __inet_inherit_port(const struct sock *sk, struct sock *child)
+ return -ENOMEM;
+ }
+ }
++ inet_csk_update_fastreuse(tb, child);
+ }
+ inet_bind_hash(child, tb, port);
+ spin_unlock(&head->lock);
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index a71f777d1353..d5e4329579e2 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1928,14 +1928,14 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
+
+ conn_reuse_mode = sysctl_conn_reuse_mode(ipvs);
+ if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) {
+- bool uses_ct = false, resched = false;
++ bool old_ct = false, resched = false;
+
+ if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest &&
+ unlikely(!atomic_read(&cp->dest->weight))) {
+ resched = true;
+- uses_ct = ip_vs_conn_uses_conntrack(cp, skb);
++ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
+ } else if (is_new_conn_expected(cp, conn_reuse_mode)) {
+- uses_ct = ip_vs_conn_uses_conntrack(cp, skb);
++ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
+ if (!atomic_read(&cp->n_control)) {
+ resched = true;
+ } else {
+@@ -1943,15 +1943,17 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
+ * that uses conntrack while it is still
+ * referenced by controlled connection(s).
+ */
+- resched = !uses_ct;
++ resched = !old_ct;
+ }
+ }
+
+ if (resched) {
++ if (!old_ct)
++ cp->flags &= ~IP_VS_CONN_F_NFCT;
+ if (!atomic_read(&cp->n_control))
+ ip_vs_conn_expire_now(cp);
+ __ip_vs_conn_put(cp);
+- if (uses_ct)
++ if (old_ct)
+ return NF_DROP;
+ cp = NULL;
+ }
+diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
+index e2188deb08dc..b927730d9ab0 100644
+--- a/net/nfc/rawsock.c
++++ b/net/nfc/rawsock.c
+@@ -344,10 +344,13 @@ static int rawsock_create(struct net *net, struct socket *sock,
+ if ((sock->type != SOCK_SEQPACKET) && (sock->type != SOCK_RAW))
+ return -ESOCKTNOSUPPORT;
+
+- if (sock->type == SOCK_RAW)
++ if (sock->type == SOCK_RAW) {
++ if (!capable(CAP_NET_RAW))
++ return -EPERM;
+ sock->ops = &rawsock_raw_ops;
+- else
++ } else {
+ sock->ops = &rawsock_ops;
++ }
+
+ sk = sk_alloc(net, PF_NFC, GFP_ATOMIC, nfc_proto->proto, kern);
+ if (!sk)
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 0e029aefa707..b3caf1eac6af 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -949,6 +949,7 @@ static int prb_queue_frozen(struct tpacket_kbdq_core *pkc)
+ }
+
+ static void prb_clear_blk_fill_status(struct packet_ring_buffer *rb)
++ __releases(&pkc->blk_fill_in_prog_lock)
+ {
+ struct tpacket_kbdq_core *pkc = GET_PBDQC_FROM_RB(rb);
+ atomic_dec(&pkc->blk_fill_in_prog);
+@@ -996,6 +997,7 @@ static void prb_fill_curr_block(char *curr,
+ struct tpacket_kbdq_core *pkc,
+ struct tpacket_block_desc *pbd,
+ unsigned int len)
++ __acquires(&pkc->blk_fill_in_prog_lock)
+ {
+ struct tpacket3_hdr *ppd;
+
+@@ -2272,8 +2274,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ if (do_vnet &&
+ virtio_net_hdr_from_skb(skb, h.raw + macoff -
+ sizeof(struct virtio_net_hdr),
+- vio_le(), true, 0))
++ vio_le(), true, 0)) {
++ if (po->tp_version == TPACKET_V3)
++ prb_clear_blk_fill_status(&po->rx_ring);
+ goto drop_n_account;
++ }
+
+ if (po->tp_version <= TPACKET_V2) {
+ packet_increment_rx_head(po, &po->rx_ring);
+@@ -2379,7 +2384,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ __clear_bit(slot_id, po->rx_ring.rx_owner_map);
+ spin_unlock(&sk->sk_receive_queue.lock);
+ sk->sk_data_ready(sk);
+- } else {
++ } else if (po->tp_version == TPACKET_V3) {
+ prb_clear_blk_fill_status(&po->rx_ring);
+ }
+
+diff --git a/net/socket.c b/net/socket.c
+index 1030a612423b..29169045dcfe 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -474,7 +474,7 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
+ if (f.file) {
+ sock = sock_from_file(f.file, err);
+ if (likely(sock)) {
+- *fput_needed = f.flags;
++ *fput_needed = f.flags & FDPUT_FPUT;
+ return sock;
+ }
+ fdput(f);
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
+index 4fc0ce127089..22f135263815 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
+@@ -679,7 +679,6 @@ static int svc_rdma_build_read_chunk(struct svc_rqst *rqstp,
+ struct svc_rdma_read_info *info,
+ __be32 *p)
+ {
+- unsigned int i;
+ int ret;
+
+ ret = -EINVAL;
+@@ -702,12 +701,6 @@ static int svc_rdma_build_read_chunk(struct svc_rqst *rqstp,
+ info->ri_chunklen += rs_length;
+ }
+
+- /* Pages under I/O have been copied to head->rc_pages.
+- * Prevent their premature release by svc_xprt_release() .
+- */
+- for (i = 0; i < info->ri_readctxt->rc_page_count; i++)
+- rqstp->rq_pages[i] = NULL;
+-
+ return ret;
+ }
+
+@@ -802,6 +795,26 @@ out:
+ return ret;
+ }
+
++/* Pages under I/O have been copied to head->rc_pages. Ensure they
++ * are not released by svc_xprt_release() until the I/O is complete.
++ *
++ * This has to be done after all Read WRs are constructed to properly
++ * handle a page that is part of I/O on behalf of two different RDMA
++ * segments.
++ *
++ * Do this only if I/O has been posted. Otherwise, we do indeed want
++ * svc_xprt_release() to clean things up properly.
++ */
++static void svc_rdma_save_io_pages(struct svc_rqst *rqstp,
++ const unsigned int start,
++ const unsigned int num_pages)
++{
++ unsigned int i;
++
++ for (i = start; i < num_pages + start; i++)
++ rqstp->rq_pages[i] = NULL;
++}
++
+ /**
+ * svc_rdma_recv_read_chunk - Pull a Read chunk from the client
+ * @rdma: controlling RDMA transport
+@@ -855,6 +868,7 @@ int svc_rdma_recv_read_chunk(struct svcxprt_rdma *rdma, struct svc_rqst *rqstp,
+ ret = svc_rdma_post_chunk_ctxt(&info->ri_cc);
+ if (ret < 0)
+ goto out_err;
++ svc_rdma_save_io_pages(rqstp, 0, head->rc_page_count);
+ return 0;
+
+ out_err:
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index 8f40bbfd60ea..575d62130578 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -476,7 +476,7 @@ int tls_device_sendpage(struct sock *sk, struct page *page,
+ int offset, size_t size, int flags)
+ {
+ struct iov_iter msg_iter;
+- char *kaddr = kmap(page);
++ char *kaddr;
+ struct kvec iov;
+ int rc;
+
+@@ -490,6 +490,7 @@ int tls_device_sendpage(struct sock *sk, struct page *page,
+ goto out;
+ }
+
++ kaddr = kmap(page);
+ iov.iov_base = kaddr + offset;
+ iov.iov_len = size;
+ iov_iter_kvec(&msg_iter, WRITE | ITER_KVEC, &iov, 1, size);
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index 10ee51d04492..accd3846f1e3 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -912,7 +912,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
+ }
+
+ ret = sscanf(rule, "%d", &maplevel);
+- if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
++ if (ret != 1 || maplevel < 0 || maplevel > SMACK_CIPSO_MAXLEVEL)
+ goto out;
+
+ rule += SMK_DIGITLEN;
+@@ -933,6 +933,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
+
+ for (i = 0; i < catlen; i++) {
+ rule += SMK_DIGITLEN;
++ if (rule > data + count) {
++ rc = -EOVERFLOW;
++ goto out;
++ }
+ ret = sscanf(rule, "%u", &cat);
+ if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM)
+ goto out;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index fed9df479ef8..9c5b3d19bfa7 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4072,6 +4072,7 @@ static void alc233_fixup_lenovo_line2_mic_hotkey(struct hda_codec *codec,
+ {
+ struct alc_spec *spec = codec->spec;
+
++ spec->micmute_led_polarity = 1;
+ alc_fixup_hp_gpio_led(codec, action, 0, 0x04);
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ spec->init_amp = ALC_INIT_DEFAULT;
+diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c
+index 27308337ab12..ba76e37a4b09 100644
+--- a/sound/soc/intel/boards/bxt_rt298.c
++++ b/sound/soc/intel/boards/bxt_rt298.c
+@@ -544,6 +544,7 @@ static int bxt_card_late_probe(struct snd_soc_card *card)
+ /* broxton audio machine driver for SPT + RT298S */
+ static struct snd_soc_card broxton_rt298 = {
+ .name = "broxton-rt298",
++ .owner = THIS_MODULE,
+ .dai_link = broxton_rt298_dais,
+ .num_links = ARRAY_SIZE(broxton_rt298_dais),
+ .controls = broxton_controls,
+@@ -559,6 +560,7 @@ static struct snd_soc_card broxton_rt298 = {
+
+ static struct snd_soc_card geminilake_rt298 = {
+ .name = "geminilake-rt298",
++ .owner = THIS_MODULE,
+ .dai_link = broxton_rt298_dais,
+ .num_links = ARRAY_SIZE(broxton_rt298_dais),
+ .controls = broxton_controls,
+diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c
+index 7b8baf46d968..5c055d8de8c7 100644
+--- a/sound/soc/meson/axg-tdm-interface.c
++++ b/sound/soc/meson/axg-tdm-interface.c
+@@ -111,18 +111,25 @@ static int axg_tdm_iface_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ {
+ struct axg_tdm_iface *iface = snd_soc_dai_get_drvdata(dai);
+
+- /* These modes are not supported */
+- if (fmt & (SND_SOC_DAIFMT_CBS_CFM | SND_SOC_DAIFMT_CBM_CFS)) {
++ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++ case SND_SOC_DAIFMT_CBS_CFS:
++ if (!iface->mclk) {
++ dev_err(dai->dev, "cpu clock master: mclk missing\n");
++ return -ENODEV;
++ }
++ break;
++
++ case SND_SOC_DAIFMT_CBM_CFM:
++ break;
++
++ case SND_SOC_DAIFMT_CBS_CFM:
++ case SND_SOC_DAIFMT_CBM_CFS:
+ dev_err(dai->dev, "only CBS_CFS and CBM_CFM are supported\n");
++ /* Fall-through */
++ default:
+ return -EINVAL;
+ }
+
+- /* If the TDM interface is the clock master, it requires mclk */
+- if (!iface->mclk && (fmt & SND_SOC_DAIFMT_CBS_CFS)) {
+- dev_err(dai->dev, "cpu clock master: mclk missing\n");
+- return -ENODEV;
+- }
+-
+ iface->fmt = fmt;
+ return 0;
+ }
+@@ -311,7 +318,8 @@ static int axg_tdm_iface_hw_params(struct snd_pcm_substream *substream,
+ if (ret)
+ return ret;
+
+- if (iface->fmt & SND_SOC_DAIFMT_CBS_CFS) {
++ if ((iface->fmt & SND_SOC_DAIFMT_MASTER_MASK) ==
++ SND_SOC_DAIFMT_CBS_CFS) {
+ ret = axg_tdm_iface_set_sclk(dai, params);
+ if (ret)
+ return ret;
+diff --git a/sound/usb/card.h b/sound/usb/card.h
+index 7f11655bde50..f30fec68e2ca 100644
+--- a/sound/usb/card.h
++++ b/sound/usb/card.h
+@@ -129,6 +129,7 @@ struct snd_usb_substream {
+ unsigned int tx_length_quirk:1; /* add length specifier to transfers */
+ unsigned int fmt_type; /* USB audio format type (1-3) */
+ unsigned int pkt_offset_adj; /* Bytes to drop from beginning of packets (for non-compliant devices) */
++ unsigned int stream_offset_adj; /* Bytes to drop from beginning of stream (for non-compliant devices) */
+
+ unsigned int running: 1; /* running status */
+
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 21c1135bb89b..d1328abd1bc4 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -195,6 +195,7 @@ static const struct rc_config {
+ { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */
+ { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
+ { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
++ { USB_ID(0x041e, 0x3263), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
+ { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */
+ };
+
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 8b91be394407..7743e7bc6bf2 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1387,6 +1387,12 @@ static void retire_capture_urb(struct snd_usb_substream *subs,
+ // continue;
+ }
+ bytes = urb->iso_frame_desc[i].actual_length;
++ if (subs->stream_offset_adj > 0) {
++ unsigned int adj = min(subs->stream_offset_adj, bytes);
++ cp += adj;
++ bytes -= adj;
++ subs->stream_offset_adj -= adj;
++ }
+ frames = bytes / stride;
+ if (!subs->txfr_quirk)
+ bytes = frames * stride;
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 41a5e38b7870..89b70308b551 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3419,6 +3419,62 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ .type = QUIRK_SETUP_FMT_AFTER_RESUME
+ }
+ },
++{
++ /*
++ * PIONEER DJ DDJ-RB
++ * PCM is 4 channels out, 2 dummy channels in @ 44.1 fixed
++ * The feedback for the output is the dummy input.
++ */
++ USB_DEVICE_VENDOR_SPEC(0x2b73, 0x000e),
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_FIXED_ENDPOINT,
++ .data = &(const struct audioformat) {
++ .formats = SNDRV_PCM_FMTBIT_S24_3LE,
++ .channels = 4,
++ .iface = 0,
++ .altsetting = 1,
++ .altset_idx = 1,
++ .endpoint = 0x01,
++ .ep_attr = USB_ENDPOINT_XFER_ISOC|
++ USB_ENDPOINT_SYNC_ASYNC,
++ .rates = SNDRV_PCM_RATE_44100,
++ .rate_min = 44100,
++ .rate_max = 44100,
++ .nr_rates = 1,
++ .rate_table = (unsigned int[]) { 44100 }
++ }
++ },
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_FIXED_ENDPOINT,
++ .data = &(const struct audioformat) {
++ .formats = SNDRV_PCM_FMTBIT_S24_3LE,
++ .channels = 2,
++ .iface = 0,
++ .altsetting = 1,
++ .altset_idx = 1,
++ .endpoint = 0x82,
++ .ep_attr = USB_ENDPOINT_XFER_ISOC|
++ USB_ENDPOINT_SYNC_ASYNC|
++ USB_ENDPOINT_USAGE_IMPLICIT_FB,
++ .rates = SNDRV_PCM_RATE_44100,
++ .rate_min = 44100,
++ .rate_max = 44100,
++ .nr_rates = 1,
++ .rate_table = (unsigned int[]) { 44100 }
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
+
+ #define ALC1220_VB_DESKTOP(vend, prod) { \
+ USB_DEVICE(vend, prod), \
+@@ -3472,7 +3528,13 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */
+ * with.
+ */
+ {
+- USB_DEVICE(0x534d, 0x2109),
++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
++ USB_DEVICE_ID_MATCH_INT_CLASS |
++ USB_DEVICE_ID_MATCH_INT_SUBCLASS,
++ .idVendor = 0x534d,
++ .idProduct = 0x2109,
++ .bInterfaceClass = USB_CLASS_AUDIO,
++ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+ .vendor_name = "MacroSilicon",
+ .product_name = "MS2109",
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index e9ec6166acc6..8d9117312e30 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1166,6 +1166,9 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
+ case USB_ID(0x041e, 0x3f19): /* E-Mu 0204 USB */
+ set_format_emu_quirk(subs, fmt);
+ break;
++ case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */
++ subs->stream_offset_adj = 2;
++ break;
+ }
+ }
+
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index 9d020bd0de17..ff5d803cfaf0 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -99,6 +99,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as,
+ subs->tx_length_quirk = as->chip->tx_length_quirk;
+ subs->speed = snd_usb_get_speed(subs->dev);
+ subs->pkt_offset_adj = 0;
++ subs->stream_offset_adj = 0;
+
+ snd_usb_set_pcm_ops(as->pcm, stream);
+
+diff --git a/tools/build/Build.include b/tools/build/Build.include
+index 9ec01f4454f9..585486e40995 100644
+--- a/tools/build/Build.include
++++ b/tools/build/Build.include
+@@ -74,7 +74,8 @@ dep-cmd = $(if $(wildcard $(fixdep)),
+ # dependencies in the cmd file
+ if_changed_dep = $(if $(strip $(any-prereq) $(arg-check)), \
+ @set -e; \
+- $(echo-cmd) $(cmd_$(1)) && $(dep-cmd))
++ $(echo-cmd) $(cmd_$(1)); \
++ $(dep-cmd))
+
+ # if_changed - execute command if any prerequisite is newer than
+ # target, or command line has changed
+diff --git a/tools/testing/selftests/powerpc/benchmarks/context_switch.c b/tools/testing/selftests/powerpc/benchmarks/context_switch.c
+index 87f1f0252299..9ec7674697b1 100644
+--- a/tools/testing/selftests/powerpc/benchmarks/context_switch.c
++++ b/tools/testing/selftests/powerpc/benchmarks/context_switch.c
+@@ -23,6 +23,7 @@
+ #include <limits.h>
+ #include <sys/time.h>
+ #include <sys/syscall.h>
++#include <sys/sysinfo.h>
+ #include <sys/types.h>
+ #include <sys/shm.h>
+ #include <linux/futex.h>
+@@ -108,8 +109,9 @@ static void start_thread_on(void *(*fn)(void *), void *arg, unsigned long cpu)
+
+ static void start_process_on(void *(*fn)(void *), void *arg, unsigned long cpu)
+ {
+- int pid;
+- cpu_set_t cpuset;
++ int pid, ncpus;
++ cpu_set_t *cpuset;
++ size_t size;
+
+ pid = fork();
+ if (pid == -1) {
+@@ -120,14 +122,23 @@ static void start_process_on(void *(*fn)(void *), void *arg, unsigned long cpu)
+ if (pid)
+ return;
+
+- CPU_ZERO(&cpuset);
+- CPU_SET(cpu, &cpuset);
++ ncpus = get_nprocs();
++ size = CPU_ALLOC_SIZE(ncpus);
++ cpuset = CPU_ALLOC(ncpus);
++ if (!cpuset) {
++ perror("malloc");
++ exit(1);
++ }
++ CPU_ZERO_S(size, cpuset);
++ CPU_SET_S(cpu, size, cpuset);
+
+- if (sched_setaffinity(0, sizeof(cpuset), &cpuset)) {
++ if (sched_setaffinity(0, size, cpuset)) {
+ perror("sched_setaffinity");
++ CPU_FREE(cpuset);
+ exit(1);
+ }
+
++ CPU_FREE(cpuset);
+ fn(arg);
+
+ exit(0);
+diff --git a/tools/testing/selftests/powerpc/utils.c b/tools/testing/selftests/powerpc/utils.c
+index aa8fc1e6365b..ba0959d454b3 100644
+--- a/tools/testing/selftests/powerpc/utils.c
++++ b/tools/testing/selftests/powerpc/utils.c
+@@ -13,6 +13,7 @@
+ #include <stdio.h>
+ #include <string.h>
+ #include <sys/stat.h>
++#include <sys/sysinfo.h>
+ #include <sys/types.h>
+ #include <sys/utsname.h>
+ #include <unistd.h>
+@@ -83,28 +84,40 @@ void *get_auxv_entry(int type)
+
+ int pick_online_cpu(void)
+ {
+- cpu_set_t mask;
+- int cpu;
++ int ncpus, cpu = -1;
++ cpu_set_t *mask;
++ size_t size;
++
++ ncpus = get_nprocs_conf();
++ size = CPU_ALLOC_SIZE(ncpus);
++ mask = CPU_ALLOC(ncpus);
++ if (!mask) {
++ perror("malloc");
++ return -1;
++ }
+
+- CPU_ZERO(&mask);
++ CPU_ZERO_S(size, mask);
+
+- if (sched_getaffinity(0, sizeof(mask), &mask)) {
++ if (sched_getaffinity(0, size, mask)) {
+ perror("sched_getaffinity");
+- return -1;
++ goto done;
+ }
+
+ /* We prefer a primary thread, but skip 0 */
+- for (cpu = 8; cpu < CPU_SETSIZE; cpu += 8)
+- if (CPU_ISSET(cpu, &mask))
+- return cpu;
++ for (cpu = 8; cpu < ncpus; cpu += 8)
++ if (CPU_ISSET_S(cpu, size, mask))
++ goto done;
+
+ /* Search for anything, but in reverse */
+- for (cpu = CPU_SETSIZE - 1; cpu >= 0; cpu--)
+- if (CPU_ISSET(cpu, &mask))
+- return cpu;
++ for (cpu = ncpus - 1; cpu >= 0; cpu--)
++ if (CPU_ISSET_S(cpu, size, mask))
++ goto done;
+
+ printf("No cpus in affinity mask?!\n");
+- return -1;
++
++done:
++ CPU_FREE(mask);
++ return cpu;
+ }
+
+ bool is_ppc64le(void)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-08-21 10:49 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2020-08-21 10:49 UTC (permalink / raw
To: gentoo-commits
commit: 57661b28b79bbbbea7e6812d625ee222265e71cc
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 21 10:48:18 2020 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Fri Aug 21 10:49:01 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=57661b28
Linux patch 4.19.141
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1140_linux-4.19.141.patch | 2957 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2961 insertions(+)
diff --git a/0000_README b/0000_README
index 1b514b0..1680f0b 100644
--- a/0000_README
+++ b/0000_README
@@ -599,6 +599,10 @@ Patch: 1139_linux-4.19.140.patch
From: https://www.kernel.org
Desc: Linux 4.19.140
+Patch: 1140_linux-4.19.141.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.141
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1140_linux-4.19.141.patch b/1140_linux-4.19.141.patch
new file mode 100644
index 0000000..f4b0b6a
--- /dev/null
+++ b/1140_linux-4.19.141.patch
@@ -0,0 +1,2957 @@
+diff --git a/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt b/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt
+index c82794002595f..89647d7143879 100644
+--- a/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt
++++ b/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt
+@@ -21,7 +21,7 @@ controller state. The mux controller state is described in
+
+ Example:
+ mux: mux-controller {
+- compatible = "mux-gpio";
++ compatible = "gpio-mux";
+ #mux-control-cells = <0>;
+
+ mux-gpios = <&pioA 0 GPIO_ACTIVE_HIGH>,
+diff --git a/Makefile b/Makefile
+index c5ee1c10a39c8..5b64e11419846 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 140
++SUBLEVEL = 141
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+index 3ab25ad402b90..6cbdd66921aab 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+@@ -19,6 +19,12 @@
+ model = "Globalscale Marvell ESPRESSOBin Board";
+ compatible = "globalscale,espressobin", "marvell,armada3720", "marvell,armada3710";
+
++ aliases {
++ ethernet0 = ð0;
++ serial0 = &uart0;
++ serial1 = &uart1;
++ };
++
+ chosen {
+ stdout-path = "serial0:115200n8";
+ };
+diff --git a/arch/mips/kernel/topology.c b/arch/mips/kernel/topology.c
+index cd3e1f82e1a5d..08ad6371fbe08 100644
+--- a/arch/mips/kernel/topology.c
++++ b/arch/mips/kernel/topology.c
+@@ -20,7 +20,7 @@ static int __init topology_init(void)
+ for_each_present_cpu(i) {
+ struct cpu *c = &per_cpu(cpu_devices, i);
+
+- c->hotpluggable = 1;
++ c->hotpluggable = !!i;
+ ret = register_cpu(c, i);
+ if (ret)
+ printk(KERN_WARNING "topology_init: register_cpu %d "
+diff --git a/arch/openrisc/kernel/stacktrace.c b/arch/openrisc/kernel/stacktrace.c
+index 43f140a28bc72..54d38809e22cb 100644
+--- a/arch/openrisc/kernel/stacktrace.c
++++ b/arch/openrisc/kernel/stacktrace.c
+@@ -13,6 +13,7 @@
+ #include <linux/export.h>
+ #include <linux/sched.h>
+ #include <linux/sched/debug.h>
++#include <linux/sched/task_stack.h>
+ #include <linux/stacktrace.h>
+
+ #include <asm/processor.h>
+@@ -68,12 +69,25 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
+ {
+ unsigned long *sp = NULL;
+
++ if (!try_get_task_stack(tsk))
++ return;
++
+ if (tsk == current)
+ sp = (unsigned long *) &sp;
+- else
+- sp = (unsigned long *) KSTK_ESP(tsk);
++ else {
++ unsigned long ksp;
++
++ /* Locate stack from kernel context */
++ ksp = task_thread_info(tsk)->ksp;
++ ksp += STACK_FRAME_OVERHEAD; /* redzone */
++ ksp += sizeof(struct pt_regs);
++
++ sp = (unsigned long *) ksp;
++ }
+
+ unwind_stack(trace, sp, save_stack_address_nosched);
++
++ put_task_stack(tsk);
+ }
+ EXPORT_SYMBOL_GPL(save_stack_trace_tsk);
+
+diff --git a/arch/powerpc/include/asm/percpu.h b/arch/powerpc/include/asm/percpu.h
+index dce863a7635cd..8e5b7d0b851c6 100644
+--- a/arch/powerpc/include/asm/percpu.h
++++ b/arch/powerpc/include/asm/percpu.h
+@@ -10,8 +10,6 @@
+
+ #ifdef CONFIG_SMP
+
+-#include <asm/paca.h>
+-
+ #define __my_cpu_offset local_paca->data_offset
+
+ #endif /* CONFIG_SMP */
+@@ -19,4 +17,6 @@
+
+ #include <asm-generic/percpu.h>
+
++#include <asm/paca.h>
++
+ #endif /* _ASM_POWERPC_PERCPU_H_ */
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 6e0ff8b600ced..eb5252177b662 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -233,6 +233,9 @@ static bool bad_kernel_fault(bool is_exec, unsigned long error_code,
+ return is_exec || (address >= TASK_SIZE);
+ }
+
++// This comes from 64-bit struct rt_sigframe + __SIGNAL_FRAMESIZE
++#define SIGFRAME_MAX_SIZE (4096 + 128)
++
+ static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address,
+ struct vm_area_struct *vma, unsigned int flags,
+ bool *must_retry)
+@@ -240,7 +243,7 @@ static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address,
+ /*
+ * N.B. The POWER/Open ABI allows programs to access up to
+ * 288 bytes below the stack pointer.
+- * The kernel signal delivery code writes up to about 1.5kB
++ * The kernel signal delivery code writes a bit over 4KB
+ * below the stack pointer (r1) before decrementing it.
+ * The exec code can write slightly over 640kB to the stack
+ * before setting the user r1. Thus we allow the stack to
+@@ -265,7 +268,7 @@ static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address,
+ * between the last mapped region and the stack will
+ * expand the stack rather than segfaulting.
+ */
+- if (address + 2048 >= uregs->gpr[1])
++ if (address + SIGFRAME_MAX_SIZE >= uregs->gpr[1])
+ return false;
+
+ if ((flags & FAULT_FLAG_WRITE) && (flags & FAULT_FLAG_USER) &&
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index b168c3742b431..afabe69186195 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -31,7 +31,7 @@ static bool rtas_hp_event;
+ unsigned long pseries_memory_block_size(void)
+ {
+ struct device_node *np;
+- unsigned int memblock_size = MIN_MEMORY_BLOCK_SIZE;
++ u64 memblock_size = MIN_MEMORY_BLOCK_SIZE;
+ struct resource r;
+
+ np = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory");
+diff --git a/arch/sh/boards/mach-landisk/setup.c b/arch/sh/boards/mach-landisk/setup.c
+index f1147caebacf0..af69fb7fef7c7 100644
+--- a/arch/sh/boards/mach-landisk/setup.c
++++ b/arch/sh/boards/mach-landisk/setup.c
+@@ -85,6 +85,9 @@ device_initcall(landisk_devices_setup);
+
+ static void __init landisk_setup(char **cmdline_p)
+ {
++ /* I/O port identity mapping */
++ __set_io_port_base(0);
++
+ /* LED ON */
+ __raw_writeb(__raw_readb(PA_LED) | 0x03, PA_LED);
+
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index 99c28c02b7a54..8b7e0b46e86ea 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -556,6 +556,10 @@ static int x86_vector_alloc_irqs(struct irq_domain *domain, unsigned int virq,
+ irqd->chip_data = apicd;
+ irqd->hwirq = virq + i;
+ irqd_set_single_target(irqd);
++
++ /* Don't invoke affinity setter on deactivated interrupts */
++ irqd_set_affinity_on_activate(irqd);
++
+ /*
+ * Legacy vectors are already assigned when the IOAPIC
+ * takes them over. They stay on the same vector. This is
+diff --git a/arch/xtensa/kernel/perf_event.c b/arch/xtensa/kernel/perf_event.c
+index ff1d81385ed7a..768e1f7ab8715 100644
+--- a/arch/xtensa/kernel/perf_event.c
++++ b/arch/xtensa/kernel/perf_event.c
+@@ -404,7 +404,7 @@ static struct pmu xtensa_pmu = {
+ .read = xtensa_pmu_read,
+ };
+
+-static int xtensa_pmu_setup(int cpu)
++static int xtensa_pmu_setup(unsigned int cpu)
+ {
+ unsigned i;
+
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index caaeb7910a046..0047bbdd43c0f 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -792,7 +792,9 @@ static int __device_attach(struct device *dev, bool allow_async)
+ int ret = 0;
+
+ device_lock(dev);
+- if (dev->driver) {
++ if (dev->p->dead) {
++ goto out_unlock;
++ } else if (dev->driver) {
+ if (device_is_bound(dev)) {
+ ret = 1;
+ goto out_unlock;
+diff --git a/drivers/clk/sirf/clk-atlas6.c b/drivers/clk/sirf/clk-atlas6.c
+index 0cd11e6893afa..25ed60776560e 100644
+--- a/drivers/clk/sirf/clk-atlas6.c
++++ b/drivers/clk/sirf/clk-atlas6.c
+@@ -136,7 +136,7 @@ static void __init atlas6_clk_init(struct device_node *np)
+
+ for (i = pll1; i < maxclk; i++) {
+ atlas6_clks[i] = clk_register(NULL, atlas6_clk_hw_array[i]);
+- BUG_ON(!atlas6_clks[i]);
++ BUG_ON(IS_ERR(atlas6_clks[i]));
+ }
+ clk_register_clkdev(atlas6_clks[cpu], NULL, "cpu");
+ clk_register_clkdev(atlas6_clks[io], NULL, "io");
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+index 083aa71487e8e..db87cb8930d24 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+@@ -2723,7 +2723,10 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr *hwmgr)
+
+ static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr)
+ {
+- return ci_is_smc_ram_running(hwmgr);
++ return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device,
++ CGS_IND_REG__SMC, FEATURE_STATUS,
++ VOLTAGE_CONTROLLER_ON))
++ ? true : false;
+ }
+
+ static int ci_smu_init(struct pp_hwmgr *hwmgr)
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index fa5c25d36d3dc..652de972c3aea 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -107,6 +107,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"),
+ },
+ .driver_data = (void *)&lcd800x1280_rightside_up,
++ }, { /* Asus T103HAF */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"),
++ },
++ .driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* GPD MicroPC (generic strings, also match on bios date) */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
+diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
+index 42daa5c9ff8e6..221a8cbc57f90 100644
+--- a/drivers/gpu/drm/imx/imx-ldb.c
++++ b/drivers/gpu/drm/imx/imx-ldb.c
+@@ -311,18 +311,19 @@ static void imx_ldb_encoder_disable(struct drm_encoder *encoder)
+ {
+ struct imx_ldb_channel *imx_ldb_ch = enc_to_imx_ldb_ch(encoder);
+ struct imx_ldb *ldb = imx_ldb_ch->ldb;
++ int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN;
+ int mux, ret;
+
+ drm_panel_disable(imx_ldb_ch->panel);
+
+- if (imx_ldb_ch == &ldb->channel[0])
++ if (imx_ldb_ch == &ldb->channel[0] || dual)
+ ldb->ldb_ctrl &= ~LDB_CH0_MODE_EN_MASK;
+- else if (imx_ldb_ch == &ldb->channel[1])
++ if (imx_ldb_ch == &ldb->channel[1] || dual)
+ ldb->ldb_ctrl &= ~LDB_CH1_MODE_EN_MASK;
+
+ regmap_write(ldb->regmap, IOMUXC_GPR2, ldb->ldb_ctrl);
+
+- if (ldb->ldb_ctrl & LDB_SPLIT_MODE_EN) {
++ if (dual) {
+ clk_disable_unprepare(ldb->clk[0]);
+ clk_disable_unprepare(ldb->clk[1]);
+ }
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index 6a712a8d59e93..e486b6517ac55 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -2861,7 +2861,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
+ ++i;
+ }
+
+- if (i != unit) {
++ if (&con->head == &dev_priv->dev->mode_config.connector_list) {
+ DRM_ERROR("Could not find initial display unit.\n");
+ ret = -EINVAL;
+ goto out_unlock;
+@@ -2885,13 +2885,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
+ break;
+ }
+
+- if (mode->type & DRM_MODE_TYPE_PREFERRED)
+- *p_mode = mode;
+- else {
++ if (&mode->head == &con->modes) {
+ WARN_ONCE(true, "Could not find initial preferred mode.\n");
+ *p_mode = list_first_entry(&con->modes,
+ struct drm_display_mode,
+ head);
++ } else {
++ *p_mode = mode;
+ }
+
+ out_unlock:
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+index 7235781171912..0743a73117000 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+@@ -79,7 +79,7 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
+ struct vmw_legacy_display_unit *entry;
+ struct drm_framebuffer *fb = NULL;
+ struct drm_crtc *crtc = NULL;
+- int i = 0;
++ int i;
+
+ /* If there is no display topology the host just assumes
+ * that the guest will set the same layout as the host.
+@@ -90,12 +90,11 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
+ crtc = &entry->base.crtc;
+ w = max(w, crtc->x + crtc->mode.hdisplay);
+ h = max(h, crtc->y + crtc->mode.vdisplay);
+- i++;
+ }
+
+ if (crtc == NULL)
+ return 0;
+- fb = entry->base.crtc.primary->state->fb;
++ fb = crtc->primary->state->fb;
+
+ return vmw_kms_write_svga(dev_priv, w, h, fb->pitches[0],
+ fb->format->cpp[0] * 8,
+diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c
+index 91653adc41cc4..cdaf1d74e31a2 100644
+--- a/drivers/gpu/ipu-v3/ipu-image-convert.c
++++ b/drivers/gpu/ipu-v3/ipu-image-convert.c
+@@ -998,9 +998,10 @@ done:
+ return IRQ_WAKE_THREAD;
+ }
+
+-static irqreturn_t norotate_irq(int irq, void *data)
++static irqreturn_t eof_irq(int irq, void *data)
+ {
+ struct ipu_image_convert_chan *chan = data;
++ struct ipu_image_convert_priv *priv = chan->priv;
+ struct ipu_image_convert_ctx *ctx;
+ struct ipu_image_convert_run *run;
+ unsigned long flags;
+@@ -1017,45 +1018,26 @@ static irqreturn_t norotate_irq(int irq, void *data)
+
+ ctx = run->ctx;
+
+- if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
+- /* this is a rotation operation, just ignore */
+- spin_unlock_irqrestore(&chan->irqlock, flags);
+- return IRQ_HANDLED;
+- }
+-
+- ret = do_irq(run);
+-out:
+- spin_unlock_irqrestore(&chan->irqlock, flags);
+- return ret;
+-}
+-
+-static irqreturn_t rotate_irq(int irq, void *data)
+-{
+- struct ipu_image_convert_chan *chan = data;
+- struct ipu_image_convert_priv *priv = chan->priv;
+- struct ipu_image_convert_ctx *ctx;
+- struct ipu_image_convert_run *run;
+- unsigned long flags;
+- irqreturn_t ret;
+-
+- spin_lock_irqsave(&chan->irqlock, flags);
+-
+- /* get current run and its context */
+- run = chan->current_run;
+- if (!run) {
++ if (irq == chan->out_eof_irq) {
++ if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
++ /* this is a rotation op, just ignore */
++ ret = IRQ_HANDLED;
++ goto out;
++ }
++ } else if (irq == chan->rot_out_eof_irq) {
++ if (!ipu_rot_mode_is_irt(ctx->rot_mode)) {
++ /* this was NOT a rotation op, shouldn't happen */
++ dev_err(priv->ipu->dev,
++ "Unexpected rotation interrupt\n");
++ ret = IRQ_HANDLED;
++ goto out;
++ }
++ } else {
++ dev_err(priv->ipu->dev, "Received unknown irq %d\n", irq);
+ ret = IRQ_NONE;
+ goto out;
+ }
+
+- ctx = run->ctx;
+-
+- if (!ipu_rot_mode_is_irt(ctx->rot_mode)) {
+- /* this was NOT a rotation operation, shouldn't happen */
+- dev_err(priv->ipu->dev, "Unexpected rotation interrupt\n");
+- spin_unlock_irqrestore(&chan->irqlock, flags);
+- return IRQ_HANDLED;
+- }
+-
+ ret = do_irq(run);
+ out:
+ spin_unlock_irqrestore(&chan->irqlock, flags);
+@@ -1148,7 +1130,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan)
+ chan->out_chan,
+ IPU_IRQ_EOF);
+
+- ret = request_threaded_irq(chan->out_eof_irq, norotate_irq, do_bh,
++ ret = request_threaded_irq(chan->out_eof_irq, eof_irq, do_bh,
+ 0, "ipu-ic", chan);
+ if (ret < 0) {
+ dev_err(priv->ipu->dev, "could not acquire irq %d\n",
+@@ -1161,7 +1143,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan)
+ chan->rotation_out_chan,
+ IPU_IRQ_EOF);
+
+- ret = request_threaded_irq(chan->rot_out_eof_irq, rotate_irq, do_bh,
++ ret = request_threaded_irq(chan->rot_out_eof_irq, eof_irq, do_bh,
+ 0, "ipu-ic", chan);
+ if (ret < 0) {
+ dev_err(priv->ipu->dev, "could not acquire irq %d\n",
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 6e49e438ef5a5..dcdce18fc7062 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -587,13 +587,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR);
+ }
+
+- rcar_i2c_write(priv, ICSSR, ~SAR & 0xff);
++ /* Clear SSR, too, because of old STOPs to other clients than us */
++ rcar_i2c_write(priv, ICSSR, ~(SAR | SSR) & 0xff);
+ }
+
+ /* master sent stop */
+ if (ssr_filtered & SSR) {
+ i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
+- rcar_i2c_write(priv, ICSIER, SAR | SSR);
++ rcar_i2c_write(priv, ICSIER, SAR);
+ rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
+ }
+
+@@ -848,7 +849,7 @@ static int rcar_reg_slave(struct i2c_client *slave)
+ priv->slave = slave;
+ rcar_i2c_write(priv, ICSAR, slave->addr);
+ rcar_i2c_write(priv, ICSSR, 0);
+- rcar_i2c_write(priv, ICSIER, SAR | SSR);
++ rcar_i2c_write(priv, ICSIER, SAR);
+ rcar_i2c_write(priv, ICSCR, SIE | SDBS);
+
+ return 0;
+@@ -860,12 +861,14 @@ static int rcar_unreg_slave(struct i2c_client *slave)
+
+ WARN_ON(!priv->slave);
+
+- /* disable irqs and ensure none is running before clearing ptr */
++ /* ensure no irq is running before clearing ptr */
++ disable_irq(priv->irq);
+ rcar_i2c_write(priv, ICSIER, 0);
+- rcar_i2c_write(priv, ICSCR, 0);
++ rcar_i2c_write(priv, ICSSR, 0);
++ enable_irq(priv->irq);
++ rcar_i2c_write(priv, ICSCR, SDBS);
+ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+
+- synchronize_irq(priv->irq);
+ priv->slave = NULL;
+
+ pm_runtime_put(rcar_i2c_priv_to_dev(priv));
+diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c
+index 095530c233e41..7549abd544c0f 100644
+--- a/drivers/iio/dac/ad5592r-base.c
++++ b/drivers/iio/dac/ad5592r-base.c
+@@ -417,7 +417,7 @@ static int ad5592r_read_raw(struct iio_dev *iio_dev,
+ s64 tmp = *val * (3767897513LL / 25LL);
+ *val = div_s64_rem(tmp, 1000000000LL, val2);
+
+- ret = IIO_VAL_INT_PLUS_MICRO;
++ return IIO_VAL_INT_PLUS_MICRO;
+ } else {
+ int mult;
+
+@@ -448,7 +448,7 @@ static int ad5592r_read_raw(struct iio_dev *iio_dev,
+ ret = IIO_VAL_INT;
+ break;
+ default:
+- ret = -EINVAL;
++ return -EINVAL;
+ }
+
+ unlock:
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
+index 85267bbf48360..ef12221017053 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib.h
++++ b/drivers/infiniband/ulp/ipoib/ipoib.h
+@@ -513,7 +513,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev);
+
+ int ipoib_ib_dev_open_default(struct net_device *dev);
+ int ipoib_ib_dev_open(struct net_device *dev);
+-int ipoib_ib_dev_stop(struct net_device *dev);
++void ipoib_ib_dev_stop(struct net_device *dev);
+ void ipoib_ib_dev_up(struct net_device *dev);
+ void ipoib_ib_dev_down(struct net_device *dev);
+ int ipoib_ib_dev_stop_default(struct net_device *dev);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index 0f2e80f54d333..82b9c5b6e3e65 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -669,14 +669,13 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb,
+ return rc;
+ }
+
+-static void __ipoib_reap_ah(struct net_device *dev)
++static void ipoib_reap_dead_ahs(struct ipoib_dev_priv *priv)
+ {
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+ struct ipoib_ah *ah, *tah;
+ LIST_HEAD(remove_list);
+ unsigned long flags;
+
+- netif_tx_lock_bh(dev);
++ netif_tx_lock_bh(priv->dev);
+ spin_lock_irqsave(&priv->lock, flags);
+
+ list_for_each_entry_safe(ah, tah, &priv->dead_ahs, list)
+@@ -687,37 +686,37 @@ static void __ipoib_reap_ah(struct net_device *dev)
+ }
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+- netif_tx_unlock_bh(dev);
++ netif_tx_unlock_bh(priv->dev);
+ }
+
+ void ipoib_reap_ah(struct work_struct *work)
+ {
+ struct ipoib_dev_priv *priv =
+ container_of(work, struct ipoib_dev_priv, ah_reap_task.work);
+- struct net_device *dev = priv->dev;
+
+- __ipoib_reap_ah(dev);
++ ipoib_reap_dead_ahs(priv);
+
+ if (!test_bit(IPOIB_STOP_REAPER, &priv->flags))
+ queue_delayed_work(priv->wq, &priv->ah_reap_task,
+ round_jiffies_relative(HZ));
+ }
+
+-static void ipoib_flush_ah(struct net_device *dev)
++static void ipoib_start_ah_reaper(struct ipoib_dev_priv *priv)
+ {
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+-
+- cancel_delayed_work(&priv->ah_reap_task);
+- flush_workqueue(priv->wq);
+- ipoib_reap_ah(&priv->ah_reap_task.work);
++ clear_bit(IPOIB_STOP_REAPER, &priv->flags);
++ queue_delayed_work(priv->wq, &priv->ah_reap_task,
++ round_jiffies_relative(HZ));
+ }
+
+-static void ipoib_stop_ah(struct net_device *dev)
++static void ipoib_stop_ah_reaper(struct ipoib_dev_priv *priv)
+ {
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+-
+ set_bit(IPOIB_STOP_REAPER, &priv->flags);
+- ipoib_flush_ah(dev);
++ cancel_delayed_work(&priv->ah_reap_task);
++ /*
++ * After ipoib_stop_ah_reaper() we always go through
++ * ipoib_reap_dead_ahs() which ensures the work is really stopped and
++ * does a final flush out of the dead_ah's list
++ */
+ }
+
+ static int recvs_pending(struct net_device *dev)
+@@ -846,18 +845,6 @@ timeout:
+ return 0;
+ }
+
+-int ipoib_ib_dev_stop(struct net_device *dev)
+-{
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+-
+- priv->rn_ops->ndo_stop(dev);
+-
+- clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
+- ipoib_flush_ah(dev);
+-
+- return 0;
+-}
+-
+ int ipoib_ib_dev_open_default(struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = ipoib_priv(dev);
+@@ -901,10 +888,7 @@ int ipoib_ib_dev_open(struct net_device *dev)
+ return -1;
+ }
+
+- clear_bit(IPOIB_STOP_REAPER, &priv->flags);
+- queue_delayed_work(priv->wq, &priv->ah_reap_task,
+- round_jiffies_relative(HZ));
+-
++ ipoib_start_ah_reaper(priv);
+ if (priv->rn_ops->ndo_open(dev)) {
+ pr_warn("%s: Failed to open dev\n", dev->name);
+ goto dev_stop;
+@@ -915,13 +899,20 @@ int ipoib_ib_dev_open(struct net_device *dev)
+ return 0;
+
+ dev_stop:
+- set_bit(IPOIB_STOP_REAPER, &priv->flags);
+- cancel_delayed_work(&priv->ah_reap_task);
+- set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
+- ipoib_ib_dev_stop(dev);
++ ipoib_stop_ah_reaper(priv);
+ return -1;
+ }
+
++void ipoib_ib_dev_stop(struct net_device *dev)
++{
++ struct ipoib_dev_priv *priv = ipoib_priv(dev);
++
++ priv->rn_ops->ndo_stop(dev);
++
++ clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
++ ipoib_stop_ah_reaper(priv);
++}
++
+ void ipoib_pkey_dev_check_presence(struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = ipoib_priv(dev);
+@@ -1232,7 +1223,7 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
+ ipoib_mcast_dev_flush(dev);
+ if (oper_up)
+ set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
+- ipoib_flush_ah(dev);
++ ipoib_reap_dead_ahs(priv);
+ }
+
+ if (level >= IPOIB_FLUSH_NORMAL)
+@@ -1307,7 +1298,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
+ * the neighbor garbage collection is stopped and reaped.
+ * That should all be done now, so make a final ah flush.
+ */
+- ipoib_stop_ah(dev);
++ ipoib_reap_dead_ahs(priv);
+
+ clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 6093e8268583d..d0c35eb687aeb 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1979,6 +1979,8 @@ static void ipoib_ndo_uninit(struct net_device *dev)
+
+ /* no more works over the priv->wq */
+ if (priv->wq) {
++ /* See ipoib_mcast_carrier_on_task() */
++ WARN_ON(test_bit(IPOIB_FLAG_OPER_UP, &priv->flags));
+ flush_workqueue(priv->wq);
+ destroy_workqueue(priv->wq);
+ priv->wq = NULL;
+diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
+index 1d6010d463e2c..022a8cb58a066 100644
+--- a/drivers/input/mouse/sentelic.c
++++ b/drivers/input/mouse/sentelic.c
+@@ -454,7 +454,7 @@ static ssize_t fsp_attr_set_setreg(struct psmouse *psmouse, void *data,
+
+ fsp_reg_write_enable(psmouse, false);
+
+- return count;
++ return retval;
+ }
+
+ PSMOUSE_DEFINE_WO_ATTR(setreg, S_IWUSR, NULL, fsp_attr_set_setreg);
+diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
+index 50217548c3b8e..5ce55fabc9d80 100644
+--- a/drivers/iommu/omap-iommu-debug.c
++++ b/drivers/iommu/omap-iommu-debug.c
+@@ -101,8 +101,11 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
+ mutex_lock(&iommu_debug_lock);
+
+ bytes = omap_iommu_dump_ctx(obj, p, count);
++ if (bytes < 0)
++ goto err;
+ bytes = simple_read_from_buffer(userbuf, count, ppos, buf, bytes);
+
++err:
+ mutex_unlock(&iommu_debug_lock);
+ kfree(buf);
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index fe7d63cdfb1d7..d5cc32e80f5e2 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2458,6 +2458,7 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ {
+ msi_alloc_info_t *info = args;
+ struct its_device *its_dev = info->scratchpad[0].ptr;
++ struct irq_data *irqd;
+ irq_hw_number_t hwirq;
+ int err;
+ int i;
+@@ -2473,7 +2474,9 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+
+ irq_domain_set_hwirq_and_chip(domain, virq + i,
+ hwirq + i, &its_irq_chip, its_dev);
+- irqd_set_single_target(irq_desc_get_irq_data(irq_to_desc(virq + i)));
++ irqd = irq_get_irq_data(virq + i);
++ irqd_set_single_target(irqd);
++ irqd_set_affinity_on_activate(irqd);
+ pr_debug("ID:%d pID:%d vID:%d\n",
+ (int)(hwirq + i - its_dev->event_map.lpi_base),
+ (int)(hwirq + i), virq + i);
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index 2a2f189dd37cb..1cc6ae3e058c6 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -264,7 +264,7 @@ struct bcache_device {
+ #define BCACHE_DEV_UNLINK_DONE 2
+ #define BCACHE_DEV_WB_RUNNING 3
+ #define BCACHE_DEV_RATE_DW_RUNNING 4
+- unsigned int nr_stripes;
++ int nr_stripes;
+ unsigned int stripe_size;
+ atomic_t *stripe_sectors_dirty;
+ unsigned long *full_dirty_stripes;
+diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
+index 268f1b6850840..ec48cf86cab60 100644
+--- a/drivers/md/bcache/bset.c
++++ b/drivers/md/bcache/bset.c
+@@ -321,7 +321,7 @@ int bch_btree_keys_alloc(struct btree_keys *b,
+
+ b->page_order = page_order;
+
+- t->data = (void *) __get_free_pages(gfp, b->page_order);
++ t->data = (void *) __get_free_pages(__GFP_COMP|gfp, b->page_order);
+ if (!t->data)
+ goto err;
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 38a8f8d2a908d..d320574b9a4c8 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -830,7 +830,7 @@ int bch_btree_cache_alloc(struct cache_set *c)
+ mutex_init(&c->verify_lock);
+
+ c->verify_ondisk = (void *)
+- __get_free_pages(GFP_KERNEL, ilog2(bucket_pages(c)));
++ __get_free_pages(GFP_KERNEL|__GFP_COMP, ilog2(bucket_pages(c)));
+
+ c->verify_data = mca_bucket_alloc(c, &ZERO_KEY, GFP_KERNEL);
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 7bb15cddca5ec..182c2b7bd9601 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -864,8 +864,8 @@ int bch_journal_alloc(struct cache_set *c)
+ j->w[1].c = c;
+
+ if (!(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) ||
+- !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)) ||
+- !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)))
++ !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS)) ||
++ !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS)))
+ return -ENOMEM;
+
+ return 0;
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 46ad0bf18e1fd..825bfde10c694 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1693,7 +1693,7 @@ void bch_cache_set_unregister(struct cache_set *c)
+ }
+
+ #define alloc_bucket_pages(gfp, c) \
+- ((void *) __get_free_pages(__GFP_ZERO|gfp, ilog2(bucket_pages(c))))
++ ((void *) __get_free_pages(__GFP_ZERO|__GFP_COMP|gfp, ilog2(bucket_pages(c))))
+
+ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
+ {
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index b5fc3c6c7178e..aa58833fb012f 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -506,15 +506,19 @@ void bcache_dev_sectors_dirty_add(struct cache_set *c, unsigned int inode,
+ uint64_t offset, int nr_sectors)
+ {
+ struct bcache_device *d = c->devices[inode];
+- unsigned int stripe_offset, stripe, sectors_dirty;
++ unsigned int stripe_offset, sectors_dirty;
++ int stripe;
+
+ if (!d)
+ return;
+
++ stripe = offset_to_stripe(d, offset);
++ if (stripe < 0)
++ return;
++
+ if (UUID_FLASH_ONLY(&c->uuids[inode]))
+ atomic_long_add(nr_sectors, &c->flash_dev_dirty_sectors);
+
+- stripe = offset_to_stripe(d, offset);
+ stripe_offset = offset & (d->stripe_size - 1);
+
+ while (nr_sectors) {
+@@ -554,12 +558,12 @@ static bool dirty_pred(struct keybuf *buf, struct bkey *k)
+ static void refill_full_stripes(struct cached_dev *dc)
+ {
+ struct keybuf *buf = &dc->writeback_keys;
+- unsigned int start_stripe, stripe, next_stripe;
++ unsigned int start_stripe, next_stripe;
++ int stripe;
+ bool wrapped = false;
+
+ stripe = offset_to_stripe(&dc->disk, KEY_OFFSET(&buf->last_scanned));
+-
+- if (stripe >= dc->disk.nr_stripes)
++ if (stripe < 0)
+ stripe = 0;
+
+ start_stripe = stripe;
+diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h
+index e75dc33339f6f..b902e574c5c40 100644
+--- a/drivers/md/bcache/writeback.h
++++ b/drivers/md/bcache/writeback.h
+@@ -28,10 +28,22 @@ static inline uint64_t bcache_dev_sectors_dirty(struct bcache_device *d)
+ return ret;
+ }
+
+-static inline unsigned int offset_to_stripe(struct bcache_device *d,
++static inline int offset_to_stripe(struct bcache_device *d,
+ uint64_t offset)
+ {
+ do_div(offset, d->stripe_size);
++
++ /* d->nr_stripes is in range [1, INT_MAX] */
++ if (unlikely(offset >= d->nr_stripes)) {
++ pr_err("Invalid stripe %llu (>= nr_stripes %d).\n",
++ offset, d->nr_stripes);
++ return -EINVAL;
++ }
++
++ /*
++ * Here offset is definitly smaller than INT_MAX,
++ * return it as int will never overflow.
++ */
+ return offset;
+ }
+
+@@ -39,7 +51,10 @@ static inline bool bcache_dev_stripe_dirty(struct cached_dev *dc,
+ uint64_t offset,
+ unsigned int nr_sectors)
+ {
+- unsigned int stripe = offset_to_stripe(&dc->disk, offset);
++ int stripe = offset_to_stripe(&dc->disk, offset);
++
++ if (stripe < 0)
++ return false;
+
+ while (1) {
+ if (atomic_read(dc->disk.stripe_sectors_dirty + stripe))
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 4d36373e1c0f0..9fde174ce3961 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -95,9 +95,6 @@ static void dm_old_stop_queue(struct request_queue *q)
+
+ static void dm_mq_stop_queue(struct request_queue *q)
+ {
+- if (blk_mq_queue_stopped(q))
+- return;
+-
+ blk_mq_quiesce_queue(q);
+ }
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 01021382131bc..d91154d654550 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3596,6 +3596,7 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s,
+ * is missing/faulty, then we need to read everything we can.
+ */
+ if (sh->raid_conf->level != 6 &&
++ sh->raid_conf->rmw_level != PARITY_DISABLE_RMW &&
+ sh->sector < sh->raid_conf->mddev->recovery_cp)
+ /* reconstruct-write isn't being forced */
+ return 0;
+@@ -4832,7 +4833,7 @@ static void handle_stripe(struct stripe_head *sh)
+ * or to load a block that is being partially written.
+ */
+ if (s.to_read || s.non_overwrite
+- || (conf->level == 6 && s.to_write && s.failed)
++ || (s.to_write && s.failed)
+ || (s.syncing && (s.uptodate + s.compute < disks))
+ || s.replacing
+ || s.expanding)
+diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c
+index 96d1b1b3fe8e8..681de42f12e9a 100644
+--- a/drivers/media/platform/rockchip/rga/rga-hw.c
++++ b/drivers/media/platform/rockchip/rga/rga-hw.c
+@@ -208,22 +208,25 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx)
+ dst_info.data.format = ctx->out.fmt->hw_format;
+ dst_info.data.swap = ctx->out.fmt->color_swap;
+
+- if (ctx->in.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) {
+- if (ctx->out.fmt->hw_format < RGA_COLOR_FMT_YUV422SP) {
+- switch (ctx->in.colorspace) {
+- case V4L2_COLORSPACE_REC709:
+- src_info.data.csc_mode =
+- RGA_SRC_CSC_MODE_BT709_R0;
+- break;
+- default:
+- src_info.data.csc_mode =
+- RGA_SRC_CSC_MODE_BT601_R0;
+- break;
+- }
++ /*
++ * CSC mode must only be set when the colorspace families differ between
++ * input and output. It must remain unset (zeroed) if both are the same.
++ */
++
++ if (RGA_COLOR_FMT_IS_YUV(ctx->in.fmt->hw_format) &&
++ RGA_COLOR_FMT_IS_RGB(ctx->out.fmt->hw_format)) {
++ switch (ctx->in.colorspace) {
++ case V4L2_COLORSPACE_REC709:
++ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0;
++ break;
++ default:
++ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT601_R0;
++ break;
+ }
+ }
+
+- if (ctx->out.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) {
++ if (RGA_COLOR_FMT_IS_RGB(ctx->in.fmt->hw_format) &&
++ RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) {
+ switch (ctx->out.colorspace) {
+ case V4L2_COLORSPACE_REC709:
+ dst_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0;
+diff --git a/drivers/media/platform/rockchip/rga/rga-hw.h b/drivers/media/platform/rockchip/rga/rga-hw.h
+index ca3c204abe420..3e4b70eb9ced5 100644
+--- a/drivers/media/platform/rockchip/rga/rga-hw.h
++++ b/drivers/media/platform/rockchip/rga/rga-hw.h
+@@ -103,6 +103,11 @@
+ #define RGA_COLOR_FMT_CP_8BPP 15
+ #define RGA_COLOR_FMT_MASK 15
+
++#define RGA_COLOR_FMT_IS_YUV(fmt) \
++ (((fmt) >= RGA_COLOR_FMT_YUV422SP) && ((fmt) < RGA_COLOR_FMT_CP_1BPP))
++#define RGA_COLOR_FMT_IS_RGB(fmt) \
++ ((fmt) < RGA_COLOR_FMT_YUV422SP)
++
+ #define RGA_COLOR_NONE_SWAP 0
+ #define RGA_COLOR_RB_SWAP 1
+ #define RGA_COLOR_ALPHA_SWAP 2
+diff --git a/drivers/media/platform/vsp1/vsp1_dl.c b/drivers/media/platform/vsp1/vsp1_dl.c
+index a5634ca85a316..a07caf981e15a 100644
+--- a/drivers/media/platform/vsp1/vsp1_dl.c
++++ b/drivers/media/platform/vsp1/vsp1_dl.c
+@@ -431,6 +431,8 @@ vsp1_dl_cmd_pool_create(struct vsp1_device *vsp1, enum vsp1_extcmd_type type,
+ if (!pool)
+ return NULL;
+
++ pool->vsp1 = vsp1;
++
+ spin_lock_init(&pool->lock);
+ INIT_LIST_HEAD(&pool->free);
+
+diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
+index a4403a57ddc89..09acaa2cf74a2 100644
+--- a/drivers/mfd/arizona-core.c
++++ b/drivers/mfd/arizona-core.c
+@@ -1433,6 +1433,15 @@ err_irq:
+ arizona_irq_exit(arizona);
+ err_pm:
+ pm_runtime_disable(arizona->dev);
++
++ switch (arizona->pdata.clk32k_src) {
++ case ARIZONA_32KZ_MCLK1:
++ case ARIZONA_32KZ_MCLK2:
++ arizona_clk32k_disable(arizona);
++ break;
++ default:
++ break;
++ }
+ err_reset:
+ arizona_enable_reset(arizona);
+ regulator_disable(arizona->dcvdd);
+@@ -1455,6 +1464,15 @@ int arizona_dev_exit(struct arizona *arizona)
+ regulator_disable(arizona->dcvdd);
+ regulator_put(arizona->dcvdd);
+
++ switch (arizona->pdata.clk32k_src) {
++ case ARIZONA_32KZ_MCLK1:
++ case ARIZONA_32KZ_MCLK2:
++ arizona_clk32k_disable(arizona);
++ break;
++ default:
++ break;
++ }
++
+ mfd_remove_devices(arizona->dev);
+ arizona_free_irq(arizona, ARIZONA_IRQ_UNDERCLOCKED, arizona);
+ arizona_free_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, arizona);
+diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
+index 6ea0dd37b4535..fe614ba5fec90 100644
+--- a/drivers/mfd/dln2.c
++++ b/drivers/mfd/dln2.c
+@@ -290,7 +290,11 @@ static void dln2_rx(struct urb *urb)
+ len = urb->actual_length - sizeof(struct dln2_header);
+
+ if (handle == DLN2_HANDLE_EVENT) {
++ unsigned long flags;
++
++ spin_lock_irqsave(&dln2->event_cb_lock, flags);
+ dln2_run_event_callbacks(dln2, id, echo, data, len);
++ spin_unlock_irqrestore(&dln2->event_cb_lock, flags);
+ } else {
+ /* URB will be re-submitted in _dln2_transfer (free_rx_slot) */
+ if (dln2_transfer_complete(dln2, urb, handle, echo))
+diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+index 382172fb3da8f..74eea8247490d 100644
+--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+@@ -222,15 +222,12 @@ static void renesas_sdhi_internal_dmac_issue_tasklet_fn(unsigned long arg)
+ DTRAN_CTRL_DM_START);
+ }
+
+-static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
++static bool renesas_sdhi_internal_dmac_complete(struct tmio_mmc_host *host)
+ {
+- struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg;
+ enum dma_data_direction dir;
+
+- spin_lock_irq(&host->lock);
+-
+ if (!host->data)
+- goto out;
++ return false;
+
+ if (host->data->flags & MMC_DATA_READ)
+ dir = DMA_FROM_DEVICE;
+@@ -243,6 +240,17 @@ static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
+ if (dir == DMA_FROM_DEVICE)
+ clear_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags);
+
++ return true;
++}
++
++static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
++{
++ struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg;
++
++ spin_lock_irq(&host->lock);
++ if (!renesas_sdhi_internal_dmac_complete(host))
++ goto out;
++
+ tmio_mmc_do_data_irq(host);
+ out:
+ spin_unlock_irq(&host->lock);
+diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
+index 2a0cbc535a2ed..19673ed929e68 100644
+--- a/drivers/net/ethernet/qualcomm/emac/emac.c
++++ b/drivers/net/ethernet/qualcomm/emac/emac.c
+@@ -493,13 +493,24 @@ static int emac_clks_phase1_init(struct platform_device *pdev,
+
+ ret = clk_prepare_enable(adpt->clk[EMAC_CLK_CFG_AHB]);
+ if (ret)
+- return ret;
++ goto disable_clk_axi;
+
+ ret = clk_set_rate(adpt->clk[EMAC_CLK_HIGH_SPEED], 19200000);
+ if (ret)
+- return ret;
++ goto disable_clk_cfg_ahb;
++
++ ret = clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]);
++ if (ret)
++ goto disable_clk_cfg_ahb;
+
+- return clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]);
++ return 0;
++
++disable_clk_cfg_ahb:
++ clk_disable_unprepare(adpt->clk[EMAC_CLK_CFG_AHB]);
++disable_clk_axi:
++ clk_disable_unprepare(adpt->clk[EMAC_CLK_AXI]);
++
++ return ret;
+ }
+
+ /* Enable clocks; needs emac_clks_phase1_init to be called before */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+index 4d75158c64b29..826626e870d5c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -350,6 +350,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
+ plat_dat->has_gmac = true;
+ plat_dat->bsp_priv = gmac;
+ plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed;
++ plat_dat->multicast_filter_bins = 0;
+
+ err = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+ if (err)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+index e4e9a7591efe9..4d617ba11ecb5 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+@@ -176,6 +176,9 @@ static void dwmac1000_set_filter(struct mac_device_info *hw,
+ value = GMAC_FRAME_FILTER_PR;
+ } else if (dev->flags & IFF_ALLMULTI) {
+ value = GMAC_FRAME_FILTER_PM; /* pass all multi */
++ } else if (!netdev_mc_empty(dev) && (mcbitslog2 == 0)) {
++ /* Fall back to all multicast if we've no filter */
++ value = GMAC_FRAME_FILTER_PM;
+ } else if (!netdev_mc_empty(dev)) {
+ struct netdev_hw_addr *ha;
+
+diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
+index 5cb40b2518f93..87a2829dffd44 100644
+--- a/drivers/pci/bus.c
++++ b/drivers/pci/bus.c
+@@ -323,12 +323,8 @@ void pci_bus_add_device(struct pci_dev *dev)
+
+ dev->match_driver = true;
+ retval = device_attach(&dev->dev);
+- if (retval < 0 && retval != -EPROBE_DEFER) {
++ if (retval < 0 && retval != -EPROBE_DEFER)
+ pci_warn(dev, "device attach failed (%d)\n", retval);
+- pci_proc_detach_device(dev);
+- pci_remove_sysfs_dev_files(dev);
+- return;
+- }
+
+ pci_dev_assign_added(dev, true);
+ }
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index e292801fff7fd..1bdac298a943f 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -45,7 +45,13 @@
+ #define PCIE_CAP_CPL_TIMEOUT_DISABLE 0x10
+
+ #define PCIE20_PARF_PHY_CTRL 0x40
++#define PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK GENMASK(20, 16)
++#define PHY_CTRL_PHY_TX0_TERM_OFFSET(x) ((x) << 16)
++
+ #define PCIE20_PARF_PHY_REFCLK 0x4C
++#define PHY_REFCLK_SSP_EN BIT(16)
++#define PHY_REFCLK_USE_PAD BIT(12)
++
+ #define PCIE20_PARF_DBI_BASE_ADDR 0x168
+ #define PCIE20_PARF_SLV_ADDR_SPACE_SIZE 0x16C
+ #define PCIE20_PARF_MHI_CLOCK_RESET_CTRL 0x174
+@@ -76,6 +82,18 @@
+ #define DBI_RO_WR_EN 1
+
+ #define PERST_DELAY_US 1000
++/* PARF registers */
++#define PCIE20_PARF_PCS_DEEMPH 0x34
++#define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16)
++#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8)
++#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0)
++
++#define PCIE20_PARF_PCS_SWING 0x38
++#define PCS_SWING_TX_SWING_FULL(x) ((x) << 8)
++#define PCS_SWING_TX_SWING_LOW(x) ((x) << 0)
++
++#define PCIE20_PARF_CONFIG_BITS 0x50
++#define PHY_RX0_EQ(x) ((x) << 24)
+
+ #define PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE 0x358
+ #define SLV_ADDR_SPACE_SZ 0x10000000
+@@ -275,6 +293,7 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie)
+ struct qcom_pcie_resources_2_1_0 *res = &pcie->res.v2_1_0;
+ struct dw_pcie *pci = pcie->pci;
+ struct device *dev = pci->dev;
++ struct device_node *node = dev->of_node;
+ u32 val;
+ int ret;
+
+@@ -319,9 +338,29 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie)
+ val &= ~BIT(0);
+ writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
+
++ if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) {
++ writel(PCS_DEEMPH_TX_DEEMPH_GEN1(24) |
++ PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(24) |
++ PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(34),
++ pcie->parf + PCIE20_PARF_PCS_DEEMPH);
++ writel(PCS_SWING_TX_SWING_FULL(120) |
++ PCS_SWING_TX_SWING_LOW(120),
++ pcie->parf + PCIE20_PARF_PCS_SWING);
++ writel(PHY_RX0_EQ(4), pcie->parf + PCIE20_PARF_CONFIG_BITS);
++ }
++
++ if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) {
++ /* set TX termination offset */
++ val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
++ val &= ~PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK;
++ val |= PHY_CTRL_PHY_TX0_TERM_OFFSET(7);
++ writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
++ }
++
+ /* enable external reference clock */
+ val = readl(pcie->parf + PCIE20_PARF_PHY_REFCLK);
+- val |= BIT(16);
++ val &= ~PHY_REFCLK_USE_PAD;
++ val |= PHY_REFCLK_SSP_EN;
+ writel(val, pcie->parf + PCIE20_PARF_PHY_REFCLK);
+
+ ret = reset_control_deassert(res->phy_reset);
+diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
+index c94c135254479..be35bbfa69687 100644
+--- a/drivers/pci/hotplug/acpiphp_glue.c
++++ b/drivers/pci/hotplug/acpiphp_glue.c
+@@ -122,13 +122,21 @@ static struct acpiphp_context *acpiphp_grab_context(struct acpi_device *adev)
+ struct acpiphp_context *context;
+
+ acpi_lock_hp_context();
++
+ context = acpiphp_get_context(adev);
+- if (!context || context->func.parent->is_going_away) {
+- acpi_unlock_hp_context();
+- return NULL;
++ if (!context)
++ goto unlock;
++
++ if (context->func.parent->is_going_away) {
++ acpiphp_put_context(context);
++ context = NULL;
++ goto unlock;
+ }
++
+ get_bridge(context->func.parent);
+ acpiphp_put_context(context);
++
++unlock:
+ acpi_unlock_hp_context();
+ return context;
+ }
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index cbc0d8da7483c..9a5b6a8e2502f 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -348,6 +348,57 @@ static void pci_read_bases(struct pci_dev *dev, unsigned int howmany, int rom)
+ }
+ }
+
++static void pci_read_bridge_windows(struct pci_dev *bridge)
++{
++ u16 io;
++ u32 pmem, tmp;
++
++ pci_read_config_word(bridge, PCI_IO_BASE, &io);
++ if (!io) {
++ pci_write_config_word(bridge, PCI_IO_BASE, 0xe0f0);
++ pci_read_config_word(bridge, PCI_IO_BASE, &io);
++ pci_write_config_word(bridge, PCI_IO_BASE, 0x0);
++ }
++ if (io)
++ bridge->io_window = 1;
++
++ /*
++ * DECchip 21050 pass 2 errata: the bridge may miss an address
++ * disconnect boundary by one PCI data phase. Workaround: do not
++ * use prefetching on this device.
++ */
++ if (bridge->vendor == PCI_VENDOR_ID_DEC && bridge->device == 0x0001)
++ return;
++
++ pci_read_config_dword(bridge, PCI_PREF_MEMORY_BASE, &pmem);
++ if (!pmem) {
++ pci_write_config_dword(bridge, PCI_PREF_MEMORY_BASE,
++ 0xffe0fff0);
++ pci_read_config_dword(bridge, PCI_PREF_MEMORY_BASE, &pmem);
++ pci_write_config_dword(bridge, PCI_PREF_MEMORY_BASE, 0x0);
++ }
++ if (!pmem)
++ return;
++
++ bridge->pref_window = 1;
++
++ if ((pmem & PCI_PREF_RANGE_TYPE_MASK) == PCI_PREF_RANGE_TYPE_64) {
++
++ /*
++ * Bridge claims to have a 64-bit prefetchable memory
++ * window; verify that the upper bits are actually
++ * writable.
++ */
++ pci_read_config_dword(bridge, PCI_PREF_BASE_UPPER32, &pmem);
++ pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32,
++ 0xffffffff);
++ pci_read_config_dword(bridge, PCI_PREF_BASE_UPPER32, &tmp);
++ pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32, pmem);
++ if (tmp)
++ bridge->pref_64_window = 1;
++ }
++}
++
+ static void pci_read_bridge_io(struct pci_bus *child)
+ {
+ struct pci_dev *dev = child->self;
+@@ -1712,6 +1763,7 @@ int pci_setup_device(struct pci_dev *dev)
+ pci_read_irq(dev);
+ dev->transparent = ((dev->class & 0xff) == 1);
+ pci_read_bases(dev, 2, PCI_ROM_ADDRESS1);
++ pci_read_bridge_windows(dev);
+ set_pcie_hotplug_bridge(dev);
+ pos = pci_find_capability(dev, PCI_CAP_ID_SSVID);
+ if (pos) {
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 9129ccd593d10..af2149632102a 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5068,7 +5068,8 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0422, quirk_no_ext_tags);
+ */
+ static void quirk_amd_harvest_no_ats(struct pci_dev *pdev)
+ {
+- if (pdev->device == 0x7340 && pdev->revision != 0xc5)
++ if ((pdev->device == 0x7312 && pdev->revision != 0x00) ||
++ (pdev->device == 0x7340 && pdev->revision != 0xc5))
+ return;
+
+ pci_info(pdev, "disabling ATS\n");
+@@ -5079,6 +5080,8 @@ static void quirk_amd_harvest_no_ats(struct pci_dev *pdev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_amd_harvest_no_ats);
+ /* AMD Iceland dGPU */
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_amd_harvest_no_ats);
++/* AMD Navi10 dGPU */
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7312, quirk_amd_harvest_no_ats);
+ /* AMD Navi14 dGPU */
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7340, quirk_amd_harvest_no_ats);
+ #endif /* CONFIG_PCI_ATS */
+diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
+index 8e5b00a420a55..87c8190de622f 100644
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -735,58 +735,21 @@ int pci_claim_bridge_resource(struct pci_dev *bridge, int i)
+ base/limit registers must be read-only and read as 0. */
+ static void pci_bridge_check_ranges(struct pci_bus *bus)
+ {
+- u16 io;
+- u32 pmem;
+ struct pci_dev *bridge = bus->self;
+- struct resource *b_res;
++ struct resource *b_res = &bridge->resource[PCI_BRIDGE_RESOURCES];
+
+- b_res = &bridge->resource[PCI_BRIDGE_RESOURCES];
+ b_res[1].flags |= IORESOURCE_MEM;
+
+- pci_read_config_word(bridge, PCI_IO_BASE, &io);
+- if (!io) {
+- pci_write_config_word(bridge, PCI_IO_BASE, 0xe0f0);
+- pci_read_config_word(bridge, PCI_IO_BASE, &io);
+- pci_write_config_word(bridge, PCI_IO_BASE, 0x0);
+- }
+- if (io)
++ if (bridge->io_window)
+ b_res[0].flags |= IORESOURCE_IO;
+
+- /* DECchip 21050 pass 2 errata: the bridge may miss an address
+- disconnect boundary by one PCI data phase.
+- Workaround: do not use prefetching on this device. */
+- if (bridge->vendor == PCI_VENDOR_ID_DEC && bridge->device == 0x0001)
+- return;
+-
+- pci_read_config_dword(bridge, PCI_PREF_MEMORY_BASE, &pmem);
+- if (!pmem) {
+- pci_write_config_dword(bridge, PCI_PREF_MEMORY_BASE,
+- 0xffe0fff0);
+- pci_read_config_dword(bridge, PCI_PREF_MEMORY_BASE, &pmem);
+- pci_write_config_dword(bridge, PCI_PREF_MEMORY_BASE, 0x0);
+- }
+- if (pmem) {
++ if (bridge->pref_window) {
+ b_res[2].flags |= IORESOURCE_MEM | IORESOURCE_PREFETCH;
+- if ((pmem & PCI_PREF_RANGE_TYPE_MASK) ==
+- PCI_PREF_RANGE_TYPE_64) {
++ if (bridge->pref_64_window) {
+ b_res[2].flags |= IORESOURCE_MEM_64;
+ b_res[2].flags |= PCI_PREF_RANGE_TYPE_64;
+ }
+ }
+-
+- /* double check if bridge does support 64 bit pref */
+- if (b_res[2].flags & IORESOURCE_MEM_64) {
+- u32 mem_base_hi, tmp;
+- pci_read_config_dword(bridge, PCI_PREF_BASE_UPPER32,
+- &mem_base_hi);
+- pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32,
+- 0xffffffff);
+- pci_read_config_dword(bridge, PCI_PREF_BASE_UPPER32, &tmp);
+- if (!tmp)
+- b_res[2].flags &= ~IORESOURCE_MEM_64;
+- pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32,
+- mem_base_hi);
+- }
+ }
+
+ /* Helper function for sizing routines: find first available
+diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
+index 31b01035d0ab3..8cfba3614e601 100644
+--- a/drivers/pwm/pwm-bcm-iproc.c
++++ b/drivers/pwm/pwm-bcm-iproc.c
+@@ -85,8 +85,6 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
+ u64 tmp, multi, rate;
+ u32 value, prescale;
+
+- rate = clk_get_rate(ip->clk);
+-
+ value = readl(ip->base + IPROC_PWM_CTRL_OFFSET);
+
+ if (value & BIT(IPROC_PWM_CTRL_EN_SHIFT(pwm->hwpwm)))
+@@ -99,6 +97,13 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
+ else
+ state->polarity = PWM_POLARITY_INVERSED;
+
++ rate = clk_get_rate(ip->clk);
++ if (rate == 0) {
++ state->period = 0;
++ state->duty_cycle = 0;
++ return;
++ }
++
+ value = readl(ip->base + IPROC_PWM_PRESCALE_OFFSET);
+ prescale = value >> IPROC_PWM_PRESCALE_SHIFT(pwm->hwpwm);
+ prescale &= IPROC_PWM_PRESCALE_MAX;
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 0d33e3079f0dc..ef61cb709acd4 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -151,6 +151,8 @@ int qcom_q6v5_request_stop(struct qcom_q6v5 *q6v5)
+ {
+ int ret;
+
++ q6v5->running = false;
++
+ qcom_smem_state_update_bits(q6v5->state,
+ BIT(q6v5->stop_bit), BIT(q6v5->stop_bit));
+
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index 768eba8c111d9..5bc33817568ea 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -1712,7 +1712,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
+ }
+ tgtp->tport_unreg_cmp = &tport_unreg_cmp;
+ nvmet_fc_unregister_targetport(phba->targetport);
+- if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp,
++ if (!wait_for_completion_timeout(&tport_unreg_cmp,
+ msecs_to_jiffies(LPFC_NVMET_WAIT_TMO)))
+ lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+ "6179 Unreg targetport %p timeout "
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 3c0f38cd3a5a4..ce9cc1f90b052 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2037,12 +2037,11 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port,
+ #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE)
+
+ static int ftdi_process_packet(struct usb_serial_port *port,
+- struct ftdi_private *priv, char *packet, int len)
++ struct ftdi_private *priv, unsigned char *buf, int len)
+ {
++ unsigned char status;
+ int i;
+- char status;
+ char flag;
+- char *ch;
+
+ if (len < 2) {
+ dev_dbg(&port->dev, "malformed packet\n");
+@@ -2052,7 +2051,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ /* Compare new line status to the old one, signal if different/
+ N.B. packet may be processed more than once, but differences
+ are only processed once. */
+- status = packet[0] & FTDI_STATUS_B0_MASK;
++ status = buf[0] & FTDI_STATUS_B0_MASK;
+ if (status != priv->prev_status) {
+ char diff_status = status ^ priv->prev_status;
+
+@@ -2078,13 +2077,12 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ }
+
+ /* save if the transmitter is empty or not */
+- if (packet[1] & FTDI_RS_TEMT)
++ if (buf[1] & FTDI_RS_TEMT)
+ priv->transmit_empty = 1;
+ else
+ priv->transmit_empty = 0;
+
+- len -= 2;
+- if (!len)
++ if (len == 2)
+ return 0; /* status only */
+
+ /*
+@@ -2092,40 +2090,41 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ * data payload to avoid over-reporting.
+ */
+ flag = TTY_NORMAL;
+- if (packet[1] & FTDI_RS_ERR_MASK) {
++ if (buf[1] & FTDI_RS_ERR_MASK) {
+ /* Break takes precedence over parity, which takes precedence
+ * over framing errors */
+- if (packet[1] & FTDI_RS_BI) {
++ if (buf[1] & FTDI_RS_BI) {
+ flag = TTY_BREAK;
+ port->icount.brk++;
+ usb_serial_handle_break(port);
+- } else if (packet[1] & FTDI_RS_PE) {
++ } else if (buf[1] & FTDI_RS_PE) {
+ flag = TTY_PARITY;
+ port->icount.parity++;
+- } else if (packet[1] & FTDI_RS_FE) {
++ } else if (buf[1] & FTDI_RS_FE) {
+ flag = TTY_FRAME;
+ port->icount.frame++;
+ }
+ /* Overrun is special, not associated with a char */
+- if (packet[1] & FTDI_RS_OE) {
++ if (buf[1] & FTDI_RS_OE) {
+ port->icount.overrun++;
+ tty_insert_flip_char(&port->port, 0, TTY_OVERRUN);
+ }
+ }
+
+- port->icount.rx += len;
+- ch = packet + 2;
++ port->icount.rx += len - 2;
+
+ if (port->port.console && port->sysrq) {
+- for (i = 0; i < len; i++, ch++) {
+- if (!usb_serial_handle_sysrq_char(port, *ch))
+- tty_insert_flip_char(&port->port, *ch, flag);
++ for (i = 2; i < len; i++) {
++ if (usb_serial_handle_sysrq_char(port, buf[i]))
++ continue;
++ tty_insert_flip_char(&port->port, buf[i], flag);
+ }
+ } else {
+- tty_insert_flip_string_fixed_flag(&port->port, ch, flag, len);
++ tty_insert_flip_string_fixed_flag(&port->port, buf + 2, flag,
++ len - 2);
+ }
+
+- return len;
++ return len - 2;
+ }
+
+ static void ftdi_process_read_urb(struct urb *urb)
+diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
+index 9a1c761258ce4..5d0ea419070dc 100644
+--- a/drivers/watchdog/f71808e_wdt.c
++++ b/drivers/watchdog/f71808e_wdt.c
+@@ -688,9 +688,9 @@ static int __init watchdog_init(int sioaddr)
+ * into the module have been registered yet.
+ */
+ watchdog.sioaddr = sioaddr;
+- watchdog.ident.options = WDIOC_SETTIMEOUT
+- | WDIOF_MAGICCLOSE
+- | WDIOF_KEEPALIVEPING;
++ watchdog.ident.options = WDIOF_MAGICCLOSE
++ | WDIOF_KEEPALIVEPING
++ | WDIOF_CARDRESET;
+
+ snprintf(watchdog.ident.identity,
+ sizeof(watchdog.ident.identity), "%s watchdog",
+@@ -704,6 +704,13 @@ static int __init watchdog_init(int sioaddr)
+ wdt_conf = superio_inb(sioaddr, F71808FG_REG_WDT_CONF);
+ watchdog.caused_reboot = wdt_conf & BIT(F71808FG_FLAG_WDTMOUT_STS);
+
++ /*
++ * We don't want WDTMOUT_STS to stick around till regular reboot.
++ * Write 1 to the bit to clear it to zero.
++ */
++ superio_outb(sioaddr, F71808FG_REG_WDT_CONF,
++ wdt_conf | BIT(F71808FG_FLAG_WDTMOUT_STS));
++
+ superio_exit(sioaddr);
+
+ err = watchdog_set_timeout(timeout);
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index 10b2090f3e5e7..1c322caecf7f1 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -947,6 +947,15 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ if (IS_ERR_OR_NULL(watchdog_kworker))
+ return -ENODEV;
+
++ device_initialize(&wd_data->dev);
++ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
++ wd_data->dev.class = &watchdog_class;
++ wd_data->dev.parent = wdd->parent;
++ wd_data->dev.groups = wdd->groups;
++ wd_data->dev.release = watchdog_core_data_release;
++ dev_set_drvdata(&wd_data->dev, wdd);
++ dev_set_name(&wd_data->dev, "watchdog%d", wdd->id);
++
+ kthread_init_work(&wd_data->work, watchdog_ping_work);
+ hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ wd_data->timer.function = watchdog_timer_expired;
+@@ -967,15 +976,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ }
+ }
+
+- device_initialize(&wd_data->dev);
+- wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
+- wd_data->dev.class = &watchdog_class;
+- wd_data->dev.parent = wdd->parent;
+- wd_data->dev.groups = wdd->groups;
+- wd_data->dev.release = watchdog_core_data_release;
+- dev_set_drvdata(&wd_data->dev, wdd);
+- dev_set_name(&wd_data->dev, "watchdog%d", wdd->id);
+-
+ /* Fill in the data structures */
+ cdev_init(&wd_data->cdev, &watchdog_fops);
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 9740f7b5d4fb4..3130844e219cf 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1500,9 +1500,16 @@ int btrfs_init_fs_root(struct btrfs_root *root)
+ spin_lock_init(&root->ino_cache_lock);
+ init_waitqueue_head(&root->ino_cache_wait);
+
+- ret = get_anon_bdev(&root->anon_dev);
+- if (ret)
+- goto fail;
++ /*
++ * Don't assign anonymous block device to roots that are not exposed to
++ * userspace, the id pool is limited to 1M
++ */
++ if (is_fstree(root->root_key.objectid) &&
++ btrfs_root_refs(&root->root_item) > 0) {
++ ret = get_anon_bdev(&root->anon_dev);
++ if (ret)
++ goto fail;
++ }
+
+ mutex_lock(&root->objectid_mutex);
+ ret = btrfs_find_highest_objectid(root,
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index c9965e89097fd..4c65305fd4180 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -2169,7 +2169,7 @@ out:
+ static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl,
+ struct btrfs_free_space *info, bool update_stat)
+ {
+- struct btrfs_free_space *left_info;
++ struct btrfs_free_space *left_info = NULL;
+ struct btrfs_free_space *right_info;
+ bool merged = false;
+ u64 offset = info->offset;
+@@ -2184,7 +2184,7 @@ static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl,
+ if (right_info && rb_prev(&right_info->offset_index))
+ left_info = rb_entry(rb_prev(&right_info->offset_index),
+ struct btrfs_free_space, offset_index);
+- else
++ else if (!right_info)
+ left_info = tree_search_offset(ctl, offset - 1, 0, 0);
+
+ if (right_info && !right_info->bitmap) {
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 7befb7c12bd32..1656ef0e959f0 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -4458,6 +4458,8 @@ int btrfs_delete_subvolume(struct inode *dir, struct dentry *dentry)
+ }
+ }
+
++ free_anon_bdev(dest->anon_dev);
++ dest->anon_dev = 0;
+ out_end_trans:
+ trans->block_rsv = NULL;
+ trans->bytes_reserved = 0;
+@@ -7012,7 +7014,7 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode,
+ found_type == BTRFS_FILE_EXTENT_PREALLOC) {
+ /* Only regular file could have regular/prealloc extent */
+ if (!S_ISREG(inode->vfs_inode.i_mode)) {
+- ret = -EUCLEAN;
++ err = -EUCLEAN;
+ btrfs_crit(fs_info,
+ "regular/prealloc extent found for non-regular inode %llu",
+ btrfs_ino(inode));
+diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
+index dbc685ca017f2..5dec52bd2897b 100644
+--- a/fs/btrfs/ref-verify.c
++++ b/fs/btrfs/ref-verify.c
+@@ -297,6 +297,8 @@ static struct block_entry *add_block_entry(struct btrfs_fs_info *fs_info,
+ exist_re = insert_root_entry(&exist->roots, re);
+ if (exist_re)
+ kfree(re);
++ } else {
++ kfree(re);
+ }
+ kfree(be);
+ return exist;
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 6a5b16a119eda..ed539496089f1 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -432,6 +432,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
+ char *compress_type;
+ bool compress_force = false;
+ enum btrfs_compression_type saved_compress_type;
++ int saved_compress_level;
+ bool saved_compress_force;
+ int no_compress = 0;
+
+@@ -514,6 +515,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
+ info->compress_type : BTRFS_COMPRESS_NONE;
+ saved_compress_force =
+ btrfs_test_opt(info, FORCE_COMPRESS);
++ saved_compress_level = info->compress_level;
+ if (token == Opt_compress ||
+ token == Opt_compress_force ||
+ strncmp(args[0].from, "zlib", 4) == 0) {
+@@ -552,6 +554,8 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
+ no_compress = 0;
+ } else if (strncmp(args[0].from, "no", 2) == 0) {
+ compress_type = "no";
++ info->compress_level = 0;
++ info->compress_type = 0;
+ btrfs_clear_opt(info->mount_opt, COMPRESS);
+ btrfs_clear_opt(info->mount_opt, FORCE_COMPRESS);
+ compress_force = false;
+@@ -572,11 +576,11 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
+ */
+ btrfs_clear_opt(info->mount_opt, FORCE_COMPRESS);
+ }
+- if ((btrfs_test_opt(info, COMPRESS) &&
+- (info->compress_type != saved_compress_type ||
+- compress_force != saved_compress_force)) ||
+- (!btrfs_test_opt(info, COMPRESS) &&
+- no_compress == 1)) {
++ if (no_compress == 1) {
++ btrfs_info(info, "use no compression");
++ } else if ((info->compress_type != saved_compress_type) ||
++ (compress_force != saved_compress_force) ||
++ (info->compress_level != saved_compress_level)) {
+ btrfs_info(info, "%s %s compression, level %d",
+ (compress_force) ? "force" : "use",
+ compress_type, info->compress_level);
+@@ -2314,9 +2318,7 @@ static int btrfs_unfreeze(struct super_block *sb)
+ static int btrfs_show_devname(struct seq_file *m, struct dentry *root)
+ {
+ struct btrfs_fs_info *fs_info = btrfs_sb(root->d_sb);
+- struct btrfs_fs_devices *cur_devices;
+ struct btrfs_device *dev, *first_dev = NULL;
+- struct list_head *head;
+
+ /*
+ * Lightweight locking of the devices. We should not need
+@@ -2326,18 +2328,13 @@ static int btrfs_show_devname(struct seq_file *m, struct dentry *root)
+ * least until until the rcu_read_unlock.
+ */
+ rcu_read_lock();
+- cur_devices = fs_info->fs_devices;
+- while (cur_devices) {
+- head = &cur_devices->devices;
+- list_for_each_entry_rcu(dev, head, dev_list) {
+- if (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state))
+- continue;
+- if (!dev->name)
+- continue;
+- if (!first_dev || dev->devid < first_dev->devid)
+- first_dev = dev;
+- }
+- cur_devices = cur_devices->seed;
++ list_for_each_entry_rcu(dev, &fs_info->fs_devices->devices, dev_list) {
++ if (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state))
++ continue;
++ if (!dev->name)
++ continue;
++ if (!first_dev || dev->devid < first_dev->devid)
++ first_dev = dev;
+ }
+
+ if (first_dev)
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 928ac2c4899e7..090315f4ac78f 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3988,11 +3988,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ fs_info->csum_root,
+ ds + cs, ds + cs + cl - 1,
+ &ordered_sums, 0);
+- if (ret) {
+- btrfs_release_path(dst_path);
+- kfree(ins_data);
+- return ret;
+- }
++ if (ret)
++ break;
+ }
+ }
+ }
+@@ -4005,7 +4002,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
+ * we have to do this after the loop above to avoid changing the
+ * log tree while trying to change the log tree.
+ */
+- ret = 0;
+ while (!list_empty(&ordered_sums)) {
+ struct btrfs_ordered_sum *sums = list_entry(ordered_sums.next,
+ struct btrfs_ordered_sum,
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index e0ba1e9ddcdf0..4abb2a155ac5b 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -155,7 +155,9 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info,
+ *
+ * global::fs_devs - add, remove, updates to the global list
+ *
+- * does not protect: manipulation of the fs_devices::devices list!
++ * does not protect: manipulation of the fs_devices::devices list in general
++ * but in mount context it could be used to exclude list modifications by eg.
++ * scan ioctl
+ *
+ * btrfs_device::name - renames (write side), read is RCU
+ *
+@@ -168,6 +170,9 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info,
+ * may be used to exclude some operations from running concurrently without any
+ * modifications to the list (see write_all_supers)
+ *
++ * Is not required at mount and close times, because our device list is
++ * protected by the uuid_mutex at that point.
++ *
+ * balance_mutex
+ * -------------
+ * protects balance structures (status, state) and context accessed from
+@@ -656,6 +661,11 @@ static void btrfs_free_stale_devices(const char *path,
+ }
+ }
+
++/*
++ * This is only used on mount, and we are protected from competing things
++ * messing with our fs_devices by the uuid_mutex, thus we do not need the
++ * fs_devices->device_list_mutex here.
++ */
+ static int btrfs_open_one_device(struct btrfs_fs_devices *fs_devices,
+ struct btrfs_device *device, fmode_t flags,
+ void *holder)
+@@ -1153,8 +1163,14 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
+ int ret;
+
+ lockdep_assert_held(&uuid_mutex);
++ /*
++ * The device_list_mutex cannot be taken here in case opening the
++ * underlying device takes further locks like bd_mutex.
++ *
++ * We also don't need the lock here as this is called during mount and
++ * exclusion is provided by uuid_mutex
++ */
+
+- mutex_lock(&fs_devices->device_list_mutex);
+ if (fs_devices->opened) {
+ fs_devices->opened++;
+ ret = 0;
+@@ -1162,7 +1178,6 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
+ list_sort(NULL, &fs_devices->devices, devid_cmp);
+ ret = open_fs_devices(fs_devices, flags, holder);
+ }
+- mutex_unlock(&fs_devices->device_list_mutex);
+
+ return ret;
+ }
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 14265b4bbcc00..2fc96f7923ee5 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -509,15 +509,31 @@ cifs_ses_oplock_break(struct work_struct *work)
+ kfree(lw);
+ }
+
++static void
++smb2_queue_pending_open_break(struct tcon_link *tlink, __u8 *lease_key,
++ __le32 new_lease_state)
++{
++ struct smb2_lease_break_work *lw;
++
++ lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
++ if (!lw) {
++ cifs_put_tlink(tlink);
++ return;
++ }
++
++ INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
++ lw->tlink = tlink;
++ lw->lease_state = new_lease_state;
++ memcpy(lw->lease_key, lease_key, SMB2_LEASE_KEY_SIZE);
++ queue_work(cifsiod_wq, &lw->lease_break);
++}
++
+ static bool
+-smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
+- struct smb2_lease_break_work *lw)
++smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp)
+ {
+- bool found;
+ __u8 lease_state;
+ struct list_head *tmp;
+ struct cifsFileInfo *cfile;
+- struct cifs_pending_open *open;
+ struct cifsInodeInfo *cinode;
+ int ack_req = le32_to_cpu(rsp->Flags &
+ SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED);
+@@ -556,22 +572,29 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
+ &cinode->flags);
+
+ cifs_queue_oplock_break(cfile);
+- kfree(lw);
+ return true;
+ }
+
+- found = false;
++ return false;
++}
++
++static struct cifs_pending_open *
++smb2_tcon_find_pending_open_lease(struct cifs_tcon *tcon,
++ struct smb2_lease_break *rsp)
++{
++ __u8 lease_state = le32_to_cpu(rsp->NewLeaseState);
++ int ack_req = le32_to_cpu(rsp->Flags &
++ SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED);
++ struct cifs_pending_open *open;
++ struct cifs_pending_open *found = NULL;
++
+ list_for_each_entry(open, &tcon->pending_opens, olist) {
+ if (memcmp(open->lease_key, rsp->LeaseKey,
+ SMB2_LEASE_KEY_SIZE))
+ continue;
+
+ if (!found && ack_req) {
+- found = true;
+- memcpy(lw->lease_key, open->lease_key,
+- SMB2_LEASE_KEY_SIZE);
+- lw->tlink = cifs_get_tlink(open->tlink);
+- queue_work(cifsiod_wq, &lw->lease_break);
++ found = open;
+ }
+
+ cifs_dbg(FYI, "found in the pending open list\n");
+@@ -592,14 +615,7 @@ smb2_is_valid_lease_break(char *buffer)
+ struct TCP_Server_Info *server;
+ struct cifs_ses *ses;
+ struct cifs_tcon *tcon;
+- struct smb2_lease_break_work *lw;
+-
+- lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
+- if (!lw)
+- return false;
+-
+- INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
+- lw->lease_state = rsp->NewLeaseState;
++ struct cifs_pending_open *open;
+
+ cifs_dbg(FYI, "Checking for lease break\n");
+
+@@ -617,11 +633,27 @@ smb2_is_valid_lease_break(char *buffer)
+ spin_lock(&tcon->open_file_lock);
+ cifs_stats_inc(
+ &tcon->stats.cifs_stats.num_oplock_brks);
+- if (smb2_tcon_has_lease(tcon, rsp, lw)) {
++ if (smb2_tcon_has_lease(tcon, rsp)) {
+ spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+ return true;
+ }
++ open = smb2_tcon_find_pending_open_lease(tcon,
++ rsp);
++ if (open) {
++ __u8 lease_key[SMB2_LEASE_KEY_SIZE];
++ struct tcon_link *tlink;
++
++ tlink = cifs_get_tlink(open->tlink);
++ memcpy(lease_key, open->lease_key,
++ SMB2_LEASE_KEY_SIZE);
++ spin_unlock(&tcon->open_file_lock);
++ spin_unlock(&cifs_tcp_ses_lock);
++ smb2_queue_pending_open_break(tlink,
++ lease_key,
++ rsp->NewLeaseState);
++ return true;
++ }
+ spin_unlock(&tcon->open_file_lock);
+
+ if (tcon->crfid.is_valid &&
+@@ -639,7 +671,6 @@ smb2_is_valid_lease_break(char *buffer)
+ }
+ }
+ spin_unlock(&cifs_tcp_ses_lock);
+- kfree(lw);
+ cifs_dbg(FYI, "Can not process lease break - no lease matched\n");
+ return false;
+ }
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index e2d2b749c8f38..379ac8caa29a6 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -1132,6 +1132,8 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
+ spnego_key = cifs_get_spnego_key(ses);
+ if (IS_ERR(spnego_key)) {
+ rc = PTR_ERR(spnego_key);
++ if (rc == -ENOKEY)
++ cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n");
+ spnego_key = NULL;
+ goto out;
+ }
+diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
+index 5c3d7b7e49755..d8a03b1afbc33 100644
+--- a/fs/ext2/ialloc.c
++++ b/fs/ext2/ialloc.c
+@@ -80,6 +80,7 @@ static void ext2_release_inode(struct super_block *sb, int group, int dir)
+ if (dir)
+ le16_add_cpu(&desc->bg_used_dirs_count, -1);
+ spin_unlock(sb_bgl_lock(EXT2_SB(sb), group));
++ percpu_counter_inc(&EXT2_SB(sb)->s_freeinodes_counter);
+ if (dir)
+ percpu_counter_dec(&EXT2_SB(sb)->s_dirs_counter);
+ mark_buffer_dirty(bh);
+@@ -531,7 +532,7 @@ got:
+ goto fail;
+ }
+
+- percpu_counter_add(&sbi->s_freeinodes_counter, -1);
++ percpu_counter_dec(&sbi->s_freeinodes_counter);
+ if (S_ISDIR(mode))
+ percpu_counter_inc(&sbi->s_dirs_counter);
+
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index 4f994de46e6b9..03fe8bac36cf4 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -155,8 +155,10 @@ static int minix_remount (struct super_block * sb, int * flags, char * data)
+ return 0;
+ }
+
+-static bool minix_check_superblock(struct minix_sb_info *sbi)
++static bool minix_check_superblock(struct super_block *sb)
+ {
++ struct minix_sb_info *sbi = minix_sb(sb);
++
+ if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
+ return false;
+
+@@ -166,7 +168,7 @@ static bool minix_check_superblock(struct minix_sb_info *sbi)
+ * of indirect blocks which places the limit well above U32_MAX.
+ */
+ if (sbi->s_version == MINIX_V1 &&
+- sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE)
++ sb->s_maxbytes > (7 + 512 + 512*512) * BLOCK_SIZE)
+ return false;
+
+ return true;
+@@ -207,7 +209,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ sbi->s_zmap_blocks = ms->s_zmap_blocks;
+ sbi->s_firstdatazone = ms->s_firstdatazone;
+ sbi->s_log_zone_size = ms->s_log_zone_size;
+- sbi->s_max_size = ms->s_max_size;
++ s->s_maxbytes = ms->s_max_size;
+ s->s_magic = ms->s_magic;
+ if (s->s_magic == MINIX_SUPER_MAGIC) {
+ sbi->s_version = MINIX_V1;
+@@ -238,7 +240,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ sbi->s_zmap_blocks = m3s->s_zmap_blocks;
+ sbi->s_firstdatazone = m3s->s_firstdatazone;
+ sbi->s_log_zone_size = m3s->s_log_zone_size;
+- sbi->s_max_size = m3s->s_max_size;
++ s->s_maxbytes = m3s->s_max_size;
+ sbi->s_ninodes = m3s->s_ninodes;
+ sbi->s_nzones = m3s->s_zones;
+ sbi->s_dirsize = 64;
+@@ -250,7 +252,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ } else
+ goto out_no_fs;
+
+- if (!minix_check_superblock(sbi))
++ if (!minix_check_superblock(s))
+ goto out_illegal_sb;
+
+ /*
+diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
+index 046cc96ee7adb..1fed906042aa8 100644
+--- a/fs/minix/itree_v1.c
++++ b/fs/minix/itree_v1.c
+@@ -29,12 +29,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, inode->i_sb->s_bdev);
+- } else if (block >= (minix_sb(inode->i_sb)->s_max_size/BLOCK_SIZE)) {
+- if (printk_ratelimit())
+- printk("MINIX-fs: block_to_path: "
+- "block %ld too big on dev %pg\n",
+- block, inode->i_sb->s_bdev);
+- } else if (block < 7) {
++ return 0;
++ }
++ if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes)
++ return 0;
++
++ if (block < 7) {
+ offsets[n++] = block;
+ } else if ((block -= 7) < 512) {
+ offsets[n++] = 7;
+diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c
+index f7fc7eccccccd..9d00f31a2d9d1 100644
+--- a/fs/minix/itree_v2.c
++++ b/fs/minix/itree_v2.c
+@@ -32,13 +32,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, sb->s_bdev);
+- } else if ((u64)block * (u64)sb->s_blocksize >=
+- minix_sb(sb)->s_max_size) {
+- if (printk_ratelimit())
+- printk("MINIX-fs: block_to_path: "
+- "block %ld too big on dev %pg\n",
+- block, sb->s_bdev);
+- } else if (block < DIRCOUNT) {
++ return 0;
++ }
++ if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes)
++ return 0;
++
++ if (block < DIRCOUNT) {
+ offsets[n++] = block;
+ } else if ((block -= DIRCOUNT) < INDIRCOUNT(sb)) {
+ offsets[n++] = DIRCOUNT;
+diff --git a/fs/minix/minix.h b/fs/minix/minix.h
+index df081e8afcc3c..168d45d3de73e 100644
+--- a/fs/minix/minix.h
++++ b/fs/minix/minix.h
+@@ -32,7 +32,6 @@ struct minix_sb_info {
+ unsigned long s_zmap_blocks;
+ unsigned long s_firstdatazone;
+ unsigned long s_log_zone_size;
+- unsigned long s_max_size;
+ int s_dirsize;
+ int s_namelen;
+ struct buffer_head ** s_imap;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 05cb68ca1ba1a..1ef75b1deffa3 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5603,8 +5603,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,
+ return ret;
+ if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
+ return -ENOENT;
+- if (buflen < label.len)
+- return -ERANGE;
+ return 0;
+ }
+
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index c4cf0192d7bb8..0a5cae8f8aff9 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -4280,7 +4280,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
+ goto out_overflow;
+ if (len < NFS4_MAXLABELLEN) {
+ if (label) {
+- memcpy(label->label, p, len);
++ if (label->len) {
++ if (label->len < len)
++ return -ERANGE;
++ memcpy(label->label, p, len);
++ }
+ label->len = len;
+ label->pi = pi;
+ label->lfs = lfs;
+diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
+index 2319336183005..b9f62d29355ba 100644
+--- a/fs/ocfs2/ocfs2.h
++++ b/fs/ocfs2/ocfs2.h
+@@ -338,8 +338,8 @@ struct ocfs2_super
+ spinlock_t osb_lock;
+ u32 s_next_generation;
+ unsigned long osb_flags;
+- s16 s_inode_steal_slot;
+- s16 s_meta_steal_slot;
++ u16 s_inode_steal_slot;
++ u16 s_meta_steal_slot;
+ atomic_t s_num_inodes_stolen;
+ atomic_t s_num_meta_stolen;
+
+diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
+index 15a89c513da2f..0230b4ece0f0e 100644
+--- a/fs/ocfs2/suballoc.c
++++ b/fs/ocfs2/suballoc.c
+@@ -893,9 +893,9 @@ static void __ocfs2_set_steal_slot(struct ocfs2_super *osb, int slot, int type)
+ {
+ spin_lock(&osb->osb_lock);
+ if (type == INODE_ALLOC_SYSTEM_INODE)
+- osb->s_inode_steal_slot = slot;
++ osb->s_inode_steal_slot = (u16)slot;
+ else if (type == EXTENT_ALLOC_SYSTEM_INODE)
+- osb->s_meta_steal_slot = slot;
++ osb->s_meta_steal_slot = (u16)slot;
+ spin_unlock(&osb->osb_lock);
+ }
+
+diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
+index 3415e0b09398f..2658d91c1f7b6 100644
+--- a/fs/ocfs2/super.c
++++ b/fs/ocfs2/super.c
+@@ -92,7 +92,7 @@ struct mount_options
+ unsigned long commit_interval;
+ unsigned long mount_opt;
+ unsigned int atime_quantum;
+- signed short slot;
++ unsigned short slot;
+ int localalloc_opt;
+ unsigned int resv_level;
+ int dir_resv_level;
+@@ -1384,7 +1384,7 @@ static int ocfs2_parse_options(struct super_block *sb,
+ goto bail;
+ }
+ if (option)
+- mopt->slot = (s16)option;
++ mopt->slot = (u16)option;
+ break;
+ case Opt_commit:
+ if (match_int(&args[0], &option)) {
+diff --git a/fs/ufs/super.c b/fs/ufs/super.c
+index a4e07e910f1b4..6e59e45d7bfbd 100644
+--- a/fs/ufs/super.c
++++ b/fs/ufs/super.c
+@@ -100,7 +100,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 gene
+ struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
+ struct inode *inode;
+
+- if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg)
++ if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg)
+ return ERR_PTR(-ESTALE);
+
+ inode = ufs_iget(sb, ino);
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index b1b4411b4c6b8..539f4a84412f4 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -308,8 +308,8 @@ enum {
+
+ #define QI_DEV_EIOTLB_ADDR(a) ((u64)(a) & VTD_PAGE_MASK)
+ #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11)
+-#define QI_DEV_EIOTLB_GLOB(g) ((u64)g)
+-#define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32)
++#define QI_DEV_EIOTLB_GLOB(g) ((u64)(g) & 0x1)
++#define QI_DEV_EIOTLB_PASID(p) ((u64)((p) & 0xfffff) << 32)
+ #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16)
+ #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4)
+ #define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index 6ecaf056ab637..a042faefb9b73 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -210,6 +210,8 @@ struct irq_data {
+ * IRQD_CAN_RESERVE - Can use reservation mode
+ * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change
+ * required
++ * IRQD_AFFINITY_ON_ACTIVATE - Affinity is set on activation. Don't call
++ * irq_chip::irq_set_affinity() when deactivated.
+ */
+ enum {
+ IRQD_TRIGGER_MASK = 0xf,
+@@ -233,6 +235,7 @@ enum {
+ IRQD_DEFAULT_TRIGGER_SET = (1 << 25),
+ IRQD_CAN_RESERVE = (1 << 26),
+ IRQD_MSI_NOMASK_QUIRK = (1 << 27),
++ IRQD_AFFINITY_ON_ACTIVATE = (1 << 29),
+ };
+
+ #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors)
+@@ -407,6 +410,16 @@ static inline bool irqd_msi_nomask_quirk(struct irq_data *d)
+ return __irqd_to_state(d) & IRQD_MSI_NOMASK_QUIRK;
+ }
+
++static inline void irqd_set_affinity_on_activate(struct irq_data *d)
++{
++ __irqd_to_state(d) |= IRQD_AFFINITY_ON_ACTIVATE;
++}
++
++static inline bool irqd_affinity_on_activate(struct irq_data *d)
++{
++ return __irqd_to_state(d) & IRQD_AFFINITY_ON_ACTIVATE;
++}
++
+ #undef __irqd_to_state
+
+ static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index b1f297f4b7b0b..2517492dd1855 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -373,6 +373,9 @@ struct pci_dev {
+ bool match_driver; /* Skip attaching driver */
+
+ unsigned int transparent:1; /* Subtractive decode bridge */
++ unsigned int io_window:1; /* Bridge has I/O window */
++ unsigned int pref_window:1; /* Bridge has pref mem window */
++ unsigned int pref_64_window:1; /* Pref mem window is 64-bit */
+ unsigned int multifunction:1; /* Multi-function device */
+
+ unsigned int is_busmaster:1; /* Is busmaster */
+diff --git a/include/net/sock.h b/include/net/sock.h
+index e2df102e669e8..77f36257cac97 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -845,6 +845,8 @@ static inline int sk_memalloc_socks(void)
+ {
+ return static_branch_unlikely(&memalloc_socks_key);
+ }
++
++void __receive_sock(struct file *file);
+ #else
+
+ static inline int sk_memalloc_socks(void)
+@@ -852,6 +854,8 @@ static inline int sk_memalloc_socks(void)
+ return 0;
+ }
+
++static inline void __receive_sock(struct file *file)
++{ }
+ #endif
+
+ static inline gfp_t sk_gfp_mask(const struct sock *sk, gfp_t gfp_mask)
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 025fcd029f833..3b66c77670d9b 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -280,12 +280,16 @@ static bool irq_set_affinity_deactivated(struct irq_data *data,
+ struct irq_desc *desc = irq_data_to_desc(data);
+
+ /*
++ * Handle irq chips which can handle affinity only in activated
++ * state correctly
++ *
+ * If the interrupt is not yet activated, just store the affinity
+ * mask and do not call the chip driver at all. On activation the
+ * driver has to make sure anyway that the interrupt is in a
+ * useable state so startup works.
+ */
+- if (!IS_ENABLED(CONFIG_IRQ_DOMAIN_HIERARCHY) || irqd_is_activated(data))
++ if (!IS_ENABLED(CONFIG_IRQ_DOMAIN_HIERARCHY) ||
++ irqd_is_activated(data) || !irqd_affinity_on_activate(data))
+ return false;
+
+ cpumask_copy(desc->irq_common_data.affinity, mask);
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 178327a75e733..eb4bffe6d764d 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2077,6 +2077,13 @@ static void kill_kprobe(struct kprobe *p)
+ * the original probed function (which will be freed soon) any more.
+ */
+ arch_remove_kprobe(p);
++
++ /*
++ * The module is going away. We should disarm the kprobe which
++ * is using ftrace.
++ */
++ if (kprobe_ftrace(p))
++ disarm_kprobe_ftrace(p);
+ }
+
+ /* Disable one kprobe */
+diff --git a/kernel/module.c b/kernel/module.c
+index ae8e7a1fa74a8..d05e1bfdd3559 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1461,18 +1461,34 @@ struct module_sect_attrs {
+ struct module_sect_attr attrs[0];
+ };
+
++#define MODULE_SECT_READ_SIZE (3 /* "0x", "\n" */ + (BITS_PER_LONG / 4))
+ static ssize_t module_sect_read(struct file *file, struct kobject *kobj,
+ struct bin_attribute *battr,
+ char *buf, loff_t pos, size_t count)
+ {
+ struct module_sect_attr *sattr =
+ container_of(battr, struct module_sect_attr, battr);
++ char bounce[MODULE_SECT_READ_SIZE + 1];
++ size_t wrote;
+
+ if (pos != 0)
+ return -EINVAL;
+
+- return sprintf(buf, "0x%px\n",
+- kallsyms_show_value(file->f_cred) ? (void *)sattr->address : NULL);
++ /*
++ * Since we're a binary read handler, we must account for the
++ * trailing NUL byte that sprintf will write: if "buf" is
++ * too small to hold the NUL, or the NUL is exactly the last
++ * byte, the read will look like it got truncated by one byte.
++ * Since there is no way to ask sprintf nicely to not write
++ * the NUL, we have to use a bounce buffer.
++ */
++ wrote = scnprintf(bounce, sizeof(bounce), "0x%px\n",
++ kallsyms_show_value(file->f_cred)
++ ? (void *)sattr->address : NULL);
++ count = min(count, wrote);
++ memcpy(buf, bounce, count);
++
++ return count;
+ }
+
+ static void free_sect_attrs(struct module_sect_attrs *sect_attrs)
+@@ -1521,7 +1537,7 @@ static void add_sect_attrs(struct module *mod, const struct load_info *info)
+ goto out;
+ sect_attrs->nsections++;
+ sattr->battr.read = module_sect_read;
+- sattr->battr.size = 3 /* "0x", "\n" */ + (BITS_PER_LONG / 4);
++ sattr->battr.size = MODULE_SECT_READ_SIZE;
+ sattr->battr.attr.mode = 0400;
+ *(gattr++) = &(sattr++)->battr;
+ }
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 0c379cd40bea3..70f7743c16729 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -5665,8 +5665,11 @@ static int referenced_filters(struct dyn_ftrace *rec)
+ int cnt = 0;
+
+ for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) {
+- if (ops_references_rec(ops, rec))
+- cnt++;
++ if (ops_references_rec(ops, rec)) {
++ cnt++;
++ if (ops->flags & FTRACE_OPS_FL_SAVE_REGS)
++ rec->flags |= FTRACE_FL_REGS;
++ }
+ }
+
+ return cnt;
+@@ -5843,8 +5846,8 @@ void ftrace_module_enable(struct module *mod)
+ if (ftrace_start_up)
+ cnt += referenced_filters(rec);
+
+- /* This clears FTRACE_FL_DISABLED */
+- rec->flags = cnt;
++ rec->flags &= ~FTRACE_FL_DISABLED;
++ rec->flags += cnt;
+
+ if (ftrace_start_up && cnt) {
+ int failed = __ftrace_replace_code(rec, 1);
+@@ -6447,12 +6450,12 @@ void ftrace_pid_follow_fork(struct trace_array *tr, bool enable)
+ if (enable) {
+ register_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork,
+ tr);
+- register_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit,
++ register_trace_sched_process_free(ftrace_pid_follow_sched_process_exit,
+ tr);
+ } else {
+ unregister_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork,
+ tr);
+- unregister_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit,
++ unregister_trace_sched_process_free(ftrace_pid_follow_sched_process_exit,
+ tr);
+ }
+ }
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index ec340e1cbffcb..27726121d332c 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -534,12 +534,12 @@ void trace_event_follow_fork(struct trace_array *tr, bool enable)
+ if (enable) {
+ register_trace_prio_sched_process_fork(event_filter_pid_sched_process_fork,
+ tr, INT_MIN);
+- register_trace_prio_sched_process_exit(event_filter_pid_sched_process_exit,
++ register_trace_prio_sched_process_free(event_filter_pid_sched_process_exit,
+ tr, INT_MAX);
+ } else {
+ unregister_trace_sched_process_fork(event_filter_pid_sched_process_fork,
+ tr);
+- unregister_trace_sched_process_exit(event_filter_pid_sched_process_exit,
++ unregister_trace_sched_process_free(event_filter_pid_sched_process_exit,
+ tr);
+ }
+ }
+diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
+index 8030e24dbf148..568918fae8d41 100644
+--- a/kernel/trace/trace_hwlat.c
++++ b/kernel/trace/trace_hwlat.c
+@@ -270,6 +270,7 @@ static bool disable_migrate;
+ static void move_to_next_cpu(void)
+ {
+ struct cpumask *current_mask = &save_cpumask;
++ struct trace_array *tr = hwlat_trace;
+ int next_cpu;
+
+ if (disable_migrate)
+@@ -283,7 +284,7 @@ static void move_to_next_cpu(void)
+ goto disable;
+
+ get_online_cpus();
+- cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask);
++ cpumask_and(current_mask, cpu_online_mask, tr->tracing_cpumask);
+ next_cpu = cpumask_next(smp_processor_id(), current_mask);
+ put_online_cpus();
+
+@@ -360,7 +361,7 @@ static int start_kthread(struct trace_array *tr)
+ /* Just pick the first CPU on first iteration */
+ current_mask = &save_cpumask;
+ get_online_cpus();
+- cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask);
++ cpumask_and(current_mask, cpu_online_mask, tr->tracing_cpumask);
+ put_online_cpus();
+ next_cpu = cpumask_first(current_mask);
+
+diff --git a/lib/test_kmod.c b/lib/test_kmod.c
+index 9cf77628fc913..87a0cc750ea23 100644
+--- a/lib/test_kmod.c
++++ b/lib/test_kmod.c
+@@ -745,7 +745,7 @@ static int trigger_config_run_type(struct kmod_test_device *test_dev,
+ break;
+ case TEST_KMOD_FS_TYPE:
+ kfree_const(config->test_fs);
+- config->test_driver = NULL;
++ config->test_fs = NULL;
+ copied = config_copy_test_fs(config, test_str,
+ strlen(test_str));
+ break;
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index ecefdba4b0dda..483c4573695a9 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1251,6 +1251,7 @@ static void collect_mm_slot(struct mm_slot *mm_slot)
+ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
+ {
+ struct vm_area_struct *vma;
++ struct mm_struct *mm;
+ unsigned long addr;
+ pmd_t *pmd, _pmd;
+
+@@ -1264,7 +1265,8 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
+ continue;
+ if (vma->vm_end < addr + HPAGE_PMD_SIZE)
+ continue;
+- pmd = mm_find_pmd(vma->vm_mm, addr);
++ mm = vma->vm_mm;
++ pmd = mm_find_pmd(mm, addr);
+ if (!pmd)
+ continue;
+ /*
+@@ -1273,14 +1275,16 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
+ * re-fault. Not ideal, but it's more important to not disturb
+ * the system too much.
+ */
+- if (down_write_trylock(&vma->vm_mm->mmap_sem)) {
+- spinlock_t *ptl = pmd_lock(vma->vm_mm, pmd);
+- /* assume page table is clear */
+- _pmd = pmdp_collapse_flush(vma, addr, pmd);
+- spin_unlock(ptl);
+- up_write(&vma->vm_mm->mmap_sem);
+- mm_dec_nr_ptes(vma->vm_mm);
+- pte_free(vma->vm_mm, pmd_pgtable(_pmd));
++ if (down_write_trylock(&mm->mmap_sem)) {
++ if (!khugepaged_test_exit(mm)) {
++ spinlock_t *ptl = pmd_lock(mm, pmd);
++ /* assume page table is clear */
++ _pmd = pmdp_collapse_flush(vma, addr, pmd);
++ spin_unlock(ptl);
++ mm_dec_nr_ptes(mm);
++ pte_free(mm, pmd_pgtable(_pmd));
++ }
++ up_write(&mm->mmap_sem);
+ }
+ }
+ i_mmap_unlock_write(mapping);
+diff --git a/mm/page_counter.c b/mm/page_counter.c
+index de31470655f66..147ff99187b81 100644
+--- a/mm/page_counter.c
++++ b/mm/page_counter.c
+@@ -77,7 +77,7 @@ void page_counter_charge(struct page_counter *counter, unsigned long nr_pages)
+ long new;
+
+ new = atomic_long_add_return(nr_pages, &c->usage);
+- propagate_protected_usage(counter, new);
++ propagate_protected_usage(c, new);
+ /*
+ * This is indeed racy, but we can live with some
+ * inaccuracy in the watermark.
+@@ -121,7 +121,7 @@ bool page_counter_try_charge(struct page_counter *counter,
+ new = atomic_long_add_return(nr_pages, &c->usage);
+ if (new > c->max) {
+ atomic_long_sub(nr_pages, &c->usage);
+- propagate_protected_usage(counter, new);
++ propagate_protected_usage(c, new);
+ /*
+ * This is racy, but we can live with some
+ * inaccuracy in the failcnt.
+@@ -130,7 +130,7 @@ bool page_counter_try_charge(struct page_counter *counter,
+ *fail = c;
+ goto failed;
+ }
+- propagate_protected_usage(counter, new);
++ propagate_protected_usage(c, new);
+ /*
+ * Just like with failcnt, we can live with some
+ * inaccuracy in the watermark.
+diff --git a/net/compat.c b/net/compat.c
+index 3c4b0283b29a1..2a8c7cb5f06a8 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -289,6 +289,7 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
+ break;
+ }
+ /* Bump the usage count and install the file. */
++ __receive_sock(fp[i]);
+ fd_install(new_fd, get_file(fp[i]));
+ }
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 6c3b031b6ad66..e6cbe137cb6fc 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2636,6 +2636,27 @@ int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct *
+ }
+ EXPORT_SYMBOL(sock_no_mmap);
+
++/*
++ * When a file is received (via SCM_RIGHTS, etc), we must bump the
++ * various sock-based usage counts.
++ */
++void __receive_sock(struct file *file)
++{
++ struct socket *sock;
++ int error;
++
++ /*
++ * The resulting value of "error" is ignored here since we only
++ * need to take action when the file is a socket and testing
++ * "sock" for NULL is sufficient.
++ */
++ sock = sock_from_file(file, &error);
++ if (sock) {
++ sock_update_netprioidx(&sock->sk->sk_cgrp_data);
++ sock_update_classid(&sock->sk->sk_cgrp_data);
++ }
++}
++
+ ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags)
+ {
+ ssize_t res;
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index ec2e83272f9d8..2a82d438991b5 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -979,7 +979,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
+ might_sleep();
+ lockdep_assert_held(&local->sta_mtx);
+
+- while (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
++ if (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
+ ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+ WARN_ON_ONCE(ret);
+ }
+diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
+index 3ef2b27ebbe8c..f32c55ffffc79 100644
+--- a/sound/pci/echoaudio/echoaudio.c
++++ b/sound/pci/echoaudio/echoaudio.c
+@@ -2216,7 +2216,6 @@ static int snd_echo_resume(struct device *dev)
+ if (err < 0) {
+ kfree(commpage_bak);
+ dev_err(dev, "resume init_hw err=%d\n", err);
+- snd_echo_free(chip);
+ return err;
+ }
+
+@@ -2243,7 +2242,6 @@ static int snd_echo_resume(struct device *dev)
+ if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED,
+ KBUILD_MODNAME, chip)) {
+ dev_err(chip->card->dev, "cannot grab irq\n");
+- snd_echo_free(chip);
+ return -EBUSY;
+ }
+ chip->irq = pci->irq;
+diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
+index 42a787856cd87..7c17f17ea2cd2 100644
+--- a/tools/build/Makefile.feature
++++ b/tools/build/Makefile.feature
+@@ -7,7 +7,7 @@ endif
+
+ feature_check = $(eval $(feature_check_code))
+ define feature_check_code
+- feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0)
++ feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC="$(CC)" CXX="$(CXX)" CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0)
+ endef
+
+ feature_set = $(eval $(feature_set_code))
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index bf8a8ebcca1eb..c4845b66b9baa 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -62,8 +62,6 @@ FILES= \
+
+ FILES := $(addprefix $(OUTPUT),$(FILES))
+
+-CC ?= $(CROSS_COMPILE)gcc
+-CXX ?= $(CROSS_COMPILE)g++
+ PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config
+ LLVM_CONFIG ?= llvm-config
+
+diff --git a/tools/perf/bench/mem-functions.c b/tools/perf/bench/mem-functions.c
+index 0251dd348124a..4864fc67d01b5 100644
+--- a/tools/perf/bench/mem-functions.c
++++ b/tools/perf/bench/mem-functions.c
+@@ -222,12 +222,8 @@ static int bench_mem_common(int argc, const char **argv, struct bench_mem_info *
+ return 0;
+ }
+
+-static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst)
++static void memcpy_prefault(memcpy_t fn, size_t size, void *src, void *dst)
+ {
+- u64 cycle_start = 0ULL, cycle_end = 0ULL;
+- memcpy_t fn = r->fn.memcpy;
+- int i;
+-
+ /* Make sure to always prefault zero pages even if MMAP_THRESH is crossed: */
+ memset(src, 0, size);
+
+@@ -236,6 +232,15 @@ static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, vo
+ * to not measure page fault overhead:
+ */
+ fn(dst, src, size);
++}
++
++static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst)
++{
++ u64 cycle_start = 0ULL, cycle_end = 0ULL;
++ memcpy_t fn = r->fn.memcpy;
++ int i;
++
++ memcpy_prefault(fn, size, src, dst);
+
+ cycle_start = get_cycles();
+ for (i = 0; i < nr_loops; ++i)
+@@ -251,11 +256,7 @@ static double do_memcpy_gettimeofday(const struct function *r, size_t size, void
+ memcpy_t fn = r->fn.memcpy;
+ int i;
+
+- /*
+- * We prefault the freshly allocated memory range here,
+- * to not measure page fault overhead:
+- */
+- fn(dst, src, size);
++ memcpy_prefault(fn, size, src, dst);
+
+ BUG_ON(gettimeofday(&tv_start, NULL));
+ for (i = 0; i < nr_loops; ++i)
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index 4357141c7c924..6522b6513895c 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -1129,6 +1129,7 @@ static int intel_pt_walk_fup(struct intel_pt_decoder *decoder)
+ return 0;
+ if (err == -EAGAIN ||
+ intel_pt_fup_with_nlip(decoder, &intel_pt_insn, ip, err)) {
++ decoder->pkt_state = INTEL_PT_STATE_IN_SYNC;
+ if (intel_pt_fup_event(decoder))
+ return 0;
+ return -EAGAIN;
+@@ -1780,17 +1781,13 @@ next:
+ }
+ if (decoder->set_fup_mwait)
+ no_tip = true;
++ if (no_tip)
++ decoder->pkt_state = INTEL_PT_STATE_FUP_NO_TIP;
++ else
++ decoder->pkt_state = INTEL_PT_STATE_FUP;
+ err = intel_pt_walk_fup(decoder);
+- if (err != -EAGAIN) {
+- if (err)
+- return err;
+- if (no_tip)
+- decoder->pkt_state =
+- INTEL_PT_STATE_FUP_NO_TIP;
+- else
+- decoder->pkt_state = INTEL_PT_STATE_FUP;
+- return 0;
+- }
++ if (err != -EAGAIN)
++ return err;
+ if (no_tip) {
+ no_tip = false;
+ break;
+@@ -2375,15 +2372,11 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder)
+ err = intel_pt_walk_tip(decoder);
+ break;
+ case INTEL_PT_STATE_FUP:
+- decoder->pkt_state = INTEL_PT_STATE_IN_SYNC;
+ err = intel_pt_walk_fup(decoder);
+ if (err == -EAGAIN)
+ err = intel_pt_walk_fup_tip(decoder);
+- else if (!err)
+- decoder->pkt_state = INTEL_PT_STATE_FUP;
+ break;
+ case INTEL_PT_STATE_FUP_NO_TIP:
+- decoder->pkt_state = INTEL_PT_STATE_IN_SYNC;
+ err = intel_pt_walk_fup(decoder);
+ if (err == -EAGAIN)
+ err = intel_pt_walk_trace(decoder);
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+index bdbbbe8431e03..3694613f418f6 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+@@ -44,7 +44,7 @@ struct shared_info {
+ unsigned long amr2;
+
+ /* AMR value that ptrace should refuse to write to the child. */
+- unsigned long amr3;
++ unsigned long invalid_amr;
+
+ /* IAMR value the parent expects to read from the child. */
+ unsigned long expected_iamr;
+@@ -57,8 +57,8 @@ struct shared_info {
+ * (even though they're valid ones) because userspace doesn't have
+ * access to those registers.
+ */
+- unsigned long new_iamr;
+- unsigned long new_uamor;
++ unsigned long invalid_iamr;
++ unsigned long invalid_uamor;
+ };
+
+ static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights)
+@@ -66,11 +66,6 @@ static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights)
+ return syscall(__NR_pkey_alloc, flags, init_access_rights);
+ }
+
+-static int sys_pkey_free(int pkey)
+-{
+- return syscall(__NR_pkey_free, pkey);
+-}
+-
+ static int child(struct shared_info *info)
+ {
+ unsigned long reg;
+@@ -100,28 +95,32 @@ static int child(struct shared_info *info)
+
+ info->amr1 |= 3ul << pkeyshift(pkey1);
+ info->amr2 |= 3ul << pkeyshift(pkey2);
+- info->amr3 |= info->amr2 | 3ul << pkeyshift(pkey3);
++ /*
++ * invalid amr value where we try to force write
++ * things which are deined by a uamor setting.
++ */
++ info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor);
+
++ /*
++ * if PKEY_DISABLE_EXECUTE succeeded we should update the expected_iamr
++ */
+ if (disable_execute)
+ info->expected_iamr |= 1ul << pkeyshift(pkey1);
+ else
+ info->expected_iamr &= ~(1ul << pkeyshift(pkey1));
+
+- info->expected_iamr &= ~(1ul << pkeyshift(pkey2) | 1ul << pkeyshift(pkey3));
+-
+- info->expected_uamor |= 3ul << pkeyshift(pkey1) |
+- 3ul << pkeyshift(pkey2);
+- info->new_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2);
+- info->new_uamor |= 3ul << pkeyshift(pkey1);
++ /*
++ * We allocated pkey2 and pkey 3 above. Clear the IAMR bits.
++ */
++ info->expected_iamr &= ~(1ul << pkeyshift(pkey2));
++ info->expected_iamr &= ~(1ul << pkeyshift(pkey3));
+
+ /*
+- * We won't use pkey3. We just want a plausible but invalid key to test
+- * whether ptrace will let us write to AMR bits we are not supposed to.
+- *
+- * This also tests whether the kernel restores the UAMOR permissions
+- * after a key is freed.
++ * Create an IAMR value different from expected value.
++ * Kernel will reject an IAMR and UAMOR change.
+ */
+- sys_pkey_free(pkey3);
++ info->invalid_iamr = info->expected_iamr | (1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2));
++ info->invalid_uamor = info->expected_uamor & ~(0x3ul << pkeyshift(pkey1));
+
+ printf("%-30s AMR: %016lx pkey1: %d pkey2: %d pkey3: %d\n",
+ user_write, info->amr1, pkey1, pkey2, pkey3);
+@@ -196,9 +195,9 @@ static int parent(struct shared_info *info, pid_t pid)
+ PARENT_SKIP_IF_UNSUPPORTED(ret, &info->child_sync);
+ PARENT_FAIL_IF(ret, &info->child_sync);
+
+- info->amr1 = info->amr2 = info->amr3 = regs[0];
+- info->expected_iamr = info->new_iamr = regs[1];
+- info->expected_uamor = info->new_uamor = regs[2];
++ info->amr1 = info->amr2 = regs[0];
++ info->expected_iamr = regs[1];
++ info->expected_uamor = regs[2];
+
+ /* Wake up child so that it can set itself up. */
+ ret = prod_child(&info->child_sync);
+@@ -234,10 +233,10 @@ static int parent(struct shared_info *info, pid_t pid)
+ return ret;
+
+ /* Write invalid AMR value in child. */
+- ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->amr3, 1);
++ ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->invalid_amr, 1);
+ PARENT_FAIL_IF(ret, &info->child_sync);
+
+- printf("%-30s AMR: %016lx\n", ptrace_write_running, info->amr3);
++ printf("%-30s AMR: %016lx\n", ptrace_write_running, info->invalid_amr);
+
+ /* Wake up child so that it can verify it didn't change. */
+ ret = prod_child(&info->child_sync);
+@@ -249,7 +248,7 @@ static int parent(struct shared_info *info, pid_t pid)
+
+ /* Try to write to IAMR. */
+ regs[0] = info->amr1;
+- regs[1] = info->new_iamr;
++ regs[1] = info->invalid_iamr;
+ ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 2);
+ PARENT_FAIL_IF(!ret, &info->child_sync);
+
+@@ -257,7 +256,7 @@ static int parent(struct shared_info *info, pid_t pid)
+ ptrace_write_running, regs[0], regs[1]);
+
+ /* Try to write to IAMR and UAMOR. */
+- regs[2] = info->new_uamor;
++ regs[2] = info->invalid_uamor;
+ ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 3);
+ PARENT_FAIL_IF(!ret, &info->child_sync);
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-08-26 11:15 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-08-26 11:15 UTC (permalink / raw
To: gentoo-commits
commit: 286936af5f7b3c95f620e434ebb58ba5f7d7095d
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 26 11:15:26 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Aug 26 11:15:26 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=286936af
Linux patch 4.19.142
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1141_linux-4.19.142.patch | 2088 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2092 insertions(+)
diff --git a/0000_README b/0000_README
index 1680f0b..4adb8c6 100644
--- a/0000_README
+++ b/0000_README
@@ -603,6 +603,10 @@ Patch: 1140_linux-4.19.141.patch
From: https://www.kernel.org
Desc: Linux 4.19.141
+Patch: 1141_linux-4.19.142.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.142
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1141_linux-4.19.142.patch b/1141_linux-4.19.142.patch
new file mode 100644
index 0000000..84d26b3
--- /dev/null
+++ b/1141_linux-4.19.142.patch
@@ -0,0 +1,2088 @@
+diff --git a/Makefile b/Makefile
+index 5b64e11419846..e5e46aecf357f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 141
++SUBLEVEL = 142
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h
+index eb09d5aee9106..0bba9e991189d 100644
+--- a/arch/alpha/include/asm/io.h
++++ b/arch/alpha/include/asm/io.h
+@@ -507,10 +507,10 @@ extern inline void writeq(u64 b, volatile void __iomem *addr)
+ }
+ #endif
+
+-#define ioread16be(p) be16_to_cpu(ioread16(p))
+-#define ioread32be(p) be32_to_cpu(ioread32(p))
+-#define iowrite16be(v,p) iowrite16(cpu_to_be16(v), (p))
+-#define iowrite32be(v,p) iowrite32(cpu_to_be32(v), (p))
++#define ioread16be(p) swab16(ioread16(p))
++#define ioread32be(p) swab32(ioread32(p))
++#define iowrite16be(v,p) iowrite16(swab16(v), (p))
++#define iowrite32be(v,p) iowrite32(swab32(v), (p))
+
+ #define inb_p inb
+ #define inw_p inw
+diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
+index c9128bb187f9a..471859cbfe0bb 100644
+--- a/arch/arm/include/asm/kvm_host.h
++++ b/arch/arm/include/asm/kvm_host.h
+@@ -234,7 +234,7 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu,
+
+ #define KVM_ARCH_WANT_MMU_NOTIFIER
+ int kvm_unmap_hva_range(struct kvm *kvm,
+- unsigned long start, unsigned long end);
++ unsigned long start, unsigned long end, bool blockable);
+ void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
+
+ unsigned long kvm_arm_num_regs(struct kvm_vcpu *vcpu);
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index e9afdfcb8403c..5e720742d6479 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -370,7 +370,7 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu,
+
+ #define KVM_ARCH_WANT_MMU_NOTIFIER
+ int kvm_unmap_hva_range(struct kvm *kvm,
+- unsigned long start, unsigned long end);
++ unsigned long start, unsigned long end, bool blockable);
+ void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
+ int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end);
+ int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
+diff --git a/arch/m68k/include/asm/m53xxacr.h b/arch/m68k/include/asm/m53xxacr.h
+index 9138a624c5c81..692f90e7fecc1 100644
+--- a/arch/m68k/include/asm/m53xxacr.h
++++ b/arch/m68k/include/asm/m53xxacr.h
+@@ -89,9 +89,9 @@
+ * coherency though in all cases. And for copyback caches we will need
+ * to push cached data as well.
+ */
+-#define CACHE_INIT CACR_CINVA
+-#define CACHE_INVALIDATE CACR_CINVA
+-#define CACHE_INVALIDATED CACR_CINVA
++#define CACHE_INIT (CACHE_MODE + CACR_CINVA - CACR_EC)
++#define CACHE_INVALIDATE (CACHE_MODE + CACR_CINVA)
++#define CACHE_INVALIDATED (CACHE_MODE + CACR_CINVA)
+
+ #define ACR0_MODE ((CONFIG_RAMBASE & 0xff000000) + \
+ (0x000f0000) + \
+diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
+index 2b3fdfc9e0e77..c254761cb8ad9 100644
+--- a/arch/mips/include/asm/kvm_host.h
++++ b/arch/mips/include/asm/kvm_host.h
+@@ -936,7 +936,7 @@ enum kvm_mips_fault_result kvm_trap_emul_gva_fault(struct kvm_vcpu *vcpu,
+
+ #define KVM_ARCH_WANT_MMU_NOTIFIER
+ int kvm_unmap_hva_range(struct kvm *kvm,
+- unsigned long start, unsigned long end);
++ unsigned long start, unsigned long end, bool blockable);
+ void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
+ int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end);
+ int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
+diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c
+index d8dcdb3504059..098a7afd4d384 100644
+--- a/arch/mips/kvm/mmu.c
++++ b/arch/mips/kvm/mmu.c
+@@ -512,7 +512,8 @@ static int kvm_unmap_hva_handler(struct kvm *kvm, gfn_t gfn, gfn_t gfn_end,
+ return 1;
+ }
+
+-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
++int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end,
++ bool blockable)
+ {
+ handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, NULL);
+
+diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
+index 2f95e38f05491..7b54d8412367e 100644
+--- a/arch/powerpc/include/asm/kvm_host.h
++++ b/arch/powerpc/include/asm/kvm_host.h
+@@ -68,7 +68,8 @@
+ #define KVM_ARCH_WANT_MMU_NOTIFIER
+
+ extern int kvm_unmap_hva_range(struct kvm *kvm,
+- unsigned long start, unsigned long end);
++ unsigned long start, unsigned long end,
++ bool blockable);
+ extern int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end);
+ extern int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
+ extern void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
+diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c
+index cc05f346e0421..bc9d1321dc730 100644
+--- a/arch/powerpc/kvm/book3s.c
++++ b/arch/powerpc/kvm/book3s.c
+@@ -812,7 +812,8 @@ void kvmppc_core_commit_memory_region(struct kvm *kvm,
+ kvm->arch.kvm_ops->commit_memory_region(kvm, mem, old, new);
+ }
+
+-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
++int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end,
++ bool blockable)
+ {
+ return kvm->arch.kvm_ops->unmap_hva_range(kvm, start, end);
+ }
+diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c
+index 8f2985e46f6f1..bbb02195dc530 100644
+--- a/arch/powerpc/kvm/e500_mmu_host.c
++++ b/arch/powerpc/kvm/e500_mmu_host.c
+@@ -737,7 +737,8 @@ static int kvm_unmap_hva(struct kvm *kvm, unsigned long hva)
+ return 0;
+ }
+
+-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
++int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end,
++ bool blockable)
+ {
+ /* kvm_unmap_hva flushes everything anyways */
+ kvm_unmap_hva(kvm, start);
+diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
+index e81a285f3a6ce..e827108680f21 100644
+--- a/arch/powerpc/platforms/pseries/ras.c
++++ b/arch/powerpc/platforms/pseries/ras.c
+@@ -118,7 +118,6 @@ static void handle_system_shutdown(char event_modifier)
+ case EPOW_SHUTDOWN_ON_UPS:
+ pr_emerg("Loss of system power detected. System is running on"
+ " UPS/battery. Check RTAS error log for details\n");
+- orderly_poweroff(true);
+ break;
+
+ case EPOW_SHUTDOWN_LOSS_OF_CRITICAL_FUNCTIONS:
+diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
+index 65fefbf61e1ca..3ffa2847c110b 100644
+--- a/arch/s390/kernel/ptrace.c
++++ b/arch/s390/kernel/ptrace.c
+@@ -1286,7 +1286,6 @@ static bool is_ri_cb_valid(struct runtime_instr_cb *cb)
+ cb->pc == 1 &&
+ cb->qc == 0 &&
+ cb->reserved2 == 0 &&
+- cb->key == PAGE_DEFAULT_KEY &&
+ cb->reserved3 == 0 &&
+ cb->reserved4 == 0 &&
+ cb->reserved5 == 0 &&
+@@ -1350,7 +1349,11 @@ static int s390_runtime_instr_set(struct task_struct *target,
+ kfree(data);
+ return -EINVAL;
+ }
+-
++ /*
++ * Override access key in any case, since user space should
++ * not be able to set it, nor should it care about it.
++ */
++ ri_cb.key = PAGE_DEFAULT_KEY >> 4;
+ preempt_disable();
+ if (!target->thread.ri_cb)
+ target->thread.ri_cb = data;
+diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c
+index 125c7f6e87150..1788a5454b6fc 100644
+--- a/arch/s390/kernel/runtime_instr.c
++++ b/arch/s390/kernel/runtime_instr.c
+@@ -57,7 +57,7 @@ static void init_runtime_instr_cb(struct runtime_instr_cb *cb)
+ cb->k = 1;
+ cb->ps = 1;
+ cb->pc = 1;
+- cb->key = PAGE_DEFAULT_KEY;
++ cb->key = PAGE_DEFAULT_KEY >> 4;
+ cb->v = 1;
+ }
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index ce7b3b22ae86b..4876411a072a7 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1465,7 +1465,8 @@ asmlinkage void __noreturn kvm_spurious_fault(void);
+ ____kvm_handle_fault_on_reboot(insn, "")
+
+ #define KVM_ARCH_WANT_MMU_NOTIFIER
+-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end);
++int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end,
++ bool blockable);
+ int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end);
+ int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
+ void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 92ff656e18101..a2ff5c214738a 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -1956,7 +1956,8 @@ static int kvm_handle_hva(struct kvm *kvm, unsigned long hva,
+ return kvm_handle_hva_range(kvm, hva, hva + 1, data, handler);
+ }
+
+-int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end)
++int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end,
++ bool blockable)
+ {
+ return kvm_handle_hva_range(kvm, start, end, 0, kvm_unmap_rmapp);
+ }
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 5b2440e591fc1..430a4bc66f604 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -857,7 +857,7 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+ unsigned long old_cr4 = kvm_read_cr4(vcpu);
+ unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE |
+- X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE;
++ X86_CR4_SMEP;
+
+ if (kvm_valid_cr4(vcpu, cr4))
+ return 1;
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index 9112d1cb397bb..22da9bfd8a458 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -25,6 +25,7 @@
+ #include <asm/xen/pci.h>
+ #include <asm/xen/cpuid.h>
+ #include <asm/apic.h>
++#include <asm/acpi.h>
+ #include <asm/i8259.h>
+
+ static int xen_pcifront_enable_irq(struct pci_dev *dev)
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 8353ab9bd31bd..c5cf9e77fe862 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -40,6 +40,17 @@ static HLIST_HEAD(clk_root_list);
+ static HLIST_HEAD(clk_orphan_list);
+ static LIST_HEAD(clk_notifier_list);
+
++static struct hlist_head *all_lists[] = {
++ &clk_root_list,
++ &clk_orphan_list,
++ NULL,
++};
++
++static struct hlist_head *orphan_list[] = {
++ &clk_orphan_list,
++ NULL,
++};
++
+ /*** private data structures ***/
+
+ struct clk_core {
+@@ -2618,17 +2629,6 @@ static int inited = 0;
+ static DEFINE_MUTEX(clk_debug_lock);
+ static HLIST_HEAD(clk_debug_list);
+
+-static struct hlist_head *all_lists[] = {
+- &clk_root_list,
+- &clk_orphan_list,
+- NULL,
+-};
+-
+-static struct hlist_head *orphan_list[] = {
+- &clk_orphan_list,
+- NULL,
+-};
+-
+ static void clk_summary_show_one(struct seq_file *s, struct clk_core *c,
+ int level)
+ {
+@@ -3328,6 +3328,34 @@ static const struct clk_ops clk_nodrv_ops = {
+ .set_parent = clk_nodrv_set_parent,
+ };
+
++static void clk_core_evict_parent_cache_subtree(struct clk_core *root,
++ struct clk_core *target)
++{
++ int i;
++ struct clk_core *child;
++
++ for (i = 0; i < root->num_parents; i++)
++ if (root->parents[i] == target)
++ root->parents[i] = NULL;
++
++ hlist_for_each_entry(child, &root->children, child_node)
++ clk_core_evict_parent_cache_subtree(child, target);
++}
++
++/* Remove this clk from all parent caches */
++static void clk_core_evict_parent_cache(struct clk_core *core)
++{
++ struct hlist_head **lists;
++ struct clk_core *root;
++
++ lockdep_assert_held(&prepare_lock);
++
++ for (lists = all_lists; *lists; lists++)
++ hlist_for_each_entry(root, *lists, child_node)
++ clk_core_evict_parent_cache_subtree(root, core);
++
++}
++
+ /**
+ * clk_unregister - unregister a currently registered clock
+ * @clk: clock to unregister
+@@ -3366,6 +3394,8 @@ void clk_unregister(struct clk *clk)
+ clk_core_set_parent_nolock(child, NULL);
+ }
+
++ clk_core_evict_parent_cache(clk->core);
++
+ hlist_del_init(&clk->core->child_node);
+
+ if (clk->core->prepare_count)
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index e7b3d4ed8eff4..99166000ffb77 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -1431,6 +1431,7 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
+
+ intel_pstate_get_hwp_max(cpu->cpu, &phy_max, ¤t_max);
+ cpu->pstate.turbo_freq = phy_max * cpu->pstate.scaling;
++ cpu->pstate.turbo_pstate = phy_max;
+ } else {
+ cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
+ }
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index de1bc38ab39fb..a8180f9090fae 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -359,6 +359,7 @@ static int __init efisubsys_init(void)
+ efi_kobj = kobject_create_and_add("efi", firmware_kobj);
+ if (!efi_kobj) {
+ pr_err("efi: Firmware registration failed.\n");
++ destroy_workqueue(efi_rts_wq);
+ return -ENOMEM;
+ }
+
+@@ -395,6 +396,7 @@ err_unregister:
+ generic_ops_unregister();
+ err_put:
+ kobject_put(efi_kobj);
++ destroy_workqueue(efi_rts_wq);
+ return error;
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/include/fixed31_32.h b/drivers/gpu/drm/amd/display/include/fixed31_32.h
+index 52a73332befb9..343f869c5277d 100644
+--- a/drivers/gpu/drm/amd/display/include/fixed31_32.h
++++ b/drivers/gpu/drm/amd/display/include/fixed31_32.h
+@@ -431,6 +431,9 @@ struct fixed31_32 dc_fixpt_log(struct fixed31_32 arg);
+ */
+ static inline struct fixed31_32 dc_fixpt_pow(struct fixed31_32 arg1, struct fixed31_32 arg2)
+ {
++ if (arg1.value == 0)
++ return arg2.value == 0 ? dc_fixpt_one : dc_fixpt_zero;
++
+ return dc_fixpt_exp(
+ dc_fixpt_mul(
+ dc_fixpt_log(arg1),
+diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
+index 4709f08f39e49..1c1a435d354bc 100644
+--- a/drivers/gpu/drm/vgem/vgem_drv.c
++++ b/drivers/gpu/drm/vgem/vgem_drv.c
+@@ -219,32 +219,6 @@ static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
+ return 0;
+ }
+
+-static int vgem_gem_dumb_map(struct drm_file *file, struct drm_device *dev,
+- uint32_t handle, uint64_t *offset)
+-{
+- struct drm_gem_object *obj;
+- int ret;
+-
+- obj = drm_gem_object_lookup(file, handle);
+- if (!obj)
+- return -ENOENT;
+-
+- if (!obj->filp) {
+- ret = -EINVAL;
+- goto unref;
+- }
+-
+- ret = drm_gem_create_mmap_offset(obj);
+- if (ret)
+- goto unref;
+-
+- *offset = drm_vma_node_offset_addr(&obj->vma_node);
+-unref:
+- drm_gem_object_put_unlocked(obj);
+-
+- return ret;
+-}
+-
+ static struct drm_ioctl_desc vgem_ioctls[] = {
+ DRM_IOCTL_DEF_DRV(VGEM_FENCE_ATTACH, vgem_fence_attach_ioctl, DRM_AUTH|DRM_RENDER_ALLOW),
+ DRM_IOCTL_DEF_DRV(VGEM_FENCE_SIGNAL, vgem_fence_signal_ioctl, DRM_AUTH|DRM_RENDER_ALLOW),
+@@ -438,7 +412,6 @@ static struct drm_driver vgem_driver = {
+ .fops = &vgem_driver_fops,
+
+ .dumb_create = vgem_gem_dumb_create,
+- .dumb_map_offset = vgem_gem_dumb_map,
+
+ .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
+ .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
+diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
+index 589b0d4677d52..f1b666c80f368 100644
+--- a/drivers/infiniband/hw/bnxt_re/main.c
++++ b/drivers/infiniband/hw/bnxt_re/main.c
+@@ -753,7 +753,8 @@ static int bnxt_re_handle_qp_async_event(struct creq_qp_event *qp_event,
+ struct ib_event event;
+ unsigned int flags;
+
+- if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR) {
++ if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR &&
++ rdma_is_kernel_res(&qp->ib_qp.res)) {
+ flags = bnxt_re_lock_cqs(qp);
+ bnxt_qplib_add_flush_qp(&qp->qplib_qp);
+ bnxt_re_unlock_cqs(qp, flags);
+diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
+index d3ff1fc09af71..a9040c0fb4c3f 100644
+--- a/drivers/input/mouse/psmouse-base.c
++++ b/drivers/input/mouse/psmouse-base.c
+@@ -2044,7 +2044,7 @@ static int psmouse_get_maxproto(char *buffer, const struct kernel_param *kp)
+ {
+ int type = *((unsigned int *)kp->arg);
+
+- return sprintf(buffer, "%s", psmouse_protocol_by_type(type)->name);
++ return sprintf(buffer, "%s\n", psmouse_protocol_by_type(type)->name);
+ }
+
+ static int __init psmouse_init(void)
+diff --git a/drivers/media/pci/ttpci/budget-core.c b/drivers/media/pci/ttpci/budget-core.c
+index b3dc45b91101d..9b545c7431685 100644
+--- a/drivers/media/pci/ttpci/budget-core.c
++++ b/drivers/media/pci/ttpci/budget-core.c
+@@ -383,20 +383,25 @@ static int budget_register(struct budget *budget)
+ ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->hw_frontend);
+
+ if (ret < 0)
+- return ret;
++ goto err_release_dmx;
+
+ budget->mem_frontend.source = DMX_MEMORY_FE;
+ ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->mem_frontend);
+ if (ret < 0)
+- return ret;
++ goto err_release_dmx;
+
+ ret = dvbdemux->dmx.connect_frontend(&dvbdemux->dmx, &budget->hw_frontend);
+ if (ret < 0)
+- return ret;
++ goto err_release_dmx;
+
+ dvb_net_init(&budget->dvb_adapter, &budget->dvb_net, &dvbdemux->dmx);
+
+ return 0;
++
++err_release_dmx:
++ dvb_dmxdev_release(&budget->dmxdev);
++ dvb_dmx_release(&budget->demux);
++ return ret;
+ }
+
+ static void budget_unregister(struct budget *budget)
+diff --git a/drivers/media/platform/davinci/vpss.c b/drivers/media/platform/davinci/vpss.c
+index 89a86c19579b8..50fc71d0cb9f3 100644
+--- a/drivers/media/platform/davinci/vpss.c
++++ b/drivers/media/platform/davinci/vpss.c
+@@ -514,19 +514,31 @@ static void vpss_exit(void)
+
+ static int __init vpss_init(void)
+ {
++ int ret;
++
+ if (!request_mem_region(VPSS_CLK_CTRL, 4, "vpss_clock_control"))
+ return -EBUSY;
+
+ oper_cfg.vpss_regs_base2 = ioremap(VPSS_CLK_CTRL, 4);
+ if (unlikely(!oper_cfg.vpss_regs_base2)) {
+- release_mem_region(VPSS_CLK_CTRL, 4);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto err_ioremap;
+ }
+
+ writel(VPSS_CLK_CTRL_VENCCLKEN |
+- VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2);
++ VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2);
++
++ ret = platform_driver_register(&vpss_driver);
++ if (ret)
++ goto err_pd_register;
++
++ return 0;
+
+- return platform_driver_register(&vpss_driver);
++err_pd_register:
++ iounmap(oper_cfg.vpss_regs_base2);
++err_ioremap:
++ release_mem_region(VPSS_CLK_CTRL, 4);
++ return ret;
+ }
+ subsys_initcall(vpss_init);
+ module_exit(vpss_exit);
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 11429df743067..d32e32e791741 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2029,7 +2029,8 @@ static int bond_release_and_destroy(struct net_device *bond_dev,
+ int ret;
+
+ ret = __bond_release_one(bond_dev, slave_dev, false, true);
+- if (ret == 0 && !bond_has_slaves(bond)) {
++ if (ret == 0 && !bond_has_slaves(bond) &&
++ bond_dev->reg_state != NETREG_UNREGISTERING) {
+ bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
+ netdev_info(bond_dev, "Destroying bond %s\n",
+ bond_dev->name);
+@@ -2772,6 +2773,9 @@ static int bond_ab_arp_inspect(struct bonding *bond)
+ if (bond_time_in_interval(bond, last_rx, 1)) {
+ bond_propose_link_state(slave, BOND_LINK_UP);
+ commit++;
++ } else if (slave->link == BOND_LINK_BACK) {
++ bond_propose_link_state(slave, BOND_LINK_FAIL);
++ commit++;
+ }
+ continue;
+ }
+@@ -2882,6 +2886,19 @@ static void bond_ab_arp_commit(struct bonding *bond)
+
+ continue;
+
++ case BOND_LINK_FAIL:
++ bond_set_slave_link_state(slave, BOND_LINK_FAIL,
++ BOND_SLAVE_NOTIFY_NOW);
++ bond_set_slave_inactive_flags(slave,
++ BOND_SLAVE_NOTIFY_NOW);
++
++ /* A slave has just been enslaved and has become
++ * the current active slave.
++ */
++ if (rtnl_dereference(bond->curr_active_slave))
++ RCU_INIT_POINTER(bond->current_arp_slave, NULL);
++ continue;
++
+ default:
+ netdev_err(bond->dev, "impossible: new_link %d on slave %s\n",
+ slave->link_new_state, slave->dev->name);
+@@ -2931,8 +2948,6 @@ static bool bond_ab_arp_probe(struct bonding *bond)
+ return should_notify_rtnl;
+ }
+
+- bond_set_slave_inactive_flags(curr_arp_slave, BOND_SLAVE_NOTIFY_LATER);
+-
+ bond_for_each_slave_rcu(bond, slave, iter) {
+ if (!found && !before && bond_slave_is_up(slave))
+ before = slave;
+@@ -4200,13 +4215,23 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ return ret;
+ }
+
++static u32 bond_mode_bcast_speed(struct slave *slave, u32 speed)
++{
++ if (speed == 0 || speed == SPEED_UNKNOWN)
++ speed = slave->speed;
++ else
++ speed = min(speed, slave->speed);
++
++ return speed;
++}
++
+ static int bond_ethtool_get_link_ksettings(struct net_device *bond_dev,
+ struct ethtool_link_ksettings *cmd)
+ {
+ struct bonding *bond = netdev_priv(bond_dev);
+- unsigned long speed = 0;
+ struct list_head *iter;
+ struct slave *slave;
++ u32 speed = 0;
+
+ cmd->base.duplex = DUPLEX_UNKNOWN;
+ cmd->base.port = PORT_OTHER;
+@@ -4218,8 +4243,13 @@ static int bond_ethtool_get_link_ksettings(struct net_device *bond_dev,
+ */
+ bond_for_each_slave(bond, slave, iter) {
+ if (bond_slave_can_tx(slave)) {
+- if (slave->speed != SPEED_UNKNOWN)
+- speed += slave->speed;
++ if (slave->speed != SPEED_UNKNOWN) {
++ if (BOND_MODE(bond) == BOND_MODE_BROADCAST)
++ speed = bond_mode_bcast_speed(slave,
++ speed);
++ else
++ speed += slave->speed;
++ }
+ if (cmd->base.duplex == DUPLEX_UNKNOWN &&
+ slave->duplex != DUPLEX_UNKNOWN)
+ cmd->base.duplex = slave->duplex;
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 11f3993ab7f30..294be86420b6d 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1335,6 +1335,8 @@ static int b53_arl_op(struct b53_device *dev, int op, int port,
+ return ret;
+
+ switch (ret) {
++ case -ETIMEDOUT:
++ return ret;
+ case -ENOSPC:
+ dev_dbg(dev->dev, "{%pM,%.4d} no space left in ARL\n",
+ addr, vid);
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 8736718b17359..55cc70ba5b093 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2647,16 +2647,14 @@ static void ena_fw_reset_device(struct work_struct *work)
+ {
+ struct ena_adapter *adapter =
+ container_of(work, struct ena_adapter, reset_task);
+- struct pci_dev *pdev = adapter->pdev;
+
+- if (unlikely(!test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))) {
+- dev_err(&pdev->dev,
+- "device reset schedule while reset bit is off\n");
+- return;
+- }
+ rtnl_lock();
+- ena_destroy_device(adapter, false);
+- ena_restore_device(adapter);
++
++ if (likely(test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))) {
++ ena_destroy_device(adapter, false);
++ ena_restore_device(adapter);
++ }
++
+ rtnl_unlock();
+ }
+
+@@ -3392,8 +3390,11 @@ static void ena_remove(struct pci_dev *pdev)
+ netdev->rx_cpu_rmap = NULL;
+ }
+ #endif /* CONFIG_RFS_ACCEL */
+- del_timer_sync(&adapter->timer_service);
+
++ /* Make sure timer and reset routine won't be called after
++ * freeing device resources.
++ */
++ del_timer_sync(&adapter->timer_service);
+ cancel_work_sync(&adapter->reset_task);
+
+ unregister_netdev(netdev);
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index f402af39da42a..16de0fa92ab74 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -2392,7 +2392,7 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
+
+ dev_info(dev, "probe %s ID %d\n", dev_name(dev), id);
+
+- netdev = alloc_etherdev_mq(sizeof(*port), TX_QUEUE_NUM);
++ netdev = devm_alloc_etherdev_mqs(dev, sizeof(*port), TX_QUEUE_NUM, TX_QUEUE_NUM);
+ if (!netdev) {
+ dev_err(dev, "Can't allocate ethernet device #%d\n", id);
+ return -ENOMEM;
+@@ -2526,7 +2526,6 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
+ }
+
+ port->netdev = NULL;
+- free_netdev(netdev);
+ return ret;
+ }
+
+@@ -2535,7 +2534,6 @@ static int gemini_ethernet_port_remove(struct platform_device *pdev)
+ struct gemini_ethernet_port *port = platform_get_drvdata(pdev);
+
+ gemini_port_remove(port);
+- free_netdev(port->netdev);
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 48c58f93b124b..3b6da228140e3 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3659,11 +3659,11 @@ failed_mii_init:
+ failed_irq:
+ failed_init:
+ fec_ptp_stop(pdev);
+- if (fep->reg_phy)
+- regulator_disable(fep->reg_phy);
+ failed_reset:
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++ if (fep->reg_phy)
++ regulator_disable(fep->reg_phy);
+ failed_regulator:
+ clk_disable_unprepare(fep->clk_ahb);
+ failed_clk_ahb:
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
+index 80e3eec6134ee..a5e5e7e14e6c5 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
+@@ -1206,7 +1206,7 @@ struct i40e_aqc_set_vsi_promiscuous_modes {
+ #define I40E_AQC_SET_VSI_PROMISC_BROADCAST 0x04
+ #define I40E_AQC_SET_VSI_DEFAULT 0x08
+ #define I40E_AQC_SET_VSI_PROMISC_VLAN 0x10
+-#define I40E_AQC_SET_VSI_PROMISC_TX 0x8000
++#define I40E_AQC_SET_VSI_PROMISC_RX_ONLY 0x8000
+ __le16 seid;
+ #define I40E_AQC_VSI_PROM_CMD_SEID_MASK 0x3FF
+ __le16 vlan_tag;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
+index eb0ae6ab01e26..e75b4c4872c09 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
+@@ -1970,6 +1970,21 @@ i40e_status i40e_aq_set_phy_debug(struct i40e_hw *hw, u8 cmd_flags,
+ return status;
+ }
+
++/**
++ * i40e_is_aq_api_ver_ge
++ * @aq: pointer to AdminQ info containing HW API version to compare
++ * @maj: API major value
++ * @min: API minor value
++ *
++ * Assert whether current HW API version is greater/equal than provided.
++ **/
++static bool i40e_is_aq_api_ver_ge(struct i40e_adminq_info *aq, u16 maj,
++ u16 min)
++{
++ return (aq->api_maj_ver > maj ||
++ (aq->api_maj_ver == maj && aq->api_min_ver >= min));
++}
++
+ /**
+ * i40e_aq_add_vsi
+ * @hw: pointer to the hw struct
+@@ -2095,18 +2110,16 @@ i40e_status i40e_aq_set_vsi_unicast_promiscuous(struct i40e_hw *hw,
+
+ if (set) {
+ flags |= I40E_AQC_SET_VSI_PROMISC_UNICAST;
+- if (rx_only_promisc &&
+- (((hw->aq.api_maj_ver == 1) && (hw->aq.api_min_ver >= 5)) ||
+- (hw->aq.api_maj_ver > 1)))
+- flags |= I40E_AQC_SET_VSI_PROMISC_TX;
++ if (rx_only_promisc && i40e_is_aq_api_ver_ge(&hw->aq, 1, 5))
++ flags |= I40E_AQC_SET_VSI_PROMISC_RX_ONLY;
+ }
+
+ cmd->promiscuous_flags = cpu_to_le16(flags);
+
+ cmd->valid_flags = cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_UNICAST);
+- if (((hw->aq.api_maj_ver >= 1) && (hw->aq.api_min_ver >= 5)) ||
+- (hw->aq.api_maj_ver > 1))
+- cmd->valid_flags |= cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_TX);
++ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5))
++ cmd->valid_flags |=
++ cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_RX_ONLY);
+
+ cmd->seid = cpu_to_le16(seid);
+ status = i40e_asq_send_command(hw, &desc, NULL, 0, cmd_details);
+@@ -2203,11 +2216,17 @@ enum i40e_status_code i40e_aq_set_vsi_uc_promisc_on_vlan(struct i40e_hw *hw,
+ i40e_fill_default_direct_cmd_desc(&desc,
+ i40e_aqc_opc_set_vsi_promiscuous_modes);
+
+- if (enable)
++ if (enable) {
+ flags |= I40E_AQC_SET_VSI_PROMISC_UNICAST;
++ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5))
++ flags |= I40E_AQC_SET_VSI_PROMISC_RX_ONLY;
++ }
+
+ cmd->promiscuous_flags = cpu_to_le16(flags);
+ cmd->valid_flags = cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_UNICAST);
++ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5))
++ cmd->valid_flags |=
++ cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_RX_ONLY);
+ cmd->seid = cpu_to_le16(seid);
+ cmd->vlan_tag = cpu_to_le16(vid | I40E_AQC_SET_VSI_VLAN_VALID);
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index a74b01bf581e9..3200c75b9ed2a 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -14152,6 +14152,9 @@ static void i40e_remove(struct pci_dev *pdev)
+ i40e_write_rx_ctl(hw, I40E_PFQF_HENA(0), 0);
+ i40e_write_rx_ctl(hw, I40E_PFQF_HENA(1), 0);
+
++ while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state))
++ usleep_range(1000, 2000);
++
+ /* no more scheduling of any task */
+ set_bit(__I40E_SUSPENDED, pf->state);
+ set_bit(__I40E_DOWN, pf->state);
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index e33cbb793b638..4a5d99ecb89d3 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -513,7 +513,7 @@ static int netvsc_vf_xmit(struct net_device *net, struct net_device *vf_netdev,
+ int rc;
+
+ skb->dev = vf_netdev;
+- skb->queue_mapping = qdisc_skb_cb(skb)->slave_dev_queue_mapping;
++ skb_record_rx_queue(skb, qdisc_skb_cb(skb)->slave_dev_queue_mapping);
+
+ rc = dev_queue_xmit(skb);
+ if (likely(rc == NET_XMIT_SUCCESS || rc == NET_XMIT_CN)) {
+diff --git a/drivers/rtc/rtc-goldfish.c b/drivers/rtc/rtc-goldfish.c
+index a1c44d0c85578..30cbe22c57a8e 100644
+--- a/drivers/rtc/rtc-goldfish.c
++++ b/drivers/rtc/rtc-goldfish.c
+@@ -87,6 +87,7 @@ static int goldfish_rtc_set_alarm(struct device *dev,
+ rtc_alarm64 = rtc_alarm * NSEC_PER_SEC;
+ writel((rtc_alarm64 >> 32), base + TIMER_ALARM_HIGH);
+ writel(rtc_alarm64, base + TIMER_ALARM_LOW);
++ writel(1, base + TIMER_IRQ_ENABLED);
+ } else {
+ /*
+ * if this function was called with enabled=0
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index 91aa4bfcf8d61..5bb278a604ed2 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -403,7 +403,7 @@ static void zfcp_fsf_req_complete(struct zfcp_fsf_req *req)
+ return;
+ }
+
+- del_timer(&req->timer);
++ del_timer_sync(&req->timer);
+ zfcp_fsf_protstatus_eval(req);
+ zfcp_fsf_fsfstatus_eval(req);
+ req->handler(req);
+@@ -758,7 +758,7 @@ static int zfcp_fsf_req_send(struct zfcp_fsf_req *req)
+ req->qdio_req.qdio_outb_usage = atomic_read(&qdio->req_q_free);
+ req->issued = get_tod_clock();
+ if (zfcp_qdio_send(qdio, &req->qdio_req)) {
+- del_timer(&req->timer);
++ del_timer_sync(&req->timer);
+ /* lookup request again, list might have changed */
+ zfcp_reqlist_find_rm(adapter->req_list, req_id);
+ zfcp_erp_adapter_reopen(adapter, 0, "fsrs__1");
+diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c
+index 8839f509b19ab..78cf5b32bca67 100644
+--- a/drivers/scsi/libfc/fc_disc.c
++++ b/drivers/scsi/libfc/fc_disc.c
+@@ -593,8 +593,12 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp,
+
+ if (PTR_ERR(fp) == -FC_EX_CLOSED)
+ goto out;
+- if (IS_ERR(fp))
+- goto redisc;
++ if (IS_ERR(fp)) {
++ mutex_lock(&disc->disc_mutex);
++ fc_disc_restart(disc);
++ mutex_unlock(&disc->disc_mutex);
++ goto out;
++ }
+
+ cp = fc_frame_payload_get(fp, sizeof(*cp));
+ if (!cp)
+@@ -621,7 +625,7 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp,
+ new_rdata->disc_id = disc->disc_id;
+ fc_rport_login(new_rdata);
+ }
+- goto out;
++ goto free_fp;
+ }
+ rdata->disc_id = disc->disc_id;
+ mutex_unlock(&rdata->rp_mutex);
+@@ -638,6 +642,8 @@ redisc:
+ fc_disc_restart(disc);
+ mutex_unlock(&disc->disc_mutex);
+ }
++free_fp:
++ fc_frame_free(fp);
+ out:
+ kref_put(&rdata->kref, fc_rport_destroy);
+ if (!IS_ERR(fp))
+diff --git a/drivers/scsi/ufs/ufs_quirks.h b/drivers/scsi/ufs/ufs_quirks.h
+index 5d2dfdb41a6ff..758d3a67047df 100644
+--- a/drivers/scsi/ufs/ufs_quirks.h
++++ b/drivers/scsi/ufs/ufs_quirks.h
+@@ -21,6 +21,7 @@
+ #define UFS_ANY_VENDOR 0xFFFF
+ #define UFS_ANY_MODEL "ANY_MODEL"
+
++#define UFS_VENDOR_MICRON 0x12C
+ #define UFS_VENDOR_TOSHIBA 0x198
+ #define UFS_VENDOR_SAMSUNG 0x1CE
+ #define UFS_VENDOR_SKHYNIX 0x1AD
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index bd21c9cdf8183..ab628fd37e026 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -218,6 +218,8 @@ ufs_get_desired_pm_lvl_for_dev_link_state(enum ufs_dev_pwr_mode dev_state,
+
+ static struct ufs_dev_fix ufs_fixups[] = {
+ /* UFS cards deviations table */
++ UFS_FIX(UFS_VENDOR_MICRON, UFS_ANY_MODEL,
++ UFS_DEVICE_QUIRK_DELAY_BEFORE_LPM),
+ UFS_FIX(UFS_VENDOR_SAMSUNG, UFS_ANY_MODEL,
+ UFS_DEVICE_QUIRK_DELAY_BEFORE_LPM),
+ UFS_FIX(UFS_VENDOR_SAMSUNG, UFS_ANY_MODEL, UFS_DEVICE_NO_VCCQ),
+diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
+index 671d078349cc6..0a7fd56c1ed9d 100644
+--- a/drivers/spi/Kconfig
++++ b/drivers/spi/Kconfig
+@@ -817,4 +817,7 @@ config SPI_SLAVE_SYSTEM_CONTROL
+
+ endif # SPI_SLAVE
+
++config SPI_DYNAMIC
++ def_bool ACPI || OF_DYNAMIC || SPI_SLAVE
++
+ endif # SPI
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index f589d8100e957..92e6b6774d98e 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -432,6 +432,12 @@ static LIST_HEAD(spi_controller_list);
+ */
+ static DEFINE_MUTEX(board_lock);
+
++/*
++ * Prevents addition of devices with same chip select and
++ * addition of devices below an unregistering controller.
++ */
++static DEFINE_MUTEX(spi_add_lock);
++
+ /**
+ * spi_alloc_device - Allocate a new SPI device
+ * @ctlr: Controller to which device is connected
+@@ -510,7 +516,6 @@ static int spi_dev_check(struct device *dev, void *data)
+ */
+ int spi_add_device(struct spi_device *spi)
+ {
+- static DEFINE_MUTEX(spi_add_lock);
+ struct spi_controller *ctlr = spi->controller;
+ struct device *dev = ctlr->dev.parent;
+ int status;
+@@ -538,6 +543,13 @@ int spi_add_device(struct spi_device *spi)
+ goto done;
+ }
+
++ /* Controller may unregister concurrently */
++ if (IS_ENABLED(CONFIG_SPI_DYNAMIC) &&
++ !device_is_registered(&ctlr->dev)) {
++ status = -ENODEV;
++ goto done;
++ }
++
+ if (ctlr->cs_gpios)
+ spi->cs_gpio = ctlr->cs_gpios[spi->chip_select];
+
+@@ -2306,6 +2318,10 @@ void spi_unregister_controller(struct spi_controller *ctlr)
+ struct spi_controller *found;
+ int id = ctlr->bus_num;
+
++ /* Prevent addition of new devices, unregister existing ones */
++ if (IS_ENABLED(CONFIG_SPI_DYNAMIC))
++ mutex_lock(&spi_add_lock);
++
+ device_for_each_child(&ctlr->dev, NULL, __unregister);
+
+ /* First make sure that this controller was ever added */
+@@ -2326,6 +2342,9 @@ void spi_unregister_controller(struct spi_controller *ctlr)
+ if (found == ctlr)
+ idr_remove(&spi_master_idr, id);
+ mutex_unlock(&board_lock);
++
++ if (IS_ENABLED(CONFIG_SPI_DYNAMIC))
++ mutex_unlock(&spi_add_lock);
+ }
+ EXPORT_SYMBOL_GPL(spi_unregister_controller);
+
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 8da89925a874d..9c05e820857aa 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -612,7 +612,7 @@ static inline void tcmu_flush_dcache_range(void *vaddr, size_t size)
+ size = round_up(size+offset, PAGE_SIZE);
+
+ while (size) {
+- flush_dcache_page(virt_to_page(start));
++ flush_dcache_page(vmalloc_to_page(start));
+ start += PAGE_SIZE;
+ size -= PAGE_SIZE;
+ }
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index 6dbdadb936a89..52083b710b87e 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -1193,13 +1193,16 @@ static int vfio_bus_type(struct device *dev, void *data)
+ static int vfio_iommu_replay(struct vfio_iommu *iommu,
+ struct vfio_domain *domain)
+ {
+- struct vfio_domain *d;
++ struct vfio_domain *d = NULL;
+ struct rb_node *n;
+ unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
+ int ret;
+
+ /* Arbitrarily pick the first domain in the list for lookups */
+- d = list_first_entry(&iommu->domain_list, struct vfio_domain, next);
++ if (!list_empty(&iommu->domain_list))
++ d = list_first_entry(&iommu->domain_list,
++ struct vfio_domain, next);
++
+ n = rb_first(&iommu->dma_list);
+
+ for (; n; n = rb_next(n)) {
+@@ -1217,6 +1220,11 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu,
+ phys_addr_t p;
+ dma_addr_t i;
+
++ if (WARN_ON(!d)) { /* mapped w/o a domain?! */
++ ret = -EINVAL;
++ goto unwind;
++ }
++
+ phys = iommu_iova_to_phys(d->domain, iova);
+
+ if (WARN_ON(!phys)) {
+@@ -1246,7 +1254,7 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu,
+ if (npage <= 0) {
+ WARN_ON(!npage);
+ ret = (int)npage;
+- return ret;
++ goto unwind;
+ }
+
+ phys = pfn << PAGE_SHIFT;
+@@ -1255,14 +1263,67 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu,
+
+ ret = iommu_map(domain->domain, iova, phys,
+ size, dma->prot | domain->prot);
+- if (ret)
+- return ret;
++ if (ret) {
++ if (!dma->iommu_mapped)
++ vfio_unpin_pages_remote(dma, iova,
++ phys >> PAGE_SHIFT,
++ size >> PAGE_SHIFT,
++ true);
++ goto unwind;
++ }
+
+ iova += size;
+ }
++ }
++
++ /* All dmas are now mapped, defer to second tree walk for unwind */
++ for (n = rb_first(&iommu->dma_list); n; n = rb_next(n)) {
++ struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node);
++
+ dma->iommu_mapped = true;
+ }
++
+ return 0;
++
++unwind:
++ for (; n; n = rb_prev(n)) {
++ struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node);
++ dma_addr_t iova;
++
++ if (dma->iommu_mapped) {
++ iommu_unmap(domain->domain, dma->iova, dma->size);
++ continue;
++ }
++
++ iova = dma->iova;
++ while (iova < dma->iova + dma->size) {
++ phys_addr_t phys, p;
++ size_t size;
++ dma_addr_t i;
++
++ phys = iommu_iova_to_phys(domain->domain, iova);
++ if (!phys) {
++ iova += PAGE_SIZE;
++ continue;
++ }
++
++ size = PAGE_SIZE;
++ p = phys + size;
++ i = iova + size;
++ while (i < dma->iova + dma->size &&
++ p == iommu_iova_to_phys(domain->domain, i)) {
++ size += PAGE_SIZE;
++ p += PAGE_SIZE;
++ i += PAGE_SIZE;
++ }
++
++ iommu_unmap(domain->domain, iova, size);
++ vfio_unpin_pages_remote(dma, iova, phys >> PAGE_SHIFT,
++ size >> PAGE_SHIFT, true);
++ }
++ }
++
++ return ret;
+ }
+
+ /*
+diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
+index cc1006375cacb..f50cc1a7c31a9 100644
+--- a/drivers/video/fbdev/efifb.c
++++ b/drivers/video/fbdev/efifb.c
+@@ -449,7 +449,7 @@ static int efifb_probe(struct platform_device *dev)
+ info->apertures->ranges[0].base = efifb_fix.smem_start;
+ info->apertures->ranges[0].size = size_remap;
+
+- if (efi_enabled(EFI_BOOT) &&
++ if (efi_enabled(EFI_MEMMAP) &&
+ !efi_mem_desc_lookup(efifb_fix.smem_start, &md)) {
+ if ((efifb_fix.smem_start + efifb_fix.smem_len) >
+ (md.phys_addr + (md.num_pages << EFI_PAGE_SHIFT))) {
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 6228b48d1e127..df7980aef927a 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -828,6 +828,9 @@ bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx)
+ {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+
++ if (unlikely(vq->broken))
++ return false;
++
+ virtio_mb(vq->weak_barriers);
+ return (u16)last_used_idx != virtio16_to_cpu(_vq->vdev, vq->vring.used->idx);
+ }
+diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c
+index 5f6b77ea34fb5..128375ff80b8c 100644
+--- a/drivers/xen/preempt.c
++++ b/drivers/xen/preempt.c
+@@ -31,7 +31,7 @@ EXPORT_SYMBOL_GPL(xen_in_preemptible_hcall);
+ asmlinkage __visible void xen_maybe_preempt_hcall(void)
+ {
+ if (unlikely(__this_cpu_read(xen_in_preemptible_hcall)
+- && need_resched())) {
++ && need_resched() && !preempt_count())) {
+ /*
+ * Clear flag as we may be rescheduled on a different
+ * cpu.
+diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
+index 069273a2483f9..fc6c42eeb659c 100644
+--- a/fs/afs/dynroot.c
++++ b/fs/afs/dynroot.c
+@@ -299,15 +299,17 @@ void afs_dynroot_depopulate(struct super_block *sb)
+ net->dynroot_sb = NULL;
+ mutex_unlock(&net->proc_cells_lock);
+
+- inode_lock(root->d_inode);
+-
+- /* Remove all the pins for dirs created for manually added cells */
+- list_for_each_entry_safe(subdir, tmp, &root->d_subdirs, d_child) {
+- if (subdir->d_fsdata) {
+- subdir->d_fsdata = NULL;
+- dput(subdir);
++ if (root) {
++ inode_lock(root->d_inode);
++
++ /* Remove all the pins for dirs created for manually added cells */
++ list_for_each_entry_safe(subdir, tmp, &root->d_subdirs, d_child) {
++ if (subdir->d_fsdata) {
++ subdir->d_fsdata = NULL;
++ dput(subdir);
++ }
+ }
+- }
+
+- inode_unlock(root->d_inode);
++ inode_unlock(root->d_inode);
++ }
+ }
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 15cb96ad15d8c..554727d82d432 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -3271,6 +3271,8 @@ void btrfs_sysfs_remove_mounted(struct btrfs_fs_info *fs_info);
+ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
+ unsigned long new_flags);
+ int btrfs_sync_fs(struct super_block *sb, int wait);
++char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info,
++ u64 subvol_objectid);
+
+ static inline __printf(2, 3) __cold
+ void btrfs_no_printk(const struct btrfs_fs_info *fs_info, const char *fmt, ...)
+diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
+index 1f3755b3a37ae..665ec85cb09b8 100644
+--- a/fs/btrfs/export.c
++++ b/fs/btrfs/export.c
+@@ -57,9 +57,9 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len,
+ return type;
+ }
+
+-static struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid,
+- u64 root_objectid, u32 generation,
+- int check_generation)
++struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid,
++ u64 root_objectid, u32 generation,
++ int check_generation)
+ {
+ struct btrfs_fs_info *fs_info = btrfs_sb(sb);
+ struct btrfs_root *root;
+@@ -152,7 +152,7 @@ static struct dentry *btrfs_fh_to_dentry(struct super_block *sb, struct fid *fh,
+ return btrfs_get_dentry(sb, objectid, root_objectid, generation, 1);
+ }
+
+-static struct dentry *btrfs_get_parent(struct dentry *child)
++struct dentry *btrfs_get_parent(struct dentry *child)
+ {
+ struct inode *dir = d_inode(child);
+ struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb);
+diff --git a/fs/btrfs/export.h b/fs/btrfs/export.h
+index 57488ecd7d4ef..f32f4113c976a 100644
+--- a/fs/btrfs/export.h
++++ b/fs/btrfs/export.h
+@@ -18,4 +18,9 @@ struct btrfs_fid {
+ u64 parent_root_objectid;
+ } __attribute__ ((packed));
+
++struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid,
++ u64 root_objectid, u32 generation,
++ int check_generation);
++struct dentry *btrfs_get_parent(struct dentry *child);
++
+ #endif
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 1656ef0e959f0..bdfe159a60da6 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -628,7 +628,21 @@ cont:
+ PAGE_SET_WRITEBACK |
+ page_error_op |
+ PAGE_END_WRITEBACK);
+- goto free_pages_out;
++
++ /*
++ * Ensure we only free the compressed pages if we have
++ * them allocated, as we can still reach here with
++ * inode_need_compress() == false.
++ */
++ if (pages) {
++ for (i = 0; i < nr_pages; i++) {
++ WARN_ON(pages[i]->mapping);
++ put_page(pages[i]);
++ }
++ kfree(pages);
++ }
++
++ return;
+ }
+ }
+
+@@ -706,13 +720,6 @@ cleanup_and_bail_uncompressed:
+ *num_added += 1;
+
+ return;
+-
+-free_pages_out:
+- for (i = 0; i < nr_pages; i++) {
+- WARN_ON(pages[i]->mapping);
+- put_page(pages[i]);
+- }
+- kfree(pages);
+ }
+
+ static void free_async_extent_pages(struct async_extent *async_extent)
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index ed539496089f1..4d2810a32b4a9 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -1000,8 +1000,8 @@ out:
+ return error;
+ }
+
+-static char *get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info,
+- u64 subvol_objectid)
++char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info,
++ u64 subvol_objectid)
+ {
+ struct btrfs_root *root = fs_info->tree_root;
+ struct btrfs_root *fs_root;
+@@ -1282,6 +1282,7 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry)
+ {
+ struct btrfs_fs_info *info = btrfs_sb(dentry->d_sb);
+ const char *compress_type;
++ const char *subvol_name;
+
+ if (btrfs_test_opt(info, DEGRADED))
+ seq_puts(seq, ",degraded");
+@@ -1366,8 +1367,13 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry)
+ seq_puts(seq, ",ref_verify");
+ seq_printf(seq, ",subvolid=%llu",
+ BTRFS_I(d_inode(dentry))->root->root_key.objectid);
+- seq_puts(seq, ",subvol=");
+- seq_dentry(seq, dentry, " \t\n\\");
++ subvol_name = btrfs_get_subvol_name_from_objectid(info,
++ BTRFS_I(d_inode(dentry))->root->root_key.objectid);
++ if (!IS_ERR(subvol_name)) {
++ seq_puts(seq, ",subvol=");
++ seq_escape(seq, subvol_name, " \t\n\\");
++ kfree(subvol_name);
++ }
+ return 0;
+ }
+
+@@ -1412,8 +1418,8 @@ static struct dentry *mount_subvol(const char *subvol_name, u64 subvol_objectid,
+ goto out;
+ }
+ }
+- subvol_name = get_subvol_name_from_objectid(btrfs_sb(mnt->mnt_sb),
+- subvol_objectid);
++ subvol_name = btrfs_get_subvol_name_from_objectid(
++ btrfs_sb(mnt->mnt_sb), subvol_objectid);
+ if (IS_ERR(subvol_name)) {
+ root = ERR_CAST(subvol_name);
+ subvol_name = NULL;
+diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
+index aefb0169d46d7..afec808a763b1 100644
+--- a/fs/btrfs/sysfs.c
++++ b/fs/btrfs/sysfs.c
+@@ -10,6 +10,7 @@
+ #include <linux/kobject.h>
+ #include <linux/bug.h>
+ #include <linux/debugfs.h>
++#include <linux/sched/mm.h>
+
+ #include "ctree.h"
+ #include "disk-io.h"
+@@ -766,7 +767,9 @@ int btrfs_sysfs_add_device_link(struct btrfs_fs_devices *fs_devices,
+ {
+ int error = 0;
+ struct btrfs_device *dev;
++ unsigned int nofs_flag;
+
++ nofs_flag = memalloc_nofs_save();
+ list_for_each_entry(dev, &fs_devices->devices, dev_list) {
+ struct hd_struct *disk;
+ struct kobject *disk_kobj;
+@@ -785,6 +788,7 @@ int btrfs_sysfs_add_device_link(struct btrfs_fs_devices *fs_devices,
+ if (error)
+ break;
+ }
++ memalloc_nofs_restore(nofs_flag);
+
+ return error;
+ }
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index a2e903203bf9f..0fa14d8b9c64c 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -3682,7 +3682,6 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc)
+ return -ENOMEM;
+ }
+
+- fsc->mdsc = mdsc;
+ init_completion(&mdsc->safe_umount_waiters);
+ init_waitqueue_head(&mdsc->session_close_wq);
+ INIT_LIST_HEAD(&mdsc->waiting_for_map);
+@@ -3723,6 +3722,8 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc)
+
+ strscpy(mdsc->nodename, utsname()->nodename,
+ sizeof(mdsc->nodename));
++
++ fsc->mdsc = mdsc;
+ return 0;
+ }
+
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 58f48ea0db234..f988ccd064a22 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1890,9 +1890,11 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+ * not already there, and calling reverse_path_check()
+ * during ep_insert().
+ */
+- if (list_empty(&epi->ffd.file->f_tfile_llink))
++ if (list_empty(&epi->ffd.file->f_tfile_llink)) {
++ get_file(epi->ffd.file);
+ list_add(&epi->ffd.file->f_tfile_llink,
+ &tfile_check_list);
++ }
+ }
+ }
+ mutex_unlock(&ep->mtx);
+@@ -1936,6 +1938,7 @@ static void clear_tfile_check_list(void)
+ file = list_first_entry(&tfile_check_list, struct file,
+ f_tfile_llink);
+ list_del_init(&file->f_tfile_llink);
++ fput(file);
+ }
+ INIT_LIST_HEAD(&tfile_check_list);
+ }
+@@ -2091,13 +2094,13 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ mutex_lock(&epmutex);
+ if (is_file_epoll(tf.file)) {
+ error = -ELOOP;
+- if (ep_loop_check(ep, tf.file) != 0) {
+- clear_tfile_check_list();
++ if (ep_loop_check(ep, tf.file) != 0)
+ goto error_tgt_fput;
+- }
+- } else
++ } else {
++ get_file(tf.file);
+ list_add(&tf.file->f_tfile_llink,
+ &tfile_check_list);
++ }
+ mutex_lock_nested(&ep->mtx, 0);
+ if (is_file_epoll(tf.file)) {
+ tep = tf.file->private_data;
+@@ -2121,8 +2124,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ error = ep_insert(ep, &epds, tf.file, fd, full_check);
+ } else
+ error = -EEXIST;
+- if (full_check)
+- clear_tfile_check_list();
+ break;
+ case EPOLL_CTL_DEL:
+ if (epi)
+@@ -2145,8 +2146,10 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ mutex_unlock(&ep->mtx);
+
+ error_tgt_fput:
+- if (full_check)
++ if (full_check) {
++ clear_tfile_check_list();
+ mutex_unlock(&epmutex);
++ }
+
+ fdput(tf);
+ error_fput:
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index d203cc935ff83..552164034d340 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -68,7 +68,7 @@ static int add_system_zone(struct ext4_system_blocks *system_blks,
+ ext4_fsblk_t start_blk,
+ unsigned int count)
+ {
+- struct ext4_system_zone *new_entry = NULL, *entry;
++ struct ext4_system_zone *new_entry, *entry;
+ struct rb_node **n = &system_blks->root.rb_node, *node;
+ struct rb_node *parent = NULL, *new_node = NULL;
+
+@@ -79,30 +79,20 @@ static int add_system_zone(struct ext4_system_blocks *system_blks,
+ n = &(*n)->rb_left;
+ else if (start_blk >= (entry->start_blk + entry->count))
+ n = &(*n)->rb_right;
+- else {
+- if (start_blk + count > (entry->start_blk +
+- entry->count))
+- entry->count = (start_blk + count -
+- entry->start_blk);
+- new_node = *n;
+- new_entry = rb_entry(new_node, struct ext4_system_zone,
+- node);
+- break;
+- }
++ else /* Unexpected overlap of system zones. */
++ return -EFSCORRUPTED;
+ }
+
+- if (!new_entry) {
+- new_entry = kmem_cache_alloc(ext4_system_zone_cachep,
+- GFP_KERNEL);
+- if (!new_entry)
+- return -ENOMEM;
+- new_entry->start_blk = start_blk;
+- new_entry->count = count;
+- new_node = &new_entry->node;
+-
+- rb_link_node(new_node, parent, n);
+- rb_insert_color(new_node, &system_blks->root);
+- }
++ new_entry = kmem_cache_alloc(ext4_system_zone_cachep,
++ GFP_KERNEL);
++ if (!new_entry)
++ return -ENOMEM;
++ new_entry->start_blk = start_blk;
++ new_entry->count = count;
++ new_node = &new_entry->node;
++
++ rb_link_node(new_node, parent, n);
++ rb_insert_color(new_node, &system_blks->root);
+
+ /* Can we merge to the left? */
+ node = rb_prev(new_node);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index a8f2e3549bb95..186a2dd05bd87 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1309,8 +1309,8 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,
+ ext4_match(fname, de)) {
+ /* found a match - just to be sure, do
+ * a full check */
+- if (ext4_check_dir_entry(dir, NULL, de, bh, bh->b_data,
+- bh->b_size, offset))
++ if (ext4_check_dir_entry(dir, NULL, de, bh, search_buf,
++ buf_size, offset))
+ return -1;
+ *res_dir = de;
+ return 1;
+@@ -1732,7 +1732,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
+ blocksize, hinfo, map);
+ map -= count;
+ dx_sort_map(map, count);
+- /* Split the existing block in the middle, size-wise */
++ /* Ensure that neither split block is over half full */
+ size = 0;
+ move = 0;
+ for (i = count-1; i >= 0; i--) {
+@@ -1742,8 +1742,18 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
+ size += map[i].size;
+ move++;
+ }
+- /* map index at which we will split */
+- split = count - move;
++ /*
++ * map index at which we will split
++ *
++ * If the sum of active entries didn't exceed half the block size, just
++ * split it in half by count; each resulting block will have at least
++ * half the space free.
++ */
++ if (i > 0)
++ split = count - move;
++ else
++ split = count/2;
++
+ hash2 = map[split].hash;
+ continued = hash2 == map[split - 1].hash;
+ dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n",
+@@ -2344,7 +2354,7 @@ int ext4_generic_delete_entry(handle_t *handle,
+ de = (struct ext4_dir_entry_2 *)entry_buf;
+ while (i < buf_size - csum_size) {
+ if (ext4_check_dir_entry(dir, NULL, de, bh,
+- bh->b_data, bh->b_size, i))
++ entry_buf, buf_size, i))
+ return -EFSCORRUPTED;
+ if (de == de_del) {
+ if (pde)
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index a15a22d209090..8a50722bca29e 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1370,8 +1370,10 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)
+ int ret;
+
+ /* Buffer got discarded which means block device got invalidated */
+- if (!buffer_mapped(bh))
++ if (!buffer_mapped(bh)) {
++ unlock_buffer(bh);
+ return -EIO;
++ }
+
+ trace_jbd2_write_superblock(journal, write_flags);
+ if (!(journal->j_flags & JBD2_BARRIER))
+diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
+index f20cff1194bb6..776493713153f 100644
+--- a/fs/jffs2/dir.c
++++ b/fs/jffs2/dir.c
+@@ -590,10 +590,14 @@ static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry)
+ int ret;
+ uint32_t now = JFFS2_NOW();
+
++ mutex_lock(&f->sem);
+ for (fd = f->dents ; fd; fd = fd->next) {
+- if (fd->ino)
++ if (fd->ino) {
++ mutex_unlock(&f->sem);
+ return -ENOTEMPTY;
++ }
+ }
++ mutex_unlock(&f->sem);
+
+ ret = jffs2_do_unlink(c, dir_f, dentry->d_name.name,
+ dentry->d_name.len, f, now);
+diff --git a/fs/romfs/storage.c b/fs/romfs/storage.c
+index f86f51f99aceb..1dcadd22b440d 100644
+--- a/fs/romfs/storage.c
++++ b/fs/romfs/storage.c
+@@ -221,10 +221,8 @@ int romfs_dev_read(struct super_block *sb, unsigned long pos,
+ size_t limit;
+
+ limit = romfs_maxsize(sb);
+- if (pos >= limit)
++ if (pos >= limit || buflen > limit - pos)
+ return -EIO;
+- if (buflen > limit - pos)
+- buflen = limit - pos;
+
+ #ifdef CONFIG_ROMFS_ON_MTD
+ if (sb->s_mtd)
+diff --git a/fs/signalfd.c b/fs/signalfd.c
+index 4fcd1498acf52..3c40a3bf772ce 100644
+--- a/fs/signalfd.c
++++ b/fs/signalfd.c
+@@ -313,9 +313,10 @@ SYSCALL_DEFINE4(signalfd4, int, ufd, sigset_t __user *, user_mask,
+ {
+ sigset_t mask;
+
+- if (sizemask != sizeof(sigset_t) ||
+- copy_from_user(&mask, user_mask, sizeof(mask)))
++ if (sizemask != sizeof(sigset_t))
+ return -EINVAL;
++ if (copy_from_user(&mask, user_mask, sizeof(mask)))
++ return -EFAULT;
+ return do_signalfd4(ufd, &mask, flags);
+ }
+
+@@ -324,9 +325,10 @@ SYSCALL_DEFINE3(signalfd, int, ufd, sigset_t __user *, user_mask,
+ {
+ sigset_t mask;
+
+- if (sizemask != sizeof(sigset_t) ||
+- copy_from_user(&mask, user_mask, sizeof(mask)))
++ if (sizemask != sizeof(sigset_t))
+ return -EINVAL;
++ if (copy_from_user(&mask, user_mask, sizeof(mask)))
++ return -EFAULT;
+ return do_signalfd4(ufd, &mask, 0);
+ }
+
+diff --git a/fs/xfs/xfs_sysfs.h b/fs/xfs/xfs_sysfs.h
+index e9f810fc67317..43585850f1546 100644
+--- a/fs/xfs/xfs_sysfs.h
++++ b/fs/xfs/xfs_sysfs.h
+@@ -32,9 +32,11 @@ xfs_sysfs_init(
+ struct xfs_kobj *parent_kobj,
+ const char *name)
+ {
++ struct kobject *parent;
++
++ parent = parent_kobj ? &parent_kobj->kobject : NULL;
+ init_completion(&kobj->complete);
+- return kobject_init_and_add(&kobj->kobject, ktype,
+- &parent_kobj->kobject, "%s", name);
++ return kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name);
+ }
+
+ static inline void
+diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c
+index c23257a26c2b8..b8f05d5909b59 100644
+--- a/fs/xfs/xfs_trans_dquot.c
++++ b/fs/xfs/xfs_trans_dquot.c
+@@ -657,7 +657,7 @@ xfs_trans_dqresv(
+ }
+ }
+ if (ninos > 0) {
+- total_count = be64_to_cpu(dqp->q_core.d_icount) + ninos;
++ total_count = dqp->q_res_icount + ninos;
+ timer = be32_to_cpu(dqp->q_core.d_itimer);
+ warns = be16_to_cpu(dqp->q_core.d_iwarns);
+ warnlimit = dqp->q_mount->m_quotainfo->qi_iwarnlimit;
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index 087d18d771b53..b786eda90bb56 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -190,8 +190,15 @@ static void __kthread_parkme(struct kthread *self)
+ if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags))
+ break;
+
++ /*
++ * Thread is going to call schedule(), do not preempt it,
++ * or the caller of kthread_park() may spend more time in
++ * wait_task_inactive().
++ */
++ preempt_disable();
+ complete(&self->parked);
+- schedule();
++ schedule_preempt_disabled();
++ preempt_enable();
+ }
+ __set_current_state(TASK_RUNNING);
+ }
+@@ -236,8 +243,14 @@ static int kthread(void *_create)
+ /* OK, tell user we're spawned, wait for stop or wakeup */
+ __set_current_state(TASK_UNINTERRUPTIBLE);
+ create->result = current;
++ /*
++ * Thread is going to call schedule(), do not preempt it,
++ * or the creator may spend more time in wait_task_inactive().
++ */
++ preempt_disable();
+ complete(done);
+- schedule();
++ schedule_preempt_disabled();
++ preempt_enable();
+
+ ret = -EINTR;
+ if (!test_bit(KTHREAD_SHOULD_STOP, &self->flags)) {
+diff --git a/kernel/relay.c b/kernel/relay.c
+index 13c19f39e31e2..735cb208f023b 100644
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -197,6 +197,7 @@ free_buf:
+ static void relay_destroy_channel(struct kref *kref)
+ {
+ struct rchan *chan = container_of(kref, struct rchan, kref);
++ free_percpu(chan->buf);
+ kfree(chan);
+ }
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index e068c7f75a849..8a5708f31aa07 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4650,25 +4650,21 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr)
+ void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
+ unsigned long *start, unsigned long *end)
+ {
+- unsigned long check_addr = *start;
++ unsigned long a_start, a_end;
+
+ if (!(vma->vm_flags & VM_MAYSHARE))
+ return;
+
+- for (check_addr = *start; check_addr < *end; check_addr += PUD_SIZE) {
+- unsigned long a_start = check_addr & PUD_MASK;
+- unsigned long a_end = a_start + PUD_SIZE;
++ /* Extend the range to be PUD aligned for a worst case scenario */
++ a_start = ALIGN_DOWN(*start, PUD_SIZE);
++ a_end = ALIGN(*end, PUD_SIZE);
+
+- /*
+- * If sharing is possible, adjust start/end if necessary.
+- */
+- if (range_in_vma(vma, a_start, a_end)) {
+- if (a_start < *start)
+- *start = a_start;
+- if (a_end > *end)
+- *end = a_end;
+- }
+- }
++ /*
++ * Intersect the range with the vma range, since pmd sharing won't be
++ * across vma after all
++ */
++ *start = max(vma->vm_start, a_start);
++ *end = min(vma->vm_end, a_end);
+ }
+
+ /*
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index 483c4573695a9..f37be43f8caeb 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -394,7 +394,7 @@ static void insert_to_mm_slots_hash(struct mm_struct *mm,
+
+ static inline int khugepaged_test_exit(struct mm_struct *mm)
+ {
+- return atomic_read(&mm->mm_users) == 0;
++ return atomic_read(&mm->mm_users) == 0 || !mmget_still_valid(mm);
+ }
+
+ static bool hugepage_vma_check(struct vm_area_struct *vma,
+@@ -427,7 +427,7 @@ int __khugepaged_enter(struct mm_struct *mm)
+ return -ENOMEM;
+
+ /* __khugepaged_exit() must not run from under us */
+- VM_BUG_ON_MM(khugepaged_test_exit(mm), mm);
++ VM_BUG_ON_MM(atomic_read(&mm->mm_users) == 0, mm);
+ if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) {
+ free_mm_slot(mm_slot);
+ return 0;
+@@ -1005,9 +1005,6 @@ static void collapse_huge_page(struct mm_struct *mm,
+ * handled by the anon_vma lock + PG_lock.
+ */
+ down_write(&mm->mmap_sem);
+- result = SCAN_ANY_PROCESS;
+- if (!mmget_still_valid(mm))
+- goto out;
+ result = hugepage_vma_revalidate(mm, address, &vma);
+ if (result)
+ goto out;
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 7181dfe764405..5717ee66c8b38 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1115,6 +1115,11 @@ static void free_pcppages_bulk(struct zone *zone, int count,
+ struct page *page, *tmp;
+ LIST_HEAD(head);
+
++ /*
++ * Ensure proper count is passed which otherwise would stuck in the
++ * below while (list_empty(list)) loop.
++ */
++ count = min(pcp->count, count);
+ while (count) {
+ struct list_head *list;
+
+@@ -7395,7 +7400,7 @@ int __meminit init_per_zone_wmark_min(void)
+
+ return 0;
+ }
+-core_initcall(init_per_zone_wmark_min)
++postcore_initcall(init_per_zone_wmark_min)
+
+ /*
+ * min_free_kbytes_sysctl_handler - just a wrapper around proc_dointvec() so
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+index 16c8174658fd1..252495ff9010d 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+@@ -268,6 +268,8 @@ static int svc_rdma_post_recv(struct svcxprt_rdma *rdma)
+ {
+ struct svc_rdma_recv_ctxt *ctxt;
+
++ if (test_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags))
++ return 0;
+ ctxt = svc_rdma_recv_ctxt_get(rdma);
+ if (!ctxt)
+ return -ENOMEM;
+diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
+index 8f004db6f6034..1ee33d2e15bf8 100644
+--- a/scripts/kconfig/qconf.cc
++++ b/scripts/kconfig/qconf.cc
+@@ -869,40 +869,40 @@ void ConfigList::focusInEvent(QFocusEvent *e)
+
+ void ConfigList::contextMenuEvent(QContextMenuEvent *e)
+ {
+- if (e->y() <= header()->geometry().bottom()) {
+- if (!headerPopup) {
+- QAction *action;
+-
+- headerPopup = new QMenu(this);
+- action = new QAction("Show Name", this);
+- action->setCheckable(true);
+- connect(action, SIGNAL(toggled(bool)),
+- parent(), SLOT(setShowName(bool)));
+- connect(parent(), SIGNAL(showNameChanged(bool)),
+- action, SLOT(setOn(bool)));
+- action->setChecked(showName);
+- headerPopup->addAction(action);
+- action = new QAction("Show Range", this);
+- action->setCheckable(true);
+- connect(action, SIGNAL(toggled(bool)),
+- parent(), SLOT(setShowRange(bool)));
+- connect(parent(), SIGNAL(showRangeChanged(bool)),
+- action, SLOT(setOn(bool)));
+- action->setChecked(showRange);
+- headerPopup->addAction(action);
+- action = new QAction("Show Data", this);
+- action->setCheckable(true);
+- connect(action, SIGNAL(toggled(bool)),
+- parent(), SLOT(setShowData(bool)));
+- connect(parent(), SIGNAL(showDataChanged(bool)),
+- action, SLOT(setOn(bool)));
+- action->setChecked(showData);
+- headerPopup->addAction(action);
+- }
+- headerPopup->exec(e->globalPos());
+- e->accept();
+- } else
+- e->ignore();
++ if (!headerPopup) {
++ QAction *action;
++
++ headerPopup = new QMenu(this);
++ action = new QAction("Show Name", this);
++ action->setCheckable(true);
++ connect(action, SIGNAL(toggled(bool)),
++ parent(), SLOT(setShowName(bool)));
++ connect(parent(), SIGNAL(showNameChanged(bool)),
++ action, SLOT(setChecked(bool)));
++ action->setChecked(showName);
++ headerPopup->addAction(action);
++
++ action = new QAction("Show Range", this);
++ action->setCheckable(true);
++ connect(action, SIGNAL(toggled(bool)),
++ parent(), SLOT(setShowRange(bool)));
++ connect(parent(), SIGNAL(showRangeChanged(bool)),
++ action, SLOT(setChecked(bool)));
++ action->setChecked(showRange);
++ headerPopup->addAction(action);
++
++ action = new QAction("Show Data", this);
++ action->setCheckable(true);
++ connect(action, SIGNAL(toggled(bool)),
++ parent(), SLOT(setShowData(bool)));
++ connect(parent(), SIGNAL(showDataChanged(bool)),
++ action, SLOT(setChecked(bool)));
++ action->setChecked(showData);
++ headerPopup->addAction(action);
++ }
++
++ headerPopup->exec(e->globalPos());
++ e->accept();
+ }
+
+ ConfigView*ConfigView::viewList;
+@@ -1228,7 +1228,7 @@ QMenu* ConfigInfoView::createStandardContextMenu(const QPoint & pos)
+
+ action->setCheckable(true);
+ connect(action, SIGNAL(toggled(bool)), SLOT(setShowDebug(bool)));
+- connect(this, SIGNAL(showDebugChanged(bool)), action, SLOT(setOn(bool)));
++ connect(this, SIGNAL(showDebugChanged(bool)), action, SLOT(setChecked(bool)));
+ action->setChecked(showDebug());
+ popup->addSeparator();
+ popup->addAction(action);
+diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
+index cbdb6d4bb91ef..f4aba065c9257 100644
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -16,8 +16,8 @@
+
+ #define CDC_D_REVISION1 (0xf000)
+ #define CDC_D_PERPH_SUBTYPE (0xf005)
+-#define CDC_D_INT_EN_SET (0x015)
+-#define CDC_D_INT_EN_CLR (0x016)
++#define CDC_D_INT_EN_SET (0xf015)
++#define CDC_D_INT_EN_CLR (0xf016)
+ #define MBHC_SWITCH_INT BIT(7)
+ #define MBHC_MIC_ELECTRICAL_INS_REM_DET BIT(6)
+ #define MBHC_BUTTON_PRESS_DET BIT(5)
+diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+index 6868e71e3a3f0..0572c3c964506 100644
+--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+@@ -339,7 +339,7 @@ static int sst_media_open(struct snd_pcm_substream *substream,
+
+ ret_val = power_up_sst(stream);
+ if (ret_val < 0)
+- return ret_val;
++ goto out_power_up;
+
+ /* Make sure, that the period size is always even */
+ snd_pcm_hw_constraint_step(substream->runtime, 0,
+@@ -348,8 +348,9 @@ static int sst_media_open(struct snd_pcm_substream *substream,
+ return snd_pcm_hw_constraint_integer(runtime,
+ SNDRV_PCM_HW_PARAM_PERIODS);
+ out_ops:
+- kfree(stream);
+ mutex_unlock(&sst_lock);
++out_power_up:
++ kfree(stream);
+ return ret_val;
+ }
+
+diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
+index c6b51571be945..44eee18c658ae 100644
+--- a/sound/soc/qcom/qdsp6/q6routing.c
++++ b/sound/soc/qcom/qdsp6/q6routing.c
+@@ -968,6 +968,20 @@ static int msm_routing_probe(struct snd_soc_component *c)
+ return 0;
+ }
+
++static unsigned int q6routing_reg_read(struct snd_soc_component *component,
++ unsigned int reg)
++{
++ /* default value */
++ return 0;
++}
++
++static int q6routing_reg_write(struct snd_soc_component *component,
++ unsigned int reg, unsigned int val)
++{
++ /* dummy */
++ return 0;
++}
++
+ static const struct snd_soc_component_driver msm_soc_routing_component = {
+ .ops = &q6pcm_routing_ops,
+ .probe = msm_routing_probe,
+@@ -976,6 +990,8 @@ static const struct snd_soc_component_driver msm_soc_routing_component = {
+ .num_dapm_widgets = ARRAY_SIZE(msm_qdsp6_widgets),
+ .dapm_routes = intercon,
+ .num_dapm_routes = ARRAY_SIZE(intercon),
++ .read = q6routing_reg_read,
++ .write = q6routing_reg_write,
+ };
+
+ static int q6pcm_routing_probe(struct platform_device *pdev)
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index 60169196b9481..4da4ec2552463 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -1351,7 +1351,7 @@ int debuginfo__find_trace_events(struct debuginfo *dbg,
+ tf.ntevs = 0;
+
+ ret = debuginfo__find_probes(dbg, &tf.pf);
+- if (ret < 0) {
++ if (ret < 0 || tf.ntevs == 0) {
+ for (i = 0; i < tf.ntevs; i++)
+ clear_probe_trace_event(&tf.tevs[i]);
+ zfree(tevs);
+diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c
+index 075cb0c730149..90418d79ef676 100644
+--- a/tools/testing/selftests/cgroup/cgroup_util.c
++++ b/tools/testing/selftests/cgroup/cgroup_util.c
+@@ -95,7 +95,7 @@ int cg_read_strcmp(const char *cgroup, const char *control,
+
+ /* Handle the case of comparing against empty string */
+ if (!expected)
+- size = 32;
++ return -1;
+ else
+ size = strlen(expected) + 1;
+
+diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
+index a5bc10d30618f..41d6285c3da99 100644
+--- a/virt/kvm/arm/mmu.c
++++ b/virt/kvm/arm/mmu.c
+@@ -323,7 +323,8 @@ static void unmap_stage2_puds(struct kvm *kvm, pgd_t *pgd,
+ * destroying the VM), otherwise another faulting VCPU may come in and mess
+ * with things behind our backs.
+ */
+-static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
++static void __unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size,
++ bool may_block)
+ {
+ pgd_t *pgd;
+ phys_addr_t addr = start, end = start + size;
+@@ -348,11 +349,16 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
+ * If the range is too large, release the kvm->mmu_lock
+ * to prevent starvation and lockup detector warnings.
+ */
+- if (next != end)
++ if (may_block && next != end)
+ cond_resched_lock(&kvm->mmu_lock);
+ } while (pgd++, addr = next, addr != end);
+ }
+
++static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
++{
++ __unmap_stage2_range(kvm, start, size, true);
++}
++
+ static void stage2_flush_ptes(struct kvm *kvm, pmd_t *pmd,
+ phys_addr_t addr, phys_addr_t end)
+ {
+@@ -1820,18 +1826,20 @@ static int handle_hva_to_gpa(struct kvm *kvm,
+
+ static int kvm_unmap_hva_handler(struct kvm *kvm, gpa_t gpa, u64 size, void *data)
+ {
+- unmap_stage2_range(kvm, gpa, size);
++ bool may_block = *(bool *)data;
++
++ __unmap_stage2_range(kvm, gpa, size, may_block);
+ return 0;
+ }
+
+ int kvm_unmap_hva_range(struct kvm *kvm,
+- unsigned long start, unsigned long end)
++ unsigned long start, unsigned long end, bool blockable)
+ {
+ if (!kvm->arch.pgd)
+ return 0;
+
+ trace_kvm_unmap_hva_range(start, end);
+- handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, NULL);
++ handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, &blockable);
+ return 0;
+ }
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 1218ea663c6d2..2155b52b17eca 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -410,7 +410,7 @@ static int kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
+ * count is also read inside the mmu_lock critical section.
+ */
+ kvm->mmu_notifier_count++;
+- need_tlb_flush = kvm_unmap_hva_range(kvm, start, end);
++ need_tlb_flush = kvm_unmap_hva_range(kvm, start, end, blockable);
+ need_tlb_flush |= kvm->tlbs_dirty;
+ /* we've to flush the tlb before the pages can be freed */
+ if (need_tlb_flush)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-09-03 11:37 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-09-03 11:37 UTC (permalink / raw
To: gentoo-commits
commit: 9780c46f4fc87bbda21ddef0d0f91e988ef7eae5
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 3 11:37:07 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Sep 3 11:37:07 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9780c46f
Linux patch 4.19.143
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1142_linux-4.19.143.patch | 4522 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4526 insertions(+)
diff --git a/0000_README b/0000_README
index 4adb8c6..f31a3e5 100644
--- a/0000_README
+++ b/0000_README
@@ -607,6 +607,10 @@ Patch: 1141_linux-4.19.142.patch
From: https://www.kernel.org
Desc: Linux 4.19.142
+Patch: 1142_linux-4.19.143.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.143
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1142_linux-4.19.143.patch b/1142_linux-4.19.143.patch
new file mode 100644
index 0000000..8f19ed2
--- /dev/null
+++ b/1142_linux-4.19.143.patch
@@ -0,0 +1,4522 @@
+diff --git a/Makefile b/Makefile
+index e5e46aecf357f..6fa3278df77c9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 142
++SUBLEVEL = 143
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index 074b4ec520c63..d18c043264440 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -609,7 +609,7 @@
+ fsl,tmr-prsc = <2>;
+ fsl,tmr-add = <0xaaaaaaab>;
+ fsl,tmr-fiper1 = <999999995>;
+- fsl,tmr-fiper2 = <99990>;
++ fsl,tmr-fiper2 = <999999995>;
+ fsl,max-adj = <499999999>;
+ };
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
+index 60d218c5275c1..6754817658fa4 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi
+@@ -529,7 +529,7 @@
+ pins = "gpio63", "gpio64", "gpio65", "gpio66",
+ "gpio67", "gpio68";
+ drive-strength = <2>;
+- bias-disable;
++ bias-pull-down;
+ };
+ };
+ };
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index f3978931aaf40..3cdefd84af545 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -626,7 +626,7 @@ static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par,
+ * making sure it is a kernel address and not a PC-relative
+ * reference.
+ */
+- asm volatile("ldr %0, =__hyp_panic_string" : "=r" (str_va));
++ asm volatile("ldr %0, =%1" : "=r" (str_va) : "S" (__hyp_panic_string));
+
+ __hyp_do_panic(str_va,
+ spsr, elr,
+diff --git a/arch/mips/vdso/genvdso.c b/arch/mips/vdso/genvdso.c
+index 530a36f465ced..afcc86726448e 100644
+--- a/arch/mips/vdso/genvdso.c
++++ b/arch/mips/vdso/genvdso.c
+@@ -126,6 +126,7 @@ static void *map_vdso(const char *path, size_t *_size)
+ if (fstat(fd, &stat) != 0) {
+ fprintf(stderr, "%s: Failed to stat '%s': %s\n", program_name,
+ path, strerror(errno));
++ close(fd);
+ return NULL;
+ }
+
+@@ -134,6 +135,7 @@ static void *map_vdso(const char *path, size_t *_size)
+ if (addr == MAP_FAILED) {
+ fprintf(stderr, "%s: Failed to map '%s': %s\n", program_name,
+ path, strerror(errno));
++ close(fd);
+ return NULL;
+ }
+
+@@ -143,6 +145,7 @@ static void *map_vdso(const char *path, size_t *_size)
+ if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) {
+ fprintf(stderr, "%s: '%s' is not an ELF file\n", program_name,
+ path);
++ close(fd);
+ return NULL;
+ }
+
+@@ -154,6 +157,7 @@ static void *map_vdso(const char *path, size_t *_size)
+ default:
+ fprintf(stderr, "%s: '%s' has invalid ELF class\n",
+ program_name, path);
++ close(fd);
+ return NULL;
+ }
+
+@@ -165,6 +169,7 @@ static void *map_vdso(const char *path, size_t *_size)
+ default:
+ fprintf(stderr, "%s: '%s' has invalid ELF data order\n",
+ program_name, path);
++ close(fd);
+ return NULL;
+ }
+
+@@ -172,15 +177,18 @@ static void *map_vdso(const char *path, size_t *_size)
+ fprintf(stderr,
+ "%s: '%s' has invalid ELF machine (expected EM_MIPS)\n",
+ program_name, path);
++ close(fd);
+ return NULL;
+ } else if (swap_uint16(ehdr->e_type) != ET_DYN) {
+ fprintf(stderr,
+ "%s: '%s' has invalid ELF type (expected ET_DYN)\n",
+ program_name, path);
++ close(fd);
+ return NULL;
+ }
+
+ *_size = stat.st_size;
++ close(fd);
+ return addr;
+ }
+
+@@ -284,10 +292,12 @@ int main(int argc, char **argv)
+ /* Calculate and write symbol offsets to <output file> */
+ if (!get_symbols(dbg_vdso_path, dbg_vdso)) {
+ unlink(out_path);
++ fclose(out_file);
+ return EXIT_FAILURE;
+ }
+
+ fprintf(out_file, "};\n");
++ fclose(out_file);
+
+ return EXIT_SUCCESS;
+ }
+diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
+index 458b928dbd844..5bef78e2b4c14 100644
+--- a/arch/powerpc/kernel/cpu_setup_power.S
++++ b/arch/powerpc/kernel/cpu_setup_power.S
+@@ -183,7 +183,7 @@ __init_LPCR_ISA300:
+
+ __init_FSCR:
+ mfspr r3,SPRN_FSCR
+- ori r3,r3,FSCR_TAR|FSCR_DSCR|FSCR_EBB
++ ori r3,r3,FSCR_TAR|FSCR_EBB
+ mtspr SPRN_FSCR,r3
+ blr
+
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index 4004dbdab9c7b..d407b73298171 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -2087,6 +2087,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
+
+ if (perf_event_overflow(event, &data, regs))
+ power_pmu_stop(event, 0);
++ } else if (period) {
++ /* Account for interrupt in case of invalid SIAR */
++ if (perf_event_account_interrupt(event))
++ power_pmu_stop(event, 0);
+ }
+ }
+
+diff --git a/arch/powerpc/platforms/cell/Kconfig b/arch/powerpc/platforms/cell/Kconfig
+index 9f5958f169234..741a8fa8a3e6b 100644
+--- a/arch/powerpc/platforms/cell/Kconfig
++++ b/arch/powerpc/platforms/cell/Kconfig
+@@ -46,6 +46,7 @@ config SPU_FS
+ tristate "SPU file system"
+ default m
+ depends on PPC_CELL
++ depends on COREDUMP
+ select SPU_BASE
+ help
+ The SPU file system is used to access Synergistic Processing
+diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
+index cb1f51ad48e40..411f785cdfb51 100644
+--- a/arch/powerpc/sysdev/xive/native.c
++++ b/arch/powerpc/sysdev/xive/native.c
+@@ -22,6 +22,7 @@
+ #include <linux/delay.h>
+ #include <linux/cpumask.h>
+ #include <linux/mm.h>
++#include <linux/kmemleak.h>
+
+ #include <asm/prom.h>
+ #include <asm/io.h>
+@@ -627,6 +628,7 @@ static bool xive_native_provision_pages(void)
+ pr_err("Failed to allocate provisioning page\n");
+ return false;
+ }
++ kmemleak_ignore(p);
+ opal_xive_donate_page(chip, __pa(p));
+ }
+ return true;
+diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
+index da1de190a3b13..d89a757cbde0f 100644
+--- a/block/blk-mq-sched.c
++++ b/block/blk-mq-sched.c
+@@ -69,6 +69,15 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx)
+ return;
+ clear_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
+
++ /*
++ * Order clearing SCHED_RESTART and list_empty_careful(&hctx->dispatch)
++ * in blk_mq_run_hw_queue(). Its pair is the barrier in
++ * blk_mq_dispatch_rq_list(). So dispatch code won't see SCHED_RESTART,
++ * meantime new request added to hctx->dispatch is missed to check in
++ * blk_mq_run_hw_queue().
++ */
++ smp_mb();
++
+ blk_mq_run_hw_queue(hctx, true);
+ }
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 684acaa96db7e..db2db0b70d34f 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1221,6 +1221,15 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+ list_splice_init(list, &hctx->dispatch);
+ spin_unlock(&hctx->lock);
+
++ /*
++ * Order adding requests to hctx->dispatch and checking
++ * SCHED_RESTART flag. The pair of this smp_mb() is the one
++ * in blk_mq_sched_restart(). Avoid restart code path to
++ * miss the new added requests to hctx->dispatch, meantime
++ * SCHED_RESTART is observed here.
++ */
++ smp_mb();
++
+ /*
+ * If SCHED_RESTART was set by the caller of this function and
+ * it is no longer set that means that it was cleared by another
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 928fc1532a706..b911c38ad18ca 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -3333,9 +3333,9 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode)
+ */
+ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
+ {
+- if (fwnode) {
+- struct fwnode_handle *fn = dev->fwnode;
++ struct fwnode_handle *fn = dev->fwnode;
+
++ if (fwnode) {
+ if (fwnode_is_primary(fn))
+ fn = fn->secondary;
+
+@@ -3345,8 +3345,12 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
+ }
+ dev->fwnode = fwnode;
+ } else {
+- dev->fwnode = fwnode_is_primary(dev->fwnode) ?
+- dev->fwnode->secondary : NULL;
++ if (fwnode_is_primary(fn)) {
++ dev->fwnode = fn->secondary;
++ fn->secondary = NULL;
++ } else {
++ dev->fwnode = NULL;
++ }
+ }
+ }
+ EXPORT_SYMBOL_GPL(set_primary_fwnode);
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 3b382a7e07b20..da413b95afabf 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -1751,13 +1751,17 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
+ }
+
+ /*
+- * If a device configured to wake up the system from sleep states
+- * has been suspended at run time and there's a resume request pending
+- * for it, this is equivalent to the device signaling wakeup, so the
+- * system suspend operation should be aborted.
++ * Wait for possible runtime PM transitions of the device in progress
++ * to complete and if there's a runtime resume request pending for it,
++ * resume it before proceeding with invoking the system-wide suspend
++ * callbacks for it.
++ *
++ * If the system-wide suspend callbacks below change the configuration
++ * of the device, they must disable runtime PM for it or otherwise
++ * ensure that its runtime-resume callbacks will not be confused by that
++ * change in case they are invoked going forward.
+ */
+- if (pm_runtime_barrier(dev) && device_may_wakeup(dev))
+- pm_wakeup_event(dev, 0);
++ pm_runtime_barrier(dev);
+
+ if (pm_wakeup_pending()) {
+ dev->power.direct_complete = false;
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index da68c42aed682..19042b42a8baf 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -864,6 +864,7 @@ static void loop_config_discard(struct loop_device *lo)
+ struct file *file = lo->lo_backing_file;
+ struct inode *inode = file->f_mapping->host;
+ struct request_queue *q = lo->lo_queue;
++ u32 granularity, max_discard_sectors;
+
+ /*
+ * If the backing device is a block device, mirror its zeroing
+@@ -876,11 +877,10 @@ static void loop_config_discard(struct loop_device *lo)
+ struct request_queue *backingq;
+
+ backingq = bdev_get_queue(inode->i_bdev);
+- blk_queue_max_discard_sectors(q,
+- backingq->limits.max_write_zeroes_sectors);
+
+- blk_queue_max_write_zeroes_sectors(q,
+- backingq->limits.max_write_zeroes_sectors);
++ max_discard_sectors = backingq->limits.max_write_zeroes_sectors;
++ granularity = backingq->limits.discard_granularity ?:
++ queue_physical_block_size(backingq);
+
+ /*
+ * We use punch hole to reclaim the free space used by the
+@@ -889,23 +889,26 @@ static void loop_config_discard(struct loop_device *lo)
+ * useful information.
+ */
+ } else if (!file->f_op->fallocate || lo->lo_encrypt_key_size) {
+- q->limits.discard_granularity = 0;
+- q->limits.discard_alignment = 0;
+- blk_queue_max_discard_sectors(q, 0);
+- blk_queue_max_write_zeroes_sectors(q, 0);
++ max_discard_sectors = 0;
++ granularity = 0;
+
+ } else {
+- q->limits.discard_granularity = inode->i_sb->s_blocksize;
+- q->limits.discard_alignment = 0;
+-
+- blk_queue_max_discard_sectors(q, UINT_MAX >> 9);
+- blk_queue_max_write_zeroes_sectors(q, UINT_MAX >> 9);
++ max_discard_sectors = UINT_MAX >> 9;
++ granularity = inode->i_sb->s_blocksize;
+ }
+
+- if (q->limits.max_write_zeroes_sectors)
++ if (max_discard_sectors) {
++ q->limits.discard_granularity = granularity;
++ blk_queue_max_discard_sectors(q, max_discard_sectors);
++ blk_queue_max_write_zeroes_sectors(q, max_discard_sectors);
+ blk_queue_flag_set(QUEUE_FLAG_DISCARD, q);
+- else
++ } else {
++ q->limits.discard_granularity = 0;
++ blk_queue_max_discard_sectors(q, 0);
++ blk_queue_max_write_zeroes_sectors(q, 0);
+ blk_queue_flag_clear(QUEUE_FLAG_DISCARD, q);
++ }
++ q->limits.discard_alignment = 0;
+ }
+
+ static void loop_unprepare_queue(struct loop_device *lo)
+diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
+index d2d7dc9cd58d2..4fef1fb918ece 100644
+--- a/drivers/block/null_blk_main.c
++++ b/drivers/block/null_blk_main.c
+@@ -1086,7 +1086,7 @@ static int null_handle_rq(struct nullb_cmd *cmd)
+ len = bvec.bv_len;
+ err = null_transfer(nullb, bvec.bv_page, len, bvec.bv_offset,
+ op_is_write(req_op(rq)), sector,
+- req_op(rq) & REQ_FUA);
++ rq->cmd_flags & REQ_FUA);
+ if (err) {
+ spin_unlock_irq(&nullb->lock);
+ return err;
+diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
+index 4946c5b37d04d..f79f877942733 100644
+--- a/drivers/char/tpm/tpm-chip.c
++++ b/drivers/char/tpm/tpm-chip.c
+@@ -276,13 +276,8 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev,
+ chip->cdev.owner = THIS_MODULE;
+ chip->cdevs.owner = THIS_MODULE;
+
+- chip->work_space.context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
+- if (!chip->work_space.context_buf) {
+- rc = -ENOMEM;
+- goto out;
+- }
+- chip->work_space.session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
+- if (!chip->work_space.session_buf) {
++ rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE);
++ if (rc) {
+ rc = -ENOMEM;
+ goto out;
+ }
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index 289221d653cb2..b9a30f0b88257 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -188,6 +188,7 @@ struct tpm_space {
+ u8 *context_buf;
+ u32 session_tbl[3];
+ u8 *session_buf;
++ u32 buf_size;
+ };
+
+ enum tpm_chip_flags {
+@@ -278,6 +279,9 @@ struct tpm_output_header {
+
+ #define TPM_TAG_RQU_COMMAND 193
+
++/* TPM2 specific constants. */
++#define TPM2_SPACE_BUFFER_SIZE 16384 /* 16 kB */
++
+ struct stclear_flags_t {
+ __be16 tag;
+ u8 deactivated;
+@@ -595,7 +599,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type);
+ unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal);
+ int tpm2_probe(struct tpm_chip *chip);
+ int tpm2_find_cc(struct tpm_chip *chip, u32 cc);
+-int tpm2_init_space(struct tpm_space *space);
++int tpm2_init_space(struct tpm_space *space, unsigned int buf_size);
+ void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space);
+ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc,
+ u8 *cmd);
+diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
+index d2e101b32482f..9f4e22dcde270 100644
+--- a/drivers/char/tpm/tpm2-space.c
++++ b/drivers/char/tpm/tpm2-space.c
+@@ -43,18 +43,21 @@ static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space)
+ }
+ }
+
+-int tpm2_init_space(struct tpm_space *space)
++int tpm2_init_space(struct tpm_space *space, unsigned int buf_size)
+ {
+- space->context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
++ space->context_buf = kzalloc(buf_size, GFP_KERNEL);
+ if (!space->context_buf)
+ return -ENOMEM;
+
+- space->session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
++ space->session_buf = kzalloc(buf_size, GFP_KERNEL);
+ if (space->session_buf == NULL) {
+ kfree(space->context_buf);
++ /* Prevent caller getting a dangling pointer. */
++ space->context_buf = NULL;
+ return -ENOMEM;
+ }
+
++ space->buf_size = buf_size;
+ return 0;
+ }
+
+@@ -276,8 +279,10 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc,
+ sizeof(space->context_tbl));
+ memcpy(&chip->work_space.session_tbl, &space->session_tbl,
+ sizeof(space->session_tbl));
+- memcpy(chip->work_space.context_buf, space->context_buf, PAGE_SIZE);
+- memcpy(chip->work_space.session_buf, space->session_buf, PAGE_SIZE);
++ memcpy(chip->work_space.context_buf, space->context_buf,
++ space->buf_size);
++ memcpy(chip->work_space.session_buf, space->session_buf,
++ space->buf_size);
+
+ rc = tpm2_load_space(chip);
+ if (rc) {
+@@ -456,7 +461,7 @@ static int tpm2_save_space(struct tpm_chip *chip)
+ continue;
+
+ rc = tpm2_save_context(chip, space->context_tbl[i],
+- space->context_buf, PAGE_SIZE,
++ space->context_buf, space->buf_size,
+ &offset);
+ if (rc == -ENOENT) {
+ space->context_tbl[i] = 0;
+@@ -474,9 +479,8 @@ static int tpm2_save_space(struct tpm_chip *chip)
+ continue;
+
+ rc = tpm2_save_context(chip, space->session_tbl[i],
+- space->session_buf, PAGE_SIZE,
++ space->session_buf, space->buf_size,
+ &offset);
+-
+ if (rc == -ENOENT) {
+ /* handle error saving session, just forget it */
+ space->session_tbl[i] = 0;
+@@ -522,8 +526,10 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space,
+ sizeof(space->context_tbl));
+ memcpy(&space->session_tbl, &chip->work_space.session_tbl,
+ sizeof(space->session_tbl));
+- memcpy(space->context_buf, chip->work_space.context_buf, PAGE_SIZE);
+- memcpy(space->session_buf, chip->work_space.session_buf, PAGE_SIZE);
++ memcpy(space->context_buf, chip->work_space.context_buf,
++ space->buf_size);
++ memcpy(space->session_buf, chip->work_space.session_buf,
++ space->buf_size);
+
+ return 0;
+ }
+diff --git a/drivers/char/tpm/tpmrm-dev.c b/drivers/char/tpm/tpmrm-dev.c
+index 1a0e97a5da5a4..162fb16243d03 100644
+--- a/drivers/char/tpm/tpmrm-dev.c
++++ b/drivers/char/tpm/tpmrm-dev.c
+@@ -22,7 +22,7 @@ static int tpmrm_open(struct inode *inode, struct file *file)
+ if (priv == NULL)
+ return -ENOMEM;
+
+- rc = tpm2_init_space(&priv->space);
++ rc = tpm2_init_space(&priv->space, TPM2_SPACE_BUFFER_SIZE);
+ if (rc) {
+ kfree(priv);
+ return -ENOMEM;
+diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
+index aac9b9b360b80..9e4781a807cfa 100644
+--- a/drivers/edac/ie31200_edac.c
++++ b/drivers/edac/ie31200_edac.c
+@@ -147,6 +147,8 @@
+ (n << (28 + (2 * skl) - PAGE_SHIFT))
+
+ static int nr_channels;
++static struct pci_dev *mci_pdev;
++static int ie31200_registered = 1;
+
+ struct ie31200_priv {
+ void __iomem *window;
+@@ -518,12 +520,16 @@ fail_free:
+ static int ie31200_init_one(struct pci_dev *pdev,
+ const struct pci_device_id *ent)
+ {
+- edac_dbg(0, "MC:\n");
++ int rc;
+
++ edac_dbg(0, "MC:\n");
+ if (pci_enable_device(pdev) < 0)
+ return -EIO;
++ rc = ie31200_probe1(pdev, ent->driver_data);
++ if (rc == 0 && !mci_pdev)
++ mci_pdev = pci_dev_get(pdev);
+
+- return ie31200_probe1(pdev, ent->driver_data);
++ return rc;
+ }
+
+ static void ie31200_remove_one(struct pci_dev *pdev)
+@@ -532,6 +538,8 @@ static void ie31200_remove_one(struct pci_dev *pdev)
+ struct ie31200_priv *priv;
+
+ edac_dbg(0, "\n");
++ pci_dev_put(mci_pdev);
++ mci_pdev = NULL;
+ mci = edac_mc_del_mc(&pdev->dev);
+ if (!mci)
+ return;
+@@ -583,17 +591,53 @@ static struct pci_driver ie31200_driver = {
+
+ static int __init ie31200_init(void)
+ {
++ int pci_rc, i;
++
+ edac_dbg(3, "MC:\n");
+ /* Ensure that the OPSTATE is set correctly for POLL or NMI */
+ opstate_init();
+
+- return pci_register_driver(&ie31200_driver);
++ pci_rc = pci_register_driver(&ie31200_driver);
++ if (pci_rc < 0)
++ goto fail0;
++
++ if (!mci_pdev) {
++ ie31200_registered = 0;
++ for (i = 0; ie31200_pci_tbl[i].vendor != 0; i++) {
++ mci_pdev = pci_get_device(ie31200_pci_tbl[i].vendor,
++ ie31200_pci_tbl[i].device,
++ NULL);
++ if (mci_pdev)
++ break;
++ }
++ if (!mci_pdev) {
++ edac_dbg(0, "ie31200 pci_get_device fail\n");
++ pci_rc = -ENODEV;
++ goto fail1;
++ }
++ pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]);
++ if (pci_rc < 0) {
++ edac_dbg(0, "ie31200 init fail\n");
++ pci_rc = -ENODEV;
++ goto fail1;
++ }
++ }
++ return 0;
++
++fail1:
++ pci_unregister_driver(&ie31200_driver);
++fail0:
++ pci_dev_put(mci_pdev);
++
++ return pci_rc;
+ }
+
+ static void __exit ie31200_exit(void)
+ {
+ edac_dbg(3, "MC:\n");
+ pci_unregister_driver(&ie31200_driver);
++ if (!ie31200_registered)
++ ie31200_remove_one(mci_pdev);
+ }
+
+ module_init(ie31200_init);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+index c770d73352a79..c15286858f0bf 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -718,8 +718,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (encoder) {
+@@ -856,8 +858,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ encoder = amdgpu_connector_best_single_encoder(connector);
+@@ -979,8 +983,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
+@@ -1329,8 +1335,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+index 686a26de50f91..049a1961c3fa5 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+@@ -275,7 +275,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
+
+ ret = pm_runtime_get_sync(dev->dev);
+ if (ret < 0)
+- return ret;
++ goto out;
+
+ ret = drm_crtc_helper_set_config(set, ctx);
+
+@@ -290,7 +290,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
+ take the current one */
+ if (active && !adev->have_disp_power_ref) {
+ adev->have_disp_power_ref = true;
+- return ret;
++ goto out;
+ }
+ /* if we have no active crtcs, then drop the power ref
+ we got before */
+@@ -299,6 +299,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
+ adev->have_disp_power_ref = false;
+ }
+
++out:
+ /* drop the power reference we got coming in here */
+ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 5e29f14f4b301..63b1e325b45c5 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1085,11 +1085,12 @@ long amdgpu_drm_ioctl(struct file *filp,
+ dev = file_priv->minor->dev;
+ ret = pm_runtime_get_sync(dev->dev);
+ if (ret < 0)
+- return ret;
++ goto out;
+
+ ret = drm_ioctl(filp, cmd, arg);
+
+ pm_runtime_mark_last_busy(dev->dev);
++out:
+ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index bb41936df0d97..dd9b8feb3a666 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -524,8 +524,12 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ * in the bitfields */
+ if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK)
+ se_num = 0xffffffff;
++ else if (se_num >= AMDGPU_GFX_MAX_SE)
++ return -EINVAL;
+ if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK)
+ sh_num = 0xffffffff;
++ else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE)
++ return -EINVAL;
+
+ if (info->read_mmr_reg.count > 128)
+ return -EINVAL;
+@@ -835,7 +839,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
+
+ r = pm_runtime_get_sync(dev->dev);
+ if (r < 0)
+- return r;
++ goto pm_put;
+
+ fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
+ if (unlikely(!fpriv)) {
+@@ -883,6 +887,7 @@ error_pasid:
+
+ out_suspend:
+ pm_runtime_mark_last_busy(dev->dev);
++pm_put:
+ pm_runtime_put_autosuspend(dev->dev);
+
+ return r;
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+index 0805c423a5ce0..5cf499a07806a 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -592,8 +592,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
+
+ ret = kobject_init_and_add(dev->kobj_node, &node_type,
+ sys_props.kobj_nodes, "%d", id);
+- if (ret < 0)
++ if (ret < 0) {
++ kobject_put(dev->kobj_node);
+ return ret;
++ }
+
+ dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node);
+ if (!dev->kobj_mem)
+@@ -640,8 +642,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
+ return -ENOMEM;
+ ret = kobject_init_and_add(mem->kobj, &mem_type,
+ dev->kobj_mem, "%d", i);
+- if (ret < 0)
++ if (ret < 0) {
++ kobject_put(mem->kobj);
+ return ret;
++ }
+
+ mem->attr.name = "properties";
+ mem->attr.mode = KFD_SYSFS_FILE_MODE;
+@@ -659,8 +663,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
+ return -ENOMEM;
+ ret = kobject_init_and_add(cache->kobj, &cache_type,
+ dev->kobj_cache, "%d", i);
+- if (ret < 0)
++ if (ret < 0) {
++ kobject_put(cache->kobj);
+ return ret;
++ }
+
+ cache->attr.name = "properties";
+ cache->attr.mode = KFD_SYSFS_FILE_MODE;
+@@ -678,8 +684,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
+ return -ENOMEM;
+ ret = kobject_init_and_add(iolink->kobj, &iolink_type,
+ dev->kobj_iolink, "%d", i);
+- if (ret < 0)
++ if (ret < 0) {
++ kobject_put(iolink->kobj);
+ return ret;
++ }
+
+ iolink->attr.name = "properties";
+ iolink->attr.mode = KFD_SYSFS_FILE_MODE;
+@@ -759,8 +767,10 @@ static int kfd_topology_update_sysfs(void)
+ ret = kobject_init_and_add(sys_props.kobj_topology,
+ &sysprops_type, &kfd_device->kobj,
+ "topology");
+- if (ret < 0)
++ if (ret < 0) {
++ kobject_put(sys_props.kobj_topology);
+ return ret;
++ }
+
+ sys_props.kobj_nodes = kobject_create_and_add("nodes",
+ sys_props.kobj_topology);
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
+index aa044c1955fe0..a2b2a6c67cda1 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
+@@ -362,6 +362,9 @@ int vega10_thermal_get_temperature(struct pp_hwmgr *hwmgr)
+ static int vega10_thermal_set_temperature_range(struct pp_hwmgr *hwmgr,
+ struct PP_TemperatureRange *range)
+ {
++ struct phm_ppt_v2_information *pp_table_info =
++ (struct phm_ppt_v2_information *)(hwmgr->pptable);
++ struct phm_tdp_table *tdp_table = pp_table_info->tdp_table;
+ struct amdgpu_device *adev = hwmgr->adev;
+ int low = VEGA10_THERMAL_MINIMUM_ALERT_TEMP *
+ PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+@@ -371,8 +374,8 @@ static int vega10_thermal_set_temperature_range(struct pp_hwmgr *hwmgr,
+
+ if (low < range->min)
+ low = range->min;
+- if (high > range->max)
+- high = range->max;
++ if (high > tdp_table->usSoftwareShutdownTemp)
++ high = tdp_table->usSoftwareShutdownTemp;
+
+ if (low > high)
+ return -EINVAL;
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c
+index 904eb2c9155b4..601a596e94f02 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c
+@@ -170,6 +170,8 @@ int vega12_thermal_get_temperature(struct pp_hwmgr *hwmgr)
+ static int vega12_thermal_set_temperature_range(struct pp_hwmgr *hwmgr,
+ struct PP_TemperatureRange *range)
+ {
++ struct phm_ppt_v3_information *pptable_information =
++ (struct phm_ppt_v3_information *)hwmgr->pptable;
+ struct amdgpu_device *adev = hwmgr->adev;
+ int low = VEGA12_THERMAL_MINIMUM_ALERT_TEMP *
+ PP_TEMPERATURE_UNITS_PER_CENTIGRADES;
+@@ -179,8 +181,8 @@ static int vega12_thermal_set_temperature_range(struct pp_hwmgr *hwmgr,
+
+ if (low < range->min)
+ low = range->min;
+- if (high > range->max)
+- high = range->max;
++ if (high > pptable_information->us_software_shutdown_temp)
++ high = pptable_information->us_software_shutdown_temp;
+
+ if (low > high)
+ return -EINVAL;
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index 93d70f4a2154e..c9f831604558f 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -221,7 +221,7 @@ int adreno_hw_init(struct msm_gpu *gpu)
+ ring->next = ring->start;
+
+ /* reset completed fence seqno: */
+- ring->memptrs->fence = ring->seqno;
++ ring->memptrs->fence = ring->fctx->completed_fence;
+ ring->memptrs->rptr = 0;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index 10107e551fac3..e06ea8c8184cb 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -1920,8 +1920,10 @@ nv50_disp_atomic_commit(struct drm_device *dev,
+ int ret, i;
+
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return ret;
++ }
+
+ ret = drm_atomic_helper_setup_commit(state, nonblock);
+ if (ret)
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index fb0094fc55834..b71afde8f115a 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -551,8 +551,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
+ pm_runtime_get_noresume(dev->dev);
+ } else {
+ ret = pm_runtime_get_sync(dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(dev->dev);
+ return conn_status;
++ }
+ }
+
+ nv_encoder = nouveau_connector_ddc_detect(connector);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+index 406cb99af7f21..d4fe52ec4c966 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+@@ -189,8 +189,10 @@ nouveau_fbcon_open(struct fb_info *info, int user)
+ struct nouveau_fbdev *fbcon = info->par;
+ struct nouveau_drm *drm = nouveau_drm(fbcon->helper.dev);
+ int ret = pm_runtime_get_sync(drm->dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put(drm->dev->dev);
+ return ret;
++ }
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index de656f5553839..b9927101e8450 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -882,8 +882,10 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (encoder) {
+@@ -1028,8 +1030,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ encoder = radeon_best_single_encoder(connector);
+@@ -1166,8 +1170,10 @@ radeon_tv_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ encoder = radeon_best_single_encoder(connector);
+@@ -1250,8 +1256,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (radeon_connector->detected_hpd_without_ddc) {
+@@ -1665,8 +1673,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
+
+ if (!drm_kms_helper_is_poll_worker()) {
+ r = pm_runtime_get_sync(connector->dev->dev);
+- if (r < 0)
++ if (r < 0) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+ }
+
+ if (!force && radeon_check_hpd_status_unchanged(connector)) {
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 20530d8adfbb8..2c100b73d3fc1 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -756,6 +756,7 @@
+ #define USB_DEVICE_ID_LOGITECH_G27_WHEEL 0xc29b
+ #define USB_DEVICE_ID_LOGITECH_WII_WHEEL 0xc29c
+ #define USB_DEVICE_ID_LOGITECH_ELITE_KBD 0xc30a
++#define USB_DEVICE_ID_LOGITECH_GROUP_AUDIO 0x0882
+ #define USB_DEVICE_ID_S510_RECEIVER 0xc50c
+ #define USB_DEVICE_ID_S510_RECEIVER_2 0xc517
+ #define USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500 0xc512
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index bdde16395b2ce..62f87f8bd9720 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -179,6 +179,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD2, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE), HID_QUIRK_MULTI_INPUT },
++ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_GROUP_AUDIO), HID_QUIRK_NOGET },
+
+ { 0 }
+ };
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index f17ebbe53abf0..1f8d403d3db4d 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -444,6 +444,19 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state)
+ dev_err(&client->dev, "failed to change power setting.\n");
+
+ set_pwr_exit:
++
++ /*
++ * The HID over I2C specification states that if a DEVICE needs time
++ * after the PWR_ON request, it should utilise CLOCK stretching.
++ * However, it has been observered that the Windows driver provides a
++ * 1ms sleep between the PWR_ON and RESET requests.
++ * According to Goodix Windows even waits 60 ms after (other?)
++ * PWR_ON requests. Testing has confirmed that several devices
++ * will not work properly without a delay after a PWR_ON request.
++ */
++ if (!ret && power_state == I2C_HID_PWR_ON)
++ msleep(60);
++
+ return ret;
+ }
+
+@@ -465,15 +478,6 @@ static int i2c_hid_hwreset(struct i2c_client *client)
+ if (ret)
+ goto out_unlock;
+
+- /*
+- * The HID over I2C specification states that if a DEVICE needs time
+- * after the PWR_ON request, it should utilise CLOCK stretching.
+- * However, it has been observered that the Windows driver provides a
+- * 1ms sleep between the PWR_ON and RESET requests and that some devices
+- * rely on this.
+- */
+- usleep_range(1000, 5000);
+-
+ i2c_hid_dbg(ihid, "resetting...\n");
+
+ ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0);
+diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
+index c34ef95d7cef3..2dff663847c69 100644
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -532,12 +532,16 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
+
+ switch (cmd) {
+ case HIDIOCGUSAGE:
++ if (uref->usage_index >= field->report_count)
++ goto inval;
+ uref->value = field->value[uref->usage_index];
+ if (copy_to_user(user_arg, uref, sizeof(*uref)))
+ goto fault;
+ goto goodreturn;
+
+ case HIDIOCSUSAGE:
++ if (uref->usage_index >= field->report_count)
++ goto inval;
+ field->value[uref->usage_index] = uref->value;
+ goto goodreturn;
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index dcdce18fc7062..f9029800d3996 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -594,6 +594,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ /* master sent stop */
+ if (ssr_filtered & SSR) {
+ i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
++ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */
+ rcar_i2c_write(priv, ICSIER, SAR);
+ rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
+ }
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index 34c058c24b9d2..ce5cd05253db9 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -814,7 +814,9 @@ iova_magazine_free_pfns(struct iova_magazine *mag, struct iova_domain *iovad)
+ for (i = 0 ; i < mag->size; ++i) {
+ struct iova *iova = private_find_iova(iovad, mag->pfns[i]);
+
+- BUG_ON(!iova);
++ if (WARN_ON(!iova))
++ continue;
++
+ private_free_iova(iovad, iova);
+ }
+
+diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
+index 97b27f338c305..f605470855f19 100644
+--- a/drivers/irqchip/irq-stm32-exti.c
++++ b/drivers/irqchip/irq-stm32-exti.c
+@@ -382,6 +382,16 @@ static void stm32_irq_ack(struct irq_data *d)
+ irq_gc_unlock(gc);
+ }
+
++/* directly set the target bit without reading first. */
++static inline void stm32_exti_write_bit(struct irq_data *d, u32 reg)
++{
++ struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d);
++ void __iomem *base = chip_data->host_data->base;
++ u32 val = BIT(d->hwirq % IRQS_PER_BANK);
++
++ writel_relaxed(val, base + reg);
++}
++
+ static inline u32 stm32_exti_set_bit(struct irq_data *d, u32 reg)
+ {
+ struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d);
+@@ -415,9 +425,9 @@ static void stm32_exti_h_eoi(struct irq_data *d)
+
+ raw_spin_lock(&chip_data->rlock);
+
+- stm32_exti_set_bit(d, stm32_bank->rpr_ofst);
++ stm32_exti_write_bit(d, stm32_bank->rpr_ofst);
+ if (stm32_bank->fpr_ofst != UNDEF_REG)
+- stm32_exti_set_bit(d, stm32_bank->fpr_ofst);
++ stm32_exti_write_bit(d, stm32_bank->fpr_ofst);
+
+ raw_spin_unlock(&chip_data->rlock);
+
+diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
+index 4961573850d54..b2b3f779592fd 100644
+--- a/drivers/media/cec/cec-api.c
++++ b/drivers/media/cec/cec-api.c
+@@ -147,7 +147,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap,
+ struct cec_log_addrs log_addrs;
+
+ mutex_lock(&adap->lock);
+- log_addrs = adap->log_addrs;
++ /*
++ * We use memcpy here instead of assignment since there is a
++ * hole at the end of struct cec_log_addrs that an assignment
++ * might ignore. So when we do copy_to_user() we could leak
++ * one byte of memory.
++ */
++ memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs));
+ if (!adap->is_configured)
+ memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID,
+ sizeof(log_addrs.log_addr));
+diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c
+index d6816effb8786..d02b5fd940c12 100644
+--- a/drivers/media/pci/ttpci/av7110.c
++++ b/drivers/media/pci/ttpci/av7110.c
+@@ -424,14 +424,15 @@ static void debiirq(unsigned long cookie)
+ case DATA_CI_GET:
+ {
+ u8 *data = av7110->debi_virt;
++ u8 data_0 = data[0];
+
+- if ((data[0] < 2) && data[2] == 0xff) {
++ if (data_0 < 2 && data[2] == 0xff) {
+ int flags = 0;
+ if (data[5] > 0)
+ flags |= CA_CI_MODULE_PRESENT;
+ if (data[5] > 5)
+ flags |= CA_CI_MODULE_READY;
+- av7110->ci_slot[data[0]].flags = flags;
++ av7110->ci_slot[data_0].flags = flags;
+ } else
+ ci_get_data(&av7110->ci_rbuffer,
+ av7110->debi_virt,
+diff --git a/drivers/media/rc/gpio-ir-tx.c b/drivers/media/rc/gpio-ir-tx.c
+index cd476cab97820..4e70b67ccd181 100644
+--- a/drivers/media/rc/gpio-ir-tx.c
++++ b/drivers/media/rc/gpio-ir-tx.c
+@@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
+ // space
+ edge = ktime_add_us(edge, txbuf[i]);
+ delta = ktime_us_delta(edge, ktime_get());
+- if (delta > 10) {
+- spin_unlock_irqrestore(&gpio_ir->lock, flags);
+- usleep_range(delta, delta + 10);
+- spin_lock_irqsave(&gpio_ir->lock, flags);
+- } else if (delta > 0) {
++ if (delta > 0)
+ udelay(delta);
+- }
+ } else {
+ // pulse
+ ktime_t last = ktime_add_us(edge, txbuf[i]);
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index 742d6c1973f4f..adea7ff63132f 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -176,6 +176,9 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x1ac4), (kernel_ulong_t)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info },
++ /* EBG */
++ { PCI_VDEVICE(INTEL, 0x1bad), (kernel_ulong_t)&bxt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x1bae), (kernel_ulong_t)&bxt_uart_info },
+ /* GLK */
+ { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info },
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 55cc70ba5b093..3c3222e2dcfcf 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2736,7 +2736,7 @@ static int check_missing_comp_in_tx_queue(struct ena_adapter *adapter,
+ }
+
+ u64_stats_update_begin(&tx_ring->syncp);
+- tx_ring->tx_stats.missed_tx = missed_tx;
++ tx_ring->tx_stats.missed_tx += missed_tx;
+ u64_stats_update_end(&tx_ring->syncp);
+
+ return rc;
+@@ -3544,6 +3544,9 @@ static void ena_keep_alive_wd(void *adapter_data,
+ rx_drops = ((u64)desc->rx_drops_high << 32) | desc->rx_drops_low;
+
+ u64_stats_update_begin(&adapter->syncp);
++ /* These stats are accumulated by the device, so the counters indicate
++ * all drops since last reset.
++ */
+ adapter->dev_stats.rx_drops = rx_drops;
+ u64_stats_update_end(&adapter->syncp);
+ }
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index cf2d1e846a692..8243501c37574 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -844,8 +844,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
+ continue;
+
+ err = gfar_parse_group(child, priv, model);
+- if (err)
++ if (err) {
++ of_node_put(child);
+ goto err_grp_init;
++ }
+ }
+ } else { /* SQ_SG_MODE */
+ err = gfar_parse_group(np, priv, model);
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+index ccd852ad62a4b..d50c5b55da180 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+@@ -192,7 +192,7 @@ static int ixgbe_fcoe_ddp_setup(struct net_device *netdev, u16 xid,
+ }
+
+ /* alloc the udl from per cpu ddp pool */
+- ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_KERNEL, &ddp->udp);
++ ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_ATOMIC, &ddp->udp);
+ if (!ddp->udl) {
+ e_err(drv, "failed allocated ddp context\n");
+ goto out_noddp_unmap;
+diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
+index 87f605a33c37a..9fa3c0bd6ec78 100644
+--- a/drivers/net/ipvlan/ipvlan_main.c
++++ b/drivers/net/ipvlan/ipvlan_main.c
+@@ -177,12 +177,21 @@ static void ipvlan_port_destroy(struct net_device *dev)
+ kfree(port);
+ }
+
++#define IPVLAN_ALWAYS_ON_OFLOADS \
++ (NETIF_F_SG | NETIF_F_HW_CSUM | \
++ NETIF_F_GSO_ROBUST | NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ENCAP_ALL)
++
++#define IPVLAN_ALWAYS_ON \
++ (IPVLAN_ALWAYS_ON_OFLOADS | NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED)
++
+ #define IPVLAN_FEATURES \
+- (NETIF_F_SG | NETIF_F_CSUM_MASK | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
++ (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
+ NETIF_F_GSO | NETIF_F_TSO | NETIF_F_GSO_ROBUST | \
+ NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \
+ NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER)
+
++ /* NETIF_F_GSO_ENCAP_ALL NETIF_F_GSO_SOFTWARE Newly added */
++
+ #define IPVLAN_STATE_MASK \
+ ((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
+
+@@ -196,7 +205,9 @@ static int ipvlan_init(struct net_device *dev)
+ dev->state = (dev->state & ~IPVLAN_STATE_MASK) |
+ (phy_dev->state & IPVLAN_STATE_MASK);
+ dev->features = phy_dev->features & IPVLAN_FEATURES;
+- dev->features |= NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED;
++ dev->features |= IPVLAN_ALWAYS_ON;
++ dev->vlan_features = phy_dev->vlan_features & IPVLAN_FEATURES;
++ dev->vlan_features |= IPVLAN_ALWAYS_ON_OFLOADS;
+ dev->gso_max_size = phy_dev->gso_max_size;
+ dev->gso_max_segs = phy_dev->gso_max_segs;
+ dev->hard_header_len = phy_dev->hard_header_len;
+@@ -297,7 +308,14 @@ static netdev_features_t ipvlan_fix_features(struct net_device *dev,
+ {
+ struct ipvl_dev *ipvlan = netdev_priv(dev);
+
+- return features & (ipvlan->sfeatures | ~IPVLAN_FEATURES);
++ features |= NETIF_F_ALL_FOR_ALL;
++ features &= (ipvlan->sfeatures | ~IPVLAN_FEATURES);
++ features = netdev_increment_features(ipvlan->phy_dev->features,
++ features, features);
++ features |= IPVLAN_ALWAYS_ON;
++ features &= (IPVLAN_FEATURES | IPVLAN_ALWAYS_ON);
++
++ return features;
+ }
+
+ static void ipvlan_change_rx_flags(struct net_device *dev, int change)
+@@ -802,10 +820,9 @@ static int ipvlan_device_event(struct notifier_block *unused,
+
+ case NETDEV_FEAT_CHANGE:
+ list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+- ipvlan->dev->features = dev->features & IPVLAN_FEATURES;
+ ipvlan->dev->gso_max_size = dev->gso_max_size;
+ ipvlan->dev->gso_max_segs = dev->gso_max_segs;
+- netdev_features_change(ipvlan->dev);
++ netdev_update_features(ipvlan->dev);
+ }
+ break;
+
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 349123592af0f..e226a96da3a39 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -1230,6 +1230,9 @@ static void macvlan_port_destroy(struct net_device *dev)
+ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[],
+ struct netlink_ext_ack *extack)
+ {
++ struct nlattr *nla, *head;
++ int rem, len;
++
+ if (tb[IFLA_ADDRESS]) {
+ if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
+ return -EINVAL;
+@@ -1277,6 +1280,20 @@ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[],
+ return -EADDRNOTAVAIL;
+ }
+
++ if (data[IFLA_MACVLAN_MACADDR_DATA]) {
++ head = nla_data(data[IFLA_MACVLAN_MACADDR_DATA]);
++ len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]);
++
++ nla_for_each_attr(nla, head, len, rem) {
++ if (nla_type(nla) != IFLA_MACVLAN_MACADDR ||
++ nla_len(nla) != ETH_ALEN)
++ return -EINVAL;
++
++ if (!is_valid_ether_addr(nla_data(nla)))
++ return -EADDRNOTAVAIL;
++ }
++ }
++
+ if (data[IFLA_MACVLAN_MACADDR_COUNT])
+ return -EINVAL;
+
+@@ -1333,10 +1350,6 @@ static int macvlan_changelink_sources(struct macvlan_dev *vlan, u32 mode,
+ len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]);
+
+ nla_for_each_attr(nla, head, len, rem) {
+- if (nla_type(nla) != IFLA_MACVLAN_MACADDR ||
+- nla_len(nla) != ETH_ALEN)
+- continue;
+-
+ addr = nla_data(nla);
+ ret = macvlan_hash_add_source(vlan, addr);
+ if (ret)
+diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
+index fac58c3c576a2..3ff65a0a834a2 100644
+--- a/drivers/net/wireless/ath/ath10k/hw.h
++++ b/drivers/net/wireless/ath/ath10k/hw.h
+@@ -753,7 +753,7 @@ ath10k_rx_desc_get_l3_pad_bytes(struct ath10k_hw_params *hw,
+
+ #define TARGET_10_4_TX_DBG_LOG_SIZE 1024
+ #define TARGET_10_4_NUM_WDS_ENTRIES 32
+-#define TARGET_10_4_DMA_BURST_SIZE 0
++#define TARGET_10_4_DMA_BURST_SIZE 1
+ #define TARGET_10_4_MAC_AGGR_DELIM 0
+ #define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1
+ #define TARGET_10_4_VOW_CONFIG 0
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 1893640555c1e..3d6c0d8c71d7e 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -739,8 +739,11 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw)
+
+ usb_anchor_urb(urb, &rtlusb->rx_submitted);
+ err = usb_submit_urb(urb, GFP_KERNEL);
+- if (err)
++ if (err) {
++ usb_unanchor_urb(urb);
++ usb_free_urb(urb);
+ goto err_out;
++ }
+ usb_free_urb(urb);
+ }
+ return 0;
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index ed43b06353a39..bb3b447c56468 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1716,7 +1716,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl,
+ if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.cmddma)) {
+ dev_err(ctrl->dev,
+ "FCP Op failed - cmdiu dma mapping failed.\n");
+- ret = EFAULT;
++ ret = -EFAULT;
+ goto out_on_error;
+ }
+
+@@ -1726,7 +1726,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl,
+ if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.rspdma)) {
+ dev_err(ctrl->dev,
+ "FCP Op failed - rspiu dma mapping failed.\n");
+- ret = EFAULT;
++ ret = -EFAULT;
+ }
+
+ atomic_set(&op->state, FCPOP_STATE_IDLE);
+diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
+index a32897f83ee51..fb7478b6c4f9d 100644
+--- a/drivers/pci/slot.c
++++ b/drivers/pci/slot.c
+@@ -303,13 +303,16 @@ placeholder:
+ slot_name = make_slot_name(name);
+ if (!slot_name) {
+ err = -ENOMEM;
++ kfree(slot);
+ goto err;
+ }
+
+ err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
+ "%s", slot_name);
+- if (err)
++ if (err) {
++ kobject_put(&slot->kobj);
+ goto err;
++ }
+
+ INIT_LIST_HEAD(&slot->list);
+ list_add(&slot->list, &parent->slots);
+@@ -328,7 +331,6 @@ out:
+ mutex_unlock(&pci_slot_mutex);
+ return slot;
+ err:
+- kfree(slot);
+ slot = ERR_PTR(err);
+ goto out;
+ }
+diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
+index df09ed53ab459..825a8f2703b4f 100644
+--- a/drivers/s390/cio/css.c
++++ b/drivers/s390/cio/css.c
+@@ -615,6 +615,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data)
+ rc = css_evaluate_known_subchannel(sch, 1);
+ if (rc == -EAGAIN)
+ css_schedule_eval(sch->schid);
++ /*
++ * The loop might take long time for platforms with lots of
++ * known devices. Allow scheduling here.
++ */
++ cond_resched();
+ }
+ return 0;
+ }
+diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
+index 24cbd0a2cc69f..658c0726581f9 100644
+--- a/drivers/scsi/fcoe/fcoe_ctlr.c
++++ b/drivers/scsi/fcoe/fcoe_ctlr.c
+@@ -267,9 +267,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new)
+ WARN_ON(!fcf_dev);
+ new->fcf_dev = NULL;
+ fcoe_fcf_device_delete(fcf_dev);
+- kfree(new);
+ mutex_unlock(&cdev->lock);
+ }
++ kfree(new);
+ }
+
+ /**
+diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c
+index 1ff0f7de91058..64545b300dfc7 100644
+--- a/drivers/scsi/lpfc/lpfc_vport.c
++++ b/drivers/scsi/lpfc/lpfc_vport.c
+@@ -653,27 +653,16 @@ lpfc_vport_delete(struct fc_vport *fc_vport)
+ vport->port_state < LPFC_VPORT_READY)
+ return -EAGAIN;
+ }
++
+ /*
+- * This is a bit of a mess. We want to ensure the shost doesn't get
+- * torn down until we're done with the embedded lpfc_vport structure.
+- *
+- * Beyond holding a reference for this function, we also need a
+- * reference for outstanding I/O requests we schedule during delete
+- * processing. But once we scsi_remove_host() we can no longer obtain
+- * a reference through scsi_host_get().
+- *
+- * So we take two references here. We release one reference at the
+- * bottom of the function -- after delinking the vport. And we
+- * release the other at the completion of the unreg_vpi that get's
+- * initiated after we've disposed of all other resources associated
+- * with the port.
++ * Take early refcount for outstanding I/O requests we schedule during
++ * delete processing for unreg_vpi. Always keep this before
++ * scsi_remove_host() as we can no longer obtain a reference through
++ * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL.
+ */
+ if (!scsi_host_get(shost))
+ return VPORT_INVAL;
+- if (!scsi_host_get(shost)) {
+- scsi_host_put(shost);
+- return VPORT_INVAL;
+- }
++
+ lpfc_free_sysfs_attr(vport);
+
+ lpfc_debugfs_terminate(vport);
+@@ -820,8 +809,9 @@ skip_logo:
+ if (!(vport->vpi_state & LPFC_VPI_REGISTERED) ||
+ lpfc_mbx_unreg_vpi(vport))
+ scsi_host_put(shost);
+- } else
++ } else {
+ scsi_host_put(shost);
++ }
+
+ lpfc_free_vpi(phba, vport->vpi);
+ vport->work_port_events = 0;
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index ac5d2d34aeeae..07c5d7397d425 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -329,14 +329,6 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ if (time_after(jiffies, wait_time))
+ break;
+
+- /*
+- * Check if it's UNLOADING, cause we cannot poll in
+- * this case, or else a NULL pointer dereference
+- * is triggered.
+- */
+- if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags)))
+- return QLA_FUNCTION_TIMEOUT;
+-
+ /* Check for pending interrupts. */
+ qla2x00_poll(ha->rsp_q_map[0]);
+
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 5590d6e8b5762..3e2f8ce1d9a97 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -477,6 +477,11 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
+ struct nvme_private *priv = fd->private;
+ struct qla_nvme_rport *qla_rport = rport->private;
+
++ if (!priv) {
++ /* nvme association has been torn down */
++ return rval;
++ }
++
+ fcport = qla_rport->fcport;
+
+ vha = fcport->vha;
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index b56cf790587e5..e17ca7df8d0e4 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1997,6 +1997,11 @@ skip_pio:
+ /* Determine queue resources */
+ ha->max_req_queues = ha->max_rsp_queues = 1;
+ ha->msix_count = QLA_BASE_VECTORS;
++
++ /* Check if FW supports MQ or not */
++ if (!(ha->fw_attributes & BIT_6))
++ goto mqiobase_exit;
++
+ if (!ql2xmqsupport || !ql2xnvmeenable ||
+ (!IS_QLA25XX(ha) && !IS_QLA81XX(ha)))
+ goto mqiobase_exit;
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 04d095488c764..6983473011980 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -3172,7 +3172,7 @@ static int iscsi_set_flashnode_param(struct iscsi_transport *transport,
+ pr_err("%s could not find host no %u\n",
+ __func__, ev->u.set_flashnode.host_no);
+ err = -ENODEV;
+- goto put_host;
++ goto exit_set_fnode;
+ }
+
+ idx = ev->u.set_flashnode.flashnode_idx;
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index ab628fd37e026..eb10a5cacd90c 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1540,6 +1540,7 @@ unblock_reqs:
+ int ufshcd_hold(struct ufs_hba *hba, bool async)
+ {
+ int rc = 0;
++ bool flush_result;
+ unsigned long flags;
+
+ if (!ufshcd_is_clkgating_allowed(hba))
+@@ -1571,7 +1572,9 @@ start:
+ break;
+ }
+ spin_unlock_irqrestore(hba->host->host_lock, flags);
+- flush_work(&hba->clk_gating.ungate_work);
++ flush_result = flush_work(&hba->clk_gating.ungate_work);
++ if (hba->clk_gating.is_suspended && !flush_result)
++ goto out;
+ spin_lock_irqsave(hba->host->host_lock, flags);
+ goto start;
+ }
+@@ -5602,7 +5605,7 @@ static void ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status)
+ */
+ static irqreturn_t ufshcd_intr(int irq, void *__hba)
+ {
+- u32 intr_status, enabled_intr_status;
++ u32 intr_status, enabled_intr_status = 0;
+ irqreturn_t retval = IRQ_NONE;
+ struct ufs_hba *hba = __hba;
+ int retries = hba->nutrs;
+@@ -5616,7 +5619,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
+ * read, make sure we handle them by checking the interrupt status
+ * again in a loop until we process all of the reqs before returning.
+ */
+- do {
++ while (intr_status && retries--) {
+ enabled_intr_status =
+ intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
+ if (intr_status)
+@@ -5627,7 +5630,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
+ }
+
+ intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS);
+- } while (intr_status && --retries);
++ }
+
+ spin_unlock(hba->host->host_lock);
+ return retval;
+@@ -5927,7 +5930,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
+ /* command completed already */
+ dev_err(hba->dev, "%s: cmd at tag %d successfully cleared from DB.\n",
+ __func__, tag);
+- goto out;
++ goto cleanup;
+ } else {
+ dev_err(hba->dev,
+ "%s: no response from device. tag = %d, err %d\n",
+@@ -5961,6 +5964,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
+ goto out;
+ }
+
++cleanup:
+ scsi_dma_unmap(cmd);
+
+ spin_lock_irqsave(host->host_lock, flags);
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index ad1e55d3d5d59..391a20b3d2fda 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -254,7 +254,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz)
+ {
+ u32 div, mbrdiv;
+
+- div = DIV_ROUND_UP(spi->clk_rate, speed_hz);
++ /* Ensure spi->clk_rate is even */
++ div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz);
+
+ /*
+ * SPI framework set xfer->speed_hz to master->max_speed_hz if
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 9c05e820857aa..91dbac7446a47 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -1231,7 +1231,14 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+
+ struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
+
+- tcmu_flush_dcache_range(entry, sizeof(*entry));
++ /*
++ * Flush max. up to end of cmd ring since current entry might
++ * be a padding that is shorter than sizeof(*entry)
++ */
++ size_t ring_left = head_to_end(udev->cmdr_last_cleaned,
++ udev->cmdr_size);
++ tcmu_flush_dcache_range(entry, ring_left < sizeof(*entry) ?
++ ring_left : sizeof(*entry));
+
+ if (tcmu_hdr_get_op(entry->hdr.len_op) == TCMU_OP_PAD) {
+ UPDATE_HEAD(udev->cmdr_last_cleaned,
+diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
+index d39162e71f59d..195f58c5b477f 100644
+--- a/drivers/tty/serial/8250/8250_exar.c
++++ b/drivers/tty/serial/8250/8250_exar.c
+@@ -638,6 +638,24 @@ static const struct exar8250_board pbn_exar_XR17V35x = {
+ .exit = pci_xr17v35x_exit,
+ };
+
++static const struct exar8250_board pbn_fastcom35x_2 = {
++ .num_ports = 2,
++ .setup = pci_xr17v35x_setup,
++ .exit = pci_xr17v35x_exit,
++};
++
++static const struct exar8250_board pbn_fastcom35x_4 = {
++ .num_ports = 4,
++ .setup = pci_xr17v35x_setup,
++ .exit = pci_xr17v35x_exit,
++};
++
++static const struct exar8250_board pbn_fastcom35x_8 = {
++ .num_ports = 8,
++ .setup = pci_xr17v35x_setup,
++ .exit = pci_xr17v35x_exit,
++};
++
+ static const struct exar8250_board pbn_exar_XR17V4358 = {
+ .num_ports = 12,
+ .setup = pci_xr17v35x_setup,
+@@ -708,9 +726,9 @@ static const struct pci_device_id exar_pci_tbl[] = {
+ EXAR_DEVICE(EXAR, EXAR_XR17V358, pbn_exar_XR17V35x),
+ EXAR_DEVICE(EXAR, EXAR_XR17V4358, pbn_exar_XR17V4358),
+ EXAR_DEVICE(EXAR, EXAR_XR17V8358, pbn_exar_XR17V8358),
+- EXAR_DEVICE(COMMTECH, COMMTECH_4222PCIE, pbn_exar_XR17V35x),
+- EXAR_DEVICE(COMMTECH, COMMTECH_4224PCIE, pbn_exar_XR17V35x),
+- EXAR_DEVICE(COMMTECH, COMMTECH_4228PCIE, pbn_exar_XR17V35x),
++ EXAR_DEVICE(COMMTECH, COMMTECH_4222PCIE, pbn_fastcom35x_2),
++ EXAR_DEVICE(COMMTECH, COMMTECH_4224PCIE, pbn_fastcom35x_4),
++ EXAR_DEVICE(COMMTECH, COMMTECH_4228PCIE, pbn_fastcom35x_8),
+
+ EXAR_DEVICE(COMMTECH, COMMTECH_4222PCI335, pbn_fastcom335_2),
+ EXAR_DEVICE(COMMTECH, COMMTECH_4224PCI335, pbn_fastcom335_4),
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 20b799219826e..09f0dc3b967b1 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -2259,6 +2259,10 @@ int serial8250_do_startup(struct uart_port *port)
+
+ if (port->irq && !(up->port.flags & UPF_NO_THRE_TEST)) {
+ unsigned char iir1;
++
++ if (port->irqflags & IRQF_SHARED)
++ disable_irq_nosync(port->irq);
++
+ /*
+ * Test for UARTs that do not reassert THRE when the
+ * transmitter is idle and the interrupt has already
+@@ -2268,8 +2272,6 @@ int serial8250_do_startup(struct uart_port *port)
+ * allow register changes to become visible.
+ */
+ spin_lock_irqsave(&port->lock, flags);
+- if (up->port.irqflags & IRQF_SHARED)
+- disable_irq_nosync(port->irq);
+
+ wait_for_xmitr(up, UART_LSR_THRE);
+ serial_port_out_sync(port, UART_IER, UART_IER_THRI);
+@@ -2281,9 +2283,10 @@ int serial8250_do_startup(struct uart_port *port)
+ iir = serial_port_in(port, UART_IIR);
+ serial_port_out(port, UART_IER, 0);
+
++ spin_unlock_irqrestore(&port->lock, flags);
++
+ if (port->irqflags & IRQF_SHARED)
+ enable_irq(port->irq);
+- spin_unlock_irqrestore(&port->lock, flags);
+
+ /*
+ * If the interrupt is not reasserted, or we otherwise
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index 1d501154e9f78..45e4f29521430 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -2252,9 +2252,8 @@ pl011_console_write(struct console *co, const char *s, unsigned int count)
+ clk_disable(uap->clk);
+ }
+
+-static void __init
+-pl011_console_get_options(struct uart_amba_port *uap, int *baud,
+- int *parity, int *bits)
++static void pl011_console_get_options(struct uart_amba_port *uap, int *baud,
++ int *parity, int *bits)
+ {
+ if (pl011_read(uap, REG_CR) & UART01x_CR_UARTEN) {
+ unsigned int lcr_h, ibrd, fbrd;
+@@ -2287,7 +2286,7 @@ pl011_console_get_options(struct uart_amba_port *uap, int *baud,
+ }
+ }
+
+-static int __init pl011_console_setup(struct console *co, char *options)
++static int pl011_console_setup(struct console *co, char *options)
+ {
+ struct uart_amba_port *uap;
+ int baud = 38400;
+@@ -2355,8 +2354,8 @@ static int __init pl011_console_setup(struct console *co, char *options)
+ *
+ * Returns 0 if console matches; otherwise non-zero to use default matching
+ */
+-static int __init pl011_console_match(struct console *co, char *name, int idx,
+- char *options)
++static int pl011_console_match(struct console *co, char *name, int idx,
++ char *options)
+ {
+ unsigned char iotype;
+ resource_size_t addr;
+@@ -2594,7 +2593,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap,
+
+ static int pl011_register_port(struct uart_amba_port *uap)
+ {
+- int ret;
++ int ret, i;
+
+ /* Ensure interrupts from this UART are masked and cleared */
+ pl011_write(0, uap, REG_IMSC);
+@@ -2605,6 +2604,9 @@ static int pl011_register_port(struct uart_amba_port *uap)
+ if (ret < 0) {
+ dev_err(uap->port.dev,
+ "Failed to register AMBA-PL011 driver\n");
++ for (i = 0; i < ARRAY_SIZE(amba_ports); i++)
++ if (amba_ports[i] == uap)
++ amba_ports[i] = NULL;
+ return ret;
+ }
+ }
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index 2a49b6d876b87..fcb89bf2524d1 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1755,9 +1755,11 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
+ ourport->tx_irq = ret + 1;
+ }
+
+- ret = platform_get_irq(platdev, 1);
+- if (ret > 0)
+- ourport->tx_irq = ret;
++ if (!s3c24xx_serial_has_interrupt_mask(port)) {
++ ret = platform_get_irq(platdev, 1);
++ if (ret > 0)
++ ourport->tx_irq = ret;
++ }
+ /*
+ * DMA is currently supported only on DT platforms, if DMA properties
+ * are specified.
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 982d9684c65e3..758f522f331e4 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1199,7 +1199,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ unsigned int old_rows, old_row_size, first_copied_row;
+ unsigned int new_cols, new_rows, new_row_size, new_screen_size;
+ unsigned int user;
+- unsigned short *newscreen;
++ unsigned short *oldscreen, *newscreen;
+ struct uni_screen *new_uniscr = NULL;
+
+ WARN_CONSOLE_UNLOCKED();
+@@ -1297,10 +1297,11 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ if (new_scr_end > new_origin)
+ scr_memsetw((void *)new_origin, vc->vc_video_erase_char,
+ new_scr_end - new_origin);
+- kfree(vc->vc_screenbuf);
++ oldscreen = vc->vc_screenbuf;
+ vc->vc_screenbuf = newscreen;
+ vc->vc_screenbuf_size = new_screen_size;
+ set_origin(vc);
++ kfree(oldscreen);
+
+ /* do part of a reset_terminal() */
+ vc->vc_top = 0;
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index 5de81431c8351..6a82030cf1efb 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -893,12 +893,22 @@ int vt_ioctl(struct tty_struct *tty,
+ console_lock();
+ vcp = vc_cons[i].d;
+ if (vcp) {
++ int ret;
++ int save_scan_lines = vcp->vc_scan_lines;
++ int save_font_height = vcp->vc_font.height;
++
+ if (v.v_vlin)
+ vcp->vc_scan_lines = v.v_vlin;
+ if (v.v_clin)
+ vcp->vc_font.height = v.v_clin;
+ vcp->vc_resize_user = 1;
+- vc_resize(vcp, v.v_cols, v.v_rows);
++ ret = vc_resize(vcp, v.v_cols, v.v_rows);
++ if (ret) {
++ vcp->vc_scan_lines = save_scan_lines;
++ vcp->vc_font.height = save_font_height;
++ console_unlock();
++ return ret;
++ }
+ }
+ console_unlock();
+ }
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index ea7883e1fbe28..41453bf6fc0bd 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -378,21 +378,19 @@ static void acm_ctrl_irq(struct urb *urb)
+ if (current_size < expected_size) {
+ /* notification is transmitted fragmented, reassemble */
+ if (acm->nb_size < expected_size) {
+- if (acm->nb_size) {
+- kfree(acm->notification_buffer);
+- acm->nb_size = 0;
+- }
++ u8 *new_buffer;
+ alloc_size = roundup_pow_of_two(expected_size);
+- /*
+- * kmalloc ensures a valid notification_buffer after a
+- * use of kfree in case the previous allocation was too
+- * small. Final freeing is done on disconnect.
+- */
+- acm->notification_buffer =
+- kmalloc(alloc_size, GFP_ATOMIC);
+- if (!acm->notification_buffer)
++ /* Final freeing is done on disconnect. */
++ new_buffer = krealloc(acm->notification_buffer,
++ alloc_size, GFP_ATOMIC);
++ if (!new_buffer) {
++ acm->nb_index = 0;
+ goto exit;
++ }
++
++ acm->notification_buffer = new_buffer;
+ acm->nb_size = alloc_size;
++ dr = (struct usb_cdc_notification *)acm->notification_buffer;
+ }
+
+ copy_size = min(current_size,
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index c96c50faccf72..2f068e525a374 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -370,6 +370,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x0926, 0x0202), .driver_info =
+ USB_QUIRK_ENDPOINT_BLACKLIST },
+
++ /* Sound Devices MixPre-D */
++ { USB_DEVICE(0x0926, 0x0208), .driver_info =
++ USB_QUIRK_ENDPOINT_BLACKLIST },
++
+ /* Keytouch QWERTY Panel keyboard */
+ { USB_DEVICE(0x0926, 0x3333), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+@@ -465,6 +469,8 @@ static const struct usb_device_id usb_quirk_list[] = {
+
+ { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM },
+
++ { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* DJI CineSSD */
+ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
+
+@@ -509,6 +515,7 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
+ */
+ static const struct usb_device_id usb_endpoint_blacklist[] = {
+ { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0202, 1), .driver_info = 0x85 },
++ { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0208, 1), .driver_info = 0x85 },
+ { }
+ };
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 2f5f4ca5c0d04..7bf2573dd459e 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1017,26 +1017,24 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
+ * dwc3_prepare_one_trb - setup one TRB from one request
+ * @dep: endpoint for which this request is prepared
+ * @req: dwc3_request pointer
++ * @trb_length: buffer size of the TRB
+ * @chain: should this TRB be chained to the next?
+ * @node: only for isochronous endpoints. First TRB needs different type.
+ */
+ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
+- struct dwc3_request *req, unsigned chain, unsigned node)
++ struct dwc3_request *req, unsigned int trb_length,
++ unsigned chain, unsigned node)
+ {
+ struct dwc3_trb *trb;
+- unsigned int length;
+ dma_addr_t dma;
+ unsigned stream_id = req->request.stream_id;
+ unsigned short_not_ok = req->request.short_not_ok;
+ unsigned no_interrupt = req->request.no_interrupt;
+
+- if (req->request.num_sgs > 0) {
+- length = sg_dma_len(req->start_sg);
++ if (req->request.num_sgs > 0)
+ dma = sg_dma_address(req->start_sg);
+- } else {
+- length = req->request.length;
++ else
+ dma = req->request.dma;
+- }
+
+ trb = &dep->trb_pool[dep->trb_enqueue];
+
+@@ -1048,7 +1046,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
+
+ req->num_trbs++;
+
+- __dwc3_prepare_one_trb(dep, trb, dma, length, chain, node,
++ __dwc3_prepare_one_trb(dep, trb, dma, trb_length, chain, node,
+ stream_id, short_not_ok, no_interrupt);
+ }
+
+@@ -1058,16 +1056,27 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ struct scatterlist *sg = req->start_sg;
+ struct scatterlist *s;
+ int i;
+-
++ unsigned int length = req->request.length;
+ unsigned int remaining = req->request.num_mapped_sgs
+ - req->num_queued_sgs;
+
++ /*
++ * If we resume preparing the request, then get the remaining length of
++ * the request and resume where we left off.
++ */
++ for_each_sg(req->request.sg, s, req->num_queued_sgs, i)
++ length -= sg_dma_len(s);
++
+ for_each_sg(sg, s, remaining, i) {
+- unsigned int length = req->request.length;
+ unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
+ unsigned int rem = length % maxp;
++ unsigned int trb_length;
+ unsigned chain = true;
+
++ trb_length = min_t(unsigned int, length, sg_dma_len(s));
++
++ length -= trb_length;
++
+ /*
+ * IOMMU driver is coalescing the list of sgs which shares a
+ * page boundary into one and giving it to USB driver. With
+@@ -1075,7 +1084,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ * sgs passed. So mark the chain bit to false if it isthe last
+ * mapped sg.
+ */
+- if (i == remaining - 1)
++ if ((i == remaining - 1) || !length)
+ chain = false;
+
+ if (rem && usb_endpoint_dir_out(dep->endpoint.desc) && !chain) {
+@@ -1085,7 +1094,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ req->needs_extra_trb = true;
+
+ /* prepare normal TRB */
+- dwc3_prepare_one_trb(dep, req, true, i);
++ dwc3_prepare_one_trb(dep, req, trb_length, true, i);
+
+ /* Now prepare one extra TRB to align transfer size */
+ trb = &dep->trb_pool[dep->trb_enqueue];
+@@ -1095,8 +1104,37 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ req->request.stream_id,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
++ } else if (req->request.zero && req->request.length &&
++ !usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
++ !rem && !chain) {
++ struct dwc3 *dwc = dep->dwc;
++ struct dwc3_trb *trb;
++
++ req->needs_extra_trb = true;
++
++ /* Prepare normal TRB */
++ dwc3_prepare_one_trb(dep, req, trb_length, true, i);
++
++ /* Prepare one extra TRB to handle ZLP */
++ trb = &dep->trb_pool[dep->trb_enqueue];
++ req->num_trbs++;
++ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
++ !req->direction, 1,
++ req->request.stream_id,
++ req->request.short_not_ok,
++ req->request.no_interrupt);
++
++ /* Prepare one more TRB to handle MPS alignment */
++ if (!req->direction) {
++ trb = &dep->trb_pool[dep->trb_enqueue];
++ req->num_trbs++;
++ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp,
++ false, 1, req->request.stream_id,
++ req->request.short_not_ok,
++ req->request.no_interrupt);
++ }
+ } else {
+- dwc3_prepare_one_trb(dep, req, chain, i);
++ dwc3_prepare_one_trb(dep, req, trb_length, chain, i);
+ }
+
+ /*
+@@ -1111,6 +1149,16 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+
+ req->num_queued_sgs++;
+
++ /*
++ * The number of pending SG entries may not correspond to the
++ * number of mapped SG entries. If all the data are queued, then
++ * don't include unused SG entries.
++ */
++ if (length == 0) {
++ req->num_pending_sgs -= req->request.num_mapped_sgs - req->num_queued_sgs;
++ break;
++ }
++
+ if (!dwc3_calc_trbs_left(dep))
+ break;
+ }
+@@ -1130,7 +1178,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
+ req->needs_extra_trb = true;
+
+ /* prepare normal TRB */
+- dwc3_prepare_one_trb(dep, req, true, 0);
++ dwc3_prepare_one_trb(dep, req, length, true, 0);
+
+ /* Now prepare one extra TRB to align transfer size */
+ trb = &dep->trb_pool[dep->trb_enqueue];
+@@ -1140,6 +1188,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
+ } else if (req->request.zero && req->request.length &&
++ !usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
+ (IS_ALIGNED(req->request.length, maxp))) {
+ struct dwc3 *dwc = dep->dwc;
+ struct dwc3_trb *trb;
+@@ -1147,17 +1196,27 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
+ req->needs_extra_trb = true;
+
+ /* prepare normal TRB */
+- dwc3_prepare_one_trb(dep, req, true, 0);
++ dwc3_prepare_one_trb(dep, req, length, true, 0);
+
+- /* Now prepare one extra TRB to handle ZLP */
++ /* Prepare one extra TRB to handle ZLP */
+ trb = &dep->trb_pool[dep->trb_enqueue];
+ req->num_trbs++;
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
+- false, 1, req->request.stream_id,
++ !req->direction, 1, req->request.stream_id,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
++
++ /* Prepare one more TRB to handle MPS alignment for OUT */
++ if (!req->direction) {
++ trb = &dep->trb_pool[dep->trb_enqueue];
++ req->num_trbs++;
++ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp,
++ false, 1, req->request.stream_id,
++ req->request.short_not_ok,
++ req->request.no_interrupt);
++ }
+ } else {
+- dwc3_prepare_one_trb(dep, req, false, 0);
++ dwc3_prepare_one_trb(dep, req, length, false, 0);
+ }
+ }
+
+@@ -2328,8 +2387,17 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+ status);
+
+ if (req->needs_extra_trb) {
++ unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
++
+ ret = dwc3_gadget_ep_reclaim_trb_linear(dep, req, event,
+ status);
++
++ /* Reclaim MPS padding TRB for ZLP */
++ if (!req->direction && req->request.zero && req->request.length &&
++ !usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
++ (IS_ALIGNED(req->request.length, maxp)))
++ ret = dwc3_gadget_ep_reclaim_trb_linear(dep, req, event, status);
++
+ req->needs_extra_trb = false;
+ }
+
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index cfca4584ae135..8d8c81d430694 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1184,12 +1184,15 @@ static int ncm_unwrap_ntb(struct gether *port,
+ int ndp_index;
+ unsigned dg_len, dg_len2;
+ unsigned ndp_len;
++ unsigned block_len;
+ struct sk_buff *skb2;
+ int ret = -EINVAL;
+- unsigned max_size = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
++ unsigned ntb_max = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
++ unsigned frame_max = le16_to_cpu(ecm_desc.wMaxSegmentSize);
+ const struct ndp_parser_opts *opts = ncm->parser_opts;
+ unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
+ int dgram_counter;
++ bool ndp_after_header;
+
+ /* dwSignature */
+ if (get_unaligned_le32(tmp) != opts->nth_sign) {
+@@ -1208,25 +1211,37 @@ static int ncm_unwrap_ntb(struct gether *port,
+ }
+ tmp++; /* skip wSequence */
+
++ block_len = get_ncm(&tmp, opts->block_length);
+ /* (d)wBlockLength */
+- if (get_ncm(&tmp, opts->block_length) > max_size) {
++ if (block_len > ntb_max) {
+ INFO(port->func.config->cdev, "OUT size exceeded\n");
+ goto err;
+ }
+
+ ndp_index = get_ncm(&tmp, opts->ndp_index);
++ ndp_after_header = false;
+
+ /* Run through all the NDP's in the NTB */
+ do {
+- /* NCM 3.2 */
+- if (((ndp_index % 4) != 0) &&
+- (ndp_index < opts->nth_size)) {
++ /*
++ * NCM 3.2
++ * dwNdpIndex
++ */
++ if (((ndp_index % 4) != 0) ||
++ (ndp_index < opts->nth_size) ||
++ (ndp_index > (block_len -
++ opts->ndp_size))) {
+ INFO(port->func.config->cdev, "Bad index: %#X\n",
+ ndp_index);
+ goto err;
+ }
++ if (ndp_index == opts->nth_size)
++ ndp_after_header = true;
+
+- /* walk through NDP */
++ /*
++ * walk through NDP
++ * dwSignature
++ */
+ tmp = (void *)(skb->data + ndp_index);
+ if (get_unaligned_le32(tmp) != ncm->ndp_sign) {
+ INFO(port->func.config->cdev, "Wrong NDP SIGN\n");
+@@ -1237,14 +1252,15 @@ static int ncm_unwrap_ntb(struct gether *port,
+ ndp_len = get_unaligned_le16(tmp++);
+ /*
+ * NCM 3.3.1
++ * wLength
+ * entry is 2 items
+ * item size is 16/32 bits, opts->dgram_item_len * 2 bytes
+ * minimal: struct usb_cdc_ncm_ndpX + normal entry + zero entry
+ * Each entry is a dgram index and a dgram length.
+ */
+ if ((ndp_len < opts->ndp_size
+- + 2 * 2 * (opts->dgram_item_len * 2))
+- || (ndp_len % opts->ndplen_align != 0)) {
++ + 2 * 2 * (opts->dgram_item_len * 2)) ||
++ (ndp_len % opts->ndplen_align != 0)) {
+ INFO(port->func.config->cdev, "Bad NDP length: %#X\n",
+ ndp_len);
+ goto err;
+@@ -1261,8 +1277,21 @@ static int ncm_unwrap_ntb(struct gether *port,
+
+ do {
+ index = index2;
++ /* wDatagramIndex[0] */
++ if ((index < opts->nth_size) ||
++ (index > block_len - opts->dpe_size)) {
++ INFO(port->func.config->cdev,
++ "Bad index: %#X\n", index);
++ goto err;
++ }
++
+ dg_len = dg_len2;
+- if (dg_len < 14 + crc_len) { /* ethernet hdr + crc */
++ /*
++ * wDatagramLength[0]
++ * ethernet hdr + crc or larger than max frame size
++ */
++ if ((dg_len < 14 + crc_len) ||
++ (dg_len > frame_max)) {
+ INFO(port->func.config->cdev,
+ "Bad dgram length: %#X\n", dg_len);
+ goto err;
+@@ -1286,6 +1315,37 @@ static int ncm_unwrap_ntb(struct gether *port,
+ index2 = get_ncm(&tmp, opts->dgram_item_len);
+ dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
+
++ if (index2 == 0 || dg_len2 == 0)
++ break;
++
++ /* wDatagramIndex[1] */
++ if (ndp_after_header) {
++ if (index2 < opts->nth_size + opts->ndp_size) {
++ INFO(port->func.config->cdev,
++ "Bad index: %#X\n", index2);
++ goto err;
++ }
++ } else {
++ if (index2 < opts->nth_size + opts->dpe_size) {
++ INFO(port->func.config->cdev,
++ "Bad index: %#X\n", index2);
++ goto err;
++ }
++ }
++ if (index2 > block_len - opts->dpe_size) {
++ INFO(port->func.config->cdev,
++ "Bad index: %#X\n", index2);
++ goto err;
++ }
++
++ /* wDatagramLength[1] */
++ if ((dg_len2 < 14 + crc_len) ||
++ (dg_len2 > frame_max)) {
++ INFO(port->func.config->cdev,
++ "Bad dgram length: %#X\n", dg_len);
++ goto err;
++ }
++
+ /*
+ * Copy the data into a new skb.
+ * This ensures the truesize is correct
+@@ -1302,9 +1362,6 @@ static int ncm_unwrap_ntb(struct gether *port,
+ ndp_len -= 2 * (opts->dgram_item_len * 2);
+
+ dgram_counter++;
+-
+- if (index2 == 0 || dg_len2 == 0)
+- break;
+ } while (ndp_len > 2 * (opts->dgram_item_len * 2));
+ } while (ndp_index);
+
+diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
+index 106988a6661ab..785826ab5348e 100644
+--- a/drivers/usb/gadget/function/f_tcm.c
++++ b/drivers/usb/gadget/function/f_tcm.c
+@@ -751,12 +751,13 @@ static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream)
+ goto err_sts;
+
+ return 0;
++
+ err_sts:
+- usb_ep_free_request(fu->ep_status, stream->req_status);
+- stream->req_status = NULL;
+-err_out:
+ usb_ep_free_request(fu->ep_out, stream->req_out);
+ stream->req_out = NULL;
++err_out:
++ usb_ep_free_request(fu->ep_in, stream->req_in);
++ stream->req_in = NULL;
+ out:
+ return -ENOMEM;
+ }
+diff --git a/drivers/usb/gadget/u_f.h b/drivers/usb/gadget/u_f.h
+index 09f90447fed5d..cfa6426553375 100644
+--- a/drivers/usb/gadget/u_f.h
++++ b/drivers/usb/gadget/u_f.h
+@@ -14,6 +14,7 @@
+ #define __U_F_H__
+
+ #include <linux/usb/gadget.h>
++#include <linux/overflow.h>
+
+ /* Variable Length Array Macros **********************************************/
+ #define vla_group(groupname) size_t groupname##__next = 0
+@@ -21,21 +22,36 @@
+
+ #define vla_item(groupname, type, name, n) \
+ size_t groupname##_##name##__offset = ({ \
+- size_t align_mask = __alignof__(type) - 1; \
+- size_t offset = (groupname##__next + align_mask) & ~align_mask;\
+- size_t size = (n) * sizeof(type); \
+- groupname##__next = offset + size; \
++ size_t offset = 0; \
++ if (groupname##__next != SIZE_MAX) { \
++ size_t align_mask = __alignof__(type) - 1; \
++ size_t size = array_size(n, sizeof(type)); \
++ offset = (groupname##__next + align_mask) & \
++ ~align_mask; \
++ if (check_add_overflow(offset, size, \
++ &groupname##__next)) { \
++ groupname##__next = SIZE_MAX; \
++ offset = 0; \
++ } \
++ } \
+ offset; \
+ })
+
+ #define vla_item_with_sz(groupname, type, name, n) \
+- size_t groupname##_##name##__sz = (n) * sizeof(type); \
+- size_t groupname##_##name##__offset = ({ \
+- size_t align_mask = __alignof__(type) - 1; \
+- size_t offset = (groupname##__next + align_mask) & ~align_mask;\
+- size_t size = groupname##_##name##__sz; \
+- groupname##__next = offset + size; \
+- offset; \
++ size_t groupname##_##name##__sz = array_size(n, sizeof(type)); \
++ size_t groupname##_##name##__offset = ({ \
++ size_t offset = 0; \
++ if (groupname##__next != SIZE_MAX) { \
++ size_t align_mask = __alignof__(type) - 1; \
++ offset = (groupname##__next + align_mask) & \
++ ~align_mask; \
++ if (check_add_overflow(offset, groupname##_##name##__sz,\
++ &groupname##__next)) { \
++ groupname##__next = SIZE_MAX; \
++ offset = 0; \
++ } \
++ } \
++ offset; \
+ })
+
+ #define vla_ptr(ptr, groupname, name) \
+diff --git a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c
+index c0c4dcca6f3cb..a4a88b6de3c48 100644
+--- a/drivers/usb/host/ohci-exynos.c
++++ b/drivers/usb/host/ohci-exynos.c
+@@ -156,9 +156,8 @@ static int exynos_ohci_probe(struct platform_device *pdev)
+ hcd->rsrc_len = resource_size(res);
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq) {
+- dev_err(&pdev->dev, "Failed to get IRQ\n");
+- err = -ENODEV;
++ if (irq < 0) {
++ err = irq;
+ goto fail_io;
+ }
+
+diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
+index 76c3f29562d2b..448d7b11dec4c 100644
+--- a/drivers/usb/host/xhci-debugfs.c
++++ b/drivers/usb/host/xhci-debugfs.c
+@@ -273,7 +273,7 @@ static int xhci_slot_context_show(struct seq_file *s, void *unused)
+
+ static int xhci_endpoint_context_show(struct seq_file *s, void *unused)
+ {
+- int dci;
++ int ep_index;
+ dma_addr_t dma;
+ struct xhci_hcd *xhci;
+ struct xhci_ep_ctx *ep_ctx;
+@@ -282,9 +282,9 @@ static int xhci_endpoint_context_show(struct seq_file *s, void *unused)
+
+ xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus));
+
+- for (dci = 1; dci < 32; dci++) {
+- ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, dci);
+- dma = dev->out_ctx->dma + dci * CTX_SIZE(xhci->hcc_params);
++ for (ep_index = 0; ep_index < 31; ep_index++) {
++ ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
++ dma = dev->out_ctx->dma + (ep_index + 1) * CTX_SIZE(xhci->hcc_params);
+ seq_printf(s, "%pad: %s\n", &dma,
+ xhci_decode_ep_context(le32_to_cpu(ep_ctx->ep_info),
+ le32_to_cpu(ep_ctx->ep_info2),
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index a58ef53e4ae1d..64dc94853b8b5 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -736,15 +736,6 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
+ {
+ u32 pls = status_reg & PORT_PLS_MASK;
+
+- /* resume state is a xHCI internal state.
+- * Do not report it to usb core, instead, pretend to be U3,
+- * thus usb core knows it's not ready for transfer
+- */
+- if (pls == XDEV_RESUME) {
+- *status |= USB_SS_PORT_LS_U3;
+- return;
+- }
+-
+ /* When the CAS bit is set then warm reset
+ * should be performed on port
+ */
+@@ -766,6 +757,16 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
+ */
+ pls |= USB_PORT_STAT_CONNECTION;
+ } else {
++ /*
++ * Resume state is an xHCI internal state. Do not report it to
++ * usb core, instead, pretend to be U3, thus usb core knows
++ * it's not ready for transfer.
++ */
++ if (pls == XDEV_RESUME) {
++ *status |= USB_SS_PORT_LS_U3;
++ return;
++ }
++
+ /*
+ * If CAS bit isn't set but the Port is already at
+ * Compliance Mode, fake a connection so the USB core
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index f8e71c7aba6e6..6f976c4cccdae 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3154,10 +3154,11 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
+
+ wait_for_completion(cfg_cmd->completion);
+
+- ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE;
+ xhci_free_command(xhci, cfg_cmd);
+ cleanup:
+ xhci_free_command(xhci, stop_cmd);
++ if (ep->ep_state & EP_SOFT_CLEAR_TOGGLE)
++ ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE;
+ }
+
+ static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
+diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c
+index e5c03c6d16e9e..d3b161bdef749 100644
+--- a/drivers/usb/misc/lvstest.c
++++ b/drivers/usb/misc/lvstest.c
+@@ -429,7 +429,7 @@ static int lvs_rh_probe(struct usb_interface *intf,
+ USB_DT_SS_HUB_SIZE, USB_CTRL_GET_TIMEOUT);
+ if (ret < (USB_DT_HUB_NONVAR_SIZE + 2)) {
+ dev_err(&hdev->dev, "wrong root hub descriptor read %d\n", ret);
+- return ret;
++ return ret < 0 ? ret : -EINVAL;
+ }
+
+ /* submit urb to poll interrupt endpoint */
+diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
+index 6376be1f5fd22..4877bf82ad395 100644
+--- a/drivers/usb/misc/sisusbvga/sisusb.c
++++ b/drivers/usb/misc/sisusbvga/sisusb.c
+@@ -761,7 +761,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr,
+ u8 swap8, fromkern = kernbuffer ? 1 : 0;
+ u16 swap16;
+ u32 swap32, flag = (length >> 28) & 1;
+- char buf[4];
++ u8 buf[4];
+
+ /* if neither kernbuffer not userbuffer are given, assume
+ * data in obuf
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index be0505b8b5d4e..785080f790738 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -492,7 +492,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
+ prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
+ dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__,
+ dev->cntl_buffer[0]);
+- retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL);
++ retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC);
+ if (retval >= 0)
+ timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
+ finish_wait(&dev->waitq, &wait);
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index f6c3681fa2e9e..88275842219ef 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2328,7 +2328,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x0114,
+ "JMicron",
+ "USB to ATA/ATAPI Bridge",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+- US_FL_BROKEN_FUA ),
++ US_FL_BROKEN_FUA | US_FL_IGNORE_UAS ),
+
+ /* Reported by Andrey Rahmatullin <wrar@altlinux.org> */
+ UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100,
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 37157ed9a881a..dcdfcdfd2ad13 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -28,6 +28,13 @@
+ * and don't forget to CC: the USB development list <linux-usb@vger.kernel.org>
+ */
+
++/* Reported-by: Till Dörges <doerges@pre-sense.de> */
++UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999,
++ "Sony",
++ "PSZ-HA*",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_REPORT_OPCODES),
++
+ /* Reported-by: Julian Groß <julian.g@posteo.de> */
+ UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
+ "LaCie",
+@@ -80,6 +87,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_BROKEN_FUA),
+
++/* Reported-by: Thinh Nguyen <thinhn@synopsys.com> */
++UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999,
++ "PNY",
++ "Pro Elite SSD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_ATA_1X),
++
+ /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+ UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
+ "VIA",
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index cb93a6b381609..f75557b39a61d 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -2152,6 +2152,9 @@ static void updatescrollmode(struct display *p,
+ }
+ }
+
++#define PITCH(w) (((w) + 7) >> 3)
++#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */
++
+ static int fbcon_resize(struct vc_data *vc, unsigned int width,
+ unsigned int height, unsigned int user)
+ {
+@@ -2161,6 +2164,24 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
+ struct fb_var_screeninfo var = info->var;
+ int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
+
++ if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {
++ int size;
++ int pitch = PITCH(vc->vc_font.width);
++
++ /*
++ * If user font, ensure that a possible change to user font
++ * height or width will not allow a font data out-of-bounds access.
++ * NOTE: must use original charcount in calculation as font
++ * charcount can change and cannot be used to determine the
++ * font data allocated size.
++ */
++ if (pitch <= 0)
++ return -EINVAL;
++ size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data));
++ if (size > FNTSIZE(vc->vc_font.data))
++ return -EINVAL;
++ }
++
+ virt_w = FBCON_SWAP(ops->rotate, width, height);
+ virt_h = FBCON_SWAP(ops->rotate, height, width);
+ virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width,
+@@ -2623,7 +2644,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font,
+ int size;
+ int i, csum;
+ u8 *new_data, *data = font->data;
+- int pitch = (font->width+7) >> 3;
++ int pitch = PITCH(font->width);
+
+ /* Is there a reason why fbconsole couldn't handle any charcount >256?
+ * If not this check should be changed to charcount < 256 */
+@@ -2639,7 +2660,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font,
+ if (fbcon_invalid_charcount(info, charcount))
+ return -EINVAL;
+
+- size = h * pitch * charcount;
++ size = CALC_FONTSZ(h, pitch, charcount);
+
+ new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
+index a06d9c25765c5..0bd582e845f31 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c
+@@ -531,8 +531,11 @@ int dispc_runtime_get(void)
+ DSSDBG("dispc_runtime_get\n");
+
+ r = pm_runtime_get_sync(&dispc.pdev->dev);
+- WARN_ON(r < 0);
+- return r < 0 ? r : 0;
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&dispc.pdev->dev);
++ return r;
++ }
++ return 0;
+ }
+ EXPORT_SYMBOL(dispc_runtime_get);
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
+index 8e1d60d48dbb0..50792d31533bf 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c
+@@ -1148,8 +1148,11 @@ static int dsi_runtime_get(struct platform_device *dsidev)
+ DSSDBG("dsi_runtime_get\n");
+
+ r = pm_runtime_get_sync(&dsi->pdev->dev);
+- WARN_ON(r < 0);
+- return r < 0 ? r : 0;
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&dsi->pdev->dev);
++ return r;
++ }
++ return 0;
+ }
+
+ static void dsi_runtime_put(struct platform_device *dsidev)
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss.c b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
+index b6c6c24979dd6..faebf9a773ba5 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
+@@ -779,8 +779,11 @@ int dss_runtime_get(void)
+ DSSDBG("dss_runtime_get\n");
+
+ r = pm_runtime_get_sync(&dss.pdev->dev);
+- WARN_ON(r < 0);
+- return r < 0 ? r : 0;
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&dss.pdev->dev);
++ return r;
++ }
++ return 0;
+ }
+
+ void dss_runtime_put(void)
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
+index 28de56e21c74b..9fd9a02bb871d 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c
+@@ -50,9 +50,10 @@ static int hdmi_runtime_get(void)
+ DSSDBG("hdmi_runtime_get\n");
+
+ r = pm_runtime_get_sync(&hdmi.pdev->dev);
+- WARN_ON(r < 0);
+- if (r < 0)
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&hdmi.pdev->dev);
+ return r;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
+index 2e2fcc3d6d4f7..13f3a5ce55294 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c
+@@ -54,9 +54,10 @@ static int hdmi_runtime_get(void)
+ DSSDBG("hdmi_runtime_get\n");
+
+ r = pm_runtime_get_sync(&hdmi.pdev->dev);
+- WARN_ON(r < 0);
+- if (r < 0)
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&hdmi.pdev->dev);
+ return r;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/venc.c b/drivers/video/fbdev/omap2/omapfb/dss/venc.c
+index 392464da12e41..96714b4596d2d 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/venc.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/venc.c
+@@ -402,8 +402,11 @@ static int venc_runtime_get(void)
+ DSSDBG("venc_runtime_get\n");
+
+ r = pm_runtime_get_sync(&venc.pdev->dev);
+- WARN_ON(r < 0);
+- return r < 0 ? r : 0;
++ if (WARN_ON(r < 0)) {
++ pm_runtime_put_sync(&venc.pdev->dev);
++ return r;
++ }
++ return 0;
+ }
+
+ static void venc_runtime_put(void)
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index 8d49b91d92cd3..95e5a9300ff04 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -154,7 +154,7 @@ int get_evtchn_to_irq(unsigned evtchn)
+ /* Get info for IRQ */
+ struct irq_info *info_for_irq(unsigned irq)
+ {
+- return irq_get_handler_data(irq);
++ return irq_get_chip_data(irq);
+ }
+
+ /* Constructors for packed IRQ information. */
+@@ -375,7 +375,7 @@ static void xen_irq_init(unsigned irq)
+ info->type = IRQT_UNBOUND;
+ info->refcnt = -1;
+
+- irq_set_handler_data(irq, info);
++ irq_set_chip_data(irq, info);
+
+ list_add_tail(&info->list, &xen_irq_list_head);
+ }
+@@ -424,14 +424,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi)
+
+ static void xen_free_irq(unsigned irq)
+ {
+- struct irq_info *info = irq_get_handler_data(irq);
++ struct irq_info *info = irq_get_chip_data(irq);
+
+ if (WARN_ON(!info))
+ return;
+
+ list_del(&info->list);
+
+- irq_set_handler_data(irq, NULL);
++ irq_set_chip_data(irq, NULL);
+
+ WARN_ON(info->refcnt > 0);
+
+@@ -601,7 +601,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
+ static void __unbind_from_irq(unsigned int irq)
+ {
+ int evtchn = evtchn_from_irq(irq);
+- struct irq_info *info = irq_get_handler_data(irq);
++ struct irq_info *info = irq_get_chip_data(irq);
+
+ if (info->refcnt > 0) {
+ info->refcnt--;
+@@ -1105,7 +1105,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
+
+ void unbind_from_irqhandler(unsigned int irq, void *dev_id)
+ {
+- struct irq_info *info = irq_get_handler_data(irq);
++ struct irq_info *info = irq_get_chip_data(irq);
+
+ if (WARN_ON(!info))
+ return;
+@@ -1139,7 +1139,7 @@ int evtchn_make_refcounted(unsigned int evtchn)
+ if (irq == -1)
+ return -ENOENT;
+
+- info = irq_get_handler_data(irq);
++ info = irq_get_chip_data(irq);
+
+ if (!info)
+ return -ENOENT;
+@@ -1167,7 +1167,7 @@ int evtchn_get(unsigned int evtchn)
+ if (irq == -1)
+ goto done;
+
+- info = irq_get_handler_data(irq);
++ info = irq_get_chip_data(irq);
+
+ if (!info)
+ goto done;
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 3130844e219cf..cb21ffd3bba7c 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4444,6 +4444,7 @@ static void btrfs_cleanup_bg_io(struct btrfs_block_group_cache *cache)
+ cache->io_ctl.inode = NULL;
+ iput(inode);
+ }
++ ASSERT(cache->io_ctl.pages == NULL);
+ btrfs_put_block_group(cache);
+ }
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index dc1841855a69a..646152f305843 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -3010,14 +3010,14 @@ reserve_space:
+ if (ret < 0)
+ goto out;
+ space_reserved = true;
+- ret = btrfs_qgroup_reserve_data(inode, &data_reserved,
+- alloc_start, bytes_to_reserve);
+- if (ret)
+- goto out;
+ ret = btrfs_punch_hole_lock_range(inode, lockstart, lockend,
+ &cached_state);
+ if (ret)
+ goto out;
++ ret = btrfs_qgroup_reserve_data(inode, &data_reserved,
++ alloc_start, bytes_to_reserve);
++ if (ret)
++ goto out;
+ ret = btrfs_prealloc_file_range(inode, mode, alloc_start,
+ alloc_end - alloc_start,
+ i_blocksize(inode),
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index 4c65305fd4180..652b0b16e93e2 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -1167,7 +1167,6 @@ static int __btrfs_wait_cache_io(struct btrfs_root *root,
+ ret = update_cache_item(trans, root, inode, path, offset,
+ io_ctl->entries, io_ctl->bitmaps);
+ out:
+- io_ctl_free(io_ctl);
+ if (ret) {
+ invalidate_inode_pages2(inode->i_mapping);
+ BTRFS_I(inode)->generation = 0;
+@@ -1332,6 +1331,7 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,
+ * them out later
+ */
+ io_ctl_drop_pages(io_ctl);
++ io_ctl_free(io_ctl);
+
+ unlock_extent_cached(&BTRFS_I(inode)->io_tree, 0,
+ i_size_read(inode) - 1, &cached_state);
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 4d2810a32b4a9..40f5b4dcb9276 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -539,6 +539,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
+ } else if (strncmp(args[0].from, "lzo", 3) == 0) {
+ compress_type = "lzo";
+ info->compress_type = BTRFS_COMPRESS_LZO;
++ info->compress_level = 0;
+ btrfs_set_opt(info->mount_opt, COMPRESS);
+ btrfs_clear_opt(info->mount_opt, NODATACOW);
+ btrfs_clear_opt(info->mount_opt, NODATASUM);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 090315f4ac78f..3e903e6a33870 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3422,11 +3422,13 @@ fail:
+ btrfs_free_path(path);
+ out_unlock:
+ mutex_unlock(&dir->log_mutex);
+- if (ret == -ENOSPC) {
++ if (err == -ENOSPC) {
+ btrfs_set_log_full_commit(root->fs_info, trans);
+- ret = 0;
+- } else if (ret < 0)
+- btrfs_abort_transaction(trans, ret);
++ err = 0;
++ } else if (err < 0 && err != -ENOENT) {
++ /* ENOENT can be returned if the entry hasn't been fsynced yet */
++ btrfs_abort_transaction(trans, err);
++ }
+
+ btrfs_end_log_trans(root);
+
+diff --git a/fs/buffer.c b/fs/buffer.c
+index c49fdab5cb36e..362a868764599 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -3193,6 +3193,15 @@ int __sync_dirty_buffer(struct buffer_head *bh, int op_flags)
+ WARN_ON(atomic_read(&bh->b_count) < 1);
+ lock_buffer(bh);
+ if (test_clear_buffer_dirty(bh)) {
++ /*
++ * The bh should be mapped, but it might not be if the
++ * device was hot-removed. Not much we can do but fail the I/O.
++ */
++ if (!buffer_mapped(bh)) {
++ unlock_buffer(bh);
++ return -EIO;
++ }
++
+ get_bh(bh);
+ bh->b_end_io = end_buffer_write_sync;
+ ret = submit_bh(REQ_OP_WRITE, op_flags, bh);
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 0fa14d8b9c64c..5f3707a90e7f7 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -3615,6 +3615,9 @@ static void delayed_work(struct work_struct *work)
+ dout("mdsc delayed_work\n");
+ ceph_check_delayed_caps(mdsc);
+
++ if (mdsc->stopping)
++ return;
++
+ mutex_lock(&mdsc->mutex);
+ renew_interval = mdsc->mdsmap->m_session_timeout >> 2;
+ renew_caps = time_after_eq(jiffies, HZ*renew_interval +
+@@ -3950,7 +3953,16 @@ void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc)
+ static void ceph_mdsc_stop(struct ceph_mds_client *mdsc)
+ {
+ dout("stop\n");
+- cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */
++ /*
++ * Make sure the delayed work stopped before releasing
++ * the resources.
++ *
++ * Because the cancel_delayed_work_sync() will only
++ * guarantee that the work finishes executing. But the
++ * delayed work will re-arm itself again after that.
++ */
++ flush_delayed_work(&mdsc->delayed_work);
++
+ if (mdsc->mdsmap)
+ ceph_mdsmap_destroy(mdsc->mdsmap);
+ kfree(mdsc->sessions);
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index 552164034d340..f22a89cdb4072 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -250,14 +250,6 @@ int ext4_setup_system_zone(struct super_block *sb)
+ int flex_size = ext4_flex_bg_size(sbi);
+ int ret;
+
+- if (!test_opt(sb, BLOCK_VALIDITY)) {
+- if (sbi->system_blks)
+- ext4_release_system_zone(sb);
+- return 0;
+- }
+- if (sbi->system_blks)
+- return 0;
+-
+ system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL);
+ if (!system_blks)
+ return -ENOMEM;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 1428dab2afff8..0c15ff19acbd4 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -65,10 +65,10 @@ static int ext4_load_journal(struct super_block *, struct ext4_super_block *,
+ unsigned long journal_devnum);
+ static int ext4_show_options(struct seq_file *seq, struct dentry *root);
+ static int ext4_commit_super(struct super_block *sb, int sync);
+-static void ext4_mark_recovery_complete(struct super_block *sb,
++static int ext4_mark_recovery_complete(struct super_block *sb,
+ struct ext4_super_block *es);
+-static void ext4_clear_journal_err(struct super_block *sb,
+- struct ext4_super_block *es);
++static int ext4_clear_journal_err(struct super_block *sb,
++ struct ext4_super_block *es);
+ static int ext4_sync_fs(struct super_block *sb, int wait);
+ static int ext4_remount(struct super_block *sb, int *flags, char *data);
+ static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf);
+@@ -4473,11 +4473,13 @@ no_journal:
+
+ ext4_set_resv_clusters(sb);
+
+- err = ext4_setup_system_zone(sb);
+- if (err) {
+- ext4_msg(sb, KERN_ERR, "failed to initialize system "
+- "zone (%d)", err);
+- goto failed_mount4a;
++ if (test_opt(sb, BLOCK_VALIDITY)) {
++ err = ext4_setup_system_zone(sb);
++ if (err) {
++ ext4_msg(sb, KERN_ERR, "failed to initialize system "
++ "zone (%d)", err);
++ goto failed_mount4a;
++ }
+ }
+
+ ext4_ext_init(sb);
+@@ -4545,7 +4547,9 @@ no_journal:
+ EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS;
+ if (needs_recovery) {
+ ext4_msg(sb, KERN_INFO, "recovery complete");
+- ext4_mark_recovery_complete(sb, es);
++ err = ext4_mark_recovery_complete(sb, es);
++ if (err)
++ goto failed_mount8;
+ }
+ if (EXT4_SB(sb)->s_journal) {
+ if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)
+@@ -4588,10 +4592,8 @@ cantfind_ext4:
+ ext4_msg(sb, KERN_ERR, "VFS: Can't find ext4 filesystem");
+ goto failed_mount;
+
+-#ifdef CONFIG_QUOTA
+ failed_mount8:
+ ext4_unregister_sysfs(sb);
+-#endif
+ failed_mount7:
+ ext4_unregister_li_request(sb);
+ failed_mount6:
+@@ -4727,7 +4729,8 @@ static journal_t *ext4_get_journal(struct super_block *sb,
+ struct inode *journal_inode;
+ journal_t *journal;
+
+- BUG_ON(!ext4_has_feature_journal(sb));
++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
++ return NULL;
+
+ journal_inode = ext4_get_journal_inode(sb, journal_inum);
+ if (!journal_inode)
+@@ -4757,7 +4760,8 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb,
+ struct ext4_super_block *es;
+ struct block_device *bdev;
+
+- BUG_ON(!ext4_has_feature_journal(sb));
++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
++ return NULL;
+
+ bdev = ext4_blkdev_get(j_dev, sb);
+ if (bdev == NULL)
+@@ -4848,8 +4852,10 @@ static int ext4_load_journal(struct super_block *sb,
+ dev_t journal_dev;
+ int err = 0;
+ int really_read_only;
++ int journal_dev_ro;
+
+- BUG_ON(!ext4_has_feature_journal(sb));
++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
++ return -EFSCORRUPTED;
+
+ if (journal_devnum &&
+ journal_devnum != le32_to_cpu(es->s_journal_dev)) {
+@@ -4859,7 +4865,31 @@ static int ext4_load_journal(struct super_block *sb,
+ } else
+ journal_dev = new_decode_dev(le32_to_cpu(es->s_journal_dev));
+
+- really_read_only = bdev_read_only(sb->s_bdev);
++ if (journal_inum && journal_dev) {
++ ext4_msg(sb, KERN_ERR,
++ "filesystem has both journal inode and journal device!");
++ return -EINVAL;
++ }
++
++ if (journal_inum) {
++ journal = ext4_get_journal(sb, journal_inum);
++ if (!journal)
++ return -EINVAL;
++ } else {
++ journal = ext4_get_dev_journal(sb, journal_dev);
++ if (!journal)
++ return -EINVAL;
++ }
++
++ journal_dev_ro = bdev_read_only(journal->j_dev);
++ really_read_only = bdev_read_only(sb->s_bdev) | journal_dev_ro;
++
++ if (journal_dev_ro && !sb_rdonly(sb)) {
++ ext4_msg(sb, KERN_ERR,
++ "journal device read-only, try mounting with '-o ro'");
++ err = -EROFS;
++ goto err_out;
++ }
+
+ /*
+ * Are we loading a blank journal or performing recovery after a
+@@ -4874,27 +4904,14 @@ static int ext4_load_journal(struct super_block *sb,
+ ext4_msg(sb, KERN_ERR, "write access "
+ "unavailable, cannot proceed "
+ "(try mounting with noload)");
+- return -EROFS;
++ err = -EROFS;
++ goto err_out;
+ }
+ ext4_msg(sb, KERN_INFO, "write access will "
+ "be enabled during recovery");
+ }
+ }
+
+- if (journal_inum && journal_dev) {
+- ext4_msg(sb, KERN_ERR, "filesystem has both journal "
+- "and inode journals!");
+- return -EINVAL;
+- }
+-
+- if (journal_inum) {
+- if (!(journal = ext4_get_journal(sb, journal_inum)))
+- return -EINVAL;
+- } else {
+- if (!(journal = ext4_get_dev_journal(sb, journal_dev)))
+- return -EINVAL;
+- }
+-
+ if (!(journal->j_flags & JBD2_BARRIER))
+ ext4_msg(sb, KERN_INFO, "barriers disabled");
+
+@@ -4914,12 +4931,16 @@ static int ext4_load_journal(struct super_block *sb,
+
+ if (err) {
+ ext4_msg(sb, KERN_ERR, "error loading journal");
+- jbd2_journal_destroy(journal);
+- return err;
++ goto err_out;
+ }
+
+ EXT4_SB(sb)->s_journal = journal;
+- ext4_clear_journal_err(sb, es);
++ err = ext4_clear_journal_err(sb, es);
++ if (err) {
++ EXT4_SB(sb)->s_journal = NULL;
++ jbd2_journal_destroy(journal);
++ return err;
++ }
+
+ if (!really_read_only && journal_devnum &&
+ journal_devnum != le32_to_cpu(es->s_journal_dev)) {
+@@ -4930,6 +4951,10 @@ static int ext4_load_journal(struct super_block *sb,
+ }
+
+ return 0;
++
++err_out:
++ jbd2_journal_destroy(journal);
++ return err;
+ }
+
+ static int ext4_commit_super(struct super_block *sb, int sync)
+@@ -4941,13 +4966,6 @@ static int ext4_commit_super(struct super_block *sb, int sync)
+ if (!sbh || block_device_ejected(sb))
+ return error;
+
+- /*
+- * The superblock bh should be mapped, but it might not be if the
+- * device was hot-removed. Not much we can do but fail the I/O.
+- */
+- if (!buffer_mapped(sbh))
+- return error;
+-
+ /*
+ * If the file system is mounted read-only, don't update the
+ * superblock write time. This avoids updating the superblock
+@@ -5015,26 +5033,32 @@ static int ext4_commit_super(struct super_block *sb, int sync)
+ * remounting) the filesystem readonly, then we will end up with a
+ * consistent fs on disk. Record that fact.
+ */
+-static void ext4_mark_recovery_complete(struct super_block *sb,
+- struct ext4_super_block *es)
++static int ext4_mark_recovery_complete(struct super_block *sb,
++ struct ext4_super_block *es)
+ {
++ int err;
+ journal_t *journal = EXT4_SB(sb)->s_journal;
+
+ if (!ext4_has_feature_journal(sb)) {
+- BUG_ON(journal != NULL);
+- return;
++ if (journal != NULL) {
++ ext4_error(sb, "Journal got removed while the fs was "
++ "mounted!");
++ return -EFSCORRUPTED;
++ }
++ return 0;
+ }
+ jbd2_journal_lock_updates(journal);
+- if (jbd2_journal_flush(journal) < 0)
++ err = jbd2_journal_flush(journal);
++ if (err < 0)
+ goto out;
+
+ if (ext4_has_feature_journal_needs_recovery(sb) && sb_rdonly(sb)) {
+ ext4_clear_feature_journal_needs_recovery(sb);
+ ext4_commit_super(sb, 1);
+ }
+-
+ out:
+ jbd2_journal_unlock_updates(journal);
++ return err;
+ }
+
+ /*
+@@ -5042,14 +5066,17 @@ out:
+ * has recorded an error from a previous lifetime, move that error to the
+ * main filesystem now.
+ */
+-static void ext4_clear_journal_err(struct super_block *sb,
++static int ext4_clear_journal_err(struct super_block *sb,
+ struct ext4_super_block *es)
+ {
+ journal_t *journal;
+ int j_errno;
+ const char *errstr;
+
+- BUG_ON(!ext4_has_feature_journal(sb));
++ if (!ext4_has_feature_journal(sb)) {
++ ext4_error(sb, "Journal got removed while the fs was mounted!");
++ return -EFSCORRUPTED;
++ }
+
+ journal = EXT4_SB(sb)->s_journal;
+
+@@ -5074,6 +5101,7 @@ static void ext4_clear_journal_err(struct super_block *sb,
+ jbd2_journal_clear_err(journal);
+ jbd2_journal_update_sb_errno(journal);
+ }
++ return 0;
+ }
+
+ /*
+@@ -5216,7 +5244,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ {
+ struct ext4_super_block *es;
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+- unsigned long old_sb_flags;
++ unsigned long old_sb_flags, vfs_flags;
+ struct ext4_mount_options old_opts;
+ int enable_quota = 0;
+ ext4_group_t g;
+@@ -5259,6 +5287,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ if (sbi->s_journal && sbi->s_journal->j_task->io_context)
+ journal_ioprio = sbi->s_journal->j_task->io_context->ioprio;
+
++ /*
++ * Some options can be enabled by ext4 and/or by VFS mount flag
++ * either way we need to make sure it matches in both *flags and
++ * s_flags. Copy those selected flags from *flags to s_flags
++ */
++ vfs_flags = SB_LAZYTIME | SB_I_VERSION;
++ sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags);
++
+ if (!parse_options(data, sb, NULL, &journal_ioprio, 1)) {
+ err = -EINVAL;
+ goto restore_opts;
+@@ -5312,9 +5348,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
+ }
+
+- if (*flags & SB_LAZYTIME)
+- sb->s_flags |= SB_LAZYTIME;
+-
+ if ((bool)(*flags & SB_RDONLY) != sb_rdonly(sb)) {
+ if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) {
+ err = -EROFS;
+@@ -5344,8 +5377,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ (sbi->s_mount_state & EXT4_VALID_FS))
+ es->s_state = cpu_to_le16(sbi->s_mount_state);
+
+- if (sbi->s_journal)
++ if (sbi->s_journal) {
++ /*
++ * We let remount-ro finish even if marking fs
++ * as clean failed...
++ */
+ ext4_mark_recovery_complete(sb, es);
++ }
+ if (sbi->s_mmp_tsk)
+ kthread_stop(sbi->s_mmp_tsk);
+ } else {
+@@ -5393,8 +5431,11 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ * been changed by e2fsck since we originally mounted
+ * the partition.)
+ */
+- if (sbi->s_journal)
+- ext4_clear_journal_err(sb, es);
++ if (sbi->s_journal) {
++ err = ext4_clear_journal_err(sb, es);
++ if (err)
++ goto restore_opts;
++ }
+ sbi->s_mount_state = le16_to_cpu(es->s_state);
+
+ err = ext4_setup_super(sb, es, 0);
+@@ -5424,7 +5465,17 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ ext4_register_li_request(sb, first_not_zeroed);
+ }
+
+- ext4_setup_system_zone(sb);
++ /*
++ * Handle creation of system zone data early because it can fail.
++ * Releasing of existing data is done when we are sure remount will
++ * succeed.
++ */
++ if (test_opt(sb, BLOCK_VALIDITY) && !sbi->system_blks) {
++ err = ext4_setup_system_zone(sb);
++ if (err)
++ goto restore_opts;
++ }
++
+ if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) {
+ err = ext4_commit_super(sb, 1);
+ if (err)
+@@ -5445,8 +5496,16 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ }
+ }
+ #endif
++ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks)
++ ext4_release_system_zone(sb);
++
++ /*
++ * Some options can be enabled by ext4 and/or by VFS mount flag
++ * either way we need to make sure it matches in both *flags and
++ * s_flags. Copy those selected flags from s_flags to *flags
++ */
++ *flags = (*flags & ~vfs_flags) | (sb->s_flags & vfs_flags);
+
+- *flags = (*flags & ~SB_LAZYTIME) | (sb->s_flags & SB_LAZYTIME);
+ ext4_msg(sb, KERN_INFO, "re-mounted. Opts: %s", orig_data);
+ kfree(orig_data);
+ return 0;
+@@ -5460,6 +5519,8 @@ restore_opts:
+ sbi->s_commit_interval = old_opts.s_commit_interval;
+ sbi->s_min_batch_time = old_opts.s_min_batch_time;
+ sbi->s_max_batch_time = old_opts.s_max_batch_time;
++ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks)
++ ext4_release_system_zone(sb);
+ #ifdef CONFIG_QUOTA
+ sbi->s_jquota_fmt = old_opts.s_jquota_fmt;
+ for (i = 0; i < EXT4_MAXQUOTAS; i++) {
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 6b5b685af5990..53ffa6fe207a3 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -2921,7 +2921,7 @@ bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid);
+ void f2fs_alloc_nid_done(struct f2fs_sb_info *sbi, nid_t nid);
+ void f2fs_alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid);
+ int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink);
+-void f2fs_recover_inline_xattr(struct inode *inode, struct page *page);
++int f2fs_recover_inline_xattr(struct inode *inode, struct page *page);
+ int f2fs_recover_xattr_data(struct inode *inode, struct page *page);
+ int f2fs_recover_inode_page(struct f2fs_sb_info *sbi, struct page *page);
+ int f2fs_restore_node_summary(struct f2fs_sb_info *sbi,
+@@ -3314,7 +3314,7 @@ int f2fs_read_inline_data(struct inode *inode, struct page *page);
+ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page);
+ int f2fs_convert_inline_inode(struct inode *inode);
+ int f2fs_write_inline_data(struct inode *inode, struct page *page);
+-bool f2fs_recover_inline_data(struct inode *inode, struct page *npage);
++int f2fs_recover_inline_data(struct inode *inode, struct page *npage);
+ struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir,
+ struct fscrypt_name *fname, struct page **res_page);
+ int f2fs_make_empty_inline_dir(struct inode *inode, struct inode *parent,
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index c1ba29d10789d..2fabeb0bb28fd 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -256,7 +256,7 @@ int f2fs_write_inline_data(struct inode *inode, struct page *page)
+ return 0;
+ }
+
+-bool f2fs_recover_inline_data(struct inode *inode, struct page *npage)
++int f2fs_recover_inline_data(struct inode *inode, struct page *npage)
+ {
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct f2fs_inode *ri = NULL;
+@@ -278,7 +278,8 @@ bool f2fs_recover_inline_data(struct inode *inode, struct page *npage)
+ ri && (ri->i_inline & F2FS_INLINE_DATA)) {
+ process_inline:
+ ipage = f2fs_get_node_page(sbi, inode->i_ino);
+- f2fs_bug_on(sbi, IS_ERR(ipage));
++ if (IS_ERR(ipage))
++ return PTR_ERR(ipage);
+
+ f2fs_wait_on_page_writeback(ipage, NODE, true);
+
+@@ -291,21 +292,25 @@ process_inline:
+
+ set_page_dirty(ipage);
+ f2fs_put_page(ipage, 1);
+- return true;
++ return 1;
+ }
+
+ if (f2fs_has_inline_data(inode)) {
+ ipage = f2fs_get_node_page(sbi, inode->i_ino);
+- f2fs_bug_on(sbi, IS_ERR(ipage));
++ if (IS_ERR(ipage))
++ return PTR_ERR(ipage);
+ f2fs_truncate_inline_inode(inode, ipage, 0);
+ clear_inode_flag(inode, FI_INLINE_DATA);
+ f2fs_put_page(ipage, 1);
+ } else if (ri && (ri->i_inline & F2FS_INLINE_DATA)) {
+- if (f2fs_truncate_blocks(inode, 0, false))
+- return false;
++ int ret;
++
++ ret = f2fs_truncate_blocks(inode, 0, false);
++ if (ret)
++ return ret;
+ goto process_inline;
+ }
+- return false;
++ return 0;
+ }
+
+ struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir,
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index f0714c1258c79..2ff02541c53d5 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -2451,7 +2451,7 @@ int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink)
+ return nr - nr_shrink;
+ }
+
+-void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
++int f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
+ {
+ void *src_addr, *dst_addr;
+ size_t inline_size;
+@@ -2459,7 +2459,8 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
+ struct f2fs_inode *ri;
+
+ ipage = f2fs_get_node_page(F2FS_I_SB(inode), inode->i_ino);
+- f2fs_bug_on(F2FS_I_SB(inode), IS_ERR(ipage));
++ if (IS_ERR(ipage))
++ return PTR_ERR(ipage);
+
+ ri = F2FS_INODE(page);
+ if (ri->i_inline & F2FS_INLINE_XATTR) {
+@@ -2478,6 +2479,7 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page)
+ update_inode:
+ f2fs_update_inode(inode, ipage);
+ f2fs_put_page(ipage, 1);
++ return 0;
+ }
+
+ int f2fs_recover_xattr_data(struct inode *inode, struct page *page)
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 733f005b85d65..ad0486beee2c0 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -471,7 +471,9 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
+
+ /* step 1: recover xattr */
+ if (IS_INODE(page)) {
+- f2fs_recover_inline_xattr(inode, page);
++ err = f2fs_recover_inline_xattr(inode, page);
++ if (err)
++ goto out;
+ } else if (f2fs_has_xattr_block(ofs_of_node(page))) {
+ err = f2fs_recover_xattr_data(inode, page);
+ if (!err)
+@@ -480,8 +482,12 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
+ }
+
+ /* step 2: recover inline data */
+- if (f2fs_recover_inline_data(inode, page))
++ err = f2fs_recover_inline_data(inode, page);
++ if (err) {
++ if (err == 1)
++ err = 0;
+ goto out;
++ }
+
+ /* step 3: recover data indices */
+ start = f2fs_start_bidx_of_node(ofs_of_node(page), inode);
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 9782250c98156..161ce0eb8891a 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1004,6 +1004,9 @@ static void f2fs_put_super(struct super_block *sb)
+ int i;
+ bool dropped;
+
++ /* unregister procfs/sysfs entries in advance to avoid race case */
++ f2fs_unregister_sysfs(sbi);
++
+ f2fs_quota_off_umount(sb);
+
+ /* prevent remaining shrinker jobs */
+@@ -1067,8 +1070,6 @@ static void f2fs_put_super(struct super_block *sb)
+
+ kfree(sbi->ckpt);
+
+- f2fs_unregister_sysfs(sbi);
+-
+ sb->s_fs_info = NULL;
+ if (sbi->s_chksum_driver)
+ crypto_free_shash(sbi->s_chksum_driver);
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 7bfeb1643c1f4..15216b440880a 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -45,7 +45,6 @@ struct wb_completion {
+ struct wb_writeback_work {
+ long nr_pages;
+ struct super_block *sb;
+- unsigned long *older_than_this;
+ enum writeback_sync_modes sync_mode;
+ unsigned int tagged_writepages:1;
+ unsigned int for_kupdate:1;
+@@ -160,7 +159,9 @@ static void inode_io_list_del_locked(struct inode *inode,
+ struct bdi_writeback *wb)
+ {
+ assert_spin_locked(&wb->list_lock);
++ assert_spin_locked(&inode->i_lock);
+
++ inode->i_state &= ~I_SYNC_QUEUED;
+ list_del_init(&inode->i_io_list);
+ wb_io_lists_depopulated(wb);
+ }
+@@ -1042,7 +1043,9 @@ void inode_io_list_del(struct inode *inode)
+ struct bdi_writeback *wb;
+
+ wb = inode_to_wb_and_lock_list(inode);
++ spin_lock(&inode->i_lock);
+ inode_io_list_del_locked(inode, wb);
++ spin_unlock(&inode->i_lock);
+ spin_unlock(&wb->list_lock);
+ }
+
+@@ -1091,8 +1094,10 @@ void sb_clear_inode_writeback(struct inode *inode)
+ * the case then the inode must have been redirtied while it was being written
+ * out and we don't reset its dirtied_when.
+ */
+-static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
++static void redirty_tail_locked(struct inode *inode, struct bdi_writeback *wb)
+ {
++ assert_spin_locked(&inode->i_lock);
++
+ if (!list_empty(&wb->b_dirty)) {
+ struct inode *tail;
+
+@@ -1101,6 +1106,14 @@ static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
+ inode->dirtied_when = jiffies;
+ }
+ inode_io_list_move_locked(inode, wb, &wb->b_dirty);
++ inode->i_state &= ~I_SYNC_QUEUED;
++}
++
++static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
++{
++ spin_lock(&inode->i_lock);
++ redirty_tail_locked(inode, wb);
++ spin_unlock(&inode->i_lock);
+ }
+
+ /*
+@@ -1139,16 +1152,13 @@ static bool inode_dirtied_after(struct inode *inode, unsigned long t)
+ #define EXPIRE_DIRTY_ATIME 0x0001
+
+ /*
+- * Move expired (dirtied before work->older_than_this) dirty inodes from
++ * Move expired (dirtied before dirtied_before) dirty inodes from
+ * @delaying_queue to @dispatch_queue.
+ */
+ static int move_expired_inodes(struct list_head *delaying_queue,
+ struct list_head *dispatch_queue,
+- int flags,
+- struct wb_writeback_work *work)
++ int flags, unsigned long dirtied_before)
+ {
+- unsigned long *older_than_this = NULL;
+- unsigned long expire_time;
+ LIST_HEAD(tmp);
+ struct list_head *pos, *node;
+ struct super_block *sb = NULL;
+@@ -1156,21 +1166,17 @@ static int move_expired_inodes(struct list_head *delaying_queue,
+ int do_sb_sort = 0;
+ int moved = 0;
+
+- if ((flags & EXPIRE_DIRTY_ATIME) == 0)
+- older_than_this = work->older_than_this;
+- else if (!work->for_sync) {
+- expire_time = jiffies - (dirtytime_expire_interval * HZ);
+- older_than_this = &expire_time;
+- }
+ while (!list_empty(delaying_queue)) {
+ inode = wb_inode(delaying_queue->prev);
+- if (older_than_this &&
+- inode_dirtied_after(inode, *older_than_this))
++ if (inode_dirtied_after(inode, dirtied_before))
+ break;
+ list_move(&inode->i_io_list, &tmp);
+ moved++;
++ spin_lock(&inode->i_lock);
+ if (flags & EXPIRE_DIRTY_ATIME)
+- set_bit(__I_DIRTY_TIME_EXPIRED, &inode->i_state);
++ inode->i_state |= I_DIRTY_TIME_EXPIRED;
++ inode->i_state |= I_SYNC_QUEUED;
++ spin_unlock(&inode->i_lock);
+ if (sb_is_blkdev_sb(inode->i_sb))
+ continue;
+ if (sb && sb != inode->i_sb)
+@@ -1208,18 +1214,22 @@ out:
+ * |
+ * +--> dequeue for IO
+ */
+-static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work)
++static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work,
++ unsigned long dirtied_before)
+ {
+ int moved;
++ unsigned long time_expire_jif = dirtied_before;
+
+ assert_spin_locked(&wb->list_lock);
+ list_splice_init(&wb->b_more_io, &wb->b_io);
+- moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, work);
++ moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, dirtied_before);
++ if (!work->for_sync)
++ time_expire_jif = jiffies - dirtytime_expire_interval * HZ;
+ moved += move_expired_inodes(&wb->b_dirty_time, &wb->b_io,
+- EXPIRE_DIRTY_ATIME, work);
++ EXPIRE_DIRTY_ATIME, time_expire_jif);
+ if (moved)
+ wb_io_lists_populated(wb);
+- trace_writeback_queue_io(wb, work, moved);
++ trace_writeback_queue_io(wb, work, dirtied_before, moved);
+ }
+
+ static int write_inode(struct inode *inode, struct writeback_control *wbc)
+@@ -1313,7 +1323,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb,
+ * writeback is not making progress due to locked
+ * buffers. Skip this inode for now.
+ */
+- redirty_tail(inode, wb);
++ redirty_tail_locked(inode, wb);
+ return;
+ }
+
+@@ -1333,7 +1343,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb,
+ * retrying writeback of the dirty page/inode
+ * that cannot be performed immediately.
+ */
+- redirty_tail(inode, wb);
++ redirty_tail_locked(inode, wb);
+ }
+ } else if (inode->i_state & I_DIRTY) {
+ /*
+@@ -1341,10 +1351,11 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb,
+ * such as delayed allocation during submission or metadata
+ * updates after data IO completion.
+ */
+- redirty_tail(inode, wb);
++ redirty_tail_locked(inode, wb);
+ } else if (inode->i_state & I_DIRTY_TIME) {
+ inode->dirtied_when = jiffies;
+ inode_io_list_move_locked(inode, wb, &wb->b_dirty_time);
++ inode->i_state &= ~I_SYNC_QUEUED;
+ } else {
+ /* The inode is clean. Remove from writeback lists. */
+ inode_io_list_del_locked(inode, wb);
+@@ -1588,8 +1599,8 @@ static long writeback_sb_inodes(struct super_block *sb,
+ */
+ spin_lock(&inode->i_lock);
+ if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) {
++ redirty_tail_locked(inode, wb);
+ spin_unlock(&inode->i_lock);
+- redirty_tail(inode, wb);
+ continue;
+ }
+ if ((inode->i_state & I_SYNC) && wbc.sync_mode != WB_SYNC_ALL) {
+@@ -1730,7 +1741,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages,
+ blk_start_plug(&plug);
+ spin_lock(&wb->list_lock);
+ if (list_empty(&wb->b_io))
+- queue_io(wb, &work);
++ queue_io(wb, &work, jiffies);
+ __writeback_inodes_wb(wb, &work);
+ spin_unlock(&wb->list_lock);
+ blk_finish_plug(&plug);
+@@ -1750,7 +1761,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages,
+ * takes longer than a dirty_writeback_interval interval, then leave a
+ * one-second gap.
+ *
+- * older_than_this takes precedence over nr_to_write. So we'll only write back
++ * dirtied_before takes precedence over nr_to_write. So we'll only write back
+ * all dirty pages if they are all attached to "old" mappings.
+ */
+ static long wb_writeback(struct bdi_writeback *wb,
+@@ -1758,14 +1769,11 @@ static long wb_writeback(struct bdi_writeback *wb,
+ {
+ unsigned long wb_start = jiffies;
+ long nr_pages = work->nr_pages;
+- unsigned long oldest_jif;
++ unsigned long dirtied_before = jiffies;
+ struct inode *inode;
+ long progress;
+ struct blk_plug plug;
+
+- oldest_jif = jiffies;
+- work->older_than_this = &oldest_jif;
+-
+ blk_start_plug(&plug);
+ spin_lock(&wb->list_lock);
+ for (;;) {
+@@ -1799,14 +1807,14 @@ static long wb_writeback(struct bdi_writeback *wb,
+ * safe.
+ */
+ if (work->for_kupdate) {
+- oldest_jif = jiffies -
++ dirtied_before = jiffies -
+ msecs_to_jiffies(dirty_expire_interval * 10);
+ } else if (work->for_background)
+- oldest_jif = jiffies;
++ dirtied_before = jiffies;
+
+ trace_writeback_start(wb, work);
+ if (list_empty(&wb->b_io))
+- queue_io(wb, work);
++ queue_io(wb, work, dirtied_before);
+ if (work->sb)
+ progress = writeback_sb_inodes(work->sb, wb, work);
+ else
+@@ -2208,11 +2216,12 @@ void __mark_inode_dirty(struct inode *inode, int flags)
+ inode->i_state |= flags;
+
+ /*
+- * If the inode is being synced, just update its dirty state.
+- * The unlocker will place the inode on the appropriate
+- * superblock list, based upon its state.
++ * If the inode is queued for writeback by flush worker, just
++ * update its dirty state. Once the flush worker is done with
++ * the inode it will place it on the appropriate superblock
++ * list, based upon its state.
+ */
+- if (inode->i_state & I_SYNC)
++ if (inode->i_state & I_SYNC_QUEUED)
+ goto out_unlock_inode;
+
+ /*
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 43693b6797105..8c305593fb51f 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1915,6 +1915,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
+ */
+ static void __jbd2_journal_unfile_buffer(struct journal_head *jh)
+ {
++ J_ASSERT_JH(jh, jh->b_transaction != NULL);
++ J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
++
+ __jbd2_journal_temp_unlink_buffer(jh);
+ jh->b_transaction = NULL;
+ jbd2_journal_put_journal_head(jh);
+@@ -2006,6 +2009,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
+ {
+ struct buffer_head *head;
+ struct buffer_head *bh;
++ bool has_write_io_error = false;
+ int ret = 0;
+
+ J_ASSERT(PageLocked(page));
+@@ -2030,11 +2034,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
+ jbd_unlock_bh_state(bh);
+ if (buffer_jbd(bh))
+ goto busy;
++
++ /*
++ * If we free a metadata buffer which has been failed to
++ * write out, the jbd2 checkpoint procedure will not detect
++ * this failure and may lead to filesystem inconsistency
++ * after cleanup journal tail.
++ */
++ if (buffer_write_io_error(bh)) {
++ pr_err("JBD2: Error while async write back metadata bh %llu.",
++ (unsigned long long)bh->b_blocknr);
++ has_write_io_error = true;
++ }
+ } while ((bh = bh->b_this_page) != head);
+
+ ret = try_to_free_buffers(page);
+
+ busy:
++ if (has_write_io_error)
++ jbd2_journal_abort(journal, -EIO);
++
+ return ret;
+ }
+
+@@ -2462,6 +2481,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
+
+ was_dirty = test_clear_buffer_jbddirty(bh);
+ __jbd2_journal_temp_unlink_buffer(jh);
++
++ /*
++ * b_transaction must be set, otherwise the new b_transaction won't
++ * be holding jh reference
++ */
++ J_ASSERT_JH(jh, jh->b_transaction != NULL);
++
+ /*
+ * We set b_transaction here because b_next_transaction will inherit
+ * our jh reference and thus __jbd2_journal_file_buffer() must not
+diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
+index 901f27ac94abc..56e9043bddc71 100644
+--- a/fs/xfs/xfs_icache.c
++++ b/fs/xfs/xfs_icache.c
+@@ -1127,7 +1127,7 @@ restart:
+ goto out_ifunlock;
+ xfs_iunpin_wait(ip);
+ }
+- if (xfs_iflags_test(ip, XFS_ISTALE) || xfs_inode_clean(ip)) {
++ if (xfs_inode_clean(ip)) {
+ xfs_ifunlock(ip);
+ goto reclaim;
+ }
+@@ -1214,6 +1214,7 @@ reclaim:
+ xfs_ilock(ip, XFS_ILOCK_EXCL);
+ xfs_qm_dqdetach(ip);
+ xfs_iunlock(ip, XFS_ILOCK_EXCL);
++ ASSERT(xfs_inode_clean(ip));
+
+ __xfs_inode_free(ip);
+ return error;
+diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
+index f2d06e1e49066..cd81d6d9848d1 100644
+--- a/fs/xfs/xfs_inode.c
++++ b/fs/xfs/xfs_inode.c
+@@ -1772,10 +1772,31 @@ xfs_inactive_ifree(
+ return error;
+ }
+
++ /*
++ * We do not hold the inode locked across the entire rolling transaction
++ * here. We only need to hold it for the first transaction that
++ * xfs_ifree() builds, which may mark the inode XFS_ISTALE if the
++ * underlying cluster buffer is freed. Relogging an XFS_ISTALE inode
++ * here breaks the relationship between cluster buffer invalidation and
++ * stale inode invalidation on cluster buffer item journal commit
++ * completion, and can result in leaving dirty stale inodes hanging
++ * around in memory.
++ *
++ * We have no need for serialising this inode operation against other
++ * operations - we freed the inode and hence reallocation is required
++ * and that will serialise on reallocating the space the deferops need
++ * to free. Hence we can unlock the inode on the first commit of
++ * the transaction rather than roll it right through the deferops. This
++ * avoids relogging the XFS_ISTALE inode.
++ *
++ * We check that xfs_ifree() hasn't grown an internal transaction roll
++ * by asserting that the inode is still locked when it returns.
++ */
+ xfs_ilock(ip, XFS_ILOCK_EXCL);
+- xfs_trans_ijoin(tp, ip, 0);
++ xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
+
+ error = xfs_ifree(tp, ip);
++ ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
+ if (error) {
+ /*
+ * If we fail to free the inode, shut down. The cancel
+@@ -1788,7 +1809,6 @@ xfs_inactive_ifree(
+ xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
+ }
+ xfs_trans_cancel(tp);
+- xfs_iunlock(ip, XFS_ILOCK_EXCL);
+ return error;
+ }
+
+@@ -1806,7 +1826,6 @@ xfs_inactive_ifree(
+ xfs_notice(mp, "%s: xfs_trans_commit returned error %d",
+ __func__, error);
+
+- xfs_iunlock(ip, XFS_ILOCK_EXCL);
+ return 0;
+ }
+
+diff --git a/fs/xfs/xfs_trans_inode.c b/fs/xfs/xfs_trans_inode.c
+index 542927321a61b..ae453dd236a69 100644
+--- a/fs/xfs/xfs_trans_inode.c
++++ b/fs/xfs/xfs_trans_inode.c
+@@ -39,6 +39,7 @@ xfs_trans_ijoin(
+
+ ASSERT(iip->ili_lock_flags == 0);
+ iip->ili_lock_flags = lock_flags;
++ ASSERT(!xfs_iflags_test(ip, XFS_ISTALE));
+
+ /*
+ * Get a log_item_desc to point at the new item.
+@@ -90,6 +91,7 @@ xfs_trans_log_inode(
+
+ ASSERT(ip->i_itemp != NULL);
+ ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
++ ASSERT(!xfs_iflags_test(ip, XFS_ISTALE));
+
+ /*
+ * Don't bother with i_lock for the I_DIRTY_TIME check here, as races
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index 6797811bf1e6c..9a5d4b4992716 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -996,7 +996,11 @@ extern void *efi_get_pal_addr (void);
+ extern void efi_map_pal_code (void);
+ extern void efi_memmap_walk (efi_freemem_callback_t callback, void *arg);
+ extern void efi_gettimeofday (struct timespec64 *ts);
++#ifdef CONFIG_EFI
+ extern void efi_enter_virtual_mode (void); /* switch EFI to virtual mode, if possible */
++#else
++static inline void efi_enter_virtual_mode (void) {}
++#endif
+ #ifdef CONFIG_X86
+ extern void efi_free_boot_services(void);
+ extern efi_status_t efi_query_variable_store(u32 attributes,
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 8d568b51778ba..876bfb6df06a9 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2050,6 +2050,10 @@ static inline void init_sync_kiocb(struct kiocb *kiocb, struct file *filp)
+ *
+ * I_CREATING New object's inode in the middle of setting up.
+ *
++ * I_SYNC_QUEUED Inode is queued in b_io or b_more_io writeback lists.
++ * Used to detect that mark_inode_dirty() should not move
++ * inode between dirty lists.
++ *
+ * Q: What is the difference between I_WILL_FREE and I_FREEING?
+ */
+ #define I_DIRTY_SYNC (1 << 0)
+@@ -2067,11 +2071,11 @@ static inline void init_sync_kiocb(struct kiocb *kiocb, struct file *filp)
+ #define I_DIO_WAKEUP (1 << __I_DIO_WAKEUP)
+ #define I_LINKABLE (1 << 10)
+ #define I_DIRTY_TIME (1 << 11)
+-#define __I_DIRTY_TIME_EXPIRED 12
+-#define I_DIRTY_TIME_EXPIRED (1 << __I_DIRTY_TIME_EXPIRED)
++#define I_DIRTY_TIME_EXPIRED (1 << 12)
+ #define I_WB_SWITCH (1 << 13)
+ #define I_OVL_INUSE (1 << 14)
+ #define I_CREATING (1 << 15)
++#define I_SYNC_QUEUED (1 << 17)
+
+ #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC)
+ #define I_DIRTY (I_DIRTY_INODE | I_DIRTY_PAGES)
+diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
+index 32db72c7c055f..29d09755e5cfc 100644
+--- a/include/trace/events/writeback.h
++++ b/include/trace/events/writeback.h
+@@ -360,8 +360,9 @@ DEFINE_WBC_EVENT(wbc_writepage);
+ TRACE_EVENT(writeback_queue_io,
+ TP_PROTO(struct bdi_writeback *wb,
+ struct wb_writeback_work *work,
++ unsigned long dirtied_before,
+ int moved),
+- TP_ARGS(wb, work, moved),
++ TP_ARGS(wb, work, dirtied_before, moved),
+ TP_STRUCT__entry(
+ __array(char, name, 32)
+ __field(unsigned long, older)
+@@ -371,19 +372,17 @@ TRACE_EVENT(writeback_queue_io,
+ __field(unsigned int, cgroup_ino)
+ ),
+ TP_fast_assign(
+- unsigned long *older_than_this = work->older_than_this;
+ strncpy(__entry->name, dev_name(wb->bdi->dev), 32);
+- __entry->older = older_than_this ? *older_than_this : 0;
+- __entry->age = older_than_this ?
+- (jiffies - *older_than_this) * 1000 / HZ : -1;
++ __entry->older = dirtied_before;
++ __entry->age = (jiffies - dirtied_before) * 1000 / HZ;
+ __entry->moved = moved;
+ __entry->reason = work->reason;
+ __entry->cgroup_ino = __trace_wb_assign_cgroup(wb);
+ ),
+ TP_printk("bdi %s: older=%lu age=%ld enqueue=%d reason=%s cgroup_ino=%u",
+ __entry->name,
+- __entry->older, /* older_than_this in jiffies */
+- __entry->age, /* older_than_this in relative milliseconds */
++ __entry->older, /* dirtied_before in jiffies */
++ __entry->age, /* dirtied_before in relative milliseconds */
+ __entry->moved,
+ __print_symbolic(__entry->reason, WB_WORK_REASON),
+ __entry->cgroup_ino
+diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
+index 30cc217b86318..651a4ad6d711f 100644
+--- a/kernel/irq/matrix.c
++++ b/kernel/irq/matrix.c
+@@ -380,6 +380,13 @@ int irq_matrix_alloc(struct irq_matrix *m, const struct cpumask *msk,
+ unsigned int cpu, bit;
+ struct cpumap *cm;
+
++ /*
++ * Not required in theory, but matrix_find_best_cpu() uses
++ * for_each_cpu() which ignores the cpumask on UP .
++ */
++ if (cpumask_empty(msk))
++ return -EINVAL;
++
+ cpu = matrix_find_best_cpu(m, msk);
+ if (cpu == UINT_MAX)
+ return -ENOSPC;
+diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
+index 6fcc4650f0c48..53cc3bb7025a5 100644
+--- a/kernel/locking/lockdep_proc.c
++++ b/kernel/locking/lockdep_proc.c
+@@ -394,7 +394,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt)
+ seq_time(m, lt->min);
+ seq_time(m, lt->max);
+ seq_time(m, lt->total);
+- seq_time(m, lt->nr ? div_s64(lt->total, lt->nr) : 0);
++ seq_time(m, lt->nr ? div64_u64(lt->total, lt->nr) : 0);
+ }
+
+ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 7a4ca2deb39bc..1442f6152abc2 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -529,6 +529,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ if (!dir)
+ goto err;
+
++ /*
++ * As blktrace relies on debugfs for its interface the debugfs directory
++ * is required, contrary to the usual mantra of not checking for debugfs
++ * files or directories.
++ */
++ if (IS_ERR_OR_NULL(dir)) {
++ pr_warn("debugfs_dir not present for %s so skipping\n",
++ buts->name);
++ ret = -ENOENT;
++ goto err;
++ }
++
+ bt->dev = dev;
+ atomic_set(&bt->dropped, 0);
+ INIT_LIST_HEAD(&bt->running_list);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 0629ca89ab74f..af6e9028716d1 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -5128,8 +5128,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb)
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (unlikely(!skb))
+ goto err_free;
+-
+- if (unlikely(!pskb_may_pull(skb, VLAN_HLEN)))
++ /* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */
++ if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short))))
+ goto err_free;
+
+ vhdr = (struct vlan_hdr *)skb->data;
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 8e70a015c7928..b825ac025d5bd 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -865,7 +865,15 @@ int ip6_tnl_rcv(struct ip6_tnl *t, struct sk_buff *skb,
+ struct metadata_dst *tun_dst,
+ bool log_ecn_err)
+ {
+- return __ip6_tnl_rcv(t, skb, tpi, tun_dst, ip6ip6_dscp_ecn_decapsulate,
++ int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
++ const struct ipv6hdr *ipv6h,
++ struct sk_buff *skb);
++
++ dscp_ecn_decapsulate = ip6ip6_dscp_ecn_decapsulate;
++ if (tpi->proto == htons(ETH_P_IP))
++ dscp_ecn_decapsulate = ip4ip6_dscp_ecn_decapsulate;
++
++ return __ip6_tnl_rcv(t, skb, tpi, tun_dst, dscp_ecn_decapsulate,
+ log_ecn_err);
+ }
+ EXPORT_SYMBOL(ip6_tnl_rcv);
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index b5671966fa037..42bd1e74f78c1 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -554,23 +554,25 @@ static void qrtr_port_remove(struct qrtr_sock *ipc)
+ */
+ static int qrtr_port_assign(struct qrtr_sock *ipc, int *port)
+ {
++ u32 min_port;
+ int rc;
+
+ mutex_lock(&qrtr_port_lock);
+ if (!*port) {
+- rc = idr_alloc(&qrtr_ports, ipc,
+- QRTR_MIN_EPH_SOCKET, QRTR_MAX_EPH_SOCKET + 1,
+- GFP_ATOMIC);
+- if (rc >= 0)
+- *port = rc;
++ min_port = QRTR_MIN_EPH_SOCKET;
++ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, QRTR_MAX_EPH_SOCKET, GFP_ATOMIC);
++ if (!rc)
++ *port = min_port;
+ } else if (*port < QRTR_MIN_EPH_SOCKET && !capable(CAP_NET_ADMIN)) {
+ rc = -EACCES;
+ } else if (*port == QRTR_PORT_CTRL) {
+- rc = idr_alloc(&qrtr_ports, ipc, 0, 1, GFP_ATOMIC);
++ min_port = 0;
++ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, 0, GFP_ATOMIC);
+ } else {
+- rc = idr_alloc(&qrtr_ports, ipc, *port, *port + 1, GFP_ATOMIC);
+- if (rc >= 0)
+- *port = rc;
++ min_port = *port;
++ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, *port, GFP_ATOMIC);
++ if (!rc)
++ *port = min_port;
+ }
+ mutex_unlock(&qrtr_port_lock);
+
+diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c
+index 2379a02c319d7..6c4a7a5938b7a 100644
+--- a/net/smc/smc_diag.c
++++ b/net/smc/smc_diag.c
+@@ -169,13 +169,15 @@ static int __smc_diag_dump(struct sock *sk, struct sk_buff *skb,
+ (req->diag_ext & (1 << (SMC_DIAG_DMBINFO - 1))) &&
+ !list_empty(&smc->conn.lgr->list)) {
+ struct smc_connection *conn = &smc->conn;
+- struct smcd_diag_dmbinfo dinfo = {
+- .linkid = *((u32 *)conn->lgr->id),
+- .peer_gid = conn->lgr->peer_gid,
+- .my_gid = conn->lgr->smcd->local_gid,
+- .token = conn->rmb_desc->token,
+- .peer_token = conn->peer_token
+- };
++ struct smcd_diag_dmbinfo dinfo;
++
++ memset(&dinfo, 0, sizeof(dinfo));
++
++ dinfo.linkid = *((u32 *)conn->lgr->id);
++ dinfo.peer_gid = conn->lgr->peer_gid;
++ dinfo.my_gid = conn->lgr->smcd->local_gid;
++ dinfo.token = conn->rmb_desc->token;
++ dinfo.peer_token = conn->peer_token;
+
+ if (nla_put(skb, SMC_DIAG_DMBINFO, sizeof(dinfo), &dinfo) < 0)
+ goto errout;
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 29e684054abe3..f8e111218a0ec 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -255,8 +255,9 @@ err_out:
+ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
+ struct tipc_nl_compat_msg *msg)
+ {
+- int err;
++ struct nlmsghdr *nlh;
+ struct sk_buff *arg;
++ int err;
+
+ if (msg->req_type && (!msg->req_size ||
+ !TLV_CHECK_TYPE(msg->req, msg->req_type)))
+@@ -285,6 +286,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
+ return -ENOMEM;
+ }
+
++ nlh = nlmsg_put(arg, 0, 0, tipc_genl_family.id, 0, NLM_F_MULTI);
++ if (!nlh) {
++ kfree_skb(arg);
++ kfree_skb(msg->rep);
++ msg->rep = NULL;
++ return -EMSGSIZE;
++ }
++ nlmsg_end(arg, nlh);
++
+ err = __tipc_nl_compat_dumpit(cmd, msg, arg);
+ if (err) {
+ kfree_skb(msg->rep);
+diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c
+index 146e1a3498c73..419da70cd942a 100644
+--- a/sound/pci/cs46xx/cs46xx_lib.c
++++ b/sound/pci/cs46xx/cs46xx_lib.c
+@@ -780,7 +780,7 @@ static void snd_cs46xx_set_capture_sample_rate(struct snd_cs46xx *chip, unsigned
+ rate = 48000 / 9;
+
+ /*
+- * We can not capture at at rate greater than the Input Rate (48000).
++ * We can not capture at a rate greater than the Input Rate (48000).
+ * Return an error if an attempt is made to stray outside that limit.
+ */
+ if (rate > 48000)
+diff --git a/sound/pci/cs46xx/dsp_spos_scb_lib.c b/sound/pci/cs46xx/dsp_spos_scb_lib.c
+index 8d0a3d3573457..8ef51a29380af 100644
+--- a/sound/pci/cs46xx/dsp_spos_scb_lib.c
++++ b/sound/pci/cs46xx/dsp_spos_scb_lib.c
+@@ -1739,7 +1739,7 @@ int cs46xx_iec958_pre_open (struct snd_cs46xx *chip)
+ struct dsp_spos_instance * ins = chip->dsp_spos_instance;
+
+ if ( ins->spdif_status_out & DSP_SPDIF_STATUS_OUTPUT_ENABLED ) {
+- /* remove AsynchFGTxSCB and and PCMSerialInput_II */
++ /* remove AsynchFGTxSCB and PCMSerialInput_II */
+ cs46xx_dsp_disable_spdif_out (chip);
+
+ /* save state */
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index f3a6b1d869d8a..dbeb62362f1c3 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -3410,7 +3410,7 @@ EXPORT_SYMBOL_GPL(snd_hda_set_power_save);
+ * @nid: NID to check / update
+ *
+ * Check whether the given NID is in the amp list. If it's in the list,
+- * check the current AMP status, and update the the power-status according
++ * check the current AMP status, and update the power-status according
+ * to the mute status.
+ *
+ * This function is supposed to be set or called from the check_power_status
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 2609161707a41..97adb7e340f99 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -825,7 +825,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
+ }
+ }
+
+-/* sync power of each widget in the the given path */
++/* sync power of each widget in the given path */
+ static hda_nid_t path_power_update(struct hda_codec *codec,
+ struct nid_path *path,
+ bool allow_powerdown)
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index d8168aa2cef38..85c33f528d7b3 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -845,7 +845,7 @@ static int stac_auto_create_beep_ctls(struct hda_codec *codec,
+ static struct snd_kcontrol_new beep_vol_ctl =
+ HDA_CODEC_VOLUME(NULL, 0, 0, 0);
+
+- /* check for mute support for the the amp */
++ /* check for mute support for the amp */
+ if ((caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT) {
+ const struct snd_kcontrol_new *temp;
+ if (spec->anabeep_nid == nid)
+diff --git a/sound/pci/ice1712/prodigy192.c b/sound/pci/ice1712/prodigy192.c
+index 3919aed39ca03..5e52086d7b986 100644
+--- a/sound/pci/ice1712/prodigy192.c
++++ b/sound/pci/ice1712/prodigy192.c
+@@ -31,7 +31,7 @@
+ * Experimentally I found out that only a combination of
+ * OCKS0=1, OCKS1=1 (128fs, 64fs output) and ice1724 -
+ * VT1724_MT_I2S_MCLK_128X=0 (256fs input) yields correct
+- * sampling rate. That means the the FPGA doubles the
++ * sampling rate. That means that the FPGA doubles the
+ * MCK01 rate.
+ *
+ * Copyright (c) 2003 Takashi Iwai <tiwai@suse.de>
+diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
+index 4cf3200e988b0..df44135e1b0c9 100644
+--- a/sound/pci/oxygen/xonar_dg.c
++++ b/sound/pci/oxygen/xonar_dg.c
+@@ -39,7 +39,7 @@
+ * GPIO 4 <- headphone detect
+ * GPIO 5 -> enable ADC analog circuit for the left channel
+ * GPIO 6 -> enable ADC analog circuit for the right channel
+- * GPIO 7 -> switch green rear output jack between CS4245 and and the first
++ * GPIO 7 -> switch green rear output jack between CS4245 and the first
+ * channel of CS4361 (mechanical relay)
+ * GPIO 8 -> enable output to speakers
+ *
+diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c
+index 108e8bf42a346..f0a409504a13b 100644
+--- a/sound/soc/codecs/wm8958-dsp2.c
++++ b/sound/soc/codecs/wm8958-dsp2.c
+@@ -419,8 +419,12 @@ int wm8958_aif_ev(struct snd_soc_dapm_widget *w,
+ struct snd_kcontrol *kcontrol, int event)
+ {
+ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
++ struct wm8994 *control = dev_get_drvdata(component->dev->parent);
+ int i;
+
++ if (control->type != WM8958)
++ return 0;
++
+ switch (event) {
+ case SND_SOC_DAPM_POST_PMU:
+ case SND_SOC_DAPM_PRE_PMU:
+diff --git a/sound/soc/img/img-i2s-in.c b/sound/soc/img/img-i2s-in.c
+index c22880aea82a2..7e48c740bf550 100644
+--- a/sound/soc/img/img-i2s-in.c
++++ b/sound/soc/img/img-i2s-in.c
+@@ -346,8 +346,10 @@ static int img_i2s_in_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ chan_control_mask = IMG_I2S_IN_CH_CTL_CLK_TRANS_MASK;
+
+ ret = pm_runtime_get_sync(i2s->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(i2s->dev);
+ return ret;
++ }
+
+ for (i = 0; i < i2s->active_channels; i++)
+ img_i2s_in_ch_disable(i2s, i);
+diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c
+index acc005217be06..f56752662b199 100644
+--- a/sound/soc/img/img-parallel-out.c
++++ b/sound/soc/img/img-parallel-out.c
+@@ -166,8 +166,10 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ }
+
+ ret = pm_runtime_get_sync(prl->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(prl->dev);
+ return ret;
++ }
+
+ reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL);
+ reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set;
+diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
+index 43679aeeb12be..88e838ac937dc 100644
+--- a/sound/soc/tegra/tegra30_ahub.c
++++ b/sound/soc/tegra/tegra30_ahub.c
+@@ -655,8 +655,10 @@ static int tegra30_ahub_resume(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put(dev);
+ return ret;
++ }
+ ret = regcache_sync(ahub->regmap_ahub);
+ ret |= regcache_sync(ahub->regmap_apbif);
+ pm_runtime_put(dev);
+diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
+index 0b176ea24914b..bf155c5092f06 100644
+--- a/sound/soc/tegra/tegra30_i2s.c
++++ b/sound/soc/tegra/tegra30_i2s.c
+@@ -551,8 +551,10 @@ static int tegra30_i2s_resume(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put(dev);
+ return ret;
++ }
+ ret = regcache_sync(i2s->regmap);
+ pm_runtime_put(dev);
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 89b70308b5513..83f72ddf4fda6 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3524,8 +3524,8 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */
+ * they pretend to be 96kHz mono as a workaround for stereo being broken
+ * by that...
+ *
+- * They also have swapped L-R channels, but that's for userspace to deal
+- * with.
++ * They also have an issue with initial stream alignment that causes the
++ * channels to be swapped and out of phase, which is dealt with in quirks.c.
+ */
+ {
+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
+index 94110b1dcd3d8..031baa43646fb 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
+@@ -91,8 +91,6 @@ int back_to_back_ebbs(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ event_close(&event);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
+index 7c57a8d79535d..361e0be9df9ae 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
+@@ -42,8 +42,6 @@ int cycles(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ event_close(&event);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
+index ecf5ee3283a3e..fe7d0dc2a1a26 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
+@@ -99,8 +99,6 @@ int cycles_with_freeze(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ printf("EBBs while frozen %d\n", ebbs_while_frozen);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
+index c0faba520b35c..b9b30f974b5ea 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
+@@ -71,8 +71,6 @@ int cycles_with_mmcr2(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ event_close(&event);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
+index 46681fec549b8..2694ae161a84a 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
+@@ -396,8 +396,6 @@ int ebb_child(union pipe read_pipe, union pipe write_pipe)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ event_close(&event);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
+index a991d2ea8d0a1..174e4f4dae6c0 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
+@@ -38,8 +38,6 @@ static int victim_child(union pipe read_pipe, union pipe write_pipe)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ FAIL_IF(ebb_state.stats.ebb_count == 0);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
+index 2ed7ad33f7a3b..dddb95938304e 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
+@@ -75,7 +75,6 @@ static int test_body(void)
+ ebb_freeze_pmcs();
+ ebb_global_disable();
+
+- count_pmc(4, sample_period);
+ mtspr(SPRN_PMC4, 0xdead);
+
+ dump_summary_ebb_state();
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
+index 6ff8c8ff27d66..035c02273cd49 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
+@@ -70,13 +70,6 @@ int multi_counter(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+- count_pmc(2, sample_period);
+- count_pmc(3, sample_period);
+- count_pmc(4, sample_period);
+- count_pmc(5, sample_period);
+- count_pmc(6, sample_period);
+-
+ dump_ebb_state();
+
+ for (i = 0; i < 6; i++)
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
+index 037cb6154f360..3e9d4ac965c85 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
+@@ -61,8 +61,6 @@ static int cycles_child(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_summary_ebb_state();
+
+ event_close(&event);
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
+index c5fa64790c22e..d90891fe96a32 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
+@@ -82,8 +82,6 @@ static int test_body(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(1, sample_period);
+-
+ dump_ebb_state();
+
+ if (mmcr0_mismatch)
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
+index 30e1ac62e8cb4..8ca92b9ee5b01 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
+@@ -76,8 +76,6 @@ int pmc56_overflow(void)
+ ebb_global_disable();
+ ebb_freeze_pmcs();
+
+- count_pmc(2, sample_period);
+-
+ dump_ebb_state();
+
+ printf("PMC5/6 overflow %d\n", pmc56_overflowed);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-09-09 17:59 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-09-09 17:59 UTC (permalink / raw
To: gentoo-commits
commit: da15fdc8f254f2da7da6a4e9dfa62b88ed14034e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 9 17:59:26 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Sep 9 17:59:26 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=da15fdc8
Linux patch 4.19.144
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1143_linux-4.19.144.patch | 3925 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3929 insertions(+)
diff --git a/0000_README b/0000_README
index f31a3e5..be0a5e0 100644
--- a/0000_README
+++ b/0000_README
@@ -611,6 +611,10 @@ Patch: 1142_linux-4.19.143.patch
From: https://www.kernel.org
Desc: Linux 4.19.143
+Patch: 1143_linux-4.19.144.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.144
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1143_linux-4.19.144.patch b/1143_linux-4.19.144.patch
new file mode 100644
index 0000000..f86fb4f
--- /dev/null
+++ b/1143_linux-4.19.144.patch
@@ -0,0 +1,3925 @@
+diff --git a/Documentation/filesystems/affs.txt b/Documentation/filesystems/affs.txt
+index 71b63c2b98410..a8f1a58e36922 100644
+--- a/Documentation/filesystems/affs.txt
++++ b/Documentation/filesystems/affs.txt
+@@ -93,13 +93,15 @@ The Amiga protection flags RWEDRWEDHSPARWED are handled as follows:
+
+ - R maps to r for user, group and others. On directories, R implies x.
+
+- - If both W and D are allowed, w will be set.
++ - W maps to w.
+
+ - E maps to x.
+
+- - H and P are always retained and ignored under Linux.
++ - D is ignored.
+
+- - A is always reset when a file is written to.
++ - H, S and P are always retained and ignored under Linux.
++
++ - A is cleared when a file is written to.
+
+ User id and group id will be used unless set[gu]id are given as mount
+ options. Since most of the Amiga file systems are single user systems
+@@ -111,11 +113,13 @@ Linux -> Amiga:
+
+ The Linux rwxrwxrwx file mode is handled as follows:
+
+- - r permission will set R for user, group and others.
++ - r permission will allow R for user, group and others.
++
++ - w permission will allow W for user, group and others.
+
+- - w permission will set W and D for user, group and others.
++ - x permission of the user will allow E for plain files.
+
+- - x permission of the user will set E for plain files.
++ - D will be allowed for user, group and others.
+
+ - All other flags (suid, sgid, ...) are ignored and will
+ not be retained.
+diff --git a/Makefile b/Makefile
+index 6fa3278df77c9..ba9d0b4476e11 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 143
++SUBLEVEL = 144
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
+index 8b284cbf8162f..a3b6f58d188c9 100644
+--- a/arch/arm64/include/asm/kvm_arm.h
++++ b/arch/arm64/include/asm/kvm_arm.h
+@@ -83,11 +83,12 @@
+ * IMO: Override CPSR.I and enable signaling with VI
+ * FMO: Override CPSR.F and enable signaling with VF
+ * SWIO: Turn set/way invalidates into set/way clean+invalidate
++ * PTW: Take a stage2 fault if a stage1 walk steps in device memory
+ */
+ #define HCR_GUEST_FLAGS (HCR_TSC | HCR_TSW | HCR_TWE | HCR_TWI | HCR_VM | \
+ HCR_TVM | HCR_BSU_IS | HCR_FB | HCR_TAC | \
+ HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW | HCR_TLOR | \
+- HCR_FMO | HCR_IMO)
++ HCR_FMO | HCR_IMO | HCR_PTW )
+ #define HCR_VIRT_EXCP_MASK (HCR_VSE | HCR_VI | HCR_VF)
+ #define HCR_HOST_NVHE_FLAGS (HCR_RW | HCR_API | HCR_APK)
+ #define HCR_HOST_VHE_FLAGS (HCR_RW | HCR_TGE | HCR_E2H)
+diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h
+index 102b5a5c47b6c..e3c0dba5bddea 100644
+--- a/arch/arm64/include/asm/kvm_asm.h
++++ b/arch/arm64/include/asm/kvm_asm.h
+@@ -87,6 +87,34 @@ extern u32 __init_stage2_translation(void);
+ *__hyp_this_cpu_ptr(sym); \
+ })
+
++#define __KVM_EXTABLE(from, to) \
++ " .pushsection __kvm_ex_table, \"a\"\n" \
++ " .align 3\n" \
++ " .long (" #from " - .), (" #to " - .)\n" \
++ " .popsection\n"
++
++
++#define __kvm_at(at_op, addr) \
++( { \
++ int __kvm_at_err = 0; \
++ u64 spsr, elr; \
++ asm volatile( \
++ " mrs %1, spsr_el2\n" \
++ " mrs %2, elr_el2\n" \
++ "1: at "at_op", %3\n" \
++ " isb\n" \
++ " b 9f\n" \
++ "2: msr spsr_el2, %1\n" \
++ " msr elr_el2, %2\n" \
++ " mov %w0, %4\n" \
++ "9:\n" \
++ __KVM_EXTABLE(1b, 2b) \
++ : "+r" (__kvm_at_err), "=&r" (spsr), "=&r" (elr) \
++ : "r" (addr), "i" (-EFAULT)); \
++ __kvm_at_err; \
++} )
++
++
+ #else /* __ASSEMBLY__ */
+
+ .macro hyp_adr_this_cpu reg, sym, tmp
+@@ -111,6 +139,21 @@ extern u32 __init_stage2_translation(void);
+ kern_hyp_va \vcpu
+ .endm
+
++/*
++ * KVM extable for unexpected exceptions.
++ * In the same format _asm_extable, but output to a different section so that
++ * it can be mapped to EL2. The KVM version is not sorted. The caller must
++ * ensure:
++ * x18 has the hypervisor value to allow any Shadow-Call-Stack instrumented
++ * code to write to it, and that SPSR_EL2 and ELR_EL2 are restored by the fixup.
++ */
++.macro _kvm_extable, from, to
++ .pushsection __kvm_ex_table, "a"
++ .align 3
++ .long (\from - .), (\to - .)
++ .popsection
++.endm
++
+ #endif
+
+ #endif /* __ARM_KVM_ASM_H__ */
+diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
+index d6050c6e65bc1..69e7c8d4a00f6 100644
+--- a/arch/arm64/kernel/vmlinux.lds.S
++++ b/arch/arm64/kernel/vmlinux.lds.S
+@@ -24,6 +24,13 @@ ENTRY(_text)
+
+ jiffies = jiffies_64;
+
++
++#define HYPERVISOR_EXTABLE \
++ . = ALIGN(SZ_8); \
++ __start___kvm_ex_table = .; \
++ *(__kvm_ex_table) \
++ __stop___kvm_ex_table = .;
++
+ #define HYPERVISOR_TEXT \
+ /* \
+ * Align to 4 KB so that \
+@@ -39,6 +46,7 @@ jiffies = jiffies_64;
+ __hyp_idmap_text_end = .; \
+ __hyp_text_start = .; \
+ *(.hyp.text) \
++ HYPERVISOR_EXTABLE \
+ __hyp_text_end = .;
+
+ #define IDMAP_TEXT \
+diff --git a/arch/arm64/kvm/hyp/entry.S b/arch/arm64/kvm/hyp/entry.S
+index fad1e164fe488..fc83e932afbe3 100644
+--- a/arch/arm64/kvm/hyp/entry.S
++++ b/arch/arm64/kvm/hyp/entry.S
+@@ -17,6 +17,7 @@
+
+ #include <linux/linkage.h>
+
++#include <asm/alternative.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/assembler.h>
+ #include <asm/fpsimdmacros.h>
+@@ -62,6 +63,20 @@ ENTRY(__guest_enter)
+ // Store the host regs
+ save_callee_saved_regs x1
+
++ // Now the host state is stored if we have a pending RAS SError it must
++ // affect the host. If any asynchronous exception is pending we defer
++ // the guest entry. The DSB isn't necessary before v8.2 as any SError
++ // would be fatal.
++alternative_if ARM64_HAS_RAS_EXTN
++ dsb nshst
++ isb
++alternative_else_nop_endif
++ mrs x1, isr_el1
++ cbz x1, 1f
++ mov x0, #ARM_EXCEPTION_IRQ
++ ret
++
++1:
+ add x18, x0, #VCPU_CONTEXT
+
+ // Restore guest regs x0-x17
+@@ -148,18 +163,22 @@ alternative_endif
+ // This is our single instruction exception window. A pending
+ // SError is guaranteed to occur at the earliest when we unmask
+ // it, and at the latest just after the ISB.
+- .global abort_guest_exit_start
+ abort_guest_exit_start:
+
+ isb
+
+- .global abort_guest_exit_end
+ abort_guest_exit_end:
++ msr daifset, #4 // Mask aborts
++ ret
++
++ _kvm_extable abort_guest_exit_start, 9997f
++ _kvm_extable abort_guest_exit_end, 9997f
++9997:
++ msr daifset, #4 // Mask aborts
++ mov x0, #(1 << ARM_EXIT_WITH_SERROR_BIT)
+
+- // If the exception took place, restore the EL1 exception
+- // context so that we can report some information.
+- // Merge the exception code with the SError pending bit.
+- tbz x0, #ARM_EXIT_WITH_SERROR_BIT, 1f
++ // restore the EL1 exception context so that we can report some
++ // information. Merge the exception code with the SError pending bit.
+ msr elr_el2, x2
+ msr esr_el2, x3
+ msr spsr_el2, x4
+diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S
+index 24b4fbafe3e4a..ea063312bca18 100644
+--- a/arch/arm64/kvm/hyp/hyp-entry.S
++++ b/arch/arm64/kvm/hyp/hyp-entry.S
+@@ -26,6 +26,30 @@
+ #include <asm/kvm_mmu.h>
+ #include <asm/mmu.h>
+
++.macro save_caller_saved_regs_vect
++ /* x0 and x1 were saved in the vector entry */
++ stp x2, x3, [sp, #-16]!
++ stp x4, x5, [sp, #-16]!
++ stp x6, x7, [sp, #-16]!
++ stp x8, x9, [sp, #-16]!
++ stp x10, x11, [sp, #-16]!
++ stp x12, x13, [sp, #-16]!
++ stp x14, x15, [sp, #-16]!
++ stp x16, x17, [sp, #-16]!
++.endm
++
++.macro restore_caller_saved_regs_vect
++ ldp x16, x17, [sp], #16
++ ldp x14, x15, [sp], #16
++ ldp x12, x13, [sp], #16
++ ldp x10, x11, [sp], #16
++ ldp x8, x9, [sp], #16
++ ldp x6, x7, [sp], #16
++ ldp x4, x5, [sp], #16
++ ldp x2, x3, [sp], #16
++ ldp x0, x1, [sp], #16
++.endm
++
+ .text
+ .pushsection .hyp.text, "ax"
+
+@@ -162,28 +186,24 @@ el1_error:
+ mov x0, #ARM_EXCEPTION_EL1_SERROR
+ b __guest_exit
+
++el2_sync:
++ save_caller_saved_regs_vect
++ stp x29, x30, [sp, #-16]!
++ bl kvm_unexpected_el2_exception
++ ldp x29, x30, [sp], #16
++ restore_caller_saved_regs_vect
++
++ eret
++
+ el2_error:
+- ldp x0, x1, [sp], #16
++ save_caller_saved_regs_vect
++ stp x29, x30, [sp, #-16]!
++
++ bl kvm_unexpected_el2_exception
++
++ ldp x29, x30, [sp], #16
++ restore_caller_saved_regs_vect
+
+- /*
+- * Only two possibilities:
+- * 1) Either we come from the exit path, having just unmasked
+- * PSTATE.A: change the return code to an EL2 fault, and
+- * carry on, as we're already in a sane state to handle it.
+- * 2) Or we come from anywhere else, and that's a bug: we panic.
+- *
+- * For (1), x0 contains the original return code and x1 doesn't
+- * contain anything meaningful at that stage. We can reuse them
+- * as temp registers.
+- * For (2), who cares?
+- */
+- mrs x0, elr_el2
+- adr x1, abort_guest_exit_start
+- cmp x0, x1
+- adr x1, abort_guest_exit_end
+- ccmp x0, x1, #4, ne
+- b.ne __hyp_panic
+- mov x0, #(1 << ARM_EXIT_WITH_SERROR_BIT)
+ eret
+
+ ENTRY(__hyp_do_panic)
+@@ -212,7 +232,6 @@ ENDPROC(\label)
+ invalid_vector el2t_irq_invalid
+ invalid_vector el2t_fiq_invalid
+ invalid_vector el2t_error_invalid
+- invalid_vector el2h_sync_invalid
+ invalid_vector el2h_irq_invalid
+ invalid_vector el2h_fiq_invalid
+ invalid_vector el1_fiq_invalid
+@@ -240,7 +259,7 @@ ENTRY(__kvm_hyp_vector)
+ invalid_vect el2t_fiq_invalid // FIQ EL2t
+ invalid_vect el2t_error_invalid // Error EL2t
+
+- invalid_vect el2h_sync_invalid // Synchronous EL2h
++ valid_vect el2_sync // Synchronous EL2h
+ invalid_vect el2h_irq_invalid // IRQ EL2h
+ invalid_vect el2h_fiq_invalid // FIQ EL2h
+ valid_vect el2_error // Error EL2h
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index 3cdefd84af545..f146bff53edf9 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -23,6 +23,7 @@
+ #include <kvm/arm_psci.h>
+
+ #include <asm/cpufeature.h>
++#include <asm/extable.h>
+ #include <asm/kprobes.h>
+ #include <asm/kvm_asm.h>
+ #include <asm/kvm_emulate.h>
+@@ -34,6 +35,9 @@
+ #include <asm/processor.h>
+ #include <asm/thread_info.h>
+
++extern struct exception_table_entry __start___kvm_ex_table;
++extern struct exception_table_entry __stop___kvm_ex_table;
++
+ /* Check whether the FP regs were dirtied while in the host-side run loop: */
+ static bool __hyp_text update_fp_enabled(struct kvm_vcpu *vcpu)
+ {
+@@ -264,10 +268,10 @@ static bool __hyp_text __translate_far_to_hpfar(u64 far, u64 *hpfar)
+ * saved the guest context yet, and we may return early...
+ */
+ par = read_sysreg(par_el1);
+- asm volatile("at s1e1r, %0" : : "r" (far));
+- isb();
+-
+- tmp = read_sysreg(par_el1);
++ if (!__kvm_at("s1e1r", far))
++ tmp = read_sysreg(par_el1);
++ else
++ tmp = 1; /* back to the guest */
+ write_sysreg(par, par_el1);
+
+ if (unlikely(tmp & 1))
+@@ -663,3 +667,30 @@ void __hyp_text __noreturn hyp_panic(struct kvm_cpu_context *host_ctxt)
+
+ unreachable();
+ }
++
++asmlinkage void __hyp_text kvm_unexpected_el2_exception(void)
++{
++ unsigned long addr, fixup;
++ struct kvm_cpu_context *host_ctxt;
++ struct exception_table_entry *entry, *end;
++ unsigned long elr_el2 = read_sysreg(elr_el2);
++
++ entry = hyp_symbol_addr(__start___kvm_ex_table);
++ end = hyp_symbol_addr(__stop___kvm_ex_table);
++ host_ctxt = __hyp_this_cpu_ptr(kvm_host_cpu_state);
++
++ while (entry < end) {
++ addr = (unsigned long)&entry->insn + entry->insn;
++ fixup = (unsigned long)&entry->fixup + entry->fixup;
++
++ if (addr != elr_el2) {
++ entry++;
++ continue;
++ }
++
++ write_sysreg(fixup, elr_el2);
++ return;
++ }
++
++ hyp_panic(host_ctxt);
++}
+diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
+index 5ec546b5eed1c..d16e6654a6555 100644
+--- a/arch/mips/kernel/smp-bmips.c
++++ b/arch/mips/kernel/smp-bmips.c
+@@ -240,6 +240,8 @@ static int bmips_boot_secondary(int cpu, struct task_struct *idle)
+ */
+ static void bmips_init_secondary(void)
+ {
++ bmips_cpu_setup();
++
+ switch (current_cpu_type()) {
+ case CPU_BMIPS4350:
+ case CPU_BMIPS4380:
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index 05a539d3a5970..7650edd5cf7ff 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -1789,7 +1789,11 @@ static void setup_scache(void)
+ printk("MIPS secondary cache %ldkB, %s, linesize %d bytes.\n",
+ scache_size >> 10,
+ way_string[c->scache.ways], c->scache.linesz);
++
++ if (current_cpu_type() == CPU_BMIPS5000)
++ c->options |= MIPS_CPU_INCLUSIVE_CACHES;
+ }
++
+ #else
+ if (!(c->scache.flags & MIPS_CACHE_NOT_PRESENT))
+ panic("Dunno how to handle MIPS32 / MIPS64 second level cache");
+diff --git a/arch/s390/include/asm/percpu.h b/arch/s390/include/asm/percpu.h
+index 0095ddb58ff69..50f6661ba5664 100644
+--- a/arch/s390/include/asm/percpu.h
++++ b/arch/s390/include/asm/percpu.h
+@@ -29,7 +29,7 @@
+ typedef typeof(pcp) pcp_op_T__; \
+ pcp_op_T__ old__, new__, prev__; \
+ pcp_op_T__ *ptr__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ prev__ = *ptr__; \
+ do { \
+@@ -37,7 +37,7 @@
+ new__ = old__ op (val); \
+ prev__ = cmpxchg(ptr__, old__, new__); \
+ } while (prev__ != old__); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ new__; \
+ })
+
+@@ -68,7 +68,7 @@
+ typedef typeof(pcp) pcp_op_T__; \
+ pcp_op_T__ val__ = (val); \
+ pcp_op_T__ old__, *ptr__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ if (__builtin_constant_p(val__) && \
+ ((szcast)val__ > -129) && ((szcast)val__ < 128)) { \
+@@ -84,7 +84,7 @@
+ : [val__] "d" (val__) \
+ : "cc"); \
+ } \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ }
+
+ #define this_cpu_add_4(pcp, val) arch_this_cpu_add(pcp, val, "laa", "asi", int)
+@@ -95,14 +95,14 @@
+ typedef typeof(pcp) pcp_op_T__; \
+ pcp_op_T__ val__ = (val); \
+ pcp_op_T__ old__, *ptr__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ asm volatile( \
+ op " %[old__],%[val__],%[ptr__]\n" \
+ : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__) \
+ : [val__] "d" (val__) \
+ : "cc"); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ old__ + val__; \
+ })
+
+@@ -114,14 +114,14 @@
+ typedef typeof(pcp) pcp_op_T__; \
+ pcp_op_T__ val__ = (val); \
+ pcp_op_T__ old__, *ptr__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ asm volatile( \
+ op " %[old__],%[val__],%[ptr__]\n" \
+ : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__) \
+ : [val__] "d" (val__) \
+ : "cc"); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ }
+
+ #define this_cpu_and_4(pcp, val) arch_this_cpu_to_op(pcp, val, "lan")
+@@ -136,10 +136,10 @@
+ typedef typeof(pcp) pcp_op_T__; \
+ pcp_op_T__ ret__; \
+ pcp_op_T__ *ptr__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ ret__ = cmpxchg(ptr__, oval, nval); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ ret__; \
+ })
+
+@@ -152,10 +152,10 @@
+ ({ \
+ typeof(pcp) *ptr__; \
+ typeof(pcp) ret__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+ ret__ = xchg(ptr__, nval); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ ret__; \
+ })
+
+@@ -171,11 +171,11 @@
+ typeof(pcp1) *p1__; \
+ typeof(pcp2) *p2__; \
+ int ret__; \
+- preempt_disable(); \
++ preempt_disable_notrace(); \
+ p1__ = raw_cpu_ptr(&(pcp1)); \
+ p2__ = raw_cpu_ptr(&(pcp2)); \
+ ret__ = __cmpxchg_double(p1__, p2__, o1__, o2__, n1__, n2__); \
+- preempt_enable(); \
++ preempt_enable_notrace(); \
+ ret__; \
+ })
+
+diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
+index d71d72cf6c666..4686757a74d75 100644
+--- a/arch/x86/mm/numa_emulation.c
++++ b/arch/x86/mm/numa_emulation.c
+@@ -322,7 +322,7 @@ static int __init split_nodes_size_interleave(struct numa_meminfo *ei,
+ u64 addr, u64 max_addr, u64 size)
+ {
+ return split_nodes_size_interleave_uniform(ei, pi, addr, max_addr, size,
+- 0, NULL, NUMA_NO_NODE);
++ 0, NULL, 0);
+ }
+
+ int __init setup_emu2phys_nid(int *dfl_phys_nid)
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 6b372fa583822..fead7243930c0 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4492,9 +4492,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */
+ { "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, },
+
+- /* Some Sandisk SSDs lock up hard with NCQ enabled. Reported on
+- SD7SN6S256G and SD8SN8U256G */
+- { "SanDisk SD[78]SN*G", NULL, ATA_HORKAGE_NONCQ, },
++ /* Sandisk SD7/8/9s lock up hard on large trims */
++ { "SanDisk SD[789]*", NULL, ATA_HORKAGE_MAX_TRIM_128M, },
+
+ /* devices which puke on READ_NATIVE_MAX */
+ { "HDS724040KLSA80", "KFAOA20N", ATA_HORKAGE_BROKEN_HPA, },
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 6c2c2b07f029e..e7af41d95490d 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -2391,6 +2391,7 @@ static unsigned int ata_scsiop_inq_89(struct ata_scsi_args *args, u8 *rbuf)
+
+ static unsigned int ata_scsiop_inq_b0(struct ata_scsi_args *args, u8 *rbuf)
+ {
++ struct ata_device *dev = args->dev;
+ u16 min_io_sectors;
+
+ rbuf[1] = 0xb0;
+@@ -2416,7 +2417,12 @@ static unsigned int ata_scsiop_inq_b0(struct ata_scsi_args *args, u8 *rbuf)
+ * with the unmap bit set.
+ */
+ if (ata_id_has_trim(args->id)) {
+- put_unaligned_be64(65535 * ATA_MAX_TRIM_RNUM, &rbuf[36]);
++ u64 max_blocks = 65535 * ATA_MAX_TRIM_RNUM;
++
++ if (dev->horkage & ATA_HORKAGE_MAX_TRIM_128M)
++ max_blocks = 128 << (20 - SECTOR_SHIFT);
++
++ put_unaligned_be64(max_blocks, &rbuf[36]);
+ put_unaligned_be32(1, &rbuf[28]);
+ }
+
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index 6df894d65d9e2..2d182dc1b49ed 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -148,7 +148,8 @@ static void enter_s2idle_proper(struct cpuidle_driver *drv,
+ */
+ stop_critical_timings();
+ drv->states[index].enter_s2idle(dev, drv, index);
+- WARN_ON(!irqs_disabled());
++ if (WARN_ON_ONCE(!irqs_disabled()))
++ local_irq_disable();
+ /*
+ * timekeeping_resume() that will be called by tick_unfreeze() for the
+ * first CPU executing it calls functions containing RCU read-side
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index dbc51154f1229..86427f6ba78cb 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1677,6 +1677,8 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,
+ return NULL;
+
+ dmac_pdev = of_find_device_by_node(dma_spec->np);
++ if (!dmac_pdev)
++ return NULL;
+
+ dma_cap_zero(mask);
+ dma_cap_set(DMA_SLAVE, mask);
+diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c
+index 91fd395c90c4c..8344a60c2131b 100644
+--- a/drivers/dma/of-dma.c
++++ b/drivers/dma/of-dma.c
+@@ -72,12 +72,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec,
+ return NULL;
+
+ chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target);
+- if (chan) {
+- chan->router = ofdma->dma_router;
+- chan->route_data = route_data;
+- } else {
++ if (IS_ERR_OR_NULL(chan)) {
+ ofdma->dma_router->route_free(ofdma->dma_router->dev,
+ route_data);
++ } else {
++ chan->router = ofdma->dma_router;
++ chan->route_data = route_data;
+ }
+
+ /*
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index bc8050c025b7b..c564df713efc3 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2769,6 +2769,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
+ while (burst != (1 << desc->rqcfg.brst_size))
+ desc->rqcfg.brst_size++;
+
++ desc->rqcfg.brst_len = get_burst_len(desc, len);
+ /*
+ * If burst size is smaller than bus width then make sure we only
+ * transfer one at a time to avoid a burst stradling an MFIFO entry.
+@@ -2776,7 +2777,6 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
+ if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
+ desc->rqcfg.brst_len = 1;
+
+- desc->rqcfg.brst_len = get_burst_len(desc, len);
+ desc->bytes_requested = len;
+
+ desc->txd.flags = flags;
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+index 9cde79a7335c8..739ca9c2081a6 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+@@ -117,12 +117,22 @@ static int a6xx_gmu_start(struct a6xx_gmu *gmu)
+ {
+ int ret;
+ u32 val;
++ u32 mask, reset_val;
++
++ val = gmu_read(gmu, REG_A6XX_GMU_CM3_DTCM_START + 0xff8);
++ if (val <= 0x20010004) {
++ mask = 0xffffffff;
++ reset_val = 0xbabeface;
++ } else {
++ mask = 0x1ff;
++ reset_val = 0x100;
++ }
+
+ gmu_write(gmu, REG_A6XX_GMU_CM3_SYSRESET, 1);
+ gmu_write(gmu, REG_A6XX_GMU_CM3_SYSRESET, 0);
+
+ ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_CM3_FW_INIT_RESULT, val,
+- val == 0xbabeface, 100, 10000);
++ (val & mask) == reset_val, 100, 10000);
+
+ if (ret)
+ dev_err(gmu->dev, "GMU firmware initialization timed out\n");
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 6f81de85fb860..7f45486b6650b 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -1358,6 +1358,13 @@ static int msm_pdev_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static void msm_pdev_shutdown(struct platform_device *pdev)
++{
++ struct drm_device *drm = platform_get_drvdata(pdev);
++
++ drm_atomic_helper_shutdown(drm);
++}
++
+ static const struct of_device_id dt_match[] = {
+ { .compatible = "qcom,mdp4", .data = (void *)KMS_MDP4 },
+ { .compatible = "qcom,mdss", .data = (void *)KMS_MDP5 },
+@@ -1369,6 +1376,7 @@ MODULE_DEVICE_TABLE(of, dt_match);
+ static struct platform_driver msm_platform_driver = {
+ .probe = msm_pdev_probe,
+ .remove = msm_pdev_remove,
++ .shutdown = msm_pdev_shutdown,
+ .driver = {
+ .name = "msm",
+ .of_match_table = dt_match,
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 2c85d075daee1..05122167d9d85 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1425,6 +1425,17 @@ static void hid_output_field(const struct hid_device *hid,
+ }
+ }
+
++/*
++ * Compute the size of a report.
++ */
++static size_t hid_compute_report_size(struct hid_report *report)
++{
++ if (report->size)
++ return ((report->size - 1) >> 3) + 1;
++
++ return 0;
++}
++
+ /*
+ * Create a report. 'data' has to be allocated using
+ * hid_alloc_report_buf() so that it has proper size.
+@@ -1437,7 +1448,7 @@ void hid_output_report(struct hid_report *report, __u8 *data)
+ if (report->id > 0)
+ *data++ = report->id;
+
+- memset(data, 0, ((report->size - 1) >> 3) + 1);
++ memset(data, 0, hid_compute_report_size(report));
+ for (n = 0; n < report->maxfield; n++)
+ hid_output_field(report->device, report->field[n], data);
+ }
+@@ -1564,7 +1575,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
+ csize--;
+ }
+
+- rsize = ((report->size - 1) >> 3) + 1;
++ rsize = hid_compute_report_size(report);
+
+ if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
+ rsize = HID_MAX_BUFFER_SIZE - 1;
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 51bfe23d00bc5..a9da1526c40ae 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -1125,6 +1125,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ }
+
+ mapped:
++ /* Mapping failed, bail out */
++ if (!bit)
++ return;
++
+ if (device->driver->input_mapped &&
+ device->driver->input_mapped(device, hidinput, field, usage,
+ &bit, &max) < 0) {
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 8baf10beb1d5d..ccda72f748ee5 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -841,6 +841,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ code = BTN_0 + ((usage->hid - 1) & HID_USAGE);
+
+ hid_map_usage(hi, usage, bit, max, EV_KEY, code);
++ if (!*bit)
++ return -1;
+ input_set_capability(hi->input, EV_KEY, code);
+ return 1;
+
+diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
+index 5c677ba440143..b201129a9beae 100644
+--- a/drivers/hwmon/applesmc.c
++++ b/drivers/hwmon/applesmc.c
+@@ -760,15 +760,18 @@ static ssize_t applesmc_light_show(struct device *dev,
+ }
+
+ ret = applesmc_read_key(LIGHT_SENSOR_LEFT_KEY, buffer, data_length);
++ if (ret)
++ goto out;
+ /* newer macbooks report a single 10-bit bigendian value */
+ if (data_length == 10) {
+ left = be16_to_cpu(*(__be16 *)(buffer + 6)) >> 2;
+ goto out;
+ }
+ left = buffer[2];
++
++ ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length);
+ if (ret)
+ goto out;
+- ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length);
+ right = buffer[2];
+
+ out:
+@@ -817,12 +820,11 @@ static ssize_t applesmc_show_fan_speed(struct device *dev,
+ to_index(attr));
+
+ ret = applesmc_read_key(newkey, buffer, 2);
+- speed = ((buffer[0] << 8 | buffer[1]) >> 2);
+-
+ if (ret)
+ return ret;
+- else
+- return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed);
++
++ speed = ((buffer[0] << 8 | buffer[1]) >> 2);
++ return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed);
+ }
+
+ static ssize_t applesmc_store_fan_speed(struct device *dev,
+@@ -858,12 +860,11 @@ static ssize_t applesmc_show_fan_manual(struct device *dev,
+ u8 buffer[2];
+
+ ret = applesmc_read_key(FANS_MANUAL, buffer, 2);
+- manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01;
+-
+ if (ret)
+ return ret;
+- else
+- return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual);
++
++ manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01;
++ return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual);
+ }
+
+ static ssize_t applesmc_store_fan_manual(struct device *dev,
+@@ -879,10 +880,11 @@ static ssize_t applesmc_store_fan_manual(struct device *dev,
+ return -EINVAL;
+
+ ret = applesmc_read_key(FANS_MANUAL, buffer, 2);
+- val = (buffer[0] << 8 | buffer[1]);
+ if (ret)
+ goto out;
+
++ val = (buffer[0] << 8 | buffer[1]);
++
+ if (input)
+ val = val | (0x01 << to_index(attr));
+ else
+@@ -958,13 +960,12 @@ static ssize_t applesmc_key_count_show(struct device *dev,
+ u32 count;
+
+ ret = applesmc_read_key(KEY_COUNT_KEY, buffer, 4);
+- count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) +
+- ((u32)buffer[2]<<8) + buffer[3];
+-
+ if (ret)
+ return ret;
+- else
+- return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count);
++
++ count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) +
++ ((u32)buffer[2]<<8) + buffer[3];
++ return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count);
+ }
+
+ static ssize_t applesmc_key_at_index_read_show(struct device *dev,
+diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
+index 15a4ad31c510a..9d2d03545bb07 100644
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -479,12 +479,18 @@ static void iommu_enable_irq_remapping(struct intel_iommu *iommu)
+
+ /* Enable interrupt-remapping */
+ iommu->gcmd |= DMA_GCMD_IRE;
+- iommu->gcmd &= ~DMA_GCMD_CFI; /* Block compatibility-format MSIs */
+ writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG);
+-
+ IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG,
+ readl, (sts & DMA_GSTS_IRES), sts);
+
++ /* Block compatibility-format MSIs */
++ if (sts & DMA_GSTS_CFIS) {
++ iommu->gcmd &= ~DMA_GCMD_CFI;
++ writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG);
++ IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG,
++ readl, !(sts & DMA_GSTS_CFIS), sts);
++ }
++
+ /*
+ * With CFI clear in the Global Command register, we should be
+ * protected from dangerous (i.e. compatibility) interrupts
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index 151aa95775be2..af6d4f898e4c1 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -537,12 +537,16 @@ static int __create_persistent_data_objects(struct dm_cache_metadata *cmd,
+ CACHE_MAX_CONCURRENT_LOCKS);
+ if (IS_ERR(cmd->bm)) {
+ DMERR("could not create block manager");
+- return PTR_ERR(cmd->bm);
++ r = PTR_ERR(cmd->bm);
++ cmd->bm = NULL;
++ return r;
+ }
+
+ r = __open_or_format_metadata(cmd, may_format_device);
+- if (r)
++ if (r) {
+ dm_block_manager_destroy(cmd->bm);
++ cmd->bm = NULL;
++ }
+
+ return r;
+ }
+diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
+index 6a26afcc1fd6b..85077f4d257a7 100644
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -698,12 +698,16 @@ static int __create_persistent_data_objects(struct dm_pool_metadata *pmd, bool f
+ THIN_MAX_CONCURRENT_LOCKS);
+ if (IS_ERR(pmd->bm)) {
+ DMERR("could not create block manager");
+- return PTR_ERR(pmd->bm);
++ r = PTR_ERR(pmd->bm);
++ pmd->bm = NULL;
++ return r;
+ }
+
+ r = __open_or_format_metadata(pmd, format_device);
+- if (r)
++ if (r) {
+ dm_block_manager_destroy(pmd->bm);
++ pmd->bm = NULL;
++ }
+
+ return r;
+ }
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index cc028353f9d55..776aaf5951e4a 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -226,6 +226,7 @@ static int persistent_memory_claim(struct dm_writecache *wc)
+ pfn_t pfn;
+ int id;
+ struct page **pages;
++ sector_t offset;
+
+ wc->memory_vmapped = false;
+
+@@ -244,9 +245,16 @@ static int persistent_memory_claim(struct dm_writecache *wc)
+ goto err1;
+ }
+
++ offset = get_start_sect(wc->ssd_dev->bdev);
++ if (offset & (PAGE_SIZE / 512 - 1)) {
++ r = -EINVAL;
++ goto err1;
++ }
++ offset >>= PAGE_SHIFT - 9;
++
+ id = dax_read_lock();
+
+- da = dax_direct_access(wc->ssd_dev->dax_dev, 0, p, &wc->memory_map, &pfn);
++ da = dax_direct_access(wc->ssd_dev->dax_dev, offset, p, &wc->memory_map, &pfn);
+ if (da < 0) {
+ wc->memory_map = NULL;
+ r = da;
+@@ -268,7 +276,7 @@ static int persistent_memory_claim(struct dm_writecache *wc)
+ i = 0;
+ do {
+ long daa;
+- daa = dax_direct_access(wc->ssd_dev->dax_dev, i, p - i,
++ daa = dax_direct_access(wc->ssd_dev->dax_dev, offset + i, p - i,
+ NULL, &pfn);
+ if (daa <= 0) {
+ r = daa ? daa : -EINVAL;
+diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
+index c30affbd43a98..cf3df733d9605 100644
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -1245,6 +1245,10 @@ static ssize_t store_protocols(struct device *device,
+ }
+
+ mutex_lock(&dev->lock);
++ if (!dev->registered) {
++ mutex_unlock(&dev->lock);
++ return -ENODEV;
++ }
+
+ old_protocols = *current_protocols;
+ new_protocols = old_protocols;
+@@ -1383,6 +1387,10 @@ static ssize_t store_filter(struct device *device,
+ return -EINVAL;
+
+ mutex_lock(&dev->lock);
++ if (!dev->registered) {
++ mutex_unlock(&dev->lock);
++ return -ENODEV;
++ }
+
+ new_filter = *filter;
+ if (fattr->mask)
+@@ -1497,6 +1505,10 @@ static ssize_t store_wakeup_protocols(struct device *device,
+ int i;
+
+ mutex_lock(&dev->lock);
++ if (!dev->registered) {
++ mutex_unlock(&dev->lock);
++ return -ENODEV;
++ }
+
+ allowed = dev->allowed_wakeup_protocols;
+
+@@ -1556,25 +1568,25 @@ static void rc_dev_release(struct device *device)
+ kfree(dev);
+ }
+
+-#define ADD_HOTPLUG_VAR(fmt, val...) \
+- do { \
+- int err = add_uevent_var(env, fmt, val); \
+- if (err) \
+- return err; \
+- } while (0)
+-
+ static int rc_dev_uevent(struct device *device, struct kobj_uevent_env *env)
+ {
+ struct rc_dev *dev = to_rc_dev(device);
++ int ret = 0;
+
+- if (dev->rc_map.name)
+- ADD_HOTPLUG_VAR("NAME=%s", dev->rc_map.name);
+- if (dev->driver_name)
+- ADD_HOTPLUG_VAR("DRV_NAME=%s", dev->driver_name);
+- if (dev->device_name)
+- ADD_HOTPLUG_VAR("DEV_NAME=%s", dev->device_name);
++ mutex_lock(&dev->lock);
+
+- return 0;
++ if (!dev->registered)
++ ret = -ENODEV;
++ if (ret == 0 && dev->rc_map.name)
++ ret = add_uevent_var(env, "NAME=%s", dev->rc_map.name);
++ if (ret == 0 && dev->driver_name)
++ ret = add_uevent_var(env, "DRV_NAME=%s", dev->driver_name);
++ if (ret == 0 && dev->device_name)
++ ret = add_uevent_var(env, "DEV_NAME=%s", dev->device_name);
++
++ mutex_unlock(&dev->lock);
++
++ return ret;
+ }
+
+ /*
+@@ -1958,14 +1970,14 @@ void rc_unregister_device(struct rc_dev *dev)
+ del_timer_sync(&dev->timer_keyup);
+ del_timer_sync(&dev->timer_repeat);
+
+- rc_free_rx_device(dev);
+-
+ mutex_lock(&dev->lock);
+ if (dev->users && dev->close)
+ dev->close(dev);
+ dev->registered = false;
+ mutex_unlock(&dev->lock);
+
++ rc_free_rx_device(dev);
++
+ /*
+ * lirc device should be freed with dev->registered = false, so
+ * that userspace polling will get notified.
+diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c
+index 0187dbf3b87df..54cdafdd067db 100644
+--- a/drivers/net/ethernet/arc/emac_mdio.c
++++ b/drivers/net/ethernet/arc/emac_mdio.c
+@@ -153,6 +153,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv)
+ if (IS_ERR(data->reset_gpio)) {
+ error = PTR_ERR(data->reset_gpio);
+ dev_err(priv->dev, "Failed to request gpio: %d\n", error);
++ mdiobus_free(bus);
+ return error;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 6b761f6b8fd56..9a614c5cdfa22 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2441,8 +2441,10 @@ static int bcm_sysport_probe(struct platform_device *pdev)
+ priv->tx_rings = devm_kcalloc(&pdev->dev, txq,
+ sizeof(struct bcm_sysport_tx_ring),
+ GFP_KERNEL);
+- if (!priv->tx_rings)
+- return -ENOMEM;
++ if (!priv->tx_rings) {
++ ret = -ENOMEM;
++ goto err_free_netdev;
++ }
+
+ priv->is_lite = params->is_lite;
+ priv->num_rx_desc_words = params->num_rx_desc_words;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index ab4d1dacb5854..a267380b267d7 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -6836,16 +6836,19 @@ static ssize_t bnxt_show_temp(struct device *dev,
+ struct hwrm_temp_monitor_query_input req = {0};
+ struct hwrm_temp_monitor_query_output *resp;
+ struct bnxt *bp = dev_get_drvdata(dev);
+- u32 temp = 0;
++ u32 len = 0;
+
+ resp = bp->hwrm_cmd_resp_addr;
+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1);
+ mutex_lock(&bp->hwrm_cmd_lock);
+- if (!_hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT))
+- temp = resp->temp * 1000; /* display millidegree */
++ if (!_hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT))
++ len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */
+ mutex_unlock(&bp->hwrm_cmd_lock);
+
+- return sprintf(buf, "%u\n", temp);
++ if (len)
++ return len;
++
++ return sprintf(buf, "unknown\n");
+ }
+ static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0);
+
+@@ -7024,15 +7027,15 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
+ }
+ }
+
+- bnxt_enable_napi(bp);
+- bnxt_debug_dev_init(bp);
+-
+ rc = bnxt_init_nic(bp, irq_re_init);
+ if (rc) {
+ netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc);
+- goto open_err;
++ goto open_err_irq;
+ }
+
++ bnxt_enable_napi(bp);
++ bnxt_debug_dev_init(bp);
++
+ if (link_re_init) {
+ mutex_lock(&bp->link_lock);
+ rc = bnxt_update_phy_setting(bp);
+@@ -7063,10 +7066,6 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
+ bnxt_vf_reps_open(bp);
+ return 0;
+
+-open_err:
+- bnxt_debug_dev_exit(bp);
+- bnxt_disable_napi(bp);
+-
+ open_err_irq:
+ bnxt_del_napi(bp);
+
+@@ -9128,6 +9127,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ (long)pci_resource_start(pdev, 0), dev->dev_addr);
+ pcie_print_link_status(pdev);
+
++ pci_save_state(pdev);
+ return 0;
+
+ init_err_cleanup_tc:
+@@ -9289,6 +9289,8 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev)
+ "Cannot re-enable PCI device after reset.\n");
+ } else {
+ pci_set_master(pdev);
++ pci_restore_state(pdev);
++ pci_save_state(pdev);
+
+ err = bnxt_hwrm_func_reset(bp);
+ if (!err && netif_running(netdev))
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 63730e449e088..a1cb99110092d 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -471,7 +471,7 @@ static void bnxt_get_channels(struct net_device *dev,
+ int max_tx_sch_inputs;
+
+ /* Get the most up-to-date max_tx_sch_inputs. */
+- if (BNXT_NEW_RM(bp))
++ if (netif_running(dev) && BNXT_NEW_RM(bp))
+ bnxt_hwrm_func_resc_qcaps(bp, false);
+ max_tx_sch_inputs = hw_resc->max_tx_sch_inputs;
+
+@@ -1877,6 +1877,9 @@ static int bnxt_get_nvram_directory(struct net_device *dev, u32 len, u8 *data)
+ if (rc != 0)
+ return rc;
+
++ if (!dir_entries || !entry_length)
++ return -EIO;
++
+ /* Insert 2 bytes of directory info (count and size of entries) */
+ if (len < 2)
+ return -EINVAL;
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index be845df050399..6fcf9646d141b 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -7219,8 +7219,8 @@ static inline void tg3_reset_task_schedule(struct tg3 *tp)
+
+ static inline void tg3_reset_task_cancel(struct tg3 *tp)
+ {
+- cancel_work_sync(&tp->reset_task);
+- tg3_flag_clear(tp, RESET_TASK_PENDING);
++ if (test_and_clear_bit(TG3_FLAG_RESET_TASK_PENDING, tp->tg3_flags))
++ cancel_work_sync(&tp->reset_task);
+ tg3_flag_clear(tp, TX_RECOVERY_PENDING);
+ }
+
+@@ -11213,18 +11213,27 @@ static void tg3_reset_task(struct work_struct *work)
+
+ tg3_halt(tp, RESET_KIND_SHUTDOWN, 0);
+ err = tg3_init_hw(tp, true);
+- if (err)
++ if (err) {
++ tg3_full_unlock(tp);
++ tp->irq_sync = 0;
++ tg3_napi_enable(tp);
++ /* Clear this flag so that tg3_reset_task_cancel() will not
++ * call cancel_work_sync() and wait forever.
++ */
++ tg3_flag_clear(tp, RESET_TASK_PENDING);
++ dev_close(tp->dev);
+ goto out;
++ }
+
+ tg3_netif_start(tp);
+
+-out:
+ tg3_full_unlock(tp);
+
+ if (!err)
+ tg3_phy_start(tp);
+
+ tg3_flag_clear(tp, RESET_TASK_PENDING);
++out:
+ rtnl_unlock();
+ }
+
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index 16de0fa92ab74..5242687060b44 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -2451,8 +2451,8 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
+ port->reset = devm_reset_control_get_exclusive(dev, NULL);
+ if (IS_ERR(port->reset)) {
+ dev_err(dev, "no reset\n");
+- clk_disable_unprepare(port->pclk);
+- return PTR_ERR(port->reset);
++ ret = PTR_ERR(port->reset);
++ goto unprepare;
+ }
+ reset_control_reset(port->reset);
+ usleep_range(100, 500);
+@@ -2507,25 +2507,25 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
+ IRQF_SHARED,
+ port_names[port->id],
+ port);
+- if (ret) {
+- clk_disable_unprepare(port->pclk);
+- return ret;
+- }
++ if (ret)
++ goto unprepare;
+
+ ret = register_netdev(netdev);
+- if (!ret) {
++ if (ret)
++ goto unprepare;
++
++ netdev_info(netdev,
++ "irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n",
++ port->irq, &dmares->start,
++ &gmacres->start);
++ ret = gmac_setup_phy(netdev);
++ if (ret)
+ netdev_info(netdev,
+- "irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n",
+- port->irq, &dmares->start,
+- &gmacres->start);
+- ret = gmac_setup_phy(netdev);
+- if (ret)
+- netdev_info(netdev,
+- "PHY init failed, deferring to ifup time\n");
+- return 0;
+- }
++ "PHY init failed, deferring to ifup time\n");
++ return 0;
+
+- port->netdev = NULL;
++unprepare:
++ clk_disable_unprepare(port->pclk);
+ return ret;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 024b08fafd3b2..4de65a9de0a63 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -2297,8 +2297,10 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
+ priv->enet_ver = AE_VERSION_1;
+ else if (acpi_dev_found(hns_enet_acpi_match[1].id))
+ priv->enet_ver = AE_VERSION_2;
+- else
+- return -ENXIO;
++ else {
++ ret = -ENXIO;
++ goto out_read_prop_fail;
++ }
+
+ /* try to find port-idx-in-ae first */
+ ret = acpi_node_get_property_reference(dev->fwnode,
+@@ -2314,7 +2316,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
+ priv->fwnode = args.fwnode;
+ } else {
+ dev_err(dev, "cannot read cfg data from OF or acpi\n");
+- return -ENXIO;
++ ret = -ENXIO;
++ goto out_read_prop_fail;
+ }
+
+ ret = device_property_read_u32(dev, "port-idx-in-ae", &port_id);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
+index 1a11bc0e16123..cfa0bba3940fb 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
+@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order)
+ goto err_out;
+
+ for (i = 0; i <= buddy->max_order; ++i) {
+- s = BITS_TO_LONGS(1 << (buddy->max_order - i));
++ s = BITS_TO_LONGS(1UL << (buddy->max_order - i));
+ buddy->bits[i] = kvmalloc_array(s, sizeof(long), GFP_KERNEL | __GFP_ZERO);
+ if (!buddy->bits[i])
+ goto err_out_free;
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 569e698b5c807..b5066cf86c856 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1337,6 +1337,51 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler,
+ return error;
+ }
+
++/* MDIO bus init function */
++static int ravb_mdio_init(struct ravb_private *priv)
++{
++ struct platform_device *pdev = priv->pdev;
++ struct device *dev = &pdev->dev;
++ int error;
++
++ /* Bitbang init */
++ priv->mdiobb.ops = &bb_ops;
++
++ /* MII controller setting */
++ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
++ if (!priv->mii_bus)
++ return -ENOMEM;
++
++ /* Hook up MII support for ethtool */
++ priv->mii_bus->name = "ravb_mii";
++ priv->mii_bus->parent = dev;
++ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
++ pdev->name, pdev->id);
++
++ /* Register MDIO bus */
++ error = of_mdiobus_register(priv->mii_bus, dev->of_node);
++ if (error)
++ goto out_free_bus;
++
++ return 0;
++
++out_free_bus:
++ free_mdio_bitbang(priv->mii_bus);
++ return error;
++}
++
++/* MDIO bus release function */
++static int ravb_mdio_release(struct ravb_private *priv)
++{
++ /* Unregister mdio bus */
++ mdiobus_unregister(priv->mii_bus);
++
++ /* Free bitbang info */
++ free_mdio_bitbang(priv->mii_bus);
++
++ return 0;
++}
++
+ /* Network device open function for Ethernet AVB */
+ static int ravb_open(struct net_device *ndev)
+ {
+@@ -1345,6 +1390,13 @@ static int ravb_open(struct net_device *ndev)
+ struct device *dev = &pdev->dev;
+ int error;
+
++ /* MDIO bus init */
++ error = ravb_mdio_init(priv);
++ if (error) {
++ netdev_err(ndev, "failed to initialize MDIO\n");
++ return error;
++ }
++
+ napi_enable(&priv->napi[RAVB_BE]);
+ napi_enable(&priv->napi[RAVB_NC]);
+
+@@ -1422,6 +1474,7 @@ out_free_irq:
+ out_napi_off:
+ napi_disable(&priv->napi[RAVB_NC]);
+ napi_disable(&priv->napi[RAVB_BE]);
++ ravb_mdio_release(priv);
+ return error;
+ }
+
+@@ -1721,6 +1774,8 @@ static int ravb_close(struct net_device *ndev)
+ ravb_ring_free(ndev, RAVB_BE);
+ ravb_ring_free(ndev, RAVB_NC);
+
++ ravb_mdio_release(priv);
++
+ return 0;
+ }
+
+@@ -1867,51 +1922,6 @@ static const struct net_device_ops ravb_netdev_ops = {
+ .ndo_set_features = ravb_set_features,
+ };
+
+-/* MDIO bus init function */
+-static int ravb_mdio_init(struct ravb_private *priv)
+-{
+- struct platform_device *pdev = priv->pdev;
+- struct device *dev = &pdev->dev;
+- int error;
+-
+- /* Bitbang init */
+- priv->mdiobb.ops = &bb_ops;
+-
+- /* MII controller setting */
+- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
+- if (!priv->mii_bus)
+- return -ENOMEM;
+-
+- /* Hook up MII support for ethtool */
+- priv->mii_bus->name = "ravb_mii";
+- priv->mii_bus->parent = dev;
+- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+- pdev->name, pdev->id);
+-
+- /* Register MDIO bus */
+- error = of_mdiobus_register(priv->mii_bus, dev->of_node);
+- if (error)
+- goto out_free_bus;
+-
+- return 0;
+-
+-out_free_bus:
+- free_mdio_bitbang(priv->mii_bus);
+- return error;
+-}
+-
+-/* MDIO bus release function */
+-static int ravb_mdio_release(struct ravb_private *priv)
+-{
+- /* Unregister mdio bus */
+- mdiobus_unregister(priv->mii_bus);
+-
+- /* Free bitbang info */
+- free_mdio_bitbang(priv->mii_bus);
+-
+- return 0;
+-}
+-
+ static const struct of_device_id ravb_match_table[] = {
+ { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 },
+ { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 },
+@@ -2138,13 +2148,6 @@ static int ravb_probe(struct platform_device *pdev)
+ eth_hw_addr_random(ndev);
+ }
+
+- /* MDIO bus init */
+- error = ravb_mdio_init(priv);
+- if (error) {
+- dev_err(&pdev->dev, "failed to initialize MDIO\n");
+- goto out_dma_free;
+- }
+-
+ netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64);
+ netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64);
+
+@@ -2166,8 +2169,6 @@ static int ravb_probe(struct platform_device *pdev)
+ out_napi_del:
+ netif_napi_del(&priv->napi[RAVB_NC]);
+ netif_napi_del(&priv->napi[RAVB_BE]);
+- ravb_mdio_release(priv);
+-out_dma_free:
+ dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
+ priv->desc_bat_dma);
+
+@@ -2199,7 +2200,6 @@ static int ravb_remove(struct platform_device *pdev)
+ unregister_netdev(ndev);
+ netif_napi_del(&priv->napi[RAVB_NC]);
+ netif_napi_del(&priv->napi[RAVB_BE]);
+- ravb_mdio_release(priv);
+ pm_runtime_disable(&pdev->dev);
+ free_netdev(ndev);
+ platform_set_drvdata(pdev, NULL);
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index d73850ebb671f..f2fecb6842209 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -1187,6 +1187,7 @@ static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq,
+ goto nlmsg_failure;
+
+ if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) ||
++ nla_put_u32(skb, GTPA_LINK, pctx->dev->ifindex) ||
+ nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer_addr_ip4.s_addr) ||
+ nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms_addr_ip4.s_addr))
+ goto nla_put_failure;
+diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
+index 023b8d0bf1754..8d27786acad91 100644
+--- a/drivers/net/usb/asix_common.c
++++ b/drivers/net/usb/asix_common.c
+@@ -309,7 +309,7 @@ int asix_read_phy_addr(struct usbnet *dev, int internal)
+
+ netdev_dbg(dev->net, "asix_get_phy_addr()\n");
+
+- if (ret < 0) {
++ if (ret < 2) {
+ netdev_err(dev->net, "Error reading PHYID register: %02x\n", ret);
+ goto out;
+ }
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index ea3c891186147..af58bf54aa9b6 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1227,6 +1227,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x2001, 0x7e16, 3)}, /* D-Link DWM-221 */
+ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */
+ {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */
++ {QMI_FIXED_INTF(0x2001, 0x7e3d, 4)}, /* D-Link DWM-222 A2 */
+ {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */
+ {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */
+ {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */
+@@ -1262,6 +1263,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */
+ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */
+ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */
+ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index 776b7e9e23b9e..f28df233dfcd0 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -307,6 +307,9 @@ static void nvmet_keep_alive_timer(struct work_struct *work)
+
+ static void nvmet_start_keep_alive_timer(struct nvmet_ctrl *ctrl)
+ {
++ if (unlikely(ctrl->kato == 0))
++ return;
++
+ pr_debug("ctrl %d start keep-alive timer for %d secs\n",
+ ctrl->cntlid, ctrl->kato);
+
+@@ -316,6 +319,9 @@ static void nvmet_start_keep_alive_timer(struct nvmet_ctrl *ctrl)
+
+ static void nvmet_stop_keep_alive_timer(struct nvmet_ctrl *ctrl)
+ {
++ if (unlikely(ctrl->kato == 0))
++ return;
++
+ pr_debug("ctrl %d stop keep-alive\n", ctrl->cntlid);
+
+ cancel_delayed_work_sync(&ctrl->ka_work);
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 29b4b236afd85..77e4d184bc995 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1986,9 +1986,9 @@ nvmet_fc_fod_op_done(struct nvmet_fc_fcp_iod *fod)
+ return;
+ if (fcpreq->fcp_error ||
+ fcpreq->transferred_length != fcpreq->transfer_length) {
+- spin_lock(&fod->flock);
++ spin_lock_irqsave(&fod->flock, flags);
+ fod->abort = true;
+- spin_unlock(&fod->flock);
++ spin_unlock_irqrestore(&fod->flock, flags);
+
+ nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
+ return;
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 91dbac7446a47..99314e5162447 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -687,8 +687,10 @@ static void scatter_data_area(struct tcmu_dev *udev,
+ from = kmap_atomic(sg_page(sg)) + sg->offset;
+ while (sg_remaining > 0) {
+ if (block_remaining == 0) {
+- if (to)
++ if (to) {
++ flush_dcache_page(page);
+ kunmap_atomic(to);
++ }
+
+ block_remaining = DATA_BLOCK_SIZE;
+ dbi = tcmu_cmd_get_dbi(tcmu_cmd);
+@@ -733,7 +735,6 @@ static void scatter_data_area(struct tcmu_dev *udev,
+ memcpy(to + offset,
+ from + sg->length - sg_remaining,
+ copy_bytes);
+- tcmu_flush_dcache_range(to, copy_bytes);
+ }
+
+ sg_remaining -= copy_bytes;
+@@ -742,8 +743,10 @@ static void scatter_data_area(struct tcmu_dev *udev,
+ kunmap_atomic(from - sg->offset);
+ }
+
+- if (to)
++ if (to) {
++ flush_dcache_page(page);
+ kunmap_atomic(to);
++ }
+ }
+
+ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
+@@ -789,13 +792,13 @@ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
+ dbi = tcmu_cmd_get_dbi(cmd);
+ page = tcmu_get_block_page(udev, dbi);
+ from = kmap_atomic(page);
++ flush_dcache_page(page);
+ }
+ copy_bytes = min_t(size_t, sg_remaining,
+ block_remaining);
+ if (read_len < copy_bytes)
+ copy_bytes = read_len;
+ offset = DATA_BLOCK_SIZE - block_remaining;
+- tcmu_flush_dcache_range(from, copy_bytes);
+ memcpy(to + sg->length - sg_remaining, from + offset,
+ copy_bytes);
+
+@@ -1018,7 +1021,7 @@ static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err)
+ entry->hdr.cmd_id = 0; /* not used for PAD */
+ entry->hdr.kflags = 0;
+ entry->hdr.uflags = 0;
+- tcmu_flush_dcache_range(entry, sizeof(*entry));
++ tcmu_flush_dcache_range(entry, sizeof(entry->hdr));
+
+ UPDATE_HEAD(mb->cmd_head, pad_size, udev->cmdr_size);
+ tcmu_flush_dcache_range(mb, sizeof(*mb));
+@@ -1083,7 +1086,7 @@ static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err)
+ cdb_off = CMDR_OFF + cmd_head + base_command_size;
+ memcpy((void *) mb + cdb_off, se_cmd->t_task_cdb, scsi_command_size(se_cmd->t_task_cdb));
+ entry->req.cdb_off = cdb_off;
+- tcmu_flush_dcache_range(entry, sizeof(*entry));
++ tcmu_flush_dcache_range(entry, command_size);
+
+ UPDATE_HEAD(mb->cmd_head, command_size, udev->cmdr_size);
+ tcmu_flush_dcache_range(mb, sizeof(*mb));
+diff --git a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
+index c12211eaaac4d..0b9f835d931f0 100644
+--- a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
++++ b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
+@@ -46,20 +46,21 @@ static struct temp_sensor_data omap4430_mpu_temp_sensor_data = {
+
+ /*
+ * Temperature values in milli degree celsius
+- * ADC code values from 530 to 923
++ * ADC code values from 13 to 107, see TRM
++ * "18.4.10.2.3 ADC Codes Versus Temperature".
+ */
+ static const int
+ omap4430_adc_to_temp[OMAP4430_ADC_END_VALUE - OMAP4430_ADC_START_VALUE + 1] = {
+- -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -22000,
+- -20000, -18000, -17000, -15000, -13000, -12000, -10000, -8000, -6000,
+- -5000, -3000, -1000, 0, 2000, 3000, 5000, 6000, 8000, 10000, 12000,
+- 13000, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28000, 30000,
+- 32000, 33000, 35000, 37000, 38000, 40000, 42000, 43000, 45000, 47000,
+- 48000, 50000, 52000, 53000, 55000, 57000, 58000, 60000, 62000, 64000,
+- 66000, 68000, 70000, 71000, 73000, 75000, 77000, 78000, 80000, 82000,
+- 83000, 85000, 87000, 88000, 90000, 92000, 93000, 95000, 97000, 98000,
+- 100000, 102000, 103000, 105000, 107000, 109000, 111000, 113000, 115000,
+- 117000, 118000, 120000, 122000, 123000,
++ -40000, -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000,
++ -22000, -20000, -18500, -17000, -15000, -13500, -12000, -10000, -8000,
++ -6500, -5000, -3500, -1500, 0, 2000, 3500, 5000, 6500, 8500, 10000,
++ 12000, 13500, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28500,
++ 30000, 32000, 33500, 35000, 37000, 38500, 40000, 42000, 43500, 45000,
++ 47000, 48500, 50000, 52000, 53500, 55000, 57000, 58500, 60000, 62000,
++ 64000, 66000, 68000, 70000, 71500, 73500, 75000, 77000, 78500, 80000,
++ 82000, 83500, 85000, 87000, 88500, 90000, 92000, 93500, 95000, 97000,
++ 98500, 100000, 102000, 103500, 105000, 107000, 109000, 111000, 113000,
++ 115000, 117000, 118500, 120000, 122000, 123500, 125000,
+ };
+
+ /* OMAP4430 data */
+diff --git a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
+index b87c8659ec608..8a081abce4b5f 100644
+--- a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
++++ b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
+@@ -67,9 +67,13 @@
+ * and thresholds for OMAP4430.
+ */
+
+-/* ADC conversion table limits */
+-#define OMAP4430_ADC_START_VALUE 0
+-#define OMAP4430_ADC_END_VALUE 127
++/*
++ * ADC conversion table limits. Ignore values outside the TRM listed
++ * range to avoid bogus thermal shutdowns. See omap4430 TRM chapter
++ * "18.4.10.2.3 ADC Codes Versus Temperature".
++ */
++#define OMAP4430_ADC_START_VALUE 13
++#define OMAP4430_ADC_END_VALUE 107
+ /* bandgap clock limits (no control on 4430) */
+ #define OMAP4430_MAX_FREQ 32768
+ #define OMAP4430_MIN_FREQ 32768
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 0d405cc58e722..cd0768c3e773e 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -1050,7 +1050,7 @@ static unsigned int qcom_geni_serial_tx_empty(struct uart_port *uport)
+ }
+
+ #ifdef CONFIG_SERIAL_QCOM_GENI_CONSOLE
+-static int __init qcom_geni_console_setup(struct console *co, char *options)
++static int qcom_geni_console_setup(struct console *co, char *options)
+ {
+ struct uart_port *uport;
+ struct qcom_geni_serial_port *port;
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 66783a37f450c..9f72a6ee13b53 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -29,6 +29,7 @@
+ #include <linux/vfio.h>
+ #include <linux/vgaarb.h>
+ #include <linux/nospec.h>
++#include <linux/sched/mm.h>
+
+ #include "vfio_pci_private.h"
+
+@@ -181,6 +182,7 @@ no_mmap:
+
+ static void vfio_pci_try_bus_reset(struct vfio_pci_device *vdev);
+ static void vfio_pci_disable(struct vfio_pci_device *vdev);
++static int vfio_pci_try_zap_and_vma_lock_cb(struct pci_dev *pdev, void *data);
+
+ /*
+ * INTx masking requires the ability to disable INTx signaling via PCI_COMMAND
+@@ -623,6 +625,12 @@ int vfio_pci_register_dev_region(struct vfio_pci_device *vdev,
+ return 0;
+ }
+
++struct vfio_devices {
++ struct vfio_device **devices;
++ int cur_index;
++ int max_index;
++};
++
+ static long vfio_pci_ioctl(void *device_data,
+ unsigned int cmd, unsigned long arg)
+ {
+@@ -696,7 +704,7 @@ static long vfio_pci_ioctl(void *device_data,
+ {
+ void __iomem *io;
+ size_t size;
+- u16 orig_cmd;
++ u16 cmd;
+
+ info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+ info.flags = 0;
+@@ -716,10 +724,7 @@ static long vfio_pci_ioctl(void *device_data,
+ * Is it really there? Enable memory decode for
+ * implicit access in pci_map_rom().
+ */
+- pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
+- pci_write_config_word(pdev, PCI_COMMAND,
+- orig_cmd | PCI_COMMAND_MEMORY);
+-
++ cmd = vfio_pci_memory_lock_and_enable(vdev);
+ io = pci_map_rom(pdev, &size);
+ if (io) {
+ info.flags = VFIO_REGION_INFO_FLAG_READ;
+@@ -727,8 +732,8 @@ static long vfio_pci_ioctl(void *device_data,
+ } else {
+ info.size = 0;
+ }
++ vfio_pci_memory_unlock_and_restore(vdev, cmd);
+
+- pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
+ break;
+ }
+ case VFIO_PCI_VGA_REGION_INDEX:
+@@ -865,8 +870,16 @@ static long vfio_pci_ioctl(void *device_data,
+ return ret;
+
+ } else if (cmd == VFIO_DEVICE_RESET) {
+- return vdev->reset_works ?
+- pci_try_reset_function(vdev->pdev) : -EINVAL;
++ int ret;
++
++ if (!vdev->reset_works)
++ return -EINVAL;
++
++ vfio_pci_zap_and_down_write_memory_lock(vdev);
++ ret = pci_try_reset_function(vdev->pdev);
++ up_write(&vdev->memory_lock);
++
++ return ret;
+
+ } else if (cmd == VFIO_DEVICE_GET_PCI_HOT_RESET_INFO) {
+ struct vfio_pci_hot_reset_info hdr;
+@@ -946,8 +959,9 @@ reset_info_exit:
+ int32_t *group_fds;
+ struct vfio_pci_group_entry *groups;
+ struct vfio_pci_group_info info;
++ struct vfio_devices devs = { .cur_index = 0 };
+ bool slot = false;
+- int i, count = 0, ret = 0;
++ int i, group_idx, mem_idx = 0, count = 0, ret = 0;
+
+ minsz = offsetofend(struct vfio_pci_hot_reset, count);
+
+@@ -999,9 +1013,9 @@ reset_info_exit:
+ * user interface and store the group and iommu ID. This
+ * ensures the group is held across the reset.
+ */
+- for (i = 0; i < hdr.count; i++) {
++ for (group_idx = 0; group_idx < hdr.count; group_idx++) {
+ struct vfio_group *group;
+- struct fd f = fdget(group_fds[i]);
++ struct fd f = fdget(group_fds[group_idx]);
+ if (!f.file) {
+ ret = -EBADF;
+ break;
+@@ -1014,8 +1028,9 @@ reset_info_exit:
+ break;
+ }
+
+- groups[i].group = group;
+- groups[i].id = vfio_external_user_iommu_id(group);
++ groups[group_idx].group = group;
++ groups[group_idx].id =
++ vfio_external_user_iommu_id(group);
+ }
+
+ kfree(group_fds);
+@@ -1034,13 +1049,63 @@ reset_info_exit:
+ ret = vfio_pci_for_each_slot_or_bus(vdev->pdev,
+ vfio_pci_validate_devs,
+ &info, slot);
+- if (!ret)
+- /* User has access, do the reset */
+- ret = pci_reset_bus(vdev->pdev);
++ if (ret)
++ goto hot_reset_release;
++
++ devs.max_index = count;
++ devs.devices = kcalloc(count, sizeof(struct vfio_device *),
++ GFP_KERNEL);
++ if (!devs.devices) {
++ ret = -ENOMEM;
++ goto hot_reset_release;
++ }
++
++ /*
++ * We need to get memory_lock for each device, but devices
++ * can share mmap_sem, therefore we need to zap and hold
++ * the vma_lock for each device, and only then get each
++ * memory_lock.
++ */
++ ret = vfio_pci_for_each_slot_or_bus(vdev->pdev,
++ vfio_pci_try_zap_and_vma_lock_cb,
++ &devs, slot);
++ if (ret)
++ goto hot_reset_release;
++
++ for (; mem_idx < devs.cur_index; mem_idx++) {
++ struct vfio_pci_device *tmp;
++
++ tmp = vfio_device_data(devs.devices[mem_idx]);
++
++ ret = down_write_trylock(&tmp->memory_lock);
++ if (!ret) {
++ ret = -EBUSY;
++ goto hot_reset_release;
++ }
++ mutex_unlock(&tmp->vma_lock);
++ }
++
++ /* User has access, do the reset */
++ ret = pci_reset_bus(vdev->pdev);
+
+ hot_reset_release:
+- for (i--; i >= 0; i--)
+- vfio_group_put_external_user(groups[i].group);
++ for (i = 0; i < devs.cur_index; i++) {
++ struct vfio_device *device;
++ struct vfio_pci_device *tmp;
++
++ device = devs.devices[i];
++ tmp = vfio_device_data(device);
++
++ if (i < mem_idx)
++ up_write(&tmp->memory_lock);
++ else
++ mutex_unlock(&tmp->vma_lock);
++ vfio_device_put(device);
++ }
++ kfree(devs.devices);
++
++ for (group_idx--; group_idx >= 0; group_idx--)
++ vfio_group_put_external_user(groups[group_idx].group);
+
+ kfree(groups);
+ return ret;
+@@ -1121,6 +1186,202 @@ static ssize_t vfio_pci_write(void *device_data, const char __user *buf,
+ return vfio_pci_rw(device_data, (char __user *)buf, count, ppos, true);
+ }
+
++/* Return 1 on zap and vma_lock acquired, 0 on contention (only with @try) */
++static int vfio_pci_zap_and_vma_lock(struct vfio_pci_device *vdev, bool try)
++{
++ struct vfio_pci_mmap_vma *mmap_vma, *tmp;
++
++ /*
++ * Lock ordering:
++ * vma_lock is nested under mmap_sem for vm_ops callback paths.
++ * The memory_lock semaphore is used by both code paths calling
++ * into this function to zap vmas and the vm_ops.fault callback
++ * to protect the memory enable state of the device.
++ *
++ * When zapping vmas we need to maintain the mmap_sem => vma_lock
++ * ordering, which requires using vma_lock to walk vma_list to
++ * acquire an mm, then dropping vma_lock to get the mmap_sem and
++ * reacquiring vma_lock. This logic is derived from similar
++ * requirements in uverbs_user_mmap_disassociate().
++ *
++ * mmap_sem must always be the top-level lock when it is taken.
++ * Therefore we can only hold the memory_lock write lock when
++ * vma_list is empty, as we'd need to take mmap_sem to clear
++ * entries. vma_list can only be guaranteed empty when holding
++ * vma_lock, thus memory_lock is nested under vma_lock.
++ *
++ * This enables the vm_ops.fault callback to acquire vma_lock,
++ * followed by memory_lock read lock, while already holding
++ * mmap_sem without risk of deadlock.
++ */
++ while (1) {
++ struct mm_struct *mm = NULL;
++
++ if (try) {
++ if (!mutex_trylock(&vdev->vma_lock))
++ return 0;
++ } else {
++ mutex_lock(&vdev->vma_lock);
++ }
++ while (!list_empty(&vdev->vma_list)) {
++ mmap_vma = list_first_entry(&vdev->vma_list,
++ struct vfio_pci_mmap_vma,
++ vma_next);
++ mm = mmap_vma->vma->vm_mm;
++ if (mmget_not_zero(mm))
++ break;
++
++ list_del(&mmap_vma->vma_next);
++ kfree(mmap_vma);
++ mm = NULL;
++ }
++ if (!mm)
++ return 1;
++ mutex_unlock(&vdev->vma_lock);
++
++ if (try) {
++ if (!down_read_trylock(&mm->mmap_sem)) {
++ mmput(mm);
++ return 0;
++ }
++ } else {
++ down_read(&mm->mmap_sem);
++ }
++ if (mmget_still_valid(mm)) {
++ if (try) {
++ if (!mutex_trylock(&vdev->vma_lock)) {
++ up_read(&mm->mmap_sem);
++ mmput(mm);
++ return 0;
++ }
++ } else {
++ mutex_lock(&vdev->vma_lock);
++ }
++ list_for_each_entry_safe(mmap_vma, tmp,
++ &vdev->vma_list, vma_next) {
++ struct vm_area_struct *vma = mmap_vma->vma;
++
++ if (vma->vm_mm != mm)
++ continue;
++
++ list_del(&mmap_vma->vma_next);
++ kfree(mmap_vma);
++
++ zap_vma_ptes(vma, vma->vm_start,
++ vma->vm_end - vma->vm_start);
++ }
++ mutex_unlock(&vdev->vma_lock);
++ }
++ up_read(&mm->mmap_sem);
++ mmput(mm);
++ }
++}
++
++void vfio_pci_zap_and_down_write_memory_lock(struct vfio_pci_device *vdev)
++{
++ vfio_pci_zap_and_vma_lock(vdev, false);
++ down_write(&vdev->memory_lock);
++ mutex_unlock(&vdev->vma_lock);
++}
++
++u16 vfio_pci_memory_lock_and_enable(struct vfio_pci_device *vdev)
++{
++ u16 cmd;
++
++ down_write(&vdev->memory_lock);
++ pci_read_config_word(vdev->pdev, PCI_COMMAND, &cmd);
++ if (!(cmd & PCI_COMMAND_MEMORY))
++ pci_write_config_word(vdev->pdev, PCI_COMMAND,
++ cmd | PCI_COMMAND_MEMORY);
++
++ return cmd;
++}
++
++void vfio_pci_memory_unlock_and_restore(struct vfio_pci_device *vdev, u16 cmd)
++{
++ pci_write_config_word(vdev->pdev, PCI_COMMAND, cmd);
++ up_write(&vdev->memory_lock);
++}
++
++/* Caller holds vma_lock */
++static int __vfio_pci_add_vma(struct vfio_pci_device *vdev,
++ struct vm_area_struct *vma)
++{
++ struct vfio_pci_mmap_vma *mmap_vma;
++
++ mmap_vma = kmalloc(sizeof(*mmap_vma), GFP_KERNEL);
++ if (!mmap_vma)
++ return -ENOMEM;
++
++ mmap_vma->vma = vma;
++ list_add(&mmap_vma->vma_next, &vdev->vma_list);
++
++ return 0;
++}
++
++/*
++ * Zap mmaps on open so that we can fault them in on access and therefore
++ * our vma_list only tracks mappings accessed since last zap.
++ */
++static void vfio_pci_mmap_open(struct vm_area_struct *vma)
++{
++ zap_vma_ptes(vma, vma->vm_start, vma->vm_end - vma->vm_start);
++}
++
++static void vfio_pci_mmap_close(struct vm_area_struct *vma)
++{
++ struct vfio_pci_device *vdev = vma->vm_private_data;
++ struct vfio_pci_mmap_vma *mmap_vma;
++
++ mutex_lock(&vdev->vma_lock);
++ list_for_each_entry(mmap_vma, &vdev->vma_list, vma_next) {
++ if (mmap_vma->vma == vma) {
++ list_del(&mmap_vma->vma_next);
++ kfree(mmap_vma);
++ break;
++ }
++ }
++ mutex_unlock(&vdev->vma_lock);
++}
++
++static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf)
++{
++ struct vm_area_struct *vma = vmf->vma;
++ struct vfio_pci_device *vdev = vma->vm_private_data;
++ vm_fault_t ret = VM_FAULT_NOPAGE;
++
++ mutex_lock(&vdev->vma_lock);
++ down_read(&vdev->memory_lock);
++
++ if (!__vfio_pci_memory_enabled(vdev)) {
++ ret = VM_FAULT_SIGBUS;
++ mutex_unlock(&vdev->vma_lock);
++ goto up_out;
++ }
++
++ if (__vfio_pci_add_vma(vdev, vma)) {
++ ret = VM_FAULT_OOM;
++ mutex_unlock(&vdev->vma_lock);
++ goto up_out;
++ }
++
++ mutex_unlock(&vdev->vma_lock);
++
++ if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
++ vma->vm_end - vma->vm_start, vma->vm_page_prot))
++ ret = VM_FAULT_SIGBUS;
++
++up_out:
++ up_read(&vdev->memory_lock);
++ return ret;
++}
++
++static const struct vm_operations_struct vfio_pci_mmap_ops = {
++ .open = vfio_pci_mmap_open,
++ .close = vfio_pci_mmap_close,
++ .fault = vfio_pci_mmap_fault,
++};
++
+ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma)
+ {
+ struct vfio_pci_device *vdev = device_data;
+@@ -1170,8 +1431,14 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma)
+ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ vma->vm_pgoff = (pci_resource_start(pdev, index) >> PAGE_SHIFT) + pgoff;
+
+- return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+- req_len, vma->vm_page_prot);
++ /*
++ * See remap_pfn_range(), called from vfio_pci_fault() but we can't
++ * change vm_flags within the fault handler. Set them now.
++ */
++ vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;
++ vma->vm_ops = &vfio_pci_mmap_ops;
++
++ return 0;
+ }
+
+ static void vfio_pci_request(void *device_data, unsigned int count)
+@@ -1243,6 +1510,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ spin_lock_init(&vdev->irqlock);
+ mutex_init(&vdev->ioeventfds_lock);
+ INIT_LIST_HEAD(&vdev->ioeventfds_list);
++ mutex_init(&vdev->vma_lock);
++ INIT_LIST_HEAD(&vdev->vma_list);
++ init_rwsem(&vdev->memory_lock);
+
+ ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev);
+ if (ret) {
+@@ -1338,12 +1608,6 @@ static struct pci_driver vfio_pci_driver = {
+ .err_handler = &vfio_err_handlers,
+ };
+
+-struct vfio_devices {
+- struct vfio_device **devices;
+- int cur_index;
+- int max_index;
+-};
+-
+ static int vfio_pci_get_devs(struct pci_dev *pdev, void *data)
+ {
+ struct vfio_devices *devs = data;
+@@ -1365,6 +1629,39 @@ static int vfio_pci_get_devs(struct pci_dev *pdev, void *data)
+ return 0;
+ }
+
++static int vfio_pci_try_zap_and_vma_lock_cb(struct pci_dev *pdev, void *data)
++{
++ struct vfio_devices *devs = data;
++ struct vfio_device *device;
++ struct vfio_pci_device *vdev;
++
++ if (devs->cur_index == devs->max_index)
++ return -ENOSPC;
++
++ device = vfio_device_get_from_dev(&pdev->dev);
++ if (!device)
++ return -EINVAL;
++
++ if (pci_dev_driver(pdev) != &vfio_pci_driver) {
++ vfio_device_put(device);
++ return -EBUSY;
++ }
++
++ vdev = vfio_device_data(device);
++
++ /*
++ * Locking multiple devices is prone to deadlock, runaway and
++ * unwind if we hit contention.
++ */
++ if (!vfio_pci_zap_and_vma_lock(vdev, true)) {
++ vfio_device_put(device);
++ return -EBUSY;
++ }
++
++ devs->devices[devs->cur_index++] = device;
++ return 0;
++}
++
+ /*
+ * Attempt to do a bus/slot reset if there are devices affected by a reset for
+ * this device that are needs_reset and all of the affected devices are unused
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index 36bc8f104e42e..a1a26465d224c 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -398,6 +398,20 @@ static inline void p_setd(struct perm_bits *p, int off, u32 virt, u32 write)
+ *(__le32 *)(&p->write[off]) = cpu_to_le32(write);
+ }
+
++/* Caller should hold memory_lock semaphore */
++bool __vfio_pci_memory_enabled(struct vfio_pci_device *vdev)
++{
++ struct pci_dev *pdev = vdev->pdev;
++ u16 cmd = le16_to_cpu(*(__le16 *)&vdev->vconfig[PCI_COMMAND]);
++
++ /*
++ * SR-IOV VF memory enable is handled by the MSE bit in the
++ * PF SR-IOV capability, there's therefore no need to trigger
++ * faults based on the virtual value.
++ */
++ return pdev->is_virtfn || (cmd & PCI_COMMAND_MEMORY);
++}
++
+ /*
+ * Restore the *real* BARs after we detect a FLR or backdoor reset.
+ * (backdoor = some device specific technique that we didn't catch)
+@@ -558,13 +572,18 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos,
+
+ new_cmd = le32_to_cpu(val);
+
++ phys_io = !!(phys_cmd & PCI_COMMAND_IO);
++ virt_io = !!(le16_to_cpu(*virt_cmd) & PCI_COMMAND_IO);
++ new_io = !!(new_cmd & PCI_COMMAND_IO);
++
+ phys_mem = !!(phys_cmd & PCI_COMMAND_MEMORY);
+ virt_mem = !!(le16_to_cpu(*virt_cmd) & PCI_COMMAND_MEMORY);
+ new_mem = !!(new_cmd & PCI_COMMAND_MEMORY);
+
+- phys_io = !!(phys_cmd & PCI_COMMAND_IO);
+- virt_io = !!(le16_to_cpu(*virt_cmd) & PCI_COMMAND_IO);
+- new_io = !!(new_cmd & PCI_COMMAND_IO);
++ if (!new_mem)
++ vfio_pci_zap_and_down_write_memory_lock(vdev);
++ else
++ down_write(&vdev->memory_lock);
+
+ /*
+ * If the user is writing mem/io enable (new_mem/io) and we
+@@ -581,8 +600,11 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos,
+ }
+
+ count = vfio_default_config_write(vdev, pos, count, perm, offset, val);
+- if (count < 0)
++ if (count < 0) {
++ if (offset == PCI_COMMAND)
++ up_write(&vdev->memory_lock);
+ return count;
++ }
+
+ /*
+ * Save current memory/io enable bits in vconfig to allow for
+@@ -593,6 +615,8 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos,
+
+ *virt_cmd &= cpu_to_le16(~mask);
+ *virt_cmd |= cpu_to_le16(new_cmd & mask);
++
++ up_write(&vdev->memory_lock);
+ }
+
+ /* Emulate INTx disable */
+@@ -830,8 +854,11 @@ static int vfio_exp_config_write(struct vfio_pci_device *vdev, int pos,
+ pos - offset + PCI_EXP_DEVCAP,
+ &cap);
+
+- if (!ret && (cap & PCI_EXP_DEVCAP_FLR))
++ if (!ret && (cap & PCI_EXP_DEVCAP_FLR)) {
++ vfio_pci_zap_and_down_write_memory_lock(vdev);
+ pci_try_reset_function(vdev->pdev);
++ up_write(&vdev->memory_lock);
++ }
+ }
+
+ /*
+@@ -909,8 +936,11 @@ static int vfio_af_config_write(struct vfio_pci_device *vdev, int pos,
+ pos - offset + PCI_AF_CAP,
+ &cap);
+
+- if (!ret && (cap & PCI_AF_CAP_FLR) && (cap & PCI_AF_CAP_TP))
++ if (!ret && (cap & PCI_AF_CAP_FLR) && (cap & PCI_AF_CAP_TP)) {
++ vfio_pci_zap_and_down_write_memory_lock(vdev);
+ pci_try_reset_function(vdev->pdev);
++ up_write(&vdev->memory_lock);
++ }
+ }
+
+ return count;
+@@ -1708,6 +1738,15 @@ int vfio_config_init(struct vfio_pci_device *vdev)
+ vconfig[PCI_INTERRUPT_PIN]);
+
+ vconfig[PCI_INTERRUPT_PIN] = 0; /* Gratuitous for good VFs */
++
++ /*
++ * VFs do no implement the memory enable bit of the COMMAND
++ * register therefore we'll not have it set in our initial
++ * copy of config space after pci_enable_device(). For
++ * consistency with PFs, set the virtual enable bit here.
++ */
++ *(__le16 *)&vconfig[PCI_COMMAND] |=
++ cpu_to_le16(PCI_COMMAND_MEMORY);
+ }
+
+ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx)
+diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
+index 94594dc63c417..bdfdd506bc588 100644
+--- a/drivers/vfio/pci/vfio_pci_intrs.c
++++ b/drivers/vfio/pci/vfio_pci_intrs.c
+@@ -252,6 +252,7 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix)
+ struct pci_dev *pdev = vdev->pdev;
+ unsigned int flag = msix ? PCI_IRQ_MSIX : PCI_IRQ_MSI;
+ int ret;
++ u16 cmd;
+
+ if (!is_irq_none(vdev))
+ return -EINVAL;
+@@ -261,13 +262,16 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix)
+ return -ENOMEM;
+
+ /* return the number of supported vectors if we can't get all: */
++ cmd = vfio_pci_memory_lock_and_enable(vdev);
+ ret = pci_alloc_irq_vectors(pdev, 1, nvec, flag);
+ if (ret < nvec) {
+ if (ret > 0)
+ pci_free_irq_vectors(pdev);
++ vfio_pci_memory_unlock_and_restore(vdev, cmd);
+ kfree(vdev->ctx);
+ return ret;
+ }
++ vfio_pci_memory_unlock_and_restore(vdev, cmd);
+
+ vdev->num_ctx = nvec;
+ vdev->irq_type = msix ? VFIO_PCI_MSIX_IRQ_INDEX :
+@@ -290,6 +294,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,
+ struct pci_dev *pdev = vdev->pdev;
+ struct eventfd_ctx *trigger;
+ int irq, ret;
++ u16 cmd;
+
+ if (vector < 0 || vector >= vdev->num_ctx)
+ return -EINVAL;
+@@ -298,7 +303,11 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,
+
+ if (vdev->ctx[vector].trigger) {
+ irq_bypass_unregister_producer(&vdev->ctx[vector].producer);
++
++ cmd = vfio_pci_memory_lock_and_enable(vdev);
+ free_irq(irq, vdev->ctx[vector].trigger);
++ vfio_pci_memory_unlock_and_restore(vdev, cmd);
++
+ kfree(vdev->ctx[vector].name);
+ eventfd_ctx_put(vdev->ctx[vector].trigger);
+ vdev->ctx[vector].trigger = NULL;
+@@ -326,6 +335,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,
+ * such a reset it would be unsuccessful. To avoid this, restore the
+ * cached value of the message prior to enabling.
+ */
++ cmd = vfio_pci_memory_lock_and_enable(vdev);
+ if (msix) {
+ struct msi_msg msg;
+
+@@ -335,6 +345,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,
+
+ ret = request_irq(irq, vfio_msihandler, 0,
+ vdev->ctx[vector].name, trigger);
++ vfio_pci_memory_unlock_and_restore(vdev, cmd);
+ if (ret) {
+ kfree(vdev->ctx[vector].name);
+ eventfd_ctx_put(trigger);
+@@ -379,6 +390,7 @@ static void vfio_msi_disable(struct vfio_pci_device *vdev, bool msix)
+ {
+ struct pci_dev *pdev = vdev->pdev;
+ int i;
++ u16 cmd;
+
+ for (i = 0; i < vdev->num_ctx; i++) {
+ vfio_virqfd_disable(&vdev->ctx[i].unmask);
+@@ -387,7 +399,9 @@ static void vfio_msi_disable(struct vfio_pci_device *vdev, bool msix)
+
+ vfio_msi_set_block(vdev, 0, vdev->num_ctx, NULL, msix);
+
++ cmd = vfio_pci_memory_lock_and_enable(vdev);
+ pci_free_irq_vectors(pdev);
++ vfio_pci_memory_unlock_and_restore(vdev, cmd);
+
+ /*
+ * Both disable paths above use pci_intx_for_msi() to clear DisINTx
+diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h
+index cde3b5d3441ad..17d2bae5b013c 100644
+--- a/drivers/vfio/pci/vfio_pci_private.h
++++ b/drivers/vfio/pci/vfio_pci_private.h
+@@ -76,6 +76,11 @@ struct vfio_pci_dummy_resource {
+ struct list_head res_next;
+ };
+
++struct vfio_pci_mmap_vma {
++ struct vm_area_struct *vma;
++ struct list_head vma_next;
++};
++
+ struct vfio_pci_device {
+ struct pci_dev *pdev;
+ void __iomem *barmap[PCI_STD_RESOURCE_END + 1];
+@@ -111,6 +116,9 @@ struct vfio_pci_device {
+ struct list_head dummy_resources_list;
+ struct mutex ioeventfds_lock;
+ struct list_head ioeventfds_list;
++ struct mutex vma_lock;
++ struct list_head vma_list;
++ struct rw_semaphore memory_lock;
+ };
+
+ #define is_intx(vdev) (vdev->irq_type == VFIO_PCI_INTX_IRQ_INDEX)
+@@ -149,6 +157,14 @@ extern int vfio_pci_register_dev_region(struct vfio_pci_device *vdev,
+ unsigned int type, unsigned int subtype,
+ const struct vfio_pci_regops *ops,
+ size_t size, u32 flags, void *data);
++
++extern bool __vfio_pci_memory_enabled(struct vfio_pci_device *vdev);
++extern void vfio_pci_zap_and_down_write_memory_lock(struct vfio_pci_device
++ *vdev);
++extern u16 vfio_pci_memory_lock_and_enable(struct vfio_pci_device *vdev);
++extern void vfio_pci_memory_unlock_and_restore(struct vfio_pci_device *vdev,
++ u16 cmd);
++
+ #ifdef CONFIG_VFIO_PCI_IGD
+ extern int vfio_pci_igd_init(struct vfio_pci_device *vdev);
+ #else
+diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
+index a6029d0a55244..3d0ec2bbe131f 100644
+--- a/drivers/vfio/pci/vfio_pci_rdwr.c
++++ b/drivers/vfio/pci/vfio_pci_rdwr.c
+@@ -165,6 +165,7 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf,
+ size_t x_start = 0, x_end = 0;
+ resource_size_t end;
+ void __iomem *io;
++ struct resource *res = &vdev->pdev->resource[bar];
+ ssize_t done;
+
+ if (pci_resource_start(pdev, bar))
+@@ -180,6 +181,14 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf,
+
+ count = min(count, (size_t)(end - pos));
+
++ if (res->flags & IORESOURCE_MEM) {
++ down_read(&vdev->memory_lock);
++ if (!__vfio_pci_memory_enabled(vdev)) {
++ up_read(&vdev->memory_lock);
++ return -EIO;
++ }
++ }
++
+ if (bar == PCI_ROM_RESOURCE) {
+ /*
+ * The ROM can fill less space than the BAR, so we start the
+@@ -187,13 +196,17 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf,
+ * filling large ROM BARs much faster.
+ */
+ io = pci_map_rom(pdev, &x_start);
+- if (!io)
+- return -ENOMEM;
++ if (!io) {
++ done = -ENOMEM;
++ goto out;
++ }
+ x_end = end;
+ } else {
+ int ret = vfio_pci_setup_barmap(vdev, bar);
+- if (ret)
+- return ret;
++ if (ret) {
++ done = ret;
++ goto out;
++ }
+
+ io = vdev->barmap[bar];
+ }
+@@ -210,6 +223,9 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf,
+
+ if (bar == PCI_ROM_RESOURCE)
+ pci_unmap_rom(pdev, io);
++out:
++ if (res->flags & IORESOURCE_MEM)
++ up_read(&vdev->memory_lock);
+
+ return done;
+ }
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index 52083b710b87e..05d8553635ee7 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -343,6 +343,32 @@ static int put_pfn(unsigned long pfn, int prot)
+ return 0;
+ }
+
++static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm,
++ unsigned long vaddr, unsigned long *pfn,
++ bool write_fault)
++{
++ int ret;
++
++ ret = follow_pfn(vma, vaddr, pfn);
++ if (ret) {
++ bool unlocked = false;
++
++ ret = fixup_user_fault(NULL, mm, vaddr,
++ FAULT_FLAG_REMOTE |
++ (write_fault ? FAULT_FLAG_WRITE : 0),
++ &unlocked);
++ if (unlocked)
++ return -EAGAIN;
++
++ if (ret)
++ return ret;
++
++ ret = follow_pfn(vma, vaddr, pfn);
++ }
++
++ return ret;
++}
++
+ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr,
+ int prot, unsigned long *pfn)
+ {
+@@ -382,12 +408,16 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr,
+
+ down_read(&mm->mmap_sem);
+
++retry:
+ vma = find_vma_intersection(mm, vaddr, vaddr + 1);
+
+ if (vma && vma->vm_flags & VM_PFNMAP) {
+- if (!follow_pfn(vma, vaddr, pfn) &&
+- is_invalid_reserved_pfn(*pfn))
+- ret = 0;
++ ret = follow_fault_pfn(vma, mm, vaddr, pfn, prot & IOMMU_WRITE);
++ if (ret == -EAGAIN)
++ goto retry;
++
++ if (!ret && !is_invalid_reserved_pfn(*pfn))
++ ret = -EFAULT;
+ }
+
+ up_read(&mm->mmap_sem);
+diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
+index e94a61eaeceb0..f7b553faadb10 100644
+--- a/drivers/xen/xenbus/xenbus_client.c
++++ b/drivers/xen/xenbus/xenbus_client.c
+@@ -365,8 +365,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void *vaddr,
+ int i, j;
+
+ for (i = 0; i < nr_pages; i++) {
+- err = gnttab_grant_foreign_access(dev->otherend_id,
+- virt_to_gfn(vaddr), 0);
++ unsigned long gfn;
++
++ if (is_vmalloc_addr(vaddr))
++ gfn = pfn_to_gfn(vmalloc_to_pfn(vaddr));
++ else
++ gfn = virt_to_gfn(vaddr);
++
++ err = gnttab_grant_foreign_access(dev->otherend_id, gfn, 0);
+ if (err < 0) {
+ xenbus_dev_fatal(dev, err,
+ "granting access to ring page");
+diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
+index 14a6c1b90c9fb..9a1e761b64a2b 100644
+--- a/fs/affs/amigaffs.c
++++ b/fs/affs/amigaffs.c
+@@ -420,24 +420,51 @@ affs_mode_to_prot(struct inode *inode)
+ u32 prot = AFFS_I(inode)->i_protect;
+ umode_t mode = inode->i_mode;
+
++ /*
++ * First, clear all RWED bits for owner, group, other.
++ * Then, recalculate them afresh.
++ *
++ * We'll always clear the delete-inhibit bit for the owner, as that is
++ * the classic single-user mode AmigaOS protection bit and we need to
++ * stay compatible with all scenarios.
++ *
++ * Since multi-user AmigaOS is an extension, we'll only set the
++ * delete-allow bit if any of the other bits in the same user class
++ * (group/other) are used.
++ */
++ prot &= ~(FIBF_NOEXECUTE | FIBF_NOREAD
++ | FIBF_NOWRITE | FIBF_NODELETE
++ | FIBF_GRP_EXECUTE | FIBF_GRP_READ
++ | FIBF_GRP_WRITE | FIBF_GRP_DELETE
++ | FIBF_OTR_EXECUTE | FIBF_OTR_READ
++ | FIBF_OTR_WRITE | FIBF_OTR_DELETE);
++
++ /* Classic single-user AmigaOS flags. These are inverted. */
+ if (!(mode & 0100))
+ prot |= FIBF_NOEXECUTE;
+ if (!(mode & 0400))
+ prot |= FIBF_NOREAD;
+ if (!(mode & 0200))
+ prot |= FIBF_NOWRITE;
++
++ /* Multi-user extended flags. Not inverted. */
+ if (mode & 0010)
+ prot |= FIBF_GRP_EXECUTE;
+ if (mode & 0040)
+ prot |= FIBF_GRP_READ;
+ if (mode & 0020)
+ prot |= FIBF_GRP_WRITE;
++ if (mode & 0070)
++ prot |= FIBF_GRP_DELETE;
++
+ if (mode & 0001)
+ prot |= FIBF_OTR_EXECUTE;
+ if (mode & 0004)
+ prot |= FIBF_OTR_READ;
+ if (mode & 0002)
+ prot |= FIBF_OTR_WRITE;
++ if (mode & 0007)
++ prot |= FIBF_OTR_DELETE;
+
+ AFFS_I(inode)->i_protect = prot;
+ }
+diff --git a/fs/affs/file.c b/fs/affs/file.c
+index a85817f54483f..ba084b0b214b9 100644
+--- a/fs/affs/file.c
++++ b/fs/affs/file.c
+@@ -428,6 +428,24 @@ static int affs_write_begin(struct file *file, struct address_space *mapping,
+ return ret;
+ }
+
++static int affs_write_end(struct file *file, struct address_space *mapping,
++ loff_t pos, unsigned int len, unsigned int copied,
++ struct page *page, void *fsdata)
++{
++ struct inode *inode = mapping->host;
++ int ret;
++
++ ret = generic_write_end(file, mapping, pos, len, copied, page, fsdata);
++
++ /* Clear Archived bit on file writes, as AmigaOS would do */
++ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) {
++ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED;
++ mark_inode_dirty(inode);
++ }
++
++ return ret;
++}
++
+ static sector_t _affs_bmap(struct address_space *mapping, sector_t block)
+ {
+ return generic_block_bmap(mapping,block,affs_get_block);
+@@ -437,7 +455,7 @@ const struct address_space_operations affs_aops = {
+ .readpage = affs_readpage,
+ .writepage = affs_writepage,
+ .write_begin = affs_write_begin,
+- .write_end = generic_write_end,
++ .write_end = affs_write_end,
+ .direct_IO = affs_direct_IO,
+ .bmap = _affs_bmap
+ };
+@@ -794,6 +812,12 @@ done:
+ if (tmp > inode->i_size)
+ inode->i_size = AFFS_I(inode)->mmu_private = tmp;
+
++ /* Clear Archived bit on file writes, as AmigaOS would do */
++ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) {
++ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED;
++ mark_inode_dirty(inode);
++ }
++
+ err_first_bh:
+ unlock_page(page);
+ put_page(page);
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index c9943d70e2cb2..8007b6aacec60 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1347,7 +1347,8 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct btrfs_path *path,
+ btrfs_tree_read_unlock_blocking(eb);
+ free_extent_buffer(eb);
+
+- extent_buffer_get(eb_rewin);
++ btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb_rewin),
++ eb_rewin, btrfs_header_level(eb_rewin));
+ btrfs_tree_read_lock(eb_rewin);
+ __tree_mod_log_rewind(fs_info, eb_rewin, time_seq, tm);
+ WARN_ON(btrfs_header_nritems(eb_rewin) >
+@@ -1421,8 +1422,6 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+
+ if (!eb)
+ return NULL;
+- extent_buffer_get(eb);
+- btrfs_tree_read_lock(eb);
+ if (old_root) {
+ btrfs_set_header_bytenr(eb, eb->start);
+ btrfs_set_header_backref_rev(eb, BTRFS_MIXED_BACKREF_REV);
+@@ -1430,6 +1429,9 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+ btrfs_set_header_level(eb, old_root->level);
+ btrfs_set_header_generation(eb, old_generation);
+ }
++ btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb), eb,
++ btrfs_header_level(eb));
++ btrfs_tree_read_lock(eb);
+ if (tm)
+ __tree_mod_log_rewind(fs_info, eb, time_seq, tm);
+ else
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index fbcd18d96c524..82d597b16152c 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -5377,9 +5377,9 @@ void read_extent_buffer(const struct extent_buffer *eb, void *dstv,
+ }
+ }
+
+-int read_extent_buffer_to_user(const struct extent_buffer *eb,
+- void __user *dstv,
+- unsigned long start, unsigned long len)
++int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb,
++ void __user *dstv,
++ unsigned long start, unsigned long len)
+ {
+ size_t cur;
+ size_t offset;
+@@ -5400,7 +5400,7 @@ int read_extent_buffer_to_user(const struct extent_buffer *eb,
+
+ cur = min(len, (PAGE_SIZE - offset));
+ kaddr = page_address(page);
+- if (copy_to_user(dst, kaddr + offset, cur)) {
++ if (probe_user_write(dst, kaddr + offset, cur)) {
+ ret = -EFAULT;
+ break;
+ }
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index a3598b24441e1..d5089cadd7c49 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -448,9 +448,9 @@ int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv,
+ void read_extent_buffer(const struct extent_buffer *eb, void *dst,
+ unsigned long start,
+ unsigned long len);
+-int read_extent_buffer_to_user(const struct extent_buffer *eb,
+- void __user *dst, unsigned long start,
+- unsigned long len);
++int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb,
++ void __user *dst, unsigned long start,
++ unsigned long len);
+ void write_extent_buffer_fsid(struct extent_buffer *eb, const void *src);
+ void write_extent_buffer_chunk_tree_uuid(struct extent_buffer *eb,
+ const void *src);
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index a5ae02bf3652b..85990755edd90 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2079,9 +2079,14 @@ static noinline int copy_to_sk(struct btrfs_path *path,
+ sh.len = item_len;
+ sh.transid = found_transid;
+
+- /* copy search result header */
+- if (copy_to_user(ubuf + *sk_offset, &sh, sizeof(sh))) {
+- ret = -EFAULT;
++ /*
++ * Copy search result header. If we fault then loop again so we
++ * can fault in the pages and -EFAULT there if there's a
++ * problem. Otherwise we'll fault and then copy the buffer in
++ * properly this next time through
++ */
++ if (probe_user_write(ubuf + *sk_offset, &sh, sizeof(sh))) {
++ ret = 0;
+ goto out;
+ }
+
+@@ -2089,10 +2094,14 @@ static noinline int copy_to_sk(struct btrfs_path *path,
+
+ if (item_len) {
+ char __user *up = ubuf + *sk_offset;
+- /* copy the item */
+- if (read_extent_buffer_to_user(leaf, up,
+- item_off, item_len)) {
+- ret = -EFAULT;
++ /*
++ * Copy the item, same behavior as above, but reset the
++ * * sk_offset so we copy the full thing again.
++ */
++ if (read_extent_buffer_to_user_nofault(leaf, up,
++ item_off, item_len)) {
++ ret = 0;
++ *sk_offset -= sizeof(sh);
+ goto out;
+ }
+
+@@ -2180,6 +2189,10 @@ static noinline int search_ioctl(struct inode *inode,
+ key.offset = sk->min_offset;
+
+ while (1) {
++ ret = fault_in_pages_writeable(ubuf, *buf_size - sk_offset);
++ if (ret)
++ break;
++
+ ret = btrfs_search_forward(root, &key, path, sk->min_transid);
+ if (ret != 0) {
+ if (ret > 0)
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 4abb2a155ac5b..498ec4b10e610 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4172,6 +4172,7 @@ static int btrfs_uuid_scan_kthread(void *data)
+ goto skip;
+ }
+ update_tree:
++ btrfs_release_path(path);
+ if (!btrfs_is_empty_uuid(root_item.uuid)) {
+ ret = btrfs_uuid_tree_add(trans, root_item.uuid,
+ BTRFS_UUID_KEY_SUBVOL,
+@@ -4196,6 +4197,7 @@ update_tree:
+ }
+
+ skip:
++ btrfs_release_path(path);
+ if (trans) {
+ ret = btrfs_end_transaction(trans);
+ trans = NULL;
+@@ -4203,7 +4205,6 @@ skip:
+ break;
+ }
+
+- btrfs_release_path(path);
+ if (key.offset < (u64)-1) {
+ key.offset++;
+ } else if (key.type < BTRFS_ROOT_ITEM_KEY) {
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index faca455bd3c69..4ce2752c8b71c 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -1819,6 +1819,7 @@ const struct file_operations ceph_file_fops = {
+ .mmap = ceph_mmap,
+ .fsync = ceph_fsync,
+ .lock = ceph_lock,
++ .setlease = simple_nosetlease,
+ .flock = ceph_flock,
+ .splice_read = generic_file_splice_read,
+ .splice_write = iter_file_splice_write,
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index f988ccd064a22..61a52bb26d127 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1891,9 +1891,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+ * during ep_insert().
+ */
+ if (list_empty(&epi->ffd.file->f_tfile_llink)) {
+- get_file(epi->ffd.file);
+- list_add(&epi->ffd.file->f_tfile_llink,
+- &tfile_check_list);
++ if (get_file_rcu(epi->ffd.file))
++ list_add(&epi->ffd.file->f_tfile_llink,
++ &tfile_check_list);
+ }
+ }
+ }
+diff --git a/fs/ext2/file.c b/fs/ext2/file.c
+index 28b2609f25c1c..d39d90c1b6709 100644
+--- a/fs/ext2/file.c
++++ b/fs/ext2/file.c
+@@ -93,8 +93,10 @@ static vm_fault_t ext2_dax_fault(struct vm_fault *vmf)
+ struct inode *inode = file_inode(vmf->vma->vm_file);
+ struct ext2_inode_info *ei = EXT2_I(inode);
+ vm_fault_t ret;
++ bool write = (vmf->flags & FAULT_FLAG_WRITE) &&
++ (vmf->vma->vm_flags & VM_SHARED);
+
+- if (vmf->flags & FAULT_FLAG_WRITE) {
++ if (write) {
+ sb_start_pagefault(inode->i_sb);
+ file_update_time(vmf->vma->vm_file);
+ }
+@@ -103,7 +105,7 @@ static vm_fault_t ext2_dax_fault(struct vm_fault *vmf)
+ ret = dax_iomap_fault(vmf, PE_SIZE_PTE, NULL, NULL, &ext2_iomap_ops);
+
+ up_read(&ei->dax_sem);
+- if (vmf->flags & FAULT_FLAG_WRITE)
++ if (write)
+ sb_end_pagefault(inode->i_sb);
+ return ret;
+ }
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index 2652d00842d6b..087a5715cf20e 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -935,8 +935,10 @@ xfs_attr_shortform_verify(
+ * struct xfs_attr_sf_entry has a variable length.
+ * Check the fixed-offset parts of the structure are
+ * within the data buffer.
++ * xfs_attr_sf_entry is defined with a 1-byte variable
++ * array at the end, so we must subtract that off.
+ */
+- if (((char *)sfep + sizeof(*sfep)) >= endp)
++ if (((char *)sfep + sizeof(*sfep) - 1) >= endp)
+ return __this_address;
+
+ /* Don't allow names with known bad length. */
+diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
+index 0b7145fdb8aa1..f35e1801f1c90 100644
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -6130,7 +6130,7 @@ xfs_bmap_validate_extent(
+
+ isrt = XFS_IS_REALTIME_INODE(ip);
+ endfsb = irec->br_startblock + irec->br_blockcount - 1;
+- if (isrt) {
++ if (isrt && whichfork == XFS_DATA_FORK) {
+ if (!xfs_verify_rtbno(mp, irec->br_startblock))
+ return __this_address;
+ if (!xfs_verify_rtbno(mp, endfsb))
+diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
+index 259549698ba7e..f22acfd53850b 100644
+--- a/fs/xfs/xfs_file.c
++++ b/fs/xfs/xfs_file.c
+@@ -1095,6 +1095,14 @@ __xfs_filemap_fault(
+ return ret;
+ }
+
++static inline bool
++xfs_is_write_fault(
++ struct vm_fault *vmf)
++{
++ return (vmf->flags & FAULT_FLAG_WRITE) &&
++ (vmf->vma->vm_flags & VM_SHARED);
++}
++
+ static vm_fault_t
+ xfs_filemap_fault(
+ struct vm_fault *vmf)
+@@ -1102,7 +1110,7 @@ xfs_filemap_fault(
+ /* DAX can shortcut the normal fault path on write faults! */
+ return __xfs_filemap_fault(vmf, PE_SIZE_PTE,
+ IS_DAX(file_inode(vmf->vma->vm_file)) &&
+- (vmf->flags & FAULT_FLAG_WRITE));
++ xfs_is_write_fault(vmf));
+ }
+
+ static vm_fault_t
+@@ -1115,7 +1123,7 @@ xfs_filemap_huge_fault(
+
+ /* DAX can shortcut the normal fault path on write faults! */
+ return __xfs_filemap_fault(vmf, pe_size,
+- (vmf->flags & FAULT_FLAG_WRITE));
++ xfs_is_write_fault(vmf));
+ }
+
+ static vm_fault_t
+diff --git a/include/linux/bvec.h b/include/linux/bvec.h
+index fe7a22dd133b5..bc1f16e9f3f4d 100644
+--- a/include/linux/bvec.h
++++ b/include/linux/bvec.h
+@@ -119,11 +119,18 @@ static inline bool bvec_iter_rewind(const struct bio_vec *bv,
+ return true;
+ }
+
++static inline void bvec_iter_skip_zero_bvec(struct bvec_iter *iter)
++{
++ iter->bi_bvec_done = 0;
++ iter->bi_idx++;
++}
++
+ #define for_each_bvec(bvl, bio_vec, iter, start) \
+ for (iter = (start); \
+ (iter).bi_size && \
+ ((bvl = bvec_iter_bvec((bio_vec), (iter))), 1); \
+- bvec_iter_advance((bio_vec), &(iter), (bvl).bv_len))
++ (bvl).bv_len ? (void)bvec_iter_advance((bio_vec), &(iter), \
++ (bvl).bv_len) : bvec_iter_skip_zero_bvec(&(iter)))
+
+ /* for iterating one bio from start to end */
+ #define BVEC_ITER_ALL_INIT (struct bvec_iter) \
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 8506637f070d1..a46b6832b3733 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -956,34 +956,49 @@ static inline void hid_device_io_stop(struct hid_device *hid) {
+ * @max: maximal valid usage->code to consider later (out parameter)
+ * @type: input event type (EV_KEY, EV_REL, ...)
+ * @c: code which corresponds to this usage and type
++ *
++ * The value pointed to by @bit will be set to NULL if either @type is
++ * an unhandled event type, or if @c is out of range for @type. This
++ * can be used as an error condition.
+ */
+ static inline void hid_map_usage(struct hid_input *hidinput,
+ struct hid_usage *usage, unsigned long **bit, int *max,
+- __u8 type, __u16 c)
++ __u8 type, unsigned int c)
+ {
+ struct input_dev *input = hidinput->input;
+-
+- usage->type = type;
+- usage->code = c;
++ unsigned long *bmap = NULL;
++ unsigned int limit = 0;
+
+ switch (type) {
+ case EV_ABS:
+- *bit = input->absbit;
+- *max = ABS_MAX;
++ bmap = input->absbit;
++ limit = ABS_MAX;
+ break;
+ case EV_REL:
+- *bit = input->relbit;
+- *max = REL_MAX;
++ bmap = input->relbit;
++ limit = REL_MAX;
+ break;
+ case EV_KEY:
+- *bit = input->keybit;
+- *max = KEY_MAX;
++ bmap = input->keybit;
++ limit = KEY_MAX;
+ break;
+ case EV_LED:
+- *bit = input->ledbit;
+- *max = LED_MAX;
++ bmap = input->ledbit;
++ limit = LED_MAX;
+ break;
+ }
++
++ if (unlikely(c > limit || !bmap)) {
++ pr_warn_ratelimited("%s: Invalid code %d type %d\n",
++ input->name, c, type);
++ *bit = NULL;
++ return;
++ }
++
++ usage->type = type;
++ usage->code = c;
++ *max = limit;
++ *bit = bmap;
+ }
+
+ /**
+@@ -997,7 +1012,8 @@ static inline void hid_map_usage_clear(struct hid_input *hidinput,
+ __u8 type, __u16 c)
+ {
+ hid_map_usage(hidinput, usage, bit, max, type, c);
+- clear_bit(c, *bit);
++ if (*bit)
++ clear_bit(usage->code, *bit);
+ }
+
+ /**
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index ed1453c15041d..afc1d72161ba5 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -439,6 +439,7 @@ enum {
+ ATA_HORKAGE_NO_DMA_LOG = (1 << 23), /* don't use DMA for log read */
+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
+ ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */
++ ATA_HORKAGE_MAX_TRIM_128M = (1 << 26), /* Limit max trim size to 128M */
+
+ /* DMA mask for user DMA control: User visible values; DO NOT
+ renumber */
+diff --git a/include/linux/log2.h b/include/linux/log2.h
+index 2af7f77866d03..78496801cddf0 100644
+--- a/include/linux/log2.h
++++ b/include/linux/log2.h
+@@ -177,7 +177,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
+ #define roundup_pow_of_two(n) \
+ ( \
+ __builtin_constant_p(n) ? ( \
+- (n == 1) ? 1 : \
++ ((n) == 1) ? 1 : \
+ (1UL << (ilog2((n) - 1) + 1)) \
+ ) : \
+ __roundup_pow_of_two(n) \
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index cf09ab37b45b7..e713476ff29db 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -43,8 +43,7 @@ int nfnetlink_has_listeners(struct net *net, unsigned int group);
+ int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 portid,
+ unsigned int group, int echo, gfp_t flags);
+ int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error);
+-int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid,
+- int flags);
++int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid);
+
+ static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type)
+ {
+diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
+index d55b68b113de1..db9b0dd0a7a3b 100644
+--- a/include/linux/uaccess.h
++++ b/include/linux/uaccess.h
+@@ -242,6 +242,17 @@ static inline unsigned long __copy_from_user_inatomic_nocache(void *to,
+ extern long probe_kernel_read(void *dst, const void *src, size_t size);
+ extern long __probe_kernel_read(void *dst, const void *src, size_t size);
+
++/*
++ * probe_user_read(): safely attempt to read from a location in user space
++ * @dst: pointer to the buffer that shall take the data
++ * @src: address to read from
++ * @size: size of the data chunk
++ *
++ * Safely read from address @src to the buffer at @dst. If a kernel fault
++ * happens, handle that and return -EFAULT.
++ */
++extern long probe_user_read(void *dst, const void __user *src, size_t size);
++
+ /*
+ * probe_kernel_write(): safely attempt to write to a location
+ * @dst: address to write to
+@@ -254,7 +265,22 @@ extern long __probe_kernel_read(void *dst, const void *src, size_t size);
+ extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);
+ extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size);
+
++/*
++ * probe_user_write(): safely attempt to write to a location in user space
++ * @dst: address to write to
++ * @src: pointer to the data that shall be written
++ * @size: size of the data chunk
++ *
++ * Safely write to address @dst from the buffer at @src. If a kernel fault
++ * happens, handle that and return -EFAULT.
++ */
++extern long notrace probe_user_write(void __user *dst, const void *src, size_t size);
++extern long notrace __probe_user_write(void __user *dst, const void *src, size_t size);
++
+ extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count);
++extern long strncpy_from_unsafe_user(char *dst, const void __user *unsafe_addr,
++ long count);
++extern long strnlen_unsafe_user(const void __user *unsafe_addr, long count);
+
+ /**
+ * probe_kernel_address(): safely attempt to read from a location
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 024636c31adcf..93253ba1eeac3 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -130,6 +130,8 @@ static inline u8 nft_reg_load8(u32 *sreg)
+ static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
+ unsigned int len)
+ {
++ if (len % NFT_REG32_SIZE)
++ dst[len / NFT_REG32_SIZE] = 0;
+ memcpy(dst, src, len);
+ }
+
+diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
+index 5eac62e1b68d5..cc00be102b9fb 100644
+--- a/include/uapi/linux/netfilter/nf_tables.h
++++ b/include/uapi/linux/netfilter/nf_tables.h
+@@ -132,7 +132,7 @@ enum nf_tables_msg_types {
+ * @NFTA_LIST_ELEM: list element (NLA_NESTED)
+ */
+ enum nft_list_attributes {
+- NFTA_LIST_UNPEC,
++ NFTA_LIST_UNSPEC,
+ NFTA_LIST_ELEM,
+ __NFTA_LIST_MAX
+ };
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 8a5708f31aa07..27e49c5ec2194 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2918,6 +2918,22 @@ static unsigned int cpuset_mems_nr(unsigned int *array)
+ }
+
+ #ifdef CONFIG_SYSCTL
++static int proc_hugetlb_doulongvec_minmax(struct ctl_table *table, int write,
++ void *buffer, size_t *length,
++ loff_t *ppos, unsigned long *out)
++{
++ struct ctl_table dup_table;
++
++ /*
++ * In order to avoid races with __do_proc_doulongvec_minmax(), we
++ * can duplicate the @table and alter the duplicate of it.
++ */
++ dup_table = *table;
++ dup_table.data = out;
++
++ return proc_doulongvec_minmax(&dup_table, write, buffer, length, ppos);
++}
++
+ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
+ struct ctl_table *table, int write,
+ void __user *buffer, size_t *length, loff_t *ppos)
+@@ -2929,9 +2945,8 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
+ if (!hugepages_supported())
+ return -EOPNOTSUPP;
+
+- table->data = &tmp;
+- table->maxlen = sizeof(unsigned long);
+- ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
++ ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos,
++ &tmp);
+ if (ret)
+ goto out;
+
+@@ -2975,9 +2990,8 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write,
+ if (write && hstate_is_gigantic(h))
+ return -EINVAL;
+
+- table->data = &tmp;
+- table->maxlen = sizeof(unsigned long);
+- ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
++ ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos,
++ &tmp);
+ if (ret)
+ goto out;
+
+diff --git a/mm/maccess.c b/mm/maccess.c
+index ec00be51a24fd..6e41ba452e5e9 100644
+--- a/mm/maccess.c
++++ b/mm/maccess.c
+@@ -5,8 +5,32 @@
+ #include <linux/mm.h>
+ #include <linux/uaccess.h>
+
++static __always_inline long
++probe_read_common(void *dst, const void __user *src, size_t size)
++{
++ long ret;
++
++ pagefault_disable();
++ ret = __copy_from_user_inatomic(dst, src, size);
++ pagefault_enable();
++
++ return ret ? -EFAULT : 0;
++}
++
++static __always_inline long
++probe_write_common(void __user *dst, const void *src, size_t size)
++{
++ long ret;
++
++ pagefault_disable();
++ ret = __copy_to_user_inatomic(dst, src, size);
++ pagefault_enable();
++
++ return ret ? -EFAULT : 0;
++}
++
+ /**
+- * probe_kernel_read(): safely attempt to read from a location
++ * probe_kernel_read(): safely attempt to read from a kernel-space location
+ * @dst: pointer to the buffer that shall take the data
+ * @src: address to read from
+ * @size: size of the data chunk
+@@ -29,16 +53,40 @@ long __probe_kernel_read(void *dst, const void *src, size_t size)
+ mm_segment_t old_fs = get_fs();
+
+ set_fs(KERNEL_DS);
+- pagefault_disable();
+- ret = __copy_from_user_inatomic(dst,
+- (__force const void __user *)src, size);
+- pagefault_enable();
++ ret = probe_read_common(dst, (__force const void __user *)src, size);
+ set_fs(old_fs);
+
+- return ret ? -EFAULT : 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(probe_kernel_read);
+
++/**
++ * probe_user_read(): safely attempt to read from a user-space location
++ * @dst: pointer to the buffer that shall take the data
++ * @src: address to read from. This must be a user address.
++ * @size: size of the data chunk
++ *
++ * Safely read from user address @src to the buffer at @dst. If a kernel fault
++ * happens, handle that and return -EFAULT.
++ */
++
++long __weak probe_user_read(void *dst, const void __user *src, size_t size)
++ __attribute__((alias("__probe_user_read")));
++
++long __probe_user_read(void *dst, const void __user *src, size_t size)
++{
++ long ret = -EFAULT;
++ mm_segment_t old_fs = get_fs();
++
++ set_fs(USER_DS);
++ if (access_ok(VERIFY_READ, src, size))
++ ret = probe_read_common(dst, src, size);
++ set_fs(old_fs);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(probe_user_read);
++
+ /**
+ * probe_kernel_write(): safely attempt to write to a location
+ * @dst: address to write to
+@@ -48,6 +96,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
+ * Safely write to address @dst from the buffer at @src. If a kernel fault
+ * happens, handle that and return -EFAULT.
+ */
++
+ long __weak probe_kernel_write(void *dst, const void *src, size_t size)
+ __attribute__((alias("__probe_kernel_write")));
+
+@@ -57,15 +106,40 @@ long __probe_kernel_write(void *dst, const void *src, size_t size)
+ mm_segment_t old_fs = get_fs();
+
+ set_fs(KERNEL_DS);
+- pagefault_disable();
+- ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
+- pagefault_enable();
++ ret = probe_write_common((__force void __user *)dst, src, size);
+ set_fs(old_fs);
+
+- return ret ? -EFAULT : 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(probe_kernel_write);
+
++/**
++ * probe_user_write(): safely attempt to write to a user-space location
++ * @dst: address to write to
++ * @src: pointer to the data that shall be written
++ * @size: size of the data chunk
++ *
++ * Safely write to address @dst from the buffer at @src. If a kernel fault
++ * happens, handle that and return -EFAULT.
++ */
++
++long __weak probe_user_write(void __user *dst, const void *src, size_t size)
++ __attribute__((alias("__probe_user_write")));
++
++long __probe_user_write(void __user *dst, const void *src, size_t size)
++{
++ long ret = -EFAULT;
++ mm_segment_t old_fs = get_fs();
++
++ set_fs(USER_DS);
++ if (access_ok(VERIFY_WRITE, dst, size))
++ ret = probe_write_common(dst, src, size);
++ set_fs(old_fs);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(probe_user_write);
++
+ /**
+ * strncpy_from_unsafe: - Copy a NUL terminated string from unsafe address.
+ * @dst: Destination address, in kernel space. This buffer must be at
+@@ -105,3 +179,76 @@ long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count)
+
+ return ret ? -EFAULT : src - unsafe_addr;
+ }
++
++/**
++ * strncpy_from_unsafe_user: - Copy a NUL terminated string from unsafe user
++ * address.
++ * @dst: Destination address, in kernel space. This buffer must be at
++ * least @count bytes long.
++ * @unsafe_addr: Unsafe user address.
++ * @count: Maximum number of bytes to copy, including the trailing NUL.
++ *
++ * Copies a NUL-terminated string from unsafe user address to kernel buffer.
++ *
++ * On success, returns the length of the string INCLUDING the trailing NUL.
++ *
++ * If access fails, returns -EFAULT (some data may have been copied
++ * and the trailing NUL added).
++ *
++ * If @count is smaller than the length of the string, copies @count-1 bytes,
++ * sets the last byte of @dst buffer to NUL and returns @count.
++ */
++long strncpy_from_unsafe_user(char *dst, const void __user *unsafe_addr,
++ long count)
++{
++ mm_segment_t old_fs = get_fs();
++ long ret;
++
++ if (unlikely(count <= 0))
++ return 0;
++
++ set_fs(USER_DS);
++ pagefault_disable();
++ ret = strncpy_from_user(dst, unsafe_addr, count);
++ pagefault_enable();
++ set_fs(old_fs);
++
++ if (ret >= count) {
++ ret = count;
++ dst[ret - 1] = '\0';
++ } else if (ret > 0) {
++ ret++;
++ }
++
++ return ret;
++}
++
++/**
++ * strnlen_unsafe_user: - Get the size of a user string INCLUDING final NUL.
++ * @unsafe_addr: The string to measure.
++ * @count: Maximum count (including NUL)
++ *
++ * Get the size of a NUL-terminated string in user space without pagefault.
++ *
++ * Returns the size of the string INCLUDING the terminating NUL.
++ *
++ * If the string is too long, returns a number larger than @count. User
++ * has to check the return value against "> count".
++ * On exception (or invalid count), returns 0.
++ *
++ * Unlike strnlen_user, this can be used from IRQ handler etc. because
++ * it disables pagefaults.
++ */
++long strnlen_unsafe_user(const void __user *unsafe_addr, long count)
++{
++ mm_segment_t old_fs = get_fs();
++ int ret;
++
++ set_fs(USER_DS);
++ pagefault_disable();
++ ret = strnlen_user(unsafe_addr, count);
++ pagefault_enable();
++ set_fs(old_fs);
++
++ return ret;
++}
+diff --git a/mm/slub.c b/mm/slub.c
+index 882a1e0ae89c8..dfc9b4267603e 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -646,12 +646,12 @@ static void slab_fix(struct kmem_cache *s, char *fmt, ...)
+ }
+
+ static bool freelist_corrupted(struct kmem_cache *s, struct page *page,
+- void *freelist, void *nextfree)
++ void **freelist, void *nextfree)
+ {
+ if ((s->flags & SLAB_CONSISTENCY_CHECKS) &&
+- !check_valid_pointer(s, page, nextfree)) {
+- object_err(s, page, freelist, "Freechain corrupt");
+- freelist = NULL;
++ !check_valid_pointer(s, page, nextfree) && freelist) {
++ object_err(s, page, *freelist, "Freechain corrupt");
++ *freelist = NULL;
+ slab_fix(s, "Isolate corrupted freechain");
+ return true;
+ }
+@@ -1343,7 +1343,7 @@ static inline void dec_slabs_node(struct kmem_cache *s, int node,
+ int objects) {}
+
+ static bool freelist_corrupted(struct kmem_cache *s, struct page *page,
+- void *freelist, void *nextfree)
++ void **freelist, void *nextfree)
+ {
+ return false;
+ }
+@@ -2037,7 +2037,7 @@ static void deactivate_slab(struct kmem_cache *s, struct page *page,
+ * 'freelist' is already corrupted. So isolate all objects
+ * starting at 'freelist'.
+ */
+- if (freelist_corrupted(s, page, freelist, nextfree))
++ if (freelist_corrupted(s, page, &freelist, nextfree))
+ break;
+
+ do {
+diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
+index 0458de53cb64b..04a620fd13014 100644
+--- a/net/batman-adv/bat_v_ogm.c
++++ b/net/batman-adv/bat_v_ogm.c
+@@ -716,6 +716,12 @@ static void batadv_v_ogm_process(const struct sk_buff *skb, int ogm_offset,
+ ntohl(ogm_packet->seqno), ogm_throughput, ogm_packet->ttl,
+ ogm_packet->version, ntohs(ogm_packet->tvlv_len));
+
++ if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) {
++ batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
++ "Drop packet: originator packet from ourself\n");
++ return;
++ }
++
+ /* If the throughput metric is 0, immediately drop the packet. No need
+ * to create orig_node / neigh_node for an unusable route.
+ */
+@@ -843,11 +849,6 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb,
+ if (batadv_is_my_mac(bat_priv, ethhdr->h_source))
+ goto free_skb;
+
+- ogm_packet = (struct batadv_ogm2_packet *)skb->data;
+-
+- if (batadv_is_my_mac(bat_priv, ogm_packet->orig))
+- goto free_skb;
+-
+ batadv_inc_counter(bat_priv, BATADV_CNT_MGMT_RX);
+ batadv_add_counter(bat_priv, BATADV_CNT_MGMT_RX_BYTES,
+ skb->len + ETH_HLEN);
+diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
+index 85faf25c29122..9b8bf06ccb613 100644
+--- a/net/batman-adv/bridge_loop_avoidance.c
++++ b/net/batman-adv/bridge_loop_avoidance.c
+@@ -450,7 +450,10 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, u8 *mac,
+ batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
+ skb->len + ETH_HLEN);
+
+- netif_rx(skb);
++ if (in_interrupt())
++ netif_rx(skb);
++ else
++ netif_rx_ni(skb);
+ out:
+ if (primary_if)
+ batadv_hardif_put(primary_if);
+diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
+index 140c61a3f1ecf..0c59fefc13719 100644
+--- a/net/batman-adv/gateway_client.c
++++ b/net/batman-adv/gateway_client.c
+@@ -714,8 +714,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len,
+
+ chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET;
+ /* store the client address if the message is going to a client */
+- if (ret == BATADV_DHCP_TO_CLIENT &&
+- pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) {
++ if (ret == BATADV_DHCP_TO_CLIENT) {
++ if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN))
++ return BATADV_DHCP_NO;
++
+ /* check if the DHCP packet carries an Ethernet DHCP */
+ p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET;
+ if (*p != BATADV_DHCP_HTYPE_ETHERNET)
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 1b8a53081632f..5b4632826dc66 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -718,11 +718,11 @@ static int nf_tables_gettable(struct net *net, struct sock *nlsk,
+ nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
+ family, table);
+ if (err < 0)
+- goto err;
++ goto err_fill_table_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
+
+-err:
++err_fill_table_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -1383,11 +1383,11 @@ static int nf_tables_getchain(struct net *net, struct sock *nlsk,
+ nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
+ family, table, chain);
+ if (err < 0)
+- goto err;
++ goto err_fill_chain_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
+
+-err:
++err_fill_chain_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -2488,11 +2488,11 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk,
+ nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
+ family, table, chain, rule);
+ if (err < 0)
+- goto err;
++ goto err_fill_rule_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
+
+-err:
++err_fill_rule_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -3204,7 +3204,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
+ goto nla_put_failure;
+ }
+
+- if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
++ if (set->udata &&
++ nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
+ goto nla_put_failure;
+
+ desc = nla_nest_start(skb, NFTA_SET_DESC);
+@@ -3376,11 +3377,11 @@ static int nf_tables_getset(struct net *net, struct sock *nlsk,
+
+ err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
+ if (err < 0)
+- goto err;
++ goto err_fill_set_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
+
+-err:
++err_fill_set_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -4156,24 +4157,18 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ err = -ENOMEM;
+ skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
+ if (skb == NULL)
+- goto err1;
++ return err;
+
+ err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
+ NFT_MSG_NEWSETELEM, 0, set, &elem);
+ if (err < 0)
+- goto err2;
++ goto err_fill_setelem;
+
+- err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
+- /* This avoids a loop in nfnetlink. */
+- if (err < 0)
+- goto err1;
++ return nfnetlink_unicast(skb, ctx->net, ctx->portid);
+
+- return 0;
+-err2:
++err_fill_setelem:
+ kfree_skb(skb);
+-err1:
+- /* this avoids a loop in nfnetlink. */
+- return err == -EAGAIN ? -ENOBUFS : err;
++ return err;
+ }
+
+ /* called with rcu_read_lock held */
+@@ -5272,10 +5267,11 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk,
+ nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
+ family, table, obj, reset);
+ if (err < 0)
+- goto err;
++ goto err_fill_obj_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
+-err:
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
++
++err_fill_obj_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -5932,10 +5928,11 @@ static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
+ NFT_MSG_NEWFLOWTABLE, 0, family,
+ flowtable);
+ if (err < 0)
+- goto err;
++ goto err_fill_flowtable_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
+-err:
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
++
++err_fill_flowtable_info:
+ kfree_skb(skb2);
+ return err;
+ }
+@@ -6096,10 +6093,11 @@ static int nf_tables_getgen(struct net *net, struct sock *nlsk,
+ err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
+ nlh->nlmsg_seq);
+ if (err < 0)
+- goto err;
++ goto err_fill_gen_info;
+
+- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
+-err:
++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
++
++err_fill_gen_info:
+ kfree_skb(skb2);
+ return err;
+ }
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index 7f2c1915763f8..9bacddc761ba4 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -148,10 +148,15 @@ int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error)
+ }
+ EXPORT_SYMBOL_GPL(nfnetlink_set_err);
+
+-int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid,
+- int flags)
++int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid)
+ {
+- return netlink_unicast(net->nfnl, skb, portid, flags);
++ int err;
++
++ err = nlmsg_unicast(net->nfnl, skb, portid);
++ if (err == -EAGAIN)
++ err = -ENOBUFS;
++
++ return err;
+ }
+ EXPORT_SYMBOL_GPL(nfnetlink_unicast);
+
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index 332c69d27b478..25298b3eb8546 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -359,8 +359,7 @@ __nfulnl_send(struct nfulnl_instance *inst)
+ goto out;
+ }
+ }
+- nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid,
+- MSG_DONTWAIT);
++ nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid);
+ out:
+ inst->qlen = 0;
+ inst->skb = NULL;
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index d33094f4ec41e..f81a3ce0fe48e 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -685,7 +685,7 @@ __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue,
+ *packet_id_ptr = htonl(entry->id);
+
+ /* nfnetlink_unicast will either free the nskb or add it to a socket */
+- err = nfnetlink_unicast(nskb, net, queue->peer_portid, MSG_DONTWAIT);
++ err = nfnetlink_unicast(nskb, net, queue->peer_portid);
+ if (err < 0) {
+ if (queue->flags & NFQA_CFG_F_FAIL_OPEN) {
+ failopen = 1;
+diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
+index 19446a89a2a81..b1a9f330a51fe 100644
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -79,7 +79,9 @@ static void nft_payload_eval(const struct nft_expr *expr,
+ u32 *dest = ®s->data[priv->dreg];
+ int offset;
+
+- dest[priv->len / NFT_REG32_SIZE] = 0;
++ if (priv->len % NFT_REG32_SIZE)
++ dest[priv->len / NFT_REG32_SIZE] = 0;
++
+ switch (priv->base) {
+ case NFT_PAYLOAD_LL_HEADER:
+ if (!skb_mac_header_was_set(skb))
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 32f575857e415..935aebf150107 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2936,6 +2936,9 @@ int regulatory_hint_user(const char *alpha2,
+ if (WARN_ON(!alpha2))
+ return -EINVAL;
+
++ if (!is_world_regdom(alpha2) && !is_an_alpha2(alpha2))
++ return -EINVAL;
++
+ request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
+ if (!request)
+ return -ENOMEM;
+diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
+index 161b0224d6ae9..7eb944cbbaeab 100755
+--- a/scripts/checkpatch.pl
++++ b/scripts/checkpatch.pl
+@@ -2541,8 +2541,8 @@ sub process {
+
+ # Check if the commit log has what seems like a diff which can confuse patch
+ if ($in_commit_log && !$commit_log_has_diff &&
+- (($line =~ m@^\s+diff\b.*a/[\w/]+@ &&
+- $line =~ m@^\s+diff\b.*a/([\w/]+)\s+b/$1\b@) ||
++ (($line =~ m@^\s+diff\b.*a/([\w/]+)@ &&
++ $line =~ m@^\s+diff\b.*a/[\w/]+\s+b/$1\b@) ||
+ $line =~ m@^\s*(?:\-\-\-\s+a/|\+\+\+\s+b/)@ ||
+ $line =~ m/^\s*\@\@ \-\d+,\d+ \+\d+,\d+ \@\@/)) {
+ ERROR("DIFF_IN_COMMIT_MSG",
+diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c
+index 3788906421a73..fe27034f28460 100644
+--- a/sound/core/oss/mulaw.c
++++ b/sound/core/oss/mulaw.c
+@@ -329,8 +329,8 @@ int snd_pcm_plugin_build_mulaw(struct snd_pcm_substream *plug,
+ snd_BUG();
+ return -EINVAL;
+ }
+- if (snd_BUG_ON(!snd_pcm_format_linear(format->format)))
+- return -ENXIO;
++ if (!snd_pcm_format_linear(format->format))
++ return -EINVAL;
+
+ err = snd_pcm_plugin_build(plug, "Mu-Law<->linear conversion",
+ src_format, dst_format,
+diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c
+index ef689997d6a5b..bf53e342788e2 100644
+--- a/sound/firewire/digi00x/digi00x.c
++++ b/sound/firewire/digi00x/digi00x.c
+@@ -15,6 +15,7 @@ MODULE_LICENSE("GPL v2");
+ #define VENDOR_DIGIDESIGN 0x00a07e
+ #define MODEL_CONSOLE 0x000001
+ #define MODEL_RACK 0x000002
++#define SPEC_VERSION 0x000001
+
+ static int name_card(struct snd_dg00x *dg00x)
+ {
+@@ -185,14 +186,18 @@ static const struct ieee1394_device_id snd_dg00x_id_table[] = {
+ /* Both of 002/003 use the same ID. */
+ {
+ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_VERSION |
+ IEEE1394_MATCH_MODEL_ID,
+ .vendor_id = VENDOR_DIGIDESIGN,
++ .version = SPEC_VERSION,
+ .model_id = MODEL_CONSOLE,
+ },
+ {
+ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_VERSION |
+ IEEE1394_MATCH_MODEL_ID,
+ .vendor_id = VENDOR_DIGIDESIGN,
++ .version = SPEC_VERSION,
+ .model_id = MODEL_RACK,
+ },
+ {}
+diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c
+index cd27b55366544..675b812e96d63 100644
+--- a/sound/pci/ca0106/ca0106_main.c
++++ b/sound/pci/ca0106/ca0106_main.c
+@@ -551,7 +551,8 @@ static int snd_ca0106_pcm_power_dac(struct snd_ca0106 *chip, int channel_id,
+ else
+ /* Power down */
+ chip->spi_dac_reg[reg] |= bit;
+- return snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]);
++ if (snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]) != 0)
++ return -ENXIO;
+ }
+ return 0;
+ }
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 419d099b5582b..b8e5f2b19ff85 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2574,6 +2574,7 @@ static void i915_pin_cvt_fixup(struct hda_codec *codec,
+ hda_nid_t cvt_nid)
+ {
+ if (per_pin) {
++ haswell_verify_D0(codec, per_pin->cvt_nid, per_pin->pin_nid);
+ snd_hda_set_dev_select(codec, per_pin->pin_nid,
+ per_pin->dev_id);
+ intel_verify_pin_cvt_connect(codec, per_pin);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9c5b3d19bfa73..8092fd5617fa7 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2452,6 +2452,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
++ SND_PCI_QUIRK(0x1462, 0x9c37, "MSI X570-A PRO", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+ SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
+diff --git a/tools/include/uapi/linux/perf_event.h b/tools/include/uapi/linux/perf_event.h
+index f35eb72739c09..a45e7b4f03163 100644
+--- a/tools/include/uapi/linux/perf_event.h
++++ b/tools/include/uapi/linux/perf_event.h
+@@ -1079,7 +1079,7 @@ union perf_mem_data_src {
+
+ #define PERF_MEM_SNOOPX_FWD 0x01 /* forward */
+ /* 1 free */
+-#define PERF_MEM_SNOOPX_SHIFT 37
++#define PERF_MEM_SNOOPX_SHIFT 38
+
+ /* locked instruction */
+ #define PERF_MEM_LOCK_NA 0x01 /* not available */
+diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
+index 246dee081efda..edf2be251788f 100644
+--- a/tools/perf/Documentation/perf-record.txt
++++ b/tools/perf/Documentation/perf-record.txt
+@@ -33,6 +33,10 @@ OPTIONS
+ - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a
+ hexadecimal event descriptor.
+
++ - a symbolic or raw PMU event followed by an optional colon
++ and a list of event modifiers, e.g., cpu-cycles:p. See the
++ linkperf:perf-list[1] man page for details on event modifiers.
++
+ - a symbolically formed PMU event like 'pmu/param1=0x3,param2/' where
+ 'param1', 'param2', etc are defined as formats for the PMU in
+ /sys/bus/event_source/devices/<pmu>/format/*.
+diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
+index b10a90b6a7181..239af8f71f79b 100644
+--- a/tools/perf/Documentation/perf-stat.txt
++++ b/tools/perf/Documentation/perf-stat.txt
+@@ -39,6 +39,10 @@ report::
+ - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a
+ hexadecimal event descriptor.
+
++ - a symbolic or raw PMU event followed by an optional colon
++ and a list of event modifiers, e.g., cpu-cycles:p. See the
++ linkperf:perf-list[1] man page for details on event modifiers.
++
+ - a symbolically formed event like 'pmu/param1=0x3,param2/' where
+ param1 and param2 are defined as formats for the PMU in
+ /sys/bus/event_source/devices/<pmu>/format/*
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index 38b5888ef7b38..c17e594041712 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -137,7 +137,7 @@ static char *fixregex(char *s)
+ return s;
+
+ /* allocate space for a new string */
+- fixed = (char *) malloc(len + 1);
++ fixed = (char *) malloc(len + esc_count + 1);
+ if (!fixed)
+ return NULL;
+
+diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
+index 9b552c0fc47db..4e202217fae10 100644
+--- a/tools/testing/selftests/bpf/test_maps.c
++++ b/tools/testing/selftests/bpf/test_maps.c
+@@ -1017,6 +1017,8 @@ static void __run_parallel(int tasks, void (*fn)(int task, void *data),
+ pid_t pid[tasks];
+ int i;
+
++ fflush(stdout);
++
+ for (i = 0; i < tasks; i++) {
+ pid[i] = fork();
+ if (pid[i] == 0) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-09-12 17:59 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-09-12 17:59 UTC (permalink / raw
To: gentoo-commits
commit: 446d5cdf7326d9bbed834b46506efb00344b685a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 12 17:59:32 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Sep 12 17:59:32 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=446d5cdf
Linux patch 4.19.145
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1144_linux-4.19.145.patch | 322 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 326 insertions(+)
diff --git a/0000_README b/0000_README
index be0a5e0..7d78220 100644
--- a/0000_README
+++ b/0000_README
@@ -615,6 +615,10 @@ Patch: 1143_linux-4.19.144.patch
From: https://www.kernel.org
Desc: Linux 4.19.144
+Patch: 1144_linux-4.19.145.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.145
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1144_linux-4.19.145.patch b/1144_linux-4.19.145.patch
new file mode 100644
index 0000000..561a2f0
--- /dev/null
+++ b/1144_linux-4.19.145.patch
@@ -0,0 +1,322 @@
+diff --git a/Makefile b/Makefile
+index ba9d0b4476e11..6bf851efcabe9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 144
++SUBLEVEL = 145
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index ea33d6abdcfc9..ce3710404544c 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -1036,6 +1036,8 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id,
+
+ q->backing_dev_info->ra_pages =
+ (VM_MAX_READAHEAD * 1024) / PAGE_SIZE;
++ q->backing_dev_info->io_pages =
++ (VM_MAX_READAHEAD * 1024) / PAGE_SIZE;
+ q->backing_dev_info->capabilities = BDI_CAP_CGROUP_WRITEBACK;
+ q->backing_dev_info->name = "block";
+ q->node = node_id;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index 701624a63d2f4..1ab40d622ae1e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -198,7 +198,7 @@ int mlx5e_attr_get(struct net_device *dev, struct switchdev_attr *attr)
+ struct mlx5_eswitch_rep *rep = rpriv->rep;
+ struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+
+- if (esw->mode == SRIOV_NONE)
++ if (esw->mode != SRIOV_OFFLOADS)
+ return -EOPNOTSUPP;
+
+ switch (attr->id) {
+diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
+index b91f92e4e5f22..915ac75b55fc7 100644
+--- a/drivers/net/usb/dm9601.c
++++ b/drivers/net/usb/dm9601.c
+@@ -625,6 +625,10 @@ static const struct usb_device_id products[] = {
+ USB_DEVICE(0x0a46, 0x1269), /* DM9621A USB to Fast Ethernet Adapter */
+ .driver_info = (unsigned long)&dm9601_info,
+ },
++ {
++ USB_DEVICE(0x0586, 0x3427), /* ZyXEL Keenetic Plus DSL xDSL modem */
++ .driver_info = (unsigned long)&dm9601_info,
++ },
+ {}, // END
+ };
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 42ba150fa18d5..c77d12a35f923 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -6196,12 +6196,13 @@ void netif_napi_add(struct net_device *dev, struct napi_struct *napi,
+ pr_err_once("netif_napi_add() called with weight %d on device %s\n",
+ weight, dev->name);
+ napi->weight = weight;
+- list_add(&napi->dev_list, &dev->napi_list);
+ napi->dev = dev;
+ #ifdef CONFIG_NETPOLL
+ napi->poll_owner = -1;
+ #endif
+ set_bit(NAPI_STATE_SCHED, &napi->state);
++ set_bit(NAPI_STATE_NPSVC, &napi->state);
++ list_add_rcu(&napi->dev_list, &dev->napi_list);
+ napi_hash_add(napi);
+ }
+ EXPORT_SYMBOL(netif_napi_add);
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index a581cf101cd9c..023ce0fbb496d 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -161,7 +161,7 @@ static void poll_napi(struct net_device *dev)
+ struct napi_struct *napi;
+ int cpu = smp_processor_id();
+
+- list_for_each_entry(napi, &dev->napi_list, dev_list) {
++ list_for_each_entry_rcu(napi, &dev->napi_list, dev_list) {
+ if (cmpxchg(&napi->poll_owner, -1, cpu) == -1) {
+ poll_one_napi(napi);
+ smp_store_release(&napi->poll_owner, -1);
+diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
+index 41d0e95d171e1..b1a1718495f34 100644
+--- a/net/netlabel/netlabel_domainhash.c
++++ b/net/netlabel/netlabel_domainhash.c
+@@ -99,6 +99,7 @@ static void netlbl_domhsh_free_entry(struct rcu_head *entry)
+ kfree(netlbl_domhsh_addr6_entry(iter6));
+ }
+ #endif /* IPv6 */
++ kfree(ptr->def.addrsel);
+ }
+ kfree(ptr->domain);
+ kfree(ptr);
+@@ -550,6 +551,8 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
+ goto add_return;
+ }
+ #endif /* IPv6 */
++ /* cleanup the new entry since we've moved everything over */
++ netlbl_domhsh_free_entry(&entry->rcu);
+ } else
+ ret_val = -EINVAL;
+
+@@ -593,6 +596,12 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
+ {
+ int ret_val = 0;
+ struct audit_buffer *audit_buf;
++ struct netlbl_af4list *iter4;
++ struct netlbl_domaddr4_map *map4;
++#if IS_ENABLED(CONFIG_IPV6)
++ struct netlbl_af6list *iter6;
++ struct netlbl_domaddr6_map *map6;
++#endif /* IPv6 */
+
+ if (entry == NULL)
+ return -ENOENT;
+@@ -610,6 +619,9 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
+ ret_val = -ENOENT;
+ spin_unlock(&netlbl_domhsh_lock);
+
++ if (ret_val)
++ return ret_val;
++
+ audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
+ if (audit_buf != NULL) {
+ audit_log_format(audit_buf,
+@@ -619,40 +631,29 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
+ audit_log_end(audit_buf);
+ }
+
+- if (ret_val == 0) {
+- struct netlbl_af4list *iter4;
+- struct netlbl_domaddr4_map *map4;
+-#if IS_ENABLED(CONFIG_IPV6)
+- struct netlbl_af6list *iter6;
+- struct netlbl_domaddr6_map *map6;
+-#endif /* IPv6 */
+-
+- switch (entry->def.type) {
+- case NETLBL_NLTYPE_ADDRSELECT:
+- netlbl_af4list_foreach_rcu(iter4,
+- &entry->def.addrsel->list4) {
+- map4 = netlbl_domhsh_addr4_entry(iter4);
+- cipso_v4_doi_putdef(map4->def.cipso);
+- }
++ switch (entry->def.type) {
++ case NETLBL_NLTYPE_ADDRSELECT:
++ netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) {
++ map4 = netlbl_domhsh_addr4_entry(iter4);
++ cipso_v4_doi_putdef(map4->def.cipso);
++ }
+ #if IS_ENABLED(CONFIG_IPV6)
+- netlbl_af6list_foreach_rcu(iter6,
+- &entry->def.addrsel->list6) {
+- map6 = netlbl_domhsh_addr6_entry(iter6);
+- calipso_doi_putdef(map6->def.calipso);
+- }
++ netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) {
++ map6 = netlbl_domhsh_addr6_entry(iter6);
++ calipso_doi_putdef(map6->def.calipso);
++ }
+ #endif /* IPv6 */
+- break;
+- case NETLBL_NLTYPE_CIPSOV4:
+- cipso_v4_doi_putdef(entry->def.cipso);
+- break;
++ break;
++ case NETLBL_NLTYPE_CIPSOV4:
++ cipso_v4_doi_putdef(entry->def.cipso);
++ break;
+ #if IS_ENABLED(CONFIG_IPV6)
+- case NETLBL_NLTYPE_CALIPSO:
+- calipso_doi_putdef(entry->def.calipso);
+- break;
++ case NETLBL_NLTYPE_CALIPSO:
++ calipso_doi_putdef(entry->def.calipso);
++ break;
+ #endif /* IPv6 */
+- }
+- call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
+ }
++ call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
+
+ return ret_val;
+ }
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index df4a7d7c5ec04..4a2873f70b372 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -7643,8 +7643,6 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
+
+ pr_debug("%s: begins, snum:%d\n", __func__, snum);
+
+- local_bh_disable();
+-
+ if (snum == 0) {
+ /* Search for an available port. */
+ int low, high, remaining, index;
+@@ -7663,20 +7661,21 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
+ continue;
+ index = sctp_phashfn(sock_net(sk), rover);
+ head = &sctp_port_hashtable[index];
+- spin_lock(&head->lock);
++ spin_lock_bh(&head->lock);
+ sctp_for_each_hentry(pp, &head->chain)
+ if ((pp->port == rover) &&
+ net_eq(sock_net(sk), pp->net))
+ goto next;
+ break;
+ next:
+- spin_unlock(&head->lock);
++ spin_unlock_bh(&head->lock);
++ cond_resched();
+ } while (--remaining > 0);
+
+ /* Exhausted local port range during search? */
+ ret = 1;
+ if (remaining <= 0)
+- goto fail;
++ return ret;
+
+ /* OK, here is the one we will use. HEAD (the port
+ * hash table list entry) is non-NULL and we hold it's
+@@ -7691,7 +7690,7 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
+ * port iterator, pp being NULL.
+ */
+ head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
+- spin_lock(&head->lock);
++ spin_lock_bh(&head->lock);
+ sctp_for_each_hentry(pp, &head->chain) {
+ if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))
+ goto pp_found;
+@@ -7773,10 +7772,7 @@ success:
+ ret = 0;
+
+ fail_unlock:
+- spin_unlock(&head->lock);
+-
+-fail:
+- local_bh_enable();
++ spin_unlock_bh(&head->lock);
+ return ret;
+ }
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index f0184a5e83aa3..d0cf7169f08c8 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -2565,18 +2565,21 @@ static int tipc_shutdown(struct socket *sock, int how)
+ lock_sock(sk);
+
+ __tipc_shutdown(sock, TIPC_CONN_SHUTDOWN);
+- sk->sk_shutdown = SEND_SHUTDOWN;
++ if (tipc_sk_type_connectionless(sk))
++ sk->sk_shutdown = SHUTDOWN_MASK;
++ else
++ sk->sk_shutdown = SEND_SHUTDOWN;
+
+ if (sk->sk_state == TIPC_DISCONNECTING) {
+ /* Discard any unreceived messages */
+ __skb_queue_purge(&sk->sk_receive_queue);
+
+- /* Wake up anyone sleeping in poll */
+- sk->sk_state_change(sk);
+ res = 0;
+ } else {
+ res = -ENOTCONN;
+ }
++ /* Wake up anyone sleeping in poll. */
++ sk->sk_state_change(sk);
+
+ release_sock(sk);
+ return res;
+diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c
+index d3fdc463a884e..1e61cdce28952 100644
+--- a/sound/firewire/tascam/tascam.c
++++ b/sound/firewire/tascam/tascam.c
+@@ -225,11 +225,39 @@ static void snd_tscm_remove(struct fw_unit *unit)
+ }
+
+ static const struct ieee1394_device_id snd_tscm_id_table[] = {
++ // Tascam, FW-1884.
+ {
+ .match_flags = IEEE1394_MATCH_VENDOR_ID |
+- IEEE1394_MATCH_SPECIFIER_ID,
++ IEEE1394_MATCH_SPECIFIER_ID |
++ IEEE1394_MATCH_VERSION,
+ .vendor_id = 0x00022e,
+ .specifier_id = 0x00022e,
++ .version = 0x800000,
++ },
++ // Tascam, FE-8 (.version = 0x800001)
++ // This kernel module doesn't support FE-8 because the most of features
++ // can be implemented in userspace without any specific support of this
++ // module.
++ //
++ // .version = 0x800002 is unknown.
++ //
++ // Tascam, FW-1082.
++ {
++ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_SPECIFIER_ID |
++ IEEE1394_MATCH_VERSION,
++ .vendor_id = 0x00022e,
++ .specifier_id = 0x00022e,
++ .version = 0x800003,
++ },
++ // Tascam, FW-1804.
++ {
++ .match_flags = IEEE1394_MATCH_VENDOR_ID |
++ IEEE1394_MATCH_SPECIFIER_ID |
++ IEEE1394_MATCH_VERSION,
++ .vendor_id = 0x00022e,
++ .specifier_id = 0x00022e,
++ .version = 0x800004,
+ },
+ /* FE-08 requires reverse-engineering because it just has faders. */
+ {}
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-09-17 14:55 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-09-17 14:55 UTC (permalink / raw
To: gentoo-commits
commit: f0692fef2ebc8ccdee5117b2b793b72a24c01158
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 17 14:55:20 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Sep 17 14:55:20 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f0692fef
Linux patch 4.19.146
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1145_linux-4.19.146.patch | 3221 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3225 insertions(+)
diff --git a/0000_README b/0000_README
index 7d78220..4416605 100644
--- a/0000_README
+++ b/0000_README
@@ -619,6 +619,10 @@ Patch: 1144_linux-4.19.145.patch
From: https://www.kernel.org
Desc: Linux 4.19.145
+Patch: 1145_linux-4.19.146.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.146
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1145_linux-4.19.146.patch b/1145_linux-4.19.146.patch
new file mode 100644
index 0000000..6b815f5
--- /dev/null
+++ b/1145_linux-4.19.146.patch
@@ -0,0 +1,3221 @@
+diff --git a/Makefile b/Makefile
+index 6bf851efcabe9..aaeb3f3dbcea8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 145
++SUBLEVEL = 146
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
+index d131c54acd3ec..f6b6e3c9ca8aa 100644
+--- a/arch/arc/boot/dts/hsdk.dts
++++ b/arch/arc/boot/dts/hsdk.dts
+@@ -83,6 +83,8 @@
+
+ arcpct: pct {
+ compatible = "snps,archs-pct";
++ interrupt-parent = <&cpu_intc>;
++ interrupts = <20>;
+ };
+
+ /* TIMER0 with interrupt for clockevent */
+@@ -173,7 +175,7 @@
+ reg = <0x8000 0x2000>;
+ interrupts = <10>;
+ interrupt-names = "macirq";
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ snps,pbl = <32>;
+ snps,multicast-filter-bins = <256>;
+ clocks = <&gmacclk>;
+@@ -191,7 +193,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ compatible = "snps,dwmac-mdio";
+- phy0: ethernet-phy@0 {
++ phy0: ethernet-phy@0 { /* Micrel KSZ9031 */
+ reg = <0>;
+ ti,rx-internal-delay = <DP83867_RGMIIDCTL_2_00_NS>;
+ ti,tx-internal-delay = <DP83867_RGMIIDCTL_2_00_NS>;
+diff --git a/arch/arc/plat-eznps/include/plat/ctop.h b/arch/arc/plat-eznps/include/plat/ctop.h
+index 4f6a1673b3a6e..ddfca2c3357a0 100644
+--- a/arch/arc/plat-eznps/include/plat/ctop.h
++++ b/arch/arc/plat-eznps/include/plat/ctop.h
+@@ -43,7 +43,6 @@
+ #define CTOP_AUX_DPC (CTOP_AUX_BASE + 0x02C)
+ #define CTOP_AUX_LPC (CTOP_AUX_BASE + 0x030)
+ #define CTOP_AUX_EFLAGS (CTOP_AUX_BASE + 0x080)
+-#define CTOP_AUX_IACK (CTOP_AUX_BASE + 0x088)
+ #define CTOP_AUX_GPA1 (CTOP_AUX_BASE + 0x08C)
+ #define CTOP_AUX_UDMC (CTOP_AUX_BASE + 0x300)
+
+diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
+index e35398cc60a06..dd71ab08136be 100644
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -217,7 +217,7 @@
+ };
+
+ qspi: spi@27200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+ <0x11c408 0x004>,
+diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
+index 273a316045798..b395cb195db21 100644
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -274,7 +274,7 @@
+ };
+
+ qspi: spi@27200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+ <0x11c408 0x004>,
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index a678fb7c9e3b2..c91716d5980c3 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -445,7 +445,7 @@
+ };
+
+ spi@18029200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x18029200 0x184>,
+ <0x18029000 0x124>,
+ <0x1811b408 0x004>,
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+index 3e39b9a1f35d0..0093548d50ff8 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+@@ -55,6 +55,8 @@
+
+ &mcbsp2 {
+ status = "okay";
++ pinctrl-names = "default";
++ pinctrl-0 = <&mcbsp2_pins>;
+ };
+
+ &charger {
+diff --git a/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi b/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
+index 86c5644f558cb..032e8dde13817 100644
+--- a/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
+@@ -84,6 +84,8 @@
+ };
+
+ &mcbsp2 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&mcbsp2_pins>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index d18c043264440..b66b2bd1aa856 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -168,7 +168,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ reg = <0x0 0x1550000 0x0 0x10000>,
+- <0x0 0x40000000 0x0 0x40000000>;
++ <0x0 0x40000000 0x0 0x20000000>;
+ reg-names = "QuadSPI", "QuadSPI-memory";
+ interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
+ clock-names = "qspi_en", "qspi";
+diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
+index ba5657574d9bb..4b1c8bec2de35 100644
+--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
+@@ -791,7 +791,7 @@
+ timer3: timer3@ffd00100 {
+ compatible = "snps,dw-apb-timer";
+ interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>;
+- reg = <0xffd01000 0x100>;
++ reg = <0xffd00100 0x100>;
+ clocks = <&l4_sys_free_clk>;
+ clock-names = "timer";
+ };
+diff --git a/arch/arm/boot/dts/vfxxx.dtsi b/arch/arm/boot/dts/vfxxx.dtsi
+index d392794d9c139..de81e8b4afde9 100644
+--- a/arch/arm/boot/dts/vfxxx.dtsi
++++ b/arch/arm/boot/dts/vfxxx.dtsi
+@@ -532,7 +532,7 @@
+ };
+
+ ocotp: ocotp@400a5000 {
+- compatible = "fsl,vf610-ocotp";
++ compatible = "fsl,vf610-ocotp", "syscon";
+ reg = <0x400a5000 0x1000>;
+ clocks = <&clks VF610_CLK_OCOTP>;
+ };
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+index ea854f689fda8..6bfb7bbd264af 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -745,7 +745,7 @@
+ };
+
+ qspi: spi@66470200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-ns2-qspi";
++ compatible = "brcm,spi-ns2-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x66470200 0x184>,
+ <0x66470000 0x124>,
+ <0x67017408 0x004>,
+diff --git a/arch/powerpc/configs/pasemi_defconfig b/arch/powerpc/configs/pasemi_defconfig
+index 4504380c7a922..60839eeada8b7 100644
+--- a/arch/powerpc/configs/pasemi_defconfig
++++ b/arch/powerpc/configs/pasemi_defconfig
+@@ -110,7 +110,6 @@ CONFIG_FB_NVIDIA=y
+ CONFIG_FB_NVIDIA_I2C=y
+ CONFIG_FB_RADEON=y
+ # CONFIG_LCD_CLASS_DEVICE is not set
+-CONFIG_VGACON_SOFT_SCROLLBACK=y
+ CONFIG_LOGO=y
+ CONFIG_SOUND=y
+ CONFIG_SND=y
+diff --git a/arch/powerpc/configs/ppc6xx_defconfig b/arch/powerpc/configs/ppc6xx_defconfig
+index 7032d4244ec5f..e30af76f47537 100644
+--- a/arch/powerpc/configs/ppc6xx_defconfig
++++ b/arch/powerpc/configs/ppc6xx_defconfig
+@@ -779,7 +779,6 @@ CONFIG_FB_TRIDENT=m
+ CONFIG_FB_SM501=m
+ CONFIG_FB_IBM_GXT4500=y
+ CONFIG_LCD_PLATFORM=m
+-CONFIG_VGACON_SOFT_SCROLLBACK=y
+ CONFIG_FRAMEBUFFER_CONSOLE=y
+ CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+ CONFIG_LOGO=y
+diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig
+index ce75be940567e..5a23a4ccd7556 100644
+--- a/arch/x86/configs/i386_defconfig
++++ b/arch/x86/configs/i386_defconfig
+@@ -216,7 +216,6 @@ CONFIG_FB_MODE_HELPERS=y
+ CONFIG_FB_TILEBLITTING=y
+ CONFIG_FB_EFI=y
+ # CONFIG_LCD_CLASS_DEVICE is not set
+-CONFIG_VGACON_SOFT_SCROLLBACK=y
+ CONFIG_LOGO=y
+ # CONFIG_LOGO_LINUX_MONO is not set
+ # CONFIG_LOGO_LINUX_VGA16 is not set
+diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
+index 45b0f4d84d83b..dc08812929046 100644
+--- a/arch/x86/configs/x86_64_defconfig
++++ b/arch/x86/configs/x86_64_defconfig
+@@ -212,7 +212,6 @@ CONFIG_FB_MODE_HELPERS=y
+ CONFIG_FB_TILEBLITTING=y
+ CONFIG_FB_EFI=y
+ # CONFIG_LCD_CLASS_DEVICE is not set
+-CONFIG_VGACON_SOFT_SCROLLBACK=y
+ CONFIG_LOGO=y
+ # CONFIG_LOGO_LINUX_MONO is not set
+ # CONFIG_LOGO_LINUX_VGA16 is not set
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 2f823f35dee50..d6bcbce6c15cb 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10128,6 +10128,7 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
+ (exit_reason != EXIT_REASON_EXCEPTION_NMI &&
+ exit_reason != EXIT_REASON_EPT_VIOLATION &&
+ exit_reason != EXIT_REASON_PML_FULL &&
++ exit_reason != EXIT_REASON_APIC_ACCESS &&
+ exit_reason != EXIT_REASON_TASK_SWITCH)) {
+ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV;
+diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
+index 112b1001c2694..ef395b238816c 100644
+--- a/drivers/atm/firestream.c
++++ b/drivers/atm/firestream.c
+@@ -1013,6 +1013,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
+ error = make_rate (pcr, r, &tmc0, NULL);
+ if (error) {
+ kfree(tc);
++ kfree(vcc);
+ return error;
+ }
+ }
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 1101290971699..9f1265ce2e365 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -4124,6 +4124,9 @@ static ssize_t rbd_config_info_show(struct device *dev,
+ {
+ struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
+
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ return sprintf(buf, "%s\n", rbd_dev->config_info);
+ }
+
+@@ -4235,6 +4238,9 @@ static ssize_t rbd_image_refresh(struct device *dev,
+ struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
+ int ret;
+
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ ret = rbd_dev_refresh(rbd_dev);
+ if (ret)
+ return ret;
+@@ -5846,6 +5852,9 @@ static ssize_t do_rbd_add(struct bus_type *bus,
+ struct rbd_client *rbdc;
+ int rc;
+
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ if (!try_module_get(THIS_MODULE))
+ return -ENODEV;
+
+@@ -5995,6 +6004,9 @@ static ssize_t do_rbd_remove(struct bus_type *bus,
+ bool force = false;
+ int ret;
+
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ dev_id = -1;
+ opt_buf[0] = '\0';
+ sscanf(buf, "%d %5s", &dev_id, opt_buf);
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 99166000ffb77..864a7e8ebdfc3 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -712,7 +712,7 @@ static void intel_pstate_get_hwp_max(unsigned int cpu, int *phy_max,
+
+ rdmsrl_on_cpu(cpu, MSR_HWP_CAPABILITIES, &cap);
+ WRITE_ONCE(all_cpu_data[cpu]->hwp_cap_cached, cap);
+- if (global.no_turbo)
++ if (global.no_turbo || global.turbo_disabled)
+ *current_max = HWP_GUARANTEED_PERF(cap);
+ else
+ *current_max = HWP_HIGHEST_PERF(cap);
+@@ -2325,9 +2325,15 @@ static int intel_pstate_update_status(const char *buf, size_t size)
+ {
+ int ret;
+
+- if (size == 3 && !strncmp(buf, "off", size))
+- return intel_pstate_driver ?
+- intel_pstate_unregister_driver() : -EINVAL;
++ if (size == 3 && !strncmp(buf, "off", size)) {
++ if (!intel_pstate_driver)
++ return -EINVAL;
++
++ if (hwp_active)
++ return -EBUSY;
++
++ return intel_pstate_unregister_driver();
++ }
+
+ if (size == 6 && !strncmp(buf, "active", size)) {
+ if (intel_pstate_driver) {
+diff --git a/drivers/dma/acpi-dma.c b/drivers/dma/acpi-dma.c
+index 4a748c3435d7d..8d99c84361cbb 100644
+--- a/drivers/dma/acpi-dma.c
++++ b/drivers/dma/acpi-dma.c
+@@ -131,11 +131,13 @@ static void acpi_dma_parse_csrt(struct acpi_device *adev, struct acpi_dma *adma)
+ if (ret < 0) {
+ dev_warn(&adev->dev,
+ "error in parsing resource group\n");
+- return;
++ break;
+ }
+
+ grp = (struct acpi_csrt_group *)((void *)grp + grp->length);
+ }
++
++ acpi_put_table((struct acpi_table_header *)csrt);
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index 219440bebd052..72c0a2ae2dd4f 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -3566,7 +3566,8 @@ static int smu7_read_sensor(struct pp_hwmgr *hwmgr, int idx,
+ case AMDGPU_PP_SENSOR_GPU_POWER:
+ return smu7_get_gpu_power(hwmgr, (uint32_t *)value);
+ case AMDGPU_PP_SENSOR_VDDGFX:
+- if ((data->vr_config & 0xff) == 0x2)
++ if ((data->vr_config & VRCONF_VDDGFX_MASK) ==
++ (VR_SVI2_PLANE_2 << VRCONF_VDDGFX_SHIFT))
+ val_vid = PHM_READ_INDIRECT_FIELD(hwmgr->device,
+ CGS_IND_REG__SMC, PWR_SVI2_STATUS, PLANE2_VID);
+ else
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index ba6f3c14495c0..1fc9a7fa37b45 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -1518,7 +1518,8 @@ struct msm_gpu *a5xx_gpu_init(struct drm_device *dev)
+
+ check_speed_bin(&pdev->dev);
+
+- ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 4);
++ /* Restricting nr_rings to 1 to temporarily disable preemption */
++ ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1);
+ if (ret) {
+ a5xx_destroy(&(a5xx_gpu->base.base));
+ return ERR_PTR(ret);
+diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+index 79eb11cd185d1..9a5584efd5e78 100644
+--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+@@ -761,7 +761,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi,
+ regmap_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(0),
+ sun6i_dsi_dcs_build_pkt_hdr(dsi, msg));
+
+- bounce = kzalloc(msg->tx_len + sizeof(crc), GFP_KERNEL);
++ bounce = kzalloc(ALIGN(msg->tx_len + sizeof(crc), 4), GFP_KERNEL);
+ if (!bounce)
+ return -ENOMEM;
+
+@@ -772,7 +772,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi,
+ memcpy((u8 *)bounce + msg->tx_len, &crc, sizeof(crc));
+ len += sizeof(crc);
+
+- regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, len);
++ regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, DIV_ROUND_UP(len, 4));
+ regmap_write(dsi->regs, SUN6I_DSI_CMD_CTL_REG, len + 4 - 1);
+ kfree(bounce);
+
+diff --git a/drivers/gpu/drm/tve200/tve200_display.c b/drivers/gpu/drm/tve200/tve200_display.c
+index e8723a2412a6f..c0b113ba329c2 100644
+--- a/drivers/gpu/drm/tve200/tve200_display.c
++++ b/drivers/gpu/drm/tve200/tve200_display.c
+@@ -17,6 +17,7 @@
+ #include <linux/version.h>
+ #include <linux/dma-buf.h>
+ #include <linux/of_graph.h>
++#include <linux/delay.h>
+
+ #include <drm/drmP.h>
+ #include <drm/drm_panel.h>
+@@ -132,9 +133,25 @@ static void tve200_display_enable(struct drm_simple_display_pipe *pipe,
+ struct drm_connector *connector = priv->connector;
+ u32 format = fb->format->format;
+ u32 ctrl1 = 0;
++ int retries;
+
+ clk_prepare_enable(priv->clk);
+
++ /* Reset the TVE200 and wait for it to come back online */
++ writel(TVE200_CTRL_4_RESET, priv->regs + TVE200_CTRL_4);
++ for (retries = 0; retries < 5; retries++) {
++ usleep_range(30000, 50000);
++ if (readl(priv->regs + TVE200_CTRL_4) & TVE200_CTRL_4_RESET)
++ continue;
++ else
++ break;
++ }
++ if (retries == 5 &&
++ readl(priv->regs + TVE200_CTRL_4) & TVE200_CTRL_4_RESET) {
++ dev_err(drm->dev, "can't get hardware out of reset\n");
++ return;
++ }
++
+ /* Function 1 */
+ ctrl1 |= TVE200_CTRL_CSMODE;
+ /* Interlace mode for CCIR656: parameterize? */
+@@ -231,8 +248,9 @@ static void tve200_display_disable(struct drm_simple_display_pipe *pipe)
+
+ drm_crtc_vblank_off(crtc);
+
+- /* Disable and Power Down */
++ /* Disable put into reset and Power Down */
+ writel(0, priv->regs + TVE200_CTRL);
++ writel(TVE200_CTRL_4_RESET, priv->regs + TVE200_CTRL_4);
+
+ clk_disable_unprepare(priv->clk);
+ }
+@@ -280,6 +298,8 @@ static int tve200_display_enable_vblank(struct drm_simple_display_pipe *pipe)
+ struct drm_device *drm = crtc->dev;
+ struct tve200_drm_dev_private *priv = drm->dev_private;
+
++ /* Clear any IRQs and enable */
++ writel(0xFF, priv->regs + TVE200_INT_CLR);
+ writel(TVE200_INT_V_STATUS, priv->regs + TVE200_INT_EN);
+ return 0;
+ }
+diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c
+index 07e26c3567eb9..6346282e0ff05 100644
+--- a/drivers/hid/hid-elan.c
++++ b/drivers/hid/hid-elan.c
+@@ -192,6 +192,7 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER);
+ if (ret) {
+ hid_err(hdev, "Failed to init elan MT slots: %d\n", ret);
++ input_free_device(input);
+ return ret;
+ }
+
+@@ -202,6 +203,7 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ if (ret) {
+ hid_err(hdev, "Failed to register elan input device: %d\n",
+ ret);
++ input_mt_destroy_slots(input);
+ input_free_device(input);
+ return ret;
+ }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 2c100b73d3fc1..e18d796d985f8 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -985,6 +985,8 @@
+ #define USB_DEVICE_ID_SAITEK_RAT9 0x0cfa
+ #define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0
+ #define USB_DEVICE_ID_SAITEK_X52 0x075c
++#define USB_DEVICE_ID_SAITEK_X52_2 0x0255
++#define USB_DEVICE_ID_SAITEK_X52_PRO 0x0762
+
+ #define USB_VENDOR_ID_SAMSUNG 0x0419
+ #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 62f87f8bd9720..2d8d20a7f4574 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -147,6 +147,8 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_2), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_PRO), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
+diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
+index cb8c98a440109..e029d4b0f7afd 100644
+--- a/drivers/iio/accel/bmc150-accel-core.c
++++ b/drivers/iio/accel/bmc150-accel-core.c
+@@ -197,6 +197,14 @@ struct bmc150_accel_data {
+ struct mutex mutex;
+ u8 fifo_mode, watermark;
+ s16 buffer[8];
++ /*
++ * Ensure there is sufficient space and correct alignment for
++ * the timestamp if enabled
++ */
++ struct {
++ __le16 channels[3];
++ s64 ts __aligned(8);
++ } scan;
+ u8 bw_bits;
+ u32 slope_dur;
+ u32 slope_thres;
+@@ -915,15 +923,16 @@ static int __bmc150_accel_fifo_flush(struct iio_dev *indio_dev,
+ * now.
+ */
+ for (i = 0; i < count; i++) {
+- u16 sample[8];
+ int j, bit;
+
+ j = 0;
+ for_each_set_bit(bit, indio_dev->active_scan_mask,
+ indio_dev->masklength)
+- memcpy(&sample[j++], &buffer[i * 3 + bit], 2);
++ memcpy(&data->scan.channels[j++], &buffer[i * 3 + bit],
++ sizeof(data->scan.channels[0]));
+
+- iio_push_to_buffers_with_timestamp(indio_dev, sample, tstamp);
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
++ tstamp);
+
+ tstamp += sample_period;
+ }
+diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
+index 0c0df4fce4206..f74cb2e082a67 100644
+--- a/drivers/iio/accel/kxsd9.c
++++ b/drivers/iio/accel/kxsd9.c
+@@ -212,14 +212,20 @@ static irqreturn_t kxsd9_trigger_handler(int irq, void *p)
+ const struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct kxsd9_state *st = iio_priv(indio_dev);
++ /*
++ * Ensure correct positioning and alignment of timestamp.
++ * No need to zero initialize as all elements written.
++ */
++ struct {
++ __be16 chan[4];
++ s64 ts __aligned(8);
++ } hw_values;
+ int ret;
+- /* 4 * 16bit values AND timestamp */
+- __be16 hw_values[8];
+
+ ret = regmap_bulk_read(st->map,
+ KXSD9_REG_X,
+- &hw_values,
+- 8);
++ hw_values.chan,
++ sizeof(hw_values.chan));
+ if (ret) {
+ dev_err(st->dev,
+ "error reading data\n");
+@@ -227,7 +233,7 @@ static irqreturn_t kxsd9_trigger_handler(int irq, void *p)
+ }
+
+ iio_push_to_buffers_with_timestamp(indio_dev,
+- hw_values,
++ &hw_values,
+ iio_get_time_ns(indio_dev));
+ iio_trigger_notify_done(indio_dev->trig);
+
+diff --git a/drivers/iio/accel/mma7455_core.c b/drivers/iio/accel/mma7455_core.c
+index da0ceaac46b53..a3b5d5780bc8f 100644
+--- a/drivers/iio/accel/mma7455_core.c
++++ b/drivers/iio/accel/mma7455_core.c
+@@ -55,6 +55,14 @@
+
+ struct mma7455_data {
+ struct regmap *regmap;
++ /*
++ * Used to reorganize data. Will ensure correct alignment of
++ * the timestamp if present
++ */
++ struct {
++ __le16 channels[3];
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ static int mma7455_drdy(struct mma7455_data *mma7455)
+@@ -85,19 +93,19 @@ static irqreturn_t mma7455_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct mma7455_data *mma7455 = iio_priv(indio_dev);
+- u8 buf[16]; /* 3 x 16-bit channels + padding + ts */
+ int ret;
+
+ ret = mma7455_drdy(mma7455);
+ if (ret)
+ goto done;
+
+- ret = regmap_bulk_read(mma7455->regmap, MMA7455_REG_XOUTL, buf,
+- sizeof(__le16) * 3);
++ ret = regmap_bulk_read(mma7455->regmap, MMA7455_REG_XOUTL,
++ mma7455->scan.channels,
++ sizeof(mma7455->scan.channels));
+ if (ret)
+ goto done;
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buf,
++ iio_push_to_buffers_with_timestamp(indio_dev, &mma7455->scan,
+ iio_get_time_ns(indio_dev));
+
+ done:
+diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
+index fcfec758fec63..15c254b4745cc 100644
+--- a/drivers/iio/accel/mma8452.c
++++ b/drivers/iio/accel/mma8452.c
+@@ -107,6 +107,12 @@ struct mma8452_data {
+ u8 data_cfg;
+ const struct mma_chip_info *chip_info;
+ int sleep_val;
++
++ /* Ensure correct alignment of time stamp when present */
++ struct {
++ __be16 channels[3];
++ s64 ts __aligned(8);
++ } buffer;
+ };
+
+ /**
+@@ -1088,14 +1094,13 @@ static irqreturn_t mma8452_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct mma8452_data *data = iio_priv(indio_dev);
+- u8 buffer[16]; /* 3 16-bit channels + padding + ts */
+ int ret;
+
+- ret = mma8452_read(data, (__be16 *)buffer);
++ ret = mma8452_read(data, data->buffer.channels);
+ if (ret < 0)
+ goto done;
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
+ iio_get_time_ns(indio_dev));
+
+ done:
+diff --git a/drivers/iio/adc/ina2xx-adc.c b/drivers/iio/adc/ina2xx-adc.c
+index d1239624187da..1ab106b3d3a6b 100644
+--- a/drivers/iio/adc/ina2xx-adc.c
++++ b/drivers/iio/adc/ina2xx-adc.c
+@@ -146,6 +146,11 @@ struct ina2xx_chip_info {
+ int range_vbus; /* Bus voltage maximum in V */
+ int pga_gain_vshunt; /* Shunt voltage PGA gain */
+ bool allow_async_readout;
++ /* data buffer needs space for channel data and timestamp */
++ struct {
++ u16 chan[4];
++ u64 ts __aligned(8);
++ } scan;
+ };
+
+ static const struct ina2xx_config ina2xx_config[] = {
+@@ -736,8 +741,6 @@ static int ina2xx_conversion_ready(struct iio_dev *indio_dev)
+ static int ina2xx_work_buffer(struct iio_dev *indio_dev)
+ {
+ struct ina2xx_chip_info *chip = iio_priv(indio_dev);
+- /* data buffer needs space for channel data and timestap */
+- unsigned short data[4 + sizeof(s64)/sizeof(short)];
+ int bit, ret, i = 0;
+ s64 time;
+
+@@ -756,10 +759,10 @@ static int ina2xx_work_buffer(struct iio_dev *indio_dev)
+ if (ret < 0)
+ return ret;
+
+- data[i++] = val;
++ chip->scan.chan[i++] = val;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data, time);
++ iio_push_to_buffers_with_timestamp(indio_dev, &chip->scan, time);
+
+ return 0;
+ };
+diff --git a/drivers/iio/adc/max1118.c b/drivers/iio/adc/max1118.c
+index 49db9e9ae625c..b372b226ac203 100644
+--- a/drivers/iio/adc/max1118.c
++++ b/drivers/iio/adc/max1118.c
+@@ -38,6 +38,11 @@ struct max1118 {
+ struct spi_device *spi;
+ struct mutex lock;
+ struct regulator *reg;
++ /* Ensure natural alignment of buffer elements */
++ struct {
++ u8 channels[2];
++ s64 ts __aligned(8);
++ } scan;
+
+ u8 data ____cacheline_aligned;
+ };
+@@ -162,7 +167,6 @@ static irqreturn_t max1118_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct max1118 *adc = iio_priv(indio_dev);
+- u8 data[16] = { }; /* 2x 8-bit ADC data + padding + 8 bytes timestamp */
+ int scan_index;
+ int i = 0;
+
+@@ -180,10 +184,10 @@ static irqreturn_t max1118_trigger_handler(int irq, void *p)
+ goto out;
+ }
+
+- data[i] = ret;
++ adc->scan.channels[i] = ret;
+ i++;
+ }
+- iio_push_to_buffers_with_timestamp(indio_dev, data,
++ iio_push_to_buffers_with_timestamp(indio_dev, &adc->scan,
+ iio_get_time_ns(indio_dev));
+ out:
+ mutex_unlock(&adc->lock);
+diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
+index 819f260115005..4ee4ca35c2550 100644
+--- a/drivers/iio/adc/mcp3422.c
++++ b/drivers/iio/adc/mcp3422.c
+@@ -99,16 +99,12 @@ static int mcp3422_update_config(struct mcp3422 *adc, u8 newconfig)
+ {
+ int ret;
+
+- mutex_lock(&adc->lock);
+-
+ ret = i2c_master_send(adc->i2c, &newconfig, 1);
+ if (ret > 0) {
+ adc->config = newconfig;
+ ret = 0;
+ }
+
+- mutex_unlock(&adc->lock);
+-
+ return ret;
+ }
+
+@@ -141,6 +137,8 @@ static int mcp3422_read_channel(struct mcp3422 *adc,
+ u8 config;
+ u8 req_channel = channel->channel;
+
++ mutex_lock(&adc->lock);
++
+ if (req_channel != MCP3422_CHANNEL(adc->config)) {
+ config = adc->config;
+ config &= ~MCP3422_CHANNEL_MASK;
+@@ -148,12 +146,18 @@ static int mcp3422_read_channel(struct mcp3422 *adc,
+ config &= ~MCP3422_PGA_MASK;
+ config |= MCP3422_PGA_VALUE(adc->pga[req_channel]);
+ ret = mcp3422_update_config(adc, config);
+- if (ret < 0)
++ if (ret < 0) {
++ mutex_unlock(&adc->lock);
+ return ret;
++ }
+ msleep(mcp3422_read_times[MCP3422_SAMPLE_RATE(adc->config)]);
+ }
+
+- return mcp3422_read(adc, value, &config);
++ ret = mcp3422_read(adc, value, &config);
++
++ mutex_unlock(&adc->lock);
++
++ return ret;
+ }
+
+ static int mcp3422_read_raw(struct iio_dev *iio,
+diff --git a/drivers/iio/adc/ti-adc081c.c b/drivers/iio/adc/ti-adc081c.c
+index 405e3779c0c56..ef95363ebac2a 100644
+--- a/drivers/iio/adc/ti-adc081c.c
++++ b/drivers/iio/adc/ti-adc081c.c
+@@ -36,6 +36,12 @@ struct adc081c {
+
+ /* 8, 10 or 12 */
+ int bits;
++
++ /* Ensure natural alignment of buffer elements */
++ struct {
++ u16 channel;
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ #define REG_CONV_RES 0x00
+@@ -131,14 +137,13 @@ static irqreturn_t adc081c_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct adc081c *data = iio_priv(indio_dev);
+- u16 buf[8]; /* 2 bytes data + 6 bytes padding + 8 bytes timestamp */
+ int ret;
+
+ ret = i2c_smbus_read_word_swapped(data->i2c, REG_CONV_RES);
+ if (ret < 0)
+ goto out;
+- buf[0] = ret;
+- iio_push_to_buffers_with_timestamp(indio_dev, buf,
++ data->scan.channel = ret;
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ iio_get_time_ns(indio_dev));
+ out:
+ iio_trigger_notify_done(indio_dev->trig);
+diff --git a/drivers/iio/adc/ti-adc084s021.c b/drivers/iio/adc/ti-adc084s021.c
+index 25504640e1261..ec490e7a5b737 100644
+--- a/drivers/iio/adc/ti-adc084s021.c
++++ b/drivers/iio/adc/ti-adc084s021.c
+@@ -28,6 +28,11 @@ struct adc084s021 {
+ struct spi_transfer spi_trans;
+ struct regulator *reg;
+ struct mutex lock;
++ /* Buffer used to align data */
++ struct {
++ __be16 channels[4];
++ s64 ts __aligned(8);
++ } scan;
+ /*
+ * DMA (thus cache coherency maintenance) requires the
+ * transfer buffers to live in their own cache line.
+@@ -143,14 +148,13 @@ static irqreturn_t adc084s021_buffer_trigger_handler(int irq, void *pollfunc)
+ struct iio_poll_func *pf = pollfunc;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct adc084s021 *adc = iio_priv(indio_dev);
+- __be16 data[8] = {0}; /* 4 * 16-bit words of data + 8 bytes timestamp */
+
+ mutex_lock(&adc->lock);
+
+- if (adc084s021_adc_conversion(adc, &data) < 0)
++ if (adc084s021_adc_conversion(adc, adc->scan.channels) < 0)
+ dev_err(&adc->spi->dev, "Failed to read data\n");
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data,
++ iio_push_to_buffers_with_timestamp(indio_dev, &adc->scan,
+ iio_get_time_ns(indio_dev));
+ mutex_unlock(&adc->lock);
+ iio_trigger_notify_done(indio_dev->trig);
+diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
+index 6a114dcb4a3a7..dc8d859e4b92c 100644
+--- a/drivers/iio/adc/ti-ads1015.c
++++ b/drivers/iio/adc/ti-ads1015.c
+@@ -312,6 +312,7 @@ static const struct iio_chan_spec ads1115_channels[] = {
+ IIO_CHAN_SOFT_TIMESTAMP(ADS1015_TIMESTAMP),
+ };
+
++#ifdef CONFIG_PM
+ static int ads1015_set_power_state(struct ads1015_data *data, bool on)
+ {
+ int ret;
+@@ -329,6 +330,15 @@ static int ads1015_set_power_state(struct ads1015_data *data, bool on)
+ return ret < 0 ? ret : 0;
+ }
+
++#else /* !CONFIG_PM */
++
++static int ads1015_set_power_state(struct ads1015_data *data, bool on)
++{
++ return 0;
++}
++
++#endif /* !CONFIG_PM */
++
+ static
+ int ads1015_get_adc_result(struct ads1015_data *data, int chan, int *val)
+ {
+diff --git a/drivers/iio/chemical/ccs811.c b/drivers/iio/chemical/ccs811.c
+index b4a46eb457893..46d5d48b58b6c 100644
+--- a/drivers/iio/chemical/ccs811.c
++++ b/drivers/iio/chemical/ccs811.c
+@@ -78,6 +78,11 @@ struct ccs811_data {
+ struct ccs811_reading buffer;
+ struct iio_trigger *drdy_trig;
+ bool drdy_trig_on;
++ /* Ensures correct alignment of timestamp if present */
++ struct {
++ s16 channels[2];
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ static const struct iio_chan_spec ccs811_channels[] = {
+@@ -309,17 +314,17 @@ static irqreturn_t ccs811_trigger_handler(int irq, void *p)
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct ccs811_data *data = iio_priv(indio_dev);
+ struct i2c_client *client = data->client;
+- s16 buf[8]; /* s16 eCO2 + s16 TVOC + padding + 8 byte timestamp */
+ int ret;
+
+- ret = i2c_smbus_read_i2c_block_data(client, CCS811_ALG_RESULT_DATA, 4,
+- (u8 *)&buf);
++ ret = i2c_smbus_read_i2c_block_data(client, CCS811_ALG_RESULT_DATA,
++ sizeof(data->scan.channels),
++ (u8 *)data->scan.channels);
+ if (ret != 4) {
+ dev_err(&client->dev, "cannot read sensor data\n");
+ goto err;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buf,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ iio_get_time_ns(indio_dev));
+
+ err:
+diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
+index 830a2d45aa4dd..947f17588024a 100644
+--- a/drivers/iio/light/ltr501.c
++++ b/drivers/iio/light/ltr501.c
+@@ -1245,13 +1245,16 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct ltr501_data *data = iio_priv(indio_dev);
+- u16 buf[8];
++ struct {
++ u16 channels[3];
++ s64 ts __aligned(8);
++ } scan;
+ __le16 als_buf[2];
+ u8 mask = 0;
+ int j = 0;
+ int ret, psdata;
+
+- memset(buf, 0, sizeof(buf));
++ memset(&scan, 0, sizeof(scan));
+
+ /* figure out which data needs to be ready */
+ if (test_bit(0, indio_dev->active_scan_mask) ||
+@@ -1270,9 +1273,9 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p)
+ if (ret < 0)
+ return ret;
+ if (test_bit(0, indio_dev->active_scan_mask))
+- buf[j++] = le16_to_cpu(als_buf[1]);
++ scan.channels[j++] = le16_to_cpu(als_buf[1]);
+ if (test_bit(1, indio_dev->active_scan_mask))
+- buf[j++] = le16_to_cpu(als_buf[0]);
++ scan.channels[j++] = le16_to_cpu(als_buf[0]);
+ }
+
+ if (mask & LTR501_STATUS_PS_RDY) {
+@@ -1280,10 +1283,10 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p)
+ &psdata, 2);
+ if (ret < 0)
+ goto done;
+- buf[j++] = psdata & LTR501_PS_DATA_MASK;
++ scan.channels[j++] = psdata & LTR501_PS_DATA_MASK;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buf,
++ iio_push_to_buffers_with_timestamp(indio_dev, &scan,
+ iio_get_time_ns(indio_dev));
+
+ done:
+diff --git a/drivers/iio/light/max44000.c b/drivers/iio/light/max44000.c
+index bcdb0eb9e5371..7d2b3d0657262 100644
+--- a/drivers/iio/light/max44000.c
++++ b/drivers/iio/light/max44000.c
+@@ -78,6 +78,11 @@
+ struct max44000_data {
+ struct mutex lock;
+ struct regmap *regmap;
++ /* Ensure naturally aligned timestamp */
++ struct {
++ u16 channels[2];
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ /* Default scale is set to the minimum of 0.03125 or 1 / (1 << 5) lux */
+@@ -491,7 +496,6 @@ static irqreturn_t max44000_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct max44000_data *data = iio_priv(indio_dev);
+- u16 buf[8]; /* 2x u16 + padding + 8 bytes timestamp */
+ int index = 0;
+ unsigned int regval;
+ int ret;
+@@ -501,17 +505,17 @@ static irqreturn_t max44000_trigger_handler(int irq, void *p)
+ ret = max44000_read_alsval(data);
+ if (ret < 0)
+ goto out_unlock;
+- buf[index++] = ret;
++ data->scan.channels[index++] = ret;
+ }
+ if (test_bit(MAX44000_SCAN_INDEX_PRX, indio_dev->active_scan_mask)) {
+ ret = regmap_read(data->regmap, MAX44000_REG_PRX_DATA, ®val);
+ if (ret < 0)
+ goto out_unlock;
+- buf[index] = regval;
++ data->scan.channels[index] = regval;
+ }
+ mutex_unlock(&data->lock);
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buf,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ iio_get_time_ns(indio_dev));
+ iio_trigger_notify_done(indio_dev->trig);
+ return IRQ_HANDLED;
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index 42a827a665121..379aa7f4a8041 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -381,6 +381,12 @@ struct ak8975_data {
+ struct iio_mount_matrix orientation;
+ struct regulator *vdd;
+ struct regulator *vid;
++
++ /* Ensure natural alignment of timestamp */
++ struct {
++ s16 channels[3];
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ /* Enable attached power regulator if any. */
+@@ -815,7 +821,6 @@ static void ak8975_fill_buffer(struct iio_dev *indio_dev)
+ const struct i2c_client *client = data->client;
+ const struct ak_def *def = data->def;
+ int ret;
+- s16 buff[8]; /* 3 x 16 bits axis values + 1 aligned 64 bits timestamp */
+ __le16 fval[3];
+
+ mutex_lock(&data->lock);
+@@ -838,12 +843,13 @@ static void ak8975_fill_buffer(struct iio_dev *indio_dev)
+ mutex_unlock(&data->lock);
+
+ /* Clamp to valid range. */
+- buff[0] = clamp_t(s16, le16_to_cpu(fval[0]), -def->range, def->range);
+- buff[1] = clamp_t(s16, le16_to_cpu(fval[1]), -def->range, def->range);
+- buff[2] = clamp_t(s16, le16_to_cpu(fval[2]), -def->range, def->range);
++ data->scan.channels[0] = clamp_t(s16, le16_to_cpu(fval[0]), -def->range, def->range);
++ data->scan.channels[1] = clamp_t(s16, le16_to_cpu(fval[1]), -def->range, def->range);
++ data->scan.channels[2] = clamp_t(s16, le16_to_cpu(fval[2]), -def->range, def->range);
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buff,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ iio_get_time_ns(indio_dev));
++
+ return;
+
+ unlock:
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index e8432876cc860..e1ecd4682c096 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1711,7 +1711,7 @@ int ib_get_eth_speed(struct ib_device *dev, u8 port_num, u8 *speed, u8 *width)
+
+ dev_put(netdev);
+
+- if (!rc) {
++ if (!rc && lksettings.base.speed != (u32)SPEED_UNKNOWN) {
+ netdev_speed = lksettings.base.speed;
+ } else {
+ netdev_speed = SPEED_1000;
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index c9af2d139f5cb..957da3ffe593c 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -3033,6 +3033,19 @@ static void bnxt_re_process_res_rawqp1_wc(struct ib_wc *wc,
+ wc->wc_flags |= IB_WC_GRH;
+ }
+
++static bool bnxt_re_check_if_vlan_valid(struct bnxt_re_dev *rdev,
++ u16 vlan_id)
++{
++ /*
++ * Check if the vlan is configured in the host. If not configured, it
++ * can be a transparent VLAN. So dont report the vlan id.
++ */
++ if (!__vlan_find_dev_deep_rcu(rdev->netdev,
++ htons(ETH_P_8021Q), vlan_id))
++ return false;
++ return true;
++}
++
+ static bool bnxt_re_is_vlan_pkt(struct bnxt_qplib_cqe *orig_cqe,
+ u16 *vid, u8 *sl)
+ {
+@@ -3101,9 +3114,11 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *qp,
+ wc->src_qp = orig_cqe->src_qp;
+ memcpy(wc->smac, orig_cqe->smac, ETH_ALEN);
+ if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) {
+- wc->vlan_id = vlan_id;
+- wc->sl = sl;
+- wc->wc_flags |= IB_WC_WITH_VLAN;
++ if (bnxt_re_check_if_vlan_valid(rdev, vlan_id)) {
++ wc->vlan_id = vlan_id;
++ wc->sl = sl;
++ wc->wc_flags |= IB_WC_WITH_VLAN;
++ }
+ }
+ wc->port_num = 1;
+ wc->vendor_err = orig_cqe->status;
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index 10999fa692818..94dedabe648c2 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -163,9 +163,6 @@ static int rxe_init_ports(struct rxe_dev *rxe)
+
+ rxe_init_port_param(port);
+
+- if (!port->attr.pkey_tbl_len || !port->attr.gid_tbl_len)
+- return -EINVAL;
+-
+ port->pkey_tbl = kcalloc(port->attr.pkey_tbl_len,
+ sizeof(*port->pkey_tbl), GFP_KERNEL);
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index dff605fdf60fa..2cca89ca08cd4 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -203,6 +203,7 @@ int rxe_mem_init_user(struct rxe_pd *pd, u64 start,
+ vaddr = page_address(sg_page(sg));
+ if (!vaddr) {
+ pr_warn("null vaddr\n");
++ ib_umem_release(umem);
+ err = -ENOMEM;
+ goto err1;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index 3a94eb5edcf90..f7f9caaec7d6b 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -1146,7 +1146,7 @@ static ssize_t parent_show(struct device *device,
+ struct rxe_dev *rxe = container_of(device, struct rxe_dev,
+ ib_dev.dev);
+
+- return snprintf(buf, 16, "%s\n", rxe_parent_name(rxe, 1));
++ return scnprintf(buf, PAGE_SIZE, "%s\n", rxe_parent_name(rxe, 1));
+ }
+
+ static DEVICE_ATTR_RO(parent);
+diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
+index 58da65df03f5e..7a59a8ebac108 100644
+--- a/drivers/iommu/amd_iommu_v2.c
++++ b/drivers/iommu/amd_iommu_v2.c
+@@ -776,6 +776,13 @@ int amd_iommu_init_device(struct pci_dev *pdev, int pasids)
+
+ might_sleep();
+
++ /*
++ * When memory encryption is active the device is likely not in a
++ * direct-mapped domain. Forbid using IOMMUv2 functionality for now.
++ */
++ if (mem_encrypt_active())
++ return -ENODEV;
++
+ if (!amd_iommu_v2_supported())
+ return -ENODEV;
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 643fd1a1b88be..4970cd40813b2 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -1060,7 +1060,7 @@ static void sdhci_msm_set_cdr(struct sdhci_host *host, bool enable)
+ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ {
+ struct sdhci_host *host = mmc_priv(mmc);
+- int tuning_seq_cnt = 3;
++ int tuning_seq_cnt = 10;
+ u8 phase, tuned_phases[16], tuned_phase_cnt = 0;
+ int rc;
+ struct mmc_ios ios = host->mmc->ios;
+@@ -1124,6 +1124,22 @@ retry:
+ } while (++phase < ARRAY_SIZE(tuned_phases));
+
+ if (tuned_phase_cnt) {
++ if (tuned_phase_cnt == ARRAY_SIZE(tuned_phases)) {
++ /*
++ * All phases valid is _almost_ as bad as no phases
++ * valid. Probably all phases are not really reliable
++ * but we didn't detect where the unreliable place is.
++ * That means we'll essentially be guessing and hoping
++ * we get a good phase. Better to try a few times.
++ */
++ dev_dbg(mmc_dev(mmc), "%s: All phases valid; try again\n",
++ mmc_hostname(mmc));
++ if (--tuning_seq_cnt) {
++ tuned_phase_cnt = 0;
++ goto retry;
++ }
++ }
++
+ rc = msm_find_most_appropriate_phase(host, tuned_phases,
+ tuned_phase_cnt);
+ if (rc < 0)
+diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
+index 320039d329c7d..c169a26e5359a 100644
+--- a/drivers/net/wan/hdlc_cisco.c
++++ b/drivers/net/wan/hdlc_cisco.c
+@@ -374,6 +374,7 @@ static int cisco_ioctl(struct net_device *dev, struct ifreq *ifr)
+ memcpy(&state(hdlc)->settings, &new_settings, size);
+ spin_lock_init(&state(hdlc)->lock);
+ dev->header_ops = &cisco_header_ops;
++ dev->hard_header_len = sizeof(struct hdlc_header);
+ dev->type = ARPHRD_CISCO;
+ call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);
+ netif_dormant_on(dev);
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index c94dfa70f2a33..15177a54b17d7 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -213,6 +213,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
+
+ skb->dev = dev = lapbeth->ethdev;
+
++ skb_reset_network_header(skb);
++
+ dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0);
+
+ dev_queue_xmit(skb);
+@@ -343,6 +345,7 @@ static int lapbeth_new_device(struct net_device *dev)
+ */
+ ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len
+ + dev->needed_headroom;
++ ndev->needed_tailroom = dev->needed_tailroom;
+
+ lapbeth = netdev_priv(ndev);
+ lapbeth->axdev = ndev;
+diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c
+index 01acb6e533655..c4b6e29c07192 100644
+--- a/drivers/nfc/st95hf/core.c
++++ b/drivers/nfc/st95hf/core.c
+@@ -981,7 +981,7 @@ static int st95hf_in_send_cmd(struct nfc_digital_dev *ddev,
+ rc = down_killable(&stcontext->exchange_lock);
+ if (rc) {
+ WARN(1, "Semaphore is not found up in st95hf_in_send_cmd\n");
+- return rc;
++ goto free_skb_resp;
+ }
+
+ rc = st95hf_spi_send(&stcontext->spicontext, skb->data,
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index bcd09d3a44dad..05dd46f984414 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -577,7 +577,6 @@ bool __nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
+ * which is require to set the queue live in the appropinquate states.
+ */
+ switch (ctrl->state) {
+- case NVME_CTRL_NEW:
+ case NVME_CTRL_CONNECTING:
+ if (req->cmd->common.opcode == nvme_fabrics_command &&
+ req->cmd->fabrics.fctype == nvme_fabrics_type_connect)
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index f393a6193252e..7e2cdb17c26d8 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -118,6 +118,7 @@ struct nvme_rdma_ctrl {
+ struct sockaddr_storage src_addr;
+
+ struct nvme_ctrl ctrl;
++ struct mutex teardown_lock;
+ bool use_inline_data;
+ };
+
+@@ -880,6 +881,7 @@ out_free_io_queues:
+ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&ctrl->teardown_lock);
+ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_stop_queue(&ctrl->queues[0]);
+ if (ctrl->ctrl.admin_tagset)
+@@ -887,11 +889,13 @@ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ nvme_cancel_request, &ctrl->ctrl);
+ blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_destroy_admin_queue(ctrl, remove);
++ mutex_unlock(&ctrl->teardown_lock);
+ }
+
+ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&ctrl->teardown_lock);
+ if (ctrl->ctrl.queue_count > 1) {
+ nvme_stop_queues(&ctrl->ctrl);
+ nvme_rdma_stop_io_queues(ctrl);
+@@ -902,6 +906,7 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ nvme_start_queues(&ctrl->ctrl);
+ nvme_rdma_destroy_io_queues(ctrl, remove);
+ }
++ mutex_unlock(&ctrl->teardown_lock);
+ }
+
+ static void nvme_rdma_stop_ctrl(struct nvme_ctrl *nctrl)
+@@ -1955,6 +1960,7 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
+ return ERR_PTR(-ENOMEM);
+ ctrl->ctrl.opts = opts;
+ INIT_LIST_HEAD(&ctrl->list);
++ mutex_init(&ctrl->teardown_lock);
+
+ if (opts->mask & NVMF_OPT_TRSVCID)
+ port = opts->trsvcid;
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c
+index cf515928fed09..68107611c70a2 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c
+@@ -311,8 +311,8 @@ static const struct qmp_phy_init_tbl ipq8074_pcie_serdes_tbl[] = {
+ QMP_PHY_INIT_CFG(QSERDES_COM_BG_TRIM, 0xf),
+ QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP_EN, 0x1),
+ QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_MAP, 0x0),
+- QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER1, 0x1f),
+- QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER2, 0x3f),
++ QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER1, 0xff),
++ QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER2, 0x1f),
+ QMP_PHY_INIT_CFG(QSERDES_COM_CMN_CONFIG, 0x6),
+ QMP_PHY_INIT_CFG(QSERDES_COM_PLL_IVCO, 0xf),
+ QMP_PHY_INIT_CFG(QSERDES_COM_HSCLK_SEL, 0x0),
+@@ -338,7 +338,6 @@ static const struct qmp_phy_init_tbl ipq8074_pcie_serdes_tbl[] = {
+ QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN1_MODE0, 0x0),
+ QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN0_MODE0, 0x80),
+ QMP_PHY_INIT_CFG(QSERDES_COM_BIAS_EN_CTRL_BY_PSM, 0x1),
+- QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_CTRL, 0xa),
+ QMP_PHY_INIT_CFG(QSERDES_COM_SSC_EN_CENTER, 0x1),
+ QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER1, 0x31),
+ QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER2, 0x1),
+@@ -347,7 +346,6 @@ static const struct qmp_phy_init_tbl ipq8074_pcie_serdes_tbl[] = {
+ QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE1, 0x2f),
+ QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE2, 0x19),
+ QMP_PHY_INIT_CFG(QSERDES_COM_CLK_EP_DIV, 0x19),
+- QMP_PHY_INIT_CFG(QSERDES_RX_SIGDET_CNTRL, 0x7),
+ };
+
+ static const struct qmp_phy_init_tbl ipq8074_pcie_tx_tbl[] = {
+@@ -355,6 +353,8 @@ static const struct qmp_phy_init_tbl ipq8074_pcie_tx_tbl[] = {
+ QMP_PHY_INIT_CFG(QSERDES_TX_LANE_MODE, 0x6),
+ QMP_PHY_INIT_CFG(QSERDES_TX_RES_CODE_LANE_OFFSET, 0x2),
+ QMP_PHY_INIT_CFG(QSERDES_TX_RCV_DETECT_LVL_2, 0x12),
++ QMP_PHY_INIT_CFG(QSERDES_TX_EMP_POST1_LVL, 0x36),
++ QMP_PHY_INIT_CFG(QSERDES_TX_SLEW_CNTL, 0x0a),
+ };
+
+ static const struct qmp_phy_init_tbl ipq8074_pcie_rx_tbl[] = {
+@@ -365,7 +365,6 @@ static const struct qmp_phy_init_tbl ipq8074_pcie_rx_tbl[] = {
+ QMP_PHY_INIT_CFG(QSERDES_RX_RX_EQU_ADAPTOR_CNTRL4, 0xdb),
+ QMP_PHY_INIT_CFG(QSERDES_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x4b),
+ QMP_PHY_INIT_CFG(QSERDES_RX_UCDR_SO_GAIN, 0x4),
+- QMP_PHY_INIT_CFG(QSERDES_RX_UCDR_SO_GAIN_HALF, 0x4),
+ };
+
+ static const struct qmp_phy_init_tbl ipq8074_pcie_pcs_tbl[] = {
+@@ -818,6 +817,9 @@ static const struct qmp_phy_cfg msm8996_usb3phy_cfg = {
+ .mask_pcs_ready = PHYSTATUS,
+ };
+
++static const char * const ipq8074_pciephy_clk_l[] = {
++ "aux", "cfg_ahb",
++};
+ /* list of resets */
+ static const char * const ipq8074_pciephy_reset_l[] = {
+ "phy", "common",
+@@ -835,8 +837,8 @@ static const struct qmp_phy_cfg ipq8074_pciephy_cfg = {
+ .rx_tbl_num = ARRAY_SIZE(ipq8074_pcie_rx_tbl),
+ .pcs_tbl = ipq8074_pcie_pcs_tbl,
+ .pcs_tbl_num = ARRAY_SIZE(ipq8074_pcie_pcs_tbl),
+- .clk_list = NULL,
+- .num_clks = 0,
++ .clk_list = ipq8074_pciephy_clk_l,
++ .num_clks = ARRAY_SIZE(ipq8074_pciephy_clk_l),
+ .reset_list = ipq8074_pciephy_reset_l,
+ .num_resets = ARRAY_SIZE(ipq8074_pciephy_reset_l),
+ .vreg_list = NULL,
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.h b/drivers/phy/qualcomm/phy-qcom-qmp.h
+index 5d78d43ba9fc5..6b3aaf521e588 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.h
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.h
+@@ -77,6 +77,8 @@
+ #define QSERDES_COM_CORECLK_DIV_MODE1 0x1bc
+
+ /* Only for QMP V2 PHY - TX registers */
++#define QSERDES_TX_EMP_POST1_LVL 0x018
++#define QSERDES_TX_SLEW_CNTL 0x040
+ #define QSERDES_TX_RES_CODE_LANE_OFFSET 0x054
+ #define QSERDES_TX_DEBUG_BUS_SEL 0x064
+ #define QSERDES_TX_HIGHZ_TRANSCEIVEREN_BIAS_DRVR_EN 0x068
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 4bab758d14b1a..37e6270749eef 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1257,7 +1257,7 @@ static int set_consumer_device_supply(struct regulator_dev *rdev,
+ const char *consumer_dev_name,
+ const char *supply)
+ {
+- struct regulator_map *node;
++ struct regulator_map *node, *new_node;
+ int has_dev;
+
+ if (supply == NULL)
+@@ -1268,6 +1268,22 @@ static int set_consumer_device_supply(struct regulator_dev *rdev,
+ else
+ has_dev = 0;
+
++ new_node = kzalloc(sizeof(struct regulator_map), GFP_KERNEL);
++ if (new_node == NULL)
++ return -ENOMEM;
++
++ new_node->regulator = rdev;
++ new_node->supply = supply;
++
++ if (has_dev) {
++ new_node->dev_name = kstrdup(consumer_dev_name, GFP_KERNEL);
++ if (new_node->dev_name == NULL) {
++ kfree(new_node);
++ return -ENOMEM;
++ }
++ }
++
++ mutex_lock(®ulator_list_mutex);
+ list_for_each_entry(node, ®ulator_map_list, list) {
+ if (node->dev_name && consumer_dev_name) {
+ if (strcmp(node->dev_name, consumer_dev_name) != 0)
+@@ -1285,26 +1301,19 @@ static int set_consumer_device_supply(struct regulator_dev *rdev,
+ node->regulator->desc->name,
+ supply,
+ dev_name(&rdev->dev), rdev_get_name(rdev));
+- return -EBUSY;
++ goto fail;
+ }
+
+- node = kzalloc(sizeof(struct regulator_map), GFP_KERNEL);
+- if (node == NULL)
+- return -ENOMEM;
+-
+- node->regulator = rdev;
+- node->supply = supply;
+-
+- if (has_dev) {
+- node->dev_name = kstrdup(consumer_dev_name, GFP_KERNEL);
+- if (node->dev_name == NULL) {
+- kfree(node);
+- return -ENOMEM;
+- }
+- }
++ list_add(&new_node->list, ®ulator_map_list);
++ mutex_unlock(®ulator_list_mutex);
+
+- list_add(&node->list, ®ulator_map_list);
+ return 0;
++
++fail:
++ mutex_unlock(®ulator_list_mutex);
++ kfree(new_node->dev_name);
++ kfree(new_node);
++ return -EBUSY;
+ }
+
+ static void unset_regulator_supplies(struct regulator_dev *rdev)
+@@ -4375,19 +4384,16 @@ regulator_register(const struct regulator_desc *regulator_desc,
+
+ /* add consumers devices */
+ if (init_data) {
+- mutex_lock(®ulator_list_mutex);
+ for (i = 0; i < init_data->num_consumer_supplies; i++) {
+ ret = set_consumer_device_supply(rdev,
+ init_data->consumer_supplies[i].dev_name,
+ init_data->consumer_supplies[i].supply);
+ if (ret < 0) {
+- mutex_unlock(®ulator_list_mutex);
+ dev_err(dev, "Failed to set supply %s\n",
+ init_data->consumer_supplies[i].supply);
+ goto unset_supplies;
+ }
+ }
+- mutex_unlock(®ulator_list_mutex);
+ }
+
+ if (!rdev->desc->ops->get_voltage &&
+diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
+index 64a958a99f6a8..d82698b7dfe6c 100644
+--- a/drivers/scsi/libsas/sas_ata.c
++++ b/drivers/scsi/libsas/sas_ata.c
+@@ -223,7 +223,10 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
+ task->num_scatter = si;
+ }
+
+- task->data_dir = qc->dma_dir;
++ if (qc->tf.protocol == ATA_PROT_NODATA)
++ task->data_dir = DMA_NONE;
++ else
++ task->data_dir = qc->dma_dir;
+ task->scatter = qc->sg;
+ task->ata_task.retry_count = 1;
+ task->task_state_flags = SAS_TASK_STATE_PENDING;
+diff --git a/drivers/staging/greybus/audio_topology.c b/drivers/staging/greybus/audio_topology.c
+index b71078339e860..860247d718184 100644
+--- a/drivers/staging/greybus/audio_topology.c
++++ b/drivers/staging/greybus/audio_topology.c
+@@ -460,6 +460,15 @@ static int gbcodec_mixer_dapm_ctl_put(struct snd_kcontrol *kcontrol,
+ val = ucontrol->value.integer.value[0] & mask;
+ connect = !!val;
+
++ ret = gb_pm_runtime_get_sync(bundle);
++ if (ret)
++ return ret;
++
++ ret = gb_audio_gb_get_control(module->mgmt_connection, data->ctl_id,
++ GB_AUDIO_INVALID_INDEX, &gbvalue);
++ if (ret)
++ goto exit;
++
+ /* update ucontrol */
+ if (gbvalue.value.integer_value[0] != val) {
+ for (wi = 0; wi < wlist->num_widgets; wi++) {
+@@ -473,25 +482,17 @@ static int gbcodec_mixer_dapm_ctl_put(struct snd_kcontrol *kcontrol,
+ gbvalue.value.integer_value[0] =
+ cpu_to_le32(ucontrol->value.integer.value[0]);
+
+- ret = gb_pm_runtime_get_sync(bundle);
+- if (ret)
+- return ret;
+-
+ ret = gb_audio_gb_set_control(module->mgmt_connection,
+ data->ctl_id,
+ GB_AUDIO_INVALID_INDEX, &gbvalue);
+-
+- gb_pm_runtime_put_autosuspend(bundle);
+-
+- if (ret) {
+- dev_err_ratelimited(codec->dev,
+- "%d:Error in %s for %s\n", ret,
+- __func__, kcontrol->id.name);
+- return ret;
+- }
+ }
+
+- return 0;
++exit:
++ gb_pm_runtime_put_autosuspend(bundle);
++ if (ret)
++ dev_err_ratelimited(codec_dev, "%d:Error in %s for %s\n", ret,
++ __func__, kcontrol->id.name);
++ return ret;
+ }
+
+ #define SOC_DAPM_MIXER_GB(xname, kcount, data) \
+diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
+index 65ad9773018ee..7686805dfe0f2 100644
+--- a/drivers/staging/wlan-ng/hfa384x_usb.c
++++ b/drivers/staging/wlan-ng/hfa384x_usb.c
+@@ -532,13 +532,8 @@ static void hfa384x_usb_defer(struct work_struct *data)
+ */
+ void hfa384x_create(struct hfa384x *hw, struct usb_device *usb)
+ {
+- memset(hw, 0, sizeof(*hw));
+ hw->usb = usb;
+
+- /* set up the endpoints */
+- hw->endp_in = usb_rcvbulkpipe(usb, 1);
+- hw->endp_out = usb_sndbulkpipe(usb, 2);
+-
+ /* Set up the waitq */
+ init_waitqueue_head(&hw->cmdq);
+
+diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c
+index 8d32b1603d10a..9eee72aff7233 100644
+--- a/drivers/staging/wlan-ng/prism2usb.c
++++ b/drivers/staging/wlan-ng/prism2usb.c
+@@ -61,23 +61,14 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
+ const struct usb_device_id *id)
+ {
+ struct usb_device *dev;
+- const struct usb_endpoint_descriptor *epd;
+- const struct usb_host_interface *iface_desc = interface->cur_altsetting;
++ struct usb_endpoint_descriptor *bulk_in, *bulk_out;
++ struct usb_host_interface *iface_desc = interface->cur_altsetting;
+ struct wlandevice *wlandev = NULL;
+ struct hfa384x *hw = NULL;
+ int result = 0;
+
+- if (iface_desc->desc.bNumEndpoints != 2) {
+- result = -ENODEV;
+- goto failed;
+- }
+-
+- result = -EINVAL;
+- epd = &iface_desc->endpoint[1].desc;
+- if (!usb_endpoint_is_bulk_in(epd))
+- goto failed;
+- epd = &iface_desc->endpoint[2].desc;
+- if (!usb_endpoint_is_bulk_out(epd))
++ result = usb_find_common_endpoints(iface_desc, &bulk_in, &bulk_out, NULL, NULL);
++ if (result)
+ goto failed;
+
+ dev = interface_to_usbdev(interface);
+@@ -96,6 +87,8 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
+ }
+
+ /* Initialize the hw data */
++ hw->endp_in = usb_rcvbulkpipe(dev, bulk_in->bEndpointAddress);
++ hw->endp_out = usb_sndbulkpipe(dev, bulk_out->bEndpointAddress);
+ hfa384x_create(hw, dev);
+ hw->wlandev = wlandev;
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 1633e26662687..2602b57936d4b 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1381,14 +1381,27 @@ static u32 iscsit_do_crypto_hash_sg(
+ sg = cmd->first_data_sg;
+ page_off = cmd->first_data_sg_off;
+
++ if (data_length && page_off) {
++ struct scatterlist first_sg;
++ u32 len = min_t(u32, data_length, sg->length - page_off);
++
++ sg_init_table(&first_sg, 1);
++ sg_set_page(&first_sg, sg_page(sg), len, sg->offset + page_off);
++
++ ahash_request_set_crypt(hash, &first_sg, NULL, len);
++ crypto_ahash_update(hash);
++
++ data_length -= len;
++ sg = sg_next(sg);
++ }
++
+ while (data_length) {
+- u32 cur_len = min_t(u32, data_length, (sg->length - page_off));
++ u32 cur_len = min_t(u32, data_length, sg->length);
+
+ ahash_request_set_crypt(hash, sg, NULL, cur_len);
+ crypto_ahash_update(hash);
+
+ data_length -= cur_len;
+- page_off = 0;
+ /* iscsit_map_iovec has already checked for invalid sg pointers */
+ sg = sg_next(sg);
+ }
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index f25049ba4a85b..db93bd0a9b886 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -1183,7 +1183,7 @@ void iscsit_free_conn(struct iscsi_conn *conn)
+ }
+
+ void iscsi_target_login_sess_out(struct iscsi_conn *conn,
+- struct iscsi_np *np, bool zero_tsih, bool new_sess)
++ bool zero_tsih, bool new_sess)
+ {
+ if (!new_sess)
+ goto old_sess_out;
+@@ -1201,7 +1201,6 @@ void iscsi_target_login_sess_out(struct iscsi_conn *conn,
+ conn->sess = NULL;
+
+ old_sess_out:
+- iscsi_stop_login_thread_timer(np);
+ /*
+ * If login negotiation fails check if the Time2Retain timer
+ * needs to be restarted.
+@@ -1441,8 +1440,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ new_sess_out:
+ new_sess = true;
+ old_sess_out:
++ iscsi_stop_login_thread_timer(np);
+ tpg_np = conn->tpg_np;
+- iscsi_target_login_sess_out(conn, np, zero_tsih, new_sess);
++ iscsi_target_login_sess_out(conn, zero_tsih, new_sess);
+ new_sess = false;
+
+ if (tpg) {
+diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
+index 3b8e3639ff5d0..fc95e6150253f 100644
+--- a/drivers/target/iscsi/iscsi_target_login.h
++++ b/drivers/target/iscsi/iscsi_target_login.h
+@@ -22,8 +22,7 @@ extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
+ extern void iscsit_free_conn(struct iscsi_conn *);
+ extern int iscsit_start_kthreads(struct iscsi_conn *);
+ extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
+-extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,
+- bool, bool);
++extern void iscsi_target_login_sess_out(struct iscsi_conn *, bool, bool);
+ extern int iscsi_target_login_thread(void *);
+ extern void iscsi_handle_login_thread_timeout(struct timer_list *t);
+
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index 8a5e8d17a9426..5db8842a80265 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -554,12 +554,11 @@ static bool iscsi_target_sk_check_and_clear(struct iscsi_conn *conn, unsigned in
+
+ static void iscsi_target_login_drop(struct iscsi_conn *conn, struct iscsi_login *login)
+ {
+- struct iscsi_np *np = login->np;
+ bool zero_tsih = login->zero_tsih;
+
+ iscsi_remove_failed_auth_entry(conn);
+ iscsi_target_nego_release(conn);
+- iscsi_target_login_sess_out(conn, np, zero_tsih, true);
++ iscsi_target_login_sess_out(conn, zero_tsih, true);
+ }
+
+ struct conn_timeout {
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index f705ea52eb973..152228d33ad20 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1204,6 +1204,34 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
+ }
+ }
+
++/*
++ * usb_disable_device_endpoints -- Disable all endpoints for a device
++ * @dev: the device whose endpoints are being disabled
++ * @skip_ep0: 0 to disable endpoint 0, 1 to skip it.
++ */
++static void usb_disable_device_endpoints(struct usb_device *dev, int skip_ep0)
++{
++ struct usb_hcd *hcd = bus_to_hcd(dev->bus);
++ int i;
++
++ if (hcd->driver->check_bandwidth) {
++ /* First pass: Cancel URBs, leave endpoint pointers intact. */
++ for (i = skip_ep0; i < 16; ++i) {
++ usb_disable_endpoint(dev, i, false);
++ usb_disable_endpoint(dev, i + USB_DIR_IN, false);
++ }
++ /* Remove endpoints from the host controller internal state */
++ mutex_lock(hcd->bandwidth_mutex);
++ usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
++ mutex_unlock(hcd->bandwidth_mutex);
++ }
++ /* Second pass: remove endpoint pointers */
++ for (i = skip_ep0; i < 16; ++i) {
++ usb_disable_endpoint(dev, i, true);
++ usb_disable_endpoint(dev, i + USB_DIR_IN, true);
++ }
++}
++
+ /**
+ * usb_disable_device - Disable all the endpoints for a USB device
+ * @dev: the device whose endpoints are being disabled
+@@ -1217,7 +1245,6 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
+ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ {
+ int i;
+- struct usb_hcd *hcd = bus_to_hcd(dev->bus);
+
+ /* getting rid of interfaces will disconnect
+ * any drivers bound to them (a key side effect)
+@@ -1263,22 +1290,8 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+
+ dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
+ skip_ep0 ? "non-ep0" : "all");
+- if (hcd->driver->check_bandwidth) {
+- /* First pass: Cancel URBs, leave endpoint pointers intact. */
+- for (i = skip_ep0; i < 16; ++i) {
+- usb_disable_endpoint(dev, i, false);
+- usb_disable_endpoint(dev, i + USB_DIR_IN, false);
+- }
+- /* Remove endpoints from the host controller internal state */
+- mutex_lock(hcd->bandwidth_mutex);
+- usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
+- mutex_unlock(hcd->bandwidth_mutex);
+- /* Second pass: remove endpoint pointers */
+- }
+- for (i = skip_ep0; i < 16; ++i) {
+- usb_disable_endpoint(dev, i, true);
+- usb_disable_endpoint(dev, i + USB_DIR_IN, true);
+- }
++
++ usb_disable_device_endpoints(dev, skip_ep0);
+ }
+
+ /**
+@@ -1521,6 +1534,9 @@ EXPORT_SYMBOL_GPL(usb_set_interface);
+ * The caller must own the device lock.
+ *
+ * Return: Zero on success, else a negative error code.
++ *
++ * If this routine fails the device will probably be in an unusable state
++ * with endpoints disabled, and interfaces only partially enabled.
+ */
+ int usb_reset_configuration(struct usb_device *dev)
+ {
+@@ -1536,10 +1552,7 @@ int usb_reset_configuration(struct usb_device *dev)
+ * calls during probe() are fine
+ */
+
+- for (i = 1; i < 16; ++i) {
+- usb_disable_endpoint(dev, i, true);
+- usb_disable_endpoint(dev, i + USB_DIR_IN, true);
+- }
++ usb_disable_device_endpoints(dev, 1); /* skip ep0*/
+
+ config = dev->actconfig;
+ retval = 0;
+@@ -1552,34 +1565,10 @@ int usb_reset_configuration(struct usb_device *dev)
+ mutex_unlock(hcd->bandwidth_mutex);
+ return -ENOMEM;
+ }
+- /* Make sure we have enough bandwidth for each alternate setting 0 */
+- for (i = 0; i < config->desc.bNumInterfaces; i++) {
+- struct usb_interface *intf = config->interface[i];
+- struct usb_host_interface *alt;
+
+- alt = usb_altnum_to_altsetting(intf, 0);
+- if (!alt)
+- alt = &intf->altsetting[0];
+- if (alt != intf->cur_altsetting)
+- retval = usb_hcd_alloc_bandwidth(dev, NULL,
+- intf->cur_altsetting, alt);
+- if (retval < 0)
+- break;
+- }
+- /* If not, reinstate the old alternate settings */
++ /* xHCI adds all endpoints in usb_hcd_alloc_bandwidth */
++ retval = usb_hcd_alloc_bandwidth(dev, config, NULL, NULL);
+ if (retval < 0) {
+-reset_old_alts:
+- for (i--; i >= 0; i--) {
+- struct usb_interface *intf = config->interface[i];
+- struct usb_host_interface *alt;
+-
+- alt = usb_altnum_to_altsetting(intf, 0);
+- if (!alt)
+- alt = &intf->altsetting[0];
+- if (alt != intf->cur_altsetting)
+- usb_hcd_alloc_bandwidth(dev, NULL,
+- alt, intf->cur_altsetting);
+- }
+ usb_enable_lpm(dev);
+ mutex_unlock(hcd->bandwidth_mutex);
+ return retval;
+@@ -1588,8 +1577,12 @@ reset_old_alts:
+ USB_REQ_SET_CONFIGURATION, 0,
+ config->desc.bConfigurationValue, 0,
+ NULL, 0, USB_CTRL_SET_TIMEOUT);
+- if (retval < 0)
+- goto reset_old_alts;
++ if (retval < 0) {
++ usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
++ usb_enable_lpm(dev);
++ mutex_unlock(hcd->bandwidth_mutex);
++ return retval;
++ }
+ mutex_unlock(hcd->bandwidth_mutex);
+
+ /* re-init hc/hcd interface/endpoint state */
+diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
+index 7e88fdfe3cf5c..b93b18ba89df6 100644
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -888,7 +888,11 @@ read_descriptors(struct file *filp, struct kobject *kobj,
+ size_t srclen, n;
+ int cfgno;
+ void *src;
++ int retval;
+
++ retval = usb_lock_device_interruptible(udev);
++ if (retval < 0)
++ return -EINTR;
+ /* The binary attribute begins with the device descriptor.
+ * Following that are the raw descriptor entries for all the
+ * configurations (config plus subsidiary descriptors).
+@@ -913,6 +917,7 @@ read_descriptors(struct file *filp, struct kobject *kobj,
+ off -= srclen;
+ }
+ }
++ usb_unlock_device(udev);
+ return count - nleft;
+ }
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index ce9cc1f90b052..f0f630e1cf1c9 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -703,6 +703,7 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
++ { USB_DEVICE(XSENS_VID, XSENS_MTIUSBCONVERTER_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
+ { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index e8373528264c3..b5ca17a5967a0 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -160,6 +160,7 @@
+ #define XSENS_AWINDA_DONGLE_PID 0x0102
+ #define XSENS_MTW_PID 0x0200 /* Xsens MTw */
+ #define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */
++#define XSENS_MTIUSBCONVERTER_PID 0x0301 /* MTi USB converter */
+ #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */
+
+ /* Xsens devices using FTDI VID */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 6e44aaafdcb10..810f1010ab132 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1094,14 +1094,18 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M),
+ .driver_info = RSVD(1) | RSVD(3) },
+ /* Quectel products using Quectel vendor ID */
+- { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
+- .driver_info = RSVD(4) },
+- { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
+- .driver_info = RSVD(4) },
+- { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95),
+- .driver_info = RSVD(4) },
+- { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
+- .driver_info = RSVD(4) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21, 0xff, 0xff, 0xff),
++ .driver_info = NUMEP2 },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25, 0xff, 0xff, 0xff),
++ .driver_info = NUMEP2 },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0xff, 0xff),
++ .driver_info = NUMEP2 },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96, 0xff, 0xff, 0xff),
++ .driver_info = NUMEP2 },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
+@@ -1819,6 +1823,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */
+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */
+ .driver_info = RSVD(7) },
++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9205, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT+ECM mode */
++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9206, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT-only mode */
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
+diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c
+index a18112a83faed..dda8bd39c9186 100644
+--- a/drivers/usb/typec/ucsi/ucsi_acpi.c
++++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
+@@ -64,11 +64,15 @@ static void ucsi_acpi_notify(acpi_handle handle, u32 event, void *data)
+
+ static int ucsi_acpi_probe(struct platform_device *pdev)
+ {
++ struct acpi_device *adev = ACPI_COMPANION(&pdev->dev);
+ struct ucsi_acpi *ua;
+ struct resource *res;
+ acpi_status status;
+ int ret;
+
++ if (adev->dep_unmet)
++ return -EPROBE_DEFER;
++
+ ua = devm_kzalloc(&pdev->dev, sizeof(*ua), GFP_KERNEL);
+ if (!ua)
+ return -ENOMEM;
+diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
+index 787792c3d08d6..40d5fea8513cf 100644
+--- a/drivers/video/console/Kconfig
++++ b/drivers/video/console/Kconfig
+@@ -21,52 +21,6 @@ config VGA_CONSOLE
+
+ Say Y.
+
+-config VGACON_SOFT_SCROLLBACK
+- bool "Enable Scrollback Buffer in System RAM"
+- depends on VGA_CONSOLE
+- default n
+- help
+- The scrollback buffer of the standard VGA console is located in
+- the VGA RAM. The size of this RAM is fixed and is quite small.
+- If you require a larger scrollback buffer, this can be placed in
+- System RAM which is dynamically allocated during initialization.
+- Placing the scrollback buffer in System RAM will slightly slow
+- down the console.
+-
+- If you want this feature, say 'Y' here and enter the amount of
+- RAM to allocate for this buffer. If unsure, say 'N'.
+-
+-config VGACON_SOFT_SCROLLBACK_SIZE
+- int "Scrollback Buffer Size (in KB)"
+- depends on VGACON_SOFT_SCROLLBACK
+- range 1 1024
+- default "64"
+- help
+- Enter the amount of System RAM to allocate for scrollback
+- buffers of VGA consoles. Each 64KB will give you approximately
+- 16 80x25 screenfuls of scrollback buffer.
+-
+-config VGACON_SOFT_SCROLLBACK_PERSISTENT_ENABLE_BY_DEFAULT
+- bool "Persistent Scrollback History for each console by default"
+- depends on VGACON_SOFT_SCROLLBACK
+- default n
+- help
+- Say Y here if the scrollback history should persist by default when
+- switching between consoles. Otherwise, the scrollback history will be
+- flushed each time the console is switched. This feature can also be
+- enabled using the boot command line parameter
+- 'vgacon.scrollback_persistent=1'.
+-
+- This feature might break your tool of choice to flush the scrollback
+- buffer, e.g. clear(1) will work fine but Debian's clear_console(1)
+- will be broken, which might cause security issues.
+- You can use the escape sequence \e[3J instead if this feature is
+- activated.
+-
+- Note that a buffer of VGACON_SOFT_SCROLLBACK_SIZE is taken for each
+- created tty device.
+- So if you use a RAM-constrained system, say N here.
+-
+ config MDA_CONSOLE
+ depends on !M68K && !PARISC && ISA
+ tristate "MDA text console (dual-headed)"
+diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
+index e079b910feb24..55507df335bdd 100644
+--- a/drivers/video/console/vgacon.c
++++ b/drivers/video/console/vgacon.c
+@@ -165,214 +165,6 @@ static inline void vga_set_mem_top(struct vc_data *c)
+ write_vga(12, (c->vc_visible_origin - vga_vram_base) / 2);
+ }
+
+-#ifdef CONFIG_VGACON_SOFT_SCROLLBACK
+-/* software scrollback */
+-struct vgacon_scrollback_info {
+- void *data;
+- int tail;
+- int size;
+- int rows;
+- int cnt;
+- int cur;
+- int save;
+- int restore;
+-};
+-
+-static struct vgacon_scrollback_info *vgacon_scrollback_cur;
+-static struct vgacon_scrollback_info vgacon_scrollbacks[MAX_NR_CONSOLES];
+-static bool scrollback_persistent = \
+- IS_ENABLED(CONFIG_VGACON_SOFT_SCROLLBACK_PERSISTENT_ENABLE_BY_DEFAULT);
+-module_param_named(scrollback_persistent, scrollback_persistent, bool, 0000);
+-MODULE_PARM_DESC(scrollback_persistent, "Enable persistent scrollback for all vga consoles");
+-
+-static void vgacon_scrollback_reset(int vc_num, size_t reset_size)
+-{
+- struct vgacon_scrollback_info *scrollback = &vgacon_scrollbacks[vc_num];
+-
+- if (scrollback->data && reset_size > 0)
+- memset(scrollback->data, 0, reset_size);
+-
+- scrollback->cnt = 0;
+- scrollback->tail = 0;
+- scrollback->cur = 0;
+-}
+-
+-static void vgacon_scrollback_init(int vc_num)
+-{
+- int pitch = vga_video_num_columns * 2;
+- size_t size = CONFIG_VGACON_SOFT_SCROLLBACK_SIZE * 1024;
+- int rows = size / pitch;
+- void *data;
+-
+- data = kmalloc_array(CONFIG_VGACON_SOFT_SCROLLBACK_SIZE, 1024,
+- GFP_NOWAIT);
+-
+- vgacon_scrollbacks[vc_num].data = data;
+- vgacon_scrollback_cur = &vgacon_scrollbacks[vc_num];
+-
+- vgacon_scrollback_cur->rows = rows - 1;
+- vgacon_scrollback_cur->size = rows * pitch;
+-
+- vgacon_scrollback_reset(vc_num, size);
+-}
+-
+-static void vgacon_scrollback_switch(int vc_num)
+-{
+- if (!scrollback_persistent)
+- vc_num = 0;
+-
+- if (!vgacon_scrollbacks[vc_num].data) {
+- vgacon_scrollback_init(vc_num);
+- } else {
+- if (scrollback_persistent) {
+- vgacon_scrollback_cur = &vgacon_scrollbacks[vc_num];
+- } else {
+- size_t size = CONFIG_VGACON_SOFT_SCROLLBACK_SIZE * 1024;
+-
+- vgacon_scrollback_reset(vc_num, size);
+- }
+- }
+-}
+-
+-static void vgacon_scrollback_startup(void)
+-{
+- vgacon_scrollback_cur = &vgacon_scrollbacks[0];
+- vgacon_scrollback_init(0);
+-}
+-
+-static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
+-{
+- void *p;
+-
+- if (!vgacon_scrollback_cur->data || !vgacon_scrollback_cur->size ||
+- c->vc_num != fg_console)
+- return;
+-
+- p = (void *) (c->vc_origin + t * c->vc_size_row);
+-
+- while (count--) {
+- if ((vgacon_scrollback_cur->tail + c->vc_size_row) >
+- vgacon_scrollback_cur->size)
+- vgacon_scrollback_cur->tail = 0;
+-
+- scr_memcpyw(vgacon_scrollback_cur->data +
+- vgacon_scrollback_cur->tail,
+- p, c->vc_size_row);
+-
+- vgacon_scrollback_cur->cnt++;
+- p += c->vc_size_row;
+- vgacon_scrollback_cur->tail += c->vc_size_row;
+-
+- if (vgacon_scrollback_cur->tail >= vgacon_scrollback_cur->size)
+- vgacon_scrollback_cur->tail = 0;
+-
+- if (vgacon_scrollback_cur->cnt > vgacon_scrollback_cur->rows)
+- vgacon_scrollback_cur->cnt = vgacon_scrollback_cur->rows;
+-
+- vgacon_scrollback_cur->cur = vgacon_scrollback_cur->cnt;
+- }
+-}
+-
+-static void vgacon_restore_screen(struct vc_data *c)
+-{
+- c->vc_origin = c->vc_visible_origin;
+- vgacon_scrollback_cur->save = 0;
+-
+- if (!vga_is_gfx && !vgacon_scrollback_cur->restore) {
+- scr_memcpyw((u16 *) c->vc_origin, (u16 *) c->vc_screenbuf,
+- c->vc_screenbuf_size > vga_vram_size ?
+- vga_vram_size : c->vc_screenbuf_size);
+- vgacon_scrollback_cur->restore = 1;
+- vgacon_scrollback_cur->cur = vgacon_scrollback_cur->cnt;
+- }
+-}
+-
+-static void vgacon_scrolldelta(struct vc_data *c, int lines)
+-{
+- int start, end, count, soff;
+-
+- if (!lines) {
+- vgacon_restore_screen(c);
+- return;
+- }
+-
+- if (!vgacon_scrollback_cur->data)
+- return;
+-
+- if (!vgacon_scrollback_cur->save) {
+- vgacon_cursor(c, CM_ERASE);
+- vgacon_save_screen(c);
+- c->vc_origin = (unsigned long)c->vc_screenbuf;
+- vgacon_scrollback_cur->save = 1;
+- }
+-
+- vgacon_scrollback_cur->restore = 0;
+- start = vgacon_scrollback_cur->cur + lines;
+- end = start + abs(lines);
+-
+- if (start < 0)
+- start = 0;
+-
+- if (start > vgacon_scrollback_cur->cnt)
+- start = vgacon_scrollback_cur->cnt;
+-
+- if (end < 0)
+- end = 0;
+-
+- if (end > vgacon_scrollback_cur->cnt)
+- end = vgacon_scrollback_cur->cnt;
+-
+- vgacon_scrollback_cur->cur = start;
+- count = end - start;
+- soff = vgacon_scrollback_cur->tail -
+- ((vgacon_scrollback_cur->cnt - end) * c->vc_size_row);
+- soff -= count * c->vc_size_row;
+-
+- if (soff < 0)
+- soff += vgacon_scrollback_cur->size;
+-
+- count = vgacon_scrollback_cur->cnt - start;
+-
+- if (count > c->vc_rows)
+- count = c->vc_rows;
+-
+- if (count) {
+- int copysize;
+-
+- int diff = c->vc_rows - count;
+- void *d = (void *) c->vc_visible_origin;
+- void *s = (void *) c->vc_screenbuf;
+-
+- count *= c->vc_size_row;
+- /* how much memory to end of buffer left? */
+- copysize = min(count, vgacon_scrollback_cur->size - soff);
+- scr_memcpyw(d, vgacon_scrollback_cur->data + soff, copysize);
+- d += copysize;
+- count -= copysize;
+-
+- if (count) {
+- scr_memcpyw(d, vgacon_scrollback_cur->data, count);
+- d += count;
+- }
+-
+- if (diff)
+- scr_memcpyw(d, s, diff * c->vc_size_row);
+- } else
+- vgacon_cursor(c, CM_MOVE);
+-}
+-
+-static void vgacon_flush_scrollback(struct vc_data *c)
+-{
+- size_t size = CONFIG_VGACON_SOFT_SCROLLBACK_SIZE * 1024;
+-
+- vgacon_scrollback_reset(c->vc_num, size);
+-}
+-#else
+-#define vgacon_scrollback_startup(...) do { } while (0)
+-#define vgacon_scrollback_init(...) do { } while (0)
+-#define vgacon_scrollback_update(...) do { } while (0)
+-#define vgacon_scrollback_switch(...) do { } while (0)
+-
+ static void vgacon_restore_screen(struct vc_data *c)
+ {
+ if (c->vc_origin != c->vc_visible_origin)
+@@ -386,11 +178,6 @@ static void vgacon_scrolldelta(struct vc_data *c, int lines)
+ vga_set_mem_top(c);
+ }
+
+-static void vgacon_flush_scrollback(struct vc_data *c)
+-{
+-}
+-#endif /* CONFIG_VGACON_SOFT_SCROLLBACK */
+-
+ static const char *vgacon_startup(void)
+ {
+ const char *display_desc = NULL;
+@@ -573,10 +360,7 @@ static const char *vgacon_startup(void)
+ vgacon_xres = screen_info.orig_video_cols * VGA_FONTWIDTH;
+ vgacon_yres = vga_scan_lines;
+
+- if (!vga_init_done) {
+- vgacon_scrollback_startup();
+- vga_init_done = true;
+- }
++ vga_init_done = true;
+
+ return display_desc;
+ }
+@@ -867,7 +651,6 @@ static int vgacon_switch(struct vc_data *c)
+ vgacon_doresize(c, c->vc_cols, c->vc_rows);
+ }
+
+- vgacon_scrollback_switch(c->vc_num);
+ return 0; /* Redrawing not needed */
+ }
+
+@@ -1384,7 +1167,6 @@ static bool vgacon_scroll(struct vc_data *c, unsigned int t, unsigned int b,
+ oldo = c->vc_origin;
+ delta = lines * c->vc_size_row;
+ if (dir == SM_UP) {
+- vgacon_scrollback_update(c, t, lines);
+ if (c->vc_scr_end + delta >= vga_vram_end) {
+ scr_memcpyw((u16 *) vga_vram_base,
+ (u16 *) (oldo + delta),
+@@ -1448,7 +1230,6 @@ const struct consw vga_con = {
+ .con_save_screen = vgacon_save_screen,
+ .con_build_attr = vgacon_build_attr,
+ .con_invert_region = vgacon_invert_region,
+- .con_flush_scrollback = vgacon_flush_scrollback,
+ };
+ EXPORT_SYMBOL(vga_con);
+
+diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
+index 35ebeeccde4df..436365efae731 100644
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -234,7 +234,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
+ }
+
+ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg)
++ int fg, int bg)
+ {
+ struct fb_cursor cursor;
+ struct fbcon_ops *ops = info->fbcon_par;
+@@ -247,15 +247,6 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+
+ cursor.set = 0;
+
+- if (softback_lines) {
+- if (y + softback_lines >= vc->vc_rows) {
+- mode = CM_ERASE;
+- ops->cursor_flash = 0;
+- return;
+- } else
+- y += softback_lines;
+- }
+-
+ c = scr_readw((u16 *) vc->vc_pos);
+ attribute = get_attribute(info, c);
+ src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height));
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index f75557b39a61d..29226b6cb632d 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -102,12 +102,6 @@ static int logo_lines;
+ /* logo_shown is an index to vc_cons when >= 0; otherwise follows FBCON_LOGO
+ enums. */
+ static int logo_shown = FBCON_LOGO_CANSHOW;
+-/* Software scrollback */
+-static int fbcon_softback_size = 32768;
+-static unsigned long softback_buf, softback_curr;
+-static unsigned long softback_in;
+-static unsigned long softback_top, softback_end;
+-static int softback_lines;
+ /* console mappings */
+ static int first_fb_vc;
+ static int last_fb_vc = MAX_NR_CONSOLES - 1;
+@@ -148,8 +142,6 @@ static int margin_color;
+
+ static const struct consw fb_con;
+
+-#define CM_SOFTBACK (8)
+-
+ #define advance_row(p, delta) (unsigned short *)((unsigned long)(p) + (delta) * vc->vc_size_row)
+
+ static int fbcon_set_origin(struct vc_data *);
+@@ -355,18 +347,6 @@ static int get_color(struct vc_data *vc, struct fb_info *info,
+ return color;
+ }
+
+-static void fbcon_update_softback(struct vc_data *vc)
+-{
+- int l = fbcon_softback_size / vc->vc_size_row;
+-
+- if (l > 5)
+- softback_end = softback_buf + l * vc->vc_size_row;
+- else
+- /* Smaller scrollback makes no sense, and 0 would screw
+- the operation totally */
+- softback_top = 0;
+-}
+-
+ static void fb_flashcursor(struct work_struct *work)
+ {
+ struct fb_info *info = container_of(work, struct fb_info, queue);
+@@ -396,7 +376,7 @@ static void fb_flashcursor(struct work_struct *work)
+ c = scr_readw((u16 *) vc->vc_pos);
+ mode = (!ops->cursor_flash || ops->cursor_state.enable) ?
+ CM_ERASE : CM_DRAW;
+- ops->cursor(vc, info, mode, softback_lines, get_color(vc, info, c, 1),
++ ops->cursor(vc, info, mode, get_color(vc, info, c, 1),
+ get_color(vc, info, c, 0));
+ console_unlock();
+ }
+@@ -453,13 +433,7 @@ static int __init fb_console_setup(char *this_opt)
+ }
+
+ if (!strncmp(options, "scrollback:", 11)) {
+- options += 11;
+- if (*options) {
+- fbcon_softback_size = simple_strtoul(options, &options, 0);
+- if (*options == 'k' || *options == 'K') {
+- fbcon_softback_size *= 1024;
+- }
+- }
++ pr_warn("Ignoring scrollback size option\n");
+ continue;
+ }
+
+@@ -988,31 +962,6 @@ static const char *fbcon_startup(void)
+
+ set_blitting_type(vc, info);
+
+- if (info->fix.type != FB_TYPE_TEXT) {
+- if (fbcon_softback_size) {
+- if (!softback_buf) {
+- softback_buf =
+- (unsigned long)
+- kmalloc(fbcon_softback_size,
+- GFP_KERNEL);
+- if (!softback_buf) {
+- fbcon_softback_size = 0;
+- softback_top = 0;
+- }
+- }
+- } else {
+- if (softback_buf) {
+- kfree((void *) softback_buf);
+- softback_buf = 0;
+- softback_top = 0;
+- }
+- }
+- if (softback_buf)
+- softback_in = softback_top = softback_curr =
+- softback_buf;
+- softback_lines = 0;
+- }
+-
+ /* Setup default font */
+ if (!p->fontdata && !vc->vc_font.data) {
+ if (!fontname[0] || !(font = find_font(fontname)))
+@@ -1181,9 +1130,6 @@ static void fbcon_init(struct vc_data *vc, int init)
+ if (logo)
+ fbcon_prepare_logo(vc, info, cols, rows, new_cols, new_rows);
+
+- if (vc == svc && softback_buf)
+- fbcon_update_softback(vc);
+-
+ if (ops->rotate_font && ops->rotate_font(info, vc)) {
+ ops->rotate = FB_ROTATE_UR;
+ set_blitting_type(vc, info);
+@@ -1346,7 +1292,6 @@ static void fbcon_cursor(struct vc_data *vc, int mode)
+ {
+ struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+ struct fbcon_ops *ops = info->fbcon_par;
+- int y;
+ int c = scr_readw((u16 *) vc->vc_pos);
+
+ ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
+@@ -1360,16 +1305,8 @@ static void fbcon_cursor(struct vc_data *vc, int mode)
+ fbcon_add_cursor_timer(info);
+
+ ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1;
+- if (mode & CM_SOFTBACK) {
+- mode &= ~CM_SOFTBACK;
+- y = softback_lines;
+- } else {
+- if (softback_lines)
+- fbcon_set_origin(vc);
+- y = 0;
+- }
+
+- ops->cursor(vc, info, mode, y, get_color(vc, info, c, 1),
++ ops->cursor(vc, info, mode, get_color(vc, info, c, 1),
+ get_color(vc, info, c, 0));
+ }
+
+@@ -1440,8 +1377,6 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var,
+
+ if (con_is_visible(vc)) {
+ update_screen(vc);
+- if (softback_buf)
+- fbcon_update_softback(vc);
+ }
+ }
+
+@@ -1579,99 +1514,6 @@ static __inline__ void ypan_down_redraw(struct vc_data *vc, int t, int count)
+ scrollback_current = 0;
+ }
+
+-static void fbcon_redraw_softback(struct vc_data *vc, struct display *p,
+- long delta)
+-{
+- int count = vc->vc_rows;
+- unsigned short *d, *s;
+- unsigned long n;
+- int line = 0;
+-
+- d = (u16 *) softback_curr;
+- if (d == (u16 *) softback_in)
+- d = (u16 *) vc->vc_origin;
+- n = softback_curr + delta * vc->vc_size_row;
+- softback_lines -= delta;
+- if (delta < 0) {
+- if (softback_curr < softback_top && n < softback_buf) {
+- n += softback_end - softback_buf;
+- if (n < softback_top) {
+- softback_lines -=
+- (softback_top - n) / vc->vc_size_row;
+- n = softback_top;
+- }
+- } else if (softback_curr >= softback_top
+- && n < softback_top) {
+- softback_lines -=
+- (softback_top - n) / vc->vc_size_row;
+- n = softback_top;
+- }
+- } else {
+- if (softback_curr > softback_in && n >= softback_end) {
+- n += softback_buf - softback_end;
+- if (n > softback_in) {
+- n = softback_in;
+- softback_lines = 0;
+- }
+- } else if (softback_curr <= softback_in && n > softback_in) {
+- n = softback_in;
+- softback_lines = 0;
+- }
+- }
+- if (n == softback_curr)
+- return;
+- softback_curr = n;
+- s = (u16 *) softback_curr;
+- if (s == (u16 *) softback_in)
+- s = (u16 *) vc->vc_origin;
+- while (count--) {
+- unsigned short *start;
+- unsigned short *le;
+- unsigned short c;
+- int x = 0;
+- unsigned short attr = 1;
+-
+- start = s;
+- le = advance_row(s, 1);
+- do {
+- c = scr_readw(s);
+- if (attr != (c & 0xff00)) {
+- attr = c & 0xff00;
+- if (s > start) {
+- fbcon_putcs(vc, start, s - start,
+- line, x);
+- x += s - start;
+- start = s;
+- }
+- }
+- if (c == scr_readw(d)) {
+- if (s > start) {
+- fbcon_putcs(vc, start, s - start,
+- line, x);
+- x += s - start + 1;
+- start = s + 1;
+- } else {
+- x++;
+- start++;
+- }
+- }
+- s++;
+- d++;
+- } while (s < le);
+- if (s > start)
+- fbcon_putcs(vc, start, s - start, line, x);
+- line++;
+- if (d == (u16 *) softback_end)
+- d = (u16 *) softback_buf;
+- if (d == (u16 *) softback_in)
+- d = (u16 *) vc->vc_origin;
+- if (s == (u16 *) softback_end)
+- s = (u16 *) softback_buf;
+- if (s == (u16 *) softback_in)
+- s = (u16 *) vc->vc_origin;
+- }
+-}
+-
+ static void fbcon_redraw_move(struct vc_data *vc, struct display *p,
+ int line, int count, int dy)
+ {
+@@ -1811,31 +1653,6 @@ static void fbcon_redraw(struct vc_data *vc, struct display *p,
+ }
+ }
+
+-static inline void fbcon_softback_note(struct vc_data *vc, int t,
+- int count)
+-{
+- unsigned short *p;
+-
+- if (vc->vc_num != fg_console)
+- return;
+- p = (unsigned short *) (vc->vc_origin + t * vc->vc_size_row);
+-
+- while (count) {
+- scr_memcpyw((u16 *) softback_in, p, vc->vc_size_row);
+- count--;
+- p = advance_row(p, 1);
+- softback_in += vc->vc_size_row;
+- if (softback_in == softback_end)
+- softback_in = softback_buf;
+- if (softback_in == softback_top) {
+- softback_top += vc->vc_size_row;
+- if (softback_top == softback_end)
+- softback_top = softback_buf;
+- }
+- }
+- softback_curr = softback_in;
+-}
+-
+ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b,
+ enum con_scroll dir, unsigned int count)
+ {
+@@ -1858,8 +1675,6 @@ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b,
+ case SM_UP:
+ if (count > vc->vc_rows) /* Maximum realistic size */
+ count = vc->vc_rows;
+- if (softback_top)
+- fbcon_softback_note(vc, t, count);
+ if (logo_shown >= 0)
+ goto redraw_up;
+ switch (p->scrollmode) {
+@@ -2230,14 +2045,6 @@ static int fbcon_switch(struct vc_data *vc)
+ info = registered_fb[con2fb_map[vc->vc_num]];
+ ops = info->fbcon_par;
+
+- if (softback_top) {
+- if (softback_lines)
+- fbcon_set_origin(vc);
+- softback_top = softback_curr = softback_in = softback_buf;
+- softback_lines = 0;
+- fbcon_update_softback(vc);
+- }
+-
+ if (logo_shown >= 0) {
+ struct vc_data *conp2 = vc_cons[logo_shown].d;
+
+@@ -2571,9 +2378,6 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
+ int cnt;
+ char *old_data = NULL;
+
+- if (con_is_visible(vc) && softback_lines)
+- fbcon_set_origin(vc);
+-
+ resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
+ if (p->userfont)
+ old_data = vc->vc_font.data;
+@@ -2599,8 +2403,6 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
+ cols /= w;
+ rows /= h;
+ vc_resize(vc, cols, rows);
+- if (con_is_visible(vc) && softback_buf)
+- fbcon_update_softback(vc);
+ } else if (con_is_visible(vc)
+ && vc->vc_mode == KD_TEXT) {
+ fbcon_clear_margins(vc, 0);
+@@ -2759,19 +2561,7 @@ static void fbcon_set_palette(struct vc_data *vc, const unsigned char *table)
+
+ static u16 *fbcon_screen_pos(struct vc_data *vc, int offset)
+ {
+- unsigned long p;
+- int line;
+-
+- if (vc->vc_num != fg_console || !softback_lines)
+- return (u16 *) (vc->vc_origin + offset);
+- line = offset / vc->vc_size_row;
+- if (line >= softback_lines)
+- return (u16 *) (vc->vc_origin + offset -
+- softback_lines * vc->vc_size_row);
+- p = softback_curr + offset;
+- if (p >= softback_end)
+- p += softback_buf - softback_end;
+- return (u16 *) p;
++ return (u16 *) (vc->vc_origin + offset);
+ }
+
+ static unsigned long fbcon_getxy(struct vc_data *vc, unsigned long pos,
+@@ -2785,22 +2575,7 @@ static unsigned long fbcon_getxy(struct vc_data *vc, unsigned long pos,
+
+ x = offset % vc->vc_cols;
+ y = offset / vc->vc_cols;
+- if (vc->vc_num == fg_console)
+- y += softback_lines;
+ ret = pos + (vc->vc_cols - x) * 2;
+- } else if (vc->vc_num == fg_console && softback_lines) {
+- unsigned long offset = pos - softback_curr;
+-
+- if (pos < softback_curr)
+- offset += softback_end - softback_buf;
+- offset /= 2;
+- x = offset % vc->vc_cols;
+- y = offset / vc->vc_cols;
+- ret = pos + (vc->vc_cols - x) * 2;
+- if (ret == softback_end)
+- ret = softback_buf;
+- if (ret == softback_in)
+- ret = vc->vc_origin;
+ } else {
+ /* Should not happen */
+ x = y = 0;
+@@ -2828,106 +2603,11 @@ static void fbcon_invert_region(struct vc_data *vc, u16 * p, int cnt)
+ a = ((a) & 0x88ff) | (((a) & 0x7000) >> 4) |
+ (((a) & 0x0700) << 4);
+ scr_writew(a, p++);
+- if (p == (u16 *) softback_end)
+- p = (u16 *) softback_buf;
+- if (p == (u16 *) softback_in)
+- p = (u16 *) vc->vc_origin;
+ }
+ }
+
+-static void fbcon_scrolldelta(struct vc_data *vc, int lines)
+-{
+- struct fb_info *info = registered_fb[con2fb_map[fg_console]];
+- struct fbcon_ops *ops = info->fbcon_par;
+- struct display *disp = &fb_display[fg_console];
+- int offset, limit, scrollback_old;
+-
+- if (softback_top) {
+- if (vc->vc_num != fg_console)
+- return;
+- if (vc->vc_mode != KD_TEXT || !lines)
+- return;
+- if (logo_shown >= 0) {
+- struct vc_data *conp2 = vc_cons[logo_shown].d;
+-
+- if (conp2->vc_top == logo_lines
+- && conp2->vc_bottom == conp2->vc_rows)
+- conp2->vc_top = 0;
+- if (logo_shown == vc->vc_num) {
+- unsigned long p, q;
+- int i;
+-
+- p = softback_in;
+- q = vc->vc_origin +
+- logo_lines * vc->vc_size_row;
+- for (i = 0; i < logo_lines; i++) {
+- if (p == softback_top)
+- break;
+- if (p == softback_buf)
+- p = softback_end;
+- p -= vc->vc_size_row;
+- q -= vc->vc_size_row;
+- scr_memcpyw((u16 *) q, (u16 *) p,
+- vc->vc_size_row);
+- }
+- softback_in = softback_curr = p;
+- update_region(vc, vc->vc_origin,
+- logo_lines * vc->vc_cols);
+- }
+- logo_shown = FBCON_LOGO_CANSHOW;
+- }
+- fbcon_cursor(vc, CM_ERASE | CM_SOFTBACK);
+- fbcon_redraw_softback(vc, disp, lines);
+- fbcon_cursor(vc, CM_DRAW | CM_SOFTBACK);
+- return;
+- }
+-
+- if (!scrollback_phys_max)
+- return;
+-
+- scrollback_old = scrollback_current;
+- scrollback_current -= lines;
+- if (scrollback_current < 0)
+- scrollback_current = 0;
+- else if (scrollback_current > scrollback_max)
+- scrollback_current = scrollback_max;
+- if (scrollback_current == scrollback_old)
+- return;
+-
+- if (fbcon_is_inactive(vc, info))
+- return;
+-
+- fbcon_cursor(vc, CM_ERASE);
+-
+- offset = disp->yscroll - scrollback_current;
+- limit = disp->vrows;
+- switch (disp->scrollmode) {
+- case SCROLL_WRAP_MOVE:
+- info->var.vmode |= FB_VMODE_YWRAP;
+- break;
+- case SCROLL_PAN_MOVE:
+- case SCROLL_PAN_REDRAW:
+- limit -= vc->vc_rows;
+- info->var.vmode &= ~FB_VMODE_YWRAP;
+- break;
+- }
+- if (offset < 0)
+- offset += limit;
+- else if (offset >= limit)
+- offset -= limit;
+-
+- ops->var.xoffset = 0;
+- ops->var.yoffset = offset * vc->vc_font.height;
+- ops->update_start(info);
+-
+- if (!scrollback_current)
+- fbcon_cursor(vc, CM_DRAW);
+-}
+-
+ static int fbcon_set_origin(struct vc_data *vc)
+ {
+- if (softback_lines)
+- fbcon_scrolldelta(vc, softback_lines);
+ return 0;
+ }
+
+@@ -2991,8 +2671,6 @@ static void fbcon_modechanged(struct fb_info *info)
+
+ fbcon_set_palette(vc, color_table);
+ update_screen(vc);
+- if (softback_buf)
+- fbcon_update_softback(vc);
+ }
+ }
+
+@@ -3434,7 +3112,6 @@ static const struct consw fb_con = {
+ .con_font_default = fbcon_set_def_font,
+ .con_font_copy = fbcon_copy_font,
+ .con_set_palette = fbcon_set_palette,
+- .con_scrolldelta = fbcon_scrolldelta,
+ .con_set_origin = fbcon_set_origin,
+ .con_invert_region = fbcon_invert_region,
+ .con_screen_pos = fbcon_screen_pos,
+@@ -3691,9 +3368,6 @@ static void fbcon_exit(void)
+ }
+ #endif
+
+- kfree((void *)softback_buf);
+- softback_buf = 0UL;
+-
+ for_each_registered_fb(i) {
+ int pending = 0;
+
+diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h
+index 21912a3ba32f8..aeea63abbe987 100644
+--- a/drivers/video/fbdev/core/fbcon.h
++++ b/drivers/video/fbdev/core/fbcon.h
+@@ -62,7 +62,7 @@ struct fbcon_ops {
+ void (*clear_margins)(struct vc_data *vc, struct fb_info *info,
+ int color, int bottom_only);
+ void (*cursor)(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg);
++ int fg, int bg);
+ int (*update_start)(struct fb_info *info);
+ int (*rotate_font)(struct fb_info *info, struct vc_data *vc);
+ struct fb_var_screeninfo var; /* copy of the current fb_var_screeninfo */
+diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c
+index 78f3a56214782..71ad6967a70ee 100644
+--- a/drivers/video/fbdev/core/fbcon_ccw.c
++++ b/drivers/video/fbdev/core/fbcon_ccw.c
+@@ -219,7 +219,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ }
+
+ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg)
++ int fg, int bg)
+ {
+ struct fb_cursor cursor;
+ struct fbcon_ops *ops = info->fbcon_par;
+@@ -236,15 +236,6 @@ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+
+ cursor.set = 0;
+
+- if (softback_lines) {
+- if (y + softback_lines >= vc->vc_rows) {
+- mode = CM_ERASE;
+- ops->cursor_flash = 0;
+- return;
+- } else
+- y += softback_lines;
+- }
+-
+ c = scr_readw((u16 *) vc->vc_pos);
+ attribute = get_attribute(info, c);
+ src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
+diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c
+index fd098ff17574b..31fe5dd651d44 100644
+--- a/drivers/video/fbdev/core/fbcon_cw.c
++++ b/drivers/video/fbdev/core/fbcon_cw.c
+@@ -202,7 +202,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ }
+
+ static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg)
++ int fg, int bg)
+ {
+ struct fb_cursor cursor;
+ struct fbcon_ops *ops = info->fbcon_par;
+@@ -219,15 +219,6 @@ static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+
+ cursor.set = 0;
+
+- if (softback_lines) {
+- if (y + softback_lines >= vc->vc_rows) {
+- mode = CM_ERASE;
+- ops->cursor_flash = 0;
+- return;
+- } else
+- y += softback_lines;
+- }
+-
+ c = scr_readw((u16 *) vc->vc_pos);
+ attribute = get_attribute(info, c);
+ src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
+diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c
+index e165a3fad29ad..b2dd1370e39b2 100644
+--- a/drivers/video/fbdev/core/fbcon_ud.c
++++ b/drivers/video/fbdev/core/fbcon_ud.c
+@@ -249,7 +249,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
+ }
+
+ static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg)
++ int fg, int bg)
+ {
+ struct fb_cursor cursor;
+ struct fbcon_ops *ops = info->fbcon_par;
+@@ -267,15 +267,6 @@ static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+
+ cursor.set = 0;
+
+- if (softback_lines) {
+- if (y + softback_lines >= vc->vc_rows) {
+- mode = CM_ERASE;
+- ops->cursor_flash = 0;
+- return;
+- } else
+- y += softback_lines;
+- }
+-
+ c = scr_readw((u16 *) vc->vc_pos);
+ attribute = get_attribute(info, c);
+ src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.height));
+diff --git a/drivers/video/fbdev/core/tileblit.c b/drivers/video/fbdev/core/tileblit.c
+index 93390312957ff..eb664dbf96f66 100644
+--- a/drivers/video/fbdev/core/tileblit.c
++++ b/drivers/video/fbdev/core/tileblit.c
+@@ -80,7 +80,7 @@ static void tile_clear_margins(struct vc_data *vc, struct fb_info *info,
+ }
+
+ static void tile_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg)
++ int fg, int bg)
+ {
+ struct fb_tilecursor cursor;
+ int use_sw = (vc->vc_cursor_type & 0x10);
+diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c
+index 2c6a576ed84c7..4b83109202b1c 100644
+--- a/drivers/video/fbdev/vga16fb.c
++++ b/drivers/video/fbdev/vga16fb.c
+@@ -1121,7 +1121,7 @@ static void vga_8planes_imageblit(struct fb_info *info, const struct fb_image *i
+ char oldop = setop(0);
+ char oldsr = setsr(0);
+ char oldmask = selectmask();
+- const char *cdat = image->data;
++ const unsigned char *cdat = image->data;
+ u32 dx = image->dx;
+ char __iomem *where;
+ int y;
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index ec3aa76d19b7f..319a89d4d0735 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1057,12 +1057,11 @@ int btrfs_get_extent_inline_ref_type(const struct extent_buffer *eb,
+ if (type == BTRFS_SHARED_BLOCK_REF_KEY) {
+ ASSERT(eb->fs_info);
+ /*
+- * Every shared one has parent tree
+- * block, which must be aligned to
+- * nodesize.
++ * Every shared one has parent tree block,
++ * which must be aligned to sector size.
+ */
+ if (offset &&
+- IS_ALIGNED(offset, eb->fs_info->nodesize))
++ IS_ALIGNED(offset, eb->fs_info->sectorsize))
+ return type;
+ }
+ } else if (is_data == BTRFS_REF_TYPE_DATA) {
+@@ -1071,12 +1070,11 @@ int btrfs_get_extent_inline_ref_type(const struct extent_buffer *eb,
+ if (type == BTRFS_SHARED_DATA_REF_KEY) {
+ ASSERT(eb->fs_info);
+ /*
+- * Every shared one has parent tree
+- * block, which must be aligned to
+- * nodesize.
++ * Every shared one has parent tree block,
++ * which must be aligned to sector size.
+ */
+ if (offset &&
+- IS_ALIGNED(offset, eb->fs_info->nodesize))
++ IS_ALIGNED(offset, eb->fs_info->sectorsize))
+ return type;
+ }
+ } else {
+@@ -1086,8 +1084,9 @@ int btrfs_get_extent_inline_ref_type(const struct extent_buffer *eb,
+ }
+
+ btrfs_print_leaf((struct extent_buffer *)eb);
+- btrfs_err(eb->fs_info, "eb %llu invalid extent inline ref type %d",
+- eb->start, type);
++ btrfs_err(eb->fs_info,
++ "eb %llu iref 0x%lx invalid extent inline ref type %d",
++ eb->start, (unsigned long)iref, type);
+ WARN_ON(1);
+
+ return BTRFS_REF_TYPE_INVALID;
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 85990755edd90..01a90fa03c24f 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2189,7 +2189,8 @@ static noinline int search_ioctl(struct inode *inode,
+ key.offset = sk->min_offset;
+
+ while (1) {
+- ret = fault_in_pages_writeable(ubuf, *buf_size - sk_offset);
++ ret = fault_in_pages_writeable(ubuf + sk_offset,
++ *buf_size - sk_offset);
+ if (ret)
+ break;
+
+diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
+index df49931ffe922..4b217e9a581ce 100644
+--- a/fs/btrfs/print-tree.c
++++ b/fs/btrfs/print-tree.c
+@@ -95,9 +95,10 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
+ * offset is supposed to be a tree block which
+ * must be aligned to nodesize.
+ */
+- if (!IS_ALIGNED(offset, eb->fs_info->nodesize))
+- pr_info("\t\t\t(parent %llu is NOT ALIGNED to nodesize %llu)\n",
+- offset, (unsigned long long)eb->fs_info->nodesize);
++ if (!IS_ALIGNED(offset, eb->fs_info->sectorsize))
++ pr_info(
++ "\t\t\t(parent %llu not aligned to sectorsize %u)\n",
++ offset, eb->fs_info->sectorsize);
+ break;
+ case BTRFS_EXTENT_DATA_REF_KEY:
+ dref = (struct btrfs_extent_data_ref *)(&iref->offset);
+@@ -112,8 +113,9 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
+ * must be aligned to nodesize.
+ */
+ if (!IS_ALIGNED(offset, eb->fs_info->nodesize))
+- pr_info("\t\t\t(parent %llu is NOT ALIGNED to nodesize %llu)\n",
+- offset, (unsigned long long)eb->fs_info->nodesize);
++ pr_info(
++ "\t\t\t(parent %llu not aligned to sectorsize %u)\n",
++ offset, eb->fs_info->sectorsize);
+ break;
+ default:
+ pr_cont("(extent %llu has INVALID ref type %d)\n",
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 498ec4b10e610..815b655b8f10a 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4,6 +4,7 @@
+ */
+
+ #include <linux/sched.h>
++#include <linux/sched/mm.h>
+ #include <linux/bio.h>
+ #include <linux/slab.h>
+ #include <linux/buffer_head.h>
+@@ -6292,8 +6293,17 @@ static struct btrfs_device *add_missing_dev(struct btrfs_fs_devices *fs_devices,
+ u64 devid, u8 *dev_uuid)
+ {
+ struct btrfs_device *device;
++ unsigned int nofs_flag;
+
++ /*
++ * We call this under the chunk_mutex, so we want to use NOFS for this
++ * allocation, however we don't want to change btrfs_alloc_device() to
++ * always do NOFS because we use it in a lot of other GFP_KERNEL safe
++ * places.
++ */
++ nofs_flag = memalloc_nofs_save();
+ device = btrfs_alloc_device(NULL, &devid, dev_uuid);
++ memalloc_nofs_restore(nofs_flag);
+ if (IS_ERR(device))
+ return device;
+
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index 087a5715cf20e..bd37f4a292c3b 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -551,8 +551,8 @@ xfs_attr_shortform_create(xfs_da_args_t *args)
+ ASSERT(ifp->if_flags & XFS_IFINLINE);
+ }
+ xfs_idata_realloc(dp, sizeof(*hdr), XFS_ATTR_FORK);
+- hdr = (xfs_attr_sf_hdr_t *)ifp->if_u1.if_data;
+- hdr->count = 0;
++ hdr = (struct xfs_attr_sf_hdr *)ifp->if_u1.if_data;
++ memset(hdr, 0, sizeof(*hdr));
+ hdr->totsize = cpu_to_be16(sizeof(*hdr));
+ xfs_trans_log_inode(args->trans, dp, XFS_ILOG_CORE | XFS_ILOG_ADATA);
+ }
+diff --git a/include/linux/netfilter/nf_conntrack_sctp.h b/include/linux/netfilter/nf_conntrack_sctp.h
+index 9a33f171aa822..625f491b95de8 100644
+--- a/include/linux/netfilter/nf_conntrack_sctp.h
++++ b/include/linux/netfilter/nf_conntrack_sctp.h
+@@ -9,6 +9,8 @@ struct ip_ct_sctp {
+ enum sctp_conntrack state;
+
+ __be32 vtag[IP_CT_DIR_MAX];
++ u8 last_dir;
++ u8 flags;
+ };
+
+ #endif /* _NF_CONNTRACK_SCTP_H */
+diff --git a/include/soc/nps/common.h b/include/soc/nps/common.h
+index 9b1d43d671a3f..8c18dc6d3fde5 100644
+--- a/include/soc/nps/common.h
++++ b/include/soc/nps/common.h
+@@ -45,6 +45,12 @@
+ #define CTOP_INST_MOV2B_FLIP_R3_B1_B2_INST 0x5B60
+ #define CTOP_INST_MOV2B_FLIP_R3_B1_B2_LIMM 0x00010422
+
++#ifndef AUX_IENABLE
++#define AUX_IENABLE 0x40c
++#endif
++
++#define CTOP_AUX_IACK (0xFFFFF800 + 0x088)
++
+ #ifndef __ASSEMBLY__
+
+ /* In order to increase compilation test coverage */
+diff --git a/kernel/gcov/gcc_4_7.c b/kernel/gcov/gcc_4_7.c
+index ca5e5c0ef8536..5b9e76117ded1 100644
+--- a/kernel/gcov/gcc_4_7.c
++++ b/kernel/gcov/gcc_4_7.c
+@@ -19,7 +19,9 @@
+ #include <linux/vmalloc.h>
+ #include "gcov.h"
+
+-#if (__GNUC__ >= 7)
++#if (__GNUC__ >= 10)
++#define GCOV_COUNTERS 8
++#elif (__GNUC__ >= 7)
+ #define GCOV_COUNTERS 9
+ #elif (__GNUC__ > 5) || (__GNUC__ == 5 && __GNUC_MINOR__ >= 1)
+ #define GCOV_COUNTERS 10
+diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
+index 7d7e30ea0ecf9..a937d4f75613f 100644
+--- a/net/netfilter/nf_conntrack_proto_sctp.c
++++ b/net/netfilter/nf_conntrack_proto_sctp.c
+@@ -65,6 +65,8 @@ static const unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] = {
+ [SCTP_CONNTRACK_HEARTBEAT_ACKED] = 210 SECS,
+ };
+
++#define SCTP_FLAG_HEARTBEAT_VTAG_FAILED 1
++
+ #define sNO SCTP_CONNTRACK_NONE
+ #define sCL SCTP_CONNTRACK_CLOSED
+ #define sCW SCTP_CONNTRACK_COOKIE_WAIT
+@@ -288,6 +290,7 @@ static int sctp_packet(struct nf_conn *ct,
+ u_int32_t offset, count;
+ unsigned int *timeouts;
+ unsigned long map[256 / sizeof(unsigned long)] = { 0 };
++ bool ignore = false;
+
+ sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
+ if (sh == NULL)
+@@ -332,15 +335,39 @@ static int sctp_packet(struct nf_conn *ct,
+ /* Sec 8.5.1 (D) */
+ if (sh->vtag != ct->proto.sctp.vtag[dir])
+ goto out_unlock;
+- } else if (sch->type == SCTP_CID_HEARTBEAT ||
+- sch->type == SCTP_CID_HEARTBEAT_ACK) {
++ } else if (sch->type == SCTP_CID_HEARTBEAT) {
++ if (ct->proto.sctp.vtag[dir] == 0) {
++ pr_debug("Setting %d vtag %x for dir %d\n", sch->type, sh->vtag, dir);
++ ct->proto.sctp.vtag[dir] = sh->vtag;
++ } else if (sh->vtag != ct->proto.sctp.vtag[dir]) {
++ if (test_bit(SCTP_CID_DATA, map) || ignore)
++ goto out_unlock;
++
++ ct->proto.sctp.flags |= SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ ct->proto.sctp.last_dir = dir;
++ ignore = true;
++ continue;
++ } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) {
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ }
++ } else if (sch->type == SCTP_CID_HEARTBEAT_ACK) {
+ if (ct->proto.sctp.vtag[dir] == 0) {
+ pr_debug("Setting vtag %x for dir %d\n",
+ sh->vtag, dir);
+ ct->proto.sctp.vtag[dir] = sh->vtag;
+ } else if (sh->vtag != ct->proto.sctp.vtag[dir]) {
+- pr_debug("Verification tag check failed\n");
+- goto out_unlock;
++ if (test_bit(SCTP_CID_DATA, map) || ignore)
++ goto out_unlock;
++
++ if ((ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) == 0 ||
++ ct->proto.sctp.last_dir == dir)
++ goto out_unlock;
++
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ ct->proto.sctp.vtag[dir] = sh->vtag;
++ ct->proto.sctp.vtag[!dir] = 0;
++ } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) {
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
+ }
+ }
+
+@@ -375,6 +402,10 @@ static int sctp_packet(struct nf_conn *ct,
+ }
+ spin_unlock_bh(&ct->lock);
+
++ /* allow but do not refresh timeout */
++ if (ignore)
++ return NF_ACCEPT;
++
+ timeouts = nf_ct_timeout_lookup(ct);
+ if (!timeouts)
+ timeouts = sctp_pernet(nf_ct_net(ct))->timeouts;
+diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c
+index dbf02a3a8d2f2..58b53a4bc4d01 100644
+--- a/sound/hda/hdac_device.c
++++ b/sound/hda/hdac_device.c
+@@ -124,6 +124,8 @@ EXPORT_SYMBOL_GPL(snd_hdac_device_init);
+ void snd_hdac_device_exit(struct hdac_device *codec)
+ {
+ pm_runtime_put_noidle(&codec->dev);
++ /* keep balance of runtime PM child_count in parent device */
++ pm_runtime_set_suspended(&codec->dev);
+ snd_hdac_bus_remove_device(codec->bus, codec);
+ kfree(codec->vendor_name);
+ kfree(codec->chip_name);
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index b8e5f2b19ff85..708efb9b43877 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3431,6 +3431,7 @@ static int tegra_hdmi_build_pcms(struct hda_codec *codec)
+
+ static int patch_tegra_hdmi(struct hda_codec *codec)
+ {
++ struct hdmi_spec *spec;
+ int err;
+
+ err = patch_generic_hdmi(codec);
+@@ -3438,6 +3439,10 @@ static int patch_tegra_hdmi(struct hda_codec *codec)
+ return err;
+
+ codec->patch_ops.build_pcms = tegra_hdmi_build_pcms;
++ spec = codec->spec;
++ spec->chmap.ops.chmap_cea_alloc_validate_get_type =
++ nvhdmi_chmap_cea_alloc_validate_get_type;
++ spec->chmap.ops.chmap_validate = nvhdmi_chmap_validate;
+
+ return 0;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-09-17 15:01 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-09-17 15:01 UTC (permalink / raw
To: gentoo-commits
commit: e4110c1227bc615bec77a318ea7dbde5b740404f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 17 15:00:38 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Sep 17 15:00:38 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e4110c12
Removal of unsupported fbcondecor patch
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 -
4200_fbcondecor.patch | 2095 -------------------------------------------------
2 files changed, 2099 deletions(-)
diff --git a/0000_README b/0000_README
index 4416605..5d9a94a 100644
--- a/0000_README
+++ b/0000_README
@@ -639,10 +639,6 @@ Patch: 2600_enable-key-swapping-for-apple-mac.patch
From: https://github.com/free5lot/hid-apple-patched
Desc: This hid-apple patch enables swapping of the FN and left Control keys and some additional on some apple keyboards. See bug #622902
-Patch: 4200_fbcondecor.patch
-From: http://www.mepiscommunity.org/fbcondecor
-Desc: Bootsplash ported by Conrad Kostecki. (Bug #637434)
-
Patch: 4400_alpha-sysctl-uac.patch
From: Tobias Klausmann (klausman@gentoo.org) and http://bugs.gentoo.org/show_bug.cgi?id=217323
Desc: Enable control of the unaligned access control policy from sysctl
diff --git a/4200_fbcondecor.patch b/4200_fbcondecor.patch
deleted file mode 100644
index 7151d0f..0000000
--- a/4200_fbcondecor.patch
+++ /dev/null
@@ -1,2095 +0,0 @@
-diff --git a/Documentation/fb/00-INDEX b/Documentation/fb/00-INDEX
-index fe85e7c5907a..22309308ba56 100644
---- a/Documentation/fb/00-INDEX
-+++ b/Documentation/fb/00-INDEX
-@@ -23,6 +23,8 @@ ep93xx-fb.txt
- - info on the driver for EP93xx LCD controller.
- fbcon.txt
- - intro to and usage guide for the framebuffer console (fbcon).
-+fbcondecor.txt
-+ - info on the Framebuffer Console Decoration
- framebuffer.txt
- - introduction to frame buffer devices.
- gxfb.txt
-diff --git a/Documentation/fb/fbcondecor.txt b/Documentation/fb/fbcondecor.txt
-new file mode 100644
-index 000000000000..637209e11ccd
---- /dev/null
-+++ b/Documentation/fb/fbcondecor.txt
-@@ -0,0 +1,207 @@
-+What is it?
-+-----------
-+
-+The framebuffer decorations are a kernel feature which allows displaying a
-+background picture on selected consoles.
-+
-+What do I need to get it to work?
-+---------------------------------
-+
-+To get fbcondecor up-and-running you will have to:
-+ 1) get a copy of splashutils [1] or a similar program
-+ 2) get some fbcondecor themes
-+ 3) build the kernel helper program
-+ 4) build your kernel with the FB_CON_DECOR option enabled.
-+
-+To get fbcondecor operational right after fbcon initialization is finished, you
-+will have to include a theme and the kernel helper into your initramfs image.
-+Please refer to splashutils documentation for instructions on how to do that.
-+
-+[1] The splashutils package can be downloaded from:
-+ http://github.com/alanhaggai/fbsplash
-+
-+The userspace helper
-+--------------------
-+
-+The userspace fbcondecor helper (by default: /sbin/fbcondecor_helper) is called by the
-+kernel whenever an important event occurs and the kernel needs some kind of
-+job to be carried out. Important events include console switches and video
-+mode switches (the kernel requests background images and configuration
-+parameters for the current console). The fbcondecor helper must be accessible at
-+all times. If it's not, fbcondecor will be switched off automatically.
-+
-+It's possible to set path to the fbcondecor helper by writing it to
-+/proc/sys/kernel/fbcondecor.
-+
-+*****************************************************************************
-+
-+The information below is mostly technical stuff. There's probably no need to
-+read it unless you plan to develop a userspace helper.
-+
-+The fbcondecor protocol
-+-----------------------
-+
-+The fbcondecor protocol defines a communication interface between the kernel and
-+the userspace fbcondecor helper.
-+
-+The kernel side is responsible for:
-+
-+ * rendering console text, using an image as a background (instead of a
-+ standard solid color fbcon uses),
-+ * accepting commands from the user via ioctls on the fbcondecor device,
-+ * calling the userspace helper to set things up as soon as the fb subsystem
-+ is initialized.
-+
-+The userspace helper is responsible for everything else, including parsing
-+configuration files, decompressing the image files whenever the kernel needs
-+it, and communicating with the kernel if necessary.
-+
-+The fbcondecor protocol specifies how communication is done in both ways:
-+kernel->userspace and userspace->helper.
-+
-+Kernel -> Userspace
-+-------------------
-+
-+The kernel communicates with the userspace helper by calling it and specifying
-+the task to be done in a series of arguments.
-+
-+The arguments follow the pattern:
-+<fbcondecor protocol version> <command> <parameters>
-+
-+All commands defined in fbcondecor protocol v2 have the following parameters:
-+ virtual console
-+ framebuffer number
-+ theme
-+
-+Fbcondecor protocol v1 specified an additional 'fbcondecor mode' after the
-+framebuffer number. Fbcondecor protocol v1 is deprecated and should not be used.
-+
-+Fbcondecor protocol v2 specifies the following commands:
-+
-+getpic
-+------
-+ The kernel issues this command to request image data. It's up to the
-+ userspace helper to find a background image appropriate for the specified
-+ theme and the current resolution. The userspace helper should respond by
-+ issuing the FBIOCONDECOR_SETPIC ioctl.
-+
-+init
-+----
-+ The kernel issues this command after the fbcondecor device is created and
-+ the fbcondecor interface is initialized. Upon receiving 'init', the userspace
-+ helper should parse the kernel command line (/proc/cmdline) or otherwise
-+ decide whether fbcondecor is to be activated.
-+
-+ To activate fbcondecor on the first console the helper should issue the
-+ FBIOCONDECOR_SETCFG, FBIOCONDECOR_SETPIC and FBIOCONDECOR_SETSTATE commands,
-+ in the above-mentioned order.
-+
-+ When the userspace helper is called in an early phase of the boot process
-+ (right after the initialization of fbcon), no filesystems will be mounted.
-+ The helper program should mount sysfs and then create the appropriate
-+ framebuffer, fbcondecor and tty0 devices (if they don't already exist) to get
-+ current display settings and to be able to communicate with the kernel side.
-+ It should probably also mount the procfs to be able to parse the kernel
-+ command line parameters.
-+
-+ Note that the console sem is not held when the kernel calls fbcondecor_helper
-+ with the 'init' command. The fbcondecor helper should perform all ioctls with
-+ origin set to FBCON_DECOR_IO_ORIG_USER.
-+
-+modechange
-+----------
-+ The kernel issues this command on a mode change. The helper's response should
-+ be similar to the response to the 'init' command. Note that this time the
-+ console sem is held and all ioctls must be performed with origin set to
-+ FBCON_DECOR_IO_ORIG_KERNEL.
-+
-+
-+Userspace -> Kernel
-+-------------------
-+
-+Userspace programs can communicate with fbcondecor via ioctls on the
-+fbcondecor device. These ioctls are to be used by both the userspace helper
-+(called only by the kernel) and userspace configuration tools (run by the users).
-+
-+The fbcondecor helper should set the origin field to FBCON_DECOR_IO_ORIG_KERNEL
-+when doing the appropriate ioctls. All userspace configuration tools should
-+use FBCON_DECOR_IO_ORIG_USER. Failure to set the appropriate value in the origin
-+field when performing ioctls from the kernel helper will most likely result
-+in a console deadlock.
-+
-+FBCON_DECOR_IO_ORIG_KERNEL instructs fbcondecor not to try to acquire the console
-+semaphore. Not surprisingly, FBCON_DECOR_IO_ORIG_USER instructs it to acquire
-+the console sem.
-+
-+The framebuffer console decoration provides the following ioctls (all defined in
-+linux/fb.h):
-+
-+FBIOCONDECOR_SETPIC
-+description: loads a background picture for a virtual console
-+argument: struct fbcon_decor_iowrapper*; data: struct fb_image*
-+notes:
-+If called for consoles other than the current foreground one, the picture data
-+will be ignored.
-+
-+If the current virtual console is running in a 8-bpp mode, the cmap substruct
-+of fb_image has to be filled appropriately: start should be set to 16 (first
-+16 colors are reserved for fbcon), len to a value <= 240 and red, green and
-+blue should point to valid cmap data. The transp field is ingored. The fields
-+dx, dy, bg_color, fg_color in fb_image are ignored as well.
-+
-+FBIOCONDECOR_SETCFG
-+description: sets the fbcondecor config for a virtual console
-+argument: struct fbcon_decor_iowrapper*; data: struct vc_decor*
-+notes: The structure has to be filled with valid data.
-+
-+FBIOCONDECOR_GETCFG
-+description: gets the fbcondecor config for a virtual console
-+argument: struct fbcon_decor_iowrapper*; data: struct vc_decor*
-+
-+FBIOCONDECOR_SETSTATE
-+description: sets the fbcondecor state for a virtual console
-+argument: struct fbcon_decor_iowrapper*; data: unsigned int*
-+ values: 0 = disabled, 1 = enabled.
-+
-+FBIOCONDECOR_GETSTATE
-+description: gets the fbcondecor state for a virtual console
-+argument: struct fbcon_decor_iowrapper*; data: unsigned int*
-+ values: as in FBIOCONDECOR_SETSTATE
-+
-+Info on used structures:
-+
-+Definition of struct vc_decor can be found in linux/console_decor.h. It's
-+heavily commented. Note that the 'theme' field should point to a string
-+no longer than FBCON_DECOR_THEME_LEN. When FBIOCONDECOR_GETCFG call is
-+performed, the theme field should point to a char buffer of length
-+FBCON_DECOR_THEME_LEN.
-+
-+Definition of struct fbcon_decor_iowrapper can be found in linux/fb.h.
-+The fields in this struct have the following meaning:
-+
-+vc:
-+Virtual console number.
-+
-+origin:
-+Specifies if the ioctl is performed as a response to a kernel request. The
-+fbcondecor helper should set this field to FBCON_DECOR_IO_ORIG_KERNEL, userspace
-+programs should set it to FBCON_DECOR_IO_ORIG_USER. This field is necessary to
-+avoid console semaphore deadlocks.
-+
-+data:
-+Pointer to a data structure appropriate for the performed ioctl. Type of
-+the data struct is specified in the ioctls description.
-+
-+*****************************************************************************
-+
-+Credit
-+------
-+
-+Original 'bootsplash' project & implementation by:
-+ Volker Poplawski <volker@poplawski.de>, Stefan Reinauer <stepan@suse.de>,
-+ Steffen Winterfeldt <snwint@suse.de>, Michael Schroeder <mls@suse.de>,
-+ Ken Wimer <wimer@suse.de>.
-+
-+Fbcondecor, fbcondecor protocol design, current implementation & docs by:
-+ Michal Januszewski <michalj+fbcondecor@gmail.com>
-+
-diff --git a/drivers/Makefile b/drivers/Makefile
-index 1d034b680431..9f41f2ea0c8b 100644
---- a/drivers/Makefile
-+++ b/drivers/Makefile
-@@ -23,6 +23,10 @@ obj-y += pci/dwc/
-
- obj-$(CONFIG_PARISC) += parisc/
- obj-$(CONFIG_RAPIDIO) += rapidio/
-+# tty/ comes before char/ so that the VT console is the boot-time
-+# default.
-+obj-y += tty/
-+obj-y += char/
- obj-y += video/
- obj-y += idle/
-
-@@ -53,11 +57,6 @@ obj-$(CONFIG_REGULATOR) += regulator/
- # reset controllers early, since gpu drivers might rely on them to initialize
- obj-$(CONFIG_RESET_CONTROLLER) += reset/
-
--# tty/ comes before char/ so that the VT console is the boot-time
--# default.
--obj-y += tty/
--obj-y += char/
--
- # iommu/ comes before gpu as gpu are using iommu controllers
- obj-$(CONFIG_IOMMU_SUPPORT) += iommu/
-
-diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
-index 7f1f1fbcef9e..8439b618dfc0 100644
---- a/drivers/video/console/Kconfig
-+++ b/drivers/video/console/Kconfig
-@@ -151,6 +151,19 @@ config FRAMEBUFFER_CONSOLE_ROTATION
- such that other users of the framebuffer will remain normally
- oriented.
-
-+config FB_CON_DECOR
-+ bool "Support for the Framebuffer Console Decorations"
-+ depends on FRAMEBUFFER_CONSOLE=y && !FB_TILEBLITTING
-+ default n
-+ ---help---
-+ This option enables support for framebuffer console decorations which
-+ makes it possible to display images in the background of the system
-+ consoles. Note that userspace utilities are necessary in order to take
-+ advantage of these features. Refer to Documentation/fb/fbcondecor.txt
-+ for more information.
-+
-+ If unsure, say N.
-+
- config STI_CONSOLE
- bool "STI text console"
- depends on PARISC
-diff --git a/drivers/video/console/Makefile b/drivers/video/console/Makefile
-index db07b784bd2c..3e369bd120b8 100644
---- a/drivers/video/console/Makefile
-+++ b/drivers/video/console/Makefile
-@@ -9,4 +9,5 @@ obj-$(CONFIG_STI_CONSOLE) += sticon.o sticore.o
- obj-$(CONFIG_VGA_CONSOLE) += vgacon.o
- obj-$(CONFIG_MDA_CONSOLE) += mdacon.o
-
-+obj-$(CONFIG_FB_CON_DECOR) += fbcondecor.o cfbcondecor.o
- obj-$(CONFIG_FB_STI) += sticore.o
-diff --git a/drivers/video/console/cfbcondecor.c b/drivers/video/console/cfbcondecor.c
-new file mode 100644
-index 000000000000..b00960803edc
---- /dev/null
-+++ b/drivers/video/console/cfbcondecor.c
-@@ -0,0 +1,473 @@
-+/*
-+ * linux/drivers/video/cfbcon_decor.c -- Framebuffer decor render functions
-+ *
-+ * Copyright (C) 2004 Michal Januszewski <michalj+fbcondecor@gmail.com>
-+ *
-+ * Code based upon "Bootdecor" (C) 2001-2003
-+ * Volker Poplawski <volker@poplawski.de>,
-+ * Stefan Reinauer <stepan@suse.de>,
-+ * Steffen Winterfeldt <snwint@suse.de>,
-+ * Michael Schroeder <mls@suse.de>,
-+ * Ken Wimer <wimer@suse.de>.
-+ *
-+ * This file is subject to the terms and conditions of the GNU General Public
-+ * License. See the file COPYING in the main directory of this archive for
-+ * more details.
-+ */
-+#include <linux/module.h>
-+#include <linux/types.h>
-+#include <linux/fb.h>
-+#include <linux/selection.h>
-+#include <linux/slab.h>
-+#include <linux/vt_kern.h>
-+#include <asm/irq.h>
-+
-+#include "../fbdev/core/fbcon.h"
-+#include "fbcondecor.h"
-+
-+#define parse_pixel(shift, bpp, type) \
-+ do { \
-+ if (d & (0x80 >> (shift))) \
-+ dd2[(shift)] = fgx; \
-+ else \
-+ dd2[(shift)] = transparent ? *(type *)decor_src : bgx; \
-+ decor_src += (bpp); \
-+ } while (0) \
-+
-+extern int get_color(struct vc_data *vc, struct fb_info *info,
-+ u16 c, int is_fg);
-+
-+void fbcon_decor_fix_pseudo_pal(struct fb_info *info, struct vc_data *vc)
-+{
-+ int i, j, k;
-+ int minlen = min(min(info->var.red.length, info->var.green.length),
-+ info->var.blue.length);
-+ u32 col;
-+
-+ for (j = i = 0; i < 16; i++) {
-+ k = color_table[i];
-+
-+ col = ((vc->vc_palette[j++] >> (8-minlen))
-+ << info->var.red.offset);
-+ col |= ((vc->vc_palette[j++] >> (8-minlen))
-+ << info->var.green.offset);
-+ col |= ((vc->vc_palette[j++] >> (8-minlen))
-+ << info->var.blue.offset);
-+ ((u32 *)info->pseudo_palette)[k] = col;
-+ }
-+}
-+
-+void fbcon_decor_renderc(struct fb_info *info, int ypos, int xpos, int height,
-+ int width, u8 *src, u32 fgx, u32 bgx, u8 transparent)
-+{
-+ unsigned int x, y;
-+ u32 dd;
-+ int bytespp = ((info->var.bits_per_pixel + 7) >> 3);
-+ unsigned int d = ypos * info->fix.line_length + xpos * bytespp;
-+ unsigned int ds = (ypos * info->var.xres + xpos) * bytespp;
-+ u16 dd2[4];
-+
-+ u8 *decor_src = (u8 *)(info->bgdecor.data + ds);
-+ u8 *dst = (u8 *)(info->screen_base + d);
-+
-+ if ((ypos + height) > info->var.yres || (xpos + width) > info->var.xres)
-+ return;
-+
-+ for (y = 0; y < height; y++) {
-+ switch (info->var.bits_per_pixel) {
-+
-+ case 32:
-+ for (x = 0; x < width; x++) {
-+
-+ if ((x & 7) == 0)
-+ d = *src++;
-+ if (d & 0x80)
-+ dd = fgx;
-+ else
-+ dd = transparent ?
-+ *(u32 *)decor_src : bgx;
-+
-+ d <<= 1;
-+ decor_src += 4;
-+ fb_writel(dd, dst);
-+ dst += 4;
-+ }
-+ break;
-+ case 24:
-+ for (x = 0; x < width; x++) {
-+
-+ if ((x & 7) == 0)
-+ d = *src++;
-+ if (d & 0x80)
-+ dd = fgx;
-+ else
-+ dd = transparent ?
-+ (*(u32 *)decor_src & 0xffffff) : bgx;
-+
-+ d <<= 1;
-+ decor_src += 3;
-+#ifdef __LITTLE_ENDIAN
-+ fb_writew(dd & 0xffff, dst);
-+ dst += 2;
-+ fb_writeb((dd >> 16), dst);
-+#else
-+ fb_writew(dd >> 8, dst);
-+ dst += 2;
-+ fb_writeb(dd & 0xff, dst);
-+#endif
-+ dst++;
-+ }
-+ break;
-+ case 16:
-+ for (x = 0; x < width; x += 2) {
-+ if ((x & 7) == 0)
-+ d = *src++;
-+
-+ parse_pixel(0, 2, u16);
-+ parse_pixel(1, 2, u16);
-+#ifdef __LITTLE_ENDIAN
-+ dd = dd2[0] | (dd2[1] << 16);
-+#else
-+ dd = dd2[1] | (dd2[0] << 16);
-+#endif
-+ d <<= 2;
-+ fb_writel(dd, dst);
-+ dst += 4;
-+ }
-+ break;
-+
-+ case 8:
-+ for (x = 0; x < width; x += 4) {
-+ if ((x & 7) == 0)
-+ d = *src++;
-+
-+ parse_pixel(0, 1, u8);
-+ parse_pixel(1, 1, u8);
-+ parse_pixel(2, 1, u8);
-+ parse_pixel(3, 1, u8);
-+
-+#ifdef __LITTLE_ENDIAN
-+ dd = dd2[0] | (dd2[1] << 8) | (dd2[2] << 16) | (dd2[3] << 24);
-+#else
-+ dd = dd2[3] | (dd2[2] << 8) | (dd2[1] << 16) | (dd2[0] << 24);
-+#endif
-+ d <<= 4;
-+ fb_writel(dd, dst);
-+ dst += 4;
-+ }
-+ }
-+
-+ dst += info->fix.line_length - width * bytespp;
-+ decor_src += (info->var.xres - width) * bytespp;
-+ }
-+}
-+
-+#define cc2cx(a) \
-+ ((info->fix.visual == FB_VISUAL_TRUECOLOR || \
-+ info->fix.visual == FB_VISUAL_DIRECTCOLOR) ? \
-+ ((u32 *)info->pseudo_palette)[a] : a)
-+
-+void fbcon_decor_putcs(struct vc_data *vc, struct fb_info *info,
-+ const unsigned short *s, int count, int yy, int xx)
-+{
-+ unsigned short charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
-+ struct fbcon_ops *ops = info->fbcon_par;
-+ int fg_color, bg_color, transparent;
-+ u8 *src;
-+ u32 bgx, fgx;
-+ u16 c = scr_readw(s);
-+
-+ fg_color = get_color(vc, info, c, 1);
-+ bg_color = get_color(vc, info, c, 0);
-+
-+ /* Don't paint the background image if console is blanked */
-+ transparent = ops->blank_state ? 0 :
-+ (vc->vc_decor.bg_color == bg_color);
-+
-+ xx = xx * vc->vc_font.width + vc->vc_decor.tx;
-+ yy = yy * vc->vc_font.height + vc->vc_decor.ty;
-+
-+ fgx = cc2cx(fg_color);
-+ bgx = cc2cx(bg_color);
-+
-+ while (count--) {
-+ c = scr_readw(s++);
-+ src = vc->vc_font.data + (c & charmask) * vc->vc_font.height *
-+ ((vc->vc_font.width + 7) >> 3);
-+
-+ fbcon_decor_renderc(info, yy, xx, vc->vc_font.height,
-+ vc->vc_font.width, src, fgx, bgx, transparent);
-+ xx += vc->vc_font.width;
-+ }
-+}
-+
-+void fbcon_decor_cursor(struct fb_info *info, struct fb_cursor *cursor)
-+{
-+ int i;
-+ unsigned int dsize, s_pitch;
-+ struct fbcon_ops *ops = info->fbcon_par;
-+ struct vc_data *vc;
-+ u8 *src;
-+
-+ /* we really don't need any cursors while the console is blanked */
-+ if (info->state != FBINFO_STATE_RUNNING || ops->blank_state)
-+ return;
-+
-+ vc = vc_cons[ops->currcon].d;
-+
-+ src = kmalloc(64 + sizeof(struct fb_image), GFP_ATOMIC);
-+ if (!src)
-+ return;
-+
-+ s_pitch = (cursor->image.width + 7) >> 3;
-+ dsize = s_pitch * cursor->image.height;
-+ if (cursor->enable) {
-+ switch (cursor->rop) {
-+ case ROP_XOR:
-+ for (i = 0; i < dsize; i++)
-+ src[i] = cursor->image.data[i] ^ cursor->mask[i];
-+ break;
-+ case ROP_COPY:
-+ default:
-+ for (i = 0; i < dsize; i++)
-+ src[i] = cursor->image.data[i] & cursor->mask[i];
-+ break;
-+ }
-+ } else
-+ memcpy(src, cursor->image.data, dsize);
-+
-+ fbcon_decor_renderc(info,
-+ cursor->image.dy + vc->vc_decor.ty,
-+ cursor->image.dx + vc->vc_decor.tx,
-+ cursor->image.height,
-+ cursor->image.width,
-+ (u8 *)src,
-+ cc2cx(cursor->image.fg_color),
-+ cc2cx(cursor->image.bg_color),
-+ cursor->image.bg_color == vc->vc_decor.bg_color);
-+
-+ kfree(src);
-+}
-+
-+static void decorset(u8 *dst, int height, int width, int dstbytes,
-+ u32 bgx, int bpp)
-+{
-+ int i;
-+
-+ if (bpp == 8)
-+ bgx |= bgx << 8;
-+ if (bpp == 16 || bpp == 8)
-+ bgx |= bgx << 16;
-+
-+ while (height-- > 0) {
-+ u8 *p = dst;
-+
-+ switch (bpp) {
-+
-+ case 32:
-+ for (i = 0; i < width; i++) {
-+ fb_writel(bgx, p); p += 4;
-+ }
-+ break;
-+ case 24:
-+ for (i = 0; i < width; i++) {
-+#ifdef __LITTLE_ENDIAN
-+ fb_writew((bgx & 0xffff), (u16 *)p); p += 2;
-+ fb_writeb((bgx >> 16), p++);
-+#else
-+ fb_writew((bgx >> 8), (u16 *)p); p += 2;
-+ fb_writeb((bgx & 0xff), p++);
-+#endif
-+ }
-+ break;
-+ case 16:
-+ for (i = 0; i < width/4; i++) {
-+ fb_writel(bgx, p); p += 4;
-+ fb_writel(bgx, p); p += 4;
-+ }
-+ if (width & 2) {
-+ fb_writel(bgx, p); p += 4;
-+ }
-+ if (width & 1)
-+ fb_writew(bgx, (u16 *)p);
-+ break;
-+ case 8:
-+ for (i = 0; i < width/4; i++) {
-+ fb_writel(bgx, p); p += 4;
-+ }
-+
-+ if (width & 2) {
-+ fb_writew(bgx, p); p += 2;
-+ }
-+ if (width & 1)
-+ fb_writeb(bgx, (u8 *)p);
-+ break;
-+
-+ }
-+ dst += dstbytes;
-+ }
-+}
-+
-+void fbcon_decor_copy(u8 *dst, u8 *src, int height, int width, int linebytes,
-+ int srclinebytes, int bpp)
-+{
-+ int i;
-+
-+ while (height-- > 0) {
-+ u32 *p = (u32 *)dst;
-+ u32 *q = (u32 *)src;
-+
-+ switch (bpp) {
-+
-+ case 32:
-+ for (i = 0; i < width; i++)
-+ fb_writel(*q++, p++);
-+ break;
-+ case 24:
-+ for (i = 0; i < (width * 3 / 4); i++)
-+ fb_writel(*q++, p++);
-+ if ((width * 3) % 4) {
-+ if (width & 2) {
-+ fb_writeb(*(u8 *)q, (u8 *)p);
-+ } else if (width & 1) {
-+ fb_writew(*(u16 *)q, (u16 *)p);
-+ fb_writeb(*(u8 *)((u16 *)q + 1),
-+ (u8 *)((u16 *)p + 2));
-+ }
-+ }
-+ break;
-+ case 16:
-+ for (i = 0; i < width/4; i++) {
-+ fb_writel(*q++, p++);
-+ fb_writel(*q++, p++);
-+ }
-+ if (width & 2)
-+ fb_writel(*q++, p++);
-+ if (width & 1)
-+ fb_writew(*(u16 *)q, (u16 *)p);
-+ break;
-+ case 8:
-+ for (i = 0; i < width/4; i++)
-+ fb_writel(*q++, p++);
-+
-+ if (width & 2) {
-+ fb_writew(*(u16 *)q, (u16 *)p);
-+ q = (u32 *) ((u16 *)q + 1);
-+ p = (u32 *) ((u16 *)p + 1);
-+ }
-+ if (width & 1)
-+ fb_writeb(*(u8 *)q, (u8 *)p);
-+ break;
-+ }
-+
-+ dst += linebytes;
-+ src += srclinebytes;
-+ }
-+}
-+
-+static void decorfill(struct fb_info *info, int sy, int sx, int height,
-+ int width)
-+{
-+ int bytespp = ((info->var.bits_per_pixel + 7) >> 3);
-+ int d = sy * info->fix.line_length + sx * bytespp;
-+ int ds = (sy * info->var.xres + sx) * bytespp;
-+
-+ fbcon_decor_copy((u8 *)(info->screen_base + d), (u8 *)(info->bgdecor.data + ds),
-+ height, width, info->fix.line_length, info->var.xres * bytespp,
-+ info->var.bits_per_pixel);
-+}
-+
-+void fbcon_decor_clear(struct vc_data *vc, struct fb_info *info, int sy, int sx,
-+ int height, int width)
-+{
-+ int bgshift = (vc->vc_hi_font_mask) ? 13 : 12;
-+ struct fbcon_ops *ops = info->fbcon_par;
-+ u8 *dst;
-+ int transparent, bg_color = attr_bgcol_ec(bgshift, vc, info);
-+
-+ transparent = (vc->vc_decor.bg_color == bg_color);
-+ sy = sy * vc->vc_font.height + vc->vc_decor.ty;
-+ sx = sx * vc->vc_font.width + vc->vc_decor.tx;
-+ height *= vc->vc_font.height;
-+ width *= vc->vc_font.width;
-+
-+ /* Don't paint the background image if console is blanked */
-+ if (transparent && !ops->blank_state) {
-+ decorfill(info, sy, sx, height, width);
-+ } else {
-+ dst = (u8 *)(info->screen_base + sy * info->fix.line_length +
-+ sx * ((info->var.bits_per_pixel + 7) >> 3));
-+ decorset(dst, height, width, info->fix.line_length, cc2cx(bg_color),
-+ info->var.bits_per_pixel);
-+ }
-+}
-+
-+void fbcon_decor_clear_margins(struct vc_data *vc, struct fb_info *info,
-+ int bottom_only)
-+{
-+ unsigned int tw = vc->vc_cols*vc->vc_font.width;
-+ unsigned int th = vc->vc_rows*vc->vc_font.height;
-+
-+ if (!bottom_only) {
-+ /* top margin */
-+ decorfill(info, 0, 0, vc->vc_decor.ty, info->var.xres);
-+ /* left margin */
-+ decorfill(info, vc->vc_decor.ty, 0, th, vc->vc_decor.tx);
-+ /* right margin */
-+ decorfill(info, vc->vc_decor.ty, vc->vc_decor.tx + tw, th,
-+ info->var.xres - vc->vc_decor.tx - tw);
-+ }
-+ decorfill(info, vc->vc_decor.ty + th, 0,
-+ info->var.yres - vc->vc_decor.ty - th, info->var.xres);
-+}
-+
-+void fbcon_decor_bmove_redraw(struct vc_data *vc, struct fb_info *info, int y,
-+ int sx, int dx, int width)
-+{
-+ u16 *d = (u16 *) (vc->vc_origin + vc->vc_size_row * y + dx * 2);
-+ u16 *s = d + (dx - sx);
-+ u16 *start = d;
-+ u16 *ls = d;
-+ u16 *le = d + width;
-+ u16 c;
-+ int x = dx;
-+ u16 attr = 1;
-+
-+ do {
-+ c = scr_readw(d);
-+ if (attr != (c & 0xff00)) {
-+ attr = c & 0xff00;
-+ if (d > start) {
-+ fbcon_decor_putcs(vc, info, start, d - start, y, x);
-+ x += d - start;
-+ start = d;
-+ }
-+ }
-+ if (s >= ls && s < le && c == scr_readw(s)) {
-+ if (d > start) {
-+ fbcon_decor_putcs(vc, info, start, d - start, y, x);
-+ x += d - start + 1;
-+ start = d + 1;
-+ } else {
-+ x++;
-+ start++;
-+ }
-+ }
-+ s++;
-+ d++;
-+ } while (d < le);
-+ if (d > start)
-+ fbcon_decor_putcs(vc, info, start, d - start, y, x);
-+}
-+
-+void fbcon_decor_blank(struct vc_data *vc, struct fb_info *info, int blank)
-+{
-+ if (blank) {
-+ decorset((u8 *)info->screen_base, info->var.yres, info->var.xres,
-+ info->fix.line_length, 0, info->var.bits_per_pixel);
-+ } else {
-+ update_screen(vc);
-+ fbcon_decor_clear_margins(vc, info, 0);
-+ }
-+}
-+
-diff --git a/drivers/video/console/fbcondecor.c b/drivers/video/console/fbcondecor.c
-new file mode 100644
-index 000000000000..78288a497a60
---- /dev/null
-+++ b/drivers/video/console/fbcondecor.c
-@@ -0,0 +1,549 @@
-+/*
-+ * linux/drivers/video/console/fbcondecor.c -- Framebuffer console decorations
-+ *
-+ * Copyright (C) 2004-2009 Michal Januszewski <michalj+fbcondecor@gmail.com>
-+ *
-+ * Code based upon "Bootsplash" (C) 2001-2003
-+ * Volker Poplawski <volker@poplawski.de>,
-+ * Stefan Reinauer <stepan@suse.de>,
-+ * Steffen Winterfeldt <snwint@suse.de>,
-+ * Michael Schroeder <mls@suse.de>,
-+ * Ken Wimer <wimer@suse.de>.
-+ *
-+ * Compat ioctl support by Thorsten Klein <TK@Thorsten-Klein.de>.
-+ *
-+ * This file is subject to the terms and conditions of the GNU General Public
-+ * License. See the file COPYING in the main directory of this archive for
-+ * more details.
-+ *
-+ */
-+#include <linux/module.h>
-+#include <linux/kernel.h>
-+#include <linux/string.h>
-+#include <linux/types.h>
-+#include <linux/fb.h>
-+#include <linux/vt_kern.h>
-+#include <linux/vmalloc.h>
-+#include <linux/unistd.h>
-+#include <linux/syscalls.h>
-+#include <linux/init.h>
-+#include <linux/proc_fs.h>
-+#include <linux/workqueue.h>
-+#include <linux/kmod.h>
-+#include <linux/miscdevice.h>
-+#include <linux/device.h>
-+#include <linux/fs.h>
-+#include <linux/compat.h>
-+#include <linux/console.h>
-+#include <linux/binfmts.h>
-+#include <linux/uaccess.h>
-+#include <asm/irq.h>
-+
-+#include "../fbdev/core/fbcon.h"
-+#include "fbcondecor.h"
-+
-+extern signed char con2fb_map[];
-+static int fbcon_decor_enable(struct vc_data *vc);
-+
-+static int initialized;
-+
-+char fbcon_decor_path[KMOD_PATH_LEN] = "/sbin/fbcondecor_helper";
-+EXPORT_SYMBOL(fbcon_decor_path);
-+
-+int fbcon_decor_call_helper(char *cmd, unsigned short vc)
-+{
-+ char *envp[] = {
-+ "HOME=/",
-+ "PATH=/sbin:/bin",
-+ NULL
-+ };
-+
-+ char tfb[5];
-+ char tcons[5];
-+ unsigned char fb = (int) con2fb_map[vc];
-+
-+ char *argv[] = {
-+ fbcon_decor_path,
-+ "2",
-+ cmd,
-+ tcons,
-+ tfb,
-+ vc_cons[vc].d->vc_decor.theme,
-+ NULL
-+ };
-+
-+ snprintf(tfb, 5, "%d", fb);
-+ snprintf(tcons, 5, "%d", vc);
-+
-+ return call_usermodehelper(fbcon_decor_path, argv, envp, UMH_WAIT_EXEC);
-+}
-+
-+/* Disables fbcondecor on a virtual console; called with console sem held. */
-+int fbcon_decor_disable(struct vc_data *vc, unsigned char redraw)
-+{
-+ struct fb_info *info;
-+
-+ if (!vc->vc_decor.state)
-+ return -EINVAL;
-+
-+ info = registered_fb[(int) con2fb_map[vc->vc_num]];
-+
-+ if (info == NULL)
-+ return -EINVAL;
-+
-+ vc->vc_decor.state = 0;
-+ vc_resize(vc, info->var.xres / vc->vc_font.width,
-+ info->var.yres / vc->vc_font.height);
-+
-+ if (fg_console == vc->vc_num && redraw) {
-+ redraw_screen(vc, 0);
-+ update_region(vc, vc->vc_origin +
-+ vc->vc_size_row * vc->vc_top,
-+ vc->vc_size_row * (vc->vc_bottom - vc->vc_top) / 2);
-+ }
-+
-+ printk(KERN_INFO "fbcondecor: switched decor state to 'off' on console %d\n",
-+ vc->vc_num);
-+
-+ return 0;
-+}
-+
-+/* Enables fbcondecor on a virtual console; called with console sem held. */
-+static int fbcon_decor_enable(struct vc_data *vc)
-+{
-+ struct fb_info *info;
-+
-+ info = registered_fb[(int) con2fb_map[vc->vc_num]];
-+
-+ if (vc->vc_decor.twidth == 0 || vc->vc_decor.theight == 0 ||
-+ info == NULL || vc->vc_decor.state || (!info->bgdecor.data &&
-+ vc->vc_num == fg_console))
-+ return -EINVAL;
-+
-+ vc->vc_decor.state = 1;
-+ vc_resize(vc, vc->vc_decor.twidth / vc->vc_font.width,
-+ vc->vc_decor.theight / vc->vc_font.height);
-+
-+ if (fg_console == vc->vc_num) {
-+ redraw_screen(vc, 0);
-+ update_region(vc, vc->vc_origin +
-+ vc->vc_size_row * vc->vc_top,
-+ vc->vc_size_row * (vc->vc_bottom - vc->vc_top) / 2);
-+ fbcon_decor_clear_margins(vc, info, 0);
-+ }
-+
-+ printk(KERN_INFO "fbcondecor: switched decor state to 'on' on console %d\n",
-+ vc->vc_num);
-+
-+ return 0;
-+}
-+
-+static inline int fbcon_decor_ioctl_dosetstate(struct vc_data *vc, unsigned int state, unsigned char origin)
-+{
-+ int ret;
-+
-+ console_lock();
-+ if (!state)
-+ ret = fbcon_decor_disable(vc, 1);
-+ else
-+ ret = fbcon_decor_enable(vc);
-+ console_unlock();
-+
-+ return ret;
-+}
-+
-+static inline void fbcon_decor_ioctl_dogetstate(struct vc_data *vc, unsigned int *state)
-+{
-+ *state = vc->vc_decor.state;
-+}
-+
-+static int fbcon_decor_ioctl_dosetcfg(struct vc_data *vc, struct vc_decor *cfg, unsigned char origin)
-+{
-+ struct fb_info *info;
-+ int len;
-+ char *tmp;
-+
-+ info = registered_fb[(int) con2fb_map[vc->vc_num]];
-+
-+ if (info == NULL || !cfg->twidth || !cfg->theight ||
-+ cfg->tx + cfg->twidth > info->var.xres ||
-+ cfg->ty + cfg->theight > info->var.yres)
-+ return -EINVAL;
-+
-+ len = strnlen_user(cfg->theme, MAX_ARG_STRLEN);
-+ if (!len || len > FBCON_DECOR_THEME_LEN)
-+ return -EINVAL;
-+ tmp = kmalloc(len, GFP_KERNEL);
-+ if (!tmp)
-+ return -ENOMEM;
-+ if (copy_from_user(tmp, (void __user *)cfg->theme, len))
-+ return -EFAULT;
-+ cfg->theme = tmp;
-+ cfg->state = 0;
-+
-+ console_lock();
-+ if (vc->vc_decor.state)
-+ fbcon_decor_disable(vc, 1);
-+ kfree(vc->vc_decor.theme);
-+ vc->vc_decor = *cfg;
-+ console_unlock();
-+
-+ printk(KERN_INFO "fbcondecor: console %d using theme '%s'\n",
-+ vc->vc_num, vc->vc_decor.theme);
-+ return 0;
-+}
-+
-+static int fbcon_decor_ioctl_dogetcfg(struct vc_data *vc,
-+ struct vc_decor *decor)
-+{
-+ char __user *tmp;
-+
-+ tmp = decor->theme;
-+ *decor = vc->vc_decor;
-+ decor->theme = tmp;
-+
-+ if (vc->vc_decor.theme) {
-+ if (copy_to_user(tmp, vc->vc_decor.theme,
-+ strlen(vc->vc_decor.theme) + 1))
-+ return -EFAULT;
-+ } else
-+ if (put_user(0, tmp))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
-+static int fbcon_decor_ioctl_dosetpic(struct vc_data *vc, struct fb_image *img,
-+ unsigned char origin)
-+{
-+ struct fb_info *info;
-+ int len;
-+ u8 *tmp;
-+
-+ if (vc->vc_num != fg_console)
-+ return -EINVAL;
-+
-+ info = registered_fb[(int) con2fb_map[vc->vc_num]];
-+
-+ if (info == NULL)
-+ return -EINVAL;
-+
-+ if (img->width != info->var.xres || img->height != info->var.yres) {
-+ printk(KERN_ERR "fbcondecor: picture dimensions mismatch\n");
-+ printk(KERN_ERR "%dx%d vs %dx%d\n", img->width, img->height,
-+ info->var.xres, info->var.yres);
-+ return -EINVAL;
-+ }
-+
-+ if (img->depth != info->var.bits_per_pixel) {
-+ printk(KERN_ERR "fbcondecor: picture depth mismatch\n");
-+ return -EINVAL;
-+ }
-+
-+ if (img->depth == 8) {
-+ if (!img->cmap.len || !img->cmap.red || !img->cmap.green ||
-+ !img->cmap.blue)
-+ return -EINVAL;
-+
-+ tmp = vmalloc(img->cmap.len * 3 * 2);
-+ if (!tmp)
-+ return -ENOMEM;
-+
-+ if (copy_from_user(tmp,
-+ (void __user *)img->cmap.red,
-+ (img->cmap.len << 1)) ||
-+ copy_from_user(tmp + (img->cmap.len << 1),
-+ (void __user *)img->cmap.green,
-+ (img->cmap.len << 1)) ||
-+ copy_from_user(tmp + (img->cmap.len << 2),
-+ (void __user *)img->cmap.blue,
-+ (img->cmap.len << 1))) {
-+ vfree(tmp);
-+ return -EFAULT;
-+ }
-+
-+ img->cmap.transp = NULL;
-+ img->cmap.red = (u16 *)tmp;
-+ img->cmap.green = img->cmap.red + img->cmap.len;
-+ img->cmap.blue = img->cmap.green + img->cmap.len;
-+ } else {
-+ img->cmap.red = NULL;
-+ }
-+
-+ len = ((img->depth + 7) >> 3) * img->width * img->height;
-+
-+ /*
-+ * Allocate an additional byte so that we never go outside of the
-+ * buffer boundaries in the rendering functions in a 24 bpp mode.
-+ */
-+ tmp = vmalloc(len + 1);
-+
-+ if (!tmp)
-+ goto out;
-+
-+ if (copy_from_user(tmp, (void __user *)img->data, len))
-+ goto out;
-+
-+ img->data = tmp;
-+
-+ console_lock();
-+
-+ if (info->bgdecor.data)
-+ vfree((u8 *)info->bgdecor.data);
-+ if (info->bgdecor.cmap.red)
-+ vfree(info->bgdecor.cmap.red);
-+
-+ info->bgdecor = *img;
-+
-+ if (fbcon_decor_active_vc(vc) && fg_console == vc->vc_num) {
-+ redraw_screen(vc, 0);
-+ update_region(vc, vc->vc_origin +
-+ vc->vc_size_row * vc->vc_top,
-+ vc->vc_size_row * (vc->vc_bottom - vc->vc_top) / 2);
-+ fbcon_decor_clear_margins(vc, info, 0);
-+ }
-+
-+ console_unlock();
-+
-+ return 0;
-+
-+out:
-+ if (img->cmap.red)
-+ vfree(img->cmap.red);
-+
-+ if (tmp)
-+ vfree(tmp);
-+ return -ENOMEM;
-+}
-+
-+static long fbcon_decor_ioctl(struct file *filp, u_int cmd, u_long arg)
-+{
-+ struct fbcon_decor_iowrapper __user *wrapper = (void __user *) arg;
-+ struct vc_data *vc = NULL;
-+ unsigned short vc_num = 0;
-+ unsigned char origin = 0;
-+ void __user *data = NULL;
-+
-+ if (!access_ok(VERIFY_READ, wrapper,
-+ sizeof(struct fbcon_decor_iowrapper)))
-+ return -EFAULT;
-+
-+ __get_user(vc_num, &wrapper->vc);
-+ __get_user(origin, &wrapper->origin);
-+ __get_user(data, &wrapper->data);
-+
-+ if (!vc_cons_allocated(vc_num))
-+ return -EINVAL;
-+
-+ vc = vc_cons[vc_num].d;
-+
-+ switch (cmd) {
-+ case FBIOCONDECOR_SETPIC:
-+ {
-+ struct fb_image img;
-+
-+ if (copy_from_user(&img, (struct fb_image __user *)data, sizeof(struct fb_image)))
-+ return -EFAULT;
-+
-+ return fbcon_decor_ioctl_dosetpic(vc, &img, origin);
-+ }
-+ case FBIOCONDECOR_SETCFG:
-+ {
-+ struct vc_decor cfg;
-+
-+ if (copy_from_user(&cfg, (struct vc_decor __user *)data, sizeof(struct vc_decor)))
-+ return -EFAULT;
-+
-+ return fbcon_decor_ioctl_dosetcfg(vc, &cfg, origin);
-+ }
-+ case FBIOCONDECOR_GETCFG:
-+ {
-+ int rval;
-+ struct vc_decor cfg;
-+
-+ if (copy_from_user(&cfg, (struct vc_decor __user *)data, sizeof(struct vc_decor)))
-+ return -EFAULT;
-+
-+ rval = fbcon_decor_ioctl_dogetcfg(vc, &cfg);
-+
-+ if (copy_to_user(data, &cfg, sizeof(struct vc_decor)))
-+ return -EFAULT;
-+ return rval;
-+ }
-+ case FBIOCONDECOR_SETSTATE:
-+ {
-+ unsigned int state = 0;
-+
-+ if (get_user(state, (unsigned int __user *)data))
-+ return -EFAULT;
-+ return fbcon_decor_ioctl_dosetstate(vc, state, origin);
-+ }
-+ case FBIOCONDECOR_GETSTATE:
-+ {
-+ unsigned int state = 0;
-+
-+ fbcon_decor_ioctl_dogetstate(vc, &state);
-+ return put_user(state, (unsigned int __user *)data);
-+ }
-+
-+ default:
-+ return -ENOIOCTLCMD;
-+ }
-+}
-+
-+#ifdef CONFIG_COMPAT
-+
-+static long fbcon_decor_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
-+{
-+ struct fbcon_decor_iowrapper32 __user *wrapper = (void __user *)arg;
-+ struct vc_data *vc = NULL;
-+ unsigned short vc_num = 0;
-+ unsigned char origin = 0;
-+ compat_uptr_t data_compat = 0;
-+ void __user *data = NULL;
-+
-+ if (!access_ok(VERIFY_READ, wrapper,
-+ sizeof(struct fbcon_decor_iowrapper32)))
-+ return -EFAULT;
-+
-+ __get_user(vc_num, &wrapper->vc);
-+ __get_user(origin, &wrapper->origin);
-+ __get_user(data_compat, &wrapper->data);
-+ data = compat_ptr(data_compat);
-+
-+ if (!vc_cons_allocated(vc_num))
-+ return -EINVAL;
-+
-+ vc = vc_cons[vc_num].d;
-+
-+ switch (cmd) {
-+ case FBIOCONDECOR_SETPIC32:
-+ {
-+ struct fb_image32 img_compat;
-+ struct fb_image img;
-+
-+ if (copy_from_user(&img_compat, (struct fb_image32 __user *)data, sizeof(struct fb_image32)))
-+ return -EFAULT;
-+
-+ fb_image_from_compat(img, img_compat);
-+
-+ return fbcon_decor_ioctl_dosetpic(vc, &img, origin);
-+ }
-+
-+ case FBIOCONDECOR_SETCFG32:
-+ {
-+ struct vc_decor32 cfg_compat;
-+ struct vc_decor cfg;
-+
-+ if (copy_from_user(&cfg_compat, (struct vc_decor32 __user *)data, sizeof(struct vc_decor32)))
-+ return -EFAULT;
-+
-+ vc_decor_from_compat(cfg, cfg_compat);
-+
-+ return fbcon_decor_ioctl_dosetcfg(vc, &cfg, origin);
-+ }
-+
-+ case FBIOCONDECOR_GETCFG32:
-+ {
-+ int rval;
-+ struct vc_decor32 cfg_compat;
-+ struct vc_decor cfg;
-+
-+ if (copy_from_user(&cfg_compat, (struct vc_decor32 __user *)data, sizeof(struct vc_decor32)))
-+ return -EFAULT;
-+ cfg.theme = compat_ptr(cfg_compat.theme);
-+
-+ rval = fbcon_decor_ioctl_dogetcfg(vc, &cfg);
-+
-+ vc_decor_to_compat(cfg_compat, cfg);
-+
-+ if (copy_to_user((struct vc_decor32 __user *)data, &cfg_compat, sizeof(struct vc_decor32)))
-+ return -EFAULT;
-+ return rval;
-+ }
-+
-+ case FBIOCONDECOR_SETSTATE32:
-+ {
-+ compat_uint_t state_compat = 0;
-+ unsigned int state = 0;
-+
-+ if (get_user(state_compat, (compat_uint_t __user *)data))
-+ return -EFAULT;
-+
-+ state = (unsigned int)state_compat;
-+
-+ return fbcon_decor_ioctl_dosetstate(vc, state, origin);
-+ }
-+
-+ case FBIOCONDECOR_GETSTATE32:
-+ {
-+ compat_uint_t state_compat = 0;
-+ unsigned int state = 0;
-+
-+ fbcon_decor_ioctl_dogetstate(vc, &state);
-+ state_compat = (compat_uint_t)state;
-+
-+ return put_user(state_compat, (compat_uint_t __user *)data);
-+ }
-+
-+ default:
-+ return -ENOIOCTLCMD;
-+ }
-+}
-+#else
-+ #define fbcon_decor_compat_ioctl NULL
-+#endif
-+
-+static struct file_operations fbcon_decor_ops = {
-+ .owner = THIS_MODULE,
-+ .unlocked_ioctl = fbcon_decor_ioctl,
-+ .compat_ioctl = fbcon_decor_compat_ioctl
-+};
-+
-+static struct miscdevice fbcon_decor_dev = {
-+ .minor = MISC_DYNAMIC_MINOR,
-+ .name = "fbcondecor",
-+ .fops = &fbcon_decor_ops
-+};
-+
-+void fbcon_decor_reset(void)
-+{
-+ int i;
-+
-+ for (i = 0; i < num_registered_fb; i++) {
-+ registered_fb[i]->bgdecor.data = NULL;
-+ registered_fb[i]->bgdecor.cmap.red = NULL;
-+ }
-+
-+ for (i = 0; i < MAX_NR_CONSOLES && vc_cons[i].d; i++) {
-+ vc_cons[i].d->vc_decor.state = vc_cons[i].d->vc_decor.twidth =
-+ vc_cons[i].d->vc_decor.theight = 0;
-+ vc_cons[i].d->vc_decor.theme = NULL;
-+ }
-+}
-+
-+int fbcon_decor_init(void)
-+{
-+ int i;
-+
-+ fbcon_decor_reset();
-+
-+ if (initialized)
-+ return 0;
-+
-+ i = misc_register(&fbcon_decor_dev);
-+ if (i) {
-+ printk(KERN_ERR "fbcondecor: failed to register device\n");
-+ return i;
-+ }
-+
-+ fbcon_decor_call_helper("init", 0);
-+ initialized = 1;
-+ return 0;
-+}
-+
-+int fbcon_decor_exit(void)
-+{
-+ fbcon_decor_reset();
-+ return 0;
-+}
-diff --git a/drivers/video/console/fbcondecor.h b/drivers/video/console/fbcondecor.h
-new file mode 100644
-index 000000000000..c49386c16695
---- /dev/null
-+++ b/drivers/video/console/fbcondecor.h
-@@ -0,0 +1,77 @@
-+/*
-+ * linux/drivers/video/console/fbcondecor.h -- Framebuffer Console Decoration headers
-+ *
-+ * Copyright (C) 2004 Michal Januszewski <michalj+fbcondecor@gmail.com>
-+ *
-+ */
-+
-+#ifndef __FBCON_DECOR_H
-+#define __FBCON_DECOR_H
-+
-+#ifndef _LINUX_FB_H
-+#include <linux/fb.h>
-+#endif
-+
-+/* This is needed for vc_cons in fbcmap.c */
-+#include <linux/vt_kern.h>
-+
-+struct fb_cursor;
-+struct fb_info;
-+struct vc_data;
-+
-+#ifdef CONFIG_FB_CON_DECOR
-+/* fbcondecor.c */
-+int fbcon_decor_init(void);
-+int fbcon_decor_exit(void);
-+int fbcon_decor_call_helper(char *cmd, unsigned short cons);
-+int fbcon_decor_disable(struct vc_data *vc, unsigned char redraw);
-+
-+/* cfbcondecor.c */
-+void fbcon_decor_putcs(struct vc_data *vc, struct fb_info *info, const unsigned short *s, int count, int yy, int xx);
-+void fbcon_decor_cursor(struct fb_info *info, struct fb_cursor *cursor);
-+void fbcon_decor_clear(struct vc_data *vc, struct fb_info *info, int sy, int sx, int height, int width);
-+void fbcon_decor_clear_margins(struct vc_data *vc, struct fb_info *info, int bottom_only);
-+void fbcon_decor_blank(struct vc_data *vc, struct fb_info *info, int blank);
-+void fbcon_decor_bmove_redraw(struct vc_data *vc, struct fb_info *info, int y, int sx, int dx, int width);
-+void fbcon_decor_copy(u8 *dst, u8 *src, int height, int width, int linebytes, int srclinesbytes, int bpp);
-+void fbcon_decor_fix_pseudo_pal(struct fb_info *info, struct vc_data *vc);
-+
-+/* vt.c */
-+void acquire_console_sem(void);
-+void release_console_sem(void);
-+void do_unblank_screen(int entering_gfx);
-+
-+/* struct vc_data *y */
-+#define fbcon_decor_active_vc(y) (y->vc_decor.state && y->vc_decor.theme)
-+
-+/* struct fb_info *x, struct vc_data *y */
-+#define fbcon_decor_active_nores(x, y) (x->bgdecor.data && fbcon_decor_active_vc(y))
-+
-+/* struct fb_info *x, struct vc_data *y */
-+#define fbcon_decor_active(x, y) (fbcon_decor_active_nores(x, y) && \
-+ x->bgdecor.width == x->var.xres && \
-+ x->bgdecor.height == x->var.yres && \
-+ x->bgdecor.depth == x->var.bits_per_pixel)
-+
-+#else /* CONFIG_FB_CON_DECOR */
-+
-+static inline void fbcon_decor_putcs(struct vc_data *vc, struct fb_info *info, const unsigned short *s, int count, int yy, int xx) {}
-+static inline void fbcon_decor_putc(struct vc_data *vc, struct fb_info *info, int c, int ypos, int xpos) {}
-+static inline void fbcon_decor_cursor(struct fb_info *info, struct fb_cursor *cursor) {}
-+static inline void fbcon_decor_clear(struct vc_data *vc, struct fb_info *info, int sy, int sx, int height, int width) {}
-+static inline void fbcon_decor_clear_margins(struct vc_data *vc, struct fb_info *info, int bottom_only) {}
-+static inline void fbcon_decor_blank(struct vc_data *vc, struct fb_info *info, int blank) {}
-+static inline void fbcon_decor_bmove_redraw(struct vc_data *vc, struct fb_info *info, int y, int sx, int dx, int width) {}
-+static inline void fbcon_decor_fix_pseudo_pal(struct fb_info *info, struct vc_data *vc) {}
-+static inline int fbcon_decor_call_helper(char *cmd, unsigned short cons) { return 0; }
-+static inline int fbcon_decor_init(void) { return 0; }
-+static inline int fbcon_decor_exit(void) { return 0; }
-+static inline int fbcon_decor_disable(struct vc_data *vc, unsigned char redraw) { return 0; }
-+
-+#define fbcon_decor_active_vc(y) (0)
-+#define fbcon_decor_active_nores(x, y) (0)
-+#define fbcon_decor_active(x, y) (0)
-+
-+#endif /* CONFIG_FB_CON_DECOR */
-+
-+#endif /* __FBCON_DECOR_H */
-diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
-index 5e58f5ec0a28..1daa8c2cb2d8 100644
---- a/drivers/video/fbdev/Kconfig
-+++ b/drivers/video/fbdev/Kconfig
-@@ -1226,7 +1226,6 @@ config FB_MATROX
- select FB_CFB_FILLRECT
- select FB_CFB_COPYAREA
- select FB_CFB_IMAGEBLIT
-- select FB_TILEBLITTING
- select FB_MACMODES if PPC_PMAC
- ---help---
- Say Y here if you have a Matrox Millennium, Matrox Millennium II,
-diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
-index 790900d646c0..3f940c93752c 100644
---- a/drivers/video/fbdev/core/bitblit.c
-+++ b/drivers/video/fbdev/core/bitblit.c
-@@ -18,6 +18,7 @@
- #include <linux/console.h>
- #include <asm/types.h>
- #include "fbcon.h"
-+#include "../../console/fbcondecor.h"
-
- /*
- * Accelerated handlers.
-@@ -55,6 +56,13 @@ static void bit_bmove(struct vc_data *vc, struct fb_info *info, int sy,
- area.height = height * vc->vc_font.height;
- area.width = width * vc->vc_font.width;
-
-+ if (fbcon_decor_active(info, vc)) {
-+ area.sx += vc->vc_decor.tx;
-+ area.sy += vc->vc_decor.ty;
-+ area.dx += vc->vc_decor.tx;
-+ area.dy += vc->vc_decor.ty;
-+ }
-+
- info->fbops->fb_copyarea(info, &area);
- }
-
-@@ -379,11 +387,15 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
- cursor.image.depth = 1;
- cursor.rop = ROP_XOR;
-
-- if (info->fbops->fb_cursor)
-- err = info->fbops->fb_cursor(info, &cursor);
-+ if (fbcon_decor_active(info, vc)) {
-+ fbcon_decor_cursor(info, &cursor);
-+ } else {
-+ if (info->fbops->fb_cursor)
-+ err = info->fbops->fb_cursor(info, &cursor);
-
-- if (err)
-- soft_cursor(info, &cursor);
-+ if (err)
-+ soft_cursor(info, &cursor);
-+ }
-
- ops->cursor_reset = 0;
- }
-diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c
-index 68a113594808..21f977cb59d2 100644
---- a/drivers/video/fbdev/core/fbcmap.c
-+++ b/drivers/video/fbdev/core/fbcmap.c
-@@ -17,6 +17,8 @@
- #include <linux/slab.h>
- #include <linux/uaccess.h>
-
-+#include "../../console/fbcondecor.h"
-+
- static u16 red2[] __read_mostly = {
- 0x0000, 0xaaaa
- };
-@@ -256,9 +258,12 @@ int fb_set_cmap(struct fb_cmap *cmap, struct fb_info *info)
- break;
- }
- }
-- if (rc == 0)
-+ if (rc == 0) {
- fb_copy_cmap(cmap, &info->cmap);
--
-+ if (fbcon_decor_active(info, vc_cons[fg_console].d) &&
-+ info->fix.visual == FB_VISUAL_DIRECTCOLOR)
-+ fbcon_decor_fix_pseudo_pal(info, vc_cons[fg_console].d);
-+ }
- return rc;
- }
-
-diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
-index 04612f938bab..95c349200078 100644
---- a/drivers/video/fbdev/core/fbcon.c
-+++ b/drivers/video/fbdev/core/fbcon.c
-@@ -80,6 +80,7 @@
- #include <asm/irq.h>
-
- #include "fbcon.h"
-+#include "../../console/fbcondecor.h"
-
- #ifdef FBCONDEBUG
- # define DPRINTK(fmt, args...) printk(KERN_DEBUG "%s: " fmt, __func__ , ## args)
-@@ -95,7 +96,7 @@ enum {
-
- static struct display fb_display[MAX_NR_CONSOLES];
-
--static signed char con2fb_map[MAX_NR_CONSOLES];
-+signed char con2fb_map[MAX_NR_CONSOLES];
- static signed char con2fb_map_boot[MAX_NR_CONSOLES];
-
- static int logo_lines;
-@@ -282,7 +283,7 @@ static inline int fbcon_is_inactive(struct vc_data *vc, struct fb_info *info)
- !vt_force_oops_output(vc);
- }
-
--static int get_color(struct vc_data *vc, struct fb_info *info,
-+int get_color(struct vc_data *vc, struct fb_info *info,
- u16 c, int is_fg)
- {
- int depth = fb_get_color_depth(&info->var, &info->fix);
-@@ -551,6 +552,9 @@ static int do_fbcon_takeover(int show_logo)
- info_idx = -1;
- } else {
- fbcon_has_console_bind = 1;
-+#ifdef CONFIG_FB_CON_DECOR
-+ fbcon_decor_init();
-+#endif
- }
-
- return err;
-@@ -1013,6 +1017,12 @@ static const char *fbcon_startup(void)
- rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
- cols /= vc->vc_font.width;
- rows /= vc->vc_font.height;
-+
-+ if (fbcon_decor_active(info, vc)) {
-+ cols = vc->vc_decor.twidth / vc->vc_font.width;
-+ rows = vc->vc_decor.theight / vc->vc_font.height;
-+ }
-+
- vc_resize(vc, cols, rows);
-
- DPRINTK("mode: %s\n", info->fix.id);
-@@ -1042,7 +1052,7 @@ static void fbcon_init(struct vc_data *vc, int init)
- cap = info->flags;
-
- if (vc != svc || logo_shown == FBCON_LOGO_DONTSHOW ||
-- (info->fix.type == FB_TYPE_TEXT))
-+ (info->fix.type == FB_TYPE_TEXT) || fbcon_decor_active(info, vc))
- logo = 0;
-
- if (var_to_display(p, &info->var, info))
-@@ -1275,6 +1285,11 @@ static void fbcon_clear(struct vc_data *vc, int sy, int sx, int height,
- fbcon_clear_margins(vc, 0);
- }
-
-+ if (fbcon_decor_active(info, vc)) {
-+ fbcon_decor_clear(vc, info, sy, sx, height, width);
-+ return;
-+ }
-+
- /* Split blits that cross physical y_wrap boundary */
-
- y_break = p->vrows - p->yscroll;
-@@ -1294,10 +1309,15 @@ static void fbcon_putcs(struct vc_data *vc, const unsigned short *s,
- struct display *p = &fb_display[vc->vc_num];
- struct fbcon_ops *ops = info->fbcon_par;
-
-- if (!fbcon_is_inactive(vc, info))
-- ops->putcs(vc, info, s, count, real_y(p, ypos), xpos,
-- get_color(vc, info, scr_readw(s), 1),
-- get_color(vc, info, scr_readw(s), 0));
-+ if (!fbcon_is_inactive(vc, info)) {
-+
-+ if (fbcon_decor_active(info, vc))
-+ fbcon_decor_putcs(vc, info, s, count, ypos, xpos);
-+ else
-+ ops->putcs(vc, info, s, count, real_y(p, ypos), xpos,
-+ get_color(vc, info, scr_readw(s), 1),
-+ get_color(vc, info, scr_readw(s), 0));
-+ }
- }
-
- static void fbcon_putc(struct vc_data *vc, int c, int ypos, int xpos)
-@@ -1313,8 +1333,12 @@ static void fbcon_clear_margins(struct vc_data *vc, int bottom_only)
- struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
- struct fbcon_ops *ops = info->fbcon_par;
-
-- if (!fbcon_is_inactive(vc, info))
-- ops->clear_margins(vc, info, margin_color, bottom_only);
-+ if (!fbcon_is_inactive(vc, info)) {
-+ if (fbcon_decor_active(info, vc))
-+ fbcon_decor_clear_margins(vc, info, bottom_only);
-+ else
-+ ops->clear_margins(vc, info, margin_color, bottom_only);
-+ }
- }
-
- static void fbcon_cursor(struct vc_data *vc, int mode)
-@@ -1835,7 +1859,7 @@ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b,
- count = vc->vc_rows;
- if (softback_top)
- fbcon_softback_note(vc, t, count);
-- if (logo_shown >= 0)
-+ if (logo_shown >= 0 || fbcon_decor_active(info, vc))
- goto redraw_up;
- switch (p->scrollmode) {
- case SCROLL_MOVE:
-@@ -1928,6 +1952,8 @@ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b,
- count = vc->vc_rows;
- if (logo_shown >= 0)
- goto redraw_down;
-+ if (fbcon_decor_active(info, vc))
-+ goto redraw_down;
- switch (p->scrollmode) {
- case SCROLL_MOVE:
- fbcon_redraw_blit(vc, info, p, b - 1, b - t - count,
-@@ -2076,6 +2102,13 @@ static void fbcon_bmove_rec(struct vc_data *vc, struct display *p, int sy, int s
- }
- return;
- }
-+
-+ if (fbcon_decor_active(info, vc) && sy == dy && height == 1) {
-+ /* must use slower redraw bmove to keep background pic intact */
-+ fbcon_decor_bmove_redraw(vc, info, sy, sx, dx, width);
-+ return;
-+ }
-+
- ops->bmove(vc, info, real_y(p, sy), sx, real_y(p, dy), dx,
- height, width);
- }
-@@ -2146,8 +2179,8 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
- var.yres = virt_h * virt_fh;
- x_diff = info->var.xres - var.xres;
- y_diff = info->var.yres - var.yres;
-- if (x_diff < 0 || x_diff > virt_fw ||
-- y_diff < 0 || y_diff > virt_fh) {
-+ if ((x_diff < 0 || x_diff > virt_fw ||
-+ y_diff < 0 || y_diff > virt_fh) && !vc->vc_decor.state) {
- const struct fb_videomode *mode;
-
- DPRINTK("attempting resize %ix%i\n", var.xres, var.yres);
-@@ -2183,6 +2216,22 @@ static int fbcon_switch(struct vc_data *vc)
-
- info = registered_fb[con2fb_map[vc->vc_num]];
- ops = info->fbcon_par;
-+ prev_console = ops->currcon;
-+ if (prev_console != -1)
-+ old_info = registered_fb[con2fb_map[prev_console]];
-+
-+#ifdef CONFIG_FB_CON_DECOR
-+ if (!fbcon_decor_active_vc(vc) && info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
-+ struct vc_data *vc_curr = vc_cons[prev_console].d;
-+
-+ if (vc_curr && fbcon_decor_active_vc(vc_curr)) {
-+ // Clear the screen to avoid displaying funky colors
-+ // during palette updates.
-+ memset((u8 *)info->screen_base + info->fix.line_length * info->var.yoffset,
-+ 0, info->var.yres * info->fix.line_length);
-+ }
-+ }
-+#endif
-
- if (softback_top) {
- if (softback_lines)
-@@ -2201,9 +2250,6 @@ static int fbcon_switch(struct vc_data *vc)
- logo_shown = FBCON_LOGO_CANSHOW;
- }
-
-- prev_console = ops->currcon;
-- if (prev_console != -1)
-- old_info = registered_fb[con2fb_map[prev_console]];
- /*
- * FIXME: If we have multiple fbdev's loaded, we need to
- * update all info->currcon. Perhaps, we can place this
-@@ -2247,6 +2293,18 @@ static int fbcon_switch(struct vc_data *vc)
- fbcon_del_cursor_timer(old_info);
- }
-
-+ if (fbcon_decor_active_vc(vc)) {
-+ struct vc_data *vc_curr = vc_cons[prev_console].d;
-+
-+ if (!vc_curr->vc_decor.theme ||
-+ strcmp(vc->vc_decor.theme, vc_curr->vc_decor.theme) ||
-+ (fbcon_decor_active_nores(info, vc_curr) &&
-+ !fbcon_decor_active(info, vc_curr))) {
-+ fbcon_decor_disable(vc, 0);
-+ fbcon_decor_call_helper("modechange", vc->vc_num);
-+ }
-+ }
-+
- if (fbcon_is_inactive(vc, info) ||
- ops->blank_state != FB_BLANK_UNBLANK)
- fbcon_del_cursor_timer(info);
-@@ -2355,15 +2413,20 @@ static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch)
- }
- }
-
-- if (!fbcon_is_inactive(vc, info)) {
-+ if (!fbcon_is_inactive(vc, info)) {
- if (ops->blank_state != blank) {
- ops->blank_state = blank;
- fbcon_cursor(vc, blank ? CM_ERASE : CM_DRAW);
- ops->cursor_flash = (!blank);
-
-- if (!(info->flags & FBINFO_MISC_USEREVENT))
-- if (fb_blank(info, blank))
-- fbcon_generic_blank(vc, info, blank);
-+ if (!(info->flags & FBINFO_MISC_USEREVENT)) {
-+ if (fb_blank(info, blank)) {
-+ if (fbcon_decor_active(info, vc))
-+ fbcon_decor_blank(vc, info, blank);
-+ else
-+ fbcon_generic_blank(vc, info, blank);
-+ }
-+ }
- }
-
- if (!blank)
-@@ -2546,13 +2609,22 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
- set_vc_hi_font(vc, true);
-
- if (resize) {
-+ /* reset wrap/pan */
- int cols, rows;
-
- cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
- rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
-+
-+ if (fbcon_decor_active(info, vc)) {
-+ info->var.xoffset = info->var.yoffset = p->yscroll = 0;
-+ cols = vc->vc_decor.twidth;
-+ rows = vc->vc_decor.theight;
-+ }
- cols /= w;
- rows /= h;
-+
- vc_resize(vc, cols, rows);
-+
- if (con_is_visible(vc) && softback_buf)
- fbcon_update_softback(vc);
- } else if (con_is_visible(vc)
-@@ -2681,7 +2753,11 @@ static void fbcon_set_palette(struct vc_data *vc, const unsigned char *table)
- int i, j, k, depth;
- u8 val;
-
-- if (fbcon_is_inactive(vc, info))
-+ if (fbcon_is_inactive(vc, info)
-+#ifdef CONFIG_FB_CON_DECOR
-+ || vc->vc_num != fg_console
-+#endif
-+ )
- return;
-
- if (!con_is_visible(vc))
-@@ -2707,7 +2783,47 @@ static void fbcon_set_palette(struct vc_data *vc, const unsigned char *table)
- } else
- fb_copy_cmap(fb_default_cmap(1 << depth), &palette_cmap);
-
-- fb_set_cmap(&palette_cmap, info);
-+ if (fbcon_decor_active(info, vc_cons[fg_console].d) &&
-+ info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
-+
-+ u16 *red, *green, *blue;
-+ int minlen = min(min(info->var.red.length, info->var.green.length),
-+ info->var.blue.length);
-+
-+ struct fb_cmap cmap = {
-+ .start = 0,
-+ .len = (1 << minlen),
-+ .red = NULL,
-+ .green = NULL,
-+ .blue = NULL,
-+ .transp = NULL
-+ };
-+
-+ red = kmalloc(256 * sizeof(u16) * 3, GFP_KERNEL);
-+
-+ if (!red)
-+ goto out;
-+
-+ green = red + 256;
-+ blue = green + 256;
-+ cmap.red = red;
-+ cmap.green = green;
-+ cmap.blue = blue;
-+
-+ for (i = 0; i < cmap.len; i++)
-+ red[i] = green[i] = blue[i] = (0xffff * i)/(cmap.len-1);
-+
-+ fb_set_cmap(&cmap, info);
-+ fbcon_decor_fix_pseudo_pal(info, vc_cons[fg_console].d);
-+ kfree(red);
-+
-+ return;
-+
-+ } else if (fbcon_decor_active(info, vc_cons[fg_console].d) &&
-+ info->var.bits_per_pixel == 8 && info->bgdecor.cmap.red != NULL)
-+ fb_set_cmap(&info->bgdecor.cmap, info);
-+
-+out: fb_set_cmap(&palette_cmap, info);
- }
-
- static u16 *fbcon_screen_pos(struct vc_data *vc, int offset)
-@@ -2932,7 +3048,14 @@ static void fbcon_modechanged(struct fb_info *info)
- rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
- cols /= vc->vc_font.width;
- rows /= vc->vc_font.height;
-- vc_resize(vc, cols, rows);
-+
-+ if (!fbcon_decor_active_nores(info, vc)) {
-+ vc_resize(vc, cols, rows);
-+ } else {
-+ fbcon_decor_disable(vc, 0);
-+ fbcon_decor_call_helper("modechange", vc->vc_num);
-+ }
-+
- updatescrollmode(p, info, vc);
- scrollback_max = 0;
- scrollback_current = 0;
-@@ -2977,7 +3100,8 @@ static void fbcon_set_all_vcs(struct fb_info *info)
- rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
- cols /= vc->vc_font.width;
- rows /= vc->vc_font.height;
-- vc_resize(vc, cols, rows);
-+ if (!fbcon_decor_active_nores(info, vc))
-+ vc_resize(vc, cols, rows);
- }
-
- if (fg != -1)
-@@ -3618,6 +3742,7 @@ static void fbcon_exit(void)
- }
- }
-
-+ fbcon_decor_exit();
- fbcon_has_exited = 1;
- }
-
-diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
-index f741ba8df01b..b0141433d249 100644
---- a/drivers/video/fbdev/core/fbmem.c
-+++ b/drivers/video/fbdev/core/fbmem.c
-@@ -1253,15 +1253,6 @@ struct fb_fix_screeninfo32 {
- u16 reserved[3];
- };
-
--struct fb_cmap32 {
-- u32 start;
-- u32 len;
-- compat_caddr_t red;
-- compat_caddr_t green;
-- compat_caddr_t blue;
-- compat_caddr_t transp;
--};
--
- static int fb_getput_cmap(struct fb_info *info, unsigned int cmd,
- unsigned long arg)
- {
-diff --git a/include/linux/console_decor.h b/include/linux/console_decor.h
-new file mode 100644
-index 000000000000..15143556c2aa
---- /dev/null
-+++ b/include/linux/console_decor.h
-@@ -0,0 +1,46 @@
-+#ifndef _LINUX_CONSOLE_DECOR_H_
-+#define _LINUX_CONSOLE_DECOR_H_ 1
-+
-+/* A structure used by the framebuffer console decorations (drivers/video/console/fbcondecor.c) */
-+struct vc_decor {
-+ __u8 bg_color; /* The color that is to be treated as transparent */
-+ __u8 state; /* Current decor state: 0 = off, 1 = on */
-+ __u16 tx, ty; /* Top left corner coordinates of the text field */
-+ __u16 twidth, theight; /* Width and height of the text field */
-+ char *theme;
-+};
-+
-+#ifdef __KERNEL__
-+#ifdef CONFIG_COMPAT
-+#include <linux/compat.h>
-+
-+struct vc_decor32 {
-+ __u8 bg_color; /* The color that is to be treated as transparent */
-+ __u8 state; /* Current decor state: 0 = off, 1 = on */
-+ __u16 tx, ty; /* Top left corner coordinates of the text field */
-+ __u16 twidth, theight; /* Width and height of the text field */
-+ compat_uptr_t theme;
-+};
-+
-+#define vc_decor_from_compat(to, from) \
-+ (to).bg_color = (from).bg_color; \
-+ (to).state = (from).state; \
-+ (to).tx = (from).tx; \
-+ (to).ty = (from).ty; \
-+ (to).twidth = (from).twidth; \
-+ (to).theight = (from).theight; \
-+ (to).theme = compat_ptr((from).theme)
-+
-+#define vc_decor_to_compat(to, from) \
-+ (to).bg_color = (from).bg_color; \
-+ (to).state = (from).state; \
-+ (to).tx = (from).tx; \
-+ (to).ty = (from).ty; \
-+ (to).twidth = (from).twidth; \
-+ (to).theight = (from).theight; \
-+ (to).theme = ptr_to_compat((from).theme)
-+
-+#endif /* CONFIG_COMPAT */
-+#endif /* __KERNEL__ */
-+
-+#endif
-diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h
-index c0ec478ea5bf..8bfed6b21fc9 100644
---- a/include/linux/console_struct.h
-+++ b/include/linux/console_struct.h
-@@ -21,6 +21,7 @@ struct vt_struct;
- struct uni_pagedir;
-
- #define NPAR 16
-+#include <linux/console_decor.h>
-
- /*
- * Example: vc_data of a console that was scrolled 3 lines down.
-@@ -141,6 +142,8 @@ struct vc_data {
- struct uni_pagedir *vc_uni_pagedir;
- struct uni_pagedir **vc_uni_pagedir_loc; /* [!] Location of uni_pagedir variable for this console */
- bool vc_panic_force_write; /* when oops/panic this VC can accept forced output/blanking */
-+
-+ struct vc_decor vc_decor;
- /* additional information is in vt_kern.h */
- };
-
-diff --git a/include/linux/fb.h b/include/linux/fb.h
-index bc24e48e396d..ad7d182c7545 100644
---- a/include/linux/fb.h
-+++ b/include/linux/fb.h
-@@ -239,6 +239,34 @@ struct fb_deferred_io {
- };
- #endif
-
-+#ifdef __KERNEL__
-+#ifdef CONFIG_COMPAT
-+struct fb_image32 {
-+ __u32 dx; /* Where to place image */
-+ __u32 dy;
-+ __u32 width; /* Size of image */
-+ __u32 height;
-+ __u32 fg_color; /* Only used when a mono bitmap */
-+ __u32 bg_color;
-+ __u8 depth; /* Depth of the image */
-+ const compat_uptr_t data; /* Pointer to image data */
-+ struct fb_cmap32 cmap; /* color map info */
-+};
-+
-+#define fb_image_from_compat(to, from) \
-+ (to).dx = (from).dx; \
-+ (to).dy = (from).dy; \
-+ (to).width = (from).width; \
-+ (to).height = (from).height; \
-+ (to).fg_color = (from).fg_color; \
-+ (to).bg_color = (from).bg_color; \
-+ (to).depth = (from).depth; \
-+ (to).data = compat_ptr((from).data); \
-+ fb_cmap_from_compat((to).cmap, (from).cmap)
-+
-+#endif /* CONFIG_COMPAT */
-+#endif /* __KERNEL__ */
-+
- /*
- * Frame buffer operations
- *
-@@ -509,6 +537,9 @@ struct fb_info {
- #define FBINFO_STATE_SUSPENDED 1
- u32 state; /* Hardware state i.e suspend */
- void *fbcon_par; /* fbcon use-only private area */
-+
-+ struct fb_image bgdecor;
-+
- /* From here on everything is device dependent */
- void *par;
- /* we need the PCI or similar aperture base/size not
-diff --git a/include/uapi/linux/fb.h b/include/uapi/linux/fb.h
-index 6cd9b198b7c6..a228440649fa 100644
---- a/include/uapi/linux/fb.h
-+++ b/include/uapi/linux/fb.h
-@@ -9,6 +9,23 @@
-
- #define FB_MAX 32 /* sufficient for now */
-
-+struct fbcon_decor_iowrapper {
-+ unsigned short vc; /* Virtual console */
-+ unsigned char origin; /* Point of origin of the request */
-+ void *data;
-+};
-+
-+#ifdef __KERNEL__
-+#ifdef CONFIG_COMPAT
-+#include <linux/compat.h>
-+struct fbcon_decor_iowrapper32 {
-+ unsigned short vc; /* Virtual console */
-+ unsigned char origin; /* Point of origin of the request */
-+ compat_uptr_t data;
-+};
-+#endif /* CONFIG_COMPAT */
-+#endif /* __KERNEL__ */
-+
- /* ioctls
- 0x46 is 'F' */
- #define FBIOGET_VSCREENINFO 0x4600
-@@ -36,6 +53,25 @@
- #define FBIOGET_DISPINFO 0x4618
- #define FBIO_WAITFORVSYNC _IOW('F', 0x20, __u32)
-
-+#define FBIOCONDECOR_SETCFG _IOWR('F', 0x19, struct fbcon_decor_iowrapper)
-+#define FBIOCONDECOR_GETCFG _IOR('F', 0x1A, struct fbcon_decor_iowrapper)
-+#define FBIOCONDECOR_SETSTATE _IOWR('F', 0x1B, struct fbcon_decor_iowrapper)
-+#define FBIOCONDECOR_GETSTATE _IOR('F', 0x1C, struct fbcon_decor_iowrapper)
-+#define FBIOCONDECOR_SETPIC _IOWR('F', 0x1D, struct fbcon_decor_iowrapper)
-+#ifdef __KERNEL__
-+#ifdef CONFIG_COMPAT
-+#define FBIOCONDECOR_SETCFG32 _IOWR('F', 0x19, struct fbcon_decor_iowrapper32)
-+#define FBIOCONDECOR_GETCFG32 _IOR('F', 0x1A, struct fbcon_decor_iowrapper32)
-+#define FBIOCONDECOR_SETSTATE32 _IOWR('F', 0x1B, struct fbcon_decor_iowrapper32)
-+#define FBIOCONDECOR_GETSTATE32 _IOR('F', 0x1C, struct fbcon_decor_iowrapper32)
-+#define FBIOCONDECOR_SETPIC32 _IOWR('F', 0x1D, struct fbcon_decor_iowrapper32)
-+#endif /* CONFIG_COMPAT */
-+#endif /* __KERNEL__ */
-+
-+#define FBCON_DECOR_THEME_LEN 128 /* Maximum length of a theme name */
-+#define FBCON_DECOR_IO_ORIG_KERNEL 0 /* Kernel ioctl origin */
-+#define FBCON_DECOR_IO_ORIG_USER 1 /* User ioctl origin */
-+
- #define FB_TYPE_PACKED_PIXELS 0 /* Packed Pixels */
- #define FB_TYPE_PLANES 1 /* Non interleaved planes */
- #define FB_TYPE_INTERLEAVED_PLANES 2 /* Interleaved planes */
-@@ -278,6 +314,29 @@ struct fb_var_screeninfo {
- __u32 reserved[4]; /* Reserved for future compatibility */
- };
-
-+#ifdef __KERNEL__
-+#ifdef CONFIG_COMPAT
-+struct fb_cmap32 {
-+ __u32 start;
-+ __u32 len; /* Number of entries */
-+ compat_uptr_t red; /* Red values */
-+ compat_uptr_t green;
-+ compat_uptr_t blue;
-+ compat_uptr_t transp; /* transparency, can be NULL */
-+};
-+
-+#define fb_cmap_from_compat(to, from) \
-+ (to).start = (from).start; \
-+ (to).len = (from).len; \
-+ (to).red = compat_ptr((from).red); \
-+ (to).green = compat_ptr((from).green); \
-+ (to).blue = compat_ptr((from).blue); \
-+ (to).transp = compat_ptr((from).transp)
-+
-+#endif /* CONFIG_COMPAT */
-+#endif /* __KERNEL__ */
-+
-+
- struct fb_cmap {
- __u32 start; /* First entry */
- __u32 len; /* Number of entries */
-diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index d9c31bc2eaea..e33ac56cc32a 100644
---- a/kernel/sysctl.c
-+++ b/kernel/sysctl.c
-@@ -150,6 +150,10 @@ static const int cap_last_cap = CAP_LAST_CAP;
- static unsigned long hung_task_timeout_max = (LONG_MAX/HZ);
- #endif
-
-+#ifdef CONFIG_FB_CON_DECOR
-+extern char fbcon_decor_path[];
-+#endif
-+
- #ifdef CONFIG_INOTIFY_USER
- #include <linux/inotify.h>
- #endif
-@@ -283,6 +287,15 @@ static struct ctl_table sysctl_base_table[] = {
- .mode = 0555,
- .child = dev_table,
- },
-+#ifdef CONFIG_FB_CON_DECOR
-+ {
-+ .procname = "fbcondecor",
-+ .data = &fbcon_decor_path,
-+ .maxlen = KMOD_PATH_LEN,
-+ .mode = 0644,
-+ .proc_handler = &proc_dostring,
-+ },
-+#endif
- { }
- };
-
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-09-23 12:07 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-09-23 12:07 UTC (permalink / raw
To: gentoo-commits
commit: f9b71e81f1e521cd7b9c44697540ef76275bfbcb
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 23 12:07:30 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Sep 23 12:07:30 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f9b71e81
Linux patch 4.19.147
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1146_linux-4.19.147.patch | 1758 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1762 insertions(+)
diff --git a/0000_README b/0000_README
index 5d9a94a..4996714 100644
--- a/0000_README
+++ b/0000_README
@@ -623,6 +623,10 @@ Patch: 1145_linux-4.19.146.patch
From: https://www.kernel.org
Desc: Linux 4.19.146
+Patch: 1146_linux-4.19.147.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.147
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1146_linux-4.19.147.patch b/1146_linux-4.19.147.patch
new file mode 100644
index 0000000..11c1e98
--- /dev/null
+++ b/1146_linux-4.19.147.patch
@@ -0,0 +1,1758 @@
+diff --git a/Makefile b/Makefile
+index aaeb3f3dbcea8..ee648a902ce31 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 146
++SUBLEVEL = 147
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index a830a9701e501..cc8c8d22afaf5 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -852,6 +852,7 @@ config SNI_RM
+ select I8253
+ select I8259
+ select ISA
++ select MIPS_L1_CACHE_SHIFT_6
+ select SWAP_IO_SPACE if CPU_BIG_ENDIAN
+ select SYS_HAS_CPU_R4X00
+ select SYS_HAS_CPU_R5000
+diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
+index e7f5ef6bed0fe..79485790f7b56 100644
+--- a/arch/mips/kvm/mips.c
++++ b/arch/mips/kvm/mips.c
+@@ -131,6 +131,8 @@ void kvm_arch_check_processor_compat(void *rtn)
+ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
+ {
+ switch (type) {
++ case KVM_VM_MIPS_AUTO:
++ break;
+ #ifdef CONFIG_KVM_MIPS_VZ
+ case KVM_VM_MIPS_VZ:
+ #else
+diff --git a/arch/mips/sni/a20r.c b/arch/mips/sni/a20r.c
+index f9407e1704762..c6af7047eb0d2 100644
+--- a/arch/mips/sni/a20r.c
++++ b/arch/mips/sni/a20r.c
+@@ -143,7 +143,10 @@ static struct platform_device sc26xx_pdev = {
+ },
+ };
+
+-static u32 a20r_ack_hwint(void)
++/*
++ * Trigger chipset to update CPU's CAUSE IP field
++ */
++static u32 a20r_update_cause_ip(void)
+ {
+ u32 status = read_c0_status();
+
+@@ -205,12 +208,14 @@ static void a20r_hwint(void)
+ int irq;
+
+ clear_c0_status(IE_IRQ0);
+- status = a20r_ack_hwint();
++ status = a20r_update_cause_ip();
+ cause = read_c0_cause();
+
+ irq = ffs(((cause & status) >> 8) & 0xf8);
+ if (likely(irq > 0))
+ do_IRQ(SNI_A20R_IRQ_BASE + irq - 1);
++
++ a20r_update_cause_ip();
+ set_c0_status(IE_IRQ0);
+ }
+
+diff --git a/arch/openrisc/mm/cache.c b/arch/openrisc/mm/cache.c
+index b747bf1fc1b63..4272d9123f9ed 100644
+--- a/arch/openrisc/mm/cache.c
++++ b/arch/openrisc/mm/cache.c
+@@ -20,7 +20,7 @@
+ #include <asm/cacheflush.h>
+ #include <asm/tlbflush.h>
+
+-static void cache_loop(struct page *page, const unsigned int reg)
++static __always_inline void cache_loop(struct page *page, const unsigned int reg)
+ {
+ unsigned long paddr = page_to_pfn(page) << PAGE_SHIFT;
+ unsigned long line = paddr & ~(L1_CACHE_BYTES - 1);
+diff --git a/arch/powerpc/kernel/dma-iommu.c b/arch/powerpc/kernel/dma-iommu.c
+index f9fe2080ceb90..eed3543aeca46 100644
+--- a/arch/powerpc/kernel/dma-iommu.c
++++ b/arch/powerpc/kernel/dma-iommu.c
+@@ -100,7 +100,8 @@ static u64 dma_iommu_get_required_mask(struct device *dev)
+ if (!tbl)
+ return 0;
+
+- mask = 1ULL < (fls_long(tbl->it_offset + tbl->it_size) - 1);
++ mask = 1ULL << (fls_long(tbl->it_offset + tbl->it_size) +
++ tbl->it_page_shift - 1);
+ mask += mask - 1;
+
+ return mask;
+diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
+index 466f66c8a7f8d..b337a0cd58ba4 100644
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -38,6 +38,8 @@ KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
+ KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member)
+ KBUILD_CFLAGS += $(call cc-disable-warning, gnu)
+ KBUILD_CFLAGS += -Wno-pointer-sign
++# Disable relocation relaxation in case the link is not PIE.
++KBUILD_CFLAGS += $(call as-option,-Wa$(comma)-mrelax-relocations=no)
+
+ KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
+ GCOV_PROFILE := n
+diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig
+index 5a23a4ccd7556..9218cb1286611 100644
+--- a/arch/x86/configs/i386_defconfig
++++ b/arch/x86/configs/i386_defconfig
+@@ -245,6 +245,7 @@ CONFIG_USB_HIDDEV=y
+ CONFIG_USB=y
+ CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+ CONFIG_USB_MON=y
++CONFIG_USB_XHCI_HCD=y
+ CONFIG_USB_EHCI_HCD=y
+ CONFIG_USB_EHCI_TT_NEWSCHED=y
+ CONFIG_USB_OHCI_HCD=y
+diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
+index dc08812929046..146a12293396d 100644
+--- a/arch/x86/configs/x86_64_defconfig
++++ b/arch/x86/configs/x86_64_defconfig
+@@ -241,6 +241,7 @@ CONFIG_USB_HIDDEV=y
+ CONFIG_USB=y
+ CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+ CONFIG_USB_MON=y
++CONFIG_USB_XHCI_HCD=y
+ CONFIG_USB_EHCI_HCD=y
+ CONFIG_USB_EHCI_TT_NEWSCHED=y
+ CONFIG_USB_OHCI_HCD=y
+diff --git a/drivers/clk/davinci/pll.c b/drivers/clk/davinci/pll.c
+index 1c99e992d6388..796b428998ae0 100644
+--- a/drivers/clk/davinci/pll.c
++++ b/drivers/clk/davinci/pll.c
+@@ -491,7 +491,7 @@ struct clk *davinci_pll_clk_register(struct device *dev,
+ parent_name = postdiv_name;
+ }
+
+- pllen = kzalloc(sizeof(*pllout), GFP_KERNEL);
++ pllen = kzalloc(sizeof(*pllen), GFP_KERNEL);
+ if (!pllen) {
+ ret = -ENOMEM;
+ goto err_unregister_postdiv;
+diff --git a/drivers/clk/rockchip/clk-rk3228.c b/drivers/clk/rockchip/clk-rk3228.c
+index 04f4f3739e3be..8d11d76e1db7c 100644
+--- a/drivers/clk/rockchip/clk-rk3228.c
++++ b/drivers/clk/rockchip/clk-rk3228.c
+@@ -144,7 +144,7 @@ PNAME(mux_usb480m_p) = { "usb480m_phy", "xin24m" };
+ PNAME(mux_hdmiphy_p) = { "hdmiphy_phy", "xin24m" };
+ PNAME(mux_aclk_cpu_src_p) = { "cpll_aclk_cpu", "gpll_aclk_cpu", "hdmiphy_aclk_cpu" };
+
+-PNAME(mux_pll_src_4plls_p) = { "cpll", "gpll", "hdmiphy" "usb480m" };
++PNAME(mux_pll_src_4plls_p) = { "cpll", "gpll", "hdmiphy", "usb480m" };
+ PNAME(mux_pll_src_3plls_p) = { "cpll", "gpll", "hdmiphy" };
+ PNAME(mux_pll_src_2plls_p) = { "cpll", "gpll" };
+ PNAME(mux_sclk_hdmi_cec_p) = { "cpll", "gpll", "xin24m" };
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+index 947bc6d623020..d143217636071 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -600,8 +600,13 @@ err_pm:
+ pm_runtime_disable(dev);
+ err_node:
+ of_node_put(private->mutex_node);
+- for (i = 0; i < DDP_COMPONENT_ID_MAX; i++)
++ for (i = 0; i < DDP_COMPONENT_ID_MAX; i++) {
+ of_node_put(private->comp_node[i]);
++ if (private->ddp_comp[i]) {
++ put_device(private->ddp_comp[i]->larb_dev);
++ private->ddp_comp[i] = NULL;
++ }
++ }
+ return ret;
+ }
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 62444a3a5742a..331fb0c129290 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1476,25 +1476,30 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ dev_err(dev,
+ "Failed to get system configuration registers: %d\n",
+ ret);
+- return ret;
++ goto put_device;
+ }
+ hdmi->sys_regmap = regmap;
+
+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ hdmi->regs = devm_ioremap_resource(dev, mem);
+- if (IS_ERR(hdmi->regs))
+- return PTR_ERR(hdmi->regs);
++ if (IS_ERR(hdmi->regs)) {
++ ret = PTR_ERR(hdmi->regs);
++ goto put_device;
++ }
+
+ remote = of_graph_get_remote_node(np, 1, 0);
+- if (!remote)
+- return -EINVAL;
++ if (!remote) {
++ ret = -EINVAL;
++ goto put_device;
++ }
+
+ if (!of_device_is_compatible(remote, "hdmi-connector")) {
+ hdmi->next_bridge = of_drm_find_bridge(remote);
+ if (!hdmi->next_bridge) {
+ dev_err(dev, "Waiting for external bridge\n");
+ of_node_put(remote);
+- return -EPROBE_DEFER;
++ ret = -EPROBE_DEFER;
++ goto put_device;
+ }
+ }
+
+@@ -1503,7 +1508,8 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ dev_err(dev, "Failed to find ddc-i2c-bus node in %pOF\n",
+ remote);
+ of_node_put(remote);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_device;
+ }
+ of_node_put(remote);
+
+@@ -1511,10 +1517,14 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ of_node_put(i2c_np);
+ if (!hdmi->ddc_adpt) {
+ dev_err(dev, "Failed to get ddc i2c adapter by node\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_device;
+ }
+
+ return 0;
++put_device:
++ put_device(hdmi->cec_dev);
++ return ret;
+ }
+
+ /*
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index c83361a8e2033..7920b0d7e35a7 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -779,7 +779,7 @@ static void vmbus_wait_for_unload(void)
+ void *page_addr;
+ struct hv_message *msg;
+ struct vmbus_channel_message_header *hdr;
+- u32 message_type;
++ u32 message_type, i;
+
+ /*
+ * CHANNELMSG_UNLOAD_RESPONSE is always delivered to the CPU which was
+@@ -789,8 +789,11 @@ static void vmbus_wait_for_unload(void)
+ * functional and vmbus_unload_response() will complete
+ * vmbus_connection.unload_event. If not, the last thing we can do is
+ * read message pages for all CPUs directly.
++ *
++ * Wait no more than 10 seconds so that the panic path can't get
++ * hung forever in case the response message isn't seen.
+ */
+- while (1) {
++ for (i = 0; i < 1000; i++) {
+ if (completion_done(&vmbus_connection.unload_event))
+ break;
+
+diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
+index 0e745f82d6a53..f328de980855d 100644
+--- a/drivers/i2c/algos/i2c-algo-pca.c
++++ b/drivers/i2c/algos/i2c-algo-pca.c
+@@ -50,8 +50,22 @@ static void pca_reset(struct i2c_algo_pca_data *adap)
+ pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_IPRESET);
+ pca_outw(adap, I2C_PCA_IND, 0xA5);
+ pca_outw(adap, I2C_PCA_IND, 0x5A);
++
++ /*
++ * After a reset we need to re-apply any configuration
++ * (calculated in pca_init) to get the bus in a working state.
++ */
++ pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_IMODE);
++ pca_outw(adap, I2C_PCA_IND, adap->bus_settings.mode);
++ pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_ISCLL);
++ pca_outw(adap, I2C_PCA_IND, adap->bus_settings.tlow);
++ pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_ISCLH);
++ pca_outw(adap, I2C_PCA_IND, adap->bus_settings.thi);
++
++ pca_set_con(adap, I2C_PCA_CON_ENSIO);
+ } else {
+ adap->reset_chip(adap->data);
++ pca_set_con(adap, I2C_PCA_CON_ENSIO | adap->bus_settings.clock_freq);
+ }
+ }
+
+@@ -432,13 +446,14 @@ static int pca_init(struct i2c_adapter *adap)
+ " Use the nominal frequency.\n", adap->name);
+ }
+
+- pca_reset(pca_data);
+-
+ clock = pca_clock(pca_data);
+ printk(KERN_INFO "%s: Clock frequency is %dkHz\n",
+ adap->name, freqs[clock]);
+
+- pca_set_con(pca_data, I2C_PCA_CON_ENSIO | clock);
++ /* Store settings as these will be needed when the PCA chip is reset */
++ pca_data->bus_settings.clock_freq = clock;
++
++ pca_reset(pca_data);
+ } else {
+ int clock;
+ int mode;
+@@ -505,19 +520,15 @@ static int pca_init(struct i2c_adapter *adap)
+ thi = tlow * min_thi / min_tlow;
+ }
+
++ /* Store settings as these will be needed when the PCA chip is reset */
++ pca_data->bus_settings.mode = mode;
++ pca_data->bus_settings.tlow = tlow;
++ pca_data->bus_settings.thi = thi;
++
+ pca_reset(pca_data);
+
+ printk(KERN_INFO
+ "%s: Clock frequency is %dHz\n", adap->name, clock * 100);
+-
+- pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_IMODE);
+- pca_outw(pca_data, I2C_PCA_IND, mode);
+- pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_ISCLL);
+- pca_outw(pca_data, I2C_PCA_IND, tlow);
+- pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_ISCLH);
+- pca_outw(pca_data, I2C_PCA_IND, thi);
+-
+- pca_set_con(pca_data, I2C_PCA_CON_ENSIO);
+ }
+ udelay(500); /* 500 us for oscillator to stabilise */
+
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 679c6c41f64b4..58fc17e46694d 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -1506,6 +1506,16 @@ static inline int i801_acpi_probe(struct i801_priv *priv) { return 0; }
+ static inline void i801_acpi_remove(struct i801_priv *priv) { }
+ #endif
+
++static unsigned char i801_setup_hstcfg(struct i801_priv *priv)
++{
++ unsigned char hstcfg = priv->original_hstcfg;
++
++ hstcfg &= ~SMBHSTCFG_I2C_EN; /* SMBus timing */
++ hstcfg |= SMBHSTCFG_HST_EN;
++ pci_write_config_byte(priv->pci_dev, SMBHSTCFG, hstcfg);
++ return hstcfg;
++}
++
+ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ {
+ unsigned char temp;
+@@ -1611,14 +1621,10 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ return err;
+ }
+
+- pci_read_config_byte(priv->pci_dev, SMBHSTCFG, &temp);
+- priv->original_hstcfg = temp;
+- temp &= ~SMBHSTCFG_I2C_EN; /* SMBus timing */
+- if (!(temp & SMBHSTCFG_HST_EN)) {
++ pci_read_config_byte(priv->pci_dev, SMBHSTCFG, &priv->original_hstcfg);
++ temp = i801_setup_hstcfg(priv);
++ if (!(priv->original_hstcfg & SMBHSTCFG_HST_EN))
+ dev_info(&dev->dev, "Enabling SMBus device\n");
+- temp |= SMBHSTCFG_HST_EN;
+- }
+- pci_write_config_byte(priv->pci_dev, SMBHSTCFG, temp);
+
+ if (temp & SMBHSTCFG_SMB_SMI_EN) {
+ dev_dbg(&dev->dev, "SMBus using interrupt SMI#\n");
+@@ -1745,6 +1751,7 @@ static int i801_resume(struct device *dev)
+ struct pci_dev *pci_dev = to_pci_dev(dev);
+ struct i801_priv *priv = pci_get_drvdata(pci_dev);
+
++ i801_setup_hstcfg(priv);
+ i801_enable_host_notify(&priv->adapter);
+
+ return 0;
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+index 09e7d3dd30553..336144876363a 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+@@ -141,7 +141,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
+ attr->max_inline_data = le32_to_cpu(sb->max_inline_data);
+ attr->l2_db_size = (sb->l2_db_space_size + 1) *
+ (0x01 << RCFW_DBR_BASE_PAGE_SHIFT);
+- attr->max_sgid = le32_to_cpu(sb->max_gid);
++ attr->max_sgid = BNXT_QPLIB_NUM_GIDS_SUPPORTED;
+
+ bnxt_qplib_query_version(rcfw, attr->fw_ver);
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
+index 9d3e8b9949458..b6e9e0ef79391 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h
++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
+@@ -47,6 +47,7 @@
+ struct bnxt_qplib_dev_attr {
+ #define FW_VER_ARR_LEN 4
+ u8 fw_ver[FW_VER_ARR_LEN];
++#define BNXT_QPLIB_NUM_GIDS_SUPPORTED 256
+ u16 max_sgid;
+ u16 max_mrw;
+ u32 max_qp;
+diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
+index 6590d10f166fe..31c16b68aa311 100644
+--- a/drivers/input/mouse/trackpoint.c
++++ b/drivers/input/mouse/trackpoint.c
+@@ -20,10 +20,12 @@
+ #include "trackpoint.h"
+
+ static const char * const trackpoint_variants[] = {
+- [TP_VARIANT_IBM] = "IBM",
+- [TP_VARIANT_ALPS] = "ALPS",
+- [TP_VARIANT_ELAN] = "Elan",
+- [TP_VARIANT_NXP] = "NXP",
++ [TP_VARIANT_IBM] = "IBM",
++ [TP_VARIANT_ALPS] = "ALPS",
++ [TP_VARIANT_ELAN] = "Elan",
++ [TP_VARIANT_NXP] = "NXP",
++ [TP_VARIANT_JYT_SYNAPTICS] = "JYT_Synaptics",
++ [TP_VARIANT_SYNAPTICS] = "Synaptics",
+ };
+
+ /*
+diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h
+index 538986e5ac5bc..4ebcdf802e9a2 100644
+--- a/drivers/input/mouse/trackpoint.h
++++ b/drivers/input/mouse/trackpoint.h
+@@ -27,10 +27,12 @@
+ * 0x01 was the original IBM trackpoint, others implement very limited
+ * subset of trackpoint features.
+ */
+-#define TP_VARIANT_IBM 0x01
+-#define TP_VARIANT_ALPS 0x02
+-#define TP_VARIANT_ELAN 0x03
+-#define TP_VARIANT_NXP 0x04
++#define TP_VARIANT_IBM 0x01
++#define TP_VARIANT_ALPS 0x02
++#define TP_VARIANT_ELAN 0x03
++#define TP_VARIANT_NXP 0x04
++#define TP_VARIANT_JYT_SYNAPTICS 0x05
++#define TP_VARIANT_SYNAPTICS 0x06
+
+ /*
+ * Commands
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 8134c7f928165..7c05e09abacf9 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -552,6 +552,14 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"),
+ },
+ },
++ {
++ /* Entroware Proteus */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Entroware"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Proteus"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"),
++ },
++ },
+ { }
+ };
+
+@@ -680,6 +688,14 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
+ },
+ },
++ {
++ /* Entroware Proteus */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Entroware"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Proteus"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"),
++ },
++ },
+ { }
+ };
+
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 4a5d99ecb89d3..2dff0e110c6f3 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -378,7 +378,7 @@ static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb,
+ }
+ rcu_read_unlock();
+
+- while (unlikely(txq >= ndev->real_num_tx_queues))
++ while (txq >= ndev->real_num_tx_queues)
+ txq -= ndev->real_num_tx_queues;
+
+ return txq;
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index bb3b447c56468..73db32f97abf3 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1791,6 +1791,7 @@ nvme_fc_term_aen_ops(struct nvme_fc_ctrl *ctrl)
+ struct nvme_fc_fcp_op *aen_op;
+ int i;
+
++ cancel_work_sync(&ctrl->ctrl.async_event_work);
+ aen_op = ctrl->aen_ops;
+ for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++) {
+ if (!aen_op->fcp_req.private)
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 7e2cdb17c26d8..077c678166651 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -740,6 +740,7 @@ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset);
+ }
+ if (ctrl->async_event_sqe.data) {
++ cancel_work_sync(&ctrl->ctrl.async_event_work);
+ nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe,
+ sizeof(struct nvme_command), DMA_TO_DEVICE);
+ ctrl->async_event_sqe.data = NULL;
+diff --git a/drivers/rapidio/Kconfig b/drivers/rapidio/Kconfig
+index d6d2f20c45977..21df2816def76 100644
+--- a/drivers/rapidio/Kconfig
++++ b/drivers/rapidio/Kconfig
+@@ -25,7 +25,7 @@ config RAPIDIO_ENABLE_RX_TX_PORTS
+ config RAPIDIO_DMA_ENGINE
+ bool "DMA Engine support for RapidIO"
+ depends on RAPIDIO
+- select DMADEVICES
++ depends on DMADEVICES
+ select DMA_ENGINE
+ help
+ Say Y here if you want to use DMA Engine frameork for RapidIO data
+diff --git a/drivers/regulator/pwm-regulator.c b/drivers/regulator/pwm-regulator.c
+index a2fd140eff81a..34f3b9778ffa1 100644
+--- a/drivers/regulator/pwm-regulator.c
++++ b/drivers/regulator/pwm-regulator.c
+@@ -285,7 +285,7 @@ static int pwm_regulator_init_table(struct platform_device *pdev,
+ return ret;
+ }
+
+- drvdata->state = -EINVAL;
++ drvdata->state = -ENOTRECOVERABLE;
+ drvdata->duty_cycle_table = duty_cycle_table;
+ memcpy(&drvdata->ops, &pwm_regulator_voltage_table_ops,
+ sizeof(drvdata->ops));
+diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c
+index 78cf5b32bca67..0b3f4538c1d4d 100644
+--- a/drivers/scsi/libfc/fc_disc.c
++++ b/drivers/scsi/libfc/fc_disc.c
+@@ -646,8 +646,6 @@ free_fp:
+ fc_frame_free(fp);
+ out:
+ kref_put(&rdata->kref, fc_rport_destroy);
+- if (!IS_ERR(fp))
+- fc_frame_free(fp);
+ }
+
+ /**
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 9032793c405eb..6a4b496081e4a 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -4112,7 +4112,9 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ out:
+ if (ndlp && NLP_CHK_NODE_ACT(ndlp) && shost) {
+ spin_lock_irq(shost->host_lock);
+- ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI);
++ if (mbox)
++ ndlp->nlp_flag &= ~NLP_ACC_REGLOGIN;
++ ndlp->nlp_flag &= ~NLP_RM_DFLT_RPI;
+ spin_unlock_irq(shost->host_lock);
+
+ /* If the node is not being used by another discovery thread,
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 5be4212312cb0..ba79b37d8cf7e 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -794,7 +794,7 @@ pm8001_exec_internal_task_abort(struct pm8001_hba_info *pm8001_ha,
+
+ res = pm8001_tag_alloc(pm8001_ha, &ccb_tag);
+ if (res)
+- return res;
++ goto ex_err;
+ ccb = &pm8001_ha->ccb_info[ccb_tag];
+ ccb->device = pm8001_dev;
+ ccb->ccb_tag = ccb_tag;
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index a9dc9c4a63826..47835d26a9730 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -262,8 +262,8 @@ struct name_list_extended {
+ struct get_name_list_extended *l;
+ dma_addr_t ldma;
+ struct list_head fcports;
+- spinlock_t fcports_lock;
+ u32 size;
++ u8 sent;
+ };
+ /*
+ * Timeout timer counts in seconds
+@@ -2351,7 +2351,7 @@ typedef struct fc_port {
+ unsigned int login_succ:1;
+ unsigned int query:1;
+ unsigned int id_changed:1;
+- unsigned int rscn_rcvd:1;
++ unsigned int scan_needed:1;
+
+ struct work_struct nvme_del_work;
+ struct completion nvme_del_done;
+@@ -2375,11 +2375,13 @@ typedef struct fc_port {
+ unsigned long expires;
+ struct list_head del_list_entry;
+ struct work_struct free_work;
+-
++ struct work_struct reg_work;
++ uint64_t jiffies_at_registration;
+ struct qlt_plogi_ack_t *plogi_link[QLT_PLOGI_LINK_MAX];
+
+ uint16_t tgt_id;
+ uint16_t old_tgt_id;
++ uint16_t sec_since_registration;
+
+ uint8_t fcp_prio;
+
+@@ -2412,6 +2414,7 @@ typedef struct fc_port {
+ struct qla_tgt_sess *tgt_session;
+ struct ct_sns_desc ct_desc;
+ enum discovery_state disc_state;
++ enum discovery_state next_disc_state;
+ enum login_state fw_login_state;
+ unsigned long dm_login_expire;
+ unsigned long plogi_nack_done_deadline;
+@@ -3222,7 +3225,6 @@ enum qla_work_type {
+ QLA_EVT_GPDB,
+ QLA_EVT_PRLI,
+ QLA_EVT_GPSC,
+- QLA_EVT_UPD_FCPORT,
+ QLA_EVT_GNL,
+ QLA_EVT_NACK,
+ QLA_EVT_RELOGIN,
+diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
+index 178974896b5c7..b8e4abe804d5d 100644
+--- a/drivers/scsi/qla2xxx/qla_gbl.h
++++ b/drivers/scsi/qla2xxx/qla_gbl.h
+@@ -54,7 +54,7 @@ extern void qla2x00_abort_isp_cleanup(scsi_qla_host_t *);
+ extern void qla2x00_quiesce_io(scsi_qla_host_t *);
+
+ extern void qla2x00_update_fcport(scsi_qla_host_t *, fc_port_t *);
+-
++void qla_register_fcport_fn(struct work_struct *);
+ extern void qla2x00_alloc_fw_dump(scsi_qla_host_t *);
+ extern void qla2x00_try_to_stop_firmware(scsi_qla_host_t *);
+
+@@ -109,6 +109,7 @@ int qla24xx_post_newsess_work(struct scsi_qla_host *, port_id_t *, u8 *, u8*,
+ int qla24xx_fcport_handle_login(struct scsi_qla_host *, fc_port_t *);
+ int qla24xx_detect_sfp(scsi_qla_host_t *vha);
+ int qla24xx_post_gpdb_work(struct scsi_qla_host *, fc_port_t *, u8);
++
+ void qla2x00_async_prlo_done(struct scsi_qla_host *, fc_port_t *,
+ uint16_t *);
+ extern int qla2x00_post_async_prlo_work(struct scsi_qla_host *, fc_port_t *,
+@@ -208,7 +209,7 @@ extern void qla2x00_disable_board_on_pci_error(struct work_struct *);
+ extern void qla2x00_sp_compl(void *, int);
+ extern void qla2xxx_qpair_sp_free_dma(void *);
+ extern void qla2xxx_qpair_sp_compl(void *, int);
+-extern int qla24xx_post_upd_fcport_work(struct scsi_qla_host *, fc_port_t *);
++extern void qla24xx_sched_upd_fcport(fc_port_t *);
+ void qla2x00_handle_login_done_event(struct scsi_qla_host *, fc_port_t *,
+ uint16_t *);
+ int qla24xx_post_gnl_work(struct scsi_qla_host *, fc_port_t *);
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index f621cb55ccfb2..c3195d4c25e5c 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3973,7 +3973,7 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ list_for_each_entry(fcport, &vha->vp_fcports, list) {
+ if (memcmp(rp->port_name, fcport->port_name, WWN_SIZE))
+ continue;
+- fcport->rscn_rcvd = 0;
++ fcport->scan_needed = 0;
+ fcport->scan_state = QLA_FCPORT_FOUND;
+ found = true;
+ /*
+@@ -4009,20 +4009,19 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ */
+ list_for_each_entry(fcport, &vha->vp_fcports, list) {
+ if ((fcport->flags & FCF_FABRIC_DEVICE) == 0) {
+- fcport->rscn_rcvd = 0;
++ fcport->scan_needed = 0;
+ continue;
+ }
+
+ if (fcport->scan_state != QLA_FCPORT_FOUND) {
+- fcport->rscn_rcvd = 0;
++ fcport->scan_needed = 0;
+ if ((qla_dual_mode_enabled(vha) ||
+ qla_ini_mode_enabled(vha)) &&
+ atomic_read(&fcport->state) == FCS_ONLINE) {
+- qla2x00_mark_device_lost(vha, fcport,
+- ql2xplogiabsentdevice, 0);
++ if (fcport->loop_id != FC_NO_LOOP_ID) {
++ if (fcport->flags & FCF_FCP2_DEVICE)
++ fcport->logout_on_delete = 0;
+
+- if (fcport->loop_id != FC_NO_LOOP_ID &&
+- (fcport->flags & FCF_FCP2_DEVICE) == 0) {
+ ql_dbg(ql_dbg_disc, vha, 0x20f0,
+ "%s %d %8phC post del sess\n",
+ __func__, __LINE__,
+@@ -4033,7 +4032,7 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ }
+ }
+ } else {
+- if (fcport->rscn_rcvd ||
++ if (fcport->scan_needed ||
+ fcport->disc_state != DSC_LOGIN_COMPLETE) {
+ if (fcport->login_retry == 0) {
+ fcport->login_retry =
+@@ -4043,7 +4042,7 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ fcport->port_name, fcport->loop_id,
+ fcport->login_retry);
+ }
+- fcport->rscn_rcvd = 0;
++ fcport->scan_needed = 0;
+ qla24xx_fcport_handle_login(vha, fcport);
+ }
+ }
+@@ -4058,7 +4057,7 @@ out:
+
+ if (recheck) {
+ list_for_each_entry(fcport, &vha->vp_fcports, list) {
+- if (fcport->rscn_rcvd) {
++ if (fcport->scan_needed) {
+ set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
+ set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+ break;
+@@ -4261,12 +4260,13 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res)
+
+ sp->rc = res;
+ rc = qla2x00_post_nvme_gpnft_done_work(vha, sp, QLA_EVT_GPNFT);
+- if (!rc) {
++ if (rc) {
+ qla24xx_sp_unmap(vha, sp);
+ set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
+ set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+ return;
+ }
++ return;
+ }
+
+ if (cmd == GPN_FT_CMD) {
+@@ -4316,6 +4316,8 @@ static int qla24xx_async_gnnft(scsi_qla_host_t *vha, struct srb *sp,
+ vha->scan.scan_flags &= ~SF_SCANNING;
+ spin_unlock_irqrestore(&vha->work_lock, flags);
+ WARN_ON(1);
++ set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
++ set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+ goto done_free_sp;
+ }
+
+@@ -4349,8 +4351,12 @@ static int qla24xx_async_gnnft(scsi_qla_host_t *vha, struct srb *sp,
+ sp->done = qla2x00_async_gpnft_gnnft_sp_done;
+
+ rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
++ if (rval != QLA_SUCCESS) {
++ spin_lock_irqsave(&vha->work_lock, flags);
++ vha->scan.scan_flags &= ~SF_SCANNING;
++ spin_unlock_irqrestore(&vha->work_lock, flags);
+ goto done_free_sp;
++ }
+
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "Async-%s hdl=%x FC4Type %x.\n", sp->name,
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index f45759b353bea..2ebf4e4e02344 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -800,6 +800,7 @@ qla24xx_async_gnl_sp_done(void *s, int res)
+ if (res == QLA_FUNCTION_TIMEOUT)
+ return;
+
++ sp->fcport->flags &= ~(FCF_ASYNC_SENT|FCF_ASYNC_ACTIVE);
+ memset(&ea, 0, sizeof(ea));
+ ea.sp = sp;
+ ea.rc = res;
+@@ -827,25 +828,24 @@ qla24xx_async_gnl_sp_done(void *s, int res)
+ (loop_id & 0x7fff));
+ }
+
+- spin_lock_irqsave(&vha->gnl.fcports_lock, flags);
++ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+
+ INIT_LIST_HEAD(&h);
+ fcport = tf = NULL;
+ if (!list_empty(&vha->gnl.fcports))
+ list_splice_init(&vha->gnl.fcports, &h);
++ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+
+ list_for_each_entry_safe(fcport, tf, &h, gnl_entry) {
+ list_del_init(&fcport->gnl_entry);
+- spin_lock(&vha->hw->tgt.sess_lock);
++ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+ fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+- spin_unlock(&vha->hw->tgt.sess_lock);
++ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+ ea.fcport = fcport;
+
+ qla2x00_fcport_event_handler(vha, &ea);
+ }
+- spin_unlock_irqrestore(&vha->gnl.fcports_lock, flags);
+
+- spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+ /* create new fcport if fw has knowledge of new sessions */
+ for (i = 0; i < n; i++) {
+ port_id_t id;
+@@ -878,6 +878,8 @@ qla24xx_async_gnl_sp_done(void *s, int res)
+ }
+ }
+
++ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
++ vha->gnl.sent = 0;
+ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+
+ sp->free(sp);
+@@ -897,27 +899,24 @@ int qla24xx_async_gnl(struct scsi_qla_host *vha, fc_port_t *fcport)
+ ql_dbg(ql_dbg_disc, vha, 0x20d9,
+ "Async-gnlist WWPN %8phC \n", fcport->port_name);
+
+- spin_lock_irqsave(&vha->gnl.fcports_lock, flags);
+- if (!list_empty(&fcport->gnl_entry)) {
+- spin_unlock_irqrestore(&vha->gnl.fcports_lock, flags);
+- rval = QLA_SUCCESS;
+- goto done;
+- }
+-
+- spin_lock(&vha->hw->tgt.sess_lock);
++ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
++ fcport->flags |= FCF_ASYNC_SENT;
+ fcport->disc_state = DSC_GNL;
+ fcport->last_rscn_gen = fcport->rscn_gen;
+ fcport->last_login_gen = fcport->login_gen;
+- spin_unlock(&vha->hw->tgt.sess_lock);
+
+ list_add_tail(&fcport->gnl_entry, &vha->gnl.fcports);
+- spin_unlock_irqrestore(&vha->gnl.fcports_lock, flags);
++ if (vha->gnl.sent) {
++ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
++ return QLA_SUCCESS;
++ }
++ vha->gnl.sent = 1;
++ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+
+ sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
+ if (!sp)
+ goto done;
+
+- fcport->flags |= FCF_ASYNC_SENT;
+ sp->type = SRB_MB_IOCB;
+ sp->name = "gnlist";
+ sp->gen1 = fcport->rscn_gen;
+@@ -1204,11 +1203,9 @@ void __qla24xx_handle_gpdb_event(scsi_qla_host_t *vha, struct event_arg *ea)
+ vha->fcport_count++;
+ ea->fcport->login_succ = 1;
+
+- ql_dbg(ql_dbg_disc, vha, 0x20d6,
+- "%s %d %8phC post upd_fcport fcp_cnt %d\n",
+- __func__, __LINE__, ea->fcport->port_name,
+- vha->fcport_count);
+- qla24xx_post_upd_fcport_work(vha, ea->fcport);
++ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
++ qla24xx_sched_upd_fcport(ea->fcport);
++ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+ } else if (ea->fcport->login_succ) {
+ /*
+ * We have an existing session. A late RSCN delivery
+@@ -1326,6 +1323,7 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
+ {
+ u16 data[2];
+ u64 wwn;
++ u16 sec;
+
+ ql_dbg(ql_dbg_disc, vha, 0x20d8,
+ "%s %8phC DS %d LS %d P %d fl %x confl %p rscn %d|%d login %d retry %d lid %d scan %d\n",
+@@ -1457,6 +1455,22 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
+ qla24xx_post_prli_work(vha, fcport);
+ break;
+
++ case DSC_UPD_FCPORT:
++ sec = jiffies_to_msecs(jiffies -
++ fcport->jiffies_at_registration)/1000;
++ if (fcport->sec_since_registration < sec && sec &&
++ !(sec % 60)) {
++ fcport->sec_since_registration = sec;
++ ql_dbg(ql_dbg_disc, fcport->vha, 0xffff,
++ "%s %8phC - Slow Rport registration(%d Sec)\n",
++ __func__, fcport->port_name, sec);
++ }
++
++ if (fcport->next_disc_state != DSC_DELETE_PEND)
++ fcport->next_disc_state = DSC_ADISC;
++ set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
++ break;
++
+ default:
+ break;
+ }
+@@ -1572,8 +1586,10 @@ void qla2x00_fcport_event_handler(scsi_qla_host_t *vha, struct event_arg *ea)
+ case RSCN_PORT_ADDR:
+ fcport = qla2x00_find_fcport_by_nportid
+ (vha, &ea->id, 1);
+- if (fcport)
+- fcport->rscn_rcvd = 1;
++ if (fcport) {
++ fcport->scan_needed = 1;
++ fcport->rscn_gen++;
++ }
+
+ spin_lock_irqsave(&vha->work_lock, flags);
+ if (vha->scan.scan_flags == 0) {
+@@ -4741,6 +4757,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags)
+ return NULL;
+ }
+ INIT_WORK(&fcport->del_work, qla24xx_delete_sess_fn);
++ INIT_WORK(&fcport->reg_work, qla_register_fcport_fn);
+ INIT_LIST_HEAD(&fcport->gnl_entry);
+ INIT_LIST_HEAD(&fcport->list);
+
+@@ -5221,13 +5238,15 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport)
+ void
+ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport)
+ {
+- fcport->vha = vha;
+-
+ if (IS_SW_RESV_ADDR(fcport->d_id))
+ return;
+
++ ql_dbg(ql_dbg_disc, vha, 0x20ef, "%s %8phC\n",
++ __func__, fcport->port_name);
++
++ fcport->disc_state = DSC_UPD_FCPORT;
++ fcport->login_retry = vha->hw->login_retry_count;
+ fcport->flags &= ~(FCF_LOGIN_NEEDED | FCF_ASYNC_SENT);
+- fcport->disc_state = DSC_LOGIN_COMPLETE;
+ fcport->deleted = 0;
+ fcport->logout_on_delete = 1;
+ fcport->login_retry = vha->hw->login_retry_count;
+@@ -5289,6 +5308,36 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport)
+ }
+ }
+ qla2x00_set_fcport_state(fcport, FCS_ONLINE);
++
++ fcport->disc_state = DSC_LOGIN_COMPLETE;
++}
++
++void qla_register_fcport_fn(struct work_struct *work)
++{
++ fc_port_t *fcport = container_of(work, struct fc_port, reg_work);
++ u32 rscn_gen = fcport->rscn_gen;
++ u16 data[2];
++
++ if (IS_SW_RESV_ADDR(fcport->d_id))
++ return;
++
++ qla2x00_update_fcport(fcport->vha, fcport);
++
++ if (rscn_gen != fcport->rscn_gen) {
++ /* RSCN(s) came in while registration */
++ switch (fcport->next_disc_state) {
++ case DSC_DELETE_PEND:
++ qlt_schedule_sess_for_deletion(fcport);
++ break;
++ case DSC_ADISC:
++ data[0] = data[1] = 0;
++ qla2x00_post_async_adisc_work(fcport->vha, fcport,
++ data);
++ break;
++ default:
++ break;
++ }
++ }
+ }
+
+ /*
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index e17ca7df8d0e4..83ef790afb5df 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -2719,7 +2719,7 @@ static void qla2x00_iocb_work_fn(struct work_struct *work)
+ struct scsi_qla_host, iocb_work);
+ struct qla_hw_data *ha = vha->hw;
+ struct scsi_qla_host *base_vha = pci_get_drvdata(ha->pdev);
+- int i = 20;
++ int i = 2;
+ unsigned long flags;
+
+ if (test_bit(UNLOADING, &base_vha->dpc_flags))
+@@ -4606,7 +4606,6 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht,
+
+ spin_lock_init(&vha->work_lock);
+ spin_lock_init(&vha->cmd_list_lock);
+- spin_lock_init(&vha->gnl.fcports_lock);
+ init_waitqueue_head(&vha->fcport_waitQ);
+ init_waitqueue_head(&vha->vref_waitq);
+
+@@ -4792,16 +4791,25 @@ qlafx00_post_aenfx_work(struct scsi_qla_host *vha, uint32_t evtcode,
+ return qla2x00_post_work(vha, e);
+ }
+
+-int qla24xx_post_upd_fcport_work(struct scsi_qla_host *vha, fc_port_t *fcport)
++void qla24xx_sched_upd_fcport(fc_port_t *fcport)
+ {
+- struct qla_work_evt *e;
++ unsigned long flags;
+
+- e = qla2x00_alloc_work(vha, QLA_EVT_UPD_FCPORT);
+- if (!e)
+- return QLA_FUNCTION_FAILED;
++ if (IS_SW_RESV_ADDR(fcport->d_id))
++ return;
+
+- e->u.fcport.fcport = fcport;
+- return qla2x00_post_work(vha, e);
++ spin_lock_irqsave(&fcport->vha->work_lock, flags);
++ if (fcport->disc_state == DSC_UPD_FCPORT) {
++ spin_unlock_irqrestore(&fcport->vha->work_lock, flags);
++ return;
++ }
++ fcport->jiffies_at_registration = jiffies;
++ fcport->sec_since_registration = 0;
++ fcport->next_disc_state = DSC_DELETED;
++ fcport->disc_state = DSC_UPD_FCPORT;
++ spin_unlock_irqrestore(&fcport->vha->work_lock, flags);
++
++ queue_work(system_unbound_wq, &fcport->reg_work);
+ }
+
+ static
+@@ -5057,9 +5065,6 @@ qla2x00_do_work(struct scsi_qla_host *vha)
+ case QLA_EVT_GPSC:
+ qla24xx_async_gpsc(vha, e->u.fcport.fcport);
+ break;
+- case QLA_EVT_UPD_FCPORT:
+- qla2x00_update_fcport(vha, e->u.fcport.fcport);
+- break;
+ case QLA_EVT_GNL:
+ qla24xx_async_gnl(vha, e->u.fcport.fcport);
+ break;
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 95206e227730c..29b79e85fa7f2 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -600,14 +600,9 @@ void qla2x00_async_nack_sp_done(void *s, int res)
+ sp->fcport->login_succ = 1;
+
+ vha->fcport_count++;
+-
+- ql_dbg(ql_dbg_disc, vha, 0x20f3,
+- "%s %d %8phC post upd_fcport fcp_cnt %d\n",
+- __func__, __LINE__,
+- sp->fcport->port_name,
+- vha->fcport_count);
+- sp->fcport->disc_state = DSC_UPD_FCPORT;
+- qla24xx_post_upd_fcport_work(vha, sp->fcport);
++ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
++ qla24xx_sched_upd_fcport(sp->fcport);
++ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+ } else {
+ sp->fcport->login_retry = 0;
+ sp->fcport->disc_state = DSC_LOGIN_COMPLETE;
+@@ -1227,11 +1222,12 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
+ {
+ struct qla_tgt *tgt = sess->tgt;
+ unsigned long flags;
++ u16 sec;
+
+- if (sess->disc_state == DSC_DELETE_PEND)
++ switch (sess->disc_state) {
++ case DSC_DELETE_PEND:
+ return;
+-
+- if (sess->disc_state == DSC_DELETED) {
++ case DSC_DELETED:
+ if (tgt && tgt->tgt_stop && (tgt->sess_count == 0))
+ wake_up_all(&tgt->waitQ);
+ if (sess->vha->fcport_count == 0)
+@@ -1240,6 +1236,24 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
+ if (!sess->plogi_link[QLT_PLOGI_LINK_SAME_WWN] &&
+ !sess->plogi_link[QLT_PLOGI_LINK_CONFLICT])
+ return;
++ break;
++ case DSC_UPD_FCPORT:
++ /*
++ * This port is not done reporting to upper layer.
++ * let it finish
++ */
++ sess->next_disc_state = DSC_DELETE_PEND;
++ sec = jiffies_to_msecs(jiffies -
++ sess->jiffies_at_registration)/1000;
++ if (sess->sec_since_registration < sec && sec && !(sec % 5)) {
++ sess->sec_since_registration = sec;
++ ql_dbg(ql_dbg_disc, sess->vha, 0xffff,
++ "%s %8phC : Slow Rport registration(%d Sec)\n",
++ __func__, sess->port_name, sec);
++ }
++ return;
++ default:
++ break;
+ }
+
+ if (sess->deleted == QLA_SESS_DELETED)
+@@ -4749,6 +4763,32 @@ static int qlt_handle_login(struct scsi_qla_host *vha,
+ goto out;
+ }
+
++ if (sess->disc_state == DSC_UPD_FCPORT) {
++ u16 sec;
++
++ /*
++ * Remote port registration is still going on from
++ * previous login. Allow it to finish before we
++ * accept the new login.
++ */
++ sess->next_disc_state = DSC_DELETE_PEND;
++ sec = jiffies_to_msecs(jiffies -
++ sess->jiffies_at_registration) / 1000;
++ if (sess->sec_since_registration < sec && sec &&
++ !(sec % 5)) {
++ sess->sec_since_registration = sec;
++ ql_dbg(ql_dbg_disc, vha, 0xffff,
++ "%s %8phC - Slow Rport registration (%d Sec)\n",
++ __func__, sess->port_name, sec);
++ }
++
++ if (!conflict_sess)
++ kmem_cache_free(qla_tgt_plogi_cachep, pla);
++
++ qlt_send_term_imm_notif(vha, iocb, 1);
++ goto out;
++ }
++
+ qlt_plogi_ack_link(vha, pla, sess, QLT_PLOGI_LINK_SAME_WWN);
+ sess->d_id = port_id;
+ sess->login_gen++;
+@@ -4908,6 +4948,7 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
+
+ if (sess != NULL) {
+ bool delete = false;
++ int sec;
+ spin_lock_irqsave(&tgt->ha->tgt.sess_lock, flags);
+ switch (sess->fw_login_state) {
+ case DSC_LS_PLOGI_PEND:
+@@ -4920,9 +4961,24 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
+ }
+
+ switch (sess->disc_state) {
++ case DSC_UPD_FCPORT:
++ spin_unlock_irqrestore(&tgt->ha->tgt.sess_lock,
++ flags);
++
++ sec = jiffies_to_msecs(jiffies -
++ sess->jiffies_at_registration)/1000;
++ if (sess->sec_since_registration < sec && sec &&
++ !(sec % 5)) {
++ sess->sec_since_registration = sec;
++ ql_dbg(ql_dbg_disc, sess->vha, 0xffff,
++ "%s %8phC : Slow Rport registration(%d Sec)\n",
++ __func__, sess->port_name, sec);
++ }
++ qlt_send_term_imm_notif(vha, iocb, 1);
++ return 0;
++
+ case DSC_LOGIN_PEND:
+ case DSC_GPDB:
+- case DSC_UPD_FCPORT:
+ case DSC_LOGIN_COMPLETE:
+ case DSC_ADISC:
+ delete = false;
+@@ -5959,10 +6015,7 @@ static fc_port_t *qlt_get_port_database(struct scsi_qla_host *vha,
+ case MODE_DUAL:
+ if (newfcport) {
+ if (!IS_IIDMA_CAPABLE(vha->hw) || !vha->hw->flags.gpsc_supported) {
+- ql_dbg(ql_dbg_disc, vha, 0x20fe,
+- "%s %d %8phC post upd_fcport fcp_cnt %d\n",
+- __func__, __LINE__, fcport->port_name, vha->fcport_count);
+- qla24xx_post_upd_fcport_work(vha, fcport);
++ qla24xx_sched_upd_fcport(fcport);
+ } else {
+ ql_dbg(ql_dbg_disc, vha, 0x20ff,
+ "%s %d %8phC post gpsc fcp_cnt %d\n",
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index bed7403bb6b3a..b9a7117b6dce3 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -99,7 +99,7 @@ static struct spi_test spi_tests[] = {
+ {
+ .description = "tx/rx-transfer - crossing PAGE_SIZE",
+ .fill_option = FILL_COUNT_8,
+- .iterate_len = { ITERATE_MAX_LEN },
++ .iterate_len = { ITERATE_LEN },
+ .iterate_tx_align = ITERATE_ALIGN,
+ .iterate_rx_align = ITERATE_ALIGN,
+ .transfer_count = 1,
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 92e6b6774d98e..1fd529a2d2f6b 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1116,8 +1116,6 @@ out:
+ if (msg->status && ctlr->handle_err)
+ ctlr->handle_err(ctlr, msg);
+
+- spi_res_release(ctlr, msg);
+-
+ spi_finalize_current_message(ctlr);
+
+ return ret;
+@@ -1375,6 +1373,13 @@ void spi_finalize_current_message(struct spi_controller *ctlr)
+
+ spi_unmap_msg(ctlr, mesg);
+
++ /* In the prepare_messages callback the spi bus has the opportunity to
++ * split a transfer to smaller chunks.
++ * Release splited transfers here since spi_map_msg is done on the
++ * splited transfers.
++ */
++ spi_res_release(ctlr, mesg);
++
+ if (ctlr->cur_msg_prepared && ctlr->unprepare_message) {
+ ret = ctlr->unprepare_message(ctlr, mesg);
+ if (ret) {
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 02091782bc1e7..725e5842b8acc 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -5236,6 +5236,17 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ PCI_ANY_ID, PCI_ANY_ID,
+ 0, 0, pbn_wch384_4 },
+
++ /*
++ * Realtek RealManage
++ */
++ { PCI_VENDOR_ID_REALTEK, 0x816a,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0, pbn_b0_1_115200 },
++
++ { PCI_VENDOR_ID_REALTEK, 0x816b,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0, pbn_b0_1_115200 },
++
+ /* Fintek PCI serial cards */
+ { PCI_DEVICE(0x1c29, 0x1104), .driver_data = pbn_fintek_4 },
+ { PCI_DEVICE(0x1c29, 0x1108), .driver_data = pbn_fintek_8 },
+diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
+index 419804c9c974b..db36a796af8c3 100644
+--- a/drivers/usb/class/usblp.c
++++ b/drivers/usb/class/usblp.c
+@@ -827,6 +827,11 @@ static ssize_t usblp_read(struct file *file, char __user *buffer, size_t len, lo
+ if (rv < 0)
+ return rv;
+
++ if (!usblp->present) {
++ count = -ENODEV;
++ goto done;
++ }
++
+ if ((avail = usblp->rstatus) < 0) {
+ printk(KERN_ERR "usblp%d: error %d reading from printer\n",
+ usblp->minor, (int)avail);
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 2f068e525a374..4ee8105310989 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -397,6 +397,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Generic RTL8153 based ethernet adapters */
+ { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* SONiX USB DEVICE Touchpad */
++ { USB_DEVICE(0x0c45, 0x7056), .driver_info =
++ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
++
+ /* Action Semiconductor flash disk */
+ { USB_DEVICE(0x10d6, 0x2200), .driver_info =
+ USB_QUIRK_STRING_FETCH_255 },
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index 8608ac513fb76..caf9f6b1cd346 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -22,6 +22,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/usb.h>
+ #include <linux/usb/hcd.h>
++#include <linux/usb/otg.h>
+ #include <linux/moduleparam.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/debugfs.h>
+diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
+index ce0eaf7d7c12a..087402aec5cbe 100644
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -14,7 +14,6 @@
+ */
+
+ /*-------------------------------------------------------------------------*/
+-#include <linux/usb/otg.h>
+
+ #define PORT_WAKE_BITS (PORT_WKOC_E|PORT_WKDISC_E|PORT_WKCONN_E)
+
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index 27d8b4b6ff593..658b0cd8e27ee 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -669,8 +669,7 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
+ if (devinfo->resetting) {
+ cmnd->result = DID_ERROR << 16;
+ cmnd->scsi_done(cmnd);
+- spin_unlock_irqrestore(&devinfo->lock, flags);
+- return 0;
++ goto zombie;
+ }
+
+ /* Find a free uas-tag */
+@@ -706,6 +705,16 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
+ cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB);
+
+ err = uas_submit_urbs(cmnd, devinfo);
++ /*
++ * in case of fatal errors the SCSI layer is peculiar
++ * a command that has finished is a success for the purpose
++ * of queueing, no matter how fatal the error
++ */
++ if (err == -ENODEV) {
++ cmnd->result = DID_ERROR << 16;
++ cmnd->scsi_done(cmnd);
++ goto zombie;
++ }
+ if (err) {
+ /* If we did nothing, give up now */
+ if (cmdinfo->state & SUBMIT_STATUS_URB) {
+@@ -716,6 +725,7 @@ static int uas_queuecommand_lck(struct scsi_cmnd *cmnd,
+ }
+
+ devinfo->cmnd[idx] = cmnd;
++zombie:
+ spin_unlock_irqrestore(&devinfo->lock, flags);
+ return 0;
+ }
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 29226b6cb632d..0bf5ea518558c 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -1979,7 +1979,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
+ struct fb_var_screeninfo var = info->var;
+ int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
+
+- if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {
++ if (p->userfont && FNTSIZE(vc->vc_font.data)) {
+ int size;
+ int pitch = PITCH(vc->vc_font.width);
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index c81a1f3f0a101..c63f5e32630ee 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2490,6 +2490,9 @@ static int check_direct_IO(struct inode *inode, struct iov_iter *iter,
+ unsigned long align = offset | iov_iter_alignment(iter);
+ struct block_device *bdev = inode->i_sb->s_bdev;
+
++ if (iov_iter_rw(iter) == READ && offset >= i_size_read(inode))
++ return 1;
++
+ if (align & blocksize_mask) {
+ if (bdev)
+ blkbits = blksize_bits(bdev_logical_block_size(bdev));
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 2ff02541c53d5..1934dc6ad1ccd 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -2257,6 +2257,9 @@ static int __f2fs_build_free_nids(struct f2fs_sb_info *sbi,
+ if (unlikely(nid >= nm_i->max_nid))
+ nid = 0;
+
++ if (unlikely(nid % NAT_ENTRY_PER_BLOCK))
++ nid = NAT_BLOCK_OFFSET(nid) * NAT_ENTRY_PER_BLOCK;
++
+ /* Enough entries */
+ if (nm_i->nid_cnt[FREE_NID] >= NAT_ENTRY_PER_BLOCK)
+ return 0;
+diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
+index c63bee9adb6a8..20f08f4391c9d 100644
+--- a/fs/gfs2/glops.c
++++ b/fs/gfs2/glops.c
+@@ -89,6 +89,8 @@ static void gfs2_ail_empty_gl(struct gfs2_glock *gl)
+ memset(&tr, 0, sizeof(tr));
+ INIT_LIST_HEAD(&tr.tr_buf);
+ INIT_LIST_HEAD(&tr.tr_databuf);
++ INIT_LIST_HEAD(&tr.tr_ail1_list);
++ INIT_LIST_HEAD(&tr.tr_ail2_list);
+ tr.tr_revokes = atomic_read(&gl->gl_ail_count);
+
+ if (!tr.tr_revokes)
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index 06752db213d21..74c1fe9c4a042 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -806,8 +806,6 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)
+ tr = sdp->sd_log_tr;
+ if (tr) {
+ sdp->sd_log_tr = NULL;
+- INIT_LIST_HEAD(&tr->tr_ail1_list);
+- INIT_LIST_HEAD(&tr->tr_ail2_list);
+ tr->tr_first = sdp->sd_log_flush_head;
+ if (unlikely (state == SFS_FROZEN))
+ gfs2_assert_withdraw(sdp, !tr->tr_num_buf_new && !tr->tr_num_databuf_new);
+diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c
+index 812b5d5978b27..9313f7904e342 100644
+--- a/fs/gfs2/trans.c
++++ b/fs/gfs2/trans.c
+@@ -56,6 +56,8 @@ int gfs2_trans_begin(struct gfs2_sbd *sdp, unsigned int blocks,
+ sizeof(u64));
+ INIT_LIST_HEAD(&tr->tr_databuf);
+ INIT_LIST_HEAD(&tr->tr_buf);
++ INIT_LIST_HEAD(&tr->tr_ail1_list);
++ INIT_LIST_HEAD(&tr->tr_ail2_list);
+
+ sb_start_intwrite(sdp->sd_vfs);
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 1ef75b1deffa3..b2a2ff3f22a46 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3129,8 +3129,10 @@ static int _nfs4_do_setattr(struct inode *inode,
+
+ /* Servers should only apply open mode checks for file size changes */
+ truncate = (arg->iap->ia_valid & ATTR_SIZE) ? true : false;
+- if (!truncate)
++ if (!truncate) {
++ nfs4_inode_make_writeable(inode);
+ goto zero_stateid;
++ }
+
+ if (nfs4_copy_delegation_stateid(inode, FMODE_WRITE, &arg->stateid, &delegation_cred)) {
+ /* Use that stateid */
+@@ -7006,7 +7008,12 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
+ err = nfs4_set_lock_state(state, fl);
+ if (err != 0)
+ return err;
+- err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
++ do {
++ err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
++ if (err != -NFS4ERR_DELAY)
++ break;
++ ssleep(1);
++ } while (err == -NFS4ERR_DELAY);
+ return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
+ }
+
+diff --git a/include/linux/i2c-algo-pca.h b/include/linux/i2c-algo-pca.h
+index d03071732db4a..7c522fdd9ea73 100644
+--- a/include/linux/i2c-algo-pca.h
++++ b/include/linux/i2c-algo-pca.h
+@@ -53,6 +53,20 @@
+ #define I2C_PCA_CON_SI 0x08 /* Serial Interrupt */
+ #define I2C_PCA_CON_CR 0x07 /* Clock Rate (MASK) */
+
++/**
++ * struct pca_i2c_bus_settings - The configured PCA i2c bus settings
++ * @mode: Configured i2c bus mode
++ * @tlow: Configured SCL LOW period
++ * @thi: Configured SCL HIGH period
++ * @clock_freq: The configured clock frequency
++ */
++struct pca_i2c_bus_settings {
++ int mode;
++ int tlow;
++ int thi;
++ int clock_freq;
++};
++
+ struct i2c_algo_pca_data {
+ void *data; /* private low level data */
+ void (*write_byte) (void *data, int reg, int val);
+@@ -64,6 +78,7 @@ struct i2c_algo_pca_data {
+ * For PCA9665, use the frequency you want here. */
+ unsigned int i2c_clock;
+ unsigned int chip;
++ struct pca_i2c_bus_settings bus_settings;
+ };
+
+ int i2c_pca_add_bus(struct i2c_adapter *);
+diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
+index 66ce6659ecb69..c297abc4e6697 100644
+--- a/include/uapi/linux/kvm.h
++++ b/include/uapi/linux/kvm.h
+@@ -746,9 +746,10 @@ struct kvm_ppc_resize_hpt {
+ #define KVM_VM_PPC_HV 1
+ #define KVM_VM_PPC_PR 2
+
+-/* on MIPS, 0 forces trap & emulate, 1 forces VZ ASE */
+-#define KVM_VM_MIPS_TE 0
++/* on MIPS, 0 indicates auto, 1 forces VZ ASE, 2 forces trap & emulate */
++#define KVM_VM_MIPS_AUTO 0
+ #define KVM_VM_MIPS_VZ 1
++#define KVM_VM_MIPS_TE 2
+
+ #define KVM_S390_SIE_PAGE_OFFSET 1
+
+diff --git a/mm/percpu.c b/mm/percpu.c
+index ff76fa0b75288..0151f276ae680 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1103,7 +1103,7 @@ static struct pcpu_chunk * __init pcpu_alloc_first_chunk(unsigned long tmp_addr,
+
+ /* allocate chunk */
+ chunk = memblock_virt_alloc(sizeof(struct pcpu_chunk) +
+- BITS_TO_LONGS(region_size >> PAGE_SHIFT),
++ BITS_TO_LONGS(region_size >> PAGE_SHIFT) * sizeof(unsigned long),
+ 0);
+
+ INIT_LIST_HEAD(&chunk->list);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index af6e9028716d1..be4bc833c28a2 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -5521,9 +5521,13 @@ static int pskb_carve_inside_nonlinear(struct sk_buff *skb, const u32 off,
+ if (skb_has_frag_list(skb))
+ skb_clone_fraglist(skb);
+
+- if (k == 0) {
+- /* split line is in frag list */
+- pskb_carve_frag_list(skb, shinfo, off - pos, gfp_mask);
++ /* split line is in frag list */
++ if (k == 0 && pskb_carve_frag_list(skb, shinfo, off - pos, gfp_mask)) {
++ /* skb_frag_unref() is not needed here as shinfo->nr_frags = 0. */
++ if (skb_has_frag_list(skb))
++ kfree_skb_list(skb_shinfo(skb)->frag_list);
++ kfree(data);
++ return -ENOMEM;
+ }
+ skb_release_data(skb);
+
+diff --git a/net/dsa/tag_edsa.c b/net/dsa/tag_edsa.c
+index 4083326b806e8..d62d28d358d91 100644
+--- a/net/dsa/tag_edsa.c
++++ b/net/dsa/tag_edsa.c
+@@ -17,6 +17,16 @@
+ #define DSA_HLEN 4
+ #define EDSA_HLEN 8
+
++#define FRAME_TYPE_TO_CPU 0x00
++#define FRAME_TYPE_FORWARD 0x03
++
++#define TO_CPU_CODE_MGMT_TRAP 0x00
++#define TO_CPU_CODE_FRAME2REG 0x01
++#define TO_CPU_CODE_IGMP_MLD_TRAP 0x02
++#define TO_CPU_CODE_POLICY_TRAP 0x03
++#define TO_CPU_CODE_ARP_MIRROR 0x04
++#define TO_CPU_CODE_POLICY_MIRROR 0x05
++
+ static struct sk_buff *edsa_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct dsa_port *dp = dsa_slave_to_port(dev);
+@@ -81,6 +91,8 @@ static struct sk_buff *edsa_rcv(struct sk_buff *skb, struct net_device *dev,
+ struct packet_type *pt)
+ {
+ u8 *edsa_header;
++ int frame_type;
++ int code;
+ int source_device;
+ int source_port;
+
+@@ -95,8 +107,29 @@ static struct sk_buff *edsa_rcv(struct sk_buff *skb, struct net_device *dev,
+ /*
+ * Check that frame type is either TO_CPU or FORWARD.
+ */
+- if ((edsa_header[0] & 0xc0) != 0x00 && (edsa_header[0] & 0xc0) != 0xc0)
++ frame_type = edsa_header[0] >> 6;
++
++ switch (frame_type) {
++ case FRAME_TYPE_TO_CPU:
++ code = (edsa_header[1] & 0x6) | ((edsa_header[2] >> 4) & 1);
++
++ /*
++ * Mark the frame to never egress on any port of the same switch
++ * unless it's a trapped IGMP/MLD packet, in which case the
++ * bridge might want to forward it.
++ */
++ if (code != TO_CPU_CODE_IGMP_MLD_TRAP)
++ skb->offload_fwd_mark = 1;
++
++ break;
++
++ case FRAME_TYPE_FORWARD:
++ skb->offload_fwd_mark = 1;
++ break;
++
++ default:
+ return NULL;
++ }
+
+ /*
+ * Determine source device and port.
+@@ -160,8 +193,6 @@ static struct sk_buff *edsa_rcv(struct sk_buff *skb, struct net_device *dev,
+ 2 * ETH_ALEN);
+ }
+
+- skb->offload_fwd_mark = 1;
+-
+ return skb;
+ }
+
+diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
+index 08b5fa4a2852a..ba8f367312289 100644
+--- a/net/sunrpc/rpcb_clnt.c
++++ b/net/sunrpc/rpcb_clnt.c
+@@ -981,8 +981,8 @@ static int rpcb_dec_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr,
+ p = xdr_inline_decode(xdr, len);
+ if (unlikely(p == NULL))
+ goto out_fail;
+- dprintk("RPC: %5u RPCB_%s reply: %s\n", req->rq_task->tk_pid,
+- req->rq_task->tk_msg.rpc_proc->p_name, (char *)p);
++ dprintk("RPC: %5u RPCB_%s reply: %*pE\n", req->rq_task->tk_pid,
++ req->rq_task->tk_msg.rpc_proc->p_name, len, (char *)p);
+
+ if (rpc_uaddr2sockaddr(req->rq_xprt->xprt_net, (char *)p, len,
+ sap, sizeof(address)) == 0)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 8092fd5617fa7..9c5b3d19bfa73 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2452,7 +2452,6 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+- SND_PCI_QUIRK(0x1462, 0x9c37, "MSI X570-A PRO", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+ SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
+diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c
+index 4b559932adc33..121460db8eacf 100644
+--- a/sound/soc/qcom/apq8016_sbc.c
++++ b/sound/soc/qcom/apq8016_sbc.c
+@@ -233,6 +233,7 @@ static int apq8016_sbc_platform_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ card->dapm_widgets = apq8016_sbc_dapm_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(apq8016_sbc_dapm_widgets);
+ data = apq8016_sbc_parse_of(card);
+diff --git a/sound/soc/qcom/apq8096.c b/sound/soc/qcom/apq8096.c
+index 1543e85629f80..04f814a0a7d51 100644
+--- a/sound/soc/qcom/apq8096.c
++++ b/sound/soc/qcom/apq8096.c
+@@ -46,6 +46,7 @@ static int apq8096_platform_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ dev_set_drvdata(dev, card);
+ ret = qcom_snd_parse_of(card);
+ if (ret) {
+diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c
+index 2a781d87ee65e..5fdbfa363ab16 100644
+--- a/sound/soc/qcom/sdm845.c
++++ b/sound/soc/qcom/sdm845.c
+@@ -226,6 +226,7 @@ static int sdm845_snd_platform_probe(struct platform_device *pdev)
+ }
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ dev_set_drvdata(dev, card);
+ ret = qcom_snd_parse_of(card);
+ if (ret) {
+diff --git a/sound/soc/qcom/storm.c b/sound/soc/qcom/storm.c
+index a9fa972466ad1..00a3f4c1b6fed 100644
+--- a/sound/soc/qcom/storm.c
++++ b/sound/soc/qcom/storm.c
+@@ -99,6 +99,7 @@ static int storm_platform_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ card->dev = &pdev->dev;
++ card->owner = THIS_MODULE;
+
+ ret = snd_soc_of_parse_card_name(card, "qcom,model");
+ if (ret) {
+diff --git a/tools/perf/tests/bp_signal.c b/tools/perf/tests/bp_signal.c
+index 6cf00650602ef..697423ce3bdfc 100644
+--- a/tools/perf/tests/bp_signal.c
++++ b/tools/perf/tests/bp_signal.c
+@@ -44,10 +44,13 @@ volatile long the_var;
+ #if defined (__x86_64__)
+ extern void __test_function(volatile long *ptr);
+ asm (
++ ".pushsection .text;"
+ ".globl __test_function\n"
++ ".type __test_function, @function;"
+ "__test_function:\n"
+ "incq (%rdi)\n"
+- "ret\n");
++ "ret\n"
++ ".popsection\n");
+ #else
+ static void __test_function(volatile long *ptr)
+ {
+diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c
+index 7bedf8608fdde..3e183eef6f857 100644
+--- a/tools/perf/tests/pmu.c
++++ b/tools/perf/tests/pmu.c
+@@ -172,6 +172,7 @@ int test__pmu(struct test *test __maybe_unused, int subtest __maybe_unused)
+ ret = 0;
+ } while (0);
+
++ perf_pmu__del_formats(&formats);
+ test_format_dir_put(format);
+ return ret;
+ }
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index c1acf04c9f7ab..c42054f42e7e6 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -1282,6 +1282,17 @@ void perf_pmu__set_format(unsigned long *bits, long from, long to)
+ set_bit(b, bits);
+ }
+
++void perf_pmu__del_formats(struct list_head *formats)
++{
++ struct perf_pmu_format *fmt, *tmp;
++
++ list_for_each_entry_safe(fmt, tmp, formats, list) {
++ list_del(&fmt->list);
++ free(fmt->name);
++ free(fmt);
++ }
++}
++
+ static int sub_non_neg(int a, int b)
+ {
+ if (b > a)
+diff --git a/tools/perf/util/pmu.h b/tools/perf/util/pmu.h
+index 76fecec7b3f91..21335425f2e42 100644
+--- a/tools/perf/util/pmu.h
++++ b/tools/perf/util/pmu.h
+@@ -79,6 +79,7 @@ int perf_pmu__new_format(struct list_head *list, char *name,
+ int config, unsigned long *bits);
+ void perf_pmu__set_format(unsigned long *bits, long from, long to);
+ int perf_pmu__format_parse(char *dir, struct list_head *head);
++void perf_pmu__del_formats(struct list_head *formats);
+
+ struct perf_pmu *perf_pmu__scan(struct perf_pmu *pmu);
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-09-24 15:58 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-09-24 15:58 UTC (permalink / raw
To: gentoo-commits
commit: b393fe8ec24508bd7ae2f91cf3603dc7db2a74b1
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 24 15:58:28 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Sep 24 15:58:28 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b393fe8e
Add CONFIG_USER_NS to GENTOO_LINUX_INIT_SYSTEMD
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
4567_distro-Gentoo-Kconfig.patch | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index 10c164e..e754a3e 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -1,14 +1,14 @@
---- a/Kconfig 2018-09-28 08:08:05.058882080 -0400
-+++ b/Kconfig 2018-09-28 08:09:17.869573745 -0400
-@@ -30,3 +30,5 @@ source "crypto/Kconfig"
- source "lib/Kconfig"
-
+--- a/Kconfig 2020-04-15 11:05:30.202413863 -0400
++++ b/Kconfig 2020-04-15 10:37:45.683952949 -0400
+@@ -32,3 +32,5 @@ source "lib/Kconfig"
source "lib/Kconfig.debug"
+
+ source "Documentation/Kconfig"
+
+source "distro/Kconfig"
---- /dev/null 2020-05-13 03:13:57.920193259 -0400
-+++ b/distro/Kconfig 2020-05-13 08:21:40.704254967 -0400
-@@ -0,0 +1,157 @@
+--- /dev/null 2020-09-24 03:06:47.590000000 -0400
++++ b/distro/Kconfig 2020-09-24 11:31:29.403150624 -0400
+@@ -0,0 +1,158 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -145,6 +145,7 @@
+ select TIMERFD
+ select TMPFS_POSIX_ACL
+ select TMPFS_XATTR
++ select USER_NS
+
+ select ANON_INODES
+ select BLOCK
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-09-26 22:00 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-09-26 22:00 UTC (permalink / raw
To: gentoo-commits
commit: de1ca00a7d2ca5589f537b73addb0c569d7821e5
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 26 22:00:27 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Sep 26 22:00:27 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=de1ca00a
Linux patch 4.19.148
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1147_linux-4.19.148.patch | 1529 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1533 insertions(+)
diff --git a/0000_README b/0000_README
index 4996714..9707ae7 100644
--- a/0000_README
+++ b/0000_README
@@ -627,6 +627,10 @@ Patch: 1146_linux-4.19.147.patch
From: https://www.kernel.org
Desc: Linux 4.19.147
+Patch: 1147_linux-4.19.148.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.148
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1147_linux-4.19.148.patch b/1147_linux-4.19.148.patch
new file mode 100644
index 0000000..30160d9
--- /dev/null
+++ b/1147_linux-4.19.148.patch
@@ -0,0 +1,1529 @@
+diff --git a/Documentation/kbuild/llvm.rst b/Documentation/kbuild/llvm.rst
+new file mode 100644
+index 0000000000000..c776b6eee969f
+--- /dev/null
++++ b/Documentation/kbuild/llvm.rst
+@@ -0,0 +1,87 @@
++==============================
++Building Linux with Clang/LLVM
++==============================
++
++This document covers how to build the Linux kernel with Clang and LLVM
++utilities.
++
++About
++-----
++
++The Linux kernel has always traditionally been compiled with GNU toolchains
++such as GCC and binutils. Ongoing work has allowed for `Clang
++<https://clang.llvm.org/>`_ and `LLVM <https://llvm.org/>`_ utilities to be
++used as viable substitutes. Distributions such as `Android
++<https://www.android.com/>`_, `ChromeOS
++<https://www.chromium.org/chromium-os>`_, and `OpenMandriva
++<https://www.openmandriva.org/>`_ use Clang built kernels. `LLVM is a
++collection of toolchain components implemented in terms of C++ objects
++<https://www.aosabook.org/en/llvm.html>`_. Clang is a front-end to LLVM that
++supports C and the GNU C extensions required by the kernel, and is pronounced
++"klang," not "see-lang."
++
++Clang
++-----
++
++The compiler used can be swapped out via `CC=` command line argument to `make`.
++`CC=` should be set when selecting a config and during a build.
++
++ make CC=clang defconfig
++
++ make CC=clang
++
++Cross Compiling
++---------------
++
++A single Clang compiler binary will typically contain all supported backends,
++which can help simplify cross compiling.
++
++ ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- make CC=clang
++
++`CROSS_COMPILE` is not used to prefix the Clang compiler binary, instead
++`CROSS_COMPILE` is used to set a command line flag: `--target <triple>`. For
++example:
++
++ clang --target aarch64-linux-gnu foo.c
++
++LLVM Utilities
++--------------
++
++LLVM has substitutes for GNU binutils utilities. Kbuild supports `LLVM=1`
++to enable them.
++
++ make LLVM=1
++
++They can be enabled individually. The full list of the parameters:
++
++ make CC=clang LD=ld.lld AR=llvm-ar NM=llvm-nm STRIP=llvm-strip \\
++ OBJCOPY=llvm-objcopy OBJDUMP=llvm-objdump OBJSIZE=llvm-size \\
++ READELF=llvm-readelf HOSTCC=clang HOSTCXX=clang++ HOSTAR=llvm-ar \\
++ HOSTLD=ld.lld
++
++Currently, the integrated assembler is disabled by default. You can pass
++`LLVM_IAS=1` to enable it.
++
++Getting Help
++------------
++
++- `Website <https://clangbuiltlinux.github.io/>`_
++- `Mailing List <https://groups.google.com/forum/#!forum/clang-built-linux>`_: <clang-built-linux@googlegroups.com>
++- `Issue Tracker <https://github.com/ClangBuiltLinux/linux/issues>`_
++- IRC: #clangbuiltlinux on chat.freenode.net
++- `Telegram <https://t.me/ClangBuiltLinux>`_: @ClangBuiltLinux
++- `Wiki <https://github.com/ClangBuiltLinux/linux/wiki>`_
++- `Beginner Bugs <https://github.com/ClangBuiltLinux/linux/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22>`_
++
++Getting LLVM
++-------------
++
++- http://releases.llvm.org/download.html
++- https://github.com/llvm/llvm-project
++- https://llvm.org/docs/GettingStarted.html
++- https://llvm.org/docs/CMake.html
++- https://apt.llvm.org/
++- https://www.archlinux.org/packages/extra/x86_64/llvm/
++- https://github.com/ClangBuiltLinux/tc-build
++- https://github.com/ClangBuiltLinux/linux/wiki/Building-Clang-from-source
++- https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86/
+diff --git a/MAINTAINERS b/MAINTAINERS
+index b9f9da0b886f5..1061db6fbc326 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -3613,6 +3613,15 @@ M: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
+ S: Maintained
+ F: .clang-format
+
++CLANG/LLVM BUILD SUPPORT
++L: clang-built-linux@googlegroups.com
++W: https://clangbuiltlinux.github.io/
++B: https://github.com/ClangBuiltLinux/linux/issues
++C: irc://chat.freenode.net/clangbuiltlinux
++S: Supported
++K: \b(?i:clang|llvm)\b
++F: Documentation/kbuild/llvm.rst
++
+ CLEANCACHE API
+ M: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+ L: linux-kernel@vger.kernel.org
+diff --git a/Makefile b/Makefile
+index ee648a902ce31..3ffd5b03e6ddf 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 147
++SUBLEVEL = 148
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -358,8 +358,13 @@ HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS 2>/dev/null)
+ HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS 2>/dev/null)
+ HOST_LFS_LIBS := $(shell getconf LFS_LIBS 2>/dev/null)
+
+-HOSTCC = gcc
+-HOSTCXX = g++
++ifneq ($(LLVM),)
++HOSTCC = clang
++HOSTCXX = clang++
++else
++HOSTCC = gcc
++HOSTCXX = g++
++endif
+ KBUILD_HOSTCFLAGS := -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 \
+ -fomit-frame-pointer -std=gnu89 $(HOST_LFS_CFLAGS) \
+ $(HOSTCFLAGS)
+@@ -368,15 +373,28 @@ KBUILD_HOSTLDFLAGS := $(HOST_LFS_LDFLAGS) $(HOSTLDFLAGS)
+ KBUILD_HOSTLDLIBS := $(HOST_LFS_LIBS) $(HOSTLDLIBS)
+
+ # Make variables (CC, etc...)
+-AS = $(CROSS_COMPILE)as
+-LD = $(CROSS_COMPILE)ld
+-CC = $(CROSS_COMPILE)gcc
+ CPP = $(CC) -E
++ifneq ($(LLVM),)
++CC = clang
++LD = ld.lld
++AR = llvm-ar
++NM = llvm-nm
++OBJCOPY = llvm-objcopy
++OBJDUMP = llvm-objdump
++READELF = llvm-readelf
++OBJSIZE = llvm-size
++STRIP = llvm-strip
++else
++CC = $(CROSS_COMPILE)gcc
++LD = $(CROSS_COMPILE)ld
+ AR = $(CROSS_COMPILE)ar
+ NM = $(CROSS_COMPILE)nm
+-STRIP = $(CROSS_COMPILE)strip
+ OBJCOPY = $(CROSS_COMPILE)objcopy
+ OBJDUMP = $(CROSS_COMPILE)objdump
++READELF = $(CROSS_COMPILE)readelf
++OBJSIZE = $(CROSS_COMPILE)size
++STRIP = $(CROSS_COMPILE)strip
++endif
+ LEX = flex
+ YACC = bison
+ AWK = awk
+@@ -432,8 +450,8 @@ KBUILD_LDFLAGS :=
+ GCC_PLUGINS_CFLAGS :=
+ CLANG_FLAGS :=
+
+-export ARCH SRCARCH CONFIG_SHELL HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE AS LD CC
+-export CPP AR NM STRIP OBJCOPY OBJDUMP KBUILD_HOSTLDFLAGS KBUILD_HOSTLDLIBS
++export ARCH SRCARCH CONFIG_SHELL HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE LD CC
++export CPP AR NM STRIP OBJCOPY OBJDUMP OBJSIZE READELF KBUILD_HOSTLDFLAGS KBUILD_HOSTLDLIBS
+ export MAKE LEX YACC AWK GENKSYMS INSTALLKERNEL PERL PYTHON PYTHON2 PYTHON3 UTS_MACHINE
+ export HOSTCXX KBUILD_HOSTCXXFLAGS LDFLAGS_MODULE CHECK CHECKFLAGS
+
+@@ -491,7 +509,9 @@ endif
+ ifneq ($(GCC_TOOLCHAIN),)
+ CLANG_FLAGS += --gcc-toolchain=$(GCC_TOOLCHAIN)
+ endif
++ifneq ($(LLVM_IAS),1)
+ CLANG_FLAGS += -no-integrated-as
++endif
+ CLANG_FLAGS += -Werror=unknown-warning-option
+ KBUILD_CFLAGS += $(CLANG_FLAGS)
+ KBUILD_AFLAGS += $(CLANG_FLAGS)
+diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
+index b337a0cd58ba4..5642f025b397c 100644
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -102,7 +102,7 @@ vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o
+ quiet_cmd_check_data_rel = DATAREL $@
+ define cmd_check_data_rel
+ for obj in $(filter %.o,$^); do \
+- ${CROSS_COMPILE}readelf -S $$obj | grep -qF .rel.local && { \
++ $(READELF) -S $$obj | grep -qF .rel.local && { \
+ echo "error: $$obj has data relocations!" >&2; \
+ exit 1; \
+ } || true; \
+diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c
+index 7e27c9aff9b72..430988f797225 100644
+--- a/drivers/net/dsa/rtl8366.c
++++ b/drivers/net/dsa/rtl8366.c
+@@ -452,13 +452,19 @@ int rtl8366_vlan_del(struct dsa_switch *ds, int port,
+ return ret;
+
+ if (vid == vlanmc.vid) {
+- /* clear VLAN member configurations */
+- vlanmc.vid = 0;
+- vlanmc.priority = 0;
+- vlanmc.member = 0;
+- vlanmc.untag = 0;
+- vlanmc.fid = 0;
+-
++ /* Remove this port from the VLAN */
++ vlanmc.member &= ~BIT(port);
++ vlanmc.untag &= ~BIT(port);
++ /*
++ * If no ports are members of this VLAN
++ * anymore then clear the whole member
++ * config so it can be reused.
++ */
++ if (!vlanmc.member && vlanmc.untag) {
++ vlanmc.vid = 0;
++ vlanmc.priority = 0;
++ vlanmc.fid = 0;
++ }
+ ret = smi->ops->set_vlan_mc(smi, i, &vlanmc);
+ if (ret) {
+ dev_err(smi->dev,
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index a267380b267d7..c3f04fb319556 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -6837,18 +6837,16 @@ static ssize_t bnxt_show_temp(struct device *dev,
+ struct hwrm_temp_monitor_query_output *resp;
+ struct bnxt *bp = dev_get_drvdata(dev);
+ u32 len = 0;
++ int rc;
+
+ resp = bp->hwrm_cmd_resp_addr;
+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1);
+ mutex_lock(&bp->hwrm_cmd_lock);
+- if (!_hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT))
++ rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ if (!rc)
+ len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */
+ mutex_unlock(&bp->hwrm_cmd_lock);
+-
+- if (len)
+- return len;
+-
+- return sprintf(buf, "unknown\n");
++ return rc ?: len;
+ }
+ static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0);
+
+@@ -6868,7 +6866,16 @@ static void bnxt_hwmon_close(struct bnxt *bp)
+
+ static void bnxt_hwmon_open(struct bnxt *bp)
+ {
++ struct hwrm_temp_monitor_query_input req = {0};
+ struct pci_dev *pdev = bp->pdev;
++ int rc;
++
++ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1);
++ rc = hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ if (rc == -EACCES || rc == -EOPNOTSUPP) {
++ bnxt_hwmon_close(bp);
++ return;
++ }
+
+ bp->hwmon_dev = hwmon_device_register_with_groups(&pdev->dev,
+ DRV_MODULE_NAME, bp,
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index a1cb99110092d..1ea81c23039f5 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1369,9 +1369,12 @@ static int bnxt_set_pauseparam(struct net_device *dev,
+ if (!BNXT_SINGLE_PF(bp))
+ return -EOPNOTSUPP;
+
++ mutex_lock(&bp->link_lock);
+ if (epause->autoneg) {
+- if (!(link_info->autoneg & BNXT_AUTONEG_SPEED))
+- return -EINVAL;
++ if (!(link_info->autoneg & BNXT_AUTONEG_SPEED)) {
++ rc = -EINVAL;
++ goto pause_exit;
++ }
+
+ link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL;
+ if (bp->hwrm_spec_code >= 0x10201)
+@@ -1392,11 +1395,11 @@ static int bnxt_set_pauseparam(struct net_device *dev,
+ if (epause->tx_pause)
+ link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX;
+
+- if (netif_running(dev)) {
+- mutex_lock(&bp->link_lock);
++ if (netif_running(dev))
+ rc = bnxt_hwrm_set_pause(bp);
+- mutex_unlock(&bp->link_lock);
+- }
++
++pause_exit:
++ mutex_unlock(&bp->link_lock);
+ return rc;
+ }
+
+@@ -2113,8 +2116,7 @@ static int bnxt_set_eee(struct net_device *dev, struct ethtool_eee *edata)
+ struct bnxt *bp = netdev_priv(dev);
+ struct ethtool_eee *eee = &bp->eee;
+ struct bnxt_link_info *link_info = &bp->link_info;
+- u32 advertising =
+- _bnxt_fw_to_ethtool_adv_spds(link_info->advertising, 0);
++ u32 advertising;
+ int rc = 0;
+
+ if (!BNXT_SINGLE_PF(bp))
+@@ -2123,19 +2125,23 @@ static int bnxt_set_eee(struct net_device *dev, struct ethtool_eee *edata)
+ if (!(bp->flags & BNXT_FLAG_EEE_CAP))
+ return -EOPNOTSUPP;
+
++ mutex_lock(&bp->link_lock);
++ advertising = _bnxt_fw_to_ethtool_adv_spds(link_info->advertising, 0);
+ if (!edata->eee_enabled)
+ goto eee_ok;
+
+ if (!(link_info->autoneg & BNXT_AUTONEG_SPEED)) {
+ netdev_warn(dev, "EEE requires autoneg\n");
+- return -EINVAL;
++ rc = -EINVAL;
++ goto eee_exit;
+ }
+ if (edata->tx_lpi_enabled) {
+ if (bp->lpi_tmr_hi && (edata->tx_lpi_timer > bp->lpi_tmr_hi ||
+ edata->tx_lpi_timer < bp->lpi_tmr_lo)) {
+ netdev_warn(dev, "Valid LPI timer range is %d and %d microsecs\n",
+ bp->lpi_tmr_lo, bp->lpi_tmr_hi);
+- return -EINVAL;
++ rc = -EINVAL;
++ goto eee_exit;
+ } else if (!bp->lpi_tmr_hi) {
+ edata->tx_lpi_timer = eee->tx_lpi_timer;
+ }
+@@ -2145,7 +2151,8 @@ static int bnxt_set_eee(struct net_device *dev, struct ethtool_eee *edata)
+ } else if (edata->advertised & ~advertising) {
+ netdev_warn(dev, "EEE advertised %x must be a subset of autoneg advertised speeds %x\n",
+ edata->advertised, advertising);
+- return -EINVAL;
++ rc = -EINVAL;
++ goto eee_exit;
+ }
+
+ eee->advertised = edata->advertised;
+@@ -2157,6 +2164,8 @@ eee_ok:
+ if (netif_running(dev))
+ rc = bnxt_hwrm_set_link_setting(bp, false, true);
+
++eee_exit:
++ mutex_unlock(&bp->link_lock);
+ return rc;
+ }
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+index 97d97de9accc5..bb3ee55cb72cb 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+@@ -1591,13 +1591,16 @@ out:
+ static int configure_filter_tcb(struct adapter *adap, unsigned int tid,
+ struct filter_entry *f)
+ {
+- if (f->fs.hitcnts)
++ if (f->fs.hitcnts) {
+ set_tcb_field(adap, f, tid, TCB_TIMESTAMP_W,
+- TCB_TIMESTAMP_V(TCB_TIMESTAMP_M) |
++ TCB_TIMESTAMP_V(TCB_TIMESTAMP_M),
++ TCB_TIMESTAMP_V(0ULL),
++ 1);
++ set_tcb_field(adap, f, tid, TCB_RTT_TS_RECENT_AGE_W,
+ TCB_RTT_TS_RECENT_AGE_V(TCB_RTT_TS_RECENT_AGE_M),
+- TCB_TIMESTAMP_V(0ULL) |
+ TCB_RTT_TS_RECENT_AGE_V(0ULL),
+ 1);
++ }
+
+ if (f->fs.newdmac)
+ set_tcb_tflag(adap, f, tid, TF_CCTRL_ECE_S, 1,
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index 6a79c8e4a7a40..9043d2cadd5de 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -744,8 +744,8 @@ nfp_port_get_fecparam(struct net_device *netdev,
+ struct nfp_eth_table_port *eth_port;
+ struct nfp_port *port;
+
+- param->active_fec = ETHTOOL_FEC_NONE_BIT;
+- param->fec = ETHTOOL_FEC_NONE_BIT;
++ param->active_fec = ETHTOOL_FEC_NONE;
++ param->fec = ETHTOOL_FEC_NONE;
+
+ port = nfp_port_from_netdev(netdev);
+ eth_port = nfp_port_get_eth_port(port);
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 817c290b78cd9..d0b5844c8a315 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -721,7 +721,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb,
+ struct net_device *dev,
+ struct geneve_sock *gs4,
+ struct flowi4 *fl4,
+- const struct ip_tunnel_info *info)
++ const struct ip_tunnel_info *info,
++ __be16 dport, __be16 sport)
+ {
+ bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
+ struct geneve_dev *geneve = netdev_priv(dev);
+@@ -737,6 +738,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb,
+ fl4->flowi4_proto = IPPROTO_UDP;
+ fl4->daddr = info->key.u.ipv4.dst;
+ fl4->saddr = info->key.u.ipv4.src;
++ fl4->fl4_dport = dport;
++ fl4->fl4_sport = sport;
+
+ tos = info->key.tos;
+ if ((tos == 1) && !geneve->collect_md) {
+@@ -771,7 +774,8 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb,
+ struct net_device *dev,
+ struct geneve_sock *gs6,
+ struct flowi6 *fl6,
+- const struct ip_tunnel_info *info)
++ const struct ip_tunnel_info *info,
++ __be16 dport, __be16 sport)
+ {
+ bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
+ struct geneve_dev *geneve = netdev_priv(dev);
+@@ -787,6 +791,9 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb,
+ fl6->flowi6_proto = IPPROTO_UDP;
+ fl6->daddr = info->key.u.ipv6.dst;
+ fl6->saddr = info->key.u.ipv6.src;
++ fl6->fl6_dport = dport;
++ fl6->fl6_sport = sport;
++
+ prio = info->key.tos;
+ if ((prio == 1) && !geneve->collect_md) {
+ prio = ip_tunnel_get_dsfield(ip_hdr(skb), skb);
+@@ -833,14 +840,15 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ __be16 df;
+ int err;
+
+- rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info);
++ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
++ rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info,
++ geneve->info.key.tp_dst, sport);
+ if (IS_ERR(rt))
+ return PTR_ERR(rt);
+
+ skb_tunnel_check_pmtu(skb, &rt->dst,
+ GENEVE_IPV4_HLEN + info->options_len);
+
+- sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+ if (geneve->collect_md) {
+ tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
+ ttl = key->ttl;
+@@ -875,13 +883,14 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ __be16 sport;
+ int err;
+
+- dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info);
++ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
++ dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info,
++ geneve->info.key.tp_dst, sport);
+ if (IS_ERR(dst))
+ return PTR_ERR(dst);
+
+ skb_tunnel_check_pmtu(skb, dst, GENEVE_IPV6_HLEN + info->options_len);
+
+- sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+ if (geneve->collect_md) {
+ prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
+ ttl = key->ttl;
+@@ -958,13 +967,18 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
+ {
+ struct ip_tunnel_info *info = skb_tunnel_info(skb);
+ struct geneve_dev *geneve = netdev_priv(dev);
++ __be16 sport;
+
+ if (ip_tunnel_info_af(info) == AF_INET) {
+ struct rtable *rt;
+ struct flowi4 fl4;
++
+ struct geneve_sock *gs4 = rcu_dereference(geneve->sock4);
++ sport = udp_flow_src_port(geneve->net, skb,
++ 1, USHRT_MAX, true);
+
+- rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info);
++ rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info,
++ geneve->info.key.tp_dst, sport);
+ if (IS_ERR(rt))
+ return PTR_ERR(rt);
+
+@@ -974,9 +988,13 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
+ } else if (ip_tunnel_info_af(info) == AF_INET6) {
+ struct dst_entry *dst;
+ struct flowi6 fl6;
++
+ struct geneve_sock *gs6 = rcu_dereference(geneve->sock6);
++ sport = udp_flow_src_port(geneve->net, skb,
++ 1, USHRT_MAX, true);
+
+- dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info);
++ dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info,
++ geneve->info.key.tp_dst, sport);
+ if (IS_ERR(dst))
+ return PTR_ERR(dst);
+
+@@ -987,8 +1005,7 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
+ return -EINVAL;
+ }
+
+- info->key.tp_src = udp_flow_src_port(geneve->net, skb,
+- 1, USHRT_MAX, true);
++ info->key.tp_src = sport;
+ info->key.tp_dst = geneve->info.key.tp_dst;
+ return 0;
+ }
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 54ac599cffb4d..b884b681d5c52 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1154,7 +1154,8 @@ void phy_detach(struct phy_device *phydev)
+
+ phy_led_triggers_unregister(phydev);
+
+- module_put(phydev->mdio.dev.driver->owner);
++ if (phydev->mdio.dev.driver)
++ module_put(phydev->mdio.dev.driver->owner);
+
+ /* If the device had no specific driver before (i.e. - it
+ * was using the generic driver), we unbind the device
+diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig
+index 4e9fe75d70675..21190dfbabb16 100644
+--- a/drivers/net/wan/Kconfig
++++ b/drivers/net/wan/Kconfig
+@@ -199,7 +199,7 @@ config WANXL_BUILD_FIRMWARE
+ depends on WANXL && !PREVENT_FIRMWARE_BUILD
+ help
+ Allows you to rebuild firmware run by the QUICC processor.
+- It requires as68k, ld68k and hexdump programs.
++ It requires m68k toolchains and hexdump programs.
+
+ You should never need this option, say N.
+
+diff --git a/drivers/net/wan/Makefile b/drivers/net/wan/Makefile
+index 9532e69fda878..0500282e176e0 100644
+--- a/drivers/net/wan/Makefile
++++ b/drivers/net/wan/Makefile
+@@ -41,17 +41,17 @@ $(obj)/wanxl.o: $(obj)/wanxlfw.inc
+
+ ifeq ($(CONFIG_WANXL_BUILD_FIRMWARE),y)
+ ifeq ($(ARCH),m68k)
+- AS68K = $(AS)
+- LD68K = $(LD)
++ M68KCC = $(CC)
++ M68KLD = $(LD)
+ else
+- AS68K = as68k
+- LD68K = ld68k
++ M68KCC = $(CROSS_COMPILE_M68K)gcc
++ M68KLD = $(CROSS_COMPILE_M68K)ld
+ endif
+
+ quiet_cmd_build_wanxlfw = BLD FW $@
+ cmd_build_wanxlfw = \
+- $(CPP) -D__ASSEMBLY__ -Wp,-MD,$(depfile) -I$(srctree)/include/uapi $< | $(AS68K) -m68360 -o $(obj)/wanxlfw.o; \
+- $(LD68K) --oformat binary -Ttext 0x1000 $(obj)/wanxlfw.o -o $(obj)/wanxlfw.bin; \
++ $(M68KCC) -D__ASSEMBLY__ -Wp,-MD,$(depfile) -I$(srctree)/include/uapi -c -o $(obj)/wanxlfw.o $<; \
++ $(M68KLD) --oformat binary -Ttext 0x1000 $(obj)/wanxlfw.o -o $(obj)/wanxlfw.bin; \
+ hexdump -ve '"\n" 16/1 "0x%02X,"' $(obj)/wanxlfw.bin | sed 's/0x ,//g;1s/^/static const u8 firmware[]={/;$$s/,$$/\n};\n/' >$(obj)/wanxlfw.inc; \
+ rm -f $(obj)/wanxlfw.bin $(obj)/wanxlfw.o
+
+diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
+index ab8b3cbbb205c..85844f26547dd 100644
+--- a/drivers/net/wan/hdlc_ppp.c
++++ b/drivers/net/wan/hdlc_ppp.c
+@@ -386,11 +386,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ }
+
+ for (opt = data; len; len -= opt[1], opt += opt[1]) {
+- if (len < 2 || len < opt[1]) {
+- dev->stats.rx_errors++;
+- kfree(out);
+- return; /* bad packet, drop silently */
+- }
++ if (len < 2 || opt[1] < 2 || len < opt[1])
++ goto err_out;
+
+ if (pid == PID_LCP)
+ switch (opt[0]) {
+@@ -398,6 +395,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ continue; /* MRU always OK and > 1500 bytes? */
+
+ case LCP_OPTION_ACCM: /* async control character map */
++ if (opt[1] < sizeof(valid_accm))
++ goto err_out;
+ if (!memcmp(opt, valid_accm,
+ sizeof(valid_accm)))
+ continue;
+@@ -409,6 +408,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ }
+ break;
+ case LCP_OPTION_MAGIC:
++ if (len < 6)
++ goto err_out;
+ if (opt[1] != 6 || (!opt[2] && !opt[3] &&
+ !opt[4] && !opt[5]))
+ break; /* reject invalid magic number */
+@@ -427,6 +428,11 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ ppp_cp_event(dev, pid, RCR_GOOD, CP_CONF_ACK, id, req_len, data);
+
+ kfree(out);
++ return;
++
++err_out:
++ dev->stats.rx_errors++;
++ kfree(out);
+ }
+
+ static int ppp_rx(struct sk_buff *skb)
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index e1a5887b6d91d..d2df7d71d6667 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -1062,8 +1062,10 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+ serial8250_apply_quirks(uart);
+ ret = uart_add_one_port(&serial8250_reg,
+ &uart->port);
+- if (ret == 0)
+- ret = uart->port.line;
++ if (ret)
++ goto err;
++
++ ret = uart->port.line;
+ } else {
+ dev_info(uart->port.dev,
+ "skipping CIR port at 0x%lx / 0x%llx, IRQ %d\n",
+@@ -1088,6 +1090,11 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+ mutex_unlock(&serial_mutex);
+
+ return ret;
++
++err:
++ uart->port.dev = NULL;
++ mutex_unlock(&serial_mutex);
++ return ret;
+ }
+ EXPORT_SYMBOL(serial8250_register_8250_port);
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 25407c206e732..cbc0294f39899 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -3014,8 +3014,9 @@ static inline int skb_padto(struct sk_buff *skb, unsigned int len)
+ * is untouched. Otherwise it is extended. Returns zero on
+ * success. The skb is freed on error if @free_on_error is true.
+ */
+-static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len,
+- bool free_on_error)
++static inline int __must_check __skb_put_padto(struct sk_buff *skb,
++ unsigned int len,
++ bool free_on_error)
+ {
+ unsigned int size = skb->len;
+
+@@ -3038,7 +3039,7 @@ static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len,
+ * is untouched. Otherwise it is extended. Returns zero on
+ * success. The skb is freed on error.
+ */
+-static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
++static inline int __must_check skb_put_padto(struct sk_buff *skb, unsigned int len)
+ {
+ return __skb_put_padto(skb, len, true);
+ }
+diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
+index 2d5220ab0600b..fc9d6e37552d3 100644
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -139,8 +139,8 @@ struct inet_connection_sock {
+ } icsk_mtup;
+ u32 icsk_user_timeout;
+
+- u64 icsk_ca_priv[88 / sizeof(u64)];
+-#define ICSK_CA_PRIV_SIZE (11 * sizeof(u64))
++ u64 icsk_ca_priv[104 / sizeof(u64)];
++#define ICSK_CA_PRIV_SIZE (13 * sizeof(u64))
+ };
+
+ #define ICSK_TIME_RETRANS 1 /* Retransmit timer */
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index eb4bffe6d764d..230d9d599b5aa 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2061,6 +2061,9 @@ static void kill_kprobe(struct kprobe *p)
+ {
+ struct kprobe *kp;
+
++ if (WARN_ON_ONCE(kprobe_gone(p)))
++ return;
++
+ p->flags |= KPROBE_FLAG_GONE;
+ if (kprobe_aggrprobe(p)) {
+ /*
+@@ -2243,7 +2246,10 @@ static int kprobes_module_callback(struct notifier_block *nb,
+ mutex_lock(&kprobe_mutex);
+ for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
+ head = &kprobe_table[i];
+- hlist_for_each_entry_rcu(p, head, hlist)
++ hlist_for_each_entry_rcu(p, head, hlist) {
++ if (kprobe_gone(p))
++ continue;
++
+ if (within_module_init((unsigned long)p->addr, mod) ||
+ (checkcore &&
+ within_module_core((unsigned long)p->addr, mod))) {
+@@ -2260,6 +2266,7 @@ static int kprobes_module_callback(struct notifier_block *nb,
+ */
+ kill_kprobe(p);
+ }
++ }
+ }
+ mutex_unlock(&kprobe_mutex);
+ return NOTIFY_DONE;
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 1443ae6fee9bd..8b137248b146d 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2145,7 +2145,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
+ put_page(page);
+ add_mm_counter(mm, mm_counter_file(page), -HPAGE_PMD_NR);
+ return;
+- } else if (is_huge_zero_pmd(*pmd)) {
++ } else if (pmd_trans_huge(*pmd) && is_huge_zero_pmd(*pmd)) {
+ /*
+ * FIXME: Do we want to invalidate secondary mmu by calling
+ * mmu_notifier_invalidate_range() see comments below inside
+@@ -2233,27 +2233,33 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
+ pte = pte_offset_map(&_pmd, addr);
+ BUG_ON(!pte_none(*pte));
+ set_pte_at(mm, addr, pte, entry);
+- atomic_inc(&page[i]._mapcount);
+- pte_unmap(pte);
+- }
+-
+- /*
+- * Set PG_double_map before dropping compound_mapcount to avoid
+- * false-negative page_mapped().
+- */
+- if (compound_mapcount(page) > 1 && !TestSetPageDoubleMap(page)) {
+- for (i = 0; i < HPAGE_PMD_NR; i++)
++ if (!pmd_migration)
+ atomic_inc(&page[i]._mapcount);
++ pte_unmap(pte);
+ }
+
+- if (atomic_add_negative(-1, compound_mapcount_ptr(page))) {
+- /* Last compound_mapcount is gone. */
+- __dec_node_page_state(page, NR_ANON_THPS);
+- if (TestClearPageDoubleMap(page)) {
+- /* No need in mapcount reference anymore */
++ if (!pmd_migration) {
++ /*
++ * Set PG_double_map before dropping compound_mapcount to avoid
++ * false-negative page_mapped().
++ */
++ if (compound_mapcount(page) > 1 &&
++ !TestSetPageDoubleMap(page)) {
+ for (i = 0; i < HPAGE_PMD_NR; i++)
+- atomic_dec(&page[i]._mapcount);
++ atomic_inc(&page[i]._mapcount);
++ }
++
++ lock_page_memcg(page);
++ if (atomic_add_negative(-1, compound_mapcount_ptr(page))) {
++ /* Last compound_mapcount is gone. */
++ __dec_lruvec_page_state(page, NR_ANON_THPS);
++ if (TestClearPageDoubleMap(page)) {
++ /* No need in mapcount reference anymore */
++ for (i = 0; i < HPAGE_PMD_NR; i++)
++ atomic_dec(&page[i]._mapcount);
++ }
+ }
++ unlock_page_memcg(page);
+ }
+
+ smp_wmb(); /* make pte visible before pmd */
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index bc2ecd43251ad..b93dc8fc6007f 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2708,6 +2708,14 @@ static bool shrink_node(pg_data_t *pgdat, struct scan_control *sc)
+ unsigned long reclaimed;
+ unsigned long scanned;
+
++ /*
++ * This loop can become CPU-bound when target memcgs
++ * aren't eligible for reclaim - either because they
++ * don't have any reclaimable pages, or because their
++ * memory is explicitly protected. Avoid soft lockups.
++ */
++ cond_resched();
++
+ switch (mem_cgroup_protected(root, memcg)) {
+ case MEMCG_PROT_MIN:
+ /*
+diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
+index a556cd708885a..5ee6b94131b23 100644
+--- a/net/dcb/dcbnl.c
++++ b/net/dcb/dcbnl.c
+@@ -1421,6 +1421,7 @@ static int dcbnl_ieee_set(struct net_device *netdev, struct nlmsghdr *nlh,
+ {
+ const struct dcbnl_rtnl_ops *ops = netdev->dcbnl_ops;
+ struct nlattr *ieee[DCB_ATTR_IEEE_MAX + 1];
++ int prio;
+ int err;
+
+ if (!ops)
+@@ -1469,6 +1470,13 @@ static int dcbnl_ieee_set(struct net_device *netdev, struct nlmsghdr *nlh,
+ struct dcbnl_buffer *buffer =
+ nla_data(ieee[DCB_ATTR_DCB_BUFFER]);
+
++ for (prio = 0; prio < ARRAY_SIZE(buffer->prio2buffer); prio++) {
++ if (buffer->prio2buffer[prio] >= DCBX_MAX_BUFFERS) {
++ err = -EINVAL;
++ goto err;
++ }
++ }
++
+ err = ops->dcbnl_setbuffer(netdev, buffer);
+ if (err)
+ goto err;
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index fbf30122e8bf2..f0faf1193dd89 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -73,6 +73,7 @@
+ #include <net/icmp.h>
+ #include <net/checksum.h>
+ #include <net/inetpeer.h>
++#include <net/inet_ecn.h>
+ #include <net/lwtunnel.h>
+ #include <linux/bpf-cgroup.h>
+ #include <linux/igmp.h>
+@@ -1582,7 +1583,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
+ if (IS_ERR(rt))
+ return;
+
+- inet_sk(sk)->tos = arg->tos;
++ inet_sk(sk)->tos = arg->tos & ~INET_ECN_MASK;
+
+ sk->sk_priority = skb->priority;
+ sk->sk_protocol = ip_hdr(skb)->protocol;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index f752d22cc8a59..84de87b7eedcd 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -777,8 +777,10 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
+ neigh_event_send(n, NULL);
+ } else {
+ if (fib_lookup(net, fl4, &res, 0) == 0) {
+- struct fib_nh *nh = &FIB_RES_NH(res);
++ struct fib_nh *nh;
+
++ fib_select_path(net, &res, fl4, skb);
++ nh = &FIB_RES_NH(res);
+ update_or_create_fnhe(nh, fl4->daddr, new_gw,
+ 0, false,
+ jiffies + ip_rt_gc_timeout);
+@@ -1004,6 +1006,7 @@ out: kfree_skb(skb);
+ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
+ {
+ struct dst_entry *dst = &rt->dst;
++ struct net *net = dev_net(dst->dev);
+ u32 old_mtu = ipv4_mtu(dst);
+ struct fib_result res;
+ bool lock = false;
+@@ -1024,9 +1027,11 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
+ return;
+
+ rcu_read_lock();
+- if (fib_lookup(dev_net(dst->dev), fl4, &res, 0) == 0) {
+- struct fib_nh *nh = &FIB_RES_NH(res);
++ if (fib_lookup(net, fl4, &res, 0) == 0) {
++ struct fib_nh *nh;
+
++ fib_select_path(net, &res, fl4, NULL);
++ nh = &FIB_RES_NH(res);
+ update_or_create_fnhe(nh, fl4->daddr, 0, mtu, lock,
+ jiffies + ip_rt_mtu_expires);
+ }
+@@ -2536,8 +2541,6 @@ struct rtable *ip_route_output_key_hash_rcu(struct net *net, struct flowi4 *fl4,
+ fib_select_path(net, res, fl4, skb);
+
+ dev_out = FIB_RES_DEV(*res);
+- fl4->flowi4_oif = dev_out->ifindex;
+-
+
+ make_route:
+ rth = __mkroute_output(res, fl4, orig_oif, dev_out, flags);
+diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
+index b371e66502c36..93f1763362977 100644
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -115,6 +115,14 @@ struct bbr {
+ unused_b:5;
+ u32 prior_cwnd; /* prior cwnd upon entering loss recovery */
+ u32 full_bw; /* recent bw, to estimate if pipe is full */
++
++ /* For tracking ACK aggregation: */
++ u64 ack_epoch_mstamp; /* start of ACK sampling epoch */
++ u16 extra_acked[2]; /* max excess data ACKed in epoch */
++ u32 ack_epoch_acked:20, /* packets (S)ACKed in sampling epoch */
++ extra_acked_win_rtts:5, /* age of extra_acked, in round trips */
++ extra_acked_win_idx:1, /* current index in extra_acked array */
++ unused_c:6;
+ };
+
+ #define CYCLE_LEN 8 /* number of phases in a pacing gain cycle */
+@@ -174,6 +182,15 @@ static const u32 bbr_lt_bw_diff = 4000 / 8;
+ /* If we estimate we're policed, use lt_bw for this many round trips: */
+ static const u32 bbr_lt_bw_max_rtts = 48;
+
++/* Gain factor for adding extra_acked to target cwnd: */
++static const int bbr_extra_acked_gain = BBR_UNIT;
++/* Window length of extra_acked window. */
++static const u32 bbr_extra_acked_win_rtts = 5;
++/* Max allowed val for ack_epoch_acked, after which sampling epoch is reset */
++static const u32 bbr_ack_epoch_acked_reset_thresh = 1U << 20;
++/* Time period for clamping cwnd increment due to ack aggregation */
++static const u32 bbr_extra_acked_max_us = 100 * 1000;
++
+ static void bbr_check_probe_rtt_done(struct sock *sk);
+
+ /* Do we estimate that STARTUP filled the pipe? */
+@@ -200,6 +217,16 @@ static u32 bbr_bw(const struct sock *sk)
+ return bbr->lt_use_bw ? bbr->lt_bw : bbr_max_bw(sk);
+ }
+
++/* Return maximum extra acked in past k-2k round trips,
++ * where k = bbr_extra_acked_win_rtts.
++ */
++static u16 bbr_extra_acked(const struct sock *sk)
++{
++ struct bbr *bbr = inet_csk_ca(sk);
++
++ return max(bbr->extra_acked[0], bbr->extra_acked[1]);
++}
++
+ /* Return rate in bytes per second, optionally with a gain.
+ * The order here is chosen carefully to avoid overflow of u64. This should
+ * work for input rates of up to 2.9Tbit/sec and gain of 2.89x.
+@@ -305,6 +332,8 @@ static void bbr_cwnd_event(struct sock *sk, enum tcp_ca_event event)
+
+ if (event == CA_EVENT_TX_START && tp->app_limited) {
+ bbr->idle_restart = 1;
++ bbr->ack_epoch_mstamp = tp->tcp_mstamp;
++ bbr->ack_epoch_acked = 0;
+ /* Avoid pointless buffer overflows: pace at est. bw if we don't
+ * need more speed (we're restarting from idle and app-limited).
+ */
+@@ -315,30 +344,19 @@ static void bbr_cwnd_event(struct sock *sk, enum tcp_ca_event event)
+ }
+ }
+
+-/* Find target cwnd. Right-size the cwnd based on min RTT and the
+- * estimated bottleneck bandwidth:
++/* Calculate bdp based on min RTT and the estimated bottleneck bandwidth:
+ *
+- * cwnd = bw * min_rtt * gain = BDP * gain
++ * bdp = bw * min_rtt * gain
+ *
+ * The key factor, gain, controls the amount of queue. While a small gain
+ * builds a smaller queue, it becomes more vulnerable to noise in RTT
+ * measurements (e.g., delayed ACKs or other ACK compression effects). This
+ * noise may cause BBR to under-estimate the rate.
+- *
+- * To achieve full performance in high-speed paths, we budget enough cwnd to
+- * fit full-sized skbs in-flight on both end hosts to fully utilize the path:
+- * - one skb in sending host Qdisc,
+- * - one skb in sending host TSO/GSO engine
+- * - one skb being received by receiver host LRO/GRO/delayed-ACK engine
+- * Don't worry, at low rates (bbr_min_tso_rate) this won't bloat cwnd because
+- * in such cases tso_segs_goal is 1. The minimum cwnd is 4 packets,
+- * which allows 2 outstanding 2-packet sequences, to try to keep pipe
+- * full even with ACK-every-other-packet delayed ACKs.
+ */
+-static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain)
++static u32 bbr_bdp(struct sock *sk, u32 bw, int gain)
+ {
+ struct bbr *bbr = inet_csk_ca(sk);
+- u32 cwnd;
++ u32 bdp;
+ u64 w;
+
+ /* If we've never had a valid RTT sample, cap cwnd at the initial
+@@ -353,7 +371,24 @@ static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain)
+ w = (u64)bw * bbr->min_rtt_us;
+
+ /* Apply a gain to the given value, then remove the BW_SCALE shift. */
+- cwnd = (((w * gain) >> BBR_SCALE) + BW_UNIT - 1) / BW_UNIT;
++ bdp = (((w * gain) >> BBR_SCALE) + BW_UNIT - 1) / BW_UNIT;
++
++ return bdp;
++}
++
++/* To achieve full performance in high-speed paths, we budget enough cwnd to
++ * fit full-sized skbs in-flight on both end hosts to fully utilize the path:
++ * - one skb in sending host Qdisc,
++ * - one skb in sending host TSO/GSO engine
++ * - one skb being received by receiver host LRO/GRO/delayed-ACK engine
++ * Don't worry, at low rates (bbr_min_tso_rate) this won't bloat cwnd because
++ * in such cases tso_segs_goal is 1. The minimum cwnd is 4 packets,
++ * which allows 2 outstanding 2-packet sequences, to try to keep pipe
++ * full even with ACK-every-other-packet delayed ACKs.
++ */
++static u32 bbr_quantization_budget(struct sock *sk, u32 cwnd, int gain)
++{
++ struct bbr *bbr = inet_csk_ca(sk);
+
+ /* Allow enough full-sized skbs in flight to utilize end systems. */
+ cwnd += 3 * bbr_tso_segs_goal(sk);
+@@ -368,6 +403,33 @@ static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain)
+ return cwnd;
+ }
+
++/* Find inflight based on min RTT and the estimated bottleneck bandwidth. */
++static u32 bbr_inflight(struct sock *sk, u32 bw, int gain)
++{
++ u32 inflight;
++
++ inflight = bbr_bdp(sk, bw, gain);
++ inflight = bbr_quantization_budget(sk, inflight, gain);
++
++ return inflight;
++}
++
++/* Find the cwnd increment based on estimate of ack aggregation */
++static u32 bbr_ack_aggregation_cwnd(struct sock *sk)
++{
++ u32 max_aggr_cwnd, aggr_cwnd = 0;
++
++ if (bbr_extra_acked_gain && bbr_full_bw_reached(sk)) {
++ max_aggr_cwnd = ((u64)bbr_bw(sk) * bbr_extra_acked_max_us)
++ / BW_UNIT;
++ aggr_cwnd = (bbr_extra_acked_gain * bbr_extra_acked(sk))
++ >> BBR_SCALE;
++ aggr_cwnd = min(aggr_cwnd, max_aggr_cwnd);
++ }
++
++ return aggr_cwnd;
++}
++
+ /* An optimization in BBR to reduce losses: On the first round of recovery, we
+ * follow the packet conservation principle: send P packets per P packets acked.
+ * After that, we slow-start and send at most 2*P packets per P packets acked.
+@@ -428,8 +490,15 @@ static void bbr_set_cwnd(struct sock *sk, const struct rate_sample *rs,
+ if (bbr_set_cwnd_to_recover_or_restore(sk, rs, acked, &cwnd))
+ goto done;
+
++ target_cwnd = bbr_bdp(sk, bw, gain);
++
++ /* Increment the cwnd to account for excess ACKed data that seems
++ * due to aggregation (of data and/or ACKs) visible in the ACK stream.
++ */
++ target_cwnd += bbr_ack_aggregation_cwnd(sk);
++ target_cwnd = bbr_quantization_budget(sk, target_cwnd, gain);
++
+ /* If we're below target cwnd, slow start cwnd toward target cwnd. */
+- target_cwnd = bbr_target_cwnd(sk, bw, gain);
+ if (bbr_full_bw_reached(sk)) /* only cut cwnd if we filled the pipe */
+ cwnd = min(cwnd + acked, target_cwnd);
+ else if (cwnd < target_cwnd || tp->delivered < TCP_INIT_CWND)
+@@ -470,14 +539,14 @@ static bool bbr_is_next_cycle_phase(struct sock *sk,
+ if (bbr->pacing_gain > BBR_UNIT)
+ return is_full_length &&
+ (rs->losses || /* perhaps pacing_gain*BDP won't fit */
+- inflight >= bbr_target_cwnd(sk, bw, bbr->pacing_gain));
++ inflight >= bbr_inflight(sk, bw, bbr->pacing_gain));
+
+ /* A pacing_gain < 1.0 tries to drain extra queue we added if bw
+ * probing didn't find more bw. If inflight falls to match BDP then we
+ * estimate queue is drained; persisting would underutilize the pipe.
+ */
+ return is_full_length ||
+- inflight <= bbr_target_cwnd(sk, bw, BBR_UNIT);
++ inflight <= bbr_inflight(sk, bw, BBR_UNIT);
+ }
+
+ static void bbr_advance_cycle_phase(struct sock *sk)
+@@ -699,6 +768,67 @@ static void bbr_update_bw(struct sock *sk, const struct rate_sample *rs)
+ }
+ }
+
++/* Estimates the windowed max degree of ack aggregation.
++ * This is used to provision extra in-flight data to keep sending during
++ * inter-ACK silences.
++ *
++ * Degree of ack aggregation is estimated as extra data acked beyond expected.
++ *
++ * max_extra_acked = "maximum recent excess data ACKed beyond max_bw * interval"
++ * cwnd += max_extra_acked
++ *
++ * Max extra_acked is clamped by cwnd and bw * bbr_extra_acked_max_us (100 ms).
++ * Max filter is an approximate sliding window of 5-10 (packet timed) round
++ * trips.
++ */
++static void bbr_update_ack_aggregation(struct sock *sk,
++ const struct rate_sample *rs)
++{
++ u32 epoch_us, expected_acked, extra_acked;
++ struct bbr *bbr = inet_csk_ca(sk);
++ struct tcp_sock *tp = tcp_sk(sk);
++
++ if (!bbr_extra_acked_gain || rs->acked_sacked <= 0 ||
++ rs->delivered < 0 || rs->interval_us <= 0)
++ return;
++
++ if (bbr->round_start) {
++ bbr->extra_acked_win_rtts = min(0x1F,
++ bbr->extra_acked_win_rtts + 1);
++ if (bbr->extra_acked_win_rtts >= bbr_extra_acked_win_rtts) {
++ bbr->extra_acked_win_rtts = 0;
++ bbr->extra_acked_win_idx = bbr->extra_acked_win_idx ?
++ 0 : 1;
++ bbr->extra_acked[bbr->extra_acked_win_idx] = 0;
++ }
++ }
++
++ /* Compute how many packets we expected to be delivered over epoch. */
++ epoch_us = tcp_stamp_us_delta(tp->delivered_mstamp,
++ bbr->ack_epoch_mstamp);
++ expected_acked = ((u64)bbr_bw(sk) * epoch_us) / BW_UNIT;
++
++ /* Reset the aggregation epoch if ACK rate is below expected rate or
++ * significantly large no. of ack received since epoch (potentially
++ * quite old epoch).
++ */
++ if (bbr->ack_epoch_acked <= expected_acked ||
++ (bbr->ack_epoch_acked + rs->acked_sacked >=
++ bbr_ack_epoch_acked_reset_thresh)) {
++ bbr->ack_epoch_acked = 0;
++ bbr->ack_epoch_mstamp = tp->delivered_mstamp;
++ expected_acked = 0;
++ }
++
++ /* Compute excess data delivered, beyond what was expected. */
++ bbr->ack_epoch_acked = min_t(u32, 0xFFFFF,
++ bbr->ack_epoch_acked + rs->acked_sacked);
++ extra_acked = bbr->ack_epoch_acked - expected_acked;
++ extra_acked = min(extra_acked, tp->snd_cwnd);
++ if (extra_acked > bbr->extra_acked[bbr->extra_acked_win_idx])
++ bbr->extra_acked[bbr->extra_acked_win_idx] = extra_acked;
++}
++
+ /* Estimate when the pipe is full, using the change in delivery rate: BBR
+ * estimates that STARTUP filled the pipe if the estimated bw hasn't changed by
+ * at least bbr_full_bw_thresh (25%) after bbr_full_bw_cnt (3) non-app-limited
+@@ -736,11 +866,11 @@ static void bbr_check_drain(struct sock *sk, const struct rate_sample *rs)
+ bbr->pacing_gain = bbr_drain_gain; /* pace slow to drain */
+ bbr->cwnd_gain = bbr_high_gain; /* maintain cwnd */
+ tcp_sk(sk)->snd_ssthresh =
+- bbr_target_cwnd(sk, bbr_max_bw(sk), BBR_UNIT);
++ bbr_inflight(sk, bbr_max_bw(sk), BBR_UNIT);
+ } /* fall through to check if in-flight is already small: */
+ if (bbr->mode == BBR_DRAIN &&
+ tcp_packets_in_flight(tcp_sk(sk)) <=
+- bbr_target_cwnd(sk, bbr_max_bw(sk), BBR_UNIT))
++ bbr_inflight(sk, bbr_max_bw(sk), BBR_UNIT))
+ bbr_reset_probe_bw_mode(sk); /* we estimate queue is drained */
+ }
+
+@@ -828,6 +958,7 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs)
+ static void bbr_update_model(struct sock *sk, const struct rate_sample *rs)
+ {
+ bbr_update_bw(sk, rs);
++ bbr_update_ack_aggregation(sk, rs);
+ bbr_update_cycle_phase(sk, rs);
+ bbr_check_full_bw_reached(sk, rs);
+ bbr_check_drain(sk, rs);
+@@ -878,6 +1009,13 @@ static void bbr_init(struct sock *sk)
+ bbr_reset_lt_bw_sampling(sk);
+ bbr_reset_startup_mode(sk);
+
++ bbr->ack_epoch_mstamp = tp->tcp_mstamp;
++ bbr->ack_epoch_acked = 0;
++ bbr->extra_acked_win_rtts = 0;
++ bbr->extra_acked_win_idx = 0;
++ bbr->extra_acked[0] = 0;
++ bbr->extra_acked[1] = 0;
++
+ cmpxchg(&sk->sk_pacing_status, SK_PACING_NONE, SK_PACING_NEEDED);
+ }
+
+diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
+index 613282c65a107..a32cf50c237d8 100644
+--- a/net/ipv6/Kconfig
++++ b/net/ipv6/Kconfig
+@@ -321,6 +321,7 @@ config IPV6_SEG6_LWTUNNEL
+ config IPV6_SEG6_HMAC
+ bool "IPv6: Segment Routing HMAC support"
+ depends on IPV6
++ select CRYPTO
+ select CRYPTO_HMAC
+ select CRYPTO_SHA1
+ select CRYPTO_SHA256
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 5e8979c1f76d8..05a206202e23d 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -1811,14 +1811,19 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,
+ /* Need to own table->tb6_lock */
+ int fib6_del(struct fib6_info *rt, struct nl_info *info)
+ {
+- struct fib6_node *fn = rcu_dereference_protected(rt->fib6_node,
+- lockdep_is_held(&rt->fib6_table->tb6_lock));
+- struct fib6_table *table = rt->fib6_table;
+ struct net *net = info->nl_net;
+ struct fib6_info __rcu **rtp;
+ struct fib6_info __rcu **rtp_next;
++ struct fib6_table *table;
++ struct fib6_node *fn;
++
++ if (rt == net->ipv6.fib6_null_entry)
++ return -ENOENT;
+
+- if (!fn || rt == net->ipv6.fib6_null_entry)
++ table = rt->fib6_table;
++ fn = rcu_dereference_protected(rt->fib6_node,
++ lockdep_is_held(&table->tb6_lock));
++ if (!fn)
+ return -ENOENT;
+
+ WARN_ON(!(fn->fn_flags & RTN_RTINFO));
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 1982f9f31debb..e340e97224c3a 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1855,6 +1855,13 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
+ if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
+ struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
+
++ if ((xfilter->sadb_x_filter_splen >=
++ (sizeof(xfrm_address_t) << 3)) ||
++ (xfilter->sadb_x_filter_dplen >=
++ (sizeof(xfrm_address_t) << 3))) {
++ mutex_unlock(&pfk->dump_lock);
++ return -EINVAL;
++ }
+ filter = kmalloc(sizeof(*filter), GFP_KERNEL);
+ if (filter == NULL) {
+ mutex_unlock(&pfk->dump_lock);
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 42bd1e74f78c1..a05c5cb3429c0 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -185,7 +185,7 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+ {
+ struct qrtr_hdr_v1 *hdr;
+ size_t len = skb->len;
+- int rc = -ENODEV;
++ int rc;
+
+ hdr = skb_push(skb, sizeof(*hdr));
+ hdr->version = cpu_to_le32(QRTR_PROTO_VER_1);
+@@ -203,15 +203,17 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+ hdr->size = cpu_to_le32(len);
+ hdr->confirm_rx = 0;
+
+- skb_put_padto(skb, ALIGN(len, 4) + sizeof(*hdr));
+-
+- mutex_lock(&node->ep_lock);
+- if (node->ep)
+- rc = node->ep->xmit(node->ep, skb);
+- else
+- kfree_skb(skb);
+- mutex_unlock(&node->ep_lock);
++ rc = skb_put_padto(skb, ALIGN(len, 4) + sizeof(*hdr));
+
++ if (!rc) {
++ mutex_lock(&node->ep_lock);
++ rc = -ENODEV;
++ if (node->ep)
++ rc = node->ep->xmit(node->ep, skb);
++ else
++ kfree_skb(skb);
++ mutex_unlock(&node->ep_lock);
++ }
+ return rc;
+ }
+
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 119e20cad662b..bd96fd261dba3 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -1115,27 +1115,36 @@ static void dev_deactivate_queue(struct net_device *dev,
+ struct netdev_queue *dev_queue,
+ void *_qdisc_default)
+ {
+- struct Qdisc *qdisc_default = _qdisc_default;
+- struct Qdisc *qdisc;
++ struct Qdisc *qdisc = rtnl_dereference(dev_queue->qdisc);
+
+- qdisc = rtnl_dereference(dev_queue->qdisc);
+ if (qdisc) {
+- bool nolock = qdisc->flags & TCQ_F_NOLOCK;
+-
+- if (nolock)
+- spin_lock_bh(&qdisc->seqlock);
+- spin_lock_bh(qdisc_lock(qdisc));
+-
+ if (!(qdisc->flags & TCQ_F_BUILTIN))
+ set_bit(__QDISC_STATE_DEACTIVATED, &qdisc->state);
++ }
++}
+
+- rcu_assign_pointer(dev_queue->qdisc, qdisc_default);
+- qdisc_reset(qdisc);
++static void dev_reset_queue(struct net_device *dev,
++ struct netdev_queue *dev_queue,
++ void *_unused)
++{
++ struct Qdisc *qdisc;
++ bool nolock;
+
+- spin_unlock_bh(qdisc_lock(qdisc));
+- if (nolock)
+- spin_unlock_bh(&qdisc->seqlock);
+- }
++ qdisc = dev_queue->qdisc_sleeping;
++ if (!qdisc)
++ return;
++
++ nolock = qdisc->flags & TCQ_F_NOLOCK;
++
++ if (nolock)
++ spin_lock_bh(&qdisc->seqlock);
++ spin_lock_bh(qdisc_lock(qdisc));
++
++ qdisc_reset(qdisc);
++
++ spin_unlock_bh(qdisc_lock(qdisc));
++ if (nolock)
++ spin_unlock_bh(&qdisc->seqlock);
+ }
+
+ static bool some_qdisc_is_busy(struct net_device *dev)
+@@ -1196,12 +1205,20 @@ void dev_deactivate_many(struct list_head *head)
+ dev_watchdog_down(dev);
+ }
+
+- /* Wait for outstanding qdisc-less dev_queue_xmit calls.
++ /* Wait for outstanding qdisc-less dev_queue_xmit calls or
++ * outstanding qdisc enqueuing calls.
+ * This is avoided if all devices are in dismantle phase :
+ * Caller will call synchronize_net() for us
+ */
+ synchronize_net();
+
++ list_for_each_entry(dev, head, close_list) {
++ netdev_for_each_tx_queue(dev, dev_reset_queue, NULL);
++
++ if (dev_ingress_queue(dev))
++ dev_reset_queue(dev, dev_ingress_queue(dev), NULL);
++ }
++
+ /* Wait for outstanding qdisc_run calls. */
+ list_for_each_entry(dev, head, close_list) {
+ while (some_qdisc_is_busy(dev))
+diff --git a/net/tipc/group.c b/net/tipc/group.c
+index 9a9138de4eca5..b656385efad65 100644
+--- a/net/tipc/group.c
++++ b/net/tipc/group.c
+@@ -273,8 +273,8 @@ static struct tipc_member *tipc_group_find_node(struct tipc_group *grp,
+ return NULL;
+ }
+
+-static void tipc_group_add_to_tree(struct tipc_group *grp,
+- struct tipc_member *m)
++static int tipc_group_add_to_tree(struct tipc_group *grp,
++ struct tipc_member *m)
+ {
+ u64 nkey, key = (u64)m->node << 32 | m->port;
+ struct rb_node **n, *parent = NULL;
+@@ -291,10 +291,11 @@ static void tipc_group_add_to_tree(struct tipc_group *grp,
+ else if (key > nkey)
+ n = &(*n)->rb_right;
+ else
+- return;
++ return -EEXIST;
+ }
+ rb_link_node(&m->tree_node, parent, n);
+ rb_insert_color(&m->tree_node, &grp->members);
++ return 0;
+ }
+
+ static struct tipc_member *tipc_group_create_member(struct tipc_group *grp,
+@@ -302,6 +303,7 @@ static struct tipc_member *tipc_group_create_member(struct tipc_group *grp,
+ u32 instance, int state)
+ {
+ struct tipc_member *m;
++ int ret;
+
+ m = kzalloc(sizeof(*m), GFP_ATOMIC);
+ if (!m)
+@@ -314,8 +316,12 @@ static struct tipc_member *tipc_group_create_member(struct tipc_group *grp,
+ m->port = port;
+ m->instance = instance;
+ m->bc_acked = grp->bc_snd_nxt - 1;
++ ret = tipc_group_add_to_tree(grp, m);
++ if (ret < 0) {
++ kfree(m);
++ return NULL;
++ }
+ grp->member_cnt++;
+- tipc_group_add_to_tree(grp, m);
+ tipc_nlist_add(&grp->dests, m->node);
+ m->state = state;
+ return m;
+diff --git a/net/tipc/msg.c b/net/tipc/msg.c
+index cbccf1791d3c5..b078b77620f18 100644
+--- a/net/tipc/msg.c
++++ b/net/tipc/msg.c
+@@ -140,7 +140,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
+ if (fragid == FIRST_FRAGMENT) {
+ if (unlikely(head))
+ goto err;
+- if (unlikely(skb_unclone(frag, GFP_ATOMIC)))
++ frag = skb_unshare(frag, GFP_ATOMIC);
++ if (unlikely(!frag))
+ goto err;
+ head = *headbuf = frag;
+ *buf = NULL;
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index d0cf7169f08c8..16e2af3a00ccb 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -2565,10 +2565,7 @@ static int tipc_shutdown(struct socket *sock, int how)
+ lock_sock(sk);
+
+ __tipc_shutdown(sock, TIPC_CONN_SHUTDOWN);
+- if (tipc_sk_type_connectionless(sk))
+- sk->sk_shutdown = SHUTDOWN_MASK;
+- else
+- sk->sk_shutdown = SEND_SHUTDOWN;
++ sk->sk_shutdown = SHUTDOWN_MASK;
+
+ if (sk->sk_state == TIPC_DISCONNECTING) {
+ /* Discard any unreceived messages */
+diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
+index 20f67fcf378d5..baa92279c137e 100644
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -7,9 +7,15 @@ ARCH := x86
+ endif
+
+ # always use the host compiler
++ifneq ($(LLVM),)
++HOSTAR ?= llvm-ar
++HOSTCC ?= clang
++HOSTLD ?= ld.lld
++else
+ HOSTAR ?= ar
+ HOSTCC ?= gcc
+ HOSTLD ?= ld
++endif
+ AR = $(HOSTAR)
+ CC = $(HOSTCC)
+ LD = $(HOSTLD)
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 2155b52b17eca..6bd01d12df2ec 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -3844,7 +3844,7 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
+ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+ struct kvm_io_device *dev)
+ {
+- int i;
++ int i, j;
+ struct kvm_io_bus *new_bus, *bus;
+
+ bus = kvm_get_bus(kvm, bus_idx);
+@@ -3861,17 +3861,20 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+
+ new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
+ sizeof(struct kvm_io_range)), GFP_KERNEL);
+- if (!new_bus) {
++ if (new_bus) {
++ memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
++ new_bus->dev_count--;
++ memcpy(new_bus->range + i, bus->range + i + 1,
++ (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
++ } else {
+ pr_err("kvm: failed to shrink bus, removing it completely\n");
+- goto broken;
++ for (j = 0; j < bus->dev_count; j++) {
++ if (j == i)
++ continue;
++ kvm_iodevice_destructor(bus->range[j].dev);
++ }
+ }
+
+- memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
+- new_bus->dev_count--;
+- memcpy(new_bus->range + i, bus->range + i + 1,
+- (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
+-
+-broken:
+ rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
+ synchronize_srcu_expedited(&kvm->srcu);
+ kfree(bus);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-09-26 22:07 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-09-26 22:07 UTC (permalink / raw
To: gentoo-commits
commit: 21a9e44cc1f2393d129a2b558b1379a84e3dbfa3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 26 22:06:54 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Sep 26 22:06:54 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=21a9e44c
Fix gentoo Kconfig patch
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
4567_distro-Gentoo-Kconfig.patch | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index e754a3e..fe71b18 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -1,9 +1,9 @@
---- a/Kconfig 2020-04-15 11:05:30.202413863 -0400
-+++ b/Kconfig 2020-04-15 10:37:45.683952949 -0400
-@@ -32,3 +32,5 @@ source "lib/Kconfig"
- source "lib/Kconfig.debug"
+--- a/Kconfig 2020-09-26 18:03:43.918963345 -0400
++++ b/Kconfig 2020-09-26 18:04:12.439182521 -0400
+@@ -30,3 +30,5 @@ source "crypto/Kconfig"
+ source "lib/Kconfig"
- source "Documentation/Kconfig"
+ source "lib/Kconfig.debug"
+
+source "distro/Kconfig"
--- /dev/null 2020-09-24 03:06:47.590000000 -0400
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-10-01 12:45 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-10-01 12:45 UTC (permalink / raw
To: gentoo-commits
commit: 310f5c1a8c792bf9601dccaa67621ff87d95d8a8
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Oct 1 12:45:24 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Oct 1 12:45:24 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=310f5c1a
Linux patch 4.19.149
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1148_linux-4.19.149.patch | 9972 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 9976 insertions(+)
diff --git a/0000_README b/0000_README
index 9707ae7..e7a8587 100644
--- a/0000_README
+++ b/0000_README
@@ -631,6 +631,10 @@ Patch: 1147_linux-4.19.148.patch
From: https://www.kernel.org
Desc: Linux 4.19.148
+Patch: 1148_linux-4.19.149.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.149
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1148_linux-4.19.149.patch b/1148_linux-4.19.149.patch
new file mode 100644
index 0000000..75c6340
--- /dev/null
+++ b/1148_linux-4.19.149.patch
@@ -0,0 +1,9972 @@
+diff --git a/Documentation/devicetree/bindings/sound/wm8994.txt b/Documentation/devicetree/bindings/sound/wm8994.txt
+index 68cccc4653ba3..367b58ce1bb92 100644
+--- a/Documentation/devicetree/bindings/sound/wm8994.txt
++++ b/Documentation/devicetree/bindings/sound/wm8994.txt
+@@ -14,9 +14,15 @@ Required properties:
+ - #gpio-cells : Must be 2. The first cell is the pin number and the
+ second cell is used to specify optional parameters (currently unused).
+
+- - AVDD2-supply, DBVDD1-supply, DBVDD2-supply, DBVDD3-supply, CPVDD-supply,
+- SPKVDD1-supply, SPKVDD2-supply : power supplies for the device, as covered
+- in Documentation/devicetree/bindings/regulator/regulator.txt
++ - power supplies for the device, as covered in
++ Documentation/devicetree/bindings/regulator/regulator.txt, depending
++ on compatible:
++ - for wlf,wm1811 and wlf,wm8958:
++ AVDD1-supply, AVDD2-supply, DBVDD1-supply, DBVDD2-supply, DBVDD3-supply,
++ DCVDD-supply, CPVDD-supply, SPKVDD1-supply, SPKVDD2-supply
++ - for wlf,wm8994:
++ AVDD1-supply, AVDD2-supply, DBVDD-supply, DCVDD-supply, CPVDD-supply,
++ SPKVDD1-supply, SPKVDD2-supply
+
+ Optional properties:
+
+@@ -73,11 +79,11 @@ wm8994: codec@1a {
+
+ lineout1-se;
+
++ AVDD1-supply = <®ulator>;
+ AVDD2-supply = <®ulator>;
+ CPVDD-supply = <®ulator>;
+- DBVDD1-supply = <®ulator>;
+- DBVDD2-supply = <®ulator>;
+- DBVDD3-supply = <®ulator>;
++ DBVDD-supply = <®ulator>;
++ DCVDD-supply = <®ulator>;
+ SPKVDD1-supply = <®ulator>;
+ SPKVDD2-supply = <®ulator>;
+ };
+diff --git a/Documentation/driver-api/libata.rst b/Documentation/driver-api/libata.rst
+index 70e180e6b93dc..9f3e5dc311840 100644
+--- a/Documentation/driver-api/libata.rst
++++ b/Documentation/driver-api/libata.rst
+@@ -250,7 +250,7 @@ High-level taskfile hooks
+
+ ::
+
+- void (*qc_prep) (struct ata_queued_cmd *qc);
++ enum ata_completion_errors (*qc_prep) (struct ata_queued_cmd *qc);
+ int (*qc_issue) (struct ata_queued_cmd *qc);
+
+
+diff --git a/Makefile b/Makefile
+index 3ffd5b03e6ddf..3ff5cf33ef55c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 148
++SUBLEVEL = 149
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/include/asm/kvm_emulate.h b/arch/arm/include/asm/kvm_emulate.h
+index 7d2ca035d6c8f..11d4ff9f3e4df 100644
+--- a/arch/arm/include/asm/kvm_emulate.h
++++ b/arch/arm/include/asm/kvm_emulate.h
+@@ -216,7 +216,7 @@ static inline int kvm_vcpu_dabt_get_rd(struct kvm_vcpu *vcpu)
+ return (kvm_vcpu_get_hsr(vcpu) & HSR_SRT_MASK) >> HSR_SRT_SHIFT;
+ }
+
+-static inline bool kvm_vcpu_dabt_iss1tw(struct kvm_vcpu *vcpu)
++static inline bool kvm_vcpu_abt_iss1tw(const struct kvm_vcpu *vcpu)
+ {
+ return kvm_vcpu_get_hsr(vcpu) & HSR_DABT_S1PTW;
+ }
+@@ -248,16 +248,21 @@ static inline bool kvm_vcpu_trap_il_is32bit(struct kvm_vcpu *vcpu)
+ return kvm_vcpu_get_hsr(vcpu) & HSR_IL;
+ }
+
+-static inline u8 kvm_vcpu_trap_get_class(struct kvm_vcpu *vcpu)
++static inline u8 kvm_vcpu_trap_get_class(const struct kvm_vcpu *vcpu)
+ {
+ return kvm_vcpu_get_hsr(vcpu) >> HSR_EC_SHIFT;
+ }
+
+-static inline bool kvm_vcpu_trap_is_iabt(struct kvm_vcpu *vcpu)
++static inline bool kvm_vcpu_trap_is_iabt(const struct kvm_vcpu *vcpu)
+ {
+ return kvm_vcpu_trap_get_class(vcpu) == HSR_EC_IABT;
+ }
+
++static inline bool kvm_vcpu_trap_is_exec_fault(const struct kvm_vcpu *vcpu)
++{
++ return kvm_vcpu_trap_is_iabt(vcpu) && !kvm_vcpu_abt_iss1tw(vcpu);
++}
++
+ static inline u8 kvm_vcpu_trap_get_fault(struct kvm_vcpu *vcpu)
+ {
+ return kvm_vcpu_get_hsr(vcpu) & HSR_FSC;
+diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
+index a4d4a28fe07df..d23ab9ec130a3 100644
+--- a/arch/arm/kernel/stacktrace.c
++++ b/arch/arm/kernel/stacktrace.c
+@@ -115,6 +115,8 @@ static int save_trace(struct stackframe *frame, void *d)
+ return 0;
+
+ regs = (struct pt_regs *)frame->sp;
++ if ((unsigned long)®s[1] > ALIGN(frame->sp, THREAD_SIZE))
++ return 0;
+
+ trace->entries[trace->nr_entries++] = regs->ARM_pc;
+
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index badf02ca36938..aec533168f046 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -67,14 +67,16 @@ static void dump_mem(const char *, const char *, unsigned long, unsigned long);
+
+ void dump_backtrace_entry(unsigned long where, unsigned long from, unsigned long frame)
+ {
++ unsigned long end = frame + 4 + sizeof(struct pt_regs);
++
+ #ifdef CONFIG_KALLSYMS
+ printk("[<%08lx>] (%ps) from [<%08lx>] (%pS)\n", where, (void *)where, from, (void *)from);
+ #else
+ printk("Function entered at [<%08lx>] from [<%08lx>]\n", where, from);
+ #endif
+
+- if (in_entry_text(from))
+- dump_mem("", "Exception stack", frame + 4, frame + 4 + sizeof(struct pt_regs));
++ if (in_entry_text(from) && end <= ALIGN(frame, THREAD_SIZE))
++ dump_mem("", "Exception stack", frame + 4, end);
+ }
+
+ void dump_backtrace_stm(u32 *stack, u32 instruction)
+diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
+index 778cb4f868d9b..669c960dd069c 100644
+--- a/arch/arm64/include/asm/kvm_emulate.h
++++ b/arch/arm64/include/asm/kvm_emulate.h
+@@ -303,7 +303,7 @@ static inline int kvm_vcpu_dabt_get_rd(const struct kvm_vcpu *vcpu)
+ return (kvm_vcpu_get_hsr(vcpu) & ESR_ELx_SRT_MASK) >> ESR_ELx_SRT_SHIFT;
+ }
+
+-static inline bool kvm_vcpu_dabt_iss1tw(const struct kvm_vcpu *vcpu)
++static inline bool kvm_vcpu_abt_iss1tw(const struct kvm_vcpu *vcpu)
+ {
+ return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_S1PTW);
+ }
+@@ -311,7 +311,7 @@ static inline bool kvm_vcpu_dabt_iss1tw(const struct kvm_vcpu *vcpu)
+ static inline bool kvm_vcpu_dabt_iswrite(const struct kvm_vcpu *vcpu)
+ {
+ return !!(kvm_vcpu_get_hsr(vcpu) & ESR_ELx_WNR) ||
+- kvm_vcpu_dabt_iss1tw(vcpu); /* AF/DBM update */
++ kvm_vcpu_abt_iss1tw(vcpu); /* AF/DBM update */
+ }
+
+ static inline bool kvm_vcpu_dabt_is_cm(const struct kvm_vcpu *vcpu)
+@@ -340,6 +340,11 @@ static inline bool kvm_vcpu_trap_is_iabt(const struct kvm_vcpu *vcpu)
+ return kvm_vcpu_trap_get_class(vcpu) == ESR_ELx_EC_IABT_LOW;
+ }
+
++static inline bool kvm_vcpu_trap_is_exec_fault(const struct kvm_vcpu *vcpu)
++{
++ return kvm_vcpu_trap_is_iabt(vcpu) && !kvm_vcpu_abt_iss1tw(vcpu);
++}
++
+ static inline u8 kvm_vcpu_trap_get_fault(const struct kvm_vcpu *vcpu)
+ {
+ return kvm_vcpu_get_hsr(vcpu) & ESR_ELx_FSC;
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index ac3126aba0368..de6fa9b4abfa0 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -155,11 +155,10 @@ static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = {
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_GIC_SHIFT, 4, 0),
+ S_ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_ASIMD_SHIFT, 4, ID_AA64PFR0_ASIMD_NI),
+ S_ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_FP_SHIFT, 4, ID_AA64PFR0_FP_NI),
+- /* Linux doesn't care about the EL3 */
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL3_SHIFT, 4, 0),
+- ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL2_SHIFT, 4, 0),
+- ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL1_SHIFT, 4, ID_AA64PFR0_EL1_64BIT_ONLY),
+- ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL0_SHIFT, 4, ID_AA64PFR0_EL0_64BIT_ONLY),
++ ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL2_SHIFT, 4, 0),
++ ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL1_SHIFT, 4, ID_AA64PFR0_EL1_64BIT_ONLY),
++ ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL0_SHIFT, 4, ID_AA64PFR0_EL0_64BIT_ONLY),
+ ARM64_FTR_END,
+ };
+
+@@ -301,7 +300,7 @@ static const struct arm64_ftr_bits ftr_id_pfr0[] = {
+ };
+
+ static const struct arm64_ftr_bits ftr_id_dfr0[] = {
+- ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 28, 4, 0),
++ /* [31:28] TraceFilt */
+ S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 24, 4, 0xf), /* PerfMon */
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 20, 4, 0),
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 16, 4, 0),
+@@ -671,9 +670,6 @@ void update_cpu_features(int cpu,
+ taint |= check_update_ftr_reg(SYS_ID_AA64MMFR2_EL1, cpu,
+ info->reg_id_aa64mmfr2, boot->reg_id_aa64mmfr2);
+
+- /*
+- * EL3 is not our concern.
+- */
+ taint |= check_update_ftr_reg(SYS_ID_AA64PFR0_EL1, cpu,
+ info->reg_id_aa64pfr0, boot->reg_id_aa64pfr0);
+ taint |= check_update_ftr_reg(SYS_ID_AA64PFR1_EL1, cpu,
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index f146bff53edf9..15312e429b7d1 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -430,7 +430,7 @@ static bool __hyp_text fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code)
+ kvm_vcpu_trap_get_fault_type(vcpu) == FSC_FAULT &&
+ kvm_vcpu_dabt_isvalid(vcpu) &&
+ !kvm_vcpu_dabt_isextabt(vcpu) &&
+- !kvm_vcpu_dabt_iss1tw(vcpu);
++ !kvm_vcpu_abt_iss1tw(vcpu);
+
+ if (valid) {
+ int ret = __vgic_v2_perform_cpuif_access(vcpu);
+diff --git a/arch/m68k/q40/config.c b/arch/m68k/q40/config.c
+index 96810d91da2bd..4a25ce6a1823d 100644
+--- a/arch/m68k/q40/config.c
++++ b/arch/m68k/q40/config.c
+@@ -273,6 +273,7 @@ static int q40_get_rtc_pll(struct rtc_pll_info *pll)
+ {
+ int tmp = Q40_RTC_CTRL;
+
++ pll->pll_ctrl = 0;
+ pll->pll_value = tmp & Q40_RTC_PLL_MASK;
+ if (tmp & Q40_RTC_PLL_SIGN)
+ pll->pll_value = -pll->pll_value;
+diff --git a/arch/mips/include/asm/cpu-type.h b/arch/mips/include/asm/cpu-type.h
+index a45af3de075d9..d43e4ab20b238 100644
+--- a/arch/mips/include/asm/cpu-type.h
++++ b/arch/mips/include/asm/cpu-type.h
+@@ -47,6 +47,7 @@ static inline int __pure __get_cpu_type(const int cpu_type)
+ case CPU_34K:
+ case CPU_1004K:
+ case CPU_74K:
++ case CPU_1074K:
+ case CPU_M14KC:
+ case CPU_M14KEC:
+ case CPU_INTERAPTIV:
+diff --git a/arch/powerpc/include/asm/kvm_asm.h b/arch/powerpc/include/asm/kvm_asm.h
+index a790d5cf6ea37..684e8ae00d160 100644
+--- a/arch/powerpc/include/asm/kvm_asm.h
++++ b/arch/powerpc/include/asm/kvm_asm.h
+@@ -163,4 +163,7 @@
+
+ #define KVM_INST_FETCH_FAILED -1
+
++/* Extract PO and XOP opcode fields */
++#define PO_XOP_OPCODE_MASK 0xfc0007fe
++
+ #endif /* __POWERPC_KVM_ASM_H__ */
+diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
+index fe3c6f3bd3b62..d123cba0992d0 100644
+--- a/arch/powerpc/kernel/eeh.c
++++ b/arch/powerpc/kernel/eeh.c
+@@ -502,7 +502,7 @@ int eeh_dev_check_failure(struct eeh_dev *edev)
+ rc = 1;
+ if (pe->state & EEH_PE_ISOLATED) {
+ pe->check_count++;
+- if (pe->check_count % EEH_MAX_FAILS == 0) {
++ if (pe->check_count == EEH_MAX_FAILS) {
+ dn = pci_device_to_OF_node(dev);
+ if (dn)
+ location = of_get_property(dn, "ibm,loc-code",
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index d5f351f02c153..7781f0168ce8c 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -430,11 +430,11 @@ out:
+ #ifdef CONFIG_PPC_BOOK3S_64
+ BUG_ON(get_paca()->in_nmi == 0);
+ if (get_paca()->in_nmi > 1)
+- nmi_panic(regs, "Unrecoverable nested System Reset");
++ die("Unrecoverable nested System Reset", regs, SIGABRT);
+ #endif
+ /* Must die if the interrupt is not recoverable */
+ if (!(regs->msr & MSR_RI))
+- nmi_panic(regs, "Unrecoverable System Reset");
++ die("Unrecoverable System Reset", regs, SIGABRT);
+
+ if (!nested)
+ nmi_exit();
+@@ -775,7 +775,7 @@ void machine_check_exception(struct pt_regs *regs)
+
+ /* Must die if the interrupt is not recoverable */
+ if (!(regs->msr & MSR_RI))
+- nmi_panic(regs, "Unrecoverable Machine check");
++ die("Unrecoverable Machine check", regs, SIGBUS);
+
+ return;
+
+diff --git a/arch/powerpc/kvm/book3s_hv_tm.c b/arch/powerpc/kvm/book3s_hv_tm.c
+index 31cd0f327c8a2..e7fd60cf97804 100644
+--- a/arch/powerpc/kvm/book3s_hv_tm.c
++++ b/arch/powerpc/kvm/book3s_hv_tm.c
+@@ -6,6 +6,8 @@
+ * published by the Free Software Foundation.
+ */
+
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
+ #include <linux/kvm_host.h>
+
+ #include <asm/kvm_ppc.h>
+@@ -47,7 +49,18 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ u64 newmsr, bescr;
+ int ra, rs;
+
+- switch (instr & 0xfc0007ff) {
++ /*
++ * rfid, rfebb, and mtmsrd encode bit 31 = 0 since it's a reserved bit
++ * in these instructions, so masking bit 31 out doesn't change these
++ * instructions. For treclaim., tsr., and trechkpt. instructions if bit
++ * 31 = 0 then they are per ISA invalid forms, however P9 UM, in section
++ * 4.6.10 Book II Invalid Forms, informs specifically that ignoring bit
++ * 31 is an acceptable way to handle these invalid forms that have
++ * bit 31 = 0. Moreover, for emulation purposes both forms (w/ and wo/
++ * bit 31 set) can generate a softpatch interrupt. Hence both forms
++ * are handled below for these instructions so they behave the same way.
++ */
++ switch (instr & PO_XOP_OPCODE_MASK) {
+ case PPC_INST_RFID:
+ /* XXX do we need to check for PR=0 here? */
+ newmsr = vcpu->arch.shregs.srr1;
+@@ -108,7 +121,8 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ vcpu->arch.shregs.msr = newmsr;
+ return RESUME_GUEST;
+
+- case PPC_INST_TSR:
++ /* ignore bit 31, see comment above */
++ case (PPC_INST_TSR & PO_XOP_OPCODE_MASK):
+ /* check for PR=1 and arch 2.06 bit set in PCR */
+ if ((msr & MSR_PR) && (vcpu->arch.vcore->pcr & PCR_ARCH_206)) {
+ /* generate an illegal instruction interrupt */
+@@ -143,7 +157,8 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ vcpu->arch.shregs.msr = msr;
+ return RESUME_GUEST;
+
+- case PPC_INST_TRECLAIM:
++ /* ignore bit 31, see comment above */
++ case (PPC_INST_TRECLAIM & PO_XOP_OPCODE_MASK):
+ /* check for TM disabled in the HFSCR or MSR */
+ if (!(vcpu->arch.hfscr & HFSCR_TM)) {
+ /* generate an illegal instruction interrupt */
+@@ -179,7 +194,8 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ vcpu->arch.shregs.msr &= ~MSR_TS_MASK;
+ return RESUME_GUEST;
+
+- case PPC_INST_TRECHKPT:
++ /* ignore bit 31, see comment above */
++ case (PPC_INST_TRECHKPT & PO_XOP_OPCODE_MASK):
+ /* XXX do we need to check for PR=0 here? */
+ /* check for TM disabled in the HFSCR or MSR */
+ if (!(vcpu->arch.hfscr & HFSCR_TM)) {
+@@ -211,6 +227,8 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ }
+
+ /* What should we do here? We didn't recognize the instruction */
+- WARN_ON_ONCE(1);
++ kvmppc_core_queue_program(vcpu, SRR1_PROGILL);
++ pr_warn_ratelimited("Unrecognized TM-related instruction %#x for emulation", instr);
++
+ return RESUME_GUEST;
+ }
+diff --git a/arch/powerpc/kvm/book3s_hv_tm_builtin.c b/arch/powerpc/kvm/book3s_hv_tm_builtin.c
+index 3cf5863bc06e8..3c7ca2fa19597 100644
+--- a/arch/powerpc/kvm/book3s_hv_tm_builtin.c
++++ b/arch/powerpc/kvm/book3s_hv_tm_builtin.c
+@@ -26,7 +26,18 @@ int kvmhv_p9_tm_emulation_early(struct kvm_vcpu *vcpu)
+ u64 newmsr, msr, bescr;
+ int rs;
+
+- switch (instr & 0xfc0007ff) {
++ /*
++ * rfid, rfebb, and mtmsrd encode bit 31 = 0 since it's a reserved bit
++ * in these instructions, so masking bit 31 out doesn't change these
++ * instructions. For the tsr. instruction if bit 31 = 0 then it is per
++ * ISA an invalid form, however P9 UM, in section 4.6.10 Book II Invalid
++ * Forms, informs specifically that ignoring bit 31 is an acceptable way
++ * to handle TM-related invalid forms that have bit 31 = 0. Moreover,
++ * for emulation purposes both forms (w/ and wo/ bit 31 set) can
++ * generate a softpatch interrupt. Hence both forms are handled below
++ * for tsr. to make them behave the same way.
++ */
++ switch (instr & PO_XOP_OPCODE_MASK) {
+ case PPC_INST_RFID:
+ /* XXX do we need to check for PR=0 here? */
+ newmsr = vcpu->arch.shregs.srr1;
+@@ -76,7 +87,8 @@ int kvmhv_p9_tm_emulation_early(struct kvm_vcpu *vcpu)
+ vcpu->arch.shregs.msr = newmsr;
+ return 1;
+
+- case PPC_INST_TSR:
++ /* ignore bit 31, see comment above */
++ case (PPC_INST_TSR & PO_XOP_OPCODE_MASK):
+ /* we know the MSR has the TS field = S (0b01) here */
+ msr = vcpu->arch.shregs.msr;
+ /* check for PR=1 and arch 2.06 bit set in PCR */
+diff --git a/arch/riscv/include/asm/ftrace.h b/arch/riscv/include/asm/ftrace.h
+index c6dcc5291f972..02fbc175142e2 100644
+--- a/arch/riscv/include/asm/ftrace.h
++++ b/arch/riscv/include/asm/ftrace.h
+@@ -63,4 +63,11 @@ do { \
+ * Let auipc+jalr be the basic *mcount unit*, so we make it 8 bytes here.
+ */
+ #define MCOUNT_INSN_SIZE 8
++
++#ifndef __ASSEMBLY__
++struct dyn_ftrace;
++int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec);
++#define ftrace_init_nop ftrace_init_nop
++#endif
++
+ #endif
+diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c
+index 6d39f64e4dce4..fa8530f05ed4f 100644
+--- a/arch/riscv/kernel/ftrace.c
++++ b/arch/riscv/kernel/ftrace.c
+@@ -88,6 +88,25 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
+ return __ftrace_modify_call(rec->ip, addr, false);
+ }
+
++
++/*
++ * This is called early on, and isn't wrapped by
++ * ftrace_arch_code_modify_{prepare,post_process}() and therefor doesn't hold
++ * text_mutex, which triggers a lockdep failure. SMP isn't running so we could
++ * just directly poke the text, but it's simpler to just take the lock
++ * ourselves.
++ */
++int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
++{
++ int out;
++
++ ftrace_arch_code_modify_prepare();
++ out = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
++ ftrace_arch_code_modify_post_process();
++
++ return out;
++}
++
+ int ftrace_update_ftrace_func(ftrace_func_t func)
+ {
+ int ret = __ftrace_modify_call((unsigned long)&ftrace_call,
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index 74a296cea21cc..0e6d01225a670 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -1377,8 +1377,8 @@ static int aux_output_begin(struct perf_output_handle *handle,
+ idx = aux->empty_mark + 1;
+ for (i = 0; i < range_scan; i++, idx++) {
+ te = aux_sdb_trailer(aux, idx);
+- te->flags = te->flags & ~SDB_TE_BUFFER_FULL_MASK;
+- te->flags = te->flags & ~SDB_TE_ALERT_REQ_MASK;
++ te->flags &= ~(SDB_TE_BUFFER_FULL_MASK |
++ SDB_TE_ALERT_REQ_MASK);
+ te->overflow = 0;
+ }
+ /* Save the position of empty SDBs */
+@@ -1425,8 +1425,7 @@ static bool aux_set_alert(struct aux_buffer *aux, unsigned long alert_index,
+ te = aux_sdb_trailer(aux, alert_index);
+ do {
+ orig_flags = te->flags;
+- orig_overflow = te->overflow;
+- *overflow = orig_overflow;
++ *overflow = orig_overflow = te->overflow;
+ if (orig_flags & SDB_TE_BUFFER_FULL_MASK) {
+ /*
+ * SDB is already set by hardware.
+@@ -1660,7 +1659,7 @@ static void *aux_buffer_setup(struct perf_event *event, void **pages,
+ }
+
+ /* Allocate aux_buffer struct for the event */
+- aux = kmalloc(sizeof(struct aux_buffer), GFP_KERNEL);
++ aux = kzalloc(sizeof(struct aux_buffer), GFP_KERNEL);
+ if (!aux)
+ goto no_aux;
+ sfb = &aux->sfb;
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 5f85e0dfa66d1..4bda9055daefa 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -537,7 +537,7 @@ static struct notifier_block kdump_mem_nb = {
+ /*
+ * Make sure that the area behind memory_end is protected
+ */
+-static void reserve_memory_end(void)
++static void __init reserve_memory_end(void)
+ {
+ #ifdef CONFIG_CRASH_DUMP
+ if (ipl_info.type == IPL_TYPE_FCP_DUMP &&
+@@ -555,7 +555,7 @@ static void reserve_memory_end(void)
+ /*
+ * Make sure that oldmem, where the dump is stored, is protected
+ */
+-static void reserve_oldmem(void)
++static void __init reserve_oldmem(void)
+ {
+ #ifdef CONFIG_CRASH_DUMP
+ if (OLDMEM_BASE)
+@@ -567,7 +567,7 @@ static void reserve_oldmem(void)
+ /*
+ * Make sure that oldmem, where the dump is stored, is protected
+ */
+-static void remove_oldmem(void)
++static void __init remove_oldmem(void)
+ {
+ #ifdef CONFIG_CRASH_DUMP
+ if (OLDMEM_BASE)
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index e3f70c60e8ccd..62f9903544b59 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -330,7 +330,7 @@ DECLARE_STATIC_KEY_FALSE(mds_idle_clear);
+ * combination with microcode which triggers a CPU buffer flush when the
+ * instruction is executed.
+ */
+-static inline void mds_clear_cpu_buffers(void)
++static __always_inline void mds_clear_cpu_buffers(void)
+ {
+ static const u16 ds = __KERNEL_DS;
+
+@@ -351,7 +351,7 @@ static inline void mds_clear_cpu_buffers(void)
+ *
+ * Clear CPU buffers if the corresponding static key is enabled
+ */
+-static inline void mds_user_clear_cpu_buffers(void)
++static __always_inline void mds_user_clear_cpu_buffers(void)
+ {
+ if (static_branch_likely(&mds_user_clear))
+ mds_clear_cpu_buffers();
+diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h
+index 19b137f1b3beb..2ff9b98812b76 100644
+--- a/arch/x86/include/asm/pkeys.h
++++ b/arch/x86/include/asm/pkeys.h
+@@ -4,6 +4,11 @@
+
+ #define ARCH_DEFAULT_PKEY 0
+
++/*
++ * If more than 16 keys are ever supported, a thorough audit
++ * will be necessary to ensure that the types that store key
++ * numbers and masks have sufficient capacity.
++ */
+ #define arch_max_pkey() (boot_cpu_has(X86_FEATURE_OSPKE) ? 16 : 1)
+
+ extern int arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 95e21c4380124..15234885e60bc 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2250,6 +2250,7 @@ static inline void __init check_timer(void)
+ legacy_pic->init(0);
+ legacy_pic->make_irq(0);
+ apic_write(APIC_LVT0, APIC_DM_EXTINT);
++ legacy_pic->unmask(0);
+
+ unlock_ExtINT_logic();
+
+diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
+index 4b900035f2202..601a5da1d196a 100644
+--- a/arch/x86/kernel/fpu/xstate.c
++++ b/arch/x86/kernel/fpu/xstate.c
+@@ -907,8 +907,6 @@ const void *get_xsave_field_ptr(int xsave_state)
+
+ #ifdef CONFIG_ARCH_HAS_PKEYS
+
+-#define NR_VALID_PKRU_BITS (CONFIG_NR_PROTECTION_KEYS * 2)
+-#define PKRU_VALID_MASK (NR_VALID_PKRU_BITS - 1)
+ /*
+ * This will go out and modify PKRU register to set the access
+ * rights for @pkey to @init_val.
+@@ -927,6 +925,13 @@ int arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
+ if (!boot_cpu_has(X86_FEATURE_OSPKE))
+ return -EINVAL;
+
++ /*
++ * This code should only be called with valid 'pkey'
++ * values originating from in-kernel users. Complain
++ * if a bad value is observed.
++ */
++ WARN_ON_ONCE(pkey >= arch_max_pkey());
++
+ /* Set the bits we need in PKRU: */
+ if (init_val & PKEY_DISABLE_ACCESS)
+ new_pkru_bits |= PKRU_AD_BIT;
+diff --git a/arch/x86/kvm/mmutrace.h b/arch/x86/kvm/mmutrace.h
+index cb41b036eb264..7e0dc8c7da2c0 100644
+--- a/arch/x86/kvm/mmutrace.h
++++ b/arch/x86/kvm/mmutrace.h
+@@ -339,7 +339,7 @@ TRACE_EVENT(
+ /* These depend on page entry type, so compute them now. */
+ __field(bool, r)
+ __field(bool, x)
+- __field(u8, u)
++ __field(signed char, u)
+ ),
+
+ TP_fast_assign(
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 2aafb6c791345..cb09a0ec87500 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3942,6 +3942,12 @@ static int iret_interception(struct vcpu_svm *svm)
+ return 1;
+ }
+
++static int invd_interception(struct vcpu_svm *svm)
++{
++ /* Treat an INVD instruction as a NOP and just skip it. */
++ return kvm_skip_emulated_instruction(&svm->vcpu);
++}
++
+ static int invlpg_interception(struct vcpu_svm *svm)
+ {
+ if (!static_cpu_has(X86_FEATURE_DECODEASSISTS))
+@@ -4831,7 +4837,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
+ [SVM_EXIT_RDPMC] = rdpmc_interception,
+ [SVM_EXIT_CPUID] = cpuid_interception,
+ [SVM_EXIT_IRET] = iret_interception,
+- [SVM_EXIT_INVD] = emulate_on_interception,
++ [SVM_EXIT_INVD] = invd_interception,
+ [SVM_EXIT_PAUSE] = pause_interception,
+ [SVM_EXIT_HLT] = halt_interception,
+ [SVM_EXIT_INVLPG] = invlpg_interception,
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 430a4bc66f604..dd182228be714 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -858,6 +858,7 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ unsigned long old_cr4 = kvm_read_cr4(vcpu);
+ unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE |
+ X86_CR4_SMEP;
++ unsigned long mmu_role_bits = pdptr_bits | X86_CR4_SMAP | X86_CR4_PKE;
+
+ if (kvm_valid_cr4(vcpu, cr4))
+ return 1;
+@@ -885,7 +886,7 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ if (kvm_x86_ops->set_cr4(vcpu, cr4))
+ return 1;
+
+- if (((cr4 ^ old_cr4) & pdptr_bits) ||
++ if (((cr4 ^ old_cr4) & mmu_role_bits) ||
+ (!(cr4 & X86_CR4_PCIDE) && (old_cr4 & X86_CR4_PCIDE)))
+ kvm_mmu_reset_context(vcpu);
+
+@@ -4668,10 +4669,13 @@ set_identity_unlock:
+ r = -EFAULT;
+ if (copy_from_user(&u.ps, argp, sizeof u.ps))
+ goto out;
++ mutex_lock(&kvm->lock);
+ r = -ENXIO;
+ if (!kvm->arch.vpit)
+- goto out;
++ goto set_pit_out;
+ r = kvm_vm_ioctl_set_pit(kvm, &u.ps);
++set_pit_out:
++ mutex_unlock(&kvm->lock);
+ break;
+ }
+ case KVM_GET_PIT2: {
+@@ -4691,10 +4695,13 @@ set_identity_unlock:
+ r = -EFAULT;
+ if (copy_from_user(&u.ps2, argp, sizeof(u.ps2)))
+ goto out;
++ mutex_lock(&kvm->lock);
+ r = -ENXIO;
+ if (!kvm->arch.vpit)
+- goto out;
++ goto set_pit2_out;
+ r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2);
++set_pit2_out:
++ mutex_unlock(&kvm->lock);
+ break;
+ }
+ case KVM_REINJECT_CONTROL: {
+diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
+index 7077b3e282414..40dbbd8f1fe41 100644
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -139,7 +139,7 @@ long __copy_user_flushcache(void *dst, const void __user *src, unsigned size)
+ */
+ if (size < 8) {
+ if (!IS_ALIGNED(dest, 4) || size != 4)
+- clean_cache_range(dst, 1);
++ clean_cache_range(dst, size);
+ } else {
+ if (!IS_ALIGNED(dest, 8)) {
+ dest = ALIGN(dest, boot_cpu_data.x86_clflush_size);
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 49e16f0090957..9415a0041aaf7 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -1080,29 +1080,21 @@ void acpi_ec_dispatch_gpe(void)
+ /* --------------------------------------------------------------------------
+ Event Management
+ -------------------------------------------------------------------------- */
+-static struct acpi_ec_query_handler *
+-acpi_ec_get_query_handler(struct acpi_ec_query_handler *handler)
+-{
+- if (handler)
+- kref_get(&handler->kref);
+- return handler;
+-}
+-
+ static struct acpi_ec_query_handler *
+ acpi_ec_get_query_handler_by_value(struct acpi_ec *ec, u8 value)
+ {
+ struct acpi_ec_query_handler *handler;
+- bool found = false;
+
+ mutex_lock(&ec->mutex);
+ list_for_each_entry(handler, &ec->list, node) {
+ if (value == handler->query_bit) {
+- found = true;
+- break;
++ kref_get(&handler->kref);
++ mutex_unlock(&ec->mutex);
++ return handler;
+ }
+ }
+ mutex_unlock(&ec->mutex);
+- return found ? acpi_ec_get_query_handler(handler) : NULL;
++ return NULL;
+ }
+
+ static void acpi_ec_query_handler_release(struct kref *kref)
+diff --git a/drivers/ata/acard-ahci.c b/drivers/ata/acard-ahci.c
+index 583e366be7e23..505f8c3168188 100644
+--- a/drivers/ata/acard-ahci.c
++++ b/drivers/ata/acard-ahci.c
+@@ -72,7 +72,7 @@ struct acard_sg {
+ __le32 size; /* bit 31 (EOT) max==0x10000 (64k) */
+ };
+
+-static void acard_ahci_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors acard_ahci_qc_prep(struct ata_queued_cmd *qc);
+ static bool acard_ahci_qc_fill_rtf(struct ata_queued_cmd *qc);
+ static int acard_ahci_port_start(struct ata_port *ap);
+ static int acard_ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+@@ -257,7 +257,7 @@ static unsigned int acard_ahci_fill_sg(struct ata_queued_cmd *qc, void *cmd_tbl)
+ return si;
+ }
+
+-static void acard_ahci_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors acard_ahci_qc_prep(struct ata_queued_cmd *qc)
+ {
+ struct ata_port *ap = qc->ap;
+ struct ahci_port_priv *pp = ap->private_data;
+@@ -295,6 +295,8 @@ static void acard_ahci_qc_prep(struct ata_queued_cmd *qc)
+ opts |= AHCI_CMD_ATAPI | AHCI_CMD_PREFETCH;
+
+ ahci_fill_cmd_slot(pp, qc->hw_tag, opts);
++
++ return AC_ERR_OK;
+ }
+
+ static bool acard_ahci_qc_fill_rtf(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 2bdb250a2142c..f1153e7ba3b3a 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -73,7 +73,7 @@ static int ahci_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
+ static bool ahci_qc_fill_rtf(struct ata_queued_cmd *qc);
+ static int ahci_port_start(struct ata_port *ap);
+ static void ahci_port_stop(struct ata_port *ap);
+-static void ahci_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors ahci_qc_prep(struct ata_queued_cmd *qc);
+ static int ahci_pmp_qc_defer(struct ata_queued_cmd *qc);
+ static void ahci_freeze(struct ata_port *ap);
+ static void ahci_thaw(struct ata_port *ap);
+@@ -1640,7 +1640,7 @@ static int ahci_pmp_qc_defer(struct ata_queued_cmd *qc)
+ return sata_pmp_qc_defer_cmd_switch(qc);
+ }
+
+-static void ahci_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors ahci_qc_prep(struct ata_queued_cmd *qc)
+ {
+ struct ata_port *ap = qc->ap;
+ struct ahci_port_priv *pp = ap->private_data;
+@@ -1676,6 +1676,8 @@ static void ahci_qc_prep(struct ata_queued_cmd *qc)
+ opts |= AHCI_CMD_ATAPI | AHCI_CMD_PREFETCH;
+
+ ahci_fill_cmd_slot(pp, qc->hw_tag, opts);
++
++ return AC_ERR_OK;
+ }
+
+ static void ahci_fbs_dec_intr(struct ata_port *ap)
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index fead7243930c0..db1d86af21b4d 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4996,7 +4996,10 @@ int ata_std_qc_defer(struct ata_queued_cmd *qc)
+ return ATA_DEFER_LINK;
+ }
+
+-void ata_noop_qc_prep(struct ata_queued_cmd *qc) { }
++enum ata_completion_errors ata_noop_qc_prep(struct ata_queued_cmd *qc)
++{
++ return AC_ERR_OK;
++}
+
+ /**
+ * ata_sg_init - Associate command with scatter-gather table.
+@@ -5483,7 +5486,9 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
+ return;
+ }
+
+- ap->ops->qc_prep(qc);
++ qc->err_mask |= ap->ops->qc_prep(qc);
++ if (unlikely(qc->err_mask))
++ goto err;
+ trace_ata_qc_issue(qc);
+ qc->err_mask |= ap->ops->qc_issue(qc);
+ if (unlikely(qc->err_mask))
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index 873cc09060551..7484ffdabd543 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -2695,12 +2695,14 @@ static void ata_bmdma_fill_sg_dumb(struct ata_queued_cmd *qc)
+ * LOCKING:
+ * spin_lock_irqsave(host lock)
+ */
+-void ata_bmdma_qc_prep(struct ata_queued_cmd *qc)
++enum ata_completion_errors ata_bmdma_qc_prep(struct ata_queued_cmd *qc)
+ {
+ if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+- return;
++ return AC_ERR_OK;
+
+ ata_bmdma_fill_sg(qc);
++
++ return AC_ERR_OK;
+ }
+ EXPORT_SYMBOL_GPL(ata_bmdma_qc_prep);
+
+@@ -2713,12 +2715,14 @@ EXPORT_SYMBOL_GPL(ata_bmdma_qc_prep);
+ * LOCKING:
+ * spin_lock_irqsave(host lock)
+ */
+-void ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc)
++enum ata_completion_errors ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc)
+ {
+ if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+- return;
++ return AC_ERR_OK;
+
+ ata_bmdma_fill_sg_dumb(qc);
++
++ return AC_ERR_OK;
+ }
+ EXPORT_SYMBOL_GPL(ata_bmdma_dumb_qc_prep);
+
+diff --git a/drivers/ata/pata_macio.c b/drivers/ata/pata_macio.c
+index 9588e685d994c..765b99319d3cd 100644
+--- a/drivers/ata/pata_macio.c
++++ b/drivers/ata/pata_macio.c
+@@ -507,7 +507,7 @@ static int pata_macio_cable_detect(struct ata_port *ap)
+ return ATA_CBL_PATA40;
+ }
+
+-static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pata_macio_qc_prep(struct ata_queued_cmd *qc)
+ {
+ unsigned int write = (qc->tf.flags & ATA_TFLAG_WRITE);
+ struct ata_port *ap = qc->ap;
+@@ -520,7 +520,7 @@ static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
+ __func__, qc, qc->flags, write, qc->dev->devno);
+
+ if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+- return;
++ return AC_ERR_OK;
+
+ table = (struct dbdma_cmd *) priv->dma_table_cpu;
+
+@@ -565,6 +565,8 @@ static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
+ table->command = cpu_to_le16(DBDMA_STOP);
+
+ dev_dbgdma(priv->dev, "%s: %d DMA list entries\n", __func__, pi);
++
++ return AC_ERR_OK;
+ }
+
+
+diff --git a/drivers/ata/pata_pxa.c b/drivers/ata/pata_pxa.c
+index e8b6a2e464c98..5b1458ca986b6 100644
+--- a/drivers/ata/pata_pxa.c
++++ b/drivers/ata/pata_pxa.c
+@@ -58,25 +58,27 @@ static void pxa_ata_dma_irq(void *d)
+ /*
+ * Prepare taskfile for submission.
+ */
+-static void pxa_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pxa_qc_prep(struct ata_queued_cmd *qc)
+ {
+ struct pata_pxa_data *pd = qc->ap->private_data;
+ struct dma_async_tx_descriptor *tx;
+ enum dma_transfer_direction dir;
+
+ if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+- return;
++ return AC_ERR_OK;
+
+ dir = (qc->dma_dir == DMA_TO_DEVICE ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM);
+ tx = dmaengine_prep_slave_sg(pd->dma_chan, qc->sg, qc->n_elem, dir,
+ DMA_PREP_INTERRUPT);
+ if (!tx) {
+ ata_dev_err(qc->dev, "prep_slave_sg() failed\n");
+- return;
++ return AC_ERR_OK;
+ }
+ tx->callback = pxa_ata_dma_irq;
+ tx->callback_param = pd;
+ pd->dma_cookie = dmaengine_submit(tx);
++
++ return AC_ERR_OK;
+ }
+
+ /*
+diff --git a/drivers/ata/pdc_adma.c b/drivers/ata/pdc_adma.c
+index f1e873a37465e..096b4771b19da 100644
+--- a/drivers/ata/pdc_adma.c
++++ b/drivers/ata/pdc_adma.c
+@@ -132,7 +132,7 @@ static int adma_ata_init_one(struct pci_dev *pdev,
+ const struct pci_device_id *ent);
+ static int adma_port_start(struct ata_port *ap);
+ static void adma_port_stop(struct ata_port *ap);
+-static void adma_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors adma_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int adma_qc_issue(struct ata_queued_cmd *qc);
+ static int adma_check_atapi_dma(struct ata_queued_cmd *qc);
+ static void adma_freeze(struct ata_port *ap);
+@@ -311,7 +311,7 @@ static int adma_fill_sg(struct ata_queued_cmd *qc)
+ return i;
+ }
+
+-static void adma_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors adma_qc_prep(struct ata_queued_cmd *qc)
+ {
+ struct adma_port_priv *pp = qc->ap->private_data;
+ u8 *buf = pp->pkt;
+@@ -322,7 +322,7 @@ static void adma_qc_prep(struct ata_queued_cmd *qc)
+
+ adma_enter_reg_mode(qc->ap);
+ if (qc->tf.protocol != ATA_PROT_DMA)
+- return;
++ return AC_ERR_OK;
+
+ buf[i++] = 0; /* Response flags */
+ buf[i++] = 0; /* reserved */
+@@ -387,6 +387,7 @@ static void adma_qc_prep(struct ata_queued_cmd *qc)
+ printk("%s\n", obuf);
+ }
+ #endif
++ return AC_ERR_OK;
+ }
+
+ static inline void adma_packet_start(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
+index ae52a45fab5f7..8b3be0ff91cb4 100644
+--- a/drivers/ata/sata_fsl.c
++++ b/drivers/ata/sata_fsl.c
+@@ -507,7 +507,7 @@ static unsigned int sata_fsl_fill_sg(struct ata_queued_cmd *qc, void *cmd_desc,
+ return num_prde;
+ }
+
+-static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sata_fsl_qc_prep(struct ata_queued_cmd *qc)
+ {
+ struct ata_port *ap = qc->ap;
+ struct sata_fsl_port_priv *pp = ap->private_data;
+@@ -553,6 +553,8 @@ static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
+
+ VPRINTK("SATA FSL : xx_qc_prep, di = 0x%x, ttl = %d, num_prde = %d\n",
+ desc_info, ttl_dwords, num_prde);
++
++ return AC_ERR_OK;
+ }
+
+ static unsigned int sata_fsl_qc_issue(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
+index 9b6d7930d1c79..6c7ddc037fce9 100644
+--- a/drivers/ata/sata_inic162x.c
++++ b/drivers/ata/sata_inic162x.c
+@@ -472,7 +472,7 @@ static void inic_fill_sg(struct inic_prd *prd, struct ata_queued_cmd *qc)
+ prd[-1].flags |= PRD_END;
+ }
+
+-static void inic_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors inic_qc_prep(struct ata_queued_cmd *qc)
+ {
+ struct inic_port_priv *pp = qc->ap->private_data;
+ struct inic_pkt *pkt = pp->pkt;
+@@ -532,6 +532,8 @@ static void inic_qc_prep(struct ata_queued_cmd *qc)
+ inic_fill_sg(prd, qc);
+
+ pp->cpb_tbl[0] = pp->pkt_dma;
++
++ return AC_ERR_OK;
+ }
+
+ static unsigned int inic_qc_issue(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index ab2e9f62ddc1a..2910b22fac117 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -605,8 +605,8 @@ static int mv5_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val)
+ static int mv_port_start(struct ata_port *ap);
+ static void mv_port_stop(struct ata_port *ap);
+ static int mv_qc_defer(struct ata_queued_cmd *qc);
+-static void mv_qc_prep(struct ata_queued_cmd *qc);
+-static void mv_qc_prep_iie(struct ata_queued_cmd *qc);
++static enum ata_completion_errors mv_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors mv_qc_prep_iie(struct ata_queued_cmd *qc);
+ static unsigned int mv_qc_issue(struct ata_queued_cmd *qc);
+ static int mv_hardreset(struct ata_link *link, unsigned int *class,
+ unsigned long deadline);
+@@ -2044,7 +2044,7 @@ static void mv_rw_multi_errata_sata24(struct ata_queued_cmd *qc)
+ * LOCKING:
+ * Inherited from caller.
+ */
+-static void mv_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors mv_qc_prep(struct ata_queued_cmd *qc)
+ {
+ struct ata_port *ap = qc->ap;
+ struct mv_port_priv *pp = ap->private_data;
+@@ -2056,15 +2056,15 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+ switch (tf->protocol) {
+ case ATA_PROT_DMA:
+ if (tf->command == ATA_CMD_DSM)
+- return;
++ return AC_ERR_OK;
+ /* fall-thru */
+ case ATA_PROT_NCQ:
+ break; /* continue below */
+ case ATA_PROT_PIO:
+ mv_rw_multi_errata_sata24(qc);
+- return;
++ return AC_ERR_OK;
+ default:
+- return;
++ return AC_ERR_OK;
+ }
+
+ /* Fill in command request block
+@@ -2111,12 +2111,10 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+ * non-NCQ mode are: [RW] STREAM DMA and W DMA FUA EXT, none
+ * of which are defined/used by Linux. If we get here, this
+ * driver needs work.
+- *
+- * FIXME: modify libata to give qc_prep a return value and
+- * return error here.
+ */
+- BUG_ON(tf->command);
+- break;
++ ata_port_err(ap, "%s: unsupported command: %.2x\n", __func__,
++ tf->command);
++ return AC_ERR_INVALID;
+ }
+ mv_crqb_pack_cmd(cw++, tf->nsect, ATA_REG_NSECT, 0);
+ mv_crqb_pack_cmd(cw++, tf->hob_lbal, ATA_REG_LBAL, 0);
+@@ -2129,8 +2127,10 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+ mv_crqb_pack_cmd(cw++, tf->command, ATA_REG_CMD, 1); /* last */
+
+ if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+- return;
++ return AC_ERR_OK;
+ mv_fill_sg(qc);
++
++ return AC_ERR_OK;
+ }
+
+ /**
+@@ -2145,7 +2145,7 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+ * LOCKING:
+ * Inherited from caller.
+ */
+-static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
++static enum ata_completion_errors mv_qc_prep_iie(struct ata_queued_cmd *qc)
+ {
+ struct ata_port *ap = qc->ap;
+ struct mv_port_priv *pp = ap->private_data;
+@@ -2156,9 +2156,9 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
+
+ if ((tf->protocol != ATA_PROT_DMA) &&
+ (tf->protocol != ATA_PROT_NCQ))
+- return;
++ return AC_ERR_OK;
+ if (tf->command == ATA_CMD_DSM)
+- return; /* use bmdma for this */
++ return AC_ERR_OK; /* use bmdma for this */
+
+ /* Fill in Gen IIE command request block */
+ if (!(tf->flags & ATA_TFLAG_WRITE))
+@@ -2199,8 +2199,10 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
+ );
+
+ if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+- return;
++ return AC_ERR_OK;
+ mv_fill_sg(qc);
++
++ return AC_ERR_OK;
+ }
+
+ /**
+diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
+index 761577d57ff37..798d549435cc1 100644
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -313,7 +313,7 @@ static void nv_ck804_freeze(struct ata_port *ap);
+ static void nv_ck804_thaw(struct ata_port *ap);
+ static int nv_adma_slave_config(struct scsi_device *sdev);
+ static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc);
+-static void nv_adma_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors nv_adma_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int nv_adma_qc_issue(struct ata_queued_cmd *qc);
+ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance);
+ static void nv_adma_irq_clear(struct ata_port *ap);
+@@ -335,7 +335,7 @@ static void nv_mcp55_freeze(struct ata_port *ap);
+ static void nv_swncq_error_handler(struct ata_port *ap);
+ static int nv_swncq_slave_config(struct scsi_device *sdev);
+ static int nv_swncq_port_start(struct ata_port *ap);
+-static void nv_swncq_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors nv_swncq_qc_prep(struct ata_queued_cmd *qc);
+ static void nv_swncq_fill_sg(struct ata_queued_cmd *qc);
+ static unsigned int nv_swncq_qc_issue(struct ata_queued_cmd *qc);
+ static void nv_swncq_irq_clear(struct ata_port *ap, u16 fis);
+@@ -1365,7 +1365,7 @@ static int nv_adma_use_reg_mode(struct ata_queued_cmd *qc)
+ return 1;
+ }
+
+-static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors nv_adma_qc_prep(struct ata_queued_cmd *qc)
+ {
+ struct nv_adma_port_priv *pp = qc->ap->private_data;
+ struct nv_adma_cpb *cpb = &pp->cpb[qc->hw_tag];
+@@ -1377,7 +1377,7 @@ static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
+ (qc->flags & ATA_QCFLAG_DMAMAP));
+ nv_adma_register_mode(qc->ap);
+ ata_bmdma_qc_prep(qc);
+- return;
++ return AC_ERR_OK;
+ }
+
+ cpb->resp_flags = NV_CPB_RESP_DONE;
+@@ -1409,6 +1409,8 @@ static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
+ cpb->ctl_flags = ctl_flags;
+ wmb();
+ cpb->resp_flags = 0;
++
++ return AC_ERR_OK;
+ }
+
+ static unsigned int nv_adma_qc_issue(struct ata_queued_cmd *qc)
+@@ -1972,17 +1974,19 @@ static int nv_swncq_port_start(struct ata_port *ap)
+ return 0;
+ }
+
+-static void nv_swncq_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors nv_swncq_qc_prep(struct ata_queued_cmd *qc)
+ {
+ if (qc->tf.protocol != ATA_PROT_NCQ) {
+ ata_bmdma_qc_prep(qc);
+- return;
++ return AC_ERR_OK;
+ }
+
+ if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+- return;
++ return AC_ERR_OK;
+
+ nv_swncq_fill_sg(qc);
++
++ return AC_ERR_OK;
+ }
+
+ static void nv_swncq_fill_sg(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
+index d032bf657f709..29d2bb465f60d 100644
+--- a/drivers/ata/sata_promise.c
++++ b/drivers/ata/sata_promise.c
+@@ -155,7 +155,7 @@ static int pdc_sata_scr_write(struct ata_link *link, unsigned int sc_reg, u32 va
+ static int pdc_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int pdc_common_port_start(struct ata_port *ap);
+ static int pdc_sata_port_start(struct ata_port *ap);
+-static void pdc_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors pdc_qc_prep(struct ata_queued_cmd *qc);
+ static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static int pdc_check_atapi_dma(struct ata_queued_cmd *qc);
+@@ -649,7 +649,7 @@ static void pdc_fill_sg(struct ata_queued_cmd *qc)
+ prd[idx - 1].flags_len |= cpu_to_le32(ATA_PRD_EOT);
+ }
+
+-static void pdc_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pdc_qc_prep(struct ata_queued_cmd *qc)
+ {
+ struct pdc_port_priv *pp = qc->ap->private_data;
+ unsigned int i;
+@@ -681,6 +681,8 @@ static void pdc_qc_prep(struct ata_queued_cmd *qc)
+ default:
+ break;
+ }
++
++ return AC_ERR_OK;
+ }
+
+ static int pdc_is_sataii_tx4(unsigned long flags)
+diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
+index 1fe941688e95d..a66d10628c183 100644
+--- a/drivers/ata/sata_qstor.c
++++ b/drivers/ata/sata_qstor.c
+@@ -116,7 +116,7 @@ static int qs_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
+ static int qs_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int qs_port_start(struct ata_port *ap);
+ static void qs_host_stop(struct ata_host *host);
+-static void qs_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors qs_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int qs_qc_issue(struct ata_queued_cmd *qc);
+ static int qs_check_atapi_dma(struct ata_queued_cmd *qc);
+ static void qs_freeze(struct ata_port *ap);
+@@ -276,7 +276,7 @@ static unsigned int qs_fill_sg(struct ata_queued_cmd *qc)
+ return si;
+ }
+
+-static void qs_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors qs_qc_prep(struct ata_queued_cmd *qc)
+ {
+ struct qs_port_priv *pp = qc->ap->private_data;
+ u8 dflags = QS_DF_PORD, *buf = pp->pkt;
+@@ -288,7 +288,7 @@ static void qs_qc_prep(struct ata_queued_cmd *qc)
+
+ qs_enter_reg_mode(qc->ap);
+ if (qc->tf.protocol != ATA_PROT_DMA)
+- return;
++ return AC_ERR_OK;
+
+ nelem = qs_fill_sg(qc);
+
+@@ -311,6 +311,8 @@ static void qs_qc_prep(struct ata_queued_cmd *qc)
+
+ /* frame information structure (FIS) */
+ ata_tf_to_fis(&qc->tf, 0, 1, &buf[32]);
++
++ return AC_ERR_OK;
+ }
+
+ static inline void qs_packet_start(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
+index 50ebd779d975f..8323f88d17a53 100644
+--- a/drivers/ata/sata_rcar.c
++++ b/drivers/ata/sata_rcar.c
+@@ -554,12 +554,14 @@ static void sata_rcar_bmdma_fill_sg(struct ata_queued_cmd *qc)
+ prd[si - 1].addr |= cpu_to_le32(SATA_RCAR_DTEND);
+ }
+
+-static void sata_rcar_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sata_rcar_qc_prep(struct ata_queued_cmd *qc)
+ {
+ if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+- return;
++ return AC_ERR_OK;
+
+ sata_rcar_bmdma_fill_sg(qc);
++
++ return AC_ERR_OK;
+ }
+
+ static void sata_rcar_bmdma_setup(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
+index ed76f070d21e4..82adaf02887fb 100644
+--- a/drivers/ata/sata_sil.c
++++ b/drivers/ata/sata_sil.c
+@@ -119,7 +119,7 @@ static void sil_dev_config(struct ata_device *dev);
+ static int sil_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
+ static int sil_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
+ static int sil_set_mode(struct ata_link *link, struct ata_device **r_failed);
+-static void sil_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors sil_qc_prep(struct ata_queued_cmd *qc);
+ static void sil_bmdma_setup(struct ata_queued_cmd *qc);
+ static void sil_bmdma_start(struct ata_queued_cmd *qc);
+ static void sil_bmdma_stop(struct ata_queued_cmd *qc);
+@@ -333,12 +333,14 @@ static void sil_fill_sg(struct ata_queued_cmd *qc)
+ last_prd->flags_len |= cpu_to_le32(ATA_PRD_EOT);
+ }
+
+-static void sil_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sil_qc_prep(struct ata_queued_cmd *qc)
+ {
+ if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+- return;
++ return AC_ERR_OK;
+
+ sil_fill_sg(qc);
++
++ return AC_ERR_OK;
+ }
+
+ static unsigned char sil_get_device_cache_line(struct pci_dev *pdev)
+diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
+index 319f517137cd5..7a8ca81e52bfc 100644
+--- a/drivers/ata/sata_sil24.c
++++ b/drivers/ata/sata_sil24.c
+@@ -336,7 +336,7 @@ static void sil24_dev_config(struct ata_device *dev);
+ static int sil24_scr_read(struct ata_link *link, unsigned sc_reg, u32 *val);
+ static int sil24_scr_write(struct ata_link *link, unsigned sc_reg, u32 val);
+ static int sil24_qc_defer(struct ata_queued_cmd *qc);
+-static void sil24_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors sil24_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc);
+ static bool sil24_qc_fill_rtf(struct ata_queued_cmd *qc);
+ static void sil24_pmp_attach(struct ata_port *ap);
+@@ -840,7 +840,7 @@ static int sil24_qc_defer(struct ata_queued_cmd *qc)
+ return ata_std_qc_defer(qc);
+ }
+
+-static void sil24_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sil24_qc_prep(struct ata_queued_cmd *qc)
+ {
+ struct ata_port *ap = qc->ap;
+ struct sil24_port_priv *pp = ap->private_data;
+@@ -884,6 +884,8 @@ static void sil24_qc_prep(struct ata_queued_cmd *qc)
+
+ if (qc->flags & ATA_QCFLAG_DMAMAP)
+ sil24_fill_sg(qc, sge);
++
++ return AC_ERR_OK;
+ }
+
+ static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
+index 405e606a234d1..0d742457925ec 100644
+--- a/drivers/ata/sata_sx4.c
++++ b/drivers/ata/sata_sx4.c
+@@ -218,7 +218,7 @@ static void pdc_error_handler(struct ata_port *ap);
+ static void pdc_freeze(struct ata_port *ap);
+ static void pdc_thaw(struct ata_port *ap);
+ static int pdc_port_start(struct ata_port *ap);
+-static void pdc20621_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors pdc20621_qc_prep(struct ata_queued_cmd *qc);
+ static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static unsigned int pdc20621_dimm_init(struct ata_host *host);
+@@ -546,7 +546,7 @@ static void pdc20621_nodata_prep(struct ata_queued_cmd *qc)
+ VPRINTK("ata pkt buf ofs %u, mmio copied\n", i);
+ }
+
+-static void pdc20621_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pdc20621_qc_prep(struct ata_queued_cmd *qc)
+ {
+ switch (qc->tf.protocol) {
+ case ATA_PROT_DMA:
+@@ -558,6 +558,8 @@ static void pdc20621_qc_prep(struct ata_queued_cmd *qc)
+ default:
+ break;
+ }
++
++ return AC_ERR_OK;
+ }
+
+ static void __pdc20621_push_hdma(struct ata_queued_cmd *qc,
+diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
+index 7323e9210f4b1..38fec976e62d4 100644
+--- a/drivers/atm/eni.c
++++ b/drivers/atm/eni.c
+@@ -2243,7 +2243,7 @@ static int eni_init_one(struct pci_dev *pci_dev,
+
+ rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(32));
+ if (rc < 0)
+- goto out;
++ goto err_disable;
+
+ rc = -ENOMEM;
+ eni_dev = kmalloc(sizeof(struct eni_dev), GFP_KERNEL);
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index d26b485ccc7d0..e8b3353c18eb8 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -2367,7 +2367,7 @@ int regmap_raw_write_async(struct regmap *map, unsigned int reg,
+ EXPORT_SYMBOL_GPL(regmap_raw_write_async);
+
+ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
+- unsigned int val_len)
++ unsigned int val_len, bool noinc)
+ {
+ struct regmap_range_node *range;
+ int ret;
+@@ -2380,7 +2380,7 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
+ range = _regmap_range_lookup(map, reg);
+ if (range) {
+ ret = _regmap_select_page(map, ®, range,
+- val_len / map->format.val_bytes);
++ noinc ? 1 : val_len / map->format.val_bytes);
+ if (ret != 0)
+ return ret;
+ }
+@@ -2418,7 +2418,7 @@ static int _regmap_bus_read(void *context, unsigned int reg,
+ if (!map->format.parse_val)
+ return -EINVAL;
+
+- ret = _regmap_raw_read(map, reg, work_val, map->format.val_bytes);
++ ret = _regmap_raw_read(map, reg, work_val, map->format.val_bytes, false);
+ if (ret == 0)
+ *val = map->format.parse_val(work_val);
+
+@@ -2536,7 +2536,7 @@ int regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
+
+ /* Read bytes that fit into whole chunks */
+ for (i = 0; i < chunk_count; i++) {
+- ret = _regmap_raw_read(map, reg, val, chunk_bytes);
++ ret = _regmap_raw_read(map, reg, val, chunk_bytes, false);
+ if (ret != 0)
+ goto out;
+
+@@ -2547,7 +2547,7 @@ int regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
+
+ /* Read remaining bytes */
+ if (val_len) {
+- ret = _regmap_raw_read(map, reg, val, val_len);
++ ret = _regmap_raw_read(map, reg, val, val_len, false);
+ if (ret != 0)
+ goto out;
+ }
+@@ -2622,7 +2622,7 @@ int regmap_noinc_read(struct regmap *map, unsigned int reg,
+ read_len = map->max_raw_read;
+ else
+ read_len = val_len;
+- ret = _regmap_raw_read(map, reg, val, read_len);
++ ret = _regmap_raw_read(map, reg, val, read_len, true);
+ if (ret)
+ goto out_unlock;
+ val = ((u8 *)val) + read_len;
+diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
+index 8d1cd2479e36f..cc51395d8b0e5 100644
+--- a/drivers/bluetooth/btrtl.c
++++ b/drivers/bluetooth/btrtl.c
+@@ -343,11 +343,11 @@ static int rtlbt_parse_firmware(struct hci_dev *hdev,
+ * the end.
+ */
+ len = patch_length;
+- buf = kmemdup(btrtl_dev->fw_data + patch_offset, patch_length,
+- GFP_KERNEL);
++ buf = kvmalloc(patch_length, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
++ memcpy(buf, btrtl_dev->fw_data + patch_offset, patch_length - 4);
+ memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4);
+
+ *_buf = buf;
+@@ -415,8 +415,10 @@ static int rtl_load_file(struct hci_dev *hdev, const char *name, u8 **buff)
+ if (ret < 0)
+ return ret;
+ ret = fw->size;
+- *buff = kmemdup(fw->data, ret, GFP_KERNEL);
+- if (!*buff)
++ *buff = kvmalloc(fw->size, GFP_KERNEL);
++ if (*buff)
++ memcpy(*buff, fw->data, ret);
++ else
+ ret = -ENOMEM;
+
+ release_firmware(fw);
+@@ -454,14 +456,14 @@ static int btrtl_setup_rtl8723b(struct hci_dev *hdev,
+ goto out;
+
+ if (btrtl_dev->cfg_len > 0) {
+- tbuff = kzalloc(ret + btrtl_dev->cfg_len, GFP_KERNEL);
++ tbuff = kvzalloc(ret + btrtl_dev->cfg_len, GFP_KERNEL);
+ if (!tbuff) {
+ ret = -ENOMEM;
+ goto out;
+ }
+
+ memcpy(tbuff, fw_data, ret);
+- kfree(fw_data);
++ kvfree(fw_data);
+
+ memcpy(tbuff + ret, btrtl_dev->cfg_data, btrtl_dev->cfg_len);
+ ret += btrtl_dev->cfg_len;
+@@ -474,7 +476,7 @@ static int btrtl_setup_rtl8723b(struct hci_dev *hdev,
+ ret = rtl_download_firmware(hdev, fw_data, ret);
+
+ out:
+- kfree(fw_data);
++ kvfree(fw_data);
+ return ret;
+ }
+
+@@ -501,8 +503,8 @@ static struct sk_buff *btrtl_read_local_version(struct hci_dev *hdev)
+
+ void btrtl_free(struct btrtl_device_info *btrtl_dev)
+ {
+- kfree(btrtl_dev->fw_data);
+- kfree(btrtl_dev->cfg_data);
++ kvfree(btrtl_dev->fw_data);
++ kvfree(btrtl_dev->cfg_data);
+ kfree(btrtl_dev);
+ }
+ EXPORT_SYMBOL_GPL(btrtl_free);
+diff --git a/drivers/bus/hisi_lpc.c b/drivers/bus/hisi_lpc.c
+index e31c02dc77709..cbd970fb02f18 100644
+--- a/drivers/bus/hisi_lpc.c
++++ b/drivers/bus/hisi_lpc.c
+@@ -358,6 +358,26 @@ static int hisi_lpc_acpi_xlat_io_res(struct acpi_device *adev,
+ return 0;
+ }
+
++/*
++ * Released firmware describes the IO port max address as 0x3fff, which is
++ * the max host bus address. Fixup to a proper range. This will probably
++ * never be fixed in firmware.
++ */
++static void hisi_lpc_acpi_fixup_child_resource(struct device *hostdev,
++ struct resource *r)
++{
++ if (r->end != 0x3fff)
++ return;
++
++ if (r->start == 0xe4)
++ r->end = 0xe4 + 0x04 - 1;
++ else if (r->start == 0x2f8)
++ r->end = 0x2f8 + 0x08 - 1;
++ else
++ dev_warn(hostdev, "unrecognised resource %pR to fixup, ignoring\n",
++ r);
++}
++
+ /*
+ * hisi_lpc_acpi_set_io_res - set the resources for a child
+ * @child: the device node to be updated the I/O resource
+@@ -419,8 +439,11 @@ static int hisi_lpc_acpi_set_io_res(struct device *child,
+ return -ENOMEM;
+ }
+ count = 0;
+- list_for_each_entry(rentry, &resource_list, node)
+- resources[count++] = *rentry->res;
++ list_for_each_entry(rentry, &resource_list, node) {
++ resources[count] = *rentry->res;
++ hisi_lpc_acpi_fixup_child_resource(hostdev, &resources[count]);
++ count++;
++ }
+
+ acpi_dev_free_resource_list(&resource_list);
+
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 6a5d4dfafc474..80dedecfe15c5 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1150,14 +1150,14 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
+ * We take into account the first, second and third-order deltas
+ * in order to make our estimate.
+ */
+- delta = sample.jiffies - state->last_time;
+- state->last_time = sample.jiffies;
++ delta = sample.jiffies - READ_ONCE(state->last_time);
++ WRITE_ONCE(state->last_time, sample.jiffies);
+
+- delta2 = delta - state->last_delta;
+- state->last_delta = delta;
++ delta2 = delta - READ_ONCE(state->last_delta);
++ WRITE_ONCE(state->last_delta, delta);
+
+- delta3 = delta2 - state->last_delta2;
+- state->last_delta2 = delta2;
++ delta3 = delta2 - READ_ONCE(state->last_delta2);
++ WRITE_ONCE(state->last_delta2, delta2);
+
+ if (delta < 0)
+ delta = -delta;
+diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
+index 8eeb4190207d1..dce22b7fc5449 100644
+--- a/drivers/char/tlclk.c
++++ b/drivers/char/tlclk.c
+@@ -776,17 +776,21 @@ static int __init tlclk_init(void)
+ {
+ int ret;
+
++ telclk_interrupt = (inb(TLCLK_REG7) & 0x0f);
++
++ alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL);
++ if (!alarm_events) {
++ ret = -ENOMEM;
++ goto out1;
++ }
++
+ ret = register_chrdev(tlclk_major, "telco_clock", &tlclk_fops);
+ if (ret < 0) {
+ printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major);
++ kfree(alarm_events);
+ return ret;
+ }
+ tlclk_major = ret;
+- alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL);
+- if (!alarm_events) {
+- ret = -ENOMEM;
+- goto out1;
+- }
+
+ /* Read telecom clock IRQ number (Set by BIOS) */
+ if (!request_region(TLCLK_BASE, 8, "telco_clock")) {
+@@ -795,7 +799,6 @@ static int __init tlclk_init(void)
+ ret = -EBUSY;
+ goto out2;
+ }
+- telclk_interrupt = (inb(TLCLK_REG7) & 0x0f);
+
+ if (0x0F == telclk_interrupt ) { /* not MCPBL0010 ? */
+ printk(KERN_ERR "telclk_interrupt = 0x%x non-mcpbl0010 hw.\n",
+@@ -836,8 +839,8 @@ out3:
+ release_region(TLCLK_BASE, 8);
+ out2:
+ kfree(alarm_events);
+-out1:
+ unregister_chrdev(tlclk_major, "telco_clock");
++out1:
+ return ret;
+ }
+
+diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
+index 763fc7e6c0058..20f27100708bd 100644
+--- a/drivers/char/tpm/tpm_crb.c
++++ b/drivers/char/tpm/tpm_crb.c
+@@ -26,6 +26,7 @@
+ #include "tpm.h"
+
+ #define ACPI_SIG_TPM2 "TPM2"
++#define TPM_CRB_MAX_RESOURCES 3
+
+ static const guid_t crb_acpi_start_guid =
+ GUID_INIT(0x6BBF6CAB, 0x5463, 0x4714,
+@@ -95,7 +96,6 @@ enum crb_status {
+ struct crb_priv {
+ u32 sm;
+ const char *hid;
+- void __iomem *iobase;
+ struct crb_regs_head __iomem *regs_h;
+ struct crb_regs_tail __iomem *regs_t;
+ u8 __iomem *cmd;
+@@ -438,21 +438,27 @@ static const struct tpm_class_ops tpm_crb = {
+
+ static int crb_check_resource(struct acpi_resource *ares, void *data)
+ {
+- struct resource *io_res = data;
++ struct resource *iores_array = data;
+ struct resource_win win;
+ struct resource *res = &(win.res);
++ int i;
+
+ if (acpi_dev_resource_memory(ares, res) ||
+ acpi_dev_resource_address_space(ares, &win)) {
+- *io_res = *res;
+- io_res->name = NULL;
++ for (i = 0; i < TPM_CRB_MAX_RESOURCES + 1; ++i) {
++ if (resource_type(iores_array + i) != IORESOURCE_MEM) {
++ iores_array[i] = *res;
++ iores_array[i].name = NULL;
++ break;
++ }
++ }
+ }
+
+ return 1;
+ }
+
+-static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
+- struct resource *io_res, u64 start, u32 size)
++static void __iomem *crb_map_res(struct device *dev, struct resource *iores,
++ void __iomem **iobase_ptr, u64 start, u32 size)
+ {
+ struct resource new_res = {
+ .start = start,
+@@ -464,10 +470,16 @@ static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
+ if (start != new_res.start)
+ return (void __iomem *) ERR_PTR(-EINVAL);
+
+- if (!resource_contains(io_res, &new_res))
++ if (!iores)
+ return devm_ioremap_resource(dev, &new_res);
+
+- return priv->iobase + (new_res.start - io_res->start);
++ if (!*iobase_ptr) {
++ *iobase_ptr = devm_ioremap_resource(dev, iores);
++ if (IS_ERR(*iobase_ptr))
++ return *iobase_ptr;
++ }
++
++ return *iobase_ptr + (new_res.start - iores->start);
+ }
+
+ /*
+@@ -494,9 +506,13 @@ static u64 crb_fixup_cmd_size(struct device *dev, struct resource *io_res,
+ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ struct acpi_table_tpm2 *buf)
+ {
+- struct list_head resources;
+- struct resource io_res;
++ struct list_head acpi_resource_list;
++ struct resource iores_array[TPM_CRB_MAX_RESOURCES + 1] = { {0} };
++ void __iomem *iobase_array[TPM_CRB_MAX_RESOURCES] = {NULL};
+ struct device *dev = &device->dev;
++ struct resource *iores;
++ void __iomem **iobase_ptr;
++ int i;
+ u32 pa_high, pa_low;
+ u64 cmd_pa;
+ u32 cmd_size;
+@@ -505,21 +521,41 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ u32 rsp_size;
+ int ret;
+
+- INIT_LIST_HEAD(&resources);
+- ret = acpi_dev_get_resources(device, &resources, crb_check_resource,
+- &io_res);
++ INIT_LIST_HEAD(&acpi_resource_list);
++ ret = acpi_dev_get_resources(device, &acpi_resource_list,
++ crb_check_resource, iores_array);
+ if (ret < 0)
+ return ret;
+- acpi_dev_free_resource_list(&resources);
++ acpi_dev_free_resource_list(&acpi_resource_list);
+
+- if (resource_type(&io_res) != IORESOURCE_MEM) {
++ if (resource_type(iores_array) != IORESOURCE_MEM) {
+ dev_err(dev, FW_BUG "TPM2 ACPI table does not define a memory resource\n");
+ return -EINVAL;
++ } else if (resource_type(iores_array + TPM_CRB_MAX_RESOURCES) ==
++ IORESOURCE_MEM) {
++ dev_warn(dev, "TPM2 ACPI table defines too many memory resources\n");
++ memset(iores_array + TPM_CRB_MAX_RESOURCES,
++ 0, sizeof(*iores_array));
++ iores_array[TPM_CRB_MAX_RESOURCES].flags = 0;
+ }
+
+- priv->iobase = devm_ioremap_resource(dev, &io_res);
+- if (IS_ERR(priv->iobase))
+- return PTR_ERR(priv->iobase);
++ iores = NULL;
++ iobase_ptr = NULL;
++ for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) {
++ if (buf->control_address >= iores_array[i].start &&
++ buf->control_address + sizeof(struct crb_regs_tail) - 1 <=
++ iores_array[i].end) {
++ iores = iores_array + i;
++ iobase_ptr = iobase_array + i;
++ break;
++ }
++ }
++
++ priv->regs_t = crb_map_res(dev, iores, iobase_ptr, buf->control_address,
++ sizeof(struct crb_regs_tail));
++
++ if (IS_ERR(priv->regs_t))
++ return PTR_ERR(priv->regs_t);
+
+ /* The ACPI IO region starts at the head area and continues to include
+ * the control area, as one nice sane region except for some older
+@@ -527,9 +563,10 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ */
+ if ((priv->sm == ACPI_TPM2_COMMAND_BUFFER) ||
+ (priv->sm == ACPI_TPM2_MEMORY_MAPPED)) {
+- if (buf->control_address == io_res.start +
++ if (iores &&
++ buf->control_address == iores->start +
+ sizeof(*priv->regs_h))
+- priv->regs_h = priv->iobase;
++ priv->regs_h = *iobase_ptr;
+ else
+ dev_warn(dev, FW_BUG "Bad ACPI memory layout");
+ }
+@@ -538,13 +575,6 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ if (ret)
+ return ret;
+
+- priv->regs_t = crb_map_res(dev, priv, &io_res, buf->control_address,
+- sizeof(struct crb_regs_tail));
+- if (IS_ERR(priv->regs_t)) {
+- ret = PTR_ERR(priv->regs_t);
+- goto out_relinquish_locality;
+- }
+-
+ /*
+ * PTT HW bug w/a: wake up the device to access
+ * possibly not retained registers.
+@@ -556,13 +586,26 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ pa_high = ioread32(&priv->regs_t->ctrl_cmd_pa_high);
+ pa_low = ioread32(&priv->regs_t->ctrl_cmd_pa_low);
+ cmd_pa = ((u64)pa_high << 32) | pa_low;
+- cmd_size = crb_fixup_cmd_size(dev, &io_res, cmd_pa,
+- ioread32(&priv->regs_t->ctrl_cmd_size));
++ cmd_size = ioread32(&priv->regs_t->ctrl_cmd_size);
++
++ iores = NULL;
++ iobase_ptr = NULL;
++ for (i = 0; iores_array[i].end; ++i) {
++ if (cmd_pa >= iores_array[i].start &&
++ cmd_pa <= iores_array[i].end) {
++ iores = iores_array + i;
++ iobase_ptr = iobase_array + i;
++ break;
++ }
++ }
++
++ if (iores)
++ cmd_size = crb_fixup_cmd_size(dev, iores, cmd_pa, cmd_size);
+
+ dev_dbg(dev, "cmd_hi = %X cmd_low = %X cmd_size %X\n",
+ pa_high, pa_low, cmd_size);
+
+- priv->cmd = crb_map_res(dev, priv, &io_res, cmd_pa, cmd_size);
++ priv->cmd = crb_map_res(dev, iores, iobase_ptr, cmd_pa, cmd_size);
+ if (IS_ERR(priv->cmd)) {
+ ret = PTR_ERR(priv->cmd);
+ goto out;
+@@ -570,11 +613,25 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+
+ memcpy_fromio(&__rsp_pa, &priv->regs_t->ctrl_rsp_pa, 8);
+ rsp_pa = le64_to_cpu(__rsp_pa);
+- rsp_size = crb_fixup_cmd_size(dev, &io_res, rsp_pa,
+- ioread32(&priv->regs_t->ctrl_rsp_size));
++ rsp_size = ioread32(&priv->regs_t->ctrl_rsp_size);
++
++ iores = NULL;
++ iobase_ptr = NULL;
++ for (i = 0; resource_type(iores_array + i) == IORESOURCE_MEM; ++i) {
++ if (rsp_pa >= iores_array[i].start &&
++ rsp_pa <= iores_array[i].end) {
++ iores = iores_array + i;
++ iobase_ptr = iobase_array + i;
++ break;
++ }
++ }
++
++ if (iores)
++ rsp_size = crb_fixup_cmd_size(dev, iores, rsp_pa, rsp_size);
+
+ if (cmd_pa != rsp_pa) {
+- priv->rsp = crb_map_res(dev, priv, &io_res, rsp_pa, rsp_size);
++ priv->rsp = crb_map_res(dev, iores, iobase_ptr,
++ rsp_pa, rsp_size);
+ ret = PTR_ERR_OR_ZERO(priv->rsp);
+ goto out;
+ }
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index 569e93e1f06cc..3ba67bc6baba0 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -588,6 +588,7 @@ static irqreturn_t ibmvtpm_interrupt(int irq, void *vtpm_instance)
+ */
+ while ((crq = ibmvtpm_crq_get_next(ibmvtpm)) != NULL) {
+ ibmvtpm_crq_process(crq, ibmvtpm);
++ wake_up_interruptible(&ibmvtpm->crq_queue.wq);
+ crq->valid = 0;
+ smp_wmb();
+ }
+@@ -635,6 +636,7 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+ }
+
+ crq_q->num_entry = CRQ_RES_BUF_SIZE / sizeof(*crq_q->crq_addr);
++ init_waitqueue_head(&crq_q->wq);
+ ibmvtpm->crq_dma_handle = dma_map_single(dev, crq_q->crq_addr,
+ CRQ_RES_BUF_SIZE,
+ DMA_BIDIRECTIONAL);
+@@ -687,6 +689,13 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+ if (rc)
+ goto init_irq_cleanup;
+
++ if (!wait_event_timeout(ibmvtpm->crq_queue.wq,
++ ibmvtpm->rtce_buf != NULL,
++ HZ)) {
++ dev_err(dev, "CRQ response timed out\n");
++ goto init_irq_cleanup;
++ }
++
+ return tpm_chip_register(chip);
+ init_irq_cleanup:
+ do {
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
+index 91dfe766d0800..4f6a124601db4 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.h
++++ b/drivers/char/tpm/tpm_ibmvtpm.h
+@@ -31,6 +31,7 @@ struct ibmvtpm_crq_queue {
+ struct ibmvtpm_crq *crq_addr;
+ u32 index;
+ u32 num_entry;
++ wait_queue_head_t wq;
+ };
+
+ struct ibmvtpm_dev {
+diff --git a/drivers/clk/socfpga/clk-pll-s10.c b/drivers/clk/socfpga/clk-pll-s10.c
+index c4d0b6f6abf2e..fc2e2839fe570 100644
+--- a/drivers/clk/socfpga/clk-pll-s10.c
++++ b/drivers/clk/socfpga/clk-pll-s10.c
+@@ -38,7 +38,9 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hwclk,
+ /* read VCO1 reg for numerator and denominator */
+ reg = readl(socfpgaclk->hw.reg);
+ refdiv = (reg & SOCFPGA_PLL_REFDIV_MASK) >> SOCFPGA_PLL_REFDIV_SHIFT;
+- vco_freq = (unsigned long long)parent_rate / refdiv;
++
++ vco_freq = parent_rate;
++ do_div(vco_freq, refdiv);
+
+ /* Read mdiv and fdiv from the fdbck register */
+ reg = readl(socfpgaclk->hw.reg + 0x4);
+diff --git a/drivers/clk/ti/adpll.c b/drivers/clk/ti/adpll.c
+index 688e403333b91..14926e07d09ae 100644
+--- a/drivers/clk/ti/adpll.c
++++ b/drivers/clk/ti/adpll.c
+@@ -193,15 +193,8 @@ static const char *ti_adpll_clk_get_name(struct ti_adpll_data *d,
+ if (err)
+ return NULL;
+ } else {
+- const char *base_name = "adpll";
+- char *buf;
+-
+- buf = devm_kzalloc(d->dev, 8 + 1 + strlen(base_name) + 1 +
+- strlen(postfix), GFP_KERNEL);
+- if (!buf)
+- return NULL;
+- sprintf(buf, "%08lx.%s.%s", d->pa, base_name, postfix);
+- name = buf;
++ name = devm_kasprintf(d->dev, GFP_KERNEL, "%08lx.adpll.%s",
++ d->pa, postfix);
+ }
+
+ return name;
+diff --git a/drivers/clocksource/h8300_timer8.c b/drivers/clocksource/h8300_timer8.c
+index 1d740a8c42ab3..47114c2a7cb54 100644
+--- a/drivers/clocksource/h8300_timer8.c
++++ b/drivers/clocksource/h8300_timer8.c
+@@ -169,7 +169,7 @@ static int __init h8300_8timer_init(struct device_node *node)
+ return PTR_ERR(clk);
+ }
+
+- ret = ENXIO;
++ ret = -ENXIO;
+ base = of_iomap(node, 0);
+ if (!base) {
+ pr_err("failed to map registers for clockevent\n");
+diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
+index 687c92ef76440..79942f7057576 100644
+--- a/drivers/cpufreq/powernv-cpufreq.c
++++ b/drivers/cpufreq/powernv-cpufreq.c
+@@ -903,6 +903,7 @@ static struct notifier_block powernv_cpufreq_reboot_nb = {
+ void powernv_cpufreq_work_fn(struct work_struct *work)
+ {
+ struct chip *chip = container_of(work, struct chip, throttle);
++ struct cpufreq_policy *policy;
+ unsigned int cpu;
+ cpumask_t mask;
+
+@@ -917,12 +918,14 @@ void powernv_cpufreq_work_fn(struct work_struct *work)
+ chip->restore = false;
+ for_each_cpu(cpu, &mask) {
+ int index;
+- struct cpufreq_policy policy;
+
+- cpufreq_get_policy(&policy, cpu);
+- index = cpufreq_table_find_index_c(&policy, policy.cur);
+- powernv_cpufreq_target_index(&policy, index);
+- cpumask_andnot(&mask, &mask, policy.cpus);
++ policy = cpufreq_cpu_get(cpu);
++ if (!policy)
++ continue;
++ index = cpufreq_table_find_index_c(policy, policy->cur);
++ powernv_cpufreq_target_index(policy, index);
++ cpumask_andnot(&mask, &mask, policy->cpus);
++ cpufreq_cpu_put(policy);
+ }
+ out:
+ put_online_cpus();
+diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
+index 9b3c259f081d3..ee508bbbb7504 100644
+--- a/drivers/crypto/chelsio/chcr_algo.c
++++ b/drivers/crypto/chelsio/chcr_algo.c
+@@ -2418,8 +2418,9 @@ int chcr_aead_dma_map(struct device *dev,
+ else
+ reqctx->b0_dma = 0;
+ if (req->src == req->dst) {
+- error = dma_map_sg(dev, req->src, sg_nents(req->src),
+- DMA_BIDIRECTIONAL);
++ error = dma_map_sg(dev, req->src,
++ sg_nents_for_len(req->src, dst_size),
++ DMA_BIDIRECTIONAL);
+ if (!error)
+ goto err;
+ } else {
+diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c
+index 1e0cc96306dd7..2c1f3ddb0cc79 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_io.c
++++ b/drivers/crypto/chelsio/chtls/chtls_io.c
+@@ -1449,7 +1449,7 @@ static int chtls_pt_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ csk->wr_max_credits))
+ sk->sk_write_space(sk);
+
+- if (copied >= target && !sk->sk_backlog.tail)
++ if (copied >= target && !READ_ONCE(sk->sk_backlog.tail))
+ break;
+
+ if (copied) {
+@@ -1482,7 +1482,7 @@ static int chtls_pt_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ break;
+ }
+ }
+- if (sk->sk_backlog.tail) {
++ if (READ_ONCE(sk->sk_backlog.tail)) {
+ release_sock(sk);
+ lock_sock(sk);
+ chtls_cleanup_rbuf(sk, copied);
+@@ -1627,7 +1627,7 @@ static int peekmsg(struct sock *sk, struct msghdr *msg,
+ break;
+ }
+
+- if (sk->sk_backlog.tail) {
++ if (READ_ONCE(sk->sk_backlog.tail)) {
+ /* Do not sleep, just process backlog. */
+ release_sock(sk);
+ lock_sock(sk);
+@@ -1759,7 +1759,7 @@ int chtls_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ csk->wr_max_credits))
+ sk->sk_write_space(sk);
+
+- if (copied >= target && !sk->sk_backlog.tail)
++ if (copied >= target && !READ_ONCE(sk->sk_backlog.tail))
+ break;
+
+ if (copied) {
+@@ -1790,7 +1790,7 @@ int chtls_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ }
+ }
+
+- if (sk->sk_backlog.tail) {
++ if (READ_ONCE(sk->sk_backlog.tail)) {
+ release_sock(sk);
+ lock_sock(sk);
+ chtls_cleanup_rbuf(sk, copied);
+diff --git a/drivers/devfreq/tegra-devfreq.c b/drivers/devfreq/tegra-devfreq.c
+index 06768074d2d82..479d9575e1245 100644
+--- a/drivers/devfreq/tegra-devfreq.c
++++ b/drivers/devfreq/tegra-devfreq.c
+@@ -80,6 +80,8 @@
+
+ #define KHZ 1000
+
++#define KHZ_MAX (ULONG_MAX / KHZ)
++
+ /* Assume that the bus is saturated if the utilization is 25% */
+ #define BUS_SATURATION_RATIO 25
+
+@@ -180,7 +182,7 @@ struct tegra_actmon_emc_ratio {
+ };
+
+ static struct tegra_actmon_emc_ratio actmon_emc_ratios[] = {
+- { 1400000, ULONG_MAX },
++ { 1400000, KHZ_MAX },
+ { 1200000, 750000 },
+ { 1100000, 600000 },
+ { 1000000, 500000 },
+diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
+index 1551ca7df3941..8586cc05def17 100644
+--- a/drivers/dma-buf/dma-fence.c
++++ b/drivers/dma-buf/dma-fence.c
+@@ -244,6 +244,30 @@ void dma_fence_free(struct dma_fence *fence)
+ }
+ EXPORT_SYMBOL(dma_fence_free);
+
++static bool __dma_fence_enable_signaling(struct dma_fence *fence)
++{
++ bool was_set;
++
++ lockdep_assert_held(fence->lock);
++
++ was_set = test_and_set_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
++ &fence->flags);
++
++ if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags))
++ return false;
++
++ if (!was_set && fence->ops->enable_signaling) {
++ trace_dma_fence_enable_signal(fence);
++
++ if (!fence->ops->enable_signaling(fence)) {
++ dma_fence_signal_locked(fence);
++ return false;
++ }
++ }
++
++ return true;
++}
++
+ /**
+ * dma_fence_enable_sw_signaling - enable signaling on fence
+ * @fence: the fence to enable
+@@ -256,19 +280,12 @@ void dma_fence_enable_sw_signaling(struct dma_fence *fence)
+ {
+ unsigned long flags;
+
+- if (!test_and_set_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
+- &fence->flags) &&
+- !test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags) &&
+- fence->ops->enable_signaling) {
+- trace_dma_fence_enable_signal(fence);
+-
+- spin_lock_irqsave(fence->lock, flags);
+-
+- if (!fence->ops->enable_signaling(fence))
+- dma_fence_signal_locked(fence);
++ if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags))
++ return;
+
+- spin_unlock_irqrestore(fence->lock, flags);
+- }
++ spin_lock_irqsave(fence->lock, flags);
++ __dma_fence_enable_signaling(fence);
++ spin_unlock_irqrestore(fence->lock, flags);
+ }
+ EXPORT_SYMBOL(dma_fence_enable_sw_signaling);
+
+@@ -302,7 +319,6 @@ int dma_fence_add_callback(struct dma_fence *fence, struct dma_fence_cb *cb,
+ {
+ unsigned long flags;
+ int ret = 0;
+- bool was_set;
+
+ if (WARN_ON(!fence || !func))
+ return -EINVAL;
+@@ -314,25 +330,14 @@ int dma_fence_add_callback(struct dma_fence *fence, struct dma_fence_cb *cb,
+
+ spin_lock_irqsave(fence->lock, flags);
+
+- was_set = test_and_set_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
+- &fence->flags);
+-
+- if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags))
+- ret = -ENOENT;
+- else if (!was_set && fence->ops->enable_signaling) {
+- trace_dma_fence_enable_signal(fence);
+-
+- if (!fence->ops->enable_signaling(fence)) {
+- dma_fence_signal_locked(fence);
+- ret = -ENOENT;
+- }
+- }
+-
+- if (!ret) {
++ if (__dma_fence_enable_signaling(fence)) {
+ cb->func = func;
+ list_add_tail(&cb->node, &fence->cb_list);
+- } else
++ } else {
+ INIT_LIST_HEAD(&cb->node);
++ ret = -ENOENT;
++ }
++
+ spin_unlock_irqrestore(fence->lock, flags);
+
+ return ret;
+@@ -432,7 +437,6 @@ dma_fence_default_wait(struct dma_fence *fence, bool intr, signed long timeout)
+ struct default_wait_cb cb;
+ unsigned long flags;
+ signed long ret = timeout ? timeout : 1;
+- bool was_set;
+
+ if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags))
+ return ret;
+@@ -444,21 +448,9 @@ dma_fence_default_wait(struct dma_fence *fence, bool intr, signed long timeout)
+ goto out;
+ }
+
+- was_set = test_and_set_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
+- &fence->flags);
+-
+- if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags))
++ if (!__dma_fence_enable_signaling(fence))
+ goto out;
+
+- if (!was_set && fence->ops->enable_signaling) {
+- trace_dma_fence_enable_signal(fence);
+-
+- if (!fence->ops->enable_signaling(fence)) {
+- dma_fence_signal_locked(fence);
+- goto out;
+- }
+- }
+-
+ if (!timeout) {
+ ret = 0;
+ goto out;
+diff --git a/drivers/dma/mediatek/mtk-hsdma.c b/drivers/dma/mediatek/mtk-hsdma.c
+index b7ec56ae02a6e..fca232b1d4a64 100644
+--- a/drivers/dma/mediatek/mtk-hsdma.c
++++ b/drivers/dma/mediatek/mtk-hsdma.c
+@@ -997,7 +997,7 @@ static int mtk_hsdma_probe(struct platform_device *pdev)
+ if (err) {
+ dev_err(&pdev->dev,
+ "request_irq failed with err %d\n", err);
+- goto err_unregister;
++ goto err_free;
+ }
+
+ platform_set_drvdata(pdev, hsdma);
+@@ -1006,6 +1006,8 @@ static int mtk_hsdma_probe(struct platform_device *pdev)
+
+ return 0;
+
++err_free:
++ of_dma_controller_free(pdev->dev.of_node);
+ err_unregister:
+ dma_async_device_unregister(dd);
+
+diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c
+index 4903a408fc146..ac7af440f8658 100644
+--- a/drivers/dma/stm32-dma.c
++++ b/drivers/dma/stm32-dma.c
+@@ -494,8 +494,10 @@ static int stm32_dma_terminate_all(struct dma_chan *c)
+
+ spin_lock_irqsave(&chan->vchan.lock, flags);
+
+- if (chan->busy) {
+- stm32_dma_stop(chan);
++ if (chan->desc) {
++ vchan_terminate_vdesc(&chan->desc->vdesc);
++ if (chan->busy)
++ stm32_dma_stop(chan);
+ chan->desc = NULL;
+ }
+
+@@ -551,6 +553,8 @@ static void stm32_dma_start_transfer(struct stm32_dma_chan *chan)
+ if (!vdesc)
+ return;
+
++ list_del(&vdesc->node);
++
+ chan->desc = to_stm32_dma_desc(vdesc);
+ chan->next_sg = 0;
+ }
+@@ -628,7 +632,6 @@ static void stm32_dma_handle_chan_done(struct stm32_dma_chan *chan)
+ } else {
+ chan->busy = false;
+ if (chan->next_sg == chan->desc->num_sgs) {
+- list_del(&chan->desc->vdesc.node);
+ vchan_cookie_complete(&chan->desc->vdesc);
+ chan->desc = NULL;
+ }
+diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
+index 8c3c3e5b812a8..9c6867916e890 100644
+--- a/drivers/dma/stm32-mdma.c
++++ b/drivers/dma/stm32-mdma.c
+@@ -1137,6 +1137,8 @@ static void stm32_mdma_start_transfer(struct stm32_mdma_chan *chan)
+ return;
+ }
+
++ list_del(&vdesc->node);
++
+ chan->desc = to_stm32_mdma_desc(vdesc);
+ hwdesc = chan->desc->node[0].hwdesc;
+ chan->curr_hwdesc = 0;
+@@ -1252,8 +1254,10 @@ static int stm32_mdma_terminate_all(struct dma_chan *c)
+ LIST_HEAD(head);
+
+ spin_lock_irqsave(&chan->vchan.lock, flags);
+- if (chan->busy) {
+- stm32_mdma_stop(chan);
++ if (chan->desc) {
++ vchan_terminate_vdesc(&chan->desc->vdesc);
++ if (chan->busy)
++ stm32_mdma_stop(chan);
+ chan->desc = NULL;
+ }
+ vchan_get_all_descriptors(&chan->vchan, &head);
+@@ -1341,7 +1345,6 @@ static enum dma_status stm32_mdma_tx_status(struct dma_chan *c,
+
+ static void stm32_mdma_xfer_end(struct stm32_mdma_chan *chan)
+ {
+- list_del(&chan->desc->vdesc.node);
+ vchan_cookie_complete(&chan->desc->vdesc);
+ chan->desc = NULL;
+ chan->busy = false;
+diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
+index 15481aeaeecd1..5ccd24a46e381 100644
+--- a/drivers/dma/tegra20-apb-dma.c
++++ b/drivers/dma/tegra20-apb-dma.c
+@@ -1225,8 +1225,7 @@ static void tegra_dma_free_chan_resources(struct dma_chan *dc)
+
+ dev_dbg(tdc2dev(tdc), "Freeing channel %d\n", tdc->id);
+
+- if (tdc->busy)
+- tegra_dma_terminate_all(dc);
++ tegra_dma_terminate_all(dc);
+
+ spin_lock_irqsave(&tdc->lock, flags);
+ list_splice_init(&tdc->pending_sg_req, &sg_req_list);
+diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
+index 73de6a6179fcd..e002ff8413e2a 100644
+--- a/drivers/dma/xilinx/zynqmp_dma.c
++++ b/drivers/dma/xilinx/zynqmp_dma.c
+@@ -127,10 +127,12 @@
+ /* Max transfer size per descriptor */
+ #define ZYNQMP_DMA_MAX_TRANS_LEN 0x40000000
+
++/* Max burst lengths */
++#define ZYNQMP_DMA_MAX_DST_BURST_LEN 32768U
++#define ZYNQMP_DMA_MAX_SRC_BURST_LEN 32768U
++
+ /* Reset values for data attributes */
+ #define ZYNQMP_DMA_AXCACHE_VAL 0xF
+-#define ZYNQMP_DMA_ARLEN_RST_VAL 0xF
+-#define ZYNQMP_DMA_AWLEN_RST_VAL 0xF
+
+ #define ZYNQMP_DMA_SRC_ISSUE_RST_VAL 0x1F
+
+@@ -536,17 +538,19 @@ static void zynqmp_dma_handle_ovfl_int(struct zynqmp_dma_chan *chan, u32 status)
+
+ static void zynqmp_dma_config(struct zynqmp_dma_chan *chan)
+ {
+- u32 val;
++ u32 val, burst_val;
+
+ val = readl(chan->regs + ZYNQMP_DMA_CTRL0);
+ val |= ZYNQMP_DMA_POINT_TYPE_SG;
+ writel(val, chan->regs + ZYNQMP_DMA_CTRL0);
+
+ val = readl(chan->regs + ZYNQMP_DMA_DATA_ATTR);
++ burst_val = __ilog2_u32(chan->src_burst_len);
+ val = (val & ~ZYNQMP_DMA_ARLEN) |
+- (chan->src_burst_len << ZYNQMP_DMA_ARLEN_OFST);
++ ((burst_val << ZYNQMP_DMA_ARLEN_OFST) & ZYNQMP_DMA_ARLEN);
++ burst_val = __ilog2_u32(chan->dst_burst_len);
+ val = (val & ~ZYNQMP_DMA_AWLEN) |
+- (chan->dst_burst_len << ZYNQMP_DMA_AWLEN_OFST);
++ ((burst_val << ZYNQMP_DMA_AWLEN_OFST) & ZYNQMP_DMA_AWLEN);
+ writel(val, chan->regs + ZYNQMP_DMA_DATA_ATTR);
+ }
+
+@@ -562,8 +566,10 @@ static int zynqmp_dma_device_config(struct dma_chan *dchan,
+ {
+ struct zynqmp_dma_chan *chan = to_chan(dchan);
+
+- chan->src_burst_len = config->src_maxburst;
+- chan->dst_burst_len = config->dst_maxburst;
++ chan->src_burst_len = clamp(config->src_maxburst, 1U,
++ ZYNQMP_DMA_MAX_SRC_BURST_LEN);
++ chan->dst_burst_len = clamp(config->dst_maxburst, 1U,
++ ZYNQMP_DMA_MAX_DST_BURST_LEN);
+
+ return 0;
+ }
+@@ -884,8 +890,8 @@ static int zynqmp_dma_chan_probe(struct zynqmp_dma_device *zdev,
+ return PTR_ERR(chan->regs);
+
+ chan->bus_width = ZYNQMP_DMA_BUS_WIDTH_64;
+- chan->dst_burst_len = ZYNQMP_DMA_AWLEN_RST_VAL;
+- chan->src_burst_len = ZYNQMP_DMA_ARLEN_RST_VAL;
++ chan->dst_burst_len = ZYNQMP_DMA_MAX_DST_BURST_LEN;
++ chan->src_burst_len = ZYNQMP_DMA_MAX_SRC_BURST_LEN;
+ err = of_property_read_u32(node, "xlnx,bus-width", &chan->bus_width);
+ if (err < 0) {
+ dev_err(&pdev->dev, "missing xlnx,bus-width property\n");
+diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
+index 05b528c7ed8fd..e809f4d9a9e93 100644
+--- a/drivers/firmware/arm_sdei.c
++++ b/drivers/firmware/arm_sdei.c
+@@ -410,14 +410,19 @@ int sdei_event_enable(u32 event_num)
+ return -ENOENT;
+ }
+
+- spin_lock(&sdei_list_lock);
+- event->reenable = true;
+- spin_unlock(&sdei_list_lock);
+
++ cpus_read_lock();
+ if (event->type == SDEI_EVENT_TYPE_SHARED)
+ err = sdei_api_event_enable(event->event_num);
+ else
+ err = sdei_do_cross_call(_local_event_enable, event);
++
++ if (!err) {
++ spin_lock(&sdei_list_lock);
++ event->reenable = true;
++ spin_unlock(&sdei_list_lock);
++ }
++ cpus_read_unlock();
+ mutex_unlock(&sdei_events_lock);
+
+ return err;
+@@ -619,21 +624,18 @@ int sdei_event_register(u32 event_num, sdei_event_callback *cb, void *arg)
+ break;
+ }
+
+- spin_lock(&sdei_list_lock);
+- event->reregister = true;
+- spin_unlock(&sdei_list_lock);
+-
++ cpus_read_lock();
+ err = _sdei_event_register(event);
+ if (err) {
+- spin_lock(&sdei_list_lock);
+- event->reregister = false;
+- event->reenable = false;
+- spin_unlock(&sdei_list_lock);
+-
+ sdei_event_destroy(event);
+ pr_warn("Failed to register event %u: %d\n", event_num,
+ err);
++ } else {
++ spin_lock(&sdei_list_lock);
++ event->reregister = true;
++ spin_unlock(&sdei_list_lock);
+ }
++ cpus_read_unlock();
+ } while (0);
+ mutex_unlock(&sdei_events_lock);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+index a5df80d50d447..6cf3dd5edffda 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+@@ -191,30 +191,35 @@ static bool amdgpu_read_bios_from_rom(struct amdgpu_device *adev)
+
+ static bool amdgpu_read_platform_bios(struct amdgpu_device *adev)
+ {
+- uint8_t __iomem *bios;
+- size_t size;
++ phys_addr_t rom = adev->pdev->rom;
++ size_t romlen = adev->pdev->romlen;
++ void __iomem *bios;
+
+ adev->bios = NULL;
+
+- bios = pci_platform_rom(adev->pdev, &size);
+- if (!bios) {
++ if (!rom || romlen == 0)
+ return false;
+- }
+
+- adev->bios = kzalloc(size, GFP_KERNEL);
+- if (adev->bios == NULL)
++ adev->bios = kzalloc(romlen, GFP_KERNEL);
++ if (!adev->bios)
+ return false;
+
+- memcpy_fromio(adev->bios, bios, size);
++ bios = ioremap(rom, romlen);
++ if (!bios)
++ goto free_bios;
+
+- if (!check_atom_bios(adev->bios, size)) {
+- kfree(adev->bios);
+- return false;
+- }
++ memcpy_fromio(adev->bios, bios, romlen);
++ iounmap(bios);
+
+- adev->bios_size = size;
++ if (!check_atom_bios(adev->bios, romlen))
++ goto free_bios;
++
++ adev->bios_size = romlen;
+
+ return true;
++free_bios:
++ kfree(adev->bios);
++ return false;
+ }
+
+ #ifdef CONFIG_ACPI
+diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
+index e9934de1b9cf8..0222bb7ea49b4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/atom.c
++++ b/drivers/gpu/drm/amd/amdgpu/atom.c
+@@ -742,8 +742,8 @@ static void atom_op_jump(atom_exec_context *ctx, int *ptr, int arg)
+ cjiffies = jiffies;
+ if (time_after(cjiffies, ctx->last_jump_jiffies)) {
+ cjiffies -= ctx->last_jump_jiffies;
+- if ((jiffies_to_msecs(cjiffies) > 5000)) {
+- DRM_ERROR("atombios stuck in loop for more than 5secs aborting\n");
++ if ((jiffies_to_msecs(cjiffies) > 10000)) {
++ DRM_ERROR("atombios stuck in loop for more than 10secs aborting\n");
+ ctx->abort = true;
+ }
+ } else {
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+index 189212cb35475..bff39f561264e 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -1101,6 +1101,8 @@ static int stop_cpsch(struct device_queue_manager *dqm)
+ unmap_queues_cpsch(dqm, KFD_UNMAP_QUEUES_FILTER_ALL_QUEUES, 0);
+ dqm_unlock(dqm);
+
++ pm_release_ib(&dqm->packets);
++
+ kfd_gtt_sa_free(dqm->dev, dqm->fence_mem);
+ pm_uninit(&dqm->packets);
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 3abc0294c05f5..2fb2c683ad54b 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -1576,8 +1576,7 @@ static void write_i2c_retimer_setting(
+ buffer, sizeof(buffer));
+
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ /* Based on DP159 specs, APPLY_RX_TX_CHANGE bit in 0x0A
+ * needs to be set to 1 on every 0xA-0xC write.
+@@ -1595,8 +1594,7 @@ static void write_i2c_retimer_setting(
+ pipe_ctx->stream->sink->link->ddc,
+ slave_address, &offset, 1, &value, 1);
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+ }
+
+ buffer[0] = offset;
+@@ -1605,8 +1603,7 @@ static void write_i2c_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+ }
+ }
+ }
+@@ -1623,8 +1620,7 @@ static void write_i2c_retimer_setting(
+ buffer, sizeof(buffer));
+
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ /* Based on DP159 specs, APPLY_RX_TX_CHANGE bit in 0x0A
+ * needs to be set to 1 on every 0xA-0xC write.
+@@ -1642,8 +1638,7 @@ static void write_i2c_retimer_setting(
+ pipe_ctx->stream->sink->link->ddc,
+ slave_address, &offset, 1, &value, 1);
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+ }
+
+ buffer[0] = offset;
+@@ -1652,8 +1647,7 @@ static void write_i2c_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+ }
+ }
+ }
+@@ -1668,8 +1662,7 @@ static void write_i2c_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ /* Write offset 0x00 to 0x23 */
+ buffer[0] = 0x00;
+@@ -1677,8 +1670,7 @@ static void write_i2c_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ /* Write offset 0xff to 0x00 */
+ buffer[0] = 0xff;
+@@ -1686,10 +1678,14 @@ static void write_i2c_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ }
++
++ return;
++
++i2c_write_fail:
++ DC_LOG_DEBUG("Set retimer failed");
+ }
+
+ static void write_i2c_default_retimer_setting(
+@@ -1710,8 +1706,7 @@ static void write_i2c_default_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ /* Write offset 0x0A to 0x17 */
+ buffer[0] = 0x0A;
+@@ -1719,8 +1714,7 @@ static void write_i2c_default_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ /* Write offset 0x0B to 0xDA or 0xD8 */
+ buffer[0] = 0x0B;
+@@ -1728,8 +1722,7 @@ static void write_i2c_default_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ /* Write offset 0x0A to 0x17 */
+ buffer[0] = 0x0A;
+@@ -1737,8 +1730,7 @@ static void write_i2c_default_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ /* Write offset 0x0C to 0x1D or 0x91 */
+ buffer[0] = 0x0C;
+@@ -1746,8 +1738,7 @@ static void write_i2c_default_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ /* Write offset 0x0A to 0x17 */
+ buffer[0] = 0x0A;
+@@ -1755,8 +1746,7 @@ static void write_i2c_default_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+
+ if (is_vga_mode) {
+@@ -1768,8 +1758,7 @@ static void write_i2c_default_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ /* Write offset 0x00 to 0x23 */
+ buffer[0] = 0x00;
+@@ -1777,8 +1766,7 @@ static void write_i2c_default_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+
+ /* Write offset 0xff to 0x00 */
+ buffer[0] = 0xff;
+@@ -1786,9 +1774,13 @@ static void write_i2c_default_retimer_setting(
+ i2c_success = i2c_write(pipe_ctx, slave_address,
+ buffer, sizeof(buffer));
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ goto i2c_write_fail;
+ }
++
++ return;
++
++i2c_write_fail:
++ DC_LOG_DEBUG("Set default retimer failed");
+ }
+
+ static void write_i2c_redriver_setting(
+@@ -1811,8 +1803,7 @@ static void write_i2c_redriver_setting(
+ buffer, sizeof(buffer));
+
+ if (!i2c_success)
+- /* Write failure */
+- ASSERT(i2c_success);
++ DC_LOG_DEBUG("Set redriver failed");
+ }
+
+ static void enable_link_hdmi(struct pipe_ctx *pipe_ctx)
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+index 46c9cb47a96e5..145af3bb2dfcb 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+@@ -127,22 +127,16 @@ struct aux_payloads {
+ struct vector payloads;
+ };
+
+-static struct i2c_payloads *dal_ddc_i2c_payloads_create(struct dc_context *ctx, uint32_t count)
++static bool dal_ddc_i2c_payloads_create(
++ struct dc_context *ctx,
++ struct i2c_payloads *payloads,
++ uint32_t count)
+ {
+- struct i2c_payloads *payloads;
+-
+- payloads = kzalloc(sizeof(struct i2c_payloads), GFP_KERNEL);
+-
+- if (!payloads)
+- return NULL;
+-
+ if (dal_vector_construct(
+ &payloads->payloads, ctx, count, sizeof(struct i2c_payload)))
+- return payloads;
+-
+- kfree(payloads);
+- return NULL;
++ return true;
+
++ return false;
+ }
+
+ static struct i2c_payload *dal_ddc_i2c_payloads_get(struct i2c_payloads *p)
+@@ -155,14 +149,12 @@ static uint32_t dal_ddc_i2c_payloads_get_count(struct i2c_payloads *p)
+ return p->payloads.count;
+ }
+
+-static void dal_ddc_i2c_payloads_destroy(struct i2c_payloads **p)
++static void dal_ddc_i2c_payloads_destroy(struct i2c_payloads *p)
+ {
+- if (!p || !*p)
++ if (!p)
+ return;
+- dal_vector_destruct(&(*p)->payloads);
+- kfree(*p);
+- *p = NULL;
+
++ dal_vector_destruct(&p->payloads);
+ }
+
+ static struct aux_payloads *dal_ddc_aux_payloads_create(struct dc_context *ctx, uint32_t count)
+@@ -580,9 +572,13 @@ bool dal_ddc_service_query_ddc_data(
+
+ uint32_t payloads_num = write_payloads + read_payloads;
+
++
+ if (write_size > EDID_SEGMENT_SIZE || read_size > EDID_SEGMENT_SIZE)
+ return false;
+
++ if (!payloads_num)
++ return false;
++
+ /*TODO: len of payload data for i2c and aux is uint8!!!!,
+ * but we want to read 256 over i2c!!!!*/
+ if (dal_ddc_service_is_in_aux_transaction_mode(ddc)) {
+@@ -613,23 +609,25 @@ bool dal_ddc_service_query_ddc_data(
+ dal_ddc_aux_payloads_destroy(&payloads);
+
+ } else {
+- struct i2c_payloads *payloads =
+- dal_ddc_i2c_payloads_create(ddc->ctx, payloads_num);
++ struct i2c_command command = {0};
++ struct i2c_payloads payloads;
+
+- struct i2c_command command = {
+- .payloads = dal_ddc_i2c_payloads_get(payloads),
+- .number_of_payloads = 0,
+- .engine = DDC_I2C_COMMAND_ENGINE,
+- .speed = ddc->ctx->dc->caps.i2c_speed_in_khz };
++ if (!dal_ddc_i2c_payloads_create(ddc->ctx, &payloads, payloads_num))
++ return false;
++
++ command.payloads = dal_ddc_i2c_payloads_get(&payloads);
++ command.number_of_payloads = 0;
++ command.engine = DDC_I2C_COMMAND_ENGINE;
++ command.speed = ddc->ctx->dc->caps.i2c_speed_in_khz;
+
+ dal_ddc_i2c_payloads_add(
+- payloads, address, write_size, write_buf, true);
++ &payloads, address, write_size, write_buf, true);
+
+ dal_ddc_i2c_payloads_add(
+- payloads, address, read_size, read_buf, false);
++ &payloads, address, read_size, read_buf, false);
+
+ command.number_of_payloads =
+- dal_ddc_i2c_payloads_get_count(payloads);
++ dal_ddc_i2c_payloads_get_count(&payloads);
+
+ ret = dm_helpers_submit_i2c(
+ ddc->ctx,
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index 72c0a2ae2dd4f..058898b321b8a 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -3970,6 +3970,13 @@ static int smu7_set_power_state_tasks(struct pp_hwmgr *hwmgr, const void *input)
+ "Failed to populate and upload SCLK MCLK DPM levels!",
+ result = tmp_result);
+
++ /*
++ * If a custom pp table is loaded, set DPMTABLE_OD_UPDATE_VDDC flag.
++ * That effectively disables AVFS feature.
++ */
++ if (hwmgr->hardcode_pp_table != NULL)
++ data->need_update_smu7_dpm_table |= DPMTABLE_OD_UPDATE_VDDC;
++
+ tmp_result = smu7_update_avfs(hwmgr);
+ PP_ASSERT_WITH_CODE((0 == tmp_result),
+ "Failed to update avfs voltages!",
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+index ce459ea4ec3ad..da9e6923fa659 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+@@ -3591,6 +3591,13 @@ static int vega10_set_power_state_tasks(struct pp_hwmgr *hwmgr,
+ PP_ASSERT_WITH_CODE(!result,
+ "Failed to upload PPtable!", return result);
+
++ /*
++ * If a custom pp table is loaded, set DPMTABLE_OD_UPDATE_VDDC flag.
++ * That effectively disables AVFS feature.
++ */
++ if(hwmgr->hardcode_pp_table != NULL)
++ data->need_update_dpm_table |= DPMTABLE_OD_UPDATE_VDDC;
++
+ vega10_update_avfs(hwmgr);
+
+ data->need_update_dpm_table &= DPMTABLE_OD_UPDATE_VDDC;
+diff --git a/drivers/gpu/drm/gma500/cdv_intel_display.c b/drivers/gpu/drm/gma500/cdv_intel_display.c
+index 17db4b4749d5a..2e8479744ca4a 100644
+--- a/drivers/gpu/drm/gma500/cdv_intel_display.c
++++ b/drivers/gpu/drm/gma500/cdv_intel_display.c
+@@ -415,6 +415,8 @@ static bool cdv_intel_find_dp_pll(const struct gma_limit_t *limit,
+ struct gma_crtc *gma_crtc = to_gma_crtc(crtc);
+ struct gma_clock_t clock;
+
++ memset(&clock, 0, sizeof(clock));
++
+ switch (refclk) {
+ case 27000:
+ if (target < 200000) {
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index 1fc9a7fa37b45..d29a58bd2f7a3 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -1474,18 +1474,31 @@ static const struct adreno_gpu_funcs funcs = {
+ static void check_speed_bin(struct device *dev)
+ {
+ struct nvmem_cell *cell;
+- u32 bin, val;
++ u32 val;
++
++ /*
++ * If the OPP table specifies a opp-supported-hw property then we have
++ * to set something with dev_pm_opp_set_supported_hw() or the table
++ * doesn't get populated so pick an arbitrary value that should
++ * ensure the default frequencies are selected but not conflict with any
++ * actual bins
++ */
++ val = 0x80;
+
+ cell = nvmem_cell_get(dev, "speed_bin");
+
+- /* If a nvmem cell isn't defined, nothing to do */
+- if (IS_ERR(cell))
+- return;
++ if (!IS_ERR(cell)) {
++ void *buf = nvmem_cell_read(cell, NULL);
++
++ if (!IS_ERR(buf)) {
++ u8 bin = *((u8 *) buf);
+
+- bin = *((u32 *) nvmem_cell_read(cell, NULL));
+- nvmem_cell_put(cell);
++ val = (1 << bin);
++ kfree(buf);
++ }
+
+- val = (1 << bin);
++ nvmem_cell_put(cell);
++ }
+
+ dev_pm_opp_set_supported_hw(dev, &val, 1);
+ }
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 7f45486b6650b..3ba3ae9749bec 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -495,8 +495,10 @@ static int msm_drm_init(struct device *dev, struct drm_driver *drv)
+ if (!dev->dma_parms) {
+ dev->dma_parms = devm_kzalloc(dev, sizeof(*dev->dma_parms),
+ GFP_KERNEL);
+- if (!dev->dma_parms)
+- return -ENOMEM;
++ if (!dev->dma_parms) {
++ ret = -ENOMEM;
++ goto err_msm_uninit;
++ }
+ }
+ dma_set_max_seg_size(dev, DMA_BIT_MASK(32));
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index e06ea8c8184cb..1bb0a9f6fa730 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -909,8 +909,10 @@ nv50_mstc_detect(struct drm_connector *connector, bool force)
+ return connector_status_disconnected;
+
+ ret = pm_runtime_get_sync(connector->dev->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(connector->dev->dev);
+ return connector_status_disconnected;
++ }
+
+ conn_status = drm_dp_mst_detect_port(connector, mstc->port->mgr,
+ mstc->port);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+index 9635704a1d864..4561a786fab07 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c
++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+@@ -161,8 +161,11 @@ nouveau_debugfs_pstate_set(struct file *file, const char __user *ubuf,
+ }
+
+ ret = pm_runtime_get_sync(drm->dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(drm->dev);
+ return ret;
++ }
++
+ ret = nvif_mthd(ctrl, NVIF_CONTROL_PSTATE_USER, &args, sizeof(args));
+ pm_runtime_put_autosuspend(drm->dev);
+ if (ret < 0)
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index 791f970714ed6..a98fccb0d32f9 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -82,8 +82,10 @@ nouveau_gem_object_open(struct drm_gem_object *gem, struct drm_file *file_priv)
+ return ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret < 0 && ret != -EACCES)
++ if (ret < 0 && ret != -EACCES) {
++ pm_runtime_put_autosuspend(dev);
+ goto out;
++ }
+
+ ret = nouveau_vma_new(nvbo, &cli->vmm, &vma);
+ pm_runtime_mark_last_busy(dev);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowpci.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowpci.c
+index 9b91da09dc5f8..8d9812a51ef63 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowpci.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowpci.c
+@@ -101,9 +101,13 @@ platform_init(struct nvkm_bios *bios, const char *name)
+ else
+ return ERR_PTR(-ENODEV);
+
++ if (!pdev->rom || pdev->romlen == 0)
++ return ERR_PTR(-ENODEV);
++
+ if ((priv = kmalloc(sizeof(*priv), GFP_KERNEL))) {
++ priv->size = pdev->romlen;
+ if (ret = -ENODEV,
+- (priv->rom = pci_platform_rom(pdev, &priv->size)))
++ (priv->rom = ioremap(pdev->rom, pdev->romlen)))
+ return priv;
+ kfree(priv);
+ }
+@@ -111,11 +115,20 @@ platform_init(struct nvkm_bios *bios, const char *name)
+ return ERR_PTR(ret);
+ }
+
++static void
++platform_fini(void *data)
++{
++ struct priv *priv = data;
++
++ iounmap(priv->rom);
++ kfree(priv);
++}
++
+ const struct nvbios_source
+ nvbios_platform = {
+ .name = "PLATFORM",
+ .init = platform_init,
+- .fini = (void(*)(void *))kfree,
++ .fini = platform_fini,
+ .read = pcirom_read,
+ .rw = true,
+ };
+diff --git a/drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c b/drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c
+index 3bfb95d230e0e..d8fb686c1fda9 100644
+--- a/drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c
++++ b/drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c
+@@ -193,7 +193,7 @@ static int __init omapdss_boot_init(void)
+ dss = of_find_matching_node(NULL, omapdss_of_match);
+
+ if (dss == NULL || !of_device_is_available(dss))
+- return 0;
++ goto put_node;
+
+ omapdss_walk_device(dss, true);
+
+@@ -218,6 +218,8 @@ static int __init omapdss_boot_init(void)
+ kfree(n);
+ }
+
++put_node:
++ of_node_put(dss);
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
+index 04c0ed41374f1..dd0528cf98183 100644
+--- a/drivers/gpu/drm/radeon/radeon_bios.c
++++ b/drivers/gpu/drm/radeon/radeon_bios.c
+@@ -104,25 +104,33 @@ static bool radeon_read_bios(struct radeon_device *rdev)
+
+ static bool radeon_read_platform_bios(struct radeon_device *rdev)
+ {
+- uint8_t __iomem *bios;
+- size_t size;
++ phys_addr_t rom = rdev->pdev->rom;
++ size_t romlen = rdev->pdev->romlen;
++ void __iomem *bios;
+
+ rdev->bios = NULL;
+
+- bios = pci_platform_rom(rdev->pdev, &size);
+- if (!bios) {
++ if (!rom || romlen == 0)
+ return false;
+- }
+
+- if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
++ rdev->bios = kzalloc(romlen, GFP_KERNEL);
++ if (!rdev->bios)
+ return false;
+- }
+- rdev->bios = kmemdup(bios, size, GFP_KERNEL);
+- if (rdev->bios == NULL) {
+- return false;
+- }
++
++ bios = ioremap(rom, romlen);
++ if (!bios)
++ goto free_bios;
++
++ memcpy_fromio(rdev->bios, bios, romlen);
++ iounmap(bios);
++
++ if (rdev->bios[0] != 0x55 || rdev->bios[1] != 0xaa)
++ goto free_bios;
+
+ return true;
++free_bios:
++ kfree(rdev->bios);
++ return false;
+ }
+
+ #ifdef CONFIG_ACPI
+diff --git a/drivers/gpu/drm/sun4i/sun8i_csc.h b/drivers/gpu/drm/sun4i/sun8i_csc.h
+index 880e8fbb08556..242752b2d328c 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_csc.h
++++ b/drivers/gpu/drm/sun4i/sun8i_csc.h
+@@ -14,7 +14,7 @@ struct sun8i_mixer;
+
+ /* VI channel CSC units offsets */
+ #define CCSC00_OFFSET 0xAA050
+-#define CCSC01_OFFSET 0xFA000
++#define CCSC01_OFFSET 0xFA050
+ #define CCSC10_OFFSET 0xA0000
+ #define CCSC11_OFFSET 0xF0000
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 86b98856756d9..1161662664577 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1134,6 +1134,7 @@ static int vc4_hdmi_audio_init(struct vc4_hdmi *hdmi)
+ card->num_links = 1;
+ card->name = "vc4-hdmi";
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+
+ /*
+ * Be careful, snd_soc_register_card() calls dev_set_drvdata() and
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index f225bef1e043c..41dd0a08a625c 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -1292,8 +1292,8 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
+
+ /* create pre-declared device nodes */
+ of_i2c_register_devices(adap);
+- i2c_acpi_register_devices(adap);
+ i2c_acpi_install_space_handler(adap);
++ i2c_acpi_register_devices(adap);
+
+ if (adap->nr < __i2c_first_dynamic_bus_num)
+ i2c_scan_static_board_info(adap);
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 64f206e11d497..4ebf63360a697 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1100,14 +1100,22 @@ retest:
+ break;
+ }
+
+- spin_lock_irq(&cm.lock);
++ spin_lock_irq(&cm_id_priv->lock);
++ spin_lock(&cm.lock);
++ /* Required for cleanup paths related cm_req_handler() */
++ if (cm_id_priv->timewait_info) {
++ cm_cleanup_timewait(cm_id_priv->timewait_info);
++ kfree(cm_id_priv->timewait_info);
++ cm_id_priv->timewait_info = NULL;
++ }
+ if (!list_empty(&cm_id_priv->altr_list) &&
+ (!cm_id_priv->altr_send_port_not_ready))
+ list_del(&cm_id_priv->altr_list);
+ if (!list_empty(&cm_id_priv->prim_list) &&
+ (!cm_id_priv->prim_send_port_not_ready))
+ list_del(&cm_id_priv->prim_list);
+- spin_unlock_irq(&cm.lock);
++ spin_unlock(&cm.lock);
++ spin_unlock_irq(&cm_id_priv->lock);
+
+ cm_free_id(cm_id->local_id);
+ cm_deref_id(cm_id_priv);
+@@ -1424,7 +1432,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
+ /* Verify that we're not in timewait. */
+ cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+ spin_lock_irqsave(&cm_id_priv->lock, flags);
+- if (cm_id->state != IB_CM_IDLE) {
++ if (cm_id->state != IB_CM_IDLE || WARN_ON(cm_id_priv->timewait_info)) {
+ spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+ ret = -EINVAL;
+ goto out;
+@@ -1442,12 +1450,12 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
+ param->ppath_sgid_attr, &cm_id_priv->av,
+ cm_id_priv);
+ if (ret)
+- goto error1;
++ goto out;
+ if (param->alternate_path) {
+ ret = cm_init_av_by_path(param->alternate_path, NULL,
+ &cm_id_priv->alt_av, cm_id_priv);
+ if (ret)
+- goto error1;
++ goto out;
+ }
+ cm_id->service_id = param->service_id;
+ cm_id->service_mask = ~cpu_to_be64(0);
+@@ -1465,7 +1473,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
+
+ ret = cm_alloc_msg(cm_id_priv, &cm_id_priv->msg);
+ if (ret)
+- goto error1;
++ goto out;
+
+ req_msg = (struct cm_req_msg *) cm_id_priv->msg->mad;
+ cm_format_req(req_msg, cm_id_priv, param);
+@@ -1488,7 +1496,6 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
+ return 0;
+
+ error2: cm_free_msg(cm_id_priv->msg);
+-error1: kfree(cm_id_priv->timewait_info);
+ out: return ret;
+ }
+ EXPORT_SYMBOL(ib_send_cm_req);
+@@ -1973,7 +1980,7 @@ static int cm_req_handler(struct cm_work *work)
+ pr_debug("%s: local_id %d, no listen_cm_id_priv\n", __func__,
+ be32_to_cpu(cm_id->local_id));
+ ret = -EINVAL;
+- goto free_timeinfo;
++ goto destroy;
+ }
+
+ cm_id_priv->id.cm_handler = listen_cm_id_priv->id.cm_handler;
+@@ -2057,8 +2064,6 @@ static int cm_req_handler(struct cm_work *work)
+ rejected:
+ atomic_dec(&cm_id_priv->refcount);
+ cm_deref_id(listen_cm_id_priv);
+-free_timeinfo:
+- kfree(cm_id_priv->timewait_info);
+ destroy:
+ ib_destroy_cm_id(cm_id);
+ return ret;
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 16145b0a14583..3fd3dfa3478b7 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -3293,7 +3293,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ if (raddr->sin_addr.s_addr == htonl(INADDR_ANY)) {
+ err = pick_local_ipaddrs(dev, cm_id);
+ if (err)
+- goto fail2;
++ goto fail3;
+ }
+
+ /* find a route */
+@@ -3315,7 +3315,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ if (ipv6_addr_type(&raddr6->sin6_addr) == IPV6_ADDR_ANY) {
+ err = pick_local_ip6addrs(dev, cm_id);
+ if (err)
+- goto fail2;
++ goto fail3;
+ }
+
+ /* find a route */
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+index 4321b9e3dbb4b..0273d0404e740 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+@@ -2071,9 +2071,9 @@ static int i40iw_addr_resolve_neigh_ipv6(struct i40iw_device *iwdev,
+ dst = i40iw_get_dst_ipv6(&src_addr, &dst_addr);
+ if (!dst || dst->error) {
+ if (dst) {
+- dst_release(dst);
+ i40iw_pr_err("ip6_route_output returned dst->error = %d\n",
+ dst->error);
++ dst_release(dst);
+ }
+ return rc;
+ }
+diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+index 2566715773675..e908dfbaa1378 100644
+--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c
++++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+@@ -460,10 +460,10 @@ qedr_addr6_resolve(struct qedr_dev *dev,
+
+ if ((!dst) || dst->error) {
+ if (dst) {
+- dst_release(dst);
+ DP_ERR(dev,
+ "ip6_route_output returned dst->error = %d\n",
+ dst->error);
++ dst_release(dst);
+ }
+ return -EINVAL;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index 94dedabe648c2..6589ff51eaf5c 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -121,6 +121,8 @@ static void rxe_init_device_param(struct rxe_dev *rxe)
+ rxe->attr.max_fast_reg_page_list_len = RXE_MAX_FMR_PAGE_LIST_LEN;
+ rxe->attr.max_pkeys = RXE_MAX_PKEYS;
+ rxe->attr.local_ca_ack_delay = RXE_LOCAL_CA_ACK_DELAY;
++ addrconf_addr_eui48((unsigned char *)&rxe->attr.sys_image_guid,
++ rxe->ndev->dev_addr);
+
+ rxe->max_ucontext = RXE_MAX_UCONTEXT;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 230697fa31fe3..8a22ab8b29e9b 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -583,15 +583,16 @@ int rxe_qp_from_attr(struct rxe_qp *qp, struct ib_qp_attr *attr, int mask,
+ int err;
+
+ if (mask & IB_QP_MAX_QP_RD_ATOMIC) {
+- int max_rd_atomic = __roundup_pow_of_two(attr->max_rd_atomic);
++ int max_rd_atomic = attr->max_rd_atomic ?
++ roundup_pow_of_two(attr->max_rd_atomic) : 0;
+
+ qp->attr.max_rd_atomic = max_rd_atomic;
+ atomic_set(&qp->req.rd_atomic, max_rd_atomic);
+ }
+
+ if (mask & IB_QP_MAX_DEST_RD_ATOMIC) {
+- int max_dest_rd_atomic =
+- __roundup_pow_of_two(attr->max_dest_rd_atomic);
++ int max_dest_rd_atomic = attr->max_dest_rd_atomic ?
++ roundup_pow_of_two(attr->max_dest_rd_atomic) : 0;
+
+ qp->attr.max_dest_rd_atomic = max_dest_rd_atomic;
+
+diff --git a/drivers/leds/leds-mlxreg.c b/drivers/leds/leds-mlxreg.c
+index 1ee48cb21df95..022e973dc7c31 100644
+--- a/drivers/leds/leds-mlxreg.c
++++ b/drivers/leds/leds-mlxreg.c
+@@ -209,8 +209,8 @@ static int mlxreg_led_config(struct mlxreg_led_priv_data *priv)
+ brightness = LED_OFF;
+ led_data->base_color = MLXREG_LED_GREEN_SOLID;
+ }
+- sprintf(led_data->led_cdev_name, "%s:%s", "mlxreg",
+- data->label);
++ snprintf(led_data->led_cdev_name, sizeof(led_data->led_cdev_name),
++ "mlxreg:%s", data->label);
+ led_cdev->name = led_data->led_cdev_name;
+ led_cdev->brightness = brightness;
+ led_cdev->max_brightness = LED_ON;
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index 1cc6ae3e058c6..6a380ed4919a0 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -585,6 +585,7 @@ struct cache_set {
+ */
+ wait_queue_head_t btree_cache_wait;
+ struct task_struct *btree_cache_alloc_lock;
++ spinlock_t btree_cannibalize_lock;
+
+ /*
+ * When we free a btree node, we increment the gen of the bucket the
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index d320574b9a4c8..e388e7bb7b5db 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -876,15 +876,17 @@ out:
+
+ static int mca_cannibalize_lock(struct cache_set *c, struct btree_op *op)
+ {
+- struct task_struct *old;
+-
+- old = cmpxchg(&c->btree_cache_alloc_lock, NULL, current);
+- if (old && old != current) {
++ spin_lock(&c->btree_cannibalize_lock);
++ if (likely(c->btree_cache_alloc_lock == NULL)) {
++ c->btree_cache_alloc_lock = current;
++ } else if (c->btree_cache_alloc_lock != current) {
+ if (op)
+ prepare_to_wait(&c->btree_cache_wait, &op->wait,
+ TASK_UNINTERRUPTIBLE);
++ spin_unlock(&c->btree_cannibalize_lock);
+ return -EINTR;
+ }
++ spin_unlock(&c->btree_cannibalize_lock);
+
+ return 0;
+ }
+@@ -919,10 +921,12 @@ static struct btree *mca_cannibalize(struct cache_set *c, struct btree_op *op,
+ */
+ static void bch_cannibalize_unlock(struct cache_set *c)
+ {
++ spin_lock(&c->btree_cannibalize_lock);
+ if (c->btree_cache_alloc_lock == current) {
+ c->btree_cache_alloc_lock = NULL;
+ wake_up(&c->btree_cache_wait);
+ }
++ spin_unlock(&c->btree_cannibalize_lock);
+ }
+
+ static struct btree *mca_alloc(struct cache_set *c, struct btree_op *op,
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 825bfde10c694..7787ec42f81e1 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1737,6 +1737,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
+ sema_init(&c->sb_write_mutex, 1);
+ mutex_init(&c->bucket_lock);
+ init_waitqueue_head(&c->btree_cache_wait);
++ spin_lock_init(&c->btree_cannibalize_lock);
+ init_waitqueue_head(&c->bucket_wait);
+ init_waitqueue_head(&c->gc_wait);
+ sema_init(&c->uuid_write_mutex, 1);
+diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
+index 097c42d3f8c26..df0c7243eafe4 100644
+--- a/drivers/media/dvb-frontends/tda10071.c
++++ b/drivers/media/dvb-frontends/tda10071.c
+@@ -483,10 +483,11 @@ static int tda10071_read_status(struct dvb_frontend *fe, enum fe_status *status)
+ goto error;
+
+ if (dev->delivery_system == SYS_DVBS) {
+- dev->dvbv3_ber = buf[0] << 24 | buf[1] << 16 |
+- buf[2] << 8 | buf[3] << 0;
+- dev->post_bit_error += buf[0] << 24 | buf[1] << 16 |
+- buf[2] << 8 | buf[3] << 0;
++ u32 bit_error = buf[0] << 24 | buf[1] << 16 |
++ buf[2] << 8 | buf[3] << 0;
++
++ dev->dvbv3_ber = bit_error;
++ dev->post_bit_error += bit_error;
+ c->post_bit_error.stat[0].scale = FE_SCALE_COUNTER;
+ c->post_bit_error.stat[0].uvalue = dev->post_bit_error;
+ dev->block_error += buf[4] << 8 | buf[5] << 0;
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index 4731e1c72f960..0a434bdce3b3b 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -2337,11 +2337,12 @@ smiapp_sysfs_nvm_read(struct device *dev, struct device_attribute *attr,
+ if (rval < 0) {
+ if (rval != -EBUSY && rval != -EAGAIN)
+ pm_runtime_set_active(&client->dev);
+- pm_runtime_put(&client->dev);
++ pm_runtime_put_noidle(&client->dev);
+ return -ENODEV;
+ }
+
+ if (smiapp_read_nvm(sensor, sensor->nvm)) {
++ pm_runtime_put(&client->dev);
+ dev_err(&client->dev, "nvm read failed\n");
+ return -ENODEV;
+ }
+diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
+index ed518b1f82e4a..d04ed438a45de 100644
+--- a/drivers/media/media-device.c
++++ b/drivers/media/media-device.c
+@@ -568,6 +568,38 @@ static void media_device_release(struct media_devnode *devnode)
+ dev_dbg(devnode->parent, "Media device released\n");
+ }
+
++static void __media_device_unregister_entity(struct media_entity *entity)
++{
++ struct media_device *mdev = entity->graph_obj.mdev;
++ struct media_link *link, *tmp;
++ struct media_interface *intf;
++ unsigned int i;
++
++ ida_free(&mdev->entity_internal_idx, entity->internal_idx);
++
++ /* Remove all interface links pointing to this entity */
++ list_for_each_entry(intf, &mdev->interfaces, graph_obj.list) {
++ list_for_each_entry_safe(link, tmp, &intf->links, list) {
++ if (link->entity == entity)
++ __media_remove_intf_link(link);
++ }
++ }
++
++ /* Remove all data links that belong to this entity */
++ __media_entity_remove_links(entity);
++
++ /* Remove all pads that belong to this entity */
++ for (i = 0; i < entity->num_pads; i++)
++ media_gobj_destroy(&entity->pads[i].graph_obj);
++
++ /* Remove the entity */
++ media_gobj_destroy(&entity->graph_obj);
++
++ /* invoke entity_notify callbacks to handle entity removal?? */
++
++ entity->graph_obj.mdev = NULL;
++}
++
+ /**
+ * media_device_register_entity - Register an entity with a media device
+ * @mdev: The media device
+@@ -625,6 +657,7 @@ int __must_check media_device_register_entity(struct media_device *mdev,
+ */
+ ret = media_graph_walk_init(&new, mdev);
+ if (ret) {
++ __media_device_unregister_entity(entity);
+ mutex_unlock(&mdev->graph_mutex);
+ return ret;
+ }
+@@ -637,38 +670,6 @@ int __must_check media_device_register_entity(struct media_device *mdev,
+ }
+ EXPORT_SYMBOL_GPL(media_device_register_entity);
+
+-static void __media_device_unregister_entity(struct media_entity *entity)
+-{
+- struct media_device *mdev = entity->graph_obj.mdev;
+- struct media_link *link, *tmp;
+- struct media_interface *intf;
+- unsigned int i;
+-
+- ida_free(&mdev->entity_internal_idx, entity->internal_idx);
+-
+- /* Remove all interface links pointing to this entity */
+- list_for_each_entry(intf, &mdev->interfaces, graph_obj.list) {
+- list_for_each_entry_safe(link, tmp, &intf->links, list) {
+- if (link->entity == entity)
+- __media_remove_intf_link(link);
+- }
+- }
+-
+- /* Remove all data links that belong to this entity */
+- __media_entity_remove_links(entity);
+-
+- /* Remove all pads that belong to this entity */
+- for (i = 0; i < entity->num_pads; i++)
+- media_gobj_destroy(&entity->pads[i].graph_obj);
+-
+- /* Remove the entity */
+- media_gobj_destroy(&entity->graph_obj);
+-
+- /* invoke entity_notify callbacks to handle entity removal?? */
+-
+- entity->graph_obj.mdev = NULL;
+-}
+-
+ void media_device_unregister_entity(struct media_entity *entity)
+ {
+ struct media_device *mdev = entity->graph_obj.mdev;
+diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
+index be3155275a6ba..d945323fc437d 100644
+--- a/drivers/media/platform/ti-vpe/cal.c
++++ b/drivers/media/platform/ti-vpe/cal.c
+@@ -684,12 +684,13 @@ static void pix_proc_config(struct cal_ctx *ctx)
+ }
+
+ static void cal_wr_dma_config(struct cal_ctx *ctx,
+- unsigned int width)
++ unsigned int width, unsigned int height)
+ {
+ u32 val;
+
+ val = reg_read(ctx->dev, CAL_WR_DMA_CTRL(ctx->csi2_port));
+ set_field(&val, ctx->csi2_port, CAL_WR_DMA_CTRL_CPORT_MASK);
++ set_field(&val, height, CAL_WR_DMA_CTRL_YSIZE_MASK);
+ set_field(&val, CAL_WR_DMA_CTRL_DTAG_PIX_DAT,
+ CAL_WR_DMA_CTRL_DTAG_MASK);
+ set_field(&val, CAL_WR_DMA_CTRL_MODE_CONST,
+@@ -1315,7 +1316,8 @@ static int cal_start_streaming(struct vb2_queue *vq, unsigned int count)
+ csi2_lane_config(ctx);
+ csi2_ctx_config(ctx);
+ pix_proc_config(ctx);
+- cal_wr_dma_config(ctx, ctx->v_fmt.fmt.pix.bytesperline);
++ cal_wr_dma_config(ctx, ctx->v_fmt.fmt.pix.bytesperline,
++ ctx->v_fmt.fmt.pix.height);
+ cal_wr_dma_addr(ctx, addr);
+ csi2_ppi_enable(ctx);
+
+diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
+index 19c6a0354ce00..b84a6f6548610 100644
+--- a/drivers/media/usb/go7007/go7007-usb.c
++++ b/drivers/media/usb/go7007/go7007-usb.c
+@@ -1052,6 +1052,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
+ struct go7007_usb *usb;
+ const struct go7007_usb_board *board;
+ struct usb_device *usbdev = interface_to_usbdev(intf);
++ struct usb_host_endpoint *ep;
+ unsigned num_i2c_devs;
+ char *name;
+ int video_pipe, i, v_urb_len;
+@@ -1148,7 +1149,8 @@ static int go7007_usb_probe(struct usb_interface *intf,
+ if (usb->intr_urb->transfer_buffer == NULL)
+ goto allocfail;
+
+- if (go->board_id == GO7007_BOARDID_SENSORAY_2250)
++ ep = usb->usbdev->ep_in[4];
++ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
+ usb_fill_bulk_urb(usb->intr_urb, usb->usbdev,
+ usb_rcvbulkpipe(usb->usbdev, 4),
+ usb->intr_urb->transfer_buffer, 2*sizeof(u16),
+diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
+index 182973df1aed4..77c965c6a65f1 100644
+--- a/drivers/mfd/mfd-core.c
++++ b/drivers/mfd/mfd-core.c
+@@ -32,6 +32,11 @@ int mfd_cell_enable(struct platform_device *pdev)
+ const struct mfd_cell *cell = mfd_get_cell(pdev);
+ int err = 0;
+
++ if (!cell->enable) {
++ dev_dbg(&pdev->dev, "No .enable() call-back registered\n");
++ return 0;
++ }
++
+ /* only call enable hook if the cell wasn't previously enabled */
+ if (atomic_inc_return(cell->usage_count) == 1)
+ err = cell->enable(pdev);
+@@ -49,6 +54,11 @@ int mfd_cell_disable(struct platform_device *pdev)
+ const struct mfd_cell *cell = mfd_get_cell(pdev);
+ int err = 0;
+
++ if (!cell->disable) {
++ dev_dbg(&pdev->dev, "No .disable() call-back registered\n");
++ return 0;
++ }
++
+ /* only disable if no other clients are using it */
+ if (atomic_dec_return(cell->usage_count) == 0)
+ err = cell->disable(pdev);
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index 5ca53e225382d..4b18034537f53 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -300,7 +300,7 @@ static void mmc_manage_enhanced_area(struct mmc_card *card, u8 *ext_csd)
+ }
+ }
+
+-static void mmc_part_add(struct mmc_card *card, unsigned int size,
++static void mmc_part_add(struct mmc_card *card, u64 size,
+ unsigned int part_cfg, char *name, int idx, bool ro,
+ int area_type)
+ {
+@@ -316,7 +316,7 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd)
+ {
+ int idx;
+ u8 hc_erase_grp_sz, hc_wp_grp_sz;
+- unsigned int part_size;
++ u64 part_size;
+
+ /*
+ * General purpose partition feature support --
+@@ -346,8 +346,7 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd)
+ (ext_csd[EXT_CSD_GP_SIZE_MULT + idx * 3 + 1]
+ << 8) +
+ ext_csd[EXT_CSD_GP_SIZE_MULT + idx * 3];
+- part_size *= (size_t)(hc_erase_grp_sz *
+- hc_wp_grp_sz);
++ part_size *= (hc_erase_grp_sz * hc_wp_grp_sz);
+ mmc_part_add(card, part_size << 19,
+ EXT_CSD_PART_CONFIG_ACC_GP0 + idx,
+ "gp%d", idx, false,
+@@ -365,7 +364,7 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd)
+ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd)
+ {
+ int err = 0, idx;
+- unsigned int part_size;
++ u64 part_size;
+ struct device_node *np;
+ bool broken_hpi = false;
+
+diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
+index 1dbc9554a0786..3ab75d3e2ce32 100644
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -727,7 +727,6 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd)
+ kfree(mtd->eraseregions);
+ kfree(mtd);
+ kfree(cfi->cmdset_priv);
+- kfree(cfi->cfiq);
+ return NULL;
+ }
+
+diff --git a/drivers/mtd/cmdlinepart.c b/drivers/mtd/cmdlinepart.c
+index 3ea44cff9b759..c29205ee82e20 100644
+--- a/drivers/mtd/cmdlinepart.c
++++ b/drivers/mtd/cmdlinepart.c
+@@ -231,12 +231,29 @@ static int mtdpart_setup_real(char *s)
+ struct cmdline_mtd_partition *this_mtd;
+ struct mtd_partition *parts;
+ int mtd_id_len, num_parts;
+- char *p, *mtd_id;
++ char *p, *mtd_id, *semicol;
++
++ /*
++ * Replace the first ';' by a NULL char so strrchr can work
++ * properly.
++ */
++ semicol = strchr(s, ';');
++ if (semicol)
++ *semicol = '\0';
+
+ mtd_id = s;
+
+- /* fetch <mtd-id> */
+- p = strchr(s, ':');
++ /*
++ * fetch <mtd-id>. We use strrchr to ignore all ':' that could
++ * be present in the MTD name, only the last one is interpreted
++ * as an <mtd-id>/<part-definition> separator.
++ */
++ p = strrchr(s, ':');
++
++ /* Restore the ';' now. */
++ if (semicol)
++ *semicol = ';';
++
+ if (!p) {
+ pr_err("no mtd-id\n");
+ return -EINVAL;
+diff --git a/drivers/mtd/nand/raw/omap_elm.c b/drivers/mtd/nand/raw/omap_elm.c
+index a3f32f939cc17..6736777a41567 100644
+--- a/drivers/mtd/nand/raw/omap_elm.c
++++ b/drivers/mtd/nand/raw/omap_elm.c
+@@ -421,6 +421,7 @@ static int elm_probe(struct platform_device *pdev)
+ pm_runtime_enable(&pdev->dev);
+ if (pm_runtime_get_sync(&pdev->dev) < 0) {
+ ret = -EINVAL;
++ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ dev_err(&pdev->dev, "can't enable clock\n");
+ return ret;
+diff --git a/drivers/mtd/ubi/fastmap-wl.c b/drivers/mtd/ubi/fastmap-wl.c
+index 98f7d6be8d1fc..e08f6b4637dda 100644
+--- a/drivers/mtd/ubi/fastmap-wl.c
++++ b/drivers/mtd/ubi/fastmap-wl.c
+@@ -48,6 +48,13 @@ static struct ubi_wl_entry *find_anchor_wl_entry(struct rb_root *root)
+ return victim;
+ }
+
++static inline void return_unused_peb(struct ubi_device *ubi,
++ struct ubi_wl_entry *e)
++{
++ wl_tree_add(e, &ubi->free);
++ ubi->free_count++;
++}
++
+ /**
+ * return_unused_pool_pebs - returns unused PEB to the free tree.
+ * @ubi: UBI device description object
+@@ -61,23 +68,10 @@ static void return_unused_pool_pebs(struct ubi_device *ubi,
+
+ for (i = pool->used; i < pool->size; i++) {
+ e = ubi->lookuptbl[pool->pebs[i]];
+- wl_tree_add(e, &ubi->free);
+- ubi->free_count++;
++ return_unused_peb(ubi, e);
+ }
+ }
+
+-static int anchor_pebs_available(struct rb_root *root)
+-{
+- struct rb_node *p;
+- struct ubi_wl_entry *e;
+-
+- ubi_rb_for_each_entry(p, e, root, u.rb)
+- if (e->pnum < UBI_FM_MAX_START)
+- return 1;
+-
+- return 0;
+-}
+-
+ /**
+ * ubi_wl_get_fm_peb - find a physical erase block with a given maximal number.
+ * @ubi: UBI device description object
+@@ -286,8 +280,26 @@ static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi)
+ int ubi_ensure_anchor_pebs(struct ubi_device *ubi)
+ {
+ struct ubi_work *wrk;
++ struct ubi_wl_entry *anchor;
+
+ spin_lock(&ubi->wl_lock);
++
++ /* Do we already have an anchor? */
++ if (ubi->fm_anchor) {
++ spin_unlock(&ubi->wl_lock);
++ return 0;
++ }
++
++ /* See if we can find an anchor PEB on the list of free PEBs */
++ anchor = ubi_wl_get_fm_peb(ubi, 1);
++ if (anchor) {
++ ubi->fm_anchor = anchor;
++ spin_unlock(&ubi->wl_lock);
++ return 0;
++ }
++
++ /* No luck, trigger wear leveling to produce a new anchor PEB */
++ ubi->fm_do_produce_anchor = 1;
+ if (ubi->wl_scheduled) {
+ spin_unlock(&ubi->wl_lock);
+ return 0;
+@@ -303,7 +315,6 @@ int ubi_ensure_anchor_pebs(struct ubi_device *ubi)
+ return -ENOMEM;
+ }
+
+- wrk->anchor = 1;
+ wrk->func = &wear_leveling_worker;
+ __schedule_ubi_work(ubi, wrk);
+ return 0;
+@@ -365,6 +376,11 @@ static void ubi_fastmap_close(struct ubi_device *ubi)
+ return_unused_pool_pebs(ubi, &ubi->fm_pool);
+ return_unused_pool_pebs(ubi, &ubi->fm_wl_pool);
+
++ if (ubi->fm_anchor) {
++ return_unused_peb(ubi, ubi->fm_anchor);
++ ubi->fm_anchor = NULL;
++ }
++
+ if (ubi->fm) {
+ for (i = 0; i < ubi->fm->used_blocks; i++)
+ kfree(ubi->fm->e[i]);
+diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
+index 8e292992f84c7..b88ef875236cc 100644
+--- a/drivers/mtd/ubi/fastmap.c
++++ b/drivers/mtd/ubi/fastmap.c
+@@ -1552,14 +1552,6 @@ int ubi_update_fastmap(struct ubi_device *ubi)
+ return 0;
+ }
+
+- ret = ubi_ensure_anchor_pebs(ubi);
+- if (ret) {
+- up_write(&ubi->fm_eba_sem);
+- up_write(&ubi->work_sem);
+- up_write(&ubi->fm_protect);
+- return ret;
+- }
+-
+ new_fm = kzalloc(sizeof(*new_fm), GFP_KERNEL);
+ if (!new_fm) {
+ up_write(&ubi->fm_eba_sem);
+@@ -1630,7 +1622,8 @@ int ubi_update_fastmap(struct ubi_device *ubi)
+ }
+
+ spin_lock(&ubi->wl_lock);
+- tmp_e = ubi_wl_get_fm_peb(ubi, 1);
++ tmp_e = ubi->fm_anchor;
++ ubi->fm_anchor = NULL;
+ spin_unlock(&ubi->wl_lock);
+
+ if (old_fm) {
+@@ -1682,6 +1675,9 @@ out_unlock:
+ up_write(&ubi->work_sem);
+ up_write(&ubi->fm_protect);
+ kfree(old_fm);
++
++ ubi_ensure_anchor_pebs(ubi);
++
+ return ret;
+
+ err:
+diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
+index d47b9e436e673..d248ec371cc17 100644
+--- a/drivers/mtd/ubi/ubi.h
++++ b/drivers/mtd/ubi/ubi.h
+@@ -504,6 +504,8 @@ struct ubi_debug_info {
+ * @fm_work: fastmap work queue
+ * @fm_work_scheduled: non-zero if fastmap work was scheduled
+ * @fast_attach: non-zero if UBI was attached by fastmap
++ * @fm_anchor: The next anchor PEB to use for fastmap
++ * @fm_do_produce_anchor: If true produce an anchor PEB in wl
+ *
+ * @used: RB-tree of used physical eraseblocks
+ * @erroneous: RB-tree of erroneous used physical eraseblocks
+@@ -612,6 +614,8 @@ struct ubi_device {
+ struct work_struct fm_work;
+ int fm_work_scheduled;
+ int fast_attach;
++ struct ubi_wl_entry *fm_anchor;
++ int fm_do_produce_anchor;
+
+ /* Wear-leveling sub-system's stuff */
+ struct rb_root used;
+@@ -802,7 +806,6 @@ struct ubi_attach_info {
+ * @vol_id: the volume ID on which this erasure is being performed
+ * @lnum: the logical eraseblock number
+ * @torture: if the physical eraseblock has to be tortured
+- * @anchor: produce a anchor PEB to by used by fastmap
+ *
+ * The @func pointer points to the worker function. If the @shutdown argument is
+ * not zero, the worker has to free the resources and exit immediately as the
+@@ -818,7 +821,6 @@ struct ubi_work {
+ int vol_id;
+ int lnum;
+ int torture;
+- int anchor;
+ };
+
+ #include "debug.h"
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 6f2ac865ff05e..80d64d7e7a8be 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -331,13 +331,6 @@ static struct ubi_wl_entry *find_wl_entry(struct ubi_device *ubi,
+ }
+ }
+
+- /* If no fastmap has been written and this WL entry can be used
+- * as anchor PEB, hold it back and return the second best WL entry
+- * such that fastmap can use the anchor PEB later. */
+- if (prev_e && !ubi->fm_disabled &&
+- !ubi->fm && e->pnum < UBI_FM_MAX_START)
+- return prev_e;
+-
+ return e;
+ }
+
+@@ -648,9 +641,6 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ {
+ int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
+ int erase = 0, keep = 0, vol_id = -1, lnum = -1;
+-#ifdef CONFIG_MTD_UBI_FASTMAP
+- int anchor = wrk->anchor;
+-#endif
+ struct ubi_wl_entry *e1, *e2;
+ struct ubi_vid_io_buf *vidb;
+ struct ubi_vid_hdr *vid_hdr;
+@@ -690,11 +680,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ }
+
+ #ifdef CONFIG_MTD_UBI_FASTMAP
+- /* Check whether we need to produce an anchor PEB */
+- if (!anchor)
+- anchor = !anchor_pebs_available(&ubi->free);
+-
+- if (anchor) {
++ if (ubi->fm_do_produce_anchor) {
+ e1 = find_anchor_wl_entry(&ubi->used);
+ if (!e1)
+ goto out_cancel;
+@@ -705,6 +691,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ self_check_in_wl_tree(ubi, e1, &ubi->used);
+ rb_erase(&e1->u.rb, &ubi->used);
+ dbg_wl("anchor-move PEB %d to PEB %d", e1->pnum, e2->pnum);
++ ubi->fm_do_produce_anchor = 0;
+ } else if (!ubi->scrub.rb_node) {
+ #else
+ if (!ubi->scrub.rb_node) {
+@@ -1037,7 +1024,6 @@ static int ensure_wear_leveling(struct ubi_device *ubi, int nested)
+ goto out_cancel;
+ }
+
+- wrk->anchor = 0;
+ wrk->func = &wear_leveling_worker;
+ if (nested)
+ __schedule_ubi_work(ubi, wrk);
+@@ -1079,8 +1065,15 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)
+ err = sync_erase(ubi, e, wl_wrk->torture);
+ if (!err) {
+ spin_lock(&ubi->wl_lock);
+- wl_tree_add(e, &ubi->free);
+- ubi->free_count++;
++
++ if (!ubi->fm_anchor && e->pnum < UBI_FM_MAX_START) {
++ ubi->fm_anchor = e;
++ ubi->fm_do_produce_anchor = 0;
++ } else {
++ wl_tree_add(e, &ubi->free);
++ ubi->free_count++;
++ }
++
+ spin_unlock(&ubi->wl_lock);
+
+ /*
+@@ -1724,6 +1717,9 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
+ if (err)
+ goto out_free;
+
++#ifdef CONFIG_MTD_UBI_FASTMAP
++ ubi_ensure_anchor_pebs(ubi);
++#endif
+ return 0;
+
+ out_free:
+diff --git a/drivers/mtd/ubi/wl.h b/drivers/mtd/ubi/wl.h
+index a9e2d669acd81..c93a532937863 100644
+--- a/drivers/mtd/ubi/wl.h
++++ b/drivers/mtd/ubi/wl.h
+@@ -2,7 +2,6 @@
+ #ifndef UBI_WL_H
+ #define UBI_WL_H
+ #ifdef CONFIG_MTD_UBI_FASTMAP
+-static int anchor_pebs_available(struct rb_root *root);
+ static void update_fastmap_work_fn(struct work_struct *wrk);
+ static struct ubi_wl_entry *find_anchor_wl_entry(struct rb_root *root);
+ static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi);
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index 47b867c64b147..195108858f38f 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -542,8 +542,13 @@ void e1000_reinit_locked(struct e1000_adapter *adapter)
+ WARN_ON(in_interrupt());
+ while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
+ msleep(1);
+- e1000_down(adapter);
+- e1000_up(adapter);
++
++ /* only run the task if not already down */
++ if (!test_bit(__E1000_DOWN, &adapter->flags)) {
++ e1000_down(adapter);
++ e1000_up(adapter);
++ }
++
+ clear_bit(__E1000_RESETTING, &adapter->flags);
+ }
+
+@@ -1433,10 +1438,15 @@ int e1000_close(struct net_device *netdev)
+ struct e1000_hw *hw = &adapter->hw;
+ int count = E1000_CHECK_RESET_COUNT;
+
+- while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
++ while (test_and_set_bit(__E1000_RESETTING, &adapter->flags) && count--)
+ usleep_range(10000, 20000);
+
+- WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
++ WARN_ON(count < 0);
++
++ /* signal that we're down so that the reset task will no longer run */
++ set_bit(__E1000_DOWN, &adapter->flags);
++ clear_bit(__E1000_RESETTING, &adapter->flags);
++
+ e1000_down(adapter);
+ e1000_power_down_phy(adapter);
+ e1000_free_irq(adapter);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+index 71a7af134dd8e..886c7aae662fa 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+@@ -96,6 +96,7 @@ static int qed_sp_vf_start(struct qed_hwfn *p_hwfn, struct qed_vf_info *p_vf)
+ p_ramrod->personality = PERSONALITY_ETH;
+ break;
+ case QED_PCI_ETH_ROCE:
++ case QED_PCI_ETH_IWARP:
+ p_ramrod->personality = PERSONALITY_RDMA_AND_ETH;
+ break;
+ default:
+diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
+index 71be8524cca87..a686926bba71e 100644
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -883,7 +883,9 @@ static int adf7242_rx(struct adf7242_local *lp)
+ int ret;
+ u8 lqi, len_u8, *data;
+
+- adf7242_read_reg(lp, 0, &len_u8);
++ ret = adf7242_read_reg(lp, 0, &len_u8);
++ if (ret)
++ return ret;
+
+ len = len_u8;
+
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index 38a41651e451c..deace0aadad24 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -2923,6 +2923,7 @@ static int ca8210_dev_com_init(struct ca8210_priv *priv)
+ );
+ if (!priv->irq_workqueue) {
+ dev_crit(&priv->spi->dev, "alloc of irq_workqueue failed!\n");
++ destroy_workqueue(priv->mlme_workqueue);
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
+index da2d179430ca5..4c57e79e5779a 100644
+--- a/drivers/net/wireless/ath/ar5523/ar5523.c
++++ b/drivers/net/wireless/ath/ar5523/ar5523.c
+@@ -1770,6 +1770,8 @@ static const struct usb_device_id ar5523_id_table[] = {
+ AR5523_DEVICE_UX(0x0846, 0x4300), /* Netgear / WG111U */
+ AR5523_DEVICE_UG(0x0846, 0x4250), /* Netgear / WG111T */
+ AR5523_DEVICE_UG(0x0846, 0x5f00), /* Netgear / WPN111 */
++ AR5523_DEVICE_UG(0x083a, 0x4506), /* SMC / EZ Connect
++ SMCWUSBT-G2 */
+ AR5523_DEVICE_UG(0x157e, 0x3006), /* Umedia / AR5523_1 */
+ AR5523_DEVICE_UX(0x157e, 0x3205), /* Umedia / AR5523_2 */
+ AR5523_DEVICE_UG(0x157e, 0x3006), /* Umedia / TEW444UBEU */
+diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
+index 0baaad90b8d18..4e980e78ba95c 100644
+--- a/drivers/net/wireless/ath/ath10k/debug.c
++++ b/drivers/net/wireless/ath/ath10k/debug.c
+@@ -1521,7 +1521,7 @@ static void ath10k_tpc_stats_print(struct ath10k_tpc_stats *tpc_stats,
+ *len += scnprintf(buf + *len, buf_len - *len,
+ "No. Preamble Rate_code ");
+
+- for (i = 0; i < WMI_TPC_TX_N_CHAIN; i++)
++ for (i = 0; i < tpc_stats->num_tx_chain; i++)
+ *len += scnprintf(buf + *len, buf_len - *len,
+ "tpc_value%d ", i);
+
+@@ -2365,6 +2365,7 @@ void ath10k_debug_destroy(struct ath10k *ar)
+ ath10k_debug_fw_stats_reset(ar);
+
+ kfree(ar->debug.tpc_stats);
++ kfree(ar->debug.tpc_stats_final);
+ }
+
+ int ath10k_debug_register(struct ath10k *ar)
+diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
+index 0ecaba824fb28..0cdaecb0e28a9 100644
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -1567,23 +1567,33 @@ static int ath10k_sdio_hif_diag_read(struct ath10k *ar, u32 address, void *buf,
+ size_t buf_len)
+ {
+ int ret;
++ void *mem;
++
++ mem = kzalloc(buf_len, GFP_KERNEL);
++ if (!mem)
++ return -ENOMEM;
+
+ /* set window register to start read cycle */
+ ret = ath10k_sdio_write32(ar, MBOX_WINDOW_READ_ADDR_ADDRESS, address);
+ if (ret) {
+ ath10k_warn(ar, "failed to set mbox window read address: %d", ret);
+- return ret;
++ goto out;
+ }
+
+ /* read the data */
+- ret = ath10k_sdio_read(ar, MBOX_WINDOW_DATA_ADDRESS, buf, buf_len);
++ ret = ath10k_sdio_read(ar, MBOX_WINDOW_DATA_ADDRESS, mem, buf_len);
+ if (ret) {
+ ath10k_warn(ar, "failed to read from mbox window data address: %d\n",
+ ret);
+- return ret;
++ goto out;
+ }
+
+- return 0;
++ memcpy(buf, mem, buf_len);
++
++out:
++ kfree(mem);
++
++ return ret;
+ }
+
+ static int ath10k_sdio_hif_diag_read32(struct ath10k *ar, u32 address,
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 3372dfa0deccf..3f3fbee631c34 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -4550,16 +4550,13 @@ static void ath10k_tpc_config_disp_tables(struct ath10k *ar,
+ }
+
+ pream_idx = 0;
+- for (i = 0; i < __le32_to_cpu(ev->rate_max); i++) {
++ for (i = 0; i < tpc_stats->rate_max; i++) {
+ memset(tpc_value, 0, sizeof(tpc_value));
+ memset(buff, 0, sizeof(buff));
+ if (i == pream_table[pream_idx])
+ pream_idx++;
+
+- for (j = 0; j < WMI_TPC_TX_N_CHAIN; j++) {
+- if (j >= __le32_to_cpu(ev->num_tx_chain))
+- break;
+-
++ for (j = 0; j < tpc_stats->num_tx_chain; j++) {
+ tpc[j] = ath10k_tpc_config_get_rate(ar, ev, i, j + 1,
+ rate_code[i],
+ type);
+@@ -4672,7 +4669,7 @@ void ath10k_wmi_tpc_config_get_rate_code(u8 *rate_code, u16 *pream_table,
+
+ void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb)
+ {
+- u32 num_tx_chain;
++ u32 num_tx_chain, rate_max;
+ u8 rate_code[WMI_TPC_RATE_MAX];
+ u16 pream_table[WMI_TPC_PREAM_TABLE_MAX];
+ struct wmi_pdev_tpc_config_event *ev;
+@@ -4688,6 +4685,13 @@ void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb)
+ return;
+ }
+
++ rate_max = __le32_to_cpu(ev->rate_max);
++ if (rate_max > WMI_TPC_RATE_MAX) {
++ ath10k_warn(ar, "number of rate is %d greater than TPC configured rate %d\n",
++ rate_max, WMI_TPC_RATE_MAX);
++ rate_max = WMI_TPC_RATE_MAX;
++ }
++
+ tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC);
+ if (!tpc_stats)
+ return;
+@@ -4704,8 +4708,8 @@ void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb)
+ __le32_to_cpu(ev->twice_antenna_reduction);
+ tpc_stats->power_limit = __le32_to_cpu(ev->power_limit);
+ tpc_stats->twice_max_rd_power = __le32_to_cpu(ev->twice_max_rd_power);
+- tpc_stats->num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
+- tpc_stats->rate_max = __le32_to_cpu(ev->rate_max);
++ tpc_stats->num_tx_chain = num_tx_chain;
++ tpc_stats->rate_max = rate_max;
+
+ ath10k_tpc_config_disp_tables(ar, ev, tpc_stats,
+ rate_code, pream_table,
+@@ -4900,16 +4904,13 @@ ath10k_wmi_tpc_stats_final_disp_tables(struct ath10k *ar,
+ }
+
+ pream_idx = 0;
+- for (i = 0; i < __le32_to_cpu(ev->rate_max); i++) {
++ for (i = 0; i < tpc_stats->rate_max; i++) {
+ memset(tpc_value, 0, sizeof(tpc_value));
+ memset(buff, 0, sizeof(buff));
+ if (i == pream_table[pream_idx])
+ pream_idx++;
+
+- for (j = 0; j < WMI_TPC_TX_N_CHAIN; j++) {
+- if (j >= __le32_to_cpu(ev->num_tx_chain))
+- break;
+-
++ for (j = 0; j < tpc_stats->num_tx_chain; j++) {
+ tpc[j] = ath10k_wmi_tpc_final_get_rate(ar, ev, i, j + 1,
+ rate_code[i],
+ type, pream_idx);
+@@ -4925,7 +4926,7 @@ ath10k_wmi_tpc_stats_final_disp_tables(struct ath10k *ar,
+
+ void ath10k_wmi_event_tpc_final_table(struct ath10k *ar, struct sk_buff *skb)
+ {
+- u32 num_tx_chain;
++ u32 num_tx_chain, rate_max;
+ u8 rate_code[WMI_TPC_FINAL_RATE_MAX];
+ u16 pream_table[WMI_TPC_PREAM_TABLE_MAX];
+ struct wmi_pdev_tpc_final_table_event *ev;
+@@ -4933,12 +4934,24 @@ void ath10k_wmi_event_tpc_final_table(struct ath10k *ar, struct sk_buff *skb)
+
+ ev = (struct wmi_pdev_tpc_final_table_event *)skb->data;
+
++ num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
++ if (num_tx_chain > WMI_TPC_TX_N_CHAIN) {
++ ath10k_warn(ar, "number of tx chain is %d greater than TPC final configured tx chain %d\n",
++ num_tx_chain, WMI_TPC_TX_N_CHAIN);
++ return;
++ }
++
++ rate_max = __le32_to_cpu(ev->rate_max);
++ if (rate_max > WMI_TPC_FINAL_RATE_MAX) {
++ ath10k_warn(ar, "number of rate is %d greater than TPC final configured rate %d\n",
++ rate_max, WMI_TPC_FINAL_RATE_MAX);
++ rate_max = WMI_TPC_FINAL_RATE_MAX;
++ }
++
+ tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC);
+ if (!tpc_stats)
+ return;
+
+- num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
+-
+ ath10k_wmi_tpc_config_get_rate_code(rate_code, pream_table,
+ num_tx_chain);
+
+@@ -4951,8 +4964,8 @@ void ath10k_wmi_event_tpc_final_table(struct ath10k *ar, struct sk_buff *skb)
+ __le32_to_cpu(ev->twice_antenna_reduction);
+ tpc_stats->power_limit = __le32_to_cpu(ev->power_limit);
+ tpc_stats->twice_max_rd_power = __le32_to_cpu(ev->twice_max_rd_power);
+- tpc_stats->num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
+- tpc_stats->rate_max = __le32_to_cpu(ev->rate_max);
++ tpc_stats->num_tx_chain = num_tx_chain;
++ tpc_stats->rate_max = rate_max;
+
+ ath10k_wmi_tpc_stats_final_disp_tables(ar, ev, tpc_stats,
+ rate_code, pream_table,
+diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
+index 1fb76d2f5d3fd..8b9d0809daf62 100644
+--- a/drivers/net/wireless/marvell/mwifiex/fw.h
++++ b/drivers/net/wireless/marvell/mwifiex/fw.h
+@@ -953,7 +953,7 @@ struct mwifiex_tkip_param {
+ struct mwifiex_aes_param {
+ u8 pn[WPA_PN_SIZE];
+ __le16 key_len;
+- u8 key[WLAN_KEY_LEN_CCMP];
++ u8 key[WLAN_KEY_LEN_CCMP_256];
+ } __packed;
+
+ struct mwifiex_wapi_param {
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+index 797c2e9783943..7003767eef423 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+@@ -620,7 +620,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
+ key_v2 = &resp->params.key_material_v2;
+
+ len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len);
+- if (len > WLAN_KEY_LEN_CCMP)
++ if (len > sizeof(key_v2->key_param_set.key_params.aes.key))
+ return -EINVAL;
+
+ if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) {
+@@ -636,7 +636,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
+ return 0;
+
+ memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0,
+- WLAN_KEY_LEN_CCMP);
++ sizeof(key_v2->key_param_set.key_params.aes.key));
+ priv->aes_key_v2.key_param_set.key_params.aes.key_len =
+ cpu_to_le16(len);
+ memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key,
+diff --git a/drivers/net/wireless/mediatek/mt76/agg-rx.c b/drivers/net/wireless/mediatek/mt76/agg-rx.c
+index d44d57e6eb27a..97df6b3a472b1 100644
+--- a/drivers/net/wireless/mediatek/mt76/agg-rx.c
++++ b/drivers/net/wireless/mediatek/mt76/agg-rx.c
+@@ -278,6 +278,7 @@ static void mt76_rx_aggr_shutdown(struct mt76_dev *dev, struct mt76_rx_tid *tid)
+ if (!skb)
+ continue;
+
++ tid->reorder_buf[i] = NULL;
+ tid->nframes--;
+ dev_kfree_skb(skb);
+ }
+diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
+index 2ca5658bbc2ab..43c7b37dec0c9 100644
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -3671,8 +3671,10 @@ void wlcore_regdomain_config(struct wl1271 *wl)
+ goto out;
+
+ ret = pm_runtime_get_sync(wl->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_autosuspend(wl->dev);
+ goto out;
++ }
+
+ ret = wlcore_cmd_regdomain_config_locked(wl);
+ if (ret < 0) {
+diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c
+index b6e19c2d66b0a..250bcbf4ea2f2 100644
+--- a/drivers/net/wireless/ti/wlcore/tx.c
++++ b/drivers/net/wireless/ti/wlcore/tx.c
+@@ -877,6 +877,7 @@ void wl1271_tx_work(struct work_struct *work)
+
+ ret = wlcore_tx_work_locked(wl);
+ if (ret < 0) {
++ pm_runtime_put_noidle(wl->dev);
+ wl12xx_queue_recovery_work(wl);
+ goto out;
+ }
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 0d60f2f8f3eec..33dad9774da01 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -255,11 +255,8 @@ void nvme_complete_rq(struct request *req)
+ trace_nvme_complete_rq(req);
+
+ if (unlikely(status != BLK_STS_OK && nvme_req_needs_retry(req))) {
+- if ((req->cmd_flags & REQ_NVME_MPATH) &&
+- blk_path_error(status)) {
+- nvme_failover_req(req);
++ if ((req->cmd_flags & REQ_NVME_MPATH) && nvme_failover_req(req))
+ return;
+- }
+
+ if (!blk_queue_dying(req->q)) {
+ nvme_req(req)->retries++;
+@@ -1602,7 +1599,7 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
+ if (ns->head->disk) {
+ nvme_update_disk_info(ns->head->disk, ns, id);
+ blk_queue_stack_limits(ns->head->disk->queue, ns->queue);
+- revalidate_disk(ns->head->disk);
++ nvme_mpath_update_disk_size(ns->head->disk);
+ }
+ #endif
+ }
+@@ -2859,6 +2856,10 @@ static ssize_t nvme_sysfs_delete(struct device *dev,
+ {
+ struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
+
++ /* Can't delete non-created controllers */
++ if (!ctrl->created)
++ return -EBUSY;
++
+ if (device_remove_file_self(dev, attr))
+ nvme_delete_ctrl_sync(ctrl);
+ return count;
+@@ -3579,6 +3580,7 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
+ queue_work(nvme_wq, &ctrl->async_event_work);
+ nvme_start_queues(ctrl);
+ }
++ ctrl->created = true;
+ }
+ EXPORT_SYMBOL_GPL(nvme_start_ctrl);
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 2e63c1106030b..e71075338ff5c 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -73,17 +73,12 @@ void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+ }
+ }
+
+-void nvme_failover_req(struct request *req)
++bool nvme_failover_req(struct request *req)
+ {
+ struct nvme_ns *ns = req->q->queuedata;
+ u16 status = nvme_req(req)->status;
+ unsigned long flags;
+
+- spin_lock_irqsave(&ns->head->requeue_lock, flags);
+- blk_steal_bios(&ns->head->requeue_list, req);
+- spin_unlock_irqrestore(&ns->head->requeue_lock, flags);
+- blk_mq_end_request(req, 0);
+-
+ switch (status & 0x7ff) {
+ case NVME_SC_ANA_TRANSITION:
+ case NVME_SC_ANA_INACCESSIBLE:
+@@ -111,15 +106,17 @@ void nvme_failover_req(struct request *req)
+ nvme_mpath_clear_current_path(ns);
+ break;
+ default:
+- /*
+- * Reset the controller for any non-ANA error as we don't know
+- * what caused the error.
+- */
+- nvme_reset_ctrl(ns->ctrl);
+- break;
++ /* This was a non-ANA error so follow the normal error path. */
++ return false;
+ }
+
++ spin_lock_irqsave(&ns->head->requeue_lock, flags);
++ blk_steal_bios(&ns->head->requeue_list, req);
++ spin_unlock_irqrestore(&ns->head->requeue_lock, flags);
++ blk_mq_end_request(req, 0);
++
+ kblockd_schedule_work(&ns->head->requeue_work);
++ return true;
+ }
+
+ void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl)
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index cc4273f119894..9c2e7a151e400 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -206,6 +206,7 @@ struct nvme_ctrl {
+ struct nvme_command ka_cmd;
+ struct work_struct fw_act_work;
+ unsigned long events;
++ bool created;
+
+ #ifdef CONFIG_NVME_MULTIPATH
+ /* asymmetric namespace access: */
+@@ -477,7 +478,7 @@ void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys);
+ void nvme_mpath_start_freeze(struct nvme_subsystem *subsys);
+ void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+ struct nvme_ctrl *ctrl, int *flags);
+-void nvme_failover_req(struct request *req);
++bool nvme_failover_req(struct request *req);
+ void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl);
+ int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head);
+ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id);
+@@ -503,6 +504,16 @@ static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
+ kblockd_schedule_work(&head->requeue_work);
+ }
+
++static inline void nvme_mpath_update_disk_size(struct gendisk *disk)
++{
++ struct block_device *bdev = bdget_disk(disk, 0);
++
++ if (bdev) {
++ bd_set_size(bdev, get_capacity(disk) << SECTOR_SHIFT);
++ bdput(bdev);
++ }
++}
++
+ extern struct device_attribute dev_attr_ana_grpid;
+ extern struct device_attribute dev_attr_ana_state;
+
+@@ -521,8 +532,9 @@ static inline void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
+ sprintf(disk_name, "nvme%dn%d", ctrl->instance, ns->head->instance);
+ }
+
+-static inline void nvme_failover_req(struct request *req)
++static inline bool nvme_failover_req(struct request *req)
+ {
++ return false;
+ }
+ static inline void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl)
+ {
+@@ -568,6 +580,9 @@ static inline void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys)
+ static inline void nvme_mpath_start_freeze(struct nvme_subsystem *subsys)
+ {
+ }
++static inline void nvme_mpath_update_disk_size(struct gendisk *disk)
++{
++}
+ #endif /* CONFIG_NVME_MULTIPATH */
+
+ #ifdef CONFIG_NVM
+diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
+index 08f997a390d5d..cfd26437aeaea 100644
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -83,6 +83,7 @@ enum nvmet_rdma_queue_state {
+
+ struct nvmet_rdma_queue {
+ struct rdma_cm_id *cm_id;
++ struct ib_qp *qp;
+ struct nvmet_port *port;
+ struct ib_cq *cq;
+ atomic_t sq_wr_avail;
+@@ -471,7 +472,7 @@ static int nvmet_rdma_post_recv(struct nvmet_rdma_device *ndev,
+ if (ndev->srq)
+ ret = ib_post_srq_recv(ndev->srq, &cmd->wr, NULL);
+ else
+- ret = ib_post_recv(cmd->queue->cm_id->qp, &cmd->wr, NULL);
++ ret = ib_post_recv(cmd->queue->qp, &cmd->wr, NULL);
+
+ if (unlikely(ret))
+ pr_err("post_recv cmd failed\n");
+@@ -510,7 +511,7 @@ static void nvmet_rdma_release_rsp(struct nvmet_rdma_rsp *rsp)
+ atomic_add(1 + rsp->n_rdma, &queue->sq_wr_avail);
+
+ if (rsp->n_rdma) {
+- rdma_rw_ctx_destroy(&rsp->rw, queue->cm_id->qp,
++ rdma_rw_ctx_destroy(&rsp->rw, queue->qp,
+ queue->cm_id->port_num, rsp->req.sg,
+ rsp->req.sg_cnt, nvmet_data_dir(&rsp->req));
+ }
+@@ -594,7 +595,7 @@ static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc)
+
+ WARN_ON(rsp->n_rdma <= 0);
+ atomic_add(rsp->n_rdma, &queue->sq_wr_avail);
+- rdma_rw_ctx_destroy(&rsp->rw, queue->cm_id->qp,
++ rdma_rw_ctx_destroy(&rsp->rw, queue->qp,
+ queue->cm_id->port_num, rsp->req.sg,
+ rsp->req.sg_cnt, nvmet_data_dir(&rsp->req));
+ rsp->n_rdma = 0;
+@@ -737,7 +738,7 @@ static bool nvmet_rdma_execute_command(struct nvmet_rdma_rsp *rsp)
+ }
+
+ if (nvmet_rdma_need_data_in(rsp)) {
+- if (rdma_rw_ctx_post(&rsp->rw, queue->cm_id->qp,
++ if (rdma_rw_ctx_post(&rsp->rw, queue->qp,
+ queue->cm_id->port_num, &rsp->read_cqe, NULL))
+ nvmet_req_complete(&rsp->req, NVME_SC_DATA_XFER_ERROR);
+ } else {
+@@ -1020,6 +1021,7 @@ static int nvmet_rdma_create_queue_ib(struct nvmet_rdma_queue *queue)
+ pr_err("failed to create_qp ret= %d\n", ret);
+ goto err_destroy_cq;
+ }
++ queue->qp = queue->cm_id->qp;
+
+ atomic_set(&queue->sq_wr_avail, qp_attr.cap.max_send_wr);
+
+@@ -1048,11 +1050,10 @@ err_destroy_cq:
+
+ static void nvmet_rdma_destroy_queue_ib(struct nvmet_rdma_queue *queue)
+ {
+- struct ib_qp *qp = queue->cm_id->qp;
+-
+- ib_drain_qp(qp);
+- rdma_destroy_id(queue->cm_id);
+- ib_destroy_qp(qp);
++ ib_drain_qp(queue->qp);
++ if (queue->cm_id)
++ rdma_destroy_id(queue->cm_id);
++ ib_destroy_qp(queue->qp);
+ ib_free_cq(queue->cq);
+ }
+
+@@ -1286,9 +1287,12 @@ static int nvmet_rdma_queue_connect(struct rdma_cm_id *cm_id,
+
+ ret = nvmet_rdma_cm_accept(cm_id, queue, &event->param.conn);
+ if (ret) {
+- schedule_work(&queue->release_work);
+- /* Destroying rdma_cm id is not needed here */
+- return 0;
++ /*
++ * Don't destroy the cm_id in free path, as we implicitly
++ * destroy the cm_id here with non-zero ret code.
++ */
++ queue->cm_id = NULL;
++ goto free_queue;
+ }
+
+ mutex_lock(&nvmet_rdma_queue_mutex);
+@@ -1297,6 +1301,8 @@ static int nvmet_rdma_queue_connect(struct rdma_cm_id *cm_id,
+
+ return 0;
+
++free_queue:
++ nvmet_rdma_free_queue(queue);
+ put_device:
+ kref_put(&ndev->ref, nvmet_rdma_free_dev);
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 6f86583605a46..097c02197ec8f 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -2400,7 +2400,7 @@ static int tegra_pcie_probe(struct platform_device *pdev)
+ err = pm_runtime_get_sync(pcie->dev);
+ if (err < 0) {
+ dev_err(dev, "fail to enable pcie controller: %d\n", err);
+- goto teardown_msi;
++ goto pm_runtime_put;
+ }
+
+ err = tegra_pcie_request_resources(pcie);
+@@ -2440,7 +2440,6 @@ free_resources:
+ pm_runtime_put:
+ pm_runtime_put_sync(pcie->dev);
+ pm_runtime_disable(pcie->dev);
+-teardown_msi:
+ tegra_pcie_msi_teardown(pcie);
+ put_resources:
+ tegra_pcie_put_resources(pcie);
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 07940d1d83b70..005817e40ad39 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -530,7 +530,7 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id)
+ struct controller *ctrl = (struct controller *)dev_id;
+ struct pci_dev *pdev = ctrl_dev(ctrl);
+ struct device *parent = pdev->dev.parent;
+- u16 status, events;
++ u16 status, events = 0;
+
+ /*
+ * Interrupts only occur in D3hot or shallower (PCIe r4.0, sec 6.7.3.4).
+@@ -553,6 +553,7 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id)
+ }
+ }
+
++read_status:
+ pcie_capability_read_word(pdev, PCI_EXP_SLTSTA, &status);
+ if (status == (u16) ~0) {
+ ctrl_info(ctrl, "%s: no response from device\n", __func__);
+@@ -565,24 +566,37 @@ static irqreturn_t pciehp_isr(int irq, void *dev_id)
+ * Slot Status contains plain status bits as well as event
+ * notification bits; right now we only want the event bits.
+ */
+- events = status & (PCI_EXP_SLTSTA_ABP | PCI_EXP_SLTSTA_PFD |
+- PCI_EXP_SLTSTA_PDC | PCI_EXP_SLTSTA_CC |
+- PCI_EXP_SLTSTA_DLLSC);
++ status &= PCI_EXP_SLTSTA_ABP | PCI_EXP_SLTSTA_PFD |
++ PCI_EXP_SLTSTA_PDC | PCI_EXP_SLTSTA_CC |
++ PCI_EXP_SLTSTA_DLLSC;
+
+ /*
+ * If we've already reported a power fault, don't report it again
+ * until we've done something to handle it.
+ */
+ if (ctrl->power_fault_detected)
+- events &= ~PCI_EXP_SLTSTA_PFD;
++ status &= ~PCI_EXP_SLTSTA_PFD;
+
++ events |= status;
+ if (!events) {
+ if (parent)
+ pm_runtime_put(parent);
+ return IRQ_NONE;
+ }
+
+- pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, events);
++ if (status) {
++ pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, events);
++
++ /*
++ * In MSI mode, all event bits must be zero before the port
++ * will send a new interrupt (PCIe Base Spec r5.0 sec 6.7.3.4).
++ * So re-read the Slot Status register in case a bit was set
++ * between read and write.
++ */
++ if (pci_dev_msi_enabled(pdev) && !pciehp_poll_mode)
++ goto read_status;
++ }
++
+ ctrl_dbg(ctrl, "pending interrupts %#06x from Slot Status\n", events);
+ if (parent)
+ pm_runtime_put(parent);
+diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
+index 137bf0cee897c..8fc9a4e911e3a 100644
+--- a/drivers/pci/rom.c
++++ b/drivers/pci/rom.c
+@@ -195,20 +195,3 @@ void pci_unmap_rom(struct pci_dev *pdev, void __iomem *rom)
+ pci_disable_rom(pdev);
+ }
+ EXPORT_SYMBOL(pci_unmap_rom);
+-
+-/**
+- * pci_platform_rom - provides a pointer to any ROM image provided by the
+- * platform
+- * @pdev: pointer to pci device struct
+- * @size: pointer to receive size of pci window over ROM
+- */
+-void __iomem *pci_platform_rom(struct pci_dev *pdev, size_t *size)
+-{
+- if (pdev->rom && pdev->romlen) {
+- *size = pdev->romlen;
+- return phys_to_virt((phys_addr_t)pdev->rom);
+- }
+-
+- return NULL;
+-}
+-EXPORT_SYMBOL(pci_platform_rom);
+diff --git a/drivers/phy/samsung/phy-s5pv210-usb2.c b/drivers/phy/samsung/phy-s5pv210-usb2.c
+index f6f72339bbc32..bb7fdf491c1c2 100644
+--- a/drivers/phy/samsung/phy-s5pv210-usb2.c
++++ b/drivers/phy/samsung/phy-s5pv210-usb2.c
+@@ -142,6 +142,10 @@ static void s5pv210_phy_pwr(struct samsung_usb2_phy_instance *inst, bool on)
+ udelay(10);
+ rst &= ~rstbits;
+ writel(rst, drv->reg_phy + S5PV210_UPHYRST);
++ /* The following delay is necessary for the reset sequence to be
++ * completed
++ */
++ udelay(80);
+ } else {
+ pwr = readl(drv->reg_phy + S5PV210_UPHYPWR);
+ pwr |= phypwr;
+diff --git a/drivers/power/supply/max17040_battery.c b/drivers/power/supply/max17040_battery.c
+index 33c40f79d23d5..2c35c13ad546f 100644
+--- a/drivers/power/supply/max17040_battery.c
++++ b/drivers/power/supply/max17040_battery.c
+@@ -109,7 +109,7 @@ static void max17040_get_vcell(struct i2c_client *client)
+
+ vcell = max17040_read_reg(client, MAX17040_VCELL);
+
+- chip->vcell = vcell;
++ chip->vcell = (vcell >> 4) * 1250;
+ }
+
+ static void max17040_get_soc(struct i2c_client *client)
+diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
+index 5940780648e0f..f36a8a5261a13 100644
+--- a/drivers/rapidio/devices/rio_mport_cdev.c
++++ b/drivers/rapidio/devices/rio_mport_cdev.c
+@@ -2385,13 +2385,6 @@ static struct mport_dev *mport_cdev_add(struct rio_mport *mport)
+ cdev_init(&md->cdev, &mport_fops);
+ md->cdev.owner = THIS_MODULE;
+
+- ret = cdev_device_add(&md->cdev, &md->dev);
+- if (ret) {
+- rmcd_error("Failed to register mport %d (err=%d)",
+- mport->id, ret);
+- goto err_cdev;
+- }
+-
+ INIT_LIST_HEAD(&md->doorbells);
+ spin_lock_init(&md->db_lock);
+ INIT_LIST_HEAD(&md->portwrites);
+@@ -2411,6 +2404,13 @@ static struct mport_dev *mport_cdev_add(struct rio_mport *mport)
+ #else
+ md->properties.transfer_mode |= RIO_TRANSFER_MODE_TRANSFER;
+ #endif
++
++ ret = cdev_device_add(&md->cdev, &md->dev);
++ if (ret) {
++ rmcd_error("Failed to register mport %d (err=%d)",
++ mport->id, ret);
++ goto err_cdev;
++ }
+ ret = rio_query_mport(mport, &attr);
+ if (!ret) {
+ md->properties.flags = attr.flags;
+diff --git a/drivers/rtc/rtc-ds1374.c b/drivers/rtc/rtc-ds1374.c
+index 38a2e9e684df4..77a106e90124b 100644
+--- a/drivers/rtc/rtc-ds1374.c
++++ b/drivers/rtc/rtc-ds1374.c
+@@ -620,6 +620,10 @@ static int ds1374_probe(struct i2c_client *client,
+ if (!ds1374)
+ return -ENOMEM;
+
++ ds1374->rtc = devm_rtc_allocate_device(&client->dev);
++ if (IS_ERR(ds1374->rtc))
++ return PTR_ERR(ds1374->rtc);
++
+ ds1374->client = client;
+ i2c_set_clientdata(client, ds1374);
+
+@@ -641,12 +645,11 @@ static int ds1374_probe(struct i2c_client *client,
+ device_set_wakeup_capable(&client->dev, 1);
+ }
+
+- ds1374->rtc = devm_rtc_device_register(&client->dev, client->name,
+- &ds1374_rtc_ops, THIS_MODULE);
+- if (IS_ERR(ds1374->rtc)) {
+- dev_err(&client->dev, "unable to register the class device\n");
+- return PTR_ERR(ds1374->rtc);
+- }
++ ds1374->rtc->ops = &ds1374_rtc_ops;
++
++ ret = rtc_register_device(ds1374->rtc);
++ if (ret)
++ return ret;
+
+ #ifdef CONFIG_RTC_DRV_DS1374_WDT
+ save_client = client;
+diff --git a/drivers/rtc/rtc-sa1100.c b/drivers/rtc/rtc-sa1100.c
+index 304d905cb23fd..56f625371735f 100644
+--- a/drivers/rtc/rtc-sa1100.c
++++ b/drivers/rtc/rtc-sa1100.c
+@@ -186,7 +186,6 @@ static const struct rtc_class_ops sa1100_rtc_ops = {
+
+ int sa1100_rtc_init(struct platform_device *pdev, struct sa1100_rtc *info)
+ {
+- struct rtc_device *rtc;
+ int ret;
+
+ spin_lock_init(&info->lock);
+@@ -215,15 +214,14 @@ int sa1100_rtc_init(struct platform_device *pdev, struct sa1100_rtc *info)
+ writel_relaxed(0, info->rcnr);
+ }
+
+- rtc = devm_rtc_device_register(&pdev->dev, pdev->name, &sa1100_rtc_ops,
+- THIS_MODULE);
+- if (IS_ERR(rtc)) {
++ info->rtc->ops = &sa1100_rtc_ops;
++ info->rtc->max_user_freq = RTC_FREQ;
++
++ ret = rtc_register_device(info->rtc);
++ if (ret) {
+ clk_disable_unprepare(info->clk);
+- return PTR_ERR(rtc);
++ return ret;
+ }
+- info->rtc = rtc;
+-
+- rtc->max_user_freq = RTC_FREQ;
+
+ /* Fix for a nasty initialization problem the in SA11xx RTSR register.
+ * See also the comments in sa1100_rtc_interrupt().
+@@ -272,6 +270,10 @@ static int sa1100_rtc_probe(struct platform_device *pdev)
+ info->irq_1hz = irq_1hz;
+ info->irq_alarm = irq_alarm;
+
++ info->rtc = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(info->rtc))
++ return PTR_ERR(info->rtc);
++
+ ret = devm_request_irq(&pdev->dev, irq_1hz, sa1100_rtc_interrupt, 0,
+ "rtc 1Hz", &pdev->dev);
+ if (ret) {
+diff --git a/drivers/s390/block/dasd_fba.c b/drivers/s390/block/dasd_fba.c
+index 56007a3e7f110..fab09455ba944 100644
+--- a/drivers/s390/block/dasd_fba.c
++++ b/drivers/s390/block/dasd_fba.c
+@@ -40,6 +40,7 @@
+ MODULE_LICENSE("GPL");
+
+ static struct dasd_discipline dasd_fba_discipline;
++static void *dasd_fba_zero_page;
+
+ struct dasd_fba_private {
+ struct dasd_fba_characteristics rdc_data;
+@@ -270,7 +271,7 @@ static void ccw_write_zero(struct ccw1 *ccw, int count)
+ ccw->cmd_code = DASD_FBA_CCW_WRITE;
+ ccw->flags |= CCW_FLAG_SLI;
+ ccw->count = count;
+- ccw->cda = (__u32) (addr_t) page_to_phys(ZERO_PAGE(0));
++ ccw->cda = (__u32) (addr_t) dasd_fba_zero_page;
+ }
+
+ /*
+@@ -811,6 +812,11 @@ dasd_fba_init(void)
+ int ret;
+
+ ASCEBC(dasd_fba_discipline.ebcname, 4);
++
++ dasd_fba_zero_page = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
++ if (!dasd_fba_zero_page)
++ return -ENOMEM;
++
+ ret = ccw_driver_register(&dasd_fba_driver);
+ if (!ret)
+ wait_for_device_probe();
+@@ -822,6 +828,7 @@ static void __exit
+ dasd_fba_cleanup(void)
+ {
+ ccw_driver_unregister(&dasd_fba_driver);
++ free_page((unsigned long)dasd_fba_zero_page);
+ }
+
+ module_init(dasd_fba_init);
+diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
+index 23c24a699cefe..b7cb897cd83e0 100644
+--- a/drivers/s390/crypto/zcrypt_api.c
++++ b/drivers/s390/crypto/zcrypt_api.c
+@@ -915,7 +915,8 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
+ if (!reqcnt)
+ return -ENOMEM;
+ zcrypt_perdev_reqcnt(reqcnt, AP_DEVICES);
+- if (copy_to_user((int __user *) arg, reqcnt, sizeof(reqcnt)))
++ if (copy_to_user((int __user *) arg, reqcnt,
++ sizeof(u32) * AP_DEVICES))
+ rc = -EFAULT;
+ kfree(reqcnt);
+ return rc;
+diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
+index 6e356325d8d98..54717fb84a54c 100644
+--- a/drivers/scsi/aacraid/aachba.c
++++ b/drivers/scsi/aacraid/aachba.c
+@@ -2481,13 +2481,13 @@ static int aac_read(struct scsi_cmnd * scsicmd)
+ scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+ SAM_STAT_CHECK_CONDITION;
+ set_sense(&dev->fsa_dev[cid].sense_data,
+- HARDWARE_ERROR, SENCODE_INTERNAL_TARGET_FAILURE,
++ ILLEGAL_REQUEST, SENCODE_LBA_OUT_OF_RANGE,
+ ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0);
+ memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
+ min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data),
+ SCSI_SENSE_BUFFERSIZE));
+ scsicmd->scsi_done(scsicmd);
+- return 1;
++ return 0;
+ }
+
+ dprintk((KERN_DEBUG "aac_read[cpu %d]: lba = %llu, t = %ld.\n",
+@@ -2573,13 +2573,13 @@ static int aac_write(struct scsi_cmnd * scsicmd)
+ scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+ SAM_STAT_CHECK_CONDITION;
+ set_sense(&dev->fsa_dev[cid].sense_data,
+- HARDWARE_ERROR, SENCODE_INTERNAL_TARGET_FAILURE,
++ ILLEGAL_REQUEST, SENCODE_LBA_OUT_OF_RANGE,
+ ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0);
+ memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
+ min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data),
+ SCSI_SENSE_BUFFERSIZE));
+ scsicmd->scsi_done(scsicmd);
+- return 1;
++ return 0;
+ }
+
+ dprintk((KERN_DEBUG "aac_write[cpu %d]: lba = %llu, t = %ld.\n",
+diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
+index b7588de4484e5..4cb6ee6e1212e 100644
+--- a/drivers/scsi/aacraid/commsup.c
++++ b/drivers/scsi/aacraid/commsup.c
+@@ -743,7 +743,7 @@ int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback,
+ hbacmd->request_id =
+ cpu_to_le32((((u32)(fibptr - dev->fibs)) << 2) + 1);
+ fibptr->flags |= FIB_CONTEXT_FLAG_SCSI_CMD;
+- } else if (command != HBA_IU_TYPE_SCSI_TM_REQ)
++ } else
+ return -EINVAL;
+
+
+diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
+index 1046947064a0b..eecffc03084c0 100644
+--- a/drivers/scsi/aacraid/linit.c
++++ b/drivers/scsi/aacraid/linit.c
+@@ -736,7 +736,11 @@ static int aac_eh_abort(struct scsi_cmnd* cmd)
+ status = aac_hba_send(HBA_IU_TYPE_SCSI_TM_REQ, fib,
+ (fib_callback) aac_hba_callback,
+ (void *) cmd);
+-
++ if (status != -EINPROGRESS) {
++ aac_fib_complete(fib);
++ aac_fib_free(fib);
++ return ret;
++ }
+ /* Wait up to 15 secs for completion */
+ for (count = 0; count < 15; ++count) {
+ if (cmd->SCp.sent_command) {
+@@ -915,11 +919,11 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd)
+
+ info = &aac->hba_map[bus][cid];
+
+- if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+- info->reset_state > 0)
++ if (!(info->devtype == AAC_DEVTYPE_NATIVE_RAW &&
++ !(info->reset_state > 0)))
+ return FAILED;
+
+- pr_err("%s: Host adapter reset request. SCSI hang ?\n",
++ pr_err("%s: Host device reset request. SCSI hang ?\n",
+ AAC_DRIVERNAME);
+
+ fib = aac_fib_alloc(aac);
+@@ -934,7 +938,12 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd)
+ status = aac_hba_send(command, fib,
+ (fib_callback) aac_tmf_callback,
+ (void *) info);
+-
++ if (status != -EINPROGRESS) {
++ info->reset_state = 0;
++ aac_fib_complete(fib);
++ aac_fib_free(fib);
++ return ret;
++ }
+ /* Wait up to 15 seconds for completion */
+ for (count = 0; count < 15; ++count) {
+ if (info->reset_state == 0) {
+@@ -973,11 +982,11 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd)
+
+ info = &aac->hba_map[bus][cid];
+
+- if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+- info->reset_state > 0)
++ if (!(info->devtype == AAC_DEVTYPE_NATIVE_RAW &&
++ !(info->reset_state > 0)))
+ return FAILED;
+
+- pr_err("%s: Host adapter reset request. SCSI hang ?\n",
++ pr_err("%s: Host target reset request. SCSI hang ?\n",
+ AAC_DRIVERNAME);
+
+ fib = aac_fib_alloc(aac);
+@@ -994,6 +1003,13 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd)
+ (fib_callback) aac_tmf_callback,
+ (void *) info);
+
++ if (status != -EINPROGRESS) {
++ info->reset_state = 0;
++ aac_fib_complete(fib);
++ aac_fib_free(fib);
++ return ret;
++ }
++
+ /* Wait up to 15 seconds for completion */
+ for (count = 0; count < 15; ++count) {
+ if (info->reset_state <= 0) {
+@@ -1046,7 +1062,7 @@ static int aac_eh_bus_reset(struct scsi_cmnd* cmd)
+ }
+ }
+
+- pr_err("%s: Host adapter reset request. SCSI hang ?\n", AAC_DRIVERNAME);
++ pr_err("%s: Host bus reset request. SCSI hang ?\n", AAC_DRIVERNAME);
+
+ /*
+ * Check the health of the controller
+@@ -1604,7 +1620,7 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ struct Scsi_Host *shost;
+ struct aac_dev *aac;
+ struct list_head *insert = &aac_devices;
+- int error = -ENODEV;
++ int error;
+ int unique_id = 0;
+ u64 dmamask;
+ int mask_bits = 0;
+@@ -1629,7 +1645,6 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ error = pci_enable_device(pdev);
+ if (error)
+ goto out;
+- error = -ENODEV;
+
+ if (!(aac_drivers[index].quirks & AAC_QUIRK_SRC)) {
+ error = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+@@ -1661,8 +1676,10 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ pci_set_master(pdev);
+
+ shost = scsi_host_alloc(&aac_driver_template, sizeof(struct aac_dev));
+- if (!shost)
++ if (!shost) {
++ error = -ENOMEM;
+ goto out_disable_pdev;
++ }
+
+ shost->irq = pdev->irq;
+ shost->unique_id = unique_id;
+@@ -1687,8 +1704,11 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ aac->fibs = kcalloc(shost->can_queue + AAC_NUM_MGT_FIB,
+ sizeof(struct fib),
+ GFP_KERNEL);
+- if (!aac->fibs)
++ if (!aac->fibs) {
++ error = -ENOMEM;
+ goto out_free_host;
++ }
++
+ spin_lock_init(&aac->fib_lock);
+
+ mutex_init(&aac->ioctl_mutex);
+diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c
+index f987c40c47a13..443813feaef47 100644
+--- a/drivers/scsi/cxlflash/main.c
++++ b/drivers/scsi/cxlflash/main.c
+@@ -3749,6 +3749,7 @@ static int cxlflash_probe(struct pci_dev *pdev,
+ cfg->afu_cookie = cfg->ops->create_afu(pdev);
+ if (unlikely(!cfg->afu_cookie)) {
+ dev_err(dev, "%s: create_afu failed\n", __func__);
++ rc = -ENOMEM;
+ goto out_remove;
+ }
+
+diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
+index 73ffc16ec0225..b521fc7650cb9 100644
+--- a/drivers/scsi/fnic/fnic_scsi.c
++++ b/drivers/scsi/fnic/fnic_scsi.c
+@@ -1034,7 +1034,8 @@ static void fnic_fcpio_icmnd_cmpl_handler(struct fnic *fnic,
+ atomic64_inc(&fnic_stats->io_stats.io_completions);
+
+
+- io_duration_time = jiffies_to_msecs(jiffies) - jiffies_to_msecs(io_req->start_time);
++ io_duration_time = jiffies_to_msecs(jiffies) -
++ jiffies_to_msecs(start_time);
+
+ if(io_duration_time <= 10)
+ atomic64_inc(&fnic_stats->io_stats.io_btw_0_to_10_msec);
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index f570b8c5d857c..11de2198bb87d 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -507,6 +507,12 @@ static ssize_t host_store_rescan(struct device *dev,
+ return count;
+ }
+
++static void hpsa_turn_off_ioaccel_for_device(struct hpsa_scsi_dev_t *device)
++{
++ device->offload_enabled = 0;
++ device->offload_to_be_enabled = 0;
++}
++
+ static ssize_t host_show_firmware_revision(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+@@ -1743,8 +1749,7 @@ static void hpsa_figure_phys_disk_ptrs(struct ctlr_info *h,
+ __func__,
+ h->scsi_host->host_no, logical_drive->bus,
+ logical_drive->target, logical_drive->lun);
+- logical_drive->offload_enabled = 0;
+- logical_drive->offload_to_be_enabled = 0;
++ hpsa_turn_off_ioaccel_for_device(logical_drive);
+ logical_drive->queue_depth = 8;
+ }
+ }
+@@ -2496,8 +2501,7 @@ static void process_ioaccel2_completion(struct ctlr_info *h,
+ IOACCEL2_SERV_RESPONSE_FAILURE) {
+ if (c2->error_data.status ==
+ IOACCEL2_STATUS_SR_IOACCEL_DISABLED) {
+- dev->offload_enabled = 0;
+- dev->offload_to_be_enabled = 0;
++ hpsa_turn_off_ioaccel_for_device(dev);
+ }
+
+ return hpsa_retry_cmd(h, c);
+@@ -3676,10 +3680,17 @@ static void hpsa_get_ioaccel_status(struct ctlr_info *h,
+ this_device->offload_config =
+ !!(ioaccel_status & OFFLOAD_CONFIGURED_BIT);
+ if (this_device->offload_config) {
+- this_device->offload_to_be_enabled =
++ bool offload_enabled =
+ !!(ioaccel_status & OFFLOAD_ENABLED_BIT);
+- if (hpsa_get_raid_map(h, scsi3addr, this_device))
+- this_device->offload_to_be_enabled = 0;
++ /*
++ * Check to see if offload can be enabled.
++ */
++ if (offload_enabled) {
++ rc = hpsa_get_raid_map(h, scsi3addr, this_device);
++ if (rc) /* could not load raid_map */
++ goto out;
++ this_device->offload_to_be_enabled = 1;
++ }
+ }
+
+ out:
+@@ -3998,8 +4009,7 @@ static int hpsa_update_device_info(struct ctlr_info *h,
+ } else {
+ this_device->raid_level = RAID_UNKNOWN;
+ this_device->offload_config = 0;
+- this_device->offload_enabled = 0;
+- this_device->offload_to_be_enabled = 0;
++ hpsa_turn_off_ioaccel_for_device(this_device);
+ this_device->hba_ioaccel_enabled = 0;
+ this_device->volume_offline = 0;
+ this_device->queue_depth = h->nr_cmds;
+@@ -5213,8 +5223,12 @@ static int hpsa_scsi_ioaccel_raid_map(struct ctlr_info *h,
+ /* Handles load balance across RAID 1 members.
+ * (2-drive R1 and R10 with even # of drives.)
+ * Appropriate for SSDs, not optimal for HDDs
++ * Ensure we have the correct raid_map.
+ */
+- BUG_ON(le16_to_cpu(map->layout_map_count) != 2);
++ if (le16_to_cpu(map->layout_map_count) != 2) {
++ hpsa_turn_off_ioaccel_for_device(dev);
++ return IO_ACCEL_INELIGIBLE;
++ }
+ if (dev->offload_to_mirror)
+ map_index += le16_to_cpu(map->data_disks_per_row);
+ dev->offload_to_mirror = !dev->offload_to_mirror;
+@@ -5222,8 +5236,12 @@ static int hpsa_scsi_ioaccel_raid_map(struct ctlr_info *h,
+ case HPSA_RAID_ADM:
+ /* Handles N-way mirrors (R1-ADM)
+ * and R10 with # of drives divisible by 3.)
++ * Ensure we have the correct raid_map.
+ */
+- BUG_ON(le16_to_cpu(map->layout_map_count) != 3);
++ if (le16_to_cpu(map->layout_map_count) != 3) {
++ hpsa_turn_off_ioaccel_for_device(dev);
++ return IO_ACCEL_INELIGIBLE;
++ }
+
+ offload_to_mirror = dev->offload_to_mirror;
+ raid_map_helper(map, offload_to_mirror,
+@@ -5248,7 +5266,10 @@ static int hpsa_scsi_ioaccel_raid_map(struct ctlr_info *h,
+ r5or6_blocks_per_row =
+ le16_to_cpu(map->strip_size) *
+ le16_to_cpu(map->data_disks_per_row);
+- BUG_ON(r5or6_blocks_per_row == 0);
++ if (r5or6_blocks_per_row == 0) {
++ hpsa_turn_off_ioaccel_for_device(dev);
++ return IO_ACCEL_INELIGIBLE;
++ }
+ stripesize = r5or6_blocks_per_row *
+ le16_to_cpu(map->layout_map_count);
+ #if BITS_PER_LONG == 32
+@@ -8218,7 +8239,7 @@ static int detect_controller_lockup(struct ctlr_info *h)
+ *
+ * Called from monitor controller worker (hpsa_event_monitor_worker)
+ *
+- * A Volume (or Volumes that comprise an Array set may be undergoing a
++ * A Volume (or Volumes that comprise an Array set) may be undergoing a
+ * transformation, so we will be turning off ioaccel for all volumes that
+ * make up the Array.
+ */
+@@ -8241,6 +8262,9 @@ static void hpsa_set_ioaccel_status(struct ctlr_info *h)
+ * Run through current device list used during I/O requests.
+ */
+ for (i = 0; i < h->ndevices; i++) {
++ int offload_to_be_enabled = 0;
++ int offload_config = 0;
++
+ device = h->dev[i];
+
+ if (!device)
+@@ -8258,25 +8282,35 @@ static void hpsa_set_ioaccel_status(struct ctlr_info *h)
+ continue;
+
+ ioaccel_status = buf[IOACCEL_STATUS_BYTE];
+- device->offload_config =
++
++ /*
++ * Check if offload is still configured on
++ */
++ offload_config =
+ !!(ioaccel_status & OFFLOAD_CONFIGURED_BIT);
+- if (device->offload_config)
+- device->offload_to_be_enabled =
++ /*
++ * If offload is configured on, check to see if ioaccel
++ * needs to be enabled.
++ */
++ if (offload_config)
++ offload_to_be_enabled =
+ !!(ioaccel_status & OFFLOAD_ENABLED_BIT);
+
++ /*
++ * If ioaccel is to be re-enabled, re-enable later during the
++ * scan operation so the driver can get a fresh raidmap
++ * before turning ioaccel back on.
++ */
++ if (offload_to_be_enabled)
++ continue;
++
+ /*
+ * Immediately turn off ioaccel for any volume the
+ * controller tells us to. Some of the reasons could be:
+ * transformation - change to the LVs of an Array.
+ * degraded volume - component failure
+- *
+- * If ioaccel is to be re-enabled, re-enable later during the
+- * scan operation so the driver can get a fresh raidmap
+- * before turning ioaccel back on.
+- *
+ */
+- if (!device->offload_to_be_enabled)
+- device->offload_enabled = 0;
++ hpsa_turn_off_ioaccel_for_device(device);
+ }
+
+ kfree(buf);
+diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
+index 90a748551ede5..2b3239765c249 100644
+--- a/drivers/scsi/libfc/fc_rport.c
++++ b/drivers/scsi/libfc/fc_rport.c
+@@ -145,8 +145,10 @@ struct fc_rport_priv *fc_rport_create(struct fc_lport *lport, u32 port_id)
+ lockdep_assert_held(&lport->disc.disc_mutex);
+
+ rdata = fc_rport_lookup(lport, port_id);
+- if (rdata)
++ if (rdata) {
++ kref_put(&rdata->kref, fc_rport_destroy);
+ return rdata;
++ }
+
+ if (lport->rport_priv_size > 0)
+ rport_priv_size = lport->rport_priv_size;
+@@ -493,10 +495,11 @@ static void fc_rport_enter_delete(struct fc_rport_priv *rdata,
+
+ fc_rport_state_enter(rdata, RPORT_ST_DELETE);
+
+- kref_get(&rdata->kref);
+- if (rdata->event == RPORT_EV_NONE &&
+- !queue_work(rport_event_queue, &rdata->event_work))
+- kref_put(&rdata->kref, fc_rport_destroy);
++ if (rdata->event == RPORT_EV_NONE) {
++ kref_get(&rdata->kref);
++ if (!queue_work(rport_event_queue, &rdata->event_work))
++ kref_put(&rdata->kref, fc_rport_destroy);
++ }
+
+ rdata->event = event;
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
+index fe084d47ed9e5..3447d19d4147a 100644
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -332,7 +332,6 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
+ if (strlcat(buf, "\nNVME Initiator Enabled\n", PAGE_SIZE) >= PAGE_SIZE)
+ goto buffer_done;
+
+- rcu_read_lock();
+ scnprintf(tmp, sizeof(tmp),
+ "XRI Dist lpfc%d Total %d NVME %d SCSI %d ELS %d\n",
+ phba->brd_no,
+@@ -341,7 +340,7 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
+ phba->sli4_hba.scsi_xri_max,
+ lpfc_sli4_get_els_iocb_cnt(phba));
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto buffer_done;
+
+ /* Port state is only one of two values for now. */
+ if (localport->port_id)
+@@ -357,7 +356,9 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
+ wwn_to_u64(vport->fc_nodename.u.wwn),
+ localport->port_id, statep);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto buffer_done;
++
++ spin_lock_irq(shost->host_lock);
+
+ list_for_each_entry(ndlp, &vport->fc_nodes, nlp_listp) {
+ nrport = NULL;
+@@ -384,39 +385,39 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
+
+ /* Tab in to show lport ownership. */
+ if (strlcat(buf, "NVME RPORT ", PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto unlock_buf_done;
+ if (phba->brd_no >= 10) {
+ if (strlcat(buf, " ", PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto unlock_buf_done;
+ }
+
+ scnprintf(tmp, sizeof(tmp), "WWPN x%llx ",
+ nrport->port_name);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto unlock_buf_done;
+
+ scnprintf(tmp, sizeof(tmp), "WWNN x%llx ",
+ nrport->node_name);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto unlock_buf_done;
+
+ scnprintf(tmp, sizeof(tmp), "DID x%06x ",
+ nrport->port_id);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto unlock_buf_done;
+
+ /* An NVME rport can have multiple roles. */
+ if (nrport->port_role & FC_PORT_ROLE_NVME_INITIATOR) {
+ if (strlcat(buf, "INITIATOR ", PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto unlock_buf_done;
+ }
+ if (nrport->port_role & FC_PORT_ROLE_NVME_TARGET) {
+ if (strlcat(buf, "TARGET ", PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto unlock_buf_done;
+ }
+ if (nrport->port_role & FC_PORT_ROLE_NVME_DISCOVERY) {
+ if (strlcat(buf, "DISCSRVC ", PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto unlock_buf_done;
+ }
+ if (nrport->port_role & ~(FC_PORT_ROLE_NVME_INITIATOR |
+ FC_PORT_ROLE_NVME_TARGET |
+@@ -424,14 +425,14 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
+ scnprintf(tmp, sizeof(tmp), "UNKNOWN ROLE x%x",
+ nrport->port_role);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto unlock_buf_done;
+ }
+
+ scnprintf(tmp, sizeof(tmp), "%s\n", statep);
+ if (strlcat(buf, tmp, PAGE_SIZE) >= PAGE_SIZE)
+- goto rcu_unlock_buf_done;
++ goto unlock_buf_done;
+ }
+- rcu_read_unlock();
++ spin_unlock_irq(shost->host_lock);
+
+ if (!lport)
+ goto buffer_done;
+@@ -491,11 +492,11 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
+ atomic_read(&lport->cmpl_fcp_err));
+ strlcat(buf, tmp, PAGE_SIZE);
+
+- /* RCU is already unlocked. */
++ /* host_lock is already unlocked. */
+ goto buffer_done;
+
+- rcu_unlock_buf_done:
+- rcu_read_unlock();
++ unlock_buf_done:
++ spin_unlock_irq(shost->host_lock);
+
+ buffer_done:
+ len = strnlen(buf, PAGE_SIZE);
+diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
+index 384f5cd7c3c81..99b4ff78f9dce 100644
+--- a/drivers/scsi/lpfc/lpfc_ct.c
++++ b/drivers/scsi/lpfc/lpfc_ct.c
+@@ -1737,8 +1737,8 @@ lpfc_fdmi_hba_attr_wwnn(struct lpfc_vport *vport, struct lpfc_fdmi_attr_def *ad)
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, sizeof(struct lpfc_name));
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ memcpy(&ae->un.AttrWWN, &vport->fc_sparam.nodeName,
+ sizeof(struct lpfc_name));
+@@ -1754,8 +1754,8 @@ lpfc_fdmi_hba_attr_manufacturer(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ /* This string MUST be consistent with other FC platforms
+ * supported by Broadcom.
+@@ -1779,8 +1779,8 @@ lpfc_fdmi_hba_attr_sn(struct lpfc_vport *vport, struct lpfc_fdmi_attr_def *ad)
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ strncpy(ae->un.AttrString, phba->SerialNumber,
+ sizeof(ae->un.AttrString));
+@@ -1801,8 +1801,8 @@ lpfc_fdmi_hba_attr_model(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ strncpy(ae->un.AttrString, phba->ModelName,
+ sizeof(ae->un.AttrString));
+@@ -1822,8 +1822,8 @@ lpfc_fdmi_hba_attr_description(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ strncpy(ae->un.AttrString, phba->ModelDesc,
+ sizeof(ae->un.AttrString));
+@@ -1845,8 +1845,8 @@ lpfc_fdmi_hba_attr_hdw_ver(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t i, j, incr, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ /* Convert JEDEC ID to ascii for hardware version */
+ incr = vp->rev.biuRev;
+@@ -1875,8 +1875,8 @@ lpfc_fdmi_hba_attr_drvr_ver(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ strncpy(ae->un.AttrString, lpfc_release_version,
+ sizeof(ae->un.AttrString));
+@@ -1897,8 +1897,8 @@ lpfc_fdmi_hba_attr_rom_ver(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ if (phba->sli_rev == LPFC_SLI_REV4)
+ lpfc_decode_firmware_rev(phba, ae->un.AttrString, 1);
+@@ -1922,8 +1922,8 @@ lpfc_fdmi_hba_attr_fmw_ver(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ lpfc_decode_firmware_rev(phba, ae->un.AttrString, 1);
+ len = strnlen(ae->un.AttrString,
+@@ -1942,8 +1942,8 @@ lpfc_fdmi_hba_attr_os_ver(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ snprintf(ae->un.AttrString, sizeof(ae->un.AttrString), "%s %s %s",
+ init_utsname()->sysname,
+@@ -1965,7 +1965,7 @@ lpfc_fdmi_hba_attr_ct_len(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+
+ ae->un.AttrInt = cpu_to_be32(LPFC_MAX_CT_SIZE);
+ size = FOURBYTES + sizeof(uint32_t);
+@@ -1981,8 +1981,8 @@ lpfc_fdmi_hba_attr_symbolic_name(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ len = lpfc_vport_symbolic_node_name(vport,
+ ae->un.AttrString, 256);
+@@ -2000,7 +2000,7 @@ lpfc_fdmi_hba_attr_vendor_info(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+
+ /* Nothing is defined for this currently */
+ ae->un.AttrInt = cpu_to_be32(0);
+@@ -2017,7 +2017,7 @@ lpfc_fdmi_hba_attr_num_ports(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+
+ /* Each driver instance corresponds to a single port */
+ ae->un.AttrInt = cpu_to_be32(1);
+@@ -2034,8 +2034,8 @@ lpfc_fdmi_hba_attr_fabric_wwnn(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, sizeof(struct lpfc_name));
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ memcpy(&ae->un.AttrWWN, &vport->fabric_nodename,
+ sizeof(struct lpfc_name));
+@@ -2053,8 +2053,8 @@ lpfc_fdmi_hba_attr_bios_ver(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ lpfc_decode_firmware_rev(phba, ae->un.AttrString, 1);
+ len = strnlen(ae->un.AttrString,
+@@ -2073,7 +2073,7 @@ lpfc_fdmi_hba_attr_bios_state(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+
+ /* Driver doesn't have access to this information */
+ ae->un.AttrInt = cpu_to_be32(0);
+@@ -2090,8 +2090,8 @@ lpfc_fdmi_hba_attr_vendor_id(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ strncpy(ae->un.AttrString, "EMULEX",
+ sizeof(ae->un.AttrString));
+@@ -2112,8 +2112,8 @@ lpfc_fdmi_port_attr_fc4type(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 32);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ ae->un.AttrTypes[3] = 0x02; /* Type 0x1 - ELS */
+ ae->un.AttrTypes[2] = 0x01; /* Type 0x8 - FCP */
+@@ -2134,7 +2134,7 @@ lpfc_fdmi_port_attr_support_speed(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+
+ ae->un.AttrInt = 0;
+ if (!(phba->hba_flag & HBA_FCOE_MODE)) {
+@@ -2186,7 +2186,7 @@ lpfc_fdmi_port_attr_speed(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+
+ if (!(phba->hba_flag & HBA_FCOE_MODE)) {
+ switch (phba->fc_linkspeed) {
+@@ -2253,7 +2253,7 @@ lpfc_fdmi_port_attr_max_frame(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+
+ hsp = (struct serv_parm *)&vport->fc_sparam;
+ ae->un.AttrInt = (((uint32_t) hsp->cmn.bbRcvSizeMsb) << 8) |
+@@ -2273,8 +2273,8 @@ lpfc_fdmi_port_attr_os_devname(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ snprintf(ae->un.AttrString, sizeof(ae->un.AttrString),
+ "/sys/class/scsi_host/host%d", shost->host_no);
+@@ -2294,8 +2294,8 @@ lpfc_fdmi_port_attr_host_name(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ snprintf(ae->un.AttrString, sizeof(ae->un.AttrString), "%s",
+ init_utsname()->nodename);
+@@ -2315,8 +2315,8 @@ lpfc_fdmi_port_attr_wwnn(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, sizeof(struct lpfc_name));
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ memcpy(&ae->un.AttrWWN, &vport->fc_sparam.nodeName,
+ sizeof(struct lpfc_name));
+@@ -2333,8 +2333,8 @@ lpfc_fdmi_port_attr_wwpn(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, sizeof(struct lpfc_name));
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ memcpy(&ae->un.AttrWWN, &vport->fc_sparam.portName,
+ sizeof(struct lpfc_name));
+@@ -2351,8 +2351,8 @@ lpfc_fdmi_port_attr_symbolic_name(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ len = lpfc_vport_symbolic_port_name(vport, ae->un.AttrString, 256);
+ len += (len & 3) ? (4 - (len & 3)) : 4;
+@@ -2370,7 +2370,7 @@ lpfc_fdmi_port_attr_port_type(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+ if (phba->fc_topology == LPFC_TOPOLOGY_LOOP)
+ ae->un.AttrInt = cpu_to_be32(LPFC_FDMI_PORTTYPE_NLPORT);
+ else
+@@ -2388,7 +2388,7 @@ lpfc_fdmi_port_attr_class(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+ ae->un.AttrInt = cpu_to_be32(FC_COS_CLASS2 | FC_COS_CLASS3);
+ size = FOURBYTES + sizeof(uint32_t);
+ ad->AttrLen = cpu_to_be16(size);
+@@ -2403,8 +2403,8 @@ lpfc_fdmi_port_attr_fabric_wwpn(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, sizeof(struct lpfc_name));
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ memcpy(&ae->un.AttrWWN, &vport->fabric_portname,
+ sizeof(struct lpfc_name));
+@@ -2421,8 +2421,8 @@ lpfc_fdmi_port_attr_active_fc4type(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 32);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ ae->un.AttrTypes[3] = 0x02; /* Type 0x1 - ELS */
+ ae->un.AttrTypes[2] = 0x01; /* Type 0x8 - FCP */
+@@ -2442,7 +2442,7 @@ lpfc_fdmi_port_attr_port_state(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+ /* Link Up - operational */
+ ae->un.AttrInt = cpu_to_be32(LPFC_FDMI_PORTSTATE_ONLINE);
+ size = FOURBYTES + sizeof(uint32_t);
+@@ -2458,7 +2458,7 @@ lpfc_fdmi_port_attr_num_disc(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+ vport->fdmi_num_disc = lpfc_find_map_node(vport);
+ ae->un.AttrInt = cpu_to_be32(vport->fdmi_num_disc);
+ size = FOURBYTES + sizeof(uint32_t);
+@@ -2474,7 +2474,7 @@ lpfc_fdmi_port_attr_nportid(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+ ae->un.AttrInt = cpu_to_be32(vport->fc_myDID);
+ size = FOURBYTES + sizeof(uint32_t);
+ ad->AttrLen = cpu_to_be16(size);
+@@ -2489,8 +2489,8 @@ lpfc_fdmi_smart_attr_service(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ strncpy(ae->un.AttrString, "Smart SAN Initiator",
+ sizeof(ae->un.AttrString));
+@@ -2510,8 +2510,8 @@ lpfc_fdmi_smart_attr_guid(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ memcpy(&ae->un.AttrString, &vport->fc_sparam.nodeName,
+ sizeof(struct lpfc_name));
+@@ -2531,8 +2531,8 @@ lpfc_fdmi_smart_attr_version(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ strncpy(ae->un.AttrString, "Smart SAN Version 2.0",
+ sizeof(ae->un.AttrString));
+@@ -2553,8 +2553,8 @@ lpfc_fdmi_smart_attr_model(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t len, size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+- memset(ae, 0, 256);
++ ae = &ad->AttrValue;
++ memset(ae, 0, sizeof(*ae));
+
+ strncpy(ae->un.AttrString, phba->ModelName,
+ sizeof(ae->un.AttrString));
+@@ -2573,7 +2573,7 @@ lpfc_fdmi_smart_attr_port_info(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+
+ /* SRIOV (type 3) is not supported */
+ if (vport->vpi)
+@@ -2593,7 +2593,7 @@ lpfc_fdmi_smart_attr_qos(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+ ae->un.AttrInt = cpu_to_be32(0);
+ size = FOURBYTES + sizeof(uint32_t);
+ ad->AttrLen = cpu_to_be16(size);
+@@ -2608,7 +2608,7 @@ lpfc_fdmi_smart_attr_security(struct lpfc_vport *vport,
+ struct lpfc_fdmi_attr_entry *ae;
+ uint32_t size;
+
+- ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++ ae = &ad->AttrValue;
+ ae->un.AttrInt = cpu_to_be32(1);
+ size = FOURBYTES + sizeof(uint32_t);
+ ad->AttrLen = cpu_to_be16(size);
+@@ -2756,7 +2756,8 @@ lpfc_fdmi_cmd(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ /* Registered Port List */
+ /* One entry (port) per adapter */
+ rh->rpl.EntryCnt = cpu_to_be32(1);
+- memcpy(&rh->rpl.pe, &phba->pport->fc_sparam.portName,
++ memcpy(&rh->rpl.pe.PortName,
++ &phba->pport->fc_sparam.portName,
+ sizeof(struct lpfc_name));
+
+ /* point to the HBA attribute block */
+diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h
+index 009aa0eee0408..48d4d576d588e 100644
+--- a/drivers/scsi/lpfc/lpfc_hw.h
++++ b/drivers/scsi/lpfc/lpfc_hw.h
+@@ -1333,25 +1333,8 @@ struct fc_rdp_res_frame {
+ /* lpfc_sli_ct_request defines the CT_IU preamble for FDMI commands */
+ #define SLI_CT_FDMI_Subtypes 0x10 /* Management Service Subtype */
+
+-/*
+- * Registered Port List Format
+- */
+-struct lpfc_fdmi_reg_port_list {
+- uint32_t EntryCnt;
+- uint32_t pe; /* Variable-length array */
+-};
+-
+-
+ /* Definitions for HBA / Port attribute entries */
+
+-struct lpfc_fdmi_attr_def { /* Defined in TLV format */
+- /* Structure is in Big Endian format */
+- uint32_t AttrType:16;
+- uint32_t AttrLen:16;
+- uint32_t AttrValue; /* Marks start of Value (ATTRIBUTE_ENTRY) */
+-};
+-
+-
+ /* Attribute Entry */
+ struct lpfc_fdmi_attr_entry {
+ union {
+@@ -1362,7 +1345,13 @@ struct lpfc_fdmi_attr_entry {
+ } un;
+ };
+
+-#define LPFC_FDMI_MAX_AE_SIZE sizeof(struct lpfc_fdmi_attr_entry)
++struct lpfc_fdmi_attr_def { /* Defined in TLV format */
++ /* Structure is in Big Endian format */
++ uint32_t AttrType:16;
++ uint32_t AttrLen:16;
++ /* Marks start of Value (ATTRIBUTE_ENTRY) */
++ struct lpfc_fdmi_attr_entry AttrValue;
++} __packed;
+
+ /*
+ * HBA Attribute Block
+@@ -1386,13 +1375,20 @@ struct lpfc_fdmi_hba_ident {
+ struct lpfc_name PortName;
+ };
+
++/*
++ * Registered Port List Format
++ */
++struct lpfc_fdmi_reg_port_list {
++ uint32_t EntryCnt;
++ struct lpfc_fdmi_port_entry pe;
++} __packed;
++
+ /*
+ * Register HBA(RHBA)
+ */
+ struct lpfc_fdmi_reg_hba {
+ struct lpfc_fdmi_hba_ident hi;
+- struct lpfc_fdmi_reg_port_list rpl; /* variable-length array */
+-/* struct lpfc_fdmi_attr_block ab; */
++ struct lpfc_fdmi_reg_port_list rpl;
+ };
+
+ /*
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index a56a939792ac1..2ab351260e815 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -17413,6 +17413,10 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf)
+ list_add_tail(&iocbq->list, &first_iocbq->list);
+ }
+ }
++ /* Free the sequence's header buffer */
++ if (!first_iocbq)
++ lpfc_in_buf_free(vport->phba, &seq_dmabuf->dbuf);
++
+ return first_iocbq;
+ }
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index ba79b37d8cf7e..5becdde3ea324 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -1184,8 +1184,8 @@ int pm8001_abort_task(struct sas_task *task)
+ pm8001_ha = pm8001_find_ha_by_dev(dev);
+ device_id = pm8001_dev->device_id;
+ phy_id = pm8001_dev->attached_phy;
+- rc = pm8001_find_tag(task, &tag);
+- if (rc == 0) {
++ ret = pm8001_find_tag(task, &tag);
++ if (ret == 0) {
+ pm8001_printk("no tag for task:%p\n", task);
+ return TMF_RESP_FUNC_FAILED;
+ }
+@@ -1223,26 +1223,50 @@ int pm8001_abort_task(struct sas_task *task)
+
+ /* 2. Send Phy Control Hard Reset */
+ reinit_completion(&completion);
++ phy->port_reset_status = PORT_RESET_TMO;
+ phy->reset_success = false;
+ phy->enable_completion = &completion;
+ phy->reset_completion = &completion_reset;
+ ret = PM8001_CHIP_DISP->phy_ctl_req(pm8001_ha, phy_id,
+ PHY_HARD_RESET);
+- if (ret)
+- goto out;
+- PM8001_MSG_DBG(pm8001_ha,
+- pm8001_printk("Waiting for local phy ctl\n"));
+- wait_for_completion(&completion);
+- if (!phy->reset_success)
++ if (ret) {
++ phy->enable_completion = NULL;
++ phy->reset_completion = NULL;
+ goto out;
++ }
+
+- /* 3. Wait for Port Reset complete / Port reset TMO */
++ /* In the case of the reset timeout/fail we still
++ * abort the command at the firmware. The assumption
++ * here is that the drive is off doing something so
++ * that it's not processing requests, and we want to
++ * avoid getting a completion for this and either
++ * leaking the task in libsas or losing the race and
++ * getting a double free.
++ */
+ PM8001_MSG_DBG(pm8001_ha,
++ pm8001_printk("Waiting for local phy ctl\n"));
++ ret = wait_for_completion_timeout(&completion,
++ PM8001_TASK_TIMEOUT * HZ);
++ if (!ret || !phy->reset_success) {
++ phy->enable_completion = NULL;
++ phy->reset_completion = NULL;
++ } else {
++ /* 3. Wait for Port Reset complete or
++ * Port reset TMO
++ */
++ PM8001_MSG_DBG(pm8001_ha,
+ pm8001_printk("Waiting for Port reset\n"));
+- wait_for_completion(&completion_reset);
+- if (phy->port_reset_status) {
+- pm8001_dev_gone_notify(dev);
+- goto out;
++ ret = wait_for_completion_timeout(
++ &completion_reset,
++ PM8001_TASK_TIMEOUT * HZ);
++ if (!ret)
++ phy->reset_completion = NULL;
++ WARN_ON(phy->port_reset_status ==
++ PORT_RESET_TMO);
++ if (phy->port_reset_status == PORT_RESET_TMO) {
++ pm8001_dev_gone_notify(dev);
++ goto out;
++ }
+ }
+
+ /*
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index 751941a3ed303..aa451c8b49e56 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -1065,6 +1065,9 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
+ break;
+ }
+
++ if (!abrt_conn)
++ wait_delay += qedi->pf_params.iscsi_pf_params.two_msl_timer;
++
+ qedi_ep->state = EP_STATE_DISCONN_START;
+ ret = qedi_ops->destroy_conn(qedi->cdev, qedi_ep->handle, abrt_conn);
+ if (ret) {
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index eb10a5cacd90c..b2cbdd01ab10b 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -353,27 +353,27 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba,
+ u8 opcode = 0;
+ u32 intr, doorbell;
+ struct ufshcd_lrb *lrbp = &hba->lrb[tag];
++ struct scsi_cmnd *cmd = lrbp->cmd;
+ int transfer_len = -1;
+
+ if (!trace_ufshcd_command_enabled()) {
+ /* trace UPIU W/O tracing command */
+- if (lrbp->cmd)
++ if (cmd)
+ ufshcd_add_cmd_upiu_trace(hba, tag, str);
+ return;
+ }
+
+- if (lrbp->cmd) { /* data phase exists */
++ if (cmd) { /* data phase exists */
+ /* trace UPIU also */
+ ufshcd_add_cmd_upiu_trace(hba, tag, str);
+- opcode = (u8)(*lrbp->cmd->cmnd);
++ opcode = cmd->cmnd[0];
+ if ((opcode == READ_10) || (opcode == WRITE_10)) {
+ /*
+ * Currently we only fully trace read(10) and write(10)
+ * commands
+ */
+- if (lrbp->cmd->request && lrbp->cmd->request->bio)
+- lba =
+- lrbp->cmd->request->bio->bi_iter.bi_sector;
++ if (cmd->request && cmd->request->bio)
++ lba = cmd->request->bio->bi_iter.bi_sector;
+ transfer_len = be32_to_cpu(
+ lrbp->ucd_req_ptr->sc.exp_data_transfer_len);
+ }
+@@ -1910,12 +1910,12 @@ void ufshcd_send_command(struct ufs_hba *hba, unsigned int task_tag)
+ {
+ hba->lrb[task_tag].issue_time_stamp = ktime_get();
+ hba->lrb[task_tag].compl_time_stamp = ktime_set(0, 0);
++ ufshcd_add_command_trace(hba, task_tag, "send");
+ ufshcd_clk_scaling_start_busy(hba);
+ __set_bit(task_tag, &hba->outstanding_reqs);
+ ufshcd_writel(hba, 1 << task_tag, REG_UTP_TRANSFER_REQ_DOOR_BELL);
+ /* Make sure that doorbell is committed immediately */
+ wmb();
+- ufshcd_add_command_trace(hba, task_tag, "send");
+ }
+
+ /**
+diff --git a/drivers/staging/media/imx/imx-media-capture.c b/drivers/staging/media/imx/imx-media-capture.c
+index 256039ce561e6..81a3370551dbc 100644
+--- a/drivers/staging/media/imx/imx-media-capture.c
++++ b/drivers/staging/media/imx/imx-media-capture.c
+@@ -678,7 +678,7 @@ int imx_media_capture_device_register(struct imx_media_video_dev *vdev)
+ /* setup default format */
+ fmt_src.pad = priv->src_sd_pad;
+ fmt_src.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+- v4l2_subdev_call(sd, pad, get_fmt, NULL, &fmt_src);
++ ret = v4l2_subdev_call(sd, pad, get_fmt, NULL, &fmt_src);
+ if (ret) {
+ v4l2_err(sd, "failed to get src_sd format\n");
+ goto unreg;
+diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
+index 17b4b9257b495..0ddf41b5a734a 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
++++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
+@@ -1535,21 +1535,14 @@ static int amsdu_to_msdu(struct adapter *padapter, struct recv_frame *prframe)
+
+ /* Allocate new skb for releasing to upper layer */
+ sub_skb = dev_alloc_skb(nSubframe_Length + 12);
+- if (sub_skb) {
+- skb_reserve(sub_skb, 12);
+- skb_put_data(sub_skb, pdata, nSubframe_Length);
+- } else {
+- sub_skb = skb_clone(prframe->pkt, GFP_ATOMIC);
+- if (sub_skb) {
+- sub_skb->data = pdata;
+- sub_skb->len = nSubframe_Length;
+- skb_set_tail_pointer(sub_skb, nSubframe_Length);
+- } else {
+- DBG_88E("skb_clone() Fail!!! , nr_subframes=%d\n", nr_subframes);
+- break;
+- }
++ if (!sub_skb) {
++ DBG_88E("dev_alloc_skb() Fail!!! , nr_subframes=%d\n", nr_subframes);
++ break;
+ }
+
++ skb_reserve(sub_skb, 12);
++ skb_put_data(sub_skb, pdata, nSubframe_Length);
++
+ subframes[nr_subframes++] = sub_skb;
+
+ if (nr_subframes >= MAX_SUBFRAME_COUNT) {
+diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
+index 4dc30e7890f6c..140386d7c75a3 100644
+--- a/drivers/thermal/rcar_thermal.c
++++ b/drivers/thermal/rcar_thermal.c
+@@ -505,8 +505,10 @@ static int rcar_thermal_probe(struct platform_device *pdev)
+ res = platform_get_resource(pdev, IORESOURCE_MEM,
+ mres++);
+ common->base = devm_ioremap_resource(dev, res);
+- if (IS_ERR(common->base))
+- return PTR_ERR(common->base);
++ if (IS_ERR(common->base)) {
++ ret = PTR_ERR(common->base);
++ goto error_unregister;
++ }
+
+ idle = 0; /* polling delay is not needed */
+ }
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index a019286f8bb65..cbd006fb7fbb9 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -781,7 +781,10 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ dmaengine_tx_status(dma->rxchan, dma->rx_cookie, &state);
+
+ count = dma->rx_size - state.residue;
+-
++ if (count < dma->rx_size)
++ dmaengine_terminate_async(dma->rxchan);
++ if (!count)
++ goto unlock;
+ ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
+
+ p->port.icount.rx += ret;
+@@ -843,7 +846,6 @@ static void omap_8250_rx_dma_flush(struct uart_8250_port *p)
+ spin_unlock_irqrestore(&priv->rx_dma_lock, flags);
+
+ __dma_rx_do_complete(p);
+- dmaengine_terminate_all(dma->rxchan);
+ }
+
+ static int omap_8250_rx_dma(struct uart_8250_port *p)
+@@ -1227,11 +1229,11 @@ static int omap8250_probe(struct platform_device *pdev)
+ spin_lock_init(&priv->rx_dma_lock);
+
+ device_init_wakeup(&pdev->dev, true);
++ pm_runtime_enable(&pdev->dev);
+ pm_runtime_use_autosuspend(&pdev->dev);
+ pm_runtime_set_autosuspend_delay(&pdev->dev, -1);
+
+ pm_runtime_irq_safe(&pdev->dev);
+- pm_runtime_enable(&pdev->dev);
+
+ pm_runtime_get_sync(&pdev->dev);
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 09f0dc3b967b1..60ca19eca1f63 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1861,6 +1861,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ unsigned char status;
+ unsigned long flags;
+ struct uart_8250_port *up = up_to_u8250p(port);
++ bool skip_rx = false;
+
+ if (iir & UART_IIR_NO_INT)
+ return 0;
+@@ -1869,7 +1870,20 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+
+ status = serial_port_in(port, UART_LSR);
+
+- if (status & (UART_LSR_DR | UART_LSR_BI)) {
++ /*
++ * If port is stopped and there are no error conditions in the
++ * FIFO, then don't drain the FIFO, as this may lead to TTY buffer
++ * overflow. Not servicing, RX FIFO would trigger auto HW flow
++ * control when FIFO occupancy reaches preset threshold, thus
++ * halting RX. This only works when auto HW flow control is
++ * available.
++ */
++ if (!(status & (UART_LSR_FIFOE | UART_LSR_BRK_ERROR_BITS)) &&
++ (port->status & (UPSTAT_AUTOCTS | UPSTAT_AUTORTS)) &&
++ !(port->read_status_mask & UART_LSR_DR))
++ skip_rx = true;
++
++ if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) {
+ if (!up->dma || handle_rx_dma(up, iir))
+ status = serial8250_rx_chars(up, status);
+ }
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index fcb89bf2524d1..1528a7ba2bf4d 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1187,14 +1187,14 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport,
+ struct s3c24xx_uart_info *info = ourport->info;
+ struct clk *clk;
+ unsigned long rate;
+- unsigned int cnt, baud, quot, clk_sel, best_quot = 0;
++ unsigned int cnt, baud, quot, best_quot = 0;
+ char clkname[MAX_CLK_NAME_LENGTH];
+ int calc_deviation, deviation = (1 << 30) - 1;
+
+- clk_sel = (ourport->cfg->clk_sel) ? ourport->cfg->clk_sel :
+- ourport->info->def_clk_sel;
+ for (cnt = 0; cnt < info->num_clks; cnt++) {
+- if (!(clk_sel & (1 << cnt)))
++ /* Keep selected clock if provided */
++ if (ourport->cfg->clk_sel &&
++ !(ourport->cfg->clk_sel & (1 << cnt)))
+ continue;
+
+ sprintf(clkname, "clk_uart_baud%d", cnt);
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index 31950a38f0fb7..23f9b0cdff086 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1236,6 +1236,7 @@ static int cdns_uart_console_setup(struct console *co, char *options)
+ int bits = 8;
+ int parity = 'n';
+ int flow = 'n';
++ unsigned long time_out;
+
+ if (!port->membase) {
+ pr_debug("console on " CDNS_UART_TTY_NAME "%i not present\n",
+@@ -1246,6 +1247,13 @@ static int cdns_uart_console_setup(struct console *co, char *options)
+ if (options)
+ uart_parse_options(options, &baud, &parity, &bits, &flow);
+
++ /* Wait for tx_empty before setting up the console */
++ time_out = jiffies + usecs_to_jiffies(TX_TIMEOUT);
++
++ while (time_before(jiffies, time_out) &&
++ cdns_uart_tx_empty(port) != TIOCSER_TEMT)
++ cpu_relax();
++
+ return uart_set_options(port, co, baud, parity, bits, flow);
+ }
+
+diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c
+index 58b454c34560a..10a832a2135e2 100644
+--- a/drivers/tty/vcc.c
++++ b/drivers/tty/vcc.c
+@@ -604,6 +604,7 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+ port->index = vcc_table_add(port);
+ if (port->index == -1) {
+ pr_err("VCC: no more TTY indices left for allocation\n");
++ rv = -ENOMEM;
+ goto free_ldc;
+ }
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 7bf2573dd459e..37cc3fd7c3cad 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -270,7 +270,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
+ {
+ const struct usb_endpoint_descriptor *desc = dep->endpoint.desc;
+ struct dwc3 *dwc = dep->dwc;
+- u32 timeout = 1000;
++ u32 timeout = 5000;
+ u32 saved_config = 0;
+ u32 reg;
+
+diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
+index de764459e05a6..9d93e7441bbca 100644
+--- a/drivers/usb/host/ehci-mv.c
++++ b/drivers/usb/host/ehci-mv.c
+@@ -192,12 +192,10 @@ static int mv_ehci_probe(struct platform_device *pdev)
+ hcd->rsrc_len = resource_size(r);
+ hcd->regs = ehci_mv->op_regs;
+
+- hcd->irq = platform_get_irq(pdev, 0);
+- if (!hcd->irq) {
+- dev_err(&pdev->dev, "Cannot get irq.");
+- retval = -ENODEV;
++ retval = platform_get_irq(pdev, 0);
++ if (retval < 0)
+ goto err_disable_clk;
+- }
++ hcd->irq = retval;
+
+ ehci = hcd_to_ehci(hcd);
+ ehci->caps = (struct ehci_caps *) ehci_mv->cap_regs;
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 9f72a6ee13b53..58e7336b2748b 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -409,6 +409,19 @@ static void vfio_pci_release(void *device_data)
+ if (!(--vdev->refcnt)) {
+ vfio_spapr_pci_eeh_release(vdev->pdev);
+ vfio_pci_disable(vdev);
++ mutex_lock(&vdev->igate);
++ if (vdev->err_trigger) {
++ eventfd_ctx_put(vdev->err_trigger);
++ vdev->err_trigger = NULL;
++ }
++ mutex_unlock(&vdev->igate);
++
++ mutex_lock(&vdev->igate);
++ if (vdev->req_trigger) {
++ eventfd_ctx_put(vdev->req_trigger);
++ vdev->req_trigger = NULL;
++ }
++ mutex_unlock(&vdev->igate);
+ }
+
+ mutex_unlock(&driver_lock);
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 8ac8f7469354b..9f3faac490259 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1793,6 +1793,16 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
+ struct gendisk *disk = bdev->bd_disk;
+ struct block_device *victim = NULL;
+
++ /*
++ * Sync early if it looks like we're the last one. If someone else
++ * opens the block device between now and the decrement of bd_openers
++ * then we did a sync that we didn't need to, but that's not the end
++ * of the world and we want to avoid long (could be several minute)
++ * syncs while holding the mutex.
++ */
++ if (bdev->bd_openers == 1)
++ sync_blockdev(bdev);
++
+ mutex_lock_nested(&bdev->bd_mutex, for_part);
+ if (for_part)
+ bdev->bd_part_count--;
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 319a89d4d0735..ce5e0f6c6af4f 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -9098,8 +9098,6 @@ out:
+ */
+ if (!for_reloc && !root_dropped)
+ btrfs_add_dead_root(root);
+- if (err && err != -EAGAIN)
+- btrfs_handle_fs_error(fs_info, err, NULL);
+ return err;
+ }
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index bdfe159a60da6..64d459ca76d06 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -8913,20 +8913,17 @@ again:
+ /*
+ * Qgroup reserved space handler
+ * Page here will be either
+- * 1) Already written to disk
+- * In this case, its reserved space is released from data rsv map
+- * and will be freed by delayed_ref handler finally.
+- * So even we call qgroup_free_data(), it won't decrease reserved
+- * space.
+- * 2) Not written to disk
+- * This means the reserved space should be freed here. However,
+- * if a truncate invalidates the page (by clearing PageDirty)
+- * and the page is accounted for while allocating extent
+- * in btrfs_check_data_free_space() we let delayed_ref to
+- * free the entire extent.
++ * 1) Already written to disk or ordered extent already submitted
++ * Then its QGROUP_RESERVED bit in io_tree is already cleaned.
++ * Qgroup will be handled by its qgroup_record then.
++ * btrfs_qgroup_free_data() call will do nothing here.
++ *
++ * 2) Not written to disk yet
++ * Then btrfs_qgroup_free_data() call will clear the QGROUP_RESERVED
++ * bit of its io_tree, and free the qgroup reserved data space.
++ * Since the IO will never happen for this page.
+ */
+- if (PageDirty(page))
+- btrfs_qgroup_free_data(inode, NULL, page_start, PAGE_SIZE);
++ btrfs_qgroup_free_data(inode, NULL, page_start, PAGE_SIZE);
+ if (!inode_evicting) {
+ clear_extent_bit(tree, page_start, page_end,
+ EXTENT_LOCKED | EXTENT_DIRTY |
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index a2d4eed27f804..c0dbf8b7762b4 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -2015,12 +2015,24 @@ ack:
+ if (mutex_trylock(&session->s_mutex) == 0) {
+ dout("inverting session/ino locks on %p\n",
+ session);
++ session = ceph_get_mds_session(session);
+ spin_unlock(&ci->i_ceph_lock);
+ if (took_snap_rwsem) {
+ up_read(&mdsc->snap_rwsem);
+ took_snap_rwsem = 0;
+ }
+- mutex_lock(&session->s_mutex);
++ if (session) {
++ mutex_lock(&session->s_mutex);
++ ceph_put_mds_session(session);
++ } else {
++ /*
++ * Because we take the reference while
++ * holding the i_ceph_lock, it should
++ * never be NULL. Throw a warning if it
++ * ever is.
++ */
++ WARN_ON_ONCE(true);
++ }
+ goto retry;
+ }
+ }
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 1e438e0faf77e..3c24fb77ef325 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -764,8 +764,11 @@ static int fill_inode(struct inode *inode, struct page *locked_page,
+ info_caps = le32_to_cpu(info->cap.caps);
+
+ /* prealloc new cap struct */
+- if (info_caps && ceph_snap(inode) == CEPH_NOSNAP)
++ if (info_caps && ceph_snap(inode) == CEPH_NOSNAP) {
+ new_cap = ceph_get_cap(mdsc, caps_reservation);
++ if (!new_cap)
++ return -ENOMEM;
++ }
+
+ /*
+ * prealloc xattr data, if it looks like we'll need it. only
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 71c2dd0c7f038..2c632793c88c5 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -259,8 +259,9 @@ struct smb_version_operations {
+ int (*check_message)(char *, unsigned int, struct TCP_Server_Info *);
+ bool (*is_oplock_break)(char *, struct TCP_Server_Info *);
+ int (*handle_cancelled_mid)(char *, struct TCP_Server_Info *);
+- void (*downgrade_oplock)(struct TCP_Server_Info *,
+- struct cifsInodeInfo *, bool);
++ void (*downgrade_oplock)(struct TCP_Server_Info *server,
++ struct cifsInodeInfo *cinode, __u32 oplock,
++ unsigned int epoch, bool *purge_cache);
+ /* process transaction2 response */
+ bool (*check_trans2)(struct mid_q_entry *, struct TCP_Server_Info *,
+ char *, int);
+@@ -1160,6 +1161,8 @@ struct cifsFileInfo {
+ unsigned int f_flags;
+ bool invalidHandle:1; /* file closed via session abend */
+ bool oplock_break_cancelled:1;
++ unsigned int oplock_epoch; /* epoch from the lease break */
++ __u32 oplock_level; /* oplock/lease level from the lease break */
+ int count;
+ spinlock_t file_info_lock; /* protects four flag/count fields above */
+ struct mutex fh_mutex; /* prevents reopen race after dead ses*/
+@@ -1300,7 +1303,7 @@ struct cifsInodeInfo {
+ unsigned int epoch; /* used to track lease state changes */
+ #define CIFS_INODE_PENDING_OPLOCK_BREAK (0) /* oplock break in progress */
+ #define CIFS_INODE_PENDING_WRITERS (1) /* Writes in progress */
+-#define CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 (2) /* Downgrade oplock to L2 */
++#define CIFS_INODE_FLAG_UNUSED (2) /* Unused flag */
+ #define CIFS_INO_DELETE_PENDING (3) /* delete pending on server */
+ #define CIFS_INO_INVALID_MAPPING (4) /* pagecache is invalid */
+ #define CIFS_INO_LOCK (5) /* lock bit for synchronization */
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 128cbd69911b4..5cb15649adb07 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -3804,7 +3804,8 @@ readpages_get_pages(struct address_space *mapping, struct list_head *page_list,
+ break;
+
+ __SetPageLocked(page);
+- if (add_to_page_cache_locked(page, mapping, page->index, gfp)) {
++ rc = add_to_page_cache_locked(page, mapping, page->index, gfp);
++ if (rc) {
+ __ClearPageLocked(page);
+ break;
+ }
+@@ -3820,6 +3821,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
+ struct list_head *page_list, unsigned num_pages)
+ {
+ int rc;
++ int err = 0;
+ struct list_head tmplist;
+ struct cifsFileInfo *open_file = file->private_data;
+ struct cifs_sb_info *cifs_sb = CIFS_FILE_SB(file);
+@@ -3860,7 +3862,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
+ * the order of declining indexes. When we put the pages in
+ * the rdata->pages, then we want them in increasing order.
+ */
+- while (!list_empty(page_list)) {
++ while (!list_empty(page_list) && !err) {
+ unsigned int i, nr_pages, bytes, rsize;
+ loff_t offset;
+ struct page *page, *tpage;
+@@ -3883,9 +3885,10 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
+ return 0;
+ }
+
+- rc = readpages_get_pages(mapping, page_list, rsize, &tmplist,
++ nr_pages = 0;
++ err = readpages_get_pages(mapping, page_list, rsize, &tmplist,
+ &nr_pages, &offset, &bytes);
+- if (rc) {
++ if (!nr_pages) {
+ add_credits_and_wake_if(server, credits, 0);
+ break;
+ }
+@@ -4185,12 +4188,13 @@ void cifs_oplock_break(struct work_struct *work)
+ struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
+ struct TCP_Server_Info *server = tcon->ses->server;
+ int rc = 0;
++ bool purge_cache = false;
+
+ wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS,
+ TASK_UNINTERRUPTIBLE);
+
+- server->ops->downgrade_oplock(server, cinode,
+- test_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, &cinode->flags));
++ server->ops->downgrade_oplock(server, cinode, cfile->oplock_level,
++ cfile->oplock_epoch, &purge_cache);
+
+ if (!CIFS_CACHE_WRITE(cinode) && CIFS_CACHE_READ(cinode) &&
+ cifs_has_mand_locks(cinode)) {
+@@ -4205,18 +4209,21 @@ void cifs_oplock_break(struct work_struct *work)
+ else
+ break_lease(inode, O_WRONLY);
+ rc = filemap_fdatawrite(inode->i_mapping);
+- if (!CIFS_CACHE_READ(cinode)) {
++ if (!CIFS_CACHE_READ(cinode) || purge_cache) {
+ rc = filemap_fdatawait(inode->i_mapping);
+ mapping_set_error(inode->i_mapping, rc);
+ cifs_zap_mapping(inode);
+ }
+ cifs_dbg(FYI, "Oplock flush inode %p rc %d\n", inode, rc);
++ if (CIFS_CACHE_WRITE(cinode))
++ goto oplock_break_ack;
+ }
+
+ rc = cifs_push_locks(cfile);
+ if (rc)
+ cifs_dbg(VFS, "Push locks rc = %d\n", rc);
+
++oplock_break_ack:
+ /*
+ * releasing stale oplock after recent reconnect of smb session using
+ * a now incorrect file handle is not a data integrity issue but do
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index e45f8e321371c..dd67f56ea61e5 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -477,21 +477,10 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
+ set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK,
+ &pCifsInode->flags);
+
+- /*
+- * Set flag if the server downgrades the oplock
+- * to L2 else clear.
+- */
+- if (pSMB->OplockLevel)
+- set_bit(
+- CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+- &pCifsInode->flags);
+- else
+- clear_bit(
+- CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+- &pCifsInode->flags);
+-
+- cifs_queue_oplock_break(netfile);
++ netfile->oplock_epoch = 0;
++ netfile->oplock_level = pSMB->OplockLevel;
+ netfile->oplock_break_cancelled = false;
++ cifs_queue_oplock_break(netfile);
+
+ spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
+index c7f0c85664425..0b7f924512848 100644
+--- a/fs/cifs/smb1ops.c
++++ b/fs/cifs/smb1ops.c
+@@ -381,12 +381,10 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr)
+
+ static void
+ cifs_downgrade_oplock(struct TCP_Server_Info *server,
+- struct cifsInodeInfo *cinode, bool set_level2)
++ struct cifsInodeInfo *cinode, __u32 oplock,
++ unsigned int epoch, bool *purge_cache)
+ {
+- if (set_level2)
+- cifs_set_oplock_level(cinode, OPLOCK_READ);
+- else
+- cifs_set_oplock_level(cinode, 0);
++ cifs_set_oplock_level(cinode, oplock);
+ }
+
+ static bool
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 2fc96f7923ee5..7d875a47d0226 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -550,7 +550,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp)
+
+ cifs_dbg(FYI, "found in the open list\n");
+ cifs_dbg(FYI, "lease key match, lease break 0x%x\n",
+- le32_to_cpu(rsp->NewLeaseState));
++ lease_state);
+
+ if (ack_req)
+ cfile->oplock_break_cancelled = false;
+@@ -559,17 +559,8 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp)
+
+ set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags);
+
+- /*
+- * Set or clear flags depending on the lease state being READ.
+- * HANDLE caching flag should be added when the client starts
+- * to defer closing remote file handles with HANDLE leases.
+- */
+- if (lease_state & SMB2_LEASE_READ_CACHING_HE)
+- set_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+- &cinode->flags);
+- else
+- clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+- &cinode->flags);
++ cfile->oplock_epoch = le16_to_cpu(rsp->Epoch);
++ cfile->oplock_level = lease_state;
+
+ cifs_queue_oplock_break(cfile);
+ return true;
+@@ -599,7 +590,7 @@ smb2_tcon_find_pending_open_lease(struct cifs_tcon *tcon,
+
+ cifs_dbg(FYI, "found in the pending open list\n");
+ cifs_dbg(FYI, "lease key match, lease break 0x%x\n",
+- le32_to_cpu(rsp->NewLeaseState));
++ lease_state);
+
+ open->oplock = lease_state;
+ }
+@@ -732,18 +723,9 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK,
+ &cinode->flags);
+
+- /*
+- * Set flag if the server downgrades the oplock
+- * to L2 else clear.
+- */
+- if (rsp->OplockLevel)
+- set_bit(
+- CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+- &cinode->flags);
+- else
+- clear_bit(
+- CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+- &cinode->flags);
++ cfile->oplock_epoch = 0;
++ cfile->oplock_level = rsp->OplockLevel;
++
+ spin_unlock(&cfile->file_info_lock);
+
+ cifs_queue_oplock_break(cfile);
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 2a523139a05fb..947a40069d246 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2358,22 +2358,38 @@ static long smb3_fallocate(struct file *file, struct cifs_tcon *tcon, int mode,
+
+ static void
+ smb2_downgrade_oplock(struct TCP_Server_Info *server,
+- struct cifsInodeInfo *cinode, bool set_level2)
++ struct cifsInodeInfo *cinode, __u32 oplock,
++ unsigned int epoch, bool *purge_cache)
+ {
+- if (set_level2)
+- server->ops->set_oplock_level(cinode, SMB2_OPLOCK_LEVEL_II,
+- 0, NULL);
+- else
+- server->ops->set_oplock_level(cinode, 0, 0, NULL);
++ server->ops->set_oplock_level(cinode, oplock, 0, NULL);
+ }
+
+ static void
+-smb21_downgrade_oplock(struct TCP_Server_Info *server,
+- struct cifsInodeInfo *cinode, bool set_level2)
++smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
++ unsigned int epoch, bool *purge_cache);
++
++static void
++smb3_downgrade_oplock(struct TCP_Server_Info *server,
++ struct cifsInodeInfo *cinode, __u32 oplock,
++ unsigned int epoch, bool *purge_cache)
+ {
+- server->ops->set_oplock_level(cinode,
+- set_level2 ? SMB2_LEASE_READ_CACHING_HE :
+- 0, 0, NULL);
++ unsigned int old_state = cinode->oplock;
++ unsigned int old_epoch = cinode->epoch;
++ unsigned int new_state;
++
++ if (epoch > old_epoch) {
++ smb21_set_oplock_level(cinode, oplock, 0, NULL);
++ cinode->epoch = epoch;
++ }
++
++ new_state = cinode->oplock;
++ *purge_cache = false;
++
++ if ((old_state & CIFS_CACHE_READ_FLG) != 0 &&
++ (new_state & CIFS_CACHE_READ_FLG) == 0)
++ *purge_cache = true;
++ else if (old_state == new_state && (epoch - old_epoch > 1))
++ *purge_cache = true;
+ }
+
+ static void
+@@ -3449,7 +3465,7 @@ struct smb_version_operations smb21_operations = {
+ .print_stats = smb2_print_stats,
+ .is_oplock_break = smb2_is_valid_oplock_break,
+ .handle_cancelled_mid = smb2_handle_cancelled_mid,
+- .downgrade_oplock = smb21_downgrade_oplock,
++ .downgrade_oplock = smb2_downgrade_oplock,
+ .need_neg = smb2_need_neg,
+ .negotiate = smb2_negotiate,
+ .negotiate_wsize = smb2_negotiate_wsize,
+@@ -3546,7 +3562,7 @@ struct smb_version_operations smb30_operations = {
+ .dump_share_caps = smb2_dump_share_caps,
+ .is_oplock_break = smb2_is_valid_oplock_break,
+ .handle_cancelled_mid = smb2_handle_cancelled_mid,
+- .downgrade_oplock = smb21_downgrade_oplock,
++ .downgrade_oplock = smb3_downgrade_oplock,
+ .need_neg = smb2_need_neg,
+ .negotiate = smb2_negotiate,
+ .negotiate_wsize = smb2_negotiate_wsize,
+@@ -3651,7 +3667,7 @@ struct smb_version_operations smb311_operations = {
+ .dump_share_caps = smb2_dump_share_caps,
+ .is_oplock_break = smb2_is_valid_oplock_break,
+ .handle_cancelled_mid = smb2_handle_cancelled_mid,
+- .downgrade_oplock = smb21_downgrade_oplock,
++ .downgrade_oplock = smb3_downgrade_oplock,
+ .need_neg = smb2_need_neg,
+ .negotiate = smb2_negotiate,
+ .negotiate_wsize = smb2_negotiate_wsize,
+diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
+index 308c682fa4d3b..44501f8cbd75e 100644
+--- a/fs/cifs/smb2pdu.h
++++ b/fs/cifs/smb2pdu.h
+@@ -1209,7 +1209,7 @@ struct smb2_oplock_break {
+ struct smb2_lease_break {
+ struct smb2_sync_hdr sync_hdr;
+ __le16 StructureSize; /* Must be 44 */
+- __le16 Reserved;
++ __le16 Epoch;
+ __le32 Flags;
+ __u8 LeaseKey[16];
+ __le32 CurrentLeaseState;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 6e0022326afe3..20370a0997bf9 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -864,17 +864,19 @@ struct dentry *dget_parent(struct dentry *dentry)
+ {
+ int gotref;
+ struct dentry *ret;
++ unsigned seq;
+
+ /*
+ * Do optimistic parent lookup without any
+ * locking.
+ */
+ rcu_read_lock();
++ seq = raw_seqcount_begin(&dentry->d_seq);
+ ret = READ_ONCE(dentry->d_parent);
+ gotref = lockref_get_not_zero(&ret->d_lockref);
+ rcu_read_unlock();
+ if (likely(gotref)) {
+- if (likely(ret == READ_ONCE(dentry->d_parent)))
++ if (!read_seqcount_retry(&dentry->d_seq, seq))
+ return ret;
+ dput(ret);
+ }
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index cd833f4e64ef1..52be4c9650241 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5315,7 +5315,7 @@ static int ext4_do_update_inode(handle_t *handle,
+ raw_inode->i_file_acl_high =
+ cpu_to_le16(ei->i_file_acl >> 32);
+ raw_inode->i_file_acl_lo = cpu_to_le32(ei->i_file_acl);
+- if (ei->i_disksize != ext4_isize(inode->i_sb, raw_inode)) {
++ if (READ_ONCE(ei->i_disksize) != ext4_isize(inode->i_sb, raw_inode)) {
+ ext4_isize_set(raw_inode, ei->i_disksize);
+ need_datasync = 1;
+ }
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 8dd54a8a03610..054cfdd007d69 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -1901,8 +1901,15 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
+ BUG_ON(buddy == NULL);
+
+ k = mb_find_next_zero_bit(buddy, max, 0);
+- BUG_ON(k >= max);
+-
++ if (k >= max) {
++ ext4_grp_locked_error(ac->ac_sb, e4b->bd_group, 0, 0,
++ "%d free clusters of order %d. But found 0",
++ grp->bb_counters[i], i);
++ ext4_mark_group_bitmap_corrupted(ac->ac_sb,
++ e4b->bd_group,
++ EXT4_GROUP_INFO_BBITMAP_CORRUPT);
++ break;
++ }
+ ac->ac_found++;
+
+ ac->ac_b_ex.fe_len = 1 << i;
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 01e6ea11822bf..c51c9a6881e49 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -831,7 +831,6 @@ static int fuse_check_page(struct page *page)
+ {
+ if (page_mapcount(page) ||
+ page->mapping != NULL ||
+- page_count(page) != 1 ||
+ (page->flags & PAGE_FLAGS_CHECK_AT_PREP &
+ ~(1 << PG_locked |
+ 1 << PG_referenced |
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index d968b5c5df217..a52b8b0dceeb9 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -715,7 +715,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+
+ error = gfs2_trans_begin(sdp, blocks, 0);
+ if (error)
+- goto fail_gunlock2;
++ goto fail_free_inode;
+
+ if (blocks > 1) {
+ ip->i_eattr = ip->i_no_addr + 1;
+@@ -726,7 +726,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+
+ error = gfs2_glock_get(sdp, ip->i_no_addr, &gfs2_iopen_glops, CREATE, &io_gl);
+ if (error)
+- goto fail_gunlock2;
++ goto fail_free_inode;
+
+ BUG_ON(test_and_set_bit(GLF_INODE_CREATING, &io_gl->gl_flags));
+
+@@ -735,7 +735,6 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+ goto fail_gunlock2;
+
+ glock_set_object(ip->i_iopen_gh.gh_gl, ip);
+- gfs2_glock_put(io_gl);
+ gfs2_set_iop(inode);
+ insert_inode_hash(inode);
+
+@@ -768,6 +767,8 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+
+ mark_inode_dirty(inode);
+ d_instantiate(dentry, inode);
++ /* After instantiate, errors should result in evict which will destroy
++ * both inode and iopen glocks properly. */
+ if (file) {
+ file->f_mode |= FMODE_CREATED;
+ error = finish_open(file, dentry, gfs2_open_common);
+@@ -775,15 +776,15 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+ gfs2_glock_dq_uninit(ghs);
+ gfs2_glock_dq_uninit(ghs + 1);
+ clear_bit(GLF_INODE_CREATING, &io_gl->gl_flags);
++ gfs2_glock_put(io_gl);
+ return error;
+
+ fail_gunlock3:
+ glock_clear_object(io_gl, ip);
+ gfs2_glock_dq_uninit(&ip->i_iopen_gh);
+- gfs2_glock_put(io_gl);
+ fail_gunlock2:
+- if (io_gl)
+- clear_bit(GLF_INODE_CREATING, &io_gl->gl_flags);
++ clear_bit(GLF_INODE_CREATING, &io_gl->gl_flags);
++ gfs2_glock_put(io_gl);
+ fail_free_inode:
+ if (ip->i_gl) {
+ glock_clear_object(ip->i_gl, ip);
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index 5dae7c85d9b6e..2c7d76b4c5e18 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -132,47 +132,70 @@ nfs_async_iocounter_wait(struct rpc_task *task, struct nfs_lock_context *l_ctx)
+ EXPORT_SYMBOL_GPL(nfs_async_iocounter_wait);
+
+ /*
+- * nfs_page_group_lock - lock the head of the page group
+- * @req - request in group that is to be locked
++ * nfs_page_set_headlock - set the request PG_HEADLOCK
++ * @req: request that is to be locked
+ *
+- * this lock must be held when traversing or modifying the page
+- * group list
++ * this lock must be held when modifying req->wb_head
+ *
+ * return 0 on success, < 0 on error
+ */
+ int
+-nfs_page_group_lock(struct nfs_page *req)
++nfs_page_set_headlock(struct nfs_page *req)
+ {
+- struct nfs_page *head = req->wb_head;
+-
+- WARN_ON_ONCE(head != head->wb_head);
+-
+- if (!test_and_set_bit(PG_HEADLOCK, &head->wb_flags))
++ if (!test_and_set_bit(PG_HEADLOCK, &req->wb_flags))
+ return 0;
+
+- set_bit(PG_CONTENDED1, &head->wb_flags);
++ set_bit(PG_CONTENDED1, &req->wb_flags);
+ smp_mb__after_atomic();
+- return wait_on_bit_lock(&head->wb_flags, PG_HEADLOCK,
++ return wait_on_bit_lock(&req->wb_flags, PG_HEADLOCK,
+ TASK_UNINTERRUPTIBLE);
+ }
+
+ /*
+- * nfs_page_group_unlock - unlock the head of the page group
+- * @req - request in group that is to be unlocked
++ * nfs_page_clear_headlock - clear the request PG_HEADLOCK
++ * @req: request that is to be locked
+ */
+ void
+-nfs_page_group_unlock(struct nfs_page *req)
++nfs_page_clear_headlock(struct nfs_page *req)
+ {
+- struct nfs_page *head = req->wb_head;
+-
+- WARN_ON_ONCE(head != head->wb_head);
+-
+ smp_mb__before_atomic();
+- clear_bit(PG_HEADLOCK, &head->wb_flags);
++ clear_bit(PG_HEADLOCK, &req->wb_flags);
+ smp_mb__after_atomic();
+- if (!test_bit(PG_CONTENDED1, &head->wb_flags))
++ if (!test_bit(PG_CONTENDED1, &req->wb_flags))
+ return;
+- wake_up_bit(&head->wb_flags, PG_HEADLOCK);
++ wake_up_bit(&req->wb_flags, PG_HEADLOCK);
++}
++
++/*
++ * nfs_page_group_lock - lock the head of the page group
++ * @req: request in group that is to be locked
++ *
++ * this lock must be held when traversing or modifying the page
++ * group list
++ *
++ * return 0 on success, < 0 on error
++ */
++int
++nfs_page_group_lock(struct nfs_page *req)
++{
++ int ret;
++
++ ret = nfs_page_set_headlock(req);
++ if (ret || req->wb_head == req)
++ return ret;
++ return nfs_page_set_headlock(req->wb_head);
++}
++
++/*
++ * nfs_page_group_unlock - unlock the head of the page group
++ * @req: request in group that is to be unlocked
++ */
++void
++nfs_page_group_unlock(struct nfs_page *req)
++{
++ if (req != req->wb_head)
++ nfs_page_clear_headlock(req->wb_head);
++ nfs_page_clear_headlock(req);
+ }
+
+ /*
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 63d20308a9bb7..d419d89b91f7c 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -416,22 +416,28 @@ nfs_destroy_unlinked_subrequests(struct nfs_page *destroy_list,
+ destroy_list = (subreq->wb_this_page == old_head) ?
+ NULL : subreq->wb_this_page;
+
++ /* Note: lock subreq in order to change subreq->wb_head */
++ nfs_page_set_headlock(subreq);
+ WARN_ON_ONCE(old_head != subreq->wb_head);
+
+ /* make sure old group is not used */
+ subreq->wb_this_page = subreq;
++ subreq->wb_head = subreq;
+
+ clear_bit(PG_REMOVE, &subreq->wb_flags);
+
+ /* Note: races with nfs_page_group_destroy() */
+ if (!kref_read(&subreq->wb_kref)) {
+ /* Check if we raced with nfs_page_group_destroy() */
+- if (test_and_clear_bit(PG_TEARDOWN, &subreq->wb_flags))
++ if (test_and_clear_bit(PG_TEARDOWN, &subreq->wb_flags)) {
++ nfs_page_clear_headlock(subreq);
+ nfs_free_request(subreq);
++ } else
++ nfs_page_clear_headlock(subreq);
+ continue;
+ }
++ nfs_page_clear_headlock(subreq);
+
+- subreq->wb_head = subreq;
+ nfs_release_request(old_head);
+
+ if (test_and_clear_bit(PG_INODE_REF, &subreq->wb_flags)) {
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index c24306af9758f..655079ae1dd1f 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -471,6 +471,8 @@ find_any_file(struct nfs4_file *f)
+ {
+ struct file *ret;
+
++ if (!f)
++ return NULL;
+ spin_lock(&f->fi_lock);
+ ret = __nfs4_get_fd(f, O_RDWR);
+ if (!ret) {
+@@ -1207,6 +1209,12 @@ static void nfs4_put_stateowner(struct nfs4_stateowner *sop)
+ nfs4_free_stateowner(sop);
+ }
+
++static bool
++nfs4_ol_stateid_unhashed(const struct nfs4_ol_stateid *stp)
++{
++ return list_empty(&stp->st_perfile);
++}
++
+ static bool unhash_ol_stateid(struct nfs4_ol_stateid *stp)
+ {
+ struct nfs4_file *fp = stp->st_stid.sc_file;
+@@ -1274,9 +1282,11 @@ static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
+ {
+ lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
+
++ if (!unhash_ol_stateid(stp))
++ return false;
+ list_del_init(&stp->st_locks);
+ nfs4_unhash_stid(&stp->st_stid);
+- return unhash_ol_stateid(stp);
++ return true;
+ }
+
+ static void release_lock_stateid(struct nfs4_ol_stateid *stp)
+@@ -1341,13 +1351,12 @@ static void release_open_stateid_locks(struct nfs4_ol_stateid *open_stp,
+ static bool unhash_open_stateid(struct nfs4_ol_stateid *stp,
+ struct list_head *reaplist)
+ {
+- bool unhashed;
+-
+ lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
+
+- unhashed = unhash_ol_stateid(stp);
++ if (!unhash_ol_stateid(stp))
++ return false;
+ release_open_stateid_locks(stp, reaplist);
+- return unhashed;
++ return true;
+ }
+
+ static void release_open_stateid(struct nfs4_ol_stateid *stp)
+@@ -5774,21 +5783,21 @@ alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp,
+ }
+
+ static struct nfs4_ol_stateid *
+-find_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp)
++find_lock_stateid(const struct nfs4_lockowner *lo,
++ const struct nfs4_ol_stateid *ost)
+ {
+ struct nfs4_ol_stateid *lst;
+- struct nfs4_client *clp = lo->lo_owner.so_client;
+
+- lockdep_assert_held(&clp->cl_lock);
++ lockdep_assert_held(&ost->st_stid.sc_client->cl_lock);
+
+- list_for_each_entry(lst, &lo->lo_owner.so_stateids, st_perstateowner) {
+- if (lst->st_stid.sc_type != NFS4_LOCK_STID)
+- continue;
+- if (lst->st_stid.sc_file == fp) {
+- refcount_inc(&lst->st_stid.sc_count);
+- return lst;
++ /* If ost is not hashed, ost->st_locks will not be valid */
++ if (!nfs4_ol_stateid_unhashed(ost))
++ list_for_each_entry(lst, &ost->st_locks, st_locks) {
++ if (lst->st_stateowner == &lo->lo_owner) {
++ refcount_inc(&lst->st_stid.sc_count);
++ return lst;
++ }
+ }
+- }
+ return NULL;
+ }
+
+@@ -5804,11 +5813,11 @@ init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
+ mutex_lock_nested(&stp->st_mutex, OPEN_STATEID_MUTEX);
+ retry:
+ spin_lock(&clp->cl_lock);
+- spin_lock(&fp->fi_lock);
+- retstp = find_lock_stateid(lo, fp);
++ if (nfs4_ol_stateid_unhashed(open_stp))
++ goto out_close;
++ retstp = find_lock_stateid(lo, open_stp);
+ if (retstp)
+- goto out_unlock;
+-
++ goto out_found;
+ refcount_inc(&stp->st_stid.sc_count);
+ stp->st_stid.sc_type = NFS4_LOCK_STID;
+ stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner);
+@@ -5817,22 +5826,26 @@ retry:
+ stp->st_access_bmap = 0;
+ stp->st_deny_bmap = open_stp->st_deny_bmap;
+ stp->st_openstp = open_stp;
++ spin_lock(&fp->fi_lock);
+ list_add(&stp->st_locks, &open_stp->st_locks);
+ list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
+ list_add(&stp->st_perfile, &fp->fi_stateids);
+-out_unlock:
+ spin_unlock(&fp->fi_lock);
+ spin_unlock(&clp->cl_lock);
+- if (retstp) {
+- if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) {
+- nfs4_put_stid(&retstp->st_stid);
+- goto retry;
+- }
+- /* To keep mutex tracking happy */
+- mutex_unlock(&stp->st_mutex);
+- stp = retstp;
+- }
+ return stp;
++out_found:
++ spin_unlock(&clp->cl_lock);
++ if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) {
++ nfs4_put_stid(&retstp->st_stid);
++ goto retry;
++ }
++ /* To keep mutex tracking happy */
++ mutex_unlock(&stp->st_mutex);
++ return retstp;
++out_close:
++ spin_unlock(&clp->cl_lock);
++ mutex_unlock(&stp->st_mutex);
++ return NULL;
+ }
+
+ static struct nfs4_ol_stateid *
+@@ -5847,7 +5860,7 @@ find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi,
+
+ *new = false;
+ spin_lock(&clp->cl_lock);
+- lst = find_lock_stateid(lo, fi);
++ lst = find_lock_stateid(lo, ost);
+ spin_unlock(&clp->cl_lock);
+ if (lst != NULL) {
+ if (nfsd4_lock_ol_stateid(lst) == nfs_ok)
+diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
+index 099bec94b8207..fab29f899f913 100644
+--- a/fs/ubifs/io.c
++++ b/fs/ubifs/io.c
+@@ -237,7 +237,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum)
+ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
+ int offs, int quiet, int must_chk_crc)
+ {
+- int err = -EINVAL, type, node_len;
++ int err = -EINVAL, type, node_len, dump_node = 1;
+ uint32_t crc, node_crc, magic;
+ const struct ubifs_ch *ch = buf;
+
+@@ -290,10 +290,22 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
+ out_len:
+ if (!quiet)
+ ubifs_err(c, "bad node length %d", node_len);
++ if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ)
++ dump_node = 0;
+ out:
+ if (!quiet) {
+ ubifs_err(c, "bad node at LEB %d:%d", lnum, offs);
+- ubifs_dump_node(c, buf);
++ if (dump_node) {
++ ubifs_dump_node(c, buf);
++ } else {
++ int safe_len = min3(node_len, c->leb_size - offs,
++ (int)UBIFS_MAX_DATA_NODE_SZ);
++ pr_err("\tprevent out-of-bounds memory access\n");
++ pr_err("\ttruncated data node length %d\n", safe_len);
++ pr_err("\tcorrupted data node:\n");
++ print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1,
++ buf, safe_len, 0);
++ }
+ dump_stack();
+ }
+ return err;
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index bd37f4a292c3b..efb586ea508bf 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -1438,7 +1438,9 @@ xfs_attr3_leaf_add_work(
+ for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) {
+ if (ichdr->freemap[i].base == tmp) {
+ ichdr->freemap[i].base += sizeof(xfs_attr_leaf_entry_t);
+- ichdr->freemap[i].size -= sizeof(xfs_attr_leaf_entry_t);
++ ichdr->freemap[i].size -=
++ min_t(uint16_t, ichdr->freemap[i].size,
++ sizeof(xfs_attr_leaf_entry_t));
+ }
+ }
+ ichdr->usedbytes += xfs_attr_leaf_entsize(leaf, args->index);
+diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
+index f1bb3434f51c7..01e99806b941f 100644
+--- a/fs/xfs/libxfs/xfs_dir2_node.c
++++ b/fs/xfs/libxfs/xfs_dir2_node.c
+@@ -214,6 +214,7 @@ __xfs_dir3_free_read(
+ if (fa) {
+ xfs_verifier_error(*bpp, -EFSCORRUPTED, fa);
+ xfs_trans_brelse(tp, *bpp);
++ *bpp = NULL;
+ return -EFSCORRUPTED;
+ }
+
+diff --git a/fs/xfs/libxfs/xfs_trans_resv.c b/fs/xfs/libxfs/xfs_trans_resv.c
+index f99a7aefe4184..2b3cc5a8ced1b 100644
+--- a/fs/xfs/libxfs/xfs_trans_resv.c
++++ b/fs/xfs/libxfs/xfs_trans_resv.c
+@@ -197,6 +197,24 @@ xfs_calc_inode_chunk_res(
+ return res;
+ }
+
++/*
++ * Per-extent log reservation for the btree changes involved in freeing or
++ * allocating a realtime extent. We have to be able to log as many rtbitmap
++ * blocks as needed to mark inuse MAXEXTLEN blocks' worth of realtime extents,
++ * as well as the realtime summary block.
++ */
++unsigned int
++xfs_rtalloc_log_count(
++ struct xfs_mount *mp,
++ unsigned int num_ops)
++{
++ unsigned int blksz = XFS_FSB_TO_B(mp, 1);
++ unsigned int rtbmp_bytes;
++
++ rtbmp_bytes = (MAXEXTLEN / mp->m_sb.sb_rextsize) / NBBY;
++ return (howmany(rtbmp_bytes, blksz) + 1) * num_ops;
++}
++
+ /*
+ * Various log reservation values.
+ *
+@@ -219,13 +237,21 @@ xfs_calc_inode_chunk_res(
+
+ /*
+ * In a write transaction we can allocate a maximum of 2
+- * extents. This gives:
++ * extents. This gives (t1):
+ * the inode getting the new extents: inode size
+ * the inode's bmap btree: max depth * block size
+ * the agfs of the ags from which the extents are allocated: 2 * sector
+ * the superblock free block counter: sector size
+ * the allocation btrees: 2 exts * 2 trees * (2 * max depth - 1) * block size
+- * And the bmap_finish transaction can free bmap blocks in a join:
++ * Or, if we're writing to a realtime file (t2):
++ * the inode getting the new extents: inode size
++ * the inode's bmap btree: max depth * block size
++ * the agfs of the ags from which the extents are allocated: 2 * sector
++ * the superblock free block counter: sector size
++ * the realtime bitmap: ((MAXEXTLEN / rtextsize) / NBBY) bytes
++ * the realtime summary: 1 block
++ * the allocation btrees: 2 trees * (2 * max depth - 1) * block size
++ * And the bmap_finish transaction can free bmap blocks in a join (t3):
+ * the agfs of the ags containing the blocks: 2 * sector size
+ * the agfls of the ags containing the blocks: 2 * sector size
+ * the super block free block counter: sector size
+@@ -235,40 +261,72 @@ STATIC uint
+ xfs_calc_write_reservation(
+ struct xfs_mount *mp)
+ {
+- return XFS_DQUOT_LOGRES(mp) +
+- max((xfs_calc_inode_res(mp, 1) +
++ unsigned int t1, t2, t3;
++ unsigned int blksz = XFS_FSB_TO_B(mp, 1);
++
++ t1 = xfs_calc_inode_res(mp, 1) +
++ xfs_calc_buf_res(XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK), blksz) +
++ xfs_calc_buf_res(3, mp->m_sb.sb_sectsize) +
++ xfs_calc_buf_res(xfs_allocfree_log_count(mp, 2), blksz);
++
++ if (xfs_sb_version_hasrealtime(&mp->m_sb)) {
++ t2 = xfs_calc_inode_res(mp, 1) +
+ xfs_calc_buf_res(XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK),
+- XFS_FSB_TO_B(mp, 1)) +
++ blksz) +
+ xfs_calc_buf_res(3, mp->m_sb.sb_sectsize) +
+- xfs_calc_buf_res(xfs_allocfree_log_count(mp, 2),
+- XFS_FSB_TO_B(mp, 1))),
+- (xfs_calc_buf_res(5, mp->m_sb.sb_sectsize) +
+- xfs_calc_buf_res(xfs_allocfree_log_count(mp, 2),
+- XFS_FSB_TO_B(mp, 1))));
++ xfs_calc_buf_res(xfs_rtalloc_log_count(mp, 1), blksz) +
++ xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1), blksz);
++ } else {
++ t2 = 0;
++ }
++
++ t3 = xfs_calc_buf_res(5, mp->m_sb.sb_sectsize) +
++ xfs_calc_buf_res(xfs_allocfree_log_count(mp, 2), blksz);
++
++ return XFS_DQUOT_LOGRES(mp) + max3(t1, t2, t3);
+ }
+
+ /*
+- * In truncating a file we free up to two extents at once. We can modify:
++ * In truncating a file we free up to two extents at once. We can modify (t1):
+ * the inode being truncated: inode size
+ * the inode's bmap btree: (max depth + 1) * block size
+- * And the bmap_finish transaction can free the blocks and bmap blocks:
++ * And the bmap_finish transaction can free the blocks and bmap blocks (t2):
+ * the agf for each of the ags: 4 * sector size
+ * the agfl for each of the ags: 4 * sector size
+ * the super block to reflect the freed blocks: sector size
+ * worst case split in allocation btrees per extent assuming 4 extents:
+ * 4 exts * 2 trees * (2 * max depth - 1) * block size
++ * Or, if it's a realtime file (t3):
++ * the agf for each of the ags: 2 * sector size
++ * the agfl for each of the ags: 2 * sector size
++ * the super block to reflect the freed blocks: sector size
++ * the realtime bitmap: 2 exts * ((MAXEXTLEN / rtextsize) / NBBY) bytes
++ * the realtime summary: 2 exts * 1 block
++ * worst case split in allocation btrees per extent assuming 2 extents:
++ * 2 exts * 2 trees * (2 * max depth - 1) * block size
+ */
+ STATIC uint
+ xfs_calc_itruncate_reservation(
+ struct xfs_mount *mp)
+ {
+- return XFS_DQUOT_LOGRES(mp) +
+- max((xfs_calc_inode_res(mp, 1) +
+- xfs_calc_buf_res(XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK) + 1,
+- XFS_FSB_TO_B(mp, 1))),
+- (xfs_calc_buf_res(9, mp->m_sb.sb_sectsize) +
+- xfs_calc_buf_res(xfs_allocfree_log_count(mp, 4),
+- XFS_FSB_TO_B(mp, 1))));
++ unsigned int t1, t2, t3;
++ unsigned int blksz = XFS_FSB_TO_B(mp, 1);
++
++ t1 = xfs_calc_inode_res(mp, 1) +
++ xfs_calc_buf_res(XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK) + 1, blksz);
++
++ t2 = xfs_calc_buf_res(9, mp->m_sb.sb_sectsize) +
++ xfs_calc_buf_res(xfs_allocfree_log_count(mp, 4), blksz);
++
++ if (xfs_sb_version_hasrealtime(&mp->m_sb)) {
++ t3 = xfs_calc_buf_res(5, mp->m_sb.sb_sectsize) +
++ xfs_calc_buf_res(xfs_rtalloc_log_count(mp, 2), blksz) +
++ xfs_calc_buf_res(xfs_allocfree_log_count(mp, 2), blksz);
++ } else {
++ t3 = 0;
++ }
++
++ return XFS_DQUOT_LOGRES(mp) + max3(t1, t2, t3);
+ }
+
+ /*
+diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
+index cd3e4d768a18c..33dfcba72c7a0 100644
+--- a/fs/xfs/scrub/dir.c
++++ b/fs/xfs/scrub/dir.c
+@@ -156,6 +156,9 @@ xchk_dir_actor(
+ xname.type = XFS_DIR3_FT_UNKNOWN;
+
+ error = xfs_dir_lookup(sdc->sc->tp, ip, &xname, &lookup_ino, NULL);
++ /* ENOENT means the hash lookup failed and the dir is corrupt */
++ if (error == -ENOENT)
++ error = -EFSCORRUPTED;
+ if (!xchk_fblock_process_error(sdc->sc, XFS_DATA_FORK, offset,
+ &error))
+ goto out;
+diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h
+index 3b0ba54cc4d5b..3bc1034c57e66 100644
+--- a/include/linux/debugfs.h
++++ b/include/linux/debugfs.h
+@@ -54,6 +54,8 @@ static const struct file_operations __fops = { \
+ .llseek = no_llseek, \
+ }
+
++typedef struct vfsmount *(*debugfs_automount_t)(struct dentry *, void *);
++
+ #if defined(CONFIG_DEBUG_FS)
+
+ struct dentry *debugfs_lookup(const char *name, struct dentry *parent);
+@@ -75,7 +77,6 @@ struct dentry *debugfs_create_dir(const char *name, struct dentry *parent);
+ struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent,
+ const char *dest);
+
+-typedef struct vfsmount *(*debugfs_automount_t)(struct dentry *, void *);
+ struct dentry *debugfs_create_automount(const char *name,
+ struct dentry *parent,
+ debugfs_automount_t f,
+@@ -204,7 +205,7 @@ static inline struct dentry *debugfs_create_symlink(const char *name,
+
+ static inline struct dentry *debugfs_create_automount(const char *name,
+ struct dentry *parent,
+- struct vfsmount *(*f)(void *),
++ debugfs_automount_t f,
+ void *data)
+ {
+ return ERR_PTR(-ENODEV);
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index afc1d72161ba5..3d076aca7ac2a 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -503,6 +503,7 @@ enum hsm_task_states {
+ };
+
+ enum ata_completion_errors {
++ AC_ERR_OK = 0, /* no error */
+ AC_ERR_DEV = (1 << 0), /* device reported error */
+ AC_ERR_HSM = (1 << 1), /* host state machine violation */
+ AC_ERR_TIMEOUT = (1 << 2), /* timeout */
+@@ -912,9 +913,9 @@ struct ata_port_operations {
+ /*
+ * Command execution
+ */
+- int (*qc_defer)(struct ata_queued_cmd *qc);
+- int (*check_atapi_dma)(struct ata_queued_cmd *qc);
+- void (*qc_prep)(struct ata_queued_cmd *qc);
++ int (*qc_defer)(struct ata_queued_cmd *qc);
++ int (*check_atapi_dma)(struct ata_queued_cmd *qc);
++ enum ata_completion_errors (*qc_prep)(struct ata_queued_cmd *qc);
+ unsigned int (*qc_issue)(struct ata_queued_cmd *qc);
+ bool (*qc_fill_rtf)(struct ata_queued_cmd *qc);
+
+@@ -1181,7 +1182,7 @@ extern int ata_xfer_mode2shift(unsigned long xfer_mode);
+ extern const char *ata_mode_string(unsigned long xfer_mask);
+ extern unsigned long ata_id_xfermask(const u16 *id);
+ extern int ata_std_qc_defer(struct ata_queued_cmd *qc);
+-extern void ata_noop_qc_prep(struct ata_queued_cmd *qc);
++extern enum ata_completion_errors ata_noop_qc_prep(struct ata_queued_cmd *qc);
+ extern void ata_sg_init(struct ata_queued_cmd *qc, struct scatterlist *sg,
+ unsigned int n_elem);
+ extern unsigned int ata_dev_classify(const struct ata_taskfile *tf);
+@@ -1916,9 +1917,9 @@ extern const struct ata_port_operations ata_bmdma_port_ops;
+ .sg_tablesize = LIBATA_MAX_PRD, \
+ .dma_boundary = ATA_DMA_BOUNDARY
+
+-extern void ata_bmdma_qc_prep(struct ata_queued_cmd *qc);
++extern enum ata_completion_errors ata_bmdma_qc_prep(struct ata_queued_cmd *qc);
+ extern unsigned int ata_bmdma_qc_issue(struct ata_queued_cmd *qc);
+-extern void ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc);
++extern enum ata_completion_errors ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc);
+ extern unsigned int ata_bmdma_port_intr(struct ata_port *ap,
+ struct ata_queued_cmd *qc);
+ extern irqreturn_t ata_bmdma_interrupt(int irq, void *dev_instance);
+diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
+index 8ef330027b134..3f8e84a80b4ad 100644
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -227,7 +227,7 @@ struct mmc_queue_req;
+ * MMC Physical partitions
+ */
+ struct mmc_part {
+- unsigned int size; /* partition size (in bytes) */
++ u64 size; /* partition size (in bytes) */
+ unsigned int part_cfg; /* partition type */
+ char name[MAX_MMC_PART_NAME_LEN];
+ bool force_ro; /* to make boot parts RO by default */
+diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h
+index ad69430fd0eb5..5162fc1533c2f 100644
+--- a/include/linux/nfs_page.h
++++ b/include/linux/nfs_page.h
+@@ -142,6 +142,8 @@ extern void nfs_unlock_and_release_request(struct nfs_page *);
+ extern int nfs_page_group_lock(struct nfs_page *);
+ extern void nfs_page_group_unlock(struct nfs_page *);
+ extern bool nfs_page_group_sync_on_bit(struct nfs_page *, unsigned int);
++extern int nfs_page_set_headlock(struct nfs_page *req);
++extern void nfs_page_clear_headlock(struct nfs_page *req);
+ extern bool nfs_async_iocounter_wait(struct rpc_task *, struct nfs_lock_context *);
+
+ /*
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 2517492dd1855..2fda9893962d1 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1144,7 +1144,6 @@ int pci_enable_rom(struct pci_dev *pdev);
+ void pci_disable_rom(struct pci_dev *pdev);
+ void __iomem __must_check *pci_map_rom(struct pci_dev *pdev, size_t *size);
+ void pci_unmap_rom(struct pci_dev *pdev, void __iomem *rom);
+-void __iomem __must_check *pci_platform_rom(struct pci_dev *pdev, size_t *size);
+
+ /* Power management related routines */
+ int pci_save_state(struct pci_dev *dev);
+diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
+index bcf4cf26b8c89..a42a29952889c 100644
+--- a/include/linux/seqlock.h
++++ b/include/linux/seqlock.h
+@@ -243,6 +243,13 @@ static inline void raw_write_seqcount_end(seqcount_t *s)
+ * usual consistency guarantee. It is one wmb cheaper, because we can
+ * collapse the two back-to-back wmb()s.
+ *
++ * Note that, writes surrounding the barrier should be declared atomic (e.g.
++ * via WRITE_ONCE): a) to ensure the writes become visible to other threads
++ * atomically, avoiding compiler optimizations; b) to document which writes are
++ * meant to propagate to the reader critical section. This is necessary because
++ * neither writes before and after the barrier are enclosed in a seq-writer
++ * critical section that would ensure readers are aware of ongoing writes.
++ *
+ * seqcount_t seq;
+ * bool X = true, Y = false;
+ *
+@@ -262,11 +269,11 @@ static inline void raw_write_seqcount_end(seqcount_t *s)
+ *
+ * void write(void)
+ * {
+- * Y = true;
++ * WRITE_ONCE(Y, true);
+ *
+ * raw_write_seqcount_barrier(seq);
+ *
+- * X = false;
++ * WRITE_ONCE(X, false);
+ * }
+ */
+ static inline void raw_write_seqcount_barrier(seqcount_t *s)
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index cbc0294f39899..703ce71caeacb 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1688,6 +1688,18 @@ static inline __u32 skb_queue_len(const struct sk_buff_head *list_)
+ return list_->qlen;
+ }
+
++/**
++ * skb_queue_len_lockless - get queue length
++ * @list_: list to measure
++ *
++ * Return the length of an &sk_buff queue.
++ * This variant can be used in lockless contexts.
++ */
++static inline __u32 skb_queue_len_lockless(const struct sk_buff_head *list_)
++{
++ return READ_ONCE(list_->qlen);
++}
++
+ /**
+ * __skb_queue_head_init - initialize non-spinlock portions of sk_buff_head
+ * @list: queue to initialize
+@@ -1895,7 +1907,7 @@ static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
+ {
+ struct sk_buff *next, *prev;
+
+- list->qlen--;
++ WRITE_ONCE(list->qlen, list->qlen - 1);
+ next = skb->next;
+ prev = skb->prev;
+ skb->next = skb->prev = NULL;
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 77f36257cac97..bc752237dff3f 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -900,11 +900,11 @@ static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
+ skb_dst_force(skb);
+
+ if (!sk->sk_backlog.tail)
+- sk->sk_backlog.head = skb;
++ WRITE_ONCE(sk->sk_backlog.head, skb);
+ else
+ sk->sk_backlog.tail->next = skb;
+
+- sk->sk_backlog.tail = skb;
++ WRITE_ONCE(sk->sk_backlog.tail, skb);
+ skb->next = NULL;
+ }
+
+diff --git a/include/trace/events/sctp.h b/include/trace/events/sctp.h
+index 7475c7be165aa..d4aac34365955 100644
+--- a/include/trace/events/sctp.h
++++ b/include/trace/events/sctp.h
+@@ -75,15 +75,6 @@ TRACE_EVENT(sctp_probe,
+ __entry->pathmtu = asoc->pathmtu;
+ __entry->rwnd = asoc->peer.rwnd;
+ __entry->unack_data = asoc->unack_data;
+-
+- if (trace_sctp_probe_path_enabled()) {
+- struct sctp_transport *sp;
+-
+- list_for_each_entry(sp, &asoc->peer.transport_addr_list,
+- transports) {
+- trace_sctp_probe_path(sp, asoc);
+- }
+- }
+ ),
+
+ TP_printk("asoc=%#llx mark=%#x bind_port=%d peer_port=%d pathmtu=%d "
+diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
+index 4f7262eba73d8..50952d6d81209 100644
+--- a/kernel/audit_watch.c
++++ b/kernel/audit_watch.c
+@@ -317,8 +317,6 @@ static void audit_update_watch(struct audit_parent *parent,
+ if (oentry->rule.exe)
+ audit_remove_mark(oentry->rule.exe);
+
+- audit_watch_log_rule_change(r, owatch, "updated_rules");
+-
+ call_rcu(&oentry->rcu, audit_free_rule_rcu);
+ }
+
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index 1b28fb006763a..3f3ed33bd2fdc 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -667,15 +667,7 @@ static void htab_elem_free_rcu(struct rcu_head *head)
+ struct htab_elem *l = container_of(head, struct htab_elem, rcu);
+ struct bpf_htab *htab = l->htab;
+
+- /* must increment bpf_prog_active to avoid kprobe+bpf triggering while
+- * we're calling kfree, otherwise deadlock is possible if kprobes
+- * are placed somewhere inside of slub
+- */
+- preempt_disable();
+- __this_cpu_inc(bpf_prog_active);
+ htab_elem_free(htab, l);
+- __this_cpu_dec(bpf_prog_active);
+- preempt_enable();
+ }
+
+ static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index c04815bb15cc1..11fade89c1f38 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -207,10 +207,12 @@ static void *map_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ else
+ prev_key = key;
+
++ rcu_read_lock();
+ if (map->ops->map_get_next_key(map, prev_key, key)) {
+ map_iter(m)->done = true;
+- return NULL;
++ key = NULL;
+ }
++ rcu_read_unlock();
+ return key;
+ }
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 230d9d599b5aa..2161f519d4812 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1065,9 +1065,20 @@ static int disarm_kprobe_ftrace(struct kprobe *p)
+ return ret;
+ }
+ #else /* !CONFIG_KPROBES_ON_FTRACE */
+-#define prepare_kprobe(p) arch_prepare_kprobe(p)
+-#define arm_kprobe_ftrace(p) (-ENODEV)
+-#define disarm_kprobe_ftrace(p) (-ENODEV)
++static inline int prepare_kprobe(struct kprobe *p)
++{
++ return arch_prepare_kprobe(p);
++}
++
++static inline int arm_kprobe_ftrace(struct kprobe *p)
++{
++ return -ENODEV;
++}
++
++static inline int disarm_kprobe_ftrace(struct kprobe *p)
++{
++ return -ENODEV;
++}
+ #endif
+
+ /* Arm a kprobe with text_mutex */
+@@ -2083,9 +2094,10 @@ static void kill_kprobe(struct kprobe *p)
+
+ /*
+ * The module is going away. We should disarm the kprobe which
+- * is using ftrace.
++ * is using ftrace, because ftrace framework is still available at
++ * MODULE_STATE_GOING notification.
+ */
+- if (kprobe_ftrace(p))
++ if (kprobe_ftrace(p) && !kprobe_disabled(p) && !kprobes_all_disarmed)
+ disarm_kprobe_ftrace(p);
+ }
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 3cb0e5b479ff3..cf272aba362be 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2148,6 +2148,9 @@ static int __init console_setup(char *str)
+ char *s, *options, *brl_options = NULL;
+ int idx;
+
++ if (str[0] == 0)
++ return 1;
++
+ if (_braille_console_setup(&str, &brl_options))
+ return 1;
+
+diff --git a/kernel/sys.c b/kernel/sys.c
+index 096932a450466..baf60a3aa34b7 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1275,11 +1275,13 @@ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)
+
+ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
+ {
+- struct oldold_utsname tmp = {};
++ struct oldold_utsname tmp;
+
+ if (!name)
+ return -EFAULT;
+
++ memset(&tmp, 0, sizeof(tmp));
++
+ down_read(&uts_sem);
+ memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN);
+ memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN);
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 81ee5b83c9200..c66fd11d94bc4 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1004,9 +1004,8 @@ static int scale64_check_overflow(u64 mult, u64 div, u64 *base)
+ ((int)sizeof(u64)*8 - fls64(mult) < fls64(rem)))
+ return -EOVERFLOW;
+ tmp *= mult;
+- rem *= mult;
+
+- do_div(rem, div);
++ rem = div64_u64(rem * mult, div);
+ *base = tmp + rem;
+ return 0;
+ }
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 4966410bb0f4d..6bf617ff03694 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -3037,6 +3037,9 @@ int trace_array_printk(struct trace_array *tr,
+ if (!(global_trace.trace_flags & TRACE_ITER_PRINTK))
+ return 0;
+
++ if (!tr)
++ return -ENOENT;
++
+ va_start(ap, fmt);
+ ret = trace_array_vprintk(tr, ip, fmt, ap);
+ va_end(ap);
+@@ -8526,7 +8529,7 @@ __init static int tracer_alloc_buffers(void)
+ goto out_free_buffer_mask;
+
+ /* Only allocate trace_printk buffers if a trace_printk exists */
+- if (__stop___trace_bprintk_fmt != __start___trace_bprintk_fmt)
++ if (&__stop___trace_bprintk_fmt != &__start___trace_bprintk_fmt)
+ /* Must be called before global_trace.buffer is allocated */
+ trace_printk_init_buffers();
+
+diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
+index 06bb2fd9a56c5..a97aad105d367 100644
+--- a/kernel/trace/trace_entries.h
++++ b/kernel/trace/trace_entries.h
+@@ -179,7 +179,7 @@ FTRACE_ENTRY(kernel_stack, stack_entry,
+
+ F_STRUCT(
+ __field( int, size )
+- __dynamic_array(unsigned long, caller )
++ __array( unsigned long, caller, FTRACE_STACK_ENTRIES )
+ ),
+
+ F_printk("\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n"
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 27726121d332c..0fc06a7da87fb 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -800,6 +800,8 @@ static int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set)
+ char *event = NULL, *sub = NULL, *match;
+ int ret;
+
++ if (!tr)
++ return -ENOENT;
+ /*
+ * The buf format can be <subsystem>:<event-name>
+ * *:<event-name> means any event by that name.
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index dbd3c97d1501a..3ed2d7f7e5712 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -4225,7 +4225,6 @@ static int parse_var_defs(struct hist_trigger_data *hist_data)
+
+ s = kstrdup(field_str, GFP_KERNEL);
+ if (!s) {
+- kfree(hist_data->attrs->var_defs.name[n_vars]);
+ ret = -ENOMEM;
+ goto free;
+ }
+diff --git a/kernel/trace/trace_preemptirq.c b/kernel/trace/trace_preemptirq.c
+index 71f553cceb3c1..0e373cb0106bb 100644
+--- a/kernel/trace/trace_preemptirq.c
++++ b/kernel/trace/trace_preemptirq.c
+@@ -59,14 +59,14 @@ EXPORT_SYMBOL(trace_hardirqs_on_caller);
+
+ __visible void trace_hardirqs_off_caller(unsigned long caller_addr)
+ {
++ lockdep_hardirqs_off(CALLER_ADDR0);
++
+ if (!this_cpu_read(tracing_irq_cpu)) {
+ this_cpu_write(tracing_irq_cpu, 1);
+ tracer_hardirqs_off(CALLER_ADDR0, caller_addr);
+ if (!in_nmi())
+ trace_irq_disable_rcuidle(CALLER_ADDR0, caller_addr);
+ }
+-
+- lockdep_hardirqs_off(CALLER_ADDR0);
+ }
+ EXPORT_SYMBOL(trace_hardirqs_off_caller);
+ #endif /* CONFIG_TRACE_IRQFLAGS */
+diff --git a/lib/string.c b/lib/string.c
+index 72125fd5b4a64..edf4907ec946f 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -236,6 +236,30 @@ ssize_t strscpy(char *dest, const char *src, size_t count)
+ EXPORT_SYMBOL(strscpy);
+ #endif
+
++/**
++ * stpcpy - copy a string from src to dest returning a pointer to the new end
++ * of dest, including src's %NUL-terminator. May overrun dest.
++ * @dest: pointer to end of string being copied into. Must be large enough
++ * to receive copy.
++ * @src: pointer to the beginning of string being copied from. Must not overlap
++ * dest.
++ *
++ * stpcpy differs from strcpy in a key way: the return value is a pointer
++ * to the new %NUL-terminating character in @dest. (For strcpy, the return
++ * value is a pointer to the start of @dest). This interface is considered
++ * unsafe as it doesn't perform bounds checking of the inputs. As such it's
++ * not recommended for usage. Instead, its definition is provided in case
++ * the compiler lowers other libcalls to stpcpy.
++ */
++char *stpcpy(char *__restrict__ dest, const char *__restrict__ src);
++char *stpcpy(char *__restrict__ dest, const char *__restrict__ src)
++{
++ while ((*dest++ = *src++) != '\0')
++ /* nothing */;
++ return --dest;
++}
++EXPORT_SYMBOL(stpcpy);
++
+ #ifndef __HAVE_ARCH_STRCAT
+ /**
+ * strcat - Append one %NUL-terminated string to another
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 45f1c6d73b5b0..f2e777003b901 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -2889,6 +2889,14 @@ filler:
+ unlock_page(page);
+ goto out;
+ }
++
++ /*
++ * A previous I/O error may have been due to temporary
++ * failures.
++ * Clear page error before actual read, PG_error will be
++ * set again if read page fails.
++ */
++ ClearPageError(page);
+ goto filler;
+
+ out:
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index 5eeabece0c178..f54734abf9466 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -2039,7 +2039,7 @@ void __init kmemleak_init(void)
+ create_object((unsigned long)__bss_start, __bss_stop - __bss_start,
+ KMEMLEAK_GREY, GFP_ATOMIC);
+ /* only register .data..ro_after_init if not within .data */
+- if (__start_ro_after_init < _sdata || __end_ro_after_init > _edata)
++ if (&__start_ro_after_init < &_sdata || &__end_ro_after_init > &_edata)
+ create_object((unsigned long)__start_ro_after_init,
+ __end_ro_after_init - __start_ro_after_init,
+ KMEMLEAK_GREY, GFP_ATOMIC);
+diff --git a/mm/memory.c b/mm/memory.c
+index bbf0cc4066c84..eeae63bd95027 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -116,6 +116,18 @@ int randomize_va_space __read_mostly =
+ 2;
+ #endif
+
++#ifndef arch_faults_on_old_pte
++static inline bool arch_faults_on_old_pte(void)
++{
++ /*
++ * Those arches which don't have hw access flag feature need to
++ * implement their own helper. By default, "true" means pagefault
++ * will be hit on old pte.
++ */
++ return true;
++}
++#endif
++
+ static int __init disable_randmaps(char *s)
+ {
+ randomize_va_space = 0;
+@@ -2335,32 +2347,101 @@ static inline int pte_unmap_same(struct mm_struct *mm, pmd_t *pmd,
+ return same;
+ }
+
+-static inline void cow_user_page(struct page *dst, struct page *src, unsigned long va, struct vm_area_struct *vma)
++static inline bool cow_user_page(struct page *dst, struct page *src,
++ struct vm_fault *vmf)
+ {
++ bool ret;
++ void *kaddr;
++ void __user *uaddr;
++ bool locked = false;
++ struct vm_area_struct *vma = vmf->vma;
++ struct mm_struct *mm = vma->vm_mm;
++ unsigned long addr = vmf->address;
++
+ debug_dma_assert_idle(src);
+
++ if (likely(src)) {
++ copy_user_highpage(dst, src, addr, vma);
++ return true;
++ }
++
+ /*
+ * If the source page was a PFN mapping, we don't have
+ * a "struct page" for it. We do a best-effort copy by
+ * just copying from the original user address. If that
+ * fails, we just zero-fill it. Live with it.
+ */
+- if (unlikely(!src)) {
+- void *kaddr = kmap_atomic(dst);
+- void __user *uaddr = (void __user *)(va & PAGE_MASK);
++ kaddr = kmap_atomic(dst);
++ uaddr = (void __user *)(addr & PAGE_MASK);
++
++ /*
++ * On architectures with software "accessed" bits, we would
++ * take a double page fault, so mark it accessed here.
++ */
++ if (arch_faults_on_old_pte() && !pte_young(vmf->orig_pte)) {
++ pte_t entry;
++
++ vmf->pte = pte_offset_map_lock(mm, vmf->pmd, addr, &vmf->ptl);
++ locked = true;
++ if (!likely(pte_same(*vmf->pte, vmf->orig_pte))) {
++ /*
++ * Other thread has already handled the fault
++ * and we don't need to do anything. If it's
++ * not the case, the fault will be triggered
++ * again on the same address.
++ */
++ ret = false;
++ goto pte_unlock;
++ }
++
++ entry = pte_mkyoung(vmf->orig_pte);
++ if (ptep_set_access_flags(vma, addr, vmf->pte, entry, 0))
++ update_mmu_cache(vma, addr, vmf->pte);
++ }
++
++ /*
++ * This really shouldn't fail, because the page is there
++ * in the page tables. But it might just be unreadable,
++ * in which case we just give up and fill the result with
++ * zeroes.
++ */
++ if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) {
++ if (locked)
++ goto warn;
++
++ /* Re-validate under PTL if the page is still mapped */
++ vmf->pte = pte_offset_map_lock(mm, vmf->pmd, addr, &vmf->ptl);
++ locked = true;
++ if (!likely(pte_same(*vmf->pte, vmf->orig_pte))) {
++ /* The PTE changed under us. Retry page fault. */
++ ret = false;
++ goto pte_unlock;
++ }
+
+ /*
+- * This really shouldn't fail, because the page is there
+- * in the page tables. But it might just be unreadable,
+- * in which case we just give up and fill the result with
+- * zeroes.
++ * The same page can be mapped back since last copy attampt.
++ * Try to copy again under PTL.
+ */
+- if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE))
++ if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) {
++ /*
++ * Give a warn in case there can be some obscure
++ * use-case
++ */
++warn:
++ WARN_ON_ONCE(1);
+ clear_page(kaddr);
+- kunmap_atomic(kaddr);
+- flush_dcache_page(dst);
+- } else
+- copy_user_highpage(dst, src, va, vma);
++ }
++ }
++
++ ret = true;
++
++pte_unlock:
++ if (locked)
++ pte_unmap_unlock(vmf->pte, vmf->ptl);
++ kunmap_atomic(kaddr);
++ flush_dcache_page(dst);
++
++ return ret;
+ }
+
+ static gfp_t __get_fault_gfp_mask(struct vm_area_struct *vma)
+@@ -2514,7 +2595,19 @@ static vm_fault_t wp_page_copy(struct vm_fault *vmf)
+ vmf->address);
+ if (!new_page)
+ goto oom;
+- cow_user_page(new_page, old_page, vmf->address, vma);
++
++ if (!cow_user_page(new_page, old_page, vmf)) {
++ /*
++ * COW failed, if the fault was solved by other,
++ * it's fine. If not, userspace would re-fault on
++ * the same address and we will handle the fault
++ * from the second attempt.
++ */
++ put_page(new_page);
++ if (old_page)
++ put_page(old_page);
++ return 0;
++ }
+ }
+
+ if (mem_cgroup_try_charge_delay(new_page, mm, GFP_KERNEL, &memcg, false))
+diff --git a/mm/mmap.c b/mm/mmap.c
+index e84fd3347a518..f875386e7acd4 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2077,6 +2077,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ info.low_limit = mm->mmap_base;
+ info.high_limit = TASK_SIZE;
+ info.align_mask = 0;
++ info.align_offset = 0;
+ return vm_unmapped_area(&info);
+ }
+ #endif
+@@ -2118,6 +2119,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ info.low_limit = max(PAGE_SIZE, mmap_min_addr);
+ info.high_limit = mm->mmap_base;
+ info.align_mask = 0;
++ info.align_offset = 0;
+ addr = vm_unmapped_area(&info);
+
+ /*
+diff --git a/mm/pagewalk.c b/mm/pagewalk.c
+index c3084ff2569d2..3c0930d94a295 100644
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -15,9 +15,9 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, walk);
+ if (err)
+ break;
+- addr += PAGE_SIZE;
+- if (addr == end)
++ if (addr >= end - PAGE_SIZE)
+ break;
++ addr += PAGE_SIZE;
+ pte++;
+ }
+
+diff --git a/mm/swap_state.c b/mm/swap_state.c
+index 09731f4174c7e..3febffe0fca4a 100644
+--- a/mm/swap_state.c
++++ b/mm/swap_state.c
+@@ -537,10 +537,11 @@ static unsigned long swapin_nr_pages(unsigned long offset)
+ return 1;
+
+ hits = atomic_xchg(&swapin_readahead_hits, 0);
+- pages = __swapin_nr_pages(prev_offset, offset, hits, max_pages,
++ pages = __swapin_nr_pages(READ_ONCE(prev_offset), offset, hits,
++ max_pages,
+ atomic_read(&last_readahead_pages));
+ if (!hits)
+- prev_offset = offset;
++ WRITE_ONCE(prev_offset, offset);
+ atomic_set(&last_readahead_pages, pages);
+
+ return pages;
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 0047dcaf93697..adeb49fcad23e 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -998,7 +998,7 @@ start_over:
+ goto nextsi;
+ }
+ if (size == SWAPFILE_CLUSTER) {
+- if (!(si->flags & SWP_FILE))
++ if (si->flags & SWP_BLKDEV)
+ n_ret = swap_alloc_cluster(si, swp_entries);
+ } else
+ n_ret = scan_swap_map_slots(si, SWAP_HAS_CACHE,
+@@ -2738,10 +2738,10 @@ static void *swap_next(struct seq_file *swap, void *v, loff_t *pos)
+ else
+ type = si->type + 1;
+
++ ++(*pos);
+ for (; (si = swap_type_to_swap_info(type)); type++) {
+ if (!(si->flags & SWP_USED) || !si->swap_map)
+ continue;
+- ++*pos;
+ return si;
+ }
+
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index b93dc8fc6007f..b7d7f6d65bd5b 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3109,8 +3109,9 @@ static bool allow_direct_reclaim(pg_data_t *pgdat)
+
+ /* kswapd must be awake if processes are being throttled */
+ if (!wmark_ok && waitqueue_active(&pgdat->kswapd_wait)) {
+- pgdat->kswapd_classzone_idx = min(pgdat->kswapd_classzone_idx,
+- (enum zone_type)ZONE_NORMAL);
++ if (READ_ONCE(pgdat->kswapd_classzone_idx) > ZONE_NORMAL)
++ WRITE_ONCE(pgdat->kswapd_classzone_idx, ZONE_NORMAL);
++
+ wake_up_interruptible(&pgdat->kswapd_wait);
+ }
+
+@@ -3626,9 +3627,9 @@ out:
+ static enum zone_type kswapd_classzone_idx(pg_data_t *pgdat,
+ enum zone_type prev_classzone_idx)
+ {
+- if (pgdat->kswapd_classzone_idx == MAX_NR_ZONES)
+- return prev_classzone_idx;
+- return pgdat->kswapd_classzone_idx;
++ enum zone_type curr_idx = READ_ONCE(pgdat->kswapd_classzone_idx);
++
++ return curr_idx == MAX_NR_ZONES ? prev_classzone_idx : curr_idx;
+ }
+
+ static void kswapd_try_to_sleep(pg_data_t *pgdat, int alloc_order, int reclaim_order,
+@@ -3672,8 +3673,11 @@ static void kswapd_try_to_sleep(pg_data_t *pgdat, int alloc_order, int reclaim_o
+ * the previous request that slept prematurely.
+ */
+ if (remaining) {
+- pgdat->kswapd_classzone_idx = kswapd_classzone_idx(pgdat, classzone_idx);
+- pgdat->kswapd_order = max(pgdat->kswapd_order, reclaim_order);
++ WRITE_ONCE(pgdat->kswapd_classzone_idx,
++ kswapd_classzone_idx(pgdat, classzone_idx));
++
++ if (READ_ONCE(pgdat->kswapd_order) < reclaim_order)
++ WRITE_ONCE(pgdat->kswapd_order, reclaim_order);
+ }
+
+ finish_wait(&pgdat->kswapd_wait, &wait);
+@@ -3755,12 +3759,12 @@ static int kswapd(void *p)
+ tsk->flags |= PF_MEMALLOC | PF_SWAPWRITE | PF_KSWAPD;
+ set_freezable();
+
+- pgdat->kswapd_order = 0;
+- pgdat->kswapd_classzone_idx = MAX_NR_ZONES;
++ WRITE_ONCE(pgdat->kswapd_order, 0);
++ WRITE_ONCE(pgdat->kswapd_classzone_idx, MAX_NR_ZONES);
+ for ( ; ; ) {
+ bool ret;
+
+- alloc_order = reclaim_order = pgdat->kswapd_order;
++ alloc_order = reclaim_order = READ_ONCE(pgdat->kswapd_order);
+ classzone_idx = kswapd_classzone_idx(pgdat, classzone_idx);
+
+ kswapd_try_sleep:
+@@ -3768,10 +3772,10 @@ kswapd_try_sleep:
+ classzone_idx);
+
+ /* Read the new order and classzone_idx */
+- alloc_order = reclaim_order = pgdat->kswapd_order;
++ alloc_order = reclaim_order = READ_ONCE(pgdat->kswapd_order);
+ classzone_idx = kswapd_classzone_idx(pgdat, classzone_idx);
+- pgdat->kswapd_order = 0;
+- pgdat->kswapd_classzone_idx = MAX_NR_ZONES;
++ WRITE_ONCE(pgdat->kswapd_order, 0);
++ WRITE_ONCE(pgdat->kswapd_classzone_idx, MAX_NR_ZONES);
+
+ ret = try_to_freeze();
+ if (kthread_should_stop())
+@@ -3816,20 +3820,23 @@ void wakeup_kswapd(struct zone *zone, gfp_t gfp_flags, int order,
+ enum zone_type classzone_idx)
+ {
+ pg_data_t *pgdat;
++ enum zone_type curr_idx;
+
+ if (!managed_zone(zone))
+ return;
+
+ if (!cpuset_zone_allowed(zone, gfp_flags))
+ return;
++
+ pgdat = zone->zone_pgdat;
++ curr_idx = READ_ONCE(pgdat->kswapd_classzone_idx);
++
++ if (curr_idx == MAX_NR_ZONES || curr_idx < classzone_idx)
++ WRITE_ONCE(pgdat->kswapd_classzone_idx, classzone_idx);
++
++ if (READ_ONCE(pgdat->kswapd_order) < order)
++ WRITE_ONCE(pgdat->kswapd_order, order);
+
+- if (pgdat->kswapd_classzone_idx == MAX_NR_ZONES)
+- pgdat->kswapd_classzone_idx = classzone_idx;
+- else
+- pgdat->kswapd_classzone_idx = max(pgdat->kswapd_classzone_idx,
+- classzone_idx);
+- pgdat->kswapd_order = max(pgdat->kswapd_order, order);
+ if (!waitqueue_active(&pgdat->kswapd_wait))
+ return;
+
+diff --git a/net/atm/lec.c b/net/atm/lec.c
+index ad4f829193f05..5a6186b809874 100644
+--- a/net/atm/lec.c
++++ b/net/atm/lec.c
+@@ -1270,6 +1270,12 @@ static void lec_arp_clear_vccs(struct lec_arp_table *entry)
+ entry->vcc = NULL;
+ }
+ if (entry->recv_vcc) {
++ struct atm_vcc *vcc = entry->recv_vcc;
++ struct lec_vcc_priv *vpriv = LEC_VCC_PRIV(vcc);
++
++ kfree(vpriv);
++ vcc->user_back = NULL;
++
+ entry->recv_vcc->push = entry->old_recv_push;
+ vcc_release_async(entry->recv_vcc, -EPIPE);
+ entry->recv_vcc = NULL;
+diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
+index 9b8bf06ccb613..1401031f4bb4a 100644
+--- a/net/batman-adv/bridge_loop_avoidance.c
++++ b/net/batman-adv/bridge_loop_avoidance.c
+@@ -37,6 +37,7 @@
+ #include <linux/lockdep.h>
+ #include <linux/netdevice.h>
+ #include <linux/netlink.h>
++#include <linux/preempt.h>
+ #include <linux/rculist.h>
+ #include <linux/rcupdate.h>
+ #include <linux/seq_file.h>
+@@ -96,11 +97,12 @@ static inline u32 batadv_choose_claim(const void *data, u32 size)
+ */
+ static inline u32 batadv_choose_backbone_gw(const void *data, u32 size)
+ {
+- const struct batadv_bla_claim *claim = (struct batadv_bla_claim *)data;
++ const struct batadv_bla_backbone_gw *gw;
+ u32 hash = 0;
+
+- hash = jhash(&claim->addr, sizeof(claim->addr), hash);
+- hash = jhash(&claim->vid, sizeof(claim->vid), hash);
++ gw = (struct batadv_bla_backbone_gw *)data;
++ hash = jhash(&gw->orig, sizeof(gw->orig), hash);
++ hash = jhash(&gw->vid, sizeof(gw->vid), hash);
+
+ return hash % size;
+ }
+@@ -1592,13 +1594,16 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
+ }
+
+ /**
+- * batadv_bla_check_bcast_duplist() - Check if a frame is in the broadcast dup.
++ * batadv_bla_check_duplist() - Check if a frame is in the broadcast dup.
+ * @bat_priv: the bat priv with all the soft interface information
+- * @skb: contains the bcast_packet to be checked
++ * @skb: contains the multicast packet to be checked
++ * @payload_ptr: pointer to position inside the head buffer of the skb
++ * marking the start of the data to be CRC'ed
++ * @orig: originator mac address, NULL if unknown
+ *
+- * check if it is on our broadcast list. Another gateway might
+- * have sent the same packet because it is connected to the same backbone,
+- * so we have to remove this duplicate.
++ * Check if it is on our broadcast list. Another gateway might have sent the
++ * same packet because it is connected to the same backbone, so we have to
++ * remove this duplicate.
+ *
+ * This is performed by checking the CRC, which will tell us
+ * with a good chance that it is the same packet. If it is furthermore
+@@ -1607,19 +1612,17 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
+ *
+ * Return: true if a packet is in the duplicate list, false otherwise.
+ */
+-bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
+- struct sk_buff *skb)
++static bool batadv_bla_check_duplist(struct batadv_priv *bat_priv,
++ struct sk_buff *skb, u8 *payload_ptr,
++ const u8 *orig)
+ {
+- int i, curr;
+- __be32 crc;
+- struct batadv_bcast_packet *bcast_packet;
+ struct batadv_bcast_duplist_entry *entry;
+ bool ret = false;
+-
+- bcast_packet = (struct batadv_bcast_packet *)skb->data;
++ int i, curr;
++ __be32 crc;
+
+ /* calculate the crc ... */
+- crc = batadv_skb_crc32(skb, (u8 *)(bcast_packet + 1));
++ crc = batadv_skb_crc32(skb, payload_ptr);
+
+ spin_lock_bh(&bat_priv->bla.bcast_duplist_lock);
+
+@@ -1638,8 +1641,21 @@ bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
+ if (entry->crc != crc)
+ continue;
+
+- if (batadv_compare_eth(entry->orig, bcast_packet->orig))
+- continue;
++ /* are the originators both known and not anonymous? */
++ if (orig && !is_zero_ether_addr(orig) &&
++ !is_zero_ether_addr(entry->orig)) {
++ /* If known, check if the new frame came from
++ * the same originator:
++ * We are safe to take identical frames from the
++ * same orig, if known, as multiplications in
++ * the mesh are detected via the (orig, seqno) pair.
++ * So we can be a bit more liberal here and allow
++ * identical frames from the same orig which the source
++ * host might have sent multiple times on purpose.
++ */
++ if (batadv_compare_eth(entry->orig, orig))
++ continue;
++ }
+
+ /* this entry seems to match: same crc, not too old,
+ * and from another gw. therefore return true to forbid it.
+@@ -1655,7 +1671,14 @@ bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
+ entry = &bat_priv->bla.bcast_duplist[curr];
+ entry->crc = crc;
+ entry->entrytime = jiffies;
+- ether_addr_copy(entry->orig, bcast_packet->orig);
++
++ /* known originator */
++ if (orig)
++ ether_addr_copy(entry->orig, orig);
++ /* anonymous originator */
++ else
++ eth_zero_addr(entry->orig);
++
+ bat_priv->bla.bcast_duplist_curr = curr;
+
+ out:
+@@ -1664,6 +1687,48 @@ out:
+ return ret;
+ }
+
++/**
++ * batadv_bla_check_ucast_duplist() - Check if a frame is in the broadcast dup.
++ * @bat_priv: the bat priv with all the soft interface information
++ * @skb: contains the multicast packet to be checked, decapsulated from a
++ * unicast_packet
++ *
++ * Check if it is on our broadcast list. Another gateway might have sent the
++ * same packet because it is connected to the same backbone, so we have to
++ * remove this duplicate.
++ *
++ * Return: true if a packet is in the duplicate list, false otherwise.
++ */
++static bool batadv_bla_check_ucast_duplist(struct batadv_priv *bat_priv,
++ struct sk_buff *skb)
++{
++ return batadv_bla_check_duplist(bat_priv, skb, (u8 *)skb->data, NULL);
++}
++
++/**
++ * batadv_bla_check_bcast_duplist() - Check if a frame is in the broadcast dup.
++ * @bat_priv: the bat priv with all the soft interface information
++ * @skb: contains the bcast_packet to be checked
++ *
++ * Check if it is on our broadcast list. Another gateway might have sent the
++ * same packet because it is connected to the same backbone, so we have to
++ * remove this duplicate.
++ *
++ * Return: true if a packet is in the duplicate list, false otherwise.
++ */
++bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv,
++ struct sk_buff *skb)
++{
++ struct batadv_bcast_packet *bcast_packet;
++ u8 *payload_ptr;
++
++ bcast_packet = (struct batadv_bcast_packet *)skb->data;
++ payload_ptr = (u8 *)(bcast_packet + 1);
++
++ return batadv_bla_check_duplist(bat_priv, skb, payload_ptr,
++ bcast_packet->orig);
++}
++
+ /**
+ * batadv_bla_is_backbone_gw_orig() - Check if the originator is a gateway for
+ * the VLAN identified by vid.
+@@ -1825,7 +1890,7 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb,
+ * @bat_priv: the bat priv with all the soft interface information
+ * @skb: the frame to be checked
+ * @vid: the VLAN ID of the frame
+- * @is_bcast: the packet came in a broadcast packet type.
++ * @packet_type: the batman packet type this frame came in
+ *
+ * batadv_bla_rx avoidance checks if:
+ * * we have to race for a claim
+@@ -1837,7 +1902,7 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb,
+ * further process the skb.
+ */
+ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+- unsigned short vid, bool is_bcast)
++ unsigned short vid, int packet_type)
+ {
+ struct batadv_bla_backbone_gw *backbone_gw;
+ struct ethhdr *ethhdr;
+@@ -1859,9 +1924,32 @@ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+ goto handled;
+
+ if (unlikely(atomic_read(&bat_priv->bla.num_requests)))
+- /* don't allow broadcasts while requests are in flight */
+- if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast)
+- goto handled;
++ /* don't allow multicast packets while requests are in flight */
++ if (is_multicast_ether_addr(ethhdr->h_dest))
++ /* Both broadcast flooding or multicast-via-unicasts
++ * delivery might send to multiple backbone gateways
++ * sharing the same LAN and therefore need to coordinate
++ * which backbone gateway forwards into the LAN,
++ * by claiming the payload source address.
++ *
++ * Broadcast flooding and multicast-via-unicasts
++ * delivery use the following two batman packet types.
++ * Note: explicitly exclude BATADV_UNICAST_4ADDR,
++ * as the DHCP gateway feature will send explicitly
++ * to only one BLA gateway, so the claiming process
++ * should be avoided there.
++ */
++ if (packet_type == BATADV_BCAST ||
++ packet_type == BATADV_UNICAST)
++ goto handled;
++
++ /* potential duplicates from foreign BLA backbone gateways via
++ * multicast-in-unicast packets
++ */
++ if (is_multicast_ether_addr(ethhdr->h_dest) &&
++ packet_type == BATADV_UNICAST &&
++ batadv_bla_check_ucast_duplist(bat_priv, skb))
++ goto handled;
+
+ ether_addr_copy(search_claim.addr, ethhdr->h_source);
+ search_claim.vid = vid;
+@@ -1896,13 +1984,14 @@ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+ goto allow;
+ }
+
+- /* if it is a broadcast ... */
+- if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast) {
++ /* if it is a multicast ... */
++ if (is_multicast_ether_addr(ethhdr->h_dest) &&
++ (packet_type == BATADV_BCAST || packet_type == BATADV_UNICAST)) {
+ /* ... drop it. the responsible gateway is in charge.
+ *
+- * We need to check is_bcast because with the gateway
++ * We need to check packet type because with the gateway
+ * feature, broadcasts (like DHCP requests) may be sent
+- * using a unicast packet type.
++ * using a unicast 4 address packet type. See comment above.
+ */
+ goto handled;
+ } else {
+diff --git a/net/batman-adv/bridge_loop_avoidance.h b/net/batman-adv/bridge_loop_avoidance.h
+index 71f95a3e4d3f3..af28fdb01467c 100644
+--- a/net/batman-adv/bridge_loop_avoidance.h
++++ b/net/batman-adv/bridge_loop_avoidance.h
+@@ -48,7 +48,7 @@ static inline bool batadv_bla_is_loopdetect_mac(const uint8_t *mac)
+
+ #ifdef CONFIG_BATMAN_ADV_BLA
+ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+- unsigned short vid, bool is_bcast);
++ unsigned short vid, int packet_type);
+ bool batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+ unsigned short vid);
+ bool batadv_bla_is_backbone_gw(struct sk_buff *skb,
+@@ -79,7 +79,7 @@ bool batadv_bla_check_claim(struct batadv_priv *bat_priv, u8 *addr,
+
+ static inline bool batadv_bla_rx(struct batadv_priv *bat_priv,
+ struct sk_buff *skb, unsigned short vid,
+- bool is_bcast)
++ int packet_type)
+ {
+ return false;
+ }
+diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
+index cc3ed93a6d513..98af41e3810dc 100644
+--- a/net/batman-adv/routing.c
++++ b/net/batman-adv/routing.c
+@@ -838,6 +838,10 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
+ vid = batadv_get_vid(skb, hdr_len);
+ ethhdr = (struct ethhdr *)(skb->data + hdr_len);
+
++ /* do not reroute multicast frames in a unicast header */
++ if (is_multicast_ether_addr(ethhdr->h_dest))
++ return true;
++
+ /* check if the destination client was served by this node and it is now
+ * roaming. In this case, it means that the node has got a ROAM_ADV
+ * message and that it knows the new destination in the mesh to re-route
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index a2976adeeedce..6ff78080ec7fb 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -426,10 +426,10 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ struct vlan_ethhdr *vhdr;
+ struct ethhdr *ethhdr;
+ unsigned short vid;
+- bool is_bcast;
++ int packet_type;
+
+ batadv_bcast_packet = (struct batadv_bcast_packet *)skb->data;
+- is_bcast = (batadv_bcast_packet->packet_type == BATADV_BCAST);
++ packet_type = batadv_bcast_packet->packet_type;
+
+ skb_pull_rcsum(skb, hdr_size);
+ skb_reset_mac_header(skb);
+@@ -472,7 +472,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ /* Let the bridge loop avoidance check the packet. If will
+ * not handle it, we can safely push it up.
+ */
+- if (batadv_bla_rx(bat_priv, skb, vid, is_bcast))
++ if (batadv_bla_rx(bat_priv, skb, vid, packet_type))
+ goto out;
+
+ if (orig_node)
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 2b4a7cf03041b..310622086f74b 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -41,12 +41,27 @@
+
+ /* Handle HCI Event packets */
+
+-static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
++static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
++ u8 *new_status)
+ {
+ __u8 status = *((__u8 *) skb->data);
+
+ BT_DBG("%s status 0x%2.2x", hdev->name, status);
+
++ /* It is possible that we receive Inquiry Complete event right
++ * before we receive Inquiry Cancel Command Complete event, in
++ * which case the latter event should have status of Command
++ * Disallowed (0x0c). This should not be treated as error, since
++ * we actually achieve what Inquiry Cancel wants to achieve,
++ * which is to end the last Inquiry session.
++ */
++ if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
++ bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
++ status = 0x00;
++ }
++
++ *new_status = status;
++
+ if (status)
+ return;
+
+@@ -3039,7 +3054,7 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
+
+ switch (*opcode) {
+ case HCI_OP_INQUIRY_CANCEL:
+- hci_cc_inquiry_cancel(hdev, skb);
++ hci_cc_inquiry_cancel(hdev, skb, status);
+ break;
+
+ case HCI_OP_PERIODIC_INQ:
+@@ -5738,6 +5753,11 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
+ u8 status = 0, event = hdr->evt, req_evt = 0;
+ u16 opcode = HCI_OP_NOP;
+
++ if (!event) {
++ bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
++ goto done;
++ }
++
+ if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
+ struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
+ opcode = __le16_to_cpu(cmd_hdr->opcode);
+@@ -5949,6 +5969,7 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
+ req_complete_skb(hdev, status, opcode, orig_skb);
+ }
+
++done:
+ kfree_skb(orig_skb);
+ kfree_skb(skb);
+ hdev->stat.evt_rx++;
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 0d84d1f820d4c..c04107d446016 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -414,6 +414,9 @@ static void l2cap_chan_timeout(struct work_struct *work)
+ BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
+
+ mutex_lock(&conn->chan_lock);
++ /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
++ * this work. No need to call l2cap_chan_hold(chan) here again.
++ */
+ l2cap_chan_lock(chan);
+
+ if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
+@@ -426,12 +429,12 @@ static void l2cap_chan_timeout(struct work_struct *work)
+
+ l2cap_chan_close(chan, reason);
+
+- l2cap_chan_unlock(chan);
+-
+ chan->ops->close(chan);
+- mutex_unlock(&conn->chan_lock);
+
++ l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
++
++ mutex_unlock(&conn->chan_lock);
+ }
+
+ struct l2cap_chan *l2cap_chan_create(void)
+@@ -1725,9 +1728,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
+
+ l2cap_chan_del(chan, err);
+
+- l2cap_chan_unlock(chan);
+-
+ chan->ops->close(chan);
++
++ l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
+ }
+
+@@ -4114,7 +4117,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
+ return 0;
+ }
+
+- if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
++ if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
++ chan->state != BT_CONNECTED) {
+ cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
+ chan->dcid);
+ goto unlock;
+@@ -4337,6 +4341,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
+ return 0;
+ }
+
++ l2cap_chan_hold(chan);
+ l2cap_chan_lock(chan);
+
+ rsp.dcid = cpu_to_le16(chan->scid);
+@@ -4345,12 +4350,11 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
+
+ chan->ops->set_shutdown(chan);
+
+- l2cap_chan_hold(chan);
+ l2cap_chan_del(chan, ECONNRESET);
+
+- l2cap_chan_unlock(chan);
+-
+ chan->ops->close(chan);
++
++ l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
+
+ mutex_unlock(&conn->chan_lock);
+@@ -4382,20 +4386,21 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
+ return 0;
+ }
+
++ l2cap_chan_hold(chan);
+ l2cap_chan_lock(chan);
+
+ if (chan->state != BT_DISCONN) {
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+ mutex_unlock(&conn->chan_lock);
+ return 0;
+ }
+
+- l2cap_chan_hold(chan);
+ l2cap_chan_del(chan, 0);
+
+- l2cap_chan_unlock(chan);
+-
+ chan->ops->close(chan);
++
++ l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
+
+ mutex_unlock(&conn->chan_lock);
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index a3a2cd55e23a9..5572042f04531 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1039,7 +1039,7 @@ done:
+ }
+
+ /* Kill socket (only if zapped and orphan)
+- * Must be called on unlocked socket.
++ * Must be called on unlocked socket, with l2cap channel lock.
+ */
+ static void l2cap_sock_kill(struct sock *sk)
+ {
+@@ -1190,6 +1190,7 @@ static int l2cap_sock_release(struct socket *sock)
+ {
+ struct sock *sk = sock->sk;
+ int err;
++ struct l2cap_chan *chan;
+
+ BT_DBG("sock %p, sk %p", sock, sk);
+
+@@ -1199,9 +1200,17 @@ static int l2cap_sock_release(struct socket *sock)
+ bt_sock_unlink(&l2cap_sk_list, sk);
+
+ err = l2cap_sock_shutdown(sock, 2);
++ chan = l2cap_pi(sk)->chan;
++
++ l2cap_chan_hold(chan);
++ l2cap_chan_lock(chan);
+
+ sock_orphan(sk);
+ l2cap_sock_kill(sk);
++
++ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
++
+ return err;
+ }
+
+@@ -1219,12 +1228,15 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
+ BT_DBG("child chan %p state %s", chan,
+ state_to_string(chan->state));
+
++ l2cap_chan_hold(chan);
+ l2cap_chan_lock(chan);
++
+ __clear_chan_timer(chan);
+ l2cap_chan_close(chan, ECONNRESET);
+- l2cap_chan_unlock(chan);
+-
+ l2cap_sock_kill(sk);
++
++ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+ }
+ }
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 25a2c3186e14a..557bd5cc8f94c 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -5418,8 +5418,6 @@ static int bpf_gen_ld_abs(const struct bpf_insn *orig,
+ bool indirect = BPF_MODE(orig->code) == BPF_IND;
+ struct bpf_insn *insn = insn_buf;
+
+- /* We're guaranteed here that CTX is in R6. */
+- *insn++ = BPF_MOV64_REG(BPF_REG_1, BPF_REG_CTX);
+ if (!indirect) {
+ *insn++ = BPF_MOV64_IMM(BPF_REG_2, orig->imm);
+ } else {
+@@ -5427,6 +5425,8 @@ static int bpf_gen_ld_abs(const struct bpf_insn *orig,
+ if (orig->imm)
+ *insn++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, orig->imm);
+ }
++ /* We're guaranteed here that CTX is in R6. */
++ *insn++ = BPF_MOV64_REG(BPF_REG_1, BPF_REG_CTX);
+
+ switch (BPF_SIZE(orig->code)) {
+ case BPF_B:
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index bf738ec68cb53..6e890f51b7d86 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -2844,6 +2844,7 @@ static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ *pos = cpu+1;
+ return per_cpu_ptr(tbl->stats, cpu);
+ }
++ (*pos)++;
+ return NULL;
+ }
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 84de87b7eedcd..3db428242b22d 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -274,6 +274,7 @@ static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ *pos = cpu+1;
+ return &per_cpu(rt_cache_stat, cpu);
+ }
++ (*pos)++;
+ return NULL;
+
+ }
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 616ff2970f4fc..4ce3397e6fcf7 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2038,7 +2038,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
+
+ /* Well, if we have backlog, try to process it now yet. */
+
+- if (copied >= target && !sk->sk_backlog.tail)
++ if (copied >= target && !READ_ONCE(sk->sk_backlog.tail))
+ break;
+
+ if (copied) {
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 05a206202e23d..b924941b96a31 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -2377,14 +2377,13 @@ static void *ipv6_route_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ struct net *net = seq_file_net(seq);
+ struct ipv6_route_iter *iter = seq->private;
+
++ ++(*pos);
+ if (!v)
+ goto iter_table;
+
+ n = rcu_dereference_bh(((struct fib6_info *)v)->fib6_next);
+- if (n) {
+- ++*pos;
++ if (n)
+ return n;
+- }
+
+ iter_table:
+ ipv6_route_check_sernum(iter);
+@@ -2392,8 +2391,6 @@ iter_table:
+ r = fib6_walk_continue(&iter->w);
+ spin_unlock_bh(&iter->tbl->tb6_lock);
+ if (r > 0) {
+- if (v)
+- ++*pos;
+ return iter->w.leaf;
+ } else if (r < 0) {
+ fib6_walker_unlink(net, &iter->w);
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index 6ead3c39f3566..bcba579e292ff 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -785,7 +785,7 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ }
+ /* Well, if we have backlog, try to process it now yet. */
+
+- if (copied >= target && !sk->sk_backlog.tail)
++ if (copied >= target && !READ_ONCE(sk->sk_backlog.tail))
+ break;
+
+ if (copied) {
+diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
+index bcd1a5e6ebf42..2f873a0dc5836 100644
+--- a/net/mac802154/tx.c
++++ b/net/mac802154/tx.c
+@@ -42,11 +42,11 @@ void ieee802154_xmit_worker(struct work_struct *work)
+ if (res)
+ goto err_tx;
+
+- ieee802154_xmit_complete(&local->hw, skb, false);
+-
+ dev->stats.tx_packets++;
+ dev->stats.tx_bytes += skb->len;
+
++ ieee802154_xmit_complete(&local->hw, skb, false);
++
+ return;
+
+ err_tx:
+@@ -86,6 +86,8 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
+
+ /* async is priority, otherwise sync is fallback */
+ if (local->ops->xmit_async) {
++ unsigned int len = skb->len;
++
+ ret = drv_xmit_async(local, skb);
+ if (ret) {
+ ieee802154_wake_queue(&local->hw);
+@@ -93,7 +95,7 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
+ }
+
+ dev->stats.tx_packets++;
+- dev->stats.tx_bytes += skb->len;
++ dev->stats.tx_bytes += len;
+ } else {
+ local->tx_skb = skb;
+ queue_work(local->workqueue, &local->tx_work);
+diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c
+index c038e021a5916..5ea2471ffc03f 100644
+--- a/net/openvswitch/meter.c
++++ b/net/openvswitch/meter.c
+@@ -255,8 +255,8 @@ static struct dp_meter *dp_meter_create(struct nlattr **a)
+ *
+ * Start with a full bucket.
+ */
+- band->bucket = (band->burst_size + band->rate) * 1000;
+- band_max_delta_t = band->bucket / band->rate;
++ band->bucket = (band->burst_size + band->rate) * 1000ULL;
++ band_max_delta_t = div_u64(band->bucket, band->rate);
+ if (band_max_delta_t > meter->max_delta_t)
+ meter->max_delta_t = band_max_delta_t;
+ band++;
+diff --git a/net/openvswitch/meter.h b/net/openvswitch/meter.h
+index 964ace2650f89..970557ed5b5b6 100644
+--- a/net/openvswitch/meter.h
++++ b/net/openvswitch/meter.h
+@@ -26,7 +26,7 @@ struct dp_meter_band {
+ u32 type;
+ u32 rate;
+ u32 burst_size;
+- u32 bucket; /* 1/1000 packets, or in bits */
++ u64 bucket; /* 1/1000 packets, or in bits */
+ struct ovs_flow_stats stats;
+ };
+
+diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
+index 7bb8e5603298d..d6e83a37a1adf 100644
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -51,6 +51,7 @@
+ #include <net/sctp/sctp.h>
+ #include <net/sctp/sm.h>
+ #include <net/sctp/stream_sched.h>
++#include <trace/events/sctp.h>
+
+ /* Declare internal functions here. */
+ static int sctp_acked(struct sctp_sackhdr *sack, __u32 tsn);
+@@ -1257,6 +1258,11 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_chunk *chunk)
+ /* Grab the association's destination address list. */
+ transport_list = &asoc->peer.transport_addr_list;
+
++ /* SCTP path tracepoint for congestion control debugging. */
++ list_for_each_entry(transport, transport_list, transports) {
++ trace_sctp_probe_path(transport, asoc);
++ }
++
+ sack_ctsn = ntohl(sack->cum_tsn_ack);
+ gap_ack_blocks = ntohs(sack->num_gap_ack_blocks);
+ asoc->stats.gapcnt += gap_ack_blocks;
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index c8ee8e801edb8..709c082dc9059 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -103,8 +103,17 @@ void svc_unreg_xprt_class(struct svc_xprt_class *xcl)
+ }
+ EXPORT_SYMBOL_GPL(svc_unreg_xprt_class);
+
+-/*
+- * Format the transport list for printing
++/**
++ * svc_print_xprts - Format the transport list for printing
++ * @buf: target buffer for formatted address
++ * @maxlen: length of target buffer
++ *
++ * Fills in @buf with a string containing a list of transport names, each name
++ * terminated with '\n'. If the buffer is too small, some entries may be
++ * missing, but it is guaranteed that all lines in the output buffer are
++ * complete.
++ *
++ * Returns positive length of the filled-in string.
+ */
+ int svc_print_xprts(char *buf, int maxlen)
+ {
+@@ -117,9 +126,9 @@ int svc_print_xprts(char *buf, int maxlen)
+ list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) {
+ int slen;
+
+- sprintf(tmpstr, "%s %d\n", xcl->xcl_name, xcl->xcl_max_payload);
+- slen = strlen(tmpstr);
+- if (len + slen > maxlen)
++ slen = snprintf(tmpstr, sizeof(tmpstr), "%s %d\n",
++ xcl->xcl_name, xcl->xcl_max_payload);
++ if (slen >= sizeof(tmpstr) || len + slen >= maxlen)
+ break;
+ len += slen;
+ strcat(buf, tmpstr);
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+index b9827665ff355..d183d4aee822c 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+@@ -256,6 +256,7 @@ xprt_rdma_bc_put(struct rpc_xprt *xprt)
+ {
+ dprintk("svcrdma: %s: xprt %p\n", __func__, xprt);
+
++ xprt_rdma_free_addresses(xprt);
+ xprt_free(xprt);
+ module_put(THIS_MODULE);
+ }
+diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
+index 41f4464ac6cc5..ec9a7137d2677 100644
+--- a/net/tipc/topsrv.c
++++ b/net/tipc/topsrv.c
+@@ -407,7 +407,9 @@ static int tipc_conn_rcv_from_sock(struct tipc_conn *con)
+ return -EWOULDBLOCK;
+ if (ret == sizeof(s)) {
+ read_lock_bh(&sk->sk_callback_lock);
+- ret = tipc_conn_rcv_sub(srv, con, &s);
++ /* RACE: the connection can be closed in the meantime */
++ if (likely(connected(con)))
++ ret = tipc_conn_rcv_sub(srv, con, &s);
+ read_unlock_bh(&sk->sk_callback_lock);
+ if (!ret)
+ return 0;
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 2318e2e2748f4..2020306468af4 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -192,11 +192,17 @@ static inline int unix_may_send(struct sock *sk, struct sock *osk)
+ return unix_peer(osk) == NULL || unix_our_peer(sk, osk);
+ }
+
+-static inline int unix_recvq_full(struct sock const *sk)
++static inline int unix_recvq_full(const struct sock *sk)
+ {
+ return skb_queue_len(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;
+ }
+
++static inline int unix_recvq_full_lockless(const struct sock *sk)
++{
++ return skb_queue_len_lockless(&sk->sk_receive_queue) >
++ READ_ONCE(sk->sk_max_ack_backlog);
++}
++
+ struct sock *unix_peer_get(struct sock *s)
+ {
+ struct sock *peer;
+@@ -1788,7 +1794,8 @@ restart_locked:
+ * - unix_peer(sk) == sk by time of get but disconnected before lock
+ */
+ if (other != sk &&
+- unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
++ unlikely(unix_peer(other) != sk &&
++ unix_recvq_full_lockless(other))) {
+ if (timeo) {
+ timeo = unix_wait_for_peer(other, timeo);
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 452254fd89f87..250b725f5754c 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -3304,6 +3304,9 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
+ return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
+ }
+
++ if (!selinux_state.initialized)
++ return (inode_owner_or_capable(inode) ? 0 : -EPERM);
++
+ sbsec = inode->i_sb->s_security;
+ if (!(sbsec->flags & SBLABEL_MNT))
+ return -EOPNOTSUPP;
+@@ -3387,6 +3390,15 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
+ return;
+ }
+
++ if (!selinux_state.initialized) {
++ /* If we haven't even been initialized, then we can't validate
++ * against a policy, so leave the label as invalid. It may
++ * resolve to a valid label on the next revalidation try if
++ * we've since initialized.
++ */
++ return;
++ }
++
+ rc = security_context_to_sid_force(&selinux_state, value, size,
+ &newsid);
+ if (rc) {
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index f3a5a138a096d..60b3f16bb5c7b 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -1509,6 +1509,7 @@ static struct avc_cache_stats *sel_avc_get_stat_idx(loff_t *idx)
+ *idx = cpu + 1;
+ return &per_cpu(avc_cache_stats, cpu);
+ }
++ (*idx)++;
+ return NULL;
+ }
+
+diff --git a/sound/hda/hdac_bus.c b/sound/hda/hdac_bus.c
+index 714a51721a313..ab9236e4c157e 100644
+--- a/sound/hda/hdac_bus.c
++++ b/sound/hda/hdac_bus.c
+@@ -155,6 +155,7 @@ static void process_unsol_events(struct work_struct *work)
+ struct hdac_driver *drv;
+ unsigned int rp, caddr, res;
+
++ spin_lock_irq(&bus->reg_lock);
+ while (bus->unsol_rp != bus->unsol_wp) {
+ rp = (bus->unsol_rp + 1) % HDA_UNSOL_QUEUE_SIZE;
+ bus->unsol_rp = rp;
+@@ -166,10 +167,13 @@ static void process_unsol_events(struct work_struct *work)
+ codec = bus->caddr_tbl[caddr & 0x0f];
+ if (!codec || !codec->dev.driver)
+ continue;
++ spin_unlock_irq(&bus->reg_lock);
+ drv = drv_to_hdac_driver(codec->dev.driver);
+ if (drv->unsol_event)
+ drv->unsol_event(codec, res);
++ spin_lock_irq(&bus->reg_lock);
+ }
++ spin_unlock_irq(&bus->reg_lock);
+ }
+
+ /**
+diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
+index 7d049569012c1..3f06986fbecf8 100644
+--- a/sound/pci/asihpi/hpioctl.c
++++ b/sound/pci/asihpi/hpioctl.c
+@@ -350,7 +350,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev,
+ struct hpi_message hm;
+ struct hpi_response hr;
+ struct hpi_adapter adapter;
+- struct hpi_pci pci;
++ struct hpi_pci pci = { 0 };
+
+ memset(&adapter, 0, sizeof(adapter));
+
+@@ -506,7 +506,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev,
+ return 0;
+
+ err:
+- for (idx = 0; idx < HPI_MAX_ADAPTER_MEM_SPACES; idx++) {
++ while (--idx >= 0) {
+ if (pci.ap_mem_base[idx]) {
+ iounmap(pci.ap_mem_base[idx]);
+ pci.ap_mem_base[idx] = NULL;
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index fa261b27d8588..8198d2e53b7df 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -1169,16 +1169,23 @@ irqreturn_t azx_interrupt(int irq, void *dev_id)
+ if (snd_hdac_bus_handle_stream_irq(bus, status, stream_update))
+ active = true;
+
+- /* clear rirb int */
+ status = azx_readb(chip, RIRBSTS);
+ if (status & RIRB_INT_MASK) {
++ /*
++ * Clearing the interrupt status here ensures that no
++ * interrupt gets masked after the RIRB wp is read in
++ * snd_hdac_bus_update_rirb. This avoids a possible
++ * race condition where codec response in RIRB may
++ * remain unserviced by IRQ, eventually falling back
++ * to polling mode in azx_rirb_get_response.
++ */
++ azx_writeb(chip, RIRBSTS, RIRB_INT_MASK);
+ active = true;
+ if (status & RIRB_INT_RESPONSE) {
+ if (chip->driver_caps & AZX_DCAPS_CTX_WORKAROUND)
+ udelay(80);
+ snd_hdac_bus_update_rirb(bus);
+ }
+- azx_writeb(chip, RIRBSTS, RIRB_INT_MASK);
+ }
+ } while (active && ++repeat < 10);
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9c5b3d19bfa73..24bc9e4460473 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3290,7 +3290,11 @@ static void alc256_shutup(struct hda_codec *codec)
+
+ /* 3k pull low control for Headset jack. */
+ /* NOTE: call this before clearing the pin, otherwise codec stalls */
+- alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
++ /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
++ * when booting with headset plugged. So skip setting it for the codec alc257
++ */
++ if (codec->core.vendor_id != 0x10ec0257)
++ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+ if (!spec->no_shutup_pins)
+ snd_hda_codec_write(codec, hp_pin, 0,
+@@ -5612,6 +5616,7 @@ static void alc_fixup_thinkpad_acpi(struct hda_codec *codec,
+ #include "hp_x360_helper.c"
+
+ enum {
++ ALC269_FIXUP_GPIO2,
+ ALC269_FIXUP_SONY_VAIO,
+ ALC275_FIXUP_SONY_VAIO_GPIO2,
+ ALC269_FIXUP_DELL_M101Z,
+@@ -5764,6 +5769,10 @@ enum {
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
++ [ALC269_FIXUP_GPIO2] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_gpio2,
++ },
+ [ALC269_FIXUP_SONY_VAIO] = {
+ .type = HDA_FIXUP_PINCTLS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -6559,6 +6568,8 @@ static const struct hda_fixup alc269_fixups[] = {
+ [ALC233_FIXUP_LENOVO_MULTI_CODECS] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc233_alc662_fixup_lenovo_dual_codecs,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_GPIO2
+ },
+ [ALC233_FIXUP_ACER_HEADSET_MIC] = {
+ .type = HDA_FIXUP_VERBS,
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 89b6e187ac235..a5b0c40ee545f 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -2130,10 +2130,16 @@ static void max98090_pll_work(struct max98090_priv *max98090)
+
+ dev_info_ratelimited(component->dev, "PLL unlocked\n");
+
++ /*
++ * As the datasheet suggested, the maximum PLL lock time should be
++ * 7 msec. The workaround resets the codec softly by toggling SHDN
++ * off and on if PLL failed to lock for 10 msec. Notably, there is
++ * no suggested hold time for SHDN off.
++ */
++
+ /* Toggle shutdown OFF then ON */
+ snd_soc_component_update_bits(component, M98090_REG_DEVICE_SHUTDOWN,
+ M98090_SHDNN_MASK, 0);
+- msleep(10);
+ snd_soc_component_update_bits(component, M98090_REG_DEVICE_SHUTDOWN,
+ M98090_SHDNN_MASK, M98090_SHDNN_MASK);
+
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 01acb8da2f48e..e3e069277a3ff 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -3376,6 +3376,8 @@ int wm8994_mic_detect(struct snd_soc_component *component, struct snd_soc_jack *
+ return -EINVAL;
+ }
+
++ pm_runtime_get_sync(component->dev);
++
+ switch (micbias) {
+ case 1:
+ micdet = &wm8994->micdet[0];
+@@ -3423,6 +3425,8 @@ int wm8994_mic_detect(struct snd_soc_component *component, struct snd_soc_jack *
+
+ snd_soc_dapm_sync(dapm);
+
++ pm_runtime_put(component->dev);
++
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(wm8994_mic_detect);
+@@ -3790,6 +3794,8 @@ int wm8958_mic_detect(struct snd_soc_component *component, struct snd_soc_jack *
+ return -EINVAL;
+ }
+
++ pm_runtime_get_sync(component->dev);
++
+ if (jack) {
+ snd_soc_dapm_force_enable_pin(dapm, "CLK_SYS");
+ snd_soc_dapm_sync(dapm);
+@@ -3858,6 +3864,8 @@ int wm8958_mic_detect(struct snd_soc_component *component, struct snd_soc_jack *
+ snd_soc_dapm_sync(dapm);
+ }
+
++ pm_runtime_put(component->dev);
++
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(wm8958_mic_detect);
+@@ -4051,11 +4059,13 @@ static int wm8994_component_probe(struct snd_soc_component *component)
+ wm8994->hubs.dcs_readback_mode = 2;
+ break;
+ }
++ wm8994->hubs.micd_scthr = true;
+ break;
+
+ case WM8958:
+ wm8994->hubs.dcs_readback_mode = 1;
+ wm8994->hubs.hp_startup_mode = 1;
++ wm8994->hubs.micd_scthr = true;
+
+ switch (control->revision) {
+ case 0:
+diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
+index fed6ea9b019f7..da7fa6f5459e6 100644
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -1227,6 +1227,9 @@ int wm_hubs_handle_analogue_pdata(struct snd_soc_component *component,
+ snd_soc_component_update_bits(component, WM8993_ADDITIONAL_CONTROL,
+ WM8993_LINEOUT2_FB, WM8993_LINEOUT2_FB);
+
++ if (!hubs->micd_scthr)
++ return 0;
++
+ snd_soc_component_update_bits(component, WM8993_MICBIAS,
+ WM8993_JD_SCTHR_MASK | WM8993_JD_THR_MASK |
+ WM8993_MICB1_LVL | WM8993_MICB2_LVL,
+diff --git a/sound/soc/codecs/wm_hubs.h b/sound/soc/codecs/wm_hubs.h
+index ee339ad8514d1..1433d73e09bf8 100644
+--- a/sound/soc/codecs/wm_hubs.h
++++ b/sound/soc/codecs/wm_hubs.h
+@@ -31,6 +31,7 @@ struct wm_hubs_data {
+ int hp_startup_mode;
+ int series_startup;
+ int no_series_update;
++ bool micd_scthr;
+
+ bool no_cache_dac_hp_direct;
+ struct list_head dcs_cache;
+diff --git a/sound/soc/img/img-i2s-out.c b/sound/soc/img/img-i2s-out.c
+index fc2d1dac63339..798ab579564cb 100644
+--- a/sound/soc/img/img-i2s-out.c
++++ b/sound/soc/img/img-i2s-out.c
+@@ -350,8 +350,10 @@ static int img_i2s_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ chan_control_mask = IMG_I2S_OUT_CHAN_CTL_CLKT_MASK;
+
+ ret = pm_runtime_get_sync(i2s->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(i2s->dev);
+ return ret;
++ }
+
+ img_i2s_out_disable(i2s);
+
+@@ -491,8 +493,10 @@ static int img_i2s_out_probe(struct platform_device *pdev)
+ goto err_pm_disable;
+ }
+ ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(&pdev->dev);
+ goto err_suspend;
++ }
+
+ reg = IMG_I2S_OUT_CTL_FRM_SIZE_MASK;
+ img_i2s_out_writel(i2s, reg, IMG_I2S_OUT_CTL);
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 0dcd249877c55..ec630127ef2f3 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -588,6 +588,16 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* MPMAN Converter 9, similar hw as the I.T.Works TW891 2-in-1 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MPMAN"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Converter9"),
++ },
++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS |
++ BYT_RT5640_MONO_SPEAKER |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ /* MPMAN MPWIN895CL */
+ .matches = {
+diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c
+index c6a58520d377a..255cc45905b81 100644
+--- a/sound/soc/kirkwood/kirkwood-dma.c
++++ b/sound/soc/kirkwood/kirkwood-dma.c
+@@ -136,7 +136,7 @@ static int kirkwood_dma_open(struct snd_pcm_substream *substream)
+ err = request_irq(priv->irq, kirkwood_dma_irq, IRQF_SHARED,
+ "kirkwood-i2s", priv);
+ if (err)
+- return -EBUSY;
++ return err;
+
+ /*
+ * Enable Error interrupts. We're only ack'ing them but
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 28a3ad8b1d74b..137e1e8718d6f 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1828,6 +1828,28 @@ static int snd_usbmidi_create_endpoints(struct snd_usb_midi *umidi,
+ return 0;
+ }
+
++static struct usb_ms_endpoint_descriptor *find_usb_ms_endpoint_descriptor(
++ struct usb_host_endpoint *hostep)
++{
++ unsigned char *extra = hostep->extra;
++ int extralen = hostep->extralen;
++
++ while (extralen > 3) {
++ struct usb_ms_endpoint_descriptor *ms_ep =
++ (struct usb_ms_endpoint_descriptor *)extra;
++
++ if (ms_ep->bLength > 3 &&
++ ms_ep->bDescriptorType == USB_DT_CS_ENDPOINT &&
++ ms_ep->bDescriptorSubtype == UAC_MS_GENERAL)
++ return ms_ep;
++ if (!extra[0])
++ break;
++ extralen -= extra[0];
++ extra += extra[0];
++ }
++ return NULL;
++}
++
+ /*
+ * Returns MIDIStreaming device capabilities.
+ */
+@@ -1865,11 +1887,8 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi,
+ ep = get_ep_desc(hostep);
+ if (!usb_endpoint_xfer_bulk(ep) && !usb_endpoint_xfer_int(ep))
+ continue;
+- ms_ep = (struct usb_ms_endpoint_descriptor *)hostep->extra;
+- if (hostep->extralen < 4 ||
+- ms_ep->bLength < 4 ||
+- ms_ep->bDescriptorType != USB_DT_CS_ENDPOINT ||
+- ms_ep->bDescriptorSubtype != UAC_MS_GENERAL)
++ ms_ep = find_usb_ms_endpoint_descriptor(hostep);
++ if (!ms_ep)
+ continue;
+ if (usb_endpoint_dir_out(ep)) {
+ if (endpoints[epidx].out_ep) {
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 45bd3d54be54b..451b8ea383c61 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1699,6 +1699,16 @@ static void __build_feature_ctl(struct usb_mixer_interface *mixer,
+ /* get min/max values */
+ get_min_max_with_quirks(cval, 0, kctl);
+
++ /* skip a bogus volume range */
++ if (cval->max <= cval->min) {
++ usb_audio_dbg(mixer->chip,
++ "[%d] FU [%s] skipped due to invalid volume\n",
++ cval->head.id, kctl->id.name);
++ snd_ctl_free_one(kctl);
++ return;
++ }
++
++
+ if (control == UAC_FU_VOLUME) {
+ check_mapped_dB(map, cval);
+ if (cval->dBmin < cval->dBmax || !cval->initialized) {
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 8d9117312e30c..e6dea1c7112be 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1338,12 +1338,13 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+ && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ msleep(20);
+
+- /* Zoom R16/24, Logitech H650e, Jabra 550a, Kingston HyperX needs a tiny
+- * delay here, otherwise requests like get/set frequency return as
+- * failed despite actually succeeding.
++ /* Zoom R16/24, Logitech H650e/H570e, Jabra 550a, Kingston HyperX
++ * needs a tiny delay here, otherwise requests like get/set
++ * frequency return as failed despite actually succeeding.
+ */
+ if ((chip->usb_id == USB_ID(0x1686, 0x00dd) ||
+ chip->usb_id == USB_ID(0x046d, 0x0a46) ||
++ chip->usb_id == USB_ID(0x046d, 0x0a56) ||
+ chip->usb_id == USB_ID(0x0b0e, 0x0349) ||
+ chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+diff --git a/tools/gpio/gpio-hammer.c b/tools/gpio/gpio-hammer.c
+index 4bcb234c0fcab..3da5462a0c7d3 100644
+--- a/tools/gpio/gpio-hammer.c
++++ b/tools/gpio/gpio-hammer.c
+@@ -138,7 +138,14 @@ int main(int argc, char **argv)
+ device_name = optarg;
+ break;
+ case 'o':
+- lines[i] = strtoul(optarg, NULL, 10);
++ /*
++ * Avoid overflow. Do not immediately error, we want to
++ * be able to accurately report on the amount of times
++ * '-o' was given to give an accurate error message
++ */
++ if (i < GPIOHANDLES_MAX)
++ lines[i] = strtoul(optarg, NULL, 10);
++
+ i++;
+ break;
+ case '?':
+@@ -146,6 +153,14 @@ int main(int argc, char **argv)
+ return -1;
+ }
+ }
++
++ if (i >= GPIOHANDLES_MAX) {
++ fprintf(stderr,
++ "Only %d occurences of '-o' are allowed, %d were found\n",
++ GPIOHANDLES_MAX, i + 1);
++ return -1;
++ }
++
+ nlines = i;
+
+ if (!device_name || !nlines) {
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index fd3071d83deae..c0ab27368a345 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -503,7 +503,7 @@ static int add_jump_destinations(struct objtool_file *file)
+ insn->type != INSN_JUMP_UNCONDITIONAL)
+ continue;
+
+- if (insn->ignore || insn->offset == FAKE_JUMP_OFFSET)
++ if (insn->offset == FAKE_JUMP_OFFSET)
+ continue;
+
+ rela = find_rela_by_dest_range(insn->sec, insn->offset,
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 6aae10ff954c7..adabe9d4dc866 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -422,7 +422,7 @@ static void process_interval(void)
+ }
+
+ init_stats(&walltime_nsecs_stats);
+- update_stats(&walltime_nsecs_stats, stat_config.interval * 1000000);
++ update_stats(&walltime_nsecs_stats, stat_config.interval * 1000000ULL);
+ print_counters(&rs, 0, NULL);
+ }
+
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index c17e594041712..6631970f96832 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -1064,10 +1064,9 @@ static int process_one_file(const char *fpath, const struct stat *sb,
+ */
+ int main(int argc, char *argv[])
+ {
+- int rc;
++ int rc, ret = 0;
+ int maxfds;
+ char ldirname[PATH_MAX];
+-
+ const char *arch;
+ const char *output_file;
+ const char *start_dirname;
+@@ -1138,7 +1137,8 @@ int main(int argc, char *argv[])
+ /* Make build fail */
+ fclose(eventsfp);
+ free_arch_std_events();
+- return 1;
++ ret = 1;
++ goto out_free_mapfile;
+ } else if (rc) {
+ goto empty_map;
+ }
+@@ -1156,14 +1156,17 @@ int main(int argc, char *argv[])
+ /* Make build fail */
+ fclose(eventsfp);
+ free_arch_std_events();
+- return 1;
++ ret = 1;
+ }
+
+- return 0;
++
++ goto out_free_mapfile;
+
+ empty_map:
+ fclose(eventsfp);
+ create_empty_mapping(output_file);
+ free_arch_std_events();
+- return 0;
++out_free_mapfile:
++ free(mapfile);
++ return ret;
+ }
+diff --git a/tools/perf/tests/shell/lib/probe_vfs_getname.sh b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
+index 7cb99b433888b..c2cc42daf9242 100644
+--- a/tools/perf/tests/shell/lib/probe_vfs_getname.sh
++++ b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
+@@ -14,7 +14,7 @@ add_probe_vfs_getname() {
+ if [ $had_vfs_getname -eq 1 ] ; then
+ line=$(perf probe -L getname_flags 2>&1 | egrep 'result.*=.*filename;' | sed -r 's/[[:space:]]+([[:digit:]]+)[[:space:]]+result->uptr.*/\1/')
+ perf probe -q "vfs_getname=getname_flags:${line} pathname=result->name:string" || \
+- perf probe $verbose "vfs_getname=getname_flags:${line} pathname=filename:string"
++ perf probe $verbose "vfs_getname=getname_flags:${line} pathname=filename:ustring"
+ fi
+ }
+
+diff --git a/tools/perf/trace/beauty/arch_errno_names.sh b/tools/perf/trace/beauty/arch_errno_names.sh
+index 22c9fc900c847..f8c44a85650be 100755
+--- a/tools/perf/trace/beauty/arch_errno_names.sh
++++ b/tools/perf/trace/beauty/arch_errno_names.sh
+@@ -91,7 +91,7 @@ EoHEADER
+ # in tools/perf/arch
+ archlist=""
+ for arch in $(find $toolsdir/arch -maxdepth 1 -mindepth 1 -type d -printf "%f\n" | grep -v x86 | sort); do
+- test -d arch/$arch && archlist="$archlist $arch"
++ test -d $toolsdir/perf/arch/$arch && archlist="$archlist $arch"
+ done
+
+ for arch in x86 $archlist generic; do
+diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
+index f93846edc1e0d..827d844f4efb1 100644
+--- a/tools/perf/util/cpumap.c
++++ b/tools/perf/util/cpumap.c
+@@ -462,7 +462,7 @@ static void set_max_cpu_num(void)
+
+ /* get the highest possible cpu number for a sparse allocation */
+ ret = snprintf(path, PATH_MAX, "%s/devices/system/cpu/possible", mnt);
+- if (ret == PATH_MAX) {
++ if (ret >= PATH_MAX) {
+ pr_err("sysfs path crossed PATH_MAX(%d) size\n", PATH_MAX);
+ goto out;
+ }
+@@ -473,7 +473,7 @@ static void set_max_cpu_num(void)
+
+ /* get the highest present cpu number for a sparse allocation */
+ ret = snprintf(path, PATH_MAX, "%s/devices/system/cpu/present", mnt);
+- if (ret == PATH_MAX) {
++ if (ret >= PATH_MAX) {
+ pr_err("sysfs path crossed PATH_MAX(%d) size\n", PATH_MAX);
+ goto out;
+ }
+@@ -501,7 +501,7 @@ static void set_max_node_num(void)
+
+ /* get the highest possible cpu number for a sparse allocation */
+ ret = snprintf(path, PATH_MAX, "%s/devices/system/node/possible", mnt);
+- if (ret == PATH_MAX) {
++ if (ret >= PATH_MAX) {
+ pr_err("sysfs path crossed PATH_MAX(%d) size\n", PATH_MAX);
+ goto out;
+ }
+@@ -586,7 +586,7 @@ int cpu__setup_cpunode_map(void)
+ return 0;
+
+ n = snprintf(path, PATH_MAX, "%s/devices/system/node", mnt);
+- if (n == PATH_MAX) {
++ if (n >= PATH_MAX) {
+ pr_err("sysfs path crossed PATH_MAX(%d) size\n", PATH_MAX);
+ return -1;
+ }
+@@ -601,7 +601,7 @@ int cpu__setup_cpunode_map(void)
+ continue;
+
+ n = snprintf(buf, PATH_MAX, "%s/%s", path, dent1->d_name);
+- if (n == PATH_MAX) {
++ if (n >= PATH_MAX) {
+ pr_err("sysfs path crossed PATH_MAX(%d) size\n", PATH_MAX);
+ continue;
+ }
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 4fad92213609f..11a2aa80802d5 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -1290,6 +1290,9 @@ void perf_evsel__exit(struct perf_evsel *evsel)
+ thread_map__put(evsel->threads);
+ zfree(&evsel->group_name);
+ zfree(&evsel->name);
++ zfree(&evsel->pmu_name);
++ zfree(&evsel->per_pkg_mask);
++ zfree(&evsel->metric_events);
+ perf_evsel__object.fini(evsel);
+ }
+
+diff --git a/tools/perf/util/mem2node.c b/tools/perf/util/mem2node.c
+index c6fd81c025863..81c5a2e438b7d 100644
+--- a/tools/perf/util/mem2node.c
++++ b/tools/perf/util/mem2node.c
+@@ -1,5 +1,6 @@
+ #include <errno.h>
+ #include <inttypes.h>
++#include <asm/bug.h>
+ #include <linux/bitmap.h>
+ #include "mem2node.h"
+ #include "util.h"
+@@ -92,7 +93,7 @@ int mem2node__init(struct mem2node *map, struct perf_env *env)
+
+ /* Cut unused entries, due to merging. */
+ tmp_entries = realloc(entries, sizeof(*entries) * j);
+- if (tmp_entries)
++ if (tmp_entries || WARN_ON_ONCE(j == 0))
+ entries = tmp_entries;
+
+ for (i = 0; i < j; i++) {
+diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c
+index 8b3dafe3fac3a..6dcc6e1182a54 100644
+--- a/tools/perf/util/metricgroup.c
++++ b/tools/perf/util/metricgroup.c
+@@ -171,6 +171,7 @@ static int metricgroup__setup_events(struct list_head *groups,
+ if (!evsel) {
+ pr_debug("Cannot resolve %s: %s\n",
+ eg->metric_name, eg->metric_expr);
++ free(metric_events);
+ continue;
+ }
+ for (i = 0; i < eg->idnum; i++)
+@@ -178,11 +179,13 @@ static int metricgroup__setup_events(struct list_head *groups,
+ me = metricgroup__lookup(metric_events_list, evsel, true);
+ if (!me) {
+ ret = -ENOMEM;
++ free(metric_events);
+ break;
+ }
+ expr = malloc(sizeof(struct metric_expr));
+ if (!expr) {
+ ret = -ENOMEM;
++ free(metric_events);
+ break;
+ }
+ expr->metric_expr = eg->metric_expr;
+diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
+index 95043cae57740..0eff0c3ba9eeb 100644
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -1261,7 +1261,7 @@ int parse_events_add_pmu(struct parse_events_state *parse_state,
+ attr.type = pmu->type;
+ evsel = __add_event(list, &parse_state->idx, &attr, NULL, pmu, NULL, auto_merge_stats);
+ if (evsel) {
+- evsel->pmu_name = name;
++ evsel->pmu_name = name ? strdup(name) : NULL;
+ evsel->use_uncore_alias = use_uncore_alias;
+ return 0;
+ } else {
+@@ -1302,7 +1302,7 @@ int parse_events_add_pmu(struct parse_events_state *parse_state,
+ evsel->snapshot = info.snapshot;
+ evsel->metric_expr = info.metric_expr;
+ evsel->metric_name = info.metric_name;
+- evsel->pmu_name = name;
++ evsel->pmu_name = name ? strdup(name) : NULL;
+ evsel->use_uncore_alias = use_uncore_alias;
+ }
+
+@@ -1421,12 +1421,11 @@ parse_events__set_leader_for_uncore_aliase(char *name, struct list_head *list,
+ * event. That can be used to distinguish the leader from
+ * other members, even they have the same event name.
+ */
+- if ((leader != evsel) && (leader->pmu_name == evsel->pmu_name)) {
++ if ((leader != evsel) &&
++ !strcmp(leader->pmu_name, evsel->pmu_name)) {
+ is_leader = false;
+ continue;
+ }
+- /* The name is always alias name */
+- WARN_ON(strcmp(leader->name, evsel->name));
+
+ /* Store the leader event for each PMU */
+ leaders[nr_pmu++] = (uintptr_t) evsel;
+diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
+index 46daa22b86e3b..85ff4f68adc00 100644
+--- a/tools/perf/util/sort.c
++++ b/tools/perf/util/sort.c
+@@ -2690,7 +2690,7 @@ static char *prefix_if_not_in(const char *pre, char *str)
+ return str;
+
+ if (asprintf(&n, "%s,%s", pre, str) < 0)
+- return NULL;
++ n = NULL;
+
+ free(str);
+ return n;
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index a701a8a48f005..166c621e02235 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1421,6 +1421,7 @@ struct kcore_copy_info {
+ u64 first_symbol;
+ u64 last_symbol;
+ u64 first_module;
++ u64 first_module_symbol;
+ u64 last_module_symbol;
+ size_t phnum;
+ struct list_head phdrs;
+@@ -1497,6 +1498,8 @@ static int kcore_copy__process_kallsyms(void *arg, const char *name, char type,
+ return 0;
+
+ if (strchr(name, '[')) {
++ if (!kci->first_module_symbol || start < kci->first_module_symbol)
++ kci->first_module_symbol = start;
+ if (start > kci->last_module_symbol)
+ kci->last_module_symbol = start;
+ return 0;
+@@ -1694,6 +1697,10 @@ static int kcore_copy__calc_maps(struct kcore_copy_info *kci, const char *dir,
+ kci->etext += page_size;
+ }
+
++ if (kci->first_module_symbol &&
++ (!kci->first_module || kci->first_module_symbol < kci->first_module))
++ kci->first_module = kci->first_module_symbol;
++
+ kci->first_module = round_down(kci->first_module, page_size);
+
+ if (kci->last_module_symbol) {
+diff --git a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
+index 2fa3c5757bcb5..dbed3d213bf17 100755
+--- a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
++++ b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
+@@ -10,11 +10,11 @@ then this utility enables and collects trace data for a user specified interval
+ and generates performance plots.
+
+ Prerequisites:
+- Python version 2.7.x
++ Python version 2.7.x or higher
+ gnuplot 5.0 or higher
+- gnuplot-py 1.8
++ gnuplot-py 1.8 or higher
+ (Most of the distributions have these required packages. They may be called
+- gnuplot-py, phython-gnuplot. )
++ gnuplot-py, phython-gnuplot or phython3-gnuplot, gnuplot-nox, ... )
+
+ HWP (Hardware P-States are disabled)
+ Kernel config for Linux trace is enabled
+@@ -180,7 +180,7 @@ def plot_pstate_cpu_with_sample():
+ g_plot('set xlabel "Samples"')
+ g_plot('set ylabel "P-State"')
+ g_plot('set title "{} : cpu pstate vs. sample : {:%F %H:%M}"'.format(testname, datetime.now()))
+- title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++ title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+ plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_SAMPLE, C_TO)
+ g_plot('title_list = "{}"'.format(title_list))
+ g_plot(plot_str)
+@@ -197,7 +197,7 @@ def plot_pstate_cpu():
+ # the following command is really cool, but doesn't work with the CPU masking option because it aborts on the first missing file.
+ # plot_str = 'plot for [i=0:*] file=sprintf("cpu%03d.csv",i) title_s=sprintf("cpu%03d",i) file using 16:7 pt 7 ps 1 title title_s'
+ #
+- title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++ title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+ plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_TO)
+ g_plot('title_list = "{}"'.format(title_list))
+ g_plot(plot_str)
+@@ -211,7 +211,7 @@ def plot_load_cpu():
+ g_plot('set ylabel "CPU load (percent)"')
+ g_plot('set title "{} : cpu loads : {:%F %H:%M}"'.format(testname, datetime.now()))
+
+- title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++ title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+ plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_LOAD)
+ g_plot('title_list = "{}"'.format(title_list))
+ g_plot(plot_str)
+@@ -225,7 +225,7 @@ def plot_frequency_cpu():
+ g_plot('set ylabel "CPU Frequency (GHz)"')
+ g_plot('set title "{} : cpu frequencies : {:%F %H:%M}"'.format(testname, datetime.now()))
+
+- title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++ title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+ plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_FREQ)
+ g_plot('title_list = "{}"'.format(title_list))
+ g_plot(plot_str)
+@@ -240,7 +240,7 @@ def plot_duration_cpu():
+ g_plot('set ylabel "Timer Duration (MilliSeconds)"')
+ g_plot('set title "{} : cpu durations : {:%F %H:%M}"'.format(testname, datetime.now()))
+
+- title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++ title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+ plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_DURATION)
+ g_plot('title_list = "{}"'.format(title_list))
+ g_plot(plot_str)
+@@ -254,7 +254,7 @@ def plot_scaled_cpu():
+ g_plot('set ylabel "Scaled Busy (Unitless)"')
+ g_plot('set title "{} : cpu scaled busy : {:%F %H:%M}"'.format(testname, datetime.now()))
+
+- title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++ title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+ plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_SCALED)
+ g_plot('title_list = "{}"'.format(title_list))
+ g_plot(plot_str)
+@@ -268,7 +268,7 @@ def plot_boost_cpu():
+ g_plot('set ylabel "CPU IO Boost (percent)"')
+ g_plot('set title "{} : cpu io boost : {:%F %H:%M}"'.format(testname, datetime.now()))
+
+- title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++ title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+ plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_BOOST)
+ g_plot('title_list = "{}"'.format(title_list))
+ g_plot(plot_str)
+@@ -282,7 +282,7 @@ def plot_ghz_cpu():
+ g_plot('set ylabel "TSC Frequency (GHz)"')
+ g_plot('set title "{} : cpu TSC Frequencies (Sanity check calculation) : {:%F %H:%M}"'.format(testname, datetime.now()))
+
+- title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++ title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+ plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_GHZ)
+ g_plot('title_list = "{}"'.format(title_list))
+ g_plot(plot_str)
+diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
+index 27a54a17da65d..f4e92afab14b2 100644
+--- a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
+@@ -30,7 +30,7 @@ ftrace_filter_check '*schedule*' '^.*schedule.*$'
+ ftrace_filter_check 'schedule*' '^schedule.*$'
+
+ # filter by *mid*end
+-ftrace_filter_check '*aw*lock' '.*aw.*lock$'
++ftrace_filter_check '*pin*lock' '.*pin.*lock$'
+
+ # filter by start*mid*
+ ftrace_filter_check 'mutex*try*' '^mutex.*try.*'
+diff --git a/tools/testing/selftests/x86/syscall_nt.c b/tools/testing/selftests/x86/syscall_nt.c
+index 43fcab367fb0a..74e6b3fc2d09e 100644
+--- a/tools/testing/selftests/x86/syscall_nt.c
++++ b/tools/testing/selftests/x86/syscall_nt.c
+@@ -67,6 +67,7 @@ static void do_it(unsigned long extraflags)
+ set_eflags(get_eflags() | extraflags);
+ syscall(SYS_getpid);
+ flags = get_eflags();
++ set_eflags(X86_EFLAGS_IF | X86_EFLAGS_FIXED);
+ if ((flags & extraflags) == extraflags) {
+ printf("[OK]\tThe syscall worked and flags are still set\n");
+ } else {
+diff --git a/virt/kvm/arm/mmio.c b/virt/kvm/arm/mmio.c
+index 878e0edb2e1b7..ff0a1c6083718 100644
+--- a/virt/kvm/arm/mmio.c
++++ b/virt/kvm/arm/mmio.c
+@@ -142,7 +142,7 @@ static int decode_hsr(struct kvm_vcpu *vcpu, bool *is_write, int *len)
+ bool sign_extend;
+ bool sixty_four;
+
+- if (kvm_vcpu_dabt_iss1tw(vcpu)) {
++ if (kvm_vcpu_abt_iss1tw(vcpu)) {
+ /* page table accesses IO mem: tell guest to fix its TTBR */
+ kvm_inject_dabt(vcpu, kvm_vcpu_get_hfar(vcpu));
+ return 1;
+diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
+index 41d6285c3da99..787f7329d1b7f 100644
+--- a/virt/kvm/arm/mmu.c
++++ b/virt/kvm/arm/mmu.c
+@@ -1282,6 +1282,9 @@ static bool transparent_hugepage_adjust(kvm_pfn_t *pfnp, phys_addr_t *ipap)
+
+ static bool kvm_is_write_fault(struct kvm_vcpu *vcpu)
+ {
++ if (kvm_vcpu_abt_iss1tw(vcpu))
++ return true;
++
+ if (kvm_vcpu_trap_is_iabt(vcpu))
+ return false;
+
+@@ -1496,7 +1499,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
+ unsigned long flags = 0;
+
+ write_fault = kvm_is_write_fault(vcpu);
+- exec_fault = kvm_vcpu_trap_is_iabt(vcpu);
++ exec_fault = kvm_vcpu_trap_is_exec_fault(vcpu);
+ VM_BUG_ON(write_fault && exec_fault);
+
+ if (fault_status == FSC_PERM && !write_fault && !exec_fault) {
+diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
+index cd75df25fe140..2fc1777da50d2 100644
+--- a/virt/kvm/arm/vgic/vgic-init.c
++++ b/virt/kvm/arm/vgic/vgic-init.c
+@@ -187,6 +187,7 @@ static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis)
+ break;
+ default:
+ kfree(dist->spis);
++ dist->spis = NULL;
+ return -EINVAL;
+ }
+ }
+diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
+index 9295addea7ecf..f139b1c62ca38 100644
+--- a/virt/kvm/arm/vgic/vgic-its.c
++++ b/virt/kvm/arm/vgic/vgic-its.c
+@@ -107,14 +107,21 @@ out_unlock:
+ * We "cache" the configuration table entries in our struct vgic_irq's.
+ * However we only have those structs for mapped IRQs, so we read in
+ * the respective config data from memory here upon mapping the LPI.
++ *
++ * Should any of these fail, behave as if we couldn't create the LPI
++ * by dropping the refcount and returning the error.
+ */
+ ret = update_lpi_config(kvm, irq, NULL, false);
+- if (ret)
++ if (ret) {
++ vgic_put_irq(kvm, irq);
+ return ERR_PTR(ret);
++ }
+
+ ret = vgic_v3_lpi_sync_pending_status(kvm, irq);
+- if (ret)
++ if (ret) {
++ vgic_put_irq(kvm, irq);
+ return ERR_PTR(ret);
++ }
+
+ return irq;
+ }
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 6bd01d12df2ec..9312c7e750ed3 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -169,6 +169,7 @@ bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
+ */
+ if (pfn_valid(pfn))
+ return PageReserved(pfn_to_page(pfn)) &&
++ !is_zero_pfn(pfn) &&
+ !kvm_is_zone_device_pfn(pfn);
+
+ return true;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-10-07 12:50 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-10-07 12:50 UTC (permalink / raw
To: gentoo-commits
commit: acb7e192c86b3b4470f10c8245b744d7947a1982
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 7 12:50:11 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Oct 7 12:50:11 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=acb7e192
Linux patch 4.19.150
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1149_linux-4.19.150.patch | 1698 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1702 insertions(+)
diff --git a/0000_README b/0000_README
index e7a8587..47aa030 100644
--- a/0000_README
+++ b/0000_README
@@ -635,6 +635,10 @@ Patch: 1148_linux-4.19.149.patch
From: https://www.kernel.org
Desc: Linux 4.19.149
+Patch: 1149_linux-4.19.150.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.150
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1149_linux-4.19.150.patch b/1149_linux-4.19.150.patch
new file mode 100644
index 0000000..adccde0
--- /dev/null
+++ b/1149_linux-4.19.150.patch
@@ -0,0 +1,1698 @@
+diff --git a/Makefile b/Makefile
+index 3ff5cf33ef55c..65485185bec29 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 149
++SUBLEVEL = 150
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
+index 79e5cc70f1fdd..561e2573bd34c 100644
+--- a/arch/ia64/mm/init.c
++++ b/arch/ia64/mm/init.c
+@@ -499,7 +499,7 @@ virtual_memmap_init(u64 start, u64 end, void *arg)
+ if (map_start < map_end)
+ memmap_init_zone((unsigned long)(map_end - map_start),
+ args->nid, args->zone, page_to_pfn(map_start),
+- MEMMAP_EARLY, NULL);
++ MEMINIT_EARLY, NULL);
+ return 0;
+ }
+
+@@ -508,8 +508,8 @@ memmap_init (unsigned long size, int nid, unsigned long zone,
+ unsigned long start_pfn)
+ {
+ if (!vmem_map) {
+- memmap_init_zone(size, nid, zone, start_pfn, MEMMAP_EARLY,
+- NULL);
++ memmap_init_zone(size, nid, zone, start_pfn,
++ MEMINIT_EARLY, NULL);
+ } else {
+ struct page *start;
+ struct memmap_init_callback_data args;
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index f3565c2dbc527..503e2f90e58ef 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -403,10 +403,32 @@ static int __ref get_nid_for_pfn(unsigned long pfn)
+ return pfn_to_nid(pfn);
+ }
+
++static int do_register_memory_block_under_node(int nid,
++ struct memory_block *mem_blk)
++{
++ int ret;
++
++ /*
++ * If this memory block spans multiple nodes, we only indicate
++ * the last processed node.
++ */
++ mem_blk->nid = nid;
++
++ ret = sysfs_create_link_nowarn(&node_devices[nid]->dev.kobj,
++ &mem_blk->dev.kobj,
++ kobject_name(&mem_blk->dev.kobj));
++ if (ret)
++ return ret;
++
++ return sysfs_create_link_nowarn(&mem_blk->dev.kobj,
++ &node_devices[nid]->dev.kobj,
++ kobject_name(&node_devices[nid]->dev.kobj));
++}
++
+ /* register memory section under specified node if it spans that node */
+-int register_mem_sect_under_node(struct memory_block *mem_blk, void *arg)
++int register_mem_block_under_node_early(struct memory_block *mem_blk, void *arg)
+ {
+- int ret, nid = *(int *)arg;
++ int nid = *(int *)arg;
+ unsigned long pfn, sect_start_pfn, sect_end_pfn;
+
+ sect_start_pfn = section_nr_to_pfn(mem_blk->start_section_nr);
+@@ -426,38 +448,33 @@ int register_mem_sect_under_node(struct memory_block *mem_blk, void *arg)
+ }
+
+ /*
+- * We need to check if page belongs to nid only for the boot
+- * case, during hotplug we know that all pages in the memory
+- * block belong to the same node.
+- */
+- if (system_state == SYSTEM_BOOTING) {
+- page_nid = get_nid_for_pfn(pfn);
+- if (page_nid < 0)
+- continue;
+- if (page_nid != nid)
+- continue;
+- }
+-
+- /*
+- * If this memory block spans multiple nodes, we only indicate
+- * the last processed node.
++ * We need to check if page belongs to nid only at the boot
++ * case because node's ranges can be interleaved.
+ */
+- mem_blk->nid = nid;
+-
+- ret = sysfs_create_link_nowarn(&node_devices[nid]->dev.kobj,
+- &mem_blk->dev.kobj,
+- kobject_name(&mem_blk->dev.kobj));
+- if (ret)
+- return ret;
++ page_nid = get_nid_for_pfn(pfn);
++ if (page_nid < 0)
++ continue;
++ if (page_nid != nid)
++ continue;
+
+- return sysfs_create_link_nowarn(&mem_blk->dev.kobj,
+- &node_devices[nid]->dev.kobj,
+- kobject_name(&node_devices[nid]->dev.kobj));
++ return do_register_memory_block_under_node(nid, mem_blk);
+ }
+ /* mem section does not span the specified node */
+ return 0;
+ }
+
++/*
++ * During hotplug we know that all pages in the memory block belong to the same
++ * node.
++ */
++static int register_mem_block_under_node_hotplug(struct memory_block *mem_blk,
++ void *arg)
++{
++ int nid = *(int *)arg;
++
++ return do_register_memory_block_under_node(nid, mem_blk);
++}
++
+ /*
+ * Unregister a memory block device under the node it spans. Memory blocks
+ * with multiple nodes cannot be offlined and therefore also never be removed.
+@@ -473,10 +490,17 @@ void unregister_memory_block_under_nodes(struct memory_block *mem_blk)
+ kobject_name(&node_devices[mem_blk->nid]->dev.kobj));
+ }
+
+-int link_mem_sections(int nid, unsigned long start_pfn, unsigned long end_pfn)
++int link_mem_sections(int nid, unsigned long start_pfn, unsigned long end_pfn,
++ enum meminit_context context)
+ {
+- return walk_memory_range(start_pfn, end_pfn, (void *)&nid,
+- register_mem_sect_under_node);
++ walk_memory_blocks_func_t func;
++
++ if (context == MEMINIT_HOTPLUG)
++ func = register_mem_block_under_node_hotplug;
++ else
++ func = register_mem_block_under_node_early;
++
++ return walk_memory_range(start_pfn, end_pfn, (void *)&nid, func);
+ }
+
+ #ifdef CONFIG_HUGETLBFS
+diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
+index 442309b569203..8086756e7f076 100644
+--- a/drivers/clk/samsung/clk-exynos4.c
++++ b/drivers/clk/samsung/clk-exynos4.c
+@@ -1072,7 +1072,7 @@ static const struct samsung_gate_clock exynos4210_gate_clks[] __initconst = {
+ GATE(CLK_PCIE, "pcie", "aclk133", GATE_IP_FSYS, 14, 0, 0),
+ GATE(CLK_SMMU_PCIE, "smmu_pcie", "aclk133", GATE_IP_FSYS, 18, 0, 0),
+ GATE(CLK_MODEMIF, "modemif", "aclk100", GATE_IP_PERIL, 28, 0, 0),
+- GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, 0, 0),
++ GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0),
+ GATE(CLK_SYSREG, "sysreg", "aclk100", E4210_GATE_IP_PERIR, 0,
+ CLK_IGNORE_UNUSED, 0),
+ GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4210_GATE_IP_PERIR, 11, 0,
+@@ -1113,7 +1113,7 @@ static const struct samsung_gate_clock exynos4x12_gate_clks[] __initconst = {
+ 0),
+ GATE(CLK_TSADC, "tsadc", "aclk133", E4X12_GATE_BUS_FSYS1, 16, 0, 0),
+ GATE(CLK_MIPI_HSI, "mipi_hsi", "aclk133", GATE_IP_FSYS, 10, 0, 0),
+- GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, 0, 0),
++ GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0),
+ GATE(CLK_SYSREG, "sysreg", "aclk100", E4X12_GATE_IP_PERIR, 1,
+ CLK_IGNORE_UNUSED, 0),
+ GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4X12_GATE_IP_PERIR, 11, 0,
+diff --git a/drivers/clk/socfpga/clk-s10.c b/drivers/clk/socfpga/clk-s10.c
+index 5bed36e129516..7327e90735c89 100644
+--- a/drivers/clk/socfpga/clk-s10.c
++++ b/drivers/clk/socfpga/clk-s10.c
+@@ -107,7 +107,7 @@ static const struct stratix10_perip_cnt_clock s10_main_perip_cnt_clks[] = {
+ { STRATIX10_EMAC_B_FREE_CLK, "emacb_free_clk", NULL, emacb_free_mux, ARRAY_SIZE(emacb_free_mux),
+ 0, 0, 2, 0xB0, 1},
+ { STRATIX10_EMAC_PTP_FREE_CLK, "emac_ptp_free_clk", NULL, emac_ptp_free_mux,
+- ARRAY_SIZE(emac_ptp_free_mux), 0, 0, 4, 0xB0, 2},
++ ARRAY_SIZE(emac_ptp_free_mux), 0, 0, 2, 0xB0, 2},
+ { STRATIX10_GPIO_DB_FREE_CLK, "gpio_db_free_clk", NULL, gpio_db_free_mux,
+ ARRAY_SIZE(gpio_db_free_mux), 0, 0, 0, 0xB0, 3},
+ { STRATIX10_SDMMC_FREE_CLK, "sdmmc_free_clk", NULL, sdmmc_free_mux,
+diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
+index 945bd13e5e791..cab324eb7df24 100644
+--- a/drivers/gpio/gpio-mockup.c
++++ b/drivers/gpio/gpio-mockup.c
+@@ -367,6 +367,7 @@ static int __init gpio_mockup_init(void)
+ err = platform_driver_register(&gpio_mockup_driver);
+ if (err) {
+ gpio_mockup_err("error registering platform driver\n");
++ debugfs_remove_recursive(gpio_mockup_dbg_dir);
+ return err;
+ }
+
+@@ -386,6 +387,7 @@ static int __init gpio_mockup_init(void)
+ gpio_mockup_err("error registering device");
+ platform_driver_unregister(&gpio_mockup_driver);
+ gpio_mockup_unregister_pdevs();
++ debugfs_remove_recursive(gpio_mockup_dbg_dir);
+ return PTR_ERR(pdev);
+ }
+
+diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c
+index 55072d2b367fa..4d53347adcafa 100644
+--- a/drivers/gpio/gpio-sprd.c
++++ b/drivers/gpio/gpio-sprd.c
+@@ -149,17 +149,20 @@ static int sprd_gpio_irq_set_type(struct irq_data *data,
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IS, 0);
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IBE, 0);
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IEV, 1);
++ sprd_gpio_update(chip, offset, SPRD_GPIO_IC, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_EDGE_FALLING:
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IS, 0);
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IBE, 0);
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IEV, 0);
++ sprd_gpio_update(chip, offset, SPRD_GPIO_IC, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_EDGE_BOTH:
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IS, 0);
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IBE, 1);
++ sprd_gpio_update(chip, offset, SPRD_GPIO_IC, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_LEVEL_HIGH:
+diff --git a/drivers/gpio/gpio-tc3589x.c b/drivers/gpio/gpio-tc3589x.c
+index 91a8ef8e7f3fd..1436098b16149 100644
+--- a/drivers/gpio/gpio-tc3589x.c
++++ b/drivers/gpio/gpio-tc3589x.c
+@@ -209,7 +209,7 @@ static void tc3589x_gpio_irq_sync_unlock(struct irq_data *d)
+ continue;
+
+ tc3589x_gpio->oldregs[i][j] = new;
+- tc3589x_reg_write(tc3589x, regmap[i] + j * 8, new);
++ tc3589x_reg_write(tc3589x, regmap[i] + j, new);
+ }
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+index 049a1961c3fa5..5f85c9586cba1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+@@ -290,7 +290,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
+ take the current one */
+ if (active && !adev->have_disp_power_ref) {
+ adev->have_disp_power_ref = true;
+- goto out;
++ return ret;
+ }
+ /* if we have no active crtcs, then drop the power ref
+ we got before */
+diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.c b/drivers/gpu/drm/sun4i/sun8i_mixer.c
+index 71a798e5d5591..649b57e5e4b78 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c
+@@ -364,7 +364,7 @@ static struct regmap_config sun8i_mixer_regmap_config = {
+ .reg_bits = 32,
+ .val_bits = 32,
+ .reg_stride = 4,
+- .max_register = 0xbfffc, /* guessed */
++ .max_register = 0xffffc, /* guessed */
+ };
+
+ static int sun8i_mixer_of_get_id(struct device_node *node)
+diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
+index 8a8ca945561b0..7eba874a981d3 100644
+--- a/drivers/i2c/busses/i2c-cpm.c
++++ b/drivers/i2c/busses/i2c-cpm.c
+@@ -74,6 +74,9 @@ struct i2c_ram {
+ char res1[4]; /* Reserved */
+ ushort rpbase; /* Relocation pointer */
+ char res2[2]; /* Reserved */
++ /* The following elements are only for CPM2 */
++ char res3[4]; /* Reserved */
++ uint sdmatmp; /* Internal */
+ };
+
+ #define I2COM_START 0x80
+diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
+index 31c16b68aa311..e468657854094 100644
+--- a/drivers/input/mouse/trackpoint.c
++++ b/drivers/input/mouse/trackpoint.c
+@@ -285,6 +285,8 @@ static int trackpoint_start_protocol(struct psmouse *psmouse,
+ case TP_VARIANT_ALPS:
+ case TP_VARIANT_ELAN:
+ case TP_VARIANT_NXP:
++ case TP_VARIANT_JYT_SYNAPTICS:
++ case TP_VARIANT_SYNAPTICS:
+ if (variant_id)
+ *variant_id = param[0];
+ if (firmware_id)
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 7c05e09abacf9..51bd2ebaa342c 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -725,6 +725,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
+ },
+ },
++ {
++ /* Acer Aspire 5 A515 */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "Grumpy_PK"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "PK"),
++ },
++ },
+ { }
+ };
+
+diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
+index 1bd0cd7168dfc..4bf6049dd2c79 100644
+--- a/drivers/iommu/exynos-iommu.c
++++ b/drivers/iommu/exynos-iommu.c
+@@ -1302,13 +1302,17 @@ static int exynos_iommu_of_xlate(struct device *dev,
+ return -ENODEV;
+
+ data = platform_get_drvdata(sysmmu);
+- if (!data)
++ if (!data) {
++ put_device(&sysmmu->dev);
+ return -ENODEV;
++ }
+
+ if (!owner) {
+ owner = kzalloc(sizeof(*owner), GFP_KERNEL);
+- if (!owner)
++ if (!owner) {
++ put_device(&sysmmu->dev);
+ return -ENOMEM;
++ }
+
+ INIT_LIST_HEAD(&owner->controllers);
+ mutex_init(&owner->rpm_lock);
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index 35168b47afe6c..a411300f9d6dc 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -739,7 +739,8 @@ static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot)
+ static bool glk_broken_cqhci(struct sdhci_pci_slot *slot)
+ {
+ return slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC &&
+- dmi_match(DMI_BIOS_VENDOR, "LENOVO");
++ (dmi_match(DMI_BIOS_VENDOR, "LENOVO") ||
++ dmi_match(DMI_SYS_VENDOR, "IRBIS"));
+ }
+
+ static int glk_emmc_probe_slot(struct sdhci_pci_slot *slot)
+diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c
+index 13430f75496cc..b312cd9bce169 100644
+--- a/drivers/net/ethernet/dec/tulip/de2104x.c
++++ b/drivers/net/ethernet/dec/tulip/de2104x.c
+@@ -91,7 +91,7 @@ MODULE_PARM_DESC (rx_copybreak, "de2104x Breakpoint at which Rx packets are copi
+ #define DSL CONFIG_DE2104X_DSL
+ #endif
+
+-#define DE_RX_RING_SIZE 64
++#define DE_RX_RING_SIZE 128
+ #define DE_TX_RING_SIZE 64
+ #define DE_RING_BYTES \
+ ((sizeof(struct de_desc) * DE_RX_RING_SIZE) + \
+diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
+index b807c91abe1da..a22ae3137a3f8 100644
+--- a/drivers/net/usb/rndis_host.c
++++ b/drivers/net/usb/rndis_host.c
+@@ -213,7 +213,7 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen)
+ dev_dbg(&info->control->dev,
+ "rndis response error, code %d\n", retval);
+ }
+- msleep(20);
++ msleep(40);
+ }
+ dev_dbg(&info->control->dev, "rndis response timeout\n");
+ return -ETIMEDOUT;
+diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
+index c169a26e5359a..2c6e3fa6947a0 100644
+--- a/drivers/net/wan/hdlc_cisco.c
++++ b/drivers/net/wan/hdlc_cisco.c
+@@ -121,6 +121,7 @@ static void cisco_keepalive_send(struct net_device *dev, u32 type,
+ skb_put(skb, sizeof(struct cisco_packet));
+ skb->priority = TC_PRIO_CONTROL;
+ skb->dev = dev;
++ skb->protocol = htons(ETH_P_HDLC);
+ skb_reset_network_header(skb);
+
+ dev_queue_xmit(skb);
+diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
+index 038236a9c60ee..03b5f5cce6f47 100644
+--- a/drivers/net/wan/hdlc_fr.c
++++ b/drivers/net/wan/hdlc_fr.c
+@@ -436,6 +436,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (pvc->state.fecn) /* TX Congestion counter */
+ dev->stats.tx_compressed++;
+ skb->dev = pvc->frad;
++ skb->protocol = htons(ETH_P_HDLC);
++ skb_reset_network_header(skb);
+ dev_queue_xmit(skb);
+ return NETDEV_TX_OK;
+ }
+@@ -558,6 +560,7 @@ static void fr_lmi_send(struct net_device *dev, int fullrep)
+ skb_put(skb, i);
+ skb->priority = TC_PRIO_CONTROL;
+ skb->dev = dev;
++ skb->protocol = htons(ETH_P_HDLC);
+ skb_reset_network_header(skb);
+
+ dev_queue_xmit(skb);
+@@ -1044,7 +1047,7 @@ static void pvc_setup(struct net_device *dev)
+ {
+ dev->type = ARPHRD_DLCI;
+ dev->flags = IFF_POINTOPOINT;
+- dev->hard_header_len = 10;
++ dev->hard_header_len = 0;
+ dev->addr_len = 2;
+ netif_keep_dst(dev);
+ }
+@@ -1096,6 +1099,7 @@ static int fr_add_pvc(struct net_device *frad, unsigned int dlci, int type)
+ dev->mtu = HDLC_MAX_MTU;
+ dev->min_mtu = 68;
+ dev->max_mtu = HDLC_MAX_MTU;
++ dev->needed_headroom = 10;
+ dev->priv_flags |= IFF_NO_QUEUE;
+ dev->ml_priv = pvc;
+
+diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
+index 85844f26547dd..20d9b6585fba3 100644
+--- a/drivers/net/wan/hdlc_ppp.c
++++ b/drivers/net/wan/hdlc_ppp.c
+@@ -254,6 +254,7 @@ static void ppp_tx_cp(struct net_device *dev, u16 pid, u8 code,
+
+ skb->priority = TC_PRIO_CONTROL;
+ skb->dev = dev;
++ skb->protocol = htons(ETH_P_HDLC);
+ skb_reset_network_header(skb);
+ skb_queue_tail(&tx_queue, skb);
+ }
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 15177a54b17d7..e5fc1b95cea6a 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -201,8 +201,6 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
+ struct net_device *dev;
+ int size = skb->len;
+
+- skb->protocol = htons(ETH_P_X25);
+-
+ ptr = skb_push(skb, 2);
+
+ *ptr++ = size % 256;
+@@ -213,6 +211,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
+
+ skb->dev = dev = lapbeth->ethdev;
+
++ skb->protocol = htons(ETH_P_DEC);
++
+ skb_reset_network_header(skb);
+
+ dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0);
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 33dad9774da01..9ea3d8e611005 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2605,10 +2605,24 @@ static int nvme_dev_open(struct inode *inode, struct file *file)
+ return -EWOULDBLOCK;
+ }
+
++ nvme_get_ctrl(ctrl);
++ if (!try_module_get(ctrl->ops->module))
++ return -EINVAL;
++
+ file->private_data = ctrl;
+ return 0;
+ }
+
++static int nvme_dev_release(struct inode *inode, struct file *file)
++{
++ struct nvme_ctrl *ctrl =
++ container_of(inode->i_cdev, struct nvme_ctrl, cdev);
++
++ module_put(ctrl->ops->module);
++ nvme_put_ctrl(ctrl);
++ return 0;
++}
++
+ static int nvme_dev_user_cmd(struct nvme_ctrl *ctrl, void __user *argp)
+ {
+ struct nvme_ns *ns;
+@@ -2669,6 +2683,7 @@ static long nvme_dev_ioctl(struct file *file, unsigned int cmd,
+ static const struct file_operations nvme_dev_fops = {
+ .owner = THIS_MODULE,
+ .open = nvme_dev_open,
++ .release = nvme_dev_release,
+ .unlocked_ioctl = nvme_dev_ioctl,
+ .compat_ioctl = nvme_dev_ioctl,
+ };
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 73db32f97abf3..ed88d50217724 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3294,12 +3294,14 @@ nvme_fc_create_ctrl(struct device *dev, struct nvmf_ctrl_options *opts)
+ spin_lock_irqsave(&nvme_fc_lock, flags);
+ list_for_each_entry(lport, &nvme_fc_lport_list, port_list) {
+ if (lport->localport.node_name != laddr.nn ||
+- lport->localport.port_name != laddr.pn)
++ lport->localport.port_name != laddr.pn ||
++ lport->localport.port_state != FC_OBJSTATE_ONLINE)
+ continue;
+
+ list_for_each_entry(rport, &lport->endp_list, endp_list) {
+ if (rport->remoteport.node_name != raddr.nn ||
+- rport->remoteport.port_name != raddr.pn)
++ rport->remoteport.port_name != raddr.pn ||
++ rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
+ continue;
+
+ /* if fail to get reference fall through. Will error */
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+index 43231fd065a18..1a9450ef932b5 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+@@ -418,7 +418,7 @@ static struct mvebu_mpp_mode mv98dx3236_mpp_modes[] = {
+ MPP_VAR_FUNCTION(0x1, "i2c0", "sck", V_98DX3236_PLUS)),
+ MPP_MODE(15,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_98DX3236_PLUS),
+- MPP_VAR_FUNCTION(0x4, "i2c0", "sda", V_98DX3236_PLUS)),
++ MPP_VAR_FUNCTION(0x1, "i2c0", "sda", V_98DX3236_PLUS)),
+ MPP_MODE(16,
+ MPP_VAR_FUNCTION(0x0, "gpo", NULL, V_98DX3236_PLUS),
+ MPP_VAR_FUNCTION(0x4, "dev", "oe", V_98DX3236_PLUS)),
+diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c
+index 1e8ff6256079f..b8dd75b8518b5 100644
+--- a/drivers/spi/spi-fsl-espi.c
++++ b/drivers/spi/spi-fsl-espi.c
+@@ -559,13 +559,14 @@ static void fsl_espi_cpu_irq(struct fsl_espi *espi, u32 events)
+ static irqreturn_t fsl_espi_irq(s32 irq, void *context_data)
+ {
+ struct fsl_espi *espi = context_data;
+- u32 events;
++ u32 events, mask;
+
+ spin_lock(&espi->lock);
+
+ /* Get interrupt events(tx/rx) */
+ events = fsl_espi_read_reg(espi, ESPI_SPIE);
+- if (!events) {
++ mask = fsl_espi_read_reg(espi, ESPI_SPIM);
++ if (!(events & mask)) {
+ spin_unlock(&espi->lock);
+ return IRQ_NONE;
+ }
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index 8d8c81d430694..e2eefdd8bf786 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1192,7 +1192,6 @@ static int ncm_unwrap_ntb(struct gether *port,
+ const struct ndp_parser_opts *opts = ncm->parser_opts;
+ unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
+ int dgram_counter;
+- bool ndp_after_header;
+
+ /* dwSignature */
+ if (get_unaligned_le32(tmp) != opts->nth_sign) {
+@@ -1219,7 +1218,6 @@ static int ncm_unwrap_ntb(struct gether *port,
+ }
+
+ ndp_index = get_ncm(&tmp, opts->ndp_index);
+- ndp_after_header = false;
+
+ /* Run through all the NDP's in the NTB */
+ do {
+@@ -1235,8 +1233,6 @@ static int ncm_unwrap_ntb(struct gether *port,
+ ndp_index);
+ goto err;
+ }
+- if (ndp_index == opts->nth_size)
+- ndp_after_header = true;
+
+ /*
+ * walk through NDP
+@@ -1315,37 +1311,13 @@ static int ncm_unwrap_ntb(struct gether *port,
+ index2 = get_ncm(&tmp, opts->dgram_item_len);
+ dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
+
+- if (index2 == 0 || dg_len2 == 0)
+- break;
+-
+ /* wDatagramIndex[1] */
+- if (ndp_after_header) {
+- if (index2 < opts->nth_size + opts->ndp_size) {
+- INFO(port->func.config->cdev,
+- "Bad index: %#X\n", index2);
+- goto err;
+- }
+- } else {
+- if (index2 < opts->nth_size + opts->dpe_size) {
+- INFO(port->func.config->cdev,
+- "Bad index: %#X\n", index2);
+- goto err;
+- }
+- }
+ if (index2 > block_len - opts->dpe_size) {
+ INFO(port->func.config->cdev,
+ "Bad index: %#X\n", index2);
+ goto err;
+ }
+
+- /* wDatagramLength[1] */
+- if ((dg_len2 < 14 + crc_len) ||
+- (dg_len2 > frame_max)) {
+- INFO(port->func.config->cdev,
+- "Bad dgram length: %#X\n", dg_len);
+- goto err;
+- }
+-
+ /*
+ * Copy the data into a new skb.
+ * This ensures the truesize is correct
+@@ -1362,6 +1334,8 @@ static int ncm_unwrap_ntb(struct gether *port,
+ ndp_len -= 2 * (opts->dgram_item_len * 2);
+
+ dgram_counter++;
++ if (index2 == 0 || dg_len2 == 0)
++ break;
+ } while (ndp_len > 2 * (opts->dgram_item_len * 2));
+ } while (ndp_index);
+
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 7891bd40ebd82..6ee320259e4f7 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -383,6 +383,52 @@ static bool vhost_vsock_more_replies(struct vhost_vsock *vsock)
+ return val < vq->num;
+ }
+
++static struct virtio_transport vhost_transport = {
++ .transport = {
++ .get_local_cid = vhost_transport_get_local_cid,
++
++ .init = virtio_transport_do_socket_init,
++ .destruct = virtio_transport_destruct,
++ .release = virtio_transport_release,
++ .connect = virtio_transport_connect,
++ .shutdown = virtio_transport_shutdown,
++ .cancel_pkt = vhost_transport_cancel_pkt,
++
++ .dgram_enqueue = virtio_transport_dgram_enqueue,
++ .dgram_dequeue = virtio_transport_dgram_dequeue,
++ .dgram_bind = virtio_transport_dgram_bind,
++ .dgram_allow = virtio_transport_dgram_allow,
++
++ .stream_enqueue = virtio_transport_stream_enqueue,
++ .stream_dequeue = virtio_transport_stream_dequeue,
++ .stream_has_data = virtio_transport_stream_has_data,
++ .stream_has_space = virtio_transport_stream_has_space,
++ .stream_rcvhiwat = virtio_transport_stream_rcvhiwat,
++ .stream_is_active = virtio_transport_stream_is_active,
++ .stream_allow = virtio_transport_stream_allow,
++
++ .notify_poll_in = virtio_transport_notify_poll_in,
++ .notify_poll_out = virtio_transport_notify_poll_out,
++ .notify_recv_init = virtio_transport_notify_recv_init,
++ .notify_recv_pre_block = virtio_transport_notify_recv_pre_block,
++ .notify_recv_pre_dequeue = virtio_transport_notify_recv_pre_dequeue,
++ .notify_recv_post_dequeue = virtio_transport_notify_recv_post_dequeue,
++ .notify_send_init = virtio_transport_notify_send_init,
++ .notify_send_pre_block = virtio_transport_notify_send_pre_block,
++ .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue,
++ .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue,
++
++ .set_buffer_size = virtio_transport_set_buffer_size,
++ .set_min_buffer_size = virtio_transport_set_min_buffer_size,
++ .set_max_buffer_size = virtio_transport_set_max_buffer_size,
++ .get_buffer_size = virtio_transport_get_buffer_size,
++ .get_min_buffer_size = virtio_transport_get_min_buffer_size,
++ .get_max_buffer_size = virtio_transport_get_max_buffer_size,
++ },
++
++ .send_pkt = vhost_transport_send_pkt,
++};
++
+ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
+ {
+ struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue,
+@@ -439,7 +485,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
+ if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid &&
+ le64_to_cpu(pkt->hdr.dst_cid) ==
+ vhost_transport_get_local_cid())
+- virtio_transport_recv_pkt(pkt);
++ virtio_transport_recv_pkt(&vhost_transport, pkt);
+ else
+ virtio_transport_free_pkt(pkt);
+
+@@ -792,52 +838,6 @@ static struct miscdevice vhost_vsock_misc = {
+ .fops = &vhost_vsock_fops,
+ };
+
+-static struct virtio_transport vhost_transport = {
+- .transport = {
+- .get_local_cid = vhost_transport_get_local_cid,
+-
+- .init = virtio_transport_do_socket_init,
+- .destruct = virtio_transport_destruct,
+- .release = virtio_transport_release,
+- .connect = virtio_transport_connect,
+- .shutdown = virtio_transport_shutdown,
+- .cancel_pkt = vhost_transport_cancel_pkt,
+-
+- .dgram_enqueue = virtio_transport_dgram_enqueue,
+- .dgram_dequeue = virtio_transport_dgram_dequeue,
+- .dgram_bind = virtio_transport_dgram_bind,
+- .dgram_allow = virtio_transport_dgram_allow,
+-
+- .stream_enqueue = virtio_transport_stream_enqueue,
+- .stream_dequeue = virtio_transport_stream_dequeue,
+- .stream_has_data = virtio_transport_stream_has_data,
+- .stream_has_space = virtio_transport_stream_has_space,
+- .stream_rcvhiwat = virtio_transport_stream_rcvhiwat,
+- .stream_is_active = virtio_transport_stream_is_active,
+- .stream_allow = virtio_transport_stream_allow,
+-
+- .notify_poll_in = virtio_transport_notify_poll_in,
+- .notify_poll_out = virtio_transport_notify_poll_out,
+- .notify_recv_init = virtio_transport_notify_recv_init,
+- .notify_recv_pre_block = virtio_transport_notify_recv_pre_block,
+- .notify_recv_pre_dequeue = virtio_transport_notify_recv_pre_dequeue,
+- .notify_recv_post_dequeue = virtio_transport_notify_recv_post_dequeue,
+- .notify_send_init = virtio_transport_notify_send_init,
+- .notify_send_pre_block = virtio_transport_notify_send_pre_block,
+- .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue,
+- .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue,
+-
+- .set_buffer_size = virtio_transport_set_buffer_size,
+- .set_min_buffer_size = virtio_transport_set_min_buffer_size,
+- .set_max_buffer_size = virtio_transport_set_max_buffer_size,
+- .get_buffer_size = virtio_transport_get_buffer_size,
+- .get_min_buffer_size = virtio_transport_get_min_buffer_size,
+- .get_max_buffer_size = virtio_transport_get_max_buffer_size,
+- },
+-
+- .send_pkt = vhost_transport_send_pkt,
+-};
+-
+ static int __init vhost_vsock_init(void)
+ {
+ int ret;
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 61a52bb26d127..a4a32b79e8321 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -222,8 +222,7 @@ struct eventpoll {
+ struct file *file;
+
+ /* used to optimize loop detection check */
+- int visited;
+- struct list_head visited_list_link;
++ u64 gen;
+
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+ /* used to track busy poll napi_id */
+@@ -273,6 +272,8 @@ static long max_user_watches __read_mostly;
+ */
+ static DEFINE_MUTEX(epmutex);
+
++static u64 loop_check_gen = 0;
++
+ /* Used to check for epoll file descriptor inclusion loops */
+ static struct nested_calls poll_loop_ncalls;
+
+@@ -282,9 +283,6 @@ static struct kmem_cache *epi_cache __read_mostly;
+ /* Slab cache used to allocate "struct eppoll_entry" */
+ static struct kmem_cache *pwq_cache __read_mostly;
+
+-/* Visited nodes during ep_loop_check(), so we can unset them when we finish */
+-static LIST_HEAD(visited_list);
+-
+ /*
+ * List of files with newly added links, where we may need to limit the number
+ * of emanating paths. Protected by the epmutex.
+@@ -1378,7 +1376,7 @@ static int reverse_path_check(void)
+
+ static int ep_create_wakeup_source(struct epitem *epi)
+ {
+- const char *name;
++ struct name_snapshot n;
+ struct wakeup_source *ws;
+
+ if (!epi->ep->ws) {
+@@ -1387,8 +1385,9 @@ static int ep_create_wakeup_source(struct epitem *epi)
+ return -ENOMEM;
+ }
+
+- name = epi->ffd.file->f_path.dentry->d_name.name;
+- ws = wakeup_source_register(name);
++ take_dentry_name_snapshot(&n, epi->ffd.file->f_path.dentry);
++ ws = wakeup_source_register(n.name);
++ release_dentry_name_snapshot(&n);
+
+ if (!ws)
+ return -ENOMEM;
+@@ -1450,6 +1449,22 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event,
+ RCU_INIT_POINTER(epi->ws, NULL);
+ }
+
++ /* Add the current item to the list of active epoll hook for this file */
++ spin_lock(&tfile->f_lock);
++ list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links);
++ spin_unlock(&tfile->f_lock);
++
++ /*
++ * Add the current item to the RB tree. All RB tree operations are
++ * protected by "mtx", and ep_insert() is called with "mtx" held.
++ */
++ ep_rbtree_insert(ep, epi);
++
++ /* now check if we've created too many backpaths */
++ error = -EINVAL;
++ if (full_check && reverse_path_check())
++ goto error_remove_epi;
++
+ /* Initialize the poll table using the queue callback */
+ epq.epi = epi;
+ init_poll_funcptr(&epq.pt, ep_ptable_queue_proc);
+@@ -1472,22 +1487,6 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event,
+ if (epi->nwait < 0)
+ goto error_unregister;
+
+- /* Add the current item to the list of active epoll hook for this file */
+- spin_lock(&tfile->f_lock);
+- list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links);
+- spin_unlock(&tfile->f_lock);
+-
+- /*
+- * Add the current item to the RB tree. All RB tree operations are
+- * protected by "mtx", and ep_insert() is called with "mtx" held.
+- */
+- ep_rbtree_insert(ep, epi);
+-
+- /* now check if we've created too many backpaths */
+- error = -EINVAL;
+- if (full_check && reverse_path_check())
+- goto error_remove_epi;
+-
+ /* We have to drop the new item inside our item list to keep track of it */
+ spin_lock_irq(&ep->wq.lock);
+
+@@ -1516,6 +1515,8 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event,
+
+ return 0;
+
++error_unregister:
++ ep_unregister_pollwait(ep, epi);
+ error_remove_epi:
+ spin_lock(&tfile->f_lock);
+ list_del_rcu(&epi->fllink);
+@@ -1523,9 +1524,6 @@ error_remove_epi:
+
+ rb_erase_cached(&epi->rbn, &ep->rbr);
+
+-error_unregister:
+- ep_unregister_pollwait(ep, epi);
+-
+ /*
+ * We need to do this because an event could have been arrived on some
+ * allocated wait queue. Note that we don't care about the ep->ovflist
+@@ -1868,13 +1866,12 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+ struct epitem *epi;
+
+ mutex_lock_nested(&ep->mtx, call_nests + 1);
+- ep->visited = 1;
+- list_add(&ep->visited_list_link, &visited_list);
++ ep->gen = loop_check_gen;
+ for (rbp = rb_first_cached(&ep->rbr); rbp; rbp = rb_next(rbp)) {
+ epi = rb_entry(rbp, struct epitem, rbn);
+ if (unlikely(is_file_epoll(epi->ffd.file))) {
+ ep_tovisit = epi->ffd.file->private_data;
+- if (ep_tovisit->visited)
++ if (ep_tovisit->gen == loop_check_gen)
+ continue;
+ error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+ ep_loop_check_proc, epi->ffd.file,
+@@ -1915,18 +1912,8 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+ */
+ static int ep_loop_check(struct eventpoll *ep, struct file *file)
+ {
+- int ret;
+- struct eventpoll *ep_cur, *ep_next;
+-
+- ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
++ return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+ ep_loop_check_proc, file, ep, current);
+- /* clear visited list */
+- list_for_each_entry_safe(ep_cur, ep_next, &visited_list,
+- visited_list_link) {
+- ep_cur->visited = 0;
+- list_del(&ep_cur->visited_list_link);
+- }
+- return ret;
+ }
+
+ static void clear_tfile_check_list(void)
+@@ -2088,6 +2075,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ mutex_lock_nested(&ep->mtx, 0);
+ if (op == EPOLL_CTL_ADD) {
+ if (!list_empty(&f.file->f_ep_links) ||
++ ep->gen == loop_check_gen ||
+ is_file_epoll(tf.file)) {
+ full_check = 1;
+ mutex_unlock(&ep->mtx);
+@@ -2148,6 +2136,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ error_tgt_fput:
+ if (full_check) {
+ clear_tfile_check_list();
++ loop_check_gen++;
+ mutex_unlock(&epmutex);
+ }
+
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 4ae726e70d873..733fd9e4f0a15 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -553,6 +553,9 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
+ xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE);
+
+ do {
++ if (entry->label)
++ entry->label->len = NFS4_MAXLABELLEN;
++
+ status = xdr_decode(desc, entry, &stream);
+ if (status != 0) {
+ if (status == -EAGAIN)
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 05bc5f25ab85c..83828c118b6b7 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -2179,7 +2179,7 @@ static inline void zero_resv_unavail(void) {}
+
+ extern void set_dma_reserve(unsigned long new_dma_reserve);
+ extern void memmap_init_zone(unsigned long, int, unsigned long, unsigned long,
+- enum memmap_context, struct vmem_altmap *);
++ enum meminit_context, struct vmem_altmap *);
+ extern void setup_per_zone_wmarks(void);
+ extern int __meminit init_per_zone_wmark_min(void);
+ extern void mem_init(void);
+diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
+index fdd93a39f1fa1..fa02014eba8ea 100644
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -759,10 +759,15 @@ bool zone_watermark_ok(struct zone *z, unsigned int order,
+ unsigned int alloc_flags);
+ bool zone_watermark_ok_safe(struct zone *z, unsigned int order,
+ unsigned long mark, int classzone_idx);
+-enum memmap_context {
+- MEMMAP_EARLY,
+- MEMMAP_HOTPLUG,
++/*
++ * Memory initialization context, use to differentiate memory added by
++ * the platform statically or via memory hotplug interface.
++ */
++enum meminit_context {
++ MEMINIT_EARLY,
++ MEMINIT_HOTPLUG,
+ };
++
+ extern void init_currently_empty_zone(struct zone *zone, unsigned long start_pfn,
+ unsigned long size);
+
+diff --git a/include/linux/node.h b/include/linux/node.h
+index 708939bae9aa8..a79ec4492650c 100644
+--- a/include/linux/node.h
++++ b/include/linux/node.h
+@@ -32,11 +32,13 @@ extern struct node *node_devices[];
+ typedef void (*node_registration_func_t)(struct node *);
+
+ #if defined(CONFIG_MEMORY_HOTPLUG_SPARSE) && defined(CONFIG_NUMA)
+-extern int link_mem_sections(int nid, unsigned long start_pfn,
+- unsigned long end_pfn);
++int link_mem_sections(int nid, unsigned long start_pfn,
++ unsigned long end_pfn,
++ enum meminit_context context);
+ #else
+ static inline int link_mem_sections(int nid, unsigned long start_pfn,
+- unsigned long end_pfn)
++ unsigned long end_pfn,
++ enum meminit_context context)
+ {
+ return 0;
+ }
+@@ -61,7 +63,8 @@ static inline int register_one_node(int nid)
+ if (error)
+ return error;
+ /* link memory sections under this node */
+- error = link_mem_sections(nid, start_pfn, end_pfn);
++ error = link_mem_sections(nid, start_pfn, end_pfn,
++ MEMINIT_EARLY);
+ }
+
+ return error;
+diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h
+index e223e2632eddd..8b8d13f01caee 100644
+--- a/include/linux/virtio_vsock.h
++++ b/include/linux/virtio_vsock.h
+@@ -149,7 +149,8 @@ virtio_transport_dgram_enqueue(struct vsock_sock *vsk,
+
+ void virtio_transport_destruct(struct vsock_sock *vsk);
+
+-void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt);
++void virtio_transport_recv_pkt(struct virtio_transport *t,
++ struct virtio_vsock_pkt *pkt);
+ void virtio_transport_free_pkt(struct virtio_vsock_pkt *pkt);
+ void virtio_transport_inc_tx_pkt(struct virtio_vsock_sock *vvs, struct virtio_vsock_pkt *pkt);
+ u32 virtio_transport_get_credit(struct virtio_vsock_sock *vvs, u32 wanted);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 70f7743c16729..992d48774c9e9 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -6370,16 +6370,14 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip,
+ {
+ int bit;
+
+- if ((op->flags & FTRACE_OPS_FL_RCU) && !rcu_is_watching())
+- return;
+-
+ bit = trace_test_and_set_recursion(TRACE_LIST_START, TRACE_LIST_MAX);
+ if (bit < 0)
+ return;
+
+ preempt_disable_notrace();
+
+- op->func(ip, parent_ip, op, regs);
++ if (!(op->flags & FTRACE_OPS_FL_RCU) || rcu_is_watching())
++ op->func(ip, parent_ip, op, regs);
+
+ preempt_enable_notrace();
+ trace_clear_recursion(bit);
+diff --git a/lib/random32.c b/lib/random32.c
+index 036de0c93e224..b6f3325e38e43 100644
+--- a/lib/random32.c
++++ b/lib/random32.c
+@@ -48,7 +48,7 @@ static inline void prandom_state_selftest(void)
+ }
+ #endif
+
+-DEFINE_PER_CPU(struct rnd_state, net_rand_state);
++DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+
+ /**
+ * prandom_u32_state - seeded pseudo-random number generator.
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index aae7ff4856711..e60e28131f679 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -733,7 +733,7 @@ void __ref move_pfn_range_to_zone(struct zone *zone, unsigned long start_pfn,
+ * are reserved so nobody should be touching them so we should be safe
+ */
+ memmap_init_zone(nr_pages, nid, zone_idx(zone), start_pfn,
+- MEMMAP_HOTPLUG, altmap);
++ MEMINIT_HOTPLUG, altmap);
+
+ set_zone_contiguous(zone);
+ }
+@@ -1102,7 +1102,8 @@ int __ref add_memory_resource(int nid, struct resource *res, bool online)
+ }
+
+ /* link memory sections under this node.*/
+- ret = link_mem_sections(nid, PFN_DOWN(start), PFN_UP(start + size - 1));
++ ret = link_mem_sections(nid, PFN_DOWN(start), PFN_UP(start + size - 1),
++ MEMINIT_HOTPLUG);
+ BUG_ON(ret);
+
+ /* create new memmap entry */
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 5717ee66c8b38..545800433dfba 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5480,7 +5480,7 @@ void __ref build_all_zonelists(pg_data_t *pgdat)
+ * done. Non-atomic initialization, single-pass.
+ */
+ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
+- unsigned long start_pfn, enum memmap_context context,
++ unsigned long start_pfn, enum meminit_context context,
+ struct vmem_altmap *altmap)
+ {
+ unsigned long end_pfn = start_pfn + size;
+@@ -5507,7 +5507,7 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
+ * There can be holes in boot-time mem_map[]s handed to this
+ * function. They do not exist on hotplugged memory.
+ */
+- if (context != MEMMAP_EARLY)
++ if (context != MEMINIT_EARLY)
+ goto not_early;
+
+ if (!early_pfn_valid(pfn))
+@@ -5542,7 +5542,7 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
+ not_early:
+ page = pfn_to_page(pfn);
+ __init_single_page(page, pfn, zone, nid);
+- if (context == MEMMAP_HOTPLUG)
++ if (context == MEMINIT_HOTPLUG)
+ SetPageReserved(page);
+
+ /*
+@@ -5557,7 +5557,7 @@ not_early:
+ * check here not to call set_pageblock_migratetype() against
+ * pfn out of zone.
+ *
+- * Please note that MEMMAP_HOTPLUG path doesn't clear memmap
++ * Please note that MEMINIT_HOTPLUG path doesn't clear memmap
+ * because this is done early in sparse_add_one_section
+ */
+ if (!(pfn & (pageblock_nr_pages - 1))) {
+@@ -5578,7 +5578,8 @@ static void __meminit zone_init_free_lists(struct zone *zone)
+
+ #ifndef __HAVE_ARCH_MEMMAP_INIT
+ #define memmap_init(size, nid, zone, start_pfn) \
+- memmap_init_zone((size), (nid), (zone), (start_pfn), MEMMAP_EARLY, NULL)
++ memmap_init_zone((size), (nid), (zone), (start_pfn), \
++ MEMINIT_EARLY, NULL)
+ #endif
+
+ static int zone_batchsize(struct zone *zone)
+diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
+index 259325cbcc314..4d154efb80c88 100644
+--- a/net/mac80211/vht.c
++++ b/net/mac80211/vht.c
+@@ -170,10 +170,7 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
+ /* take some capabilities as-is */
+ cap_info = le32_to_cpu(vht_cap_ie->vht_cap_info);
+ vht_cap->cap = cap_info;
+- vht_cap->cap &= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895 |
+- IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991 |
+- IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
+- IEEE80211_VHT_CAP_RXLDPC |
++ vht_cap->cap &= IEEE80211_VHT_CAP_RXLDPC |
+ IEEE80211_VHT_CAP_VHT_TXOP_PS |
+ IEEE80211_VHT_CAP_HTC_VHT |
+ IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK |
+@@ -182,6 +179,9 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
+ IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN |
+ IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
+
++ vht_cap->cap |= min_t(u32, cap_info & IEEE80211_VHT_CAP_MAX_MPDU_MASK,
++ own_cap.cap & IEEE80211_VHT_CAP_MAX_MPDU_MASK);
++
+ /* and some based on our own capabilities */
+ switch (own_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
+ case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 31fa94064a620..0b89609a6e9d6 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -1129,6 +1129,8 @@ ctnetlink_parse_tuple(const struct nlattr * const cda[],
+ if (!tb[CTA_TUPLE_IP])
+ return -EINVAL;
+
++ if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6)
++ return -EOPNOTSUPP;
+ tuple->src.l3num = l3num;
+
+ err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index b3caf1eac6aff..16b745d254fea 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2162,7 +2162,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ int skb_len = skb->len;
+ unsigned int snaplen, res;
+ unsigned long status = TP_STATUS_USER;
+- unsigned short macoff, netoff, hdrlen;
++ unsigned short macoff, hdrlen;
++ unsigned int netoff;
+ struct sk_buff *copy_skb = NULL;
+ struct timespec ts;
+ __u32 ts_status;
+@@ -2225,6 +2226,12 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ }
+ macoff = netoff - maclen;
+ }
++ if (netoff > USHRT_MAX) {
++ spin_lock(&sk->sk_receive_queue.lock);
++ po->stats.stats1.tp_drops++;
++ spin_unlock(&sk->sk_receive_queue.lock);
++ goto drop_n_restore;
++ }
+ if (po->tp_version <= TPACKET_V2) {
+ if (macoff + snaplen > po->rx_ring.frame_size) {
+ if (po->copy_thresh &&
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 96ab344f17bbc..cc70d651d13e0 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -39,6 +39,7 @@ struct virtio_vsock {
+ * must be accessed with tx_lock held.
+ */
+ struct mutex tx_lock;
++ bool tx_run;
+
+ struct work_struct send_pkt_work;
+ spinlock_t send_pkt_list_lock;
+@@ -54,6 +55,7 @@ struct virtio_vsock {
+ * must be accessed with rx_lock held.
+ */
+ struct mutex rx_lock;
++ bool rx_run;
+ int rx_buf_nr;
+ int rx_buf_max_nr;
+
+@@ -61,46 +63,28 @@ struct virtio_vsock {
+ * vqs[VSOCK_VQ_EVENT] must be accessed with event_lock held.
+ */
+ struct mutex event_lock;
++ bool event_run;
+ struct virtio_vsock_event event_list[8];
+
+ u32 guest_cid;
+ };
+
+-static struct virtio_vsock *virtio_vsock_get(void)
+-{
+- return the_virtio_vsock;
+-}
+-
+ static u32 virtio_transport_get_local_cid(void)
+ {
+- struct virtio_vsock *vsock = virtio_vsock_get();
+-
+- if (!vsock)
+- return VMADDR_CID_ANY;
+-
+- return vsock->guest_cid;
+-}
+-
+-static void virtio_transport_loopback_work(struct work_struct *work)
+-{
+- struct virtio_vsock *vsock =
+- container_of(work, struct virtio_vsock, loopback_work);
+- LIST_HEAD(pkts);
+-
+- spin_lock_bh(&vsock->loopback_list_lock);
+- list_splice_init(&vsock->loopback_list, &pkts);
+- spin_unlock_bh(&vsock->loopback_list_lock);
+-
+- mutex_lock(&vsock->rx_lock);
+- while (!list_empty(&pkts)) {
+- struct virtio_vsock_pkt *pkt;
+-
+- pkt = list_first_entry(&pkts, struct virtio_vsock_pkt, list);
+- list_del_init(&pkt->list);
++ struct virtio_vsock *vsock;
++ u32 ret;
+
+- virtio_transport_recv_pkt(pkt);
++ rcu_read_lock();
++ vsock = rcu_dereference(the_virtio_vsock);
++ if (!vsock) {
++ ret = VMADDR_CID_ANY;
++ goto out_rcu;
+ }
+- mutex_unlock(&vsock->rx_lock);
++
++ ret = vsock->guest_cid;
++out_rcu:
++ rcu_read_unlock();
++ return ret;
+ }
+
+ static int virtio_transport_send_pkt_loopback(struct virtio_vsock *vsock,
+@@ -128,6 +112,9 @@ virtio_transport_send_pkt_work(struct work_struct *work)
+
+ mutex_lock(&vsock->tx_lock);
+
++ if (!vsock->tx_run)
++ goto out;
++
+ vq = vsock->vqs[VSOCK_VQ_TX];
+
+ for (;;) {
+@@ -186,6 +173,7 @@ virtio_transport_send_pkt_work(struct work_struct *work)
+ if (added)
+ virtqueue_kick(vq);
+
++out:
+ mutex_unlock(&vsock->tx_lock);
+
+ if (restart_rx)
+@@ -198,14 +186,18 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt)
+ struct virtio_vsock *vsock;
+ int len = pkt->len;
+
+- vsock = virtio_vsock_get();
++ rcu_read_lock();
++ vsock = rcu_dereference(the_virtio_vsock);
+ if (!vsock) {
+ virtio_transport_free_pkt(pkt);
+- return -ENODEV;
++ len = -ENODEV;
++ goto out_rcu;
+ }
+
+- if (le64_to_cpu(pkt->hdr.dst_cid) == vsock->guest_cid)
+- return virtio_transport_send_pkt_loopback(vsock, pkt);
++ if (le64_to_cpu(pkt->hdr.dst_cid) == vsock->guest_cid) {
++ len = virtio_transport_send_pkt_loopback(vsock, pkt);
++ goto out_rcu;
++ }
+
+ if (pkt->reply)
+ atomic_inc(&vsock->queued_replies);
+@@ -215,6 +207,9 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt)
+ spin_unlock_bh(&vsock->send_pkt_list_lock);
+
+ queue_work(virtio_vsock_workqueue, &vsock->send_pkt_work);
++
++out_rcu:
++ rcu_read_unlock();
+ return len;
+ }
+
+@@ -223,12 +218,14 @@ virtio_transport_cancel_pkt(struct vsock_sock *vsk)
+ {
+ struct virtio_vsock *vsock;
+ struct virtio_vsock_pkt *pkt, *n;
+- int cnt = 0;
++ int cnt = 0, ret;
+ LIST_HEAD(freeme);
+
+- vsock = virtio_vsock_get();
++ rcu_read_lock();
++ vsock = rcu_dereference(the_virtio_vsock);
+ if (!vsock) {
+- return -ENODEV;
++ ret = -ENODEV;
++ goto out_rcu;
+ }
+
+ spin_lock_bh(&vsock->send_pkt_list_lock);
+@@ -256,7 +253,11 @@ virtio_transport_cancel_pkt(struct vsock_sock *vsk)
+ queue_work(virtio_vsock_workqueue, &vsock->rx_work);
+ }
+
+- return 0;
++ ret = 0;
++
++out_rcu:
++ rcu_read_unlock();
++ return ret;
+ }
+
+ static void virtio_vsock_rx_fill(struct virtio_vsock *vsock)
+@@ -308,6 +309,10 @@ static void virtio_transport_tx_work(struct work_struct *work)
+
+ vq = vsock->vqs[VSOCK_VQ_TX];
+ mutex_lock(&vsock->tx_lock);
++
++ if (!vsock->tx_run)
++ goto out;
++
+ do {
+ struct virtio_vsock_pkt *pkt;
+ unsigned int len;
+@@ -318,6 +323,8 @@ static void virtio_transport_tx_work(struct work_struct *work)
+ added = true;
+ }
+ } while (!virtqueue_enable_cb(vq));
++
++out:
+ mutex_unlock(&vsock->tx_lock);
+
+ if (added)
+@@ -336,56 +343,6 @@ static bool virtio_transport_more_replies(struct virtio_vsock *vsock)
+ return val < virtqueue_get_vring_size(vq);
+ }
+
+-static void virtio_transport_rx_work(struct work_struct *work)
+-{
+- struct virtio_vsock *vsock =
+- container_of(work, struct virtio_vsock, rx_work);
+- struct virtqueue *vq;
+-
+- vq = vsock->vqs[VSOCK_VQ_RX];
+-
+- mutex_lock(&vsock->rx_lock);
+-
+- do {
+- virtqueue_disable_cb(vq);
+- for (;;) {
+- struct virtio_vsock_pkt *pkt;
+- unsigned int len;
+-
+- if (!virtio_transport_more_replies(vsock)) {
+- /* Stop rx until the device processes already
+- * pending replies. Leave rx virtqueue
+- * callbacks disabled.
+- */
+- goto out;
+- }
+-
+- pkt = virtqueue_get_buf(vq, &len);
+- if (!pkt) {
+- break;
+- }
+-
+- vsock->rx_buf_nr--;
+-
+- /* Drop short/long packets */
+- if (unlikely(len < sizeof(pkt->hdr) ||
+- len > sizeof(pkt->hdr) + pkt->len)) {
+- virtio_transport_free_pkt(pkt);
+- continue;
+- }
+-
+- pkt->len = len - sizeof(pkt->hdr);
+- virtio_transport_deliver_tap_pkt(pkt);
+- virtio_transport_recv_pkt(pkt);
+- }
+- } while (!virtqueue_enable_cb(vq));
+-
+-out:
+- if (vsock->rx_buf_nr < vsock->rx_buf_max_nr / 2)
+- virtio_vsock_rx_fill(vsock);
+- mutex_unlock(&vsock->rx_lock);
+-}
+-
+ /* event_lock must be held */
+ static int virtio_vsock_event_fill_one(struct virtio_vsock *vsock,
+ struct virtio_vsock_event *event)
+@@ -455,6 +412,9 @@ static void virtio_transport_event_work(struct work_struct *work)
+
+ mutex_lock(&vsock->event_lock);
+
++ if (!vsock->event_run)
++ goto out;
++
+ do {
+ struct virtio_vsock_event *event;
+ unsigned int len;
+@@ -469,7 +429,7 @@ static void virtio_transport_event_work(struct work_struct *work)
+ } while (!virtqueue_enable_cb(vq));
+
+ virtqueue_kick(vsock->vqs[VSOCK_VQ_EVENT]);
+-
++out:
+ mutex_unlock(&vsock->event_lock);
+ }
+
+@@ -546,6 +506,86 @@ static struct virtio_transport virtio_transport = {
+ .send_pkt = virtio_transport_send_pkt,
+ };
+
++static void virtio_transport_loopback_work(struct work_struct *work)
++{
++ struct virtio_vsock *vsock =
++ container_of(work, struct virtio_vsock, loopback_work);
++ LIST_HEAD(pkts);
++
++ spin_lock_bh(&vsock->loopback_list_lock);
++ list_splice_init(&vsock->loopback_list, &pkts);
++ spin_unlock_bh(&vsock->loopback_list_lock);
++
++ mutex_lock(&vsock->rx_lock);
++
++ if (!vsock->rx_run)
++ goto out;
++
++ while (!list_empty(&pkts)) {
++ struct virtio_vsock_pkt *pkt;
++
++ pkt = list_first_entry(&pkts, struct virtio_vsock_pkt, list);
++ list_del_init(&pkt->list);
++
++ virtio_transport_recv_pkt(&virtio_transport, pkt);
++ }
++out:
++ mutex_unlock(&vsock->rx_lock);
++}
++
++static void virtio_transport_rx_work(struct work_struct *work)
++{
++ struct virtio_vsock *vsock =
++ container_of(work, struct virtio_vsock, rx_work);
++ struct virtqueue *vq;
++
++ vq = vsock->vqs[VSOCK_VQ_RX];
++
++ mutex_lock(&vsock->rx_lock);
++
++ if (!vsock->rx_run)
++ goto out;
++
++ do {
++ virtqueue_disable_cb(vq);
++ for (;;) {
++ struct virtio_vsock_pkt *pkt;
++ unsigned int len;
++
++ if (!virtio_transport_more_replies(vsock)) {
++ /* Stop rx until the device processes already
++ * pending replies. Leave rx virtqueue
++ * callbacks disabled.
++ */
++ goto out;
++ }
++
++ pkt = virtqueue_get_buf(vq, &len);
++ if (!pkt) {
++ break;
++ }
++
++ vsock->rx_buf_nr--;
++
++ /* Drop short/long packets */
++ if (unlikely(len < sizeof(pkt->hdr) ||
++ len > sizeof(pkt->hdr) + pkt->len)) {
++ virtio_transport_free_pkt(pkt);
++ continue;
++ }
++
++ pkt->len = len - sizeof(pkt->hdr);
++ virtio_transport_deliver_tap_pkt(pkt);
++ virtio_transport_recv_pkt(&virtio_transport, pkt);
++ }
++ } while (!virtqueue_enable_cb(vq));
++
++out:
++ if (vsock->rx_buf_nr < vsock->rx_buf_max_nr / 2)
++ virtio_vsock_rx_fill(vsock);
++ mutex_unlock(&vsock->rx_lock);
++}
++
+ static int virtio_vsock_probe(struct virtio_device *vdev)
+ {
+ vq_callback_t *callbacks[] = {
+@@ -566,7 +606,8 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ return ret;
+
+ /* Only one virtio-vsock device per guest is supported */
+- if (the_virtio_vsock) {
++ if (rcu_dereference_protected(the_virtio_vsock,
++ lockdep_is_held(&the_virtio_vsock_mutex))) {
+ ret = -EBUSY;
+ goto out;
+ }
+@@ -591,8 +632,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ vsock->rx_buf_max_nr = 0;
+ atomic_set(&vsock->queued_replies, 0);
+
+- vdev->priv = vsock;
+- the_virtio_vsock = vsock;
+ mutex_init(&vsock->tx_lock);
+ mutex_init(&vsock->rx_lock);
+ mutex_init(&vsock->event_lock);
+@@ -606,14 +645,23 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ INIT_WORK(&vsock->send_pkt_work, virtio_transport_send_pkt_work);
+ INIT_WORK(&vsock->loopback_work, virtio_transport_loopback_work);
+
++ mutex_lock(&vsock->tx_lock);
++ vsock->tx_run = true;
++ mutex_unlock(&vsock->tx_lock);
++
+ mutex_lock(&vsock->rx_lock);
+ virtio_vsock_rx_fill(vsock);
++ vsock->rx_run = true;
+ mutex_unlock(&vsock->rx_lock);
+
+ mutex_lock(&vsock->event_lock);
+ virtio_vsock_event_fill(vsock);
++ vsock->event_run = true;
+ mutex_unlock(&vsock->event_lock);
+
++ vdev->priv = vsock;
++ rcu_assign_pointer(the_virtio_vsock, vsock);
++
+ mutex_unlock(&the_virtio_vsock_mutex);
+ return 0;
+
+@@ -628,6 +676,12 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+ struct virtio_vsock *vsock = vdev->priv;
+ struct virtio_vsock_pkt *pkt;
+
++ mutex_lock(&the_virtio_vsock_mutex);
++
++ vdev->priv = NULL;
++ rcu_assign_pointer(the_virtio_vsock, NULL);
++ synchronize_rcu();
++
+ flush_work(&vsock->loopback_work);
+ flush_work(&vsock->rx_work);
+ flush_work(&vsock->tx_work);
+@@ -637,6 +691,24 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+ /* Reset all connected sockets when the device disappear */
+ vsock_for_each_connected_socket(virtio_vsock_reset_sock);
+
++ /* Stop all work handlers to make sure no one is accessing the device,
++ * so we can safely call vdev->config->reset().
++ */
++ mutex_lock(&vsock->rx_lock);
++ vsock->rx_run = false;
++ mutex_unlock(&vsock->rx_lock);
++
++ mutex_lock(&vsock->tx_lock);
++ vsock->tx_run = false;
++ mutex_unlock(&vsock->tx_lock);
++
++ mutex_lock(&vsock->event_lock);
++ vsock->event_run = false;
++ mutex_unlock(&vsock->event_lock);
++
++ /* Flush all device writes and interrupts, device will not use any
++ * more buffers.
++ */
+ vdev->config->reset(vdev);
+
+ mutex_lock(&vsock->rx_lock);
+@@ -667,12 +739,11 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+ }
+ spin_unlock_bh(&vsock->loopback_list_lock);
+
+- mutex_lock(&the_virtio_vsock_mutex);
+- the_virtio_vsock = NULL;
+- mutex_unlock(&the_virtio_vsock_mutex);
+-
++ /* Delete virtqueues and flush outstanding callbacks if any */
+ vdev->config->del_vqs(vdev);
+
++ mutex_unlock(&the_virtio_vsock_mutex);
++
+ kfree(vsock);
+ }
+
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 52242a148c705..5f8a72d34d313 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -669,9 +669,9 @@ static int virtio_transport_reset(struct vsock_sock *vsk,
+ /* Normally packets are associated with a socket. There may be no socket if an
+ * attempt was made to connect to a socket that does not exist.
+ */
+-static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt)
++static int virtio_transport_reset_no_sock(const struct virtio_transport *t,
++ struct virtio_vsock_pkt *pkt)
+ {
+- const struct virtio_transport *t;
+ struct virtio_vsock_pkt *reply;
+ struct virtio_vsock_pkt_info info = {
+ .op = VIRTIO_VSOCK_OP_RST,
+@@ -691,7 +691,6 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt)
+ if (!reply)
+ return -ENOMEM;
+
+- t = virtio_transport_get_ops();
+ if (!t) {
+ virtio_transport_free_pkt(reply);
+ return -ENOTCONN;
+@@ -993,7 +992,8 @@ static bool virtio_transport_space_update(struct sock *sk,
+ /* We are under the virtio-vsock's vsock->rx_lock or vhost-vsock's vq->mutex
+ * lock.
+ */
+-void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt)
++void virtio_transport_recv_pkt(struct virtio_transport *t,
++ struct virtio_vsock_pkt *pkt)
+ {
+ struct sockaddr_vm src, dst;
+ struct vsock_sock *vsk;
+@@ -1015,7 +1015,7 @@ void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt)
+ le32_to_cpu(pkt->hdr.fwd_cnt));
+
+ if (le16_to_cpu(pkt->hdr.type) != VIRTIO_VSOCK_TYPE_STREAM) {
+- (void)virtio_transport_reset_no_sock(pkt);
++ (void)virtio_transport_reset_no_sock(t, pkt);
+ goto free_pkt;
+ }
+
+@@ -1026,7 +1026,7 @@ void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt)
+ if (!sk) {
+ sk = vsock_find_bound_socket(&dst);
+ if (!sk) {
+- (void)virtio_transport_reset_no_sock(pkt);
++ (void)virtio_transport_reset_no_sock(t, pkt);
+ goto free_pkt;
+ }
+ }
+@@ -1060,6 +1060,7 @@ void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt)
+ virtio_transport_free_pkt(pkt);
+ break;
+ default:
++ (void)virtio_transport_reset_no_sock(t, pkt);
+ virtio_transport_free_pkt(pkt);
+ break;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-10-14 20:36 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-10-14 20:36 UTC (permalink / raw
To: gentoo-commits
commit: 40ca78d22ec084b5932a3d76164833e23ef1fc36
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 14 20:36:30 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Oct 14 20:36:30 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=40ca78d2
Linux patch 4.19.151
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1150_linux-4.19.151.patch | 1688 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1692 insertions(+)
diff --git a/0000_README b/0000_README
index 47aa030..7427668 100644
--- a/0000_README
+++ b/0000_README
@@ -639,6 +639,10 @@ Patch: 1149_linux-4.19.150.patch
From: https://www.kernel.org
Desc: Linux 4.19.150
+Patch: 1150_linux-4.19.151.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.151
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1150_linux-4.19.151.patch b/1150_linux-4.19.151.patch
new file mode 100644
index 0000000..e5af897
--- /dev/null
+++ b/1150_linux-4.19.151.patch
@@ -0,0 +1,1688 @@
+diff --git a/Makefile b/Makefile
+index 65485185bec29..f2c9db9b4015a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 150
++SUBLEVEL = 151
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+index faa017d4cd56b..636bab51de38d 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+@@ -151,6 +151,7 @@
+ };
+
+ &qspi {
++ status = "okay";
+ flash@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 0047bbdd43c0f..b3c569412f4e2 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -472,7 +472,8 @@ static int really_probe(struct device *dev, struct device_driver *drv)
+ drv->bus->name, __func__, drv->name, dev_name(dev));
+ if (!list_empty(&dev->devres_head)) {
+ dev_crit(dev, "Resources present before probing\n");
+- return -EBUSY;
++ ret = -EBUSY;
++ goto done;
+ }
+
+ re_probe:
+@@ -579,7 +580,7 @@ pinctrl_bind_failed:
+ ret = 0;
+ done:
+ atomic_dec(&probe_count);
+- wake_up(&probe_waitqueue);
++ wake_up_all(&probe_waitqueue);
+ return ret;
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+index fcf421263fd96..abad7460084f2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -954,6 +954,7 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_tt *ttm)
+
+ release_sg:
+ kfree(ttm->sg);
++ ttm->sg = NULL;
+ return r;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
+index c002f89685073..9682f30ab6f68 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
+@@ -176,6 +176,8 @@ void
+ nouveau_mem_del(struct ttm_mem_reg *reg)
+ {
+ struct nouveau_mem *mem = nouveau_mem(reg);
++ if (!mem)
++ return;
+ nouveau_mem_fini(mem);
+ kfree(reg->mm_node);
+ reg->mm_node = NULL;
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 58fc17e46694d..3ac3b26cc9317 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -1698,6 +1698,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
+
+ pci_set_drvdata(dev, priv);
+
++ dev_pm_set_driver_flags(&dev->dev, DPM_FLAG_NEVER_SKIP);
+ pm_runtime_set_autosuspend_delay(&dev->dev, 1000);
+ pm_runtime_use_autosuspend(&dev->dev);
+ pm_runtime_put_autosuspend(&dev->dev);
+diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
+index 90f5d0407d732..f48e637f1a3e8 100644
+--- a/drivers/i2c/busses/i2c-meson.c
++++ b/drivers/i2c/busses/i2c-meson.c
+@@ -8,6 +8,7 @@
+ * published by the Free Software Foundation.
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+ #include <linux/i2c.h>
+@@ -35,12 +36,17 @@
+ #define REG_CTRL_ACK_IGNORE BIT(1)
+ #define REG_CTRL_STATUS BIT(2)
+ #define REG_CTRL_ERROR BIT(3)
+-#define REG_CTRL_CLKDIV_SHIFT 12
+-#define REG_CTRL_CLKDIV_MASK GENMASK(21, 12)
+-#define REG_CTRL_CLKDIVEXT_SHIFT 28
+-#define REG_CTRL_CLKDIVEXT_MASK GENMASK(29, 28)
++#define REG_CTRL_CLKDIV GENMASK(21, 12)
++#define REG_CTRL_CLKDIVEXT GENMASK(29, 28)
++
++#define REG_SLV_ADDR GENMASK(7, 0)
++#define REG_SLV_SDA_FILTER GENMASK(10, 8)
++#define REG_SLV_SCL_FILTER GENMASK(13, 11)
++#define REG_SLV_SCL_LOW GENMASK(27, 16)
++#define REG_SLV_SCL_LOW_EN BIT(28)
+
+ #define I2C_TIMEOUT_MS 500
++#define FILTER_DELAY 15
+
+ enum {
+ TOKEN_END = 0,
+@@ -135,19 +141,24 @@ static void meson_i2c_set_clk_div(struct meson_i2c *i2c, unsigned int freq)
+ unsigned long clk_rate = clk_get_rate(i2c->clk);
+ unsigned int div;
+
+- div = DIV_ROUND_UP(clk_rate, freq * i2c->data->div_factor);
++ div = DIV_ROUND_UP(clk_rate, freq);
++ div -= FILTER_DELAY;
++ div = DIV_ROUND_UP(div, i2c->data->div_factor);
+
+ /* clock divider has 12 bits */
+- if (div >= (1 << 12)) {
++ if (div > GENMASK(11, 0)) {
+ dev_err(i2c->dev, "requested bus frequency too low\n");
+- div = (1 << 12) - 1;
++ div = GENMASK(11, 0);
+ }
+
+- meson_i2c_set_mask(i2c, REG_CTRL, REG_CTRL_CLKDIV_MASK,
+- (div & GENMASK(9, 0)) << REG_CTRL_CLKDIV_SHIFT);
++ meson_i2c_set_mask(i2c, REG_CTRL, REG_CTRL_CLKDIV,
++ FIELD_PREP(REG_CTRL_CLKDIV, div & GENMASK(9, 0)));
++
++ meson_i2c_set_mask(i2c, REG_CTRL, REG_CTRL_CLKDIVEXT,
++ FIELD_PREP(REG_CTRL_CLKDIVEXT, div >> 10));
+
+- meson_i2c_set_mask(i2c, REG_CTRL, REG_CTRL_CLKDIVEXT_MASK,
+- (div >> 10) << REG_CTRL_CLKDIVEXT_SHIFT);
++ /* Disable HIGH/LOW mode */
++ meson_i2c_set_mask(i2c, REG_SLAVE_ADDR, REG_SLV_SCL_LOW_EN, 0);
+
+ dev_dbg(i2c->dev, "%s: clk %lu, freq %u, div %u\n", __func__,
+ clk_rate, freq, div);
+@@ -276,7 +287,10 @@ static void meson_i2c_do_start(struct meson_i2c *i2c, struct i2c_msg *msg)
+ token = (msg->flags & I2C_M_RD) ? TOKEN_SLAVE_ADDR_READ :
+ TOKEN_SLAVE_ADDR_WRITE;
+
+- writel(msg->addr << 1, i2c->regs + REG_SLAVE_ADDR);
++
++ meson_i2c_set_mask(i2c, REG_SLAVE_ADDR, REG_SLV_ADDR,
++ FIELD_PREP(REG_SLV_ADDR, msg->addr << 1));
++
+ meson_i2c_add_token(i2c, TOKEN_START);
+ meson_i2c_add_token(i2c, token);
+ }
+@@ -435,6 +449,10 @@ static int meson_i2c_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++ /* Disable filtering */
++ meson_i2c_set_mask(i2c, REG_SLAVE_ADDR,
++ REG_SLV_SDA_FILTER | REG_SLV_SCL_FILTER, 0);
++
+ meson_i2c_set_clk_div(i2c, timings.bus_freq_hz);
+
+ return 0;
+diff --git a/drivers/i2c/busses/i2c-owl.c b/drivers/i2c/busses/i2c-owl.c
+index 96b4572e6d9cc..cf3fcf35fe3d8 100644
+--- a/drivers/i2c/busses/i2c-owl.c
++++ b/drivers/i2c/busses/i2c-owl.c
+@@ -179,6 +179,9 @@ static irqreturn_t owl_i2c_interrupt(int irq, void *_dev)
+ fifostat = readl(i2c_dev->base + OWL_I2C_REG_FIFOSTAT);
+ if (fifostat & OWL_I2C_FIFOSTAT_RNB) {
+ i2c_dev->err = -ENXIO;
++ /* Clear NACK error bit by writing "1" */
++ owl_i2c_update_reg(i2c_dev->base + OWL_I2C_REG_FIFOSTAT,
++ OWL_I2C_FIFOSTAT_RNB, true);
+ goto stop;
+ }
+
+@@ -186,6 +189,9 @@ static irqreturn_t owl_i2c_interrupt(int irq, void *_dev)
+ stat = readl(i2c_dev->base + OWL_I2C_REG_STAT);
+ if (stat & OWL_I2C_STAT_BEB) {
+ i2c_dev->err = -EIO;
++ /* Clear BUS error bit by writing "1" */
++ owl_i2c_update_reg(i2c_dev->base + OWL_I2C_REG_STAT,
++ OWL_I2C_STAT_BEB, true);
+ goto stop;
+ }
+
+diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
+index 2a788169cbb82..9b31cd6b6062b 100644
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -185,7 +185,7 @@ static void mmc_queue_setup_discard(struct request_queue *q,
+ q->limits.discard_granularity = card->pref_erase << 9;
+ /* granularity must not be greater than max. discard */
+ if (card->pref_erase > max_discard)
+- q->limits.discard_granularity = 0;
++ q->limits.discard_granularity = SECTOR_SIZE;
+ if (mmc_can_secure_erase_trim(card))
+ blk_queue_flag_set(QUEUE_FLAG_SECERASE, q);
+ }
+diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
+index 5b8502fd50cbc..88075e420f907 100644
+--- a/drivers/mtd/nand/raw/sunxi_nand.c
++++ b/drivers/mtd/nand/raw/sunxi_nand.c
+@@ -1947,7 +1947,7 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc,
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret) {
+ dev_err(dev, "failed to register mtd device: %d\n", ret);
+- nand_release(nand);
++ nand_cleanup(nand);
+ return ret;
+ }
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index d32e32e791741..a59333b87eafd 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1123,6 +1123,7 @@ static void bond_setup_by_slave(struct net_device *bond_dev,
+
+ bond_dev->type = slave_dev->type;
+ bond_dev->hard_header_len = slave_dev->hard_header_len;
++ bond_dev->needed_headroom = slave_dev->needed_headroom;
+ bond_dev->addr_len = slave_dev->addr_len;
+
+ memcpy(bond_dev->broadcast, slave_dev->broadcast,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+index 76cc10e44080b..7ddacc9e4fe40 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+@@ -217,6 +217,9 @@ static int __mlx5e_add_vlan_rule(struct mlx5e_priv *priv,
+ break;
+ }
+
++ if (WARN_ONCE(*rule_p, "VLAN rule already exists type %d", rule_type))
++ return 0;
++
+ *rule_p = mlx5_add_flow_rules(ft, spec, &flow_act, &dest, 1);
+
+ if (IS_ERR(*rule_p)) {
+@@ -397,8 +400,7 @@ static void mlx5e_add_vlan_rules(struct mlx5e_priv *priv)
+ for_each_set_bit(i, priv->fs.vlan.active_svlans, VLAN_N_VID)
+ mlx5e_add_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_MATCH_STAG_VID, i);
+
+- if (priv->fs.vlan.cvlan_filter_disabled &&
+- !(priv->netdev->flags & IFF_PROMISC))
++ if (priv->fs.vlan.cvlan_filter_disabled)
+ mlx5e_add_any_vid_rules(priv);
+ }
+
+@@ -415,8 +417,12 @@ static void mlx5e_del_vlan_rules(struct mlx5e_priv *priv)
+ for_each_set_bit(i, priv->fs.vlan.active_svlans, VLAN_N_VID)
+ mlx5e_del_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_MATCH_STAG_VID, i);
+
+- if (priv->fs.vlan.cvlan_filter_disabled &&
+- !(priv->netdev->flags & IFF_PROMISC))
++ WARN_ON_ONCE(!(test_bit(MLX5E_STATE_DESTROYING, &priv->state)));
++
++ /* must be called after DESTROY bit is set and
++ * set_rx_mode is called and flushed
++ */
++ if (priv->fs.vlan.cvlan_filter_disabled)
+ mlx5e_del_any_vid_rules(priv);
+ }
+
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index b5066cf86c856..569e698b5c807 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1337,51 +1337,6 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler,
+ return error;
+ }
+
+-/* MDIO bus init function */
+-static int ravb_mdio_init(struct ravb_private *priv)
+-{
+- struct platform_device *pdev = priv->pdev;
+- struct device *dev = &pdev->dev;
+- int error;
+-
+- /* Bitbang init */
+- priv->mdiobb.ops = &bb_ops;
+-
+- /* MII controller setting */
+- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
+- if (!priv->mii_bus)
+- return -ENOMEM;
+-
+- /* Hook up MII support for ethtool */
+- priv->mii_bus->name = "ravb_mii";
+- priv->mii_bus->parent = dev;
+- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+- pdev->name, pdev->id);
+-
+- /* Register MDIO bus */
+- error = of_mdiobus_register(priv->mii_bus, dev->of_node);
+- if (error)
+- goto out_free_bus;
+-
+- return 0;
+-
+-out_free_bus:
+- free_mdio_bitbang(priv->mii_bus);
+- return error;
+-}
+-
+-/* MDIO bus release function */
+-static int ravb_mdio_release(struct ravb_private *priv)
+-{
+- /* Unregister mdio bus */
+- mdiobus_unregister(priv->mii_bus);
+-
+- /* Free bitbang info */
+- free_mdio_bitbang(priv->mii_bus);
+-
+- return 0;
+-}
+-
+ /* Network device open function for Ethernet AVB */
+ static int ravb_open(struct net_device *ndev)
+ {
+@@ -1390,13 +1345,6 @@ static int ravb_open(struct net_device *ndev)
+ struct device *dev = &pdev->dev;
+ int error;
+
+- /* MDIO bus init */
+- error = ravb_mdio_init(priv);
+- if (error) {
+- netdev_err(ndev, "failed to initialize MDIO\n");
+- return error;
+- }
+-
+ napi_enable(&priv->napi[RAVB_BE]);
+ napi_enable(&priv->napi[RAVB_NC]);
+
+@@ -1474,7 +1422,6 @@ out_free_irq:
+ out_napi_off:
+ napi_disable(&priv->napi[RAVB_NC]);
+ napi_disable(&priv->napi[RAVB_BE]);
+- ravb_mdio_release(priv);
+ return error;
+ }
+
+@@ -1774,8 +1721,6 @@ static int ravb_close(struct net_device *ndev)
+ ravb_ring_free(ndev, RAVB_BE);
+ ravb_ring_free(ndev, RAVB_NC);
+
+- ravb_mdio_release(priv);
+-
+ return 0;
+ }
+
+@@ -1922,6 +1867,51 @@ static const struct net_device_ops ravb_netdev_ops = {
+ .ndo_set_features = ravb_set_features,
+ };
+
++/* MDIO bus init function */
++static int ravb_mdio_init(struct ravb_private *priv)
++{
++ struct platform_device *pdev = priv->pdev;
++ struct device *dev = &pdev->dev;
++ int error;
++
++ /* Bitbang init */
++ priv->mdiobb.ops = &bb_ops;
++
++ /* MII controller setting */
++ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
++ if (!priv->mii_bus)
++ return -ENOMEM;
++
++ /* Hook up MII support for ethtool */
++ priv->mii_bus->name = "ravb_mii";
++ priv->mii_bus->parent = dev;
++ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
++ pdev->name, pdev->id);
++
++ /* Register MDIO bus */
++ error = of_mdiobus_register(priv->mii_bus, dev->of_node);
++ if (error)
++ goto out_free_bus;
++
++ return 0;
++
++out_free_bus:
++ free_mdio_bitbang(priv->mii_bus);
++ return error;
++}
++
++/* MDIO bus release function */
++static int ravb_mdio_release(struct ravb_private *priv)
++{
++ /* Unregister mdio bus */
++ mdiobus_unregister(priv->mii_bus);
++
++ /* Free bitbang info */
++ free_mdio_bitbang(priv->mii_bus);
++
++ return 0;
++}
++
+ static const struct of_device_id ravb_match_table[] = {
+ { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 },
+ { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 },
+@@ -2148,6 +2138,13 @@ static int ravb_probe(struct platform_device *pdev)
+ eth_hw_addr_random(ndev);
+ }
+
++ /* MDIO bus init */
++ error = ravb_mdio_init(priv);
++ if (error) {
++ dev_err(&pdev->dev, "failed to initialize MDIO\n");
++ goto out_dma_free;
++ }
++
+ netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64);
+ netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64);
+
+@@ -2169,6 +2166,8 @@ static int ravb_probe(struct platform_device *pdev)
+ out_napi_del:
+ netif_napi_del(&priv->napi[RAVB_NC]);
+ netif_napi_del(&priv->napi[RAVB_BE]);
++ ravb_mdio_release(priv);
++out_dma_free:
+ dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
+ priv->desc_bat_dma);
+
+@@ -2200,6 +2199,7 @@ static int ravb_remove(struct platform_device *pdev)
+ unregister_netdev(ndev);
+ netif_napi_del(&priv->napi[RAVB_NC]);
+ netif_napi_del(&priv->napi[RAVB_BE]);
++ ravb_mdio_release(priv);
+ pm_runtime_disable(&pdev->dev);
+ free_netdev(ndev);
+ platform_set_drvdata(pdev, NULL);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+index 4d5fb4b51cc4f..5986fe927ad0b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+@@ -694,23 +694,16 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev,
+ struct stmmac_priv *priv = netdev_priv(dev);
+ int ret;
+
+- if (!edata->eee_enabled) {
++ if (!priv->dma_cap.eee)
++ return -EOPNOTSUPP;
++
++ if (!edata->eee_enabled)
+ stmmac_disable_eee_mode(priv);
+- } else {
+- /* We are asking for enabling the EEE but it is safe
+- * to verify all by invoking the eee_init function.
+- * In case of failure it will return an error.
+- */
+- edata->eee_enabled = stmmac_eee_init(priv);
+- if (!edata->eee_enabled)
+- return -EOPNOTSUPP;
+- }
+
+ ret = phy_ethtool_set_eee(dev->phydev, edata);
+ if (ret)
+ return ret;
+
+- priv->eee_enabled = edata->eee_enabled;
+ priv->tx_lpi_timer = edata->tx_lpi_timer;
+ return 0;
+ }
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 4ad3b877e5fd9..4c5b67a2d63a0 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -1085,6 +1085,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
+ struct macsec_rx_sa *rx_sa;
+ struct macsec_rxh_data *rxd;
+ struct macsec_dev *macsec;
++ unsigned int len;
+ sci_t sci;
+ u32 pn;
+ bool cbit;
+@@ -1240,9 +1241,10 @@ deliver:
+ macsec_rxsc_put(rx_sc);
+
+ skb_orphan(skb);
++ len = skb->len;
+ ret = gro_cells_receive(&macsec->gro_cells, skb);
+ if (ret == NET_RX_SUCCESS)
+- count_rx(dev, skb->len);
++ count_rx(dev, len);
+ else
+ macsec->secy.netdev->stats.rx_dropped++;
+
+diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
+index 1f5fd24cd749e..2386871e12949 100644
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -154,6 +154,7 @@ config MDIO_THUNDER
+ depends on 64BIT
+ depends on PCI
+ select MDIO_CAVIUM
++ select MDIO_DEVRES
+ help
+ This driver supports the MDIO interfaces found on Cavium
+ ThunderX SoCs when the MDIO bus device appears as a PCI
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 53d9562a8818b..3eb034a5a659b 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -294,7 +294,7 @@ inst_rollback:
+ for (i--; i >= 0; i--)
+ __team_option_inst_del_option(team, dst_opts[i]);
+
+- i = option_count - 1;
++ i = option_count;
+ alloc_rollback:
+ for (i--; i >= 0; i--)
+ kfree(dst_opts[i]);
+@@ -2086,6 +2086,7 @@ static void team_setup_by_port(struct net_device *dev,
+ dev->header_ops = port_dev->header_ops;
+ dev->type = port_dev->type;
+ dev->hard_header_len = port_dev->hard_header_len;
++ dev->needed_headroom = port_dev->needed_headroom;
+ dev->addr_len = port_dev->addr_len;
+ dev->mtu = port_dev->mtu;
+ memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len);
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index 8455f72007b9e..a9d0df435e266 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1735,6 +1735,7 @@ static const struct driver_info belkin_info = {
+ .status = ax88179_status,
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
++ .stop = ax88179_stop,
+ .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index 80373a9171dd2..933d1a74bcdb3 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -277,12 +277,20 @@ static int write_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 reg)
+ return 1;
+ }
+
+-static inline void set_ethernet_addr(rtl8150_t * dev)
++static void set_ethernet_addr(rtl8150_t *dev)
+ {
+- u8 node_id[6];
++ u8 node_id[ETH_ALEN];
++ int ret;
++
++ ret = get_registers(dev, IDR, sizeof(node_id), node_id);
+
+- get_registers(dev, IDR, sizeof(node_id), node_id);
+- memcpy(dev->netdev->dev_addr, node_id, sizeof(node_id));
++ if (ret == sizeof(node_id)) {
++ ether_addr_copy(dev->netdev->dev_addr, node_id);
++ } else {
++ eth_hw_addr_random(dev->netdev);
++ netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n",
++ dev->netdev->dev_addr);
++ }
+ }
+
+ static int rtl8150_set_mac_address(struct net_device *netdev, void *p)
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 9ea3d8e611005..b633ea40430ee 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2606,8 +2606,10 @@ static int nvme_dev_open(struct inode *inode, struct file *file)
+ }
+
+ nvme_get_ctrl(ctrl);
+- if (!try_module_get(ctrl->ops->module))
++ if (!try_module_get(ctrl->ops->module)) {
++ nvme_put_ctrl(ctrl);
+ return -EINVAL;
++ }
+
+ file->private_data = ctrl;
+ return 0;
+diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
+index 1e2524de6a63c..a13bb4ddd0cf1 100644
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -235,6 +235,7 @@ config FUJITSU_LAPTOP
+ depends on BACKLIGHT_CLASS_DEVICE
+ depends on ACPI_VIDEO || ACPI_VIDEO = n
+ select INPUT_SPARSEKMAP
++ select NEW_LEDS
+ select LEDS_CLASS
+ ---help---
+ This is a driver for laptops built by Fujitsu:
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index c7c8b432c163f..1e6b4661c7645 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -15,9 +15,13 @@
+ #include <linux/platform_device.h>
+ #include <linux/suspend.h>
+
++/* Returned when NOT in tablet mode on some HP Stream x360 11 models */
++#define VGBS_TABLET_MODE_FLAG_ALT 0x10
+ /* When NOT in tablet mode, VGBS returns with the flag 0x40 */
+-#define TABLET_MODE_FLAG 0x40
+-#define DOCK_MODE_FLAG 0x80
++#define VGBS_TABLET_MODE_FLAG 0x40
++#define VGBS_DOCK_MODE_FLAG 0x80
++
++#define VGBS_TABLET_MODE_FLAGS (VGBS_TABLET_MODE_FLAG | VGBS_TABLET_MODE_FLAG_ALT)
+
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("AceLan Kao");
+@@ -148,26 +152,60 @@ static void detect_tablet_mode(struct platform_device *device)
+ if (ACPI_FAILURE(status))
+ return;
+
+- m = !(vgbs & TABLET_MODE_FLAG);
++ m = !(vgbs & VGBS_TABLET_MODE_FLAGS);
+ input_report_switch(priv->input_dev, SW_TABLET_MODE, m);
+- m = (vgbs & DOCK_MODE_FLAG) ? 1 : 0;
++ m = (vgbs & VGBS_DOCK_MODE_FLAG) ? 1 : 0;
+ input_report_switch(priv->input_dev, SW_DOCK, m);
+ }
+
++/*
++ * There are several laptops (non 2-in-1) models out there which support VGBS,
++ * but simply always return 0, which we translate to SW_TABLET_MODE=1. This in
++ * turn causes userspace (libinput) to suppress events from the builtin
++ * keyboard and touchpad, making the laptop essentially unusable.
++ *
++ * Since the problem of wrongly reporting SW_TABLET_MODE=1 in combination
++ * with libinput, leads to a non-usable system. Where as OTOH many people will
++ * not even notice when SW_TABLET_MODE is not being reported, a DMI based allow
++ * list is used here. This list mainly matches on the chassis-type of 2-in-1s.
++ *
++ * There are also some 2-in-1s which use the intel-vbtn ACPI interface to report
++ * SW_TABLET_MODE with a chassis-type of 8 ("Portable") or 10 ("Notebook"),
++ * these are matched on a per model basis, since many normal laptops with a
++ * possible broken VGBS ACPI-method also use these chassis-types.
++ */
++static const struct dmi_system_id dmi_switches_allow_list[] = {
++ {
++ .matches = {
++ DMI_EXACT_MATCH(DMI_CHASSIS_TYPE, "31" /* Convertible */),
++ },
++ },
++ {
++ .matches = {
++ DMI_EXACT_MATCH(DMI_CHASSIS_TYPE, "32" /* Detachable */),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Venue 11 Pro 7130"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Stream x360 Convertible PC 11"),
++ },
++ },
++ {} /* Array terminator */
++};
++
+ static bool intel_vbtn_has_switches(acpi_handle handle)
+ {
+- const char *chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
+ unsigned long long vgbs;
+ acpi_status status;
+
+- /*
+- * Some normal laptops have a VGBS method despite being non-convertible
+- * and their VGBS method always returns 0, causing detect_tablet_mode()
+- * to report SW_TABLET_MODE=1 to userspace, which causes issues.
+- * These laptops have a DMI chassis_type of 9 ("Laptop"), do not report
+- * switches on any devices with a DMI chassis_type of 9.
+- */
+- if (chassis_type && strcmp(chassis_type, "9") == 0)
++ if (!dmi_check_system(dmi_switches_allow_list))
+ return false;
+
+ status = acpi_evaluate_integer(handle, "VGBS", NULL, &vgbs);
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 8f85bb4fe7844..98bd8213b0378 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -2597,7 +2597,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
+ */
+ static int hotkey_kthread(void *data)
+ {
+- struct tp_nvram_state s[2];
++ struct tp_nvram_state s[2] = { 0 };
+ u32 poll_mask, event_mask;
+ unsigned int si, so;
+ unsigned long t;
+@@ -6879,8 +6879,10 @@ static int __init tpacpi_query_bcl_levels(acpi_handle handle)
+ list_for_each_entry(child, &device->children, node) {
+ acpi_status status = acpi_evaluate_object(child->handle, "_BCL",
+ NULL, &buffer);
+- if (ACPI_FAILURE(status))
++ if (ACPI_FAILURE(status)) {
++ buffer.length = ACPI_ALLOCATE_BUFFER;
+ continue;
++ }
+
+ obj = (union acpi_object *)buffer.pointer;
+ if (!obj || (obj->type != ACPI_TYPE_PACKAGE)) {
+diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
+index cc2fb50431840..02b24ae8b9cb6 100644
+--- a/drivers/video/console/newport_con.c
++++ b/drivers/video/console/newport_con.c
+@@ -35,12 +35,6 @@
+
+ #define FONT_DATA ((unsigned char *)font_vga_8x16.data)
+
+-/* borrowed from fbcon.c */
+-#define REFCOUNT(fd) (((int *)(fd))[-1])
+-#define FNTSIZE(fd) (((int *)(fd))[-2])
+-#define FNTCHARCNT(fd) (((int *)(fd))[-3])
+-#define FONT_EXTRA_WORDS 3
+-
+ static unsigned char *font_data[MAX_NR_CONSOLES];
+
+ static struct newport_regs *npregs;
+@@ -522,6 +516,7 @@ static int newport_set_font(int unit, struct console_font *op)
+ FNTSIZE(new_data) = size;
+ FNTCHARCNT(new_data) = op->charcount;
+ REFCOUNT(new_data) = 0; /* usage counter */
++ FNTSUM(new_data) = 0;
+
+ p = new_data;
+ for (i = 0; i < op->charcount; i++) {
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 0bf5ea518558c..5742a0dc774e9 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -2270,6 +2270,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+
+ if (font->width <= 8) {
+ j = vc->vc_font.height;
++ if (font->charcount * j > FNTSIZE(fontdata))
++ return -EINVAL;
++
+ for (i = 0; i < font->charcount; i++) {
+ memcpy(data, fontdata, j);
+ memset(data + j, 0, 32 - j);
+@@ -2278,6 +2281,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ }
+ } else if (font->width <= 16) {
+ j = vc->vc_font.height * 2;
++ if (font->charcount * j > FNTSIZE(fontdata))
++ return -EINVAL;
++
+ for (i = 0; i < font->charcount; i++) {
+ memcpy(data, fontdata, j);
+ memset(data + j, 0, 64 - j);
+@@ -2285,6 +2291,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ fontdata += j;
+ }
+ } else if (font->width <= 24) {
++ if (font->charcount * (vc->vc_font.height * sizeof(u32)) > FNTSIZE(fontdata))
++ return -EINVAL;
++
+ for (i = 0; i < font->charcount; i++) {
+ for (j = 0; j < vc->vc_font.height; j++) {
+ *data++ = fontdata[0];
+@@ -2297,6 +2306,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ }
+ } else {
+ j = vc->vc_font.height * 4;
++ if (font->charcount * j > FNTSIZE(fontdata))
++ return -EINVAL;
++
+ for (i = 0; i < font->charcount; i++) {
+ memcpy(data, fontdata, j);
+ memset(data + j, 0, 128 - j);
+diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h
+index aeea63abbe987..c023009f29789 100644
+--- a/drivers/video/fbdev/core/fbcon.h
++++ b/drivers/video/fbdev/core/fbcon.h
+@@ -152,13 +152,6 @@ static inline int attr_col_ec(int shift, struct vc_data *vc,
+ #define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0)
+ #define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1)
+
+-/* Font */
+-#define REFCOUNT(fd) (((int *)(fd))[-1])
+-#define FNTSIZE(fd) (((int *)(fd))[-2])
+-#define FNTCHARCNT(fd) (((int *)(fd))[-3])
+-#define FNTSUM(fd) (((int *)(fd))[-4])
+-#define FONT_EXTRA_WORDS 4
+-
+ /*
+ * Scroll Method
+ */
+diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c
+index c0d445294aa7c..ac72d4f85f7d0 100644
+--- a/drivers/video/fbdev/core/fbcon_rotate.c
++++ b/drivers/video/fbdev/core/fbcon_rotate.c
+@@ -14,6 +14,7 @@
+ #include <linux/fb.h>
+ #include <linux/vt_kern.h>
+ #include <linux/console.h>
++#include <linux/font.h>
+ #include <asm/types.h>
+ #include "fbcon.h"
+ #include "fbcon_rotate.h"
+diff --git a/drivers/video/fbdev/core/tileblit.c b/drivers/video/fbdev/core/tileblit.c
+index eb664dbf96f66..adff8d6ffe6f9 100644
+--- a/drivers/video/fbdev/core/tileblit.c
++++ b/drivers/video/fbdev/core/tileblit.c
+@@ -13,6 +13,7 @@
+ #include <linux/fb.h>
+ #include <linux/vt_kern.h>
+ #include <linux/console.h>
++#include <linux/font.h>
+ #include <asm/types.h>
+ #include "fbcon.h"
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 947a40069d246..3d63c76ed0989 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -950,7 +950,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
+ return rc;
+ }
+
+- len = sizeof(ea) + ea_name_len + ea_value_len + 1;
++ len = sizeof(*ea) + ea_name_len + ea_value_len + 1;
+ ea = kzalloc(len, GFP_KERNEL);
+ if (ea == NULL) {
+ SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid);
+diff --git a/include/linux/font.h b/include/linux/font.h
+index d6821769dd1e1..f85e70bd4793e 100644
+--- a/include/linux/font.h
++++ b/include/linux/font.h
+@@ -57,4 +57,17 @@ extern const struct font_desc *get_default_font(int xres, int yres,
+ /* Max. length for the name of a predefined font */
+ #define MAX_FONT_NAME 32
+
++/* Extra word getters */
++#define REFCOUNT(fd) (((int *)(fd))[-1])
++#define FNTSIZE(fd) (((int *)(fd))[-2])
++#define FNTCHARCNT(fd) (((int *)(fd))[-3])
++#define FNTSUM(fd) (((int *)(fd))[-4])
++
++#define FONT_EXTRA_WORDS 4
++
++struct font_data {
++ unsigned int extra[FONT_EXTRA_WORDS];
++ const unsigned char data[];
++} __packed;
++
+ #endif /* _VIDEO_FONT_H */
+diff --git a/include/linux/khugepaged.h b/include/linux/khugepaged.h
+index 082d1d2a52169..dc9a2eecc8b80 100644
+--- a/include/linux/khugepaged.h
++++ b/include/linux/khugepaged.h
+@@ -15,6 +15,7 @@ extern int __khugepaged_enter(struct mm_struct *mm);
+ extern void __khugepaged_exit(struct mm_struct *mm);
+ extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
+ unsigned long vm_flags);
++extern void khugepaged_min_free_kbytes_update(void);
+
+ #define khugepaged_enabled() \
+ (transparent_hugepage_flags & \
+@@ -73,6 +74,10 @@ static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
+ {
+ return 0;
+ }
++
++static inline void khugepaged_min_free_kbytes_update(void)
++{
++}
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+
+ #endif /* _LINUX_KHUGEPAGED_H */
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index 3a0b5de742e9b..fe8bed557691a 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1873,21 +1873,17 @@ static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_es
+ static inline int xfrm_replay_clone(struct xfrm_state *x,
+ struct xfrm_state *orig)
+ {
+- x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
++
++ x->replay_esn = kmemdup(orig->replay_esn,
++ xfrm_replay_state_esn_len(orig->replay_esn),
+ GFP_KERNEL);
+ if (!x->replay_esn)
+ return -ENOMEM;
+-
+- x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
+- x->replay_esn->replay_window = orig->replay_esn->replay_window;
+-
+- x->preplay_esn = kmemdup(x->replay_esn,
+- xfrm_replay_state_esn_len(x->replay_esn),
++ x->preplay_esn = kmemdup(orig->preplay_esn,
++ xfrm_replay_state_esn_len(orig->preplay_esn),
+ GFP_KERNEL);
+- if (!x->preplay_esn) {
+- kfree(x->replay_esn);
++ if (!x->preplay_esn)
+ return -ENOMEM;
+- }
+
+ return 0;
+ }
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index a17e6302ded53..a35d742b0ba82 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -98,7 +98,7 @@ static void remote_function(void *data)
+ * retry due to any failures in smp_call_function_single(), such as if the
+ * task_cpu() goes offline concurrently.
+ *
+- * returns @func return value or -ESRCH when the process isn't running
++ * returns @func return value or -ESRCH or -ENXIO when the process isn't running
+ */
+ static int
+ task_function_call(struct task_struct *p, remote_function_f func, void *info)
+@@ -114,7 +114,8 @@ task_function_call(struct task_struct *p, remote_function_f func, void *info)
+ for (;;) {
+ ret = smp_call_function_single(task_cpu(p), remote_function,
+ &data, 1);
+- ret = !ret ? data.ret : -EAGAIN;
++ if (!ret)
++ ret = data.ret;
+
+ if (ret != -EAGAIN)
+ break;
+diff --git a/kernel/umh.c b/kernel/umh.c
+index 52a9084f85419..16653319c8ce8 100644
+--- a/kernel/umh.c
++++ b/kernel/umh.c
+@@ -13,6 +13,7 @@
+ #include <linux/cred.h>
+ #include <linux/file.h>
+ #include <linux/fdtable.h>
++#include <linux/fs_struct.h>
+ #include <linux/workqueue.h>
+ #include <linux/security.h>
+ #include <linux/mount.h>
+@@ -72,6 +73,14 @@ static int call_usermodehelper_exec_async(void *data)
+ flush_signal_handlers(current, 1);
+ spin_unlock_irq(¤t->sighand->siglock);
+
++ /*
++ * Initial kernel threads share ther FS with init, in order to
++ * get the init root directory. But we've now created a new
++ * thread that is going to execve a user process and has its own
++ * 'struct fs_struct'. Reset umask to the default.
++ */
++ current->fs->umask = 0022;
++
+ /*
+ * Our parent (unbound workqueue) runs with elevated scheduling
+ * priority. Avoid propagating that into the userspace child.
+diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c
+index 532f0ff89a962..0e2deac97da0d 100644
+--- a/lib/fonts/font_10x18.c
++++ b/lib/fonts/font_10x18.c
+@@ -8,8 +8,8 @@
+
+ #define FONTDATAMAX 9216
+
+-static const unsigned char fontdata_10x18[FONTDATAMAX] = {
+-
++static struct font_data fontdata_10x18 = {
++ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, 0x00, /* 0000000000 */
+ 0x00, 0x00, /* 0000000000 */
+@@ -5129,8 +5129,7 @@ static const unsigned char fontdata_10x18[FONTDATAMAX] = {
+ 0x00, 0x00, /* 0000000000 */
+ 0x00, 0x00, /* 0000000000 */
+ 0x00, 0x00, /* 0000000000 */
+-
+-};
++} };
+
+
+ const struct font_desc font_10x18 = {
+@@ -5138,7 +5137,7 @@ const struct font_desc font_10x18 = {
+ .name = "10x18",
+ .width = 10,
+ .height = 18,
+- .data = fontdata_10x18,
++ .data = fontdata_10x18.data,
+ #ifdef __sparc__
+ .pref = 5,
+ #else
+diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c
+index 09b2cc03435b9..87da8acd07db0 100644
+--- a/lib/fonts/font_6x10.c
++++ b/lib/fonts/font_6x10.c
+@@ -1,8 +1,10 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include <linux/font.h>
+
+-static const unsigned char fontdata_6x10[] = {
++#define FONTDATAMAX 2560
+
++static struct font_data fontdata_6x10 = {
++ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+@@ -3074,14 +3076,13 @@ static const unsigned char fontdata_6x10[] = {
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+-
+-};
++} };
+
+ const struct font_desc font_6x10 = {
+ .idx = FONT6x10_IDX,
+ .name = "6x10",
+ .width = 6,
+ .height = 10,
+- .data = fontdata_6x10,
++ .data = fontdata_6x10.data,
+ .pref = 0,
+ };
+diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c
+index d7136c33f1f01..5e975dfa10a53 100644
+--- a/lib/fonts/font_6x11.c
++++ b/lib/fonts/font_6x11.c
+@@ -9,8 +9,8 @@
+
+ #define FONTDATAMAX (11*256)
+
+-static const unsigned char fontdata_6x11[FONTDATAMAX] = {
+-
++static struct font_data fontdata_6x11 = {
++ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+@@ -3338,8 +3338,7 @@ static const unsigned char fontdata_6x11[FONTDATAMAX] = {
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+-
+-};
++} };
+
+
+ const struct font_desc font_vga_6x11 = {
+@@ -3347,7 +3346,7 @@ const struct font_desc font_vga_6x11 = {
+ .name = "ProFont6x11",
+ .width = 6,
+ .height = 11,
+- .data = fontdata_6x11,
++ .data = fontdata_6x11.data,
+ /* Try avoiding this font if possible unless on MAC */
+ .pref = -2000,
+ };
+diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c
+index 89752d0b23e8b..86d298f385058 100644
+--- a/lib/fonts/font_7x14.c
++++ b/lib/fonts/font_7x14.c
+@@ -8,8 +8,8 @@
+
+ #define FONTDATAMAX 3584
+
+-static const unsigned char fontdata_7x14[FONTDATAMAX] = {
+-
++static struct font_data fontdata_7x14 = {
++ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 0000000 */
+ 0x00, /* 0000000 */
+@@ -4105,8 +4105,7 @@ static const unsigned char fontdata_7x14[FONTDATAMAX] = {
+ 0x00, /* 0000000 */
+ 0x00, /* 0000000 */
+ 0x00, /* 0000000 */
+-
+-};
++} };
+
+
+ const struct font_desc font_7x14 = {
+@@ -4114,6 +4113,6 @@ const struct font_desc font_7x14 = {
+ .name = "7x14",
+ .width = 7,
+ .height = 14,
+- .data = fontdata_7x14,
++ .data = fontdata_7x14.data,
+ .pref = 0,
+ };
+diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c
+index b7ab1f5fbdb8a..37cedd36ca5ef 100644
+--- a/lib/fonts/font_8x16.c
++++ b/lib/fonts/font_8x16.c
+@@ -10,8 +10,8 @@
+
+ #define FONTDATAMAX 4096
+
+-static const unsigned char fontdata_8x16[FONTDATAMAX] = {
+-
++static struct font_data fontdata_8x16 = {
++ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+@@ -4619,8 +4619,7 @@ static const unsigned char fontdata_8x16[FONTDATAMAX] = {
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+-
+-};
++} };
+
+
+ const struct font_desc font_vga_8x16 = {
+@@ -4628,7 +4627,7 @@ const struct font_desc font_vga_8x16 = {
+ .name = "VGA8x16",
+ .width = 8,
+ .height = 16,
+- .data = fontdata_8x16,
++ .data = fontdata_8x16.data,
+ .pref = 0,
+ };
+ EXPORT_SYMBOL(font_vga_8x16);
+diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c
+index 2328ebc8bab5d..8ab695538395d 100644
+--- a/lib/fonts/font_8x8.c
++++ b/lib/fonts/font_8x8.c
+@@ -9,8 +9,8 @@
+
+ #define FONTDATAMAX 2048
+
+-static const unsigned char fontdata_8x8[FONTDATAMAX] = {
+-
++static struct font_data fontdata_8x8 = {
++ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+@@ -2570,8 +2570,7 @@ static const unsigned char fontdata_8x8[FONTDATAMAX] = {
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+-
+-};
++} };
+
+
+ const struct font_desc font_vga_8x8 = {
+@@ -2579,6 +2578,6 @@ const struct font_desc font_vga_8x8 = {
+ .name = "VGA8x8",
+ .width = 8,
+ .height = 8,
+- .data = fontdata_8x8,
++ .data = fontdata_8x8.data,
+ .pref = 0,
+ };
+diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c
+index 0ff0e85d4481b..069b3e80c4344 100644
+--- a/lib/fonts/font_acorn_8x8.c
++++ b/lib/fonts/font_acorn_8x8.c
+@@ -3,7 +3,10 @@
+
+ #include <linux/font.h>
+
+-static const unsigned char acorndata_8x8[] = {
++#define FONTDATAMAX 2048
++
++static struct font_data acorndata_8x8 = {
++{ 0, 0, FONTDATAMAX, 0 }, {
+ /* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */
+ /* 01 */ 0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */
+ /* 02 */ 0x7e, 0xff, 0xbd, 0xff, 0xc3, 0xe7, 0xff, 0x7e, /* ^B */
+@@ -260,14 +263,14 @@ static const unsigned char acorndata_8x8[] = {
+ /* FD */ 0x38, 0x04, 0x18, 0x20, 0x3c, 0x00, 0x00, 0x00,
+ /* FE */ 0x00, 0x00, 0x3c, 0x3c, 0x3c, 0x3c, 0x00, 0x00,
+ /* FF */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+-};
++} };
+
+ const struct font_desc font_acorn_8x8 = {
+ .idx = ACORN8x8_IDX,
+ .name = "Acorn8x8",
+ .width = 8,
+ .height = 8,
+- .data = acorndata_8x8,
++ .data = acorndata_8x8.data,
+ #ifdef CONFIG_ARCH_ACORN
+ .pref = 20,
+ #else
+diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c
+index 838caa1cfef70..1449876c6a270 100644
+--- a/lib/fonts/font_mini_4x6.c
++++ b/lib/fonts/font_mini_4x6.c
+@@ -43,8 +43,8 @@ __END__;
+
+ #define FONTDATAMAX 1536
+
+-static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
+-
++static struct font_data fontdata_mini_4x6 = {
++ { 0, 0, FONTDATAMAX, 0 }, {
+ /*{*/
+ /* Char 0: ' ' */
+ 0xee, /*= [*** ] */
+@@ -2145,14 +2145,14 @@ static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
+ 0xee, /*= [*** ] */
+ 0x00, /*= [ ] */
+ /*}*/
+-};
++} };
+
+ const struct font_desc font_mini_4x6 = {
+ .idx = MINI4x6_IDX,
+ .name = "MINI4x6",
+ .width = 4,
+ .height = 6,
+- .data = fontdata_mini_4x6,
++ .data = fontdata_mini_4x6.data,
+ .pref = 3,
+ };
+
+diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c
+index b15d3c342c5bb..32d65551e7ed2 100644
+--- a/lib/fonts/font_pearl_8x8.c
++++ b/lib/fonts/font_pearl_8x8.c
+@@ -14,8 +14,8 @@
+
+ #define FONTDATAMAX 2048
+
+-static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
+-
++static struct font_data fontdata_pearl8x8 = {
++ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+@@ -2575,14 +2575,13 @@ static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+ 0x00, /* 00000000 */
+-
+-};
++} };
+
+ const struct font_desc font_pearl_8x8 = {
+ .idx = PEARL8x8_IDX,
+ .name = "PEARL8x8",
+ .width = 8,
+ .height = 8,
+- .data = fontdata_pearl8x8,
++ .data = fontdata_pearl8x8.data,
+ .pref = 2,
+ };
+diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c
+index 955d6eee3959d..641a6b4dca424 100644
+--- a/lib/fonts/font_sun12x22.c
++++ b/lib/fonts/font_sun12x22.c
+@@ -3,8 +3,8 @@
+
+ #define FONTDATAMAX 11264
+
+-static const unsigned char fontdata_sun12x22[FONTDATAMAX] = {
+-
++static struct font_data fontdata_sun12x22 = {
++ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, 0x00, /* 000000000000 */
+ 0x00, 0x00, /* 000000000000 */
+@@ -6148,8 +6148,7 @@ static const unsigned char fontdata_sun12x22[FONTDATAMAX] = {
+ 0x00, 0x00, /* 000000000000 */
+ 0x00, 0x00, /* 000000000000 */
+ 0x00, 0x00, /* 000000000000 */
+-
+-};
++} };
+
+
+ const struct font_desc font_sun_12x22 = {
+@@ -6157,7 +6156,7 @@ const struct font_desc font_sun_12x22 = {
+ .name = "SUN12x22",
+ .width = 12,
+ .height = 22,
+- .data = fontdata_sun12x22,
++ .data = fontdata_sun12x22.data,
+ #ifdef __sparc__
+ .pref = 5,
+ #else
+diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c
+index 03d71e53954ab..193fe6d988e08 100644
+--- a/lib/fonts/font_sun8x16.c
++++ b/lib/fonts/font_sun8x16.c
+@@ -3,7 +3,8 @@
+
+ #define FONTDATAMAX 4096
+
+-static const unsigned char fontdata_sun8x16[FONTDATAMAX] = {
++static struct font_data fontdata_sun8x16 = {
++{ 0, 0, FONTDATAMAX, 0 }, {
+ /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x7e,0xff,0xdb,0xff,0xff,0xc3,0xe7,0xff,0xff,0x7e,0x00,0x00,0x00,0x00,
+@@ -260,14 +261,14 @@ static const unsigned char fontdata_sun8x16[FONTDATAMAX] = {
+ /* */ 0x00,0x70,0xd8,0x30,0x60,0xc8,0xf8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x00,0x00,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+-};
++} };
+
+ const struct font_desc font_sun_8x16 = {
+ .idx = SUN8x16_IDX,
+ .name = "SUN8x16",
+ .width = 8,
+ .height = 16,
+- .data = fontdata_sun8x16,
++ .data = fontdata_sun8x16.data,
+ #ifdef __sparc__
+ .pref = 10,
+ #else
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index f37be43f8caeb..9c7dc2276156b 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -53,6 +53,9 @@ enum scan_result {
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/huge_memory.h>
+
++static struct task_struct *khugepaged_thread __read_mostly;
++static DEFINE_MUTEX(khugepaged_mutex);
++
+ /* default scan 8*512 pte (or vmas) every 30 second */
+ static unsigned int khugepaged_pages_to_scan __read_mostly;
+ static unsigned int khugepaged_pages_collapsed;
+@@ -820,6 +823,18 @@ static struct page *khugepaged_alloc_hugepage(bool *wait)
+
+ static bool khugepaged_prealloc_page(struct page **hpage, bool *wait)
+ {
++ /*
++ * If the hpage allocated earlier was briefly exposed in page cache
++ * before collapse_file() failed, it is possible that racing lookups
++ * have not yet completed, and would then be unpleasantly surprised by
++ * finding the hpage reused for the same mapping at a different offset.
++ * Just release the previous allocation if there is any danger of that.
++ */
++ if (*hpage && page_count(*hpage) > 1) {
++ put_page(*hpage);
++ *hpage = NULL;
++ }
++
+ if (!*hpage)
+ *hpage = khugepaged_alloc_hugepage(wait);
+
+@@ -1940,8 +1955,6 @@ static void set_recommended_min_free_kbytes(void)
+
+ int start_stop_khugepaged(void)
+ {
+- static struct task_struct *khugepaged_thread __read_mostly;
+- static DEFINE_MUTEX(khugepaged_mutex);
+ int err = 0;
+
+ mutex_lock(&khugepaged_mutex);
+@@ -1968,3 +1981,11 @@ fail:
+ mutex_unlock(&khugepaged_mutex);
+ return err;
+ }
++
++void khugepaged_min_free_kbytes_update(void)
++{
++ mutex_lock(&khugepaged_mutex);
++ if (khugepaged_enabled() && khugepaged_thread)
++ set_recommended_min_free_kbytes();
++ mutex_unlock(&khugepaged_mutex);
++}
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 545800433dfba..4325e7d581155 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -66,6 +66,7 @@
+ #include <linux/ftrace.h>
+ #include <linux/lockdep.h>
+ #include <linux/nmi.h>
++#include <linux/khugepaged.h>
+
+ #include <asm/sections.h>
+ #include <asm/tlbflush.h>
+@@ -7399,6 +7400,8 @@ int __meminit init_per_zone_wmark_min(void)
+ setup_min_slab_ratio();
+ #endif
+
++ khugepaged_min_free_kbytes_update();
++
+ return 0;
+ }
+ postcore_initcall(init_per_zone_wmark_min)
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index f8e073ef1a671..fb13fcfedaf4f 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -899,15 +899,19 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
+ }
+ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype);
+
+- if (err == NF_ACCEPT &&
+- ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) {
+- if (maniptype == NF_NAT_MANIP_SRC)
+- maniptype = NF_NAT_MANIP_DST;
+- else
+- maniptype = NF_NAT_MANIP_SRC;
+-
+- err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
+- maniptype);
++ if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
++ if (ct->status & IPS_SRC_NAT) {
++ if (maniptype == NF_NAT_MANIP_SRC)
++ maniptype = NF_NAT_MANIP_DST;
++ else
++ maniptype = NF_NAT_MANIP_SRC;
++
++ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
++ maniptype);
++ } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
++ err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL,
++ NF_NAT_MANIP_SRC);
++ }
+ }
+
+ /* Mark NAT done if successful and update the flow key. */
+diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
+index 126154a97a592..04213afd7710f 100644
+--- a/net/rxrpc/conn_event.c
++++ b/net/rxrpc/conn_event.c
+@@ -342,18 +342,18 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
+ return ret;
+
+ spin_lock(&conn->channel_lock);
+- spin_lock(&conn->state_lock);
++ spin_lock_bh(&conn->state_lock);
+
+ if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) {
+ conn->state = RXRPC_CONN_SERVICE;
+- spin_unlock(&conn->state_lock);
++ spin_unlock_bh(&conn->state_lock);
+ for (loop = 0; loop < RXRPC_MAXCALLS; loop++)
+ rxrpc_call_is_secure(
+ rcu_dereference_protected(
+ conn->channels[loop].call,
+ lockdep_is_held(&conn->channel_lock)));
+ } else {
+- spin_unlock(&conn->state_lock);
++ spin_unlock_bh(&conn->state_lock);
+ }
+
+ spin_unlock(&conn->channel_lock);
+diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
+index ad9d1b21cb0ba..2fe2add62a8ed 100644
+--- a/net/rxrpc/key.c
++++ b/net/rxrpc/key.c
+@@ -905,7 +905,7 @@ int rxrpc_request_key(struct rxrpc_sock *rx, char __user *optval, int optlen)
+
+ _enter("");
+
+- if (optlen <= 0 || optlen > PAGE_SIZE - 1)
++ if (optlen <= 0 || optlen > PAGE_SIZE - 1 || rx->securities)
+ return -EINVAL;
+
+ description = memdup_user_nul(optval, optlen);
+@@ -1075,7 +1075,7 @@ static long rxrpc_read(const struct key *key,
+
+ switch (token->security_index) {
+ case RXRPC_SECURITY_RXKAD:
+- toksize += 9 * 4; /* viceid, kvno, key*2 + len, begin,
++ toksize += 8 * 4; /* viceid, kvno, key*2, begin,
+ * end, primary, tktlen */
+ toksize += RND(token->kad->ticket_len);
+ break;
+@@ -1110,7 +1110,8 @@ static long rxrpc_read(const struct key *key,
+ break;
+
+ default: /* we have a ticket we can't encode */
+- BUG();
++ pr_err("Unsupported key token type (%u)\n",
++ token->security_index);
+ continue;
+ }
+
+@@ -1141,6 +1142,14 @@ static long rxrpc_read(const struct key *key,
+ memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3)); \
+ xdr += (_l + 3) >> 2; \
+ } while(0)
++#define ENCODE_BYTES(l, s) \
++ do { \
++ u32 _l = (l); \
++ memcpy(xdr, (s), _l); \
++ if (_l & 3) \
++ memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3)); \
++ xdr += (_l + 3) >> 2; \
++ } while(0)
+ #define ENCODE64(x) \
+ do { \
+ __be64 y = cpu_to_be64(x); \
+@@ -1168,7 +1177,7 @@ static long rxrpc_read(const struct key *key,
+ case RXRPC_SECURITY_RXKAD:
+ ENCODE(token->kad->vice_id);
+ ENCODE(token->kad->kvno);
+- ENCODE_DATA(8, token->kad->session_key);
++ ENCODE_BYTES(8, token->kad->session_key);
+ ENCODE(token->kad->start);
+ ENCODE(token->kad->expiry);
+ ENCODE(token->kad->primary_flag);
+@@ -1218,7 +1227,6 @@ static long rxrpc_read(const struct key *key,
+ break;
+
+ default:
+- BUG();
+ break;
+ }
+
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index 5b537613946fc..2bd8c80bd85fb 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -515,6 +515,7 @@ int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
+ out_err:
+ /* Clean up any successful allocations */
+ sctp_auth_destroy_hmacs(ep->auth_hmacs);
++ ep->auth_hmacs = NULL;
+ return -ENOMEM;
+ }
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 996b68b48a878..4e41792099822 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3621,6 +3621,9 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
+ if (err)
+ return err;
+
++ if (key.idx < 0)
++ return -EINVAL;
++
+ if (info->attrs[NL80211_ATTR_MAC])
+ mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 6f00f88adab90..6cc9f6e2dd2b7 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -293,7 +293,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ }
+
+ mtu = dst_mtu(dst);
+- if (!skb->ignore_df && skb->len > mtu) {
++ if (skb->len > mtu) {
+ skb_dst_update_pmtu_no_confirm(skb, mtu);
+
+ if (skb->protocol == htons(ETH_P_IPV6)) {
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 47a8ff972a2bf..a649d7c2f48ca 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -923,7 +923,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
+ */
+ if (x->km.state == XFRM_STATE_VALID) {
+ if ((x->sel.family &&
+- !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
++ (x->sel.family != family ||
++ !xfrm_selector_match(&x->sel, fl, family))) ||
+ !security_xfrm_state_pol_flow_match(x, pol, fl))
+ return;
+
+@@ -936,7 +937,9 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
+ *acq_in_progress = 1;
+ } else if (x->km.state == XFRM_STATE_ERROR ||
+ x->km.state == XFRM_STATE_EXPIRED) {
+- if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
++ if ((!x->sel.family ||
++ (x->sel.family == family &&
++ xfrm_selector_match(&x->sel, fl, family))) &&
+ security_xfrm_state_pol_flow_match(x, pol, fl))
+ *error = -ESRCH;
+ }
+@@ -976,7 +979,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
+ tmpl->mode == x->props.mode &&
+ tmpl->id.proto == x->id.proto &&
+ (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
+- xfrm_state_look_at(pol, x, fl, encap_family,
++ xfrm_state_look_at(pol, x, fl, family,
+ &best, &acquire_in_progress, &error);
+ }
+ if (best || acquire_in_progress)
+@@ -993,7 +996,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
+ tmpl->mode == x->props.mode &&
+ tmpl->id.proto == x->id.proto &&
+ (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
+- xfrm_state_look_at(pol, x, fl, encap_family,
++ xfrm_state_look_at(pol, x, fl, family,
+ &best, &acquire_in_progress, &error);
+ }
+
+@@ -1341,6 +1344,30 @@ out:
+ EXPORT_SYMBOL(xfrm_state_add);
+
+ #ifdef CONFIG_XFRM_MIGRATE
++static inline int clone_security(struct xfrm_state *x, struct xfrm_sec_ctx *security)
++{
++ struct xfrm_user_sec_ctx *uctx;
++ int size = sizeof(*uctx) + security->ctx_len;
++ int err;
++
++ uctx = kmalloc(size, GFP_KERNEL);
++ if (!uctx)
++ return -ENOMEM;
++
++ uctx->exttype = XFRMA_SEC_CTX;
++ uctx->len = size;
++ uctx->ctx_doi = security->ctx_doi;
++ uctx->ctx_alg = security->ctx_alg;
++ uctx->ctx_len = security->ctx_len;
++ memcpy(uctx + 1, security->ctx_str, security->ctx_len);
++ err = security_xfrm_state_alloc(x, uctx);
++ kfree(uctx);
++ if (err)
++ return err;
++
++ return 0;
++}
++
+ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
+ struct xfrm_encap_tmpl *encap)
+ {
+@@ -1397,6 +1424,10 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
+ goto error;
+ }
+
++ if (orig->security)
++ if (clone_security(x, orig->security))
++ goto error;
++
+ if (orig->coaddr) {
+ x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
+ GFP_KERNEL);
+@@ -1410,6 +1441,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
+ }
+
+ memcpy(&x->mark, &orig->mark, sizeof(x->mark));
++ memcpy(&x->props.smark, &orig->props.smark, sizeof(x->props.smark));
+
+ if (xfrm_init_state(x) < 0)
+ goto error;
+@@ -1421,7 +1453,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
+ x->tfcpad = orig->tfcpad;
+ x->replay_maxdiff = orig->replay_maxdiff;
+ x->replay_maxage = orig->replay_maxage;
+- x->curlft.add_time = orig->curlft.add_time;
++ memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft));
+ x->km.state = orig->km.state;
+ x->km.seq = orig->km.seq;
+ x->replay = orig->replay;
+diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
+index d0733251a386e..9caab84c6294d 100644
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -651,7 +651,9 @@ repeat:
+ delay_msecs = top->delay_secs * MSEC_PER_SEC;
+ set_term_quiet_input(&save);
+ /* trash return*/
+- getc(stdin);
++ clearerr(stdin);
++ if (poll(&stdin_poll, 1, 0) > 0)
++ getc(stdin);
+
+ while (!done) {
+ perf_top__print_sym_table(top);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-10-17 10:17 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-10-17 10:17 UTC (permalink / raw
To: gentoo-commits
commit: fe459960788d36773dd2c0b329ceee5a0f8dc400
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 17 10:17:34 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Oct 17 10:17:34 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=fe459960
Linux patch 4.19.152
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1151_linux-4.19.152.patch | 739 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 743 insertions(+)
diff --git a/0000_README b/0000_README
index 7427668..ddccc76 100644
--- a/0000_README
+++ b/0000_README
@@ -643,6 +643,10 @@ Patch: 1150_linux-4.19.151.patch
From: https://www.kernel.org
Desc: Linux 4.19.151
+Patch: 1151_linux-4.19.152.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.152
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1151_linux-4.19.152.patch b/1151_linux-4.19.152.patch
new file mode 100644
index 0000000..2735545
--- /dev/null
+++ b/1151_linux-4.19.152.patch
@@ -0,0 +1,739 @@
+diff --git a/Makefile b/Makefile
+index f2c9db9b4015a..aa79ce7bfdc73 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 151
++SUBLEVEL = 152
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
+index 1f5a5ffe7fcf8..c762004572eff 100644
+--- a/arch/arm/boot/compressed/Makefile
++++ b/arch/arm/boot/compressed/Makefile
+@@ -120,7 +120,7 @@ ccflags-y := -fpic $(call cc-option,-mno-single-pic-base,) -fno-builtin -I$(obj)
+ asflags-y := -DZIMAGE
+
+ # Supply kernel BSS size to the decompressor via a linker symbol.
+-KBSS_SZ = $(shell echo $$(($$($(CROSS_COMPILE)nm $(obj)/../../../../vmlinux | \
++KBSS_SZ = $(shell echo $$(($$($(NM) $(obj)/../../../../vmlinux | \
+ sed -n -e 's/^\([^ ]*\) [AB] __bss_start$$/-0x\1/p' \
+ -e 's/^\([^ ]*\) [AB] __bss_stop$$/+0x\1/p') )) )
+ LDFLAGS_vmlinux = --defsym _kernel_bss_size=$(KBSS_SZ)
+@@ -166,7 +166,7 @@ $(obj)/bswapsdi2.S: $(srctree)/arch/$(SRCARCH)/lib/bswapsdi2.S
+ # The .data section is already discarded by the linker script so no need
+ # to bother about it here.
+ check_for_bad_syms = \
+-bad_syms=$$($(CROSS_COMPILE)nm $@ | sed -n 's/^.\{8\} [bc] \(.*\)/\1/p') && \
++bad_syms=$$($(NM) $@ | sed -n 's/^.\{8\} [bc] \(.*\)/\1/p') && \
+ [ -z "$$bad_syms" ] || \
+ ( echo "following symbols must have non local/private scope:" >&2; \
+ echo "$$bad_syms" >&2; rm -f $@; false )
+diff --git a/arch/arm/vdso/Makefile b/arch/arm/vdso/Makefile
+index f4efff9d3afbb..1f5ec9741e6d4 100644
+--- a/arch/arm/vdso/Makefile
++++ b/arch/arm/vdso/Makefile
+@@ -10,12 +10,13 @@ obj-vdso := $(addprefix $(obj)/, $(obj-vdso))
+ ccflags-y := -fPIC -fno-common -fno-builtin -fno-stack-protector
+ ccflags-y += -DDISABLE_BRANCH_PROFILING
+
+-VDSO_LDFLAGS := -Wl,-Bsymbolic -Wl,--no-undefined -Wl,-soname=linux-vdso.so.1
+-VDSO_LDFLAGS += -Wl,-z,max-page-size=4096 -Wl,-z,common-page-size=4096
+-VDSO_LDFLAGS += -nostdlib -shared
+-VDSO_LDFLAGS += $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
+-VDSO_LDFLAGS += $(call cc-ldoption, -Wl$(comma)--build-id)
+-VDSO_LDFLAGS += $(call cc-ldoption, -fuse-ld=bfd)
++ldflags-$(CONFIG_CPU_ENDIAN_BE8) := --be8
++ldflags-y := -Bsymbolic --no-undefined -soname=linux-vdso.so.1 \
++ -z max-page-size=4096 -z common-page-size=4096 \
++ -nostdlib -shared $(ldflags-y) \
++ $(call ld-option, --hash-style=sysv) \
++ $(call ld-option, --build-id) \
++ -T
+
+ obj-$(CONFIG_VDSO) += vdso.o
+ extra-$(CONFIG_VDSO) += vdso.lds
+@@ -37,8 +38,8 @@ KCOV_INSTRUMENT := n
+ $(obj)/vdso.o : $(obj)/vdso.so
+
+ # Link rule for the .so file
+-$(obj)/vdso.so.raw: $(src)/vdso.lds $(obj-vdso) FORCE
+- $(call if_changed,vdsold)
++$(obj)/vdso.so.raw: $(obj)/vdso.lds $(obj-vdso) FORCE
++ $(call if_changed,ld)
+
+ $(obj)/vdso.so.dbg: $(obj)/vdso.so.raw $(obj)/vdsomunge FORCE
+ $(call if_changed,vdsomunge)
+@@ -48,11 +49,6 @@ $(obj)/%.so: OBJCOPYFLAGS := -S
+ $(obj)/%.so: $(obj)/%.so.dbg FORCE
+ $(call if_changed,objcopy)
+
+-# Actual build commands
+-quiet_cmd_vdsold = VDSO $@
+- cmd_vdsold = $(CC) $(c_flags) $(VDSO_LDFLAGS) \
+- -Wl,-T $(filter %.lds,$^) $(filter %.o,$^) -o $@
+-
+ quiet_cmd_vdsomunge = MUNGE $@
+ cmd_vdsomunge = $(objtree)/$(obj)/vdsomunge $< $@
+
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index 0b1fc5664b1d8..c2736274ad634 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -2980,7 +2980,6 @@ static int aead_gcm_ccm_setkey(struct crypto_aead *cipher,
+
+ ctx->enckeylen = keylen;
+ ctx->authkeylen = 0;
+- memcpy(ctx->enckey, key, ctx->enckeylen);
+
+ switch (ctx->enckeylen) {
+ case AES_KEYSIZE_128:
+@@ -2996,6 +2995,8 @@ static int aead_gcm_ccm_setkey(struct crypto_aead *cipher,
+ goto badkey;
+ }
+
++ memcpy(ctx->enckey, key, ctx->enckeylen);
++
+ flow_log(" enckeylen:%u authkeylen:%u\n", ctx->enckeylen,
+ ctx->authkeylen);
+ flow_dump(" enc: ", ctx->enckey, ctx->enckeylen);
+@@ -3056,6 +3057,10 @@ static int aead_gcm_esp_setkey(struct crypto_aead *cipher,
+ struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher);
+
+ flow_log("%s\n", __func__);
++
++ if (keylen < GCM_ESP_SALT_SIZE)
++ return -EINVAL;
++
+ ctx->salt_len = GCM_ESP_SALT_SIZE;
+ ctx->salt_offset = GCM_ESP_SALT_OFFSET;
+ memcpy(ctx->salt, key + keylen - GCM_ESP_SALT_SIZE, GCM_ESP_SALT_SIZE);
+@@ -3084,6 +3089,10 @@ static int rfc4543_gcm_esp_setkey(struct crypto_aead *cipher,
+ struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher);
+
+ flow_log("%s\n", __func__);
++
++ if (keylen < GCM_ESP_SALT_SIZE)
++ return -EINVAL;
++
+ ctx->salt_len = GCM_ESP_SALT_SIZE;
+ ctx->salt_offset = GCM_ESP_SALT_OFFSET;
+ memcpy(ctx->salt, key + keylen - GCM_ESP_SALT_SIZE, GCM_ESP_SALT_SIZE);
+@@ -3113,6 +3122,10 @@ static int aead_ccm_esp_setkey(struct crypto_aead *cipher,
+ struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher);
+
+ flow_log("%s\n", __func__);
++
++ if (keylen < CCM_ESP_SALT_SIZE)
++ return -EINVAL;
++
+ ctx->salt_len = CCM_ESP_SALT_SIZE;
+ ctx->salt_offset = CCM_ESP_SALT_OFFSET;
+ memcpy(ctx->salt, key + keylen - CCM_ESP_SALT_SIZE, CCM_ESP_SALT_SIZE);
+diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
+index 1138e41d68059..883342a45be7f 100644
+--- a/drivers/crypto/qat/qat_common/qat_algs.c
++++ b/drivers/crypto/qat/qat_common/qat_algs.c
+@@ -828,6 +828,11 @@ static int qat_alg_aead_dec(struct aead_request *areq)
+ struct icp_qat_fw_la_bulk_req *msg;
+ int digst_size = crypto_aead_authsize(aead_tfm);
+ int ret, ctr = 0;
++ u32 cipher_len;
++
++ cipher_len = areq->cryptlen - digst_size;
++ if (cipher_len % AES_BLOCK_SIZE != 0)
++ return -EINVAL;
+
+ ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req);
+ if (unlikely(ret))
+@@ -842,7 +847,7 @@ static int qat_alg_aead_dec(struct aead_request *areq)
+ qat_req->req.comn_mid.src_data_addr = qat_req->buf.blp;
+ qat_req->req.comn_mid.dest_data_addr = qat_req->buf.bloutp;
+ cipher_param = (void *)&qat_req->req.serv_specif_rqpars;
+- cipher_param->cipher_length = areq->cryptlen - digst_size;
++ cipher_param->cipher_length = cipher_len;
+ cipher_param->cipher_offset = areq->assoclen;
+ memcpy(cipher_param->u.cipher_IV_array, areq->iv, AES_BLOCK_SIZE);
+ auth_param = (void *)((uint8_t *)cipher_param + sizeof(*cipher_param));
+@@ -871,6 +876,9 @@ static int qat_alg_aead_enc(struct aead_request *areq)
+ uint8_t *iv = areq->iv;
+ int ret, ctr = 0;
+
++ if (areq->cryptlen % AES_BLOCK_SIZE != 0)
++ return -EINVAL;
++
+ ret = qat_alg_sgl_to_bufl(ctx->inst, areq->src, areq->dst, qat_req);
+ if (unlikely(ret))
+ return ret;
+diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
+index ee9c656d121f1..2308c0b4f5e7e 100644
+--- a/drivers/media/usb/usbtv/usbtv-core.c
++++ b/drivers/media/usb/usbtv/usbtv-core.c
+@@ -113,7 +113,8 @@ static int usbtv_probe(struct usb_interface *intf,
+
+ usbtv_audio_fail:
+ /* we must not free at this point */
+- usb_get_dev(usbtv->udev);
++ v4l2_device_get(&usbtv->v4l2_dev);
++ /* this will undo the v4l2_device_get() */
+ usbtv_video_free(usbtv);
+
+ usbtv_video_fail:
+diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
+index ee7857298361d..cf7e10fbab0e7 100644
+--- a/drivers/net/ethernet/marvell/mvmdio.c
++++ b/drivers/net/ethernet/marvell/mvmdio.c
+@@ -319,15 +319,25 @@ static int orion_mdio_probe(struct platform_device *pdev)
+
+ init_waitqueue_head(&dev->smi_busy_wait);
+
+- for (i = 0; i < ARRAY_SIZE(dev->clk); i++) {
+- dev->clk[i] = of_clk_get(pdev->dev.of_node, i);
+- if (PTR_ERR(dev->clk[i]) == -EPROBE_DEFER) {
++ if (pdev->dev.of_node) {
++ for (i = 0; i < ARRAY_SIZE(dev->clk); i++) {
++ dev->clk[i] = of_clk_get(pdev->dev.of_node, i);
++ if (PTR_ERR(dev->clk[i]) == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto out_clk;
++ }
++ if (IS_ERR(dev->clk[i]))
++ break;
++ clk_prepare_enable(dev->clk[i]);
++ }
++ } else {
++ dev->clk[0] = clk_get(&pdev->dev, NULL);
++ if (PTR_ERR(dev->clk[0]) == -EPROBE_DEFER) {
+ ret = -EPROBE_DEFER;
+ goto out_clk;
+ }
+- if (IS_ERR(dev->clk[i]))
+- break;
+- clk_prepare_enable(dev->clk[i]);
++ if (!IS_ERR(dev->clk[0]))
++ clk_prepare_enable(dev->clk[0]);
+ }
+
+ dev->err_interrupt = platform_get_irq(pdev, 0);
+diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
+index 65dc6c51037e3..7956abcbae22b 100644
+--- a/drivers/staging/comedi/drivers/vmk80xx.c
++++ b/drivers/staging/comedi/drivers/vmk80xx.c
+@@ -667,6 +667,9 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev)
+ if (!devpriv->ep_rx || !devpriv->ep_tx)
+ return -ENODEV;
+
++ if (!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx))
++ return -EINVAL;
++
+ return 0;
+ }
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index f0f630e1cf1c9..b2364e3794295 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1027,6 +1027,11 @@ static const struct usb_device_id id_table_combined[] = {
+ /* U-Blox devices */
+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
++ /* FreeCalypso USB adapters */
++ { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index b5ca17a5967a0..3d47c6d72256e 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -39,6 +39,13 @@
+
+ #define FTDI_LUMEL_PD12_PID 0x6002
+
++/*
++ * Custom USB adapters made by Falconia Partners LLC
++ * for FreeCalypso project, ID codes allocated to Falconia by FTDI.
++ */
++#define FTDI_FALCONIA_JTAG_BUF_PID 0x7150
++#define FTDI_FALCONIA_JTAG_UNBUF_PID 0x7151
++
+ /* Sienna Serial Interface by Secyourit GmbH */
+ #define FTDI_SIENNA_PID 0x8348
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 810f1010ab132..c773db129bf94 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -528,6 +528,7 @@ static void option_instat_callback(struct urb *urb);
+ /* Cellient products */
+ #define CELLIENT_VENDOR_ID 0x2692
+ #define CELLIENT_PRODUCT_MEN200 0x9005
++#define CELLIENT_PRODUCT_MPL200 0x9025
+
+ /* Hyundai Petatel Inc. products */
+ #define PETATEL_VENDOR_ID 0x1ff4
+@@ -1186,6 +1187,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(2) | RSVD(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1053, 0xff), /* Telit FN980 (ECM) */
+ .driver_info = NCTRL(0) | RSVD(1) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff), /* Telit FT980-KS */
++ .driver_info = NCTRL(2) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+@@ -1982,6 +1985,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
+ { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
++ { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200),
++ .driver_info = RSVD(1) | RSVD(4) },
+ { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
+ { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) }, /* TP-Link LTE Module */
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 7751b94ac7f5e..2d78ad2842a44 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -94,6 +94,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD381_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LD381GC_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index c98db6b650a5c..a897680473a78 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -121,6 +121,7 @@
+
+ /* Hewlett-Packard POS Pole Displays */
+ #define HP_VENDOR_ID 0x03f0
++#define HP_LD381GC_PRODUCT_ID 0x0183
+ #define HP_LM920_PRODUCT_ID 0x026b
+ #define HP_TD620_PRODUCT_ID 0x0956
+ #define HP_LD960_PRODUCT_ID 0x0b39
+diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
+index 6419e6dacc394..70387650436cf 100644
+--- a/fs/reiserfs/inode.c
++++ b/fs/reiserfs/inode.c
+@@ -1553,11 +1553,7 @@ void reiserfs_read_locked_inode(struct inode *inode,
+ * set version 1, version 2 could be used too, because stat data
+ * key is the same in both versions
+ */
+- key.version = KEY_FORMAT_3_5;
+- key.on_disk_key.k_dir_id = dirino;
+- key.on_disk_key.k_objectid = inode->i_ino;
+- key.on_disk_key.k_offset = 0;
+- key.on_disk_key.k_type = 0;
++ _make_cpu_key(&key, KEY_FORMAT_3_5, dirino, inode->i_ino, 0, 0, 3);
+
+ /* look for the object's stat data */
+ retval = search_item(inode->i_sb, &key, &path_to_sd);
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index ee216925a7090..0a397f179fd6a 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -665,6 +665,13 @@ reiserfs_xattr_get(struct inode *inode, const char *name, void *buffer,
+ if (get_inode_sd_version(inode) == STAT_DATA_V1)
+ return -EOPNOTSUPP;
+
++ /*
++ * priv_root needn't be initialized during mount so allow initial
++ * lookups to succeed.
++ */
++ if (!REISERFS_SB(inode->i_sb)->priv_root)
++ return 0;
++
+ dentry = xattr_lookup(inode, name, XATTR_REPLACE);
+ if (IS_ERR(dentry)) {
+ err = PTR_ERR(dentry);
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index cc2d0c3b475b5..3195728095752 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1287,16 +1287,34 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
+ conn->security_cfm_cb(conn, status);
+ }
+
+-static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
+- __u8 encrypt)
++static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
+ {
+ struct hci_cb *cb;
++ __u8 encrypt;
++
++ if (conn->state == BT_CONFIG) {
++ if (!status)
++ conn->state = BT_CONNECTED;
+
+- if (conn->sec_level == BT_SECURITY_SDP)
+- conn->sec_level = BT_SECURITY_LOW;
++ hci_connect_cfm(conn, status);
++ hci_conn_drop(conn);
++ return;
++ }
+
+- if (conn->pending_sec_level > conn->sec_level)
+- conn->sec_level = conn->pending_sec_level;
++ if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
++ encrypt = 0x00;
++ else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
++ encrypt = 0x02;
++ else
++ encrypt = 0x01;
++
++ if (!status) {
++ if (conn->sec_level == BT_SECURITY_SDP)
++ conn->sec_level = BT_SECURITY_LOW;
++
++ if (conn->pending_sec_level > conn->sec_level)
++ conn->sec_level = conn->pending_sec_level;
++ }
+
+ mutex_lock(&hci_cb_list_lock);
+ list_for_each_entry(cb, &hci_cb_list, list) {
+diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
+index 0697fd4130877..21dbd38f724d4 100644
+--- a/include/net/bluetooth/l2cap.h
++++ b/include/net/bluetooth/l2cap.h
+@@ -619,6 +619,8 @@ struct l2cap_ops {
+ struct sk_buff *(*alloc_skb) (struct l2cap_chan *chan,
+ unsigned long hdr_len,
+ unsigned long len, int nb);
++ int (*filter) (struct l2cap_chan * chan,
++ struct sk_buff *skb);
+ };
+
+ struct l2cap_conn {
+diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
+index 51c2cf2d8923a..be9640e9ca006 100644
+--- a/net/bluetooth/a2mp.c
++++ b/net/bluetooth/a2mp.c
+@@ -233,6 +233,9 @@ static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
+ struct a2mp_info_req req;
+
+ found = true;
++
++ memset(&req, 0, sizeof(req));
++
+ req.id = cl->id;
+ a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr),
+ sizeof(req), &req);
+@@ -312,6 +315,8 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb,
+ if (!hdev || hdev->dev_type != HCI_AMP) {
+ struct a2mp_info_rsp rsp;
+
++ memset(&rsp, 0, sizeof(rsp));
++
+ rsp.id = req->id;
+ rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
+
+@@ -355,6 +360,8 @@ static int a2mp_getinfo_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
+ if (!ctrl)
+ return -ENOMEM;
+
++ memset(&req, 0, sizeof(req));
++
+ req.id = rsp->id;
+ a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req),
+ &req);
+@@ -383,6 +390,8 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
+ struct a2mp_amp_assoc_rsp rsp;
+ rsp.id = req->id;
+
++ memset(&rsp, 0, sizeof(rsp));
++
+ if (tmp) {
+ rsp.status = A2MP_STATUS_COLLISION_OCCURED;
+ amp_mgr_put(tmp);
+@@ -471,7 +480,6 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
+ struct a2mp_cmd *hdr)
+ {
+ struct a2mp_physlink_req *req = (void *) skb->data;
+-
+ struct a2mp_physlink_rsp rsp;
+ struct hci_dev *hdev;
+ struct hci_conn *hcon;
+@@ -482,6 +490,8 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
+
+ BT_DBG("local_id %d, remote_id %d", req->local_id, req->remote_id);
+
++ memset(&rsp, 0, sizeof(rsp));
++
+ rsp.local_id = req->remote_id;
+ rsp.remote_id = req->local_id;
+
+@@ -560,6 +570,8 @@ static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
+
+ BT_DBG("local_id %d remote_id %d", req->local_id, req->remote_id);
+
++ memset(&rsp, 0, sizeof(rsp));
++
+ rsp.local_id = req->remote_id;
+ rsp.remote_id = req->local_id;
+ rsp.status = A2MP_STATUS_SUCCESS;
+@@ -682,6 +694,8 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
+ if (err) {
+ struct a2mp_cmd_rej rej;
+
++ memset(&rej, 0, sizeof(rej));
++
+ rej.reason = cpu_to_le16(0);
+ hdr = (void *) skb->data;
+
+@@ -905,6 +919,8 @@ void a2mp_send_getinfo_rsp(struct hci_dev *hdev)
+
+ BT_DBG("%s mgr %p", hdev->name, mgr);
+
++ memset(&rsp, 0, sizeof(rsp));
++
+ rsp.id = hdev->id;
+ rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
+
+@@ -1002,6 +1018,8 @@ void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status)
+ if (!mgr)
+ return;
+
++ memset(&rsp, 0, sizeof(rsp));
++
+ hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT);
+ if (!hs_hcon) {
+ rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION;
+@@ -1034,6 +1052,8 @@ void a2mp_discover_amp(struct l2cap_chan *chan)
+
+ mgr->bredr_chan = chan;
+
++ memset(&req, 0, sizeof(req));
++
+ req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
+ req.ext_feat = 0;
+ a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req);
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index db735d0d931e6..1b50e4ef2c683 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1282,6 +1282,23 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
+ return 0;
+ }
+
++ /* AES encryption is required for Level 4:
++ *
++ * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
++ * page 1319:
++ *
++ * 128-bit equivalent strength for link and encryption keys
++ * required using FIPS approved algorithms (E0 not allowed,
++ * SAFER+ not allowed, and P-192 not allowed; encryption key
++ * not shortened)
++ */
++ if (conn->sec_level == BT_SECURITY_FIPS &&
++ !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
++ bt_dev_err(conn->hdev,
++ "Invalid security: Missing AES-CCM usage");
++ return 0;
++ }
++
+ if (hci_conn_ssp_enabled(conn) &&
+ !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ return 0;
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 310622086f74b..d98d8e78b7363 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -2756,7 +2756,7 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ &cp);
+ } else {
+ clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
+- hci_encrypt_cfm(conn, ev->status, 0x00);
++ hci_encrypt_cfm(conn, ev->status);
+ }
+ }
+
+@@ -2841,22 +2841,7 @@ static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
+ conn->enc_key_size = rp->key_size;
+ }
+
+- if (conn->state == BT_CONFIG) {
+- conn->state = BT_CONNECTED;
+- hci_connect_cfm(conn, 0);
+- hci_conn_drop(conn);
+- } else {
+- u8 encrypt;
+-
+- if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+- encrypt = 0x00;
+- else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
+- encrypt = 0x02;
+- else
+- encrypt = 0x01;
+-
+- hci_encrypt_cfm(conn, 0, encrypt);
+- }
++ hci_encrypt_cfm(conn, 0);
+
+ unlock:
+ hci_dev_unlock(hdev);
+@@ -2905,27 +2890,23 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
+
+ clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
+
++ /* Check link security requirements are met */
++ if (!hci_conn_check_link_mode(conn))
++ ev->status = HCI_ERROR_AUTH_FAILURE;
++
+ if (ev->status && conn->state == BT_CONNECTED) {
+ if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
+ set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
+
++ /* Notify upper layers so they can cleanup before
++ * disconnecting.
++ */
++ hci_encrypt_cfm(conn, ev->status);
+ hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+ hci_conn_drop(conn);
+ goto unlock;
+ }
+
+- /* In Secure Connections Only mode, do not allow any connections
+- * that are not encrypted with AES-CCM using a P-256 authenticated
+- * combination key.
+- */
+- if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
+- (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
+- conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
+- hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
+- hci_conn_drop(conn);
+- goto unlock;
+- }
+-
+ /* Try reading the encryption key size for encrypted ACL links */
+ if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
+ struct hci_cp_read_enc_key_size cp;
+@@ -2955,14 +2936,7 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ }
+
+ notify:
+- if (conn->state == BT_CONFIG) {
+- if (!ev->status)
+- conn->state = BT_CONNECTED;
+-
+- hci_connect_cfm(conn, ev->status);
+- hci_conn_drop(conn);
+- } else
+- hci_encrypt_cfm(conn, ev->status, ev->encrypt);
++ hci_encrypt_cfm(conn, ev->status);
+
+ unlock:
+ hci_dev_unlock(hdev);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index c04107d446016..f1ff833210231 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -6683,9 +6683,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
+ goto drop;
+ }
+
+- if ((chan->mode == L2CAP_MODE_ERTM ||
+- chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
+- goto drop;
++ if (chan->ops->filter) {
++ if (chan->ops->filter(chan, skb))
++ goto drop;
++ }
+
+ if (!control->sframe) {
+ int err;
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index 5572042f04531..2a85dc3be8bf3 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1476,6 +1476,19 @@ static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
+ sk->sk_state_change(sk);
+ }
+
++static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
++{
++ struct sock *sk = chan->data;
++
++ switch (chan->mode) {
++ case L2CAP_MODE_ERTM:
++ case L2CAP_MODE_STREAMING:
++ return sk_filter(sk, skb);
++ }
++
++ return 0;
++}
++
+ static const struct l2cap_ops l2cap_chan_ops = {
+ .name = "L2CAP Socket Interface",
+ .new_connection = l2cap_sock_new_connection_cb,
+@@ -1490,6 +1503,7 @@ static const struct l2cap_ops l2cap_chan_ops = {
+ .set_shutdown = l2cap_sock_set_shutdown_cb,
+ .get_sndtimeo = l2cap_sock_get_sndtimeo_cb,
+ .alloc_skb = l2cap_sock_alloc_skb_cb,
++ .filter = l2cap_sock_filter,
+ };
+
+ static void l2cap_sock_destruct(struct sock *sk)
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index ccce954f81468..5340b1097afb7 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -756,7 +756,8 @@ static u32 get_supported_settings(struct hci_dev *hdev)
+
+ if (lmp_ssp_capable(hdev)) {
+ settings |= MGMT_SETTING_SSP;
+- settings |= MGMT_SETTING_HS;
++ if (IS_ENABLED(CONFIG_BT_HS))
++ settings |= MGMT_SETTING_HS;
+ }
+
+ if (lmp_sc_capable(hdev))
+@@ -1771,6 +1772,10 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
+
+ BT_DBG("request for %s", hdev->name);
+
++ if (!IS_ENABLED(CONFIG_BT_HS))
++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
++ MGMT_STATUS_NOT_SUPPORTED);
++
+ status = mgmt_bredr_support(hdev);
+ if (status)
+ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
+diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
+index 7b5e15cc6b717..ad33b99f5d21e 100644
+--- a/tools/perf/util/cs-etm.c
++++ b/tools/perf/util/cs-etm.c
+@@ -87,6 +87,9 @@ struct cs_etm_queue {
+ struct cs_etm_packet *packet;
+ };
+
++/* RB tree for quick conversion between traceID and metadata pointers */
++static struct intlist *traceid_list;
++
+ static int cs_etm__update_queues(struct cs_etm_auxtrace *etm);
+ static int cs_etm__process_timeless_queues(struct cs_etm_auxtrace *etm,
+ pid_t tid, u64 time_);
+diff --git a/tools/perf/util/cs-etm.h b/tools/perf/util/cs-etm.h
+index 37f8d48179cae..c7ef97b198c77 100644
+--- a/tools/perf/util/cs-etm.h
++++ b/tools/perf/util/cs-etm.h
+@@ -53,9 +53,6 @@ enum {
+ CS_ETMV4_PRIV_MAX,
+ };
+
+-/* RB tree for quick conversion between traceID and CPUs */
+-struct intlist *traceid_list;
+-
+ #define KiB(x) ((x) * 1024)
+ #define MiB(x) ((x) * 1024 * 1024)
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-10-29 11:18 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-10-29 11:18 UTC (permalink / raw
To: gentoo-commits
commit: bb34eaadc95f27973636b3035add7cb29eacddfc
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Oct 29 11:18:33 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Oct 29 11:18:33 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bb34eaad
Linux patch 4.19.153
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1152_linux-4.19.153.patch | 4259 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4263 insertions(+)
diff --git a/0000_README b/0000_README
index ddccc76..f3a1010 100644
--- a/0000_README
+++ b/0000_README
@@ -647,6 +647,10 @@ Patch: 1151_linux-4.19.152.patch
From: https://www.kernel.org
Desc: Linux 4.19.152
+Patch: 1152_linux-4.19.153.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.153
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1152_linux-4.19.153.patch b/1152_linux-4.19.153.patch
new file mode 100644
index 0000000..f5fa716
--- /dev/null
+++ b/1152_linux-4.19.153.patch
@@ -0,0 +1,4259 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 30752db575870..fb129272240c9 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -558,7 +558,7 @@
+ loops can be debugged more effectively on production
+ systems.
+
+- clearcpuid=BITNUM [X86]
++ clearcpuid=BITNUM[,BITNUM...] [X86]
+ Disable CPUID feature X for the kernel. See
+ arch/x86/include/asm/cpufeatures.h for the valid bit
+ numbers. Note the Linux specific bits are not necessarily
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index 7eb9366422f54..3c617d620b6f8 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -934,12 +934,14 @@ icmp_ratelimit - INTEGER
+ icmp_msgs_per_sec - INTEGER
+ Limit maximal number of ICMP packets sent per second from this host.
+ Only messages whose type matches icmp_ratemask (see below) are
+- controlled by this limit.
++ controlled by this limit. For security reasons, the precise count
++ of messages per second is randomized.
+ Default: 1000
+
+ icmp_msgs_burst - INTEGER
+ icmp_msgs_per_sec controls number of ICMP packets sent per second,
+ while icmp_msgs_burst controls the burst size of these packets.
++ For security reasons, the precise burst size is randomized.
+ Default: 50
+
+ icmp_ratemask - INTEGER
+diff --git a/Makefile b/Makefile
+index aa79ce7bfdc73..d5e93bf207998 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 152
++SUBLEVEL = 153
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig
+index c285a83cbf08f..df35ea1912e8b 100644
+--- a/arch/arc/plat-hsdk/Kconfig
++++ b/arch/arc/plat-hsdk/Kconfig
+@@ -11,5 +11,6 @@ menuconfig ARC_SOC_HSDK
+ select ARC_HAS_ACCL_REGS
+ select ARC_IRQ_NO_AUTOSAVE
+ select CLK_HSDK
++ select RESET_CONTROLLER
+ select RESET_HSDK
+ select MIGHT_HAVE_PCI
+diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
+index 808efbb89b88c..02f613def40dc 100644
+--- a/arch/arm/mm/cache-l2x0.c
++++ b/arch/arm/mm/cache-l2x0.c
+@@ -1261,20 +1261,28 @@ static void __init l2c310_of_parse(const struct device_node *np,
+
+ ret = of_property_read_u32(np, "prefetch-data", &val);
+ if (ret == 0) {
+- if (val)
++ if (val) {
+ prefetch |= L310_PREFETCH_CTRL_DATA_PREFETCH;
+- else
++ *aux_val |= L310_PREFETCH_CTRL_DATA_PREFETCH;
++ } else {
+ prefetch &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
++ *aux_val &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
++ }
++ *aux_mask &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
+ } else if (ret != -EINVAL) {
+ pr_err("L2C-310 OF prefetch-data property value is missing\n");
+ }
+
+ ret = of_property_read_u32(np, "prefetch-instr", &val);
+ if (ret == 0) {
+- if (val)
++ if (val) {
+ prefetch |= L310_PREFETCH_CTRL_INSTR_PREFETCH;
+- else
++ *aux_val |= L310_PREFETCH_CTRL_INSTR_PREFETCH;
++ } else {
+ prefetch &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
++ *aux_val &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
++ }
++ *aux_mask &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
+ } else if (ret != -EINVAL) {
+ pr_err("L2C-310 OF prefetch-instr property value is missing\n");
+ }
+diff --git a/arch/powerpc/include/asm/drmem.h b/arch/powerpc/include/asm/drmem.h
+index 9e516fe3daaba..668d8a121f1a0 100644
+--- a/arch/powerpc/include/asm/drmem.h
++++ b/arch/powerpc/include/asm/drmem.h
+@@ -12,6 +12,8 @@
+ #ifndef _ASM_POWERPC_LMB_H
+ #define _ASM_POWERPC_LMB_H
+
++#include <linux/sched.h>
++
+ struct drmem_lmb {
+ u64 base_addr;
+ u32 drc_index;
+@@ -27,8 +29,22 @@ struct drmem_lmb_info {
+
+ extern struct drmem_lmb_info *drmem_info;
+
++static inline struct drmem_lmb *drmem_lmb_next(struct drmem_lmb *lmb,
++ const struct drmem_lmb *start)
++{
++ /*
++ * DLPAR code paths can take several milliseconds per element
++ * when interacting with firmware. Ensure that we don't
++ * unfairly monopolize the CPU.
++ */
++ if (((++lmb - start) % 16) == 0)
++ cond_resched();
++
++ return lmb;
++}
++
+ #define for_each_drmem_lmb_in_range(lmb, start, end) \
+- for ((lmb) = (start); (lmb) < (end); (lmb)++)
++ for ((lmb) = (start); (lmb) < (end); lmb = drmem_lmb_next(lmb, start))
+
+ #define for_each_drmem_lmb(lmb) \
+ for_each_drmem_lmb_in_range((lmb), \
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index af99716615122..494b0283f2129 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -788,7 +788,7 @@
+ #define THRM1_TIN (1 << 31)
+ #define THRM1_TIV (1 << 30)
+ #define THRM1_THRES(x) ((x&0x7f)<<23)
+-#define THRM3_SITV(x) ((x&0x3fff)<<1)
++#define THRM3_SITV(x) ((x & 0x1fff) << 1)
+ #define THRM1_TID (1<<2)
+ #define THRM1_TIE (1<<1)
+ #define THRM1_V (1<<0)
+diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c
+index e2ab8a111b693..a130473f16e5b 100644
+--- a/arch/powerpc/kernel/tau_6xx.c
++++ b/arch/powerpc/kernel/tau_6xx.c
+@@ -13,13 +13,14 @@
+ */
+
+ #include <linux/errno.h>
+-#include <linux/jiffies.h>
+ #include <linux/kernel.h>
+ #include <linux/param.h>
+ #include <linux/string.h>
+ #include <linux/mm.h>
+ #include <linux/interrupt.h>
+ #include <linux/init.h>
++#include <linux/delay.h>
++#include <linux/workqueue.h>
+
+ #include <asm/io.h>
+ #include <asm/reg.h>
+@@ -39,8 +40,6 @@ static struct tau_temp
+ unsigned char grew;
+ } tau[NR_CPUS];
+
+-struct timer_list tau_timer;
+-
+ #undef DEBUG
+
+ /* TODO: put these in a /proc interface, with some sanity checks, and maybe
+@@ -50,7 +49,7 @@ struct timer_list tau_timer;
+ #define step_size 2 /* step size when temp goes out of range */
+ #define window_expand 1 /* expand the window by this much */
+ /* configurable values for shrinking the window */
+-#define shrink_timer 2*HZ /* period between shrinking the window */
++#define shrink_timer 2000 /* period between shrinking the window */
+ #define min_window 2 /* minimum window size, degrees C */
+
+ static void set_thresholds(unsigned long cpu)
+@@ -111,11 +110,6 @@ static void TAUupdate(int cpu)
+ #ifdef DEBUG
+ printk("grew = %d\n", tau[cpu].grew);
+ #endif
+-
+-#ifndef CONFIG_TAU_INT /* tau_timeout will do this if not using interrupts */
+- set_thresholds(cpu);
+-#endif
+-
+ }
+
+ #ifdef CONFIG_TAU_INT
+@@ -178,27 +172,27 @@ static void tau_timeout(void * info)
+ * complex sleep code needs to be added. One mtspr every time
+ * tau_timeout is called is probably not a big deal.
+ *
+- * Enable thermal sensor and set up sample interval timer
+- * need 20 us to do the compare.. until a nice 'cpu_speed' function
+- * call is implemented, just assume a 500 mhz clock. It doesn't really
+- * matter if we take too long for a compare since it's all interrupt
+- * driven anyway.
+- *
+- * use a extra long time.. (60 us @ 500 mhz)
++ * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet"
++ * recommends that "the maximum value be set in THRM3 under all
++ * conditions."
+ */
+- mtspr(SPRN_THRM3, THRM3_SITV(500*60) | THRM3_E);
++ mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E);
+
+ local_irq_restore(flags);
+ }
+
+-static void tau_timeout_smp(struct timer_list *unused)
+-{
++static struct workqueue_struct *tau_workq;
+
+- /* schedule ourselves to be run again */
+- mod_timer(&tau_timer, jiffies + shrink_timer) ;
++static void tau_work_func(struct work_struct *work)
++{
++ msleep(shrink_timer);
+ on_each_cpu(tau_timeout, NULL, 0);
++ /* schedule ourselves to be run again */
++ queue_work(tau_workq, work);
+ }
+
++DECLARE_WORK(tau_work, tau_work_func);
++
+ /*
+ * setup the TAU
+ *
+@@ -231,21 +225,16 @@ static int __init TAU_init(void)
+ return 1;
+ }
+
+-
+- /* first, set up the window shrinking timer */
+- timer_setup(&tau_timer, tau_timeout_smp, 0);
+- tau_timer.expires = jiffies + shrink_timer;
+- add_timer(&tau_timer);
++ tau_workq = alloc_workqueue("tau", WQ_UNBOUND, 1);
++ if (!tau_workq)
++ return -ENOMEM;
+
+ on_each_cpu(TAU_init_smp, NULL, 0);
+
+- printk("Thermal assist unit ");
+-#ifdef CONFIG_TAU_INT
+- printk("using interrupts, ");
+-#else
+- printk("using timers, ");
+-#endif
+- printk("shrink_timer: %d jiffies\n", shrink_timer);
++ queue_work(tau_workq, &tau_work);
++
++ pr_info("Thermal assist unit using %s, shrink_timer: %d ms\n",
++ IS_ENABLED(CONFIG_TAU_INT) ? "interrupts" : "workqueue", shrink_timer);
+ tau_initialized = 1;
+
+ return 0;
+diff --git a/arch/powerpc/platforms/pseries/rng.c b/arch/powerpc/platforms/pseries/rng.c
+index 31ca557af60bc..262b8c5e1b9d0 100644
+--- a/arch/powerpc/platforms/pseries/rng.c
++++ b/arch/powerpc/platforms/pseries/rng.c
+@@ -40,6 +40,7 @@ static __init int rng_init(void)
+
+ ppc_md.get_random_seed = pseries_get_random_long;
+
++ of_node_put(dn);
+ return 0;
+ }
+ machine_subsys_initcall(pseries, rng_init);
+diff --git a/arch/powerpc/sysdev/xics/icp-hv.c b/arch/powerpc/sysdev/xics/icp-hv.c
+index bbc839a98c414..003deaabb5680 100644
+--- a/arch/powerpc/sysdev/xics/icp-hv.c
++++ b/arch/powerpc/sysdev/xics/icp-hv.c
+@@ -179,6 +179,7 @@ int icp_hv_init(void)
+
+ icp_ops = &icp_hv_ops;
+
++ of_node_put(np);
+ return 0;
+ }
+
+diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c
+index 3210fee27e7f9..0014d26391fa6 100644
+--- a/arch/x86/events/amd/iommu.c
++++ b/arch/x86/events/amd/iommu.c
+@@ -387,7 +387,7 @@ static __init int _init_events_attrs(void)
+ while (amd_iommu_v2_event_descs[i].attr.attr.name)
+ i++;
+
+- attrs = kcalloc(i + 1, sizeof(struct attribute **), GFP_KERNEL);
++ attrs = kcalloc(i + 1, sizeof(*attrs), GFP_KERNEL);
+ if (!attrs)
+ return -ENOMEM;
+
+diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
+index 6abd83572b016..9692ccc583bb3 100644
+--- a/arch/x86/kernel/fpu/init.c
++++ b/arch/x86/kernel/fpu/init.c
+@@ -249,9 +249,9 @@ static void __init fpu__init_system_ctx_switch(void)
+ */
+ static void __init fpu__init_parse_early_param(void)
+ {
+- char arg[32];
++ char arg[128];
+ char *argptr = arg;
+- int bit;
++ int arglen, res, bit;
+
+ if (cmdline_find_option_bool(boot_command_line, "no387"))
+ setup_clear_cpu_cap(X86_FEATURE_FPU);
+@@ -271,12 +271,26 @@ static void __init fpu__init_parse_early_param(void)
+ if (cmdline_find_option_bool(boot_command_line, "noxsaves"))
+ setup_clear_cpu_cap(X86_FEATURE_XSAVES);
+
+- if (cmdline_find_option(boot_command_line, "clearcpuid", arg,
+- sizeof(arg)) &&
+- get_option(&argptr, &bit) &&
+- bit >= 0 &&
+- bit < NCAPINTS * 32)
+- setup_clear_cpu_cap(bit);
++ arglen = cmdline_find_option(boot_command_line, "clearcpuid", arg, sizeof(arg));
++ if (arglen <= 0)
++ return;
++
++ pr_info("Clearing CPUID bits:");
++ do {
++ res = get_option(&argptr, &bit);
++ if (res == 0 || res == 3)
++ break;
++
++ /* If the argument was too long, the last bit may be cut off */
++ if (res == 1 && arglen >= sizeof(arg))
++ break;
++
++ if (bit >= 0 && bit < NCAPINTS * 32) {
++ pr_cont(" " X86_CAP_FMT, x86_cap_flag(bit));
++ setup_clear_cpu_cap(bit);
++ }
++ } while (res == 2);
++ pr_cont("\n");
+ }
+
+ /*
+diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
+index 0f8b9b900b0e7..996eb53f8eb75 100644
+--- a/arch/x86/kernel/nmi.c
++++ b/arch/x86/kernel/nmi.c
+@@ -104,7 +104,6 @@ fs_initcall(nmi_warning_debugfs);
+
+ static void nmi_check_duration(struct nmiaction *action, u64 duration)
+ {
+- u64 whole_msecs = READ_ONCE(action->max_duration);
+ int remainder_ns, decimal_msecs;
+
+ if (duration < nmi_longest_ns || duration < action->max_duration)
+@@ -112,12 +111,12 @@ static void nmi_check_duration(struct nmiaction *action, u64 duration)
+
+ action->max_duration = duration;
+
+- remainder_ns = do_div(whole_msecs, (1000 * 1000));
++ remainder_ns = do_div(duration, (1000 * 1000));
+ decimal_msecs = remainder_ns / 1000;
+
+ printk_ratelimited(KERN_INFO
+ "INFO: NMI handler (%ps) took too long to run: %lld.%03d msecs\n",
+- action->handler, whole_msecs, decimal_msecs);
++ action->handler, duration, decimal_msecs);
+ }
+
+ static int nmi_handle(unsigned int type, struct pt_regs *regs)
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index a2ff5c214738a..5faa49a95ac97 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -6225,6 +6225,7 @@ static void kvm_recover_nx_lpages(struct kvm *kvm)
+ cond_resched_lock(&kvm->mmu_lock);
+ }
+ }
++ kvm_mmu_commit_zap_page(kvm, &invalid_list);
+
+ spin_unlock(&kvm->mmu_lock);
+ srcu_read_unlock(&kvm->srcu, rcu_idx);
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index cb09a0ec87500..a0c3d1b4b295b 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -5380,6 +5380,7 @@ static int svm_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
+ * - Tell IOMMU to use legacy mode for this interrupt.
+ * - Retrieve ga_tag of prior interrupt remapping data.
+ */
++ pi.prev_ga_tag = 0;
+ pi.is_guest_mode = false;
+ ret = irq_set_vcpu_affinity(host_irq, &pi);
+
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index b4f16202ab7af..182783801ffa6 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -82,7 +82,7 @@ static int crypto_aead_copy_sgl(struct crypto_skcipher *null_tfm,
+ SKCIPHER_REQUEST_ON_STACK(skreq, null_tfm);
+
+ skcipher_request_set_tfm(skreq, null_tfm);
+- skcipher_request_set_callback(skreq, CRYPTO_TFM_REQ_MAY_BACKLOG,
++ skcipher_request_set_callback(skreq, CRYPTO_TFM_REQ_MAY_SLEEP,
+ NULL, NULL);
+ skcipher_request_set_crypt(skreq, src, dst, len, NULL);
+
+@@ -295,19 +295,20 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
+ areq->outlen = outlen;
+
+ aead_request_set_callback(&areq->cra_u.aead_req,
+- CRYPTO_TFM_REQ_MAY_BACKLOG,
++ CRYPTO_TFM_REQ_MAY_SLEEP,
+ af_alg_async_cb, areq);
+ err = ctx->enc ? crypto_aead_encrypt(&areq->cra_u.aead_req) :
+ crypto_aead_decrypt(&areq->cra_u.aead_req);
+
+ /* AIO operation in progress */
+- if (err == -EINPROGRESS || err == -EBUSY)
++ if (err == -EINPROGRESS)
+ return -EIOCBQUEUED;
+
+ sock_put(sk);
+ } else {
+ /* Synchronous operation */
+ aead_request_set_callback(&areq->cra_u.aead_req,
++ CRYPTO_TFM_REQ_MAY_SLEEP |
+ CRYPTO_TFM_REQ_MAY_BACKLOG,
+ crypto_req_done, &ctx->wait);
+ err = crypto_wait_req(ctx->enc ?
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index 1cb106c46043d..9d2e9783c0d4e 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -127,7 +127,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
+ crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);
+
+ /* AIO operation in progress */
+- if (err == -EINPROGRESS || err == -EBUSY)
++ if (err == -EINPROGRESS)
+ return -EIOCBQUEUED;
+
+ sock_put(sk);
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 112b5b50ad3c4..cda4f7eb58ead 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -285,7 +285,7 @@ struct binder_device {
+ struct binder_work {
+ struct list_head entry;
+
+- enum {
++ enum binder_work_type {
+ BINDER_WORK_TRANSACTION = 1,
+ BINDER_WORK_TRANSACTION_COMPLETE,
+ BINDER_WORK_RETURN_ERROR,
+@@ -895,27 +895,6 @@ static struct binder_work *binder_dequeue_work_head_ilocked(
+ return w;
+ }
+
+-/**
+- * binder_dequeue_work_head() - Dequeues the item at head of list
+- * @proc: binder_proc associated with list
+- * @list: list to dequeue head
+- *
+- * Removes the head of the list if there are items on the list
+- *
+- * Return: pointer dequeued binder_work, NULL if list was empty
+- */
+-static struct binder_work *binder_dequeue_work_head(
+- struct binder_proc *proc,
+- struct list_head *list)
+-{
+- struct binder_work *w;
+-
+- binder_inner_proc_lock(proc);
+- w = binder_dequeue_work_head_ilocked(list);
+- binder_inner_proc_unlock(proc);
+- return w;
+-}
+-
+ static void
+ binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
+ static void binder_free_thread(struct binder_thread *thread);
+@@ -4242,13 +4221,17 @@ static void binder_release_work(struct binder_proc *proc,
+ struct list_head *list)
+ {
+ struct binder_work *w;
++ enum binder_work_type wtype;
+
+ while (1) {
+- w = binder_dequeue_work_head(proc, list);
++ binder_inner_proc_lock(proc);
++ w = binder_dequeue_work_head_ilocked(list);
++ wtype = w ? w->type : 0;
++ binder_inner_proc_unlock(proc);
+ if (!w)
+ return;
+
+- switch (w->type) {
++ switch (wtype) {
+ case BINDER_WORK_TRANSACTION: {
+ struct binder_transaction *t;
+
+@@ -4282,9 +4265,11 @@ static void binder_release_work(struct binder_proc *proc,
+ kfree(death);
+ binder_stats_deleted(BINDER_STAT_DEATH);
+ } break;
++ case BINDER_WORK_NODE:
++ break;
+ default:
+ pr_err("unexpected work type, %d, not freed\n",
+- w->type);
++ wtype);
+ break;
+ }
+ }
+diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
+index efeb8137ec67f..48560e646e53e 100644
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -545,6 +545,7 @@ static void hci_uart_tty_close(struct tty_struct *tty)
+ clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+ percpu_up_write(&hu->proto_lock);
+
++ cancel_work_sync(&hu->init_ready);
+ cancel_work_sync(&hu->write_work);
+
+ if (hdev) {
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index d3fb0d657fa52..7b3aade431e5e 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -369,6 +369,8 @@ void hci_uart_unregister_device(struct hci_uart *hu)
+ struct hci_dev *hdev = hu->hdev;
+
+ clear_bit(HCI_UART_PROTO_READY, &hu->flags);
++
++ cancel_work_sync(&hu->init_ready);
+ if (test_bit(HCI_UART_REGISTERED, &hu->flags))
+ hci_unregister_dev(hdev);
+ hci_free_dev(hdev);
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index c5f98cafc25c9..9b0b490d70ff4 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -486,6 +486,12 @@ remove_opp:
+ /* late_initcall, to guarantee the driver is loaded after A37xx clock driver */
+ late_initcall(armada37xx_cpufreq_driver_init);
+
++static const struct of_device_id __maybe_unused armada37xx_cpufreq_of_match[] = {
++ { .compatible = "marvell,armada-3700-nb-pm" },
++ { },
++};
++MODULE_DEVICE_TABLE(of, armada37xx_cpufreq_of_match);
++
+ MODULE_AUTHOR("Gregory CLEMENT <gregory.clement@free-electrons.com>");
+ MODULE_DESCRIPTION("Armada 37xx cpufreq driver");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index 28d24118c6450..f1ca66147c287 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -1057,6 +1057,9 @@ static struct sock *chtls_recv_sock(struct sock *lsk,
+ ndev = n->dev;
+ if (!ndev)
+ goto free_dst;
++ if (is_vlan_dev(ndev))
++ ndev = vlan_dev_real_dev(ndev);
++
+ port_id = cxgb4_port_idx(ndev);
+
+ csk = chtls_sock_create(cdev);
+diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c
+index 2c1f3ddb0cc79..e9573e7f9e803 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_io.c
++++ b/drivers/crypto/chelsio/chtls/chtls_io.c
+@@ -914,9 +914,9 @@ static int tls_header_read(struct tls_hdr *thdr, struct iov_iter *from)
+ return (__force int)cpu_to_be16(thdr->length);
+ }
+
+-static int csk_mem_free(struct chtls_dev *cdev, struct sock *sk)
++static bool csk_mem_free(struct chtls_dev *cdev, struct sock *sk)
+ {
+- return (cdev->max_host_sndbuf - sk->sk_wmem_queued);
++ return (cdev->max_host_sndbuf - sk->sk_wmem_queued > 0);
+ }
+
+ static int csk_wait_memory(struct chtls_dev *cdev,
+@@ -1217,6 +1217,7 @@ int chtls_sendpage(struct sock *sk, struct page *page,
+ copied = 0;
+ csk = rcu_dereference_sk_user_data(sk);
+ cdev = csk->cdev;
++ lock_sock(sk);
+ timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
+
+ err = sk_stream_wait_connect(sk, &timeo);
+diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
+index 27f7dad2d45d9..9b7b8558db31d 100644
+--- a/drivers/crypto/ixp4xx_crypto.c
++++ b/drivers/crypto/ixp4xx_crypto.c
+@@ -530,7 +530,7 @@ static void release_ixp_crypto(struct device *dev)
+
+ if (crypt_virt) {
+ dma_free_coherent(dev,
+- NPE_QLEN_TOTAL * sizeof( struct crypt_ctl),
++ NPE_QLEN * sizeof(struct crypt_ctl),
+ crypt_virt, crypt_phys);
+ }
+ }
+diff --git a/drivers/crypto/mediatek/mtk-platform.c b/drivers/crypto/mediatek/mtk-platform.c
+index ee0404e27a0f2..e4d7ef3bfb61d 100644
+--- a/drivers/crypto/mediatek/mtk-platform.c
++++ b/drivers/crypto/mediatek/mtk-platform.c
+@@ -446,7 +446,7 @@ static void mtk_desc_dma_free(struct mtk_cryp *cryp)
+ static int mtk_desc_ring_alloc(struct mtk_cryp *cryp)
+ {
+ struct mtk_ring **ring = cryp->ring;
+- int i, err = ENOMEM;
++ int i;
+
+ for (i = 0; i < MTK_RING_MAX; i++) {
+ ring[i] = kzalloc(sizeof(**ring), GFP_KERNEL);
+@@ -473,14 +473,14 @@ static int mtk_desc_ring_alloc(struct mtk_cryp *cryp)
+ return 0;
+
+ err_cleanup:
+- for (; i--; ) {
++ do {
+ dma_free_coherent(cryp->dev, MTK_DESC_RING_SZ,
+ ring[i]->res_base, ring[i]->res_dma);
+ dma_free_coherent(cryp->dev, MTK_DESC_RING_SZ,
+ ring[i]->cmd_base, ring[i]->cmd_dma);
+ kfree(ring[i]);
+- }
+- return err;
++ } while (i--);
++ return -ENOMEM;
+ }
+
+ static int mtk_crypto_probe(struct platform_device *pdev)
+diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
+index 2faaa4069cdd8..4d31ef4724366 100644
+--- a/drivers/crypto/omap-sham.c
++++ b/drivers/crypto/omap-sham.c
+@@ -456,6 +456,9 @@ static void omap_sham_write_ctrl_omap4(struct omap_sham_dev *dd, size_t length,
+ struct omap_sham_reqctx *ctx = ahash_request_ctx(dd->req);
+ u32 val, mask;
+
++ if (likely(ctx->digcnt))
++ omap_sham_write(dd, SHA_REG_DIGCNT(dd), ctx->digcnt);
++
+ /*
+ * Setting ALGO_CONST only for the first iteration and
+ * CLOSE_HASH only for the last one. Note that flags mode bits
+diff --git a/drivers/crypto/picoxcell_crypto.c b/drivers/crypto/picoxcell_crypto.c
+index e2491754c468f..1ef47f7208b92 100644
+--- a/drivers/crypto/picoxcell_crypto.c
++++ b/drivers/crypto/picoxcell_crypto.c
+@@ -1701,11 +1701,6 @@ static int spacc_probe(struct platform_device *pdev)
+ goto err_clk_put;
+ }
+
+- ret = device_create_file(&pdev->dev, &dev_attr_stat_irq_thresh);
+- if (ret)
+- goto err_clk_disable;
+-
+-
+ /*
+ * Use an IRQ threshold of 50% as a default. This seems to be a
+ * reasonable trade off of latency against throughput but can be
+@@ -1713,6 +1708,10 @@ static int spacc_probe(struct platform_device *pdev)
+ */
+ engine->stat_irq_thresh = (engine->fifo_sz / 2);
+
++ ret = device_create_file(&pdev->dev, &dev_attr_stat_irq_thresh);
++ if (ret)
++ goto err_clk_disable;
++
+ /*
+ * Configure the interrupts. We only use the STAT_CNT interrupt as we
+ * only submit a new packet for processing when we complete another in
+diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
+index b506eef6b146d..858ef4e15180b 100644
+--- a/drivers/edac/i5100_edac.c
++++ b/drivers/edac/i5100_edac.c
+@@ -1072,16 +1072,15 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ PCI_DEVICE_ID_INTEL_5100_19, 0);
+ if (!einj) {
+ ret = -ENODEV;
+- goto bail_einj;
++ goto bail_mc_free;
+ }
+
+ rc = pci_enable_device(einj);
+ if (rc < 0) {
+ ret = rc;
+- goto bail_disable_einj;
++ goto bail_einj;
+ }
+
+-
+ mci->pdev = &pdev->dev;
+
+ priv = mci->pvt_info;
+@@ -1147,14 +1146,14 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ bail_scrub:
+ priv->scrub_enable = 0;
+ cancel_delayed_work_sync(&(priv->i5100_scrubbing));
+- edac_mc_free(mci);
+-
+-bail_disable_einj:
+ pci_disable_device(einj);
+
+ bail_einj:
+ pci_dev_put(einj);
+
++bail_mc_free:
++ edac_mc_free(mci);
++
+ bail_disable_ch1:
+ pci_disable_device(ch1mm);
+
+diff --git a/drivers/edac/ti_edac.c b/drivers/edac/ti_edac.c
+index 6ac26d1b929f0..3247689467435 100644
+--- a/drivers/edac/ti_edac.c
++++ b/drivers/edac/ti_edac.c
+@@ -278,7 +278,8 @@ static int ti_edac_probe(struct platform_device *pdev)
+
+ /* add EMIF ECC error handler */
+ error_irq = platform_get_irq(pdev, 0);
+- if (!error_irq) {
++ if (error_irq < 0) {
++ ret = error_irq;
+ edac_printk(KERN_ERR, EDAC_MOD_NAME,
+ "EMIF irq number not defined.\n");
+ goto err;
+diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
+index 90ed20083009f..05eba6dec5ebf 100644
+--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
++++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
+@@ -2119,7 +2119,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
+ intel_dp->dpcd,
+ sizeof(intel_dp->dpcd));
+ cdv_intel_edp_panel_vdd_off(gma_encoder);
+- if (ret == 0) {
++ if (ret <= 0) {
+ /* if this fails, presume the device is a ghost */
+ DRM_INFO("failed to retrieve link info, disabling eDP\n");
+ cdv_intel_dp_encoder_destroy(encoder);
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index a9da1526c40ae..11bd2ca22a2e6 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -796,7 +796,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ case 0x3b: /* Battery Strength */
+ hidinput_setup_battery(device, HID_INPUT_REPORT, field);
+ usage->type = EV_PWR;
+- goto ignore;
++ return;
+
+ case 0x3c: /* Invert */
+ map_key_clear(BTN_TOOL_RUBBER);
+@@ -1052,7 +1052,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ case HID_DC_BATTERYSTRENGTH:
+ hidinput_setup_battery(device, HID_INPUT_REPORT, field);
+ usage->type = EV_PWR;
+- goto ignore;
++ return;
+ }
+ goto unknown;
+
+diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
+index bf4675a273965..9be8c31f613fd 100644
+--- a/drivers/hid/hid-roccat-kone.c
++++ b/drivers/hid/hid-roccat-kone.c
+@@ -297,31 +297,40 @@ static ssize_t kone_sysfs_write_settings(struct file *fp, struct kobject *kobj,
+ struct kone_device *kone = hid_get_drvdata(dev_get_drvdata(dev));
+ struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev));
+ int retval = 0, difference, old_profile;
++ struct kone_settings *settings = (struct kone_settings *)buf;
+
+ /* I need to get my data in one piece */
+ if (off != 0 || count != sizeof(struct kone_settings))
+ return -EINVAL;
+
+ mutex_lock(&kone->kone_lock);
+- difference = memcmp(buf, &kone->settings, sizeof(struct kone_settings));
++ difference = memcmp(settings, &kone->settings,
++ sizeof(struct kone_settings));
+ if (difference) {
+- retval = kone_set_settings(usb_dev,
+- (struct kone_settings const *)buf);
+- if (retval) {
+- mutex_unlock(&kone->kone_lock);
+- return retval;
++ if (settings->startup_profile < 1 ||
++ settings->startup_profile > 5) {
++ retval = -EINVAL;
++ goto unlock;
+ }
+
++ retval = kone_set_settings(usb_dev, settings);
++ if (retval)
++ goto unlock;
++
+ old_profile = kone->settings.startup_profile;
+- memcpy(&kone->settings, buf, sizeof(struct kone_settings));
++ memcpy(&kone->settings, settings, sizeof(struct kone_settings));
+
+ kone_profile_activated(kone, kone->settings.startup_profile);
+
+ if (kone->settings.startup_profile != old_profile)
+ kone_profile_report(kone, kone->settings.startup_profile);
+ }
++unlock:
+ mutex_unlock(&kone->kone_lock);
+
++ if (retval)
++ return retval;
++
+ return sizeof(struct kone_settings);
+ }
+ static BIN_ATTR(settings, 0660, kone_sysfs_read_settings,
+diff --git a/drivers/hwmon/pmbus/max34440.c b/drivers/hwmon/pmbus/max34440.c
+index 47576c4600105..9af5ab52ca31c 100644
+--- a/drivers/hwmon/pmbus/max34440.c
++++ b/drivers/hwmon/pmbus/max34440.c
+@@ -400,7 +400,6 @@ static struct pmbus_driver_info max34440_info[] = {
+ .func[18] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
+ .func[19] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
+ .func[20] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
+- .read_byte_data = max34440_read_byte_data,
+ .read_word_data = max34440_read_word_data,
+ .write_word_data = max34440_write_word_data,
+ },
+@@ -431,7 +430,6 @@ static struct pmbus_driver_info max34440_info[] = {
+ .func[15] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
+ .func[16] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
+ .func[17] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
+- .read_byte_data = max34440_read_byte_data,
+ .read_word_data = max34440_read_word_data,
+ .write_word_data = max34440_write_word_data,
+ },
+@@ -467,7 +465,6 @@ static struct pmbus_driver_info max34440_info[] = {
+ .func[19] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
+ .func[20] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
+ .func[21] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP,
+- .read_byte_data = max34440_read_byte_data,
+ .read_word_data = max34440_read_word_data,
+ .write_word_data = max34440_write_word_data,
+ },
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index 2acc30c3d5b2d..01052de6bedbf 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -588,6 +588,7 @@ static int ucma_free_ctx(struct ucma_context *ctx)
+ list_move_tail(&uevent->list, &list);
+ }
+ list_del(&ctx->list);
++ events_reported = ctx->events_reported;
+ mutex_unlock(&ctx->file->mut);
+
+ list_for_each_entry_safe(uevent, tmp, &list, list) {
+@@ -597,7 +598,6 @@ static int ucma_free_ctx(struct ucma_context *ctx)
+ kfree(uevent);
+ }
+
+- events_reported = ctx->events_reported;
+ mutex_destroy(&ctx->mutex);
+ kfree(ctx);
+ return events_reported;
+@@ -1476,7 +1476,9 @@ static ssize_t ucma_process_join(struct ucma_file *file,
+ return 0;
+
+ err3:
++ mutex_lock(&ctx->mutex);
+ rdma_leave_multicast(ctx->cm_id, (struct sockaddr *) &mc->addr);
++ mutex_unlock(&ctx->mutex);
+ ucma_cleanup_mc_events(mc);
+ err2:
+ mutex_lock(&mut);
+@@ -1644,7 +1646,9 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file,
+
+ cur_file = ctx->file;
+ if (cur_file == new_file) {
++ mutex_lock(&cur_file->mut);
+ resp.events_reported = ctx->events_reported;
++ mutex_unlock(&cur_file->mut);
+ goto response;
+ }
+
+diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c
+index 8c79a480f2b76..d3e11503e67ca 100644
+--- a/drivers/infiniband/hw/mlx4/cm.c
++++ b/drivers/infiniband/hw/mlx4/cm.c
+@@ -307,6 +307,9 @@ static void schedule_delayed(struct ib_device *ibdev, struct id_map_entry *id)
+ if (!sriov->is_going_down) {
+ id->scheduled_delete = 1;
+ schedule_delayed_work(&id->timeout, CM_CLEANUP_CACHE_TIMEOUT);
++ } else if (id->scheduled_delete) {
++ /* Adjust timeout if already scheduled */
++ mod_delayed_work(system_wq, &id->timeout, CM_CLEANUP_CACHE_TIMEOUT);
+ }
+ spin_unlock_irqrestore(&sriov->going_down_lock, flags);
+ spin_unlock(&sriov->id_map_lock);
+diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
+index 5aaa2a6c431b6..418b9312fb2d7 100644
+--- a/drivers/infiniband/hw/mlx4/mad.c
++++ b/drivers/infiniband/hw/mlx4/mad.c
+@@ -1305,6 +1305,18 @@ static void mlx4_ib_tunnel_comp_handler(struct ib_cq *cq, void *arg)
+ spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags);
+ }
+
++static void mlx4_ib_wire_comp_handler(struct ib_cq *cq, void *arg)
++{
++ unsigned long flags;
++ struct mlx4_ib_demux_pv_ctx *ctx = cq->cq_context;
++ struct mlx4_ib_dev *dev = to_mdev(ctx->ib_dev);
++
++ spin_lock_irqsave(&dev->sriov.going_down_lock, flags);
++ if (!dev->sriov.is_going_down && ctx->state == DEMUX_PV_STATE_ACTIVE)
++ queue_work(ctx->wi_wq, &ctx->work);
++ spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags);
++}
++
+ static int mlx4_ib_post_pv_qp_buf(struct mlx4_ib_demux_pv_ctx *ctx,
+ struct mlx4_ib_demux_pv_qp *tun_qp,
+ int index)
+@@ -2000,7 +2012,8 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port,
+ cq_size *= 2;
+
+ cq_attr.cqe = cq_size;
+- ctx->cq = ib_create_cq(ctx->ib_dev, mlx4_ib_tunnel_comp_handler,
++ ctx->cq = ib_create_cq(ctx->ib_dev,
++ create_tun ? mlx4_ib_tunnel_comp_handler : mlx4_ib_wire_comp_handler,
+ NULL, ctx, &cq_attr);
+ if (IS_ERR(ctx->cq)) {
+ ret = PTR_ERR(ctx->cq);
+@@ -2037,6 +2050,7 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port,
+ INIT_WORK(&ctx->work, mlx4_ib_sqp_comp_worker);
+
+ ctx->wq = to_mdev(ibdev)->sriov.demux[port - 1].wq;
++ ctx->wi_wq = to_mdev(ibdev)->sriov.demux[port - 1].wi_wq;
+
+ ret = ib_req_notify_cq(ctx->cq, IB_CQ_NEXT_COMP);
+ if (ret) {
+@@ -2180,7 +2194,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,
+ goto err_mcg;
+ }
+
+- snprintf(name, sizeof name, "mlx4_ibt%d", port);
++ snprintf(name, sizeof(name), "mlx4_ibt%d", port);
+ ctx->wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM);
+ if (!ctx->wq) {
+ pr_err("Failed to create tunnelling WQ for port %d\n", port);
+@@ -2188,7 +2202,15 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,
+ goto err_wq;
+ }
+
+- snprintf(name, sizeof name, "mlx4_ibud%d", port);
++ snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
++ ctx->wi_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM);
++ if (!ctx->wi_wq) {
++ pr_err("Failed to create wire WQ for port %d\n", port);
++ ret = -ENOMEM;
++ goto err_wiwq;
++ }
++
++ snprintf(name, sizeof(name), "mlx4_ibud%d", port);
+ ctx->ud_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM);
+ if (!ctx->ud_wq) {
+ pr_err("Failed to create up/down WQ for port %d\n", port);
+@@ -2199,6 +2221,10 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,
+ return 0;
+
+ err_udwq:
++ destroy_workqueue(ctx->wi_wq);
++ ctx->wi_wq = NULL;
++
++err_wiwq:
+ destroy_workqueue(ctx->wq);
+ ctx->wq = NULL;
+
+@@ -2246,12 +2272,14 @@ static void mlx4_ib_free_demux_ctx(struct mlx4_ib_demux_ctx *ctx)
+ ctx->tun[i]->state = DEMUX_PV_STATE_DOWNING;
+ }
+ flush_workqueue(ctx->wq);
++ flush_workqueue(ctx->wi_wq);
+ for (i = 0; i < dev->dev->caps.sqp_demux; i++) {
+ destroy_pv_resources(dev, i, ctx->port, ctx->tun[i], 0);
+ free_pv_object(dev, i, ctx->port);
+ }
+ kfree(ctx->tun);
+ destroy_workqueue(ctx->ud_wq);
++ destroy_workqueue(ctx->wi_wq);
+ destroy_workqueue(ctx->wq);
+ }
+ }
+diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
+index e10dccc7958f1..76ca67aa40158 100644
+--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
++++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
+@@ -464,6 +464,7 @@ struct mlx4_ib_demux_pv_ctx {
+ struct ib_pd *pd;
+ struct work_struct work;
+ struct workqueue_struct *wq;
++ struct workqueue_struct *wi_wq;
+ struct mlx4_ib_demux_pv_qp qp[2];
+ };
+
+@@ -471,6 +472,7 @@ struct mlx4_ib_demux_ctx {
+ struct ib_device *ib_dev;
+ int port;
+ struct workqueue_struct *wq;
++ struct workqueue_struct *wi_wq;
+ struct workqueue_struct *ud_wq;
+ spinlock_t ud_lock;
+ atomic64_t subnet_prefix;
+diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
+index d1680d3b58250..2a82661620fe7 100644
+--- a/drivers/infiniband/hw/qedr/main.c
++++ b/drivers/infiniband/hw/qedr/main.c
+@@ -604,7 +604,7 @@ static int qedr_set_device_attr(struct qedr_dev *dev)
+ qed_attr = dev->ops->rdma_query_device(dev->rdma_ctx);
+
+ /* Part 2 - check capabilities */
+- page_size = ~dev->attr.page_size_caps + 1;
++ page_size = ~qed_attr->page_size_caps + 1;
+ if (page_size > PAGE_SIZE) {
+ DP_ERR(dev,
+ "Kernel PAGE_SIZE is %ld which is smaller than minimum page size (%d) required by qedr\n",
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 7b26afc7fef35..f847f0a9f204d 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -2522,7 +2522,7 @@ int qedr_query_qp(struct ib_qp *ibqp,
+ qp_attr->cap.max_recv_wr = qp->rq.max_wr;
+ qp_attr->cap.max_send_sge = qp->sq.max_sges;
+ qp_attr->cap.max_recv_sge = qp->rq.max_sges;
+- qp_attr->cap.max_inline_data = ROCE_REQ_MAX_INLINE_DATA_SIZE;
++ qp_attr->cap.max_inline_data = dev->attr.max_inline;
+ qp_init_attr->cap = qp_attr->cap;
+
+ qp_attr->ah_attr.type = RDMA_AH_ATTR_TYPE_ROCE;
+diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c
+index 12e79f9e32d53..d9a9644306096 100644
+--- a/drivers/media/i2c/m5mols/m5mols_core.c
++++ b/drivers/media/i2c/m5mols/m5mols_core.c
+@@ -768,7 +768,8 @@ static int m5mols_sensor_power(struct m5mols_info *info, bool enable)
+
+ ret = regulator_bulk_enable(ARRAY_SIZE(supplies), supplies);
+ if (ret) {
+- info->set_power(&client->dev, 0);
++ if (info->set_power)
++ info->set_power(&client->dev, 0);
+ return ret;
+ }
+
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index e4c0a27b636aa..d9bc3851bf63b 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -919,8 +919,8 @@ static const struct cec_adap_ops tc358743_cec_adap_ops = {
+ .adap_monitor_all_enable = tc358743_cec_adap_monitor_all_enable,
+ };
+
+-static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus,
+- bool *handled)
++static void tc358743_cec_handler(struct v4l2_subdev *sd, u16 intstatus,
++ bool *handled)
+ {
+ struct tc358743_state *state = to_state(sd);
+ unsigned int cec_rxint, cec_txint;
+@@ -953,7 +953,8 @@ static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus,
+ cec_transmit_attempt_done(state->cec_adap,
+ CEC_TX_STATUS_ERROR);
+ }
+- *handled = true;
++ if (handled)
++ *handled = true;
+ }
+ if ((intstatus & MASK_CEC_RINT) &&
+ (cec_rxint & MASK_CECRIEND)) {
+@@ -968,7 +969,8 @@ static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus,
+ msg.msg[i] = v & 0xff;
+ }
+ cec_received_msg(state->cec_adap, &msg);
+- *handled = true;
++ if (handled)
++ *handled = true;
+ }
+ i2c_wr16(sd, INTSTATUS,
+ intstatus & (MASK_CEC_RINT | MASK_CEC_TINT));
+@@ -1432,7 +1434,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
+
+ #ifdef CONFIG_VIDEO_TC358743_CEC
+ if (intstatus & (MASK_CEC_RINT | MASK_CEC_TINT)) {
+- tc358743_cec_isr(sd, intstatus, handled);
++ tc358743_cec_handler(sd, intstatus, handled);
+ i2c_wr16(sd, INTSTATUS,
+ intstatus & (MASK_CEC_RINT | MASK_CEC_TINT));
+ intstatus &= ~(MASK_CEC_RINT | MASK_CEC_TINT);
+@@ -1461,7 +1463,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
+ static irqreturn_t tc358743_irq_handler(int irq, void *dev_id)
+ {
+ struct tc358743_state *state = dev_id;
+- bool handled;
++ bool handled = false;
+
+ tc358743_isr(&state->sd, 0, &handled);
+
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index 2d25a197dc657..f5fca01f3248e 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -1257,11 +1257,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd)
+ if (IS_ERR(pctl->state_default))
+ return PTR_ERR(pctl->state_default);
+
++ /* PINCTRL_STATE_IDLE is optional */
+ pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl,
+ PINCTRL_STATE_IDLE);
+- if (IS_ERR(pctl->state_idle))
+- return PTR_ERR(pctl->state_idle);
+-
+ return 0;
+ }
+
+diff --git a/drivers/media/platform/mx2_emmaprp.c b/drivers/media/platform/mx2_emmaprp.c
+index 419e1cb10dc66..f4be4c672d40e 100644
+--- a/drivers/media/platform/mx2_emmaprp.c
++++ b/drivers/media/platform/mx2_emmaprp.c
+@@ -929,8 +929,11 @@ static int emmaprp_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, pcdev);
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq < 0)
+- return irq;
++ if (irq < 0) {
++ ret = irq;
++ goto rel_vdev;
++ }
++
+ ret = devm_request_irq(&pdev->dev, irq, emmaprp_irq, 0,
+ dev_name(&pdev->dev), pcdev);
+ if (ret)
+diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
+index addd03b517481..00e52f0b8251b 100644
+--- a/drivers/media/platform/omap3isp/isp.c
++++ b/drivers/media/platform/omap3isp/isp.c
+@@ -2265,8 +2265,10 @@ static int isp_probe(struct platform_device *pdev)
+ mem = platform_get_resource(pdev, IORESOURCE_MEM, i);
+ isp->mmio_base[map_idx] =
+ devm_ioremap_resource(isp->dev, mem);
+- if (IS_ERR(isp->mmio_base[map_idx]))
+- return PTR_ERR(isp->mmio_base[map_idx]);
++ if (IS_ERR(isp->mmio_base[map_idx])) {
++ ret = PTR_ERR(isp->mmio_base[map_idx]);
++ goto error;
++ }
+ }
+
+ ret = isp_get_clocks(isp);
+diff --git a/drivers/media/platform/qcom/camss/camss-csiphy.c b/drivers/media/platform/qcom/camss/camss-csiphy.c
+index 008afb85023be..3c5b9082ad723 100644
+--- a/drivers/media/platform/qcom/camss/camss-csiphy.c
++++ b/drivers/media/platform/qcom/camss/camss-csiphy.c
+@@ -176,8 +176,10 @@ static int csiphy_set_power(struct v4l2_subdev *sd, int on)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_sync(dev);
+ return ret;
++ }
+
+ ret = csiphy_set_clock_rates(csiphy);
+ if (ret < 0) {
+diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c
+index 5c6b00737fe75..05c712e00a2a7 100644
+--- a/drivers/media/platform/rcar-fcp.c
++++ b/drivers/media/platform/rcar-fcp.c
+@@ -103,8 +103,10 @@ int rcar_fcp_enable(struct rcar_fcp_device *fcp)
+ return 0;
+
+ ret = pm_runtime_get_sync(fcp->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(fcp->dev);
+ return ret;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/media/platform/rcar-vin/rcar-dma.c b/drivers/media/platform/rcar-vin/rcar-dma.c
+index 92323310f7352..70a8cc433a03f 100644
+--- a/drivers/media/platform/rcar-vin/rcar-dma.c
++++ b/drivers/media/platform/rcar-vin/rcar-dma.c
+@@ -1323,8 +1323,10 @@ int rvin_set_channel_routing(struct rvin_dev *vin, u8 chsel)
+ int ret;
+
+ ret = pm_runtime_get_sync(vin->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(vin->dev);
+ return ret;
++ }
+
+ /* Make register writes take effect immediately. */
+ vnmc = rvin_read(vin, VNMC_REG);
+diff --git a/drivers/media/platform/rockchip/rga/rga-buf.c b/drivers/media/platform/rockchip/rga/rga-buf.c
+index 356821c2dacf0..0932f1445deab 100644
+--- a/drivers/media/platform/rockchip/rga/rga-buf.c
++++ b/drivers/media/platform/rockchip/rga/rga-buf.c
+@@ -89,6 +89,7 @@ static int rga_buf_start_streaming(struct vb2_queue *q, unsigned int count)
+
+ ret = pm_runtime_get_sync(rga->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(rga->dev);
+ rga_buf_return_buffers(q, VB2_BUF_STATE_QUEUED);
+ return ret;
+ }
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+index 5e080f32b0e82..95abf2bd7ebae 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+@@ -83,8 +83,10 @@ int s5p_mfc_power_on(void)
+ int i, ret = 0;
+
+ ret = pm_runtime_get_sync(pm->device);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(pm->device);
+ return ret;
++ }
+
+ /* clock control */
+ for (i = 0; i < pm->num_clocks; i++) {
+diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c
+index 18d0b56417894..ee1a211797673 100644
+--- a/drivers/media/platform/stm32/stm32-dcmi.c
++++ b/drivers/media/platform/stm32/stm32-dcmi.c
+@@ -587,7 +587,7 @@ static int dcmi_start_streaming(struct vb2_queue *vq, unsigned int count)
+ if (ret < 0) {
+ dev_err(dcmi->dev, "%s: Failed to start streaming, cannot get sync (%d)\n",
+ __func__, ret);
+- goto err_release_buffers;
++ goto err_pm_put;
+ }
+
+ /* Enable stream on the sub device */
+@@ -682,8 +682,6 @@ err_subdev_streamoff:
+
+ err_pm_put:
+ pm_runtime_put(dcmi->dev);
+-
+-err_release_buffers:
+ spin_lock_irq(&dcmi->irqlock);
+ /*
+ * Return all buffers to vb2 in QUEUED state.
+diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
+index a285b9db7ee86..70a8371b7e9a1 100644
+--- a/drivers/media/platform/ti-vpe/vpe.c
++++ b/drivers/media/platform/ti-vpe/vpe.c
+@@ -2451,6 +2451,8 @@ static int vpe_runtime_get(struct platform_device *pdev)
+
+ r = pm_runtime_get_sync(&pdev->dev);
+ WARN_ON(r < 0);
++ if (r)
++ pm_runtime_put_noidle(&pdev->dev);
+ return r < 0 ? r : 0;
+ }
+
+diff --git a/drivers/media/tuners/tuner-simple.c b/drivers/media/tuners/tuner-simple.c
+index 29c1473f2e9f6..81e24cf0c8b80 100644
+--- a/drivers/media/tuners/tuner-simple.c
++++ b/drivers/media/tuners/tuner-simple.c
+@@ -499,7 +499,7 @@ static int simple_radio_bandswitch(struct dvb_frontend *fe, u8 *buffer)
+ case TUNER_TENA_9533_DI:
+ case TUNER_YMEC_TVF_5533MF:
+ tuner_dbg("This tuner doesn't have FM. Most cards have a TEA5767 for FM\n");
+- return 0;
++ return -EINVAL;
+ case TUNER_PHILIPS_FM1216ME_MK3:
+ case TUNER_PHILIPS_FM1236_MK3:
+ case TUNER_PHILIPS_FMD1216ME_MK3:
+@@ -701,7 +701,8 @@ static int simple_set_radio_freq(struct dvb_frontend *fe,
+ TUNER_RATIO_SELECT_50; /* 50 kHz step */
+
+ /* Bandswitch byte */
+- simple_radio_bandswitch(fe, &buffer[0]);
++ if (simple_radio_bandswitch(fe, &buffer[0]))
++ return 0;
+
+ /* Convert from 1/16 kHz V4L steps to 1/20 MHz (=50 kHz) PLL steps
+ freq * (1 Mhz / 16000 V4L steps) * (20 PLL steps / 1 MHz) =
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
+index f2854337cdcac..abfc49901222e 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -778,12 +778,16 @@ static s32 uvc_get_le_value(struct uvc_control_mapping *mapping,
+ offset &= 7;
+ mask = ((1LL << bits) - 1) << offset;
+
+- for (; bits > 0; data++) {
++ while (1) {
+ u8 byte = *data & mask;
+ value |= offset > 0 ? (byte >> offset) : (byte << (-offset));
+ bits -= 8 - (offset > 0 ? offset : 0);
++ if (bits <= 0)
++ break;
++
+ offset -= 8;
+ mask = (1 << bits) - 1;
++ data++;
+ }
+
+ /* Sign-extend the value if needed. */
+diff --git a/drivers/media/usb/uvc/uvc_entity.c b/drivers/media/usb/uvc/uvc_entity.c
+index 554063c07d7a2..f2457953f27c6 100644
+--- a/drivers/media/usb/uvc/uvc_entity.c
++++ b/drivers/media/usb/uvc/uvc_entity.c
+@@ -78,10 +78,45 @@ static int uvc_mc_init_entity(struct uvc_video_chain *chain,
+ int ret;
+
+ if (UVC_ENTITY_TYPE(entity) != UVC_TT_STREAMING) {
++ u32 function;
++
+ v4l2_subdev_init(&entity->subdev, &uvc_subdev_ops);
+ strlcpy(entity->subdev.name, entity->name,
+ sizeof(entity->subdev.name));
+
++ switch (UVC_ENTITY_TYPE(entity)) {
++ case UVC_VC_SELECTOR_UNIT:
++ function = MEDIA_ENT_F_VID_MUX;
++ break;
++ case UVC_VC_PROCESSING_UNIT:
++ case UVC_VC_EXTENSION_UNIT:
++ /* For lack of a better option. */
++ function = MEDIA_ENT_F_PROC_VIDEO_PIXEL_FORMATTER;
++ break;
++ case UVC_COMPOSITE_CONNECTOR:
++ case UVC_COMPONENT_CONNECTOR:
++ function = MEDIA_ENT_F_CONN_COMPOSITE;
++ break;
++ case UVC_SVIDEO_CONNECTOR:
++ function = MEDIA_ENT_F_CONN_SVIDEO;
++ break;
++ case UVC_ITT_CAMERA:
++ function = MEDIA_ENT_F_CAM_SENSOR;
++ break;
++ case UVC_TT_VENDOR_SPECIFIC:
++ case UVC_ITT_VENDOR_SPECIFIC:
++ case UVC_ITT_MEDIA_TRANSPORT_INPUT:
++ case UVC_OTT_VENDOR_SPECIFIC:
++ case UVC_OTT_DISPLAY:
++ case UVC_OTT_MEDIA_TRANSPORT_OUTPUT:
++ case UVC_EXTERNAL_VENDOR_SPECIFIC:
++ default:
++ function = MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN;
++ break;
++ }
++
++ entity->subdev.entity.function = function;
++
+ ret = media_entity_pads_init(&entity->subdev.entity,
+ entity->num_pads, entity->pads);
+
+diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
+index e0173bf4b0dc7..ec1ac61a21ed1 100644
+--- a/drivers/mfd/sm501.c
++++ b/drivers/mfd/sm501.c
+@@ -1429,8 +1429,14 @@ static int sm501_plat_probe(struct platform_device *dev)
+ goto err_claim;
+ }
+
+- return sm501_init_dev(sm);
++ ret = sm501_init_dev(sm);
++ if (ret)
++ goto err_unmap;
++
++ return 0;
+
++ err_unmap:
++ iounmap(sm->regs);
+ err_claim:
+ release_resource(sm->regs_claim);
+ kfree(sm->regs_claim);
+diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c
+index 0e4193cb08cf1..e1f59b17715d5 100644
+--- a/drivers/misc/mic/scif/scif_rma.c
++++ b/drivers/misc/mic/scif/scif_rma.c
+@@ -1403,6 +1403,8 @@ retry:
+ NULL);
+ up_write(&mm->mmap_sem);
+ if (nr_pages != pinned_pages->nr_pages) {
++ if (pinned_pages->nr_pages < 0)
++ pinned_pages->nr_pages = 0;
+ if (try_upgrade) {
+ if (ulimit)
+ __scif_dec_pinned_vm_lock(mm,
+@@ -1423,7 +1425,6 @@ retry:
+
+ if (pinned_pages->nr_pages < nr_pages) {
+ err = -EFAULT;
+- pinned_pages->nr_pages = nr_pages;
+ goto dec_pinned;
+ }
+
+@@ -1436,7 +1437,6 @@ dec_pinned:
+ __scif_dec_pinned_vm_lock(mm, nr_pages, 0);
+ /* Something went wrong! Rollback */
+ error_unmap:
+- pinned_pages->nr_pages = nr_pages;
+ scif_destroy_pinned_pages(pinned_pages);
+ *pages = NULL;
+ dev_dbg(scif_info.mdev.this_device,
+diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+index bd52f29b4a4e2..5e0d1ac67f73f 100644
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -671,8 +671,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
+ if (retval < (int)produce_q->kernel_if->num_pages) {
+ pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
+ retval);
+- qp_release_pages(produce_q->kernel_if->u.h.header_page,
+- retval, false);
++ if (retval > 0)
++ qp_release_pages(produce_q->kernel_if->u.h.header_page,
++ retval, false);
+ err = VMCI_ERROR_NO_MEM;
+ goto out;
+ }
+@@ -683,8 +684,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
+ if (retval < (int)consume_q->kernel_if->num_pages) {
+ pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
+ retval);
+- qp_release_pages(consume_q->kernel_if->u.h.header_page,
+- retval, false);
++ if (retval > 0)
++ qp_release_pages(consume_q->kernel_if->u.h.header_page,
++ retval, false);
+ qp_release_pages(produce_q->kernel_if->u.h.header_page,
+ produce_q->kernel_if->num_pages, false);
+ err = VMCI_ERROR_NO_MEM;
+diff --git a/drivers/mtd/lpddr/lpddr2_nvm.c b/drivers/mtd/lpddr/lpddr2_nvm.c
+index c950c880ad590..90e6cb64db69c 100644
+--- a/drivers/mtd/lpddr/lpddr2_nvm.c
++++ b/drivers/mtd/lpddr/lpddr2_nvm.c
+@@ -402,6 +402,17 @@ static int lpddr2_nvm_lock(struct mtd_info *mtd, loff_t start_add,
+ return lpddr2_nvm_do_block_op(mtd, start_add, len, LPDDR2_NVM_LOCK);
+ }
+
++static const struct mtd_info lpddr2_nvm_mtd_info = {
++ .type = MTD_RAM,
++ .writesize = 1,
++ .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK),
++ ._read = lpddr2_nvm_read,
++ ._write = lpddr2_nvm_write,
++ ._erase = lpddr2_nvm_erase,
++ ._unlock = lpddr2_nvm_unlock,
++ ._lock = lpddr2_nvm_lock,
++};
++
+ /*
+ * lpddr2_nvm driver probe method
+ */
+@@ -442,6 +453,7 @@ static int lpddr2_nvm_probe(struct platform_device *pdev)
+ .pfow_base = OW_BASE_ADDRESS,
+ .fldrv_priv = pcm_data,
+ };
++
+ if (IS_ERR(map->virt))
+ return PTR_ERR(map->virt);
+
+@@ -453,22 +465,13 @@ static int lpddr2_nvm_probe(struct platform_device *pdev)
+ return PTR_ERR(pcm_data->ctl_regs);
+
+ /* Populate mtd_info data structure */
+- *mtd = (struct mtd_info) {
+- .dev = { .parent = &pdev->dev },
+- .name = pdev->dev.init_name,
+- .type = MTD_RAM,
+- .priv = map,
+- .size = resource_size(add_range),
+- .erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width,
+- .writesize = 1,
+- .writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width,
+- .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK),
+- ._read = lpddr2_nvm_read,
+- ._write = lpddr2_nvm_write,
+- ._erase = lpddr2_nvm_erase,
+- ._unlock = lpddr2_nvm_unlock,
+- ._lock = lpddr2_nvm_lock,
+- };
++ *mtd = lpddr2_nvm_mtd_info;
++ mtd->dev.parent = &pdev->dev;
++ mtd->name = pdev->dev.init_name;
++ mtd->priv = map;
++ mtd->size = resource_size(add_range);
++ mtd->erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width;
++ mtd->writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width;
+
+ /* Verify the presence of the device looking for PFOW string */
+ if (!lpddr2_nvm_pfow_present(map)) {
+diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
+index e078fc41aa612..feeffde2d4fa9 100644
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -293,12 +293,13 @@ static void mtdoops_do_dump(struct kmsg_dumper *dumper,
+ kmsg_dump_get_buffer(dumper, true, cxt->oops_buf + MTDOOPS_HEADER_SIZE,
+ record_size - MTDOOPS_HEADER_SIZE, NULL);
+
+- /* Panics must be written immediately */
+- if (reason != KMSG_DUMP_OOPS)
++ if (reason != KMSG_DUMP_OOPS) {
++ /* Panics must be written immediately */
+ mtdoops_write(cxt, 1);
+-
+- /* For other cases, schedule work to write it "nicely" */
+- schedule_work(&cxt->work_write);
++ } else {
++ /* For other cases, schedule work to write it "nicely" */
++ schedule_work(&cxt->work_write);
++ }
+ }
+
+ static void mtdoops_notify_add(struct mtd_info *mtd)
+diff --git a/drivers/net/dsa/realtek-smi.h b/drivers/net/dsa/realtek-smi.h
+index 9a63b51e1d82f..6f2dab7e33d65 100644
+--- a/drivers/net/dsa/realtek-smi.h
++++ b/drivers/net/dsa/realtek-smi.h
+@@ -25,6 +25,9 @@ struct rtl8366_mib_counter {
+ const char *name;
+ };
+
++/**
++ * struct rtl8366_vlan_mc - Virtual LAN member configuration
++ */
+ struct rtl8366_vlan_mc {
+ u16 vid;
+ u16 untag;
+@@ -119,7 +122,6 @@ int realtek_smi_setup_mdio(struct realtek_smi *smi);
+ int rtl8366_mc_is_used(struct realtek_smi *smi, int mc_index, int *used);
+ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member,
+ u32 untag, u32 fid);
+-int rtl8366_get_pvid(struct realtek_smi *smi, int port, int *val);
+ int rtl8366_set_pvid(struct realtek_smi *smi, unsigned int port,
+ unsigned int vid);
+ int rtl8366_enable_vlan4k(struct realtek_smi *smi, bool enable);
+diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c
+index 430988f797225..dddbc86429bd9 100644
+--- a/drivers/net/dsa/rtl8366.c
++++ b/drivers/net/dsa/rtl8366.c
+@@ -36,12 +36,113 @@ int rtl8366_mc_is_used(struct realtek_smi *smi, int mc_index, int *used)
+ }
+ EXPORT_SYMBOL_GPL(rtl8366_mc_is_used);
+
++/**
++ * rtl8366_obtain_mc() - retrieve or allocate a VLAN member configuration
++ * @smi: the Realtek SMI device instance
++ * @vid: the VLAN ID to look up or allocate
++ * @vlanmc: the pointer will be assigned to a pointer to a valid member config
++ * if successful
++ * @return: index of a new member config or negative error number
++ */
++static int rtl8366_obtain_mc(struct realtek_smi *smi, int vid,
++ struct rtl8366_vlan_mc *vlanmc)
++{
++ struct rtl8366_vlan_4k vlan4k;
++ int ret;
++ int i;
++
++ /* Try to find an existing member config entry for this VID */
++ for (i = 0; i < smi->num_vlan_mc; i++) {
++ ret = smi->ops->get_vlan_mc(smi, i, vlanmc);
++ if (ret) {
++ dev_err(smi->dev, "error searching for VLAN MC %d for VID %d\n",
++ i, vid);
++ return ret;
++ }
++
++ if (vid == vlanmc->vid)
++ return i;
++ }
++
++ /* We have no MC entry for this VID, try to find an empty one */
++ for (i = 0; i < smi->num_vlan_mc; i++) {
++ ret = smi->ops->get_vlan_mc(smi, i, vlanmc);
++ if (ret) {
++ dev_err(smi->dev, "error searching for VLAN MC %d for VID %d\n",
++ i, vid);
++ return ret;
++ }
++
++ if (vlanmc->vid == 0 && vlanmc->member == 0) {
++ /* Update the entry from the 4K table */
++ ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k);
++ if (ret) {
++ dev_err(smi->dev, "error looking for 4K VLAN MC %d for VID %d\n",
++ i, vid);
++ return ret;
++ }
++
++ vlanmc->vid = vid;
++ vlanmc->member = vlan4k.member;
++ vlanmc->untag = vlan4k.untag;
++ vlanmc->fid = vlan4k.fid;
++ ret = smi->ops->set_vlan_mc(smi, i, vlanmc);
++ if (ret) {
++ dev_err(smi->dev, "unable to set/update VLAN MC %d for VID %d\n",
++ i, vid);
++ return ret;
++ }
++
++ dev_dbg(smi->dev, "created new MC at index %d for VID %d\n",
++ i, vid);
++ return i;
++ }
++ }
++
++ /* MC table is full, try to find an unused entry and replace it */
++ for (i = 0; i < smi->num_vlan_mc; i++) {
++ int used;
++
++ ret = rtl8366_mc_is_used(smi, i, &used);
++ if (ret)
++ return ret;
++
++ if (!used) {
++ /* Update the entry from the 4K table */
++ ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k);
++ if (ret)
++ return ret;
++
++ vlanmc->vid = vid;
++ vlanmc->member = vlan4k.member;
++ vlanmc->untag = vlan4k.untag;
++ vlanmc->fid = vlan4k.fid;
++ ret = smi->ops->set_vlan_mc(smi, i, vlanmc);
++ if (ret) {
++ dev_err(smi->dev, "unable to set/update VLAN MC %d for VID %d\n",
++ i, vid);
++ return ret;
++ }
++ dev_dbg(smi->dev, "recycled MC at index %i for VID %d\n",
++ i, vid);
++ return i;
++ }
++ }
++
++ dev_err(smi->dev, "all VLAN member configurations are in use\n");
++ return -ENOSPC;
++}
++
+ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member,
+ u32 untag, u32 fid)
+ {
++ struct rtl8366_vlan_mc vlanmc;
+ struct rtl8366_vlan_4k vlan4k;
++ int mc;
+ int ret;
+- int i;
++
++ if (!smi->ops->is_vlan_valid(smi, vid))
++ return -EINVAL;
+
+ dev_dbg(smi->dev,
+ "setting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n",
+@@ -63,133 +164,58 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member,
+ "resulting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n",
+ vid, vlan4k.member, vlan4k.untag);
+
+- /* Try to find an existing MC entry for this VID */
+- for (i = 0; i < smi->num_vlan_mc; i++) {
+- struct rtl8366_vlan_mc vlanmc;
+-
+- ret = smi->ops->get_vlan_mc(smi, i, &vlanmc);
+- if (ret)
+- return ret;
+-
+- if (vid == vlanmc.vid) {
+- /* update the MC entry */
+- vlanmc.member |= member;
+- vlanmc.untag |= untag;
+- vlanmc.fid = fid;
+-
+- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc);
++ /* Find or allocate a member config for this VID */
++ ret = rtl8366_obtain_mc(smi, vid, &vlanmc);
++ if (ret < 0)
++ return ret;
++ mc = ret;
+
+- dev_dbg(smi->dev,
+- "resulting VLAN%d MC members: 0x%02x, untagged: 0x%02x\n",
+- vid, vlanmc.member, vlanmc.untag);
++ /* Update the MC entry */
++ vlanmc.member |= member;
++ vlanmc.untag |= untag;
++ vlanmc.fid = fid;
+
+- break;
+- }
+- }
++ /* Commit updates to the MC entry */
++ ret = smi->ops->set_vlan_mc(smi, mc, &vlanmc);
++ if (ret)
++ dev_err(smi->dev, "failed to commit changes to VLAN MC index %d for VID %d\n",
++ mc, vid);
++ else
++ dev_dbg(smi->dev,
++ "resulting VLAN%d MC members: 0x%02x, untagged: 0x%02x\n",
++ vid, vlanmc.member, vlanmc.untag);
+
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(rtl8366_set_vlan);
+
+-int rtl8366_get_pvid(struct realtek_smi *smi, int port, int *val)
+-{
+- struct rtl8366_vlan_mc vlanmc;
+- int ret;
+- int index;
+-
+- ret = smi->ops->get_mc_index(smi, port, &index);
+- if (ret)
+- return ret;
+-
+- ret = smi->ops->get_vlan_mc(smi, index, &vlanmc);
+- if (ret)
+- return ret;
+-
+- *val = vlanmc.vid;
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(rtl8366_get_pvid);
+-
+ int rtl8366_set_pvid(struct realtek_smi *smi, unsigned int port,
+ unsigned int vid)
+ {
+ struct rtl8366_vlan_mc vlanmc;
+- struct rtl8366_vlan_4k vlan4k;
++ int mc;
+ int ret;
+- int i;
+-
+- /* Try to find an existing MC entry for this VID */
+- for (i = 0; i < smi->num_vlan_mc; i++) {
+- ret = smi->ops->get_vlan_mc(smi, i, &vlanmc);
+- if (ret)
+- return ret;
+-
+- if (vid == vlanmc.vid) {
+- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc);
+- if (ret)
+- return ret;
+-
+- ret = smi->ops->set_mc_index(smi, port, i);
+- return ret;
+- }
+- }
+-
+- /* We have no MC entry for this VID, try to find an empty one */
+- for (i = 0; i < smi->num_vlan_mc; i++) {
+- ret = smi->ops->get_vlan_mc(smi, i, &vlanmc);
+- if (ret)
+- return ret;
+-
+- if (vlanmc.vid == 0 && vlanmc.member == 0) {
+- /* Update the entry from the 4K table */
+- ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k);
+- if (ret)
+- return ret;
+
+- vlanmc.vid = vid;
+- vlanmc.member = vlan4k.member;
+- vlanmc.untag = vlan4k.untag;
+- vlanmc.fid = vlan4k.fid;
+- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc);
+- if (ret)
+- return ret;
+-
+- ret = smi->ops->set_mc_index(smi, port, i);
+- return ret;
+- }
+- }
+-
+- /* MC table is full, try to find an unused entry and replace it */
+- for (i = 0; i < smi->num_vlan_mc; i++) {
+- int used;
+-
+- ret = rtl8366_mc_is_used(smi, i, &used);
+- if (ret)
+- return ret;
+-
+- if (!used) {
+- /* Update the entry from the 4K table */
+- ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k);
+- if (ret)
+- return ret;
++ if (!smi->ops->is_vlan_valid(smi, vid))
++ return -EINVAL;
+
+- vlanmc.vid = vid;
+- vlanmc.member = vlan4k.member;
+- vlanmc.untag = vlan4k.untag;
+- vlanmc.fid = vlan4k.fid;
+- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc);
+- if (ret)
+- return ret;
++ /* Find or allocate a member config for this VID */
++ ret = rtl8366_obtain_mc(smi, vid, &vlanmc);
++ if (ret < 0)
++ return ret;
++ mc = ret;
+
+- ret = smi->ops->set_mc_index(smi, port, i);
+- return ret;
+- }
++ ret = smi->ops->set_mc_index(smi, port, mc);
++ if (ret) {
++ dev_err(smi->dev, "set PVID: failed to set MC index %d for port %d\n",
++ mc, port);
++ return ret;
+ }
+
+- dev_err(smi->dev,
+- "all VLAN member configurations are in use\n");
++ dev_dbg(smi->dev, "set PVID: the PVID for port %d set to %d using existing MC index %d\n",
++ port, vid, mc);
+
+- return -ENOSPC;
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(rtl8366_set_pvid);
+
+@@ -389,7 +415,8 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port,
+ if (!smi->ops->is_vlan_valid(smi, vid))
+ return;
+
+- dev_info(smi->dev, "add VLAN on port %d, %s, %s\n",
++ dev_info(smi->dev, "add VLAN %d on port %d, %s, %s\n",
++ vlan->vid_begin,
+ port,
+ untagged ? "untagged" : "tagged",
+ pvid ? " PVID" : "no PVID");
+@@ -398,34 +425,29 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port,
+ dev_err(smi->dev, "port is DSA or CPU port\n");
+
+ for (vid = vlan->vid_begin; vid <= vlan->vid_end; vid++) {
+- int pvid_val = 0;
+-
+- dev_info(smi->dev, "add VLAN %04x\n", vid);
+ member |= BIT(port);
+
+ if (untagged)
+ untag |= BIT(port);
+
+- /* To ensure that we have a valid MC entry for this VLAN,
+- * initialize the port VLAN ID here.
+- */
+- ret = rtl8366_get_pvid(smi, port, &pvid_val);
+- if (ret < 0) {
+- dev_err(smi->dev, "could not lookup PVID for port %d\n",
+- port);
+- return;
+- }
+- if (pvid_val == 0) {
+- ret = rtl8366_set_pvid(smi, port, vid);
+- if (ret < 0)
+- return;
+- }
+-
+ ret = rtl8366_set_vlan(smi, vid, member, untag, 0);
+ if (ret)
+ dev_err(smi->dev,
+ "failed to set up VLAN %04x",
+ vid);
++
++ if (!pvid)
++ continue;
++
++ ret = rtl8366_set_pvid(smi, port, vid);
++ if (ret)
++ dev_err(smi->dev,
++ "failed to set PVID on port %d to VLAN %04x",
++ port, vid);
++
++ if (!ret)
++ dev_dbg(smi->dev, "VLAN add: added VLAN %d with PVID on port %d\n",
++ vid, port);
+ }
+ }
+ EXPORT_SYMBOL_GPL(rtl8366_vlan_add);
+diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c
+index f4b14b6acd22d..5aefd7a4696a5 100644
+--- a/drivers/net/dsa/rtl8366rb.c
++++ b/drivers/net/dsa/rtl8366rb.c
+@@ -1270,7 +1270,7 @@ static bool rtl8366rb_is_vlan_valid(struct realtek_smi *smi, unsigned int vlan)
+ if (smi->vlan4k_enabled)
+ max = RTL8366RB_NUM_VIDS - 1;
+
+- if (vlan == 0 || vlan >= max)
++ if (vlan == 0 || vlan > max)
+ return false;
+
+ return true;
+diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
+index 0dd64acd2a3fb..08cac1bfacafb 100644
+--- a/drivers/net/ethernet/cisco/enic/enic.h
++++ b/drivers/net/ethernet/cisco/enic/enic.h
+@@ -171,6 +171,7 @@ struct enic {
+ u16 num_vfs;
+ #endif
+ spinlock_t enic_api_lock;
++ bool enic_api_busy;
+ struct enic_port_profile *pp;
+
+ /* work queue cache line section */
+diff --git a/drivers/net/ethernet/cisco/enic/enic_api.c b/drivers/net/ethernet/cisco/enic/enic_api.c
+index b161f24522b87..b028ea2dec2b9 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_api.c
++++ b/drivers/net/ethernet/cisco/enic/enic_api.c
+@@ -34,6 +34,12 @@ int enic_api_devcmd_proxy_by_index(struct net_device *netdev, int vf,
+ struct vnic_dev *vdev = enic->vdev;
+
+ spin_lock(&enic->enic_api_lock);
++ while (enic->enic_api_busy) {
++ spin_unlock(&enic->enic_api_lock);
++ cpu_relax();
++ spin_lock(&enic->enic_api_lock);
++ }
++
+ spin_lock_bh(&enic->devcmd_lock);
+
+ vnic_dev_cmd_proxy_by_index_start(vdev, vf);
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
+index 026a3bd71204f..810cbe2210463 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -2142,8 +2142,6 @@ static int enic_dev_wait(struct vnic_dev *vdev,
+ int done;
+ int err;
+
+- BUG_ON(in_interrupt());
+-
+ err = start(vdev, arg);
+ if (err)
+ return err;
+@@ -2331,6 +2329,13 @@ static int enic_set_rss_nic_cfg(struct enic *enic)
+ rss_hash_bits, rss_base_cpu, rss_enable);
+ }
+
++static void enic_set_api_busy(struct enic *enic, bool busy)
++{
++ spin_lock(&enic->enic_api_lock);
++ enic->enic_api_busy = busy;
++ spin_unlock(&enic->enic_api_lock);
++}
++
+ static void enic_reset(struct work_struct *work)
+ {
+ struct enic *enic = container_of(work, struct enic, reset);
+@@ -2340,7 +2345,9 @@ static void enic_reset(struct work_struct *work)
+
+ rtnl_lock();
+
+- spin_lock(&enic->enic_api_lock);
++ /* Stop any activity from infiniband */
++ enic_set_api_busy(enic, true);
++
+ enic_stop(enic->netdev);
+ enic_dev_soft_reset(enic);
+ enic_reset_addr_lists(enic);
+@@ -2348,7 +2355,10 @@ static void enic_reset(struct work_struct *work)
+ enic_set_rss_nic_cfg(enic);
+ enic_dev_set_ig_vlan_rewrite_mode(enic);
+ enic_open(enic->netdev);
+- spin_unlock(&enic->enic_api_lock);
++
++ /* Allow infiniband to fiddle with the device again */
++ enic_set_api_busy(enic, false);
++
+ call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev);
+
+ rtnl_unlock();
+@@ -2360,7 +2370,9 @@ static void enic_tx_hang_reset(struct work_struct *work)
+
+ rtnl_lock();
+
+- spin_lock(&enic->enic_api_lock);
++ /* Stop any activity from infiniband */
++ enic_set_api_busy(enic, true);
++
+ enic_dev_hang_notify(enic);
+ enic_stop(enic->netdev);
+ enic_dev_hang_reset(enic);
+@@ -2369,7 +2381,10 @@ static void enic_tx_hang_reset(struct work_struct *work)
+ enic_set_rss_nic_cfg(enic);
+ enic_dev_set_ig_vlan_rewrite_mode(enic);
+ enic_open(enic->netdev);
+- spin_unlock(&enic->enic_api_lock);
++
++ /* Allow infiniband to fiddle with the device again */
++ enic_set_api_busy(enic, false);
++
+ call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev);
+
+ rtnl_unlock();
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 3b6da228140e3..7d1a669416f20 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -1897,6 +1897,27 @@ static int fec_enet_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
+ return ret;
+ }
+
++static void fec_enet_phy_reset_after_clk_enable(struct net_device *ndev)
++{
++ struct fec_enet_private *fep = netdev_priv(ndev);
++ struct phy_device *phy_dev = ndev->phydev;
++
++ if (phy_dev) {
++ phy_reset_after_clk_enable(phy_dev);
++ } else if (fep->phy_node) {
++ /*
++ * If the PHY still is not bound to the MAC, but there is
++ * OF PHY node and a matching PHY device instance already,
++ * use the OF PHY node to obtain the PHY device instance,
++ * and then use that PHY device instance when triggering
++ * the PHY reset.
++ */
++ phy_dev = of_phy_find_device(fep->phy_node);
++ phy_reset_after_clk_enable(phy_dev);
++ put_device(&phy_dev->mdio.dev);
++ }
++}
++
+ static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
+ {
+ struct fec_enet_private *fep = netdev_priv(ndev);
+@@ -1923,7 +1944,7 @@ static int fec_enet_clk_enable(struct net_device *ndev, bool enable)
+ if (ret)
+ goto failed_clk_ref;
+
+- phy_reset_after_clk_enable(ndev->phydev);
++ fec_enet_phy_reset_after_clk_enable(ndev);
+ } else {
+ clk_disable_unprepare(fep->clk_enet_out);
+ if (fep->clk_ptp) {
+@@ -2929,16 +2950,16 @@ fec_enet_open(struct net_device *ndev)
+ /* Init MAC prior to mii bus probe */
+ fec_restart(ndev);
+
+- /* Probe and connect to PHY when open the interface */
+- ret = fec_enet_mii_probe(ndev);
+- if (ret)
+- goto err_enet_mii_probe;
+-
+ /* Call phy_reset_after_clk_enable() again if it failed during
+ * phy_reset_after_clk_enable() before because the PHY wasn't probed.
+ */
+ if (reset_again)
+- phy_reset_after_clk_enable(ndev->phydev);
++ fec_enet_phy_reset_after_clk_enable(ndev);
++
++ /* Probe and connect to PHY when open the interface */
++ ret = fec_enet_mii_probe(ndev);
++ if (ret)
++ goto err_enet_mii_probe;
+
+ if (fep->quirks & FEC_QUIRK_ERR006687)
+ imx6q_cpuidle_fec_irqs_used();
+diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
+index e2f6670d6eaf0..75a1915d95aa8 100644
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -1330,6 +1330,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
+ int offset = ibmveth_rxq_frame_offset(adapter);
+ int csum_good = ibmveth_rxq_csum_good(adapter);
+ int lrg_pkt = ibmveth_rxq_large_packet(adapter);
++ __sum16 iph_check = 0;
+
+ skb = ibmveth_rxq_get_buffer(adapter);
+
+@@ -1366,16 +1367,26 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
+ skb_put(skb, length);
+ skb->protocol = eth_type_trans(skb, netdev);
+
+- if (csum_good) {
+- skb->ip_summed = CHECKSUM_UNNECESSARY;
+- ibmveth_rx_csum_helper(skb, adapter);
++ /* PHYP without PLSO support places a -1 in the ip
++ * checksum for large send frames.
++ */
++ if (skb->protocol == cpu_to_be16(ETH_P_IP)) {
++ struct iphdr *iph = (struct iphdr *)skb->data;
++
++ iph_check = iph->check;
+ }
+
+- if (length > netdev->mtu + ETH_HLEN) {
++ if ((length > netdev->mtu + ETH_HLEN) ||
++ lrg_pkt || iph_check == 0xffff) {
+ ibmveth_rx_mss_helper(skb, mss, lrg_pkt);
+ adapter->rx_large_packets++;
+ }
+
++ if (csum_good) {
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
++ ibmveth_rx_csum_helper(skb, adapter);
++ }
++
+ napi_gro_receive(napi, skb); /* send it up */
+
+ netdev->stats.rx_packets++;
+diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
+index ae195f8adff58..5bdff77c0ad10 100644
+--- a/drivers/net/ethernet/korina.c
++++ b/drivers/net/ethernet/korina.c
+@@ -1113,7 +1113,7 @@ out:
+ return rc;
+
+ probe_err_register:
+- kfree(lp->td_ring);
++ kfree(KSEG0ADDR(lp->td_ring));
+ probe_err_td_ring:
+ iounmap(lp->tx_dma_regs);
+ probe_err_dma_tx:
+@@ -1133,6 +1133,7 @@ static int korina_remove(struct platform_device *pdev)
+ iounmap(lp->eth_regs);
+ iounmap(lp->rx_dma_regs);
+ iounmap(lp->tx_dma_regs);
++ kfree(KSEG0ADDR(lp->td_ring));
+
+ unregister_netdev(bif->dev);
+ free_netdev(bif->dev);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+index 45d9a5f8fa1bc..f509a6ce31db7 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+@@ -945,6 +945,9 @@ int mlx4_en_poll_rx_cq(struct napi_struct *napi, int budget)
+ bool clean_complete = true;
+ int done;
+
++ if (!budget)
++ return 0;
++
+ if (priv->tx_ring_num[TX_XDP]) {
+ xdp_tx_cq = priv->tx_cq[TX_XDP][cq->ring];
+ if (xdp_tx_cq->xdp_busy) {
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+index 1857ee0f0871d..e58052d07e399 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+@@ -343,7 +343,7 @@ u32 mlx4_en_recycle_tx_desc(struct mlx4_en_priv *priv,
+ .dma = tx_info->map0_dma,
+ };
+
+- if (!mlx4_en_rx_recycle(ring->recycle_ring, &frame)) {
++ if (!napi_mode || !mlx4_en_rx_recycle(ring->recycle_ring, &frame)) {
+ dma_unmap_page(priv->ddev, tx_info->map0_dma,
+ PAGE_SIZE, priv->dma_dir);
+ put_page(tx_info->page);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+index d359e850dbf07..0fd62510fb277 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+@@ -475,8 +475,9 @@ void mlx5_pps_event(struct mlx5_core_dev *mdev,
+ switch (clock->ptp_info.pin_config[pin].func) {
+ case PTP_PF_EXTTS:
+ ptp_event.index = pin;
+- ptp_event.timestamp = timecounter_cyc2time(&clock->tc,
+- be64_to_cpu(eqe->data.pps.time_stamp));
++ ptp_event.timestamp =
++ mlx5_timecounter_cyc2time(clock,
++ be64_to_cpu(eqe->data.pps.time_stamp));
+ if (clock->pps_info.enabled) {
+ ptp_event.type = PTP_CLOCK_PPSUSR;
+ ptp_event.pps_times.ts_real =
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 6df404e3dd271..58dc4fe139fbe 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -4111,6 +4111,27 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
+ rtl_unlock_work(tp);
+ }
+
++static void rtl_init_rxcfg(struct rtl8169_private *tp)
++{
++ switch (tp->mac_version) {
++ case RTL_GIGA_MAC_VER_01 ... RTL_GIGA_MAC_VER_06:
++ case RTL_GIGA_MAC_VER_10 ... RTL_GIGA_MAC_VER_17:
++ RTL_W32(tp, RxConfig, RX_FIFO_THRESH | RX_DMA_BURST);
++ break;
++ case RTL_GIGA_MAC_VER_18 ... RTL_GIGA_MAC_VER_24:
++ case RTL_GIGA_MAC_VER_34 ... RTL_GIGA_MAC_VER_36:
++ case RTL_GIGA_MAC_VER_38:
++ RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
++ break;
++ case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_51:
++ RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
++ break;
++ default:
++ RTL_W32(tp, RxConfig, RX128_INT_EN | RX_DMA_BURST);
++ break;
++ }
++}
++
+ static int rtl_set_mac_address(struct net_device *dev, void *p)
+ {
+ struct rtl8169_private *tp = netdev_priv(dev);
+@@ -4128,6 +4149,10 @@ static int rtl_set_mac_address(struct net_device *dev, void *p)
+
+ pm_runtime_put_noidle(d);
+
++ /* Reportedly at least Asus X453MA truncates packets otherwise */
++ if (tp->mac_version == RTL_GIGA_MAC_VER_37)
++ rtl_init_rxcfg(tp);
++
+ return 0;
+ }
+
+@@ -4289,27 +4314,6 @@ static void rtl_pll_power_up(struct rtl8169_private *tp)
+ }
+ }
+
+-static void rtl_init_rxcfg(struct rtl8169_private *tp)
+-{
+- switch (tp->mac_version) {
+- case RTL_GIGA_MAC_VER_01 ... RTL_GIGA_MAC_VER_06:
+- case RTL_GIGA_MAC_VER_10 ... RTL_GIGA_MAC_VER_17:
+- RTL_W32(tp, RxConfig, RX_FIFO_THRESH | RX_DMA_BURST);
+- break;
+- case RTL_GIGA_MAC_VER_18 ... RTL_GIGA_MAC_VER_24:
+- case RTL_GIGA_MAC_VER_34 ... RTL_GIGA_MAC_VER_36:
+- case RTL_GIGA_MAC_VER_38:
+- RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
+- break;
+- case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_51:
+- RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
+- break;
+- default:
+- RTL_W32(tp, RxConfig, RX128_INT_EN | RX_DMA_BURST);
+- break;
+- }
+-}
+-
+ static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
+ {
+ tp->dirty_tx = tp->cur_tx = tp->cur_rx = 0;
+@@ -6826,7 +6830,7 @@ static int rtl8169_close(struct net_device *dev)
+
+ phy_disconnect(dev->phydev);
+
+- pci_free_irq(pdev, 0, tp);
++ free_irq(pci_irq_vector(pdev, 0), tp);
+
+ dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
+ tp->RxPhyAddr);
+@@ -6881,8 +6885,8 @@ static int rtl_open(struct net_device *dev)
+
+ rtl_request_firmware(tp);
+
+- retval = pci_request_irq(pdev, 0, rtl8169_interrupt, NULL, tp,
+- dev->name);
++ retval = request_irq(pci_irq_vector(pdev, 0), rtl8169_interrupt,
++ IRQF_NO_THREAD | IRQF_SHARED, dev->name, tp);
+ if (retval < 0)
+ goto err_release_fw_2;
+
+@@ -6915,7 +6919,7 @@ out:
+ return retval;
+
+ err_free_irq:
+- pci_free_irq(pdev, 0, tp);
++ free_irq(pci_irq_vector(pdev, 0), tp);
+ err_release_fw_2:
+ rtl_release_firmware(tp);
+ rtl8169_rx_clear(tp);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index c41879a955b57..2872684906e14 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -177,32 +177,6 @@ static void stmmac_enable_all_queues(struct stmmac_priv *priv)
+ }
+ }
+
+-/**
+- * stmmac_stop_all_queues - Stop all queues
+- * @priv: driver private structure
+- */
+-static void stmmac_stop_all_queues(struct stmmac_priv *priv)
+-{
+- u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+- u32 queue;
+-
+- for (queue = 0; queue < tx_queues_cnt; queue++)
+- netif_tx_stop_queue(netdev_get_tx_queue(priv->dev, queue));
+-}
+-
+-/**
+- * stmmac_start_all_queues - Start all queues
+- * @priv: driver private structure
+- */
+-static void stmmac_start_all_queues(struct stmmac_priv *priv)
+-{
+- u32 tx_queues_cnt = priv->plat->tx_queues_to_use;
+- u32 queue;
+-
+- for (queue = 0; queue < tx_queues_cnt; queue++)
+- netif_tx_start_queue(netdev_get_tx_queue(priv->dev, queue));
+-}
+-
+ static void stmmac_service_event_schedule(struct stmmac_priv *priv)
+ {
+ if (!test_bit(STMMAC_DOWN, &priv->state) &&
+@@ -2678,7 +2652,7 @@ static int stmmac_open(struct net_device *dev)
+ }
+
+ stmmac_enable_all_queues(priv);
+- stmmac_start_all_queues(priv);
++ netif_tx_start_all_queues(priv->dev);
+
+ return 0;
+
+@@ -2724,8 +2698,6 @@ static int stmmac_release(struct net_device *dev)
+ phy_disconnect(dev->phydev);
+ }
+
+- stmmac_stop_all_queues(priv);
+-
+ stmmac_disable_all_queues(priv);
+
+ for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+@@ -4519,7 +4491,6 @@ int stmmac_suspend(struct device *dev)
+ mutex_lock(&priv->lock);
+
+ netif_device_detach(ndev);
+- stmmac_stop_all_queues(priv);
+
+ stmmac_disable_all_queues(priv);
+
+@@ -4628,8 +4599,6 @@ int stmmac_resume(struct device *dev)
+
+ stmmac_enable_all_queues(priv);
+
+- stmmac_start_all_queues(priv);
+-
+ mutex_unlock(&priv->lock);
+
+ if (ndev->phydev)
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index af58bf54aa9b6..d2612b69257ea 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1312,6 +1312,7 @@ static const struct usb_device_id products[] = {
+ {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */
+ {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */
+ {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/
++ {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */
+
+ /* 4. Gobi 1000 devices */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
+diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c
+index 7221a53b8b144..500463044b1ab 100644
+--- a/drivers/net/wan/hdlc.c
++++ b/drivers/net/wan/hdlc.c
+@@ -49,7 +49,15 @@ static struct hdlc_proto *first_proto;
+ static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev,
+ struct packet_type *p, struct net_device *orig_dev)
+ {
+- struct hdlc_device *hdlc = dev_to_hdlc(dev);
++ struct hdlc_device *hdlc;
++
++ /* First make sure "dev" is an HDLC device */
++ if (!(dev->priv_flags & IFF_WAN_HDLC)) {
++ kfree_skb(skb);
++ return NET_RX_SUCCESS;
++ }
++
++ hdlc = dev_to_hdlc(dev);
+
+ if (!net_eq(dev_net(dev), &init_net)) {
+ kfree_skb(skb);
+diff --git a/drivers/net/wan/hdlc_raw_eth.c b/drivers/net/wan/hdlc_raw_eth.c
+index 8bd3ed9058132..676dea2918bf3 100644
+--- a/drivers/net/wan/hdlc_raw_eth.c
++++ b/drivers/net/wan/hdlc_raw_eth.c
+@@ -102,6 +102,7 @@ static int raw_eth_ioctl(struct net_device *dev, struct ifreq *ifr)
+ old_qlen = dev->tx_queue_len;
+ ether_setup(dev);
+ dev->tx_queue_len = old_qlen;
++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ eth_hw_addr_random(dev);
+ call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);
+ netif_dormant_off(dev);
+diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
+index f761d651c16e7..2276d608bca35 100644
+--- a/drivers/net/wireless/ath/ath10k/ce.c
++++ b/drivers/net/wireless/ath/ath10k/ce.c
+@@ -1453,7 +1453,7 @@ ath10k_ce_alloc_src_ring(struct ath10k *ar, unsigned int ce_id,
+ ret = ath10k_ce_alloc_shadow_base(ar, src_ring, nentries);
+ if (ret) {
+ dma_free_coherent(ar->dev,
+- (nentries * sizeof(struct ce_desc_64) +
++ (nentries * sizeof(struct ce_desc) +
+ CE_DESC_RING_ALIGN),
+ src_ring->base_addr_owner_space_unaligned,
+ base_addr);
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 81af403c19c2a..faaca7fe9ad1e 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -6862,7 +6862,7 @@ ath10k_mac_update_bss_chan_survey(struct ath10k *ar,
+ struct ieee80211_channel *channel)
+ {
+ int ret;
+- enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ_CLEAR;
++ enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ;
+
+ lockdep_assert_held(&ar->conf_mutex);
+
+diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
+index 0c61dbaa62a41..702c4761006ca 100644
+--- a/drivers/net/wireless/ath/ath6kl/main.c
++++ b/drivers/net/wireless/ath/ath6kl/main.c
+@@ -429,6 +429,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr,
+
+ ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid);
+
++ if (aid < 1 || aid > AP_MAX_NUM_STA)
++ return;
++
+ if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) {
+ struct ieee80211_mgmt *mgmt =
+ (struct ieee80211_mgmt *) assoc_info;
+diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
+index bc7916f2add09..987ebae8ea0e1 100644
+--- a/drivers/net/wireless/ath/ath6kl/wmi.c
++++ b/drivers/net/wireless/ath/ath6kl/wmi.c
+@@ -2648,6 +2648,11 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class,
+ return -EINVAL;
+ }
+
++ if (tsid >= 16) {
++ ath6kl_err("invalid tsid: %d\n", tsid);
++ return -EINVAL;
++ }
++
+ skb = ath6kl_wmi_get_new_buf(sizeof(*cmd));
+ if (!skb)
+ return -ENOMEM;
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index f705f0e1cb5be..05fca38b38ed4 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -342,6 +342,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
+
+ if (skb) {
+ htc_hdr = (struct htc_frame_hdr *) skb->data;
++ if (htc_hdr->endpoint_id >= ARRAY_SIZE(htc_handle->endpoint))
++ goto ret;
+ endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id];
+ skb_pull(skb, sizeof(struct htc_frame_hdr));
+
+diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
+index ad051f34e65b2..46ae4ec4ad47d 100644
+--- a/drivers/net/wireless/ath/wcn36xx/main.c
++++ b/drivers/net/wireless/ath/wcn36xx/main.c
+@@ -163,7 +163,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = {
+ .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+ .mcs = {
+ .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+- .rx_highest = cpu_to_le16(72),
++ .rx_highest = cpu_to_le16(150),
+ .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+ }
+ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+index 9d7b8834b8545..db4c541f58ae0 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -438,7 +438,7 @@ static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb,
+ ret = brcmf_proto_hdrpull(drvr, true, skb, ifp);
+
+ if (ret || !(*ifp) || !(*ifp)->ndev) {
+- if (ret != -ENODATA && *ifp)
++ if (ret != -ENODATA && *ifp && (*ifp)->ndev)
+ (*ifp)->ndev->stats.rx_errors++;
+ brcmu_pkt_buf_free_skb(skb);
+ return -ENODATA;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 58653598db146..525b26e0f65ee 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -3424,9 +3424,12 @@ static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
+ aux_roc_req.apply_time_max_delay = cpu_to_le32(delay);
+
+ IWL_DEBUG_TE(mvm,
+- "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
+- channel->hw_value, req_dur, duration, delay,
+- dtim_interval);
++ "ROC: Requesting to remain on channel %u for %ums\n",
++ channel->hw_value, req_dur);
++ IWL_DEBUG_TE(mvm,
++ "\t(requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
++ duration, delay, dtim_interval);
++
+ /* Set the node address */
+ memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN);
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index 85d6d5f3dce5b..c9f6cd2919699 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -1895,7 +1895,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
+ chan, CFG80211_BSS_FTYPE_UNKNOWN,
+ bssid, timestamp,
+ cap_info_bitmap, beacon_period,
+- ie_buf, ie_len, rssi, GFP_KERNEL);
++ ie_buf, ie_len, rssi, GFP_ATOMIC);
+ if (bss) {
+ bss_priv = (struct mwifiex_bss_priv *)bss->priv;
+ bss_priv->band = band;
+diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
+index bfbe3aa058d93..0773d81072aa1 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
++++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
+@@ -1985,6 +1985,8 @@ error:
+ kfree(card->mpa_rx.buf);
+ card->mpa_tx.buf_size = 0;
+ card->mpa_rx.buf_size = 0;
++ card->mpa_tx.buf = NULL;
++ card->mpa_rx.buf = NULL;
+ }
+
+ return ret;
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c
+index 734844b34c266..dd473b206f123 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c
+@@ -894,6 +894,7 @@ int qtnf_cmd_send_del_intf(struct qtnf_vif *vif)
+ default:
+ pr_warn("VIF%u.%u: unsupported iftype %d\n", vif->mac->macid,
+ vif->vifid, vif->wdev.iftype);
++ dev_kfree_skb(cmd_skb);
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -2212,6 +2213,7 @@ int qtnf_cmd_send_change_sta(struct qtnf_vif *vif, const u8 *mac,
+ break;
+ default:
+ pr_err("unsupported iftype %d\n", vif->wdev.iftype);
++ dev_kfree_skb(cmd_skb);
+ ret = -EINVAL;
+ goto out;
+ }
+diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
+index 0e31f1392a53c..949b07e29c06b 100644
+--- a/drivers/perf/xgene_pmu.c
++++ b/drivers/perf/xgene_pmu.c
+@@ -1474,17 +1474,6 @@ static char *xgene_pmu_dev_name(struct device *dev, u32 type, int id)
+ }
+
+ #if defined(CONFIG_ACPI)
+-static int acpi_pmu_dev_add_resource(struct acpi_resource *ares, void *data)
+-{
+- struct resource *res = data;
+-
+- if (ares->type == ACPI_RESOURCE_TYPE_FIXED_MEMORY32)
+- acpi_dev_resource_memory(ares, res);
+-
+- /* Always tell the ACPI core to skip this resource */
+- return 1;
+-}
+-
+ static struct
+ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu,
+ struct acpi_device *adev, u32 type)
+@@ -1496,6 +1485,7 @@ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu,
+ struct hw_pmu_info *inf;
+ void __iomem *dev_csr;
+ struct resource res;
++ struct resource_entry *rentry;
+ int enable_bit;
+ int rc;
+
+@@ -1504,11 +1494,23 @@ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu,
+ return NULL;
+
+ INIT_LIST_HEAD(&resource_list);
+- rc = acpi_dev_get_resources(adev, &resource_list,
+- acpi_pmu_dev_add_resource, &res);
++ rc = acpi_dev_get_resources(adev, &resource_list, NULL, NULL);
++ if (rc <= 0) {
++ dev_err(dev, "PMU type %d: No resources found\n", type);
++ return NULL;
++ }
++
++ list_for_each_entry(rentry, &resource_list, node) {
++ if (resource_type(rentry->res) == IORESOURCE_MEM) {
++ res = *rentry->res;
++ rentry = NULL;
++ break;
++ }
++ }
+ acpi_dev_free_resource_list(&resource_list);
+- if (rc < 0) {
+- dev_err(dev, "PMU type %d: No resource address found\n", type);
++
++ if (rentry) {
++ dev_err(dev, "PMU type %d: No memory resource found\n", type);
+ return NULL;
+ }
+
+diff --git a/drivers/pinctrl/bcm/Kconfig b/drivers/pinctrl/bcm/Kconfig
+index 0f38d51f47c64..e6cd314919de1 100644
+--- a/drivers/pinctrl/bcm/Kconfig
++++ b/drivers/pinctrl/bcm/Kconfig
+@@ -21,6 +21,7 @@ config PINCTRL_BCM2835
+ select PINMUX
+ select PINCONF
+ select GENERIC_PINCONF
++ select GPIOLIB
+ select GPIOLIB_IRQCHIP
+
+ config PINCTRL_IPROC_GPIO
+diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
+index 33c3eca0ece97..5b5a4323ae63d 100644
+--- a/drivers/pinctrl/pinctrl-mcp23s08.c
++++ b/drivers/pinctrl/pinctrl-mcp23s08.c
+@@ -120,7 +120,7 @@ static const struct regmap_config mcp23x08_regmap = {
+ .max_register = MCP_OLAT,
+ };
+
+-static const struct reg_default mcp23x16_defaults[] = {
++static const struct reg_default mcp23x17_defaults[] = {
+ {.reg = MCP_IODIR << 1, .def = 0xffff},
+ {.reg = MCP_IPOL << 1, .def = 0x0000},
+ {.reg = MCP_GPINTEN << 1, .def = 0x0000},
+@@ -131,23 +131,23 @@ static const struct reg_default mcp23x16_defaults[] = {
+ {.reg = MCP_OLAT << 1, .def = 0x0000},
+ };
+
+-static const struct regmap_range mcp23x16_volatile_range = {
++static const struct regmap_range mcp23x17_volatile_range = {
+ .range_min = MCP_INTF << 1,
+ .range_max = MCP_GPIO << 1,
+ };
+
+-static const struct regmap_access_table mcp23x16_volatile_table = {
+- .yes_ranges = &mcp23x16_volatile_range,
++static const struct regmap_access_table mcp23x17_volatile_table = {
++ .yes_ranges = &mcp23x17_volatile_range,
+ .n_yes_ranges = 1,
+ };
+
+-static const struct regmap_range mcp23x16_precious_range = {
+- .range_min = MCP_GPIO << 1,
++static const struct regmap_range mcp23x17_precious_range = {
++ .range_min = MCP_INTCAP << 1,
+ .range_max = MCP_GPIO << 1,
+ };
+
+-static const struct regmap_access_table mcp23x16_precious_table = {
+- .yes_ranges = &mcp23x16_precious_range,
++static const struct regmap_access_table mcp23x17_precious_table = {
++ .yes_ranges = &mcp23x17_precious_range,
+ .n_yes_ranges = 1,
+ };
+
+@@ -157,10 +157,10 @@ static const struct regmap_config mcp23x17_regmap = {
+
+ .reg_stride = 2,
+ .max_register = MCP_OLAT << 1,
+- .volatile_table = &mcp23x16_volatile_table,
+- .precious_table = &mcp23x16_precious_table,
+- .reg_defaults = mcp23x16_defaults,
+- .num_reg_defaults = ARRAY_SIZE(mcp23x16_defaults),
++ .volatile_table = &mcp23x17_volatile_table,
++ .precious_table = &mcp23x17_precious_table,
++ .reg_defaults = mcp23x17_defaults,
++ .num_reg_defaults = ARRAY_SIZE(mcp23x17_defaults),
+ .cache_type = REGCACHE_FLAT,
+ .val_format_endian = REGMAP_ENDIAN_LITTLE,
+ };
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 69e28c12d5915..0c72de95b5ccd 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -221,15 +221,6 @@ static struct i2c_board_info mlxplat_mlxcpld_psu[] = {
+ },
+ };
+
+-static struct i2c_board_info mlxplat_mlxcpld_ng_psu[] = {
+- {
+- I2C_BOARD_INFO("24c32", 0x51),
+- },
+- {
+- I2C_BOARD_INFO("24c32", 0x50),
+- },
+-};
+-
+ static struct i2c_board_info mlxplat_mlxcpld_pwr[] = {
+ {
+ I2C_BOARD_INFO("dps460", 0x59),
+@@ -589,15 +580,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_default_ng_psu_items_data[] = {
+ .label = "psu1",
+ .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ .mask = BIT(0),
+- .hpdev.brdinfo = &mlxplat_mlxcpld_ng_psu[0],
+- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ },
+ {
+ .label = "psu2",
+ .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ .mask = BIT(1),
+- .hpdev.brdinfo = &mlxplat_mlxcpld_ng_psu[1],
+- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ },
+ };
+
+diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
+index 7a4a6406cf69a..69f8be065919e 100644
+--- a/drivers/pwm/pwm-lpss.c
++++ b/drivers/pwm/pwm-lpss.c
+@@ -105,10 +105,12 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
+ * The equation is:
+ * base_unit = round(base_unit_range * freq / c)
+ */
+- base_unit_range = BIT(lpwm->info->base_unit_bits) - 1;
++ base_unit_range = BIT(lpwm->info->base_unit_bits);
+ freq *= base_unit_range;
+
+ base_unit = DIV_ROUND_CLOSEST_ULL(freq, c);
++ /* base_unit must not be 0 and we also want to avoid overflowing it */
++ base_unit = clamp_val(base_unit, 1, base_unit_range - 1);
+
+ on_time_div = 255ULL * duty_ns;
+ do_div(on_time_div, period_ns);
+@@ -116,8 +118,7 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
+
+ orig_ctrl = ctrl = pwm_lpss_read(pwm);
+ ctrl &= ~PWM_ON_TIME_DIV_MASK;
+- ctrl &= ~(base_unit_range << PWM_BASE_UNIT_SHIFT);
+- base_unit &= base_unit_range;
++ ctrl &= ~((base_unit_range - 1) << PWM_BASE_UNIT_SHIFT);
+ ctrl |= (u32) base_unit << PWM_BASE_UNIT_SHIFT;
+ ctrl |= on_time_div;
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 37e6270749eef..c290c89421314 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4363,15 +4363,20 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ else if (regulator_desc->supply_name)
+ rdev->supply_name = regulator_desc->supply_name;
+
+- /*
+- * Attempt to resolve the regulator supply, if specified,
+- * but don't return an error if we fail because we will try
+- * to resolve it again later as more regulators are added.
+- */
+- if (regulator_resolve_supply(rdev))
+- rdev_dbg(rdev, "unable to resolve supply\n");
+-
+ ret = set_machine_constraints(rdev, constraints);
++ if (ret == -EPROBE_DEFER) {
++ /* Regulator might be in bypass mode and so needs its supply
++ * to set the constraints */
++ /* FIXME: this currently triggers a chicken-and-egg problem
++ * when creating -SUPPLY symlink in sysfs to a regulator
++ * that is just being created */
++ ret = regulator_resolve_supply(rdev);
++ if (!ret)
++ ret = set_machine_constraints(rdev, constraints);
++ else
++ rdev_dbg(rdev, "unable to resolve supply early: %pe\n",
++ ERR_PTR(ret));
++ }
+ if (ret < 0)
+ goto wash;
+
+diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
+index 3660059784f74..6221a8372cee2 100644
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -3039,6 +3039,7 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba,
+ goto create_eq_error;
+ }
+
++ mem->dma = paddr;
+ mem->va = eq_vaddress;
+ ret = be_fill_queue(eq, phba->params.num_eq_entries,
+ sizeof(struct be_eq_entry), eq_vaddress);
+@@ -3048,7 +3049,6 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba,
+ goto create_eq_error;
+ }
+
+- mem->dma = paddr;
+ ret = beiscsi_cmd_eq_create(&phba->ctrl, eq,
+ BEISCSI_EQ_DELAY_DEF);
+ if (ret) {
+@@ -3105,6 +3105,7 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba,
+ goto create_cq_error;
+ }
+
++ mem->dma = paddr;
+ ret = be_fill_queue(cq, phba->params.num_cq_entries,
+ sizeof(struct sol_cqe), cq_vaddress);
+ if (ret) {
+@@ -3114,7 +3115,6 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba,
+ goto create_cq_error;
+ }
+
+- mem->dma = paddr;
+ ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false,
+ false, 0);
+ if (ret) {
+diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
+index e519238864758..1b6f9351b43f9 100644
+--- a/drivers/scsi/csiostor/csio_hw.c
++++ b/drivers/scsi/csiostor/csio_hw.c
+@@ -2384,7 +2384,7 @@ static int csio_hw_prep_fw(struct csio_hw *hw, struct fw_info *fw_info,
+ FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c),
+ FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k),
+ FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k));
+- ret = EINVAL;
++ ret = -EINVAL;
+ goto bye;
+ }
+
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 3e2f8ce1d9a97..7821c1695e824 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -676,7 +676,7 @@ int qla_nvme_register_hba(struct scsi_qla_host *vha)
+ struct nvme_fc_port_template *tmpl;
+ struct qla_hw_data *ha;
+ struct nvme_fc_port_info pinfo;
+- int ret = EINVAL;
++ int ret = -EINVAL;
+
+ if (!IS_ENABLED(CONFIG_NVME_FC))
+ return ret;
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index f59b8982b2883..4ba9f46fcf748 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -1221,7 +1221,7 @@ static int qla4xxx_get_host_stats(struct Scsi_Host *shost, char *buf, int len)
+ le64_to_cpu(ql_iscsi_stats->iscsi_sequence_error);
+ exit_host_stats:
+ if (ql_iscsi_stats)
+- dma_free_coherent(&ha->pdev->dev, host_stats_size,
++ dma_free_coherent(&ha->pdev->dev, stats_size,
+ ql_iscsi_stats, iscsi_stats_dma);
+
+ ql4_printk(KERN_INFO, ha, "%s: Get host stats done\n",
+diff --git a/drivers/slimbus/core.c b/drivers/slimbus/core.c
+index 943172806a8a7..3e63e4ce45b04 100644
+--- a/drivers/slimbus/core.c
++++ b/drivers/slimbus/core.c
+@@ -255,8 +255,6 @@ int slim_unregister_controller(struct slim_controller *ctrl)
+ {
+ /* Remove all clients */
+ device_for_each_child(ctrl->dev, NULL, slim_ctrl_remove_device);
+- /* Enter Clock Pause */
+- slim_ctrl_clk_pause(ctrl, false, 0);
+ ida_simple_remove(&ctrl_ida, ctrl->id);
+
+ return 0;
+@@ -297,8 +295,8 @@ void slim_report_absent(struct slim_device *sbdev)
+ mutex_lock(&ctrl->lock);
+ sbdev->is_laddr_valid = false;
+ mutex_unlock(&ctrl->lock);
+-
+- ida_simple_remove(&ctrl->laddr_ida, sbdev->laddr);
++ if (!ctrl->get_laddr)
++ ida_simple_remove(&ctrl->laddr_ida, sbdev->laddr);
+ slim_device_update_status(sbdev, SLIM_DEVICE_STATUS_DOWN);
+ }
+ EXPORT_SYMBOL_GPL(slim_report_absent);
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index f40ac8dcb0817..522a87fc573a6 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1272,9 +1272,13 @@ static void qcom_slim_ngd_qmi_del_server(struct qmi_handle *hdl,
+ {
+ struct qcom_slim_ngd_qmi *qmi =
+ container_of(hdl, struct qcom_slim_ngd_qmi, svc_event_hdl);
++ struct qcom_slim_ngd_ctrl *ctrl =
++ container_of(qmi, struct qcom_slim_ngd_ctrl, qmi);
+
+ qmi->svc_info.sq_node = 0;
+ qmi->svc_info.sq_port = 0;
++
++ qcom_slim_ngd_enable(ctrl, false);
+ }
+
+ static struct qmi_ops qcom_slim_ngd_qmi_svc_event_ops = {
+diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
+index 7b7151ec14c8a..1d948fee1a039 100644
+--- a/drivers/spi/spi-s3c64xx.c
++++ b/drivers/spi/spi-s3c64xx.c
+@@ -122,6 +122,7 @@
+
+ struct s3c64xx_spi_dma_data {
+ struct dma_chan *ch;
++ dma_cookie_t cookie;
+ enum dma_transfer_direction direction;
+ };
+
+@@ -264,12 +265,13 @@ static void s3c64xx_spi_dmacb(void *data)
+ spin_unlock_irqrestore(&sdd->lock, flags);
+ }
+
+-static void prepare_dma(struct s3c64xx_spi_dma_data *dma,
++static int prepare_dma(struct s3c64xx_spi_dma_data *dma,
+ struct sg_table *sgt)
+ {
+ struct s3c64xx_spi_driver_data *sdd;
+ struct dma_slave_config config;
+ struct dma_async_tx_descriptor *desc;
++ int ret;
+
+ memset(&config, 0, sizeof(config));
+
+@@ -293,12 +295,24 @@ static void prepare_dma(struct s3c64xx_spi_dma_data *dma,
+
+ desc = dmaengine_prep_slave_sg(dma->ch, sgt->sgl, sgt->nents,
+ dma->direction, DMA_PREP_INTERRUPT);
++ if (!desc) {
++ dev_err(&sdd->pdev->dev, "unable to prepare %s scatterlist",
++ dma->direction == DMA_DEV_TO_MEM ? "rx" : "tx");
++ return -ENOMEM;
++ }
+
+ desc->callback = s3c64xx_spi_dmacb;
+ desc->callback_param = dma;
+
+- dmaengine_submit(desc);
++ dma->cookie = dmaengine_submit(desc);
++ ret = dma_submit_error(dma->cookie);
++ if (ret) {
++ dev_err(&sdd->pdev->dev, "DMA submission failed");
++ return -EIO;
++ }
++
+ dma_async_issue_pending(dma->ch);
++ return 0;
+ }
+
+ static void s3c64xx_spi_set_cs(struct spi_device *spi, bool enable)
+@@ -348,11 +362,12 @@ static bool s3c64xx_spi_can_dma(struct spi_master *master,
+ return xfer->len > (FIFO_LVL_MASK(sdd) >> 1) + 1;
+ }
+
+-static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd,
++static int s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd,
+ struct spi_transfer *xfer, int dma_mode)
+ {
+ void __iomem *regs = sdd->regs;
+ u32 modecfg, chcfg;
++ int ret = 0;
+
+ modecfg = readl(regs + S3C64XX_SPI_MODE_CFG);
+ modecfg &= ~(S3C64XX_SPI_MODE_TXDMA_ON | S3C64XX_SPI_MODE_RXDMA_ON);
+@@ -378,7 +393,7 @@ static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd,
+ chcfg |= S3C64XX_SPI_CH_TXCH_ON;
+ if (dma_mode) {
+ modecfg |= S3C64XX_SPI_MODE_TXDMA_ON;
+- prepare_dma(&sdd->tx_dma, &xfer->tx_sg);
++ ret = prepare_dma(&sdd->tx_dma, &xfer->tx_sg);
+ } else {
+ switch (sdd->cur_bpw) {
+ case 32:
+@@ -410,12 +425,17 @@ static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd,
+ writel(((xfer->len * 8 / sdd->cur_bpw) & 0xffff)
+ | S3C64XX_SPI_PACKET_CNT_EN,
+ regs + S3C64XX_SPI_PACKET_CNT);
+- prepare_dma(&sdd->rx_dma, &xfer->rx_sg);
++ ret = prepare_dma(&sdd->rx_dma, &xfer->rx_sg);
+ }
+ }
+
++ if (ret)
++ return ret;
++
+ writel(modecfg, regs + S3C64XX_SPI_MODE_CFG);
+ writel(chcfg, regs + S3C64XX_SPI_CH_CFG);
++
++ return 0;
+ }
+
+ static u32 s3c64xx_spi_wait_for_timeout(struct s3c64xx_spi_driver_data *sdd,
+@@ -548,9 +568,10 @@ static int s3c64xx_wait_for_pio(struct s3c64xx_spi_driver_data *sdd,
+ return 0;
+ }
+
+-static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
++static int s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
+ {
+ void __iomem *regs = sdd->regs;
++ int ret;
+ u32 val;
+
+ /* Disable Clock */
+@@ -598,7 +619,9 @@ static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
+
+ if (sdd->port_conf->clk_from_cmu) {
+ /* The src_clk clock is divided internally by 2 */
+- clk_set_rate(sdd->src_clk, sdd->cur_speed * 2);
++ ret = clk_set_rate(sdd->src_clk, sdd->cur_speed * 2);
++ if (ret)
++ return ret;
+ } else {
+ /* Configure Clock */
+ val = readl(regs + S3C64XX_SPI_CLK_CFG);
+@@ -612,6 +635,8 @@ static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
+ val |= S3C64XX_SPI_ENCLK_ENABLE;
+ writel(val, regs + S3C64XX_SPI_CLK_CFG);
+ }
++
++ return 0;
+ }
+
+ #define XFER_DMAADDR_INVALID DMA_BIT_MASK(32)
+@@ -654,7 +679,9 @@ static int s3c64xx_spi_transfer_one(struct spi_master *master,
+ sdd->cur_bpw = bpw;
+ sdd->cur_speed = speed;
+ sdd->cur_mode = spi->mode;
+- s3c64xx_spi_config(sdd);
++ status = s3c64xx_spi_config(sdd);
++ if (status)
++ return status;
+ }
+
+ if (!is_polling(sdd) && (xfer->len > fifo_len) &&
+@@ -678,13 +705,18 @@ static int s3c64xx_spi_transfer_one(struct spi_master *master,
+ sdd->state &= ~RXBUSY;
+ sdd->state &= ~TXBUSY;
+
+- s3c64xx_enable_datapath(sdd, xfer, use_dma);
+-
+ /* Start the signals */
+ s3c64xx_spi_set_cs(spi, true);
+
++ status = s3c64xx_enable_datapath(sdd, xfer, use_dma);
++
+ spin_unlock_irqrestore(&sdd->lock, flags);
+
++ if (status) {
++ dev_err(&spi->dev, "failed to enable data path for transfer: %d\n", status);
++ break;
++ }
++
+ if (use_dma)
+ status = s3c64xx_wait_for_dma(sdd, xfer);
+ else
+diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
+index 28cae82d795c7..fb824c5174497 100644
+--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
++++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
+@@ -599,7 +599,7 @@ static void RxReorderIndicatePacket(struct ieee80211_device *ieee,
+
+ prxbIndicateArray = kmalloc_array(REORDER_WIN_SIZE,
+ sizeof(struct ieee80211_rxb *),
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ if (!prxbIndicateArray)
+ return;
+
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 99314e5162447..0219b5a865bee 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -680,7 +680,7 @@ static void scatter_data_area(struct tcmu_dev *udev,
+ void *from, *to = NULL;
+ size_t copy_bytes, to_offset, offset;
+ struct scatterlist *sg;
+- struct page *page;
++ struct page *page = NULL;
+
+ for_each_sg(data_sg, sg, data_nents, i) {
+ int sg_remaining = sg->length;
+diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
+index cb4db1b3ca3c0..7853c6375325d 100644
+--- a/drivers/tty/hvc/hvcs.c
++++ b/drivers/tty/hvc/hvcs.c
+@@ -1218,13 +1218,6 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
+
+ tty_wait_until_sent(tty, HVCS_CLOSE_WAIT);
+
+- /*
+- * This line is important because it tells hvcs_open that this
+- * device needs to be re-configured the next time hvcs_open is
+- * called.
+- */
+- tty->driver_data = NULL;
+-
+ free_irq(irq, hvcsd);
+ return;
+ } else if (hvcsd->port.count < 0) {
+@@ -1239,6 +1232,13 @@ static void hvcs_cleanup(struct tty_struct * tty)
+ {
+ struct hvcs_struct *hvcsd = tty->driver_data;
+
++ /*
++ * This line is important because it tells hvcs_open that this
++ * device needs to be re-configured the next time hvcs_open is
++ * called.
++ */
++ tty->driver_data = NULL;
++
+ tty_port_put(&hvcsd->port);
+ }
+
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index 00099a8439d21..c6a1d8c4e6894 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -120,10 +120,10 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
+ spin_lock_irqsave(&to->port->lock, flags);
+ /* Stuff the data into the input queue of the other end */
+ c = tty_insert_flip_string(to->port, buf, c);
++ spin_unlock_irqrestore(&to->port->lock, flags);
+ /* And shovel */
+ if (c)
+ tty_flip_buffer_push(to->port);
+- spin_unlock_irqrestore(&to->port->lock, flags);
+ }
+ return c;
+ }
+diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
+index df8bd0c7b97db..cd13065095bc3 100644
+--- a/drivers/tty/serial/Kconfig
++++ b/drivers/tty/serial/Kconfig
+@@ -9,6 +9,7 @@ menu "Serial drivers"
+
+ config SERIAL_EARLYCON
+ bool
++ depends on SERIAL_CORE
+ help
+ Support for early consoles with the earlycon parameter. This enables
+ the console before standard serial driver is probed. The console is
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index f18aa3f59e519..8e98b4df9b109 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -671,8 +671,11 @@ static u32 dwc2_hsotg_read_frameno(struct dwc2_hsotg *hsotg)
+ */
+ static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep)
+ {
++ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc;
+ int is_isoc = hs_ep->isochronous;
+ unsigned int maxsize;
++ u32 mps = hs_ep->ep.maxpacket;
++ int dir_in = hs_ep->dir_in;
+
+ if (is_isoc)
+ maxsize = (hs_ep->dir_in ? DEV_DMA_ISOC_TX_NBYTES_LIMIT :
+@@ -681,6 +684,11 @@ static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep)
+ else
+ maxsize = DEV_DMA_NBYTES_LIMIT * MAX_DMA_DESC_NUM_GENERIC;
+
++ /* Interrupt OUT EP with mps not multiple of 4 */
++ if (hs_ep->index)
++ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4))
++ maxsize = mps * MAX_DMA_DESC_NUM_GENERIC;
++
+ return maxsize;
+ }
+
+@@ -696,11 +704,14 @@ static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep)
+ * Isochronous - descriptor rx/tx bytes bitfield limit,
+ * Control In/Bulk/Interrupt - multiple of mps. This will allow to not
+ * have concatenations from various descriptors within one packet.
++ * Interrupt OUT - if mps not multiple of 4 then a single packet corresponds
++ * to a single descriptor.
+ *
+ * Selects corresponding mask for RX/TX bytes as well.
+ */
+ static u32 dwc2_gadget_get_desc_params(struct dwc2_hsotg_ep *hs_ep, u32 *mask)
+ {
++ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc;
+ u32 mps = hs_ep->ep.maxpacket;
+ int dir_in = hs_ep->dir_in;
+ u32 desc_size = 0;
+@@ -724,6 +735,13 @@ static u32 dwc2_gadget_get_desc_params(struct dwc2_hsotg_ep *hs_ep, u32 *mask)
+ desc_size -= desc_size % mps;
+ }
+
++ /* Interrupt OUT EP with mps not multiple of 4 */
++ if (hs_ep->index)
++ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4)) {
++ desc_size = mps;
++ *mask = DEV_DMA_NBYTES_MASK;
++ }
++
+ return desc_size;
+ }
+
+@@ -1044,13 +1062,7 @@ static void dwc2_hsotg_start_req(struct dwc2_hsotg *hsotg,
+ length += (mps - (length % mps));
+ }
+
+- /*
+- * If more data to send, adjust DMA for EP0 out data stage.
+- * ureq->dma stays unchanged, hence increment it by already
+- * passed passed data count before starting new transaction.
+- */
+- if (!index && hsotg->ep0_state == DWC2_EP0_DATA_OUT &&
+- continuing)
++ if (continuing)
+ offset = ureq->actual;
+
+ /* Fill DDMA chain entries */
+@@ -2220,22 +2232,36 @@ static void dwc2_hsotg_change_ep_iso_parity(struct dwc2_hsotg *hsotg,
+ */
+ static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep)
+ {
++ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc;
+ struct dwc2_hsotg *hsotg = hs_ep->parent;
+ unsigned int bytes_rem = 0;
++ unsigned int bytes_rem_correction = 0;
+ struct dwc2_dma_desc *desc = hs_ep->desc_list;
+ int i;
+ u32 status;
++ u32 mps = hs_ep->ep.maxpacket;
++ int dir_in = hs_ep->dir_in;
+
+ if (!desc)
+ return -EINVAL;
+
++ /* Interrupt OUT EP with mps not multiple of 4 */
++ if (hs_ep->index)
++ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4))
++ bytes_rem_correction = 4 - (mps % 4);
++
+ for (i = 0; i < hs_ep->desc_count; ++i) {
+ status = desc->status;
+ bytes_rem += status & DEV_DMA_NBYTES_MASK;
++ bytes_rem -= bytes_rem_correction;
+
+ if (status & DEV_DMA_STS_MASK)
+ dev_err(hsotg->dev, "descriptor %d closed with %x\n",
+ i, status & DEV_DMA_STS_MASK);
++
++ if (status & DEV_DMA_L)
++ break;
++
+ desc++;
+ }
+
+diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
+index a93415f33bf36..6d7861cba3f56 100644
+--- a/drivers/usb/dwc2/params.c
++++ b/drivers/usb/dwc2/params.c
+@@ -808,7 +808,7 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg)
+ int dwc2_init_params(struct dwc2_hsotg *hsotg)
+ {
+ const struct of_device_id *match;
+- void (*set_params)(void *data);
++ void (*set_params)(struct dwc2_hsotg *data);
+
+ dwc2_set_default_params(hsotg);
+ dwc2_get_device_properties(hsotg);
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index e2eefdd8bf786..09bc917d407d4 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -86,8 +86,10 @@ static inline struct f_ncm *func_to_ncm(struct usb_function *f)
+ /* peak (theoretical) bulk transfer rate in bits-per-second */
+ static inline unsigned ncm_bitrate(struct usb_gadget *g)
+ {
+- if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
+- return 13 * 1024 * 8 * 1000 * 8;
++ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
++ return 4250000000U;
++ else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
++ return 3750000000U;
+ else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
+ return 13 * 512 * 8 * 1000 * 8;
+ else
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 0ef00315ec737..39ebc1b03698b 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -93,7 +93,7 @@ struct eth_dev {
+ static inline int qlen(struct usb_gadget *gadget, unsigned qmult)
+ {
+ if (gadget_is_dualspeed(gadget) && (gadget->speed == USB_SPEED_HIGH ||
+- gadget->speed == USB_SPEED_SUPER))
++ gadget->speed >= USB_SPEED_SUPER))
+ return qmult * DEFAULT_QLEN;
+ else
+ return DEFAULT_QLEN;
+diff --git a/drivers/video/backlight/sky81452-backlight.c b/drivers/video/backlight/sky81452-backlight.c
+index d414c7a3acf5a..a2f77625b7170 100644
+--- a/drivers/video/backlight/sky81452-backlight.c
++++ b/drivers/video/backlight/sky81452-backlight.c
+@@ -207,6 +207,7 @@ static struct sky81452_bl_platform_data *sky81452_bl_parse_dt(
+ num_entry);
+ if (ret < 0) {
+ dev_err(dev, "led-sources node is invalid.\n");
++ of_node_put(np);
+ return ERR_PTR(-EINVAL);
+ }
+
+diff --git a/drivers/video/fbdev/aty/radeon_base.c b/drivers/video/fbdev/aty/radeon_base.c
+index e8594bbaea609..c6109a385cac9 100644
+--- a/drivers/video/fbdev/aty/radeon_base.c
++++ b/drivers/video/fbdev/aty/radeon_base.c
+@@ -2327,7 +2327,7 @@ static int radeonfb_pci_register(struct pci_dev *pdev,
+
+ ret = radeon_kick_out_firmware_fb(pdev);
+ if (ret)
+- return ret;
++ goto err_release_fb;
+
+ /* request the mem regions */
+ ret = pci_request_region(pdev, 0, "radeonfb framebuffer");
+diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
+index dfe3eb769638b..fde27feae5d0c 100644
+--- a/drivers/video/fbdev/sis/init.c
++++ b/drivers/video/fbdev/sis/init.c
+@@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
+
+ i = 0;
+
++ if (SiS_Pr->ChipType == SIS_730)
++ queuedata = &FQBQData730[0];
++ else
++ queuedata = &FQBQData[0];
++
+ if(ModeNo > 0x13) {
+
+ /* Get VCLK */
+@@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
+ /* Get half colordepth */
+ colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
+
+- if(SiS_Pr->ChipType == SIS_730) {
+- queuedata = &FQBQData730[0];
+- } else {
+- queuedata = &FQBQData[0];
+- }
+-
+ do {
+ templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
+
+diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c
+index 4b83109202b1c..3c4d20618de4c 100644
+--- a/drivers/video/fbdev/vga16fb.c
++++ b/drivers/video/fbdev/vga16fb.c
+@@ -243,7 +243,7 @@ static void vga16fb_update_fix(struct fb_info *info)
+ }
+
+ static void vga16fb_clock_chip(struct vga16fb_par *par,
+- unsigned int pixclock,
++ unsigned int *pixclock,
+ const struct fb_info *info,
+ int mul, int div)
+ {
+@@ -259,14 +259,14 @@ static void vga16fb_clock_chip(struct vga16fb_par *par,
+ { 0 /* bad */, 0x00, 0x00}};
+ int err;
+
+- pixclock = (pixclock * mul) / div;
++ *pixclock = (*pixclock * mul) / div;
+ best = vgaclocks;
+- err = pixclock - best->pixclock;
++ err = *pixclock - best->pixclock;
+ if (err < 0) err = -err;
+ for (ptr = vgaclocks + 1; ptr->pixclock; ptr++) {
+ int tmp;
+
+- tmp = pixclock - ptr->pixclock;
++ tmp = *pixclock - ptr->pixclock;
+ if (tmp < 0) tmp = -tmp;
+ if (tmp < err) {
+ err = tmp;
+@@ -275,7 +275,7 @@ static void vga16fb_clock_chip(struct vga16fb_par *par,
+ }
+ par->misc |= best->misc;
+ par->clkdiv = best->seq_clock_mode;
+- pixclock = (best->pixclock * div) / mul;
++ *pixclock = (best->pixclock * div) / mul;
+ }
+
+ #define FAIL(X) return -EINVAL
+@@ -497,10 +497,10 @@ static int vga16fb_check_var(struct fb_var_screeninfo *var,
+
+ if (mode & MODE_8BPP)
+ /* pixel clock == vga clock / 2 */
+- vga16fb_clock_chip(par, var->pixclock, info, 1, 2);
++ vga16fb_clock_chip(par, &var->pixclock, info, 1, 2);
+ else
+ /* pixel clock == vga clock */
+- vga16fb_clock_chip(par, var->pixclock, info, 1, 1);
++ vga16fb_clock_chip(par, &var->pixclock, info, 1, 1);
+
+ var->red.offset = var->green.offset = var->blue.offset =
+ var->transp.offset = 0;
+diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
+index 1bbd910d4ddb8..2a7f7f47fe893 100644
+--- a/drivers/virt/fsl_hypervisor.c
++++ b/drivers/virt/fsl_hypervisor.c
+@@ -157,7 +157,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
+
+ unsigned int i;
+ long ret = 0;
+- int num_pinned; /* return value from get_user_pages() */
++ int num_pinned = 0; /* return value from get_user_pages_fast() */
+ phys_addr_t remote_paddr; /* The next address in the remote buffer */
+ uint32_t count; /* The number of bytes left to copy */
+
+@@ -174,7 +174,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
+ return -EINVAL;
+
+ /*
+- * The array of pages returned by get_user_pages() covers only
++ * The array of pages returned by get_user_pages_fast() covers only
+ * page-aligned memory. Since the user buffer is probably not
+ * page-aligned, we need to handle the discrepancy.
+ *
+@@ -224,7 +224,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
+
+ /*
+ * 'pages' is an array of struct page pointers that's initialized by
+- * get_user_pages().
++ * get_user_pages_fast().
+ */
+ pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
+ if (!pages) {
+@@ -241,7 +241,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
+ if (!sg_list_unaligned) {
+ pr_debug("fsl-hv: could not allocate S/G list\n");
+ ret = -ENOMEM;
+- goto exit;
++ goto free_pages;
+ }
+ sg_list = PTR_ALIGN(sg_list_unaligned, sizeof(struct fh_sg_list));
+
+@@ -250,7 +250,6 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
+ num_pages, param.source != -1, pages);
+
+ if (num_pinned != num_pages) {
+- /* get_user_pages() failed */
+ pr_debug("fsl-hv: could not lock source buffer\n");
+ ret = (num_pinned < 0) ? num_pinned : -EFAULT;
+ goto exit;
+@@ -292,13 +291,13 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
+ virt_to_phys(sg_list), num_pages);
+
+ exit:
+- if (pages) {
+- for (i = 0; i < num_pages; i++)
+- if (pages[i])
+- put_page(pages[i]);
++ if (pages && (num_pinned > 0)) {
++ for (i = 0; i < num_pinned; i++)
++ put_page(pages[i]);
+ }
+
+ kfree(sg_list_unaligned);
++free_pages:
+ kfree(pages);
+
+ if (!ret)
+diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
+index 3d19595eb3521..4a9b53229fba2 100644
+--- a/fs/cifs/asn1.c
++++ b/fs/cifs/asn1.c
+@@ -541,8 +541,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
+ return 0;
+ } else if ((cls != ASN1_CTX) || (con != ASN1_CON)
+ || (tag != ASN1_EOC)) {
+- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
+- cls, con, tag, end, *end);
++ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n",
++ cls, con, tag, end);
+ return 0;
+ }
+
+@@ -552,8 +552,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
+ return 0;
+ } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
+ || (tag != ASN1_SEQ)) {
+- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
+- cls, con, tag, end, *end);
++ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 1\n",
++ cls, con, tag, end);
+ return 0;
+ }
+
+@@ -563,8 +563,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
+ return 0;
+ } else if ((cls != ASN1_CTX) || (con != ASN1_CON)
+ || (tag != ASN1_EOC)) {
+- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
+- cls, con, tag, end, *end);
++ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n",
++ cls, con, tag, end);
+ return 0;
+ }
+
+@@ -575,8 +575,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
+ return 0;
+ } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
+ || (tag != ASN1_SEQ)) {
+- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
+- cls, con, tag, end, *end);
++ cifs_dbg(FYI, "cls = %d con = %d tag = %d sequence_end = %p exit 1\n",
++ cls, con, tag, sequence_end);
+ return 0;
+ }
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 3d63c76ed0989..e20d170d13f6b 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2730,7 +2730,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ if (rc) {
+ cifs_dbg(VFS, "%s: Could not get %scryption key\n", __func__,
+ enc ? "en" : "de");
+- return 0;
++ return rc;
+ }
+
+ rc = smb3_crypto_aead_allocate(server);
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 3b9b726b1a6ca..5e705fa9a913d 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -1035,7 +1035,6 @@ static ssize_t oom_adj_read(struct file *file, char __user *buf, size_t count,
+
+ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
+ {
+- static DEFINE_MUTEX(oom_adj_mutex);
+ struct mm_struct *mm = NULL;
+ struct task_struct *task;
+ int err = 0;
+@@ -1075,7 +1074,7 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
+ struct task_struct *p = find_lock_task_mm(task);
+
+ if (p) {
+- if (atomic_read(&p->mm->mm_users) > 1) {
++ if (test_bit(MMF_MULTIPROCESS, &p->mm->flags)) {
+ mm = p->mm;
+ mmgrab(mm);
+ }
+diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
+index a73e5b34db418..5d4dc0f84f202 100644
+--- a/fs/quota/quota_v2.c
++++ b/fs/quota/quota_v2.c
+@@ -283,6 +283,7 @@ static void v2r1_mem2diskdqb(void *dp, struct dquot *dquot)
+ d->dqb_curspace = cpu_to_le64(m->dqb_curspace);
+ d->dqb_btime = cpu_to_le64(m->dqb_btime);
+ d->dqb_id = cpu_to_le32(from_kqid(&init_user_ns, dquot->dq_id));
++ d->dqb_pad = 0;
+ if (qtree_entry_unused(info, dp))
+ d->dqb_itime = cpu_to_le64(1);
+ }
+diff --git a/fs/xfs/libxfs/xfs_rtbitmap.c b/fs/xfs/libxfs/xfs_rtbitmap.c
+index b228c821bae68..fe7323032e785 100644
+--- a/fs/xfs/libxfs/xfs_rtbitmap.c
++++ b/fs/xfs/libxfs/xfs_rtbitmap.c
+@@ -1020,7 +1020,6 @@ xfs_rtalloc_query_range(
+ struct xfs_mount *mp = tp->t_mountp;
+ xfs_rtblock_t rtstart;
+ xfs_rtblock_t rtend;
+- xfs_rtblock_t rem;
+ int is_free;
+ int error = 0;
+
+@@ -1029,13 +1028,12 @@ xfs_rtalloc_query_range(
+ if (low_rec->ar_startext >= mp->m_sb.sb_rextents ||
+ low_rec->ar_startext == high_rec->ar_startext)
+ return 0;
+- if (high_rec->ar_startext > mp->m_sb.sb_rextents)
+- high_rec->ar_startext = mp->m_sb.sb_rextents;
++ high_rec->ar_startext = min(high_rec->ar_startext,
++ mp->m_sb.sb_rextents - 1);
+
+ /* Iterate the bitmap, looking for discrepancies. */
+ rtstart = low_rec->ar_startext;
+- rem = high_rec->ar_startext - rtstart;
+- while (rem) {
++ while (rtstart <= high_rec->ar_startext) {
+ /* Is the first block free? */
+ error = xfs_rtcheck_range(mp, tp, rtstart, 1, 1, &rtend,
+ &is_free);
+@@ -1044,7 +1042,7 @@ xfs_rtalloc_query_range(
+
+ /* How long does the extent go for? */
+ error = xfs_rtfind_forw(mp, tp, rtstart,
+- high_rec->ar_startext - 1, &rtend);
++ high_rec->ar_startext, &rtend);
+ if (error)
+ break;
+
+@@ -1057,7 +1055,6 @@ xfs_rtalloc_query_range(
+ break;
+ }
+
+- rem -= rtend - rtstart + 1;
+ rtstart = rtend + 1;
+ }
+
+diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c
+index 3d76a9e35870a..75b57b683d3e6 100644
+--- a/fs/xfs/xfs_fsmap.c
++++ b/fs/xfs/xfs_fsmap.c
+@@ -259,6 +259,9 @@ xfs_getfsmap_helper(
+
+ /* Are we just counting mappings? */
+ if (info->head->fmh_count == 0) {
++ if (info->head->fmh_entries == UINT_MAX)
++ return -ECANCELED;
++
+ if (rec_daddr > info->next_daddr)
+ info->head->fmh_entries++;
+
+diff --git a/include/linux/oom.h b/include/linux/oom.h
+index 69864a547663e..3f649be179dad 100644
+--- a/include/linux/oom.h
++++ b/include/linux/oom.h
+@@ -45,6 +45,7 @@ struct oom_control {
+ };
+
+ extern struct mutex oom_lock;
++extern struct mutex oom_adj_mutex;
+
+ static inline void set_current_oom_origin(void)
+ {
+diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h
+index ecdc6542070f1..dfd82eab29025 100644
+--- a/include/linux/sched/coredump.h
++++ b/include/linux/sched/coredump.h
+@@ -72,6 +72,7 @@ static inline int get_dumpable(struct mm_struct *mm)
+ #define MMF_DISABLE_THP 24 /* disable THP for all VMAs */
+ #define MMF_OOM_VICTIM 25 /* mm is the oom victim */
+ #define MMF_OOM_REAP_QUEUED 26 /* mm was queued for oom_reaper */
++#define MMF_MULTIPROCESS 27 /* mm is shared between processes */
+ #define MMF_DISABLE_THP_MASK (1 << MMF_DISABLE_THP)
+
+ #define MMF_INIT_MASK (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 5b29f357862dc..aad003685c31d 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -399,12 +399,18 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
+ bool forwarding)
+ {
+ struct net *net = dev_net(dst->dev);
++ unsigned int mtu;
+
+ if (net->ipv4.sysctl_ip_fwd_use_pmtu ||
+ ip_mtu_locked(dst) ||
+ !forwarding)
+ return dst_mtu(dst);
+
++ /* 'forwarding = true' case should always honour route mtu */
++ mtu = dst_metric_raw(dst, RTAX_MTU);
++ if (mtu)
++ return mtu;
++
+ return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU);
+ }
+
+diff --git a/include/net/netfilter/nf_log.h b/include/net/netfilter/nf_log.h
+index 0d3920896d502..716db4a0fed89 100644
+--- a/include/net/netfilter/nf_log.h
++++ b/include/net/netfilter/nf_log.h
+@@ -108,6 +108,7 @@ int nf_log_dump_tcp_header(struct nf_log_buf *m, const struct sk_buff *skb,
+ unsigned int logflags);
+ void nf_log_dump_sk_uid_gid(struct net *net, struct nf_log_buf *m,
+ struct sock *sk);
++void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb);
+ void nf_log_dump_packet_common(struct nf_log_buf *m, u_int8_t pf,
+ unsigned int hooknum, const struct sk_buff *skb,
+ const struct net_device *in,
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 1a2d18e98bf99..3ed29bf8eb291 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1647,6 +1647,25 @@ static __always_inline void delayed_free_task(struct task_struct *tsk)
+ free_task(tsk);
+ }
+
++static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk)
++{
++ /* Skip if kernel thread */
++ if (!tsk->mm)
++ return;
++
++ /* Skip if spawning a thread or using vfork */
++ if ((clone_flags & (CLONE_VM | CLONE_THREAD | CLONE_VFORK)) != CLONE_VM)
++ return;
++
++ /* We need to synchronize with __set_oom_adj */
++ mutex_lock(&oom_adj_mutex);
++ set_bit(MMF_MULTIPROCESS, &tsk->mm->flags);
++ /* Update the values in case they were changed after copy_signal */
++ tsk->signal->oom_score_adj = current->signal->oom_score_adj;
++ tsk->signal->oom_score_adj_min = current->signal->oom_score_adj_min;
++ mutex_unlock(&oom_adj_mutex);
++}
++
+ /*
+ * This creates a new process as a copy of the old one,
+ * but does not actually start it yet.
+@@ -2084,6 +2103,8 @@ static __latent_entropy struct task_struct *copy_process(
+ trace_task_newtask(p, clone_flags);
+ uprobe_copy_process(p, clone_flags);
+
++ copy_oom_score_adj(clone_flags, p);
++
+ return p;
+
+ bad_fork_cancel_cgroup:
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index aa730a3d5c258..87cd5bf1b4874 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4780,7 +4780,7 @@ static struct page *mc_handle_swap_pte(struct vm_area_struct *vma,
+ struct page *page = NULL;
+ swp_entry_t ent = pte_to_swp_entry(ptent);
+
+- if (!(mc.flags & MOVE_ANON) || non_swap_entry(ent))
++ if (!(mc.flags & MOVE_ANON))
+ return NULL;
+
+ /*
+@@ -4799,6 +4799,9 @@ static struct page *mc_handle_swap_pte(struct vm_area_struct *vma,
+ return page;
+ }
+
++ if (non_swap_entry(ent))
++ return NULL;
++
+ /*
+ * Because lookup_swap_cache() updates some statistics counter,
+ * we call find_get_page() with swapper_space directly.
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index a581fe2a2f1fe..928b3b5e24e6b 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -62,6 +62,8 @@ int sysctl_oom_dump_tasks = 1;
+ * and mark_oom_victim
+ */
+ DEFINE_MUTEX(oom_lock);
++/* Serializes oom_score_adj and oom_score_adj_min updates */
++DEFINE_MUTEX(oom_adj_mutex);
+
+ #ifdef CONFIG_NUMA
+ /**
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index 4efa5e33513e3..59c0b1a86e51b 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -244,7 +244,7 @@ static struct {
+ /**
+ * icmp_global_allow - Are we allowed to send one more ICMP message ?
+ *
+- * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec.
++ * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.
+ * Returns false if we reached the limit and can not send another packet.
+ * Note: called with BH disabled
+ */
+@@ -272,7 +272,10 @@ bool icmp_global_allow(void)
+ }
+ credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
+ if (credit) {
+- credit--;
++ /* We want to use a credit of one in average, but need to randomize
++ * it for security reasons.
++ */
++ credit = max_t(int, credit - prandom_u32_max(3), 0);
+ rc = true;
+ }
+ WRITE_ONCE(icmp_global.credit, credit);
+diff --git a/net/ipv4/netfilter/nf_log_arp.c b/net/ipv4/netfilter/nf_log_arp.c
+index df5c2a2061a4b..19fff2c589fac 100644
+--- a/net/ipv4/netfilter/nf_log_arp.c
++++ b/net/ipv4/netfilter/nf_log_arp.c
+@@ -46,16 +46,31 @@ static void dump_arp_packet(struct nf_log_buf *m,
+ const struct nf_loginfo *info,
+ const struct sk_buff *skb, unsigned int nhoff)
+ {
+- const struct arphdr *ah;
+- struct arphdr _arph;
+ const struct arppayload *ap;
+ struct arppayload _arpp;
++ const struct arphdr *ah;
++ unsigned int logflags;
++ struct arphdr _arph;
+
+ ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
+ if (ah == NULL) {
+ nf_log_buf_add(m, "TRUNCATED");
+ return;
+ }
++
++ if (info->type == NF_LOG_TYPE_LOG)
++ logflags = info->u.log.logflags;
++ else
++ logflags = NF_LOG_DEFAULT_MASK;
++
++ if (logflags & NF_LOG_MACDECODE) {
++ nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ",
++ eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);
++ nf_log_dump_vlan(m, skb);
++ nf_log_buf_add(m, "MACPROTO=%04x ",
++ ntohs(eth_hdr(skb)->h_proto));
++ }
++
+ nf_log_buf_add(m, "ARP HTYPE=%d PTYPE=0x%04x OPCODE=%d",
+ ntohs(ah->ar_hrd), ntohs(ah->ar_pro), ntohs(ah->ar_op));
+
+diff --git a/net/ipv4/netfilter/nf_log_ipv4.c b/net/ipv4/netfilter/nf_log_ipv4.c
+index 1e6f28c97d3a2..cde1918607e9c 100644
+--- a/net/ipv4/netfilter/nf_log_ipv4.c
++++ b/net/ipv4/netfilter/nf_log_ipv4.c
+@@ -287,8 +287,10 @@ static void dump_ipv4_mac_header(struct nf_log_buf *m,
+
+ switch (dev->type) {
+ case ARPHRD_ETHER:
+- nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ",
+- eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
++ nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ",
++ eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);
++ nf_log_dump_vlan(m, skb);
++ nf_log_buf_add(m, "MACPROTO=%04x ",
+ ntohs(eth_hdr(skb)->h_proto));
+ return;
+ default:
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 3db428242b22d..48081e6d50b4e 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2634,10 +2634,12 @@ struct rtable *ip_route_output_flow(struct net *net, struct flowi4 *flp4,
+ if (IS_ERR(rt))
+ return rt;
+
+- if (flp4->flowi4_proto)
++ if (flp4->flowi4_proto) {
++ flp4->flowi4_oif = rt->dst.dev->ifindex;
+ rt = (struct rtable *)xfrm_lookup_route(net, &rt->dst,
+ flowi4_to_flowi(flp4),
+ sk, 0);
++ }
+
+ return rt;
+ }
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 9813d62de631b..c19870d561861 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -5631,6 +5631,8 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb)
+ tcp_data_snd_check(sk);
+ if (!inet_csk_ack_scheduled(sk))
+ goto no_ack;
++ } else {
++ tcp_update_wl(tp, TCP_SKB_CB(skb)->seq);
+ }
+
+ __tcp_ack_snd_check(sk, 0);
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index b924941b96a31..8b5459b34bc4a 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -2417,8 +2417,10 @@ static void *ipv6_route_seq_start(struct seq_file *seq, loff_t *pos)
+ iter->skip = *pos;
+
+ if (iter->tbl) {
++ loff_t p = 0;
++
+ ipv6_route_seq_setup_walk(iter, net);
+- return ipv6_route_seq_next(seq, NULL, pos);
++ return ipv6_route_seq_next(seq, NULL, &p);
+ } else {
+ return NULL;
+ }
+diff --git a/net/ipv6/netfilter/nf_log_ipv6.c b/net/ipv6/netfilter/nf_log_ipv6.c
+index c6bf580d0f331..c456e2f902b93 100644
+--- a/net/ipv6/netfilter/nf_log_ipv6.c
++++ b/net/ipv6/netfilter/nf_log_ipv6.c
+@@ -300,9 +300,11 @@ static void dump_ipv6_mac_header(struct nf_log_buf *m,
+
+ switch (dev->type) {
+ case ARPHRD_ETHER:
+- nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ",
+- eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
+- ntohs(eth_hdr(skb)->h_proto));
++ nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ",
++ eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);
++ nf_log_dump_vlan(m, skb);
++ nf_log_buf_add(m, "MACPROTO=%04x ",
++ ntohs(eth_hdr(skb)->h_proto));
+ return;
+ default:
+ break;
+diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
+index 3f75cd947045e..11f7c546e57b3 100644
+--- a/net/netfilter/ipvs/ip_vs_xmit.c
++++ b/net/netfilter/ipvs/ip_vs_xmit.c
+@@ -586,6 +586,8 @@ static inline int ip_vs_tunnel_xmit_prepare(struct sk_buff *skb,
+ if (ret == NF_ACCEPT) {
+ nf_reset(skb);
+ skb_forward_csum(skb);
++ if (skb->dev)
++ skb->tstamp = 0;
+ }
+ return ret;
+ }
+@@ -626,6 +628,8 @@ static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,
+
+ if (!local) {
+ skb_forward_csum(skb);
++ if (skb->dev)
++ skb->tstamp = 0;
+ NF_HOOK(pf, NF_INET_LOCAL_OUT, cp->ipvs->net, NULL, skb,
+ NULL, skb_dst(skb)->dev, dst_output);
+ } else
+@@ -646,6 +650,8 @@ static inline int ip_vs_send_or_cont(int pf, struct sk_buff *skb,
+ if (!local) {
+ ip_vs_drop_early_demux_sk(skb);
+ skb_forward_csum(skb);
++ if (skb->dev)
++ skb->tstamp = 0;
+ NF_HOOK(pf, NF_INET_LOCAL_OUT, cp->ipvs->net, NULL, skb,
+ NULL, skb_dst(skb)->dev, dst_output);
+ } else
+diff --git a/net/netfilter/nf_log_common.c b/net/netfilter/nf_log_common.c
+index a8c5c846aec10..b164a0e1e0536 100644
+--- a/net/netfilter/nf_log_common.c
++++ b/net/netfilter/nf_log_common.c
+@@ -176,6 +176,18 @@ nf_log_dump_packet_common(struct nf_log_buf *m, u_int8_t pf,
+ }
+ EXPORT_SYMBOL_GPL(nf_log_dump_packet_common);
+
++void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb)
++{
++ u16 vid;
++
++ if (!skb_vlan_tag_present(skb))
++ return;
++
++ vid = skb_vlan_tag_get(skb);
++ nf_log_buf_add(m, "VPROTO=%04x VID=%u ", ntohs(skb->vlan_proto), vid);
++}
++EXPORT_SYMBOL_GPL(nf_log_dump_vlan);
++
+ /* bridge and netdev logging families share this code. */
+ void nf_log_l2packet(struct net *net, u_int8_t pf,
+ __be16 protocol,
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index a65a5a5f434b8..310872a9d6602 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -1235,7 +1235,7 @@ static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info)
+ u32 idx;
+ char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
+
+- if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
++ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || !info->attrs[NFC_ATTR_FIRMWARE_NAME])
+ return -EINVAL;
+
+ idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
+diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
+index e4fc6b2bc29d2..f43234be5695e 100644
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -314,7 +314,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
+
+ metadata = __ipv6_tun_set_dst(&saddr, &daddr, tos, ttl, dst_port,
+ 0, flags,
+- key_id, 0);
++ key_id, opts_len);
+ } else {
+ NL_SET_ERR_MSG(extack, "Missing either ipv4 or ipv6 src and dst");
+ ret = -EINVAL;
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index 2c9baf8bf1189..e7a6c8dcf6b8e 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -770,7 +770,7 @@ static struct smc_buf_desc *smcr_new_buf_create(struct smc_link_group *lgr,
+ return buf_desc;
+ }
+
+-#define SMCD_DMBE_SIZES 7 /* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */
++#define SMCD_DMBE_SIZES 6 /* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */
+
+ static struct smc_buf_desc *smcd_new_buf_create(struct smc_link_group *lgr,
+ bool is_dmb, int bufsize)
+diff --git a/net/tipc/msg.c b/net/tipc/msg.c
+index b078b77620f18..0b8446cd541ce 100644
+--- a/net/tipc/msg.c
++++ b/net/tipc/msg.c
+@@ -140,7 +140,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
+ if (fragid == FIRST_FRAGMENT) {
+ if (unlikely(head))
+ goto err;
+- frag = skb_unshare(frag, GFP_ATOMIC);
++ if (skb_cloned(frag))
++ frag = skb_copy(frag, GFP_ATOMIC);
+ if (unlikely(!frag))
+ goto err;
+ head = *headbuf = frag;
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index 575d621305786..dd0fc2aa68759 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -351,13 +351,13 @@ static int tls_push_data(struct sock *sk,
+ struct tls_context *tls_ctx = tls_get_ctx(sk);
+ struct tls_offload_context_tx *ctx = tls_offload_ctx_tx(tls_ctx);
+ int tls_push_record_flags = flags | MSG_SENDPAGE_NOTLAST;
+- int more = flags & (MSG_SENDPAGE_NOTLAST | MSG_MORE);
+ struct tls_record_info *record = ctx->open_record;
+ struct page_frag *pfrag;
+ size_t orig_size = size;
+ u32 max_open_record_len;
+- int copy, rc = 0;
++ bool more = false;
+ bool done = false;
++ int copy, rc = 0;
+ long timeo;
+
+ if (flags &
+@@ -422,9 +422,8 @@ handle_error:
+ if (!size) {
+ last_record:
+ tls_push_record_flags = flags;
+- if (more) {
+- tls_ctx->pending_open_record_frags =
+- record->num_frags;
++ if (flags & (MSG_SENDPAGE_NOTLAST | MSG_MORE)) {
++ more = true;
+ break;
+ }
+
+@@ -445,6 +444,8 @@ last_record:
+ }
+ } while (!done);
+
++ tls_ctx->pending_open_record_frags = more;
++
+ if (orig_size - size > 0)
+ rc = orig_size - size;
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 4e41792099822..fbc8875502c3e 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -1950,7 +1950,10 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
+ * case we'll continue with more data in the next round,
+ * but break unconditionally so unsplit data stops here.
+ */
+- state->split_start++;
++ if (state->split)
++ state->split_start++;
++ else
++ state->split_start = 0;
+ break;
+ case 9:
+ if (rdev->wiphy.extended_capabilities &&
+diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
+index c5dd05ace28cf..f4f3de5f06ca5 100644
+--- a/security/integrity/ima/ima_crypto.c
++++ b/security/integrity/ima/ima_crypto.c
+@@ -682,6 +682,8 @@ static int ima_calc_boot_aggregate_tfm(char *digest,
+ ima_pcrread(i, pcr_i);
+ /* now accumulate with current aggregate */
+ rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE);
++ if (rc != 0)
++ return rc;
+ }
+ if (!rc)
+ crypto_shash_final(shash, digest);
+diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c
+index ed5bca0db3e73..f4a9d9972330b 100644
+--- a/sound/core/seq/oss/seq_oss.c
++++ b/sound/core/seq/oss/seq_oss.c
+@@ -187,9 +187,12 @@ odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ if (snd_BUG_ON(!dp))
+ return -ENXIO;
+
+- mutex_lock(®ister_mutex);
++ if (cmd != SNDCTL_SEQ_SYNC &&
++ mutex_lock_interruptible(®ister_mutex))
++ return -ERESTARTSYS;
+ rc = snd_seq_oss_ioctl(dp, cmd, arg);
+- mutex_unlock(®ister_mutex);
++ if (cmd != SNDCTL_SEQ_SYNC)
++ mutex_unlock(®ister_mutex);
+ return rc;
+ }
+
+diff --git a/sound/firewire/bebob/bebob_hwdep.c b/sound/firewire/bebob/bebob_hwdep.c
+index 04c321e08c626..a04b5880926cb 100644
+--- a/sound/firewire/bebob/bebob_hwdep.c
++++ b/sound/firewire/bebob/bebob_hwdep.c
+@@ -37,12 +37,11 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
+ }
+
+ memset(&event, 0, sizeof(event));
++ count = min_t(long, count, sizeof(event.lock_status));
+ if (bebob->dev_lock_changed) {
+ event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
+ event.lock_status.status = (bebob->dev_lock_count > 0);
+ bebob->dev_lock_changed = false;
+-
+- count = min_t(long, count, sizeof(event.lock_status));
+ }
+
+ spin_unlock_irq(&bebob->lock);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 24bc9e4460473..382a8d179eb0d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1906,6 +1906,8 @@ enum {
+ ALC1220_FIXUP_CLEVO_P950,
+ ALC1220_FIXUP_CLEVO_PB51ED,
+ ALC1220_FIXUP_CLEVO_PB51ED_PINS,
++ ALC887_FIXUP_ASUS_AUDIO,
++ ALC887_FIXUP_ASUS_HMIC,
+ };
+
+ static void alc889_fixup_coef(struct hda_codec *codec,
+@@ -2118,6 +2120,31 @@ static void alc1220_fixup_clevo_pb51ed(struct hda_codec *codec,
+ alc_fixup_headset_mode_no_hp_mic(codec, fix, action);
+ }
+
++static void alc887_asus_hp_automute_hook(struct hda_codec *codec,
++ struct hda_jack_callback *jack)
++{
++ struct alc_spec *spec = codec->spec;
++ unsigned int vref;
++
++ snd_hda_gen_hp_automute(codec, jack);
++
++ if (spec->gen.hp_jack_present)
++ vref = AC_PINCTL_VREF_80;
++ else
++ vref = AC_PINCTL_VREF_HIZ;
++ snd_hda_set_pin_ctl(codec, 0x19, PIN_HP | vref);
++}
++
++static void alc887_fixup_asus_jack(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++ if (action != HDA_FIXUP_ACT_PROBE)
++ return;
++ snd_hda_set_pin_ctl_cache(codec, 0x1b, PIN_HP);
++ spec->gen.hp_automute_hook = alc887_asus_hp_automute_hook;
++}
++
+ static const struct hda_fixup alc882_fixups[] = {
+ [ALC882_FIXUP_ABIT_AW9D_MAX] = {
+ .type = HDA_FIXUP_PINS,
+@@ -2375,6 +2402,20 @@ static const struct hda_fixup alc882_fixups[] = {
+ .chained = true,
+ .chain_id = ALC1220_FIXUP_CLEVO_PB51ED,
+ },
++ [ALC887_FIXUP_ASUS_AUDIO] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x15, 0x02a14150 }, /* use as headset mic, without its own jack detect */
++ { 0x19, 0x22219420 },
++ {}
++ },
++ },
++ [ALC887_FIXUP_ASUS_HMIC] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc887_fixup_asus_jack,
++ .chained = true,
++ .chain_id = ALC887_FIXUP_ASUS_AUDIO,
++ },
+ };
+
+ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+@@ -2408,6 +2449,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x13c2, "Asus A7M", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1043, 0x1873, "ASUS W90V", ALC882_FIXUP_ASUS_W90V),
+ SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
++ SND_PCI_QUIRK(0x1043, 0x2390, "Asus D700SA", ALC887_FIXUP_ASUS_HMIC),
+ SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
+ SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
+ SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
+diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c
+index 292b103abada9..475579a9830a3 100644
+--- a/sound/soc/qcom/lpass-cpu.c
++++ b/sound/soc/qcom/lpass-cpu.c
+@@ -182,21 +182,6 @@ static int lpass_cpu_daiops_hw_params(struct snd_pcm_substream *substream,
+ return 0;
+ }
+
+-static int lpass_cpu_daiops_hw_free(struct snd_pcm_substream *substream,
+- struct snd_soc_dai *dai)
+-{
+- struct lpass_data *drvdata = snd_soc_dai_get_drvdata(dai);
+- int ret;
+-
+- ret = regmap_write(drvdata->lpaif_map,
+- LPAIF_I2SCTL_REG(drvdata->variant, dai->driver->id),
+- 0);
+- if (ret)
+- dev_err(dai->dev, "error writing to i2sctl reg: %d\n", ret);
+-
+- return ret;
+-}
+-
+ static int lpass_cpu_daiops_prepare(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *dai)
+ {
+@@ -277,7 +262,6 @@ const struct snd_soc_dai_ops asoc_qcom_lpass_cpu_dai_ops = {
+ .startup = lpass_cpu_daiops_startup,
+ .shutdown = lpass_cpu_daiops_shutdown,
+ .hw_params = lpass_cpu_daiops_hw_params,
+- .hw_free = lpass_cpu_daiops_hw_free,
+ .prepare = lpass_cpu_daiops_prepare,
+ .trigger = lpass_cpu_daiops_trigger,
+ };
+diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
+index d07271ea4c451..2f29672477892 100644
+--- a/sound/soc/qcom/lpass-platform.c
++++ b/sound/soc/qcom/lpass-platform.c
+@@ -69,7 +69,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
+ int ret, dma_ch, dir = substream->stream;
+ struct lpass_pcm_data *data;
+
+- data = devm_kzalloc(soc_runtime->dev, sizeof(*data), GFP_KERNEL);
++ data = kzalloc(sizeof(*data), GFP_KERNEL);
+ if (!data)
+ return -ENOMEM;
+
+@@ -127,6 +127,7 @@ static int lpass_platform_pcmops_close(struct snd_pcm_substream *substream)
+ if (v->free_dma_channel)
+ v->free_dma_channel(drvdata, data->dma_ch);
+
++ kfree(data);
+ return 0;
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-11-01 20:29 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-11-01 20:29 UTC (permalink / raw
To: gentoo-commits
commit: 41b998757415c5917867b58dae4a2b76c8a28988
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 1 20:29:16 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Nov 1 20:29:16 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=41b99875
Linux patch 4.19.154
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1153_linux-4.19.154.patch | 3490 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3494 insertions(+)
diff --git a/0000_README b/0000_README
index f3a1010..ea0813a 100644
--- a/0000_README
+++ b/0000_README
@@ -651,6 +651,10 @@ Patch: 1152_linux-4.19.153.patch
From: https://www.kernel.org
Desc: Linux 4.19.153
+Patch: 1153_linux-4.19.154.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.154
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1153_linux-4.19.154.patch b/1153_linux-4.19.154.patch
new file mode 100644
index 0000000..8691528
--- /dev/null
+++ b/1153_linux-4.19.154.patch
@@ -0,0 +1,3490 @@
+diff --git a/Makefile b/Makefile
+index d5e93bf207998..a7056e26947c3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 153
++SUBLEVEL = 154
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
+index 55d1872aa81a8..9d19183f40e15 100644
+--- a/arch/arm/boot/dts/imx6sl.dtsi
++++ b/arch/arm/boot/dts/imx6sl.dtsi
+@@ -922,8 +922,10 @@
+ };
+
+ rngb: rngb@21b4000 {
++ compatible = "fsl,imx6sl-rngb", "fsl,imx25-rngb";
+ reg = <0x021b4000 0x4000>;
+ interrupts = <0 5 IRQ_TYPE_LEVEL_HIGH>;
++ clocks = <&clks IMX6SL_CLK_DUMMY>;
+ };
+
+ weim: weim@21b8000 {
+diff --git a/arch/arm/boot/dts/owl-s500.dtsi b/arch/arm/boot/dts/owl-s500.dtsi
+index 43c9980a4260c..75a76842c2700 100644
+--- a/arch/arm/boot/dts/owl-s500.dtsi
++++ b/arch/arm/boot/dts/owl-s500.dtsi
+@@ -85,21 +85,21 @@
+ global_timer: timer@b0020200 {
+ compatible = "arm,cortex-a9-global-timer";
+ reg = <0xb0020200 0x100>;
+- interrupts = <GIC_PPI 0 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
++ interrupts = <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
+ status = "disabled";
+ };
+
+ twd_timer: timer@b0020600 {
+ compatible = "arm,cortex-a9-twd-timer";
+ reg = <0xb0020600 0x20>;
+- interrupts = <GIC_PPI 2 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
++ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
+ status = "disabled";
+ };
+
+ twd_wdt: wdt@b0020620 {
+ compatible = "arm,cortex-a9-twd-wdt";
+ reg = <0xb0020620 0xe0>;
+- interrupts = <GIC_PPI 3 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
++ interrupts = <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+index c39b9169ea641..b2a773a718e16 100644
+--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
++++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+@@ -206,16 +206,16 @@
+ };
+
+ ®_dc1sw {
+- regulator-min-microvolt = <3000000>;
+- regulator-max-microvolt = <3000000>;
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
+ regulator-name = "vcc-gmac-phy";
+ };
+
+ ®_dcdc1 {
+ regulator-always-on;
+- regulator-min-microvolt = <3000000>;
+- regulator-max-microvolt = <3000000>;
+- regulator-name = "vcc-3v0";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ regulator-name = "vcc-3v3";
+ };
+
+ ®_dcdc2 {
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 8011e564a234b..2c5193ae20277 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -877,7 +877,7 @@
+ reg-names = "mdp_phys";
+
+ interrupt-parent = <&mdss>;
+- interrupts = <0 0>;
++ interrupts = <0>;
+
+ clocks = <&gcc GCC_MDSS_AHB_CLK>,
+ <&gcc GCC_MDSS_AXI_CLK>,
+@@ -909,7 +909,7 @@
+ reg-names = "dsi_ctrl";
+
+ interrupt-parent = <&mdss>;
+- interrupts = <4 0>;
++ interrupts = <4>;
+
+ assigned-clocks = <&gcc BYTE0_CLK_SRC>,
+ <&gcc PCLK0_CLK_SRC>;
+diff --git a/arch/arm64/boot/dts/qcom/pm8916.dtsi b/arch/arm64/boot/dts/qcom/pm8916.dtsi
+index 196b1c0ceb9b0..b968afa8da175 100644
+--- a/arch/arm64/boot/dts/qcom/pm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/pm8916.dtsi
+@@ -99,7 +99,7 @@
+
+ wcd_codec: codec@f000 {
+ compatible = "qcom,pm8916-wcd-analog-codec";
+- reg = <0xf000 0x200>;
++ reg = <0xf000>;
+ reg-names = "pmic-codec-core";
+ clocks = <&gcc GCC_CODEC_DIGCODEC_CLK>;
+ clock-names = "mclk";
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index a516c0e01429a..8a885ae647b7e 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -411,7 +411,7 @@
+ };
+
+ i2c0: i2c@ff020000 {
+- compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
++ compatible = "cdns,i2c-r1p14";
+ status = "disabled";
+ interrupt-parent = <&gic>;
+ interrupts = <0 17 4>;
+@@ -421,7 +421,7 @@
+ };
+
+ i2c1: i2c@ff030000 {
+- compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
++ compatible = "cdns,i2c-r1p14";
+ status = "disabled";
+ interrupt-parent = <&gic>;
+ interrupts = <0 18 4>;
+diff --git a/arch/powerpc/include/asm/tlb.h b/arch/powerpc/include/asm/tlb.h
+index f0e571b2dc7c8..a6073fecdacd3 100644
+--- a/arch/powerpc/include/asm/tlb.h
++++ b/arch/powerpc/include/asm/tlb.h
+@@ -76,19 +76,6 @@ static inline int mm_is_thread_local(struct mm_struct *mm)
+ return false;
+ return cpumask_test_cpu(smp_processor_id(), mm_cpumask(mm));
+ }
+-static inline void mm_reset_thread_local(struct mm_struct *mm)
+-{
+- WARN_ON(atomic_read(&mm->context.copros) > 0);
+- /*
+- * It's possible for mm_access to take a reference on mm_users to
+- * access the remote mm from another thread, but it's not allowed
+- * to set mm_cpumask, so mm_users may be > 1 here.
+- */
+- WARN_ON(current->mm != mm);
+- atomic_set(&mm->context.active_cpus, 1);
+- cpumask_clear(mm_cpumask(mm));
+- cpumask_set_cpu(smp_processor_id(), mm_cpumask(mm));
+-}
+ #else /* CONFIG_PPC_BOOK3S_64 */
+ static inline int mm_is_thread_local(struct mm_struct *mm)
+ {
+diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c
+index a130473f16e5b..8ece45c2a1f64 100644
+--- a/arch/powerpc/kernel/tau_6xx.c
++++ b/arch/powerpc/kernel/tau_6xx.c
+@@ -40,7 +40,7 @@ static struct tau_temp
+ unsigned char grew;
+ } tau[NR_CPUS];
+
+-#undef DEBUG
++static bool tau_int_enable;
+
+ /* TODO: put these in a /proc interface, with some sanity checks, and maybe
+ * dynamic adjustment to minimize # of interrupts */
+@@ -54,62 +54,44 @@ static struct tau_temp
+
+ static void set_thresholds(unsigned long cpu)
+ {
+-#ifdef CONFIG_TAU_INT
+- /*
+- * setup THRM1,
+- * threshold, valid bit, enable interrupts, interrupt when below threshold
+- */
+- mtspr(SPRN_THRM1, THRM1_THRES(tau[cpu].low) | THRM1_V | THRM1_TIE | THRM1_TID);
++ u32 maybe_tie = tau_int_enable ? THRM1_TIE : 0;
+
+- /* setup THRM2,
+- * threshold, valid bit, enable interrupts, interrupt when above threshold
+- */
+- mtspr (SPRN_THRM2, THRM1_THRES(tau[cpu].high) | THRM1_V | THRM1_TIE);
+-#else
+- /* same thing but don't enable interrupts */
+- mtspr(SPRN_THRM1, THRM1_THRES(tau[cpu].low) | THRM1_V | THRM1_TID);
+- mtspr(SPRN_THRM2, THRM1_THRES(tau[cpu].high) | THRM1_V);
+-#endif
++ /* setup THRM1, threshold, valid bit, interrupt when below threshold */
++ mtspr(SPRN_THRM1, THRM1_THRES(tau[cpu].low) | THRM1_V | maybe_tie | THRM1_TID);
++
++ /* setup THRM2, threshold, valid bit, interrupt when above threshold */
++ mtspr(SPRN_THRM2, THRM1_THRES(tau[cpu].high) | THRM1_V | maybe_tie);
+ }
+
+ static void TAUupdate(int cpu)
+ {
+- unsigned thrm;
+-
+-#ifdef DEBUG
+- printk("TAUupdate ");
+-#endif
++ u32 thrm;
++ u32 bits = THRM1_TIV | THRM1_TIN | THRM1_V;
+
+ /* if both thresholds are crossed, the step_sizes cancel out
+ * and the window winds up getting expanded twice. */
+- if((thrm = mfspr(SPRN_THRM1)) & THRM1_TIV){ /* is valid? */
+- if(thrm & THRM1_TIN){ /* crossed low threshold */
+- if (tau[cpu].low >= step_size){
+- tau[cpu].low -= step_size;
+- tau[cpu].high -= (step_size - window_expand);
+- }
+- tau[cpu].grew = 1;
+-#ifdef DEBUG
+- printk("low threshold crossed ");
+-#endif
++ thrm = mfspr(SPRN_THRM1);
++ if ((thrm & bits) == bits) {
++ mtspr(SPRN_THRM1, 0);
++
++ if (tau[cpu].low >= step_size) {
++ tau[cpu].low -= step_size;
++ tau[cpu].high -= (step_size - window_expand);
+ }
++ tau[cpu].grew = 1;
++ pr_debug("%s: low threshold crossed\n", __func__);
+ }
+- if((thrm = mfspr(SPRN_THRM2)) & THRM1_TIV){ /* is valid? */
+- if(thrm & THRM1_TIN){ /* crossed high threshold */
+- if (tau[cpu].high <= 127-step_size){
+- tau[cpu].low += (step_size - window_expand);
+- tau[cpu].high += step_size;
+- }
+- tau[cpu].grew = 1;
+-#ifdef DEBUG
+- printk("high threshold crossed ");
+-#endif
++ thrm = mfspr(SPRN_THRM2);
++ if ((thrm & bits) == bits) {
++ mtspr(SPRN_THRM2, 0);
++
++ if (tau[cpu].high <= 127 - step_size) {
++ tau[cpu].low += (step_size - window_expand);
++ tau[cpu].high += step_size;
+ }
++ tau[cpu].grew = 1;
++ pr_debug("%s: high threshold crossed\n", __func__);
+ }
+-
+-#ifdef DEBUG
+- printk("grew = %d\n", tau[cpu].grew);
+-#endif
+ }
+
+ #ifdef CONFIG_TAU_INT
+@@ -134,17 +116,16 @@ void TAUException(struct pt_regs * regs)
+ static void tau_timeout(void * info)
+ {
+ int cpu;
+- unsigned long flags;
+ int size;
+ int shrink;
+
+- /* disabling interrupts *should* be okay */
+- local_irq_save(flags);
+ cpu = smp_processor_id();
+
+-#ifndef CONFIG_TAU_INT
+- TAUupdate(cpu);
+-#endif
++ if (!tau_int_enable)
++ TAUupdate(cpu);
++
++ /* Stop thermal sensor comparisons and interrupts */
++ mtspr(SPRN_THRM3, 0);
+
+ size = tau[cpu].high - tau[cpu].low;
+ if (size > min_window && ! tau[cpu].grew) {
+@@ -167,18 +148,12 @@ static void tau_timeout(void * info)
+
+ set_thresholds(cpu);
+
+- /*
+- * Do the enable every time, since otherwise a bunch of (relatively)
+- * complex sleep code needs to be added. One mtspr every time
+- * tau_timeout is called is probably not a big deal.
+- *
++ /* Restart thermal sensor comparisons and interrupts.
+ * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet"
+ * recommends that "the maximum value be set in THRM3 under all
+ * conditions."
+ */
+ mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E);
+-
+- local_irq_restore(flags);
+ }
+
+ static struct workqueue_struct *tau_workq;
+@@ -225,6 +200,9 @@ static int __init TAU_init(void)
+ return 1;
+ }
+
++ tau_int_enable = IS_ENABLED(CONFIG_TAU_INT) &&
++ !strcmp(cur_cpu_spec->platform, "ppc750");
++
+ tau_workq = alloc_workqueue("tau", WQ_UNBOUND, 1);
+ if (!tau_workq)
+ return -ENOMEM;
+@@ -234,7 +212,7 @@ static int __init TAU_init(void)
+ queue_work(tau_workq, &tau_work);
+
+ pr_info("Thermal assist unit using %s, shrink_timer: %d ms\n",
+- IS_ENABLED(CONFIG_TAU_INT) ? "interrupts" : "workqueue", shrink_timer);
++ tau_int_enable ? "interrupts" : "workqueue", shrink_timer);
+ tau_initialized = 1;
+
+ return 0;
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 1749f15fc0705..80b8fc4173de6 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -598,19 +598,29 @@ static void do_exit_flush_lazy_tlb(void *arg)
+ struct mm_struct *mm = arg;
+ unsigned long pid = mm->context.id;
+
++ /*
++ * A kthread could have done a mmget_not_zero() after the flushing CPU
++ * checked mm_is_singlethreaded, and be in the process of
++ * kthread_use_mm when interrupted here. In that case, current->mm will
++ * be set to mm, because kthread_use_mm() setting ->mm and switching to
++ * the mm is done with interrupts off.
++ */
+ if (current->mm == mm)
+- return; /* Local CPU */
++ goto out_flush;
+
+ if (current->active_mm == mm) {
+- /*
+- * Must be a kernel thread because sender is single-threaded.
+- */
+- BUG_ON(current->mm);
++ WARN_ON_ONCE(current->mm != NULL);
++ /* Is a kernel thread and is using mm as the lazy tlb */
+ mmgrab(&init_mm);
+- switch_mm(mm, &init_mm, current);
+ current->active_mm = &init_mm;
++ switch_mm_irqs_off(mm, &init_mm, current);
+ mmdrop(mm);
+ }
++
++ atomic_dec(&mm->context.active_cpus);
++ cpumask_clear_cpu(smp_processor_id(), mm_cpumask(mm));
++
++out_flush:
+ _tlbiel_pid(pid, RIC_FLUSH_ALL);
+ }
+
+@@ -625,7 +635,6 @@ static void exit_flush_lazy_tlbs(struct mm_struct *mm)
+ */
+ smp_call_function_many(mm_cpumask(mm), do_exit_flush_lazy_tlb,
+ (void *)mm, 1);
+- mm_reset_thread_local(mm);
+ }
+
+ void radix__flush_tlb_mm(struct mm_struct *mm)
+diff --git a/arch/powerpc/perf/hv-gpci-requests.h b/arch/powerpc/perf/hv-gpci-requests.h
+index e608f9db12ddc..8965b4463d433 100644
+--- a/arch/powerpc/perf/hv-gpci-requests.h
++++ b/arch/powerpc/perf/hv-gpci-requests.h
+@@ -95,7 +95,7 @@ REQUEST(__field(0, 8, partition_id)
+
+ #define REQUEST_NAME system_performance_capabilities
+ #define REQUEST_NUM 0x40
+-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
++#define REQUEST_IDX_KIND "starting_index=0xffffffff"
+ #include I(REQUEST_BEGIN)
+ REQUEST(__field(0, 1, perf_collect_privileged)
+ __field(0x1, 1, capability_mask)
+@@ -223,7 +223,7 @@ REQUEST(__field(0, 2, partition_id)
+
+ #define REQUEST_NAME system_hypervisor_times
+ #define REQUEST_NUM 0xF0
+-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
++#define REQUEST_IDX_KIND "starting_index=0xffffffff"
+ #include I(REQUEST_BEGIN)
+ REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors)
+ __count(0x8, 8, time_spent_processing_virtual_processor_timers)
+@@ -234,7 +234,7 @@ REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors)
+
+ #define REQUEST_NAME system_tlbie_count_and_time
+ #define REQUEST_NUM 0xF4
+-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
++#define REQUEST_IDX_KIND "starting_index=0xffffffff"
+ #include I(REQUEST_BEGIN)
+ REQUEST(__count(0, 8, tlbie_instructions_issued)
+ /*
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 053b8e9aa9e75..69a2dc2b16cf1 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -273,6 +273,15 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+
+ mask |= CNST_PMC_MASK(pmc);
+ value |= CNST_PMC_VAL(pmc);
++
++ /*
++ * PMC5 and PMC6 are used to count cycles and instructions and
++ * they do not support most of the constraint bits. Add a check
++ * to exclude PMC5/6 from most of the constraints except for
++ * EBB/BHRB.
++ */
++ if (pmc >= 5)
++ goto ebb_bhrb;
+ }
+
+ if (pmc <= 4) {
+@@ -331,6 +340,7 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+ }
+ }
+
++ebb_bhrb:
+ if (!pmc && ebb)
+ /* EBB events must specify the PMC */
+ return -1;
+diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
+index 14ef17e10ec9a..9914544e66774 100644
+--- a/arch/powerpc/platforms/Kconfig
++++ b/arch/powerpc/platforms/Kconfig
+@@ -238,12 +238,11 @@ config TAU
+ temperature within 2-4 degrees Celsius. This option shows the current
+ on-die temperature in /proc/cpuinfo if the cpu supports it.
+
+- Unfortunately, on some chip revisions, this sensor is very inaccurate
+- and in many cases, does not work at all, so don't assume the cpu
+- temp is actually what /proc/cpuinfo says it is.
++ Unfortunately, this sensor is very inaccurate when uncalibrated, so
++ don't assume the cpu temp is actually what /proc/cpuinfo says it is.
+
+ config TAU_INT
+- bool "Interrupt driven TAU driver (DANGEROUS)"
++ bool "Interrupt driven TAU driver (EXPERIMENTAL)"
+ depends on TAU
+ ---help---
+ The TAU supports an interrupt driven mode which causes an interrupt
+@@ -251,12 +250,7 @@ config TAU_INT
+ to get notified the temp has exceeded a range. With this option off,
+ a timer is used to re-check the temperature periodically.
+
+- However, on some cpus it appears that the TAU interrupt hardware
+- is buggy and can cause a situation which would lead unexplained hard
+- lockups.
+-
+- Unless you are extending the TAU driver, or enjoy kernel/hardware
+- debugging, leave this option off.
++ If in doubt, say N here.
+
+ config TAU_AVERAGE
+ bool "Average high and low temp"
+diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c
+index 198143833f00d..1dc2122a3cf51 100644
+--- a/arch/powerpc/platforms/powernv/opal-dump.c
++++ b/arch/powerpc/platforms/powernv/opal-dump.c
+@@ -322,15 +322,14 @@ static ssize_t dump_attr_read(struct file *filep, struct kobject *kobj,
+ return count;
+ }
+
+-static struct dump_obj *create_dump_obj(uint32_t id, size_t size,
+- uint32_t type)
++static void create_dump_obj(uint32_t id, size_t size, uint32_t type)
+ {
+ struct dump_obj *dump;
+ int rc;
+
+ dump = kzalloc(sizeof(*dump), GFP_KERNEL);
+ if (!dump)
+- return NULL;
++ return;
+
+ dump->kobj.kset = dump_kset;
+
+@@ -350,21 +349,39 @@ static struct dump_obj *create_dump_obj(uint32_t id, size_t size,
+ rc = kobject_add(&dump->kobj, NULL, "0x%x-0x%x", type, id);
+ if (rc) {
+ kobject_put(&dump->kobj);
+- return NULL;
++ return;
+ }
+
++ /*
++ * As soon as the sysfs file for this dump is created/activated there is
++ * a chance the opal_errd daemon (or any userspace) might read and
++ * acknowledge the dump before kobject_uevent() is called. If that
++ * happens then there is a potential race between
++ * dump_ack_store->kobject_put() and kobject_uevent() which leads to a
++ * use-after-free of a kernfs object resulting in a kernel crash.
++ *
++ * To avoid that, we need to take a reference on behalf of the bin file,
++ * so that our reference remains valid while we call kobject_uevent().
++ * We then drop our reference before exiting the function, leaving the
++ * bin file to drop the last reference (if it hasn't already).
++ */
++
++ /* Take a reference for the bin file */
++ kobject_get(&dump->kobj);
+ rc = sysfs_create_bin_file(&dump->kobj, &dump->dump_attr);
+- if (rc) {
++ if (rc == 0) {
++ kobject_uevent(&dump->kobj, KOBJ_ADD);
++
++ pr_info("%s: New platform dump. ID = 0x%x Size %u\n",
++ __func__, dump->id, dump->size);
++ } else {
++ /* Drop reference count taken for bin file */
+ kobject_put(&dump->kobj);
+- return NULL;
+ }
+
+- pr_info("%s: New platform dump. ID = 0x%x Size %u\n",
+- __func__, dump->id, dump->size);
+-
+- kobject_uevent(&dump->kobj, KOBJ_ADD);
+-
+- return dump;
++ /* Drop our reference */
++ kobject_put(&dump->kobj);
++ return;
+ }
+
+ static irqreturn_t process_dump(int irq, void *data)
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 210eabd71ab23..670c2aedcefab 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -3561,7 +3561,7 @@ static int em_rdpid(struct x86_emulate_ctxt *ctxt)
+ u64 tsc_aux = 0;
+
+ if (ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux))
+- return emulate_gp(ctxt, 0);
++ return emulate_ud(ctxt);
+ ctxt->dst.val = tsc_aux;
+ return X86EMUL_CONTINUE;
+ }
+diff --git a/block/blk-core.c b/block/blk-core.c
+index ce3710404544c..445b878e35194 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -2127,11 +2127,10 @@ static void handle_bad_sector(struct bio *bio, sector_t maxsector)
+ {
+ char b[BDEVNAME_SIZE];
+
+- printk(KERN_INFO "attempt to access beyond end of device\n");
+- printk(KERN_INFO "%s: rw=%d, want=%Lu, limit=%Lu\n",
+- bio_devname(bio, b), bio->bi_opf,
+- (unsigned long long)bio_end_sector(bio),
+- (long long)maxsector);
++ pr_info_ratelimited("attempt to access beyond end of device\n"
++ "%s: rw=%d, want=%llu, limit=%llu\n",
++ bio_devname(bio, b), bio->bi_opf,
++ bio_end_sector(bio), maxsector);
+ }
+
+ #ifdef CONFIG_FAIL_MAKE_REQUEST
+diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
+index 90988e7a5b47f..2e7da9b379d48 100644
+--- a/drivers/clk/at91/clk-main.c
++++ b/drivers/clk/at91/clk-main.c
+@@ -517,12 +517,17 @@ static int clk_sam9x5_main_set_parent(struct clk_hw *hw, u8 index)
+ return -EINVAL;
+
+ regmap_read(regmap, AT91_CKGR_MOR, &tmp);
+- tmp &= ~MOR_KEY_MASK;
+
+ if (index && !(tmp & AT91_PMC_MOSCSEL))
+- regmap_write(regmap, AT91_CKGR_MOR, tmp | AT91_PMC_MOSCSEL);
++ tmp = AT91_PMC_MOSCSEL;
+ else if (!index && (tmp & AT91_PMC_MOSCSEL))
+- regmap_write(regmap, AT91_CKGR_MOR, tmp & ~AT91_PMC_MOSCSEL);
++ tmp = 0;
++ else
++ return 0;
++
++ regmap_update_bits(regmap, AT91_CKGR_MOR,
++ AT91_PMC_MOSCSEL | MOR_KEY_MASK,
++ tmp | AT91_PMC_KEY);
+
+ while (!clk_sam9x5_main_ready(regmap))
+ cpu_relax();
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index 1c093fb35ebee..e4fee233849d2 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1319,8 +1319,10 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
+ pll->hw.init = &init;
+
+ ret = devm_clk_hw_register(cprman->dev, &pll->hw);
+- if (ret)
++ if (ret) {
++ kfree(pll);
+ return NULL;
++ }
+ return &pll->hw;
+ }
+
+diff --git a/drivers/clk/rockchip/clk-half-divider.c b/drivers/clk/rockchip/clk-half-divider.c
+index b8da6e799423a..6a371d05218da 100644
+--- a/drivers/clk/rockchip/clk-half-divider.c
++++ b/drivers/clk/rockchip/clk-half-divider.c
+@@ -166,7 +166,7 @@ struct clk *rockchip_clk_register_halfdiv(const char *name,
+ unsigned long flags,
+ spinlock_t *lock)
+ {
+- struct clk *clk;
++ struct clk *clk = ERR_PTR(-ENOMEM);
+ struct clk_mux *mux = NULL;
+ struct clk_gate *gate = NULL;
+ struct clk_divider *div = NULL;
+diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
+index 79942f7057576..5da985604692f 100644
+--- a/drivers/cpufreq/powernv-cpufreq.c
++++ b/drivers/cpufreq/powernv-cpufreq.c
+@@ -885,12 +885,15 @@ static int powernv_cpufreq_reboot_notifier(struct notifier_block *nb,
+ unsigned long action, void *unused)
+ {
+ int cpu;
+- struct cpufreq_policy cpu_policy;
++ struct cpufreq_policy *cpu_policy;
+
+ rebooting = true;
+ for_each_online_cpu(cpu) {
+- cpufreq_get_policy(&cpu_policy, cpu);
+- powernv_cpufreq_target_index(&cpu_policy, get_nominal_index());
++ cpu_policy = cpufreq_cpu_get(cpu);
++ if (!cpu_policy)
++ continue;
++ powernv_cpufreq_target_index(cpu_policy, get_nominal_index());
++ cpufreq_cpu_put(cpu_policy);
+ }
+
+ return NOTIFY_DONE;
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 626b643d610eb..20ca9c9e109e0 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -1752,7 +1752,7 @@ ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ break;
+ default:
+ ret = -EINVAL;
+- goto e_ctx;
++ goto e_data;
+ }
+ } else {
+ /* Stash the context */
+diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
+index 65060c08522d7..22397a23780c0 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
++++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
+@@ -113,8 +113,10 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev,
+ vgdev->capsets[i].id > 0, 5 * HZ);
+ if (ret == 0) {
+ DRM_ERROR("timed out waiting for cap set %d\n", i);
++ spin_lock(&vgdev->display_info_lock);
+ kfree(vgdev->capsets);
+ vgdev->capsets = NULL;
++ spin_unlock(&vgdev->display_info_lock);
+ return;
+ }
+ DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n",
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index 608906f06cedd..3e72c6dac0ffe 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -566,9 +566,13 @@ static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev,
+ int i = le32_to_cpu(cmd->capset_index);
+
+ spin_lock(&vgdev->display_info_lock);
+- vgdev->capsets[i].id = le32_to_cpu(resp->capset_id);
+- vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version);
+- vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size);
++ if (vgdev->capsets) {
++ vgdev->capsets[i].id = le32_to_cpu(resp->capset_id);
++ vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version);
++ vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size);
++ } else {
++ DRM_ERROR("invalid capset memory.");
++ }
+ spin_unlock(&vgdev->display_info_lock);
+ wake_up(&vgdev->resp_wq);
+ }
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index ee6dd1b84fac8..017aec34a238d 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -1117,6 +1117,7 @@ config I2C_RCAR
+ tristate "Renesas R-Car I2C Controller"
+ depends on ARCH_RENESAS || COMPILE_TEST
+ select I2C_SLAVE
++ select RESET_CONTROLLER if ARCH_RCAR_GEN3
+ help
+ If you say yes to this option, support will be included for the
+ R-Car I2C controller.
+diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
+index eb05693593875..8ba4122fb3404 100644
+--- a/drivers/i2c/i2c-core-acpi.c
++++ b/drivers/i2c/i2c-core-acpi.c
+@@ -219,6 +219,7 @@ static acpi_status i2c_acpi_add_device(acpi_handle handle, u32 level,
+ void i2c_acpi_register_devices(struct i2c_adapter *adap)
+ {
+ acpi_status status;
++ acpi_handle handle;
+
+ if (!has_acpi_companion(&adap->dev))
+ return;
+@@ -229,6 +230,15 @@ void i2c_acpi_register_devices(struct i2c_adapter *adap)
+ adap, NULL);
+ if (ACPI_FAILURE(status))
+ dev_warn(&adap->dev, "failed to enumerate I2C slaves\n");
++
++ if (!adap->dev.parent)
++ return;
++
++ handle = ACPI_HANDLE(adap->dev.parent);
++ if (!handle)
++ return;
++
++ acpi_walk_dep_device_list(handle);
+ }
+
+ const struct acpi_device_id *
+@@ -693,7 +703,6 @@ int i2c_acpi_install_space_handler(struct i2c_adapter *adapter)
+ return -ENOMEM;
+ }
+
+- acpi_walk_dep_device_list(handle);
+ return 0;
+ }
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 1f14cd4ce3db5..8cdf933310d15 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -1678,19 +1678,30 @@ static void cma_release_port(struct rdma_id_private *id_priv)
+ mutex_unlock(&lock);
+ }
+
+-static void cma_leave_roce_mc_group(struct rdma_id_private *id_priv,
+- struct cma_multicast *mc)
++static void destroy_mc(struct rdma_id_private *id_priv,
++ struct cma_multicast *mc)
+ {
+- struct rdma_dev_addr *dev_addr = &id_priv->id.route.addr.dev_addr;
+- struct net_device *ndev = NULL;
++ if (rdma_cap_ib_mcast(id_priv->id.device, id_priv->id.port_num)) {
++ ib_sa_free_multicast(mc->multicast.ib);
++ kfree(mc);
++ return;
++ }
+
+- if (dev_addr->bound_dev_if)
+- ndev = dev_get_by_index(dev_addr->net, dev_addr->bound_dev_if);
+- if (ndev) {
+- cma_igmp_send(ndev, &mc->multicast.ib->rec.mgid, false);
+- dev_put(ndev);
++ if (rdma_protocol_roce(id_priv->id.device,
++ id_priv->id.port_num)) {
++ struct rdma_dev_addr *dev_addr =
++ &id_priv->id.route.addr.dev_addr;
++ struct net_device *ndev = NULL;
++
++ if (dev_addr->bound_dev_if)
++ ndev = dev_get_by_index(dev_addr->net,
++ dev_addr->bound_dev_if);
++ if (ndev) {
++ cma_igmp_send(ndev, &mc->multicast.ib->rec.mgid, false);
++ dev_put(ndev);
++ }
++ kref_put(&mc->mcref, release_mc);
+ }
+- kref_put(&mc->mcref, release_mc);
+ }
+
+ static void cma_leave_mc_groups(struct rdma_id_private *id_priv)
+@@ -1698,16 +1709,10 @@ static void cma_leave_mc_groups(struct rdma_id_private *id_priv)
+ struct cma_multicast *mc;
+
+ while (!list_empty(&id_priv->mc_list)) {
+- mc = container_of(id_priv->mc_list.next,
+- struct cma_multicast, list);
++ mc = list_first_entry(&id_priv->mc_list, struct cma_multicast,
++ list);
+ list_del(&mc->list);
+- if (rdma_cap_ib_mcast(id_priv->cma_dev->device,
+- id_priv->id.port_num)) {
+- ib_sa_free_multicast(mc->multicast.ib);
+- kfree(mc);
+- } else {
+- cma_leave_roce_mc_group(id_priv, mc);
+- }
++ destroy_mc(id_priv, mc);
+ }
+ }
+
+@@ -4020,16 +4025,6 @@ static int cma_ib_mc_handler(int status, struct ib_sa_multicast *multicast)
+ else
+ pr_debug_ratelimited("RDMA CM: MULTICAST_ERROR: failed to join multicast. status %d\n",
+ status);
+- mutex_lock(&id_priv->qp_mutex);
+- if (!status && id_priv->id.qp) {
+- status = ib_attach_mcast(id_priv->id.qp, &multicast->rec.mgid,
+- be16_to_cpu(multicast->rec.mlid));
+- if (status)
+- pr_debug_ratelimited("RDMA CM: MULTICAST_ERROR: failed to attach QP. status %d\n",
+- status);
+- }
+- mutex_unlock(&id_priv->qp_mutex);
+-
+ event.status = status;
+ event.param.ud.private_data = mc->context;
+ if (!status) {
+@@ -4283,6 +4278,10 @@ int rdma_join_multicast(struct rdma_cm_id *id, struct sockaddr *addr,
+ struct cma_multicast *mc;
+ int ret;
+
++ /* Not supported for kernel QPs */
++ if (WARN_ON(id->qp))
++ return -EINVAL;
++
+ if (!id->device)
+ return -EINVAL;
+
+@@ -4333,25 +4332,14 @@ void rdma_leave_multicast(struct rdma_cm_id *id, struct sockaddr *addr)
+ id_priv = container_of(id, struct rdma_id_private, id);
+ spin_lock_irq(&id_priv->lock);
+ list_for_each_entry(mc, &id_priv->mc_list, list) {
+- if (!memcmp(&mc->addr, addr, rdma_addr_size(addr))) {
+- list_del(&mc->list);
+- spin_unlock_irq(&id_priv->lock);
+-
+- if (id->qp)
+- ib_detach_mcast(id->qp,
+- &mc->multicast.ib->rec.mgid,
+- be16_to_cpu(mc->multicast.ib->rec.mlid));
+-
+- BUG_ON(id_priv->cma_dev->device != id->device);
+-
+- if (rdma_cap_ib_mcast(id->device, id->port_num)) {
+- ib_sa_free_multicast(mc->multicast.ib);
+- kfree(mc);
+- } else if (rdma_protocol_roce(id->device, id->port_num)) {
+- cma_leave_roce_mc_group(id_priv, mc);
+- }
+- return;
+- }
++ if (memcmp(&mc->addr, addr, rdma_addr_size(addr)) != 0)
++ continue;
++ list_del(&mc->list);
++ spin_unlock_irq(&id_priv->lock);
++
++ WARN_ON(id_priv->cma_dev->device != id->device);
++ destroy_mc(id_priv, mc);
++ return;
+ }
+ spin_unlock_irq(&id_priv->lock);
+ }
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+index 081aa91fc162d..620eaca2b8314 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+@@ -274,7 +274,6 @@ static int hns_roce_v1_post_send(struct ib_qp *ibqp,
+ ps_opcode = HNS_ROCE_WQE_OPCODE_SEND;
+ break;
+ case IB_WR_LOCAL_INV:
+- break;
+ case IB_WR_ATOMIC_CMP_AND_SWP:
+ case IB_WR_ATOMIC_FETCH_AND_ADD:
+ case IB_WR_LSO:
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 417de7ac0d5e2..2a203e08d4c1a 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -3821,6 +3821,7 @@ done:
+ }
+
+ qp_init_attr->cap = qp_attr->cap;
++ qp_init_attr->sq_sig_type = hr_qp->sq_signal_bits;
+
+ out:
+ mutex_unlock(&hr_qp->mutex);
+diff --git a/drivers/infiniband/sw/rdmavt/vt.c b/drivers/infiniband/sw/rdmavt/vt.c
+index 17e4abc067afa..541ee30727aa0 100644
+--- a/drivers/infiniband/sw/rdmavt/vt.c
++++ b/drivers/infiniband/sw/rdmavt/vt.c
+@@ -95,9 +95,7 @@ struct rvt_dev_info *rvt_alloc_device(size_t size, int nports)
+ if (!rdi)
+ return rdi;
+
+- rdi->ports = kcalloc(nports,
+- sizeof(struct rvt_ibport **),
+- GFP_KERNEL);
++ rdi->ports = kcalloc(nports, sizeof(*rdi->ports), GFP_KERNEL);
+ if (!rdi->ports)
+ ib_dealloc_device(&rdi->ibdev);
+
+diff --git a/drivers/input/keyboard/ep93xx_keypad.c b/drivers/input/keyboard/ep93xx_keypad.c
+index f77b295e0123e..01788a78041b3 100644
+--- a/drivers/input/keyboard/ep93xx_keypad.c
++++ b/drivers/input/keyboard/ep93xx_keypad.c
+@@ -257,8 +257,8 @@ static int ep93xx_keypad_probe(struct platform_device *pdev)
+ }
+
+ keypad->irq = platform_get_irq(pdev, 0);
+- if (!keypad->irq) {
+- err = -ENXIO;
++ if (keypad->irq < 0) {
++ err = keypad->irq;
+ goto failed_free;
+ }
+
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index 840e53732753f..aeeef50cef9bb 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -253,10 +253,8 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+ }
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq) {
+- dev_err(&pdev->dev, "no keyboard irq assigned\n");
+- return -EINVAL;
+- }
++ if (irq < 0)
++ return irq;
+
+ keypad_data = kzalloc(sizeof(struct omap4_keypad), GFP_KERNEL);
+ if (!keypad_data) {
+diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c
+index f9f98ef1d98e3..8677dbe0fd209 100644
+--- a/drivers/input/keyboard/twl4030_keypad.c
++++ b/drivers/input/keyboard/twl4030_keypad.c
+@@ -63,7 +63,7 @@ struct twl4030_keypad {
+ bool autorepeat;
+ unsigned int n_rows;
+ unsigned int n_cols;
+- unsigned int irq;
++ int irq;
+
+ struct device *dbg_dev;
+ struct input_dev *input;
+@@ -389,10 +389,8 @@ static int twl4030_kp_probe(struct platform_device *pdev)
+ }
+
+ kp->irq = platform_get_irq(pdev, 0);
+- if (!kp->irq) {
+- dev_err(&pdev->dev, "no keyboard irq assigned\n");
+- return -EINVAL;
+- }
++ if (kp->irq < 0)
++ return kp->irq;
+
+ error = matrix_keypad_build_keymap(keymap_data, NULL,
+ TWL4030_MAX_ROWS,
+diff --git a/drivers/input/serio/sun4i-ps2.c b/drivers/input/serio/sun4i-ps2.c
+index 04b96fe393397..46512b4d686a8 100644
+--- a/drivers/input/serio/sun4i-ps2.c
++++ b/drivers/input/serio/sun4i-ps2.c
+@@ -210,7 +210,6 @@ static int sun4i_ps2_probe(struct platform_device *pdev)
+ struct sun4i_ps2data *drvdata;
+ struct serio *serio;
+ struct device *dev = &pdev->dev;
+- unsigned int irq;
+ int error;
+
+ drvdata = kzalloc(sizeof(struct sun4i_ps2data), GFP_KERNEL);
+@@ -263,14 +262,12 @@ static int sun4i_ps2_probe(struct platform_device *pdev)
+ writel(0, drvdata->reg_base + PS2_REG_GCTL);
+
+ /* Get IRQ for the device */
+- irq = platform_get_irq(pdev, 0);
+- if (!irq) {
+- dev_err(dev, "no IRQ found\n");
+- error = -ENXIO;
++ drvdata->irq = platform_get_irq(pdev, 0);
++ if (drvdata->irq < 0) {
++ error = drvdata->irq;
+ goto err_disable_clk;
+ }
+
+- drvdata->irq = irq;
+ drvdata->serio = serio;
+ drvdata->dev = dev;
+
+diff --git a/drivers/input/touchscreen/imx6ul_tsc.c b/drivers/input/touchscreen/imx6ul_tsc.c
+index c10fc594f94d9..6bfe42a11452a 100644
+--- a/drivers/input/touchscreen/imx6ul_tsc.c
++++ b/drivers/input/touchscreen/imx6ul_tsc.c
+@@ -538,20 +538,25 @@ static int __maybe_unused imx6ul_tsc_resume(struct device *dev)
+
+ mutex_lock(&input_dev->mutex);
+
+- if (input_dev->users) {
+- retval = clk_prepare_enable(tsc->adc_clk);
+- if (retval)
+- goto out;
+-
+- retval = clk_prepare_enable(tsc->tsc_clk);
+- if (retval) {
+- clk_disable_unprepare(tsc->adc_clk);
+- goto out;
+- }
++ if (!input_dev->users)
++ goto out;
+
+- retval = imx6ul_tsc_init(tsc);
++ retval = clk_prepare_enable(tsc->adc_clk);
++ if (retval)
++ goto out;
++
++ retval = clk_prepare_enable(tsc->tsc_clk);
++ if (retval) {
++ clk_disable_unprepare(tsc->adc_clk);
++ goto out;
+ }
+
++ retval = imx6ul_tsc_init(tsc);
++ if (retval) {
++ clk_disable_unprepare(tsc->tsc_clk);
++ clk_disable_unprepare(tsc->adc_clk);
++ goto out;
++ }
+ out:
+ mutex_unlock(&input_dev->mutex);
+ return retval;
+diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c
+index b6f95f20f9244..cd8805d71d977 100644
+--- a/drivers/input/touchscreen/stmfts.c
++++ b/drivers/input/touchscreen/stmfts.c
+@@ -479,7 +479,7 @@ static ssize_t stmfts_sysfs_hover_enable_write(struct device *dev,
+
+ mutex_lock(&sdata->mutex);
+
+- if (value & sdata->hover_enabled)
++ if (value && sdata->hover_enabled)
+ goto out;
+
+ if (sdata->running)
+diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
+index 055c90b8253cb..10a559cfb7ea3 100644
+--- a/drivers/mailbox/mailbox.c
++++ b/drivers/mailbox/mailbox.c
+@@ -85,9 +85,12 @@ static void msg_submit(struct mbox_chan *chan)
+ exit:
+ spin_unlock_irqrestore(&chan->lock, flags);
+
+- if (!err && (chan->txdone_method & TXDONE_BY_POLL))
+- /* kick start the timer immediately to avoid delays */
+- hrtimer_start(&chan->mbox->poll_hrt, 0, HRTIMER_MODE_REL);
++ /* kick start the timer immediately to avoid delays */
++ if (!err && (chan->txdone_method & TXDONE_BY_POLL)) {
++ /* but only if not already active */
++ if (!hrtimer_active(&chan->mbox->poll_hrt))
++ hrtimer_start(&chan->mbox->poll_hrt, 0, HRTIMER_MODE_REL);
++ }
+ }
+
+ static void tx_tick(struct mbox_chan *chan, int r)
+@@ -125,11 +128,10 @@ static enum hrtimer_restart txdone_hrtimer(struct hrtimer *hrtimer)
+ struct mbox_chan *chan = &mbox->chans[i];
+
+ if (chan->active_req && chan->cl) {
++ resched = true;
+ txdone = chan->mbox->ops->last_tx_done(chan);
+ if (txdone)
+ tx_tick(chan, 0);
+- else
+- resched = true;
+ }
+ }
+
+diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c
+index eaf94b817dbc0..2ac9d24d3f0cd 100644
+--- a/drivers/media/firewire/firedtv-fw.c
++++ b/drivers/media/firewire/firedtv-fw.c
+@@ -271,8 +271,10 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
+
+ name_len = fw_csr_string(unit->directory, CSR_MODEL,
+ name, sizeof(name));
+- if (name_len < 0)
+- return name_len;
++ if (name_len < 0) {
++ err = name_len;
++ goto fail_free;
++ }
+ for (i = ARRAY_SIZE(model_names); --i; )
+ if (strlen(model_names[i]) <= name_len &&
+ strncmp(name, model_names[i], name_len) == 0)
+diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
+index cf05e11da01b0..4c042ba6de918 100644
+--- a/drivers/media/pci/bt8xx/bttv-driver.c
++++ b/drivers/media/pci/bt8xx/bttv-driver.c
+@@ -4055,11 +4055,13 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
+ btv->id = dev->device;
+ if (pci_enable_device(dev)) {
+ pr_warn("%d: Can't enable device\n", btv->c.nr);
+- return -EIO;
++ result = -EIO;
++ goto free_mem;
+ }
+ if (pci_set_dma_mask(dev, DMA_BIT_MASK(32))) {
+ pr_warn("%d: No suitable DMA available\n", btv->c.nr);
+- return -EIO;
++ result = -EIO;
++ goto free_mem;
+ }
+ if (!request_mem_region(pci_resource_start(dev,0),
+ pci_resource_len(dev,0),
+@@ -4067,7 +4069,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
+ pr_warn("%d: can't request iomem (0x%llx)\n",
+ btv->c.nr,
+ (unsigned long long)pci_resource_start(dev, 0));
+- return -EBUSY;
++ result = -EBUSY;
++ goto free_mem;
+ }
+ pci_set_master(dev);
+ pci_set_command(dev);
+@@ -4253,6 +4256,10 @@ fail0:
+ release_mem_region(pci_resource_start(btv->c.pci,0),
+ pci_resource_len(btv->c.pci,0));
+ pci_disable_device(btv->c.pci);
++
++free_mem:
++ bttvs[btv->c.nr] = NULL;
++ kfree(btv);
+ return result;
+ }
+
+diff --git a/drivers/media/pci/saa7134/saa7134-tvaudio.c b/drivers/media/pci/saa7134/saa7134-tvaudio.c
+index 68d400e1e240e..8c3da6f7a60f1 100644
+--- a/drivers/media/pci/saa7134/saa7134-tvaudio.c
++++ b/drivers/media/pci/saa7134/saa7134-tvaudio.c
+@@ -693,7 +693,8 @@ int saa_dsp_writel(struct saa7134_dev *dev, int reg, u32 value)
+ {
+ int err;
+
+- audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", reg << 2, value);
++ audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n",
++ (reg << 2) & 0xffffffff, value);
+ err = saa_dsp_wait_bit(dev,SAA7135_DSP_RWSTATE_WRR);
+ if (err < 0)
+ return err;
+diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c b/drivers/media/platform/exynos4-is/fimc-isp.c
+index 9a48c0f69320b..1dbebdc1c2f87 100644
+--- a/drivers/media/platform/exynos4-is/fimc-isp.c
++++ b/drivers/media/platform/exynos4-is/fimc-isp.c
+@@ -311,8 +311,10 @@ static int fimc_isp_subdev_s_power(struct v4l2_subdev *sd, int on)
+
+ if (on) {
+ ret = pm_runtime_get_sync(&is->pdev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put(&is->pdev->dev);
+ return ret;
++ }
+ set_bit(IS_ST_PWR_ON, &is->state);
+
+ ret = fimc_is_start_firmware(is);
+diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c b/drivers/media/platform/exynos4-is/fimc-lite.c
+index 70d5f5586a5d5..10fe7d2e8790c 100644
+--- a/drivers/media/platform/exynos4-is/fimc-lite.c
++++ b/drivers/media/platform/exynos4-is/fimc-lite.c
+@@ -480,7 +480,7 @@ static int fimc_lite_open(struct file *file)
+ set_bit(ST_FLITE_IN_USE, &fimc->state);
+ ret = pm_runtime_get_sync(&fimc->pdev->dev);
+ if (ret < 0)
+- goto unlock;
++ goto err_pm;
+
+ ret = v4l2_fh_open(file);
+ if (ret < 0)
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index f5fca01f3248e..3261dc72cc614 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -481,8 +481,10 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd)
+ return -ENXIO;
+
+ ret = pm_runtime_get_sync(fmd->pmf);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put(fmd->pmf);
+ return ret;
++ }
+
+ fmd->num_sensors = 0;
+
+diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c
+index b4e28a299e26e..efab3ebc67564 100644
+--- a/drivers/media/platform/exynos4-is/mipi-csis.c
++++ b/drivers/media/platform/exynos4-is/mipi-csis.c
+@@ -513,8 +513,10 @@ static int s5pcsis_s_stream(struct v4l2_subdev *sd, int enable)
+ if (enable) {
+ s5pcsis_clear_counters(state);
+ ret = pm_runtime_get_sync(&state->pdev->dev);
+- if (ret && ret != 1)
++ if (ret && ret != 1) {
++ pm_runtime_put_noidle(&state->pdev->dev);
+ return ret;
++ }
+ }
+
+ mutex_lock(&state->lock);
+diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
+index 60069869596cb..168f5af6abcc2 100644
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -321,8 +321,10 @@ static int venus_probe(struct platform_device *pdev)
+ goto err_dev_unregister;
+
+ ret = pm_runtime_put_sync(dev);
+- if (ret)
++ if (ret) {
++ pm_runtime_get_noresume(dev);
+ goto err_dev_unregister;
++ }
+
+ return 0;
+
+@@ -333,6 +335,7 @@ err_core_deinit:
+ err_venus_shutdown:
+ venus_shutdown(dev);
+ err_runtime_disable:
++ pm_runtime_put_noidle(dev);
+ pm_runtime_set_suspended(dev);
+ pm_runtime_disable(dev);
+ hfi_destroy(core);
+diff --git a/drivers/media/platform/s3c-camif/camif-core.c b/drivers/media/platform/s3c-camif/camif-core.c
+index 79bc0ef6bb413..8d8ed72bd0aaf 100644
+--- a/drivers/media/platform/s3c-camif/camif-core.c
++++ b/drivers/media/platform/s3c-camif/camif-core.c
+@@ -476,7 +476,7 @@ static int s3c_camif_probe(struct platform_device *pdev)
+
+ ret = camif_media_dev_init(camif);
+ if (ret < 0)
+- goto err_alloc;
++ goto err_pm;
+
+ ret = camif_register_sensor(camif);
+ if (ret < 0)
+@@ -510,10 +510,9 @@ err_sens:
+ media_device_unregister(&camif->media_dev);
+ media_device_cleanup(&camif->media_dev);
+ camif_unregister_media_entities(camif);
+-err_alloc:
++err_pm:
+ pm_runtime_put(dev);
+ pm_runtime_disable(dev);
+-err_pm:
+ camif_clk_put(camif);
+ err_clk:
+ s3c_camif_unregister_subdev(camif);
+diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+index 40c4eef71c34c..00f6e3f06dac5 100644
+--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+@@ -1371,7 +1371,7 @@ static int bdisp_probe(struct platform_device *pdev)
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0) {
+ dev_err(dev, "failed to set PM\n");
+- goto err_dbg;
++ goto err_pm;
+ }
+
+ /* Filters */
+@@ -1399,7 +1399,6 @@ err_filter:
+ bdisp_hw_free_filters(bdisp->dev);
+ err_pm:
+ pm_runtime_put(dev);
+-err_dbg:
+ bdisp_debugfs_remove(bdisp);
+ err_v4l2:
+ v4l2_device_unregister(&bdisp->v4l2_dev);
+diff --git a/drivers/media/platform/sti/delta/delta-v4l2.c b/drivers/media/platform/sti/delta/delta-v4l2.c
+index 0b42acd4e3a6e..53dc6da2b09e2 100644
+--- a/drivers/media/platform/sti/delta/delta-v4l2.c
++++ b/drivers/media/platform/sti/delta/delta-v4l2.c
+@@ -954,8 +954,10 @@ static void delta_run_work(struct work_struct *work)
+ /* enable the hardware */
+ if (!dec->pm) {
+ ret = delta_get_sync(ctx);
+- if (ret)
++ if (ret) {
++ delta_put_autosuspend(ctx);
+ goto err;
++ }
+ }
+
+ /* decode this access unit */
+diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c
+index 7917fd2c4bd4b..d826c011c0952 100644
+--- a/drivers/media/platform/sti/hva/hva-hw.c
++++ b/drivers/media/platform/sti/hva/hva-hw.c
+@@ -272,6 +272,7 @@ static unsigned long int hva_hw_get_ip_version(struct hva_dev *hva)
+
+ if (pm_runtime_get_sync(dev) < 0) {
+ dev_err(dev, "%s failed to get pm_runtime\n", HVA_PREFIX);
++ pm_runtime_put_noidle(dev);
+ mutex_unlock(&hva->protect_mutex);
+ return -EFAULT;
+ }
+@@ -392,7 +393,7 @@ int hva_hw_probe(struct platform_device *pdev, struct hva_dev *hva)
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0) {
+ dev_err(dev, "%s failed to set PM\n", HVA_PREFIX);
+- goto err_clk;
++ goto err_pm;
+ }
+
+ /* check IP hardware version */
+@@ -557,6 +558,7 @@ void hva_hw_dump_regs(struct hva_dev *hva, struct seq_file *s)
+
+ if (pm_runtime_get_sync(dev) < 0) {
+ seq_puts(s, "Cannot wake up IP\n");
++ pm_runtime_put_noidle(dev);
+ mutex_unlock(&hva->protect_mutex);
+ return;
+ }
+diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c
+index b6619c9c18bb4..4e6530ee809af 100644
+--- a/drivers/media/platform/vsp1/vsp1_drv.c
++++ b/drivers/media/platform/vsp1/vsp1_drv.c
+@@ -562,7 +562,12 @@ int vsp1_device_get(struct vsp1_device *vsp1)
+ int ret;
+
+ ret = pm_runtime_get_sync(vsp1->dev);
+- return ret < 0 ? ret : 0;
++ if (ret < 0) {
++ pm_runtime_put_noidle(vsp1->dev);
++ return ret;
++ }
++
++ return 0;
+ }
+
+ /*
+@@ -845,12 +850,12 @@ static int vsp1_probe(struct platform_device *pdev)
+ /* Configure device parameters based on the version register. */
+ pm_runtime_enable(&pdev->dev);
+
+- ret = pm_runtime_get_sync(&pdev->dev);
++ ret = vsp1_device_get(vsp1);
+ if (ret < 0)
+ goto done;
+
+ vsp1->version = vsp1_read(vsp1, VI6_IP_VERSION);
+- pm_runtime_put_sync(&pdev->dev);
++ vsp1_device_put(vsp1);
+
+ for (i = 0; i < ARRAY_SIZE(vsp1_device_infos); ++i) {
+ if ((vsp1->version & VI6_IP_VERSION_MODEL_MASK) ==
+diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c
+index 8e82610ffaad5..01c82da8e9aa2 100644
+--- a/drivers/media/rc/ati_remote.c
++++ b/drivers/media/rc/ati_remote.c
+@@ -845,6 +845,10 @@ static int ati_remote_probe(struct usb_interface *interface,
+ err("%s: endpoint_in message size==0? \n", __func__);
+ return -ENODEV;
+ }
++ if (!usb_endpoint_is_int_out(endpoint_out)) {
++ err("%s: Unexpected endpoint_out\n", __func__);
++ return -ENODEV;
++ }
+
+ ati_remote = kzalloc(sizeof (struct ati_remote), GFP_KERNEL);
+ rc_dev = rc_allocate_device(RC_DRIVER_SCANCODE);
+diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
+index 18a7384b50ee9..0921c95a1dca5 100644
+--- a/drivers/media/usb/uvc/uvc_v4l2.c
++++ b/drivers/media/usb/uvc/uvc_v4l2.c
+@@ -252,11 +252,41 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
+ if (ret < 0)
+ goto done;
+
++ /* After the probe, update fmt with the values returned from
++ * negotiation with the device.
++ */
++ for (i = 0; i < stream->nformats; ++i) {
++ if (probe->bFormatIndex == stream->format[i].index) {
++ format = &stream->format[i];
++ break;
++ }
++ }
++
++ if (i == stream->nformats) {
++ uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n",
++ probe->bFormatIndex);
++ return -EINVAL;
++ }
++
++ for (i = 0; i < format->nframes; ++i) {
++ if (probe->bFrameIndex == format->frame[i].bFrameIndex) {
++ frame = &format->frame[i];
++ break;
++ }
++ }
++
++ if (i == format->nframes) {
++ uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n",
++ probe->bFrameIndex);
++ return -EINVAL;
++ }
++
+ fmt->fmt.pix.width = frame->wWidth;
+ fmt->fmt.pix.height = frame->wHeight;
+ fmt->fmt.pix.field = V4L2_FIELD_NONE;
+ fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(format, frame);
+ fmt->fmt.pix.sizeimage = probe->dwMaxVideoFrameSize;
++ fmt->fmt.pix.pixelformat = format->fcc;
+ fmt->fmt.pix.colorspace = format->colorspace;
+ fmt->fmt.pix.priv = 0;
+
+diff --git a/drivers/memory/fsl-corenet-cf.c b/drivers/memory/fsl-corenet-cf.c
+index 662d050243bec..2fbf8d09af36b 100644
+--- a/drivers/memory/fsl-corenet-cf.c
++++ b/drivers/memory/fsl-corenet-cf.c
+@@ -215,10 +215,8 @@ static int ccf_probe(struct platform_device *pdev)
+ dev_set_drvdata(&pdev->dev, ccf);
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq) {
+- dev_err(&pdev->dev, "%s: no irq\n", __func__);
+- return -ENXIO;
+- }
++ if (irq < 0)
++ return irq;
+
+ ret = devm_request_irq(&pdev->dev, irq, ccf_irq, 0, pdev->name, ccf);
+ if (ret) {
+diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
+index 1c6a7c16e0c17..2ca507f3a58c3 100644
+--- a/drivers/memory/omap-gpmc.c
++++ b/drivers/memory/omap-gpmc.c
+@@ -951,7 +951,7 @@ static int gpmc_cs_remap(int cs, u32 base)
+ int ret;
+ u32 old_base, size;
+
+- if (cs > gpmc_cs_num) {
++ if (cs >= gpmc_cs_num) {
+ pr_err("%s: requested chip-select is disabled\n", __func__);
+ return -ENODEV;
+ }
+@@ -986,7 +986,7 @@ int gpmc_cs_request(int cs, unsigned long size, unsigned long *base)
+ struct resource *res = &gpmc->mem;
+ int r = -1;
+
+- if (cs > gpmc_cs_num) {
++ if (cs >= gpmc_cs_num) {
+ pr_err("%s: requested chip-select is disabled\n", __func__);
+ return -ENODEV;
+ }
+@@ -2278,6 +2278,10 @@ static void gpmc_probe_dt_children(struct platform_device *pdev)
+ }
+ }
+ #else
++void gpmc_read_settings_dt(struct device_node *np, struct gpmc_settings *p)
++{
++ memset(p, 0, sizeof(*p));
++}
+ static int gpmc_probe_dt(struct platform_device *pdev)
+ {
+ return 0;
+diff --git a/drivers/misc/cardreader/rtsx_pcr.c b/drivers/misc/cardreader/rtsx_pcr.c
+index 5c5d0241603a3..3eb3c237f3398 100644
+--- a/drivers/misc/cardreader/rtsx_pcr.c
++++ b/drivers/misc/cardreader/rtsx_pcr.c
+@@ -1524,12 +1524,14 @@ static int rtsx_pci_probe(struct pci_dev *pcidev,
+ ret = mfd_add_devices(&pcidev->dev, pcr->id, rtsx_pcr_cells,
+ ARRAY_SIZE(rtsx_pcr_cells), NULL, 0, NULL);
+ if (ret < 0)
+- goto disable_irq;
++ goto free_slots;
+
+ schedule_delayed_work(&pcr->idle_work, msecs_to_jiffies(200));
+
+ return 0;
+
++free_slots:
++ kfree(pcr->slots);
+ disable_irq:
+ free_irq(pcr->irq, (void *)pcr);
+ disable_msi:
+diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c
+index 840afb398f9e4..8dd5c610c438d 100644
+--- a/drivers/misc/eeprom/at25.c
++++ b/drivers/misc/eeprom/at25.c
+@@ -362,7 +362,7 @@ static int at25_probe(struct spi_device *spi)
+ at25->nvmem_config.reg_read = at25_ee_read;
+ at25->nvmem_config.reg_write = at25_ee_write;
+ at25->nvmem_config.priv = at25;
+- at25->nvmem_config.stride = 4;
++ at25->nvmem_config.stride = 1;
+ at25->nvmem_config.word_size = 1;
+ at25->nvmem_config.size = chip.byte_len;
+
+diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c
+index de7f035a176df..f4332a97c6917 100644
+--- a/drivers/misc/mic/vop/vop_main.c
++++ b/drivers/misc/mic/vop/vop_main.c
+@@ -301,7 +301,7 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
+ /* First assign the vring's allocated in host memory */
+ vqconfig = _vop_vq_config(vdev->desc) + index;
+ memcpy_fromio(&config, vqconfig, sizeof(config));
+- _vr_size = vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN);
++ _vr_size = round_up(vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN), 4);
+ vr_size = PAGE_ALIGN(_vr_size + sizeof(struct _mic_vring_info));
+ va = vpdev->hw_ops->ioremap(vpdev, le64_to_cpu(config.address),
+ vr_size);
+diff --git a/drivers/misc/mic/vop/vop_vringh.c b/drivers/misc/mic/vop/vop_vringh.c
+index cbc8ebcff5cfe..a252c2199b937 100644
+--- a/drivers/misc/mic/vop/vop_vringh.c
++++ b/drivers/misc/mic/vop/vop_vringh.c
+@@ -308,7 +308,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev,
+
+ num = le16_to_cpu(vqconfig[i].num);
+ mutex_init(&vvr->vr_mutex);
+- vr_size = PAGE_ALIGN(vring_size(num, MIC_VIRTIO_RING_ALIGN) +
++ vr_size = PAGE_ALIGN(round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4) +
+ sizeof(struct _mic_vring_info));
+ vr->va = (void *)
+ __get_free_pages(GFP_KERNEL | __GFP_ZERO,
+@@ -320,7 +320,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev,
+ goto err;
+ }
+ vr->len = vr_size;
+- vr->info = vr->va + vring_size(num, MIC_VIRTIO_RING_ALIGN);
++ vr->info = vr->va + round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4);
+ vr->info->magic = cpu_to_le32(MIC_MAGIC + vdev->virtio_id + i);
+ vr_addr = dma_map_single(&vpdev->dev, vr->va, vr_size,
+ DMA_BIDIRECTIONAL);
+@@ -611,6 +611,7 @@ static int vop_virtio_copy_from_user(struct vop_vdev *vdev, void __user *ubuf,
+ size_t partlen;
+ bool dma = VOP_USE_DMA;
+ int err = 0;
++ size_t offset = 0;
+
+ if (daddr & (dma_alignment - 1)) {
+ vdev->tx_dst_unaligned += len;
+@@ -659,13 +660,20 @@ memcpy:
+ * We are copying to IO below and should ideally use something
+ * like copy_from_user_toio(..) if it existed.
+ */
+- if (copy_from_user((void __force *)dbuf, ubuf, len)) {
+- err = -EFAULT;
+- dev_err(vop_dev(vdev), "%s %d err %d\n",
+- __func__, __LINE__, err);
+- goto err;
++ while (len) {
++ partlen = min_t(size_t, len, VOP_INT_DMA_BUF_SIZE);
++
++ if (copy_from_user(vvr->buf, ubuf + offset, partlen)) {
++ err = -EFAULT;
++ dev_err(vop_dev(vdev), "%s %d err %d\n",
++ __func__, __LINE__, err);
++ goto err;
++ }
++ memcpy_toio(dbuf + offset, vvr->buf, partlen);
++ offset += partlen;
++ vdev->out_bytes += partlen;
++ len -= partlen;
+ }
+- vdev->out_bytes += len;
+ err = 0;
+ err:
+ vpdev->hw_ops->iounmap(vpdev, dbuf);
+diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
+index f8c372839d244..2ca5cd79018b4 100644
+--- a/drivers/mmc/core/sdio_cis.c
++++ b/drivers/mmc/core/sdio_cis.c
+@@ -30,6 +30,9 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
+ unsigned i, nr_strings;
+ char **buffer, *string;
+
++ if (size < 2)
++ return 0;
++
+ /* Find all null-terminated (including zero length) strings in
+ the TPLLV1_INFO field. Trailing garbage is ignored. */
+ buf += 2;
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index bfe13c6627bed..0be8db6ab3195 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -1091,18 +1091,23 @@ static int flexcan_chip_start(struct net_device *dev)
+ return err;
+ }
+
+-/* flexcan_chip_stop
++/* __flexcan_chip_stop
+ *
+- * this functions is entered with clocks enabled
++ * this function is entered with clocks enabled
+ */
+-static void flexcan_chip_stop(struct net_device *dev)
++static int __flexcan_chip_stop(struct net_device *dev, bool disable_on_error)
+ {
+ struct flexcan_priv *priv = netdev_priv(dev);
+ struct flexcan_regs __iomem *regs = priv->regs;
++ int err;
+
+ /* freeze + disable module */
+- flexcan_chip_freeze(priv);
+- flexcan_chip_disable(priv);
++ err = flexcan_chip_freeze(priv);
++ if (err && !disable_on_error)
++ return err;
++ err = flexcan_chip_disable(priv);
++ if (err && !disable_on_error)
++ goto out_chip_unfreeze;
+
+ /* Disable all interrupts */
+ priv->write(0, ®s->imask2);
+@@ -1112,6 +1117,23 @@ static void flexcan_chip_stop(struct net_device *dev)
+
+ flexcan_transceiver_disable(priv);
+ priv->can.state = CAN_STATE_STOPPED;
++
++ return 0;
++
++ out_chip_unfreeze:
++ flexcan_chip_unfreeze(priv);
++
++ return err;
++}
++
++static inline int flexcan_chip_stop_disable_on_error(struct net_device *dev)
++{
++ return __flexcan_chip_stop(dev, true);
++}
++
++static inline int flexcan_chip_stop(struct net_device *dev)
++{
++ return __flexcan_chip_stop(dev, false);
+ }
+
+ static int flexcan_open(struct net_device *dev)
+@@ -1165,7 +1187,7 @@ static int flexcan_close(struct net_device *dev)
+
+ netif_stop_queue(dev);
+ can_rx_offload_disable(&priv->offload);
+- flexcan_chip_stop(dev);
++ flexcan_chip_stop_disable_on_error(dev);
+
+ free_irq(dev->irq, dev);
+ clk_disable_unprepare(priv->clk_per);
+diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
+index 5bdff77c0ad10..993f495e2bf7b 100644
+--- a/drivers/net/ethernet/korina.c
++++ b/drivers/net/ethernet/korina.c
+@@ -1113,7 +1113,7 @@ out:
+ return rc;
+
+ probe_err_register:
+- kfree(KSEG0ADDR(lp->td_ring));
++ kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring));
+ probe_err_td_ring:
+ iounmap(lp->tx_dma_regs);
+ probe_err_dma_tx:
+@@ -1133,7 +1133,7 @@ static int korina_remove(struct platform_device *pdev)
+ iounmap(lp->eth_regs);
+ iounmap(lp->rx_dma_regs);
+ iounmap(lp->tx_dma_regs);
+- kfree(KSEG0ADDR(lp->td_ring));
++ kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring));
+
+ unregister_netdev(bif->dev);
+ free_netdev(bif->dev);
+diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
+index 03d4cc6f35bcd..7d15f6208b463 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -153,6 +153,14 @@ static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
+ BUILD_BUG_ON(HTT_RX_RING_FILL_LEVEL >= HTT_RX_RING_SIZE / 2);
+
+ idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr);
++
++ if (idx < 0 || idx >= htt->rx_ring.size) {
++ ath10k_err(htt->ar, "rx ring index is not valid, firmware malfunctioning?\n");
++ idx &= htt->rx_ring.size_mask;
++ ret = -ENOMEM;
++ goto fail;
++ }
++
+ while (num > 0) {
+ skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN);
+ if (!skb) {
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index 3f563e02d17da..2ed98aaed6fb5 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -449,10 +449,19 @@ static void hif_usb_stop(void *hif_handle)
+ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
+ /* The pending URBs have to be canceled. */
++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+ list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+ &hif_dev->tx.tx_pending, list) {
++ usb_get_urb(tx_buf->urb);
++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+ usb_kill_urb(tx_buf->urb);
++ list_del(&tx_buf->list);
++ usb_free_urb(tx_buf->urb);
++ kfree(tx_buf->buf);
++ kfree(tx_buf);
++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+ }
++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
+ usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
+ }
+@@ -762,27 +771,37 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
+ struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
+ unsigned long flags;
+
++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+ list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+ &hif_dev->tx.tx_buf, list) {
++ usb_get_urb(tx_buf->urb);
++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+ usb_kill_urb(tx_buf->urb);
+ list_del(&tx_buf->list);
+ usb_free_urb(tx_buf->urb);
+ kfree(tx_buf->buf);
+ kfree(tx_buf);
++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+ }
++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
+ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+ hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
+ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+ list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+ &hif_dev->tx.tx_pending, list) {
++ usb_get_urb(tx_buf->urb);
++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+ usb_kill_urb(tx_buf->urb);
+ list_del(&tx_buf->list);
+ usb_free_urb(tx_buf->urb);
+ kfree(tx_buf->buf);
+ kfree(tx_buf);
++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+ }
++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
+ usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
+ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+index ee922b0525610..768a99c15c08b 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -1563,6 +1563,8 @@ fail:
+ BRCMF_TX_IOCTL_MAX_MSG_SIZE,
+ msgbuf->ioctbuf,
+ msgbuf->ioctbuf_handle);
++ if (msgbuf->txflow_wq)
++ destroy_workqueue(msgbuf->txflow_wq);
+ kfree(msgbuf);
+ }
+ return -ENOMEM;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
+index 9fb0d9fbd9395..d532decc15383 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
+@@ -5085,8 +5085,10 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
+ pi->pi_fptr.radioloftget = wlc_lcnphy_get_radio_loft;
+ pi->pi_fptr.detach = wlc_phy_detach_lcnphy;
+
+- if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
++ if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) {
++ kfree(pi->u.pi_lcnphy);
+ return false;
++ }
+
+ if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
+ if (pi_lcn->lcnphy_tempsense_option == 3) {
+diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
+index d445acc4786b7..2a8d40ce463d5 100644
+--- a/drivers/net/wireless/marvell/mwifiex/usb.c
++++ b/drivers/net/wireless/marvell/mwifiex/usb.c
+@@ -1355,7 +1355,8 @@ static void mwifiex_usb_cleanup_tx_aggr(struct mwifiex_adapter *adapter)
+ skb_dequeue(&port->tx_aggr.aggr_list)))
+ mwifiex_write_data_complete(adapter, skb_tmp,
+ 0, -1);
+- del_timer_sync(&port->tx_aggr.timer_cnxt.hold_timer);
++ if (port->tx_aggr.timer_cnxt.hold_timer.function)
++ del_timer_sync(&port->tx_aggr.timer_cnxt.hold_timer);
+ port->tx_aggr.timer_cnxt.is_hold_timer_set = false;
+ port->tx_aggr.timer_cnxt.hold_tmo_msecs = 0;
+ }
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 070ea0f456abd..b80cff96dea1e 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -5453,7 +5453,6 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)
+ ret = usb_submit_urb(urb, GFP_KERNEL);
+ if (ret) {
+ usb_unanchor_urb(urb);
+- usb_free_urb(urb);
+ goto error;
+ }
+
+@@ -5462,6 +5461,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)
+ rtl8xxxu_write32(priv, REG_USB_HIMR, val32);
+
+ error:
++ usb_free_urb(urb);
+ return ret;
+ }
+
+@@ -5787,6 +5787,7 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw)
+ struct rtl8xxxu_priv *priv = hw->priv;
+ struct rtl8xxxu_rx_urb *rx_urb;
+ struct rtl8xxxu_tx_urb *tx_urb;
++ struct sk_buff *skb;
+ unsigned long flags;
+ int ret, i;
+
+@@ -5837,6 +5838,13 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw)
+ rx_urb->hw = hw;
+
+ ret = rtl8xxxu_submit_rx_urb(priv, rx_urb);
++ if (ret) {
++ if (ret != -ENOMEM) {
++ skb = (struct sk_buff *)rx_urb->urb.context;
++ dev_kfree_skb(skb);
++ }
++ rtl8xxxu_queue_rx_urb(priv, rx_urb);
++ }
+ }
+ exit:
+ /*
+diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
+index efb214fc545a2..0b1fbb5dba9b6 100644
+--- a/drivers/ntb/hw/amd/ntb_hw_amd.c
++++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
+@@ -1036,6 +1036,7 @@ static int amd_ntb_init_pci(struct amd_ntb_dev *ndev,
+
+ err_dma_mask:
+ pci_clear_master(pdev);
++ pci_release_regions(pdev);
+ err_pci_regions:
+ pci_disable_device(pdev);
+ err_pci_enable:
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index f28df233dfcd0..2b492ad55f0e4 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -787,7 +787,8 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl)
+ * in case a host died before it enabled the controller. Hence, simply
+ * reset the keep alive timer when the controller is enabled.
+ */
+- mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
++ if (ctrl->kato)
++ mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
+ }
+
+ static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)
+diff --git a/drivers/pci/controller/pcie-iproc-msi.c b/drivers/pci/controller/pcie-iproc-msi.c
+index 9deb56989d726..ea612382599cf 100644
+--- a/drivers/pci/controller/pcie-iproc-msi.c
++++ b/drivers/pci/controller/pcie-iproc-msi.c
+@@ -209,15 +209,20 @@ static int iproc_msi_irq_set_affinity(struct irq_data *data,
+ struct iproc_msi *msi = irq_data_get_irq_chip_data(data);
+ int target_cpu = cpumask_first(mask);
+ int curr_cpu;
++ int ret;
+
+ curr_cpu = hwirq_to_cpu(msi, data->hwirq);
+ if (curr_cpu == target_cpu)
+- return IRQ_SET_MASK_OK_DONE;
++ ret = IRQ_SET_MASK_OK_DONE;
++ else {
++ /* steer MSI to the target CPU */
++ data->hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq) + target_cpu;
++ ret = IRQ_SET_MASK_OK;
++ }
+
+- /* steer MSI to the target CPU */
+- data->hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq) + target_cpu;
++ irq_data_update_effective_affinity(data, cpumask_of(target_cpu));
+
+- return IRQ_SET_MASK_OK;
++ return ret;
+ }
+
+ static void iproc_msi_irq_compose_msi_msg(struct irq_data *data,
+diff --git a/drivers/pwm/pwm-img.c b/drivers/pwm/pwm-img.c
+index da72b2866e88e..3b0a097ce2abd 100644
+--- a/drivers/pwm/pwm-img.c
++++ b/drivers/pwm/pwm-img.c
+@@ -280,6 +280,8 @@ static int img_pwm_probe(struct platform_device *pdev)
+ return PTR_ERR(pwm->pwm_clk);
+ }
+
++ platform_set_drvdata(pdev, pwm);
++
+ pm_runtime_set_autosuspend_delay(&pdev->dev, IMG_PWM_PM_TIMEOUT);
+ pm_runtime_use_autosuspend(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
+@@ -316,7 +318,6 @@ static int img_pwm_probe(struct platform_device *pdev)
+ goto err_suspend;
+ }
+
+- platform_set_drvdata(pdev, pwm);
+ return 0;
+
+ err_suspend:
+diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
+index f36a8a5261a13..a136a7ae77140 100644
+--- a/drivers/rapidio/devices/rio_mport_cdev.c
++++ b/drivers/rapidio/devices/rio_mport_cdev.c
+@@ -875,15 +875,16 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
+ rmcd_error("get_user_pages_unlocked err=%ld",
+ pinned);
+ nr_pages = 0;
+- } else
++ } else {
+ rmcd_error("pinned %ld out of %ld pages",
+ pinned, nr_pages);
++ /*
++ * Set nr_pages up to mean "how many pages to unpin, in
++ * the error handler:
++ */
++ nr_pages = pinned;
++ }
+ ret = -EFAULT;
+- /*
+- * Set nr_pages up to mean "how many pages to unpin, in
+- * the error handler:
+- */
+- nr_pages = pinned;
+ goto err_pg;
+ }
+
+@@ -1684,6 +1685,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
+ struct rio_dev *rdev;
+ struct rio_switch *rswitch = NULL;
+ struct rio_mport *mport;
++ struct device *dev;
+ size_t size;
+ u32 rval;
+ u32 swpinfo = 0;
+@@ -1698,8 +1700,10 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
+ rmcd_debug(RDEV, "name:%s ct:0x%x did:0x%x hc:0x%x", dev_info.name,
+ dev_info.comptag, dev_info.destid, dev_info.hopcount);
+
+- if (bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name)) {
++ dev = bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name);
++ if (dev) {
+ rmcd_debug(RDEV, "device %s already exists", dev_info.name);
++ put_device(dev);
+ return -EEXIST;
+ }
+
+diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
+index b2e5a6abf7d5c..aa008fa11002e 100644
+--- a/drivers/rpmsg/qcom_smd.c
++++ b/drivers/rpmsg/qcom_smd.c
+@@ -1338,7 +1338,7 @@ static int qcom_smd_parse_edge(struct device *dev,
+ ret = of_property_read_u32(node, key, &edge->edge_id);
+ if (ret) {
+ dev_err(dev, "edge missing %s property\n", key);
+- return -EINVAL;
++ goto put_node;
+ }
+
+ edge->remote_pid = QCOM_SMEM_HOST_ANY;
+@@ -1349,32 +1349,37 @@ static int qcom_smd_parse_edge(struct device *dev,
+ edge->mbox_client.knows_txdone = true;
+ edge->mbox_chan = mbox_request_channel(&edge->mbox_client, 0);
+ if (IS_ERR(edge->mbox_chan)) {
+- if (PTR_ERR(edge->mbox_chan) != -ENODEV)
+- return PTR_ERR(edge->mbox_chan);
++ if (PTR_ERR(edge->mbox_chan) != -ENODEV) {
++ ret = PTR_ERR(edge->mbox_chan);
++ goto put_node;
++ }
+
+ edge->mbox_chan = NULL;
+
+ syscon_np = of_parse_phandle(node, "qcom,ipc", 0);
+ if (!syscon_np) {
+ dev_err(dev, "no qcom,ipc node\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto put_node;
+ }
+
+ edge->ipc_regmap = syscon_node_to_regmap(syscon_np);
+- if (IS_ERR(edge->ipc_regmap))
+- return PTR_ERR(edge->ipc_regmap);
++ if (IS_ERR(edge->ipc_regmap)) {
++ ret = PTR_ERR(edge->ipc_regmap);
++ goto put_node;
++ }
+
+ key = "qcom,ipc";
+ ret = of_property_read_u32_index(node, key, 1, &edge->ipc_offset);
+ if (ret < 0) {
+ dev_err(dev, "no offset in %s\n", key);
+- return -EINVAL;
++ goto put_node;
+ }
+
+ ret = of_property_read_u32_index(node, key, 2, &edge->ipc_bit);
+ if (ret < 0) {
+ dev_err(dev, "no bit in %s\n", key);
+- return -EINVAL;
++ goto put_node;
+ }
+ }
+
+@@ -1385,7 +1390,8 @@ static int qcom_smd_parse_edge(struct device *dev,
+ irq = irq_of_parse_and_map(node, 0);
+ if (irq < 0) {
+ dev_err(dev, "required smd interrupt missing\n");
+- return -EINVAL;
++ ret = irq;
++ goto put_node;
+ }
+
+ ret = devm_request_irq(dev, irq,
+@@ -1393,12 +1399,18 @@ static int qcom_smd_parse_edge(struct device *dev,
+ node->name, edge);
+ if (ret) {
+ dev_err(dev, "failed to request smd irq\n");
+- return ret;
++ goto put_node;
+ }
+
+ edge->irq = irq;
+
+ return 0;
++
++put_node:
++ of_node_put(node);
++ edge->of_node = NULL;
++
++ return ret;
+ }
+
+ /*
+diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
+index 71d53bb239e25..090ab377f65e5 100644
+--- a/drivers/scsi/ibmvscsi/ibmvfc.c
++++ b/drivers/scsi/ibmvscsi/ibmvfc.c
+@@ -4795,6 +4795,7 @@ static int ibmvfc_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+ if (IS_ERR(vhost->work_thread)) {
+ dev_err(dev, "Couldn't create kernel thread: %ld\n",
+ PTR_ERR(vhost->work_thread));
++ rc = PTR_ERR(vhost->work_thread);
+ goto free_host_mem;
+ }
+
+diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
+index b3cd9a6b1d306..b3df114a1200f 100644
+--- a/drivers/scsi/mvumi.c
++++ b/drivers/scsi/mvumi.c
+@@ -2439,6 +2439,7 @@ static int mvumi_io_attach(struct mvumi_hba *mhba)
+ if (IS_ERR(mhba->dm_thread)) {
+ dev_err(&mhba->pdev->dev,
+ "failed to create device scan thread\n");
++ ret = PTR_ERR(mhba->dm_thread);
+ mutex_unlock(&mhba->sas_discovery_mutex);
+ goto fail_create_thread;
+ }
+diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
+index 25d763ae5d5a6..357a0acc5ed2f 100644
+--- a/drivers/scsi/qedi/qedi_fw.c
++++ b/drivers/scsi/qedi/qedi_fw.c
+@@ -62,6 +62,7 @@ static void qedi_process_logout_resp(struct qedi_ctx *qedi,
+ "Freeing tid=0x%x for cid=0x%x\n",
+ cmd->task_id, qedi_conn->iscsi_conn_id);
+
++ spin_lock(&qedi_conn->list_lock);
+ if (likely(cmd->io_cmd_in_list)) {
+ cmd->io_cmd_in_list = false;
+ list_del_init(&cmd->io_cmd);
+@@ -72,6 +73,7 @@ static void qedi_process_logout_resp(struct qedi_ctx *qedi,
+ cmd->task_id, qedi_conn->iscsi_conn_id,
+ &cmd->io_cmd);
+ }
++ spin_unlock(&qedi_conn->list_lock);
+
+ cmd->state = RESPONSE_RECEIVED;
+ qedi_clear_task_idx(qedi, cmd->task_id);
+@@ -125,6 +127,7 @@ static void qedi_process_text_resp(struct qedi_ctx *qedi,
+ "Freeing tid=0x%x for cid=0x%x\n",
+ cmd->task_id, qedi_conn->iscsi_conn_id);
+
++ spin_lock(&qedi_conn->list_lock);
+ if (likely(cmd->io_cmd_in_list)) {
+ cmd->io_cmd_in_list = false;
+ list_del_init(&cmd->io_cmd);
+@@ -135,6 +138,7 @@ static void qedi_process_text_resp(struct qedi_ctx *qedi,
+ cmd->task_id, qedi_conn->iscsi_conn_id,
+ &cmd->io_cmd);
+ }
++ spin_unlock(&qedi_conn->list_lock);
+
+ cmd->state = RESPONSE_RECEIVED;
+ qedi_clear_task_idx(qedi, cmd->task_id);
+@@ -227,11 +231,13 @@ static void qedi_process_tmf_resp(struct qedi_ctx *qedi,
+
+ tmf_hdr = (struct iscsi_tm *)qedi_cmd->task->hdr;
+
++ spin_lock(&qedi_conn->list_lock);
+ if (likely(qedi_cmd->io_cmd_in_list)) {
+ qedi_cmd->io_cmd_in_list = false;
+ list_del_init(&qedi_cmd->io_cmd);
+ qedi_conn->active_cmd_count--;
+ }
++ spin_unlock(&qedi_conn->list_lock);
+
+ if (((tmf_hdr->flags & ISCSI_FLAG_TM_FUNC_MASK) ==
+ ISCSI_TM_FUNC_LOGICAL_UNIT_RESET) ||
+@@ -293,11 +299,13 @@ static void qedi_process_login_resp(struct qedi_ctx *qedi,
+ ISCSI_LOGIN_RESPONSE_HDR_DATA_SEG_LEN_MASK;
+ qedi_conn->gen_pdu.resp_wr_ptr = qedi_conn->gen_pdu.resp_buf + pld_len;
+
++ spin_lock(&qedi_conn->list_lock);
+ if (likely(cmd->io_cmd_in_list)) {
+ cmd->io_cmd_in_list = false;
+ list_del_init(&cmd->io_cmd);
+ qedi_conn->active_cmd_count--;
+ }
++ spin_unlock(&qedi_conn->list_lock);
+
+ memset(task_ctx, '\0', sizeof(*task_ctx));
+
+@@ -829,8 +837,11 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi,
+ qedi_clear_task_idx(qedi_conn->qedi, rtid);
+
+ spin_lock(&qedi_conn->list_lock);
+- list_del_init(&dbg_cmd->io_cmd);
+- qedi_conn->active_cmd_count--;
++ if (likely(dbg_cmd->io_cmd_in_list)) {
++ dbg_cmd->io_cmd_in_list = false;
++ list_del_init(&dbg_cmd->io_cmd);
++ qedi_conn->active_cmd_count--;
++ }
+ spin_unlock(&qedi_conn->list_lock);
+ qedi_cmd->state = CLEANUP_RECV;
+ wake_up_interruptible(&qedi_conn->wait_queue);
+@@ -1249,6 +1260,7 @@ int qedi_cleanup_all_io(struct qedi_ctx *qedi, struct qedi_conn *qedi_conn,
+ qedi_conn->cmd_cleanup_req++;
+ qedi_iscsi_cleanup_task(ctask, true);
+
++ cmd->io_cmd_in_list = false;
+ list_del_init(&cmd->io_cmd);
+ qedi_conn->active_cmd_count--;
+ QEDI_WARN(&qedi->dbg_ctx,
+@@ -1462,8 +1474,11 @@ ldel_exit:
+ spin_unlock_bh(&qedi_conn->tmf_work_lock);
+
+ spin_lock(&qedi_conn->list_lock);
+- list_del_init(&cmd->io_cmd);
+- qedi_conn->active_cmd_count--;
++ if (likely(cmd->io_cmd_in_list)) {
++ cmd->io_cmd_in_list = false;
++ list_del_init(&cmd->io_cmd);
++ qedi_conn->active_cmd_count--;
++ }
+ spin_unlock(&qedi_conn->list_lock);
+
+ clear_bit(QEDI_CONN_FW_CLEANUP, &qedi_conn->flags);
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index aa451c8b49e56..4e8c5fcbded6a 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -976,11 +976,13 @@ static void qedi_cleanup_active_cmd_list(struct qedi_conn *qedi_conn)
+ {
+ struct qedi_cmd *cmd, *cmd_tmp;
+
++ spin_lock(&qedi_conn->list_lock);
+ list_for_each_entry_safe(cmd, cmd_tmp, &qedi_conn->active_cmd_list,
+ io_cmd) {
+ list_del_init(&cmd->io_cmd);
+ qedi_conn->active_cmd_count--;
+ }
++ spin_unlock(&qedi_conn->list_lock);
+ }
+
+ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
+diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c
+index 21e3ff590ec91..798a74535ea7b 100644
+--- a/drivers/scsi/ufs/ufs-qcom.c
++++ b/drivers/scsi/ufs/ufs-qcom.c
+@@ -1581,9 +1581,6 @@ int ufs_qcom_testbus_config(struct ufs_qcom_host *host)
+ */
+ }
+ mask <<= offset;
+-
+- pm_runtime_get_sync(host->hba->dev);
+- ufshcd_hold(host->hba, false);
+ ufshcd_rmwl(host->hba, TEST_BUS_SEL,
+ (u32)host->testbus.select_major << 19,
+ REG_UFS_CFG1);
+@@ -1596,8 +1593,6 @@ int ufs_qcom_testbus_config(struct ufs_qcom_host *host)
+ * committed before returning.
+ */
+ mb();
+- ufshcd_release(host->hba);
+- pm_runtime_put_sync(host->hba->dev);
+
+ return 0;
+ }
+diff --git a/drivers/tty/ipwireless/network.c b/drivers/tty/ipwireless/network.c
+index cf20616340a1a..fe569f6294a24 100644
+--- a/drivers/tty/ipwireless/network.c
++++ b/drivers/tty/ipwireless/network.c
+@@ -117,7 +117,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel,
+ skb->len,
+ notify_packet_sent,
+ network);
+- if (ret == -1) {
++ if (ret < 0) {
+ skb_pull(skb, 2);
+ return 0;
+ }
+@@ -134,7 +134,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel,
+ notify_packet_sent,
+ network);
+ kfree(buf);
+- if (ret == -1)
++ if (ret < 0)
+ return 0;
+ }
+ kfree_skb(skb);
+diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
+index 1ef751c27ac6d..cb04971843306 100644
+--- a/drivers/tty/ipwireless/tty.c
++++ b/drivers/tty/ipwireless/tty.c
+@@ -218,7 +218,7 @@ static int ipw_write(struct tty_struct *linux_tty,
+ ret = ipwireless_send_packet(tty->hardware, IPW_CHANNEL_RAS,
+ buf, count,
+ ipw_write_packet_sent_callback, tty);
+- if (ret == -1) {
++ if (ret < 0) {
+ mutex_unlock(&tty->ipw_tty_mutex);
+ return 0;
+ }
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 2daccb10ae2f3..4b9f422694779 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -563,7 +563,7 @@ static void lpuart32_poll_put_char(struct uart_port *port, unsigned char c)
+
+ static int lpuart32_poll_get_char(struct uart_port *port)
+ {
+- if (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_RDRF))
++ if (!(lpuart32_read(port, UARTWATER) >> UARTWATER_RXCNT_OFF))
+ return NO_POLL_CHAR;
+
+ return lpuart32_read(port, UARTDATA);
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 41453bf6fc0bd..7376f74a4f049 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1275,9 +1275,21 @@ static int acm_probe(struct usb_interface *intf,
+ }
+ }
+ } else {
++ int class = -1;
++
+ data_intf_num = union_header->bSlaveInterface0;
+ control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0);
+ data_interface = usb_ifnum_to_if(usb_dev, data_intf_num);
++
++ if (control_interface)
++ class = control_interface->cur_altsetting->desc.bInterfaceClass;
++
++ if (class != USB_CLASS_COMM && class != USB_CLASS_CDC_DATA) {
++ dev_dbg(&intf->dev, "Broken union descriptor, assuming single interface\n");
++ combined_interfaces = 1;
++ control_interface = data_interface = intf;
++ goto look_for_collapsed_interface;
++ }
+ }
+
+ if (!control_interface || !data_interface) {
+@@ -1932,6 +1944,17 @@ static const struct usb_device_id acm_ids[] = {
+ .driver_info = IGNORE_DEVICE,
+ },
+
++ /* Exclude ETAS ES58x */
++ { USB_DEVICE(0x108c, 0x0159), /* ES581.4 */
++ .driver_info = IGNORE_DEVICE,
++ },
++ { USB_DEVICE(0x108c, 0x0168), /* ES582.1 */
++ .driver_info = IGNORE_DEVICE,
++ },
++ { USB_DEVICE(0x108c, 0x0169), /* ES584.1 */
++ .driver_info = IGNORE_DEVICE,
++ },
++
+ { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */
+ .driver_info = SEND_ZERO_PACKET,
+ },
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 4929c58830688..55ad4c43b3804 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -58,6 +58,9 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
+
+ #define WDM_MAX 16
+
++/* we cannot wait forever at flush() */
++#define WDM_FLUSH_TIMEOUT (30 * HZ)
++
+ /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */
+ #define WDM_DEFAULT_BUFSIZE 256
+
+@@ -151,7 +154,7 @@ static void wdm_out_callback(struct urb *urb)
+ kfree(desc->outbuf);
+ desc->outbuf = NULL;
+ clear_bit(WDM_IN_USE, &desc->flags);
+- wake_up(&desc->wait);
++ wake_up_all(&desc->wait);
+ }
+
+ static void wdm_in_callback(struct urb *urb)
+@@ -393,6 +396,9 @@ static ssize_t wdm_write
+ if (test_bit(WDM_RESETTING, &desc->flags))
+ r = -EIO;
+
++ if (test_bit(WDM_DISCONNECTING, &desc->flags))
++ r = -ENODEV;
++
+ if (r < 0) {
+ rv = r;
+ goto out_free_mem_pm;
+@@ -424,6 +430,7 @@ static ssize_t wdm_write
+ if (rv < 0) {
+ desc->outbuf = NULL;
+ clear_bit(WDM_IN_USE, &desc->flags);
++ wake_up_all(&desc->wait); /* for wdm_wait_for_response() */
+ dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
+ rv = usb_translate_errors(rv);
+ goto out_free_mem_pm;
+@@ -583,28 +590,58 @@ err:
+ return rv;
+ }
+
+-static int wdm_flush(struct file *file, fl_owner_t id)
++static int wdm_wait_for_response(struct file *file, long timeout)
+ {
+ struct wdm_device *desc = file->private_data;
++ long rv; /* Use long here because (int) MAX_SCHEDULE_TIMEOUT < 0. */
++
++ /*
++ * Needs both flags. We cannot do with one because resetting it would
++ * cause a race with write() yet we need to signal a disconnect.
++ */
++ rv = wait_event_interruptible_timeout(desc->wait,
++ !test_bit(WDM_IN_USE, &desc->flags) ||
++ test_bit(WDM_DISCONNECTING, &desc->flags),
++ timeout);
+
+- wait_event(desc->wait,
+- /*
+- * needs both flags. We cannot do with one
+- * because resetting it would cause a race
+- * with write() yet we need to signal
+- * a disconnect
+- */
+- !test_bit(WDM_IN_USE, &desc->flags) ||
+- test_bit(WDM_DISCONNECTING, &desc->flags));
+-
+- /* cannot dereference desc->intf if WDM_DISCONNECTING */
++ /*
++ * To report the correct error. This is best effort.
++ * We are inevitably racing with the hardware.
++ */
+ if (test_bit(WDM_DISCONNECTING, &desc->flags))
+ return -ENODEV;
+- if (desc->werr < 0)
+- dev_err(&desc->intf->dev, "Error in flush path: %d\n",
+- desc->werr);
++ if (!rv)
++ return -EIO;
++ if (rv < 0)
++ return -EINTR;
++
++ spin_lock_irq(&desc->iuspin);
++ rv = desc->werr;
++ desc->werr = 0;
++ spin_unlock_irq(&desc->iuspin);
++
++ return usb_translate_errors(rv);
++
++}
++
++/*
++ * You need to send a signal when you react to malicious or defective hardware.
++ * Also, don't abort when fsync() returned -EINVAL, for older kernels which do
++ * not implement wdm_flush() will return -EINVAL.
++ */
++static int wdm_fsync(struct file *file, loff_t start, loff_t end, int datasync)
++{
++ return wdm_wait_for_response(file, MAX_SCHEDULE_TIMEOUT);
++}
+
+- return usb_translate_errors(desc->werr);
++/*
++ * Same with wdm_fsync(), except it uses finite timeout in order to react to
++ * malicious or defective hardware which ceased communication after close() was
++ * implicitly called due to process termination.
++ */
++static int wdm_flush(struct file *file, fl_owner_t id)
++{
++ return wdm_wait_for_response(file, WDM_FLUSH_TIMEOUT);
+ }
+
+ static __poll_t wdm_poll(struct file *file, struct poll_table_struct *wait)
+@@ -729,6 +766,7 @@ static const struct file_operations wdm_fops = {
+ .owner = THIS_MODULE,
+ .read = wdm_read,
+ .write = wdm_write,
++ .fsync = wdm_fsync,
+ .open = wdm_open,
+ .flush = wdm_flush,
+ .release = wdm_release,
+diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
+index 5e844097a9e30..3cd7732c086e0 100644
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -773,11 +773,12 @@ void usb_block_urb(struct urb *urb)
+ EXPORT_SYMBOL_GPL(usb_block_urb);
+
+ /**
+- * usb_kill_anchored_urbs - cancel transfer requests en masse
++ * usb_kill_anchored_urbs - kill all URBs associated with an anchor
+ * @anchor: anchor the requests are bound to
+ *
+- * this allows all outstanding URBs to be killed starting
+- * from the back of the queue
++ * This kills all outstanding URBs starting from the back of the queue,
++ * with guarantee that no completer callbacks will take place from the
++ * anchor after this function returns.
+ *
+ * This routine should not be called by a driver after its disconnect
+ * method has returned.
+@@ -785,20 +786,26 @@ EXPORT_SYMBOL_GPL(usb_block_urb);
+ void usb_kill_anchored_urbs(struct usb_anchor *anchor)
+ {
+ struct urb *victim;
++ int surely_empty;
+
+- spin_lock_irq(&anchor->lock);
+- while (!list_empty(&anchor->urb_list)) {
+- victim = list_entry(anchor->urb_list.prev, struct urb,
+- anchor_list);
+- /* we must make sure the URB isn't freed before we kill it*/
+- usb_get_urb(victim);
+- spin_unlock_irq(&anchor->lock);
+- /* this will unanchor the URB */
+- usb_kill_urb(victim);
+- usb_put_urb(victim);
++ do {
+ spin_lock_irq(&anchor->lock);
+- }
+- spin_unlock_irq(&anchor->lock);
++ while (!list_empty(&anchor->urb_list)) {
++ victim = list_entry(anchor->urb_list.prev,
++ struct urb, anchor_list);
++ /* make sure the URB isn't freed before we kill it */
++ usb_get_urb(victim);
++ spin_unlock_irq(&anchor->lock);
++ /* this will unanchor the URB */
++ usb_kill_urb(victim);
++ usb_put_urb(victim);
++ spin_lock_irq(&anchor->lock);
++ }
++ surely_empty = usb_anchor_check_wakeup(anchor);
++
++ spin_unlock_irq(&anchor->lock);
++ cpu_relax();
++ } while (!surely_empty);
+ }
+ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);
+
+@@ -817,21 +824,27 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);
+ void usb_poison_anchored_urbs(struct usb_anchor *anchor)
+ {
+ struct urb *victim;
++ int surely_empty;
+
+- spin_lock_irq(&anchor->lock);
+- anchor->poisoned = 1;
+- while (!list_empty(&anchor->urb_list)) {
+- victim = list_entry(anchor->urb_list.prev, struct urb,
+- anchor_list);
+- /* we must make sure the URB isn't freed before we kill it*/
+- usb_get_urb(victim);
+- spin_unlock_irq(&anchor->lock);
+- /* this will unanchor the URB */
+- usb_poison_urb(victim);
+- usb_put_urb(victim);
++ do {
+ spin_lock_irq(&anchor->lock);
+- }
+- spin_unlock_irq(&anchor->lock);
++ anchor->poisoned = 1;
++ while (!list_empty(&anchor->urb_list)) {
++ victim = list_entry(anchor->urb_list.prev,
++ struct urb, anchor_list);
++ /* make sure the URB isn't freed before we kill it */
++ usb_get_urb(victim);
++ spin_unlock_irq(&anchor->lock);
++ /* this will unanchor the URB */
++ usb_poison_urb(victim);
++ usb_put_urb(victim);
++ spin_lock_irq(&anchor->lock);
++ }
++ surely_empty = usb_anchor_check_wakeup(anchor);
++
++ spin_unlock_irq(&anchor->lock);
++ cpu_relax();
++ } while (!surely_empty);
+ }
+ EXPORT_SYMBOL_GPL(usb_poison_anchored_urbs);
+
+@@ -971,14 +984,20 @@ void usb_scuttle_anchored_urbs(struct usb_anchor *anchor)
+ {
+ struct urb *victim;
+ unsigned long flags;
++ int surely_empty;
++
++ do {
++ spin_lock_irqsave(&anchor->lock, flags);
++ while (!list_empty(&anchor->urb_list)) {
++ victim = list_entry(anchor->urb_list.prev,
++ struct urb, anchor_list);
++ __usb_unanchor_urb(victim, anchor);
++ }
++ surely_empty = usb_anchor_check_wakeup(anchor);
+
+- spin_lock_irqsave(&anchor->lock, flags);
+- while (!list_empty(&anchor->urb_list)) {
+- victim = list_entry(anchor->urb_list.prev, struct urb,
+- anchor_list);
+- __usb_unanchor_urb(victim, anchor);
+- }
+- spin_unlock_irqrestore(&anchor->lock, flags);
++ spin_unlock_irqrestore(&anchor->lock, flags);
++ cpu_relax();
++ } while (!surely_empty);
+ }
+
+ EXPORT_SYMBOL_GPL(usb_scuttle_anchored_urbs);
+diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
+index 4c2771c5e7276..1ef89a4317c87 100644
+--- a/drivers/usb/dwc3/dwc3-of-simple.c
++++ b/drivers/usb/dwc3/dwc3-of-simple.c
+@@ -243,6 +243,7 @@ static const struct of_device_id of_dwc3_simple_match[] = {
+ { .compatible = "amlogic,meson-axg-dwc3" },
+ { .compatible = "amlogic,meson-gxl-dwc3" },
+ { .compatible = "allwinner,sun50i-h6-dwc3" },
++ { .compatible = "hisilicon,hi3670-dwc3" },
+ { /* Sentinel */ }
+ };
+ MODULE_DEVICE_TABLE(of, of_dwc3_simple_match);
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index 09bc917d407d4..e4aa370e86a9e 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1523,7 +1523,7 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ fs_ncm_notify_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, ncm_fs_function, ncm_hs_function,
+- ncm_ss_function, NULL);
++ ncm_ss_function, ncm_ss_function);
+ if (status)
+ goto fail;
+
+diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
+index 9c7ed2539ff77..8ed1295d7e350 100644
+--- a/drivers/usb/gadget/function/f_printer.c
++++ b/drivers/usb/gadget/function/f_printer.c
+@@ -31,6 +31,7 @@
+ #include <linux/types.h>
+ #include <linux/ctype.h>
+ #include <linux/cdev.h>
++#include <linux/kref.h>
+
+ #include <asm/byteorder.h>
+ #include <linux/io.h>
+@@ -64,7 +65,7 @@ struct printer_dev {
+ struct usb_gadget *gadget;
+ s8 interface;
+ struct usb_ep *in_ep, *out_ep;
+-
++ struct kref kref;
+ struct list_head rx_reqs; /* List of free RX structs */
+ struct list_head rx_reqs_active; /* List of Active RX xfers */
+ struct list_head rx_buffers; /* List of completed xfers */
+@@ -218,6 +219,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget,
+
+ /*-------------------------------------------------------------------------*/
+
++static void printer_dev_free(struct kref *kref)
++{
++ struct printer_dev *dev = container_of(kref, struct printer_dev, kref);
++
++ kfree(dev);
++}
++
+ static struct usb_request *
+ printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags)
+ {
+@@ -348,6 +356,7 @@ printer_open(struct inode *inode, struct file *fd)
+
+ spin_unlock_irqrestore(&dev->lock, flags);
+
++ kref_get(&dev->kref);
+ DBG(dev, "printer_open returned %x\n", ret);
+ return ret;
+ }
+@@ -365,6 +374,7 @@ printer_close(struct inode *inode, struct file *fd)
+ dev->printer_status &= ~PRINTER_SELECTED;
+ spin_unlock_irqrestore(&dev->lock, flags);
+
++ kref_put(&dev->kref, printer_dev_free);
+ DBG(dev, "printer_close\n");
+
+ return 0;
+@@ -1350,7 +1360,8 @@ static void gprinter_free(struct usb_function *f)
+ struct f_printer_opts *opts;
+
+ opts = container_of(f->fi, struct f_printer_opts, func_inst);
+- kfree(dev);
++
++ kref_put(&dev->kref, printer_dev_free);
+ mutex_lock(&opts->lock);
+ --opts->refcnt;
+ mutex_unlock(&opts->lock);
+@@ -1419,6 +1430,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)
+ return ERR_PTR(-ENOMEM);
+ }
+
++ kref_init(&dev->kref);
+ ++opts->refcnt;
+ dev->minor = opts->minor;
+ dev->pnp_string = opts->pnp_string;
+diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
+index af11887f5f9e4..e88486d8084af 100644
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -665,20 +665,24 @@ retry:
+
+ /* handle root hub init quirks ... */
+ val = roothub_a (ohci);
+- val &= ~(RH_A_PSM | RH_A_OCPM);
++ /* Configure for per-port over-current protection by default */
++ val &= ~RH_A_NOCP;
++ val |= RH_A_OCPM;
+ if (ohci->flags & OHCI_QUIRK_SUPERIO) {
+- /* NSC 87560 and maybe others */
++ /* NSC 87560 and maybe others.
++ * Ganged power switching, no over-current protection.
++ */
+ val |= RH_A_NOCP;
+- val &= ~(RH_A_POTPGT | RH_A_NPS);
+- ohci_writel (ohci, val, &ohci->regs->roothub.a);
++ val &= ~(RH_A_POTPGT | RH_A_NPS | RH_A_PSM | RH_A_OCPM);
+ } else if ((ohci->flags & OHCI_QUIRK_AMD756) ||
+ (ohci->flags & OHCI_QUIRK_HUB_POWER)) {
+ /* hub power always on; required for AMD-756 and some
+- * Mac platforms. ganged overcurrent reporting, if any.
++ * Mac platforms.
+ */
+ val |= RH_A_NPS;
+- ohci_writel (ohci, val, &ohci->regs->roothub.a);
+ }
++ ohci_writel(ohci, val, &ohci->regs->roothub.a);
++
+ ohci_writel (ohci, RH_HS_LPSC, &ohci->regs->roothub.status);
+ ohci_writel (ohci, (val & RH_A_NPS) ? 0 : RH_B_PPCM,
+ &ohci->regs->roothub.b);
+diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
+index bdfdd506bc588..c989f777bf771 100644
+--- a/drivers/vfio/pci/vfio_pci_intrs.c
++++ b/drivers/vfio/pci/vfio_pci_intrs.c
+@@ -355,11 +355,13 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,
+ vdev->ctx[vector].producer.token = trigger;
+ vdev->ctx[vector].producer.irq = irq;
+ ret = irq_bypass_register_producer(&vdev->ctx[vector].producer);
+- if (unlikely(ret))
++ if (unlikely(ret)) {
+ dev_info(&pdev->dev,
+ "irq bypass producer (token %p) registration fails: %d\n",
+ vdev->ctx[vector].producer.token, ret);
+
++ vdev->ctx[vector].producer.token = NULL;
++ }
+ vdev->ctx[vector].trigger = trigger;
+
+ return 0;
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index 05d8553635ee7..95ce167a8ad92 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -636,7 +636,8 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
+
+ ret = vfio_add_to_pfn_list(dma, iova, phys_pfn[i]);
+ if (ret) {
+- vfio_unpin_page_external(dma, iova, do_accounting);
++ if (put_pfn(phys_pfn[i], dma->prot) && do_accounting)
++ vfio_lock_acct(dma, -1, true);
+ goto pin_unwind;
+ }
+ }
+diff --git a/drivers/watchdog/sp5100_tco.h b/drivers/watchdog/sp5100_tco.h
+index 87eaf357ae01f..adf015aa4126f 100644
+--- a/drivers/watchdog/sp5100_tco.h
++++ b/drivers/watchdog/sp5100_tco.h
+@@ -70,7 +70,7 @@
+ #define EFCH_PM_DECODEEN_WDT_TMREN BIT(7)
+
+
+-#define EFCH_PM_DECODEEN3 0x00
++#define EFCH_PM_DECODEEN3 0x03
+ #define EFCH_PM_DECODEEN_SECOND_RES GENMASK(1, 0)
+ #define EFCH_PM_WATCHDOG_DISABLE ((u8)GENMASK(3, 2))
+
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index 1c322caecf7f1..8fe59b7d8eec8 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -944,8 +944,10 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ wd_data->wdd = wdd;
+ wdd->wd_data = wd_data;
+
+- if (IS_ERR_OR_NULL(watchdog_kworker))
++ if (IS_ERR_OR_NULL(watchdog_kworker)) {
++ kfree(wd_data);
+ return -ENODEV;
++ }
+
+ device_initialize(&wd_data->dev);
+ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
+@@ -971,7 +973,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ pr_err("%s: a legacy watchdog module is probably present.\n",
+ wdd->info->identity);
+ old_wd_data = NULL;
+- kfree(wd_data);
++ put_device(&wd_data->dev);
+ return err;
+ }
+ }
+diff --git a/fs/dlm/config.c b/fs/dlm/config.c
+index 1270551d24e38..f13d865244501 100644
+--- a/fs/dlm/config.c
++++ b/fs/dlm/config.c
+@@ -218,6 +218,7 @@ struct dlm_space {
+ struct list_head members;
+ struct mutex members_lock;
+ int members_count;
++ struct dlm_nodes *nds;
+ };
+
+ struct dlm_comms {
+@@ -426,6 +427,7 @@ static struct config_group *make_space(struct config_group *g, const char *name)
+ INIT_LIST_HEAD(&sp->members);
+ mutex_init(&sp->members_lock);
+ sp->members_count = 0;
++ sp->nds = nds;
+ return &sp->group;
+
+ fail:
+@@ -447,6 +449,7 @@ static void drop_space(struct config_group *g, struct config_item *i)
+ static void release_space(struct config_item *i)
+ {
+ struct dlm_space *sp = config_item_to_space(i);
++ kfree(sp->nds);
+ kfree(sp);
+ }
+
+diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c
+index 4b99e2db95b8b..6f3f245f3a803 100644
+--- a/fs/ext4/fsmap.c
++++ b/fs/ext4/fsmap.c
+@@ -108,6 +108,9 @@ static int ext4_getfsmap_helper(struct super_block *sb,
+
+ /* Are we just counting mappings? */
+ if (info->gfi_head->fmh_count == 0) {
++ if (info->gfi_head->fmh_entries == UINT_MAX)
++ return EXT4_QUERY_RANGE_ABORT;
++
+ if (rec_fsblk > info->gfi_next_fsblk)
+ info->gfi_head->fmh_entries++;
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index 9a59f49ba4050..89b6c33ba6a42 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -717,4 +717,5 @@ void f2fs_unregister_sysfs(struct f2fs_sb_info *sbi)
+ }
+ kobject_del(&sbi->s_kobj);
+ kobject_put(&sbi->s_kobj);
++ wait_for_completion(&sbi->s_kobj_unregister);
+ }
+diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
+index bd3221cbdd956..0d4b5b9843b62 100644
+--- a/fs/ntfs/inode.c
++++ b/fs/ntfs/inode.c
+@@ -1835,6 +1835,12 @@ int ntfs_read_inode_mount(struct inode *vi)
+ brelse(bh);
+ }
+
++ if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) {
++ ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.",
++ le32_to_cpu(m->bytes_allocated), vol->mft_record_size);
++ goto err_out;
++ }
++
+ /* Apply the mst fixups. */
+ if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) {
+ /* FIXME: Try to use the $MFTMirr now. */
+diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
+index 3ac1f23870837..5e1ebbe639ebf 100644
+--- a/fs/ramfs/file-nommu.c
++++ b/fs/ramfs/file-nommu.c
+@@ -228,7 +228,7 @@ static unsigned long ramfs_nommu_get_unmapped_area(struct file *file,
+ if (!pages)
+ goto out_free;
+
+- nr = find_get_pages(inode->i_mapping, &pgoff, lpages, pages);
++ nr = find_get_pages_contig(inode->i_mapping, pgoff, lpages, pages);
+ if (nr != lpages)
+ goto out_free_pages; /* leave if some pages were missing */
+
+diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
+index 70387650436cf..ac35ddf0dd603 100644
+--- a/fs/reiserfs/inode.c
++++ b/fs/reiserfs/inode.c
+@@ -2161,7 +2161,8 @@ out_end_trans:
+ out_inserted_sd:
+ clear_nlink(inode);
+ th->t_trans_id = 0; /* so the caller can't use this handle later */
+- unlock_new_inode(inode); /* OK to do even if we hadn't locked it */
++ if (inode->i_state & I_NEW)
++ unlock_new_inode(inode);
+ iput(inode);
+ return err;
+ }
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index de5eda33c92a0..ec5716dd58c23 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -1264,6 +1264,10 @@ static int reiserfs_parse_options(struct super_block *s,
+ "turned on.");
+ return 0;
+ }
++ if (qf_names[qtype] !=
++ REISERFS_SB(s)->s_qf_names[qtype])
++ kfree(qf_names[qtype]);
++ qf_names[qtype] = NULL;
+ if (*arg) { /* Some filename specified? */
+ if (REISERFS_SB(s)->s_qf_names[qtype]
+ && strcmp(REISERFS_SB(s)->s_qf_names[qtype],
+@@ -1293,10 +1297,6 @@ static int reiserfs_parse_options(struct super_block *s,
+ else
+ *mount_options |= 1 << REISERFS_GRPQUOTA;
+ } else {
+- if (qf_names[qtype] !=
+- REISERFS_SB(s)->s_qf_names[qtype])
+- kfree(qf_names[qtype]);
+- qf_names[qtype] = NULL;
+ if (qtype == USRQUOTA)
+ *mount_options &= ~(1 << REISERFS_USRQUOTA);
+ else
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 4c46ebf0e773b..3bf89a6338367 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -132,21 +132,24 @@ void udf_evict_inode(struct inode *inode)
+ struct udf_inode_info *iinfo = UDF_I(inode);
+ int want_delete = 0;
+
+- if (!inode->i_nlink && !is_bad_inode(inode)) {
+- want_delete = 1;
+- udf_setsize(inode, 0);
+- udf_update_inode(inode, IS_SYNC(inode));
++ if (!is_bad_inode(inode)) {
++ if (!inode->i_nlink) {
++ want_delete = 1;
++ udf_setsize(inode, 0);
++ udf_update_inode(inode, IS_SYNC(inode));
++ }
++ if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB &&
++ inode->i_size != iinfo->i_lenExtents) {
++ udf_warn(inode->i_sb,
++ "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n",
++ inode->i_ino, inode->i_mode,
++ (unsigned long long)inode->i_size,
++ (unsigned long long)iinfo->i_lenExtents);
++ }
+ }
+ truncate_inode_pages_final(&inode->i_data);
+ invalidate_inode_buffers(inode);
+ clear_inode(inode);
+- if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB &&
+- inode->i_size != iinfo->i_lenExtents) {
+- udf_warn(inode->i_sb, "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n",
+- inode->i_ino, inode->i_mode,
+- (unsigned long long)inode->i_size,
+- (unsigned long long)iinfo->i_lenExtents);
+- }
+ kfree(iinfo->i_ext.i_data);
+ iinfo->i_ext.i_data = NULL;
+ udf_clear_extent_cache(inode);
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 1676a175cd7a8..caeb01ca039b7 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -1349,6 +1349,12 @@ static int udf_load_sparable_map(struct super_block *sb,
+ (int)spm->numSparingTables);
+ return -EIO;
+ }
++ if (le32_to_cpu(spm->sizeSparingTable) > sb->s_blocksize) {
++ udf_err(sb, "error loading logical volume descriptor: "
++ "Too big sparing table size (%u)\n",
++ le32_to_cpu(spm->sizeSparingTable));
++ return -EIO;
++ }
+
+ for (i = 0; i < spm->numSparingTables; i++) {
+ loc = le32_to_cpu(spm->locSparingTable[i]);
+diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
+index 484eb0adcefb2..08da48b662358 100644
+--- a/fs/xfs/xfs_rtalloc.c
++++ b/fs/xfs/xfs_rtalloc.c
+@@ -245,6 +245,9 @@ xfs_rtallocate_extent_block(
+ end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1;
+ i <= end;
+ i++) {
++ /* Make sure we don't scan off the end of the rt volume. */
++ maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i;
++
+ /*
+ * See if there's a free extent of maxlen starting at i.
+ * If it's not so then next will contain the first non-free.
+@@ -440,6 +443,14 @@ xfs_rtallocate_extent_near(
+ */
+ if (bno >= mp->m_sb.sb_rextents)
+ bno = mp->m_sb.sb_rextents - 1;
++
++ /* Make sure we don't run off the end of the rt volume. */
++ maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno;
++ if (maxlen < minlen) {
++ *rtblock = NULLRTBLOCK;
++ return 0;
++ }
++
+ /*
+ * Try the exact allocation first.
+ */
+diff --git a/include/linux/overflow.h b/include/linux/overflow.h
+index 15eb85de92269..4564a175e6814 100644
+--- a/include/linux/overflow.h
++++ b/include/linux/overflow.h
+@@ -3,6 +3,7 @@
+ #define __LINUX_OVERFLOW_H
+
+ #include <linux/compiler.h>
++#include <linux/limits.h>
+
+ /*
+ * In the fallback code below, we need to compute the minimum and
+diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h
+index 731ac09ed2313..5b567b43e1b16 100644
+--- a/include/scsi/scsi_common.h
++++ b/include/scsi/scsi_common.h
+@@ -25,6 +25,13 @@ scsi_command_size(const unsigned char *cmnd)
+ scsi_varlen_cdb_length(cmnd) : COMMAND_SIZE(cmnd[0]);
+ }
+
++static inline unsigned char
++scsi_command_control(const unsigned char *cmnd)
++{
++ return (cmnd[0] == VARIABLE_LENGTH_CMD) ?
++ cmnd[1] : cmnd[COMMAND_SIZE(cmnd[0]) - 1];
++}
++
+ /* Returns a human-readable name for the device */
+ extern const char *scsi_device_type(unsigned type);
+
+diff --git a/include/trace/events/target.h b/include/trace/events/target.h
+index 914a872dd3435..e87a3716b0ac9 100644
+--- a/include/trace/events/target.h
++++ b/include/trace/events/target.h
+@@ -140,6 +140,7 @@ TRACE_EVENT(target_sequencer_start,
+ __field( unsigned int, opcode )
+ __field( unsigned int, data_length )
+ __field( unsigned int, task_attribute )
++ __field( unsigned char, control )
+ __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE )
+ __string( initiator, cmd->se_sess->se_node_acl->initiatorname )
+ ),
+@@ -149,6 +150,7 @@ TRACE_EVENT(target_sequencer_start,
+ __entry->opcode = cmd->t_task_cdb[0];
+ __entry->data_length = cmd->data_length;
+ __entry->task_attribute = cmd->sam_task_attr;
++ __entry->control = scsi_command_control(cmd->t_task_cdb);
+ memcpy(__entry->cdb, cmd->t_task_cdb, TCM_MAX_COMMAND_SIZE);
+ __assign_str(initiator, cmd->se_sess->se_node_acl->initiatorname);
+ ),
+@@ -158,9 +160,7 @@ TRACE_EVENT(target_sequencer_start,
+ show_opcode_name(__entry->opcode),
+ __entry->data_length, __print_hex(__entry->cdb, 16),
+ show_task_attribute_name(__entry->task_attribute),
+- scsi_command_size(__entry->cdb) <= 16 ?
+- __entry->cdb[scsi_command_size(__entry->cdb) - 1] :
+- __entry->cdb[1]
++ __entry->control
+ )
+ );
+
+@@ -175,6 +175,7 @@ TRACE_EVENT(target_cmd_complete,
+ __field( unsigned int, opcode )
+ __field( unsigned int, data_length )
+ __field( unsigned int, task_attribute )
++ __field( unsigned char, control )
+ __field( unsigned char, scsi_status )
+ __field( unsigned char, sense_length )
+ __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE )
+@@ -187,6 +188,7 @@ TRACE_EVENT(target_cmd_complete,
+ __entry->opcode = cmd->t_task_cdb[0];
+ __entry->data_length = cmd->data_length;
+ __entry->task_attribute = cmd->sam_task_attr;
++ __entry->control = scsi_command_control(cmd->t_task_cdb);
+ __entry->scsi_status = cmd->scsi_status;
+ __entry->sense_length = cmd->scsi_status == SAM_STAT_CHECK_CONDITION ?
+ min(18, ((u8 *) cmd->sense_buffer)[SPC_ADD_SENSE_LEN_OFFSET] + 8) : 0;
+@@ -203,9 +205,7 @@ TRACE_EVENT(target_cmd_complete,
+ show_opcode_name(__entry->opcode),
+ __entry->data_length, __print_hex(__entry->cdb, 16),
+ show_task_attribute_name(__entry->task_attribute),
+- scsi_command_size(__entry->cdb) <= 16 ?
+- __entry->cdb[scsi_command_size(__entry->cdb) - 1] :
+- __entry->cdb[1]
++ __entry->control
+ )
+ );
+
+diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
+index f35eb72739c09..5fb4cdf37100c 100644
+--- a/include/uapi/linux/perf_event.h
++++ b/include/uapi/linux/perf_event.h
+@@ -1079,7 +1079,7 @@ union perf_mem_data_src {
+
+ #define PERF_MEM_SNOOPX_FWD 0x01 /* forward */
+ /* 1 free */
+-#define PERF_MEM_SNOOPX_SHIFT 37
++#define PERF_MEM_SNOOPX_SHIFT 38
+
+ /* locked instruction */
+ #define PERF_MEM_LOCK_NA 0x01 /* not available */
+diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
+index 6a4b41484afe6..b45576ca3b0da 100644
+--- a/kernel/debug/kdb/kdb_io.c
++++ b/kernel/debug/kdb/kdb_io.c
+@@ -679,12 +679,16 @@ int vkdb_printf(enum kdb_msgsrc src, const char *fmt, va_list ap)
+ size_avail = sizeof(kdb_buffer) - len;
+ goto kdb_print_out;
+ }
+- if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH)
++ if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) {
+ /*
+ * This was a interactive search (using '/' at more
+- * prompt) and it has completed. Clear the flag.
++ * prompt) and it has completed. Replace the \0 with
++ * its original value to ensure multi-line strings
++ * are handled properly, and return to normal mode.
+ */
++ *cphold = replaced_byte;
+ kdb_grepping_flag = 0;
++ }
+ /*
+ * at this point the string is a full line and
+ * should be printed, up to the null.
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index 537a2a3c1dea2..28db51274ed0e 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -842,17 +842,6 @@ static int software_resume(void)
+
+ /* Check if the device is there */
+ swsusp_resume_device = name_to_dev_t(resume_file);
+-
+- /*
+- * name_to_dev_t is ineffective to verify parition if resume_file is in
+- * integer format. (e.g. major:minor)
+- */
+- if (isdigit(resume_file[0]) && resume_wait) {
+- int partno;
+- while (!get_gendisk(swsusp_resume_device, &partno))
+- msleep(10);
+- }
+-
+ if (!swsusp_resume_device) {
+ /*
+ * Some device discovery might still be in progress; we need
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index faef74f632620..b166320f7633e 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -24,7 +24,7 @@
+
+ DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues);
+
+-#if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_JUMP_LABEL)
++#ifdef CONFIG_SCHED_DEBUG
+ /*
+ * Debugging: various feature bits
+ *
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 5f0eb4565957f..41b7954be68b7 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -1361,7 +1361,7 @@ enum {
+
+ #undef SCHED_FEAT
+
+-#if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_JUMP_LABEL)
++#ifdef CONFIG_SCHED_DEBUG
+
+ /*
+ * To support run-time toggling of sched features, all the translation units
+@@ -1369,6 +1369,7 @@ enum {
+ */
+ extern const_debug unsigned int sysctl_sched_features;
+
++#ifdef CONFIG_JUMP_LABEL
+ #define SCHED_FEAT(name, enabled) \
+ static __always_inline bool static_branch_##name(struct static_key *key) \
+ { \
+@@ -1381,7 +1382,13 @@ static __always_inline bool static_branch_##name(struct static_key *key) \
+ extern struct static_key sched_feat_keys[__SCHED_FEAT_NR];
+ #define sched_feat(x) (static_branch_##x(&sched_feat_keys[__SCHED_FEAT_##x]))
+
+-#else /* !(SCHED_DEBUG && CONFIG_JUMP_LABEL) */
++#else /* !CONFIG_JUMP_LABEL */
++
++#define sched_feat(x) (sysctl_sched_features & (1UL << __SCHED_FEAT_##x))
++
++#endif /* CONFIG_JUMP_LABEL */
++
++#else /* !SCHED_DEBUG */
+
+ /*
+ * Each translation unit has its own copy of sysctl_sched_features to allow
+@@ -1397,7 +1404,7 @@ static const_debug __maybe_unused unsigned int sysctl_sched_features =
+
+ #define sched_feat(x) !!(sysctl_sched_features & (1UL << __SCHED_FEAT_##x))
+
+-#endif /* SCHED_DEBUG && CONFIG_JUMP_LABEL */
++#endif /* SCHED_DEBUG */
+
+ extern struct static_key_false sched_numa_balancing;
+ extern struct static_key_false sched_schedstats;
+diff --git a/lib/crc32.c b/lib/crc32.c
+index a6c9afafc8c85..1a5d08470044e 100644
+--- a/lib/crc32.c
++++ b/lib/crc32.c
+@@ -328,7 +328,7 @@ static inline u32 __pure crc32_be_generic(u32 crc, unsigned char const *p,
+ return crc;
+ }
+
+-#if CRC_LE_BITS == 1
++#if CRC_BE_BITS == 1
+ u32 __pure crc32_be(u32 crc, unsigned char const *p, size_t len)
+ {
+ return crc32_be_generic(crc, p, len, NULL, CRC32_POLY_BE);
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index 2a85dc3be8bf3..198a1fdd6709e 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1341,8 +1341,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
+
+ parent = bt_sk(sk)->parent;
+
+- sock_set_flag(sk, SOCK_ZAPPED);
+-
+ switch (chan->state) {
+ case BT_OPEN:
+ case BT_BOUND:
+@@ -1369,8 +1367,11 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
+
+ break;
+ }
+-
+ release_sock(sk);
++
++ /* Only zap after cleanup to avoid use after free race */
++ sock_set_flag(sk, SOCK_ZAPPED);
++
+ }
+
+ static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index ffcb5983107db..de6f89511a216 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -680,9 +680,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
+ }
+
+ if (dev->header_ops) {
+- /* Need space for new headers */
+- if (skb_cow_head(skb, dev->needed_headroom -
+- (tunnel->hlen + sizeof(struct iphdr))))
++ if (skb_cow_head(skb, 0))
+ goto free_skb;
+
+ tnl_params = (const struct iphdr *)skb->data;
+@@ -800,7 +798,11 @@ static void ipgre_link_update(struct net_device *dev, bool set_mtu)
+ len = tunnel->tun_hlen - len;
+ tunnel->hlen = tunnel->hlen + len;
+
+- dev->needed_headroom = dev->needed_headroom + len;
++ if (dev->header_ops)
++ dev->hard_header_len += len;
++ else
++ dev->needed_headroom += len;
++
+ if (set_mtu)
+ dev->mtu = max_t(int, dev->mtu - len, 68);
+
+@@ -1003,6 +1005,7 @@ static void __gre_tunnel_init(struct net_device *dev)
+ tunnel->parms.iph.protocol = IPPROTO_GRE;
+
+ tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
++ dev->needed_headroom = tunnel->hlen + sizeof(tunnel->parms.iph);
+
+ dev->features |= GRE_FEATURES;
+ dev->hw_features |= GRE_FEATURES;
+@@ -1046,10 +1049,14 @@ static int ipgre_tunnel_init(struct net_device *dev)
+ return -EINVAL;
+ dev->flags = IFF_BROADCAST;
+ dev->header_ops = &ipgre_header_ops;
++ dev->hard_header_len = tunnel->hlen + sizeof(*iph);
++ dev->needed_headroom = 0;
+ }
+ #endif
+ } else if (!tunnel->collect_md) {
+ dev->header_ops = &ipgre_header_ops;
++ dev->hard_header_len = tunnel->hlen + sizeof(*iph);
++ dev->needed_headroom = 0;
+ }
+
+ return ip_tunnel_init(dev);
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index b6670e74aeb7b..9926455dd546d 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -664,7 +664,8 @@ void sta_set_rate_info_tx(struct sta_info *sta,
+ u16 brate;
+
+ sband = ieee80211_get_sband(sta->sdata);
+- if (sband) {
++ WARN_ON_ONCE(sband && !sband->bitrates);
++ if (sband && sband->bitrates) {
+ brate = sband->bitrates[rate->idx].bitrate;
+ rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
+ }
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 2a82d438991b5..9968b8a976f19 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2009,6 +2009,10 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,
+ int rate_idx = STA_STATS_GET(LEGACY_IDX, rate);
+
+ sband = local->hw.wiphy->bands[band];
++
++ if (WARN_ON_ONCE(!sband->bitrates))
++ break;
++
+ brate = sband->bitrates[rate_idx].bitrate;
+ if (rinfo->bw == RATE_INFO_BW_5)
+ shift = 2;
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index c339b5e386b78..3ad1de081e3c7 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -2393,6 +2393,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+ /* Set timeout values for (tcp tcpfin udp) */
+ ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg);
+ goto out_unlock;
++ } else if (!len) {
++ /* No more commands with len == 0 below */
++ ret = -EINVAL;
++ goto out_unlock;
+ }
+
+ usvc_compat = (struct ip_vs_service_user *)arg;
+@@ -2469,9 +2473,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+ break;
+ case IP_VS_SO_SET_DELDEST:
+ ret = ip_vs_del_dest(svc, &udest);
+- break;
+- default:
+- ret = -EINVAL;
+ }
+
+ out_unlock:
+diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
+index 7011ab27c4371..40f8a1252394b 100644
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -549,13 +549,20 @@ static bool tcp_in_window(const struct nf_conn *ct,
+ swin = win << sender->td_scale;
+ sender->td_maxwin = (swin == 0 ? 1 : swin);
+ sender->td_maxend = end + sender->td_maxwin;
+- /*
+- * We haven't seen traffic in the other direction yet
+- * but we have to tweak window tracking to pass III
+- * and IV until that happens.
+- */
+- if (receiver->td_maxwin == 0)
++ if (receiver->td_maxwin == 0) {
++ /* We haven't seen traffic in the other
++ * direction yet but we have to tweak window
++ * tracking to pass III and IV until that
++ * happens.
++ */
+ receiver->td_end = receiver->td_maxend = sack;
++ } else if (sack == receiver->td_end + 1) {
++ /* Likely a reply to a keepalive.
++ * Needed for III.
++ */
++ receiver->td_end++;
++ }
++
+ }
+ } else if (((state->state == TCP_CONNTRACK_SYN_SENT
+ && dir == IP_CT_DIR_ORIGINAL)
+diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
+index f4a566e672135..98d117f3340ce 100644
+--- a/net/netfilter/nf_dup_netdev.c
++++ b/net/netfilter/nf_dup_netdev.c
+@@ -21,6 +21,7 @@ static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev)
+ skb_push(skb, skb->mac_len);
+
+ skb->dev = dev;
++ skb->tstamp = 0;
+ dev_queue_xmit(skb);
+ }
+
+diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
+index 649edbe77a205..10a12e0949299 100644
+--- a/net/netfilter/nft_fwd_netdev.c
++++ b/net/netfilter/nft_fwd_netdev.c
+@@ -129,6 +129,7 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,
+ return;
+
+ skb->dev = dev;
++ skb->tstamp = 0;
+ neigh_xmit(neigh_table, dev, addr, skb);
+ out:
+ regs->verdict.code = verdict;
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index 68259eec6afd1..ab086081be9c7 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -1079,9 +1079,9 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
+ struct gssp_in_token *in_token)
+ {
+ struct kvec *argv = &rqstp->rq_arg.head[0];
+- unsigned int page_base, length;
+- int pages, i, res;
+- size_t inlen;
++ unsigned int length, pgto_offs, pgfrom_offs;
++ int pages, i, res, pgto, pgfrom;
++ size_t inlen, to_offs, from_offs;
+
+ res = gss_read_common_verf(gc, argv, authp, in_handle);
+ if (res)
+@@ -1109,17 +1109,24 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
+ memcpy(page_address(in_token->pages[0]), argv->iov_base, length);
+ inlen -= length;
+
+- i = 1;
+- page_base = rqstp->rq_arg.page_base;
++ to_offs = length;
++ from_offs = rqstp->rq_arg.page_base;
+ while (inlen) {
+- length = min_t(unsigned int, inlen, PAGE_SIZE);
+- memcpy(page_address(in_token->pages[i]),
+- page_address(rqstp->rq_arg.pages[i]) + page_base,
++ pgto = to_offs >> PAGE_SHIFT;
++ pgfrom = from_offs >> PAGE_SHIFT;
++ pgto_offs = to_offs & ~PAGE_MASK;
++ pgfrom_offs = from_offs & ~PAGE_MASK;
++
++ length = min_t(unsigned int, inlen,
++ min_t(unsigned int, PAGE_SIZE - pgto_offs,
++ PAGE_SIZE - pgfrom_offs));
++ memcpy(page_address(in_token->pages[pgto]) + pgto_offs,
++ page_address(rqstp->rq_arg.pages[pgfrom]) + pgfrom_offs,
+ length);
+
++ to_offs += length;
++ from_offs += length;
+ inlen -= length;
+- page_base = 0;
+- i++;
+ }
+ return 0;
+ }
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+index aa4d19a780d78..4062cd624b26f 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+@@ -639,10 +639,11 @@ static int svc_rdma_pull_up_reply_msg(struct svcxprt_rdma *rdma,
+ while (remaining) {
+ len = min_t(u32, PAGE_SIZE - pageoff, remaining);
+
+- memcpy(dst, page_address(*ppages), len);
++ memcpy(dst, page_address(*ppages) + pageoff, len);
+ remaining -= len;
+ dst += len;
+ pageoff = 0;
++ ppages++;
+ }
+ }
+
+diff --git a/samples/mic/mpssd/mpssd.c b/samples/mic/mpssd/mpssd.c
+index f42ce551bb48f..a50d27473e125 100644
+--- a/samples/mic/mpssd/mpssd.c
++++ b/samples/mic/mpssd/mpssd.c
+@@ -414,9 +414,9 @@ mic_virtio_copy(struct mic_info *mic, int fd,
+
+ static inline unsigned _vring_size(unsigned int num, unsigned long align)
+ {
+- return ((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num)
++ return _ALIGN_UP(((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num)
+ + align - 1) & ~(align - 1))
+- + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num;
++ + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num, 4);
+ }
+
+ /*
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index ff2c41ea94c8c..2434a0014491f 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -876,6 +876,8 @@ static void intel_pt_set_pid_tid_cpu(struct intel_pt *pt,
+
+ if (queue->tid == -1 || pt->have_sched_switch) {
+ ptq->tid = machine__get_current_tid(pt->machine, ptq->cpu);
++ if (ptq->tid == -1)
++ ptq->pid = -1;
+ thread__zput(ptq->thread);
+ }
+
+@@ -1915,10 +1917,8 @@ static int intel_pt_context_switch(struct intel_pt *pt, union perf_event *event,
+ tid = sample->tid;
+ }
+
+- if (tid == -1) {
+- pr_err("context_switch event has no tid\n");
+- return -EINVAL;
+- }
++ if (tid == -1)
++ intel_pt_log("context_switch event has no tid\n");
+
+ intel_pt_log("context_switch: cpu %d pid %d tid %d time %"PRIu64" tsc %#"PRIx64"\n",
+ cpu, pid, tid, sample->time, perf_time_to_tsc(sample->time,
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-11-05 12:35 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-11-05 12:35 UTC (permalink / raw
To: gentoo-commits
commit: f01d715ad6d3e0957cdbeda344df8630774b0819
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 5 12:35:36 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Nov 5 12:35:36 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f01d715a
Linux patch 4.19.155
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1154_linux-4.19.155.patch | 8488 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 8492 insertions(+)
diff --git a/0000_README b/0000_README
index ea0813a..e9e0833 100644
--- a/0000_README
+++ b/0000_README
@@ -655,6 +655,10 @@ Patch: 1153_linux-4.19.154.patch
From: https://www.kernel.org
Desc: Linux 4.19.154
+Patch: 1154_linux-4.19.155.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.155
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1154_linux-4.19.155.patch b/1154_linux-4.19.155.patch
new file mode 100644
index 0000000..b0f4b5f
--- /dev/null
+++ b/1154_linux-4.19.155.patch
@@ -0,0 +1,8488 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index fb129272240c9..8dbc8d4ec8f0c 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -5270,6 +5270,14 @@
+ with /sys/devices/system/xen_memory/xen_memory0/scrub_pages.
+ Default value controlled with CONFIG_XEN_SCRUB_PAGES_DEFAULT.
+
++ xen.event_eoi_delay= [XEN]
++ How long to delay EOI handling in case of event
++ storms (jiffies). Default is 10.
++
++ xen.event_loop_timeout= [XEN]
++ After which time (jiffies) the event handling loop
++ should start to delay EOI handling. Default is 2.
++
+ xirc2ps_cs= [NET,PCMCIA]
+ Format:
+ <irq>,<irq_mask>,<io>,<full_duplex>,<do_sound>,<lockup_hack>[,<irq2>[,<irq3>[,<irq4>]]]
+diff --git a/Documentation/filesystems/fscrypt.rst b/Documentation/filesystems/fscrypt.rst
+index cfbc18f0d9c98..5b667ee1242ae 100644
+--- a/Documentation/filesystems/fscrypt.rst
++++ b/Documentation/filesystems/fscrypt.rst
+@@ -426,10 +426,18 @@ astute users may notice some differences in behavior:
+ - Unencrypted files, or files encrypted with a different encryption
+ policy (i.e. different key, modes, or flags), cannot be renamed or
+ linked into an encrypted directory; see `Encryption policy
+- enforcement`_. Attempts to do so will fail with EPERM. However,
++ enforcement`_. Attempts to do so will fail with EXDEV. However,
+ encrypted files can be renamed within an encrypted directory, or
+ into an unencrypted directory.
+
++ Note: "moving" an unencrypted file into an encrypted directory, e.g.
++ with the `mv` program, is implemented in userspace by a copy
++ followed by a delete. Be aware that the original unencrypted data
++ may remain recoverable from free space on the disk; prefer to keep
++ all files encrypted from the very beginning. The `shred` program
++ may be used to overwrite the source files but isn't guaranteed to be
++ effective on all filesystems and storage devices.
++
+ - Direct I/O is not supported on encrypted files. Attempts to use
+ direct I/O on such files will fall back to buffered I/O.
+
+@@ -516,7 +524,7 @@ not be encrypted.
+ Except for those special files, it is forbidden to have unencrypted
+ files, or files encrypted with a different encryption policy, in an
+ encrypted directory tree. Attempts to link or rename such a file into
+-an encrypted directory will fail with EPERM. This is also enforced
++an encrypted directory will fail with EXDEV. This is also enforced
+ during ->lookup() to provide limited protection against offline
+ attacks that try to disable or downgrade encryption in known locations
+ where applications may later write sensitive data. It is recommended
+diff --git a/Documentation/media/uapi/v4l/colorspaces-defs.rst b/Documentation/media/uapi/v4l/colorspaces-defs.rst
+index f24615544792b..16e46bec80934 100644
+--- a/Documentation/media/uapi/v4l/colorspaces-defs.rst
++++ b/Documentation/media/uapi/v4l/colorspaces-defs.rst
+@@ -29,8 +29,7 @@ whole range, 0-255, dividing the angular value by 1.41. The enum
+ :c:type:`v4l2_hsv_encoding` specifies which encoding is used.
+
+ .. note:: The default R'G'B' quantization is full range for all
+- colorspaces except for BT.2020 which uses limited range R'G'B'
+- quantization.
++ colorspaces. HSV formats are always full range.
+
+ .. tabularcolumns:: |p{6.0cm}|p{11.5cm}|
+
+@@ -162,8 +161,8 @@ whole range, 0-255, dividing the angular value by 1.41. The enum
+ - Details
+ * - ``V4L2_QUANTIZATION_DEFAULT``
+ - Use the default quantization encoding as defined by the
+- colorspace. This is always full range for R'G'B' (except for the
+- BT.2020 colorspace) and HSV. It is usually limited range for Y'CbCr.
++ colorspace. This is always full range for R'G'B' and HSV.
++ It is usually limited range for Y'CbCr.
+ * - ``V4L2_QUANTIZATION_FULL_RANGE``
+ - Use the full range quantization encoding. I.e. the range [0…1] is
+ mapped to [0…255] (with possible clipping to [1…254] to avoid the
+@@ -173,4 +172,4 @@ whole range, 0-255, dividing the angular value by 1.41. The enum
+ * - ``V4L2_QUANTIZATION_LIM_RANGE``
+ - Use the limited range quantization encoding. I.e. the range [0…1]
+ is mapped to [16…235]. Cb and Cr are mapped from [-0.5…0.5] to
+- [16…240].
++ [16…240]. Limited Range cannot be used with HSV.
+diff --git a/Documentation/media/uapi/v4l/colorspaces-details.rst b/Documentation/media/uapi/v4l/colorspaces-details.rst
+index 09fabf4cd4126..ca7176cae8dd8 100644
+--- a/Documentation/media/uapi/v4l/colorspaces-details.rst
++++ b/Documentation/media/uapi/v4l/colorspaces-details.rst
+@@ -370,9 +370,8 @@ Colorspace BT.2020 (V4L2_COLORSPACE_BT2020)
+ The :ref:`itu2020` standard defines the colorspace used by Ultra-high
+ definition television (UHDTV). The default transfer function is
+ ``V4L2_XFER_FUNC_709``. The default Y'CbCr encoding is
+-``V4L2_YCBCR_ENC_BT2020``. The default R'G'B' quantization is limited
+-range (!), and so is the default Y'CbCr quantization. The chromaticities
+-of the primary colors and the white reference are:
++``V4L2_YCBCR_ENC_BT2020``. The default Y'CbCr quantization is limited range.
++The chromaticities of the primary colors and the white reference are:
+
+
+
+diff --git a/Makefile b/Makefile
+index a7056e26947c3..9fc16d34e1bb9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 154
++SUBLEVEL = 155
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/Kconfig b/arch/Kconfig
+index a336548487e69..e3a030f7a7226 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -366,6 +366,13 @@ config HAVE_RCU_TABLE_FREE
+ config HAVE_RCU_TABLE_INVALIDATE
+ bool
+
++config ARCH_WANT_IRQS_OFF_ACTIVATE_MM
++ bool
++ help
++ Temporary select until all architectures can be converted to have
++ irqs disabled over activate_mm. Architectures that do IPI based TLB
++ shootdowns should enable this.
++
+ config ARCH_HAVE_NMI_SAFE_CMPXCHG
+ bool
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index e2f7c50dbace5..1877da816f650 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -592,8 +592,10 @@ config ARCH_S3C24XX
+ select HAVE_S3C2410_WATCHDOG if WATCHDOG
+ select HAVE_S3C_RTC if RTC_CLASS
+ select NEED_MACH_IO_H
++ select S3C2410_WATCHDOG
+ select SAMSUNG_ATAGS
+ select USE_OF
++ select WATCHDOG
+ help
+ Samsung S3C2410, S3C2412, S3C2413, S3C2416, S3C2440, S3C2442, S3C2443
+ and S3C2450 SoCs based systems, such as the Simtec Electronics BAST
+diff --git a/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts b/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts
+index 2b760f90f38c8..5375c6699843f 100644
+--- a/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts
++++ b/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts
+@@ -192,6 +192,7 @@
+ fixed-link {
+ speed = <1000>;
+ full-duplex;
++ pause;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
+index 1a96d4317c975..8f907c235b02c 100644
+--- a/arch/arm/boot/dts/omap4.dtsi
++++ b/arch/arm/boot/dts/omap4.dtsi
+@@ -516,7 +516,7 @@
+ status = "disabled";
+ };
+
+- target-module@56000000 {
++ sgx_module: target-module@56000000 {
+ compatible = "ti,sysc-omap4", "ti,sysc";
+ ti,hwmods = "gpu";
+ reg = <0x5601fc00 0x4>,
+diff --git a/arch/arm/boot/dts/omap443x.dtsi b/arch/arm/boot/dts/omap443x.dtsi
+index cbcdcb4e7d1c2..86b9caf461dfa 100644
+--- a/arch/arm/boot/dts/omap443x.dtsi
++++ b/arch/arm/boot/dts/omap443x.dtsi
+@@ -74,3 +74,13 @@
+ };
+
+ /include/ "omap443x-clocks.dtsi"
++
++/*
++ * Use dpll_per for sgx at 153.6MHz like droid4 stock v3.0.8 Android kernel
++ */
++&sgx_module {
++ assigned-clocks = <&l3_gfx_clkctrl OMAP4_GPU_CLKCTRL 24>,
++ <&dpll_per_m7x2_ck>;
++ assigned-clock-rates = <0>, <153600000>;
++ assigned-clock-parents = <&dpll_per_m7x2_ck>;
++};
+diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi
+index 67358562a6ea2..020a864623ff4 100644
+--- a/arch/arm/boot/dts/s5pv210.dtsi
++++ b/arch/arm/boot/dts/s5pv210.dtsi
+@@ -98,19 +98,16 @@
+ };
+
+ clocks: clock-controller@e0100000 {
+- compatible = "samsung,s5pv210-clock", "simple-bus";
++ compatible = "samsung,s5pv210-clock";
+ reg = <0xe0100000 0x10000>;
+ clock-names = "xxti", "xusbxti";
+ clocks = <&xxti>, <&xusbxti>;
+ #clock-cells = <1>;
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges;
++ };
+
+- pmu_syscon: syscon@e0108000 {
+- compatible = "samsung-s5pv210-pmu", "syscon";
+- reg = <0xe0108000 0x8000>;
+- };
++ pmu_syscon: syscon@e0108000 {
++ compatible = "samsung-s5pv210-pmu", "syscon";
++ reg = <0xe0108000 0x8000>;
+ };
+
+ pinctrl0: pinctrl@e0200000 {
+@@ -126,35 +123,28 @@
+ };
+ };
+
+- amba {
+- #address-cells = <1>;
+- #size-cells = <1>;
+- compatible = "simple-bus";
+- ranges;
+-
+- pdma0: dma@e0900000 {
+- compatible = "arm,pl330", "arm,primecell";
+- reg = <0xe0900000 0x1000>;
+- interrupt-parent = <&vic0>;
+- interrupts = <19>;
+- clocks = <&clocks CLK_PDMA0>;
+- clock-names = "apb_pclk";
+- #dma-cells = <1>;
+- #dma-channels = <8>;
+- #dma-requests = <32>;
+- };
++ pdma0: dma@e0900000 {
++ compatible = "arm,pl330", "arm,primecell";
++ reg = <0xe0900000 0x1000>;
++ interrupt-parent = <&vic0>;
++ interrupts = <19>;
++ clocks = <&clocks CLK_PDMA0>;
++ clock-names = "apb_pclk";
++ #dma-cells = <1>;
++ #dma-channels = <8>;
++ #dma-requests = <32>;
++ };
+
+- pdma1: dma@e0a00000 {
+- compatible = "arm,pl330", "arm,primecell";
+- reg = <0xe0a00000 0x1000>;
+- interrupt-parent = <&vic0>;
+- interrupts = <20>;
+- clocks = <&clocks CLK_PDMA1>;
+- clock-names = "apb_pclk";
+- #dma-cells = <1>;
+- #dma-channels = <8>;
+- #dma-requests = <32>;
+- };
++ pdma1: dma@e0a00000 {
++ compatible = "arm,pl330", "arm,primecell";
++ reg = <0xe0a00000 0x1000>;
++ interrupt-parent = <&vic0>;
++ interrupts = <20>;
++ clocks = <&clocks CLK_PDMA1>;
++ clock-names = "apb_pclk";
++ #dma-cells = <1>;
++ #dma-channels = <8>;
++ #dma-requests = <32>;
+ };
+
+ spi0: spi@e1300000 {
+@@ -227,43 +217,36 @@
+ status = "disabled";
+ };
+
+- audio-subsystem {
+- compatible = "samsung,s5pv210-audss", "simple-bus";
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges;
+-
+- clk_audss: clock-controller@eee10000 {
+- compatible = "samsung,s5pv210-audss-clock";
+- reg = <0xeee10000 0x1000>;
+- clock-names = "hclk", "xxti",
+- "fout_epll",
+- "sclk_audio0";
+- clocks = <&clocks DOUT_HCLKP>, <&xxti>,
+- <&clocks FOUT_EPLL>,
+- <&clocks SCLK_AUDIO0>;
+- #clock-cells = <1>;
+- };
++ clk_audss: clock-controller@eee10000 {
++ compatible = "samsung,s5pv210-audss-clock";
++ reg = <0xeee10000 0x1000>;
++ clock-names = "hclk", "xxti",
++ "fout_epll",
++ "sclk_audio0";
++ clocks = <&clocks DOUT_HCLKP>, <&xxti>,
++ <&clocks FOUT_EPLL>,
++ <&clocks SCLK_AUDIO0>;
++ #clock-cells = <1>;
++ };
+
+- i2s0: i2s@eee30000 {
+- compatible = "samsung,s5pv210-i2s";
+- reg = <0xeee30000 0x1000>;
+- interrupt-parent = <&vic2>;
+- interrupts = <16>;
+- dma-names = "rx", "tx", "tx-sec";
+- dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>;
+- clock-names = "iis",
+- "i2s_opclk0",
+- "i2s_opclk1";
+- clocks = <&clk_audss CLK_I2S>,
+- <&clk_audss CLK_I2S>,
+- <&clk_audss CLK_DOUT_AUD_BUS>;
+- samsung,idma-addr = <0xc0010000>;
+- pinctrl-names = "default";
+- pinctrl-0 = <&i2s0_bus>;
+- #sound-dai-cells = <0>;
+- status = "disabled";
+- };
++ i2s0: i2s@eee30000 {
++ compatible = "samsung,s5pv210-i2s";
++ reg = <0xeee30000 0x1000>;
++ interrupt-parent = <&vic2>;
++ interrupts = <16>;
++ dma-names = "rx", "tx", "tx-sec";
++ dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>;
++ clock-names = "iis",
++ "i2s_opclk0",
++ "i2s_opclk1";
++ clocks = <&clk_audss CLK_I2S>,
++ <&clk_audss CLK_I2S>,
++ <&clk_audss CLK_DOUT_AUD_BUS>;
++ samsung,idma-addr = <0xc0010000>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&i2s0_bus>;
++ #sound-dai-cells = <0>;
++ status = "disabled";
+ };
+
+ i2s1: i2s@e2100000 {
+diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
+index 8a8470d36c659..97fa9c1677576 100644
+--- a/arch/arm/kernel/hw_breakpoint.c
++++ b/arch/arm/kernel/hw_breakpoint.c
+@@ -688,6 +688,40 @@ static void disable_single_step(struct perf_event *bp)
+ arch_install_hw_breakpoint(bp);
+ }
+
++/*
++ * Arm32 hardware does not always report a watchpoint hit address that matches
++ * one of the watchpoints set. It can also report an address "near" the
++ * watchpoint if a single instruction access both watched and unwatched
++ * addresses. There is no straight-forward way, short of disassembling the
++ * offending instruction, to map that address back to the watchpoint. This
++ * function computes the distance of the memory access from the watchpoint as a
++ * heuristic for the likelyhood that a given access triggered the watchpoint.
++ *
++ * See this same function in the arm64 platform code, which has the same
++ * problem.
++ *
++ * The function returns the distance of the address from the bytes watched by
++ * the watchpoint. In case of an exact match, it returns 0.
++ */
++static u32 get_distance_from_watchpoint(unsigned long addr, u32 val,
++ struct arch_hw_breakpoint_ctrl *ctrl)
++{
++ u32 wp_low, wp_high;
++ u32 lens, lene;
++
++ lens = __ffs(ctrl->len);
++ lene = __fls(ctrl->len);
++
++ wp_low = val + lens;
++ wp_high = val + lene;
++ if (addr < wp_low)
++ return wp_low - addr;
++ else if (addr > wp_high)
++ return addr - wp_high;
++ else
++ return 0;
++}
++
+ static int watchpoint_fault_on_uaccess(struct pt_regs *regs,
+ struct arch_hw_breakpoint *info)
+ {
+@@ -697,23 +731,25 @@ static int watchpoint_fault_on_uaccess(struct pt_regs *regs,
+ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
+ struct pt_regs *regs)
+ {
+- int i, access;
+- u32 val, ctrl_reg, alignment_mask;
++ int i, access, closest_match = 0;
++ u32 min_dist = -1, dist;
++ u32 val, ctrl_reg;
+ struct perf_event *wp, **slots;
+ struct arch_hw_breakpoint *info;
+ struct arch_hw_breakpoint_ctrl ctrl;
+
+ slots = this_cpu_ptr(wp_on_reg);
+
++ /*
++ * Find all watchpoints that match the reported address. If no exact
++ * match is found. Attribute the hit to the closest watchpoint.
++ */
++ rcu_read_lock();
+ for (i = 0; i < core_num_wrps; ++i) {
+- rcu_read_lock();
+-
+ wp = slots[i];
+-
+ if (wp == NULL)
+- goto unlock;
++ continue;
+
+- info = counter_arch_bp(wp);
+ /*
+ * The DFAR is an unknown value on debug architectures prior
+ * to 7.1. Since we only allow a single watchpoint on these
+@@ -722,33 +758,31 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
+ */
+ if (debug_arch < ARM_DEBUG_ARCH_V7_1) {
+ BUG_ON(i > 0);
++ info = counter_arch_bp(wp);
+ info->trigger = wp->attr.bp_addr;
+ } else {
+- if (info->ctrl.len == ARM_BREAKPOINT_LEN_8)
+- alignment_mask = 0x7;
+- else
+- alignment_mask = 0x3;
+-
+- /* Check if the watchpoint value matches. */
+- val = read_wb_reg(ARM_BASE_WVR + i);
+- if (val != (addr & ~alignment_mask))
+- goto unlock;
+-
+- /* Possible match, check the byte address select. */
+- ctrl_reg = read_wb_reg(ARM_BASE_WCR + i);
+- decode_ctrl_reg(ctrl_reg, &ctrl);
+- if (!((1 << (addr & alignment_mask)) & ctrl.len))
+- goto unlock;
+-
+ /* Check that the access type matches. */
+ if (debug_exception_updates_fsr()) {
+ access = (fsr & ARM_FSR_ACCESS_MASK) ?
+ HW_BREAKPOINT_W : HW_BREAKPOINT_R;
+ if (!(access & hw_breakpoint_type(wp)))
+- goto unlock;
++ continue;
+ }
+
++ val = read_wb_reg(ARM_BASE_WVR + i);
++ ctrl_reg = read_wb_reg(ARM_BASE_WCR + i);
++ decode_ctrl_reg(ctrl_reg, &ctrl);
++ dist = get_distance_from_watchpoint(addr, val, &ctrl);
++ if (dist < min_dist) {
++ min_dist = dist;
++ closest_match = i;
++ }
++ /* Is this an exact match? */
++ if (dist != 0)
++ continue;
++
+ /* We have a winner. */
++ info = counter_arch_bp(wp);
+ info->trigger = addr;
+ }
+
+@@ -770,13 +804,23 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
+ * we can single-step over the watchpoint trigger.
+ */
+ if (!is_default_overflow_handler(wp))
+- goto unlock;
+-
++ continue;
+ step:
+ enable_single_step(wp, instruction_pointer(regs));
+-unlock:
+- rcu_read_unlock();
+ }
++
++ if (min_dist > 0 && min_dist != -1) {
++ /* No exact match found. */
++ wp = slots[closest_match];
++ info = counter_arch_bp(wp);
++ info->trigger = addr;
++ pr_debug("watchpoint fired: address = 0x%x\n", info->trigger);
++ perf_bp_event(wp, regs);
++ if (is_default_overflow_handler(wp))
++ enable_single_step(wp, instruction_pointer(regs));
++ }
++
++ rcu_read_unlock();
+ }
+
+ static void watchpoint_single_step_handler(unsigned long pc)
+diff --git a/arch/arm/plat-samsung/Kconfig b/arch/arm/plat-samsung/Kconfig
+index 377ff9cda667a..c83baa51289fa 100644
+--- a/arch/arm/plat-samsung/Kconfig
++++ b/arch/arm/plat-samsung/Kconfig
+@@ -240,6 +240,7 @@ config SAMSUNG_PM_DEBUG
+ bool "Samsung PM Suspend debug"
+ depends on PM && DEBUG_KERNEL
+ depends on DEBUG_EXYNOS_UART || DEBUG_S3C24XX_UART || DEBUG_S3C2410_UART
++ depends on DEBUG_LL && MMU
+ help
+ Say Y here if you want verbose debugging from the PM Suspend and
+ Resume code. See <file:Documentation/arm/Samsung-S3C24XX/Suspend.txt>
+diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
+index 393d2b524284e..91c7ffad85413 100644
+--- a/arch/arm64/Kconfig.platforms
++++ b/arch/arm64/Kconfig.platforms
+@@ -46,6 +46,7 @@ config ARCH_BCM_IPROC
+ config ARCH_BERLIN
+ bool "Marvell Berlin SoC Family"
+ select DW_APB_ICTL
++ select DW_APB_TIMER_OF
+ select GPIOLIB
+ select PINCTRL
+ help
+diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
+index 9a5e281412116..dc54a883513a8 100644
+--- a/arch/arm64/Makefile
++++ b/arch/arm64/Makefile
+@@ -10,7 +10,7 @@
+ #
+ # Copyright (C) 1995-2001 by Russell King
+
+-LDFLAGS_vmlinux :=--no-undefined -X
++LDFLAGS_vmlinux :=--no-undefined -X -z norelro
+ CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET)
+ GZFLAGS :=-9
+
+@@ -18,7 +18,7 @@ ifeq ($(CONFIG_RELOCATABLE), y)
+ # Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour
+ # for relative relocs, since this leads to better Image compression
+ # with the relocation offsets always being zero.
+-LDFLAGS_vmlinux += -shared -Bsymbolic -z notext -z norelro \
++LDFLAGS_vmlinux += -shared -Bsymbolic -z notext \
+ $(call ld-option, --no-apply-dynamic-relocs)
+ endif
+
+diff --git a/arch/arm64/boot/dts/renesas/ulcb.dtsi b/arch/arm64/boot/dts/renesas/ulcb.dtsi
+index 0ead552d7eae9..600adc25eaeff 100644
+--- a/arch/arm64/boot/dts/renesas/ulcb.dtsi
++++ b/arch/arm64/boot/dts/renesas/ulcb.dtsi
+@@ -430,6 +430,7 @@
+ bus-width = <8>;
+ mmc-hs200-1_8v;
+ non-removable;
++ full-pwr-cycle-in-suspend;
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index 5e720742d6479..c67cae9d52293 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -192,6 +192,7 @@ enum vcpu_sysreg {
+ #define cp14_DBGWCR0 (DBGWCR0_EL1 * 2)
+ #define cp14_DBGWVR0 (DBGWVR0_EL1 * 2)
+ #define cp14_DBGDCCINT (MDCCINT_EL1 * 2)
++#define cp14_DBGVCR (DBGVCR32_EL2 * 2)
+
+ #define NR_COPRO_REGS (NR_SYS_REGS * 2)
+
+diff --git a/arch/arm64/include/asm/numa.h b/arch/arm64/include/asm/numa.h
+index 626ad01e83bf0..dd870390d639f 100644
+--- a/arch/arm64/include/asm/numa.h
++++ b/arch/arm64/include/asm/numa.h
+@@ -25,6 +25,9 @@ const struct cpumask *cpumask_of_node(int node);
+ /* Returns a pointer to the cpumask of CPUs on Node 'node'. */
+ static inline const struct cpumask *cpumask_of_node(int node)
+ {
++ if (node == NUMA_NO_NODE)
++ return cpu_all_mask;
++
+ return node_to_cpumask_map[node];
+ }
+ #endif
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index 76490b0cefcee..d191ce8410dba 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -619,6 +619,12 @@ check_branch_predictor(const struct arm64_cpu_capabilities *entry, int scope)
+ return (need_wa > 0);
+ }
+
++static void
++cpu_enable_branch_predictor_hardening(const struct arm64_cpu_capabilities *cap)
++{
++ cap->matches(cap, SCOPE_LOCAL_CPU);
++}
++
+ static const __maybe_unused struct midr_range tx2_family_cpus[] = {
+ MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
+ MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
+@@ -813,9 +819,11 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ },
+ #endif
+ {
++ .desc = "Branch predictor hardening",
+ .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+ .matches = check_branch_predictor,
++ .cpu_enable = cpu_enable_branch_predictor_hardening,
+ },
+ #ifdef CONFIG_HARDEN_EL2_VECTORS
+ {
+diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c
+index 6106c49f84bc8..655a308af9e3c 100644
+--- a/arch/arm64/kernel/topology.c
++++ b/arch/arm64/kernel/topology.c
+@@ -272,21 +272,23 @@ void store_cpu_topology(unsigned int cpuid)
+ if (mpidr & MPIDR_UP_BITMASK)
+ return;
+
+- /* Create cpu topology mapping based on MPIDR. */
+- if (mpidr & MPIDR_MT_BITMASK) {
+- /* Multiprocessor system : Multi-threads per core */
+- cpuid_topo->thread_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
+- cpuid_topo->core_id = MPIDR_AFFINITY_LEVEL(mpidr, 1);
+- cpuid_topo->package_id = MPIDR_AFFINITY_LEVEL(mpidr, 2) |
+- MPIDR_AFFINITY_LEVEL(mpidr, 3) << 8;
+- } else {
+- /* Multiprocessor system : Single-thread per core */
+- cpuid_topo->thread_id = -1;
+- cpuid_topo->core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
+- cpuid_topo->package_id = MPIDR_AFFINITY_LEVEL(mpidr, 1) |
+- MPIDR_AFFINITY_LEVEL(mpidr, 2) << 8 |
+- MPIDR_AFFINITY_LEVEL(mpidr, 3) << 16;
+- }
++ /*
++ * This would be the place to create cpu topology based on MPIDR.
++ *
++ * However, it cannot be trusted to depict the actual topology; some
++ * pieces of the architecture enforce an artificial cap on Aff0 values
++ * (e.g. GICv3's ICC_SGI1R_EL1 limits it to 15), leading to an
++ * artificial cycling of Aff1, Aff2 and Aff3 values. IOW, these end up
++ * having absolutely no relationship to the actual underlying system
++ * topology, and cannot be reasonably used as core / package ID.
++ *
++ * If the MT bit is set, Aff0 *could* be used to define a thread ID, but
++ * we still wouldn't be able to obtain a sane core ID. This means we
++ * need to entirely ignore MPIDR for any topology deduction.
++ */
++ cpuid_topo->thread_id = -1;
++ cpuid_topo->core_id = cpuid;
++ cpuid_topo->package_id = cpu_to_node(cpuid);
+
+ pr_debug("CPU%u: cluster %d core %d thread %d mpidr %#016llx\n",
+ cpuid, cpuid_topo->package_id, cpuid_topo->core_id,
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+index 0c073f3ca1223..b53d0ebb87fcc 100644
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -1555,9 +1555,9 @@ static const struct sys_reg_desc cp14_regs[] = {
+ { Op1( 0), CRn( 0), CRm( 1), Op2( 0), trap_raz_wi },
+ DBG_BCR_BVR_WCR_WVR(1),
+ /* DBGDCCINT */
+- { Op1( 0), CRn( 0), CRm( 2), Op2( 0), trap_debug32 },
++ { Op1( 0), CRn( 0), CRm( 2), Op2( 0), trap_debug32, NULL, cp14_DBGDCCINT },
+ /* DBGDSCRext */
+- { Op1( 0), CRn( 0), CRm( 2), Op2( 2), trap_debug32 },
++ { Op1( 0), CRn( 0), CRm( 2), Op2( 2), trap_debug32, NULL, cp14_DBGDSCRext },
+ DBG_BCR_BVR_WCR_WVR(2),
+ /* DBGDTR[RT]Xint */
+ { Op1( 0), CRn( 0), CRm( 3), Op2( 0), trap_raz_wi },
+@@ -1572,7 +1572,7 @@ static const struct sys_reg_desc cp14_regs[] = {
+ { Op1( 0), CRn( 0), CRm( 6), Op2( 2), trap_raz_wi },
+ DBG_BCR_BVR_WCR_WVR(6),
+ /* DBGVCR */
+- { Op1( 0), CRn( 0), CRm( 7), Op2( 0), trap_debug32 },
++ { Op1( 0), CRn( 0), CRm( 7), Op2( 0), trap_debug32, NULL, cp14_DBGVCR },
+ DBG_BCR_BVR_WCR_WVR(7),
+ DBG_BCR_BVR_WCR_WVR(8),
+ DBG_BCR_BVR_WCR_WVR(9),
+diff --git a/arch/arm64/mm/numa.c b/arch/arm64/mm/numa.c
+index 54529b4ed5130..15eaf1e09d0ca 100644
+--- a/arch/arm64/mm/numa.c
++++ b/arch/arm64/mm/numa.c
+@@ -58,7 +58,11 @@ EXPORT_SYMBOL(node_to_cpumask_map);
+ */
+ const struct cpumask *cpumask_of_node(int node)
+ {
+- if (WARN_ON(node >= nr_node_ids))
++
++ if (node == NUMA_NO_NODE)
++ return cpu_all_mask;
++
++ if (WARN_ON(node < 0 || node >= nr_node_ids))
+ return cpu_none_mask;
+
+ if (WARN_ON(node_to_cpumask_map[node] == NULL))
+diff --git a/arch/ia64/kernel/Makefile b/arch/ia64/kernel/Makefile
+index d0c0ccdd656a0..03ee3ff3cefa1 100644
+--- a/arch/ia64/kernel/Makefile
++++ b/arch/ia64/kernel/Makefile
+@@ -42,7 +42,7 @@ obj-y += esi_stub.o # must be in kernel proper
+ endif
+ obj-$(CONFIG_INTEL_IOMMU) += pci-dma.o
+
+-obj-$(CONFIG_BINFMT_ELF) += elfcore.o
++obj-$(CONFIG_ELF_CORE) += elfcore.o
+
+ # fp_emulate() expects f2-f5,f16-f31 to contain the user-level state.
+ CFLAGS_traps.o += -mfixed-range=f2-f5,f16-f31
+diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c
+index aa41bd5cf9b77..8207b897b49dd 100644
+--- a/arch/ia64/kernel/kprobes.c
++++ b/arch/ia64/kernel/kprobes.c
+@@ -409,83 +409,9 @@ static void kretprobe_trampoline(void)
+ {
+ }
+
+-/*
+- * At this point the target function has been tricked into
+- * returning into our trampoline. Lookup the associated instance
+- * and then:
+- * - call the handler function
+- * - cleanup by marking the instance as unused
+- * - long jump back to the original return address
+- */
+ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
+ {
+- struct kretprobe_instance *ri = NULL;
+- struct hlist_head *head, empty_rp;
+- struct hlist_node *tmp;
+- unsigned long flags, orig_ret_address = 0;
+- unsigned long trampoline_address =
+- ((struct fnptr *)kretprobe_trampoline)->ip;
+-
+- INIT_HLIST_HEAD(&empty_rp);
+- kretprobe_hash_lock(current, &head, &flags);
+-
+- /*
+- * It is possible to have multiple instances associated with a given
+- * task either because an multiple functions in the call path
+- * have a return probe installed on them, and/or more than one return
+- * return probe was registered for a target function.
+- *
+- * We can handle this because:
+- * - instances are always inserted at the head of the list
+- * - when multiple return probes are registered for the same
+- * function, the first instance's ret_addr will point to the
+- * real return address, and all the rest will point to
+- * kretprobe_trampoline
+- */
+- hlist_for_each_entry_safe(ri, tmp, head, hlist) {
+- if (ri->task != current)
+- /* another task is sharing our hash bucket */
+- continue;
+-
+- orig_ret_address = (unsigned long)ri->ret_addr;
+- if (orig_ret_address != trampoline_address)
+- /*
+- * This is the real return address. Any other
+- * instances associated with this task are for
+- * other calls deeper on the call stack
+- */
+- break;
+- }
+-
+- regs->cr_iip = orig_ret_address;
+-
+- hlist_for_each_entry_safe(ri, tmp, head, hlist) {
+- if (ri->task != current)
+- /* another task is sharing our hash bucket */
+- continue;
+-
+- if (ri->rp && ri->rp->handler)
+- ri->rp->handler(ri, regs);
+-
+- orig_ret_address = (unsigned long)ri->ret_addr;
+- recycle_rp_inst(ri, &empty_rp);
+-
+- if (orig_ret_address != trampoline_address)
+- /*
+- * This is the real return address. Any other
+- * instances associated with this task are for
+- * other calls deeper on the call stack
+- */
+- break;
+- }
+- kretprobe_assert(ri, orig_ret_address, trampoline_address);
+-
+- kretprobe_hash_unlock(current, &flags);
+-
+- hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
+- hlist_del(&ri->hlist);
+- kfree(ri);
+- }
++ regs->cr_iip = __kretprobe_trampoline_handler(regs, kretprobe_trampoline, NULL);
+ /*
+ * By returning a non-zero value, we are telling
+ * kprobe_handler() that we don't want the post_handler
+@@ -498,6 +424,7 @@ void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
+ struct pt_regs *regs)
+ {
+ ri->ret_addr = (kprobe_opcode_t *)regs->b0;
++ ri->fp = NULL;
+
+ /* Replace the return addr with trampoline addr */
+ regs->b0 = ((struct fnptr *)kretprobe_trampoline)->ip;
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index f38d153d25861..d18ea3c1f4fac 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -152,6 +152,7 @@ config PPC
+ select ARCH_USE_BUILTIN_BSWAP
+ select ARCH_USE_CMPXCHG_LOCKREF if PPC64
+ select ARCH_WANT_IPC_PARSE_VERSION
++ select ARCH_WANT_IRQS_OFF_ACTIVATE_MM
+ select ARCH_WEAK_RELEASE_ACQUIRE
+ select BINFMT_ELF
+ select BUILDTIME_EXTABLE_SORT
+@@ -1009,6 +1010,19 @@ config FSL_RIO
+
+ source "drivers/rapidio/Kconfig"
+
++config PPC_RTAS_FILTER
++ bool "Enable filtering of RTAS syscalls"
++ default y
++ depends on PPC_RTAS
++ help
++ The RTAS syscall API has security issues that could be used to
++ compromise system integrity. This option enforces restrictions on the
++ RTAS calls and arguments passed by userspace programs to mitigate
++ these issues.
++
++ Say Y unless you know what you are doing and the filter is causing
++ problems for you.
++
+ endmenu
+
+ config NONSTATIC_KERNEL
+diff --git a/arch/powerpc/include/asm/drmem.h b/arch/powerpc/include/asm/drmem.h
+index 668d8a121f1a0..8b196720e9a01 100644
+--- a/arch/powerpc/include/asm/drmem.h
++++ b/arch/powerpc/include/asm/drmem.h
+@@ -24,7 +24,7 @@ struct drmem_lmb {
+ struct drmem_lmb_info {
+ struct drmem_lmb *lmbs;
+ int n_lmbs;
+- u32 lmb_size;
++ u64 lmb_size;
+ };
+
+ extern struct drmem_lmb_info *drmem_info;
+@@ -83,7 +83,7 @@ struct of_drconf_cell_v2 {
+ #define DRCONF_MEM_AI_INVALID 0x00000040
+ #define DRCONF_MEM_RESERVED 0x00000080
+
+-static inline u32 drmem_lmb_size(void)
++static inline u64 drmem_lmb_size(void)
+ {
+ return drmem_info->lmb_size;
+ }
+diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
+index ae953958c0f33..d93bdcaa4a469 100644
+--- a/arch/powerpc/include/asm/mmu_context.h
++++ b/arch/powerpc/include/asm/mmu_context.h
+@@ -204,7 +204,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ */
+ static inline void activate_mm(struct mm_struct *prev, struct mm_struct *next)
+ {
+- switch_mm(prev, next, current);
++ switch_mm_irqs_off(prev, next, current);
+ }
+
+ /* We don't currently use enter_lazy_tlb() for anything */
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 95d1264ba7952..7e0722b62cae9 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -1057,6 +1057,147 @@ struct pseries_errorlog *get_pseries_errorlog(struct rtas_error_log *log,
+ return NULL;
+ }
+
++#ifdef CONFIG_PPC_RTAS_FILTER
++
++/*
++ * The sys_rtas syscall, as originally designed, allows root to pass
++ * arbitrary physical addresses to RTAS calls. A number of RTAS calls
++ * can be abused to write to arbitrary memory and do other things that
++ * are potentially harmful to system integrity, and thus should only
++ * be used inside the kernel and not exposed to userspace.
++ *
++ * All known legitimate users of the sys_rtas syscall will only ever
++ * pass addresses that fall within the RMO buffer, and use a known
++ * subset of RTAS calls.
++ *
++ * Accordingly, we filter RTAS requests to check that the call is
++ * permitted, and that provided pointers fall within the RMO buffer.
++ * The rtas_filters list contains an entry for each permitted call,
++ * with the indexes of the parameters which are expected to contain
++ * addresses and sizes of buffers allocated inside the RMO buffer.
++ */
++struct rtas_filter {
++ const char *name;
++ int token;
++ /* Indexes into the args buffer, -1 if not used */
++ int buf_idx1;
++ int size_idx1;
++ int buf_idx2;
++ int size_idx2;
++
++ int fixed_size;
++};
++
++static struct rtas_filter rtas_filters[] __ro_after_init = {
++ { "ibm,activate-firmware", -1, -1, -1, -1, -1 },
++ { "ibm,configure-connector", -1, 0, -1, 1, -1, 4096 }, /* Special cased */
++ { "display-character", -1, -1, -1, -1, -1 },
++ { "ibm,display-message", -1, 0, -1, -1, -1 },
++ { "ibm,errinjct", -1, 2, -1, -1, -1, 1024 },
++ { "ibm,close-errinjct", -1, -1, -1, -1, -1 },
++ { "ibm,open-errinct", -1, -1, -1, -1, -1 },
++ { "ibm,get-config-addr-info2", -1, -1, -1, -1, -1 },
++ { "ibm,get-dynamic-sensor-state", -1, 1, -1, -1, -1 },
++ { "ibm,get-indices", -1, 2, 3, -1, -1 },
++ { "get-power-level", -1, -1, -1, -1, -1 },
++ { "get-sensor-state", -1, -1, -1, -1, -1 },
++ { "ibm,get-system-parameter", -1, 1, 2, -1, -1 },
++ { "get-time-of-day", -1, -1, -1, -1, -1 },
++ { "ibm,get-vpd", -1, 0, -1, 1, 2 },
++ { "ibm,lpar-perftools", -1, 2, 3, -1, -1 },
++ { "ibm,platform-dump", -1, 4, 5, -1, -1 },
++ { "ibm,read-slot-reset-state", -1, -1, -1, -1, -1 },
++ { "ibm,scan-log-dump", -1, 0, 1, -1, -1 },
++ { "ibm,set-dynamic-indicator", -1, 2, -1, -1, -1 },
++ { "ibm,set-eeh-option", -1, -1, -1, -1, -1 },
++ { "set-indicator", -1, -1, -1, -1, -1 },
++ { "set-power-level", -1, -1, -1, -1, -1 },
++ { "set-time-for-power-on", -1, -1, -1, -1, -1 },
++ { "ibm,set-system-parameter", -1, 1, -1, -1, -1 },
++ { "set-time-of-day", -1, -1, -1, -1, -1 },
++ { "ibm,suspend-me", -1, -1, -1, -1, -1 },
++ { "ibm,update-nodes", -1, 0, -1, -1, -1, 4096 },
++ { "ibm,update-properties", -1, 0, -1, -1, -1, 4096 },
++ { "ibm,physical-attestation", -1, 0, 1, -1, -1 },
++};
++
++static bool in_rmo_buf(u32 base, u32 end)
++{
++ return base >= rtas_rmo_buf &&
++ base < (rtas_rmo_buf + RTAS_RMOBUF_MAX) &&
++ base <= end &&
++ end >= rtas_rmo_buf &&
++ end < (rtas_rmo_buf + RTAS_RMOBUF_MAX);
++}
++
++static bool block_rtas_call(int token, int nargs,
++ struct rtas_args *args)
++{
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(rtas_filters); i++) {
++ struct rtas_filter *f = &rtas_filters[i];
++ u32 base, size, end;
++
++ if (token != f->token)
++ continue;
++
++ if (f->buf_idx1 != -1) {
++ base = be32_to_cpu(args->args[f->buf_idx1]);
++ if (f->size_idx1 != -1)
++ size = be32_to_cpu(args->args[f->size_idx1]);
++ else if (f->fixed_size)
++ size = f->fixed_size;
++ else
++ size = 1;
++
++ end = base + size - 1;
++ if (!in_rmo_buf(base, end))
++ goto err;
++ }
++
++ if (f->buf_idx2 != -1) {
++ base = be32_to_cpu(args->args[f->buf_idx2]);
++ if (f->size_idx2 != -1)
++ size = be32_to_cpu(args->args[f->size_idx2]);
++ else if (f->fixed_size)
++ size = f->fixed_size;
++ else
++ size = 1;
++ end = base + size - 1;
++
++ /*
++ * Special case for ibm,configure-connector where the
++ * address can be 0
++ */
++ if (!strcmp(f->name, "ibm,configure-connector") &&
++ base == 0)
++ return false;
++
++ if (!in_rmo_buf(base, end))
++ goto err;
++ }
++
++ return false;
++ }
++
++err:
++ pr_err_ratelimited("sys_rtas: RTAS call blocked - exploit attempt?\n");
++ pr_err_ratelimited("sys_rtas: token=0x%x, nargs=%d (called by %s)\n",
++ token, nargs, current->comm);
++ return true;
++}
++
++#else
++
++static bool block_rtas_call(int token, int nargs,
++ struct rtas_args *args)
++{
++ return false;
++}
++
++#endif /* CONFIG_PPC_RTAS_FILTER */
++
+ /* We assume to be passed big endian arguments */
+ SYSCALL_DEFINE1(rtas, struct rtas_args __user *, uargs)
+ {
+@@ -1094,6 +1235,9 @@ SYSCALL_DEFINE1(rtas, struct rtas_args __user *, uargs)
+ args.rets = &args.args[nargs];
+ memset(args.rets, 0, nret * sizeof(rtas_arg_t));
+
++ if (block_rtas_call(token, nargs, &args))
++ return -EINVAL;
++
+ /* Need to handle ibm,suspend_me call specially */
+ if (token == ibm_suspend_me_token) {
+
+@@ -1155,6 +1299,9 @@ void __init rtas_initialize(void)
+ unsigned long rtas_region = RTAS_INSTANTIATE_MAX;
+ u32 base, size, entry;
+ int no_base, no_size, no_entry;
++#ifdef CONFIG_PPC_RTAS_FILTER
++ int i;
++#endif
+
+ /* Get RTAS dev node and fill up our "rtas" structure with infos
+ * about it.
+@@ -1190,6 +1337,12 @@ void __init rtas_initialize(void)
+ #ifdef CONFIG_RTAS_ERROR_LOGGING
+ rtas_last_error_token = rtas_token("rtas-last-error");
+ #endif
++
++#ifdef CONFIG_PPC_RTAS_FILTER
++ for (i = 0; i < ARRAY_SIZE(rtas_filters); i++) {
++ rtas_filters[i].token = rtas_token(rtas_filters[i].name);
++ }
++#endif
+ }
+
+ int __init early_init_dt_scan_rtas(unsigned long node,
+diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
+index 755dc98a57ae0..6b107de10ffa7 100644
+--- a/arch/powerpc/kernel/sysfs.c
++++ b/arch/powerpc/kernel/sysfs.c
+@@ -29,29 +29,27 @@
+
+ static DEFINE_PER_CPU(struct cpu, cpu_devices);
+
+-/*
+- * SMT snooze delay stuff, 64-bit only for now
+- */
+-
+ #ifdef CONFIG_PPC64
+
+-/* Time in microseconds we delay before sleeping in the idle loop */
+-static DEFINE_PER_CPU(long, smt_snooze_delay) = { 100 };
++/*
++ * Snooze delay has not been hooked up since 3fa8cad82b94 ("powerpc/pseries/cpuidle:
++ * smt-snooze-delay cleanup.") and has been broken even longer. As was foretold in
++ * 2014:
++ *
++ * "ppc64_util currently utilises it. Once we fix ppc64_util, propose to clean
++ * up the kernel code."
++ *
++ * powerpc-utils stopped using it as of 1.3.8. At some point in the future this
++ * code should be removed.
++ */
+
+ static ssize_t store_smt_snooze_delay(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf,
+ size_t count)
+ {
+- struct cpu *cpu = container_of(dev, struct cpu, dev);
+- ssize_t ret;
+- long snooze;
+-
+- ret = sscanf(buf, "%ld", &snooze);
+- if (ret != 1)
+- return -EINVAL;
+-
+- per_cpu(smt_snooze_delay, cpu->dev.id) = snooze;
++ pr_warn_once("%s (%d) stored to unsupported smt_snooze_delay, which has no effect.\n",
++ current->comm, current->pid);
+ return count;
+ }
+
+@@ -59,9 +57,9 @@ static ssize_t show_smt_snooze_delay(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- struct cpu *cpu = container_of(dev, struct cpu, dev);
+-
+- return sprintf(buf, "%ld\n", per_cpu(smt_snooze_delay, cpu->dev.id));
++ pr_warn_once("%s (%d) read from unsupported smt_snooze_delay\n",
++ current->comm, current->pid);
++ return sprintf(buf, "100\n");
+ }
+
+ static DEVICE_ATTR(smt_snooze_delay, 0644, show_smt_snooze_delay,
+@@ -69,16 +67,10 @@ static DEVICE_ATTR(smt_snooze_delay, 0644, show_smt_snooze_delay,
+
+ static int __init setup_smt_snooze_delay(char *str)
+ {
+- unsigned int cpu;
+- long snooze;
+-
+ if (!cpu_has_feature(CPU_FTR_SMT))
+ return 1;
+
+- snooze = simple_strtol(str, NULL, 10);
+- for_each_possible_cpu(cpu)
+- per_cpu(smt_snooze_delay, cpu) = snooze;
+-
++ pr_warn("smt-snooze-delay command line option has no effect\n");
+ return 1;
+ }
+ __setup("smt-snooze-delay=", setup_smt_snooze_delay);
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 7781f0168ce8c..1b2d84cb373bb 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -794,7 +794,7 @@ static void p9_hmi_special_emu(struct pt_regs *regs)
+ {
+ unsigned int ra, rb, t, i, sel, instr, rc;
+ const void __user *addr;
+- u8 vbuf[16], *vdst;
++ u8 vbuf[16] __aligned(16), *vdst;
+ unsigned long ea, msr, msr_mask;
+ bool swap;
+
+diff --git a/arch/powerpc/platforms/powernv/opal-elog.c b/arch/powerpc/platforms/powernv/opal-elog.c
+index ba6e437abb4bb..398a06631456f 100644
+--- a/arch/powerpc/platforms/powernv/opal-elog.c
++++ b/arch/powerpc/platforms/powernv/opal-elog.c
+@@ -183,14 +183,14 @@ static ssize_t raw_attr_read(struct file *filep, struct kobject *kobj,
+ return count;
+ }
+
+-static struct elog_obj *create_elog_obj(uint64_t id, size_t size, uint64_t type)
++static void create_elog_obj(uint64_t id, size_t size, uint64_t type)
+ {
+ struct elog_obj *elog;
+ int rc;
+
+ elog = kzalloc(sizeof(*elog), GFP_KERNEL);
+ if (!elog)
+- return NULL;
++ return;
+
+ elog->kobj.kset = elog_kset;
+
+@@ -223,18 +223,37 @@ static struct elog_obj *create_elog_obj(uint64_t id, size_t size, uint64_t type)
+ rc = kobject_add(&elog->kobj, NULL, "0x%llx", id);
+ if (rc) {
+ kobject_put(&elog->kobj);
+- return NULL;
++ return;
+ }
+
++ /*
++ * As soon as the sysfs file for this elog is created/activated there is
++ * a chance the opal_errd daemon (or any userspace) might read and
++ * acknowledge the elog before kobject_uevent() is called. If that
++ * happens then there is a potential race between
++ * elog_ack_store->kobject_put() and kobject_uevent() which leads to a
++ * use-after-free of a kernfs object resulting in a kernel crash.
++ *
++ * To avoid that, we need to take a reference on behalf of the bin file,
++ * so that our reference remains valid while we call kobject_uevent().
++ * We then drop our reference before exiting the function, leaving the
++ * bin file to drop the last reference (if it hasn't already).
++ */
++
++ /* Take a reference for the bin file */
++ kobject_get(&elog->kobj);
+ rc = sysfs_create_bin_file(&elog->kobj, &elog->raw_attr);
+- if (rc) {
++ if (rc == 0) {
++ kobject_uevent(&elog->kobj, KOBJ_ADD);
++ } else {
++ /* Drop the reference taken for the bin file */
+ kobject_put(&elog->kobj);
+- return NULL;
+ }
+
+- kobject_uevent(&elog->kobj, KOBJ_ADD);
++ /* Drop our reference */
++ kobject_put(&elog->kobj);
+
+- return elog;
++ return;
+ }
+
+ static irqreturn_t elog_event(int irq, void *data)
+diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
+index 8d49ba370c504..889c3dbec6fb9 100644
+--- a/arch/powerpc/platforms/powernv/smp.c
++++ b/arch/powerpc/platforms/powernv/smp.c
+@@ -47,7 +47,7 @@
+ #include <asm/udbg.h>
+ #define DBG(fmt...) udbg_printf(fmt)
+ #else
+-#define DBG(fmt...)
++#define DBG(fmt...) do { } while (0)
+ #endif
+
+ static void pnv_smp_setup_cpu(int cpu)
+diff --git a/arch/riscv/include/uapi/asm/auxvec.h b/arch/riscv/include/uapi/asm/auxvec.h
+index 1376515547cda..ed7bf7c7add5f 100644
+--- a/arch/riscv/include/uapi/asm/auxvec.h
++++ b/arch/riscv/include/uapi/asm/auxvec.h
+@@ -21,4 +21,7 @@
+ /* vDSO location */
+ #define AT_SYSINFO_EHDR 33
+
++/* entries in ARCH_DLINFO */
++#define AT_VECTOR_SIZE_ARCH 1
++
+ #endif /* _UAPI_ASM_RISCV_AUXVEC_H */
+diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
+index 8ea9db599d38d..11c32b228f518 100644
+--- a/arch/s390/kernel/time.c
++++ b/arch/s390/kernel/time.c
+@@ -354,8 +354,9 @@ static DEFINE_PER_CPU(atomic_t, clock_sync_word);
+ static DEFINE_MUTEX(clock_sync_mutex);
+ static unsigned long clock_sync_flags;
+
+-#define CLOCK_SYNC_HAS_STP 0
+-#define CLOCK_SYNC_STP 1
++#define CLOCK_SYNC_HAS_STP 0
++#define CLOCK_SYNC_STP 1
++#define CLOCK_SYNC_STPINFO_VALID 2
+
+ /*
+ * The get_clock function for the physical clock. It will get the current
+@@ -592,6 +593,22 @@ void stp_queue_work(void)
+ queue_work(time_sync_wq, &stp_work);
+ }
+
++static int __store_stpinfo(void)
++{
++ int rc = chsc_sstpi(stp_page, &stp_info, sizeof(struct stp_sstpi));
++
++ if (rc)
++ clear_bit(CLOCK_SYNC_STPINFO_VALID, &clock_sync_flags);
++ else
++ set_bit(CLOCK_SYNC_STPINFO_VALID, &clock_sync_flags);
++ return rc;
++}
++
++static int stpinfo_valid(void)
++{
++ return stp_online && test_bit(CLOCK_SYNC_STPINFO_VALID, &clock_sync_flags);
++}
++
+ static int stp_sync_clock(void *data)
+ {
+ struct clock_sync_data *sync = data;
+@@ -613,8 +630,7 @@ static int stp_sync_clock(void *data)
+ if (rc == 0) {
+ sync->clock_delta = clock_delta;
+ clock_sync_global(clock_delta);
+- rc = chsc_sstpi(stp_page, &stp_info,
+- sizeof(struct stp_sstpi));
++ rc = __store_stpinfo();
+ if (rc == 0 && stp_info.tmd != 2)
+ rc = -EAGAIN;
+ }
+@@ -659,7 +675,7 @@ static void stp_work_fn(struct work_struct *work)
+ if (rc)
+ goto out_unlock;
+
+- rc = chsc_sstpi(stp_page, &stp_info, sizeof(struct stp_sstpi));
++ rc = __store_stpinfo();
+ if (rc || stp_info.c == 0)
+ goto out_unlock;
+
+@@ -696,10 +712,14 @@ static ssize_t stp_ctn_id_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- if (!stp_online)
+- return -ENODATA;
+- return sprintf(buf, "%016llx\n",
+- *(unsigned long long *) stp_info.ctnid);
++ ssize_t ret = -ENODATA;
++
++ mutex_lock(&stp_work_mutex);
++ if (stpinfo_valid())
++ ret = sprintf(buf, "%016llx\n",
++ *(unsigned long long *) stp_info.ctnid);
++ mutex_unlock(&stp_work_mutex);
++ return ret;
+ }
+
+ static DEVICE_ATTR(ctn_id, 0400, stp_ctn_id_show, NULL);
+@@ -708,9 +728,13 @@ static ssize_t stp_ctn_type_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- if (!stp_online)
+- return -ENODATA;
+- return sprintf(buf, "%i\n", stp_info.ctn);
++ ssize_t ret = -ENODATA;
++
++ mutex_lock(&stp_work_mutex);
++ if (stpinfo_valid())
++ ret = sprintf(buf, "%i\n", stp_info.ctn);
++ mutex_unlock(&stp_work_mutex);
++ return ret;
+ }
+
+ static DEVICE_ATTR(ctn_type, 0400, stp_ctn_type_show, NULL);
+@@ -719,9 +743,13 @@ static ssize_t stp_dst_offset_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- if (!stp_online || !(stp_info.vbits & 0x2000))
+- return -ENODATA;
+- return sprintf(buf, "%i\n", (int)(s16) stp_info.dsto);
++ ssize_t ret = -ENODATA;
++
++ mutex_lock(&stp_work_mutex);
++ if (stpinfo_valid() && (stp_info.vbits & 0x2000))
++ ret = sprintf(buf, "%i\n", (int)(s16) stp_info.dsto);
++ mutex_unlock(&stp_work_mutex);
++ return ret;
+ }
+
+ static DEVICE_ATTR(dst_offset, 0400, stp_dst_offset_show, NULL);
+@@ -730,9 +758,13 @@ static ssize_t stp_leap_seconds_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- if (!stp_online || !(stp_info.vbits & 0x8000))
+- return -ENODATA;
+- return sprintf(buf, "%i\n", (int)(s16) stp_info.leaps);
++ ssize_t ret = -ENODATA;
++
++ mutex_lock(&stp_work_mutex);
++ if (stpinfo_valid() && (stp_info.vbits & 0x8000))
++ ret = sprintf(buf, "%i\n", (int)(s16) stp_info.leaps);
++ mutex_unlock(&stp_work_mutex);
++ return ret;
+ }
+
+ static DEVICE_ATTR(leap_seconds, 0400, stp_leap_seconds_show, NULL);
+@@ -741,9 +773,13 @@ static ssize_t stp_stratum_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- if (!stp_online)
+- return -ENODATA;
+- return sprintf(buf, "%i\n", (int)(s16) stp_info.stratum);
++ ssize_t ret = -ENODATA;
++
++ mutex_lock(&stp_work_mutex);
++ if (stpinfo_valid())
++ ret = sprintf(buf, "%i\n", (int)(s16) stp_info.stratum);
++ mutex_unlock(&stp_work_mutex);
++ return ret;
+ }
+
+ static DEVICE_ATTR(stratum, 0400, stp_stratum_show, NULL);
+@@ -752,9 +788,13 @@ static ssize_t stp_time_offset_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- if (!stp_online || !(stp_info.vbits & 0x0800))
+- return -ENODATA;
+- return sprintf(buf, "%i\n", (int) stp_info.tto);
++ ssize_t ret = -ENODATA;
++
++ mutex_lock(&stp_work_mutex);
++ if (stpinfo_valid() && (stp_info.vbits & 0x0800))
++ ret = sprintf(buf, "%i\n", (int) stp_info.tto);
++ mutex_unlock(&stp_work_mutex);
++ return ret;
+ }
+
+ static DEVICE_ATTR(time_offset, 0400, stp_time_offset_show, NULL);
+@@ -763,9 +803,13 @@ static ssize_t stp_time_zone_offset_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- if (!stp_online || !(stp_info.vbits & 0x4000))
+- return -ENODATA;
+- return sprintf(buf, "%i\n", (int)(s16) stp_info.tzo);
++ ssize_t ret = -ENODATA;
++
++ mutex_lock(&stp_work_mutex);
++ if (stpinfo_valid() && (stp_info.vbits & 0x4000))
++ ret = sprintf(buf, "%i\n", (int)(s16) stp_info.tzo);
++ mutex_unlock(&stp_work_mutex);
++ return ret;
+ }
+
+ static DEVICE_ATTR(time_zone_offset, 0400,
+@@ -775,9 +819,13 @@ static ssize_t stp_timing_mode_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- if (!stp_online)
+- return -ENODATA;
+- return sprintf(buf, "%i\n", stp_info.tmd);
++ ssize_t ret = -ENODATA;
++
++ mutex_lock(&stp_work_mutex);
++ if (stpinfo_valid())
++ ret = sprintf(buf, "%i\n", stp_info.tmd);
++ mutex_unlock(&stp_work_mutex);
++ return ret;
+ }
+
+ static DEVICE_ATTR(timing_mode, 0400, stp_timing_mode_show, NULL);
+@@ -786,9 +834,13 @@ static ssize_t stp_timing_state_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- if (!stp_online)
+- return -ENODATA;
+- return sprintf(buf, "%i\n", stp_info.tst);
++ ssize_t ret = -ENODATA;
++
++ mutex_lock(&stp_work_mutex);
++ if (stpinfo_valid())
++ ret = sprintf(buf, "%i\n", stp_info.tst);
++ mutex_unlock(&stp_work_mutex);
++ return ret;
+ }
+
+ static DEVICE_ATTR(timing_state, 0400, stp_timing_state_show, NULL);
+diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
+index d3ea1f3c06a00..a7d7b7ade42fc 100644
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -1039,38 +1039,9 @@ void smp_fetch_global_pmu(void)
+ * are flush_tlb_*() routines, and these run after flush_cache_*()
+ * which performs the flushw.
+ *
+- * The SMP TLB coherency scheme we use works as follows:
+- *
+- * 1) mm->cpu_vm_mask is a bit mask of which cpus an address
+- * space has (potentially) executed on, this is the heuristic
+- * we use to avoid doing cross calls.
+- *
+- * Also, for flushing from kswapd and also for clones, we
+- * use cpu_vm_mask as the list of cpus to make run the TLB.
+- *
+- * 2) TLB context numbers are shared globally across all processors
+- * in the system, this allows us to play several games to avoid
+- * cross calls.
+- *
+- * One invariant is that when a cpu switches to a process, and
+- * that processes tsk->active_mm->cpu_vm_mask does not have the
+- * current cpu's bit set, that tlb context is flushed locally.
+- *
+- * If the address space is non-shared (ie. mm->count == 1) we avoid
+- * cross calls when we want to flush the currently running process's
+- * tlb state. This is done by clearing all cpu bits except the current
+- * processor's in current->mm->cpu_vm_mask and performing the
+- * flush locally only. This will force any subsequent cpus which run
+- * this task to flush the context from the local tlb if the process
+- * migrates to another cpu (again).
+- *
+- * 3) For shared address spaces (threads) and swapping we bite the
+- * bullet for most cases and perform the cross call (but only to
+- * the cpus listed in cpu_vm_mask).
+- *
+- * The performance gain from "optimizing" away the cross call for threads is
+- * questionable (in theory the big win for threads is the massive sharing of
+- * address space state across processors).
++ * mm->cpu_vm_mask is a bit mask of which cpus an address
++ * space has (potentially) executed on, this is the heuristic
++ * we use to limit cross calls.
+ */
+
+ /* This currently is only used by the hugetlb arch pre-fault
+@@ -1080,18 +1051,13 @@ void smp_fetch_global_pmu(void)
+ void smp_flush_tlb_mm(struct mm_struct *mm)
+ {
+ u32 ctx = CTX_HWBITS(mm->context);
+- int cpu = get_cpu();
+
+- if (atomic_read(&mm->mm_users) == 1) {
+- cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
+- goto local_flush_and_out;
+- }
++ get_cpu();
+
+ smp_cross_call_masked(&xcall_flush_tlb_mm,
+ ctx, 0, 0,
+ mm_cpumask(mm));
+
+-local_flush_and_out:
+ __flush_tlb_mm(ctx, SECONDARY_CONTEXT);
+
+ put_cpu();
+@@ -1114,17 +1080,15 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long
+ {
+ u32 ctx = CTX_HWBITS(mm->context);
+ struct tlb_pending_info info;
+- int cpu = get_cpu();
++
++ get_cpu();
+
+ info.ctx = ctx;
+ info.nr = nr;
+ info.vaddrs = vaddrs;
+
+- if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
+- cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
+- else
+- smp_call_function_many(mm_cpumask(mm), tlb_pending_func,
+- &info, 1);
++ smp_call_function_many(mm_cpumask(mm), tlb_pending_func,
++ &info, 1);
+
+ __flush_tlb_pending(ctx, nr, vaddrs);
+
+@@ -1134,14 +1098,13 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long
+ void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
+ {
+ unsigned long context = CTX_HWBITS(mm->context);
+- int cpu = get_cpu();
+
+- if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
+- cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
+- else
+- smp_cross_call_masked(&xcall_flush_tlb_page,
+- context, vaddr, 0,
+- mm_cpumask(mm));
++ get_cpu();
++
++ smp_cross_call_masked(&xcall_flush_tlb_page,
++ context, vaddr, 0,
++ mm_cpumask(mm));
++
+ __flush_tlb_page(context, vaddr);
+
+ put_cpu();
+diff --git a/arch/um/kernel/sigio.c b/arch/um/kernel/sigio.c
+index b5e0cbb343828..476ded92affac 100644
+--- a/arch/um/kernel/sigio.c
++++ b/arch/um/kernel/sigio.c
+@@ -36,14 +36,14 @@ int write_sigio_irq(int fd)
+ }
+
+ /* These are called from os-Linux/sigio.c to protect its pollfds arrays. */
+-static DEFINE_SPINLOCK(sigio_spinlock);
++static DEFINE_MUTEX(sigio_mutex);
+
+ void sigio_lock(void)
+ {
+- spin_lock(&sigio_spinlock);
++ mutex_lock(&sigio_mutex);
+ }
+
+ void sigio_unlock(void)
+ {
+- spin_unlock(&sigio_spinlock);
++ mutex_unlock(&sigio_mutex);
+ }
+diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
+index 07bf5517d9d8b..2410bd4bb48f3 100644
+--- a/arch/x86/events/amd/ibs.c
++++ b/arch/x86/events/amd/ibs.c
+@@ -89,6 +89,7 @@ struct perf_ibs {
+ u64 max_period;
+ unsigned long offset_mask[1];
+ int offset_max;
++ unsigned int fetch_count_reset_broken : 1;
+ struct cpu_perf_ibs __percpu *pcpu;
+
+ struct attribute **format_attrs;
+@@ -346,11 +347,15 @@ static u64 get_ibs_op_count(u64 config)
+ {
+ u64 count = 0;
+
++ /*
++ * If the internal 27-bit counter rolled over, the count is MaxCnt
++ * and the lower 7 bits of CurCnt are randomized.
++ * Otherwise CurCnt has the full 27-bit current counter value.
++ */
+ if (config & IBS_OP_VAL)
+- count += (config & IBS_OP_MAX_CNT) << 4; /* cnt rolled over */
+-
+- if (ibs_caps & IBS_CAPS_RDWROPCNT)
+- count += (config & IBS_OP_CUR_CNT) >> 32;
++ count = (config & IBS_OP_MAX_CNT) << 4;
++ else if (ibs_caps & IBS_CAPS_RDWROPCNT)
++ count = (config & IBS_OP_CUR_CNT) >> 32;
+
+ return count;
+ }
+@@ -375,7 +380,12 @@ perf_ibs_event_update(struct perf_ibs *perf_ibs, struct perf_event *event,
+ static inline void perf_ibs_enable_event(struct perf_ibs *perf_ibs,
+ struct hw_perf_event *hwc, u64 config)
+ {
+- wrmsrl(hwc->config_base, hwc->config | config | perf_ibs->enable_mask);
++ u64 tmp = hwc->config | config;
++
++ if (perf_ibs->fetch_count_reset_broken)
++ wrmsrl(hwc->config_base, tmp & ~perf_ibs->enable_mask);
++
++ wrmsrl(hwc->config_base, tmp | perf_ibs->enable_mask);
+ }
+
+ /*
+@@ -637,18 +647,24 @@ fail:
+ perf_ibs->offset_max,
+ offset + 1);
+ } while (offset < offset_max);
++ /*
++ * Read IbsBrTarget, IbsOpData4, and IbsExtdCtl separately
++ * depending on their availability.
++ * Can't add to offset_max as they are staggered
++ */
+ if (event->attr.sample_type & PERF_SAMPLE_RAW) {
+- /*
+- * Read IbsBrTarget and IbsOpData4 separately
+- * depending on their availability.
+- * Can't add to offset_max as they are staggered
+- */
+- if (ibs_caps & IBS_CAPS_BRNTRGT) {
+- rdmsrl(MSR_AMD64_IBSBRTARGET, *buf++);
+- size++;
++ if (perf_ibs == &perf_ibs_op) {
++ if (ibs_caps & IBS_CAPS_BRNTRGT) {
++ rdmsrl(MSR_AMD64_IBSBRTARGET, *buf++);
++ size++;
++ }
++ if (ibs_caps & IBS_CAPS_OPDATA4) {
++ rdmsrl(MSR_AMD64_IBSOPDATA4, *buf++);
++ size++;
++ }
+ }
+- if (ibs_caps & IBS_CAPS_OPDATA4) {
+- rdmsrl(MSR_AMD64_IBSOPDATA4, *buf++);
++ if (perf_ibs == &perf_ibs_fetch && (ibs_caps & IBS_CAPS_FETCHCTLEXTD)) {
++ rdmsrl(MSR_AMD64_ICIBSEXTDCTL, *buf++);
+ size++;
+ }
+ }
+@@ -744,6 +760,13 @@ static __init void perf_event_ibs_init(void)
+ {
+ struct attribute **attr = ibs_op_format_attrs;
+
++ /*
++ * Some chips fail to reset the fetch count when it is written; instead
++ * they need a 0-1 transition of IbsFetchEn.
++ */
++ if (boot_cpu_data.x86 >= 0x16 && boot_cpu_data.x86 <= 0x18)
++ perf_ibs_fetch.fetch_count_reset_broken = 1;
++
+ perf_ibs_pmu_init(&perf_ibs_fetch, "ibs_fetch");
+
+ if (ibs_caps & IBS_CAPS_OPCNT) {
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 5bb11a8c245ea..892af8ab95d70 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -377,6 +377,7 @@
+ #define MSR_AMD64_IBSOP_REG_MASK ((1UL<<MSR_AMD64_IBSOP_REG_COUNT)-1)
+ #define MSR_AMD64_IBSCTL 0xc001103a
+ #define MSR_AMD64_IBSBRTARGET 0xc001103b
++#define MSR_AMD64_ICIBSEXTDCTL 0xc001103c
+ #define MSR_AMD64_IBSOPDATA4 0xc001103d
+ #define MSR_AMD64_IBS_REG_COUNT_MAX 8 /* includes MSR_AMD64_IBSBRTARGET */
+ #define MSR_AMD64_SEV 0xc0010131
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 1d264ba1e56d1..8fa9ca3c3bd7f 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -300,19 +300,12 @@ EXPORT_SYMBOL_GPL(unwind_get_return_address);
+
+ unsigned long *unwind_get_return_address_ptr(struct unwind_state *state)
+ {
+- struct task_struct *task = state->task;
+-
+ if (unwind_done(state))
+ return NULL;
+
+ if (state->regs)
+ return &state->regs->ip;
+
+- if (task != current && state->sp == task->thread.sp) {
+- struct inactive_task_frame *frame = (void *)task->thread.sp;
+- return &frame->ret_addr;
+- }
+-
+ if (state->sp)
+ return (unsigned long *)state->sp - 1;
+
+@@ -634,7 +627,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ } else {
+ struct inactive_task_frame *frame = (void *)task->thread.sp;
+
+- state->sp = task->thread.sp;
++ state->sp = task->thread.sp + sizeof(*frame);
+ state->bp = READ_ONCE_NOCHECK(frame->bp);
+ state->ip = READ_ONCE_NOCHECK(frame->ret_addr);
+ state->signal = (void *)state->ip == ret_from_fork;
+diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
+index 43867bc853687..eea5a0f3b959b 100644
+--- a/arch/x86/pci/intel_mid_pci.c
++++ b/arch/x86/pci/intel_mid_pci.c
+@@ -33,6 +33,7 @@
+ #include <asm/hw_irq.h>
+ #include <asm/io_apic.h>
+ #include <asm/intel-mid.h>
++#include <asm/acpi.h>
+
+ #define PCIE_CAP_OFFSET 0x100
+
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 76864ea591605..9f8995cd28f65 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -1383,6 +1383,15 @@ asmlinkage __visible void __init xen_start_kernel(void)
+ x86_init.mpparse.get_smp_config = x86_init_uint_noop;
+
+ xen_boot_params_init_edd();
++
++#ifdef CONFIG_ACPI
++ /*
++ * Disable selecting "Firmware First mode" for correctable
++ * memory errors, as this is the duty of the hypervisor to
++ * decide.
++ */
++ acpi_disable_cmcff = 1;
++#endif
+ }
+
+ if (!boot_params.screen_info.orig_video_isVGA)
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 445b878e35194..ce3710404544c 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -2127,10 +2127,11 @@ static void handle_bad_sector(struct bio *bio, sector_t maxsector)
+ {
+ char b[BDEVNAME_SIZE];
+
+- pr_info_ratelimited("attempt to access beyond end of device\n"
+- "%s: rw=%d, want=%llu, limit=%llu\n",
+- bio_devname(bio, b), bio->bi_opf,
+- bio_end_sector(bio), maxsector);
++ printk(KERN_INFO "attempt to access beyond end of device\n");
++ printk(KERN_INFO "%s: rw=%d, want=%Lu, limit=%Lu\n",
++ bio_devname(bio, b), bio->bi_opf,
++ (unsigned long long)bio_end_sector(bio),
++ (long long)maxsector);
+ }
+
+ #ifdef CONFIG_FAIL_MAKE_REQUEST
+diff --git a/drivers/acpi/acpi_dbg.c b/drivers/acpi/acpi_dbg.c
+index f21c99ec46ee0..ed19d9822bc08 100644
+--- a/drivers/acpi/acpi_dbg.c
++++ b/drivers/acpi/acpi_dbg.c
+@@ -757,6 +757,9 @@ int __init acpi_aml_init(void)
+ goto err_exit;
+ }
+
++ if (acpi_disabled)
++ return -ENODEV;
++
+ /* Initialize AML IO interface */
+ mutex_init(&acpi_aml_io.lock);
+ init_waitqueue_head(&acpi_aml_io.wait);
+diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
+index 560fdae8cc590..943b1dc2d0b3c 100644
+--- a/drivers/acpi/acpi_extlog.c
++++ b/drivers/acpi/acpi_extlog.c
+@@ -224,9 +224,9 @@ static int __init extlog_init(void)
+ u64 cap;
+ int rc;
+
+- rdmsrl(MSR_IA32_MCG_CAP, cap);
+-
+- if (!(cap & MCG_ELOG_P) || !extlog_get_l1addr())
++ if (rdmsrl_safe(MSR_IA32_MCG_CAP, &cap) ||
++ !(cap & MCG_ELOG_P) ||
++ !extlog_get_l1addr())
+ return -ENODEV;
+
+ if (edac_get_report_status() == EDAC_REPORTING_FORCE) {
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index d5c19e25ddf59..f43f5adc21b61 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -149,6 +149,7 @@ struct acpi_button {
+ int last_state;
+ ktime_t last_time;
+ bool suspended;
++ bool lid_state_initialized;
+ };
+
+ static BLOCKING_NOTIFIER_HEAD(acpi_lid_notifier);
+@@ -404,6 +405,8 @@ static int acpi_lid_update_state(struct acpi_device *device,
+
+ static void acpi_lid_initialize_state(struct acpi_device *device)
+ {
++ struct acpi_button *button = acpi_driver_data(device);
++
+ switch (lid_init_state) {
+ case ACPI_BUTTON_LID_INIT_OPEN:
+ (void)acpi_lid_notify_state(device, 1);
+@@ -415,13 +418,14 @@ static void acpi_lid_initialize_state(struct acpi_device *device)
+ default:
+ break;
+ }
++
++ button->lid_state_initialized = true;
+ }
+
+ static void acpi_button_notify(struct acpi_device *device, u32 event)
+ {
+ struct acpi_button *button = acpi_driver_data(device);
+ struct input_dev *input;
+- int users;
+
+ switch (event) {
+ case ACPI_FIXED_HARDWARE_EVENT:
+@@ -430,10 +434,7 @@ static void acpi_button_notify(struct acpi_device *device, u32 event)
+ case ACPI_BUTTON_NOTIFY_STATUS:
+ input = button->input;
+ if (button->type == ACPI_BUTTON_TYPE_LID) {
+- mutex_lock(&button->input->mutex);
+- users = button->input->users;
+- mutex_unlock(&button->input->mutex);
+- if (users)
++ if (button->lid_state_initialized)
+ acpi_lid_update_state(device, true);
+ } else {
+ int keycode;
+@@ -478,7 +479,7 @@ static int acpi_button_resume(struct device *dev)
+ struct acpi_button *button = acpi_driver_data(device);
+
+ button->suspended = false;
+- if (button->type == ACPI_BUTTON_TYPE_LID && button->input->users) {
++ if (button->type == ACPI_BUTTON_TYPE_LID) {
+ button->last_state = !!acpi_lid_evaluate_state(device);
+ button->last_time = ktime_get();
+ acpi_lid_initialize_state(device);
+diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
+index 0da58f0bf7e59..a28ff3cfbc296 100644
+--- a/drivers/acpi/numa.c
++++ b/drivers/acpi/numa.c
+@@ -46,7 +46,7 @@ int acpi_numa __initdata;
+
+ int pxm_to_node(int pxm)
+ {
+- if (pxm < 0)
++ if (pxm < 0 || pxm >= MAX_PXM_DOMAINS || numa_off)
+ return NUMA_NO_NODE;
+ return pxm_to_node_map[pxm];
+ }
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index ab1da5e6e7e3e..86ffb4af4afca 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -274,6 +274,15 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "530U4E/540U4E"),
+ },
+ },
++ /* https://bugs.launchpad.net/bugs/1894667 */
++ {
++ .callback = video_detect_force_video,
++ .ident = "HP 635 Notebook",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP 635 Notebook PC"),
++ },
++ },
+
+ /* Non win8 machines which need native backlight nevertheless */
+ {
+diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
+index 798d549435cc1..2248a40631bf1 100644
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -2122,7 +2122,7 @@ static int nv_swncq_sdbfis(struct ata_port *ap)
+ pp->dhfis_bits &= ~done_mask;
+ pp->dmafis_bits &= ~done_mask;
+ pp->sdbfis_bits |= done_mask;
+- ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask);
++ ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask);
+
+ if (!ap->qc_active) {
+ DPRINTK("over\n");
+diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
+index 8323f88d17a53..4dcdf8ee0055c 100644
+--- a/drivers/ata/sata_rcar.c
++++ b/drivers/ata/sata_rcar.c
+@@ -124,7 +124,7 @@
+ /* Descriptor table word 0 bit (when DTA32M = 1) */
+ #define SATA_RCAR_DTEND BIT(0)
+
+-#define SATA_RCAR_DMA_BOUNDARY 0x1FFFFFFEUL
++#define SATA_RCAR_DMA_BOUNDARY 0x1FFFFFFFUL
+
+ /* Gen2 Physical Layer Control Registers */
+ #define RCAR_GEN2_PHY_CTL1_REG 0x1704
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index b911c38ad18ca..f0cdf38ed31c9 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -3333,6 +3333,7 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode)
+ */
+ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
+ {
++ struct device *parent = dev->parent;
+ struct fwnode_handle *fn = dev->fwnode;
+
+ if (fwnode) {
+@@ -3347,7 +3348,8 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
+ } else {
+ if (fwnode_is_primary(fn)) {
+ dev->fwnode = fn->secondary;
+- fn->secondary = NULL;
++ if (!(parent && fn == parent->fwnode))
++ fn->secondary = ERR_PTR(-ENODEV);
+ } else {
+ dev->fwnode = NULL;
+ }
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index d7c7232e438c9..52e1e71e81241 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -740,9 +740,9 @@ static void recv_work(struct work_struct *work)
+
+ blk_mq_complete_request(blk_mq_rq_from_pdu(cmd));
+ }
++ nbd_config_put(nbd);
+ atomic_dec(&config->recv_threads);
+ wake_up(&config->recv_wq);
+- nbd_config_put(nbd);
+ kfree(args);
+ }
+
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index 3666afa639d1a..b18f0162cb9c4 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -202,7 +202,7 @@ static inline void shrink_free_pagepool(struct xen_blkif_ring *ring, int num)
+
+ #define vaddr(page) ((unsigned long)pfn_to_kaddr(page_to_pfn(page)))
+
+-static int do_block_io_op(struct xen_blkif_ring *ring);
++static int do_block_io_op(struct xen_blkif_ring *ring, unsigned int *eoi_flags);
+ static int dispatch_rw_block_io(struct xen_blkif_ring *ring,
+ struct blkif_request *req,
+ struct pending_req *pending_req);
+@@ -615,6 +615,8 @@ int xen_blkif_schedule(void *arg)
+ struct xen_vbd *vbd = &blkif->vbd;
+ unsigned long timeout;
+ int ret;
++ bool do_eoi;
++ unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
+
+ set_freezable();
+ while (!kthread_should_stop()) {
+@@ -639,16 +641,23 @@ int xen_blkif_schedule(void *arg)
+ if (timeout == 0)
+ goto purge_gnt_list;
+
++ do_eoi = ring->waiting_reqs;
++
+ ring->waiting_reqs = 0;
+ smp_mb(); /* clear flag *before* checking for work */
+
+- ret = do_block_io_op(ring);
++ ret = do_block_io_op(ring, &eoi_flags);
+ if (ret > 0)
+ ring->waiting_reqs = 1;
+ if (ret == -EACCES)
+ wait_event_interruptible(ring->shutdown_wq,
+ kthread_should_stop());
+
++ if (do_eoi && !ring->waiting_reqs) {
++ xen_irq_lateeoi(ring->irq, eoi_flags);
++ eoi_flags |= XEN_EOI_FLAG_SPURIOUS;
++ }
++
+ purge_gnt_list:
+ if (blkif->vbd.feature_gnt_persistent &&
+ time_after(jiffies, ring->next_lru)) {
+@@ -1121,7 +1130,7 @@ static void end_block_io_op(struct bio *bio)
+ * and transmute it to the block API to hand it over to the proper block disk.
+ */
+ static int
+-__do_block_io_op(struct xen_blkif_ring *ring)
++__do_block_io_op(struct xen_blkif_ring *ring, unsigned int *eoi_flags)
+ {
+ union blkif_back_rings *blk_rings = &ring->blk_rings;
+ struct blkif_request req;
+@@ -1144,6 +1153,9 @@ __do_block_io_op(struct xen_blkif_ring *ring)
+ if (RING_REQUEST_CONS_OVERFLOW(&blk_rings->common, rc))
+ break;
+
++ /* We've seen a request, so clear spurious eoi flag. */
++ *eoi_flags &= ~XEN_EOI_FLAG_SPURIOUS;
++
+ if (kthread_should_stop()) {
+ more_to_do = 1;
+ break;
+@@ -1202,13 +1214,13 @@ done:
+ }
+
+ static int
+-do_block_io_op(struct xen_blkif_ring *ring)
++do_block_io_op(struct xen_blkif_ring *ring, unsigned int *eoi_flags)
+ {
+ union blkif_back_rings *blk_rings = &ring->blk_rings;
+ int more_to_do;
+
+ do {
+- more_to_do = __do_block_io_op(ring);
++ more_to_do = __do_block_io_op(ring, eoi_flags);
+ if (more_to_do)
+ break;
+
+diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
+index 25c41ce070a7f..93896c992245b 100644
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -237,9 +237,8 @@ static int xen_blkif_map(struct xen_blkif_ring *ring, grant_ref_t *gref,
+ BUG();
+ }
+
+- err = bind_interdomain_evtchn_to_irqhandler(blkif->domid, evtchn,
+- xen_blkif_be_int, 0,
+- "blkif-backend", ring);
++ err = bind_interdomain_evtchn_to_irqhandler_lateeoi(blkif->domid,
++ evtchn, xen_blkif_be_int, 0, "blkif-backend", ring);
+ if (err < 0) {
+ xenbus_unmap_ring_vfree(blkif->be->dev, ring->blk_ring);
+ ring->blk_rings.common.sring = NULL;
+diff --git a/drivers/bus/fsl-mc/mc-io.c b/drivers/bus/fsl-mc/mc-io.c
+index 7226cfc49b6fd..3f806599748a4 100644
+--- a/drivers/bus/fsl-mc/mc-io.c
++++ b/drivers/bus/fsl-mc/mc-io.c
+@@ -129,7 +129,12 @@ error_destroy_mc_io:
+ */
+ void fsl_destroy_mc_io(struct fsl_mc_io *mc_io)
+ {
+- struct fsl_mc_device *dpmcp_dev = mc_io->dpmcp_dev;
++ struct fsl_mc_device *dpmcp_dev;
++
++ if (!mc_io)
++ return;
++
++ dpmcp_dev = mc_io->dpmcp_dev;
+
+ if (dpmcp_dev)
+ fsl_mc_io_unset_dpmcp(mc_io);
+diff --git a/drivers/clk/ti/clockdomain.c b/drivers/clk/ti/clockdomain.c
+index 07a805125e98c..11d92311e162f 100644
+--- a/drivers/clk/ti/clockdomain.c
++++ b/drivers/clk/ti/clockdomain.c
+@@ -146,10 +146,12 @@ static void __init of_ti_clockdomain_setup(struct device_node *node)
+ if (clk_hw_get_flags(clk_hw) & CLK_IS_BASIC) {
+ pr_warn("can't setup clkdm for basic clk %s\n",
+ __clk_get_name(clk));
++ clk_put(clk);
+ continue;
+ }
+ to_clk_hw_omap(clk_hw)->clkdm_name = clkdm_name;
+ omap2_init_clk_clkdm(clk_hw);
++ clk_put(clk);
+ }
+ }
+
+diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
+index aca30f45172e6..9e86404a361f5 100644
+--- a/drivers/cpufreq/acpi-cpufreq.c
++++ b/drivers/cpufreq/acpi-cpufreq.c
+@@ -701,7 +701,8 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ cpumask_copy(policy->cpus, topology_core_cpumask(cpu));
+ }
+
+- if (check_amd_hwpstate_cpu(cpu) && !acpi_pstate_strict) {
++ if (check_amd_hwpstate_cpu(cpu) && boot_cpu_data.x86 < 0x19 &&
++ !acpi_pstate_strict) {
+ cpumask_clear(policy->cpus);
+ cpumask_set_cpu(cpu, policy->cpus);
+ cpumask_copy(data->freqdomain_cpus,
+diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c
+index 47105735df126..6b5d241c30b70 100644
+--- a/drivers/cpufreq/sti-cpufreq.c
++++ b/drivers/cpufreq/sti-cpufreq.c
+@@ -144,7 +144,8 @@ static const struct reg_field sti_stih407_dvfs_regfields[DVFS_MAX_REGFIELDS] = {
+ static const struct reg_field *sti_cpufreq_match(void)
+ {
+ if (of_machine_is_compatible("st,stih407") ||
+- of_machine_is_compatible("st,stih410"))
++ of_machine_is_compatible("st,stih410") ||
++ of_machine_is_compatible("st,stih418"))
+ return sti_stih407_dvfs_regfields;
+
+ return NULL;
+@@ -261,7 +262,8 @@ static int sti_cpufreq_init(void)
+ int ret;
+
+ if ((!of_machine_is_compatible("st,stih407")) &&
+- (!of_machine_is_compatible("st,stih410")))
++ (!of_machine_is_compatible("st,stih410")) &&
++ (!of_machine_is_compatible("st,stih418")))
+ return -ENODEV;
+
+ ddata.cpu = get_cpu_device(0);
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index f1ca66147c287..f7334c42ebd9e 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -696,14 +696,13 @@ static int chtls_pass_open_rpl(struct chtls_dev *cdev, struct sk_buff *skb)
+ if (rpl->status != CPL_ERR_NONE) {
+ pr_info("Unexpected PASS_OPEN_RPL status %u for STID %u\n",
+ rpl->status, stid);
+- return CPL_RET_BUF_DONE;
++ } else {
++ cxgb4_free_stid(cdev->tids, stid, listen_ctx->lsk->sk_family);
++ sock_put(listen_ctx->lsk);
++ kfree(listen_ctx);
++ module_put(THIS_MODULE);
+ }
+- cxgb4_free_stid(cdev->tids, stid, listen_ctx->lsk->sk_family);
+- sock_put(listen_ctx->lsk);
+- kfree(listen_ctx);
+- module_put(THIS_MODULE);
+-
+- return 0;
++ return CPL_RET_BUF_DONE;
+ }
+
+ static int chtls_close_listsrv_rpl(struct chtls_dev *cdev, struct sk_buff *skb)
+@@ -720,15 +719,13 @@ static int chtls_close_listsrv_rpl(struct chtls_dev *cdev, struct sk_buff *skb)
+ if (rpl->status != CPL_ERR_NONE) {
+ pr_info("Unexpected CLOSE_LISTSRV_RPL status %u for STID %u\n",
+ rpl->status, stid);
+- return CPL_RET_BUF_DONE;
++ } else {
++ cxgb4_free_stid(cdev->tids, stid, listen_ctx->lsk->sk_family);
++ sock_put(listen_ctx->lsk);
++ kfree(listen_ctx);
++ module_put(THIS_MODULE);
+ }
+-
+- cxgb4_free_stid(cdev->tids, stid, listen_ctx->lsk->sk_family);
+- sock_put(listen_ctx->lsk);
+- kfree(listen_ctx);
+- module_put(THIS_MODULE);
+-
+- return 0;
++ return CPL_RET_BUF_DONE;
+ }
+
+ static void chtls_purge_wr_queue(struct sock *sk)
+@@ -1348,7 +1345,6 @@ static void add_to_reap_list(struct sock *sk)
+ struct chtls_sock *csk = sk->sk_user_data;
+
+ local_bh_disable();
+- bh_lock_sock(sk);
+ release_tcp_port(sk); /* release the port immediately */
+
+ spin_lock(&reap_list_lock);
+@@ -1357,7 +1353,6 @@ static void add_to_reap_list(struct sock *sk)
+ if (!csk->passive_reap_next)
+ schedule_work(&reap_task);
+ spin_unlock(&reap_list_lock);
+- bh_unlock_sock(sk);
+ local_bh_enable();
+ }
+
+diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c
+index e9573e7f9e803..f9874da23a29b 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_io.c
++++ b/drivers/crypto/chelsio/chtls/chtls_io.c
+@@ -1549,6 +1549,7 @@ skip_copy:
+ tp->urg_data = 0;
+
+ if ((avail + offset) >= skb->len) {
++ struct sk_buff *next_skb;
+ if (ULP_SKB_CB(skb)->flags & ULPCB_FLAG_TLS_HDR) {
+ tp->copied_seq += skb->len;
+ hws->rcvpld = skb->hdr_len;
+@@ -1558,8 +1559,10 @@ skip_copy:
+ chtls_free_skb(sk, skb);
+ buffers_freed++;
+ hws->copied_seq = 0;
+- if (copied >= target &&
+- !skb_peek(&sk->sk_receive_queue))
++ next_skb = skb_peek(&sk->sk_receive_queue);
++ if (copied >= target && !next_skb)
++ break;
++ if (ULP_SKB_CB(next_skb)->flags & ULPCB_FLAG_TLS_HDR)
+ break;
+ }
+ } while (len > 0);
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index edff93aacad36..0d0850b35e452 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -574,11 +574,11 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
+ enum dma_status status;
+ unsigned long flags;
+
++ spin_lock_irqsave(&jzchan->vchan.lock, flags);
++
+ status = dma_cookie_status(chan, cookie, txstate);
+ if ((status == DMA_COMPLETE) || (txstate == NULL))
+- return status;
+-
+- spin_lock_irqsave(&jzchan->vchan.lock, flags);
++ goto out_unlock_irqrestore;
+
+ vdesc = vchan_find_desc(&jzchan->vchan, cookie);
+ if (vdesc) {
+@@ -595,6 +595,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
+ && jzchan->desc->status & (JZ_DMA_DCS_AR | JZ_DMA_DCS_HLT))
+ status = DMA_ERROR;
+
++out_unlock_irqrestore:
+ spin_unlock_irqrestore(&jzchan->vchan.lock, flags);
+ return status;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+index 71792d820ae0c..0db05ff4a652a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+@@ -563,6 +563,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+ struct ww_acquire_ctx ticket;
+ struct list_head list, duplicates;
+ uint64_t va_flags;
++ uint64_t vm_size;
+ int r = 0;
+
+ if (args->va_address < AMDGPU_VA_RESERVED_SIZE) {
+@@ -583,6 +584,15 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
+
+ args->va_address &= AMDGPU_VA_HOLE_MASK;
+
++ vm_size = adev->vm_manager.max_pfn * AMDGPU_GPU_PAGE_SIZE;
++ vm_size -= AMDGPU_VA_RESERVED_SIZE;
++ if (args->va_address + args->map_size > vm_size) {
++ dev_dbg(&dev->pdev->dev,
++ "va_address 0x%llx is in top reserved area 0x%llx\n",
++ args->va_address + args->map_size, vm_size);
++ return -EINVAL;
++ }
++
+ if ((args->flags & ~valid_flags) && (args->flags & ~prt_flags)) {
+ dev_dbg(&dev->pdev->dev, "invalid flags combination 0x%08X\n",
+ args->flags);
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 2fb2c683ad54b..fa0e6c8e2447c 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -2009,7 +2009,7 @@ enum dc_status dc_link_validate_mode_timing(
+ /* A hack to avoid failing any modes for EDID override feature on
+ * topology change such as lower quality cable for DP or different dongle
+ */
+- if (link->remote_sinks[0])
++ if (link->remote_sinks[0] && link->remote_sinks[0]->sink_signal == SIGNAL_TYPE_VIRTUAL)
+ return DC_OK;
+
+ /* Passive Dongle */
+diff --git a/drivers/gpu/drm/amd/display/dc/os_types.h b/drivers/gpu/drm/amd/display/dc/os_types.h
+index a407892905af2..d4cb7db891921 100644
+--- a/drivers/gpu/drm/amd/display/dc/os_types.h
++++ b/drivers/gpu/drm/amd/display/dc/os_types.h
+@@ -57,7 +57,7 @@
+ * general debug capabilities
+ *
+ */
+-#if defined(CONFIG_HAVE_KGDB) || defined(CONFIG_KGDB)
++#if defined(CONFIG_DEBUG_KERNEL_DC) && (defined(CONFIG_HAVE_KGDB) || defined(CONFIG_KGDB))
+ #define ASSERT_CRITICAL(expr) do { \
+ if (WARN_ON(!(expr))) { \
+ kgdb_breakpoint(); \
+diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
+index 2136c97aeb8ec..dcf091f9d843f 100644
+--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
++++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
+@@ -306,8 +306,12 @@ static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c,
+ const struct i2c_device_id *id)
+ {
+ struct device *dev = &stdp4028_i2c->dev;
++ int ret;
++
++ ret = ge_b850v3_lvds_init(dev);
+
+- ge_b850v3_lvds_init(dev);
++ if (ret)
++ return ret;
+
+ ge_b850v3_lvds_ptr->stdp4028_i2c = stdp4028_i2c;
+ i2c_set_clientdata(stdp4028_i2c, ge_b850v3_lvds_ptr);
+@@ -365,8 +369,12 @@ static int stdp2690_ge_b850v3_fw_probe(struct i2c_client *stdp2690_i2c,
+ const struct i2c_device_id *id)
+ {
+ struct device *dev = &stdp2690_i2c->dev;
++ int ret;
++
++ ret = ge_b850v3_lvds_init(dev);
+
+- ge_b850v3_lvds_init(dev);
++ if (ret)
++ return ret;
+
+ ge_b850v3_lvds_ptr->stdp2690_i2c = stdp2690_i2c;
+ i2c_set_clientdata(stdp2690_i2c, ge_b850v3_lvds_ptr);
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
+index fd7999642cf8a..8b5f9241a8876 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c
+@@ -326,7 +326,6 @@ static void dw_mipi_message_config(struct dw_mipi_dsi *dsi,
+ if (lpm)
+ val |= CMD_MODE_ALL_LP;
+
+- dsi_write(dsi, DSI_LPCLK_CTRL, lpm ? 0 : PHY_TXREQUESTCLKHS);
+ dsi_write(dsi, DSI_CMD_MODE_CFG, val);
+ }
+
+@@ -488,16 +487,22 @@ static void dw_mipi_dsi_video_mode_config(struct dw_mipi_dsi *dsi)
+ static void dw_mipi_dsi_set_mode(struct dw_mipi_dsi *dsi,
+ unsigned long mode_flags)
+ {
++ u32 val;
++
+ dsi_write(dsi, DSI_PWR_UP, RESET);
+
+ if (mode_flags & MIPI_DSI_MODE_VIDEO) {
+ dsi_write(dsi, DSI_MODE_CFG, ENABLE_VIDEO_MODE);
+ dw_mipi_dsi_video_mode_config(dsi);
+- dsi_write(dsi, DSI_LPCLK_CTRL, PHY_TXREQUESTCLKHS);
+ } else {
+ dsi_write(dsi, DSI_MODE_CFG, ENABLE_CMD_MODE);
+ }
+
++ val = PHY_TXREQUESTCLKHS;
++ if (dsi->mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS)
++ val |= AUTO_CLKLANE_CTRL;
++ dsi_write(dsi, DSI_LPCLK_CTRL, val);
++
+ dsi_write(dsi, DSI_PWR_UP, POWERUP);
+ }
+
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index db2e9af49ae6f..37c80cfecd097 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -33,6 +33,8 @@
+ #include <uapi/drm/i915_drm.h>
+ #include <uapi/drm/drm_fourcc.h>
+
++#include <asm/hypervisor.h>
++
+ #include <linux/io-mapping.h>
+ #include <linux/i2c.h>
+ #include <linux/i2c-algo-bit.h>
+@@ -2683,7 +2685,9 @@ static inline bool intel_vtd_active(void)
+ if (intel_iommu_gfx_mapped)
+ return true;
+ #endif
+- return false;
++
++ /* Running as a guest, we assume the host is enforcing VT'd */
++ return !hypervisor_is_type(X86_HYPER_NATIVE);
+ }
+
+ static inline bool intel_scanout_needs_vtd_wa(struct drm_i915_private *dev_priv)
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 268f5a3b31224..81e076662c7a9 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -671,7 +671,7 @@ bool ttm_bo_eviction_valuable(struct ttm_buffer_object *bo,
+ /* Don't evict this BO if it's outside of the
+ * requested placement range
+ */
+- if (place->fpfn >= (bo->mem.start + bo->mem.size) ||
++ if (place->fpfn >= (bo->mem.start + bo->mem.num_pages) ||
+ (place->lpfn && place->lpfn <= bo->mem.start))
+ return false;
+
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 77bb46948eea8..da83884b90d25 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2729,7 +2729,9 @@ static int wacom_wac_collection(struct hid_device *hdev, struct hid_report *repo
+ if (report->type != HID_INPUT_REPORT)
+ return -1;
+
+- if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input)
++ if (WACOM_PAD_FIELD(field))
++ return 0;
++ else if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input)
+ wacom_wac_pen_report(hdev, report);
+ else if (WACOM_FINGER_FIELD(field) && wacom->wacom_wac.touch_input)
+ wacom_wac_finger_report(hdev, report);
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index d4b72e4ffd71f..0e7f9bd17a91a 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -1101,14 +1101,6 @@ static int i2c_imx_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- /* Request IRQ */
+- ret = devm_request_irq(&pdev->dev, irq, i2c_imx_isr, IRQF_SHARED,
+- pdev->name, i2c_imx);
+- if (ret) {
+- dev_err(&pdev->dev, "can't claim irq %d\n", irq);
+- goto clk_disable;
+- }
+-
+ /* Init queue */
+ init_waitqueue_head(&i2c_imx->queue);
+
+@@ -1127,6 +1119,14 @@ static int i2c_imx_probe(struct platform_device *pdev)
+ if (ret < 0)
+ goto rpm_disable;
+
++ /* Request IRQ */
++ ret = request_threaded_irq(irq, i2c_imx_isr, NULL, IRQF_SHARED,
++ pdev->name, i2c_imx);
++ if (ret) {
++ dev_err(&pdev->dev, "can't claim irq %d\n", irq);
++ goto rpm_disable;
++ }
++
+ /* Set up clock divider */
+ i2c_imx->bitrate = IMX_I2C_BIT_RATE;
+ ret = of_property_read_u32(pdev->dev.of_node,
+@@ -1169,13 +1169,12 @@ static int i2c_imx_probe(struct platform_device *pdev)
+
+ clk_notifier_unregister:
+ clk_notifier_unregister(i2c_imx->clk, &i2c_imx->clk_change_nb);
++ free_irq(irq, i2c_imx);
+ rpm_disable:
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ pm_runtime_set_suspended(&pdev->dev);
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
+-
+-clk_disable:
+ clk_disable_unprepare(i2c_imx->clk);
+ return ret;
+ }
+@@ -1183,7 +1182,7 @@ clk_disable:
+ static int i2c_imx_remove(struct platform_device *pdev)
+ {
+ struct imx_i2c_struct *i2c_imx = platform_get_drvdata(pdev);
+- int ret;
++ int irq, ret;
+
+ ret = pm_runtime_get_sync(&pdev->dev);
+ if (ret < 0)
+@@ -1203,6 +1202,9 @@ static int i2c_imx_remove(struct platform_device *pdev)
+ imx_i2c_write_reg(0, i2c_imx, IMX_I2C_I2SR);
+
+ clk_notifier_unregister(i2c_imx->clk, &i2c_imx->clk_change_nb);
++ irq = platform_get_irq(pdev, 0);
++ if (irq >= 0)
++ free_irq(irq, i2c_imx);
+ clk_disable_unprepare(i2c_imx->clk);
+
+ pm_runtime_put_noidle(&pdev->dev);
+diff --git a/drivers/iio/adc/ti-adc0832.c b/drivers/iio/adc/ti-adc0832.c
+index 188dae705bf72..a408d97e2d2ea 100644
+--- a/drivers/iio/adc/ti-adc0832.c
++++ b/drivers/iio/adc/ti-adc0832.c
+@@ -31,6 +31,12 @@ struct adc0832 {
+ struct regulator *reg;
+ struct mutex lock;
+ u8 mux_bits;
++ /*
++ * Max size needed: 16x 1 byte ADC data + 8 bytes timestamp
++ * May be shorter if not all channels are enabled subject
++ * to the timestamp remaining 8 byte aligned.
++ */
++ u8 data[24] __aligned(8);
+
+ u8 tx_buf[2] ____cacheline_aligned;
+ u8 rx_buf[2];
+@@ -202,7 +208,6 @@ static irqreturn_t adc0832_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct adc0832 *adc = iio_priv(indio_dev);
+- u8 data[24] = { }; /* 16x 1 byte ADC data + 8 bytes timestamp */
+ int scan_index;
+ int i = 0;
+
+@@ -220,10 +225,10 @@ static irqreturn_t adc0832_trigger_handler(int irq, void *p)
+ goto out;
+ }
+
+- data[i] = ret;
++ adc->data[i] = ret;
+ i++;
+ }
+- iio_push_to_buffers_with_timestamp(indio_dev, data,
++ iio_push_to_buffers_with_timestamp(indio_dev, adc->data,
+ iio_get_time_ns(indio_dev));
+ out:
+ mutex_unlock(&adc->lock);
+diff --git a/drivers/iio/adc/ti-adc12138.c b/drivers/iio/adc/ti-adc12138.c
+index 703d68ae96b71..4517d7742bc35 100644
+--- a/drivers/iio/adc/ti-adc12138.c
++++ b/drivers/iio/adc/ti-adc12138.c
+@@ -50,6 +50,12 @@ struct adc12138 {
+ struct completion complete;
+ /* The number of cclk periods for the S/H's acquisition time */
+ unsigned int acquisition_time;
++ /*
++ * Maximum size needed: 16x 2 bytes ADC data + 8 bytes timestamp.
++ * Less may be need if not all channels are enabled, as long as
++ * the 8 byte alignment of the timestamp is maintained.
++ */
++ __be16 data[20] __aligned(8);
+
+ u8 tx_buf[2] ____cacheline_aligned;
+ u8 rx_buf[2];
+@@ -332,7 +338,6 @@ static irqreturn_t adc12138_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct adc12138 *adc = iio_priv(indio_dev);
+- __be16 data[20] = { }; /* 16x 2 bytes ADC data + 8 bytes timestamp */
+ __be16 trash;
+ int ret;
+ int scan_index;
+@@ -348,7 +353,7 @@ static irqreturn_t adc12138_trigger_handler(int irq, void *p)
+ reinit_completion(&adc->complete);
+
+ ret = adc12138_start_and_read_conv(adc, scan_chan,
+- i ? &data[i - 1] : &trash);
++ i ? &adc->data[i - 1] : &trash);
+ if (ret) {
+ dev_warn(&adc->spi->dev,
+ "failed to start conversion\n");
+@@ -365,7 +370,7 @@ static irqreturn_t adc12138_trigger_handler(int irq, void *p)
+ }
+
+ if (i) {
+- ret = adc12138_read_conv_data(adc, &data[i - 1]);
++ ret = adc12138_read_conv_data(adc, &adc->data[i - 1]);
+ if (ret) {
+ dev_warn(&adc->spi->dev,
+ "failed to get conversion data\n");
+@@ -373,7 +378,7 @@ static irqreturn_t adc12138_trigger_handler(int irq, void *p)
+ }
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data,
++ iio_push_to_buffers_with_timestamp(indio_dev, adc->data,
+ iio_get_time_ns(indio_dev));
+ out:
+ mutex_unlock(&adc->lock);
+diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c
+index 59770e5b66602..b080362a87669 100644
+--- a/drivers/iio/gyro/itg3200_buffer.c
++++ b/drivers/iio/gyro/itg3200_buffer.c
+@@ -49,13 +49,20 @@ static irqreturn_t itg3200_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct itg3200 *st = iio_priv(indio_dev);
+- __be16 buf[ITG3200_SCAN_ELEMENTS + sizeof(s64)/sizeof(u16)];
+-
+- int ret = itg3200_read_all_channels(st->i2c, buf);
++ /*
++ * Ensure correct alignment and padding including for the
++ * timestamp that may be inserted.
++ */
++ struct {
++ __be16 buf[ITG3200_SCAN_ELEMENTS];
++ s64 ts __aligned(8);
++ } scan;
++
++ int ret = itg3200_read_all_channels(st->i2c, scan.buf);
+ if (ret < 0)
+ goto error_ret;
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buf, pf->timestamp);
++ iio_push_to_buffers_with_timestamp(indio_dev, &scan, pf->timestamp);
+
+ iio_trigger_notify_done(indio_dev->trig);
+
+diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c
+index 76f16f9c76164..31f78fd7f9153 100644
+--- a/drivers/iio/light/si1145.c
++++ b/drivers/iio/light/si1145.c
+@@ -172,6 +172,7 @@ struct si1145_part_info {
+ * @part_info: Part information
+ * @trig: Pointer to iio trigger
+ * @meas_rate: Value of MEAS_RATE register. Only set in HW in auto mode
++ * @buffer: Used to pack data read from sensor.
+ */
+ struct si1145_data {
+ struct i2c_client *client;
+@@ -183,6 +184,14 @@ struct si1145_data {
+ bool autonomous;
+ struct iio_trigger *trig;
+ int meas_rate;
++ /*
++ * Ensure timestamp will be naturally aligned if present.
++ * Maximum buffer size (may be only partly used if not all
++ * channels are enabled):
++ * 6*2 bytes channels data + 4 bytes alignment +
++ * 8 bytes timestamp
++ */
++ u8 buffer[24] __aligned(8);
+ };
+
+ /**
+@@ -444,12 +453,6 @@ static irqreturn_t si1145_trigger_handler(int irq, void *private)
+ struct iio_poll_func *pf = private;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct si1145_data *data = iio_priv(indio_dev);
+- /*
+- * Maximum buffer size:
+- * 6*2 bytes channels data + 4 bytes alignment +
+- * 8 bytes timestamp
+- */
+- u8 buffer[24];
+ int i, j = 0;
+ int ret;
+ u8 irq_status = 0;
+@@ -482,7 +485,7 @@ static irqreturn_t si1145_trigger_handler(int irq, void *private)
+
+ ret = i2c_smbus_read_i2c_block_data_or_emulated(
+ data->client, indio_dev->channels[i].address,
+- sizeof(u16) * run, &buffer[j]);
++ sizeof(u16) * run, &data->buffer[j]);
+ if (ret < 0)
+ goto done;
+ j += run * sizeof(u16);
+@@ -497,7 +500,7 @@ static irqreturn_t si1145_trigger_handler(int irq, void *private)
+ goto done;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
+ iio_get_time_ns(indio_dev));
+
+ done:
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index df8f5ceea2dd4..30385ba7c5d9b 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -571,13 +571,12 @@ static void process_one_req(struct work_struct *_work)
+ req->callback = NULL;
+
+ spin_lock_bh(&lock);
++ /*
++ * Although the work will normally have been canceled by the workqueue,
++ * it can still be requeued as long as it is on the req_list.
++ */
++ cancel_delayed_work(&req->work);
+ if (!list_empty(&req->list)) {
+- /*
+- * Although the work will normally have been canceled by the
+- * workqueue, it can still be requeued as long as it is on the
+- * req_list.
+- */
+- cancel_delayed_work(&req->work);
+ list_del_init(&req->list);
+ kfree(req);
+ }
+diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+index e908dfbaa1378..1f1d6a000e5c9 100644
+--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c
++++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+@@ -677,6 +677,7 @@ int qedr_iw_destroy_listen(struct iw_cm_id *cm_id)
+ listener->qed_handle);
+
+ cm_id->rem_ref(cm_id);
++ kfree(listener);
+ return rc;
+ }
+
+diff --git a/drivers/input/serio/hil_mlc.c b/drivers/input/serio/hil_mlc.c
+index e1423f7648d61..4c039e4125d92 100644
+--- a/drivers/input/serio/hil_mlc.c
++++ b/drivers/input/serio/hil_mlc.c
+@@ -74,7 +74,7 @@ EXPORT_SYMBOL(hil_mlc_unregister);
+ static LIST_HEAD(hil_mlcs);
+ static DEFINE_RWLOCK(hil_mlcs_lock);
+ static struct timer_list hil_mlcs_kicker;
+-static int hil_mlcs_probe;
++static int hil_mlcs_probe, hil_mlc_stop;
+
+ static void hil_mlcs_process(unsigned long unused);
+ static DECLARE_TASKLET_DISABLED(hil_mlcs_tasklet, hil_mlcs_process, 0);
+@@ -702,9 +702,13 @@ static int hilse_donode(hil_mlc *mlc)
+ if (!mlc->ostarted) {
+ mlc->ostarted = 1;
+ mlc->opacket = pack;
+- mlc->out(mlc);
++ rc = mlc->out(mlc);
+ nextidx = HILSEN_DOZE;
+ write_unlock_irqrestore(&mlc->lock, flags);
++ if (rc) {
++ hil_mlc_stop = 1;
++ return 1;
++ }
+ break;
+ }
+ mlc->ostarted = 0;
+@@ -715,8 +719,13 @@ static int hilse_donode(hil_mlc *mlc)
+
+ case HILSE_CTS:
+ write_lock_irqsave(&mlc->lock, flags);
+- nextidx = mlc->cts(mlc) ? node->bad : node->good;
++ rc = mlc->cts(mlc);
++ nextidx = rc ? node->bad : node->good;
+ write_unlock_irqrestore(&mlc->lock, flags);
++ if (rc) {
++ hil_mlc_stop = 1;
++ return 1;
++ }
+ break;
+
+ default:
+@@ -780,6 +789,12 @@ static void hil_mlcs_process(unsigned long unused)
+
+ static void hil_mlcs_timer(struct timer_list *unused)
+ {
++ if (hil_mlc_stop) {
++ /* could not send packet - stop immediately. */
++ pr_warn(PREFIX "HIL seems stuck - Disabling HIL MLC.\n");
++ return;
++ }
++
+ hil_mlcs_probe = 1;
+ tasklet_schedule(&hil_mlcs_tasklet);
+ /* Re-insert the periodic task. */
+diff --git a/drivers/input/serio/hp_sdc_mlc.c b/drivers/input/serio/hp_sdc_mlc.c
+index 232d30c825bd1..3e85e90393746 100644
+--- a/drivers/input/serio/hp_sdc_mlc.c
++++ b/drivers/input/serio/hp_sdc_mlc.c
+@@ -210,7 +210,7 @@ static int hp_sdc_mlc_cts(hil_mlc *mlc)
+ priv->tseq[2] = 1;
+ priv->tseq[3] = 0;
+ priv->tseq[4] = 0;
+- __hp_sdc_enqueue_transaction(&priv->trans);
++ return __hp_sdc_enqueue_transaction(&priv->trans);
+ busy:
+ return 1;
+ done:
+@@ -219,7 +219,7 @@ static int hp_sdc_mlc_cts(hil_mlc *mlc)
+ return 0;
+ }
+
+-static void hp_sdc_mlc_out(hil_mlc *mlc)
++static int hp_sdc_mlc_out(hil_mlc *mlc)
+ {
+ struct hp_sdc_mlc_priv_s *priv;
+
+@@ -234,7 +234,7 @@ static void hp_sdc_mlc_out(hil_mlc *mlc)
+ do_data:
+ if (priv->emtestmode) {
+ up(&mlc->osem);
+- return;
++ return 0;
+ }
+ /* Shouldn't be sending commands when loop may be busy */
+ BUG_ON(down_trylock(&mlc->csem));
+@@ -296,7 +296,7 @@ static void hp_sdc_mlc_out(hil_mlc *mlc)
+ BUG_ON(down_trylock(&mlc->csem));
+ }
+ enqueue:
+- hp_sdc_enqueue_transaction(&priv->trans);
++ return hp_sdc_enqueue_transaction(&priv->trans);
+ }
+
+ static int __init hp_sdc_mlc_init(void)
+diff --git a/drivers/leds/leds-bcm6328.c b/drivers/leds/leds-bcm6328.c
+index 2cfd9389ee96f..b944ae828004a 100644
+--- a/drivers/leds/leds-bcm6328.c
++++ b/drivers/leds/leds-bcm6328.c
+@@ -336,7 +336,7 @@ static int bcm6328_led(struct device *dev, struct device_node *nc, u32 reg,
+ led->cdev.brightness_set = bcm6328_led_set;
+ led->cdev.blink_set = bcm6328_blink_set;
+
+- rc = led_classdev_register(dev, &led->cdev);
++ rc = devm_led_classdev_register(dev, &led->cdev);
+ if (rc < 0)
+ return rc;
+
+diff --git a/drivers/leds/leds-bcm6358.c b/drivers/leds/leds-bcm6358.c
+index b2cc06618abed..a86ab6197a4ea 100644
+--- a/drivers/leds/leds-bcm6358.c
++++ b/drivers/leds/leds-bcm6358.c
+@@ -141,7 +141,7 @@ static int bcm6358_led(struct device *dev, struct device_node *nc, u32 reg,
+
+ led->cdev.brightness_set = bcm6358_led_set;
+
+- rc = led_classdev_register(dev, &led->cdev);
++ rc = devm_led_classdev_register(dev, &led->cdev);
+ if (rc < 0)
+ return rc;
+
+diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
+index fd8607124bdbb..503f5e06fa86f 100644
+--- a/drivers/md/md-bitmap.c
++++ b/drivers/md/md-bitmap.c
+@@ -1371,7 +1371,7 @@ __acquires(bitmap->lock)
+ if (bitmap->bp[page].hijacked ||
+ bitmap->bp[page].map == NULL)
+ csize = ((sector_t)1) << (bitmap->chunkshift +
+- PAGE_COUNTER_SHIFT - 1);
++ PAGE_COUNTER_SHIFT);
+ else
+ csize = ((sector_t)1) << bitmap->chunkshift;
+ *blocks = csize - (offset & (csize - 1));
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index d91154d654550..c7bda4b0bcedf 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2417,8 +2417,6 @@ static int resize_stripes(struct r5conf *conf, int newsize)
+ } else
+ err = -ENOMEM;
+
+- mutex_unlock(&conf->cache_size_mutex);
+-
+ conf->slab_cache = sc;
+ conf->active_name = 1-conf->active_name;
+
+@@ -2441,6 +2439,8 @@ static int resize_stripes(struct r5conf *conf, int newsize)
+
+ if (!err)
+ conf->pool_size = newsize;
++ mutex_unlock(&conf->cache_size_mutex);
++
+ return err;
+ }
+
+diff --git a/drivers/media/i2c/imx274.c b/drivers/media/i2c/imx274.c
+index 8cc3bdb7f608c..0fe8b869245b8 100644
+--- a/drivers/media/i2c/imx274.c
++++ b/drivers/media/i2c/imx274.c
+@@ -1239,6 +1239,8 @@ static int imx274_s_frame_interval(struct v4l2_subdev *sd,
+ ret = imx274_set_frame_interval(imx274, fi->interval);
+
+ if (!ret) {
++ fi->interval = imx274->frame_interval;
++
+ /*
+ * exposure time range is decided by frame interval
+ * need to update it after frame interval changes
+@@ -1760,9 +1762,9 @@ static int imx274_set_frame_interval(struct stimx274 *priv,
+ __func__, frame_interval.numerator,
+ frame_interval.denominator);
+
+- if (frame_interval.numerator == 0) {
+- err = -EINVAL;
+- goto fail;
++ if (frame_interval.numerator == 0 || frame_interval.denominator == 0) {
++ frame_interval.denominator = IMX274_DEF_FRAME_RATE;
++ frame_interval.numerator = 1;
+ }
+
+ req_frame_rate = (u32)(frame_interval.denominator
+diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
+index 6c40e60ac9939..b0f8d1532b700 100644
+--- a/drivers/media/pci/tw5864/tw5864-video.c
++++ b/drivers/media/pci/tw5864/tw5864-video.c
+@@ -776,6 +776,9 @@ static int tw5864_enum_frameintervals(struct file *file, void *priv,
+ fintv->type = V4L2_FRMIVAL_TYPE_STEPWISE;
+
+ ret = tw5864_frameinterval_get(input, &frameinterval);
++ if (ret)
++ return ret;
++
+ fintv->stepwise.step = frameinterval;
+ fintv->stepwise.min = frameinterval;
+ fintv->stepwise.max = frameinterval;
+@@ -794,6 +797,9 @@ static int tw5864_g_parm(struct file *file, void *priv,
+ cp->capability = V4L2_CAP_TIMEPERFRAME;
+
+ ret = tw5864_frameinterval_get(input, &cp->timeperframe);
++ if (ret)
++ return ret;
++
+ cp->timeperframe.numerator *= input->frame_interval;
+ cp->capturemode = 0;
+ cp->readbuffers = 2;
+diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+index 11429633b2fbc..f0bca30a0a805 100644
+--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
++++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+@@ -579,6 +579,13 @@ static int mtk_jpeg_queue_setup(struct vb2_queue *q,
+ if (!q_data)
+ return -EINVAL;
+
++ if (*num_planes) {
++ for (i = 0; i < *num_planes; i++)
++ if (sizes[i] < q_data->sizeimage[i])
++ return -EINVAL;
++ return 0;
++ }
++
+ *num_planes = q_data->fmt->colplanes;
+ for (i = 0; i < q_data->fmt->colplanes; i++) {
+ sizes[i] = q_data->sizeimage[i];
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
+index abfc49901222e..cb6046481aed3 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -1853,30 +1853,35 @@ int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
+ {
+ struct uvc_entity *entity;
+ struct uvc_control *ctrl;
+- unsigned int i, found = 0;
++ unsigned int i;
++ bool found;
+ u32 reqflags;
+ u16 size;
+ u8 *data = NULL;
+ int ret;
+
+ /* Find the extension unit. */
++ found = false;
+ list_for_each_entry(entity, &chain->entities, chain) {
+ if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT &&
+- entity->id == xqry->unit)
++ entity->id == xqry->unit) {
++ found = true;
+ break;
++ }
+ }
+
+- if (entity->id != xqry->unit) {
++ if (!found) {
+ uvc_trace(UVC_TRACE_CONTROL, "Extension unit %u not found.\n",
+ xqry->unit);
+ return -ENOENT;
+ }
+
+ /* Find the control and perform delayed initialization if needed. */
++ found = false;
+ for (i = 0; i < entity->ncontrols; ++i) {
+ ctrl = &entity->controls[i];
+ if (ctrl->index == xqry->selector - 1) {
+- found = 1;
++ found = true;
+ break;
+ }
+ }
+@@ -2033,13 +2038,6 @@ static int uvc_ctrl_add_info(struct uvc_device *dev, struct uvc_control *ctrl,
+ goto done;
+ }
+
+- /*
+- * Retrieve control flags from the device. Ignore errors and work with
+- * default flag values from the uvc_ctrl array when the device doesn't
+- * properly implement GET_INFO on standard controls.
+- */
+- uvc_ctrl_get_flags(dev, ctrl, &ctrl->info);
+-
+ ctrl->initialized = 1;
+
+ uvc_trace(UVC_TRACE_CONTROL, "Added control %pUl/%u to device %s "
+@@ -2262,6 +2260,13 @@ static void uvc_ctrl_init_ctrl(struct uvc_device *dev, struct uvc_control *ctrl)
+ if (uvc_entity_match_guid(ctrl->entity, info->entity) &&
+ ctrl->index == info->index) {
+ uvc_ctrl_add_info(dev, ctrl, info);
++ /*
++ * Retrieve control flags from the device. Ignore errors
++ * and work with default flag values from the uvc_ctrl
++ * array when the device doesn't properly implement
++ * GET_INFO on standard controls.
++ */
++ uvc_ctrl_get_flags(dev, ctrl, &ctrl->info);
+ break;
+ }
+ }
+diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c
+index 2f214440008c3..1c6b2cc6269ad 100644
+--- a/drivers/memory/emif.c
++++ b/drivers/memory/emif.c
+@@ -165,35 +165,12 @@ static const struct file_operations emif_mr4_fops = {
+
+ static int __init_or_module emif_debugfs_init(struct emif_data *emif)
+ {
+- struct dentry *dentry;
+- int ret;
+-
+- dentry = debugfs_create_dir(dev_name(emif->dev), NULL);
+- if (!dentry) {
+- ret = -ENOMEM;
+- goto err0;
+- }
+- emif->debugfs_root = dentry;
+-
+- dentry = debugfs_create_file("regcache_dump", S_IRUGO,
+- emif->debugfs_root, emif, &emif_regdump_fops);
+- if (!dentry) {
+- ret = -ENOMEM;
+- goto err1;
+- }
+-
+- dentry = debugfs_create_file("mr4", S_IRUGO,
+- emif->debugfs_root, emif, &emif_mr4_fops);
+- if (!dentry) {
+- ret = -ENOMEM;
+- goto err1;
+- }
+-
++ emif->debugfs_root = debugfs_create_dir(dev_name(emif->dev), NULL);
++ debugfs_create_file("regcache_dump", S_IRUGO, emif->debugfs_root, emif,
++ &emif_regdump_fops);
++ debugfs_create_file("mr4", S_IRUGO, emif->debugfs_root, emif,
++ &emif_mr4_fops);
+ return 0;
+-err1:
+- debugfs_remove_recursive(emif->debugfs_root);
+-err0:
+- return ret;
+ }
+
+ static void __exit emif_debugfs_exit(struct emif_data *emif)
+diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
+index 2af7ae13449d3..cec867c10968b 100644
+--- a/drivers/message/fusion/mptscsih.c
++++ b/drivers/message/fusion/mptscsih.c
+@@ -1174,8 +1174,10 @@ mptscsih_remove(struct pci_dev *pdev)
+ MPT_SCSI_HOST *hd;
+ int sz1;
+
+- if((hd = shost_priv(host)) == NULL)
+- return;
++ if (host == NULL)
++ hd = NULL;
++ else
++ hd = shost_priv(host);
+
+ mptscsih_shutdown(pdev);
+
+@@ -1191,14 +1193,15 @@ mptscsih_remove(struct pci_dev *pdev)
+ "Free'd ScsiLookup (%d) memory\n",
+ ioc->name, sz1));
+
+- kfree(hd->info_kbuf);
++ if (hd)
++ kfree(hd->info_kbuf);
+
+ /* NULL the Scsi_Host pointer
+ */
+ ioc->sh = NULL;
+
+- scsi_host_put(host);
+-
++ if (host)
++ scsi_host_put(host);
+ mpt_detach(pdev);
+
+ }
+diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
+index 787a69a2a726f..b9d3c87e9318d 100644
+--- a/drivers/misc/cxl/pci.c
++++ b/drivers/misc/cxl/pci.c
+@@ -397,8 +397,8 @@ int cxl_calc_capp_routing(struct pci_dev *dev, u64 *chipid,
+ *capp_unit_id = get_capp_unit_id(np, *phb_index);
+ of_node_put(np);
+ if (!*capp_unit_id) {
+- pr_err("cxl: invalid capp unit id (phb_index: %d)\n",
+- *phb_index);
++ pr_err("cxl: No capp unit found for PHB[%lld,%d]. Make sure the adapter is on a capi-compatible slot\n",
++ *chipid, *phb_index);
+ return -ENODEV;
+ }
+
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index 145143b6a0e6d..6cc187ce3a329 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -546,6 +546,43 @@ static int sdhci_acpi_emmc_amd_probe_slot(struct platform_device *pdev,
+ (host->mmc->caps & MMC_CAP_1_8V_DDR))
+ host->mmc->caps2 = MMC_CAP2_HS400_1_8V;
+
++ /*
++ * There are two types of presets out in the wild:
++ * 1) Default/broken presets.
++ * These presets have two sets of problems:
++ * a) The clock divisor for SDR12, SDR25, and SDR50 is too small.
++ * This results in clock frequencies that are 2x higher than
++ * acceptable. i.e., SDR12 = 25 MHz, SDR25 = 50 MHz, SDR50 =
++ * 100 MHz.x
++ * b) The HS200 and HS400 driver strengths don't match.
++ * By default, the SDR104 preset register has a driver strength of
++ * A, but the (internal) HS400 preset register has a driver
++ * strength of B. As part of initializing HS400, HS200 tuning
++ * needs to be performed. Having different driver strengths
++ * between tuning and operation is wrong. It results in different
++ * rise/fall times that lead to incorrect sampling.
++ * 2) Firmware with properly initialized presets.
++ * These presets have proper clock divisors. i.e., SDR12 => 12MHz,
++ * SDR25 => 25 MHz, SDR50 => 50 MHz. Additionally the HS200 and
++ * HS400 preset driver strengths match.
++ *
++ * Enabling presets for HS400 doesn't work for the following reasons:
++ * 1) sdhci_set_ios has a hard coded list of timings that are used
++ * to determine if presets should be enabled.
++ * 2) sdhci_get_preset_value is using a non-standard register to
++ * read out HS400 presets. The AMD controller doesn't support this
++ * non-standard register. In fact, it doesn't expose the HS400
++ * preset register anywhere in the SDHCI memory map. This results
++ * in reading a garbage value and using the wrong presets.
++ *
++ * Since HS400 and HS200 presets must be identical, we could
++ * instead use the the SDR104 preset register.
++ *
++ * If the above issues are resolved we could remove this quirk for
++ * firmware that that has valid presets (i.e., SDR12 <= 12 MHz).
++ */
++ host->quirks2 |= SDHCI_QUIRK2_PRESET_VALUE_BROKEN;
++
+ host->mmc_host_ops.select_drive_strength = amd_select_drive_strength;
+ host->mmc_host_ops.set_ios = amd_set_ios;
+ return 0;
+diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c
+index 246dc6255e696..9fdb92729c28b 100644
+--- a/drivers/mmc/host/via-sdmmc.c
++++ b/drivers/mmc/host/via-sdmmc.c
+@@ -1273,11 +1273,14 @@ static void via_init_sdc_pm(struct via_crdr_mmc_host *host)
+ static int via_sd_suspend(struct pci_dev *pcidev, pm_message_t state)
+ {
+ struct via_crdr_mmc_host *host;
++ unsigned long flags;
+
+ host = pci_get_drvdata(pcidev);
+
++ spin_lock_irqsave(&host->lock, flags);
+ via_save_pcictrlreg(host);
+ via_save_sdcreg(host);
++ spin_unlock_irqrestore(&host->lock, flags);
+
+ pci_save_state(pcidev);
+ pci_enable_wake(pcidev, pci_choose_state(pcidev, state), 0);
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 80d64d7e7a8be..ac336164f6253 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1471,6 +1471,19 @@ int ubi_thread(void *u)
+ !ubi->thread_enabled || ubi_dbg_is_bgt_disabled(ubi)) {
+ set_current_state(TASK_INTERRUPTIBLE);
+ spin_unlock(&ubi->wl_lock);
++
++ /*
++ * Check kthread_should_stop() after we set the task
++ * state to guarantee that we either see the stop bit
++ * and exit or the task state is reset to runnable such
++ * that it's not scheduled out indefinitely and detects
++ * the stop bit at kthread_should_stop().
++ */
++ if (kthread_should_stop()) {
++ set_current_state(TASK_RUNNING);
++ break;
++ }
++
+ schedule();
+ continue;
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index c3f04fb319556..01d28ede1fb20 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -6326,6 +6326,11 @@ static void bnxt_report_link(struct bnxt *bp)
+ u16 fec;
+
+ netif_carrier_on(bp->dev);
++ speed = bnxt_fw_to_ethtool_speed(bp->link_info.link_speed);
++ if (speed == SPEED_UNKNOWN) {
++ netdev_info(bp->dev, "NIC Link is Up, speed unknown\n");
++ return;
++ }
+ if (bp->link_info.duplex == BNXT_LINK_DUPLEX_FULL)
+ duplex = "full";
+ else
+@@ -6338,7 +6343,6 @@ static void bnxt_report_link(struct bnxt *bp)
+ flow_ctrl = "ON - receive";
+ else
+ flow_ctrl = "none";
+- speed = bnxt_fw_to_ethtool_speed(bp->link_info.link_speed);
+ netdev_info(bp->dev, "NIC Link is Up, %u Mbps %s duplex, Flow control: %s\n",
+ speed, duplex, flow_ctrl);
+ if (bp->flags & BNXT_FLAG_EEE_CAP)
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+index bb3ee55cb72cb..a62c96001761b 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+@@ -145,13 +145,13 @@ static int configure_filter_smac(struct adapter *adap, struct filter_entry *f)
+ int err;
+
+ /* do a set-tcb for smac-sel and CWR bit.. */
+- err = set_tcb_tflag(adap, f, f->tid, TF_CCTRL_CWR_S, 1, 1);
+- if (err)
+- goto smac_err;
+-
+ err = set_tcb_field(adap, f, f->tid, TCB_SMAC_SEL_W,
+ TCB_SMAC_SEL_V(TCB_SMAC_SEL_M),
+ TCB_SMAC_SEL_V(f->smt->idx), 1);
++ if (err)
++ goto smac_err;
++
++ err = set_tcb_tflag(adap, f, f->tid, TF_CCTRL_CWR_S, 1, 1);
+ if (!err)
+ return 0;
+
+@@ -608,6 +608,7 @@ int set_filter_wr(struct adapter *adapter, int fidx)
+ FW_FILTER_WR_DIRSTEERHASH_V(f->fs.dirsteerhash) |
+ FW_FILTER_WR_LPBK_V(f->fs.action == FILTER_SWITCH) |
+ FW_FILTER_WR_DMAC_V(f->fs.newdmac) |
++ FW_FILTER_WR_SMAC_V(f->fs.newsmac) |
+ FW_FILTER_WR_INSVLAN_V(f->fs.newvlan == VLAN_INSERT ||
+ f->fs.newvlan == VLAN_REWRITE) |
+ FW_FILTER_WR_RMVLAN_V(f->fs.newvlan == VLAN_REMOVE ||
+@@ -625,7 +626,7 @@ int set_filter_wr(struct adapter *adapter, int fidx)
+ FW_FILTER_WR_OVLAN_VLD_V(f->fs.val.ovlan_vld) |
+ FW_FILTER_WR_IVLAN_VLDM_V(f->fs.mask.ivlan_vld) |
+ FW_FILTER_WR_OVLAN_VLDM_V(f->fs.mask.ovlan_vld));
+- fwr->smac_sel = 0;
++ fwr->smac_sel = f->smt->idx;
+ fwr->rx_chan_rx_rpl_iq =
+ htons(FW_FILTER_WR_RX_CHAN_V(0) |
+ FW_FILTER_WR_RX_RPL_IQ_V(adapter->sge.fw_evtq.abs_id));
+@@ -1019,11 +1020,8 @@ static void mk_act_open_req6(struct filter_entry *f, struct sk_buff *skb,
+ TX_QUEUE_V(f->fs.nat_mode) |
+ T5_OPT_2_VALID_F |
+ RX_CHANNEL_F |
+- CONG_CNTRL_V((f->fs.action == FILTER_DROP) |
+- (f->fs.dirsteer << 1)) |
+ PACE_V((f->fs.maskhash) |
+- ((f->fs.dirsteerhash) << 1)) |
+- CCTRL_ECN_V(f->fs.action == FILTER_SWITCH));
++ ((f->fs.dirsteerhash) << 1)));
+ }
+
+ static void mk_act_open_req(struct filter_entry *f, struct sk_buff *skb,
+@@ -1059,11 +1057,8 @@ static void mk_act_open_req(struct filter_entry *f, struct sk_buff *skb,
+ TX_QUEUE_V(f->fs.nat_mode) |
+ T5_OPT_2_VALID_F |
+ RX_CHANNEL_F |
+- CONG_CNTRL_V((f->fs.action == FILTER_DROP) |
+- (f->fs.dirsteer << 1)) |
+ PACE_V((f->fs.maskhash) |
+- ((f->fs.dirsteerhash) << 1)) |
+- CCTRL_ECN_V(f->fs.action == FILTER_SWITCH));
++ ((f->fs.dirsteerhash) << 1)));
+ }
+
+ static int cxgb4_set_hash_filter(struct net_device *dev,
+@@ -1722,6 +1717,20 @@ void hash_filter_rpl(struct adapter *adap, const struct cpl_act_open_rpl *rpl)
+ }
+ return;
+ }
++ switch (f->fs.action) {
++ case FILTER_PASS:
++ if (f->fs.dirsteer)
++ set_tcb_tflag(adap, f, tid,
++ TF_DIRECT_STEER_S, 1, 1);
++ break;
++ case FILTER_DROP:
++ set_tcb_tflag(adap, f, tid, TF_DROP_S, 1, 1);
++ break;
++ case FILTER_SWITCH:
++ set_tcb_tflag(adap, f, tid, TF_LPBK_S, 1, 1);
++ break;
++ }
++
+ break;
+
+ default:
+@@ -1781,22 +1790,11 @@ void filter_rpl(struct adapter *adap, const struct cpl_set_tcb_rpl *rpl)
+ if (ctx)
+ ctx->result = 0;
+ } else if (ret == FW_FILTER_WR_FLT_ADDED) {
+- int err = 0;
+-
+- if (f->fs.newsmac)
+- err = configure_filter_smac(adap, f);
+-
+- if (!err) {
+- f->pending = 0; /* async setup completed */
+- f->valid = 1;
+- if (ctx) {
+- ctx->result = 0;
+- ctx->tid = idx;
+- }
+- } else {
+- clear_filter(adap, f);
+- if (ctx)
+- ctx->result = err;
++ f->pending = 0; /* async setup completed */
++ f->valid = 1;
++ if (ctx) {
++ ctx->result = 0;
++ ctx->tid = idx;
+ }
+ } else {
+ /* Something went wrong. Issue a warning about the
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_tcb.h b/drivers/net/ethernet/chelsio/cxgb4/t4_tcb.h
+index 3297ce025e8b1..6ddc2baa74813 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_tcb.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_tcb.h
+@@ -42,6 +42,10 @@
+
+ #define TCB_T_FLAGS_W 1
+
++#define TF_DROP_S 22
++#define TF_DIRECT_STEER_S 23
++#define TF_LPBK_S 59
++
+ #define TF_CCTRL_ECE_S 60
+ #define TF_CCTRL_CWR_S 61
+ #define TF_CCTRL_RFR_S 62
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index d8e7ca48753fb..423c3e9925d00 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -488,6 +488,9 @@ static void mlxsw_emad_transmit_retry(struct mlxsw_core *mlxsw_core,
+ err = mlxsw_emad_transmit(trans->core, trans);
+ if (err == 0)
+ return;
++
++ if (!atomic_dec_and_test(&trans->active))
++ return;
+ } else {
+ err = -EIO;
+ }
+@@ -1111,6 +1114,8 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
+ if (!reload)
+ devlink_resources_unregister(devlink, NULL);
+ mlxsw_core->bus->fini(mlxsw_core->bus_priv);
++ if (!reload)
++ devlink_free(devlink);
+
+ return;
+
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 58dc4fe139fbe..1555c0dae490b 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -6630,7 +6630,7 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
+ return IRQ_NONE;
+
+ rtl_irq_disable(tp);
+- napi_schedule_irqoff(&tp->napi);
++ napi_schedule(&tp->napi);
+
+ return IRQ_HANDLED;
+ }
+@@ -6886,7 +6886,7 @@ static int rtl_open(struct net_device *dev)
+ rtl_request_firmware(tp);
+
+ retval = request_irq(pci_irq_vector(pdev, 0), rtl8169_interrupt,
+- IRQF_NO_THREAD | IRQF_SHARED, dev->name, tp);
++ IRQF_SHARED, dev->name, tp);
+ if (retval < 0)
+ goto err_release_fw_2;
+
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 569e698b5c807..c24b7ea37e399 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1732,12 +1732,16 @@ static int ravb_hwtstamp_get(struct net_device *ndev, struct ifreq *req)
+ config.flags = 0;
+ config.tx_type = priv->tstamp_tx_ctrl ? HWTSTAMP_TX_ON :
+ HWTSTAMP_TX_OFF;
+- if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_V2_L2_EVENT)
++ switch (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE) {
++ case RAVB_RXTSTAMP_TYPE_V2_L2_EVENT:
+ config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+- else if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_ALL)
++ break;
++ case RAVB_RXTSTAMP_TYPE_ALL:
+ config.rx_filter = HWTSTAMP_FILTER_ALL;
+- else
++ break;
++ default:
+ config.rx_filter = HWTSTAMP_FILTER_NONE;
++ }
+
+ return copy_to_user(req->ifr_data, &config, sizeof(config)) ?
+ -EFAULT : 0;
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index f2fecb6842209..bb9cd1262cc99 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -667,10 +667,6 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
+
+ gtp = netdev_priv(dev);
+
+- err = gtp_encap_enable(gtp, data);
+- if (err < 0)
+- return err;
+-
+ if (!data[IFLA_GTP_PDP_HASHSIZE]) {
+ hashsize = 1024;
+ } else {
+@@ -681,12 +677,16 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
+
+ err = gtp_hashtable_new(gtp, hashsize);
+ if (err < 0)
+- goto out_encap;
++ return err;
++
++ err = gtp_encap_enable(gtp, data);
++ if (err < 0)
++ goto out_hashtable;
+
+ err = register_netdevice(dev);
+ if (err < 0) {
+ netdev_dbg(dev, "failed to register new netdev %d\n", err);
+- goto out_hashtable;
++ goto out_encap;
+ }
+
+ gn = net_generic(dev_net(dev), gtp_net_id);
+@@ -697,11 +697,11 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
+
+ return 0;
+
++out_encap:
++ gtp_encap_disable(gtp);
+ out_hashtable:
+ kfree(gtp->addr_hash);
+ kfree(gtp->tid_hash);
+-out_encap:
+- gtp_encap_disable(gtp);
+ return err;
+ }
+
+diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
+index 03b5f5cce6f47..96b4ce13f3a5d 100644
+--- a/drivers/net/wan/hdlc_fr.c
++++ b/drivers/net/wan/hdlc_fr.c
+@@ -276,63 +276,69 @@ static inline struct net_device **get_dev_p(struct pvc_device *pvc,
+
+ static int fr_hard_header(struct sk_buff **skb_p, u16 dlci)
+ {
+- u16 head_len;
+ struct sk_buff *skb = *skb_p;
+
+- switch (skb->protocol) {
+- case cpu_to_be16(NLPID_CCITT_ANSI_LMI):
+- head_len = 4;
+- skb_push(skb, head_len);
+- skb->data[3] = NLPID_CCITT_ANSI_LMI;
+- break;
+-
+- case cpu_to_be16(NLPID_CISCO_LMI):
+- head_len = 4;
+- skb_push(skb, head_len);
+- skb->data[3] = NLPID_CISCO_LMI;
+- break;
+-
+- case cpu_to_be16(ETH_P_IP):
+- head_len = 4;
+- skb_push(skb, head_len);
+- skb->data[3] = NLPID_IP;
+- break;
+-
+- case cpu_to_be16(ETH_P_IPV6):
+- head_len = 4;
+- skb_push(skb, head_len);
+- skb->data[3] = NLPID_IPV6;
+- break;
+-
+- case cpu_to_be16(ETH_P_802_3):
+- head_len = 10;
+- if (skb_headroom(skb) < head_len) {
+- struct sk_buff *skb2 = skb_realloc_headroom(skb,
+- head_len);
++ if (!skb->dev) { /* Control packets */
++ switch (dlci) {
++ case LMI_CCITT_ANSI_DLCI:
++ skb_push(skb, 4);
++ skb->data[3] = NLPID_CCITT_ANSI_LMI;
++ break;
++
++ case LMI_CISCO_DLCI:
++ skb_push(skb, 4);
++ skb->data[3] = NLPID_CISCO_LMI;
++ break;
++
++ default:
++ return -EINVAL;
++ }
++
++ } else if (skb->dev->type == ARPHRD_DLCI) {
++ switch (skb->protocol) {
++ case htons(ETH_P_IP):
++ skb_push(skb, 4);
++ skb->data[3] = NLPID_IP;
++ break;
++
++ case htons(ETH_P_IPV6):
++ skb_push(skb, 4);
++ skb->data[3] = NLPID_IPV6;
++ break;
++
++ default:
++ skb_push(skb, 10);
++ skb->data[3] = FR_PAD;
++ skb->data[4] = NLPID_SNAP;
++ /* OUI 00-00-00 indicates an Ethertype follows */
++ skb->data[5] = 0x00;
++ skb->data[6] = 0x00;
++ skb->data[7] = 0x00;
++ /* This should be an Ethertype: */
++ *(__be16 *)(skb->data + 8) = skb->protocol;
++ }
++
++ } else if (skb->dev->type == ARPHRD_ETHER) {
++ if (skb_headroom(skb) < 10) {
++ struct sk_buff *skb2 = skb_realloc_headroom(skb, 10);
+ if (!skb2)
+ return -ENOBUFS;
+ dev_kfree_skb(skb);
+ skb = *skb_p = skb2;
+ }
+- skb_push(skb, head_len);
++ skb_push(skb, 10);
+ skb->data[3] = FR_PAD;
+ skb->data[4] = NLPID_SNAP;
+- skb->data[5] = FR_PAD;
++ /* OUI 00-80-C2 stands for the 802.1 organization */
++ skb->data[5] = 0x00;
+ skb->data[6] = 0x80;
+ skb->data[7] = 0xC2;
++ /* PID 00-07 stands for Ethernet frames without FCS */
+ skb->data[8] = 0x00;
+- skb->data[9] = 0x07; /* bridged Ethernet frame w/out FCS */
+- break;
++ skb->data[9] = 0x07;
+
+- default:
+- head_len = 10;
+- skb_push(skb, head_len);
+- skb->data[3] = FR_PAD;
+- skb->data[4] = NLPID_SNAP;
+- skb->data[5] = FR_PAD;
+- skb->data[6] = FR_PAD;
+- skb->data[7] = FR_PAD;
+- *(__be16*)(skb->data + 8) = skb->protocol;
++ } else {
++ return -EINVAL;
+ }
+
+ dlci_to_q922(skb->data, dlci);
+@@ -428,8 +434,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev)
+ skb_put(skb, pad);
+ memset(skb->data + len, 0, pad);
+ }
+- skb->protocol = cpu_to_be16(ETH_P_802_3);
+ }
++ skb->dev = dev;
+ if (!fr_hard_header(&skb, pvc->dlci)) {
+ dev->stats.tx_bytes += skb->len;
+ dev->stats.tx_packets++;
+@@ -497,10 +503,8 @@ static void fr_lmi_send(struct net_device *dev, int fullrep)
+ memset(skb->data, 0, len);
+ skb_reserve(skb, 4);
+ if (lmi == LMI_CISCO) {
+- skb->protocol = cpu_to_be16(NLPID_CISCO_LMI);
+ fr_hard_header(&skb, LMI_CISCO_DLCI);
+ } else {
+- skb->protocol = cpu_to_be16(NLPID_CCITT_ANSI_LMI);
+ fr_hard_header(&skb, LMI_CCITT_ANSI_DLCI);
+ }
+ data = skb_tail_pointer(skb);
+diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
+index 7d15f6208b463..68cda1564c77a 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -767,6 +767,7 @@ static void ath10k_htt_rx_h_rates(struct ath10k *ar,
+ u8 preamble = 0;
+ u8 group_id;
+ u32 info1, info2, info3;
++ u32 stbc, nsts_su;
+
+ info1 = __le32_to_cpu(rxd->ppdu_start.info1);
+ info2 = __le32_to_cpu(rxd->ppdu_start.info2);
+@@ -811,11 +812,16 @@ static void ath10k_htt_rx_h_rates(struct ath10k *ar,
+ */
+ bw = info2 & 3;
+ sgi = info3 & 1;
++ stbc = (info2 >> 3) & 1;
+ group_id = (info2 >> 4) & 0x3F;
+
+ if (GROUP_ID_IS_SU_MIMO(group_id)) {
+ mcs = (info3 >> 4) & 0x0F;
+- nss = ((info2 >> 10) & 0x07) + 1;
++ nsts_su = ((info2 >> 10) & 0x07);
++ if (stbc)
++ nss = (nsts_su >> 2) + 1;
++ else
++ nss = (nsts_su + 1);
+ } else {
+ /* Hardware doesn't decode VHT-SIG-B into Rx descriptor
+ * so it's impossible to decode MCS. Also since
+diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
+index 0cdaecb0e28a9..28d86da65c051 100644
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -561,6 +561,10 @@ static int ath10k_sdio_mbox_rx_alloc(struct ath10k *ar,
+ le16_to_cpu(htc_hdr->len),
+ ATH10K_HTC_MBOX_MAX_PAYLOAD_LENGTH);
+ ret = -ENOMEM;
++
++ queue_work(ar->workqueue, &ar->restart_work);
++ ath10k_warn(ar, "exceeds length, start recovery\n");
++
+ goto err;
+ }
+
+diff --git a/drivers/net/wireless/intersil/p54/p54pci.c b/drivers/net/wireless/intersil/p54/p54pci.c
+index 57ad56435dda5..8bc0286b4f8c1 100644
+--- a/drivers/net/wireless/intersil/p54/p54pci.c
++++ b/drivers/net/wireless/intersil/p54/p54pci.c
+@@ -332,10 +332,12 @@ static void p54p_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
+ struct p54p_desc *desc;
+ dma_addr_t mapping;
+ u32 idx, i;
++ __le32 device_addr;
+
+ spin_lock_irqsave(&priv->lock, flags);
+ idx = le32_to_cpu(ring_control->host_idx[1]);
+ i = idx % ARRAY_SIZE(ring_control->tx_data);
++ device_addr = ((struct p54_hdr *)skb->data)->req_id;
+
+ mapping = pci_map_single(priv->pdev, skb->data, skb->len,
+ PCI_DMA_TODEVICE);
+@@ -349,7 +351,7 @@ static void p54p_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
+
+ desc = &ring_control->tx_data[i];
+ desc->host_addr = cpu_to_le32(mapping);
+- desc->device_addr = ((struct p54_hdr *)skb->data)->req_id;
++ desc->device_addr = device_addr;
+ desc->len = cpu_to_le16(skb->len);
+ desc->flags = 0;
+
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 936c0b3e0ba28..86d23d0f563c4 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -140,6 +140,20 @@ struct xenvif_queue { /* Per-queue data for xenvif */
+ char name[QUEUE_NAME_SIZE]; /* DEVNAME-qN */
+ struct xenvif *vif; /* Parent VIF */
+
++ /*
++ * TX/RX common EOI handling.
++ * When feature-split-event-channels = 0, interrupt handler sets
++ * NETBK_COMMON_EOI, otherwise NETBK_RX_EOI and NETBK_TX_EOI are set
++ * by the RX and TX interrupt handlers.
++ * RX and TX handler threads will issue an EOI when either
++ * NETBK_COMMON_EOI or their specific bits (NETBK_RX_EOI or
++ * NETBK_TX_EOI) are set and they will reset those bits.
++ */
++ atomic_t eoi_pending;
++#define NETBK_RX_EOI 0x01
++#define NETBK_TX_EOI 0x02
++#define NETBK_COMMON_EOI 0x04
++
+ /* Use NAPI for guest TX */
+ struct napi_struct napi;
+ /* When feature-split-event-channels = 0, tx_irq = rx_irq. */
+@@ -357,6 +371,7 @@ int xenvif_dealloc_kthread(void *data);
+
+ irqreturn_t xenvif_ctrl_irq_fn(int irq, void *data);
+
++bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread);
+ void xenvif_rx_action(struct xenvif_queue *queue);
+ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb);
+
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index 4cafc31b98b7c..c960cb7e3251f 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -77,12 +77,28 @@ int xenvif_schedulable(struct xenvif *vif)
+ !vif->disabled;
+ }
+
++static bool xenvif_handle_tx_interrupt(struct xenvif_queue *queue)
++{
++ bool rc;
++
++ rc = RING_HAS_UNCONSUMED_REQUESTS(&queue->tx);
++ if (rc)
++ napi_schedule(&queue->napi);
++ return rc;
++}
++
+ static irqreturn_t xenvif_tx_interrupt(int irq, void *dev_id)
+ {
+ struct xenvif_queue *queue = dev_id;
++ int old;
+
+- if (RING_HAS_UNCONSUMED_REQUESTS(&queue->tx))
+- napi_schedule(&queue->napi);
++ old = atomic_fetch_or(NETBK_TX_EOI, &queue->eoi_pending);
++ WARN(old & NETBK_TX_EOI, "Interrupt while EOI pending\n");
++
++ if (!xenvif_handle_tx_interrupt(queue)) {
++ atomic_andnot(NETBK_TX_EOI, &queue->eoi_pending);
++ xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
++ }
+
+ return IRQ_HANDLED;
+ }
+@@ -116,19 +132,46 @@ static int xenvif_poll(struct napi_struct *napi, int budget)
+ return work_done;
+ }
+
++static bool xenvif_handle_rx_interrupt(struct xenvif_queue *queue)
++{
++ bool rc;
++
++ rc = xenvif_have_rx_work(queue, false);
++ if (rc)
++ xenvif_kick_thread(queue);
++ return rc;
++}
++
+ static irqreturn_t xenvif_rx_interrupt(int irq, void *dev_id)
+ {
+ struct xenvif_queue *queue = dev_id;
++ int old;
+
+- xenvif_kick_thread(queue);
++ old = atomic_fetch_or(NETBK_RX_EOI, &queue->eoi_pending);
++ WARN(old & NETBK_RX_EOI, "Interrupt while EOI pending\n");
++
++ if (!xenvif_handle_rx_interrupt(queue)) {
++ atomic_andnot(NETBK_RX_EOI, &queue->eoi_pending);
++ xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
++ }
+
+ return IRQ_HANDLED;
+ }
+
+ irqreturn_t xenvif_interrupt(int irq, void *dev_id)
+ {
+- xenvif_tx_interrupt(irq, dev_id);
+- xenvif_rx_interrupt(irq, dev_id);
++ struct xenvif_queue *queue = dev_id;
++ int old;
++
++ old = atomic_fetch_or(NETBK_COMMON_EOI, &queue->eoi_pending);
++ WARN(old, "Interrupt while EOI pending\n");
++
++ /* Use bitwise or as we need to call both functions. */
++ if ((!xenvif_handle_tx_interrupt(queue) |
++ !xenvif_handle_rx_interrupt(queue))) {
++ atomic_andnot(NETBK_COMMON_EOI, &queue->eoi_pending);
++ xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
++ }
+
+ return IRQ_HANDLED;
+ }
+@@ -595,7 +638,7 @@ int xenvif_connect_ctrl(struct xenvif *vif, grant_ref_t ring_ref,
+ shared = (struct xen_netif_ctrl_sring *)addr;
+ BACK_RING_INIT(&vif->ctrl, shared, XEN_PAGE_SIZE);
+
+- err = bind_interdomain_evtchn_to_irq(vif->domid, evtchn);
++ err = bind_interdomain_evtchn_to_irq_lateeoi(vif->domid, evtchn);
+ if (err < 0)
+ goto err_unmap;
+
+@@ -653,7 +696,7 @@ int xenvif_connect_data(struct xenvif_queue *queue,
+
+ if (tx_evtchn == rx_evtchn) {
+ /* feature-split-event-channels == 0 */
+- err = bind_interdomain_evtchn_to_irqhandler(
++ err = bind_interdomain_evtchn_to_irqhandler_lateeoi(
+ queue->vif->domid, tx_evtchn, xenvif_interrupt, 0,
+ queue->name, queue);
+ if (err < 0)
+@@ -664,7 +707,7 @@ int xenvif_connect_data(struct xenvif_queue *queue,
+ /* feature-split-event-channels == 1 */
+ snprintf(queue->tx_irq_name, sizeof(queue->tx_irq_name),
+ "%s-tx", queue->name);
+- err = bind_interdomain_evtchn_to_irqhandler(
++ err = bind_interdomain_evtchn_to_irqhandler_lateeoi(
+ queue->vif->domid, tx_evtchn, xenvif_tx_interrupt, 0,
+ queue->tx_irq_name, queue);
+ if (err < 0)
+@@ -674,7 +717,7 @@ int xenvif_connect_data(struct xenvif_queue *queue,
+
+ snprintf(queue->rx_irq_name, sizeof(queue->rx_irq_name),
+ "%s-rx", queue->name);
+- err = bind_interdomain_evtchn_to_irqhandler(
++ err = bind_interdomain_evtchn_to_irqhandler_lateeoi(
+ queue->vif->domid, rx_evtchn, xenvif_rx_interrupt, 0,
+ queue->rx_irq_name, queue);
+ if (err < 0)
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 1c849106b7935..f228298c3bd08 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -162,6 +162,10 @@ void xenvif_napi_schedule_or_enable_events(struct xenvif_queue *queue)
+
+ if (more_to_do)
+ napi_schedule(&queue->napi);
++ else if (atomic_fetch_andnot(NETBK_TX_EOI | NETBK_COMMON_EOI,
++ &queue->eoi_pending) &
++ (NETBK_TX_EOI | NETBK_COMMON_EOI))
++ xen_irq_lateeoi(queue->tx_irq, 0);
+ }
+
+ static void tx_add_credit(struct xenvif_queue *queue)
+@@ -1613,9 +1617,14 @@ static bool xenvif_ctrl_work_todo(struct xenvif *vif)
+ irqreturn_t xenvif_ctrl_irq_fn(int irq, void *data)
+ {
+ struct xenvif *vif = data;
++ unsigned int eoi_flag = XEN_EOI_FLAG_SPURIOUS;
+
+- while (xenvif_ctrl_work_todo(vif))
++ while (xenvif_ctrl_work_todo(vif)) {
+ xenvif_ctrl_action(vif);
++ eoi_flag = 0;
++ }
++
++ xen_irq_lateeoi(irq, eoi_flag);
+
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c
+index ef5887037b225..9b62f65b630e4 100644
+--- a/drivers/net/xen-netback/rx.c
++++ b/drivers/net/xen-netback/rx.c
+@@ -490,13 +490,13 @@ static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
+ return queue->stalled && prod - cons >= 1;
+ }
+
+-static bool xenvif_have_rx_work(struct xenvif_queue *queue)
++bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread)
+ {
+ return xenvif_rx_ring_slots_available(queue) ||
+ (queue->vif->stall_timeout &&
+ (xenvif_rx_queue_stalled(queue) ||
+ xenvif_rx_queue_ready(queue))) ||
+- kthread_should_stop() ||
++ (test_kthread && kthread_should_stop()) ||
+ queue->vif->disabled;
+ }
+
+@@ -527,15 +527,20 @@ static void xenvif_wait_for_rx_work(struct xenvif_queue *queue)
+ {
+ DEFINE_WAIT(wait);
+
+- if (xenvif_have_rx_work(queue))
++ if (xenvif_have_rx_work(queue, true))
+ return;
+
+ for (;;) {
+ long ret;
+
+ prepare_to_wait(&queue->wq, &wait, TASK_INTERRUPTIBLE);
+- if (xenvif_have_rx_work(queue))
++ if (xenvif_have_rx_work(queue, true))
+ break;
++ if (atomic_fetch_andnot(NETBK_RX_EOI | NETBK_COMMON_EOI,
++ &queue->eoi_pending) &
++ (NETBK_RX_EOI | NETBK_COMMON_EOI))
++ xen_irq_lateeoi(queue->rx_irq, 0);
++
+ ret = schedule_timeout(xenvif_rx_queue_timeout(queue));
+ if (!ret)
+ break;
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 077c678166651..134e14e778f8e 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -1640,7 +1640,6 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
+ complete(&queue->cm_done);
+ return 0;
+ case RDMA_CM_EVENT_REJECTED:
+- nvme_rdma_destroy_queue_ib(queue);
+ cm_error = nvme_rdma_conn_rejected(queue, ev);
+ break;
+ case RDMA_CM_EVENT_ROUTE_ERROR:
+diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
+index ff02a917556a9..93e3d9c747aa0 100644
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -1680,8 +1680,6 @@ static int bq27xxx_battery_status(struct bq27xxx_device_info *di,
+ status = POWER_SUPPLY_STATUS_FULL;
+ else if (di->cache.flags & BQ27000_FLAG_CHGS)
+ status = POWER_SUPPLY_STATUS_CHARGING;
+- else if (power_supply_am_i_supplied(di->bat) > 0)
+- status = POWER_SUPPLY_STATUS_NOT_CHARGING;
+ else
+ status = POWER_SUPPLY_STATUS_DISCHARGING;
+ } else {
+@@ -1693,6 +1691,10 @@ static int bq27xxx_battery_status(struct bq27xxx_device_info *di,
+ status = POWER_SUPPLY_STATUS_CHARGING;
+ }
+
++ if ((status == POWER_SUPPLY_STATUS_DISCHARGING) &&
++ (power_supply_am_i_supplied(di->bat) > 0))
++ status = POWER_SUPPLY_STATUS_NOT_CHARGING;
++
+ val->intval = status;
+
+ return 0;
+diff --git a/drivers/power/supply/test_power.c b/drivers/power/supply/test_power.c
+index 57246cdbd0426..925abec45380f 100644
+--- a/drivers/power/supply/test_power.c
++++ b/drivers/power/supply/test_power.c
+@@ -344,6 +344,7 @@ static int param_set_ac_online(const char *key, const struct kernel_param *kp)
+ static int param_get_ac_online(char *buffer, const struct kernel_param *kp)
+ {
+ strcpy(buffer, map_get_key(map_ac_online, ac_online, "unknown"));
++ strcat(buffer, "\n");
+ return strlen(buffer);
+ }
+
+@@ -357,6 +358,7 @@ static int param_set_usb_online(const char *key, const struct kernel_param *kp)
+ static int param_get_usb_online(char *buffer, const struct kernel_param *kp)
+ {
+ strcpy(buffer, map_get_key(map_ac_online, usb_online, "unknown"));
++ strcat(buffer, "\n");
+ return strlen(buffer);
+ }
+
+@@ -371,6 +373,7 @@ static int param_set_battery_status(const char *key,
+ static int param_get_battery_status(char *buffer, const struct kernel_param *kp)
+ {
+ strcpy(buffer, map_get_key(map_status, battery_status, "unknown"));
++ strcat(buffer, "\n");
+ return strlen(buffer);
+ }
+
+@@ -385,6 +388,7 @@ static int param_set_battery_health(const char *key,
+ static int param_get_battery_health(char *buffer, const struct kernel_param *kp)
+ {
+ strcpy(buffer, map_get_key(map_health, battery_health, "unknown"));
++ strcat(buffer, "\n");
+ return strlen(buffer);
+ }
+
+@@ -400,6 +404,7 @@ static int param_get_battery_present(char *buffer,
+ const struct kernel_param *kp)
+ {
+ strcpy(buffer, map_get_key(map_present, battery_present, "unknown"));
++ strcat(buffer, "\n");
+ return strlen(buffer);
+ }
+
+@@ -417,6 +422,7 @@ static int param_get_battery_technology(char *buffer,
+ {
+ strcpy(buffer,
+ map_get_key(map_technology, battery_technology, "unknown"));
++ strcat(buffer, "\n");
+ return strlen(buffer);
+ }
+
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index facc577ab0acc..a755f85686e53 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -970,7 +970,7 @@ static int qcom_glink_rx_open_ack(struct qcom_glink *glink, unsigned int lcid)
+ return -EINVAL;
+ }
+
+- complete(&channel->open_ack);
++ complete_all(&channel->open_ack);
+
+ return 0;
+ }
+@@ -1178,7 +1178,7 @@ static int qcom_glink_announce_create(struct rpmsg_device *rpdev)
+ __be32 *val = defaults;
+ int size;
+
+- if (glink->intentless)
++ if (glink->intentless || !completion_done(&channel->open_ack))
+ return 0;
+
+ prop = of_find_property(np, "qcom,intents", NULL);
+@@ -1413,7 +1413,7 @@ static int qcom_glink_rx_open(struct qcom_glink *glink, unsigned int rcid,
+ channel->rcid = ret;
+ spin_unlock_irqrestore(&glink->idr_lock, flags);
+
+- complete(&channel->open_req);
++ complete_all(&channel->open_req);
+
+ if (create_device) {
+ rpdev = kzalloc(sizeof(*rpdev), GFP_KERNEL);
+diff --git a/drivers/rtc/rtc-rx8010.c b/drivers/rtc/rtc-rx8010.c
+index 7ddc22eb5b0fa..f4db80f9c1b1a 100644
+--- a/drivers/rtc/rtc-rx8010.c
++++ b/drivers/rtc/rtc-rx8010.c
+@@ -428,16 +428,26 @@ static int rx8010_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
+ }
+ }
+
+-static struct rtc_class_ops rx8010_rtc_ops = {
++static const struct rtc_class_ops rx8010_rtc_ops_default = {
+ .read_time = rx8010_get_time,
+ .set_time = rx8010_set_time,
+ .ioctl = rx8010_ioctl,
+ };
+
++static const struct rtc_class_ops rx8010_rtc_ops_alarm = {
++ .read_time = rx8010_get_time,
++ .set_time = rx8010_set_time,
++ .ioctl = rx8010_ioctl,
++ .read_alarm = rx8010_read_alarm,
++ .set_alarm = rx8010_set_alarm,
++ .alarm_irq_enable = rx8010_alarm_irq_enable,
++};
++
+ static int rx8010_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+ struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
++ const struct rtc_class_ops *rtc_ops;
+ struct rx8010_data *rx8010;
+ int err = 0;
+
+@@ -468,16 +478,16 @@ static int rx8010_probe(struct i2c_client *client,
+
+ if (err) {
+ dev_err(&client->dev, "unable to request IRQ\n");
+- client->irq = 0;
+- } else {
+- rx8010_rtc_ops.read_alarm = rx8010_read_alarm;
+- rx8010_rtc_ops.set_alarm = rx8010_set_alarm;
+- rx8010_rtc_ops.alarm_irq_enable = rx8010_alarm_irq_enable;
++ return err;
+ }
++
++ rtc_ops = &rx8010_rtc_ops_alarm;
++ } else {
++ rtc_ops = &rx8010_rtc_ops_default;
+ }
+
+ rx8010->rtc = devm_rtc_device_register(&client->dev, client->name,
+- &rx8010_rtc_ops, THIS_MODULE);
++ rtc_ops, THIS_MODULE);
+
+ if (IS_ERR(rx8010->rtc)) {
+ dev_err(&client->dev, "unable to register the class device\n");
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 29b79e85fa7f2..eb6112eb475e9 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1228,14 +1228,15 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
+ case DSC_DELETE_PEND:
+ return;
+ case DSC_DELETED:
+- if (tgt && tgt->tgt_stop && (tgt->sess_count == 0))
+- wake_up_all(&tgt->waitQ);
+- if (sess->vha->fcport_count == 0)
+- wake_up_all(&sess->vha->fcport_waitQ);
+-
+ if (!sess->plogi_link[QLT_PLOGI_LINK_SAME_WWN] &&
+- !sess->plogi_link[QLT_PLOGI_LINK_CONFLICT])
++ !sess->plogi_link[QLT_PLOGI_LINK_CONFLICT]) {
++ if (tgt && tgt->tgt_stop && tgt->sess_count == 0)
++ wake_up_all(&tgt->waitQ);
++
++ if (sess->vha->fcport_count == 0)
++ wake_up_all(&sess->vha->fcport_waitQ);
+ return;
++ }
+ break;
+ case DSC_UPD_FCPORT:
+ /*
+diff --git a/drivers/staging/comedi/drivers/cb_pcidas.c b/drivers/staging/comedi/drivers/cb_pcidas.c
+index 8429d57087fd5..9b716c6964776 100644
+--- a/drivers/staging/comedi/drivers/cb_pcidas.c
++++ b/drivers/staging/comedi/drivers/cb_pcidas.c
+@@ -1342,6 +1342,7 @@ static int cb_pcidas_auto_attach(struct comedi_device *dev,
+ if (dev->irq && board->has_ao_fifo) {
+ dev->write_subdev = s;
+ s->subdev_flags |= SDF_CMD_WRITE;
++ s->len_chanlist = s->n_chan;
+ s->do_cmdtest = cb_pcidas_ao_cmdtest;
+ s->do_cmd = cb_pcidas_ao_cmd;
+ s->cancel = cb_pcidas_ao_cancel;
+diff --git a/drivers/staging/octeon/ethernet-mdio.c b/drivers/staging/octeon/ethernet-mdio.c
+index f67f950438873..5761a31e2318f 100644
+--- a/drivers/staging/octeon/ethernet-mdio.c
++++ b/drivers/staging/octeon/ethernet-mdio.c
+@@ -152,12 +152,6 @@ int cvm_oct_phy_setup_device(struct net_device *dev)
+
+ phy_node = of_parse_phandle(priv->of_node, "phy-handle", 0);
+ if (!phy_node && of_phy_is_fixed_link(priv->of_node)) {
+- int rc;
+-
+- rc = of_phy_register_fixed_link(priv->of_node);
+- if (rc)
+- return rc;
+-
+ phy_node = of_node_get(priv->of_node);
+ }
+ if (!phy_node)
+diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
+index 5e271245273c7..6c644ef6f3ff7 100644
+--- a/drivers/staging/octeon/ethernet-rx.c
++++ b/drivers/staging/octeon/ethernet-rx.c
+@@ -80,15 +80,17 @@ static inline int cvm_oct_check_rcv_error(cvmx_wqe_t *work)
+ else
+ port = work->word1.cn38xx.ipprt;
+
+- if ((work->word2.snoip.err_code == 10) && (work->word1.len <= 64)) {
++ if ((work->word2.snoip.err_code == 10) && (work->word1.len <= 64))
+ /*
+ * Ignore length errors on min size packets. Some
+ * equipment incorrectly pads packets to 64+4FCS
+ * instead of 60+4FCS. Note these packets still get
+ * counted as frame errors.
+ */
+- } else if (work->word2.snoip.err_code == 5 ||
+- work->word2.snoip.err_code == 7) {
++ return 0;
++
++ if (work->word2.snoip.err_code == 5 ||
++ work->word2.snoip.err_code == 7) {
+ /*
+ * We received a packet with either an alignment error
+ * or a FCS error. This may be signalling that we are
+@@ -119,7 +121,10 @@ static inline int cvm_oct_check_rcv_error(cvmx_wqe_t *work)
+ /* Port received 0xd5 preamble */
+ work->packet_ptr.s.addr += i + 1;
+ work->word1.len -= i + 5;
+- } else if ((*ptr & 0xf) == 0xd) {
++ return 0;
++ }
++
++ if ((*ptr & 0xf) == 0xd) {
+ /* Port received 0xd preamble */
+ work->packet_ptr.s.addr += i;
+ work->word1.len -= i + 4;
+@@ -129,21 +134,20 @@ static inline int cvm_oct_check_rcv_error(cvmx_wqe_t *work)
+ ((*(ptr + 1) & 0xf) << 4);
+ ptr++;
+ }
+- } else {
+- printk_ratelimited("Port %d unknown preamble, packet dropped\n",
+- port);
+- cvm_oct_free_work(work);
+- return 1;
++ return 0;
+ }
++
++ printk_ratelimited("Port %d unknown preamble, packet dropped\n",
++ port);
++ cvm_oct_free_work(work);
++ return 1;
+ }
+- } else {
+- printk_ratelimited("Port %d receive error code %d, packet dropped\n",
+- port, work->word2.snoip.err_code);
+- cvm_oct_free_work(work);
+- return 1;
+ }
+
+- return 0;
++ printk_ratelimited("Port %d receive error code %d, packet dropped\n",
++ port, work->word2.snoip.err_code);
++ cvm_oct_free_work(work);
++ return 1;
+ }
+
+ static void copy_segments_to_skb(cvmx_wqe_t *work, struct sk_buff *skb)
+diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
+index 9b15c9ed844b1..b680e5785ae35 100644
+--- a/drivers/staging/octeon/ethernet.c
++++ b/drivers/staging/octeon/ethernet.c
+@@ -13,6 +13,7 @@
+ #include <linux/phy.h>
+ #include <linux/slab.h>
+ #include <linux/interrupt.h>
++#include <linux/of_mdio.h>
+ #include <linux/of_net.h>
+ #include <linux/if_ether.h>
+ #include <linux/if_vlan.h>
+@@ -875,6 +876,14 @@ static int cvm_oct_probe(struct platform_device *pdev)
+ break;
+ }
+
++ if (priv->of_node && of_phy_is_fixed_link(priv->of_node)) {
++ if (of_phy_register_fixed_link(priv->of_node)) {
++ netdev_err(dev, "Failed to register fixed link for interface %d, port %d\n",
++ interface, priv->port);
++ dev->netdev_ops = NULL;
++ }
++ }
++
+ if (!dev->netdev_ops) {
+ free_netdev(dev);
+ } else if (register_netdev(dev) < 0) {
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index 45e4f29521430..1306ce5c5d9bf 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -313,8 +313,9 @@ static void pl011_write(unsigned int val, const struct uart_amba_port *uap,
+ */
+ static int pl011_fifo_to_tty(struct uart_amba_port *uap)
+ {
+- u16 status;
+ unsigned int ch, flag, fifotaken;
++ int sysrq;
++ u16 status;
+
+ for (fifotaken = 0; fifotaken != 256; fifotaken++) {
+ status = pl011_read(uap, REG_FR);
+@@ -349,10 +350,12 @@ static int pl011_fifo_to_tty(struct uart_amba_port *uap)
+ flag = TTY_FRAME;
+ }
+
+- if (uart_handle_sysrq_char(&uap->port, ch & 255))
+- continue;
++ spin_unlock(&uap->port.lock);
++ sysrq = uart_handle_sysrq_char(&uap->port, ch & 255);
++ spin_lock(&uap->port.lock);
+
+- uart_insert_char(&uap->port, ch, UART011_DR_OE, ch, flag);
++ if (!sysrq)
++ uart_insert_char(&uap->port, ch, UART011_DR_OE, ch, flag);
+ }
+
+ return fifotaken;
+diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
+index a7455f8a4235e..94cad9f86ff98 100644
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -742,8 +742,13 @@ static void k_fn(struct vc_data *vc, unsigned char value, char up_flag)
+ return;
+
+ if ((unsigned)value < ARRAY_SIZE(func_table)) {
++ unsigned long flags;
++
++ spin_lock_irqsave(&func_buf_lock, flags);
+ if (func_table[value])
+ puts_queue(vc, func_table[value]);
++ spin_unlock_irqrestore(&func_buf_lock, flags);
++
+ } else
+ pr_err("k_fn called with value=%d\n", value);
+ }
+@@ -1990,13 +1995,11 @@ out:
+ #undef s
+ #undef v
+
+-/* FIXME: This one needs untangling and locking */
++/* FIXME: This one needs untangling */
+ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+ {
+ struct kbsentry *kbs;
+- char *p;
+ u_char *q;
+- u_char __user *up;
+ int sz, fnw_sz;
+ int delta;
+ char *first_free, *fj, *fnw;
+@@ -2022,23 +2025,19 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
+ i = kbs->kb_func;
+
+ switch (cmd) {
+- case KDGKBSENT:
+- sz = sizeof(kbs->kb_string) - 1; /* sz should have been
+- a struct member */
+- up = user_kdgkb->kb_string;
+- p = func_table[i];
+- if(p)
+- for ( ; *p && sz; p++, sz--)
+- if (put_user(*p, up++)) {
+- ret = -EFAULT;
+- goto reterr;
+- }
+- if (put_user('\0', up)) {
+- ret = -EFAULT;
+- goto reterr;
+- }
+- kfree(kbs);
+- return ((p && *p) ? -EOVERFLOW : 0);
++ case KDGKBSENT: {
++ /* size should have been a struct member */
++ ssize_t len = sizeof(user_kdgkb->kb_string);
++
++ spin_lock_irqsave(&func_buf_lock, flags);
++ len = strlcpy(kbs->kb_string, func_table[i] ? : "", len);
++ spin_unlock_irqrestore(&func_buf_lock, flags);
++
++ ret = copy_to_user(user_kdgkb->kb_string, kbs->kb_string,
++ len + 1) ? -EFAULT : 0;
++
++ goto reterr;
++ }
+ case KDSKBSENT:
+ if (!perm) {
+ ret = -EPERM;
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index 6a82030cf1efb..2e959563af534 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -244,7 +244,7 @@ int vt_waitactive(int n)
+
+
+ static inline int
+-do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op)
++do_fontx_ioctl(struct vc_data *vc, int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op)
+ {
+ struct consolefontdesc cfdarg;
+ int i;
+@@ -262,15 +262,16 @@ do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struc
+ op->height = cfdarg.charheight;
+ op->charcount = cfdarg.charcount;
+ op->data = cfdarg.chardata;
+- return con_font_op(vc_cons[fg_console].d, op);
+- case GIO_FONTX: {
++ return con_font_op(vc, op);
++
++ case GIO_FONTX:
+ op->op = KD_FONT_OP_GET;
+ op->flags = KD_FONT_FLAG_OLD;
+ op->width = 8;
+ op->height = cfdarg.charheight;
+ op->charcount = cfdarg.charcount;
+ op->data = cfdarg.chardata;
+- i = con_font_op(vc_cons[fg_console].d, op);
++ i = con_font_op(vc, op);
+ if (i)
+ return i;
+ cfdarg.charheight = op->height;
+@@ -278,7 +279,6 @@ do_fontx_ioctl(int cmd, struct consolefontdesc __user *user_cfd, int perm, struc
+ if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc)))
+ return -EFAULT;
+ return 0;
+- }
+ }
+ return -EINVAL;
+ }
+@@ -924,7 +924,7 @@ int vt_ioctl(struct tty_struct *tty,
+ op.height = 0;
+ op.charcount = 256;
+ op.data = up;
+- ret = con_font_op(vc_cons[fg_console].d, &op);
++ ret = con_font_op(vc, &op);
+ break;
+ }
+
+@@ -935,7 +935,7 @@ int vt_ioctl(struct tty_struct *tty,
+ op.height = 32;
+ op.charcount = 256;
+ op.data = up;
+- ret = con_font_op(vc_cons[fg_console].d, &op);
++ ret = con_font_op(vc, &op);
+ break;
+ }
+
+@@ -952,7 +952,7 @@ int vt_ioctl(struct tty_struct *tty,
+
+ case PIO_FONTX:
+ case GIO_FONTX:
+- ret = do_fontx_ioctl(cmd, up, perm, &op);
++ ret = do_fontx_ioctl(vc, cmd, up, perm, &op);
+ break;
+
+ case PIO_FONTRESET:
+@@ -969,11 +969,11 @@ int vt_ioctl(struct tty_struct *tty,
+ {
+ op.op = KD_FONT_OP_SET_DEFAULT;
+ op.data = NULL;
+- ret = con_font_op(vc_cons[fg_console].d, &op);
++ ret = con_font_op(vc, &op);
+ if (ret)
+ break;
+ console_lock();
+- con_set_default_unimap(vc_cons[fg_console].d);
++ con_set_default_unimap(vc);
+ console_unlock();
+ break;
+ }
+@@ -1100,8 +1100,9 @@ struct compat_consolefontdesc {
+ };
+
+ static inline int
+-compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd,
+- int perm, struct console_font_op *op)
++compat_fontx_ioctl(struct vc_data *vc, int cmd,
++ struct compat_consolefontdesc __user *user_cfd,
++ int perm, struct console_font_op *op)
+ {
+ struct compat_consolefontdesc cfdarg;
+ int i;
+@@ -1119,7 +1120,8 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd,
+ op->height = cfdarg.charheight;
+ op->charcount = cfdarg.charcount;
+ op->data = compat_ptr(cfdarg.chardata);
+- return con_font_op(vc_cons[fg_console].d, op);
++ return con_font_op(vc, op);
++
+ case GIO_FONTX:
+ op->op = KD_FONT_OP_GET;
+ op->flags = KD_FONT_FLAG_OLD;
+@@ -1127,7 +1129,7 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd,
+ op->height = cfdarg.charheight;
+ op->charcount = cfdarg.charcount;
+ op->data = compat_ptr(cfdarg.chardata);
+- i = con_font_op(vc_cons[fg_console].d, op);
++ i = con_font_op(vc, op);
+ if (i)
+ return i;
+ cfdarg.charheight = op->height;
+@@ -1218,7 +1220,7 @@ long vt_compat_ioctl(struct tty_struct *tty,
+ */
+ case PIO_FONTX:
+ case GIO_FONTX:
+- ret = compat_fontx_ioctl(cmd, up, perm, &op);
++ ret = compat_fontx_ioctl(vc, cmd, up, perm, &op);
+ break;
+
+ case KDFONTOP:
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index 9c788748bdc65..3926be6591471 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -1008,8 +1008,6 @@ void uio_unregister_device(struct uio_info *info)
+
+ idev = info->uio_dev;
+
+- uio_free_minor(idev);
+-
+ mutex_lock(&idev->info_lock);
+ uio_dev_del_attributes(idev);
+
+@@ -1021,6 +1019,8 @@ void uio_unregister_device(struct uio_info *info)
+
+ device_unregister(&idev->dev);
+
++ uio_free_minor(idev);
++
+ return;
+ }
+ EXPORT_SYMBOL_GPL(uio_unregister_device);
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 7376f74a4f049..08751d1a765ff 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -508,6 +508,7 @@ static void acm_read_bulk_callback(struct urb *urb)
+ "%s - cooling babbling device\n", __func__);
+ usb_mark_last_busy(acm->dev);
+ set_bit(rb->index, &acm->urbs_in_error_delay);
++ set_bit(ACM_ERROR_DELAY, &acm->flags);
+ cooldown = true;
+ break;
+ default:
+@@ -533,7 +534,7 @@ static void acm_read_bulk_callback(struct urb *urb)
+
+ if (stopped || stalled || cooldown) {
+ if (stalled)
+- schedule_work(&acm->work);
++ schedule_delayed_work(&acm->dwork, 0);
+ else if (cooldown)
+ schedule_delayed_work(&acm->dwork, HZ / 2);
+ return;
+@@ -568,13 +569,13 @@ static void acm_write_bulk(struct urb *urb)
+ acm_write_done(acm, wb);
+ spin_unlock_irqrestore(&acm->write_lock, flags);
+ set_bit(EVENT_TTY_WAKEUP, &acm->flags);
+- schedule_work(&acm->work);
++ schedule_delayed_work(&acm->dwork, 0);
+ }
+
+ static void acm_softint(struct work_struct *work)
+ {
+ int i;
+- struct acm *acm = container_of(work, struct acm, work);
++ struct acm *acm = container_of(work, struct acm, dwork.work);
+
+ if (test_bit(EVENT_RX_STALL, &acm->flags)) {
+ smp_mb(); /* against acm_suspend() */
+@@ -590,7 +591,7 @@ static void acm_softint(struct work_struct *work)
+ if (test_and_clear_bit(ACM_ERROR_DELAY, &acm->flags)) {
+ for (i = 0; i < acm->rx_buflimit; i++)
+ if (test_and_clear_bit(i, &acm->urbs_in_error_delay))
+- acm_submit_read_urb(acm, i, GFP_NOIO);
++ acm_submit_read_urb(acm, i, GFP_KERNEL);
+ }
+
+ if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags))
+@@ -1396,7 +1397,6 @@ made_compressed_probe:
+ acm->ctrlsize = ctrlsize;
+ acm->readsize = readsize;
+ acm->rx_buflimit = num_rx_buf;
+- INIT_WORK(&acm->work, acm_softint);
+ INIT_DELAYED_WORK(&acm->dwork, acm_softint);
+ init_waitqueue_head(&acm->wioctl);
+ spin_lock_init(&acm->write_lock);
+@@ -1606,7 +1606,6 @@ static void acm_disconnect(struct usb_interface *intf)
+ }
+
+ acm_kill_urbs(acm);
+- cancel_work_sync(&acm->work);
+ cancel_delayed_work_sync(&acm->dwork);
+
+ tty_unregister_device(acm_tty_driver, acm->minor);
+@@ -1649,7 +1648,6 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message)
+ return 0;
+
+ acm_kill_urbs(acm);
+- cancel_work_sync(&acm->work);
+ cancel_delayed_work_sync(&acm->dwork);
+ acm->urbs_in_error_delay = 0;
+
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index 30380d28a504b..d8f8651425c46 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -111,8 +111,7 @@ struct acm {
+ # define ACM_ERROR_DELAY 3
+ unsigned long urbs_in_error_delay; /* these need to be restarted after a delay */
+ struct usb_cdc_line_coding line; /* bits, stop, parity */
+- struct work_struct work; /* work queue entry for various purposes*/
+- struct delayed_work dwork; /* for cool downs needed in error recovery */
++ struct delayed_work dwork; /* work queue entry for various purposes */
+ unsigned int ctrlin; /* input control lines (DCD, DSR, RI, break, overruns) */
+ unsigned int ctrlout; /* output control lines (DTR, RTS) */
+ struct async_icount iocount; /* counters for control line changes */
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 60d08269ad9a0..86b1cfbe48a08 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1507,6 +1507,17 @@ static int dwc3_probe(struct platform_device *pdev)
+
+ err5:
+ dwc3_event_buffers_cleanup(dwc);
++
++ usb_phy_shutdown(dwc->usb2_phy);
++ usb_phy_shutdown(dwc->usb3_phy);
++ phy_exit(dwc->usb2_generic_phy);
++ phy_exit(dwc->usb3_generic_phy);
++
++ usb_phy_set_suspend(dwc->usb2_phy, 1);
++ usb_phy_set_suspend(dwc->usb3_phy, 1);
++ phy_power_off(dwc->usb2_generic_phy);
++ phy_power_off(dwc->usb3_generic_phy);
++
+ dwc3_ulpi_exit(dwc);
+
+ err4:
+@@ -1545,9 +1556,9 @@ static int dwc3_remove(struct platform_device *pdev)
+ dwc3_core_exit(dwc);
+ dwc3_ulpi_exit(dwc);
+
+- pm_runtime_put_sync(&pdev->dev);
+- pm_runtime_allow(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++ pm_runtime_put_noidle(&pdev->dev);
++ pm_runtime_set_suspended(&pdev->dev);
+
+ dwc3_free_event_buffers(dwc);
+ dwc3_free_scratch_buffers(dwc);
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index 2fb02f8774011..0d95ca804c1e2 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -935,12 +935,16 @@ static void dwc3_ep0_xfer_complete(struct dwc3 *dwc,
+ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
+ struct dwc3_ep *dep, struct dwc3_request *req)
+ {
++ unsigned int trb_length = 0;
+ int ret;
+
+ req->direction = !!dep->number;
+
+ if (req->request.length == 0) {
+- dwc3_ep0_prepare_one_trb(dep, dwc->ep0_trb_addr, 0,
++ if (!req->direction)
++ trb_length = dep->endpoint.maxpacket;
++
++ dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr, trb_length,
+ DWC3_TRBCTL_CONTROL_DATA, false);
+ ret = dwc3_ep0_start_trans(dep);
+ } else if (!IS_ALIGNED(req->request.length, dep->endpoint.maxpacket)
+@@ -987,9 +991,12 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
+
+ req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
+
++ if (!req->direction)
++ trb_length = dep->endpoint.maxpacket;
++
+ /* Now prepare one extra TRB to align transfer size */
+ dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
+- 0, DWC3_TRBCTL_CONTROL_DATA,
++ trb_length, DWC3_TRBCTL_CONTROL_DATA,
+ false);
+ ret = dwc3_ep0_start_trans(dep);
+ } else {
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 37cc3fd7c3cad..f0d2f0a4e9908 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1057,6 +1057,8 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ struct scatterlist *s;
+ int i;
+ unsigned int length = req->request.length;
++ unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
++ unsigned int rem = length % maxp;
+ unsigned int remaining = req->request.num_mapped_sgs
+ - req->num_queued_sgs;
+
+@@ -1068,8 +1070,6 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ length -= sg_dma_len(s);
+
+ for_each_sg(sg, s, remaining, i) {
+- unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
+- unsigned int rem = length % maxp;
+ unsigned int trb_length;
+ unsigned chain = true;
+
+diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c
+index 677f9d5921097..de922022b83a5 100644
+--- a/drivers/usb/host/fsl-mph-dr-of.c
++++ b/drivers/usb/host/fsl-mph-dr-of.c
+@@ -94,10 +94,13 @@ static struct platform_device *fsl_usb2_device_register(
+
+ pdev->dev.coherent_dma_mask = ofdev->dev.coherent_dma_mask;
+
+- if (!pdev->dev.dma_mask)
++ if (!pdev->dev.dma_mask) {
+ pdev->dev.dma_mask = &ofdev->dev.coherent_dma_mask;
+- else
+- dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
++ } else {
++ retval = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
++ if (retval)
++ goto error;
++ }
+
+ retval = platform_device_add_data(pdev, pdata, sizeof(*pdata));
+ if (retval)
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 1a6a23e57201d..0c6b6f14b1696 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -21,6 +21,8 @@
+ #define SSIC_PORT_CFG2_OFFSET 0x30
+ #define PROG_DONE (1 << 30)
+ #define SSIC_PORT_UNUSED (1 << 31)
++#define SPARSE_DISABLE_BIT 17
++#define SPARSE_CNTL_ENABLE 0xC12C
+
+ /* Device for a quirk */
+ #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73
+@@ -141,6 +143,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ (pdev->device == 0x15e0 || pdev->device == 0x15e1))
+ xhci->quirks |= XHCI_SNPS_BROKEN_SUSPEND;
+
++ if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x15e5)
++ xhci->quirks |= XHCI_DISABLE_SPARSE;
++
+ if (pdev->vendor == PCI_VENDOR_ID_AMD)
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+
+@@ -441,6 +446,15 @@ static void xhci_pme_quirk(struct usb_hcd *hcd)
+ readl(reg);
+ }
+
++static void xhci_sparse_control_quirk(struct usb_hcd *hcd)
++{
++ u32 reg;
++
++ reg = readl(hcd->regs + SPARSE_CNTL_ENABLE);
++ reg &= ~BIT(SPARSE_DISABLE_BIT);
++ writel(reg, hcd->regs + SPARSE_CNTL_ENABLE);
++}
++
+ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+@@ -460,6 +474,9 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ if (xhci->quirks & XHCI_SSIC_PORT_UNUSED)
+ xhci_ssic_port_unused_quirk(hcd, true);
+
++ if (xhci->quirks & XHCI_DISABLE_SPARSE)
++ xhci_sparse_control_quirk(hcd);
++
+ ret = xhci_suspend(xhci, do_wakeup);
+ if (ret && (xhci->quirks & XHCI_SSIC_PORT_UNUSED))
+ xhci_ssic_port_unused_quirk(hcd, false);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 6f976c4cccdae..0348ea899d062 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -972,12 +972,15 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
+ xhci->shared_hcd->state != HC_STATE_SUSPENDED)
+ return -EINVAL;
+
+- xhci_dbc_suspend(xhci);
+-
+ /* Clear root port wake on bits if wakeup not allowed. */
+ if (!do_wakeup)
+ xhci_disable_port_wake_on_bits(xhci);
+
++ if (!HCD_HW_ACCESSIBLE(hcd))
++ return 0;
++
++ xhci_dbc_suspend(xhci);
++
+ /* Don't poll the roothubs on bus suspend. */
+ xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
+ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 39efbcf63c11d..7a4195f8cd1cc 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1872,6 +1872,7 @@ struct xhci_hcd {
+ #define XHCI_ZERO_64B_REGS BIT_ULL(32)
+ #define XHCI_RESET_PLL_ON_DISCONNECT BIT_ULL(34)
+ #define XHCI_SNPS_BROKEN_SUSPEND BIT_ULL(35)
++#define XHCI_DISABLE_SPARSE BIT_ULL(38)
+
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
+index b8073f36ffdc6..62fdfde4ad03e 100644
+--- a/drivers/usb/misc/adutux.c
++++ b/drivers/usb/misc/adutux.c
+@@ -209,6 +209,7 @@ static void adu_interrupt_out_callback(struct urb *urb)
+
+ if (status != 0) {
+ if ((status != -ENOENT) &&
++ (status != -ESHUTDOWN) &&
+ (status != -ECONNRESET)) {
+ dev_dbg(&dev->udev->dev,
+ "%s :nonzero status received: %d\n", __func__,
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index 29d72e9b0f017..af41d4dce3adb 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -2727,12 +2727,12 @@ static void tcpm_reset_port(struct tcpm_port *port)
+
+ static void tcpm_detach(struct tcpm_port *port)
+ {
+- if (!port->attached)
+- return;
+-
+ if (tcpm_port_is_disconnected(port))
+ port->hard_reset_count = 0;
+
++ if (!port->attached)
++ return;
++
+ tcpm_reset_port(port);
+ }
+
+@@ -3486,7 +3486,7 @@ static void run_state_machine(struct tcpm_port *port)
+ */
+ tcpm_set_pwr_role(port, TYPEC_SOURCE);
+ tcpm_pd_send_control(port, PD_CTRL_PS_RDY);
+- tcpm_set_state(port, SRC_STARTUP, 0);
++ tcpm_set_state(port, SRC_STARTUP, PD_T_SWAP_SRC_START);
+ break;
+
+ case VCONN_SWAP_ACCEPT:
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index a94d700a45030..59c61744dcc16 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -273,13 +273,14 @@ __vringh_iov(struct vringh *vrh, u16 i,
+ desc_max = vrh->vring.num;
+ up_next = -1;
+
++ /* You must want something! */
++ if (WARN_ON(!riov && !wiov))
++ return -EINVAL;
++
+ if (riov)
+ riov->i = riov->used = 0;
+- else if (wiov)
++ if (wiov)
+ wiov->i = wiov->used = 0;
+- else
+- /* You must want something! */
+- BUG();
+
+ for (;;) {
+ void *addr;
+diff --git a/drivers/video/fbdev/pvr2fb.c b/drivers/video/fbdev/pvr2fb.c
+index 8a53d1de611d5..3fd2cb4cdfa90 100644
+--- a/drivers/video/fbdev/pvr2fb.c
++++ b/drivers/video/fbdev/pvr2fb.c
+@@ -1027,6 +1027,8 @@ static int __init pvr2fb_setup(char *options)
+ if (!options || !*options)
+ return 0;
+
++ cable_arg[0] = output_arg[0] = 0;
++
+ while ((this_opt = strsep(&options, ","))) {
+ if (!*this_opt)
+ continue;
+diff --git a/drivers/w1/masters/mxc_w1.c b/drivers/w1/masters/mxc_w1.c
+index 50b46c4399ead..075454053e5e5 100644
+--- a/drivers/w1/masters/mxc_w1.c
++++ b/drivers/w1/masters/mxc_w1.c
+@@ -15,7 +15,7 @@
+ #include <linux/clk.h>
+ #include <linux/delay.h>
+ #include <linux/io.h>
+-#include <linux/jiffies.h>
++#include <linux/ktime.h>
+ #include <linux/module.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/platform_device.h>
+@@ -48,12 +48,12 @@ struct mxc_w1_device {
+ static u8 mxc_w1_ds2_reset_bus(void *data)
+ {
+ struct mxc_w1_device *dev = data;
+- unsigned long timeout;
++ ktime_t timeout;
+
+ writeb(MXC_W1_CONTROL_RPP, dev->regs + MXC_W1_CONTROL);
+
+ /* Wait for reset sequence 511+512us, use 1500us for sure */
+- timeout = jiffies + usecs_to_jiffies(1500);
++ timeout = ktime_add_us(ktime_get(), 1500);
+
+ udelay(511 + 512);
+
+@@ -63,7 +63,7 @@ static u8 mxc_w1_ds2_reset_bus(void *data)
+ /* PST bit is valid after the RPP bit is self-cleared */
+ if (!(ctrl & MXC_W1_CONTROL_RPP))
+ return !(ctrl & MXC_W1_CONTROL_PST);
+- } while (time_is_after_jiffies(timeout));
++ } while (ktime_before(ktime_get(), timeout));
+
+ return 1;
+ }
+@@ -76,12 +76,12 @@ static u8 mxc_w1_ds2_reset_bus(void *data)
+ static u8 mxc_w1_ds2_touch_bit(void *data, u8 bit)
+ {
+ struct mxc_w1_device *dev = data;
+- unsigned long timeout;
++ ktime_t timeout;
+
+ writeb(MXC_W1_CONTROL_WR(bit), dev->regs + MXC_W1_CONTROL);
+
+ /* Wait for read/write bit (60us, Max 120us), use 200us for sure */
+- timeout = jiffies + usecs_to_jiffies(200);
++ timeout = ktime_add_us(ktime_get(), 200);
+
+ udelay(60);
+
+@@ -91,7 +91,7 @@ static u8 mxc_w1_ds2_touch_bit(void *data, u8 bit)
+ /* RDST bit is valid after the WR1/RD bit is self-cleared */
+ if (!(ctrl & MXC_W1_CONTROL_WR(bit)))
+ return !!(ctrl & MXC_W1_CONTROL_RDST);
+- } while (time_is_after_jiffies(timeout));
++ } while (ktime_before(ktime_get(), timeout));
+
+ return 0;
+ }
+diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c
+index a281aa84bfb14..4c3b4ea4e17f5 100644
+--- a/drivers/watchdog/rdc321x_wdt.c
++++ b/drivers/watchdog/rdc321x_wdt.c
+@@ -244,6 +244,8 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
+
+ rdc321x_wdt_device.sb_pdev = pdata->sb_pdev;
+ rdc321x_wdt_device.base_reg = r->start;
++ rdc321x_wdt_device.queue = 0;
++ rdc321x_wdt_device.default_ticks = ticks;
+
+ err = misc_register(&rdc321x_wdt_misc);
+ if (err < 0) {
+@@ -258,14 +260,11 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
+ rdc321x_wdt_device.base_reg, RDC_WDT_RST);
+
+ init_completion(&rdc321x_wdt_device.stop);
+- rdc321x_wdt_device.queue = 0;
+
+ clear_bit(0, &rdc321x_wdt_device.inuse);
+
+ timer_setup(&rdc321x_wdt_device.timer, rdc321x_wdt_trigger, 0);
+
+- rdc321x_wdt_device.default_ticks = ticks;
+-
+ dev_info(&pdev->dev, "watchdog init success\n");
+
+ return 0;
+diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c
+index 8edef51c92e59..f026624898e7a 100644
+--- a/drivers/xen/events/events_2l.c
++++ b/drivers/xen/events/events_2l.c
+@@ -91,6 +91,8 @@ static void evtchn_2l_unmask(unsigned port)
+
+ BUG_ON(!irqs_disabled());
+
++ smp_wmb(); /* All writes before unmask must be visible. */
++
+ if (unlikely((cpu != cpu_from_evtchn(port))))
+ do_hypercall = 1;
+ else {
+@@ -159,7 +161,7 @@ static inline xen_ulong_t active_evtchns(unsigned int cpu,
+ * a bitset of words which contain pending event bits. The second
+ * level is a bitset of pending events themselves.
+ */
+-static void evtchn_2l_handle_events(unsigned cpu)
++static void evtchn_2l_handle_events(unsigned cpu, struct evtchn_loop_ctrl *ctrl)
+ {
+ int irq;
+ xen_ulong_t pending_words;
+@@ -240,10 +242,7 @@ static void evtchn_2l_handle_events(unsigned cpu)
+
+ /* Process port. */
+ port = (word_idx * BITS_PER_EVTCHN_WORD) + bit_idx;
+- irq = get_evtchn_to_irq(port);
+-
+- if (irq != -1)
+- generic_handle_irq(irq);
++ handle_irq_for_port(port, ctrl);
+
+ bit_idx = (bit_idx + 1) % BITS_PER_EVTCHN_WORD;
+
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index 95e5a9300ff04..aca8456752797 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -32,6 +32,10 @@
+ #include <linux/slab.h>
+ #include <linux/irqnr.h>
+ #include <linux/pci.h>
++#include <linux/spinlock.h>
++#include <linux/cpuhotplug.h>
++#include <linux/atomic.h>
++#include <linux/ktime.h>
+
+ #ifdef CONFIG_X86
+ #include <asm/desc.h>
+@@ -61,6 +65,15 @@
+
+ #include "events_internal.h"
+
++#undef MODULE_PARAM_PREFIX
++#define MODULE_PARAM_PREFIX "xen."
++
++static uint __read_mostly event_loop_timeout = 2;
++module_param(event_loop_timeout, uint, 0644);
++
++static uint __read_mostly event_eoi_delay = 10;
++module_param(event_eoi_delay, uint, 0644);
++
+ const struct evtchn_ops *evtchn_ops;
+
+ /*
+@@ -69,6 +82,24 @@ const struct evtchn_ops *evtchn_ops;
+ */
+ static DEFINE_MUTEX(irq_mapping_update_lock);
+
++/*
++ * Lock protecting event handling loop against removing event channels.
++ * Adding of event channels is no issue as the associated IRQ becomes active
++ * only after everything is setup (before request_[threaded_]irq() the handler
++ * can't be entered for an event, as the event channel will be unmasked only
++ * then).
++ */
++static DEFINE_RWLOCK(evtchn_rwlock);
++
++/*
++ * Lock hierarchy:
++ *
++ * irq_mapping_update_lock
++ * evtchn_rwlock
++ * IRQ-desc lock
++ * percpu eoi_list_lock
++ */
++
+ static LIST_HEAD(xen_irq_list_head);
+
+ /* IRQ <-> VIRQ mapping. */
+@@ -90,18 +121,23 @@ static bool (*pirq_needs_eoi)(unsigned irq);
+ /* Xen will never allocate port zero for any purpose. */
+ #define VALID_EVTCHN(chn) ((chn) != 0)
+
++static struct irq_info *legacy_info_ptrs[NR_IRQS_LEGACY];
++
+ static struct irq_chip xen_dynamic_chip;
++static struct irq_chip xen_lateeoi_chip;
+ static struct irq_chip xen_percpu_chip;
+ static struct irq_chip xen_pirq_chip;
+ static void enable_dynirq(struct irq_data *data);
+ static void disable_dynirq(struct irq_data *data);
+
++static DEFINE_PER_CPU(unsigned int, irq_epoch);
++
+ static void clear_evtchn_to_irq_row(unsigned row)
+ {
+ unsigned col;
+
+ for (col = 0; col < EVTCHN_PER_ROW; col++)
+- evtchn_to_irq[row][col] = -1;
++ WRITE_ONCE(evtchn_to_irq[row][col], -1);
+ }
+
+ static void clear_evtchn_to_irq_all(void)
+@@ -138,7 +174,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq)
+ clear_evtchn_to_irq_row(row);
+ }
+
+- evtchn_to_irq[row][col] = irq;
++ WRITE_ONCE(evtchn_to_irq[row][col], irq);
+ return 0;
+ }
+
+@@ -148,13 +184,24 @@ int get_evtchn_to_irq(unsigned evtchn)
+ return -1;
+ if (evtchn_to_irq[EVTCHN_ROW(evtchn)] == NULL)
+ return -1;
+- return evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)];
++ return READ_ONCE(evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)]);
+ }
+
+ /* Get info for IRQ */
+ struct irq_info *info_for_irq(unsigned irq)
+ {
+- return irq_get_chip_data(irq);
++ if (irq < nr_legacy_irqs())
++ return legacy_info_ptrs[irq];
++ else
++ return irq_get_chip_data(irq);
++}
++
++static void set_info_for_irq(unsigned int irq, struct irq_info *info)
++{
++ if (irq < nr_legacy_irqs())
++ legacy_info_ptrs[irq] = info;
++ else
++ irq_set_chip_data(irq, info);
+ }
+
+ /* Constructors for packed IRQ information. */
+@@ -246,10 +293,14 @@ static void xen_irq_info_cleanup(struct irq_info *info)
+ */
+ unsigned int evtchn_from_irq(unsigned irq)
+ {
+- if (unlikely(WARN(irq >= nr_irqs, "Invalid irq %d!\n", irq)))
++ const struct irq_info *info = NULL;
++
++ if (likely(irq < nr_irqs))
++ info = info_for_irq(irq);
++ if (!info)
+ return 0;
+
+- return info_for_irq(irq)->evtchn;
++ return info->evtchn;
+ }
+
+ unsigned irq_from_evtchn(unsigned int evtchn)
+@@ -360,9 +411,157 @@ void notify_remote_via_irq(int irq)
+ }
+ EXPORT_SYMBOL_GPL(notify_remote_via_irq);
+
++struct lateeoi_work {
++ struct delayed_work delayed;
++ spinlock_t eoi_list_lock;
++ struct list_head eoi_list;
++};
++
++static DEFINE_PER_CPU(struct lateeoi_work, lateeoi);
++
++static void lateeoi_list_del(struct irq_info *info)
++{
++ struct lateeoi_work *eoi = &per_cpu(lateeoi, info->eoi_cpu);
++ unsigned long flags;
++
++ spin_lock_irqsave(&eoi->eoi_list_lock, flags);
++ list_del_init(&info->eoi_list);
++ spin_unlock_irqrestore(&eoi->eoi_list_lock, flags);
++}
++
++static void lateeoi_list_add(struct irq_info *info)
++{
++ struct lateeoi_work *eoi = &per_cpu(lateeoi, info->eoi_cpu);
++ struct irq_info *elem;
++ u64 now = get_jiffies_64();
++ unsigned long delay;
++ unsigned long flags;
++
++ if (now < info->eoi_time)
++ delay = info->eoi_time - now;
++ else
++ delay = 1;
++
++ spin_lock_irqsave(&eoi->eoi_list_lock, flags);
++
++ if (list_empty(&eoi->eoi_list)) {
++ list_add(&info->eoi_list, &eoi->eoi_list);
++ mod_delayed_work_on(info->eoi_cpu, system_wq,
++ &eoi->delayed, delay);
++ } else {
++ list_for_each_entry_reverse(elem, &eoi->eoi_list, eoi_list) {
++ if (elem->eoi_time <= info->eoi_time)
++ break;
++ }
++ list_add(&info->eoi_list, &elem->eoi_list);
++ }
++
++ spin_unlock_irqrestore(&eoi->eoi_list_lock, flags);
++}
++
++static void xen_irq_lateeoi_locked(struct irq_info *info, bool spurious)
++{
++ evtchn_port_t evtchn;
++ unsigned int cpu;
++ unsigned int delay = 0;
++
++ evtchn = info->evtchn;
++ if (!VALID_EVTCHN(evtchn) || !list_empty(&info->eoi_list))
++ return;
++
++ if (spurious) {
++ if ((1 << info->spurious_cnt) < (HZ << 2))
++ info->spurious_cnt++;
++ if (info->spurious_cnt > 1) {
++ delay = 1 << (info->spurious_cnt - 2);
++ if (delay > HZ)
++ delay = HZ;
++ if (!info->eoi_time)
++ info->eoi_cpu = smp_processor_id();
++ info->eoi_time = get_jiffies_64() + delay;
++ }
++ } else {
++ info->spurious_cnt = 0;
++ }
++
++ cpu = info->eoi_cpu;
++ if (info->eoi_time &&
++ (info->irq_epoch == per_cpu(irq_epoch, cpu) || delay)) {
++ lateeoi_list_add(info);
++ return;
++ }
++
++ info->eoi_time = 0;
++ unmask_evtchn(evtchn);
++}
++
++static void xen_irq_lateeoi_worker(struct work_struct *work)
++{
++ struct lateeoi_work *eoi;
++ struct irq_info *info;
++ u64 now = get_jiffies_64();
++ unsigned long flags;
++
++ eoi = container_of(to_delayed_work(work), struct lateeoi_work, delayed);
++
++ read_lock_irqsave(&evtchn_rwlock, flags);
++
++ while (true) {
++ spin_lock(&eoi->eoi_list_lock);
++
++ info = list_first_entry_or_null(&eoi->eoi_list, struct irq_info,
++ eoi_list);
++
++ if (info == NULL || now < info->eoi_time) {
++ spin_unlock(&eoi->eoi_list_lock);
++ break;
++ }
++
++ list_del_init(&info->eoi_list);
++
++ spin_unlock(&eoi->eoi_list_lock);
++
++ info->eoi_time = 0;
++
++ xen_irq_lateeoi_locked(info, false);
++ }
++
++ if (info)
++ mod_delayed_work_on(info->eoi_cpu, system_wq,
++ &eoi->delayed, info->eoi_time - now);
++
++ read_unlock_irqrestore(&evtchn_rwlock, flags);
++}
++
++static void xen_cpu_init_eoi(unsigned int cpu)
++{
++ struct lateeoi_work *eoi = &per_cpu(lateeoi, cpu);
++
++ INIT_DELAYED_WORK(&eoi->delayed, xen_irq_lateeoi_worker);
++ spin_lock_init(&eoi->eoi_list_lock);
++ INIT_LIST_HEAD(&eoi->eoi_list);
++}
++
++void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags)
++{
++ struct irq_info *info;
++ unsigned long flags;
++
++ read_lock_irqsave(&evtchn_rwlock, flags);
++
++ info = info_for_irq(irq);
++
++ if (info)
++ xen_irq_lateeoi_locked(info, eoi_flags & XEN_EOI_FLAG_SPURIOUS);
++
++ read_unlock_irqrestore(&evtchn_rwlock, flags);
++}
++EXPORT_SYMBOL_GPL(xen_irq_lateeoi);
++
+ static void xen_irq_init(unsigned irq)
+ {
+ struct irq_info *info;
++
+ #ifdef CONFIG_SMP
+ /* By default all event channels notify CPU#0. */
+ cpumask_copy(irq_get_affinity_mask(irq), cpumask_of(0));
+@@ -375,8 +574,9 @@ static void xen_irq_init(unsigned irq)
+ info->type = IRQT_UNBOUND;
+ info->refcnt = -1;
+
+- irq_set_chip_data(irq, info);
++ set_info_for_irq(irq, info);
+
++ INIT_LIST_HEAD(&info->eoi_list);
+ list_add_tail(&info->list, &xen_irq_list_head);
+ }
+
+@@ -424,17 +624,25 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi)
+
+ static void xen_free_irq(unsigned irq)
+ {
+- struct irq_info *info = irq_get_chip_data(irq);
++ struct irq_info *info = info_for_irq(irq);
++ unsigned long flags;
+
+ if (WARN_ON(!info))
+ return;
+
++ write_lock_irqsave(&evtchn_rwlock, flags);
++
++ if (!list_empty(&info->eoi_list))
++ lateeoi_list_del(info);
++
+ list_del(&info->list);
+
+- irq_set_chip_data(irq, NULL);
++ set_info_for_irq(irq, NULL);
+
+ WARN_ON(info->refcnt > 0);
+
++ write_unlock_irqrestore(&evtchn_rwlock, flags);
++
+ kfree(info);
+
+ /* Legacy IRQ descriptors are managed by the arch. */
+@@ -601,7 +809,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
+ static void __unbind_from_irq(unsigned int irq)
+ {
+ int evtchn = evtchn_from_irq(irq);
+- struct irq_info *info = irq_get_chip_data(irq);
++ struct irq_info *info = info_for_irq(irq);
+
+ if (info->refcnt > 0) {
+ info->refcnt--;
+@@ -826,7 +1034,7 @@ int xen_pirq_from_irq(unsigned irq)
+ }
+ EXPORT_SYMBOL_GPL(xen_pirq_from_irq);
+
+-int bind_evtchn_to_irq(unsigned int evtchn)
++static int bind_evtchn_to_irq_chip(evtchn_port_t evtchn, struct irq_chip *chip)
+ {
+ int irq;
+ int ret;
+@@ -843,7 +1051,7 @@ int bind_evtchn_to_irq(unsigned int evtchn)
+ if (irq < 0)
+ goto out;
+
+- irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
++ irq_set_chip_and_handler_name(irq, chip,
+ handle_edge_irq, "event");
+
+ ret = xen_irq_info_evtchn_setup(irq, evtchn);
+@@ -864,8 +1072,19 @@ out:
+
+ return irq;
+ }
++
++int bind_evtchn_to_irq(evtchn_port_t evtchn)
++{
++ return bind_evtchn_to_irq_chip(evtchn, &xen_dynamic_chip);
++}
+ EXPORT_SYMBOL_GPL(bind_evtchn_to_irq);
+
++int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn)
++{
++ return bind_evtchn_to_irq_chip(evtchn, &xen_lateeoi_chip);
++}
++EXPORT_SYMBOL_GPL(bind_evtchn_to_irq_lateeoi);
++
+ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
+ {
+ struct evtchn_bind_ipi bind_ipi;
+@@ -907,8 +1126,9 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
+ return irq;
+ }
+
+-int bind_interdomain_evtchn_to_irq(unsigned int remote_domain,
+- unsigned int remote_port)
++static int bind_interdomain_evtchn_to_irq_chip(unsigned int remote_domain,
++ evtchn_port_t remote_port,
++ struct irq_chip *chip)
+ {
+ struct evtchn_bind_interdomain bind_interdomain;
+ int err;
+@@ -919,10 +1139,26 @@ int bind_interdomain_evtchn_to_irq(unsigned int remote_domain,
+ err = HYPERVISOR_event_channel_op(EVTCHNOP_bind_interdomain,
+ &bind_interdomain);
+
+- return err ? : bind_evtchn_to_irq(bind_interdomain.local_port);
++ return err ? : bind_evtchn_to_irq_chip(bind_interdomain.local_port,
++ chip);
++}
++
++int bind_interdomain_evtchn_to_irq(unsigned int remote_domain,
++ evtchn_port_t remote_port)
++{
++ return bind_interdomain_evtchn_to_irq_chip(remote_domain, remote_port,
++ &xen_dynamic_chip);
+ }
+ EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq);
+
++int bind_interdomain_evtchn_to_irq_lateeoi(unsigned int remote_domain,
++ evtchn_port_t remote_port)
++{
++ return bind_interdomain_evtchn_to_irq_chip(remote_domain, remote_port,
++ &xen_lateeoi_chip);
++}
++EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irq_lateeoi);
++
+ static int find_virq(unsigned int virq, unsigned int cpu)
+ {
+ struct evtchn_status status;
+@@ -1018,14 +1254,15 @@ static void unbind_from_irq(unsigned int irq)
+ mutex_unlock(&irq_mapping_update_lock);
+ }
+
+-int bind_evtchn_to_irqhandler(unsigned int evtchn,
+- irq_handler_t handler,
+- unsigned long irqflags,
+- const char *devname, void *dev_id)
++static int bind_evtchn_to_irqhandler_chip(evtchn_port_t evtchn,
++ irq_handler_t handler,
++ unsigned long irqflags,
++ const char *devname, void *dev_id,
++ struct irq_chip *chip)
+ {
+ int irq, retval;
+
+- irq = bind_evtchn_to_irq(evtchn);
++ irq = bind_evtchn_to_irq_chip(evtchn, chip);
+ if (irq < 0)
+ return irq;
+ retval = request_irq(irq, handler, irqflags, devname, dev_id);
+@@ -1036,18 +1273,38 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn,
+
+ return irq;
+ }
++
++int bind_evtchn_to_irqhandler(evtchn_port_t evtchn,
++ irq_handler_t handler,
++ unsigned long irqflags,
++ const char *devname, void *dev_id)
++{
++ return bind_evtchn_to_irqhandler_chip(evtchn, handler, irqflags,
++ devname, dev_id,
++ &xen_dynamic_chip);
++}
+ EXPORT_SYMBOL_GPL(bind_evtchn_to_irqhandler);
+
+-int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain,
+- unsigned int remote_port,
+- irq_handler_t handler,
+- unsigned long irqflags,
+- const char *devname,
+- void *dev_id)
++int bind_evtchn_to_irqhandler_lateeoi(evtchn_port_t evtchn,
++ irq_handler_t handler,
++ unsigned long irqflags,
++ const char *devname, void *dev_id)
++{
++ return bind_evtchn_to_irqhandler_chip(evtchn, handler, irqflags,
++ devname, dev_id,
++ &xen_lateeoi_chip);
++}
++EXPORT_SYMBOL_GPL(bind_evtchn_to_irqhandler_lateeoi);
++
++static int bind_interdomain_evtchn_to_irqhandler_chip(
++ unsigned int remote_domain, evtchn_port_t remote_port,
++ irq_handler_t handler, unsigned long irqflags,
++ const char *devname, void *dev_id, struct irq_chip *chip)
+ {
+ int irq, retval;
+
+- irq = bind_interdomain_evtchn_to_irq(remote_domain, remote_port);
++ irq = bind_interdomain_evtchn_to_irq_chip(remote_domain, remote_port,
++ chip);
+ if (irq < 0)
+ return irq;
+
+@@ -1059,8 +1316,33 @@ int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain,
+
+ return irq;
+ }
++
++int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain,
++ evtchn_port_t remote_port,
++ irq_handler_t handler,
++ unsigned long irqflags,
++ const char *devname,
++ void *dev_id)
++{
++ return bind_interdomain_evtchn_to_irqhandler_chip(remote_domain,
++ remote_port, handler, irqflags, devname,
++ dev_id, &xen_dynamic_chip);
++}
+ EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irqhandler);
+
++int bind_interdomain_evtchn_to_irqhandler_lateeoi(unsigned int remote_domain,
++ evtchn_port_t remote_port,
++ irq_handler_t handler,
++ unsigned long irqflags,
++ const char *devname,
++ void *dev_id)
++{
++ return bind_interdomain_evtchn_to_irqhandler_chip(remote_domain,
++ remote_port, handler, irqflags, devname,
++ dev_id, &xen_lateeoi_chip);
++}
++EXPORT_SYMBOL_GPL(bind_interdomain_evtchn_to_irqhandler_lateeoi);
++
+ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname, void *dev_id)
+@@ -1105,7 +1387,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
+
+ void unbind_from_irqhandler(unsigned int irq, void *dev_id)
+ {
+- struct irq_info *info = irq_get_chip_data(irq);
++ struct irq_info *info = info_for_irq(irq);
+
+ if (WARN_ON(!info))
+ return;
+@@ -1139,7 +1421,7 @@ int evtchn_make_refcounted(unsigned int evtchn)
+ if (irq == -1)
+ return -ENOENT;
+
+- info = irq_get_chip_data(irq);
++ info = info_for_irq(irq);
+
+ if (!info)
+ return -ENOENT;
+@@ -1167,13 +1449,13 @@ int evtchn_get(unsigned int evtchn)
+ if (irq == -1)
+ goto done;
+
+- info = irq_get_chip_data(irq);
++ info = info_for_irq(irq);
+
+ if (!info)
+ goto done;
+
+ err = -EINVAL;
+- if (info->refcnt <= 0)
++ if (info->refcnt <= 0 || info->refcnt == SHRT_MAX)
+ goto done;
+
+ info->refcnt++;
+@@ -1212,6 +1494,54 @@ void xen_send_IPI_one(unsigned int cpu, enum ipi_vector vector)
+ notify_remote_via_irq(irq);
+ }
+
++struct evtchn_loop_ctrl {
++ ktime_t timeout;
++ unsigned count;
++ bool defer_eoi;
++};
++
++void handle_irq_for_port(evtchn_port_t port, struct evtchn_loop_ctrl *ctrl)
++{
++ int irq;
++ struct irq_info *info;
++
++ irq = get_evtchn_to_irq(port);
++ if (irq == -1)
++ return;
++
++ /*
++ * Check for timeout every 256 events.
++ * We are setting the timeout value only after the first 256
++ * events in order to not hurt the common case of few loop
++ * iterations. The 256 is basically an arbitrary value.
++ *
++ * In case we are hitting the timeout we need to defer all further
++ * EOIs in order to ensure to leave the event handling loop rather
++ * sooner than later.
++ */
++ if (!ctrl->defer_eoi && !(++ctrl->count & 0xff)) {
++ ktime_t kt = ktime_get();
++
++ if (!ctrl->timeout) {
++ kt = ktime_add_ms(kt,
++ jiffies_to_msecs(event_loop_timeout));
++ ctrl->timeout = kt;
++ } else if (kt > ctrl->timeout) {
++ ctrl->defer_eoi = true;
++ }
++ }
++
++ info = info_for_irq(irq);
++
++ if (ctrl->defer_eoi) {
++ info->eoi_cpu = smp_processor_id();
++ info->irq_epoch = __this_cpu_read(irq_epoch);
++ info->eoi_time = get_jiffies_64() + event_eoi_delay;
++ }
++
++ generic_handle_irq(irq);
++}
++
+ static DEFINE_PER_CPU(unsigned, xed_nesting_count);
+
+ static void __xen_evtchn_do_upcall(void)
+@@ -1219,6 +1549,9 @@ static void __xen_evtchn_do_upcall(void)
+ struct vcpu_info *vcpu_info = __this_cpu_read(xen_vcpu);
+ int cpu = get_cpu();
+ unsigned count;
++ struct evtchn_loop_ctrl ctrl = { 0 };
++
++ read_lock(&evtchn_rwlock);
+
+ do {
+ vcpu_info->evtchn_upcall_pending = 0;
+@@ -1226,7 +1559,7 @@ static void __xen_evtchn_do_upcall(void)
+ if (__this_cpu_inc_return(xed_nesting_count) - 1)
+ goto out;
+
+- xen_evtchn_handle_events(cpu);
++ xen_evtchn_handle_events(cpu, &ctrl);
+
+ BUG_ON(!irqs_disabled());
+
+@@ -1235,6 +1568,14 @@ static void __xen_evtchn_do_upcall(void)
+ } while (count != 1 || vcpu_info->evtchn_upcall_pending);
+
+ out:
++ read_unlock(&evtchn_rwlock);
++
++ /*
++ * Increment irq_epoch only now to defer EOIs only for
++ * xen_irq_lateeoi() invocations occurring from inside the loop
++ * above.
++ */
++ __this_cpu_inc(irq_epoch);
+
+ put_cpu();
+ }
+@@ -1601,6 +1942,21 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
+ .irq_retrigger = retrigger_dynirq,
+ };
+
++static struct irq_chip xen_lateeoi_chip __read_mostly = {
++ /* The chip name needs to contain "xen-dyn" for irqbalance to work. */
++ .name = "xen-dyn-lateeoi",
++
++ .irq_disable = disable_dynirq,
++ .irq_mask = disable_dynirq,
++ .irq_unmask = enable_dynirq,
++
++ .irq_ack = mask_ack_dynirq,
++ .irq_mask_ack = mask_ack_dynirq,
++
++ .irq_set_affinity = set_affinity_irq,
++ .irq_retrigger = retrigger_dynirq,
++};
++
+ static struct irq_chip xen_pirq_chip __read_mostly = {
+ .name = "xen-pirq",
+
+@@ -1667,12 +2023,31 @@ void xen_callback_vector(void)
+ void xen_callback_vector(void) {}
+ #endif
+
+-#undef MODULE_PARAM_PREFIX
+-#define MODULE_PARAM_PREFIX "xen."
+-
+ static bool fifo_events = true;
+ module_param(fifo_events, bool, 0);
+
++static int xen_evtchn_cpu_prepare(unsigned int cpu)
++{
++ int ret = 0;
++
++ xen_cpu_init_eoi(cpu);
++
++ if (evtchn_ops->percpu_init)
++ ret = evtchn_ops->percpu_init(cpu);
++
++ return ret;
++}
++
++static int xen_evtchn_cpu_dead(unsigned int cpu)
++{
++ int ret = 0;
++
++ if (evtchn_ops->percpu_deinit)
++ ret = evtchn_ops->percpu_deinit(cpu);
++
++ return ret;
++}
++
+ void __init xen_init_IRQ(void)
+ {
+ int ret = -EINVAL;
+@@ -1683,6 +2058,12 @@ void __init xen_init_IRQ(void)
+ if (ret < 0)
+ xen_evtchn_2l_init();
+
++ xen_cpu_init_eoi(smp_processor_id());
++
++ cpuhp_setup_state_nocalls(CPUHP_XEN_EVTCHN_PREPARE,
++ "xen/evtchn:prepare",
++ xen_evtchn_cpu_prepare, xen_evtchn_cpu_dead);
++
+ evtchn_to_irq = kcalloc(EVTCHN_ROW(xen_evtchn_max_channels()),
+ sizeof(*evtchn_to_irq), GFP_KERNEL);
+ BUG_ON(!evtchn_to_irq);
+diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
+index 76b318e88382e..33462521bfd0f 100644
+--- a/drivers/xen/events/events_fifo.c
++++ b/drivers/xen/events/events_fifo.c
+@@ -227,19 +227,25 @@ static bool evtchn_fifo_is_masked(unsigned port)
+ return sync_test_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
+ }
+ /*
+- * Clear MASKED, spinning if BUSY is set.
++ * Clear MASKED if not PENDING, spinning if BUSY is set.
++ * Return true if mask was cleared.
+ */
+-static void clear_masked(volatile event_word_t *word)
++static bool clear_masked_cond(volatile event_word_t *word)
+ {
+ event_word_t new, old, w;
+
+ w = *word;
+
+ do {
++ if (w & (1 << EVTCHN_FIFO_PENDING))
++ return false;
++
+ old = w & ~(1 << EVTCHN_FIFO_BUSY);
+ new = old & ~(1 << EVTCHN_FIFO_MASKED);
+ w = sync_cmpxchg(word, old, new);
+ } while (w != old);
++
++ return true;
+ }
+
+ static void evtchn_fifo_unmask(unsigned port)
+@@ -248,8 +254,7 @@ static void evtchn_fifo_unmask(unsigned port)
+
+ BUG_ON(!irqs_disabled());
+
+- clear_masked(word);
+- if (evtchn_fifo_is_pending(port)) {
++ if (!clear_masked_cond(word)) {
+ struct evtchn_unmask unmask = { .port = port };
+ (void)HYPERVISOR_event_channel_op(EVTCHNOP_unmask, &unmask);
+ }
+@@ -270,19 +275,9 @@ static uint32_t clear_linked(volatile event_word_t *word)
+ return w & EVTCHN_FIFO_LINK_MASK;
+ }
+
+-static void handle_irq_for_port(unsigned port)
+-{
+- int irq;
+-
+- irq = get_evtchn_to_irq(port);
+- if (irq != -1)
+- generic_handle_irq(irq);
+-}
+-
+-static void consume_one_event(unsigned cpu,
++static void consume_one_event(unsigned cpu, struct evtchn_loop_ctrl *ctrl,
+ struct evtchn_fifo_control_block *control_block,
+- unsigned priority, unsigned long *ready,
+- bool drop)
++ unsigned priority, unsigned long *ready)
+ {
+ struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu);
+ uint32_t head;
+@@ -315,16 +310,17 @@ static void consume_one_event(unsigned cpu,
+ clear_bit(priority, ready);
+
+ if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port)) {
+- if (unlikely(drop))
++ if (unlikely(!ctrl))
+ pr_warn("Dropping pending event for port %u\n", port);
+ else
+- handle_irq_for_port(port);
++ handle_irq_for_port(port, ctrl);
+ }
+
+ q->head[priority] = head;
+ }
+
+-static void __evtchn_fifo_handle_events(unsigned cpu, bool drop)
++static void __evtchn_fifo_handle_events(unsigned cpu,
++ struct evtchn_loop_ctrl *ctrl)
+ {
+ struct evtchn_fifo_control_block *control_block;
+ unsigned long ready;
+@@ -336,14 +332,15 @@ static void __evtchn_fifo_handle_events(unsigned cpu, bool drop)
+
+ while (ready) {
+ q = find_first_bit(&ready, EVTCHN_FIFO_MAX_QUEUES);
+- consume_one_event(cpu, control_block, q, &ready, drop);
++ consume_one_event(cpu, ctrl, control_block, q, &ready);
+ ready |= xchg(&control_block->ready, 0);
+ }
+ }
+
+-static void evtchn_fifo_handle_events(unsigned cpu)
++static void evtchn_fifo_handle_events(unsigned cpu,
++ struct evtchn_loop_ctrl *ctrl)
+ {
+- __evtchn_fifo_handle_events(cpu, false);
++ __evtchn_fifo_handle_events(cpu, ctrl);
+ }
+
+ static void evtchn_fifo_resume(void)
+@@ -380,21 +377,6 @@ static void evtchn_fifo_resume(void)
+ event_array_pages = 0;
+ }
+
+-static const struct evtchn_ops evtchn_ops_fifo = {
+- .max_channels = evtchn_fifo_max_channels,
+- .nr_channels = evtchn_fifo_nr_channels,
+- .setup = evtchn_fifo_setup,
+- .bind_to_cpu = evtchn_fifo_bind_to_cpu,
+- .clear_pending = evtchn_fifo_clear_pending,
+- .set_pending = evtchn_fifo_set_pending,
+- .is_pending = evtchn_fifo_is_pending,
+- .test_and_set_mask = evtchn_fifo_test_and_set_mask,
+- .mask = evtchn_fifo_mask,
+- .unmask = evtchn_fifo_unmask,
+- .handle_events = evtchn_fifo_handle_events,
+- .resume = evtchn_fifo_resume,
+-};
+-
+ static int evtchn_fifo_alloc_control_block(unsigned cpu)
+ {
+ void *control_block = NULL;
+@@ -417,19 +399,36 @@ static int evtchn_fifo_alloc_control_block(unsigned cpu)
+ return ret;
+ }
+
+-static int xen_evtchn_cpu_prepare(unsigned int cpu)
++static int evtchn_fifo_percpu_init(unsigned int cpu)
+ {
+ if (!per_cpu(cpu_control_block, cpu))
+ return evtchn_fifo_alloc_control_block(cpu);
+ return 0;
+ }
+
+-static int xen_evtchn_cpu_dead(unsigned int cpu)
++static int evtchn_fifo_percpu_deinit(unsigned int cpu)
+ {
+- __evtchn_fifo_handle_events(cpu, true);
++ __evtchn_fifo_handle_events(cpu, NULL);
+ return 0;
+ }
+
++static const struct evtchn_ops evtchn_ops_fifo = {
++ .max_channels = evtchn_fifo_max_channels,
++ .nr_channels = evtchn_fifo_nr_channels,
++ .setup = evtchn_fifo_setup,
++ .bind_to_cpu = evtchn_fifo_bind_to_cpu,
++ .clear_pending = evtchn_fifo_clear_pending,
++ .set_pending = evtchn_fifo_set_pending,
++ .is_pending = evtchn_fifo_is_pending,
++ .test_and_set_mask = evtchn_fifo_test_and_set_mask,
++ .mask = evtchn_fifo_mask,
++ .unmask = evtchn_fifo_unmask,
++ .handle_events = evtchn_fifo_handle_events,
++ .resume = evtchn_fifo_resume,
++ .percpu_init = evtchn_fifo_percpu_init,
++ .percpu_deinit = evtchn_fifo_percpu_deinit,
++};
++
+ int __init xen_evtchn_fifo_init(void)
+ {
+ int cpu = smp_processor_id();
+@@ -443,9 +442,5 @@ int __init xen_evtchn_fifo_init(void)
+
+ evtchn_ops = &evtchn_ops_fifo;
+
+- cpuhp_setup_state_nocalls(CPUHP_XEN_EVTCHN_PREPARE,
+- "xen/evtchn:prepare",
+- xen_evtchn_cpu_prepare, xen_evtchn_cpu_dead);
+-
+ return ret;
+ }
+diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h
+index 50c2050a1e320..b9b4f59198930 100644
+--- a/drivers/xen/events/events_internal.h
++++ b/drivers/xen/events/events_internal.h
+@@ -32,11 +32,16 @@ enum xen_irq_type {
+ */
+ struct irq_info {
+ struct list_head list;
+- int refcnt;
++ struct list_head eoi_list;
++ short refcnt;
++ short spurious_cnt;
+ enum xen_irq_type type; /* type */
+ unsigned irq;
+ unsigned int evtchn; /* event channel */
+ unsigned short cpu; /* cpu bound */
++ unsigned short eoi_cpu; /* EOI must happen on this cpu */
++ unsigned int irq_epoch; /* If eoi_cpu valid: irq_epoch of event */
++ u64 eoi_time; /* Time in jiffies when to EOI. */
+
+ union {
+ unsigned short virq;
+@@ -55,6 +60,8 @@ struct irq_info {
+ #define PIRQ_SHAREABLE (1 << 1)
+ #define PIRQ_MSI_GROUP (1 << 2)
+
++struct evtchn_loop_ctrl;
++
+ struct evtchn_ops {
+ unsigned (*max_channels)(void);
+ unsigned (*nr_channels)(void);
+@@ -69,14 +76,18 @@ struct evtchn_ops {
+ void (*mask)(unsigned port);
+ void (*unmask)(unsigned port);
+
+- void (*handle_events)(unsigned cpu);
++ void (*handle_events)(unsigned cpu, struct evtchn_loop_ctrl *ctrl);
+ void (*resume)(void);
++
++ int (*percpu_init)(unsigned int cpu);
++ int (*percpu_deinit)(unsigned int cpu);
+ };
+
+ extern const struct evtchn_ops *evtchn_ops;
+
+ extern int **evtchn_to_irq;
+ int get_evtchn_to_irq(unsigned int evtchn);
++void handle_irq_for_port(evtchn_port_t port, struct evtchn_loop_ctrl *ctrl);
+
+ struct irq_info *info_for_irq(unsigned irq);
+ unsigned cpu_from_irq(unsigned irq);
+@@ -134,9 +145,10 @@ static inline void unmask_evtchn(unsigned port)
+ return evtchn_ops->unmask(port);
+ }
+
+-static inline void xen_evtchn_handle_events(unsigned cpu)
++static inline void xen_evtchn_handle_events(unsigned cpu,
++ struct evtchn_loop_ctrl *ctrl)
+ {
+- return evtchn_ops->handle_events(cpu);
++ return evtchn_ops->handle_events(cpu, ctrl);
+ }
+
+ static inline void xen_evtchn_resume(void)
+diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
+index 47c70b826a6ab..4b11e60e37a33 100644
+--- a/drivers/xen/evtchn.c
++++ b/drivers/xen/evtchn.c
+@@ -166,7 +166,6 @@ static irqreturn_t evtchn_interrupt(int irq, void *data)
+ "Interrupt for port %d, but apparently not enabled; per-user %p\n",
+ evtchn->port, u);
+
+- disable_irq_nosync(irq);
+ evtchn->enabled = false;
+
+ spin_lock(&u->ring_prod_lock);
+@@ -292,7 +291,7 @@ static ssize_t evtchn_write(struct file *file, const char __user *buf,
+ evtchn = find_evtchn(u, port);
+ if (evtchn && !evtchn->enabled) {
+ evtchn->enabled = true;
+- enable_irq(irq_from_evtchn(port));
++ xen_irq_lateeoi(irq_from_evtchn(port), 0);
+ }
+ }
+
+@@ -392,8 +391,8 @@ static int evtchn_bind_to_user(struct per_user_data *u, int port)
+ if (rc < 0)
+ goto err;
+
+- rc = bind_evtchn_to_irqhandler(port, evtchn_interrupt, 0,
+- u->name, evtchn);
++ rc = bind_evtchn_to_irqhandler_lateeoi(port, evtchn_interrupt, 0,
++ u->name, evtchn);
+ if (rc < 0)
+ goto err;
+
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index 398fd8b1639d4..f94bb6034a5a8 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -75,6 +75,7 @@ struct sock_mapping {
+ atomic_t write;
+ atomic_t io;
+ atomic_t release;
++ atomic_t eoi;
+ void (*saved_data_ready)(struct sock *sk);
+ struct pvcalls_ioworker ioworker;
+ };
+@@ -96,7 +97,7 @@ static int pvcalls_back_release_active(struct xenbus_device *dev,
+ struct pvcalls_fedata *fedata,
+ struct sock_mapping *map);
+
+-static void pvcalls_conn_back_read(void *opaque)
++static bool pvcalls_conn_back_read(void *opaque)
+ {
+ struct sock_mapping *map = (struct sock_mapping *)opaque;
+ struct msghdr msg;
+@@ -116,17 +117,17 @@ static void pvcalls_conn_back_read(void *opaque)
+ virt_mb();
+
+ if (error)
+- return;
++ return false;
+
+ size = pvcalls_queued(prod, cons, array_size);
+ if (size >= array_size)
+- return;
++ return false;
+ spin_lock_irqsave(&map->sock->sk->sk_receive_queue.lock, flags);
+ if (skb_queue_empty(&map->sock->sk->sk_receive_queue)) {
+ atomic_set(&map->read, 0);
+ spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock,
+ flags);
+- return;
++ return true;
+ }
+ spin_unlock_irqrestore(&map->sock->sk->sk_receive_queue.lock, flags);
+ wanted = array_size - size;
+@@ -150,7 +151,7 @@ static void pvcalls_conn_back_read(void *opaque)
+ ret = inet_recvmsg(map->sock, &msg, wanted, MSG_DONTWAIT);
+ WARN_ON(ret > wanted);
+ if (ret == -EAGAIN) /* shouldn't happen */
+- return;
++ return true;
+ if (!ret)
+ ret = -ENOTCONN;
+ spin_lock_irqsave(&map->sock->sk->sk_receive_queue.lock, flags);
+@@ -169,10 +170,10 @@ static void pvcalls_conn_back_read(void *opaque)
+ virt_wmb();
+ notify_remote_via_irq(map->irq);
+
+- return;
++ return true;
+ }
+
+-static void pvcalls_conn_back_write(struct sock_mapping *map)
++static bool pvcalls_conn_back_write(struct sock_mapping *map)
+ {
+ struct pvcalls_data_intf *intf = map->ring;
+ struct pvcalls_data *data = &map->data;
+@@ -189,7 +190,7 @@ static void pvcalls_conn_back_write(struct sock_mapping *map)
+ array_size = XEN_FLEX_RING_SIZE(map->ring_order);
+ size = pvcalls_queued(prod, cons, array_size);
+ if (size == 0)
+- return;
++ return false;
+
+ memset(&msg, 0, sizeof(msg));
+ msg.msg_flags |= MSG_DONTWAIT;
+@@ -207,12 +208,11 @@ static void pvcalls_conn_back_write(struct sock_mapping *map)
+
+ atomic_set(&map->write, 0);
+ ret = inet_sendmsg(map->sock, &msg, size);
+- if (ret == -EAGAIN || (ret >= 0 && ret < size)) {
++ if (ret == -EAGAIN) {
+ atomic_inc(&map->write);
+ atomic_inc(&map->io);
++ return true;
+ }
+- if (ret == -EAGAIN)
+- return;
+
+ /* write the data, then update the indexes */
+ virt_wmb();
+@@ -225,9 +225,13 @@ static void pvcalls_conn_back_write(struct sock_mapping *map)
+ }
+ /* update the indexes, then notify the other end */
+ virt_wmb();
+- if (prod != cons + ret)
++ if (prod != cons + ret) {
+ atomic_inc(&map->write);
++ atomic_inc(&map->io);
++ }
+ notify_remote_via_irq(map->irq);
++
++ return true;
+ }
+
+ static void pvcalls_back_ioworker(struct work_struct *work)
+@@ -236,6 +240,7 @@ static void pvcalls_back_ioworker(struct work_struct *work)
+ struct pvcalls_ioworker, register_work);
+ struct sock_mapping *map = container_of(ioworker, struct sock_mapping,
+ ioworker);
++ unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
+
+ while (atomic_read(&map->io) > 0) {
+ if (atomic_read(&map->release) > 0) {
+@@ -243,10 +248,18 @@ static void pvcalls_back_ioworker(struct work_struct *work)
+ return;
+ }
+
+- if (atomic_read(&map->read) > 0)
+- pvcalls_conn_back_read(map);
+- if (atomic_read(&map->write) > 0)
+- pvcalls_conn_back_write(map);
++ if (atomic_read(&map->read) > 0 &&
++ pvcalls_conn_back_read(map))
++ eoi_flags = 0;
++ if (atomic_read(&map->write) > 0 &&
++ pvcalls_conn_back_write(map))
++ eoi_flags = 0;
++
++ if (atomic_read(&map->eoi) > 0 && !atomic_read(&map->write)) {
++ atomic_set(&map->eoi, 0);
++ xen_irq_lateeoi(map->irq, eoi_flags);
++ eoi_flags = XEN_EOI_FLAG_SPURIOUS;
++ }
+
+ atomic_dec(&map->io);
+ }
+@@ -343,12 +356,9 @@ static struct sock_mapping *pvcalls_new_active_socket(
+ goto out;
+ map->bytes = page;
+
+- ret = bind_interdomain_evtchn_to_irqhandler(fedata->dev->otherend_id,
+- evtchn,
+- pvcalls_back_conn_event,
+- 0,
+- "pvcalls-backend",
+- map);
++ ret = bind_interdomain_evtchn_to_irqhandler_lateeoi(
++ fedata->dev->otherend_id, evtchn,
++ pvcalls_back_conn_event, 0, "pvcalls-backend", map);
+ if (ret < 0)
+ goto out;
+ map->irq = ret;
+@@ -882,15 +892,18 @@ static irqreturn_t pvcalls_back_event(int irq, void *dev_id)
+ {
+ struct xenbus_device *dev = dev_id;
+ struct pvcalls_fedata *fedata = NULL;
++ unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
+
+- if (dev == NULL)
+- return IRQ_HANDLED;
++ if (dev) {
++ fedata = dev_get_drvdata(&dev->dev);
++ if (fedata) {
++ pvcalls_back_work(fedata);
++ eoi_flags = 0;
++ }
++ }
+
+- fedata = dev_get_drvdata(&dev->dev);
+- if (fedata == NULL)
+- return IRQ_HANDLED;
++ xen_irq_lateeoi(irq, eoi_flags);
+
+- pvcalls_back_work(fedata);
+ return IRQ_HANDLED;
+ }
+
+@@ -900,12 +913,15 @@ static irqreturn_t pvcalls_back_conn_event(int irq, void *sock_map)
+ struct pvcalls_ioworker *iow;
+
+ if (map == NULL || map->sock == NULL || map->sock->sk == NULL ||
+- map->sock->sk->sk_user_data != map)
++ map->sock->sk->sk_user_data != map) {
++ xen_irq_lateeoi(irq, 0);
+ return IRQ_HANDLED;
++ }
+
+ iow = &map->ioworker;
+
+ atomic_inc(&map->write);
++ atomic_inc(&map->eoi);
+ atomic_inc(&map->io);
+ queue_work(iow->wq, &iow->register_work);
+
+@@ -940,7 +956,7 @@ static int backend_connect(struct xenbus_device *dev)
+ goto error;
+ }
+
+- err = bind_interdomain_evtchn_to_irq(dev->otherend_id, evtchn);
++ err = bind_interdomain_evtchn_to_irq_lateeoi(dev->otherend_id, evtchn);
+ if (err < 0)
+ goto error;
+ fedata->irq = err;
+diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
+index 097410a7cdb74..adf3aae2939f5 100644
+--- a/drivers/xen/xen-pciback/pci_stub.c
++++ b/drivers/xen/xen-pciback/pci_stub.c
+@@ -733,10 +733,17 @@ static pci_ers_result_t common_process(struct pcistub_device *psdev,
+ wmb();
+ notify_remote_via_irq(pdev->evtchn_irq);
+
++ /* Enable IRQ to signal "request done". */
++ xen_pcibk_lateeoi(pdev, 0);
++
+ ret = wait_event_timeout(xen_pcibk_aer_wait_queue,
+ !(test_bit(_XEN_PCIB_active, (unsigned long *)
+ &sh_info->flags)), 300*HZ);
+
++ /* Enable IRQ for pcifront request if not already active. */
++ if (!test_bit(_PDEVF_op_active, &pdev->flags))
++ xen_pcibk_lateeoi(pdev, 0);
++
+ if (!ret) {
+ if (test_bit(_XEN_PCIB_active,
+ (unsigned long *)&sh_info->flags)) {
+@@ -750,13 +757,6 @@ static pci_ers_result_t common_process(struct pcistub_device *psdev,
+ }
+ clear_bit(_PCIB_op_pending, (unsigned long *)&pdev->flags);
+
+- if (test_bit(_XEN_PCIF_active,
+- (unsigned long *)&sh_info->flags)) {
+- dev_dbg(&psdev->dev->dev,
+- "schedule pci_conf service in " DRV_NAME "\n");
+- xen_pcibk_test_and_schedule_op(psdev->pdev);
+- }
+-
+ res = (pci_ers_result_t)aer_op->err;
+ return res;
+ }
+diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
+index 263c059bff900..235cdfe13494f 100644
+--- a/drivers/xen/xen-pciback/pciback.h
++++ b/drivers/xen/xen-pciback/pciback.h
+@@ -14,6 +14,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/workqueue.h>
+ #include <linux/atomic.h>
++#include <xen/events.h>
+ #include <xen/interface/io/pciif.h>
+
+ #define DRV_NAME "xen-pciback"
+@@ -27,6 +28,8 @@ struct pci_dev_entry {
+ #define PDEVF_op_active (1<<(_PDEVF_op_active))
+ #define _PCIB_op_pending (1)
+ #define PCIB_op_pending (1<<(_PCIB_op_pending))
++#define _EOI_pending (2)
++#define EOI_pending (1<<(_EOI_pending))
+
+ struct xen_pcibk_device {
+ void *pci_dev_data;
+@@ -182,12 +185,17 @@ static inline void xen_pcibk_release_devices(struct xen_pcibk_device *pdev)
+ irqreturn_t xen_pcibk_handle_event(int irq, void *dev_id);
+ void xen_pcibk_do_op(struct work_struct *data);
+
++static inline void xen_pcibk_lateeoi(struct xen_pcibk_device *pdev,
++ unsigned int eoi_flag)
++{
++ if (test_and_clear_bit(_EOI_pending, &pdev->flags))
++ xen_irq_lateeoi(pdev->evtchn_irq, eoi_flag);
++}
++
+ int xen_pcibk_xenbus_register(void);
+ void xen_pcibk_xenbus_unregister(void);
+
+ extern int verbose_request;
+-
+-void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev);
+ #endif
+
+ /* Handles shared IRQs that can to device domain and control domain. */
+diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
+index 787966f445895..c4ed2c634ca7e 100644
+--- a/drivers/xen/xen-pciback/pciback_ops.c
++++ b/drivers/xen/xen-pciback/pciback_ops.c
+@@ -297,26 +297,41 @@ int xen_pcibk_disable_msix(struct xen_pcibk_device *pdev,
+ return 0;
+ }
+ #endif
++
++static inline bool xen_pcibk_test_op_pending(struct xen_pcibk_device *pdev)
++{
++ return test_bit(_XEN_PCIF_active,
++ (unsigned long *)&pdev->sh_info->flags) &&
++ !test_and_set_bit(_PDEVF_op_active, &pdev->flags);
++}
++
+ /*
+ * Now the same evtchn is used for both pcifront conf_read_write request
+ * as well as pcie aer front end ack. We use a new work_queue to schedule
+ * xen_pcibk conf_read_write service for avoiding confict with aer_core
+ * do_recovery job which also use the system default work_queue
+ */
+-void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev)
++static void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev)
+ {
++ bool eoi = true;
++
+ /* Check that frontend is requesting an operation and that we are not
+ * already processing a request */
+- if (test_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags)
+- && !test_and_set_bit(_PDEVF_op_active, &pdev->flags)) {
++ if (xen_pcibk_test_op_pending(pdev)) {
+ schedule_work(&pdev->op_work);
++ eoi = false;
+ }
+ /*_XEN_PCIB_active should have been cleared by pcifront. And also make
+ sure xen_pcibk is waiting for ack by checking _PCIB_op_pending*/
+ if (!test_bit(_XEN_PCIB_active, (unsigned long *)&pdev->sh_info->flags)
+ && test_bit(_PCIB_op_pending, &pdev->flags)) {
+ wake_up(&xen_pcibk_aer_wait_queue);
++ eoi = false;
+ }
++
++ /* EOI if there was nothing to do. */
++ if (eoi)
++ xen_pcibk_lateeoi(pdev, XEN_EOI_FLAG_SPURIOUS);
+ }
+
+ /* Performing the configuration space reads/writes must not be done in atomic
+@@ -324,10 +339,8 @@ void xen_pcibk_test_and_schedule_op(struct xen_pcibk_device *pdev)
+ * use of semaphores). This function is intended to be called from a work
+ * queue in process context taking a struct xen_pcibk_device as a parameter */
+
+-void xen_pcibk_do_op(struct work_struct *data)
++static void xen_pcibk_do_one_op(struct xen_pcibk_device *pdev)
+ {
+- struct xen_pcibk_device *pdev =
+- container_of(data, struct xen_pcibk_device, op_work);
+ struct pci_dev *dev;
+ struct xen_pcibk_dev_data *dev_data = NULL;
+ struct xen_pci_op *op = &pdev->op;
+@@ -400,16 +413,31 @@ void xen_pcibk_do_op(struct work_struct *data)
+ smp_mb__before_atomic(); /* /after/ clearing PCIF_active */
+ clear_bit(_PDEVF_op_active, &pdev->flags);
+ smp_mb__after_atomic(); /* /before/ final check for work */
++}
+
+- /* Check to see if the driver domain tried to start another request in
+- * between clearing _XEN_PCIF_active and clearing _PDEVF_op_active.
+- */
+- xen_pcibk_test_and_schedule_op(pdev);
++void xen_pcibk_do_op(struct work_struct *data)
++{
++ struct xen_pcibk_device *pdev =
++ container_of(data, struct xen_pcibk_device, op_work);
++
++ do {
++ xen_pcibk_do_one_op(pdev);
++ } while (xen_pcibk_test_op_pending(pdev));
++
++ xen_pcibk_lateeoi(pdev, 0);
+ }
+
+ irqreturn_t xen_pcibk_handle_event(int irq, void *dev_id)
+ {
+ struct xen_pcibk_device *pdev = dev_id;
++ bool eoi;
++
++ /* IRQs might come in before pdev->evtchn_irq is written. */
++ if (unlikely(pdev->evtchn_irq != irq))
++ pdev->evtchn_irq = irq;
++
++ eoi = test_and_set_bit(_EOI_pending, &pdev->flags);
++ WARN(eoi, "IRQ while EOI pending\n");
+
+ xen_pcibk_test_and_schedule_op(pdev);
+
+diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
+index 581c4e1a8b829..3bbed47da3fa5 100644
+--- a/drivers/xen/xen-pciback/xenbus.c
++++ b/drivers/xen/xen-pciback/xenbus.c
+@@ -123,7 +123,7 @@ static int xen_pcibk_do_attach(struct xen_pcibk_device *pdev, int gnt_ref,
+
+ pdev->sh_info = vaddr;
+
+- err = bind_interdomain_evtchn_to_irqhandler(
++ err = bind_interdomain_evtchn_to_irqhandler_lateeoi(
+ pdev->xdev->otherend_id, remote_evtchn, xen_pcibk_handle_event,
+ 0, DRV_NAME, pdev);
+ if (err < 0) {
+diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
+index 14a3d4cbc2a78..1abc0a55b8d9c 100644
+--- a/drivers/xen/xen-scsiback.c
++++ b/drivers/xen/xen-scsiback.c
+@@ -91,7 +91,6 @@ struct vscsibk_info {
+ unsigned int irq;
+
+ struct vscsiif_back_ring ring;
+- int ring_error;
+
+ spinlock_t ring_lock;
+ atomic_t nr_unreplied_reqs;
+@@ -722,7 +721,8 @@ static struct vscsibk_pend *prepare_pending_reqs(struct vscsibk_info *info,
+ return pending_req;
+ }
+
+-static int scsiback_do_cmd_fn(struct vscsibk_info *info)
++static int scsiback_do_cmd_fn(struct vscsibk_info *info,
++ unsigned int *eoi_flags)
+ {
+ struct vscsiif_back_ring *ring = &info->ring;
+ struct vscsiif_request ring_req;
+@@ -739,11 +739,12 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
+ rc = ring->rsp_prod_pvt;
+ pr_warn("Dom%d provided bogus ring requests (%#x - %#x = %u). Halting ring processing\n",
+ info->domid, rp, rc, rp - rc);
+- info->ring_error = 1;
+- return 0;
++ return -EINVAL;
+ }
+
+ while ((rc != rp)) {
++ *eoi_flags &= ~XEN_EOI_FLAG_SPURIOUS;
++
+ if (RING_REQUEST_CONS_OVERFLOW(ring, rc))
+ break;
+
+@@ -802,13 +803,16 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info)
+ static irqreturn_t scsiback_irq_fn(int irq, void *dev_id)
+ {
+ struct vscsibk_info *info = dev_id;
++ int rc;
++ unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS;
+
+- if (info->ring_error)
+- return IRQ_HANDLED;
+-
+- while (scsiback_do_cmd_fn(info))
++ while ((rc = scsiback_do_cmd_fn(info, &eoi_flags)) > 0)
+ cond_resched();
+
++ /* In case of a ring error we keep the event channel masked. */
++ if (!rc)
++ xen_irq_lateeoi(irq, eoi_flags);
++
+ return IRQ_HANDLED;
+ }
+
+@@ -829,7 +833,7 @@ static int scsiback_init_sring(struct vscsibk_info *info, grant_ref_t ring_ref,
+ sring = (struct vscsiif_sring *)area;
+ BACK_RING_INIT(&info->ring, sring, PAGE_SIZE);
+
+- err = bind_interdomain_evtchn_to_irq(info->domid, evtchn);
++ err = bind_interdomain_evtchn_to_irq_lateeoi(info->domid, evtchn);
+ if (err < 0)
+ goto unmap_page;
+
+@@ -1252,7 +1256,6 @@ static int scsiback_probe(struct xenbus_device *dev,
+
+ info->domid = dev->otherend_id;
+ spin_lock_init(&info->ring_lock);
+- info->ring_error = 0;
+ atomic_set(&info->nr_unreplied_reqs, 0);
+ init_waitqueue_head(&info->waiting_to_free);
+ info->dev = dev;
+diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
+index 550d0b169d7c2..61e0c552083fe 100644
+--- a/fs/9p/vfs_file.c
++++ b/fs/9p/vfs_file.c
+@@ -624,9 +624,9 @@ static void v9fs_mmap_vm_close(struct vm_area_struct *vma)
+ struct writeback_control wbc = {
+ .nr_to_write = LONG_MAX,
+ .sync_mode = WB_SYNC_ALL,
+- .range_start = vma->vm_pgoff * PAGE_SIZE,
++ .range_start = (loff_t)vma->vm_pgoff * PAGE_SIZE,
+ /* absolute end, byte at end included */
+- .range_end = vma->vm_pgoff * PAGE_SIZE +
++ .range_end = (loff_t)vma->vm_pgoff * PAGE_SIZE +
+ (vma->vm_end - vma->vm_start - 1),
+ };
+
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 8007b6aacec60..f36b2a386aae8 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1110,6 +1110,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+
+ ret = update_ref_for_cow(trans, root, buf, cow, &last_ref);
+ if (ret) {
++ btrfs_tree_unlock(cow);
++ free_extent_buffer(cow);
+ btrfs_abort_transaction(trans, ret);
+ return ret;
+ }
+@@ -1117,6 +1119,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ if (test_bit(BTRFS_ROOT_REF_COWS, &root->state)) {
+ ret = btrfs_reloc_cow_block(trans, root, buf, cow);
+ if (ret) {
++ btrfs_tree_unlock(cow);
++ free_extent_buffer(cow);
+ btrfs_abort_transaction(trans, ret);
+ return ret;
+ }
+@@ -1149,6 +1153,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ if (last_ref) {
+ ret = tree_mod_log_free_eb(buf);
+ if (ret) {
++ btrfs_tree_unlock(cow);
++ free_extent_buffer(cow);
+ btrfs_abort_transaction(trans, ret);
+ return ret;
+ }
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index 7374fb23381ca..14855972dee30 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -620,8 +620,7 @@ static int btrfs_delayed_inode_reserve_metadata(
+ */
+ if (!src_rsv || (!trans->bytes_reserved &&
+ src_rsv->type != BTRFS_BLOCK_RSV_DELALLOC)) {
+- ret = btrfs_qgroup_reserve_meta_prealloc(root,
+- fs_info->nodesize, true);
++ ret = btrfs_qgroup_reserve_meta_prealloc(root, num_bytes, true);
+ if (ret < 0)
+ return ret;
+ ret = btrfs_block_rsv_add(root, dst_rsv, num_bytes,
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index 1b9c8ffb038ff..36c0490156ac5 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -190,7 +190,7 @@ static int btrfs_init_dev_replace_tgtdev(struct btrfs_fs_info *fs_info,
+ int ret = 0;
+
+ *device_out = NULL;
+- if (fs_info->fs_devices->seeding) {
++ if (srcdev->fs_devices->seeding) {
+ btrfs_err(fs_info, "the filesystem is a seed filesystem!");
+ return -EINVAL;
+ }
+diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
+index 4c81ffe123857..368c349c5669c 100644
+--- a/fs/btrfs/reada.c
++++ b/fs/btrfs/reada.c
+@@ -442,6 +442,8 @@ static struct reada_extent *reada_find_extent(struct btrfs_fs_info *fs_info,
+ }
+ have_zone = 1;
+ }
++ if (!have_zone)
++ radix_tree_delete(&fs_info->reada_tree, index);
+ spin_unlock(&fs_info->reada_lock);
+ btrfs_dev_replace_read_unlock(&fs_info->dev_replace);
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 2bc80d0b56dba..ed61c0daef416 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -3810,6 +3810,72 @@ static int update_ref_path(struct send_ctx *sctx, struct recorded_ref *ref)
+ return 0;
+ }
+
++/*
++ * When processing the new references for an inode we may orphanize an existing
++ * directory inode because its old name conflicts with one of the new references
++ * of the current inode. Later, when processing another new reference of our
++ * inode, we might need to orphanize another inode, but the path we have in the
++ * reference reflects the pre-orphanization name of the directory we previously
++ * orphanized. For example:
++ *
++ * parent snapshot looks like:
++ *
++ * . (ino 256)
++ * |----- f1 (ino 257)
++ * |----- f2 (ino 258)
++ * |----- d1/ (ino 259)
++ * |----- d2/ (ino 260)
++ *
++ * send snapshot looks like:
++ *
++ * . (ino 256)
++ * |----- d1 (ino 258)
++ * |----- f2/ (ino 259)
++ * |----- f2_link/ (ino 260)
++ * | |----- f1 (ino 257)
++ * |
++ * |----- d2 (ino 258)
++ *
++ * When processing inode 257 we compute the name for inode 259 as "d1", and we
++ * cache it in the name cache. Later when we start processing inode 258, when
++ * collecting all its new references we set a full path of "d1/d2" for its new
++ * reference with name "d2". When we start processing the new references we
++ * start by processing the new reference with name "d1", and this results in
++ * orphanizing inode 259, since its old reference causes a conflict. Then we
++ * move on the next new reference, with name "d2", and we find out we must
++ * orphanize inode 260, as its old reference conflicts with ours - but for the
++ * orphanization we use a source path corresponding to the path we stored in the
++ * new reference, which is "d1/d2" and not "o259-6-0/d2" - this makes the
++ * receiver fail since the path component "d1/" no longer exists, it was renamed
++ * to "o259-6-0/" when processing the previous new reference. So in this case we
++ * must recompute the path in the new reference and use it for the new
++ * orphanization operation.
++ */
++static int refresh_ref_path(struct send_ctx *sctx, struct recorded_ref *ref)
++{
++ char *name;
++ int ret;
++
++ name = kmemdup(ref->name, ref->name_len, GFP_KERNEL);
++ if (!name)
++ return -ENOMEM;
++
++ fs_path_reset(ref->full_path);
++ ret = get_cur_path(sctx, ref->dir, ref->dir_gen, ref->full_path);
++ if (ret < 0)
++ goto out;
++
++ ret = fs_path_add(ref->full_path, name, ref->name_len);
++ if (ret < 0)
++ goto out;
++
++ /* Update the reference's base name pointer. */
++ set_ref_path(ref, ref->full_path);
++out:
++ kfree(name);
++ return ret;
++}
++
+ /*
+ * This does all the move/link/unlink/rmdir magic.
+ */
+@@ -3940,6 +4006,12 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move)
+ struct name_cache_entry *nce;
+ struct waiting_dir_move *wdm;
+
++ if (orphanized_dir) {
++ ret = refresh_ref_path(sctx, cur);
++ if (ret < 0)
++ goto out;
++ }
++
+ ret = orphanize_inode(sctx, ow_inode, ow_gen,
+ cur->full_path);
+ if (ret < 0)
+@@ -6787,7 +6859,7 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg)
+
+ alloc_size = sizeof(struct clone_root) * (arg->clone_sources_count + 1);
+
+- sctx->clone_roots = kzalloc(alloc_size, GFP_KERNEL);
++ sctx->clone_roots = kvzalloc(alloc_size, GFP_KERNEL);
+ if (!sctx->clone_roots) {
+ ret = -ENOMEM;
+ goto out;
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 3e903e6a33870..7b940264c7b9d 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -3589,6 +3589,7 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans,
+ * search and this search we'll not find the key again and can just
+ * bail.
+ */
++search:
+ ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0);
+ if (ret != 0)
+ goto done;
+@@ -3608,6 +3609,13 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans,
+
+ if (min_key.objectid != ino || min_key.type != key_type)
+ goto done;
++
++ if (need_resched()) {
++ btrfs_release_path(path);
++ cond_resched();
++ goto search;
++ }
++
+ ret = overwrite_item(trans, log, dst_path, src, i,
+ &min_key);
+ if (ret) {
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 815b655b8f10a..0879e3dc39c8c 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -857,16 +857,18 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ bdput(path_bdev);
+ mutex_unlock(&fs_devices->device_list_mutex);
+ btrfs_warn_in_rcu(device->fs_info,
+- "duplicate device fsid:devid for %pU:%llu old:%s new:%s",
+- disk_super->fsid, devid,
+- rcu_str_deref(device->name), path);
++ "duplicate device %s devid %llu generation %llu scanned by %s (%d)",
++ path, devid, found_transid,
++ current->comm,
++ task_pid_nr(current));
+ return ERR_PTR(-EEXIST);
+ }
+ bdput(path_bdev);
+ btrfs_info_in_rcu(device->fs_info,
+- "device fsid %pU devid %llu moved old:%s new:%s",
+- disk_super->fsid, devid,
+- rcu_str_deref(device->name), path);
++ "devid %llu device path %s changed to %s scanned by %s (%d)",
++ devid, rcu_str_deref(device->name),
++ path, current->comm,
++ task_pid_nr(current));
+ }
+
+ name = rcu_string_strdup(path, GFP_NOFS);
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 362a868764599..356e289d19f20 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -2742,16 +2742,6 @@ int nobh_writepage(struct page *page, get_block_t *get_block,
+ /* Is the page fully outside i_size? (truncate in progress) */
+ offset = i_size & (PAGE_SIZE-1);
+ if (page->index >= end_index+1 || !offset) {
+- /*
+- * The page may have dirty, unmapped buffers. For example,
+- * they may have been added in ext3_writepage(). Make them
+- * freeable here, so the page does not leak.
+- */
+-#if 0
+- /* Not really sure about this - do we need this ? */
+- if (page->mapping->a_ops->invalidatepage)
+- page->mapping->a_ops->invalidatepage(page, offset);
+-#endif
+ unlock_page(page);
+ return 0; /* don't care */
+ }
+@@ -2946,12 +2936,6 @@ int block_write_full_page(struct page *page, get_block_t *get_block,
+ /* Is the page fully outside i_size? (truncate in progress) */
+ offset = i_size & (PAGE_SIZE-1);
+ if (page->index >= end_index+1 || !offset) {
+- /*
+- * The page may have dirty, unmapped buffers. For example,
+- * they may have been added in ext3_writepage(). Make them
+- * freeable here, so the page does not leak.
+- */
+- do_invalidatepage(page, 0, PAGE_SIZE);
+ unlock_page(page);
+ return 0; /* don't care */
+ }
+diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
+index f822ac9e3cb0f..f5bf10729a877 100644
+--- a/fs/cachefiles/rdwr.c
++++ b/fs/cachefiles/rdwr.c
+@@ -125,7 +125,7 @@ static int cachefiles_read_reissue(struct cachefiles_object *object,
+ _debug("reissue read");
+ ret = bmapping->a_ops->readpage(NULL, backpage);
+ if (ret < 0)
+- goto unlock_discard;
++ goto discard;
+ }
+
+ /* but the page may have been read before the monitor was installed, so
+@@ -142,6 +142,7 @@ static int cachefiles_read_reissue(struct cachefiles_object *object,
+
+ unlock_discard:
+ unlock_page(backpage);
++discard:
+ spin_lock_irq(&object->work_lock);
+ list_del(&monitor->op_link);
+ spin_unlock_irq(&object->work_lock);
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index 476728bdae8c6..e59b2f53a81f6 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -1437,7 +1437,7 @@ static vm_fault_t ceph_filemap_fault(struct vm_fault *vmf)
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ struct ceph_file_info *fi = vma->vm_file->private_data;
+ struct page *pinned_page = NULL;
+- loff_t off = vmf->pgoff << PAGE_SHIFT;
++ loff_t off = (loff_t)vmf->pgoff << PAGE_SHIFT;
+ int want, got, err;
+ sigset_t oldset;
+ vm_fault_t ret = VM_FAULT_SIGBUS;
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 4a38f16d944db..d30eb43506562 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -2550,13 +2550,18 @@ cifs_setattr(struct dentry *direntry, struct iattr *attrs)
+ {
+ struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb);
+ struct cifs_tcon *pTcon = cifs_sb_master_tcon(cifs_sb);
++ int rc, retries = 0;
+
+- if (pTcon->unix_ext)
+- return cifs_setattr_unix(direntry, attrs);
+-
+- return cifs_setattr_nounix(direntry, attrs);
++ do {
++ if (pTcon->unix_ext)
++ rc = cifs_setattr_unix(direntry, attrs);
++ else
++ rc = cifs_setattr_nounix(direntry, attrs);
++ retries++;
++ } while (is_retryable_error(rc) && retries < 2);
+
+ /* BB: add cifs_setattr_legacy for really old servers */
++ return rc;
+ }
+
+ #if 0
+diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
+index c83ddff3ff4ac..04a3c2c92b21e 100644
+--- a/fs/crypto/crypto.c
++++ b/fs/crypto/crypto.c
+@@ -314,45 +314,47 @@ int fscrypt_decrypt_page(const struct inode *inode, struct page *page,
+ EXPORT_SYMBOL(fscrypt_decrypt_page);
+
+ /*
+- * Validate dentries for encrypted directories to make sure we aren't
+- * potentially caching stale data after a key has been added or
+- * removed.
++ * Validate dentries in encrypted directories to make sure we aren't potentially
++ * caching stale dentries after a key has been added.
+ */
+ static int fscrypt_d_revalidate(struct dentry *dentry, unsigned int flags)
+ {
+ struct dentry *dir;
+- int dir_has_key, cached_with_key;
++ int err;
++ int valid;
++
++ /*
++ * Plaintext names are always valid, since fscrypt doesn't support
++ * reverting to ciphertext names without evicting the directory's inode
++ * -- which implies eviction of the dentries in the directory.
++ */
++ if (!(dentry->d_flags & DCACHE_ENCRYPTED_NAME))
++ return 1;
++
++ /*
++ * Ciphertext name; valid if the directory's key is still unavailable.
++ *
++ * Although fscrypt forbids rename() on ciphertext names, we still must
++ * use dget_parent() here rather than use ->d_parent directly. That's
++ * because a corrupted fs image may contain directory hard links, which
++ * the VFS handles by moving the directory's dentry tree in the dcache
++ * each time ->lookup() finds the directory and it already has a dentry
++ * elsewhere. Thus ->d_parent can be changing, and we must safely grab
++ * a reference to some ->d_parent to prevent it from being freed.
++ */
+
+ if (flags & LOOKUP_RCU)
+ return -ECHILD;
+
+ dir = dget_parent(dentry);
+- if (!IS_ENCRYPTED(d_inode(dir))) {
+- dput(dir);
+- return 0;
+- }
+-
+- spin_lock(&dentry->d_lock);
+- cached_with_key = dentry->d_flags & DCACHE_ENCRYPTED_WITH_KEY;
+- spin_unlock(&dentry->d_lock);
+- dir_has_key = (d_inode(dir)->i_crypt_info != NULL);
++ err = fscrypt_get_encryption_info(d_inode(dir));
++ valid = !fscrypt_has_encryption_key(d_inode(dir));
+ dput(dir);
+
+- /*
+- * If the dentry was cached without the key, and it is a
+- * negative dentry, it might be a valid name. We can't check
+- * if the key has since been made available due to locking
+- * reasons, so we fail the validation so ext4_lookup() can do
+- * this check.
+- *
+- * We also fail the validation if the dentry was created with
+- * the key present, but we no longer have the key, or vice versa.
+- */
+- if ((!cached_with_key && d_is_negative(dentry)) ||
+- (!cached_with_key && dir_has_key) ||
+- (cached_with_key && !dir_has_key))
+- return 0;
+- return 1;
++ if (err < 0)
++ return err;
++
++ return valid;
+ }
+
+ const struct dentry_operations fscrypt_d_ops = {
+diff --git a/fs/crypto/fname.c b/fs/crypto/fname.c
+index d7a0f682ca122..17bb9a3fc0b01 100644
+--- a/fs/crypto/fname.c
++++ b/fs/crypto/fname.c
+@@ -354,6 +354,7 @@ int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname,
+ }
+ if (!lookup)
+ return -ENOKEY;
++ fname->is_ciphertext_name = true;
+
+ /*
+ * We don't have the key and we are doing a lookup; decode the
+diff --git a/fs/crypto/hooks.c b/fs/crypto/hooks.c
+index 926e5df20ec31..042d5b44f4ed9 100644
+--- a/fs/crypto/hooks.c
++++ b/fs/crypto/hooks.c
+@@ -49,7 +49,8 @@ int fscrypt_file_open(struct inode *inode, struct file *filp)
+ }
+ EXPORT_SYMBOL_GPL(fscrypt_file_open);
+
+-int __fscrypt_prepare_link(struct inode *inode, struct inode *dir)
++int __fscrypt_prepare_link(struct inode *inode, struct inode *dir,
++ struct dentry *dentry)
+ {
+ int err;
+
+@@ -57,8 +58,12 @@ int __fscrypt_prepare_link(struct inode *inode, struct inode *dir)
+ if (err)
+ return err;
+
++ /* ... in case we looked up ciphertext name before key was added */
++ if (dentry->d_flags & DCACHE_ENCRYPTED_NAME)
++ return -ENOKEY;
++
+ if (!fscrypt_has_permitted_context(dir, inode))
+- return -EPERM;
++ return -EXDEV;
+
+ return 0;
+ }
+@@ -78,37 +83,42 @@ int __fscrypt_prepare_rename(struct inode *old_dir, struct dentry *old_dentry,
+ if (err)
+ return err;
+
++ /* ... in case we looked up ciphertext name(s) before key was added */
++ if ((old_dentry->d_flags | new_dentry->d_flags) &
++ DCACHE_ENCRYPTED_NAME)
++ return -ENOKEY;
++
+ if (old_dir != new_dir) {
+ if (IS_ENCRYPTED(new_dir) &&
+ !fscrypt_has_permitted_context(new_dir,
+ d_inode(old_dentry)))
+- return -EPERM;
++ return -EXDEV;
+
+ if ((flags & RENAME_EXCHANGE) &&
+ IS_ENCRYPTED(old_dir) &&
+ !fscrypt_has_permitted_context(old_dir,
+ d_inode(new_dentry)))
+- return -EPERM;
++ return -EXDEV;
+ }
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(__fscrypt_prepare_rename);
+
+-int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry)
++int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry,
++ struct fscrypt_name *fname)
+ {
+- int err = fscrypt_get_encryption_info(dir);
++ int err = fscrypt_setup_filename(dir, &dentry->d_name, 1, fname);
+
+- if (err)
++ if (err && err != -ENOENT)
+ return err;
+
+- if (fscrypt_has_encryption_key(dir)) {
++ if (fname->is_ciphertext_name) {
+ spin_lock(&dentry->d_lock);
+- dentry->d_flags |= DCACHE_ENCRYPTED_WITH_KEY;
++ dentry->d_flags |= DCACHE_ENCRYPTED_NAME;
+ spin_unlock(&dentry->d_lock);
++ d_set_d_op(dentry, &fscrypt_d_ops);
+ }
+-
+- d_set_d_op(dentry, &fscrypt_d_ops);
+- return 0;
++ return err;
+ }
+ EXPORT_SYMBOL_GPL(__fscrypt_prepare_lookup);
+
+diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
+index 4288839501e94..e9d975f39f46b 100644
+--- a/fs/crypto/policy.c
++++ b/fs/crypto/policy.c
+@@ -153,8 +153,7 @@ EXPORT_SYMBOL(fscrypt_ioctl_get_policy);
+ * malicious offline violations of this constraint, while the link and rename
+ * checks are needed to prevent online violations of this constraint.
+ *
+- * Return: 1 if permitted, 0 if forbidden. If forbidden, the caller must fail
+- * the filesystem operation with EPERM.
++ * Return: 1 if permitted, 0 if forbidden.
+ */
+ int fscrypt_has_permitted_context(struct inode *parent, struct inode *child)
+ {
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 20370a0997bf9..1897833a46685 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -2712,6 +2712,20 @@ static void copy_name(struct dentry *dentry, struct dentry *target)
+ call_rcu(&old_name->u.head, __d_free_external_name);
+ }
+
++/*
++ * When d_splice_alias() moves a directory's encrypted alias to its decrypted
++ * alias as a result of the encryption key being added, DCACHE_ENCRYPTED_NAME
++ * must be cleared. Note that we don't have to support arbitrary moves of this
++ * flag because fscrypt doesn't allow encrypted aliases to be the source or
++ * target of a rename().
++ */
++static inline void fscrypt_handle_d_move(struct dentry *dentry)
++{
++#if IS_ENABLED(CONFIG_FS_ENCRYPTION)
++ dentry->d_flags &= ~DCACHE_ENCRYPTED_NAME;
++#endif
++}
++
+ /*
+ * __d_move - move a dentry
+ * @dentry: entry to move
+@@ -2787,6 +2801,7 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
+ list_move(&dentry->d_child, &dentry->d_parent->d_subdirs);
+ __d_rehash(dentry);
+ fsnotify_update_flags(dentry);
++ fscrypt_handle_d_move(dentry);
+
+ write_seqcount_end(&target->d_seq);
+ write_seqcount_end(&dentry->d_seq);
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index 5b68e4294faa5..834615f13f3e3 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -145,6 +145,9 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
+
+ name[len + EFI_VARIABLE_GUID_LEN+1] = '\0';
+
++ /* replace invalid slashes like kobject_set_name_vargs does for /sys/firmware/efi/vars. */
++ strreplace(name, '/', '!');
++
+ inode = efivarfs_get_inode(sb, d_inode(root), S_IFREG | 0644, 0,
+ is_removable);
+ if (!inode)
+diff --git a/fs/exec.c b/fs/exec.c
+index cece8c14f377a..52788644c4af2 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1028,10 +1028,23 @@ static int exec_mmap(struct mm_struct *mm)
+ }
+ }
+ task_lock(tsk);
++
++ local_irq_disable();
+ active_mm = tsk->active_mm;
+- tsk->mm = mm;
+ tsk->active_mm = mm;
++ tsk->mm = mm;
++ /*
++ * This prevents preemption while active_mm is being loaded and
++ * it and mm are being updated, which could cause problems for
++ * lazy tlb mm refcounting when these are updated by context
++ * switches. Not all architectures can handle irqs off over
++ * activate_mm yet.
++ */
++ if (!IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
++ local_irq_enable();
+ activate_mm(active_mm, mm);
++ if (IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM))
++ local_irq_enable();
+ tsk->mm->vmacache_seqnum = 0;
+ vmacache_flush(tsk);
+ task_unlock(tsk);
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 0a4461ac4225f..19109c04710ee 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -2326,23 +2326,47 @@ static inline bool ext4_encrypted_inode(struct inode *inode)
+ }
+
+ #ifdef CONFIG_EXT4_FS_ENCRYPTION
++static inline void ext4_fname_from_fscrypt_name(struct ext4_filename *dst,
++ const struct fscrypt_name *src)
++{
++ memset(dst, 0, sizeof(*dst));
++
++ dst->usr_fname = src->usr_fname;
++ dst->disk_name = src->disk_name;
++ dst->hinfo.hash = src->hash;
++ dst->hinfo.minor_hash = src->minor_hash;
++ dst->crypto_buf = src->crypto_buf;
++}
++
+ static inline int ext4_fname_setup_filename(struct inode *dir,
+- const struct qstr *iname,
+- int lookup, struct ext4_filename *fname)
++ const struct qstr *iname,
++ int lookup,
++ struct ext4_filename *fname)
+ {
+ struct fscrypt_name name;
+ int err;
+
+- memset(fname, 0, sizeof(struct ext4_filename));
+-
+ err = fscrypt_setup_filename(dir, iname, lookup, &name);
++ if (err)
++ return err;
+
+- fname->usr_fname = name.usr_fname;
+- fname->disk_name = name.disk_name;
+- fname->hinfo.hash = name.hash;
+- fname->hinfo.minor_hash = name.minor_hash;
+- fname->crypto_buf = name.crypto_buf;
+- return err;
++ ext4_fname_from_fscrypt_name(fname, &name);
++ return 0;
++}
++
++static inline int ext4_fname_prepare_lookup(struct inode *dir,
++ struct dentry *dentry,
++ struct ext4_filename *fname)
++{
++ struct fscrypt_name name;
++ int err;
++
++ err = fscrypt_prepare_lookup(dir, dentry, &name);
++ if (err)
++ return err;
++
++ ext4_fname_from_fscrypt_name(fname, &name);
++ return 0;
+ }
+
+ static inline void ext4_fname_free_filename(struct ext4_filename *fname)
+@@ -2356,19 +2380,27 @@ static inline void ext4_fname_free_filename(struct ext4_filename *fname)
+ fname->usr_fname = NULL;
+ fname->disk_name.name = NULL;
+ }
+-#else
++#else /* !CONFIG_EXT4_FS_ENCRYPTION */
+ static inline int ext4_fname_setup_filename(struct inode *dir,
+- const struct qstr *iname,
+- int lookup, struct ext4_filename *fname)
++ const struct qstr *iname,
++ int lookup,
++ struct ext4_filename *fname)
+ {
+ fname->usr_fname = iname;
+ fname->disk_name.name = (unsigned char *) iname->name;
+ fname->disk_name.len = iname->len;
+ return 0;
+ }
+-static inline void ext4_fname_free_filename(struct ext4_filename *fname) { }
+
+-#endif
++static inline int ext4_fname_prepare_lookup(struct inode *dir,
++ struct dentry *dentry,
++ struct ext4_filename *fname)
++{
++ return ext4_fname_setup_filename(dir, &dentry->d_name, 1, fname);
++}
++
++static inline void ext4_fname_free_filename(struct ext4_filename *fname) { }
++#endif /* !CONFIG_EXT4_FS_ENCRYPTION */
+
+ /* dir.c */
+ extern int __ext4_check_dir_entry(const char *, unsigned int, struct inode *,
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 52be4c9650241..cc092386ac6d9 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5271,6 +5271,12 @@ static int ext4_do_update_inode(handle_t *handle,
+ if (ext4_test_inode_state(inode, EXT4_STATE_NEW))
+ memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);
+
++ err = ext4_inode_blocks_set(handle, raw_inode, ei);
++ if (err) {
++ spin_unlock(&ei->i_raw_lock);
++ goto out_brelse;
++ }
++
+ raw_inode->i_mode = cpu_to_le16(inode->i_mode);
+ i_uid = i_uid_read(inode);
+ i_gid = i_gid_read(inode);
+@@ -5304,11 +5310,6 @@ static int ext4_do_update_inode(handle_t *handle,
+ EXT4_INODE_SET_XTIME(i_atime, inode, raw_inode);
+ EXT4_EINODE_SET_XTIME(i_crtime, ei, raw_inode);
+
+- err = ext4_inode_blocks_set(handle, raw_inode, ei);
+- if (err) {
+- spin_unlock(&ei->i_raw_lock);
+- goto out_brelse;
+- }
+ raw_inode->i_dtime = cpu_to_le32(ei->i_dtime);
+ raw_inode->i_flags = cpu_to_le32(ei->i_flags & 0xFFFFFFFF);
+ if (likely(!test_opt2(inode->i_sb, HURD_COMPAT)))
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 186a2dd05bd87..4191552880bd7 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1343,7 +1343,7 @@ static int is_dx_internal_node(struct inode *dir, ext4_lblk_t block,
+ }
+
+ /*
+- * ext4_find_entry()
++ * __ext4_find_entry()
+ *
+ * finds an entry in the specified directory with the wanted name. It
+ * returns the cache buffer in which the entry was found, and the entry
+@@ -1353,39 +1353,32 @@ static int is_dx_internal_node(struct inode *dir, ext4_lblk_t block,
+ * The returned buffer_head has ->b_count elevated. The caller is expected
+ * to brelse() it when appropriate.
+ */
+-static struct buffer_head * ext4_find_entry (struct inode *dir,
+- const struct qstr *d_name,
+- struct ext4_dir_entry_2 **res_dir,
+- int *inlined)
++static struct buffer_head *__ext4_find_entry(struct inode *dir,
++ struct ext4_filename *fname,
++ struct ext4_dir_entry_2 **res_dir,
++ int *inlined)
+ {
+ struct super_block *sb;
+ struct buffer_head *bh_use[NAMEI_RA_SIZE];
+ struct buffer_head *bh, *ret = NULL;
+ ext4_lblk_t start, block;
+- const u8 *name = d_name->name;
++ const u8 *name = fname->usr_fname->name;
+ size_t ra_max = 0; /* Number of bh's in the readahead
+ buffer, bh_use[] */
+ size_t ra_ptr = 0; /* Current index into readahead
+ buffer */
+ ext4_lblk_t nblocks;
+ int i, namelen, retval;
+- struct ext4_filename fname;
+
+ *res_dir = NULL;
+ sb = dir->i_sb;
+- namelen = d_name->len;
++ namelen = fname->usr_fname->len;
+ if (namelen > EXT4_NAME_LEN)
+ return NULL;
+
+- retval = ext4_fname_setup_filename(dir, d_name, 1, &fname);
+- if (retval == -ENOENT)
+- return NULL;
+- if (retval)
+- return ERR_PTR(retval);
+-
+ if (ext4_has_inline_data(dir)) {
+ int has_inline_data = 1;
+- ret = ext4_find_inline_entry(dir, &fname, res_dir,
++ ret = ext4_find_inline_entry(dir, fname, res_dir,
+ &has_inline_data);
+ if (has_inline_data) {
+ if (inlined)
+@@ -1405,7 +1398,7 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
+ goto restart;
+ }
+ if (is_dx(dir)) {
+- ret = ext4_dx_find_entry(dir, &fname, res_dir);
++ ret = ext4_dx_find_entry(dir, fname, res_dir);
+ /*
+ * On success, or if the error was file not found,
+ * return. Otherwise, fall back to doing a search the
+@@ -1470,7 +1463,7 @@ restart:
+ goto cleanup_and_exit;
+ }
+ set_buffer_verified(bh);
+- i = search_dirblock(bh, dir, &fname,
++ i = search_dirblock(bh, dir, fname,
+ block << EXT4_BLOCK_SIZE_BITS(sb), res_dir);
+ if (i == 1) {
+ EXT4_I(dir)->i_dir_start_lookup = block;
+@@ -1501,10 +1494,50 @@ cleanup_and_exit:
+ /* Clean up the read-ahead blocks */
+ for (; ra_ptr < ra_max; ra_ptr++)
+ brelse(bh_use[ra_ptr]);
+- ext4_fname_free_filename(&fname);
+ return ret;
+ }
+
++static struct buffer_head *ext4_find_entry(struct inode *dir,
++ const struct qstr *d_name,
++ struct ext4_dir_entry_2 **res_dir,
++ int *inlined)
++{
++ int err;
++ struct ext4_filename fname;
++ struct buffer_head *bh;
++
++ err = ext4_fname_setup_filename(dir, d_name, 1, &fname);
++ if (err == -ENOENT)
++ return NULL;
++ if (err)
++ return ERR_PTR(err);
++
++ bh = __ext4_find_entry(dir, &fname, res_dir, inlined);
++
++ ext4_fname_free_filename(&fname);
++ return bh;
++}
++
++static struct buffer_head *ext4_lookup_entry(struct inode *dir,
++ struct dentry *dentry,
++ struct ext4_dir_entry_2 **res_dir)
++{
++ int err;
++ struct ext4_filename fname;
++ struct buffer_head *bh;
++
++ err = ext4_fname_prepare_lookup(dir, dentry, &fname);
++ if (err == -ENOENT)
++ return NULL;
++ if (err)
++ return ERR_PTR(err);
++
++ bh = __ext4_find_entry(dir, &fname, res_dir, NULL);
++
++ ext4_fname_free_filename(&fname);
++ return bh;
++}
++
+ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
+ struct ext4_filename *fname,
+ struct ext4_dir_entry_2 **res_dir)
+@@ -1563,16 +1596,11 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi
+ struct inode *inode;
+ struct ext4_dir_entry_2 *de;
+ struct buffer_head *bh;
+- int err;
+-
+- err = fscrypt_prepare_lookup(dir, dentry, flags);
+- if (err)
+- return ERR_PTR(err);
+
+ if (dentry->d_name.len > EXT4_NAME_LEN)
+ return ERR_PTR(-ENAMETOOLONG);
+
+- bh = ext4_find_entry(dir, &dentry->d_name, &de, NULL);
++ bh = ext4_lookup_entry(dir, dentry, &de);
+ if (IS_ERR(bh))
+ return (struct dentry *) bh;
+ inode = NULL;
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index ef552d93708e2..8098255c2801a 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -861,8 +861,10 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+
+ BUFFER_TRACE(dind, "get_write_access");
+ err = ext4_journal_get_write_access(handle, dind);
+- if (unlikely(err))
++ if (unlikely(err)) {
+ ext4_std_error(sb, err);
++ goto errout;
++ }
+
+ /* ext4_reserve_inode_write() gets a reference on the iloc */
+ err = ext4_reserve_inode_write(handle, inode, &iloc);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 0c15ff19acbd4..6338ca95d8b3a 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4594,6 +4594,7 @@ cantfind_ext4:
+
+ failed_mount8:
+ ext4_unregister_sysfs(sb);
++ kobject_put(&sbi->s_kobj);
+ failed_mount7:
+ ext4_unregister_li_request(sb);
+ failed_mount6:
+@@ -5752,6 +5753,11 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
+ /* Quotafile not on the same filesystem? */
+ if (path->dentry->d_sb != sb)
+ return -EXDEV;
++
++ /* Quota already enabled for this file? */
++ if (IS_NOQUOTA(d_inode(path->dentry)))
++ return -EBUSY;
++
+ /* Journaling quota? */
+ if (EXT4_SB(sb)->s_qf_names[type]) {
+ /* Quotafile not in fs root? */
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index 388500eec7291..a563de5ccd217 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -218,6 +218,8 @@ int f2fs_ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages,
+ blkno * NAT_ENTRY_PER_BLOCK);
+ break;
+ case META_SIT:
++ if (unlikely(blkno >= TOTAL_SEGS(sbi)))
++ goto out;
+ /* get sit block addr */
+ fio.new_blkaddr = current_sit_addr(sbi,
+ blkno * SIT_ENTRY_PER_BLOCK);
+@@ -1003,8 +1005,12 @@ int f2fs_sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type)
+ get_pages(sbi, is_dir ?
+ F2FS_DIRTY_DENTS : F2FS_DIRTY_DATA));
+ retry:
+- if (unlikely(f2fs_cp_error(sbi)))
++ if (unlikely(f2fs_cp_error(sbi))) {
++ trace_f2fs_sync_dirty_inodes_exit(sbi->sb, is_dir,
++ get_pages(sbi, is_dir ?
++ F2FS_DIRTY_DENTS : F2FS_DIRTY_DATA));
+ return -EIO;
++ }
+
+ spin_lock(&sbi->inode_lock[type]);
+
+diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
+index ebe19894884be..2cd85ce3e4502 100644
+--- a/fs/f2fs/dir.c
++++ b/fs/f2fs/dir.c
+@@ -208,16 +208,15 @@ struct f2fs_dir_entry *__f2fs_find_entry(struct inode *dir,
+ unsigned int max_depth;
+ unsigned int level;
+
++ *res_page = NULL;
++
+ if (f2fs_has_inline_dentry(dir)) {
+- *res_page = NULL;
+ de = f2fs_find_in_inline_dir(dir, fname, res_page);
+ goto out;
+ }
+
+- if (npages == 0) {
+- *res_page = NULL;
++ if (npages == 0)
+ goto out;
+- }
+
+ max_depth = F2FS_I(dir)->i_current_depth;
+ if (unlikely(max_depth > MAX_DIR_HASH_DEPTH)) {
+@@ -229,7 +228,6 @@ struct f2fs_dir_entry *__f2fs_find_entry(struct inode *dir,
+ }
+
+ for (level = 0; level < max_depth; level++) {
+- *res_page = NULL;
+ de = find_in_level(dir, level, fname, res_page);
+ if (de || IS_ERR(*res_page))
+ break;
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index 4f0cc0c79d1ee..8617e742d0878 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -432,19 +432,23 @@ static struct dentry *f2fs_lookup(struct inode *dir, struct dentry *dentry,
+ nid_t ino = -1;
+ int err = 0;
+ unsigned int root_ino = F2FS_ROOT_INO(F2FS_I_SB(dir));
++ struct fscrypt_name fname;
+
+ trace_f2fs_lookup_start(dir, dentry, flags);
+
+- err = fscrypt_prepare_lookup(dir, dentry, flags);
+- if (err)
+- goto out;
+-
+ if (dentry->d_name.len > F2FS_NAME_LEN) {
+ err = -ENAMETOOLONG;
+ goto out;
+ }
+
+- de = f2fs_find_entry(dir, &dentry->d_name, &page);
++ err = fscrypt_prepare_lookup(dir, dentry, &fname);
++ if (err == -ENOENT)
++ goto out_splice;
++ if (err)
++ goto out;
++ de = __f2fs_find_entry(dir, &fname, &page);
++ fscrypt_free_filename(&fname);
++
+ if (!de) {
+ if (IS_ERR(page)) {
+ err = PTR_ERR(page);
+@@ -484,8 +488,7 @@ static struct dentry *f2fs_lookup(struct inode *dir, struct dentry *dentry,
+ }
+ out_splice:
+ new = d_splice_alias(inode, dentry);
+- if (IS_ERR(new))
+- err = PTR_ERR(new);
++ err = PTR_ERR_OR_ZERO(new);
+ trace_f2fs_lookup_end(dir, dentry, ino, err);
+ return new;
+ out_iput:
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index c51c9a6881e49..1ff5a6b21db0b 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -853,15 +853,16 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
+ struct page *newpage;
+ struct pipe_buffer *buf = cs->pipebufs;
+
++ get_page(oldpage);
+ err = unlock_request(cs->req);
+ if (err)
+- return err;
++ goto out_put_old;
+
+ fuse_copy_finish(cs);
+
+ err = pipe_buf_confirm(cs->pipe, buf);
+ if (err)
+- return err;
++ goto out_put_old;
+
+ BUG_ON(!cs->nr_segs);
+ cs->currbuf = buf;
+@@ -901,7 +902,7 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
+ err = replace_page_cache_page(oldpage, newpage, GFP_KERNEL);
+ if (err) {
+ unlock_page(newpage);
+- return err;
++ goto out_put_old;
+ }
+
+ get_page(newpage);
+@@ -920,14 +921,19 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
+ if (err) {
+ unlock_page(newpage);
+ put_page(newpage);
+- return err;
++ goto out_put_old;
+ }
+
+ unlock_page(oldpage);
++ /* Drop ref for ap->pages[] array */
+ put_page(oldpage);
+ cs->len = 0;
+
+- return 0;
++ err = 0;
++out_put_old:
++ /* Drop ref obtained in this function */
++ put_page(oldpage);
++ return err;
+
+ out_fallback_unlock:
+ unlock_page(newpage);
+@@ -936,10 +942,10 @@ out_fallback:
+ cs->offset = buf->offset;
+
+ err = lock_request(cs->req);
+- if (err)
+- return err;
++ if (!err)
++ err = 1;
+
+- return 1;
++ goto out_put_old;
+ }
+
+ static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page,
+@@ -951,14 +957,16 @@ static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page,
+ if (cs->nr_segs == cs->pipe->buffers)
+ return -EIO;
+
++ get_page(page);
+ err = unlock_request(cs->req);
+- if (err)
++ if (err) {
++ put_page(page);
+ return err;
++ }
+
+ fuse_copy_finish(cs);
+
+ buf = cs->pipebufs;
+- get_page(page);
+ buf->page = page;
+ buf->offset = offset;
+ buf->len = count;
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index 9448c8461e576..17001f4e9f845 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -161,15 +161,19 @@ static int gfs2_check_sb(struct gfs2_sbd *sdp, int silent)
+ return -EINVAL;
+ }
+
+- /* If format numbers match exactly, we're done. */
+-
+- if (sb->sb_fs_format == GFS2_FORMAT_FS &&
+- sb->sb_multihost_format == GFS2_FORMAT_MULTI)
+- return 0;
++ if (sb->sb_fs_format != GFS2_FORMAT_FS ||
++ sb->sb_multihost_format != GFS2_FORMAT_MULTI) {
++ fs_warn(sdp, "Unknown on-disk format, unable to mount\n");
++ return -EINVAL;
++ }
+
+- fs_warn(sdp, "Unknown on-disk format, unable to mount\n");
++ if (sb->sb_bsize < 512 || sb->sb_bsize > PAGE_SIZE ||
++ (sb->sb_bsize & (sb->sb_bsize - 1))) {
++ pr_warn("Invalid superblock size\n");
++ return -EINVAL;
++ }
+
+- return -EINVAL;
++ return 0;
+ }
+
+ static void end_bio_io_page(struct bio *bio)
+diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
+index e5686be67be8d..d57d453aecc2d 100644
+--- a/fs/nfs/namespace.c
++++ b/fs/nfs/namespace.c
+@@ -30,9 +30,9 @@ int nfs_mountpoint_expiry_timeout = 500 * HZ;
+ /*
+ * nfs_path - reconstruct the path given an arbitrary dentry
+ * @base - used to return pointer to the end of devname part of path
+- * @dentry - pointer to dentry
++ * @dentry_in - pointer to dentry
+ * @buffer - result buffer
+- * @buflen - length of buffer
++ * @buflen_in - length of buffer
+ * @flags - options (see below)
+ *
+ * Helper function for constructing the server pathname
+@@ -47,15 +47,19 @@ int nfs_mountpoint_expiry_timeout = 500 * HZ;
+ * the original device (export) name
+ * (if unset, the original name is returned verbatim)
+ */
+-char *nfs_path(char **p, struct dentry *dentry, char *buffer, ssize_t buflen,
+- unsigned flags)
++char *nfs_path(char **p, struct dentry *dentry_in, char *buffer,
++ ssize_t buflen_in, unsigned flags)
+ {
+ char *end;
+ int namelen;
+ unsigned seq;
+ const char *base;
++ struct dentry *dentry;
++ ssize_t buflen;
+
+ rename_retry:
++ buflen = buflen_in;
++ dentry = dentry_in;
+ end = buffer+buflen;
+ *--end = '\0';
+ buflen--;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index b2a2ff3f22a46..fe7b42c277ac5 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7600,9 +7600,11 @@ int nfs4_proc_secinfo(struct inode *dir, const struct qstr *name,
+ * both PNFS and NON_PNFS flags set, and not having one of NON_PNFS, PNFS, or
+ * DS flags set.
+ */
+-static int nfs4_check_cl_exchange_flags(u32 flags)
++static int nfs4_check_cl_exchange_flags(u32 flags, u32 version)
+ {
+- if (flags & ~EXCHGID4_FLAG_MASK_R)
++ if (version >= 2 && (flags & ~EXCHGID4_2_FLAG_MASK_R))
++ goto out_inval;
++ else if (version < 2 && (flags & ~EXCHGID4_FLAG_MASK_R))
+ goto out_inval;
+ if ((flags & EXCHGID4_FLAG_USE_PNFS_MDS) &&
+ (flags & EXCHGID4_FLAG_USE_NON_PNFS))
+@@ -7997,7 +7999,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
+ if (status != 0)
+ goto out;
+
+- status = nfs4_check_cl_exchange_flags(resp->flags);
++ status = nfs4_check_cl_exchange_flags(resp->flags,
++ clp->cl_mvops->minor_version);
+ if (status != 0)
+ goto out;
+
+diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
+index 0d20fd161225a..01f7ce1ae1275 100644
+--- a/fs/nfsd/nfsproc.c
++++ b/fs/nfsd/nfsproc.c
+@@ -118,6 +118,13 @@ done:
+ return nfsd_return_attrs(nfserr, resp);
+ }
+
++/* Obsolete, replaced by MNTPROC_MNT. */
++static __be32
++nfsd_proc_root(struct svc_rqst *rqstp)
++{
++ return nfs_ok;
++}
++
+ /*
+ * Look up a path name component
+ * Note: the dentry in the resp->fh may be negative if the file
+@@ -201,6 +208,13 @@ nfsd_proc_read(struct svc_rqst *rqstp)
+ return fh_getattr(&resp->fh, &resp->stat);
+ }
+
++/* Reserved */
++static __be32
++nfsd_proc_writecache(struct svc_rqst *rqstp)
++{
++ return nfs_ok;
++}
++
+ /*
+ * Write data to a file
+ * N.B. After this call resp->fh needs an fh_put
+@@ -615,6 +629,7 @@ static const struct svc_procedure nfsd_procedures2[18] = {
+ .pc_xdrressize = ST+AT,
+ },
+ [NFSPROC_ROOT] = {
++ .pc_func = nfsd_proc_root,
+ .pc_decode = nfssvc_decode_void,
+ .pc_encode = nfssvc_encode_void,
+ .pc_argsize = sizeof(struct nfsd_void),
+@@ -652,6 +667,7 @@ static const struct svc_procedure nfsd_procedures2[18] = {
+ .pc_xdrressize = ST+AT+1+NFSSVC_MAXBLKSIZE_V2/4,
+ },
+ [NFSPROC_WRITECACHE] = {
++ .pc_func = nfsd_proc_writecache,
+ .pc_decode = nfssvc_decode_void,
+ .pc_encode = nfssvc_encode_void,
+ .pc_argsize = sizeof(struct nfsd_void),
+diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
+index 564e330d05b14..24bbecd4752b7 100644
+--- a/fs/ubifs/debug.c
++++ b/fs/ubifs/debug.c
+@@ -1129,6 +1129,7 @@ int dbg_check_dir(struct ubifs_info *c, const struct inode *dir)
+ err = PTR_ERR(dent);
+ if (err == -ENOENT)
+ break;
++ kfree(pdent);
+ return err;
+ }
+
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index d7c0aa0626cd7..10aab5dccaee4 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -220,11 +220,9 @@ static struct dentry *ubifs_lookup(struct inode *dir, struct dentry *dentry,
+
+ dbg_gen("'%pd' in dir ino %lu", dentry, dir->i_ino);
+
+- err = fscrypt_prepare_lookup(dir, dentry, flags);
+- if (err)
+- return ERR_PTR(err);
+-
+- err = fscrypt_setup_filename(dir, &dentry->d_name, 1, &nm);
++ err = fscrypt_prepare_lookup(dir, dentry, &nm);
++ if (err == -ENOENT)
++ return d_splice_alias(NULL, dentry);
+ if (err)
+ return ERR_PTR(err);
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index caeb01ca039b7..c7f6243f318bb 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -1685,7 +1685,8 @@ static noinline int udf_process_sequence(
+ "Pointers (max %u supported)\n",
+ UDF_MAX_TD_NESTING);
+ brelse(bh);
+- return -EIO;
++ ret = -EIO;
++ goto out;
+ }
+
+ vdp = (struct volDescPtr *)bh->b_data;
+@@ -1705,7 +1706,8 @@ static noinline int udf_process_sequence(
+ curr = get_volume_descriptor_record(ident, bh, &data);
+ if (IS_ERR(curr)) {
+ brelse(bh);
+- return PTR_ERR(curr);
++ ret = PTR_ERR(curr);
++ goto out;
+ }
+ /* Descriptor we don't care about? */
+ if (!curr)
+@@ -1727,28 +1729,31 @@ static noinline int udf_process_sequence(
+ */
+ if (!data.vds[VDS_POS_PRIMARY_VOL_DESC].block) {
+ udf_err(sb, "Primary Volume Descriptor not found!\n");
+- return -EAGAIN;
++ ret = -EAGAIN;
++ goto out;
+ }
+ ret = udf_load_pvoldesc(sb, data.vds[VDS_POS_PRIMARY_VOL_DESC].block);
+ if (ret < 0)
+- return ret;
++ goto out;
+
+ if (data.vds[VDS_POS_LOGICAL_VOL_DESC].block) {
+ ret = udf_load_logicalvol(sb,
+ data.vds[VDS_POS_LOGICAL_VOL_DESC].block,
+ fileset);
+ if (ret < 0)
+- return ret;
++ goto out;
+ }
+
+ /* Now handle prevailing Partition Descriptors */
+ for (i = 0; i < data.num_part_descs; i++) {
+ ret = udf_load_partdesc(sb, data.part_descs_loc[i].rec.block);
+ if (ret < 0)
+- return ret;
++ goto out;
+ }
+-
+- return 0;
++ ret = 0;
++out:
++ kfree(data.part_descs_loc);
++ return ret;
+ }
+
+ /*
+diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
+index f35e1801f1c90..fc9950a505e62 100644
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -4920,20 +4920,25 @@ xfs_bmap_del_extent_real(
+
+ flags = XFS_ILOG_CORE;
+ if (whichfork == XFS_DATA_FORK && XFS_IS_REALTIME_INODE(ip)) {
+- xfs_fsblock_t bno;
+ xfs_filblks_t len;
+ xfs_extlen_t mod;
+
+- bno = div_u64_rem(del->br_startblock, mp->m_sb.sb_rextsize,
+- &mod);
+- ASSERT(mod == 0);
+ len = div_u64_rem(del->br_blockcount, mp->m_sb.sb_rextsize,
+ &mod);
+ ASSERT(mod == 0);
+
+- error = xfs_rtfree_extent(tp, bno, (xfs_extlen_t)len);
+- if (error)
+- goto done;
++ if (!(bflags & XFS_BMAPI_REMAP)) {
++ xfs_fsblock_t bno;
++
++ bno = div_u64_rem(del->br_startblock,
++ mp->m_sb.sb_rextsize, &mod);
++ ASSERT(mod == 0);
++
++ error = xfs_rtfree_extent(tp, bno, (xfs_extlen_t)len);
++ if (error)
++ goto done;
++ }
++
+ do_fx = 0;
+ nblks = len * mp->m_sb.sb_rextsize;
+ qfield = XFS_TRANS_DQ_RTBCOUNT;
+diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
+index 08da48b662358..280965fc9bbd4 100644
+--- a/fs/xfs/xfs_rtalloc.c
++++ b/fs/xfs/xfs_rtalloc.c
+@@ -998,10 +998,13 @@ xfs_growfs_rt(
+ xfs_ilock(mp->m_rbmip, XFS_ILOCK_EXCL);
+ xfs_trans_ijoin(tp, mp->m_rbmip, XFS_ILOCK_EXCL);
+ /*
+- * Update the bitmap inode's size.
++ * Update the bitmap inode's size ondisk and incore. We need
++ * to update the incore size so that inode inactivation won't
++ * punch what it thinks are "posteof" blocks.
+ */
+ mp->m_rbmip->i_d.di_size =
+ nsbp->sb_rbmblocks * nsbp->sb_blocksize;
++ i_size_write(VFS_I(mp->m_rbmip), mp->m_rbmip->i_d.di_size);
+ xfs_trans_log_inode(tp, mp->m_rbmip, XFS_ILOG_CORE);
+ /*
+ * Get the summary inode into the transaction.
+@@ -1009,9 +1012,12 @@ xfs_growfs_rt(
+ xfs_ilock(mp->m_rsumip, XFS_ILOCK_EXCL);
+ xfs_trans_ijoin(tp, mp->m_rsumip, XFS_ILOCK_EXCL);
+ /*
+- * Update the summary inode's size.
++ * Update the summary inode's size. We need to update the
++ * incore size so that inode inactivation won't punch what it
++ * thinks are "posteof" blocks.
+ */
+ mp->m_rsumip->i_d.di_size = nmp->m_rsumsize;
++ i_size_write(VFS_I(mp->m_rsumip), mp->m_rsumip->i_d.di_size);
+ xfs_trans_log_inode(tp, mp->m_rsumip, XFS_ILOG_CORE);
+ /*
+ * Copy summary data from old to new sizes.
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index 0880baefd85f8..02b1b40fea5b1 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -210,7 +210,7 @@ struct dentry_operations {
+
+ #define DCACHE_MAY_FREE 0x00800000
+ #define DCACHE_FALLTHRU 0x01000000 /* Fall through to lower layer */
+-#define DCACHE_ENCRYPTED_WITH_KEY 0x02000000 /* dir is encrypted with a valid key */
++#define DCACHE_ENCRYPTED_NAME 0x02000000 /* Encrypted name (dir key was unavailable) */
+ #define DCACHE_OP_REAL 0x04000000
+
+ #define DCACHE_PAR_LOOKUP 0x10000000 /* being looked up (with parent locked shared) */
+diff --git a/include/linux/fscrypt.h b/include/linux/fscrypt.h
+index 952ab97af325e..c1e4a615bd1cb 100644
+--- a/include/linux/fscrypt.h
++++ b/include/linux/fscrypt.h
+@@ -32,6 +32,7 @@ struct fscrypt_name {
+ u32 hash;
+ u32 minor_hash;
+ struct fscrypt_str crypto_buf;
++ bool is_ciphertext_name;
+ };
+
+ #define FSTR_INIT(n, l) { .name = n, .len = l }
+@@ -89,7 +90,7 @@ static inline int fscrypt_require_key(struct inode *inode)
+ * in an encrypted directory tree use the same encryption policy.
+ *
+ * Return: 0 on success, -ENOKEY if the directory's encryption key is missing,
+- * -EPERM if the link would result in an inconsistent encryption policy, or
++ * -EXDEV if the link would result in an inconsistent encryption policy, or
+ * another -errno code.
+ */
+ static inline int fscrypt_prepare_link(struct dentry *old_dentry,
+@@ -97,7 +98,7 @@ static inline int fscrypt_prepare_link(struct dentry *old_dentry,
+ struct dentry *dentry)
+ {
+ if (IS_ENCRYPTED(dir))
+- return __fscrypt_prepare_link(d_inode(old_dentry), dir);
++ return __fscrypt_prepare_link(d_inode(old_dentry), dir, dentry);
+ return 0;
+ }
+
+@@ -119,7 +120,7 @@ static inline int fscrypt_prepare_link(struct dentry *old_dentry,
+ * We also verify that the rename will not violate the constraint that all files
+ * in an encrypted directory tree use the same encryption policy.
+ *
+- * Return: 0 on success, -ENOKEY if an encryption key is missing, -EPERM if the
++ * Return: 0 on success, -ENOKEY if an encryption key is missing, -EXDEV if the
+ * rename would cause inconsistent encryption policies, or another -errno code.
+ */
+ static inline int fscrypt_prepare_rename(struct inode *old_dir,
+@@ -138,27 +139,32 @@ static inline int fscrypt_prepare_rename(struct inode *old_dir,
+ * fscrypt_prepare_lookup - prepare to lookup a name in a possibly-encrypted directory
+ * @dir: directory being searched
+ * @dentry: filename being looked up
+- * @flags: lookup flags
++ * @fname: (output) the name to use to search the on-disk directory
+ *
+- * Prepare for ->lookup() in a directory which may be encrypted. Lookups can be
+- * done with or without the directory's encryption key; without the key,
++ * Prepare for ->lookup() in a directory which may be encrypted by determining
++ * the name that will actually be used to search the directory on-disk. Lookups
++ * can be done with or without the directory's encryption key; without the key,
+ * filenames are presented in encrypted form. Therefore, we'll try to set up
+ * the directory's encryption key, but even without it the lookup can continue.
+ *
+- * To allow invalidating stale dentries if the directory's encryption key is
+- * added later, we also install a custom ->d_revalidate() method and use the
+- * DCACHE_ENCRYPTED_WITH_KEY flag to indicate whether a given dentry is a
+- * plaintext name (flag set) or a ciphertext name (flag cleared).
++ * This also installs a custom ->d_revalidate() method which will invalidate the
++ * dentry if it was created without the key and the key is later added.
+ *
+- * Return: 0 on success, -errno if a problem occurred while setting up the
+- * encryption key
++ * Return: 0 on success; -ENOENT if key is unavailable but the filename isn't a
++ * correctly formed encoded ciphertext name, so a negative dentry should be
++ * created; or another -errno code.
+ */
+ static inline int fscrypt_prepare_lookup(struct inode *dir,
+ struct dentry *dentry,
+- unsigned int flags)
++ struct fscrypt_name *fname)
+ {
+ if (IS_ENCRYPTED(dir))
+- return __fscrypt_prepare_lookup(dir, dentry);
++ return __fscrypt_prepare_lookup(dir, dentry, fname);
++
++ memset(fname, 0, sizeof(*fname));
++ fname->usr_fname = &dentry->d_name;
++ fname->disk_name.name = (unsigned char *)dentry->d_name.name;
++ fname->disk_name.len = dentry->d_name.len;
+ return 0;
+ }
+
+diff --git a/include/linux/fscrypt_notsupp.h b/include/linux/fscrypt_notsupp.h
+index ee8b43e4c15a6..24b261e49dc14 100644
+--- a/include/linux/fscrypt_notsupp.h
++++ b/include/linux/fscrypt_notsupp.h
+@@ -112,7 +112,7 @@ static inline int fscrypt_setup_filename(struct inode *dir,
+ if (IS_ENCRYPTED(dir))
+ return -EOPNOTSUPP;
+
+- memset(fname, 0, sizeof(struct fscrypt_name));
++ memset(fname, 0, sizeof(*fname));
+ fname->usr_fname = iname;
+ fname->disk_name.name = (unsigned char *)iname->name;
+ fname->disk_name.len = iname->len;
+@@ -183,8 +183,8 @@ static inline int fscrypt_file_open(struct inode *inode, struct file *filp)
+ return 0;
+ }
+
+-static inline int __fscrypt_prepare_link(struct inode *inode,
+- struct inode *dir)
++static inline int __fscrypt_prepare_link(struct inode *inode, struct inode *dir,
++ struct dentry *dentry)
+ {
+ return -EOPNOTSUPP;
+ }
+@@ -199,7 +199,8 @@ static inline int __fscrypt_prepare_rename(struct inode *old_dir,
+ }
+
+ static inline int __fscrypt_prepare_lookup(struct inode *dir,
+- struct dentry *dentry)
++ struct dentry *dentry,
++ struct fscrypt_name *fname)
+ {
+ return -EOPNOTSUPP;
+ }
+diff --git a/include/linux/fscrypt_supp.h b/include/linux/fscrypt_supp.h
+index 6456c6b2005f4..8641e20694ce9 100644
+--- a/include/linux/fscrypt_supp.h
++++ b/include/linux/fscrypt_supp.h
+@@ -184,13 +184,15 @@ extern int fscrypt_zeroout_range(const struct inode *, pgoff_t, sector_t,
+
+ /* hooks.c */
+ extern int fscrypt_file_open(struct inode *inode, struct file *filp);
+-extern int __fscrypt_prepare_link(struct inode *inode, struct inode *dir);
++extern int __fscrypt_prepare_link(struct inode *inode, struct inode *dir,
++ struct dentry *dentry);
+ extern int __fscrypt_prepare_rename(struct inode *old_dir,
+ struct dentry *old_dentry,
+ struct inode *new_dir,
+ struct dentry *new_dentry,
+ unsigned int flags);
+-extern int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry);
++extern int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry,
++ struct fscrypt_name *fname);
+ extern int __fscrypt_prepare_symlink(struct inode *dir, unsigned int len,
+ unsigned int max_len,
+ struct fscrypt_str *disk_link);
+diff --git a/include/linux/hil_mlc.h b/include/linux/hil_mlc.h
+index 774f7d3b8f6af..369221fd55187 100644
+--- a/include/linux/hil_mlc.h
++++ b/include/linux/hil_mlc.h
+@@ -103,7 +103,7 @@ struct hilse_node {
+
+ /* Methods for back-end drivers, e.g. hp_sdc_mlc */
+ typedef int (hil_mlc_cts) (hil_mlc *mlc);
+-typedef void (hil_mlc_out) (hil_mlc *mlc);
++typedef int (hil_mlc_out) (hil_mlc *mlc);
+ typedef int (hil_mlc_in) (hil_mlc *mlc, suseconds_t timeout);
+
+ struct hil_mlc_devinfo {
+diff --git a/include/linux/mtd/pfow.h b/include/linux/mtd/pfow.h
+index 122f3439e1af2..c65d7a3be3c69 100644
+--- a/include/linux/mtd/pfow.h
++++ b/include/linux/mtd/pfow.h
+@@ -128,7 +128,7 @@ static inline void print_drs_error(unsigned dsr)
+
+ if (!(dsr & DSR_AVAILABLE))
+ printk(KERN_NOTICE"DSR.15: (0) Device not Available\n");
+- if (prog_status & 0x03)
++ if ((prog_status & 0x03) == 0x03)
+ printk(KERN_NOTICE"DSR.9,8: (11) Attempt to program invalid "
+ "half with 41h command\n");
+ else if (prog_status & 0x02)
+diff --git a/include/linux/usb/pd.h b/include/linux/usb/pd.h
+index f2162e0fe531b..bdf4c88d2aa0a 100644
+--- a/include/linux/usb/pd.h
++++ b/include/linux/usb/pd.h
+@@ -451,6 +451,7 @@ static inline unsigned int rdo_max_power(u32 rdo)
+ #define PD_T_ERROR_RECOVERY 100 /* minimum 25 is insufficient */
+ #define PD_T_SRCSWAPSTDBY 625 /* Maximum of 650ms */
+ #define PD_T_NEWSRC 250 /* Maximum of 275ms */
++#define PD_T_SWAP_SRC_START 20 /* Minimum of 20ms */
+
+ #define PD_T_DRP_TRY 100 /* 75 - 150 ms */
+ #define PD_T_DRP_TRYWAIT 600 /* 400 - 800 ms */
+diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
+index d143e277cdaf2..71ca8c4dc290f 100644
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -1193,8 +1193,8 @@ union bpf_attr {
+ * Return
+ * The return value depends on the result of the test, and can be:
+ *
+- * * 0, if the *skb* task belongs to the cgroup2.
+- * * 1, if the *skb* task does not belong to the cgroup2.
++ * * 0, if current task belongs to the cgroup2.
++ * * 1, if current task does not belong to the cgroup2.
+ * * A negative error code, if an error occurred.
+ *
+ * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags)
+diff --git a/include/uapi/linux/nfs4.h b/include/uapi/linux/nfs4.h
+index 8572930cf5b00..54a78529c8b38 100644
+--- a/include/uapi/linux/nfs4.h
++++ b/include/uapi/linux/nfs4.h
+@@ -136,6 +136,8 @@
+
+ #define EXCHGID4_FLAG_UPD_CONFIRMED_REC_A 0x40000000
+ #define EXCHGID4_FLAG_CONFIRMED_R 0x80000000
++
++#define EXCHGID4_FLAG_SUPP_FENCE_OPS 0x00000004
+ /*
+ * Since the validity of these bits depends on whether
+ * they're set in the argument or response, have separate
+@@ -143,6 +145,7 @@
+ */
+ #define EXCHGID4_FLAG_MASK_A 0x40070103
+ #define EXCHGID4_FLAG_MASK_R 0x80070103
++#define EXCHGID4_2_FLAG_MASK_R 0x80070107
+
+ #define SEQ4_STATUS_CB_PATH_DOWN 0x00000001
+ #define SEQ4_STATUS_CB_GSS_CONTEXTS_EXPIRING 0x00000002
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index 1aae2e4b8f102..b73f4423bc09d 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -362,9 +362,9 @@ enum v4l2_hsv_encoding {
+
+ enum v4l2_quantization {
+ /*
+- * The default for R'G'B' quantization is always full range, except
+- * for the BT2020 colorspace. For Y'CbCr the quantization is always
+- * limited range, except for COLORSPACE_JPEG: this is full range.
++ * The default for R'G'B' quantization is always full range.
++ * For Y'CbCr the quantization is always limited range, except
++ * for COLORSPACE_JPEG: this is full range.
+ */
+ V4L2_QUANTIZATION_DEFAULT = 0,
+ V4L2_QUANTIZATION_FULL_RANGE = 1,
+@@ -373,14 +373,13 @@ enum v4l2_quantization {
+
+ /*
+ * Determine how QUANTIZATION_DEFAULT should map to a proper quantization.
+- * This depends on whether the image is RGB or not, the colorspace and the
+- * Y'CbCr encoding.
++ * This depends on whether the image is RGB or not, the colorspace.
++ * The Y'CbCr encoding is not used anymore, but is still there for backwards
++ * compatibility.
+ */
+ #define V4L2_MAP_QUANTIZATION_DEFAULT(is_rgb_or_hsv, colsp, ycbcr_enc) \
+- (((is_rgb_or_hsv) && (colsp) == V4L2_COLORSPACE_BT2020) ? \
+- V4L2_QUANTIZATION_LIM_RANGE : \
+- (((is_rgb_or_hsv) || (colsp) == V4L2_COLORSPACE_JPEG) ? \
+- V4L2_QUANTIZATION_FULL_RANGE : V4L2_QUANTIZATION_LIM_RANGE))
++ (((is_rgb_or_hsv) || (colsp) == V4L2_COLORSPACE_JPEG) ? \
++ V4L2_QUANTIZATION_FULL_RANGE : V4L2_QUANTIZATION_LIM_RANGE)
+
+ /*
+ * Deprecated names for opRGB colorspace (IEC 61966-2-5)
+diff --git a/include/xen/events.h b/include/xen/events.h
+index 1650d39decaec..d8255ed2052cc 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -14,11 +14,16 @@
+
+ unsigned xen_evtchn_nr_channels(void);
+
+-int bind_evtchn_to_irq(unsigned int evtchn);
+-int bind_evtchn_to_irqhandler(unsigned int evtchn,
++int bind_evtchn_to_irq(evtchn_port_t evtchn);
++int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn);
++int bind_evtchn_to_irqhandler(evtchn_port_t evtchn,
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname,
+ void *dev_id);
++int bind_evtchn_to_irqhandler_lateeoi(evtchn_port_t evtchn,
++ irq_handler_t handler,
++ unsigned long irqflags, const char *devname,
++ void *dev_id);
+ int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
+ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ irq_handler_t handler,
+@@ -31,13 +36,21 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
+ const char *devname,
+ void *dev_id);
+ int bind_interdomain_evtchn_to_irq(unsigned int remote_domain,
+- unsigned int remote_port);
++ evtchn_port_t remote_port);
++int bind_interdomain_evtchn_to_irq_lateeoi(unsigned int remote_domain,
++ evtchn_port_t remote_port);
+ int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain,
+- unsigned int remote_port,
++ evtchn_port_t remote_port,
+ irq_handler_t handler,
+ unsigned long irqflags,
+ const char *devname,
+ void *dev_id);
++int bind_interdomain_evtchn_to_irqhandler_lateeoi(unsigned int remote_domain,
++ evtchn_port_t remote_port,
++ irq_handler_t handler,
++ unsigned long irqflags,
++ const char *devname,
++ void *dev_id);
+
+ /*
+ * Common unbind function for all event sources. Takes IRQ to unbind from.
+@@ -46,6 +59,14 @@ int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain,
+ */
+ void unbind_from_irqhandler(unsigned int irq, void *dev_id);
+
++/*
++ * Send late EOI for an IRQ bound to an event channel via one of the *_lateeoi
++ * functions above.
++ */
++void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags);
++/* Signal an event was spurious, i.e. there was no action resulting from it. */
++#define XEN_EOI_FLAG_SPURIOUS 0x00000001
++
+ #define XEN_IRQ_PRIORITY_MAX EVTCHN_FIFO_PRIORITY_MAX
+ #define XEN_IRQ_PRIORITY_DEFAULT EVTCHN_FIFO_PRIORITY_DEFAULT
+ #define XEN_IRQ_PRIORITY_MIN EVTCHN_FIFO_PRIORITY_MIN
+diff --git a/init/Kconfig b/init/Kconfig
+index 47035b5a46f64..5eb91dde4018c 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -535,7 +535,8 @@ config IKCONFIG_PROC
+
+ config LOG_BUF_SHIFT
+ int "Kernel log buffer size (16 => 64KB, 17 => 128KB)"
+- range 12 25
++ range 12 25 if !H8300
++ range 12 19 if H8300
+ default 17
+ depends on PRINTK
+ help
+diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
+index fbb1bfdd2fa53..8c76141c99c8c 100644
+--- a/kernel/debug/debug_core.c
++++ b/kernel/debug/debug_core.c
+@@ -95,14 +95,6 @@ int dbg_switch_cpu;
+ /* Use kdb or gdbserver mode */
+ int dbg_kdb_mode = 1;
+
+-static int __init opt_kgdb_con(char *str)
+-{
+- kgdb_use_con = 1;
+- return 0;
+-}
+-
+-early_param("kgdbcon", opt_kgdb_con);
+-
+ module_param(kgdb_use_con, int, 0644);
+ module_param(kgdbreboot, int, 0644);
+
+@@ -820,6 +812,20 @@ static struct console kgdbcons = {
+ .index = -1,
+ };
+
++static int __init opt_kgdb_con(char *str)
++{
++ kgdb_use_con = 1;
++
++ if (kgdb_io_module_registered && !kgdb_con_registered) {
++ register_console(&kgdbcons);
++ kgdb_con_registered = 1;
++ }
++
++ return 0;
++}
++
++early_param("kgdbcon", opt_kgdb_con);
++
+ #ifdef CONFIG_MAGIC_SYSRQ
+ static void sysrq_handle_dbg(int key)
+ {
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 920d853a8e9e2..eabb9180ffa89 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1517,8 +1517,10 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_
+ */
+ newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
+
+- if (unlikely(should_fail_futex(true)))
++ if (unlikely(should_fail_futex(true))) {
+ ret = -EFAULT;
++ goto out_unlock;
++ }
+
+ ret = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval);
+ if (!ret && (curval != uval)) {
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 564d22691dd73..eef05eb3b2841 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -1692,18 +1692,18 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
+ {
+ struct ring_buffer_per_cpu *cpu_buffer;
+ unsigned long nr_pages;
+- int cpu, err = 0;
++ int cpu, err;
+
+ /*
+ * Always succeed at resizing a non-existent buffer:
+ */
+ if (!buffer)
+- return size;
++ return 0;
+
+ /* Make sure the requested buffer exists */
+ if (cpu_id != RING_BUFFER_ALL_CPUS &&
+ !cpumask_test_cpu(cpu_id, buffer->cpumask))
+- return size;
++ return 0;
+
+ nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE);
+
+@@ -1843,7 +1843,7 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
+ }
+
+ mutex_unlock(&buffer->mutex);
+- return size;
++ return 0;
+
+ out_err:
+ for_each_buffer_cpu(buffer, cpu) {
+diff --git a/lib/scatterlist.c b/lib/scatterlist.c
+index 60e7eca2f4bed..3b859201f84c6 100644
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -506,7 +506,7 @@ struct scatterlist *sgl_alloc_order(unsigned long long length,
+ elem_len = min_t(u64, length, PAGE_SIZE << order);
+ page = alloc_pages(gfp, order);
+ if (!page) {
+- sgl_free(sgl);
++ sgl_free_order(sgl, order);
+ return NULL;
+ }
+
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index b6dcb40fa8a7d..9268f808afc08 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -1038,7 +1038,7 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)
+
+ csocket = NULL;
+
+- if (addr == NULL)
++ if (!addr || !strlen(addr))
+ return -EINVAL;
+
+ if (strlen(addr) >= UNIX_PATH_MAX) {
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index f7d7f32ac673c..21bd37ec5511c 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -3037,6 +3037,11 @@ static void con_fault(struct ceph_connection *con)
+ ceph_msg_put(con->in_msg);
+ con->in_msg = NULL;
+ }
++ if (con->out_msg) {
++ BUG_ON(con->out_msg->con != con);
++ ceph_msg_put(con->out_msg);
++ con->out_msg = NULL;
++ }
+
+ /* Requeue anything that hasn't been acked */
+ list_splice_init(&con->out_sent, &con->out_queue);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 4ce3397e6fcf7..98e8ee8bb7593 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -495,6 +495,8 @@ static inline bool tcp_stream_is_readable(const struct tcp_sock *tp,
+ return true;
+ if (tcp_rmem_pressure(sk))
+ return true;
++ if (tcp_receive_window(tp) <= inet_csk(sk)->icsk_ack.rcv_mss)
++ return true;
+ }
+ if (sk->sk_prot->stream_memory_read)
+ return sk->sk_prot->stream_memory_read(sk);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index c19870d561861..686833dfaa7fd 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4704,7 +4704,8 @@ void tcp_data_ready(struct sock *sk)
+ int avail = tp->rcv_nxt - tp->copied_seq;
+
+ if (avail < sk->sk_rcvlowat && !tcp_rmem_pressure(sk) &&
+- !sock_flag(sk, SOCK_DONE))
++ !sock_flag(sk, SOCK_DONE) &&
++ tcp_receive_window(tp) > inet_csk(sk)->icsk_ack.rcv_mss)
+ return;
+
+ sk->sk_data_ready(sk);
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 014a28d8dd4fa..02d8d3fd84a5c 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -330,7 +330,7 @@ static s64 tabledist(s64 mu, s32 sigma,
+
+ /* default uniform distribution */
+ if (dist == NULL)
+- return ((rnd % (2 * sigma)) + mu) - sigma;
++ return ((rnd % (2 * (u32)sigma)) + mu) - sigma;
+
+ t = dist->table[rnd % dist->size];
+ x = (sigma % NETEM_DIST_SCALE) * t;
+@@ -787,6 +787,10 @@ static void get_slot(struct netem_sched_data *q, const struct nlattr *attr)
+ q->slot_config.max_packets = INT_MAX;
+ if (q->slot_config.max_bytes == 0)
+ q->slot_config.max_bytes = INT_MAX;
++
++ /* capping dist_jitter to the range acceptable by tabledist() */
++ q->slot_config.dist_jitter = min_t(__s64, INT_MAX, abs(q->slot_config.dist_jitter));
++
+ q->slot.packets_left = q->slot_config.max_packets;
+ q->slot.bytes_left = q->slot_config.max_bytes;
+ if (q->slot_config.min_delay | q->slot_config.max_delay |
+@@ -1011,6 +1015,9 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,
+ if (tb[TCA_NETEM_SLOT])
+ get_slot(q, tb[TCA_NETEM_SLOT]);
+
++ /* capping jitter to the range acceptable by tabledist() */
++ q->jitter = min_t(s64, abs(q->jitter), INT_MAX);
++
+ return ret;
+
+ get_table_failure:
+diff --git a/net/tipc/msg.c b/net/tipc/msg.c
+index 0b8446cd541ce..f04843ca82162 100644
+--- a/net/tipc/msg.c
++++ b/net/tipc/msg.c
+@@ -140,12 +140,11 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
+ if (fragid == FIRST_FRAGMENT) {
+ if (unlikely(head))
+ goto err;
+- if (skb_cloned(frag))
+- frag = skb_copy(frag, GFP_ATOMIC);
++ *buf = NULL;
++ frag = skb_unshare(frag, GFP_ATOMIC);
+ if (unlikely(!frag))
+ goto err;
+ head = *headbuf = frag;
+- *buf = NULL;
+ TIPC_SKB_CB(head)->tail = NULL;
+ if (skb_is_nonlinear(head)) {
+ skb_walk_frags(head, tail) {
+diff --git a/scripts/setlocalversion b/scripts/setlocalversion
+index 365b3c2b8f431..2cb0b92f40bed 100755
+--- a/scripts/setlocalversion
++++ b/scripts/setlocalversion
+@@ -45,7 +45,7 @@ scm_version()
+
+ # Check for git and a git repo.
+ if test -z "$(git rev-parse --show-cdup 2>/dev/null)" &&
+- head=`git rev-parse --verify --short HEAD 2>/dev/null`; then
++ head=$(git rev-parse --verify HEAD 2>/dev/null); then
+
+ # If we are at a tagged commit (like "v2.6.30-rc6"), we ignore
+ # it, because this version is defined in the top level Makefile.
+@@ -59,11 +59,22 @@ scm_version()
+ fi
+ # If we are past a tagged commit (like
+ # "v2.6.30-rc5-302-g72357d5"), we pretty print it.
+- if atag="`git describe 2>/dev/null`"; then
+- echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),$(NF))}'
+-
+- # If we don't have a tag at all we print -g{commitish}.
++ #
++ # Ensure the abbreviated sha1 has exactly 12
++ # hex characters, to make the output
++ # independent of git version, local
++ # core.abbrev settings and/or total number of
++ # objects in the current repository - passing
++ # --abbrev=12 ensures a minimum of 12, and the
++ # awk substr() then picks the 'g' and first 12
++ # hex chars.
++ if atag="$(git describe --abbrev=12 2>/dev/null)"; then
++ echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),substr($(NF),0,13))}'
++
++ # If we don't have a tag at all we print -g{commitish},
++ # again using exactly 12 hex chars.
+ else
++ head="$(echo $head | cut -c1-12)"
+ printf '%s%s' -g $head
+ fi
+ fi
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index e11d860fdce4d..651c0127c00de 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -186,6 +186,12 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
+ break;
+ case EVM_IMA_XATTR_DIGSIG:
+ case EVM_XATTR_PORTABLE_DIGSIG:
++ /* accept xattr with non-empty signature field */
++ if (xattr_len <= sizeof(struct signature_v2_hdr)) {
++ evm_status = INTEGRITY_FAIL;
++ goto out;
++ }
++
+ hdr = (struct signature_v2_hdr *)xattr_data;
+ digest.hdr.algo = hdr->hash_algo;
+ rc = evm_calc_hash(dentry, xattr_name, xattr_value,
+diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
+index bf4cd924aed55..13944978ada5b 100644
+--- a/tools/include/uapi/linux/bpf.h
++++ b/tools/include/uapi/linux/bpf.h
+@@ -1191,8 +1191,8 @@ union bpf_attr {
+ * Return
+ * The return value depends on the result of the test, and can be:
+ *
+- * * 0, if the *skb* task belongs to the cgroup2.
+- * * 1, if the *skb* task does not belong to the cgroup2.
++ * * 0, if current task belongs to the cgroup2.
++ * * 1, if current task does not belong to the cgroup2.
+ * * A negative error code, if an error occurred.
+ *
+ * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags)
+diff --git a/tools/objtool/orc_gen.c b/tools/objtool/orc_gen.c
+index 3f98dcfbc177b..0b1ba8e7d18a1 100644
+--- a/tools/objtool/orc_gen.c
++++ b/tools/objtool/orc_gen.c
+@@ -100,11 +100,6 @@ static int create_orc_entry(struct section *u_sec, struct section *ip_relasec,
+ struct orc_entry *orc;
+ struct rela *rela;
+
+- if (!insn_sec->sym) {
+- WARN("missing symbol for section %s", insn_sec->name);
+- return -1;
+- }
+-
+ /* populate ORC data */
+ orc = (struct orc_entry *)u_sec->data->d_buf + idx;
+ memcpy(orc, o, sizeof(*orc));
+@@ -117,8 +112,32 @@ static int create_orc_entry(struct section *u_sec, struct section *ip_relasec,
+ }
+ memset(rela, 0, sizeof(*rela));
+
+- rela->sym = insn_sec->sym;
+- rela->addend = insn_off;
++ if (insn_sec->sym) {
++ rela->sym = insn_sec->sym;
++ rela->addend = insn_off;
++ } else {
++ /*
++ * The Clang assembler doesn't produce section symbols, so we
++ * have to reference the function symbol instead:
++ */
++ rela->sym = find_symbol_containing(insn_sec, insn_off);
++ if (!rela->sym) {
++ /*
++ * Hack alert. This happens when we need to reference
++ * the NOP pad insn immediately after the function.
++ */
++ rela->sym = find_symbol_containing(insn_sec,
++ insn_off - 1);
++ }
++ if (!rela->sym) {
++ WARN("missing symbol for insn at offset 0x%lx\n",
++ insn_off);
++ return -1;
++ }
++
++ rela->addend = insn_off - rela->sym->offset;
++ }
++
+ rela->type = R_X86_64_PC32;
+ rela->offset = idx * sizeof(int);
+
+diff --git a/tools/perf/util/print_binary.c b/tools/perf/util/print_binary.c
+index 23e3670634465..71aeaf6f45cc2 100644
+--- a/tools/perf/util/print_binary.c
++++ b/tools/perf/util/print_binary.c
+@@ -50,7 +50,7 @@ int is_printable_array(char *p, unsigned int len)
+
+ len--;
+
+- for (i = 0; i < len; i++) {
++ for (i = 0; i < len && p[i]; i++) {
+ if (!isprint(p[i]) && !isspace(p[i]))
+ return 0;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-11-10 13:56 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-11-10 13:56 UTC (permalink / raw
To: gentoo-commits
commit: 96339a934e3be4fc8007433e7229ad6074feab5a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 10 13:56:24 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 10 13:56:24 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=96339a93
Linux patch 4.19.156
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1155_linux-4.19.156.patch | 2339 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2343 insertions(+)
diff --git a/0000_README b/0000_README
index e9e0833..54a0fb2 100644
--- a/0000_README
+++ b/0000_README
@@ -659,6 +659,10 @@ Patch: 1154_linux-4.19.155.patch
From: https://www.kernel.org
Desc: Linux 4.19.155
+Patch: 1155_linux-4.19.156.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.156
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1155_linux-4.19.156.patch b/1155_linux-4.19.156.patch
new file mode 100644
index 0000000..8a1ecce
--- /dev/null
+++ b/1155_linux-4.19.156.patch
@@ -0,0 +1,2339 @@
+diff --git a/Makefile b/Makefile
+index 9fc16d34e1bb9..82891b34e19e0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 155
++SUBLEVEL = 156
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
+index 705a682084232..85d9ea4a0accc 100644
+--- a/arch/arc/kernel/entry.S
++++ b/arch/arc/kernel/entry.S
+@@ -156,6 +156,7 @@ END(EV_Extension)
+ tracesys:
+ ; save EFA in case tracer wants the PC of traced task
+ ; using ERET won't work since next-PC has already committed
++ lr r12, [efa]
+ GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11
+ st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address
+
+@@ -198,9 +199,15 @@ tracesys_exit:
+ ; Breakpoint TRAP
+ ; ---------------------------------------------
+ trap_with_param:
+- mov r0, r12 ; EFA in case ptracer/gdb wants stop_pc
++
++ ; stop_pc info by gdb needs this info
++ lr r0, [efa]
+ mov r1, sp
+
++ ; Now that we have read EFA, it is safe to do "fake" rtie
++ ; and get out of CPU exception mode
++ FAKE_RET_FROM_EXCPN
++
+ ; Save callee regs in case gdb wants to have a look
+ ; SP will grow up by size of CALLEE Reg-File
+ ; NOTE: clobbers r12
+@@ -227,10 +234,6 @@ ENTRY(EV_Trap)
+
+ EXCEPTION_PROLOGUE
+
+- lr r12, [efa]
+-
+- FAKE_RET_FROM_EXCPN
+-
+ ;============ TRAP 1 :breakpoints
+ ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR)
+ bmsk.f 0, r9, 7
+@@ -238,6 +241,9 @@ ENTRY(EV_Trap)
+
+ ;============ TRAP (no param): syscall top level
+
++ ; First return from Exception to pure K mode (Exception/IRQs renabled)
++ FAKE_RET_FROM_EXCPN
++
+ ; If syscall tracing ongoing, invoke pre-post-hooks
+ GET_CURR_THR_INFO_FLAGS r10
+ btst r10, TIF_SYSCALL_TRACE
+diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
+index bf40e06f3fb84..0fed32b959232 100644
+--- a/arch/arc/kernel/stacktrace.c
++++ b/arch/arc/kernel/stacktrace.c
+@@ -115,7 +115,7 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
+ int (*consumer_fn) (unsigned int, void *), void *arg)
+ {
+ #ifdef CONFIG_ARC_DW2_UNWIND
+- int ret = 0;
++ int ret = 0, cnt = 0;
+ unsigned int address;
+ struct unwind_frame_info frame_info;
+
+@@ -135,6 +135,11 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
+ break;
+
+ frame_info.regs.r63 = frame_info.regs.r31;
++
++ if (cnt++ > 128) {
++ printk("unwinder looping too long, aborting !\n");
++ return 0;
++ }
+ }
+
+ return address; /* return the last address it saw */
+diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
+index 5d46bb0139fad..707ad5074878a 100644
+--- a/arch/arm/boot/dts/sun4i-a10.dtsi
++++ b/arch/arm/boot/dts/sun4i-a10.dtsi
+@@ -143,7 +143,7 @@
+ trips {
+ cpu_alert0: cpu-alert0 {
+ /* milliCelsius */
+- temperature = <850000>;
++ temperature = <85000>;
+ hysteresis = <2000>;
+ type = "passive";
+ };
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+index 6cbdd66921aab..1a3e6e3b04eba 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+@@ -21,6 +21,10 @@
+
+ aliases {
+ ethernet0 = ð0;
++ /* for dsa slave device */
++ ethernet1 = &switch0port1;
++ ethernet2 = &switch0port2;
++ ethernet3 = &switch0port3;
+ serial0 = &uart0;
+ serial1 = &uart1;
+ };
+@@ -136,25 +140,25 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- port@0 {
++ switch0port0: port@0 {
+ reg = <0>;
+ label = "cpu";
+ ethernet = <ð0>;
+ };
+
+- port@1 {
++ switch0port1: port@1 {
+ reg = <1>;
+ label = "wan";
+ phy-handle = <&switch0phy0>;
+ };
+
+- port@2 {
++ switch0port2: port@2 {
+ reg = <2>;
+ label = "lan0";
+ phy-handle = <&switch0phy1>;
+ };
+
+- port@3 {
++ switch0port3: port@3 {
+ reg = <3>;
+ label = "lan1";
+ phy-handle = <&switch0phy2>;
+diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
+index 9490a2845f14b..273687986a263 100644
+--- a/arch/x86/kernel/kexec-bzimage64.c
++++ b/arch/x86/kernel/kexec-bzimage64.c
+@@ -211,8 +211,7 @@ setup_boot_parameters(struct kimage *image, struct boot_params *params,
+ params->hdr.hardware_subarch = boot_params.hdr.hardware_subarch;
+
+ /* Copying screen_info will do? */
+- memcpy(¶ms->screen_info, &boot_params.screen_info,
+- sizeof(struct screen_info));
++ memcpy(¶ms->screen_info, &screen_info, sizeof(struct screen_info));
+
+ /* Fill in memsize later */
+ params->screen_info.ext_mem_k = 0;
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index a06547fe6f6b4..85bd46e0a745f 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -876,13 +876,20 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ goto fail;
+ }
+
++ if (radix_tree_preload(GFP_KERNEL)) {
++ blkg_free(new_blkg);
++ ret = -ENOMEM;
++ goto fail;
++ }
++
+ rcu_read_lock();
+ spin_lock_irq(q->queue_lock);
+
+ blkg = blkg_lookup_check(pos, pol, q);
+ if (IS_ERR(blkg)) {
+ ret = PTR_ERR(blkg);
+- goto fail_unlock;
++ blkg_free(new_blkg);
++ goto fail_preloaded;
+ }
+
+ if (blkg) {
+@@ -891,10 +898,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ blkg = blkg_create(pos, q, new_blkg);
+ if (unlikely(IS_ERR(blkg))) {
+ ret = PTR_ERR(blkg);
+- goto fail_unlock;
++ goto fail_preloaded;
+ }
+ }
+
++ radix_tree_preload_end();
++
+ if (pos == blkcg)
+ goto success;
+ }
+@@ -904,6 +913,8 @@ success:
+ ctx->body = body;
+ return 0;
+
++fail_preloaded:
++ radix_tree_preload_end();
+ fail_unlock:
+ spin_unlock_irq(q->queue_lock);
+ rcu_read_unlock();
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index dd4c7289610ec..cb88f3b43a940 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -1535,7 +1535,7 @@ static ssize_t format1_show(struct device *dev,
+ le16_to_cpu(nfit_dcr->dcr->code));
+ break;
+ }
+- if (rc != ENXIO)
++ if (rc != -ENXIO)
+ break;
+ }
+ mutex_unlock(&acpi_desc->init_mutex);
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index b3c569412f4e2..4ba9231a6be80 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -931,6 +931,8 @@ static void __device_release_driver(struct device *dev, struct device *parent)
+
+ drv = dev->driver;
+ if (drv) {
++ pm_runtime_get_sync(dev);
++
+ while (device_links_busy(dev)) {
+ device_unlock(dev);
+ if (parent && dev->bus->need_parent_lock)
+@@ -946,11 +948,12 @@ static void __device_release_driver(struct device *dev, struct device *parent)
+ * have released the driver successfully while this one
+ * was waiting, so check for that.
+ */
+- if (dev->driver != drv)
++ if (dev->driver != drv) {
++ pm_runtime_put(dev);
+ return;
++ }
+ }
+
+- pm_runtime_get_sync(dev);
+ pm_runtime_clean_up_links(dev);
+
+ driver_sysfs_remove(dev);
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index f7334c42ebd9e..35116cdb5e389 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -175,7 +175,7 @@ static struct sk_buff *alloc_ctrl_skb(struct sk_buff *skb, int len)
+ {
+ if (likely(skb && !skb_shared(skb) && !skb_cloned(skb))) {
+ __skb_trim(skb, 0);
+- refcount_add(2, &skb->users);
++ refcount_inc(&skb->users);
+ } else {
+ skb = alloc_skb(len, GFP_KERNEL | __GFP_NOFAIL);
+ }
+diff --git a/drivers/crypto/chelsio/chtls/chtls_hw.c b/drivers/crypto/chelsio/chtls/chtls_hw.c
+index 64d24823c65aa..2294fb06bef36 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_hw.c
++++ b/drivers/crypto/chelsio/chtls/chtls_hw.c
+@@ -368,6 +368,9 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, u32 optname)
+ if (ret)
+ goto out_notcb;
+
++ if (unlikely(csk_flag(sk, CSK_ABORT_SHUTDOWN)))
++ goto out_notcb;
++
+ set_wr_txq(skb, CPL_PRIORITY_DATA, csk->tlshws.txqid);
+ csk->wr_credits -= DIV_ROUND_UP(len, 16);
+ csk->wr_unacked += DIV_ROUND_UP(len, 16);
+diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
+index a262a64f56256..ba24ac698e8bc 100644
+--- a/drivers/gpu/drm/i915/i915_gpu_error.c
++++ b/drivers/gpu/drm/i915/i915_gpu_error.c
+@@ -268,6 +268,8 @@ static int compress_page(struct compress *c,
+
+ if (zlib_deflate(zstream, Z_NO_FLUSH) != Z_OK)
+ return -EIO;
++
++ cond_resched();
+ } while (zstream->avail_in);
+
+ /* Fallback to uncompressed if we increase size? */
+@@ -347,6 +349,7 @@ static int compress_page(struct compress *c,
+ if (!i915_memcpy_from_wc(ptr, src, PAGE_SIZE))
+ memcpy(ptr, src, PAGE_SIZE);
+ dst->pages[dst->page_count++] = ptr;
++ cond_resched();
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
+index 04270a14fcaaf..868dd1ef3b693 100644
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -312,6 +312,7 @@ unbind_all:
+ component_unbind_all(dev, drm);
+ gem_destroy:
+ vc4_gem_destroy(drm);
++ drm_mode_config_cleanup(drm);
+ vc4_bo_cache_destroy(drm);
+ dev_put:
+ drm_dev_put(drm);
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index acae87f548a16..0374a1ba10103 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1704,7 +1704,8 @@ static inline int macb_clear_csum(struct sk_buff *skb)
+
+ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)
+ {
+- bool cloned = skb_cloned(*skb) || skb_header_cloned(*skb);
++ bool cloned = skb_cloned(*skb) || skb_header_cloned(*skb) ||
++ skb_is_nonlinear(*skb);
+ int padlen = ETH_ZLEN - (*skb)->len;
+ int headroom = skb_headroom(*skb);
+ int tailroom = skb_tailroom(*skb);
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index 8243501c37574..8db0924ec681c 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -1388,7 +1388,7 @@ static int gfar_probe(struct platform_device *ofdev)
+
+ if (dev->features & NETIF_F_IP_CSUM ||
+ priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER)
+- dev->needed_headroom = GMAC_FCB_LEN;
++ dev->needed_headroom = GMAC_FCB_LEN + GMAC_TXPAL_LEN;
+
+ /* Initializing some of the rx/tx queue level parameters */
+ for (i = 0; i < priv->num_tx_queues; i++) {
+@@ -2370,20 +2370,12 @@ static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ fcb_len = GMAC_FCB_LEN + GMAC_TXPAL_LEN;
+
+ /* make space for additional header when fcb is needed */
+- if (fcb_len && unlikely(skb_headroom(skb) < fcb_len)) {
+- struct sk_buff *skb_new;
+-
+- skb_new = skb_realloc_headroom(skb, fcb_len);
+- if (!skb_new) {
++ if (fcb_len) {
++ if (unlikely(skb_cow_head(skb, fcb_len))) {
+ dev->stats.tx_errors++;
+ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+ }
+-
+- if (skb->sk)
+- skb_set_owner_w(skb_new, skb->sk);
+- dev_consume_skb_any(skb);
+- skb = skb_new;
+ }
+
+ /* total number of fragments in the SKB */
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 998d08ae7431a..47d518e6d5d4f 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -1886,7 +1886,8 @@ static int sfp_probe(struct platform_device *pdev)
+ continue;
+
+ irq = gpiod_to_irq(sfp->gpio[i]);
+- if (!irq) {
++ if (irq < 0) {
++ irq = 0;
+ poll = true;
+ continue;
+ }
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index d2612b69257ea..6e0b3dc14aa47 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1268,6 +1268,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */
+ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1230, 2)}, /* Telit LE910Cx */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)}, /* Telit LE910Cx */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)}, /* Telit LE910Cx */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)}, /* Telit LN940 series */
+diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
+index 895c83e0c7b6c..19f95552da4d8 100644
+--- a/drivers/of/of_reserved_mem.c
++++ b/drivers/of/of_reserved_mem.c
+@@ -218,6 +218,16 @@ static int __init __rmem_cmp(const void *a, const void *b)
+ if (ra->base > rb->base)
+ return 1;
+
++ /*
++ * Put the dynamic allocations (address == 0, size == 0) before static
++ * allocations at address 0x0 so that overlap detection works
++ * correctly.
++ */
++ if (ra->size < rb->size)
++ return -1;
++ if (ra->size > rb->size)
++ return 1;
++
+ return 0;
+ }
+
+@@ -235,8 +245,7 @@ static void __init __rmem_check_for_overlap(void)
+
+ this = &reserved_mem[i];
+ next = &reserved_mem[i + 1];
+- if (!(this->base && next->base))
+- continue;
++
+ if (this->base + this->size > next->base) {
+ phys_addr_t this_end, next_end;
+
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 9a7e3a3bd5ce8..009a5b2aa3d02 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -1722,15 +1722,16 @@ static void scsi_sysfs_add_devices(struct Scsi_Host *shost)
+ */
+ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost)
+ {
+- struct async_scan_data *data;
++ struct async_scan_data *data = NULL;
+ unsigned long flags;
+
+ if (strncmp(scsi_scan_type, "sync", 4) == 0)
+ return NULL;
+
++ mutex_lock(&shost->scan_mutex);
+ if (shost->async_scan) {
+ shost_printk(KERN_DEBUG, shost, "%s called twice\n", __func__);
+- return NULL;
++ goto err;
+ }
+
+ data = kmalloc(sizeof(*data), GFP_KERNEL);
+@@ -1741,7 +1742,6 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost)
+ goto err;
+ init_completion(&data->prev_finished);
+
+- mutex_lock(&shost->scan_mutex);
+ spin_lock_irqsave(shost->host_lock, flags);
+ shost->async_scan = 1;
+ spin_unlock_irqrestore(shost->host_lock, flags);
+@@ -1756,6 +1756,7 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost)
+ return data;
+
+ err:
++ mutex_unlock(&shost->scan_mutex);
+ kfree(data);
+ return NULL;
+ }
+diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
+index 159169a48debe..cc4f0c5e5ddff 100644
+--- a/drivers/tty/serial/8250/8250_mtk.c
++++ b/drivers/tty/serial/8250/8250_mtk.c
+@@ -47,7 +47,7 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
+ */
+ baud = tty_termios_baud_rate(termios);
+
+- serial8250_do_set_termios(port, termios, old);
++ serial8250_do_set_termios(port, termios, NULL);
+
+ tty_termios_encode_baud_rate(termios, baud, baud);
+
+diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c
+index 1b4008d022bfd..2f7ef64536a04 100644
+--- a/drivers/tty/serial/serial_txx9.c
++++ b/drivers/tty/serial/serial_txx9.c
+@@ -1284,6 +1284,9 @@ static int __init serial_txx9_init(void)
+
+ #ifdef ENABLE_SERIAL_TXX9_PCI
+ ret = pci_register_driver(&serial_txx9_pci_driver);
++ if (ret) {
++ platform_driver_unregister(&serial_txx9_plat_driver);
++ }
+ #endif
+ if (ret == 0)
+ goto out;
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 758f522f331e4..13ea0579f104c 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -4574,27 +4574,6 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
+ return rc;
+ }
+
+-static int con_font_copy(struct vc_data *vc, struct console_font_op *op)
+-{
+- int con = op->height;
+- int rc;
+-
+-
+- console_lock();
+- if (vc->vc_mode != KD_TEXT)
+- rc = -EINVAL;
+- else if (!vc->vc_sw->con_font_copy)
+- rc = -ENOSYS;
+- else if (con < 0 || !vc_cons_allocated(con))
+- rc = -ENOTTY;
+- else if (con == vc->vc_num) /* nothing to do */
+- rc = 0;
+- else
+- rc = vc->vc_sw->con_font_copy(vc, con);
+- console_unlock();
+- return rc;
+-}
+-
+ int con_font_op(struct vc_data *vc, struct console_font_op *op)
+ {
+ switch (op->op) {
+@@ -4605,7 +4584,8 @@ int con_font_op(struct vc_data *vc, struct console_font_op *op)
+ case KD_FONT_OP_SET_DEFAULT:
+ return con_font_default(vc, op);
+ case KD_FONT_OP_COPY:
+- return con_font_copy(vc, op);
++ /* was buggy and never really used */
++ return -EINVAL;
+ }
+ return -ENOSYS;
+ }
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 4ee8105310989..5ad14cdd97623 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -378,6 +378,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x0926, 0x3333), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
++ /* Kingston DataTraveler 3.0 */
++ { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
+ { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
+
+diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
+index bbcd3332471dc..3828ed6d38a21 100644
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -573,6 +573,7 @@ static int mtu3_gadget_stop(struct usb_gadget *g)
+
+ spin_unlock_irqrestore(&mtu->lock, flags);
+
++ synchronize_irq(mtu->irq);
+ return 0;
+ }
+
+diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
+index ebd76ab07b722..36dd688b5795c 100644
+--- a/drivers/usb/serial/cyberjack.c
++++ b/drivers/usb/serial/cyberjack.c
+@@ -357,11 +357,12 @@ static void cyberjack_write_bulk_callback(struct urb *urb)
+ struct device *dev = &port->dev;
+ int status = urb->status;
+ unsigned long flags;
++ bool resubmitted = false;
+
+- set_bit(0, &port->write_urbs_free);
+ if (status) {
+ dev_dbg(dev, "%s - nonzero write bulk status received: %d\n",
+ __func__, status);
++ set_bit(0, &port->write_urbs_free);
+ return;
+ }
+
+@@ -394,6 +395,8 @@ static void cyberjack_write_bulk_callback(struct urb *urb)
+ goto exit;
+ }
+
++ resubmitted = true;
++
+ dev_dbg(dev, "%s - priv->wrsent=%d\n", __func__, priv->wrsent);
+ dev_dbg(dev, "%s - priv->wrfilled=%d\n", __func__, priv->wrfilled);
+
+@@ -410,6 +413,8 @@ static void cyberjack_write_bulk_callback(struct urb *urb)
+
+ exit:
+ spin_unlock_irqrestore(&priv->lock, flags);
++ if (!resubmitted)
++ set_bit(0, &port->write_urbs_free);
+ usb_serial_port_softint(port);
+ }
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index c773db129bf94..f28344f03141d 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -250,6 +250,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_EP06 0x0306
+ #define QUECTEL_PRODUCT_EM12 0x0512
+ #define QUECTEL_PRODUCT_RM500Q 0x0800
++#define QUECTEL_PRODUCT_EC200T 0x6026
+
+ #define CMOTECH_VENDOR_ID 0x16d8
+ #define CMOTECH_PRODUCT_6001 0x6001
+@@ -1117,6 +1118,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
+ .driver_info = ZLP },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
+
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+@@ -1189,6 +1191,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff), /* Telit FT980-KS */
+ .driver_info = NCTRL(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */
++ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+@@ -1201,6 +1205,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff), /* Telit LE910Cx (RNDIS) */
++ .driver_info = NCTRL(2) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+@@ -1215,6 +1221,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1230, 0xff), /* Telit LE910Cx (rmnet) */
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */
++ .driver_info = NCTRL(2) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 554727d82d432..4d1c12faada89 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -1459,6 +1459,21 @@ do { \
+
+ #define BTRFS_INODE_ROOT_ITEM_INIT (1 << 31)
+
++#define BTRFS_INODE_FLAG_MASK \
++ (BTRFS_INODE_NODATASUM | \
++ BTRFS_INODE_NODATACOW | \
++ BTRFS_INODE_READONLY | \
++ BTRFS_INODE_NOCOMPRESS | \
++ BTRFS_INODE_PREALLOC | \
++ BTRFS_INODE_SYNC | \
++ BTRFS_INODE_IMMUTABLE | \
++ BTRFS_INODE_APPEND | \
++ BTRFS_INODE_NODUMP | \
++ BTRFS_INODE_NOATIME | \
++ BTRFS_INODE_DIRSYNC | \
++ BTRFS_INODE_COMPRESS | \
++ BTRFS_INODE_ROOT_ITEM_INIT)
++
+ struct btrfs_map_token {
+ const struct extent_buffer *eb;
+ char *kaddr;
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 82d597b16152c..301111922a1a2 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -138,7 +138,61 @@ static int add_extent_changeset(struct extent_state *state, unsigned bits,
+ return ret;
+ }
+
+-static void flush_write_bio(struct extent_page_data *epd);
++static int __must_check submit_one_bio(struct bio *bio, int mirror_num,
++ unsigned long bio_flags)
++{
++ blk_status_t ret = 0;
++ struct bio_vec *bvec = bio_last_bvec_all(bio);
++ struct page *page = bvec->bv_page;
++ struct extent_io_tree *tree = bio->bi_private;
++ u64 start;
++
++ start = page_offset(page) + bvec->bv_offset;
++
++ bio->bi_private = NULL;
++
++ if (tree->ops)
++ ret = tree->ops->submit_bio_hook(tree->private_data, bio,
++ mirror_num, bio_flags, start);
++ else
++ btrfsic_submit_bio(bio);
++
++ return blk_status_to_errno(ret);
++}
++
++/* Cleanup unsubmitted bios */
++static void end_write_bio(struct extent_page_data *epd, int ret)
++{
++ if (epd->bio) {
++ epd->bio->bi_status = errno_to_blk_status(ret);
++ bio_endio(epd->bio);
++ epd->bio = NULL;
++ }
++}
++
++/*
++ * Submit bio from extent page data via submit_one_bio
++ *
++ * Return 0 if everything is OK.
++ * Return <0 for error.
++ */
++static int __must_check flush_write_bio(struct extent_page_data *epd)
++{
++ int ret = 0;
++
++ if (epd->bio) {
++ ret = submit_one_bio(epd->bio, 0, 0);
++ /*
++ * Clean up of epd->bio is handled by its endio function.
++ * And endio is either triggered by successful bio execution
++ * or the error handler of submit bio hook.
++ * So at this point, no matter what happened, we don't need
++ * to clean up epd->bio.
++ */
++ epd->bio = NULL;
++ }
++ return ret;
++}
+
+ int __init extent_io_init(void)
+ {
+@@ -2710,28 +2764,6 @@ struct bio *btrfs_bio_clone_partial(struct bio *orig, int offset, int size)
+ return bio;
+ }
+
+-static int __must_check submit_one_bio(struct bio *bio, int mirror_num,
+- unsigned long bio_flags)
+-{
+- blk_status_t ret = 0;
+- struct bio_vec *bvec = bio_last_bvec_all(bio);
+- struct page *page = bvec->bv_page;
+- struct extent_io_tree *tree = bio->bi_private;
+- u64 start;
+-
+- start = page_offset(page) + bvec->bv_offset;
+-
+- bio->bi_private = NULL;
+-
+- if (tree->ops)
+- ret = tree->ops->submit_bio_hook(tree->private_data, bio,
+- mirror_num, bio_flags, start);
+- else
+- btrfsic_submit_bio(bio);
+-
+- return blk_status_to_errno(ret);
+-}
+-
+ /*
+ * @opf: bio REQ_OP_* and REQ_* flags as one value
+ * @tree: tree so we can call our merge_bio hook
+@@ -3439,6 +3471,9 @@ done:
+ * records are inserted to lock ranges in the tree, and as dirty areas
+ * are found, they are marked writeback. Then the lock bits are removed
+ * and the end_io handler clears the writeback ranges
++ *
++ * Return 0 if everything goes well.
++ * Return <0 for error.
+ */
+ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
+ struct extent_page_data *epd)
+@@ -3506,6 +3541,7 @@ done:
+ end_extent_writepage(page, ret, start, page_end);
+ }
+ unlock_page(page);
++ ASSERT(ret <= 0);
+ return ret;
+
+ done_unlocked:
+@@ -3518,18 +3554,34 @@ void wait_on_extent_buffer_writeback(struct extent_buffer *eb)
+ TASK_UNINTERRUPTIBLE);
+ }
+
++static void end_extent_buffer_writeback(struct extent_buffer *eb)
++{
++ clear_bit(EXTENT_BUFFER_WRITEBACK, &eb->bflags);
++ smp_mb__after_atomic();
++ wake_up_bit(&eb->bflags, EXTENT_BUFFER_WRITEBACK);
++}
++
++/*
++ * Lock eb pages and flush the bio if we can't the locks
++ *
++ * Return 0 if nothing went wrong
++ * Return >0 is same as 0, except bio is not submitted
++ * Return <0 if something went wrong, no page is locked
++ */
+ static noinline_for_stack int
+ lock_extent_buffer_for_io(struct extent_buffer *eb,
+ struct btrfs_fs_info *fs_info,
+ struct extent_page_data *epd)
+ {
+- int i, num_pages;
++ int i, num_pages, failed_page_nr;
+ int flush = 0;
+ int ret = 0;
+
+ if (!btrfs_try_tree_write_lock(eb)) {
++ ret = flush_write_bio(epd);
++ if (ret < 0)
++ return ret;
+ flush = 1;
+- flush_write_bio(epd);
+ btrfs_tree_lock(eb);
+ }
+
+@@ -3538,7 +3590,9 @@ lock_extent_buffer_for_io(struct extent_buffer *eb,
+ if (!epd->sync_io)
+ return 0;
+ if (!flush) {
+- flush_write_bio(epd);
++ ret = flush_write_bio(epd);
++ if (ret < 0)
++ return ret;
+ flush = 1;
+ }
+ while (1) {
+@@ -3579,7 +3633,14 @@ lock_extent_buffer_for_io(struct extent_buffer *eb,
+
+ if (!trylock_page(p)) {
+ if (!flush) {
+- flush_write_bio(epd);
++ int err;
++
++ err = flush_write_bio(epd);
++ if (err < 0) {
++ ret = err;
++ failed_page_nr = i;
++ goto err_unlock;
++ }
+ flush = 1;
+ }
+ lock_page(p);
+@@ -3587,13 +3648,25 @@ lock_extent_buffer_for_io(struct extent_buffer *eb,
+ }
+
+ return ret;
+-}
+-
+-static void end_extent_buffer_writeback(struct extent_buffer *eb)
+-{
+- clear_bit(EXTENT_BUFFER_WRITEBACK, &eb->bflags);
+- smp_mb__after_atomic();
+- wake_up_bit(&eb->bflags, EXTENT_BUFFER_WRITEBACK);
++err_unlock:
++ /* Unlock already locked pages */
++ for (i = 0; i < failed_page_nr; i++)
++ unlock_page(eb->pages[i]);
++ /*
++ * Clear EXTENT_BUFFER_WRITEBACK and wake up anyone waiting on it.
++ * Also set back EXTENT_BUFFER_DIRTY so future attempts to this eb can
++ * be made and undo everything done before.
++ */
++ btrfs_tree_lock(eb);
++ spin_lock(&eb->refs_lock);
++ set_bit(EXTENT_BUFFER_DIRTY, &eb->bflags);
++ end_extent_buffer_writeback(eb);
++ spin_unlock(&eb->refs_lock);
++ percpu_counter_add_batch(&fs_info->dirty_metadata_bytes, eb->len,
++ fs_info->dirty_metadata_batch);
++ btrfs_clear_header_flag(eb, BTRFS_HEADER_FLAG_WRITTEN);
++ btrfs_tree_unlock(eb);
++ return ret;
+ }
+
+ static void set_btree_ioerr(struct page *page)
+@@ -3869,7 +3942,44 @@ retry:
+ index = 0;
+ goto retry;
+ }
+- flush_write_bio(&epd);
++ ASSERT(ret <= 0);
++ if (ret < 0) {
++ end_write_bio(&epd, ret);
++ return ret;
++ }
++ /*
++ * If something went wrong, don't allow any metadata write bio to be
++ * submitted.
++ *
++ * This would prevent use-after-free if we had dirty pages not
++ * cleaned up, which can still happen by fuzzed images.
++ *
++ * - Bad extent tree
++ * Allowing existing tree block to be allocated for other trees.
++ *
++ * - Log tree operations
++ * Exiting tree blocks get allocated to log tree, bumps its
++ * generation, then get cleaned in tree re-balance.
++ * Such tree block will not be written back, since it's clean,
++ * thus no WRITTEN flag set.
++ * And after log writes back, this tree block is not traced by
++ * any dirty extent_io_tree.
++ *
++ * - Offending tree block gets re-dirtied from its original owner
++ * Since it has bumped generation, no WRITTEN flag, it can be
++ * reused without COWing. This tree block will not be traced
++ * by btrfs_transaction::dirty_pages.
++ *
++ * Now such dirty tree block will not be cleaned by any dirty
++ * extent io tree. Thus we don't want to submit such wild eb
++ * if the fs already has error.
++ */
++ if (!test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) {
++ ret = flush_write_bio(&epd);
++ } else {
++ ret = -EUCLEAN;
++ end_write_bio(&epd, ret);
++ }
+ return ret;
+ }
+
+@@ -3966,7 +4076,8 @@ retry:
+ * tmpfs file mapping
+ */
+ if (!trylock_page(page)) {
+- flush_write_bio(epd);
++ ret = flush_write_bio(epd);
++ BUG_ON(ret < 0);
+ lock_page(page);
+ }
+
+@@ -3976,8 +4087,10 @@ retry:
+ }
+
+ if (wbc->sync_mode != WB_SYNC_NONE) {
+- if (PageWriteback(page))
+- flush_write_bio(epd);
++ if (PageWriteback(page)) {
++ ret = flush_write_bio(epd);
++ BUG_ON(ret < 0);
++ }
+ wait_on_page_writeback(page);
+ }
+
+@@ -4022,8 +4135,9 @@ retry:
+ * page in our current bio, and thus deadlock, so flush the
+ * write bio here.
+ */
+- flush_write_bio(epd);
+- goto retry;
++ ret = flush_write_bio(epd);
++ if (!ret)
++ goto retry;
+ }
+
+ if (wbc->range_cyclic || (wbc->nr_to_write > 0 && range_whole))
+@@ -4033,17 +4147,6 @@ retry:
+ return ret;
+ }
+
+-static void flush_write_bio(struct extent_page_data *epd)
+-{
+- if (epd->bio) {
+- int ret;
+-
+- ret = submit_one_bio(epd->bio, 0, 0);
+- BUG_ON(ret < 0); /* -ENOMEM */
+- epd->bio = NULL;
+- }
+-}
+-
+ int extent_write_full_page(struct page *page, struct writeback_control *wbc)
+ {
+ int ret;
+@@ -4055,8 +4158,14 @@ int extent_write_full_page(struct page *page, struct writeback_control *wbc)
+ };
+
+ ret = __extent_writepage(page, wbc, &epd);
++ ASSERT(ret <= 0);
++ if (ret < 0) {
++ end_write_bio(&epd, ret);
++ return ret;
++ }
+
+- flush_write_bio(&epd);
++ ret = flush_write_bio(&epd);
++ ASSERT(ret <= 0);
+ return ret;
+ }
+
+@@ -4064,6 +4173,7 @@ int extent_write_locked_range(struct inode *inode, u64 start, u64 end,
+ int mode)
+ {
+ int ret = 0;
++ int flush_ret;
+ struct address_space *mapping = inode->i_mapping;
+ struct extent_io_tree *tree = &BTRFS_I(inode)->io_tree;
+ struct page *page;
+@@ -4098,7 +4208,8 @@ int extent_write_locked_range(struct inode *inode, u64 start, u64 end,
+ start += PAGE_SIZE;
+ }
+
+- flush_write_bio(&epd);
++ flush_ret = flush_write_bio(&epd);
++ BUG_ON(flush_ret < 0);
+ return ret;
+ }
+
+@@ -4106,6 +4217,7 @@ int extent_writepages(struct address_space *mapping,
+ struct writeback_control *wbc)
+ {
+ int ret = 0;
++ int flush_ret;
+ struct extent_page_data epd = {
+ .bio = NULL,
+ .tree = &BTRFS_I(mapping->host)->io_tree,
+@@ -4114,7 +4226,8 @@ int extent_writepages(struct address_space *mapping,
+ };
+
+ ret = extent_write_cache_pages(mapping, wbc, &epd);
+- flush_write_bio(&epd);
++ flush_ret = flush_write_bio(&epd);
++ BUG_ON(flush_ret < 0);
+ return ret;
+ }
+
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index d98ec885b72a1..9023e6b46396a 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -448,6 +448,320 @@ static int check_block_group_item(struct btrfs_fs_info *fs_info,
+ return 0;
+ }
+
++__printf(5, 6)
++__cold
++static void chunk_err(const struct btrfs_fs_info *fs_info,
++ const struct extent_buffer *leaf,
++ const struct btrfs_chunk *chunk, u64 logical,
++ const char *fmt, ...)
++{
++ bool is_sb;
++ struct va_format vaf;
++ va_list args;
++ int i;
++ int slot = -1;
++
++ /* Only superblock eb is able to have such small offset */
++ is_sb = (leaf->start == BTRFS_SUPER_INFO_OFFSET);
++
++ if (!is_sb) {
++ /*
++ * Get the slot number by iterating through all slots, this
++ * would provide better readability.
++ */
++ for (i = 0; i < btrfs_header_nritems(leaf); i++) {
++ if (btrfs_item_ptr_offset(leaf, i) ==
++ (unsigned long)chunk) {
++ slot = i;
++ break;
++ }
++ }
++ }
++ va_start(args, fmt);
++ vaf.fmt = fmt;
++ vaf.va = &args;
++
++ if (is_sb)
++ btrfs_crit(fs_info,
++ "corrupt superblock syschunk array: chunk_start=%llu, %pV",
++ logical, &vaf);
++ else
++ btrfs_crit(fs_info,
++ "corrupt leaf: root=%llu block=%llu slot=%d chunk_start=%llu, %pV",
++ BTRFS_CHUNK_TREE_OBJECTID, leaf->start, slot,
++ logical, &vaf);
++ va_end(args);
++}
++
++/*
++ * The common chunk check which could also work on super block sys chunk array.
++ *
++ * Return -EUCLEAN if anything is corrupted.
++ * Return 0 if everything is OK.
++ */
++int btrfs_check_chunk_valid(struct btrfs_fs_info *fs_info,
++ struct extent_buffer *leaf,
++ struct btrfs_chunk *chunk, u64 logical)
++{
++ u64 length;
++ u64 stripe_len;
++ u16 num_stripes;
++ u16 sub_stripes;
++ u64 type;
++ u64 features;
++ bool mixed = false;
++
++ length = btrfs_chunk_length(leaf, chunk);
++ stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
++ num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
++ sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk);
++ type = btrfs_chunk_type(leaf, chunk);
++
++ if (!num_stripes) {
++ chunk_err(fs_info, leaf, chunk, logical,
++ "invalid chunk num_stripes, have %u", num_stripes);
++ return -EUCLEAN;
++ }
++ if (!IS_ALIGNED(logical, fs_info->sectorsize)) {
++ chunk_err(fs_info, leaf, chunk, logical,
++ "invalid chunk logical, have %llu should aligned to %u",
++ logical, fs_info->sectorsize);
++ return -EUCLEAN;
++ }
++ if (btrfs_chunk_sector_size(leaf, chunk) != fs_info->sectorsize) {
++ chunk_err(fs_info, leaf, chunk, logical,
++ "invalid chunk sectorsize, have %u expect %u",
++ btrfs_chunk_sector_size(leaf, chunk),
++ fs_info->sectorsize);
++ return -EUCLEAN;
++ }
++ if (!length || !IS_ALIGNED(length, fs_info->sectorsize)) {
++ chunk_err(fs_info, leaf, chunk, logical,
++ "invalid chunk length, have %llu", length);
++ return -EUCLEAN;
++ }
++ if (!is_power_of_2(stripe_len) || stripe_len != BTRFS_STRIPE_LEN) {
++ chunk_err(fs_info, leaf, chunk, logical,
++ "invalid chunk stripe length: %llu",
++ stripe_len);
++ return -EUCLEAN;
++ }
++ if (~(BTRFS_BLOCK_GROUP_TYPE_MASK | BTRFS_BLOCK_GROUP_PROFILE_MASK) &
++ type) {
++ chunk_err(fs_info, leaf, chunk, logical,
++ "unrecognized chunk type: 0x%llx",
++ ~(BTRFS_BLOCK_GROUP_TYPE_MASK |
++ BTRFS_BLOCK_GROUP_PROFILE_MASK) &
++ btrfs_chunk_type(leaf, chunk));
++ return -EUCLEAN;
++ }
++
++ if (!is_power_of_2(type & BTRFS_BLOCK_GROUP_PROFILE_MASK) &&
++ (type & BTRFS_BLOCK_GROUP_PROFILE_MASK) != 0) {
++ chunk_err(fs_info, leaf, chunk, logical,
++ "invalid chunk profile flag: 0x%llx, expect 0 or 1 bit set",
++ type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
++ return -EUCLEAN;
++ }
++ if ((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0) {
++ chunk_err(fs_info, leaf, chunk, logical,
++ "missing chunk type flag, have 0x%llx one bit must be set in 0x%llx",
++ type, BTRFS_BLOCK_GROUP_TYPE_MASK);
++ return -EUCLEAN;
++ }
++
++ if ((type & BTRFS_BLOCK_GROUP_SYSTEM) &&
++ (type & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA))) {
++ chunk_err(fs_info, leaf, chunk, logical,
++ "system chunk with data or metadata type: 0x%llx",
++ type);
++ return -EUCLEAN;
++ }
++
++ features = btrfs_super_incompat_flags(fs_info->super_copy);
++ if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS)
++ mixed = true;
++
++ if (!mixed) {
++ if ((type & BTRFS_BLOCK_GROUP_METADATA) &&
++ (type & BTRFS_BLOCK_GROUP_DATA)) {
++ chunk_err(fs_info, leaf, chunk, logical,
++ "mixed chunk type in non-mixed mode: 0x%llx", type);
++ return -EUCLEAN;
++ }
++ }
++
++ if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) ||
++ (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes != 2) ||
++ (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) ||
++ (type & BTRFS_BLOCK_GROUP_RAID6 && num_stripes < 3) ||
++ (type & BTRFS_BLOCK_GROUP_DUP && num_stripes != 2) ||
++ ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 && num_stripes != 1)) {
++ chunk_err(fs_info, leaf, chunk, logical,
++ "invalid num_stripes:sub_stripes %u:%u for profile %llu",
++ num_stripes, sub_stripes,
++ type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
++ return -EUCLEAN;
++ }
++
++ return 0;
++}
++
++__printf(4, 5)
++__cold
++static void dev_item_err(const struct btrfs_fs_info *fs_info,
++ const struct extent_buffer *eb, int slot,
++ const char *fmt, ...)
++{
++ struct btrfs_key key;
++ struct va_format vaf;
++ va_list args;
++
++ btrfs_item_key_to_cpu(eb, &key, slot);
++ va_start(args, fmt);
++
++ vaf.fmt = fmt;
++ vaf.va = &args;
++
++ btrfs_crit(fs_info,
++ "corrupt %s: root=%llu block=%llu slot=%d devid=%llu %pV",
++ btrfs_header_level(eb) == 0 ? "leaf" : "node",
++ btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot,
++ key.objectid, &vaf);
++ va_end(args);
++}
++
++static int check_dev_item(struct btrfs_fs_info *fs_info,
++ struct extent_buffer *leaf,
++ struct btrfs_key *key, int slot)
++{
++ struct btrfs_dev_item *ditem;
++
++ if (key->objectid != BTRFS_DEV_ITEMS_OBJECTID) {
++ dev_item_err(fs_info, leaf, slot,
++ "invalid objectid: has=%llu expect=%llu",
++ key->objectid, BTRFS_DEV_ITEMS_OBJECTID);
++ return -EUCLEAN;
++ }
++ ditem = btrfs_item_ptr(leaf, slot, struct btrfs_dev_item);
++ if (btrfs_device_id(leaf, ditem) != key->offset) {
++ dev_item_err(fs_info, leaf, slot,
++ "devid mismatch: key has=%llu item has=%llu",
++ key->offset, btrfs_device_id(leaf, ditem));
++ return -EUCLEAN;
++ }
++
++ /*
++ * For device total_bytes, we don't have reliable way to check it, as
++ * it can be 0 for device removal. Device size check can only be done
++ * by dev extents check.
++ */
++ if (btrfs_device_bytes_used(leaf, ditem) >
++ btrfs_device_total_bytes(leaf, ditem)) {
++ dev_item_err(fs_info, leaf, slot,
++ "invalid bytes used: have %llu expect [0, %llu]",
++ btrfs_device_bytes_used(leaf, ditem),
++ btrfs_device_total_bytes(leaf, ditem));
++ return -EUCLEAN;
++ }
++ /*
++ * Remaining members like io_align/type/gen/dev_group aren't really
++ * utilized. Skip them to make later usage of them easier.
++ */
++ return 0;
++}
++
++/* Inode item error output has the same format as dir_item_err() */
++#define inode_item_err(fs_info, eb, slot, fmt, ...) \
++ dir_item_err(fs_info, eb, slot, fmt, __VA_ARGS__)
++
++static int check_inode_item(struct btrfs_fs_info *fs_info,
++ struct extent_buffer *leaf,
++ struct btrfs_key *key, int slot)
++{
++ struct btrfs_inode_item *iitem;
++ u64 super_gen = btrfs_super_generation(fs_info->super_copy);
++ u32 valid_mask = (S_IFMT | S_ISUID | S_ISGID | S_ISVTX | 0777);
++ u32 mode;
++
++ if ((key->objectid < BTRFS_FIRST_FREE_OBJECTID ||
++ key->objectid > BTRFS_LAST_FREE_OBJECTID) &&
++ key->objectid != BTRFS_ROOT_TREE_DIR_OBJECTID &&
++ key->objectid != BTRFS_FREE_INO_OBJECTID) {
++ generic_err(fs_info, leaf, slot,
++ "invalid key objectid: has %llu expect %llu or [%llu, %llu] or %llu",
++ key->objectid, BTRFS_ROOT_TREE_DIR_OBJECTID,
++ BTRFS_FIRST_FREE_OBJECTID,
++ BTRFS_LAST_FREE_OBJECTID,
++ BTRFS_FREE_INO_OBJECTID);
++ return -EUCLEAN;
++ }
++ if (key->offset != 0) {
++ inode_item_err(fs_info, leaf, slot,
++ "invalid key offset: has %llu expect 0",
++ key->offset);
++ return -EUCLEAN;
++ }
++ iitem = btrfs_item_ptr(leaf, slot, struct btrfs_inode_item);
++
++ /* Here we use super block generation + 1 to handle log tree */
++ if (btrfs_inode_generation(leaf, iitem) > super_gen + 1) {
++ inode_item_err(fs_info, leaf, slot,
++ "invalid inode generation: has %llu expect (0, %llu]",
++ btrfs_inode_generation(leaf, iitem),
++ super_gen + 1);
++ return -EUCLEAN;
++ }
++ /* Note for ROOT_TREE_DIR_ITEM, mkfs could set its transid 0 */
++ if (btrfs_inode_transid(leaf, iitem) > super_gen + 1) {
++ inode_item_err(fs_info, leaf, slot,
++ "invalid inode transid: has %llu expect [0, %llu]",
++ btrfs_inode_transid(leaf, iitem), super_gen + 1);
++ return -EUCLEAN;
++ }
++
++ /*
++ * For size and nbytes it's better not to be too strict, as for dir
++ * item its size/nbytes can easily get wrong, but doesn't affect
++ * anything in the fs. So here we skip the check.
++ */
++ mode = btrfs_inode_mode(leaf, iitem);
++ if (mode & ~valid_mask) {
++ inode_item_err(fs_info, leaf, slot,
++ "unknown mode bit detected: 0x%x",
++ mode & ~valid_mask);
++ return -EUCLEAN;
++ }
++
++ /*
++ * S_IFMT is not bit mapped so we can't completely rely on is_power_of_2,
++ * but is_power_of_2() can save us from checking FIFO/CHR/DIR/REG.
++ * Only needs to check BLK, LNK and SOCKS
++ */
++ if (!is_power_of_2(mode & S_IFMT)) {
++ if (!S_ISLNK(mode) && !S_ISBLK(mode) && !S_ISSOCK(mode)) {
++ inode_item_err(fs_info, leaf, slot,
++ "invalid mode: has 0%o expect valid S_IF* bit(s)",
++ mode & S_IFMT);
++ return -EUCLEAN;
++ }
++ }
++ if (S_ISDIR(mode) && btrfs_inode_nlink(leaf, iitem) > 1) {
++ inode_item_err(fs_info, leaf, slot,
++ "invalid nlink: has %u expect no more than 1 for dir",
++ btrfs_inode_nlink(leaf, iitem));
++ return -EUCLEAN;
++ }
++ if (btrfs_inode_flags(leaf, iitem) & ~BTRFS_INODE_FLAG_MASK) {
++ inode_item_err(fs_info, leaf, slot,
++ "unknown flags detected: 0x%llx",
++ btrfs_inode_flags(leaf, iitem) &
++ ~BTRFS_INODE_FLAG_MASK);
++ return -EUCLEAN;
++ }
++ return 0;
++}
++
+ /*
+ * Common point to switch the item-specific validation.
+ */
+@@ -456,6 +770,7 @@ static int check_leaf_item(struct btrfs_fs_info *fs_info,
+ struct btrfs_key *key, int slot)
+ {
+ int ret = 0;
++ struct btrfs_chunk *chunk;
+
+ switch (key->type) {
+ case BTRFS_EXTENT_DATA_KEY:
+@@ -472,6 +787,17 @@ static int check_leaf_item(struct btrfs_fs_info *fs_info,
+ case BTRFS_BLOCK_GROUP_ITEM_KEY:
+ ret = check_block_group_item(fs_info, leaf, key, slot);
+ break;
++ case BTRFS_CHUNK_ITEM_KEY:
++ chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk);
++ ret = btrfs_check_chunk_valid(fs_info, leaf, chunk,
++ key->offset);
++ break;
++ case BTRFS_DEV_ITEM_KEY:
++ ret = check_dev_item(fs_info, leaf, key, slot);
++ break;
++ case BTRFS_INODE_ITEM_KEY:
++ ret = check_inode_item(fs_info, leaf, key, slot);
++ break;
+ }
+ return ret;
+ }
+diff --git a/fs/btrfs/tree-checker.h b/fs/btrfs/tree-checker.h
+index ff043275b7844..4df45e8a66595 100644
+--- a/fs/btrfs/tree-checker.h
++++ b/fs/btrfs/tree-checker.h
+@@ -25,4 +25,8 @@ int btrfs_check_leaf_relaxed(struct btrfs_fs_info *fs_info,
+ struct extent_buffer *leaf);
+ int btrfs_check_node(struct btrfs_fs_info *fs_info, struct extent_buffer *node);
+
++int btrfs_check_chunk_valid(struct btrfs_fs_info *fs_info,
++ struct extent_buffer *leaf,
++ struct btrfs_chunk *chunk, u64 logical);
++
+ #endif
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 0879e3dc39c8c..05daa2b816c31 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -28,6 +28,7 @@
+ #include "math.h"
+ #include "dev-replace.h"
+ #include "sysfs.h"
++#include "tree-checker.h"
+
+ const struct btrfs_raid_attr btrfs_raid_array[BTRFS_NR_RAID_TYPES] = {
+ [BTRFS_RAID_RAID10] = {
+@@ -4605,15 +4606,6 @@ static void check_raid56_incompat_flag(struct btrfs_fs_info *info, u64 type)
+ btrfs_set_fs_incompat(info, RAID56);
+ }
+
+-#define BTRFS_MAX_DEVS(info) ((BTRFS_MAX_ITEM_SIZE(info) \
+- - sizeof(struct btrfs_chunk)) \
+- / sizeof(struct btrfs_stripe) + 1)
+-
+-#define BTRFS_MAX_DEVS_SYS_CHUNK ((BTRFS_SYSTEM_CHUNK_ARRAY_SIZE \
+- - 2 * sizeof(struct btrfs_disk_key) \
+- - 2 * sizeof(struct btrfs_chunk)) \
+- / sizeof(struct btrfs_stripe) + 1)
+-
+ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
+ u64 start, u64 type)
+ {
+@@ -6370,99 +6362,6 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info,
+ return dev;
+ }
+
+-/* Return -EIO if any error, otherwise return 0. */
+-static int btrfs_check_chunk_valid(struct btrfs_fs_info *fs_info,
+- struct extent_buffer *leaf,
+- struct btrfs_chunk *chunk, u64 logical)
+-{
+- u64 length;
+- u64 stripe_len;
+- u16 num_stripes;
+- u16 sub_stripes;
+- u64 type;
+- u64 features;
+- bool mixed = false;
+-
+- length = btrfs_chunk_length(leaf, chunk);
+- stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
+- num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
+- sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk);
+- type = btrfs_chunk_type(leaf, chunk);
+-
+- if (!num_stripes) {
+- btrfs_err(fs_info, "invalid chunk num_stripes: %u",
+- num_stripes);
+- return -EIO;
+- }
+- if (!IS_ALIGNED(logical, fs_info->sectorsize)) {
+- btrfs_err(fs_info, "invalid chunk logical %llu", logical);
+- return -EIO;
+- }
+- if (btrfs_chunk_sector_size(leaf, chunk) != fs_info->sectorsize) {
+- btrfs_err(fs_info, "invalid chunk sectorsize %u",
+- btrfs_chunk_sector_size(leaf, chunk));
+- return -EIO;
+- }
+- if (!length || !IS_ALIGNED(length, fs_info->sectorsize)) {
+- btrfs_err(fs_info, "invalid chunk length %llu", length);
+- return -EIO;
+- }
+- if (!is_power_of_2(stripe_len) || stripe_len != BTRFS_STRIPE_LEN) {
+- btrfs_err(fs_info, "invalid chunk stripe length: %llu",
+- stripe_len);
+- return -EIO;
+- }
+- if (~(BTRFS_BLOCK_GROUP_TYPE_MASK | BTRFS_BLOCK_GROUP_PROFILE_MASK) &
+- type) {
+- btrfs_err(fs_info, "unrecognized chunk type: %llu",
+- ~(BTRFS_BLOCK_GROUP_TYPE_MASK |
+- BTRFS_BLOCK_GROUP_PROFILE_MASK) &
+- btrfs_chunk_type(leaf, chunk));
+- return -EIO;
+- }
+-
+- if ((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0) {
+- btrfs_err(fs_info, "missing chunk type flag: 0x%llx", type);
+- return -EIO;
+- }
+-
+- if ((type & BTRFS_BLOCK_GROUP_SYSTEM) &&
+- (type & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA))) {
+- btrfs_err(fs_info,
+- "system chunk with data or metadata type: 0x%llx", type);
+- return -EIO;
+- }
+-
+- features = btrfs_super_incompat_flags(fs_info->super_copy);
+- if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS)
+- mixed = true;
+-
+- if (!mixed) {
+- if ((type & BTRFS_BLOCK_GROUP_METADATA) &&
+- (type & BTRFS_BLOCK_GROUP_DATA)) {
+- btrfs_err(fs_info,
+- "mixed chunk type in non-mixed mode: 0x%llx", type);
+- return -EIO;
+- }
+- }
+-
+- if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) ||
+- (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes != 2) ||
+- (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) ||
+- (type & BTRFS_BLOCK_GROUP_RAID6 && num_stripes < 3) ||
+- (type & BTRFS_BLOCK_GROUP_DUP && num_stripes != 2) ||
+- ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 &&
+- num_stripes != 1)) {
+- btrfs_err(fs_info,
+- "invalid num_stripes:sub_stripes %u:%u for profile %llu",
+- num_stripes, sub_stripes,
+- type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
+- return -EIO;
+- }
+-
+- return 0;
+-}
+-
+ static void btrfs_report_missing_device(struct btrfs_fs_info *fs_info,
+ u64 devid, u8 *uuid, bool error)
+ {
+@@ -6493,9 +6392,15 @@ static int read_one_chunk(struct btrfs_fs_info *fs_info, struct btrfs_key *key,
+ length = btrfs_chunk_length(leaf, chunk);
+ num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
+
+- ret = btrfs_check_chunk_valid(fs_info, leaf, chunk, logical);
+- if (ret)
+- return ret;
++ /*
++ * Only need to verify chunk item if we're reading from sys chunk array,
++ * as chunk item in tree block is already verified by tree-checker.
++ */
++ if (leaf->start == BTRFS_SUPER_INFO_OFFSET) {
++ ret = btrfs_check_chunk_valid(fs_info, leaf, chunk, logical);
++ if (ret)
++ return ret;
++ }
+
+ read_lock(&map_tree->map_tree.lock);
+ em = lookup_extent_mapping(&map_tree->map_tree, logical, 1);
+diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
+index 8e8bf3246de18..65cd023b097c1 100644
+--- a/fs/btrfs/volumes.h
++++ b/fs/btrfs/volumes.h
+@@ -257,6 +257,15 @@ struct btrfs_fs_devices {
+
+ #define BTRFS_BIO_INLINE_CSUM_SIZE 64
+
++#define BTRFS_MAX_DEVS(info) ((BTRFS_MAX_ITEM_SIZE(info) \
++ - sizeof(struct btrfs_chunk)) \
++ / sizeof(struct btrfs_stripe) + 1)
++
++#define BTRFS_MAX_DEVS_SYS_CHUNK ((BTRFS_SYSTEM_CHUNK_ARRAY_SIZE \
++ - 2 * sizeof(struct btrfs_disk_key) \
++ - 2 * sizeof(struct btrfs_chunk)) \
++ / sizeof(struct btrfs_stripe) + 1)
++
+ /*
+ * we need the mirror number and stripe index to be passed around
+ * the call chain while we are processing end_io (especially errors).
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index ccdd8c821abd7..c20d71d86812a 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -870,7 +870,8 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
+ out_free:
+ kfree(gl->gl_lksb.sb_lvbptr);
+ kmem_cache_free(cachep, gl);
+- atomic_dec(&sdp->sd_glock_disposal);
++ if (atomic_dec_and_test(&sdp->sd_glock_disposal))
++ wake_up(&sdp->sd_glock_wait);
+
+ out:
+ return ret;
+diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
+index 15fd0277ffa69..5901b00059294 100644
+--- a/include/asm-generic/pgtable.h
++++ b/include/asm-generic/pgtable.h
+@@ -1115,10 +1115,6 @@ static inline bool arch_has_pfn_modify_check(void)
+
+ #endif /* !__ASSEMBLY__ */
+
+-#ifndef io_remap_pfn_range
+-#define io_remap_pfn_range remap_pfn_range
+-#endif
+-
+ #ifndef has_transparent_hugepage
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ #define has_transparent_hugepage() 1
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 83828c118b6b7..f6ecf41aea83d 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -2561,6 +2561,15 @@ static inline vm_fault_t vmf_insert_pfn(struct vm_area_struct *vma,
+ return VM_FAULT_NOPAGE;
+ }
+
++#ifndef io_remap_pfn_range
++static inline int io_remap_pfn_range(struct vm_area_struct *vma,
++ unsigned long addr, unsigned long pfn,
++ unsigned long size, pgprot_t prot)
++{
++ return remap_pfn_range(vma, addr, pfn, size, pgprot_decrypted(prot));
++}
++#endif
++
+ static inline vm_fault_t vmf_error(int err)
+ {
+ if (err == -ENOMEM)
+diff --git a/include/net/dsa.h b/include/net/dsa.h
+index 461e8a7661b78..d28df7adf948a 100644
+--- a/include/net/dsa.h
++++ b/include/net/dsa.h
+@@ -196,6 +196,7 @@ struct dsa_port {
+ unsigned int index;
+ const char *name;
+ const struct dsa_port *cpu_dp;
++ const char *mac;
+ struct device_node *dn;
+ unsigned int ageing_time;
+ u8 stp_state;
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index a35d742b0ba82..8b94eb6437c18 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -9047,6 +9047,7 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
+ if (token == IF_SRC_FILE || token == IF_SRC_FILEADDR) {
+ int fpos = token == IF_SRC_FILE ? 2 : 1;
+
++ kfree(filename);
+ filename = match_strdup(&args[fpos]);
+ if (!filename) {
+ ret = -ENOMEM;
+@@ -9093,16 +9094,13 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
+ */
+ ret = -EOPNOTSUPP;
+ if (!event->ctx->task)
+- goto fail_free_name;
++ goto fail;
+
+ /* look up the path and grab its inode */
+ ret = kern_path(filename, LOOKUP_FOLLOW,
+ &filter->path);
+ if (ret)
+- goto fail_free_name;
+-
+- kfree(filename);
+- filename = NULL;
++ goto fail;
+
+ ret = -EINVAL;
+ if (!filter->path.dentry ||
+@@ -9122,13 +9120,13 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
+ if (state != IF_STATE_ACTION)
+ goto fail;
+
++ kfree(filename);
+ kfree(orig);
+
+ return 0;
+
+-fail_free_name:
+- kfree(filename);
+ fail:
++ kfree(filename);
+ free_filters_list(filters);
+ kfree(orig);
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 3ed29bf8eb291..f2c92c1001949 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1965,14 +1965,9 @@ static __latent_entropy struct task_struct *copy_process(
+ /* ok, now we should be set up.. */
+ p->pid = pid_nr(pid);
+ if (clone_flags & CLONE_THREAD) {
+- p->exit_signal = -1;
+ p->group_leader = current->group_leader;
+ p->tgid = current->tgid;
+ } else {
+- if (clone_flags & CLONE_PARENT)
+- p->exit_signal = current->group_leader->exit_signal;
+- else
+- p->exit_signal = (clone_flags & CSIGNAL);
+ p->group_leader = p;
+ p->tgid = p->pid;
+ }
+@@ -2017,9 +2012,14 @@ static __latent_entropy struct task_struct *copy_process(
+ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
+ p->real_parent = current->real_parent;
+ p->parent_exec_id = current->parent_exec_id;
++ if (clone_flags & CLONE_THREAD)
++ p->exit_signal = -1;
++ else
++ p->exit_signal = current->group_leader->exit_signal;
+ } else {
+ p->real_parent = current;
+ p->parent_exec_id = current->self_exec_id;
++ p->exit_signal = (clone_flags & CSIGNAL);
+ }
+
+ klp_copy_process(p);
+diff --git a/kernel/futex.c b/kernel/futex.c
+index eabb9180ffa89..52f641c00a65b 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2417,10 +2417,22 @@ retry:
+ }
+
+ /*
+- * Since we just failed the trylock; there must be an owner.
++ * The trylock just failed, so either there is an owner or
++ * there is a higher priority waiter than this one.
+ */
+ newowner = rt_mutex_owner(&pi_state->pi_mutex);
+- BUG_ON(!newowner);
++ /*
++ * If the higher priority waiter has not yet taken over the
++ * rtmutex then newowner is NULL. We can't return here with
++ * that state because it's inconsistent vs. the user space
++ * state. So drop the locks and try again. It's a valid
++ * situation and not any different from the other retry
++ * conditions.
++ */
++ if (unlikely(!newowner)) {
++ err = -EAGAIN;
++ goto handle_err;
++ }
+ } else {
+ WARN_ON_ONCE(argowner != current);
+ if (oldowner == current) {
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index b786eda90bb56..2eed853ab9cc5 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -863,7 +863,8 @@ void kthread_delayed_work_timer_fn(struct timer_list *t)
+ /* Move the work from worker->delayed_work_list. */
+ WARN_ON_ONCE(list_empty(&work->node));
+ list_del_init(&work->node);
+- kthread_insert_work(worker, work, &worker->work_list);
++ if (!work->canceling)
++ kthread_insert_work(worker, work, &worker->work_list);
+
+ spin_unlock(&worker->lock);
+ }
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 6a56921181393..a02a25acf2056 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -385,16 +385,17 @@ static bool task_participate_group_stop(struct task_struct *task)
+
+ void task_join_group_stop(struct task_struct *task)
+ {
++ unsigned long mask = current->jobctl & JOBCTL_STOP_SIGMASK;
++ struct signal_struct *sig = current->signal;
++
++ if (sig->group_stop_count) {
++ sig->group_stop_count++;
++ mask |= JOBCTL_STOP_CONSUME;
++ } else if (!(sig->flags & SIGNAL_STOP_STOPPED))
++ return;
++
+ /* Have the new thread join an on-going signal group stop */
+- unsigned long jobctl = current->jobctl;
+- if (jobctl & JOBCTL_STOP_PENDING) {
+- struct signal_struct *sig = current->signal;
+- unsigned long signr = jobctl & JOBCTL_STOP_SIGMASK;
+- unsigned long gstop = JOBCTL_STOP_PENDING | JOBCTL_STOP_CONSUME;
+- if (task_set_jobctl_pending(task, signr | gstop)) {
+- sig->group_stop_count++;
+- }
+- }
++ task_set_jobctl_pending(task, mask | JOBCTL_STOP_PENDING);
+ }
+
+ /*
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 1442f6152abc2..645048bb1e869 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -521,10 +521,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ if (!bt->msg_data)
+ goto err;
+
+- ret = -ENOENT;
+-
+- dir = debugfs_lookup(buts->name, blk_debugfs_root);
+- if (!dir)
++#ifdef CONFIG_BLK_DEBUG_FS
++ /*
++ * When tracing whole make_request drivers (multiqueue) block devices,
++ * reuse the existing debugfs directory created by the block layer on
++ * init. For request-based block devices, all partitions block devices,
++ * and scsi-generic block devices we create a temporary new debugfs
++ * directory that will be removed once the trace ends.
++ */
++ if (q->mq_ops && bdev && bdev == bdev->bd_contains)
++ dir = q->debugfs_dir;
++ else
++#endif
+ bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root);
+ if (!dir)
+ goto err;
+@@ -583,8 +591,6 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+
+ ret = 0;
+ err:
+- if (dir && !bt->dir)
+- dput(dir);
+ if (ret)
+ blk_trace_free(bt);
+ return ret;
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index eef05eb3b2841..87ce9736043da 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -444,14 +444,16 @@ struct rb_event_info {
+
+ /*
+ * Used for which event context the event is in.
+- * NMI = 0
+- * IRQ = 1
+- * SOFTIRQ = 2
+- * NORMAL = 3
++ * TRANSITION = 0
++ * NMI = 1
++ * IRQ = 2
++ * SOFTIRQ = 3
++ * NORMAL = 4
+ *
+ * See trace_recursive_lock() comment below for more details.
+ */
+ enum {
++ RB_CTX_TRANSITION,
+ RB_CTX_NMI,
+ RB_CTX_IRQ,
+ RB_CTX_SOFTIRQ,
+@@ -2620,10 +2622,10 @@ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
+ * a bit of overhead in something as critical as function tracing,
+ * we use a bitmask trick.
+ *
+- * bit 0 = NMI context
+- * bit 1 = IRQ context
+- * bit 2 = SoftIRQ context
+- * bit 3 = normal context.
++ * bit 1 = NMI context
++ * bit 2 = IRQ context
++ * bit 3 = SoftIRQ context
++ * bit 4 = normal context.
+ *
+ * This works because this is the order of contexts that can
+ * preempt other contexts. A SoftIRQ never preempts an IRQ
+@@ -2646,6 +2648,30 @@ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
+ * The least significant bit can be cleared this way, and it
+ * just so happens that it is the same bit corresponding to
+ * the current context.
++ *
++ * Now the TRANSITION bit breaks the above slightly. The TRANSITION bit
++ * is set when a recursion is detected at the current context, and if
++ * the TRANSITION bit is already set, it will fail the recursion.
++ * This is needed because there's a lag between the changing of
++ * interrupt context and updating the preempt count. In this case,
++ * a false positive will be found. To handle this, one extra recursion
++ * is allowed, and this is done by the TRANSITION bit. If the TRANSITION
++ * bit is already set, then it is considered a recursion and the function
++ * ends. Otherwise, the TRANSITION bit is set, and that bit is returned.
++ *
++ * On the trace_recursive_unlock(), the TRANSITION bit will be the first
++ * to be cleared. Even if it wasn't the context that set it. That is,
++ * if an interrupt comes in while NORMAL bit is set and the ring buffer
++ * is called before preempt_count() is updated, since the check will
++ * be on the NORMAL bit, the TRANSITION bit will then be set. If an
++ * NMI then comes in, it will set the NMI bit, but when the NMI code
++ * does the trace_recursive_unlock() it will clear the TRANSTION bit
++ * and leave the NMI bit set. But this is fine, because the interrupt
++ * code that set the TRANSITION bit will then clear the NMI bit when it
++ * calls trace_recursive_unlock(). If another NMI comes in, it will
++ * set the TRANSITION bit and continue.
++ *
++ * Note: The TRANSITION bit only handles a single transition between context.
+ */
+
+ static __always_inline int
+@@ -2661,8 +2687,16 @@ trace_recursive_lock(struct ring_buffer_per_cpu *cpu_buffer)
+ bit = pc & NMI_MASK ? RB_CTX_NMI :
+ pc & HARDIRQ_MASK ? RB_CTX_IRQ : RB_CTX_SOFTIRQ;
+
+- if (unlikely(val & (1 << (bit + cpu_buffer->nest))))
+- return 1;
++ if (unlikely(val & (1 << (bit + cpu_buffer->nest)))) {
++ /*
++ * It is possible that this was called by transitioning
++ * between interrupt context, and preempt_count() has not
++ * been updated yet. In this case, use the TRANSITION bit.
++ */
++ bit = RB_CTX_TRANSITION;
++ if (val & (1 << (bit + cpu_buffer->nest)))
++ return 1;
++ }
+
+ val |= (1 << (bit + cpu_buffer->nest));
+ cpu_buffer->current_context = val;
+@@ -2677,8 +2711,8 @@ trace_recursive_unlock(struct ring_buffer_per_cpu *cpu_buffer)
+ cpu_buffer->current_context - (1 << cpu_buffer->nest);
+ }
+
+-/* The recursive locking above uses 4 bits */
+-#define NESTED_BITS 4
++/* The recursive locking above uses 5 bits */
++#define NESTED_BITS 5
+
+ /**
+ * ring_buffer_nest_start - Allow to trace while nested
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 6bf617ff03694..c3cc6aaa6f79d 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2819,7 +2819,7 @@ static char *get_trace_buf(void)
+
+ /* Interrupts must see nesting incremented before we use the buffer */
+ barrier();
+- return &buffer->buffer[buffer->nesting][0];
++ return &buffer->buffer[buffer->nesting - 1][0];
+ }
+
+ static void put_trace_buf(void)
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index ee0c6a313ed1a..01475411fd1b2 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -534,6 +534,12 @@ enum {
+
+ TRACE_GRAPH_DEPTH_START_BIT,
+ TRACE_GRAPH_DEPTH_END_BIT,
++
++ /*
++ * When transitioning between context, the preempt_count() may
++ * not be correct. Allow for a single recursion to cover this case.
++ */
++ TRACE_TRANSITION_BIT,
+ };
+
+ #define trace_recursion_set(bit) do { (current)->trace_recursion |= (1<<(bit)); } while (0)
+@@ -588,14 +594,27 @@ static __always_inline int trace_test_and_set_recursion(int start, int max)
+ return 0;
+
+ bit = trace_get_context_bit() + start;
+- if (unlikely(val & (1 << bit)))
+- return -1;
++ if (unlikely(val & (1 << bit))) {
++ /*
++ * It could be that preempt_count has not been updated during
++ * a switch between contexts. Allow for a single recursion.
++ */
++ bit = TRACE_TRANSITION_BIT;
++ if (trace_recursion_test(bit))
++ return -1;
++ trace_recursion_set(bit);
++ barrier();
++ return bit + 1;
++ }
++
++ /* Normal check passed, clear the transition to allow it again */
++ trace_recursion_clear(TRACE_TRANSITION_BIT);
+
+ val |= 1 << bit;
+ current->trace_recursion = val;
+ barrier();
+
+- return bit;
++ return bit + 1;
+ }
+
+ static __always_inline void trace_clear_recursion(int bit)
+@@ -605,6 +624,7 @@ static __always_inline void trace_clear_recursion(int bit)
+ if (!bit)
+ return;
+
++ bit--;
+ bit = 1 << bit;
+ val &= ~bit;
+
+diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c
+index 11e9daa4a568a..330ba2b081ede 100644
+--- a/kernel/trace/trace_selftest.c
++++ b/kernel/trace/trace_selftest.c
+@@ -492,8 +492,13 @@ trace_selftest_function_recursion(void)
+ unregister_ftrace_function(&test_rec_probe);
+
+ ret = -1;
+- if (trace_selftest_recursion_cnt != 1) {
+- pr_cont("*callback not called once (%d)* ",
++ /*
++ * Recursion allows for transitions between context,
++ * and may call the callback twice.
++ */
++ if (trace_selftest_recursion_cnt != 1 &&
++ trace_selftest_recursion_cnt != 2) {
++ pr_cont("*callback not called once (or twice) (%d)* ",
+ trace_selftest_recursion_cnt);
+ goto out;
+ }
+diff --git a/lib/crc32test.c b/lib/crc32test.c
+index 97d6a57cefcc5..61ddce2cff777 100644
+--- a/lib/crc32test.c
++++ b/lib/crc32test.c
+@@ -683,7 +683,6 @@ static int __init crc32c_test(void)
+
+ /* reduce OS noise */
+ local_irq_save(flags);
+- local_irq_disable();
+
+ nsec = ktime_get_ns();
+ for (i = 0; i < 100; i++) {
+@@ -694,7 +693,6 @@ static int __init crc32c_test(void)
+ nsec = ktime_get_ns() - nsec;
+
+ local_irq_restore(flags);
+- local_irq_enable();
+
+ pr_info("crc32c: CRC_LE_BITS = %d\n", CRC_LE_BITS);
+
+@@ -768,7 +766,6 @@ static int __init crc32_test(void)
+
+ /* reduce OS noise */
+ local_irq_save(flags);
+- local_irq_disable();
+
+ nsec = ktime_get_ns();
+ for (i = 0; i < 100; i++) {
+@@ -783,7 +780,6 @@ static int __init crc32_test(void)
+ nsec = ktime_get_ns() - nsec;
+
+ local_irq_restore(flags);
+- local_irq_enable();
+
+ pr_info("crc32: CRC_LE_BITS = %d, CRC_BE BITS = %d\n",
+ CRC_LE_BITS, CRC_BE_BITS);
+diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c
+index 0e2deac97da0d..e02f9df24d1ee 100644
+--- a/lib/fonts/font_10x18.c
++++ b/lib/fonts/font_10x18.c
+@@ -8,7 +8,7 @@
+
+ #define FONTDATAMAX 9216
+
+-static struct font_data fontdata_10x18 = {
++static const struct font_data fontdata_10x18 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, 0x00, /* 0000000000 */
+diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c
+index 87da8acd07db0..6e3c4b7691c85 100644
+--- a/lib/fonts/font_6x10.c
++++ b/lib/fonts/font_6x10.c
+@@ -3,7 +3,7 @@
+
+ #define FONTDATAMAX 2560
+
+-static struct font_data fontdata_6x10 = {
++static const struct font_data fontdata_6x10 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c
+index 5e975dfa10a53..2d22a24e816f0 100644
+--- a/lib/fonts/font_6x11.c
++++ b/lib/fonts/font_6x11.c
+@@ -9,7 +9,7 @@
+
+ #define FONTDATAMAX (11*256)
+
+-static struct font_data fontdata_6x11 = {
++static const struct font_data fontdata_6x11 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c
+index 86d298f385058..9cc7ae2e03f7d 100644
+--- a/lib/fonts/font_7x14.c
++++ b/lib/fonts/font_7x14.c
+@@ -8,7 +8,7 @@
+
+ #define FONTDATAMAX 3584
+
+-static struct font_data fontdata_7x14 = {
++static const struct font_data fontdata_7x14 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 0000000 */
+diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c
+index 37cedd36ca5ef..bab25dc59e8dd 100644
+--- a/lib/fonts/font_8x16.c
++++ b/lib/fonts/font_8x16.c
+@@ -10,7 +10,7 @@
+
+ #define FONTDATAMAX 4096
+
+-static struct font_data fontdata_8x16 = {
++static const struct font_data fontdata_8x16 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c
+index 8ab695538395d..109d0572368f4 100644
+--- a/lib/fonts/font_8x8.c
++++ b/lib/fonts/font_8x8.c
+@@ -9,7 +9,7 @@
+
+ #define FONTDATAMAX 2048
+
+-static struct font_data fontdata_8x8 = {
++static const struct font_data fontdata_8x8 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c
+index 069b3e80c4344..fb395f0d40317 100644
+--- a/lib/fonts/font_acorn_8x8.c
++++ b/lib/fonts/font_acorn_8x8.c
+@@ -5,7 +5,7 @@
+
+ #define FONTDATAMAX 2048
+
+-static struct font_data acorndata_8x8 = {
++static const struct font_data acorndata_8x8 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */
+ /* 01 */ 0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */
+diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c
+index 1449876c6a270..592774a90917b 100644
+--- a/lib/fonts/font_mini_4x6.c
++++ b/lib/fonts/font_mini_4x6.c
+@@ -43,7 +43,7 @@ __END__;
+
+ #define FONTDATAMAX 1536
+
+-static struct font_data fontdata_mini_4x6 = {
++static const struct font_data fontdata_mini_4x6 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /*{*/
+ /* Char 0: ' ' */
+diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c
+index 32d65551e7ed2..a6f95ebce9507 100644
+--- a/lib/fonts/font_pearl_8x8.c
++++ b/lib/fonts/font_pearl_8x8.c
+@@ -14,7 +14,7 @@
+
+ #define FONTDATAMAX 2048
+
+-static struct font_data fontdata_pearl8x8 = {
++static const struct font_data fontdata_pearl8x8 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, /* 00000000 */
+diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c
+index 641a6b4dca424..a5b65bd496045 100644
+--- a/lib/fonts/font_sun12x22.c
++++ b/lib/fonts/font_sun12x22.c
+@@ -3,7 +3,7 @@
+
+ #define FONTDATAMAX 11264
+
+-static struct font_data fontdata_sun12x22 = {
++static const struct font_data fontdata_sun12x22 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 0 0x00 '^@' */
+ 0x00, 0x00, /* 000000000000 */
+diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c
+index 193fe6d988e08..e577e76a6a7c0 100644
+--- a/lib/fonts/font_sun8x16.c
++++ b/lib/fonts/font_sun8x16.c
+@@ -3,7 +3,7 @@
+
+ #define FONTDATAMAX 4096
+
+-static struct font_data fontdata_sun8x16 = {
++static const struct font_data fontdata_sun8x16 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00,
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 68c46da82aac0..3cd27c1c729f6 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -496,7 +496,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
+ unsigned long flags = qp->flags;
+ int ret;
+ bool has_unmovable = false;
+- pte_t *pte;
++ pte_t *pte, *mapped_pte;
+ spinlock_t *ptl;
+
+ ptl = pmd_trans_huge_lock(pmd, vma);
+@@ -510,7 +510,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
+ if (pmd_trans_unstable(pmd))
+ return 0;
+
+- pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
++ mapped_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+ for (; addr != end; pte++, addr += PAGE_SIZE) {
+ if (!pte_present(*pte))
+ continue;
+@@ -542,7 +542,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
+ } else
+ break;
+ }
+- pte_unmap_unlock(pte - 1, ptl);
++ pte_unmap_unlock(mapped_pte, ptl);
+ cond_resched();
+
+ if (has_unmovable)
+diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
+index b036c55f5cb1d..7c10bc4dacd31 100644
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -261,6 +261,7 @@ static int dsa_port_setup(struct dsa_port *dp)
+ int err = 0;
+
+ memset(&dp->devlink_port, 0, sizeof(dp->devlink_port));
++ dp->mac = of_get_mac_address(dp->dn);
+
+ if (dp->type != DSA_PORT_TYPE_UNUSED)
+ err = devlink_port_register(ds->devlink, &dp->devlink_port,
+diff --git a/net/dsa/slave.c b/net/dsa/slave.c
+index 8ee28b6016d82..d03c67e761dfa 100644
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -1313,7 +1313,10 @@ int dsa_slave_create(struct dsa_port *port)
+ slave_dev->features = master->vlan_features | NETIF_F_HW_TC;
+ slave_dev->hw_features |= NETIF_F_HW_TC;
+ slave_dev->ethtool_ops = &dsa_slave_ethtool_ops;
+- eth_hw_addr_inherit(slave_dev, master);
++ if (port->mac && is_valid_ether_addr(port->mac))
++ ether_addr_copy(slave_dev->dev_addr, port->mac);
++ else
++ eth_hw_addr_inherit(slave_dev, master);
+ slave_dev->priv_flags |= IFF_NO_QUEUE;
+ slave_dev->netdev_ops = &dsa_slave_netdev_ops;
+ slave_dev->switchdev_ops = &dsa_slave_switchdev_ops;
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 567517e448115..bb4f1d0da1533 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -1615,12 +1615,12 @@ static int sctp_cmd_interpreter(enum sctp_event event_type,
+ break;
+
+ case SCTP_CMD_INIT_FAILED:
+- sctp_cmd_init_failed(commands, asoc, cmd->obj.u32);
++ sctp_cmd_init_failed(commands, asoc, cmd->obj.u16);
+ break;
+
+ case SCTP_CMD_ASSOC_FAILED:
+ sctp_cmd_assoc_failed(commands, asoc, event_type,
+- subtype, chunk, cmd->obj.u32);
++ subtype, chunk, cmd->obj.u16);
+ break;
+
+ case SCTP_CMD_INIT_COUNTER_INC:
+diff --git a/net/tipc/core.c b/net/tipc/core.c
+index 49bb9fc0aa068..ce0f067d0faf7 100644
+--- a/net/tipc/core.c
++++ b/net/tipc/core.c
+@@ -93,6 +93,11 @@ out_sk_rht:
+ static void __net_exit tipc_exit_net(struct net *net)
+ {
+ tipc_net_stop(net);
++
++ /* Make sure the tipc_net_finalize_work stopped
++ * before releasing the resources.
++ */
++ flush_scheduled_work();
+ tipc_bcast_stop(net);
+ tipc_nametbl_stop(net);
+ tipc_sk_rht_destroy(net);
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index c88dc8ee3144b..02374459c4179 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -629,7 +629,7 @@ struct sock *__vsock_create(struct net *net,
+ vsk->owner = get_cred(psk->owner);
+ vsk->connect_timeout = psk->connect_timeout;
+ } else {
+- vsk->trusted = capable(CAP_NET_ADMIN);
++ vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN);
+ vsk->owner = get_current_cred();
+ vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT;
+ }
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 7743e7bc6bf22..e4d2fcc89c306 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -334,6 +334,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ switch (subs->stream->chip->usb_id) {
+ case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */
+ case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C600 */
++ case USB_ID(0x22f0, 0x0006): /* Allen&Heath Qu-16 */
+ ep = 0x81;
+ ifnum = 3;
+ goto add_sync_ep_from_ifnum;
+@@ -343,6 +344,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ ifnum = 2;
+ goto add_sync_ep_from_ifnum;
+ case USB_ID(0x2466, 0x8003): /* Fractal Audio Axe-Fx II */
++ case USB_ID(0x0499, 0x172a): /* Yamaha MODX */
+ ep = 0x86;
+ ifnum = 2;
+ goto add_sync_ep_from_ifnum;
+@@ -350,6 +352,10 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ ep = 0x81;
+ ifnum = 2;
+ goto add_sync_ep_from_ifnum;
++ case USB_ID(0x1686, 0xf029): /* Zoom UAC-2 */
++ ep = 0x82;
++ ifnum = 2;
++ goto add_sync_ep_from_ifnum;
+ case USB_ID(0x1397, 0x0001): /* Behringer UFX1604 */
+ case USB_ID(0x1397, 0x0002): /* Behringer UFX1204 */
+ ep = 0x81;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index e6dea1c7112be..3effe2e86197d 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1466,6 +1466,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ case 0x278b: /* Rotel? */
+ case 0x292b: /* Gustard/Ess based devices */
+ case 0x2ab6: /* T+A devices */
++ case 0x3353: /* Khadas devices */
+ case 0x3842: /* EVGA */
+ case 0xc502: /* HiBy devices */
+ if (fp->dsd_raw)
+diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h
+index dc58254a2b696..8c01b2cfdb1ad 100644
+--- a/tools/perf/util/util.h
++++ b/tools/perf/util/util.h
+@@ -22,7 +22,7 @@ static inline void *zalloc(size_t size)
+ return calloc(1, size);
+ }
+
+-#define zfree(ptr) ({ free(*ptr); *ptr = NULL; })
++#define zfree(ptr) ({ free((void *)*ptr); *ptr = NULL; })
+
+ struct dirent;
+ struct nsinfo;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-11-11 15:43 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-11-11 15:43 UTC (permalink / raw
To: gentoo-commits
commit: 103fcc9ad0af899e33fdabfe1d5fbed4a50925bd
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 11 15:42:57 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Nov 11 15:42:57 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=103fcc9a
Linux patch 4.19.157
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 ++++
1156_linux-4.19.157.patch | 29 +++++++++++++++++++++++++++++
2 files changed, 33 insertions(+)
diff --git a/0000_README b/0000_README
index 54a0fb2..6ed2267 100644
--- a/0000_README
+++ b/0000_README
@@ -663,6 +663,10 @@ Patch: 1155_linux-4.19.156.patch
From: https://www.kernel.org
Desc: Linux 4.19.156
+Patch: 1156_linux-4.19.157.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.157
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1156_linux-4.19.157.patch b/1156_linux-4.19.157.patch
new file mode 100644
index 0000000..7ce30a4
--- /dev/null
+++ b/1156_linux-4.19.157.patch
@@ -0,0 +1,29 @@
+diff --git a/Makefile b/Makefile
+index 82891b34e19e0..245bcd8dd7b72 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 156
++SUBLEVEL = 157
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
+index 9e2f274bd44f2..60c8375c3c816 100644
+--- a/drivers/powercap/powercap_sys.c
++++ b/drivers/powercap/powercap_sys.c
+@@ -379,9 +379,9 @@ static void create_power_zone_common_attributes(
+ &dev_attr_max_energy_range_uj.attr;
+ if (power_zone->ops->get_energy_uj) {
+ if (power_zone->ops->reset_energy_uj)
+- dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
++ dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUSR;
+ else
+- dev_attr_energy_uj.attr.mode = S_IRUGO;
++ dev_attr_energy_uj.attr.mode = S_IRUSR;
+ power_zone->zone_dev_attrs[count++] =
+ &dev_attr_energy_uj.attr;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-11-18 19:56 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-11-18 19:56 UTC (permalink / raw
To: gentoo-commits
commit: eabb0eeb83a288eb30a7f95735245dbdf98879ac
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 18 19:56:24 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Nov 18 19:56:24 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=eabb0eeb
Linux patch 4.19.158
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1157_linux-4.19.158.patch | 3734 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3738 insertions(+)
diff --git a/0000_README b/0000_README
index 6ed2267..9824d3a 100644
--- a/0000_README
+++ b/0000_README
@@ -667,6 +667,10 @@ Patch: 1156_linux-4.19.157.patch
From: https://www.kernel.org
Desc: Linux 4.19.157
+Patch: 1157_linux-4.19.158.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.158
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1157_linux-4.19.158.patch b/1157_linux-4.19.158.patch
new file mode 100644
index 0000000..43b384d
--- /dev/null
+++ b/1157_linux-4.19.158.patch
@@ -0,0 +1,3734 @@
+diff --git a/Makefile b/Makefile
+index 245bcd8dd7b72..698a9cc2864bd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 157
++SUBLEVEL = 158
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/include/asm/kprobes.h b/arch/arm/include/asm/kprobes.h
+index 82290f212d8e7..e1eb662e0f9e0 100644
+--- a/arch/arm/include/asm/kprobes.h
++++ b/arch/arm/include/asm/kprobes.h
+@@ -52,20 +52,20 @@ int kprobe_exceptions_notify(struct notifier_block *self,
+ unsigned long val, void *data);
+
+ /* optinsn template addresses */
+-extern __visible kprobe_opcode_t optprobe_template_entry;
+-extern __visible kprobe_opcode_t optprobe_template_val;
+-extern __visible kprobe_opcode_t optprobe_template_call;
+-extern __visible kprobe_opcode_t optprobe_template_end;
+-extern __visible kprobe_opcode_t optprobe_template_sub_sp;
+-extern __visible kprobe_opcode_t optprobe_template_add_sp;
+-extern __visible kprobe_opcode_t optprobe_template_restore_begin;
+-extern __visible kprobe_opcode_t optprobe_template_restore_orig_insn;
+-extern __visible kprobe_opcode_t optprobe_template_restore_end;
++extern __visible kprobe_opcode_t optprobe_template_entry[];
++extern __visible kprobe_opcode_t optprobe_template_val[];
++extern __visible kprobe_opcode_t optprobe_template_call[];
++extern __visible kprobe_opcode_t optprobe_template_end[];
++extern __visible kprobe_opcode_t optprobe_template_sub_sp[];
++extern __visible kprobe_opcode_t optprobe_template_add_sp[];
++extern __visible kprobe_opcode_t optprobe_template_restore_begin[];
++extern __visible kprobe_opcode_t optprobe_template_restore_orig_insn[];
++extern __visible kprobe_opcode_t optprobe_template_restore_end[];
+
+ #define MAX_OPTIMIZED_LENGTH 4
+ #define MAX_OPTINSN_SIZE \
+- ((unsigned long)&optprobe_template_end - \
+- (unsigned long)&optprobe_template_entry)
++ ((unsigned long)optprobe_template_end - \
++ (unsigned long)optprobe_template_entry)
+ #define RELATIVEJUMP_SIZE 4
+
+ struct arch_optimized_insn {
+diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c
+index 0dc23fc227ed2..cf08cb7267670 100644
+--- a/arch/arm/probes/kprobes/opt-arm.c
++++ b/arch/arm/probes/kprobes/opt-arm.c
+@@ -98,21 +98,21 @@ asm (
+ "optprobe_template_end:\n");
+
+ #define TMPL_VAL_IDX \
+- ((unsigned long *)&optprobe_template_val - (unsigned long *)&optprobe_template_entry)
++ ((unsigned long *)optprobe_template_val - (unsigned long *)optprobe_template_entry)
+ #define TMPL_CALL_IDX \
+- ((unsigned long *)&optprobe_template_call - (unsigned long *)&optprobe_template_entry)
++ ((unsigned long *)optprobe_template_call - (unsigned long *)optprobe_template_entry)
+ #define TMPL_END_IDX \
+- ((unsigned long *)&optprobe_template_end - (unsigned long *)&optprobe_template_entry)
++ ((unsigned long *)optprobe_template_end - (unsigned long *)optprobe_template_entry)
+ #define TMPL_ADD_SP \
+- ((unsigned long *)&optprobe_template_add_sp - (unsigned long *)&optprobe_template_entry)
++ ((unsigned long *)optprobe_template_add_sp - (unsigned long *)optprobe_template_entry)
+ #define TMPL_SUB_SP \
+- ((unsigned long *)&optprobe_template_sub_sp - (unsigned long *)&optprobe_template_entry)
++ ((unsigned long *)optprobe_template_sub_sp - (unsigned long *)optprobe_template_entry)
+ #define TMPL_RESTORE_BEGIN \
+- ((unsigned long *)&optprobe_template_restore_begin - (unsigned long *)&optprobe_template_entry)
++ ((unsigned long *)optprobe_template_restore_begin - (unsigned long *)optprobe_template_entry)
+ #define TMPL_RESTORE_ORIGN_INSN \
+- ((unsigned long *)&optprobe_template_restore_orig_insn - (unsigned long *)&optprobe_template_entry)
++ ((unsigned long *)optprobe_template_restore_orig_insn - (unsigned long *)optprobe_template_entry)
+ #define TMPL_RESTORE_END \
+- ((unsigned long *)&optprobe_template_restore_end - (unsigned long *)&optprobe_template_entry)
++ ((unsigned long *)optprobe_template_restore_end - (unsigned long *)optprobe_template_entry)
+
+ /*
+ * ARM can always optimize an instruction when using ARM ISA, except
+@@ -247,7 +247,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *or
+ }
+
+ /* Copy arch-dep-instance from template. */
+- memcpy(code, (unsigned long *)&optprobe_template_entry,
++ memcpy(code, (unsigned long *)optprobe_template_entry,
+ TMPL_END_IDX * sizeof(kprobe_opcode_t));
+
+ /* Adjust buffer according to instruction. */
+diff --git a/arch/arm64/crypto/aes-modes.S b/arch/arm64/crypto/aes-modes.S
+index 483a7130cf0e1..496c243de4ac3 100644
+--- a/arch/arm64/crypto/aes-modes.S
++++ b/arch/arm64/crypto/aes-modes.S
+@@ -232,17 +232,19 @@ AES_ENTRY(aes_ctr_encrypt)
+ bmi .Lctr1x
+ cmn w6, #4 /* 32 bit overflow? */
+ bcs .Lctr1x
+- ldr q8, =0x30000000200000001 /* addends 1,2,3[,0] */
+- dup v7.4s, w6
++ add w7, w6, #1
+ mov v0.16b, v4.16b
+- add v7.4s, v7.4s, v8.4s
++ add w8, w6, #2
+ mov v1.16b, v4.16b
+- rev32 v8.16b, v7.16b
++ add w9, w6, #3
+ mov v2.16b, v4.16b
++ rev w7, w7
+ mov v3.16b, v4.16b
+- mov v1.s[3], v8.s[0]
+- mov v2.s[3], v8.s[1]
+- mov v3.s[3], v8.s[2]
++ rev w8, w8
++ mov v1.s[3], w7
++ rev w9, w9
++ mov v2.s[3], w8
++ mov v3.s[3], w9
+ ld1 {v5.16b-v7.16b}, [x20], #48 /* get 3 input blocks */
+ bl aes_encrypt_block4x
+ eor v0.16b, v5.16b, v0.16b
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index 8e31dfd85de32..888f247c9261a 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -831,7 +831,7 @@ void __init smp_detect_cpus(void)
+ */
+ static void smp_start_secondary(void *cpuvoid)
+ {
+- int cpu = smp_processor_id();
++ int cpu = raw_smp_processor_id();
+
+ S390_lowcore.last_update_clock = get_tod_clock();
+ S390_lowcore.restart_stack = (unsigned long) restart_stack;
+@@ -844,6 +844,7 @@ static void smp_start_secondary(void *cpuvoid)
+ set_cpu_flag(CIF_ASCE_PRIMARY);
+ set_cpu_flag(CIF_ASCE_SECONDARY);
+ cpu_init();
++ rcu_cpu_starting(cpu);
+ preempt_disable();
+ init_cpu_timer();
+ vtime_init();
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index bf554ed2fd51a..9e482fbdb28fb 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -1240,6 +1240,14 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
+ return 0;
+ }
+
++static bool is_spec_ib_user_controlled(void)
++{
++ return spectre_v2_user_ibpb == SPECTRE_V2_USER_PRCTL ||
++ spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_PRCTL ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP;
++}
++
+ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
+ {
+ switch (ctrl) {
+@@ -1247,17 +1255,26 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
+ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
+ spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
+ return 0;
+- /*
+- * Indirect branch speculation is always disabled in strict
+- * mode. It can neither be enabled if it was force-disabled
+- * by a previous prctl call.
+
++ /*
++ * With strict mode for both IBPB and STIBP, the instruction
++ * code paths avoid checking this task flag and instead,
++ * unconditionally run the instruction. However, STIBP and IBPB
++ * are independent and either can be set to conditionally
++ * enabled regardless of the mode of the other.
++ *
++ * If either is set to conditional, allow the task flag to be
++ * updated, unless it was force-disabled by a previous prctl
++ * call. Currently, this is possible on an AMD CPU which has the
++ * feature X86_FEATURE_AMD_STIBP_ALWAYS_ON. In this case, if the
++ * kernel is booted with 'spectre_v2_user=seccomp', then
++ * spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP and
++ * spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED.
+ */
+- if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
+- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
+- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED ||
++ if (!is_spec_ib_user_controlled() ||
+ task_spec_ib_force_disable(task))
+ return -EPERM;
++
+ task_clear_spec_ib_disable(task);
+ task_update_spec_tif(task);
+ break;
+@@ -1270,10 +1287,10 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
+ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
+ spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
+ return -EPERM;
+- if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
+- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
+- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED)
++
++ if (!is_spec_ib_user_controlled())
+ return 0;
++
+ task_set_spec_ib_disable(task);
+ if (ctrl == PR_SPEC_FORCE_DISABLE)
+ task_set_spec_ib_force_disable(task);
+@@ -1336,20 +1353,17 @@ static int ib_prctl_get(struct task_struct *task)
+ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
+ spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
+ return PR_SPEC_ENABLE;
+- else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
+- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
+- spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED)
+- return PR_SPEC_DISABLE;
+- else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_PRCTL ||
+- spectre_v2_user_ibpb == SPECTRE_V2_USER_SECCOMP ||
+- spectre_v2_user_stibp == SPECTRE_V2_USER_PRCTL ||
+- spectre_v2_user_stibp == SPECTRE_V2_USER_SECCOMP) {
++ else if (is_spec_ib_user_controlled()) {
+ if (task_spec_ib_force_disable(task))
+ return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
+ if (task_spec_ib_disable(task))
+ return PR_SPEC_PRCTL | PR_SPEC_DISABLE;
+ return PR_SPEC_PRCTL | PR_SPEC_ENABLE;
+- } else
++ } else if (spectre_v2_user_ibpb == SPECTRE_V2_USER_STRICT ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||
++ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED)
++ return PR_SPEC_DISABLE;
++ else
+ return PR_SPEC_NOT_AFFECTED;
+ }
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 52e1e71e81241..517318bb350cf 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -276,7 +276,7 @@ static void nbd_size_clear(struct nbd_device *nbd)
+ }
+ }
+
+-static void nbd_size_update(struct nbd_device *nbd)
++static void nbd_size_update(struct nbd_device *nbd, bool start)
+ {
+ struct nbd_config *config = nbd->config;
+ struct block_device *bdev = bdget_disk(nbd->disk, 0);
+@@ -292,7 +292,8 @@ static void nbd_size_update(struct nbd_device *nbd)
+ if (bdev) {
+ if (bdev->bd_disk) {
+ bd_set_size(bdev, config->bytesize);
+- set_blocksize(bdev, config->blksize);
++ if (start)
++ set_blocksize(bdev, config->blksize);
+ } else
+ bdev->bd_invalidated = 1;
+ bdput(bdev);
+@@ -307,7 +308,7 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize,
+ config->blksize = blocksize;
+ config->bytesize = blocksize * nr_blocks;
+ if (nbd->task_recv != NULL)
+- nbd_size_update(nbd);
++ nbd_size_update(nbd, false);
+ }
+
+ static void nbd_complete_rq(struct request *req)
+@@ -1244,7 +1245,7 @@ static int nbd_start_device(struct nbd_device *nbd)
+ args->index = i;
+ queue_work(nbd->recv_workq, &args->work);
+ }
+- nbd_size_update(nbd);
++ nbd_size_update(nbd, true);
+ return error;
+ }
+
+@@ -1447,6 +1448,7 @@ static void nbd_release(struct gendisk *disk, fmode_t mode)
+ if (test_bit(NBD_DISCONNECT_ON_CLOSE, &nbd->config->runtime_flags) &&
+ bdev->bd_openers == 0)
+ nbd_disconnect_and_put(nbd);
++ bdput(bdev);
+
+ nbd_config_put(nbd);
+ nbd_put(nbd);
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 80dedecfe15c5..98925d49c96be 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1257,7 +1257,6 @@ void add_interrupt_randomness(int irq, int irq_flags)
+
+ fast_mix(fast_pool);
+ add_interrupt_bench(cycles);
+- this_cpu_add(net_rand_state.s1, fast_pool->pool[cycles & 3]);
+
+ if (unlikely(crng_init == 0)) {
+ if ((fast_pool->count >= 64) &&
+diff --git a/drivers/char/tpm/eventlog/efi.c b/drivers/char/tpm/eventlog/efi.c
+index 3e673ab22cb45..abd3beeb51589 100644
+--- a/drivers/char/tpm/eventlog/efi.c
++++ b/drivers/char/tpm/eventlog/efi.c
+@@ -43,6 +43,11 @@ int tpm_read_log_efi(struct tpm_chip *chip)
+ log_size = log_tbl->size;
+ memunmap(log_tbl);
+
++ if (!log_size) {
++ pr_warn("UEFI TPM log area empty\n");
++ return -EIO;
++ }
++
+ log_tbl = memremap(efi.tpm_log, sizeof(*log_tbl) + log_size,
+ MEMREMAP_WB);
+ if (!log_tbl) {
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index f08949a5f6785..5a3a4f0953910 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -31,6 +31,7 @@
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+ #include <linux/kernel.h>
++#include <linux/dmi.h>
+ #include "tpm.h"
+ #include "tpm_tis_core.h"
+
+@@ -53,8 +54,8 @@ static inline struct tpm_tis_tcg_phy *to_tpm_tis_tcg_phy(struct tpm_tis_data *da
+ return container_of(data, struct tpm_tis_tcg_phy, priv);
+ }
+
+-static bool interrupts = true;
+-module_param(interrupts, bool, 0444);
++static int interrupts = -1;
++module_param(interrupts, int, 0444);
+ MODULE_PARM_DESC(interrupts, "Enable interrupts");
+
+ static bool itpm;
+@@ -67,6 +68,28 @@ module_param(force, bool, 0444);
+ MODULE_PARM_DESC(force, "Force device probe rather than using ACPI entry");
+ #endif
+
++static int tpm_tis_disable_irq(const struct dmi_system_id *d)
++{
++ if (interrupts == -1) {
++ pr_notice("tpm_tis: %s detected: disabling interrupts.\n", d->ident);
++ interrupts = 0;
++ }
++
++ return 0;
++}
++
++static const struct dmi_system_id tpm_tis_dmi_table[] = {
++ {
++ .callback = tpm_tis_disable_irq,
++ .ident = "ThinkPad T490s",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T490s"),
++ },
++ },
++ {}
++};
++
+ #if defined(CONFIG_PNP) && defined(CONFIG_ACPI)
+ static int has_hid(struct acpi_device *dev, const char *hid)
+ {
+@@ -196,6 +219,8 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info)
+ int irq = -1;
+ int rc;
+
++ dmi_check_system(tpm_tis_dmi_table);
++
+ rc = check_acpi_tpm2(dev);
+ if (rc)
+ return rc;
+diff --git a/drivers/gpio/gpio-pcie-idio-24.c b/drivers/gpio/gpio-pcie-idio-24.c
+index f953541e78901..634125747a039 100644
+--- a/drivers/gpio/gpio-pcie-idio-24.c
++++ b/drivers/gpio/gpio-pcie-idio-24.c
+@@ -28,6 +28,47 @@
+ #include <linux/spinlock.h>
+ #include <linux/types.h>
+
++/*
++ * PLX PEX8311 PCI LCS_INTCSR Interrupt Control/Status
++ *
++ * Bit: Description
++ * 0: Enable Interrupt Sources (Bit 0)
++ * 1: Enable Interrupt Sources (Bit 1)
++ * 2: Generate Internal PCI Bus Internal SERR# Interrupt
++ * 3: Mailbox Interrupt Enable
++ * 4: Power Management Interrupt Enable
++ * 5: Power Management Interrupt
++ * 6: Slave Read Local Data Parity Check Error Enable
++ * 7: Slave Read Local Data Parity Check Error Status
++ * 8: Internal PCI Wire Interrupt Enable
++ * 9: PCI Express Doorbell Interrupt Enable
++ * 10: PCI Abort Interrupt Enable
++ * 11: Local Interrupt Input Enable
++ * 12: Retry Abort Enable
++ * 13: PCI Express Doorbell Interrupt Active
++ * 14: PCI Abort Interrupt Active
++ * 15: Local Interrupt Input Active
++ * 16: Local Interrupt Output Enable
++ * 17: Local Doorbell Interrupt Enable
++ * 18: DMA Channel 0 Interrupt Enable
++ * 19: DMA Channel 1 Interrupt Enable
++ * 20: Local Doorbell Interrupt Active
++ * 21: DMA Channel 0 Interrupt Active
++ * 22: DMA Channel 1 Interrupt Active
++ * 23: Built-In Self-Test (BIST) Interrupt Active
++ * 24: Direct Master was the Bus Master during a Master or Target Abort
++ * 25: DMA Channel 0 was the Bus Master during a Master or Target Abort
++ * 26: DMA Channel 1 was the Bus Master during a Master or Target Abort
++ * 27: Target Abort after internal 256 consecutive Master Retrys
++ * 28: PCI Bus wrote data to LCS_MBOX0
++ * 29: PCI Bus wrote data to LCS_MBOX1
++ * 30: PCI Bus wrote data to LCS_MBOX2
++ * 31: PCI Bus wrote data to LCS_MBOX3
++ */
++#define PLX_PEX8311_PCI_LCS_INTCSR 0x68
++#define INTCSR_INTERNAL_PCI_WIRE BIT(8)
++#define INTCSR_LOCAL_INPUT BIT(11)
++
+ /**
+ * struct idio_24_gpio_reg - GPIO device registers structure
+ * @out0_7: Read: FET Outputs 0-7
+@@ -92,6 +133,7 @@ struct idio_24_gpio_reg {
+ struct idio_24_gpio {
+ struct gpio_chip chip;
+ raw_spinlock_t lock;
++ __u8 __iomem *plx;
+ struct idio_24_gpio_reg __iomem *reg;
+ unsigned long irq_mask;
+ };
+@@ -360,13 +402,13 @@ static void idio_24_irq_mask(struct irq_data *data)
+ unsigned long flags;
+ const unsigned long bit_offset = irqd_to_hwirq(data) - 24;
+ unsigned char new_irq_mask;
+- const unsigned long bank_offset = bit_offset/8 * 8;
++ const unsigned long bank_offset = bit_offset / 8;
+ unsigned char cos_enable_state;
+
+ raw_spin_lock_irqsave(&idio24gpio->lock, flags);
+
+- idio24gpio->irq_mask &= BIT(bit_offset);
+- new_irq_mask = idio24gpio->irq_mask >> bank_offset;
++ idio24gpio->irq_mask &= ~BIT(bit_offset);
++ new_irq_mask = idio24gpio->irq_mask >> bank_offset * 8;
+
+ if (!new_irq_mask) {
+ cos_enable_state = ioread8(&idio24gpio->reg->cos_enable);
+@@ -389,12 +431,12 @@ static void idio_24_irq_unmask(struct irq_data *data)
+ unsigned long flags;
+ unsigned char prev_irq_mask;
+ const unsigned long bit_offset = irqd_to_hwirq(data) - 24;
+- const unsigned long bank_offset = bit_offset/8 * 8;
++ const unsigned long bank_offset = bit_offset / 8;
+ unsigned char cos_enable_state;
+
+ raw_spin_lock_irqsave(&idio24gpio->lock, flags);
+
+- prev_irq_mask = idio24gpio->irq_mask >> bank_offset;
++ prev_irq_mask = idio24gpio->irq_mask >> bank_offset * 8;
+ idio24gpio->irq_mask |= BIT(bit_offset);
+
+ if (!prev_irq_mask) {
+@@ -481,6 +523,7 @@ static int idio_24_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ struct device *const dev = &pdev->dev;
+ struct idio_24_gpio *idio24gpio;
+ int err;
++ const size_t pci_plx_bar_index = 1;
+ const size_t pci_bar_index = 2;
+ const char *const name = pci_name(pdev);
+
+@@ -494,12 +537,13 @@ static int idio_24_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ return err;
+ }
+
+- err = pcim_iomap_regions(pdev, BIT(pci_bar_index), name);
++ err = pcim_iomap_regions(pdev, BIT(pci_plx_bar_index) | BIT(pci_bar_index), name);
+ if (err) {
+ dev_err(dev, "Unable to map PCI I/O addresses (%d)\n", err);
+ return err;
+ }
+
++ idio24gpio->plx = pcim_iomap_table(pdev)[pci_plx_bar_index];
+ idio24gpio->reg = pcim_iomap_table(pdev)[pci_bar_index];
+
+ idio24gpio->chip.label = name;
+@@ -520,6 +564,12 @@ static int idio_24_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ /* Software board reset */
+ iowrite8(0, &idio24gpio->reg->soft_reset);
++ /*
++ * enable PLX PEX8311 internal PCI wire interrupt and local interrupt
++ * input
++ */
++ iowrite8((INTCSR_INTERNAL_PCI_WIRE | INTCSR_LOCAL_INPUT) >> 8,
++ idio24gpio->plx + PLX_PEX8311_PCI_LCS_INTCSR + 1);
+
+ err = devm_gpiochip_add_data(dev, &idio24gpio->chip, idio24gpio);
+ if (err) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+index d0fa2aac23888..ca66c2f797584 100644
+--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
++++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+@@ -1086,22 +1086,19 @@ static int cik_sdma_soft_reset(void *handle)
+ {
+ u32 srbm_soft_reset = 0;
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+- u32 tmp = RREG32(mmSRBM_STATUS2);
++ u32 tmp;
+
+- if (tmp & SRBM_STATUS2__SDMA_BUSY_MASK) {
+- /* sdma0 */
+- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET);
+- tmp |= SDMA0_F32_CNTL__HALT_MASK;
+- WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp);
+- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK;
+- }
+- if (tmp & SRBM_STATUS2__SDMA1_BUSY_MASK) {
+- /* sdma1 */
+- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET);
+- tmp |= SDMA0_F32_CNTL__HALT_MASK;
+- WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp);
+- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK;
+- }
++ /* sdma0 */
++ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET);
++ tmp |= SDMA0_F32_CNTL__HALT_MASK;
++ WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp);
++ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK;
++
++ /* sdma1 */
++ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET);
++ tmp |= SDMA0_F32_CNTL__HALT_MASK;
++ WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp);
++ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK;
+
+ if (srbm_soft_reset) {
+ tmp = RREG32(mmSRBM_SOFT_RESET);
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index 058898b321b8a..d8e624d64ae38 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -1531,6 +1531,10 @@ int smu7_disable_dpm_tasks(struct pp_hwmgr *hwmgr)
+ PP_ASSERT_WITH_CODE((tmp_result == 0),
+ "Failed to reset to default!", result = tmp_result);
+
++ tmp_result = smum_stop_smc(hwmgr);
++ PP_ASSERT_WITH_CODE((tmp_result == 0),
++ "Failed to stop smc!", result = tmp_result);
++
+ tmp_result = smu7_force_switch_to_arbf0(hwmgr);
+ PP_ASSERT_WITH_CODE((tmp_result == 0),
+ "Failed to force to switch arbf0!", result = tmp_result);
+diff --git a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
+index 6ee864455a12a..f59e1e737735f 100644
+--- a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
++++ b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
+@@ -216,6 +216,7 @@ struct pp_smumgr_func {
+ bool (*is_hw_avfs_present)(struct pp_hwmgr *hwmgr);
+ int (*update_dpm_settings)(struct pp_hwmgr *hwmgr, void *profile_setting);
+ int (*smc_table_manager)(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t table_id, bool rw); /*rw: true for read, false for write */
++ int (*stop_smc)(struct pp_hwmgr *hwmgr);
+ };
+
+ struct pp_hwmgr_func {
+diff --git a/drivers/gpu/drm/amd/powerplay/inc/smumgr.h b/drivers/gpu/drm/amd/powerplay/inc/smumgr.h
+index 82550a8a3a3fc..ef4f2392e2e7d 100644
+--- a/drivers/gpu/drm/amd/powerplay/inc/smumgr.h
++++ b/drivers/gpu/drm/amd/powerplay/inc/smumgr.h
+@@ -113,4 +113,6 @@ extern int smum_update_dpm_settings(struct pp_hwmgr *hwmgr, void *profile_settin
+
+ extern int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t table_id, bool rw);
+
++extern int smum_stop_smc(struct pp_hwmgr *hwmgr);
++
+ #endif
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+index db87cb8930d24..c05bec5effb2e 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+@@ -2723,10 +2723,7 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr *hwmgr)
+
+ static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr)
+ {
+- return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device,
+- CGS_IND_REG__SMC, FEATURE_STATUS,
+- VOLTAGE_CONTROLLER_ON))
+- ? true : false;
++ return ci_is_smc_ram_running(hwmgr);
+ }
+
+ static int ci_smu_init(struct pp_hwmgr *hwmgr)
+@@ -2934,6 +2931,29 @@ static int ci_update_smc_table(struct pp_hwmgr *hwmgr, uint32_t type)
+ return 0;
+ }
+
++static void ci_reset_smc(struct pp_hwmgr *hwmgr)
++{
++ PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC,
++ SMC_SYSCON_RESET_CNTL,
++ rst_reg, 1);
++}
++
++
++static void ci_stop_smc_clock(struct pp_hwmgr *hwmgr)
++{
++ PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC,
++ SMC_SYSCON_CLOCK_CNTL_0,
++ ck_disable, 1);
++}
++
++static int ci_stop_smc(struct pp_hwmgr *hwmgr)
++{
++ ci_reset_smc(hwmgr);
++ ci_stop_smc_clock(hwmgr);
++
++ return 0;
++}
++
+ const struct pp_smumgr_func ci_smu_funcs = {
+ .smu_init = ci_smu_init,
+ .smu_fini = ci_smu_fini,
+@@ -2957,4 +2977,5 @@ const struct pp_smumgr_func ci_smu_funcs = {
+ .is_dpm_running = ci_is_dpm_running,
+ .update_dpm_settings = ci_update_dpm_settings,
+ .update_smc_table = ci_update_smc_table,
++ .stop_smc = ci_stop_smc,
+ };
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
+index a6edd5df33b0f..20ecf994d47f3 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
+@@ -213,3 +213,11 @@ int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t tabl
+
+ return -EINVAL;
+ }
++
++int smum_stop_smc(struct pp_hwmgr *hwmgr)
++{
++ if (hwmgr->smumgr_funcs->stop_smc)
++ return hwmgr->smumgr_funcs->stop_smc(hwmgr);
++
++ return 0;
++}
+diff --git a/drivers/gpu/drm/gma500/psb_irq.c b/drivers/gpu/drm/gma500/psb_irq.c
+index 78eb109028091..076b6da44f461 100644
+--- a/drivers/gpu/drm/gma500/psb_irq.c
++++ b/drivers/gpu/drm/gma500/psb_irq.c
+@@ -350,6 +350,7 @@ int psb_irq_postinstall(struct drm_device *dev)
+ {
+ struct drm_psb_private *dev_priv = dev->dev_private;
+ unsigned long irqflags;
++ unsigned int i;
+
+ spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
+
+@@ -362,20 +363,12 @@ int psb_irq_postinstall(struct drm_device *dev)
+ PSB_WVDC32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R);
+ PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
+
+- if (dev->vblank[0].enabled)
+- psb_enable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
+- else
+- psb_disable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
+-
+- if (dev->vblank[1].enabled)
+- psb_enable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
+- else
+- psb_disable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
+-
+- if (dev->vblank[2].enabled)
+- psb_enable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
+- else
+- psb_disable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
++ for (i = 0; i < dev->num_crtcs; ++i) {
++ if (dev->vblank[i].enabled)
++ psb_enable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE);
++ else
++ psb_disable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE);
++ }
+
+ if (dev_priv->ops->hotplug_enable)
+ dev_priv->ops->hotplug_enable(dev, true);
+@@ -388,6 +381,7 @@ void psb_irq_uninstall(struct drm_device *dev)
+ {
+ struct drm_psb_private *dev_priv = dev->dev_private;
+ unsigned long irqflags;
++ unsigned int i;
+
+ spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
+
+@@ -396,14 +390,10 @@ void psb_irq_uninstall(struct drm_device *dev)
+
+ PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
+
+- if (dev->vblank[0].enabled)
+- psb_disable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
+-
+- if (dev->vblank[1].enabled)
+- psb_disable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
+-
+- if (dev->vblank[2].enabled)
+- psb_disable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
++ for (i = 0; i < dev->num_crtcs; ++i) {
++ if (dev->vblank[i].enabled)
++ psb_disable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE);
++ }
+
+ dev_priv->vdc_irq_mask &= _PSB_IRQ_SGX_FLAG |
+ _PSB_IRQ_MSVDX_FLAG |
+diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
+index 9ca0706a9d402..e5fc719a34e70 100644
+--- a/drivers/hv/hv_balloon.c
++++ b/drivers/hv/hv_balloon.c
+@@ -1275,7 +1275,7 @@ static void balloon_up(struct work_struct *dummy)
+
+ /* Refuse to balloon below the floor. */
+ if (avail_pages < num_pages || avail_pages - num_pages < floor) {
+- pr_warn("Balloon request will be partially fulfilled. %s\n",
++ pr_info("Balloon request will be partially fulfilled. %s\n",
+ avail_pages < num_pages ? "Not enough memory." :
+ "Balloon floor reached.");
+
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index 859b06424e5c4..df6f3cc958e5e 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -410,7 +410,11 @@ extern bool amd_iommu_np_cache;
+ /* Only true if all IOMMUs support device IOTLBs */
+ extern bool amd_iommu_iotlb_sup;
+
+-#define MAX_IRQS_PER_TABLE 256
++/*
++ * AMD IOMMU hardware only support 512 IRTEs despite
++ * the architectural limitation of 2048 entries.
++ */
++#define MAX_IRQS_PER_TABLE 512
+ #define IRQ_TABLE_ALIGNMENT 128
+
+ struct irq_remap_table {
+diff --git a/drivers/mfd/sprd-sc27xx-spi.c b/drivers/mfd/sprd-sc27xx-spi.c
+index 69df27769c213..3ba8cfa4b3b7a 100644
+--- a/drivers/mfd/sprd-sc27xx-spi.c
++++ b/drivers/mfd/sprd-sc27xx-spi.c
+@@ -212,7 +212,7 @@ static int sprd_pmic_probe(struct spi_device *spi)
+ }
+
+ ret = devm_regmap_add_irq_chip(&spi->dev, ddata->regmap, ddata->irq,
+- IRQF_ONESHOT | IRQF_NO_SUSPEND, 0,
++ IRQF_ONESHOT, 0,
+ &ddata->irq_chip, &ddata->irq_data);
+ if (ret) {
+ dev_err(&spi->dev, "Failed to add PMIC irq chip %d\n", ret);
+@@ -228,9 +228,34 @@ static int sprd_pmic_probe(struct spi_device *spi)
+ return ret;
+ }
+
++ device_init_wakeup(&spi->dev, true);
+ return 0;
+ }
+
++#ifdef CONFIG_PM_SLEEP
++static int sprd_pmic_suspend(struct device *dev)
++{
++ struct sprd_pmic *ddata = dev_get_drvdata(dev);
++
++ if (device_may_wakeup(dev))
++ enable_irq_wake(ddata->irq);
++
++ return 0;
++}
++
++static int sprd_pmic_resume(struct device *dev)
++{
++ struct sprd_pmic *ddata = dev_get_drvdata(dev);
++
++ if (device_may_wakeup(dev))
++ disable_irq_wake(ddata->irq);
++
++ return 0;
++}
++#endif
++
++static SIMPLE_DEV_PM_OPS(sprd_pmic_pm_ops, sprd_pmic_suspend, sprd_pmic_resume);
++
+ static const struct of_device_id sprd_pmic_match[] = {
+ { .compatible = "sprd,sc2731", .data = &sc2731_data },
+ {},
+@@ -242,6 +267,7 @@ static struct spi_driver sprd_pmic_driver = {
+ .name = "sc27xx-pmic",
+ .bus = &spi_bus_type,
+ .of_match_table = sprd_pmic_match,
++ .pm = &sprd_pmic_pm_ops,
+ },
+ .probe = sprd_pmic_probe,
+ };
+diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h
+index 64e318f589b42..0d23efcc74ffe 100644
+--- a/drivers/misc/mei/client.h
++++ b/drivers/misc/mei/client.h
+@@ -138,11 +138,11 @@ static inline u8 mei_cl_me_id(const struct mei_cl *cl)
+ *
+ * @cl: host client
+ *
+- * Return: mtu
++ * Return: mtu or 0 if client is not connected
+ */
+ static inline size_t mei_cl_mtu(const struct mei_cl *cl)
+ {
+- return cl->me_cl->props.max_msg_length;
++ return cl->me_cl ? cl->me_cl->props.max_msg_length : 0;
+ }
+
+ /**
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 61f0faddfd889..e8ab582551f8e 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -764,6 +764,7 @@ int renesas_sdhi_remove(struct platform_device *pdev)
+
+ tmio_mmc_host_remove(host);
+ renesas_sdhi_clk_disable(host);
++ tmio_mmc_host_free(host);
+
+ return 0;
+ }
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 1545f2b299d06..1950b13f22dfc 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -493,9 +493,13 @@ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8
+ */
+ struct sk_buff *skb = priv->echo_skb[idx];
+ struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+- u8 len = cf->len;
+
+- *len_ptr = len;
++ /* get the real payload length for netdev statistics */
++ if (cf->can_id & CAN_RTR_FLAG)
++ *len_ptr = 0;
++ else
++ *len_ptr = cf->len;
++
+ priv->echo_skb[idx] = NULL;
+
+ return skb;
+@@ -520,7 +524,11 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
+ if (!skb)
+ return 0;
+
+- netif_rx(skb);
++ skb_get(skb);
++ if (netif_rx(skb) == NET_RX_SUCCESS)
++ dev_consume_skb_any(skb);
++ else
++ dev_kfree_skb_any(skb);
+
+ return len;
+ }
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 0be8db6ab3195..92fe345e48ab7 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -301,8 +301,7 @@ static const struct flexcan_devtype_data fsl_vf610_devtype_data = {
+
+ static const struct flexcan_devtype_data fsl_ls1021a_r2_devtype_data = {
+ .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS |
+- FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_BROKEN_PERR_STATE |
+- FLEXCAN_QUIRK_USE_OFF_TIMESTAMP,
++ FLEXCAN_QUIRK_BROKEN_PERR_STATE | FLEXCAN_QUIRK_USE_OFF_TIMESTAMP,
+ };
+
+ static const struct can_bittiming_const flexcan_bittiming_const = {
+diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c
+index 5696d7e807513..4bc5d522c74bb 100644
+--- a/drivers/net/can/peak_canfd/peak_canfd.c
++++ b/drivers/net/can/peak_canfd/peak_canfd.c
+@@ -256,8 +256,7 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,
+ cf_len = get_can_dlc(pucan_msg_get_dlc(msg));
+
+ /* if this frame is an echo, */
+- if ((rx_msg_flags & PUCAN_MSG_LOOPED_BACK) &&
+- !(rx_msg_flags & PUCAN_MSG_SELF_RECEIVE)) {
++ if (rx_msg_flags & PUCAN_MSG_LOOPED_BACK) {
+ unsigned long flags;
+
+ spin_lock_irqsave(&priv->echo_lock, flags);
+@@ -271,7 +270,13 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,
+ netif_wake_queue(priv->ndev);
+
+ spin_unlock_irqrestore(&priv->echo_lock, flags);
+- return 0;
++
++ /* if this frame is only an echo, stop here. Otherwise,
++ * continue to push this application self-received frame into
++ * its own rx queue.
++ */
++ if (!(rx_msg_flags & PUCAN_MSG_SELF_RECEIVE))
++ return 0;
+ }
+
+ /* otherwise, it should be pushed into rx fifo */
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 5f7e97d54733c..5cf4171df1f42 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -281,7 +281,7 @@ int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
+
+ if (skb_queue_len(&offload->skb_queue) >
+ offload->skb_queue_len_max) {
+- kfree_skb(skb);
++ dev_kfree_skb_any(skb);
+ return -ENOBUFS;
+ }
+
+@@ -326,7 +326,7 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+ {
+ if (skb_queue_len(&offload->skb_queue) >
+ offload->skb_queue_len_max) {
+- kfree_skb(skb);
++ dev_kfree_skb_any(skb);
+ return -ENOBUFS;
+ }
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index afc8d978124ef..db156a11e6db5 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -138,14 +138,55 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time)
+ /* protect from getting time before setting now */
+ if (ktime_to_ns(time_ref->tv_host)) {
+ u64 delta_us;
++ s64 delta_ts = 0;
++
++ /* General case: dev_ts_1 < dev_ts_2 < ts, with:
++ *
++ * - dev_ts_1 = previous sync timestamp
++ * - dev_ts_2 = last sync timestamp
++ * - ts = event timestamp
++ * - ts_period = known sync period (theoretical)
++ * ~ dev_ts2 - dev_ts1
++ * *but*:
++ *
++ * - time counters wrap (see adapter->ts_used_bits)
++ * - sometimes, dev_ts_1 < ts < dev_ts2
++ *
++ * "normal" case (sync time counters increase):
++ * must take into account case when ts wraps (tsw)
++ *
++ * < ts_period > < >
++ * | | |
++ * ---+--------+----+-------0-+--+-->
++ * ts_dev_1 | ts_dev_2 |
++ * ts tsw
++ */
++ if (time_ref->ts_dev_1 < time_ref->ts_dev_2) {
++ /* case when event time (tsw) wraps */
++ if (ts < time_ref->ts_dev_1)
++ delta_ts = 1 << time_ref->adapter->ts_used_bits;
++
++ /* Otherwise, sync time counter (ts_dev_2) has wrapped:
++ * handle case when event time (tsn) hasn't.
++ *
++ * < ts_period > < >
++ * | | |
++ * ---+--------+--0-+---------+--+-->
++ * ts_dev_1 | ts_dev_2 |
++ * tsn ts
++ */
++ } else if (time_ref->ts_dev_1 < ts) {
++ delta_ts = -(1 << time_ref->adapter->ts_used_bits);
++ }
+
+- delta_us = ts - time_ref->ts_dev_2;
+- if (ts < time_ref->ts_dev_2)
+- delta_us &= (1 << time_ref->adapter->ts_used_bits) - 1;
++ /* add delay between last sync and event timestamps */
++ delta_ts += (signed int)(ts - time_ref->ts_dev_2);
+
+- delta_us += time_ref->ts_total;
++ /* add time from beginning to last sync */
++ delta_ts += time_ref->ts_total;
+
+- delta_us *= time_ref->adapter->us_per_ts_scale;
++ /* convert ticks number into microseconds */
++ delta_us = delta_ts * time_ref->adapter->us_per_ts_scale;
+ delta_us >>= time_ref->adapter->us_per_ts_shift;
+
+ *time = ktime_add_us(time_ref->tv_host_0, delta_us);
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+index 41988358f63c8..19600d35aac55 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+@@ -476,12 +476,18 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if,
+ struct pucan_msg *rx_msg)
+ {
+ struct pucan_rx_msg *rm = (struct pucan_rx_msg *)rx_msg;
+- struct peak_usb_device *dev = usb_if->dev[pucan_msg_get_channel(rm)];
+- struct net_device *netdev = dev->netdev;
++ struct peak_usb_device *dev;
++ struct net_device *netdev;
+ struct canfd_frame *cfd;
+ struct sk_buff *skb;
+ const u16 rx_msg_flags = le16_to_cpu(rm->flags);
+
++ if (pucan_msg_get_channel(rm) >= ARRAY_SIZE(usb_if->dev))
++ return -ENOMEM;
++
++ dev = usb_if->dev[pucan_msg_get_channel(rm)];
++ netdev = dev->netdev;
++
+ if (rx_msg_flags & PUCAN_MSG_EXT_DATA_LEN) {
+ /* CANFD frame case */
+ skb = alloc_canfd_skb(netdev, &cfd);
+@@ -527,15 +533,21 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if,
+ struct pucan_msg *rx_msg)
+ {
+ struct pucan_status_msg *sm = (struct pucan_status_msg *)rx_msg;
+- struct peak_usb_device *dev = usb_if->dev[pucan_stmsg_get_channel(sm)];
+- struct pcan_usb_fd_device *pdev =
+- container_of(dev, struct pcan_usb_fd_device, dev);
++ struct pcan_usb_fd_device *pdev;
+ enum can_state new_state = CAN_STATE_ERROR_ACTIVE;
+ enum can_state rx_state, tx_state;
+- struct net_device *netdev = dev->netdev;
++ struct peak_usb_device *dev;
++ struct net_device *netdev;
+ struct can_frame *cf;
+ struct sk_buff *skb;
+
++ if (pucan_stmsg_get_channel(sm) >= ARRAY_SIZE(usb_if->dev))
++ return -ENOMEM;
++
++ dev = usb_if->dev[pucan_stmsg_get_channel(sm)];
++ pdev = container_of(dev, struct pcan_usb_fd_device, dev);
++ netdev = dev->netdev;
++
+ /* nothing should be sent while in BUS_OFF state */
+ if (dev->can.state == CAN_STATE_BUS_OFF)
+ return 0;
+@@ -587,9 +599,14 @@ static int pcan_usb_fd_decode_error(struct pcan_usb_fd_if *usb_if,
+ struct pucan_msg *rx_msg)
+ {
+ struct pucan_error_msg *er = (struct pucan_error_msg *)rx_msg;
+- struct peak_usb_device *dev = usb_if->dev[pucan_ermsg_get_channel(er)];
+- struct pcan_usb_fd_device *pdev =
+- container_of(dev, struct pcan_usb_fd_device, dev);
++ struct pcan_usb_fd_device *pdev;
++ struct peak_usb_device *dev;
++
++ if (pucan_ermsg_get_channel(er) >= ARRAY_SIZE(usb_if->dev))
++ return -EINVAL;
++
++ dev = usb_if->dev[pucan_ermsg_get_channel(er)];
++ pdev = container_of(dev, struct pcan_usb_fd_device, dev);
+
+ /* keep a trace of tx and rx error counters for later use */
+ pdev->bec.txerr = er->tx_err_cnt;
+@@ -603,11 +620,17 @@ static int pcan_usb_fd_decode_overrun(struct pcan_usb_fd_if *usb_if,
+ struct pucan_msg *rx_msg)
+ {
+ struct pcan_ufd_ovr_msg *ov = (struct pcan_ufd_ovr_msg *)rx_msg;
+- struct peak_usb_device *dev = usb_if->dev[pufd_omsg_get_channel(ov)];
+- struct net_device *netdev = dev->netdev;
++ struct peak_usb_device *dev;
++ struct net_device *netdev;
+ struct can_frame *cf;
+ struct sk_buff *skb;
+
++ if (pufd_omsg_get_channel(ov) >= ARRAY_SIZE(usb_if->dev))
++ return -EINVAL;
++
++ dev = usb_if->dev[pufd_omsg_get_channel(ov)];
++ netdev = dev->netdev;
++
+ /* allocate an skb to store the error frame */
+ skb = alloc_can_err_skb(netdev, &cf);
+ if (!skb)
+@@ -724,6 +747,9 @@ static int pcan_usb_fd_encode_msg(struct peak_usb_device *dev,
+ u16 tx_msg_size, tx_msg_flags;
+ u8 can_dlc;
+
++ if (cfd->len > CANFD_MAX_DLEN)
++ return -EINVAL;
++
+ tx_msg_size = ALIGN(sizeof(struct pucan_tx_msg) + cfd->len, 4);
+ tx_msg->size = cpu_to_le16(tx_msg_size);
+ tx_msg->type = cpu_to_le16(PUCAN_MSG_CAN_TX);
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index 208341541087e..085fdceb3821b 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -672,14 +672,12 @@ clean_up:
+ static int lan743x_dp_write(struct lan743x_adapter *adapter,
+ u32 select, u32 addr, u32 length, u32 *buf)
+ {
+- int ret = -EIO;
+ u32 dp_sel;
+ int i;
+
+- mutex_lock(&adapter->dp_lock);
+ if (lan743x_csr_wait_for_bit(adapter, DP_SEL, DP_SEL_DPRDY_,
+ 1, 40, 100, 100))
+- goto unlock;
++ return -EIO;
+ dp_sel = lan743x_csr_read(adapter, DP_SEL);
+ dp_sel &= ~DP_SEL_MASK_;
+ dp_sel |= select;
+@@ -691,13 +689,10 @@ static int lan743x_dp_write(struct lan743x_adapter *adapter,
+ lan743x_csr_write(adapter, DP_CMD, DP_CMD_WRITE_);
+ if (lan743x_csr_wait_for_bit(adapter, DP_SEL, DP_SEL_DPRDY_,
+ 1, 40, 100, 100))
+- goto unlock;
++ return -EIO;
+ }
+- ret = 0;
+
+-unlock:
+- mutex_unlock(&adapter->dp_lock);
+- return ret;
++ return 0;
+ }
+
+ static u32 lan743x_mac_mii_access(u16 id, u16 index, int read)
+@@ -2679,7 +2674,6 @@ static int lan743x_hardware_init(struct lan743x_adapter *adapter,
+
+ adapter->intr.irq = adapter->pdev->irq;
+ lan743x_csr_write(adapter, INT_EN_CLR, 0xFFFFFFFF);
+- mutex_init(&adapter->dp_lock);
+
+ ret = lan743x_gpio_init(adapter);
+ if (ret)
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.h b/drivers/net/ethernet/microchip/lan743x_main.h
+index 2d6eea18973e8..77273be2d1ee0 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.h
++++ b/drivers/net/ethernet/microchip/lan743x_main.h
+@@ -702,9 +702,6 @@ struct lan743x_adapter {
+ struct lan743x_csr csr;
+ struct lan743x_intr intr;
+
+- /* lock, used to prevent concurrent access to data port */
+- struct mutex dp_lock;
+-
+ struct lan743x_gpio gpio;
+ struct lan743x_ptp ptp;
+
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 1555c0dae490b..c7ce167c67a08 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -6274,7 +6274,8 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp,
+ opts[1] |= transport_offset << TCPHO_SHIFT;
+ } else {
+ if (unlikely(rtl_test_hw_pad_bug(tp, skb)))
+- return !eth_skb_pad(skb);
++ /* eth_skb_pad would free the skb on error */
++ return !__skb_put_padto(skb, ETH_ZLEN, false);
+ }
+
+ return true;
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index b55eeb8f8fa3a..93899a7be9c57 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -336,8 +336,7 @@ static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
+ return ret;
+ }
+
+-static int vrf_finish_direct(struct net *net, struct sock *sk,
+- struct sk_buff *skb)
++static void vrf_finish_direct(struct sk_buff *skb)
+ {
+ struct net_device *vrf_dev = skb->dev;
+
+@@ -356,7 +355,8 @@ static int vrf_finish_direct(struct net *net, struct sock *sk,
+ skb_pull(skb, ETH_HLEN);
+ }
+
+- return 1;
++ /* reset skb device */
++ nf_reset(skb);
+ }
+
+ #if IS_ENABLED(CONFIG_IPV6)
+@@ -435,15 +435,41 @@ static struct sk_buff *vrf_ip6_out_redirect(struct net_device *vrf_dev,
+ return skb;
+ }
+
++static int vrf_output6_direct_finish(struct net *net, struct sock *sk,
++ struct sk_buff *skb)
++{
++ vrf_finish_direct(skb);
++
++ return vrf_ip6_local_out(net, sk, skb);
++}
++
+ static int vrf_output6_direct(struct net *net, struct sock *sk,
+ struct sk_buff *skb)
+ {
++ int err = 1;
++
+ skb->protocol = htons(ETH_P_IPV6);
+
+- return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
+- net, sk, skb, NULL, skb->dev,
+- vrf_finish_direct,
+- !(IPCB(skb)->flags & IPSKB_REROUTED));
++ if (!(IPCB(skb)->flags & IPSKB_REROUTED))
++ err = nf_hook(NFPROTO_IPV6, NF_INET_POST_ROUTING, net, sk, skb,
++ NULL, skb->dev, vrf_output6_direct_finish);
++
++ if (likely(err == 1))
++ vrf_finish_direct(skb);
++
++ return err;
++}
++
++static int vrf_ip6_out_direct_finish(struct net *net, struct sock *sk,
++ struct sk_buff *skb)
++{
++ int err;
++
++ err = vrf_output6_direct(net, sk, skb);
++ if (likely(err == 1))
++ err = vrf_ip6_local_out(net, sk, skb);
++
++ return err;
+ }
+
+ static struct sk_buff *vrf_ip6_out_direct(struct net_device *vrf_dev,
+@@ -456,18 +482,15 @@ static struct sk_buff *vrf_ip6_out_direct(struct net_device *vrf_dev,
+ skb->dev = vrf_dev;
+
+ err = nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, sk,
+- skb, NULL, vrf_dev, vrf_output6_direct);
++ skb, NULL, vrf_dev, vrf_ip6_out_direct_finish);
+
+ if (likely(err == 1))
+ err = vrf_output6_direct(net, sk, skb);
+
+- /* reset skb device */
+ if (likely(err == 1))
+- nf_reset(skb);
+- else
+- skb = NULL;
++ return skb;
+
+- return skb;
++ return NULL;
+ }
+
+ static struct sk_buff *vrf_ip6_out(struct net_device *vrf_dev,
+@@ -649,15 +672,41 @@ static struct sk_buff *vrf_ip_out_redirect(struct net_device *vrf_dev,
+ return skb;
+ }
+
++static int vrf_output_direct_finish(struct net *net, struct sock *sk,
++ struct sk_buff *skb)
++{
++ vrf_finish_direct(skb);
++
++ return vrf_ip_local_out(net, sk, skb);
++}
++
+ static int vrf_output_direct(struct net *net, struct sock *sk,
+ struct sk_buff *skb)
+ {
++ int err = 1;
++
+ skb->protocol = htons(ETH_P_IP);
+
+- return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
+- net, sk, skb, NULL, skb->dev,
+- vrf_finish_direct,
+- !(IPCB(skb)->flags & IPSKB_REROUTED));
++ if (!(IPCB(skb)->flags & IPSKB_REROUTED))
++ err = nf_hook(NFPROTO_IPV4, NF_INET_POST_ROUTING, net, sk, skb,
++ NULL, skb->dev, vrf_output_direct_finish);
++
++ if (likely(err == 1))
++ vrf_finish_direct(skb);
++
++ return err;
++}
++
++static int vrf_ip_out_direct_finish(struct net *net, struct sock *sk,
++ struct sk_buff *skb)
++{
++ int err;
++
++ err = vrf_output_direct(net, sk, skb);
++ if (likely(err == 1))
++ err = vrf_ip_local_out(net, sk, skb);
++
++ return err;
+ }
+
+ static struct sk_buff *vrf_ip_out_direct(struct net_device *vrf_dev,
+@@ -670,18 +719,15 @@ static struct sk_buff *vrf_ip_out_direct(struct net_device *vrf_dev,
+ skb->dev = vrf_dev;
+
+ err = nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, sk,
+- skb, NULL, vrf_dev, vrf_output_direct);
++ skb, NULL, vrf_dev, vrf_ip_out_direct_finish);
+
+ if (likely(err == 1))
+ err = vrf_output_direct(net, sk, skb);
+
+- /* reset skb device */
+ if (likely(err == 1))
+- nf_reset(skb);
+- else
+- skb = NULL;
++ return skb;
+
+- return skb;
++ return NULL;
+ }
+
+ static struct sk_buff *vrf_ip_out(struct net_device *vrf_dev,
+diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c
+index f6b000ddcd151..b7bfc0caa5dc8 100644
+--- a/drivers/net/wan/cosa.c
++++ b/drivers/net/wan/cosa.c
+@@ -902,6 +902,7 @@ static ssize_t cosa_write(struct file *file,
+ chan->tx_status = 1;
+ spin_unlock_irqrestore(&cosa->lock, flags);
+ up(&chan->wsem);
++ kfree(kbuf);
+ return -ERESTARTSYS;
+ }
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index f19393e584dc9..d567fbe79cffa 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -973,7 +973,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
+ struct ath_htc_rx_status *rxstatus;
+ struct ath_rx_status rx_stats;
+ bool decrypt_error = false;
+- __be16 rs_datalen;
++ u16 rs_datalen;
+ bool is_phyerr;
+
+ if (skb->len < HTC_RX_FRAME_HEADER_SIZE) {
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index c42aebba35ab8..30806dd357350 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -975,11 +975,13 @@ EXPORT_SYMBOL_GPL(of_dma_get_range);
+ */
+ bool of_dma_is_coherent(struct device_node *np)
+ {
+- struct device_node *node = of_node_get(np);
++ struct device_node *node;
+
+ if (IS_ENABLED(CONFIG_OF_DMA_DEFAULT_COHERENT))
+ return true;
+
++ node = of_node_get(np);
++
+ while (node) {
+ if (of_property_read_bool(node, "dma-coherent")) {
+ of_node_put(node);
+diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed.c b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
+index aefe3c33dffd8..8dec302dc067a 100644
+--- a/drivers/pinctrl/aspeed/pinctrl-aspeed.c
++++ b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
+@@ -458,13 +458,14 @@ int aspeed_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned int function,
+ static bool aspeed_expr_is_gpio(const struct aspeed_sig_expr *expr)
+ {
+ /*
+- * The signal type is GPIO if the signal name has "GPIO" as a prefix.
++ * The signal type is GPIO if the signal name has "GPI" as a prefix.
+ * strncmp (rather than strcmp) is used to implement the prefix
+ * requirement.
+ *
+- * expr->signal might look like "GPIOT3" in the GPIO case.
++ * expr->signal might look like "GPIOB1" in the GPIO case.
++ * expr->signal might look like "GPIT0" in the GPI case.
+ */
+- return strncmp(expr->signal, "GPIO", 4) == 0;
++ return strncmp(expr->signal, "GPI", 3) == 0;
+ }
+
+ static bool aspeed_gpio_in_exprs(const struct aspeed_sig_expr **exprs)
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
+index 89ff2795a8b55..5e0adb00b4307 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.c
++++ b/drivers/pinctrl/intel/pinctrl-intel.c
+@@ -621,6 +621,10 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned pin,
+
+ value |= PADCFG1_TERM_UP;
+
++ /* Set default strength value in case none is given */
++ if (arg == 1)
++ arg = 5000;
++
+ switch (arg) {
+ case 20000:
+ value |= PADCFG1_TERM_20K << PADCFG1_TERM_SHIFT;
+@@ -643,6 +647,10 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned pin,
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+ value &= ~(PADCFG1_TERM_UP | PADCFG1_TERM_MASK);
+
++ /* Set default strength value in case none is given */
++ if (arg == 1)
++ arg = 5000;
++
+ switch (arg) {
+ case 20000:
+ value |= PADCFG1_TERM_20K << PADCFG1_TERM_SHIFT;
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index b1ffdd3f6d076..d6255049e5196 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -157,7 +157,7 @@ static int amd_gpio_set_debounce(struct gpio_chip *gc, unsigned offset,
+ pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
+ pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
+ } else if (debounce < 250000) {
+- time = debounce / 15600;
++ time = debounce / 15625;
+ pin_reg |= time & DB_TMR_OUT_MASK;
+ pin_reg &= ~BIT(DB_TMR_OUT_UNIT_OFF);
+ pin_reg |= BIT(DB_TMR_LARGE_OFF);
+@@ -167,14 +167,14 @@ static int amd_gpio_set_debounce(struct gpio_chip *gc, unsigned offset,
+ pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
+ pin_reg |= BIT(DB_TMR_LARGE_OFF);
+ } else {
+- pin_reg &= ~DB_CNTRl_MASK;
++ pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
+ ret = -EINVAL;
+ }
+ } else {
+ pin_reg &= ~BIT(DB_TMR_OUT_UNIT_OFF);
+ pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
+ pin_reg &= ~DB_TMR_OUT_MASK;
+- pin_reg &= ~DB_CNTRl_MASK;
++ pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
+ }
+ writel(pin_reg, gpio_dev->base + offset * 4);
+ raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index c290c89421314..ad5235ca8e4ee 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -3405,6 +3405,8 @@ static int _regulator_get_voltage(struct regulator_dev *rdev)
+ ret = rdev->desc->fixed_uV;
+ } else if (rdev->supply) {
+ ret = _regulator_get_voltage(rdev->supply->rdev);
++ } else if (rdev->supply_name) {
++ return -EPROBE_DEFER;
+ } else {
+ return -EINVAL;
+ }
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index c95c782b93a53..60c48dc5d9453 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -672,8 +672,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ rcu_read_lock();
+ list_for_each_entry_rcu(h,
+ &tmp_pg->dh_list, node) {
+- /* h->sdev should always be valid */
+- BUG_ON(!h->sdev);
++ if (!h->sdev)
++ continue;
+ h->sdev->access_state = desc[0];
+ }
+ rcu_read_unlock();
+@@ -719,7 +719,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ pg->expiry = 0;
+ rcu_read_lock();
+ list_for_each_entry_rcu(h, &pg->dh_list, node) {
+- BUG_ON(!h->sdev);
++ if (!h->sdev)
++ continue;
+ h->sdev->access_state =
+ (pg->state & SCSI_ACCESS_STATE_MASK);
+ if (pg->pref)
+@@ -1160,7 +1161,6 @@ static void alua_bus_detach(struct scsi_device *sdev)
+ spin_lock(&h->pg_lock);
+ pg = rcu_dereference_protected(h->pg, lockdep_is_held(&h->pg_lock));
+ rcu_assign_pointer(h->pg, NULL);
+- h->sdev = NULL;
+ spin_unlock(&h->pg_lock);
+ if (pg) {
+ spin_lock_irq(&pg->lock);
+@@ -1169,6 +1169,7 @@ static void alua_bus_detach(struct scsi_device *sdev)
+ kref_put(&pg->kref, release_port_group);
+ }
+ sdev->handler_data = NULL;
++ synchronize_rcu();
+ kfree(h);
+ }
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 11de2198bb87d..0fe21cbdf0ca7 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -8781,7 +8781,7 @@ reinit_after_soft_reset:
+ /* hook into SCSI subsystem */
+ rc = hpsa_scsi_add_host(h);
+ if (rc)
+- goto clean7; /* perf, sg, cmd, irq, shost, pci, lu, aer/h */
++ goto clean8; /* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */
+
+ /* Monitor the controller for firmware lockups */
+ h->heartbeat_sample_interval = HEARTBEAT_SAMPLE_INTERVAL;
+@@ -8796,6 +8796,8 @@ reinit_after_soft_reset:
+ HPSA_EVENT_MONITOR_INTERVAL);
+ return 0;
+
++clean8: /* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */
++ kfree(h->lastlogicals);
+ clean7: /* perf, sg, cmd, irq, shost, pci, lu, aer/h */
+ hpsa_free_performant_mode(h);
+ h->access.set_intr_mask(h, HPSA_INTR_OFF);
+diff --git a/drivers/staging/erofs/inode.c b/drivers/staging/erofs/inode.c
+index 7448744cc5159..12a5be95457f8 100644
+--- a/drivers/staging/erofs/inode.c
++++ b/drivers/staging/erofs/inode.c
+@@ -53,11 +53,9 @@ static int read_inode(struct inode *inode, void *data)
+ i_gid_write(inode, le32_to_cpu(v2->i_gid));
+ set_nlink(inode, le32_to_cpu(v2->i_nlink));
+
+- /* ns timestamp */
+- inode->i_mtime.tv_sec = inode->i_ctime.tv_sec =
+- le64_to_cpu(v2->i_ctime);
+- inode->i_mtime.tv_nsec = inode->i_ctime.tv_nsec =
+- le32_to_cpu(v2->i_ctime_nsec);
++ /* extended inode has its own timestamp */
++ inode->i_ctime.tv_sec = le64_to_cpu(v2->i_ctime);
++ inode->i_ctime.tv_nsec = le32_to_cpu(v2->i_ctime_nsec);
+
+ inode->i_size = le64_to_cpu(v2->i_size);
+ } else if (__inode_version(advise) == EROFS_INODE_LAYOUT_V1) {
+@@ -83,11 +81,9 @@ static int read_inode(struct inode *inode, void *data)
+ i_gid_write(inode, le16_to_cpu(v1->i_gid));
+ set_nlink(inode, le16_to_cpu(v1->i_nlink));
+
+- /* use build time to derive all file time */
+- inode->i_mtime.tv_sec = inode->i_ctime.tv_sec =
+- sbi->build_time;
+- inode->i_mtime.tv_nsec = inode->i_ctime.tv_nsec =
+- sbi->build_time_nsec;
++ /* use build time for compact inodes */
++ inode->i_ctime.tv_sec = sbi->build_time;
++ inode->i_ctime.tv_nsec = sbi->build_time_nsec;
+
+ inode->i_size = le32_to_cpu(v1->i_size);
+ } else {
+@@ -97,6 +93,11 @@ static int read_inode(struct inode *inode, void *data)
+ return -EIO;
+ }
+
++ inode->i_mtime.tv_sec = inode->i_ctime.tv_sec;
++ inode->i_atime.tv_sec = inode->i_ctime.tv_sec;
++ inode->i_mtime.tv_nsec = inode->i_ctime.tv_nsec;
++ inode->i_atime.tv_nsec = inode->i_ctime.tv_nsec;
++
+ /* measure inode.i_blocks as the generic filesystem */
+ inode->i_blocks = ((inode->i_size - 1) >> 9) + 1;
+ return 0;
+diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
+index d436a1534fc2b..384623c49cfee 100644
+--- a/drivers/thunderbolt/nhi.c
++++ b/drivers/thunderbolt/nhi.c
+@@ -408,12 +408,23 @@ static int ring_request_msix(struct tb_ring *ring, bool no_suspend)
+
+ ring->vector = ret;
+
+- ring->irq = pci_irq_vector(ring->nhi->pdev, ring->vector);
+- if (ring->irq < 0)
+- return ring->irq;
++ ret = pci_irq_vector(ring->nhi->pdev, ring->vector);
++ if (ret < 0)
++ goto err_ida_remove;
++
++ ring->irq = ret;
+
+ irqflags = no_suspend ? IRQF_NO_SUSPEND : 0;
+- return request_irq(ring->irq, ring_msix, irqflags, "thunderbolt", ring);
++ ret = request_irq(ring->irq, ring_msix, irqflags, "thunderbolt", ring);
++ if (ret)
++ goto err_ida_remove;
++
++ return 0;
++
++err_ida_remove:
++ ida_simple_remove(&nhi->msix_ida, ring->vector);
++
++ return ret;
+ }
+
+ static void ring_release_msix(struct tb_ring *ring)
+diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c
+index befe754906979..4eb51a123a6fd 100644
+--- a/drivers/thunderbolt/xdomain.c
++++ b/drivers/thunderbolt/xdomain.c
+@@ -774,6 +774,7 @@ static void enumerate_services(struct tb_xdomain *xd)
+
+ id = ida_simple_get(&xd->service_ids, 0, 0, GFP_KERNEL);
+ if (id < 0) {
++ kfree(svc->key);
+ kfree(svc);
+ break;
+ }
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index 3926be6591471..0e3e16c51d3a9 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -413,10 +413,10 @@ static int uio_get_minor(struct uio_device *idev)
+ return retval;
+ }
+
+-static void uio_free_minor(struct uio_device *idev)
++static void uio_free_minor(unsigned long minor)
+ {
+ mutex_lock(&minor_lock);
+- idr_remove(&uio_idr, idev->minor);
++ idr_remove(&uio_idr, minor);
+ mutex_unlock(&minor_lock);
+ }
+
+@@ -988,7 +988,7 @@ err_request_irq:
+ err_uio_dev_add_attributes:
+ device_del(&idev->dev);
+ err_device_create:
+- uio_free_minor(idev);
++ uio_free_minor(idev->minor);
+ put_device(&idev->dev);
+ return ret;
+ }
+@@ -1002,11 +1002,13 @@ EXPORT_SYMBOL_GPL(__uio_register_device);
+ void uio_unregister_device(struct uio_info *info)
+ {
+ struct uio_device *idev;
++ unsigned long minor;
+
+ if (!info || !info->uio_dev)
+ return;
+
+ idev = info->uio_dev;
++ minor = idev->minor;
+
+ mutex_lock(&idev->info_lock);
+ uio_dev_del_attributes(idev);
+@@ -1019,7 +1021,7 @@ void uio_unregister_device(struct uio_info *info)
+
+ device_unregister(&idev->dev);
+
+- uio_free_minor(idev);
++ uio_free_minor(minor);
+
+ return;
+ }
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 08751d1a765ff..e0d8da4e3967b 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1738,6 +1738,15 @@ static const struct usb_device_id acm_ids[] = {
+ { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */
+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ },
++ { USB_DEVICE(0x045b, 0x023c), /* Renesas USB Download mode */
++ .driver_info = DISABLE_ECHO, /* Don't echo banner */
++ },
++ { USB_DEVICE(0x045b, 0x0248), /* Renesas USB Download mode */
++ .driver_info = DISABLE_ECHO, /* Don't echo banner */
++ },
++ { USB_DEVICE(0x045b, 0x024D), /* Renesas USB Download mode */
++ .driver_info = DISABLE_ECHO, /* Don't echo banner */
++ },
+ { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */
+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ },
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index f0d2f0a4e9908..6ab5c48f5d873 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2386,6 +2386,11 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+ ret = dwc3_gadget_ep_reclaim_trb_linear(dep, req, event,
+ status);
+
++ req->request.actual = req->request.length - req->remaining;
++
++ if (!dwc3_gadget_ep_request_completed(req))
++ goto out;
++
+ if (req->needs_extra_trb) {
+ unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc);
+
+@@ -2401,13 +2406,6 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+ req->needs_extra_trb = false;
+ }
+
+- req->request.actual = req->request.length - req->remaining;
+-
+- if (!dwc3_gadget_ep_request_completed(req)) {
+- __dwc3_gadget_kick_transfer(dep);
+- goto out;
+- }
+-
+ dwc3_gadget_giveback(dep, req, status);
+
+ out:
+@@ -2430,6 +2428,24 @@ static void dwc3_gadget_ep_cleanup_completed_requests(struct dwc3_ep *dep,
+ }
+ }
+
++static bool dwc3_gadget_ep_should_continue(struct dwc3_ep *dep)
++{
++ struct dwc3_request *req;
++
++ if (!list_empty(&dep->pending_list))
++ return true;
++
++ /*
++ * We only need to check the first entry of the started list. We can
++ * assume the completed requests are removed from the started list.
++ */
++ req = next_request(&dep->started_list);
++ if (!req)
++ return false;
++
++ return !dwc3_gadget_ep_request_completed(req);
++}
++
+ static void dwc3_gadget_endpoint_frame_from_event(struct dwc3_ep *dep,
+ const struct dwc3_event_depevt *event)
+ {
+@@ -2459,6 +2475,8 @@ static void dwc3_gadget_endpoint_transfer_in_progress(struct dwc3_ep *dep,
+
+ if (stop)
+ dwc3_stop_active_transfer(dep, true, true);
++ else if (dwc3_gadget_ep_should_continue(dep))
++ __dwc3_gadget_kick_transfer(dep);
+
+ /*
+ * WORKAROUND: This is the 2nd half of U1/U2 -> U0 workaround.
+diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c
+index c3721225b61ed..b706ad3034bc1 100644
+--- a/drivers/usb/gadget/udc/goku_udc.c
++++ b/drivers/usb/gadget/udc/goku_udc.c
+@@ -1757,6 +1757,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto err;
+ }
+
++ pci_set_drvdata(pdev, dev);
+ spin_lock_init(&dev->lock);
+ dev->pdev = pdev;
+ dev->gadget.ops = &goku_ops;
+@@ -1790,7 +1791,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ }
+ dev->regs = (struct goku_udc_regs __iomem *) base;
+
+- pci_set_drvdata(pdev, dev);
+ INFO(dev, "%s\n", driver_desc);
+ INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr());
+ INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base);
+diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c
+index 3c4abb5a1c3fc..73aba464b66ab 100644
+--- a/drivers/usb/host/xhci-histb.c
++++ b/drivers/usb/host/xhci-histb.c
+@@ -241,7 +241,7 @@ static int xhci_histb_probe(struct platform_device *pdev)
+ /* Initialize dma_mask and coherent_dma_mask to 32-bits */
+ ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
+ if (ret)
+- return ret;
++ goto disable_pm;
+
+ hcd = usb_create_hcd(driver, dev, dev_name(dev));
+ if (!hcd) {
+diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
+index c0cd824be2b76..460760d0becfe 100644
+--- a/drivers/vfio/platform/vfio_platform_common.c
++++ b/drivers/vfio/platform/vfio_platform_common.c
+@@ -273,7 +273,7 @@ static int vfio_platform_open(void *device_data)
+
+ ret = pm_runtime_get_sync(vdev->device);
+ if (ret < 0)
+- goto err_pm;
++ goto err_rst;
+
+ ret = vfio_platform_call_reset(vdev, &extra_dbg);
+ if (ret && vdev->reset_required) {
+@@ -290,7 +290,6 @@ static int vfio_platform_open(void *device_data)
+
+ err_rst:
+ pm_runtime_put(vdev->device);
+-err_pm:
+ vfio_platform_irq_cleanup(vdev);
+ err_irq:
+ vfio_platform_regions_cleanup(vdev);
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index 36c0490156ac5..4d1d2657d70cd 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -54,6 +54,17 @@ int btrfs_init_dev_replace(struct btrfs_fs_info *fs_info)
+ ret = btrfs_search_slot(NULL, dev_root, &key, path, 0, 0);
+ if (ret) {
+ no_valid_dev_replace_entry_found:
++ /*
++ * We don't have a replace item or it's corrupted. If there is
++ * a replace target, fail the mount.
++ */
++ if (btrfs_find_device(fs_info->fs_devices,
++ BTRFS_DEV_REPLACE_DEVID, NULL, NULL, false)) {
++ btrfs_err(fs_info,
++ "found replace target device without a valid replace item");
++ ret = -EUCLEAN;
++ goto out;
++ }
+ ret = 0;
+ dev_replace->replace_state =
+ BTRFS_DEV_REPLACE_ITEM_STATE_NEVER_STARTED;
+@@ -107,8 +118,19 @@ no_valid_dev_replace_entry_found:
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_NEVER_STARTED:
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_FINISHED:
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_CANCELED:
+- dev_replace->srcdev = NULL;
+- dev_replace->tgtdev = NULL;
++ /*
++ * We don't have an active replace item but if there is a
++ * replace target, fail the mount.
++ */
++ if (btrfs_find_device(fs_info->fs_devices,
++ BTRFS_DEV_REPLACE_DEVID, NULL, NULL, false)) {
++ btrfs_err(fs_info,
++ "replace devid present without an active replace item");
++ ret = -EUCLEAN;
++ } else {
++ dev_replace->srcdev = NULL;
++ dev_replace->tgtdev = NULL;
++ }
+ break;
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED:
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED:
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 301111922a1a2..dabf153843e90 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -3913,6 +3913,10 @@ retry:
+ if (!ret) {
+ free_extent_buffer(eb);
+ continue;
++ } else if (ret < 0) {
++ done = 1;
++ free_extent_buffer(eb);
++ break;
+ }
+
+ ret = write_one_eb(eb, fs_info, wbc, &epd);
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 01a90fa03c24f..f3658d6ea6571 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1239,6 +1239,7 @@ static int cluster_pages_for_defrag(struct inode *inode,
+ u64 page_start;
+ u64 page_end;
+ u64 page_cnt;
++ u64 start = (u64)start_index << PAGE_SHIFT;
+ int ret;
+ int i;
+ int i_done;
+@@ -1255,8 +1256,7 @@ static int cluster_pages_for_defrag(struct inode *inode,
+ page_cnt = min_t(u64, (u64)num_pages, (u64)file_end - start_index + 1);
+
+ ret = btrfs_delalloc_reserve_space(inode, &data_reserved,
+- start_index << PAGE_SHIFT,
+- page_cnt << PAGE_SHIFT);
++ start, page_cnt << PAGE_SHIFT);
+ if (ret)
+ return ret;
+ i_done = 0;
+@@ -1346,8 +1346,7 @@ again:
+ btrfs_mod_outstanding_extents(BTRFS_I(inode), 1);
+ spin_unlock(&BTRFS_I(inode)->lock);
+ btrfs_delalloc_release_space(inode, data_reserved,
+- start_index << PAGE_SHIFT,
+- (page_cnt - i_done) << PAGE_SHIFT, true);
++ start, (page_cnt - i_done) << PAGE_SHIFT, true);
+ }
+
+
+@@ -1374,8 +1373,7 @@ out:
+ put_page(pages[i]);
+ }
+ btrfs_delalloc_release_space(inode, data_reserved,
+- start_index << PAGE_SHIFT,
+- page_cnt << PAGE_SHIFT, true);
++ start, page_cnt << PAGE_SHIFT, true);
+ btrfs_delalloc_release_extents(BTRFS_I(inode), page_cnt << PAGE_SHIFT);
+ extent_changeset_free(data_reserved);
+ return ret;
+@@ -4217,6 +4215,8 @@ process_slot:
+ ret = -EINTR;
+ goto out;
+ }
++
++ cond_resched();
+ }
+ ret = 0;
+
+diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
+index 5dec52bd2897b..b26739d0e991b 100644
+--- a/fs/btrfs/ref-verify.c
++++ b/fs/btrfs/ref-verify.c
+@@ -854,6 +854,7 @@ int btrfs_ref_tree_mod(struct btrfs_root *root, u64 bytenr, u64 num_bytes,
+ "dropping a ref for a root that doesn't have a ref on the block");
+ dump_block_entry(fs_info, be);
+ dump_ref_action(fs_info, ra);
++ kfree(ref);
+ kfree(ra);
+ goto out_unlock;
+ }
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 05daa2b816c31..7e000d061813c 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -974,22 +974,13 @@ again:
+ continue;
+ }
+
+- if (device->devid == BTRFS_DEV_REPLACE_DEVID) {
+- /*
+- * In the first step, keep the device which has
+- * the correct fsid and the devid that is used
+- * for the dev_replace procedure.
+- * In the second step, the dev_replace state is
+- * read from the device tree and it is known
+- * whether the procedure is really active or
+- * not, which means whether this device is
+- * used or whether it should be removed.
+- */
+- if (step == 0 || test_bit(BTRFS_DEV_STATE_REPLACE_TGT,
+- &device->dev_state)) {
+- continue;
+- }
+- }
++ /*
++ * We have already validated the presence of BTRFS_DEV_REPLACE_DEVID,
++ * in btrfs_init_dev_replace() so just continue.
++ */
++ if (device->devid == BTRFS_DEV_REPLACE_DEVID)
++ continue;
++
+ if (device->bdev) {
+ blkdev_put(device->bdev, device->mode);
+ device->bdev = NULL;
+@@ -998,9 +989,6 @@ again:
+ if (test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state)) {
+ list_del_init(&device->dev_alloc_list);
+ clear_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state);
+- if (!test_bit(BTRFS_DEV_STATE_REPLACE_TGT,
+- &device->dev_state))
+- fs_devices->rw_devices--;
+ }
+ list_del_init(&device->dev_list);
+ fs_devices->num_devices--;
+@@ -2459,9 +2447,6 @@ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *device_path
+ btrfs_set_super_num_devices(fs_info->super_copy,
+ orig_super_num_devices + 1);
+
+- /* add sysfs device entry */
+- btrfs_sysfs_add_device_link(fs_devices, device);
+-
+ /*
+ * we've got more storage, clear any full flags on the space
+ * infos
+@@ -2469,6 +2454,10 @@ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *device_path
+ btrfs_clear_space_info_full(fs_info);
+
+ mutex_unlock(&fs_info->chunk_mutex);
++
++ /* Add sysfs device entry */
++ btrfs_sysfs_add_device_link(fs_devices, device);
++
+ mutex_unlock(&fs_devices->device_list_mutex);
+
+ if (seeding_dev) {
+diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
+index a2b2355e7f019..9986817532b10 100644
+--- a/fs/cifs/cifs_unicode.c
++++ b/fs/cifs/cifs_unicode.c
+@@ -501,7 +501,13 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
+ else if (map_chars == SFM_MAP_UNI_RSVD) {
+ bool end_of_string;
+
+- if (i == srclen - 1)
++ /**
++ * Remap spaces and periods found at the end of every
++ * component of the path. The special cases of '.' and
++ * '..' do not need to be dealt with explicitly because
++ * they are addressed in namei.c:link_path_walk().
++ **/
++ if ((i == srclen - 1) || (source[i+1] == '\\'))
+ end_of_string = true;
+ else
+ end_of_string = false;
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 4572cb0579518..c952461876595 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1921,6 +1921,7 @@ int ext4_inline_data_truncate(struct inode *inode, int *has_inline)
+
+ ext4_write_lock_xattr(inode, &no_expand);
+ if (!ext4_has_inline_data(inode)) {
++ ext4_write_unlock_xattr(inode, &no_expand);
+ *has_inline = 0;
+ ext4_journal_stop(handle);
+ return 0;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 6338ca95d8b3a..ee96f504ed782 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1748,8 +1748,8 @@ static const struct mount_opts {
+ {Opt_noquota, (EXT4_MOUNT_QUOTA | EXT4_MOUNT_USRQUOTA |
+ EXT4_MOUNT_GRPQUOTA | EXT4_MOUNT_PRJQUOTA),
+ MOPT_CLEAR | MOPT_Q},
+- {Opt_usrjquota, 0, MOPT_Q},
+- {Opt_grpjquota, 0, MOPT_Q},
++ {Opt_usrjquota, 0, MOPT_Q | MOPT_STRING},
++ {Opt_grpjquota, 0, MOPT_Q | MOPT_STRING},
+ {Opt_offusrjquota, 0, MOPT_Q},
+ {Opt_offgrpjquota, 0, MOPT_Q},
+ {Opt_jqfmt_vfsold, QFMT_VFS_OLD, MOPT_QFMT},
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index c94c4ac1ae78b..de9b561b1c385 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -739,9 +739,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
+ }
+
+ gfs2_free_clones(rgd);
++ return_all_reservations(rgd);
+ kfree(rgd->rd_bits);
+ rgd->rd_bits = NULL;
+- return_all_reservations(rgd);
+ kmem_cache_free(gfs2_rgrpd_cachep, rgd);
+ }
+ }
+@@ -1387,6 +1387,9 @@ int gfs2_fitrim(struct file *filp, void __user *argp)
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
++ if (!test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags))
++ return -EROFS;
++
+ if (!blk_queue_discard(q))
+ return -EOPNOTSUPP;
+
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index a971862b186e3..22cd68bd8c9b0 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -934,6 +934,7 @@ restart:
+ gfs2_jindex_free(sdp);
+ /* Take apart glock structures and buffer lists */
+ gfs2_gl_hash_clear(sdp);
++ truncate_inode_pages_final(&sdp->sd_aspace);
+ gfs2_delete_debugfs_file(sdp);
+ /* Unmount the locking protocol */
+ gfs2_lm_unmount(sdp);
+diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
+index 2658d91c1f7b6..09bc2cf5f61cd 100644
+--- a/fs/ocfs2/super.c
++++ b/fs/ocfs2/super.c
+@@ -1747,6 +1747,7 @@ static void ocfs2_inode_init_once(void *data)
+
+ oi->ip_blkno = 0ULL;
+ oi->ip_clusters = 0;
++ oi->ip_next_orphan = NULL;
+
+ ocfs2_resv_init_once(&oi->ip_la_data_resv);
+
+diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
+index 1eb7933dac83e..b3a9043b0c9ee 100644
+--- a/fs/xfs/libxfs/xfs_alloc.c
++++ b/fs/xfs/libxfs/xfs_alloc.c
+@@ -2213,6 +2213,7 @@ xfs_defer_agfl_block(
+ new->xefi_startblock = XFS_AGB_TO_FSB(mp, agno, agbno);
+ new->xefi_blockcount = 1;
+ new->xefi_oinfo = *oinfo;
++ new->xefi_skip_discard = false;
+
+ trace_xfs_agfl_free_defer(mp, agno, 0, agbno, 1);
+
+diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h
+index 488dc8860fd7c..50242ba3cdb72 100644
+--- a/fs/xfs/libxfs/xfs_bmap.h
++++ b/fs/xfs/libxfs/xfs_bmap.h
+@@ -52,9 +52,9 @@ struct xfs_extent_free_item
+ {
+ xfs_fsblock_t xefi_startblock;/* starting fs block number */
+ xfs_extlen_t xefi_blockcount;/* number of blocks in extent */
++ bool xefi_skip_discard;
+ struct list_head xefi_list;
+ struct xfs_owner_info xefi_oinfo; /* extent owner */
+- bool xefi_skip_discard;
+ };
+
+ #define XFS_BMAP_MAX_NMAP 4
+diff --git a/fs/xfs/libxfs/xfs_rmap.c b/fs/xfs/libxfs/xfs_rmap.c
+index 245af452840ef..ab3e72e702f00 100644
+--- a/fs/xfs/libxfs/xfs_rmap.c
++++ b/fs/xfs/libxfs/xfs_rmap.c
+@@ -1387,7 +1387,7 @@ xfs_rmap_convert_shared(
+ * record for our insertion point. This will also give us the record for
+ * start block contiguity tests.
+ */
+- error = xfs_rmap_lookup_le_range(cur, bno, owner, offset, flags,
++ error = xfs_rmap_lookup_le_range(cur, bno, owner, offset, oldext,
+ &PREV, &i);
+ if (error)
+ goto done;
+diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
+index f79cf040d7450..77528f413286b 100644
+--- a/fs/xfs/libxfs/xfs_rmap_btree.c
++++ b/fs/xfs/libxfs/xfs_rmap_btree.c
+@@ -247,8 +247,8 @@ xfs_rmapbt_key_diff(
+ else if (y > x)
+ return -1;
+
+- x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset));
+- y = rec->rm_offset;
++ x = be64_to_cpu(kp->rm_offset);
++ y = xfs_rmap_irec_offset_pack(rec);
+ if (x > y)
+ return 1;
+ else if (y > x)
+@@ -279,8 +279,8 @@ xfs_rmapbt_diff_two_keys(
+ else if (y > x)
+ return -1;
+
+- x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset));
+- y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset));
++ x = be64_to_cpu(kp1->rm_offset);
++ y = be64_to_cpu(kp2->rm_offset);
+ if (x > y)
+ return 1;
+ else if (y > x)
+@@ -393,8 +393,8 @@ xfs_rmapbt_keys_inorder(
+ return 1;
+ else if (a > b)
+ return 0;
+- a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset));
+- b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset));
++ a = be64_to_cpu(k1->rmap.rm_offset);
++ b = be64_to_cpu(k2->rmap.rm_offset);
+ if (a <= b)
+ return 1;
+ return 0;
+@@ -423,8 +423,8 @@ xfs_rmapbt_recs_inorder(
+ return 1;
+ else if (a > b)
+ return 0;
+- a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset));
+- b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset));
++ a = be64_to_cpu(r1->rmap.rm_offset);
++ b = be64_to_cpu(r2->rmap.rm_offset);
+ if (a <= b)
+ return 1;
+ return 0;
+diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c
+index f84a58e523bc8..b05d65fd360b3 100644
+--- a/fs/xfs/scrub/bmap.c
++++ b/fs/xfs/scrub/bmap.c
+@@ -120,6 +120,8 @@ xchk_bmap_get_rmap(
+
+ if (info->whichfork == XFS_ATTR_FORK)
+ rflags |= XFS_RMAP_ATTR_FORK;
++ if (irec->br_state == XFS_EXT_UNWRITTEN)
++ rflags |= XFS_RMAP_UNWRITTEN;
+
+ /*
+ * CoW staging extents are owned (on disk) by the refcountbt, so
+diff --git a/fs/xfs/scrub/inode.c b/fs/xfs/scrub/inode.c
+index e386c9b0b4ab7..8d45d60832db9 100644
+--- a/fs/xfs/scrub/inode.c
++++ b/fs/xfs/scrub/inode.c
+@@ -131,8 +131,7 @@ xchk_inode_flags(
+ goto bad;
+
+ /* rt flags require rt device */
+- if ((flags & (XFS_DIFLAG_REALTIME | XFS_DIFLAG_RTINHERIT)) &&
+- !mp->m_rtdev_targp)
++ if ((flags & XFS_DIFLAG_REALTIME) && !mp->m_rtdev_targp)
+ goto bad;
+
+ /* new rt bitmap flag only valid for rbmino */
+diff --git a/fs/xfs/scrub/refcount.c b/fs/xfs/scrub/refcount.c
+index e8c82b026083e..76e4f16a9fab2 100644
+--- a/fs/xfs/scrub/refcount.c
++++ b/fs/xfs/scrub/refcount.c
+@@ -180,7 +180,6 @@ xchk_refcountbt_process_rmap_fragments(
+ */
+ INIT_LIST_HEAD(&worklist);
+ rbno = NULLAGBLOCK;
+- nr = 1;
+
+ /* Make sure the fragments actually /are/ in agbno order. */
+ bno = 0;
+@@ -194,15 +193,14 @@ xchk_refcountbt_process_rmap_fragments(
+ * Find all the rmaps that start at or before the refc extent,
+ * and put them on the worklist.
+ */
++ nr = 0;
+ list_for_each_entry_safe(frag, n, &refchk->fragments, list) {
+- if (frag->rm.rm_startblock > refchk->bno)
+- goto done;
++ if (frag->rm.rm_startblock > refchk->bno || nr > target_nr)
++ break;
+ bno = frag->rm.rm_startblock + frag->rm.rm_blockcount;
+ if (bno < rbno)
+ rbno = bno;
+ list_move_tail(&frag->list, &worklist);
+- if (nr == target_nr)
+- break;
+ nr++;
+ }
+
+diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
+index e427ad097e2ee..948ac1290121b 100644
+--- a/fs/xfs/xfs_iops.c
++++ b/fs/xfs/xfs_iops.c
+@@ -895,6 +895,16 @@ xfs_setattr_size(
+ error = iomap_zero_range(inode, oldsize, newsize - oldsize,
+ &did_zeroing, &xfs_iomap_ops);
+ } else {
++ /*
++ * iomap won't detect a dirty page over an unwritten block (or a
++ * cow block over a hole) and subsequently skips zeroing the
++ * newly post-EOF portion of the page. Flush the new EOF to
++ * convert the block before the pagecache truncate.
++ */
++ error = filemap_write_and_wait_range(inode->i_mapping, newsize,
++ newsize);
++ if (error)
++ return error;
+ error = iomap_truncate_page(inode, newsize, &did_zeroing,
+ &xfs_iomap_ops);
+ }
+diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c
+index f44c3599527d0..1c9bced3e8601 100644
+--- a/fs/xfs/xfs_pnfs.c
++++ b/fs/xfs/xfs_pnfs.c
+@@ -141,7 +141,7 @@ xfs_fs_map_blocks(
+ goto out_unlock;
+ error = invalidate_inode_pages2(inode->i_mapping);
+ if (WARN_ON_ONCE(error))
+- return error;
++ goto out_unlock;
+
+ end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + length);
+ offset_fsb = XFS_B_TO_FSBT(mp, offset);
+diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
+index b3379a97245c1..a34694e675c9a 100644
+--- a/include/linux/can/skb.h
++++ b/include/linux/can/skb.h
+@@ -61,21 +61,17 @@ static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk)
+ */
+ static inline struct sk_buff *can_create_echo_skb(struct sk_buff *skb)
+ {
+- if (skb_shared(skb)) {
+- struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
++ struct sk_buff *nskb;
+
+- if (likely(nskb)) {
+- can_skb_set_owner(nskb, skb->sk);
+- consume_skb(skb);
+- return nskb;
+- } else {
+- kfree_skb(skb);
+- return NULL;
+- }
++ nskb = skb_clone(skb, GFP_ATOMIC);
++ if (unlikely(!nskb)) {
++ kfree_skb(skb);
++ return NULL;
+ }
+
+- /* we can assume to have an unshared skb with proper owner */
+- return skb;
++ can_skb_set_owner(nskb, skb->sk);
++ consume_skb(skb);
++ return nskb;
+ }
+
+ #endif /* !_CAN_SKB_H */
+diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
+index 95ab5cc644226..45ff1330b3393 100644
+--- a/include/linux/netfilter_ipv4.h
++++ b/include/linux/netfilter_ipv4.h
+@@ -16,7 +16,7 @@ struct ip_rt_info {
+ u_int32_t mark;
+ };
+
+-int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned addr_type);
++int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb, unsigned addr_type);
+
+ struct nf_queue_entry;
+
+diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
+index c0dc4dd78887a..47a2de582f574 100644
+--- a/include/linux/netfilter_ipv6.h
++++ b/include/linux/netfilter_ipv6.h
+@@ -36,7 +36,7 @@ struct nf_ipv6_ops {
+ };
+
+ #ifdef CONFIG_NETFILTER
+-int ip6_route_me_harder(struct net *net, struct sk_buff *skb);
++int ip6_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb);
+ __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
+ unsigned int dataoff, u_int8_t protocol);
+
+diff --git a/include/linux/prandom.h b/include/linux/prandom.h
+index aa16e6468f91e..cc1e71334e53c 100644
+--- a/include/linux/prandom.h
++++ b/include/linux/prandom.h
+@@ -16,12 +16,44 @@ void prandom_bytes(void *buf, size_t nbytes);
+ void prandom_seed(u32 seed);
+ void prandom_reseed_late(void);
+
++#if BITS_PER_LONG == 64
++/*
++ * The core SipHash round function. Each line can be executed in
++ * parallel given enough CPU resources.
++ */
++#define PRND_SIPROUND(v0, v1, v2, v3) ( \
++ v0 += v1, v1 = rol64(v1, 13), v2 += v3, v3 = rol64(v3, 16), \
++ v1 ^= v0, v0 = rol64(v0, 32), v3 ^= v2, \
++ v0 += v3, v3 = rol64(v3, 21), v2 += v1, v1 = rol64(v1, 17), \
++ v3 ^= v0, v1 ^= v2, v2 = rol64(v2, 32) \
++)
++
++#define PRND_K0 (0x736f6d6570736575 ^ 0x6c7967656e657261)
++#define PRND_K1 (0x646f72616e646f6d ^ 0x7465646279746573)
++
++#elif BITS_PER_LONG == 32
++/*
++ * On 32-bit machines, we use HSipHash, a reduced-width version of SipHash.
++ * This is weaker, but 32-bit machines are not used for high-traffic
++ * applications, so there is less output for an attacker to analyze.
++ */
++#define PRND_SIPROUND(v0, v1, v2, v3) ( \
++ v0 += v1, v1 = rol32(v1, 5), v2 += v3, v3 = rol32(v3, 8), \
++ v1 ^= v0, v0 = rol32(v0, 16), v3 ^= v2, \
++ v0 += v3, v3 = rol32(v3, 7), v2 += v1, v1 = rol32(v1, 13), \
++ v3 ^= v0, v1 ^= v2, v2 = rol32(v2, 16) \
++)
++#define PRND_K0 0x6c796765
++#define PRND_K1 0x74656462
++
++#else
++#error Unsupported BITS_PER_LONG
++#endif
++
+ struct rnd_state {
+ __u32 s1, s2, s3, s4;
+ };
+
+-DECLARE_PER_CPU(struct rnd_state, net_rand_state);
+-
+ u32 prandom_u32_state(struct rnd_state *state);
+ void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
+ void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state);
+diff --git a/include/linux/time64.h b/include/linux/time64.h
+index 4a45aea0f96e9..8dbdf6cae3e8b 100644
+--- a/include/linux/time64.h
++++ b/include/linux/time64.h
+@@ -138,6 +138,10 @@ static inline bool timespec64_valid_settod(const struct timespec64 *ts)
+ */
+ static inline s64 timespec64_to_ns(const struct timespec64 *ts)
+ {
++ /* Prevent multiplication overflow */
++ if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
++ return KTIME_MAX;
++
+ return ((s64) ts->tv_sec * NSEC_PER_SEC) + ts->tv_nsec;
+ }
+
+diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
+index 2a8c41f12d450..6f7d4e977c5cc 100644
+--- a/kernel/dma/swiotlb.c
++++ b/kernel/dma/swiotlb.c
+@@ -239,6 +239,7 @@ int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
+ io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+ }
+ io_tlb_index = 0;
++ no_iotlb_memory = false;
+
+ if (verbose)
+ swiotlb_print_info();
+@@ -270,9 +271,11 @@ swiotlb_init(int verbose)
+ if (vstart && !swiotlb_init_with_tbl(vstart, io_tlb_nslabs, verbose))
+ return;
+
+- if (io_tlb_start)
++ if (io_tlb_start) {
+ memblock_free_early(io_tlb_start,
+ PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT));
++ io_tlb_start = 0;
++ }
+ pr_warn("Cannot allocate buffer");
+ no_iotlb_memory = true;
+ }
+@@ -376,6 +379,7 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
+ io_tlb_orig_addr[i] = INVALID_PHYS_ADDR;
+ }
+ io_tlb_index = 0;
++ no_iotlb_memory = false;
+
+ swiotlb_print_info();
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 8b94eb6437c18..b8b74a4a524c1 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5475,11 +5475,11 @@ static void perf_pmu_output_stop(struct perf_event *event);
+ static void perf_mmap_close(struct vm_area_struct *vma)
+ {
+ struct perf_event *event = vma->vm_file->private_data;
+-
+ struct ring_buffer *rb = ring_buffer_get(event);
+ struct user_struct *mmap_user = rb->mmap_user;
+ int mmap_locked = rb->mmap_locked;
+ unsigned long size = perf_data_size(rb);
++ bool detach_rest = false;
+
+ if (event->pmu->event_unmapped)
+ event->pmu->event_unmapped(event, vma->vm_mm);
+@@ -5510,7 +5510,8 @@ static void perf_mmap_close(struct vm_area_struct *vma)
+ mutex_unlock(&event->mmap_mutex);
+ }
+
+- atomic_dec(&rb->mmap_count);
++ if (atomic_dec_and_test(&rb->mmap_count))
++ detach_rest = true;
+
+ if (!atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex))
+ goto out_put;
+@@ -5519,7 +5520,7 @@ static void perf_mmap_close(struct vm_area_struct *vma)
+ mutex_unlock(&event->mmap_mutex);
+
+ /* If there's still other mmap()s of this buffer, we're done. */
+- if (atomic_read(&rb->mmap_count))
++ if (!detach_rest)
+ goto out_put;
+
+ /*
+diff --git a/kernel/events/internal.h b/kernel/events/internal.h
+index 6dc725a7e7bc9..8fc0ddc38cb69 100644
+--- a/kernel/events/internal.h
++++ b/kernel/events/internal.h
+@@ -209,7 +209,7 @@ static inline int get_recursion_context(int *recursion)
+ rctx = 3;
+ else if (in_irq())
+ rctx = 2;
+- else if (in_softirq())
++ else if (in_serving_softirq())
+ rctx = 1;
+ else
+ rctx = 0;
+diff --git a/kernel/exit.c b/kernel/exit.c
+index eeaafd4064c95..65133ebddfada 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -517,7 +517,10 @@ static void exit_mm(void)
+ up_read(&mm->mmap_sem);
+
+ self.task = current;
+- self.next = xchg(&core_state->dumper.next, &self);
++ if (self.task->flags & PF_SIGNALED)
++ self.next = xchg(&core_state->dumper.next, &self);
++ else
++ self.task = NULL;
+ /*
+ * Implies mb(), the result of xchg() must be visible
+ * to core_state->dumper.
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 52f641c00a65b..334dc4cae780e 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -856,8 +856,9 @@ static void put_pi_state(struct futex_pi_state *pi_state)
+ */
+ if (pi_state->owner) {
+ struct task_struct *owner;
++ unsigned long flags;
+
+- raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
++ raw_spin_lock_irqsave(&pi_state->pi_mutex.wait_lock, flags);
+ owner = pi_state->owner;
+ if (owner) {
+ raw_spin_lock(&owner->pi_lock);
+@@ -865,7 +866,7 @@ static void put_pi_state(struct futex_pi_state *pi_state)
+ raw_spin_unlock(&owner->pi_lock);
+ }
+ rt_mutex_proxy_unlock(&pi_state->pi_mutex, owner);
+- raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
++ raw_spin_unlock_irqrestore(&pi_state->pi_mutex.wait_lock, flags);
+ }
+
+ if (current->pi_state_cache) {
+diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
+index 5f3e2baefca92..d532bf0c5a672 100644
+--- a/kernel/irq/Kconfig
++++ b/kernel/irq/Kconfig
+@@ -80,6 +80,7 @@ config IRQ_FASTEOI_HIERARCHY_HANDLERS
+ # Generic IRQ IPI support
+ config GENERIC_IRQ_IPI
+ bool
++ select IRQ_DOMAIN_HIERARCHY
+
+ # Generic MSI interrupt support
+ config GENERIC_MSI_IRQ
+diff --git a/kernel/reboot.c b/kernel/reboot.c
+index 8fb44dec9ad75..45bea54f9aee0 100644
+--- a/kernel/reboot.c
++++ b/kernel/reboot.c
+@@ -539,22 +539,22 @@ static int __init reboot_setup(char *str)
+ break;
+
+ case 's':
+- {
+- int rc;
+-
+- if (isdigit(*(str+1))) {
+- rc = kstrtoint(str+1, 0, &reboot_cpu);
+- if (rc)
+- return rc;
+- } else if (str[1] == 'm' && str[2] == 'p' &&
+- isdigit(*(str+3))) {
+- rc = kstrtoint(str+3, 0, &reboot_cpu);
+- if (rc)
+- return rc;
+- } else
++ if (isdigit(*(str+1)))
++ reboot_cpu = simple_strtoul(str+1, NULL, 0);
++ else if (str[1] == 'm' && str[2] == 'p' &&
++ isdigit(*(str+3)))
++ reboot_cpu = simple_strtoul(str+3, NULL, 0);
++ else
+ reboot_mode = REBOOT_SOFT;
++ if (reboot_cpu >= num_possible_cpus()) {
++ pr_err("Ignoring the CPU number in reboot= option. "
++ "CPU %d exceeds possible cpu number %d\n",
++ reboot_cpu, num_possible_cpus());
++ reboot_cpu = 0;
++ break;
++ }
+ break;
+- }
++
+ case 'g':
+ reboot_mode = REBOOT_GPIO;
+ break;
+diff --git a/kernel/time/itimer.c b/kernel/time/itimer.c
+index 9a65713c83093..2e2b335ef1018 100644
+--- a/kernel/time/itimer.c
++++ b/kernel/time/itimer.c
+@@ -154,10 +154,6 @@ static void set_cpu_itimer(struct task_struct *tsk, unsigned int clock_id,
+ u64 oval, nval, ointerval, ninterval;
+ struct cpu_itimer *it = &tsk->signal->it[clock_id];
+
+- /*
+- * Use the to_ktime conversion because that clamps the maximum
+- * value to KTIME_MAX and avoid multiplication overflows.
+- */
+ nval = ktime_to_ns(timeval_to_ktime(value->it_value));
+ ninterval = ktime_to_ns(timeval_to_ktime(value->it_interval));
+
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index a02e0f6b287ce..0a3cc37e4b838 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -15,6 +15,7 @@
+ #include <linux/err.h>
+ #include <linux/hrtimer.h>
+ #include <linux/interrupt.h>
++#include <linux/nmi.h>
+ #include <linux/percpu.h>
+ #include <linux/profile.h>
+ #include <linux/sched.h>
+@@ -520,6 +521,7 @@ void tick_unfreeze(void)
+ trace_suspend_resume(TPS("timekeeping_freeze"),
+ smp_processor_id(), false);
+ } else {
++ touch_softlockup_watchdog();
+ tick_resume_local();
+ }
+
+diff --git a/kernel/time/timer.c b/kernel/time/timer.c
+index 61e41ea3a96ec..a6e88d9bb931c 100644
+--- a/kernel/time/timer.c
++++ b/kernel/time/timer.c
+@@ -1655,13 +1655,6 @@ void update_process_times(int user_tick)
+ scheduler_tick();
+ if (IS_ENABLED(CONFIG_POSIX_TIMERS))
+ run_posix_cpu_timers(p);
+-
+- /* The current CPU might make use of net randoms without receiving IRQs
+- * to renew them often enough. Let's update the net_rand_state from a
+- * non-constant value that's not affine to the number of calls to make
+- * sure it's updated when there's some activity (we don't care in idle).
+- */
+- this_cpu_add(net_rand_state.s1, rol32(jiffies, 24) + user_tick);
+ }
+
+ /**
+diff --git a/lib/random32.c b/lib/random32.c
+index b6f3325e38e43..9085b1172015e 100644
+--- a/lib/random32.c
++++ b/lib/random32.c
+@@ -40,16 +40,6 @@
+ #include <linux/sched.h>
+ #include <asm/unaligned.h>
+
+-#ifdef CONFIG_RANDOM32_SELFTEST
+-static void __init prandom_state_selftest(void);
+-#else
+-static inline void prandom_state_selftest(void)
+-{
+-}
+-#endif
+-
+-DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+-
+ /**
+ * prandom_u32_state - seeded pseudo-random number generator.
+ * @state: pointer to state structure holding seeded state.
+@@ -69,25 +59,6 @@ u32 prandom_u32_state(struct rnd_state *state)
+ }
+ EXPORT_SYMBOL(prandom_u32_state);
+
+-/**
+- * prandom_u32 - pseudo random number generator
+- *
+- * A 32 bit pseudo-random number is generated using a fast
+- * algorithm suitable for simulation. This algorithm is NOT
+- * considered safe for cryptographic use.
+- */
+-u32 prandom_u32(void)
+-{
+- struct rnd_state *state = &get_cpu_var(net_rand_state);
+- u32 res;
+-
+- res = prandom_u32_state(state);
+- put_cpu_var(net_rand_state);
+-
+- return res;
+-}
+-EXPORT_SYMBOL(prandom_u32);
+-
+ /**
+ * prandom_bytes_state - get the requested number of pseudo-random bytes
+ *
+@@ -119,20 +90,6 @@ void prandom_bytes_state(struct rnd_state *state, void *buf, size_t bytes)
+ }
+ EXPORT_SYMBOL(prandom_bytes_state);
+
+-/**
+- * prandom_bytes - get the requested number of pseudo-random bytes
+- * @buf: where to copy the pseudo-random bytes to
+- * @bytes: the requested number of bytes
+- */
+-void prandom_bytes(void *buf, size_t bytes)
+-{
+- struct rnd_state *state = &get_cpu_var(net_rand_state);
+-
+- prandom_bytes_state(state, buf, bytes);
+- put_cpu_var(net_rand_state);
+-}
+-EXPORT_SYMBOL(prandom_bytes);
+-
+ static void prandom_warmup(struct rnd_state *state)
+ {
+ /* Calling RNG ten times to satisfy recurrence condition */
+@@ -148,96 +105,6 @@ static void prandom_warmup(struct rnd_state *state)
+ prandom_u32_state(state);
+ }
+
+-static u32 __extract_hwseed(void)
+-{
+- unsigned int val = 0;
+-
+- (void)(arch_get_random_seed_int(&val) ||
+- arch_get_random_int(&val));
+-
+- return val;
+-}
+-
+-static void prandom_seed_early(struct rnd_state *state, u32 seed,
+- bool mix_with_hwseed)
+-{
+-#define LCG(x) ((x) * 69069U) /* super-duper LCG */
+-#define HWSEED() (mix_with_hwseed ? __extract_hwseed() : 0)
+- state->s1 = __seed(HWSEED() ^ LCG(seed), 2U);
+- state->s2 = __seed(HWSEED() ^ LCG(state->s1), 8U);
+- state->s3 = __seed(HWSEED() ^ LCG(state->s2), 16U);
+- state->s4 = __seed(HWSEED() ^ LCG(state->s3), 128U);
+-}
+-
+-/**
+- * prandom_seed - add entropy to pseudo random number generator
+- * @seed: seed value
+- *
+- * Add some additional seeding to the prandom pool.
+- */
+-void prandom_seed(u32 entropy)
+-{
+- int i;
+- /*
+- * No locking on the CPUs, but then somewhat random results are, well,
+- * expected.
+- */
+- for_each_possible_cpu(i) {
+- struct rnd_state *state = &per_cpu(net_rand_state, i);
+-
+- state->s1 = __seed(state->s1 ^ entropy, 2U);
+- prandom_warmup(state);
+- }
+-}
+-EXPORT_SYMBOL(prandom_seed);
+-
+-/*
+- * Generate some initially weak seeding values to allow
+- * to start the prandom_u32() engine.
+- */
+-static int __init prandom_init(void)
+-{
+- int i;
+-
+- prandom_state_selftest();
+-
+- for_each_possible_cpu(i) {
+- struct rnd_state *state = &per_cpu(net_rand_state, i);
+- u32 weak_seed = (i + jiffies) ^ random_get_entropy();
+-
+- prandom_seed_early(state, weak_seed, true);
+- prandom_warmup(state);
+- }
+-
+- return 0;
+-}
+-core_initcall(prandom_init);
+-
+-static void __prandom_timer(struct timer_list *unused);
+-
+-static DEFINE_TIMER(seed_timer, __prandom_timer);
+-
+-static void __prandom_timer(struct timer_list *unused)
+-{
+- u32 entropy;
+- unsigned long expires;
+-
+- get_random_bytes(&entropy, sizeof(entropy));
+- prandom_seed(entropy);
+-
+- /* reseed every ~60 seconds, in [40 .. 80) interval with slack */
+- expires = 40 + prandom_u32_max(40);
+- seed_timer.expires = jiffies + msecs_to_jiffies(expires * MSEC_PER_SEC);
+-
+- add_timer(&seed_timer);
+-}
+-
+-static void __init __prandom_start_seed_timer(void)
+-{
+- seed_timer.expires = jiffies + msecs_to_jiffies(40 * MSEC_PER_SEC);
+- add_timer(&seed_timer);
+-}
+-
+ void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state)
+ {
+ int i;
+@@ -257,51 +124,6 @@ void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state)
+ }
+ EXPORT_SYMBOL(prandom_seed_full_state);
+
+-/*
+- * Generate better values after random number generator
+- * is fully initialized.
+- */
+-static void __prandom_reseed(bool late)
+-{
+- unsigned long flags;
+- static bool latch = false;
+- static DEFINE_SPINLOCK(lock);
+-
+- /* Asking for random bytes might result in bytes getting
+- * moved into the nonblocking pool and thus marking it
+- * as initialized. In this case we would double back into
+- * this function and attempt to do a late reseed.
+- * Ignore the pointless attempt to reseed again if we're
+- * already waiting for bytes when the nonblocking pool
+- * got initialized.
+- */
+-
+- /* only allow initial seeding (late == false) once */
+- if (!spin_trylock_irqsave(&lock, flags))
+- return;
+-
+- if (latch && !late)
+- goto out;
+-
+- latch = true;
+- prandom_seed_full_state(&net_rand_state);
+-out:
+- spin_unlock_irqrestore(&lock, flags);
+-}
+-
+-void prandom_reseed_late(void)
+-{
+- __prandom_reseed(true);
+-}
+-
+-static int __init prandom_reseed(void)
+-{
+- __prandom_reseed(false);
+- __prandom_start_seed_timer();
+- return 0;
+-}
+-late_initcall(prandom_reseed);
+-
+ #ifdef CONFIG_RANDOM32_SELFTEST
+ static struct prandom_test1 {
+ u32 seed;
+@@ -421,7 +243,28 @@ static struct prandom_test2 {
+ { 407983964U, 921U, 728767059U },
+ };
+
+-static void __init prandom_state_selftest(void)
++static u32 __extract_hwseed(void)
++{
++ unsigned int val = 0;
++
++ (void)(arch_get_random_seed_int(&val) ||
++ arch_get_random_int(&val));
++
++ return val;
++}
++
++static void prandom_seed_early(struct rnd_state *state, u32 seed,
++ bool mix_with_hwseed)
++{
++#define LCG(x) ((x) * 69069U) /* super-duper LCG */
++#define HWSEED() (mix_with_hwseed ? __extract_hwseed() : 0)
++ state->s1 = __seed(HWSEED() ^ LCG(seed), 2U);
++ state->s2 = __seed(HWSEED() ^ LCG(state->s1), 8U);
++ state->s3 = __seed(HWSEED() ^ LCG(state->s2), 16U);
++ state->s4 = __seed(HWSEED() ^ LCG(state->s3), 128U);
++}
++
++static int __init prandom_state_selftest(void)
+ {
+ int i, j, errors = 0, runs = 0;
+ bool error = false;
+@@ -461,5 +304,266 @@ static void __init prandom_state_selftest(void)
+ pr_warn("prandom: %d/%d self tests failed\n", errors, runs);
+ else
+ pr_info("prandom: %d self tests passed\n", runs);
++ return 0;
+ }
++core_initcall(prandom_state_selftest);
+ #endif
++
++/*
++ * The prandom_u32() implementation is now completely separate from the
++ * prandom_state() functions, which are retained (for now) for compatibility.
++ *
++ * Because of (ab)use in the networking code for choosing random TCP/UDP port
++ * numbers, which open DoS possibilities if guessable, we want something
++ * stronger than a standard PRNG. But the performance requirements of
++ * the network code do not allow robust crypto for this application.
++ *
++ * So this is a homebrew Junior Spaceman implementation, based on the
++ * lowest-latency trustworthy crypto primitive available, SipHash.
++ * (The authors of SipHash have not been consulted about this abuse of
++ * their work.)
++ *
++ * Standard SipHash-2-4 uses 2n+4 rounds to hash n words of input to
++ * one word of output. This abbreviated version uses 2 rounds per word
++ * of output.
++ */
++
++struct siprand_state {
++ unsigned long v0;
++ unsigned long v1;
++ unsigned long v2;
++ unsigned long v3;
++};
++
++static DEFINE_PER_CPU(struct siprand_state, net_rand_state) __latent_entropy;
++
++/*
++ * This is the core CPRNG function. As "pseudorandom", this is not used
++ * for truly valuable things, just intended to be a PITA to guess.
++ * For maximum speed, we do just two SipHash rounds per word. This is
++ * the same rate as 4 rounds per 64 bits that SipHash normally uses,
++ * so hopefully it's reasonably secure.
++ *
++ * There are two changes from the official SipHash finalization:
++ * - We omit some constants XORed with v2 in the SipHash spec as irrelevant;
++ * they are there only to make the output rounds distinct from the input
++ * rounds, and this application has no input rounds.
++ * - Rather than returning v0^v1^v2^v3, return v1+v3.
++ * If you look at the SipHash round, the last operation on v3 is
++ * "v3 ^= v0", so "v0 ^ v3" just undoes that, a waste of time.
++ * Likewise "v1 ^= v2". (The rotate of v2 makes a difference, but
++ * it still cancels out half of the bits in v2 for no benefit.)
++ * Second, since the last combining operation was xor, continue the
++ * pattern of alternating xor/add for a tiny bit of extra non-linearity.
++ */
++static inline u32 siprand_u32(struct siprand_state *s)
++{
++ unsigned long v0 = s->v0, v1 = s->v1, v2 = s->v2, v3 = s->v3;
++
++ PRND_SIPROUND(v0, v1, v2, v3);
++ PRND_SIPROUND(v0, v1, v2, v3);
++ s->v0 = v0; s->v1 = v1; s->v2 = v2; s->v3 = v3;
++ return v1 + v3;
++}
++
++
++/**
++ * prandom_u32 - pseudo random number generator
++ *
++ * A 32 bit pseudo-random number is generated using a fast
++ * algorithm suitable for simulation. This algorithm is NOT
++ * considered safe for cryptographic use.
++ */
++u32 prandom_u32(void)
++{
++ struct siprand_state *state = get_cpu_ptr(&net_rand_state);
++ u32 res = siprand_u32(state);
++
++ put_cpu_ptr(&net_rand_state);
++ return res;
++}
++EXPORT_SYMBOL(prandom_u32);
++
++/**
++ * prandom_bytes - get the requested number of pseudo-random bytes
++ * @buf: where to copy the pseudo-random bytes to
++ * @bytes: the requested number of bytes
++ */
++void prandom_bytes(void *buf, size_t bytes)
++{
++ struct siprand_state *state = get_cpu_ptr(&net_rand_state);
++ u8 *ptr = buf;
++
++ while (bytes >= sizeof(u32)) {
++ put_unaligned(siprand_u32(state), (u32 *)ptr);
++ ptr += sizeof(u32);
++ bytes -= sizeof(u32);
++ }
++
++ if (bytes > 0) {
++ u32 rem = siprand_u32(state);
++
++ do {
++ *ptr++ = (u8)rem;
++ rem >>= BITS_PER_BYTE;
++ } while (--bytes > 0);
++ }
++ put_cpu_ptr(&net_rand_state);
++}
++EXPORT_SYMBOL(prandom_bytes);
++
++/**
++ * prandom_seed - add entropy to pseudo random number generator
++ * @entropy: entropy value
++ *
++ * Add some additional seed material to the prandom pool.
++ * The "entropy" is actually our IP address (the only caller is
++ * the network code), not for unpredictability, but to ensure that
++ * different machines are initialized differently.
++ */
++void prandom_seed(u32 entropy)
++{
++ int i;
++
++ add_device_randomness(&entropy, sizeof(entropy));
++
++ for_each_possible_cpu(i) {
++ struct siprand_state *state = per_cpu_ptr(&net_rand_state, i);
++ unsigned long v0 = state->v0, v1 = state->v1;
++ unsigned long v2 = state->v2, v3 = state->v3;
++
++ do {
++ v3 ^= entropy;
++ PRND_SIPROUND(v0, v1, v2, v3);
++ PRND_SIPROUND(v0, v1, v2, v3);
++ v0 ^= entropy;
++ } while (unlikely(!v0 || !v1 || !v2 || !v3));
++
++ WRITE_ONCE(state->v0, v0);
++ WRITE_ONCE(state->v1, v1);
++ WRITE_ONCE(state->v2, v2);
++ WRITE_ONCE(state->v3, v3);
++ }
++}
++EXPORT_SYMBOL(prandom_seed);
++
++/*
++ * Generate some initially weak seeding values to allow
++ * the prandom_u32() engine to be started.
++ */
++static int __init prandom_init_early(void)
++{
++ int i;
++ unsigned long v0, v1, v2, v3;
++
++ if (!arch_get_random_long(&v0))
++ v0 = jiffies;
++ if (!arch_get_random_long(&v1))
++ v1 = random_get_entropy();
++ v2 = v0 ^ PRND_K0;
++ v3 = v1 ^ PRND_K1;
++
++ for_each_possible_cpu(i) {
++ struct siprand_state *state;
++
++ v3 ^= i;
++ PRND_SIPROUND(v0, v1, v2, v3);
++ PRND_SIPROUND(v0, v1, v2, v3);
++ v0 ^= i;
++
++ state = per_cpu_ptr(&net_rand_state, i);
++ state->v0 = v0; state->v1 = v1;
++ state->v2 = v2; state->v3 = v3;
++ }
++
++ return 0;
++}
++core_initcall(prandom_init_early);
++
++
++/* Stronger reseeding when available, and periodically thereafter. */
++static void prandom_reseed(struct timer_list *unused);
++
++static DEFINE_TIMER(seed_timer, prandom_reseed);
++
++static void prandom_reseed(struct timer_list *unused)
++{
++ unsigned long expires;
++ int i;
++
++ /*
++ * Reinitialize each CPU's PRNG with 128 bits of key.
++ * No locking on the CPUs, but then somewhat random results are,
++ * well, expected.
++ */
++ for_each_possible_cpu(i) {
++ struct siprand_state *state;
++ unsigned long v0 = get_random_long(), v2 = v0 ^ PRND_K0;
++ unsigned long v1 = get_random_long(), v3 = v1 ^ PRND_K1;
++#if BITS_PER_LONG == 32
++ int j;
++
++ /*
++ * On 32-bit machines, hash in two extra words to
++ * approximate 128-bit key length. Not that the hash
++ * has that much security, but this prevents a trivial
++ * 64-bit brute force.
++ */
++ for (j = 0; j < 2; j++) {
++ unsigned long m = get_random_long();
++
++ v3 ^= m;
++ PRND_SIPROUND(v0, v1, v2, v3);
++ PRND_SIPROUND(v0, v1, v2, v3);
++ v0 ^= m;
++ }
++#endif
++ /*
++ * Probably impossible in practice, but there is a
++ * theoretical risk that a race between this reseeding
++ * and the target CPU writing its state back could
++ * create the all-zero SipHash fixed point.
++ *
++ * To ensure that never happens, ensure the state
++ * we write contains no zero words.
++ */
++ state = per_cpu_ptr(&net_rand_state, i);
++ WRITE_ONCE(state->v0, v0 ? v0 : -1ul);
++ WRITE_ONCE(state->v1, v1 ? v1 : -1ul);
++ WRITE_ONCE(state->v2, v2 ? v2 : -1ul);
++ WRITE_ONCE(state->v3, v3 ? v3 : -1ul);
++ }
++
++ /* reseed every ~60 seconds, in [40 .. 80) interval with slack */
++ expires = round_jiffies(jiffies + 40 * HZ + prandom_u32_max(40 * HZ));
++ mod_timer(&seed_timer, expires);
++}
++
++/*
++ * The random ready callback can be called from almost any interrupt.
++ * To avoid worrying about whether it's safe to delay that interrupt
++ * long enough to seed all CPUs, just schedule an immediate timer event.
++ */
++static void prandom_timer_start(struct random_ready_callback *unused)
++{
++ mod_timer(&seed_timer, jiffies);
++}
++
++/*
++ * Start periodic full reseeding as soon as strong
++ * random numbers are available.
++ */
++static int __init prandom_init_late(void)
++{
++ static struct random_ready_callback random_ready = {
++ .func = prandom_timer_start
++ };
++ int ret = add_random_ready_callback(&random_ready);
++
++ if (ret == -EALREADY) {
++ prandom_timer_start(&random_ready);
++ ret = 0;
++ }
++ return ret;
++}
++late_initcall(prandom_init_late);
+diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
+index 8d2e5dc9a827d..3d670d5aea344 100644
+--- a/net/ipv4/netfilter.c
++++ b/net/ipv4/netfilter.c
+@@ -17,17 +17,19 @@
+ #include <net/netfilter/nf_queue.h>
+
+ /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
+-int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_type)
++int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb, unsigned int addr_type)
+ {
+ const struct iphdr *iph = ip_hdr(skb);
+ struct rtable *rt;
+ struct flowi4 fl4 = {};
+ __be32 saddr = iph->saddr;
+- const struct sock *sk = skb_to_full_sk(skb);
+- __u8 flags = sk ? inet_sk_flowi_flags(sk) : 0;
++ __u8 flags;
+ struct net_device *dev = skb_dst(skb)->dev;
+ unsigned int hh_len;
+
++ sk = sk_to_full_sk(sk);
++ flags = sk ? inet_sk_flowi_flags(sk) : 0;
++
+ if (addr_type == RTN_UNSPEC)
+ addr_type = inet_addr_type_dev_table(net, dev, saddr);
+ if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
+@@ -91,8 +93,8 @@ int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry)
+ skb->mark == rt_info->mark &&
+ iph->daddr == rt_info->daddr &&
+ iph->saddr == rt_info->saddr))
+- return ip_route_me_harder(entry->state.net, skb,
+- RTN_UNSPEC);
++ return ip_route_me_harder(entry->state.net, entry->state.sk,
++ skb, RTN_UNSPEC);
+ }
+ return 0;
+ }
+diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
+index 690b17ef6a44a..d64b1ef43c106 100644
+--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
++++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
+@@ -54,7 +54,7 @@ synproxy_send_tcp(struct net *net,
+
+ skb_dst_set_noref(nskb, skb_dst(skb));
+ nskb->protocol = htons(ETH_P_IP);
+- if (ip_route_me_harder(net, nskb, RTN_UNSPEC))
++ if (ip_route_me_harder(net, nskb->sk, nskb, RTN_UNSPEC))
+ goto free_nskb;
+
+ if (nfct) {
+diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
+index dea138ca89254..0829f46ddfddf 100644
+--- a/net/ipv4/netfilter/iptable_mangle.c
++++ b/net/ipv4/netfilter/iptable_mangle.c
+@@ -65,7 +65,7 @@ ipt_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)
+ iph->daddr != daddr ||
+ skb->mark != mark ||
+ iph->tos != tos) {
+- err = ip_route_me_harder(state->net, skb, RTN_UNSPEC);
++ err = ip_route_me_harder(state->net, state->sk, skb, RTN_UNSPEC);
+ if (err < 0)
+ ret = NF_DROP_ERR(err);
+ }
+diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+index 6115bf1ff6f0a..6a27766b7d0ff 100644
+--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
++++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+@@ -329,7 +329,7 @@ nf_nat_ipv4_local_fn(void *priv, struct sk_buff *skb,
+
+ if (ct->tuplehash[dir].tuple.dst.u3.ip !=
+ ct->tuplehash[!dir].tuple.src.u3.ip) {
+- err = ip_route_me_harder(state->net, skb, RTN_UNSPEC);
++ err = ip_route_me_harder(state->net, state->sk, skb, RTN_UNSPEC);
+ if (err < 0)
+ ret = NF_DROP_ERR(err);
+ }
+diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
+index 5cd06ba3535df..4996db1f64a15 100644
+--- a/net/ipv4/netfilter/nf_reject_ipv4.c
++++ b/net/ipv4/netfilter/nf_reject_ipv4.c
+@@ -129,7 +129,7 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
+ ip4_dst_hoplimit(skb_dst(nskb)));
+ nf_reject_ip_tcphdr_put(nskb, oldskb, oth);
+
+- if (ip_route_me_harder(net, nskb, RTN_UNSPEC))
++ if (ip_route_me_harder(net, nskb->sk, nskb, RTN_UNSPEC))
+ goto free_nskb;
+
+ niph = ip_hdr(nskb);
+diff --git a/net/ipv4/netfilter/nft_chain_route_ipv4.c b/net/ipv4/netfilter/nft_chain_route_ipv4.c
+index 7d82934c46f42..61003768e52bf 100644
+--- a/net/ipv4/netfilter/nft_chain_route_ipv4.c
++++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c
+@@ -50,7 +50,7 @@ static unsigned int nf_route_table_hook(void *priv,
+ iph->daddr != daddr ||
+ skb->mark != mark ||
+ iph->tos != tos) {
+- err = ip_route_me_harder(state->net, skb, RTN_UNSPEC);
++ err = ip_route_me_harder(state->net, state->sk, skb, RTN_UNSPEC);
+ if (err < 0)
+ ret = NF_DROP_ERR(err);
+ }
+diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
+index f66b2e6d97a79..1a06850ef3cc5 100644
+--- a/net/ipv4/syncookies.c
++++ b/net/ipv4/syncookies.c
+@@ -296,7 +296,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
+ __u32 cookie = ntohl(th->ack_seq) - 1;
+ struct sock *ret = sk;
+ struct request_sock *req;
+- int mss;
++ int full_space, mss;
+ struct rtable *rt;
+ __u8 rcv_wscale;
+ struct flowi4 fl4;
+@@ -391,8 +391,13 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
+
+ /* Try to redo what tcp_v4_send_synack did. */
+ req->rsk_window_clamp = tp->window_clamp ? :dst_metric(&rt->dst, RTAX_WINDOW);
++ /* limit the window selection if the user enforce a smaller rx buffer */
++ full_space = tcp_full_space(sk);
++ if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
++ (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
++ req->rsk_window_clamp = full_space;
+
+- tcp_select_initial_window(sk, tcp_full_space(sk), req->mss,
++ tcp_select_initial_window(sk, full_space, req->mss,
+ &req->rsk_rcv_wnd, &req->rsk_window_clamp,
+ ireq->wscale_ok, &rcv_wscale,
+ dst_metric(&rt->dst, RTAX_INITRWND));
+diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
+index 6d0b1f3e927bd..5679fa3f696ad 100644
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -17,10 +17,10 @@
+ #include <net/xfrm.h>
+ #include <net/netfilter/nf_queue.h>
+
+-int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
++int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff *skb)
+ {
+ const struct ipv6hdr *iph = ipv6_hdr(skb);
+- struct sock *sk = sk_to_full_sk(skb->sk);
++ struct sock *sk = sk_to_full_sk(sk_partial);
+ unsigned int hh_len;
+ struct dst_entry *dst;
+ int strict = (ipv6_addr_type(&iph->daddr) &
+@@ -81,7 +81,7 @@ static int nf_ip6_reroute(struct sk_buff *skb,
+ if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
+ !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
+ skb->mark != rt_info->mark)
+- return ip6_route_me_harder(entry->state.net, skb);
++ return ip6_route_me_harder(entry->state.net, entry->state.sk, skb);
+ }
+ return 0;
+ }
+diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
+index b0524b18c4fb3..acba3757ff605 100644
+--- a/net/ipv6/netfilter/ip6table_mangle.c
++++ b/net/ipv6/netfilter/ip6table_mangle.c
+@@ -60,7 +60,7 @@ ip6t_mangle_out(struct sk_buff *skb, const struct nf_hook_state *state)
+ skb->mark != mark ||
+ ipv6_hdr(skb)->hop_limit != hop_limit ||
+ flowlabel != *((u_int32_t *)ipv6_hdr(skb)))) {
+- err = ip6_route_me_harder(state->net, skb);
++ err = ip6_route_me_harder(state->net, state->sk, skb);
+ if (err < 0)
+ ret = NF_DROP_ERR(err);
+ }
+diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+index ca6d38698b1ad..2b6a3b27f6704 100644
+--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
++++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+@@ -352,7 +352,7 @@ nf_nat_ipv6_local_fn(void *priv, struct sk_buff *skb,
+
+ if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3,
+ &ct->tuplehash[!dir].tuple.src.u3)) {
+- err = ip6_route_me_harder(state->net, skb);
++ err = ip6_route_me_harder(state->net, state->sk, skb);
+ if (err < 0)
+ ret = NF_DROP_ERR(err);
+ }
+diff --git a/net/ipv6/netfilter/nft_chain_route_ipv6.c b/net/ipv6/netfilter/nft_chain_route_ipv6.c
+index da3f1f8cb325c..afe79cb46e630 100644
+--- a/net/ipv6/netfilter/nft_chain_route_ipv6.c
++++ b/net/ipv6/netfilter/nft_chain_route_ipv6.c
+@@ -52,7 +52,7 @@ static unsigned int nf_route_table_hook(void *priv,
+ skb->mark != mark ||
+ ipv6_hdr(skb)->hop_limit != hop_limit ||
+ flowlabel != *((u_int32_t *)ipv6_hdr(skb)))) {
+- err = ip6_route_me_harder(state->net, skb);
++ err = ip6_route_me_harder(state->net, state->sk, skb);
+ if (err < 0)
+ ret = NF_DROP_ERR(err);
+ }
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index bfed7508ba19a..98c108baf35e2 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1087,7 +1087,6 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
+ if (tdev && !netif_is_l3_master(tdev)) {
+ int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+
+- dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
+ dev->mtu = tdev->mtu - t_hlen;
+ if (dev->mtu < IPV6_MIN_MTU)
+ dev->mtu = IPV6_MIN_MTU;
+@@ -1377,7 +1376,6 @@ static void ipip6_tunnel_setup(struct net_device *dev)
+ dev->priv_destructor = ipip6_dev_free;
+
+ dev->type = ARPHRD_SIT;
+- dev->hard_header_len = LL_MAX_HEADER + t_hlen;
+ dev->mtu = ETH_DATA_LEN - t_hlen;
+ dev->min_mtu = IPV6_MIN_MTU;
+ dev->max_mtu = IP6_MAX_MTU - t_hlen;
+diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
+index a377be8a9fb44..ec61b67a92be0 100644
+--- a/net/ipv6/syncookies.c
++++ b/net/ipv6/syncookies.c
+@@ -141,7 +141,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
+ __u32 cookie = ntohl(th->ack_seq) - 1;
+ struct sock *ret = sk;
+ struct request_sock *req;
+- int mss;
++ int full_space, mss;
+ struct dst_entry *dst;
+ __u8 rcv_wscale;
+ u32 tsoff = 0;
+@@ -246,7 +246,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
+ }
+
+ req->rsk_window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
+- tcp_select_initial_window(sk, tcp_full_space(sk), req->mss,
++ /* limit the window selection if the user enforce a smaller rx buffer */
++ full_space = tcp_full_space(sk);
++ if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
++ (req->rsk_window_clamp > full_space || req->rsk_window_clamp == 0))
++ req->rsk_window_clamp = full_space;
++
++ tcp_select_initial_window(sk, full_space, req->mss,
+ &req->rsk_rcv_wnd, &req->rsk_window_clamp,
+ ireq->wscale_ok, &rcv_wscale,
+ dst_metric(dst, RTAX_INITRWND));
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index 23a1002ed86dd..ad3e515f91f0f 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -1571,7 +1571,8 @@ static int iucv_sock_shutdown(struct socket *sock, int how)
+ break;
+ }
+
+- if (how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) {
++ if ((how == SEND_SHUTDOWN || how == SHUTDOWN_MASK) &&
++ sk->sk_state == IUCV_CONNECTED) {
+ if (iucv->transport == AF_IUCV_TRANS_IUCV) {
+ txmsg.class = 0;
+ txmsg.tag = 0;
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 3160ffd93a153..98d048630ad2f 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1908,19 +1908,24 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
+
+ /* device xmit handlers */
+
++enum ieee80211_encrypt {
++ ENCRYPT_NO,
++ ENCRYPT_MGMT,
++ ENCRYPT_DATA,
++};
++
+ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
+ struct sk_buff *skb,
+- int head_need, bool may_encrypt)
++ int head_need,
++ enum ieee80211_encrypt encrypt)
+ {
+ struct ieee80211_local *local = sdata->local;
+- struct ieee80211_hdr *hdr;
+ bool enc_tailroom;
+ int tail_need = 0;
+
+- hdr = (struct ieee80211_hdr *) skb->data;
+- enc_tailroom = may_encrypt &&
+- (sdata->crypto_tx_tailroom_needed_cnt ||
+- ieee80211_is_mgmt(hdr->frame_control));
++ enc_tailroom = encrypt == ENCRYPT_MGMT ||
++ (encrypt == ENCRYPT_DATA &&
++ sdata->crypto_tx_tailroom_needed_cnt);
+
+ if (enc_tailroom) {
+ tail_need = IEEE80211_ENCRYPT_TAILROOM;
+@@ -1952,23 +1957,29 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+- struct ieee80211_hdr *hdr;
++ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+ int headroom;
+- bool may_encrypt;
++ enum ieee80211_encrypt encrypt;
+
+- may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
++ if (info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)
++ encrypt = ENCRYPT_NO;
++ else if (ieee80211_is_mgmt(hdr->frame_control))
++ encrypt = ENCRYPT_MGMT;
++ else
++ encrypt = ENCRYPT_DATA;
+
+ headroom = local->tx_headroom;
+- if (may_encrypt)
++ if (encrypt != ENCRYPT_NO)
+ headroom += sdata->encrypt_headroom;
+ headroom -= skb_headroom(skb);
+ headroom = max_t(int, 0, headroom);
+
+- if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
++ if (ieee80211_skb_resize(sdata, skb, headroom, encrypt)) {
+ ieee80211_free_txskb(&local->hw, skb);
+ return;
+ }
+
++ /* reload after potential resize */
+ hdr = (struct ieee80211_hdr *) skb->data;
+ info->control.vif = &sdata->vif;
+
+@@ -2751,7 +2762,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
+ head_need += sdata->encrypt_headroom;
+ head_need += local->tx_headroom;
+ head_need = max_t(int, 0, head_need);
+- if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
++ if (ieee80211_skb_resize(sdata, skb, head_need, ENCRYPT_DATA)) {
+ ieee80211_free_txskb(&local->hw, skb);
+ skb = NULL;
+ return ERR_PTR(-ENOMEM);
+@@ -3414,7 +3425,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
+ if (unlikely(ieee80211_skb_resize(sdata, skb,
+ max_t(int, extra_head + hw_headroom -
+ skb_headroom(skb), 0),
+- false))) {
++ ENCRYPT_NO))) {
+ kfree_skb(skb);
+ return true;
+ }
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index 36ebc40a4313c..0427e66bc4786 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -488,13 +488,14 @@ ip_set_match_extensions(struct ip_set *set, const struct ip_set_ext *ext,
+ if (SET_WITH_COUNTER(set)) {
+ struct ip_set_counter *counter = ext_counter(data, set);
+
++ ip_set_update_counter(counter, ext, flags);
++
+ if (flags & IPSET_FLAG_MATCH_COUNTERS &&
+ !(ip_set_match_counter(ip_set_get_packets(counter),
+ mext->packets, mext->packets_op) &&
+ ip_set_match_counter(ip_set_get_bytes(counter),
+ mext->bytes, mext->bytes_op)))
+ return false;
+- ip_set_update_counter(counter, ext, flags);
+ }
+ if (SET_WITH_SKBINFO(set))
+ ip_set_get_skbinfo(ext_skbinfo(data, set),
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index d5e4329579e28..acaeeaf814415 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -725,12 +725,12 @@ static int ip_vs_route_me_harder(struct netns_ipvs *ipvs, int af,
+ struct dst_entry *dst = skb_dst(skb);
+
+ if (dst->dev && !(dst->dev->flags & IFF_LOOPBACK) &&
+- ip6_route_me_harder(ipvs->net, skb) != 0)
++ ip6_route_me_harder(ipvs->net, skb->sk, skb) != 0)
+ return 1;
+ } else
+ #endif
+ if (!(skb_rtable(skb)->rt_flags & RTCF_LOCAL) &&
+- ip_route_me_harder(ipvs->net, skb, RTN_LOCAL) != 0)
++ ip_route_me_harder(ipvs->net, skb->sk, skb, RTN_LOCAL) != 0)
+ return 1;
+
+ return 0;
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index bd96fd261dba3..4e15913e7519e 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -1116,10 +1116,13 @@ static void dev_deactivate_queue(struct net_device *dev,
+ void *_qdisc_default)
+ {
+ struct Qdisc *qdisc = rtnl_dereference(dev_queue->qdisc);
++ struct Qdisc *qdisc_default = _qdisc_default;
+
+ if (qdisc) {
+ if (!(qdisc->flags & TCQ_F_BUILTIN))
+ set_bit(__QDISC_STATE_DEACTIVATED, &qdisc->state);
++
++ rcu_assign_pointer(dev_queue->qdisc, qdisc_default);
+ }
+ }
+
+diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
+index ec9a7137d2677..1c4733153d749 100644
+--- a/net/tipc/topsrv.c
++++ b/net/tipc/topsrv.c
+@@ -671,12 +671,18 @@ static int tipc_topsrv_start(struct net *net)
+
+ ret = tipc_topsrv_work_start(srv);
+ if (ret < 0)
+- return ret;
++ goto err_start;
+
+ ret = tipc_topsrv_create_listener(srv);
+ if (ret < 0)
+- tipc_topsrv_work_stop(srv);
++ goto err_create;
+
++ return 0;
++
++err_create:
++ tipc_topsrv_work_stop(srv);
++err_start:
++ kfree(srv);
+ return ret;
+ }
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 935aebf150107..c7825b951f725 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -3374,7 +3374,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
+ power_rule = ®_rule->power_rule;
+
+ if (reg_rule->flags & NL80211_RRF_AUTO_BW)
+- snprintf(bw, sizeof(bw), "%d KHz, %d KHz AUTO",
++ snprintf(bw, sizeof(bw), "%d KHz, %u KHz AUTO",
+ freq_range->max_bandwidth_khz,
+ reg_get_max_bandwidth(rd, reg_rule));
+ else
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index bd1cbbfe5924b..372f4194db5a0 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -824,7 +824,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
+ sock->state = SS_CONNECTED;
+ rc = 0;
+ out_put_neigh:
+- if (rc) {
++ if (rc && x25->neighbour) {
+ read_lock_bh(&x25_list_lock);
+ x25_neigh_put(x25->neighbour);
+ x25->neighbour = NULL;
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index a649d7c2f48ca..84dea0ad16661 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -1825,6 +1825,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
+ int err = -ENOENT;
+ __be32 minspi = htonl(low);
+ __be32 maxspi = htonl(high);
++ __be32 newspi = 0;
+ u32 mark = x->mark.v & x->mark.m;
+
+ spin_lock_bh(&x->lock);
+@@ -1843,21 +1844,22 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
+ xfrm_state_put(x0);
+ goto unlock;
+ }
+- x->id.spi = minspi;
++ newspi = minspi;
+ } else {
+ u32 spi = 0;
+ for (h = 0; h < high-low+1; h++) {
+ spi = low + prandom_u32()%(high-low+1);
+ x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
+ if (x0 == NULL) {
+- x->id.spi = htonl(spi);
++ newspi = htonl(spi);
+ break;
+ }
+ xfrm_state_put(x0);
+ }
+ }
+- if (x->id.spi) {
++ if (newspi) {
+ spin_lock_bh(&net->xfrm.xfrm_state_lock);
++ x->id.spi = newspi;
+ h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
+ hlist_add_head_rcu(&x->byspi, net->xfrm.state_byspi + h);
+ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+diff --git a/security/selinux/ibpkey.c b/security/selinux/ibpkey.c
+index 0a4b89d482977..cb05ae28ce009 100644
+--- a/security/selinux/ibpkey.c
++++ b/security/selinux/ibpkey.c
+@@ -161,8 +161,10 @@ static int sel_ib_pkey_sid_slow(u64 subnet_prefix, u16 pkey_num, u32 *sid)
+ * is valid, it just won't be added to the cache.
+ */
+ new = kzalloc(sizeof(*new), GFP_ATOMIC);
+- if (!new)
++ if (!new) {
++ ret = -ENOMEM;
+ goto out;
++ }
+
+ new->psec.subnet_prefix = subnet_prefix;
+ new->psec.pkey = pkey_num;
+diff --git a/sound/hda/ext/hdac_ext_controller.c b/sound/hda/ext/hdac_ext_controller.c
+index 84b44cdae28a1..b96abebcfd1a4 100644
+--- a/sound/hda/ext/hdac_ext_controller.c
++++ b/sound/hda/ext/hdac_ext_controller.c
+@@ -156,6 +156,8 @@ struct hdac_ext_link *snd_hdac_ext_bus_get_link(struct hdac_bus *bus,
+ return NULL;
+ if (bus->idx != bus_idx)
+ return NULL;
++ if (addr < 0 || addr > 31)
++ return NULL;
+
+ list_for_each_entry(hlink, &bus->hlink_list, list) {
+ for (i = 0; i < HDA_MAX_CODECS; i++) {
+diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
+index 9569cc06e0a73..2814251df06b4 100644
+--- a/tools/perf/util/scripting-engines/trace-event-python.c
++++ b/tools/perf/util/scripting-engines/trace-event-python.c
+@@ -1493,7 +1493,6 @@ static void _free_command_line(wchar_t **command_line, int num)
+ static int python_start_script(const char *script, int argc, const char **argv)
+ {
+ struct tables *tables = &tables_global;
+- PyMODINIT_FUNC (*initfunc)(void);
+ #if PY_MAJOR_VERSION < 3
+ const char **command_line;
+ #else
+@@ -1508,20 +1507,18 @@ static int python_start_script(const char *script, int argc, const char **argv)
+ FILE *fp;
+
+ #if PY_MAJOR_VERSION < 3
+- initfunc = initperf_trace_context;
+ command_line = malloc((argc + 1) * sizeof(const char *));
+ command_line[0] = script;
+ for (i = 1; i < argc + 1; i++)
+ command_line[i] = argv[i - 1];
++ PyImport_AppendInittab(name, initperf_trace_context);
+ #else
+- initfunc = PyInit_perf_trace_context;
+ command_line = malloc((argc + 1) * sizeof(wchar_t *));
+ command_line[0] = Py_DecodeLocale(script, NULL);
+ for (i = 1; i < argc + 1; i++)
+ command_line[i] = Py_DecodeLocale(argv[i - 1], NULL);
++ PyImport_AppendInittab(name, PyInit_perf_trace_context);
+ #endif
+-
+- PyImport_AppendInittab(name, initfunc);
+ Py_Initialize();
+
+ #if PY_MAJOR_VERSION < 3
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index f016d1b330e54..6a2037b52098b 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -488,6 +488,7 @@ static void perf_event__mmap2_swap(union perf_event *event,
+ event->mmap2.maj = bswap_32(event->mmap2.maj);
+ event->mmap2.min = bswap_32(event->mmap2.min);
+ event->mmap2.ino = bswap_64(event->mmap2.ino);
++ event->mmap2.ino_generation = bswap_64(event->mmap2.ino_generation);
+
+ if (sample_id_all) {
+ void *data = &event->mmap2.filename;
+diff --git a/tools/testing/selftests/proc/proc-loadavg-001.c b/tools/testing/selftests/proc/proc-loadavg-001.c
+index fcff7047000da..8edaafc2b92fd 100644
+--- a/tools/testing/selftests/proc/proc-loadavg-001.c
++++ b/tools/testing/selftests/proc/proc-loadavg-001.c
+@@ -14,7 +14,6 @@
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+ /* Test that /proc/loadavg correctly reports last pid in pid namespace. */
+-#define _GNU_SOURCE
+ #include <errno.h>
+ #include <sched.h>
+ #include <sys/types.h>
+diff --git a/tools/testing/selftests/proc/proc-self-syscall.c b/tools/testing/selftests/proc/proc-self-syscall.c
+index 5ab5f4810e43a..7b9018fad092a 100644
+--- a/tools/testing/selftests/proc/proc-self-syscall.c
++++ b/tools/testing/selftests/proc/proc-self-syscall.c
+@@ -13,7 +13,6 @@
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+-#define _GNU_SOURCE
+ #include <unistd.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
+diff --git a/tools/testing/selftests/proc/proc-uptime-002.c b/tools/testing/selftests/proc/proc-uptime-002.c
+index 30e2b78490898..e7ceabed7f51f 100644
+--- a/tools/testing/selftests/proc/proc-uptime-002.c
++++ b/tools/testing/selftests/proc/proc-uptime-002.c
+@@ -15,7 +15,6 @@
+ */
+ // Test that values in /proc/uptime increment monotonically
+ // while shifting across CPUs.
+-#define _GNU_SOURCE
+ #undef NDEBUG
+ #include <assert.h>
+ #include <unistd.h>
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-11-22 19:26 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-11-22 19:26 UTC (permalink / raw
To: gentoo-commits
commit: c869a8b6a8317d09e7c35c8fba10cc10a0200cc5
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Nov 22 19:26:06 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Nov 22 19:26:06 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c869a8b6
Linux patch 4.19.159
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1158_linux-4.19.159.patch | 1417 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1421 insertions(+)
diff --git a/0000_README b/0000_README
index 9824d3a..9a90375 100644
--- a/0000_README
+++ b/0000_README
@@ -671,6 +671,10 @@ Patch: 1157_linux-4.19.158.patch
From: https://www.kernel.org
Desc: Linux 4.19.158
+Patch: 1158_linux-4.19.159.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.159
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1158_linux-4.19.159.patch b/1158_linux-4.19.159.patch
new file mode 100644
index 0000000..2992776
--- /dev/null
+++ b/1158_linux-4.19.159.patch
@@ -0,0 +1,1417 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 8dbc8d4ec8f0c..7371643dd8d4f 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2560,6 +2560,8 @@
+ mds=off [X86]
+ tsx_async_abort=off [X86]
+ kvm.nx_huge_pages=off [X86]
++ no_entry_flush [PPC]
++ no_uaccess_flush [PPC]
+
+ Exceptions:
+ This does not have any effect on
+@@ -2870,6 +2872,8 @@
+
+ noefi Disable EFI runtime services support.
+
++ no_entry_flush [PPC] Don't flush the L1-D cache when entering the kernel.
++
+ noexec [IA-64]
+
+ noexec [X86]
+@@ -2919,6 +2923,9 @@
+ nospec_store_bypass_disable
+ [HW] Disable all mitigations for the Speculative Store Bypass vulnerability
+
++ no_uaccess_flush
++ [PPC] Don't flush the L1-D cache after accessing user data.
++
+ noxsave [BUGS=X86] Disables x86 extended register state save
+ and restore using xsave. The kernel will fallback to
+ enabling legacy floating-point and sse state.
+diff --git a/Makefile b/Makefile
+index 698a9cc2864bd..593fdbce712d7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 158
++SUBLEVEL = 159
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/include/asm/book3s/64/kup-radix.h b/arch/powerpc/include/asm/book3s/64/kup-radix.h
+new file mode 100644
+index 0000000000000..aa54ac2e5659e
+--- /dev/null
++++ b/arch/powerpc/include/asm/book3s/64/kup-radix.h
+@@ -0,0 +1,22 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H
++#define _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H
++
++DECLARE_STATIC_KEY_FALSE(uaccess_flush_key);
++
++/* Prototype for function defined in exceptions-64s.S */
++void do_uaccess_flush(void);
++
++static __always_inline void allow_user_access(void __user *to, const void __user *from,
++ unsigned long size)
++{
++}
++
++static inline void prevent_user_access(void __user *to, const void __user *from,
++ unsigned long size)
++{
++ if (static_branch_unlikely(&uaccess_flush_key))
++ do_uaccess_flush();
++}
++
++#endif /* _ASM_POWERPC_BOOK3S_64_KUP_RADIX_H */
+diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
+index a86feddddad0c..35fb5b11955a0 100644
+--- a/arch/powerpc/include/asm/exception-64s.h
++++ b/arch/powerpc/include/asm/exception-64s.h
+@@ -90,11 +90,18 @@
+ nop; \
+ nop
+
++#define ENTRY_FLUSH_SLOT \
++ ENTRY_FLUSH_FIXUP_SECTION; \
++ nop; \
++ nop; \
++ nop;
++
+ /*
+ * r10 must be free to use, r13 must be paca
+ */
+ #define INTERRUPT_TO_KERNEL \
+- STF_ENTRY_BARRIER_SLOT
++ STF_ENTRY_BARRIER_SLOT; \
++ ENTRY_FLUSH_SLOT
+
+ /*
+ * Macros for annotating the expected destination of (h)rfid
+diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h
+index 40a6c9261a6bf..5bf3f0779b936 100644
+--- a/arch/powerpc/include/asm/feature-fixups.h
++++ b/arch/powerpc/include/asm/feature-fixups.h
+@@ -205,6 +205,22 @@ label##3: \
+ FTR_ENTRY_OFFSET 955b-956b; \
+ .popsection;
+
++#define UACCESS_FLUSH_FIXUP_SECTION \
++959: \
++ .pushsection __uaccess_flush_fixup,"a"; \
++ .align 2; \
++960: \
++ FTR_ENTRY_OFFSET 959b-960b; \
++ .popsection;
++
++#define ENTRY_FLUSH_FIXUP_SECTION \
++957: \
++ .pushsection __entry_flush_fixup,"a"; \
++ .align 2; \
++958: \
++ FTR_ENTRY_OFFSET 957b-958b; \
++ .popsection;
++
+ #define RFI_FLUSH_FIXUP_SECTION \
+ 951: \
+ .pushsection __rfi_flush_fixup,"a"; \
+@@ -237,8 +253,11 @@ label##3: \
+ #include <linux/types.h>
+
+ extern long stf_barrier_fallback;
++extern long entry_flush_fallback;
+ extern long __start___stf_entry_barrier_fixup, __stop___stf_entry_barrier_fixup;
+ extern long __start___stf_exit_barrier_fixup, __stop___stf_exit_barrier_fixup;
++extern long __start___uaccess_flush_fixup, __stop___uaccess_flush_fixup;
++extern long __start___entry_flush_fixup, __stop___entry_flush_fixup;
+ extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup;
+ extern long __start___barrier_nospec_fixup, __stop___barrier_nospec_fixup;
+ extern long __start__btb_flush_fixup, __stop__btb_flush_fixup;
+diff --git a/arch/powerpc/include/asm/futex.h b/arch/powerpc/include/asm/futex.h
+index 2a7b01f97a56b..1eabc20dddd38 100644
+--- a/arch/powerpc/include/asm/futex.h
++++ b/arch/powerpc/include/asm/futex.h
+@@ -35,6 +35,7 @@ static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
+ {
+ int oldval = 0, ret;
+
++ allow_write_to_user(uaddr, sizeof(*uaddr));
+ pagefault_disable();
+
+ switch (op) {
+@@ -61,6 +62,7 @@ static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
+
+ *oval = oldval;
+
++ prevent_write_to_user(uaddr, sizeof(*uaddr));
+ return ret;
+ }
+
+@@ -74,6 +76,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+ if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
+ return -EFAULT;
+
++ allow_write_to_user(uaddr, sizeof(*uaddr));
+ __asm__ __volatile__ (
+ PPC_ATOMIC_ENTRY_BARRIER
+ "1: lwarx %1,0,%3 # futex_atomic_cmpxchg_inatomic\n\
+@@ -94,6 +97,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+ : "cc", "memory");
+
+ *uval = prev;
++ prevent_write_to_user(uaddr, sizeof(*uaddr));
+ return ret;
+ }
+
+diff --git a/arch/powerpc/include/asm/kup.h b/arch/powerpc/include/asm/kup.h
+new file mode 100644
+index 0000000000000..f0f8e36ad71f5
+--- /dev/null
++++ b/arch/powerpc/include/asm/kup.h
+@@ -0,0 +1,40 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_POWERPC_KUP_H_
++#define _ASM_POWERPC_KUP_H_
++
++#ifndef __ASSEMBLY__
++
++#include <asm/pgtable.h>
++
++#ifdef CONFIG_PPC_BOOK3S_64
++#include <asm/book3s/64/kup-radix.h>
++#else
++static inline void allow_user_access(void __user *to, const void __user *from,
++ unsigned long size) { }
++static inline void prevent_user_access(void __user *to, const void __user *from,
++ unsigned long size) { }
++#endif /* CONFIG_PPC_BOOK3S_64 */
++
++static inline void allow_read_from_user(const void __user *from, unsigned long size)
++{
++ allow_user_access(NULL, from, size);
++}
++
++static inline void allow_write_to_user(void __user *to, unsigned long size)
++{
++ allow_user_access(to, NULL, size);
++}
++
++static inline void prevent_read_from_user(const void __user *from, unsigned long size)
++{
++ prevent_user_access(NULL, from, size);
++}
++
++static inline void prevent_write_to_user(void __user *to, unsigned long size)
++{
++ prevent_user_access(to, NULL, size);
++}
++
++#endif /* !__ASSEMBLY__ */
++
++#endif /* _ASM_POWERPC_KUP_H_ */
+diff --git a/arch/powerpc/include/asm/security_features.h b/arch/powerpc/include/asm/security_features.h
+index ccf44c135389a..3b45a64e491e5 100644
+--- a/arch/powerpc/include/asm/security_features.h
++++ b/arch/powerpc/include/asm/security_features.h
+@@ -84,12 +84,19 @@ static inline bool security_ftr_enabled(unsigned long feature)
+ // Software required to flush link stack on context switch
+ #define SEC_FTR_FLUSH_LINK_STACK 0x0000000000001000ull
+
++// The L1-D cache should be flushed when entering the kernel
++#define SEC_FTR_L1D_FLUSH_ENTRY 0x0000000000004000ull
++
++// The L1-D cache should be flushed after user accesses from the kernel
++#define SEC_FTR_L1D_FLUSH_UACCESS 0x0000000000008000ull
+
+ // Features enabled by default
+ #define SEC_FTR_DEFAULT \
+ (SEC_FTR_L1D_FLUSH_HV | \
+ SEC_FTR_L1D_FLUSH_PR | \
+ SEC_FTR_BNDS_CHK_SPEC_BAR | \
++ SEC_FTR_L1D_FLUSH_ENTRY | \
++ SEC_FTR_L1D_FLUSH_UACCESS | \
+ SEC_FTR_FAVOUR_SECURITY)
+
+ #endif /* _ASM_POWERPC_SECURITY_FEATURES_H */
+diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h
+index 65676e2325b85..6f2f4497e13b3 100644
+--- a/arch/powerpc/include/asm/setup.h
++++ b/arch/powerpc/include/asm/setup.h
+@@ -52,12 +52,16 @@ enum l1d_flush_type {
+ };
+
+ void setup_rfi_flush(enum l1d_flush_type, bool enable);
++void setup_entry_flush(bool enable);
++void setup_uaccess_flush(bool enable);
+ void do_rfi_flush_fixups(enum l1d_flush_type types);
+ #ifdef CONFIG_PPC_BARRIER_NOSPEC
+ void setup_barrier_nospec(void);
+ #else
+ static inline void setup_barrier_nospec(void) { };
+ #endif
++void do_uaccess_flush_fixups(enum l1d_flush_type types);
++void do_entry_flush_fixups(enum l1d_flush_type types);
+ void do_barrier_nospec_fixups(bool enable);
+ extern bool barrier_nospec_enabled;
+
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index 38a25ff8afb76..ab6612e35ace3 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -6,6 +6,7 @@
+ #include <asm/processor.h>
+ #include <asm/page.h>
+ #include <asm/extable.h>
++#include <asm/kup.h>
+
+ /*
+ * The fs value determines whether argument validity checking should be
+@@ -91,9 +92,14 @@ static inline int __access_ok(unsigned long addr, unsigned long size,
+ __put_user_check((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
+
+ #define __get_user(x, ptr) \
+- __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
++ __get_user_nocheck((x), (ptr), sizeof(*(ptr)), true)
+ #define __put_user(x, ptr) \
+- __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
++ __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)), true)
++
++#define __get_user_allowed(x, ptr) \
++ __get_user_nocheck((x), (ptr), sizeof(*(ptr)), false)
++#define __put_user_allowed(x, ptr) \
++ __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)), false)
+
+ #define __get_user_inatomic(x, ptr) \
+ __get_user_nosleep((x), (ptr), sizeof(*(ptr)))
+@@ -138,7 +144,7 @@ extern long __put_user_bad(void);
+ : "r" (x), "b" (addr), "i" (-EFAULT), "0" (err))
+ #endif /* __powerpc64__ */
+
+-#define __put_user_size(x, ptr, size, retval) \
++#define __put_user_size_allowed(x, ptr, size, retval) \
+ do { \
+ retval = 0; \
+ switch (size) { \
+@@ -150,14 +156,28 @@ do { \
+ } \
+ } while (0)
+
+-#define __put_user_nocheck(x, ptr, size) \
++#define __put_user_size(x, ptr, size, retval) \
++do { \
++ allow_write_to_user(ptr, size); \
++ __put_user_size_allowed(x, ptr, size, retval); \
++ prevent_write_to_user(ptr, size); \
++} while (0)
++
++#define __put_user_nocheck(x, ptr, size, do_allow) \
+ ({ \
+ long __pu_err; \
+ __typeof__(*(ptr)) __user *__pu_addr = (ptr); \
++ __typeof__(*(ptr)) __pu_val = (x); \
++ __typeof__(size) __pu_size = (size); \
++ \
+ if (!is_kernel_addr((unsigned long)__pu_addr)) \
+ might_fault(); \
+- __chk_user_ptr(ptr); \
+- __put_user_size((x), __pu_addr, (size), __pu_err); \
++ __chk_user_ptr(__pu_addr); \
++ if (do_allow) \
++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
++ else \
++ __put_user_size_allowed(__pu_val, __pu_addr, __pu_size, __pu_err); \
++ \
+ __pu_err; \
+ })
+
+@@ -165,9 +185,13 @@ do { \
+ ({ \
+ long __pu_err = -EFAULT; \
+ __typeof__(*(ptr)) __user *__pu_addr = (ptr); \
++ __typeof__(*(ptr)) __pu_val = (x); \
++ __typeof__(size) __pu_size = (size); \
++ \
+ might_fault(); \
+- if (access_ok(VERIFY_WRITE, __pu_addr, size)) \
+- __put_user_size((x), __pu_addr, (size), __pu_err); \
++ if (access_ok(VERIFY_WRITE, __pu_addr, __pu_size)) \
++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
++ \
+ __pu_err; \
+ })
+
+@@ -175,8 +199,12 @@ do { \
+ ({ \
+ long __pu_err; \
+ __typeof__(*(ptr)) __user *__pu_addr = (ptr); \
+- __chk_user_ptr(ptr); \
+- __put_user_size((x), __pu_addr, (size), __pu_err); \
++ __typeof__(*(ptr)) __pu_val = (x); \
++ __typeof__(size) __pu_size = (size); \
++ \
++ __chk_user_ptr(__pu_addr); \
++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
++ \
+ __pu_err; \
+ })
+
+@@ -234,7 +262,7 @@ extern long __get_user_bad(void);
+ : "b" (addr), "i" (-EFAULT), "0" (err))
+ #endif /* __powerpc64__ */
+
+-#define __get_user_size(x, ptr, size, retval) \
++#define __get_user_size_allowed(x, ptr, size, retval) \
+ do { \
+ retval = 0; \
+ __chk_user_ptr(ptr); \
+@@ -249,6 +277,13 @@ do { \
+ } \
+ } while (0)
+
++#define __get_user_size(x, ptr, size, retval) \
++do { \
++ allow_read_from_user(ptr, size); \
++ __get_user_size_allowed(x, ptr, size, retval); \
++ prevent_read_from_user(ptr, size); \
++} while (0)
++
+ /*
+ * This is a type: either unsigned long, if the argument fits into
+ * that type, or otherwise unsigned long long.
+@@ -256,17 +291,23 @@ do { \
+ #define __long_type(x) \
+ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
+
+-#define __get_user_nocheck(x, ptr, size) \
++#define __get_user_nocheck(x, ptr, size, do_allow) \
+ ({ \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+- __chk_user_ptr(ptr); \
++ __typeof__(size) __gu_size = (size); \
++ \
++ __chk_user_ptr(__gu_addr); \
+ if (!is_kernel_addr((unsigned long)__gu_addr)) \
+ might_fault(); \
+ barrier_nospec(); \
+- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
++ if (do_allow) \
++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
++ else \
++ __get_user_size_allowed(__gu_val, __gu_addr, __gu_size, __gu_err); \
+ (x) = (__typeof__(*(ptr)))__gu_val; \
++ \
+ __gu_err; \
+ })
+
+@@ -275,12 +316,15 @@ do { \
+ long __gu_err = -EFAULT; \
+ __long_type(*(ptr)) __gu_val = 0; \
+ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(size) __gu_size = (size); \
++ \
+ might_fault(); \
+- if (access_ok(VERIFY_READ, __gu_addr, (size))) { \
++ if (access_ok(VERIFY_READ, __gu_addr, __gu_size)) { \
+ barrier_nospec(); \
+- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
+ } \
+ (x) = (__force __typeof__(*(ptr)))__gu_val; \
++ \
+ __gu_err; \
+ })
+
+@@ -289,10 +333,13 @@ do { \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+- __chk_user_ptr(ptr); \
++ __typeof__(size) __gu_size = (size); \
++ \
++ __chk_user_ptr(__gu_addr); \
+ barrier_nospec(); \
+- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
+ (x) = (__force __typeof__(*(ptr)))__gu_val; \
++ \
+ __gu_err; \
+ })
+
+@@ -306,16 +353,22 @@ extern unsigned long __copy_tofrom_user(void __user *to,
+ static inline unsigned long
+ raw_copy_in_user(void __user *to, const void __user *from, unsigned long n)
+ {
++ unsigned long ret;
++
+ barrier_nospec();
+- return __copy_tofrom_user(to, from, n);
++ allow_user_access(to, from, n);
++ ret = __copy_tofrom_user(to, from, n);
++ prevent_user_access(to, from, n);
++ return ret;
+ }
+ #endif /* __powerpc64__ */
+
+ static inline unsigned long raw_copy_from_user(void *to,
+ const void __user *from, unsigned long n)
+ {
++ unsigned long ret;
+ if (__builtin_constant_p(n) && (n <= 8)) {
+- unsigned long ret = 1;
++ ret = 1;
+
+ switch (n) {
+ case 1:
+@@ -340,27 +393,30 @@ static inline unsigned long raw_copy_from_user(void *to,
+ }
+
+ barrier_nospec();
+- return __copy_tofrom_user((__force void __user *)to, from, n);
++ allow_read_from_user(from, n);
++ ret = __copy_tofrom_user((__force void __user *)to, from, n);
++ prevent_read_from_user(from, n);
++ return ret;
+ }
+
+-static inline unsigned long raw_copy_to_user(void __user *to,
+- const void *from, unsigned long n)
++static inline unsigned long
++raw_copy_to_user_allowed(void __user *to, const void *from, unsigned long n)
+ {
+ if (__builtin_constant_p(n) && (n <= 8)) {
+ unsigned long ret = 1;
+
+ switch (n) {
+ case 1:
+- __put_user_size(*(u8 *)from, (u8 __user *)to, 1, ret);
++ __put_user_size_allowed(*(u8 *)from, (u8 __user *)to, 1, ret);
+ break;
+ case 2:
+- __put_user_size(*(u16 *)from, (u16 __user *)to, 2, ret);
++ __put_user_size_allowed(*(u16 *)from, (u16 __user *)to, 2, ret);
+ break;
+ case 4:
+- __put_user_size(*(u32 *)from, (u32 __user *)to, 4, ret);
++ __put_user_size_allowed(*(u32 *)from, (u32 __user *)to, 4, ret);
+ break;
+ case 8:
+- __put_user_size(*(u64 *)from, (u64 __user *)to, 8, ret);
++ __put_user_size_allowed(*(u64 *)from, (u64 __user *)to, 8, ret);
+ break;
+ }
+ if (ret == 0)
+@@ -370,14 +426,34 @@ static inline unsigned long raw_copy_to_user(void __user *to,
+ return __copy_tofrom_user(to, (__force const void __user *)from, n);
+ }
+
+-extern unsigned long __clear_user(void __user *addr, unsigned long size);
++static inline unsigned long
++raw_copy_to_user(void __user *to, const void *from, unsigned long n)
++{
++ unsigned long ret;
++
++ allow_write_to_user(to, n);
++ ret = raw_copy_to_user_allowed(to, from, n);
++ prevent_write_to_user(to, n);
++ return ret;
++}
++
++unsigned long __arch_clear_user(void __user *addr, unsigned long size);
+
+ static inline unsigned long clear_user(void __user *addr, unsigned long size)
+ {
++ unsigned long ret = size;
+ might_fault();
+- if (likely(access_ok(VERIFY_WRITE, addr, size)))
+- return __clear_user(addr, size);
+- return size;
++ if (likely(access_ok(VERIFY_WRITE, addr, size))) {
++ allow_write_to_user(addr, size);
++ ret = __arch_clear_user(addr, size);
++ prevent_write_to_user(addr, size);
++ }
++ return ret;
++}
++
++static inline unsigned long __clear_user(void __user *addr, unsigned long size)
++{
++ return clear_user(addr, size);
+ }
+
+ extern long strncpy_from_user(char *dst, const char __user *src, long count);
+@@ -388,4 +464,13 @@ extern long __copy_from_user_flushcache(void *dst, const void __user *src,
+ extern void memcpy_page_flushcache(char *to, struct page *page, size_t offset,
+ size_t len);
+
++#define user_access_begin(type, ptr, len) access_ok(type, ptr, len)
++#define user_access_end() prevent_user_access(NULL, NULL, ~0ul)
++
++#define unsafe_op_wrap(op, err) do { if (unlikely(op)) goto err; } while (0)
++#define unsafe_get_user(x, p, e) unsafe_op_wrap(__get_user_allowed(x, p), e)
++#define unsafe_put_user(x, p, e) unsafe_op_wrap(__put_user_allowed(x, p), e)
++#define unsafe_copy_to_user(d, s, l, e) \
++ unsafe_op_wrap(raw_copy_to_user_allowed(d, s, l), e)
++
+ #endif /* _ARCH_POWERPC_UACCESS_H */
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index e1dab9b1e4478..344e2758b22df 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -540,7 +540,7 @@ EXC_COMMON_BEGIN(unrecover_mce)
+ b 1b
+
+
+-EXC_REAL(data_access, 0x300, 0x80)
++EXC_REAL_OOL(data_access, 0x300, 0x80)
+ EXC_VIRT(data_access, 0x4300, 0x80, 0x300)
+ TRAMP_KVM_SKIP(PACA_EXGEN, 0x300)
+
+@@ -572,13 +572,16 @@ ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX)
+ EXC_REAL_BEGIN(data_access_slb, 0x380, 0x80)
+ SET_SCRATCH0(r13)
+ EXCEPTION_PROLOG_0(PACA_EXSLB)
++ b tramp_data_access_slb
++EXC_REAL_END(data_access_slb, 0x380, 0x80)
++
++TRAMP_REAL_BEGIN(tramp_data_access_slb)
+ EXCEPTION_PROLOG_1(PACA_EXSLB, KVMTEST_PR, 0x380)
+ mr r12,r3 /* save r3 */
+ mfspr r3,SPRN_DAR
+ mfspr r11,SPRN_SRR1
+ crset 4*cr6+eq
+ BRANCH_TO_COMMON(r10, slb_miss_common)
+-EXC_REAL_END(data_access_slb, 0x380, 0x80)
+
+ EXC_VIRT_BEGIN(data_access_slb, 0x4380, 0x80)
+ SET_SCRATCH0(r13)
+@@ -593,7 +596,7 @@ EXC_VIRT_END(data_access_slb, 0x4380, 0x80)
+ TRAMP_KVM_SKIP(PACA_EXSLB, 0x380)
+
+
+-EXC_REAL(instruction_access, 0x400, 0x80)
++EXC_REAL_OOL(instruction_access, 0x400, 0x80)
+ EXC_VIRT(instruction_access, 0x4400, 0x80, 0x400)
+ TRAMP_KVM(PACA_EXGEN, 0x400)
+
+@@ -616,13 +619,16 @@ ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX)
+ EXC_REAL_BEGIN(instruction_access_slb, 0x480, 0x80)
+ SET_SCRATCH0(r13)
+ EXCEPTION_PROLOG_0(PACA_EXSLB)
++ b tramp_instruction_access_slb
++EXC_REAL_END(instruction_access_slb, 0x480, 0x80)
++
++TRAMP_REAL_BEGIN(tramp_instruction_access_slb)
+ EXCEPTION_PROLOG_1(PACA_EXSLB, KVMTEST_PR, 0x480)
+ mr r12,r3 /* save r3 */
+ mfspr r3,SPRN_SRR0 /* SRR0 is faulting address */
+ mfspr r11,SPRN_SRR1
+ crclr 4*cr6+eq
+ BRANCH_TO_COMMON(r10, slb_miss_common)
+-EXC_REAL_END(instruction_access_slb, 0x480, 0x80)
+
+ EXC_VIRT_BEGIN(instruction_access_slb, 0x4480, 0x80)
+ SET_SCRATCH0(r13)
+@@ -883,13 +889,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_TM)
+
+
+ EXC_REAL_OOL_MASKABLE(decrementer, 0x900, 0x80, IRQS_DISABLED)
+-EXC_VIRT_MASKABLE(decrementer, 0x4900, 0x80, 0x900, IRQS_DISABLED)
++EXC_VIRT_OOL_MASKABLE(decrementer, 0x4900, 0x80, 0x900, IRQS_DISABLED)
+ TRAMP_KVM(PACA_EXGEN, 0x900)
+ EXC_COMMON_ASYNC(decrementer_common, 0x900, timer_interrupt)
+
+
+-EXC_REAL_HV(hdecrementer, 0x980, 0x80)
+-EXC_VIRT_HV(hdecrementer, 0x4980, 0x80, 0x980)
++EXC_REAL_OOL_HV(hdecrementer, 0x980, 0x80)
++EXC_VIRT_OOL_HV(hdecrementer, 0x4980, 0x80, 0x980)
+ TRAMP_KVM_HV(PACA_EXGEN, 0x980)
+ EXC_COMMON(hdecrementer_common, 0x980, hdec_interrupt)
+
+@@ -1523,15 +1529,8 @@ TRAMP_REAL_BEGIN(stf_barrier_fallback)
+ .endr
+ blr
+
+-TRAMP_REAL_BEGIN(rfi_flush_fallback)
+- SET_SCRATCH0(r13);
+- GET_PACA(r13);
+- std r1,PACA_EXRFI+EX_R12(r13)
+- ld r1,PACAKSAVE(r13)
+- std r9,PACA_EXRFI+EX_R9(r13)
+- std r10,PACA_EXRFI+EX_R10(r13)
+- std r11,PACA_EXRFI+EX_R11(r13)
+- mfctr r9
++/* Clobbers r10, r11, ctr */
++.macro L1D_DISPLACEMENT_FLUSH
+ ld r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13)
+ ld r11,PACA_L1D_FLUSH_SIZE(r13)
+ srdi r11,r11,(7 + 3) /* 128 byte lines, unrolled 8x */
+@@ -1542,7 +1541,7 @@ TRAMP_REAL_BEGIN(rfi_flush_fallback)
+ sync
+
+ /*
+- * The load adresses are at staggered offsets within cachelines,
++ * The load addresses are at staggered offsets within cachelines,
+ * which suits some pipelines better (on others it should not
+ * hurt).
+ */
+@@ -1557,7 +1556,30 @@ TRAMP_REAL_BEGIN(rfi_flush_fallback)
+ ld r11,(0x80 + 8)*7(r10)
+ addi r10,r10,0x80*8
+ bdnz 1b
++.endm
++
++TRAMP_REAL_BEGIN(entry_flush_fallback)
++ std r9,PACA_EXRFI+EX_R9(r13)
++ std r10,PACA_EXRFI+EX_R10(r13)
++ std r11,PACA_EXRFI+EX_R11(r13)
++ mfctr r9
++ L1D_DISPLACEMENT_FLUSH
++ mtctr r9
++ ld r9,PACA_EXRFI+EX_R9(r13)
++ ld r10,PACA_EXRFI+EX_R10(r13)
++ ld r11,PACA_EXRFI+EX_R11(r13)
++ blr
+
++TRAMP_REAL_BEGIN(rfi_flush_fallback)
++ SET_SCRATCH0(r13);
++ GET_PACA(r13);
++ std r1,PACA_EXRFI+EX_R12(r13)
++ ld r1,PACAKSAVE(r13)
++ std r9,PACA_EXRFI+EX_R9(r13)
++ std r10,PACA_EXRFI+EX_R10(r13)
++ std r11,PACA_EXRFI+EX_R11(r13)
++ mfctr r9
++ L1D_DISPLACEMENT_FLUSH
+ mtctr r9
+ ld r9,PACA_EXRFI+EX_R9(r13)
+ ld r10,PACA_EXRFI+EX_R10(r13)
+@@ -1575,32 +1597,7 @@ TRAMP_REAL_BEGIN(hrfi_flush_fallback)
+ std r10,PACA_EXRFI+EX_R10(r13)
+ std r11,PACA_EXRFI+EX_R11(r13)
+ mfctr r9
+- ld r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13)
+- ld r11,PACA_L1D_FLUSH_SIZE(r13)
+- srdi r11,r11,(7 + 3) /* 128 byte lines, unrolled 8x */
+- mtctr r11
+- DCBT_BOOK3S_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */
+-
+- /* order ld/st prior to dcbt stop all streams with flushing */
+- sync
+-
+- /*
+- * The load adresses are at staggered offsets within cachelines,
+- * which suits some pipelines better (on others it should not
+- * hurt).
+- */
+-1:
+- ld r11,(0x80 + 8)*0(r10)
+- ld r11,(0x80 + 8)*1(r10)
+- ld r11,(0x80 + 8)*2(r10)
+- ld r11,(0x80 + 8)*3(r10)
+- ld r11,(0x80 + 8)*4(r10)
+- ld r11,(0x80 + 8)*5(r10)
+- ld r11,(0x80 + 8)*6(r10)
+- ld r11,(0x80 + 8)*7(r10)
+- addi r10,r10,0x80*8
+- bdnz 1b
+-
++ L1D_DISPLACEMENT_FLUSH
+ mtctr r9
+ ld r9,PACA_EXRFI+EX_R9(r13)
+ ld r10,PACA_EXRFI+EX_R10(r13)
+@@ -1609,6 +1606,19 @@ TRAMP_REAL_BEGIN(hrfi_flush_fallback)
+ GET_SCRATCH0(r13);
+ hrfid
+
++USE_TEXT_SECTION()
++
++_GLOBAL(do_uaccess_flush)
++ UACCESS_FLUSH_FIXUP_SECTION
++ nop
++ nop
++ nop
++ blr
++ L1D_DISPLACEMENT_FLUSH
++ blr
++_ASM_NOKPROBE_SYMBOL(do_uaccess_flush)
++EXPORT_SYMBOL(do_uaccess_flush)
++
+ /*
+ * Real mode exceptions actually use this too, but alternate
+ * instruction code patches (which end up in the common .text area)
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index 9fd2ff28b8ff2..dc99258f2e8c6 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -356,11 +356,9 @@ _ENTRY(ITLBMiss_cmp)
+ /* Load the MI_TWC with the attributes for this "segment." */
+ mtspr SPRN_MI_TWC, r11 /* Set segment attributes */
+
+-#ifdef CONFIG_SWAP
+- rlwinm r11, r10, 32-5, _PAGE_PRESENT
++ rlwinm r11, r10, 32-7, _PAGE_PRESENT
+ and r11, r11, r10
+ rlwimi r10, r11, 0, _PAGE_PRESENT
+-#endif
+ li r11, RPN_PATTERN | 0x200
+ /* The Linux PTE won't go exactly into the MMU TLB.
+ * Software indicator bits 20 and 23 must be clear.
+@@ -482,11 +480,9 @@ _ENTRY(DTLBMiss_jmp)
+ * r11 = ((r10 & PRESENT) & ((r10 & ACCESSED) >> 5));
+ * r10 = (r10 & ~PRESENT) | r11;
+ */
+-#ifdef CONFIG_SWAP
+- rlwinm r11, r10, 32-5, _PAGE_PRESENT
++ rlwinm r11, r10, 32-7, _PAGE_PRESENT
+ and r11, r11, r10
+ rlwimi r10, r11, 0, _PAGE_PRESENT
+-#endif
+ /* The Linux PTE won't go exactly into the MMU TLB.
+ * Software indicator bits 24, 25, 26, and 27 must be
+ * set. All other Linux PTE bits control the behavior
+diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
+index bd4996958b13d..122365624d3da 100644
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -863,7 +863,13 @@ early_initcall(disable_hardlockup_detector);
+ static enum l1d_flush_type enabled_flush_types;
+ static void *l1d_flush_fallback_area;
+ static bool no_rfi_flush;
++static bool no_entry_flush;
++static bool no_uaccess_flush;
+ bool rfi_flush;
++bool entry_flush;
++bool uaccess_flush;
++DEFINE_STATIC_KEY_FALSE(uaccess_flush_key);
++EXPORT_SYMBOL(uaccess_flush_key);
+
+ static int __init handle_no_rfi_flush(char *p)
+ {
+@@ -873,6 +879,22 @@ static int __init handle_no_rfi_flush(char *p)
+ }
+ early_param("no_rfi_flush", handle_no_rfi_flush);
+
++static int __init handle_no_entry_flush(char *p)
++{
++ pr_info("entry-flush: disabled on command line.");
++ no_entry_flush = true;
++ return 0;
++}
++early_param("no_entry_flush", handle_no_entry_flush);
++
++static int __init handle_no_uaccess_flush(char *p)
++{
++ pr_info("uaccess-flush: disabled on command line.");
++ no_uaccess_flush = true;
++ return 0;
++}
++early_param("no_uaccess_flush", handle_no_uaccess_flush);
++
+ /*
+ * The RFI flush is not KPTI, but because users will see doco that says to use
+ * nopti we hijack that option here to also disable the RFI flush.
+@@ -904,6 +926,32 @@ void rfi_flush_enable(bool enable)
+ rfi_flush = enable;
+ }
+
++void entry_flush_enable(bool enable)
++{
++ if (enable) {
++ do_entry_flush_fixups(enabled_flush_types);
++ on_each_cpu(do_nothing, NULL, 1);
++ } else {
++ do_entry_flush_fixups(L1D_FLUSH_NONE);
++ }
++
++ entry_flush = enable;
++}
++
++void uaccess_flush_enable(bool enable)
++{
++ if (enable) {
++ do_uaccess_flush_fixups(enabled_flush_types);
++ static_branch_enable(&uaccess_flush_key);
++ on_each_cpu(do_nothing, NULL, 1);
++ } else {
++ static_branch_disable(&uaccess_flush_key);
++ do_uaccess_flush_fixups(L1D_FLUSH_NONE);
++ }
++
++ uaccess_flush = enable;
++}
++
+ static void __ref init_fallback_flush(void)
+ {
+ u64 l1d_size, limit;
+@@ -957,10 +1005,28 @@ void setup_rfi_flush(enum l1d_flush_type types, bool enable)
+
+ enabled_flush_types = types;
+
+- if (!no_rfi_flush && !cpu_mitigations_off())
++ if (!cpu_mitigations_off() && !no_rfi_flush)
+ rfi_flush_enable(enable);
+ }
+
++void setup_entry_flush(bool enable)
++{
++ if (cpu_mitigations_off())
++ return;
++
++ if (!no_entry_flush)
++ entry_flush_enable(enable);
++}
++
++void setup_uaccess_flush(bool enable)
++{
++ if (cpu_mitigations_off())
++ return;
++
++ if (!no_uaccess_flush)
++ uaccess_flush_enable(enable);
++}
++
+ #ifdef CONFIG_DEBUG_FS
+ static int rfi_flush_set(void *data, u64 val)
+ {
+@@ -988,9 +1054,63 @@ static int rfi_flush_get(void *data, u64 *val)
+
+ DEFINE_SIMPLE_ATTRIBUTE(fops_rfi_flush, rfi_flush_get, rfi_flush_set, "%llu\n");
+
++static int entry_flush_set(void *data, u64 val)
++{
++ bool enable;
++
++ if (val == 1)
++ enable = true;
++ else if (val == 0)
++ enable = false;
++ else
++ return -EINVAL;
++
++ /* Only do anything if we're changing state */
++ if (enable != entry_flush)
++ entry_flush_enable(enable);
++
++ return 0;
++}
++
++static int entry_flush_get(void *data, u64 *val)
++{
++ *val = entry_flush ? 1 : 0;
++ return 0;
++}
++
++DEFINE_SIMPLE_ATTRIBUTE(fops_entry_flush, entry_flush_get, entry_flush_set, "%llu\n");
++
++static int uaccess_flush_set(void *data, u64 val)
++{
++ bool enable;
++
++ if (val == 1)
++ enable = true;
++ else if (val == 0)
++ enable = false;
++ else
++ return -EINVAL;
++
++ /* Only do anything if we're changing state */
++ if (enable != uaccess_flush)
++ uaccess_flush_enable(enable);
++
++ return 0;
++}
++
++static int uaccess_flush_get(void *data, u64 *val)
++{
++ *val = uaccess_flush ? 1 : 0;
++ return 0;
++}
++
++DEFINE_SIMPLE_ATTRIBUTE(fops_uaccess_flush, uaccess_flush_get, uaccess_flush_set, "%llu\n");
++
+ static __init int rfi_flush_debugfs_init(void)
+ {
+ debugfs_create_file("rfi_flush", 0600, powerpc_debugfs_root, NULL, &fops_rfi_flush);
++ debugfs_create_file("entry_flush", 0600, powerpc_debugfs_root, NULL, &fops_entry_flush);
++ debugfs_create_file("uaccess_flush", 0600, powerpc_debugfs_root, NULL, &fops_uaccess_flush);
+ return 0;
+ }
+ device_initcall(rfi_flush_debugfs_init);
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index d081d726ca8ea..695432965f206 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -140,6 +140,20 @@ SECTIONS
+ __stop___stf_entry_barrier_fixup = .;
+ }
+
++ . = ALIGN(8);
++ __uaccess_flush_fixup : AT(ADDR(__uaccess_flush_fixup) - LOAD_OFFSET) {
++ __start___uaccess_flush_fixup = .;
++ *(__uaccess_flush_fixup)
++ __stop___uaccess_flush_fixup = .;
++ }
++
++ . = ALIGN(8);
++ __entry_flush_fixup : AT(ADDR(__entry_flush_fixup) - LOAD_OFFSET) {
++ __start___entry_flush_fixup = .;
++ *(__entry_flush_fixup)
++ __stop___entry_flush_fixup = .;
++ }
++
+ . = ALIGN(8);
+ __stf_exit_barrier_fixup : AT(ADDR(__stf_exit_barrier_fixup) - LOAD_OFFSET) {
+ __start___stf_exit_barrier_fixup = .;
+diff --git a/arch/powerpc/lib/checksum_wrappers.c b/arch/powerpc/lib/checksum_wrappers.c
+index a0cb63fb76a1a..8d83c39be7e49 100644
+--- a/arch/powerpc/lib/checksum_wrappers.c
++++ b/arch/powerpc/lib/checksum_wrappers.c
+@@ -29,6 +29,7 @@ __wsum csum_and_copy_from_user(const void __user *src, void *dst,
+ unsigned int csum;
+
+ might_sleep();
++ allow_read_from_user(src, len);
+
+ *err_ptr = 0;
+
+@@ -60,6 +61,7 @@ __wsum csum_and_copy_from_user(const void __user *src, void *dst,
+ }
+
+ out:
++ prevent_read_from_user(src, len);
+ return (__force __wsum)csum;
+ }
+ EXPORT_SYMBOL(csum_and_copy_from_user);
+@@ -70,6 +72,7 @@ __wsum csum_and_copy_to_user(const void *src, void __user *dst, int len,
+ unsigned int csum;
+
+ might_sleep();
++ allow_write_to_user(dst, len);
+
+ *err_ptr = 0;
+
+@@ -97,6 +100,7 @@ __wsum csum_and_copy_to_user(const void *src, void __user *dst, int len,
+ }
+
+ out:
++ prevent_write_to_user(dst, len);
+ return (__force __wsum)csum;
+ }
+ EXPORT_SYMBOL(csum_and_copy_to_user);
+diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c
+index dbe478e7b8e09..065a3426f0ebc 100644
+--- a/arch/powerpc/lib/feature-fixups.c
++++ b/arch/powerpc/lib/feature-fixups.c
+@@ -232,6 +232,110 @@ void do_stf_barrier_fixups(enum stf_barrier_type types)
+ do_stf_exit_barrier_fixups(types);
+ }
+
++void do_uaccess_flush_fixups(enum l1d_flush_type types)
++{
++ unsigned int instrs[4], *dest;
++ long *start, *end;
++ int i;
++
++ start = PTRRELOC(&__start___uaccess_flush_fixup);
++ end = PTRRELOC(&__stop___uaccess_flush_fixup);
++
++ instrs[0] = 0x60000000; /* nop */
++ instrs[1] = 0x60000000; /* nop */
++ instrs[2] = 0x60000000; /* nop */
++ instrs[3] = 0x4e800020; /* blr */
++
++ i = 0;
++ if (types == L1D_FLUSH_FALLBACK) {
++ instrs[3] = 0x60000000; /* nop */
++ /* fallthrough to fallback flush */
++ }
++
++ if (types & L1D_FLUSH_ORI) {
++ instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */
++ instrs[i++] = 0x63de0000; /* ori 30,30,0 L1d flush*/
++ }
++
++ if (types & L1D_FLUSH_MTTRIG)
++ instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */
++
++ for (i = 0; start < end; start++, i++) {
++ dest = (void *)start + *start;
++
++ pr_devel("patching dest %lx\n", (unsigned long)dest);
++
++ patch_instruction(dest, instrs[0]);
++
++ patch_instruction((dest + 1), instrs[1]);
++ patch_instruction((dest + 2), instrs[2]);
++ patch_instruction((dest + 3), instrs[3]);
++ }
++
++ printk(KERN_DEBUG "uaccess-flush: patched %d locations (%s flush)\n", i,
++ (types == L1D_FLUSH_NONE) ? "no" :
++ (types == L1D_FLUSH_FALLBACK) ? "fallback displacement" :
++ (types & L1D_FLUSH_ORI) ? (types & L1D_FLUSH_MTTRIG)
++ ? "ori+mttrig type"
++ : "ori type" :
++ (types & L1D_FLUSH_MTTRIG) ? "mttrig type"
++ : "unknown");
++}
++
++void do_entry_flush_fixups(enum l1d_flush_type types)
++{
++ unsigned int instrs[3], *dest;
++ long *start, *end;
++ int i;
++
++ start = PTRRELOC(&__start___entry_flush_fixup);
++ end = PTRRELOC(&__stop___entry_flush_fixup);
++
++ instrs[0] = 0x60000000; /* nop */
++ instrs[1] = 0x60000000; /* nop */
++ instrs[2] = 0x60000000; /* nop */
++
++ i = 0;
++ if (types == L1D_FLUSH_FALLBACK) {
++ instrs[i++] = 0x7d4802a6; /* mflr r10 */
++ instrs[i++] = 0x60000000; /* branch patched below */
++ instrs[i++] = 0x7d4803a6; /* mtlr r10 */
++ }
++
++ if (types & L1D_FLUSH_ORI) {
++ instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */
++ instrs[i++] = 0x63de0000; /* ori 30,30,0 L1d flush*/
++ }
++
++ if (types & L1D_FLUSH_MTTRIG)
++ instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */
++
++ for (i = 0; start < end; start++, i++) {
++ dest = (void *)start + *start;
++
++ pr_devel("patching dest %lx\n", (unsigned long)dest);
++
++ patch_instruction(dest, instrs[0]);
++
++ if (types == L1D_FLUSH_FALLBACK)
++ patch_branch((dest + 1), (unsigned long)&entry_flush_fallback,
++ BRANCH_SET_LINK);
++ else
++ patch_instruction((dest + 1), instrs[1]);
++
++ patch_instruction((dest + 2), instrs[2]);
++ }
++
++ printk(KERN_DEBUG "entry-flush: patched %d locations (%s flush)\n", i,
++ (types == L1D_FLUSH_NONE) ? "no" :
++ (types == L1D_FLUSH_FALLBACK) ? "fallback displacement" :
++ (types & L1D_FLUSH_ORI) ? (types & L1D_FLUSH_MTTRIG)
++ ? "ori+mttrig type"
++ : "ori type" :
++ (types & L1D_FLUSH_MTTRIG) ? "mttrig type"
++ : "unknown");
++}
++
+ void do_rfi_flush_fixups(enum l1d_flush_type types)
+ {
+ unsigned int instrs[3], *dest;
+diff --git a/arch/powerpc/lib/string_32.S b/arch/powerpc/lib/string_32.S
+index f69a6aab7bfbb..1ddb26394e8ac 100644
+--- a/arch/powerpc/lib/string_32.S
++++ b/arch/powerpc/lib/string_32.S
+@@ -17,7 +17,7 @@ CACHELINE_BYTES = L1_CACHE_BYTES
+ LG_CACHELINE_BYTES = L1_CACHE_SHIFT
+ CACHELINE_MASK = (L1_CACHE_BYTES-1)
+
+-_GLOBAL(__clear_user)
++_GLOBAL(__arch_clear_user)
+ /*
+ * Use dcbz on the complete cache lines in the destination
+ * to set them to zero. This requires that the destination
+@@ -87,4 +87,4 @@ _GLOBAL(__clear_user)
+ EX_TABLE(8b, 91b)
+ EX_TABLE(9b, 91b)
+
+-EXPORT_SYMBOL(__clear_user)
++EXPORT_SYMBOL(__arch_clear_user)
+diff --git a/arch/powerpc/lib/string_64.S b/arch/powerpc/lib/string_64.S
+index 56aac4c220257..ea3798f4f25f2 100644
+--- a/arch/powerpc/lib/string_64.S
++++ b/arch/powerpc/lib/string_64.S
+@@ -29,7 +29,7 @@ PPC64_CACHES:
+ .section ".text"
+
+ /**
+- * __clear_user: - Zero a block of memory in user space, with less checking.
++ * __arch_clear_user: - Zero a block of memory in user space, with less checking.
+ * @to: Destination address, in user space.
+ * @n: Number of bytes to zero.
+ *
+@@ -70,7 +70,7 @@ err3; stb r0,0(r3)
+ mr r3,r4
+ blr
+
+-_GLOBAL_TOC(__clear_user)
++_GLOBAL_TOC(__arch_clear_user)
+ cmpdi r4,32
+ neg r6,r3
+ li r0,0
+@@ -193,4 +193,4 @@ err1; dcbz 0,r3
+ cmpdi r4,32
+ blt .Lshort_clear
+ b .Lmedium_clear
+-EXPORT_SYMBOL(__clear_user)
++EXPORT_SYMBOL(__arch_clear_user)
+diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
+index adddde0236227..5068dd7f6e74b 100644
+--- a/arch/powerpc/platforms/powernv/setup.c
++++ b/arch/powerpc/platforms/powernv/setup.c
+@@ -125,12 +125,29 @@ static void pnv_setup_rfi_flush(void)
+ type = L1D_FLUSH_ORI;
+ }
+
++ /*
++ * If we are non-Power9 bare metal, we don't need to flush on kernel
++ * entry or after user access: they fix a P9 specific vulnerability.
++ */
++ if (!pvr_version_is(PVR_POWER9)) {
++ security_ftr_clear(SEC_FTR_L1D_FLUSH_ENTRY);
++ security_ftr_clear(SEC_FTR_L1D_FLUSH_UACCESS);
++ }
++
+ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && \
+ (security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR) || \
+ security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV));
+
+ setup_rfi_flush(type, enable);
+ setup_count_cache_flush();
++
++ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
++ security_ftr_enabled(SEC_FTR_L1D_FLUSH_ENTRY);
++ setup_entry_flush(enable);
++
++ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
++ security_ftr_enabled(SEC_FTR_L1D_FLUSH_UACCESS);
++ setup_uaccess_flush(enable);
+ }
+
+ static void __init pnv_setup_arch(void)
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index c2d318d1df021..2e0d38cafdd44 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -565,6 +565,14 @@ void pseries_setup_rfi_flush(void)
+
+ setup_rfi_flush(types, enable);
+ setup_count_cache_flush();
++
++ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
++ security_ftr_enabled(SEC_FTR_L1D_FLUSH_ENTRY);
++ setup_entry_flush(enable);
++
++ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) &&
++ security_ftr_enabled(SEC_FTR_L1D_FLUSH_UACCESS);
++ setup_uaccess_flush(enable);
+ }
+
+ #ifdef CONFIG_PCI_IOV
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 670c2aedcefab..3e182c7ae7714 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -3994,6 +3994,12 @@ static int em_clflush(struct x86_emulate_ctxt *ctxt)
+ return X86EMUL_CONTINUE;
+ }
+
++static int em_clflushopt(struct x86_emulate_ctxt *ctxt)
++{
++ /* emulating clflushopt regardless of cpuid */
++ return X86EMUL_CONTINUE;
++}
++
+ static int em_movsxd(struct x86_emulate_ctxt *ctxt)
+ {
+ ctxt->dst.val = (s32) ctxt->src.val;
+@@ -4507,7 +4513,7 @@ static const struct opcode group11[] = {
+ };
+
+ static const struct gprefix pfx_0f_ae_7 = {
+- I(SrcMem | ByteOp, em_clflush), N, N, N,
++ I(SrcMem | ByteOp, em_clflush), I(SrcMem | ByteOp, em_clflushopt), N, N,
+ };
+
+ static const struct group_dual group15 = { {
+diff --git a/drivers/acpi/evged.c b/drivers/acpi/evged.c
+index 73f6093a5c16d..9f4b405a5c20b 100644
+--- a/drivers/acpi/evged.c
++++ b/drivers/acpi/evged.c
+@@ -110,7 +110,7 @@ static acpi_status acpi_ged_request_interrupt(struct acpi_resource *ares,
+
+ switch (gsi) {
+ case 0 ... 255:
+- sprintf(ev_name, "_%c%02hhX",
++ sprintf(ev_name, "_%c%02X",
+ trigger == ACPI_EDGE_SENSITIVE ? 'E' : 'L', gsi);
+
+ if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle)))
+diff --git a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c
+index ad5d7f94f95a6..1c7aa86c92ab1 100644
+--- a/drivers/input/keyboard/sunkbd.c
++++ b/drivers/input/keyboard/sunkbd.c
+@@ -111,7 +111,8 @@ static irqreturn_t sunkbd_interrupt(struct serio *serio,
+ switch (data) {
+
+ case SUNKBD_RET_RESET:
+- schedule_work(&sunkbd->tq);
++ if (sunkbd->enabled)
++ schedule_work(&sunkbd->tq);
+ sunkbd->reset = -1;
+ break;
+
+@@ -212,16 +213,12 @@ static int sunkbd_initialize(struct sunkbd *sunkbd)
+ }
+
+ /*
+- * sunkbd_reinit() sets leds and beeps to a state the computer remembers they
+- * were in.
++ * sunkbd_set_leds_beeps() sets leds and beeps to a state the computer remembers
++ * they were in.
+ */
+
+-static void sunkbd_reinit(struct work_struct *work)
++static void sunkbd_set_leds_beeps(struct sunkbd *sunkbd)
+ {
+- struct sunkbd *sunkbd = container_of(work, struct sunkbd, tq);
+-
+- wait_event_interruptible_timeout(sunkbd->wait, sunkbd->reset >= 0, HZ);
+-
+ serio_write(sunkbd->serio, SUNKBD_CMD_SETLED);
+ serio_write(sunkbd->serio,
+ (!!test_bit(LED_CAPSL, sunkbd->dev->led) << 3) |
+@@ -234,11 +231,39 @@ static void sunkbd_reinit(struct work_struct *work)
+ SUNKBD_CMD_BELLOFF - !!test_bit(SND_BELL, sunkbd->dev->snd));
+ }
+
++
++/*
++ * sunkbd_reinit() wait for the keyboard reset to complete and restores state
++ * of leds and beeps.
++ */
++
++static void sunkbd_reinit(struct work_struct *work)
++{
++ struct sunkbd *sunkbd = container_of(work, struct sunkbd, tq);
++
++ /*
++ * It is OK that we check sunkbd->enabled without pausing serio,
++ * as we only want to catch true->false transition that will
++ * happen once and we will be woken up for it.
++ */
++ wait_event_interruptible_timeout(sunkbd->wait,
++ sunkbd->reset >= 0 || !sunkbd->enabled,
++ HZ);
++
++ if (sunkbd->reset >= 0 && sunkbd->enabled)
++ sunkbd_set_leds_beeps(sunkbd);
++}
++
+ static void sunkbd_enable(struct sunkbd *sunkbd, bool enable)
+ {
+ serio_pause_rx(sunkbd->serio);
+ sunkbd->enabled = enable;
+ serio_continue_rx(sunkbd->serio);
++
++ if (!enable) {
++ wake_up_interruptible(&sunkbd->wait);
++ cancel_work_sync(&sunkbd->tq);
++ }
+ }
+
+ /*
+diff --git a/net/can/proc.c b/net/can/proc.c
+index 70fea17bb04c5..a3071f43acd76 100644
+--- a/net/can/proc.c
++++ b/net/can/proc.c
+@@ -467,6 +467,9 @@ void can_init_proc(struct net *net)
+ */
+ void can_remove_proc(struct net *net)
+ {
++ if (!net->can.proc_dir)
++ return;
++
+ if (net->can.pde_version)
+ remove_proc_entry(CAN_PROC_VERSION, net->can.proc_dir);
+
+@@ -494,6 +497,5 @@ void can_remove_proc(struct net *net)
+ if (net->can.pde_rcvlist_sff)
+ remove_proc_entry(CAN_PROC_RCVLIST_SFF, net->can.proc_dir);
+
+- if (net->can.proc_dir)
+- remove_proc_entry("can", net->proc_net);
++ remove_proc_entry("can", net->proc_net);
+ }
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 9968b8a976f19..d11eb5139c92a 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -244,6 +244,24 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
+ */
+ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
+ {
++ /*
++ * If we had used sta_info_pre_move_state() then we might not
++ * have gone through the state transitions down again, so do
++ * it here now (and warn if it's inserted).
++ *
++ * This will clear state such as fast TX/RX that may have been
++ * allocated during state transitions.
++ */
++ while (sta->sta_state > IEEE80211_STA_NONE) {
++ int ret;
++
++ WARN_ON_ONCE(test_sta_flag(sta, WLAN_STA_INSERTED));
++
++ ret = sta_info_move_state(sta, sta->sta_state - 1);
++ if (WARN_ONCE(ret, "sta_info_move_state() returned %d\n", ret))
++ break;
++ }
++
+ if (sta->rate_ctrl)
+ rate_control_free_sta(sta);
+
+diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
+index ad33b99f5d21e..7b5e15cc6b717 100644
+--- a/tools/perf/util/cs-etm.c
++++ b/tools/perf/util/cs-etm.c
+@@ -87,9 +87,6 @@ struct cs_etm_queue {
+ struct cs_etm_packet *packet;
+ };
+
+-/* RB tree for quick conversion between traceID and metadata pointers */
+-static struct intlist *traceid_list;
+-
+ static int cs_etm__update_queues(struct cs_etm_auxtrace *etm);
+ static int cs_etm__process_timeless_queues(struct cs_etm_auxtrace *etm,
+ pid_t tid, u64 time_);
+diff --git a/tools/perf/util/cs-etm.h b/tools/perf/util/cs-etm.h
+index c7ef97b198c77..37f8d48179cae 100644
+--- a/tools/perf/util/cs-etm.h
++++ b/tools/perf/util/cs-etm.h
+@@ -53,6 +53,9 @@ enum {
+ CS_ETMV4_PRIV_MAX,
+ };
+
++/* RB tree for quick conversion between traceID and CPUs */
++struct intlist *traceid_list;
++
+ #define KiB(x) ((x) * 1024)
+ #define MiB(x) ((x) * 1024 * 1024)
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-11-24 14:40 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-11-24 14:40 UTC (permalink / raw
To: gentoo-commits
commit: 66fcddb83d5ddd5929285eb27f5d2e5caeb45ee0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 24 14:39:52 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 24 14:39:52 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=66fcddb8
Linux patch 4.19.160
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1159_linux-4.19.160.patch | 2671 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2675 insertions(+)
diff --git a/0000_README b/0000_README
index 9a90375..4c3c996 100644
--- a/0000_README
+++ b/0000_README
@@ -675,6 +675,10 @@ Patch: 1158_linux-4.19.159.patch
From: https://www.kernel.org
Desc: Linux 4.19.159
+Patch: 1159_linux-4.19.160.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.160
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1159_linux-4.19.160.patch b/1159_linux-4.19.160.patch
new file mode 100644
index 0000000..96f09d2
--- /dev/null
+++ b/1159_linux-4.19.160.patch
@@ -0,0 +1,2671 @@
+diff --git a/Makefile b/Makefile
+index 593fdbce712d7..c587114984229 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 159
++SUBLEVEL = 160
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts
+index a25da415cb02e..907339bc81e54 100644
+--- a/arch/arm/boot/dts/imx50-evk.dts
++++ b/arch/arm/boot/dts/imx50-evk.dts
+@@ -59,7 +59,7 @@
+ MX50_PAD_CSPI_MISO__CSPI_MISO 0x00
+ MX50_PAD_CSPI_MOSI__CSPI_MOSI 0x00
+ MX50_PAD_CSPI_SS0__GPIO4_11 0xc4
+- MX50_PAD_ECSPI1_MOSI__CSPI_SS1 0xf4
++ MX50_PAD_ECSPI1_MOSI__GPIO4_13 0x84
+ >;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+index 4f27861bbb324..4cc9858f7ff80 100644
+--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+@@ -97,7 +97,7 @@
+ &fec {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_enet>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+index f250b20af4937..9be1c4a3d95fb 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+@@ -131,7 +131,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_sw>;
+ phy-handle = <&rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ allwinner,rx-delay-ps = <700>;
+ allwinner,tx-delay-ps = <700>;
+ status = "okay";
+diff --git a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+index 7e74ba83f8095..75396993195d1 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+@@ -168,7 +168,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_dldo4>;
+ phy-handle = <&rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
+index 71fb732089397..babf4cf1b2f68 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
+@@ -53,11 +53,6 @@
+ };
+ };
+
+-&emac {
+- /* LEDs changed to active high on the plus */
+- /delete-property/ allwinner,leds-active-low;
+-};
+-
+ &mmc1 {
+ vmmc-supply = <®_vcc3v3>;
+ bus-width = <4>;
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
+index 6dbf7b2e0c13c..b6ca45d18e511 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
+@@ -67,7 +67,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+index b2a773a718e16..5e5223a48ac7b 100644
+--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
++++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+@@ -121,7 +121,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-supply = <®_dc1sw>;
+ status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+index 094cfed13df97..13ce24e922eea 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+@@ -97,7 +97,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <&ext_rgmii_phy>;
+ phy-supply = <®_dc1sw>;
+ status = "okay";
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+index d5b6e8159a335..5d0905f0f1c1d 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+@@ -52,7 +52,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-txid";
+ phy-handle = <&ext_rgmii_phy>;
+ status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
+index 3e0d5a9c096d3..5fbfa76daae22 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
+@@ -157,7 +157,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
+index b75ca4d7d0019..7a30211d59ef5 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
+@@ -164,7 +164,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c
+index 3856d51c645b5..3ebb2a56e5f7b 100644
+--- a/arch/arm64/kernel/psci.c
++++ b/arch/arm64/kernel/psci.c
+@@ -69,7 +69,6 @@ static int cpu_psci_cpu_disable(unsigned int cpu)
+
+ static void cpu_psci_cpu_die(unsigned int cpu)
+ {
+- int ret;
+ /*
+ * There are no known implementations of PSCI actually using the
+ * power state field, pass a sensible default for now.
+@@ -77,9 +76,7 @@ static void cpu_psci_cpu_die(unsigned int cpu)
+ u32 state = PSCI_POWER_STATE_TYPE_POWER_DOWN <<
+ PSCI_0_2_POWER_STATE_TYPE_SHIFT;
+
+- ret = psci_ops.cpu_off(state);
+-
+- pr_crit("unable to power off CPU%u (%d)\n", cpu, ret);
++ psci_ops.cpu_off(state);
+ }
+
+ static int cpu_psci_cpu_kill(unsigned int cpu)
+diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
+index d129475fd40de..4254ba13c5c51 100644
+--- a/arch/mips/alchemy/common/clock.c
++++ b/arch/mips/alchemy/common/clock.c
+@@ -152,6 +152,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
+ {
+ struct clk_init_data id;
+ struct clk_hw *h;
++ struct clk *clk;
+
+ h = kzalloc(sizeof(*h), GFP_KERNEL);
+ if (!h)
+@@ -164,7 +165,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
+ id.ops = &alchemy_clkops_cpu;
+ h->init = &id;
+
+- return clk_register(NULL, h);
++ clk = clk_register(NULL, h);
++ if (IS_ERR(clk)) {
++ pr_err("failed to register clock\n");
++ kfree(h);
++ }
++
++ return clk;
+ }
+
+ /* AUXPLLs ************************************************************/
+diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
+index 0596505770dba..11985399c4695 100644
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -424,6 +424,7 @@ int has_transparent_hugepage(void)
+ }
+ return mask == PM_HUGE_MASK;
+ }
++EXPORT_SYMBOL(has_transparent_hugepage);
+
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index 0e6d01225a670..c8e1e325215b8 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -2097,4 +2097,4 @@ out:
+ return err;
+ }
+ arch_initcall(init_cpum_sampling_pmu);
+-core_param(cpum_sfb_size, CPUM_SF_MAX_SDB, sfb_size, 0640);
++core_param(cpum_sfb_size, CPUM_SF_MAX_SDB, sfb_size, 0644);
+diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
+index 16936a24795c8..3aa0e5a453030 100644
+--- a/arch/x86/kernel/cpu/microcode/intel.c
++++ b/arch/x86/kernel/cpu/microcode/intel.c
+@@ -103,53 +103,6 @@ static int has_newer_microcode(void *mc, unsigned int csig, int cpf, int new_rev
+ return find_matching_signature(mc, csig, cpf);
+ }
+
+-/*
+- * Given CPU signature and a microcode patch, this function finds if the
+- * microcode patch has matching family and model with the CPU.
+- *
+- * %true - if there's a match
+- * %false - otherwise
+- */
+-static bool microcode_matches(struct microcode_header_intel *mc_header,
+- unsigned long sig)
+-{
+- unsigned long total_size = get_totalsize(mc_header);
+- unsigned long data_size = get_datasize(mc_header);
+- struct extended_sigtable *ext_header;
+- unsigned int fam_ucode, model_ucode;
+- struct extended_signature *ext_sig;
+- unsigned int fam, model;
+- int ext_sigcount, i;
+-
+- fam = x86_family(sig);
+- model = x86_model(sig);
+-
+- fam_ucode = x86_family(mc_header->sig);
+- model_ucode = x86_model(mc_header->sig);
+-
+- if (fam == fam_ucode && model == model_ucode)
+- return true;
+-
+- /* Look for ext. headers: */
+- if (total_size <= data_size + MC_HEADER_SIZE)
+- return false;
+-
+- ext_header = (void *) mc_header + data_size + MC_HEADER_SIZE;
+- ext_sig = (void *)ext_header + EXT_HEADER_SIZE;
+- ext_sigcount = ext_header->count;
+-
+- for (i = 0; i < ext_sigcount; i++) {
+- fam_ucode = x86_family(ext_sig->sig);
+- model_ucode = x86_model(ext_sig->sig);
+-
+- if (fam == fam_ucode && model == model_ucode)
+- return true;
+-
+- ext_sig++;
+- }
+- return false;
+-}
+-
+ static struct ucode_patch *memdup_patch(void *data, unsigned int size)
+ {
+ struct ucode_patch *p;
+@@ -167,7 +120,7 @@ static struct ucode_patch *memdup_patch(void *data, unsigned int size)
+ return p;
+ }
+
+-static void save_microcode_patch(void *data, unsigned int size)
++static void save_microcode_patch(struct ucode_cpu_info *uci, void *data, unsigned int size)
+ {
+ struct microcode_header_intel *mc_hdr, *mc_saved_hdr;
+ struct ucode_patch *iter, *tmp, *p = NULL;
+@@ -213,6 +166,9 @@ static void save_microcode_patch(void *data, unsigned int size)
+ if (!p)
+ return;
+
++ if (!find_matching_signature(p->data, uci->cpu_sig.sig, uci->cpu_sig.pf))
++ return;
++
+ /*
+ * Save for early loading. On 32-bit, that needs to be a physical
+ * address as the APs are running from physical addresses, before
+@@ -347,13 +303,14 @@ scan_microcode(void *data, size_t size, struct ucode_cpu_info *uci, bool save)
+
+ size -= mc_size;
+
+- if (!microcode_matches(mc_header, uci->cpu_sig.sig)) {
++ if (!find_matching_signature(data, uci->cpu_sig.sig,
++ uci->cpu_sig.pf)) {
+ data += mc_size;
+ continue;
+ }
+
+ if (save) {
+- save_microcode_patch(data, mc_size);
++ save_microcode_patch(uci, data, mc_size);
+ goto next;
+ }
+
+@@ -486,14 +443,14 @@ static void show_saved_mc(void)
+ * Save this microcode patch. It will be loaded early when a CPU is
+ * hot-added or resumes.
+ */
+-static void save_mc_for_early(u8 *mc, unsigned int size)
++static void save_mc_for_early(struct ucode_cpu_info *uci, u8 *mc, unsigned int size)
+ {
+ /* Synchronization during CPU hotplug. */
+ static DEFINE_MUTEX(x86_cpu_microcode_mutex);
+
+ mutex_lock(&x86_cpu_microcode_mutex);
+
+- save_microcode_patch(mc, size);
++ save_microcode_patch(uci, mc, size);
+ show_saved_mc();
+
+ mutex_unlock(&x86_cpu_microcode_mutex);
+@@ -937,7 +894,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
+ * permanent memory. So it will be loaded early when a CPU is hot added
+ * or resumes.
+ */
+- save_mc_for_early(new_mc, new_mc_size);
++ save_mc_for_early(uci, new_mc, new_mc_size);
+
+ pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n",
+ cpu, new_rev, uci->cpu_sig.rev);
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index 52dd59af873ee..77d05b56089a2 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -214,28 +214,30 @@ int __init efi_alloc_page_tables(void)
+ gfp_mask = GFP_KERNEL | __GFP_ZERO;
+ efi_pgd = (pgd_t *)__get_free_pages(gfp_mask, PGD_ALLOCATION_ORDER);
+ if (!efi_pgd)
+- return -ENOMEM;
++ goto fail;
+
+ pgd = efi_pgd + pgd_index(EFI_VA_END);
+ p4d = p4d_alloc(&init_mm, pgd, EFI_VA_END);
+- if (!p4d) {
+- free_page((unsigned long)efi_pgd);
+- return -ENOMEM;
+- }
++ if (!p4d)
++ goto free_pgd;
+
+ pud = pud_alloc(&init_mm, p4d, EFI_VA_END);
+- if (!pud) {
+- if (pgtable_l5_enabled())
+- free_page((unsigned long) pgd_page_vaddr(*pgd));
+- free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
+- return -ENOMEM;
+- }
++ if (!pud)
++ goto free_p4d;
+
+ efi_mm.pgd = efi_pgd;
+ mm_init_cpumask(&efi_mm);
+ init_new_context(NULL, &efi_mm);
+
+ return 0;
++
++free_p4d:
++ if (pgtable_l5_enabled())
++ free_page((unsigned long)pgd_page_vaddr(*pgd));
++free_pgd:
++ free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
++fail:
++ return -ENOMEM;
+ }
+
+ /*
+diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c
+index 9220dcde7520c..d1ebe67c68d41 100644
+--- a/arch/xtensa/mm/cache.c
++++ b/arch/xtensa/mm/cache.c
+@@ -71,8 +71,10 @@ static inline void kmap_invalidate_coherent(struct page *page,
+ kvaddr = TLBTEMP_BASE_1 +
+ (page_to_phys(page) & DCACHE_ALIAS_MASK);
+
++ preempt_disable();
+ __invalidate_dcache_page_alias(kvaddr,
+ page_to_phys(page));
++ preempt_enable();
+ }
+ }
+ }
+@@ -157,6 +159,7 @@ void flush_dcache_page(struct page *page)
+ if (!alias && !mapping)
+ return;
+
++ preempt_disable();
+ virt = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK);
+ __flush_invalidate_dcache_page_alias(virt, phys);
+
+@@ -167,6 +170,7 @@ void flush_dcache_page(struct page *page)
+
+ if (mapping)
+ __invalidate_icache_page_alias(virt, phys);
++ preempt_enable();
+ }
+
+ /* There shouldn't be an entry in the cache for this page anymore. */
+@@ -200,8 +204,10 @@ void local_flush_cache_page(struct vm_area_struct *vma, unsigned long address,
+ unsigned long phys = page_to_phys(pfn_to_page(pfn));
+ unsigned long virt = TLBTEMP_BASE_1 + (address & DCACHE_ALIAS_MASK);
+
++ preempt_disable();
+ __flush_invalidate_dcache_page_alias(virt, phys);
+ __invalidate_icache_page_alias(virt, phys);
++ preempt_enable();
+ }
+ EXPORT_SYMBOL(local_flush_cache_page);
+
+@@ -228,11 +234,13 @@ update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep)
+ unsigned long phys = page_to_phys(page);
+ unsigned long tmp;
+
++ preempt_disable();
+ tmp = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK);
+ __flush_invalidate_dcache_page_alias(tmp, phys);
+ tmp = TLBTEMP_BASE_1 + (addr & DCACHE_ALIAS_MASK);
+ __flush_invalidate_dcache_page_alias(tmp, phys);
+ __invalidate_icache_page_alias(tmp, phys);
++ preempt_enable();
+
+ clear_bit(PG_arch_1, &page->flags);
+ }
+@@ -266,7 +274,9 @@ void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
+
+ if (alias) {
+ unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
++ preempt_disable();
+ __flush_invalidate_dcache_page_alias(t, phys);
++ preempt_enable();
+ }
+
+ /* Copy data */
+@@ -281,9 +291,11 @@ void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
+ if (alias) {
+ unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
+
++ preempt_disable();
+ __flush_invalidate_dcache_range((unsigned long) dst, len);
+ if ((vma->vm_flags & VM_EXEC) != 0)
+ __invalidate_icache_page_alias(t, phys);
++ preempt_enable();
+
+ } else if ((vma->vm_flags & VM_EXEC) != 0) {
+ __flush_dcache_range((unsigned long)dst,len);
+@@ -305,7 +317,9 @@ extern void copy_from_user_page(struct vm_area_struct *vma, struct page *page,
+
+ if (alias) {
+ unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
++ preempt_disable();
+ __flush_invalidate_dcache_page_alias(t, phys);
++ preempt_enable();
+ }
+
+ memcpy(dst, src, len);
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index f43f5adc21b61..abf101451c929 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -98,7 +98,18 @@ static const struct dmi_system_id lid_blacklst[] = {
+ */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "E2215T MD60198"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "E2215T"),
++ },
++ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
++ },
++ {
++ /*
++ * Medion Akoya E2228T, notification of the LID device only
++ * happens on close, not on open and _LID always returns closed.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "E2228T"),
+ },
+ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
+ },
+diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
+index cbec9adc01c76..0d3754a4ac209 100644
+--- a/drivers/atm/nicstar.c
++++ b/drivers/atm/nicstar.c
+@@ -1705,6 +1705,8 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
+
+ if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
+ atomic_inc(&vcc->stats->tx_err);
++ dma_unmap_single(&card->pcidev->dev, NS_PRV_DMA(skb), skb->len,
++ DMA_TO_DEVICE);
+ dev_kfree_skb_any(skb);
+ return -EIO;
+ }
+diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+index 31875b636434a..5073622cbb567 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+@@ -140,6 +140,7 @@ static int sun8i_dw_hdmi_bind(struct device *dev, struct device *master,
+ phy_node = of_parse_phandle(dev->of_node, "phys", 0);
+ if (!phy_node) {
+ dev_err(dev, "Can't found PHY phandle\n");
++ ret = -EINVAL;
+ goto err_disable_clk_tmds;
+ }
+
+diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
+index e5fdca74a630b..c22afc9792067 100644
+--- a/drivers/iio/accel/kxcjk-1013.c
++++ b/drivers/iio/accel/kxcjk-1013.c
+@@ -134,6 +134,12 @@ enum kx_chipset {
+ KX_MAX_CHIPS /* this must be last */
+ };
+
++enum kx_acpi_type {
++ ACPI_GENERIC,
++ ACPI_SMO8500,
++ ACPI_KIOX010A,
++};
++
+ struct kxcjk1013_data {
+ struct i2c_client *client;
+ struct iio_trigger *dready_trig;
+@@ -150,7 +156,7 @@ struct kxcjk1013_data {
+ bool motion_trigger_on;
+ int64_t timestamp;
+ enum kx_chipset chipset;
+- bool is_smo8500_device;
++ enum kx_acpi_type acpi_type;
+ };
+
+ enum kxcjk1013_axis {
+@@ -277,6 +283,32 @@ static const struct {
+ {19163, 1, 0},
+ {38326, 0, 1} };
+
++#ifdef CONFIG_ACPI
++enum kiox010a_fn_index {
++ KIOX010A_SET_LAPTOP_MODE = 1,
++ KIOX010A_SET_TABLET_MODE = 2,
++};
++
++static int kiox010a_dsm(struct device *dev, int fn_index)
++{
++ acpi_handle handle = ACPI_HANDLE(dev);
++ guid_t kiox010a_dsm_guid;
++ union acpi_object *obj;
++
++ if (!handle)
++ return -ENODEV;
++
++ guid_parse("1f339696-d475-4e26-8cad-2e9f8e6d7a91", &kiox010a_dsm_guid);
++
++ obj = acpi_evaluate_dsm(handle, &kiox010a_dsm_guid, 1, fn_index, NULL);
++ if (!obj)
++ return -EIO;
++
++ ACPI_FREE(obj);
++ return 0;
++}
++#endif
++
+ static int kxcjk1013_set_mode(struct kxcjk1013_data *data,
+ enum kxcjk1013_mode mode)
+ {
+@@ -354,6 +386,13 @@ static int kxcjk1013_chip_init(struct kxcjk1013_data *data)
+ {
+ int ret;
+
++#ifdef CONFIG_ACPI
++ if (data->acpi_type == ACPI_KIOX010A) {
++ /* Make sure the kbd and touchpad on 2-in-1s using 2 KXCJ91008-s work */
++ kiox010a_dsm(&data->client->dev, KIOX010A_SET_LAPTOP_MODE);
++ }
++#endif
++
+ ret = i2c_smbus_read_byte_data(data->client, KXCJK1013_REG_WHO_AM_I);
+ if (ret < 0) {
+ dev_err(&data->client->dev, "Error reading who_am_i\n");
+@@ -1241,7 +1280,7 @@ static irqreturn_t kxcjk1013_data_rdy_trig_poll(int irq, void *private)
+
+ static const char *kxcjk1013_match_acpi_device(struct device *dev,
+ enum kx_chipset *chipset,
+- bool *is_smo8500_device)
++ enum kx_acpi_type *acpi_type)
+ {
+ const struct acpi_device_id *id;
+
+@@ -1250,7 +1289,9 @@ static const char *kxcjk1013_match_acpi_device(struct device *dev,
+ return NULL;
+
+ if (strcmp(id->id, "SMO8500") == 0)
+- *is_smo8500_device = true;
++ *acpi_type = ACPI_SMO8500;
++ else if (strcmp(id->id, "KIOX010A") == 0)
++ *acpi_type = ACPI_KIOX010A;
+
+ *chipset = (enum kx_chipset)id->driver_data;
+
+@@ -1286,7 +1327,7 @@ static int kxcjk1013_probe(struct i2c_client *client,
+ } else if (ACPI_HANDLE(&client->dev)) {
+ name = kxcjk1013_match_acpi_device(&client->dev,
+ &data->chipset,
+- &data->is_smo8500_device);
++ &data->acpi_type);
+ } else
+ return -ENODEV;
+
+@@ -1304,7 +1345,7 @@ static int kxcjk1013_probe(struct i2c_client *client,
+ indio_dev->modes = INDIO_DIRECT_MODE;
+ indio_dev->info = &kxcjk1013_info;
+
+- if (client->irq > 0 && !data->is_smo8500_device) {
++ if (client->irq > 0 && data->acpi_type != ACPI_SMO8500) {
+ ret = devm_request_threaded_irq(&client->dev, client->irq,
+ kxcjk1013_data_rdy_trig_poll,
+ kxcjk1013_event_handler,
+diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
+index a3e79bf5a04b0..3695dd7dbb9b4 100644
+--- a/drivers/input/misc/adxl34x.c
++++ b/drivers/input/misc/adxl34x.c
+@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
+ struct input_dev *input_dev;
+ const struct adxl34x_platform_data *pdata;
+ int err, range, i;
+- unsigned char revid;
++ int revid;
+
+ if (!irq) {
+ dev_err(dev, "no IRQ?\n");
+diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
+index 2a80675cfd947..de400d76df55a 100644
+--- a/drivers/input/touchscreen/Kconfig
++++ b/drivers/input/touchscreen/Kconfig
+@@ -95,6 +95,7 @@ config TOUCHSCREEN_AD7879_SPI
+ config TOUCHSCREEN_ADC
+ tristate "Generic ADC based resistive touchscreen"
+ depends on IIO
++ select IIO_BUFFER
+ select IIO_BUFFER_CB
+ help
+ Say Y here if you want to use the generic ADC
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 1950b13f22dfc..f88590074569e 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -579,7 +579,7 @@ static void can_restart(struct net_device *dev)
+ }
+ cf->can_id |= CAN_ERR_RESTARTED;
+
+- netif_rx(skb);
++ netif_rx_ni(skb);
+
+ stats->rx_packets++;
+ stats->rx_bytes += cf->can_dlc;
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index deb274a19ba00..efaa342600c41 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -675,7 +675,7 @@ static int m_can_handle_state_change(struct net_device *dev,
+ unsigned int ecr;
+
+ switch (new_state) {
+- case CAN_STATE_ERROR_ACTIVE:
++ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ priv->can.can_stats.error_warning++;
+ priv->can.state = CAN_STATE_ERROR_WARNING;
+@@ -704,7 +704,7 @@ static int m_can_handle_state_change(struct net_device *dev,
+ __m_can_get_berr_counter(dev, &bec);
+
+ switch (new_state) {
+- case CAN_STATE_ERROR_ACTIVE:
++ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ cf->can_id |= CAN_ERR_CRTL;
+ cf->data[1] = (bec.txerr > bec.rxerr) ?
+diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
+index db6ea936dc3fc..81a3fdd5e0103 100644
+--- a/drivers/net/can/ti_hecc.c
++++ b/drivers/net/can/ti_hecc.c
+@@ -903,7 +903,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->base = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->base)) {
+ dev_err(&pdev->dev, "hecc ioremap failed\n");
+- return PTR_ERR(priv->base);
++ err = PTR_ERR(priv->base);
++ goto probe_exit_candev;
+ }
+
+ /* handle hecc-ram memory */
+@@ -916,7 +917,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->hecc_ram = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->hecc_ram)) {
+ dev_err(&pdev->dev, "hecc-ram ioremap failed\n");
+- return PTR_ERR(priv->hecc_ram);
++ err = PTR_ERR(priv->hecc_ram);
++ goto probe_exit_candev;
+ }
+
+ /* handle mbx memory */
+@@ -929,13 +931,14 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->mbx = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->mbx)) {
+ dev_err(&pdev->dev, "mbx ioremap failed\n");
+- return PTR_ERR(priv->mbx);
++ err = PTR_ERR(priv->mbx);
++ goto probe_exit_candev;
+ }
+
+ irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+ if (!irq) {
+ dev_err(&pdev->dev, "No irq resource\n");
+- goto probe_exit;
++ goto probe_exit_candev;
+ }
+
+ priv->ndev = ndev;
+@@ -988,7 +991,7 @@ probe_exit_clk:
+ clk_put(priv->clk);
+ probe_exit_candev:
+ free_candev(ndev);
+-probe_exit:
++
+ return err;
+ }
+
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index 7ab87a7587545..218fadc911558 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -367,7 +367,7 @@ static const struct can_bittiming_const kvaser_usb_hydra_kcan_bittiming_c = {
+ .tseg2_max = 32,
+ .sjw_max = 16,
+ .brp_min = 1,
+- .brp_max = 4096,
++ .brp_max = 8192,
+ .brp_inc = 1,
+ };
+
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
+index 1b0afeaf1a3c2..896f5b0227295 100644
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -337,8 +337,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
+ if (!ctx)
+ return NETDEV_TX_BUSY;
+
+- can_put_echo_skb(skb, priv->netdev, ctx->ndx);
+-
+ if (cf->can_id & CAN_EFF_FLAG) {
+ /* SIDH | SIDL | EIDH | EIDL
+ * 28 - 21 | 20 19 18 x x x 17 16 | 15 - 8 | 7 - 0
+@@ -368,6 +366,8 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
+ if (cf->can_id & CAN_RTR_FLAG)
+ usb_msg.dlc |= MCBA_DLC_RTR_MASK;
+
++ can_put_echo_skb(skb, priv->netdev, ctx->ndx);
++
+ err = mcba_usb_xmit(priv, (struct mcba_usb_msg *)&usb_msg, ctx);
+ if (err)
+ goto xmit_failed;
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index db156a11e6db5..f7d653d48a1e4 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -164,7 +164,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time)
+ if (time_ref->ts_dev_1 < time_ref->ts_dev_2) {
+ /* case when event time (tsw) wraps */
+ if (ts < time_ref->ts_dev_1)
+- delta_ts = 1 << time_ref->adapter->ts_used_bits;
++ delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits);
+
+ /* Otherwise, sync time counter (ts_dev_2) has wrapped:
+ * handle case when event time (tsn) hasn't.
+@@ -176,7 +176,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time)
+ * tsn ts
+ */
+ } else if (time_ref->ts_dev_1 < ts) {
+- delta_ts = -(1 << time_ref->adapter->ts_used_bits);
++ delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits);
+ }
+
+ /* add delay between last sync and event timestamps */
+diff --git a/drivers/net/dsa/mv88e6xxx/global1_vtu.c b/drivers/net/dsa/mv88e6xxx/global1_vtu.c
+index 7a6667e0b9f9c..e17158139aa8d 100644
+--- a/drivers/net/dsa/mv88e6xxx/global1_vtu.c
++++ b/drivers/net/dsa/mv88e6xxx/global1_vtu.c
+@@ -127,11 +127,9 @@ static int mv88e6xxx_g1_vtu_vid_write(struct mv88e6xxx_chip *chip,
+ * Offset 0x08: VTU/STU Data Register 2
+ * Offset 0x09: VTU/STU Data Register 3
+ */
+-
+-static int mv88e6185_g1_vtu_data_read(struct mv88e6xxx_chip *chip,
+- struct mv88e6xxx_vtu_entry *entry)
++static int mv88e6185_g1_vtu_stu_data_read(struct mv88e6xxx_chip *chip,
++ u16 *regs)
+ {
+- u16 regs[3];
+ int i;
+
+ /* Read all 3 VTU/STU Data registers */
+@@ -144,12 +142,45 @@ static int mv88e6185_g1_vtu_data_read(struct mv88e6xxx_chip *chip,
+ return err;
+ }
+
+- /* Extract MemberTag and PortState data */
++ return 0;
++}
++
++static int mv88e6185_g1_vtu_data_read(struct mv88e6xxx_chip *chip,
++ struct mv88e6xxx_vtu_entry *entry)
++{
++ u16 regs[3];
++ int err;
++ int i;
++
++ err = mv88e6185_g1_vtu_stu_data_read(chip, regs);
++ if (err)
++ return err;
++
++ /* Extract MemberTag data */
+ for (i = 0; i < mv88e6xxx_num_ports(chip); ++i) {
+ unsigned int member_offset = (i % 4) * 4;
+- unsigned int state_offset = member_offset + 2;
+
+ entry->member[i] = (regs[i / 4] >> member_offset) & 0x3;
++ }
++
++ return 0;
++}
++
++static int mv88e6185_g1_stu_data_read(struct mv88e6xxx_chip *chip,
++ struct mv88e6xxx_vtu_entry *entry)
++{
++ u16 regs[3];
++ int err;
++ int i;
++
++ err = mv88e6185_g1_vtu_stu_data_read(chip, regs);
++ if (err)
++ return err;
++
++ /* Extract PortState data */
++ for (i = 0; i < mv88e6xxx_num_ports(chip); ++i) {
++ unsigned int state_offset = (i % 4) * 4 + 2;
++
+ entry->state[i] = (regs[i / 4] >> state_offset) & 0x3;
+ }
+
+@@ -322,6 +353,10 @@ int mv88e6185_g1_vtu_getnext(struct mv88e6xxx_chip *chip,
+ if (err)
+ return err;
+
++ err = mv88e6185_g1_stu_data_read(chip, entry);
++ if (err)
++ return err;
++
+ /* VTU DBNum[3:0] are located in VTU Operation 3:0
+ * VTU DBNum[7:4] are located in VTU Operation 11:8
+ */
+@@ -347,16 +382,20 @@ int mv88e6352_g1_vtu_getnext(struct mv88e6xxx_chip *chip,
+ return err;
+
+ if (entry->valid) {
+- /* Fetch (and mask) VLAN PortState data from the STU */
+- err = mv88e6xxx_g1_vtu_stu_get(chip, entry);
++ err = mv88e6185_g1_vtu_data_read(chip, entry);
+ if (err)
+ return err;
+
+- err = mv88e6185_g1_vtu_data_read(chip, entry);
++ err = mv88e6xxx_g1_vtu_fid_read(chip, entry);
+ if (err)
+ return err;
+
+- err = mv88e6xxx_g1_vtu_fid_read(chip, entry);
++ /* Fetch VLAN PortState data from the STU */
++ err = mv88e6xxx_g1_vtu_stu_get(chip, entry);
++ if (err)
++ return err;
++
++ err = mv88e6185_g1_stu_data_read(chip, entry);
+ if (err)
+ return err;
+ }
+diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
+index 88f8d31e4c833..7aeb2805fec45 100644
+--- a/drivers/net/ethernet/broadcom/b44.c
++++ b/drivers/net/ethernet/broadcom/b44.c
+@@ -2389,7 +2389,8 @@ static int b44_init_one(struct ssb_device *sdev,
+ goto err_out_free_dev;
+ }
+
+- if (dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30))) {
++ err = dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30));
++ if (err) {
+ dev_err(sdev->dev,
+ "Required 30BIT DMA mask unsupported by the system\n");
+ goto err_out_powerdown;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 1ea81c23039f5..511240e8246f0 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -2300,7 +2300,7 @@ static int bnxt_get_module_eeprom(struct net_device *dev,
+ /* Read A2 portion of the EEPROM */
+ if (length) {
+ start -= ETH_MODULE_SFF_8436_LEN;
+- rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 1,
++ rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 0,
+ start, length, data);
+ }
+ return rc;
+diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
+index e4fc38cbe8535..acf27c3952865 100644
+--- a/drivers/net/ethernet/faraday/ftgmac100.c
++++ b/drivers/net/ethernet/faraday/ftgmac100.c
+@@ -1884,6 +1884,8 @@ static int ftgmac100_probe(struct platform_device *pdev)
+ return 0;
+
+ err_ncsi_dev:
++ if (priv->ndev)
++ ncsi_unregister_dev(priv->ndev);
+ err_register_netdev:
+ ftgmac100_destroy_mdio(netdev);
+ err_setup_mdio:
+@@ -1904,6 +1906,8 @@ static int ftgmac100_remove(struct platform_device *pdev)
+ netdev = platform_get_drvdata(pdev);
+ priv = netdev_priv(netdev);
+
++ if (priv->ndev)
++ ncsi_unregister_dev(priv->ndev);
+ unregister_netdev(netdev);
+
+ clk_disable_unprepare(priv->clk);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
+index 04ebce738db91..926407f0bbd9d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
+@@ -1861,8 +1861,8 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev, struct mlx4_init_hca_param *param)
+ #define INIT_HCA_LOG_RD_OFFSET (INIT_HCA_QPC_OFFSET + 0x77)
+ #define INIT_HCA_MCAST_OFFSET 0x0c0
+ #define INIT_HCA_MC_BASE_OFFSET (INIT_HCA_MCAST_OFFSET + 0x00)
+-#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x12)
+-#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x16)
++#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x13)
++#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x17)
+ #define INIT_HCA_UC_STEERING_OFFSET (INIT_HCA_MCAST_OFFSET + 0x18)
+ #define INIT_HCA_LOG_MC_TABLE_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x1b)
+ #define INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN 0x6
+@@ -1870,7 +1870,7 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev, struct mlx4_init_hca_param *param)
+ #define INIT_HCA_DRIVER_VERSION_SZ 0x40
+ #define INIT_HCA_FS_PARAM_OFFSET 0x1d0
+ #define INIT_HCA_FS_BASE_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x00)
+-#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x12)
++#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x13)
+ #define INIT_HCA_FS_A0_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x18)
+ #define INIT_HCA_FS_LOG_TABLE_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x1b)
+ #define INIT_HCA_FS_ETH_BITS_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x21)
+diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.h b/drivers/net/ethernet/mellanox/mlx4/fw.h
+index 650ae08c71def..8f020f26ebf5f 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.h
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.h
+@@ -182,8 +182,8 @@ struct mlx4_init_hca_param {
+ u64 cmpt_base;
+ u64 mtt_base;
+ u64 global_caps;
+- u16 log_mc_entry_sz;
+- u16 log_mc_hash_sz;
++ u8 log_mc_entry_sz;
++ u8 log_mc_hash_sz;
+ u16 hca_core_clock; /* Internal Clock Frequency (in MHz) */
+ u8 log_num_qps;
+ u8 log_num_srqs;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index 7366033cd31cf..2190daace8735 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1999,12 +1999,15 @@ static u32 calculate_vports_min_rate_divider(struct mlx5_eswitch *esw)
+ max_guarantee = evport->info.min_rate;
+ }
+
+- return max_t(u32, max_guarantee / fw_max_bw_share, 1);
++ if (max_guarantee)
++ return max_t(u32, max_guarantee / fw_max_bw_share, 1);
++ return 0;
+ }
+
+-static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider)
++static int normalize_vports_min_rate(struct mlx5_eswitch *esw)
+ {
+ u32 fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share);
++ u32 divider = calculate_vports_min_rate_divider(esw);
+ struct mlx5_vport *evport;
+ u32 vport_max_rate;
+ u32 vport_min_rate;
+@@ -2018,9 +2021,9 @@ static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider)
+ continue;
+ vport_min_rate = evport->info.min_rate;
+ vport_max_rate = evport->info.max_rate;
+- bw_share = MLX5_MIN_BW_SHARE;
++ bw_share = 0;
+
+- if (vport_min_rate)
++ if (divider)
+ bw_share = MLX5_RATE_TO_BW_SHARE(vport_min_rate,
+ divider,
+ fw_max_bw_share);
+@@ -2045,7 +2048,6 @@ int mlx5_eswitch_set_vport_rate(struct mlx5_eswitch *esw, int vport,
+ struct mlx5_vport *evport;
+ u32 fw_max_bw_share;
+ u32 previous_min_rate;
+- u32 divider;
+ bool min_rate_supported;
+ bool max_rate_supported;
+ int err = 0;
+@@ -2071,8 +2073,7 @@ int mlx5_eswitch_set_vport_rate(struct mlx5_eswitch *esw, int vport,
+
+ previous_min_rate = evport->info.min_rate;
+ evport->info.min_rate = min_rate;
+- divider = calculate_vports_min_rate_divider(esw);
+- err = normalize_vports_min_rate(esw, divider);
++ err = normalize_vports_min_rate(esw);
+ if (err) {
+ evport->info.min_rate = previous_min_rate;
+ goto unlock;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index 423c3e9925d00..049ca4ba49deb 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -439,7 +439,8 @@ static void mlxsw_emad_trans_timeout_schedule(struct mlxsw_reg_trans *trans)
+ if (trans->core->fw_flash_in_progress)
+ timeout = msecs_to_jiffies(MLXSW_EMAD_TIMEOUT_DURING_FW_FLASH_MS);
+
+- queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw, timeout);
++ queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw,
++ timeout << trans->retries);
+ }
+
+ static int mlxsw_emad_transmit(struct mlxsw_core *mlxsw_core,
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index 085fdceb3821b..df4519c04ba07 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -145,7 +145,8 @@ static void lan743x_intr_software_isr(void *context)
+
+ int_sts = lan743x_csr_read(adapter, INT_STS);
+ if (int_sts & INT_BIT_SW_GP_) {
+- lan743x_csr_write(adapter, INT_STS, INT_BIT_SW_GP_);
++ /* disable the interrupt to prevent repeated re-triggering */
++ lan743x_csr_write(adapter, INT_EN_CLR, INT_BIT_SW_GP_);
+ intr->software_isr_flag = 1;
+ }
+ }
+@@ -1245,13 +1246,13 @@ clean_up_data_descriptor:
+ goto clear_active;
+
+ if (!(buffer_info->flags & TX_BUFFER_INFO_FLAG_TIMESTAMP_REQUESTED)) {
+- dev_kfree_skb(buffer_info->skb);
++ dev_kfree_skb_any(buffer_info->skb);
+ goto clear_skb;
+ }
+
+ if (cleanup) {
+ lan743x_ptp_unrequest_tx_timestamp(tx->adapter);
+- dev_kfree_skb(buffer_info->skb);
++ dev_kfree_skb_any(buffer_info->skb);
+ } else {
+ ignore_sync = (buffer_info->flags &
+ TX_BUFFER_INFO_FLAG_IGNORE_SYNC) != 0;
+@@ -1561,7 +1562,7 @@ static netdev_tx_t lan743x_tx_xmit_frame(struct lan743x_tx *tx,
+ if (required_number_of_descriptors >
+ lan743x_tx_get_avail_desc(tx)) {
+ if (required_number_of_descriptors > (tx->ring_size - 1)) {
+- dev_kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ } else {
+ /* save to overflow buffer */
+ tx->overflow_skb = skb;
+@@ -1594,7 +1595,7 @@ static netdev_tx_t lan743x_tx_xmit_frame(struct lan743x_tx *tx,
+ start_frame_length,
+ do_timestamp,
+ skb->ip_summed == CHECKSUM_PARTIAL)) {
+- dev_kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ goto unlock;
+ }
+
+@@ -1614,7 +1615,7 @@ static netdev_tx_t lan743x_tx_xmit_frame(struct lan743x_tx *tx,
+ * frame assembler clean up was performed inside
+ * lan743x_tx_frame_add_fragment
+ */
+- dev_kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ goto unlock;
+ }
+ }
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+index 39787bb885c86..80afc8f36e00f 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -2737,14 +2737,18 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
+ iwarp_info->partial_fpdus = kcalloc((u16)p_hwfn->p_rdma_info->num_qps,
+ sizeof(*iwarp_info->partial_fpdus),
+ GFP_KERNEL);
+- if (!iwarp_info->partial_fpdus)
++ if (!iwarp_info->partial_fpdus) {
++ rc = -ENOMEM;
+ goto err;
++ }
+
+ iwarp_info->max_num_partial_fpdus = (u16)p_hwfn->p_rdma_info->num_qps;
+
+ iwarp_info->mpa_intermediate_buf = kzalloc(buff_size, GFP_KERNEL);
+- if (!iwarp_info->mpa_intermediate_buf)
++ if (!iwarp_info->mpa_intermediate_buf) {
++ rc = -ENOMEM;
+ goto err;
++ }
+
+ /* The mpa_bufs array serves for pending RX packets received on the
+ * mpa ll2 that don't have place on the tx ring and require later
+@@ -2754,8 +2758,10 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
+ iwarp_info->mpa_bufs = kcalloc(data.input.rx_num_desc,
+ sizeof(*iwarp_info->mpa_bufs),
+ GFP_KERNEL);
+- if (!iwarp_info->mpa_bufs)
++ if (!iwarp_info->mpa_bufs) {
++ rc = -ENOMEM;
+ goto err;
++ }
+
+ INIT_LIST_HEAD(&iwarp_info->mpa_buf_pending_list);
+ INIT_LIST_HEAD(&iwarp_info->mpa_buf_list);
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+index cda5b0a9e9489..10286215092f6 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+@@ -2251,7 +2251,8 @@ static int qlcnic_83xx_restart_hw(struct qlcnic_adapter *adapter)
+
+ /* Boot either flash image or firmware image from host file system */
+ if (qlcnic_load_fw_file == 1) {
+- if (qlcnic_83xx_load_fw_image_from_host(adapter))
++ err = qlcnic_83xx_load_fw_image_from_host(adapter);
++ if (err)
+ return err;
+ } else {
+ QLC_SHARED_REG_WR32(adapter, QLCNIC_FW_IMG_VALID,
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+index c9d43bad1e2fc..9b1804a228d92 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+@@ -197,6 +197,11 @@ rx_handler_result_t rmnet_rx_handler(struct sk_buff **pskb)
+
+ dev = skb->dev;
+ port = rmnet_get_port_rcu(dev);
++ if (unlikely(!port)) {
++ atomic_long_inc(&skb->dev->rx_nohandler);
++ kfree_skb(skb);
++ goto done;
++ }
+
+ switch (port->rmnet_mode) {
+ case RMNET_EPMODE_VND:
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index d0b5844c8a315..2e2afc824a6a8 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -223,8 +223,7 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ if (ip_tunnel_collect_metadata() || gs->collect_md) {
+ __be16 flags;
+
+- flags = TUNNEL_KEY | TUNNEL_GENEVE_OPT |
+- (gnvh->oam ? TUNNEL_OAM : 0) |
++ flags = TUNNEL_KEY | (gnvh->oam ? TUNNEL_OAM : 0) |
+ (gnvh->critical ? TUNNEL_CRIT_OPT : 0);
+
+ tun_dst = udp_tun_rx_dst(skb, geneve_get_sk_family(gs), flags,
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 6e0b3dc14aa47..ebd630a94571f 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1029,7 +1029,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x05c6, 0x9011, 4)},
+ {QMI_FIXED_INTF(0x05c6, 0x9021, 1)},
+ {QMI_FIXED_INTF(0x05c6, 0x9022, 2)},
+- {QMI_FIXED_INTF(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */
++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */
+ {QMI_FIXED_INTF(0x05c6, 0x9026, 3)},
+ {QMI_FIXED_INTF(0x05c6, 0x902e, 5)},
+ {QMI_FIXED_INTF(0x05c6, 0x9031, 5)},
+diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
+index 005df24f5b3f1..4d3b62707524a 100644
+--- a/drivers/pinctrl/pinctrl-rockchip.c
++++ b/drivers/pinctrl/pinctrl-rockchip.c
+@@ -2778,7 +2778,9 @@ static int rockchip_gpio_to_irq(struct gpio_chip *gc, unsigned offset)
+ if (!bank->domain)
+ return -ENXIO;
+
++ clk_enable(bank->clk);
+ virq = irq_create_mapping(bank->domain, offset);
++ clk_disable(bank->clk);
+
+ return (virq) ? : -ENXIO;
+ }
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index ad5235ca8e4ee..8a6ca06d9c160 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1091,7 +1091,6 @@ static int _regulator_do_enable(struct regulator_dev *rdev);
+ /**
+ * set_machine_constraints - sets regulator constraints
+ * @rdev: regulator source
+- * @constraints: constraints to apply
+ *
+ * Allows platform initialisation code to define and constrain
+ * regulator circuits e.g. valid voltage/current ranges, etc. NOTE:
+@@ -1099,21 +1098,11 @@ static int _regulator_do_enable(struct regulator_dev *rdev);
+ * regulator operations to proceed i.e. set_voltage, set_current_limit,
+ * set_mode.
+ */
+-static int set_machine_constraints(struct regulator_dev *rdev,
+- const struct regulation_constraints *constraints)
++static int set_machine_constraints(struct regulator_dev *rdev)
+ {
+ int ret = 0;
+ const struct regulator_ops *ops = rdev->desc->ops;
+
+- if (constraints)
+- rdev->constraints = kmemdup(constraints, sizeof(*constraints),
+- GFP_KERNEL);
+- else
+- rdev->constraints = kzalloc(sizeof(*constraints),
+- GFP_KERNEL);
+- if (!rdev->constraints)
+- return -ENOMEM;
+-
+ ret = machine_constraints_voltage(rdev, rdev->constraints);
+ if (ret != 0)
+ return ret;
+@@ -1606,6 +1595,15 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+ }
+ }
+
++ if (r == rdev) {
++ dev_err(dev, "Supply for %s (%s) resolved to itself\n",
++ rdev->desc->name, rdev->supply_name);
++ if (!have_full_constraints())
++ return -EINVAL;
++ r = dummy_regulator_rdev;
++ get_device(&r->dev);
++ }
++
+ /*
+ * If the supply's parent device is not the same as the
+ * regulator's parent device, then ensure the parent device
+@@ -4257,7 +4255,6 @@ struct regulator_dev *
+ regulator_register(const struct regulator_desc *regulator_desc,
+ const struct regulator_config *cfg)
+ {
+- const struct regulation_constraints *constraints = NULL;
+ const struct regulator_init_data *init_data;
+ struct regulator_config *config = NULL;
+ static atomic_t regulator_no = ATOMIC_INIT(-1);
+@@ -4358,14 +4355,23 @@ regulator_register(const struct regulator_desc *regulator_desc,
+
+ /* set regulator constraints */
+ if (init_data)
+- constraints = &init_data->constraints;
++ rdev->constraints = kmemdup(&init_data->constraints,
++ sizeof(*rdev->constraints),
++ GFP_KERNEL);
++ else
++ rdev->constraints = kzalloc(sizeof(*rdev->constraints),
++ GFP_KERNEL);
++ if (!rdev->constraints) {
++ ret = -ENOMEM;
++ goto wash;
++ }
+
+ if (init_data && init_data->supply_regulator)
+ rdev->supply_name = init_data->supply_regulator;
+ else if (regulator_desc->supply_name)
+ rdev->supply_name = regulator_desc->supply_name;
+
+- ret = set_machine_constraints(rdev, constraints);
++ ret = set_machine_constraints(rdev);
+ if (ret == -EPROBE_DEFER) {
+ /* Regulator might be in bypass mode and so needs its supply
+ * to set the constraints */
+@@ -4374,7 +4380,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ * that is just being created */
+ ret = regulator_resolve_supply(rdev);
+ if (!ret)
+- ret = set_machine_constraints(rdev, constraints);
++ ret = set_machine_constraints(rdev);
+ else
+ rdev_dbg(rdev, "unable to resolve supply early: %pe\n",
+ ERR_PTR(ret));
+diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
+index 30e92a9cc97e9..4b8306594c3f1 100644
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -755,11 +755,14 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
+ * the switched regulator till yet.
+ */
+ if (pfuze_chip->flags & PFUZE_FLAG_DISABLE_SW) {
+- if (pfuze_chip->regulator_descs[i].sw_reg) {
+- desc->ops = &pfuze100_sw_disable_regulator_ops;
+- desc->enable_val = 0x8;
+- desc->disable_val = 0x0;
+- desc->enable_time = 500;
++ if (pfuze_chip->chip_id == PFUZE100 ||
++ pfuze_chip->chip_id == PFUZE200) {
++ if (pfuze_chip->regulator_descs[i].sw_reg) {
++ desc->ops = &pfuze100_sw_disable_regulator_ops;
++ desc->enable_val = 0x8;
++ desc->disable_val = 0x0;
++ desc->enable_time = 500;
++ }
+ }
+ }
+
+diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
+index 89b9314d64c9d..016330f909c09 100644
+--- a/drivers/regulator/ti-abb-regulator.c
++++ b/drivers/regulator/ti-abb-regulator.c
+@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
+ return ret;
+ }
+
+- /* If data is exactly the same, then just update index, no change */
+ info = &abb->info[sel];
++ /*
++ * When Linux kernel is starting up, we are'nt sure of the
++ * Bias configuration that bootloader has configured.
++ * So, we get to know the actual setting the first time
++ * we are asked to transition.
++ */
++ if (abb->current_info_idx == -EINVAL)
++ goto just_set_abb;
++
++ /* If data is exactly the same, then just update index, no change */
+ oinfo = &abb->info[abb->current_info_idx];
+ if (!memcmp(info, oinfo, sizeof(*info))) {
+ dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__,
+@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
+ goto out;
+ }
+
++just_set_abb:
+ ret = ti_abb_set_opp(rdev, abb, info);
+
+ out:
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index a23e7d394a0ad..157bbb13c26c6 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -2833,6 +2833,12 @@ static int _dasd_requeue_request(struct dasd_ccw_req *cqr)
+
+ if (!block)
+ return -EINVAL;
++ /*
++ * If the request is an ERP request there is nothing to requeue.
++ * This will be done with the remaining original request.
++ */
++ if (cqr->refers)
++ return 0;
+ spin_lock_irq(&cqr->dq->lock);
+ req = (struct request *) cqr->callback_data;
+ blk_mq_requeue_request(req, false);
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index b2cbdd01ab10b..a63119c35fde8 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1592,12 +1592,12 @@ start:
+ * work and to enable clocks.
+ */
+ case CLKS_OFF:
+- ufshcd_scsi_block_requests(hba);
+ hba->clk_gating.state = REQ_CLKS_ON;
+ trace_ufshcd_clk_gating(dev_name(hba->dev),
+ hba->clk_gating.state);
+- queue_work(hba->clk_gating.clk_gating_workq,
+- &hba->clk_gating.ungate_work);
++ if (queue_work(hba->clk_gating.clk_gating_workq,
++ &hba->clk_gating.ungate_work))
++ ufshcd_scsi_block_requests(hba);
+ /*
+ * fall through to check if we should wait for this
+ * work to be done or not.
+diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+index 49ea780f9f42a..dc69c41f3e380 100644
+--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
++++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+@@ -20,6 +20,7 @@ static const struct sdio_device_id sdio_ids[] =
+ { SDIO_DEVICE(0x024c, 0x0525), },
+ { SDIO_DEVICE(0x024c, 0x0623), },
+ { SDIO_DEVICE(0x024c, 0x0626), },
++ { SDIO_DEVICE(0x024c, 0x0627), },
+ { SDIO_DEVICE(0x024c, 0xb723), },
+ { /* end: all zeroes */ },
+ };
+diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c
+index 93742dbdee77b..6c754ddf12571 100644
+--- a/drivers/staging/speakup/spk_ttyio.c
++++ b/drivers/staging/speakup/spk_ttyio.c
+@@ -49,15 +49,25 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty)
+
+ if (tty->ops->write == NULL)
+ return -EOPNOTSUPP;
++
++ mutex_lock(&speakup_tty_mutex);
++ if (speakup_tty) {
++ mutex_unlock(&speakup_tty_mutex);
++ return -EBUSY;
++ }
+ speakup_tty = tty;
+
+ ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL);
+- if (!ldisc_data)
++ if (!ldisc_data) {
++ speakup_tty = NULL;
++ mutex_unlock(&speakup_tty_mutex);
+ return -ENOMEM;
++ }
+
+ sema_init(&ldisc_data->sem, 0);
+ ldisc_data->buf_free = true;
+ speakup_tty->disc_data = ldisc_data;
++ mutex_unlock(&speakup_tty_mutex);
+
+ return 0;
+ }
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 4066cb2b79cb0..7a6e26b12bf64 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -1915,16 +1915,6 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count)
+ unsigned int ucr1;
+ unsigned long flags = 0;
+ int locked = 1;
+- int retval;
+-
+- retval = clk_enable(sport->clk_per);
+- if (retval)
+- return;
+- retval = clk_enable(sport->clk_ipg);
+- if (retval) {
+- clk_disable(sport->clk_per);
+- return;
+- }
+
+ if (sport->port.sysrq)
+ locked = 0;
+@@ -1960,9 +1950,6 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count)
+
+ if (locked)
+ spin_unlock_irqrestore(&sport->port.lock, flags);
+-
+- clk_disable(sport->clk_ipg);
+- clk_disable(sport->clk_per);
+ }
+
+ /*
+@@ -2063,15 +2050,14 @@ imx_uart_console_setup(struct console *co, char *options)
+
+ retval = uart_set_options(&sport->port, co, baud, parity, bits, flow);
+
+- clk_disable(sport->clk_ipg);
+ if (retval) {
+- clk_unprepare(sport->clk_ipg);
++ clk_disable_unprepare(sport->clk_ipg);
+ goto error_console;
+ }
+
+- retval = clk_prepare(sport->clk_per);
++ retval = clk_prepare_enable(sport->clk_per);
+ if (retval)
+- clk_unprepare(sport->clk_ipg);
++ clk_disable_unprepare(sport->clk_ipg);
+
+ error_console:
+ return retval;
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index 834615f13f3e3..7808a26bd33fa 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -23,6 +23,7 @@ LIST_HEAD(efivarfs_list);
+ static void efivarfs_evict_inode(struct inode *inode)
+ {
+ clear_inode(inode);
++ kfree(inode->i_private);
+ }
+
+ static const struct super_operations efivarfs_ops = {
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 19109c04710ee..a436307eed001 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -2427,7 +2427,8 @@ void ext4_insert_dentry(struct inode *inode,
+ struct ext4_filename *fname);
+ static inline void ext4_update_dx_flag(struct inode *inode)
+ {
+- if (!ext4_has_feature_dir_index(inode->i_sb)) {
++ if (!ext4_has_feature_dir_index(inode->i_sb) &&
++ ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) {
+ /* ext4_iget() should have caught this... */
+ WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb));
+ ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);
+diff --git a/fs/libfs.c b/fs/libfs.c
+index 02158618f4c99..be57e64834e5a 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -868,7 +868,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+ size_t len, loff_t *ppos)
+ {
+ struct simple_attr *attr;
+- u64 val;
++ unsigned long long val;
+ size_t size;
+ ssize_t ret;
+
+@@ -886,7 +886,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+ goto out;
+
+ attr->set_buf[size] = '\0';
+- val = simple_strtoll(attr->set_buf, NULL, 0);
++ ret = kstrtoull(attr->set_buf, 0, &val);
++ if (ret)
++ goto out;
+ ret = attr->set(attr->data, val);
+ if (ret == 0)
+ ret = len; /* on success, claim we got the whole input */
+diff --git a/fs/super.c b/fs/super.c
+index f3a8c008e1643..9fb4553c46e63 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -1360,36 +1360,11 @@ EXPORT_SYMBOL(__sb_end_write);
+ */
+ int __sb_start_write(struct super_block *sb, int level, bool wait)
+ {
+- bool force_trylock = false;
+- int ret = 1;
++ if (!wait)
++ return percpu_down_read_trylock(sb->s_writers.rw_sem + level-1);
+
+-#ifdef CONFIG_LOCKDEP
+- /*
+- * We want lockdep to tell us about possible deadlocks with freezing
+- * but it's it bit tricky to properly instrument it. Getting a freeze
+- * protection works as getting a read lock but there are subtle
+- * problems. XFS for example gets freeze protection on internal level
+- * twice in some cases, which is OK only because we already hold a
+- * freeze protection also on higher level. Due to these cases we have
+- * to use wait == F (trylock mode) which must not fail.
+- */
+- if (wait) {
+- int i;
+-
+- for (i = 0; i < level - 1; i++)
+- if (percpu_rwsem_is_held(sb->s_writers.rw_sem + i)) {
+- force_trylock = true;
+- break;
+- }
+- }
+-#endif
+- if (wait && !force_trylock)
+- percpu_down_read(sb->s_writers.rw_sem + level-1);
+- else
+- ret = percpu_down_read_trylock(sb->s_writers.rw_sem + level-1);
+-
+- WARN_ON(force_trylock && !ret);
+- return ret;
++ percpu_down_read(sb->s_writers.rw_sem + level-1);
++ return 1;
+ }
+ EXPORT_SYMBOL(__sb_start_write);
+
+diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
+index 77528f413286b..f79cf040d7450 100644
+--- a/fs/xfs/libxfs/xfs_rmap_btree.c
++++ b/fs/xfs/libxfs/xfs_rmap_btree.c
+@@ -247,8 +247,8 @@ xfs_rmapbt_key_diff(
+ else if (y > x)
+ return -1;
+
+- x = be64_to_cpu(kp->rm_offset);
+- y = xfs_rmap_irec_offset_pack(rec);
++ x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset));
++ y = rec->rm_offset;
+ if (x > y)
+ return 1;
+ else if (y > x)
+@@ -279,8 +279,8 @@ xfs_rmapbt_diff_two_keys(
+ else if (y > x)
+ return -1;
+
+- x = be64_to_cpu(kp1->rm_offset);
+- y = be64_to_cpu(kp2->rm_offset);
++ x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset));
++ y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset));
+ if (x > y)
+ return 1;
+ else if (y > x)
+@@ -393,8 +393,8 @@ xfs_rmapbt_keys_inorder(
+ return 1;
+ else if (a > b)
+ return 0;
+- a = be64_to_cpu(k1->rmap.rm_offset);
+- b = be64_to_cpu(k2->rmap.rm_offset);
++ a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset));
++ b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset));
+ if (a <= b)
+ return 1;
+ return 0;
+@@ -423,8 +423,8 @@ xfs_rmapbt_recs_inorder(
+ return 1;
+ else if (a > b)
+ return 0;
+- a = be64_to_cpu(r1->rmap.rm_offset);
+- b = be64_to_cpu(r2->rmap.rm_offset);
++ a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset));
++ b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset));
+ if (a <= b)
+ return 1;
+ return 0;
+diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c
+index b05d65fd360b3..cf005e18d6186 100644
+--- a/fs/xfs/scrub/bmap.c
++++ b/fs/xfs/scrub/bmap.c
+@@ -225,13 +225,13 @@ xchk_bmap_xref_rmap(
+ * which doesn't track unwritten state.
+ */
+ if (owner != XFS_RMAP_OWN_COW &&
+- irec->br_state == XFS_EXT_UNWRITTEN &&
+- !(rmap.rm_flags & XFS_RMAP_UNWRITTEN))
++ !!(irec->br_state == XFS_EXT_UNWRITTEN) !=
++ !!(rmap.rm_flags & XFS_RMAP_UNWRITTEN))
+ xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
+ irec->br_startoff);
+
+- if (info->whichfork == XFS_ATTR_FORK &&
+- !(rmap.rm_flags & XFS_RMAP_ATTR_FORK))
++ if (!!(info->whichfork == XFS_ATTR_FORK) !=
++ !!(rmap.rm_flags & XFS_RMAP_ATTR_FORK))
+ xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
+ irec->br_startoff);
+ if (rmap.rm_flags & XFS_RMAP_BMBT_BLOCK)
+diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c
+index 4ae959f7ad2c0..c924fe3cdad65 100644
+--- a/fs/xfs/scrub/btree.c
++++ b/fs/xfs/scrub/btree.c
+@@ -450,32 +450,41 @@ xchk_btree_check_minrecs(
+ int level,
+ struct xfs_btree_block *block)
+ {
+- unsigned int numrecs;
+- int ok_level;
+-
+- numrecs = be16_to_cpu(block->bb_numrecs);
++ struct xfs_btree_cur *cur = bs->cur;
++ unsigned int root_level = cur->bc_nlevels - 1;
++ unsigned int numrecs = be16_to_cpu(block->bb_numrecs);
+
+ /* More records than minrecs means the block is ok. */
+- if (numrecs >= bs->cur->bc_ops->get_minrecs(bs->cur, level))
++ if (numrecs >= cur->bc_ops->get_minrecs(cur, level))
+ return;
+
+ /*
+- * Certain btree blocks /can/ have fewer than minrecs records. Any
+- * level greater than or equal to the level of the highest dedicated
+- * btree block are allowed to violate this constraint.
+- *
+- * For a btree rooted in a block, the btree root can have fewer than
+- * minrecs records. If the btree is rooted in an inode and does not
+- * store records in the root, the direct children of the root and the
+- * root itself can have fewer than minrecs records.
++ * For btrees rooted in the inode, it's possible that the root block
++ * contents spilled into a regular ondisk block because there wasn't
++ * enough space in the inode root. The number of records in that
++ * child block might be less than the standard minrecs, but that's ok
++ * provided that there's only one direct child of the root.
+ */
+- ok_level = bs->cur->bc_nlevels - 1;
+- if (bs->cur->bc_flags & XFS_BTREE_ROOT_IN_INODE)
+- ok_level--;
+- if (level >= ok_level)
++ if ((cur->bc_flags & XFS_BTREE_ROOT_IN_INODE) &&
++ level == cur->bc_nlevels - 2) {
++ struct xfs_btree_block *root_block;
++ struct xfs_buf *root_bp;
++ int root_maxrecs;
++
++ root_block = xfs_btree_get_block(cur, root_level, &root_bp);
++ root_maxrecs = cur->bc_ops->get_dmaxrecs(cur, root_level);
++ if (be16_to_cpu(root_block->bb_numrecs) != 1 ||
++ numrecs <= root_maxrecs)
++ xchk_btree_set_corrupt(bs->sc, cur, level);
+ return;
++ }
+
+- xchk_btree_set_corrupt(bs->sc, bs->cur, level);
++ /*
++ * Otherwise, only the root level is allowed to have fewer than minrecs
++ * records or keyptrs.
++ */
++ if (level < root_level)
++ xchk_btree_set_corrupt(bs->sc, cur, level);
+ }
+
+ /*
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index e11423530d642..f8873c4eb003a 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -489,9 +489,11 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info,
+ const void *from, int len,
+ __be16 flags)
+ {
+- memcpy(ip_tunnel_info_opts(info), from, len);
+ info->options_len = len;
+- info->key.tun_flags |= flags;
++ if (len > 0) {
++ memcpy(ip_tunnel_info_opts(info), from, len);
++ info->key.tun_flags |= flags;
++ }
+ }
+
+ static inline struct ip_tunnel_info *lwt_tun_info(struct lwtunnel_state *lwtstate)
+@@ -537,7 +539,6 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info,
+ __be16 flags)
+ {
+ info->options_len = 0;
+- info->key.tun_flags |= flags;
+ }
+
+ #endif /* CONFIG_INET */
+diff --git a/kernel/fail_function.c b/kernel/fail_function.c
+index bc80a4e268c0b..a52151a2291fb 100644
+--- a/kernel/fail_function.c
++++ b/kernel/fail_function.c
+@@ -261,7 +261,7 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
+
+ if (copy_from_user(buf, buffer, count)) {
+ ret = -EFAULT;
+- goto out;
++ goto out_free;
+ }
+ buf[count] = '\0';
+ sym = strstrip(buf);
+@@ -315,8 +315,9 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
+ ret = count;
+ }
+ out:
+- kfree(buf);
+ mutex_unlock(&fei_lock);
++out_free:
++ kfree(buf);
+ return ret;
+ }
+
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index b93eb4eaf7acf..ecdb7402072fa 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -258,17 +258,11 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
+ return ret;
+ }
+
+-static bool ptrace_has_cap(const struct cred *cred, struct user_namespace *ns,
+- unsigned int mode)
++static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
+ {
+- int ret;
+-
+ if (mode & PTRACE_MODE_NOAUDIT)
+- ret = security_capable(cred, ns, CAP_SYS_PTRACE, CAP_OPT_NOAUDIT);
+- else
+- ret = security_capable(cred, ns, CAP_SYS_PTRACE, CAP_OPT_NONE);
+-
+- return ret == 0;
++ return ns_capable_noaudit(ns, CAP_SYS_PTRACE);
++ return ns_capable(ns, CAP_SYS_PTRACE);
+ }
+
+ /* Returns 0 on success, -errno on denial. */
+@@ -320,7 +314,7 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ gid_eq(caller_gid, tcred->sgid) &&
+ gid_eq(caller_gid, tcred->gid))
+ goto ok;
+- if (ptrace_has_cap(cred, tcred->user_ns, mode))
++ if (ptrace_has_cap(tcred->user_ns, mode))
+ goto ok;
+ rcu_read_unlock();
+ return -EPERM;
+@@ -339,7 +333,7 @@ ok:
+ mm = task->mm;
+ if (mm &&
+ ((get_dumpable(mm) != SUID_DUMP_USER) &&
+- !ptrace_has_cap(cred, mm->user_ns, mode)))
++ !ptrace_has_cap(mm->user_ns, mode)))
+ return -EPERM;
+
+ return security_ptrace_access_check(task, mode);
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index 56e69203b6588..b9bd5a6b51386 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -36,7 +36,7 @@
+ #include <linux/filter.h>
+ #include <linux/pid.h>
+ #include <linux/ptrace.h>
+-#include <linux/security.h>
++#include <linux/capability.h>
+ #include <linux/tracehook.h>
+ #include <linux/uaccess.h>
+
+@@ -383,8 +383,7 @@ static struct seccomp_filter *seccomp_prepare_filter(struct sock_fprog *fprog)
+ * behavior of privileged children.
+ */
+ if (!task_no_new_privs(current) &&
+- security_capable(current_cred(), current_user_ns(),
+- CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) != 0)
++ !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
+ return ERR_PTR(-EACCES);
+
+ /* Allocate a new seccomp_filter */
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 8b137248b146d..d74afc256c07c 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -694,7 +694,6 @@ vm_fault_t do_huge_pmd_anonymous_page(struct vm_fault *vmf)
+ transparent_hugepage_use_zero_page()) {
+ pgtable_t pgtable;
+ struct page *zero_page;
+- bool set;
+ vm_fault_t ret;
+ pgtable = pte_alloc_one(vma->vm_mm, haddr);
+ if (unlikely(!pgtable))
+@@ -707,25 +706,25 @@ vm_fault_t do_huge_pmd_anonymous_page(struct vm_fault *vmf)
+ }
+ vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
+ ret = 0;
+- set = false;
+ if (pmd_none(*vmf->pmd)) {
+ ret = check_stable_address_space(vma->vm_mm);
+ if (ret) {
+ spin_unlock(vmf->ptl);
++ pte_free(vma->vm_mm, pgtable);
+ } else if (userfaultfd_missing(vma)) {
+ spin_unlock(vmf->ptl);
++ pte_free(vma->vm_mm, pgtable);
+ ret = handle_userfault(vmf, VM_UFFD_MISSING);
+ VM_BUG_ON(ret & VM_FAULT_FALLBACK);
+ } else {
+ set_huge_zero_page(pgtable, vma->vm_mm, vma,
+ haddr, vmf->pmd, zero_page);
+ spin_unlock(vmf->ptl);
+- set = true;
+ }
+- } else
++ } else {
+ spin_unlock(vmf->ptl);
+- if (!set)
+ pte_free(vma->vm_mm, pgtable);
++ }
+ return ret;
+ }
+ gfp = alloc_hugepage_direct_gfpmask(vma);
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 4325e7d581155..4446a523e684e 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4554,6 +4554,11 @@ refill:
+ if (!page_ref_sub_and_test(page, nc->pagecnt_bias))
+ goto refill;
+
++ if (unlikely(nc->pfmemalloc)) {
++ free_the_page(page, compound_order(page));
++ goto refill;
++ }
++
+ #if (PAGE_SIZE < PAGE_FRAG_CACHE_MAX_SIZE)
+ /* if size can vary use size else just use PAGE_SIZE */
+ size = nc->size;
+diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
+index 9ce661e2590dc..a350c05b7ff5e 100644
+--- a/net/bridge/br_device.c
++++ b/net/bridge/br_device.c
+@@ -215,6 +215,7 @@ static void br_get_stats64(struct net_device *dev,
+ sum.rx_packets += tmp.rx_packets;
+ }
+
++ netdev_stats_to_stats64(stats, &dev->stats);
+ stats->tx_bytes = sum.tx_bytes;
+ stats->tx_packets = sum.tx_packets;
+ stats->rx_bytes = sum.rx_bytes;
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 04132b0b5d360..b3edb80921248 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -722,16 +722,25 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
+ {
+ struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
+
+- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU ||
+- cfd->len > CAN_MAX_DLEN)) {
+- pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n",
++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d\n",
++ dev->type, skb->len);
++ goto free_skb;
++ }
++
++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
++ if (unlikely(cfd->len > CAN_MAX_DLEN)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d, datalen %d\n",
+ dev->type, skb->len, cfd->len);
+- kfree_skb(skb);
+- return NET_RX_DROP;
++ goto free_skb;
+ }
+
+ can_receive(skb, dev);
+ return NET_RX_SUCCESS;
++
++free_skb:
++ kfree_skb(skb);
++ return NET_RX_DROP;
+ }
+
+ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -739,16 +748,25 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
+ {
+ struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
+
+- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU ||
+- cfd->len > CANFD_MAX_DLEN)) {
+- pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n",
++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n",
++ dev->type, skb->len);
++ goto free_skb;
++ }
++
++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
++ if (unlikely(cfd->len > CANFD_MAX_DLEN)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d, datalen %d\n",
+ dev->type, skb->len, cfd->len);
+- kfree_skb(skb);
+- return NET_RX_DROP;
++ goto free_skb;
+ }
+
+ can_receive(skb, dev);
+ return NET_RX_SUCCESS;
++
++free_skb:
++ kfree_skb(skb);
++ return NET_RX_DROP;
+ }
+
+ /*
+diff --git a/net/core/devlink.c b/net/core/devlink.c
+index a77e3777c8dd3..6ad0952648967 100644
+--- a/net/core/devlink.c
++++ b/net/core/devlink.c
+@@ -1113,7 +1113,7 @@ static int devlink_nl_sb_port_pool_fill(struct sk_buff *msg,
+ err = ops->sb_occ_port_pool_get(devlink_port, devlink_sb->index,
+ pool_index, &cur, &max);
+ if (err && err != -EOPNOTSUPP)
+- return err;
++ goto sb_occ_get_failure;
+ if (!err) {
+ if (nla_put_u32(msg, DEVLINK_ATTR_SB_OCC_CUR, cur))
+ goto nla_put_failure;
+@@ -1126,8 +1126,10 @@ static int devlink_nl_sb_port_pool_fill(struct sk_buff *msg,
+ return 0;
+
+ nla_put_failure:
++ err = -EMSGSIZE;
++sb_occ_get_failure:
+ genlmsg_cancel(msg, hdr);
+- return -EMSGSIZE;
++ return err;
+ }
+
+ static int devlink_nl_cmd_sb_port_pool_get_doit(struct sk_buff *skb,
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index 023ce0fbb496d..41e32a958d08d 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -28,6 +28,7 @@
+ #include <linux/slab.h>
+ #include <linux/export.h>
+ #include <linux/if_vlan.h>
++#include <net/dsa.h>
+ #include <net/tcp.h>
+ #include <net/udp.h>
+ #include <net/addrconf.h>
+@@ -638,15 +639,15 @@ EXPORT_SYMBOL_GPL(__netpoll_setup);
+
+ int netpoll_setup(struct netpoll *np)
+ {
+- struct net_device *ndev = NULL;
++ struct net_device *ndev = NULL, *dev = NULL;
++ struct net *net = current->nsproxy->net_ns;
+ struct in_device *in_dev;
+ int err;
+
+ rtnl_lock();
+- if (np->dev_name[0]) {
+- struct net *net = current->nsproxy->net_ns;
++ if (np->dev_name[0])
+ ndev = __dev_get_by_name(net, np->dev_name);
+- }
++
+ if (!ndev) {
+ np_err(np, "%s doesn't exist, aborting\n", np->dev_name);
+ err = -ENODEV;
+@@ -654,6 +655,19 @@ int netpoll_setup(struct netpoll *np)
+ }
+ dev_hold(ndev);
+
++ /* bring up DSA management network devices up first */
++ for_each_netdev(net, dev) {
++ if (!netdev_uses_dsa(dev))
++ continue;
++
++ err = dev_change_flags(dev, dev->flags | IFF_UP);
++ if (err < 0) {
++ np_err(np, "%s failed to open %s\n",
++ np->dev_name, dev->name);
++ goto put;
++ }
++ }
++
+ if (netdev_master_upper_dev_get(ndev)) {
+ np_err(np, "%s is a slave device, aborting\n", np->dev_name);
+ err = -EBUSY;
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index f0957ebf82cf7..d07917059d70f 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -392,8 +392,10 @@ static int inet_req_diag_fill(struct sock *sk, struct sk_buff *skb,
+ r->idiag_inode = 0;
+
+ if (net_admin && nla_put_u32(skb, INET_DIAG_MARK,
+- inet_rsk(reqsk)->ir_mark))
++ inet_rsk(reqsk)->ir_mark)) {
++ nlmsg_cancel(skb, nlh);
+ return -EMSGSIZE;
++ }
+
+ nlmsg_end(skb, nlh);
+ return 0;
+diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
+index 93f1763362977..b70c9365e1313 100644
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -917,7 +917,7 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs)
+ filter_expired = after(tcp_jiffies32,
+ bbr->min_rtt_stamp + bbr_min_rtt_win_sec * HZ);
+ if (rs->rtt_us >= 0 &&
+- (rs->rtt_us <= bbr->min_rtt_us ||
++ (rs->rtt_us < bbr->min_rtt_us ||
+ (filter_expired && !rs->is_ack_delayed))) {
+ bbr->min_rtt_us = rs->rtt_us;
+ bbr->min_rtt_stamp = tcp_jiffies32;
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index 78c9743915676..2b68bd7c83c4f 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -600,7 +600,8 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
+ memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+ memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
+- if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN))
++ err = ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN);
++ if (err)
+ goto out_free;
+
+ ip6h->priority = 0;
+diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
+index 07fb219327d65..1f3c420c01c78 100644
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -276,7 +276,7 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
+ success = !!(info->flags & IEEE80211_TX_STAT_ACK);
+
+ for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+- if (ar[i].idx < 0)
++ if (ar[i].idx < 0 || !ar[i].count)
+ break;
+
+ ndx = rix_to_ndx(mi, ar[i].idx);
+@@ -289,12 +289,6 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
+ mi->r[ndx].stats.success += success;
+ }
+
+- if ((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) && (i >= 0))
+- mi->sample_packets++;
+-
+- if (mi->sample_deferred > 0)
+- mi->sample_deferred--;
+-
+ if (time_after(jiffies, mi->last_stats_update +
+ (mp->update_interval * HZ) / 1000))
+ minstrel_update_stats(mp, mi);
+@@ -373,7 +367,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
+ return;
+
+ delta = (mi->total_packets * sampling_ratio / 100) -
+- (mi->sample_packets + mi->sample_deferred / 2);
++ mi->sample_packets;
+
+ /* delta < 0: no sampling required */
+ prev_sample = mi->prev_sample;
+@@ -382,7 +376,6 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
+ return;
+
+ if (mi->total_packets >= 10000) {
+- mi->sample_deferred = 0;
+ mi->sample_packets = 0;
+ mi->total_packets = 0;
+ } else if (delta > mi->n_rates * 2) {
+@@ -407,19 +400,8 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
+ * rate sampling method should be used.
+ * Respect such rates that are not sampled for 20 interations.
+ */
+- if (mrr_capable &&
+- msr->perfect_tx_time > mr->perfect_tx_time &&
+- msr->stats.sample_skipped < 20) {
+- /* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
+- * packets that have the sampling rate deferred to the
+- * second MRR stage. Increase the sample counter only
+- * if the deferred sample rate was actually used.
+- * Use the sample_deferred counter to make sure that
+- * the sampling is not done in large bursts */
+- info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+- rate++;
+- mi->sample_deferred++;
+- } else {
++ if (msr->perfect_tx_time < mr->perfect_tx_time ||
++ msr->stats.sample_skipped >= 20) {
+ if (!msr->sample_limit)
+ return;
+
+@@ -439,6 +421,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
+
+ rate->idx = mi->r[ndx].rix;
+ rate->count = minstrel_get_retry_count(&mi->r[ndx], info);
++ info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+ }
+
+
+diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h
+index be6c3f35f48b3..d60413adb215a 100644
+--- a/net/mac80211/rc80211_minstrel.h
++++ b/net/mac80211/rc80211_minstrel.h
+@@ -98,7 +98,6 @@ struct minstrel_sta_info {
+ u8 max_prob_rate;
+ unsigned int total_packets;
+ unsigned int sample_packets;
+- int sample_deferred;
+
+ unsigned int sample_row;
+ unsigned int sample_column;
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index d11eb5139c92a..c0fae954082b7 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -634,7 +634,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
+ out_drop_sta:
+ local->num_sta--;
+ synchronize_net();
+- __cleanup_single_sta(sta);
++ cleanup_single_sta(sta);
+ out_err:
+ mutex_unlock(&local->sta_mtx);
+ kfree(sinfo);
+@@ -653,19 +653,13 @@ int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
+
+ err = sta_info_insert_check(sta);
+ if (err) {
++ sta_info_free(local, sta);
+ mutex_unlock(&local->sta_mtx);
+ rcu_read_lock();
+- goto out_free;
++ return err;
+ }
+
+- err = sta_info_insert_finish(sta);
+- if (err)
+- goto out_free;
+-
+- return 0;
+- out_free:
+- sta_info_free(local, sta);
+- return err;
++ return sta_info_insert_finish(sta);
+ }
+
+ int sta_info_insert(struct sta_info *sta)
+diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
+index 091284760d21f..f65afa7e7d289 100644
+--- a/net/ncsi/ncsi-manage.c
++++ b/net/ncsi/ncsi-manage.c
+@@ -1484,9 +1484,6 @@ struct ncsi_dev *ncsi_register_dev(struct net_device *dev,
+ ndp->ptype.dev = dev;
+ dev_add_pack(&ndp->ptype);
+
+- /* Set up generic netlink interface */
+- ncsi_init_netlink(dev);
+-
+ return nd;
+ }
+ EXPORT_SYMBOL_GPL(ncsi_register_dev);
+@@ -1566,8 +1563,6 @@ void ncsi_unregister_dev(struct ncsi_dev *nd)
+ #endif
+ spin_unlock_irqrestore(&ncsi_dev_lock, flags);
+
+- ncsi_unregister_netlink(nd->dev);
+-
+ kfree(ndp);
+ }
+ EXPORT_SYMBOL_GPL(ncsi_unregister_dev);
+diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c
+index 45f33d6dedf77..a2f4280e28898 100644
+--- a/net/ncsi/ncsi-netlink.c
++++ b/net/ncsi/ncsi-netlink.c
+@@ -397,24 +397,8 @@ static struct genl_family ncsi_genl_family __ro_after_init = {
+ .n_ops = ARRAY_SIZE(ncsi_ops),
+ };
+
+-int ncsi_init_netlink(struct net_device *dev)
++static int __init ncsi_init_netlink(void)
+ {
+- int rc;
+-
+- rc = genl_register_family(&ncsi_genl_family);
+- if (rc)
+- netdev_err(dev, "ncsi: failed to register netlink family\n");
+-
+- return rc;
+-}
+-
+-int ncsi_unregister_netlink(struct net_device *dev)
+-{
+- int rc;
+-
+- rc = genl_unregister_family(&ncsi_genl_family);
+- if (rc)
+- netdev_err(dev, "ncsi: failed to unregister netlink family\n");
+-
+- return rc;
++ return genl_register_family(&ncsi_genl_family);
+ }
++subsys_initcall(ncsi_init_netlink);
+diff --git a/net/ncsi/ncsi-netlink.h b/net/ncsi/ncsi-netlink.h
+index 91a5c256f8c4f..6c55a67751577 100644
+--- a/net/ncsi/ncsi-netlink.h
++++ b/net/ncsi/ncsi-netlink.h
+@@ -14,7 +14,4 @@
+
+ #include "internal.h"
+
+-int ncsi_init_netlink(struct net_device *dev);
+-int ncsi_unregister_netlink(struct net_device *dev);
+-
+ #endif /* __NCSI_NETLINK_H__ */
+diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
+index c92894c3e40a3..0067f472367be 100644
+--- a/net/netlabel/netlabel_unlabeled.c
++++ b/net/netlabel/netlabel_unlabeled.c
+@@ -1179,12 +1179,13 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
+ struct netlbl_unlhsh_walk_arg cb_arg;
+ u32 skip_bkt = cb->args[0];
+ u32 skip_chain = cb->args[1];
+- u32 iter_bkt;
+- u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
++ u32 skip_addr4 = cb->args[2];
++ u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
+ struct netlbl_unlhsh_iface *iface;
+ struct list_head *iter_list;
+ struct netlbl_af4list *addr4;
+ #if IS_ENABLED(CONFIG_IPV6)
++ u32 skip_addr6 = cb->args[3];
+ struct netlbl_af6list *addr6;
+ #endif
+
+@@ -1195,7 +1196,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
+ rcu_read_lock();
+ for (iter_bkt = skip_bkt;
+ iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
+- iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
++ iter_bkt++) {
+ iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
+ list_for_each_entry_rcu(iface, iter_list, list) {
+ if (!iface->valid ||
+@@ -1203,7 +1204,7 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
+ continue;
+ netlbl_af4list_foreach_rcu(addr4,
+ &iface->addr4_list) {
+- if (iter_addr4++ < cb->args[2])
++ if (iter_addr4++ < skip_addr4)
+ continue;
+ if (netlbl_unlabel_staticlist_gen(
+ NLBL_UNLABEL_C_STATICLIST,
+@@ -1216,10 +1217,12 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
+ goto unlabel_staticlist_return;
+ }
+ }
++ iter_addr4 = 0;
++ skip_addr4 = 0;
+ #if IS_ENABLED(CONFIG_IPV6)
+ netlbl_af6list_foreach_rcu(addr6,
+ &iface->addr6_list) {
+- if (iter_addr6++ < cb->args[3])
++ if (iter_addr6++ < skip_addr6)
+ continue;
+ if (netlbl_unlabel_staticlist_gen(
+ NLBL_UNLABEL_C_STATICLIST,
+@@ -1232,8 +1235,12 @@ static int netlbl_unlabel_staticlist(struct sk_buff *skb,
+ goto unlabel_staticlist_return;
+ }
+ }
++ iter_addr6 = 0;
++ skip_addr6 = 0;
+ #endif /* IPv6 */
+ }
++ iter_chain = 0;
++ skip_chain = 0;
+ }
+
+ unlabel_staticlist_return:
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index f64d882c86985..3dd900e42b85c 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -461,7 +461,7 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
+ else {
+ if (!mod_timer(&t->proto_unreach_timer,
+ jiffies + (HZ/20)))
+- sctp_association_hold(asoc);
++ sctp_transport_hold(t);
+ }
+ } else {
+ struct net *net = sock_net(sk);
+@@ -470,7 +470,7 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
+ "encountered!\n", __func__);
+
+ if (del_timer(&t->proto_unreach_timer))
+- sctp_association_put(asoc);
++ sctp_transport_put(t);
+
+ sctp_do_sm(net, SCTP_EVENT_T_OTHER,
+ SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index bb4f1d0da1533..2a94240eac360 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -434,7 +434,7 @@ void sctp_generate_proto_unreach_event(struct timer_list *t)
+ /* Try again later. */
+ if (!mod_timer(&transport->proto_unreach_timer,
+ jiffies + (HZ/20)))
+- sctp_association_hold(asoc);
++ sctp_transport_hold(transport);
+ goto out_unlock;
+ }
+
+@@ -450,7 +450,7 @@ void sctp_generate_proto_unreach_event(struct timer_list *t)
+
+ out_unlock:
+ bh_unlock_sock(sk);
+- sctp_association_put(asoc);
++ sctp_transport_put(transport);
+ }
+
+ /* Handle the timeout of the RE-CONFIG timer. */
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c
+index c0d55ed62d2e3..78302e547b2bd 100644
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -148,7 +148,7 @@ void sctp_transport_free(struct sctp_transport *transport)
+
+ /* Delete the ICMP proto unreachable timer if it's active. */
+ if (del_timer(&transport->proto_unreach_timer))
+- sctp_association_put(transport->asoc);
++ sctp_transport_put(transport);
+
+ sctp_transport_put(transport);
+ }
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 372f4194db5a0..b3db0b0a52f5c 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -1049,6 +1049,7 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
+ makex25->lci = lci;
+ makex25->dest_addr = dest_addr;
+ makex25->source_addr = source_addr;
++ x25_neigh_hold(nb);
+ makex25->neighbour = nb;
+ makex25->facilities = facilities;
+ makex25->dte_facilities= dte_facilities;
+diff --git a/sound/core/control.c b/sound/core/control.c
+index d1312f14d78fb..9cec0e8c9d536 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -1388,7 +1388,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+
+ unlock:
+ up_write(&card->controls_rwsem);
+- return 0;
++ return err;
+ }
+
+ static int snd_ctl_elem_add_user(struct snd_ctl_file *file,
+diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c
+index 36a08ba51ec79..58674a711132c 100644
+--- a/sound/firewire/fireworks/fireworks_transaction.c
++++ b/sound/firewire/fireworks/fireworks_transaction.c
+@@ -124,7 +124,7 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
+ t = (struct snd_efw_transaction *)data;
+ length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
+
+- spin_lock_irq(&efw->lock);
++ spin_lock(&efw->lock);
+
+ if (efw->push_ptr < efw->pull_ptr)
+ capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
+@@ -191,7 +191,7 @@ handle_resp_for_user(struct fw_card *card, int generation, int source,
+
+ copy_resp_to_buf(efw, data, length, rcode);
+ end:
+- spin_unlock_irq(&instances_lock);
++ spin_unlock(&instances_lock);
+ }
+
+ static void
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 382a8d179eb0d..935ca7989cfd5 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2498,13 +2498,23 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+ SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
+ SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x9506, "Clevo P955HQ", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x950A, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x95e3, "Clevo P955[ER]T", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x95e4, "Clevo P955ER", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x95e5, "Clevo P955EE6", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x95e6, "Clevo P950R[CDF]", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x96e1, "Clevo P960[ER][CDFN]-K", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x97e1, "Clevo P970[ER][CDFN]", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x97e2, "Clevo P970RC-M", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x65d2, "Clevo PB51R[CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
+@@ -7114,11 +7124,49 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1558, 0x1323, "Clevo N130ZU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x1401, "Clevo L140[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x1403, "Clevo N140CU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x1404, "Clevo N150CU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x14a1, "Clevo L141MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x4018, "Clevo NV40M[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x4019, "Clevo NV40MZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x4020, "Clevo NV40MB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x40a1, "Clevo NL40GU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x40c1, "Clevo NL40[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x40d1, "Clevo NL41DU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x50a3, "Clevo NJ51GU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x50b3, "Clevo NK50S[BEZ]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x50b6, "Clevo NK50S5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x50b8, "Clevo NK50SZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x50d5, "Clevo NP50D5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x50f0, "Clevo NH50A[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x50f3, "Clevo NH58DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x5101, "Clevo S510WU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x5157, "Clevo W517GU1", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x51a1, "Clevo NS50MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8228, "Clevo NR40BU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8520, "Clevo NH50D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8521, "Clevo NH77D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8535, "Clevo NH50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8536, "Clevo NH79D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8550, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8551, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8560, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1558, 0x8561, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1558, 0x8668, "Clevo NP50B[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8680, "Clevo NJ50LU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8686, "Clevo NH50[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8a20, "Clevo NH55DCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8a51, "Clevo NH70RCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8d50, "Clevo NH55RCQ-M", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x951d, "Clevo N950T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x961d, "Clevo N960S[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL53RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
+ SND_PCI_QUIRK(0x17aa, 0x1048, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+diff --git a/sound/pci/mixart/mixart_core.c b/sound/pci/mixart/mixart_core.c
+index 71776bfe04858..5a956f8bfa9e0 100644
+--- a/sound/pci/mixart/mixart_core.c
++++ b/sound/pci/mixart/mixart_core.c
+@@ -83,7 +83,6 @@ static int get_msg(struct mixart_mgr *mgr, struct mixart_msg *resp,
+ unsigned int i;
+ #endif
+
+- mutex_lock(&mgr->msg_lock);
+ err = 0;
+
+ /* copy message descriptor from miXart to driver */
+@@ -132,8 +131,6 @@ static int get_msg(struct mixart_mgr *mgr, struct mixart_msg *resp,
+ writel_be(headptr, MIXART_MEM(mgr, MSG_OUTBOUND_FREE_HEAD));
+
+ _clean_exit:
+- mutex_unlock(&mgr->msg_lock);
+-
+ return err;
+ }
+
+@@ -271,7 +268,9 @@ int snd_mixart_send_msg(struct mixart_mgr *mgr, struct mixart_msg *request, int
+ resp.data = resp_data;
+ resp.size = max_resp_size;
+
++ mutex_lock(&mgr->msg_lock);
+ err = get_msg(mgr, &resp, msg_frame);
++ mutex_unlock(&mgr->msg_lock);
+
+ if( request->message_id != resp.message_id )
+ dev_err(&mgr->pci->dev, "RESPONSE ERROR!\n");
+diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
+index 2f29672477892..1d06e2b7bb635 100644
+--- a/sound/soc/qcom/lpass-platform.c
++++ b/sound/soc/qcom/lpass-platform.c
+@@ -81,8 +81,10 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
+ else
+ dma_ch = 0;
+
+- if (dma_ch < 0)
++ if (dma_ch < 0) {
++ kfree(data);
+ return dma_ch;
++ }
+
+ drvdata->substream[dma_ch] = substream;
+
+@@ -103,6 +105,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
+ ret = snd_pcm_hw_constraint_integer(runtime,
+ SNDRV_PCM_HW_PARAM_PERIODS);
+ if (ret < 0) {
++ kfree(data);
+ dev_err(soc_runtime->dev, "setting constraints failed: %d\n",
+ ret);
+ return -EINVAL;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 3effe2e86197d..d4aae3fcd3cd7 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1338,13 +1338,13 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+ && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ msleep(20);
+
+- /* Zoom R16/24, Logitech H650e/H570e, Jabra 550a, Kingston HyperX
+- * needs a tiny delay here, otherwise requests like get/set
+- * frequency return as failed despite actually succeeding.
++ /* Zoom R16/24, many Logitech(at least H650e/H570e/BCC950),
++ * Jabra 550a, Kingston HyperX needs a tiny delay here,
++ * otherwise requests like get/set frequency return
++ * as failed despite actually succeeding.
+ */
+ if ((chip->usb_id == USB_ID(0x1686, 0x00dd) ||
+- chip->usb_id == USB_ID(0x046d, 0x0a46) ||
+- chip->usb_id == USB_ID(0x046d, 0x0a56) ||
++ USB_ID_VENDOR(chip->usb_id) == 0x046d || /* Logitech */
+ chip->usb_id == USB_ID(0x0b0e, 0x0349) ||
+ chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
+index 6e0189df2b3ba..0cb7f7b731fb0 100644
+--- a/tools/perf/builtin-lock.c
++++ b/tools/perf/builtin-lock.c
+@@ -620,7 +620,7 @@ static int report_lock_release_event(struct perf_evsel *evsel,
+ case SEQ_STATE_READ_ACQUIRED:
+ seq->read_count--;
+ BUG_ON(seq->read_count < 0);
+- if (!seq->read_count) {
++ if (seq->read_count) {
+ ls->nr_release++;
+ goto end;
+ }
+diff --git a/tools/testing/selftests/kvm/include/x86.h b/tools/testing/selftests/kvm/include/x86.h
+index 42c3596815b83..a7667a613bbc7 100644
+--- a/tools/testing/selftests/kvm/include/x86.h
++++ b/tools/testing/selftests/kvm/include/x86.h
+@@ -59,7 +59,7 @@ enum x86_register {
+ struct desc64 {
+ uint16_t limit0;
+ uint16_t base0;
+- unsigned base1:8, s:1, type:4, dpl:2, p:1;
++ unsigned base1:8, type:4, s:1, dpl:2, p:1;
+ unsigned limit1:4, avl:1, l:1, db:1, g:1, base2:8;
+ uint32_t base3;
+ uint32_t zero1;
+diff --git a/tools/testing/selftests/kvm/lib/x86.c b/tools/testing/selftests/kvm/lib/x86.c
+index 4d35eba73dc97..800fe36064f9a 100644
+--- a/tools/testing/selftests/kvm/lib/x86.c
++++ b/tools/testing/selftests/kvm/lib/x86.c
+@@ -449,11 +449,12 @@ static void kvm_seg_fill_gdt_64bit(struct kvm_vm *vm, struct kvm_segment *segp)
+ desc->limit0 = segp->limit & 0xFFFF;
+ desc->base0 = segp->base & 0xFFFF;
+ desc->base1 = segp->base >> 16;
+- desc->s = segp->s;
+ desc->type = segp->type;
++ desc->s = segp->s;
+ desc->dpl = segp->dpl;
+ desc->p = segp->present;
+ desc->limit1 = segp->limit >> 16;
++ desc->avl = segp->avl;
+ desc->l = segp->l;
+ desc->db = segp->db;
+ desc->g = segp->g;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-12-02 12:49 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-12-02 12:49 UTC (permalink / raw
To: gentoo-commits
commit: 1c7a6b1bfbd50f52704f439af51a76744baa1cae
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 2 12:49:30 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 2 12:49:30 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=1c7a6b1b
Linux patch 4.19.161
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1160_linux-4.19.161.patch | 2290 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2294 insertions(+)
diff --git a/0000_README b/0000_README
index 4c3c996..bb6e712 100644
--- a/0000_README
+++ b/0000_README
@@ -679,6 +679,10 @@ Patch: 1159_linux-4.19.160.patch
From: https://www.kernel.org
Desc: Linux 4.19.160
+Patch: 1160_linux-4.19.161.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.161
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1160_linux-4.19.161.patch b/1160_linux-4.19.161.patch
new file mode 100644
index 0000000..168587e
--- /dev/null
+++ b/1160_linux-4.19.161.patch
@@ -0,0 +1,2290 @@
+diff --git a/Makefile b/Makefile
+index c587114984229..84807cee57b88 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 160
++SUBLEVEL = 161
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/dra76x.dtsi b/arch/arm/boot/dts/dra76x.dtsi
+index 216e1d1a69c7d..473d6721b7887 100644
+--- a/arch/arm/boot/dts/dra76x.dtsi
++++ b/arch/arm/boot/dts/dra76x.dtsi
+@@ -35,8 +35,8 @@
+ interrupts = <GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "int0", "int1";
+- clocks = <&mcan_clk>, <&l3_iclk_div>;
+- clock-names = "cclk", "hclk";
++ clocks = <&l3_iclk_div>, <&mcan_clk>;
++ clock-names = "hclk", "cclk";
+ bosch,mram-cfg = <0x0 0 0 32 0 0 1 1>;
+ };
+ };
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 291fed0a9df82..f43519b710610 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -107,8 +107,6 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ #define pte_valid(pte) (!!(pte_val(pte) & PTE_VALID))
+ #define pte_valid_not_user(pte) \
+ ((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID)
+-#define pte_valid_young(pte) \
+- ((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF))
+ #define pte_valid_user(pte) \
+ ((pte_val(pte) & (PTE_VALID | PTE_USER)) == (PTE_VALID | PTE_USER))
+
+@@ -116,9 +114,12 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ * Could the pte be present in the TLB? We must check mm_tlb_flush_pending
+ * so that we don't erroneously return false for pages that have been
+ * remapped as PROT_NONE but are yet to be flushed from the TLB.
++ * Note that we can't make any assumptions based on the state of the access
++ * flag, since ptep_clear_flush_young() elides a DSB when invalidating the
++ * TLB.
+ */
+ #define pte_accessible(mm, pte) \
+- (mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid_young(pte))
++ (mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid(pte))
+
+ /*
+ * p??_access_permitted() is true for valid user mappings (subject to the
+@@ -144,13 +145,6 @@ static inline pte_t set_pte_bit(pte_t pte, pgprot_t prot)
+ return pte;
+ }
+
+-static inline pte_t pte_wrprotect(pte_t pte)
+-{
+- pte = clear_pte_bit(pte, __pgprot(PTE_WRITE));
+- pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
+- return pte;
+-}
+-
+ static inline pte_t pte_mkwrite(pte_t pte)
+ {
+ pte = set_pte_bit(pte, __pgprot(PTE_WRITE));
+@@ -176,6 +170,20 @@ static inline pte_t pte_mkdirty(pte_t pte)
+ return pte;
+ }
+
++static inline pte_t pte_wrprotect(pte_t pte)
++{
++ /*
++ * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY
++ * clear), set the PTE_DIRTY bit.
++ */
++ if (pte_hw_dirty(pte))
++ pte = pte_mkdirty(pte);
++
++ pte = clear_pte_bit(pte, __pgprot(PTE_WRITE));
++ pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
++ return pte;
++}
++
+ static inline pte_t pte_mkold(pte_t pte)
+ {
+ return clear_pte_bit(pte, __pgprot(PTE_AF));
+@@ -668,12 +676,6 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
+ pte = READ_ONCE(*ptep);
+ do {
+ old_pte = pte;
+- /*
+- * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY
+- * clear), set the PTE_DIRTY bit.
+- */
+- if (pte_hw_dirty(pte))
+- pte = pte_mkdirty(pte);
+ pte = pte_wrprotect(pte);
+ pte_val(pte) = cmpxchg_relaxed(&pte_val(*ptep),
+ pte_val(old_pte), pte_val(pte));
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index 4a650eb3d94a3..3b3cd12c06920 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -100,14 +100,14 @@
+ MODULE_LICENSE("GPL");
+
+ #define DEFINE_CSTATE_FORMAT_ATTR(_var, _name, _format) \
+-static ssize_t __cstate_##_var##_show(struct kobject *kobj, \
+- struct kobj_attribute *attr, \
++static ssize_t __cstate_##_var##_show(struct device *dev, \
++ struct device_attribute *attr, \
+ char *page) \
+ { \
+ BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \
+ return sprintf(page, _format "\n"); \
+ } \
+-static struct kobj_attribute format_attr_##_var = \
++static struct device_attribute format_attr_##_var = \
+ __ATTR(_name, 0444, __cstate_##_var##_show, NULL)
+
+ static ssize_t cstate_get_attr_cpumask(struct device *dev,
+diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
+index 2413169ce3627..bc348663da94d 100644
+--- a/arch/x86/events/intel/rapl.c
++++ b/arch/x86/events/intel/rapl.c
+@@ -115,18 +115,6 @@ static const char *const rapl_domain_names[NR_RAPL_DOMAINS] __initconst = {
+ * any other bit is reserved
+ */
+ #define RAPL_EVENT_MASK 0xFFULL
+-
+-#define DEFINE_RAPL_FORMAT_ATTR(_var, _name, _format) \
+-static ssize_t __rapl_##_var##_show(struct kobject *kobj, \
+- struct kobj_attribute *attr, \
+- char *page) \
+-{ \
+- BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \
+- return sprintf(page, _format "\n"); \
+-} \
+-static struct kobj_attribute format_attr_##_var = \
+- __ATTR(_name, 0444, __rapl_##_var##_show, NULL)
+-
+ #define RAPL_CNTR_WIDTH 32
+
+ #define RAPL_EVENT_ATTR_STR(_name, v, str) \
+@@ -548,7 +536,7 @@ static struct attribute_group rapl_pmu_events_group = {
+ .attrs = NULL, /* patched at runtime */
+ };
+
+-DEFINE_RAPL_FORMAT_ATTR(event, event, "config:0-7");
++PMU_FORMAT_ATTR(event, "config:0-7");
+ static struct attribute *rapl_formats_attr[] = {
+ &format_attr_event.attr,
+ NULL,
+diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
+index 7098b9b05d566..2f4ed5aa08bad 100644
+--- a/arch/x86/events/intel/uncore.c
++++ b/arch/x86/events/intel/uncore.c
+@@ -90,8 +90,8 @@ end:
+ return map;
+ }
+
+-ssize_t uncore_event_show(struct kobject *kobj,
+- struct kobj_attribute *attr, char *buf)
++ssize_t uncore_event_show(struct device *dev,
++ struct device_attribute *attr, char *buf)
+ {
+ struct uncore_event_desc *event =
+ container_of(attr, struct uncore_event_desc, attr);
+diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
+index 40e040ec31b50..0fc86ac73b511 100644
+--- a/arch/x86/events/intel/uncore.h
++++ b/arch/x86/events/intel/uncore.h
+@@ -133,7 +133,7 @@ struct intel_uncore_box {
+ #define UNCORE_BOX_FLAG_CTL_OFFS8 1 /* event config registers are 8-byte apart */
+
+ struct uncore_event_desc {
+- struct kobj_attribute attr;
++ struct device_attribute attr;
+ const char *config;
+ };
+
+@@ -153,8 +153,8 @@ struct pci2phy_map {
+
+ struct pci2phy_map *__find_pci2phy_map(int segment);
+
+-ssize_t uncore_event_show(struct kobject *kobj,
+- struct kobj_attribute *attr, char *buf);
++ssize_t uncore_event_show(struct device *dev,
++ struct device_attribute *attr, char *buf);
+
+ #define INTEL_UNCORE_EVENT_DESC(_name, _config) \
+ { \
+@@ -163,14 +163,14 @@ ssize_t uncore_event_show(struct kobject *kobj,
+ }
+
+ #define DEFINE_UNCORE_FORMAT_ATTR(_var, _name, _format) \
+-static ssize_t __uncore_##_var##_show(struct kobject *kobj, \
+- struct kobj_attribute *attr, \
++static ssize_t __uncore_##_var##_show(struct device *dev, \
++ struct device_attribute *attr, \
+ char *page) \
+ { \
+ BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \
+ return sprintf(page, _format "\n"); \
+ } \
+-static struct kobj_attribute format_attr_##_var = \
++static struct device_attribute format_attr_##_var = \
+ __ATTR(_name, 0444, __uncore_##_var##_show, NULL)
+
+ static inline bool uncore_pmc_fixed(int idx)
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 4876411a072a7..98b74711e6b74 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1472,6 +1472,7 @@ int kvm_test_age_hva(struct kvm *kvm, unsigned long hva);
+ void kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte);
+ int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v);
+ int kvm_cpu_has_interrupt(struct kvm_vcpu *vcpu);
++int kvm_cpu_has_extint(struct kvm_vcpu *v);
+ int kvm_arch_interrupt_allowed(struct kvm_vcpu *vcpu);
+ int kvm_cpu_get_interrupt(struct kvm_vcpu *v);
+ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event);
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 9e482fbdb28fb..c524fa1f4c0e6 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -733,11 +733,13 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ if (boot_cpu_has(X86_FEATURE_IBPB)) {
+ setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+
++ spectre_v2_user_ibpb = mode;
+ switch (cmd) {
+ case SPECTRE_V2_USER_CMD_FORCE:
+ case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
+ case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
+ static_branch_enable(&switch_mm_always_ibpb);
++ spectre_v2_user_ibpb = SPECTRE_V2_USER_STRICT;
+ break;
+ case SPECTRE_V2_USER_CMD_PRCTL:
+ case SPECTRE_V2_USER_CMD_AUTO:
+@@ -751,8 +753,6 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
+ static_key_enabled(&switch_mm_always_ibpb) ?
+ "always-on" : "conditional");
+-
+- spectre_v2_user_ibpb = mode;
+ }
+
+ /*
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index e62e416dd1162..12083f200e096 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -515,6 +515,24 @@ unlock:
+ return ret ?: nbytes;
+ }
+
++/**
++ * rdtgroup_remove - the helper to remove resource group safely
++ * @rdtgrp: resource group to remove
++ *
++ * On resource group creation via a mkdir, an extra kernfs_node reference is
++ * taken to ensure that the rdtgroup structure remains accessible for the
++ * rdtgroup_kn_unlock() calls where it is removed.
++ *
++ * Drop the extra reference here, then free the rdtgroup structure.
++ *
++ * Return: void
++ */
++static void rdtgroup_remove(struct rdtgroup *rdtgrp)
++{
++ kernfs_put(rdtgrp->kn);
++ kfree(rdtgrp);
++}
++
+ struct task_move_callback {
+ struct callback_head work;
+ struct rdtgroup *rdtgrp;
+@@ -537,7 +555,7 @@ static void move_myself(struct callback_head *head)
+ (rdtgrp->flags & RDT_DELETED)) {
+ current->closid = 0;
+ current->rmid = 0;
+- kfree(rdtgrp);
++ rdtgroup_remove(rdtgrp);
+ }
+
+ preempt_disable();
+@@ -1626,7 +1644,6 @@ static int rdtgroup_mkdir_info_resdir(struct rdt_resource *r, char *name,
+ if (IS_ERR(kn_subdir))
+ return PTR_ERR(kn_subdir);
+
+- kernfs_get(kn_subdir);
+ ret = rdtgroup_kn_set_ugid(kn_subdir);
+ if (ret)
+ return ret;
+@@ -1649,7 +1666,6 @@ static int rdtgroup_create_info_dir(struct kernfs_node *parent_kn)
+ kn_info = kernfs_create_dir(parent_kn, "info", parent_kn->mode, NULL);
+ if (IS_ERR(kn_info))
+ return PTR_ERR(kn_info);
+- kernfs_get(kn_info);
+
+ ret = rdtgroup_add_files(kn_info, RF_TOP_INFO);
+ if (ret)
+@@ -1670,12 +1686,6 @@ static int rdtgroup_create_info_dir(struct kernfs_node *parent_kn)
+ goto out_destroy;
+ }
+
+- /*
+- * This extra ref will be put in kernfs_remove() and guarantees
+- * that @rdtgrp->kn is always accessible.
+- */
+- kernfs_get(kn_info);
+-
+ ret = rdtgroup_kn_set_ugid(kn_info);
+ if (ret)
+ goto out_destroy;
+@@ -1704,12 +1714,6 @@ mongroup_create_dir(struct kernfs_node *parent_kn, struct rdtgroup *prgrp,
+ if (dest_kn)
+ *dest_kn = kn;
+
+- /*
+- * This extra ref will be put in kernfs_remove() and guarantees
+- * that @rdtgrp->kn is always accessible.
+- */
+- kernfs_get(kn);
+-
+ ret = rdtgroup_kn_set_ugid(kn);
+ if (ret)
+ goto out_destroy;
+@@ -1973,8 +1977,7 @@ void rdtgroup_kn_unlock(struct kernfs_node *kn)
+ rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED)
+ rdtgroup_pseudo_lock_remove(rdtgrp);
+ kernfs_unbreak_active_protection(kn);
+- kernfs_put(rdtgrp->kn);
+- kfree(rdtgrp);
++ rdtgroup_remove(rdtgrp);
+ } else {
+ kernfs_unbreak_active_protection(kn);
+ }
+@@ -2025,7 +2028,6 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,
+ dentry = ERR_PTR(ret);
+ goto out_info;
+ }
+- kernfs_get(kn_mongrp);
+
+ ret = mkdir_mondata_all(rdtgroup_default.kn,
+ &rdtgroup_default, &kn_mondata);
+@@ -2033,7 +2035,6 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,
+ dentry = ERR_PTR(ret);
+ goto out_mongrp;
+ }
+- kernfs_get(kn_mondata);
+ rdtgroup_default.mon.mon_data_kn = kn_mondata;
+ }
+
+@@ -2185,7 +2186,7 @@ static void free_all_child_rdtgrp(struct rdtgroup *rdtgrp)
+ if (atomic_read(&sentry->waitcount) != 0)
+ sentry->flags = RDT_DELETED;
+ else
+- kfree(sentry);
++ rdtgroup_remove(sentry);
+ }
+ }
+
+@@ -2227,7 +2228,7 @@ static void rmdir_all_sub(void)
+ if (atomic_read(&rdtgrp->waitcount) != 0)
+ rdtgrp->flags = RDT_DELETED;
+ else
+- kfree(rdtgrp);
++ rdtgroup_remove(rdtgrp);
+ }
+ /* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */
+ update_closid_rmid(cpu_online_mask, &rdtgroup_default);
+@@ -2326,11 +2327,6 @@ static int mkdir_mondata_subdir(struct kernfs_node *parent_kn,
+ if (IS_ERR(kn))
+ return PTR_ERR(kn);
+
+- /*
+- * This extra ref will be put in kernfs_remove() and guarantees
+- * that kn is always accessible.
+- */
+- kernfs_get(kn);
+ ret = rdtgroup_kn_set_ugid(kn);
+ if (ret)
+ goto out_destroy;
+@@ -2622,8 +2618,8 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
+ /*
+ * kernfs_remove() will drop the reference count on "kn" which
+ * will free it. But we still need it to stick around for the
+- * rdtgroup_kn_unlock(kn} call below. Take one extra reference
+- * here, which will be dropped inside rdtgroup_kn_unlock().
++ * rdtgroup_kn_unlock(kn) call. Take one extra reference here,
++ * which will be dropped by kernfs_put() in rdtgroup_remove().
+ */
+ kernfs_get(kn);
+
+@@ -2664,6 +2660,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
+ out_idfree:
+ free_rmid(rdtgrp->mon.rmid);
+ out_destroy:
++ kernfs_put(rdtgrp->kn);
+ kernfs_remove(rdtgrp->kn);
+ out_free_rgrp:
+ kfree(rdtgrp);
+@@ -2676,7 +2673,7 @@ static void mkdir_rdt_prepare_clean(struct rdtgroup *rgrp)
+ {
+ kernfs_remove(rgrp->kn);
+ free_rmid(rgrp->mon.rmid);
+- kfree(rgrp);
++ rdtgroup_remove(rgrp);
+ }
+
+ /*
+@@ -2838,11 +2835,6 @@ static int rdtgroup_rmdir_mon(struct kernfs_node *kn, struct rdtgroup *rdtgrp,
+ WARN_ON(list_empty(&prdtgrp->mon.crdtgrp_list));
+ list_del(&rdtgrp->mon.crdtgrp_list);
+
+- /*
+- * one extra hold on this, will drop when we kfree(rdtgrp)
+- * in rdtgroup_kn_unlock()
+- */
+- kernfs_get(kn);
+ kernfs_remove(rdtgrp->kn);
+
+ return 0;
+@@ -2854,11 +2846,6 @@ static int rdtgroup_ctrl_remove(struct kernfs_node *kn,
+ rdtgrp->flags = RDT_DELETED;
+ list_del(&rdtgrp->rdtgroup_list);
+
+- /*
+- * one extra hold on this, will drop when we kfree(rdtgrp)
+- * in rdtgroup_kn_unlock()
+- */
+- kernfs_get(kn);
+ kernfs_remove(rdtgrp->kn);
+ return 0;
+ }
+diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
+index 007bc654f928a..295ebadb8f2c1 100644
+--- a/arch/x86/kvm/irq.c
++++ b/arch/x86/kvm/irq.c
+@@ -52,29 +52,10 @@ static int pending_userspace_extint(struct kvm_vcpu *v)
+ * check if there is pending interrupt from
+ * non-APIC source without intack.
+ */
+-static int kvm_cpu_has_extint(struct kvm_vcpu *v)
+-{
+- u8 accept = kvm_apic_accept_pic_intr(v);
+-
+- if (accept) {
+- if (irqchip_split(v->kvm))
+- return pending_userspace_extint(v);
+- else
+- return v->kvm->arch.vpic->output;
+- } else
+- return 0;
+-}
+-
+-/*
+- * check if there is injectable interrupt:
+- * when virtual interrupt delivery enabled,
+- * interrupt from apic will handled by hardware,
+- * we don't need to check it here.
+- */
+-int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v)
++int kvm_cpu_has_extint(struct kvm_vcpu *v)
+ {
+ /*
+- * FIXME: interrupt.injected represents an interrupt that it's
++ * FIXME: interrupt.injected represents an interrupt whose
+ * side-effects have already been applied (e.g. bit from IRR
+ * already moved to ISR). Therefore, it is incorrect to rely
+ * on interrupt.injected to know if there is a pending
+@@ -87,6 +68,23 @@ int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v)
+ if (!lapic_in_kernel(v))
+ return v->arch.interrupt.injected;
+
++ if (!kvm_apic_accept_pic_intr(v))
++ return 0;
++
++ if (irqchip_split(v->kvm))
++ return pending_userspace_extint(v);
++ else
++ return v->kvm->arch.vpic->output;
++}
++
++/*
++ * check if there is injectable interrupt:
++ * when virtual interrupt delivery enabled,
++ * interrupt from apic will handled by hardware,
++ * we don't need to check it here.
++ */
++int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v)
++{
+ if (kvm_cpu_has_extint(v))
+ return 1;
+
+@@ -102,20 +100,6 @@ int kvm_cpu_has_injectable_intr(struct kvm_vcpu *v)
+ */
+ int kvm_cpu_has_interrupt(struct kvm_vcpu *v)
+ {
+- /*
+- * FIXME: interrupt.injected represents an interrupt that it's
+- * side-effects have already been applied (e.g. bit from IRR
+- * already moved to ISR). Therefore, it is incorrect to rely
+- * on interrupt.injected to know if there is a pending
+- * interrupt in the user-mode LAPIC.
+- * This leads to nVMX/nSVM not be able to distinguish
+- * if it should exit from L2 to L1 on EXTERNAL_INTERRUPT on
+- * pending interrupt or should re-inject an injected
+- * interrupt.
+- */
+- if (!lapic_in_kernel(v))
+- return v->arch.interrupt.injected;
+-
+ if (kvm_cpu_has_extint(v))
+ return 1;
+
+@@ -129,16 +113,21 @@ EXPORT_SYMBOL_GPL(kvm_cpu_has_interrupt);
+ */
+ static int kvm_cpu_get_extint(struct kvm_vcpu *v)
+ {
+- if (kvm_cpu_has_extint(v)) {
+- if (irqchip_split(v->kvm)) {
+- int vector = v->arch.pending_external_vector;
+-
+- v->arch.pending_external_vector = -1;
+- return vector;
+- } else
+- return kvm_pic_read_irq(v->kvm); /* PIC */
+- } else
++ if (!kvm_cpu_has_extint(v)) {
++ WARN_ON(!lapic_in_kernel(v));
+ return -1;
++ }
++
++ if (!lapic_in_kernel(v))
++ return v->arch.interrupt.nr;
++
++ if (irqchip_split(v->kvm)) {
++ int vector = v->arch.pending_external_vector;
++
++ v->arch.pending_external_vector = -1;
++ return vector;
++ } else
++ return kvm_pic_read_irq(v->kvm); /* PIC */
+ }
+
+ /*
+@@ -146,13 +135,7 @@ static int kvm_cpu_get_extint(struct kvm_vcpu *v)
+ */
+ int kvm_cpu_get_interrupt(struct kvm_vcpu *v)
+ {
+- int vector;
+-
+- if (!lapic_in_kernel(v))
+- return v->arch.interrupt.nr;
+-
+- vector = kvm_cpu_get_extint(v);
+-
++ int vector = kvm_cpu_get_extint(v);
+ if (vector != -1)
+ return vector; /* PIC */
+
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index bba2f76c356dd..56a4b9762b0c1 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2284,7 +2284,7 @@ int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu)
+ struct kvm_lapic *apic = vcpu->arch.apic;
+ u32 ppr;
+
+- if (!kvm_apic_hw_enabled(apic))
++ if (!kvm_apic_present(vcpu))
+ return -1;
+
+ __apic_update_ppr(apic, &ppr);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index dd182228be714..7096578ef7370 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3351,21 +3351,23 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
+
+ static int kvm_cpu_accept_dm_intr(struct kvm_vcpu *vcpu)
+ {
++ /*
++ * We can accept userspace's request for interrupt injection
++ * as long as we have a place to store the interrupt number.
++ * The actual injection will happen when the CPU is able to
++ * deliver the interrupt.
++ */
++ if (kvm_cpu_has_extint(vcpu))
++ return false;
++
++ /* Acknowledging ExtINT does not happen if LINT0 is masked. */
+ return (!lapic_in_kernel(vcpu) ||
+ kvm_apic_accept_pic_intr(vcpu));
+ }
+
+-/*
+- * if userspace requested an interrupt window, check that the
+- * interrupt window is open.
+- *
+- * No need to exit to userspace if we already have an interrupt queued.
+- */
+ static int kvm_vcpu_ready_for_interrupt_injection(struct kvm_vcpu *vcpu)
+ {
+ return kvm_arch_interrupt_allowed(vcpu) &&
+- !kvm_cpu_has_interrupt(vcpu) &&
+- !kvm_event_needs_reinjection(vcpu) &&
+ kvm_cpu_accept_dm_intr(vcpu);
+ }
+
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index 717b4847b473f..6fffb86a32add 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -101,10 +101,20 @@ void xen_init_lock_cpu(int cpu)
+
+ void xen_uninit_lock_cpu(int cpu)
+ {
++ int irq;
++
+ if (!xen_pvspin)
+ return;
+
+- unbind_from_irqhandler(per_cpu(lock_kicker_irq, cpu), NULL);
++ /*
++ * When booting the kernel with 'mitigations=auto,nosmt', the secondary
++ * CPUs are not activated, and lock_kicker_irq is not initialized.
++ */
++ irq = per_cpu(lock_kicker_irq, cpu);
++ if (irq == -1)
++ return;
++
++ unbind_from_irqhandler(irq, NULL);
+ per_cpu(lock_kicker_irq, cpu) = -1;
+ kfree(per_cpu(irq_name, cpu));
+ per_cpu(irq_name, cpu) = NULL;
+diff --git a/arch/xtensa/include/asm/uaccess.h b/arch/xtensa/include/asm/uaccess.h
+index f1158b4c629cf..da4effe270072 100644
+--- a/arch/xtensa/include/asm/uaccess.h
++++ b/arch/xtensa/include/asm/uaccess.h
+@@ -291,7 +291,7 @@ strncpy_from_user(char *dst, const char *src, long count)
+ return -EFAULT;
+ }
+ #else
+-long strncpy_from_user(char *dst, const char *src, long count);
++long strncpy_from_user(char *dst, const char __user *src, long count);
+ #endif
+
+ /*
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index c564df713efc3..15b30d2d8f7ed 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2774,7 +2774,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
+ * If burst size is smaller than bus width then make sure we only
+ * transfer one at a time to avoid a burst stradling an MFIFO entry.
+ */
+- if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
++ if (burst * 8 < pl330->pcfg.data_bus_width)
+ desc->rqcfg.brst_len = 1;
+
+ desc->bytes_requested = len;
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index d56b6b0e22a84..28592137fb67e 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -453,8 +453,8 @@ struct xilinx_dma_device {
+ #define to_dma_tx_descriptor(tx) \
+ container_of(tx, struct xilinx_dma_tx_descriptor, async_tx)
+ #define xilinx_dma_poll_timeout(chan, reg, val, cond, delay_us, timeout_us) \
+- readl_poll_timeout(chan->xdev->regs + chan->ctrl_offset + reg, val, \
+- cond, delay_us, timeout_us)
++ readl_poll_timeout_atomic(chan->xdev->regs + chan->ctrl_offset + reg, \
++ val, cond, delay_us, timeout_us)
+
+ /* IO accessors */
+ static inline u32 dma_read(struct xilinx_dma_chan *chan, u32 reg)
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index 1a4b44923aeca..281cf9cbb44c4 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -1702,27 +1702,6 @@ drm_atomic_set_crtc_for_connector(struct drm_connector_state *conn_state,
+ struct drm_connector *connector = conn_state->connector;
+ struct drm_crtc_state *crtc_state;
+
+- /*
+- * For compatibility with legacy users, we want to make sure that
+- * we allow DPMS On<->Off modesets on unregistered connectors, since
+- * legacy modesetting users will not be expecting these to fail. We do
+- * not however, want to allow legacy users to assign a connector
+- * that's been unregistered from sysfs to another CRTC, since doing
+- * this with a now non-existent connector could potentially leave us
+- * in an invalid state.
+- *
+- * Since the connector can be unregistered at any point during an
+- * atomic check or commit, this is racy. But that's OK: all we care
+- * about is ensuring that userspace can't use this connector for new
+- * configurations after it's been notified that the connector is no
+- * longer present.
+- */
+- if (!READ_ONCE(connector->registered) && crtc) {
+- DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] is not registered\n",
+- connector->base.id, connector->name);
+- return -EINVAL;
+- }
+-
+ if (conn_state->crtc == crtc)
+ return 0;
+
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index c22062cc99923..d24a15484e31c 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -307,6 +307,26 @@ update_connector_routing(struct drm_atomic_state *state,
+ return 0;
+ }
+
++ crtc_state = drm_atomic_get_new_crtc_state(state,
++ new_connector_state->crtc);
++ /*
++ * For compatibility with legacy users, we want to make sure that
++ * we allow DPMS On->Off modesets on unregistered connectors. Modesets
++ * which would result in anything else must be considered invalid, to
++ * avoid turning on new displays on dead connectors.
++ *
++ * Since the connector can be unregistered at any point during an
++ * atomic check or commit, this is racy. But that's OK: all we care
++ * about is ensuring that userspace can't do anything but shut off the
++ * display on a connector that was destroyed after its been notified,
++ * not before.
++ */
++ if (drm_connector_is_unregistered(connector) && crtc_state->active) {
++ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] is not registered\n",
++ connector->base.id, connector->name);
++ return -EINVAL;
++ }
++
+ funcs = connector->helper_private;
+
+ if (funcs->atomic_best_encoder)
+@@ -351,7 +371,6 @@ update_connector_routing(struct drm_atomic_state *state,
+
+ set_best_encoder(state, new_connector_state, new_encoder);
+
+- crtc_state = drm_atomic_get_new_crtc_state(state, new_connector_state->crtc);
+ crtc_state->connectors_changed = true;
+
+ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] using [ENCODER:%d:%s] on [CRTC:%d:%s]\n",
+diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
+index 6011d769d50bb..7bb68ca4aa0ba 100644
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -375,7 +375,8 @@ void drm_connector_cleanup(struct drm_connector *connector)
+ /* The connector should have been removed from userspace long before
+ * it is finally destroyed.
+ */
+- if (WARN_ON(connector->registered))
++ if (WARN_ON(connector->registration_state ==
++ DRM_CONNECTOR_REGISTERED))
+ drm_connector_unregister(connector);
+
+ if (connector->tile_group) {
+@@ -432,7 +433,7 @@ int drm_connector_register(struct drm_connector *connector)
+ return 0;
+
+ mutex_lock(&connector->mutex);
+- if (connector->registered)
++ if (connector->registration_state != DRM_CONNECTOR_INITIALIZING)
+ goto unlock;
+
+ ret = drm_sysfs_connector_add(connector);
+@@ -452,7 +453,7 @@ int drm_connector_register(struct drm_connector *connector)
+
+ drm_mode_object_register(connector->dev, &connector->base);
+
+- connector->registered = true;
++ connector->registration_state = DRM_CONNECTOR_REGISTERED;
+ goto unlock;
+
+ err_debugfs:
+@@ -474,7 +475,7 @@ EXPORT_SYMBOL(drm_connector_register);
+ void drm_connector_unregister(struct drm_connector *connector)
+ {
+ mutex_lock(&connector->mutex);
+- if (!connector->registered) {
++ if (connector->registration_state != DRM_CONNECTOR_REGISTERED) {
+ mutex_unlock(&connector->mutex);
+ return;
+ }
+@@ -485,7 +486,7 @@ void drm_connector_unregister(struct drm_connector *connector)
+ drm_sysfs_connector_remove(connector);
+ drm_debugfs_connector_remove(connector);
+
+- connector->registered = false;
++ connector->registration_state = DRM_CONNECTOR_UNREGISTERED;
+ mutex_unlock(&connector->mutex);
+ }
+ EXPORT_SYMBOL(drm_connector_unregister);
+diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
+index c7d52c66ff298..8a19cfcfc4f18 100644
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -77,7 +77,7 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
+ pipe_config->pbn = mst_pbn;
+
+ /* Zombie connectors can't have VCPI slots */
+- if (READ_ONCE(connector->registered)) {
++ if (!drm_connector_is_unregistered(connector)) {
+ slots = drm_dp_atomic_find_vcpi_slots(state,
+ &intel_dp->mst_mgr,
+ port,
+@@ -317,7 +317,7 @@ static int intel_dp_mst_get_ddc_modes(struct drm_connector *connector)
+ struct edid *edid;
+ int ret;
+
+- if (!READ_ONCE(connector->registered))
++ if (drm_connector_is_unregistered(connector))
+ return intel_connector_update_modes(connector, NULL);
+
+ edid = drm_dp_mst_get_edid(connector, &intel_dp->mst_mgr, intel_connector->port);
+@@ -333,7 +333,7 @@ intel_dp_mst_detect(struct drm_connector *connector, bool force)
+ struct intel_connector *intel_connector = to_intel_connector(connector);
+ struct intel_dp *intel_dp = intel_connector->mst_port;
+
+- if (!READ_ONCE(connector->registered))
++ if (drm_connector_is_unregistered(connector))
+ return connector_status_disconnected;
+ return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr,
+ intel_connector->port);
+@@ -376,7 +376,7 @@ intel_dp_mst_mode_valid(struct drm_connector *connector,
+ int bpp = 24; /* MST uses fixed bpp */
+ int max_rate, mode_rate, max_lanes, max_link_clock;
+
+- if (!READ_ONCE(connector->registered))
++ if (drm_connector_is_unregistered(connector))
+ return MODE_ERROR;
+
+ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c
+index 1689568b597d4..12c5d7c96527a 100644
+--- a/drivers/hid/hid-cypress.c
++++ b/drivers/hid/hid-cypress.c
+@@ -26,19 +26,17 @@
+ #define CP_2WHEEL_MOUSE_HACK 0x02
+ #define CP_2WHEEL_MOUSE_HACK_ON 0x04
+
++#define VA_INVAL_LOGICAL_BOUNDARY 0x08
++
+ /*
+ * Some USB barcode readers from cypress have usage min and usage max in
+ * the wrong order
+ */
+-static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++static __u8 *cp_rdesc_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
+ unsigned int i;
+
+- if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
+- return rdesc;
+-
+ if (*rsize < 4)
+ return rdesc;
+
+@@ -51,6 +49,40 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ return rdesc;
+ }
+
++static __u8 *va_logical_boundary_fixup(struct hid_device *hdev, __u8 *rdesc,
++ unsigned int *rsize)
++{
++ /*
++ * Varmilo VA104M (with VID Cypress and device ID 07B1) incorrectly
++ * reports Logical Minimum of its Consumer Control device as 572
++ * (0x02 0x3c). Fix this by setting its Logical Minimum to zero.
++ */
++ if (*rsize == 25 &&
++ rdesc[0] == 0x05 && rdesc[1] == 0x0c &&
++ rdesc[2] == 0x09 && rdesc[3] == 0x01 &&
++ rdesc[6] == 0x19 && rdesc[7] == 0x00 &&
++ rdesc[11] == 0x16 && rdesc[12] == 0x3c && rdesc[13] == 0x02) {
++ hid_info(hdev,
++ "fixing up varmilo VA104M consumer control report descriptor\n");
++ rdesc[12] = 0x00;
++ rdesc[13] = 0x00;
++ }
++ return rdesc;
++}
++
++static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++ unsigned int *rsize)
++{
++ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
++
++ if (quirks & CP_RDESC_SWAPPED_MIN_MAX)
++ rdesc = cp_rdesc_fixup(hdev, rdesc, rsize);
++ if (quirks & VA_INVAL_LOGICAL_BOUNDARY)
++ rdesc = va_logical_boundary_fixup(hdev, rdesc, rsize);
++
++ return rdesc;
++}
++
+ static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ struct hid_field *field, struct hid_usage *usage,
+ unsigned long **bit, int *max)
+@@ -131,6 +163,8 @@ static const struct hid_device_id cp_devices[] = {
+ .driver_data = CP_RDESC_SWAPPED_MIN_MAX },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE),
+ .driver_data = CP_2WHEEL_MOUSE_HACK },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1),
++ .driver_data = VA_INVAL_LOGICAL_BOUNDARY },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, cp_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index e18d796d985f8..6d118da1615d4 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -330,6 +330,8 @@
+ #define USB_DEVICE_ID_CYPRESS_BARCODE_4 0xed81
+ #define USB_DEVICE_ID_CYPRESS_TRUETOUCH 0xc001
+
++#define USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1 0X07b1
++
+ #define USB_VENDOR_ID_DATA_MODUL 0x7374
+ #define USB_VENDOR_ID_DATA_MODUL_EASYMAXTOUCH 0x1201
+
+@@ -442,6 +444,10 @@
+ #define USB_VENDOR_ID_FRUCTEL 0x25B6
+ #define USB_DEVICE_ID_GAMETEL_MT_MODE 0x0002
+
++#define USB_VENDOR_ID_GAMEVICE 0x27F8
++#define USB_DEVICE_ID_GAMEVICE_GV186 0x0BBE
++#define USB_DEVICE_ID_GAMEVICE_KISHI 0x0BBF
++
+ #define USB_VENDOR_ID_GAMERON 0x0810
+ #define USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR 0x0001
+ #define USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR 0x0002
+@@ -477,6 +483,7 @@
+ #define USB_DEVICE_ID_PENPOWER 0x00f4
+
+ #define USB_VENDOR_ID_GREENASIA 0x0e8f
++#define USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR 0x3010
+ #define USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD 0x3013
+
+ #define USB_VENDOR_ID_GRETAGMACBETH 0x0971
+@@ -726,6 +733,7 @@
+ #define USB_VENDOR_ID_LOGITECH 0x046d
+ #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
+ #define USB_DEVICE_ID_LOGITECH_T651 0xb00c
++#define USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD 0xb309
+ #define USB_DEVICE_ID_LOGITECH_C007 0xc007
+ #define USB_DEVICE_ID_LOGITECH_C077 0xc077
+ #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 11bd2ca22a2e6..13deb9a676855 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -331,6 +331,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ USB_DEVICE_ID_ASUSTEK_T100CHI_KEYBOARD),
+ HID_BATTERY_QUIRK_IGNORE },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
++ USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD),
++ HID_BATTERY_QUIRK_IGNORE },
+ {}
+ };
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 2d8d20a7f4574..10cb42a00fe87 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -85,7 +85,12 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_FUTABA, USB_DEVICE_ID_LED_DISPLAY), HID_QUIRK_NO_INIT_REPORTS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD), HID_QUIRK_MULTI_INPUT },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_GV186),
++ HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_KISHI),
++ HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index 4256fdc5cd6d5..21fbdcde1faa1 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -496,7 +496,8 @@ static int sensor_hub_raw_event(struct hid_device *hdev,
+ return 1;
+
+ ptr = raw_data;
+- ptr++; /* Skip report id */
++ if (report->id)
++ ptr++; /* Skip report id */
+
+ spin_lock_irqsave(&pdata->lock, flags);
+
+diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
+index a6531ffe29a6f..a5694dec3f2ee 100644
+--- a/drivers/infiniband/hw/mthca/mthca_cq.c
++++ b/drivers/infiniband/hw/mthca/mthca_cq.c
+@@ -808,8 +808,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
+ }
+
+ mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
+- if (IS_ERR(mailbox))
++ if (IS_ERR(mailbox)) {
++ err = PTR_ERR(mailbox);
+ goto err_out_arm;
++ }
+
+ cq_context = mailbox->buf;
+
+@@ -851,9 +853,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
+ }
+
+ spin_lock_irq(&dev->cq_table.lock);
+- if (mthca_array_set(&dev->cq_table.cq,
+- cq->cqn & (dev->limits.num_cqs - 1),
+- cq)) {
++ err = mthca_array_set(&dev->cq_table.cq,
++ cq->cqn & (dev->limits.num_cqs - 1), cq);
++ if (err) {
+ spin_unlock_irq(&dev->cq_table.lock);
+ goto err_out_free_mr;
+ }
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 95a78ccbd8470..fef3b4064f187 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -125,6 +125,7 @@ module_param_named(unmask_kbd_data, i8042_unmask_kbd_data, bool, 0600);
+ MODULE_PARM_DESC(unmask_kbd_data, "Unconditional enable (may reveal sensitive data) of normally sanitize-filtered kbd data traffic debug log [pre-condition: i8042.debug=1 enabled]");
+ #endif
+
++static bool i8042_present;
+ static bool i8042_bypass_aux_irq_test;
+ static char i8042_kbd_firmware_id[128];
+ static char i8042_aux_firmware_id[128];
+@@ -345,6 +346,9 @@ int i8042_command(unsigned char *param, int command)
+ unsigned long flags;
+ int retval;
+
++ if (!i8042_present)
++ return -1;
++
+ spin_lock_irqsave(&i8042_lock, flags);
+ retval = __i8042_command(param, command);
+ spin_unlock_irqrestore(&i8042_lock, flags);
+@@ -1613,12 +1617,15 @@ static int __init i8042_init(void)
+
+ err = i8042_platform_init();
+ if (err)
+- return err;
++ return (err == -ENODEV) ? 0 : err;
+
+ err = i8042_controller_check();
+ if (err)
+ goto err_platform_exit;
+
++ /* Set this before creating the dev to allow i8042_command to work right away */
++ i8042_present = true;
++
+ pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0);
+ if (IS_ERR(pdev)) {
+ err = PTR_ERR(pdev);
+@@ -1637,6 +1644,9 @@ static int __init i8042_init(void)
+
+ static void __exit i8042_exit(void)
+ {
++ if (!i8042_present)
++ return;
++
+ platform_device_unregister(i8042_platform_device);
+ platform_driver_unregister(&i8042_driver);
+ i8042_platform_exit();
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index efaa342600c41..fbb970220c2d7 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -976,7 +976,7 @@ static const struct can_bittiming_const m_can_bittiming_const_31X = {
+ .name = KBUILD_MODNAME,
+ .tseg1_min = 2, /* Time segment 1 = prop_seg + phase_seg1 */
+ .tseg1_max = 256,
+- .tseg2_min = 1, /* Time segment 2 = phase_seg2 */
++ .tseg2_min = 2, /* Time segment 2 = phase_seg2 */
+ .tseg2_max = 128,
+ .sjw_max = 128,
+ .brp_min = 1,
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index cc2e224661b30..6a57169c27158 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -71,21 +71,27 @@ enum gs_can_identify_mode {
+ };
+
+ /* data types passed between host and device */
++
++/* The firmware on the original USB2CAN by Geschwister Schneider
++ * Technologie Entwicklungs- und Vertriebs UG exchanges all data
++ * between the host and the device in host byte order. This is done
++ * with the struct gs_host_config::byte_order member, which is sent
++ * first to indicate the desired byte order.
++ *
++ * The widely used open source firmware candleLight doesn't support
++ * this feature and exchanges the data in little endian byte order.
++ */
+ struct gs_host_config {
+- u32 byte_order;
++ __le32 byte_order;
+ } __packed;
+-/* All data exchanged between host and device is exchanged in host byte order,
+- * thanks to the struct gs_host_config byte_order member, which is sent first
+- * to indicate the desired byte order.
+- */
+
+ struct gs_device_config {
+ u8 reserved1;
+ u8 reserved2;
+ u8 reserved3;
+ u8 icount;
+- u32 sw_version;
+- u32 hw_version;
++ __le32 sw_version;
++ __le32 hw_version;
+ } __packed;
+
+ #define GS_CAN_MODE_NORMAL 0
+@@ -95,26 +101,26 @@ struct gs_device_config {
+ #define GS_CAN_MODE_ONE_SHOT BIT(3)
+
+ struct gs_device_mode {
+- u32 mode;
+- u32 flags;
++ __le32 mode;
++ __le32 flags;
+ } __packed;
+
+ struct gs_device_state {
+- u32 state;
+- u32 rxerr;
+- u32 txerr;
++ __le32 state;
++ __le32 rxerr;
++ __le32 txerr;
+ } __packed;
+
+ struct gs_device_bittiming {
+- u32 prop_seg;
+- u32 phase_seg1;
+- u32 phase_seg2;
+- u32 sjw;
+- u32 brp;
++ __le32 prop_seg;
++ __le32 phase_seg1;
++ __le32 phase_seg2;
++ __le32 sjw;
++ __le32 brp;
+ } __packed;
+
+ struct gs_identify_mode {
+- u32 mode;
++ __le32 mode;
+ } __packed;
+
+ #define GS_CAN_FEATURE_LISTEN_ONLY BIT(0)
+@@ -125,23 +131,23 @@ struct gs_identify_mode {
+ #define GS_CAN_FEATURE_IDENTIFY BIT(5)
+
+ struct gs_device_bt_const {
+- u32 feature;
+- u32 fclk_can;
+- u32 tseg1_min;
+- u32 tseg1_max;
+- u32 tseg2_min;
+- u32 tseg2_max;
+- u32 sjw_max;
+- u32 brp_min;
+- u32 brp_max;
+- u32 brp_inc;
++ __le32 feature;
++ __le32 fclk_can;
++ __le32 tseg1_min;
++ __le32 tseg1_max;
++ __le32 tseg2_min;
++ __le32 tseg2_max;
++ __le32 sjw_max;
++ __le32 brp_min;
++ __le32 brp_max;
++ __le32 brp_inc;
+ } __packed;
+
+ #define GS_CAN_FLAG_OVERFLOW 1
+
+ struct gs_host_frame {
+ u32 echo_id;
+- u32 can_id;
++ __le32 can_id;
+
+ u8 can_dlc;
+ u8 channel;
+@@ -337,13 +343,13 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
+ if (!skb)
+ return;
+
+- cf->can_id = hf->can_id;
++ cf->can_id = le32_to_cpu(hf->can_id);
+
+ cf->can_dlc = get_can_dlc(hf->can_dlc);
+ memcpy(cf->data, hf->data, 8);
+
+ /* ERROR frames tell us information about the controller */
+- if (hf->can_id & CAN_ERR_FLAG)
++ if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG)
+ gs_update_state(dev, cf);
+
+ netdev->stats.rx_packets++;
+@@ -426,11 +432,11 @@ static int gs_usb_set_bittiming(struct net_device *netdev)
+ if (!dbt)
+ return -ENOMEM;
+
+- dbt->prop_seg = bt->prop_seg;
+- dbt->phase_seg1 = bt->phase_seg1;
+- dbt->phase_seg2 = bt->phase_seg2;
+- dbt->sjw = bt->sjw;
+- dbt->brp = bt->brp;
++ dbt->prop_seg = cpu_to_le32(bt->prop_seg);
++ dbt->phase_seg1 = cpu_to_le32(bt->phase_seg1);
++ dbt->phase_seg2 = cpu_to_le32(bt->phase_seg2);
++ dbt->sjw = cpu_to_le32(bt->sjw);
++ dbt->brp = cpu_to_le32(bt->brp);
+
+ /* request bit timings */
+ rc = usb_control_msg(interface_to_usbdev(intf),
+@@ -511,7 +517,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
+
+ cf = (struct can_frame *)skb->data;
+
+- hf->can_id = cf->can_id;
++ hf->can_id = cpu_to_le32(cf->can_id);
+ hf->can_dlc = cf->can_dlc;
+ memcpy(hf->data, cf->data, cf->can_dlc);
+
+@@ -581,6 +587,7 @@ static int gs_can_open(struct net_device *netdev)
+ int rc, i;
+ struct gs_device_mode *dm;
+ u32 ctrlmode;
++ u32 flags = 0;
+
+ rc = open_candev(netdev);
+ if (rc)
+@@ -648,24 +655,24 @@ static int gs_can_open(struct net_device *netdev)
+
+ /* flags */
+ ctrlmode = dev->can.ctrlmode;
+- dm->flags = 0;
+
+ if (ctrlmode & CAN_CTRLMODE_LOOPBACK)
+- dm->flags |= GS_CAN_MODE_LOOP_BACK;
++ flags |= GS_CAN_MODE_LOOP_BACK;
+ else if (ctrlmode & CAN_CTRLMODE_LISTENONLY)
+- dm->flags |= GS_CAN_MODE_LISTEN_ONLY;
++ flags |= GS_CAN_MODE_LISTEN_ONLY;
+
+ /* Controller is not allowed to retry TX
+ * this mode is unavailable on atmels uc3c hardware
+ */
+ if (ctrlmode & CAN_CTRLMODE_ONE_SHOT)
+- dm->flags |= GS_CAN_MODE_ONE_SHOT;
++ flags |= GS_CAN_MODE_ONE_SHOT;
+
+ if (ctrlmode & CAN_CTRLMODE_3_SAMPLES)
+- dm->flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
++ flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
+
+ /* finally start device */
+- dm->mode = GS_CAN_MODE_START;
++ dm->mode = cpu_to_le32(GS_CAN_MODE_START);
++ dm->flags = cpu_to_le32(flags);
+ rc = usb_control_msg(interface_to_usbdev(dev->iface),
+ usb_sndctrlpipe(interface_to_usbdev(dev->iface), 0),
+ GS_USB_BREQ_MODE,
+@@ -745,9 +752,9 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify)
+ return -ENOMEM;
+
+ if (do_identify)
+- imode->mode = GS_CAN_IDENTIFY_ON;
++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_ON);
+ else
+- imode->mode = GS_CAN_IDENTIFY_OFF;
++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_OFF);
+
+ rc = usb_control_msg(interface_to_usbdev(dev->iface),
+ usb_sndctrlpipe(interface_to_usbdev(dev->iface),
+@@ -798,6 +805,7 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+ struct net_device *netdev;
+ int rc;
+ struct gs_device_bt_const *bt_const;
++ u32 feature;
+
+ bt_const = kmalloc(sizeof(*bt_const), GFP_KERNEL);
+ if (!bt_const)
+@@ -838,14 +846,14 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+
+ /* dev settup */
+ strcpy(dev->bt_const.name, "gs_usb");
+- dev->bt_const.tseg1_min = bt_const->tseg1_min;
+- dev->bt_const.tseg1_max = bt_const->tseg1_max;
+- dev->bt_const.tseg2_min = bt_const->tseg2_min;
+- dev->bt_const.tseg2_max = bt_const->tseg2_max;
+- dev->bt_const.sjw_max = bt_const->sjw_max;
+- dev->bt_const.brp_min = bt_const->brp_min;
+- dev->bt_const.brp_max = bt_const->brp_max;
+- dev->bt_const.brp_inc = bt_const->brp_inc;
++ dev->bt_const.tseg1_min = le32_to_cpu(bt_const->tseg1_min);
++ dev->bt_const.tseg1_max = le32_to_cpu(bt_const->tseg1_max);
++ dev->bt_const.tseg2_min = le32_to_cpu(bt_const->tseg2_min);
++ dev->bt_const.tseg2_max = le32_to_cpu(bt_const->tseg2_max);
++ dev->bt_const.sjw_max = le32_to_cpu(bt_const->sjw_max);
++ dev->bt_const.brp_min = le32_to_cpu(bt_const->brp_min);
++ dev->bt_const.brp_max = le32_to_cpu(bt_const->brp_max);
++ dev->bt_const.brp_inc = le32_to_cpu(bt_const->brp_inc);
+
+ dev->udev = interface_to_usbdev(intf);
+ dev->iface = intf;
+@@ -862,28 +870,29 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+
+ /* can settup */
+ dev->can.state = CAN_STATE_STOPPED;
+- dev->can.clock.freq = bt_const->fclk_can;
++ dev->can.clock.freq = le32_to_cpu(bt_const->fclk_can);
+ dev->can.bittiming_const = &dev->bt_const;
+ dev->can.do_set_bittiming = gs_usb_set_bittiming;
+
+ dev->can.ctrlmode_supported = 0;
+
+- if (bt_const->feature & GS_CAN_FEATURE_LISTEN_ONLY)
++ feature = le32_to_cpu(bt_const->feature);
++ if (feature & GS_CAN_FEATURE_LISTEN_ONLY)
+ dev->can.ctrlmode_supported |= CAN_CTRLMODE_LISTENONLY;
+
+- if (bt_const->feature & GS_CAN_FEATURE_LOOP_BACK)
++ if (feature & GS_CAN_FEATURE_LOOP_BACK)
+ dev->can.ctrlmode_supported |= CAN_CTRLMODE_LOOPBACK;
+
+- if (bt_const->feature & GS_CAN_FEATURE_TRIPLE_SAMPLE)
++ if (feature & GS_CAN_FEATURE_TRIPLE_SAMPLE)
+ dev->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
+
+- if (bt_const->feature & GS_CAN_FEATURE_ONE_SHOT)
++ if (feature & GS_CAN_FEATURE_ONE_SHOT)
+ dev->can.ctrlmode_supported |= CAN_CTRLMODE_ONE_SHOT;
+
+ SET_NETDEV_DEV(netdev, &intf->dev);
+
+- if (dconf->sw_version > 1)
+- if (bt_const->feature & GS_CAN_FEATURE_IDENTIFY)
++ if (le32_to_cpu(dconf->sw_version) > 1)
++ if (feature & GS_CAN_FEATURE_IDENTIFY)
+ netdev->ethtool_ops = &gs_usb_ethtool_ops;
+
+ kfree(bt_const);
+@@ -918,7 +927,7 @@ static int gs_usb_probe(struct usb_interface *intf,
+ if (!hconf)
+ return -ENOMEM;
+
+- hconf->byte_order = 0x0000beef;
++ hconf->byte_order = cpu_to_le32(0x0000beef);
+
+ /* send host config */
+ rc = usb_control_msg(interface_to_usbdev(intf),
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 3c3222e2dcfcf..9aea4cf19d0c9 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2433,16 +2433,9 @@ static int ena_device_init(struct ena_com_dev *ena_dev, struct pci_dev *pdev,
+ goto err_mmio_read_less;
+ }
+
+- rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_width));
++ rc = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(dma_width));
+ if (rc) {
+- dev_err(dev, "pci_set_dma_mask failed 0x%x\n", rc);
+- goto err_mmio_read_less;
+- }
+-
+- rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(dma_width));
+- if (rc) {
+- dev_err(dev, "err_pci_set_consistent_dma_mask failed 0x%x\n",
+- rc);
++ dev_err(dev, "dma_set_mask_and_coherent failed %d\n", rc);
+ goto err_mmio_read_less;
+ }
+
+@@ -3183,6 +3176,12 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ return rc;
+ }
+
++ rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(ENA_MAX_PHYS_ADDR_SIZE_BITS));
++ if (rc) {
++ dev_err(&pdev->dev, "dma_set_mask_and_coherent failed %d\n", rc);
++ goto err_disable_device;
++ }
++
+ pci_set_master(pdev);
+
+ ena_dev = vzalloc(sizeof(*ena_dev));
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 01d28ede1fb20..db1a23b8d531d 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8021,7 +8021,8 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
+ if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 &&
+ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) {
+ dev_err(&pdev->dev, "System does not support DMA, aborting\n");
+- goto init_err_disable;
++ rc = -EIO;
++ goto init_err_release;
+ }
+
+ pci_set_master(pdev);
+@@ -9120,6 +9121,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ create_singlethread_workqueue("bnxt_pf_wq");
+ if (!bnxt_pf_wq) {
+ dev_err(&pdev->dev, "Unable to create workqueue.\n");
++ rc = -ENOMEM;
+ goto init_err_pci_clean;
+ }
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+index a62c96001761b..9160b44c68bbf 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+@@ -626,7 +626,8 @@ int set_filter_wr(struct adapter *adapter, int fidx)
+ FW_FILTER_WR_OVLAN_VLD_V(f->fs.val.ovlan_vld) |
+ FW_FILTER_WR_IVLAN_VLDM_V(f->fs.mask.ivlan_vld) |
+ FW_FILTER_WR_OVLAN_VLDM_V(f->fs.mask.ovlan_vld));
+- fwr->smac_sel = f->smt->idx;
++ if (f->fs.newsmac)
++ fwr->smac_sel = f->smt->idx;
+ fwr->rx_chan_rx_rpl_iq =
+ htons(FW_FILTER_WR_RX_CHAN_V(0) |
+ FW_FILTER_WR_RX_RPL_IQ_V(adapter->sge.fw_evtq.abs_id));
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index d8115a9333e05..2938ac440fb36 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2560,6 +2560,9 @@ static int reset_sub_crq_queues(struct ibmvnic_adapter *adapter)
+ {
+ int i, rc;
+
++ if (!adapter->tx_scrq || !adapter->rx_scrq)
++ return -EINVAL;
++
+ for (i = 0; i < adapter->req_tx_queues; i++) {
+ netdev_dbg(adapter->netdev, "Re-setting tx_scrq[%d]\n", i);
+ rc = reset_one_sub_crq_queue(adapter, adapter->tx_scrq[i]);
+@@ -4459,6 +4462,9 @@ static int ibmvnic_reset_crq(struct ibmvnic_adapter *adapter)
+ } while (rc == H_BUSY || H_IS_LONG_BUSY(rc));
+
+ /* Clean out the queue */
++ if (!crq->msgs)
++ return -EINVAL;
++
+ memset(crq->msgs, 0, PAGE_SIZE);
+ crq->cur = 0;
+ crq->active = false;
+diff --git a/drivers/nfc/s3fwrn5/i2c.c b/drivers/nfc/s3fwrn5/i2c.c
+index 4da409e77a72e..6c78529a8c89b 100644
+--- a/drivers/nfc/s3fwrn5/i2c.c
++++ b/drivers/nfc/s3fwrn5/i2c.c
+@@ -37,8 +37,8 @@ struct s3fwrn5_i2c_phy {
+ struct i2c_client *i2c_dev;
+ struct nci_dev *ndev;
+
+- unsigned int gpio_en;
+- unsigned int gpio_fw_wake;
++ int gpio_en;
++ int gpio_fw_wake;
+
+ struct mutex mutex;
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 3c68a5b35ec1b..a52b2f15f372a 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -276,9 +276,21 @@ static void nvme_dbbuf_init(struct nvme_dev *dev,
+ nvmeq->dbbuf_cq_ei = &dev->dbbuf_eis[cq_idx(qid, dev->db_stride)];
+ }
+
++static void nvme_dbbuf_free(struct nvme_queue *nvmeq)
++{
++ if (!nvmeq->qid)
++ return;
++
++ nvmeq->dbbuf_sq_db = NULL;
++ nvmeq->dbbuf_cq_db = NULL;
++ nvmeq->dbbuf_sq_ei = NULL;
++ nvmeq->dbbuf_cq_ei = NULL;
++}
++
+ static void nvme_dbbuf_set(struct nvme_dev *dev)
+ {
+ struct nvme_command c;
++ unsigned int i;
+
+ if (!dev->dbbuf_dbs)
+ return;
+@@ -292,6 +304,9 @@ static void nvme_dbbuf_set(struct nvme_dev *dev)
+ dev_warn(dev->ctrl.device, "unable to set dbbuf\n");
+ /* Free memory and continue on */
+ nvme_dbbuf_dma_free(dev);
++
++ for (i = 1; i <= dev->online_queues; i++)
++ nvme_dbbuf_free(&dev->queues[i]);
+ }
+ }
+
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index de1b4ebe4de28..39c01ef57d83c 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -899,6 +899,7 @@ remove_pads:
+ reset:
+ reset_control_assert(padctl->rst);
+ remove:
++ platform_set_drvdata(pdev, NULL);
+ soc->ops->remove(padctl);
+ return err;
+ }
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 98bd8213b0378..8cc01857bc5c0 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -4251,6 +4251,7 @@ static void hotkey_resume(void)
+ pr_err("error while attempting to reset the event firmware interface\n");
+
+ tpacpi_send_radiosw_update();
++ tpacpi_input_send_tabletsw();
+ hotkey_tablet_mode_notify_change();
+ hotkey_wakeup_reason_notify_change();
+ hotkey_wakeup_hotunplug_complete_notify_change();
+diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
+index e366977bda418..8c3e9bac4754c 100644
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -1497,7 +1497,7 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf,
+ struct toshiba_acpi_dev *dev = PDE_DATA(file_inode(file));
+ char *buffer;
+ char *cmd;
+- int lcd_out, crt_out, tv_out;
++ int lcd_out = -1, crt_out = -1, tv_out = -1;
+ int remain = count;
+ int value;
+ int ret;
+@@ -1529,7 +1529,6 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf,
+
+ kfree(cmd);
+
+- lcd_out = crt_out = tv_out = -1;
+ ret = get_video_status(dev, &video_out);
+ if (!ret) {
+ unsigned int new_video_out = video_out;
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 5f59e2dfc7db9..d0aaef937b0fe 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -470,12 +470,6 @@ static void qeth_cleanup_handled_pending(struct qeth_qdio_out_q *q, int bidx,
+
+ }
+ }
+- if (forced_cleanup && (atomic_read(&(q->bufs[bidx]->state)) ==
+- QETH_QDIO_BUF_HANDLED_DELAYED)) {
+- /* for recovery situations */
+- qeth_init_qdio_out_buf(q, bidx);
+- QETH_CARD_TEXT(q->card, 2, "clprecov");
+- }
+ }
+
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 7a05c72717666..1c69515e870cb 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -571,8 +571,8 @@ static void iscsi_complete_task(struct iscsi_task *task, int state)
+ if (conn->task == task)
+ conn->task = NULL;
+
+- if (conn->ping_task == task)
+- conn->ping_task = NULL;
++ if (READ_ONCE(conn->ping_task) == task)
++ WRITE_ONCE(conn->ping_task, NULL);
+
+ /* release get from queueing */
+ __iscsi_put_task(task);
+@@ -781,6 +781,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+ task->conn->session->age);
+ }
+
++ if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK))
++ WRITE_ONCE(conn->ping_task, task);
++
+ if (!ihost->workq) {
+ if (iscsi_prep_mgmt_task(conn, task))
+ goto free_task;
+@@ -988,8 +991,11 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+ struct iscsi_nopout hdr;
+ struct iscsi_task *task;
+
+- if (!rhdr && conn->ping_task)
+- return -EINVAL;
++ if (!rhdr) {
++ if (READ_ONCE(conn->ping_task))
++ return -EINVAL;
++ WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK);
++ }
+
+ memset(&hdr, 0, sizeof(struct iscsi_nopout));
+ hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE;
+@@ -1004,11 +1010,12 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+
+ task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0);
+ if (!task) {
++ if (!rhdr)
++ WRITE_ONCE(conn->ping_task, NULL);
+ iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n");
+ return -EIO;
+ } else if (!rhdr) {
+ /* only track our nops */
+- conn->ping_task = task;
+ conn->last_ping = jiffies;
+ }
+
+@@ -1021,7 +1028,7 @@ static int iscsi_nop_out_rsp(struct iscsi_task *task,
+ struct iscsi_conn *conn = task->conn;
+ int rc = 0;
+
+- if (conn->ping_task != task) {
++ if (READ_ONCE(conn->ping_task) != task) {
+ /*
+ * If this is not in response to one of our
+ * nops then it must be from userspace.
+@@ -1961,7 +1968,7 @@ static void iscsi_start_tx(struct iscsi_conn *conn)
+ */
+ static int iscsi_has_ping_timed_out(struct iscsi_conn *conn)
+ {
+- if (conn->ping_task &&
++ if (READ_ONCE(conn->ping_task) &&
+ time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) +
+ (conn->ping_timeout * HZ), jiffies))
+ return 1;
+@@ -2096,7 +2103,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc)
+ * Checking the transport already or nop from a cmd timeout still
+ * running
+ */
+- if (conn->ping_task) {
++ if (READ_ONCE(conn->ping_task)) {
+ task->have_checked_conn = true;
+ rc = BLK_EH_RESET_TIMER;
+ goto done;
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index a63119c35fde8..7e4e6e982055e 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -7926,11 +7926,7 @@ int ufshcd_shutdown(struct ufs_hba *hba)
+ if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba))
+ goto out;
+
+- if (pm_runtime_suspended(hba->dev)) {
+- ret = ufshcd_runtime_resume(hba);
+- if (ret)
+- goto out;
+- }
++ pm_runtime_get_sync(hba->dev);
+
+ ret = ufshcd_suspend(hba, UFS_SHUTDOWN_PM);
+ out:
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 2602b57936d4b..58ccded1be857 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -492,8 +492,7 @@ EXPORT_SYMBOL(iscsit_queue_rsp);
+ void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ {
+ spin_lock_bh(&conn->cmd_lock);
+- if (!list_empty(&cmd->i_conn_node) &&
+- !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP))
++ if (!list_empty(&cmd->i_conn_node))
+ list_del_init(&cmd->i_conn_node);
+ spin_unlock_bh(&conn->cmd_lock);
+
+@@ -4054,12 +4053,22 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ spin_lock_bh(&conn->cmd_lock);
+ list_splice_init(&conn->conn_cmd_list, &tmp_list);
+
+- list_for_each_entry(cmd, &tmp_list, i_conn_node) {
++ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+ if (se_cmd->se_tfo != NULL) {
+ spin_lock_irq(&se_cmd->t_state_lock);
+- se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++ if (se_cmd->transport_state & CMD_T_ABORTED) {
++ /*
++ * LIO's abort path owns the cleanup for this,
++ * so put it back on the list and let
++ * aborted_task handle it.
++ */
++ list_move_tail(&cmd->i_conn_node,
++ &conn->conn_cmd_list);
++ } else {
++ se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++ }
+ spin_unlock_irq(&se_cmd->t_state_lock);
+ }
+ }
+diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
+index a5afbe6dee686..7cb7efe62b011 100644
+--- a/drivers/tee/optee/call.c
++++ b/drivers/tee/optee/call.c
+@@ -538,7 +538,8 @@ void optee_free_pages_list(void *list, size_t num_entries)
+ static bool is_normal_memory(pgprot_t p)
+ {
+ #if defined(CONFIG_ARM)
+- return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
++ return (((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC) ||
++ ((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEBACK));
+ #elif defined(CONFIG_ARM64)
+ return (pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL);
+ #else
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 00204824bffd8..732e7f1687dd2 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -463,11 +463,11 @@ static void snoop_urb(struct usb_device *udev,
+
+ if (userurb) { /* Async */
+ if (when == SUBMIT)
+- dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
++ dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
+ "length %u\n",
+ userurb, ep, t, d, length);
+ else
+- dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
++ dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
+ "actual_length %u status %d\n",
+ userurb, ep, t, d, length,
+ timeout_or_status);
+@@ -1927,7 +1927,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
+ if (as) {
+ int retval;
+
+- snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++ snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ retval = processcompl(as, (void __user * __user *)arg);
+ free_async(as);
+ return retval;
+@@ -1944,7 +1944,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
+
+ as = async_getcompleted(ps);
+ if (as) {
+- snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++ snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ retval = processcompl(as, (void __user * __user *)arg);
+ free_async(as);
+ } else {
+@@ -2070,7 +2070,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
+ if (as) {
+ int retval;
+
+- snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++ snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ retval = processcompl_compat(as, (void __user * __user *)arg);
+ free_async(as);
+ return retval;
+@@ -2087,7 +2087,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar
+
+ as = async_getcompleted(ps);
+ if (as) {
+- snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++ snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ retval = processcompl_compat(as, (void __user * __user *)arg);
+ free_async(as);
+ } else {
+@@ -2512,7 +2512,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
+ #endif
+
+ case USBDEVFS_DISCARDURB:
+- snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
++ snoop(&dev->dev, "%s: DISCARDURB %px\n", __func__, p);
+ ret = proc_unlinkurb(ps, p);
+ break;
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 5ad14cdd97623..b55c3a699fc65 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -348,6 +348,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Guillemot Webcam Hercules Dualpix Exchange*/
+ { USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Guillemot Hercules DJ Console audio card (BZ 208357) */
++ { USB_DEVICE(0x06f8, 0xb000), .driver_info =
++ USB_QUIRK_ENDPOINT_BLACKLIST },
++
+ /* Midiman M-Audio Keystation 88es */
+ { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
+
+@@ -421,6 +425,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1532, 0x0116), .driver_info =
+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
++ /* Lenovo ThinkCenter A630Z TI024Gen3 usb-audio */
++ { USB_DEVICE(0x17ef, 0xa012), .driver_info =
++ USB_QUIRK_DISCONNECT_SUSPEND },
++
+ /* BUILDWIN Photo Frame */
+ { USB_DEVICE(0x1908, 0x1315), .driver_info =
+ USB_QUIRK_HONOR_BNUMINTERFACES },
+@@ -521,6 +529,8 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
+ * Matched for devices with USB_QUIRK_ENDPOINT_BLACKLIST.
+ */
+ static const struct usb_device_id usb_endpoint_blacklist[] = {
++ { USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x01 },
++ { USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x81 },
+ { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0202, 1), .driver_info = 0x85 },
+ { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0208, 1), .driver_info = 0x85 },
+ { }
+diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
+index 46af0aa07e2e3..b2b5b0689667b 100644
+--- a/drivers/usb/gadget/function/f_midi.c
++++ b/drivers/usb/gadget/function/f_midi.c
+@@ -1315,7 +1315,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
+ midi->id = kstrdup(opts->id, GFP_KERNEL);
+ if (opts->id && !midi->id) {
+ status = -ENOMEM;
+- goto setup_fail;
++ goto midi_free;
+ }
+ midi->in_ports = opts->in_ports;
+ midi->out_ports = opts->out_ports;
+@@ -1327,7 +1327,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
+
+ status = kfifo_alloc(&midi->in_req_fifo, midi->qlen, GFP_KERNEL);
+ if (status)
+- goto setup_fail;
++ goto midi_free;
+
+ spin_lock_init(&midi->transmit_lock);
+
+@@ -1343,9 +1343,13 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
+
+ return &midi->func;
+
++midi_free:
++ if (midi)
++ kfree(midi->id);
++ kfree(midi);
+ setup_fail:
+ mutex_unlock(&opts->lock);
+- kfree(midi);
++
+ return ERR_PTR(status);
+ }
+
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index 25d417ad9000c..09ed5f02c24f4 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -2039,6 +2039,9 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
+ return 0;
+
+ Enomem:
++ kfree(CHIP);
++ CHIP = NULL;
++
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
+index 403d8cd3e5827..56e70f12c9960 100644
+--- a/drivers/video/fbdev/hyperv_fb.c
++++ b/drivers/video/fbdev/hyperv_fb.c
+@@ -712,7 +712,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
+ goto err1;
+ }
+
+- fb_virt = ioremap(par->mem->start, screen_fb_size);
++ /*
++ * Map the VRAM cacheable for performance. This is also required for
++ * VM Connect to display properly for ARM64 Linux VM, as the host also
++ * maps the VRAM cacheable.
++ */
++ fb_virt = ioremap_cache(par->mem->start, screen_fb_size);
+ if (!fb_virt)
+ goto err2;
+
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index c8ed4db73b840..9936e4b991aa3 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -488,13 +488,13 @@ next2:
+ break;
+ }
+ out:
++ btrfs_free_path(path);
+ fs_info->qgroup_flags |= flags;
+ if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_ON))
+ clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
+ else if (fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN &&
+ ret >= 0)
+ ret = qgroup_rescan_init(fs_info, rescan_progress, 0);
+- btrfs_free_path(path);
+
+ if (ret < 0) {
+ ulist_free(fs_info->qgroup_ulist);
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 7e000d061813c..95b6a4ea18f7a 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -857,7 +857,13 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ if (device->bdev != path_bdev) {
+ bdput(path_bdev);
+ mutex_unlock(&fs_devices->device_list_mutex);
+- btrfs_warn_in_rcu(device->fs_info,
++ /*
++ * device->fs_info may not be reliable here, so
++ * pass in a NULL instead. This avoids a
++ * possible use-after-free when the fs_info and
++ * fs_info->sb are already torn down.
++ */
++ btrfs_warn_in_rcu(NULL,
+ "duplicate device %s devid %llu generation %llu scanned by %s (%d)",
+ path, devid, found_transid,
+ current->comm,
+diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
+index 8c6ab6c95727e..7f40343b39b05 100644
+--- a/fs/efivarfs/inode.c
++++ b/fs/efivarfs/inode.c
+@@ -10,6 +10,7 @@
+ #include <linux/efi.h>
+ #include <linux/fs.h>
+ #include <linux/ctype.h>
++#include <linux/kmemleak.h>
+ #include <linux/slab.h>
+ #include <linux/uuid.h>
+
+@@ -106,6 +107,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
+ var->var.VariableName[i] = '\0';
+
+ inode->i_private = var;
++ kmemleak_ignore(var);
+
+ err = efivar_entry_add(var, &efivarfs_list);
+ if (err)
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index 7808a26bd33fa..834615f13f3e3 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -23,7 +23,6 @@ LIST_HEAD(efivarfs_list);
+ static void efivarfs_evict_inode(struct inode *inode)
+ {
+ clear_inode(inode);
+- kfree(inode->i_private);
+ }
+
+ static const struct super_operations efivarfs_ops = {
+diff --git a/fs/proc/self.c b/fs/proc/self.c
+index cc6d4253399d1..7922edf70ce1a 100644
+--- a/fs/proc/self.c
++++ b/fs/proc/self.c
+@@ -16,6 +16,13 @@ static const char *proc_self_get_link(struct dentry *dentry,
+ pid_t tgid = task_tgid_nr_ns(current, ns);
+ char *name;
+
++ /*
++ * Not currently supported. Once we can inherit all of struct pid,
++ * we can allow this.
++ */
++ if (current->flags & PF_KTHREAD)
++ return ERR_PTR(-EOPNOTSUPP);
++
+ if (!tgid)
+ return ERR_PTR(-ENOENT);
+ /* max length of unsigned int in decimal + NULL term */
+diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
+index 97ea41dc678fe..e5f641cdab5a4 100644
+--- a/include/drm/drm_connector.h
++++ b/include/drm/drm_connector.h
+@@ -81,6 +81,53 @@ enum drm_connector_status {
+ connector_status_unknown = 3,
+ };
+
++/**
++ * enum drm_connector_registration_status - userspace registration status for
++ * a &drm_connector
++ *
++ * This enum is used to track the status of initializing a connector and
++ * registering it with userspace, so that DRM can prevent bogus modesets on
++ * connectors that no longer exist.
++ */
++enum drm_connector_registration_state {
++ /**
++ * @DRM_CONNECTOR_INITIALIZING: The connector has just been created,
++ * but has yet to be exposed to userspace. There should be no
++ * additional restrictions to how the state of this connector may be
++ * modified.
++ */
++ DRM_CONNECTOR_INITIALIZING = 0,
++
++ /**
++ * @DRM_CONNECTOR_REGISTERED: The connector has been fully initialized
++ * and registered with sysfs, as such it has been exposed to
++ * userspace. There should be no additional restrictions to how the
++ * state of this connector may be modified.
++ */
++ DRM_CONNECTOR_REGISTERED = 1,
++
++ /**
++ * @DRM_CONNECTOR_UNREGISTERED: The connector has either been exposed
++ * to userspace and has since been unregistered and removed from
++ * userspace, or the connector was unregistered before it had a chance
++ * to be exposed to userspace (e.g. still in the
++ * @DRM_CONNECTOR_INITIALIZING state). When a connector is
++ * unregistered, there are additional restrictions to how its state
++ * may be modified:
++ *
++ * - An unregistered connector may only have its DPMS changed from
++ * On->Off. Once DPMS is changed to Off, it may not be switched back
++ * to On.
++ * - Modesets are not allowed on unregistered connectors, unless they
++ * would result in disabling its assigned CRTCs. This means
++ * disabling a CRTC on an unregistered connector is OK, but enabling
++ * one is not.
++ * - Removing a CRTC from an unregistered connector is OK, but new
++ * CRTCs may never be assigned to an unregistered connector.
++ */
++ DRM_CONNECTOR_UNREGISTERED = 2,
++};
++
+ enum subpixel_order {
+ SubPixelUnknown = 0,
+ SubPixelHorizontalRGB,
+@@ -852,10 +899,12 @@ struct drm_connector {
+ bool ycbcr_420_allowed;
+
+ /**
+- * @registered: Is this connector exposed (registered) with userspace?
++ * @registration_state: Is this connector initializing, exposed
++ * (registered) with userspace, or unregistered?
++ *
+ * Protected by @mutex.
+ */
+- bool registered;
++ enum drm_connector_registration_state registration_state;
+
+ /**
+ * @modes:
+@@ -1165,6 +1214,24 @@ static inline void drm_connector_unreference(struct drm_connector *connector)
+ drm_connector_put(connector);
+ }
+
++/**
++ * drm_connector_is_unregistered - has the connector been unregistered from
++ * userspace?
++ * @connector: DRM connector
++ *
++ * Checks whether or not @connector has been unregistered from userspace.
++ *
++ * Returns:
++ * True if the connector was unregistered, false if the connector is
++ * registered or has not yet been registered with userspace.
++ */
++static inline bool
++drm_connector_is_unregistered(struct drm_connector *connector)
++{
++ return READ_ONCE(connector->registration_state) ==
++ DRM_CONNECTOR_UNREGISTERED;
++}
++
+ const char *drm_get_connector_status_name(enum drm_connector_status status);
+ const char *drm_get_subpixel_order_name(enum subpixel_order order);
+ const char *drm_get_dpms_name(int val);
+diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
+index 72cb19c3db6aa..9460a5635c90b 100644
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -300,7 +300,7 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
+
+ INIT_LIST_HEAD(&sublist);
+ list_for_each_entry_safe(skb, next, head, list) {
+- list_del(&skb->list);
++ skb_list_del_init(skb);
+ if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1)
+ list_add_tail(&skb->list, &sublist);
+ }
+diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
+index c9bd935f4fd1c..1ee0f30ae190b 100644
+--- a/include/scsi/libiscsi.h
++++ b/include/scsi/libiscsi.h
+@@ -145,6 +145,9 @@ struct iscsi_task {
+ void *dd_data; /* driver/transport data */
+ };
+
++/* invalid scsi_task pointer */
++#define INVALID_SCSI_TASK (struct iscsi_task *)-1l
++
+ static inline int iscsi_task_has_unsol_data(struct iscsi_task *task)
+ {
+ return task->unsol_r2t.data_length > task->unsol_r2t.sent;
+diff --git a/include/uapi/linux/wireless.h b/include/uapi/linux/wireless.h
+index a2c006a364e0b..24f3371ad8262 100644
+--- a/include/uapi/linux/wireless.h
++++ b/include/uapi/linux/wireless.h
+@@ -74,7 +74,11 @@
+ #include <linux/socket.h> /* for "struct sockaddr" et al */
+ #include <linux/if.h> /* for IFNAMSIZ and co... */
+
+-#include <stddef.h> /* for offsetof */
++#ifdef __KERNEL__
++# include <linux/stddef.h> /* for offsetof */
++#else
++# include <stddef.h> /* for offsetof */
++#endif
+
+ /***************************** VERSION *****************************/
+ /*
+diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c
+index 853773e45f792..837f67c9fad35 100644
+--- a/net/batman-adv/log.c
++++ b/net/batman-adv/log.c
+@@ -205,6 +205,7 @@ static const struct file_operations batadv_log_fops = {
+ .read = batadv_log_read,
+ .poll = batadv_log_poll,
+ .llseek = no_llseek,
++ .owner = THIS_MODULE,
+ };
+
+ /**
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 708efb9b43877..f86b9b0a0607e 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1955,20 +1955,23 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ int pinctl;
+ int err = 0;
+
++ mutex_lock(&spec->pcm_lock);
+ if (hinfo->nid) {
+ pcm_idx = hinfo_to_pcm_index(codec, hinfo);
+- if (snd_BUG_ON(pcm_idx < 0))
+- return -EINVAL;
++ if (snd_BUG_ON(pcm_idx < 0)) {
++ err = -EINVAL;
++ goto unlock;
++ }
+ cvt_idx = cvt_nid_to_cvt_index(codec, hinfo->nid);
+- if (snd_BUG_ON(cvt_idx < 0))
+- return -EINVAL;
++ if (snd_BUG_ON(cvt_idx < 0)) {
++ err = -EINVAL;
++ goto unlock;
++ }
+ per_cvt = get_cvt(spec, cvt_idx);
+-
+ snd_BUG_ON(!per_cvt->assigned);
+ per_cvt->assigned = 0;
+ hinfo->nid = 0;
+
+- mutex_lock(&spec->pcm_lock);
+ snd_hda_spdif_ctls_unassign(codec, pcm_idx);
+ clear_bit(pcm_idx, &spec->pcm_in_use);
+ pin_idx = hinfo_to_pin_index(codec, hinfo);
+@@ -1996,10 +1999,11 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ per_pin->setup = false;
+ per_pin->channels = 0;
+ mutex_unlock(&per_pin->lock);
+- unlock:
+- mutex_unlock(&spec->pcm_lock);
+ }
+
++unlock:
++ mutex_unlock(&spec->pcm_lock);
++
+ return err;
+ }
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 29e75c051d045..230e94bf7775a 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -332,6 +332,7 @@ bool die_is_func_def(Dwarf_Die *dw_die)
+ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
+ {
+ Dwarf_Addr base, end;
++ Dwarf_Attribute attr;
+
+ if (!addr)
+ return -EINVAL;
+@@ -339,6 +340,13 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
+ if (dwarf_entrypc(dw_die, addr) == 0)
+ return 0;
+
++ /*
++ * Since the dwarf_ranges() will return 0 if there is no
++ * DW_AT_ranges attribute, we should check it first.
++ */
++ if (!dwarf_attr(dw_die, DW_AT_ranges, &attr))
++ return -ENOENT;
++
+ return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0;
+ }
+
+diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
+index aa9c7df120cae..9c22729e2ad60 100644
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -912,11 +912,13 @@ static int __perf_event__synthesize_kernel_mmap(struct perf_tool *tool,
+ int err;
+ union perf_event *event;
+
+- if (symbol_conf.kptr_restrict)
+- return -1;
+ if (map == NULL)
+ return -1;
+
++ kmap = map__kmap(map);
++ if (!kmap->ref_reloc_sym)
++ return -1;
++
+ /*
+ * We should get this from /sys/kernel/sections/.text, but till that is
+ * available use this, and after it is use this as a fallback for older
+@@ -939,7 +941,6 @@ static int __perf_event__synthesize_kernel_mmap(struct perf_tool *tool,
+ event->header.misc = PERF_RECORD_MISC_GUEST_KERNEL;
+ }
+
+- kmap = map__kmap(map);
+ size = snprintf(event->mmap.filename, sizeof(event->mmap.filename),
+ "%s%s", machine->mmap_name, kmap->ref_reloc_sym->name) + 1;
+ size = PERF_ALIGN(size, sizeof(u64));
+diff --git a/virt/kvm/arm/vgic/vgic-mmio-v3.c b/virt/kvm/arm/vgic/vgic-mmio-v3.c
+index a2a175b08b172..cbb38a0d1b251 100644
+--- a/virt/kvm/arm/vgic/vgic-mmio-v3.c
++++ b/virt/kvm/arm/vgic/vgic-mmio-v3.c
+@@ -226,6 +226,23 @@ static unsigned long vgic_mmio_read_v3r_typer(struct kvm_vcpu *vcpu,
+ return extract_bytes(value, addr & 7, len);
+ }
+
++static unsigned long vgic_uaccess_read_v3r_typer(struct kvm_vcpu *vcpu,
++ gpa_t addr, unsigned int len)
++{
++ unsigned long mpidr = kvm_vcpu_get_mpidr_aff(vcpu);
++ int target_vcpu_id = vcpu->vcpu_id;
++ u64 value;
++
++ value = (u64)(mpidr & GENMASK(23, 0)) << 32;
++ value |= ((target_vcpu_id & 0xffff) << 8);
++
++ if (vgic_has_its(vcpu->kvm))
++ value |= GICR_TYPER_PLPIS;
++
++ /* reporting of the Last bit is not supported for userspace */
++ return extract_bytes(value, addr & 7, len);
++}
++
+ static unsigned long vgic_mmio_read_v3r_iidr(struct kvm_vcpu *vcpu,
+ gpa_t addr, unsigned int len)
+ {
+@@ -532,8 +549,9 @@ static const struct vgic_register_region vgic_v3_rdbase_registers[] = {
+ REGISTER_DESC_WITH_LENGTH(GICR_IIDR,
+ vgic_mmio_read_v3r_iidr, vgic_mmio_write_wi, 4,
+ VGIC_ACCESS_32bit),
+- REGISTER_DESC_WITH_LENGTH(GICR_TYPER,
+- vgic_mmio_read_v3r_typer, vgic_mmio_write_wi, 8,
++ REGISTER_DESC_WITH_LENGTH_UACCESS(GICR_TYPER,
++ vgic_mmio_read_v3r_typer, vgic_mmio_write_wi,
++ vgic_uaccess_read_v3r_typer, vgic_mmio_uaccess_write_wi, 8,
+ VGIC_ACCESS_64bit | VGIC_ACCESS_32bit),
+ REGISTER_DESC_WITH_LENGTH(GICR_WAKER,
+ vgic_mmio_read_raz, vgic_mmio_write_wi, 4,
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-12-08 12:06 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-12-08 12:06 UTC (permalink / raw
To: gentoo-commits
commit: 619d31acfc751e1b5ba861ddc8ae35a06e6f6cde
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 8 12:06:36 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Dec 8 12:06:36 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=619d31ac
Linux patch 4.19.162
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1161_linux-4.19.162.patch | 1041 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1045 insertions(+)
diff --git a/0000_README b/0000_README
index bb6e712..9a36e6f 100644
--- a/0000_README
+++ b/0000_README
@@ -683,6 +683,10 @@ Patch: 1160_linux-4.19.161.patch
From: https://www.kernel.org
Desc: Linux 4.19.161
+Patch: 1161_linux-4.19.162.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.162
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1161_linux-4.19.162.patch b/1161_linux-4.19.162.patch
new file mode 100644
index 0000000..f391c48
--- /dev/null
+++ b/1161_linux-4.19.162.patch
@@ -0,0 +1,1041 @@
+diff --git a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt b/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
+index cfaf889989187..9e4dc510a40aa 100644
+--- a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
++++ b/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
+@@ -25,7 +25,7 @@ Example (for ARM-based BeagleBone with NPC100 NFC controller on I2C2):
+ clock-frequency = <100000>;
+
+ interrupt-parent = <&gpio1>;
+- interrupts = <29 GPIO_ACTIVE_HIGH>;
++ interrupts = <29 IRQ_TYPE_LEVEL_HIGH>;
+
+ enable-gpios = <&gpio0 30 GPIO_ACTIVE_HIGH>;
+ firmware-gpios = <&gpio0 31 GPIO_ACTIVE_HIGH>;
+diff --git a/Documentation/devicetree/bindings/net/nfc/pn544.txt b/Documentation/devicetree/bindings/net/nfc/pn544.txt
+index 92f399ec22b87..2bd82562ce8e9 100644
+--- a/Documentation/devicetree/bindings/net/nfc/pn544.txt
++++ b/Documentation/devicetree/bindings/net/nfc/pn544.txt
+@@ -25,7 +25,7 @@ Example (for ARM-based BeagleBone with PN544 on I2C2):
+ clock-frequency = <400000>;
+
+ interrupt-parent = <&gpio1>;
+- interrupts = <17 GPIO_ACTIVE_HIGH>;
++ interrupts = <17 IRQ_TYPE_LEVEL_HIGH>;
+
+ enable-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>;
+ firmware-gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>;
+diff --git a/Makefile b/Makefile
+index 84807cee57b88..71e55c5cd74a0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 161
++SUBLEVEL = 162
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index 35116cdb5e389..35d6bd1b30993 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -1079,6 +1079,7 @@ static struct sock *chtls_recv_sock(struct sock *lsk,
+
+ oreq->ts_recent = PASS_OPEN_TID_G(ntohl(req->tos_stid));
+ sk_setup_caps(newsk, dst);
++ newsk->sk_prot_creator = lsk->sk_prot_creator;
+ csk->sk = newsk;
+ csk->passive_reap_next = oreq;
+ csk->tx_chan = cxgb4_port_chan(ndev);
+diff --git a/drivers/crypto/chelsio/chtls/chtls_hw.c b/drivers/crypto/chelsio/chtls/chtls_hw.c
+index 2294fb06bef36..7ea9dcfd7c492 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_hw.c
++++ b/drivers/crypto/chelsio/chtls/chtls_hw.c
+@@ -376,6 +376,7 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, u32 optname)
+ csk->wr_unacked += DIV_ROUND_UP(len, 16);
+ enqueue_wr(csk, skb);
+ cxgb4_ofld_send(csk->egress_dev, skb);
++ skb = NULL;
+
+ chtls_set_scmd(csk);
+ /* Clear quiesce for Rx key */
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
+index 68095f00d08f7..41227d9568717 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
+@@ -54,10 +54,6 @@
+ #define DRV_VERSION __stringify(DRV_VERSION_MAJOR) "." \
+ __stringify(DRV_VERSION_MINOR) "." __stringify(DRV_VERSION_BUILD)
+
+-static int push_mode;
+-module_param(push_mode, int, 0644);
+-MODULE_PARM_DESC(push_mode, "Low latency mode: 0=disabled (default), 1=enabled)");
+-
+ static int debug;
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "debug flags: 0=disabled (default), 0x7fffffff=all");
+@@ -1584,7 +1580,6 @@ static enum i40iw_status_code i40iw_setup_init_state(struct i40iw_handler *hdl,
+ if (status)
+ goto exit;
+ iwdev->obj_next = iwdev->obj_mem;
+- iwdev->push_mode = push_mode;
+
+ init_waitqueue_head(&iwdev->vchnl_waitq);
+ init_waitqueue_head(&dev->vf_reqs);
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+index a5e3349b8a7c3..314d19153c99a 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+@@ -201,38 +201,16 @@ static int i40iw_dealloc_ucontext(struct ib_ucontext *context)
+ */
+ static int i40iw_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+ {
+- struct i40iw_ucontext *ucontext;
+- u64 db_addr_offset;
+- u64 push_offset;
+-
+- ucontext = to_ucontext(context);
+- if (ucontext->iwdev->sc_dev.is_pf) {
+- db_addr_offset = I40IW_DB_ADDR_OFFSET;
+- push_offset = I40IW_PUSH_OFFSET;
+- if (vma->vm_pgoff)
+- vma->vm_pgoff += I40IW_PF_FIRST_PUSH_PAGE_INDEX - 1;
+- } else {
+- db_addr_offset = I40IW_VF_DB_ADDR_OFFSET;
+- push_offset = I40IW_VF_PUSH_OFFSET;
+- if (vma->vm_pgoff)
+- vma->vm_pgoff += I40IW_VF_FIRST_PUSH_PAGE_INDEX - 1;
+- }
++ struct i40iw_ucontext *ucontext = to_ucontext(context);
++ u64 dbaddr;
+
+- vma->vm_pgoff += db_addr_offset >> PAGE_SHIFT;
++ if (vma->vm_pgoff || vma->vm_end - vma->vm_start != PAGE_SIZE)
++ return -EINVAL;
+
+- if (vma->vm_pgoff == (db_addr_offset >> PAGE_SHIFT)) {
+- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+- vma->vm_private_data = ucontext;
+- } else {
+- if ((vma->vm_pgoff - (push_offset >> PAGE_SHIFT)) % 2)
+- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+- else
+- vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+- }
++ dbaddr = I40IW_DB_ADDR_OFFSET + pci_resource_start(ucontext->iwdev->ldev->pcidev, 0);
+
+- if (io_remap_pfn_range(vma, vma->vm_start,
+- vma->vm_pgoff + (pci_resource_start(ucontext->iwdev->ldev->pcidev, 0) >> PAGE_SHIFT),
+- PAGE_SIZE, vma->vm_page_prot))
++ if (io_remap_pfn_range(vma, vma->vm_start, dbaddr >> PAGE_SHIFT, PAGE_SIZE,
++ pgprot_noncached(vma->vm_page_prot)))
+ return -EAGAIN;
+
+ return 0;
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 9adc72d65c634..ee3ff0894d093 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -255,6 +255,7 @@ static const struct xpad_device {
+ { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+ { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+ { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
++ { 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 },
+ { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
+ { 0x12ab, 0x0303, "Mortal Kombat Klassic FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+@@ -432,6 +433,7 @@ static const struct usb_device_id xpad_table[] = {
+ XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */
+ XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries Controllers */
+ XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */
++ XPAD_XBOX360_VENDOR(0x1209), /* Ardwiino Controllers */
+ XPAD_XBOX360_VENDOR(0x12ab), /* X-Box 360 dance pads */
+ XPAD_XBOX360_VENDOR(0x1430), /* RedOctane X-Box 360 controllers */
+ XPAD_XBOX360_VENDOR(0x146b), /* BigBen Interactive Controllers */
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 51bd2ebaa342c..adb8b23a63934 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -223,6 +223,10 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "PEGATRON CORPORATION"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "C15B"),
+ },
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ByteSpeed LLC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ByteSpeed Laptop C15B"),
++ },
+ },
+ { }
+ };
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index a59333b87eafd..c21c4291921f6 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1268,7 +1268,39 @@ static void bond_upper_dev_unlink(struct bonding *bond, struct slave *slave)
+ slave->dev->flags &= ~IFF_SLAVE;
+ }
+
+-static struct slave *bond_alloc_slave(struct bonding *bond)
++static void slave_kobj_release(struct kobject *kobj)
++{
++ struct slave *slave = to_slave(kobj);
++ struct bonding *bond = bond_get_bond_by_slave(slave);
++
++ cancel_delayed_work_sync(&slave->notify_work);
++ if (BOND_MODE(bond) == BOND_MODE_8023AD)
++ kfree(SLAVE_AD_INFO(slave));
++
++ kfree(slave);
++}
++
++static struct kobj_type slave_ktype = {
++ .release = slave_kobj_release,
++#ifdef CONFIG_SYSFS
++ .sysfs_ops = &slave_sysfs_ops,
++#endif
++};
++
++static int bond_kobj_init(struct slave *slave)
++{
++ int err;
++
++ err = kobject_init_and_add(&slave->kobj, &slave_ktype,
++ &(slave->dev->dev.kobj), "bonding_slave");
++ if (err)
++ kobject_put(&slave->kobj);
++
++ return err;
++}
++
++static struct slave *bond_alloc_slave(struct bonding *bond,
++ struct net_device *slave_dev)
+ {
+ struct slave *slave = NULL;
+
+@@ -1276,11 +1308,17 @@ static struct slave *bond_alloc_slave(struct bonding *bond)
+ if (!slave)
+ return NULL;
+
++ slave->bond = bond;
++ slave->dev = slave_dev;
++
++ if (bond_kobj_init(slave))
++ return NULL;
++
+ if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ SLAVE_AD_INFO(slave) = kzalloc(sizeof(struct ad_slave_info),
+ GFP_KERNEL);
+ if (!SLAVE_AD_INFO(slave)) {
+- kfree(slave);
++ kobject_put(&slave->kobj);
+ return NULL;
+ }
+ }
+@@ -1289,17 +1327,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond)
+ return slave;
+ }
+
+-static void bond_free_slave(struct slave *slave)
+-{
+- struct bonding *bond = bond_get_bond_by_slave(slave);
+-
+- cancel_delayed_work_sync(&slave->notify_work);
+- if (BOND_MODE(bond) == BOND_MODE_8023AD)
+- kfree(SLAVE_AD_INFO(slave));
+-
+- kfree(slave);
+-}
+-
+ static void bond_fill_ifbond(struct bonding *bond, struct ifbond *info)
+ {
+ info->bond_mode = BOND_MODE(bond);
+@@ -1487,14 +1514,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
+ bond->dev->addr_assign_type == NET_ADDR_RANDOM)
+ bond_set_dev_addr(bond->dev, slave_dev);
+
+- new_slave = bond_alloc_slave(bond);
++ new_slave = bond_alloc_slave(bond, slave_dev);
+ if (!new_slave) {
+ res = -ENOMEM;
+ goto err_undo_flags;
+ }
+
+- new_slave->bond = bond;
+- new_slave->dev = slave_dev;
+ /* Set the new_slave's queue_id to be zero. Queue ID mapping
+ * is set via sysfs or module option if desired.
+ */
+@@ -1821,7 +1846,7 @@ err_restore_mtu:
+ dev_set_mtu(slave_dev, new_slave->original_mtu);
+
+ err_free:
+- bond_free_slave(new_slave);
++ kobject_put(&new_slave->kobj);
+
+ err_undo_flags:
+ /* Enslave of first slave has failed and we need to fix master's mac */
+@@ -2009,7 +2034,7 @@ static int __bond_release_one(struct net_device *bond_dev,
+ if (!netif_is_bond_master(slave_dev))
+ slave_dev->priv_flags &= ~IFF_BONDING;
+
+- bond_free_slave(slave);
++ kobject_put(&slave->kobj);
+
+ return 0;
+ }
+diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
+index 36dee305c6872..9ec0498d7d54e 100644
+--- a/drivers/net/bonding/bond_sysfs_slave.c
++++ b/drivers/net/bonding/bond_sysfs_slave.c
+@@ -125,7 +125,6 @@ static const struct slave_attribute *slave_attrs[] = {
+ };
+
+ #define to_slave_attr(_at) container_of(_at, struct slave_attribute, attr)
+-#define to_slave(obj) container_of(obj, struct slave, kobj)
+
+ static ssize_t slave_show(struct kobject *kobj,
+ struct attribute *attr, char *buf)
+@@ -136,28 +135,15 @@ static ssize_t slave_show(struct kobject *kobj,
+ return slave_attr->show(slave, buf);
+ }
+
+-static const struct sysfs_ops slave_sysfs_ops = {
++const struct sysfs_ops slave_sysfs_ops = {
+ .show = slave_show,
+ };
+
+-static struct kobj_type slave_ktype = {
+-#ifdef CONFIG_SYSFS
+- .sysfs_ops = &slave_sysfs_ops,
+-#endif
+-};
+-
+ int bond_sysfs_slave_add(struct slave *slave)
+ {
+ const struct slave_attribute **a;
+ int err;
+
+- err = kobject_init_and_add(&slave->kobj, &slave_ktype,
+- &(slave->dev->dev.kobj), "bonding_slave");
+- if (err) {
+- kobject_put(&slave->kobj);
+- return err;
+- }
+-
+ for (a = slave_attrs; *a; ++a) {
+ err = sysfs_create_file(&slave->kobj, &((*a)->attr));
+ if (err) {
+@@ -175,6 +161,4 @@ void bond_sysfs_slave_del(struct slave *slave)
+
+ for (a = slave_attrs; *a; ++a)
+ sysfs_remove_file(&slave->kobj, &((*a)->attr));
+-
+- kobject_put(&slave->kobj);
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+index 20b6e1b3f5e34..5c26d50fe0e91 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+@@ -3176,6 +3176,7 @@ int t3_sge_alloc_qset(struct adapter *adapter, unsigned int id, int nports,
+ GFP_KERNEL | __GFP_COMP);
+ if (!avail) {
+ CH_ALERT(adapter, "free list queue 0 initialization failed\n");
++ ret = -ENOMEM;
+ goto err;
+ }
+ if (avail < q->fl[0].size)
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 2938ac440fb36..d762eb491a7c3 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1878,8 +1878,10 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ napi_schedule(&adapter->napi[i]);
+
+ if (adapter->reset_reason != VNIC_RESET_FAILOVER &&
+- adapter->reset_reason != VNIC_RESET_CHANGE_PARAM)
++ adapter->reset_reason != VNIC_RESET_CHANGE_PARAM) {
+ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev);
++ call_netdevice_notifiers(NETDEV_RESEND_IGMP, netdev);
++ }
+
+ netif_carrier_on(netdev);
+
+@@ -2156,6 +2158,12 @@ restart_poll:
+
+ if (!pending_scrq(adapter, adapter->rx_scrq[scrq_num]))
+ break;
++ /* The queue entry at the current index is peeked at above
++ * to determine that there is a valid descriptor awaiting
++ * processing. We want to be sure that the current slot
++ * holds a valid descriptor before reading its contents.
++ */
++ dma_rmb();
+ next = ibmvnic_next_scrq(adapter, adapter->rx_scrq[scrq_num]);
+ rx_buff =
+ (struct ibmvnic_rx_buff *)be64_to_cpu(next->
+@@ -2778,13 +2786,18 @@ restart_loop:
+ unsigned int pool = scrq->pool_index;
+ int num_entries = 0;
+
++ /* The queue entry at the current index is peeked at above
++ * to determine that there is a valid descriptor awaiting
++ * processing. We want to be sure that the current slot
++ * holds a valid descriptor before reading its contents.
++ */
++ dma_rmb();
++
+ next = ibmvnic_next_scrq(adapter, scrq);
+ for (i = 0; i < next->tx_comp.num_comps; i++) {
+- if (next->tx_comp.rcs[i]) {
++ if (next->tx_comp.rcs[i])
+ dev_err(dev, "tx error %x\n",
+ next->tx_comp.rcs[i]);
+- continue;
+- }
+ index = be32_to_cpu(next->tx_comp.correlators[i]);
+ if (index & IBMVNIC_TSO_POOL_MASK) {
+ tx_pool = &adapter->tso_pool[pool];
+@@ -3174,6 +3187,11 @@ static union sub_crq *ibmvnic_next_scrq(struct ibmvnic_adapter *adapter,
+ }
+ spin_unlock_irqrestore(&scrq->lock, flags);
+
++ /* Ensure that the entire buffer descriptor has been
++ * loaded before reading its contents
++ */
++ dma_rmb();
++
+ return entry;
+ }
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
+index f84e2c2d02c09..3ad46d1f58f6e 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -147,6 +147,7 @@ enum i40e_state_t {
+ __I40E_CLIENT_SERVICE_REQUESTED,
+ __I40E_CLIENT_L2_CHANGE,
+ __I40E_CLIENT_RESET,
++ __I40E_VF_RESETS_DISABLED, /* disable resets during i40e_remove */
+ /* This must be last as it determines the size of the BITMAP */
+ __I40E_STATE_SIZE__,
+ };
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 3200c75b9ed2a..985601a65defd 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -3895,8 +3895,16 @@ static irqreturn_t i40e_intr(int irq, void *data)
+ }
+
+ if (icr0 & I40E_PFINT_ICR0_VFLR_MASK) {
+- ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK;
+- set_bit(__I40E_VFLR_EVENT_PENDING, pf->state);
++ /* disable any further VFLR event notifications */
++ if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state)) {
++ u32 reg = rd32(hw, I40E_PFINT_ICR0_ENA);
++
++ reg &= ~I40E_PFINT_ICR0_VFLR_MASK;
++ wr32(hw, I40E_PFINT_ICR0_ENA, reg);
++ } else {
++ ena_mask &= ~I40E_PFINT_ICR0_ENA_VFLR_MASK;
++ set_bit(__I40E_VFLR_EVENT_PENDING, pf->state);
++ }
+ }
+
+ if (icr0 & I40E_PFINT_ICR0_GRST_MASK) {
+@@ -14155,6 +14163,11 @@ static void i40e_remove(struct pci_dev *pdev)
+ while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state))
+ usleep_range(1000, 2000);
+
++ if (pf->flags & I40E_FLAG_SRIOV_ENABLED) {
++ set_bit(__I40E_VF_RESETS_DISABLED, pf->state);
++ i40e_free_vfs(pf);
++ pf->flags &= ~I40E_FLAG_SRIOV_ENABLED;
++ }
+ /* no more scheduling of any task */
+ set_bit(__I40E_SUSPENDED, pf->state);
+ set_bit(__I40E_DOWN, pf->state);
+@@ -14168,11 +14181,6 @@ static void i40e_remove(struct pci_dev *pdev)
+ */
+ i40e_notify_client_of_netdev_close(pf->vsi[pf->lan_vsi], false);
+
+- if (pf->flags & I40E_FLAG_SRIOV_ENABLED) {
+- i40e_free_vfs(pf);
+- pf->flags &= ~I40E_FLAG_SRIOV_ENABLED;
+- }
+-
+ i40e_fdir_teardown(pf);
+
+ /* If there is a switch structure or any orphans, remove them.
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index bc4eda52372af..dd0c9604d3c92 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1204,7 +1204,8 @@ static void i40e_cleanup_reset_vf(struct i40e_vf *vf)
+ * @vf: pointer to the VF structure
+ * @flr: VFLR was issued or not
+ *
+- * Returns true if the VF is reset, false otherwise.
++ * Returns true if the VF is in reset, resets successfully, or resets
++ * are disabled and false otherwise.
+ **/
+ bool i40e_reset_vf(struct i40e_vf *vf, bool flr)
+ {
+@@ -1214,11 +1215,14 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr)
+ u32 reg;
+ int i;
+
++ if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state))
++ return true;
++
+ /* If the VFs have been disabled, this means something else is
+ * resetting the VF, so we shouldn't continue.
+ */
+ if (test_and_set_bit(__I40E_VF_DISABLE, pf->state))
+- return false;
++ return true;
+
+ i40e_trigger_vf_reset(vf, flr);
+
+@@ -1382,6 +1386,15 @@ void i40e_free_vfs(struct i40e_pf *pf)
+
+ i40e_notify_client_of_vf_enable(pf, 0);
+
++ /* Disable IOV before freeing resources. This lets any VF drivers
++ * running in the host get themselves cleaned up before we yank
++ * the carpet out from underneath their feet.
++ */
++ if (!pci_vfs_assigned(pf->pdev))
++ pci_disable_sriov(pf->pdev);
++ else
++ dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n");
++
+ /* Amortize wait time by stopping all VFs at the same time */
+ for (i = 0; i < pf->num_alloc_vfs; i++) {
+ if (test_bit(I40E_VF_STATE_INIT, &pf->vf[i].vf_states))
+@@ -1397,15 +1410,6 @@ void i40e_free_vfs(struct i40e_pf *pf)
+ i40e_vsi_wait_queues_disabled(pf->vsi[pf->vf[i].lan_vsi_idx]);
+ }
+
+- /* Disable IOV before freeing resources. This lets any VF drivers
+- * running in the host get themselves cleaned up before we yank
+- * the carpet out from underneath their feet.
+- */
+- if (!pci_vfs_assigned(pf->pdev))
+- pci_disable_sriov(pf->pdev);
+- else
+- dev_warn(&pf->pdev->dev, "VFs are assigned - not disabling SR-IOV\n");
+-
+ /* free up VF resources */
+ tmp = pf->num_alloc_vfs;
+ pf->num_alloc_vfs = 0;
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 04bee450eb3d0..e4e43519710d4 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -3363,6 +3363,7 @@ static int mvpp2_open(struct net_device *dev)
+ if (!valid) {
+ netdev_err(port->dev,
+ "invalid configuration: no dt or link IRQ");
++ err = -ENOENT;
+ goto err_free_irq;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index e36d3e3675f96..9c3653e06886a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -331,6 +331,24 @@ out_free:
+ return err;
+ }
+
++static u32 fwp_fill_manage_pages_out(struct fw_page *fwp, u32 *out, u32 index,
++ u32 npages)
++{
++ u32 pages_set = 0;
++ unsigned int n;
++
++ for_each_clear_bit(n, &fwp->bitmask, MLX5_NUM_4K_IN_PAGE) {
++ MLX5_ARRAY_SET64(manage_pages_out, out, pas, index + pages_set,
++ fwp->addr + (n * MLX5_ADAPTER_PAGE_SIZE));
++ pages_set++;
++
++ if (!--npages)
++ break;
++ }
++
++ return pages_set;
++}
++
+ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ u32 *in, int in_size, u32 *out, int out_size)
+ {
+@@ -354,8 +372,7 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ if (fwp->func_id != func_id)
+ continue;
+
+- MLX5_ARRAY_SET64(manage_pages_out, out, pas, i, fwp->addr);
+- i++;
++ i += fwp_fill_manage_pages_out(fwp, out, i, npages - i);
+ }
+
+ MLX5_SET(manage_pages_out, out, output_num_entries, i);
+diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
+index 65f69e562618a..e2c280913fbbb 100644
+--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
+@@ -1089,16 +1089,20 @@ static int pasemi_mac_open(struct net_device *dev)
+
+ mac->tx = pasemi_mac_setup_tx_resources(dev);
+
+- if (!mac->tx)
++ if (!mac->tx) {
++ ret = -ENOMEM;
+ goto out_tx_ring;
++ }
+
+ /* We might already have allocated rings in case mtu was changed
+ * before interface was brought up.
+ */
+ if (dev->mtu > 1500 && !mac->num_cs) {
+ pasemi_mac_setup_csrings(mac);
+- if (!mac->num_cs)
++ if (!mac->num_cs) {
++ ret = -ENOMEM;
+ goto out_tx_ring;
++ }
+ }
+
+ /* Zero out rmon counters */
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 2e2afc824a6a8..69660102182bb 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -256,11 +256,21 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ skb_dst_set(skb, &tun_dst->dst);
+
+ /* Ignore packet loops (and multicast echo) */
+- if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr)) {
+- geneve->dev->stats.rx_errors++;
+- goto drop;
+- }
++ if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr))
++ goto rx_error;
+
++ switch (skb_protocol(skb, true)) {
++ case htons(ETH_P_IP):
++ if (pskb_may_pull(skb, sizeof(struct iphdr)))
++ goto rx_error;
++ break;
++ case htons(ETH_P_IPV6):
++ if (pskb_may_pull(skb, sizeof(struct ipv6hdr)))
++ goto rx_error;
++ break;
++ default:
++ goto rx_error;
++ }
+ oiph = skb_network_header(skb);
+ skb_reset_network_header(skb);
+
+@@ -301,6 +311,8 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ u64_stats_update_end(&stats->syncp);
+ }
+ return;
++rx_error:
++ geneve->dev->stats.rx_errors++;
+ drop:
+ /* Consume bad packet */
+ kfree_skb(skb);
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index d84a09172ddbf..fe0e02e11f294 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1988,12 +1988,15 @@ static ssize_t tun_chr_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ struct tun_file *tfile = file->private_data;
+ struct tun_struct *tun = tun_get(tfile);
+ ssize_t result;
++ int noblock = 0;
+
+ if (!tun)
+ return -EBADFD;
+
+- result = tun_get_user(tun, tfile, NULL, from,
+- file->f_flags & O_NONBLOCK, false);
++ if ((file->f_flags & O_NONBLOCK) || (iocb->ki_flags & IOCB_NOWAIT))
++ noblock = 1;
++
++ result = tun_get_user(tun, tfile, NULL, from, noblock, false);
+
+ tun_put(tun);
+ return result;
+@@ -2214,10 +2217,15 @@ static ssize_t tun_chr_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ struct tun_file *tfile = file->private_data;
+ struct tun_struct *tun = tun_get(tfile);
+ ssize_t len = iov_iter_count(to), ret;
++ int noblock = 0;
+
+ if (!tun)
+ return -EBADFD;
+- ret = tun_do_read(tun, tfile, to, file->f_flags & O_NONBLOCK, NULL);
++
++ if ((file->f_flags & O_NONBLOCK) || (iocb->ki_flags & IOCB_NOWAIT))
++ noblock = 1;
++
++ ret = tun_do_read(tun, tfile, to, noblock, NULL);
+ ret = min_t(ssize_t, ret, len);
+ if (ret > 0)
+ iocb->ki_pos = ret;
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index 3d71f17163902..8e2eb20613548 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -70,7 +70,7 @@
+ #define IPHETH_USBINTF_SUBCLASS 253
+ #define IPHETH_USBINTF_PROTO 1
+
+-#define IPHETH_BUF_SIZE 1516
++#define IPHETH_BUF_SIZE 1514
+ #define IPHETH_IP_ALIGN 2 /* padding at front of URB */
+ #define IPHETH_TX_TIMEOUT (5 * HZ)
+
+diff --git a/include/net/bonding.h b/include/net/bonding.h
+index 8116648873c35..c458f084f7bb9 100644
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -170,6 +170,11 @@ struct slave {
+ struct rtnl_link_stats64 slave_stats;
+ };
+
++static inline struct slave *to_slave(struct kobject *kobj)
++{
++ return container_of(kobj, struct slave, kobj);
++}
++
+ struct bond_up_slave {
+ unsigned int count;
+ struct rcu_head rcu;
+@@ -733,6 +738,9 @@ extern struct bond_parm_tbl ad_select_tbl[];
+ /* exported from bond_netlink.c */
+ extern struct rtnl_link_ops bond_link_ops;
+
++/* exported from bond_sysfs_slave.c */
++extern const struct sysfs_ops slave_sysfs_ops;
++
+ static inline void bond_tx_drop(struct net_device *dev, struct sk_buff *skb)
+ {
+ atomic_long_inc(&dev->tx_dropped);
+diff --git a/include/net/tls.h b/include/net/tls.h
+index 98f5ad0319a2b..9caef9bad0752 100644
+--- a/include/net/tls.h
++++ b/include/net/tls.h
+@@ -163,6 +163,12 @@ enum {
+
+ enum tls_context_flags {
+ TLS_RX_SYNC_RUNNING = 0,
++ /* tls_dev_del was called for the RX side, device state was released,
++ * but tls_ctx->netdev might still be kept, because TX-side driver
++ * resources might not be released yet. Used to prevent the second
++ * tls_dev_del call in tls_device_down if it happens simultaneously.
++ */
++ TLS_RX_DEV_CLOSED = 2,
+ };
+
+ struct cipher_context {
+diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
+index 568918fae8d41..ade6c3070c62f 100644
+--- a/kernel/trace/trace_hwlat.c
++++ b/kernel/trace/trace_hwlat.c
+@@ -355,7 +355,7 @@ static int start_kthread(struct trace_array *tr)
+ struct task_struct *kthread;
+ int next_cpu;
+
+- if (WARN_ON(hwlat_kthread))
++ if (hwlat_kthread)
+ return 0;
+
+ /* Just pick the first CPU on first iteration */
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index ccab290c14d48..c5380c6baf2e7 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -719,6 +719,11 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
+ mtu_reserved = nf_bridge_mtu_reduction(skb);
+ mtu = skb->dev->mtu;
+
++ if (nf_bridge->pkt_otherhost) {
++ skb->pkt_type = PACKET_OTHERHOST;
++ nf_bridge->pkt_otherhost = false;
++ }
++
+ if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
+ mtu = nf_bridge->frag_max_size;
+
+@@ -812,8 +817,6 @@ static unsigned int br_nf_post_routing(void *priv,
+ else
+ return NF_ACCEPT;
+
+- /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
+- * about the value of skb->pkt_type. */
+ if (skb->pkt_type == PACKET_OTHERHOST) {
+ skb->pkt_type = PACKET_HOST;
+ nf_bridge->pkt_otherhost = true;
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index be4bc833c28a2..b5d9c9b2c7028 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4265,7 +4265,7 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk)
+ if (skb && (skb_next = skb_peek(q))) {
+ icmp_next = is_icmp_err_skb(skb_next);
+ if (icmp_next)
+- sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin;
++ sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_errno;
+ }
+ spin_unlock_irqrestore(&q->lock, flags);
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 48081e6d50b4e..2fe50f6f876d4 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2876,7 +2876,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
+ memset(&fl4, 0, sizeof(fl4));
+ fl4.daddr = dst;
+ fl4.saddr = src;
+- fl4.flowi4_tos = rtm->rtm_tos;
++ fl4.flowi4_tos = rtm->rtm_tos & IPTOS_RT_MASK;
+ fl4.flowi4_oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0;
+ fl4.flowi4_mark = mark;
+ fl4.flowi4_uid = uid;
+@@ -2900,8 +2900,9 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
+ fl4.flowi4_iif = iif; /* for rt_fill_info */
+ skb->dev = dev;
+ skb->mark = mark;
+- err = ip_route_input_rcu(skb, dst, src, rtm->rtm_tos,
+- dev, &res);
++ err = ip_route_input_rcu(skb, dst, src,
++ rtm->rtm_tos & IPTOS_RT_MASK, dev,
++ &res);
+
+ rt = skb_rtable(skb);
+ if (err == 0 && rt->dst.error)
+diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
+index 32c3162baf3e7..00a7482b6fbd9 100644
+--- a/net/ipv4/tcp_cong.c
++++ b/net/ipv4/tcp_cong.c
+@@ -196,6 +196,11 @@ static void tcp_reinit_congestion_control(struct sock *sk,
+ icsk->icsk_ca_setsockopt = 1;
+ memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
+
++ if (ca->flags & TCP_CONG_NEEDS_ECN)
++ INET_ECN_xmit(sk);
++ else
++ INET_ECN_dontxmit(sk);
++
+ if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
+ tcp_init_congestion_control(sk);
+ }
+diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
+index 1d6ced37ad718..c7dc8b2de6c22 100644
+--- a/net/ipv6/addrlabel.c
++++ b/net/ipv6/addrlabel.c
+@@ -306,7 +306,9 @@ static int ip6addrlbl_del(struct net *net,
+ /* add default label */
+ static int __net_init ip6addrlbl_net_init(struct net *net)
+ {
+- int err = 0;
++ struct ip6addrlbl_entry *p = NULL;
++ struct hlist_node *n;
++ int err;
+ int i;
+
+ ADDRLABEL(KERN_DEBUG "%s\n", __func__);
+@@ -315,14 +317,20 @@ static int __net_init ip6addrlbl_net_init(struct net *net)
+ INIT_HLIST_HEAD(&net->ipv6.ip6addrlbl_table.head);
+
+ for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) {
+- int ret = ip6addrlbl_add(net,
+- ip6addrlbl_init_table[i].prefix,
+- ip6addrlbl_init_table[i].prefixlen,
+- 0,
+- ip6addrlbl_init_table[i].label, 0);
+- /* XXX: should we free all rules when we catch an error? */
+- if (ret && (!err || err != -ENOMEM))
+- err = ret;
++ err = ip6addrlbl_add(net,
++ ip6addrlbl_init_table[i].prefix,
++ ip6addrlbl_init_table[i].prefixlen,
++ 0,
++ ip6addrlbl_init_table[i].label, 0);
++ if (err)
++ goto err_ip6addrlbl_add;
++ }
++ return 0;
++
++err_ip6addrlbl_add:
++ hlist_for_each_entry_safe(p, n, &net->ipv6.ip6addrlbl_table.head, list) {
++ hlist_del_rcu(&p->list);
++ kfree_rcu(p, rcu);
+ }
+ return err;
+ }
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 7cc9cd83ecb59..86c8ea7d70067 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1140,8 +1140,13 @@ static void ip6gre_tnl_link_config_route(struct ip6_tnl *t, int set_mtu,
+ return;
+
+ if (rt->dst.dev) {
+- dev->needed_headroom = rt->dst.dev->hard_header_len +
+- t_hlen;
++ unsigned short dst_len = rt->dst.dev->hard_header_len +
++ t_hlen;
++
++ if (t->dev->header_ops)
++ dev->hard_header_len = dst_len;
++ else
++ dev->needed_headroom = dst_len;
+
+ if (set_mtu) {
+ dev->mtu = rt->dst.dev->mtu - t_hlen;
+@@ -1166,7 +1171,12 @@ static int ip6gre_calc_hlen(struct ip6_tnl *tunnel)
+ tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
+
+ t_hlen = tunnel->hlen + sizeof(struct ipv6hdr);
+- tunnel->dev->needed_headroom = LL_MAX_HEADER + t_hlen;
++
++ if (tunnel->dev->header_ops)
++ tunnel->dev->hard_header_len = LL_MAX_HEADER + t_hlen;
++ else
++ tunnel->dev->needed_headroom = LL_MAX_HEADER + t_hlen;
++
+ return t_hlen;
+ }
+
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index ad3e515f91f0f..d59f2341bfec6 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -1782,7 +1782,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
+ }
+
+ /* Create the new socket */
+- nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0);
++ nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0);
+ if (!nsk) {
+ err = pr_iucv->path_sever(path, user_data);
+ iucv_path_free(path);
+@@ -1992,7 +1992,7 @@ static int afiucv_hs_callback_syn(struct sock *sk, struct sk_buff *skb)
+ goto out;
+ }
+
+- nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0);
++ nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0);
+ bh_lock_sock(sk);
+ if ((sk->sk_state != IUCV_LISTEN) ||
+ sk_acceptq_is_full(sk) ||
+diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
+index 094a6621f8e80..c318e5c9f6df3 100644
+--- a/net/rose/rose_loopback.c
++++ b/net/rose/rose_loopback.c
+@@ -99,10 +99,19 @@ static void rose_loopback_timer(struct timer_list *unused)
+ }
+
+ if (frametype == ROSE_CALL_REQUEST) {
+- if ((dev = rose_dev_get(dest)) != NULL) {
+- if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0)
+- kfree_skb(skb);
+- } else {
++ if (!rose_loopback_neigh->dev) {
++ kfree_skb(skb);
++ continue;
++ }
++
++ dev = rose_dev_get(dest);
++ if (!dev) {
++ kfree_skb(skb);
++ continue;
++ }
++
++ if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) {
++ dev_put(dev);
+ kfree_skb(skb);
+ }
+ } else {
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index dd0fc2aa68759..228e3ce48d437 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -955,6 +955,8 @@ void tls_device_offload_cleanup_rx(struct sock *sk)
+ if (tls_ctx->tx_conf != TLS_HW) {
+ dev_put(netdev);
+ tls_ctx->netdev = NULL;
++ } else {
++ set_bit(TLS_RX_DEV_CLOSED, &tls_ctx->flags);
+ }
+ out:
+ up_read(&device_offload_lock);
+@@ -984,7 +986,8 @@ static int tls_device_down(struct net_device *netdev)
+ if (ctx->tx_conf == TLS_HW)
+ netdev->tlsdev_ops->tls_dev_del(netdev, ctx,
+ TLS_OFFLOAD_CTX_DIR_TX);
+- if (ctx->rx_conf == TLS_HW)
++ if (ctx->rx_conf == TLS_HW &&
++ !test_bit(TLS_RX_DEV_CLOSED, &ctx->flags))
+ netdev->tlsdev_ops->tls_dev_del(netdev, ctx,
+ TLS_OFFLOAD_CTX_DIR_RX);
+ WRITE_ONCE(ctx->netdev, NULL);
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index bbb2da70e8701..7d761244a3600 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -630,6 +630,12 @@ static struct sk_buff *tls_wait_data(struct sock *sk, int flags,
+ return NULL;
+ }
+
++ if (!skb_queue_empty(&sk->sk_receive_queue)) {
++ __strp_unpause(&ctx->strp);
++ if (ctx->recv_pkt)
++ return ctx->recv_pkt;
++ }
++
+ if (sk->sk_shutdown & RCV_SHUTDOWN)
+ return NULL;
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index b3db0b0a52f5c..f43d037ea8520 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -680,7 +680,8 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ int len, i, rc = 0;
+
+ if (addr_len != sizeof(struct sockaddr_x25) ||
+- addr->sx25_family != AF_X25) {
++ addr->sx25_family != AF_X25 ||
++ strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN) {
+ rc = -EINVAL;
+ goto out;
+ }
+@@ -774,7 +775,8 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
+
+ rc = -EINVAL;
+ if (addr_len != sizeof(struct sockaddr_x25) ||
+- addr->sx25_family != AF_X25)
++ addr->sx25_family != AF_X25 ||
++ strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN)
+ goto out;
+
+ rc = -ENETUNREACH;
+diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c
+index 26ed23b18b777..7db3032e723a4 100644
+--- a/sound/usb/mixer_us16x08.c
++++ b/sound/usb/mixer_us16x08.c
+@@ -617,7 +617,7 @@ static int snd_us16x08_eq_put(struct snd_kcontrol *kcontrol,
+ static int snd_us16x08_meter_info(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_info *uinfo)
+ {
+- uinfo->count = 1;
++ uinfo->count = 34;
+ uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+ uinfo->value.integer.max = 0x7FFF;
+ uinfo->value.integer.min = 0;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-12-11 12:56 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-12-11 12:56 UTC (permalink / raw
To: gentoo-commits
commit: e16ae6bcae07ef8229217db510288389a1193dcc
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 11 12:56:04 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Dec 11 12:56:04 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e16ae6bc
Linux patch 4.19.163
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1162_linux-4.19.163.patch | 1389 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1393 insertions(+)
diff --git a/0000_README b/0000_README
index 9a36e6f..e1c0627 100644
--- a/0000_README
+++ b/0000_README
@@ -687,6 +687,10 @@ Patch: 1161_linux-4.19.162.patch
From: https://www.kernel.org
Desc: Linux 4.19.162
+Patch: 1162_linux-4.19.163.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.163
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1162_linux-4.19.163.patch b/1162_linux-4.19.163.patch
new file mode 100644
index 0000000..b2252ce
--- /dev/null
+++ b/1162_linux-4.19.163.patch
@@ -0,0 +1,1389 @@
+diff --git a/Makefile b/Makefile
+index 71e55c5cd74a0..b651d77eb2df9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 162
++SUBLEVEL = 163
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h
+index c2c01f84df75f..3e0e18d376d2c 100644
+--- a/arch/x86/include/asm/insn.h
++++ b/arch/x86/include/asm/insn.h
+@@ -208,6 +208,21 @@ static inline int insn_offset_immediate(struct insn *insn)
+ return insn_offset_displacement(insn) + insn->displacement.nbytes;
+ }
+
++/**
++ * for_each_insn_prefix() -- Iterate prefixes in the instruction
++ * @insn: Pointer to struct insn.
++ * @idx: Index storage.
++ * @prefix: Prefix byte.
++ *
++ * Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix
++ * and the index is stored in @idx (note that this @idx is just for a cursor,
++ * do not change it.)
++ * Since prefixes.nbytes can be bigger than 4 if some prefixes
++ * are repeated, it cannot be used for looping over the prefixes.
++ */
++#define for_each_insn_prefix(insn, idx, prefix) \
++ for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = insn->prefixes.bytes[idx]) != 0; idx++)
++
+ #define POP_SS_OPCODE 0x1f
+ #define MOV_SREG_OPCODE 0x8e
+
+diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
+index 420aa7d3a2e6b..ae9e806a11def 100644
+--- a/arch/x86/kernel/uprobes.c
++++ b/arch/x86/kernel/uprobes.c
+@@ -268,12 +268,13 @@ static volatile u32 good_2byte_insns[256 / 32] = {
+
+ static bool is_prefix_bad(struct insn *insn)
+ {
++ insn_byte_t p;
+ int i;
+
+- for (i = 0; i < insn->prefixes.nbytes; i++) {
++ for_each_insn_prefix(insn, i, p) {
+ insn_attr_t attr;
+
+- attr = inat_get_opcode_attribute(insn->prefixes.bytes[i]);
++ attr = inat_get_opcode_attribute(p);
+ switch (attr) {
+ case INAT_MAKE_PREFIX(INAT_PFX_ES):
+ case INAT_MAKE_PREFIX(INAT_PFX_CS):
+@@ -728,6 +729,7 @@ static const struct uprobe_xol_ops push_xol_ops = {
+ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
+ {
+ u8 opc1 = OPCODE1(insn);
++ insn_byte_t p;
+ int i;
+
+ switch (opc1) {
+@@ -758,8 +760,8 @@ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
+ * Intel and AMD behavior differ in 64-bit mode: Intel ignores 66 prefix.
+ * No one uses these insns, reject any branch insns with such prefix.
+ */
+- for (i = 0; i < insn->prefixes.nbytes; i++) {
+- if (insn->prefixes.bytes[i] == 0x66)
++ for_each_insn_prefix(insn, i, p) {
++ if (p == 0x66)
+ return -ENOTSUPP;
+ }
+
+diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
+index 87dcba101e562..3172eaf4ec5e3 100644
+--- a/arch/x86/lib/insn-eval.c
++++ b/arch/x86/lib/insn-eval.c
+@@ -70,14 +70,15 @@ static int get_seg_reg_override_idx(struct insn *insn)
+ {
+ int idx = INAT_SEG_REG_DEFAULT;
+ int num_overrides = 0, i;
++ insn_byte_t p;
+
+ insn_get_prefixes(insn);
+
+ /* Look for any segment override prefixes. */
+- for (i = 0; i < insn->prefixes.nbytes; i++) {
++ for_each_insn_prefix(insn, i, p) {
+ insn_attr_t attr;
+
+- attr = inat_get_opcode_attribute(insn->prefixes.bytes[i]);
++ attr = inat_get_opcode_attribute(p);
+ switch (attr) {
+ case INAT_MAKE_PREFIX(INAT_PFX_CS):
+ idx = INAT_SEG_REG_CS;
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index 0e7f9bd17a91a..83c246e30399a 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -404,6 +404,19 @@ static void i2c_imx_dma_free(struct imx_i2c_struct *i2c_imx)
+ dma->chan_using = NULL;
+ }
+
++static void i2c_imx_clear_irq(struct imx_i2c_struct *i2c_imx, unsigned int bits)
++{
++ unsigned int temp;
++
++ /*
++ * i2sr_clr_opcode is the value to clear all interrupts. Here we want to
++ * clear only <bits>, so we write ~i2sr_clr_opcode with just <bits>
++ * toggled. This is required because i.MX needs W0C and Vybrid uses W1C.
++ */
++ temp = ~i2c_imx->hwdata->i2sr_clr_opcode ^ bits;
++ imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++}
++
+ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
+ {
+ unsigned long orig_jiffies = jiffies;
+@@ -416,8 +429,7 @@ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
+
+ /* check for arbitration lost */
+ if (temp & I2SR_IAL) {
+- temp &= ~I2SR_IAL;
+- imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++ i2c_imx_clear_irq(i2c_imx, I2SR_IAL);
+ return -EAGAIN;
+ }
+
+@@ -448,6 +460,16 @@ static int i2c_imx_trx_complete(struct imx_i2c_struct *i2c_imx)
+ dev_dbg(&i2c_imx->adapter.dev, "<%s> Timeout\n", __func__);
+ return -ETIMEDOUT;
+ }
++
++ /* check for arbitration lost */
++ if (i2c_imx->i2csr & I2SR_IAL) {
++ dev_dbg(&i2c_imx->adapter.dev, "<%s> Arbitration lost\n", __func__);
++ i2c_imx_clear_irq(i2c_imx, I2SR_IAL);
++
++ i2c_imx->i2csr = 0;
++ return -EAGAIN;
++ }
++
+ dev_dbg(&i2c_imx->adapter.dev, "<%s> TRX complete\n", __func__);
+ i2c_imx->i2csr = 0;
+ return 0;
+@@ -557,6 +579,8 @@ static void i2c_imx_stop(struct imx_i2c_struct *i2c_imx)
+ /* Stop I2C transaction */
+ dev_dbg(&i2c_imx->adapter.dev, "<%s>\n", __func__);
+ temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
++ if (!(temp & I2CR_MSTA))
++ i2c_imx->stopped = 1;
+ temp &= ~(I2CR_MSTA | I2CR_MTX);
+ if (i2c_imx->dma)
+ temp &= ~I2CR_DMAEN;
+@@ -587,9 +611,7 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id)
+ if (temp & I2SR_IIF) {
+ /* save status register */
+ i2c_imx->i2csr = temp;
+- temp &= ~I2SR_IIF;
+- temp |= (i2c_imx->hwdata->i2sr_clr_opcode & I2SR_IIF);
+- imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++ i2c_imx_clear_irq(i2c_imx, I2SR_IIF);
+ wake_up(&i2c_imx->queue);
+ return IRQ_HANDLED;
+ }
+@@ -722,9 +744,12 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx,
+ */
+ dev_dbg(dev, "<%s> clear MSTA\n", __func__);
+ temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
++ if (!(temp & I2CR_MSTA))
++ i2c_imx->stopped = 1;
+ temp &= ~(I2CR_MSTA | I2CR_MTX);
+ imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
+- i2c_imx_bus_busy(i2c_imx, 0);
++ if (!i2c_imx->stopped)
++ i2c_imx_bus_busy(i2c_imx, 0);
+ } else {
+ /*
+ * For i2c master receiver repeat restart operation like:
+@@ -847,9 +872,12 @@ static int i2c_imx_read(struct imx_i2c_struct *i2c_imx, struct i2c_msg *msgs, bo
+ dev_dbg(&i2c_imx->adapter.dev,
+ "<%s> clear MSTA\n", __func__);
+ temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
++ if (!(temp & I2CR_MSTA))
++ i2c_imx->stopped = 1;
+ temp &= ~(I2CR_MSTA | I2CR_MTX);
+ imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
+- i2c_imx_bus_busy(i2c_imx, 0);
++ if (!i2c_imx->stopped)
++ i2c_imx_bus_busy(i2c_imx, 0);
+ } else {
+ /*
+ * For i2c master receiver repeat restart operation like:
+diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
+index e09cd0775ae91..3417f7dffa943 100644
+--- a/drivers/i2c/busses/i2c-qup.c
++++ b/drivers/i2c/busses/i2c-qup.c
+@@ -806,7 +806,8 @@ static int qup_i2c_bam_schedule_desc(struct qup_i2c_dev *qup)
+ if (ret || qup->bus_err || qup->qup_err) {
+ reinit_completion(&qup->xfer);
+
+- if (qup_i2c_change_state(qup, QUP_RUN_STATE)) {
++ ret = qup_i2c_change_state(qup, QUP_RUN_STATE);
++ if (ret) {
+ dev_err(qup->dev, "change to run state timed out");
+ goto desc_err;
+ }
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index fef3b4064f187..c60593c8d2be5 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -1472,7 +1472,8 @@ static int __init i8042_setup_aux(void)
+ if (error)
+ goto err_free_ports;
+
+- if (aux_enable())
++ error = aux_enable();
++ if (error)
+ goto err_free_irq;
+
+ i8042_aux_irq_registered = true;
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index df6f3cc958e5e..0948c425d6528 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -259,7 +259,7 @@
+ #define DTE_IRQ_REMAP_INTCTL_MASK (0x3ULL << 60)
+ #define DTE_IRQ_TABLE_LEN_MASK (0xfULL << 1)
+ #define DTE_IRQ_REMAP_INTCTL (2ULL << 60)
+-#define DTE_IRQ_TABLE_LEN (8ULL << 1)
++#define DTE_IRQ_TABLE_LEN (9ULL << 1)
+ #define DTE_IRQ_REMAP_ENABLE 1ULL
+
+ #define PAGE_MODE_NONE 0x00
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index 776aaf5951e4a..a1d4166864d03 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -318,7 +318,7 @@ err1:
+ #else
+ static int persistent_memory_claim(struct dm_writecache *wc)
+ {
+- BUG();
++ return -EOPNOTSUPP;
+ }
+ #endif
+
+@@ -1883,7 +1883,7 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ struct wc_memory_superblock s;
+
+ static struct dm_arg _args[] = {
+- {0, 10, "Invalid number of feature args"},
++ {0, 16, "Invalid number of feature args"},
+ };
+
+ as.argc = argc;
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 874bd542a7445..6c755eb0263fb 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -462,7 +462,6 @@ static int dm_blk_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+
+ static int dm_prepare_ioctl(struct mapped_device *md, int *srcu_idx,
+ struct block_device **bdev)
+- __acquires(md->io_barrier)
+ {
+ struct dm_target *tgt;
+ struct dm_table *map;
+@@ -496,7 +495,6 @@ retry:
+ }
+
+ static void dm_unprepare_ioctl(struct mapped_device *md, int srcu_idx)
+- __releases(md->io_barrier)
+ {
+ dm_put_live_table(md, srcu_idx);
+ }
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 69660102182bb..2e2afc824a6a8 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -256,21 +256,11 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ skb_dst_set(skb, &tun_dst->dst);
+
+ /* Ignore packet loops (and multicast echo) */
+- if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr))
+- goto rx_error;
+-
+- switch (skb_protocol(skb, true)) {
+- case htons(ETH_P_IP):
+- if (pskb_may_pull(skb, sizeof(struct iphdr)))
+- goto rx_error;
+- break;
+- case htons(ETH_P_IPV6):
+- if (pskb_may_pull(skb, sizeof(struct ipv6hdr)))
+- goto rx_error;
+- break;
+- default:
+- goto rx_error;
++ if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr)) {
++ geneve->dev->stats.rx_errors++;
++ goto drop;
+ }
++
+ oiph = skb_network_header(skb);
+ skb_reset_network_header(skb);
+
+@@ -311,8 +301,6 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ u64_stats_update_end(&stats->syncp);
+ }
+ return;
+-rx_error:
+- geneve->dev->stats.rx_errors++;
+ drop:
+ /* Consume bad packet */
+ kfree_skb(skb);
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index acb02a7aa9496..1b00a3f3b419c 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -1009,6 +1009,21 @@ static void byt_gpio_disable_free(struct pinctrl_dev *pctl_dev,
+ pm_runtime_put(&vg->pdev->dev);
+ }
+
++static void byt_gpio_direct_irq_check(struct byt_gpio *vg,
++ unsigned int offset)
++{
++ void __iomem *conf_reg = byt_gpio_reg(vg, offset, BYT_CONF0_REG);
++
++ /*
++ * Before making any direction modifications, do a check if gpio is set
++ * for direct IRQ. On Bay Trail, setting GPIO to output does not make
++ * sense, so let's at least inform the caller before they shoot
++ * themselves in the foot.
++ */
++ if (readl(conf_reg) & BYT_DIRECT_IRQ_EN)
++ dev_info_once(&vg->pdev->dev, "Potential Error: Setting GPIO with direct_irq_en to output");
++}
++
+ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev,
+ struct pinctrl_gpio_range *range,
+ unsigned int offset,
+@@ -1016,7 +1031,6 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev,
+ {
+ struct byt_gpio *vg = pinctrl_dev_get_drvdata(pctl_dev);
+ void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG);
+- void __iomem *conf_reg = byt_gpio_reg(vg, offset, BYT_CONF0_REG);
+ unsigned long flags;
+ u32 value;
+
+@@ -1027,14 +1041,8 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev,
+ if (input)
+ value |= BYT_OUTPUT_EN;
+ else
+- /*
+- * Before making any direction modifications, do a check if gpio
+- * is set for direct IRQ. On baytrail, setting GPIO to output
+- * does not make sense, so let's at least warn the caller before
+- * they shoot themselves in the foot.
+- */
+- WARN(readl(conf_reg) & BYT_DIRECT_IRQ_EN,
+- "Potential Error: Setting GPIO with direct_irq_en to output");
++ byt_gpio_direct_irq_check(vg, offset);
++
+ writel(value, val_reg);
+
+ raw_spin_unlock_irqrestore(&byt_lock, flags);
+@@ -1374,19 +1382,50 @@ static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+
+ static int byt_gpio_direction_input(struct gpio_chip *chip, unsigned int offset)
+ {
+- return pinctrl_gpio_direction_input(chip->base + offset);
++ struct byt_gpio *vg = gpiochip_get_data(chip);
++ void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG);
++ unsigned long flags;
++ u32 reg;
++
++ raw_spin_lock_irqsave(&byt_lock, flags);
++
++ reg = readl(val_reg);
++ reg &= ~BYT_DIR_MASK;
++ reg |= BYT_OUTPUT_EN;
++ writel(reg, val_reg);
++
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
++ return 0;
+ }
+
++/*
++ * Note despite the temptation this MUST NOT be converted into a call to
++ * pinctrl_gpio_direction_output() + byt_gpio_set() that does not work this
++ * MUST be done as a single BYT_VAL_REG register write.
++ * See the commit message of the commit adding this comment for details.
++ */
+ static int byt_gpio_direction_output(struct gpio_chip *chip,
+ unsigned int offset, int value)
+ {
+- int ret = pinctrl_gpio_direction_output(chip->base + offset);
++ struct byt_gpio *vg = gpiochip_get_data(chip);
++ void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG);
++ unsigned long flags;
++ u32 reg;
+
+- if (ret)
+- return ret;
++ raw_spin_lock_irqsave(&byt_lock, flags);
+
+- byt_gpio_set(chip, offset, value);
++ byt_gpio_direct_irq_check(vg, offset);
+
++ reg = readl(val_reg);
++ reg &= ~BYT_DIR_MASK;
++ if (value)
++ reg |= BYT_LEVEL;
++ else
++ reg &= ~BYT_LEVEL;
++
++ writel(reg, val_reg);
++
++ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ return 0;
+ }
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
+index 07345016fd9c7..8cfb4f12c68cb 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c
+@@ -654,7 +654,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg,
+ struct _pcie_device *pcie_device = NULL;
+ u32 ioc_state;
+ u16 smid;
+- u8 timeout;
++ unsigned long timeout;
+ u8 issue_reset;
+ u32 sz, sz_arg;
+ void *psge;
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 2145a70dac691..4ee92f7ca20bd 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -1223,7 +1223,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ if (!of_match_node(bcm_qspi_of_match, dev->of_node))
+ return -ENODEV;
+
+- master = spi_alloc_master(dev, sizeof(struct bcm_qspi));
++ master = devm_spi_alloc_master(dev, sizeof(struct bcm_qspi));
+ if (!master) {
+ dev_err(dev, "error allocating spi_master\n");
+ return -ENOMEM;
+@@ -1257,21 +1257,17 @@ int bcm_qspi_probe(struct platform_device *pdev,
+
+ if (res) {
+ qspi->base[MSPI] = devm_ioremap_resource(dev, res);
+- if (IS_ERR(qspi->base[MSPI])) {
+- ret = PTR_ERR(qspi->base[MSPI]);
+- goto qspi_resource_err;
+- }
++ if (IS_ERR(qspi->base[MSPI]))
++ return PTR_ERR(qspi->base[MSPI]);
+ } else {
+- goto qspi_resource_err;
++ return 0;
+ }
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
+ if (res) {
+ qspi->base[BSPI] = devm_ioremap_resource(dev, res);
+- if (IS_ERR(qspi->base[BSPI])) {
+- ret = PTR_ERR(qspi->base[BSPI]);
+- goto qspi_resource_err;
+- }
++ if (IS_ERR(qspi->base[BSPI]))
++ return PTR_ERR(qspi->base[BSPI]);
+ qspi->bspi_mode = true;
+ } else {
+ qspi->bspi_mode = false;
+@@ -1282,18 +1278,14 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "cs_reg");
+ if (res) {
+ qspi->base[CHIP_SELECT] = devm_ioremap_resource(dev, res);
+- if (IS_ERR(qspi->base[CHIP_SELECT])) {
+- ret = PTR_ERR(qspi->base[CHIP_SELECT]);
+- goto qspi_resource_err;
+- }
++ if (IS_ERR(qspi->base[CHIP_SELECT]))
++ return PTR_ERR(qspi->base[CHIP_SELECT]);
+ }
+
+ qspi->dev_ids = kcalloc(num_irqs, sizeof(struct bcm_qspi_dev_id),
+ GFP_KERNEL);
+- if (!qspi->dev_ids) {
+- ret = -ENOMEM;
+- goto qspi_resource_err;
+- }
++ if (!qspi->dev_ids)
++ return -ENOMEM;
+
+ for (val = 0; val < num_irqs; val++) {
+ irq = -1;
+@@ -1369,7 +1361,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ qspi->xfer_mode.addrlen = -1;
+ qspi->xfer_mode.hp = -1;
+
+- ret = devm_spi_register_master(&pdev->dev, master);
++ ret = spi_register_master(master);
+ if (ret < 0) {
+ dev_err(dev, "can't register master\n");
+ goto qspi_reg_err;
+@@ -1382,8 +1374,6 @@ qspi_reg_err:
+ clk_disable_unprepare(qspi->clk);
+ qspi_probe_err:
+ kfree(qspi->dev_ids);
+-qspi_resource_err:
+- spi_master_put(master);
+ return ret;
+ }
+ /* probe function to be called by SoC specific platform driver probe */
+@@ -1393,10 +1383,10 @@ int bcm_qspi_remove(struct platform_device *pdev)
+ {
+ struct bcm_qspi *qspi = platform_get_drvdata(pdev);
+
++ spi_unregister_master(qspi->master);
+ bcm_qspi_hw_uninit(qspi);
+ clk_disable_unprepare(qspi->clk);
+ kfree(qspi->dev_ids);
+- spi_unregister_master(qspi->master);
+
+ return 0;
+ }
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index df6abc75bc167..6824beae18e4a 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -737,7 +737,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
+ struct resource *res;
+ int err;
+
+- master = spi_alloc_master(&pdev->dev, sizeof(*bs));
++ master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
+ if (!master) {
+ dev_err(&pdev->dev, "spi_alloc_master() failed\n");
+ return -ENOMEM;
+@@ -759,23 +759,20 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ bs->regs = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(bs->regs)) {
+- err = PTR_ERR(bs->regs);
+- goto out_master_put;
+- }
++ if (IS_ERR(bs->regs))
++ return PTR_ERR(bs->regs);
+
+ bs->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(bs->clk)) {
+ err = PTR_ERR(bs->clk);
+ dev_err(&pdev->dev, "could not get clk: %d\n", err);
+- goto out_master_put;
++ return err;
+ }
+
+ bs->irq = platform_get_irq(pdev, 0);
+ if (bs->irq <= 0) {
+ dev_err(&pdev->dev, "could not get IRQ: %d\n", bs->irq);
+- err = bs->irq ? bs->irq : -ENODEV;
+- goto out_master_put;
++ return bs->irq ? bs->irq : -ENODEV;
+ }
+
+ clk_prepare_enable(bs->clk);
+@@ -790,21 +787,20 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
+ dev_name(&pdev->dev), master);
+ if (err) {
+ dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
+- goto out_clk_disable;
++ goto out_dma_release;
+ }
+
+ err = spi_register_master(master);
+ if (err) {
+ dev_err(&pdev->dev, "could not register SPI master: %d\n", err);
+- goto out_clk_disable;
++ goto out_dma_release;
+ }
+
+ return 0;
+
+-out_clk_disable:
++out_dma_release:
++ bcm2835_dma_release(master);
+ clk_disable_unprepare(bs->clk);
+-out_master_put:
+- spi_master_put(master);
+ return err;
+ }
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 1fd529a2d2f6b..fbc5444bd9cbd 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2050,6 +2050,49 @@ struct spi_controller *__spi_alloc_controller(struct device *dev,
+ }
+ EXPORT_SYMBOL_GPL(__spi_alloc_controller);
+
++static void devm_spi_release_controller(struct device *dev, void *ctlr)
++{
++ spi_controller_put(*(struct spi_controller **)ctlr);
++}
++
++/**
++ * __devm_spi_alloc_controller - resource-managed __spi_alloc_controller()
++ * @dev: physical device of SPI controller
++ * @size: how much zeroed driver-private data to allocate
++ * @slave: whether to allocate an SPI master (false) or SPI slave (true)
++ * Context: can sleep
++ *
++ * Allocate an SPI controller and automatically release a reference on it
++ * when @dev is unbound from its driver. Drivers are thus relieved from
++ * having to call spi_controller_put().
++ *
++ * The arguments to this function are identical to __spi_alloc_controller().
++ *
++ * Return: the SPI controller structure on success, else NULL.
++ */
++struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
++ unsigned int size,
++ bool slave)
++{
++ struct spi_controller **ptr, *ctlr;
++
++ ptr = devres_alloc(devm_spi_release_controller, sizeof(*ptr),
++ GFP_KERNEL);
++ if (!ptr)
++ return NULL;
++
++ ctlr = __spi_alloc_controller(dev, size, slave);
++ if (ctlr) {
++ *ptr = ctlr;
++ devres_add(dev, ptr);
++ } else {
++ devres_free(ptr);
++ }
++
++ return ctlr;
++}
++EXPORT_SYMBOL_GPL(__devm_spi_alloc_controller);
++
+ #ifdef CONFIG_OF
+ static int of_spi_register_master(struct spi_controller *ctlr)
+ {
+@@ -2300,6 +2343,11 @@ int devm_spi_register_controller(struct device *dev,
+ }
+ EXPORT_SYMBOL_GPL(devm_spi_register_controller);
+
++static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr)
++{
++ return *(struct spi_controller **)res == ctlr;
++}
++
+ static int __unregister(struct device *dev, void *null)
+ {
+ spi_unregister_device(to_spi_device(dev));
+@@ -2341,7 +2389,15 @@ void spi_unregister_controller(struct spi_controller *ctlr)
+ list_del(&ctlr->list);
+ mutex_unlock(&board_lock);
+
+- device_unregister(&ctlr->dev);
++ device_del(&ctlr->dev);
++
++ /* Release the last reference on the controller if its driver
++ * has not yet been converted to devm_spi_alloc_master/slave().
++ */
++ if (!devres_find(ctlr->dev.parent, devm_spi_release_controller,
++ devm_spi_match_controller, ctlr))
++ put_device(&ctlr->dev);
++
+ /* free bus id */
+ mutex_lock(&board_lock);
+ if (found == ctlr)
+diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c
+index 6c754ddf12571..5c282e8522fb3 100644
+--- a/drivers/staging/speakup/spk_ttyio.c
++++ b/drivers/staging/speakup/spk_ttyio.c
+@@ -47,27 +47,20 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty)
+ {
+ struct spk_ldisc_data *ldisc_data;
+
++ if (tty != speakup_tty)
++ /* Somebody tried to use this line discipline outside speakup */
++ return -ENODEV;
++
+ if (tty->ops->write == NULL)
+ return -EOPNOTSUPP;
+
+- mutex_lock(&speakup_tty_mutex);
+- if (speakup_tty) {
+- mutex_unlock(&speakup_tty_mutex);
+- return -EBUSY;
+- }
+- speakup_tty = tty;
+-
+ ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL);
+- if (!ldisc_data) {
+- speakup_tty = NULL;
+- mutex_unlock(&speakup_tty_mutex);
++ if (!ldisc_data)
+ return -ENOMEM;
+- }
+
+ sema_init(&ldisc_data->sem, 0);
+ ldisc_data->buf_free = true;
+- speakup_tty->disc_data = ldisc_data;
+- mutex_unlock(&speakup_tty_mutex);
++ tty->disc_data = ldisc_data;
+
+ return 0;
+ }
+@@ -187,9 +180,25 @@ static int spk_ttyio_initialise_ldisc(struct spk_synth *synth)
+
+ tty_unlock(tty);
+
++ mutex_lock(&speakup_tty_mutex);
++ speakup_tty = tty;
+ ret = tty_set_ldisc(tty, N_SPEAKUP);
+ if (ret)
+- pr_err("speakup: Failed to set N_SPEAKUP on tty\n");
++ speakup_tty = NULL;
++ mutex_unlock(&speakup_tty_mutex);
++
++ if (!ret)
++ /* Success */
++ return 0;
++
++ pr_err("speakup: Failed to set N_SPEAKUP on tty\n");
++
++ tty_lock(tty);
++ if (tty->ops->close)
++ tty->ops->close(tty, NULL);
++ tty_unlock(tty);
++
++ tty_kclose(tty);
+
+ return ret;
+ }
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index ac8025cd4a1fe..ff6a360eef1ed 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2747,10 +2747,14 @@ void __do_SAK(struct tty_struct *tty)
+ struct task_struct *g, *p;
+ struct pid *session;
+ int i;
++ unsigned long flags;
+
+ if (!tty)
+ return;
+- session = tty->session;
++
++ spin_lock_irqsave(&tty->ctrl_lock, flags);
++ session = get_pid(tty->session);
++ spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+
+ tty_ldisc_flush(tty);
+
+@@ -2782,6 +2786,7 @@ void __do_SAK(struct tty_struct *tty)
+ task_unlock(p);
+ } while_each_thread(g, p);
+ read_unlock(&tasklist_lock);
++ put_pid(session);
+ #endif
+ }
+
+diff --git a/drivers/tty/tty_jobctrl.c b/drivers/tty/tty_jobctrl.c
+index c4ecd66fafefd..ffcab80ba77d9 100644
+--- a/drivers/tty/tty_jobctrl.c
++++ b/drivers/tty/tty_jobctrl.c
+@@ -103,8 +103,8 @@ static void __proc_set_tty(struct tty_struct *tty)
+ put_pid(tty->session);
+ put_pid(tty->pgrp);
+ tty->pgrp = get_pid(task_pgrp(current));
+- spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+ tty->session = get_pid(task_session(current));
++ spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+ if (current->signal->tty) {
+ tty_debug(tty, "current tty %s not NULL!!\n",
+ current->signal->tty->name);
+@@ -293,20 +293,23 @@ void disassociate_ctty(int on_exit)
+ spin_lock_irq(¤t->sighand->siglock);
+ put_pid(current->signal->tty_old_pgrp);
+ current->signal->tty_old_pgrp = NULL;
+-
+ tty = tty_kref_get(current->signal->tty);
++ spin_unlock_irq(¤t->sighand->siglock);
++
+ if (tty) {
+ unsigned long flags;
++
++ tty_lock(tty);
+ spin_lock_irqsave(&tty->ctrl_lock, flags);
+ put_pid(tty->session);
+ put_pid(tty->pgrp);
+ tty->session = NULL;
+ tty->pgrp = NULL;
+ spin_unlock_irqrestore(&tty->ctrl_lock, flags);
++ tty_unlock(tty);
+ tty_kref_put(tty);
+ }
+
+- spin_unlock_irq(¤t->sighand->siglock);
+ /* Now clear signal->tty under the lock */
+ read_lock(&tasklist_lock);
+ session_clear_tty(task_session(current));
+@@ -477,14 +480,19 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
+ return -ENOTTY;
+ if (retval)
+ return retval;
+- if (!current->signal->tty ||
+- (current->signal->tty != real_tty) ||
+- (real_tty->session != task_session(current)))
+- return -ENOTTY;
++
+ if (get_user(pgrp_nr, p))
+ return -EFAULT;
+ if (pgrp_nr < 0)
+ return -EINVAL;
++
++ spin_lock_irq(&real_tty->ctrl_lock);
++ if (!current->signal->tty ||
++ (current->signal->tty != real_tty) ||
++ (real_tty->session != task_session(current))) {
++ retval = -ENOTTY;
++ goto out_unlock_ctrl;
++ }
+ rcu_read_lock();
+ pgrp = find_vpid(pgrp_nr);
+ retval = -ESRCH;
+@@ -494,12 +502,12 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
+ if (session_of_pgrp(pgrp) != task_session(current))
+ goto out_unlock;
+ retval = 0;
+- spin_lock_irq(&tty->ctrl_lock);
+ put_pid(real_tty->pgrp);
+ real_tty->pgrp = get_pid(pgrp);
+- spin_unlock_irq(&tty->ctrl_lock);
+ out_unlock:
+ rcu_read_unlock();
++out_unlock_ctrl:
++ spin_unlock_irq(&real_tty->ctrl_lock);
+ return retval;
+ }
+
+@@ -511,20 +519,30 @@ out_unlock:
+ *
+ * Obtain the session id of the tty. If there is no session
+ * return an error.
+- *
+- * Locking: none. Reference to current->signal->tty is safe.
+ */
+ static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
+ {
++ unsigned long flags;
++ pid_t sid;
++
+ /*
+ * (tty == real_tty) is a cheap way of
+ * testing if the tty is NOT a master pty.
+ */
+ if (tty == real_tty && current->signal->tty != real_tty)
+ return -ENOTTY;
++
++ spin_lock_irqsave(&real_tty->ctrl_lock, flags);
+ if (!real_tty->session)
+- return -ENOTTY;
+- return put_user(pid_vnr(real_tty->session), p);
++ goto err;
++ sid = pid_vnr(real_tty->session);
++ spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
++
++ return put_user(sid, p);
++
++err:
++ spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
++ return -ENOTTY;
+ }
+
+ /*
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 11a501d0664cc..bb2edfc77627b 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1243,7 +1243,7 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ case FUNCTIONFS_ENDPOINT_DESC:
+ {
+ int desc_idx;
+- struct usb_endpoint_descriptor *desc;
++ struct usb_endpoint_descriptor desc1, *desc;
+
+ switch (epfile->ffs->gadget->speed) {
+ case USB_SPEED_SUPER:
+@@ -1255,10 +1255,12 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ default:
+ desc_idx = 0;
+ }
++
+ desc = epfile->ep->descs[desc_idx];
++ memcpy(&desc1, desc, desc->bLength);
+
+ spin_unlock_irq(&epfile->ffs->eps_lock);
+- ret = copy_to_user((void __user *)value, desc, desc->bLength);
++ ret = copy_to_user((void __user *)value, &desc1, desc1.bLength);
+ if (ret)
+ ret = -EFAULT;
+ return ret;
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index efadf2f6afa1c..c6bdf533016a5 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -80,10 +80,11 @@
+ #define CH341_LCR_CS5 0x00
+
+ static const struct usb_device_id id_table[] = {
+- { USB_DEVICE(0x4348, 0x5523) },
++ { USB_DEVICE(0x1a86, 0x5512) },
++ { USB_DEVICE(0x1a86, 0x5523) },
+ { USB_DEVICE(0x1a86, 0x7522) },
+ { USB_DEVICE(0x1a86, 0x7523) },
+- { USB_DEVICE(0x1a86, 0x5523) },
++ { USB_DEVICE(0x4348, 0x5523) },
+ { },
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
+index 5ee48b0650c45..5f6b82ebccc5a 100644
+--- a/drivers/usb/serial/kl5kusb105.c
++++ b/drivers/usb/serial/kl5kusb105.c
+@@ -276,12 +276,12 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
+ priv->cfg.unknown2 = cfg->unknown2;
+ spin_unlock_irqrestore(&priv->lock, flags);
+
++ kfree(cfg);
++
+ /* READ_ON and urb submission */
+ rc = usb_serial_generic_open(tty, port);
+- if (rc) {
+- retval = rc;
+- goto err_free_cfg;
+- }
++ if (rc)
++ return rc;
+
+ rc = usb_control_msg(port->serial->dev,
+ usb_sndctrlpipe(port->serial->dev, 0),
+@@ -324,8 +324,6 @@ err_disable_read:
+ KLSI_TIMEOUT);
+ err_generic_close:
+ usb_serial_generic_close(port);
+-err_free_cfg:
+- kfree(cfg);
+
+ return retval;
+ }
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index f28344f03141d..73cd2f8f0f65a 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -419,6 +419,7 @@ static void option_instat_callback(struct urb *urb);
+ #define CINTERION_PRODUCT_PH8 0x0053
+ #define CINTERION_PRODUCT_AHXX 0x0055
+ #define CINTERION_PRODUCT_PLXX 0x0060
++#define CINTERION_PRODUCT_EXS82 0x006c
+ #define CINTERION_PRODUCT_PH8_2RMNET 0x0082
+ #define CINTERION_PRODUCT_PH8_AUDIO 0x0083
+ #define CINTERION_PRODUCT_AHXX_2RMNET 0x0084
+@@ -1105,9 +1106,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0xff, 0xff),
+ .driver_info = NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0, 0) },
+- { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96, 0xff, 0xff, 0xff),
+- .driver_info = NUMEP2 },
+- { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96, 0xff, 0, 0) },
++ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
++ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
+@@ -1902,6 +1902,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) },
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_CLS8, 0xff),
+ .driver_info = RSVD(0) | RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EXS82, 0xff) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
+ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
+@@ -2046,12 +2047,13 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+ { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */
+ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+- { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */
++ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */
+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+ { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */
+ .driver_info = RSVD(4) | RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */
+ .driver_info = RSVD(6) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 6335ca143292f..6285085195c15 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -777,6 +777,8 @@ static void clean_demultiplex_info(struct TCP_Server_Info *server)
+ list_del_init(&server->tcp_ses_list);
+ spin_unlock(&cifs_tcp_ses_lock);
+
++ cancel_delayed_work_sync(&server->echo);
++
+ spin_lock(&GlobalMid_Lock);
+ server->tcpStatus = CifsExiting;
+ spin_unlock(&GlobalMid_Lock);
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index de9b561b1c385..054fdfd4fb8b3 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1009,6 +1009,10 @@ static int gfs2_ri_update(struct gfs2_inode *ip)
+ if (error < 0)
+ return error;
+
++ if (RB_EMPTY_ROOT(&sdp->sd_rindex_tree)) {
++ fs_err(sdp, "no resource groups found in the file system.\n");
++ return -ENOENT;
++ }
+ set_rgrp_preferences(sdp);
+
+ sdp->sd_rindex_uptodate = 1;
+diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
+index a64235e053216..8ceba9b8e51e3 100644
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -634,6 +634,25 @@ static inline struct spi_controller *spi_alloc_slave(struct device *host,
+ return __spi_alloc_controller(host, size, true);
+ }
+
++struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
++ unsigned int size,
++ bool slave);
++
++static inline struct spi_controller *devm_spi_alloc_master(struct device *dev,
++ unsigned int size)
++{
++ return __devm_spi_alloc_controller(dev, size, false);
++}
++
++static inline struct spi_controller *devm_spi_alloc_slave(struct device *dev,
++ unsigned int size)
++{
++ if (!IS_ENABLED(CONFIG_SPI_SLAVE))
++ return NULL;
++
++ return __devm_spi_alloc_controller(dev, size, true);
++}
++
+ extern int spi_register_controller(struct spi_controller *ctlr);
+ extern int devm_spi_register_controller(struct device *dev,
+ struct spi_controller *ctlr);
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index 74226a8f919c1..d808ab9c9aff2 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -306,6 +306,10 @@ struct tty_struct {
+ struct termiox *termiox; /* May be NULL for unsupported */
+ char name[64];
+ struct pid *pgrp; /* Protected by ctrl lock */
++ /*
++ * Writes protected by both ctrl lock and legacy mutex, readers must use
++ * at least one of them.
++ */
+ struct pid *session;
+ unsigned long flags;
+ int count;
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 992d48774c9e9..cce526755471f 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1650,6 +1650,8 @@ static bool test_rec_ops_needs_regs(struct dyn_ftrace *rec)
+ static struct ftrace_ops *
+ ftrace_find_tramp_ops_any(struct dyn_ftrace *rec);
+ static struct ftrace_ops *
++ftrace_find_tramp_ops_any_other(struct dyn_ftrace *rec, struct ftrace_ops *op_exclude);
++static struct ftrace_ops *
+ ftrace_find_tramp_ops_next(struct dyn_ftrace *rec, struct ftrace_ops *ops);
+
+ static bool __ftrace_hash_rec_update(struct ftrace_ops *ops,
+@@ -1787,7 +1789,7 @@ static bool __ftrace_hash_rec_update(struct ftrace_ops *ops,
+ * to it.
+ */
+ if (ftrace_rec_count(rec) == 1 &&
+- ftrace_find_tramp_ops_any(rec))
++ ftrace_find_tramp_ops_any_other(rec, ops))
+ rec->flags |= FTRACE_FL_TRAMP;
+ else
+ rec->flags &= ~FTRACE_FL_TRAMP;
+@@ -2215,6 +2217,24 @@ ftrace_find_tramp_ops_any(struct dyn_ftrace *rec)
+ return NULL;
+ }
+
++static struct ftrace_ops *
++ftrace_find_tramp_ops_any_other(struct dyn_ftrace *rec, struct ftrace_ops *op_exclude)
++{
++ struct ftrace_ops *op;
++ unsigned long ip = rec->ip;
++
++ do_for_each_ftrace_op(op, ftrace_ops_list) {
++
++ if (op == op_exclude || !op->trampoline)
++ continue;
++
++ if (hash_contains_ip(ip, op->func_hash))
++ return op;
++ } while_for_each_ftrace_op(op);
++
++ return NULL;
++}
++
+ static struct ftrace_ops *
+ ftrace_find_tramp_ops_next(struct dyn_ftrace *rec,
+ struct ftrace_ops *op)
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index c3cc6aaa6f79d..d6f1e305bb3db 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2416,7 +2416,7 @@ void trace_buffer_unlock_commit_regs(struct trace_array *tr,
+ * two. They are not that meaningful.
+ */
+ ftrace_trace_stack(tr, buffer, flags, regs ? 0 : STACK_SKIP, pc, regs);
+- ftrace_trace_userstack(buffer, flags, pc);
++ ftrace_trace_userstack(tr, buffer, flags, pc);
+ }
+
+ /*
+@@ -2736,14 +2736,15 @@ void trace_dump_stack(int skip)
+ static DEFINE_PER_CPU(int, user_stack_count);
+
+ void
+-ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
++ftrace_trace_userstack(struct trace_array *tr,
++ struct ring_buffer *buffer, unsigned long flags, int pc)
+ {
+ struct trace_event_call *call = &event_user_stack;
+ struct ring_buffer_event *event;
+ struct userstack_entry *entry;
+ struct stack_trace trace;
+
+- if (!(global_trace.trace_flags & TRACE_ITER_USERSTACKTRACE))
++ if (!(tr->trace_flags & TRACE_ITER_USERSTACKTRACE))
+ return;
+
+ /*
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 01475411fd1b2..afaeef6c15b30 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -745,13 +745,15 @@ void update_max_tr_single(struct trace_array *tr,
+ #endif /* CONFIG_TRACER_MAX_TRACE */
+
+ #ifdef CONFIG_STACKTRACE
+-void ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags,
++void ftrace_trace_userstack(struct trace_array *tr,
++ struct ring_buffer *buffer, unsigned long flags,
+ int pc);
+
+ void __trace_stack(struct trace_array *tr, unsigned long flags, int skip,
+ int pc);
+ #else
+-static inline void ftrace_trace_userstack(struct ring_buffer *buffer,
++static inline void ftrace_trace_userstack(struct trace_array *tr,
++ struct ring_buffer *buffer,
+ unsigned long flags, int pc)
+ {
+ }
+diff --git a/mm/list_lru.c b/mm/list_lru.c
+index 758653dd14431..f7d2ffc209fbd 100644
+--- a/mm/list_lru.c
++++ b/mm/list_lru.c
+@@ -542,7 +542,6 @@ static void memcg_drain_list_lru_node(struct list_lru *lru, int nid,
+ struct list_lru_node *nlru = &lru->node[nid];
+ int dst_idx = dst_memcg->kmemcg_id;
+ struct list_lru_one *src, *dst;
+- bool set;
+
+ /*
+ * Since list_lru_{add,del} may be called under an IRQ-safe lock,
+@@ -554,11 +553,12 @@ static void memcg_drain_list_lru_node(struct list_lru *lru, int nid,
+ dst = list_lru_from_memcg_idx(nlru, dst_idx);
+
+ list_splice_init(&src->list, &dst->list);
+- set = (!dst->nr_items && src->nr_items);
+- dst->nr_items += src->nr_items;
+- if (set)
++
++ if (src->nr_items) {
++ dst->nr_items += src->nr_items;
+ memcg_set_shrinker_bit(dst_memcg, nid, lru_shrinker_id(lru));
+- src->nr_items = 0;
++ src->nr_items = 0;
++ }
+
+ spin_unlock_irq(&nlru->lock);
+ }
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index adeb49fcad23e..130e2e41a48ce 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2825,6 +2825,7 @@ late_initcall(max_swapfiles_check);
+ static struct swap_info_struct *alloc_swap_info(void)
+ {
+ struct swap_info_struct *p;
++ struct swap_info_struct *defer = NULL;
+ unsigned int type;
+ int i;
+ int size = sizeof(*p) + nr_node_ids * sizeof(struct plist_node);
+@@ -2854,7 +2855,7 @@ static struct swap_info_struct *alloc_swap_info(void)
+ smp_wmb();
+ WRITE_ONCE(nr_swapfiles, nr_swapfiles + 1);
+ } else {
+- kvfree(p);
++ defer = p;
+ p = swap_info[type];
+ /*
+ * Do not memset this entry: a racing procfs swap_next()
+@@ -2867,6 +2868,7 @@ static struct swap_info_struct *alloc_swap_info(void)
+ plist_node_init(&p->avail_lists[i], 0);
+ p->flags = SWP_USED;
+ spin_unlock(&swap_lock);
++ kvfree(defer);
+ spin_lock_init(&p->lock);
+ spin_lock_init(&p->cont_lock);
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 5b4632826dc66..9cc8e92f4b000 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -532,7 +532,8 @@ static void nft_request_module(struct net *net, const char *fmt, ...)
+ static void lockdep_nfnl_nft_mutex_not_held(void)
+ {
+ #ifdef CONFIG_PROVE_LOCKING
+- WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
++ if (debug_locks)
++ WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
+ #endif
+ }
+
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 97adb7e340f99..0a196be90b2e5 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -1376,16 +1376,20 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,
+ struct nid_path *path;
+ hda_nid_t pin = pins[i];
+
+- path = snd_hda_get_path_from_idx(codec, path_idx[i]);
+- if (path) {
+- badness += assign_out_path_ctls(codec, path);
+- continue;
++ if (!spec->obey_preferred_dacs) {
++ path = snd_hda_get_path_from_idx(codec, path_idx[i]);
++ if (path) {
++ badness += assign_out_path_ctls(codec, path);
++ continue;
++ }
+ }
+
+ dacs[i] = get_preferred_dac(codec, pin);
+ if (dacs[i]) {
+ if (is_dac_already_used(codec, dacs[i]))
+ badness += bad->shared_primary;
++ } else if (spec->obey_preferred_dacs) {
++ badness += BAD_NO_PRIMARY_DAC;
+ }
+
+ if (!dacs[i])
+diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
+index 8933c0f64cc4a..2ccdd92c8c7fd 100644
+--- a/sound/pci/hda/hda_generic.h
++++ b/sound/pci/hda/hda_generic.h
+@@ -240,6 +240,7 @@ struct hda_gen_spec {
+ unsigned int power_down_unused:1; /* power down unused widgets */
+ unsigned int dac_min_mute:1; /* minimal = mute for DACs */
+ unsigned int suppress_vmaster:1; /* don't create vmaster kctls */
++ unsigned int obey_preferred_dacs:1; /* obey preferred_dacs assignment */
+
+ /* other internal flags */
+ unsigned int no_analog:1; /* digital I/O only */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 935ca7989cfd5..790a2e79aba54 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -439,6 +439,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ alc_update_coef_idx(codec, 0x7, 1<<5, 0);
+ break;
+ case 0x10ec0892:
++ case 0x10ec0897:
+ alc_update_coef_idx(codec, 0x7, 1<<5, 0);
+ break;
+ case 0x10ec0899:
+@@ -7068,6 +7069,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
+ SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360),
++ SND_PCI_QUIRK(0x103c, 0x827f, "HP x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+@@ -7777,6 +7779,9 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC292_STANDARD_PINS,
+ {0x13, 0x90a60140}),
++ SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_HPE,
++ {0x17, 0x90170110},
++ {0x21, 0x04211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_MIC,
+ {0x14, 0x90170110},
+ {0x1b, 0x90a70130},
+@@ -9162,6 +9167,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ HDA_CODEC_ENTRY(0x10ec0888, "ALC888", patch_alc882),
+ HDA_CODEC_ENTRY(0x10ec0889, "ALC889", patch_alc882),
+ HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662),
++ HDA_CODEC_ENTRY(0x10ec0897, "ALC897", patch_alc662),
+ HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882),
+ HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882),
+ HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882),
+diff --git a/tools/objtool/arch/x86/include/asm/insn.h b/tools/objtool/arch/x86/include/asm/insn.h
+index c2c01f84df75f..3e0e18d376d2c 100644
+--- a/tools/objtool/arch/x86/include/asm/insn.h
++++ b/tools/objtool/arch/x86/include/asm/insn.h
+@@ -208,6 +208,21 @@ static inline int insn_offset_immediate(struct insn *insn)
+ return insn_offset_displacement(insn) + insn->displacement.nbytes;
+ }
+
++/**
++ * for_each_insn_prefix() -- Iterate prefixes in the instruction
++ * @insn: Pointer to struct insn.
++ * @idx: Index storage.
++ * @prefix: Prefix byte.
++ *
++ * Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix
++ * and the index is stored in @idx (note that this @idx is just for a cursor,
++ * do not change it.)
++ * Since prefixes.nbytes can be bigger than 4 if some prefixes
++ * are repeated, it cannot be used for looping over the prefixes.
++ */
++#define for_each_insn_prefix(insn, idx, prefix) \
++ for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = insn->prefixes.bytes[idx]) != 0; idx++)
++
+ #define POP_SS_OPCODE 0x1f
+ #define MOV_SREG_OPCODE 0x8e
+
+diff --git a/tools/perf/util/intel-pt-decoder/insn.h b/tools/perf/util/intel-pt-decoder/insn.h
+index 2669c9f748e4d..1a01d0a41ab8e 100644
+--- a/tools/perf/util/intel-pt-decoder/insn.h
++++ b/tools/perf/util/intel-pt-decoder/insn.h
+@@ -208,6 +208,21 @@ static inline int insn_offset_immediate(struct insn *insn)
+ return insn_offset_displacement(insn) + insn->displacement.nbytes;
+ }
+
++/**
++ * for_each_insn_prefix() -- Iterate prefixes in the instruction
++ * @insn: Pointer to struct insn.
++ * @idx: Index storage.
++ * @prefix: Prefix byte.
++ *
++ * Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix
++ * and the index is stored in @idx (note that this @idx is just for a cursor,
++ * do not change it.)
++ * Since prefixes.nbytes can be bigger than 4 if some prefixes
++ * are repeated, it cannot be used for looping over the prefixes.
++ */
++#define for_each_insn_prefix(insn, idx, prefix) \
++ for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = insn->prefixes.bytes[idx]) != 0; idx++)
++
+ #define POP_SS_OPCODE 0x1f
+ #define MOV_SREG_OPCODE 0x8e
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2020-12-30 12:52 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2020-12-30 12:52 UTC (permalink / raw
To: gentoo-commits
commit: 69d400b9dc2731690a4900bf1099f8e6426c7e7a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 30 12:51:46 2020 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 30 12:51:46 2020 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=69d400b9
Linux patch 4.19.164
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1163_linux-4.19.164.patch | 9937 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 9941 insertions(+)
diff --git a/0000_README b/0000_README
index e1c0627..5ffa36c 100644
--- a/0000_README
+++ b/0000_README
@@ -691,6 +691,10 @@ Patch: 1162_linux-4.19.163.patch
From: https://www.kernel.org
Desc: Linux 4.19.163
+Patch: 1163_linux-4.19.164.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.164
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1163_linux-4.19.164.patch b/1163_linux-4.19.164.patch
new file mode 100644
index 0000000..581268c
--- /dev/null
+++ b/1163_linux-4.19.164.patch
@@ -0,0 +1,9937 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 7371643dd8d4f..558332df02a84 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -4998,6 +4998,7 @@
+ device);
+ j = NO_REPORT_LUNS (don't use report luns
+ command, uas only);
++ k = NO_SAME (do not use WRITE_SAME, uas only)
+ l = NOT_LOCKABLE (don't try to lock and
+ unlock ejectable media, not on uas);
+ m = MAX_SECTORS_64 (don't transfer more
+diff --git a/Makefile b/Makefile
+index b651d77eb2df9..d02af6881a5fe 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 163
++SUBLEVEL = 164
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -745,8 +745,11 @@ KBUILD_CFLAGS += $(call cc-option, -gsplit-dwarf, -g)
+ else
+ KBUILD_CFLAGS += -g
+ endif
++ifneq ($(LLVM_IAS),1)
+ KBUILD_AFLAGS += -Wa,-gdwarf-2
+ endif
++endif
++
+ ifdef CONFIG_DEBUG_INFO_DWARF4
+ KBUILD_CFLAGS += $(call cc-option, -gdwarf-4,)
+ endif
+diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
+index 0fed32b959232..a211e87aa6d93 100644
+--- a/arch/arc/kernel/stacktrace.c
++++ b/arch/arc/kernel/stacktrace.c
+@@ -41,15 +41,15 @@
+
+ #ifdef CONFIG_ARC_DW2_UNWIND
+
+-static void seed_unwind_frame_info(struct task_struct *tsk,
+- struct pt_regs *regs,
+- struct unwind_frame_info *frame_info)
++static int
++seed_unwind_frame_info(struct task_struct *tsk, struct pt_regs *regs,
++ struct unwind_frame_info *frame_info)
+ {
+ /*
+ * synchronous unwinding (e.g. dump_stack)
+ * - uses current values of SP and friends
+ */
+- if (tsk == NULL && regs == NULL) {
++ if (regs == NULL && (tsk == NULL || tsk == current)) {
+ unsigned long fp, sp, blink, ret;
+ frame_info->task = current;
+
+@@ -68,11 +68,15 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
+ frame_info->call_frame = 0;
+ } else if (regs == NULL) {
+ /*
+- * Asynchronous unwinding of sleeping task
+- * - Gets SP etc from task's pt_regs (saved bottom of kernel
+- * mode stack of task)
++ * Asynchronous unwinding of a likely sleeping task
++ * - first ensure it is actually sleeping
++ * - if so, it will be in __switch_to, kernel mode SP of task
++ * is safe-kept and BLINK at a well known location in there
+ */
+
++ if (tsk->state == TASK_RUNNING)
++ return -1;
++
+ frame_info->task = tsk;
+
+ frame_info->regs.r27 = TSK_K_FP(tsk);
+@@ -106,6 +110,8 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
+ frame_info->regs.r63 = regs->ret;
+ frame_info->call_frame = 0;
+ }
++
++ return 0;
+ }
+
+ #endif
+@@ -119,7 +125,8 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
+ unsigned int address;
+ struct unwind_frame_info frame_info;
+
+- seed_unwind_frame_info(tsk, regs, &frame_info);
++ if (seed_unwind_frame_info(tsk, regs, &frame_info))
++ return 0;
+
+ while (1) {
+ address = UNW_PC(&frame_info);
+diff --git a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+index 3e7d093d7a9a2..966d9a6c40fca 100644
+--- a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
++++ b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+@@ -266,11 +266,6 @@
+ reg = <0x11000 0x100>;
+ };
+
+-&i2c1 {
+- compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c";
+- reg = <0x11100 0x100>;
+-};
+-
+ &mpic {
+ reg = <0x20a00 0x2d0>, <0x21070 0x58>;
+ };
+diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+index 22dade6393d06..d1dbe3b6ad5a7 100644
+--- a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
++++ b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+@@ -22,9 +22,9 @@
+ #size-cells = <1>;
+ ranges;
+
+- vga_memory: framebuffer@7f000000 {
++ vga_memory: framebuffer@9f000000 {
+ no-map;
+- reg = <0x7f000000 0x01000000>;
++ reg = <0x9f000000 0x01000000>; /* 16M */
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+index 02c1d2958d780..74440dad43354 100644
+--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+@@ -243,6 +243,11 @@
+ atmel,pins =
+ <AT91_PIOE 9 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>; /* PE9, conflicts with A9 */
+ };
++ pinctrl_usb_default: usb_default {
++ atmel,pins =
++ <AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
++ AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
++ };
+ };
+ };
+ };
+@@ -260,6 +265,8 @@
+ &pioE 3 GPIO_ACTIVE_LOW
+ &pioE 4 GPIO_ACTIVE_LOW
+ >;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_usb_default>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+index 7d554b9ab27fd..e998d72d8b107 100644
+--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+@@ -170,6 +170,11 @@
+ atmel,pins =
+ <AT91_PIOE 31 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;
+ };
++ pinctrl_usb_default: usb_default {
++ atmel,pins =
++ <AT91_PIOE 11 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
++ AT91_PIOE 14 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
++ };
+ pinctrl_key_gpio: key_gpio_0 {
+ atmel,pins =
+ <AT91_PIOE 8 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
+@@ -195,6 +200,8 @@
+ &pioE 11 GPIO_ACTIVE_HIGH
+ &pioE 14 GPIO_ACTIVE_HIGH
+ >;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_usb_default>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi
+index ad495f5a5790f..cdf016232fb7d 100644
+--- a/arch/arm/boot/dts/at91sam9rl.dtsi
++++ b/arch/arm/boot/dts/at91sam9rl.dtsi
+@@ -277,23 +277,26 @@
+ atmel,adc-use-res = "highres";
+
+ trigger0 {
+- trigger-name = "timer-counter-0";
++ trigger-name = "external-rising";
+ trigger-value = <0x1>;
++ trigger-external;
+ };
++
+ trigger1 {
+- trigger-name = "timer-counter-1";
+- trigger-value = <0x3>;
++ trigger-name = "external-falling";
++ trigger-value = <0x2>;
++ trigger-external;
+ };
+
+ trigger2 {
+- trigger-name = "timer-counter-2";
+- trigger-value = <0x5>;
++ trigger-name = "external-any";
++ trigger-value = <0x3>;
++ trigger-external;
+ };
+
+ trigger3 {
+- trigger-name = "external";
+- trigger-value = <0x13>;
+- trigger-external;
++ trigger-name = "continuous";
++ trigger-value = <0x6>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/exynos5410-odroidxu.dts b/arch/arm/boot/dts/exynos5410-odroidxu.dts
+index a2046f5f998c1..840a854ee8385 100644
+--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
+@@ -324,6 +324,8 @@
+ regulator-name = "vddq_lcd";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ /* Supplies also GPK and GPJ */
++ regulator-always-on;
+ };
+
+ ldo8_reg: LDO8 {
+@@ -626,11 +628,11 @@
+ };
+
+ &usbdrd_dwc3_0 {
+- dr_mode = "host";
++ dr_mode = "peripheral";
+ };
+
+ &usbdrd_dwc3_1 {
+- dr_mode = "peripheral";
++ dr_mode = "host";
+ };
+
+ &usbdrd3_0 {
+diff --git a/arch/arm/boot/dts/exynos5410-pinctrl.dtsi b/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
+index 369a8a7f21050..481ee99aa9c97 100644
+--- a/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
++++ b/arch/arm/boot/dts/exynos5410-pinctrl.dtsi
+@@ -560,6 +560,34 @@
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
++
++ usb3_1_oc: usb3-1-oc {
++ samsung,pins = "gpk2-4", "gpk2-5";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
++
++ usb3_1_vbusctrl: usb3-1-vbusctrl {
++ samsung,pins = "gpk2-6", "gpk2-7";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
++
++ usb3_0_oc: usb3-0-oc {
++ samsung,pins = "gpk3-0", "gpk3-1";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_UP>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
++
++ usb3_0_vbusctrl: usb3-0-vbusctrl {
++ samsung,pins = "gpk3-2", "gpk3-3";
++ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
++ samsung,pin-pud = <EXYNOS_PIN_PULL_DOWN>;
++ samsung,pin-drv = <EXYNOS5420_PIN_DRV_LV1>;
++ };
+ };
+
+ &pinctrl_2 {
+diff --git a/arch/arm/boot/dts/exynos5410.dtsi b/arch/arm/boot/dts/exynos5410.dtsi
+index 57fc9c949e54a..95b794b1ea62e 100644
+--- a/arch/arm/boot/dts/exynos5410.dtsi
++++ b/arch/arm/boot/dts/exynos5410.dtsi
+@@ -392,6 +392,8 @@
+ &usbdrd3_0 {
+ clocks = <&clock CLK_USBD300>;
+ clock-names = "usbdrd30";
++ pinctrl-names = "default";
++ pinctrl-0 = <&usb3_0_oc>, <&usb3_0_vbusctrl>;
+ };
+
+ &usbdrd_phy0 {
+@@ -403,6 +405,8 @@
+ &usbdrd3_1 {
+ clocks = <&clock CLK_USBD301>;
+ clock-names = "usbdrd30";
++ pinctrl-names = "default";
++ pinctrl-0 = <&usb3_1_oc>, <&usb3_1_vbusctrl>;
+ };
+
+ &usbdrd_dwc3_1 {
+diff --git a/arch/arm/boot/dts/omap4-panda-es.dts b/arch/arm/boot/dts/omap4-panda-es.dts
+index 19d02df8d8a59..70fd28120c275 100644
+--- a/arch/arm/boot/dts/omap4-panda-es.dts
++++ b/arch/arm/boot/dts/omap4-panda-es.dts
+@@ -49,7 +49,7 @@
+
+ button_pins: pinmux_button_pins {
+ pinctrl-single,pins = <
+- OMAP4_IOPAD(0x11b, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_113 */
++ OMAP4_IOPAD(0x0fc, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_113 */
+ >;
+ };
+ };
+diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
+index b405992eb6016..d856c16d00156 100644
+--- a/arch/arm/boot/dts/sama5d2.dtsi
++++ b/arch/arm/boot/dts/sama5d2.dtsi
+@@ -1247,6 +1247,7 @@
+ clocks = <&securam_clk>;
+ #address-cells = <1>;
+ #size-cells = <1>;
++ no-memory-wc;
+ ranges = <0 0xf8044000 0x1420>;
+ };
+
+@@ -1297,7 +1298,7 @@
+
+ can0: can@f8054000 {
+ compatible = "bosch,m_can";
+- reg = <0xf8054000 0x4000>, <0x210000 0x4000>;
++ reg = <0xf8054000 0x4000>, <0x210000 0x1c00>;
+ reg-names = "m_can", "message_ram";
+ interrupts = <56 IRQ_TYPE_LEVEL_HIGH 7>,
+ <64 IRQ_TYPE_LEVEL_HIGH 7>;
+@@ -1490,7 +1491,7 @@
+
+ can1: can@fc050000 {
+ compatible = "bosch,m_can";
+- reg = <0xfc050000 0x4000>, <0x210000 0x4000>;
++ reg = <0xfc050000 0x4000>, <0x210000 0x3800>;
+ reg-names = "m_can", "message_ram";
+ interrupts = <57 IRQ_TYPE_LEVEL_HIGH 7>,
+ <65 IRQ_TYPE_LEVEL_HIGH 7>;
+@@ -1500,7 +1501,7 @@
+ assigned-clocks = <&can1_gclk>;
+ assigned-clock-parents = <&utmi>;
+ assigned-clock-rates = <40000000>;
+- bosch,mram-cfg = <0x1100 0 0 64 0 0 32 32>;
++ bosch,mram-cfg = <0x1c00 0 0 64 0 0 32 32>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi
+index 92fcb756a08a9..97cac6d636923 100644
+--- a/arch/arm/boot/dts/sun8i-v3s.dtsi
++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi
+@@ -419,7 +419,7 @@
+ gic: interrupt-controller@1c81000 {
+ compatible = "arm,cortex-a7-gic", "arm,cortex-a15-gic";
+ reg = <0x01c81000 0x1000>,
+- <0x01c82000 0x1000>,
++ <0x01c82000 0x2000>,
+ <0x01c84000 0x2000>,
+ <0x01c86000 0x2000>;
+ interrupt-controller;
+diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
+index 6b1148cafffdb..90add5ded3f1f 100644
+--- a/arch/arm/kernel/head.S
++++ b/arch/arm/kernel/head.S
+@@ -674,12 +674,8 @@ ARM_BE8(rev16 ip, ip)
+ ldrcc r7, [r4], #4 @ use branch for delay slot
+ bcc 1b
+ bx lr
+-#else
+-#ifdef CONFIG_CPU_ENDIAN_BE8
+- moveq r0, #0x00004000 @ set bit 22, mov to mvn instruction
+ #else
+ moveq r0, #0x400000 @ set bit 22, mov to mvn instruction
+-#endif
+ b 2f
+ 1: ldr ip, [r7, r3]
+ #ifdef CONFIG_CPU_ENDIAN_BE8
+@@ -688,7 +684,7 @@ ARM_BE8(rev16 ip, ip)
+ tst ip, #0x000f0000 @ check the rotation field
+ orrne ip, ip, r6, lsl #24 @ mask in offset bits 31-24
+ biceq ip, ip, #0x00004000 @ clear bit 22
+- orreq ip, ip, r0 @ mask in offset bits 7-0
++ orreq ip, ip, r0, ror #8 @ mask in offset bits 7-0
+ #else
+ bic ip, ip, #0x000000ff
+ tst ip, #0xf00 @ check the rotation field
+diff --git a/arch/arm/mach-shmobile/pm-rmobile.c b/arch/arm/mach-shmobile/pm-rmobile.c
+index e348bcfe389da..cb8b02a1abe26 100644
+--- a/arch/arm/mach-shmobile/pm-rmobile.c
++++ b/arch/arm/mach-shmobile/pm-rmobile.c
+@@ -330,6 +330,7 @@ static int __init rmobile_init_pm_domains(void)
+
+ pmd = of_get_child_by_name(np, "pm-domains");
+ if (!pmd) {
++ iounmap(base);
+ pr_warn("%pOF lacks pm-domains node\n", np);
+ continue;
+ }
+diff --git a/arch/arm/mach-sunxi/sunxi.c b/arch/arm/mach-sunxi/sunxi.c
+index de4b0e932f22e..aa08b8cb01524 100644
+--- a/arch/arm/mach-sunxi/sunxi.c
++++ b/arch/arm/mach-sunxi/sunxi.c
+@@ -66,6 +66,7 @@ static const char * const sun8i_board_dt_compat[] = {
+ "allwinner,sun8i-h2-plus",
+ "allwinner,sun8i-h3",
+ "allwinner,sun8i-r40",
++ "allwinner,sun8i-v3",
+ "allwinner,sun8i-v3s",
+ NULL,
+ };
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+index bdf7c6c5983ce..30fa9302a4dc8 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+@@ -399,7 +399,7 @@
+ #size-cells = <1>;
+ compatible = "winbond,w25q16", "jedec,spi-nor";
+ reg = <0>;
+- spi-max-frequency = <3000000>;
++ spi-max-frequency = <104000000>;
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+index 31b1a606cb664..5c5e57026c275 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+@@ -62,8 +62,10 @@
+ };
+
+ psci {
+- compatible = "arm,psci-0.2";
++ compatible = "arm,psci";
+ method = "smc";
++ cpu_off = <0x84000002>;
++ cpu_on = <0xC4000003>;
+ };
+
+ soc: soc {
+@@ -494,13 +496,6 @@
+ pmu_system_controller: system-controller@105c0000 {
+ compatible = "samsung,exynos7-pmu", "syscon";
+ reg = <0x105c0000 0x5000>;
+-
+- reboot: syscon-reboot {
+- compatible = "syscon-reboot";
+- regmap = <&pmu_system_controller>;
+- offset = <0x0400>;
+- mask = <0x1>;
+- };
+ };
+
+ rtc: rtc@10590000 {
+@@ -638,3 +633,4 @@
+ };
+
+ #include "exynos7-pinctrl.dtsi"
++#include "arm/exynos-syscon-restart.dtsi"
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+index 91061d9cf78bc..5b1ece4a68d67 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+@@ -255,6 +255,7 @@
+ };
+
+ &usb20_otg {
++ dr_mode = "host";
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index 92186edefeb96..6be7c67584ba9 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -1085,8 +1085,8 @@
+
+ uart0 {
+ uart0_xfer: uart0-xfer {
+- rockchip,pins = <1 RK_PB1 1 &pcfg_pull_up>,
+- <1 RK_PB0 1 &pcfg_pull_none>;
++ rockchip,pins = <1 RK_PB1 1 &pcfg_pull_none>,
++ <1 RK_PB0 1 &pcfg_pull_up>;
+ };
+
+ uart0_cts: uart0-cts {
+@@ -1104,8 +1104,8 @@
+
+ uart1 {
+ uart1_xfer: uart1-xfer {
+- rockchip,pins = <3 RK_PA4 4 &pcfg_pull_up>,
+- <3 RK_PA6 4 &pcfg_pull_none>;
++ rockchip,pins = <3 RK_PA4 4 &pcfg_pull_none>,
++ <3 RK_PA6 4 &pcfg_pull_up>;
+ };
+
+ uart1_cts: uart1-cts {
+@@ -1123,15 +1123,15 @@
+
+ uart2-0 {
+ uart2m0_xfer: uart2m0-xfer {
+- rockchip,pins = <1 RK_PA0 2 &pcfg_pull_up>,
+- <1 RK_PA1 2 &pcfg_pull_none>;
++ rockchip,pins = <1 RK_PA0 2 &pcfg_pull_none>,
++ <1 RK_PA1 2 &pcfg_pull_up>;
+ };
+ };
+
+ uart2-1 {
+ uart2m1_xfer: uart2m1-xfer {
+- rockchip,pins = <2 RK_PA0 1 &pcfg_pull_up>,
+- <2 RK_PA1 1 &pcfg_pull_none>;
++ rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>,
++ <2 RK_PA1 1 &pcfg_pull_up>;
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index f14e8c5c41acc..f4ee7c4f83b8b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -29,6 +29,9 @@
+ i2c6 = &i2c6;
+ i2c7 = &i2c7;
+ i2c8 = &i2c8;
++ mmc0 = &sdio0;
++ mmc1 = &sdmmc;
++ mmc2 = &sdhci;
+ serial0 = &uart0;
+ serial1 = &uart1;
+ serial2 = &uart2;
+diff --git a/arch/arm64/include/asm/atomic_lse.h b/arch/arm64/include/asm/atomic_lse.h
+index f9b0b09153e0e..eab3de4f2ad25 100644
+--- a/arch/arm64/include/asm/atomic_lse.h
++++ b/arch/arm64/include/asm/atomic_lse.h
+@@ -32,7 +32,9 @@ static inline void atomic_##op(int i, atomic_t *v) \
+ register int w0 asm ("w0") = i; \
+ register atomic_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN(__LL_SC_ATOMIC(op), \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN(__LL_SC_ATOMIC(op), \
+ " " #asm_op " %w[i], %[v]\n") \
+ : [i] "+r" (w0), [v] "+Q" (v->counter) \
+ : "r" (x1) \
+@@ -52,7 +54,9 @@ static inline int atomic_fetch_##op##name(int i, atomic_t *v) \
+ register int w0 asm ("w0") = i; \
+ register atomic_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_ATOMIC(fetch_##op##name), \
+ /* LSE atomics */ \
+@@ -84,7 +88,9 @@ static inline int atomic_add_return##name(int i, atomic_t *v) \
+ register int w0 asm ("w0") = i; \
+ register atomic_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_ATOMIC(add_return##name) \
+ __nops(1), \
+@@ -110,7 +116,9 @@ static inline void atomic_and(int i, atomic_t *v)
+ register int w0 asm ("w0") = i;
+ register atomic_t *x1 asm ("x1") = v;
+
+- asm volatile(ARM64_LSE_ATOMIC_INSN(
++ asm volatile(
++ __LSE_PREAMBLE
++ ARM64_LSE_ATOMIC_INSN(
+ /* LL/SC */
+ __LL_SC_ATOMIC(and)
+ __nops(1),
+@@ -128,7 +136,9 @@ static inline int atomic_fetch_and##name(int i, atomic_t *v) \
+ register int w0 asm ("w0") = i; \
+ register atomic_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_ATOMIC(fetch_and##name) \
+ __nops(1), \
+@@ -154,7 +164,9 @@ static inline void atomic_sub(int i, atomic_t *v)
+ register int w0 asm ("w0") = i;
+ register atomic_t *x1 asm ("x1") = v;
+
+- asm volatile(ARM64_LSE_ATOMIC_INSN(
++ asm volatile(
++ __LSE_PREAMBLE
++ ARM64_LSE_ATOMIC_INSN(
+ /* LL/SC */
+ __LL_SC_ATOMIC(sub)
+ __nops(1),
+@@ -172,7 +184,9 @@ static inline int atomic_sub_return##name(int i, atomic_t *v) \
+ register int w0 asm ("w0") = i; \
+ register atomic_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_ATOMIC(sub_return##name) \
+ __nops(2), \
+@@ -200,7 +214,9 @@ static inline int atomic_fetch_sub##name(int i, atomic_t *v) \
+ register int w0 asm ("w0") = i; \
+ register atomic_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_ATOMIC(fetch_sub##name) \
+ __nops(1), \
+@@ -229,7 +245,9 @@ static inline void atomic64_##op(long i, atomic64_t *v) \
+ register long x0 asm ("x0") = i; \
+ register atomic64_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN(__LL_SC_ATOMIC64(op), \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN(__LL_SC_ATOMIC64(op), \
+ " " #asm_op " %[i], %[v]\n") \
+ : [i] "+r" (x0), [v] "+Q" (v->counter) \
+ : "r" (x1) \
+@@ -249,7 +267,9 @@ static inline long atomic64_fetch_##op##name(long i, atomic64_t *v) \
+ register long x0 asm ("x0") = i; \
+ register atomic64_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_ATOMIC64(fetch_##op##name), \
+ /* LSE atomics */ \
+@@ -281,7 +301,9 @@ static inline long atomic64_add_return##name(long i, atomic64_t *v) \
+ register long x0 asm ("x0") = i; \
+ register atomic64_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_ATOMIC64(add_return##name) \
+ __nops(1), \
+@@ -307,7 +329,9 @@ static inline void atomic64_and(long i, atomic64_t *v)
+ register long x0 asm ("x0") = i;
+ register atomic64_t *x1 asm ("x1") = v;
+
+- asm volatile(ARM64_LSE_ATOMIC_INSN(
++ asm volatile(
++ __LSE_PREAMBLE
++ ARM64_LSE_ATOMIC_INSN(
+ /* LL/SC */
+ __LL_SC_ATOMIC64(and)
+ __nops(1),
+@@ -325,7 +349,9 @@ static inline long atomic64_fetch_and##name(long i, atomic64_t *v) \
+ register long x0 asm ("x0") = i; \
+ register atomic64_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_ATOMIC64(fetch_and##name) \
+ __nops(1), \
+@@ -351,7 +377,9 @@ static inline void atomic64_sub(long i, atomic64_t *v)
+ register long x0 asm ("x0") = i;
+ register atomic64_t *x1 asm ("x1") = v;
+
+- asm volatile(ARM64_LSE_ATOMIC_INSN(
++ asm volatile(
++ __LSE_PREAMBLE
++ ARM64_LSE_ATOMIC_INSN(
+ /* LL/SC */
+ __LL_SC_ATOMIC64(sub)
+ __nops(1),
+@@ -369,7 +397,9 @@ static inline long atomic64_sub_return##name(long i, atomic64_t *v) \
+ register long x0 asm ("x0") = i; \
+ register atomic64_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_ATOMIC64(sub_return##name) \
+ __nops(2), \
+@@ -397,7 +427,9 @@ static inline long atomic64_fetch_sub##name(long i, atomic64_t *v) \
+ register long x0 asm ("x0") = i; \
+ register atomic64_t *x1 asm ("x1") = v; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_ATOMIC64(fetch_sub##name) \
+ __nops(1), \
+@@ -422,7 +454,9 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
+ {
+ register long x0 asm ("x0") = (long)v;
+
+- asm volatile(ARM64_LSE_ATOMIC_INSN(
++ asm volatile(
++ __LSE_PREAMBLE
++ ARM64_LSE_ATOMIC_INSN(
+ /* LL/SC */
+ __LL_SC_ATOMIC64(dec_if_positive)
+ __nops(6),
+@@ -455,7 +489,9 @@ static inline unsigned long __cmpxchg_case_##name(volatile void *ptr, \
+ register unsigned long x1 asm ("x1") = old; \
+ register unsigned long x2 asm ("x2") = new; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_CMPXCHG(name) \
+ __nops(2), \
+@@ -507,7 +543,9 @@ static inline long __cmpxchg_double##name(unsigned long old1, \
+ register unsigned long x3 asm ("x3") = new2; \
+ register unsigned long x4 asm ("x4") = (unsigned long)ptr; \
+ \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ asm volatile( \
++ __LSE_PREAMBLE \
++ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+ __LL_SC_CMPXCHG_DBL(name) \
+ __nops(3), \
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index c67cae9d52293..151e69a93e341 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -165,6 +165,7 @@ enum vcpu_sysreg {
+ #define c2_TTBR1 (TTBR1_EL1 * 2) /* Translation Table Base Register 1 */
+ #define c2_TTBR1_high (c2_TTBR1 + 1) /* TTBR1 top 32 bits */
+ #define c2_TTBCR (TCR_EL1 * 2) /* Translation Table Base Control R. */
++#define c2_TTBCR2 (c2_TTBCR + 1) /* Translation Table Base Control R. 2 */
+ #define c3_DACR (DACR32_EL2 * 2)/* Domain Access Control Register */
+ #define c5_DFSR (ESR_EL1 * 2) /* Data Fault Status Register */
+ #define c5_IFSR (IFSR32_EL2 * 2)/* Instruction Fault Status Register */
+diff --git a/arch/arm64/include/asm/lse.h b/arch/arm64/include/asm/lse.h
+index 8262325e2fc66..13536c4da2c26 100644
+--- a/arch/arm64/include/asm/lse.h
++++ b/arch/arm64/include/asm/lse.h
+@@ -4,6 +4,8 @@
+
+ #if defined(CONFIG_AS_LSE) && defined(CONFIG_ARM64_LSE_ATOMICS)
+
++#define __LSE_PREAMBLE ".arch_extension lse\n"
++
+ #include <linux/compiler_types.h>
+ #include <linux/export.h>
+ #include <linux/stringify.h>
+@@ -20,8 +22,6 @@
+
+ #else /* __ASSEMBLER__ */
+
+-__asm__(".arch_extension lse");
+-
+ /* Move the ll/sc atomics out-of-line */
+ #define __LL_SC_INLINE notrace
+ #define __LL_SC_PREFIX(x) __ll_sc_##x
+@@ -33,7 +33,7 @@ __asm__(".arch_extension lse");
+
+ /* In-line patching at runtime */
+ #define ARM64_LSE_ATOMIC_INSN(llsc, lse) \
+- ALTERNATIVE(llsc, lse, ARM64_HAS_LSE_ATOMICS)
++ ALTERNATIVE(llsc, __LSE_PREAMBLE lse, ARM64_HAS_LSE_ATOMICS)
+
+ #endif /* __ASSEMBLER__ */
+ #else /* CONFIG_AS_LSE && CONFIG_ARM64_LSE_ATOMICS */
+diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
+index 1457a0ba83dbc..f2d2dbbbfca20 100644
+--- a/arch/arm64/kernel/syscall.c
++++ b/arch/arm64/kernel/syscall.c
+@@ -102,8 +102,8 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
+ regs->syscallno = scno;
+
+ cortex_a76_erratum_1463225_svc_handler();
++ user_exit_irqoff();
+ local_daif_restore(DAIF_PROCCTX);
+- user_exit();
+
+ if (has_syscall_work(flags)) {
+ /* set default errno for user-issued syscall(-1) */
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+index b53d0ebb87fcc..847b2d80ce870 100644
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -1661,6 +1661,7 @@ static const struct sys_reg_desc cp15_regs[] = {
+ { Op1( 0), CRn( 2), CRm( 0), Op2( 0), access_vm_reg, NULL, c2_TTBR0 },
+ { Op1( 0), CRn( 2), CRm( 0), Op2( 1), access_vm_reg, NULL, c2_TTBR1 },
+ { Op1( 0), CRn( 2), CRm( 0), Op2( 2), access_vm_reg, NULL, c2_TTBCR },
++ { Op1( 0), CRn( 2), CRm( 0), Op2( 3), access_vm_reg, NULL, c2_TTBCR2 },
+ { Op1( 0), CRn( 3), CRm( 0), Op2( 0), access_vm_reg, NULL, c3_DACR },
+ { Op1( 0), CRn( 5), CRm( 0), Op2( 0), access_vm_reg, NULL, c5_DFSR },
+ { Op1( 0), CRn( 5), CRm( 0), Op2( 1), access_vm_reg, NULL, c5_IFSR },
+diff --git a/arch/arm64/lib/memcpy.S b/arch/arm64/lib/memcpy.S
+index 67613937711f1..dfedd4ab1a766 100644
+--- a/arch/arm64/lib/memcpy.S
++++ b/arch/arm64/lib/memcpy.S
+@@ -68,9 +68,8 @@
+ stp \ptr, \regB, [\regC], \val
+ .endm
+
+- .weak memcpy
+ ENTRY(__memcpy)
+-ENTRY(memcpy)
++WEAK(memcpy)
+ #include "copy_template.S"
+ ret
+ ENDPIPROC(memcpy)
+diff --git a/arch/arm64/lib/memmove.S b/arch/arm64/lib/memmove.S
+index a5a4459013b1a..e3de8f05c21a8 100644
+--- a/arch/arm64/lib/memmove.S
++++ b/arch/arm64/lib/memmove.S
+@@ -57,9 +57,8 @@ C_h .req x12
+ D_l .req x13
+ D_h .req x14
+
+- .weak memmove
+ ENTRY(__memmove)
+-ENTRY(memmove)
++WEAK(memmove)
+ cmp dstin, src
+ b.lo __memcpy
+ add tmp1, src, count
+diff --git a/arch/arm64/lib/memset.S b/arch/arm64/lib/memset.S
+index f2670a9f218c9..316263c47c006 100644
+--- a/arch/arm64/lib/memset.S
++++ b/arch/arm64/lib/memset.S
+@@ -54,9 +54,8 @@ dst .req x8
+ tmp3w .req w9
+ tmp3 .req x9
+
+- .weak memset
+ ENTRY(__memset)
+-ENTRY(memset)
++WEAK(memset)
+ mov dst, dstin /* Preserve return value. */
+ and A_lw, val, #255
+ orr A_lw, A_lw, A_lw, lsl #8
+diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
+index 29471038d817e..c6b99845fb377 100644
+--- a/arch/mips/bcm47xx/Kconfig
++++ b/arch/mips/bcm47xx/Kconfig
+@@ -27,6 +27,7 @@ config BCM47XX_BCMA
+ select BCMA
+ select BCMA_HOST_SOC
+ select BCMA_DRIVER_MIPS
++ select BCMA_DRIVER_PCI if PCI
+ select BCMA_DRIVER_PCI_HOSTMODE if PCI
+ select BCMA_DRIVER_GPIO
+ default y
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 8954108df4570..f51e21ea53492 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -251,7 +251,6 @@ endif
+
+ cpu-as-$(CONFIG_4xx) += -Wa,-m405
+ cpu-as-$(CONFIG_ALTIVEC) += $(call as-option,-Wa$(comma)-maltivec)
+-cpu-as-$(CONFIG_E200) += -Wa,-me200
+ cpu-as-$(CONFIG_E500) += -Wa,-me500
+
+ # When using '-many -mpower4' gas will first try and find a matching power4
+diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h
+index 751cf931bb3f4..a4f4820826b74 100644
+--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
++++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
+@@ -434,9 +434,9 @@ static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr,
+ if (pte_val(*ptep) & _PAGE_HASHPTE)
+ flush_hash_entry(mm, ptep, addr);
+ __asm__ __volatile__("\
+- stw%U0%X0 %2,%0\n\
++ stw%X0 %2,%0\n\
+ eieio\n\
+- stw%U0%X0 %L2,%1"
++ stw%X1 %L2,%1"
+ : "=m" (*ptep), "=m" (*((unsigned char *)ptep+4))
+ : "r" (pte) : "memory");
+
+diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
+index 59b35b93eadec..d90093a88e096 100644
+--- a/arch/powerpc/include/asm/cputable.h
++++ b/arch/powerpc/include/asm/cputable.h
+@@ -411,7 +411,6 @@ static inline void cpu_feature_keys_init(void) { }
+ CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
+ CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP | \
+ CPU_FTR_CELL_TB_BUG | CPU_FTR_SMT)
+-#define CPU_FTRS_GENERIC_32 (CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN)
+
+ /* 64-bit CPUs */
+ #define CPU_FTRS_PPC970 (CPU_FTR_LWSYNC | \
+@@ -509,8 +508,6 @@ enum {
+ CPU_FTRS_7447 | CPU_FTRS_7447A | CPU_FTRS_82XX |
+ CPU_FTRS_G2_LE | CPU_FTRS_E300 | CPU_FTRS_E300C2 |
+ CPU_FTRS_CLASSIC32 |
+-#else
+- CPU_FTRS_GENERIC_32 |
+ #endif
+ #ifdef CONFIG_PPC_8xx
+ CPU_FTRS_8XX |
+@@ -585,8 +582,6 @@ enum {
+ CPU_FTRS_7447 & CPU_FTRS_7447A & CPU_FTRS_82XX &
+ CPU_FTRS_G2_LE & CPU_FTRS_E300 & CPU_FTRS_E300C2 &
+ CPU_FTRS_CLASSIC32 &
+-#else
+- CPU_FTRS_GENERIC_32 &
+ #endif
+ #ifdef CONFIG_PPC_8xx
+ CPU_FTRS_8XX &
+diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h
+index b321c82b36247..913878d8e3bec 100644
+--- a/arch/powerpc/include/asm/nohash/pgtable.h
++++ b/arch/powerpc/include/asm/nohash/pgtable.h
+@@ -151,9 +151,9 @@ static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr,
+ */
+ if (IS_ENABLED(CONFIG_PPC32) && IS_ENABLED(CONFIG_PTE_64BIT) && !percpu) {
+ __asm__ __volatile__("\
+- stw%U0%X0 %2,%0\n\
++ stw%X0 %2,%0\n\
+ eieio\n\
+- stw%U0%X0 %L2,%1"
++ stw%X1 %L2,%1"
+ : "=m" (*ptep), "=m" (*((unsigned char *)ptep+4))
+ : "r" (pte) : "memory");
+ return;
+diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
+index 389da790c1296..4f7b225d78cff 100644
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -423,6 +423,10 @@ generic_secondary_common_init:
+ /* From now on, r24 is expected to be logical cpuid */
+ mr r24,r5
+
++ /* Create a temp kernel stack for use before relocation is on. */
++ ld r1,PACAEMERGSP(r13)
++ subi r1,r1,STACK_FRAME_OVERHEAD
++
+ /* See if we need to call a cpu state restore handler */
+ LOAD_REG_ADDR(r23, cur_cpu_spec)
+ ld r23,0(r23)
+@@ -451,10 +455,6 @@ generic_secondary_common_init:
+ sync /* order paca.run and cur_cpu_spec */
+ isync /* In case code patching happened */
+
+- /* Create a temp kernel stack for use before relocation is on. */
+- ld r1,PACAEMERGSP(r13)
+- subi r1,r1,STACK_FRAME_OVERHEAD
+-
+ b __secondary_start
+ #endif /* SMP */
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 7e0722b62cae9..b3aa0cea6283f 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -1095,7 +1095,7 @@ static struct rtas_filter rtas_filters[] __ro_after_init = {
+ { "ibm,display-message", -1, 0, -1, -1, -1 },
+ { "ibm,errinjct", -1, 2, -1, -1, -1, 1024 },
+ { "ibm,close-errinjct", -1, -1, -1, -1, -1 },
+- { "ibm,open-errinct", -1, -1, -1, -1, -1 },
++ { "ibm,open-errinjct", -1, -1, -1, -1, -1 },
+ { "ibm,get-config-addr-info2", -1, -1, -1, -1, -1 },
+ { "ibm,get-dynamic-sensor-state", -1, 1, -1, -1, -1 },
+ { "ibm,get-indices", -1, 2, 3, -1, -1 },
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index 508244bcf19c2..7787a26d47777 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -929,8 +929,6 @@ void __init setup_arch(char **cmdline_p)
+
+ /* On BookE, setup per-core TLB data structures. */
+ setup_tlb_core_data();
+-
+- smp_release_cpus();
+ #endif
+
+ /* Print various info about the machine that has been gathered so far. */
+@@ -964,6 +962,8 @@ void __init setup_arch(char **cmdline_p)
+ exc_lvl_early_init();
+ emergency_stack_init();
+
++ smp_release_cpus();
++
+ initmem_init();
+
+ #ifdef CONFIG_DUMMY_CONSOLE
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index d407b73298171..70de138228286 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -2058,6 +2058,16 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
+ local64_set(&event->hw.period_left, left);
+ perf_event_update_userpage(event);
+
++ /*
++ * Due to hardware limitation, sometimes SIAR could sample a kernel
++ * address even when freeze on supervisor state (kernel) is set in
++ * MMCR2. Check attr.exclude_kernel and address to drop the sample in
++ * these cases.
++ */
++ if (event->attr.exclude_kernel && record)
++ if (is_kernel_addr(mfspr(SPRN_SIAR)))
++ record = 0;
++
+ /*
+ * Finally record data if requested.
+ */
+diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c
+index 84d038ed3882a..ce6597a29bc9f 100644
+--- a/arch/powerpc/platforms/powernv/memtrace.c
++++ b/arch/powerpc/platforms/powernv/memtrace.c
+@@ -33,6 +33,7 @@ struct memtrace_entry {
+ char name[16];
+ };
+
++static DEFINE_MUTEX(memtrace_mutex);
+ static u64 memtrace_size;
+
+ static struct memtrace_entry *memtrace_array;
+@@ -70,6 +71,23 @@ static int change_memblock_state(struct memory_block *mem, void *arg)
+ return 0;
+ }
+
++static void memtrace_clear_range(unsigned long start_pfn,
++ unsigned long nr_pages)
++{
++ unsigned long pfn;
++
++ /*
++ * As pages are offline, we cannot trust the memmap anymore. As HIGHMEM
++ * does not apply, avoid passing around "struct page" and use
++ * clear_page() instead directly.
++ */
++ for (pfn = start_pfn; pfn < start_pfn + nr_pages; pfn++) {
++ if (IS_ALIGNED(pfn, PAGES_PER_SECTION))
++ cond_resched();
++ clear_page(__va(PFN_PHYS(pfn)));
++ }
++}
++
+ /* called with device_hotplug_lock held */
+ static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages)
+ {
+@@ -114,6 +132,11 @@ static u64 memtrace_alloc_node(u32 nid, u64 size)
+ lock_device_hotplug();
+ for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) {
+ if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) {
++ /*
++ * Clear the range while we still have a linear
++ * mapping.
++ */
++ memtrace_clear_range(base_pfn, nr_pages);
+ /*
+ * Remove memory in memory block size chunks so that
+ * iomem resources are always split to the same size and
+@@ -272,6 +295,7 @@ static int memtrace_online(void)
+
+ static int memtrace_enable_set(void *data, u64 val)
+ {
++ int rc = -EAGAIN;
+ u64 bytes;
+
+ /*
+@@ -284,25 +308,31 @@ static int memtrace_enable_set(void *data, u64 val)
+ return -EINVAL;
+ }
+
++ mutex_lock(&memtrace_mutex);
++
+ /* Re-add/online previously removed/offlined memory */
+ if (memtrace_size) {
+ if (memtrace_online())
+- return -EAGAIN;
++ goto out_unlock;
+ }
+
+- if (!val)
+- return 0;
++ if (!val) {
++ rc = 0;
++ goto out_unlock;
++ }
+
+ /* Offline and remove memory */
+ if (memtrace_init_regions_runtime(val))
+- return -EINVAL;
++ goto out_unlock;
+
+ if (memtrace_init_debugfs())
+- return -EINVAL;
++ goto out_unlock;
+
+ memtrace_size = val;
+-
+- return 0;
++ rc = 0;
++out_unlock:
++ mutex_unlock(&memtrace_mutex);
++ return rc;
+ }
+
+ static int memtrace_enable_get(void *data, u64 *val)
+diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
+index 52a021e1f86bf..5414d3295e0a1 100644
+--- a/arch/powerpc/platforms/pseries/suspend.c
++++ b/arch/powerpc/platforms/pseries/suspend.c
+@@ -26,7 +26,6 @@
+ #include <asm/mmu.h>
+ #include <asm/rtas.h>
+ #include <asm/topology.h>
+-#include "../../kernel/cacheinfo.h"
+
+ static u64 stream_id;
+ static struct device suspend_dev;
+@@ -91,9 +90,7 @@ static void pseries_suspend_enable_irqs(void)
+ * Update configuration which can be modified based on device tree
+ * changes during resume.
+ */
+- cacheinfo_cpu_offline(smp_processor_id());
+ post_mobility_fixup();
+- cacheinfo_cpu_online(smp_processor_id());
+ }
+
+ /**
+@@ -223,7 +220,6 @@ static struct bus_type suspend_subsys = {
+
+ static const struct platform_suspend_ops pseries_suspend_ops = {
+ .valid = suspend_valid_only_mem,
+- .begin = pseries_suspend_begin,
+ .prepare_late = pseries_prepare_late,
+ .enter = pseries_suspend_enter,
+ };
+diff --git a/arch/powerpc/xmon/nonstdio.c b/arch/powerpc/xmon/nonstdio.c
+index d00123421e007..eefe1b94e0aad 100644
+--- a/arch/powerpc/xmon/nonstdio.c
++++ b/arch/powerpc/xmon/nonstdio.c
+@@ -182,7 +182,7 @@ void xmon_printf(const char *format, ...)
+
+ if (n && rc == 0) {
+ /* No udbg hooks, fallback to printk() - dangerous */
+- printk("%s", xmon_outbuf);
++ pr_cont("%s", xmon_outbuf);
+ }
+ }
+
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index 888f247c9261a..c47bd581a08a9 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -863,24 +863,12 @@ static void smp_start_secondary(void *cpuvoid)
+ /* Upping and downing of CPUs */
+ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
+ {
+- struct pcpu *pcpu;
+- int base, i, rc;
++ struct pcpu *pcpu = pcpu_devices + cpu;
++ int rc;
+
+- pcpu = pcpu_devices + cpu;
+ if (pcpu->state != CPU_STATE_CONFIGURED)
+ return -EIO;
+- base = smp_get_base_cpu(cpu);
+- for (i = 0; i <= smp_cpu_mtid; i++) {
+- if (base + i < nr_cpu_ids)
+- if (cpu_online(base + i))
+- break;
+- }
+- /*
+- * If this is the first CPU of the core to get online
+- * do an initial CPU reset.
+- */
+- if (i > smp_cpu_mtid &&
+- pcpu_sigp_retry(pcpu_devices + base, SIGP_INITIAL_CPU_RESET, 0) !=
++ if (pcpu_sigp_retry(pcpu, SIGP_INITIAL_CPU_RESET, 0) !=
+ SIGP_CC_ORDER_CODE_ACCEPTED)
+ return -EIO;
+
+diff --git a/arch/s390/purgatory/head.S b/arch/s390/purgatory/head.S
+index 2e3707b12eddb..9b2d7a71fd1bd 100644
+--- a/arch/s390/purgatory/head.S
++++ b/arch/s390/purgatory/head.S
+@@ -61,14 +61,15 @@
+ jh 10b
+ .endm
+
+-.macro START_NEXT_KERNEL base
++.macro START_NEXT_KERNEL base subcode
+ lg %r4,kernel_entry-\base(%r13)
+ lg %r5,load_psw_mask-\base(%r13)
+ ogr %r4,%r5
+ stg %r4,0(%r0)
+
+ xgr %r0,%r0
+- diag %r0,%r0,0x308
++ lghi %r1,\subcode
++ diag %r0,%r1,0x308
+ .endm
+
+ .text
+@@ -123,7 +124,7 @@ ENTRY(purgatory_start)
+ je .start_crash_kernel
+
+ /* start normal kernel */
+- START_NEXT_KERNEL .base_crash
++ START_NEXT_KERNEL .base_crash 0
+
+ .return_old_kernel:
+ lmg %r6,%r15,gprregs-.base_crash(%r13)
+@@ -227,7 +228,7 @@ ENTRY(purgatory_start)
+ MEMCPY %r9,%r10,%r11
+
+ /* start crash kernel */
+- START_NEXT_KERNEL .base_dst
++ START_NEXT_KERNEL .base_dst 1
+
+
+ load_psw_mask:
+diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
+index 3fd7c3efdb18d..9cffbbb15c569 100644
+--- a/arch/um/drivers/chan_user.c
++++ b/arch/um/drivers/chan_user.c
+@@ -26,10 +26,10 @@ int generic_read(int fd, char *c_out, void *unused)
+ n = read(fd, c_out, sizeof(*c_out));
+ if (n > 0)
+ return n;
+- else if (errno == EAGAIN)
+- return 0;
+ else if (n == 0)
+ return -EIO;
++ else if (errno == EAGAIN)
++ return 0;
+ return -errno;
+ }
+
+diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
+index 20e30be44795b..e3b422ebce09f 100644
+--- a/arch/um/drivers/xterm.c
++++ b/arch/um/drivers/xterm.c
+@@ -18,6 +18,7 @@
+ struct xterm_chan {
+ int pid;
+ int helper_pid;
++ int chan_fd;
+ char *title;
+ int device;
+ int raw;
+@@ -33,6 +34,7 @@ static void *xterm_init(char *str, int device, const struct chan_opts *opts)
+ return NULL;
+ *data = ((struct xterm_chan) { .pid = -1,
+ .helper_pid = -1,
++ .chan_fd = -1,
+ .device = device,
+ .title = opts->xterm_title,
+ .raw = opts->raw } );
+@@ -149,6 +151,7 @@ static int xterm_open(int input, int output, int primary, void *d,
+ goto out_kill;
+ }
+
++ data->chan_fd = fd;
+ new = xterm_fd(fd, &data->helper_pid);
+ if (new < 0) {
+ err = new;
+@@ -206,6 +209,8 @@ static void xterm_close(int fd, void *d)
+ os_kill_process(data->helper_pid, 0);
+ data->helper_pid = -1;
+
++ if (data->chan_fd != -1)
++ os_close_file(data->chan_fd);
+ os_close_file(fd);
+ }
+
+diff --git a/arch/um/os-Linux/irq.c b/arch/um/os-Linux/irq.c
+index 365823010346a..90ef404622805 100644
+--- a/arch/um/os-Linux/irq.c
++++ b/arch/um/os-Linux/irq.c
+@@ -48,7 +48,7 @@ int os_epoll_triggered(int index, int events)
+ int os_event_mask(int irq_type)
+ {
+ if (irq_type == IRQ_READ)
+- return EPOLLIN | EPOLLPRI;
++ return EPOLLIN | EPOLLPRI | EPOLLERR | EPOLLHUP | EPOLLRDHUP;
+ if (irq_type == IRQ_WRITE)
+ return EPOLLOUT;
+ return 0;
+diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
+index 3c1e51ead0722..cd2aa72e21239 100644
+--- a/arch/x86/include/asm/apic.h
++++ b/arch/x86/include/asm/apic.h
+@@ -252,6 +252,7 @@ static inline u64 native_x2apic_icr_read(void)
+
+ extern int x2apic_mode;
+ extern int x2apic_phys;
++extern void __init x2apic_set_max_apicid(u32 apicid);
+ extern void __init check_x2apic(void);
+ extern void x2apic_setup(void);
+ static inline int x2apic_enabled(void)
+diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
+index 71ea49e7db747..02806d95ad6ee 100644
+--- a/arch/x86/include/asm/pgtable_types.h
++++ b/arch/x86/include/asm/pgtable_types.h
+@@ -148,6 +148,7 @@ enum page_cache_mode {
+ #endif
+
+ #define _PAGE_CACHE_MASK (_PAGE_PAT | _PAGE_PCD | _PAGE_PWT)
++#define _PAGE_LARGE_CACHE_MASK (_PAGE_PWT | _PAGE_PCD | _PAGE_PAT_LARGE)
+ #define _PAGE_NOCACHE (cachemode2protval(_PAGE_CACHE_MODE_UC))
+ #define _PAGE_CACHE_WP (cachemode2protval(_PAGE_CACHE_MODE_WP))
+
+diff --git a/arch/x86/include/asm/sync_core.h b/arch/x86/include/asm/sync_core.h
+index c67caafd33817..43b5e02a7b4b9 100644
+--- a/arch/x86/include/asm/sync_core.h
++++ b/arch/x86/include/asm/sync_core.h
+@@ -16,12 +16,13 @@ static inline void sync_core_before_usermode(void)
+ /* With PTI, we unconditionally serialize before running user code. */
+ if (static_cpu_has(X86_FEATURE_PTI))
+ return;
++
+ /*
+- * Return from interrupt and NMI is done through iret, which is core
+- * serializing.
++ * Even if we're in an interrupt, we might reschedule before returning,
++ * in which case we could switch to a different thread in the same mm
++ * and return using SYSRET or SYSEXIT. Instead of trying to keep
++ * track of our need to sync the core, just sync right away.
+ */
+- if (in_irq() || in_nmi())
+- return;
+ sync_core();
+ }
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index e9456a2eef585..ab8187271d470 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1813,20 +1813,22 @@ static __init void try_to_enable_x2apic(int remap_mode)
+ return;
+
+ if (remap_mode != IRQ_REMAP_X2APIC_MODE) {
+- /* IR is required if there is APIC ID > 255 even when running
+- * under KVM
++ /*
++ * Using X2APIC without IR is not architecturally supported
++ * on bare metal but may be supported in guests.
+ */
+- if (max_physical_apicid > 255 ||
+- !x86_init.hyper.x2apic_available()) {
++ if (!x86_init.hyper.x2apic_available()) {
+ pr_info("x2apic: IRQ remapping doesn't support X2APIC mode\n");
+ x2apic_disable();
+ return;
+ }
+
+ /*
+- * without IR all CPUs can be addressed by IOAPIC/MSI
+- * only in physical mode
++ * Without IR, all CPUs can be addressed by IOAPIC/MSI only
++ * in physical mode, and CPUs with an APIC ID that cannnot
++ * be addressed must not be brought online.
+ */
++ x2apic_set_max_apicid(255);
+ x2apic_phys = 1;
+ }
+ x2apic_enable();
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index 8b7e0b46e86ea..f0d0535e8f345 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -274,20 +274,24 @@ static int assign_irq_vector_any_locked(struct irq_data *irqd)
+ const struct cpumask *affmsk = irq_data_get_affinity_mask(irqd);
+ int node = irq_data_get_node(irqd);
+
+- if (node == NUMA_NO_NODE)
+- goto all;
+- /* Try the intersection of @affmsk and node mask */
+- cpumask_and(vector_searchmask, cpumask_of_node(node), affmsk);
+- if (!assign_vector_locked(irqd, vector_searchmask))
+- return 0;
+- /* Try the node mask */
+- if (!assign_vector_locked(irqd, cpumask_of_node(node)))
+- return 0;
+-all:
++ if (node != NUMA_NO_NODE) {
++ /* Try the intersection of @affmsk and node mask */
++ cpumask_and(vector_searchmask, cpumask_of_node(node), affmsk);
++ if (!assign_vector_locked(irqd, vector_searchmask))
++ return 0;
++ }
++
+ /* Try the full affinity mask */
+ cpumask_and(vector_searchmask, affmsk, cpu_online_mask);
+ if (!assign_vector_locked(irqd, vector_searchmask))
+ return 0;
++
++ if (node != NUMA_NO_NODE) {
++ /* Try the node mask */
++ if (!assign_vector_locked(irqd, cpumask_of_node(node)))
++ return 0;
++ }
++
+ /* Try the full online mask */
+ return assign_vector_locked(irqd, cpu_online_mask);
+ }
+diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
+index b5cf9e7b3830c..ed56d2850e96a 100644
+--- a/arch/x86/kernel/apic/x2apic_phys.c
++++ b/arch/x86/kernel/apic/x2apic_phys.c
+@@ -13,6 +13,12 @@
+ int x2apic_phys;
+
+ static struct apic apic_x2apic_phys;
++static u32 x2apic_max_apicid __ro_after_init;
++
++void __init x2apic_set_max_apicid(u32 apicid)
++{
++ x2apic_max_apicid = apicid;
++}
+
+ static int __init set_x2apic_phys_mode(char *arg)
+ {
+@@ -103,6 +109,9 @@ static int x2apic_phys_probe(void)
+ /* Common x2apic functions, also used by x2apic_cluster */
+ int x2apic_apic_id_valid(u32 apicid)
+ {
++ if (x2apic_max_apicid && apicid > x2apic_max_apicid)
++ return 0;
++
+ return 1;
+ }
+
+diff --git a/arch/x86/kernel/cpu/intel_rdt.h b/arch/x86/kernel/cpu/intel_rdt.h
+index 2b483b739cf1b..8412234eabd35 100644
+--- a/arch/x86/kernel/cpu/intel_rdt.h
++++ b/arch/x86/kernel/cpu/intel_rdt.h
+@@ -251,7 +251,6 @@ struct rftype {
+ * struct mbm_state - status for each MBM counter in each domain
+ * @chunks: Total data moved (multiply by rdt_group.mon_scale to get bytes)
+ * @prev_msr Value of IA32_QM_CTR for this RMID last time we read it
+- * @chunks_bw Total local data moved. Used for bandwidth calculation
+ * @prev_bw_msr:Value of previous IA32_QM_CTR for bandwidth counting
+ * @prev_bw The most recent bandwidth in MBps
+ * @delta_bw Difference between the current and previous bandwidth
+@@ -260,7 +259,6 @@ struct rftype {
+ struct mbm_state {
+ u64 chunks;
+ u64 prev_msr;
+- u64 chunks_bw;
+ u64 prev_bw_msr;
+ u32 prev_bw;
+ u32 delta_bw;
+diff --git a/arch/x86/kernel/cpu/intel_rdt_monitor.c b/arch/x86/kernel/cpu/intel_rdt_monitor.c
+index 3d4ec80a6bb96..5dfa5ab9a5ae2 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_monitor.c
++++ b/arch/x86/kernel/cpu/intel_rdt_monitor.c
+@@ -290,8 +290,6 @@ static void mbm_bw_count(u32 rmid, struct rmid_read *rr)
+ return;
+
+ chunks = mbm_overflow_count(m->prev_bw_msr, tval);
+- m->chunks_bw += chunks;
+- m->chunks = m->chunks_bw;
+ cur_bw = (chunks * r->mon_scale) >> 20;
+
+ if (m->delta_comp)
+@@ -461,15 +459,14 @@ static void mbm_update(struct rdt_domain *d, int rmid)
+ }
+ if (is_mbm_local_enabled()) {
+ rr.evtid = QOS_L3_MBM_LOCAL_EVENT_ID;
++ __mon_event_count(rmid, &rr);
+
+ /*
+ * Call the MBA software controller only for the
+ * control groups and when user has enabled
+ * the software controller explicitly.
+ */
+- if (!is_mba_sc(NULL))
+- __mon_event_count(rmid, &rr);
+- else
++ if (is_mba_sc(NULL))
+ mbm_bw_count(rmid, &rr);
+ }
+ }
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 07e290244ca94..dfc3ab44bc5d3 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -1041,6 +1041,11 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
+ * So clear it by resetting the current kprobe:
+ */
+ regs->flags &= ~X86_EFLAGS_TF;
++ /*
++ * Since the single step (trap) has been cancelled,
++ * we need to restore BTF here.
++ */
++ restore_btf();
+
+ /*
+ * If the TF flag was set before the kprobe hit,
+diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
+index 9d05572370edc..84b0078272d1d 100644
+--- a/arch/x86/lib/memcpy_64.S
++++ b/arch/x86/lib/memcpy_64.S
+@@ -14,8 +14,6 @@
+ * to a jmp to memcpy_erms which does the REP; MOVSB mem copy.
+ */
+
+-.weak memcpy
+-
+ /*
+ * memcpy - Copy a memory block.
+ *
+@@ -28,7 +26,9 @@
+ * rax original destination
+ */
+ ENTRY(__memcpy)
+-ENTRY(memcpy)
++.weak memcpy
++.p2align 4, 0x90
++memcpy:
+ ALTERNATIVE_2 "jmp memcpy_orig", "", X86_FEATURE_REP_GOOD, \
+ "jmp memcpy_erms", X86_FEATURE_ERMS
+
+diff --git a/arch/x86/lib/memmove_64.S b/arch/x86/lib/memmove_64.S
+index bbec69d8223bf..e1cfc880f42df 100644
+--- a/arch/x86/lib/memmove_64.S
++++ b/arch/x86/lib/memmove_64.S
+@@ -25,8 +25,8 @@
+ * rax: dest
+ */
+ .weak memmove
+-
+-ENTRY(memmove)
++.p2align 4, 0x90
++memmove:
+ ENTRY(__memmove)
+
+ /* Handle more 32 bytes in loop */
+diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S
+index 9bc861c71e754..084189acdcd0d 100644
+--- a/arch/x86/lib/memset_64.S
++++ b/arch/x86/lib/memset_64.S
+@@ -6,8 +6,6 @@
+ #include <asm/alternative-asm.h>
+ #include <asm/export.h>
+
+-.weak memset
+-
+ /*
+ * ISO C memset - set a memory block to a byte value. This function uses fast
+ * string to get better performance than the original function. The code is
+@@ -19,7 +17,9 @@
+ *
+ * rax original destination
+ */
+-ENTRY(memset)
++.weak memset
++.p2align 4, 0x90
++memset:
+ ENTRY(__memset)
+ /*
+ * Some CPUs support enhanced REP MOVSB/STOSB feature. It is recommended
+diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
+index fe7a12599d8eb..968d7005f4a72 100644
+--- a/arch/x86/mm/ident_map.c
++++ b/arch/x86/mm/ident_map.c
+@@ -62,6 +62,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
+ unsigned long addr, unsigned long end)
+ {
+ unsigned long next;
++ int result;
+
+ for (; addr < end; addr = next) {
+ p4d_t *p4d = p4d_page + p4d_index(addr);
+@@ -73,13 +74,20 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
+
+ if (p4d_present(*p4d)) {
+ pud = pud_offset(p4d, 0);
+- ident_pud_init(info, pud, addr, next);
++ result = ident_pud_init(info, pud, addr, next);
++ if (result)
++ return result;
++
+ continue;
+ }
+ pud = (pud_t *)info->alloc_pgt_page(info->context);
+ if (!pud)
+ return -ENOMEM;
+- ident_pud_init(info, pud, addr, next);
++
++ result = ident_pud_init(info, pud, addr, next);
++ if (result)
++ return result;
++
+ set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag));
+ }
+
+diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
+index c9faf34cbb62e..1f25201de0afb 100644
+--- a/arch/x86/mm/mem_encrypt_identity.c
++++ b/arch/x86/mm/mem_encrypt_identity.c
+@@ -47,8 +47,8 @@
+ #define PMD_FLAGS_LARGE (__PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL)
+
+ #define PMD_FLAGS_DEC PMD_FLAGS_LARGE
+-#define PMD_FLAGS_DEC_WP ((PMD_FLAGS_DEC & ~_PAGE_CACHE_MASK) | \
+- (_PAGE_PAT | _PAGE_PWT))
++#define PMD_FLAGS_DEC_WP ((PMD_FLAGS_DEC & ~_PAGE_LARGE_CACHE_MASK) | \
++ (_PAGE_PAT_LARGE | _PAGE_PWT))
+
+ #define PMD_FLAGS_ENC (PMD_FLAGS_LARGE | _PAGE_ENC)
+
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index b72296bd04a29..2f41a34c8f574 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -321,8 +321,14 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+ /*
+ * The membarrier system call requires a full memory barrier and
+ * core serialization before returning to user-space, after
+- * storing to rq->curr. Writing to CR3 provides that full
+- * memory barrier and core serializing instruction.
++ * storing to rq->curr, when changing mm. This is because
++ * membarrier() sends IPIs to all CPUs that are in the target mm
++ * to make them issue memory barriers. However, if another CPU
++ * switches to/from the target mm concurrently with
++ * membarrier(), it can cause that CPU not to receive an IPI
++ * when it really should issue a memory barrier. Writing to CR3
++ * provides that full memory barrier and core serializing
++ * instruction.
+ */
+ if (real_prev == next) {
+ VM_WARN_ON(this_cpu_read(cpu_tlbstate.ctxs[prev_asid].ctx_id) !=
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index db2db0b70d34f..0df43515ff949 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1118,6 +1118,23 @@ static void blk_mq_update_dispatch_busy(struct blk_mq_hw_ctx *hctx, bool busy)
+
+ #define BLK_MQ_RESOURCE_DELAY 3 /* ms units */
+
++static void blk_mq_handle_dev_resource(struct request *rq,
++ struct list_head *list)
++{
++ struct request *next =
++ list_first_entry_or_null(list, struct request, queuelist);
++
++ /*
++ * If an I/O scheduler has been configured and we got a driver tag for
++ * the next request already, free it.
++ */
++ if (next)
++ blk_mq_put_driver_tag(next);
++
++ list_add(&rq->queuelist, list);
++ __blk_mq_requeue_request(rq);
++}
++
+ /*
+ * Returns true if we did some work AND can potentially do more.
+ */
+@@ -1185,17 +1202,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+
+ ret = q->mq_ops->queue_rq(hctx, &bd);
+ if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) {
+- /*
+- * If an I/O scheduler has been configured and we got a
+- * driver tag for the next request already, free it
+- * again.
+- */
+- if (!list_empty(list)) {
+- nxt = list_first_entry(list, struct request, queuelist);
+- blk_mq_put_driver_tag(nxt);
+- }
+- list_add(&rq->queuelist, list);
+- __blk_mq_requeue_request(rq);
++ blk_mq_handle_dev_resource(rq, list);
+ break;
+ }
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index 272879d7b0d1f..d0276a4ed9876 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -151,7 +151,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ const u32 allowed = CRYPTO_ALG_KERN_DRIVER_ONLY;
+ struct sock *sk = sock->sk;
+ struct alg_sock *ask = alg_sk(sk);
+- struct sockaddr_alg *sa = (void *)uaddr;
++ struct sockaddr_alg_new *sa = (void *)uaddr;
+ const struct af_alg_type *type;
+ void *private;
+ int err;
+@@ -159,7 +159,11 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ if (sock->state == SS_CONNECTED)
+ return -EINVAL;
+
+- if (addr_len < sizeof(*sa))
++ BUILD_BUG_ON(offsetof(struct sockaddr_alg_new, salg_name) !=
++ offsetof(struct sockaddr_alg, salg_name));
++ BUILD_BUG_ON(offsetof(struct sockaddr_alg, salg_name) != sizeof(*sa));
++
++ if (addr_len < sizeof(*sa) + 1)
+ return -EINVAL;
+
+ /* If caller uses non-allowed flag, return error. */
+@@ -167,7 +171,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ return -EINVAL;
+
+ sa->salg_type[sizeof(sa->salg_type) - 1] = 0;
+- sa->salg_name[sizeof(sa->salg_name) + addr_len - sizeof(*sa) - 1] = 0;
++ sa->salg_name[addr_len - sizeof(*sa) - 1] = 0;
+
+ type = alg_get_type(sa->salg_type);
+ if (IS_ERR(type) && PTR_ERR(type) == -ENOENT) {
+diff --git a/crypto/ecdh.c b/crypto/ecdh.c
+index bf6300175b9cd..a6e1a5d43fa7a 100644
+--- a/crypto/ecdh.c
++++ b/crypto/ecdh.c
+@@ -57,12 +57,13 @@ static int ecdh_set_secret(struct crypto_kpp *tfm, const void *buf,
+ return ecc_gen_privkey(ctx->curve_id, ctx->ndigits,
+ ctx->private_key);
+
+- if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
+- (const u64 *)params.key, params.key_size) < 0)
+- return -EINVAL;
+-
+ memcpy(ctx->private_key, params.key, params.key_size);
+
++ if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
++ ctx->private_key, params.key_size) < 0) {
++ memzero_explicit(ctx->private_key, params.key_size);
++ return -EINVAL;
++ }
+ return 0;
+ }
+
+diff --git a/drivers/acpi/acpi_pnp.c b/drivers/acpi/acpi_pnp.c
+index 67d97c0090a27..5d72baf60ac83 100644
+--- a/drivers/acpi/acpi_pnp.c
++++ b/drivers/acpi/acpi_pnp.c
+@@ -320,6 +320,9 @@ static bool matching_id(const char *idstr, const char *list_id)
+ {
+ int i;
+
++ if (strlen(idstr) != strlen(list_id))
++ return false;
++
+ if (memcmp(idstr, list_id, 3))
+ return false;
+
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index ca735dc24d377..9617e58832719 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -702,7 +702,7 @@ static void acpi_pm_notify_work_func(struct acpi_device_wakeup_context *context)
+ static DEFINE_MUTEX(acpi_wakeup_lock);
+
+ static int __acpi_device_wakeup_enable(struct acpi_device *adev,
+- u32 target_state, int max_count)
++ u32 target_state)
+ {
+ struct acpi_device_wakeup *wakeup = &adev->wakeup;
+ acpi_status status;
+@@ -710,9 +710,10 @@ static int __acpi_device_wakeup_enable(struct acpi_device *adev,
+
+ mutex_lock(&acpi_wakeup_lock);
+
+- if (wakeup->enable_count >= max_count)
++ if (wakeup->enable_count >= INT_MAX) {
++ acpi_handle_info(adev->handle, "Wakeup enable count out of bounds!\n");
+ goto out;
+-
++ }
+ if (wakeup->enable_count > 0)
+ goto inc;
+
+@@ -749,7 +750,7 @@ out:
+ */
+ static int acpi_device_wakeup_enable(struct acpi_device *adev, u32 target_state)
+ {
+- return __acpi_device_wakeup_enable(adev, target_state, 1);
++ return __acpi_device_wakeup_enable(adev, target_state);
+ }
+
+ /**
+@@ -779,8 +780,12 @@ out:
+ mutex_unlock(&acpi_wakeup_lock);
+ }
+
+-static int __acpi_pm_set_device_wakeup(struct device *dev, bool enable,
+- int max_count)
++/**
++ * acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device.
++ * @dev: Device to enable/disable to generate wakeup events.
++ * @enable: Whether to enable or disable the wakeup functionality.
++ */
++int acpi_pm_set_device_wakeup(struct device *dev, bool enable)
+ {
+ struct acpi_device *adev;
+ int error;
+@@ -800,36 +805,14 @@ static int __acpi_pm_set_device_wakeup(struct device *dev, bool enable,
+ return 0;
+ }
+
+- error = __acpi_device_wakeup_enable(adev, acpi_target_system_state(),
+- max_count);
++ error = __acpi_device_wakeup_enable(adev, acpi_target_system_state());
+ if (!error)
+ dev_dbg(dev, "Wakeup enabled by ACPI\n");
+
+ return error;
+ }
+-
+-/**
+- * acpi_pm_set_device_wakeup - Enable/disable remote wakeup for given device.
+- * @dev: Device to enable/disable to generate wakeup events.
+- * @enable: Whether to enable or disable the wakeup functionality.
+- */
+-int acpi_pm_set_device_wakeup(struct device *dev, bool enable)
+-{
+- return __acpi_pm_set_device_wakeup(dev, enable, 1);
+-}
+ EXPORT_SYMBOL_GPL(acpi_pm_set_device_wakeup);
+
+-/**
+- * acpi_pm_set_bridge_wakeup - Enable/disable remote wakeup for given bridge.
+- * @dev: Bridge device to enable/disable to generate wakeup events.
+- * @enable: Whether to enable or disable the wakeup functionality.
+- */
+-int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable)
+-{
+- return __acpi_pm_set_device_wakeup(dev, enable, INT_MAX);
+-}
+-EXPORT_SYMBOL_GPL(acpi_pm_set_bridge_wakeup);
+-
+ /**
+ * acpi_dev_pm_low_power - Put ACPI device into a low-power state.
+ * @dev: Device to put into a low-power state.
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 316a0fc785e36..d3f9a320e880e 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -549,7 +549,7 @@ static acpi_status acpi_dev_process_resource(struct acpi_resource *ares,
+ ret = c->preproc(ares, c->preproc_data);
+ if (ret < 0) {
+ c->error = ret;
+- return AE_CTRL_TERMINATE;
++ return AE_ABORT_METHOD;
+ } else if (ret > 0) {
+ return AE_OK;
+ }
+diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
+index 93896c992245b..42af2f37ba4e1 100644
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -264,6 +264,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
+
+ if (ring->xenblkd) {
+ kthread_stop(ring->xenblkd);
++ ring->xenblkd = NULL;
+ wake_up(&ring->shutdown_wq);
+ }
+
+@@ -651,7 +652,8 @@ static int xen_blkbk_probe(struct xenbus_device *dev,
+ /* setup back pointer */
+ be->blkif->be = be;
+
+- err = xenbus_watch_pathfmt(dev, &be->backend_watch, backend_changed,
++ err = xenbus_watch_pathfmt(dev, &be->backend_watch, NULL,
++ backend_changed,
+ "%s/%s", dev->nodename, "physical-device");
+ if (err)
+ goto fail;
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index 5a68cd4dd71cb..7ffeb37e8f202 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -257,6 +257,9 @@ static int h5_close(struct hci_uart *hu)
+ skb_queue_purge(&h5->rel);
+ skb_queue_purge(&h5->unrel);
+
++ kfree_skb(h5->rx_skb);
++ h5->rx_skb = NULL;
++
+ if (h5->vnd && h5->vnd->close)
+ h5->vnd->close(h5);
+
+diff --git a/drivers/bus/fsl-mc/fsl-mc-allocator.c b/drivers/bus/fsl-mc/fsl-mc-allocator.c
+index e906ecfe23dd8..9cb0733a03991 100644
+--- a/drivers/bus/fsl-mc/fsl-mc-allocator.c
++++ b/drivers/bus/fsl-mc/fsl-mc-allocator.c
+@@ -292,8 +292,10 @@ int __must_check fsl_mc_object_allocate(struct fsl_mc_device *mc_dev,
+ goto error;
+
+ mc_adev = resource->data;
+- if (!mc_adev)
++ if (!mc_adev) {
++ error = -EINVAL;
+ goto error;
++ }
+
+ *new_mc_adev = mc_adev;
+ return 0;
+diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c
+index 1b14256376d24..7c1da45be166e 100644
+--- a/drivers/bus/mips_cdmm.c
++++ b/drivers/bus/mips_cdmm.c
+@@ -544,10 +544,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus)
+ dev_set_name(&dev->dev, "cdmm%u-%u", cpu, id);
+ ++id;
+ ret = device_register(&dev->dev);
+- if (ret) {
++ if (ret)
+ put_device(&dev->dev);
+- kfree(dev);
+- }
+ }
+ }
+
+diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
+index 4080d4e78e8e4..f3aaefafba893 100644
+--- a/drivers/clk/clk-s2mps11.c
++++ b/drivers/clk/clk-s2mps11.c
+@@ -211,6 +211,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
+ return ret;
+
+ err_reg:
++ of_node_put(s2mps11_clks[0].clk_np);
+ while (--i >= 0)
+ clkdev_drop(s2mps11_clks[i].lookup);
+
+diff --git a/drivers/clk/mvebu/armada-37xx-xtal.c b/drivers/clk/mvebu/armada-37xx-xtal.c
+index 612d65ede10a0..5370514959e15 100644
+--- a/drivers/clk/mvebu/armada-37xx-xtal.c
++++ b/drivers/clk/mvebu/armada-37xx-xtal.c
+@@ -15,8 +15,8 @@
+ #include <linux/platform_device.h>
+ #include <linux/regmap.h>
+
+-#define NB_GPIO1_LATCH 0xC
+-#define XTAL_MODE BIT(31)
++#define NB_GPIO1_LATCH 0x8
++#define XTAL_MODE BIT(9)
+
+ static int armada_3700_xtal_clock_probe(struct platform_device *pdev)
+ {
+diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c
+index 6d2b568915597..6e03b467395b2 100644
+--- a/drivers/clk/renesas/r9a06g032-clocks.c
++++ b/drivers/clk/renesas/r9a06g032-clocks.c
+@@ -51,7 +51,7 @@ struct r9a06g032_clkdesc {
+ u16 sel, g1, r1, g2, r2;
+ } dual;
+ };
+-} __packed;
++};
+
+ #define I_GATE(_clk, _rst, _rdy, _midle, _scon, _mirack, _mistat) \
+ { .gate = _clk, .reset = _rst, \
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index 9ac6c299e0744..19304d6b2c05d 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -381,6 +381,7 @@ static struct clk_div_table ths_div_table[] = {
+ { .val = 1, .div = 2 },
+ { .val = 2, .div = 4 },
+ { .val = 3, .div = 6 },
++ { /* Sentinel */ },
+ };
+ static const char * const ths_parents[] = { "osc24M" };
+ static struct ccu_div ths_clk = {
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+index 61e3ba12773ea..d9789378caf55 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+@@ -328,6 +328,7 @@ static struct clk_div_table ths_div_table[] = {
+ { .val = 1, .div = 2 },
+ { .val = 2, .div = 4 },
+ { .val = 3, .div = 6 },
++ { /* Sentinel */ },
+ };
+ static SUNXI_CCU_DIV_TABLE_WITH_GATE(ths_clk, "ths", "osc24M",
+ 0x074, 0, 2, ths_div_table, BIT(31), 0);
+diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h
+index de466b4446da9..0efcb200dde5a 100644
+--- a/drivers/clk/tegra/clk-id.h
++++ b/drivers/clk/tegra/clk-id.h
+@@ -233,6 +233,7 @@ enum clk_id {
+ tegra_clk_sdmmc4,
+ tegra_clk_sdmmc4_8,
+ tegra_clk_se,
++ tegra_clk_se_10,
+ tegra_clk_soc_therm,
+ tegra_clk_soc_therm_8,
+ tegra_clk_sor0,
+diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
+index b137c5d34eec4..9d05fb48686db 100644
+--- a/drivers/clk/tegra/clk-tegra-periph.c
++++ b/drivers/clk/tegra/clk-tegra-periph.c
+@@ -650,7 +650,7 @@ static struct tegra_periph_init_data periph_clks[] = {
+ INT8("host1x", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_8),
+ INT8("host1x", mux_pllc4_out1_pllc_pllc4_out2_pllp_clkm_plla_pllc4_out0, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_9),
+ INT8("se", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
+- INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
++ INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se_10),
+ INT8("2d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_2D, 21, 0, tegra_clk_gr2d_8),
+ INT8("3d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_3D, 24, 0, tegra_clk_gr3d_8),
+ INT8("vic03", mux_pllm_pllc_pllp_plla_pllc2_c3_clkm, CLK_SOURCE_VIC03, 178, 0, tegra_clk_vic03),
+diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
+index 071af44b1ba85..e33ce851837e4 100644
+--- a/drivers/clk/ti/fapll.c
++++ b/drivers/clk/ti/fapll.c
+@@ -497,6 +497,7 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
+ {
+ struct clk_init_data *init;
+ struct fapll_synth *synth;
++ struct clk *clk = ERR_PTR(-ENOMEM);
+
+ init = kzalloc(sizeof(*init), GFP_KERNEL);
+ if (!init)
+@@ -519,13 +520,19 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
+ synth->hw.init = init;
+ synth->clk_pll = pll_clk;
+
+- return clk_register(NULL, &synth->hw);
++ clk = clk_register(NULL, &synth->hw);
++ if (IS_ERR(clk)) {
++ pr_err("failed to register clock\n");
++ goto free;
++ }
++
++ return clk;
+
+ free:
+ kfree(synth);
+ kfree(init);
+
+- return ERR_PTR(-ENOMEM);
++ return clk;
+ }
+
+ static void __init ti_fapll_setup(struct device_node *node)
+diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
+index 0445ad7e559e5..e67ab217eef41 100644
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -827,15 +827,24 @@ static void arch_timer_evtstrm_enable(int divider)
+
+ static void arch_timer_configure_evtstream(void)
+ {
+- int evt_stream_div, pos;
++ int evt_stream_div, lsb;
++
++ /*
++ * As the event stream can at most be generated at half the frequency
++ * of the counter, use half the frequency when computing the divider.
++ */
++ evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ / 2;
++
++ /*
++ * Find the closest power of two to the divisor. If the adjacent bit
++ * of lsb (last set bit, starts from 0) is set, then we use (lsb + 1).
++ */
++ lsb = fls(evt_stream_div) - 1;
++ if (lsb > 0 && (evt_stream_div & BIT(lsb - 1)))
++ lsb++;
+
+- /* Find the closest power of two to the divisor */
+- evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ;
+- pos = fls(evt_stream_div);
+- if (pos > 1 && !(evt_stream_div & (1 << (pos - 2))))
+- pos--;
+ /* enable event stream */
+- arch_timer_evtstrm_enable(min(pos, 15));
++ arch_timer_evtstrm_enable(max(0, min(lsb, 15)));
+ }
+
+ static void arch_counter_set_user_access(void)
+diff --git a/drivers/clocksource/cadence_ttc_timer.c b/drivers/clocksource/cadence_ttc_timer.c
+index 29d51755e18b2..a7eb858a84a0f 100644
+--- a/drivers/clocksource/cadence_ttc_timer.c
++++ b/drivers/clocksource/cadence_ttc_timer.c
+@@ -419,10 +419,8 @@ static int __init ttc_setup_clockevent(struct clk *clk,
+ ttcce->ttc.clk = clk;
+
+ err = clk_prepare_enable(ttcce->ttc.clk);
+- if (err) {
+- kfree(ttcce);
+- return err;
+- }
++ if (err)
++ goto out_kfree;
+
+ ttcce->ttc.clk_rate_change_nb.notifier_call =
+ ttc_rate_change_clockevent_cb;
+@@ -432,7 +430,7 @@ static int __init ttc_setup_clockevent(struct clk *clk,
+ &ttcce->ttc.clk_rate_change_nb);
+ if (err) {
+ pr_warn("Unable to register clock notifier.\n");
+- return err;
++ goto out_kfree;
+ }
+
+ ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk);
+@@ -461,15 +459,17 @@ static int __init ttc_setup_clockevent(struct clk *clk,
+
+ err = request_irq(irq, ttc_clock_event_interrupt,
+ IRQF_TIMER, ttcce->ce.name, ttcce);
+- if (err) {
+- kfree(ttcce);
+- return err;
+- }
++ if (err)
++ goto out_kfree;
+
+ clockevents_config_and_register(&ttcce->ce,
+ ttcce->ttc.freq / PRESCALE, 1, 0xfffe);
+
+ return 0;
++
++out_kfree:
++ kfree(ttcce);
++ return err;
+ }
+
+ /**
+diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
+index 1608f7105c9f8..ad743f2f31e78 100644
+--- a/drivers/cpufreq/highbank-cpufreq.c
++++ b/drivers/cpufreq/highbank-cpufreq.c
+@@ -104,6 +104,13 @@ out_put_node:
+ }
+ module_init(hb_cpufreq_driver_init);
+
++static const struct of_device_id __maybe_unused hb_cpufreq_of_match[] = {
++ { .compatible = "calxeda,highbank" },
++ { .compatible = "calxeda,ecx-2000" },
++ { },
++};
++MODULE_DEVICE_TABLE(of, hb_cpufreq_of_match);
++
+ MODULE_AUTHOR("Mark Langsdorf <mark.langsdorf@calxeda.com>");
+ MODULE_DESCRIPTION("Calxeda Highbank cpufreq driver");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/cpufreq/loongson1-cpufreq.c b/drivers/cpufreq/loongson1-cpufreq.c
+index be89416e2358f..9d902f67f8716 100644
+--- a/drivers/cpufreq/loongson1-cpufreq.c
++++ b/drivers/cpufreq/loongson1-cpufreq.c
+@@ -217,6 +217,7 @@ static struct platform_driver ls1x_cpufreq_platdrv = {
+
+ module_platform_driver(ls1x_cpufreq_platdrv);
+
++MODULE_ALIAS("platform:ls1x-cpufreq");
+ MODULE_AUTHOR("Kelvin Cheung <keguang.zhang@gmail.com>");
+ MODULE_DESCRIPTION("Loongson1 CPUFreq driver");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
+index eb8920d398181..5a81e20f02824 100644
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -554,6 +554,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+
+ { }
+ };
++MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines);
+
+ static int __init mtk_cpufreq_driver_init(void)
+ {
+diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
+index 87a98ec77773a..0338885332a75 100644
+--- a/drivers/cpufreq/scpi-cpufreq.c
++++ b/drivers/cpufreq/scpi-cpufreq.c
+@@ -246,6 +246,7 @@ static struct platform_driver scpi_cpufreq_platdrv = {
+ };
+ module_platform_driver(scpi_cpufreq_platdrv);
+
++MODULE_ALIAS("platform:scpi-cpufreq");
+ MODULE_AUTHOR("Sudeep Holla <sudeep.holla@arm.com>");
+ MODULE_DESCRIPTION("ARM SCPI CPUFreq interface driver");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c
+index 6b5d241c30b70..2d09960afa591 100644
+--- a/drivers/cpufreq/sti-cpufreq.c
++++ b/drivers/cpufreq/sti-cpufreq.c
+@@ -295,6 +295,13 @@ register_cpufreq_dt:
+ }
+ module_init(sti_cpufreq_init);
+
++static const struct of_device_id __maybe_unused sti_cpufreq_of_match[] = {
++ { .compatible = "st,stih407" },
++ { .compatible = "st,stih410" },
++ { },
++};
++MODULE_DEVICE_TABLE(of, sti_cpufreq_of_match);
++
+ MODULE_DESCRIPTION("STMicroelectronics CPUFreq/OPP driver");
+ MODULE_AUTHOR("Ajitpal Singh <ajitpal.singh@st.com>");
+ MODULE_AUTHOR("Lee Jones <lee.jones@linaro.org>");
+diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
+index 68d5ea818b6c0..cd00afb5786e8 100644
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -926,7 +926,7 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
+ }
+
+ pd->pd_ctl.w = PD_CTL_HOST_READY |
+- ((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) |
++ ((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) ||
+ (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
+ PD_CTL_HASH_FINAL : 0);
+ pd->pd_ctl_len.w = 0x00400000 | (assoclen + datalen);
+diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
+index 86c699c14f849..bc6c5cb7de239 100644
+--- a/drivers/crypto/inside-secure/safexcel.c
++++ b/drivers/crypto/inside-secure/safexcel.c
+@@ -1066,7 +1066,7 @@ static int safexcel_probe(struct platform_device *pdev)
+
+ priv->ring[i].rdr_req = devm_kcalloc(dev,
+ EIP197_DEFAULT_RING_SIZE,
+- sizeof(priv->ring[i].rdr_req),
++ sizeof(*priv->ring[i].rdr_req),
+ GFP_KERNEL);
+ if (!priv->ring[i].rdr_req) {
+ ret = -ENOMEM;
+diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
+index 9019f6b67986b..a5d6e1a0192bc 100644
+--- a/drivers/crypto/omap-aes.c
++++ b/drivers/crypto/omap-aes.c
+@@ -1163,7 +1163,7 @@ static int omap_aes_probe(struct platform_device *pdev)
+ if (err < 0) {
+ dev_err(dev, "%s: failed to get_sync(%d)\n",
+ __func__, err);
+- goto err_res;
++ goto err_pm_disable;
+ }
+
+ omap_aes_dma_stop(dd);
+@@ -1276,6 +1276,7 @@ err_engine:
+ omap_aes_dma_cleanup(dd);
+ err_irq:
+ tasklet_kill(&dd->done_task);
++err_pm_disable:
+ pm_runtime_disable(dev);
+ err_res:
+ dd = NULL;
+diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
+index ff149e176f649..dac130bb807ae 100644
+--- a/drivers/crypto/qat/qat_common/qat_hal.c
++++ b/drivers/crypto/qat/qat_common/qat_hal.c
+@@ -1189,7 +1189,7 @@ static int qat_hal_put_rel_rd_xfer(struct icp_qat_fw_loader_handle *handle,
+ unsigned short mask;
+ unsigned short dr_offset = 0x10;
+
+- status = ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
++ ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
+ if (CE_INUSE_CONTEXTS & ctx_enables) {
+ if (ctx & 0x1) {
+ pr_err("QAT: bad 4-ctx mode,ctx=0x%x\n", ctx);
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index ea16308fae0a5..c70a7c4f5b739 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -474,7 +474,7 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE)
+ /*
+ * locate current (offending) descriptor
+ */
+-static u32 current_desc_hdr(struct device *dev, int ch)
++static __be32 current_desc_hdr(struct device *dev, int ch)
+ {
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ int tail, iter;
+@@ -492,7 +492,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
+
+ iter = tail;
+ while (priv->chan[ch].fifo[iter].dma_desc != cur_desc &&
+- priv->chan[ch].fifo[iter].desc->next_desc != cur_desc) {
++ priv->chan[ch].fifo[iter].desc->next_desc != cpu_to_be32(cur_desc)) {
+ iter = (iter + 1) & (priv->fifo_len - 1);
+ if (iter == tail) {
+ dev_err(dev, "couldn't locate current descriptor\n");
+@@ -500,7 +500,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
+ }
+ }
+
+- if (priv->chan[ch].fifo[iter].desc->next_desc == cur_desc) {
++ if (priv->chan[ch].fifo[iter].desc->next_desc == cpu_to_be32(cur_desc)) {
+ struct talitos_edesc *edesc;
+
+ edesc = container_of(priv->chan[ch].fifo[iter].desc,
+@@ -515,13 +515,13 @@ static u32 current_desc_hdr(struct device *dev, int ch)
+ /*
+ * user diagnostics; report root cause of error based on execution unit status
+ */
+-static void report_eu_error(struct device *dev, int ch, u32 desc_hdr)
++static void report_eu_error(struct device *dev, int ch, __be32 desc_hdr)
+ {
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ int i;
+
+ if (!desc_hdr)
+- desc_hdr = in_be32(priv->chan[ch].reg + TALITOS_DESCBUF);
++ desc_hdr = cpu_to_be32(in_be32(priv->chan[ch].reg + TALITOS_DESCBUF));
+
+ switch (desc_hdr & DESC_HDR_SEL0_MASK) {
+ case DESC_HDR_SEL0_AFEU:
+diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
+index 8dc0aa4d73ab8..462adf7e4e952 100644
+--- a/drivers/dma/mv_xor_v2.c
++++ b/drivers/dma/mv_xor_v2.c
+@@ -777,8 +777,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
+ goto disable_clk;
+
+ msi_desc = first_msi_entry(&pdev->dev);
+- if (!msi_desc)
++ if (!msi_desc) {
++ ret = -ENODEV;
+ goto free_msi_irqs;
++ }
+ xor_dev->msi_desc = msi_desc;
+
+ ret = devm_request_irq(&pdev->dev, msi_desc->irq,
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index cbe4158531979..fe25c98380ad0 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -18,6 +18,9 @@ static struct msr __percpu *msrs;
+ /* Per-node stuff */
+ static struct ecc_settings **ecc_stngs;
+
++/* Device for the PCI component */
++static struct device *pci_ctl_dev;
++
+ /*
+ * Valid scrub rates for the K8 hardware memory scrubber. We map the scrubbing
+ * bandwidth to a valid bit pattern. The 'set' operation finds the 'matching-
+@@ -2563,6 +2566,9 @@ reserve_mc_sibling_devs(struct amd64_pvt *pvt, u16 pci_id1, u16 pci_id2)
+ return -ENODEV;
+ }
+
++ if (!pci_ctl_dev)
++ pci_ctl_dev = &pvt->F0->dev;
++
+ edac_dbg(1, "F0: %s\n", pci_name(pvt->F0));
+ edac_dbg(1, "F3: %s\n", pci_name(pvt->F3));
+ edac_dbg(1, "F6: %s\n", pci_name(pvt->F6));
+@@ -2587,6 +2593,9 @@ reserve_mc_sibling_devs(struct amd64_pvt *pvt, u16 pci_id1, u16 pci_id2)
+ return -ENODEV;
+ }
+
++ if (!pci_ctl_dev)
++ pci_ctl_dev = &pvt->F2->dev;
++
+ edac_dbg(1, "F1: %s\n", pci_name(pvt->F1));
+ edac_dbg(1, "F2: %s\n", pci_name(pvt->F2));
+ edac_dbg(1, "F3: %s\n", pci_name(pvt->F3));
+@@ -3441,21 +3450,10 @@ static void remove_one_instance(unsigned int nid)
+
+ static void setup_pci_device(void)
+ {
+- struct mem_ctl_info *mci;
+- struct amd64_pvt *pvt;
+-
+ if (pci_ctl)
+ return;
+
+- mci = edac_mc_find(0);
+- if (!mci)
+- return;
+-
+- pvt = mci->pvt_info;
+- if (pvt->umc)
+- pci_ctl = edac_pci_create_generic_ctl(&pvt->F0->dev, EDAC_MOD_STR);
+- else
+- pci_ctl = edac_pci_create_generic_ctl(&pvt->F2->dev, EDAC_MOD_STR);
++ pci_ctl = edac_pci_create_generic_ctl(pci_ctl_dev, EDAC_MOD_STR);
+ if (!pci_ctl) {
+ pr_warn("%s(): Unable to create PCI control\n", __func__);
+ pr_warn("%s(): PCI error report via EDAC not set\n", __func__);
+@@ -3535,6 +3533,8 @@ static int __init amd64_edac_init(void)
+ return 0;
+
+ err_pci:
++ pci_ctl_dev = NULL;
++
+ msrs_free(msrs);
+ msrs = NULL;
+
+@@ -3566,6 +3566,8 @@ static void __exit amd64_edac_exit(void)
+ kfree(ecc_stngs);
+ ecc_stngs = NULL;
+
++ pci_ctl_dev = NULL;
++
+ msrs_free(msrs);
+ msrs = NULL;
+ }
+diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
+index 227651ff9666a..c221a0aec0f37 100644
+--- a/drivers/extcon/extcon-max77693.c
++++ b/drivers/extcon/extcon-max77693.c
+@@ -1275,4 +1275,4 @@ module_platform_driver(max77693_muic_driver);
+ MODULE_DESCRIPTION("Maxim MAX77693 Extcon driver");
+ MODULE_AUTHOR("Chanwoo Choi <cw00.choi@samsung.com>");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("platform:extcon-max77693");
++MODULE_ALIAS("platform:max77693-muic");
+diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
+index 4935cda5301ea..4f1af323ec03b 100644
+--- a/drivers/gpio/gpio-eic-sprd.c
++++ b/drivers/gpio/gpio-eic-sprd.c
+@@ -599,7 +599,7 @@ static int sprd_eic_probe(struct platform_device *pdev)
+ */
+ res = platform_get_resource(pdev, IORESOURCE_MEM, i);
+ if (!res)
+- continue;
++ break;
+
+ sprd_eic->base[i] = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(sprd_eic->base[i]))
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index adc768f908f1a..3b78dcda47364 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -1191,6 +1191,13 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
+
+ devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
+
++ /* Some MVEBU SoCs have simple PWM support for GPIO lines */
++ if (IS_ENABLED(CONFIG_PWM)) {
++ err = mvebu_pwm_probe(pdev, mvchip, id);
++ if (err)
++ return err;
++ }
++
+ /* Some gpio controllers do not provide irq support */
+ if (!have_irqs)
+ return 0;
+@@ -1200,7 +1207,8 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
+ if (!mvchip->domain) {
+ dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n",
+ mvchip->chip.label);
+- return -ENODEV;
++ err = -ENODEV;
++ goto err_pwm;
+ }
+
+ err = irq_alloc_domain_generic_chips(
+@@ -1248,14 +1256,12 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
+ mvchip);
+ }
+
+- /* Some MVEBU SoCs have simple PWM support for GPIO lines */
+- if (IS_ENABLED(CONFIG_PWM))
+- return mvebu_pwm_probe(pdev, mvchip, id);
+-
+ return 0;
+
+ err_domain:
+ irq_domain_remove(mvchip->domain);
++err_pwm:
++ pwmchip_remove(&mvchip->mvpwm->chip);
+
+ return err;
+ }
+diff --git a/drivers/gpu/drm/drm_dp_aux_dev.c b/drivers/gpu/drm/drm_dp_aux_dev.c
+index 0e4f25d63fd2d..0b11210c882ee 100644
+--- a/drivers/gpu/drm/drm_dp_aux_dev.c
++++ b/drivers/gpu/drm/drm_dp_aux_dev.c
+@@ -60,7 +60,7 @@ static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_minor(unsigned index)
+
+ mutex_lock(&aux_idr_mutex);
+ aux_dev = idr_find(&aux_idr, index);
+- if (!kref_get_unless_zero(&aux_dev->refcount))
++ if (aux_dev && !kref_get_unless_zero(&aux_dev->refcount))
+ aux_dev = NULL;
+ mutex_unlock(&aux_idr_mutex);
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index a0aafd9a37e60..c50fe915f5c84 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2706,11 +2706,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr,
+ {
+ int ret;
+
+- port = drm_dp_get_validated_port_ref(mgr, port);
+- if (!port)
++ if (slots < 0)
+ return false;
+
+- if (slots < 0)
++ port = drm_dp_get_validated_port_ref(mgr, port);
++ if (!port)
+ return false;
+
+ if (port->vcpi.vcpi > 0) {
+@@ -2725,6 +2725,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr,
+ if (ret) {
+ DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n",
+ DIV_ROUND_UP(pbn, mgr->pbn_div), ret);
++ drm_dp_put_port(port);
+ goto out;
+ }
+ DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",
+diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
+index 05eba6dec5ebf..3e8b804cf7e7e 100644
+--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
++++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
+@@ -2124,7 +2124,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
+ DRM_INFO("failed to retrieve link info, disabling eDP\n");
+ cdv_intel_dp_encoder_destroy(encoder);
+ cdv_intel_dp_destroy(connector);
+- goto err_priv;
++ goto err_connector;
+ } else {
+ DRM_DEBUG_KMS("DPCD: Rev=%x LN_Rate=%x LN_CNT=%x LN_DOWNSP=%x\n",
+ intel_dp->dpcd[0], intel_dp->dpcd[1],
+diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+index 21a69b046625a..d15511b521cb7 100644
+--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+@@ -554,6 +554,7 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
+ struct pll_10nm_cached_state *cached = &pll_10nm->cached_state;
+ void __iomem *phy_base = pll_10nm->phy_cmn_mmio;
+ u32 val;
++ int ret;
+
+ val = pll_read(pll_10nm->mmio + REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE);
+ val &= ~0x3;
+@@ -568,6 +569,13 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
+ val |= cached->pll_mux;
+ pll_write(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG1, val);
+
++ ret = dsi_pll_10nm_vco_set_rate(&pll->clk_hw, pll_10nm->vco_current_rate, pll_10nm->vco_ref_clk_rate);
++ if (ret) {
++ DRM_DEV_ERROR(&pll_10nm->pdev->dev,
++ "restore vco rate failed. ret=%d\n", ret);
++ return ret;
++ }
++
+ DBG("DSI PLL%d", pll_10nm->id);
+
+ return 0;
+diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+index e884183c018ac..cb5ce73f72694 100644
+--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+@@ -763,6 +763,7 @@ static int omap_dmm_probe(struct platform_device *dev)
+ &omap_dmm->refill_pa, GFP_KERNEL);
+ if (!omap_dmm->refill_va) {
+ dev_err(&dev->dev, "could not allocate refill memory\n");
++ ret = -ENOMEM;
+ goto fail;
+ }
+
+diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
+index a2bd5876c6335..00808a3d67832 100644
+--- a/drivers/gpu/drm/tegra/drm.c
++++ b/drivers/gpu/drm/tegra/drm.c
+@@ -242,7 +242,7 @@ static int tegra_drm_open(struct drm_device *drm, struct drm_file *filp)
+ if (!fpriv)
+ return -ENOMEM;
+
+- idr_init(&fpriv->contexts);
++ idr_init_base(&fpriv->contexts, 1);
+ mutex_init(&fpriv->lock);
+ filp->driver_priv = fpriv;
+
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index 89cb70da2bfe6..83108e2430501 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -2668,17 +2668,23 @@ static int tegra_sor_init(struct host1x_client *client)
+ if (err < 0) {
+ dev_err(sor->dev, "failed to deassert SOR reset: %d\n",
+ err);
++ clk_disable_unprepare(sor->clk);
+ return err;
+ }
+ }
+
+ err = clk_prepare_enable(sor->clk_safe);
+- if (err < 0)
++ if (err < 0) {
++ clk_disable_unprepare(sor->clk);
+ return err;
++ }
+
+ err = clk_prepare_enable(sor->clk_dp);
+- if (err < 0)
++ if (err < 0) {
++ clk_disable_unprepare(sor->clk_safe);
++ clk_disable_unprepare(sor->clk);
+ return err;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/tve200/tve200_drv.c b/drivers/gpu/drm/tve200/tve200_drv.c
+index ac344ddb23bc8..f93384c232066 100644
+--- a/drivers/gpu/drm/tve200/tve200_drv.c
++++ b/drivers/gpu/drm/tve200/tve200_drv.c
+@@ -223,8 +223,8 @@ static int tve200_probe(struct platform_device *pdev)
+ }
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq) {
+- ret = -EINVAL;
++ if (irq < 0) {
++ ret = irq;
+ goto clk_disable;
+ }
+
+diff --git a/drivers/gpu/drm/xen/xen_drm_front.c b/drivers/gpu/drm/xen/xen_drm_front.c
+index 6b6d5ab82ec3f..1f6c91496d93a 100644
+--- a/drivers/gpu/drm/xen/xen_drm_front.c
++++ b/drivers/gpu/drm/xen/xen_drm_front.c
+@@ -410,7 +410,7 @@ static int xen_drm_drv_dumb_create(struct drm_file *filp,
+ args->size = args->pitch * args->height;
+
+ obj = xen_drm_front_gem_create(dev, args->size);
+- if (IS_ERR_OR_NULL(obj)) {
++ if (IS_ERR(obj)) {
+ ret = PTR_ERR(obj);
+ goto fail;
+ }
+diff --git a/drivers/gpu/drm/xen/xen_drm_front_gem.c b/drivers/gpu/drm/xen/xen_drm_front_gem.c
+index 802662839e7ed..cba7852123d66 100644
+--- a/drivers/gpu/drm/xen/xen_drm_front_gem.c
++++ b/drivers/gpu/drm/xen/xen_drm_front_gem.c
+@@ -85,7 +85,7 @@ static struct xen_gem_object *gem_create(struct drm_device *dev, size_t size)
+
+ size = round_up(size, PAGE_SIZE);
+ xen_obj = gem_create_obj(dev, size);
+- if (IS_ERR_OR_NULL(xen_obj))
++ if (IS_ERR(xen_obj))
+ return xen_obj;
+
+ if (drm_info->front_info->cfg.be_alloc) {
+@@ -119,7 +119,7 @@ static struct xen_gem_object *gem_create(struct drm_device *dev, size_t size)
+ */
+ xen_obj->num_pages = DIV_ROUND_UP(size, PAGE_SIZE);
+ xen_obj->pages = drm_gem_get_pages(&xen_obj->base);
+- if (IS_ERR_OR_NULL(xen_obj->pages)) {
++ if (IS_ERR(xen_obj->pages)) {
+ ret = PTR_ERR(xen_obj->pages);
+ xen_obj->pages = NULL;
+ goto fail;
+@@ -138,7 +138,7 @@ struct drm_gem_object *xen_drm_front_gem_create(struct drm_device *dev,
+ struct xen_gem_object *xen_obj;
+
+ xen_obj = gem_create(dev, size);
+- if (IS_ERR_OR_NULL(xen_obj))
++ if (IS_ERR(xen_obj))
+ return ERR_CAST(xen_obj);
+
+ return &xen_obj->base;
+@@ -196,7 +196,7 @@ xen_drm_front_gem_import_sg_table(struct drm_device *dev,
+
+ size = attach->dmabuf->size;
+ xen_obj = gem_create_obj(dev, size);
+- if (IS_ERR_OR_NULL(xen_obj))
++ if (IS_ERR(xen_obj))
+ return ERR_CAST(xen_obj);
+
+ ret = gem_alloc_pages_array(xen_obj, size);
+diff --git a/drivers/gpu/drm/xen/xen_drm_front_kms.c b/drivers/gpu/drm/xen/xen_drm_front_kms.c
+index a3479eb72d794..d9700c69e5b7f 100644
+--- a/drivers/gpu/drm/xen/xen_drm_front_kms.c
++++ b/drivers/gpu/drm/xen/xen_drm_front_kms.c
+@@ -59,7 +59,7 @@ fb_create(struct drm_device *dev, struct drm_file *filp,
+ int ret;
+
+ fb = drm_gem_fb_create_with_funcs(dev, filp, mode_cmd, &fb_funcs);
+- if (IS_ERR_OR_NULL(fb))
++ if (IS_ERR(fb))
+ return fb;
+
+ gem_obj = drm_gem_object_lookup(filp, mode_cmd->handles[0]);
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index f98c1e1b1dbdc..58a753ef27175 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -397,6 +397,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ .ident = "Vero K147",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VERO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "K147"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ { } /* Terminate list */
+ };
+
+diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
+index 41a09f506803d..129c5e6bc6547 100644
+--- a/drivers/hsi/controllers/omap_ssi_core.c
++++ b/drivers/hsi/controllers/omap_ssi_core.c
+@@ -389,7 +389,7 @@ static int ssi_add_controller(struct hsi_controller *ssi,
+
+ err = ida_simple_get(&platform_omap_ssi_ida, 0, 0, GFP_KERNEL);
+ if (err < 0)
+- goto out_err;
++ return err;
+ ssi->id = err;
+
+ ssi->owner = THIS_MODULE;
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+index 3b684687b5a7d..9a3cb07555e3b 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -183,6 +183,8 @@ static int tmc_pages_alloc(struct tmc_pages *tmc_pages,
+ } else {
+ page = alloc_pages_node(node,
+ GFP_KERNEL | __GFP_ZERO, 0);
++ if (!page)
++ goto err;
+ }
+ paddr = dma_map_page(dev, page, 0, PAGE_SIZE, dir);
+ if (dma_mapping_error(dev, paddr))
+diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
+index 1f98566d5b3c1..5ae3ce60a33f7 100644
+--- a/drivers/iio/adc/rockchip_saradc.c
++++ b/drivers/iio/adc/rockchip_saradc.c
+@@ -383,7 +383,7 @@ static int rockchip_saradc_resume(struct device *dev)
+
+ ret = clk_prepare_enable(info->clk);
+ if (ret)
+- return ret;
++ clk_disable_unprepare(info->pclk);
+
+ return ret;
+ }
+diff --git a/drivers/iio/imu/bmi160/bmi160_core.c b/drivers/iio/imu/bmi160/bmi160_core.c
+index c85659ca95078..e95d817c83905 100644
+--- a/drivers/iio/imu/bmi160/bmi160_core.c
++++ b/drivers/iio/imu/bmi160/bmi160_core.c
+@@ -385,8 +385,8 @@ static irqreturn_t bmi160_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct bmi160_data *data = iio_priv(indio_dev);
+- __le16 buf[16];
+- /* 3 sens x 3 axis x __le16 + 3 x __le16 pad + 4 x __le16 tstamp */
++ __le16 buf[12];
++ /* 2 sens x 3 axis x __le16 + 2 x __le16 pad + 4 x __le16 tstamp */
+ int i, ret, j = 0, base = BMI160_REG_DATA_MAGN_XOUT_L;
+ __le16 sample;
+
+diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
+index a0d089afa1a21..61b9e1bbcc318 100644
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -850,12 +850,12 @@ static int iio_buffer_update_demux(struct iio_dev *indio_dev,
+ indio_dev->masklength,
+ in_ind + 1);
+ while (in_ind != out_ind) {
+- in_ind = find_next_bit(indio_dev->active_scan_mask,
+- indio_dev->masklength,
+- in_ind + 1);
+ length = iio_storage_bytes_for_si(indio_dev, in_ind);
+ /* Make sure we are aligned */
+ in_loc = roundup(in_loc, length) + length;
++ in_ind = find_next_bit(indio_dev->active_scan_mask,
++ indio_dev->masklength,
++ in_ind + 1);
+ }
+ length = iio_storage_bytes_for_si(indio_dev, in_ind);
+ out_loc = roundup(out_loc, length);
+diff --git a/drivers/iio/light/rpr0521.c b/drivers/iio/light/rpr0521.c
+index ffe9ce798ea2d..d61c0645244ed 100644
+--- a/drivers/iio/light/rpr0521.c
++++ b/drivers/iio/light/rpr0521.c
+@@ -197,6 +197,17 @@ struct rpr0521_data {
+ bool pxs_need_dis;
+
+ struct regmap *regmap;
++
++ /*
++ * Ensure correct naturally aligned timestamp.
++ * Note that the read will put garbage data into
++ * the padding but this should not be a problem
++ */
++ struct {
++ __le16 channels[3];
++ u8 garbage;
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ static IIO_CONST_ATTR(in_intensity_scale_available, RPR0521_ALS_SCALE_AVAIL);
+@@ -452,8 +463,6 @@ static irqreturn_t rpr0521_trigger_consumer_handler(int irq, void *p)
+ struct rpr0521_data *data = iio_priv(indio_dev);
+ int err;
+
+- u8 buffer[16]; /* 3 16-bit channels + padding + ts */
+-
+ /* Use irq timestamp when reasonable. */
+ if (iio_trigger_using_own(indio_dev) && data->irq_timestamp) {
+ pf->timestamp = data->irq_timestamp;
+@@ -464,11 +473,11 @@ static irqreturn_t rpr0521_trigger_consumer_handler(int irq, void *p)
+ pf->timestamp = iio_get_time_ns(indio_dev);
+
+ err = regmap_bulk_read(data->regmap, RPR0521_REG_PXS_DATA,
+- &buffer,
++ data->scan.channels,
+ (3 * 2) + 1); /* 3 * 16-bit + (discarded) int clear reg. */
+ if (!err)
+ iio_push_to_buffers_with_timestamp(indio_dev,
+- buffer, pf->timestamp);
++ &data->scan, pf->timestamp);
+ else
+ dev_err(&data->client->dev,
+ "Trigger consumer can't read from sensor.\n");
+diff --git a/drivers/iio/light/st_uvis25.h b/drivers/iio/light/st_uvis25.h
+index 5e970ab480cda..f9bb7a5755dda 100644
+--- a/drivers/iio/light/st_uvis25.h
++++ b/drivers/iio/light/st_uvis25.h
+@@ -28,6 +28,11 @@ struct st_uvis25_hw {
+ struct iio_trigger *trig;
+ bool enabled;
+ int irq;
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ u8 chan;
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ extern const struct dev_pm_ops st_uvis25_pm_ops;
+diff --git a/drivers/iio/light/st_uvis25_core.c b/drivers/iio/light/st_uvis25_core.c
+index 302635836e6ba..815211e024a8b 100644
+--- a/drivers/iio/light/st_uvis25_core.c
++++ b/drivers/iio/light/st_uvis25_core.c
+@@ -235,17 +235,19 @@ static const struct iio_buffer_setup_ops st_uvis25_buffer_ops = {
+
+ static irqreturn_t st_uvis25_buffer_handler_thread(int irq, void *p)
+ {
+- u8 buffer[ALIGN(sizeof(u8), sizeof(s64)) + sizeof(s64)];
+ struct iio_poll_func *pf = p;
+ struct iio_dev *iio_dev = pf->indio_dev;
+ struct st_uvis25_hw *hw = iio_priv(iio_dev);
++ unsigned int val;
+ int err;
+
+- err = regmap_read(hw->regmap, ST_UVIS25_REG_OUT_ADDR, (int *)buffer);
++ err = regmap_read(hw->regmap, ST_UVIS25_REG_OUT_ADDR, &val);
+ if (err < 0)
+ goto out;
+
+- iio_push_to_buffers_with_timestamp(iio_dev, buffer,
++ hw->scan.chan = val;
++
++ iio_push_to_buffers_with_timestamp(iio_dev, &hw->scan,
+ iio_get_time_ns(iio_dev));
+
+ out:
+diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c
+index 7537547fb7eeb..bd001062dc65e 100644
+--- a/drivers/iio/pressure/mpl3115.c
++++ b/drivers/iio/pressure/mpl3115.c
+@@ -147,7 +147,14 @@ static irqreturn_t mpl3115_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct mpl3115_data *data = iio_priv(indio_dev);
+- u8 buffer[16]; /* 32-bit channel + 16-bit channel + padding + ts */
++ /*
++ * 32-bit channel + 16-bit channel + padding + ts
++ * Note that it is possible for only one of the first 2
++ * channels to be enabled. If that happens, the first element
++ * of the buffer may be either 16 or 32-bits. As such we cannot
++ * use a simple structure definition to express this data layout.
++ */
++ u8 buffer[16] __aligned(8);
+ int ret, pos = 0;
+
+ mutex_lock(&data->lock);
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 4ebf63360a697..9bdb3fd97d264 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1443,6 +1443,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
+ id.local_id);
+ if (IS_ERR(cm_id_priv->timewait_info)) {
+ ret = PTR_ERR(cm_id_priv->timewait_info);
++ cm_id_priv->timewait_info = NULL;
+ goto out;
+ }
+
+@@ -1969,6 +1970,7 @@ static int cm_req_handler(struct cm_work *work)
+ id.local_id);
+ if (IS_ERR(cm_id_priv->timewait_info)) {
+ ret = PTR_ERR(cm_id_priv->timewait_info);
++ cm_id_priv->timewait_info = NULL;
+ goto destroy;
+ }
+ cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index 957da3ffe593c..f8c9caa8aad6d 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -1838,6 +1838,7 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
+ goto out;
+ }
+ qp_attr->qp_state = __to_ib_qp_state(qplib_qp->state);
++ qp_attr->cur_qp_state = __to_ib_qp_state(qplib_qp->cur_qp_state);
+ qp_attr->en_sqd_async_notify = qplib_qp->en_sqd_async_notify ? 1 : 0;
+ qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp->access);
+ qp_attr->pkey_index = qplib_qp->pkey_index;
+diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
+index 1fd8798d91a73..43c611aa068c7 100644
+--- a/drivers/infiniband/hw/cxgb4/cq.c
++++ b/drivers/infiniband/hw/cxgb4/cq.c
+@@ -1012,6 +1012,9 @@ struct ib_cq *c4iw_create_cq(struct ib_device *ibdev,
+
+ rhp = to_c4iw_dev(ibdev);
+
++ if (entries < 1 || entries > ibdev->attrs.max_cqe)
++ return ERR_PTR(-EINVAL);
++
+ if (vector >= rhp->rdev.lldi.nciq)
+ return ERR_PTR(-EINVAL);
+
+diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
+index a5694dec3f2ee..098653b8157ed 100644
+--- a/drivers/infiniband/hw/mthca/mthca_cq.c
++++ b/drivers/infiniband/hw/mthca/mthca_cq.c
+@@ -609,7 +609,7 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
+ entry->byte_len = MTHCA_ATOMIC_BYTE_LEN;
+ break;
+ default:
+- entry->opcode = MTHCA_OPCODE_INVALID;
++ entry->opcode = 0xFF;
+ break;
+ }
+ } else {
+diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
+index 220a3e4717a35..e23575861f287 100644
+--- a/drivers/infiniband/hw/mthca/mthca_dev.h
++++ b/drivers/infiniband/hw/mthca/mthca_dev.h
+@@ -105,7 +105,6 @@ enum {
+ MTHCA_OPCODE_ATOMIC_CS = 0x11,
+ MTHCA_OPCODE_ATOMIC_FA = 0x12,
+ MTHCA_OPCODE_BIND_MW = 0x18,
+- MTHCA_OPCODE_INVALID = 0xff
+ };
+
+ enum {
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 1c1eae0ef8c28..63db49144f62b 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -664,7 +664,8 @@ next_wqe:
+ }
+
+ if (unlikely(qp_type(qp) == IB_QPT_RC &&
+- qp->req.psn > (qp->comp.psn + RXE_MAX_UNACKED_PSNS))) {
++ psn_compare(qp->req.psn, (qp->comp.psn +
++ RXE_MAX_UNACKED_PSNS)) > 0)) {
+ qp->req.wait_psn = 1;
+ goto exit;
+ }
+diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
+index d560011815983..1edf0e8322ccc 100644
+--- a/drivers/input/keyboard/cros_ec_keyb.c
++++ b/drivers/input/keyboard/cros_ec_keyb.c
+@@ -183,6 +183,7 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev,
+ "changed: [r%d c%d]: byte %02x\n",
+ row, col, new_state);
+
++ input_event(idev, EV_MSC, MSC_SCAN, pos);
+ input_report_key(idev, keycodes[pos],
+ new_state);
+ }
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index aeeef50cef9bb..adb1ecc969eeb 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -199,12 +199,8 @@ static int omap4_keypad_open(struct input_dev *input)
+ return 0;
+ }
+
+-static void omap4_keypad_close(struct input_dev *input)
++static void omap4_keypad_stop(struct omap4_keypad *keypad_data)
+ {
+- struct omap4_keypad *keypad_data = input_get_drvdata(input);
+-
+- disable_irq(keypad_data->irq);
+-
+ /* Disable interrupts and wake-up events */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+ OMAP4_VAL_IRQDISABLE);
+@@ -213,7 +209,15 @@ static void omap4_keypad_close(struct input_dev *input)
+ /* clear pending interrupts */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
++}
++
++static void omap4_keypad_close(struct input_dev *input)
++{
++ struct omap4_keypad *keypad_data;
+
++ keypad_data = input_get_drvdata(input);
++ disable_irq(keypad_data->irq);
++ omap4_keypad_stop(keypad_data);
+ enable_irq(keypad_data->irq);
+
+ pm_runtime_put_sync(input->dev.parent);
+@@ -236,13 +240,37 @@ static int omap4_keypad_parse_dt(struct device *dev,
+ return 0;
+ }
+
++static int omap4_keypad_check_revision(struct device *dev,
++ struct omap4_keypad *keypad_data)
++{
++ unsigned int rev;
++
++ rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
++ rev &= 0x03 << 30;
++ rev >>= 30;
++ switch (rev) {
++ case KBD_REVISION_OMAP4:
++ keypad_data->reg_offset = 0x00;
++ keypad_data->irqreg_offset = 0x00;
++ break;
++ case KBD_REVISION_OMAP5:
++ keypad_data->reg_offset = 0x10;
++ keypad_data->irqreg_offset = 0x0c;
++ break;
++ default:
++ dev_err(dev, "Keypad reports unsupported revision %d", rev);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ static int omap4_keypad_probe(struct platform_device *pdev)
+ {
+ struct omap4_keypad *keypad_data;
+ struct input_dev *input_dev;
+ struct resource *res;
+ unsigned int max_keys;
+- int rev;
+ int irq;
+ int error;
+
+@@ -282,41 +310,33 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+ goto err_release_mem;
+ }
+
++ pm_runtime_enable(&pdev->dev);
+
+ /*
+ * Enable clocks for the keypad module so that we can read
+ * revision register.
+ */
+- pm_runtime_enable(&pdev->dev);
+ error = pm_runtime_get_sync(&pdev->dev);
+ if (error) {
+ dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
+- goto err_unmap;
+- }
+- rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
+- rev &= 0x03 << 30;
+- rev >>= 30;
+- switch (rev) {
+- case KBD_REVISION_OMAP4:
+- keypad_data->reg_offset = 0x00;
+- keypad_data->irqreg_offset = 0x00;
+- break;
+- case KBD_REVISION_OMAP5:
+- keypad_data->reg_offset = 0x10;
+- keypad_data->irqreg_offset = 0x0c;
+- break;
+- default:
+- dev_err(&pdev->dev,
+- "Keypad reports unsupported revision %d", rev);
+- error = -EINVAL;
+- goto err_pm_put_sync;
++ pm_runtime_put_noidle(&pdev->dev);
++ } else {
++ error = omap4_keypad_check_revision(&pdev->dev,
++ keypad_data);
++ if (!error) {
++ /* Ensure device does not raise interrupts */
++ omap4_keypad_stop(keypad_data);
++ }
++ pm_runtime_put_sync(&pdev->dev);
+ }
++ if (error)
++ goto err_pm_disable;
+
+ /* input device allocation */
+ keypad_data->input = input_dev = input_allocate_device();
+ if (!input_dev) {
+ error = -ENOMEM;
+- goto err_pm_put_sync;
++ goto err_pm_disable;
+ }
+
+ input_dev->name = pdev->name;
+@@ -362,28 +382,25 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+ goto err_free_keymap;
+ }
+
+- device_init_wakeup(&pdev->dev, true);
+- pm_runtime_put_sync(&pdev->dev);
+-
+ error = input_register_device(keypad_data->input);
+ if (error < 0) {
+ dev_err(&pdev->dev, "failed to register input device\n");
+- goto err_pm_disable;
++ goto err_free_irq;
+ }
+
++ device_init_wakeup(&pdev->dev, true);
+ platform_set_drvdata(pdev, keypad_data);
++
+ return 0;
+
+-err_pm_disable:
+- pm_runtime_disable(&pdev->dev);
++err_free_irq:
+ free_irq(keypad_data->irq, keypad_data);
+ err_free_keymap:
+ kfree(keypad_data->keymap);
+ err_free_input:
+ input_free_device(input_dev);
+-err_pm_put_sync:
+- pm_runtime_put_sync(&pdev->dev);
+-err_unmap:
++err_pm_disable:
++ pm_runtime_disable(&pdev->dev);
+ iounmap(keypad_data->base);
+ err_release_mem:
+ release_mem_region(res->start, resource_size(res));
+diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
+index 23c191a2a0715..cf4d507efaf6d 100644
+--- a/drivers/input/misc/cm109.c
++++ b/drivers/input/misc/cm109.c
+@@ -571,12 +571,15 @@ static int cm109_input_open(struct input_dev *idev)
+ dev->ctl_data->byte[HID_OR2] = dev->keybit;
+ dev->ctl_data->byte[HID_OR3] = 0x00;
+
++ dev->ctl_urb_pending = 1;
+ error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL);
+- if (error)
++ if (error) {
++ dev->ctl_urb_pending = 0;
+ dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n",
+ __func__, error);
+- else
++ } else {
+ dev->open = 1;
++ }
+
+ mutex_unlock(&dev->pm_mutex);
+
+diff --git a/drivers/input/mouse/cyapa_gen6.c b/drivers/input/mouse/cyapa_gen6.c
+index c1b524ab46232..ba50f57134239 100644
+--- a/drivers/input/mouse/cyapa_gen6.c
++++ b/drivers/input/mouse/cyapa_gen6.c
+@@ -573,7 +573,7 @@ static int cyapa_pip_retrieve_data_structure(struct cyapa *cyapa,
+
+ memset(&cmd, 0, sizeof(cmd));
+ put_unaligned_le16(PIP_OUTPUT_REPORT_ADDR, &cmd.head.addr);
+- put_unaligned_le16(sizeof(cmd), &cmd.head.length - 2);
++ put_unaligned_le16(sizeof(cmd) - 2, &cmd.head.length);
+ cmd.head.report_id = PIP_APP_CMD_REPORT_ID;
+ cmd.head.cmd_code = PIP_RETRIEVE_DATA_STRUCTURE;
+ put_unaligned_le16(read_offset, &cmd.read_offset);
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index adb8b23a63934..b256e3006a6fb 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -615,6 +615,48 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "AOA150"),
+ },
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A114-31"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A314-31"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A315-31"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-132"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-332"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-432"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate Spin B118-RN"),
++ },
++ },
+ {
+ /* Advent 4211 */
+ .matches = {
+diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
+index a2f45aefce08a..b536768234b7c 100644
+--- a/drivers/input/touchscreen/ads7846.c
++++ b/drivers/input/touchscreen/ads7846.c
+@@ -35,6 +35,7 @@
+ #include <linux/regulator/consumer.h>
+ #include <linux/module.h>
+ #include <asm/irq.h>
++#include <asm/unaligned.h>
+
+ /*
+ * This code has been heavily tested on a Nokia 770, and lightly
+@@ -199,6 +200,26 @@ struct ads7846 {
+ #define REF_ON (READ_12BIT_DFR(x, 1, 1))
+ #define REF_OFF (READ_12BIT_DFR(y, 0, 0))
+
++static int get_pendown_state(struct ads7846 *ts)
++{
++ if (ts->get_pendown_state)
++ return ts->get_pendown_state();
++
++ return !gpio_get_value(ts->gpio_pendown);
++}
++
++static void ads7846_report_pen_up(struct ads7846 *ts)
++{
++ struct input_dev *input = ts->input;
++
++ input_report_key(input, BTN_TOUCH, 0);
++ input_report_abs(input, ABS_PRESSURE, 0);
++ input_sync(input);
++
++ ts->pendown = false;
++ dev_vdbg(&ts->spi->dev, "UP\n");
++}
++
+ /* Must be called with ts->lock held */
+ static void ads7846_stop(struct ads7846 *ts)
+ {
+@@ -215,6 +236,10 @@ static void ads7846_stop(struct ads7846 *ts)
+ static void ads7846_restart(struct ads7846 *ts)
+ {
+ if (!ts->disabled && !ts->suspended) {
++ /* Check if pen was released since last stop */
++ if (ts->pendown && !get_pendown_state(ts))
++ ads7846_report_pen_up(ts);
++
+ /* Tell IRQ thread that it may poll the device. */
+ ts->stopped = false;
+ mb();
+@@ -410,7 +435,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command)
+
+ if (status == 0) {
+ /* BE12 value, then padding */
+- status = be16_to_cpu(*((u16 *)&req->sample[1]));
++ status = get_unaligned_be16(&req->sample[1]);
+ status = status >> 3;
+ status &= 0x0fff;
+ }
+@@ -605,14 +630,6 @@ static const struct attribute_group ads784x_attr_group = {
+
+ /*--------------------------------------------------------------------------*/
+
+-static int get_pendown_state(struct ads7846 *ts)
+-{
+- if (ts->get_pendown_state)
+- return ts->get_pendown_state();
+-
+- return !gpio_get_value(ts->gpio_pendown);
+-}
+-
+ static void null_wait_for_sync(void)
+ {
+ }
+@@ -785,10 +802,11 @@ static void ads7846_report_state(struct ads7846 *ts)
+ /* compute touch pressure resistance using equation #2 */
+ Rt = z2;
+ Rt -= z1;
+- Rt *= x;
+ Rt *= ts->x_plate_ohms;
++ Rt = DIV_ROUND_CLOSEST(Rt, 16);
++ Rt *= x;
+ Rt /= z1;
+- Rt = (Rt + 2047) >> 12;
++ Rt = DIV_ROUND_CLOSEST(Rt, 256);
+ } else {
+ Rt = 0;
+ }
+@@ -871,16 +889,8 @@ static irqreturn_t ads7846_irq(int irq, void *handle)
+ msecs_to_jiffies(TS_POLL_PERIOD));
+ }
+
+- if (ts->pendown && !ts->stopped) {
+- struct input_dev *input = ts->input;
+-
+- input_report_key(input, BTN_TOUCH, 0);
+- input_report_abs(input, ABS_PRESSURE, 0);
+- input_sync(input);
+-
+- ts->pendown = false;
+- dev_vdbg(&ts->spi->dev, "UP\n");
+- }
++ if (ts->pendown && !ts->stopped)
++ ads7846_report_pen_up(ts);
+
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
+index b20ba65992735..7e480e2364216 100644
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -136,6 +136,18 @@ static const struct dmi_system_id rotated_screen[] = {
+ DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"),
+ },
+ },
++ {
++ .ident = "Teclast X98 Pro",
++ .matches = {
++ /*
++ * Only match BIOS date, because the manufacturers
++ * BIOS does not report the board name at all
++ * (sometimes)...
++ */
++ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"),
++ DMI_MATCH(DMI_BIOS_DATE, "10/28/2015"),
++ },
++ },
+ {
+ .ident = "WinBook TW100",
+ .matches = {
+diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
+index 23a3b877f7f1d..ede02dc2bcd0b 100644
+--- a/drivers/irqchip/irq-alpine-msi.c
++++ b/drivers/irqchip/irq-alpine-msi.c
+@@ -165,8 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain,
+ return 0;
+
+ err_sgi:
+- while (--i >= 0)
+- irq_domain_free_irqs_parent(domain, virq, i);
++ irq_domain_free_irqs_parent(domain, virq, i - 1);
+ alpine_msix_free_sgi(priv, sgi, nr_irqs);
+ return err;
+ }
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index d5cc32e80f5e2..cd58c123f547e 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -49,7 +49,6 @@
+ #define ITS_FLAGS_CMDQ_NEEDS_FLUSHING (1ULL << 0)
+ #define ITS_FLAGS_WORKAROUND_CAVIUM_22375 (1ULL << 1)
+ #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2)
+-#define ITS_FLAGS_SAVE_SUSPEND_STATE (1ULL << 3)
+
+ #define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING (1 << 0)
+
+@@ -3240,9 +3239,6 @@ static int its_save_disable(void)
+ list_for_each_entry(its, &its_nodes, entry) {
+ void __iomem *base;
+
+- if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE))
+- continue;
+-
+ base = its->base;
+ its->ctlr_save = readl_relaxed(base + GITS_CTLR);
+ err = its_force_quiescent(base);
+@@ -3261,9 +3257,6 @@ err:
+ list_for_each_entry_continue_reverse(its, &its_nodes, entry) {
+ void __iomem *base;
+
+- if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE))
+- continue;
+-
+ base = its->base;
+ writel_relaxed(its->ctlr_save, base + GITS_CTLR);
+ }
+@@ -3283,9 +3276,6 @@ static void its_restore_enable(void)
+ void __iomem *base;
+ int i;
+
+- if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE))
+- continue;
+-
+ base = its->base;
+
+ /*
+@@ -3293,7 +3283,10 @@ static void its_restore_enable(void)
+ * don't restore it since writing to CBASER or BASER<n>
+ * registers is undefined according to the GIC v3 ITS
+ * Specification.
++ *
++ * Firmware resuming with the ITS enabled is terminally broken.
+ */
++ WARN_ON(readl_relaxed(base + GITS_CTLR) & GITS_CTLR_ENABLE);
+ ret = its_force_quiescent(base);
+ if (ret) {
+ pr_err("ITS@%pa: failed to quiesce on resume: %d\n",
+@@ -3558,9 +3551,6 @@ static int __init its_probe_one(struct resource *res,
+ ctlr |= GITS_CTLR_ImDe;
+ writel_relaxed(ctlr, its->base + GITS_CTLR);
+
+- if (GITS_TYPER_HCC(typer))
+- its->flags |= ITS_FLAGS_SAVE_SUSPEND_STATE;
+-
+ err = its_init_domain(handle, its);
+ if (err)
+ goto out_free_tables;
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index f666778ad2372..439277f48ff8b 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1575,6 +1575,7 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para
+
+ if (!argc) {
+ DMWARN("Empty message received.");
++ r = -EINVAL;
+ goto out_argv;
+ }
+
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 36275c59e4e7b..f849db3035a05 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1336,12 +1336,6 @@ void dm_table_event_callback(struct dm_table *t,
+
+ void dm_table_event(struct dm_table *t)
+ {
+- /*
+- * You can no longer call dm_table_event() from interrupt
+- * context, use a bottom half instead.
+- */
+- BUG_ON(in_interrupt());
+-
+ mutex_lock(&_event_lock);
+ if (t->event_fn)
+ t->event_fn(t->event_context);
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index 4522e87d9d68d..107f36b9155fa 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -669,9 +669,27 @@ out:
+ * Takes the lock on the TOKEN lock resource so no other
+ * node can communicate while the operation is underway.
+ */
+-static int lock_token(struct md_cluster_info *cinfo, bool mddev_locked)
++static int lock_token(struct md_cluster_info *cinfo)
+ {
+- int error, set_bit = 0;
++ int error;
++
++ error = dlm_lock_sync(cinfo->token_lockres, DLM_LOCK_EX);
++ if (error) {
++ pr_err("md-cluster(%s:%d): failed to get EX on TOKEN (%d)\n",
++ __func__, __LINE__, error);
++ } else {
++ /* Lock the receive sequence */
++ mutex_lock(&cinfo->recv_mutex);
++ }
++ return error;
++}
++
++/* lock_comm()
++ * Sets the MD_CLUSTER_SEND_LOCK bit to lock the send channel.
++ */
++static int lock_comm(struct md_cluster_info *cinfo, bool mddev_locked)
++{
++ int rv, set_bit = 0;
+ struct mddev *mddev = cinfo->mddev;
+
+ /*
+@@ -682,34 +700,19 @@ static int lock_token(struct md_cluster_info *cinfo, bool mddev_locked)
+ */
+ if (mddev_locked && !test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
+ &cinfo->state)) {
+- error = test_and_set_bit_lock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
++ rv = test_and_set_bit_lock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD,
+ &cinfo->state);
+- WARN_ON_ONCE(error);
++ WARN_ON_ONCE(rv);
+ md_wakeup_thread(mddev->thread);
+ set_bit = 1;
+ }
+- error = dlm_lock_sync(cinfo->token_lockres, DLM_LOCK_EX);
+- if (set_bit)
+- clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
+
+- if (error)
+- pr_err("md-cluster(%s:%d): failed to get EX on TOKEN (%d)\n",
+- __func__, __LINE__, error);
+-
+- /* Lock the receive sequence */
+- mutex_lock(&cinfo->recv_mutex);
+- return error;
+-}
+-
+-/* lock_comm()
+- * Sets the MD_CLUSTER_SEND_LOCK bit to lock the send channel.
+- */
+-static int lock_comm(struct md_cluster_info *cinfo, bool mddev_locked)
+-{
+ wait_event(cinfo->wait,
+ !test_and_set_bit(MD_CLUSTER_SEND_LOCK, &cinfo->state));
+-
+- return lock_token(cinfo, mddev_locked);
++ rv = lock_token(cinfo);
++ if (set_bit)
++ clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
++ return rv;
+ }
+
+ static void unlock_comm(struct md_cluster_info *cinfo)
+@@ -789,9 +792,11 @@ static int sendmsg(struct md_cluster_info *cinfo, struct cluster_msg *cmsg,
+ {
+ int ret;
+
+- lock_comm(cinfo, mddev_locked);
+- ret = __sendmsg(cinfo, cmsg);
+- unlock_comm(cinfo);
++ ret = lock_comm(cinfo, mddev_locked);
++ if (!ret) {
++ ret = __sendmsg(cinfo, cmsg);
++ unlock_comm(cinfo);
++ }
+ return ret;
+ }
+
+@@ -1063,7 +1068,7 @@ static int metadata_update_start(struct mddev *mddev)
+ return 0;
+ }
+
+- ret = lock_token(cinfo, 1);
++ ret = lock_token(cinfo);
+ clear_bit_unlock(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state);
+ return ret;
+ }
+@@ -1181,7 +1186,10 @@ static void update_size(struct mddev *mddev, sector_t old_dev_sectors)
+ int raid_slot = -1;
+
+ md_update_sb(mddev, 1);
+- lock_comm(cinfo, 1);
++ if (lock_comm(cinfo, 1)) {
++ pr_err("%s: lock_comm failed\n", __func__);
++ return;
++ }
+
+ memset(&cmsg, 0, sizeof(cmsg));
+ cmsg.type = cpu_to_le32(METADATA_UPDATED);
+@@ -1330,7 +1338,8 @@ static int add_new_disk(struct mddev *mddev, struct md_rdev *rdev)
+ cmsg.type = cpu_to_le32(NEWDISK);
+ memcpy(cmsg.uuid, uuid, 16);
+ cmsg.raid_slot = cpu_to_le32(rdev->desc_nr);
+- lock_comm(cinfo, 1);
++ if (lock_comm(cinfo, 1))
++ return -EAGAIN;
+ ret = __sendmsg(cinfo, &cmsg);
+ if (ret) {
+ unlock_comm(cinfo);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index a4e7e6c025d9c..80ca13594c182 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6564,8 +6564,10 @@ static int hot_remove_disk(struct mddev *mddev, dev_t dev)
+ goto busy;
+
+ kick_rdev:
+- if (mddev_is_clustered(mddev))
+- md_cluster_ops->remove_disk(mddev, rdev);
++ if (mddev_is_clustered(mddev)) {
++ if (md_cluster_ops->remove_disk(mddev, rdev))
++ goto busy;
++ }
+
+ md_kick_rdev_from_array(rdev);
+ set_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags);
+@@ -6895,6 +6897,7 @@ static int update_raid_disks(struct mddev *mddev, int raid_disks)
+ return -EINVAL;
+ if (mddev->sync_thread ||
+ test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
++ test_bit(MD_RESYNCING_REMOTE, &mddev->recovery) ||
+ mddev->reshape_position != MaxSector)
+ return -EBUSY;
+
+@@ -7214,8 +7217,11 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
+ err = -EBUSY;
+ goto out;
+ }
+- WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags));
+- set_bit(MD_CLOSING, &mddev->flags);
++ if (test_and_set_bit(MD_CLOSING, &mddev->flags)) {
++ mutex_unlock(&mddev->open_mutex);
++ err = -EBUSY;
++ goto out;
++ }
+ did_set_md_closing = true;
+ mutex_unlock(&mddev->open_mutex);
+ sync_blockdev(bdev);
+@@ -9238,8 +9244,11 @@ static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)
+ }
+ }
+
+- if (mddev->raid_disks != le32_to_cpu(sb->raid_disks))
+- update_raid_disks(mddev, le32_to_cpu(sb->raid_disks));
++ if (mddev->raid_disks != le32_to_cpu(sb->raid_disks)) {
++ ret = update_raid_disks(mddev, le32_to_cpu(sb->raid_disks));
++ if (ret)
++ pr_warn("md: updating array disks failed. %d\n", ret);
++ }
+
+ /* Finally set the event to be up to date */
+ mddev->events = le64_to_cpu(sb->events);
+diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
+index 43cfd1dbda014..afca47b97c2a2 100644
+--- a/drivers/media/common/siano/smsdvb-main.c
++++ b/drivers/media/common/siano/smsdvb-main.c
+@@ -1180,12 +1180,15 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
+ rc = dvb_create_media_graph(&client->adapter, true);
+ if (rc < 0) {
+ pr_err("dvb_create_media_graph failed %d\n", rc);
+- goto client_error;
++ goto media_graph_error;
+ }
+
+ pr_info("DVB interface registered.\n");
+ return 0;
+
++media_graph_error:
++ smsdvb_debugfs_release(client);
++
+ client_error:
+ dvb_unregister_frontend(&client->frontend);
+
+diff --git a/drivers/media/i2c/max2175.c b/drivers/media/i2c/max2175.c
+index 008a082cb8ad7..dddc5ef50dd4e 100644
+--- a/drivers/media/i2c/max2175.c
++++ b/drivers/media/i2c/max2175.c
+@@ -511,7 +511,7 @@ static void max2175_set_bbfilter(struct max2175 *ctx)
+ }
+ }
+
+-static bool max2175_set_csm_mode(struct max2175 *ctx,
++static int max2175_set_csm_mode(struct max2175 *ctx,
+ enum max2175_csm_mode new_mode)
+ {
+ int ret = max2175_poll_csm_ready(ctx);
+diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+index ca1a4d8e972ec..2ad2870c03ae2 100644
+--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+@@ -801,6 +801,7 @@ static void cio2_vb2_return_all_buffers(struct cio2_queue *q,
+ atomic_dec(&q->bufs_queued);
+ vb2_buffer_done(&q->bufs[i]->vbb.vb2_buf,
+ state);
++ q->bufs[i] = NULL;
+ }
+ }
+ }
+@@ -1245,29 +1246,15 @@ static int cio2_subdev_get_fmt(struct v4l2_subdev *sd,
+ struct v4l2_subdev_format *fmt)
+ {
+ struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev);
+- struct v4l2_subdev_format format;
+- int ret;
+-
+- if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+- fmt->format = *v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+- return 0;
+- }
+
+- if (fmt->pad == CIO2_PAD_SINK) {
+- format.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+- ret = v4l2_subdev_call(sd, pad, get_fmt, NULL,
+- &format);
++ mutex_lock(&q->subdev_lock);
+
+- if (ret)
+- return ret;
+- /* update colorspace etc */
+- q->subdev_fmt.colorspace = format.format.colorspace;
+- q->subdev_fmt.ycbcr_enc = format.format.ycbcr_enc;
+- q->subdev_fmt.quantization = format.format.quantization;
+- q->subdev_fmt.xfer_func = format.format.xfer_func;
+- }
++ if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
++ fmt->format = *v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
++ else
++ fmt->format = q->subdev_fmt;
+
+- fmt->format = q->subdev_fmt;
++ mutex_unlock(&q->subdev_lock);
+
+ return 0;
+ }
+@@ -1284,6 +1271,9 @@ static int cio2_subdev_set_fmt(struct v4l2_subdev *sd,
+ struct v4l2_subdev_format *fmt)
+ {
+ struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev);
++ struct v4l2_mbus_framefmt *mbus;
++ u32 mbus_code = fmt->format.code;
++ unsigned int i;
+
+ /*
+ * Only allow setting sink pad format;
+@@ -1292,16 +1282,29 @@ static int cio2_subdev_set_fmt(struct v4l2_subdev *sd,
+ if (fmt->pad == CIO2_PAD_SOURCE)
+ return cio2_subdev_get_fmt(sd, cfg, fmt);
+
+- if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
+- *v4l2_subdev_get_try_format(sd, cfg, fmt->pad) = fmt->format;
+- } else {
+- /* It's the sink, allow changing frame size */
+- q->subdev_fmt.width = fmt->format.width;
+- q->subdev_fmt.height = fmt->format.height;
+- q->subdev_fmt.code = fmt->format.code;
+- fmt->format = q->subdev_fmt;
++ if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
++ mbus = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
++ else
++ mbus = &q->subdev_fmt;
++
++ fmt->format.code = formats[0].mbus_code;
++
++ for (i = 0; i < ARRAY_SIZE(formats); i++) {
++ if (formats[i].mbus_code == fmt->format.code) {
++ fmt->format.code = mbus_code;
++ break;
++ }
+ }
+
++ fmt->format.width = min_t(u32, fmt->format.width, CIO2_IMAGE_MAX_WIDTH);
++ fmt->format.height = min_t(u32, fmt->format.height,
++ CIO2_IMAGE_MAX_LENGTH);
++ fmt->format.field = V4L2_FIELD_NONE;
++
++ mutex_lock(&q->subdev_lock);
++ *mbus = fmt->format;
++ mutex_unlock(&q->subdev_lock);
++
+ return 0;
+ }
+
+@@ -1549,6 +1552,7 @@ static int cio2_queue_init(struct cio2_device *cio2, struct cio2_queue *q)
+
+ /* Initialize miscellaneous variables */
+ mutex_init(&q->lock);
++ mutex_init(&q->subdev_lock);
+
+ /* Initialize formats to default values */
+ fmt = &q->subdev_fmt;
+@@ -1666,6 +1670,7 @@ fail_vdev_media_entity:
+ fail_subdev_media_entity:
+ cio2_fbpt_exit(q, &cio2->pci_dev->dev);
+ fail_fbpt:
++ mutex_destroy(&q->subdev_lock);
+ mutex_destroy(&q->lock);
+
+ return r;
+@@ -1679,6 +1684,7 @@ static void cio2_queue_exit(struct cio2_device *cio2, struct cio2_queue *q)
+ v4l2_device_unregister_subdev(&q->subdev);
+ media_entity_cleanup(&q->subdev.entity);
+ cio2_fbpt_exit(q, &cio2->pci_dev->dev);
++ mutex_destroy(&q->subdev_lock);
+ mutex_destroy(&q->lock);
+ }
+
+diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.h b/drivers/media/pci/intel/ipu3/ipu3-cio2.h
+index 240635be7a317..b73c016d8a1bc 100644
+--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.h
++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.h
+@@ -334,6 +334,7 @@ struct cio2_queue {
+
+ /* Subdev, /dev/v4l-subdevX */
+ struct v4l2_subdev subdev;
++ struct mutex subdev_lock; /* Serialise acces to subdev_fmt field */
+ struct media_pad subdev_pads[CIO2_PADS];
+ struct v4l2_mbus_framefmt subdev_fmt;
+ atomic_t frame_sequence;
+diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
+index f33c0de3e8490..019bbc18cede6 100644
+--- a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
++++ b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c
+@@ -184,7 +184,7 @@ int netup_spi_init(struct netup_unidvb_dev *ndev)
+ struct spi_master *master;
+ struct netup_spi *nspi;
+
+- master = spi_alloc_master(&ndev->pci_dev->dev,
++ master = devm_spi_alloc_master(&ndev->pci_dev->dev,
+ sizeof(struct netup_spi));
+ if (!master) {
+ dev_err(&ndev->pci_dev->dev,
+@@ -217,6 +217,7 @@ int netup_spi_init(struct netup_unidvb_dev *ndev)
+ ndev->pci_slot,
+ ndev->pci_func);
+ if (!spi_new_device(master, &netup_spi_board)) {
++ spi_unregister_master(master);
+ ndev->spi = NULL;
+ dev_err(&ndev->pci_dev->dev,
+ "%s(): unable to create SPI device\n", __func__);
+@@ -235,13 +236,13 @@ void netup_spi_release(struct netup_unidvb_dev *ndev)
+ if (!spi)
+ return;
+
++ spi_unregister_master(spi->master);
+ spin_lock_irqsave(&spi->lock, flags);
+ reg = readw(&spi->regs->control_stat);
+ writew(reg | NETUP_SPI_CTRL_IRQ, &spi->regs->control_stat);
+ reg = readw(&spi->regs->control_stat);
+ writew(reg & ~NETUP_SPI_CTRL_IMASK, &spi->regs->control_stat);
+ spin_unlock_irqrestore(&spi->lock, flags);
+- spi_unregister_master(spi->master);
+ ndev->spi = NULL;
+ }
+
+diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c
+index 6b5582b7c5955..6e25654da2567 100644
+--- a/drivers/media/pci/saa7146/mxb.c
++++ b/drivers/media/pci/saa7146/mxb.c
+@@ -653,16 +653,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio *
+ struct mxb *mxb = (struct mxb *)dev->ext_priv;
+
+ DEB_D("VIDIOC_S_AUDIO %d\n", a->index);
+- if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) {
+- if (mxb->cur_audinput != a->index) {
+- mxb->cur_audinput = a->index;
+- tea6420_route(mxb, a->index);
+- if (mxb->cur_audinput == 0)
+- mxb_update_audmode(mxb);
+- }
+- return 0;
++ if (a->index >= 32 ||
++ !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index)))
++ return -EINVAL;
++
++ if (mxb->cur_audinput != a->index) {
++ mxb->cur_audinput = a->index;
++ tea6420_route(mxb, a->index);
++ if (mxb->cur_audinput == 0)
++ mxb_update_audmode(mxb);
+ }
+- return -EINVAL;
++ return 0;
+ }
+
+ #ifdef CONFIG_VIDEO_ADV_DEBUG
+diff --git a/drivers/media/pci/solo6x10/solo6x10-g723.c b/drivers/media/pci/solo6x10/solo6x10-g723.c
+index 2ac33b5cc4546..f06e6d35d846c 100644
+--- a/drivers/media/pci/solo6x10/solo6x10-g723.c
++++ b/drivers/media/pci/solo6x10/solo6x10-g723.c
+@@ -410,7 +410,7 @@ int solo_g723_init(struct solo_dev *solo_dev)
+
+ ret = snd_ctl_add(card, snd_ctl_new1(&kctl, solo_dev));
+ if (ret < 0)
+- return ret;
++ goto snd_error;
+
+ ret = solo_snd_pcm_init(solo_dev);
+ if (ret < 0)
+diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+index 79ca03ac449c3..3f64119e8c082 100644
+--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+@@ -103,6 +103,7 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev)
+ void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev)
+ {
+ pm_runtime_disable(dev->pm.dev);
++ put_device(dev->pm.larbvdec);
+ }
+
+ void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm)
+diff --git a/drivers/media/rc/sunxi-cir.c b/drivers/media/rc/sunxi-cir.c
+index f500cea228a95..0114e81fa6fa2 100644
+--- a/drivers/media/rc/sunxi-cir.c
++++ b/drivers/media/rc/sunxi-cir.c
+@@ -129,6 +129,8 @@ static irqreturn_t sunxi_ir_irq(int irqno, void *dev_id)
+ } else if (status & REG_RXINT_RPEI_EN) {
+ ir_raw_event_set_idle(ir->rc, true);
+ ir_raw_event_handle(ir->rc);
++ } else {
++ ir_raw_event_handle(ir->rc);
+ }
+
+ spin_unlock(&ir->ir_lock);
+diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
+index c9a2b29a60a57..93212ed80bf85 100644
+--- a/drivers/media/usb/gspca/gspca.c
++++ b/drivers/media/usb/gspca/gspca.c
+@@ -1585,6 +1585,7 @@ out:
+ input_unregister_device(gspca_dev->input_dev);
+ #endif
+ v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
++ v4l2_device_unregister(&gspca_dev->v4l2_dev);
+ kfree(gspca_dev->usb_buf);
+ kfree(gspca_dev);
+ return ret;
+diff --git a/drivers/media/usb/msi2500/msi2500.c b/drivers/media/usb/msi2500/msi2500.c
+index 65ef755adfdc1..b2adde978c9be 100644
+--- a/drivers/media/usb/msi2500/msi2500.c
++++ b/drivers/media/usb/msi2500/msi2500.c
+@@ -1250,7 +1250,7 @@ static int msi2500_probe(struct usb_interface *intf,
+ }
+
+ dev->master = master;
+- master->bus_num = 0;
++ master->bus_num = -1;
+ master->num_chipselect = 1;
+ master->transfer_one_message = msi2500_transfer_one_message;
+ spi_master_set_devdata(master, dev);
+diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c
+index 96055de6e8ce2..62f0128419717 100644
+--- a/drivers/media/usb/tm6000/tm6000-video.c
++++ b/drivers/media/usb/tm6000/tm6000-video.c
+@@ -463,11 +463,12 @@ static int tm6000_alloc_urb_buffers(struct tm6000_core *dev)
+ if (dev->urb_buffer)
+ return 0;
+
+- dev->urb_buffer = kmalloc_array(num_bufs, sizeof(void *), GFP_KERNEL);
++ dev->urb_buffer = kmalloc_array(num_bufs, sizeof(*dev->urb_buffer),
++ GFP_KERNEL);
+ if (!dev->urb_buffer)
+ return -ENOMEM;
+
+- dev->urb_dma = kmalloc_array(num_bufs, sizeof(dma_addr_t *),
++ dev->urb_dma = kmalloc_array(num_bufs, sizeof(*dev->urb_dma),
+ GFP_KERNEL);
+ if (!dev->urb_dma)
+ return -ENOMEM;
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index b1564cacd19e1..20ae8652adf44 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -469,7 +469,6 @@ static void memstick_check(struct work_struct *work)
+ host->card = card;
+ if (device_register(&card->dev)) {
+ put_device(&card->dev);
+- kfree(host->card);
+ host->card = NULL;
+ }
+ } else
+diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
+index 627d6e62fe313..4559593ecd5a9 100644
+--- a/drivers/memstick/host/r592.c
++++ b/drivers/memstick/host/r592.c
+@@ -762,8 +762,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto error3;
+
+ dev->mmio = pci_ioremap_bar(pdev, 0);
+- if (!dev->mmio)
++ if (!dev->mmio) {
++ error = -ENOMEM;
+ goto error4;
++ }
+
+ dev->irq = pdev->irq;
+ spin_lock_init(&dev->irq_lock);
+@@ -789,12 +791,14 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ &dev->dummy_dma_page_physical_address, GFP_KERNEL);
+ r592_stop_dma(dev , 0);
+
+- if (request_irq(dev->irq, &r592_irq, IRQF_SHARED,
+- DRV_NAME, dev))
++ error = request_irq(dev->irq, &r592_irq, IRQF_SHARED,
++ DRV_NAME, dev);
++ if (error)
+ goto error6;
+
+ r592_update_card_detect(dev);
+- if (memstick_add_host(host))
++ error = memstick_add_host(host);
++ if (error)
+ goto error7;
+
+ message("driver successfully loaded");
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index c723a1e54b188..90656b625b9a6 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -631,7 +631,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+
+ memcpy(&(idata->ic.response), cmd.resp, sizeof(cmd.resp));
+
+- if (idata->rpmb || (cmd.flags & MMC_RSP_R1B)) {
++ if (idata->rpmb || (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) {
+ /*
+ * Ensure RPMB/R1B command has completed by polling CMD13
+ * "Send Status".
+diff --git a/drivers/mtd/cmdlinepart.c b/drivers/mtd/cmdlinepart.c
+index c29205ee82e20..c24a26fbbffbb 100644
+--- a/drivers/mtd/cmdlinepart.c
++++ b/drivers/mtd/cmdlinepart.c
+@@ -231,7 +231,7 @@ static int mtdpart_setup_real(char *s)
+ struct cmdline_mtd_partition *this_mtd;
+ struct mtd_partition *parts;
+ int mtd_id_len, num_parts;
+- char *p, *mtd_id, *semicol;
++ char *p, *mtd_id, *semicol, *open_parenth;
+
+ /*
+ * Replace the first ';' by a NULL char so strrchr can work
+@@ -241,6 +241,14 @@ static int mtdpart_setup_real(char *s)
+ if (semicol)
+ *semicol = '\0';
+
++ /*
++ * make sure that part-names with ":" will not be handled as
++ * part of the mtd-id with an ":"
++ */
++ open_parenth = strchr(s, '(');
++ if (open_parenth)
++ *open_parenth = '\0';
++
+ mtd_id = s;
+
+ /*
+@@ -250,6 +258,10 @@ static int mtdpart_setup_real(char *s)
+ */
+ p = strrchr(s, ':');
+
++ /* Restore the '(' now. */
++ if (open_parenth)
++ *open_parenth = '(';
++
+ /* Restore the ';' now. */
+ if (semicol)
+ *semicol = ';';
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index 9fcbcf4b217b6..2726f18242333 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -1578,6 +1578,8 @@ static int check_flash_errors(struct qcom_nand_host *host, int cw_cnt)
+ struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
+ int i;
+
++ nandc_read_buffer_sync(nandc, true);
++
+ for (i = 0; i < cw_cnt; i++) {
+ u32 flash = le32_to_cpu(nandc->reg_read_buf[i]);
+
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index 1d61ae7aaa66c..83954f424d413 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -378,6 +378,10 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
+ }
+ }
+
++ if (req->ooblen)
++ memcpy(req->oobbuf.in, spinand->oobbuf + req->ooboffs,
++ req->ooblen);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c
+index e226961905830..bed5ffa75b276 100644
+--- a/drivers/net/can/softing/softing_main.c
++++ b/drivers/net/can/softing/softing_main.c
+@@ -393,8 +393,13 @@ static int softing_netdev_open(struct net_device *ndev)
+
+ /* check or determine and set bittime */
+ ret = open_candev(ndev);
+- if (!ret)
+- ret = softing_startstop(ndev, 1);
++ if (ret)
++ return ret;
++
++ ret = softing_startstop(ndev, 1);
++ if (ret < 0)
++ close_candev(ndev);
++
+ return ret;
+ }
+
+diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
+index c458b81ba63af..d249a4309da2f 100644
+--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
+@@ -847,13 +847,13 @@ static int emac_probe(struct platform_device *pdev)
+ db->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(db->clk)) {
+ ret = PTR_ERR(db->clk);
+- goto out_iounmap;
++ goto out_dispose_mapping;
+ }
+
+ ret = clk_prepare_enable(db->clk);
+ if (ret) {
+ dev_err(&pdev->dev, "Error couldn't enable clock (%d)\n", ret);
+- goto out_iounmap;
++ goto out_dispose_mapping;
+ }
+
+ ret = sunxi_sram_claim(&pdev->dev);
+@@ -910,6 +910,8 @@ out_release_sram:
+ sunxi_sram_release(&pdev->dev);
+ out_clk_disable_unprepare:
+ clk_disable_unprepare(db->clk);
++out_dispose_mapping:
++ irq_dispose_mapping(ndev->irq);
+ out_iounmap:
+ iounmap(db->membase);
+ out:
+@@ -928,6 +930,7 @@ static int emac_remove(struct platform_device *pdev)
+ unregister_netdev(ndev);
+ sunxi_sram_release(&pdev->dev);
+ clk_disable_unprepare(db->clk);
++ irq_dispose_mapping(ndev->irq);
+ iounmap(db->membase);
+ free_netdev(ndev);
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index c7667017c1a3f..c3e824f5e50e8 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -3593,8 +3593,10 @@ static int bcmgenet_probe(struct platform_device *pdev)
+ clk_disable_unprepare(priv->clk);
+
+ err = register_netdev(dev);
+- if (err)
++ if (err) {
++ bcmgenet_mii_exit(dev);
+ goto err;
++ }
+
+ return err;
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 4243ff4ec4b1d..faee77fa08044 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -1943,7 +1943,8 @@ static inline bool ixgbe_page_is_reserved(struct page *page)
+ return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page);
+ }
+
+-static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer)
++static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer,
++ int rx_buffer_pgcnt)
+ {
+ unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;
+ struct page *page = rx_buffer->page;
+@@ -1954,7 +1955,7 @@ static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer)
+
+ #if (PAGE_SIZE < 8192)
+ /* if we are only owner of page we can reuse it */
+- if (unlikely((page_ref_count(page) - pagecnt_bias) > 1))
++ if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1))
+ return false;
+ #else
+ /* The last offset is a bit aggressive in that we assume the
+@@ -2019,11 +2020,18 @@ static void ixgbe_add_rx_frag(struct ixgbe_ring *rx_ring,
+ static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring,
+ union ixgbe_adv_rx_desc *rx_desc,
+ struct sk_buff **skb,
+- const unsigned int size)
++ const unsigned int size,
++ int *rx_buffer_pgcnt)
+ {
+ struct ixgbe_rx_buffer *rx_buffer;
+
+ rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean];
++ *rx_buffer_pgcnt =
++#if (PAGE_SIZE < 8192)
++ page_count(rx_buffer->page);
++#else
++ 0;
++#endif
+ prefetchw(rx_buffer->page);
+ *skb = rx_buffer->skb;
+
+@@ -2053,9 +2061,10 @@ skip_sync:
+
+ static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring,
+ struct ixgbe_rx_buffer *rx_buffer,
+- struct sk_buff *skb)
++ struct sk_buff *skb,
++ int rx_buffer_pgcnt)
+ {
+- if (ixgbe_can_reuse_rx_page(rx_buffer)) {
++ if (ixgbe_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) {
+ /* hand second half of page back to the ring */
+ ixgbe_reuse_rx_page(rx_ring, rx_buffer);
+ } else {
+@@ -2299,6 +2308,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
+ union ixgbe_adv_rx_desc *rx_desc;
+ struct ixgbe_rx_buffer *rx_buffer;
+ struct sk_buff *skb;
++ int rx_buffer_pgcnt;
+ unsigned int size;
+
+ /* return some buffers to hardware, one at a time is too slow */
+@@ -2318,7 +2328,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
+ */
+ dma_rmb();
+
+- rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size);
++ rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size, &rx_buffer_pgcnt);
+
+ /* retrieve a buffer from the ring */
+ if (!skb) {
+@@ -2360,7 +2370,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
+ break;
+ }
+
+- ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb);
++ ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb, rx_buffer_pgcnt);
+ cleaned_count++;
+
+ /* place incomplete frames back on ring for completion */
+diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
+index 993f495e2bf7b..9f804e2aba359 100644
+--- a/drivers/net/ethernet/korina.c
++++ b/drivers/net/ethernet/korina.c
+@@ -219,7 +219,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
+ dev_kfree_skb_any(skb);
+ spin_unlock_irqrestore(&lp->lock, flags);
+
+- return NETDEV_TX_BUSY;
++ return NETDEV_TX_OK;
+ }
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 5868ec11db1af..47eee3e083ece 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1384,8 +1384,10 @@ static void mlx4_en_tx_timeout(struct net_device *dev)
+ }
+
+ priv->port_stats.tx_timeout++;
+- en_dbg(DRV, priv, "Scheduling watchdog\n");
+- queue_work(mdev->workqueue, &priv->watchdog_task);
++ if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state)) {
++ en_dbg(DRV, priv, "Scheduling port restart\n");
++ queue_work(mdev->workqueue, &priv->restart_task);
++ }
+ }
+
+
+@@ -1739,6 +1741,7 @@ int mlx4_en_start_port(struct net_device *dev)
+ mlx4_en_deactivate_cq(priv, cq);
+ goto tx_err;
+ }
++ clear_bit(MLX4_EN_TX_RING_STATE_RECOVERING, &tx_ring->state);
+ if (t != TX_XDP) {
+ tx_ring->tx_queue = netdev_get_tx_queue(dev, i);
+ tx_ring->recycle_ring = NULL;
+@@ -1835,6 +1838,7 @@ int mlx4_en_start_port(struct net_device *dev)
+ local_bh_enable();
+ }
+
++ clear_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state);
+ netif_tx_start_all_queues(dev);
+ netif_device_attach(dev);
+
+@@ -2005,7 +2009,7 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
+ static void mlx4_en_restart(struct work_struct *work)
+ {
+ struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
+- watchdog_task);
++ restart_task);
+ struct mlx4_en_dev *mdev = priv->mdev;
+ struct net_device *dev = priv->dev;
+
+@@ -2387,7 +2391,7 @@ static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
+ if (netif_running(dev)) {
+ mutex_lock(&mdev->state_lock);
+ if (!mdev->device_up) {
+- /* NIC is probably restarting - let watchdog task reset
++ /* NIC is probably restarting - let restart task reset
+ * the port */
+ en_dbg(DRV, priv, "Change MTU called with card down!?\n");
+ } else {
+@@ -2396,7 +2400,9 @@ static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
+ if (err) {
+ en_err(priv, "Failed restarting port:%d\n",
+ priv->port);
+- queue_work(mdev->workqueue, &priv->watchdog_task);
++ if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING,
++ &priv->state))
++ queue_work(mdev->workqueue, &priv->restart_task);
+ }
+ }
+ mutex_unlock(&mdev->state_lock);
+@@ -2882,7 +2888,8 @@ static int mlx4_xdp_set(struct net_device *dev, struct bpf_prog *prog)
+ if (err) {
+ en_err(priv, "Failed starting port %d for XDP change\n",
+ priv->port);
+- queue_work(mdev->workqueue, &priv->watchdog_task);
++ if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state))
++ queue_work(mdev->workqueue, &priv->restart_task);
+ }
+ }
+
+@@ -3280,7 +3287,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ priv->counter_index = MLX4_SINK_COUNTER_INDEX(mdev->dev);
+ spin_lock_init(&priv->stats_lock);
+ INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode);
+- INIT_WORK(&priv->watchdog_task, mlx4_en_restart);
++ INIT_WORK(&priv->restart_task, mlx4_en_restart);
+ INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate);
+ INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats);
+ INIT_DELAYED_WORK(&priv->service_task, mlx4_en_service_task);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+index e58052d07e399..29041d4a3f28e 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+@@ -385,6 +385,35 @@ int mlx4_en_free_tx_buf(struct net_device *dev, struct mlx4_en_tx_ring *ring)
+ return cnt;
+ }
+
++static void mlx4_en_handle_err_cqe(struct mlx4_en_priv *priv, struct mlx4_err_cqe *err_cqe,
++ u16 cqe_index, struct mlx4_en_tx_ring *ring)
++{
++ struct mlx4_en_dev *mdev = priv->mdev;
++ struct mlx4_en_tx_info *tx_info;
++ struct mlx4_en_tx_desc *tx_desc;
++ u16 wqe_index;
++ int desc_size;
++
++ en_err(priv, "CQE error - cqn 0x%x, ci 0x%x, vendor syndrome: 0x%x syndrome: 0x%x\n",
++ ring->sp_cqn, cqe_index, err_cqe->vendor_err_syndrome, err_cqe->syndrome);
++ print_hex_dump(KERN_WARNING, "", DUMP_PREFIX_OFFSET, 16, 1, err_cqe, sizeof(*err_cqe),
++ false);
++
++ wqe_index = be16_to_cpu(err_cqe->wqe_index) & ring->size_mask;
++ tx_info = &ring->tx_info[wqe_index];
++ desc_size = tx_info->nr_txbb << LOG_TXBB_SIZE;
++ en_err(priv, "Related WQE - qpn 0x%x, wqe index 0x%x, wqe size 0x%x\n", ring->qpn,
++ wqe_index, desc_size);
++ tx_desc = ring->buf + (wqe_index << LOG_TXBB_SIZE);
++ print_hex_dump(KERN_WARNING, "", DUMP_PREFIX_OFFSET, 16, 1, tx_desc, desc_size, false);
++
++ if (test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state))
++ return;
++
++ en_err(priv, "Scheduling port restart\n");
++ queue_work(mdev->workqueue, &priv->restart_task);
++}
++
+ bool mlx4_en_process_tx_cq(struct net_device *dev,
+ struct mlx4_en_cq *cq, int napi_budget)
+ {
+@@ -431,13 +460,10 @@ bool mlx4_en_process_tx_cq(struct net_device *dev,
+ dma_rmb();
+
+ if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) ==
+- MLX4_CQE_OPCODE_ERROR)) {
+- struct mlx4_err_cqe *cqe_err = (struct mlx4_err_cqe *)cqe;
+-
+- en_err(priv, "CQE error - vendor syndrome: 0x%x syndrome: 0x%x\n",
+- cqe_err->vendor_err_syndrome,
+- cqe_err->syndrome);
+- }
++ MLX4_CQE_OPCODE_ERROR))
++ if (!test_and_set_bit(MLX4_EN_TX_RING_STATE_RECOVERING, &ring->state))
++ mlx4_en_handle_err_cqe(priv, (struct mlx4_err_cqe *)cqe, index,
++ ring);
+
+ /* Skip over last polled CQE */
+ new_index = be16_to_cpu(cqe->wqe_index) & size_mask;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index 240f9c9ca943d..1a57ea9a7ea59 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -271,6 +271,10 @@ struct mlx4_en_page_cache {
+ } buf[MLX4_EN_CACHE_SIZE];
+ };
+
++enum {
++ MLX4_EN_TX_RING_STATE_RECOVERING,
++};
++
+ struct mlx4_en_priv;
+
+ struct mlx4_en_tx_ring {
+@@ -317,6 +321,7 @@ struct mlx4_en_tx_ring {
+ * Only queue_stopped might be used if BQL is not properly working.
+ */
+ unsigned long queue_stopped;
++ unsigned long state;
+ struct mlx4_hwq_resources sp_wqres;
+ struct mlx4_qp sp_qp;
+ struct mlx4_qp_context sp_context;
+@@ -530,6 +535,10 @@ struct mlx4_en_stats_bitmap {
+ struct mutex mutex; /* for mutual access to stats bitmap */
+ };
+
++enum {
++ MLX4_EN_STATE_FLAG_RESTARTING,
++};
++
+ struct mlx4_en_priv {
+ struct mlx4_en_dev *mdev;
+ struct mlx4_en_port_profile *prof;
+@@ -595,7 +604,7 @@ struct mlx4_en_priv {
+ struct mlx4_en_cq *rx_cq[MAX_RX_RINGS];
+ struct mlx4_qp drop_qp;
+ struct work_struct rx_mode_task;
+- struct work_struct watchdog_task;
++ struct work_struct restart_task;
+ struct work_struct linkstate_task;
+ struct delayed_work stats_task;
+ struct delayed_work service_task;
+@@ -643,6 +652,7 @@ struct mlx4_en_priv {
+ u32 pflags;
+ u8 rss_key[MLX4_EN_RSS_KEY_SIZE];
+ u8 rss_hash_fn;
++ unsigned long state;
+ };
+
+ enum mlx4_en_wol {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 5fac00ea62457..a2b25afa24722 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -51,6 +51,7 @@
+ #ifdef CONFIG_RFS_ACCEL
+ #include <linux/cpu_rmap.h>
+ #endif
++#include <linux/version.h>
+ #include <net/devlink.h>
+ #include "mlx5_core.h"
+ #include "fs_core.h"
+@@ -211,7 +212,10 @@ static void mlx5_set_driver_version(struct mlx5_core_dev *dev)
+ strncat(string, ",", remaining_size);
+
+ remaining_size = max_t(int, 0, driver_ver_sz - strlen(string));
+- strncat(string, DRIVER_VERSION, remaining_size);
++
++ snprintf(string + strlen(string), remaining_size, "%u.%u.%u",
++ (u8)((LINUX_VERSION_CODE >> 16) & 0xff), (u8)((LINUX_VERSION_CODE >> 8) & 0xff),
++ (u16)(LINUX_VERSION_CODE & 0xffff));
+
+ /*Send the command*/
+ MLX5_SET(set_driver_version_in, in, opcode,
+diff --git a/drivers/net/ethernet/microchip/lan743x_ethtool.c b/drivers/net/ethernet/microchip/lan743x_ethtool.c
+index 07c1eb63415a3..190c22cdc4d2b 100644
+--- a/drivers/net/ethernet/microchip/lan743x_ethtool.c
++++ b/drivers/net/ethernet/microchip/lan743x_ethtool.c
+@@ -659,7 +659,9 @@ static void lan743x_ethtool_get_wol(struct net_device *netdev,
+
+ wol->supported = 0;
+ wol->wolopts = 0;
+- phy_ethtool_get_wol(netdev->phydev, wol);
++
++ if (netdev->phydev)
++ phy_ethtool_get_wol(netdev->phydev, wol);
+
+ wol->supported |= WAKE_BCAST | WAKE_UCAST | WAKE_MCAST |
+ WAKE_MAGIC | WAKE_PHY | WAKE_ARP;
+@@ -688,9 +690,8 @@ static int lan743x_ethtool_set_wol(struct net_device *netdev,
+
+ device_set_wakeup_enable(&adapter->pdev->dev, (bool)wol->wolopts);
+
+- phy_ethtool_set_wol(netdev->phydev, wol);
+-
+- return 0;
++ return netdev->phydev ? phy_ethtool_set_wol(netdev->phydev, wol)
++ : -ENETDOWN;
+ }
+ #endif /* CONFIG_PM */
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+index dbd48012224f2..ed34b7d1a9e11 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+@@ -2508,6 +2508,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ qlcnic_sriov_vf_register_map(ahw);
+ break;
+ default:
++ err = -EINVAL;
+ goto err_out_free_hw_res;
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+index 03bda2e0b7a89..5020d5b28c6ad 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+@@ -35,7 +35,6 @@
+ #define PRG_ETH0_EXT_RMII_MODE 4
+
+ /* mux to choose between fclk_div2 (bit unset) and mpll2 (bit set) */
+-#define PRG_ETH0_CLK_M250_SEL_SHIFT 4
+ #define PRG_ETH0_CLK_M250_SEL_MASK GENMASK(4, 4)
+
+ #define PRG_ETH0_TXDLY_SHIFT 5
+@@ -149,8 +148,9 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac)
+ }
+
+ clk_configs->m250_mux.reg = dwmac->regs + PRG_ETH0;
+- clk_configs->m250_mux.shift = PRG_ETH0_CLK_M250_SEL_SHIFT;
+- clk_configs->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK;
++ clk_configs->m250_mux.shift = __ffs(PRG_ETH0_CLK_M250_SEL_MASK);
++ clk_configs->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK >>
++ clk_configs->m250_mux.shift;
+ clk = meson8b_dwmac_register_clk(dwmac, "m250_sel", mux_parent_names,
+ MUX_CLK_NUM_PARENTS, &clk_mux_ops,
+ &clk_configs->m250_mux.hw);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 2872684906e14..4ac507b4d1019 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -1428,6 +1428,19 @@ static void dma_free_tx_skbufs(struct stmmac_priv *priv, u32 queue)
+ stmmac_free_tx_buffer(priv, queue, i);
+ }
+
++/**
++ * stmmac_free_tx_skbufs - free TX skb buffers
++ * @priv: private structure
++ */
++static void stmmac_free_tx_skbufs(struct stmmac_priv *priv)
++{
++ u32 tx_queue_cnt = priv->plat->tx_queues_to_use;
++ u32 queue;
++
++ for (queue = 0; queue < tx_queue_cnt; queue++)
++ dma_free_tx_skbufs(priv, queue);
++}
++
+ /**
+ * free_dma_rx_desc_resources - free RX dma desc resources
+ * @priv: private structure
+@@ -2689,9 +2702,6 @@ static int stmmac_release(struct net_device *dev)
+ struct stmmac_priv *priv = netdev_priv(dev);
+ u32 chan;
+
+- if (priv->eee_enabled)
+- del_timer_sync(&priv->eee_ctrl_timer);
+-
+ /* Stop and disconnect the PHY */
+ if (dev->phydev) {
+ phy_stop(dev->phydev);
+@@ -2710,6 +2720,11 @@ static int stmmac_release(struct net_device *dev)
+ if (priv->lpi_irq > 0)
+ free_irq(priv->lpi_irq, dev);
+
++ if (priv->eee_enabled) {
++ priv->tx_path_in_lpi_mode = false;
++ del_timer_sync(&priv->eee_ctrl_timer);
++ }
++
+ /* Stop TX/RX DMA and clear the descriptors */
+ stmmac_stop_all_dma(priv);
+
+@@ -4497,6 +4512,11 @@ int stmmac_suspend(struct device *dev)
+ for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
+ del_timer_sync(&priv->tx_queue[chan].txtimer);
+
++ if (priv->eee_enabled) {
++ priv->tx_path_in_lpi_mode = false;
++ del_timer_sync(&priv->eee_ctrl_timer);
++ }
++
+ /* Stop TX/RX DMA */
+ stmmac_stop_all_dma(priv);
+
+@@ -4591,6 +4611,7 @@ int stmmac_resume(struct device *dev)
+
+ stmmac_reset_queues_param(priv);
+
++ stmmac_free_tx_skbufs(priv);
+ stmmac_clear_descriptors(priv);
+
+ stmmac_hw_setup(ndev, false);
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index abf85f0ab72fc..66fffbd64a33f 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3180,6 +3180,9 @@ static void vxlan_config_apply(struct net_device *dev,
+ dev->gso_max_segs = lowerdev->gso_max_segs;
+
+ needed_headroom = lowerdev->hard_header_len;
++ needed_headroom += lowerdev->needed_headroom;
++
++ dev->needed_tailroom = lowerdev->needed_tailroom;
+
+ max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
+ VXLAN_HEADROOM);
+diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
+index c64a03f164c0f..16d5fe6d1e2e4 100644
+--- a/drivers/net/wireless/ath/ath10k/usb.c
++++ b/drivers/net/wireless/ath/ath10k/usb.c
+@@ -1019,6 +1019,8 @@ static int ath10k_usb_probe(struct usb_interface *interface,
+
+ ar_usb = ath10k_usb_priv(ar);
+ ret = ath10k_usb_create(ar, interface);
++ if (ret)
++ goto err;
+ ar_usb->ar = ar;
+
+ ar->dev_id = product_id;
+@@ -1030,7 +1032,7 @@ static int ath10k_usb_probe(struct usb_interface *interface,
+ ret = ath10k_core_register(ar, chip_id);
+ if (ret) {
+ ath10k_warn(ar, "failed to register driver core: %d\n", ret);
+- goto err;
++ goto err_usb_destroy;
+ }
+
+ /* TODO: remove this once USB support is fully implemented */
+@@ -1038,6 +1040,9 @@ static int ath10k_usb_probe(struct usb_interface *interface,
+
+ return 0;
+
++err_usb_destroy:
++ ath10k_usb_destroy(ar);
++
+ err:
+ ath10k_core_destroy(ar);
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index 7f435fa29f75e..a6f7bf28a8b2d 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -1157,13 +1157,15 @@ static int ath10k_wmi_tlv_svc_avail_parse(struct ath10k *ar, u16 tag, u16 len,
+
+ switch (tag) {
+ case WMI_TLV_TAG_STRUCT_SERVICE_AVAILABLE_EVENT:
++ arg->service_map_ext_valid = true;
+ arg->service_map_ext_len = *(__le32 *)ptr;
+ arg->service_map_ext = ptr + sizeof(__le32);
+ return 0;
+ default:
+ break;
+ }
+- return -EPROTO;
++
++ return 0;
+ }
+
+ static int ath10k_wmi_tlv_op_pull_svc_avail(struct ath10k *ar,
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 3f3fbee631c34..41eb57be92220 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -5510,8 +5510,13 @@ void ath10k_wmi_event_service_available(struct ath10k *ar, struct sk_buff *skb)
+ ret);
+ }
+
+- ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
+- __le32_to_cpu(arg.service_map_ext_len));
++ /*
++ * Initialization of "arg.service_map_ext_valid" to ZERO is necessary
++ * for the below logic to work.
++ */
++ if (arg.service_map_ext_valid)
++ ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
++ __le32_to_cpu(arg.service_map_ext_len));
+ }
+
+ static int ath10k_wmi_event_temperature(struct ath10k *ar, struct sk_buff *skb)
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
+index e341cfb3fcc26..6bd63d1cd0395 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -6710,6 +6710,7 @@ struct wmi_svc_rdy_ev_arg {
+ };
+
+ struct wmi_svc_avail_ev_arg {
++ bool service_map_ext_valid;
+ __le32 service_map_ext_len;
+ const __le32 *service_map_ext;
+ };
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 525b26e0f65ee..2fad20c845b47 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -2880,7 +2880,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
+
+ /* this would be a mac80211 bug ... but don't crash */
+ if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
+- return -EINVAL;
++ return test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status) ? 0 : -EINVAL;
+
+ /*
+ * If we are in a STA removal flow and in DQA mode:
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 24da496151353..f48c7cac122e9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -2121,18 +2121,36 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
+ void *buf, int dwords)
+ {
+ unsigned long flags;
+- int offs, ret = 0;
++ int offs = 0;
+ u32 *vals = buf;
+
+- if (iwl_trans_grab_nic_access(trans, &flags)) {
+- iwl_write32(trans, HBUS_TARG_MEM_RADDR, addr);
+- for (offs = 0; offs < dwords; offs++)
+- vals[offs] = iwl_read32(trans, HBUS_TARG_MEM_RDAT);
+- iwl_trans_release_nic_access(trans, &flags);
+- } else {
+- ret = -EBUSY;
++ while (offs < dwords) {
++ /* limit the time we spin here under lock to 1/2s */
++ ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC);
++
++ if (iwl_trans_grab_nic_access(trans, &flags)) {
++ iwl_write32(trans, HBUS_TARG_MEM_RADDR,
++ addr + 4 * offs);
++
++ while (offs < dwords) {
++ vals[offs] = iwl_read32(trans,
++ HBUS_TARG_MEM_RDAT);
++ offs++;
++
++ /* calling ktime_get is expensive so
++ * do it once in 128 reads
++ */
++ if (offs % 128 == 0 && ktime_after(ktime_get(),
++ timeout))
++ break;
++ }
++ iwl_trans_release_nic_access(trans, &flags);
++ } else {
++ return -EBUSY;
++ }
+ }
+- return ret;
++
++ return 0;
+ }
+
+ static int iwl_trans_pcie_write_mem(struct iwl_trans *trans, u32 addr,
+diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+index b704e4bce171d..a04d598430228 100644
+--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
++++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+@@ -1237,13 +1237,6 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (skb->len < ETH_HLEN)
+ goto drop;
+
+- ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
+- if (!ctx)
+- goto busy;
+-
+- memset(ctx->buf, 0, BULK_BUF_SIZE);
+- buf = ctx->buf->data;
+-
+ tx_control = 0;
+
+ err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
+@@ -1251,6 +1244,13 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (err)
+ goto drop;
+
++ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
++ if (!ctx)
++ goto drop;
++
++ memset(ctx->buf, 0, BULK_BUF_SIZE);
++ buf = ctx->buf->data;
++
+ {
+ __le16 *tx_cntl = (__le16 *)buf;
+ *tx_cntl = cpu_to_le16(tx_control);
+diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
+index e48b47f425540..ceac611ef0864 100644
+--- a/drivers/net/wireless/marvell/mwifiex/main.c
++++ b/drivers/net/wireless/marvell/mwifiex/main.c
+@@ -1474,6 +1474,8 @@ int mwifiex_shutdown_sw(struct mwifiex_adapter *adapter)
+ priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
+ mwifiex_deauthenticate(priv, NULL);
+
++ mwifiex_init_shutdown_fw(priv, MWIFIEX_FUNC_SHUTDOWN);
++
+ mwifiex_uninit_sw(adapter);
+
+ if (adapter->if_ops.down_dev)
+diff --git a/drivers/net/wireless/st/cw1200/main.c b/drivers/net/wireless/st/cw1200/main.c
+index c1608f0bf6d01..0c5a15e2b8f97 100644
+--- a/drivers/net/wireless/st/cw1200/main.c
++++ b/drivers/net/wireless/st/cw1200/main.c
+@@ -384,6 +384,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
+ CW1200_LINK_ID_MAX,
+ cw1200_skb_dtor,
+ priv)) {
++ destroy_workqueue(priv->workqueue);
+ ieee80211_free_hw(hw);
+ return NULL;
+ }
+@@ -395,6 +396,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
+ for (; i > 0; i--)
+ cw1200_queue_deinit(&priv->tx_queue[i - 1]);
+ cw1200_queue_stats_deinit(&priv->tx_queue_stats);
++ destroy_workqueue(priv->workqueue);
+ ieee80211_free_hw(hw);
+ return NULL;
+ }
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index cd51492ae6c2d..107bbd4ae825e 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -777,12 +777,14 @@ static int xen_register_credit_watch(struct xenbus_device *dev,
+ return -ENOMEM;
+ snprintf(node, maxlen, "%s/rate", dev->nodename);
+ vif->credit_watch.node = node;
++ vif->credit_watch.will_handle = NULL;
+ vif->credit_watch.callback = xen_net_rate_changed;
+ err = register_xenbus_watch(&vif->credit_watch);
+ if (err) {
+ pr_err("Failed to set watcher %s\n", vif->credit_watch.node);
+ kfree(node);
+ vif->credit_watch.node = NULL;
++ vif->credit_watch.will_handle = NULL;
+ vif->credit_watch.callback = NULL;
+ }
+ return err;
+@@ -829,6 +831,7 @@ static int xen_register_mcast_ctrl_watch(struct xenbus_device *dev,
+ snprintf(node, maxlen, "%s/request-multicast-control",
+ dev->otherend);
+ vif->mcast_ctrl_watch.node = node;
++ vif->mcast_ctrl_watch.will_handle = NULL;
+ vif->mcast_ctrl_watch.callback = xen_mcast_ctrl_changed;
+ err = register_xenbus_watch(&vif->mcast_ctrl_watch);
+ if (err) {
+@@ -836,6 +839,7 @@ static int xen_register_mcast_ctrl_watch(struct xenbus_device *dev,
+ vif->mcast_ctrl_watch.node);
+ kfree(node);
+ vif->mcast_ctrl_watch.node = NULL;
++ vif->mcast_ctrl_watch.will_handle = NULL;
+ vif->mcast_ctrl_watch.callback = NULL;
+ }
+ return err;
+@@ -1039,7 +1043,7 @@ static void connect(struct backend_info *be)
+ xenvif_carrier_on(be->vif);
+
+ unregister_hotplug_status_watch(be);
+- err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
++ err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, NULL,
+ hotplug_status_changed,
+ "%s/%s", dev->nodename, "hotplug-status");
+ if (!err)
+diff --git a/drivers/nfc/s3fwrn5/firmware.c b/drivers/nfc/s3fwrn5/firmware.c
+index b7828fb252f27..b7d5b12035c1a 100644
+--- a/drivers/nfc/s3fwrn5/firmware.c
++++ b/drivers/nfc/s3fwrn5/firmware.c
+@@ -304,8 +304,10 @@ static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info)
+ if (ret < 0)
+ return ret;
+
+- if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE)
++ if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) {
++ release_firmware(fw->fw);
+ return -EINVAL;
++ }
+
+ memcpy(fw->date, fw->fw->data + 0x00, 12);
+ fw->date[12] = '\0';
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index 9f1b7e3153f99..19e3469d5908e 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -861,6 +861,15 @@ static int __blk_label_update(struct nd_region *nd_region,
+ }
+ }
+
++ /* release slots associated with any invalidated UUIDs */
++ mutex_lock(&nd_mapping->lock);
++ list_for_each_entry_safe(label_ent, e, &nd_mapping->labels, list)
++ if (test_and_clear_bit(ND_LABEL_REAP, &label_ent->flags)) {
++ reap_victim(nd_mapping, label_ent);
++ list_move(&label_ent->list, &list);
++ }
++ mutex_unlock(&nd_mapping->lock);
++
+ /*
+ * Find the resource associated with the first label in the set
+ * per the v1.2 namespace specification.
+@@ -880,8 +889,10 @@ static int __blk_label_update(struct nd_region *nd_region,
+ if (is_old_resource(res, old_res_list, old_num_resources))
+ continue; /* carry-over */
+ slot = nd_label_alloc_slot(ndd);
+- if (slot == UINT_MAX)
++ if (slot == UINT_MAX) {
++ rc = -ENXIO;
+ goto abort;
++ }
+ dev_dbg(ndd->dev, "allocated: %d\n", slot);
+
+ nd_label = to_label(ndd, slot);
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 1bdac298a943f..791d6b671ee0b 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -108,6 +108,7 @@ struct qcom_pcie_resources_2_1_0 {
+ struct reset_control *ahb_reset;
+ struct reset_control *por_reset;
+ struct reset_control *phy_reset;
++ struct reset_control *ext_reset;
+ struct regulator_bulk_data supplies[QCOM_PCIE_2_1_0_MAX_SUPPLY];
+ };
+
+@@ -269,6 +270,10 @@ static int qcom_pcie_get_resources_2_1_0(struct qcom_pcie *pcie)
+ if (IS_ERR(res->por_reset))
+ return PTR_ERR(res->por_reset);
+
++ res->ext_reset = devm_reset_control_get_optional_exclusive(dev, "ext");
++ if (IS_ERR(res->ext_reset))
++ return PTR_ERR(res->ext_reset);
++
+ res->phy_reset = devm_reset_control_get_exclusive(dev, "phy");
+ return PTR_ERR_OR_ZERO(res->phy_reset);
+ }
+@@ -281,6 +286,7 @@ static void qcom_pcie_deinit_2_1_0(struct qcom_pcie *pcie)
+ reset_control_assert(res->axi_reset);
+ reset_control_assert(res->ahb_reset);
+ reset_control_assert(res->por_reset);
++ reset_control_assert(res->ext_reset);
+ reset_control_assert(res->pci_reset);
+ clk_disable_unprepare(res->iface_clk);
+ clk_disable_unprepare(res->core_clk);
+@@ -333,6 +339,12 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie)
+ goto err_deassert_ahb;
+ }
+
++ ret = reset_control_deassert(res->ext_reset);
++ if (ret) {
++ dev_err(dev, "cannot deassert ext reset\n");
++ goto err_deassert_ahb;
++ }
++
+ /* enable PCIe clocks and resets */
+ val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
+ val &= ~BIT(0);
+diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
+index ec86414216f97..f2d79e0235bc1 100644
+--- a/drivers/pci/controller/pcie-iproc.c
++++ b/drivers/pci/controller/pcie-iproc.c
+@@ -300,7 +300,7 @@ enum iproc_pcie_reg {
+ };
+
+ /* iProc PCIe PAXB BCMA registers */
+-static const u16 iproc_pcie_reg_paxb_bcma[] = {
++static const u16 iproc_pcie_reg_paxb_bcma[IPROC_PCIE_MAX_NUM_REG] = {
+ [IPROC_PCIE_CLK_CTRL] = 0x000,
+ [IPROC_PCIE_CFG_IND_ADDR] = 0x120,
+ [IPROC_PCIE_CFG_IND_DATA] = 0x124,
+@@ -311,7 +311,7 @@ static const u16 iproc_pcie_reg_paxb_bcma[] = {
+ };
+
+ /* iProc PCIe PAXB registers */
+-static const u16 iproc_pcie_reg_paxb[] = {
++static const u16 iproc_pcie_reg_paxb[IPROC_PCIE_MAX_NUM_REG] = {
+ [IPROC_PCIE_CLK_CTRL] = 0x000,
+ [IPROC_PCIE_CFG_IND_ADDR] = 0x120,
+ [IPROC_PCIE_CFG_IND_DATA] = 0x124,
+@@ -327,7 +327,7 @@ static const u16 iproc_pcie_reg_paxb[] = {
+ };
+
+ /* iProc PCIe PAXB v2 registers */
+-static const u16 iproc_pcie_reg_paxb_v2[] = {
++static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = {
+ [IPROC_PCIE_CLK_CTRL] = 0x000,
+ [IPROC_PCIE_CFG_IND_ADDR] = 0x120,
+ [IPROC_PCIE_CFG_IND_DATA] = 0x124,
+@@ -355,7 +355,7 @@ static const u16 iproc_pcie_reg_paxb_v2[] = {
+ };
+
+ /* iProc PCIe PAXC v1 registers */
+-static const u16 iproc_pcie_reg_paxc[] = {
++static const u16 iproc_pcie_reg_paxc[IPROC_PCIE_MAX_NUM_REG] = {
+ [IPROC_PCIE_CLK_CTRL] = 0x000,
+ [IPROC_PCIE_CFG_IND_ADDR] = 0x1f0,
+ [IPROC_PCIE_CFG_IND_DATA] = 0x1f4,
+@@ -364,7 +364,7 @@ static const u16 iproc_pcie_reg_paxc[] = {
+ };
+
+ /* iProc PCIe PAXC v2 registers */
+-static const u16 iproc_pcie_reg_paxc_v2[] = {
++static const u16 iproc_pcie_reg_paxc_v2[IPROC_PCIE_MAX_NUM_REG] = {
+ [IPROC_PCIE_MSI_GIC_MODE] = 0x050,
+ [IPROC_PCIE_MSI_BASE_ADDR] = 0x074,
+ [IPROC_PCIE_MSI_WINDOW_SIZE] = 0x078,
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index f7218c1673ceb..2c46f7dcd2f5d 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -587,7 +587,7 @@ static int acpi_pci_propagate_wakeup(struct pci_bus *bus, bool enable)
+ {
+ while (bus->parent) {
+ if (acpi_pm_device_can_wakeup(&bus->self->dev))
+- return acpi_pm_set_bridge_wakeup(&bus->self->dev, enable);
++ return acpi_pm_set_device_wakeup(&bus->self->dev, enable);
+
+ bus = bus->parent;
+ }
+@@ -595,7 +595,7 @@ static int acpi_pci_propagate_wakeup(struct pci_bus *bus, bool enable)
+ /* We have reached the root bus. */
+ if (bus->bridge) {
+ if (acpi_pm_device_can_wakeup(bus->bridge))
+- return acpi_pm_set_bridge_wakeup(bus->bridge, enable);
++ return acpi_pm_set_device_wakeup(bus->bridge, enable);
+ }
+ return 0;
+ }
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 57a87a001b4f4..cd628dd73719b 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5840,19 +5840,21 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,
+ while (*p) {
+ count = 0;
+ if (sscanf(p, "%d%n", &align_order, &count) == 1 &&
+- p[count] == '@') {
++ p[count] == '@') {
+ p += count + 1;
++ if (align_order > 63) {
++ pr_err("PCI: Invalid requested alignment (order %d)\n",
++ align_order);
++ align_order = PAGE_SHIFT;
++ }
+ } else {
+- align_order = -1;
++ align_order = PAGE_SHIFT;
+ }
+
+ ret = pci_dev_str_match(dev, p, &p);
+ if (ret == 1) {
+ *resize = true;
+- if (align_order == -1)
+- align = PAGE_SIZE;
+- else
+- align = 1 << align_order;
++ align = 1ULL << align_order;
+ break;
+ } else if (ret < 0) {
+ pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
+diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
+index fb7478b6c4f9d..dfbe9cbf292c0 100644
+--- a/drivers/pci/slot.c
++++ b/drivers/pci/slot.c
+@@ -307,6 +307,9 @@ placeholder:
+ goto err;
+ }
+
++ INIT_LIST_HEAD(&slot->list);
++ list_add(&slot->list, &parent->slots);
++
+ err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
+ "%s", slot_name);
+ if (err) {
+@@ -314,9 +317,6 @@ placeholder:
+ goto err;
+ }
+
+- INIT_LIST_HEAD(&slot->list);
+- list_add(&slot->list, &parent->slots);
+-
+ down_read(&pci_bus_sem);
+ list_for_each_entry(dev, &parent->devices, bus_list)
+ if (PCI_SLOT(dev->devfn) == slot_nr)
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index 1b00a3f3b419c..b3d478edbbb1c 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -1258,7 +1258,6 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
+ break;
+ case PIN_CONFIG_INPUT_DEBOUNCE:
+ debounce = readl(db_reg);
+- debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+
+ if (arg)
+ conf |= BYT_DEBOUNCE_EN;
+@@ -1267,24 +1266,31 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
+
+ switch (arg) {
+ case 375:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_375US;
+ break;
+ case 750:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_750US;
+ break;
+ case 1500:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_1500US;
+ break;
+ case 3000:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_3MS;
+ break;
+ case 6000:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_6MS;
+ break;
+ case 12000:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_12MS;
+ break;
+ case 24000:
++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+ debounce |= BYT_DEBOUNCE_PULSE_24MS;
+ break;
+ default:
+diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
+index 4fa69f988c7b7..6b2312e73f23f 100644
+--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
++++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
+@@ -729,6 +729,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin,
+ mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK;
+ bits |= BUFCFG_PU_EN;
+
++ /* Set default strength value in case none is given */
++ if (arg == 1)
++ arg = 20000;
++
+ switch (arg) {
+ case 50000:
+ bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT;
+@@ -749,6 +753,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin,
+ mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK;
+ bits |= BUFCFG_PD_EN;
+
++ /* Set default strength value in case none is given */
++ if (arg == 1)
++ arg = 20000;
++
+ switch (arg) {
+ case 50000:
+ bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT;
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index d6255049e5196..d9b9c11c7f8f2 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -439,7 +439,6 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
+ pin_reg &= ~BIT(LEVEL_TRIG_OFF);
+ pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
+ pin_reg |= ACTIVE_HIGH << ACTIVE_LEVEL_OFF;
+- pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
+ irq_set_handler_locked(d, handle_edge_irq);
+ break;
+
+@@ -447,7 +446,6 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
+ pin_reg &= ~BIT(LEVEL_TRIG_OFF);
+ pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
+ pin_reg |= ACTIVE_LOW << ACTIVE_LEVEL_OFF;
+- pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
+ irq_set_handler_locked(d, handle_edge_irq);
+ break;
+
+@@ -455,7 +453,6 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
+ pin_reg &= ~BIT(LEVEL_TRIG_OFF);
+ pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
+ pin_reg |= BOTH_EADGE << ACTIVE_LEVEL_OFF;
+- pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
+ irq_set_handler_locked(d, handle_edge_irq);
+ break;
+
+@@ -463,8 +460,6 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
+ pin_reg |= LEVEL_TRIGGER << LEVEL_TRIG_OFF;
+ pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
+ pin_reg |= ACTIVE_HIGH << ACTIVE_LEVEL_OFF;
+- pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
+- pin_reg |= DB_TYPE_PRESERVE_LOW_GLITCH << DB_CNTRL_OFF;
+ irq_set_handler_locked(d, handle_level_irq);
+ break;
+
+@@ -472,8 +467,6 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
+ pin_reg |= LEVEL_TRIGGER << LEVEL_TRIG_OFF;
+ pin_reg &= ~(ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);
+ pin_reg |= ACTIVE_LOW << ACTIVE_LEVEL_OFF;
+- pin_reg &= ~(DB_CNTRl_MASK << DB_CNTRL_OFF);
+- pin_reg |= DB_TYPE_PRESERVE_HIGH_GLITCH << DB_CNTRL_OFF;
+ irq_set_handler_locked(d, handle_level_irq);
+ break;
+
+diff --git a/drivers/pinctrl/pinctrl-falcon.c b/drivers/pinctrl/pinctrl-falcon.c
+index fb73dcbb5ef37..68dcf53aaac34 100644
+--- a/drivers/pinctrl/pinctrl-falcon.c
++++ b/drivers/pinctrl/pinctrl-falcon.c
+@@ -438,24 +438,28 @@ static int pinctrl_falcon_probe(struct platform_device *pdev)
+
+ /* load and remap the pad resources of the different banks */
+ for_each_compatible_node(np, NULL, "lantiq,pad-falcon") {
+- struct platform_device *ppdev = of_find_device_by_node(np);
+ const __be32 *bank = of_get_property(np, "lantiq,bank", NULL);
+ struct resource res;
++ struct platform_device *ppdev;
+ u32 avail;
+ int pins;
+
+ if (!of_device_is_available(np))
+ continue;
+
+- if (!ppdev) {
+- dev_err(&pdev->dev, "failed to find pad pdev\n");
+- continue;
+- }
+ if (!bank || *bank >= PORTS)
+ continue;
+ if (of_address_to_resource(np, 0, &res))
+ continue;
++
++ ppdev = of_find_device_by_node(np);
++ if (!ppdev) {
++ dev_err(&pdev->dev, "failed to find pad pdev\n");
++ continue;
++ }
++
+ falcon_info.clk[*bank] = clk_get(&ppdev->dev, NULL);
++ put_device(&ppdev->dev);
+ if (IS_ERR(falcon_info.clk[*bank])) {
+ dev_err(&ppdev->dev, "failed to get clock\n");
+ return PTR_ERR(falcon_info.clk[*bank]);
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+index 61aaaf58c5993..ff9c2758d25e0 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+@@ -1001,20 +1001,22 @@ static void sunxi_pinctrl_irq_handler(struct irq_desc *desc)
+ if (bank == pctl->desc->irq_banks)
+ return;
+
++ chained_irq_enter(chip, desc);
++
+ reg = sunxi_irq_status_reg_from_bank(pctl->desc, bank);
+ val = readl(pctl->membase + reg);
+
+ if (val) {
+ int irqoffset;
+
+- chained_irq_enter(chip, desc);
+ for_each_set_bit(irqoffset, &val, IRQ_PER_BANK) {
+ int pin_irq = irq_find_mapping(pctl->domain,
+ bank * IRQ_PER_BANK + irqoffset);
+ generic_handle_irq(pin_irq);
+ }
+- chained_irq_exit(chip, desc);
+ }
++
++ chained_irq_exit(chip, desc);
+ }
+
+ static int sunxi_pinctrl_add_function(struct sunxi_pinctrl *pctl,
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index fcfeadd1301f4..92400abe35520 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -124,6 +124,7 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
+ {KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} }, /* Display Switch */
+ {KE_IGNORE, 0x81, {KEY_SLEEP} },
+ {KE_KEY, 0x82, {KEY_TOUCHPAD_TOGGLE} }, /* Touch Pad Toggle */
++ {KE_IGNORE, 0x84, {KEY_KBDILLUMTOGGLE} }, /* Automatic Keyboard background light toggle */
+ {KE_KEY, KEY_TOUCHPAD_ON, {KEY_TOUCHPAD_ON} },
+ {KE_KEY, KEY_TOUCHPAD_OFF, {KEY_TOUCHPAD_OFF} },
+ {KE_IGNORE, 0x83, {KEY_TOUCHPAD_TOGGLE} },
+diff --git a/drivers/platform/x86/dell-smbios-base.c b/drivers/platform/x86/dell-smbios-base.c
+index 0537d44d45a6e..9e9fc51557892 100644
+--- a/drivers/platform/x86/dell-smbios-base.c
++++ b/drivers/platform/x86/dell-smbios-base.c
+@@ -597,6 +597,7 @@ static int __init dell_smbios_init(void)
+ if (wmi && smm) {
+ pr_err("No SMBIOS backends available (wmi: %d, smm: %d)\n",
+ wmi, smm);
++ ret = -ENODEV;
+ goto fail_create_group;
+ }
+
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index 1e6b4661c7645..36d6e72f50735 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -197,6 +197,18 @@ static const struct dmi_system_id dmi_switches_allow_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Stream x360 Convertible PC 11"),
+ },
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion 13 x360 PC"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Switch SA5-271"),
++ },
++ },
+ {} /* Array terminator */
+ };
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 0c72de95b5ccd..b2a196a2b6c7c 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -212,15 +212,6 @@ static struct i2c_mux_reg_platform_data mlxplat_mux_data[] = {
+ };
+
+ /* Platform hotplug devices */
+-static struct i2c_board_info mlxplat_mlxcpld_psu[] = {
+- {
+- I2C_BOARD_INFO("24c02", 0x51),
+- },
+- {
+- I2C_BOARD_INFO("24c02", 0x50),
+- },
+-};
+-
+ static struct i2c_board_info mlxplat_mlxcpld_pwr[] = {
+ {
+ I2C_BOARD_INFO("dps460", 0x59),
+@@ -251,15 +242,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_default_psu_items_data[] = {
+ .label = "psu1",
+ .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ .mask = BIT(0),
+- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
+- .hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ },
+ {
+ .label = "psu2",
+ .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ .mask = BIT(1),
+- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
+- .hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ },
+ };
+
+@@ -326,7 +315,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = {
+ .aggr_mask = MLXPLAT_CPLD_AGGR_PSU_MASK_DEF,
+ .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ .mask = MLXPLAT_CPLD_PSU_MASK,
+- .count = ARRAY_SIZE(mlxplat_mlxcpld_psu),
++ .count = ARRAY_SIZE(mlxplat_mlxcpld_default_psu_items_data),
+ .inversed = 1,
+ .health = false,
+ },
+@@ -335,7 +324,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = {
+ .aggr_mask = MLXPLAT_CPLD_AGGR_PWR_MASK_DEF,
+ .reg = MLXPLAT_CPLD_LPC_REG_PWR_OFFSET,
+ .mask = MLXPLAT_CPLD_PWR_MASK,
+- .count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
++ .count = ARRAY_SIZE(mlxplat_mlxcpld_default_pwr_items_data),
+ .inversed = 0,
+ .health = false,
+ },
+@@ -344,7 +333,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = {
+ .aggr_mask = MLXPLAT_CPLD_AGGR_FAN_MASK_DEF,
+ .reg = MLXPLAT_CPLD_LPC_REG_FAN_OFFSET,
+ .mask = MLXPLAT_CPLD_FAN_MASK,
+- .count = ARRAY_SIZE(mlxplat_mlxcpld_fan),
++ .count = ARRAY_SIZE(mlxplat_mlxcpld_default_fan_items_data),
+ .inversed = 1,
+ .health = false,
+ },
+@@ -422,15 +411,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_msn274x_psu_items_data[] = {
+ .label = "psu1",
+ .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ .mask = BIT(0),
+- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
+- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ },
+ {
+ .label = "psu2",
+ .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ .mask = BIT(1),
+- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
+- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ },
+ };
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 8cc01857bc5c0..a6e69f2495d23 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -3242,7 +3242,14 @@ static int hotkey_init_tablet_mode(void)
+
+ in_tablet_mode = hotkey_gmms_get_tablet_mode(res,
+ &has_tablet_mode);
+- if (has_tablet_mode)
++ /*
++ * The Yoga 11e series has 2 accelerometers described by a
++ * BOSC0200 ACPI node. This setup relies on a Windows service
++ * which calls special ACPI methods on this node to report
++ * the laptop/tent/tablet mode to the EC. The bmc150 iio driver
++ * does not support this, so skip the hotkey on these models.
++ */
++ if (has_tablet_mode && !acpi_dev_present("BOSC0200", "1", -1))
+ tp_features.hotkey_tablet = TP_HOTKEY_TABLET_USES_GMMS;
+ type = "GMMS";
+ } else if (acpi_evalf(hkey_handle, &res, "MHKG", "qd")) {
+@@ -9690,6 +9697,7 @@ static const struct tpacpi_quirk battery_quirk_table[] __initconst = {
+ TPACPI_Q_LNV3('R', '0', 'B', true), /* Thinkpad 11e gen 3 */
+ TPACPI_Q_LNV3('R', '0', 'C', true), /* Thinkpad 13 */
+ TPACPI_Q_LNV3('R', '0', 'J', true), /* Thinkpad 13 gen 2 */
++ TPACPI_Q_LNV3('R', '0', 'K', true), /* Thinkpad 11e gen 4 celeron BIOS */
+ };
+
+ static int __init tpacpi_battery_init(struct ibm_init_struct *ibm)
+diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
+index 46eb7716c35c8..84106a9836c8f 100644
+--- a/drivers/power/supply/axp288_charger.c
++++ b/drivers/power/supply/axp288_charger.c
+@@ -555,14 +555,15 @@ out:
+
+ /*
+ * The HP Pavilion x2 10 series comes in a number of variants:
+- * Bay Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "815D"
+- * Cherry Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "813E"
+- * Cherry Trail SoC + TI PMIC, DMI_BOARD_NAME: "827C" or "82F4"
++ * Bay Trail SoC + AXP288 PMIC, Micro-USB, DMI_BOARD_NAME: "8021"
++ * Bay Trail SoC + AXP288 PMIC, Type-C, DMI_BOARD_NAME: "815D"
++ * Cherry Trail SoC + AXP288 PMIC, Type-C, DMI_BOARD_NAME: "813E"
++ * Cherry Trail SoC + TI PMIC, Type-C, DMI_BOARD_NAME: "827C" or "82F4"
+ *
+- * The variants with the AXP288 PMIC are all kinds of special:
++ * The variants with the AXP288 + Type-C connector are all kinds of special:
+ *
+- * 1. All variants use a Type-C connector which the AXP288 does not support, so
+- * when using a Type-C charger it is not recognized. Unlike most AXP288 devices,
++ * 1. They use a Type-C connector which the AXP288 does not support, so when
++ * using a Type-C charger it is not recognized. Unlike most AXP288 devices,
+ * this model actually has mostly working ACPI AC / Battery code, the ACPI code
+ * "solves" this by simply setting the input_current_limit to 3A.
+ * There are still some issues with the ACPI code, so we use this native driver,
+@@ -585,12 +586,17 @@ out:
+ */
+ static const struct dmi_system_id axp288_hp_x2_dmi_ids[] = {
+ {
+- /*
+- * Bay Trail model has "Hewlett-Packard" as sys_vendor, Cherry
+- * Trail model has "HP", so we only match on product_name.
+- */
+ .matches = {
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "815D"),
++ },
++ },
++ {
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "HP"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "813E"),
+ },
+ },
+ {} /* Terminating entry */
+diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
+index b58df04d03b33..863208928cf0b 100644
+--- a/drivers/power/supply/bq24190_charger.c
++++ b/drivers/power/supply/bq24190_charger.c
+@@ -446,8 +446,10 @@ static ssize_t bq24190_sysfs_show(struct device *dev,
+ return -EINVAL;
+
+ ret = pm_runtime_get_sync(bdi->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(bdi->dev);
+ return ret;
++ }
+
+ ret = bq24190_read_mask(bdi, info->reg, info->mask, info->shift, &v);
+ if (ret)
+@@ -1092,8 +1094,10 @@ static int bq24190_charger_get_property(struct power_supply *psy,
+ dev_dbg(bdi->dev, "prop: %d\n", psp);
+
+ ret = pm_runtime_get_sync(bdi->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(bdi->dev);
+ return ret;
++ }
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_CHARGE_TYPE:
+@@ -1164,8 +1168,10 @@ static int bq24190_charger_set_property(struct power_supply *psy,
+ dev_dbg(bdi->dev, "prop: %d\n", psp);
+
+ ret = pm_runtime_get_sync(bdi->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(bdi->dev);
+ return ret;
++ }
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_ONLINE:
+@@ -1425,8 +1431,10 @@ static int bq24190_battery_get_property(struct power_supply *psy,
+ dev_dbg(bdi->dev, "prop: %d\n", psp);
+
+ ret = pm_runtime_get_sync(bdi->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(bdi->dev);
+ return ret;
++ }
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_STATUS:
+@@ -1471,8 +1479,10 @@ static int bq24190_battery_set_property(struct power_supply *psy,
+ dev_dbg(bdi->dev, "prop: %d\n", psp);
+
+ ret = pm_runtime_get_sync(bdi->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(bdi->dev);
+ return ret;
++ }
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_ONLINE:
+diff --git a/drivers/ps3/ps3stor_lib.c b/drivers/ps3/ps3stor_lib.c
+index 8c3f5adf1bc65..2d76183756626 100644
+--- a/drivers/ps3/ps3stor_lib.c
++++ b/drivers/ps3/ps3stor_lib.c
+@@ -201,7 +201,7 @@ int ps3stor_setup(struct ps3_storage_device *dev, irq_handler_t handler)
+ dev->bounce_lpar = ps3_mm_phys_to_lpar(__pa(dev->bounce_buf));
+ dev->bounce_dma = dma_map_single(&dev->sbd.core, dev->bounce_buf,
+ dev->bounce_size, DMA_BIDIRECTIONAL);
+- if (!dev->bounce_dma) {
++ if (dma_mapping_error(&dev->sbd.core, dev->bounce_dma)) {
+ dev_err(&dev->sbd.core, "%s:%u: map DMA region failed\n",
+ __func__, __LINE__);
+ error = -ENODEV;
+diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c
+index 15b40a8bc4fbb..5055ba2c6c940 100644
+--- a/drivers/pwm/pwm-lp3943.c
++++ b/drivers/pwm/pwm-lp3943.c
+@@ -278,6 +278,7 @@ static int lp3943_pwm_probe(struct platform_device *pdev)
+ lp3943_pwm->chip.dev = &pdev->dev;
+ lp3943_pwm->chip.ops = &lp3943_pwm_ops;
+ lp3943_pwm->chip.npwm = LP3943_NUM_PWMS;
++ lp3943_pwm->chip.base = -1;
+
+ platform_set_drvdata(pdev, lp3943_pwm);
+
+diff --git a/drivers/pwm/pwm-zx.c b/drivers/pwm/pwm-zx.c
+index 5d27c16edfb13..0d4112410b69d 100644
+--- a/drivers/pwm/pwm-zx.c
++++ b/drivers/pwm/pwm-zx.c
+@@ -241,6 +241,7 @@ static int zx_pwm_probe(struct platform_device *pdev)
+ ret = pwmchip_add(&zpc->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to add PWM chip: %d\n", ret);
++ clk_disable_unprepare(zpc->pclk);
+ return ret;
+ }
+
+diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
+index 99f86612f7751..dc78a523a69f2 100644
+--- a/drivers/s390/block/dasd_alias.c
++++ b/drivers/s390/block/dasd_alias.c
+@@ -256,7 +256,6 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
+ return;
+ device->discipline->get_uid(device, &uid);
+ spin_lock_irqsave(&lcu->lock, flags);
+- list_del_init(&device->alias_list);
+ /* make sure that the workers don't use this device */
+ if (device == lcu->suc_data.device) {
+ spin_unlock_irqrestore(&lcu->lock, flags);
+@@ -283,6 +282,7 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
+
+ spin_lock_irqsave(&aliastree.lock, flags);
+ spin_lock(&lcu->lock);
++ list_del_init(&device->alias_list);
+ if (list_empty(&lcu->grouplist) &&
+ list_empty(&lcu->active_devices) &&
+ list_empty(&lcu->inactive_devices)) {
+@@ -462,11 +462,19 @@ static int read_unit_address_configuration(struct dasd_device *device,
+ spin_unlock_irqrestore(&lcu->lock, flags);
+
+ rc = dasd_sleep_on(cqr);
+- if (rc && !suborder_not_supported(cqr)) {
++ if (!rc)
++ goto out;
++
++ if (suborder_not_supported(cqr)) {
++ /* suborder not supported or device unusable for IO */
++ rc = -EOPNOTSUPP;
++ } else {
++ /* IO failed but should be retried */
+ spin_lock_irqsave(&lcu->lock, flags);
+ lcu->flags |= NEED_UAC_UPDATE;
+ spin_unlock_irqrestore(&lcu->lock, flags);
+ }
++out:
+ dasd_sfree_request(cqr, cqr->memdev);
+ return rc;
+ }
+@@ -503,6 +511,14 @@ static int _lcu_update(struct dasd_device *refdev, struct alias_lcu *lcu)
+ return rc;
+
+ spin_lock_irqsave(&lcu->lock, flags);
++ /*
++ * there is another update needed skip the remaining handling
++ * the data might already be outdated
++ * but especially do not add the device to an LCU with pending
++ * update
++ */
++ if (lcu->flags & NEED_UAC_UPDATE)
++ goto out;
+ lcu->pav = NO_PAV;
+ for (i = 0; i < MAX_DEVICES_PER_LCU; ++i) {
+ switch (lcu->uac->unit[i].ua_type) {
+@@ -521,6 +537,7 @@ static int _lcu_update(struct dasd_device *refdev, struct alias_lcu *lcu)
+ alias_list) {
+ _add_device_to_lcu(lcu, device, refdev);
+ }
++out:
+ spin_unlock_irqrestore(&lcu->lock, flags);
+ return 0;
+ }
+@@ -625,6 +642,7 @@ int dasd_alias_add_device(struct dasd_device *device)
+ }
+ if (lcu->flags & UPDATE_PENDING) {
+ list_move(&device->alias_list, &lcu->active_devices);
++ private->pavgroup = NULL;
+ _schedule_lcu_update(lcu, device);
+ }
+ spin_unlock_irqrestore(&lcu->lock, flags);
+diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
+index 6221a8372cee2..3660059784f74 100644
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -3039,7 +3039,6 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba,
+ goto create_eq_error;
+ }
+
+- mem->dma = paddr;
+ mem->va = eq_vaddress;
+ ret = be_fill_queue(eq, phba->params.num_eq_entries,
+ sizeof(struct be_eq_entry), eq_vaddress);
+@@ -3049,6 +3048,7 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba,
+ goto create_eq_error;
+ }
+
++ mem->dma = paddr;
+ ret = beiscsi_cmd_eq_create(&phba->ctrl, eq,
+ BEISCSI_EQ_DELAY_DEF);
+ if (ret) {
+@@ -3105,7 +3105,6 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba,
+ goto create_cq_error;
+ }
+
+- mem->dma = paddr;
+ ret = be_fill_queue(cq, phba->params.num_cq_entries,
+ sizeof(struct sol_cqe), cq_vaddress);
+ if (ret) {
+@@ -3115,6 +3114,7 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba,
+ goto create_cq_error;
+ }
+
++ mem->dma = paddr;
+ ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false,
+ false, 0);
+ if (ret) {
+diff --git a/drivers/scsi/bnx2i/Kconfig b/drivers/scsi/bnx2i/Kconfig
+index ba30ff86d5818..b27a3738d940c 100644
+--- a/drivers/scsi/bnx2i/Kconfig
++++ b/drivers/scsi/bnx2i/Kconfig
+@@ -3,6 +3,7 @@ config SCSI_BNX2_ISCSI
+ depends on NET
+ depends on PCI
+ depends on (IPV6 || IPV6=n)
++ depends on MMU
+ select SCSI_ISCSI_ATTRS
+ select NETDEVICES
+ select ETHERNET
+diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
+index e52599f441707..bc5dbe3bae5c5 100644
+--- a/drivers/scsi/fnic/fnic_main.c
++++ b/drivers/scsi/fnic/fnic_main.c
+@@ -746,6 +746,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ for (i = 0; i < FNIC_IO_LOCKS; i++)
+ spin_lock_init(&fnic->io_req_lock[i]);
+
++ err = -ENOMEM;
+ fnic->io_req_pool = mempool_create_slab_pool(2, fnic_io_req_cache);
+ if (!fnic->io_req_pool)
+ goto err_out_free_resources;
+diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
+index 9c22a2c93462e..fa758f9b82e09 100644
+--- a/drivers/scsi/lpfc/lpfc_mem.c
++++ b/drivers/scsi/lpfc/lpfc_mem.c
+@@ -560,8 +560,6 @@ lpfc_els_hbq_free(struct lpfc_hba *phba, struct hbq_dmabuf *hbqbp)
+ * Description: Allocates a DMA-mapped receive buffer from the lpfc_hrb_pool PCI
+ * pool along a non-DMA-mapped container for it.
+ *
+- * Notes: Not interrupt-safe. Must be called with no locks held.
+- *
+ * Returns:
+ * pointer to HBQ on success
+ * NULL on failure
+@@ -631,7 +629,7 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
+ {
+ struct rqb_dmabuf *dma_buf;
+
+- dma_buf = kzalloc(sizeof(struct rqb_dmabuf), GFP_KERNEL);
++ dma_buf = kzalloc(sizeof(*dma_buf), GFP_KERNEL);
+ if (!dma_buf)
+ return NULL;
+
+@@ -754,7 +752,6 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
+ drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
+ rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
+ if (rc < 0) {
+- (rqbp->rqb_free_buffer)(phba, rqb_entry);
+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+ "6409 Cannot post to HRQ %d: %x %x %x "
+ "DRQ %x %x\n",
+@@ -764,6 +761,7 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
+ rqb_entry->hrq->entry_count,
+ rqb_entry->drq->host_index,
+ rqb_entry->drq->hba_index);
++ (rqbp->rqb_free_buffer)(phba, rqb_entry);
+ } else {
+ list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
+ rqbp->buffer_count++;
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 2ab351260e815..a7b14875af5fa 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -6755,12 +6755,16 @@ lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+ struct rqb_dmabuf *rqb_buffer;
+ LIST_HEAD(rqb_buf_list);
+
+- spin_lock_irqsave(&phba->hbalock, flags);
+ rqbp = hrq->rqbp;
+ for (i = 0; i < count; i++) {
++ spin_lock_irqsave(&phba->hbalock, flags);
+ /* IF RQ is already full, don't bother */
+- if (rqbp->buffer_count + i >= rqbp->entry_count - 1)
++ if (rqbp->buffer_count + i >= rqbp->entry_count - 1) {
++ spin_unlock_irqrestore(&phba->hbalock, flags);
+ break;
++ }
++ spin_unlock_irqrestore(&phba->hbalock, flags);
++
+ rqb_buffer = rqbp->rqb_alloc_buffer(phba);
+ if (!rqb_buffer)
+ break;
+@@ -6769,6 +6773,8 @@ lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+ rqb_buffer->idx = idx;
+ list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
+ }
++
++ spin_lock_irqsave(&phba->hbalock, flags);
+ while (!list_empty(&rqb_buf_list)) {
+ list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
+ hbuf.list);
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 21f971447dd8c..83d25ee88f028 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -7192,7 +7192,7 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
+ int error = 0, i;
+ void *sense = NULL;
+ dma_addr_t sense_handle;
+- unsigned long *sense_ptr;
++ void *sense_ptr;
+ u32 opcode = 0;
+
+ memset(kbuff_arr, 0, sizeof(kbuff_arr));
+@@ -7309,6 +7309,13 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
+ }
+
+ if (ioc->sense_len) {
++ /* make sure the pointer is part of the frame */
++ if (ioc->sense_off >
++ (sizeof(union megasas_frame) - sizeof(__le64))) {
++ error = -EINVAL;
++ goto out;
++ }
++
+ sense = dma_alloc_coherent(&instance->pdev->dev, ioc->sense_len,
+ &sense_handle, GFP_KERNEL);
+ if (!sense) {
+@@ -7316,12 +7323,11 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
+ goto out;
+ }
+
+- sense_ptr =
+- (unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off);
++ sense_ptr = (void *)cmd->frame + ioc->sense_off;
+ if (instance->consistent_mask_64bit)
+- *sense_ptr = cpu_to_le64(sense_handle);
++ put_unaligned_le64(sense_handle, sense_ptr);
+ else
+- *sense_ptr = cpu_to_le32(sense_handle);
++ put_unaligned_le32(sense_handle, sense_ptr);
+ }
+
+ /*
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 9fbe20e38ad07..07959047d4dc4 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -5771,7 +5771,7 @@ _base_send_ioc_init(struct MPT3SAS_ADAPTER *ioc)
+
+ r = _base_handshake_req_reply_wait(ioc,
+ sizeof(Mpi2IOCInitRequest_t), (u32 *)&mpi_request,
+- sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 10);
++ sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 30);
+
+ if (r != 0) {
+ pr_err(MPT3SAS_FMT "%s: handshake failed (r=%d)\n",
+diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
+index 7a697ca68501e..1d59d7447a1c8 100644
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -1059,7 +1059,8 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
+
+ pm8001_init_sas_add(pm8001_ha);
+ /* phy setting support for motherboard controller */
+- if (pm8001_configure_phy_settings(pm8001_ha))
++ rc = pm8001_configure_phy_settings(pm8001_ha);
++ if (rc)
+ goto err_out_shost;
+
+ pm8001_post_sas_ha_init(shost, chip);
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index 763c7628356b1..eaa50328de90c 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -2580,7 +2580,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
+ QEDI_ERR(&qedi->dbg_ctx,
+ "Unable to start offload thread!\n");
+ rc = -ENODEV;
+- goto free_cid_que;
++ goto free_tmf_thread;
+ }
+
+ /* F/w needs 1st task context memory entry for performance */
+@@ -2600,6 +2600,8 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
+
+ return 0;
+
++free_tmf_thread:
++ destroy_workqueue(qedi->tmf_thread);
+ free_cid_que:
+ qedi_release_cid_que(qedi);
+ free_uio:
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index c501fb5190a38..fe5ae2b221c19 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -3446,6 +3446,78 @@ void sdev_enable_disk_events(struct scsi_device *sdev)
+ }
+ EXPORT_SYMBOL(sdev_enable_disk_events);
+
++static unsigned char designator_prio(const unsigned char *d)
++{
++ if (d[1] & 0x30)
++ /* not associated with LUN */
++ return 0;
++
++ if (d[3] == 0)
++ /* invalid length */
++ return 0;
++
++ /*
++ * Order of preference for lun descriptor:
++ * - SCSI name string
++ * - NAA IEEE Registered Extended
++ * - EUI-64 based 16-byte
++ * - EUI-64 based 12-byte
++ * - NAA IEEE Registered
++ * - NAA IEEE Extended
++ * - EUI-64 based 8-byte
++ * - SCSI name string (truncated)
++ * - T10 Vendor ID
++ * as longer descriptors reduce the likelyhood
++ * of identification clashes.
++ */
++
++ switch (d[1] & 0xf) {
++ case 8:
++ /* SCSI name string, variable-length UTF-8 */
++ return 9;
++ case 3:
++ switch (d[4] >> 4) {
++ case 6:
++ /* NAA registered extended */
++ return 8;
++ case 5:
++ /* NAA registered */
++ return 5;
++ case 4:
++ /* NAA extended */
++ return 4;
++ case 3:
++ /* NAA locally assigned */
++ return 1;
++ default:
++ break;
++ }
++ break;
++ case 2:
++ switch (d[3]) {
++ case 16:
++ /* EUI64-based, 16 byte */
++ return 7;
++ case 12:
++ /* EUI64-based, 12 byte */
++ return 6;
++ case 8:
++ /* EUI64-based, 8 byte */
++ return 3;
++ default:
++ break;
++ }
++ break;
++ case 1:
++ /* T10 vendor ID */
++ return 1;
++ default:
++ break;
++ }
++
++ return 0;
++}
++
+ /**
+ * scsi_vpd_lun_id - return a unique device identification
+ * @sdev: SCSI device
+@@ -3462,7 +3534,7 @@ EXPORT_SYMBOL(sdev_enable_disk_events);
+ */
+ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ {
+- u8 cur_id_type = 0xff;
++ u8 cur_id_prio = 0;
+ u8 cur_id_size = 0;
+ const unsigned char *d, *cur_id_str;
+ const struct scsi_vpd *vpd_pg83;
+@@ -3475,20 +3547,6 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ return -ENXIO;
+ }
+
+- /*
+- * Look for the correct descriptor.
+- * Order of preference for lun descriptor:
+- * - SCSI name string
+- * - NAA IEEE Registered Extended
+- * - EUI-64 based 16-byte
+- * - EUI-64 based 12-byte
+- * - NAA IEEE Registered
+- * - NAA IEEE Extended
+- * - T10 Vendor ID
+- * as longer descriptors reduce the likelyhood
+- * of identification clashes.
+- */
+-
+ /* The id string must be at least 20 bytes + terminating NULL byte */
+ if (id_len < 21) {
+ rcu_read_unlock();
+@@ -3498,8 +3556,9 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ memset(id, 0, id_len);
+ d = vpd_pg83->data + 4;
+ while (d < vpd_pg83->data + vpd_pg83->len) {
+- /* Skip designators not referring to the LUN */
+- if ((d[1] & 0x30) != 0x00)
++ u8 prio = designator_prio(d);
++
++ if (prio == 0 || cur_id_prio > prio)
+ goto next_desig;
+
+ switch (d[1] & 0xf) {
+@@ -3507,28 +3566,19 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ /* T10 Vendor ID */
+ if (cur_id_size > d[3])
+ break;
+- /* Prefer anything */
+- if (cur_id_type > 0x01 && cur_id_type != 0xff)
+- break;
++ cur_id_prio = prio;
+ cur_id_size = d[3];
+ if (cur_id_size + 4 > id_len)
+ cur_id_size = id_len - 4;
+ cur_id_str = d + 4;
+- cur_id_type = d[1] & 0xf;
+ id_size = snprintf(id, id_len, "t10.%*pE",
+ cur_id_size, cur_id_str);
+ break;
+ case 0x2:
+ /* EUI-64 */
+- if (cur_id_size > d[3])
+- break;
+- /* Prefer NAA IEEE Registered Extended */
+- if (cur_id_type == 0x3 &&
+- cur_id_size == d[3])
+- break;
++ cur_id_prio = prio;
+ cur_id_size = d[3];
+ cur_id_str = d + 4;
+- cur_id_type = d[1] & 0xf;
+ switch (cur_id_size) {
+ case 8:
+ id_size = snprintf(id, id_len,
+@@ -3546,17 +3596,14 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ cur_id_str);
+ break;
+ default:
+- cur_id_size = 0;
+ break;
+ }
+ break;
+ case 0x3:
+ /* NAA */
+- if (cur_id_size > d[3])
+- break;
++ cur_id_prio = prio;
+ cur_id_size = d[3];
+ cur_id_str = d + 4;
+- cur_id_type = d[1] & 0xf;
+ switch (cur_id_size) {
+ case 8:
+ id_size = snprintf(id, id_len,
+@@ -3569,26 +3616,25 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ cur_id_str);
+ break;
+ default:
+- cur_id_size = 0;
+ break;
+ }
+ break;
+ case 0x8:
+ /* SCSI name string */
+- if (cur_id_size + 4 > d[3])
++ if (cur_id_size > d[3])
+ break;
+ /* Prefer others for truncated descriptor */
+- if (cur_id_size && d[3] > id_len)
+- break;
++ if (d[3] > id_len) {
++ prio = 2;
++ if (cur_id_prio > prio)
++ break;
++ }
++ cur_id_prio = prio;
+ cur_id_size = id_size = d[3];
+ cur_id_str = d + 4;
+- cur_id_type = d[1] & 0xf;
+ if (cur_id_size >= id_len)
+ cur_id_size = id_len - 1;
+ memcpy(id, cur_id_str, cur_id_size);
+- /* Decrease priority for truncated descriptor */
+- if (cur_id_size != id_size)
+- cur_id_size = 6;
+ break;
+ default:
+ break;
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 7e4e6e982055e..61b1eae42ea85 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1281,8 +1281,15 @@ static int ufshcd_devfreq_target(struct device *dev,
+ }
+ spin_unlock_irqrestore(hba->host->host_lock, irq_flags);
+
++ pm_runtime_get_noresume(hba->dev);
++ if (!pm_runtime_active(hba->dev)) {
++ pm_runtime_put_noidle(hba->dev);
++ ret = -EAGAIN;
++ goto out;
++ }
+ start = ktime_get();
+ ret = ufshcd_devfreq_scale(hba, scale_up);
++ pm_runtime_put(hba->dev);
+
+ trace_ufshcd_profile_clk_scaling(dev_name(hba->dev),
+ (scale_up ? "up" : "down"),
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 522a87fc573a6..44021620d1013 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1200,6 +1200,9 @@ static int qcom_slim_ngd_runtime_resume(struct device *dev)
+ struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
+ int ret = 0;
+
++ if (!ctrl->qmi.handle)
++ return 0;
++
+ if (ctrl->state >= QCOM_SLIM_NGD_CTRL_ASLEEP)
+ ret = qcom_slim_ngd_power_up(ctrl);
+ if (ret) {
+@@ -1493,6 +1496,9 @@ static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev)
+ struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
+ int ret = 0;
+
++ if (!ctrl->qmi.handle)
++ return 0;
++
+ ret = qcom_slim_qmi_power_request(ctrl, false);
+ if (ret && ret != -EBUSY)
+ dev_info(ctrl->dev, "slim resource not idle:%d\n", ret);
+diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
+index b60b77bfaffae..ea6f8904c01b5 100644
+--- a/drivers/soc/fsl/dpio/dpio-driver.c
++++ b/drivers/soc/fsl/dpio/dpio-driver.c
+@@ -53,7 +53,6 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
+ struct dpio_priv *priv;
+ int error;
+ struct fsl_mc_device_irq *irq;
+- cpumask_t mask;
+
+ priv = dev_get_drvdata(&dpio_dev->dev);
+
+@@ -72,9 +71,7 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
+ }
+
+ /* set the affinity hint */
+- cpumask_clear(&mask);
+- cpumask_set_cpu(cpu, &mask);
+- if (irq_set_affinity_hint(irq->msi_desc->irq, &mask))
++ if (irq_set_affinity_hint(irq->msi_desc->irq, cpumask_of(cpu)))
+ dev_err(&dpio_dev->dev,
+ "irq_set_affinity failed irq %d cpu %d\n",
+ irq->msi_desc->irq, cpu);
+diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c
+index 5b24bb4bfbf66..ef54f1638d207 100644
+--- a/drivers/soc/mediatek/mtk-scpsys.c
++++ b/drivers/soc/mediatek/mtk-scpsys.c
+@@ -454,6 +454,7 @@ static void mtk_register_power_domains(struct platform_device *pdev,
+ for (i = 0; i < num; i++) {
+ struct scp_domain *scpd = &scp->domains[i];
+ struct generic_pm_domain *genpd = &scpd->genpd;
++ bool on;
+
+ /*
+ * Initially turn on all domains to make the domains usable
+@@ -461,9 +462,9 @@ static void mtk_register_power_domains(struct platform_device *pdev,
+ * software. The unused domains will be switched off during
+ * late_init time.
+ */
+- genpd->power_on(genpd);
++ on = !WARN_ON(genpd->power_on(genpd) < 0);
+
+- pm_genpd_init(genpd, NULL, false);
++ pm_genpd_init(genpd, NULL, !on);
+ }
+
+ /*
+diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
+index ee89ffb6dde84..7369b061929bb 100644
+--- a/drivers/soc/qcom/qcom-geni-se.c
++++ b/drivers/soc/qcom/qcom-geni-se.c
+@@ -275,6 +275,7 @@ static void geni_se_select_fifo_mode(struct geni_se *se)
+
+ static void geni_se_select_dma_mode(struct geni_se *se)
+ {
++ u32 proto = geni_se_read_proto(se);
+ u32 val;
+
+ writel_relaxed(0, se->base + SE_GSI_EVENT_EN);
+@@ -284,6 +285,18 @@ static void geni_se_select_dma_mode(struct geni_se *se)
+ writel_relaxed(0xffffffff, se->base + SE_DMA_RX_IRQ_CLR);
+ writel_relaxed(0xffffffff, se->base + SE_IRQ_EN);
+
++ val = readl_relaxed(se->base + SE_GENI_M_IRQ_EN);
++ if (proto != GENI_SE_UART) {
++ val &= ~(M_CMD_DONE_EN | M_TX_FIFO_WATERMARK_EN);
++ val &= ~(M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN);
++ }
++ writel_relaxed(val, se->base + SE_GENI_M_IRQ_EN);
++
++ val = readl_relaxed(se->base + SE_GENI_S_IRQ_EN);
++ if (proto != GENI_SE_UART)
++ val &= ~S_CMD_DONE_EN;
++ writel_relaxed(val, se->base + SE_GENI_S_IRQ_EN);
++
+ val = readl_relaxed(se->base + SE_GENI_DMA_MODE_EN);
+ val |= GENI_DMA_MODE_EN;
+ writel_relaxed(val, se->base + SE_GENI_DMA_MODE_EN);
+@@ -633,7 +646,7 @@ int geni_se_tx_dma_prep(struct geni_se *se, void *buf, size_t len,
+ writel_relaxed(lower_32_bits(*iova), se->base + SE_DMA_TX_PTR_L);
+ writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_TX_PTR_H);
+ writel_relaxed(GENI_SE_DMA_EOT_BUF, se->base + SE_DMA_TX_ATTR);
+- writel_relaxed(len, se->base + SE_DMA_TX_LEN);
++ writel(len, se->base + SE_DMA_TX_LEN);
+ return 0;
+ }
+ EXPORT_SYMBOL(geni_se_tx_dma_prep);
+@@ -667,7 +680,7 @@ int geni_se_rx_dma_prep(struct geni_se *se, void *buf, size_t len,
+ writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_RX_PTR_H);
+ /* RX does not have EOT buffer type bit. So just reset RX_ATTR */
+ writel_relaxed(0, se->base + SE_DMA_RX_ATTR);
+- writel_relaxed(len, se->base + SE_DMA_RX_LEN);
++ writel(len, se->base + SE_DMA_RX_LEN);
+ return 0;
+ }
+ EXPORT_SYMBOL(geni_se_rx_dma_prep);
+diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c
+index c22503cd1edf9..7908e7f2850f9 100644
+--- a/drivers/soc/qcom/smp2p.c
++++ b/drivers/soc/qcom/smp2p.c
+@@ -326,15 +326,16 @@ static int qcom_smp2p_inbound_entry(struct qcom_smp2p *smp2p,
+ static int smp2p_update_bits(void *data, u32 mask, u32 value)
+ {
+ struct smp2p_entry *entry = data;
++ unsigned long flags;
+ u32 orig;
+ u32 val;
+
+- spin_lock(&entry->lock);
++ spin_lock_irqsave(&entry->lock, flags);
+ val = orig = readl(entry->value);
+ val &= ~mask;
+ val |= value;
+ writel(val, entry->value);
+- spin_unlock(&entry->lock);
++ spin_unlock_irqrestore(&entry->lock, flags);
+
+ if (val != orig)
+ qcom_smp2p_kick(entry->smp2p);
+diff --git a/drivers/soc/tegra/fuse/speedo-tegra210.c b/drivers/soc/tegra/fuse/speedo-tegra210.c
+index 5373f4c16b54c..4403b89561fd6 100644
+--- a/drivers/soc/tegra/fuse/speedo-tegra210.c
++++ b/drivers/soc/tegra/fuse/speedo-tegra210.c
+@@ -105,7 +105,7 @@ static int get_process_id(int value, const u32 *speedos, unsigned int num)
+ unsigned int i;
+
+ for (i = 0; i < num; i++)
+- if (value < speedos[num])
++ if (value < speedos[i])
+ return i;
+
+ return -EINVAL;
+diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
+index 224d7ddeeb767..eb2e87229c1da 100644
+--- a/drivers/soc/ti/knav_dma.c
++++ b/drivers/soc/ti/knav_dma.c
+@@ -759,8 +759,9 @@ static int knav_dma_probe(struct platform_device *pdev)
+ pm_runtime_enable(kdev->dev);
+ ret = pm_runtime_get_sync(kdev->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(kdev->dev);
+ dev_err(kdev->dev, "unable to enable pktdma, err %d\n", ret);
+- return ret;
++ goto err_pm_disable;
+ }
+
+ /* Initialise all packet dmas */
+@@ -774,7 +775,8 @@ static int knav_dma_probe(struct platform_device *pdev)
+
+ if (list_empty(&kdev->list)) {
+ dev_err(dev, "no valid dma instance\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto err_put_sync;
+ }
+
+ debugfs_create_file("knav_dma", S_IFREG | S_IRUGO, NULL, NULL,
+@@ -782,6 +784,13 @@ static int knav_dma_probe(struct platform_device *pdev)
+
+ device_ready = true;
+ return ret;
++
++err_put_sync:
++ pm_runtime_put_sync(kdev->dev);
++err_pm_disable:
++ pm_runtime_disable(kdev->dev);
++
++ return ret;
+ }
+
+ static int knav_dma_remove(struct platform_device *pdev)
+diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
+index ef36acc0e7088..9f5ce52e6c161 100644
+--- a/drivers/soc/ti/knav_qmss_queue.c
++++ b/drivers/soc/ti/knav_qmss_queue.c
+@@ -1799,6 +1799,7 @@ static int knav_queue_probe(struct platform_device *pdev)
+ pm_runtime_enable(&pdev->dev);
+ ret = pm_runtime_get_sync(&pdev->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(&pdev->dev);
+ dev_err(dev, "Failed to enable QMSS\n");
+ return ret;
+ }
+@@ -1866,9 +1867,10 @@ static int knav_queue_probe(struct platform_device *pdev)
+ if (ret)
+ goto err;
+
+- regions = of_get_child_by_name(node, "descriptor-regions");
++ regions = of_get_child_by_name(node, "descriptor-regions");
+ if (!regions) {
+ dev_err(dev, "descriptor-regions not specified\n");
++ ret = -ENODEV;
+ goto err;
+ }
+ ret = knav_queue_setup_regions(kdev, regions);
+diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
+index 11895c98aae3b..8ea7e31b8c2fb 100644
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -407,7 +407,7 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
+ unsigned long clk_hz;
+ int err;
+
+- master = spi_alloc_master(&pdev->dev, sizeof(*bs));
++ master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
+ if (!master) {
+ dev_err(&pdev->dev, "spi_alloc_master() failed\n");
+ return -ENOMEM;
+@@ -439,30 +439,27 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
+ /* the main area */
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ bs->regs = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(bs->regs)) {
+- err = PTR_ERR(bs->regs);
+- goto out_master_put;
+- }
++ if (IS_ERR(bs->regs))
++ return PTR_ERR(bs->regs);
+
+ bs->clk = devm_clk_get(&pdev->dev, NULL);
+ if ((!bs->clk) || (IS_ERR(bs->clk))) {
+ err = PTR_ERR(bs->clk);
+ dev_err(&pdev->dev, "could not get clk: %d\n", err);
+- goto out_master_put;
++ return err;
+ }
+
+ bs->irq = platform_get_irq(pdev, 0);
+ if (bs->irq <= 0) {
+ dev_err(&pdev->dev, "could not get IRQ: %d\n", bs->irq);
+- err = bs->irq ? bs->irq : -ENODEV;
+- goto out_master_put;
++ return bs->irq ? bs->irq : -ENODEV;
+ }
+
+ /* this also enables the HW block */
+ err = clk_prepare_enable(bs->clk);
+ if (err) {
+ dev_err(&pdev->dev, "could not prepare clock: %d\n", err);
+- goto out_master_put;
++ return err;
+ }
+
+ /* just checking if the clock returns a sane value */
+@@ -495,8 +492,6 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
+
+ out_clk_disable:
+ clk_disable_unprepare(bs->clk);
+-out_master_put:
+- spi_master_put(master);
+ return err;
+ }
+
+diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
+index 1669c554ea340..2ad7b3f3666be 100644
+--- a/drivers/spi/spi-bcm63xx-hsspi.c
++++ b/drivers/spi/spi-bcm63xx-hsspi.c
+@@ -487,8 +487,10 @@ static int bcm63xx_hsspi_resume(struct device *dev)
+
+ if (bs->pll_clk) {
+ ret = clk_prepare_enable(bs->pll_clk);
+- if (ret)
++ if (ret) {
++ clk_disable_unprepare(bs->clk);
+ return ret;
++ }
+ }
+
+ spi_master_resume(master);
+diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
+index a02099c90c5c2..b56038945f411 100644
+--- a/drivers/spi/spi-davinci.c
++++ b/drivers/spi/spi-davinci.c
+@@ -1086,13 +1086,13 @@ static int davinci_spi_remove(struct platform_device *pdev)
+ spi_bitbang_stop(&dspi->bitbang);
+
+ clk_disable_unprepare(dspi->clk);
+- spi_master_put(master);
+
+ if (dspi->dma_rx) {
+ dma_release_channel(dspi->dma_rx);
+ dma_release_channel(dspi->dma_tx);
+ }
+
++ spi_master_put(master);
+ return 0;
+ }
+
+diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
+index e4b31d6e6e33e..25a545c985d4a 100644
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -774,8 +774,10 @@ static int img_spfi_resume(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret)
++ if (ret) {
++ pm_runtime_put_noidle(dev);
+ return ret;
++ }
+ spfi_reset(spfi);
+ pm_runtime_put(dev);
+
+diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
+index 6ac95a2a21cef..4a7375ecb65ef 100644
+--- a/drivers/spi/spi-mxs.c
++++ b/drivers/spi/spi-mxs.c
+@@ -605,6 +605,7 @@ static int mxs_spi_probe(struct platform_device *pdev)
+
+ ret = pm_runtime_get_sync(ssp->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(ssp->dev);
+ dev_err(ssp->dev, "runtime_get_sync failed\n");
+ goto out_pm_runtime_disable;
+ }
+diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c
+index 288002f6c613e..661a40c653e90 100644
+--- a/drivers/spi/spi-pic32.c
++++ b/drivers/spi/spi-pic32.c
+@@ -839,6 +839,7 @@ static int pic32_spi_probe(struct platform_device *pdev)
+ return 0;
+
+ err_bailout:
++ pic32_spi_dma_unprep(pic32s);
+ clk_disable_unprepare(pic32s->clk);
+ err_master:
+ spi_master_put(master);
+diff --git a/drivers/spi/spi-rb4xx.c b/drivers/spi/spi-rb4xx.c
+index 3641d0e20135b..1d7fd6dbaf876 100644
+--- a/drivers/spi/spi-rb4xx.c
++++ b/drivers/spi/spi-rb4xx.c
+@@ -148,7 +148,7 @@ static int rb4xx_spi_probe(struct platform_device *pdev)
+ if (IS_ERR(spi_base))
+ return PTR_ERR(spi_base);
+
+- master = spi_alloc_master(&pdev->dev, sizeof(*rbspi));
++ master = devm_spi_alloc_master(&pdev->dev, sizeof(*rbspi));
+ if (!master)
+ return -ENOMEM;
+
+diff --git a/drivers/spi/spi-sc18is602.c b/drivers/spi/spi-sc18is602.c
+index 52cf0e9189c23..64cf1f572b6dd 100644
+--- a/drivers/spi/spi-sc18is602.c
++++ b/drivers/spi/spi-sc18is602.c
+@@ -248,13 +248,12 @@ static int sc18is602_probe(struct i2c_client *client,
+ struct sc18is602_platform_data *pdata = dev_get_platdata(dev);
+ struct sc18is602 *hw;
+ struct spi_master *master;
+- int error;
+
+ if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C |
+ I2C_FUNC_SMBUS_WRITE_BYTE_DATA))
+ return -EINVAL;
+
+- master = spi_alloc_master(dev, sizeof(struct sc18is602));
++ master = devm_spi_alloc_master(dev, sizeof(struct sc18is602));
+ if (!master)
+ return -ENOMEM;
+
+@@ -308,15 +307,7 @@ static int sc18is602_probe(struct i2c_client *client,
+ master->min_speed_hz = hw->freq / 128;
+ master->max_speed_hz = hw->freq / 4;
+
+- error = devm_spi_register_master(dev, master);
+- if (error)
+- goto error_reg;
+-
+- return 0;
+-
+-error_reg:
+- spi_master_put(master);
+- return error;
++ return devm_spi_register_master(dev, master);
+ }
+
+ static const struct i2c_device_id sc18is602_id[] = {
+diff --git a/drivers/spi/spi-sh.c b/drivers/spi/spi-sh.c
+index 50e0ea9acf8b8..cba49a65ed2bd 100644
+--- a/drivers/spi/spi-sh.c
++++ b/drivers/spi/spi-sh.c
+@@ -450,7 +450,7 @@ static int spi_sh_probe(struct platform_device *pdev)
+ return irq;
+ }
+
+- master = spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data));
++ master = devm_spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data));
+ if (master == NULL) {
+ dev_err(&pdev->dev, "spi_alloc_master error.\n");
+ return -ENOMEM;
+@@ -468,16 +468,14 @@ static int spi_sh_probe(struct platform_device *pdev)
+ break;
+ default:
+ dev_err(&pdev->dev, "No support width\n");
+- ret = -ENODEV;
+- goto error1;
++ return -ENODEV;
+ }
+ ss->irq = irq;
+ ss->master = master;
+ ss->addr = devm_ioremap(&pdev->dev, res->start, resource_size(res));
+ if (ss->addr == NULL) {
+ dev_err(&pdev->dev, "ioremap error.\n");
+- ret = -ENOMEM;
+- goto error1;
++ return -ENOMEM;
+ }
+ INIT_LIST_HEAD(&ss->queue);
+ spin_lock_init(&ss->lock);
+@@ -487,7 +485,7 @@ static int spi_sh_probe(struct platform_device *pdev)
+ ret = request_irq(irq, spi_sh_irq, 0, "spi_sh", ss);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "request_irq error\n");
+- goto error1;
++ return ret;
+ }
+
+ master->num_chipselect = 2;
+@@ -506,9 +504,6 @@ static int spi_sh_probe(struct platform_device *pdev)
+
+ error3:
+ free_irq(irq, ss);
+- error1:
+- spi_master_put(master);
+-
+ return ret;
+ }
+
+diff --git a/drivers/spi/spi-st-ssc4.c b/drivers/spi/spi-st-ssc4.c
+index 5df01ffdef468..b46502db7f122 100644
+--- a/drivers/spi/spi-st-ssc4.c
++++ b/drivers/spi/spi-st-ssc4.c
+@@ -379,13 +379,14 @@ static int spi_st_probe(struct platform_device *pdev)
+ ret = devm_spi_register_master(&pdev->dev, master);
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to register master\n");
+- goto clk_disable;
++ goto rpm_disable;
+ }
+
+ return 0;
+
+-clk_disable:
++rpm_disable:
+ pm_runtime_disable(&pdev->dev);
++clk_disable:
+ clk_disable_unprepare(spi_st->clk);
+ put_master:
+ spi_master_put(master);
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index 09cfae3abce2d..c510b53e5e3f5 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -827,6 +827,7 @@ static int tegra_spi_setup(struct spi_device *spi)
+
+ ret = pm_runtime_get_sync(tspi->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(tspi->dev);
+ dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
+ return ret;
+ }
+@@ -1252,6 +1253,7 @@ static int tegra_spi_resume(struct device *dev)
+
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(dev);
+ dev_err(dev, "pm runtime failed, e = %d\n", ret);
+ return ret;
+ }
+diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
+index 22893a7e0aa0e..749288310c36c 100644
+--- a/drivers/spi/spi-tegra20-sflash.c
++++ b/drivers/spi/spi-tegra20-sflash.c
+@@ -564,6 +564,7 @@ static int tegra_sflash_resume(struct device *dev)
+
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(dev);
+ dev_err(dev, "pm runtime failed, e = %d\n", ret);
+ return ret;
+ }
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index d1187317bb5d7..c6b80a60951b1 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -761,6 +761,7 @@ static int tegra_slink_setup(struct spi_device *spi)
+
+ ret = pm_runtime_get_sync(tspi->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(tspi->dev);
+ dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
+ return ret;
+ }
+@@ -1197,6 +1198,7 @@ static int tegra_slink_resume(struct device *dev)
+
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(dev);
+ dev_err(dev, "pm runtime failed, e = %d\n", ret);
+ return ret;
+ }
+diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
+index 95c28abaa0272..73a08724034ba 100644
+--- a/drivers/spi/spi-ti-qspi.c
++++ b/drivers/spi/spi-ti-qspi.c
+@@ -183,6 +183,7 @@ static int ti_qspi_setup(struct spi_device *spi)
+
+ ret = pm_runtime_get_sync(qspi->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(qspi->dev);
+ dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
+ return ret;
+ }
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index fbc5444bd9cbd..7dabbc82b6463 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -362,9 +362,11 @@ static int spi_drv_probe(struct device *dev)
+ if (ret)
+ return ret;
+
+- ret = sdrv->probe(spi);
+- if (ret)
+- dev_pm_domain_detach(dev, true);
++ if (sdrv->probe) {
++ ret = sdrv->probe(spi);
++ if (ret)
++ dev_pm_domain_detach(dev, true);
++ }
+
+ return ret;
+ }
+@@ -372,9 +374,10 @@ static int spi_drv_probe(struct device *dev)
+ static int spi_drv_remove(struct device *dev)
+ {
+ const struct spi_driver *sdrv = to_spi_driver(dev->driver);
+- int ret;
++ int ret = 0;
+
+- ret = sdrv->remove(to_spi_device(dev));
++ if (sdrv->remove)
++ ret = sdrv->remove(to_spi_device(dev));
+ dev_pm_domain_detach(dev, true);
+
+ return ret;
+@@ -399,10 +402,8 @@ int __spi_register_driver(struct module *owner, struct spi_driver *sdrv)
+ {
+ sdrv->driver.owner = owner;
+ sdrv->driver.bus = &spi_bus_type;
+- if (sdrv->probe)
+- sdrv->driver.probe = spi_drv_probe;
+- if (sdrv->remove)
+- sdrv->driver.remove = spi_drv_remove;
++ sdrv->driver.probe = spi_drv_probe;
++ sdrv->driver.remove = spi_drv_remove;
+ if (sdrv->shutdown)
+ sdrv->driver.shutdown = spi_drv_shutdown;
+ return driver_register(&sdrv->driver);
+diff --git a/drivers/staging/comedi/drivers/mf6x4.c b/drivers/staging/comedi/drivers/mf6x4.c
+index ea430237efa7f..9da8dd748078d 100644
+--- a/drivers/staging/comedi/drivers/mf6x4.c
++++ b/drivers/staging/comedi/drivers/mf6x4.c
+@@ -112,8 +112,9 @@ static int mf6x4_ai_eoc(struct comedi_device *dev,
+ struct mf6x4_private *devpriv = dev->private;
+ unsigned int status;
+
++ /* EOLC goes low at end of conversion. */
+ status = ioread32(devpriv->gpioc_reg);
+- if (status & MF6X4_GPIOC_EOLC)
++ if ((status & MF6X4_GPIOC_EOLC) == 0)
+ return 0;
+ return -EBUSY;
+ }
+diff --git a/drivers/staging/gasket/gasket_interrupt.c b/drivers/staging/gasket/gasket_interrupt.c
+index 1cfbc120f2284..225460c535d61 100644
+--- a/drivers/staging/gasket/gasket_interrupt.c
++++ b/drivers/staging/gasket/gasket_interrupt.c
+@@ -527,14 +527,16 @@ int gasket_interrupt_system_status(struct gasket_dev *gasket_dev)
+ int gasket_interrupt_set_eventfd(struct gasket_interrupt_data *interrupt_data,
+ int interrupt, int event_fd)
+ {
+- struct eventfd_ctx *ctx = eventfd_ctx_fdget(event_fd);
+-
+- if (IS_ERR(ctx))
+- return PTR_ERR(ctx);
++ struct eventfd_ctx *ctx;
+
+ if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
+ return -EINVAL;
+
++ ctx = eventfd_ctx_fdget(event_fd);
++
++ if (IS_ERR(ctx))
++ return PTR_ERR(ctx);
++
+ interrupt_data->eventfd_ctxs[interrupt] = ctx;
+ return 0;
+ }
+@@ -545,6 +547,9 @@ int gasket_interrupt_clear_eventfd(struct gasket_interrupt_data *interrupt_data,
+ if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
+ return -EINVAL;
+
+- interrupt_data->eventfd_ctxs[interrupt] = NULL;
++ if (interrupt_data->eventfd_ctxs[interrupt]) {
++ eventfd_ctx_put(interrupt_data->eventfd_ctxs[interrupt]);
++ interrupt_data->eventfd_ctxs[interrupt] = NULL;
++ }
+ return 0;
+ }
+diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c
+index 35acd55ca5ab7..6cbf69a57dfd9 100644
+--- a/drivers/staging/greybus/audio_codec.c
++++ b/drivers/staging/greybus/audio_codec.c
+@@ -489,6 +489,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream,
+ if (ret) {
+ dev_err_ratelimited(dai->dev, "%d: Error during set_config\n",
+ ret);
++ gb_pm_runtime_put_noidle(bundle);
+ mutex_unlock(&codec->lock);
+ return ret;
+ }
+@@ -565,6 +566,7 @@ static int gbcodec_prepare(struct snd_pcm_substream *substream,
+ break;
+ }
+ if (ret) {
++ gb_pm_runtime_put_noidle(bundle);
+ mutex_unlock(&codec->lock);
+ dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n",
+ ret);
+diff --git a/drivers/staging/mt7621-spi/spi-mt7621.c b/drivers/staging/mt7621-spi/spi-mt7621.c
+index 578aa6824ad3e..33c747bc83202 100644
+--- a/drivers/staging/mt7621-spi/spi-mt7621.c
++++ b/drivers/staging/mt7621-spi/spi-mt7621.c
+@@ -455,6 +455,7 @@ static int mt7621_spi_probe(struct platform_device *pdev)
+ master = spi_alloc_master(&pdev->dev, sizeof(*rs));
+ if (master == NULL) {
+ dev_info(&pdev->dev, "master allocation failed\n");
++ clk_disable_unprepare(clk);
+ return -ENOMEM;
+ }
+
+@@ -480,6 +481,7 @@ static int mt7621_spi_probe(struct platform_device *pdev)
+ ret = device_reset(&pdev->dev);
+ if (ret) {
+ dev_err(&pdev->dev, "SPI reset failed!\n");
++ clk_disable_unprepare(clk);
+ return ret;
+ }
+
+diff --git a/drivers/staging/speakup/speakup_dectlk.c b/drivers/staging/speakup/speakup_dectlk.c
+index a144f28ee1a8a..04de81559c6e3 100644
+--- a/drivers/staging/speakup/speakup_dectlk.c
++++ b/drivers/staging/speakup/speakup_dectlk.c
+@@ -37,7 +37,7 @@ static unsigned char get_index(struct spk_synth *synth);
+ static int in_escape;
+ static int is_flushing;
+
+-static spinlock_t flush_lock;
++static DEFINE_SPINLOCK(flush_lock);
+ static DECLARE_WAIT_QUEUE_HEAD(flush);
+
+ static struct var_t vars[] = {
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index cbd006fb7fbb9..c1166b45c288b 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -163,11 +163,6 @@ static void omap_8250_mdr1_errataset(struct uart_8250_port *up,
+ struct omap8250_priv *priv)
+ {
+ u8 timeout = 255;
+- u8 old_mdr1;
+-
+- old_mdr1 = serial_in(up, UART_OMAP_MDR1);
+- if (old_mdr1 == priv->mdr1)
+- return;
+
+ serial_out(up, UART_OMAP_MDR1, priv->mdr1);
+ udelay(2);
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 2a5bf4c14fb89..80fa06b16d9d7 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1421,6 +1421,10 @@ static void uart_set_ldisc(struct tty_struct *tty)
+ {
+ struct uart_state *state = tty->driver_data;
+ struct uart_port *uport;
++ struct tty_port *port = &state->port;
++
++ if (!tty_port_initialized(port))
++ return;
+
+ mutex_lock(&state->port.mutex);
+ uport = uart_port_check(state);
+diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
+index 19f5f5f2a48a1..7335dc8552180 100644
+--- a/drivers/usb/chipidea/ci_hdrc_imx.c
++++ b/drivers/usb/chipidea/ci_hdrc_imx.c
+@@ -57,7 +57,8 @@ static const struct ci_hdrc_imx_platform_flag imx6sx_usb_data = {
+
+ static const struct ci_hdrc_imx_platform_flag imx6ul_usb_data = {
+ .flags = CI_HDRC_SUPPORTS_RUNTIME_PM |
+- CI_HDRC_TURN_VBUS_EARLY_ON,
++ CI_HDRC_TURN_VBUS_EARLY_ON |
++ CI_HDRC_DISABLE_DEVICE_STREAMING,
+ };
+
+ static const struct ci_hdrc_imx_platform_flag imx7d_usb_data = {
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index b55c3a699fc65..c1592403222f5 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -342,6 +342,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x06a3, 0x0006), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
++ /* Agfa SNAPSCAN 1212U */
++ { USB_DEVICE(0x06bd, 0x0001), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Guillemot Webcam Hercules Dualpix Exchange (2nd ID) */
+ { USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
+
+diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c
+index 9fc98de836249..add0f7ead55cc 100644
+--- a/drivers/usb/gadget/function/f_acm.c
++++ b/drivers/usb/gadget/function/f_acm.c
+@@ -684,7 +684,7 @@ acm_bind(struct usb_configuration *c, struct usb_function *f)
+ acm_ss_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function,
+- acm_ss_function, NULL);
++ acm_ss_function, acm_ss_function);
+ if (status)
+ goto fail;
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index bb2edfc77627b..5c1846d1372ec 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1247,6 +1247,7 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+
+ switch (epfile->ffs->gadget->speed) {
+ case USB_SPEED_SUPER:
++ case USB_SPEED_SUPER_PLUS:
+ desc_idx = 2;
+ break;
+ case USB_SPEED_HIGH:
+@@ -3077,7 +3078,8 @@ static int _ffs_func_bind(struct usb_configuration *c,
+ }
+
+ if (likely(super)) {
+- func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs);
++ func->function.ss_descriptors = func->function.ssp_descriptors =
++ vla_ptr(vlabuf, d, ss_descs);
+ ss_len = ffs_do_descs(ffs->ss_descs_count,
+ vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
+ d_raw_descs__sz - fs_len - hs_len,
+@@ -3487,6 +3489,7 @@ static void ffs_func_unbind(struct usb_configuration *c,
+ func->function.fs_descriptors = NULL;
+ func->function.hs_descriptors = NULL;
+ func->function.ss_descriptors = NULL;
++ func->function.ssp_descriptors = NULL;
+ func->interfaces_nums = NULL;
+
+ ffs_event_add(ffs, FUNCTIONFS_UNBIND);
+diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
+index b2b5b0689667b..0e083a53da534 100644
+--- a/drivers/usb/gadget/function/f_midi.c
++++ b/drivers/usb/gadget/function/f_midi.c
+@@ -1048,6 +1048,12 @@ static int f_midi_bind(struct usb_configuration *c, struct usb_function *f)
+ f->ss_descriptors = usb_copy_descriptors(midi_function);
+ if (!f->ss_descriptors)
+ goto fail_f_midi;
++
++ if (gadget_is_superspeed_plus(c->cdev->gadget)) {
++ f->ssp_descriptors = usb_copy_descriptors(midi_function);
++ if (!f->ssp_descriptors)
++ goto fail_f_midi;
++ }
+ }
+
+ kfree(midi_function);
+diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
+index 0d8e4a364ca6e..cc1ff5b7b60c4 100644
+--- a/drivers/usb/gadget/function/f_rndis.c
++++ b/drivers/usb/gadget/function/f_rndis.c
+@@ -87,8 +87,10 @@ static inline struct f_rndis *func_to_rndis(struct usb_function *f)
+ /* peak (theoretical) bulk transfer rate in bits-per-second */
+ static unsigned int bitrate(struct usb_gadget *g)
+ {
++ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
++ return 4250000000U;
+ if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
+- return 13 * 1024 * 8 * 1000 * 8;
++ return 3750000000U;
+ else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
+ return 13 * 512 * 8 * 1000 * 8;
+ else
+diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
+index d0248c58dcb6a..fdbce8529dbb4 100644
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -2747,7 +2747,7 @@ static int __init init(void)
+ {
+ int retval = -ENOMEM;
+ int i;
+- struct dummy *dum[MAX_NUM_UDC];
++ struct dummy *dum[MAX_NUM_UDC] = {};
+
+ if (usb_disabled())
+ return -ENODEV;
+diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
+index 7d20296cbe9f9..d31c425d61675 100644
+--- a/drivers/usb/host/ehci-omap.c
++++ b/drivers/usb/host/ehci-omap.c
+@@ -222,6 +222,7 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+
+ err_pm_runtime:
+ pm_runtime_put_sync(dev);
++ pm_runtime_disable(dev);
+
+ err_phy:
+ for (i = 0; i < omap->nports; i++) {
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index afa321ab55fcf..c9acc59f4addd 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1864,7 +1864,7 @@ max3421_probe(struct spi_device *spi)
+ struct max3421_hcd *max3421_hcd;
+ struct usb_hcd *hcd = NULL;
+ struct max3421_hcd_platform_data *pdata = NULL;
+- int retval = -ENOMEM;
++ int retval;
+
+ if (spi_setup(spi) < 0) {
+ dev_err(&spi->dev, "Unable to setup SPI bus");
+@@ -1906,6 +1906,7 @@ max3421_probe(struct spi_device *spi)
+ goto error;
+ }
+
++ retval = -ENOMEM;
+ hcd = usb_create_hcd(&max3421_hcd_desc, &spi->dev,
+ dev_name(&spi->dev));
+ if (!hcd) {
+diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
+index c5e6e8d0b5ef5..10d97261b433f 100644
+--- a/drivers/usb/host/oxu210hp-hcd.c
++++ b/drivers/usb/host/oxu210hp-hcd.c
+@@ -3719,8 +3719,10 @@ static struct usb_hcd *oxu_create(struct platform_device *pdev,
+ oxu->is_otg = otg;
+
+ ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
+- if (ret < 0)
++ if (ret < 0) {
++ usb_put_hcd(hcd);
+ return ERR_PTR(ret);
++ }
+
+ device_wakeup_enable(hcd->self.controller);
+ return hcd;
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 64dc94853b8b5..e6e8bed11aeab 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1617,6 +1617,10 @@ retry:
+ hcd->state = HC_STATE_SUSPENDED;
+ bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
+ spin_unlock_irqrestore(&xhci->lock, flags);
++
++ if (bus_state->bus_suspended)
++ usleep_range(5000, 10000);
++
+ return 0;
+ }
+
+diff --git a/drivers/usb/misc/sisusbvga/Kconfig b/drivers/usb/misc/sisusbvga/Kconfig
+index 36bc28c884ad7..47dabccafef43 100644
+--- a/drivers/usb/misc/sisusbvga/Kconfig
++++ b/drivers/usb/misc/sisusbvga/Kconfig
+@@ -15,7 +15,7 @@ config USB_SISUSBVGA
+
+ config USB_SISUSBVGA_CON
+ bool "Text console and mode switching support" if USB_SISUSBVGA
+- depends on VT
++ depends on VT && BROKEN
+ select FONT_8x16
+ ---help---
+ Say Y here if you want a VGA text console via the USB dongle or
+diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
+index e7f244cf2c072..a618276ead98d 100644
+--- a/drivers/usb/serial/digi_acceleport.c
++++ b/drivers/usb/serial/digi_acceleport.c
+@@ -19,7 +19,6 @@
+ #include <linux/tty_flip.h>
+ #include <linux/module.h>
+ #include <linux/spinlock.h>
+-#include <linux/workqueue.h>
+ #include <linux/uaccess.h>
+ #include <linux/usb.h>
+ #include <linux/wait.h>
+@@ -198,14 +197,12 @@ struct digi_port {
+ int dp_throttle_restart;
+ wait_queue_head_t dp_flush_wait;
+ wait_queue_head_t dp_close_wait; /* wait queue for close */
+- struct work_struct dp_wakeup_work;
+ struct usb_serial_port *dp_port;
+ };
+
+
+ /* Local Function Declarations */
+
+-static void digi_wakeup_write_lock(struct work_struct *work);
+ static int digi_write_oob_command(struct usb_serial_port *port,
+ unsigned char *buf, int count, int interruptible);
+ static int digi_write_inb_command(struct usb_serial_port *port,
+@@ -356,26 +353,6 @@ __releases(lock)
+ return timeout;
+ }
+
+-
+-/*
+- * Digi Wakeup Write
+- *
+- * Wake up port, line discipline, and tty processes sleeping
+- * on writes.
+- */
+-
+-static void digi_wakeup_write_lock(struct work_struct *work)
+-{
+- struct digi_port *priv =
+- container_of(work, struct digi_port, dp_wakeup_work);
+- struct usb_serial_port *port = priv->dp_port;
+- unsigned long flags;
+-
+- spin_lock_irqsave(&priv->dp_port_lock, flags);
+- tty_port_tty_wakeup(&port->port);
+- spin_unlock_irqrestore(&priv->dp_port_lock, flags);
+-}
+-
+ /*
+ * Digi Write OOB Command
+ *
+@@ -987,6 +964,7 @@ static void digi_write_bulk_callback(struct urb *urb)
+ unsigned long flags;
+ int ret = 0;
+ int status = urb->status;
++ bool wakeup;
+
+ /* port and serial sanity check */
+ if (port == NULL || (priv = usb_get_serial_port_data(port)) == NULL) {
+@@ -1013,6 +991,7 @@ static void digi_write_bulk_callback(struct urb *urb)
+ }
+
+ /* try to send any buffered data on this port */
++ wakeup = true;
+ spin_lock_irqsave(&priv->dp_port_lock, flags);
+ priv->dp_write_urb_in_use = 0;
+ if (priv->dp_out_buf_len > 0) {
+@@ -1028,19 +1007,18 @@ static void digi_write_bulk_callback(struct urb *urb)
+ if (ret == 0) {
+ priv->dp_write_urb_in_use = 1;
+ priv->dp_out_buf_len = 0;
++ wakeup = false;
+ }
+ }
+- /* wake up processes sleeping on writes immediately */
+- tty_port_tty_wakeup(&port->port);
+- /* also queue up a wakeup at scheduler time, in case we */
+- /* lost the race in write_chan(). */
+- schedule_work(&priv->dp_wakeup_work);
+-
+ spin_unlock_irqrestore(&priv->dp_port_lock, flags);
++
+ if (ret && ret != -EPERM)
+ dev_err_console(port,
+ "%s: usb_submit_urb failed, ret=%d, port=%d\n",
+ __func__, ret, priv->dp_port_num);
++
++ if (wakeup)
++ tty_port_tty_wakeup(&port->port);
+ }
+
+ static int digi_write_room(struct tty_struct *tty)
+@@ -1240,7 +1218,6 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
+ init_waitqueue_head(&priv->dp_transmit_idle_wait);
+ init_waitqueue_head(&priv->dp_flush_wait);
+ init_waitqueue_head(&priv->dp_close_wait);
+- INIT_WORK(&priv->dp_wakeup_work, digi_wakeup_write_lock);
+ priv->dp_port = port;
+
+ init_waitqueue_head(&port->write_wait);
+@@ -1509,13 +1486,14 @@ static int digi_read_oob_callback(struct urb *urb)
+ rts = C_CRTSCTS(tty);
+
+ if (tty && opcode == DIGI_CMD_READ_INPUT_SIGNALS) {
++ bool wakeup = false;
++
+ spin_lock_irqsave(&priv->dp_port_lock, flags);
+ /* convert from digi flags to termiox flags */
+ if (val & DIGI_READ_INPUT_SIGNALS_CTS) {
+ priv->dp_modem_signals |= TIOCM_CTS;
+- /* port must be open to use tty struct */
+ if (rts)
+- tty_port_tty_wakeup(&port->port);
++ wakeup = true;
+ } else {
+ priv->dp_modem_signals &= ~TIOCM_CTS;
+ /* port must be open to use tty struct */
+@@ -1534,6 +1512,9 @@ static int digi_read_oob_callback(struct urb *urb)
+ priv->dp_modem_signals &= ~TIOCM_CD;
+
+ spin_unlock_irqrestore(&priv->dp_port_lock, flags);
++
++ if (wakeup)
++ tty_port_tty_wakeup(&port->port);
+ } else if (opcode == DIGI_CMD_TRANSMIT_IDLE) {
+ spin_lock_irqsave(&priv->dp_port_lock, flags);
+ priv->dp_transmit_idle = 1;
+diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
+index 38d43c4b7ce54..e7a2aa1747db1 100644
+--- a/drivers/usb/serial/keyspan_pda.c
++++ b/drivers/usb/serial/keyspan_pda.c
+@@ -40,11 +40,12 @@
+ #define DRIVER_AUTHOR "Brian Warner <warner@lothar.com>"
+ #define DRIVER_DESC "USB Keyspan PDA Converter driver"
+
++#define KEYSPAN_TX_THRESHOLD 16
++
+ struct keyspan_pda_private {
+ int tx_room;
+ int tx_throttled;
+- struct work_struct wakeup_work;
+- struct work_struct unthrottle_work;
++ struct work_struct unthrottle_work;
+ struct usb_serial *serial;
+ struct usb_serial_port *port;
+ };
+@@ -97,15 +98,6 @@ static const struct usb_device_id id_table_fake_xircom[] = {
+ };
+ #endif
+
+-static void keyspan_pda_wakeup_write(struct work_struct *work)
+-{
+- struct keyspan_pda_private *priv =
+- container_of(work, struct keyspan_pda_private, wakeup_work);
+- struct usb_serial_port *port = priv->port;
+-
+- tty_port_tty_wakeup(&port->port);
+-}
+-
+ static void keyspan_pda_request_unthrottle(struct work_struct *work)
+ {
+ struct keyspan_pda_private *priv =
+@@ -120,7 +112,7 @@ static void keyspan_pda_request_unthrottle(struct work_struct *work)
+ 7, /* request_unthrottle */
+ USB_TYPE_VENDOR | USB_RECIP_INTERFACE
+ | USB_DIR_OUT,
+- 16, /* value: threshold */
++ KEYSPAN_TX_THRESHOLD,
+ 0, /* index */
+ NULL,
+ 0,
+@@ -139,6 +131,8 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
+ int retval;
+ int status = urb->status;
+ struct keyspan_pda_private *priv;
++ unsigned long flags;
++
+ priv = usb_get_serial_port_data(port);
+
+ switch (status) {
+@@ -172,18 +166,21 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
+ break;
+ case 1:
+ /* status interrupt */
+- if (len < 3) {
++ if (len < 2) {
+ dev_warn(&port->dev, "short interrupt message received\n");
+ break;
+ }
+- dev_dbg(&port->dev, "rx int, d1=%d, d2=%d\n", data[1], data[2]);
++ dev_dbg(&port->dev, "rx int, d1=%d\n", data[1]);
+ switch (data[1]) {
+ case 1: /* modemline change */
+ break;
+ case 2: /* tx unthrottle interrupt */
++ spin_lock_irqsave(&port->lock, flags);
+ priv->tx_throttled = 0;
++ priv->tx_room = max(priv->tx_room, KEYSPAN_TX_THRESHOLD);
++ spin_unlock_irqrestore(&port->lock, flags);
+ /* queue up a wakeup at scheduler time */
+- schedule_work(&priv->wakeup_work);
++ usb_serial_port_softint(port);
+ break;
+ default:
+ break;
+@@ -443,6 +440,7 @@ static int keyspan_pda_write(struct tty_struct *tty,
+ int request_unthrottle = 0;
+ int rc = 0;
+ struct keyspan_pda_private *priv;
++ unsigned long flags;
+
+ priv = usb_get_serial_port_data(port);
+ /* guess how much room is left in the device's ring buffer, and if we
+@@ -462,13 +460,13 @@ static int keyspan_pda_write(struct tty_struct *tty,
+ the TX urb is in-flight (wait until it completes)
+ the device is full (wait until it says there is room)
+ */
+- spin_lock_bh(&port->lock);
++ spin_lock_irqsave(&port->lock, flags);
+ if (!test_bit(0, &port->write_urbs_free) || priv->tx_throttled) {
+- spin_unlock_bh(&port->lock);
++ spin_unlock_irqrestore(&port->lock, flags);
+ return 0;
+ }
+ clear_bit(0, &port->write_urbs_free);
+- spin_unlock_bh(&port->lock);
++ spin_unlock_irqrestore(&port->lock, flags);
+
+ /* At this point the URB is in our control, nobody else can submit it
+ again (the only sudden transition was the one from EINPROGRESS to
+@@ -514,7 +512,8 @@ static int keyspan_pda_write(struct tty_struct *tty,
+ goto exit;
+ }
+ }
+- if (count > priv->tx_room) {
++
++ if (count >= priv->tx_room) {
+ /* we're about to completely fill the Tx buffer, so
+ we'll be throttled afterwards. */
+ count = priv->tx_room;
+@@ -547,7 +546,7 @@ static int keyspan_pda_write(struct tty_struct *tty,
+
+ rc = count;
+ exit:
+- if (rc < 0)
++ if (rc <= 0)
+ set_bit(0, &port->write_urbs_free);
+ return rc;
+ }
+@@ -562,21 +561,24 @@ static void keyspan_pda_write_bulk_callback(struct urb *urb)
+ priv = usb_get_serial_port_data(port);
+
+ /* queue up a wakeup at scheduler time */
+- schedule_work(&priv->wakeup_work);
++ usb_serial_port_softint(port);
+ }
+
+
+ static int keyspan_pda_write_room(struct tty_struct *tty)
+ {
+ struct usb_serial_port *port = tty->driver_data;
+- struct keyspan_pda_private *priv;
+- priv = usb_get_serial_port_data(port);
+- /* used by n_tty.c for processing of tabs and such. Giving it our
+- conservative guess is probably good enough, but needs testing by
+- running a console through the device. */
+- return priv->tx_room;
+-}
++ struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
++ unsigned long flags;
++ int room = 0;
+
++ spin_lock_irqsave(&port->lock, flags);
++ if (test_bit(0, &port->write_urbs_free) && !priv->tx_throttled)
++ room = priv->tx_room;
++ spin_unlock_irqrestore(&port->lock, flags);
++
++ return room;
++}
+
+ static int keyspan_pda_chars_in_buffer(struct tty_struct *tty)
+ {
+@@ -656,8 +658,12 @@ error:
+ }
+ static void keyspan_pda_close(struct usb_serial_port *port)
+ {
++ struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
++
+ usb_kill_urb(port->write_urb);
+ usb_kill_urb(port->interrupt_in_urb);
++
++ cancel_work_sync(&priv->unthrottle_work);
+ }
+
+
+@@ -715,7 +721,6 @@ static int keyspan_pda_port_probe(struct usb_serial_port *port)
+ if (!priv)
+ return -ENOMEM;
+
+- INIT_WORK(&priv->wakeup_work, keyspan_pda_wakeup_write);
+ INIT_WORK(&priv->unthrottle_work, keyspan_pda_request_unthrottle);
+ priv->serial = port->serial;
+ priv->port = port;
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index c0232b67a40f4..1f65bee521e69 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -638,6 +638,8 @@ static void parport_mos7715_restore_state(struct parport *pp,
+ spin_unlock(&release_lock);
+ return;
+ }
++ mos_parport->shadowDCR = s->u.pc.ctr;
++ mos_parport->shadowECR = s->u.pc.ecr;
+ write_parport_reg_nonblock(mos_parport, MOS7720_DCR,
+ mos_parport->shadowDCR);
+ write_parport_reg_nonblock(mos_parport, MOS7720_ECR,
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 73cd2f8f0f65a..6fd6012ad7b3a 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -563,6 +563,9 @@ static void option_instat_callback(struct urb *urb);
+
+ /* Device flags */
+
++/* Highest interface number which can be used with NCTRL() and RSVD() */
++#define FLAG_IFNUM_MAX 7
++
+ /* Interface does not support modem-control requests */
+ #define NCTRL(ifnum) ((BIT(ifnum) & 0xff) << 8)
+
+@@ -2100,6 +2103,14 @@ static struct usb_serial_driver * const serial_drivers[] = {
+
+ module_usb_serial_driver(serial_drivers, option_ids);
+
++static bool iface_is_reserved(unsigned long device_flags, u8 ifnum)
++{
++ if (ifnum > FLAG_IFNUM_MAX)
++ return false;
++
++ return device_flags & RSVD(ifnum);
++}
++
+ static int option_probe(struct usb_serial *serial,
+ const struct usb_device_id *id)
+ {
+@@ -2116,7 +2127,7 @@ static int option_probe(struct usb_serial *serial,
+ * the same class/subclass/protocol as the serial interfaces. Look at
+ * the Windows driver .INF files for reserved interface numbers.
+ */
+- if (device_flags & RSVD(iface_desc->bInterfaceNumber))
++ if (iface_is_reserved(device_flags, iface_desc->bInterfaceNumber))
+ return -ENODEV;
+
+ /*
+@@ -2132,6 +2143,14 @@ static int option_probe(struct usb_serial *serial,
+ return 0;
+ }
+
++static bool iface_no_modem_control(unsigned long device_flags, u8 ifnum)
++{
++ if (ifnum > FLAG_IFNUM_MAX)
++ return false;
++
++ return device_flags & NCTRL(ifnum);
++}
++
+ static int option_attach(struct usb_serial *serial)
+ {
+ struct usb_interface_descriptor *iface_desc;
+@@ -2147,7 +2166,7 @@ static int option_attach(struct usb_serial *serial)
+
+ iface_desc = &serial->interface->cur_altsetting->desc;
+
+- if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
++ if (!iface_no_modem_control(device_flags, iface_desc->bInterfaceNumber))
+ data->use_send_setup = 1;
+
+ if (device_flags & ZLP)
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index 658b0cd8e27ee..1fc7143c35a37 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -874,6 +874,9 @@ static int uas_slave_configure(struct scsi_device *sdev)
+ if (devinfo->flags & US_FL_NO_READ_CAPACITY_16)
+ sdev->no_read_capacity_16 = 1;
+
++ /* Some disks cannot handle WRITE_SAME */
++ if (devinfo->flags & US_FL_NO_SAME)
++ sdev->no_write_same = 1;
+ /*
+ * Some disks return the total number of blocks in response
+ * to READ CAPACITY rather than the highest block number.
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index dcdfcdfd2ad13..749c69be091cc 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -35,12 +35,15 @@ UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_REPORT_OPCODES),
+
+-/* Reported-by: Julian Groß <julian.g@posteo.de> */
++/*
++ * Initially Reported-by: Julian Groß <julian.g@posteo.de>
++ * Further reports David C. Partridge <david.partridge@perdrix.co.uk>
++ */
+ UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
+ "LaCie",
+ "2Big Quadra USB3",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+- US_FL_NO_REPORT_OPCODES),
++ US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME),
+
+ /*
+ * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI
+diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
+index 9a79cd9762f31..2349dfa3b1762 100644
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -541,6 +541,9 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags)
+ case 'j':
+ f |= US_FL_NO_REPORT_LUNS;
+ break;
++ case 'k':
++ f |= US_FL_NO_SAME;
++ break;
+ case 'l':
+ f |= US_FL_NOT_LOCKABLE;
+ break;
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 58e7336b2748b..5e23e4aa5b0a3 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -1380,8 +1380,8 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf)
+
+ mutex_unlock(&vdev->vma_lock);
+
+- if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+- vma->vm_end - vma->vm_start, vma->vm_page_prot))
++ if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
++ vma->vm_end - vma->vm_start, vma->vm_page_prot))
+ ret = VM_FAULT_SIGBUS;
+
+ up_out:
+diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
+index 4ed55e6bbb840..6d01ae3984c73 100644
+--- a/drivers/video/fbdev/atmel_lcdfb.c
++++ b/drivers/video/fbdev/atmel_lcdfb.c
+@@ -1071,8 +1071,8 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
+ }
+
+ INIT_LIST_HEAD(&pdata->pwr_gpios);
+- ret = -ENOMEM;
+ for (i = 0; i < gpiod_count(dev, "atmel,power-control"); i++) {
++ ret = -ENOMEM;
+ gpiod = devm_gpiod_get_index(dev, "atmel,power-control",
+ i, GPIOD_ASIS);
+ if (IS_ERR(gpiod))
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index 709d4de11f40f..fa7f4c61524d9 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -515,7 +515,7 @@ config SUNXI_WATCHDOG
+
+ config COH901327_WATCHDOG
+ bool "ST-Ericsson COH 901 327 watchdog"
+- depends on ARCH_U300 || (ARM && COMPILE_TEST)
++ depends on ARCH_U300 || (ARM && COMMON_CLK && COMPILE_TEST)
+ default y if MACH_U300
+ select WATCHDOG_CORE
+ help
+@@ -651,6 +651,7 @@ config MOXART_WDT
+
+ config SIRFSOC_WATCHDOG
+ tristate "SiRFSOC watchdog"
++ depends on HAS_IOMEM
+ depends on ARCH_SIRF || COMPILE_TEST
+ select WATCHDOG_CORE
+ default y
+diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c
+index 780971318810d..1a0005a8fadb2 100644
+--- a/drivers/watchdog/qcom-wdt.c
++++ b/drivers/watchdog/qcom-wdt.c
+@@ -121,7 +121,7 @@ static int qcom_wdt_restart(struct watchdog_device *wdd, unsigned long action,
+ */
+ wmb();
+
+- msleep(150);
++ mdelay(150);
+ return 0;
+ }
+
+diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
+index b6c65afd36778..86cf93af951b5 100644
+--- a/drivers/watchdog/sprd_wdt.c
++++ b/drivers/watchdog/sprd_wdt.c
+@@ -116,18 +116,6 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,
+ u32 tmr_step = timeout * SPRD_WDT_CNT_STEP;
+ u32 prtmr_step = pretimeout * SPRD_WDT_CNT_STEP;
+
+- sprd_wdt_unlock(wdt->base);
+- writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
+- SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH);
+- writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK),
+- wdt->base + SPRD_WDT_LOAD_LOW);
+- writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
+- SPRD_WDT_LOW_VALUE_MASK,
+- wdt->base + SPRD_WDT_IRQ_LOAD_HIGH);
+- writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK,
+- wdt->base + SPRD_WDT_IRQ_LOAD_LOW);
+- sprd_wdt_lock(wdt->base);
+-
+ /*
+ * Waiting the load value operation done,
+ * it needs two or three RTC clock cycles.
+@@ -142,6 +130,19 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,
+
+ if (delay_cnt >= SPRD_WDT_LOAD_TIMEOUT)
+ return -EBUSY;
++
++ sprd_wdt_unlock(wdt->base);
++ writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
++ SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH);
++ writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK),
++ wdt->base + SPRD_WDT_LOAD_LOW);
++ writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
++ SPRD_WDT_LOW_VALUE_MASK,
++ wdt->base + SPRD_WDT_IRQ_LOAD_HIGH);
++ writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK,
++ wdt->base + SPRD_WDT_IRQ_LOAD_LOW);
++ sprd_wdt_lock(wdt->base);
++
+ return 0;
+ }
+
+@@ -360,15 +361,10 @@ static int __maybe_unused sprd_wdt_pm_resume(struct device *dev)
+ if (ret)
+ return ret;
+
+- if (watchdog_active(&wdt->wdd)) {
++ if (watchdog_active(&wdt->wdd))
+ ret = sprd_wdt_start(&wdt->wdd);
+- if (ret) {
+- sprd_wdt_disable(wdt);
+- return ret;
+- }
+- }
+
+- return 0;
++ return ret;
+ }
+
+ static const struct dev_pm_ops sprd_wdt_pm_ops = {
+diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
+index 8b1f37ffb65ac..5c600a3706505 100644
+--- a/drivers/watchdog/watchdog_core.c
++++ b/drivers/watchdog/watchdog_core.c
+@@ -246,15 +246,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd)
+ }
+
+ if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
+- wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
+-
+- ret = register_reboot_notifier(&wdd->reboot_nb);
+- if (ret) {
+- pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
+- wdd->id, ret);
+- watchdog_dev_unregister(wdd);
+- ida_simple_remove(&watchdog_ida, id);
+- return ret;
++ if (!wdd->ops->stop)
++ pr_warn("watchdog%d: stop_on_reboot not supported\n", wdd->id);
++ else {
++ wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
++
++ ret = register_reboot_notifier(&wdd->reboot_nb);
++ if (ret) {
++ pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
++ wdd->id, ret);
++ watchdog_dev_unregister(wdd);
++ ida_simple_remove(&watchdog_ida, id);
++ return ret;
++ }
+ }
+ }
+
+diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
+index 3bbed47da3fa5..1e2a996c75158 100644
+--- a/drivers/xen/xen-pciback/xenbus.c
++++ b/drivers/xen/xen-pciback/xenbus.c
+@@ -688,7 +688,7 @@ static int xen_pcibk_xenbus_probe(struct xenbus_device *dev,
+
+ /* watch the backend node for backend configuration information */
+ err = xenbus_watch_path(dev, dev->nodename, &pdev->be_watch,
+- xen_pcibk_be_watch);
++ NULL, xen_pcibk_be_watch);
+ if (err)
+ goto out;
+
+diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h
+index d75a2385b37c7..88516a8a9f932 100644
+--- a/drivers/xen/xenbus/xenbus.h
++++ b/drivers/xen/xenbus/xenbus.h
+@@ -44,6 +44,8 @@ struct xen_bus_type {
+ int (*get_bus_id)(char bus_id[XEN_BUS_ID_SIZE], const char *nodename);
+ int (*probe)(struct xen_bus_type *bus, const char *type,
+ const char *dir);
++ bool (*otherend_will_handle)(struct xenbus_watch *watch,
++ const char *path, const char *token);
+ void (*otherend_changed)(struct xenbus_watch *watch, const char *path,
+ const char *token);
+ struct bus_type bus;
+diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
+index f7b553faadb10..e35bb6b874491 100644
+--- a/drivers/xen/xenbus/xenbus_client.c
++++ b/drivers/xen/xenbus/xenbus_client.c
+@@ -114,18 +114,22 @@ EXPORT_SYMBOL_GPL(xenbus_strstate);
+ */
+ int xenbus_watch_path(struct xenbus_device *dev, const char *path,
+ struct xenbus_watch *watch,
++ bool (*will_handle)(struct xenbus_watch *,
++ const char *, const char *),
+ void (*callback)(struct xenbus_watch *,
+ const char *, const char *))
+ {
+ int err;
+
+ watch->node = path;
++ watch->will_handle = will_handle;
+ watch->callback = callback;
+
+ err = register_xenbus_watch(watch);
+
+ if (err) {
+ watch->node = NULL;
++ watch->will_handle = NULL;
+ watch->callback = NULL;
+ xenbus_dev_fatal(dev, err, "adding watch on %s", path);
+ }
+@@ -152,6 +156,8 @@ EXPORT_SYMBOL_GPL(xenbus_watch_path);
+ */
+ int xenbus_watch_pathfmt(struct xenbus_device *dev,
+ struct xenbus_watch *watch,
++ bool (*will_handle)(struct xenbus_watch *,
++ const char *, const char *),
+ void (*callback)(struct xenbus_watch *,
+ const char *, const char *),
+ const char *pathfmt, ...)
+@@ -168,7 +174,7 @@ int xenbus_watch_pathfmt(struct xenbus_device *dev,
+ xenbus_dev_fatal(dev, -ENOMEM, "allocating path for watch");
+ return -ENOMEM;
+ }
+- err = xenbus_watch_path(dev, path, watch, callback);
++ err = xenbus_watch_path(dev, path, watch, will_handle, callback);
+
+ if (err)
+ kfree(path);
+diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
+index 5b471889d7237..e6d0903459e11 100644
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -136,6 +136,7 @@ static int watch_otherend(struct xenbus_device *dev)
+ container_of(dev->dev.bus, struct xen_bus_type, bus);
+
+ return xenbus_watch_pathfmt(dev, &dev->otherend_watch,
++ bus->otherend_will_handle,
+ bus->otherend_changed,
+ "%s/%s", dev->otherend, "state");
+ }
+diff --git a/drivers/xen/xenbus/xenbus_probe_backend.c b/drivers/xen/xenbus/xenbus_probe_backend.c
+index b0bed4faf44cc..4bb603051d5b6 100644
+--- a/drivers/xen/xenbus/xenbus_probe_backend.c
++++ b/drivers/xen/xenbus/xenbus_probe_backend.c
+@@ -180,6 +180,12 @@ static int xenbus_probe_backend(struct xen_bus_type *bus, const char *type,
+ return err;
+ }
+
++static bool frontend_will_handle(struct xenbus_watch *watch,
++ const char *path, const char *token)
++{
++ return watch->nr_pending == 0;
++}
++
+ static void frontend_changed(struct xenbus_watch *watch,
+ const char *path, const char *token)
+ {
+@@ -191,6 +197,7 @@ static struct xen_bus_type xenbus_backend = {
+ .levels = 3, /* backend/type/<frontend>/<id> */
+ .get_bus_id = backend_bus_id,
+ .probe = xenbus_probe_backend,
++ .otherend_will_handle = frontend_will_handle,
+ .otherend_changed = frontend_changed,
+ .bus = {
+ .name = "xen-backend",
+diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
+index 3a06eb699f333..12e02eb01f599 100644
+--- a/drivers/xen/xenbus/xenbus_xs.c
++++ b/drivers/xen/xenbus/xenbus_xs.c
+@@ -705,9 +705,13 @@ int xs_watch_msg(struct xs_watch_event *event)
+
+ spin_lock(&watches_lock);
+ event->handle = find_watch(event->token);
+- if (event->handle != NULL) {
++ if (event->handle != NULL &&
++ (!event->handle->will_handle ||
++ event->handle->will_handle(event->handle,
++ event->path, event->token))) {
+ spin_lock(&watch_events_lock);
+ list_add_tail(&event->list, &watch_events);
++ event->handle->nr_pending++;
+ wake_up(&watch_events_waitq);
+ spin_unlock(&watch_events_lock);
+ } else
+@@ -765,6 +769,8 @@ int register_xenbus_watch(struct xenbus_watch *watch)
+
+ sprintf(token, "%lX", (long)watch);
+
++ watch->nr_pending = 0;
++
+ down_read(&xs_watch_rwsem);
+
+ spin_lock(&watches_lock);
+@@ -814,11 +820,14 @@ void unregister_xenbus_watch(struct xenbus_watch *watch)
+
+ /* Cancel pending watch events. */
+ spin_lock(&watch_events_lock);
+- list_for_each_entry_safe(event, tmp, &watch_events, list) {
+- if (event->handle != watch)
+- continue;
+- list_del(&event->list);
+- kfree(event);
++ if (watch->nr_pending) {
++ list_for_each_entry_safe(event, tmp, &watch_events, list) {
++ if (event->handle != watch)
++ continue;
++ list_del(&event->list);
++ kfree(event);
++ }
++ watch->nr_pending = 0;
+ }
+ spin_unlock(&watch_events_lock);
+
+@@ -865,7 +874,6 @@ void xs_suspend_cancel(void)
+
+ static int xenwatch_thread(void *unused)
+ {
+- struct list_head *ent;
+ struct xs_watch_event *event;
+
+ xenwatch_pid = current->pid;
+@@ -880,13 +888,15 @@ static int xenwatch_thread(void *unused)
+ mutex_lock(&xenwatch_mutex);
+
+ spin_lock(&watch_events_lock);
+- ent = watch_events.next;
+- if (ent != &watch_events)
+- list_del(ent);
++ event = list_first_entry_or_null(&watch_events,
++ struct xs_watch_event, list);
++ if (event) {
++ list_del(&event->list);
++ event->handle->nr_pending--;
++ }
+ spin_unlock(&watch_events_lock);
+
+- if (ent != &watch_events) {
+- event = list_entry(ent, struct xs_watch_event, list);
++ if (event) {
+ event->handle->callback(event->handle, event->path,
+ event->token);
+ kfree(event);
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index c0dbf8b7762b4..6e871a382209b 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1047,12 +1047,19 @@ void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release)
+ {
+ struct ceph_mds_session *session = cap->session;
+ struct ceph_inode_info *ci = cap->ci;
+- struct ceph_mds_client *mdsc =
+- ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc;
++ struct ceph_mds_client *mdsc;
+ int removed = 0;
+
++ /* 'ci' being NULL means the remove have already occurred */
++ if (!ci) {
++ dout("%s: cap inode is NULL\n", __func__);
++ return;
++ }
++
+ dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
+
++ mdsc = ceph_inode_to_client(&ci->vfs_inode)->mdsc;
++
+ /* remove from inode's cap rbtree, and clear auth cap */
+ rb_erase(&cap->ci_node, &ci->i_caps);
+ if (ci->i_auth_cap == cap)
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index e20d170d13f6b..faafa9a557c23 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -366,7 +366,8 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ goto out;
+ }
+
+- if (bytes_left || p->Next)
++ /* Azure rounds the buffer size up 8, to a 16 byte boundary */
++ if ((bytes_left > 8) || p->Next)
+ cifs_dbg(VFS, "%s: incomplete interface info\n", __func__);
+
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 379ac8caa29a6..ee824131c02e4 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -406,8 +406,8 @@ build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt)
+ pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES;
+ pneg_ctxt->DataLength = cpu_to_le16(38);
+ pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1);
+- pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE);
+- get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE);
++ pneg_ctxt->SaltLength = cpu_to_le16(SMB311_LINUX_CLIENT_SALT_SIZE);
++ get_random_bytes(pneg_ctxt->Salt, SMB311_LINUX_CLIENT_SALT_SIZE);
+ pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512;
+ }
+
+@@ -461,6 +461,9 @@ static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt)
+ if (len < MIN_PREAUTH_CTXT_DATA_LEN) {
+ printk_once(KERN_WARNING "server sent bad preauth context\n");
+ return;
++ } else if (len < MIN_PREAUTH_CTXT_DATA_LEN + le16_to_cpu(ctxt->SaltLength)) {
++ pr_warn_once("server sent invalid SaltLength\n");
++ return;
+ }
+ if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1)
+ printk_once(KERN_WARNING "illegal SMB3 hash algorithm count\n");
+diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
+index 44501f8cbd75e..48ed43e6aee84 100644
+--- a/fs/cifs/smb2pdu.h
++++ b/fs/cifs/smb2pdu.h
+@@ -257,12 +257,20 @@ struct smb2_neg_context {
+ /* Followed by array of data */
+ } __packed;
+
+-#define SMB311_SALT_SIZE 32
++#define SMB311_LINUX_CLIENT_SALT_SIZE 32
+ /* Hash Algorithm Types */
+ #define SMB2_PREAUTH_INTEGRITY_SHA512 cpu_to_le16(0x0001)
+ #define SMB2_PREAUTH_HASH_SIZE 64
+
+-#define MIN_PREAUTH_CTXT_DATA_LEN (SMB311_SALT_SIZE + 6)
++/*
++ * SaltLength that the server send can be zero, so the only three required
++ * fields (all __le16) end up six bytes total, so the minimum context data len
++ * in the response is six bytes which accounts for
++ *
++ * HashAlgorithmCount, SaltLength, and 1 HashAlgorithm.
++ */
++#define MIN_PREAUTH_CTXT_DATA_LEN 6
++
+ struct smb2_preauth_neg_context {
+ __le16 ContextType; /* 1 */
+ __le16 DataLength;
+@@ -270,7 +278,7 @@ struct smb2_preauth_neg_context {
+ __le16 HashAlgorithmCount; /* 1 */
+ __le16 SaltLength;
+ __le16 HashAlgorithms; /* HashAlgorithms[0] since only one defined */
+- __u8 Salt[SMB311_SALT_SIZE];
++ __u8 Salt[SMB311_LINUX_CLIENT_SALT_SIZE];
+ } __packed;
+
+ /* Encryption Algorithms Ciphers */
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index cc092386ac6d9..b2a9c746f8ce4 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -203,6 +203,7 @@ void ext4_evict_inode(struct inode *inode)
+ */
+ int extra_credits = 6;
+ struct ext4_xattr_inode_array *ea_inode_array = NULL;
++ bool freeze_protected = false;
+
+ trace_ext4_evict_inode(inode);
+
+@@ -250,9 +251,14 @@ void ext4_evict_inode(struct inode *inode)
+
+ /*
+ * Protect us against freezing - iput() caller didn't have to have any
+- * protection against it
++ * protection against it. When we are in a running transaction though,
++ * we are already protected against freezing and we cannot grab further
++ * protection due to lock ordering constraints.
+ */
+- sb_start_intwrite(inode->i_sb);
++ if (!ext4_journal_current_handle()) {
++ sb_start_intwrite(inode->i_sb);
++ freeze_protected = true;
++ }
+
+ if (!IS_NOQUOTA(inode))
+ extra_credits += EXT4_MAXQUOTAS_DEL_BLOCKS(inode->i_sb);
+@@ -271,7 +277,8 @@ void ext4_evict_inode(struct inode *inode)
+ * cleaned up.
+ */
+ ext4_orphan_del(NULL, inode);
+- sb_end_intwrite(inode->i_sb);
++ if (freeze_protected)
++ sb_end_intwrite(inode->i_sb);
+ goto no_delete;
+ }
+
+@@ -312,7 +319,8 @@ void ext4_evict_inode(struct inode *inode)
+ stop_handle:
+ ext4_journal_stop(handle);
+ ext4_orphan_del(NULL, inode);
+- sb_end_intwrite(inode->i_sb);
++ if (freeze_protected)
++ sb_end_intwrite(inode->i_sb);
+ ext4_xattr_inode_array_free(ea_inode_array);
+ goto no_delete;
+ }
+@@ -341,7 +349,8 @@ stop_handle:
+ else
+ ext4_free_inode(handle, inode);
+ ext4_journal_stop(handle);
+- sb_end_intwrite(inode->i_sb);
++ if (freeze_protected)
++ sb_end_intwrite(inode->i_sb);
+ ext4_xattr_inode_array_free(ea_inode_array);
+ return;
+ no_delete:
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 054cfdd007d69..ec6f65c91d93c 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -4690,6 +4690,7 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
+ ext4_group_first_block_no(sb, group) +
+ EXT4_C2B(sbi, cluster),
+ "Block already on to-be-freed list");
++ kmem_cache_free(ext4_free_data_cachep, new_entry);
+ return 0;
+ }
+ }
+diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
+index bccfc40b3a74a..d19483fa1fe89 100644
+--- a/fs/jffs2/readinode.c
++++ b/fs/jffs2/readinode.c
+@@ -672,6 +672,22 @@ static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_r
+ jffs2_free_full_dirent(fd);
+ return -EIO;
+ }
++
++#ifdef CONFIG_JFFS2_SUMMARY
++ /*
++ * we use CONFIG_JFFS2_SUMMARY because without it, we
++ * have checked it while mounting
++ */
++ crc = crc32(0, fd->name, rd->nsize);
++ if (unlikely(crc != je32_to_cpu(rd->name_crc))) {
++ JFFS2_NOTICE("name CRC failed on dirent node at"
++ "%#08x: read %#08x,calculated %#08x\n",
++ ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
++ jffs2_mark_node_obsolete(c, ref);
++ jffs2_free_full_dirent(fd);
++ return 0;
++ }
++#endif
+ }
+
+ fd->nhash = full_name_hash(NULL, fd->name, rd->nsize);
+diff --git a/fs/jfs/jfs_dmap.h b/fs/jfs/jfs_dmap.h
+index 562b9a7e4311f..f502a15c6c987 100644
+--- a/fs/jfs/jfs_dmap.h
++++ b/fs/jfs/jfs_dmap.h
+@@ -196,7 +196,7 @@ typedef union dmtree {
+ #define dmt_leafidx t1.leafidx
+ #define dmt_height t1.height
+ #define dmt_budmin t1.budmin
+-#define dmt_stree t1.stree
++#define dmt_stree t2.stree
+
+ /*
+ * on-disk aggregate disk allocation map descriptor.
+diff --git a/fs/lockd/host.c b/fs/lockd/host.c
+index f0b5c987d6ae1..3f6ba0cd2bd9c 100644
+--- a/fs/lockd/host.c
++++ b/fs/lockd/host.c
+@@ -432,12 +432,7 @@ nlm_bind_host(struct nlm_host *host)
+ * RPC rebind is required
+ */
+ if ((clnt = host->h_rpcclnt) != NULL) {
+- if (time_after_eq(jiffies, host->h_nextrebind)) {
+- rpc_force_rebind(clnt);
+- host->h_nextrebind = jiffies + NLM_HOST_REBIND;
+- dprintk("lockd: next rebind in %lu jiffies\n",
+- host->h_nextrebind - jiffies);
+- }
++ nlm_rebind_host(host);
+ } else {
+ unsigned long increment = nlmsvc_timeout;
+ struct rpc_timeout timeparms = {
+@@ -485,13 +480,20 @@ nlm_bind_host(struct nlm_host *host)
+ return clnt;
+ }
+
+-/*
+- * Force a portmap lookup of the remote lockd port
++/**
++ * nlm_rebind_host - If needed, force a portmap lookup of the peer's lockd port
++ * @host: NLM host handle for peer
++ *
++ * This is not needed when using a connection-oriented protocol, such as TCP.
++ * The existing autobind mechanism is sufficient to force a rebind when
++ * required, e.g. on connection state transitions.
+ */
+ void
+ nlm_rebind_host(struct nlm_host *host)
+ {
+- dprintk("lockd: rebind host %s\n", host->h_name);
++ if (host->h_proto != IPPROTO_UDP)
++ return;
++
+ if (host->h_rpcclnt && time_after_eq(jiffies, host->h_nextrebind)) {
+ rpc_force_rebind(host->h_rpcclnt);
+ host->h_nextrebind = jiffies + NLM_HOST_REBIND;
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index e4cd3a2fe6989..aee66d8f13305 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -2142,7 +2142,7 @@ static int nfsiod_start(void)
+ {
+ struct workqueue_struct *wq;
+ dprintk("RPC: creating workqueue nfsiod\n");
+- wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM, 0);
++ wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM | WQ_UNBOUND, 0);
+ if (wq == NULL)
+ return -ENOMEM;
+ nfsiod_workqueue = wq;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index fe7b42c277ac5..1a395647ae265 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -4687,12 +4687,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
+ u64 cookie, struct page **pages, unsigned int count, bool plus)
+ {
+ struct inode *dir = d_inode(dentry);
++ struct nfs_server *server = NFS_SERVER(dir);
+ struct nfs4_readdir_arg args = {
+ .fh = NFS_FH(dir),
+ .pages = pages,
+ .pgbase = 0,
+ .count = count,
+- .bitmask = NFS_SERVER(d_inode(dentry))->attr_bitmask,
+ .plus = plus,
+ };
+ struct nfs4_readdir_res res;
+@@ -4707,9 +4707,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
+ dprintk("%s: dentry = %pd2, cookie = %Lu\n", __func__,
+ dentry,
+ (unsigned long long)cookie);
++ if (!(server->caps & NFS_CAP_SECURITY_LABEL))
++ args.bitmask = server->attr_bitmask_nl;
++ else
++ args.bitmask = server->attr_bitmask;
++
+ nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
+ res.pgbase = args.pgbase;
+- status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
++ status = nfs4_call_sync(server->client, server, &msg, &args.seq_args,
++ &res.seq_res, 0);
+ if (status >= 0) {
+ memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
+ status += args.pgbase;
+diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c
+index 5be08f02a76bc..4f90c444907f5 100644
+--- a/fs/nfs_common/grace.c
++++ b/fs/nfs_common/grace.c
+@@ -68,10 +68,14 @@ __state_in_grace(struct net *net, bool open)
+ if (!open)
+ return !list_empty(grace_list);
+
++ spin_lock(&grace_lock);
+ list_for_each_entry(lm, grace_list, list) {
+- if (lm->block_opens)
++ if (lm->block_opens) {
++ spin_unlock(&grace_lock);
+ return true;
++ }
+ }
++ spin_unlock(&grace_lock);
+ return false;
+ }
+
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index 89cb484f1cfbe..ad38633392a0d 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -417,8 +417,7 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
+ return;
+
+ nfsd_shutdown_net(net);
+- printk(KERN_WARNING "nfsd: last server has exited, flushing export "
+- "cache\n");
++ pr_info("nfsd: last server has exited, flushing export cache\n");
+ nfsd_export_flush(net);
+ }
+
+diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
+index 5d4dc0f84f202..d99710270a373 100644
+--- a/fs/quota/quota_v2.c
++++ b/fs/quota/quota_v2.c
+@@ -158,6 +158,25 @@ static int v2_read_file_info(struct super_block *sb, int type)
+ qinfo->dqi_entry_size = sizeof(struct v2r1_disk_dqblk);
+ qinfo->dqi_ops = &v2r1_qtree_ops;
+ }
++ ret = -EUCLEAN;
++ /* Some sanity checks of the read headers... */
++ if ((loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits >
++ i_size_read(sb_dqopt(sb)->files[type])) {
++ quota_error(sb, "Number of blocks too big for quota file size (%llu > %llu).",
++ (loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits,
++ i_size_read(sb_dqopt(sb)->files[type]));
++ goto out;
++ }
++ if (qinfo->dqi_free_blk >= qinfo->dqi_blocks) {
++ quota_error(sb, "Free block number too big (%u >= %u).",
++ qinfo->dqi_free_blk, qinfo->dqi_blocks);
++ goto out;
++ }
++ if (qinfo->dqi_free_entry >= qinfo->dqi_blocks) {
++ quota_error(sb, "Block with free entry too big (%u >= %u).",
++ qinfo->dqi_free_entry, qinfo->dqi_blocks);
++ goto out;
++ }
+ ret = 0;
+ out:
+ up_read(&dqopt->dqio_sem);
+diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
+index fab29f899f913..9542ebf643a5e 100644
+--- a/fs/ubifs/io.c
++++ b/fs/ubifs/io.c
+@@ -331,7 +331,7 @@ void ubifs_pad(const struct ubifs_info *c, void *buf, int pad)
+ {
+ uint32_t crc;
+
+- ubifs_assert(c, pad >= 0 && !(pad & 7));
++ ubifs_assert(c, pad >= 0);
+
+ if (pad >= UBIFS_PAD_NODE_SZ) {
+ struct ubifs_ch *ch = buf;
+@@ -728,6 +728,10 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ * write-buffer.
+ */
+ memcpy(wbuf->buf + wbuf->used, buf, len);
++ if (aligned_len > len) {
++ ubifs_assert(c, aligned_len - len < 8);
++ ubifs_pad(c, wbuf->buf + wbuf->used + len, aligned_len - len);
++ }
+
+ if (aligned_len == wbuf->avail) {
+ dbg_io("flush jhead %s wbuf to LEB %d:%d",
+@@ -820,13 +824,18 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ }
+
+ spin_lock(&wbuf->lock);
+- if (aligned_len)
++ if (aligned_len) {
+ /*
+ * And now we have what's left and what does not take whole
+ * max. write unit, so write it to the write-buffer and we are
+ * done.
+ */
+ memcpy(wbuf->buf, buf + written, len);
++ if (aligned_len > len) {
++ ubifs_assert(c, aligned_len - len < 8);
++ ubifs_pad(c, wbuf->buf + len, aligned_len - len);
++ }
++ }
+
+ if (c->leb_size - wbuf->offs >= c->max_write_size)
+ wbuf->size = c->max_write_size;
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index ba4dd54f2c821..d9773df60a360 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -622,7 +622,6 @@ acpi_status acpi_remove_pm_notifier(struct acpi_device *adev);
+ bool acpi_pm_device_can_wakeup(struct device *dev);
+ int acpi_pm_device_sleep_state(struct device *, int *, int);
+ int acpi_pm_set_device_wakeup(struct device *dev, bool enable);
+-int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable);
+ #else
+ static inline void acpi_pm_wakeup_event(struct device *dev)
+ {
+@@ -653,10 +652,6 @@ static inline int acpi_pm_set_device_wakeup(struct device *dev, bool enable)
+ {
+ return -ENODEV;
+ }
+-static inline int acpi_pm_set_bridge_wakeup(struct device *dev, bool enable)
+-{
+- return -ENODEV;
+-}
+ #endif
+
+ #ifdef CONFIG_ACPI_SLEEP
+diff --git a/include/linux/build_bug.h b/include/linux/build_bug.h
+index 43d1fd50d433d..6099f754aad7c 100644
+--- a/include/linux/build_bug.h
++++ b/include/linux/build_bug.h
+@@ -80,4 +80,9 @@
+
+ #endif /* __CHECKER__ */
+
++#ifdef __GENKSYMS__
++/* genksyms gets confused by _Static_assert */
++#define _Static_assert(expr, ...)
++#endif
++
+ #endif /* _LINUX_BUILD_BUG_H */
+diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
+index d756f2318efe0..2d6e5e4bb5d93 100644
+--- a/include/linux/compiler-clang.h
++++ b/include/linux/compiler-clang.h
+@@ -39,7 +39,6 @@
+ * and may be redefined here because they should not be shared with other
+ * compilers, like ICC.
+ */
+-#define barrier() __asm__ __volatile__("" : : : "memory")
+ #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
+ #define __assume_aligned(a, ...) \
+ __attribute__((__assume_aligned__(a, ## __VA_ARGS__)))
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 3ebee1ce6f982..14be095371093 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -14,25 +14,6 @@
+ # error Sorry, your compiler is too old - please upgrade it.
+ #endif
+
+-/* Optimization barrier */
+-
+-/* The "volatile" is due to gcc bugs */
+-#define barrier() __asm__ __volatile__("": : :"memory")
+-/*
+- * This version is i.e. to prevent dead stores elimination on @ptr
+- * where gcc and llvm may behave differently when otherwise using
+- * normal barrier(): while gcc behavior gets along with a normal
+- * barrier(), llvm needs an explicit input variable to be assumed
+- * clobbered. The issue is as follows: while the inline asm might
+- * access any memory it wants, the compiler could have fit all of
+- * @ptr into memory registers instead, and since @ptr never escaped
+- * from that, it proved that the inline asm wasn't touching any of
+- * it. This version works well with both compilers, i.e. we're telling
+- * the compiler that the inline asm absolutely may see the contents
+- * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
+- */
+-#define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
+-
+ /*
+ * This macro obfuscates arithmetic on a variable address so that gcc
+ * shouldn't recognize the original var, and make assumptions about it.
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index fbb6490c1e094..6b6505e3b2c70 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -79,11 +79,25 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+
+ /* Optimization barrier */
+ #ifndef barrier
+-# define barrier() __memory_barrier()
++/* The "volatile" is due to gcc bugs */
++# define barrier() __asm__ __volatile__("": : :"memory")
+ #endif
+
+ #ifndef barrier_data
+-# define barrier_data(ptr) barrier()
++/*
++ * This version is i.e. to prevent dead stores elimination on @ptr
++ * where gcc and llvm may behave differently when otherwise using
++ * normal barrier(): while gcc behavior gets along with a normal
++ * barrier(), llvm needs an explicit input variable to be assumed
++ * clobbered. The issue is as follows: while the inline asm might
++ * access any memory it wants, the compiler could have fit all of
++ * @ptr into memory registers instead, and since @ptr never escaped
++ * from that, it proved that the inline asm wasn't touching any of
++ * it. This version works well with both compilers, i.e. we're telling
++ * the compiler that the inline asm absolutely may see the contents
++ * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
++ */
++# define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
+ #endif
+
+ /* workaround for GCC PR82365 if needed */
+diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
+index 9077b3ebea08c..728d7716bf4f4 100644
+--- a/include/linux/netfilter/x_tables.h
++++ b/include/linux/netfilter/x_tables.h
+@@ -227,7 +227,7 @@ struct xt_table {
+ unsigned int valid_hooks;
+
+ /* Man behind the curtain... */
+- struct xt_table_info *private;
++ struct xt_table_info __rcu *private;
+
+ /* Set this to THIS_MODULE if you are a module, otherwise NULL */
+ struct module *me;
+@@ -449,6 +449,9 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
+
+ struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);
+
++struct xt_table_info
++*xt_table_get_private_protected(const struct xt_table *table);
++
+ #ifdef CONFIG_COMPAT
+ #include <net/compat.h>
+
+diff --git a/include/linux/security.h b/include/linux/security.h
+index d2240605edc46..454cc963d1457 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -787,7 +787,7 @@ static inline int security_inode_killpriv(struct dentry *dentry)
+
+ static inline int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
+ {
+- return -EOPNOTSUPP;
++ return cap_inode_getsecurity(inode, name, buffer, alloc);
+ }
+
+ static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
+diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h
+index aa5deb041c25d..7cc952282e8be 100644
+--- a/include/linux/seq_buf.h
++++ b/include/linux/seq_buf.h
+@@ -30,7 +30,7 @@ static inline void seq_buf_clear(struct seq_buf *s)
+ }
+
+ static inline void
+-seq_buf_init(struct seq_buf *s, unsigned char *buf, unsigned int size)
++seq_buf_init(struct seq_buf *s, char *buf, unsigned int size)
+ {
+ s->buffer = buf;
+ s->size = size;
+diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
+index e7bbd82908b10..69fed13e633b7 100644
+--- a/include/linux/sunrpc/xprt.h
++++ b/include/linux/sunrpc/xprt.h
+@@ -317,6 +317,7 @@ struct xprt_class {
+ struct rpc_xprt * (*setup)(struct xprt_create *);
+ struct module *owner;
+ char name[32];
++ const char * netid[];
+ };
+
+ /*
+diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h
+index 6609b39a72326..6db257466af68 100644
+--- a/include/linux/trace_seq.h
++++ b/include/linux/trace_seq.h
+@@ -12,7 +12,7 @@
+ */
+
+ struct trace_seq {
+- unsigned char buffer[PAGE_SIZE];
++ char buffer[PAGE_SIZE];
+ struct seq_buf seq;
+ int full;
+ };
+@@ -51,7 +51,7 @@ static inline int trace_seq_used(struct trace_seq *s)
+ * that is about to be written to and then return the result
+ * of that write.
+ */
+-static inline unsigned char *
++static inline char *
+ trace_seq_buffer_ptr(struct trace_seq *s)
+ {
+ return s->buffer + seq_buf_used(&s->seq);
+diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
+index 000a5954b2e89..a7f7ebdd3069e 100644
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -84,6 +84,8 @@
+ /* Cannot handle REPORT_LUNS */ \
+ US_FLAG(ALWAYS_SYNC, 0x20000000) \
+ /* lies about caching, so always sync */ \
++ US_FLAG(NO_SAME, 0x40000000) \
++ /* Cannot handle WRITE_SAME */ \
+
+ #define US_FLAG(name, value) US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
+diff --git a/include/uapi/linux/if_alg.h b/include/uapi/linux/if_alg.h
+index bc2bcdec377b4..7690507714231 100644
+--- a/include/uapi/linux/if_alg.h
++++ b/include/uapi/linux/if_alg.h
+@@ -24,6 +24,22 @@ struct sockaddr_alg {
+ __u8 salg_name[64];
+ };
+
++/*
++ * Linux v4.12 and later removed the 64-byte limit on salg_name[]; it's now an
++ * arbitrary-length field. We had to keep the original struct above for source
++ * compatibility with existing userspace programs, though. Use the new struct
++ * below if support for very long algorithm names is needed. To do this,
++ * allocate 'sizeof(struct sockaddr_alg_new) + strlen(algname) + 1' bytes, and
++ * copy algname (including the null terminator) into salg_name.
++ */
++struct sockaddr_alg_new {
++ __u16 salg_family;
++ __u8 salg_type[14];
++ __u32 salg_feat;
++ __u32 salg_mask;
++ __u8 salg_name[];
++};
++
+ struct af_alg_iv {
+ __u32 ivlen;
+ __u8 iv[0];
+diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
+index 869c816d5f8c3..eba01ab5a55e0 100644
+--- a/include/xen/xenbus.h
++++ b/include/xen/xenbus.h
+@@ -59,6 +59,15 @@ struct xenbus_watch
+ /* Path being watched. */
+ const char *node;
+
++ unsigned int nr_pending;
++
++ /*
++ * Called just before enqueing new event while a spinlock is held.
++ * The event will be discarded if this callback returns false.
++ */
++ bool (*will_handle)(struct xenbus_watch *,
++ const char *path, const char *token);
++
+ /* Callback (executed in a process context with no locks held). */
+ void (*callback)(struct xenbus_watch *,
+ const char *path, const char *token);
+@@ -192,10 +201,14 @@ void xenbus_probe(struct work_struct *);
+
+ int xenbus_watch_path(struct xenbus_device *dev, const char *path,
+ struct xenbus_watch *watch,
++ bool (*will_handle)(struct xenbus_watch *,
++ const char *, const char *),
+ void (*callback)(struct xenbus_watch *,
+ const char *, const char *));
+-__printf(4, 5)
++__printf(5, 6)
+ int xenbus_watch_pathfmt(struct xenbus_device *dev, struct xenbus_watch *watch,
++ bool (*will_handle)(struct xenbus_watch *,
++ const char *, const char *),
+ void (*callback)(struct xenbus_watch *,
+ const char *, const char *),
+ const char *pathfmt, ...);
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 08b9d6ba0807f..9a39a24f60253 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -776,6 +776,10 @@ void __init cpuhp_threads_init(void)
+ }
+
+ #ifdef CONFIG_HOTPLUG_CPU
++#ifndef arch_clear_mm_cpumask_cpu
++#define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm))
++#endif
++
+ /**
+ * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
+ * @cpu: a CPU id
+@@ -811,7 +815,7 @@ void clear_tasks_mm_cpumask(int cpu)
+ t = find_lock_task_mm(p);
+ if (!t)
+ continue;
+- cpumask_clear_cpu(cpu, mm_cpumask(t->mm));
++ arch_clear_mm_cpumask_cpu(cpu, t->mm);
+ task_unlock(t);
+ }
+ rcu_read_unlock();
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index 0a76c44eb6b29..1e42fc2ad4d57 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -1247,8 +1247,15 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain,
+ unsigned int irq_base,
+ unsigned int nr_irqs)
+ {
+- if (domain->ops->free)
+- domain->ops->free(domain, irq_base, nr_irqs);
++ unsigned int i;
++
++ if (!domain->ops->free)
++ return;
++
++ for (i = 0; i < nr_irqs; i++) {
++ if (irq_domain_get_irq_data(domain, irq_base + i))
++ domain->ops->free(domain, irq_base + i, 1);
++ }
+ }
+
+ int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index b166320f7633e..013b1c6cb4ed9 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4984,12 +4984,8 @@ static void do_sched_yield(void)
+ schedstat_inc(rq->yld_count);
+ current->sched_class->yield_task(rq);
+
+- /*
+- * Since we are going to call schedule() anyway, there's
+- * no need to preempt or enable interrupts:
+- */
+ preempt_disable();
+- rq_unlock(rq, &rf);
++ rq_unlock_irq(rq, &rf);
+ sched_preempt_enable_no_resched();
+
+ schedule();
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 8aecfb143859d..aa592dc3cb401 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2464,7 +2464,7 @@ int sched_dl_global_validate(void)
+ u64 period = global_rt_period();
+ u64 new_bw = to_ratio(period, runtime);
+ struct dl_bw *dl_b;
+- int cpu, ret = 0;
++ int cpu, cpus, ret = 0;
+ unsigned long flags;
+
+ /*
+@@ -2479,9 +2479,10 @@ int sched_dl_global_validate(void)
+ for_each_possible_cpu(cpu) {
+ rcu_read_lock_sched();
+ dl_b = dl_bw_of(cpu);
++ cpus = dl_bw_cpus(cpu);
+
+ raw_spin_lock_irqsave(&dl_b->lock, flags);
+- if (new_bw < dl_b->total_bw)
++ if (new_bw * cpus < dl_b->total_bw)
+ ret = -EBUSY;
+ raw_spin_unlock_irqrestore(&dl_b->lock, flags);
+
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 41b7954be68b7..7b7ba91e319bb 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -247,30 +247,6 @@ struct rt_bandwidth {
+
+ void __dl_clear_params(struct task_struct *p);
+
+-/*
+- * To keep the bandwidth of -deadline tasks and groups under control
+- * we need some place where:
+- * - store the maximum -deadline bandwidth of the system (the group);
+- * - cache the fraction of that bandwidth that is currently allocated.
+- *
+- * This is all done in the data structure below. It is similar to the
+- * one used for RT-throttling (rt_bandwidth), with the main difference
+- * that, since here we are only interested in admission control, we
+- * do not decrease any runtime while the group "executes", neither we
+- * need a timer to replenish it.
+- *
+- * With respect to SMP, the bandwidth is given on a per-CPU basis,
+- * meaning that:
+- * - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
+- * - dl_total_bw array contains, in the i-eth element, the currently
+- * allocated bandwidth on the i-eth CPU.
+- * Moreover, groups consume bandwidth on each CPU, while tasks only
+- * consume bandwidth on the CPU they're running on.
+- * Finally, dl_total_bw_cpu is used to cache the index of dl_total_bw
+- * that will be shown the next time the proc or cgroup controls will
+- * be red. It on its turn can be changed by writing on its own
+- * control.
+- */
+ struct dl_bandwidth {
+ raw_spinlock_t dl_runtime_lock;
+ u64 dl_runtime;
+@@ -282,6 +258,24 @@ static inline int dl_bandwidth_enabled(void)
+ return sysctl_sched_rt_runtime >= 0;
+ }
+
++/*
++ * To keep the bandwidth of -deadline tasks under control
++ * we need some place where:
++ * - store the maximum -deadline bandwidth of each cpu;
++ * - cache the fraction of bandwidth that is currently allocated in
++ * each root domain;
++ *
++ * This is all done in the data structure below. It is similar to the
++ * one used for RT-throttling (rt_bandwidth), with the main difference
++ * that, since here we are only interested in admission control, we
++ * do not decrease any runtime while the group "executes", neither we
++ * need a timer to replenish it.
++ *
++ * With respect to SMP, bandwidth is given on a per root domain basis,
++ * meaning that:
++ * - bw (< 100%) is the deadline bandwidth of each CPU;
++ * - total_bw is the currently allocated bandwidth in each root domain;
++ */
+ struct dl_bw {
+ raw_spinlock_t lock;
+ u64 bw;
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index d98d8e78b7363..b58afd2d5ebf4 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -4672,6 +4672,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
+ return;
+ }
+
++ if (!hcon->amp_mgr) {
++ hci_dev_unlock(hdev);
++ return;
++ }
++
+ if (ev->status) {
+ hci_conn_del(hcon);
+ hci_dev_unlock(hdev);
+@@ -5596,21 +5601,19 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
+ struct sk_buff *skb)
+ {
+ u8 num_reports = skb->data[0];
+- void *ptr = &skb->data[1];
++ struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
+
+- hci_dev_lock(hdev);
++ if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
++ return;
+
+- while (num_reports--) {
+- struct hci_ev_le_direct_adv_info *ev = ptr;
++ hci_dev_lock(hdev);
+
++ for (; num_reports; num_reports--, ev++)
+ process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
+ ev->bdaddr_type, &ev->direct_addr,
+ ev->direct_addr_type, ev->rssi, NULL, 0,
+ false);
+
+- ptr += sizeof(*ev);
+- }
+-
+ hci_dev_unlock(hdev);
+ }
+
+diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
+index 5f3950f00f73b..a82d0021d4617 100644
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -242,8 +242,10 @@ static int __vlan_add(struct net_bridge_vlan *v, u16 flags)
+ }
+
+ masterv = br_vlan_get_master(br, v->vid);
+- if (!masterv)
++ if (!masterv) {
++ err = -ENOMEM;
+ goto out_filt;
++ }
+ v->brvlan = masterv;
+ v->stats = masterv->stats;
+ } else {
+diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
+index a648568c5e8fe..4a5f4fbffd836 100644
+--- a/net/core/lwt_bpf.c
++++ b/net/core/lwt_bpf.c
+@@ -44,12 +44,11 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
+ {
+ int ret;
+
+- /* Preempt disable is needed to protect per-cpu redirect_info between
+- * BPF prog and skb_do_redirect(). The call_rcu in bpf_prog_put() and
+- * access to maps strictly require a rcu_read_lock() for protection,
+- * mixing with BH RCU lock doesn't work.
++ /* Preempt disable and BH disable are needed to protect per-cpu
++ * redirect_info between BPF prog and skb_do_redirect().
+ */
+ preempt_disable();
++ local_bh_disable();
+ bpf_compute_data_pointers(skb);
+ ret = bpf_prog_run_save_cb(lwt->prog, skb);
+
+@@ -82,6 +81,7 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
+ break;
+ }
+
++ local_bh_enable();
+ preempt_enable();
+
+ return ret;
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index 10d8f95eb7712..ca20efe775ee4 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -202,7 +202,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
+
+ local_bh_disable();
+ addend = xt_write_recseq_begin();
+- private = READ_ONCE(table->private); /* Address dependency. */
++ private = rcu_access_pointer(table->private);
+ cpu = smp_processor_id();
+ table_base = private->entries;
+ jumpstack = (struct arpt_entry **)private->jumpstack[cpu];
+@@ -648,7 +648,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ unsigned int countersize;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+
+ /* We need atomic snapshot of counters: rest doesn't change
+ * (other than comefrom, which userspace doesn't care
+@@ -672,7 +672,7 @@ static int copy_entries_to_user(unsigned int total_size,
+ unsigned int off, num;
+ const struct arpt_entry *e;
+ struct xt_counters *counters;
+- struct xt_table_info *private = table->private;
++ struct xt_table_info *private = xt_table_get_private_protected(table);
+ int ret = 0;
+ void *loc_cpu_entry;
+
+@@ -807,7 +807,7 @@ static int get_info(struct net *net, void __user *user,
+ t = xt_request_find_table_lock(net, NFPROTO_ARP, name);
+ if (!IS_ERR(t)) {
+ struct arpt_getinfo info;
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+ #ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
+@@ -860,7 +860,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
+
+ t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+
+ if (get.size == private->size)
+ ret = copy_entries_to_user(private->size,
+@@ -1019,7 +1019,7 @@ static int do_add_counters(struct net *net, const void __user *user,
+ }
+
+ local_bh_disable();
+- private = t->private;
++ private = xt_table_get_private_protected(t);
+ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+@@ -1356,7 +1356,7 @@ static int compat_copy_entries_to_user(unsigned int total_size,
+ void __user *userptr)
+ {
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+ void __user *pos;
+ unsigned int size;
+ int ret = 0;
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index e77872c93c206..115d48049686f 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -261,7 +261,7 @@ ipt_do_table(struct sk_buff *skb,
+ WARN_ON(!(table->valid_hooks & (1 << hook)));
+ local_bh_disable();
+ addend = xt_write_recseq_begin();
+- private = READ_ONCE(table->private); /* Address dependency. */
++ private = rcu_access_pointer(table->private);
+ cpu = smp_processor_id();
+ table_base = private->entries;
+ jumpstack = (struct ipt_entry **)private->jumpstack[cpu];
+@@ -794,7 +794,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ unsigned int countersize;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+
+ /* We need atomic snapshot of counters: rest doesn't change
+ (other than comefrom, which userspace doesn't care
+@@ -818,7 +818,7 @@ copy_entries_to_user(unsigned int total_size,
+ unsigned int off, num;
+ const struct ipt_entry *e;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+ int ret = 0;
+ const void *loc_cpu_entry;
+
+@@ -968,7 +968,7 @@ static int get_info(struct net *net, void __user *user,
+ t = xt_request_find_table_lock(net, AF_INET, name);
+ if (!IS_ERR(t)) {
+ struct ipt_getinfo info;
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+ #ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
+@@ -1022,7 +1022,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr,
+
+ t = xt_find_table_lock(net, AF_INET, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+ if (get.size == private->size)
+ ret = copy_entries_to_user(private->size,
+ t, uptr->entrytable);
+@@ -1178,7 +1178,7 @@ do_add_counters(struct net *net, const void __user *user,
+ }
+
+ local_bh_disable();
+- private = t->private;
++ private = xt_table_get_private_protected(t);
+ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+@@ -1573,7 +1573,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
+ void __user *userptr)
+ {
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+ void __user *pos;
+ unsigned int size;
+ int ret = 0;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 686833dfaa7fd..aa025cfda77bf 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -439,7 +439,6 @@ void tcp_init_buffer_space(struct sock *sk)
+ if (!(sk->sk_userlocks & SOCK_SNDBUF_LOCK))
+ tcp_sndbuf_expand(sk);
+
+- tp->rcvq_space.space = min_t(u32, tp->rcv_wnd, TCP_INIT_CWND * tp->advmss);
+ tcp_mstamp_refresh(tp);
+ tp->rcvq_space.time = tp->tcp_mstamp;
+ tp->rcvq_space.seq = tp->copied_seq;
+@@ -463,6 +462,8 @@ void tcp_init_buffer_space(struct sock *sk)
+
+ tp->rcv_ssthresh = min(tp->rcv_ssthresh, tp->window_clamp);
+ tp->snd_cwnd_stamp = tcp_jiffies32;
++ tp->rcvq_space.space = min3(tp->rcv_ssthresh, tp->rcv_wnd,
++ (u32)TCP_INIT_CWND * tp->advmss);
+ }
+
+ /* 4. Recalculate window clamp after socket hit its memory bounds. */
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 74fb211e0ea61..3cfefec819758 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1622,7 +1622,8 @@ static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited)
+ * window, and remember whether we were cwnd-limited then.
+ */
+ if (!before(tp->snd_una, tp->max_packets_seq) ||
+- tp->packets_out > tp->max_packets_out) {
++ tp->packets_out > tp->max_packets_out ||
++ is_cwnd_limited) {
+ tp->max_packets_out = tp->packets_out;
+ tp->max_packets_seq = tp->snd_nxt;
+ tp->is_cwnd_limited = is_cwnd_limited;
+@@ -2407,6 +2408,10 @@ repair:
+ else
+ tcp_chrono_stop(sk, TCP_CHRONO_RWND_LIMITED);
+
++ is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
++ if (likely(sent_pkts || is_cwnd_limited))
++ tcp_cwnd_validate(sk, is_cwnd_limited);
++
+ if (likely(sent_pkts)) {
+ if (tcp_in_cwnd_reduction(sk))
+ tp->prr_out += sent_pkts;
+@@ -2414,8 +2419,6 @@ repair:
+ /* Send one loss probe per tail loss episode. */
+ if (push_one != 2)
+ tcp_schedule_loss_probe(sk, false);
+- is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
+- tcp_cwnd_validate(sk, is_cwnd_limited);
+ return false;
+ }
+ return !tp->packets_out && !tcp_write_queue_empty(sk);
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index daf2e9e9193d1..b1441349e1517 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -283,7 +283,7 @@ ip6t_do_table(struct sk_buff *skb,
+
+ local_bh_disable();
+ addend = xt_write_recseq_begin();
+- private = READ_ONCE(table->private); /* Address dependency. */
++ private = rcu_access_pointer(table->private);
+ cpu = smp_processor_id();
+ table_base = private->entries;
+ jumpstack = (struct ip6t_entry **)private->jumpstack[cpu];
+@@ -810,7 +810,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ unsigned int countersize;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+
+ /* We need atomic snapshot of counters: rest doesn't change
+ (other than comefrom, which userspace doesn't care
+@@ -834,7 +834,7 @@ copy_entries_to_user(unsigned int total_size,
+ unsigned int off, num;
+ const struct ip6t_entry *e;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+ int ret = 0;
+ const void *loc_cpu_entry;
+
+@@ -984,7 +984,7 @@ static int get_info(struct net *net, void __user *user,
+ t = xt_request_find_table_lock(net, AF_INET6, name);
+ if (!IS_ERR(t)) {
+ struct ip6t_getinfo info;
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+ #ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
+@@ -1039,7 +1039,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
+
+ t = xt_find_table_lock(net, AF_INET6, get.name);
+ if (!IS_ERR(t)) {
+- struct xt_table_info *private = t->private;
++ struct xt_table_info *private = xt_table_get_private_protected(t);
+ if (get.size == private->size)
+ ret = copy_entries_to_user(private->size,
+ t, uptr->entrytable);
+@@ -1194,7 +1194,7 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
+ }
+
+ local_bh_disable();
+- private = t->private;
++ private = xt_table_get_private_protected(t);
+ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+@@ -1582,7 +1582,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
+ void __user *userptr)
+ {
+ struct xt_counters *counters;
+- const struct xt_table_info *private = table->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(table);
+ void __user *pos;
+ unsigned int size;
+ int ret = 0;
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index 4fc720c77e37e..6dc5f93b1e4d1 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -63,6 +63,7 @@ static struct mesh_table *mesh_table_alloc(void)
+ atomic_set(&newtbl->entries, 0);
+ spin_lock_init(&newtbl->gates_lock);
+ spin_lock_init(&newtbl->walk_lock);
++ rhashtable_init(&newtbl->rhead, &mesh_rht_params);
+
+ return newtbl;
+ }
+@@ -786,9 +787,6 @@ int mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata)
+ goto free_path;
+ }
+
+- rhashtable_init(&tbl_path->rhead, &mesh_rht_params);
+- rhashtable_init(&tbl_mpp->rhead, &mesh_rht_params);
+-
+ sdata->u.mesh.mesh_paths = tbl_path;
+ sdata->u.mesh.mpp_paths = tbl_mpp;
+
+diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
+index 4d154efb80c88..d691c2f2e92e7 100644
+--- a/net/mac80211/vht.c
++++ b/net/mac80211/vht.c
+@@ -421,12 +421,18 @@ enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta)
+ * IEEE80211-2016 specification makes higher bandwidth operation
+ * possible on the TDLS link if the peers have wider bandwidth
+ * capability.
++ *
++ * However, in this case, and only if the TDLS peer is authorized,
++ * limit to the tdls_chandef so that the configuration here isn't
++ * wider than what's actually requested on the channel context.
+ */
+ if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
+- test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW))
+- return bw;
+-
+- bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
++ test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW) &&
++ test_sta_flag(sta, WLAN_STA_AUTHORIZED) &&
++ sta->tdls_chandef.chan)
++ bw = min(bw, ieee80211_chan_width_to_rx_bw(sta->tdls_chandef.width));
++ else
++ bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
+
+ return bw;
+ }
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index 3bab89dbc3717..6a7d0303d058f 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -1354,6 +1354,14 @@ struct xt_counters *xt_counters_alloc(unsigned int counters)
+ }
+ EXPORT_SYMBOL(xt_counters_alloc);
+
++struct xt_table_info
++*xt_table_get_private_protected(const struct xt_table *table)
++{
++ return rcu_dereference_protected(table->private,
++ mutex_is_locked(&xt[table->af].mutex));
++}
++EXPORT_SYMBOL(xt_table_get_private_protected);
++
+ struct xt_table_info *
+ xt_replace_table(struct xt_table *table,
+ unsigned int num_counters,
+@@ -1361,7 +1369,6 @@ xt_replace_table(struct xt_table *table,
+ int *error)
+ {
+ struct xt_table_info *private;
+- unsigned int cpu;
+ int ret;
+
+ ret = xt_jumpstack_alloc(newinfo);
+@@ -1371,47 +1378,20 @@ xt_replace_table(struct xt_table *table,
+ }
+
+ /* Do the substitution. */
+- local_bh_disable();
+- private = table->private;
++ private = xt_table_get_private_protected(table);
+
+ /* Check inside lock: is the old number correct? */
+ if (num_counters != private->number) {
+ pr_debug("num_counters != table->private->number (%u/%u)\n",
+ num_counters, private->number);
+- local_bh_enable();
+ *error = -EAGAIN;
+ return NULL;
+ }
+
+ newinfo->initial_entries = private->initial_entries;
+- /*
+- * Ensure contents of newinfo are visible before assigning to
+- * private.
+- */
+- smp_wmb();
+- table->private = newinfo;
+-
+- /* make sure all cpus see new ->private value */
+- smp_wmb();
+
+- /*
+- * Even though table entries have now been swapped, other CPU's
+- * may still be using the old entries...
+- */
+- local_bh_enable();
+-
+- /* ... so wait for even xt_recseq on all cpus */
+- for_each_possible_cpu(cpu) {
+- seqcount_t *s = &per_cpu(xt_recseq, cpu);
+- u32 seq = raw_read_seqcount(s);
+-
+- if (seq & 1) {
+- do {
+- cond_resched();
+- cpu_relax();
+- } while (seq == raw_read_seqcount(s));
+- }
+- }
++ rcu_assign_pointer(table->private, newinfo);
++ synchronize_rcu();
+
+ #ifdef CONFIG_AUDIT
+ if (audit_enabled) {
+@@ -1452,12 +1432,12 @@ struct xt_table *xt_register_table(struct net *net,
+ }
+
+ /* Simplifies replace_table code. */
+- table->private = bootstrap;
++ rcu_assign_pointer(table->private, bootstrap);
+
+ if (!xt_replace_table(table, 0, newinfo, &ret))
+ goto unlock;
+
+- private = table->private;
++ private = xt_table_get_private_protected(table);
+ pr_debug("table->private->number = %u\n", private->number);
+
+ /* save number of initial entries */
+@@ -1480,7 +1460,8 @@ void *xt_unregister_table(struct xt_table *table)
+ struct xt_table_info *private;
+
+ mutex_lock(&xt[table->af].mutex);
+- private = table->private;
++ private = xt_table_get_private_protected(table);
++ RCU_INIT_POINTER(table->private, NULL);
+ list_del(&table->list);
+ mutex_unlock(&xt[table->af].mutex);
+ kfree(table);
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index 5e7c13aa66d0d..9c4235ce57894 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -143,31 +143,64 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(xprt_unregister_transport);
+
++static void
++xprt_class_release(const struct xprt_class *t)
++{
++ module_put(t->owner);
++}
++
++static const struct xprt_class *
++xprt_class_find_by_netid_locked(const char *netid)
++{
++ const struct xprt_class *t;
++ unsigned int i;
++
++ list_for_each_entry(t, &xprt_list, list) {
++ for (i = 0; t->netid[i][0] != '\0'; i++) {
++ if (strcmp(t->netid[i], netid) != 0)
++ continue;
++ if (!try_module_get(t->owner))
++ continue;
++ return t;
++ }
++ }
++ return NULL;
++}
++
++static const struct xprt_class *
++xprt_class_find_by_netid(const char *netid)
++{
++ const struct xprt_class *t;
++
++ spin_lock(&xprt_list_lock);
++ t = xprt_class_find_by_netid_locked(netid);
++ if (!t) {
++ spin_unlock(&xprt_list_lock);
++ request_module("rpc%s", netid);
++ spin_lock(&xprt_list_lock);
++ t = xprt_class_find_by_netid_locked(netid);
++ }
++ spin_unlock(&xprt_list_lock);
++ return t;
++}
++
+ /**
+ * xprt_load_transport - load a transport implementation
+- * @transport_name: transport to load
++ * @netid: transport to load
+ *
+ * Returns:
+ * 0: transport successfully loaded
+ * -ENOENT: transport module not available
+ */
+-int xprt_load_transport(const char *transport_name)
++int xprt_load_transport(const char *netid)
+ {
+- struct xprt_class *t;
+- int result;
++ const struct xprt_class *t;
+
+- result = 0;
+- spin_lock(&xprt_list_lock);
+- list_for_each_entry(t, &xprt_list, list) {
+- if (strcmp(t->name, transport_name) == 0) {
+- spin_unlock(&xprt_list_lock);
+- goto out;
+- }
+- }
+- spin_unlock(&xprt_list_lock);
+- result = request_module("xprt%s", transport_name);
+-out:
+- return result;
++ t = xprt_class_find_by_netid(netid);
++ if (!t)
++ return -ENOENT;
++ xprt_class_release(t);
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(xprt_load_transport);
+
+diff --git a/net/sunrpc/xprtrdma/module.c b/net/sunrpc/xprtrdma/module.c
+index 620327c01302c..45c5b41ac8dc9 100644
+--- a/net/sunrpc/xprtrdma/module.c
++++ b/net/sunrpc/xprtrdma/module.c
+@@ -24,6 +24,7 @@ MODULE_DESCRIPTION("RPC/RDMA Transport");
+ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_ALIAS("svcrdma");
+ MODULE_ALIAS("xprtrdma");
++MODULE_ALIAS("rpcrdma6");
+
+ static void __exit rpc_rdma_cleanup(void)
+ {
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index f56f36b4d742d..fdd14908eacbd 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -854,6 +854,7 @@ static struct xprt_class xprt_rdma = {
+ .owner = THIS_MODULE,
+ .ident = XPRT_TRANSPORT_RDMA,
+ .setup = xprt_setup_rdma,
++ .netid = { "rdma", "rdma6", "" },
+ };
+
+ void xprt_rdma_cleanup(void)
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 9dc059dea689d..798fbd89ed42f 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -3241,6 +3241,7 @@ static struct xprt_class xs_local_transport = {
+ .owner = THIS_MODULE,
+ .ident = XPRT_TRANSPORT_LOCAL,
+ .setup = xs_setup_local,
++ .netid = { "" },
+ };
+
+ static struct xprt_class xs_udp_transport = {
+@@ -3249,6 +3250,7 @@ static struct xprt_class xs_udp_transport = {
+ .owner = THIS_MODULE,
+ .ident = XPRT_TRANSPORT_UDP,
+ .setup = xs_setup_udp,
++ .netid = { "udp", "udp6", "" },
+ };
+
+ static struct xprt_class xs_tcp_transport = {
+@@ -3257,6 +3259,7 @@ static struct xprt_class xs_tcp_transport = {
+ .owner = THIS_MODULE,
+ .ident = XPRT_TRANSPORT_TCP,
+ .setup = xs_setup_tcp,
++ .netid = { "tcp", "tcp6", "" },
+ };
+
+ static struct xprt_class xs_bc_tcp_transport = {
+@@ -3265,6 +3268,7 @@ static struct xprt_class xs_bc_tcp_transport = {
+ .owner = THIS_MODULE,
+ .ident = XPRT_TRANSPORT_BC_TCP,
+ .setup = xs_setup_bc_tcp,
++ .netid = { "" },
+ };
+
+ /**
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index fbc8875502c3e..5f0605275fa39 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -11502,7 +11502,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
+ struct net_device *dev = info->user_ptr[1];
+ struct wireless_dev *wdev = dev->ieee80211_ptr;
+ struct nlattr *tb[NUM_NL80211_REKEY_DATA];
+- struct cfg80211_gtk_rekey_data rekey_data;
++ struct cfg80211_gtk_rekey_data rekey_data = {};
+ int err;
+
+ if (!info->attrs[NL80211_ATTR_REKEY_DATA])
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 9ff2ab63e6392..6bb0649c028c4 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -289,17 +289,17 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
+ return (xs->zc) ? xsk_zc_xmit(sk) : xsk_generic_xmit(sk, m, total_len);
+ }
+
+-static unsigned int xsk_poll(struct file *file, struct socket *sock,
++static __poll_t xsk_poll(struct file *file, struct socket *sock,
+ struct poll_table_struct *wait)
+ {
+- unsigned int mask = datagram_poll(file, sock, wait);
++ __poll_t mask = datagram_poll(file, sock, wait);
+ struct sock *sk = sock->sk;
+ struct xdp_sock *xs = xdp_sk(sk);
+
+ if (xs->rx && !xskq_empty_desc(xs->rx))
+- mask |= POLLIN | POLLRDNORM;
++ mask |= EPOLLIN | EPOLLRDNORM;
+ if (xs->tx && !xskq_full_desc(xs->tx))
+- mask |= POLLOUT | POLLWRNORM;
++ mask |= EPOLLOUT | EPOLLWRNORM;
+
+ return mask;
+ }
+diff --git a/samples/bpf/lwt_len_hist.sh b/samples/bpf/lwt_len_hist.sh
+old mode 100644
+new mode 100755
+index 090b96eaf7f76..0eda9754f50b8
+--- a/samples/bpf/lwt_len_hist.sh
++++ b/samples/bpf/lwt_len_hist.sh
+@@ -8,6 +8,8 @@ VETH1=tst_lwt1b
+ TRACE_ROOT=/sys/kernel/debug/tracing
+
+ function cleanup {
++ # To reset saved histogram, remove pinned map
++ rm /sys/fs/bpf/tc/globals/lwt_len_hist_map
+ ip route del 192.168.253.2/32 dev $VETH0 2> /dev/null
+ ip link del $VETH0 2> /dev/null
+ ip link del $VETH1 2> /dev/null
+diff --git a/samples/bpf/test_lwt_bpf.sh b/samples/bpf/test_lwt_bpf.sh
+old mode 100644
+new mode 100755
+diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
+index 7eb944cbbaeab..2e31ec1378219 100755
+--- a/scripts/checkpatch.pl
++++ b/scripts/checkpatch.pl
+@@ -4059,7 +4059,7 @@ sub process {
+ $fix) {
+ fix_delete_line($fixlinenr, $rawline);
+ my $fixed_line = $rawline;
+- $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*){(.*)$/;
++ $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*)\{(.*)$/;
+ my $line1 = $1;
+ my $line2 = $2;
+ fix_insert_line($fixlinenr, ltrim($line1));
+diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
+index 5ca2df790d3cf..389814b02d06b 100644
+--- a/scripts/kconfig/preprocess.c
++++ b/scripts/kconfig/preprocess.c
+@@ -111,7 +111,7 @@ static char *do_error_if(int argc, char *argv[])
+ if (!strcmp(argv[0], "y"))
+ pperror("%s", argv[1]);
+
+- return NULL;
++ return xstrdup("");
+ }
+
+ static char *do_filename(int argc, char *argv[])
+diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
+index f4f3de5f06ca5..5596ea8f339a3 100644
+--- a/security/integrity/ima/ima_crypto.c
++++ b/security/integrity/ima/ima_crypto.c
+@@ -415,7 +415,7 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ loff_t i_size;
+ int rc;
+ struct file *f = file;
+- bool new_file_instance = false, modified_mode = false;
++ bool new_file_instance = false;
+
+ /*
+ * For consistency, fail file's opened with the O_DIRECT flag on
+@@ -433,18 +433,10 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ O_TRUNC | O_CREAT | O_NOCTTY | O_EXCL);
+ flags |= O_RDONLY;
+ f = dentry_open(&file->f_path, flags, file->f_cred);
+- if (IS_ERR(f)) {
+- /*
+- * Cannot open the file again, lets modify f_mode
+- * of original and continue
+- */
+- pr_info_ratelimited("Unable to reopen file for reading.\n");
+- f = file;
+- f->f_mode |= FMODE_READ;
+- modified_mode = true;
+- } else {
+- new_file_instance = true;
+- }
++ if (IS_ERR(f))
++ return PTR_ERR(f);
++
++ new_file_instance = true;
+ }
+
+ i_size = i_size_read(file_inode(f));
+@@ -459,8 +451,6 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ out:
+ if (new_file_instance)
+ fput(f);
+- else if (modified_mode)
+- f->f_mode &= ~FMODE_READ;
+ return rc;
+ }
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 250b725f5754c..08833bbb97aab 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1618,7 +1618,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ * inode_doinit with a dentry, before these inodes could
+ * be used again by userspace.
+ */
+- goto out;
++ goto out_invalid;
+ }
+
+ len = INITCONTEXTLEN;
+@@ -1734,7 +1734,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ * could be used again by userspace.
+ */
+ if (!dentry)
+- goto out;
++ goto out_invalid;
+ rc = selinux_genfs_get_sid(dentry, sclass,
+ sbsec->flags, &sid);
+ dput(dentry);
+@@ -1747,11 +1747,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ out:
+ spin_lock(&isec->lock);
+ if (isec->initialized == LABEL_PENDING) {
+- if (!sid || rc) {
++ if (rc) {
+ isec->initialized = LABEL_INVALID;
+ goto out_unlock;
+ }
+-
+ isec->initialized = LABEL_INITIALIZED;
+ isec->sid = sid;
+ }
+@@ -1759,6 +1758,15 @@ out:
+ out_unlock:
+ spin_unlock(&isec->lock);
+ return rc;
++
++out_invalid:
++ spin_lock(&isec->lock);
++ if (isec->initialized == LABEL_PENDING) {
++ isec->initialized = LABEL_INVALID;
++ isec->sid = sid;
++ }
++ spin_unlock(&isec->lock);
++ return 0;
+ }
+
+ /* Convert a Linux signal to an access vector. */
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index 41abb8bd466af..2a286167460f6 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -708,6 +708,8 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream,
+
+ oss_buffer_size = snd_pcm_plug_client_size(substream,
+ snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_BUFFER_SIZE, NULL)) * oss_frame_size;
++ if (!oss_buffer_size)
++ return -EINVAL;
+ oss_buffer_size = rounddown_pow_of_two(oss_buffer_size);
+ if (atomic_read(&substream->mmap_count)) {
+ if (oss_buffer_size > runtime->oss.mmap_bytes)
+@@ -743,17 +745,21 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream,
+
+ min_period_size = snd_pcm_plug_client_size(substream,
+ snd_pcm_hw_param_value_min(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
+- min_period_size *= oss_frame_size;
+- min_period_size = roundup_pow_of_two(min_period_size);
+- if (oss_period_size < min_period_size)
+- oss_period_size = min_period_size;
++ if (min_period_size) {
++ min_period_size *= oss_frame_size;
++ min_period_size = roundup_pow_of_two(min_period_size);
++ if (oss_period_size < min_period_size)
++ oss_period_size = min_period_size;
++ }
+
+ max_period_size = snd_pcm_plug_client_size(substream,
+ snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
+- max_period_size *= oss_frame_size;
+- max_period_size = rounddown_pow_of_two(max_period_size);
+- if (oss_period_size > max_period_size)
+- oss_period_size = max_period_size;
++ if (max_period_size) {
++ max_period_size *= oss_frame_size;
++ max_period_size = rounddown_pow_of_two(max_period_size);
++ if (oss_period_size > max_period_size)
++ oss_period_size = max_period_size;
++ }
+
+ oss_periods = oss_buffer_size / oss_period_size;
+
+@@ -1949,11 +1955,15 @@ static int snd_pcm_oss_set_subdivide(struct snd_pcm_oss_file *pcm_oss_file, int
+ static int snd_pcm_oss_set_fragment1(struct snd_pcm_substream *substream, unsigned int val)
+ {
+ struct snd_pcm_runtime *runtime;
++ int fragshift;
+
+ runtime = substream->runtime;
+ if (runtime->oss.subdivision || runtime->oss.fragshift)
+ return -EINVAL;
+- runtime->oss.fragshift = val & 0xffff;
++ fragshift = val & 0xffff;
++ if (fragshift >= 31)
++ return -EINVAL;
++ runtime->oss.fragshift = fragshift;
+ runtime->oss.maxfrags = (val >> 16) & 0xffff;
+ if (runtime->oss.fragshift < 4) /* < 16 */
+ runtime->oss.fragshift = 4;
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index dbeb62362f1c3..7f1e763ccca88 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -1782,7 +1782,7 @@ int snd_hda_codec_reset(struct hda_codec *codec)
+ return -EBUSY;
+
+ /* OK, let it free */
+- snd_hdac_device_unregister(&codec->core);
++ device_release_driver(hda_codec_dev(codec));
+
+ /* allow device access again */
+ snd_hda_unlock_devices(bus);
+diff --git a/sound/pci/hda/hda_sysfs.c b/sound/pci/hda/hda_sysfs.c
+index 6535155e992df..25a4c2d580dae 100644
+--- a/sound/pci/hda/hda_sysfs.c
++++ b/sound/pci/hda/hda_sysfs.c
+@@ -138,7 +138,7 @@ static int reconfig_codec(struct hda_codec *codec)
+ "The codec is being used, can't reconfigure.\n");
+ goto error;
+ }
+- err = snd_hda_codec_configure(codec);
++ err = device_reprobe(hda_codec_dev(codec));
+ if (err < 0)
+ goto error;
+ err = snd_card_register(codec->card);
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index c9f3c002bd553..004a7772bb5d0 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -106,7 +106,7 @@ enum {
+ };
+
+ /* Strings for Input Source Enum Control */
+-static const char *const in_src_str[3] = {"Rear Mic", "Line", "Front Mic" };
++static const char *const in_src_str[3] = { "Microphone", "Line In", "Front Microphone" };
+ #define IN_SRC_NUM_OF_INPUTS 3
+ enum {
+ REAR_MIC,
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 790a2e79aba54..37b2bcdb3d65a 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2491,6 +2491,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x11f7, "MSI-GE63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1462, 0x1229, "MSI-GP73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1275, "MSI-GL63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
+@@ -7084,6 +7085,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1043, 0x1271, "ASUS X430UN", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC),
+@@ -7100,6 +7102,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
+ SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
+@@ -7126,6 +7129,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x152d, 0x1082, "Quanta NL3", ALC269_FIXUP_LIFEBOOK),
+ SND_PCI_QUIRK(0x1558, 0x1323, "Clevo N130ZU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x1401, "Clevo L140[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
+index df5b36b8fc5a6..bb6a95be87265 100644
+--- a/sound/soc/codecs/wm8997.c
++++ b/sound/soc/codecs/wm8997.c
+@@ -1180,6 +1180,8 @@ static int wm8997_probe(struct platform_device *pdev)
+ goto err_spk_irqs;
+ }
+
++ return ret;
++
+ err_spk_irqs:
+ arizona_free_spk_irqs(arizona);
+
+diff --git a/sound/soc/codecs/wm8998.c b/sound/soc/codecs/wm8998.c
+index 61294c787f274..17dc5780ab686 100644
+--- a/sound/soc/codecs/wm8998.c
++++ b/sound/soc/codecs/wm8998.c
+@@ -1378,7 +1378,7 @@ static int wm8998_probe(struct platform_device *pdev)
+
+ ret = arizona_init_spk_irqs(arizona);
+ if (ret < 0)
+- return ret;
++ goto err_pm_disable;
+
+ ret = devm_snd_soc_register_component(&pdev->dev,
+ &soc_component_dev_wm8998,
+@@ -1393,6 +1393,8 @@ static int wm8998_probe(struct platform_device *pdev)
+
+ err_spk_irqs:
+ arizona_free_spk_irqs(arizona);
++err_pm_disable:
++ pm_runtime_disable(&pdev->dev);
+
+ return ret;
+ }
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index b114fc7b2a95e..02c557e1f779c 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -1379,7 +1379,7 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
+ ctl_work = kzalloc(sizeof(*ctl_work), GFP_KERNEL);
+ if (!ctl_work) {
+ ret = -ENOMEM;
+- goto err_ctl_cache;
++ goto err_list_del;
+ }
+
+ ctl_work->dsp = dsp;
+@@ -1389,7 +1389,8 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
+
+ return 0;
+
+-err_ctl_cache:
++err_list_del:
++ list_del(&ctl->list);
+ kfree(ctl->cache);
+ err_ctl_name:
+ kfree(ctl->name);
+diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c
+index e099c0505b765..2c6b0ac97c684 100644
+--- a/sound/soc/jz4740/jz4740-i2s.c
++++ b/sound/soc/jz4740/jz4740-i2s.c
+@@ -318,10 +318,14 @@ static int jz4740_i2s_set_sysclk(struct snd_soc_dai *dai, int clk_id,
+ switch (clk_id) {
+ case JZ4740_I2S_CLKSRC_EXT:
+ parent = clk_get(NULL, "ext");
++ if (IS_ERR(parent))
++ return PTR_ERR(parent);
+ clk_set_parent(i2s->clk_i2s, parent);
+ break;
+ case JZ4740_I2S_CLKSRC_PLL:
+ parent = clk_get(NULL, "pll half");
++ if (IS_ERR(parent))
++ return PTR_ERR(parent);
+ clk_set_parent(i2s->clk_i2s, parent);
+ ret = clk_set_rate(i2s->clk_i2s, freq);
+ break;
+diff --git a/sound/soc/meson/Kconfig b/sound/soc/meson/Kconfig
+index 8af8bc358a90a..19fd4d583b869 100644
+--- a/sound/soc/meson/Kconfig
++++ b/sound/soc/meson/Kconfig
+@@ -1,5 +1,5 @@
+ menu "ASoC support for Amlogic platforms"
+- depends on ARCH_MESON || COMPILE_TEST
++ depends on ARCH_MESON || (COMPILE_TEST && COMMON_CLK)
+
+ config SND_MESON_AXG_FIFO
+ tristate
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index a0d1ce0edaf9a..af14304645ce8 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2390,6 +2390,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_RESUME:
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++ case SNDRV_PCM_TRIGGER_DRAIN:
+ ret = dpcm_dai_trigger_fe_be(substream, cmd, true);
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+@@ -2407,6 +2408,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_RESUME:
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++ case SNDRV_PCM_TRIGGER_DRAIN:
+ ret = dpcm_dai_trigger_fe_be(substream, cmd, false);
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+diff --git a/sound/usb/clock.c b/sound/usb/clock.c
+index bfe5540030b80..54818658d0217 100644
+--- a/sound/usb/clock.c
++++ b/sound/usb/clock.c
+@@ -508,6 +508,12 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, int iface,
+ }
+
+ crate = data[0] | (data[1] << 8) | (data[2] << 16);
++ if (!crate) {
++ dev_info(&dev->dev, "failed to read current rate; disabling the check\n");
++ chip->sample_rate_read_error = 3; /* three strikes, see above */
++ return 0;
++ }
++
+ if (crate != rate) {
+ dev_warn(&dev->dev, "current rate %d is different from the runtime rate %d\n", crate, rate);
+ // runtime->rate = crate;
+diff --git a/sound/usb/format.c b/sound/usb/format.c
+index c8207b52c651c..a3daf93c565aa 100644
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -53,6 +53,8 @@ static u64 parse_audio_format_i_type(struct snd_usb_audio *chip,
+ case UAC_VERSION_1:
+ default: {
+ struct uac_format_type_i_discrete_descriptor *fmt = _fmt;
++ if (format >= 64)
++ return 0; /* invalid format */
+ sample_width = fmt->bBitResolution;
+ sample_bytes = fmt->bSubframeSize;
+ format = 1ULL << format;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index d4aae3fcd3cd7..d52ab6d49d18c 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1465,6 +1465,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ case 0x25ce: /* Mytek devices */
+ case 0x278b: /* Rotel? */
+ case 0x292b: /* Gustard/Ess based devices */
++ case 0x2972: /* FiiO devices */
+ case 0x2ab6: /* T+A devices */
+ case 0x3353: /* Khadas devices */
+ case 0x3842: /* EVGA */
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index ff5d803cfaf09..94bef3d043786 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -198,16 +198,16 @@ static int usb_chmap_ctl_get(struct snd_kcontrol *kcontrol,
+ struct snd_pcm_chmap *info = snd_kcontrol_chip(kcontrol);
+ struct snd_usb_substream *subs = info->private_data;
+ struct snd_pcm_chmap_elem *chmap = NULL;
+- int i;
++ int i = 0;
+
+- memset(ucontrol->value.integer.value, 0,
+- sizeof(ucontrol->value.integer.value));
+ if (subs->cur_audiofmt)
+ chmap = subs->cur_audiofmt->chmap;
+ if (chmap) {
+ for (i = 0; i < chmap->channels; i++)
+ ucontrol->value.integer.value[i] = chmap->map[i];
+ }
++ for (; i < subs->channels_max; i++)
++ ucontrol->value.integer.value[i] = 0;
+ return 0;
+ }
+
+diff --git a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
+index 938def6d0bb98..f540037eb7050 100644
+--- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
++++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c
+@@ -278,14 +278,12 @@ cs_etm_decoder__buffer_packet(struct cs_etm_decoder *decoder,
+ enum cs_etm_sample_type sample_type)
+ {
+ u32 et = 0;
+- struct int_node *inode = NULL;
++ int cpu;
+
+ if (decoder->packet_count >= MAX_BUFFER - 1)
+ return OCSD_RESP_FATAL_SYS_ERR;
+
+- /* Search the RB tree for the cpu associated with this traceID */
+- inode = intlist__find(traceid_list, trace_chan_id);
+- if (!inode)
++ if (cs_etm__get_cpu(trace_chan_id, &cpu) < 0)
+ return OCSD_RESP_FATAL_SYS_ERR;
+
+ et = decoder->tail;
+@@ -296,7 +294,7 @@ cs_etm_decoder__buffer_packet(struct cs_etm_decoder *decoder,
+ decoder->packet_buffer[et].sample_type = sample_type;
+ decoder->packet_buffer[et].exc = false;
+ decoder->packet_buffer[et].exc_ret = false;
+- decoder->packet_buffer[et].cpu = *((int *)inode->priv);
++ decoder->packet_buffer[et].cpu = cpu;
+ decoder->packet_buffer[et].start_addr = CS_ETM_INVAL_ADDR;
+ decoder->packet_buffer[et].end_addr = CS_ETM_INVAL_ADDR;
+
+diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
+index 7b5e15cc6b717..3275b8dc93442 100644
+--- a/tools/perf/util/cs-etm.c
++++ b/tools/perf/util/cs-etm.c
+@@ -87,10 +87,27 @@ struct cs_etm_queue {
+ struct cs_etm_packet *packet;
+ };
+
++/* RB tree for quick conversion between traceID and metadata pointers */
++static struct intlist *traceid_list;
++
+ static int cs_etm__update_queues(struct cs_etm_auxtrace *etm);
+ static int cs_etm__process_timeless_queues(struct cs_etm_auxtrace *etm,
+ pid_t tid, u64 time_);
+
++int cs_etm__get_cpu(u8 trace_chan_id, int *cpu)
++{
++ struct int_node *inode;
++ u64 *metadata;
++
++ inode = intlist__find(traceid_list, trace_chan_id);
++ if (!inode)
++ return -EINVAL;
++
++ metadata = inode->priv;
++ *cpu = (int)metadata[CS_ETM_CPU];
++ return 0;
++}
++
+ static void cs_etm__packet_dump(const char *pkt_string)
+ {
+ const char *color = PERF_COLOR_BLUE;
+@@ -230,7 +247,7 @@ static void cs_etm__free(struct perf_session *session)
+ cs_etm__free_events(session);
+ session->auxtrace = NULL;
+
+- /* First remove all traceID/CPU# nodes for the RB tree */
++ /* First remove all traceID/metadata nodes for the RB tree */
+ intlist__for_each_entry_safe(inode, tmp, traceid_list)
+ intlist__remove(traceid_list, inode);
+ /* Then the RB tree itself */
+@@ -1316,9 +1333,9 @@ int cs_etm__process_auxtrace_info(union perf_event *event,
+ 0xffffffff);
+
+ /*
+- * Create an RB tree for traceID-CPU# tuple. Since the conversion has
+- * to be made for each packet that gets decoded, optimizing access in
+- * anything other than a sequential array is worth doing.
++ * Create an RB tree for traceID-metadata tuple. Since the conversion
++ * has to be made for each packet that gets decoded, optimizing access
++ * in anything other than a sequential array is worth doing.
+ */
+ traceid_list = intlist__new(NULL);
+ if (!traceid_list) {
+@@ -1384,8 +1401,8 @@ int cs_etm__process_auxtrace_info(union perf_event *event,
+ err = -EINVAL;
+ goto err_free_metadata;
+ }
+- /* All good, associate the traceID with the CPU# */
+- inode->priv = &metadata[j][CS_ETM_CPU];
++ /* All good, associate the traceID with the metadata pointer */
++ inode->priv = metadata[j];
+ }
+
+ /*
+diff --git a/tools/perf/util/cs-etm.h b/tools/perf/util/cs-etm.h
+index 37f8d48179cae..97c3152f5bfd5 100644
+--- a/tools/perf/util/cs-etm.h
++++ b/tools/perf/util/cs-etm.h
+@@ -53,9 +53,6 @@ enum {
+ CS_ETMV4_PRIV_MAX,
+ };
+
+-/* RB tree for quick conversion between traceID and CPUs */
+-struct intlist *traceid_list;
+-
+ #define KiB(x) ((x) * 1024)
+ #define MiB(x) ((x) * 1024 * 1024)
+
+@@ -69,6 +66,7 @@ static const u64 __perf_cs_etmv4_magic = 0x4040404040404040ULL;
+ #ifdef HAVE_CSTRACE_SUPPORT
+ int cs_etm__process_auxtrace_info(union perf_event *event,
+ struct perf_session *session);
++int cs_etm__get_cpu(u8 trace_chan_id, int *cpu);
+ #else
+ static inline int
+ cs_etm__process_auxtrace_info(union perf_event *event __maybe_unused,
+@@ -76,6 +74,12 @@ cs_etm__process_auxtrace_info(union perf_event *event __maybe_unused,
+ {
+ return -1;
+ }
++
++static inline int cs_etm__get_cpu(u8 trace_chan_id __maybe_unused,
++ int *cpu __maybe_unused)
++{
++ return -1;
++}
+ #endif
+
+ #endif
+diff --git a/tools/perf/util/parse-regs-options.c b/tools/perf/util/parse-regs-options.c
+index e6599e290f467..e5ad120e7f69a 100644
+--- a/tools/perf/util/parse-regs-options.c
++++ b/tools/perf/util/parse-regs-options.c
+@@ -41,7 +41,7 @@ parse_regs(const struct option *opt, const char *str, int unset)
+ }
+ fputc('\n', stderr);
+ /* just printing available regs */
+- return -1;
++ goto error;
+ }
+ for (r = sample_reg_masks; r->name; r++) {
+ if (!strcasecmp(s, r->name))
+diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
+index 3118fc0d149b0..406401f1acc25 100755
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -4177,7 +4177,12 @@ sub do_send_mail {
+ $mail_command =~ s/\$SUBJECT/$subject/g;
+ $mail_command =~ s/\$MESSAGE/$message/g;
+
+- run_command $mail_command;
++ my $ret = run_command $mail_command;
++ if (!$ret && defined($file)) {
++ # try again without the file
++ $message .= "\n\n*** FAILED TO SEND LOG ***\n\n";
++ do_send_email($subject, $message);
++ }
+ }
+
+ sub send_email {
+diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
+index d59642e70f562..2229e55216a97 100755
+--- a/tools/testing/selftests/bpf/test_offload.py
++++ b/tools/testing/selftests/bpf/test_offload.py
+@@ -787,6 +787,7 @@ try:
+ start_test("Test disabling TC offloads is rejected while filters installed...")
+ ret, _ = sim.set_ethtool_tc_offloads(False, fail=False)
+ fail(ret == 0, "Driver should refuse to disable TC offloads with filters installed...")
++ sim.set_ethtool_tc_offloads(True)
+
+ start_test("Test qdisc removal frees things...")
+ sim.tc_flush_filters()
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-01-06 14:15 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-01-06 14:15 UTC (permalink / raw
To: gentoo-commits
commit: bb6bcd3f28d96ebb52cf4915c8a2a793218fdc3b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 6 14:15:28 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jan 6 14:15:28 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bb6bcd3f
Linux patch 4.19.165
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1164_linux-4.19.165.patch | 1169 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1173 insertions(+)
diff --git a/0000_README b/0000_README
index 5ffa36c..8c285e2 100644
--- a/0000_README
+++ b/0000_README
@@ -695,6 +695,10 @@ Patch: 1163_linux-4.19.164.patch
From: https://www.kernel.org
Desc: Linux 4.19.164
+Patch: 1164_linux-4.19.165.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.165
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1164_linux-4.19.165.patch b/1164_linux-4.19.165.patch
new file mode 100644
index 0000000..b530c04
--- /dev/null
+++ b/1164_linux-4.19.165.patch
@@ -0,0 +1,1169 @@
+diff --git a/Makefile b/Makefile
+index d02af6881a5fe..e636c21432951 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 164
++SUBLEVEL = 165
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/include/asm/bitops.h b/arch/powerpc/include/asm/bitops.h
+index ff71566dadee5..76db1c5000bd6 100644
+--- a/arch/powerpc/include/asm/bitops.h
++++ b/arch/powerpc/include/asm/bitops.h
+@@ -221,15 +221,34 @@ static __inline__ void __clear_bit_unlock(int nr, volatile unsigned long *addr)
+ */
+ static __inline__ int fls(unsigned int x)
+ {
+- return 32 - __builtin_clz(x);
++ int lz;
++
++ if (__builtin_constant_p(x))
++ return x ? 32 - __builtin_clz(x) : 0;
++ asm("cntlzw %0,%1" : "=r" (lz) : "r" (x));
++ return 32 - lz;
+ }
+
+ #include <asm-generic/bitops/builtin-__fls.h>
+
++/*
++ * 64-bit can do this using one cntlzd (count leading zeroes doubleword)
++ * instruction; for 32-bit we use the generic version, which does two
++ * 32-bit fls calls.
++ */
++#ifdef CONFIG_PPC64
+ static __inline__ int fls64(__u64 x)
+ {
+- return 64 - __builtin_clzll(x);
++ int lz;
++
++ if (__builtin_constant_p(x))
++ return x ? 64 - __builtin_clzll(x) : 0;
++ asm("cntlzd %0,%1" : "=r" (lz) : "r" (x));
++ return 64 - lz;
+ }
++#else
++#include <asm-generic/bitops/fls64.h>
++#endif
+
+ #ifdef CONFIG_PPC64
+ unsigned int __arch_hweight8(unsigned int w);
+diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c
+index 280e964e1aa88..497e86cfb12e0 100644
+--- a/arch/powerpc/sysdev/mpic_msgr.c
++++ b/arch/powerpc/sysdev/mpic_msgr.c
+@@ -196,7 +196,7 @@ static int mpic_msgr_probe(struct platform_device *dev)
+
+ /* IO map the message register block. */
+ of_address_to_resource(np, 0, &rsrc);
+- msgr_block_addr = ioremap(rsrc.start, resource_size(&rsrc));
++ msgr_block_addr = devm_ioremap(&dev->dev, rsrc.start, resource_size(&rsrc));
+ if (!msgr_block_addr) {
+ dev_err(&dev->dev, "Failed to iomap MPIC message registers");
+ return -EFAULT;
+diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
+index d78a61408243f..7dec43b2c4205 100644
+--- a/arch/x86/kvm/cpuid.h
++++ b/arch/x86/kvm/cpuid.h
+@@ -154,6 +154,20 @@ static inline int guest_cpuid_stepping(struct kvm_vcpu *vcpu)
+ return x86_stepping(best->eax);
+ }
+
++static inline bool guest_has_spec_ctrl_msr(struct kvm_vcpu *vcpu)
++{
++ return (guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL) ||
++ guest_cpuid_has(vcpu, X86_FEATURE_AMD_STIBP) ||
++ guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS) ||
++ guest_cpuid_has(vcpu, X86_FEATURE_AMD_SSBD));
++}
++
++static inline bool guest_has_pred_cmd_msr(struct kvm_vcpu *vcpu)
++{
++ return (guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL) ||
++ guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBPB));
++}
++
+ static inline bool supports_cpuid_fault(struct kvm_vcpu *vcpu)
+ {
+ return vcpu->arch.msr_platform_info & MSR_PLATFORM_INFO_CPUID_FAULT;
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index a0c3d1b4b295b..d2dc734f5bd0d 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -4209,8 +4209,7 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ break;
+ case MSR_IA32_SPEC_CTRL:
+ if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS) &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_AMD_SSBD))
++ !guest_has_spec_ctrl_msr(vcpu))
+ return 1;
+
+ msr_info->data = svm->spec_ctrl;
+@@ -4312,8 +4311,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
+ break;
+ case MSR_IA32_SPEC_CTRL:
+ if (!msr->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS) &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_AMD_SSBD))
++ !guest_has_spec_ctrl_msr(vcpu))
+ return 1;
+
+ /* The STIBP bit doesn't fault even if it's not advertised */
+@@ -4340,12 +4338,11 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
+ break;
+ case MSR_IA32_PRED_CMD:
+ if (!msr->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBPB))
++ !guest_has_pred_cmd_msr(vcpu))
+ return 1;
+
+ if (data & ~PRED_CMD_IBPB)
+ return 1;
+-
+ if (!data)
+ break;
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index d6bcbce6c15cb..77b9ed5223f37 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -4066,7 +4066,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ return kvm_get_msr_common(vcpu, msr_info);
+ case MSR_IA32_SPEC_CTRL:
+ if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
++ !guest_has_spec_ctrl_msr(vcpu))
+ return 1;
+
+ msr_info->data = to_vmx(vcpu)->spec_ctrl;
+@@ -4180,7 +4180,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ break;
+ case MSR_IA32_SPEC_CTRL:
+ if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
++ !guest_has_spec_ctrl_msr(vcpu))
+ return 1;
+
+ /* The STIBP bit doesn't fault even if it's not advertised */
+@@ -4210,7 +4210,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ break;
+ case MSR_IA32_PRED_CMD:
+ if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL))
++ !guest_has_pred_cmd_msr(vcpu))
+ return 1;
+
+ if (data & ~PRED_CMD_IBPB)
+diff --git a/drivers/block/null_blk_zoned.c b/drivers/block/null_blk_zoned.c
+index d1725ac636c04..079ed33fd8067 100644
+--- a/drivers/block/null_blk_zoned.c
++++ b/drivers/block/null_blk_zoned.c
+@@ -1,9 +1,9 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include <linux/vmalloc.h>
++#include <linux/sizes.h>
+ #include "null_blk.h"
+
+-/* zone_size in MBs to sectors. */
+-#define ZONE_SIZE_SHIFT 11
++#define MB_TO_SECTS(mb) (((sector_t)mb * SZ_1M) >> SECTOR_SHIFT)
+
+ static inline unsigned int null_zone_no(struct nullb_device *dev, sector_t sect)
+ {
+@@ -12,7 +12,7 @@ static inline unsigned int null_zone_no(struct nullb_device *dev, sector_t sect)
+
+ int null_zone_init(struct nullb_device *dev)
+ {
+- sector_t dev_size = (sector_t)dev->size * 1024 * 1024;
++ sector_t dev_capacity_sects;
+ sector_t sector = 0;
+ unsigned int i;
+
+@@ -25,9 +25,12 @@ int null_zone_init(struct nullb_device *dev)
+ return -EINVAL;
+ }
+
+- dev->zone_size_sects = dev->zone_size << ZONE_SIZE_SHIFT;
+- dev->nr_zones = dev_size >>
+- (SECTOR_SHIFT + ilog2(dev->zone_size_sects));
++ dev_capacity_sects = MB_TO_SECTS(dev->size);
++ dev->zone_size_sects = MB_TO_SECTS(dev->zone_size);
++ dev->nr_zones = dev_capacity_sects >> ilog2(dev->zone_size_sects);
++ if (dev_capacity_sects & (dev->zone_size_sects - 1))
++ dev->nr_zones++;
++
+ dev->zones = kvmalloc_array(dev->nr_zones, sizeof(struct blk_zone),
+ GFP_KERNEL | __GFP_ZERO);
+ if (!dev->zones)
+@@ -37,7 +40,10 @@ int null_zone_init(struct nullb_device *dev)
+ struct blk_zone *zone = &dev->zones[i];
+
+ zone->start = zone->wp = sector;
+- zone->len = dev->zone_size_sects;
++ if (zone->start + dev->zone_size_sects > dev_capacity_sects)
++ zone->len = dev_capacity_sects - zone->start;
++ else
++ zone->len = dev->zone_size_sects;
+ zone->type = BLK_ZONE_TYPE_SEQWRITE_REQ;
+ zone->cond = BLK_ZONE_COND_EMPTY;
+
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index 7ffeb37e8f202..a017322dba82b 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -263,8 +263,12 @@ static int h5_close(struct hci_uart *hu)
+ if (h5->vnd && h5->vnd->close)
+ h5->vnd->close(h5);
+
+- if (!hu->serdev)
+- kfree(h5);
++ if (hu->serdev)
++ serdev_device_close(hu->serdev);
++
++ kfree_skb(h5->rx_skb);
++ kfree(h5);
++ h5 = NULL;
+
+ return 0;
+ }
+diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
+index e3599b43f9eb9..599be2d2b0ae9 100644
+--- a/drivers/md/dm-verity-target.c
++++ b/drivers/md/dm-verity-target.c
+@@ -533,6 +533,15 @@ static int verity_verify_io(struct dm_verity_io *io)
+ return 0;
+ }
+
++/*
++ * Skip verity work in response to I/O error when system is shutting down.
++ */
++static inline bool verity_is_system_shutting_down(void)
++{
++ return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF
++ || system_state == SYSTEM_RESTART;
++}
++
+ /*
+ * End one "io" structure with a given error.
+ */
+@@ -560,7 +569,8 @@ static void verity_end_io(struct bio *bio)
+ {
+ struct dm_verity_io *io = bio->bi_private;
+
+- if (bio->bi_status && !verity_fec_is_enabled(io->v)) {
++ if (bio->bi_status &&
++ (!verity_fec_is_enabled(io->v) || verity_is_system_shutting_down())) {
+ verity_finish_io(io, bio->bi_status);
+ return;
+ }
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 02c5e390f89f3..8e0f936b3e378 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1138,7 +1138,7 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio,
+ struct md_rdev *err_rdev = NULL;
+ gfp_t gfp = GFP_NOIO;
+
+- if (r10_bio->devs[slot].rdev) {
++ if (slot >= 0 && r10_bio->devs[slot].rdev) {
+ /*
+ * This is an error retry, but we cannot
+ * safely dereference the rdev in the r10_bio,
+@@ -1547,6 +1547,7 @@ static void __make_request(struct mddev *mddev, struct bio *bio, int sectors)
+ r10_bio->mddev = mddev;
+ r10_bio->sector = bio->bi_iter.bi_sector;
+ r10_bio->state = 0;
++ r10_bio->read_slot = -1;
+ memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * conf->copies);
+
+ if (bio_data_dir(bio) == READ)
+diff --git a/drivers/media/usb/dvb-usb/gp8psk.c b/drivers/media/usb/dvb-usb/gp8psk.c
+index 13e96b0aeb0fc..d97eab01cb8c7 100644
+--- a/drivers/media/usb/dvb-usb/gp8psk.c
++++ b/drivers/media/usb/dvb-usb/gp8psk.c
+@@ -185,7 +185,7 @@ out_rel_fw:
+
+ static int gp8psk_power_ctrl(struct dvb_usb_device *d, int onoff)
+ {
+- u8 status, buf;
++ u8 status = 0, buf;
+ int gp_product_id = le16_to_cpu(d->udev->descriptor.idProduct);
+
+ if (onoff) {
+diff --git a/drivers/misc/vmw_vmci/vmci_context.c b/drivers/misc/vmw_vmci/vmci_context.c
+index bc089e634a751..26e20b091160a 100644
+--- a/drivers/misc/vmw_vmci/vmci_context.c
++++ b/drivers/misc/vmw_vmci/vmci_context.c
+@@ -751,7 +751,7 @@ static int vmci_ctx_get_chkpt_doorbells(struct vmci_ctx *context,
+ return VMCI_ERROR_MORE_DATA;
+ }
+
+- dbells = kmalloc(data_size, GFP_ATOMIC);
++ dbells = kzalloc(data_size, GFP_ATOMIC);
+ if (!dbells)
+ return VMCI_ERROR_NO_MEM;
+
+diff --git a/drivers/rtc/rtc-sun6i.c b/drivers/rtc/rtc-sun6i.c
+index 2cd5a7b1a2e30..e85abe8056064 100644
+--- a/drivers/rtc/rtc-sun6i.c
++++ b/drivers/rtc/rtc-sun6i.c
+@@ -232,7 +232,7 @@ static void __init sun6i_rtc_clk_init(struct device_node *node)
+ 300000000);
+ if (IS_ERR(rtc->int_osc)) {
+ pr_crit("Couldn't register the internal oscillator\n");
+- return;
++ goto err;
+ }
+
+ parents[0] = clk_hw_get_name(rtc->int_osc);
+@@ -248,7 +248,7 @@ static void __init sun6i_rtc_clk_init(struct device_node *node)
+ rtc->losc = clk_register(NULL, &rtc->hw);
+ if (IS_ERR(rtc->losc)) {
+ pr_crit("Couldn't register the LOSC clock\n");
+- return;
++ goto err_register;
+ }
+
+ of_property_read_string_index(node, "clock-output-names", 1,
+@@ -259,7 +259,7 @@ static void __init sun6i_rtc_clk_init(struct device_node *node)
+ &rtc->lock);
+ if (IS_ERR(rtc->ext_losc)) {
+ pr_crit("Couldn't register the LOSC external gate\n");
+- return;
++ goto err_register;
+ }
+
+ clk_data->num = 2;
+@@ -268,6 +268,8 @@ static void __init sun6i_rtc_clk_init(struct device_node *node)
+ of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ return;
+
++err_register:
++ clk_hw_unregister_fixed_rate(rtc->int_osc);
+ err:
+ kfree(clk_data);
+ }
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 5e23e4aa5b0a3..c48e1d84efb6b 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -118,8 +118,6 @@ static void vfio_pci_probe_mmaps(struct vfio_pci_device *vdev)
+ int bar;
+ struct vfio_pci_dummy_resource *dummy_res;
+
+- INIT_LIST_HEAD(&vdev->dummy_resources_list);
+-
+ for (bar = PCI_STD_RESOURCES; bar <= PCI_STD_RESOURCE_END; bar++) {
+ res = vdev->pdev->resource + bar;
+
+@@ -1522,6 +1520,7 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ mutex_init(&vdev->igate);
+ spin_lock_init(&vdev->irqlock);
+ mutex_init(&vdev->ioeventfds_lock);
++ INIT_LIST_HEAD(&vdev->dummy_resources_list);
+ INIT_LIST_HEAD(&vdev->ioeventfds_list);
+ mutex_init(&vdev->vma_lock);
+ INIT_LIST_HEAD(&vdev->vma_list);
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index 9d8e02cfd4803..3cfbec482efb9 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -842,17 +842,18 @@ struct gntdev_copy_batch {
+ s16 __user *status[GNTDEV_COPY_BATCH];
+ unsigned int nr_ops;
+ unsigned int nr_pages;
++ bool writeable;
+ };
+
+ static int gntdev_get_page(struct gntdev_copy_batch *batch, void __user *virt,
+- bool writeable, unsigned long *gfn)
++ unsigned long *gfn)
+ {
+ unsigned long addr = (unsigned long)virt;
+ struct page *page;
+ unsigned long xen_pfn;
+ int ret;
+
+- ret = get_user_pages_fast(addr, 1, writeable, &page);
++ ret = get_user_pages_fast(addr, 1, batch->writeable, &page);
+ if (ret < 0)
+ return ret;
+
+@@ -868,9 +869,13 @@ static void gntdev_put_pages(struct gntdev_copy_batch *batch)
+ {
+ unsigned int i;
+
+- for (i = 0; i < batch->nr_pages; i++)
++ for (i = 0; i < batch->nr_pages; i++) {
++ if (batch->writeable && !PageDirty(batch->pages[i]))
++ set_page_dirty_lock(batch->pages[i]);
+ put_page(batch->pages[i]);
++ }
+ batch->nr_pages = 0;
++ batch->writeable = false;
+ }
+
+ static int gntdev_copy(struct gntdev_copy_batch *batch)
+@@ -959,8 +964,9 @@ static int gntdev_grant_copy_seg(struct gntdev_copy_batch *batch,
+ virt = seg->source.virt + copied;
+ off = (unsigned long)virt & ~XEN_PAGE_MASK;
+ len = min(len, (size_t)XEN_PAGE_SIZE - off);
++ batch->writeable = false;
+
+- ret = gntdev_get_page(batch, virt, false, &gfn);
++ ret = gntdev_get_page(batch, virt, &gfn);
+ if (ret < 0)
+ return ret;
+
+@@ -978,8 +984,9 @@ static int gntdev_grant_copy_seg(struct gntdev_copy_batch *batch,
+ virt = seg->dest.virt + copied;
+ off = (unsigned long)virt & ~XEN_PAGE_MASK;
+ len = min(len, (size_t)XEN_PAGE_SIZE - off);
++ batch->writeable = true;
+
+- ret = gntdev_get_page(batch, virt, true, &gfn);
++ ret = gntdev_get_page(batch, virt, &gfn);
+ if (ret < 0)
+ return ret;
+
+diff --git a/fs/crypto/hooks.c b/fs/crypto/hooks.c
+index 042d5b44f4ed9..aa86cb2db8236 100644
+--- a/fs/crypto/hooks.c
++++ b/fs/crypto/hooks.c
+@@ -58,8 +58,8 @@ int __fscrypt_prepare_link(struct inode *inode, struct inode *dir,
+ if (err)
+ return err;
+
+- /* ... in case we looked up ciphertext name before key was added */
+- if (dentry->d_flags & DCACHE_ENCRYPTED_NAME)
++ /* ... in case we looked up no-key name before key was added */
++ if (fscrypt_is_nokey_name(dentry))
+ return -ENOKEY;
+
+ if (!fscrypt_has_permitted_context(dir, inode))
+@@ -83,9 +83,9 @@ int __fscrypt_prepare_rename(struct inode *old_dir, struct dentry *old_dentry,
+ if (err)
+ return err;
+
+- /* ... in case we looked up ciphertext name(s) before key was added */
+- if ((old_dentry->d_flags | new_dentry->d_flags) &
+- DCACHE_ENCRYPTED_NAME)
++ /* ... in case we looked up no-key name(s) before key was added */
++ if (fscrypt_is_nokey_name(old_dentry) ||
++ fscrypt_is_nokey_name(new_dentry))
+ return -ENOKEY;
+
+ if (old_dir != new_dir) {
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 4191552880bd7..3c238006870d3 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2106,6 +2106,9 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ if (!dentry->d_name.len)
+ return -EINVAL;
+
++ if (fscrypt_is_nokey_name(dentry))
++ return -ENOKEY;
++
+ retval = ext4_fname_setup_filename(dir, &dentry->d_name, 0, &fname);
+ if (retval)
+ return retval;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index ee96f504ed782..e9e9f09f5370d 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -454,19 +454,17 @@ static bool system_going_down(void)
+
+ static void ext4_handle_error(struct super_block *sb)
+ {
++ journal_t *journal = EXT4_SB(sb)->s_journal;
++
+ if (test_opt(sb, WARN_ON_ERROR))
+ WARN_ON_ONCE(1);
+
+- if (sb_rdonly(sb))
++ if (sb_rdonly(sb) || test_opt(sb, ERRORS_CONT))
+ return;
+
+- if (!test_opt(sb, ERRORS_CONT)) {
+- journal_t *journal = EXT4_SB(sb)->s_journal;
+-
+- EXT4_SB(sb)->s_mount_flags |= EXT4_MF_FS_ABORTED;
+- if (journal)
+- jbd2_journal_abort(journal, -EIO);
+- }
++ EXT4_SB(sb)->s_mount_flags |= EXT4_MF_FS_ABORTED;
++ if (journal)
++ jbd2_journal_abort(journal, -EIO);
+ /*
+ * We force ERRORS_RO behavior when system is rebooting. Otherwise we
+ * could panic during 'reboot -f' as the underlying device got already
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 53ffa6fe207a3..aacd8e11758ca 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -2857,6 +2857,8 @@ bool f2fs_empty_dir(struct inode *dir);
+
+ static inline int f2fs_add_link(struct dentry *dentry, struct inode *inode)
+ {
++ if (fscrypt_is_nokey_name(dentry))
++ return -ENOKEY;
+ return f2fs_do_add_link(d_inode(dentry->d_parent), &dentry->d_name,
+ inode, inode->i_ino, inode->i_mode);
+ }
+diff --git a/fs/fcntl.c b/fs/fcntl.c
+index 4137d96534a6c..e039af1872ab2 100644
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -779,9 +779,10 @@ void send_sigio(struct fown_struct *fown, int fd, int band)
+ {
+ struct task_struct *p;
+ enum pid_type type;
++ unsigned long flags;
+ struct pid *pid;
+
+- read_lock(&fown->lock);
++ read_lock_irqsave(&fown->lock, flags);
+
+ type = fown->pid_type;
+ pid = fown->pid;
+@@ -802,7 +803,7 @@ void send_sigio(struct fown_struct *fown, int fd, int band)
+ read_unlock(&tasklist_lock);
+ }
+ out_unlock_fown:
+- read_unlock(&fown->lock);
++ read_unlock_irqrestore(&fown->lock, flags);
+ }
+
+ static void send_sigurg_to_task(struct task_struct *p,
+@@ -817,9 +818,10 @@ int send_sigurg(struct fown_struct *fown)
+ struct task_struct *p;
+ enum pid_type type;
+ struct pid *pid;
++ unsigned long flags;
+ int ret = 0;
+
+- read_lock(&fown->lock);
++ read_lock_irqsave(&fown->lock, flags);
+
+ type = fown->pid_type;
+ pid = fown->pid;
+@@ -842,7 +844,7 @@ int send_sigurg(struct fown_struct *fown)
+ read_unlock(&tasklist_lock);
+ }
+ out_unlock_fown:
+- read_unlock(&fown->lock);
++ read_unlock_irqrestore(&fown->lock, flags);
+ return ret;
+ }
+
+diff --git a/fs/nfs/nfs4super.c b/fs/nfs/nfs4super.c
+index 6fb7cb6b3f4b0..e7a10f5f54057 100644
+--- a/fs/nfs/nfs4super.c
++++ b/fs/nfs/nfs4super.c
+@@ -95,7 +95,7 @@ static void nfs4_evict_inode(struct inode *inode)
+ nfs_inode_return_delegation_noreclaim(inode);
+ /* Note that above delegreturn would trigger pnfs return-on-close */
+ pnfs_return_layout(inode);
+- pnfs_destroy_layout(NFS_I(inode));
++ pnfs_destroy_layout_final(NFS_I(inode));
+ /* First call standard NFS clear_inode() code */
+ nfs_clear_inode(inode);
+ }
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 2b9e139a29975..a253384a4710b 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -294,6 +294,7 @@ void
+ pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo)
+ {
+ struct inode *inode;
++ unsigned long i_state;
+
+ if (!lo)
+ return;
+@@ -304,8 +305,12 @@ pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo)
+ if (!list_empty(&lo->plh_segs))
+ WARN_ONCE(1, "NFS: BUG unfreed layout segments.\n");
+ pnfs_detach_layout_hdr(lo);
++ i_state = inode->i_state;
+ spin_unlock(&inode->i_lock);
+ pnfs_free_layout_hdr(lo);
++ /* Notify pnfs_destroy_layout_final() that we're done */
++ if (i_state & (I_FREEING | I_CLEAR))
++ wake_up_var(lo);
+ }
+ }
+
+@@ -713,8 +718,7 @@ pnfs_free_lseg_list(struct list_head *free_me)
+ }
+ }
+
+-void
+-pnfs_destroy_layout(struct nfs_inode *nfsi)
++static struct pnfs_layout_hdr *__pnfs_destroy_layout(struct nfs_inode *nfsi)
+ {
+ struct pnfs_layout_hdr *lo;
+ LIST_HEAD(tmp_list);
+@@ -732,9 +736,34 @@ pnfs_destroy_layout(struct nfs_inode *nfsi)
+ pnfs_put_layout_hdr(lo);
+ } else
+ spin_unlock(&nfsi->vfs_inode.i_lock);
++ return lo;
++}
++
++void pnfs_destroy_layout(struct nfs_inode *nfsi)
++{
++ __pnfs_destroy_layout(nfsi);
+ }
+ EXPORT_SYMBOL_GPL(pnfs_destroy_layout);
+
++static bool pnfs_layout_removed(struct nfs_inode *nfsi,
++ struct pnfs_layout_hdr *lo)
++{
++ bool ret;
++
++ spin_lock(&nfsi->vfs_inode.i_lock);
++ ret = nfsi->layout != lo;
++ spin_unlock(&nfsi->vfs_inode.i_lock);
++ return ret;
++}
++
++void pnfs_destroy_layout_final(struct nfs_inode *nfsi)
++{
++ struct pnfs_layout_hdr *lo = __pnfs_destroy_layout(nfsi);
++
++ if (lo)
++ wait_var_event(lo, pnfs_layout_removed(nfsi, lo));
++}
++
+ static bool
+ pnfs_layout_add_bulk_destroy_list(struct inode *inode,
+ struct list_head *layout_list)
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 3ba44819a88ae..80fafa29e567a 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -254,6 +254,7 @@ struct pnfs_layout_segment *pnfs_layout_process(struct nfs4_layoutget *lgp);
+ void pnfs_layoutget_free(struct nfs4_layoutget *lgp);
+ void pnfs_free_lseg_list(struct list_head *tmp_list);
+ void pnfs_destroy_layout(struct nfs_inode *);
++void pnfs_destroy_layout_final(struct nfs_inode *);
+ void pnfs_destroy_all_layouts(struct nfs_client *);
+ int pnfs_destroy_layouts_byfsid(struct nfs_client *clp,
+ struct nfs_fsid *fsid,
+@@ -645,6 +646,10 @@ static inline void pnfs_destroy_layout(struct nfs_inode *nfsi)
+ {
+ }
+
++static inline void pnfs_destroy_layout_final(struct nfs_inode *nfsi)
++{
++}
++
+ static inline struct pnfs_layout_segment *
+ pnfs_get_lseg(struct pnfs_layout_segment *lseg)
+ {
+diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c
+index bb3f59bcfcf5b..656f9ff63edda 100644
+--- a/fs/quota/quota_tree.c
++++ b/fs/quota/quota_tree.c
+@@ -61,7 +61,7 @@ static ssize_t read_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf)
+
+ memset(buf, 0, info->dqi_usable_bs);
+ return sb->s_op->quota_read(sb, info->dqi_type, buf,
+- info->dqi_usable_bs, blk << info->dqi_blocksize_bits);
++ info->dqi_usable_bs, (loff_t)blk << info->dqi_blocksize_bits);
+ }
+
+ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf)
+@@ -70,7 +70,7 @@ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf)
+ ssize_t ret;
+
+ ret = sb->s_op->quota_write(sb, info->dqi_type, buf,
+- info->dqi_usable_bs, blk << info->dqi_blocksize_bits);
++ info->dqi_usable_bs, (loff_t)blk << info->dqi_blocksize_bits);
+ if (ret != info->dqi_usable_bs) {
+ quota_error(sb, "dquota write failed");
+ if (ret >= 0)
+@@ -283,7 +283,7 @@ static uint find_free_dqentry(struct qtree_mem_dqinfo *info,
+ blk);
+ goto out_buf;
+ }
+- dquot->dq_off = (blk << info->dqi_blocksize_bits) +
++ dquot->dq_off = ((loff_t)blk << info->dqi_blocksize_bits) +
+ sizeof(struct qt_disk_dqdbheader) +
+ i * info->dqi_entry_size;
+ kfree(buf);
+@@ -558,7 +558,7 @@ static loff_t find_block_dqentry(struct qtree_mem_dqinfo *info,
+ ret = -EIO;
+ goto out_buf;
+ } else {
+- ret = (blk << info->dqi_blocksize_bits) + sizeof(struct
++ ret = ((loff_t)blk << info->dqi_blocksize_bits) + sizeof(struct
+ qt_disk_dqdbheader) + i * info->dqi_entry_size;
+ }
+ out_buf:
+diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
+index 2946713cb00d6..5229038852ca1 100644
+--- a/fs/reiserfs/stree.c
++++ b/fs/reiserfs/stree.c
+@@ -454,6 +454,12 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh)
+ "(second one): %h", ih);
+ return 0;
+ }
++ if (is_direntry_le_ih(ih) && (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE))) {
++ reiserfs_warning(NULL, "reiserfs-5093",
++ "item entry count seems wrong %h",
++ ih);
++ return 0;
++ }
+ prev_location = ih_location(ih);
+ }
+
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index 10aab5dccaee4..8fe2ee5462a0b 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -290,6 +290,15 @@ done:
+ return d_splice_alias(inode, dentry);
+ }
+
++static int ubifs_prepare_create(struct inode *dir, struct dentry *dentry,
++ struct fscrypt_name *nm)
++{
++ if (fscrypt_is_nokey_name(dentry))
++ return -ENOKEY;
++
++ return fscrypt_setup_filename(dir, &dentry->d_name, 0, nm);
++}
++
+ static int ubifs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
+ bool excl)
+ {
+@@ -313,7 +322,7 @@ static int ubifs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
+ if (err)
+ return err;
+
+- err = fscrypt_setup_filename(dir, &dentry->d_name, 0, &nm);
++ err = ubifs_prepare_create(dir, dentry, &nm);
+ if (err)
+ goto out_budg;
+
+@@ -977,7 +986,7 @@ static int ubifs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+ if (err)
+ return err;
+
+- err = fscrypt_setup_filename(dir, &dentry->d_name, 0, &nm);
++ err = ubifs_prepare_create(dir, dentry, &nm);
+ if (err)
+ goto out_budg;
+
+@@ -1062,7 +1071,7 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry,
+ return err;
+ }
+
+- err = fscrypt_setup_filename(dir, &dentry->d_name, 0, &nm);
++ err = ubifs_prepare_create(dir, dentry, &nm);
+ if (err) {
+ kfree(dev);
+ goto out_budg;
+@@ -1146,7 +1155,7 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry,
+ if (err)
+ return err;
+
+- err = fscrypt_setup_filename(dir, &dentry->d_name, 0, &nm);
++ err = ubifs_prepare_create(dir, dentry, &nm);
+ if (err)
+ goto out_budg;
+
+diff --git a/include/linux/fscrypt_notsupp.h b/include/linux/fscrypt_notsupp.h
+index 24b261e49dc14..93304cfeb6016 100644
+--- a/include/linux/fscrypt_notsupp.h
++++ b/include/linux/fscrypt_notsupp.h
+@@ -24,6 +24,11 @@ static inline bool fscrypt_dummy_context_enabled(struct inode *inode)
+ return false;
+ }
+
++static inline bool fscrypt_is_nokey_name(const struct dentry *dentry)
++{
++ return false;
++}
++
+ /* crypto.c */
+ static inline void fscrypt_enqueue_decrypt_work(struct work_struct *work)
+ {
+diff --git a/include/linux/fscrypt_supp.h b/include/linux/fscrypt_supp.h
+index 8641e20694ce9..0409c14ae1de4 100644
+--- a/include/linux/fscrypt_supp.h
++++ b/include/linux/fscrypt_supp.h
+@@ -58,6 +58,35 @@ static inline bool fscrypt_dummy_context_enabled(struct inode *inode)
+ inode->i_sb->s_cop->dummy_context(inode);
+ }
+
++/**
++ * fscrypt_is_nokey_name() - test whether a dentry is a no-key name
++ * @dentry: the dentry to check
++ *
++ * This returns true if the dentry is a no-key dentry. A no-key dentry is a
++ * dentry that was created in an encrypted directory that hasn't had its
++ * encryption key added yet. Such dentries may be either positive or negative.
++ *
++ * When a filesystem is asked to create a new filename in an encrypted directory
++ * and the new filename's dentry is a no-key dentry, it must fail the operation
++ * with ENOKEY. This includes ->create(), ->mkdir(), ->mknod(), ->symlink(),
++ * ->rename(), and ->link(). (However, ->rename() and ->link() are already
++ * handled by fscrypt_prepare_rename() and fscrypt_prepare_link().)
++ *
++ * This is necessary because creating a filename requires the directory's
++ * encryption key, but just checking for the key on the directory inode during
++ * the final filesystem operation doesn't guarantee that the key was available
++ * during the preceding dentry lookup. And the key must have already been
++ * available during the dentry lookup in order for it to have been checked
++ * whether the filename already exists in the directory and for the new file's
++ * dentry not to be invalidated due to it incorrectly having the no-key flag.
++ *
++ * Return: %true if the dentry is a no-key name
++ */
++static inline bool fscrypt_is_nokey_name(const struct dentry *dentry)
++{
++ return dentry->d_flags & DCACHE_ENCRYPTED_NAME;
++}
++
+ /* crypto.c */
+ extern void fscrypt_enqueue_decrypt_work(struct work_struct *);
+ extern struct fscrypt_ctx *fscrypt_get_ctx(const struct inode *, gfp_t);
+diff --git a/include/linux/of.h b/include/linux/of.h
+index d4f14b0302b63..6429f00341d14 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -1258,6 +1258,7 @@ static inline int of_get_available_child_count(const struct device_node *np)
+ #define _OF_DECLARE(table, name, compat, fn, fn_type) \
+ static const struct of_device_id __of_table_##name \
+ __used __section(__##table##_of_table) \
++ __aligned(__alignof__(struct of_device_id)) \
+ = { .compatible = compat, \
+ .data = (fn == (fn_type)NULL) ? fn : fn }
+ #else
+diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h
+index 5ed721ad5b198..af2a44c08683d 100644
+--- a/include/uapi/linux/const.h
++++ b/include/uapi/linux/const.h
+@@ -28,4 +28,9 @@
+ #define _BITUL(x) (_UL(1) << (x))
+ #define _BITULL(x) (_ULL(1) << (x))
+
++#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
++#define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask))
++
++#define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
++
+ #endif /* _UAPI_LINUX_CONST_H */
+diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
+index dc69391d2bbae..fc21d3726b591 100644
+--- a/include/uapi/linux/ethtool.h
++++ b/include/uapi/linux/ethtool.h
+@@ -14,7 +14,7 @@
+ #ifndef _UAPI_LINUX_ETHTOOL_H
+ #define _UAPI_LINUX_ETHTOOL_H
+
+-#include <linux/kernel.h>
++#include <linux/const.h>
+ #include <linux/types.h>
+ #include <linux/if_ether.h>
+
+diff --git a/include/uapi/linux/kernel.h b/include/uapi/linux/kernel.h
+index 0ff8f7477847c..fadf2db71fe8a 100644
+--- a/include/uapi/linux/kernel.h
++++ b/include/uapi/linux/kernel.h
+@@ -3,13 +3,6 @@
+ #define _UAPI_LINUX_KERNEL_H
+
+ #include <linux/sysinfo.h>
+-
+-/*
+- * 'kernel.h' contains some often-used function prototypes etc
+- */
+-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
+-#define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask))
+-
+-#define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
++#include <linux/const.h>
+
+ #endif /* _UAPI_LINUX_KERNEL_H */
+diff --git a/include/uapi/linux/lightnvm.h b/include/uapi/linux/lightnvm.h
+index f9a1be7fc6962..ead2e72e5c88e 100644
+--- a/include/uapi/linux/lightnvm.h
++++ b/include/uapi/linux/lightnvm.h
+@@ -21,7 +21,7 @@
+ #define _UAPI_LINUX_LIGHTNVM_H
+
+ #ifdef __KERNEL__
+-#include <linux/kernel.h>
++#include <linux/const.h>
+ #include <linux/ioctl.h>
+ #else /* __KERNEL__ */
+ #include <stdio.h>
+diff --git a/include/uapi/linux/mroute6.h b/include/uapi/linux/mroute6.h
+index 9999cc006390d..1617eb9949a5d 100644
+--- a/include/uapi/linux/mroute6.h
++++ b/include/uapi/linux/mroute6.h
+@@ -2,7 +2,7 @@
+ #ifndef _UAPI__LINUX_MROUTE6_H
+ #define _UAPI__LINUX_MROUTE6_H
+
+-#include <linux/kernel.h>
++#include <linux/const.h>
+ #include <linux/types.h>
+ #include <linux/sockios.h>
+ #include <linux/in6.h> /* For struct sockaddr_in6. */
+diff --git a/include/uapi/linux/netfilter/x_tables.h b/include/uapi/linux/netfilter/x_tables.h
+index a8283f7dbc519..b8c6bb233ac1c 100644
+--- a/include/uapi/linux/netfilter/x_tables.h
++++ b/include/uapi/linux/netfilter/x_tables.h
+@@ -1,7 +1,7 @@
+ /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+ #ifndef _UAPI_X_TABLES_H
+ #define _UAPI_X_TABLES_H
+-#include <linux/kernel.h>
++#include <linux/const.h>
+ #include <linux/types.h>
+
+ #define XT_FUNCTION_MAXNAMELEN 30
+diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h
+index 776bc92e91180..3481cde43a841 100644
+--- a/include/uapi/linux/netlink.h
++++ b/include/uapi/linux/netlink.h
+@@ -2,7 +2,7 @@
+ #ifndef _UAPI__LINUX_NETLINK_H
+ #define _UAPI__LINUX_NETLINK_H
+
+-#include <linux/kernel.h>
++#include <linux/const.h>
+ #include <linux/socket.h> /* for __kernel_sa_family_t */
+ #include <linux/types.h>
+
+diff --git a/include/uapi/linux/sysctl.h b/include/uapi/linux/sysctl.h
+index d71013fffaf65..d3393a6571ba3 100644
+--- a/include/uapi/linux/sysctl.h
++++ b/include/uapi/linux/sysctl.h
+@@ -23,7 +23,7 @@
+ #ifndef _UAPI_LINUX_SYSCTL_H
+ #define _UAPI_LINUX_SYSCTL_H
+
+-#include <linux/kernel.h>
++#include <linux/const.h>
+ #include <linux/types.h>
+ #include <linux/compiler.h>
+
+diff --git a/kernel/module.c b/kernel/module.c
+index d05e1bfdd3559..429769605871d 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1806,7 +1806,6 @@ static int mod_sysfs_init(struct module *mod)
+ if (err)
+ mod_kobject_put(mod);
+
+- /* delay uevent until full sysfs population */
+ out:
+ return err;
+ }
+@@ -1843,7 +1842,6 @@ static int mod_sysfs_setup(struct module *mod,
+ add_sect_attrs(mod, info);
+ add_notes_attrs(mod, info);
+
+- kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD);
+ return 0;
+
+ out_unreg_modinfo_attrs:
+@@ -3499,6 +3497,9 @@ static noinline int do_init_module(struct module *mod)
+ blocking_notifier_call_chain(&module_notify_list,
+ MODULE_STATE_LIVE, mod);
+
++ /* Delay uevent until module has finished its init routine */
++ kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD);
++
+ /*
+ * We need to finish all async code before the module init sequence
+ * is done. This has potential to deadlock. For example, a newly
+@@ -3841,6 +3842,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
+ MODULE_STATE_GOING, mod);
+ klp_module_going(mod);
+ bug_cleanup:
++ mod->state = MODULE_STATE_GOING;
+ /* module_bug_cleanup needs module_mutex protection */
+ mutex_lock(&module_mutex);
+ module_bug_cleanup(mod);
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 7c12b0deb4eb5..db62dbe7eaa8a 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -753,8 +753,13 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
+ runtime->boundary *= 2;
+
+ /* clear the buffer for avoiding possible kernel info leaks */
+- if (runtime->dma_area && !substream->ops->copy_user)
+- memset(runtime->dma_area, 0, runtime->dma_bytes);
++ if (runtime->dma_area && !substream->ops->copy_user) {
++ size_t size = runtime->dma_bytes;
++
++ if (runtime->info & SNDRV_PCM_INFO_MMAP)
++ size = PAGE_ALIGN(size);
++ memset(runtime->dma_area, 0, size);
++ }
+
+ snd_pcm_timer_resolution_change(substream);
+ snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP);
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index 9b26973fe697a..f4f855d7a7910 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -87,11 +87,21 @@ static inline unsigned short snd_rawmidi_file_flags(struct file *file)
+ }
+ }
+
+-static inline int snd_rawmidi_ready(struct snd_rawmidi_substream *substream)
++static inline bool __snd_rawmidi_ready(struct snd_rawmidi_runtime *runtime)
++{
++ return runtime->avail >= runtime->avail_min;
++}
++
++static bool snd_rawmidi_ready(struct snd_rawmidi_substream *substream)
+ {
+ struct snd_rawmidi_runtime *runtime = substream->runtime;
++ unsigned long flags;
++ bool ready;
+
+- return runtime->avail >= runtime->avail_min;
++ spin_lock_irqsave(&runtime->lock, flags);
++ ready = __snd_rawmidi_ready(runtime);
++ spin_unlock_irqrestore(&runtime->lock, flags);
++ return ready;
+ }
+
+ static inline int snd_rawmidi_ready_append(struct snd_rawmidi_substream *substream,
+@@ -960,7 +970,7 @@ int snd_rawmidi_receive(struct snd_rawmidi_substream *substream,
+ if (result > 0) {
+ if (runtime->event)
+ schedule_work(&runtime->event_work);
+- else if (snd_rawmidi_ready(substream))
++ else if (__snd_rawmidi_ready(runtime))
+ wake_up(&runtime->sleep);
+ }
+ spin_unlock_irqrestore(&runtime->lock, flags);
+@@ -1039,7 +1049,7 @@ static ssize_t snd_rawmidi_read(struct file *file, char __user *buf, size_t coun
+ result = 0;
+ while (count > 0) {
+ spin_lock_irq(&runtime->lock);
+- while (!snd_rawmidi_ready(substream)) {
++ while (!__snd_rawmidi_ready(runtime)) {
+ wait_queue_entry_t wait;
+
+ if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
+@@ -1056,9 +1066,11 @@ static ssize_t snd_rawmidi_read(struct file *file, char __user *buf, size_t coun
+ return -ENODEV;
+ if (signal_pending(current))
+ return result > 0 ? result : -ERESTARTSYS;
+- if (!runtime->avail)
+- return result > 0 ? result : -EIO;
+ spin_lock_irq(&runtime->lock);
++ if (!runtime->avail) {
++ spin_unlock_irq(&runtime->lock);
++ return result > 0 ? result : -EIO;
++ }
+ }
+ spin_unlock_irq(&runtime->lock);
+ count1 = snd_rawmidi_kernel_read1(substream,
+@@ -1196,7 +1208,7 @@ int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int coun
+ runtime->avail += count;
+ substream->bytes += count;
+ if (count > 0) {
+- if (runtime->drain || snd_rawmidi_ready(substream))
++ if (runtime->drain || __snd_rawmidi_ready(runtime))
+ wake_up(&runtime->sleep);
+ }
+ return count;
+@@ -1363,9 +1375,11 @@ static ssize_t snd_rawmidi_write(struct file *file, const char __user *buf,
+ return -ENODEV;
+ if (signal_pending(current))
+ return result > 0 ? result : -ERESTARTSYS;
+- if (!runtime->avail && !timeout)
+- return result > 0 ? result : -EIO;
+ spin_lock_irq(&runtime->lock);
++ if (!runtime->avail && !timeout) {
++ spin_unlock_irq(&runtime->lock);
++ return result > 0 ? result : -EIO;
++ }
+ }
+ spin_unlock_irq(&runtime->lock);
+ count1 = snd_rawmidi_kernel_write1(substream, buf, NULL, count);
+@@ -1445,6 +1459,7 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry,
+ struct snd_rawmidi *rmidi;
+ struct snd_rawmidi_substream *substream;
+ struct snd_rawmidi_runtime *runtime;
++ unsigned long buffer_size, avail, xruns;
+
+ rmidi = entry->private_data;
+ snd_iprintf(buffer, "%s\n\n", rmidi->name);
+@@ -1463,13 +1478,16 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry,
+ " Owner PID : %d\n",
+ pid_vnr(substream->pid));
+ runtime = substream->runtime;
++ spin_lock_irq(&runtime->lock);
++ buffer_size = runtime->buffer_size;
++ avail = runtime->avail;
++ spin_unlock_irq(&runtime->lock);
+ snd_iprintf(buffer,
+ " Mode : %s\n"
+ " Buffer size : %lu\n"
+ " Avail : %lu\n",
+ runtime->oss ? "OSS compatible" : "native",
+- (unsigned long) runtime->buffer_size,
+- (unsigned long) runtime->avail);
++ buffer_size, avail);
+ }
+ }
+ }
+@@ -1487,13 +1505,16 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry,
+ " Owner PID : %d\n",
+ pid_vnr(substream->pid));
+ runtime = substream->runtime;
++ spin_lock_irq(&runtime->lock);
++ buffer_size = runtime->buffer_size;
++ avail = runtime->avail;
++ xruns = runtime->xruns;
++ spin_unlock_irq(&runtime->lock);
+ snd_iprintf(buffer,
+ " Buffer size : %lu\n"
+ " Avail : %lu\n"
+ " Overruns : %lu\n",
+- (unsigned long) runtime->buffer_size,
+- (unsigned long) runtime->avail,
+- (unsigned long) runtime->xruns);
++ buffer_size, avail, xruns);
+ }
+ }
+ }
+diff --git a/sound/core/seq/seq_queue.h b/sound/core/seq/seq_queue.h
+index e006fc8e3a366..6b634cfb42ed0 100644
+--- a/sound/core/seq/seq_queue.h
++++ b/sound/core/seq/seq_queue.h
+@@ -40,10 +40,10 @@ struct snd_seq_queue {
+
+ struct snd_seq_timer *timer; /* time keeper for this queue */
+ int owner; /* client that 'owns' the timer */
+- unsigned int locked:1, /* timer is only accesibble by owner if set */
+- klocked:1, /* kernel lock (after START) */
+- check_again:1,
+- check_blocked:1;
++ bool locked; /* timer is only accesibble by owner if set */
++ bool klocked; /* kernel lock (after START) */
++ bool check_again; /* concurrent access happened during check */
++ bool check_blocked; /* queue being checked */
+
+ unsigned int flags; /* status flags */
+ unsigned int info_flags; /* info for sync */
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-01-09 12:57 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-01-09 12:57 UTC (permalink / raw
To: gentoo-commits
commit: fb15465028f43ee8584e5f9266ef526627711142
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Jan 9 12:56:53 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Jan 9 12:56:53 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=fb154650
Linux patch 4.19.166
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1165_linux-4.19.166.patch | 231 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 235 insertions(+)
diff --git a/0000_README b/0000_README
index 8c285e2..551b30e 100644
--- a/0000_README
+++ b/0000_README
@@ -699,6 +699,10 @@ Patch: 1164_linux-4.19.165.patch
From: https://www.kernel.org
Desc: Linux 4.19.165
+Patch: 1165_linux-4.19.166.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.166
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1165_linux-4.19.166.patch b/1165_linux-4.19.166.patch
new file mode 100644
index 0000000..632c738
--- /dev/null
+++ b/1165_linux-4.19.166.patch
@@ -0,0 +1,231 @@
+diff --git a/Makefile b/Makefile
+index e636c21432951..b2c939f289c25 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 165
++SUBLEVEL = 166
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index 86427f6ba78cb..c52718b37f8fd 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1683,9 +1683,11 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,
+ dma_cap_zero(mask);
+ dma_cap_set(DMA_SLAVE, mask);
+
+- atslave = kzalloc(sizeof(*atslave), GFP_KERNEL);
+- if (!atslave)
++ atslave = kmalloc(sizeof(*atslave), GFP_KERNEL);
++ if (!atslave) {
++ put_device(&dmac_pdev->dev);
+ return NULL;
++ }
+
+ atslave->cfg = ATC_DST_H2SEL_HW | ATC_SRC_H2SEL_HW;
+ /*
+@@ -1714,8 +1716,11 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,
+ atslave->dma_dev = &dmac_pdev->dev;
+
+ chan = dma_request_channel(mask, at_dma_filter, atslave);
+- if (!chan)
++ if (!chan) {
++ put_device(&dmac_pdev->dev);
++ kfree(atslave);
+ return NULL;
++ }
+
+ atchan = to_at_dma_chan(chan);
+ atchan->per_if = dma_spec->args[0] & 0xff;
+diff --git a/drivers/iio/imu/bmi160/bmi160_core.c b/drivers/iio/imu/bmi160/bmi160_core.c
+index e95d817c83905..1e413bb233ae3 100644
+--- a/drivers/iio/imu/bmi160/bmi160_core.c
++++ b/drivers/iio/imu/bmi160/bmi160_core.c
+@@ -110,6 +110,13 @@ enum bmi160_sensor_type {
+
+ struct bmi160_data {
+ struct regmap *regmap;
++ /*
++ * Ensure natural alignment for timestamp if present.
++ * Max length needed: 2 * 3 channels + 4 bytes padding + 8 byte ts.
++ * If fewer channels are enabled, less space may be needed, as
++ * long as the timestamp is still aligned to 8 bytes.
++ */
++ __le16 buf[12] __aligned(8);
+ };
+
+ const struct regmap_config bmi160_regmap_config = {
+@@ -385,8 +392,6 @@ static irqreturn_t bmi160_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct bmi160_data *data = iio_priv(indio_dev);
+- __le16 buf[12];
+- /* 2 sens x 3 axis x __le16 + 2 x __le16 pad + 4 x __le16 tstamp */
+ int i, ret, j = 0, base = BMI160_REG_DATA_MAGN_XOUT_L;
+ __le16 sample;
+
+@@ -396,10 +401,10 @@ static irqreturn_t bmi160_trigger_handler(int irq, void *p)
+ &sample, sizeof(sample));
+ if (ret < 0)
+ goto done;
+- buf[j++] = sample;
++ data->buf[j++] = sample;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buf,
++ iio_push_to_buffers_with_timestamp(indio_dev, data->buf,
+ iio_get_time_ns(indio_dev));
+ done:
+ iio_trigger_notify_done(indio_dev->trig);
+diff --git a/drivers/iio/magnetometer/mag3110.c b/drivers/iio/magnetometer/mag3110.c
+index f063355480bae..57fbe5bfe8837 100644
+--- a/drivers/iio/magnetometer/mag3110.c
++++ b/drivers/iio/magnetometer/mag3110.c
+@@ -56,6 +56,12 @@ struct mag3110_data {
+ struct mutex lock;
+ u8 ctrl_reg1;
+ int sleep_val;
++ /* Ensure natural alignment of timestamp */
++ struct {
++ __be16 channels[3];
++ u8 temperature;
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ static int mag3110_request(struct mag3110_data *data)
+@@ -387,10 +393,9 @@ static irqreturn_t mag3110_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct mag3110_data *data = iio_priv(indio_dev);
+- u8 buffer[16]; /* 3 16-bit channels + 1 byte temp + padding + ts */
+ int ret;
+
+- ret = mag3110_read(data, (__be16 *) buffer);
++ ret = mag3110_read(data, data->scan.channels);
+ if (ret < 0)
+ goto done;
+
+@@ -399,10 +404,10 @@ static irqreturn_t mag3110_trigger_handler(int irq, void *p)
+ MAG3110_DIE_TEMP);
+ if (ret < 0)
+ goto done;
+- buffer[6] = ret;
++ data->scan.temperature = ret;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ iio_get_time_ns(indio_dev));
+
+ done:
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index 83954f424d413..1d61ae7aaa66c 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -378,10 +378,6 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand,
+ }
+ }
+
+- if (req->ooblen)
+- memcpy(req->oobbuf.in, spinand->oobbuf + req->ooboffs,
+- req->ooblen);
+-
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
+index d87aeff70cefb..c2cb1e711c06e 100644
+--- a/drivers/net/wireless/marvell/mwifiex/join.c
++++ b/drivers/net/wireless/marvell/mwifiex/join.c
+@@ -877,6 +877,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
+
+ memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);
+
++ if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN)
++ req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN;
+ memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);
+
+ mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",
+diff --git a/include/linux/kdev_t.h b/include/linux/kdev_t.h
+index 85b5151911cfd..4856706fbfeb4 100644
+--- a/include/linux/kdev_t.h
++++ b/include/linux/kdev_t.h
+@@ -21,61 +21,61 @@
+ })
+
+ /* acceptable for old filesystems */
+-static inline bool old_valid_dev(dev_t dev)
++static __always_inline bool old_valid_dev(dev_t dev)
+ {
+ return MAJOR(dev) < 256 && MINOR(dev) < 256;
+ }
+
+-static inline u16 old_encode_dev(dev_t dev)
++static __always_inline u16 old_encode_dev(dev_t dev)
+ {
+ return (MAJOR(dev) << 8) | MINOR(dev);
+ }
+
+-static inline dev_t old_decode_dev(u16 val)
++static __always_inline dev_t old_decode_dev(u16 val)
+ {
+ return MKDEV((val >> 8) & 255, val & 255);
+ }
+
+-static inline u32 new_encode_dev(dev_t dev)
++static __always_inline u32 new_encode_dev(dev_t dev)
+ {
+ unsigned major = MAJOR(dev);
+ unsigned minor = MINOR(dev);
+ return (minor & 0xff) | (major << 8) | ((minor & ~0xff) << 12);
+ }
+
+-static inline dev_t new_decode_dev(u32 dev)
++static __always_inline dev_t new_decode_dev(u32 dev)
+ {
+ unsigned major = (dev & 0xfff00) >> 8;
+ unsigned minor = (dev & 0xff) | ((dev >> 12) & 0xfff00);
+ return MKDEV(major, minor);
+ }
+
+-static inline u64 huge_encode_dev(dev_t dev)
++static __always_inline u64 huge_encode_dev(dev_t dev)
+ {
+ return new_encode_dev(dev);
+ }
+
+-static inline dev_t huge_decode_dev(u64 dev)
++static __always_inline dev_t huge_decode_dev(u64 dev)
+ {
+ return new_decode_dev(dev);
+ }
+
+-static inline int sysv_valid_dev(dev_t dev)
++static __always_inline int sysv_valid_dev(dev_t dev)
+ {
+ return MAJOR(dev) < (1<<14) && MINOR(dev) < (1<<18);
+ }
+
+-static inline u32 sysv_encode_dev(dev_t dev)
++static __always_inline u32 sysv_encode_dev(dev_t dev)
+ {
+ return MINOR(dev) | (MAJOR(dev) << 18);
+ }
+
+-static inline unsigned sysv_major(u32 dev)
++static __always_inline unsigned sysv_major(u32 dev)
+ {
+ return (dev >> 18) & 0x3fff;
+ }
+
+-static inline unsigned sysv_minor(u32 dev)
++static __always_inline unsigned sysv_minor(u32 dev)
+ {
+ return dev & 0x3ffff;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-01-12 20:06 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-01-12 20:06 UTC (permalink / raw
To: gentoo-commits
commit: 58ef0246d074788e6c2b9d26d62d0ebd03bc6174
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jan 12 20:06:09 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jan 12 20:06:09 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=58ef0246
Linux patch 4.19.167
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1166_linux-4.19.167.patch | 2625 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2629 insertions(+)
diff --git a/0000_README b/0000_README
index 551b30e..5064804 100644
--- a/0000_README
+++ b/0000_README
@@ -703,6 +703,10 @@ Patch: 1165_linux-4.19.166.patch
From: https://www.kernel.org
Desc: Linux 4.19.166
+Patch: 1166_linux-4.19.167.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.167
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1166_linux-4.19.167.patch b/1166_linux-4.19.167.patch
new file mode 100644
index 0000000..ab5b3ed
--- /dev/null
+++ b/1166_linux-4.19.167.patch
@@ -0,0 +1,2625 @@
+diff --git a/Makefile b/Makefile
+index b2c939f289c25..91a82c22a4749 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 166
++SUBLEVEL = 167
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -400,7 +400,7 @@ YACC = bison
+ AWK = awk
+ GENKSYMS = scripts/genksyms/genksyms
+ INSTALLKERNEL := installkernel
+-DEPMOD = /sbin/depmod
++DEPMOD = depmod
+ PERL = perl
+ PYTHON = python
+ PYTHON2 = python2
+diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
+index e12ee86906c62..9436f34520491 100644
+--- a/arch/x86/kernel/cpu/mtrr/generic.c
++++ b/arch/x86/kernel/cpu/mtrr/generic.c
+@@ -166,9 +166,6 @@ static u8 mtrr_type_lookup_variable(u64 start, u64 end, u64 *partial_end,
+ *repeat = 0;
+ *uniform = 1;
+
+- /* Make end inclusive instead of exclusive */
+- end--;
+-
+ prev_match = MTRR_TYPE_INVALID;
+ for (i = 0; i < num_var_ranges; ++i) {
+ unsigned short start_state, end_state, inclusive;
+@@ -260,6 +257,9 @@ u8 mtrr_type_lookup(u64 start, u64 end, u8 *uniform)
+ int repeat;
+ u64 partial_end;
+
++ /* Make end inclusive instead of exclusive */
++ end--;
++
+ if (!mtrr_state_set)
+ return MTRR_TYPE_INVALID;
+
+diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
+index 0b62c817f63f5..05a02b8ace6ba 100644
+--- a/arch/x86/kvm/mmu.h
++++ b/arch/x86/kvm/mmu.h
+@@ -53,7 +53,7 @@ static inline u64 rsvd_bits(int s, int e)
+ if (e < s)
+ return 0;
+
+- return ((1ULL << (e - s + 1)) - 1) << s;
++ return ((2ULL << (e - s)) - 1) << s;
+ }
+
+ void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask, u64 mmio_value);
+diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
+index bf52106ab9c49..c0e9c00402ac8 100644
+--- a/arch/x86/mm/pgtable.c
++++ b/arch/x86/mm/pgtable.c
+@@ -838,6 +838,8 @@ int pud_free_pmd_page(pud_t *pud, unsigned long addr)
+ }
+
+ free_page((unsigned long)pmd_sv);
++
++ pgtable_pmd_page_dtor(virt_to_page(pmd));
+ free_page((unsigned long)pmd);
+
+ return 1;
+diff --git a/arch/x86/xen/efi.c b/arch/x86/xen/efi.c
+index 66bcdeeee639a..90d2e4ce70644 100644
+--- a/arch/x86/xen/efi.c
++++ b/arch/x86/xen/efi.c
+@@ -172,7 +172,7 @@ static enum efi_secureboot_mode xen_efi_get_secureboot(void)
+ return efi_secureboot_mode_unknown;
+ }
+
+-void __init xen_efi_init(void)
++void __init xen_efi_init(struct boot_params *boot_params)
+ {
+ efi_system_table_t *efi_systab_xen;
+
+@@ -181,12 +181,12 @@ void __init xen_efi_init(void)
+ if (efi_systab_xen == NULL)
+ return;
+
+- strncpy((char *)&boot_params.efi_info.efi_loader_signature, "Xen",
+- sizeof(boot_params.efi_info.efi_loader_signature));
+- boot_params.efi_info.efi_systab = (__u32)__pa(efi_systab_xen);
+- boot_params.efi_info.efi_systab_hi = (__u32)(__pa(efi_systab_xen) >> 32);
++ strncpy((char *)&boot_params->efi_info.efi_loader_signature, "Xen",
++ sizeof(boot_params->efi_info.efi_loader_signature));
++ boot_params->efi_info.efi_systab = (__u32)__pa(efi_systab_xen);
++ boot_params->efi_info.efi_systab_hi = (__u32)(__pa(efi_systab_xen) >> 32);
+
+- boot_params.secure_boot = xen_efi_get_secureboot();
++ boot_params->secure_boot = xen_efi_get_secureboot();
+
+ set_bit(EFI_BOOT, &efi.flags);
+ set_bit(EFI_PARAVIRT, &efi.flags);
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 9f8995cd28f65..1c3e9185934c4 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -1409,7 +1409,7 @@ asmlinkage __visible void __init xen_start_kernel(void)
+ /* We need this for printk timestamps */
+ xen_setup_runstate_info(0);
+
+- xen_efi_init();
++ xen_efi_init(&boot_params);
+
+ /* Start the world */
+ #ifdef CONFIG_X86_32
+diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c
+index dab07827d25e8..f04d22bcf08de 100644
+--- a/arch/x86/xen/enlighten_pvh.c
++++ b/arch/x86/xen/enlighten_pvh.c
+@@ -14,6 +14,8 @@
+ #include <xen/interface/memory.h>
+ #include <xen/interface/hvm/start_info.h>
+
++#include "xen-ops.h"
++
+ /*
+ * PVH variables.
+ *
+@@ -79,6 +81,8 @@ static void __init init_pvh_bootparams(void)
+ pvh_bootparams.hdr.type_of_loader = (9 << 4) | 0; /* Xen loader */
+
+ x86_init.acpi.get_root_pointer = pvh_get_root_pointer;
++
++ xen_efi_init(&pvh_bootparams);
+ }
+
+ /*
+diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
+index 0e60bd9186954..2f111f47ba98c 100644
+--- a/arch/x86/xen/xen-ops.h
++++ b/arch/x86/xen/xen-ops.h
+@@ -122,9 +122,9 @@ static inline void __init xen_init_vga(const struct dom0_vga_console_info *info,
+ void __init xen_init_apic(void);
+
+ #ifdef CONFIG_XEN_EFI
+-extern void xen_efi_init(void);
++extern void xen_efi_init(struct boot_params *boot_params);
+ #else
+-static inline void __init xen_efi_init(void)
++static inline void __init xen_efi_init(struct boot_params *boot_params)
+ {
+ }
+ #endif
+diff --git a/crypto/ecdh.c b/crypto/ecdh.c
+index a6e1a5d43fa7a..34605509b41a6 100644
+--- a/crypto/ecdh.c
++++ b/crypto/ecdh.c
+@@ -43,7 +43,8 @@ static int ecdh_set_secret(struct crypto_kpp *tfm, const void *buf,
+ struct ecdh params;
+ unsigned int ndigits;
+
+- if (crypto_ecdh_decode_key(buf, len, ¶ms) < 0)
++ if (crypto_ecdh_decode_key(buf, len, ¶ms) < 0 ||
++ params.key_size > sizeof(ctx->private_key))
+ return -EINVAL;
+
+ ndigits = ecdh_supported_curve(params.curve_id);
+diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
+index 6e737142ceaab..3e00ab8a8890c 100644
+--- a/drivers/atm/idt77252.c
++++ b/drivers/atm/idt77252.c
+@@ -3607,7 +3607,7 @@ static int idt77252_init_one(struct pci_dev *pcidev,
+
+ if ((err = dma_set_mask_and_coherent(&pcidev->dev, DMA_BIT_MASK(32)))) {
+ printk("idt77252: can't enable DMA for PCI device at %s\n", pci_name(pcidev));
+- return err;
++ goto err_out_disable_pdev;
+ }
+
+ card = kzalloc(sizeof(struct idt77252_dev), GFP_KERNEL);
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index f0cdf38ed31c9..4818aaddd712e 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -3349,7 +3349,7 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
+ if (fwnode_is_primary(fn)) {
+ dev->fwnode = fn->secondary;
+ if (!(parent && fn == parent->fwnode))
+- fn->secondary = ERR_PTR(-ENODEV);
++ fn->secondary = NULL;
+ } else {
+ dev->fwnode = NULL;
+ }
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index a017322dba82b..7ffeb37e8f202 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -263,12 +263,8 @@ static int h5_close(struct hci_uart *hu)
+ if (h5->vnd && h5->vnd->close)
+ h5->vnd->close(h5);
+
+- if (hu->serdev)
+- serdev_device_close(hu->serdev);
+-
+- kfree_skb(h5->rx_skb);
+- kfree(h5);
+- h5 = NULL;
++ if (!hu->serdev)
++ kfree(h5);
+
+ return 0;
+ }
+diff --git a/drivers/ide/ide-atapi.c b/drivers/ide/ide-atapi.c
+index 8b2b72b938857..4224c4dd89635 100644
+--- a/drivers/ide/ide-atapi.c
++++ b/drivers/ide/ide-atapi.c
+@@ -213,7 +213,6 @@ void ide_prep_sense(ide_drive_t *drive, struct request *rq)
+ sense_rq->rq_disk = rq->rq_disk;
+ sense_rq->cmd_flags = REQ_OP_DRV_IN;
+ ide_req(sense_rq)->type = ATA_PRIV_SENSE;
+- sense_rq->rq_flags |= RQF_PREEMPT;
+
+ req->cmd[0] = GPCMD_REQUEST_SENSE;
+ req->cmd[4] = cmd_len;
+diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
+index 0d93e0cfbeaf9..4381760846109 100644
+--- a/drivers/ide/ide-io.c
++++ b/drivers/ide/ide-io.c
+@@ -527,11 +527,6 @@ repeat:
+ * above to return us whatever is in the queue. Since we call
+ * ide_do_request() ourselves, we end up taking requests while
+ * the queue is blocked...
+- *
+- * We let requests forced at head of queue with ide-preempt
+- * though. I hope that doesn't happen too much, hopefully not
+- * unless the subdriver triggers such a thing in its own PM
+- * state machine.
+ */
+ if ((drive->dev_flags & IDE_DFLAG_BLOCKED) &&
+ ata_pm_request(rq) == 0 &&
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 9a614c5cdfa22..0c69becc3c177 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2507,6 +2507,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
+ /* HW supported features, none enabled by default */
+ dev->hw_features |= NETIF_F_RXCSUM | NETIF_F_HIGHDMA |
+ NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
++ dev->max_mtu = UMAC_MAX_MTU_SIZE;
+
+ /* Request the WOL interrupt and advertise suspend if available */
+ priv->wol_irq_disabled = 1;
+diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
+index 60da0499ad66c..a2280c4be0f51 100644
+--- a/drivers/net/ethernet/ethoc.c
++++ b/drivers/net/ethernet/ethoc.c
+@@ -1213,7 +1213,7 @@ static int ethoc_probe(struct platform_device *pdev)
+ ret = mdiobus_register(priv->mdio);
+ if (ret) {
+ dev_err(&netdev->dev, "failed to register MDIO bus\n");
+- goto free2;
++ goto free3;
+ }
+
+ ret = ethoc_mdio_probe(netdev);
+@@ -1245,6 +1245,7 @@ error2:
+ netif_napi_del(&priv->napi);
+ error:
+ mdiobus_unregister(priv->mdio);
++free3:
+ mdiobus_free(priv->mdio);
+ free2:
+ clk_disable_unprepare(priv->clk);
+diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
+index 5de6f7c73c1fa..d43173917ce47 100644
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -3902,6 +3902,7 @@ static int ucc_geth_probe(struct platform_device* ofdev)
+ INIT_WORK(&ugeth->timeout_work, ucc_geth_timeout_work);
+ netif_napi_add(dev, &ugeth->napi, ucc_geth_poll, 64);
+ dev->mtu = 1500;
++ dev->max_mtu = 1518;
+
+ ugeth->msg_enable = netif_msg_init(debug.msg_enable, UGETH_MSG_DEFAULT);
+ ugeth->phy_interface = phy_interface;
+@@ -3947,12 +3948,12 @@ static int ucc_geth_remove(struct platform_device* ofdev)
+ struct device_node *np = ofdev->dev.of_node;
+
+ unregister_netdev(dev);
+- free_netdev(dev);
+ ucc_geth_memclean(ugeth);
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(ugeth->ug_info->tbi_node);
+ of_node_put(ugeth->ug_info->phy_node);
++ free_netdev(dev);
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+index 1fa0cd527ead3..f453cebf758c6 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+@@ -419,6 +419,10 @@ static void __lb_other_process(struct hns_nic_ring_data *ring_data,
+ /* for mutl buffer*/
+ new_skb = skb_copy(skb, GFP_ATOMIC);
+ dev_kfree_skb_any(skb);
++ if (!new_skb) {
++ netdev_err(ndev, "skb alloc failed\n");
++ return;
++ }
+ skb = new_skb;
+
+ check_ok = 0;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
+index 3ad46d1f58f6e..738acba7a9a3c 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -127,6 +127,7 @@ enum i40e_state_t {
+ __I40E_RESET_INTR_RECEIVED,
+ __I40E_REINIT_REQUESTED,
+ __I40E_PF_RESET_REQUESTED,
++ __I40E_PF_RESET_AND_REBUILD_REQUESTED,
+ __I40E_CORE_RESET_REQUESTED,
+ __I40E_GLOBAL_RESET_REQUESTED,
+ __I40E_EMP_RESET_REQUESTED,
+@@ -153,6 +154,8 @@ enum i40e_state_t {
+ };
+
+ #define I40E_PF_RESET_FLAG BIT_ULL(__I40E_PF_RESET_REQUESTED)
++#define I40E_PF_RESET_AND_REBUILD_FLAG \
++ BIT_ULL(__I40E_PF_RESET_AND_REBUILD_REQUESTED)
+
+ /* VSI state flags */
+ enum i40e_vsi_state_t {
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 985601a65defd..a728b6a7872cb 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -42,6 +42,8 @@ static int i40e_setup_misc_vector(struct i40e_pf *pf);
+ static void i40e_determine_queue_usage(struct i40e_pf *pf);
+ static int i40e_setup_pf_filter_control(struct i40e_pf *pf);
+ static void i40e_prep_for_reset(struct i40e_pf *pf, bool lock_acquired);
++static void i40e_reset_and_rebuild(struct i40e_pf *pf, bool reinit,
++ bool lock_acquired);
+ static int i40e_reset(struct i40e_pf *pf);
+ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired);
+ static void i40e_fdir_sb_setup(struct i40e_pf *pf);
+@@ -7929,6 +7931,14 @@ void i40e_do_reset(struct i40e_pf *pf, u32 reset_flags, bool lock_acquired)
+ dev_dbg(&pf->pdev->dev, "PFR requested\n");
+ i40e_handle_reset_warning(pf, lock_acquired);
+
++ } else if (reset_flags & I40E_PF_RESET_AND_REBUILD_FLAG) {
++ /* Request a PF Reset
++ *
++ * Resets PF and reinitializes PFs VSI.
++ */
++ i40e_prep_for_reset(pf, lock_acquired);
++ i40e_reset_and_rebuild(pf, true, lock_acquired);
++
+ } else if (reset_flags & BIT_ULL(__I40E_REINIT_REQUESTED)) {
+ int v;
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index dd0c9604d3c92..5d782148d35f8 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1567,7 +1567,7 @@ int i40e_pci_sriov_configure(struct pci_dev *pdev, int num_vfs)
+ if (num_vfs) {
+ if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) {
+ pf->flags |= I40E_FLAG_VEB_MODE_ENABLED;
+- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG);
++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG);
+ }
+ return i40e_pci_sriov_enable(pdev, num_vfs);
+ }
+@@ -1575,7 +1575,7 @@ int i40e_pci_sriov_configure(struct pci_dev *pdev, int num_vfs)
+ if (!pci_vfs_assigned(pf->pdev)) {
+ i40e_free_vfs(pf);
+ pf->flags &= ~I40E_FLAG_VEB_MODE_ENABLED;
+- i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG);
++ i40e_do_reset_safe(pf, I40E_PF_RESET_AND_REBUILD_FLAG);
+ } else {
+ dev_warn(&pdev->dev, "Unable to free VFs because some are assigned to VMs.\n");
+ return -EINVAL;
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index e4e43519710d4..986292a34f4f6 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -954,7 +954,7 @@ static void mvpp22_gop_init_rgmii(struct mvpp2_port *port)
+
+ regmap_read(priv->sysctrl_base, GENCONF_CTRL0, &val);
+ if (port->gop_id == 2)
+- val |= GENCONF_CTRL0_PORT0_RGMII | GENCONF_CTRL0_PORT1_RGMII;
++ val |= GENCONF_CTRL0_PORT0_RGMII;
+ else if (port->gop_id == 3)
+ val |= GENCONF_CTRL0_PORT1_RGMII_MII;
+ regmap_write(priv->sysctrl_base, GENCONF_CTRL0, val);
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+index 5692c6087bbb0..a30eb90ba3d28 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -405,6 +405,38 @@ static int mvpp2_prs_tcam_first_free(struct mvpp2 *priv, unsigned char start,
+ return -EINVAL;
+ }
+
++/* Drop flow control pause frames */
++static void mvpp2_prs_drop_fc(struct mvpp2 *priv)
++{
++ unsigned char da[ETH_ALEN] = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x01 };
++ struct mvpp2_prs_entry pe;
++ unsigned int len;
++
++ memset(&pe, 0, sizeof(pe));
++
++ /* For all ports - drop flow control frames */
++ pe.index = MVPP2_PE_FC_DROP;
++ mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC);
++
++ /* Set match on DA */
++ len = ETH_ALEN;
++ while (len--)
++ mvpp2_prs_tcam_data_byte_set(&pe, len, da[len], 0xff);
++
++ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_DROP_MASK,
++ MVPP2_PRS_RI_DROP_MASK);
++
++ mvpp2_prs_sram_bits_set(&pe, MVPP2_PRS_SRAM_LU_GEN_BIT, 1);
++ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_FLOWS);
++
++ /* Mask all ports */
++ mvpp2_prs_tcam_port_map_set(&pe, MVPP2_PRS_PORT_MASK);
++
++ /* Update shadow table and hw entry */
++ mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_MAC);
++ mvpp2_prs_hw_write(priv, &pe);
++}
++
+ /* Enable/disable dropping all mac da's */
+ static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add)
+ {
+@@ -1162,6 +1194,7 @@ static void mvpp2_prs_mac_init(struct mvpp2 *priv)
+ mvpp2_prs_hw_write(priv, &pe);
+
+ /* Create dummy entries for drop all and promiscuous modes */
++ mvpp2_prs_drop_fc(priv);
+ mvpp2_prs_mac_drop_all_set(priv, 0, false);
+ mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_UNI_CAST, false);
+ mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false);
+@@ -1647,8 +1680,9 @@ static int mvpp2_prs_pppoe_init(struct mvpp2 *priv)
+ mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_IP6);
+ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_L3_IP6,
+ MVPP2_PRS_RI_L3_PROTO_MASK);
+- /* Skip eth_type + 4 bytes of IPv6 header */
+- mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 4,
++ /* Jump to DIP of IPV6 header */
++ mvpp2_prs_sram_shift_set(&pe, MVPP2_ETH_TYPE_LEN + 8 +
++ MVPP2_MAX_L3_ADDR_SIZE,
+ MVPP2_PRS_SRAM_OP_SEL_SHIFT_ADD);
+ /* Set L3 offset */
+ mvpp2_prs_sram_offset_set(&pe, MVPP2_PRS_SRAM_UDF_TYPE_L3,
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h
+index e22f6c85d3803..4b68dd3747338 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.h
+@@ -129,7 +129,7 @@
+ #define MVPP2_PE_VID_EDSA_FLTR_DEFAULT (MVPP2_PRS_TCAM_SRAM_SIZE - 7)
+ #define MVPP2_PE_VLAN_DBL (MVPP2_PRS_TCAM_SRAM_SIZE - 6)
+ #define MVPP2_PE_VLAN_NONE (MVPP2_PRS_TCAM_SRAM_SIZE - 5)
+-/* reserved */
++#define MVPP2_PE_FC_DROP (MVPP2_PRS_TCAM_SRAM_SIZE - 4)
+ #define MVPP2_PE_MAC_MC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 3)
+ #define MVPP2_PE_MAC_UC_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 2)
+ #define MVPP2_PE_MAC_NON_PROMISCUOUS (MVPP2_PRS_TCAM_SRAM_SIZE - 1)
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+index a96da16f34049..1976279800cd8 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+@@ -1747,6 +1747,11 @@ netdev_features_t qede_features_check(struct sk_buff *skb,
+ ntohs(udp_hdr(skb)->dest) != gnv_port))
+ return features & ~(NETIF_F_CSUM_MASK |
+ NETIF_F_GSO_MASK);
++ } else if (l4_proto == IPPROTO_IPIP) {
++ /* IPIP tunnels are unknown to the device or at least unsupported natively,
++ * offloads for them can't be done trivially, so disable them for such skb.
++ */
++ return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
+ }
+ }
+
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index c7ce167c67a08..6b901bf1cd54d 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -4237,7 +4237,8 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
+ return;
+
+ switch (tp->mac_version) {
+- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33:
++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26:
++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33:
+ case RTL_GIGA_MAC_VER_37:
+ case RTL_GIGA_MAC_VER_39:
+ case RTL_GIGA_MAC_VER_43:
+@@ -4263,7 +4264,8 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
+ static void r8168_pll_power_up(struct rtl8169_private *tp)
+ {
+ switch (tp->mac_version) {
+- case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33:
++ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26:
++ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33:
+ case RTL_GIGA_MAC_VER_37:
+ case RTL_GIGA_MAC_VER_39:
+ case RTL_GIGA_MAC_VER_43:
+diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
+index d7543811dfae2..10b301e790864 100644
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -476,6 +476,7 @@ void cpts_unregister(struct cpts *cpts)
+
+ ptp_clock_unregister(cpts->clock);
+ cpts->clock = NULL;
++ cpts->phc_index = -1;
+
+ cpts_write32(cpts, 0, int_enable);
+ cpts_write32(cpts, 0, control);
+@@ -577,6 +578,7 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs,
+ cpts->cc.read = cpts_systim_read;
+ cpts->cc.mask = CLOCKSOURCE_MASK(32);
+ cpts->info = cpts_info;
++ cpts->phc_index = -1;
+
+ cpts_calc_mult_shift(cpts);
+ /* save cc.mult original value as it can be modified
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index fe0e02e11f294..1a86b016b8420 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1450,7 +1450,7 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile,
+ int i;
+
+ if (it->nr_segs > MAX_SKB_FRAGS + 1)
+- return ERR_PTR(-ENOMEM);
++ return ERR_PTR(-EMSGSIZE);
+
+ local_bh_disable();
+ skb = napi_get_frags(&tfile->napi);
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index 1f57a6a2b8a25..e0bbefcbefa17 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1629,9 +1629,6 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
+ * USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be
+ * sent by device after USB_CDC_NOTIFY_SPEED_CHANGE.
+ */
+- netif_info(dev, link, dev->net,
+- "network connection: %sconnected\n",
+- !!event->wValue ? "" : "dis");
+ usbnet_link_change(dev, !!event->wValue, 0);
+ break;
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index ebd630a94571f..1b48d71dbc284 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -995,6 +995,7 @@ static const struct usb_device_id products[] = {
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)}, /* Quectel EM160R-GL */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
+
+ /* 3. Combined interface devices matching on interface number */
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index b21223be93c8e..d41d5f63f211f 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2077,14 +2077,16 @@ static int virtnet_set_channels(struct net_device *dev,
+
+ get_online_cpus();
+ err = _virtnet_set_queues(vi, queue_pairs);
+- if (!err) {
+- netif_set_real_num_tx_queues(dev, queue_pairs);
+- netif_set_real_num_rx_queues(dev, queue_pairs);
+-
+- virtnet_set_affinity(vi);
++ if (err) {
++ put_online_cpus();
++ goto err;
+ }
++ virtnet_set_affinity(vi);
+ put_online_cpus();
+
++ netif_set_real_num_tx_queues(dev, queue_pairs);
++ netif_set_real_num_rx_queues(dev, queue_pairs);
++ err:
+ return err;
+ }
+
+diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
+index 20d9b6585fba3..d67623d61dc42 100644
+--- a/drivers/net/wan/hdlc_ppp.c
++++ b/drivers/net/wan/hdlc_ppp.c
+@@ -572,6 +572,13 @@ static void ppp_timer(struct timer_list *t)
+ unsigned long flags;
+
+ spin_lock_irqsave(&ppp->lock, flags);
++ /* mod_timer could be called after we entered this function but
++ * before we got the lock.
++ */
++ if (timer_pending(&proto->timer)) {
++ spin_unlock_irqrestore(&ppp->lock, flags);
++ return;
++ }
+ switch (proto->state) {
+ case STOPPING:
+ case REQ_SENT:
+diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c
+index 69213842e63e0..efb9c3d902133 100644
+--- a/drivers/scsi/scsi_transport_spi.c
++++ b/drivers/scsi/scsi_transport_spi.c
+@@ -130,12 +130,16 @@ static int spi_execute(struct scsi_device *sdev, const void *cmd,
+ sshdr = &sshdr_tmp;
+
+ for(i = 0; i < DV_RETRIES; i++) {
++ /*
++ * The purpose of the RQF_PM flag below is to bypass the
++ * SDEV_QUIESCE state.
++ */
+ result = scsi_execute(sdev, cmd, dir, buffer, bufflen, sense,
+ sshdr, DV_TIMEOUT, /* retries */ 1,
+ REQ_FAILFAST_DEV |
+ REQ_FAILFAST_TRANSPORT |
+ REQ_FAILFAST_DRIVER,
+- 0, NULL);
++ RQF_PM, NULL);
+ if (driver_byte(result) != DRIVER_SENSE ||
+ sshdr->sense_key != UNIT_ATTENTION)
+ break;
+@@ -1018,23 +1022,26 @@ spi_dv_device(struct scsi_device *sdev)
+ */
+ lock_system_sleep();
+
++ if (scsi_autopm_get_device(sdev))
++ goto unlock_system_sleep;
++
+ if (unlikely(spi_dv_in_progress(starget)))
+- goto unlock;
++ goto put_autopm;
+
+ if (unlikely(scsi_device_get(sdev)))
+- goto unlock;
++ goto put_autopm;
+
+ spi_dv_in_progress(starget) = 1;
+
+ buffer = kzalloc(len, GFP_KERNEL);
+
+ if (unlikely(!buffer))
+- goto out_put;
++ goto put_sdev;
+
+ /* We need to verify that the actual device will quiesce; the
+ * later target quiesce is just a nice to have */
+ if (unlikely(scsi_device_quiesce(sdev)))
+- goto out_free;
++ goto free_buffer;
+
+ scsi_target_quiesce(starget);
+
+@@ -1054,12 +1061,16 @@ spi_dv_device(struct scsi_device *sdev)
+
+ spi_initial_dv(starget) = 1;
+
+- out_free:
++free_buffer:
+ kfree(buffer);
+- out_put:
++
++put_sdev:
+ spi_dv_in_progress(starget) = 0;
+ scsi_device_put(sdev);
+-unlock:
++put_autopm:
++ scsi_autopm_put_device(sdev);
++
++unlock_system_sleep:
+ unlock_system_sleep();
+ }
+ EXPORT_SYMBOL(spi_dv_device);
+diff --git a/drivers/scsi/ufs/ufshcd-pci.c b/drivers/scsi/ufs/ufshcd-pci.c
+index ffe6f82182ba8..68f4f67c5ff88 100644
+--- a/drivers/scsi/ufs/ufshcd-pci.c
++++ b/drivers/scsi/ufs/ufshcd-pci.c
+@@ -96,6 +96,30 @@ static int ufshcd_pci_resume(struct device *dev)
+ {
+ return ufshcd_system_resume(dev_get_drvdata(dev));
+ }
++
++/**
++ * ufshcd_pci_poweroff - suspend-to-disk poweroff function
++ * @dev: pointer to PCI device handle
++ *
++ * Returns 0 if successful
++ * Returns non-zero otherwise
++ */
++static int ufshcd_pci_poweroff(struct device *dev)
++{
++ struct ufs_hba *hba = dev_get_drvdata(dev);
++ int spm_lvl = hba->spm_lvl;
++ int ret;
++
++ /*
++ * For poweroff we need to set the UFS device to PowerDown mode.
++ * Force spm_lvl to ensure that.
++ */
++ hba->spm_lvl = 5;
++ ret = ufshcd_system_suspend(hba);
++ hba->spm_lvl = spm_lvl;
++ return ret;
++}
++
+ #endif /* !CONFIG_PM_SLEEP */
+
+ #ifdef CONFIG_PM
+@@ -190,8 +214,14 @@ ufshcd_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ }
+
+ static const struct dev_pm_ops ufshcd_pci_pm_ops = {
+- SET_SYSTEM_SLEEP_PM_OPS(ufshcd_pci_suspend,
+- ufshcd_pci_resume)
++#ifdef CONFIG_PM_SLEEP
++ .suspend = ufshcd_pci_suspend,
++ .resume = ufshcd_pci_resume,
++ .freeze = ufshcd_pci_suspend,
++ .thaw = ufshcd_pci_resume,
++ .poweroff = ufshcd_pci_poweroff,
++ .restore = ufshcd_pci_resume,
++#endif
+ SET_RUNTIME_PM_OPS(ufshcd_pci_runtime_suspend,
+ ufshcd_pci_runtime_resume,
+ ufshcd_pci_runtime_idle)
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 61b1eae42ea85..40f478c4d118f 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -3583,7 +3583,7 @@ static int ufshcd_dme_enable(struct ufs_hba *hba)
+ ret = ufshcd_send_uic_cmd(hba, &uic_cmd);
+ if (ret)
+ dev_err(hba->dev,
+- "dme-reset: error code %d\n", ret);
++ "dme-enable: error code %d\n", ret);
+
+ return ret;
+ }
+diff --git a/drivers/staging/mt7621-dma/mtk-hsdma.c b/drivers/staging/mt7621-dma/mtk-hsdma.c
+index 5831f816c17b1..f60302b711813 100644
+--- a/drivers/staging/mt7621-dma/mtk-hsdma.c
++++ b/drivers/staging/mt7621-dma/mtk-hsdma.c
+@@ -723,7 +723,7 @@ static int mtk_hsdma_probe(struct platform_device *pdev)
+ ret = dma_async_device_register(dd);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to register dma device\n");
+- return ret;
++ goto err_uninit_hsdma;
+ }
+
+ ret = of_dma_controller_register(pdev->dev.of_node,
+@@ -739,6 +739,8 @@ static int mtk_hsdma_probe(struct platform_device *pdev)
+
+ err_unregister:
+ dma_async_device_unregister(dd);
++err_uninit_hsdma:
++ mtk_hsdma_uninit(hsdma);
+ return ret;
+ }
+
+diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
+index 7cdb5d7f65382..1709b8a99bd79 100644
+--- a/drivers/target/target_core_xcopy.c
++++ b/drivers/target/target_core_xcopy.c
+@@ -55,60 +55,83 @@ static int target_xcopy_gen_naa_ieee(struct se_device *dev, unsigned char *buf)
+ return 0;
+ }
+
+-struct xcopy_dev_search_info {
+- const unsigned char *dev_wwn;
+- struct se_device *found_dev;
+-};
+-
++/**
++ * target_xcopy_locate_se_dev_e4_iter - compare XCOPY NAA device identifiers
++ *
++ * @se_dev: device being considered for match
++ * @dev_wwn: XCOPY requested NAA dev_wwn
++ * @return: 1 on match, 0 on no-match
++ */
+ static int target_xcopy_locate_se_dev_e4_iter(struct se_device *se_dev,
+- void *data)
++ const unsigned char *dev_wwn)
+ {
+- struct xcopy_dev_search_info *info = data;
+ unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
+ int rc;
+
+- if (!se_dev->dev_attrib.emulate_3pc)
++ if (!se_dev->dev_attrib.emulate_3pc) {
++ pr_debug("XCOPY: emulate_3pc disabled on se_dev %p\n", se_dev);
+ return 0;
++ }
+
+ memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
+ target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]);
+
+- rc = memcmp(&tmp_dev_wwn[0], info->dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN);
+- if (rc != 0)
+- return 0;
+-
+- info->found_dev = se_dev;
+- pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev);
+-
+- rc = target_depend_item(&se_dev->dev_group.cg_item);
++ rc = memcmp(&tmp_dev_wwn[0], dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN);
+ if (rc != 0) {
+- pr_err("configfs_depend_item attempt failed: %d for se_dev: %p\n",
+- rc, se_dev);
+- return rc;
++ pr_debug("XCOPY: skip non-matching: %*ph\n",
++ XCOPY_NAA_IEEE_REGEX_LEN, tmp_dev_wwn);
++ return 0;
+ }
++ pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev);
+
+- pr_debug("Called configfs_depend_item for se_dev: %p se_dev->se_dev_group: %p\n",
+- se_dev, &se_dev->dev_group);
+ return 1;
+ }
+
+-static int target_xcopy_locate_se_dev_e4(const unsigned char *dev_wwn,
+- struct se_device **found_dev)
++static int target_xcopy_locate_se_dev_e4(struct se_session *sess,
++ const unsigned char *dev_wwn,
++ struct se_device **_found_dev,
++ struct percpu_ref **_found_lun_ref)
+ {
+- struct xcopy_dev_search_info info;
+- int ret;
+-
+- memset(&info, 0, sizeof(info));
+- info.dev_wwn = dev_wwn;
+-
+- ret = target_for_each_device(target_xcopy_locate_se_dev_e4_iter, &info);
+- if (ret == 1) {
+- *found_dev = info.found_dev;
+- return 0;
+- } else {
+- pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
+- return -EINVAL;
++ struct se_dev_entry *deve;
++ struct se_node_acl *nacl;
++ struct se_lun *this_lun = NULL;
++ struct se_device *found_dev = NULL;
++
++ /* cmd with NULL sess indicates no associated $FABRIC_MOD */
++ if (!sess)
++ goto err_out;
++
++ pr_debug("XCOPY 0xe4: searching for: %*ph\n",
++ XCOPY_NAA_IEEE_REGEX_LEN, dev_wwn);
++
++ nacl = sess->se_node_acl;
++ rcu_read_lock();
++ hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link) {
++ struct se_device *this_dev;
++ int rc;
++
++ this_lun = rcu_dereference(deve->se_lun);
++ this_dev = rcu_dereference_raw(this_lun->lun_se_dev);
++
++ rc = target_xcopy_locate_se_dev_e4_iter(this_dev, dev_wwn);
++ if (rc) {
++ if (percpu_ref_tryget_live(&this_lun->lun_ref))
++ found_dev = this_dev;
++ break;
++ }
+ }
++ rcu_read_unlock();
++ if (found_dev == NULL)
++ goto err_out;
++
++ pr_debug("lun_ref held for se_dev: %p se_dev->se_dev_group: %p\n",
++ found_dev, &found_dev->dev_group);
++ *_found_dev = found_dev;
++ *_found_lun_ref = &this_lun->lun_ref;
++ return 0;
++err_out:
++ pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n");
++ return -EINVAL;
+ }
+
+ static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op *xop,
+@@ -255,12 +278,16 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd,
+
+ switch (xop->op_origin) {
+ case XCOL_SOURCE_RECV_OP:
+- rc = target_xcopy_locate_se_dev_e4(xop->dst_tid_wwn,
+- &xop->dst_dev);
++ rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess,
++ xop->dst_tid_wwn,
++ &xop->dst_dev,
++ &xop->remote_lun_ref);
+ break;
+ case XCOL_DEST_RECV_OP:
+- rc = target_xcopy_locate_se_dev_e4(xop->src_tid_wwn,
+- &xop->src_dev);
++ rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess,
++ xop->src_tid_wwn,
++ &xop->src_dev,
++ &xop->remote_lun_ref);
+ break;
+ default:
+ pr_err("XCOPY CSCD descriptor IDs not found in CSCD list - "
+@@ -412,18 +439,12 @@ static int xcopy_pt_get_cmd_state(struct se_cmd *se_cmd)
+
+ static void xcopy_pt_undepend_remotedev(struct xcopy_op *xop)
+ {
+- struct se_device *remote_dev;
+-
+ if (xop->op_origin == XCOL_SOURCE_RECV_OP)
+- remote_dev = xop->dst_dev;
++ pr_debug("putting dst lun_ref for %p\n", xop->dst_dev);
+ else
+- remote_dev = xop->src_dev;
+-
+- pr_debug("Calling configfs_undepend_item for"
+- " remote_dev: %p remote_dev->dev_group: %p\n",
+- remote_dev, &remote_dev->dev_group.cg_item);
++ pr_debug("putting src lun_ref for %p\n", xop->src_dev);
+
+- target_undepend_item(&remote_dev->dev_group.cg_item);
++ percpu_ref_put(xop->remote_lun_ref);
+ }
+
+ static void xcopy_pt_release_cmd(struct se_cmd *se_cmd)
+diff --git a/drivers/target/target_core_xcopy.h b/drivers/target/target_core_xcopy.h
+index 26ba4c3c9cffd..974bc1e19ff2b 100644
+--- a/drivers/target/target_core_xcopy.h
++++ b/drivers/target/target_core_xcopy.h
+@@ -29,6 +29,7 @@ struct xcopy_op {
+ struct se_device *dst_dev;
+ unsigned char dst_tid_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
+ unsigned char local_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
++ struct percpu_ref *remote_lun_ref;
+
+ sector_t src_lba;
+ sector_t dst_lba;
+diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
+index 7335dc8552180..af420ec2a9f41 100644
+--- a/drivers/usb/chipidea/ci_hdrc_imx.c
++++ b/drivers/usb/chipidea/ci_hdrc_imx.c
+@@ -128,9 +128,13 @@ static struct imx_usbmisc_data *usbmisc_get_init_data(struct device *dev)
+ misc_pdev = of_find_device_by_node(args.np);
+ of_node_put(args.np);
+
+- if (!misc_pdev || !platform_get_drvdata(misc_pdev))
++ if (!misc_pdev)
+ return ERR_PTR(-EPROBE_DEFER);
+
++ if (!platform_get_drvdata(misc_pdev)) {
++ put_device(&misc_pdev->dev);
++ return ERR_PTR(-EPROBE_DEFER);
++ }
+ data->dev = &misc_pdev->dev;
+
+ if (of_find_property(np, "disable-over-current", NULL))
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index e0d8da4e3967b..e847d0de67607 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1939,6 +1939,10 @@ static const struct usb_device_id acm_ids[] = {
+ { USB_DEVICE(0x04d8, 0x0083), /* Bootloader mode */
+ .driver_info = IGNORE_DEVICE,
+ },
++
++ { USB_DEVICE(0x04d8, 0xf58b),
++ .driver_info = IGNORE_DEVICE,
++ },
+ #endif
+
+ /*Samsung phone in firmware update mode */
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 55ad4c43b3804..ae69635bb1fb5 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -465,13 +465,23 @@ static int service_outstanding_interrupt(struct wdm_device *desc)
+ if (!desc->resp_count || !--desc->resp_count)
+ goto out;
+
++ if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
++ rv = -ENODEV;
++ goto out;
++ }
++ if (test_bit(WDM_RESETTING, &desc->flags)) {
++ rv = -EIO;
++ goto out;
++ }
++
+ set_bit(WDM_RESPONDING, &desc->flags);
+ spin_unlock_irq(&desc->iuspin);
+ rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ spin_lock_irq(&desc->iuspin);
+ if (rv) {
+- dev_err(&desc->intf->dev,
+- "usb_submit_urb failed with result %d\n", rv);
++ if (!test_bit(WDM_DISCONNECTING, &desc->flags))
++ dev_err(&desc->intf->dev,
++ "usb_submit_urb failed with result %d\n", rv);
+
+ /* make sure the next notification trigger a submit */
+ clear_bit(WDM_RESPONDING, &desc->flags);
+@@ -1026,9 +1036,9 @@ static void wdm_disconnect(struct usb_interface *intf)
+ wake_up_all(&desc->wait);
+ mutex_lock(&desc->rlock);
+ mutex_lock(&desc->wlock);
+- kill_urbs(desc);
+ cancel_work_sync(&desc->rxwork);
+ cancel_work_sync(&desc->service_outs_intr);
++ kill_urbs(desc);
+ mutex_unlock(&desc->wlock);
+ mutex_unlock(&desc->rlock);
+
+diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
+index db36a796af8c3..5c00d79ac7a10 100644
+--- a/drivers/usb/class/usblp.c
++++ b/drivers/usb/class/usblp.c
+@@ -274,8 +274,25 @@ static int usblp_ctrl_msg(struct usblp *usblp, int request, int type, int dir, i
+ #define usblp_reset(usblp)\
+ usblp_ctrl_msg(usblp, USBLP_REQ_RESET, USB_TYPE_CLASS, USB_DIR_OUT, USB_RECIP_OTHER, 0, NULL, 0)
+
+-#define usblp_hp_channel_change_request(usblp, channel, buffer) \
+- usblp_ctrl_msg(usblp, USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST, USB_TYPE_VENDOR, USB_DIR_IN, USB_RECIP_INTERFACE, channel, buffer, 1)
++static int usblp_hp_channel_change_request(struct usblp *usblp, int channel, u8 *new_channel)
++{
++ u8 *buf;
++ int ret;
++
++ buf = kzalloc(1, GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
++
++ ret = usblp_ctrl_msg(usblp, USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST,
++ USB_TYPE_VENDOR, USB_DIR_IN, USB_RECIP_INTERFACE,
++ channel, buf, 1);
++ if (ret == 0)
++ *new_channel = buf[0];
++
++ kfree(buf);
++
++ return ret;
++}
+
+ /*
+ * See the description for usblp_select_alts() below for the usage
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index d6968b90ee6bb..55ee41283f395 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -272,6 +272,7 @@
+
+ /* Global USB2 PHY Vendor Control Register */
+ #define DWC3_GUSB2PHYACC_NEWREGREQ BIT(25)
++#define DWC3_GUSB2PHYACC_DONE BIT(24)
+ #define DWC3_GUSB2PHYACC_BUSY BIT(23)
+ #define DWC3_GUSB2PHYACC_WRITE BIT(22)
+ #define DWC3_GUSB2PHYACC_ADDR(n) (n << 16)
+diff --git a/drivers/usb/dwc3/ulpi.c b/drivers/usb/dwc3/ulpi.c
+index f62b5f3c2d67d..bb8271531da70 100644
+--- a/drivers/usb/dwc3/ulpi.c
++++ b/drivers/usb/dwc3/ulpi.c
+@@ -24,7 +24,7 @@ static int dwc3_ulpi_busyloop(struct dwc3 *dwc)
+
+ while (count--) {
+ reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYACC(0));
+- if (!(reg & DWC3_GUSB2PHYACC_BUSY))
++ if (reg & DWC3_GUSB2PHYACC_DONE)
+ return 0;
+ cpu_relax();
+ }
+diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
+index 31cce7805eb2e..c6afc42429628 100644
+--- a/drivers/usb/gadget/Kconfig
++++ b/drivers/usb/gadget/Kconfig
+@@ -264,6 +264,7 @@ config USB_CONFIGFS_NCM
+ depends on NET
+ select USB_U_ETHER
+ select USB_F_NCM
++ select CRC32
+ help
+ NCM is an advanced protocol for Ethernet encapsulation, allows
+ grouping of several ethernet frames into one USB transfer and
+@@ -313,6 +314,7 @@ config USB_CONFIGFS_EEM
+ depends on NET
+ select USB_U_ETHER
+ select USB_F_EEM
++ select CRC32
+ help
+ CDC EEM is a newer USB standard that is somewhat simpler than CDC ECM
+ and therefore can be supported by more hardware. Technically ECM and
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 40b3ed93596ad..4cfcc73f39790 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -392,8 +392,11 @@ int usb_function_deactivate(struct usb_function *function)
+
+ spin_lock_irqsave(&cdev->lock, flags);
+
+- if (cdev->deactivations == 0)
++ if (cdev->deactivations == 0) {
++ spin_unlock_irqrestore(&cdev->lock, flags);
+ status = usb_gadget_deactivate(cdev->gadget);
++ spin_lock_irqsave(&cdev->lock, flags);
++ }
+ if (status == 0)
+ cdev->deactivations++;
+
+@@ -424,8 +427,11 @@ int usb_function_activate(struct usb_function *function)
+ status = -EINVAL;
+ else {
+ cdev->deactivations--;
+- if (cdev->deactivations == 0)
++ if (cdev->deactivations == 0) {
++ spin_unlock_irqrestore(&cdev->lock, flags);
+ status = usb_gadget_activate(cdev->gadget);
++ spin_lock_irqsave(&cdev->lock, flags);
++ }
+ }
+
+ spin_unlock_irqrestore(&cdev->lock, flags);
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index a7709d126b29b..5b8b2ca4376cb 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -233,9 +233,16 @@ static ssize_t gadget_dev_desc_bcdUSB_store(struct config_item *item,
+
+ static ssize_t gadget_dev_desc_UDC_show(struct config_item *item, char *page)
+ {
+- char *udc_name = to_gadget_info(item)->composite.gadget_driver.udc_name;
++ struct gadget_info *gi = to_gadget_info(item);
++ char *udc_name;
++ int ret;
++
++ mutex_lock(&gi->lock);
++ udc_name = gi->composite.gadget_driver.udc_name;
++ ret = sprintf(page, "%s\n", udc_name ?: "");
++ mutex_unlock(&gi->lock);
+
+- return sprintf(page, "%s\n", udc_name ?: "");
++ return ret;
+ }
+
+ static int unregister_gadget(struct gadget_info *gi)
+@@ -1217,9 +1224,9 @@ static void purge_configs_funcs(struct gadget_info *gi)
+
+ cfg = container_of(c, struct config_usb_cfg, c);
+
+- list_for_each_entry_safe(f, tmp, &c->functions, list) {
++ list_for_each_entry_safe_reverse(f, tmp, &c->functions, list) {
+
+- list_move_tail(&f->list, &cfg->func_list);
++ list_move(&f->list, &cfg->func_list);
+ if (f->unbind) {
+ dev_dbg(&gi->cdev.gadget->dev,
+ "unbind function '%s'/%p\n",
+@@ -1505,7 +1512,7 @@ static const struct usb_gadget_driver configfs_driver_template = {
+ .suspend = configfs_composite_suspend,
+ .resume = configfs_composite_resume,
+
+- .max_speed = USB_SPEED_SUPER,
++ .max_speed = USB_SPEED_SUPER_PLUS,
+ .driver = {
+ .owner = THIS_MODULE,
+ .name = "configfs-gadget",
+@@ -1545,7 +1552,7 @@ static struct config_group *gadgets_make(
+ gi->composite.unbind = configfs_do_nothing;
+ gi->composite.suspend = NULL;
+ gi->composite.resume = NULL;
+- gi->composite.max_speed = USB_SPEED_SUPER;
++ gi->composite.max_speed = USB_SPEED_SUPER_PLUS;
+
+ spin_lock_init(&gi->spinlock);
+ mutex_init(&gi->lock);
+diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
+index 8ed1295d7e350..0f47cd398d60a 100644
+--- a/drivers/usb/gadget/function/f_printer.c
++++ b/drivers/usb/gadget/function/f_printer.c
+@@ -1126,6 +1126,7 @@ fail_tx_reqs:
+ printer_req_free(dev->in_ep, req);
+ }
+
++ usb_free_all_descriptors(f);
+ return ret;
+
+ }
+diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
+index d582921f7257d..425981ab7a4dc 100644
+--- a/drivers/usb/gadget/function/f_uac2.c
++++ b/drivers/usb/gadget/function/f_uac2.c
+@@ -275,7 +275,7 @@ static struct usb_endpoint_descriptor fs_epout_desc = {
+
+ .bEndpointAddress = USB_DIR_OUT,
+ .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+- .wMaxPacketSize = cpu_to_le16(1023),
++ /* .wMaxPacketSize = DYNAMIC */
+ .bInterval = 1,
+ };
+
+@@ -284,7 +284,7 @@ static struct usb_endpoint_descriptor hs_epout_desc = {
+ .bDescriptorType = USB_DT_ENDPOINT,
+
+ .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+- .wMaxPacketSize = cpu_to_le16(1024),
++ /* .wMaxPacketSize = DYNAMIC */
+ .bInterval = 4,
+ };
+
+@@ -352,7 +352,7 @@ static struct usb_endpoint_descriptor fs_epin_desc = {
+
+ .bEndpointAddress = USB_DIR_IN,
+ .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+- .wMaxPacketSize = cpu_to_le16(1023),
++ /* .wMaxPacketSize = DYNAMIC */
+ .bInterval = 1,
+ };
+
+@@ -361,7 +361,7 @@ static struct usb_endpoint_descriptor hs_epin_desc = {
+ .bDescriptorType = USB_DT_ENDPOINT,
+
+ .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+- .wMaxPacketSize = cpu_to_le16(1024),
++ /* .wMaxPacketSize = DYNAMIC */
+ .bInterval = 4,
+ };
+
+@@ -448,12 +448,28 @@ struct cntrl_range_lay3 {
+ __le32 dRES;
+ } __packed;
+
+-static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
++static int set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
+ struct usb_endpoint_descriptor *ep_desc,
+- unsigned int factor, bool is_playback)
++ enum usb_device_speed speed, bool is_playback)
+ {
+ int chmask, srate, ssize;
+- u16 max_packet_size;
++ u16 max_size_bw, max_size_ep;
++ unsigned int factor;
++
++ switch (speed) {
++ case USB_SPEED_FULL:
++ max_size_ep = 1023;
++ factor = 1000;
++ break;
++
++ case USB_SPEED_HIGH:
++ max_size_ep = 1024;
++ factor = 8000;
++ break;
++
++ default:
++ return -EINVAL;
++ }
+
+ if (is_playback) {
+ chmask = uac2_opts->p_chmask;
+@@ -465,10 +481,12 @@ static void set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
+ ssize = uac2_opts->c_ssize;
+ }
+
+- max_packet_size = num_channels(chmask) * ssize *
++ max_size_bw = num_channels(chmask) * ssize *
+ DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1)));
+- ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_packet_size,
+- le16_to_cpu(ep_desc->wMaxPacketSize)));
++ ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_size_bw,
++ max_size_ep));
++
++ return 0;
+ }
+
+ static int
+@@ -551,10 +569,33 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
+ uac2->as_in_alt = 0;
+
+ /* Calculate wMaxPacketSize according to audio bandwidth */
+- set_ep_max_packet_size(uac2_opts, &fs_epin_desc, 1000, true);
+- set_ep_max_packet_size(uac2_opts, &fs_epout_desc, 1000, false);
+- set_ep_max_packet_size(uac2_opts, &hs_epin_desc, 8000, true);
+- set_ep_max_packet_size(uac2_opts, &hs_epout_desc, 8000, false);
++ ret = set_ep_max_packet_size(uac2_opts, &fs_epin_desc, USB_SPEED_FULL,
++ true);
++ if (ret < 0) {
++ dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
++ return ret;
++ }
++
++ ret = set_ep_max_packet_size(uac2_opts, &fs_epout_desc, USB_SPEED_FULL,
++ false);
++ if (ret < 0) {
++ dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
++ return ret;
++ }
++
++ ret = set_ep_max_packet_size(uac2_opts, &hs_epin_desc, USB_SPEED_HIGH,
++ true);
++ if (ret < 0) {
++ dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
++ return ret;
++ }
++
++ ret = set_ep_max_packet_size(uac2_opts, &hs_epout_desc, USB_SPEED_HIGH,
++ false);
++ if (ret < 0) {
++ dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
++ return ret;
++ }
+
+ agdev->out_ep = usb_ep_autoconfig(gadget, &fs_epout_desc);
+ if (!agdev->out_ep) {
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 39ebc1b03698b..156651df6b4da 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -45,9 +45,10 @@
+ #define UETH__VERSION "29-May-2008"
+
+ /* Experiments show that both Linux and Windows hosts allow up to 16k
+- * frame sizes. Set the max size to 15k+52 to prevent allocating 32k
++ * frame sizes. Set the max MTU size to 15k+52 to prevent allocating 32k
+ * blocks and still have efficient handling. */
+-#define GETHER_MAX_ETH_FRAME_LEN 15412
++#define GETHER_MAX_MTU_SIZE 15412
++#define GETHER_MAX_ETH_FRAME_LEN (GETHER_MAX_MTU_SIZE + ETH_HLEN)
+
+ struct eth_dev {
+ /* lock is held while accessing port_usb
+@@ -786,7 +787,7 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g,
+
+ /* MTU range: 14 - 15412 */
+ net->min_mtu = ETH_HLEN;
+- net->max_mtu = GETHER_MAX_ETH_FRAME_LEN;
++ net->max_mtu = GETHER_MAX_MTU_SIZE;
+
+ dev->gadget = g;
+ SET_NETDEV_DEV(net, &g->dev);
+@@ -848,7 +849,7 @@ struct net_device *gether_setup_name_default(const char *netname)
+
+ /* MTU range: 14 - 15412 */
+ net->min_mtu = ETH_HLEN;
+- net->max_mtu = GETHER_MAX_ETH_FRAME_LEN;
++ net->max_mtu = GETHER_MAX_MTU_SIZE;
+
+ return net;
+ }
+diff --git a/drivers/usb/gadget/legacy/acm_ms.c b/drivers/usb/gadget/legacy/acm_ms.c
+index af16672d51187..6680dcfe660ea 100644
+--- a/drivers/usb/gadget/legacy/acm_ms.c
++++ b/drivers/usb/gadget/legacy/acm_ms.c
+@@ -203,8 +203,10 @@ static int acm_ms_bind(struct usb_composite_dev *cdev)
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto fail_string_ids;
++ }
+ usb_otg_descriptor_init(gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 0348ea899d062..a753221c2268e 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4558,19 +4558,19 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci,
+ {
+ unsigned long long timeout_ns;
+
++ if (xhci->quirks & XHCI_INTEL_HOST)
++ timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
++ else
++ timeout_ns = udev->u1_params.sel;
++
+ /* Prevent U1 if service interval is shorter than U1 exit latency */
+ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
+- if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) {
++ if (xhci_service_interval_to_ns(desc) <= timeout_ns) {
+ dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n");
+ return USB3_LPM_DISABLED;
+ }
+ }
+
+- if (xhci->quirks & XHCI_INTEL_HOST)
+- timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
+- else
+- timeout_ns = udev->u1_params.sel;
+-
+ /* The U1 timeout is encoded in 1us intervals.
+ * Don't return a timeout of zero, because that's USB3_LPM_DISABLED.
+ */
+@@ -4622,19 +4622,19 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci,
+ {
+ unsigned long long timeout_ns;
+
++ if (xhci->quirks & XHCI_INTEL_HOST)
++ timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
++ else
++ timeout_ns = udev->u2_params.sel;
++
+ /* Prevent U2 if service interval is shorter than U2 exit latency */
+ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
+- if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) {
++ if (xhci_service_interval_to_ns(desc) <= timeout_ns) {
+ dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n");
+ return USB3_LPM_DISABLED;
+ }
+ }
+
+- if (xhci->quirks & XHCI_INTEL_HOST)
+- timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
+- else
+- timeout_ns = udev->u2_params.sel;
+-
+ /* The U2 timeout is encoded in 256us intervals */
+ timeout_ns = DIV_ROUND_UP_ULL(timeout_ns, 256 * 1000);
+ /* If the necessary timeout value is bigger than what we can set in the
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index 785080f790738..08b72bb22b7ef 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -497,6 +497,9 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
+ timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
+ finish_wait(&dev->waitq, &wait);
+
++ /* make sure URB is idle after timeout or (spurious) CMD_ACK */
++ usb_kill_urb(dev->cntl_urb);
++
+ mutex_unlock(&dev->io_mutex);
+
+ if (retval < 0) {
+diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
+index 734f18d0a7f73..6dc93652afc18 100644
+--- a/drivers/usb/serial/iuu_phoenix.c
++++ b/drivers/usb/serial/iuu_phoenix.c
+@@ -536,23 +536,29 @@ static int iuu_uart_flush(struct usb_serial_port *port)
+ struct device *dev = &port->dev;
+ int i;
+ int status;
+- u8 rxcmd = IUU_UART_RX;
++ u8 *rxcmd;
+ struct iuu_private *priv = usb_get_serial_port_data(port);
+
+ if (iuu_led(port, 0xF000, 0, 0, 0xFF) < 0)
+ return -EIO;
+
++ rxcmd = kmalloc(1, GFP_KERNEL);
++ if (!rxcmd)
++ return -ENOMEM;
++
++ rxcmd[0] = IUU_UART_RX;
++
+ for (i = 0; i < 2; i++) {
+- status = bulk_immediate(port, &rxcmd, 1);
++ status = bulk_immediate(port, rxcmd, 1);
+ if (status != IUU_OPERATION_OK) {
+ dev_dbg(dev, "%s - uart_flush_write error\n", __func__);
+- return status;
++ goto out_free;
+ }
+
+ status = read_immediate(port, &priv->len, 1);
+ if (status != IUU_OPERATION_OK) {
+ dev_dbg(dev, "%s - uart_flush_read error\n", __func__);
+- return status;
++ goto out_free;
+ }
+
+ if (priv->len > 0) {
+@@ -560,12 +566,16 @@ static int iuu_uart_flush(struct usb_serial_port *port)
+ status = read_immediate(port, priv->buf, priv->len);
+ if (status != IUU_OPERATION_OK) {
+ dev_dbg(dev, "%s - uart_flush_read error\n", __func__);
+- return status;
++ goto out_free;
+ }
+ }
+ }
+ dev_dbg(dev, "%s - uart_flush_read OK!\n", __func__);
+ iuu_led(port, 0, 0xF000, 0, 0xFF);
++
++out_free:
++ kfree(rxcmd);
++
+ return status;
+ }
+
+diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
+index e7a2aa1747db1..766969cf72b2d 100644
+--- a/drivers/usb/serial/keyspan_pda.c
++++ b/drivers/usb/serial/keyspan_pda.c
+@@ -555,10 +555,8 @@ exit:
+ static void keyspan_pda_write_bulk_callback(struct urb *urb)
+ {
+ struct usb_serial_port *port = urb->context;
+- struct keyspan_pda_private *priv;
+
+ set_bit(0, &port->write_urbs_free);
+- priv = usb_get_serial_port_data(port);
+
+ /* queue up a wakeup at scheduler time */
+ usb_serial_port_softint(port);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 6fd6012ad7b3a..1024aca252210 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1117,6 +1117,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0xff, 0x30) }, /* EM160R-GL */
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
+@@ -2057,6 +2059,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */
+ .driver_info = RSVD(6) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
++ { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 749c69be091cc..cb7b15ecb7aba 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -90,6 +90,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_BROKEN_FUA),
+
++/* Reported-by: Thinh Nguyen <thinhn@synopsys.com> */
++UNUSUAL_DEV(0x154b, 0xf00b, 0x0000, 0x9999,
++ "PNY",
++ "Pro Elite SSD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_ATA_1X),
++
+ /* Reported-by: Thinh Nguyen <thinhn@synopsys.com> */
+ UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999,
+ "PNY",
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index d5a036bf904bc..0909cfcbf7205 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -396,6 +396,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ default:
+ usbip_dbg_vhci_rh(" ClearPortFeature: default %x\n",
+ wValue);
++ if (wValue >= 32)
++ goto error;
+ vhci_hcd->port_status[rhport] &= ~(1 << wValue);
+ break;
+ }
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index 88c8c158ec25c..0c7bbc92b22a9 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -613,6 +613,7 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock)
+ size_t len, total_len = 0;
+ int err;
+ struct vhost_net_ubuf_ref *uninitialized_var(ubufs);
++ struct ubuf_info *ubuf;
+ bool zcopy_used;
+ int sent_pkts = 0;
+
+@@ -645,9 +646,7 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock)
+
+ /* use msg_control to pass vhost zerocopy ubuf info to skb */
+ if (zcopy_used) {
+- struct ubuf_info *ubuf;
+ ubuf = nvq->ubuf_info + nvq->upend_idx;
+-
+ vq->heads[nvq->upend_idx].id = cpu_to_vhost32(vq, head);
+ vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS;
+ ubuf->callback = vhost_zerocopy_callback;
+@@ -675,7 +674,8 @@ static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock)
+ err = sock->ops->sendmsg(sock, &msg, len);
+ if (unlikely(err < 0)) {
+ if (zcopy_used) {
+- vhost_net_ubuf_put(ubufs);
++ if (vq->heads[ubuf->desc].len == VHOST_DMA_IN_PROGRESS)
++ vhost_net_ubuf_put(ubufs);
+ nvq->upend_idx = ((unsigned)nvq->upend_idx - 1)
+ % UIO_MAXIOV;
+ }
+diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
+index 56e70f12c9960..c907f96d6890c 100644
+--- a/drivers/video/fbdev/hyperv_fb.c
++++ b/drivers/video/fbdev/hyperv_fb.c
+@@ -713,11 +713,9 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
+ }
+
+ /*
+- * Map the VRAM cacheable for performance. This is also required for
+- * VM Connect to display properly for ARM64 Linux VM, as the host also
+- * maps the VRAM cacheable.
++ * Map the VRAM cacheable for performance.
+ */
+- fb_virt = ioremap_cache(par->mem->start, screen_fb_size);
++ fb_virt = ioremap_wc(par->mem->start, screen_fb_size);
+ if (!fb_virt)
+ goto err2;
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index ed61c0daef416..128398dde0816 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -238,6 +238,7 @@ struct waiting_dir_move {
+ * after this directory is moved, we can try to rmdir the ino rmdir_ino.
+ */
+ u64 rmdir_ino;
++ u64 rmdir_gen;
+ bool orphanized;
+ };
+
+@@ -308,7 +309,7 @@ static int is_waiting_for_move(struct send_ctx *sctx, u64 ino);
+ static struct waiting_dir_move *
+ get_waiting_dir_move(struct send_ctx *sctx, u64 ino);
+
+-static int is_waiting_for_rm(struct send_ctx *sctx, u64 dir_ino);
++static int is_waiting_for_rm(struct send_ctx *sctx, u64 dir_ino, u64 gen);
+
+ static int need_send_hole(struct send_ctx *sctx)
+ {
+@@ -2304,7 +2305,7 @@ static int get_cur_path(struct send_ctx *sctx, u64 ino, u64 gen,
+
+ fs_path_reset(name);
+
+- if (is_waiting_for_rm(sctx, ino)) {
++ if (is_waiting_for_rm(sctx, ino, gen)) {
+ ret = gen_unique_name(sctx, ino, gen, name);
+ if (ret < 0)
+ goto out;
+@@ -2863,8 +2864,8 @@ out:
+ return ret;
+ }
+
+-static struct orphan_dir_info *
+-add_orphan_dir_info(struct send_ctx *sctx, u64 dir_ino)
++static struct orphan_dir_info *add_orphan_dir_info(struct send_ctx *sctx,
++ u64 dir_ino, u64 dir_gen)
+ {
+ struct rb_node **p = &sctx->orphan_dirs.rb_node;
+ struct rb_node *parent = NULL;
+@@ -2873,20 +2874,23 @@ add_orphan_dir_info(struct send_ctx *sctx, u64 dir_ino)
+ while (*p) {
+ parent = *p;
+ entry = rb_entry(parent, struct orphan_dir_info, node);
+- if (dir_ino < entry->ino) {
++ if (dir_ino < entry->ino)
+ p = &(*p)->rb_left;
+- } else if (dir_ino > entry->ino) {
++ else if (dir_ino > entry->ino)
+ p = &(*p)->rb_right;
+- } else {
++ else if (dir_gen < entry->gen)
++ p = &(*p)->rb_left;
++ else if (dir_gen > entry->gen)
++ p = &(*p)->rb_right;
++ else
+ return entry;
+- }
+ }
+
+ odi = kmalloc(sizeof(*odi), GFP_KERNEL);
+ if (!odi)
+ return ERR_PTR(-ENOMEM);
+ odi->ino = dir_ino;
+- odi->gen = 0;
++ odi->gen = dir_gen;
+ odi->last_dir_index_offset = 0;
+
+ rb_link_node(&odi->node, parent, p);
+@@ -2894,8 +2898,8 @@ add_orphan_dir_info(struct send_ctx *sctx, u64 dir_ino)
+ return odi;
+ }
+
+-static struct orphan_dir_info *
+-get_orphan_dir_info(struct send_ctx *sctx, u64 dir_ino)
++static struct orphan_dir_info *get_orphan_dir_info(struct send_ctx *sctx,
++ u64 dir_ino, u64 gen)
+ {
+ struct rb_node *n = sctx->orphan_dirs.rb_node;
+ struct orphan_dir_info *entry;
+@@ -2906,15 +2910,19 @@ get_orphan_dir_info(struct send_ctx *sctx, u64 dir_ino)
+ n = n->rb_left;
+ else if (dir_ino > entry->ino)
+ n = n->rb_right;
++ else if (gen < entry->gen)
++ n = n->rb_left;
++ else if (gen > entry->gen)
++ n = n->rb_right;
+ else
+ return entry;
+ }
+ return NULL;
+ }
+
+-static int is_waiting_for_rm(struct send_ctx *sctx, u64 dir_ino)
++static int is_waiting_for_rm(struct send_ctx *sctx, u64 dir_ino, u64 gen)
+ {
+- struct orphan_dir_info *odi = get_orphan_dir_info(sctx, dir_ino);
++ struct orphan_dir_info *odi = get_orphan_dir_info(sctx, dir_ino, gen);
+
+ return odi != NULL;
+ }
+@@ -2959,7 +2967,7 @@ static int can_rmdir(struct send_ctx *sctx, u64 dir, u64 dir_gen,
+ key.type = BTRFS_DIR_INDEX_KEY;
+ key.offset = 0;
+
+- odi = get_orphan_dir_info(sctx, dir);
++ odi = get_orphan_dir_info(sctx, dir, dir_gen);
+ if (odi)
+ key.offset = odi->last_dir_index_offset;
+
+@@ -2990,7 +2998,7 @@ static int can_rmdir(struct send_ctx *sctx, u64 dir, u64 dir_gen,
+
+ dm = get_waiting_dir_move(sctx, loc.objectid);
+ if (dm) {
+- odi = add_orphan_dir_info(sctx, dir);
++ odi = add_orphan_dir_info(sctx, dir, dir_gen);
+ if (IS_ERR(odi)) {
+ ret = PTR_ERR(odi);
+ goto out;
+@@ -2998,12 +3006,13 @@ static int can_rmdir(struct send_ctx *sctx, u64 dir, u64 dir_gen,
+ odi->gen = dir_gen;
+ odi->last_dir_index_offset = found_key.offset;
+ dm->rmdir_ino = dir;
++ dm->rmdir_gen = dir_gen;
+ ret = 0;
+ goto out;
+ }
+
+ if (loc.objectid > send_progress) {
+- odi = add_orphan_dir_info(sctx, dir);
++ odi = add_orphan_dir_info(sctx, dir, dir_gen);
+ if (IS_ERR(odi)) {
+ ret = PTR_ERR(odi);
+ goto out;
+@@ -3043,6 +3052,7 @@ static int add_waiting_dir_move(struct send_ctx *sctx, u64 ino, bool orphanized)
+ return -ENOMEM;
+ dm->ino = ino;
+ dm->rmdir_ino = 0;
++ dm->rmdir_gen = 0;
+ dm->orphanized = orphanized;
+
+ while (*p) {
+@@ -3188,7 +3198,7 @@ static int path_loop(struct send_ctx *sctx, struct fs_path *name,
+ while (ino != BTRFS_FIRST_FREE_OBJECTID) {
+ fs_path_reset(name);
+
+- if (is_waiting_for_rm(sctx, ino))
++ if (is_waiting_for_rm(sctx, ino, gen))
+ break;
+ if (is_waiting_for_move(sctx, ino)) {
+ if (*ancestor_ino == 0)
+@@ -3228,6 +3238,7 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
+ u64 parent_ino, parent_gen;
+ struct waiting_dir_move *dm = NULL;
+ u64 rmdir_ino = 0;
++ u64 rmdir_gen;
+ u64 ancestor;
+ bool is_orphan;
+ int ret;
+@@ -3242,6 +3253,7 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
+ dm = get_waiting_dir_move(sctx, pm->ino);
+ ASSERT(dm);
+ rmdir_ino = dm->rmdir_ino;
++ rmdir_gen = dm->rmdir_gen;
+ is_orphan = dm->orphanized;
+ free_waiting_dir_move(sctx, dm);
+
+@@ -3278,6 +3290,7 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
+ dm = get_waiting_dir_move(sctx, pm->ino);
+ ASSERT(dm);
+ dm->rmdir_ino = rmdir_ino;
++ dm->rmdir_gen = rmdir_gen;
+ }
+ goto out;
+ }
+@@ -3296,7 +3309,7 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
+ struct orphan_dir_info *odi;
+ u64 gen;
+
+- odi = get_orphan_dir_info(sctx, rmdir_ino);
++ odi = get_orphan_dir_info(sctx, rmdir_ino, rmdir_gen);
+ if (!odi) {
+ /* already deleted */
+ goto finish;
+diff --git a/fs/proc/generic.c b/fs/proc/generic.c
+index e39bac94dead0..bab10368a04d8 100644
+--- a/fs/proc/generic.c
++++ b/fs/proc/generic.c
+@@ -137,8 +137,12 @@ static int proc_getattr(const struct path *path, struct kstat *stat,
+ {
+ struct inode *inode = d_inode(path->dentry);
+ struct proc_dir_entry *de = PDE(inode);
+- if (de && de->nlink)
+- set_nlink(inode, de->nlink);
++ if (de) {
++ nlink_t nlink = READ_ONCE(de->nlink);
++ if (nlink > 0) {
++ set_nlink(inode, nlink);
++ }
++ }
+
+ generic_fillattr(inode, stat);
+ return 0;
+@@ -337,6 +341,16 @@ static const struct file_operations proc_dir_operations = {
+ .iterate_shared = proc_readdir,
+ };
+
++static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags)
++{
++ return 0;
++}
++
++const struct dentry_operations proc_net_dentry_ops = {
++ .d_revalidate = proc_net_d_revalidate,
++ .d_delete = always_delete_dentry,
++};
++
+ /*
+ * proc directories can do almost nothing..
+ */
+@@ -361,6 +375,7 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
+ write_unlock(&proc_subdir_lock);
+ goto out_free_inum;
+ }
++ dir->nlink++;
+ write_unlock(&proc_subdir_lock);
+
+ return dp;
+@@ -458,8 +473,8 @@ struct proc_dir_entry *proc_symlink(const char *name,
+ }
+ EXPORT_SYMBOL(proc_symlink);
+
+-struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode,
+- struct proc_dir_entry *parent, void *data)
++struct proc_dir_entry *_proc_mkdir(const char *name, umode_t mode,
++ struct proc_dir_entry *parent, void *data, bool force_lookup)
+ {
+ struct proc_dir_entry *ent;
+
+@@ -471,13 +486,20 @@ struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode,
+ ent->data = data;
+ ent->proc_fops = &proc_dir_operations;
+ ent->proc_iops = &proc_dir_inode_operations;
+- parent->nlink++;
++ if (force_lookup) {
++ pde_force_lookup(ent);
++ }
+ ent = proc_register(parent, ent);
+- if (!ent)
+- parent->nlink--;
+ }
+ return ent;
+ }
++EXPORT_SYMBOL_GPL(_proc_mkdir);
++
++struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode,
++ struct proc_dir_entry *parent, void *data)
++{
++ return _proc_mkdir(name, mode, parent, data, false);
++}
+ EXPORT_SYMBOL_GPL(proc_mkdir_data);
+
+ struct proc_dir_entry *proc_mkdir_mode(const char *name, umode_t mode,
+@@ -504,10 +526,7 @@ struct proc_dir_entry *proc_create_mount_point(const char *name)
+ ent->data = NULL;
+ ent->proc_fops = NULL;
+ ent->proc_iops = NULL;
+- parent->nlink++;
+ ent = proc_register(parent, ent);
+- if (!ent)
+- parent->nlink--;
+ }
+ return ent;
+ }
+@@ -665,8 +684,12 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
+ len = strlen(fn);
+
+ de = pde_subdir_find(parent, fn, len);
+- if (de)
++ if (de) {
+ rb_erase(&de->subdir_node, &parent->subdir);
++ if (S_ISDIR(de->mode)) {
++ parent->nlink--;
++ }
++ }
+ write_unlock(&proc_subdir_lock);
+ if (!de) {
+ WARN(1, "name '%s'\n", name);
+@@ -675,9 +698,6 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
+
+ proc_entry_rundown(de);
+
+- if (S_ISDIR(de->mode))
+- parent->nlink--;
+- de->nlink = 0;
+ WARN(pde_subdir_first(de),
+ "%s: removing non-empty directory '%s/%s', leaking at least '%s'\n",
+ __func__, de->parent->name, de->name, pde_subdir_first(de)->name);
+@@ -713,13 +733,12 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent)
+ de = next;
+ continue;
+ }
+- write_unlock(&proc_subdir_lock);
+-
+- proc_entry_rundown(de);
+ next = de->parent;
+ if (S_ISDIR(de->mode))
+ next->nlink--;
+- de->nlink = 0;
++ write_unlock(&proc_subdir_lock);
++
++ proc_entry_rundown(de);
+ if (de == root)
+ break;
+ pde_put(de);
+diff --git a/fs/proc/internal.h b/fs/proc/internal.h
+index 95b14196f2842..4f14906ef16b5 100644
+--- a/fs/proc/internal.h
++++ b/fs/proc/internal.h
+@@ -305,3 +305,10 @@ extern unsigned long task_statm(struct mm_struct *,
+ unsigned long *, unsigned long *,
+ unsigned long *, unsigned long *);
+ extern void task_mem(struct seq_file *, struct mm_struct *);
++
++extern const struct dentry_operations proc_net_dentry_ops;
++static inline void pde_force_lookup(struct proc_dir_entry *pde)
++{
++ /* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */
++ pde->proc_dops = &proc_net_dentry_ops;
++}
+diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
+index a7b12435519e0..096bcc1e7a8a5 100644
+--- a/fs/proc/proc_net.c
++++ b/fs/proc/proc_net.c
+@@ -38,22 +38,6 @@ static struct net *get_proc_net(const struct inode *inode)
+ return maybe_get_net(PDE_NET(PDE(inode)));
+ }
+
+-static int proc_net_d_revalidate(struct dentry *dentry, unsigned int flags)
+-{
+- return 0;
+-}
+-
+-static const struct dentry_operations proc_net_dentry_ops = {
+- .d_revalidate = proc_net_d_revalidate,
+- .d_delete = always_delete_dentry,
+-};
+-
+-static void pde_force_lookup(struct proc_dir_entry *pde)
+-{
+- /* /proc/net/ entries can be changed under us by setns(CLONE_NEWNET) */
+- pde->proc_dops = &proc_net_dentry_ops;
+-}
+-
+ static int seq_open_net(struct inode *inode, struct file *file)
+ {
+ unsigned int state_size = PDE(inode)->state_size;
+diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
+index d0e1f1522a78e..5141657a0f7f6 100644
+--- a/include/linux/proc_fs.h
++++ b/include/linux/proc_fs.h
+@@ -21,6 +21,7 @@ extern void proc_flush_task(struct task_struct *);
+
+ extern struct proc_dir_entry *proc_symlink(const char *,
+ struct proc_dir_entry *, const char *);
++struct proc_dir_entry *_proc_mkdir(const char *, umode_t, struct proc_dir_entry *, void *, bool);
+ extern struct proc_dir_entry *proc_mkdir(const char *, struct proc_dir_entry *);
+ extern struct proc_dir_entry *proc_mkdir_data(const char *, umode_t,
+ struct proc_dir_entry *, void *);
+@@ -89,6 +90,11 @@ static inline struct proc_dir_entry *proc_symlink(const char *name,
+ static inline struct proc_dir_entry *proc_mkdir(const char *name,
+ struct proc_dir_entry *parent) {return NULL;}
+ static inline struct proc_dir_entry *proc_create_mount_point(const char *name) { return NULL; }
++static inline struct proc_dir_entry *_proc_mkdir(const char *name, umode_t mode,
++ struct proc_dir_entry *parent, void *data, bool force_lookup)
++{
++ return NULL;
++}
+ static inline struct proc_dir_entry *proc_mkdir_data(const char *name,
+ umode_t mode, struct proc_dir_entry *parent, void *data) { return NULL; }
+ static inline struct proc_dir_entry *proc_mkdir_mode(const char *name,
+@@ -121,7 +127,7 @@ struct net;
+ static inline struct proc_dir_entry *proc_net_mkdir(
+ struct net *net, const char *name, struct proc_dir_entry *parent)
+ {
+- return proc_mkdir_data(name, 0, parent, net);
++ return _proc_mkdir(name, 0, parent, net, true);
+ }
+
+ struct ns_common;
+diff --git a/include/net/red.h b/include/net/red.h
+index 9665582c4687e..e21e7fd4fe077 100644
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -168,12 +168,14 @@ static inline void red_set_vars(struct red_vars *v)
+ v->qcount = -1;
+ }
+
+-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog)
++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log)
+ {
+ if (fls(qth_min) + Wlog > 32)
+ return false;
+ if (fls(qth_max) + Wlog > 32)
+ return false;
++ if (Scell_log >= 32)
++ return false;
+ if (qth_max < qth_min)
+ return false;
+ return true;
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index eef77c82d2e19..cd98ef48345e1 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -3554,17 +3554,24 @@ static void pwq_adjust_max_active(struct pool_workqueue *pwq)
+ * is updated and visible.
+ */
+ if (!freezable || !workqueue_freezing) {
++ bool kick = false;
++
+ pwq->max_active = wq->saved_max_active;
+
+ while (!list_empty(&pwq->delayed_works) &&
+- pwq->nr_active < pwq->max_active)
++ pwq->nr_active < pwq->max_active) {
+ pwq_activate_first_delayed(pwq);
++ kick = true;
++ }
+
+ /*
+ * Need to kick a worker after thawed or an unbound wq's
+- * max_active is bumped. It's a slow path. Do it always.
++ * max_active is bumped. In realtime scenarios, always kicking a
++ * worker will cause interference on the isolated cpu cores, so
++ * let's kick iff work items were activated.
+ */
+- wake_up_worker(pwq->pool);
++ if (kick)
++ wake_up_worker(pwq->pool);
+ } else {
+ pwq->max_active = 0;
+ }
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index 7e85d1e37a6ea..0b8ee173cf3a6 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -83,14 +83,14 @@ static int clear_bits_ll(unsigned long *addr, unsigned long mask_to_clear)
+ * users set the same bit, one user will return remain bits, otherwise
+ * return 0.
+ */
+-static int bitmap_set_ll(unsigned long *map, int start, int nr)
++static int bitmap_set_ll(unsigned long *map, unsigned long start, unsigned long nr)
+ {
+ unsigned long *p = map + BIT_WORD(start);
+- const int size = start + nr;
++ const unsigned long size = start + nr;
+ int bits_to_set = BITS_PER_LONG - (start % BITS_PER_LONG);
+ unsigned long mask_to_set = BITMAP_FIRST_WORD_MASK(start);
+
+- while (nr - bits_to_set >= 0) {
++ while (nr >= bits_to_set) {
+ if (set_bits_ll(p, mask_to_set))
+ return nr;
+ nr -= bits_to_set;
+@@ -118,14 +118,15 @@ static int bitmap_set_ll(unsigned long *map, int start, int nr)
+ * users clear the same bit, one user will return remain bits,
+ * otherwise return 0.
+ */
+-static int bitmap_clear_ll(unsigned long *map, int start, int nr)
++static unsigned long
++bitmap_clear_ll(unsigned long *map, unsigned long start, unsigned long nr)
+ {
+ unsigned long *p = map + BIT_WORD(start);
+- const int size = start + nr;
++ const unsigned long size = start + nr;
+ int bits_to_clear = BITS_PER_LONG - (start % BITS_PER_LONG);
+ unsigned long mask_to_clear = BITMAP_FIRST_WORD_MASK(start);
+
+- while (nr - bits_to_clear >= 0) {
++ while (nr >= bits_to_clear) {
+ if (clear_bits_ll(p, mask_to_clear))
+ return nr;
+ nr -= bits_to_clear;
+@@ -184,8 +185,8 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
+ size_t size, int nid)
+ {
+ struct gen_pool_chunk *chunk;
+- int nbits = size >> pool->min_alloc_order;
+- int nbytes = sizeof(struct gen_pool_chunk) +
++ unsigned long nbits = size >> pool->min_alloc_order;
++ unsigned long nbytes = sizeof(struct gen_pool_chunk) +
+ BITS_TO_LONGS(nbits) * sizeof(long);
+
+ chunk = vzalloc_node(nbytes, nid);
+@@ -242,7 +243,7 @@ void gen_pool_destroy(struct gen_pool *pool)
+ struct list_head *_chunk, *_next_chunk;
+ struct gen_pool_chunk *chunk;
+ int order = pool->min_alloc_order;
+- int bit, end_bit;
++ unsigned long bit, end_bit;
+
+ list_for_each_safe(_chunk, _next_chunk, &pool->chunks) {
+ chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk);
+@@ -293,7 +294,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
+ struct gen_pool_chunk *chunk;
+ unsigned long addr = 0;
+ int order = pool->min_alloc_order;
+- int nbits, start_bit, end_bit, remain;
++ unsigned long nbits, start_bit, end_bit, remain;
+
+ #ifndef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG
+ BUG_ON(in_nmi());
+@@ -376,7 +377,7 @@ void gen_pool_free(struct gen_pool *pool, unsigned long addr, size_t size)
+ {
+ struct gen_pool_chunk *chunk;
+ int order = pool->min_alloc_order;
+- int start_bit, nbits, remain;
++ unsigned long start_bit, nbits, remain;
+
+ #ifndef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG
+ BUG_ON(in_nmi());
+@@ -638,7 +639,7 @@ unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
+ index = bitmap_find_next_zero_area(map, size, start, nr, 0);
+
+ while (index < size) {
+- int next_bit = find_next_bit(map, size, index + nr);
++ unsigned long next_bit = find_next_bit(map, size, index + nr);
+ if ((next_bit - index) < len) {
+ len = next_bit - index;
+ start_bit = index;
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index 001d7f07e7803..fe0d255d66c8b 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1244,8 +1244,8 @@ static const struct attribute_group dql_group = {
+ static ssize_t xps_cpus_show(struct netdev_queue *queue,
+ char *buf)
+ {
++ int cpu, len, ret, num_tc = 1, tc = 0;
+ struct net_device *dev = queue->dev;
+- int cpu, len, num_tc = 1, tc = 0;
+ struct xps_dev_maps *dev_maps;
+ cpumask_var_t mask;
+ unsigned long index;
+@@ -1255,22 +1255,31 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue,
+
+ index = get_netdev_queue_index(queue);
+
++ if (!rtnl_trylock())
++ return restart_syscall();
++
+ if (dev->num_tc) {
+ /* Do not allow XPS on subordinate device directly */
+ num_tc = dev->num_tc;
+- if (num_tc < 0)
+- return -EINVAL;
++ if (num_tc < 0) {
++ ret = -EINVAL;
++ goto err_rtnl_unlock;
++ }
+
+ /* If queue belongs to subordinate dev use its map */
+ dev = netdev_get_tx_queue(dev, index)->sb_dev ? : dev;
+
+ tc = netdev_txq_to_tc(dev, index);
+- if (tc < 0)
+- return -EINVAL;
++ if (tc < 0) {
++ ret = -EINVAL;
++ goto err_rtnl_unlock;
++ }
+ }
+
+- if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+- return -ENOMEM;
++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) {
++ ret = -ENOMEM;
++ goto err_rtnl_unlock;
++ }
+
+ rcu_read_lock();
+ dev_maps = rcu_dereference(dev->xps_cpus_map);
+@@ -1293,9 +1302,15 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue,
+ }
+ rcu_read_unlock();
+
++ rtnl_unlock();
++
+ len = snprintf(buf, PAGE_SIZE, "%*pb\n", cpumask_pr_args(mask));
+ free_cpumask_var(mask);
+ return len < PAGE_SIZE ? len : -EINVAL;
++
++err_rtnl_unlock:
++ rtnl_unlock();
++ return ret;
+ }
+
+ static ssize_t xps_cpus_store(struct netdev_queue *queue,
+@@ -1323,7 +1338,13 @@ static ssize_t xps_cpus_store(struct netdev_queue *queue,
+ return err;
+ }
+
++ if (!rtnl_trylock()) {
++ free_cpumask_var(mask);
++ return restart_syscall();
++ }
++
+ err = netif_set_xps_queue(dev, mask, index);
++ rtnl_unlock();
+
+ free_cpumask_var(mask);
+
+@@ -1335,23 +1356,30 @@ static struct netdev_queue_attribute xps_cpus_attribute __ro_after_init
+
+ static ssize_t xps_rxqs_show(struct netdev_queue *queue, char *buf)
+ {
++ int j, len, ret, num_tc = 1, tc = 0;
+ struct net_device *dev = queue->dev;
+ struct xps_dev_maps *dev_maps;
+ unsigned long *mask, index;
+- int j, len, num_tc = 1, tc = 0;
+
+ index = get_netdev_queue_index(queue);
+
++ if (!rtnl_trylock())
++ return restart_syscall();
++
+ if (dev->num_tc) {
+ num_tc = dev->num_tc;
+ tc = netdev_txq_to_tc(dev, index);
+- if (tc < 0)
+- return -EINVAL;
++ if (tc < 0) {
++ ret = -EINVAL;
++ goto err_rtnl_unlock;
++ }
+ }
+ mask = kcalloc(BITS_TO_LONGS(dev->num_rx_queues), sizeof(long),
+ GFP_KERNEL);
+- if (!mask)
+- return -ENOMEM;
++ if (!mask) {
++ ret = -ENOMEM;
++ goto err_rtnl_unlock;
++ }
+
+ rcu_read_lock();
+ dev_maps = rcu_dereference(dev->xps_rxqs_map);
+@@ -1377,10 +1405,16 @@ static ssize_t xps_rxqs_show(struct netdev_queue *queue, char *buf)
+ out_no_maps:
+ rcu_read_unlock();
+
++ rtnl_unlock();
++
+ len = bitmap_print_to_pagebuf(false, buf, mask, dev->num_rx_queues);
+ kfree(mask);
+
+ return len < PAGE_SIZE ? len : -EINVAL;
++
++err_rtnl_unlock:
++ rtnl_unlock();
++ return ret;
+ }
+
+ static ssize_t xps_rxqs_store(struct netdev_queue *queue, const char *buf,
+@@ -1407,10 +1441,17 @@ static ssize_t xps_rxqs_store(struct netdev_queue *queue, const char *buf,
+ return err;
+ }
+
++ if (!rtnl_trylock()) {
++ bitmap_free(mask);
++ return restart_syscall();
++ }
++
+ cpus_read_lock();
+ err = __netif_set_xps_queue(dev, mask, index, true);
+ cpus_read_unlock();
+
++ rtnl_unlock();
++
+ kfree(mask);
+ return err ? : len;
+ }
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 7f4ec36e5f705..b96aa88087be1 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -302,7 +302,7 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
+ .flowi4_iif = LOOPBACK_IFINDEX,
+ .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
+ .daddr = ip_hdr(skb)->saddr,
+- .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
++ .flowi4_tos = ip_hdr(skb)->tos & IPTOS_RT_MASK,
+ .flowi4_scope = scope,
+ .flowi4_mark = vmark ? skb->mark : 0,
+ };
+diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
+index ad9ea82daeb3a..9376b30cf626e 100644
+--- a/net/ipv4/gre_demux.c
++++ b/net/ipv4/gre_demux.c
+@@ -133,7 +133,7 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ * to 0 and sets the configured key in the
+ * inner erspan header field
+ */
+- if (greh->protocol == htons(ETH_P_ERSPAN) ||
++ if ((greh->protocol == htons(ETH_P_ERSPAN) && hdr_len != 4) ||
+ greh->protocol == htons(ETH_P_ERSPAN2)) {
+ struct erspan_base_hdr *ershdr;
+
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index ca20efe775ee4..a2cae543a285a 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -1405,7 +1405,7 @@ static int compat_get_entries(struct net *net,
+ xt_compat_lock(NFPROTO_ARP);
+ t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+ struct xt_table_info info;
+
+ ret = compat_table_info(private, &info);
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index 115d48049686f..6672172a7512d 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -1619,7 +1619,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
+ xt_compat_lock(AF_INET);
+ t = xt_find_table_lock(net, AF_INET, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+ struct xt_table_info info;
+ ret = compat_table_info(private, &info);
+ if (!ret && get.size == info.size)
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index b1441349e1517..3b067d5a62ee0 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -1628,7 +1628,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
+ xt_compat_lock(AF_INET6);
+ t = xt_find_table_lock(net, AF_INET6, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = t->private;
++ const struct xt_table_info *private = xt_table_get_private_protected(t);
+ struct xt_table_info info;
+ ret = compat_table_info(private, &info);
+ if (!ret && get.size == info.size)
+diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
+index 930c1d3796f0f..a43c9a44f8701 100644
+--- a/net/ncsi/ncsi-rsp.c
++++ b/net/ncsi/ncsi-rsp.c
+@@ -949,7 +949,7 @@ int ncsi_rcv_rsp(struct sk_buff *skb, struct net_device *dev,
+ int payload, i, ret;
+
+ /* Find the NCSI device */
+- nd = ncsi_find_dev(dev);
++ nd = ncsi_find_dev(orig_dev);
+ ndp = nd ? TO_NCSI_DEV_PRIV(nd) : NULL;
+ if (!ndp)
+ return -ENODEV;
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index ddfe06d7530ba..154b40f2f2a8c 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -115,20 +115,6 @@ htable_size(u8 hbits)
+ return hsize * sizeof(struct hbucket *) + sizeof(struct htable);
+ }
+
+-/* Compute htable_bits from the user input parameter hashsize */
+-static u8
+-htable_bits(u32 hashsize)
+-{
+- /* Assume that hashsize == 2^htable_bits */
+- u8 bits = fls(hashsize - 1);
+-
+- if (jhash_size(bits) != hashsize)
+- /* Round up to the first 2^n value */
+- bits = fls(hashsize);
+-
+- return bits;
+-}
+-
+ #ifdef IP_SET_HASH_WITH_NETS
+ #if IPSET_NET_COUNT > 1
+ #define __CIDR(cidr, i) (cidr[i])
+@@ -1287,7 +1273,11 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
+ if (!h)
+ return -ENOMEM;
+
+- hbits = htable_bits(hashsize);
++ /* Compute htable_bits from the user input parameter hashsize.
++ * Assume that hashsize == 2^htable_bits,
++ * otherwise round up to the first 2^n value.
++ */
++ hbits = fls(hashsize - 1);
+ hsize = htable_size(hbits);
+ if (hsize == 0) {
+ kfree(h);
+diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
+index 9e05c86ba5c45..932c0ae99bdcf 100644
+--- a/net/netfilter/xt_RATEEST.c
++++ b/net/netfilter/xt_RATEEST.c
+@@ -118,6 +118,9 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
+ } cfg;
+ int ret;
+
++ if (strnlen(info->name, sizeof(est->name)) >= sizeof(est->name))
++ return -ENAMETOOLONG;
++
+ net_get_random_once(&jhash_rnd, sizeof(jhash_rnd));
+
+ mutex_lock(&xn->hash_lock);
+diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
+index 63bfceeb8e3cd..d058397d284bf 100644
+--- a/net/sched/sch_choke.c
++++ b/net/sched/sch_choke.c
+@@ -371,7 +371,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt,
+
+ ctl = nla_data(tb[TCA_CHOKE_PARMS]);
+
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+ return -EINVAL;
+
+ if (ctl->limit > CHOKE_MAX_QUEUE)
+diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
+index 4a042abf844c0..6f94bca75520b 100644
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -357,7 +357,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
+ struct gred_sched *table = qdisc_priv(sch);
+ struct gred_sched_data *q = table->tab[dp];
+
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+ return -EINVAL;
+
+ if (!q) {
+diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
+index 56c181c3feeb2..a3dc2118539b9 100644
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -214,7 +214,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt,
+ max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
+
+ ctl = nla_data(tb[TCA_RED_PARMS]);
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
+ return -EINVAL;
+
+ if (ctl->limit > 0) {
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index b89cf0971d3dd..74f697c4a4d30 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -651,7 +651,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
+ }
+
+ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
+- ctl_v1->Wlog))
++ ctl_v1->Wlog, ctl_v1->Scell_log))
+ return -EINVAL;
+ if (ctl_v1 && ctl_v1->qth_min) {
+ p = kmalloc(sizeof(*p), GFP_KERNEL);
+diff --git a/scripts/depmod.sh b/scripts/depmod.sh
+index e083bcae343f3..3643b4f896ede 100755
+--- a/scripts/depmod.sh
++++ b/scripts/depmod.sh
+@@ -15,6 +15,8 @@ if ! test -r System.map ; then
+ exit 0
+ fi
+
++# legacy behavior: "depmod" in /sbin, no /sbin in PATH
++PATH="$PATH:/sbin"
+ if [ -z $(command -v $DEPMOD) ]; then
+ echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2
+ echo "This is probably in the kmod package." >&2
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index d43245937db7e..2cd8bfd5293b9 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2328,8 +2328,6 @@ static struct snd_pci_quirk power_save_blacklist[] = {
+ SND_PCI_QUIRK(0x1849, 0x7662, "Asrock H81M-HDS", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+ SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0),
+- /* https://bugzilla.redhat.com/show_bug.cgi?id=1581607 */
+- SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+ SND_PCI_QUIRK(0x1558, 0x6504, "Clevo W65_67SB", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 78bb96263bc27..7d471ecc1ca03 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1088,6 +1088,7 @@ static int patch_conexant_auto(struct hda_codec *codec)
+ static const struct hda_device_id snd_hda_id_conexant[] = {
+ HDA_CODEC_ENTRY(0x14f11f86, "CX8070", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f12008, "CX8200", patch_conexant_auto),
++ HDA_CODEC_ENTRY(0x14f120d0, "CX11970", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f15045, "CX20549 (Venice)", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f15047, "CX20551 (Waikiki)", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f15051, "CX20561 (Hermosa)", patch_conexant_auto),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 37b2bcdb3d65a..9f0b05bcbd867 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5774,6 +5774,7 @@ enum {
+ ALC221_FIXUP_HP_FRONT_MIC,
+ ALC292_FIXUP_TPT460,
+ ALC298_FIXUP_SPK_VOLUME,
++ ALC298_FIXUP_LENOVO_SPK_VOLUME,
+ ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER,
+ ALC269_FIXUP_ATIV_BOOK_8,
+ ALC221_FIXUP_HP_MIC_NO_PRESENCE,
+@@ -6545,6 +6546,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
+ },
++ [ALC298_FIXUP_LENOVO_SPK_VOLUME] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc298_fixup_speaker_volume,
++ },
+ [ALC295_FIXUP_DISABLE_DAC3] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc295_fixup_disable_dac3,
+@@ -7220,6 +7225,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x3151, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3176, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940", ALC298_FIXUP_LENOVO_SPK_VOLUME),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index 6b9617aee0e69..11bf7ace5ab2d 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -1015,6 +1015,7 @@ static const struct hda_verb vt1802_init_verbs[] = {
+ enum {
+ VIA_FIXUP_INTMIC_BOOST,
+ VIA_FIXUP_ASUS_G75,
++ VIA_FIXUP_POWER_SAVE,
+ };
+
+ static void via_fixup_intmic_boost(struct hda_codec *codec,
+@@ -1024,6 +1025,13 @@ static void via_fixup_intmic_boost(struct hda_codec *codec,
+ override_mic_boost(codec, 0x30, 0, 2, 40);
+ }
+
++static void via_fixup_power_save(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PRE_PROBE)
++ codec->power_save_node = 0;
++}
++
+ static const struct hda_fixup via_fixups[] = {
+ [VIA_FIXUP_INTMIC_BOOST] = {
+ .type = HDA_FIXUP_FUNC,
+@@ -1038,11 +1046,16 @@ static const struct hda_fixup via_fixups[] = {
+ { }
+ }
+ },
++ [VIA_FIXUP_POWER_SAVE] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = via_fixup_power_save,
++ },
+ };
+
+ static const struct snd_pci_quirk vt2002p_fixups[] = {
+ SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75),
+ SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST),
++ SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", VIA_FIXUP_POWER_SAVE),
+ {}
+ };
+
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 137e1e8718d6f..26548f760bc1c 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1890,6 +1890,8 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi,
+ ms_ep = find_usb_ms_endpoint_descriptor(hostep);
+ if (!ms_ep)
+ continue;
++ if (ms_ep->bNumEmbMIDIJack > 0x10)
++ continue;
+ if (usb_endpoint_dir_out(ep)) {
+ if (endpoints[epidx].out_ep) {
+ if (++epidx >= MIDI_MAX_ENDPOINTS) {
+@@ -2142,6 +2144,8 @@ static int snd_usbmidi_detect_roland(struct snd_usb_midi *umidi,
+ cs_desc[1] == USB_DT_CS_INTERFACE &&
+ cs_desc[2] == 0xf1 &&
+ cs_desc[3] == 0x02) {
++ if (cs_desc[4] > 0x10 || cs_desc[5] > 0x10)
++ continue;
+ endpoint->in_cables = (1 << cs_desc[4]) - 1;
+ endpoint->out_cables = (1 << cs_desc[5]) - 1;
+ return snd_usbmidi_detect_endpoints(umidi, endpoint, 1);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-01-17 16:20 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-01-17 16:20 UTC (permalink / raw
To: gentoo-commits
commit: 66510528de196d19b9f5c80c95b1107cba3c02b9
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jan 17 16:20:19 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jan 17 16:20:19 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=66510528
Linux patch 4.19.168
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1167_linux-4.19.168.patch | 1123 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1127 insertions(+)
diff --git a/0000_README b/0000_README
index 5064804..48fd7f2 100644
--- a/0000_README
+++ b/0000_README
@@ -707,6 +707,10 @@ Patch: 1166_linux-4.19.167.patch
From: https://www.kernel.org
Desc: Linux 4.19.167
+Patch: 1167_linux-4.19.168.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.168
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1167_linux-4.19.168.patch b/1167_linux-4.19.168.patch
new file mode 100644
index 0000000..9a8864a
--- /dev/null
+++ b/1167_linux-4.19.168.patch
@@ -0,0 +1,1123 @@
+diff --git a/Makefile b/Makefile
+index 91a82c22a4749..3e44a813604eb 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 167
++SUBLEVEL = 168
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
+index 41c7b905980a9..23e8146b9b321 100644
+--- a/arch/arm/mach-omap2/omap_device.c
++++ b/arch/arm/mach-omap2/omap_device.c
+@@ -239,10 +239,12 @@ static int _omap_device_notifier_call(struct notifier_block *nb,
+ break;
+ case BUS_NOTIFY_BIND_DRIVER:
+ od = to_omap_device(pdev);
+- if (od && (od->_state == OMAP_DEVICE_STATE_ENABLED) &&
+- pm_runtime_status_suspended(dev)) {
++ if (od) {
+ od->_driver_status = BUS_NOTIFY_BIND_DRIVER;
+- pm_runtime_set_active(dev);
++ if (od->_state == OMAP_DEVICE_STATE_ENABLED &&
++ pm_runtime_status_suspended(dev)) {
++ pm_runtime_set_active(dev);
++ }
+ }
+ break;
+ case BUS_NOTIFY_ADD_DEVICE:
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+index 847b2d80ce870..fe97b2ad82b91 100644
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -619,6 +619,10 @@ static void reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
+ {
+ u64 pmcr, val;
+
++ /* No PMU available, PMCR_EL0 may UNDEF... */
++ if (!kvm_arm_support_pmu_v3())
++ return;
++
+ pmcr = read_sysreg(pmcr_el0);
+ /*
+ * Writable bits of PMCR_EL0 (ARMV8_PMU_PMCR_MASK) are reset to UNKNOWN
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index 12083f200e096..f406e3b85bdb2 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -533,85 +533,70 @@ static void rdtgroup_remove(struct rdtgroup *rdtgrp)
+ kfree(rdtgrp);
+ }
+
+-struct task_move_callback {
+- struct callback_head work;
+- struct rdtgroup *rdtgrp;
+-};
+-
+-static void move_myself(struct callback_head *head)
++static void _update_task_closid_rmid(void *task)
+ {
+- struct task_move_callback *callback;
+- struct rdtgroup *rdtgrp;
+-
+- callback = container_of(head, struct task_move_callback, work);
+- rdtgrp = callback->rdtgrp;
+-
+ /*
+- * If resource group was deleted before this task work callback
+- * was invoked, then assign the task to root group and free the
+- * resource group.
++ * If the task is still current on this CPU, update PQR_ASSOC MSR.
++ * Otherwise, the MSR is updated when the task is scheduled in.
+ */
+- if (atomic_dec_and_test(&rdtgrp->waitcount) &&
+- (rdtgrp->flags & RDT_DELETED)) {
+- current->closid = 0;
+- current->rmid = 0;
+- rdtgroup_remove(rdtgrp);
+- }
+-
+- preempt_disable();
+- /* update PQR_ASSOC MSR to make resource group go into effect */
+- intel_rdt_sched_in();
+- preempt_enable();
++ if (task == current)
++ intel_rdt_sched_in();
++}
+
+- kfree(callback);
++static void update_task_closid_rmid(struct task_struct *t)
++{
++ if (IS_ENABLED(CONFIG_SMP) && task_curr(t))
++ smp_call_function_single(task_cpu(t), _update_task_closid_rmid, t, 1);
++ else
++ _update_task_closid_rmid(t);
+ }
+
+ static int __rdtgroup_move_task(struct task_struct *tsk,
+ struct rdtgroup *rdtgrp)
+ {
+- struct task_move_callback *callback;
+- int ret;
+-
+- callback = kzalloc(sizeof(*callback), GFP_KERNEL);
+- if (!callback)
+- return -ENOMEM;
+- callback->work.func = move_myself;
+- callback->rdtgrp = rdtgrp;
++ /* If the task is already in rdtgrp, no need to move the task. */
++ if ((rdtgrp->type == RDTCTRL_GROUP && tsk->closid == rdtgrp->closid &&
++ tsk->rmid == rdtgrp->mon.rmid) ||
++ (rdtgrp->type == RDTMON_GROUP && tsk->rmid == rdtgrp->mon.rmid &&
++ tsk->closid == rdtgrp->mon.parent->closid))
++ return 0;
+
+ /*
+- * Take a refcount, so rdtgrp cannot be freed before the
+- * callback has been invoked.
++ * Set the task's closid/rmid before the PQR_ASSOC MSR can be
++ * updated by them.
++ *
++ * For ctrl_mon groups, move both closid and rmid.
++ * For monitor groups, can move the tasks only from
++ * their parent CTRL group.
+ */
+- atomic_inc(&rdtgrp->waitcount);
+- ret = task_work_add(tsk, &callback->work, true);
+- if (ret) {
+- /*
+- * Task is exiting. Drop the refcount and free the callback.
+- * No need to check the refcount as the group cannot be
+- * deleted before the write function unlocks rdtgroup_mutex.
+- */
+- atomic_dec(&rdtgrp->waitcount);
+- kfree(callback);
+- rdt_last_cmd_puts("task exited\n");
+- } else {
+- /*
+- * For ctrl_mon groups move both closid and rmid.
+- * For monitor groups, can move the tasks only from
+- * their parent CTRL group.
+- */
+- if (rdtgrp->type == RDTCTRL_GROUP) {
+- tsk->closid = rdtgrp->closid;
++
++ if (rdtgrp->type == RDTCTRL_GROUP) {
++ tsk->closid = rdtgrp->closid;
++ tsk->rmid = rdtgrp->mon.rmid;
++ } else if (rdtgrp->type == RDTMON_GROUP) {
++ if (rdtgrp->mon.parent->closid == tsk->closid) {
+ tsk->rmid = rdtgrp->mon.rmid;
+- } else if (rdtgrp->type == RDTMON_GROUP) {
+- if (rdtgrp->mon.parent->closid == tsk->closid) {
+- tsk->rmid = rdtgrp->mon.rmid;
+- } else {
+- rdt_last_cmd_puts("Can't move task to different control group\n");
+- ret = -EINVAL;
+- }
++ } else {
++ rdt_last_cmd_puts("Can't move task to different control group\n");
++ return -EINVAL;
+ }
+ }
+- return ret;
++
++ /*
++ * Ensure the task's closid and rmid are written before determining if
++ * the task is current that will decide if it will be interrupted.
++ */
++ barrier();
++
++ /*
++ * By now, the task's closid and rmid are set. If the task is current
++ * on a CPU, the PQR_ASSOC MSR needs to be updated to make the resource
++ * group go into effect. If the task is not current, the MSR will be
++ * updated when the task is scheduled in.
++ */
++ update_task_closid_rmid(tsk);
++
++ return 0;
+ }
+
+ /**
+diff --git a/block/genhd.c b/block/genhd.c
+index 2b2a936cf8480..2b536ab570ac1 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -208,14 +208,17 @@ struct hd_struct *disk_part_iter_next(struct disk_part_iter *piter)
+ part = rcu_dereference(ptbl->part[piter->idx]);
+ if (!part)
+ continue;
++ get_device(part_to_dev(part));
++ piter->part = part;
+ if (!part_nr_sects_read(part) &&
+ !(piter->flags & DISK_PITER_INCL_EMPTY) &&
+ !(piter->flags & DISK_PITER_INCL_EMPTY_PART0 &&
+- piter->idx == 0))
++ piter->idx == 0)) {
++ put_device(part_to_dev(part));
++ piter->part = NULL;
+ continue;
++ }
+
+- get_device(part_to_dev(part));
+- piter->part = part;
+ piter->idx += inc;
+ break;
+ }
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index 182b1908edec2..c9e5381a887bf 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -579,8 +579,12 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
+ devname = dev_name(map->dev);
+
+ if (name) {
+- map->debugfs_name = kasprintf(GFP_KERNEL, "%s-%s",
++ if (!map->debugfs_name) {
++ map->debugfs_name = kasprintf(GFP_KERNEL, "%s-%s",
+ devname, name);
++ if (!map->debugfs_name)
++ return;
++ }
+ name = map->debugfs_name;
+ } else {
+ name = devname;
+@@ -588,9 +592,10 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
+
+ if (!strcmp(name, "dummy")) {
+ kfree(map->debugfs_name);
+-
+ map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d",
+ dummy_index);
++ if (!map->debugfs_name)
++ return;
+ name = map->debugfs_name;
+ dummy_index++;
+ }
+diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
+index d4913516823f1..e101f286ac353 100644
+--- a/drivers/block/Kconfig
++++ b/drivers/block/Kconfig
+@@ -474,6 +474,7 @@ config BLK_DEV_RBD
+ config BLK_DEV_RSXX
+ tristate "IBM Flash Adapter 900GB Full Height PCIe Device Driver"
+ depends on PCI
++ select CRC32
+ help
+ Device driver for IBM's high speed PCIe SSD
+ storage device: Flash Adapter 900GB Full Height.
+diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
+index fb77b39a4ce36..818f92798fb9b 100644
+--- a/drivers/cpufreq/powernow-k8.c
++++ b/drivers/cpufreq/powernow-k8.c
+@@ -881,9 +881,9 @@ static int get_transition_latency(struct powernow_k8_data *data)
+
+ /* Take a frequency, and issue the fid/vid transition command */
+ static int transition_frequency_fidvid(struct powernow_k8_data *data,
+- unsigned int index)
++ unsigned int index,
++ struct cpufreq_policy *policy)
+ {
+- struct cpufreq_policy *policy;
+ u32 fid = 0;
+ u32 vid = 0;
+ int res;
+@@ -915,9 +915,6 @@ static int transition_frequency_fidvid(struct powernow_k8_data *data,
+ freqs.old = find_khz_freq_from_fid(data->currfid);
+ freqs.new = find_khz_freq_from_fid(fid);
+
+- policy = cpufreq_cpu_get(smp_processor_id());
+- cpufreq_cpu_put(policy);
+-
+ cpufreq_freq_transition_begin(policy, &freqs);
+ res = transition_fid_vid(data, fid, vid);
+ cpufreq_freq_transition_end(policy, &freqs, res);
+@@ -972,7 +969,7 @@ static long powernowk8_target_fn(void *arg)
+
+ powernow_k8_acpi_pst_values(data, newstate);
+
+- ret = transition_frequency_fidvid(data, newstate);
++ ret = transition_frequency_fidvid(data, newstate, pol);
+
+ if (ret) {
+ pr_err("transition frequency failed\n");
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index 35d6bd1b30993..fd3092a4378e4 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -581,7 +581,7 @@ static void chtls_reset_synq(struct listen_ctx *listen_ctx)
+
+ while (!skb_queue_empty(&listen_ctx->synq)) {
+ struct chtls_sock *csk =
+- container_of((struct synq *)__skb_dequeue
++ container_of((struct synq *)skb_peek
+ (&listen_ctx->synq), struct chtls_sock, synq);
+ struct sock *child = csk->sk;
+
+@@ -1024,6 +1024,7 @@ static struct sock *chtls_recv_sock(struct sock *lsk,
+ const struct cpl_pass_accept_req *req,
+ struct chtls_dev *cdev)
+ {
++ struct adapter *adap = pci_get_drvdata(cdev->pdev);
+ const struct tcphdr *tcph;
+ struct inet_sock *newinet;
+ const struct iphdr *iph;
+@@ -1033,9 +1034,10 @@ static struct sock *chtls_recv_sock(struct sock *lsk,
+ struct neighbour *n;
+ struct tcp_sock *tp;
+ struct sock *newsk;
++ bool found = false;
+ u16 port_id;
+ int rxq_idx;
+- int step;
++ int step, i;
+
+ iph = (const struct iphdr *)network_hdr;
+ newsk = tcp_create_openreq_child(lsk, oreq, cdev->askb);
+@@ -1048,7 +1050,7 @@ static struct sock *chtls_recv_sock(struct sock *lsk,
+
+ tcph = (struct tcphdr *)(iph + 1);
+ n = dst_neigh_lookup(dst, &iph->saddr);
+- if (!n)
++ if (!n || !n->dev)
+ goto free_sk;
+
+ ndev = n->dev;
+@@ -1057,6 +1059,13 @@ static struct sock *chtls_recv_sock(struct sock *lsk,
+ if (is_vlan_dev(ndev))
+ ndev = vlan_dev_real_dev(ndev);
+
++ for_each_port(adap, i)
++ if (cdev->ports[i] == ndev)
++ found = true;
++
++ if (!found)
++ goto free_dst;
++
+ port_id = cxgb4_port_idx(ndev);
+
+ csk = chtls_sock_create(cdev);
+@@ -1108,6 +1117,7 @@ static struct sock *chtls_recv_sock(struct sock *lsk,
+ free_csk:
+ chtls_sock_release(&csk->kref);
+ free_dst:
++ neigh_release(n);
+ dst_release(dst);
+ free_sk:
+ inet_csk_prepare_forced_close(newsk);
+@@ -1422,6 +1432,11 @@ static int chtls_pass_establish(struct chtls_dev *cdev, struct sk_buff *skb)
+ sk_wake_async(sk, 0, POLL_OUT);
+
+ data = lookup_stid(cdev->tids, stid);
++ if (!data) {
++ /* listening server close */
++ kfree_skb(skb);
++ goto unlock;
++ }
+ lsk = ((struct listen_ctx *)data)->lsk;
+
+ bh_lock_sock(lsk);
+@@ -1807,39 +1822,6 @@ static void send_defer_abort_rpl(struct chtls_dev *cdev, struct sk_buff *skb)
+ kfree_skb(skb);
+ }
+
+-static void send_abort_rpl(struct sock *sk, struct sk_buff *skb,
+- struct chtls_dev *cdev, int status, int queue)
+-{
+- struct cpl_abort_req_rss *req = cplhdr(skb);
+- struct sk_buff *reply_skb;
+- struct chtls_sock *csk;
+-
+- csk = rcu_dereference_sk_user_data(sk);
+-
+- reply_skb = alloc_skb(sizeof(struct cpl_abort_rpl),
+- GFP_KERNEL);
+-
+- if (!reply_skb) {
+- req->status = (queue << 1);
+- send_defer_abort_rpl(cdev, skb);
+- return;
+- }
+-
+- set_abort_rpl_wr(reply_skb, GET_TID(req), status);
+- kfree_skb(skb);
+-
+- set_wr_txq(reply_skb, CPL_PRIORITY_DATA, queue);
+- if (csk_conn_inline(csk)) {
+- struct l2t_entry *e = csk->l2t_entry;
+-
+- if (e && sk->sk_state != TCP_SYN_RECV) {
+- cxgb4_l2t_send(csk->egress_dev, reply_skb, e);
+- return;
+- }
+- }
+- cxgb4_ofld_send(cdev->lldi->ports[0], reply_skb);
+-}
+-
+ /*
+ * Add an skb to the deferred skb queue for processing from process context.
+ */
+@@ -1902,9 +1884,9 @@ static void bl_abort_syn_rcv(struct sock *lsk, struct sk_buff *skb)
+ queue = csk->txq_idx;
+
+ skb->sk = NULL;
++ chtls_send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev,
++ CPL_ABORT_NO_RST, queue);
+ do_abort_syn_rcv(child, lsk);
+- send_abort_rpl(child, skb, BLOG_SKB_CB(skb)->cdev,
+- CPL_ABORT_NO_RST, queue);
+ }
+
+ static int abort_syn_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1934,8 +1916,8 @@ static int abort_syn_rcv(struct sock *sk, struct sk_buff *skb)
+ if (!sock_owned_by_user(psk)) {
+ int queue = csk->txq_idx;
+
++ chtls_send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue);
+ do_abort_syn_rcv(sk, psk);
+- send_abort_rpl(sk, skb, cdev, CPL_ABORT_NO_RST, queue);
+ } else {
+ skb->sk = sk;
+ BLOG_SKB_CB(skb)->backlog_rcv = bl_abort_syn_rcv;
+@@ -1953,9 +1935,6 @@ static void chtls_abort_req_rss(struct sock *sk, struct sk_buff *skb)
+ int queue = csk->txq_idx;
+
+ if (is_neg_adv(req->status)) {
+- if (sk->sk_state == TCP_SYN_RECV)
+- chtls_set_tcb_tflag(sk, 0, 0);
+-
+ kfree_skb(skb);
+ return;
+ }
+@@ -1981,12 +1960,11 @@ static void chtls_abort_req_rss(struct sock *sk, struct sk_buff *skb)
+
+ if (sk->sk_state == TCP_SYN_RECV && !abort_syn_rcv(sk, skb))
+ return;
+-
+- chtls_release_resources(sk);
+- chtls_conn_done(sk);
+ }
+
+ chtls_send_abort_rpl(sk, skb, csk->cdev, rst_status, queue);
++ chtls_release_resources(sk);
++ chtls_conn_done(sk);
+ }
+
+ static void chtls_abort_rpl_rss(struct sock *sk, struct sk_buff *skb)
+diff --git a/drivers/dma/mediatek/mtk-hsdma.c b/drivers/dma/mediatek/mtk-hsdma.c
+index fca232b1d4a64..1d44b02831a07 100644
+--- a/drivers/dma/mediatek/mtk-hsdma.c
++++ b/drivers/dma/mediatek/mtk-hsdma.c
+@@ -1007,6 +1007,7 @@ static int mtk_hsdma_probe(struct platform_device *pdev)
+ return 0;
+
+ err_free:
++ mtk_hsdma_hw_deinit(hsdma);
+ of_dma_controller_free(pdev->dev.of_node);
+ err_unregister:
+ dma_async_device_unregister(dd);
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index 28592137fb67e..0c5668e897fe7 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -2426,7 +2426,7 @@ static int xilinx_dma_chan_probe(struct xilinx_dma_device *xdev,
+ has_dre = false;
+
+ if (!has_dre)
+- xdev->common.copy_align = fls(width - 1);
++ xdev->common.copy_align = (enum dmaengine_alignment)fls(width - 1);
+
+ if (of_device_is_compatible(node, "xlnx,axi-vdma-mm2s-channel") ||
+ of_device_is_compatible(node, "xlnx,axi-dma-mm2s-channel") ||
+@@ -2529,7 +2529,8 @@ static int xilinx_dma_chan_probe(struct xilinx_dma_device *xdev,
+ static int xilinx_dma_child_probe(struct xilinx_dma_device *xdev,
+ struct device_node *node)
+ {
+- int ret, i, nr_channels = 1;
++ int ret, i;
++ u32 nr_channels = 1;
+
+ ret = of_property_read_u32(node, "dma-channels", &nr_channels);
+ if ((ret < 0) && xdev->mcdma)
+@@ -2713,7 +2714,11 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+ }
+
+ /* Register the DMA engine with the core */
+- dma_async_device_register(&xdev->common);
++ err = dma_async_device_register(&xdev->common);
++ if (err) {
++ dev_err(xdev->dev, "failed to register the dma device\n");
++ goto error;
++ }
+
+ err = of_dma_controller_register(node, of_dma_xilinx_xlate,
+ xdev);
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index 52894816167cd..8b5b147cdfd15 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -380,7 +380,7 @@ eb_vma_misplaced(const struct drm_i915_gem_exec_object2 *entry,
+ return true;
+
+ if (!(flags & EXEC_OBJECT_SUPPORTS_48B_ADDRESS) &&
+- (vma->node.start + vma->node.size - 1) >> 32)
++ (vma->node.start + vma->node.size + 4095) >> 32)
+ return true;
+
+ if (flags & __EXEC_OBJECT_NEEDS_MAP &&
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 8249ff3a5a8d2..523014f2c0eb2 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -1241,6 +1241,37 @@ static int wacom_devm_sysfs_create_group(struct wacom *wacom,
+ group);
+ }
+
++static void wacom_devm_kfifo_release(struct device *dev, void *res)
++{
++ struct kfifo_rec_ptr_2 *devres = res;
++
++ kfifo_free(devres);
++}
++
++static int wacom_devm_kfifo_alloc(struct wacom *wacom)
++{
++ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
++ struct kfifo_rec_ptr_2 *pen_fifo = &wacom_wac->pen_fifo;
++ int error;
++
++ pen_fifo = devres_alloc(wacom_devm_kfifo_release,
++ sizeof(struct kfifo_rec_ptr_2),
++ GFP_KERNEL);
++
++ if (!pen_fifo)
++ return -ENOMEM;
++
++ error = kfifo_alloc(pen_fifo, WACOM_PKGLEN_MAX, GFP_KERNEL);
++ if (error) {
++ devres_free(pen_fifo);
++ return error;
++ }
++
++ devres_add(&wacom->hdev->dev, pen_fifo);
++
++ return 0;
++}
++
+ enum led_brightness wacom_leds_brightness_get(struct wacom_led *led)
+ {
+ struct wacom *wacom = led->wacom;
+@@ -2697,7 +2728,7 @@ static int wacom_probe(struct hid_device *hdev,
+ goto fail;
+ }
+
+- error = kfifo_alloc(&wacom_wac->pen_fifo, WACOM_PKGLEN_MAX, GFP_KERNEL);
++ error = wacom_devm_kfifo_alloc(wacom);
+ if (error)
+ goto fail;
+
+@@ -2764,8 +2795,6 @@ static void wacom_remove(struct hid_device *hdev)
+ if (wacom->wacom_wac.features.type != REMOTE)
+ wacom_release_resources(wacom);
+
+- kfifo_free(&wacom_wac->pen_fifo);
+-
+ hid_set_drvdata(hdev, NULL);
+ }
+
+diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c
+index a94e724f51dcf..bb1478e781c42 100644
+--- a/drivers/i2c/busses/i2c-sprd.c
++++ b/drivers/i2c/busses/i2c-sprd.c
+@@ -71,6 +71,8 @@
+
+ /* timeout (ms) for pm runtime autosuspend */
+ #define SPRD_I2C_PM_TIMEOUT 1000
++/* timeout (ms) for transfer message */
++#define I2C_XFER_TIMEOUT 1000
+
+ /* SPRD i2c data structure */
+ struct sprd_i2c {
+@@ -244,6 +246,7 @@ static int sprd_i2c_handle_msg(struct i2c_adapter *i2c_adap,
+ struct i2c_msg *msg, bool is_last_msg)
+ {
+ struct sprd_i2c *i2c_dev = i2c_adap->algo_data;
++ unsigned long time_left;
+
+ i2c_dev->msg = msg;
+ i2c_dev->buf = msg->buf;
+@@ -273,7 +276,10 @@ static int sprd_i2c_handle_msg(struct i2c_adapter *i2c_adap,
+
+ sprd_i2c_opt_start(i2c_dev);
+
+- wait_for_completion(&i2c_dev->complete);
++ time_left = wait_for_completion_timeout(&i2c_dev->complete,
++ msecs_to_jiffies(I2C_XFER_TIMEOUT));
++ if (!time_left)
++ return -ETIMEDOUT;
+
+ return i2c_dev->err;
+ }
+diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+index 631360b14ca71..4d89de0be58b8 100644
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+@@ -475,13 +475,29 @@ static irqreturn_t st_lsm6dsx_handler_irq(int irq, void *private)
+ static irqreturn_t st_lsm6dsx_handler_thread(int irq, void *private)
+ {
+ struct st_lsm6dsx_hw *hw = private;
+- int count;
++ int fifo_len = 0, len;
+
+- mutex_lock(&hw->fifo_lock);
+- count = st_lsm6dsx_read_fifo(hw);
+- mutex_unlock(&hw->fifo_lock);
++ /*
++ * If we are using edge IRQs, new samples can arrive while
++ * processing current interrupt since there are no hw
++ * guarantees the irq line stays "low" long enough to properly
++ * detect the new interrupt. In this case the new sample will
++ * be missed.
++ * Polling FIFO status register allow us to read new
++ * samples even if the interrupt arrives while processing
++ * previous data and the timeslot where the line is "low" is
++ * too short to be properly detected.
++ */
++ do {
++ mutex_lock(&hw->fifo_lock);
++ len = st_lsm6dsx_read_fifo(hw);
++ mutex_unlock(&hw->fifo_lock);
++
++ if (len > 0)
++ fifo_len += len;
++ } while (len > 0);
+
+- return !count ? IRQ_NONE : IRQ_HANDLED;
++ return fifo_len ? IRQ_HANDLED : IRQ_NONE;
+ }
+
+ static int st_lsm6dsx_buffer_preenable(struct iio_dev *iio_dev)
+diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
+index 9d2d03545bb07..cd2e5b44119ad 100644
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -1373,6 +1373,8 @@ static int intel_irq_remapping_alloc(struct irq_domain *domain,
+ irq_data = irq_domain_get_irq_data(domain, virq + i);
+ irq_cfg = irqd_cfg(irq_data);
+ if (!irq_data || !irq_cfg) {
++ if (!i)
++ kfree(data);
+ ret = -EINVAL;
+ goto out_free_data;
+ }
+diff --git a/drivers/lightnvm/Kconfig b/drivers/lightnvm/Kconfig
+index 439bf90d084dd..20706da7aa1cf 100644
+--- a/drivers/lightnvm/Kconfig
++++ b/drivers/lightnvm/Kconfig
+@@ -19,6 +19,7 @@ if NVM
+
+ config NVM_PBLK
+ tristate "Physical Block Device Open-Channel SSD target"
++ select CRC32
+ help
+ Allows an open-channel SSD to be exposed as a block device to the
+ host. The target assumes the device exposes raw flash and must be
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h b/drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h
+index be9dc08ccf678..4f56ffcdfc93a 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h
+@@ -102,7 +102,7 @@ struct hclgevf_mbx_arq_ring {
+ #define hclge_mbx_ring_ptr_move_crq(crq) \
+ (crq->next_to_use = (crq->next_to_use + 1) % crq->desc_num)
+ #define hclge_mbx_tail_ptr_move_arq(arq) \
+- (arq.tail = (arq.tail + 1) % HCLGE_MBX_MAX_ARQ_MSG_SIZE)
++ (arq.tail = (arq.tail + 1) % HCLGE_MBX_MAX_ARQ_MSG_NUM)
+ #define hclge_mbx_head_ptr_move_arq(arq) \
+- (arq.head = (arq.head + 1) % HCLGE_MBX_MAX_ARQ_MSG_SIZE)
++ (arq.head = (arq.head + 1) % HCLGE_MBX_MAX_ARQ_MSG_NUM)
+ #endif
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+index 7ddacc9e4fe40..c6eea6b6b1bbc 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+@@ -893,6 +893,7 @@ static int mlx5e_create_ttc_table_groups(struct mlx5e_ttc_table *ttc,
+ in = kvzalloc(inlen, GFP_KERNEL);
+ if (!in) {
+ kfree(ft->g);
++ ft->g = NULL;
+ return -ENOMEM;
+ }
+
+@@ -1033,6 +1034,7 @@ static int mlx5e_create_inner_ttc_table_groups(struct mlx5e_ttc_table *ttc)
+ in = kvzalloc(inlen, GFP_KERNEL);
+ if (!in) {
+ kfree(ft->g);
++ ft->g = NULL;
+ return -ENOMEM;
+ }
+
+@@ -1312,6 +1314,7 @@ err_destroy_groups:
+ ft->g[ft->num_groups] = NULL;
+ mlx5e_destroy_groups(ft);
+ kvfree(in);
++ kfree(ft->g);
+
+ return err;
+ }
+diff --git a/drivers/net/ethernet/natsemi/macsonic.c b/drivers/net/ethernet/natsemi/macsonic.c
+index 0937fc2a928ed..23c9394cd5d22 100644
+--- a/drivers/net/ethernet/natsemi/macsonic.c
++++ b/drivers/net/ethernet/natsemi/macsonic.c
+@@ -540,10 +540,14 @@ static int mac_sonic_platform_probe(struct platform_device *pdev)
+
+ err = register_netdev(dev);
+ if (err)
+- goto out;
++ goto undo_probe;
+
+ return 0;
+
++undo_probe:
++ dma_free_coherent(lp->device,
++ SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
++ lp->descriptors, lp->descriptors_laddr);
+ out:
+ free_netdev(dev);
+
+@@ -618,12 +622,16 @@ static int mac_sonic_nubus_probe(struct nubus_board *board)
+
+ err = register_netdev(ndev);
+ if (err)
+- goto out;
++ goto undo_probe;
+
+ nubus_set_drvdata(board, ndev);
+
+ return 0;
+
++undo_probe:
++ dma_free_coherent(lp->device,
++ SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
++ lp->descriptors, lp->descriptors_laddr);
+ out:
+ free_netdev(ndev);
+ return err;
+diff --git a/drivers/net/ethernet/natsemi/xtsonic.c b/drivers/net/ethernet/natsemi/xtsonic.c
+index e1b886e87a762..44171d7bb434c 100644
+--- a/drivers/net/ethernet/natsemi/xtsonic.c
++++ b/drivers/net/ethernet/natsemi/xtsonic.c
+@@ -265,11 +265,14 @@ int xtsonic_probe(struct platform_device *pdev)
+ sonic_msg_init(dev);
+
+ if ((err = register_netdev(dev)))
+- goto out1;
++ goto undo_probe1;
+
+ return 0;
+
+-out1:
++undo_probe1:
++ dma_free_coherent(lp->device,
++ SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
++ lp->descriptors, lp->descriptors_laddr);
+ release_region(dev->base_addr, SONIC_MEM_SIZE);
+ out:
+ free_netdev(dev);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index ef13a462c36df..1e5e831718dbd 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -73,6 +73,7 @@ struct emac_variant {
+ * @variant: reference to the current board variant
+ * @regmap: regmap for using the syscon
+ * @internal_phy_powered: Does the internal PHY is enabled
++ * @use_internal_phy: Is the internal PHY selected for use
+ * @mux_handle: Internal pointer used by mdio-mux lib
+ */
+ struct sunxi_priv_data {
+@@ -83,6 +84,7 @@ struct sunxi_priv_data {
+ const struct emac_variant *variant;
+ struct regmap_field *regmap_field;
+ bool internal_phy_powered;
++ bool use_internal_phy;
+ void *mux_handle;
+ };
+
+@@ -518,8 +520,11 @@ static const struct stmmac_dma_ops sun8i_dwmac_dma_ops = {
+ .dma_interrupt = sun8i_dwmac_dma_interrupt,
+ };
+
++static int sun8i_dwmac_power_internal_phy(struct stmmac_priv *priv);
++
+ static int sun8i_dwmac_init(struct platform_device *pdev, void *priv)
+ {
++ struct net_device *ndev = platform_get_drvdata(pdev);
+ struct sunxi_priv_data *gmac = priv;
+ int ret;
+
+@@ -533,13 +538,25 @@ static int sun8i_dwmac_init(struct platform_device *pdev, void *priv)
+
+ ret = clk_prepare_enable(gmac->tx_clk);
+ if (ret) {
+- if (gmac->regulator)
+- regulator_disable(gmac->regulator);
+ dev_err(&pdev->dev, "Could not enable AHB clock\n");
+- return ret;
++ goto err_disable_regulator;
++ }
++
++ if (gmac->use_internal_phy) {
++ ret = sun8i_dwmac_power_internal_phy(netdev_priv(ndev));
++ if (ret)
++ goto err_disable_clk;
+ }
+
+ return 0;
++
++err_disable_clk:
++ clk_disable_unprepare(gmac->tx_clk);
++err_disable_regulator:
++ if (gmac->regulator)
++ regulator_disable(gmac->regulator);
++
++ return ret;
+ }
+
+ static void sun8i_dwmac_core_init(struct mac_device_info *hw,
+@@ -809,7 +826,6 @@ static int mdio_mux_syscon_switch_fn(int current_child, int desired_child,
+ struct sunxi_priv_data *gmac = priv->plat->bsp_priv;
+ u32 reg, val;
+ int ret = 0;
+- bool need_power_ephy = false;
+
+ if (current_child ^ desired_child) {
+ regmap_field_read(gmac->regmap_field, ®);
+@@ -817,13 +833,12 @@ static int mdio_mux_syscon_switch_fn(int current_child, int desired_child,
+ case DWMAC_SUN8I_MDIO_MUX_INTERNAL_ID:
+ dev_info(priv->device, "Switch mux to internal PHY");
+ val = (reg & ~H3_EPHY_MUX_MASK) | H3_EPHY_SELECT;
+-
+- need_power_ephy = true;
++ gmac->use_internal_phy = true;
+ break;
+ case DWMAC_SUN8I_MDIO_MUX_EXTERNAL_ID:
+ dev_info(priv->device, "Switch mux to external PHY");
+ val = (reg & ~H3_EPHY_MUX_MASK) | H3_EPHY_SHUTDOWN;
+- need_power_ephy = false;
++ gmac->use_internal_phy = false;
+ break;
+ default:
+ dev_err(priv->device, "Invalid child ID %x\n",
+@@ -831,7 +846,7 @@ static int mdio_mux_syscon_switch_fn(int current_child, int desired_child,
+ return -EINVAL;
+ }
+ regmap_field_write(gmac->regmap_field, val);
+- if (need_power_ephy) {
++ if (gmac->use_internal_phy) {
+ ret = sun8i_dwmac_power_internal_phy(priv);
+ if (ret)
+ return ret;
+@@ -977,17 +992,12 @@ static void sun8i_dwmac_exit(struct platform_device *pdev, void *priv)
+ struct sunxi_priv_data *gmac = priv;
+
+ if (gmac->variant->soc_has_internal_phy) {
+- /* sun8i_dwmac_exit could be called with mdiomux uninit */
+- if (gmac->mux_handle)
+- mdio_mux_uninit(gmac->mux_handle);
+ if (gmac->internal_phy_powered)
+ sun8i_dwmac_unpower_internal_phy(gmac);
+ }
+
+ sun8i_dwmac_unset_syscon(gmac);
+
+- reset_control_put(gmac->rst_ephy);
+-
+ clk_disable_unprepare(gmac->tx_clk);
+
+ if (gmac->regulator)
+@@ -1200,12 +1210,32 @@ static int sun8i_dwmac_probe(struct platform_device *pdev)
+
+ return ret;
+ dwmac_mux:
++ reset_control_put(gmac->rst_ephy);
++ clk_put(gmac->ephy_clk);
+ sun8i_dwmac_unset_syscon(gmac);
+ dwmac_exit:
+ stmmac_pltfr_remove(pdev);
+ return ret;
+ }
+
++static int sun8i_dwmac_remove(struct platform_device *pdev)
++{
++ struct net_device *ndev = platform_get_drvdata(pdev);
++ struct stmmac_priv *priv = netdev_priv(ndev);
++ struct sunxi_priv_data *gmac = priv->plat->bsp_priv;
++
++ if (gmac->variant->soc_has_internal_phy) {
++ mdio_mux_uninit(gmac->mux_handle);
++ sun8i_dwmac_unpower_internal_phy(gmac);
++ reset_control_put(gmac->rst_ephy);
++ clk_put(gmac->ephy_clk);
++ }
++
++ stmmac_pltfr_remove(pdev);
++
++ return 0;
++}
++
+ static const struct of_device_id sun8i_dwmac_match[] = {
+ { .compatible = "allwinner,sun8i-h3-emac",
+ .data = &emac_variant_h3 },
+@@ -1223,7 +1253,7 @@ MODULE_DEVICE_TABLE(of, sun8i_dwmac_match);
+
+ static struct platform_driver sun8i_dwmac_driver = {
+ .probe = sun8i_dwmac_probe,
+- .remove = stmmac_pltfr_remove,
++ .remove = sun8i_dwmac_remove,
+ .driver = {
+ .name = "dwmac-sun8i",
+ .pm = &stmmac_pltfr_pm_ops,
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index e0bbefcbefa17..faca70c3647d3 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1127,7 +1127,10 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ * accordingly. Otherwise, we should check here.
+ */
+ if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
+- delayed_ndp_size = ALIGN(ctx->max_ndp_size, ctx->tx_ndp_modulus);
++ delayed_ndp_size = ctx->max_ndp_size +
++ max_t(u32,
++ ctx->tx_ndp_modulus,
++ ctx->tx_modulus + ctx->tx_remainder) - 1;
+ else
+ delayed_ndp_size = 0;
+
+@@ -1308,7 +1311,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ if (!(dev->driver_info->flags & FLAG_SEND_ZLP) &&
+ skb_out->len > ctx->min_tx_pkt) {
+ padding_count = ctx->tx_curr_size - skb_out->len;
+- skb_put_zero(skb_out, padding_count);
++ if (!WARN_ON(padding_count > ctx->tx_curr_size))
++ skb_put_zero(skb_out, padding_count);
+ } else if (skb_out->len < ctx->tx_curr_size &&
+ (skb_out->len % dev->maxpacket) == 0) {
+ skb_put_u8(skb_out, 0); /* force short packet */
+diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig
+index 21190dfbabb16..17ed5107b90a8 100644
+--- a/drivers/net/wan/Kconfig
++++ b/drivers/net/wan/Kconfig
+@@ -295,6 +295,7 @@ config SLIC_DS26522
+ tristate "Slic Maxim ds26522 card support"
+ depends on SPI
+ depends on FSL_SOC || ARCH_MXC || ARCH_LAYERSCAPE || COMPILE_TEST
++ select BITREVERSE
+ help
+ This module initializes and configures the slic maxim card
+ in T1 or E1 mode.
+diff --git a/drivers/net/wireless/ath/wil6210/Kconfig b/drivers/net/wireless/ath/wil6210/Kconfig
+index 3548e8d5e18e0..5284af423d935 100644
+--- a/drivers/net/wireless/ath/wil6210/Kconfig
++++ b/drivers/net/wireless/ath/wil6210/Kconfig
+@@ -1,6 +1,7 @@
+ config WIL6210
+ tristate "Wilocity 60g WiFi card wil6210 support"
+ select WANT_DEV_COREDUMP
++ select CRC32
+ depends on CFG80211
+ depends on PCI
+ default n
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index eafd0c2135a17..a889505e978be 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1572,7 +1572,7 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
+- master = spi_alloc_master(dev, sizeof(struct driver_data));
++ master = devm_spi_alloc_master(dev, sizeof(*drv_data));
+ if (!master) {
+ dev_err(&pdev->dev, "cannot alloc spi_master\n");
+ pxa_ssp_free(ssp);
+@@ -1759,7 +1759,6 @@ out_error_dma_irq_alloc:
+ free_irq(ssp->irq, drv_data);
+
+ out_error_master_alloc:
+- spi_controller_put(master);
+ pxa_ssp_free(ssp);
+ return status;
+ }
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 391a20b3d2fda..8eb2644506dd3 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -299,9 +299,9 @@ static u32 stm32_spi_prepare_fthlv(struct stm32_spi *spi)
+
+ /* align packet size with data registers access */
+ if (spi->cur_bpw > 8)
+- fthlv -= (fthlv % 2); /* multiple of 2 */
++ fthlv += (fthlv % 2) ? 1 : 0;
+ else
+- fthlv -= (fthlv % 4); /* multiple of 4 */
++ fthlv += (fthlv % 4) ? (4 - (fthlv % 4)) : 0;
+
+ return fthlv;
+ }
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index 4976f4d30f554..f65a924a75abd 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -492,7 +492,10 @@
+ */
+ #define TEXT_TEXT \
+ ALIGN_FUNCTION(); \
+- *(.text.hot TEXT_MAIN .text.fixup .text.unlikely) \
++ *(.text.hot .text.hot.*) \
++ *(TEXT_MAIN .text.fixup) \
++ *(.text.unlikely .text.unlikely.*) \
++ *(.text.unknown .text.unknown.*) \
+ *(.text..refcount) \
+ *(.ref.text) \
+ MEM_KEEP(init.text*) \
+diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
+index 5e99504539559..512ada90657b2 100644
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -277,7 +277,8 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
+ return 0;
+
+ out_free_newdev:
+- if (new_dev->reg_state == NETREG_UNINITIALIZED)
++ if (new_dev->reg_state == NETREG_UNINITIALIZED ||
++ new_dev->reg_state == NETREG_UNREGISTERED)
+ free_netdev(new_dev);
+ return err;
+ }
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index b5d9c9b2c7028..5b87d2dd7151b 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -1853,6 +1853,12 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len)
+ skb->csum = csum_block_sub(skb->csum,
+ skb_checksum(skb, len, delta, 0),
+ len);
++ } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
++ int hdlen = (len > skb_headlen(skb)) ? skb_headlen(skb) : len;
++ int offset = skb_checksum_start_offset(skb) + skb->csum_offset;
++
++ if (offset + sizeof(__sum16) > hdlen)
++ return -EINVAL;
+ }
+ return __pskb_trim(skb, len);
+ }
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index f0faf1193dd89..e411c42d84289 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -312,7 +312,7 @@ static int ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *sk
+ if (skb_is_gso(skb))
+ return ip_finish_output_gso(net, sk, skb, mtu);
+
+- if (skb->len > mtu || (IPCB(skb)->flags & IPSKB_FRAG_PMTU))
++ if (skb->len > mtu || IPCB(skb)->frag_max_size)
+ return ip_fragment(net, sk, skb, mtu, ip_finish_output2);
+
+ return ip_finish_output2(net, sk, skb);
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 375d0e516d85f..1cad731039c37 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -736,7 +736,11 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ goto tx_error;
+ }
+
+- if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off, inner_iph)) {
++ df = tnl_params->frag_off;
++ if (skb->protocol == htons(ETH_P_IP) && !tunnel->ignore_df)
++ df |= (inner_iph->frag_off & htons(IP_DF));
++
++ if (tnl_update_pmtu(dev, skb, rt, df, inner_iph)) {
+ ip_rt_put(rt);
+ goto tx_error;
+ }
+@@ -764,10 +768,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ ttl = ip4_dst_hoplimit(&rt->dst);
+ }
+
+- df = tnl_params->frag_off;
+- if (skb->protocol == htons(ETH_P_IP) && !tunnel->ignore_df)
+- df |= (inner_iph->frag_off&htons(IP_DF));
+-
+ max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
+ + rt->dst.header_len + ip_encap_hlen(&tunnel->encap);
+ if (max_headroom > dev->needed_headroom)
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 8b5459b34bc4a..e0e464b72c1fa 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -906,6 +906,8 @@ static void fib6_purge_rt(struct fib6_info *rt, struct fib6_node *fn,
+ {
+ struct fib6_table *table = rt->fib6_table;
+
++ /* Flush all cached dst in exception table */
++ rt6_flush_exceptions(rt);
+ if (rt->rt6i_pcpu)
+ fib6_drop_pcpu_from(rt, table);
+
+@@ -1756,9 +1758,6 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,
+ net->ipv6.rt6_stats->fib_rt_entries--;
+ net->ipv6.rt6_stats->fib_discarded_routes++;
+
+- /* Flush all cached dst in exception table */
+- rt6_flush_exceptions(rt);
+-
+ /* Reset round-robin state, if necessary */
+ if (rcu_access_pointer(fn->rr_ptr) == rt)
+ fn->rr_ptr = NULL;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-01-19 20:34 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-01-19 20:34 UTC (permalink / raw
To: gentoo-commits
commit: 8fb5ae6155bd43013b71d416870009d40c9128bc
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jan 19 20:33:10 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jan 19 20:33:10 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=8fb5ae61
Linux poatch 4.19.169
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1168_linux-4.19.169.patch | 900 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 904 insertions(+)
diff --git a/0000_README b/0000_README
index 48fd7f2..0373220 100644
--- a/0000_README
+++ b/0000_README
@@ -711,6 +711,10 @@ Patch: 1167_linux-4.19.168.patch
From: https://www.kernel.org
Desc: Linux 4.19.168
+Patch: 1168_linux-4.19.169.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.169
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1168_linux-4.19.169.patch b/1168_linux-4.19.169.patch
new file mode 100644
index 0000000..880daff
--- /dev/null
+++ b/1168_linux-4.19.169.patch
@@ -0,0 +1,900 @@
+diff --git a/Makefile b/Makefile
+index 3e44a813604eb..a994b12d2011a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 168
++SUBLEVEL = 169
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -438,7 +438,7 @@ KBUILD_AFLAGS := -D__ASSEMBLY__
+ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+ -fno-strict-aliasing -fno-common -fshort-wchar \
+ -Werror-implicit-function-declaration \
+- -Wno-format-security \
++ -Werror=return-type -Wno-format-security \
+ -std=gnu89
+ KBUILD_CPPFLAGS := -D__KERNEL__
+ KBUILD_AFLAGS_KERNEL :=
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index 16e6cc22e25cc..99c55f015ce86 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -91,14 +91,9 @@ libs-y += arch/arc/lib/ $(LIBGCC)
+
+ boot := arch/arc/boot
+
+-#default target for make without any arguments.
+-KBUILD_IMAGE := $(boot)/bootpImage
+-
+-all: bootpImage
+-bootpImage: vmlinux
+-
+-boot_targets += uImage uImage.bin uImage.gz
++boot_targets := uImage uImage.bin uImage.gz uImage.lzma
+
++PHONY += $(boot_targets)
+ $(boot_targets): vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
+diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h
+index 09ddddf71cc50..a70fef79c4055 100644
+--- a/arch/arc/include/asm/page.h
++++ b/arch/arc/include/asm/page.h
+@@ -13,6 +13,7 @@
+ #ifndef __ASSEMBLY__
+
+ #define clear_page(paddr) memset((paddr), 0, PAGE_SIZE)
++#define copy_user_page(to, from, vaddr, pg) copy_page(to, from)
+ #define copy_page(to, from) memcpy((to), (from), PAGE_SIZE)
+
+ struct vm_area_struct;
+diff --git a/arch/arm/boot/dts/picoxcell-pc3x2.dtsi b/arch/arm/boot/dts/picoxcell-pc3x2.dtsi
+index a1266cf8776ce..8362c6a3bcd30 100644
+--- a/arch/arm/boot/dts/picoxcell-pc3x2.dtsi
++++ b/arch/arm/boot/dts/picoxcell-pc3x2.dtsi
+@@ -54,18 +54,21 @@
+ emac: gem@30000 {
+ compatible = "cadence,gem";
+ reg = <0x30000 0x10000>;
++ interrupt-parent = <&vic0>;
+ interrupts = <31>;
+ };
+
+ dmac1: dmac@40000 {
+ compatible = "snps,dw-dmac";
+ reg = <0x40000 0x10000>;
++ interrupt-parent = <&vic0>;
+ interrupts = <25>;
+ };
+
+ dmac2: dmac@50000 {
+ compatible = "snps,dw-dmac";
+ reg = <0x50000 0x10000>;
++ interrupt-parent = <&vic0>;
+ interrupts = <26>;
+ };
+
+@@ -243,6 +246,7 @@
+ axi2pico@c0000000 {
+ compatible = "picochip,axi2pico-pc3x2";
+ reg = <0xc0000000 0x10000>;
++ interrupt-parent = <&vic0>;
+ interrupts = <13 14 15 16 17 18 19 20 21>;
+ };
+ };
+diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c
+index 81df9047e1109..40218be0b7ce8 100644
+--- a/arch/mips/boot/compressed/decompress.c
++++ b/arch/mips/boot/compressed/decompress.c
+@@ -17,6 +17,7 @@
+ #include <linux/libfdt.h>
+
+ #include <asm/addrspace.h>
++#include <asm/unaligned.h>
+
+ /*
+ * These two variables specify the free mem region
+@@ -117,7 +118,7 @@ void decompress_kernel(unsigned long boot_heap_start)
+ dtb_size = fdt_totalsize((void *)&__appended_dtb);
+
+ /* last four bytes is always image size in little endian */
+- image_size = le32_to_cpup((void *)&__image_end - 4);
++ image_size = get_unaligned_le32((void *)&__image_end - 4);
+
+ /* copy dtb to where the booted kernel will expect it */
+ memcpy((void *)VMLINUX_LOAD_ADDRESS_ULL + image_size,
+diff --git a/arch/mips/kernel/relocate.c b/arch/mips/kernel/relocate.c
+index cbf4cc0b0b6cf..934caf2040780 100644
+--- a/arch/mips/kernel/relocate.c
++++ b/arch/mips/kernel/relocate.c
+@@ -187,8 +187,14 @@ static int __init relocate_exception_table(long offset)
+ static inline __init unsigned long rotate_xor(unsigned long hash,
+ const void *area, size_t size)
+ {
+- size_t i;
+- unsigned long *ptr = (unsigned long *)area;
++ const typeof(hash) *ptr = PTR_ALIGN(area, sizeof(hash));
++ size_t diff, i;
++
++ diff = (void *)ptr - area;
++ if (unlikely(size < diff + sizeof(hash)))
++ return hash;
++
++ size = ALIGN_DOWN(size - diff, sizeof(hash));
+
+ for (i = 0; i < size / sizeof(hash); i++) {
+ /* Rotate by odd number of bits and XOR. */
+diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c
+index 2f34d52753526..e666f7eaf32de 100644
+--- a/arch/x86/hyperv/mmu.c
++++ b/arch/x86/hyperv/mmu.c
+@@ -66,11 +66,17 @@ static void hyperv_flush_tlb_others(const struct cpumask *cpus,
+ if (!hv_hypercall_pg)
+ goto do_native;
+
+- if (cpumask_empty(cpus))
+- return;
+-
+ local_irq_save(flags);
+
++ /*
++ * Only check the mask _after_ interrupt has been disabled to avoid the
++ * mask changing under our feet.
++ */
++ if (cpumask_empty(cpus)) {
++ local_irq_restore(flags);
++ return;
++ }
++
+ flush_pcpu = (struct hv_tlb_flush **)
+ this_cpu_ptr(hyperv_pcpu_input_arg);
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 5198ed1b36690..b7ad8ac6bb41e 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -5280,13 +5280,13 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
+ * limit 'something'.
+ */
+ /* no more than 50% of tags for async I/O */
+- bfqd->word_depths[0][0] = max((1U << bt->sb.shift) >> 1, 1U);
++ bfqd->word_depths[0][0] = max(bt->sb.depth >> 1, 1U);
+ /*
+ * no more than 75% of tags for sync writes (25% extra tags
+ * w.r.t. async I/O, to prevent async I/O from starving sync
+ * writes)
+ */
+- bfqd->word_depths[0][1] = max(((1U << bt->sb.shift) * 3) >> 2, 1U);
++ bfqd->word_depths[0][1] = max((bt->sb.depth * 3) >> 2, 1U);
+
+ /*
+ * In-word depths in case some bfq_queue is being weight-
+@@ -5296,9 +5296,9 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
+ * shortage.
+ */
+ /* no more than ~18% of tags for async I/O */
+- bfqd->word_depths[1][0] = max(((1U << bt->sb.shift) * 3) >> 4, 1U);
++ bfqd->word_depths[1][0] = max((bt->sb.depth * 3) >> 4, 1U);
+ /* no more than ~37% of tags for sync writes (~20% extra tags) */
+- bfqd->word_depths[1][1] = max(((1U << bt->sb.shift) * 6) >> 4, 1U);
++ bfqd->word_depths[1][1] = max((bt->sb.depth * 6) >> 4, 1U);
+
+ for (i = 0; i < 2; i++)
+ for (j = 0; j < 2; j++)
+diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
+index f59d0b9e26833..6def196cc23cf 100644
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -98,7 +98,7 @@ void acpi_scan_table_handler(u32 event, void *table, void *context);
+ extern struct list_head acpi_bus_id_list;
+
+ struct acpi_device_bus_id {
+- char bus_id[15];
++ const char *bus_id;
+ unsigned int instance_no;
+ struct list_head node;
+ };
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 1cfa3ac1d91f7..de9dc041d703e 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -486,6 +486,7 @@ static void acpi_device_del(struct acpi_device *device)
+ acpi_device_bus_id->instance_no--;
+ else {
+ list_del(&acpi_device_bus_id->node);
++ kfree_const(acpi_device_bus_id->bus_id);
+ kfree(acpi_device_bus_id);
+ }
+ break;
+@@ -674,7 +675,14 @@ int acpi_device_add(struct acpi_device *device,
+ }
+ if (!found) {
+ acpi_device_bus_id = new_bus_id;
+- strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device));
++ acpi_device_bus_id->bus_id =
++ kstrdup_const(acpi_device_hid(device), GFP_KERNEL);
++ if (!acpi_device_bus_id->bus_id) {
++ pr_err(PREFIX "Memory allocation error for bus id\n");
++ result = -ENOMEM;
++ goto err_free_new_bus_id;
++ }
++
+ acpi_device_bus_id->instance_no = 0;
+ list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list);
+ }
+@@ -709,6 +717,11 @@ int acpi_device_add(struct acpi_device *device,
+ if (device->parent)
+ list_del(&device->node);
+ list_del(&device->wakeup_list);
++
++ err_free_new_bus_id:
++ if (!found)
++ kfree(new_bus_id);
++
+ mutex_unlock(&acpi_device_lock);
+
+ err_detach:
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 3ba3ae9749bec..81de5e1659551 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -483,14 +483,14 @@ static int msm_drm_init(struct device *dev, struct drm_driver *drv)
+
+ drm_mode_config_init(ddev);
+
+- /* Bind all our sub-components: */
+- ret = component_bind_all(dev, ddev);
++ ret = msm_init_vram(ddev);
+ if (ret)
+ goto err_destroy_mdss;
+
+- ret = msm_init_vram(ddev);
++ /* Bind all our sub-components: */
++ ret = component_bind_all(dev, ddev);
+ if (ret)
+- goto err_msm_uninit;
++ goto err_destroy_mdss;
+
+ if (!dev->dma_parms) {
+ dev->dma_parms = devm_kzalloc(dev, sizeof(*dev->dma_parms),
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index f41f3ff689c55..1695605eeb528 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -6094,7 +6094,7 @@ int mlx5_ib_stage_bfrag_init(struct mlx5_ib_dev *dev)
+
+ err = mlx5_alloc_bfreg(dev->mdev, &dev->fp_bfreg, false, true);
+ if (err)
+- mlx5_free_bfreg(dev->mdev, &dev->fp_bfreg);
++ mlx5_free_bfreg(dev->mdev, &dev->bfreg);
+
+ return err;
+ }
+diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+index e611f133aa97b..e6c11b5a1669b 100644
+--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+@@ -212,6 +212,7 @@ find_free_vf_and_create_qp_grp(struct usnic_ib_dev *us_ibdev,
+
+ }
+ usnic_uiom_free_dev_list(dev_list);
++ dev_list = NULL;
+ }
+
+ /* Try to find resources on an unused vf */
+@@ -236,6 +237,8 @@ find_free_vf_and_create_qp_grp(struct usnic_ib_dev *us_ibdev,
+ qp_grp_check:
+ if (IS_ERR_OR_NULL(qp_grp)) {
+ usnic_err("Failed to allocate qp_grp\n");
++ if (usnic_ib_share_vf)
++ usnic_uiom_free_dev_list(dev_list);
+ return ERR_PTR(qp_grp ? PTR_ERR(qp_grp) : -ENOMEM);
+ }
+ return qp_grp;
+diff --git a/drivers/isdn/mISDN/Kconfig b/drivers/isdn/mISDN/Kconfig
+index c0730d5c734d6..fb61181a5c4f7 100644
+--- a/drivers/isdn/mISDN/Kconfig
++++ b/drivers/isdn/mISDN/Kconfig
+@@ -12,6 +12,7 @@ if MISDN != n
+ config MISDN_DSP
+ tristate "Digital Audio Processing of transparent data"
+ depends on MISDN
++ select BITREVERSE
+ help
+ Enable support for digital audio processing capability.
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index e8eeee680750d..875c78b5e2242 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -3078,7 +3078,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ unsigned extra_args;
+ struct dm_arg_set as;
+ static const struct dm_arg _args[] = {
+- {0, 9, "Invalid number of feature args"},
++ {0, 15, "Invalid number of feature args"},
+ };
+ unsigned journal_sectors, interleave_sectors, buffer_sectors, journal_watermark, sync_msec;
+ bool recalculate;
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index d3f28a9e3fd95..9e930a150aa29 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -137,6 +137,11 @@ struct dm_snapshot {
+ * for them to be committed.
+ */
+ struct bio_list bios_queued_during_merge;
++
++ /*
++ * Flush data after merge.
++ */
++ struct bio flush_bio;
+ };
+
+ /*
+@@ -1061,6 +1066,17 @@ shut:
+
+ static void error_bios(struct bio *bio);
+
++static int flush_data(struct dm_snapshot *s)
++{
++ struct bio *flush_bio = &s->flush_bio;
++
++ bio_reset(flush_bio);
++ bio_set_dev(flush_bio, s->origin->bdev);
++ flush_bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
++
++ return submit_bio_wait(flush_bio);
++}
++
+ static void merge_callback(int read_err, unsigned long write_err, void *context)
+ {
+ struct dm_snapshot *s = context;
+@@ -1074,6 +1090,11 @@ static void merge_callback(int read_err, unsigned long write_err, void *context)
+ goto shut;
+ }
+
++ if (flush_data(s) < 0) {
++ DMERR("Flush after merge failed: shutting down merge");
++ goto shut;
++ }
++
+ if (s->store->type->commit_merge(s->store,
+ s->num_merging_chunks) < 0) {
+ DMERR("Write error in exception store: shutting down merge");
+@@ -1198,6 +1219,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ s->first_merging_chunk = 0;
+ s->num_merging_chunks = 0;
+ bio_list_init(&s->bios_queued_during_merge);
++ bio_init(&s->flush_bio, NULL, 0);
+
+ /* Allocate hash table for COW data */
+ if (init_hash_tables(s)) {
+@@ -1391,6 +1413,8 @@ static void snapshot_dtr(struct dm_target *ti)
+
+ mutex_destroy(&s->lock);
+
++ bio_uninit(&s->flush_bio);
++
+ dm_put_device(ti, s->cow);
+
+ dm_put_device(ti, s->origin);
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 6c755eb0263fb..13237b85cfec5 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -515,7 +515,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
+ * subset of the parent bdev; require extra privileges.
+ */
+ if (!capable(CAP_SYS_RAWIO)) {
+- DMWARN_LIMIT(
++ DMDEBUG_LIMIT(
+ "%s: sending ioctl %x to DM device without required privilege.",
+ current->comm, cmd);
+ r = -ENOIOCTLCMD;
+diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
+index c8e5d889bd81f..21de56345503f 100644
+--- a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
++++ b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
+@@ -223,3 +223,4 @@ static struct platform_driver fs_enet_bb_mdio_driver = {
+ };
+
+ module_platform_driver(fs_enet_bb_mdio_driver);
++MODULE_LICENSE("GPL");
+diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-fec.c b/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
+index 1582d82483eca..4e6a9c5d8af55 100644
+--- a/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
++++ b/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
+@@ -224,3 +224,4 @@ static struct platform_driver fs_enet_fec_mdio_driver = {
+ };
+
+ module_platform_driver(fs_enet_fec_mdio_driver);
++MODULE_LICENSE("GPL");
+diff --git a/drivers/net/ethernet/freescale/ucc_geth.h b/drivers/net/ethernet/freescale/ucc_geth.h
+index 5da19b440a6a8..bf25e49d4fe34 100644
+--- a/drivers/net/ethernet/freescale/ucc_geth.h
++++ b/drivers/net/ethernet/freescale/ucc_geth.h
+@@ -580,7 +580,14 @@ struct ucc_geth_tx_global_pram {
+ u32 vtagtable[0x8]; /* 8 4-byte VLAN tags */
+ u32 tqptr; /* a base pointer to the Tx Queues Memory
+ Region */
+- u8 res2[0x80 - 0x74];
++ u8 res2[0x78 - 0x74];
++ u64 snums_en;
++ u32 l2l3baseptr; /* top byte consists of a few other bit fields */
++
++ u16 mtu[8];
++ u8 res3[0xa8 - 0x94];
++ u32 wrrtablebase; /* top byte is reserved */
++ u8 res4[0xc0 - 0xac];
+ } __packed;
+
+ /* structure representing Extended Filtering Global Parameters in PRAM */
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 1de97b69ce4e2..529c8fac15314 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -800,6 +800,13 @@ static const struct usb_device_id products[] = {
+ .driver_info = 0,
+ },
+
++/* Lenovo Powered USB-C Travel Hub (4X90S92381, based on Realtek RTL8153) */
++{
++ USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x721e, USB_CLASS_COMM,
++ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
++ .driver_info = 0,
++},
++
+ /* ThinkPad USB-C Dock Gen 2 (based on Realtek RTL8153) */
+ {
+ USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0xa387, USB_CLASS_COMM,
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 1b1ec41978300..7dc6055855354 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -5352,6 +5352,7 @@ static const struct usb_device_id rtl8152_table[] = {
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x7205)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x720c)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x7214)},
++ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x721e)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0xa387)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA, 0x09ff)},
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 9936e4b991aa3..7bda5586e4332 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2774,6 +2774,12 @@ out:
+ return ret;
+ }
+
++static bool rescan_should_stop(struct btrfs_fs_info *fs_info)
++{
++ return btrfs_fs_closing(fs_info) ||
++ test_bit(BTRFS_FS_STATE_REMOUNTING, &fs_info->fs_state);
++}
++
+ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work)
+ {
+ struct btrfs_fs_info *fs_info = container_of(work, struct btrfs_fs_info,
+@@ -2782,6 +2788,7 @@ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work)
+ struct btrfs_trans_handle *trans = NULL;
+ int err = -ENOMEM;
+ int ret = 0;
++ bool stopped = false;
+
+ path = btrfs_alloc_path();
+ if (!path)
+@@ -2794,7 +2801,7 @@ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work)
+ path->skip_locking = 1;
+
+ err = 0;
+- while (!err && !btrfs_fs_closing(fs_info)) {
++ while (!err && !(stopped = rescan_should_stop(fs_info))) {
+ trans = btrfs_start_transaction(fs_info->fs_root, 0);
+ if (IS_ERR(trans)) {
+ err = PTR_ERR(trans);
+@@ -2837,7 +2844,7 @@ out:
+ }
+
+ mutex_lock(&fs_info->qgroup_rescan_lock);
+- if (!btrfs_fs_closing(fs_info))
++ if (!stopped)
+ fs_info->qgroup_flags &= ~BTRFS_QGROUP_STATUS_FLAG_RESCAN;
+ if (trans) {
+ ret = update_qgroup_status_item(trans);
+@@ -2856,7 +2863,7 @@ out:
+
+ btrfs_end_transaction(trans);
+
+- if (btrfs_fs_closing(fs_info)) {
++ if (stopped) {
+ btrfs_info(fs_info, "qgroup scan paused");
+ } else if (err >= 0) {
+ btrfs_info(fs_info, "qgroup scan completed%s",
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 40f5b4dcb9276..521f6c2091ad1 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -1845,6 +1845,14 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
+ btrfs_scrub_cancel(fs_info);
+ btrfs_pause_balance(fs_info);
+
++ /*
++ * Pause the qgroup rescan worker if it is running. We don't want
++ * it to be still running after we are in RO mode, as after that,
++ * by the time we unmount, it might have left a transaction open,
++ * so we would leak the transaction and/or crash.
++ */
++ btrfs_qgroup_wait_for_completion(fs_info, false);
++
+ ret = btrfs_commit_super(fs_info);
+ if (ret)
+ goto restore;
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 783c54bb2ce75..21c9ebfe83478 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -1092,7 +1092,10 @@ resizefs_out:
+ err = ext4_journal_get_write_access(handle, sbi->s_sbh);
+ if (err)
+ goto pwsalt_err_journal;
++ lock_buffer(sbi->s_sbh);
+ generate_random_uuid(sbi->s_es->s_encrypt_pw_salt);
++ ext4_superblock_csum_set(sb);
++ unlock_buffer(sbi->s_sbh);
+ err = ext4_handle_dirty_metadata(handle, NULL,
+ sbi->s_sbh);
+ pwsalt_err_journal:
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 3c238006870d3..8f7e0ad5b5ef1 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -3437,8 +3437,6 @@ static int ext4_setent(handle_t *handle, struct ext4_renament *ent,
+ return retval;
+ }
+ }
+- brelse(ent->bh);
+- ent->bh = NULL;
+
+ return 0;
+ }
+@@ -3638,6 +3636,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ }
+ }
+
++ old_file_type = old.de->file_type;
+ if (IS_DIRSYNC(old.dir) || IS_DIRSYNC(new.dir))
+ ext4_handle_sync(handle);
+
+@@ -3665,7 +3664,6 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ force_reread = (new.dir->i_ino == old.dir->i_ino &&
+ ext4_test_inode_flag(new.dir, EXT4_INODE_INLINE_DATA));
+
+- old_file_type = old.de->file_type;
+ if (whiteout) {
+ /*
+ * Do this before adding a new entry, so the old entry is sure
+@@ -3737,15 +3735,19 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ retval = 0;
+
+ end_rename:
+- brelse(old.dir_bh);
+- brelse(old.bh);
+- brelse(new.bh);
+ if (whiteout) {
+- if (retval)
++ if (retval) {
++ ext4_setent(handle, &old,
++ old.inode->i_ino, old_file_type);
+ drop_nlink(whiteout);
++ }
+ unlock_new_inode(whiteout);
+ iput(whiteout);
++
+ }
++ brelse(old.dir_bh);
++ brelse(old.bh);
++ brelse(new.bh);
+ if (handle)
+ ext4_journal_stop(handle);
+ return retval;
+diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
+index 8357ff69962f2..cc07189a501fa 100644
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -575,12 +575,14 @@ extern int nfs4_test_session_trunk(struct rpc_clnt *,
+
+ static inline struct inode *nfs_igrab_and_active(struct inode *inode)
+ {
+- inode = igrab(inode);
+- if (inode != NULL && !nfs_sb_active(inode->i_sb)) {
+- iput(inode);
+- inode = NULL;
++ struct super_block *sb = inode->i_sb;
++
++ if (sb && nfs_sb_active(sb)) {
++ if (igrab(inode))
++ return inode;
++ nfs_sb_deactive(sb);
+ }
+- return inode;
++ return NULL;
+ }
+
+ static inline void nfs_iput_and_deactive(struct inode *inode)
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 1a395647ae265..d89a815f7c31f 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -6721,9 +6721,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
+ data->arg.new_lock_owner, ret);
+ } else
+ data->cancelled = true;
++ trace_nfs4_set_lock(fl, state, &data->res.stateid, cmd, ret);
+ rpc_put_task(task);
+ dprintk("%s: done, ret = %d!\n", __func__, ret);
+- trace_nfs4_set_lock(fl, state, &data->res.stateid, cmd, ret);
+ return ret;
+ }
+
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index a253384a4710b..46ca5592b8b0d 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1460,12 +1460,18 @@ void pnfs_roc_release(struct nfs4_layoutreturn_args *args,
+ int ret)
+ {
+ struct pnfs_layout_hdr *lo = args->layout;
++ struct inode *inode = args->inode;
+ const nfs4_stateid *arg_stateid = NULL;
+ const nfs4_stateid *res_stateid = NULL;
+ struct nfs4_xdr_opaque_data *ld_private = args->ld_private;
+
+ switch (ret) {
+ case -NFS4ERR_NOMATCHING_LAYOUT:
++ spin_lock(&inode->i_lock);
++ if (pnfs_layout_is_valid(lo) &&
++ nfs4_stateid_match_other(&args->stateid, &lo->plh_stateid))
++ pnfs_set_plh_return_info(lo, args->range.iomode, 0);
++ spin_unlock(&inode->i_lock);
+ break;
+ case 0:
+ if (res->lrs_present)
+@@ -2141,6 +2147,7 @@ static void _lgopen_prepare_attached(struct nfs4_opendata *data,
+ &rng, GFP_KERNEL);
+ if (!lgp) {
+ pnfs_clear_first_layoutget(lo);
++ nfs_layoutget_end(lo);
+ pnfs_put_layout_hdr(lo);
+ return;
+ }
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index cd412817654fa..019468f072b7d 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -812,6 +812,13 @@ static inline int acpi_device_modalias(struct device *dev,
+ return -ENODEV;
+ }
+
++static inline struct platform_device *
++acpi_create_platform_device(struct acpi_device *adev,
++ struct property_entry *properties)
++{
++ return NULL;
++}
++
+ static inline bool acpi_dma_supported(struct acpi_device *adev)
+ {
+ return false;
+diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
+index 5e3de28c76773..e656d1e232da4 100644
+--- a/kernel/trace/Kconfig
++++ b/kernel/trace/Kconfig
+@@ -476,7 +476,7 @@ config KPROBE_EVENTS
+ config KPROBE_EVENTS_ON_NOTRACE
+ bool "Do NOT protect notrace function from kprobe events"
+ depends on KPROBE_EVENTS
+- depends on KPROBES_ON_FTRACE
++ depends on DYNAMIC_FTRACE
+ default n
+ help
+ This is only for the developers who want to debug ftrace itself
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index c45b017bacd47..5c17f70c7f2d2 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -517,7 +517,7 @@ disable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file)
+ return ret;
+ }
+
+-#if defined(CONFIG_KPROBES_ON_FTRACE) && \
++#if defined(CONFIG_DYNAMIC_FTRACE) && \
+ !defined(CONFIG_KPROBE_EVENTS_ON_NOTRACE)
+ static bool __within_notrace_func(unsigned long addr)
+ {
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 27e49c5ec2194..0b60ab3966968 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3852,7 +3852,7 @@ retry:
+ * So we need to block hugepage fault by PG_hwpoison bit check.
+ */
+ if (unlikely(PageHWPoison(page))) {
+- ret = VM_FAULT_HWPOISON |
++ ret = VM_FAULT_HWPOISON_LARGE |
+ VM_FAULT_SET_HINDEX(hstate_index(h));
+ goto backout_unlocked;
+ }
+diff --git a/mm/slub.c b/mm/slub.c
+index dfc9b4267603e..02295fa61583c 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1830,7 +1830,7 @@ static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n,
+
+ t = acquire_slab(s, n, page, object == NULL, &objects);
+ if (!t)
+- break;
++ continue; /* cmpxchg raced */
+
+ available += objects;
+ if (!object) {
+diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
+index 4c94f3ba2ae42..dcd8e79229515 100644
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -500,6 +500,9 @@ nf_conntrack_hash_sysctl(struct ctl_table *table, int write,
+ {
+ int ret;
+
++ /* module_param hashsize could have changed value */
++ nf_conntrack_htable_size_user = nf_conntrack_htable_size;
++
+ ret = proc_dointvec(table, write, buffer, lenp, ppos);
+ if (ret < 0 || !write)
+ return ret;
+diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
+index 2268b10a9dcf8..c31df6a76504d 100644
+--- a/net/netfilter/nf_nat_core.c
++++ b/net/netfilter/nf_nat_core.c
+@@ -1068,6 +1068,7 @@ static int __init nf_nat_init(void)
+ ret = register_pernet_subsys(&nat_net_ops);
+ if (ret < 0) {
+ nf_ct_extend_unregister(&nat_extend);
++ kvfree(nf_nat_bysource);
+ return ret;
+ }
+
+diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
+index 8391c27855501..7404f02702a1c 100644
+--- a/net/sunrpc/addr.c
++++ b/net/sunrpc/addr.c
+@@ -184,7 +184,7 @@ static int rpc_parse_scope_id(struct net *net, const char *buf,
+ scope_id = dev->ifindex;
+ dev_put(dev);
+ } else {
+- if (kstrtou32(p, 10, &scope_id) == 0) {
++ if (kstrtou32(p, 10, &scope_id) != 0) {
+ kfree(p);
+ return 0;
+ }
+diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
+index 5596ea8f339a3..f0b2449897344 100644
+--- a/security/integrity/ima/ima_crypto.c
++++ b/security/integrity/ima/ima_crypto.c
+@@ -641,7 +641,7 @@ int ima_calc_buffer_hash(const void *buf, loff_t len,
+ return calc_buffer_shash(buf, len, hash);
+ }
+
+-static void __init ima_pcrread(int idx, u8 *pcr)
++static void ima_pcrread(int idx, u8 *pcr)
+ {
+ if (!ima_tpm_chip)
+ return;
+diff --git a/security/lsm_audit.c b/security/lsm_audit.c
+index 33028c098ef3c..d6fea68d22ad6 100644
+--- a/security/lsm_audit.c
++++ b/security/lsm_audit.c
+@@ -277,7 +277,9 @@ static void dump_common_audit_data(struct audit_buffer *ab,
+ struct inode *inode;
+
+ audit_log_format(ab, " name=");
++ spin_lock(&a->u.dentry->d_lock);
+ audit_log_untrustedstring(ab, a->u.dentry->d_name.name);
++ spin_unlock(&a->u.dentry->d_lock);
+
+ inode = d_backing_inode(a->u.dentry);
+ if (inode) {
+@@ -295,8 +297,9 @@ static void dump_common_audit_data(struct audit_buffer *ab,
+ dentry = d_find_alias(inode);
+ if (dentry) {
+ audit_log_format(ab, " name=");
+- audit_log_untrustedstring(ab,
+- dentry->d_name.name);
++ spin_lock(&dentry->d_lock);
++ audit_log_untrustedstring(ab, dentry->d_name.name);
++ spin_unlock(&dentry->d_lock);
+ dput(dentry);
+ }
+ audit_log_format(ab, " dev=");
+diff --git a/sound/firewire/fireface/ff-transaction.c b/sound/firewire/fireface/ff-transaction.c
+index 332b29f8ed754..47280ae506829 100644
+--- a/sound/firewire/fireface/ff-transaction.c
++++ b/sound/firewire/fireface/ff-transaction.c
+@@ -99,7 +99,7 @@ static void transmit_midi_msg(struct snd_ff *ff, unsigned int port)
+
+ /* Set interval to next transaction. */
+ ff->next_ktime[port] = ktime_add_ns(ktime_get(),
+- len * 8 * NSEC_PER_SEC / 31250);
++ len * 8 * (NSEC_PER_SEC / 31250));
+ ff->rx_bytes[port] = len;
+
+ /*
+diff --git a/sound/firewire/tascam/tascam-transaction.c b/sound/firewire/tascam/tascam-transaction.c
+index 2ad692dd4b137..92f7e74d58478 100644
+--- a/sound/firewire/tascam/tascam-transaction.c
++++ b/sound/firewire/tascam/tascam-transaction.c
+@@ -210,7 +210,7 @@ static void midi_port_work(struct work_struct *work)
+
+ /* Set interval to next transaction. */
+ port->next_ktime = ktime_add_ns(ktime_get(),
+- port->consume_bytes * 8 * NSEC_PER_SEC / 31250);
++ port->consume_bytes * 8 * (NSEC_PER_SEC / 31250));
+
+ /* Start this transaction. */
+ port->idling = false;
+diff --git a/sound/soc/intel/skylake/cnl-sst.c b/sound/soc/intel/skylake/cnl-sst.c
+index 245df1067ba89..7b429c0fb4e55 100644
+--- a/sound/soc/intel/skylake/cnl-sst.c
++++ b/sound/soc/intel/skylake/cnl-sst.c
+@@ -212,6 +212,7 @@ static int cnl_set_dsp_D0(struct sst_dsp *ctx, unsigned int core_id)
+ "dsp boot timeout, status=%#x error=%#x\n",
+ sst_dsp_shim_read(ctx, CNL_ADSP_FW_STATUS),
+ sst_dsp_shim_read(ctx, CNL_ADSP_ERROR_CODE));
++ ret = -ETIMEDOUT;
+ goto err;
+ }
+ } else {
+diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c
+index 5c055d8de8c7d..01cc551a8e3fa 100644
+--- a/sound/soc/meson/axg-tdm-interface.c
++++ b/sound/soc/meson/axg-tdm-interface.c
+@@ -459,8 +459,20 @@ static int axg_tdm_iface_set_bias_level(struct snd_soc_component *component,
+ return ret;
+ }
+
++static const struct snd_soc_dapm_widget axg_tdm_iface_dapm_widgets[] = {
++ SND_SOC_DAPM_SIGGEN("Playback Signal"),
++};
++
++static const struct snd_soc_dapm_route axg_tdm_iface_dapm_routes[] = {
++ { "Loopback", NULL, "Playback Signal" },
++};
++
+ static const struct snd_soc_component_driver axg_tdm_iface_component_drv = {
+- .set_bias_level = axg_tdm_iface_set_bias_level,
++ .dapm_widgets = axg_tdm_iface_dapm_widgets,
++ .num_dapm_widgets = ARRAY_SIZE(axg_tdm_iface_dapm_widgets),
++ .dapm_routes = axg_tdm_iface_dapm_routes,
++ .num_dapm_routes = ARRAY_SIZE(axg_tdm_iface_dapm_routes),
++ .set_bias_level = axg_tdm_iface_set_bias_level,
+ };
+
+ static const struct of_device_id axg_tdm_iface_of_match[] = {
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 96800b7c82f67..4e99d9986f112 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2454,6 +2454,7 @@ void snd_soc_dapm_free_widget(struct snd_soc_dapm_widget *w)
+ enum snd_soc_dapm_direction dir;
+
+ list_del(&w->list);
++ list_del(&w->dirty);
+ /*
+ * remove source and sink paths associated to this widget.
+ * While removing the path, remove reference to it from both
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-01-23 16:36 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-01-23 16:36 UTC (permalink / raw
To: gentoo-commits
commit: 3f8f12b4a9af73e278d57efe81ef3c3157c66d11
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Jan 23 16:36:28 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Jan 23 16:36:28 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3f8f12b4
Linux patch 4.19.170
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1169_linux-4.19.170.patch | 582 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 586 insertions(+)
diff --git a/0000_README b/0000_README
index 0373220..a166692 100644
--- a/0000_README
+++ b/0000_README
@@ -715,6 +715,10 @@ Patch: 1168_linux-4.19.169.patch
From: https://www.kernel.org
Desc: Linux 4.19.169
+Patch: 1169_linux-4.19.170.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.170
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1169_linux-4.19.170.patch b/1169_linux-4.19.170.patch
new file mode 100644
index 0000000..934c664
--- /dev/null
+++ b/1169_linux-4.19.170.patch
@@ -0,0 +1,582 @@
+diff --git a/Makefile b/Makefile
+index a994b12d2011a..7f56c62d31e8a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 169
++SUBLEVEL = 170
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
+index d9b734d0c8cc7..3c6e01520a973 100644
+--- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
++++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
+@@ -170,7 +170,7 @@ continue_block:
+
+ ## branch into array
+ lea jump_table(%rip), bufp
+- movzxw (bufp, %rax, 2), len
++ movzwq (bufp, %rax, 2), len
+ lea crc_array(%rip), bufp
+ lea (bufp, len, 1), bufp
+ JMP_NOSPEC bufp
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index dc385b70e4c33..b6e4ab67ae449 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1471,6 +1471,12 @@ sector_t dm_bufio_get_device_size(struct dm_bufio_client *c)
+ }
+ EXPORT_SYMBOL_GPL(dm_bufio_get_device_size);
+
++struct dm_io_client *dm_bufio_get_dm_io_client(struct dm_bufio_client *c)
++{
++ return c->dm_io;
++}
++EXPORT_SYMBOL_GPL(dm_bufio_get_dm_io_client);
++
+ sector_t dm_bufio_get_block_number(struct dm_buffer *b)
+ {
+ return b->block;
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 875c78b5e2242..bb99b599de770 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -1153,12 +1153,52 @@ static int dm_integrity_rw_tag(struct dm_integrity_c *ic, unsigned char *tag, se
+ return 0;
+ }
+
+-static void dm_integrity_flush_buffers(struct dm_integrity_c *ic)
++struct flush_request {
++ struct dm_io_request io_req;
++ struct dm_io_region io_reg;
++ struct dm_integrity_c *ic;
++ struct completion comp;
++};
++
++static void flush_notify(unsigned long error, void *fr_)
++{
++ struct flush_request *fr = fr_;
++ if (unlikely(error != 0))
++ dm_integrity_io_error(fr->ic, "flusing disk cache", -EIO);
++ complete(&fr->comp);
++}
++
++static void dm_integrity_flush_buffers(struct dm_integrity_c *ic, bool flush_data)
+ {
+ int r;
++
++ struct flush_request fr;
++
++ if (!ic->meta_dev)
++ flush_data = false;
++ if (flush_data) {
++ fr.io_req.bi_op = REQ_OP_WRITE,
++ fr.io_req.bi_op_flags = REQ_PREFLUSH | REQ_SYNC,
++ fr.io_req.mem.type = DM_IO_KMEM,
++ fr.io_req.mem.ptr.addr = NULL,
++ fr.io_req.notify.fn = flush_notify,
++ fr.io_req.notify.context = &fr;
++ fr.io_req.client = dm_bufio_get_dm_io_client(ic->bufio),
++ fr.io_reg.bdev = ic->dev->bdev,
++ fr.io_reg.sector = 0,
++ fr.io_reg.count = 0,
++ fr.ic = ic;
++ init_completion(&fr.comp);
++ r = dm_io(&fr.io_req, 1, &fr.io_reg, NULL);
++ BUG_ON(r);
++ }
++
+ r = dm_bufio_write_dirty_buffers(ic->bufio);
+ if (unlikely(r))
+ dm_integrity_io_error(ic, "writing tags", r);
++
++ if (flush_data)
++ wait_for_completion(&fr.comp);
+ }
+
+ static void sleep_on_endio_wait(struct dm_integrity_c *ic)
+@@ -1846,7 +1886,7 @@ static void integrity_commit(struct work_struct *w)
+ flushes = bio_list_get(&ic->flush_bio_list);
+ if (unlikely(ic->mode != 'J')) {
+ spin_unlock_irq(&ic->endio_wait.lock);
+- dm_integrity_flush_buffers(ic);
++ dm_integrity_flush_buffers(ic, true);
+ goto release_flush_bios;
+ }
+
+@@ -2057,7 +2097,7 @@ skip_io:
+ complete_journal_op(&comp);
+ wait_for_completion_io(&comp.comp);
+
+- dm_integrity_flush_buffers(ic);
++ dm_integrity_flush_buffers(ic, true);
+ }
+
+ static void integrity_writer(struct work_struct *w)
+@@ -2099,7 +2139,7 @@ static void recalc_write_super(struct dm_integrity_c *ic)
+ {
+ int r;
+
+- dm_integrity_flush_buffers(ic);
++ dm_integrity_flush_buffers(ic, false);
+ if (dm_integrity_failed(ic))
+ return;
+
+@@ -2409,7 +2449,7 @@ static void dm_integrity_postsuspend(struct dm_target *ti)
+ if (ic->meta_dev)
+ queue_work(ic->writer_wq, &ic->writer_work);
+ drain_workqueue(ic->writer_wq);
+- dm_integrity_flush_buffers(ic);
++ dm_integrity_flush_buffers(ic, true);
+ }
+
+ BUG_ON(!RB_EMPTY_ROOT(&ic->in_progress));
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 986292a34f4f6..bc5cfe062b10e 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -4266,8 +4266,6 @@ static void mvpp2_phylink_validate(struct net_device *dev,
+
+ phylink_set(mask, Autoneg);
+ phylink_set_port_modes(mask);
+- phylink_set(mask, Pause);
+- phylink_set(mask, Asym_Pause);
+
+ switch (state->interface) {
+ case PHY_INTERFACE_MODE_10GKR:
+diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+index 59c70be22a84c..42b99b1826163 100644
+--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+@@ -580,11 +580,6 @@ static const struct net_device_ops netxen_netdev_ops = {
+ .ndo_set_features = netxen_set_features,
+ };
+
+-static inline bool netxen_function_zero(struct pci_dev *pdev)
+-{
+- return (PCI_FUNC(pdev->devfn) == 0) ? true : false;
+-}
+-
+ static inline void netxen_set_interrupt_mode(struct netxen_adapter *adapter,
+ u32 mode)
+ {
+@@ -680,7 +675,7 @@ static int netxen_setup_intr(struct netxen_adapter *adapter)
+ netxen_initialize_interrupt_registers(adapter);
+ netxen_set_msix_bit(pdev, 0);
+
+- if (netxen_function_zero(pdev)) {
++ if (adapter->portnum == 0) {
+ if (!netxen_setup_msi_interrupts(adapter, num_msix))
+ netxen_set_interrupt_mode(adapter, NETXEN_MSI_MODE);
+ else
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 4ac507b4d1019..76d4b8e6ac3e8 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3596,6 +3596,7 @@ static int stmmac_change_mtu(struct net_device *dev, int new_mtu)
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
+ int txfifosz = priv->plat->tx_fifo_size;
++ const int mtu = new_mtu;
+
+ if (txfifosz == 0)
+ txfifosz = priv->dma_cap.tx_fifo_size;
+@@ -3613,7 +3614,7 @@ static int stmmac_change_mtu(struct net_device *dev, int new_mtu)
+ if ((txfifosz < new_mtu) || (new_mtu > BUF_SIZE_16KiB))
+ return -EINVAL;
+
+- dev->mtu = new_mtu;
++ dev->mtu = mtu;
+
+ netdev_update_features(dev);
+
+diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
+index a22ae3137a3f8..d3f79a4067e22 100644
+--- a/drivers/net/usb/rndis_host.c
++++ b/drivers/net/usb/rndis_host.c
+@@ -399,7 +399,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags)
+ reply_len = sizeof *phym;
+ retval = rndis_query(dev, intf, u.buf,
+ RNDIS_OID_GEN_PHYSICAL_MEDIUM,
+- 0, (void **) &phym, &reply_len);
++ reply_len, (void **)&phym, &reply_len);
+ if (retval != 0 || !phym) {
+ /* OID is optional so don't fail here. */
+ phym_unspec = cpu_to_le32(RNDIS_PHYSICAL_MEDIUM_UNSPECIFIED);
+diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
+index 94cc0a152449f..f5055ceb7529d 100644
+--- a/drivers/spi/spi-cadence.c
++++ b/drivers/spi/spi-cadence.c
+@@ -119,6 +119,7 @@ struct cdns_spi {
+ void __iomem *regs;
+ struct clk *ref_clk;
+ struct clk *pclk;
++ unsigned int clk_rate;
+ u32 speed_hz;
+ const u8 *txbuf;
+ u8 *rxbuf;
+@@ -258,7 +259,7 @@ static void cdns_spi_config_clock_freq(struct spi_device *spi,
+ u32 ctrl_reg, baud_rate_val;
+ unsigned long frequency;
+
+- frequency = clk_get_rate(xspi->ref_clk);
++ frequency = xspi->clk_rate;
+
+ ctrl_reg = cdns_spi_read(xspi, CDNS_SPI_CR);
+
+@@ -628,8 +629,9 @@ static int cdns_spi_probe(struct platform_device *pdev)
+ master->auto_runtime_pm = true;
+ master->mode_bits = SPI_CPOL | SPI_CPHA;
+
++ xspi->clk_rate = clk_get_rate(xspi->ref_clk);
+ /* Set to default valid value */
+- master->max_speed_hz = clk_get_rate(xspi->ref_clk) / 4;
++ master->max_speed_hz = xspi->clk_rate / 4;
+ xspi->speed_hz = master->max_speed_hz;
+
+ master->bits_per_word_mask = SPI_BPW_MASK(8);
+diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
+index e88486d8084af..5916235adf35c 100644
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -101,7 +101,7 @@ static void io_watchdog_func(struct timer_list *t);
+
+
+ /* Some boards misreport power switching/overcurrent */
+-static bool distrust_firmware = true;
++static bool distrust_firmware;
+ module_param (distrust_firmware, bool, 0);
+ MODULE_PARM_DESC (distrust_firmware,
+ "true to distrust firmware power/overcurrent setup");
+diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
+index 83919116d5cbe..b90bea1c434eb 100644
+--- a/fs/nfsd/nfs3xdr.c
++++ b/fs/nfsd/nfs3xdr.c
+@@ -844,9 +844,14 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
+ if (isdotent(name, namlen)) {
+ if (namlen == 2) {
+ dchild = dget_parent(dparent);
+- /* filesystem root - cannot return filehandle for ".." */
++ /*
++ * Don't return filehandle for ".." if we're at
++ * the filesystem or export root:
++ */
+ if (dchild == dparent)
+ goto out;
++ if (dparent == exp->ex_path.dentry)
++ goto out;
+ } else
+ dchild = dget(dparent);
+ } else
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 14be095371093..a80d6de3c8ad2 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -12,6 +12,12 @@
+
+ #if GCC_VERSION < 40600
+ # error Sorry, your compiler is too old - please upgrade it.
++#elif defined(CONFIG_ARM64) && GCC_VERSION < 50100
++/*
++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63293
++ * https://lore.kernel.org/r/20210107111841.GN1551@shell.armlinux.org.uk
++ */
++# error Sorry, your version of GCC is too old - please use 5.1 or newer.
+ #endif
+
+ /*
+diff --git a/include/linux/dm-bufio.h b/include/linux/dm-bufio.h
+index 3c8b7d274bd9b..45ba37aaf6b78 100644
+--- a/include/linux/dm-bufio.h
++++ b/include/linux/dm-bufio.h
+@@ -138,6 +138,7 @@ void dm_bufio_set_minimum_buffers(struct dm_bufio_client *c, unsigned n);
+
+ unsigned dm_bufio_get_block_size(struct dm_bufio_client *c);
+ sector_t dm_bufio_get_device_size(struct dm_bufio_client *c);
++struct dm_io_client *dm_bufio_get_dm_io_client(struct dm_bufio_client *c);
+ sector_t dm_bufio_get_block_number(struct dm_buffer *b);
+ void *dm_bufio_get_block_data(struct dm_buffer *b);
+ void *dm_bufio_get_aux_data(struct dm_buffer *b);
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 703ce71caeacb..06176ef2a8424 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1363,6 +1363,11 @@ static inline void skb_mark_not_on_list(struct sk_buff *skb)
+ skb->next = NULL;
+ }
+
++/* Iterate through singly-linked GSO fragments of an skb. */
++#define skb_list_walk_safe(first, skb, next_skb) \
++ for ((skb) = (first), (next_skb) = (skb) ? (skb)->next : NULL; (skb); \
++ (skb) = (next_skb), (next_skb) = (skb) ? (skb)->next : NULL)
++
+ static inline void skb_list_del_init(struct sk_buff *skb)
+ {
+ __list_del_entry(&skb->list);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 5b87d2dd7151b..73f208466363b 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -459,13 +459,17 @@ EXPORT_SYMBOL(__netdev_alloc_skb);
+ struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len,
+ gfp_t gfp_mask)
+ {
+- struct napi_alloc_cache *nc = this_cpu_ptr(&napi_alloc_cache);
++ struct napi_alloc_cache *nc;
+ struct sk_buff *skb;
+ void *data;
+
+ len += NET_SKB_PAD + NET_IP_ALIGN;
+
+- if ((len > SKB_WITH_OVERHEAD(PAGE_SIZE)) ||
++ /* If requested length is either too small or too big,
++ * we use kmalloc() for skb->head allocation.
++ */
++ if (len <= SKB_WITH_OVERHEAD(1024) ||
++ len > SKB_WITH_OVERHEAD(PAGE_SIZE) ||
+ (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) {
+ skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE);
+ if (!skb)
+@@ -473,6 +477,7 @@ struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len,
+ goto skb_success;
+ }
+
++ nc = this_cpu_ptr(&napi_alloc_cache);
+ len += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+ len = SKB_DATA_ALIGN(len);
+
+diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
+index 9c85ef2b7e1d0..375a3bbe64856 100644
+--- a/net/core/sock_reuseport.c
++++ b/net/core/sock_reuseport.c
+@@ -299,7 +299,7 @@ select_by_hash:
+ i = j = reciprocal_scale(hash, socks);
+ while (reuse->socks[i]->sk_state == TCP_ESTABLISHED) {
+ i++;
+- if (i >= reuse->num_socks)
++ if (i >= socks)
+ i = 0;
+ if (i == j)
+ goto out;
+diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
+index 5ee6b94131b23..33684f1818a82 100644
+--- a/net/dcb/dcbnl.c
++++ b/net/dcb/dcbnl.c
+@@ -1756,6 +1756,8 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
+ fn = &reply_funcs[dcb->cmd];
+ if (!fn->cb)
+ return -EOPNOTSUPP;
++ if (fn->type == RTM_SETDCB && !netlink_capable(skb, CAP_NET_ADMIN))
++ return -EPERM;
+
+ if (!tb[DCB_ATTR_IFNAME])
+ return -EINVAL;
+diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
+index 114f9def1ec54..0792a9e2a555f 100644
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -270,7 +270,6 @@ static int esp_output_udp_encap(struct xfrm_state *x, struct sk_buff *skb, struc
+ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp)
+ {
+ u8 *tail;
+- u8 *vaddr;
+ int nfrags;
+ int esph_offset;
+ struct page *page;
+@@ -312,14 +311,10 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
+ page = pfrag->page;
+ get_page(page);
+
+- vaddr = kmap_atomic(page);
+-
+- tail = vaddr + pfrag->offset;
++ tail = page_address(page) + pfrag->offset;
+
+ esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);
+
+- kunmap_atomic(vaddr);
+-
+ nfrags = skb_shinfo(skb)->nr_frags;
+
+ __skb_fill_page_desc(skb, nfrags, page, pfrag->offset,
+diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
+index a7d996148eeda..25317d5ccf2cc 100644
+--- a/net/ipv6/esp6.c
++++ b/net/ipv6/esp6.c
+@@ -237,7 +237,6 @@ static void esp_output_fill_trailer(u8 *tail, int tfclen, int plen, __u8 proto)
+ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp)
+ {
+ u8 *tail;
+- u8 *vaddr;
+ int nfrags;
+ struct page *page;
+ struct sk_buff *trailer;
+@@ -270,14 +269,10 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
+ page = pfrag->page;
+ get_page(page);
+
+- vaddr = kmap_atomic(page);
+-
+- tail = vaddr + pfrag->offset;
++ tail = page_address(page) + pfrag->offset;
+
+ esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);
+
+- kunmap_atomic(vaddr);
+-
+ nfrags = skb_shinfo(skb)->nr_frags;
+
+ __skb_fill_page_desc(skb, nfrags, page, pfrag->offset,
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 22665e3638ac4..e1bb7db88483d 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -128,8 +128,42 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
+ return -EINVAL;
+ }
+
++static int
++ip6_finish_output_gso_slowpath_drop(struct net *net, struct sock *sk,
++ struct sk_buff *skb, unsigned int mtu)
++{
++ struct sk_buff *segs, *nskb;
++ netdev_features_t features;
++ int ret = 0;
++
++ /* Please see corresponding comment in ip_finish_output_gso
++ * describing the cases where GSO segment length exceeds the
++ * egress MTU.
++ */
++ features = netif_skb_features(skb);
++ segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
++ if (IS_ERR_OR_NULL(segs)) {
++ kfree_skb(skb);
++ return -ENOMEM;
++ }
++
++ consume_skb(skb);
++
++ skb_list_walk_safe(segs, segs, nskb) {
++ int err;
++
++ skb_mark_not_on_list(segs);
++ err = ip6_fragment(net, sk, segs, ip6_finish_output2);
++ if (err && ret == 0)
++ ret = err;
++ }
++
++ return ret;
++}
++
+ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
++ unsigned int mtu;
+ int ret;
+
+ ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
+@@ -146,7 +180,11 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s
+ }
+ #endif
+
+- if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
++ mtu = ip6_skb_dst_mtu(skb);
++ if (skb_is_gso(skb) && !skb_gso_validate_network_len(skb, mtu))
++ return ip6_finish_output_gso_slowpath_drop(net, sk, skb, mtu);
++
++ if ((skb->len > mtu && !skb_is_gso(skb)) ||
+ dst_allfrag(skb_dst(skb)) ||
+ (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
+ return ip6_fragment(net, sk, skb, ip6_finish_output2);
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 98c108baf35e2..bcf29201f87b3 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1596,8 +1596,11 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
+ }
+
+ #ifdef CONFIG_IPV6_SIT_6RD
+- if (ipip6_netlink_6rd_parms(data, &ip6rd))
++ if (ipip6_netlink_6rd_parms(data, &ip6rd)) {
+ err = ipip6_tunnel_update_6rd(nt, &ip6rd);
++ if (err < 0)
++ unregister_netdevice_queue(dev, NULL);
++ }
+ #endif
+
+ return err;
+diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
+index 58bd558a277a4..40711f410828e 100644
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -446,7 +446,7 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
+ if (state >= RXRPC_CALL_COMPLETE)
+ return;
+
+- if (call->state == RXRPC_CALL_SERVER_RECV_REQUEST) {
++ if (state == RXRPC_CALL_SERVER_RECV_REQUEST) {
+ unsigned long timo = READ_ONCE(call->next_req_timo);
+ unsigned long now, expect_req_by;
+
+diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
+index 2fe2add62a8ed..9be6b35fd9b26 100644
+--- a/net/rxrpc/key.c
++++ b/net/rxrpc/key.c
+@@ -1112,7 +1112,7 @@ static long rxrpc_read(const struct key *key,
+ default: /* we have a ticket we can't encode */
+ pr_err("Unsupported key token type (%u)\n",
+ token->security_index);
+- continue;
++ return -ENOPKG;
+ }
+
+ _debug("token[%u]: toksize=%u", ntoks, toksize);
+@@ -1227,7 +1227,9 @@ static long rxrpc_read(const struct key *key,
+ break;
+
+ default:
+- break;
++ pr_err("Unsupported key token type (%u)\n",
++ token->security_index);
++ return -ENOPKG;
+ }
+
+ ASSERTCMP((unsigned long)xdr - (unsigned long)oldxdr, ==,
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index f756b721f93e0..bd28ac7f2195a 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -914,9 +914,7 @@ void tipc_link_reset(struct tipc_link *l)
+ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
+ struct sk_buff_head *xmitq)
+ {
+- struct tipc_msg *hdr = buf_msg(skb_peek(list));
+ unsigned int maxwin = l->window;
+- int imp = msg_importance(hdr);
+ unsigned int mtu = l->mtu;
+ u16 ack = l->rcv_nxt - 1;
+ u16 seqno = l->snd_nxt;
+@@ -925,13 +923,20 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
+ struct sk_buff_head *backlogq = &l->backlogq;
+ struct sk_buff *skb, *_skb, **tskb;
+ int pkt_cnt = skb_queue_len(list);
++ struct tipc_msg *hdr;
+ int rc = 0;
++ int imp;
++
++ if (pkt_cnt <= 0)
++ return 0;
+
++ hdr = buf_msg(skb_peek(list));
+ if (unlikely(msg_size(hdr) > mtu)) {
+ __skb_queue_purge(list);
+ return -EMSGSIZE;
+ }
+
++ imp = msg_importance(hdr);
+ /* Allow oversubscription of one data msg per source at congestion */
+ if (unlikely(l->backlog[imp].len >= l->backlog[imp].limit)) {
+ if (imp == TIPC_SYSTEM_IMPORTANCE) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-01-27 11:15 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-01-27 11:15 UTC (permalink / raw
To: gentoo-commits
commit: 26fef560e07e6b1481f3dfc07e97794ca542aec1
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 27 11:14:44 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jan 27 11:14:44 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=26fef560
Linux patch 4.19.171
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1170_linux-4.19.171.patch | 1370 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1374 insertions(+)
diff --git a/0000_README b/0000_README
index a166692..1c1a372 100644
--- a/0000_README
+++ b/0000_README
@@ -719,6 +719,10 @@ Patch: 1169_linux-4.19.170.patch
From: https://www.kernel.org
Desc: Linux 4.19.170
+Patch: 1170_linux-4.19.171.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.171
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1170_linux-4.19.171.patch b/1170_linux-4.19.171.patch
new file mode 100644
index 0000000..6c726b2
--- /dev/null
+++ b/1170_linux-4.19.171.patch
@@ -0,0 +1,1370 @@
+diff --git a/Makefile b/Makefile
+index 7f56c62d31e8a..335b015c5c9ba 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 170
++SUBLEVEL = 171
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
+index 07060e5b58641..8aa901e20ca8e 100644
+--- a/arch/arm/xen/enlighten.c
++++ b/arch/arm/xen/enlighten.c
+@@ -405,7 +405,7 @@ static int __init xen_guest_init(void)
+ }
+ gnttab_init();
+ if (!xen_initial_domain())
+- xenbus_probe(NULL);
++ xenbus_probe();
+
+ /*
+ * Making sure board specific code will not set up ops for
+diff --git a/arch/riscv/kernel/time.c b/arch/riscv/kernel/time.c
+index 1911c8f6b8a69..15f4ab40e2221 100644
+--- a/arch/riscv/kernel/time.c
++++ b/arch/riscv/kernel/time.c
+@@ -12,6 +12,7 @@
+ * GNU General Public License for more details.
+ */
+
++#include <linux/of_clk.h>
+ #include <linux/clocksource.h>
+ #include <linux/delay.h>
+ #include <asm/sbi.h>
+@@ -29,5 +30,7 @@ void __init time_init(void)
+ riscv_timebase = prop;
+
+ lpj_fine = riscv_timebase / HZ;
++
++ of_clk_init(NULL);
+ timer_probe();
+ }
+diff --git a/arch/sh/drivers/dma/Kconfig b/arch/sh/drivers/dma/Kconfig
+index d0de378beefe5..7d54f284ce10f 100644
+--- a/arch/sh/drivers/dma/Kconfig
++++ b/arch/sh/drivers/dma/Kconfig
+@@ -63,8 +63,7 @@ config PVR2_DMA
+
+ config G2_DMA
+ tristate "G2 Bus DMA support"
+- depends on SH_DREAMCAST
+- select SH_DMA_API
++ depends on SH_DREAMCAST && SH_DMA_API
+ help
+ This enables support for the DMA controller for the Dreamcast's
+ G2 bus. Drivers that want this will generally enable this on
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index de9dc041d703e..d614cb72041e1 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -586,6 +586,8 @@ static int acpi_get_device_data(acpi_handle handle, struct acpi_device **device,
+ if (!device)
+ return -EINVAL;
+
++ *device = NULL;
++
+ status = acpi_get_data_full(handle, acpi_scan_drop_device,
+ (void **)device, callback);
+ if (ACPI_FAILURE(status) || !*device) {
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 4818aaddd712e..f7f601858f10d 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -93,6 +93,16 @@ void device_links_read_unlock(int not_used)
+ }
+ #endif /* !CONFIG_SRCU */
+
++static bool device_is_ancestor(struct device *dev, struct device *target)
++{
++ while (target->parent) {
++ target = target->parent;
++ if (dev == target)
++ return true;
++ }
++ return false;
++}
++
+ /**
+ * device_is_dependent - Check if one device depends on another one
+ * @dev: Device to check dependencies for.
+@@ -106,7 +116,12 @@ static int device_is_dependent(struct device *dev, void *target)
+ struct device_link *link;
+ int ret;
+
+- if (dev == target)
++ /*
++ * The "ancestors" check is needed to catch the case when the target
++ * device has not been completely initialized yet and it is still
++ * missing from the list of children of its parent device.
++ */
++ if (dev == target || device_is_ancestor(dev, target))
+ return 1;
+
+ ret = device_for_each_child(dev, target, device_is_dependent);
+diff --git a/drivers/clk/tegra/clk-tegra30.c b/drivers/clk/tegra/clk-tegra30.c
+index e0aaecd98fbff..678019f86bc7a 100644
+--- a/drivers/clk/tegra/clk-tegra30.c
++++ b/drivers/clk/tegra/clk-tegra30.c
+@@ -1274,6 +1274,8 @@ static struct tegra_clk_init_table init_table[] __initdata = {
+ { TEGRA30_CLK_I2S3_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
+ { TEGRA30_CLK_I2S4_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
+ { TEGRA30_CLK_VIMCLK_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_HDA, TEGRA30_CLK_PLL_P, 102000000, 0 },
++ { TEGRA30_CLK_HDA2CODEC_2X, TEGRA30_CLK_PLL_P, 48000000, 0 },
+ /* must be the last entry */
+ { TEGRA30_CLK_CLK_MAX, TEGRA30_CLK_CLK_MAX, 0, 0 },
+ };
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index d24a15484e31c..6060b69fa6182 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -2938,7 +2938,7 @@ int drm_atomic_helper_set_config(struct drm_mode_set *set,
+
+ ret = handle_conflicting_encoders(state, true);
+ if (ret)
+- return ret;
++ goto fail;
+
+ ret = drm_atomic_commit(state);
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index 1bb0a9f6fa730..fbe156302ee86 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -131,7 +131,7 @@ nv50_dmac_destroy(struct nv50_dmac *dmac)
+
+ int
+ nv50_dmac_create(struct nvif_device *device, struct nvif_object *disp,
+- const s32 *oclass, u8 head, void *data, u32 size, u64 syncbuf,
++ const s32 *oclass, u8 head, void *data, u32 size, s64 syncbuf,
+ struct nv50_dmac *dmac)
+ {
+ struct nouveau_cli *cli = (void *)device->object.client;
+@@ -166,7 +166,7 @@ nv50_dmac_create(struct nvif_device *device, struct nvif_object *disp,
+ if (ret)
+ return ret;
+
+- if (!syncbuf)
++ if (syncbuf < 0)
+ return 0;
+
+ ret = nvif_object_init(&dmac->base.user, 0xf0000000, NV_DMA_IN_MEMORY,
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.h b/drivers/gpu/drm/nouveau/dispnv50/disp.h
+index 66c125a6b0b3c..55205d23360c8 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.h
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.h
+@@ -68,7 +68,7 @@ struct nv50_dmac {
+
+ int nv50_dmac_create(struct nvif_device *device, struct nvif_object *disp,
+ const s32 *oclass, u8 head, void *data, u32 size,
+- u64 syncbuf, struct nv50_dmac *dmac);
++ s64 syncbuf, struct nv50_dmac *dmac);
+ void nv50_dmac_destroy(struct nv50_dmac *);
+
+ u32 *evo_wait(struct nv50_dmac *, int nr);
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c b/drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c
+index f7dbd965e4e72..b49a212af4d8d 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c
+@@ -68,7 +68,7 @@ wimmc37b_init_(const struct nv50_wimm_func *func, struct nouveau_drm *drm,
+ int ret;
+
+ ret = nv50_dmac_create(&drm->client.device, &disp->disp->object,
+- &oclass, 0, &args, sizeof(args), 0,
++ &oclass, 0, &args, sizeof(args), -1,
+ &wndw->wimm);
+ if (ret) {
+ NV_ERROR(drm, "wimm%04x allocation failed: %d\n", oclass, ret);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
+index 7deb81b6dbac6..4b571cc6bc70f 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
+@@ -75,7 +75,7 @@ shadow_image(struct nvkm_bios *bios, int idx, u32 offset, struct shadow *mthd)
+ nvkm_debug(subdev, "%08x: type %02x, %d bytes\n",
+ image.base, image.type, image.size);
+
+- if (!shadow_fetch(bios, mthd, image.size)) {
++ if (!shadow_fetch(bios, mthd, image.base + image.size)) {
+ nvkm_debug(subdev, "%08x: fetch failed\n", image.base);
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
+index edb6148cbca04..d0e80ad526845 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/i2c/auxgm200.c
+@@ -33,7 +33,7 @@ static void
+ gm200_i2c_aux_fini(struct gm200_i2c_aux *aux)
+ {
+ struct nvkm_device *device = aux->base.pad->i2c->subdev.device;
+- nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00310000, 0x00000000);
++ nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00710000, 0x00000000);
+ }
+
+ static int
+@@ -54,10 +54,10 @@ gm200_i2c_aux_init(struct gm200_i2c_aux *aux)
+ AUX_ERR(&aux->base, "begin idle timeout %08x", ctrl);
+ return -EBUSY;
+ }
+- } while (ctrl & 0x03010000);
++ } while (ctrl & 0x07010000);
+
+ /* set some magic, and wait up to 1ms for it to appear */
+- nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00300000, ureq);
++ nvkm_mask(device, 0x00d954 + (aux->ch * 0x50), 0x00700000, ureq);
+ timeout = 1000;
+ do {
+ ctrl = nvkm_rd32(device, 0x00d954 + (aux->ch * 0x50));
+@@ -67,7 +67,7 @@ gm200_i2c_aux_init(struct gm200_i2c_aux *aux)
+ gm200_i2c_aux_fini(aux);
+ return -EBUSY;
+ }
+- } while ((ctrl & 0x03000000) != urep);
++ } while ((ctrl & 0x07000000) != urep);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c
+index d80dbc8f09b20..55a4ea4393c62 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c
+@@ -22,6 +22,7 @@
+ * Authors: Ben Skeggs
+ */
+ #include "priv.h"
++#include <subdev/timer.h>
+
+ static void
+ gf100_ibus_intr_hub(struct nvkm_subdev *ibus, int i)
+@@ -31,7 +32,6 @@ gf100_ibus_intr_hub(struct nvkm_subdev *ibus, int i)
+ u32 data = nvkm_rd32(device, 0x122124 + (i * 0x0400));
+ u32 stat = nvkm_rd32(device, 0x122128 + (i * 0x0400));
+ nvkm_debug(ibus, "HUB%d: %06x %08x (%08x)\n", i, addr, data, stat);
+- nvkm_mask(device, 0x122128 + (i * 0x0400), 0x00000200, 0x00000000);
+ }
+
+ static void
+@@ -42,7 +42,6 @@ gf100_ibus_intr_rop(struct nvkm_subdev *ibus, int i)
+ u32 data = nvkm_rd32(device, 0x124124 + (i * 0x0400));
+ u32 stat = nvkm_rd32(device, 0x124128 + (i * 0x0400));
+ nvkm_debug(ibus, "ROP%d: %06x %08x (%08x)\n", i, addr, data, stat);
+- nvkm_mask(device, 0x124128 + (i * 0x0400), 0x00000200, 0x00000000);
+ }
+
+ static void
+@@ -53,7 +52,6 @@ gf100_ibus_intr_gpc(struct nvkm_subdev *ibus, int i)
+ u32 data = nvkm_rd32(device, 0x128124 + (i * 0x0400));
+ u32 stat = nvkm_rd32(device, 0x128128 + (i * 0x0400));
+ nvkm_debug(ibus, "GPC%d: %06x %08x (%08x)\n", i, addr, data, stat);
+- nvkm_mask(device, 0x128128 + (i * 0x0400), 0x00000200, 0x00000000);
+ }
+
+ void
+@@ -90,6 +88,12 @@ gf100_ibus_intr(struct nvkm_subdev *ibus)
+ intr1 &= ~stat;
+ }
+ }
++
++ nvkm_mask(device, 0x121c4c, 0x0000003f, 0x00000002);
++ nvkm_msec(device, 2000,
++ if (!(nvkm_rd32(device, 0x121c4c) & 0x0000003f))
++ break;
++ );
+ }
+
+ static int
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c
+index 9025ed1bd2a99..4caf3ef087e1d 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c
+@@ -22,6 +22,7 @@
+ * Authors: Ben Skeggs
+ */
+ #include "priv.h"
++#include <subdev/timer.h>
+
+ static void
+ gk104_ibus_intr_hub(struct nvkm_subdev *ibus, int i)
+@@ -31,7 +32,6 @@ gk104_ibus_intr_hub(struct nvkm_subdev *ibus, int i)
+ u32 data = nvkm_rd32(device, 0x122124 + (i * 0x0800));
+ u32 stat = nvkm_rd32(device, 0x122128 + (i * 0x0800));
+ nvkm_debug(ibus, "HUB%d: %06x %08x (%08x)\n", i, addr, data, stat);
+- nvkm_mask(device, 0x122128 + (i * 0x0800), 0x00000200, 0x00000000);
+ }
+
+ static void
+@@ -42,7 +42,6 @@ gk104_ibus_intr_rop(struct nvkm_subdev *ibus, int i)
+ u32 data = nvkm_rd32(device, 0x124124 + (i * 0x0800));
+ u32 stat = nvkm_rd32(device, 0x124128 + (i * 0x0800));
+ nvkm_debug(ibus, "ROP%d: %06x %08x (%08x)\n", i, addr, data, stat);
+- nvkm_mask(device, 0x124128 + (i * 0x0800), 0x00000200, 0x00000000);
+ }
+
+ static void
+@@ -53,7 +52,6 @@ gk104_ibus_intr_gpc(struct nvkm_subdev *ibus, int i)
+ u32 data = nvkm_rd32(device, 0x128124 + (i * 0x0800));
+ u32 stat = nvkm_rd32(device, 0x128128 + (i * 0x0800));
+ nvkm_debug(ibus, "GPC%d: %06x %08x (%08x)\n", i, addr, data, stat);
+- nvkm_mask(device, 0x128128 + (i * 0x0800), 0x00000200, 0x00000000);
+ }
+
+ void
+@@ -90,6 +88,12 @@ gk104_ibus_intr(struct nvkm_subdev *ibus)
+ intr1 &= ~stat;
+ }
+ }
++
++ nvkm_mask(device, 0x12004c, 0x0000003f, 0x00000002);
++ nvkm_msec(device, 2000,
++ if (!(nvkm_rd32(device, 0x12004c) & 0x0000003f))
++ break;
++ );
+ }
+
+ static int
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
+index ee11ccaf0563c..cb51e248cb41b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
+@@ -316,9 +316,9 @@ nvkm_mmu_vram(struct nvkm_mmu *mmu)
+ {
+ struct nvkm_device *device = mmu->subdev.device;
+ struct nvkm_mm *mm = &device->fb->ram->vram;
+- const u32 sizeN = nvkm_mm_heap_size(mm, NVKM_RAM_MM_NORMAL);
+- const u32 sizeU = nvkm_mm_heap_size(mm, NVKM_RAM_MM_NOMAP);
+- const u32 sizeM = nvkm_mm_heap_size(mm, NVKM_RAM_MM_MIXED);
++ const u64 sizeN = nvkm_mm_heap_size(mm, NVKM_RAM_MM_NORMAL);
++ const u64 sizeU = nvkm_mm_heap_size(mm, NVKM_RAM_MM_NOMAP);
++ const u64 sizeM = nvkm_mm_heap_size(mm, NVKM_RAM_MM_MIXED);
+ u8 type = NVKM_MEM_KIND * !!mmu->func->kind;
+ u8 heap = NVKM_MEM_VRAM;
+ int heapM, heapN, heapU;
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 6d118da1615d4..ab2be7a115d8f 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -386,6 +386,7 @@
+ #define USB_DEVICE_ID_TOSHIBA_CLICK_L9W 0x0401
+ #define USB_DEVICE_ID_HP_X2 0x074d
+ #define USB_DEVICE_ID_HP_X2_10_COVER 0x0755
++#define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN 0x2706
+
+ #define USB_VENDOR_ID_ELECOM 0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084 0x0061
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 13deb9a676855..4dd151b2924e2 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -334,6 +334,8 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
+ USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD),
+ HID_BATTERY_QUIRK_IGNORE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN),
++ HID_BATTERY_QUIRK_IGNORE },
+ {}
+ };
+
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index a775d7acfa470..2a16171033941 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -230,6 +230,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Alder Lake-P */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x51a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ {
+ /* Emmitsburg PCH */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x1bcc),
+diff --git a/drivers/hwtracing/stm/heartbeat.c b/drivers/hwtracing/stm/heartbeat.c
+index 7db42395e1316..825c59a77a0e0 100644
+--- a/drivers/hwtracing/stm/heartbeat.c
++++ b/drivers/hwtracing/stm/heartbeat.c
+@@ -64,7 +64,7 @@ static void stm_heartbeat_unlink(struct stm_source_data *data)
+
+ static int stm_heartbeat_init(void)
+ {
+- int i, ret = -ENOMEM;
++ int i, ret;
+
+ if (nr_devs < 0 || nr_devs > STM_HEARTBEAT_MAX)
+ return -EINVAL;
+@@ -72,8 +72,10 @@ static int stm_heartbeat_init(void)
+ for (i = 0; i < nr_devs; i++) {
+ stm_heartbeat[i].data.name =
+ kasprintf(GFP_KERNEL, "heartbeat.%d", i);
+- if (!stm_heartbeat[i].data.name)
++ if (!stm_heartbeat[i].data.name) {
++ ret = -ENOMEM;
+ goto fail_unregister;
++ }
+
+ stm_heartbeat[i].data.nr_chans = 1;
+ stm_heartbeat[i].data.link = stm_heartbeat_link;
+diff --git a/drivers/i2c/busses/i2c-octeon-core.c b/drivers/i2c/busses/i2c-octeon-core.c
+index d9607905dc2f1..845eda70b8cab 100644
+--- a/drivers/i2c/busses/i2c-octeon-core.c
++++ b/drivers/i2c/busses/i2c-octeon-core.c
+@@ -347,7 +347,7 @@ static int octeon_i2c_read(struct octeon_i2c *i2c, int target,
+ if (result)
+ return result;
+ if (recv_len && i == 0) {
+- if (data[i] > I2C_SMBUS_BLOCK_MAX + 1)
++ if (data[i] > I2C_SMBUS_BLOCK_MAX)
+ return -EPROTO;
+ length += data[i];
+ }
+diff --git a/drivers/i2c/busses/i2c-tegra-bpmp.c b/drivers/i2c/busses/i2c-tegra-bpmp.c
+index f6cd35d0a2ac0..240bd1e908927 100644
+--- a/drivers/i2c/busses/i2c-tegra-bpmp.c
++++ b/drivers/i2c/busses/i2c-tegra-bpmp.c
+@@ -91,7 +91,7 @@ static int tegra_bpmp_xlate_flags(u16 flags, u16 *out)
+ flags &= ~I2C_M_RECV_LEN;
+ }
+
+- return (flags != 0) ? -EINVAL : 0;
++ return 0;
+ }
+
+ /**
+diff --git a/drivers/iio/dac/ad5504.c b/drivers/iio/dac/ad5504.c
+index d9037ea59168e..97b9ce305a687 100644
+--- a/drivers/iio/dac/ad5504.c
++++ b/drivers/iio/dac/ad5504.c
+@@ -189,9 +189,9 @@ static ssize_t ad5504_write_dac_powerdown(struct iio_dev *indio_dev,
+ return ret;
+
+ if (pwr_down)
+- st->pwr_down_mask |= (1 << chan->channel);
+- else
+ st->pwr_down_mask &= ~(1 << chan->channel);
++ else
++ st->pwr_down_mask |= (1 << chan->channel);
+
+ ret = ad5504_spi_write(st, AD5504_ADDR_CTRL,
+ AD5504_DAC_PWRDWN_MODE(st->pwr_down_mode) |
+diff --git a/drivers/irqchip/irq-mips-cpu.c b/drivers/irqchip/irq-mips-cpu.c
+index 66f97fde13d80..51e09f6c653c3 100644
+--- a/drivers/irqchip/irq-mips-cpu.c
++++ b/drivers/irqchip/irq-mips-cpu.c
+@@ -201,6 +201,13 @@ static int mips_cpu_ipi_alloc(struct irq_domain *domain, unsigned int virq,
+ if (ret)
+ return ret;
+
++ ret = irq_domain_set_hwirq_and_chip(domain->parent, virq + i, hwirq,
++ &mips_mt_cpu_irq_controller,
++ NULL);
++
++ if (ret)
++ return ret;
++
+ ret = irq_set_irq_type(virq + i, IRQ_TYPE_LEVEL_HIGH);
+ if (ret)
+ return ret;
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index bb99b599de770..1917051b512f5 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -3515,6 +3515,12 @@ try_smaller_buffer:
+ r = -ENOMEM;
+ goto bad;
+ }
++ } else {
++ if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) {
++ ti->error = "Recalculate can only be specified with internal_hash";
++ r = -EINVAL;
++ goto bad;
++ }
+ }
+
+ ic->bufio = dm_bufio_client_create(ic->meta_dev ? ic->meta_dev->bdev : ic->dev->bdev,
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index f849db3035a05..9164337424856 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -431,14 +431,23 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
+ {
+ int r;
+ dev_t dev;
++ unsigned int major, minor;
++ char dummy;
+ struct dm_dev_internal *dd;
+ struct dm_table *t = ti->table;
+
+ BUG_ON(!t);
+
+- dev = dm_get_dev_t(path);
+- if (!dev)
+- return -ENODEV;
++ if (sscanf(path, "%u:%u%c", &major, &minor, &dummy) == 2) {
++ /* Extract the major/minor numbers */
++ dev = MKDEV(major, minor);
++ if (MAJOR(dev) != major || MINOR(dev) != minor)
++ return -EOVERFLOW;
++ } else {
++ dev = dm_get_dev_t(path);
++ if (!dev)
++ return -ENODEV;
++ }
+
+ dd = find_device(&t->devices, dev);
+ if (!dd) {
+diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
+index 9b31cd6b6062b..9aaf5a2d83c3b 100644
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -364,8 +364,10 @@ static void mmc_setup_queue(struct mmc_queue *mq, struct mmc_card *card)
+ min(host->max_blk_count, host->max_req_size / 512));
+ blk_queue_max_segments(mq->queue, host->max_segs);
+
+- if (mmc_card_mmc(card))
++ if (mmc_card_mmc(card) && card->ext_csd.data_sector_size) {
+ block_size = card->ext_csd.data_sector_size;
++ WARN_ON(block_size != 512 && block_size != 4096);
++ }
+
+ blk_queue_logical_block_size(mq->queue, block_size);
+ blk_queue_max_segment_size(mq->queue,
+diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
+index fafb02644efde..ca34fa424634f 100644
+--- a/drivers/mmc/host/sdhci-xenon.c
++++ b/drivers/mmc/host/sdhci-xenon.c
+@@ -170,7 +170,12 @@ static void xenon_reset_exit(struct sdhci_host *host,
+ /* Disable tuning request and auto-retuning again */
+ xenon_retune_setup(host);
+
+- xenon_set_acg(host, true);
++ /*
++ * The ACG should be turned off at the early init time, in order
++ * to solve a possible issues with the 1.8V regulator stabilization.
++ * The feature is enabled in later stage.
++ */
++ xenon_set_acg(host, false);
+
+ xenon_set_sdclk_off_idle(host, sdhc_id, false);
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index f88590074569e..953c6fdc75cc4 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -579,11 +579,11 @@ static void can_restart(struct net_device *dev)
+ }
+ cf->can_id |= CAN_ERR_RESTARTED;
+
+- netif_rx_ni(skb);
+-
+ stats->rx_packets++;
+ stats->rx_bytes += cf->can_dlc;
+
++ netif_rx_ni(skb);
++
+ restart:
+ netdev_dbg(dev, "restarted\n");
+ priv->can_stats.restarts++;
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+index 19600d35aac55..40ac37fe9dcde 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+@@ -520,11 +520,11 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if,
+ else
+ memcpy(cfd->data, rm->d, cfd->len);
+
+- peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low));
+-
+ netdev->stats.rx_packets++;
+ netdev->stats.rx_bytes += cfd->len;
+
++ peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low));
++
+ return 0;
+ }
+
+@@ -586,11 +586,11 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if,
+ if (!skb)
+ return -ENOMEM;
+
+- peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low));
+-
+ netdev->stats.rx_packets++;
+ netdev->stats.rx_bytes += cf->can_dlc;
+
++ peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low));
++
+ return 0;
+ }
+
+diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
+index ed6828821fbd3..ccd758ba3fb09 100644
+--- a/drivers/net/can/vxcan.c
++++ b/drivers/net/can/vxcan.c
+@@ -49,6 +49,7 @@ static netdev_tx_t vxcan_xmit(struct sk_buff *skb, struct net_device *dev)
+ struct net_device *peer;
+ struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
+ struct net_device_stats *peerstats, *srcstats = &dev->stats;
++ u8 len;
+
+ if (can_dropped_invalid_skb(dev, skb))
+ return NETDEV_TX_OK;
+@@ -71,12 +72,13 @@ static netdev_tx_t vxcan_xmit(struct sk_buff *skb, struct net_device *dev)
+ skb->dev = peer;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+
++ len = cfd->len;
+ if (netif_rx_ni(skb) == NET_RX_SUCCESS) {
+ srcstats->tx_packets++;
+- srcstats->tx_bytes += cfd->len;
++ srcstats->tx_bytes += len;
+ peerstats = &peer->stats;
+ peerstats->rx_packets++;
+- peerstats->rx_bytes += cfd->len;
++ peerstats->rx_bytes += len;
+ }
+
+ out_unlock:
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 294be86420b6d..335ce1e849044 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1142,7 +1142,7 @@ int b53_vlan_prepare(struct dsa_switch *ds, int port,
+ if ((is5325(dev) || is5365(dev)) && vlan->vid_begin == 0)
+ return -EOPNOTSUPP;
+
+- if (vlan->vid_end > dev->num_vlans)
++ if (vlan->vid_end >= dev->num_vlans)
+ return -ERANGE;
+
+ b53_enable_vlan(dev, true, dev->vlan_filtering_enabled);
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index a29a6a618110e..ea30da1c53f0f 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -1549,10 +1549,8 @@ static int ocelot_netdevice_event(struct notifier_block *unused,
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+ int ret = 0;
+
+- if (!ocelot_netdevice_dev_check(dev))
+- return 0;
+-
+ if (event == NETDEV_PRECHANGEUPPER &&
++ ocelot_netdevice_dev_check(dev) &&
+ netif_is_lag_master(info->upper_dev)) {
+ struct netdev_lag_upper_info *lag_upper_info = info->upper_info;
+ struct netlink_ext_ack *extack;
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 441643670ac0e..9ac7b09badca6 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2620,10 +2620,10 @@ static int sh_eth_close(struct net_device *ndev)
+ /* Free all the skbuffs in the Rx queue and the DMA buffer. */
+ sh_eth_ring_free(ndev);
+
+- pm_runtime_put_sync(&mdp->pdev->dev);
+-
+ mdp->is_opened = 0;
+
++ pm_runtime_put(&mdp->pdev->dev);
++
+ return 0;
+ }
+
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index 36d6e72f50735..f5774372c3871 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -191,12 +191,6 @@ static const struct dmi_system_id dmi_switches_allow_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Venue 11 Pro 7130"),
+ },
+ },
+- {
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP Stream x360 Convertible PC 11"),
+- },
+- },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 83d25ee88f028..8877a21102f1d 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -7323,11 +7323,9 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
+ goto out;
+ }
+
++ /* always store 64 bits regardless of addressing */
+ sense_ptr = (void *)cmd->frame + ioc->sense_off;
+- if (instance->consistent_mask_64bit)
+- put_unaligned_le64(sense_handle, sense_ptr);
+- else
+- put_unaligned_le32(sense_handle, sense_ptr);
++ put_unaligned_le64(sense_handle, sense_ptr);
+ }
+
+ /*
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index eaa50328de90c..e201c163ea1c8 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -2129,7 +2129,7 @@ qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type,
+ chap_name);
+ break;
+ case ISCSI_BOOT_TGT_CHAP_SECRET:
+- rc = sprintf(buf, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
++ rc = sprintf(buf, "%.*s\n", NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN,
+ chap_secret);
+ break;
+ case ISCSI_BOOT_TGT_REV_CHAP_NAME:
+@@ -2137,7 +2137,7 @@ qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type,
+ mchap_name);
+ break;
+ case ISCSI_BOOT_TGT_REV_CHAP_SECRET:
+- rc = sprintf(buf, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
++ rc = sprintf(buf, "%.*s\n", NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN,
+ mchap_secret);
+ break;
+ case ISCSI_BOOT_TGT_FLAGS:
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 40f478c4d118f..b18430efb00fb 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -5772,19 +5772,16 @@ static int ufshcd_eh_device_reset_handler(struct scsi_cmnd *cmd)
+ {
+ struct Scsi_Host *host;
+ struct ufs_hba *hba;
+- unsigned int tag;
+ u32 pos;
+ int err;
+- u8 resp = 0xF;
+- struct ufshcd_lrb *lrbp;
++ u8 resp = 0xF, lun;
+ unsigned long flags;
+
+ host = cmd->device->host;
+ hba = shost_priv(host);
+- tag = cmd->request->tag;
+
+- lrbp = &hba->lrb[tag];
+- err = ufshcd_issue_tm_cmd(hba, lrbp->lun, 0, UFS_LOGICAL_RESET, &resp);
++ lun = ufshcd_scsi_to_upiu_lun(cmd->device->lun);
++ err = ufshcd_issue_tm_cmd(hba, lun, 0, UFS_LOGICAL_RESET, &resp);
+ if (err || resp != UPIU_TASK_MANAGEMENT_FUNC_COMPL) {
+ if (!err)
+ err = resp;
+@@ -5793,7 +5790,7 @@ static int ufshcd_eh_device_reset_handler(struct scsi_cmnd *cmd)
+
+ /* clear the commands that were pending for corresponding LUN */
+ for_each_set_bit(pos, &hba->outstanding_reqs, hba->nutrs) {
+- if (hba->lrb[pos].lun == lrbp->lun) {
++ if (hba->lrb[pos].lun == lun) {
+ err = ufshcd_clear_cmd(hba, pos);
+ if (err)
+ break;
+diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
+index fb9d369e0f50c..330522be708fa 100644
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -637,6 +637,14 @@ static void wait_for_xmitr(struct uart_port *port)
+ (val & STAT_TX_RDY(port)), 1, 10000);
+ }
+
++static void wait_for_xmite(struct uart_port *port)
++{
++ u32 val;
++
++ readl_poll_timeout_atomic(port->membase + UART_STAT, val,
++ (val & STAT_TX_EMP), 1, 10000);
++}
++
+ static void mvebu_uart_console_putchar(struct uart_port *port, int ch)
+ {
+ wait_for_xmitr(port);
+@@ -664,7 +672,7 @@ static void mvebu_uart_console_write(struct console *co, const char *s,
+
+ uart_console_write(port, s, count, mvebu_uart_console_putchar);
+
+- wait_for_xmitr(port);
++ wait_for_xmite(port);
+
+ if (ier)
+ writel(ier, port->membase + UART_CTRL(port));
+diff --git a/drivers/usb/gadget/udc/aspeed-vhub/epn.c b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+index 5939eb1e97f20..ae853cf369662 100644
+--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c
++++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+@@ -420,7 +420,10 @@ static void ast_vhub_stop_active_req(struct ast_vhub_ep *ep,
+ u32 state, reg, loops;
+
+ /* Stop DMA activity */
+- writel(0, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT);
++ if (ep->epn.desc_mode)
++ writel(VHUB_EP_DMA_CTRL_RESET, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT);
++ else
++ writel(0, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT);
+
+ /* Wait for it to complete */
+ for (loops = 0; loops < 1000; loops++) {
+diff --git a/drivers/usb/gadget/udc/bdc/Kconfig b/drivers/usb/gadget/udc/bdc/Kconfig
+index c74ac25dddcd0..051091bd265bc 100644
+--- a/drivers/usb/gadget/udc/bdc/Kconfig
++++ b/drivers/usb/gadget/udc/bdc/Kconfig
+@@ -15,7 +15,7 @@ if USB_BDC_UDC
+ comment "Platform Support"
+ config USB_BDC_PCI
+ tristate "BDC support for PCIe based platforms"
+- depends on USB_PCI
++ depends on USB_PCI && BROKEN
+ default USB_BDC_UDC
+ help
+ Enable support for platforms which have BDC connected through PCIe, such as Lego3 FPGA platform.
+diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
+index 1a79a99551871..87a417d878b8a 100644
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -1471,10 +1471,13 @@ static ssize_t soft_connect_store(struct device *dev,
+ struct device_attribute *attr, const char *buf, size_t n)
+ {
+ struct usb_udc *udc = container_of(dev, struct usb_udc, dev);
++ ssize_t ret;
+
++ mutex_lock(&udc_lock);
+ if (!udc->driver) {
+ dev_err(dev, "soft-connect without a gadget driver\n");
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto out;
+ }
+
+ if (sysfs_streq(buf, "connect")) {
+@@ -1486,10 +1489,14 @@ static ssize_t soft_connect_store(struct device *dev,
+ usb_gadget_udc_stop(udc);
+ } else {
+ dev_err(dev, "unsupported command '%s'\n", buf);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out;
+ }
+
+- return n;
++ ret = n;
++out:
++ mutex_unlock(&udc_lock);
++ return ret;
+ }
+ static DEVICE_ATTR_WO(soft_connect);
+
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index caf9f6b1cd346..d9282ca7ae8c5 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -574,6 +574,7 @@ static int ehci_run (struct usb_hcd *hcd)
+ struct ehci_hcd *ehci = hcd_to_ehci (hcd);
+ u32 temp;
+ u32 hcc_params;
++ int rc;
+
+ hcd->uses_new_polling = 1;
+
+@@ -629,9 +630,20 @@ static int ehci_run (struct usb_hcd *hcd)
+ down_write(&ehci_cf_port_reset_rwsem);
+ ehci->rh_state = EHCI_RH_RUNNING;
+ ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag);
++
++ /* Wait until HC become operational */
+ ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
+ msleep(5);
++ rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000);
++
+ up_write(&ehci_cf_port_reset_rwsem);
++
++ if (rc) {
++ ehci_err(ehci, "USB %x.%x, controller refused to start: %d\n",
++ ((ehci->sbrn & 0xf0)>>4), (ehci->sbrn & 0x0f), rc);
++ return rc;
++ }
++
+ ehci->last_periodic_enable = ktime_get_real();
+
+ temp = HC_VERSION(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));
+diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
+index 087402aec5cbe..9f9ab5ccea889 100644
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -345,6 +345,9 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
+
+ unlink_empty_async_suspended(ehci);
+
++ /* Some Synopsys controllers mistakenly leave IAA turned on */
++ ehci_writel(ehci, STS_IAA, &ehci->regs->status);
++
+ /* Any IAA cycle that started before the suspend is now invalid */
+ end_iaa_cycle(ehci);
+ ehci_handle_start_intr_unlinks(ehci);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 2a19d9a37a6aa..537bbcd47c463 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2835,6 +2835,8 @@ static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
+ trb->field[0] = cpu_to_le32(field1);
+ trb->field[1] = cpu_to_le32(field2);
+ trb->field[2] = cpu_to_le32(field3);
++ /* make sure TRB is fully written before giving it to the controller */
++ wmb();
+ trb->field[3] = cpu_to_le32(field4);
+
+ trace_xhci_queue_trb(ring, trb);
+diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
+index fe37dacc695fc..dc9cd8c519cf2 100644
+--- a/drivers/usb/host/xhci-tegra.c
++++ b/drivers/usb/host/xhci-tegra.c
+@@ -578,6 +578,13 @@ static void tegra_xusb_mbox_handle(struct tegra_xusb *tegra,
+ enable);
+ if (err < 0)
+ break;
++
++ /*
++ * wait 500us for LFPS detector to be disabled before
++ * sending ACK
++ */
++ if (!enable)
++ usleep_range(500, 1000);
+ }
+
+ if (err < 0) {
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index aca8456752797..8c08c7d46d3d0 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1987,16 +1987,6 @@ static struct irq_chip xen_percpu_chip __read_mostly = {
+ .irq_ack = ack_dynirq,
+ };
+
+-int xen_set_callback_via(uint64_t via)
+-{
+- struct xen_hvm_param a;
+- a.domid = DOMID_SELF;
+- a.index = HVM_PARAM_CALLBACK_IRQ;
+- a.value = via;
+- return HYPERVISOR_hvm_op(HVMOP_set_param, &a);
+-}
+-EXPORT_SYMBOL_GPL(xen_set_callback_via);
+-
+ #ifdef CONFIG_XEN_PVHVM
+ /* Vector callbacks are better than PCI interrupts to receive event
+ * channel notifications because we can receive vector callbacks on any
+diff --git a/drivers/xen/platform-pci.c b/drivers/xen/platform-pci.c
+index 5d7dcad0b0a0d..4cec8146609ad 100644
+--- a/drivers/xen/platform-pci.c
++++ b/drivers/xen/platform-pci.c
+@@ -162,7 +162,6 @@ static int platform_pci_probe(struct pci_dev *pdev,
+ ret = gnttab_init();
+ if (ret)
+ goto grant_out;
+- xenbus_probe(NULL);
+ return 0;
+ grant_out:
+ gnttab_free_auto_xlat_frames();
+diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h
+index 88516a8a9f932..a9bb5f91082d3 100644
+--- a/drivers/xen/xenbus/xenbus.h
++++ b/drivers/xen/xenbus/xenbus.h
+@@ -115,6 +115,7 @@ int xenbus_probe_node(struct xen_bus_type *bus,
+ const char *type,
+ const char *nodename);
+ int xenbus_probe_devices(struct xen_bus_type *bus);
++void xenbus_probe(void);
+
+ void xenbus_dev_changed(const char *node, struct xen_bus_type *bus);
+
+diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c
+index eb5151fc8efab..e5fda0256feb3 100644
+--- a/drivers/xen/xenbus/xenbus_comms.c
++++ b/drivers/xen/xenbus/xenbus_comms.c
+@@ -57,16 +57,8 @@ DEFINE_MUTEX(xs_response_mutex);
+ static int xenbus_irq;
+ static struct task_struct *xenbus_task;
+
+-static DECLARE_WORK(probe_work, xenbus_probe);
+-
+-
+ static irqreturn_t wake_waiting(int irq, void *unused)
+ {
+- if (unlikely(xenstored_ready == 0)) {
+- xenstored_ready = 1;
+- schedule_work(&probe_work);
+- }
+-
+ wake_up(&xb_waitq);
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
+index e6d0903459e11..14ccf13ab8fa1 100644
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -683,29 +683,76 @@ void unregister_xenstore_notifier(struct notifier_block *nb)
+ }
+ EXPORT_SYMBOL_GPL(unregister_xenstore_notifier);
+
+-void xenbus_probe(struct work_struct *unused)
++void xenbus_probe(void)
+ {
+ xenstored_ready = 1;
+
++ /*
++ * In the HVM case, xenbus_init() deferred its call to
++ * xs_init() in case callbacks were not operational yet.
++ * So do it now.
++ */
++ if (xen_store_domain_type == XS_HVM)
++ xs_init();
++
+ /* Notify others that xenstore is up */
+ blocking_notifier_call_chain(&xenstore_chain, 0, NULL);
+ }
+-EXPORT_SYMBOL_GPL(xenbus_probe);
+
+-static int __init xenbus_probe_initcall(void)
++/*
++ * Returns true when XenStore init must be deferred in order to
++ * allow the PCI platform device to be initialised, before we
++ * can actually have event channel interrupts working.
++ */
++static bool xs_hvm_defer_init_for_callback(void)
+ {
+- if (!xen_domain())
+- return -ENODEV;
++#ifdef CONFIG_XEN_PVHVM
++ return xen_store_domain_type == XS_HVM &&
++ !xen_have_vector_callback;
++#else
++ return false;
++#endif
++}
+
+- if (xen_initial_domain() || xen_hvm_domain())
+- return 0;
++static int __init xenbus_probe_initcall(void)
++{
++ /*
++ * Probe XenBus here in the XS_PV case, and also XS_HVM unless we
++ * need to wait for the platform PCI device to come up.
++ */
++ if (xen_store_domain_type == XS_PV ||
++ (xen_store_domain_type == XS_HVM &&
++ !xs_hvm_defer_init_for_callback()))
++ xenbus_probe();
+
+- xenbus_probe(NULL);
+ return 0;
+ }
+-
+ device_initcall(xenbus_probe_initcall);
+
++int xen_set_callback_via(uint64_t via)
++{
++ struct xen_hvm_param a;
++ int ret;
++
++ a.domid = DOMID_SELF;
++ a.index = HVM_PARAM_CALLBACK_IRQ;
++ a.value = via;
++
++ ret = HYPERVISOR_hvm_op(HVMOP_set_param, &a);
++ if (ret)
++ return ret;
++
++ /*
++ * If xenbus_probe_initcall() deferred the xenbus_probe()
++ * due to the callback not functioning yet, we can do it now.
++ */
++ if (!xenstored_ready && xs_hvm_defer_init_for_callback())
++ xenbus_probe();
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(xen_set_callback_via);
++
+ /* Set up event channel for xenstored which is run as a local process
+ * (this is normally used only in dom0)
+ */
+@@ -818,11 +865,17 @@ static int __init xenbus_init(void)
+ break;
+ }
+
+- /* Initialize the interface to xenstore. */
+- err = xs_init();
+- if (err) {
+- pr_warn("Error initializing xenstore comms: %i\n", err);
+- goto out_error;
++ /*
++ * HVM domains may not have a functional callback yet. In that
++ * case let xs_init() be called from xenbus_probe(), which will
++ * get invoked at an appropriate time.
++ */
++ if (xen_store_domain_type != XS_HVM) {
++ err = xs_init();
++ if (err) {
++ pr_warn("Error initializing xenstore comms: %i\n", err);
++ goto out_error;
++ }
+ }
+
+ if ((xen_store_domain_type != XS_LOCAL) &&
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 95b6a4ea18f7a..662711200eeba 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4011,6 +4011,8 @@ int btrfs_recover_balance(struct btrfs_fs_info *fs_info)
+ btrfs_warn(fs_info,
+ "balance: cannot set exclusive op status, resume manually");
+
++ btrfs_release_path(path);
++
+ mutex_lock(&fs_info->balance_mutex);
+ BUG_ON(fs_info->balance_ctl);
+ spin_lock(&fs_info->balance_lock);
+diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
+index eba01ab5a55e0..fe9a9fa2ebc45 100644
+--- a/include/xen/xenbus.h
++++ b/include/xen/xenbus.h
+@@ -187,7 +187,7 @@ void xs_suspend_cancel(void);
+
+ struct work_struct;
+
+-void xenbus_probe(struct work_struct *);
++void xenbus_probe(void);
+
+ #define XENBUS_IS_ERR_READ(str) ({ \
+ if (!IS_ERR(str) && strlen(str) == 0) { \
+diff --git a/mm/kasan/kasan_init.c b/mm/kasan/kasan_init.c
+index 7a2a2f13f86f5..7a731c74be7da 100644
+--- a/mm/kasan/kasan_init.c
++++ b/mm/kasan/kasan_init.c
+@@ -372,9 +372,10 @@ static void kasan_remove_pmd_table(pmd_t *pmd, unsigned long addr,
+
+ if (kasan_pte_table(*pmd)) {
+ if (IS_ALIGNED(addr, PMD_SIZE) &&
+- IS_ALIGNED(next, PMD_SIZE))
++ IS_ALIGNED(next, PMD_SIZE)) {
+ pmd_clear(pmd);
+- continue;
++ continue;
++ }
+ }
+ pte = pte_offset_kernel(pmd, addr);
+ kasan_remove_pte_table(pte, addr, next);
+@@ -397,9 +398,10 @@ static void kasan_remove_pud_table(pud_t *pud, unsigned long addr,
+
+ if (kasan_pmd_table(*pud)) {
+ if (IS_ALIGNED(addr, PUD_SIZE) &&
+- IS_ALIGNED(next, PUD_SIZE))
++ IS_ALIGNED(next, PUD_SIZE)) {
+ pud_clear(pud);
+- continue;
++ continue;
++ }
+ }
+ pmd = pmd_offset(pud, addr);
+ pmd_base = pmd_offset(pud, 0);
+@@ -423,9 +425,10 @@ static void kasan_remove_p4d_table(p4d_t *p4d, unsigned long addr,
+
+ if (kasan_pud_table(*p4d)) {
+ if (IS_ALIGNED(addr, P4D_SIZE) &&
+- IS_ALIGNED(next, P4D_SIZE))
++ IS_ALIGNED(next, P4D_SIZE)) {
+ p4d_clear(p4d);
+- continue;
++ continue;
++ }
+ }
+ pud = pud_offset(p4d, addr);
+ kasan_remove_pud_table(pud, addr, next);
+@@ -457,9 +460,10 @@ void kasan_remove_zero_shadow(void *start, unsigned long size)
+
+ if (kasan_p4d_table(*pgd)) {
+ if (IS_ALIGNED(addr, PGDIR_SIZE) &&
+- IS_ALIGNED(next, PGDIR_SIZE))
++ IS_ALIGNED(next, PGDIR_SIZE)) {
+ pgd_clear(pgd);
+- continue;
++ continue;
++ }
+ }
+
+ p4d = p4d_offset(pgd, addr);
+@@ -483,7 +487,6 @@ int kasan_add_zero_shadow(void *start, unsigned long size)
+
+ ret = kasan_populate_zero_shadow(shadow_start, shadow_end);
+ if (ret)
+- kasan_remove_zero_shadow(shadow_start,
+- size >> KASAN_SHADOW_SCALE_SHIFT);
++ kasan_remove_zero_shadow(start, size);
+ return ret;
+ }
+diff --git a/net/core/dev.c b/net/core/dev.c
+index c77d12a35f923..5d9800804d4a4 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -8351,6 +8351,11 @@ static netdev_features_t netdev_fix_features(struct net_device *dev,
+ }
+ }
+
++ if ((features & NETIF_F_HW_TLS_RX) && !(features & NETIF_F_RXCSUM)) {
++ netdev_dbg(dev, "Dropping TLS RX HW offload feature since no RXCSUM feature.\n");
++ features &= ~NETIF_F_HW_TLS_RX;
++ }
++
+ return features;
+ }
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 73f208466363b..4a9ab2596e782 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -398,7 +398,11 @@ struct sk_buff *__netdev_alloc_skb(struct net_device *dev, unsigned int len,
+
+ len += NET_SKB_PAD;
+
+- if ((len > SKB_WITH_OVERHEAD(PAGE_SIZE)) ||
++ /* If requested length is either too small or too big,
++ * we use kmalloc() for skb->head allocation.
++ */
++ if (len <= SKB_WITH_OVERHEAD(1024) ||
++ len > SKB_WITH_OVERHEAD(PAGE_SIZE) ||
+ (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) {
+ skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE);
+ if (!skb)
+diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
+index 74b19a5c572e9..088320ce77a1b 100644
+--- a/net/ipv4/netfilter/ipt_rpfilter.c
++++ b/net/ipv4/netfilter/ipt_rpfilter.c
+@@ -94,7 +94,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ flow.daddr = iph->saddr;
+ flow.saddr = rpfilter_get_saddr(iph->daddr);
+ flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
+- flow.flowi4_tos = RT_TOS(iph->tos);
++ flow.flowi4_tos = iph->tos & IPTOS_RT_MASK;
+ flow.flowi4_scope = RT_SCOPE_UNIVERSE;
+ flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par));
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 2aacf2b348348..110af0e7dc7b6 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2416,7 +2416,8 @@ int udp_v4_early_demux(struct sk_buff *skb)
+ */
+ if (!inet_sk(sk)->inet_daddr && in_dev)
+ return ip_mc_validate_source(skb, iph->daddr,
+- iph->saddr, iph->tos,
++ iph->saddr,
++ iph->tos & IPTOS_RT_MASK,
+ skb->dev, in_dev, &itag);
+ }
+ return 0;
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 627cd24b7c0d0..76c097552ea74 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2395,8 +2395,9 @@ static void addrconf_add_mroute(struct net_device *dev)
+ .fc_ifindex = dev->ifindex,
+ .fc_dst_len = 8,
+ .fc_flags = RTF_UP,
+- .fc_type = RTN_UNICAST,
++ .fc_type = RTN_MULTICAST,
+ .fc_nlinfo.nl_net = dev_net(dev),
++ .fc_protocol = RTPROT_KERNEL,
+ };
+
+ ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
+diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
+index 0d7a0aac8dbb1..e41bc5ecaa092 100644
+--- a/net/sched/cls_tcindex.c
++++ b/net/sched/cls_tcindex.c
+@@ -339,9 +339,13 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ if (tb[TCA_TCINDEX_MASK])
+ cp->mask = nla_get_u16(tb[TCA_TCINDEX_MASK]);
+
+- if (tb[TCA_TCINDEX_SHIFT])
++ if (tb[TCA_TCINDEX_SHIFT]) {
+ cp->shift = nla_get_u32(tb[TCA_TCINDEX_SHIFT]);
+-
++ if (cp->shift > 16) {
++ err = -EINVAL;
++ goto errout;
++ }
++ }
+ if (!cp->hash) {
+ /* Hash not specified, use perfect hash if the upper limit
+ * of the hashing index is below the threshold.
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 39e319d04bb87..ed065c3432e5f 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -398,7 +398,8 @@ struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r,
+ {
+ struct qdisc_rate_table *rtab;
+
+- if (tab == NULL || r->rate == 0 || r->cell_log == 0 ||
++ if (tab == NULL || r->rate == 0 ||
++ r->cell_log == 0 || r->cell_log >= 32 ||
+ nla_len(tab) != TC_RTAB_SIZE) {
+ NL_SET_ERR_MSG(extack, "Invalid rate table parameters for searching");
+ return NULL;
+diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
+index c939459172353..247b68790a522 100644
+--- a/sound/core/seq/oss/seq_oss_synth.c
++++ b/sound/core/seq/oss/seq_oss_synth.c
+@@ -624,7 +624,8 @@ snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_in
+
+ if (info->is_midi) {
+ struct midi_info minf;
+- snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf);
++ if (snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf))
++ return -ENXIO;
+ inf->synth_type = SYNTH_TYPE_MIDI;
+ inf->synth_subtype = 0;
+ inf->nr_voices = 16;
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index 11bf7ace5ab2d..efba9057b2b61 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -126,6 +126,7 @@ static struct via_spec *via_new_spec(struct hda_codec *codec)
+ spec->codec_type = VT1708S;
+ spec->gen.indep_hp = 1;
+ spec->gen.keep_eapd_on = 1;
++ spec->gen.dac_min_mute = 1;
+ spec->gen.pcm_playback_hook = via_playback_pcm_hook;
+ spec->gen.add_stereo_mix_input = HDA_HINT_STEREO_MIX_AUTO;
+ codec->power_save_node = 1;
+diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c
+index a4022983a7ce0..67eb4a446c3cb 100644
+--- a/sound/soc/intel/boards/haswell.c
++++ b/sound/soc/intel/boards/haswell.c
+@@ -198,6 +198,7 @@ static struct platform_driver haswell_audio = {
+ .probe = haswell_audio_probe,
+ .driver = {
+ .name = "haswell-audio",
++ .pm = &snd_soc_pm_ops,
+ },
+ };
+
+diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
+index 67048f922ff20..a5ba149761bf9 100755
+--- a/tools/testing/selftests/net/fib_tests.sh
++++ b/tools/testing/selftests/net/fib_tests.sh
+@@ -987,7 +987,6 @@ ipv6_addr_metric_test()
+
+ check_route6 "2001:db8:104::1 dev dummy2 proto kernel metric 260"
+ log_test $? 0 "Set metric with peer route on local side"
+- log_test $? 0 "User specified metric on local address"
+ check_route6 "2001:db8:104::2 dev dummy2 proto kernel metric 260"
+ log_test $? 0 "Set metric with peer route on peer side"
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-01-30 13:34 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-01-30 13:34 UTC (permalink / raw
To: gentoo-commits
commit: b59ee32ab3065145d58b65bb7895cca32a510ec5
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Sat Jan 30 13:33:01 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Sat Jan 30 13:33:38 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b59ee32a
Linux patch 4.19.172
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1171_linux-4.19.172.patch | 1606 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1610 insertions(+)
diff --git a/0000_README b/0000_README
index 1c1a372..a202ba1 100644
--- a/0000_README
+++ b/0000_README
@@ -723,6 +723,10 @@ Patch: 1170_linux-4.19.171.patch
From: https://www.kernel.org
Desc: Linux 4.19.171
+Patch: 1171_linux-4.19.172.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.172
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1171_linux-4.19.172.patch b/1171_linux-4.19.172.patch
new file mode 100644
index 0000000..fc24ced
--- /dev/null
+++ b/1171_linux-4.19.172.patch
@@ -0,0 +1,1606 @@
+diff --git a/Documentation/device-mapper/dm-integrity.txt b/Documentation/device-mapper/dm-integrity.txt
+index 297251b0d2d57..bf6af2ade0a67 100644
+--- a/Documentation/device-mapper/dm-integrity.txt
++++ b/Documentation/device-mapper/dm-integrity.txt
+@@ -146,6 +146,13 @@ block_size:number
+ Supported values are 512, 1024, 2048 and 4096 bytes. If not
+ specified the default block size is 512 bytes.
+
++legacy_recalculate
++ Allow recalculating of volumes with HMAC keys. This is disabled by
++ default for security reasons - an attacker could modify the volume,
++ set recalc_sector to zero, and the kernel would not detect the
++ modification.
++
++
+ The journal mode (D/J), buffer_sectors, journal_watermark, commit_time can
+ be changed when reloading the target (load an inactive table and swap the
+ tables with suspend and resume). The other arguments should not be changed
+diff --git a/Makefile b/Makefile
+index 335b015c5c9ba..7da0ddd650521 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 171
++SUBLEVEL = 172
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index 3b78dcda47364..874caed723905 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -650,9 +650,8 @@ static void mvebu_pwm_get_state(struct pwm_chip *chip,
+
+ spin_lock_irqsave(&mvpwm->lock, flags);
+
+- val = (unsigned long long)
+- readl_relaxed(mvebu_pwmreg_blink_on_duration(mvpwm));
+- val *= NSEC_PER_SEC;
++ u = readl_relaxed(mvebu_pwmreg_blink_on_duration(mvpwm));
++ val = (unsigned long long) u * NSEC_PER_SEC;
+ do_div(val, mvpwm->clk_rate);
+ if (val > UINT_MAX)
+ state->duty_cycle = UINT_MAX;
+@@ -661,21 +660,17 @@ static void mvebu_pwm_get_state(struct pwm_chip *chip,
+ else
+ state->duty_cycle = 1;
+
+- val = (unsigned long long)
+- readl_relaxed(mvebu_pwmreg_blink_off_duration(mvpwm));
++ val = (unsigned long long) u; /* on duration */
++ /* period = on + off duration */
++ val += readl_relaxed(mvebu_pwmreg_blink_off_duration(mvpwm));
+ val *= NSEC_PER_SEC;
+ do_div(val, mvpwm->clk_rate);
+- if (val < state->duty_cycle) {
++ if (val > UINT_MAX)
++ state->period = UINT_MAX;
++ else if (val)
++ state->period = val;
++ else
+ state->period = 1;
+- } else {
+- val -= state->duty_cycle;
+- if (val > UINT_MAX)
+- state->period = UINT_MAX;
+- else if (val)
+- state->period = val;
+- else
+- state->period = 1;
+- }
+
+ regmap_read(mvchip->regs, GPIO_BLINK_EN_OFF + mvchip->offset, &u);
+ if (u)
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 523014f2c0eb2..8006732b8f424 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -150,9 +150,9 @@ static int wacom_wac_pen_serial_enforce(struct hid_device *hdev,
+ }
+
+ if (flush)
+- wacom_wac_queue_flush(hdev, &wacom_wac->pen_fifo);
++ wacom_wac_queue_flush(hdev, wacom_wac->pen_fifo);
+ else if (insert)
+- wacom_wac_queue_insert(hdev, &wacom_wac->pen_fifo,
++ wacom_wac_queue_insert(hdev, wacom_wac->pen_fifo,
+ raw_data, report_size);
+
+ return insert && !flush;
+@@ -1251,7 +1251,7 @@ static void wacom_devm_kfifo_release(struct device *dev, void *res)
+ static int wacom_devm_kfifo_alloc(struct wacom *wacom)
+ {
+ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+- struct kfifo_rec_ptr_2 *pen_fifo = &wacom_wac->pen_fifo;
++ struct kfifo_rec_ptr_2 *pen_fifo;
+ int error;
+
+ pen_fifo = devres_alloc(wacom_devm_kfifo_release,
+@@ -1268,6 +1268,7 @@ static int wacom_devm_kfifo_alloc(struct wacom *wacom)
+ }
+
+ devres_add(&wacom->hdev->dev, pen_fifo);
++ wacom_wac->pen_fifo = pen_fifo;
+
+ return 0;
+ }
+diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
+index f67d871841c0c..46da97162ef43 100644
+--- a/drivers/hid/wacom_wac.h
++++ b/drivers/hid/wacom_wac.h
+@@ -344,7 +344,7 @@ struct wacom_wac {
+ struct input_dev *pen_input;
+ struct input_dev *touch_input;
+ struct input_dev *pad_input;
+- struct kfifo_rec_ptr_2 pen_fifo;
++ struct kfifo_rec_ptr_2 *pen_fifo;
+ int pid;
+ int num_contacts_left;
+ u8 bt_features;
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 1917051b512f5..cffd423172726 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -240,6 +240,7 @@ struct dm_integrity_c {
+
+ bool journal_uptodate;
+ bool just_formatted;
++ bool legacy_recalculate;
+
+ struct alg_spec internal_hash_alg;
+ struct alg_spec journal_crypt_alg;
+@@ -345,6 +346,14 @@ static int dm_integrity_failed(struct dm_integrity_c *ic)
+ return READ_ONCE(ic->failed);
+ }
+
++static bool dm_integrity_disable_recalculate(struct dm_integrity_c *ic)
++{
++ if ((ic->internal_hash_alg.key || ic->journal_mac_alg.key) &&
++ !ic->legacy_recalculate)
++ return true;
++ return false;
++}
++
+ static commit_id_t dm_integrity_commit_id(struct dm_integrity_c *ic, unsigned i,
+ unsigned j, unsigned char seq)
+ {
+@@ -2503,6 +2512,7 @@ static void dm_integrity_status(struct dm_target *ti, status_type_t type,
+ arg_count += !!ic->internal_hash_alg.alg_string;
+ arg_count += !!ic->journal_crypt_alg.alg_string;
+ arg_count += !!ic->journal_mac_alg.alg_string;
++ arg_count += ic->legacy_recalculate;
+ DMEMIT("%s %llu %u %c %u", ic->dev->name, (unsigned long long)ic->start,
+ ic->tag_size, ic->mode, arg_count);
+ if (ic->meta_dev)
+@@ -2516,6 +2526,8 @@ static void dm_integrity_status(struct dm_target *ti, status_type_t type,
+ DMEMIT(" buffer_sectors:%u", 1U << ic->log2_buffer_sectors);
+ DMEMIT(" journal_watermark:%u", (unsigned)watermark_percentage);
+ DMEMIT(" commit_time:%u", ic->autocommit_msec);
++ if (ic->legacy_recalculate)
++ DMEMIT(" legacy_recalculate");
+
+ #define EMIT_ALG(a, n) \
+ do { \
+@@ -3118,7 +3130,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ unsigned extra_args;
+ struct dm_arg_set as;
+ static const struct dm_arg _args[] = {
+- {0, 15, "Invalid number of feature args"},
++ {0, 12, "Invalid number of feature args"},
+ };
+ unsigned journal_sectors, interleave_sectors, buffer_sectors, journal_watermark, sync_msec;
+ bool recalculate;
+@@ -3248,6 +3260,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ goto bad;
+ } else if (!strcmp(opt_string, "recalculate")) {
+ recalculate = true;
++ } else if (!strcmp(opt_string, "legacy_recalculate")) {
++ ic->legacy_recalculate = true;
+ } else {
+ r = -EINVAL;
+ ti->error = "Invalid argument";
+@@ -3523,6 +3537,14 @@ try_smaller_buffer:
+ }
+ }
+
++ if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING) &&
++ le64_to_cpu(ic->sb->recalc_sector) < ic->provided_data_sectors &&
++ dm_integrity_disable_recalculate(ic)) {
++ ti->error = "Recalculating with HMAC is disabled for security reasons - if you really need it, use the argument \"legacy_recalculate\"";
++ r = -EOPNOTSUPP;
++ goto bad;
++ }
++
+ ic->bufio = dm_bufio_client_create(ic->meta_dev ? ic->meta_dev->bdev : ic->dev->bdev,
+ 1U << (SECTOR_SHIFT + ic->log2_buffer_sectors), 1, 0, NULL, NULL);
+ if (IS_ERR(ic->bufio)) {
+diff --git a/fs/exec.c b/fs/exec.c
+index 52788644c4af2..6eea921a7e72f 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1011,7 +1011,7 @@ static int exec_mmap(struct mm_struct *mm)
+ /* Notify parent that we're no longer interested in the old VM */
+ tsk = current;
+ old_mm = current->mm;
+- mm_release(tsk, old_mm);
++ exec_mm_release(tsk, old_mm);
+
+ if (old_mm) {
+ sync_mm_rss(old_mm);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index b2a9c746f8ce4..edeb837081c80 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5209,7 +5209,7 @@ static int other_inode_match(struct inode * inode, unsigned long ino,
+ (inode->i_state & I_DIRTY_TIME)) {
+ struct ext4_inode_info *ei = EXT4_I(inode);
+
+- inode->i_state &= ~(I_DIRTY_TIME | I_DIRTY_TIME_EXPIRED);
++ inode->i_state &= ~I_DIRTY_TIME;
+ spin_unlock(&inode->i_lock);
+
+ spin_lock(&ei->i_raw_lock);
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 15216b440880a..f2d0c4acb3cbb 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -1157,7 +1157,7 @@ static bool inode_dirtied_after(struct inode *inode, unsigned long t)
+ */
+ static int move_expired_inodes(struct list_head *delaying_queue,
+ struct list_head *dispatch_queue,
+- int flags, unsigned long dirtied_before)
++ unsigned long dirtied_before)
+ {
+ LIST_HEAD(tmp);
+ struct list_head *pos, *node;
+@@ -1173,8 +1173,6 @@ static int move_expired_inodes(struct list_head *delaying_queue,
+ list_move(&inode->i_io_list, &tmp);
+ moved++;
+ spin_lock(&inode->i_lock);
+- if (flags & EXPIRE_DIRTY_ATIME)
+- inode->i_state |= I_DIRTY_TIME_EXPIRED;
+ inode->i_state |= I_SYNC_QUEUED;
+ spin_unlock(&inode->i_lock);
+ if (sb_is_blkdev_sb(inode->i_sb))
+@@ -1222,11 +1220,11 @@ static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work,
+
+ assert_spin_locked(&wb->list_lock);
+ list_splice_init(&wb->b_more_io, &wb->b_io);
+- moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, dirtied_before);
++ moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, dirtied_before);
+ if (!work->for_sync)
+ time_expire_jif = jiffies - dirtytime_expire_interval * HZ;
+ moved += move_expired_inodes(&wb->b_dirty_time, &wb->b_io,
+- EXPIRE_DIRTY_ATIME, time_expire_jif);
++ time_expire_jif);
+ if (moved)
+ wb_io_lists_populated(wb);
+ trace_writeback_queue_io(wb, work, dirtied_before, moved);
+@@ -1394,26 +1392,26 @@ __writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
+ ret = err;
+ }
+
++ /*
++ * If the inode has dirty timestamps and we need to write them, call
++ * mark_inode_dirty_sync() to notify the filesystem about it and to
++ * change I_DIRTY_TIME into I_DIRTY_SYNC.
++ */
++ if ((inode->i_state & I_DIRTY_TIME) &&
++ (wbc->sync_mode == WB_SYNC_ALL || wbc->for_sync ||
++ time_after(jiffies, inode->dirtied_time_when +
++ dirtytime_expire_interval * HZ))) {
++ trace_writeback_lazytime(inode);
++ mark_inode_dirty_sync(inode);
++ }
++
+ /*
+ * Some filesystems may redirty the inode during the writeback
+ * due to delalloc, clear dirty metadata flags right before
+ * write_inode()
+ */
+ spin_lock(&inode->i_lock);
+-
+ dirty = inode->i_state & I_DIRTY;
+- if (inode->i_state & I_DIRTY_TIME) {
+- if ((dirty & I_DIRTY_INODE) ||
+- wbc->sync_mode == WB_SYNC_ALL ||
+- unlikely(inode->i_state & I_DIRTY_TIME_EXPIRED) ||
+- unlikely(time_after(jiffies,
+- (inode->dirtied_time_when +
+- dirtytime_expire_interval * HZ)))) {
+- dirty |= I_DIRTY_TIME | I_DIRTY_TIME_EXPIRED;
+- trace_writeback_lazytime(inode);
+- }
+- } else
+- inode->i_state &= ~I_DIRTY_TIME_EXPIRED;
+ inode->i_state &= ~dirty;
+
+ /*
+@@ -1434,8 +1432,6 @@ __writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
+
+ spin_unlock(&inode->i_lock);
+
+- if (dirty & I_DIRTY_TIME)
+- mark_inode_dirty_sync(inode);
+ /* Don't write the inode if only I_DIRTY_PAGES was set */
+ if (dirty & ~I_DIRTY_PAGES) {
+ int err = write_inode(inode, wbc);
+diff --git a/fs/xfs/xfs_trans_inode.c b/fs/xfs/xfs_trans_inode.c
+index ae453dd236a69..6fcdf7e449fe7 100644
+--- a/fs/xfs/xfs_trans_inode.c
++++ b/fs/xfs/xfs_trans_inode.c
+@@ -99,9 +99,9 @@ xfs_trans_log_inode(
+ * to log the timestamps, or will clear already cleared fields in the
+ * worst case.
+ */
+- if (inode->i_state & (I_DIRTY_TIME | I_DIRTY_TIME_EXPIRED)) {
++ if (inode->i_state & I_DIRTY_TIME) {
+ spin_lock(&inode->i_lock);
+- inode->i_state &= ~(I_DIRTY_TIME | I_DIRTY_TIME_EXPIRED);
++ inode->i_state &= ~I_DIRTY_TIME;
+ spin_unlock(&inode->i_lock);
+ }
+
+diff --git a/include/linux/compat.h b/include/linux/compat.h
+index de0c13bdcd2c7..189d0e111d57d 100644
+--- a/include/linux/compat.h
++++ b/include/linux/compat.h
+@@ -445,8 +445,6 @@ struct compat_kexec_segment;
+ struct compat_mq_attr;
+ struct compat_msgbuf;
+
+-extern void compat_exit_robust_list(struct task_struct *curr);
+-
+ #define BITS_PER_COMPAT_LONG (8*sizeof(compat_long_t))
+
+ #define BITS_TO_COMPAT_LONGS(bits) DIV_ROUND_UP(bits, BITS_PER_COMPAT_LONG)
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 876bfb6df06a9..b6a955ba6173a 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2071,7 +2071,6 @@ static inline void init_sync_kiocb(struct kiocb *kiocb, struct file *filp)
+ #define I_DIO_WAKEUP (1 << __I_DIO_WAKEUP)
+ #define I_LINKABLE (1 << 10)
+ #define I_DIRTY_TIME (1 << 11)
+-#define I_DIRTY_TIME_EXPIRED (1 << 12)
+ #define I_WB_SWITCH (1 << 13)
+ #define I_OVL_INUSE (1 << 14)
+ #define I_CREATING (1 << 15)
+diff --git a/include/linux/futex.h b/include/linux/futex.h
+index a61bf436dcf36..b70df27d7e85c 100644
+--- a/include/linux/futex.h
++++ b/include/linux/futex.h
+@@ -2,7 +2,9 @@
+ #ifndef _LINUX_FUTEX_H
+ #define _LINUX_FUTEX_H
+
++#include <linux/sched.h>
+ #include <linux/ktime.h>
++
+ #include <uapi/linux/futex.h>
+
+ struct inode;
+@@ -51,15 +53,35 @@ union futex_key {
+ #define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = 0ULL } }
+
+ #ifdef CONFIG_FUTEX
+-extern void exit_robust_list(struct task_struct *curr);
++enum {
++ FUTEX_STATE_OK,
++ FUTEX_STATE_EXITING,
++ FUTEX_STATE_DEAD,
++};
+
+-long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+- u32 __user *uaddr2, u32 val2, u32 val3);
+-#else
+-static inline void exit_robust_list(struct task_struct *curr)
++static inline void futex_init_task(struct task_struct *tsk)
+ {
++ tsk->robust_list = NULL;
++#ifdef CONFIG_COMPAT
++ tsk->compat_robust_list = NULL;
++#endif
++ INIT_LIST_HEAD(&tsk->pi_state_list);
++ tsk->pi_state_cache = NULL;
++ tsk->futex_state = FUTEX_STATE_OK;
++ mutex_init(&tsk->futex_exit_mutex);
+ }
+
++void futex_exit_recursive(struct task_struct *tsk);
++void futex_exit_release(struct task_struct *tsk);
++void futex_exec_release(struct task_struct *tsk);
++
++long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
++ u32 __user *uaddr2, u32 val2, u32 val3);
++#else
++static inline void futex_init_task(struct task_struct *tsk) { }
++static inline void futex_exit_recursive(struct task_struct *tsk) { }
++static inline void futex_exit_release(struct task_struct *tsk) { }
++static inline void futex_exec_release(struct task_struct *tsk) { }
+ static inline long do_futex(u32 __user *uaddr, int op, u32 val,
+ ktime_t *timeout, u32 __user *uaddr2,
+ u32 val2, u32 val3)
+@@ -68,12 +90,4 @@ static inline long do_futex(u32 __user *uaddr, int op, u32 val,
+ }
+ #endif
+
+-#ifdef CONFIG_FUTEX_PI
+-extern void exit_pi_state_list(struct task_struct *curr);
+-#else
+-static inline void exit_pi_state_list(struct task_struct *curr)
+-{
+-}
+-#endif
+-
+ #endif
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index c69f308f3a53c..5524cd5c6abe6 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -996,6 +996,8 @@ struct task_struct {
+ #endif
+ struct list_head pi_state_list;
+ struct futex_pi_state *pi_state_cache;
++ struct mutex futex_exit_mutex;
++ unsigned int futex_state;
+ #endif
+ #ifdef CONFIG_PERF_EVENTS
+ struct perf_event_context *perf_event_ctxp[perf_nr_task_contexts];
+@@ -1377,7 +1379,6 @@ extern struct pid *cad_pid;
+ */
+ #define PF_IDLE 0x00000002 /* I am an IDLE thread */
+ #define PF_EXITING 0x00000004 /* Getting shut down */
+-#define PF_EXITPIDONE 0x00000008 /* PI exit done on shut down */
+ #define PF_VCPU 0x00000010 /* I'm a virtual CPU */
+ #define PF_WQ_WORKER 0x00000020 /* I'm a workqueue worker */
+ #define PF_FORKNOEXEC 0x00000040 /* Forked but didn't exec */
+diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
+index 766bbe8138615..8d3b7e731b742 100644
+--- a/include/linux/sched/mm.h
++++ b/include/linux/sched/mm.h
+@@ -119,8 +119,10 @@ extern struct mm_struct *get_task_mm(struct task_struct *task);
+ * succeeds.
+ */
+ extern struct mm_struct *mm_access(struct task_struct *task, unsigned int mode);
+-/* Remove the current tasks stale references to the old mm_struct */
+-extern void mm_release(struct task_struct *, struct mm_struct *);
++/* Remove the current tasks stale references to the old mm_struct on exit() */
++extern void exit_mm_release(struct task_struct *, struct mm_struct *);
++/* Remove the current tasks stale references to the old mm_struct on exec() */
++extern void exec_mm_release(struct task_struct *, struct mm_struct *);
+
+ #ifdef CONFIG_MEMCG
+ extern void mm_update_next_owner(struct mm_struct *mm);
+diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
+index 29d09755e5cfc..146e7b3faa856 100644
+--- a/include/trace/events/writeback.h
++++ b/include/trace/events/writeback.h
+@@ -20,7 +20,6 @@
+ {I_CLEAR, "I_CLEAR"}, \
+ {I_SYNC, "I_SYNC"}, \
+ {I_DIRTY_TIME, "I_DIRTY_TIME"}, \
+- {I_DIRTY_TIME_EXPIRED, "I_DIRTY_TIME_EXPIRED"}, \
+ {I_REFERENCED, "I_REFERENCED"} \
+ )
+
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 65133ebddfada..908e7a33e1fcb 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -498,7 +498,7 @@ static void exit_mm(void)
+ struct mm_struct *mm = current->mm;
+ struct core_state *core_state;
+
+- mm_release(current, mm);
++ exit_mm_release(current, mm);
+ if (!mm)
+ return;
+ sync_mm_rss(mm);
+@@ -818,32 +818,12 @@ void __noreturn do_exit(long code)
+ */
+ if (unlikely(tsk->flags & PF_EXITING)) {
+ pr_alert("Fixing recursive fault but reboot is needed!\n");
+- /*
+- * We can do this unlocked here. The futex code uses
+- * this flag just to verify whether the pi state
+- * cleanup has been done or not. In the worst case it
+- * loops once more. We pretend that the cleanup was
+- * done as there is no way to return. Either the
+- * OWNER_DIED bit is set by now or we push the blocked
+- * task into the wait for ever nirwana as well.
+- */
+- tsk->flags |= PF_EXITPIDONE;
++ futex_exit_recursive(tsk);
+ set_current_state(TASK_UNINTERRUPTIBLE);
+ schedule();
+ }
+
+ exit_signals(tsk); /* sets PF_EXITING */
+- /*
+- * Ensure that all new tsk->pi_lock acquisitions must observe
+- * PF_EXITING. Serializes against futex.c:attach_to_pi_owner().
+- */
+- smp_mb();
+- /*
+- * Ensure that we must observe the pi_state in exit_mm() ->
+- * mm_release() -> exit_pi_state_list().
+- */
+- raw_spin_lock_irq(&tsk->pi_lock);
+- raw_spin_unlock_irq(&tsk->pi_lock);
+
+ /* sync mm's RSS info before statistics gathering */
+ if (tsk->mm)
+@@ -918,12 +898,6 @@ void __noreturn do_exit(long code)
+ * Make sure we are holding no locks:
+ */
+ debug_check_no_locks_held();
+- /*
+- * We can do this unlocked here. The futex code uses this flag
+- * just to verify whether the pi state cleanup has been done
+- * or not. In the worst case it loops once more.
+- */
+- tsk->flags |= PF_EXITPIDONE;
+
+ if (tsk->io_context)
+ exit_io_context(tsk);
+diff --git a/kernel/fork.c b/kernel/fork.c
+index f2c92c1001949..cf535b9d5db75 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1217,24 +1217,8 @@ static int wait_for_vfork_done(struct task_struct *child,
+ * restoring the old one. . .
+ * Eric Biederman 10 January 1998
+ */
+-void mm_release(struct task_struct *tsk, struct mm_struct *mm)
++static void mm_release(struct task_struct *tsk, struct mm_struct *mm)
+ {
+- /* Get rid of any futexes when releasing the mm */
+-#ifdef CONFIG_FUTEX
+- if (unlikely(tsk->robust_list)) {
+- exit_robust_list(tsk);
+- tsk->robust_list = NULL;
+- }
+-#ifdef CONFIG_COMPAT
+- if (unlikely(tsk->compat_robust_list)) {
+- compat_exit_robust_list(tsk);
+- tsk->compat_robust_list = NULL;
+- }
+-#endif
+- if (unlikely(!list_empty(&tsk->pi_state_list)))
+- exit_pi_state_list(tsk);
+-#endif
+-
+ uprobe_free_utask(tsk);
+
+ /* Get rid of any cached register state */
+@@ -1267,6 +1251,18 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
+ complete_vfork_done(tsk);
+ }
+
++void exit_mm_release(struct task_struct *tsk, struct mm_struct *mm)
++{
++ futex_exit_release(tsk);
++ mm_release(tsk, mm);
++}
++
++void exec_mm_release(struct task_struct *tsk, struct mm_struct *mm)
++{
++ futex_exec_release(tsk);
++ mm_release(tsk, mm);
++}
++
+ /*
+ * Allocate a new mm structure and copy contents from the
+ * mm structure of the passed in task structure.
+@@ -1937,14 +1933,8 @@ static __latent_entropy struct task_struct *copy_process(
+ #ifdef CONFIG_BLOCK
+ p->plug = NULL;
+ #endif
+-#ifdef CONFIG_FUTEX
+- p->robust_list = NULL;
+-#ifdef CONFIG_COMPAT
+- p->compat_robust_list = NULL;
+-#endif
+- INIT_LIST_HEAD(&p->pi_state_list);
+- p->pi_state_cache = NULL;
+-#endif
++ futex_init_task(p);
++
+ /*
+ * sigaltstack should be cleared when sharing the same VM
+ */
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 334dc4cae780e..224adcdac6c19 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -341,6 +341,12 @@ static inline bool should_fail_futex(bool fshared)
+ }
+ #endif /* CONFIG_FAIL_FUTEX */
+
++#ifdef CONFIG_COMPAT
++static void compat_exit_robust_list(struct task_struct *curr);
++#else
++static inline void compat_exit_robust_list(struct task_struct *curr) { }
++#endif
++
+ static inline void futex_get_mm(union futex_key *key)
+ {
+ mmgrab(key->private.mm);
+@@ -833,6 +839,29 @@ static struct futex_pi_state *alloc_pi_state(void)
+ return pi_state;
+ }
+
++static void pi_state_update_owner(struct futex_pi_state *pi_state,
++ struct task_struct *new_owner)
++{
++ struct task_struct *old_owner = pi_state->owner;
++
++ lockdep_assert_held(&pi_state->pi_mutex.wait_lock);
++
++ if (old_owner) {
++ raw_spin_lock(&old_owner->pi_lock);
++ WARN_ON(list_empty(&pi_state->list));
++ list_del_init(&pi_state->list);
++ raw_spin_unlock(&old_owner->pi_lock);
++ }
++
++ if (new_owner) {
++ raw_spin_lock(&new_owner->pi_lock);
++ WARN_ON(!list_empty(&pi_state->list));
++ list_add(&pi_state->list, &new_owner->pi_state_list);
++ pi_state->owner = new_owner;
++ raw_spin_unlock(&new_owner->pi_lock);
++ }
++}
++
+ static void get_pi_state(struct futex_pi_state *pi_state)
+ {
+ WARN_ON_ONCE(!atomic_inc_not_zero(&pi_state->refcount));
+@@ -855,17 +884,11 @@ static void put_pi_state(struct futex_pi_state *pi_state)
+ * and has cleaned up the pi_state already
+ */
+ if (pi_state->owner) {
+- struct task_struct *owner;
+ unsigned long flags;
+
+ raw_spin_lock_irqsave(&pi_state->pi_mutex.wait_lock, flags);
+- owner = pi_state->owner;
+- if (owner) {
+- raw_spin_lock(&owner->pi_lock);
+- list_del_init(&pi_state->list);
+- raw_spin_unlock(&owner->pi_lock);
+- }
+- rt_mutex_proxy_unlock(&pi_state->pi_mutex, owner);
++ pi_state_update_owner(pi_state, NULL);
++ rt_mutex_proxy_unlock(&pi_state->pi_mutex);
+ raw_spin_unlock_irqrestore(&pi_state->pi_mutex.wait_lock, flags);
+ }
+
+@@ -890,7 +913,7 @@ static void put_pi_state(struct futex_pi_state *pi_state)
+ * Kernel cleans up PI-state, but userspace is likely hosed.
+ * (Robust-futex cleanup is separate and might save the day for userspace.)
+ */
+-void exit_pi_state_list(struct task_struct *curr)
++static void exit_pi_state_list(struct task_struct *curr)
+ {
+ struct list_head *next, *head = &curr->pi_state_list;
+ struct futex_pi_state *pi_state;
+@@ -960,7 +983,8 @@ void exit_pi_state_list(struct task_struct *curr)
+ }
+ raw_spin_unlock_irq(&curr->pi_lock);
+ }
+-
++#else
++static inline void exit_pi_state_list(struct task_struct *curr) { }
+ #endif
+
+ /*
+@@ -1010,7 +1034,8 @@ void exit_pi_state_list(struct task_struct *curr)
+ * FUTEX_OWNER_DIED bit. See [4]
+ *
+ * [10] There is no transient state which leaves owner and user space
+- * TID out of sync.
++ * TID out of sync. Except one error case where the kernel is denied
++ * write access to the user address, see fixup_pi_state_owner().
+ *
+ *
+ * Serialization and lifetime rules:
+@@ -1169,16 +1194,47 @@ out_error:
+ return ret;
+ }
+
++/**
++ * wait_for_owner_exiting - Block until the owner has exited
++ * @exiting: Pointer to the exiting task
++ *
++ * Caller must hold a refcount on @exiting.
++ */
++static void wait_for_owner_exiting(int ret, struct task_struct *exiting)
++{
++ if (ret != -EBUSY) {
++ WARN_ON_ONCE(exiting);
++ return;
++ }
++
++ if (WARN_ON_ONCE(ret == -EBUSY && !exiting))
++ return;
++
++ mutex_lock(&exiting->futex_exit_mutex);
++ /*
++ * No point in doing state checking here. If the waiter got here
++ * while the task was in exec()->exec_futex_release() then it can
++ * have any FUTEX_STATE_* value when the waiter has acquired the
++ * mutex. OK, if running, EXITING or DEAD if it reached exit()
++ * already. Highly unlikely and not a problem. Just one more round
++ * through the futex maze.
++ */
++ mutex_unlock(&exiting->futex_exit_mutex);
++
++ put_task_struct(exiting);
++}
++
+ static int handle_exit_race(u32 __user *uaddr, u32 uval,
+ struct task_struct *tsk)
+ {
+ u32 uval2;
+
+ /*
+- * If PF_EXITPIDONE is not yet set, then try again.
++ * If the futex exit state is not yet FUTEX_STATE_DEAD, tell the
++ * caller that the alleged owner is busy.
+ */
+- if (tsk && !(tsk->flags & PF_EXITPIDONE))
+- return -EAGAIN;
++ if (tsk && tsk->futex_state != FUTEX_STATE_DEAD)
++ return -EBUSY;
+
+ /*
+ * Reread the user space value to handle the following situation:
+@@ -1196,8 +1252,9 @@ static int handle_exit_race(u32 __user *uaddr, u32 uval,
+ * *uaddr = 0xC0000000; tsk = get_task(PID);
+ * } if (!tsk->flags & PF_EXITING) {
+ * ... attach();
+- * tsk->flags |= PF_EXITPIDONE; } else {
+- * if (!(tsk->flags & PF_EXITPIDONE))
++ * tsk->futex_state = } else {
++ * FUTEX_STATE_DEAD; if (tsk->futex_state !=
++ * FUTEX_STATE_DEAD)
+ * return -EAGAIN;
+ * return -ESRCH; <--- FAIL
+ * }
+@@ -1228,7 +1285,8 @@ static int handle_exit_race(u32 __user *uaddr, u32 uval,
+ * it after doing proper sanity checks.
+ */
+ static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key,
+- struct futex_pi_state **ps)
++ struct futex_pi_state **ps,
++ struct task_struct **exiting)
+ {
+ pid_t pid = uval & FUTEX_TID_MASK;
+ struct futex_pi_state *pi_state;
+@@ -1253,22 +1311,33 @@ static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key,
+ }
+
+ /*
+- * We need to look at the task state flags to figure out,
+- * whether the task is exiting. To protect against the do_exit
+- * change of the task flags, we do this protected by
+- * p->pi_lock:
++ * We need to look at the task state to figure out, whether the
++ * task is exiting. To protect against the change of the task state
++ * in futex_exit_release(), we do this protected by p->pi_lock:
+ */
+ raw_spin_lock_irq(&p->pi_lock);
+- if (unlikely(p->flags & PF_EXITING)) {
++ if (unlikely(p->futex_state != FUTEX_STATE_OK)) {
+ /*
+- * The task is on the way out. When PF_EXITPIDONE is
+- * set, we know that the task has finished the
+- * cleanup:
++ * The task is on the way out. When the futex state is
++ * FUTEX_STATE_DEAD, we know that the task has finished
++ * the cleanup:
+ */
+ int ret = handle_exit_race(uaddr, uval, p);
+
+ raw_spin_unlock_irq(&p->pi_lock);
+- put_task_struct(p);
++ /*
++ * If the owner task is between FUTEX_STATE_EXITING and
++ * FUTEX_STATE_DEAD then store the task pointer and keep
++ * the reference on the task struct. The calling code will
++ * drop all locks, wait for the task to reach
++ * FUTEX_STATE_DEAD and then drop the refcount. This is
++ * required to prevent a live lock when the current task
++ * preempted the exiting task between the two states.
++ */
++ if (ret == -EBUSY)
++ *exiting = p;
++ else
++ put_task_struct(p);
+ return ret;
+ }
+
+@@ -1307,7 +1376,8 @@ static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key,
+
+ static int lookup_pi_state(u32 __user *uaddr, u32 uval,
+ struct futex_hash_bucket *hb,
+- union futex_key *key, struct futex_pi_state **ps)
++ union futex_key *key, struct futex_pi_state **ps,
++ struct task_struct **exiting)
+ {
+ struct futex_q *top_waiter = futex_top_waiter(hb, key);
+
+@@ -1322,7 +1392,7 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval,
+ * We are the first waiter - try to look up the owner based on
+ * @uval and attach to it.
+ */
+- return attach_to_pi_owner(uaddr, uval, key, ps);
++ return attach_to_pi_owner(uaddr, uval, key, ps, exiting);
+ }
+
+ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
+@@ -1350,6 +1420,8 @@ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
+ * lookup
+ * @task: the task to perform the atomic lock work for. This will
+ * be "current" except in the case of requeue pi.
++ * @exiting: Pointer to store the task pointer of the owner task
++ * which is in the middle of exiting
+ * @set_waiters: force setting the FUTEX_WAITERS bit (1) or not (0)
+ *
+ * Return:
+@@ -1358,11 +1430,17 @@ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
+ * - <0 - error
+ *
+ * The hb->lock and futex_key refs shall be held by the caller.
++ *
++ * @exiting is only set when the return value is -EBUSY. If so, this holds
++ * a refcount on the exiting task on return and the caller needs to drop it
++ * after waiting for the exit to complete.
+ */
+ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
+ union futex_key *key,
+ struct futex_pi_state **ps,
+- struct task_struct *task, int set_waiters)
++ struct task_struct *task,
++ struct task_struct **exiting,
++ int set_waiters)
+ {
+ u32 uval, newval, vpid = task_pid_vnr(task);
+ struct futex_q *top_waiter;
+@@ -1432,7 +1510,7 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
+ * attach to the owner. If that fails, no harm done, we only
+ * set the FUTEX_WAITERS bit in the user space variable.
+ */
+- return attach_to_pi_owner(uaddr, newval, key, ps);
++ return attach_to_pi_owner(uaddr, newval, key, ps, exiting);
+ }
+
+ /**
+@@ -1537,26 +1615,15 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_
+ ret = -EINVAL;
+ }
+
+- if (ret)
+- goto out_unlock;
+-
+- /*
+- * This is a point of no return; once we modify the uval there is no
+- * going back and subsequent operations must not fail.
+- */
+-
+- raw_spin_lock(&pi_state->owner->pi_lock);
+- WARN_ON(list_empty(&pi_state->list));
+- list_del_init(&pi_state->list);
+- raw_spin_unlock(&pi_state->owner->pi_lock);
+-
+- raw_spin_lock(&new_owner->pi_lock);
+- WARN_ON(!list_empty(&pi_state->list));
+- list_add(&pi_state->list, &new_owner->pi_state_list);
+- pi_state->owner = new_owner;
+- raw_spin_unlock(&new_owner->pi_lock);
+-
+- postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
++ if (!ret) {
++ /*
++ * This is a point of no return; once we modified the uval
++ * there is no going back and subsequent operations must
++ * not fail.
++ */
++ pi_state_update_owner(pi_state, new_owner);
++ postunlock = __rt_mutex_futex_unlock(&pi_state->pi_mutex, &wake_q);
++ }
+
+ out_unlock:
+ raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
+@@ -1853,6 +1920,8 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
+ * @key1: the from futex key
+ * @key2: the to futex key
+ * @ps: address to store the pi_state pointer
++ * @exiting: Pointer to store the task pointer of the owner task
++ * which is in the middle of exiting
+ * @set_waiters: force setting the FUTEX_WAITERS bit (1) or not (0)
+ *
+ * Try and get the lock on behalf of the top waiter if we can do it atomically.
+@@ -1860,16 +1929,20 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
+ * then direct futex_lock_pi_atomic() to force setting the FUTEX_WAITERS bit.
+ * hb1 and hb2 must be held by the caller.
+ *
++ * @exiting is only set when the return value is -EBUSY. If so, this holds
++ * a refcount on the exiting task on return and the caller needs to drop it
++ * after waiting for the exit to complete.
++ *
+ * Return:
+ * - 0 - failed to acquire the lock atomically;
+ * - >0 - acquired the lock, return value is vpid of the top_waiter
+ * - <0 - error
+ */
+-static int futex_proxy_trylock_atomic(u32 __user *pifutex,
+- struct futex_hash_bucket *hb1,
+- struct futex_hash_bucket *hb2,
+- union futex_key *key1, union futex_key *key2,
+- struct futex_pi_state **ps, int set_waiters)
++static int
++futex_proxy_trylock_atomic(u32 __user *pifutex, struct futex_hash_bucket *hb1,
++ struct futex_hash_bucket *hb2, union futex_key *key1,
++ union futex_key *key2, struct futex_pi_state **ps,
++ struct task_struct **exiting, int set_waiters)
+ {
+ struct futex_q *top_waiter = NULL;
+ u32 curval;
+@@ -1906,7 +1979,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
+ */
+ vpid = task_pid_vnr(top_waiter->task);
+ ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
+- set_waiters);
++ exiting, set_waiters);
+ if (ret == 1) {
+ requeue_pi_wake_futex(top_waiter, key2, hb2);
+ return vpid;
+@@ -2035,6 +2108,8 @@ retry_private:
+ }
+
+ if (requeue_pi && (task_count - nr_wake < nr_requeue)) {
++ struct task_struct *exiting = NULL;
++
+ /*
+ * Attempt to acquire uaddr2 and wake the top waiter. If we
+ * intend to requeue waiters, force setting the FUTEX_WAITERS
+@@ -2042,7 +2117,8 @@ retry_private:
+ * faults rather in the requeue loop below.
+ */
+ ret = futex_proxy_trylock_atomic(uaddr2, hb1, hb2, &key1,
+- &key2, &pi_state, nr_requeue);
++ &key2, &pi_state,
++ &exiting, nr_requeue);
+
+ /*
+ * At this point the top_waiter has either taken uaddr2 or is
+@@ -2069,7 +2145,8 @@ retry_private:
+ * If that call succeeds then we have pi_state and an
+ * initial refcount on it.
+ */
+- ret = lookup_pi_state(uaddr2, ret, hb2, &key2, &pi_state);
++ ret = lookup_pi_state(uaddr2, ret, hb2, &key2,
++ &pi_state, &exiting);
+ }
+
+ switch (ret) {
+@@ -2087,17 +2164,24 @@ retry_private:
+ if (!ret)
+ goto retry;
+ goto out;
++ case -EBUSY:
+ case -EAGAIN:
+ /*
+ * Two reasons for this:
+- * - Owner is exiting and we just wait for the
++ * - EBUSY: Owner is exiting and we just wait for the
+ * exit to complete.
+- * - The user space value changed.
++ * - EAGAIN: The user space value changed.
+ */
+ double_unlock_hb(hb1, hb2);
+ hb_waiters_dec(hb2);
+ put_futex_key(&key2);
+ put_futex_key(&key1);
++ /*
++ * Handle the case where the owner is in the middle of
++ * exiting. Wait for the exit to complete otherwise
++ * this task might loop forever, aka. live lock.
++ */
++ wait_for_owner_exiting(ret, exiting);
+ cond_resched();
+ goto retry;
+ default:
+@@ -2362,18 +2446,13 @@ static void unqueue_me_pi(struct futex_q *q)
+ spin_unlock(q->lock_ptr);
+ }
+
+-static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
+- struct task_struct *argowner)
++static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
++ struct task_struct *argowner)
+ {
++ u32 uval, uninitialized_var(curval), newval, newtid;
+ struct futex_pi_state *pi_state = q->pi_state;
+- u32 uval, uninitialized_var(curval), newval;
+ struct task_struct *oldowner, *newowner;
+- u32 newtid;
+- int ret, err = 0;
+-
+- lockdep_assert_held(q->lock_ptr);
+-
+- raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
++ int err = 0;
+
+ oldowner = pi_state->owner;
+
+@@ -2407,14 +2486,12 @@ retry:
+ * We raced against a concurrent self; things are
+ * already fixed up. Nothing to do.
+ */
+- ret = 0;
+- goto out_unlock;
++ return 0;
+ }
+
+ if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) {
+- /* We got the lock after all, nothing to fix. */
+- ret = 0;
+- goto out_unlock;
++ /* We got the lock. pi_state is correct. Tell caller. */
++ return 1;
+ }
+
+ /*
+@@ -2441,8 +2518,7 @@ retry:
+ * We raced against a concurrent self; things are
+ * already fixed up. Nothing to do.
+ */
+- ret = 0;
+- goto out_unlock;
++ return 1;
+ }
+ newowner = argowner;
+ }
+@@ -2472,22 +2548,9 @@ retry:
+ * We fixed up user space. Now we need to fix the pi_state
+ * itself.
+ */
+- if (pi_state->owner != NULL) {
+- raw_spin_lock(&pi_state->owner->pi_lock);
+- WARN_ON(list_empty(&pi_state->list));
+- list_del_init(&pi_state->list);
+- raw_spin_unlock(&pi_state->owner->pi_lock);
+- }
++ pi_state_update_owner(pi_state, newowner);
+
+- pi_state->owner = newowner;
+-
+- raw_spin_lock(&newowner->pi_lock);
+- WARN_ON(!list_empty(&pi_state->list));
+- list_add(&pi_state->list, &newowner->pi_state_list);
+- raw_spin_unlock(&newowner->pi_lock);
+- raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
+-
+- return 0;
++ return argowner == current;
+
+ /*
+ * In order to reschedule or handle a page fault, we need to drop the
+@@ -2508,17 +2571,16 @@ handle_err:
+
+ switch (err) {
+ case -EFAULT:
+- ret = fault_in_user_writeable(uaddr);
++ err = fault_in_user_writeable(uaddr);
+ break;
+
+ case -EAGAIN:
+ cond_resched();
+- ret = 0;
++ err = 0;
+ break;
+
+ default:
+ WARN_ON_ONCE(1);
+- ret = err;
+ break;
+ }
+
+@@ -2528,17 +2590,44 @@ handle_err:
+ /*
+ * Check if someone else fixed it for us:
+ */
+- if (pi_state->owner != oldowner) {
+- ret = 0;
+- goto out_unlock;
+- }
++ if (pi_state->owner != oldowner)
++ return argowner == current;
+
+- if (ret)
+- goto out_unlock;
++ /* Retry if err was -EAGAIN or the fault in succeeded */
++ if (!err)
++ goto retry;
+
+- goto retry;
++ /*
++ * fault_in_user_writeable() failed so user state is immutable. At
++ * best we can make the kernel state consistent but user state will
++ * be most likely hosed and any subsequent unlock operation will be
++ * rejected due to PI futex rule [10].
++ *
++ * Ensure that the rtmutex owner is also the pi_state owner despite
++ * the user space value claiming something different. There is no
++ * point in unlocking the rtmutex if current is the owner as it
++ * would need to wait until the next waiter has taken the rtmutex
++ * to guarantee consistent state. Keep it simple. Userspace asked
++ * for this wreckaged state.
++ *
++ * The rtmutex has an owner - either current or some other
++ * task. See the EAGAIN loop above.
++ */
++ pi_state_update_owner(pi_state, rt_mutex_owner(&pi_state->pi_mutex));
+
+-out_unlock:
++ return err;
++}
++
++static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
++ struct task_struct *argowner)
++{
++ struct futex_pi_state *pi_state = q->pi_state;
++ int ret;
++
++ lockdep_assert_held(q->lock_ptr);
++
++ raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
++ ret = __fixup_pi_state_owner(uaddr, q, argowner);
+ raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
+ return ret;
+ }
+@@ -2562,8 +2651,6 @@ static long futex_wait_restart(struct restart_block *restart);
+ */
+ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
+ {
+- int ret = 0;
+-
+ if (locked) {
+ /*
+ * Got the lock. We might not be the anticipated owner if we
+@@ -2574,8 +2661,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
+ * stable state, anything else needs more attention.
+ */
+ if (q->pi_state->owner != current)
+- ret = fixup_pi_state_owner(uaddr, q, current);
+- goto out;
++ return fixup_pi_state_owner(uaddr, q, current);
++ return 1;
+ }
+
+ /*
+@@ -2586,24 +2673,17 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
+ * Another speculative read; pi_state->owner == current is unstable
+ * but needs our attention.
+ */
+- if (q->pi_state->owner == current) {
+- ret = fixup_pi_state_owner(uaddr, q, NULL);
+- goto out;
+- }
++ if (q->pi_state->owner == current)
++ return fixup_pi_state_owner(uaddr, q, NULL);
+
+ /*
+ * Paranoia check. If we did not take the lock, then we should not be
+- * the owner of the rt_mutex.
++ * the owner of the rt_mutex. Warn and establish consistent state.
+ */
+- if (rt_mutex_owner(&q->pi_state->pi_mutex) == current) {
+- printk(KERN_ERR "fixup_owner: ret = %d pi-mutex: %p "
+- "pi-state %p\n", ret,
+- q->pi_state->pi_mutex.owner,
+- q->pi_state->owner);
+- }
++ if (WARN_ON_ONCE(rt_mutex_owner(&q->pi_state->pi_mutex) == current))
++ return fixup_pi_state_owner(uaddr, q, current);
+
+-out:
+- return ret ? ret : locked;
++ return 0;
+ }
+
+ /**
+@@ -2824,7 +2904,7 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
+ ktime_t *time, int trylock)
+ {
+ struct hrtimer_sleeper timeout, *to = NULL;
+- struct futex_pi_state *pi_state = NULL;
++ struct task_struct *exiting = NULL;
+ struct rt_mutex_waiter rt_waiter;
+ struct futex_hash_bucket *hb;
+ struct futex_q q = futex_q_init;
+@@ -2852,7 +2932,8 @@ retry:
+ retry_private:
+ hb = queue_lock(&q);
+
+- ret = futex_lock_pi_atomic(uaddr, hb, &q.key, &q.pi_state, current, 0);
++ ret = futex_lock_pi_atomic(uaddr, hb, &q.key, &q.pi_state, current,
++ &exiting, 0);
+ if (unlikely(ret)) {
+ /*
+ * Atomic work succeeded and we got the lock,
+@@ -2865,15 +2946,22 @@ retry_private:
+ goto out_unlock_put_key;
+ case -EFAULT:
+ goto uaddr_faulted;
++ case -EBUSY:
+ case -EAGAIN:
+ /*
+ * Two reasons for this:
+- * - Task is exiting and we just wait for the
++ * - EBUSY: Task is exiting and we just wait for the
+ * exit to complete.
+- * - The user space value changed.
++ * - EAGAIN: The user space value changed.
+ */
+ queue_unlock(hb);
+ put_futex_key(&q.key);
++ /*
++ * Handle the case where the owner is in the middle of
++ * exiting. Wait for the exit to complete otherwise
++ * this task might loop forever, aka. live lock.
++ */
++ wait_for_owner_exiting(ret, exiting);
+ cond_resched();
+ goto retry;
+ default:
+@@ -2958,23 +3046,9 @@ no_block:
+ if (res)
+ ret = (res < 0) ? res : 0;
+
+- /*
+- * If fixup_owner() faulted and was unable to handle the fault, unlock
+- * it and return the fault to userspace.
+- */
+- if (ret && (rt_mutex_owner(&q.pi_state->pi_mutex) == current)) {
+- pi_state = q.pi_state;
+- get_pi_state(pi_state);
+- }
+-
+ /* Unqueue and drop the lock */
+ unqueue_me_pi(&q);
+
+- if (pi_state) {
+- rt_mutex_futex_unlock(&pi_state->pi_mutex);
+- put_pi_state(pi_state);
+- }
+-
+ goto out_put_key;
+
+ out_unlock_put_key:
+@@ -3240,7 +3314,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ u32 __user *uaddr2)
+ {
+ struct hrtimer_sleeper timeout, *to = NULL;
+- struct futex_pi_state *pi_state = NULL;
+ struct rt_mutex_waiter rt_waiter;
+ struct futex_hash_bucket *hb;
+ union futex_key key2 = FUTEX_KEY_INIT;
+@@ -3325,16 +3398,17 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ if (q.pi_state && (q.pi_state->owner != current)) {
+ spin_lock(q.lock_ptr);
+ ret = fixup_pi_state_owner(uaddr2, &q, current);
+- if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) {
+- pi_state = q.pi_state;
+- get_pi_state(pi_state);
+- }
+ /*
+ * Drop the reference to the pi state which
+ * the requeue_pi() code acquired for us.
+ */
+ put_pi_state(q.pi_state);
+ spin_unlock(q.lock_ptr);
++ /*
++ * Adjust the return value. It's either -EFAULT or
++ * success (1) but the caller expects 0 for success.
++ */
++ ret = ret < 0 ? ret : 0;
+ }
+ } else {
+ struct rt_mutex *pi_mutex;
+@@ -3365,25 +3439,10 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ if (res)
+ ret = (res < 0) ? res : 0;
+
+- /*
+- * If fixup_pi_state_owner() faulted and was unable to handle
+- * the fault, unlock the rt_mutex and return the fault to
+- * userspace.
+- */
+- if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) {
+- pi_state = q.pi_state;
+- get_pi_state(pi_state);
+- }
+-
+ /* Unqueue and drop the lock. */
+ unqueue_me_pi(&q);
+ }
+
+- if (pi_state) {
+- rt_mutex_futex_unlock(&pi_state->pi_mutex);
+- put_pi_state(pi_state);
+- }
+-
+ if (ret == -EINTR) {
+ /*
+ * We've already been requeued, but cannot restart by calling
+@@ -3625,7 +3684,7 @@ static inline int fetch_robust_entry(struct robust_list __user **entry,
+ *
+ * We silently return on any sign of list-walking problem.
+ */
+-void exit_robust_list(struct task_struct *curr)
++static void exit_robust_list(struct task_struct *curr)
+ {
+ struct robust_list_head __user *head = curr->robust_list;
+ struct robust_list __user *entry, *next_entry, *pending;
+@@ -3690,6 +3749,114 @@ void exit_robust_list(struct task_struct *curr)
+ }
+ }
+
++static void futex_cleanup(struct task_struct *tsk)
++{
++ if (unlikely(tsk->robust_list)) {
++ exit_robust_list(tsk);
++ tsk->robust_list = NULL;
++ }
++
++#ifdef CONFIG_COMPAT
++ if (unlikely(tsk->compat_robust_list)) {
++ compat_exit_robust_list(tsk);
++ tsk->compat_robust_list = NULL;
++ }
++#endif
++
++ if (unlikely(!list_empty(&tsk->pi_state_list)))
++ exit_pi_state_list(tsk);
++}
++
++/**
++ * futex_exit_recursive - Set the tasks futex state to FUTEX_STATE_DEAD
++ * @tsk: task to set the state on
++ *
++ * Set the futex exit state of the task lockless. The futex waiter code
++ * observes that state when a task is exiting and loops until the task has
++ * actually finished the futex cleanup. The worst case for this is that the
++ * waiter runs through the wait loop until the state becomes visible.
++ *
++ * This is called from the recursive fault handling path in do_exit().
++ *
++ * This is best effort. Either the futex exit code has run already or
++ * not. If the OWNER_DIED bit has been set on the futex then the waiter can
++ * take it over. If not, the problem is pushed back to user space. If the
++ * futex exit code did not run yet, then an already queued waiter might
++ * block forever, but there is nothing which can be done about that.
++ */
++void futex_exit_recursive(struct task_struct *tsk)
++{
++ /* If the state is FUTEX_STATE_EXITING then futex_exit_mutex is held */
++ if (tsk->futex_state == FUTEX_STATE_EXITING)
++ mutex_unlock(&tsk->futex_exit_mutex);
++ tsk->futex_state = FUTEX_STATE_DEAD;
++}
++
++static void futex_cleanup_begin(struct task_struct *tsk)
++{
++ /*
++ * Prevent various race issues against a concurrent incoming waiter
++ * including live locks by forcing the waiter to block on
++ * tsk->futex_exit_mutex when it observes FUTEX_STATE_EXITING in
++ * attach_to_pi_owner().
++ */
++ mutex_lock(&tsk->futex_exit_mutex);
++
++ /*
++ * Switch the state to FUTEX_STATE_EXITING under tsk->pi_lock.
++ *
++ * This ensures that all subsequent checks of tsk->futex_state in
++ * attach_to_pi_owner() must observe FUTEX_STATE_EXITING with
++ * tsk->pi_lock held.
++ *
++ * It guarantees also that a pi_state which was queued right before
++ * the state change under tsk->pi_lock by a concurrent waiter must
++ * be observed in exit_pi_state_list().
++ */
++ raw_spin_lock_irq(&tsk->pi_lock);
++ tsk->futex_state = FUTEX_STATE_EXITING;
++ raw_spin_unlock_irq(&tsk->pi_lock);
++}
++
++static void futex_cleanup_end(struct task_struct *tsk, int state)
++{
++ /*
++ * Lockless store. The only side effect is that an observer might
++ * take another loop until it becomes visible.
++ */
++ tsk->futex_state = state;
++ /*
++ * Drop the exit protection. This unblocks waiters which observed
++ * FUTEX_STATE_EXITING to reevaluate the state.
++ */
++ mutex_unlock(&tsk->futex_exit_mutex);
++}
++
++void futex_exec_release(struct task_struct *tsk)
++{
++ /*
++ * The state handling is done for consistency, but in the case of
++ * exec() there is no way to prevent futher damage as the PID stays
++ * the same. But for the unlikely and arguably buggy case that a
++ * futex is held on exec(), this provides at least as much state
++ * consistency protection which is possible.
++ */
++ futex_cleanup_begin(tsk);
++ futex_cleanup(tsk);
++ /*
++ * Reset the state to FUTEX_STATE_OK. The task is alive and about
++ * exec a new binary.
++ */
++ futex_cleanup_end(tsk, FUTEX_STATE_OK);
++}
++
++void futex_exit_release(struct task_struct *tsk)
++{
++ futex_cleanup_begin(tsk);
++ futex_cleanup(tsk);
++ futex_cleanup_end(tsk, FUTEX_STATE_DEAD);
++}
++
+ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+ u32 __user *uaddr2, u32 val2, u32 val3)
+ {
+@@ -3817,7 +3984,7 @@ static void __user *futex_uaddr(struct robust_list __user *entry,
+ *
+ * We silently return on any sign of list-walking problem.
+ */
+-void compat_exit_robust_list(struct task_struct *curr)
++static void compat_exit_robust_list(struct task_struct *curr)
+ {
+ struct compat_robust_list_head __user *head = curr->compat_robust_list;
+ struct robust_list __user *entry, *next_entry, *pending;
+diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
+index 9562aaa2afdce..a5ec4f68527e5 100644
+--- a/kernel/locking/rtmutex.c
++++ b/kernel/locking/rtmutex.c
+@@ -1719,8 +1719,7 @@ void rt_mutex_init_proxy_locked(struct rt_mutex *lock,
+ * possible because it belongs to the pi_state which is about to be freed
+ * and it is not longer visible to other tasks.
+ */
+-void rt_mutex_proxy_unlock(struct rt_mutex *lock,
+- struct task_struct *proxy_owner)
++void rt_mutex_proxy_unlock(struct rt_mutex *lock)
+ {
+ debug_rt_mutex_proxy_unlock(lock);
+ rt_mutex_set_owner(lock, NULL);
+diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h
+index d1d62f942be22..ca6fb489007b6 100644
+--- a/kernel/locking/rtmutex_common.h
++++ b/kernel/locking/rtmutex_common.h
+@@ -133,8 +133,7 @@ enum rtmutex_chainwalk {
+ extern struct task_struct *rt_mutex_next_owner(struct rt_mutex *lock);
+ extern void rt_mutex_init_proxy_locked(struct rt_mutex *lock,
+ struct task_struct *proxy_owner);
+-extern void rt_mutex_proxy_unlock(struct rt_mutex *lock,
+- struct task_struct *proxy_owner);
++extern void rt_mutex_proxy_unlock(struct rt_mutex *lock);
+ extern void rt_mutex_init_waiter(struct rt_mutex_waiter *waiter);
+ extern int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
+ struct rt_mutex_waiter *waiter,
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 87ce9736043da..360129e475407 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -4393,6 +4393,8 @@ void ring_buffer_reset_cpu(struct ring_buffer *buffer, int cpu)
+
+ if (!cpumask_test_cpu(cpu, buffer->cpumask))
+ return;
++ /* prevent another thread from changing buffer sizes */
++ mutex_lock(&buffer->mutex);
+
+ atomic_inc(&buffer->resize_disabled);
+ atomic_inc(&cpu_buffer->record_disabled);
+@@ -4416,6 +4418,8 @@ void ring_buffer_reset_cpu(struct ring_buffer *buffer, int cpu)
+
+ atomic_dec(&cpu_buffer->record_disabled);
+ atomic_dec(&buffer->resize_disabled);
++
++ mutex_unlock(&buffer->mutex);
+ }
+ EXPORT_SYMBOL_GPL(ring_buffer_reset_cpu);
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 02295fa61583c..eac80b0516fe8 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -5766,10 +5766,8 @@ static int sysfs_slab_add(struct kmem_cache *s)
+
+ s->kobj.kset = kset;
+ err = kobject_init_and_add(&s->kobj, &slab_ktype, NULL, "%s", name);
+- if (err) {
+- kobject_put(&s->kobj);
++ if (err)
+ goto out;
+- }
+
+ err = sysfs_create_group(&s->kobj, &slab_attr_group);
+ if (err)
+diff --git a/tools/build/Makefile b/tools/build/Makefile
+index 727050c40f096..8a55378e8b7ce 100644
+--- a/tools/build/Makefile
++++ b/tools/build/Makefile
+@@ -15,10 +15,6 @@ endef
+ $(call allow-override,CC,$(CROSS_COMPILE)gcc)
+ $(call allow-override,LD,$(CROSS_COMPILE)ld)
+
+-HOSTCC ?= gcc
+-HOSTLD ?= ld
+-HOSTAR ?= ar
+-
+ export HOSTCC HOSTLD HOSTAR
+
+ ifeq ($(V),1)
+diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
+index baa92279c137e..15f32f67cf340 100644
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -7,15 +7,6 @@ ARCH := x86
+ endif
+
+ # always use the host compiler
+-ifneq ($(LLVM),)
+-HOSTAR ?= llvm-ar
+-HOSTCC ?= clang
+-HOSTLD ?= ld.lld
+-else
+-HOSTAR ?= ar
+-HOSTCC ?= gcc
+-HOSTLD ?= ld
+-endif
+ AR = $(HOSTAR)
+ CC = $(HOSTCC)
+ LD = $(HOSTLD)
+diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
+index 0be4116953790..678aa7feb84d0 100644
+--- a/tools/perf/Makefile.perf
++++ b/tools/perf/Makefile.perf
+@@ -148,10 +148,6 @@ endef
+
+ LD += $(EXTRA_LDFLAGS)
+
+-HOSTCC ?= gcc
+-HOSTLD ?= ld
+-HOSTAR ?= ar
+-
+ PKG_CONFIG = $(CROSS_COMPILE)pkg-config
+ LLVM_CONFIG ?= llvm-config
+
+diff --git a/tools/power/acpi/Makefile.config b/tools/power/acpi/Makefile.config
+index fc116c060b98d..32ff7baf39df4 100644
+--- a/tools/power/acpi/Makefile.config
++++ b/tools/power/acpi/Makefile.config
+@@ -57,7 +57,6 @@ INSTALL_SCRIPT = ${INSTALL_PROGRAM}
+ CROSS = #/usr/i386-linux-uclibc/usr/bin/i386-uclibc-
+ CROSS_COMPILE ?= $(CROSS)
+ LD = $(CC)
+-HOSTCC = gcc
+
+ # check if compiler option is supported
+ cc-supports = ${shell if $(CC) ${1} -S -o /dev/null -x c /dev/null > /dev/null 2>&1; then echo "$(1)"; fi;}
+diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
+index 8fc6b1ca47dca..42dbe05b18077 100644
+--- a/tools/scripts/Makefile.include
++++ b/tools/scripts/Makefile.include
+@@ -60,6 +60,16 @@ $(call allow-override,LD,$(CROSS_COMPILE)ld)
+ $(call allow-override,CXX,$(CROSS_COMPILE)g++)
+ $(call allow-override,STRIP,$(CROSS_COMPILE)strip)
+
++ifneq ($(LLVM),)
++HOSTAR ?= llvm-ar
++HOSTCC ?= clang
++HOSTLD ?= ld.lld
++else
++HOSTAR ?= ar
++HOSTCC ?= gcc
++HOSTLD ?= ld
++endif
++
+ ifeq ($(CC_NO_CLANG), 1)
+ EXTRA_WARNINGS += -Wstrict-aliasing=3
+ endif
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-02-03 23:43 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-02-03 23:43 UTC (permalink / raw
To: gentoo-commits
commit: 859e4d8ee635ad9842c3059fe7eedb7c82759803
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 3 23:42:47 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Feb 3 23:42:47 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=859e4d8e
Linux patch 4.19.173
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1172_linux-4.19.173.patch | 887 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 891 insertions(+)
diff --git a/0000_README b/0000_README
index a202ba1..0bd69fd 100644
--- a/0000_README
+++ b/0000_README
@@ -727,6 +727,10 @@ Patch: 1171_linux-4.19.172.patch
From: https://www.kernel.org
Desc: Linux 4.19.172
+Patch: 1172_linux-4.19.173.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.173
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1172_linux-4.19.173.patch b/1172_linux-4.19.173.patch
new file mode 100644
index 0000000..e037fd5
--- /dev/null
+++ b/1172_linux-4.19.173.patch
@@ -0,0 +1,887 @@
+diff --git a/Makefile b/Makefile
+index 7da0ddd650521..5770b9d8026b9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 172
++SUBLEVEL = 173
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+index b8044681006c6..2df4694c0d3bd 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+@@ -278,7 +278,7 @@
+
+ /* VDD_AUD_1P8: Audio codec */
+ reg_aud_1p8v: ldo3 {
+- regulator-name = "vdd1p8";
++ regulator-name = "vdd1p8a";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-boot-on;
+diff --git a/arch/arm/mach-imx/suspend-imx6.S b/arch/arm/mach-imx/suspend-imx6.S
+index 7d84b617af481..99d2e296082c7 100644
+--- a/arch/arm/mach-imx/suspend-imx6.S
++++ b/arch/arm/mach-imx/suspend-imx6.S
+@@ -73,6 +73,7 @@
+ #define MX6Q_CCM_CCR 0x0
+
+ .align 3
++ .arm
+
+ .macro sync_l2_cache
+
+diff --git a/arch/x86/kvm/pmu_intel.c b/arch/x86/kvm/pmu_intel.c
+index 2ab8c20c8bfad..611f9e60f8154 100644
+--- a/arch/x86/kvm/pmu_intel.c
++++ b/arch/x86/kvm/pmu_intel.c
+@@ -29,7 +29,7 @@ static struct kvm_event_hw_type_mapping intel_arch_events[] = {
+ [4] = { 0x2e, 0x41, PERF_COUNT_HW_CACHE_MISSES },
+ [5] = { 0xc4, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS },
+ [6] = { 0xc5, 0x00, PERF_COUNT_HW_BRANCH_MISSES },
+- [7] = { 0x00, 0x30, PERF_COUNT_HW_REF_CPU_CYCLES },
++ [7] = { 0x00, 0x03, PERF_COUNT_HW_REF_CPU_CYCLES },
+ };
+
+ /* mapping between fixed pmc index and intel_arch_events array */
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 7096578ef7370..8e4eef73531a5 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -102,6 +102,7 @@ static u64 __read_mostly cr4_reserved_bits = CR4_RESERVED_BITS;
+
+ static void update_cr8_intercept(struct kvm_vcpu *vcpu);
+ static void process_nmi(struct kvm_vcpu *vcpu);
++static void process_smi(struct kvm_vcpu *vcpu);
+ static void enter_smm(struct kvm_vcpu *vcpu);
+ static void __kvm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags);
+ static void store_regs(struct kvm_vcpu *vcpu);
+@@ -3499,6 +3500,10 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu,
+ struct kvm_vcpu_events *events)
+ {
+ process_nmi(vcpu);
++
++ if (kvm_check_request(KVM_REQ_SMI, vcpu))
++ process_smi(vcpu);
++
+ /*
+ * FIXME: pass injected and pending separately. This is only
+ * needed for nested virtualization, whose state cannot be
+diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
+index 8940054d6250f..b3b92c54cba8d 100644
+--- a/drivers/acpi/device_sysfs.c
++++ b/drivers/acpi/device_sysfs.c
+@@ -259,20 +259,12 @@ int __acpi_device_uevent_modalias(struct acpi_device *adev,
+ if (add_uevent_var(env, "MODALIAS="))
+ return -ENOMEM;
+
+- len = create_pnp_modalias(adev, &env->buf[env->buflen - 1],
+- sizeof(env->buf) - env->buflen);
+- if (len < 0)
+- return len;
+-
+- env->buflen += len;
+- if (!adev->data.of_compatible)
+- return 0;
+-
+- if (len > 0 && add_uevent_var(env, "MODALIAS="))
+- return -ENOMEM;
+-
+- len = create_of_modalias(adev, &env->buf[env->buflen - 1],
+- sizeof(env->buf) - env->buflen);
++ if (adev->data.of_compatible)
++ len = create_of_modalias(adev, &env->buf[env->buflen - 1],
++ sizeof(env->buf) - env->buflen);
++ else
++ len = create_pnp_modalias(adev, &env->buf[env->buflen - 1],
++ sizeof(env->buf) - env->buflen);
+ if (len < 0)
+ return len;
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 517318bb350cf..81b955670b120 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -966,6 +966,12 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+ if (!sock)
+ return err;
+
++ /*
++ * We need to make sure we don't get any errant requests while we're
++ * reallocating the ->socks array.
++ */
++ blk_mq_freeze_queue(nbd->disk->queue);
++
+ if (!netlink && !nbd->task_setup &&
+ !test_bit(NBD_BOUND, &config->runtime_flags))
+ nbd->task_setup = current;
+@@ -1004,10 +1010,12 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+ nsock->cookie = 0;
+ socks[config->num_connections++] = nsock;
+ atomic_inc(&config->live_connections);
++ blk_mq_unfreeze_queue(nbd->disk->queue);
+
+ return 0;
+
+ put_socket:
++ blk_mq_unfreeze_queue(nbd->disk->queue);
+ sockfd_put(sock);
+ return err;
+ }
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index adc0e3ed01c24..d4ceee3825f8d 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -936,7 +936,8 @@ static void blkif_set_queue_limits(struct blkfront_info *info)
+ if (info->feature_discard) {
+ blk_queue_flag_set(QUEUE_FLAG_DISCARD, rq);
+ blk_queue_max_discard_sectors(rq, get_capacity(gd));
+- rq->limits.discard_granularity = info->discard_granularity;
++ rq->limits.discard_granularity = info->discard_granularity ?:
++ info->physical_sector_size;
+ rq->limits.discard_alignment = info->discard_alignment;
+ if (info->feature_secdiscard)
+ blk_queue_flag_set(QUEUE_FLAG_SECERASE, rq);
+@@ -2169,19 +2170,12 @@ static void blkfront_closing(struct blkfront_info *info)
+
+ static void blkfront_setup_discard(struct blkfront_info *info)
+ {
+- int err;
+- unsigned int discard_granularity;
+- unsigned int discard_alignment;
+-
+ info->feature_discard = 1;
+- err = xenbus_gather(XBT_NIL, info->xbdev->otherend,
+- "discard-granularity", "%u", &discard_granularity,
+- "discard-alignment", "%u", &discard_alignment,
+- NULL);
+- if (!err) {
+- info->discard_granularity = discard_granularity;
+- info->discard_alignment = discard_alignment;
+- }
++ info->discard_granularity = xenbus_read_unsigned(info->xbdev->otherend,
++ "discard-granularity",
++ 0);
++ info->discard_alignment = xenbus_read_unsigned(info->xbdev->otherend,
++ "discard-alignment", 0);
+ info->feature_secdiscard =
+ !!xenbus_read_unsigned(info->xbdev->otherend, "discard-secure",
+ 0);
+diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
+index a9e3a11bea54a..caa6a502c37e2 100644
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -2485,7 +2485,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ init_attr->cap.max_send_wr = qhp->attr.sq_num_entries;
+ init_attr->cap.max_recv_wr = qhp->attr.rq_num_entries;
+ init_attr->cap.max_send_sge = qhp->attr.sq_max_sges;
+- init_attr->cap.max_recv_sge = qhp->attr.sq_max_sges;
++ init_attr->cap.max_recv_sge = qhp->attr.rq_max_sges;
+ init_attr->cap.max_inline_data = T4_MAX_SEND_INLINE;
+ init_attr->sq_sig_type = qhp->sq_sig_all ? IB_SIGNAL_ALL_WR : 0;
+ return 0;
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index d936ff765fe4a..3f0c2c1ef0cb2 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1029,8 +1029,8 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
+ {
+ struct intel_iommu *iommu;
+ u32 ver, sts;
+- int agaw = 0;
+- int msagaw = 0;
++ int agaw = -1;
++ int msagaw = -1;
+ int err;
+
+ if (!drhd->reg_base_addr) {
+@@ -1055,17 +1055,28 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
+ }
+
+ err = -EINVAL;
+- agaw = iommu_calculate_agaw(iommu);
+- if (agaw < 0) {
+- pr_err("Cannot get a valid agaw for iommu (seq_id = %d)\n",
+- iommu->seq_id);
+- goto err_unmap;
++ if (cap_sagaw(iommu->cap) == 0) {
++ pr_info("%s: No supported address widths. Not attempting DMA translation.\n",
++ iommu->name);
++ drhd->ignored = 1;
+ }
+- msagaw = iommu_calculate_max_sagaw(iommu);
+- if (msagaw < 0) {
+- pr_err("Cannot get a valid max agaw for iommu (seq_id = %d)\n",
+- iommu->seq_id);
+- goto err_unmap;
++
++ if (!drhd->ignored) {
++ agaw = iommu_calculate_agaw(iommu);
++ if (agaw < 0) {
++ pr_err("Cannot get a valid agaw for iommu (seq_id = %d)\n",
++ iommu->seq_id);
++ drhd->ignored = 1;
++ }
++ }
++ if (!drhd->ignored) {
++ msagaw = iommu_calculate_max_sagaw(iommu);
++ if (msagaw < 0) {
++ pr_err("Cannot get a valid max agaw for iommu (seq_id = %d)\n",
++ iommu->seq_id);
++ drhd->ignored = 1;
++ agaw = -1;
++ }
+ }
+ iommu->agaw = agaw;
+ iommu->msagaw = msagaw;
+@@ -1092,7 +1103,12 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
+
+ raw_spin_lock_init(&iommu->register_lock);
+
+- if (intel_iommu_enabled) {
++ /*
++ * This is only for hotplug; at boot time intel_iommu_enabled won't
++ * be set yet. When intel_iommu_init() runs, it registers the units
++ * present at boot time, then sets intel_iommu_enabled.
++ */
++ if (intel_iommu_enabled && !drhd->ignored) {
+ err = iommu_device_sysfs_add(&iommu->iommu, NULL,
+ intel_iommu_groups,
+ "%s", iommu->name);
+@@ -1107,6 +1123,7 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
+ }
+
+ drhd->iommu = iommu;
++ iommu->drhd = drhd;
+
+ return 0;
+
+@@ -1121,7 +1138,7 @@ error:
+
+ static void free_iommu(struct intel_iommu *iommu)
+ {
+- if (intel_iommu_enabled) {
++ if (intel_iommu_enabled && !iommu->drhd->ignored) {
+ iommu_device_unregister(&iommu->iommu);
+ iommu_device_sysfs_remove(&iommu->iommu);
+ }
+diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c
+index 005b839f6eb9e..ec4c957c36b6c 100644
+--- a/drivers/leds/led-triggers.c
++++ b/drivers/leds/led-triggers.c
+@@ -317,14 +317,15 @@ void led_trigger_event(struct led_trigger *trig,
+ enum led_brightness brightness)
+ {
+ struct led_classdev *led_cdev;
++ unsigned long flags;
+
+ if (!trig)
+ return;
+
+- read_lock(&trig->leddev_list_lock);
++ read_lock_irqsave(&trig->leddev_list_lock, flags);
+ list_for_each_entry(led_cdev, &trig->led_cdevs, trig_list)
+ led_set_brightness(led_cdev, brightness);
+- read_unlock(&trig->leddev_list_lock);
++ read_unlock_irqrestore(&trig->leddev_list_lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(led_trigger_event);
+
+@@ -335,11 +336,12 @@ static void led_trigger_blink_setup(struct led_trigger *trig,
+ int invert)
+ {
+ struct led_classdev *led_cdev;
++ unsigned long flags;
+
+ if (!trig)
+ return;
+
+- read_lock(&trig->leddev_list_lock);
++ read_lock_irqsave(&trig->leddev_list_lock, flags);
+ list_for_each_entry(led_cdev, &trig->led_cdevs, trig_list) {
+ if (oneshot)
+ led_blink_set_oneshot(led_cdev, delay_on, delay_off,
+@@ -347,7 +349,7 @@ static void led_trigger_blink_setup(struct led_trigger *trig,
+ else
+ led_blink_set(led_cdev, delay_on, delay_off);
+ }
+- read_unlock(&trig->leddev_list_lock);
++ read_unlock_irqrestore(&trig->leddev_list_lock, flags);
+ }
+
+ void led_trigger_blink(struct led_trigger *trig,
+diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
+index cf3df733d9605..6ea6038b9d364 100644
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -1875,6 +1875,8 @@ int rc_register_device(struct rc_dev *dev)
+ goto out_raw;
+ }
+
++ dev->registered = true;
++
+ rc = device_add(&dev->dev);
+ if (rc)
+ goto out_rx_free;
+@@ -1884,8 +1886,6 @@ int rc_register_device(struct rc_dev *dev)
+ dev->device_name ?: "Unspecified device", path ?: "N/A");
+ kfree(path);
+
+- dev->registered = true;
+-
+ /*
+ * once the the input device is registered in rc_setup_rx_device,
+ * userspace can open the input device and rc_open() will be called
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 953c6fdc75cc4..1bd181b33c24f 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -1142,7 +1142,7 @@ static int can_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ {
+ struct can_priv *priv = netdev_priv(dev);
+ struct can_ctrlmode cm = {.flags = priv->ctrlmode};
+- struct can_berr_counter bec;
++ struct can_berr_counter bec = { };
+ enum can_state state = priv->state;
+
+ if (priv->do_get_state)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index b16e0f45d28c5..a38a0c86705ab 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -1004,6 +1004,7 @@ static struct mlx5_flow_table *__mlx5_create_flow_table(struct mlx5_flow_namespa
+ destroy_ft:
+ root->cmds->destroy_flow_table(root->dev, ft);
+ free_ft:
++ rhltable_destroy(&ft->fgs_hash);
+ kfree(ft);
+ unlock_root:
+ mutex_unlock(&root->chain_lock);
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 3eb034a5a659b..8a1e9dba1249e 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -998,7 +998,8 @@ static void __team_compute_features(struct team *team)
+ unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE |
+ IFF_XMIT_DST_RELEASE_PERM;
+
+- list_for_each_entry(port, &team->port_list, list) {
++ rcu_read_lock();
++ list_for_each_entry_rcu(port, &team->port_list, list) {
+ vlan_features = netdev_increment_features(vlan_features,
+ port->dev->vlan_features,
+ TEAM_VLAN_FEATURES);
+@@ -1012,6 +1013,7 @@ static void __team_compute_features(struct team *team)
+ if (port->dev->hard_header_len > max_hard_header_len)
+ max_hard_header_len = port->dev->hard_header_len;
+ }
++ rcu_read_unlock();
+
+ team->dev->vlan_features = vlan_features;
+ team->dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
+@@ -1027,9 +1029,7 @@ static void __team_compute_features(struct team *team)
+
+ static void team_compute_features(struct team *team)
+ {
+- mutex_lock(&team->lock);
+ __team_compute_features(team);
+- mutex_unlock(&team->lock);
+ netdev_change_features(team->dev);
+ }
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 1b48d71dbc284..bdfe88c754dfe 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1284,6 +1284,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)}, /* Olivetti Olicard 160 */
+ {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */
+ {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */
++ {QMI_QUIRK_SET_DTR(0x1e2d, 0x006f, 8)}, /* Cinterion PLS83/PLS63 */
+ {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */
+ {QMI_FIXED_INTF(0x1e2d, 0x0063, 10)}, /* Cinterion ALASxx (1 RmNet) */
+ {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)}, /* Cinterion PHxx,PXxx (2 RmNet) */
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index f48c7cac122e9..fcda33482887b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -2126,7 +2126,8 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
+
+ while (offs < dwords) {
+ /* limit the time we spin here under lock to 1/2s */
+- ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC);
++ unsigned long end = jiffies + HZ / 2;
++ bool resched = false;
+
+ if (iwl_trans_grab_nic_access(trans, &flags)) {
+ iwl_write32(trans, HBUS_TARG_MEM_RADDR,
+@@ -2137,14 +2138,15 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
+ HBUS_TARG_MEM_RDAT);
+ offs++;
+
+- /* calling ktime_get is expensive so
+- * do it once in 128 reads
+- */
+- if (offs % 128 == 0 && ktime_after(ktime_get(),
+- timeout))
++ if (time_after(jiffies, end)) {
++ resched = true;
+ break;
++ }
+ }
+ iwl_trans_release_nic_access(trans, &flags);
++
++ if (resched)
++ cond_resched();
+ } else {
+ return -EBUSY;
+ }
+diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
+index 47cebb2ec05c5..5aacabd32923e 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
++++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
+@@ -160,8 +160,7 @@ mt7601u_rx_process_entry(struct mt7601u_dev *dev, struct mt7601u_dma_buf_rx *e)
+
+ if (new_p) {
+ /* we have one extra ref from the allocator */
+- __free_pages(e->p, MT_RX_ORDER);
+-
++ put_page(e->p);
+ e->p = new_p;
+ }
+ }
+@@ -318,7 +317,6 @@ static int mt7601u_dma_submit_tx(struct mt7601u_dev *dev,
+ }
+
+ e = &q->e[q->end];
+- e->skb = skb;
+ usb_fill_bulk_urb(e->urb, usb_dev, snd_pipe, skb->data, skb->len,
+ mt7601u_complete_tx, q);
+ ret = usb_submit_urb(e->urb, GFP_ATOMIC);
+@@ -336,6 +334,7 @@ static int mt7601u_dma_submit_tx(struct mt7601u_dev *dev,
+
+ q->end = (q->end + 1) % q->entries;
+ q->used++;
++ e->skb = skb;
+
+ if (q->used >= q->entries)
+ ieee80211_stop_queue(dev->hw, skb_get_queue_mapping(skb));
+diff --git a/drivers/soc/atmel/soc.c b/drivers/soc/atmel/soc.c
+index 4dd03b099c893..76117405d8411 100644
+--- a/drivers/soc/atmel/soc.c
++++ b/drivers/soc/atmel/soc.c
+@@ -254,8 +254,21 @@ struct soc_device * __init at91_soc_init(const struct at91_soc *socs)
+ return soc_dev;
+ }
+
++static const struct of_device_id at91_soc_allowed_list[] __initconst = {
++ { .compatible = "atmel,at91rm9200", },
++ { .compatible = "atmel,at91sam9", },
++ { .compatible = "atmel,sama5", },
++ { .compatible = "atmel,samv7", },
++ { }
++};
++
+ static int __init atmel_soc_device_init(void)
+ {
++ struct device_node *np = of_find_node_by_path("/");
++
++ if (!of_match_node(at91_soc_allowed_list, np))
++ return 0;
++
+ at91_soc_init(socs);
+
+ return 0;
+diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
+index 7e6e682104dc4..a8486432be05a 100644
+--- a/drivers/xen/privcmd.c
++++ b/drivers/xen/privcmd.c
+@@ -743,14 +743,15 @@ static int remap_pfn_fn(pte_t *ptep, pgtable_t token, unsigned long addr,
+ return 0;
+ }
+
+-static long privcmd_ioctl_mmap_resource(struct file *file, void __user *udata)
++static long privcmd_ioctl_mmap_resource(struct file *file,
++ struct privcmd_mmap_resource __user *udata)
+ {
+ struct privcmd_data *data = file->private_data;
+ struct mm_struct *mm = current->mm;
+ struct vm_area_struct *vma;
+ struct privcmd_mmap_resource kdata;
+ xen_pfn_t *pfns = NULL;
+- struct xen_mem_acquire_resource xdata;
++ struct xen_mem_acquire_resource xdata = { };
+ int rc;
+
+ if (copy_from_user(&kdata, udata, sizeof(kdata)))
+@@ -760,6 +761,22 @@ static long privcmd_ioctl_mmap_resource(struct file *file, void __user *udata)
+ if (data->domid != DOMID_INVALID && data->domid != kdata.dom)
+ return -EPERM;
+
++ /* Both fields must be set or unset */
++ if (!!kdata.addr != !!kdata.num)
++ return -EINVAL;
++
++ xdata.domid = kdata.dom;
++ xdata.type = kdata.type;
++ xdata.id = kdata.id;
++
++ if (!kdata.addr && !kdata.num) {
++ /* Query the size of the resource. */
++ rc = HYPERVISOR_memory_op(XENMEM_acquire_resource, &xdata);
++ if (rc)
++ return rc;
++ return __put_user(xdata.nr_frames, &udata->num);
++ }
++
+ down_write(&mm->mmap_sem);
+
+ vma = find_vma(mm, kdata.addr);
+@@ -793,10 +810,6 @@ static long privcmd_ioctl_mmap_resource(struct file *file, void __user *udata)
+ } else
+ vma->vm_private_data = PRIV_VMA_LOCKED;
+
+- memset(&xdata, 0, sizeof(xdata));
+- xdata.domid = kdata.dom;
+- xdata.type = kdata.type;
+- xdata.id = kdata.id;
+ xdata.frame = kdata.idx;
+ xdata.nr_frames = kdata.num;
+ set_xen_guest_handle(xdata.frame_list, pfns);
+diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
+index 14ccf13ab8fa1..786494bb7f20b 100644
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -714,6 +714,23 @@ static bool xs_hvm_defer_init_for_callback(void)
+ #endif
+ }
+
++static int xenbus_probe_thread(void *unused)
++{
++ DEFINE_WAIT(w);
++
++ /*
++ * We actually just want to wait for *any* trigger of xb_waitq,
++ * and run xenbus_probe() the moment it occurs.
++ */
++ prepare_to_wait(&xb_waitq, &w, TASK_INTERRUPTIBLE);
++ schedule();
++ finish_wait(&xb_waitq, &w);
++
++ DPRINTK("probing");
++ xenbus_probe();
++ return 0;
++}
++
+ static int __init xenbus_probe_initcall(void)
+ {
+ /*
+@@ -725,6 +742,20 @@ static int __init xenbus_probe_initcall(void)
+ !xs_hvm_defer_init_for_callback()))
+ xenbus_probe();
+
++ /*
++ * For XS_LOCAL, spawn a thread which will wait for xenstored
++ * or a xenstore-stubdom to be started, then probe. It will be
++ * triggered when communication starts happening, by waiting
++ * on xb_waitq.
++ */
++ if (xen_store_domain_type == XS_LOCAL) {
++ struct task_struct *probe_task;
++
++ probe_task = kthread_run(xenbus_probe_thread, NULL,
++ "xenbus_probe");
++ if (IS_ERR(probe_task))
++ return PTR_ERR(probe_task);
++ }
+ return 0;
+ }
+ device_initcall(xenbus_probe_initcall);
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 46ca5592b8b0d..4b165aa5a2561 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2320,6 +2320,7 @@ out_forget:
+ spin_unlock(&ino->i_lock);
+ lseg->pls_layout = lo;
+ NFS_SERVER(ino)->pnfs_curr_ld->free_lseg(lseg);
++ pnfs_free_lseg_list(&free_me);
+ return ERR_PTR(-EAGAIN);
+ }
+
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index 539f4a84412f4..786df33c00203 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -472,6 +472,8 @@ struct intel_iommu {
+ struct iommu_device iommu; /* IOMMU core code handle */
+ int node;
+ u32 flags; /* Software defined flags */
++
++ struct dmar_drhd_unit *drhd;
+ };
+
+ /* PCI domain-device relationship */
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 0d4501f44e00d..afbe1d3991f21 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1961,7 +1961,7 @@ void tcp_mark_skb_lost(struct sock *sk, struct sk_buff *skb);
+ void tcp_newreno_mark_lost(struct sock *sk, bool snd_una_advanced);
+ extern s32 tcp_rack_skb_timeout(struct tcp_sock *tp, struct sk_buff *skb,
+ u32 reo_wnd);
+-extern void tcp_rack_mark_lost(struct sock *sk);
++extern bool tcp_rack_mark_lost(struct sock *sk);
+ extern void tcp_rack_advance(struct tcp_sock *tp, u8 sacked, u32 end_seq,
+ u64 xmit_time);
+ extern void tcp_rack_reo_timeout(struct sock *sk);
+diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
+index faeec8255e7e0..6b3d7f7211dd6 100644
+--- a/kernel/kexec_core.c
++++ b/kernel/kexec_core.c
+@@ -1130,7 +1130,6 @@ int kernel_kexec(void)
+
+ #ifdef CONFIG_KEXEC_JUMP
+ if (kexec_image->preserve_context) {
+- lock_system_sleep();
+ pm_prepare_console();
+ error = freeze_processes();
+ if (error) {
+@@ -1193,7 +1192,6 @@ int kernel_kexec(void)
+ thaw_processes();
+ Restore_console:
+ pm_restore_console();
+- unlock_system_sleep();
+ }
+ #endif
+
+diff --git a/kernel/power/swap.c b/kernel/power/swap.c
+index d7f6c1a288d33..e9494c29f1ca4 100644
+--- a/kernel/power/swap.c
++++ b/kernel/power/swap.c
+@@ -491,10 +491,10 @@ static int swap_writer_finish(struct swap_map_handle *handle,
+ unsigned int flags, int error)
+ {
+ if (!error) {
+- flush_swap_writer(handle);
+ pr_info("S");
+ error = mark_swapfiles(handle, flags);
+ pr_cont("|\n");
++ flush_swap_writer(handle);
+ }
+
+ if (error)
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index aa025cfda77bf..5ffc85c8952a0 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2750,7 +2750,8 @@ static void tcp_identify_packet_loss(struct sock *sk, int *ack_flag)
+ } else if (tcp_is_rack(sk)) {
+ u32 prior_retrans = tp->retrans_out;
+
+- tcp_rack_mark_lost(sk);
++ if (tcp_rack_mark_lost(sk))
++ *ack_flag &= ~FLAG_SET_XMIT_TIMER;
+ if (prior_retrans > tp->retrans_out)
+ *ack_flag |= FLAG_LOST_RETRANS;
+ }
+@@ -3693,9 +3694,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
+
+ if (tp->tlp_high_seq)
+ tcp_process_tlp_ack(sk, ack, flag);
+- /* If needed, reset TLP/RTO timer; RACK may later override this. */
+- if (flag & FLAG_SET_XMIT_TIMER)
+- tcp_set_xmit_timer(sk);
+
+ if (tcp_ack_is_dubious(sk, flag)) {
+ is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP));
+@@ -3703,6 +3701,10 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
+ &rexmit);
+ }
+
++ /* If needed, reset TLP/RTO timer when RACK doesn't set. */
++ if (flag & FLAG_SET_XMIT_TIMER)
++ tcp_set_xmit_timer(sk);
++
+ if ((flag & FLAG_FORWARD_PROGRESS) || !(flag & FLAG_NOT_DUP))
+ sk_dst_confirm(sk);
+
+diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c
+index c81aadff769b2..0d96decba13df 100644
+--- a/net/ipv4/tcp_recovery.c
++++ b/net/ipv4/tcp_recovery.c
+@@ -109,13 +109,13 @@ static void tcp_rack_detect_loss(struct sock *sk, u32 *reo_timeout)
+ }
+ }
+
+-void tcp_rack_mark_lost(struct sock *sk)
++bool tcp_rack_mark_lost(struct sock *sk)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+ u32 timeout;
+
+ if (!tp->rack.advanced)
+- return;
++ return false;
+
+ /* Reset the advanced flag to avoid unnecessary queue scanning */
+ tp->rack.advanced = 0;
+@@ -125,6 +125,7 @@ void tcp_rack_mark_lost(struct sock *sk)
+ inet_csk_reset_xmit_timer(sk, ICSK_TIME_REO_TIMEOUT,
+ timeout, inet_csk(sk)->icsk_rto);
+ }
++ return !!timeout;
+ }
+
+ /* Record the most recently (re)sent time among the (s)acked packets
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index a879d8071712b..fc715bba59146 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1051,6 +1051,7 @@ enum queue_stop_reason {
+ IEEE80211_QUEUE_STOP_REASON_FLUSH,
+ IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN,
+ IEEE80211_QUEUE_STOP_REASON_RESERVE_TID,
++ IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE,
+
+ IEEE80211_QUEUE_STOP_REASONS,
+ };
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 152d4365f9616..511ca6f74239d 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1542,6 +1542,10 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
+ if (ret)
+ return ret;
+
++ ieee80211_stop_vif_queues(local, sdata,
++ IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
++ synchronize_net();
++
+ ieee80211_do_stop(sdata, false);
+
+ ieee80211_teardown_sdata(sdata);
+@@ -1562,6 +1566,8 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
+ err = ieee80211_do_open(&sdata->wdev, false);
+ WARN(err, "type change: do_open returned %d", err);
+
++ ieee80211_wake_vif_queues(local, sdata,
++ IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
+ return ret;
+ }
+
+diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
+index eb7f9a5f2aeb7..4e544044fc2de 100644
+--- a/net/netfilter/nft_dynset.c
++++ b/net/netfilter/nft_dynset.c
+@@ -213,8 +213,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
+ nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_EXPR,
+ priv->expr->ops->size);
+ if (set->flags & NFT_SET_TIMEOUT) {
+- if (timeout || set->timeout)
++ if (timeout || set->timeout) {
++ nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_TIMEOUT);
+ nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_EXPIRATION);
++ }
+ }
+
+ priv->timeout = timeout;
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index 310872a9d6602..4884e1987562a 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -871,6 +871,7 @@ static int nfc_genl_stop_poll(struct sk_buff *skb, struct genl_info *info)
+
+ if (!dev->polling) {
+ device_unlock(&dev->dev);
++ nfc_put_device(dev);
+ return -EINVAL;
+ }
+
+diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
+index b927730d9ab06..57a07ab80d924 100644
+--- a/net/nfc/rawsock.c
++++ b/net/nfc/rawsock.c
+@@ -117,7 +117,7 @@ static int rawsock_connect(struct socket *sock, struct sockaddr *_addr,
+ if (addr->target_idx > dev->target_next_idx - 1 ||
+ addr->target_idx < dev->target_next_idx - dev->n_targets) {
+ rc = -EINVAL;
+- goto error;
++ goto put_dev;
+ }
+
+ rc = nfc_activate_target(dev, addr->target_idx, addr->nfc_protocol);
+diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
+index 7778f0fb48cf4..7ecfbff1f0d08 100644
+--- a/net/rxrpc/call_accept.c
++++ b/net/rxrpc/call_accept.c
+@@ -211,6 +211,7 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)
+ tail = b->peer_backlog_tail;
+ while (CIRC_CNT(head, tail, size) > 0) {
+ struct rxrpc_peer *peer = b->peer_backlog[tail];
++ rxrpc_put_local(peer->local);
+ kfree(peer);
+ tail = (tail + 1) & (size - 1);
+ }
+diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
+index 69102fda9ebd4..76a80a41615be 100644
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -896,8 +896,9 @@ out:
+ int call_commit_handler(struct net_device *dev)
+ {
+ #ifdef CONFIG_WIRELESS_EXT
+- if ((netif_running(dev)) &&
+- (dev->wireless_handlers->standard[0] != NULL))
++ if (netif_running(dev) &&
++ dev->wireless_handlers &&
++ dev->wireless_handlers->standard[0])
+ /* Call the commit handler on the driver */
+ return dev->wireless_handlers->standard[0](dev, NULL,
+ NULL, NULL);
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index 0ee13d12782fb..fcba8a139f61e 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -420,7 +420,7 @@ resume:
+ /* only the first xfrm gets the encap type */
+ encap_type = 0;
+
+- if (async && x->repl->recheck(x, skb, seq)) {
++ if (x->repl->recheck(x, skb, seq)) {
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
+ goto drop_unlock;
+ }
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 939f3adf075aa..e9aea82f370de 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -2101,8 +2101,8 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net,
+ xflo.flags = flags;
+
+ /* To accelerate a bit... */
+- if ((dst_orig->flags & DST_NOXFRM) ||
+- !net->xfrm.policy_count[XFRM_POLICY_OUT])
++ if (!if_id && ((dst_orig->flags & DST_NOXFRM) ||
++ !net->xfrm.policy_count[XFRM_POLICY_OUT]))
+ goto nopol;
+
+ xdst = xfrm_bundle_lookup(net, fl, family, dir, &xflo, if_id);
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index efba9057b2b61..0046ea78abd25 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -1056,7 +1056,7 @@ static const struct hda_fixup via_fixups[] = {
+ static const struct snd_pci_quirk vt2002p_fixups[] = {
+ SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75),
+ SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST),
+- SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", VIA_FIXUP_POWER_SAVE),
++ SND_PCI_QUIRK_VENDOR(0x1558, "Clevo", VIA_FIXUP_POWER_SAVE),
+ {}
+ };
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-02-07 14:40 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-02-07 14:40 UTC (permalink / raw
To: gentoo-commits
commit: 7006cd0e76273c68b9b7f1a6e924b8e11541e064
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Sun Feb 7 14:39:25 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Sun Feb 7 14:39:33 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7006cd0e
Linux patch 4.19.174
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1173_linux-4.19.174.patch | 640 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 644 insertions(+)
diff --git a/0000_README b/0000_README
index 0bd69fd..1d2c2d9 100644
--- a/0000_README
+++ b/0000_README
@@ -731,6 +731,10 @@ Patch: 1172_linux-4.19.173.patch
From: https://www.kernel.org
Desc: Linux 4.19.173
+Patch: 1173_linux-4.19.174.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.174
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1173_linux-4.19.174.patch b/1173_linux-4.19.174.patch
new file mode 100644
index 0000000..33d2ee8
--- /dev/null
+++ b/1173_linux-4.19.174.patch
@@ -0,0 +1,640 @@
+diff --git a/Makefile b/Makefile
+index 5770b9d8026b9..8f326d0652a73 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 173
++SUBLEVEL = 174
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/include/asm/msr.h b/arch/x86/include/asm/msr.h
+index 04addd6e0a4a2..2571e2017a8bb 100644
+--- a/arch/x86/include/asm/msr.h
++++ b/arch/x86/include/asm/msr.h
+@@ -88,7 +88,7 @@ static inline void do_trace_rdpmc(unsigned int msr, u64 val, int failed) {}
+ * think of extending them - you will be slapped with a stinking trout or a frozen
+ * shark will reach you, wherever you are! You've been warned.
+ */
+-static inline unsigned long long notrace __rdmsr(unsigned int msr)
++static __always_inline unsigned long long __rdmsr(unsigned int msr)
+ {
+ DECLARE_ARGS(val, low, high);
+
+@@ -100,7 +100,7 @@ static inline unsigned long long notrace __rdmsr(unsigned int msr)
+ return EAX_EDX_VAL(val, low, high);
+ }
+
+-static inline void notrace __wrmsr(unsigned int msr, u32 low, u32 high)
++static __always_inline void __wrmsr(unsigned int msr, u32 low, u32 high)
+ {
+ asm volatile("1: wrmsr\n"
+ "2:\n"
+diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
+index 551b71a24b857..3bdab6eb33bf3 100644
+--- a/drivers/acpi/thermal.c
++++ b/drivers/acpi/thermal.c
+@@ -188,6 +188,8 @@ struct acpi_thermal {
+ int tz_enabled;
+ int kelvin_offset;
+ struct work_struct thermal_check_work;
++ struct mutex thermal_check_lock;
++ refcount_t thermal_check_count;
+ };
+
+ /* --------------------------------------------------------------------------
+@@ -513,17 +515,6 @@ static int acpi_thermal_get_trip_points(struct acpi_thermal *tz)
+ return 0;
+ }
+
+-static void acpi_thermal_check(void *data)
+-{
+- struct acpi_thermal *tz = data;
+-
+- if (!tz->tz_enabled)
+- return;
+-
+- thermal_zone_device_update(tz->thermal_zone,
+- THERMAL_EVENT_UNSPECIFIED);
+-}
+-
+ /* sys I/F for generic thermal sysfs support */
+
+ static int thermal_get_temp(struct thermal_zone_device *thermal, int *temp)
+@@ -557,6 +548,8 @@ static int thermal_get_mode(struct thermal_zone_device *thermal,
+ return 0;
+ }
+
++static void acpi_thermal_check_fn(struct work_struct *work);
++
+ static int thermal_set_mode(struct thermal_zone_device *thermal,
+ enum thermal_device_mode mode)
+ {
+@@ -582,7 +575,7 @@ static int thermal_set_mode(struct thermal_zone_device *thermal,
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ "%s kernel ACPI thermal control\n",
+ tz->tz_enabled ? "Enable" : "Disable"));
+- acpi_thermal_check(tz);
++ acpi_thermal_check_fn(&tz->thermal_check_work);
+ }
+ return 0;
+ }
+@@ -951,6 +944,12 @@ static void acpi_thermal_unregister_thermal_zone(struct acpi_thermal *tz)
+ Driver Interface
+ -------------------------------------------------------------------------- */
+
++static void acpi_queue_thermal_check(struct acpi_thermal *tz)
++{
++ if (!work_pending(&tz->thermal_check_work))
++ queue_work(acpi_thermal_pm_queue, &tz->thermal_check_work);
++}
++
+ static void acpi_thermal_notify(struct acpi_device *device, u32 event)
+ {
+ struct acpi_thermal *tz = acpi_driver_data(device);
+@@ -961,17 +960,17 @@ static void acpi_thermal_notify(struct acpi_device *device, u32 event)
+
+ switch (event) {
+ case ACPI_THERMAL_NOTIFY_TEMPERATURE:
+- acpi_thermal_check(tz);
++ acpi_queue_thermal_check(tz);
+ break;
+ case ACPI_THERMAL_NOTIFY_THRESHOLDS:
+ acpi_thermal_trips_update(tz, ACPI_TRIPS_REFRESH_THRESHOLDS);
+- acpi_thermal_check(tz);
++ acpi_queue_thermal_check(tz);
+ acpi_bus_generate_netlink_event(device->pnp.device_class,
+ dev_name(&device->dev), event, 0);
+ break;
+ case ACPI_THERMAL_NOTIFY_DEVICES:
+ acpi_thermal_trips_update(tz, ACPI_TRIPS_REFRESH_DEVICES);
+- acpi_thermal_check(tz);
++ acpi_queue_thermal_check(tz);
+ acpi_bus_generate_netlink_event(device->pnp.device_class,
+ dev_name(&device->dev), event, 0);
+ break;
+@@ -1071,7 +1070,27 @@ static void acpi_thermal_check_fn(struct work_struct *work)
+ {
+ struct acpi_thermal *tz = container_of(work, struct acpi_thermal,
+ thermal_check_work);
+- acpi_thermal_check(tz);
++
++ if (!tz->tz_enabled)
++ return;
++ /*
++ * In general, it is not sufficient to check the pending bit, because
++ * subsequent instances of this function may be queued after one of them
++ * has started running (e.g. if _TMP sleeps). Avoid bailing out if just
++ * one of them is running, though, because it may have done the actual
++ * check some time ago, so allow at least one of them to block on the
++ * mutex while another one is running the update.
++ */
++ if (!refcount_dec_not_one(&tz->thermal_check_count))
++ return;
++
++ mutex_lock(&tz->thermal_check_lock);
++
++ thermal_zone_device_update(tz->thermal_zone, THERMAL_EVENT_UNSPECIFIED);
++
++ refcount_inc(&tz->thermal_check_count);
++
++ mutex_unlock(&tz->thermal_check_lock);
+ }
+
+ static int acpi_thermal_add(struct acpi_device *device)
+@@ -1103,6 +1122,8 @@ static int acpi_thermal_add(struct acpi_device *device)
+ if (result)
+ goto free_memory;
+
++ refcount_set(&tz->thermal_check_count, 3);
++ mutex_init(&tz->thermal_check_lock);
+ INIT_WORK(&tz->thermal_check_work, acpi_thermal_check_fn);
+
+ pr_info(PREFIX "%s [%s] (%ld C)\n", acpi_device_name(device),
+@@ -1168,7 +1189,7 @@ static int acpi_thermal_resume(struct device *dev)
+ tz->state.active |= tz->trips.active[i].flags.enabled;
+ }
+
+- queue_work(acpi_thermal_pm_queue, &tz->thermal_check_work);
++ acpi_queue_thermal_check(tz);
+
+ return AE_OK;
+ }
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index c0bba680d4a88..613f03f9d9eca 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -423,15 +423,19 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds)
+ /* Find our integrated MDIO bus node */
+ dn = of_find_compatible_node(NULL, NULL, "brcm,unimac-mdio");
+ priv->master_mii_bus = of_mdio_find_bus(dn);
+- if (!priv->master_mii_bus)
++ if (!priv->master_mii_bus) {
++ of_node_put(dn);
+ return -EPROBE_DEFER;
++ }
+
+ get_device(&priv->master_mii_bus->dev);
+ priv->master_mii_dn = dn;
+
+ priv->slave_mii_bus = devm_mdiobus_alloc(ds->dev);
+- if (!priv->slave_mii_bus)
++ if (!priv->slave_mii_bus) {
++ of_node_put(dn);
+ return -ENOMEM;
++ }
+
+ priv->slave_mii_bus->priv = priv;
+ priv->slave_mii_bus->name = "sf2 slave mii";
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index d762eb491a7c3..68d5971c200a1 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -4434,6 +4434,12 @@ static void ibmvnic_tasklet(void *data)
+ while (!done) {
+ /* Pull all the valid messages off the CRQ */
+ while ((crq = ibmvnic_next_crq(adapter)) != NULL) {
++ /* This barrier makes sure ibmvnic_next_crq()'s
++ * crq->generic.first & IBMVNIC_CRQ_CMD_RSP is loaded
++ * before ibmvnic_handle_crq()'s
++ * switch(gen_crq->first) and switch(gen_crq->cmd).
++ */
++ dma_rmb();
+ ibmvnic_handle_crq(crq, adapter);
+ crq->generic.first = 0;
+ }
+diff --git a/drivers/phy/motorola/phy-cpcap-usb.c b/drivers/phy/motorola/phy-cpcap-usb.c
+index 593c77dbde2eb..106f53f333242 100644
+--- a/drivers/phy/motorola/phy-cpcap-usb.c
++++ b/drivers/phy/motorola/phy-cpcap-usb.c
+@@ -623,35 +623,42 @@ static int cpcap_usb_phy_probe(struct platform_device *pdev)
+ generic_phy = devm_phy_create(ddata->dev, NULL, &ops);
+ if (IS_ERR(generic_phy)) {
+ error = PTR_ERR(generic_phy);
+- return PTR_ERR(generic_phy);
++ goto out_reg_disable;
+ }
+
+ phy_set_drvdata(generic_phy, ddata);
+
+ phy_provider = devm_of_phy_provider_register(ddata->dev,
+ of_phy_simple_xlate);
+- if (IS_ERR(phy_provider))
+- return PTR_ERR(phy_provider);
++ if (IS_ERR(phy_provider)) {
++ error = PTR_ERR(phy_provider);
++ goto out_reg_disable;
++ }
+
+ error = cpcap_usb_init_optional_pins(ddata);
+ if (error)
+- return error;
++ goto out_reg_disable;
+
+ cpcap_usb_init_optional_gpios(ddata);
+
+ error = cpcap_usb_init_iio(ddata);
+ if (error)
+- return error;
++ goto out_reg_disable;
+
+ error = cpcap_usb_init_interrupts(pdev, ddata);
+ if (error)
+- return error;
++ goto out_reg_disable;
+
+ usb_add_phy_dev(&ddata->phy);
+ atomic_set(&ddata->active, 1);
+ schedule_delayed_work(&ddata->detect_work, msecs_to_jiffies(1));
+
+ return 0;
++
++out_reg_disable:
++ regulator_disable(ddata->vusb);
++
++ return error;
+ }
+
+ static int cpcap_usb_phy_remove(struct platform_device *pdev)
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index f5774372c3871..cf8587f96fc45 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -203,6 +203,12 @@ static const struct dmi_system_id dmi_switches_allow_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Switch SA5-271"),
+ },
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7352"),
++ },
++ },
+ {} /* Array terminator */
+ };
+
+diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
+index cb204f9734913..f122a0263a1ba 100644
+--- a/drivers/platform/x86/touchscreen_dmi.c
++++ b/drivers/platform/x86/touchscreen_dmi.c
+@@ -163,6 +163,16 @@ static const struct ts_dmi_data digma_citi_e200_data = {
+ .properties = digma_citi_e200_props,
+ };
+
++static const struct property_entry estar_beauty_hd_props[] = {
++ PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"),
++ { }
++};
++
++static const struct ts_dmi_data estar_beauty_hd_data = {
++ .acpi_name = "GDIX1001:00",
++ .properties = estar_beauty_hd_props,
++};
++
+ static const struct property_entry gp_electronic_t701_props[] = {
+ PROPERTY_ENTRY_U32("touchscreen-size-x", 960),
+ PROPERTY_ENTRY_U32("touchscreen-size-y", 640),
+@@ -501,6 +511,14 @@ static const struct dmi_system_id touchscreen_dmi_table[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
+ },
+ },
++ {
++ /* Estar Beauty HD (MID 7316R) */
++ .driver_data = (void *)&estar_beauty_hd_data,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Estar"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "eSTAR BEAUTY HD Intel Quad core"),
++ },
++ },
+ {
+ /* GP-electronic T701 */
+ .driver_data = (void *)&gp_electronic_t701_data,
+diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
+index 090ab377f65e5..50078a199fea0 100644
+--- a/drivers/scsi/ibmvscsi/ibmvfc.c
++++ b/drivers/scsi/ibmvscsi/ibmvfc.c
+@@ -2890,8 +2890,10 @@ static int ibmvfc_slave_configure(struct scsi_device *sdev)
+ unsigned long flags = 0;
+
+ spin_lock_irqsave(shost->host_lock, flags);
+- if (sdev->type == TYPE_DISK)
++ if (sdev->type == TYPE_DISK) {
+ sdev->allow_restart = 1;
++ blk_queue_rq_timeout(sdev->request_queue, 120 * HZ);
++ }
+ spin_unlock_irqrestore(shost->host_lock, flags);
+ return 0;
+ }
+diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
+index 6ba257cbc6d94..384458d1f73c3 100644
+--- a/drivers/scsi/libfc/fc_exch.c
++++ b/drivers/scsi/libfc/fc_exch.c
+@@ -1631,8 +1631,13 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
+ rc = fc_exch_done_locked(ep);
+ WARN_ON(fc_seq_exch(sp) != ep);
+ spin_unlock_bh(&ep->ex_lock);
+- if (!rc)
++ if (!rc) {
+ fc_exch_delete(ep);
++ } else {
++ FC_EXCH_DBG(ep, "ep is completed already,"
++ "hence skip calling the resp\n");
++ goto skip_resp;
++ }
+ }
+
+ /*
+@@ -1651,6 +1656,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
+ if (!fc_invoke_resp(ep, sp, fp))
+ fc_frame_free(fp);
+
++skip_resp:
+ fc_exch_release(ep);
+ return;
+ rel:
+@@ -1907,10 +1913,16 @@ static void fc_exch_reset(struct fc_exch *ep)
+
+ fc_exch_hold(ep);
+
+- if (!rc)
++ if (!rc) {
+ fc_exch_delete(ep);
++ } else {
++ FC_EXCH_DBG(ep, "ep is completed already,"
++ "hence skip calling the resp\n");
++ goto skip_resp;
++ }
+
+ fc_invoke_resp(ep, sp, ERR_PTR(-FC_EX_CLOSED));
++skip_resp:
+ fc_seq_set_resp(sp, NULL, ep->arg);
+ fc_exch_release(ep);
+ }
+diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
+index 4e46fdb2d7c99..2aaf1b7103981 100644
+--- a/drivers/scsi/scsi_transport_srp.c
++++ b/drivers/scsi/scsi_transport_srp.c
+@@ -555,7 +555,14 @@ int srp_reconnect_rport(struct srp_rport *rport)
+ res = mutex_lock_interruptible(&rport->mutex);
+ if (res)
+ goto out;
+- scsi_target_block(&shost->shost_gendev);
++ if (rport->state != SRP_RPORT_FAIL_FAST)
++ /*
++ * sdev state must be SDEV_TRANSPORT_OFFLINE, transition
++ * to SDEV_BLOCK is illegal. Calling scsi_target_unblock()
++ * later is ok though, scsi_internal_device_unblock_nowait()
++ * treats SDEV_TRANSPORT_OFFLINE like SDEV_BLOCK.
++ */
++ scsi_target_block(&shost->shost_gendev);
+ res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV;
+ pr_debug("%s (state %d): transport.reconnect() returned %d\n",
+ dev_name(&shost->shost_gendev), rport->state, res);
+diff --git a/include/linux/kthread.h b/include/linux/kthread.h
+index c1961761311db..72308c38e06c4 100644
+--- a/include/linux/kthread.h
++++ b/include/linux/kthread.h
+@@ -32,6 +32,9 @@ struct task_struct *kthread_create_on_cpu(int (*threadfn)(void *data),
+ unsigned int cpu,
+ const char *namefmt);
+
++void kthread_set_per_cpu(struct task_struct *k, int cpu);
++bool kthread_is_per_cpu(struct task_struct *k);
++
+ /**
+ * kthread_run - create and wake a thread.
+ * @threadfn: the function to run until signal_pending(current).
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index 2eed853ab9cc5..81abfac351272 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -460,11 +460,36 @@ struct task_struct *kthread_create_on_cpu(int (*threadfn)(void *data),
+ return p;
+ kthread_bind(p, cpu);
+ /* CPU hotplug need to bind once again when unparking the thread. */
+- set_bit(KTHREAD_IS_PER_CPU, &to_kthread(p)->flags);
+ to_kthread(p)->cpu = cpu;
+ return p;
+ }
+
++void kthread_set_per_cpu(struct task_struct *k, int cpu)
++{
++ struct kthread *kthread = to_kthread(k);
++ if (!kthread)
++ return;
++
++ WARN_ON_ONCE(!(k->flags & PF_NO_SETAFFINITY));
++
++ if (cpu < 0) {
++ clear_bit(KTHREAD_IS_PER_CPU, &kthread->flags);
++ return;
++ }
++
++ kthread->cpu = cpu;
++ set_bit(KTHREAD_IS_PER_CPU, &kthread->flags);
++}
++
++bool kthread_is_per_cpu(struct task_struct *k)
++{
++ struct kthread *kthread = to_kthread(k);
++ if (!kthread)
++ return false;
++
++ return test_bit(KTHREAD_IS_PER_CPU, &kthread->flags);
++}
++
+ /**
+ * kthread_unpark - unpark a thread created by kthread_create().
+ * @k: thread created by kthread_create().
+diff --git a/kernel/smpboot.c b/kernel/smpboot.c
+index c230c2dd48e19..84c16654d8598 100644
+--- a/kernel/smpboot.c
++++ b/kernel/smpboot.c
+@@ -187,6 +187,7 @@ __smpboot_create_thread(struct smp_hotplug_thread *ht, unsigned int cpu)
+ kfree(td);
+ return PTR_ERR(tsk);
+ }
++ kthread_set_per_cpu(tsk, cpu);
+ /*
+ * Park the thread so that it could start right on the CPU
+ * when it is available.
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 4c4fd4339d330..a5d75bc38eea2 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -68,6 +68,8 @@
+ #include <linux/mount.h>
+ #include <linux/pipe_fs_i.h>
+
++#include "../lib/kstrtox.h"
++
+ #include <linux/uaccess.h>
+ #include <asm/processor.h>
+
+@@ -2069,6 +2071,41 @@ static void proc_skip_char(char **buf, size_t *size, const char v)
+ }
+ }
+
++/**
++ * strtoul_lenient - parse an ASCII formatted integer from a buffer and only
++ * fail on overflow
++ *
++ * @cp: kernel buffer containing the string to parse
++ * @endp: pointer to store the trailing characters
++ * @base: the base to use
++ * @res: where the parsed integer will be stored
++ *
++ * In case of success 0 is returned and @res will contain the parsed integer,
++ * @endp will hold any trailing characters.
++ * This function will fail the parse on overflow. If there wasn't an overflow
++ * the function will defer the decision what characters count as invalid to the
++ * caller.
++ */
++static int strtoul_lenient(const char *cp, char **endp, unsigned int base,
++ unsigned long *res)
++{
++ unsigned long long result;
++ unsigned int rv;
++
++ cp = _parse_integer_fixup_radix(cp, &base);
++ rv = _parse_integer(cp, base, &result);
++ if ((rv & KSTRTOX_OVERFLOW) || (result != (unsigned long)result))
++ return -ERANGE;
++
++ cp += rv;
++
++ if (endp)
++ *endp = (char *)cp;
++
++ *res = (unsigned long)result;
++ return 0;
++}
++
+ #define TMPBUFLEN 22
+ /**
+ * proc_get_long - reads an ASCII formatted integer from a user buffer
+@@ -2112,7 +2149,8 @@ static int proc_get_long(char **buf, size_t *size,
+ if (!isdigit(*p))
+ return -EINVAL;
+
+- *val = simple_strtoul(p, &p, 0);
++ if (strtoul_lenient(p, &p, 0, val))
++ return -EINVAL;
+
+ len = p - tmp;
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index cd98ef48345e1..78600f97ffa72 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1728,12 +1728,6 @@ static void worker_attach_to_pool(struct worker *worker,
+ {
+ mutex_lock(&wq_pool_attach_mutex);
+
+- /*
+- * set_cpus_allowed_ptr() will fail if the cpumask doesn't have any
+- * online CPUs. It'll be re-applied when any of the CPUs come up.
+- */
+- set_cpus_allowed_ptr(worker->task, pool->attrs->cpumask);
+-
+ /*
+ * The wq_pool_attach_mutex ensures %POOL_DISASSOCIATED remains
+ * stable across this function. See the comments above the flag
+@@ -1742,6 +1736,9 @@ static void worker_attach_to_pool(struct worker *worker,
+ if (pool->flags & POOL_DISASSOCIATED)
+ worker->flags |= WORKER_UNBOUND;
+
++ if (worker->rescue_wq)
++ set_cpus_allowed_ptr(worker->task, pool->attrs->cpumask);
++
+ list_add_tail(&worker->node, &pool->workers);
+ worker->pool = pool;
+
+diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
+index e4e442d70c2d0..752744db11ffc 100644
+--- a/net/core/gen_estimator.c
++++ b/net/core/gen_estimator.c
+@@ -84,11 +84,11 @@ static void est_timer(struct timer_list *t)
+ u64 rate, brate;
+
+ est_fetch_counters(est, &b);
+- brate = (b.bytes - est->last_bytes) << (10 - est->ewma_log - est->intvl_log);
+- brate -= (est->avbps >> est->ewma_log);
++ brate = (b.bytes - est->last_bytes) << (10 - est->intvl_log);
++ brate = (brate >> est->ewma_log) - (est->avbps >> est->ewma_log);
+
+- rate = (u64)(b.packets - est->last_packets) << (10 - est->ewma_log - est->intvl_log);
+- rate -= (est->avpps >> est->ewma_log);
++ rate = (u64)(b.packets - est->last_packets) << (10 - est->intvl_log);
++ rate = (rate >> est->ewma_log) - (est->avpps >> est->ewma_log);
+
+ write_seqcount_begin(&est->seq);
+ est->avbps += brate;
+@@ -147,6 +147,9 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
+ if (parm->interval < -2 || parm->interval > 3)
+ return -EINVAL;
+
++ if (parm->ewma_log == 0 || parm->ewma_log >= 31)
++ return -EINVAL;
++
+ est = kzalloc(sizeof(*est), GFP_KERNEL);
+ if (!est)
+ return -ENOBUFS;
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 5e56719f999c4..9e92e5e2336be 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4003,6 +4003,8 @@ void ieee80211_check_fast_rx(struct sta_info *sta)
+
+ rcu_read_lock();
+ key = rcu_dereference(sta->ptk[sta->ptk_idx]);
++ if (!key)
++ key = rcu_dereference(sdata->default_unicast_key);
+ if (key) {
+ switch (key->conf.cipher) {
+ case WLAN_CIPHER_SUITE_TKIP:
+diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
+index b8f3cca8e58b4..264d49fea8142 100644
+--- a/tools/objtool/elf.c
++++ b/tools/objtool/elf.c
+@@ -226,8 +226,11 @@ static int read_symbols(struct elf *elf)
+
+ symtab = find_section_by_name(elf, ".symtab");
+ if (!symtab) {
+- WARN("missing symbol table");
+- return -1;
++ /*
++ * A missing symbol table is actually possible if it's an empty
++ * .o file. This can happen for thunk_64.o.
++ */
++ return 0;
+ }
+
+ symbols_nr = symtab->sh.sh_size / symtab->sh.sh_entsize;
+diff --git a/tools/testing/selftests/powerpc/alignment/alignment_handler.c b/tools/testing/selftests/powerpc/alignment/alignment_handler.c
+index 169a8b9719fb9..4f8335e0c9858 100644
+--- a/tools/testing/selftests/powerpc/alignment/alignment_handler.c
++++ b/tools/testing/selftests/powerpc/alignment/alignment_handler.c
+@@ -384,7 +384,6 @@ int test_alignment_handler_integer(void)
+ LOAD_DFORM_TEST(ldu);
+ LOAD_XFORM_TEST(ldx);
+ LOAD_XFORM_TEST(ldux);
+- LOAD_DFORM_TEST(lmw);
+ STORE_DFORM_TEST(stb);
+ STORE_XFORM_TEST(stbx);
+ STORE_DFORM_TEST(stbu);
+@@ -403,7 +402,11 @@ int test_alignment_handler_integer(void)
+ STORE_XFORM_TEST(stdx);
+ STORE_DFORM_TEST(stdu);
+ STORE_XFORM_TEST(stdux);
++
++#ifdef __BIG_ENDIAN__
++ LOAD_DFORM_TEST(lmw);
+ STORE_DFORM_TEST(stmw);
++#endif
+
+ return rc;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-02-10 10:03 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-02-10 10:03 UTC (permalink / raw
To: gentoo-commits
commit: 153ca76b9b495690dbaad17ca33b97f3d47f40a1
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 10 10:03:11 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Feb 10 10:03:20 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=153ca76b
Linux patch 4.19.175
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1174_linux-4.19.175.patch | 1311 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1315 insertions(+)
diff --git a/0000_README b/0000_README
index 1d2c2d9..d2238ab 100644
--- a/0000_README
+++ b/0000_README
@@ -735,6 +735,10 @@ Patch: 1173_linux-4.19.174.patch
From: https://www.kernel.org
Desc: Linux 4.19.174
+Patch: 1174_linux-4.19.175.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.175
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1174_linux-4.19.175.patch b/1174_linux-4.19.175.patch
new file mode 100644
index 0000000..f2c8762
--- /dev/null
+++ b/1174_linux-4.19.175.patch
@@ -0,0 +1,1311 @@
+diff --git a/Makefile b/Makefile
+index 8f326d0652a73..db37b39fae693 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 174
++SUBLEVEL = 175
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -859,12 +859,6 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=designated-init)
+ # change __FILE__ to the relative path from the srctree
+ KBUILD_CFLAGS += $(call cc-option,-fmacro-prefix-map=$(srctree)/=)
+
+-# ensure -fcf-protection is disabled when using retpoline as it is
+-# incompatible with -mindirect-branch=thunk-extern
+-ifdef CONFIG_RETPOLINE
+-KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
+-endif
+-
+ # use the deterministic mode of AR if available
+ KBUILD_ARFLAGS := $(call ar-option,D)
+
+diff --git a/arch/arm/mach-footbridge/dc21285.c b/arch/arm/mach-footbridge/dc21285.c
+index 16d71bac0061b..2d1f822700a1a 100644
+--- a/arch/arm/mach-footbridge/dc21285.c
++++ b/arch/arm/mach-footbridge/dc21285.c
+@@ -69,15 +69,15 @@ dc21285_read_config(struct pci_bus *bus, unsigned int devfn, int where,
+ if (addr)
+ switch (size) {
+ case 1:
+- asm("ldrb %0, [%1, %2]"
++ asm volatile("ldrb %0, [%1, %2]"
+ : "=r" (v) : "r" (addr), "r" (where) : "cc");
+ break;
+ case 2:
+- asm("ldrh %0, [%1, %2]"
++ asm volatile("ldrh %0, [%1, %2]"
+ : "=r" (v) : "r" (addr), "r" (where) : "cc");
+ break;
+ case 4:
+- asm("ldr %0, [%1, %2]"
++ asm volatile("ldr %0, [%1, %2]"
+ : "=r" (v) : "r" (addr), "r" (where) : "cc");
+ break;
+ }
+@@ -103,17 +103,17 @@ dc21285_write_config(struct pci_bus *bus, unsigned int devfn, int where,
+ if (addr)
+ switch (size) {
+ case 1:
+- asm("strb %0, [%1, %2]"
++ asm volatile("strb %0, [%1, %2]"
+ : : "r" (value), "r" (addr), "r" (where)
+ : "cc");
+ break;
+ case 2:
+- asm("strh %0, [%1, %2]"
++ asm volatile("strh %0, [%1, %2]"
+ : : "r" (value), "r" (addr), "r" (where)
+ : "cc");
+ break;
+ case 4:
+- asm("str %0, [%1, %2]"
++ asm volatile("str %0, [%1, %2]"
+ : : "r" (value), "r" (addr), "r" (where)
+ : "cc");
+ break;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
+index de6af453a6e16..f4eb4d3b6cabf 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
+@@ -303,7 +303,7 @@
+
+ dcfg: dcfg@1ee0000 {
+ compatible = "fsl,ls1046a-dcfg", "syscon";
+- reg = <0x0 0x1ee0000 0x0 0x10000>;
++ reg = <0x0 0x1ee0000 0x0 0x1000>;
+ big-endian;
+ };
+
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 4833dd7e2cc03..0303a243b634e 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -132,6 +132,9 @@ else
+ KBUILD_CFLAGS += -mno-red-zone
+ KBUILD_CFLAGS += -mcmodel=kernel
+
++ # Intel CET isn't enabled in the kernel
++ KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
++
+ # -funit-at-a-time shrinks the kernel .text considerably
+ # unfortunately it makes reading oopses harder.
+ KBUILD_CFLAGS += $(call cc-option,-funit-at-a-time)
+diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
+index cd2aa72e21239..b5354e216b07c 100644
+--- a/arch/x86/include/asm/apic.h
++++ b/arch/x86/include/asm/apic.h
+@@ -190,16 +190,6 @@ static inline void lapic_assign_legacy_vector(unsigned int i, bool r) { }
+ #endif /* !CONFIG_X86_LOCAL_APIC */
+
+ #ifdef CONFIG_X86_X2APIC
+-/*
+- * Make previous memory operations globally visible before
+- * sending the IPI through x2apic wrmsr. We need a serializing instruction or
+- * mfence for this.
+- */
+-static inline void x2apic_wrmsr_fence(void)
+-{
+- asm volatile("mfence" : : : "memory");
+-}
+-
+ static inline void native_apic_msr_write(u32 reg, u32 v)
+ {
+ if (reg == APIC_DFR || reg == APIC_ID || reg == APIC_LDR ||
+diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
+index 84f848c2541a6..dd22cffc6b3fc 100644
+--- a/arch/x86/include/asm/barrier.h
++++ b/arch/x86/include/asm/barrier.h
+@@ -85,4 +85,22 @@ do { \
+
+ #include <asm-generic/barrier.h>
+
++/*
++ * Make previous memory operations globally visible before
++ * a WRMSR.
++ *
++ * MFENCE makes writes visible, but only affects load/store
++ * instructions. WRMSR is unfortunately not a load/store
++ * instruction and is unaffected by MFENCE. The LFENCE ensures
++ * that the WRMSR is not reordered.
++ *
++ * Most WRMSRs are full serializing instructions themselves and
++ * do not require this barrier. This is only required for the
++ * IA32_TSC_DEADLINE and X2APIC MSRs.
++ */
++static inline void weak_wrmsr_fence(void)
++{
++ asm volatile("mfence; lfence" : : : "memory");
++}
++
+ #endif /* _ASM_X86_BARRIER_H */
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index ab8187271d470..e891b33ccfe5f 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -41,6 +41,7 @@
+ #include <asm/x86_init.h>
+ #include <asm/pgalloc.h>
+ #include <linux/atomic.h>
++#include <asm/barrier.h>
+ #include <asm/mpspec.h>
+ #include <asm/i8259.h>
+ #include <asm/proto.h>
+@@ -465,6 +466,9 @@ static int lapic_next_deadline(unsigned long delta,
+ {
+ u64 tsc;
+
++ /* This MSR is special and need a special fence: */
++ weak_wrmsr_fence();
++
+ tsc = rdtsc();
+ wrmsrl(MSR_IA32_TSC_DEADLINE, tsc + (((u64) delta) * TSC_DIVISOR));
+ return 0;
+diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
+index 145517934171e..b2c7e3bc55d22 100644
+--- a/arch/x86/kernel/apic/x2apic_cluster.c
++++ b/arch/x86/kernel/apic/x2apic_cluster.c
+@@ -31,7 +31,8 @@ static void x2apic_send_IPI(int cpu, int vector)
+ {
+ u32 dest = per_cpu(x86_cpu_to_logical_apicid, cpu);
+
+- x2apic_wrmsr_fence();
++ /* x2apic MSRs are special and need a special fence: */
++ weak_wrmsr_fence();
+ __x2apic_send_IPI_dest(dest, vector, APIC_DEST_LOGICAL);
+ }
+
+@@ -43,7 +44,8 @@ __x2apic_send_IPI_mask(const struct cpumask *mask, int vector, int apic_dest)
+ unsigned long flags;
+ u32 dest;
+
+- x2apic_wrmsr_fence();
++ /* x2apic MSRs are special and need a special fence: */
++ weak_wrmsr_fence();
+ local_irq_save(flags);
+
+ tmpmsk = this_cpu_cpumask_var_ptr(ipi_mask);
+diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
+index ed56d2850e96a..8e70c2ba21b3d 100644
+--- a/arch/x86/kernel/apic/x2apic_phys.c
++++ b/arch/x86/kernel/apic/x2apic_phys.c
+@@ -48,7 +48,8 @@ static void x2apic_send_IPI(int cpu, int vector)
+ {
+ u32 dest = per_cpu(x86_cpu_to_apicid, cpu);
+
+- x2apic_wrmsr_fence();
++ /* x2apic MSRs are special and need a special fence: */
++ weak_wrmsr_fence();
+ __x2apic_send_IPI_dest(dest, vector, APIC_DEST_PHYSICAL);
+ }
+
+@@ -59,7 +60,8 @@ __x2apic_send_IPI_mask(const struct cpumask *mask, int vector, int apic_dest)
+ unsigned long this_cpu;
+ unsigned long flags;
+
+- x2apic_wrmsr_fence();
++ /* x2apic MSRs are special and need a special fence: */
++ weak_wrmsr_fence();
+
+ local_irq_save(flags);
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index d2dc734f5bd0d..f1e86051aa5f3 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -892,6 +892,11 @@ static int has_svm(void)
+ return 0;
+ }
+
++ if (sev_active()) {
++ pr_info("KVM is unsupported when running as an SEV guest\n");
++ return 0;
++ }
++
+ return 1;
+ }
+
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index ee3ff0894d093..ef4e8423843f3 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -229,9 +229,17 @@ static const struct xpad_device {
+ { 0x0e6f, 0x0213, "Afterglow Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE },
+- { 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x02a0, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x02a1, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x02a2, "PDP Wired Controller for Xbox One - Crimson Red", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x02a4, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x02a6, "PDP Wired Controller for Xbox One - Camo Series", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x02a7, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x02a8, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x02ad, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x02b3, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
++ { 0x0e6f, 0x02b8, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 },
+ { 0x0e6f, 0x0346, "Rock Candy Gamepad for Xbox One 2016", 0, XTYPE_XBOXONE },
+ { 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 },
+@@ -310,6 +318,9 @@ static const struct xpad_device {
+ { 0x1bad, 0xfa01, "MadCatz GamePad", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 },
++ { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE },
++ { 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 },
++ { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
+ { 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5303, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
+@@ -443,8 +454,12 @@ static const struct usb_device_id xpad_table[] = {
+ XPAD_XBOX360_VENDOR(0x162e), /* Joytech X-Box 360 controllers */
+ XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */
+ XPAD_XBOX360_VENDOR(0x1bad), /* Harminix Rock Band Guitar and Drums */
++ XPAD_XBOX360_VENDOR(0x20d6), /* PowerA Controllers */
++ XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA Controllers */
+ XPAD_XBOX360_VENDOR(0x24c6), /* PowerA Controllers */
+ XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA Controllers */
++ XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Duke X-Box One pad */
++ XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */
+ { }
+ };
+
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index b256e3006a6fb..844875df8cad7 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -223,6 +223,8 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "PEGATRON CORPORATION"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "C15B"),
+ },
++ },
++ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ByteSpeed LLC"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "ByteSpeed Laptop C15B"),
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 2a83fc31dd47a..d2166dfc8b3f8 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3364,6 +3364,12 @@ static int __init init_dmars(void)
+
+ if (!ecap_pass_through(iommu->ecap))
+ hw_pass_through = 0;
++
++ if (!intel_iommu_strict && cap_caching_mode(iommu->cap)) {
++ pr_info("Disable batched IOTLB flush due to virtualization");
++ intel_iommu_strict = 1;
++ }
++
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+ if (pasid_enabled(iommu))
+ intel_svm_init(iommu);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 80ca13594c182..09f0d8e70b709 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -474,8 +474,10 @@ static void md_submit_flush_data(struct work_struct *ws)
+ * could wait for this and below md_handle_request could wait for those
+ * bios because of suspend check
+ */
++ spin_lock_irq(&mddev->lock);
+ mddev->last_flush = mddev->start_flush;
+ mddev->flush_bio = NULL;
++ spin_unlock_irq(&mddev->lock);
+ wake_up(&mddev->sb_wait);
+
+ if (bio->bi_iter.bi_size == 0) {
+diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
+index 2ca5cd79018b4..dca72444b3122 100644
+--- a/drivers/mmc/core/sdio_cis.c
++++ b/drivers/mmc/core/sdio_cis.c
+@@ -24,6 +24,8 @@
+ #include "sdio_cis.h"
+ #include "sdio_ops.h"
+
++#define SDIO_READ_CIS_TIMEOUT_MS (10 * 1000) /* 10s */
++
+ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
+ const unsigned char *buf, unsigned size)
+ {
+@@ -270,6 +272,8 @@ static int sdio_read_cis(struct mmc_card *card, struct sdio_func *func)
+
+ do {
+ unsigned char tpl_code, tpl_link;
++ unsigned long timeout = jiffies +
++ msecs_to_jiffies(SDIO_READ_CIS_TIMEOUT_MS);
+
+ ret = mmc_io_rw_direct(card, 0, 0, ptr++, 0, &tpl_code);
+ if (ret)
+@@ -322,6 +326,8 @@ static int sdio_read_cis(struct mmc_card *card, struct sdio_func *func)
+ prev = &this->next;
+
+ if (ret == -ENOENT) {
++ if (time_after(jiffies, timeout))
++ break;
+ /* warn about unknown tuples */
+ pr_warn_ratelimited("%s: queuing unknown"
+ " CIS tuple 0x%02x (%u bytes)\n",
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 6fa8aa69b4180..e04b7fa068aff 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -1658,7 +1658,11 @@ static int mv88e6xxx_port_db_load_purge(struct mv88e6xxx_chip *chip, int port,
+ if (!entry.portvec)
+ entry.state = MV88E6XXX_G1_ATU_DATA_STATE_UNUSED;
+ } else {
+- entry.portvec |= BIT(port);
++ if (state == MV88E6XXX_G1_ATU_DATA_STATE_UC_STATIC)
++ entry.portvec = BIT(port);
++ else
++ entry.portvec |= BIT(port);
++
+ entry.state = state;
+ }
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+index a30eb90ba3d28..dd590086fe6a5 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -29,16 +29,16 @@ static int mvpp2_prs_hw_write(struct mvpp2 *priv, struct mvpp2_prs_entry *pe)
+ /* Clear entry invalidation bit */
+ pe->tcam[MVPP2_PRS_TCAM_INV_WORD] &= ~MVPP2_PRS_TCAM_INV_MASK;
+
+- /* Write tcam index - indirect access */
+- mvpp2_write(priv, MVPP2_PRS_TCAM_IDX_REG, pe->index);
+- for (i = 0; i < MVPP2_PRS_TCAM_WORDS; i++)
+- mvpp2_write(priv, MVPP2_PRS_TCAM_DATA_REG(i), pe->tcam[i]);
+-
+ /* Write sram index - indirect access */
+ mvpp2_write(priv, MVPP2_PRS_SRAM_IDX_REG, pe->index);
+ for (i = 0; i < MVPP2_PRS_SRAM_WORDS; i++)
+ mvpp2_write(priv, MVPP2_PRS_SRAM_DATA_REG(i), pe->sram[i]);
+
++ /* Write tcam index - indirect access */
++ mvpp2_write(priv, MVPP2_PRS_TCAM_IDX_REG, pe->index);
++ for (i = 0; i < MVPP2_PRS_TCAM_WORDS; i++)
++ mvpp2_write(priv, MVPP2_PRS_TCAM_DATA_REG(i), pe->tcam[i]);
++
+ return 0;
+ }
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index a52b2f15f372a..82d87d2e280c2 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2733,6 +2733,8 @@ static const struct pci_device_id nvme_id_table[] = {
+ { PCI_DEVICE(0x1d1d, 0x2601), /* CNEX Granby */
+ .driver_data = NVME_QUIRK_LIGHTNVM, },
+ { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
++ { PCI_DEVICE(0x2646, 0x2263), /* KINGSTON A2000 NVMe SSD */
++ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, },
+ { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
+ { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) },
+ { 0, }
+diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
+index 5c00d79ac7a10..c9560d8ba3cb1 100644
+--- a/drivers/usb/class/usblp.c
++++ b/drivers/usb/class/usblp.c
+@@ -1327,14 +1327,17 @@ static int usblp_set_protocol(struct usblp *usblp, int protocol)
+ if (protocol < USBLP_FIRST_PROTOCOL || protocol > USBLP_LAST_PROTOCOL)
+ return -EINVAL;
+
+- alts = usblp->protocol[protocol].alt_setting;
+- if (alts < 0)
+- return -EINVAL;
+- r = usb_set_interface(usblp->dev, usblp->ifnum, alts);
+- if (r < 0) {
+- printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n",
+- alts, usblp->ifnum);
+- return r;
++ /* Don't unnecessarily set the interface if there's a single alt. */
++ if (usblp->intf->num_altsetting > 1) {
++ alts = usblp->protocol[protocol].alt_setting;
++ if (alts < 0)
++ return -EINVAL;
++ r = usb_set_interface(usblp->dev, usblp->ifnum, alts);
++ if (r < 0) {
++ printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n",
++ alts, usblp->ifnum);
++ return r;
++ }
+ }
+
+ usblp->bidir = (usblp->protocol[protocol].epread != NULL);
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 8e98b4df9b109..42f66718bc184 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -1453,7 +1453,6 @@ static void dwc2_hsotg_complete_oursetup(struct usb_ep *ep,
+ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
+ u32 windex)
+ {
+- struct dwc2_hsotg_ep *ep;
+ int dir = (windex & USB_DIR_IN) ? 1 : 0;
+ int idx = windex & 0x7F;
+
+@@ -1463,12 +1462,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
+ if (idx > hsotg->num_of_eps)
+ return NULL;
+
+- ep = index_to_ep(hsotg, idx, dir);
+-
+- if (idx && ep->dir_in != dir)
+- return NULL;
+-
+- return ep;
++ return index_to_ep(hsotg, idx, dir);
+ }
+
+ /**
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 86b1cfbe48a08..e890c26b6c826 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1700,7 +1700,7 @@ static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)
+ if (PMSG_IS_AUTO(msg))
+ break;
+
+- ret = dwc3_core_init(dwc);
++ ret = dwc3_core_init_for_resume(dwc);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/usb/gadget/legacy/ether.c b/drivers/usb/gadget/legacy/ether.c
+index 30313b233680d..99c7fc0d1d597 100644
+--- a/drivers/usb/gadget/legacy/ether.c
++++ b/drivers/usb/gadget/legacy/ether.c
+@@ -403,8 +403,10 @@ static int eth_bind(struct usb_composite_dev *cdev)
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto fail1;
++ }
+ usb_otg_descriptor_init(gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 537bbcd47c463..22b1de99d02d1 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -670,11 +670,16 @@ static void xhci_unmap_td_bounce_buffer(struct xhci_hcd *xhci,
+ dma_unmap_single(dev, seg->bounce_dma, ring->bounce_buf_len,
+ DMA_FROM_DEVICE);
+ /* for in tranfers we need to copy the data from bounce to sg */
+- len = sg_pcopy_from_buffer(urb->sg, urb->num_sgs, seg->bounce_buf,
+- seg->bounce_len, seg->bounce_offs);
+- if (len != seg->bounce_len)
+- xhci_warn(xhci, "WARN Wrong bounce buffer read length: %zu != %d\n",
+- len, seg->bounce_len);
++ if (urb->num_sgs) {
++ len = sg_pcopy_from_buffer(urb->sg, urb->num_sgs, seg->bounce_buf,
++ seg->bounce_len, seg->bounce_offs);
++ if (len != seg->bounce_len)
++ xhci_warn(xhci, "WARN Wrong bounce buffer read length: %zu != %d\n",
++ len, seg->bounce_len);
++ } else {
++ memcpy(urb->transfer_buffer + seg->bounce_offs, seg->bounce_buf,
++ seg->bounce_len);
++ }
+ seg->bounce_len = 0;
+ seg->bounce_offs = 0;
+ }
+@@ -3180,12 +3185,16 @@ static int xhci_align_td(struct xhci_hcd *xhci, struct urb *urb, u32 enqd_len,
+
+ /* create a max max_pkt sized bounce buffer pointed to by last trb */
+ if (usb_urb_dir_out(urb)) {
+- len = sg_pcopy_to_buffer(urb->sg, urb->num_sgs,
+- seg->bounce_buf, new_buff_len, enqd_len);
+- if (len != new_buff_len)
+- xhci_warn(xhci,
+- "WARN Wrong bounce buffer write length: %zu != %d\n",
+- len, new_buff_len);
++ if (urb->num_sgs) {
++ len = sg_pcopy_to_buffer(urb->sg, urb->num_sgs,
++ seg->bounce_buf, new_buff_len, enqd_len);
++ if (len != new_buff_len)
++ xhci_warn(xhci, "WARN Wrong bounce buffer write length: %zu != %d\n",
++ len, new_buff_len);
++ } else {
++ memcpy(seg->bounce_buf, urb->transfer_buffer + enqd_len, new_buff_len);
++ }
++
+ seg->bounce_dma = dma_map_single(dev, seg->bounce_buf,
+ max_pkt, DMA_TO_DEVICE);
+ } else {
+diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
+index aeb53ec5cc6ab..6b92a57382db3 100644
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -126,6 +126,7 @@ struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt)
+ }
+
+ usbhs_pipe_clear_without_sequence(pipe, 0, 0);
++ usbhs_pipe_running(pipe, 0);
+
+ __usbhsf_pkt_del(pkt);
+ }
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 46ec30a2c5168..07a2c72fc3a71 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -61,6 +61,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
+ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
++ { USB_DEVICE(0x0988, 0x0578) }, /* Teraoka AD2000 */
+ { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */
+ { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
+ { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */
+@@ -201,6 +202,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */
+ { USB_DEVICE(0x1901, 0x0195) }, /* GE B850/B650/B450 CP2104 DP UART interface */
+ { USB_DEVICE(0x1901, 0x0196) }, /* GE B850 CP2105 DP UART interface */
++ { USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */
+ { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 1024aca252210..cdf25a39fca79 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -425,6 +425,8 @@ static void option_instat_callback(struct urb *urb);
+ #define CINTERION_PRODUCT_AHXX_2RMNET 0x0084
+ #define CINTERION_PRODUCT_AHXX_AUDIO 0x0085
+ #define CINTERION_PRODUCT_CLS8 0x00b0
++#define CINTERION_PRODUCT_MV31_MBIM 0x00b3
++#define CINTERION_PRODUCT_MV31_RMNET 0x00b7
+
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID 0x0b3c
+@@ -1914,6 +1916,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_MBIM, 0xff),
++ .driver_info = RSVD(3)},
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_RMNET, 0xff),
++ .driver_info = RSVD(0)},
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
+ .driver_info = RSVD(4) },
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
+diff --git a/fs/afs/main.c b/fs/afs/main.c
+index 107427688eddd..8ecb127be63f9 100644
+--- a/fs/afs/main.c
++++ b/fs/afs/main.c
+@@ -190,7 +190,7 @@ static int __init afs_init(void)
+ goto error_cache;
+ #endif
+
+- ret = register_pernet_subsys(&afs_net_ops);
++ ret = register_pernet_device(&afs_net_ops);
+ if (ret < 0)
+ goto error_net;
+
+@@ -210,7 +210,7 @@ static int __init afs_init(void)
+ error_proc:
+ afs_fs_exit();
+ error_fs:
+- unregister_pernet_subsys(&afs_net_ops);
++ unregister_pernet_device(&afs_net_ops);
+ error_net:
+ #ifdef CONFIG_AFS_FSCACHE
+ fscache_unregister_netfs(&afs_cache_netfs);
+@@ -241,7 +241,7 @@ static void __exit afs_exit(void)
+
+ proc_remove(afs_proc_symlink);
+ afs_fs_exit();
+- unregister_pernet_subsys(&afs_net_ops);
++ unregister_pernet_device(&afs_net_ops);
+ #ifdef CONFIG_AFS_FSCACHE
+ fscache_unregister_netfs(&afs_cache_netfs);
+ #endif
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index f6e3c00898254..c7e162c9383dc 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -840,6 +840,7 @@ static int
+ cifs_d_revalidate(struct dentry *direntry, unsigned int flags)
+ {
+ struct inode *inode;
++ int rc;
+
+ if (flags & LOOKUP_RCU)
+ return -ECHILD;
+@@ -849,8 +850,25 @@ cifs_d_revalidate(struct dentry *direntry, unsigned int flags)
+ if ((flags & LOOKUP_REVAL) && !CIFS_CACHE_READ(CIFS_I(inode)))
+ CIFS_I(inode)->time = 0; /* force reval */
+
+- if (cifs_revalidate_dentry(direntry))
+- return 0;
++ rc = cifs_revalidate_dentry(direntry);
++ if (rc) {
++ cifs_dbg(FYI, "cifs_revalidate_dentry failed with rc=%d", rc);
++ switch (rc) {
++ case -ENOENT:
++ case -ESTALE:
++ /*
++ * Those errors mean the dentry is invalid
++ * (file was deleted or recreated)
++ */
++ return 0;
++ default:
++ /*
++ * Otherwise some unexpected error happened
++ * report it as-is to VFS layer
++ */
++ return rc;
++ }
++ }
+ else {
+ /*
+ * If the inode wasn't known to be a dfs entry when
+diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
+index 48ed43e6aee84..8a44d59947b70 100644
+--- a/fs/cifs/smb2pdu.h
++++ b/fs/cifs/smb2pdu.h
+@@ -222,7 +222,7 @@ struct smb2_negotiate_req {
+ __le32 NegotiateContextOffset; /* SMB3.1.1 only. MBZ earlier */
+ __le16 NegotiateContextCount; /* SMB3.1.1 only. MBZ earlier */
+ __le16 Reserved2;
+- __le16 Dialects[1]; /* One dialect (vers=) at a time for now */
++ __le16 Dialects[4]; /* BB expand this if autonegotiate > 4 dialects */
+ } __packed;
+
+ /* Dialects */
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 7a24f91af29e4..3a2fea8d211d7 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -654,9 +654,10 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
+
+ mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+
++ set_page_huge_active(page);
+ /*
+ * unlock_page because locked by add_to_page_cache()
+- * page_put due to reference from alloc_huge_page()
++ * put_page() due to reference from alloc_huge_page()
+ */
+ unlock_page(page);
+ put_page(page);
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 800bcad67325c..25be2ab6ff6cc 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -946,8 +946,8 @@ static char *ovl_get_redirect(struct dentry *dentry, bool abs_redirect)
+
+ buflen -= thislen;
+ memcpy(&buf[buflen], name, thislen);
+- tmp = dget_dlock(d->d_parent);
+ spin_unlock(&d->d_lock);
++ tmp = dget_parent(d);
+
+ dput(d);
+ d = tmp;
+diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h
+index 4cad0e784b286..b81f9e1d74b0a 100644
+--- a/include/linux/elfcore.h
++++ b/include/linux/elfcore.h
+@@ -58,6 +58,7 @@ static inline int elf_core_copy_task_xfpregs(struct task_struct *t, elf_fpxregse
+ }
+ #endif
+
++#if defined(CONFIG_UM) || defined(CONFIG_IA64)
+ /*
+ * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out
+ * extra segments containing the gate DSO contents. Dumping its
+@@ -72,5 +73,26 @@ elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset);
+ extern int
+ elf_core_write_extra_data(struct coredump_params *cprm);
+ extern size_t elf_core_extra_data_size(void);
++#else
++static inline Elf_Half elf_core_extra_phdrs(void)
++{
++ return 0;
++}
++
++static inline int elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset)
++{
++ return 1;
++}
++
++static inline int elf_core_write_extra_data(struct coredump_params *cprm)
++{
++ return 1;
++}
++
++static inline size_t elf_core_extra_data_size(void)
++{
++ return 0;
++}
++#endif
+
+ #endif /* _LINUX_ELFCORE_H */
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index d34112fb3d526..cae7fd6804488 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -541,6 +541,9 @@ static inline void set_huge_swap_pte_at(struct mm_struct *mm, unsigned long addr
+ set_huge_pte_at(mm, addr, ptep, pte);
+ }
+ #endif
++
++void set_page_huge_active(struct page *page);
++
+ #else /* CONFIG_HUGETLB_PAGE */
+ struct hstate {};
+ #define alloc_huge_page(v, a, r) NULL
+diff --git a/include/linux/msi.h b/include/linux/msi.h
+index be8ec813dbfb2..5dd171849a27e 100644
+--- a/include/linux/msi.h
++++ b/include/linux/msi.h
+@@ -118,6 +118,12 @@ struct msi_desc {
+ list_for_each_entry((desc), dev_to_msi_list((dev)), list)
+ #define for_each_msi_entry_safe(desc, tmp, dev) \
+ list_for_each_entry_safe((desc), (tmp), dev_to_msi_list((dev)), list)
++#define for_each_msi_vector(desc, __irq, dev) \
++ for_each_msi_entry((desc), (dev)) \
++ if ((desc)->irq) \
++ for (__irq = (desc)->irq; \
++ __irq < ((desc)->irq + (desc)->nvec_used); \
++ __irq++)
+
+ #ifdef CONFIG_PCI_MSI
+ #define first_pci_msi_entry(pdev) first_msi_entry(&(pdev)->dev)
+diff --git a/kernel/Makefile b/kernel/Makefile
+index ad4b324d89061..01bc1d39b400a 100644
+--- a/kernel/Makefile
++++ b/kernel/Makefile
+@@ -92,7 +92,6 @@ obj-$(CONFIG_TASK_DELAY_ACCT) += delayacct.o
+ obj-$(CONFIG_TASKSTATS) += taskstats.o tsacct.o
+ obj-$(CONFIG_TRACEPOINTS) += tracepoint.o
+ obj-$(CONFIG_LATENCYTOP) += latencytop.o
+-obj-$(CONFIG_ELFCORE) += elfcore.o
+ obj-$(CONFIG_FUNCTION_TRACER) += trace/
+ obj-$(CONFIG_TRACING) += trace/
+ obj-$(CONFIG_TRACE_CLOCK) += trace/
+diff --git a/kernel/elfcore.c b/kernel/elfcore.c
+deleted file mode 100644
+index 57fb4dcff4349..0000000000000
+--- a/kernel/elfcore.c
++++ /dev/null
+@@ -1,26 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-#include <linux/elf.h>
+-#include <linux/fs.h>
+-#include <linux/mm.h>
+-#include <linux/binfmts.h>
+-#include <linux/elfcore.h>
+-
+-Elf_Half __weak elf_core_extra_phdrs(void)
+-{
+- return 0;
+-}
+-
+-int __weak elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset)
+-{
+- return 1;
+-}
+-
+-int __weak elf_core_write_extra_data(struct coredump_params *cprm)
+-{
+- return 1;
+-}
+-
+-size_t __weak elf_core_extra_data_size(void)
+-{
+- return 0;
+-}
+diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
+index dc1186ce3ecdb..604974f2afb19 100644
+--- a/kernel/irq/msi.c
++++ b/kernel/irq/msi.c
+@@ -437,22 +437,22 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
+
+ can_reserve = msi_check_reservation_mode(domain, info, dev);
+
+- for_each_msi_entry(desc, dev) {
+- virq = desc->irq;
+- if (desc->nvec_used == 1)
+- dev_dbg(dev, "irq %d for MSI\n", virq);
+- else
++ /*
++ * This flag is set by the PCI layer as we need to activate
++ * the MSI entries before the PCI layer enables MSI in the
++ * card. Otherwise the card latches a random msi message.
++ */
++ if (!(info->flags & MSI_FLAG_ACTIVATE_EARLY))
++ goto skip_activate;
++
++ for_each_msi_vector(desc, i, dev) {
++ if (desc->irq == i) {
++ virq = desc->irq;
+ dev_dbg(dev, "irq [%d-%d] for MSI\n",
+ virq, virq + desc->nvec_used - 1);
+- /*
+- * This flag is set by the PCI layer as we need to activate
+- * the MSI entries before the PCI layer enables MSI in the
+- * card. Otherwise the card latches a random msi message.
+- */
+- if (!(info->flags & MSI_FLAG_ACTIVATE_EARLY))
+- continue;
++ }
+
+- irq_data = irq_domain_get_irq_data(domain, desc->irq);
++ irq_data = irq_domain_get_irq_data(domain, i);
+ if (!can_reserve) {
+ irqd_clr_can_reserve(irq_data);
+ if (domain->flags & IRQ_DOMAIN_MSI_NOMASK_QUIRK)
+@@ -463,28 +463,24 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
+ goto cleanup;
+ }
+
++skip_activate:
+ /*
+ * If these interrupts use reservation mode, clear the activated bit
+ * so request_irq() will assign the final vector.
+ */
+ if (can_reserve) {
+- for_each_msi_entry(desc, dev) {
+- irq_data = irq_domain_get_irq_data(domain, desc->irq);
++ for_each_msi_vector(desc, i, dev) {
++ irq_data = irq_domain_get_irq_data(domain, i);
+ irqd_clr_activated(irq_data);
+ }
+ }
+ return 0;
+
+ cleanup:
+- for_each_msi_entry(desc, dev) {
+- struct irq_data *irqd;
+-
+- if (desc->irq == virq)
+- break;
+-
+- irqd = irq_domain_get_irq_data(domain, desc->irq);
+- if (irqd_is_activated(irqd))
+- irq_domain_deactivate_irq(irqd);
++ for_each_msi_vector(desc, i, dev) {
++ irq_data = irq_domain_get_irq_data(domain, i);
++ if (irqd_is_activated(irq_data))
++ irq_domain_deactivate_irq(irq_data);
+ }
+ msi_domain_free_irqs(domain, dev);
+ return ret;
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 2161f519d4812..6d02b78fde01e 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1945,6 +1945,10 @@ int register_kretprobe(struct kretprobe *rp)
+ if (!kprobe_on_func_entry(rp->kp.addr, rp->kp.symbol_name, rp->kp.offset))
+ return -EINVAL;
+
++ /* If only rp->kp.addr is specified, check reregistering kprobes */
++ if (rp->kp.addr && check_kprobe_rereg(&rp->kp))
++ return -EINVAL;
++
+ if (kretprobe_blacklist_size) {
+ addr = kprobe_addr(&rp->kp);
+ if (IS_ERR(addr))
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index d74afc256c07c..cf9e2bbffdc1a 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2278,7 +2278,7 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
+ spinlock_t *ptl;
+ struct mm_struct *mm = vma->vm_mm;
+ unsigned long haddr = address & HPAGE_PMD_MASK;
+- bool was_locked = false;
++ bool do_unlock_page = false;
+ pmd_t _pmd;
+
+ mmu_notifier_invalidate_range_start(mm, haddr, haddr + HPAGE_PMD_SIZE);
+@@ -2291,7 +2291,6 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
+ VM_BUG_ON(freeze && !page);
+ if (page) {
+ VM_WARN_ON_ONCE(!PageLocked(page));
+- was_locked = true;
+ if (page != pmd_page(*pmd))
+ goto out;
+ }
+@@ -2300,19 +2299,29 @@ repeat:
+ if (pmd_trans_huge(*pmd)) {
+ if (!page) {
+ page = pmd_page(*pmd);
+- if (unlikely(!trylock_page(page))) {
+- get_page(page);
+- _pmd = *pmd;
+- spin_unlock(ptl);
+- lock_page(page);
+- spin_lock(ptl);
+- if (unlikely(!pmd_same(*pmd, _pmd))) {
+- unlock_page(page);
++ /*
++ * An anonymous page must be locked, to ensure that a
++ * concurrent reuse_swap_page() sees stable mapcount;
++ * but reuse_swap_page() is not used on shmem or file,
++ * and page lock must not be taken when zap_pmd_range()
++ * calls __split_huge_pmd() while i_mmap_lock is held.
++ */
++ if (PageAnon(page)) {
++ if (unlikely(!trylock_page(page))) {
++ get_page(page);
++ _pmd = *pmd;
++ spin_unlock(ptl);
++ lock_page(page);
++ spin_lock(ptl);
++ if (unlikely(!pmd_same(*pmd, _pmd))) {
++ unlock_page(page);
++ put_page(page);
++ page = NULL;
++ goto repeat;
++ }
+ put_page(page);
+- page = NULL;
+- goto repeat;
+ }
+- put_page(page);
++ do_unlock_page = true;
+ }
+ }
+ if (PageMlocked(page))
+@@ -2322,7 +2331,7 @@ repeat:
+ __split_huge_pmd_locked(vma, pmd, haddr, freeze);
+ out:
+ spin_unlock(ptl);
+- if (!was_locked && page)
++ if (do_unlock_page)
+ unlock_page(page);
+ /*
+ * No need to double call mmu_notifier->invalidate_range() callback.
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 0b60ab3966968..df89aed023029 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -68,6 +68,21 @@ DEFINE_SPINLOCK(hugetlb_lock);
+ static int num_fault_mutexes;
+ struct mutex *hugetlb_fault_mutex_table ____cacheline_aligned_in_smp;
+
++static inline bool PageHugeFreed(struct page *head)
++{
++ return page_private(head + 4) == -1UL;
++}
++
++static inline void SetPageHugeFreed(struct page *head)
++{
++ set_page_private(head + 4, -1UL);
++}
++
++static inline void ClearPageHugeFreed(struct page *head)
++{
++ set_page_private(head + 4, 0);
++}
++
+ /* Forward declaration */
+ static int hugetlb_acct_memory(struct hstate *h, long delta);
+
+@@ -858,6 +873,7 @@ static void enqueue_huge_page(struct hstate *h, struct page *page)
+ list_move(&page->lru, &h->hugepage_freelists[nid]);
+ h->free_huge_pages++;
+ h->free_huge_pages_node[nid]++;
++ SetPageHugeFreed(page);
+ }
+
+ static struct page *dequeue_huge_page_node_exact(struct hstate *h, int nid)
+@@ -875,6 +891,7 @@ static struct page *dequeue_huge_page_node_exact(struct hstate *h, int nid)
+ return NULL;
+ list_move(&page->lru, &h->hugepage_activelist);
+ set_page_refcounted(page);
++ ClearPageHugeFreed(page);
+ h->free_huge_pages--;
+ h->free_huge_pages_node[nid]--;
+ return page;
+@@ -1196,12 +1213,11 @@ struct hstate *size_to_hstate(unsigned long size)
+ */
+ bool page_huge_active(struct page *page)
+ {
+- VM_BUG_ON_PAGE(!PageHuge(page), page);
+- return PageHead(page) && PagePrivate(&page[1]);
++ return PageHeadHuge(page) && PagePrivate(&page[1]);
+ }
+
+ /* never called for tail page */
+-static void set_page_huge_active(struct page *page)
++void set_page_huge_active(struct page *page)
+ {
+ VM_BUG_ON_PAGE(!PageHeadHuge(page), page);
+ SetPagePrivate(&page[1]);
+@@ -1305,6 +1321,7 @@ static void prep_new_huge_page(struct hstate *h, struct page *page, int nid)
+ set_hugetlb_cgroup(page, NULL);
+ h->nr_huge_pages++;
+ h->nr_huge_pages_node[nid]++;
++ ClearPageHugeFreed(page);
+ spin_unlock(&hugetlb_lock);
+ }
+
+@@ -1500,6 +1517,7 @@ int dissolve_free_huge_page(struct page *page)
+ {
+ int rc = -EBUSY;
+
++retry:
+ /* Not to disrupt normal path by vainly holding hugetlb_lock */
+ if (!PageHuge(page))
+ return 0;
+@@ -1516,6 +1534,26 @@ int dissolve_free_huge_page(struct page *page)
+ int nid = page_to_nid(head);
+ if (h->free_huge_pages - h->resv_huge_pages == 0)
+ goto out;
++
++ /*
++ * We should make sure that the page is already on the free list
++ * when it is dissolved.
++ */
++ if (unlikely(!PageHugeFreed(head))) {
++ spin_unlock(&hugetlb_lock);
++ cond_resched();
++
++ /*
++ * Theoretically, we should return -EBUSY when we
++ * encounter this race. In fact, we have a chance
++ * to successfully dissolve the page if we do a
++ * retry. Because the race window is quite small.
++ * If we seize this opportunity, it is an optimization
++ * for increasing the success rate of dissolving page.
++ */
++ goto retry;
++ }
++
+ /*
+ * Move PageHWPoison flag from head page to the raw error page,
+ * which makes any subpages rather than the error page reusable.
+@@ -4940,9 +4978,9 @@ bool isolate_huge_page(struct page *page, struct list_head *list)
+ {
+ bool ret = true;
+
+- VM_BUG_ON_PAGE(!PageHead(page), page);
+ spin_lock(&hugetlb_lock);
+- if (!page_huge_active(page) || !get_page_unless_zero(page)) {
++ if (!PageHeadHuge(page) || !page_huge_active(page) ||
++ !get_page_unless_zero(page)) {
+ ret = false;
+ goto unlock;
+ }
+diff --git a/mm/memblock.c b/mm/memblock.c
+index bb4e32c6b19e9..4f7c5c3c442c3 100644
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -234,14 +234,6 @@ __memblock_find_range_top_down(phys_addr_t start, phys_addr_t end,
+ *
+ * Find @size free area aligned to @align in the specified range and node.
+ *
+- * When allocation direction is bottom-up, the @start should be greater
+- * than the end of the kernel image. Otherwise, it will be trimmed. The
+- * reason is that we want the bottom-up allocation just near the kernel
+- * image so it is highly likely that the allocated memory and the kernel
+- * will reside in the same node.
+- *
+- * If bottom-up allocation failed, will try to allocate memory top-down.
+- *
+ * Return:
+ * Found address on success, 0 on failure.
+ */
+@@ -250,8 +242,6 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t size,
+ phys_addr_t end, int nid,
+ enum memblock_flags flags)
+ {
+- phys_addr_t kernel_end, ret;
+-
+ /* pump up @end */
+ if (end == MEMBLOCK_ALLOC_ACCESSIBLE)
+ end = memblock.current_limit;
+@@ -259,40 +249,13 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t size,
+ /* avoid allocating the first page */
+ start = max_t(phys_addr_t, start, PAGE_SIZE);
+ end = max(start, end);
+- kernel_end = __pa_symbol(_end);
+-
+- /*
+- * try bottom-up allocation only when bottom-up mode
+- * is set and @end is above the kernel image.
+- */
+- if (memblock_bottom_up() && end > kernel_end) {
+- phys_addr_t bottom_up_start;
+-
+- /* make sure we will allocate above the kernel */
+- bottom_up_start = max(start, kernel_end);
+
+- /* ok, try bottom-up allocation first */
+- ret = __memblock_find_range_bottom_up(bottom_up_start, end,
+- size, align, nid, flags);
+- if (ret)
+- return ret;
+-
+- /*
+- * we always limit bottom-up allocation above the kernel,
+- * but top-down allocation doesn't have the limit, so
+- * retrying top-down allocation may succeed when bottom-up
+- * allocation failed.
+- *
+- * bottom-up allocation is expected to be fail very rarely,
+- * so we use WARN_ONCE() here to see the stack trace if
+- * fail happens.
+- */
+- WARN_ONCE(IS_ENABLED(CONFIG_MEMORY_HOTREMOVE),
+- "memblock: bottom-up allocation failed, memory hotremove may be affected\n");
+- }
+-
+- return __memblock_find_range_top_down(start, end, size, align, nid,
+- flags);
++ if (memblock_bottom_up())
++ return __memblock_find_range_bottom_up(start, end, size, align,
++ nid, flags);
++ else
++ return __memblock_find_range_top_down(start, end, size, align,
++ nid, flags);
+ }
+
+ /**
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 1cad731039c37..bdd073ea300ae 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -330,7 +330,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
+ }
+
+ dev->needed_headroom = t_hlen + hlen;
+- mtu -= (dev->hard_header_len + t_hlen);
++ mtu -= t_hlen;
+
+ if (mtu < IPV4_MIN_MTU)
+ mtu = IPV4_MIN_MTU;
+@@ -360,7 +360,7 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
+ nt = netdev_priv(dev);
+ t_hlen = nt->hlen + sizeof(struct iphdr);
+ dev->min_mtu = ETH_MIN_MTU;
+- dev->max_mtu = IP_MAX_MTU - dev->hard_header_len - t_hlen;
++ dev->max_mtu = IP_MAX_MTU - t_hlen;
+ ip_tunnel_add(itn, nt);
+ return nt;
+
+@@ -502,12 +502,11 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+ const struct iphdr *inner_iph)
+ {
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+- int pkt_size = skb->len - tunnel->hlen - dev->hard_header_len;
++ int pkt_size = skb->len - tunnel->hlen;
+ int mtu;
+
+ if (df)
+- mtu = dst_mtu(&rt->dst) - dev->hard_header_len
+- - sizeof(struct iphdr) - tunnel->hlen;
++ mtu = dst_mtu(&rt->dst) - (sizeof(struct iphdr) + tunnel->hlen);
+ else
+ mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
+
+@@ -935,7 +934,7 @@ int __ip_tunnel_change_mtu(struct net_device *dev, int new_mtu, bool strict)
+ {
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+ int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+- int max_mtu = IP_MAX_MTU - dev->hard_header_len - t_hlen;
++ int max_mtu = IP_MAX_MTU - t_hlen;
+
+ if (new_mtu < ETH_MIN_MTU)
+ return -EINVAL;
+@@ -1112,10 +1111,9 @@ int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
+
+ mtu = ip_tunnel_bind_dev(dev);
+ if (tb[IFLA_MTU]) {
+- unsigned int max = IP_MAX_MTU - dev->hard_header_len - nt->hlen;
++ unsigned int max = IP_MAX_MTU - (nt->hlen + sizeof(struct iphdr));
+
+- mtu = clamp(dev->mtu, (unsigned int)ETH_MIN_MTU,
+- (unsigned int)(max - sizeof(struct iphdr)));
++ mtu = clamp(dev->mtu, (unsigned int)ETH_MIN_MTU, max);
+ }
+
+ err = dev_set_mtu(dev, mtu);
+diff --git a/net/lapb/lapb_out.c b/net/lapb/lapb_out.c
+index eda726e22f645..621c66f001177 100644
+--- a/net/lapb/lapb_out.c
++++ b/net/lapb/lapb_out.c
+@@ -87,7 +87,8 @@ void lapb_kick(struct lapb_cb *lapb)
+ skb = skb_dequeue(&lapb->write_queue);
+
+ do {
+- if ((skbn = skb_clone(skb, GFP_ATOMIC)) == NULL) {
++ skbn = skb_copy(skb, GFP_ATOMIC);
++ if (!skbn) {
+ skb_queue_head(&lapb->write_queue, skb);
+ break;
+ }
+diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
+index f783d1377d9a8..9f0f437a09b95 100644
+--- a/net/mac80211/driver-ops.c
++++ b/net/mac80211/driver-ops.c
+@@ -128,8 +128,11 @@ int drv_sta_state(struct ieee80211_local *local,
+ } else if (old_state == IEEE80211_STA_AUTH &&
+ new_state == IEEE80211_STA_ASSOC) {
+ ret = drv_sta_add(local, sdata, &sta->sta);
+- if (ret == 0)
++ if (ret == 0) {
+ sta->uploaded = true;
++ if (rcu_access_pointer(sta->sta.rates))
++ drv_sta_rate_tbl_update(local, sdata, &sta->sta);
++ }
+ } else if (old_state == IEEE80211_STA_ASSOC &&
+ new_state == IEEE80211_STA_AUTH) {
+ drv_sta_remove(local, sdata, &sta->sta);
+diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
+index 76f303fda3eda..954b932fd7b86 100644
+--- a/net/mac80211/rate.c
++++ b/net/mac80211/rate.c
+@@ -941,7 +941,8 @@ int rate_control_set_rates(struct ieee80211_hw *hw,
+ if (old)
+ kfree_rcu(old, rcu_head);
+
+- drv_sta_rate_tbl_update(hw_to_local(hw), sta->sdata, pubsta);
++ if (sta->uploaded)
++ drv_sta_rate_tbl_update(hw_to_local(hw), sta->sdata, pubsta);
+
+ ieee80211_sta_set_expected_throughput(pubsta, sta_get_expected_throughput(sta));
+
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index 57f835d2442ec..fb7e3fffcb5ef 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -1010,7 +1010,7 @@ static int __init af_rxrpc_init(void)
+ goto error_security;
+ }
+
+- ret = register_pernet_subsys(&rxrpc_net_ops);
++ ret = register_pernet_device(&rxrpc_net_ops);
+ if (ret)
+ goto error_pernet;
+
+@@ -1055,7 +1055,7 @@ error_key_type:
+ error_sock:
+ proto_unregister(&rxrpc_proto);
+ error_proto:
+- unregister_pernet_subsys(&rxrpc_net_ops);
++ unregister_pernet_device(&rxrpc_net_ops);
+ error_pernet:
+ rxrpc_exit_security();
+ error_security:
+@@ -1077,7 +1077,7 @@ static void __exit af_rxrpc_exit(void)
+ unregister_key_type(&key_type_rxrpc);
+ sock_unregister(PF_RXRPC);
+ proto_unregister(&rxrpc_proto);
+- unregister_pernet_subsys(&rxrpc_net_ops);
++ unregister_pernet_device(&rxrpc_net_ops);
+ ASSERTCMP(atomic_read(&rxrpc_n_tx_skbs), ==, 0);
+ ASSERTCMP(atomic_read(&rxrpc_n_rx_skbs), ==, 0);
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-02-13 15:28 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-02-13 15:28 UTC (permalink / raw
To: gentoo-commits
commit: 0ddbad73d58cb0b9a876cbd0b17c9ba4303ac1a5
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 13 15:28:11 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Sat Feb 13 15:28:19 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0ddbad73
Linux patch 4.19.176
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1175_linux-4.19.176.patch | 1359 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1363 insertions(+)
diff --git a/0000_README b/0000_README
index d2238ab..4101b37 100644
--- a/0000_README
+++ b/0000_README
@@ -739,6 +739,10 @@ Patch: 1174_linux-4.19.175.patch
From: https://www.kernel.org
Desc: Linux 4.19.175
+Patch: 1175_linux-4.19.176.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.176
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1175_linux-4.19.176.patch b/1175_linux-4.19.176.patch
new file mode 100644
index 0000000..b06ab46
--- /dev/null
+++ b/1175_linux-4.19.176.patch
@@ -0,0 +1,1359 @@
+diff --git a/Makefile b/Makefile
+index db37b39fae693..6bebe3b22b452 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 175
++SUBLEVEL = 176
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index f1e86051aa5f3..b34d11f22213f 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1832,6 +1832,8 @@ static struct page **sev_pin_memory(struct kvm *kvm, unsigned long uaddr,
+ struct page **pages;
+ unsigned long first, last;
+
++ lockdep_assert_held(&kvm->lock);
++
+ if (ulen == 0 || uaddr + ulen < uaddr)
+ return NULL;
+
+@@ -7084,12 +7086,21 @@ static int svm_register_enc_region(struct kvm *kvm,
+ if (!region)
+ return -ENOMEM;
+
++ mutex_lock(&kvm->lock);
+ region->pages = sev_pin_memory(kvm, range->addr, range->size, ®ion->npages, 1);
+ if (!region->pages) {
+ ret = -ENOMEM;
++ mutex_unlock(&kvm->lock);
+ goto e_free;
+ }
+
++ region->uaddr = range->addr;
++ region->size = range->size;
++
++ mutex_lock(&kvm->lock);
++ list_add_tail(®ion->list, &sev->regions_list);
++ mutex_unlock(&kvm->lock);
++
+ /*
+ * The guest may change the memory encryption attribute from C=0 -> C=1
+ * or vice versa for this memory range. Lets make sure caches are
+@@ -7098,13 +7109,6 @@ static int svm_register_enc_region(struct kvm *kvm,
+ */
+ sev_clflush_pages(region->pages, region->npages);
+
+- region->uaddr = range->addr;
+- region->size = range->size;
+-
+- mutex_lock(&kvm->lock);
+- list_add_tail(®ion->list, &sev->regions_list);
+- mutex_unlock(&kvm->lock);
+-
+ return ret;
+
+ e_free:
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 0df43515ff949..195526b93895e 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2324,11 +2324,6 @@ static void blk_mq_map_swqueue(struct request_queue *q)
+ struct blk_mq_ctx *ctx;
+ struct blk_mq_tag_set *set = q->tag_set;
+
+- /*
+- * Avoid others reading imcomplete hctx->cpumask through sysfs
+- */
+- mutex_lock(&q->sysfs_lock);
+-
+ queue_for_each_hw_ctx(q, hctx, i) {
+ cpumask_clear(hctx->cpumask);
+ hctx->nr_ctx = 0;
+@@ -2362,8 +2357,6 @@ static void blk_mq_map_swqueue(struct request_queue *q)
+ hctx->ctxs[hctx->nr_ctx++] = ctx;
+ }
+
+- mutex_unlock(&q->sysfs_lock);
+-
+ queue_for_each_hw_ctx(q, hctx, i) {
+ /*
+ * If no software queues are mapped to this hardware queue,
+diff --git a/block/elevator.c b/block/elevator.c
+index fae58b2f906fc..ddbcd36616a8d 100644
+--- a/block/elevator.c
++++ b/block/elevator.c
+@@ -980,23 +980,19 @@ int elevator_init_mq(struct request_queue *q)
+ if (q->nr_hw_queues != 1)
+ return 0;
+
+- /*
+- * q->sysfs_lock must be held to provide mutual exclusion between
+- * elevator_switch() and here.
+- */
+- mutex_lock(&q->sysfs_lock);
++ WARN_ON_ONCE(test_bit(QUEUE_FLAG_REGISTERED, &q->queue_flags));
++
+ if (unlikely(q->elevator))
+- goto out_unlock;
++ goto out;
+
+ e = elevator_get(q, "mq-deadline", false);
+ if (!e)
+- goto out_unlock;
++ goto out;
+
+ err = blk_mq_init_sched(q, e);
+ if (err)
+ elevator_put(e);
+-out_unlock:
+- mutex_unlock(&q->sysfs_lock);
++out:
+ return err;
+ }
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 2b536ab570ac1..6965dde963736 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -652,10 +652,12 @@ exit:
+ kobject_uevent(&part_to_dev(part)->kobj, KOBJ_ADD);
+ disk_part_iter_exit(&piter);
+
+- err = sysfs_create_link(&ddev->kobj,
+- &disk->queue->backing_dev_info->dev->kobj,
+- "bdi");
+- WARN_ON(err);
++ if (disk->queue->backing_dev_info->dev) {
++ err = sysfs_create_link(&ddev->kobj,
++ &disk->queue->backing_dev_info->dev->kobj,
++ "bdi");
++ WARN_ON(err);
++ }
+ }
+
+ /**
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index fd3092a4378e4..08ed3ff8b255f 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -1051,11 +1051,9 @@ static struct sock *chtls_recv_sock(struct sock *lsk,
+ tcph = (struct tcphdr *)(iph + 1);
+ n = dst_neigh_lookup(dst, &iph->saddr);
+ if (!n || !n->dev)
+- goto free_sk;
++ goto free_dst;
+
+ ndev = n->dev;
+- if (!ndev)
+- goto free_dst;
+ if (is_vlan_dev(ndev))
+ ndev = vlan_dev_real_dev(ndev);
+
+@@ -1117,7 +1115,8 @@ static struct sock *chtls_recv_sock(struct sock *lsk,
+ free_csk:
+ chtls_sock_release(&csk->kref);
+ free_dst:
+- neigh_release(n);
++ if (n)
++ neigh_release(n);
+ dst_release(dst);
+ free_sk:
+ inet_csk_prepare_forced_close(newsk);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
+index 798605c4f1227..5287f21d7ba63 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
+@@ -520,7 +520,10 @@ static ssize_t iwl_dbgfs_os_device_timediff_read(struct file *file,
+ const size_t bufsz = sizeof(buf);
+ int pos = 0;
+
++ mutex_lock(&mvm->mutex);
+ iwl_mvm_get_sync_time(mvm, &curr_gp2, &curr_os);
++ mutex_unlock(&mvm->mutex);
++
+ do_div(curr_os, NSEC_PER_USEC);
+ diff = curr_os - curr_gp2;
+ pos += scnprintf(buf + pos, bufsz - pos, "diff=%lld\n", diff);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+index 0e26619fb330b..d932171617e6a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+@@ -1192,6 +1192,7 @@ static void iwl_mvm_reprobe_wk(struct work_struct *wk)
+ reprobe = container_of(wk, struct iwl_mvm_reprobe, work);
+ if (device_reprobe(reprobe->dev))
+ dev_err(reprobe->dev, "reprobe failed!\n");
++ put_device(reprobe->dev);
+ kfree(reprobe);
+ module_put(THIS_MODULE);
+ }
+@@ -1242,7 +1243,7 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
+ module_put(THIS_MODULE);
+ return;
+ }
+- reprobe->dev = mvm->trans->dev;
++ reprobe->dev = get_device(mvm->trans->dev);
+ INIT_WORK(&reprobe->work, iwl_mvm_reprobe_wk);
+ schedule_work(&reprobe->work);
+ } else if (mvm->fwrt.cur_fw_img == IWL_UCODE_REGULAR &&
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+index 6783b20d9681b..a1cecf4a0e820 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+@@ -159,8 +159,10 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+ /* Allocate IML */
+ iml_img = dma_alloc_coherent(trans->dev, trans->iml_len,
+ &trans_pcie->iml_dma_addr, GFP_KERNEL);
+- if (!iml_img)
+- return -ENOMEM;
++ if (!iml_img) {
++ ret = -ENOMEM;
++ goto err_free_ctxt_info;
++ }
+
+ memcpy(iml_img, trans->iml, trans->iml_len);
+
+@@ -177,6 +179,11 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+
+ return 0;
+
++err_free_ctxt_info:
++ dma_free_coherent(trans->dev, sizeof(*trans_pcie->ctxt_info_gen3),
++ trans_pcie->ctxt_info_gen3,
++ trans_pcie->ctxt_info_dma_addr);
++ trans_pcie->ctxt_info_gen3 = NULL;
+ err_free_prph_info:
+ dma_free_coherent(trans->dev,
+ sizeof(*prph_info),
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index b73582ec03a08..b1a71539ca3e5 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -631,6 +631,11 @@ static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+ struct iwl_txq *txq = trans_pcie->txq[txq_id];
+
++ if (!txq) {
++ IWL_ERR(trans, "Trying to free a queue that wasn't allocated?\n");
++ return;
++ }
++
+ spin_lock_bh(&txq->lock);
+ while (txq->write_ptr != txq->read_ptr) {
+ IWL_DEBUG_TX_REPLY(trans, "Q %d Free %d\n",
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 8a6ca06d9c160..65e1cde13d59e 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1142,17 +1142,6 @@ static int set_machine_constraints(struct regulator_dev *rdev)
+ }
+ }
+
+- /* If the constraints say the regulator should be on at this point
+- * and we have control then make sure it is enabled.
+- */
+- if (rdev->constraints->always_on || rdev->constraints->boot_on) {
+- ret = _regulator_do_enable(rdev);
+- if (ret < 0 && ret != -EINVAL) {
+- rdev_err(rdev, "failed to enable\n");
+- return ret;
+- }
+- }
+-
+ if ((rdev->constraints->ramp_delay || rdev->constraints->ramp_disable)
+ && ops->set_ramp_delay) {
+ ret = ops->set_ramp_delay(rdev, rdev->constraints->ramp_delay);
+@@ -1198,6 +1187,27 @@ static int set_machine_constraints(struct regulator_dev *rdev)
+ }
+ }
+
++ /* If the constraints say the regulator should be on at this point
++ * and we have control then make sure it is enabled.
++ */
++ if (rdev->constraints->always_on || rdev->constraints->boot_on) {
++ if (rdev->supply) {
++ ret = regulator_enable(rdev->supply);
++ if (ret < 0) {
++ _regulator_put(rdev->supply);
++ rdev->supply = NULL;
++ return ret;
++ }
++ }
++
++ ret = _regulator_do_enable(rdev);
++ if (ret < 0 && ret != -EINVAL) {
++ rdev_err(rdev, "failed to enable\n");
++ return ret;
++ }
++ rdev->use_count++;
++ }
++
+ print_constraints(rdev);
+ return 0;
+ }
+@@ -1567,13 +1577,13 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+ {
+ struct regulator_dev *r;
+ struct device *dev = rdev->dev.parent;
+- int ret;
++ int ret = 0;
+
+ /* No supply to resovle? */
+ if (!rdev->supply_name)
+ return 0;
+
+- /* Supply already resolved? */
++ /* Supply already resolved? (fast-path without locking contention) */
+ if (rdev->supply)
+ return 0;
+
+@@ -1583,7 +1593,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+
+ /* Did the lookup explicitly defer for us? */
+ if (ret == -EPROBE_DEFER)
+- return ret;
++ goto out;
+
+ if (have_full_constraints()) {
+ r = dummy_regulator_rdev;
+@@ -1591,15 +1601,18 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+ } else {
+ dev_err(dev, "Failed to resolve %s-supply for %s\n",
+ rdev->supply_name, rdev->desc->name);
+- return -EPROBE_DEFER;
++ ret = -EPROBE_DEFER;
++ goto out;
+ }
+ }
+
+ if (r == rdev) {
+ dev_err(dev, "Supply for %s (%s) resolved to itself\n",
+ rdev->desc->name, rdev->supply_name);
+- if (!have_full_constraints())
+- return -EINVAL;
++ if (!have_full_constraints()) {
++ ret = -EINVAL;
++ goto out;
++ }
+ r = dummy_regulator_rdev;
+ get_device(&r->dev);
+ }
+@@ -1613,7 +1626,8 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+ if (r->dev.parent && r->dev.parent != rdev->dev.parent) {
+ if (!device_is_bound(r->dev.parent)) {
+ put_device(&r->dev);
+- return -EPROBE_DEFER;
++ ret = -EPROBE_DEFER;
++ goto out;
+ }
+ }
+
+@@ -1621,26 +1635,48 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+ ret = regulator_resolve_supply(r);
+ if (ret < 0) {
+ put_device(&r->dev);
+- return ret;
++ goto out;
++ }
++
++ /*
++ * Recheck rdev->supply with rdev->mutex lock held to avoid a race
++ * between rdev->supply null check and setting rdev->supply in
++ * set_supply() from concurrent tasks.
++ */
++ regulator_lock(rdev);
++
++ /* Supply just resolved by a concurrent task? */
++ if (rdev->supply) {
++ regulator_unlock(rdev);
++ put_device(&r->dev);
++ goto out;
+ }
+
+ ret = set_supply(rdev, r);
+ if (ret < 0) {
++ regulator_unlock(rdev);
+ put_device(&r->dev);
+- return ret;
++ goto out;
+ }
+
+- /* Cascade always-on state to supply */
+- if (_regulator_is_enabled(rdev)) {
++ regulator_unlock(rdev);
++
++ /*
++ * In set_machine_constraints() we may have turned this regulator on
++ * but we couldn't propagate to the supply if it hadn't been resolved
++ * yet. Do it now.
++ */
++ if (rdev->use_count) {
+ ret = regulator_enable(rdev->supply);
+ if (ret < 0) {
+ _regulator_put(rdev->supply);
+ rdev->supply = NULL;
+- return ret;
++ goto out;
+ }
+ }
+
+- return 0;
++out:
++ return ret;
+ }
+
+ /* Internal regulator request function */
+diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c
+index cc475dcbf27f3..604828c04ddfb 100644
+--- a/drivers/remoteproc/qcom_q6v5_pil.c
++++ b/drivers/remoteproc/qcom_q6v5_pil.c
+@@ -340,6 +340,12 @@ static int q6v5_load(struct rproc *rproc, const struct firmware *fw)
+ {
+ struct q6v5 *qproc = rproc->priv;
+
++ /* MBA is restricted to a maximum size of 1M */
++ if (fw->size > qproc->mba_size || fw->size > SZ_1M) {
++ dev_err(qproc->dev, "MBA firmware load failed\n");
++ return -EINVAL;
++ }
++
+ memcpy(qproc->mba_region, fw->data, fw->size);
+
+ return 0;
+@@ -739,14 +745,13 @@ static int q6v5_mpss_load(struct q6v5 *qproc)
+
+ if (phdr->p_filesz) {
+ snprintf(seg_name, sizeof(seg_name), "modem.b%02d", i);
+- ret = request_firmware(&seg_fw, seg_name, qproc->dev);
++ ret = request_firmware_into_buf(&seg_fw, seg_name, qproc->dev,
++ ptr, phdr->p_filesz);
+ if (ret) {
+ dev_err(qproc->dev, "failed to load %s\n", seg_name);
+ goto release_firmware;
+ }
+
+- memcpy(ptr, seg_fw->data, seg_fw->size);
+-
+ release_firmware(seg_fw);
+ }
+
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index f2d0c4acb3cbb..a247cb4b00e2d 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -1986,7 +1986,7 @@ void wb_workfn(struct work_struct *work)
+ struct bdi_writeback, dwork);
+ long pages_written;
+
+- set_worker_desc("flush-%s", dev_name(wb->bdi->dev));
++ set_worker_desc("flush-%s", bdi_dev_name(wb->bdi));
+ current->flags |= PF_SWAPWRITE;
+
+ if (likely(!current_is_workqueue_rescuer() ||
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 4b165aa5a2561..55965e8e9a2ed 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2301,7 +2301,13 @@ pnfs_layout_process(struct nfs4_layoutget *lgp)
+ * We got an entirely new state ID. Mark all segments for the
+ * inode invalid, and retry the layoutget
+ */
+- pnfs_mark_layout_stateid_invalid(lo, &free_me);
++ struct pnfs_layout_range range = {
++ .iomode = IOMODE_ANY,
++ .length = NFS4_MAX_UINT64,
++ };
++ pnfs_set_plh_return_info(lo, IOMODE_ANY, 0);
++ pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs,
++ &range, 0);
+ goto out_forget;
+ }
+
+diff --git a/fs/squashfs/export.c b/fs/squashfs/export.c
+index 8073b6532cf04..d2a806416c3ab 100644
+--- a/fs/squashfs/export.c
++++ b/fs/squashfs/export.c
+@@ -54,12 +54,17 @@ static long long squashfs_inode_lookup(struct super_block *sb, int ino_num)
+ struct squashfs_sb_info *msblk = sb->s_fs_info;
+ int blk = SQUASHFS_LOOKUP_BLOCK(ino_num - 1);
+ int offset = SQUASHFS_LOOKUP_BLOCK_OFFSET(ino_num - 1);
+- u64 start = le64_to_cpu(msblk->inode_lookup_table[blk]);
++ u64 start;
+ __le64 ino;
+ int err;
+
+ TRACE("Entered squashfs_inode_lookup, inode_number = %d\n", ino_num);
+
++ if (ino_num == 0 || (ino_num - 1) >= msblk->inodes)
++ return -EINVAL;
++
++ start = le64_to_cpu(msblk->inode_lookup_table[blk]);
++
+ err = squashfs_read_metadata(sb, &ino, &start, &offset, sizeof(ino));
+ if (err < 0)
+ return err;
+@@ -124,7 +129,10 @@ __le64 *squashfs_read_inode_lookup_table(struct super_block *sb,
+ u64 lookup_table_start, u64 next_table, unsigned int inodes)
+ {
+ unsigned int length = SQUASHFS_LOOKUP_BLOCK_BYTES(inodes);
++ unsigned int indexes = SQUASHFS_LOOKUP_BLOCKS(inodes);
++ int n;
+ __le64 *table;
++ u64 start, end;
+
+ TRACE("In read_inode_lookup_table, length %d\n", length);
+
+@@ -134,20 +142,37 @@ __le64 *squashfs_read_inode_lookup_table(struct super_block *sb,
+ if (inodes == 0)
+ return ERR_PTR(-EINVAL);
+
+- /* length bytes should not extend into the next table - this check
+- * also traps instances where lookup_table_start is incorrectly larger
+- * than the next table start
++ /*
++ * The computed size of the lookup table (length bytes) should exactly
++ * match the table start and end points
+ */
+- if (lookup_table_start + length > next_table)
++ if (length != (next_table - lookup_table_start))
+ return ERR_PTR(-EINVAL);
+
+ table = squashfs_read_table(sb, lookup_table_start, length);
++ if (IS_ERR(table))
++ return table;
+
+ /*
+- * table[0] points to the first inode lookup table metadata block,
+- * this should be less than lookup_table_start
++ * table0], table[1], ... table[indexes - 1] store the locations
++ * of the compressed inode lookup blocks. Each entry should be
++ * less than the next (i.e. table[0] < table[1]), and the difference
++ * between them should be SQUASHFS_METADATA_SIZE or less.
++ * table[indexes - 1] should be less than lookup_table_start, and
++ * again the difference should be SQUASHFS_METADATA_SIZE or less
+ */
+- if (!IS_ERR(table) && le64_to_cpu(table[0]) >= lookup_table_start) {
++ for (n = 0; n < (indexes - 1); n++) {
++ start = le64_to_cpu(table[n]);
++ end = le64_to_cpu(table[n + 1]);
++
++ if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
++ kfree(table);
++ return ERR_PTR(-EINVAL);
++ }
++ }
++
++ start = le64_to_cpu(table[indexes - 1]);
++ if (start >= lookup_table_start || (lookup_table_start - start) > SQUASHFS_METADATA_SIZE) {
+ kfree(table);
+ return ERR_PTR(-EINVAL);
+ }
+diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c
+index d38ea3dab9515..8ccc0e3f6ea5a 100644
+--- a/fs/squashfs/id.c
++++ b/fs/squashfs/id.c
+@@ -48,10 +48,15 @@ int squashfs_get_id(struct super_block *sb, unsigned int index,
+ struct squashfs_sb_info *msblk = sb->s_fs_info;
+ int block = SQUASHFS_ID_BLOCK(index);
+ int offset = SQUASHFS_ID_BLOCK_OFFSET(index);
+- u64 start_block = le64_to_cpu(msblk->id_table[block]);
++ u64 start_block;
+ __le32 disk_id;
+ int err;
+
++ if (index >= msblk->ids)
++ return -EINVAL;
++
++ start_block = le64_to_cpu(msblk->id_table[block]);
++
+ err = squashfs_read_metadata(sb, &disk_id, &start_block, &offset,
+ sizeof(disk_id));
+ if (err < 0)
+@@ -69,7 +74,10 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb,
+ u64 id_table_start, u64 next_table, unsigned short no_ids)
+ {
+ unsigned int length = SQUASHFS_ID_BLOCK_BYTES(no_ids);
++ unsigned int indexes = SQUASHFS_ID_BLOCKS(no_ids);
++ int n;
+ __le64 *table;
++ u64 start, end;
+
+ TRACE("In read_id_index_table, length %d\n", length);
+
+@@ -80,20 +88,36 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb,
+ return ERR_PTR(-EINVAL);
+
+ /*
+- * length bytes should not extend into the next table - this check
+- * also traps instances where id_table_start is incorrectly larger
+- * than the next table start
++ * The computed size of the index table (length bytes) should exactly
++ * match the table start and end points
+ */
+- if (id_table_start + length > next_table)
++ if (length != (next_table - id_table_start))
+ return ERR_PTR(-EINVAL);
+
+ table = squashfs_read_table(sb, id_table_start, length);
++ if (IS_ERR(table))
++ return table;
+
+ /*
+- * table[0] points to the first id lookup table metadata block, this
+- * should be less than id_table_start
++ * table[0], table[1], ... table[indexes - 1] store the locations
++ * of the compressed id blocks. Each entry should be less than
++ * the next (i.e. table[0] < table[1]), and the difference between them
++ * should be SQUASHFS_METADATA_SIZE or less. table[indexes - 1]
++ * should be less than id_table_start, and again the difference
++ * should be SQUASHFS_METADATA_SIZE or less
+ */
+- if (!IS_ERR(table) && le64_to_cpu(table[0]) >= id_table_start) {
++ for (n = 0; n < (indexes - 1); n++) {
++ start = le64_to_cpu(table[n]);
++ end = le64_to_cpu(table[n + 1]);
++
++ if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
++ kfree(table);
++ return ERR_PTR(-EINVAL);
++ }
++ }
++
++ start = le64_to_cpu(table[indexes - 1]);
++ if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) {
+ kfree(table);
+ return ERR_PTR(-EINVAL);
+ }
+diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
+index ef69c31947bf8..5234c19a0eabc 100644
+--- a/fs/squashfs/squashfs_fs_sb.h
++++ b/fs/squashfs/squashfs_fs_sb.h
+@@ -77,5 +77,6 @@ struct squashfs_sb_info {
+ unsigned int inodes;
+ unsigned int fragments;
+ int xattr_ids;
++ unsigned int ids;
+ };
+ #endif
+diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
+index 40e657386fa52..728b2d72f3f07 100644
+--- a/fs/squashfs/super.c
++++ b/fs/squashfs/super.c
+@@ -176,6 +176,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
+ msblk->directory_table = le64_to_cpu(sblk->directory_table_start);
+ msblk->inodes = le32_to_cpu(sblk->inodes);
+ msblk->fragments = le32_to_cpu(sblk->fragments);
++ msblk->ids = le16_to_cpu(sblk->no_ids);
+ flags = le16_to_cpu(sblk->flags);
+
+ TRACE("Found valid superblock on %pg\n", sb->s_bdev);
+@@ -187,7 +188,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
+ TRACE("Block size %d\n", msblk->block_size);
+ TRACE("Number of inodes %d\n", msblk->inodes);
+ TRACE("Number of fragments %d\n", msblk->fragments);
+- TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids));
++ TRACE("Number of ids %d\n", msblk->ids);
+ TRACE("sblk->inode_table_start %llx\n", msblk->inode_table);
+ TRACE("sblk->directory_table_start %llx\n", msblk->directory_table);
+ TRACE("sblk->fragment_table_start %llx\n",
+@@ -244,8 +245,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
+ allocate_id_index_table:
+ /* Allocate and read id index table */
+ msblk->id_table = squashfs_read_id_index_table(sb,
+- le64_to_cpu(sblk->id_table_start), next_table,
+- le16_to_cpu(sblk->no_ids));
++ le64_to_cpu(sblk->id_table_start), next_table, msblk->ids);
+ if (IS_ERR(msblk->id_table)) {
+ ERROR("unable to read id index table\n");
+ err = PTR_ERR(msblk->id_table);
+diff --git a/fs/squashfs/xattr.h b/fs/squashfs/xattr.h
+index afe70f815e3de..86b0a0073e51f 100644
+--- a/fs/squashfs/xattr.h
++++ b/fs/squashfs/xattr.h
+@@ -30,8 +30,16 @@ extern int squashfs_xattr_lookup(struct super_block *, unsigned int, int *,
+ static inline __le64 *squashfs_read_xattr_id_table(struct super_block *sb,
+ u64 start, u64 *xattr_table_start, int *xattr_ids)
+ {
++ struct squashfs_xattr_id_table *id_table;
++
++ id_table = squashfs_read_table(sb, start, sizeof(*id_table));
++ if (IS_ERR(id_table))
++ return (__le64 *) id_table;
++
++ *xattr_table_start = le64_to_cpu(id_table->xattr_table_start);
++ kfree(id_table);
++
+ ERROR("Xattrs in filesystem, these will be ignored\n");
+- *xattr_table_start = start;
+ return ERR_PTR(-ENOTSUPP);
+ }
+
+diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c
+index c89607d690c48..3a655d879600c 100644
+--- a/fs/squashfs/xattr_id.c
++++ b/fs/squashfs/xattr_id.c
+@@ -44,10 +44,15 @@ int squashfs_xattr_lookup(struct super_block *sb, unsigned int index,
+ struct squashfs_sb_info *msblk = sb->s_fs_info;
+ int block = SQUASHFS_XATTR_BLOCK(index);
+ int offset = SQUASHFS_XATTR_BLOCK_OFFSET(index);
+- u64 start_block = le64_to_cpu(msblk->xattr_id_table[block]);
++ u64 start_block;
+ struct squashfs_xattr_id id;
+ int err;
+
++ if (index >= msblk->xattr_ids)
++ return -EINVAL;
++
++ start_block = le64_to_cpu(msblk->xattr_id_table[block]);
++
+ err = squashfs_read_metadata(sb, &id, &start_block, &offset,
+ sizeof(id));
+ if (err < 0)
+@@ -63,13 +68,17 @@ int squashfs_xattr_lookup(struct super_block *sb, unsigned int index,
+ /*
+ * Read uncompressed xattr id lookup table indexes from disk into memory
+ */
+-__le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 start,
++__le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
+ u64 *xattr_table_start, int *xattr_ids)
+ {
+- unsigned int len;
++ struct squashfs_sb_info *msblk = sb->s_fs_info;
++ unsigned int len, indexes;
+ struct squashfs_xattr_id_table *id_table;
++ __le64 *table;
++ u64 start, end;
++ int n;
+
+- id_table = squashfs_read_table(sb, start, sizeof(*id_table));
++ id_table = squashfs_read_table(sb, table_start, sizeof(*id_table));
+ if (IS_ERR(id_table))
+ return (__le64 *) id_table;
+
+@@ -83,13 +92,52 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 start,
+ if (*xattr_ids == 0)
+ return ERR_PTR(-EINVAL);
+
+- /* xattr_table should be less than start */
+- if (*xattr_table_start >= start)
++ len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
++ indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids);
++
++ /*
++ * The computed size of the index table (len bytes) should exactly
++ * match the table start and end points
++ */
++ start = table_start + sizeof(*id_table);
++ end = msblk->bytes_used;
++
++ if (len != (end - start))
+ return ERR_PTR(-EINVAL);
+
+- len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
++ table = squashfs_read_table(sb, start, len);
++ if (IS_ERR(table))
++ return table;
++
++ /* table[0], table[1], ... table[indexes - 1] store the locations
++ * of the compressed xattr id blocks. Each entry should be less than
++ * the next (i.e. table[0] < table[1]), and the difference between them
++ * should be SQUASHFS_METADATA_SIZE or less. table[indexes - 1]
++ * should be less than table_start, and again the difference
++ * shouls be SQUASHFS_METADATA_SIZE or less.
++ *
++ * Finally xattr_table_start should be less than table[0].
++ */
++ for (n = 0; n < (indexes - 1); n++) {
++ start = le64_to_cpu(table[n]);
++ end = le64_to_cpu(table[n + 1]);
++
++ if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
++ kfree(table);
++ return ERR_PTR(-EINVAL);
++ }
++ }
++
++ start = le64_to_cpu(table[indexes - 1]);
++ if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) {
++ kfree(table);
++ return ERR_PTR(-EINVAL);
++ }
+
+- TRACE("In read_xattr_index_table, length %d\n", len);
++ if (*xattr_table_start >= le64_to_cpu(table[0])) {
++ kfree(table);
++ return ERR_PTR(-EINVAL);
++ }
+
+- return squashfs_read_table(sb, start + sizeof(*id_table), len);
++ return table;
+ }
+diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
+index c28a47cbe355e..1ef4aca7b953f 100644
+--- a/include/linux/backing-dev.h
++++ b/include/linux/backing-dev.h
+@@ -13,6 +13,7 @@
+ #include <linux/fs.h>
+ #include <linux/sched.h>
+ #include <linux/blkdev.h>
++#include <linux/device.h>
+ #include <linux/writeback.h>
+ #include <linux/blk-cgroup.h>
+ #include <linux/backing-dev-defs.h>
+@@ -498,4 +499,13 @@ static inline int bdi_rw_congested(struct backing_dev_info *bdi)
+ (1 << WB_async_congested));
+ }
+
++extern const char *bdi_unknown_name;
++
++static inline const char *bdi_dev_name(struct backing_dev_info *bdi)
++{
++ if (!bdi || !bdi->dev)
++ return bdi_unknown_name;
++ return dev_name(bdi->dev);
++}
++
+ #endif /* _LINUX_BACKING_DEV_H */
+diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
+index 9f22652d69bb0..c28204e22b544 100644
+--- a/include/linux/kprobes.h
++++ b/include/linux/kprobes.h
+@@ -245,7 +245,7 @@ extern void kprobes_inc_nmissed_count(struct kprobe *p);
+ extern bool arch_within_kprobe_blacklist(unsigned long addr);
+ extern int arch_populate_kprobe_blacklist(void);
+ extern bool arch_kprobe_on_func_entry(unsigned long offset);
+-extern bool kprobe_on_func_entry(kprobe_opcode_t *addr, const char *sym, unsigned long offset);
++extern int kprobe_on_func_entry(kprobe_opcode_t *addr, const char *sym, unsigned long offset);
+
+ extern bool within_kprobe_blacklist(unsigned long addr);
+ extern int kprobe_add_ksym_blacklist(unsigned long entry);
+diff --git a/include/linux/string.h b/include/linux/string.h
+index 4db285b83f44e..1e0c442b941e2 100644
+--- a/include/linux/string.h
++++ b/include/linux/string.h
+@@ -31,6 +31,10 @@ size_t strlcpy(char *, const char *, size_t);
+ #ifndef __HAVE_ARCH_STRSCPY
+ ssize_t strscpy(char *, const char *, size_t);
+ #endif
++
++/* Wraps calls to strscpy()/memset(), no arch specific code required */
++ssize_t strscpy_pad(char *dest, const char *src, size_t count);
++
+ #ifndef __HAVE_ARCH_STRCAT
+ extern char * strcat(char *, const char *);
+ #endif
+diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
+index 2bd68177a442e..33580cc72a43d 100644
+--- a/include/linux/sunrpc/xdr.h
++++ b/include/linux/sunrpc/xdr.h
+@@ -26,8 +26,7 @@ struct rpc_rqst;
+ #define XDR_QUADLEN(l) (((l) + 3) >> 2)
+
+ /*
+- * Generic opaque `network object.' At the kernel level, this type
+- * is used only by lockd.
++ * Generic opaque `network object.'
+ */
+ #define XDR_MAX_NETOBJ 1024
+ struct xdr_netobj {
+diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
+index 146e7b3faa856..300afa559f467 100644
+--- a/include/trace/events/writeback.h
++++ b/include/trace/events/writeback.h
+@@ -65,8 +65,9 @@ TRACE_EVENT(writeback_dirty_page,
+ ),
+
+ TP_fast_assign(
+- strncpy(__entry->name,
+- mapping ? dev_name(inode_to_bdi(mapping->host)->dev) : "(unknown)", 32);
++ strscpy_pad(__entry->name,
++ bdi_dev_name(mapping ? inode_to_bdi(mapping->host) :
++ NULL), 32);
+ __entry->ino = mapping ? mapping->host->i_ino : 0;
+ __entry->index = page->index;
+ ),
+@@ -95,8 +96,7 @@ DECLARE_EVENT_CLASS(writeback_dirty_inode_template,
+ struct backing_dev_info *bdi = inode_to_bdi(inode);
+
+ /* may be called for files on pseudo FSes w/ unregistered bdi */
+- strncpy(__entry->name,
+- bdi->dev ? dev_name(bdi->dev) : "(unknown)", 32);
++ strscpy_pad(__entry->name, bdi_dev_name(bdi), 32);
+ __entry->ino = inode->i_ino;
+ __entry->state = inode->i_state;
+ __entry->flags = flags;
+@@ -175,8 +175,8 @@ DECLARE_EVENT_CLASS(writeback_write_inode_template,
+ ),
+
+ TP_fast_assign(
+- strncpy(__entry->name,
+- dev_name(inode_to_bdi(inode)->dev), 32);
++ strscpy_pad(__entry->name,
++ bdi_dev_name(inode_to_bdi(inode)), 32);
+ __entry->ino = inode->i_ino;
+ __entry->sync_mode = wbc->sync_mode;
+ __entry->cgroup_ino = __trace_wbc_assign_cgroup(wbc);
+@@ -219,8 +219,7 @@ DECLARE_EVENT_CLASS(writeback_work_class,
+ __field(unsigned int, cgroup_ino)
+ ),
+ TP_fast_assign(
+- strncpy(__entry->name,
+- wb->bdi->dev ? dev_name(wb->bdi->dev) : "(unknown)", 32);
++ strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32);
+ __entry->nr_pages = work->nr_pages;
+ __entry->sb_dev = work->sb ? work->sb->s_dev : 0;
+ __entry->sync_mode = work->sync_mode;
+@@ -273,7 +272,7 @@ DECLARE_EVENT_CLASS(writeback_class,
+ __field(unsigned int, cgroup_ino)
+ ),
+ TP_fast_assign(
+- strncpy(__entry->name, dev_name(wb->bdi->dev), 32);
++ strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32);
+ __entry->cgroup_ino = __trace_wb_assign_cgroup(wb);
+ ),
+ TP_printk("bdi %s: cgroup_ino=%u",
+@@ -295,7 +294,7 @@ TRACE_EVENT(writeback_bdi_register,
+ __array(char, name, 32)
+ ),
+ TP_fast_assign(
+- strncpy(__entry->name, dev_name(bdi->dev), 32);
++ strscpy_pad(__entry->name, bdi_dev_name(bdi), 32);
+ ),
+ TP_printk("bdi %s",
+ __entry->name
+@@ -320,7 +319,7 @@ DECLARE_EVENT_CLASS(wbc_class,
+ ),
+
+ TP_fast_assign(
+- strncpy(__entry->name, dev_name(bdi->dev), 32);
++ strscpy_pad(__entry->name, bdi_dev_name(bdi), 32);
+ __entry->nr_to_write = wbc->nr_to_write;
+ __entry->pages_skipped = wbc->pages_skipped;
+ __entry->sync_mode = wbc->sync_mode;
+@@ -371,7 +370,7 @@ TRACE_EVENT(writeback_queue_io,
+ __field(unsigned int, cgroup_ino)
+ ),
+ TP_fast_assign(
+- strncpy(__entry->name, dev_name(wb->bdi->dev), 32);
++ strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32);
+ __entry->older = dirtied_before;
+ __entry->age = (jiffies - dirtied_before) * 1000 / HZ;
+ __entry->moved = moved;
+@@ -456,7 +455,7 @@ TRACE_EVENT(bdi_dirty_ratelimit,
+ ),
+
+ TP_fast_assign(
+- strlcpy(__entry->bdi, dev_name(wb->bdi->dev), 32);
++ strscpy_pad(__entry->bdi, bdi_dev_name(wb->bdi), 32);
+ __entry->write_bw = KBps(wb->write_bandwidth);
+ __entry->avg_write_bw = KBps(wb->avg_write_bandwidth);
+ __entry->dirty_rate = KBps(dirty_rate);
+@@ -521,7 +520,7 @@ TRACE_EVENT(balance_dirty_pages,
+
+ TP_fast_assign(
+ unsigned long freerun = (thresh + bg_thresh) / 2;
+- strlcpy(__entry->bdi, dev_name(wb->bdi->dev), 32);
++ strscpy_pad(__entry->bdi, bdi_dev_name(wb->bdi), 32);
+
+ __entry->limit = global_wb_domain.dirty_limit;
+ __entry->setpoint = (global_wb_domain.dirty_limit +
+@@ -581,8 +580,8 @@ TRACE_EVENT(writeback_sb_inodes_requeue,
+ ),
+
+ TP_fast_assign(
+- strncpy(__entry->name,
+- dev_name(inode_to_bdi(inode)->dev), 32);
++ strscpy_pad(__entry->name,
++ bdi_dev_name(inode_to_bdi(inode)), 32);
+ __entry->ino = inode->i_ino;
+ __entry->state = inode->i_state;
+ __entry->dirtied_when = inode->dirtied_when;
+@@ -655,8 +654,8 @@ DECLARE_EVENT_CLASS(writeback_single_inode_template,
+ ),
+
+ TP_fast_assign(
+- strncpy(__entry->name,
+- dev_name(inode_to_bdi(inode)->dev), 32);
++ strscpy_pad(__entry->name,
++ bdi_dev_name(inode_to_bdi(inode)), 32);
+ __entry->ino = inode->i_ino;
+ __entry->state = inode->i_state;
+ __entry->dirtied_when = inode->dirtied_when;
+diff --git a/init/init_task.c b/init/init_task.c
+index 5aebe3be4d7cd..994ffe0181208 100644
+--- a/init/init_task.c
++++ b/init/init_task.c
+@@ -168,7 +168,8 @@ struct task_struct init_task
+ .lockdep_recursion = 0,
+ #endif
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+- .ret_stack = NULL,
++ .ret_stack = NULL,
++ .tracing_graph_pause = ATOMIC_INIT(0),
+ #endif
+ #if defined(CONFIG_TRACING) && defined(CONFIG_PREEMPT)
+ .trace_recursion = 0,
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 6d02b78fde01e..d4435fd6fc8bc 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1921,29 +1921,45 @@ bool __weak arch_kprobe_on_func_entry(unsigned long offset)
+ return !offset;
+ }
+
+-bool kprobe_on_func_entry(kprobe_opcode_t *addr, const char *sym, unsigned long offset)
++/**
++ * kprobe_on_func_entry() -- check whether given address is function entry
++ * @addr: Target address
++ * @sym: Target symbol name
++ * @offset: The offset from the symbol or the address
++ *
++ * This checks whether the given @addr+@offset or @sym+@offset is on the
++ * function entry address or not.
++ * This returns 0 if it is the function entry, or -EINVAL if it is not.
++ * And also it returns -ENOENT if it fails the symbol or address lookup.
++ * Caller must pass @addr or @sym (either one must be NULL), or this
++ * returns -EINVAL.
++ */
++int kprobe_on_func_entry(kprobe_opcode_t *addr, const char *sym, unsigned long offset)
+ {
+ kprobe_opcode_t *kp_addr = _kprobe_addr(addr, sym, offset);
+
+ if (IS_ERR(kp_addr))
+- return false;
++ return PTR_ERR(kp_addr);
+
+- if (!kallsyms_lookup_size_offset((unsigned long)kp_addr, NULL, &offset) ||
+- !arch_kprobe_on_func_entry(offset))
+- return false;
++ if (!kallsyms_lookup_size_offset((unsigned long)kp_addr, NULL, &offset))
++ return -ENOENT;
+
+- return true;
++ if (!arch_kprobe_on_func_entry(offset))
++ return -EINVAL;
++
++ return 0;
+ }
+
+ int register_kretprobe(struct kretprobe *rp)
+ {
+- int ret = 0;
++ int ret;
+ struct kretprobe_instance *inst;
+ int i;
+ void *addr;
+
+- if (!kprobe_on_func_entry(rp->kp.addr, rp->kp.symbol_name, rp->kp.offset))
+- return -EINVAL;
++ ret = kprobe_on_func_entry(rp->kp.addr, rp->kp.symbol_name, rp->kp.offset);
++ if (ret)
++ return ret;
+
+ /* If only rp->kp.addr is specified, check reregistering kprobes */
+ if (rp->kp.addr && check_kprobe_rereg(&rp->kp))
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index cce526755471f..3492202762c73 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -6875,7 +6875,6 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
+ }
+
+ if (t->ret_stack == NULL) {
+- atomic_set(&t->tracing_graph_pause, 0);
+ atomic_set(&t->trace_overrun, 0);
+ t->curr_ret_stack = -1;
+ t->curr_ret_depth = -1;
+@@ -7088,7 +7087,6 @@ static DEFINE_PER_CPU(struct ftrace_ret_stack *, idle_ret_stack);
+ static void
+ graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
+ {
+- atomic_set(&t->tracing_graph_pause, 0);
+ atomic_set(&t->trace_overrun, 0);
+ t->ftrace_timestamp = 0;
+ /* make curr_ret_stack visible before we add the ret_stack */
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index 5c17f70c7f2d2..61eff45653f57 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -112,9 +112,9 @@ bool trace_kprobe_on_func_entry(struct trace_event_call *call)
+ {
+ struct trace_kprobe *tk = (struct trace_kprobe *)call->data;
+
+- return kprobe_on_func_entry(tk->rp.kp.addr,
++ return (kprobe_on_func_entry(tk->rp.kp.addr,
+ tk->rp.kp.addr ? NULL : tk->rp.kp.symbol_name,
+- tk->rp.kp.addr ? 0 : tk->rp.kp.offset);
++ tk->rp.kp.addr ? 0 : tk->rp.kp.offset) == 0);
+ }
+
+ bool trace_kprobe_error_injectable(struct trace_event_call *call)
+diff --git a/lib/string.c b/lib/string.c
+index edf4907ec946f..f7f7770444bf5 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -158,11 +158,9 @@ EXPORT_SYMBOL(strlcpy);
+ * @src: Where to copy the string from
+ * @count: Size of destination buffer
+ *
+- * Copy the string, or as much of it as fits, into the dest buffer.
+- * The routine returns the number of characters copied (not including
+- * the trailing NUL) or -E2BIG if the destination buffer wasn't big enough.
+- * The behavior is undefined if the string buffers overlap.
+- * The destination buffer is always NUL terminated, unless it's zero-sized.
++ * Copy the string, or as much of it as fits, into the dest buffer. The
++ * behavior is undefined if the string buffers overlap. The destination
++ * buffer is always NUL terminated, unless it's zero-sized.
+ *
+ * Preferred to strlcpy() since the API doesn't require reading memory
+ * from the src string beyond the specified "count" bytes, and since
+@@ -172,8 +170,10 @@ EXPORT_SYMBOL(strlcpy);
+ *
+ * Preferred to strncpy() since it always returns a valid string, and
+ * doesn't unnecessarily force the tail of the destination buffer to be
+- * zeroed. If the zeroing is desired, it's likely cleaner to use strscpy()
+- * with an overflow test, then just memset() the tail of the dest buffer.
++ * zeroed. If zeroing is desired please use strscpy_pad().
++ *
++ * Return: The number of characters copied (not including the trailing
++ * %NUL) or -E2BIG if the destination buffer wasn't big enough.
+ */
+ ssize_t strscpy(char *dest, const char *src, size_t count)
+ {
+@@ -260,6 +260,39 @@ char *stpcpy(char *__restrict__ dest, const char *__restrict__ src)
+ }
+ EXPORT_SYMBOL(stpcpy);
+
++/**
++ * strscpy_pad() - Copy a C-string into a sized buffer
++ * @dest: Where to copy the string to
++ * @src: Where to copy the string from
++ * @count: Size of destination buffer
++ *
++ * Copy the string, or as much of it as fits, into the dest buffer. The
++ * behavior is undefined if the string buffers overlap. The destination
++ * buffer is always %NUL terminated, unless it's zero-sized.
++ *
++ * If the source string is shorter than the destination buffer, zeros
++ * the tail of the destination buffer.
++ *
++ * For full explanation of why you may want to consider using the
++ * 'strscpy' functions please see the function docstring for strscpy().
++ *
++ * Return: The number of characters copied (not including the trailing
++ * %NUL) or -E2BIG if the destination buffer wasn't big enough.
++ */
++ssize_t strscpy_pad(char *dest, const char *src, size_t count)
++{
++ ssize_t written;
++
++ written = strscpy(dest, src, count);
++ if (written < 0 || written == count - 1)
++ return written;
++
++ memset(dest + written + 1, 0, count - written - 1);
++
++ return written;
++}
++EXPORT_SYMBOL(strscpy_pad);
++
+ #ifndef __HAVE_ARCH_STRCAT
+ /**
+ * strcat - Append one %NUL-terminated string to another
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index 72e6d0c55cfad..0a970be24a28d 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -19,6 +19,7 @@ struct backing_dev_info noop_backing_dev_info = {
+ EXPORT_SYMBOL_GPL(noop_backing_dev_info);
+
+ static struct class *bdi_class;
++const char *bdi_unknown_name = "(unknown)";
+
+ /*
+ * bdi_lock protects updates to bdi_list. bdi_list has RCU reader side
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index e340e97224c3a..c7d5a6015389b 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2908,7 +2908,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t)
+ break;
+ if (!aalg->pfkey_supported)
+ continue;
+- if (aalg_tmpl_set(t, aalg) && aalg->available)
++ if (aalg_tmpl_set(t, aalg))
+ sz += sizeof(struct sadb_comb);
+ }
+ return sz + sizeof(struct sadb_prop);
+@@ -2926,7 +2926,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
+ if (!ealg->pfkey_supported)
+ continue;
+
+- if (!(ealg_tmpl_set(t, ealg) && ealg->available))
++ if (!(ealg_tmpl_set(t, ealg)))
+ continue;
+
+ for (k = 1; ; k++) {
+@@ -2937,7 +2937,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
+ if (!aalg->pfkey_supported)
+ continue;
+
+- if (aalg_tmpl_set(t, aalg) && aalg->available)
++ if (aalg_tmpl_set(t, aalg))
+ sz += sizeof(struct sadb_comb);
+ }
+ }
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index 8cb7d812ccb82..e61c48c1b37d6 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -53,6 +53,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/hashtable.h>
+
++#include "auth_gss_internal.h"
+ #include "../netns.h"
+
+ static const struct rpc_authops authgss_ops;
+@@ -147,35 +148,6 @@ gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
+ clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
+ }
+
+-static const void *
+-simple_get_bytes(const void *p, const void *end, void *res, size_t len)
+-{
+- const void *q = (const void *)((const char *)p + len);
+- if (unlikely(q > end || q < p))
+- return ERR_PTR(-EFAULT);
+- memcpy(res, p, len);
+- return q;
+-}
+-
+-static inline const void *
+-simple_get_netobj(const void *p, const void *end, struct xdr_netobj *dest)
+-{
+- const void *q;
+- unsigned int len;
+-
+- p = simple_get_bytes(p, end, &len, sizeof(len));
+- if (IS_ERR(p))
+- return p;
+- q = (const void *)((const char *)p + len);
+- if (unlikely(q > end || q < p))
+- return ERR_PTR(-EFAULT);
+- dest->data = kmemdup(p, len, GFP_NOFS);
+- if (unlikely(dest->data == NULL))
+- return ERR_PTR(-ENOMEM);
+- dest->len = len;
+- return q;
+-}
+-
+ static struct gss_cl_ctx *
+ gss_cred_get_ctx(struct rpc_cred *cred)
+ {
+diff --git a/net/sunrpc/auth_gss/auth_gss_internal.h b/net/sunrpc/auth_gss/auth_gss_internal.h
+new file mode 100644
+index 0000000000000..f6d9631bd9d00
+--- /dev/null
++++ b/net/sunrpc/auth_gss/auth_gss_internal.h
+@@ -0,0 +1,45 @@
++// SPDX-License-Identifier: BSD-3-Clause
++/*
++ * linux/net/sunrpc/auth_gss/auth_gss_internal.h
++ *
++ * Internal definitions for RPCSEC_GSS client authentication
++ *
++ * Copyright (c) 2000 The Regents of the University of Michigan.
++ * All rights reserved.
++ *
++ */
++#include <linux/err.h>
++#include <linux/string.h>
++#include <linux/sunrpc/xdr.h>
++
++static inline const void *
++simple_get_bytes(const void *p, const void *end, void *res, size_t len)
++{
++ const void *q = (const void *)((const char *)p + len);
++ if (unlikely(q > end || q < p))
++ return ERR_PTR(-EFAULT);
++ memcpy(res, p, len);
++ return q;
++}
++
++static inline const void *
++simple_get_netobj(const void *p, const void *end, struct xdr_netobj *dest)
++{
++ const void *q;
++ unsigned int len;
++
++ p = simple_get_bytes(p, end, &len, sizeof(len));
++ if (IS_ERR(p))
++ return p;
++ q = (const void *)((const char *)p + len);
++ if (unlikely(q > end || q < p))
++ return ERR_PTR(-EFAULT);
++ if (len) {
++ dest->data = kmemdup(p, len, GFP_NOFS);
++ if (unlikely(dest->data == NULL))
++ return ERR_PTR(-ENOMEM);
++ } else
++ dest->data = NULL;
++ dest->len = len;
++ return q;
++}
+diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
+index 7bb2514aadd9d..14f2823ad6c20 100644
+--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
++++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
+@@ -46,6 +46,8 @@
+ #include <linux/sunrpc/xdr.h>
+ #include <linux/sunrpc/gss_krb5_enctypes.h>
+
++#include "auth_gss_internal.h"
++
+ #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
+ # define RPCDBG_FACILITY RPCDBG_AUTH
+ #endif
+@@ -187,35 +189,6 @@ get_gss_krb5_enctype(int etype)
+ return NULL;
+ }
+
+-static const void *
+-simple_get_bytes(const void *p, const void *end, void *res, int len)
+-{
+- const void *q = (const void *)((const char *)p + len);
+- if (unlikely(q > end || q < p))
+- return ERR_PTR(-EFAULT);
+- memcpy(res, p, len);
+- return q;
+-}
+-
+-static const void *
+-simple_get_netobj(const void *p, const void *end, struct xdr_netobj *res)
+-{
+- const void *q;
+- unsigned int len;
+-
+- p = simple_get_bytes(p, end, &len, sizeof(len));
+- if (IS_ERR(p))
+- return p;
+- q = (const void *)((const char *)p + len);
+- if (unlikely(q > end || q < p))
+- return ERR_PTR(-EFAULT);
+- res->data = kmemdup(p, len, GFP_NOFS);
+- if (unlikely(res->data == NULL))
+- return ERR_PTR(-ENOMEM);
+- res->len = len;
+- return q;
+-}
+-
+ static inline const void *
+ get_key(const void *p, const void *end,
+ struct krb5_ctx *ctx, struct crypto_skcipher **res)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-02-23 14:31 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-02-23 14:31 UTC (permalink / raw
To: gentoo-commits
commit: 8bc0f0a9365ed33be2d79d652aa3d13faf58ff7f
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Tue Feb 23 14:30:48 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Tue Feb 23 14:31:04 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=8bc0f0a9
Linux patch 4.19.177
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1176_linux-4.19.177.patch | 1506 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1510 insertions(+)
diff --git a/0000_README b/0000_README
index 4101b37..310ffed 100644
--- a/0000_README
+++ b/0000_README
@@ -743,6 +743,10 @@ Patch: 1175_linux-4.19.176.patch
From: https://www.kernel.org
Desc: Linux 4.19.176
+Patch: 1176_linux-4.19.177.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.177
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1176_linux-4.19.177.patch b/1176_linux-4.19.177.patch
new file mode 100644
index 0000000..6692875
--- /dev/null
+++ b/1176_linux-4.19.177.patch
@@ -0,0 +1,1506 @@
+diff --git a/Makefile b/Makefile
+index 6bebe3b22b452..74b9258e7d2ce 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 176
++SUBLEVEL = 177
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 9ad3df11db0d8..abef034987a27 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -323,9 +323,6 @@
+
+ clocks = <&xtal_32k>, <&xtal>;
+ clock-names = "xtal_32k", "xtal";
+-
+- assigned-clocks = <&clk LPC32XX_CLK_HCLK_PLL>;
+- assigned-clock-rates = <208000000>;
+ };
+ };
+
+diff --git a/arch/arm/include/asm/kexec-internal.h b/arch/arm/include/asm/kexec-internal.h
+new file mode 100644
+index 0000000000000..ecc2322db7aa1
+--- /dev/null
++++ b/arch/arm/include/asm/kexec-internal.h
+@@ -0,0 +1,12 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ARM_KEXEC_INTERNAL_H
++#define _ARM_KEXEC_INTERNAL_H
++
++struct kexec_relocate_data {
++ unsigned long kexec_start_address;
++ unsigned long kexec_indirection_page;
++ unsigned long kexec_mach_type;
++ unsigned long kexec_r2;
++};
++
++#endif
+diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c
+index 3968d6c22455b..ae85f67a63520 100644
+--- a/arch/arm/kernel/asm-offsets.c
++++ b/arch/arm/kernel/asm-offsets.c
+@@ -18,6 +18,7 @@
+ #include <linux/kvm_host.h>
+ #endif
+ #include <asm/cacheflush.h>
++#include <asm/kexec-internal.h>
+ #include <asm/glue-df.h>
+ #include <asm/glue-pf.h>
+ #include <asm/mach/arch.h>
+@@ -189,5 +190,9 @@ int main(void)
+ DEFINE(MPU_RGN_PRBAR, offsetof(struct mpu_rgn, prbar));
+ DEFINE(MPU_RGN_PRLAR, offsetof(struct mpu_rgn, prlar));
+ #endif
++ DEFINE(KEXEC_START_ADDR, offsetof(struct kexec_relocate_data, kexec_start_address));
++ DEFINE(KEXEC_INDIR_PAGE, offsetof(struct kexec_relocate_data, kexec_indirection_page));
++ DEFINE(KEXEC_MACH_TYPE, offsetof(struct kexec_relocate_data, kexec_mach_type));
++ DEFINE(KEXEC_R2, offsetof(struct kexec_relocate_data, kexec_r2));
+ return 0;
+ }
+diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
+index 76300f3813e89..734adeb42df87 100644
+--- a/arch/arm/kernel/machine_kexec.c
++++ b/arch/arm/kernel/machine_kexec.c
+@@ -15,6 +15,7 @@
+ #include <asm/pgalloc.h>
+ #include <asm/mmu_context.h>
+ #include <asm/cacheflush.h>
++#include <asm/kexec-internal.h>
+ #include <asm/fncpy.h>
+ #include <asm/mach-types.h>
+ #include <asm/smp_plat.h>
+@@ -24,11 +25,6 @@
+ extern void relocate_new_kernel(void);
+ extern const unsigned int relocate_new_kernel_size;
+
+-extern unsigned long kexec_start_address;
+-extern unsigned long kexec_indirection_page;
+-extern unsigned long kexec_mach_type;
+-extern unsigned long kexec_boot_atags;
+-
+ static atomic_t waiting_for_crash_ipi;
+
+ /*
+@@ -161,6 +157,7 @@ void (*kexec_reinit)(void);
+ void machine_kexec(struct kimage *image)
+ {
+ unsigned long page_list, reboot_entry_phys;
++ struct kexec_relocate_data *data;
+ void (*reboot_entry)(void);
+ void *reboot_code_buffer;
+
+@@ -176,18 +173,17 @@ void machine_kexec(struct kimage *image)
+
+ reboot_code_buffer = page_address(image->control_code_page);
+
+- /* Prepare parameters for reboot_code_buffer*/
+- set_kernel_text_rw();
+- kexec_start_address = image->start;
+- kexec_indirection_page = page_list;
+- kexec_mach_type = machine_arch_type;
+- kexec_boot_atags = image->arch.kernel_r2;
+-
+ /* copy our kernel relocation code to the control code page */
+ reboot_entry = fncpy(reboot_code_buffer,
+ &relocate_new_kernel,
+ relocate_new_kernel_size);
+
++ data = reboot_code_buffer + relocate_new_kernel_size;
++ data->kexec_start_address = image->start;
++ data->kexec_indirection_page = page_list;
++ data->kexec_mach_type = machine_arch_type;
++ data->kexec_r2 = image->arch.kernel_r2;
++
+ /* get the identity mapping physical address for the reboot code */
+ reboot_entry_phys = virt_to_idmap(reboot_entry);
+
+diff --git a/arch/arm/kernel/relocate_kernel.S b/arch/arm/kernel/relocate_kernel.S
+index 7eaa2ae7aff58..5e15b5912cb05 100644
+--- a/arch/arm/kernel/relocate_kernel.S
++++ b/arch/arm/kernel/relocate_kernel.S
+@@ -5,14 +5,16 @@
+
+ #include <linux/linkage.h>
+ #include <asm/assembler.h>
++#include <asm/asm-offsets.h>
+ #include <asm/kexec.h>
+
+ .align 3 /* not needed for this code, but keeps fncpy() happy */
+
+ ENTRY(relocate_new_kernel)
+
+- ldr r0,kexec_indirection_page
+- ldr r1,kexec_start_address
++ adr r7, relocate_new_kernel_end
++ ldr r0, [r7, #KEXEC_INDIR_PAGE]
++ ldr r1, [r7, #KEXEC_START_ADDR]
+
+ /*
+ * If there is no indirection page (we are doing crashdumps)
+@@ -57,34 +59,16 @@ ENTRY(relocate_new_kernel)
+
+ 2:
+ /* Jump to relocated kernel */
+- mov lr,r1
+- mov r0,#0
+- ldr r1,kexec_mach_type
+- ldr r2,kexec_boot_atags
+- ARM( ret lr )
+- THUMB( bx lr )
+-
+- .align
+-
+- .globl kexec_start_address
+-kexec_start_address:
+- .long 0x0
+-
+- .globl kexec_indirection_page
+-kexec_indirection_page:
+- .long 0x0
+-
+- .globl kexec_mach_type
+-kexec_mach_type:
+- .long 0x0
+-
+- /* phy addr of the atags for the new kernel */
+- .globl kexec_boot_atags
+-kexec_boot_atags:
+- .long 0x0
++ mov lr, r1
++ mov r0, #0
++ ldr r1, [r7, #KEXEC_MACH_TYPE]
++ ldr r2, [r7, #KEXEC_R2]
++ ARM( ret lr )
++ THUMB( bx lr )
+
+ ENDPROC(relocate_new_kernel)
+
++ .align 3
+ relocate_new_kernel_end:
+
+ .globl relocate_new_kernel_size
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index b908382b69ff5..1c01358b9b6db 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -697,18 +697,20 @@ struct page *get_signal_page(void)
+
+ addr = page_address(page);
+
++ /* Poison the entire page */
++ memset32(addr, __opcode_to_mem_arm(0xe7fddef1),
++ PAGE_SIZE / sizeof(u32));
++
+ /* Give the signal return code some randomness */
+ offset = 0x200 + (get_random_int() & 0x7fc);
+ signal_return_offset = offset;
+
+- /*
+- * Copy signal return handlers into the vector page, and
+- * set sigreturn to be a pointer to these.
+- */
++ /* Copy signal return handlers into the page */
+ memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
+
+- ptr = (unsigned long)addr + offset;
+- flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
++ /* Flush out all instructions in this page */
++ ptr = (unsigned long)addr;
++ flush_icache_range(ptr, ptr + PAGE_SIZE);
+
+ return page;
+ }
+diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
+index 8aa901e20ca8e..dd946c77e8015 100644
+--- a/arch/arm/xen/enlighten.c
++++ b/arch/arm/xen/enlighten.c
+@@ -404,8 +404,6 @@ static int __init xen_guest_init(void)
+ return -ENOMEM;
+ }
+ gnttab_init();
+- if (!xen_initial_domain())
+- xenbus_probe();
+
+ /*
+ * Making sure board specific code will not set up ops for
+diff --git a/arch/arm/xen/p2m.c b/arch/arm/xen/p2m.c
+index 0641ba54ab62a..ce538c51fa3fb 100644
+--- a/arch/arm/xen/p2m.c
++++ b/arch/arm/xen/p2m.c
+@@ -93,8 +93,10 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
+ for (i = 0; i < count; i++) {
+ if (map_ops[i].status)
+ continue;
+- set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
+- map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT);
++ if (unlikely(!set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
++ map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT))) {
++ return -ENOMEM;
++ }
+ }
+
+ return 0;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index f4ee7c4f83b8b..b1c1a88a1c20c 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -198,6 +198,7 @@
+ reg = <0x0 0xf8000000 0x0 0x2000000>,
+ <0x0 0xfd000000 0x0 0x1000000>;
+ reg-names = "axi-base", "apb-base";
++ device_type = "pci";
+ #address-cells = <3>;
+ #size-cells = <2>;
+ #interrupt-cells = <1>;
+@@ -216,7 +217,6 @@
+ <0 0 0 2 &pcie0_intc 1>,
+ <0 0 0 3 &pcie0_intc 2>,
+ <0 0 0 4 &pcie0_intc 3>;
+- linux,pci-domain = <0>;
+ max-link-speed = <1>;
+ msi-map = <0x0 &its 0x0 0x1000>;
+ phys = <&pcie_phy 0>, <&pcie_phy 1>,
+diff --git a/arch/h8300/kernel/asm-offsets.c b/arch/h8300/kernel/asm-offsets.c
+index 85e60509f0a83..d4b53af657c84 100644
+--- a/arch/h8300/kernel/asm-offsets.c
++++ b/arch/h8300/kernel/asm-offsets.c
+@@ -63,6 +63,9 @@ int main(void)
+ OFFSET(TI_FLAGS, thread_info, flags);
+ OFFSET(TI_CPU, thread_info, cpu);
+ OFFSET(TI_PRE, thread_info, preempt_count);
++#ifdef CONFIG_PREEMPTION
++ DEFINE(TI_PRE_COUNT, offsetof(struct thread_info, preempt_count));
++#endif
+
+ return 0;
+ }
+diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h
+index 06cfbb3aacbb0..abc147aeff8b0 100644
+--- a/arch/riscv/include/asm/page.h
++++ b/arch/riscv/include/asm/page.h
+@@ -115,7 +115,10 @@ extern unsigned long min_low_pfn;
+
+ #endif /* __ASSEMBLY__ */
+
+-#define virt_addr_valid(vaddr) (pfn_valid(virt_to_pfn(vaddr)))
++#define virt_addr_valid(vaddr) ({ \
++ unsigned long _addr = (unsigned long)vaddr; \
++ (unsigned long)(_addr) >= PAGE_OFFSET && pfn_valid(virt_to_pfn(_addr)); \
++})
+
+ #define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | \
+ VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 0303a243b634e..75200b421f29b 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -61,6 +61,9 @@ endif
+ KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow
+ KBUILD_CFLAGS += $(call cc-option,-mno-avx,)
+
++# Intel CET isn't enabled in the kernel
++KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
++
+ ifeq ($(CONFIG_X86_32),y)
+ BITS := 32
+ UTS_MACHINE := i386
+@@ -132,9 +135,6 @@ else
+ KBUILD_CFLAGS += -mno-red-zone
+ KBUILD_CFLAGS += -mcmodel=kernel
+
+- # Intel CET isn't enabled in the kernel
+- KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
+-
+ # -funit-at-a-time shrinks the kernel .text considerably
+ # unfortunately it makes reading oopses harder.
+ KBUILD_CFLAGS += $(call cc-option,-funit-at-a-time)
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index b34d11f22213f..8cb9277aa6ff2 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -7097,7 +7097,6 @@ static int svm_register_enc_region(struct kvm *kvm,
+ region->uaddr = range->addr;
+ region->size = range->size;
+
+- mutex_lock(&kvm->lock);
+ list_add_tail(®ion->list, &sev->regions_list);
+ mutex_unlock(&kvm->lock);
+
+diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
+index 159a897151d64..e8ef994c7243c 100644
+--- a/arch/x86/xen/p2m.c
++++ b/arch/x86/xen/p2m.c
+@@ -708,7 +708,8 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
+ unsigned long mfn, pfn;
+
+ /* Do not add to override if the map failed. */
+- if (map_ops[i].status)
++ if (map_ops[i].status != GNTST_okay ||
++ (kmap_ops && kmap_ops[i].status != GNTST_okay))
+ continue;
+
+ if (map_ops[i].flags & GNTMAP_contains_pte) {
+@@ -746,17 +747,15 @@ int clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops,
+ unsigned long mfn = __pfn_to_mfn(page_to_pfn(pages[i]));
+ unsigned long pfn = page_to_pfn(pages[i]);
+
+- if (mfn == INVALID_P2M_ENTRY || !(mfn & FOREIGN_FRAME_BIT)) {
++ if (mfn != INVALID_P2M_ENTRY && (mfn & FOREIGN_FRAME_BIT))
++ set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
++ else
+ ret = -EINVAL;
+- goto out;
+- }
+-
+- set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
+ }
+ if (kunmap_ops)
+ ret = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref,
+- kunmap_ops, count);
+-out:
++ kunmap_ops, count) ?: ret;
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(clear_foreign_p2m_mapping);
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index b7ad8ac6bb41e..5198ed1b36690 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -5280,13 +5280,13 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
+ * limit 'something'.
+ */
+ /* no more than 50% of tags for async I/O */
+- bfqd->word_depths[0][0] = max(bt->sb.depth >> 1, 1U);
++ bfqd->word_depths[0][0] = max((1U << bt->sb.shift) >> 1, 1U);
+ /*
+ * no more than 75% of tags for sync writes (25% extra tags
+ * w.r.t. async I/O, to prevent async I/O from starving sync
+ * writes)
+ */
+- bfqd->word_depths[0][1] = max((bt->sb.depth * 3) >> 2, 1U);
++ bfqd->word_depths[0][1] = max(((1U << bt->sb.shift) * 3) >> 2, 1U);
+
+ /*
+ * In-word depths in case some bfq_queue is being weight-
+@@ -5296,9 +5296,9 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
+ * shortage.
+ */
+ /* no more than ~18% of tags for async I/O */
+- bfqd->word_depths[1][0] = max((bt->sb.depth * 3) >> 4, 1U);
++ bfqd->word_depths[1][0] = max(((1U << bt->sb.shift) * 3) >> 4, 1U);
+ /* no more than ~37% of tags for sync writes (~20% extra tags) */
+- bfqd->word_depths[1][1] = max((bt->sb.depth * 6) >> 4, 1U);
++ bfqd->word_depths[1][1] = max(((1U << bt->sb.shift) * 6) >> 4, 1U);
+
+ for (i = 0; i < 2; i++)
+ for (j = 0; j < 2; j++)
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index b18f0162cb9c4..208f3eea3641f 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -850,8 +850,11 @@ again:
+ pages[i]->page = persistent_gnt->page;
+ pages[i]->persistent_gnt = persistent_gnt;
+ } else {
+- if (get_free_page(ring, &pages[i]->page))
+- goto out_of_memory;
++ if (get_free_page(ring, &pages[i]->page)) {
++ put_free_pages(ring, pages_to_gnt, segs_to_map);
++ ret = -ENOMEM;
++ goto out;
++ }
+ addr = vaddr(pages[i]->page);
+ pages_to_gnt[segs_to_map] = pages[i]->page;
+ pages[i]->persistent_gnt = NULL;
+@@ -867,10 +870,8 @@ again:
+ break;
+ }
+
+- if (segs_to_map) {
++ if (segs_to_map)
+ ret = gnttab_map_refs(map, NULL, pages_to_gnt, segs_to_map);
+- BUG_ON(ret);
+- }
+
+ /*
+ * Now swizzle the MFN in our domain with the MFN from the other domain
+@@ -885,7 +886,7 @@ again:
+ pr_debug("invalid buffer -- could not remap it\n");
+ put_free_pages(ring, &pages[seg_idx]->page, 1);
+ pages[seg_idx]->handle = BLKBACK_INVALID_HANDLE;
+- ret |= 1;
++ ret |= !ret;
+ goto next;
+ }
+ pages[seg_idx]->handle = map[new_map_idx].handle;
+@@ -937,17 +938,18 @@ next:
+ }
+ segs_to_map = 0;
+ last_map = map_until;
+- if (map_until != num)
++ if (!ret && map_until != num)
+ goto again;
+
+- return ret;
+-
+-out_of_memory:
+- pr_alert("%s: out of memory\n", __func__);
+- put_free_pages(ring, pages_to_gnt, segs_to_map);
+- for (i = last_map; i < num; i++)
++out:
++ for (i = last_map; i < num; i++) {
++ /* Don't zap current batch's valid persistent grants. */
++ if(i >= last_map + segs_to_map)
++ pages[i]->persistent_gnt = NULL;
+ pages[i]->handle = BLKBACK_INVALID_HANDLE;
+- return -ENOMEM;
++ }
++
++ return ret;
+ }
+
+ static int xen_blkbk_map_seg(struct pending_req *pending_req)
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 3b07a316680c2..62a2f0491117d 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -668,8 +668,8 @@ static void emulated_link_detect(struct dc_link *link)
+ link->type = dc_connection_none;
+ prev_sink = link->local_sink;
+
+- if (prev_sink != NULL)
+- dc_sink_retain(prev_sink);
++ if (prev_sink)
++ dc_sink_release(prev_sink);
+
+ switch (link->connector_signal) {
+ case SIGNAL_TYPE_HDMI_TYPE_A: {
+@@ -4732,14 +4732,14 @@ static int dm_force_atomic_commit(struct drm_connector *connector)
+
+ ret = PTR_ERR_OR_ZERO(conn_state);
+ if (ret)
+- goto err;
++ goto out;
+
+ /* Attach crtc to drm_atomic_state*/
+ crtc_state = drm_atomic_get_crtc_state(state, &disconnected_acrtc->base);
+
+ ret = PTR_ERR_OR_ZERO(crtc_state);
+ if (ret)
+- goto err;
++ goto out;
+
+ /* force a restore */
+ crtc_state->mode_changed = true;
+@@ -4749,17 +4749,15 @@ static int dm_force_atomic_commit(struct drm_connector *connector)
+
+ ret = PTR_ERR_OR_ZERO(plane_state);
+ if (ret)
+- goto err;
+-
++ goto out;
+
+ /* Call commit internally with the state we just constructed */
+ ret = drm_atomic_commit(state);
+- if (!ret)
+- return 0;
+
+-err:
+- DRM_ERROR("Restoring old state failed with %i\n", ret);
++out:
+ drm_atomic_state_put(state);
++ if (ret)
++ DRM_ERROR("Restoring old state failed with %i\n", ret);
+
+ return ret;
+ }
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index eb7e533b0dd47..6feafebf85feb 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -49,6 +49,8 @@
+ #define STM32F7_I2C_CR1_RXDMAEN BIT(15)
+ #define STM32F7_I2C_CR1_TXDMAEN BIT(14)
+ #define STM32F7_I2C_CR1_ANFOFF BIT(12)
++#define STM32F7_I2C_CR1_DNF_MASK GENMASK(11, 8)
++#define STM32F7_I2C_CR1_DNF(n) (((n) & 0xf) << 8)
+ #define STM32F7_I2C_CR1_ERRIE BIT(7)
+ #define STM32F7_I2C_CR1_TCIE BIT(6)
+ #define STM32F7_I2C_CR1_STOPIE BIT(5)
+@@ -147,7 +149,7 @@
+ #define STM32F7_I2C_MAX_SLAVE 0x2
+
+ #define STM32F7_I2C_DNF_DEFAULT 0
+-#define STM32F7_I2C_DNF_MAX 16
++#define STM32F7_I2C_DNF_MAX 15
+
+ #define STM32F7_I2C_ANALOG_FILTER_ENABLE 1
+ #define STM32F7_I2C_ANALOG_FILTER_DELAY_MIN 50 /* ns */
+@@ -645,6 +647,13 @@ static void stm32f7_i2c_hw_config(struct stm32f7_i2c_dev *i2c_dev)
+ else
+ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
+ STM32F7_I2C_CR1_ANFOFF);
++
++ /* Program the Digital Filter */
++ stm32f7_i2c_clr_bits(i2c_dev->base + STM32F7_I2C_CR1,
++ STM32F7_I2C_CR1_DNF_MASK);
++ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
++ STM32F7_I2C_CR1_DNF(i2c_dev->setup.dnf));
++
+ stm32f7_i2c_set_bits(i2c_dev->base + STM32F7_I2C_CR1,
+ STM32F7_I2C_CR1_PE);
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index d575dd9a329d9..16ab000454f91 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5182,12 +5182,19 @@ void hclge_reset_tqp(struct hnae3_handle *handle, u16 queue_id)
+
+ void hclge_reset_vf_queue(struct hclge_vport *vport, u16 queue_id)
+ {
++ struct hnae3_handle *handle = &vport->nic;
+ struct hclge_dev *hdev = vport->back;
+ int reset_try_times = 0;
+ int reset_status;
+ u16 queue_gid;
+ int ret;
+
++ if (queue_id >= handle->kinfo.num_tqps) {
++ dev_warn(&hdev->pdev->dev, "Invalid vf queue id(%u)\n",
++ queue_id);
++ return;
++ }
++
+ queue_gid = hclge_covert_handle_qid_global(&vport->nic, queue_id);
+
+ ret = hclge_send_reset_tqp_cmd(hdev, queue_gid, true);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 37c0bc699cd9c..cc1895a32b9d3 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -314,7 +314,12 @@ static int tc_setup_cbs(struct stmmac_priv *priv,
+
+ priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_AVB;
+ } else if (!qopt->enable) {
+- return stmmac_dma_qmode(priv, priv->ioaddr, queue, MTL_QUEUE_DCB);
++ ret = stmmac_dma_qmode(priv, priv->ioaddr, queue,
++ MTL_QUEUE_DCB);
++ if (ret)
++ return ret;
++
++ priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB;
+ }
+
+ /* Port Transmit Rate and Speed Divider */
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index cc6840377bc27..8ce6a167dd2cc 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -393,15 +393,17 @@ static void
+ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+ int len, bool more)
+ {
+- struct page *page = virt_to_head_page(data);
+- int offset = data - page_address(page);
+ struct sk_buff *skb = q->rx_head;
+ struct skb_shared_info *shinfo = skb_shinfo(skb);
+
+ if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) {
+- offset += q->buf_offset;
++ struct page *page = virt_to_head_page(data);
++ int offset = data - page_address(page) + q->buf_offset;
++
+ skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len,
+ q->buf_size);
++ } else {
++ skb_free_frag(data);
+ }
+
+ if (more)
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index f228298c3bd08..b29a1b279fff4 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -1326,13 +1326,11 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget)
+ return 0;
+
+ gnttab_batch_copy(queue->tx_copy_ops, nr_cops);
+- if (nr_mops != 0) {
++ if (nr_mops != 0)
+ ret = gnttab_map_refs(queue->tx_map_ops,
+ NULL,
+ queue->pages_to_map,
+ nr_mops);
+- BUG_ON(ret);
+- }
+
+ work_done = xenvif_tx_submit(queue);
+
+diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c
+index 9b62f65b630e4..48e2006f96ce6 100644
+--- a/drivers/net/xen-netback/rx.c
++++ b/drivers/net/xen-netback/rx.c
+@@ -38,10 +38,15 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
+ RING_IDX prod, cons;
+ struct sk_buff *skb;
+ int needed;
++ unsigned long flags;
++
++ spin_lock_irqsave(&queue->rx_queue.lock, flags);
+
+ skb = skb_peek(&queue->rx_queue);
+- if (!skb)
++ if (!skb) {
++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
+ return false;
++ }
+
+ needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE);
+ if (skb_is_gso(skb))
+@@ -49,6 +54,8 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
+ if (skb->sw_hash)
+ needed++;
+
++ spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
++
+ do {
+ prod = queue->rx.sring->req_prod;
+ cons = queue->rx.req_cons;
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index 952544ca0d84d..93fadd4abf14d 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -45,6 +45,10 @@ MODULE_LICENSE("GPL");
+ MODULE_ALIAS("wmi:95F24279-4D7B-4334-9387-ACCDC67EF61C");
+ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
+
++static int enable_tablet_mode_sw = -1;
++module_param(enable_tablet_mode_sw, int, 0444);
++MODULE_PARM_DESC(enable_tablet_mode_sw, "Enable SW_TABLET_MODE reporting (-1=auto, 0=no, 1=yes)");
++
+ #define HPWMI_EVENT_GUID "95F24279-4D7B-4334-9387-ACCDC67EF61C"
+ #define HPWMI_BIOS_GUID "5FB7F034-2C63-45e9-BE91-3D44E2C707E4"
+
+@@ -656,10 +660,12 @@ static int __init hp_wmi_input_setup(void)
+ }
+
+ /* Tablet mode */
+- val = hp_wmi_hw_state(HPWMI_TABLET_MASK);
+- if (!(val < 0)) {
+- __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
+- input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, val);
++ if (enable_tablet_mode_sw > 0) {
++ val = hp_wmi_hw_state(HPWMI_TABLET_MASK);
++ if (val >= 0) {
++ __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
++ input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, val);
++ }
+ }
+
+ err = sparse_keymap_setup(hp_wmi_input_dev, hp_wmi_keymap, NULL);
+diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
+index 0ccd06f11f123..de31362940973 100644
+--- a/drivers/scsi/qla2xxx/qla_tmpl.c
++++ b/drivers/scsi/qla2xxx/qla_tmpl.c
+@@ -940,7 +940,8 @@ qla27xx_template_checksum(void *p, ulong size)
+ static inline int
+ qla27xx_verify_template_checksum(struct qla27xx_fwdt_template *tmp)
+ {
+- return qla27xx_template_checksum(tmp, tmp->template_size) == 0;
++ return qla27xx_template_checksum(tmp,
++ le32_to_cpu(tmp->template_size)) == 0;
+ }
+
+ static inline int
+@@ -956,7 +957,7 @@ qla27xx_execute_fwdt_template(struct scsi_qla_host *vha)
+ ulong len;
+
+ if (qla27xx_fwdt_template_valid(tmp)) {
+- len = tmp->template_size;
++ len = le32_to_cpu(tmp->template_size);
+ tmp = memcpy(vha->hw->fw_dump, tmp, len);
+ ql27xx_edit_template(vha, tmp);
+ qla27xx_walk_template(vha, tmp, tmp, &len);
+@@ -972,7 +973,7 @@ qla27xx_fwdt_calculate_dump_size(struct scsi_qla_host *vha)
+ ulong len = 0;
+
+ if (qla27xx_fwdt_template_valid(tmp)) {
+- len = tmp->template_size;
++ len = le32_to_cpu(tmp->template_size);
+ qla27xx_walk_template(vha, tmp, NULL, &len);
+ }
+
+@@ -984,7 +985,7 @@ qla27xx_fwdt_template_size(void *p)
+ {
+ struct qla27xx_fwdt_template *tmp = p;
+
+- return tmp->template_size;
++ return le32_to_cpu(tmp->template_size);
+ }
+
+ ulong
+diff --git a/drivers/scsi/qla2xxx/qla_tmpl.h b/drivers/scsi/qla2xxx/qla_tmpl.h
+index 141c1c5e73f42..2d3e1a8349b3b 100644
+--- a/drivers/scsi/qla2xxx/qla_tmpl.h
++++ b/drivers/scsi/qla2xxx/qla_tmpl.h
+@@ -13,7 +13,7 @@
+ struct __packed qla27xx_fwdt_template {
+ uint32_t template_type;
+ uint32_t entry_offset;
+- uint32_t template_size;
++ __le32 template_size;
+ uint32_t reserved_1;
+
+ uint32_t entry_count;
+diff --git a/drivers/usb/dwc3/ulpi.c b/drivers/usb/dwc3/ulpi.c
+index bb8271531da70..ffe3440abb74c 100644
+--- a/drivers/usb/dwc3/ulpi.c
++++ b/drivers/usb/dwc3/ulpi.c
+@@ -7,6 +7,8 @@
+ * Author: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+ */
+
++#include <linux/delay.h>
++#include <linux/time64.h>
+ #include <linux/ulpi/regs.h>
+
+ #include "core.h"
+@@ -17,12 +19,22 @@
+ DWC3_GUSB2PHYACC_ADDR(ULPI_ACCESS_EXTENDED) | \
+ DWC3_GUSB2PHYACC_EXTEND_ADDR(a) : DWC3_GUSB2PHYACC_ADDR(a))
+
+-static int dwc3_ulpi_busyloop(struct dwc3 *dwc)
++#define DWC3_ULPI_BASE_DELAY DIV_ROUND_UP(NSEC_PER_SEC, 60000000L)
++
++static int dwc3_ulpi_busyloop(struct dwc3 *dwc, u8 addr, bool read)
+ {
+- unsigned count = 1000;
++ unsigned long ns = 5L * DWC3_ULPI_BASE_DELAY;
++ unsigned int count = 1000;
+ u32 reg;
+
++ if (addr >= ULPI_EXT_VENDOR_SPECIFIC)
++ ns += DWC3_ULPI_BASE_DELAY;
++
++ if (read)
++ ns += DWC3_ULPI_BASE_DELAY;
++
+ while (count--) {
++ ndelay(ns);
+ reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYACC(0));
+ if (reg & DWC3_GUSB2PHYACC_DONE)
+ return 0;
+@@ -47,7 +59,7 @@ static int dwc3_ulpi_read(struct device *dev, u8 addr)
+ reg = DWC3_GUSB2PHYACC_NEWREGREQ | DWC3_ULPI_ADDR(addr);
+ dwc3_writel(dwc->regs, DWC3_GUSB2PHYACC(0), reg);
+
+- ret = dwc3_ulpi_busyloop(dwc);
++ ret = dwc3_ulpi_busyloop(dwc, addr, true);
+ if (ret)
+ return ret;
+
+@@ -71,7 +83,7 @@ static int dwc3_ulpi_write(struct device *dev, u8 addr, u8 val)
+ reg |= DWC3_GUSB2PHYACC_WRITE | val;
+ dwc3_writel(dwc->regs, DWC3_GUSB2PHYACC(0), reg);
+
+- return dwc3_ulpi_busyloop(dwc);
++ return dwc3_ulpi_busyloop(dwc, addr, false);
+ }
+
+ static const struct ulpi_ops dwc3_ulpi_ops = {
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index 3cfbec482efb9..e519063e421e2 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -323,44 +323,47 @@ int gntdev_map_grant_pages(struct gntdev_grant_map *map)
+ * to the kernel linear addresses of the struct pages.
+ * These ptes are completely different from the user ptes dealt
+ * with find_grant_ptes.
++ * Note that GNTMAP_device_map isn't needed here: The
++ * dev_bus_addr output field gets consumed only from ->map_ops,
++ * and by not requesting it when mapping we also avoid needing
++ * to mirror dev_bus_addr into ->unmap_ops (and holding an extra
++ * reference to the page in the hypervisor).
+ */
++ unsigned int flags = (map->flags & ~GNTMAP_device_map) |
++ GNTMAP_host_map;
++
+ for (i = 0; i < map->count; i++) {
+ unsigned long address = (unsigned long)
+ pfn_to_kaddr(page_to_pfn(map->pages[i]));
+ BUG_ON(PageHighMem(map->pages[i]));
+
+- gnttab_set_map_op(&map->kmap_ops[i], address,
+- map->flags | GNTMAP_host_map,
++ gnttab_set_map_op(&map->kmap_ops[i], address, flags,
+ map->grants[i].ref,
+ map->grants[i].domid);
+ gnttab_set_unmap_op(&map->kunmap_ops[i], address,
+- map->flags | GNTMAP_host_map, -1);
++ flags, -1);
+ }
+ }
+
+ pr_debug("map %d+%d\n", map->index, map->count);
+ err = gnttab_map_refs(map->map_ops, use_ptemod ? map->kmap_ops : NULL,
+ map->pages, map->count);
+- if (err)
+- return err;
+
+ for (i = 0; i < map->count; i++) {
+- if (map->map_ops[i].status) {
++ if (map->map_ops[i].status == GNTST_okay)
++ map->unmap_ops[i].handle = map->map_ops[i].handle;
++ else if (!err)
+ err = -EINVAL;
+- continue;
+- }
+
+- map->unmap_ops[i].handle = map->map_ops[i].handle;
+- if (use_ptemod)
+- map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
+-#ifdef CONFIG_XEN_GRANT_DMA_ALLOC
+- else if (map->dma_vaddr) {
+- unsigned long bfn;
++ if (map->flags & GNTMAP_device_map)
++ map->unmap_ops[i].dev_bus_addr = map->map_ops[i].dev_bus_addr;
+
+- bfn = pfn_to_bfn(page_to_pfn(map->pages[i]));
+- map->unmap_ops[i].dev_bus_addr = __pfn_to_phys(bfn);
++ if (use_ptemod) {
++ if (map->kmap_ops[i].status == GNTST_okay)
++ map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
++ else if (!err)
++ err = -EINVAL;
+ }
+-#endif
+ }
+ return err;
+ }
+diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
+index 1abc0a55b8d9c..614d067ffe126 100644
+--- a/drivers/xen/xen-scsiback.c
++++ b/drivers/xen/xen-scsiback.c
+@@ -422,12 +422,12 @@ static int scsiback_gnttab_data_map_batch(struct gnttab_map_grant_ref *map,
+ return 0;
+
+ err = gnttab_map_refs(map, NULL, pg, cnt);
+- BUG_ON(err);
+ for (i = 0; i < cnt; i++) {
+ if (unlikely(map[i].status != GNTST_okay)) {
+ pr_err("invalid buffer -- could not remap it\n");
+ map[i].handle = SCSIBACK_INVALID_HANDLE;
+- err = -ENOMEM;
++ if (!err)
++ err = -ENOMEM;
+ } else {
+ get_page(pg[i]);
+ }
+diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h
+index a9bb5f91082d3..88516a8a9f932 100644
+--- a/drivers/xen/xenbus/xenbus.h
++++ b/drivers/xen/xenbus/xenbus.h
+@@ -115,7 +115,6 @@ int xenbus_probe_node(struct xen_bus_type *bus,
+ const char *type,
+ const char *nodename);
+ int xenbus_probe_devices(struct xen_bus_type *bus);
+-void xenbus_probe(void);
+
+ void xenbus_dev_changed(const char *node, struct xen_bus_type *bus);
+
+diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
+index 786494bb7f20b..652894d619677 100644
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -683,7 +683,7 @@ void unregister_xenstore_notifier(struct notifier_block *nb)
+ }
+ EXPORT_SYMBOL_GPL(unregister_xenstore_notifier);
+
+-void xenbus_probe(void)
++static void xenbus_probe(void)
+ {
+ xenstored_ready = 1;
+
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 6eb0b882ad231..e164f489d01d9 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -79,6 +79,14 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+
+ if (ovl_is_private_xattr(name))
+ continue;
++
++ error = security_inode_copy_up_xattr(name);
++ if (error < 0 && error != -EOPNOTSUPP)
++ break;
++ if (error == 1) {
++ error = 0;
++ continue; /* Discard */
++ }
+ retry:
+ size = vfs_getxattr(old, name, value, value_size);
+ if (size == -ERANGE)
+@@ -102,13 +110,6 @@ retry:
+ goto retry;
+ }
+
+- error = security_inode_copy_up_xattr(name);
+- if (error < 0 && error != -EOPNOTSUPP)
+- break;
+- if (error == 1) {
+- error = 0;
+- continue; /* Discard */
+- }
+ error = vfs_setxattr(new, name, value, size, 0);
+ if (error)
+ break;
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index 8b3c284ce92ea..08e60a6df77c3 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -340,7 +340,9 @@ int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name,
+ goto out;
+
+ if (!value && !upperdentry) {
++ old_cred = ovl_override_creds(dentry->d_sb);
+ err = vfs_getxattr(realdentry, name, NULL, 0);
++ revert_creds(old_cred);
+ if (err < 0)
+ goto out_drop_write;
+ }
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 246623406db9f..f0dc432a3ceb3 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -82,7 +82,7 @@ static void ovl_dentry_release(struct dentry *dentry)
+ static struct dentry *ovl_d_real(struct dentry *dentry,
+ const struct inode *inode)
+ {
+- struct dentry *real;
++ struct dentry *real = NULL, *lower;
+
+ /* It's an overlay file */
+ if (inode && d_inode(dentry) == inode)
+@@ -101,9 +101,10 @@ static struct dentry *ovl_d_real(struct dentry *dentry,
+ if (real && !inode && ovl_has_upperdata(d_inode(dentry)))
+ return real;
+
+- real = ovl_dentry_lowerdata(dentry);
+- if (!real)
++ lower = ovl_dentry_lowerdata(dentry);
++ if (!lower)
+ goto bug;
++ real = lower;
+
+ /* Handle recursion */
+ real = d_real(real, inode);
+@@ -111,8 +112,10 @@ static struct dentry *ovl_d_real(struct dentry *dentry,
+ if (!inode || inode == d_inode(real))
+ return real;
+ bug:
+- WARN(1, "ovl_d_real(%pd4, %s:%lu): real dentry not found\n", dentry,
+- inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0);
++ WARN(1, "%s(%pd4, %s:%lu): real dentry (%p/%lu) not found\n",
++ __func__, dentry, inode ? inode->i_sb->s_id : "NULL",
++ inode ? inode->i_ino : 0, real,
++ real && d_inode(real) ? d_inode(real)->i_ino : 0);
+ return dentry;
+ }
+
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index f65a924a75abd..e71c97c3c25ef 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -363,7 +363,7 @@
+ } \
+ \
+ /* Built-in firmware blobs */ \
+- .builtin_fw : AT(ADDR(.builtin_fw) - LOAD_OFFSET) { \
++ .builtin_fw : AT(ADDR(.builtin_fw) - LOAD_OFFSET) ALIGN(8) { \
+ __start_builtin_fw = .; \
+ KEEP(*(.builtin_fw)) \
+ __end_builtin_fw = .; \
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 4e14926433edb..9770e08c7e029 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3966,6 +3966,7 @@ static inline void netif_tx_disable(struct net_device *dev)
+
+ local_bh_disable();
+ cpu = smp_processor_id();
++ spin_lock(&dev->tx_global_lock);
+ for (i = 0; i < dev->num_tx_queues; i++) {
+ struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
+
+@@ -3973,6 +3974,7 @@ static inline void netif_tx_disable(struct net_device *dev)
+ netif_tx_stop_queue(txq);
+ __netif_tx_unlock(txq);
+ }
++ spin_unlock(&dev->tx_global_lock);
+ local_bh_enable();
+ }
+
+diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
+index 9bc5bc07d4d3f..a9978350b45b0 100644
+--- a/include/xen/grant_table.h
++++ b/include/xen/grant_table.h
+@@ -157,6 +157,7 @@ gnttab_set_map_op(struct gnttab_map_grant_ref *map, phys_addr_t addr,
+ map->flags = flags;
+ map->ref = ref;
+ map->dom = domid;
++ map->status = 1; /* arbitrary positive value */
+ }
+
+ static inline void
+diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
+index fe9a9fa2ebc45..14d47ed4114fd 100644
+--- a/include/xen/xenbus.h
++++ b/include/xen/xenbus.h
+@@ -187,8 +187,6 @@ void xs_suspend_cancel(void);
+
+ struct work_struct;
+
+-void xenbus_probe(void);
+-
+ #define XENBUS_IS_ERR_READ(str) ({ \
+ if (!IS_ERR(str) && strlen(str) == 0) { \
+ kfree(str); \
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index 55fff5e6d9831..a47d623f59fe7 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -114,6 +114,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
+
+ /* hash table size must be power of 2 */
+ n_buckets = roundup_pow_of_two(attr->max_entries);
++ if (!n_buckets)
++ return ERR_PTR(-E2BIG);
+
+ cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap);
+ if (cost >= U32_MAX - PAGE_SIZE)
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index d6f1e305bb3db..88a4f9e2d06c7 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2292,7 +2292,7 @@ trace_event_buffer_lock_reserve(struct ring_buffer **current_rb,
+ (entry = this_cpu_read(trace_buffered_event))) {
+ /* Try to use the per cpu buffer first */
+ val = this_cpu_inc_return(trace_buffered_event_cnt);
+- if (val == 1) {
++ if ((len < (PAGE_SIZE - sizeof(*entry))) && val == 1) {
+ trace_event_setup(entry, type, flags, pc);
+ entry->array[0] = len;
+ return entry;
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 0fc06a7da87fb..ea43be6b9cc3c 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -1113,7 +1113,8 @@ system_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
+ mutex_lock(&event_mutex);
+ list_for_each_entry(file, &tr->events, list) {
+ call = file->event_call;
+- if (!trace_event_name(call) || !call->class || !call->class->reg)
++ if ((call->flags & TRACE_EVENT_FL_IGNORE_ENABLE) ||
++ !trace_event_name(call) || !call->class || !call->class->reg)
+ continue;
+
+ if (system && strcmp(call->class->system, system->name) != 0)
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index ad1da6b2fb607..1dceda3c0e759 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1063,7 +1063,8 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
+ * Let nf_ct_resolve_clash() deal with this later.
+ */
+ if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+- &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple))
++ &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple) &&
++ nf_ct_zone_equal(ct, zone, IP_CT_DIR_ORIGINAL))
+ continue;
+
+ NF_CT_STAT_INC_ATOMIC(net, found);
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index 890799c16aa41..b3957fe7eced2 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -360,7 +360,7 @@ static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff,
+ return -1;
+
+ tcph = (void *)(skb_network_header(skb) + thoff);
+- inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true);
++ inet_proto_csum_replace2(&tcph->check, skb, port, new_port, false);
+
+ return 0;
+ }
+@@ -377,7 +377,7 @@ static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
+ udph = (void *)(skb_network_header(skb) + thoff);
+ if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
+ inet_proto_csum_replace2(&udph->check, skb, port,
+- new_port, true);
++ new_port, false);
+ if (!udph->check)
+ udph->check = CSUM_MANGLED_0;
+ }
+diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
+index 570144507df11..cb58bc7ae30d3 100644
+--- a/net/netfilter/xt_recent.c
++++ b/net/netfilter/xt_recent.c
+@@ -155,7 +155,8 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
+ /*
+ * Drop entries with timestamps older then 'time'.
+ */
+-static void recent_entry_reap(struct recent_table *t, unsigned long time)
++static void recent_entry_reap(struct recent_table *t, unsigned long time,
++ struct recent_entry *working, bool update)
+ {
+ struct recent_entry *e;
+
+@@ -164,6 +165,12 @@ static void recent_entry_reap(struct recent_table *t, unsigned long time)
+ */
+ e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
+
++ /*
++ * Do not reap the entry which are going to be updated.
++ */
++ if (e == working && update)
++ return;
++
+ /*
+ * The last time stamp is the most recent.
+ */
+@@ -306,7 +313,8 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par)
+
+ /* info->seconds must be non-zero */
+ if (info->check_set & XT_RECENT_REAP)
+- recent_entry_reap(t, time);
++ recent_entry_reap(t, time, e,
++ info->check_set & XT_RECENT_UPDATE && ret);
+ }
+
+ if (info->check_set & XT_RECENT_SET ||
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index a05c5cb3429c0..69cf9cbbb05f6 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -194,7 +194,7 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
+ hdr->src_port_id = cpu_to_le32(from->sq_port);
+ if (to->sq_port == QRTR_PORT_CTRL) {
+ hdr->dst_node_id = cpu_to_le32(node->nid);
+- hdr->dst_port_id = cpu_to_le32(QRTR_NODE_BCAST);
++ hdr->dst_port_id = cpu_to_le32(QRTR_PORT_CTRL);
+ } else {
+ hdr->dst_node_id = cpu_to_le32(to->sq_node);
+ hdr->dst_port_id = cpu_to_le32(to->sq_port);
+diff --git a/net/qrtr/tun.c b/net/qrtr/tun.c
+index e35869e81766e..997af345ce374 100644
+--- a/net/qrtr/tun.c
++++ b/net/qrtr/tun.c
+@@ -80,6 +80,12 @@ static ssize_t qrtr_tun_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ ssize_t ret;
+ void *kbuf;
+
++ if (!len)
++ return -EINVAL;
++
++ if (len > KMALLOC_MAX_SIZE)
++ return -ENOMEM;
++
+ kbuf = kzalloc(len, GFP_KERNEL);
+ if (!kbuf)
+ return -ENOMEM;
+diff --git a/net/rds/rdma.c b/net/rds/rdma.c
+index e1965d9cbcf82..9882cebfcad60 100644
+--- a/net/rds/rdma.c
++++ b/net/rds/rdma.c
+@@ -531,6 +531,9 @@ int rds_rdma_extra_size(struct rds_rdma_args *args,
+ if (args->nr_local == 0)
+ return -EINVAL;
+
++ if (args->nr_local > UIO_MAXIOV)
++ return -EMSGSIZE;
++
+ iov->iov = kcalloc(args->nr_local,
+ sizeof(struct rds_iovec),
+ GFP_KERNEL);
+diff --git a/net/sctp/proc.c b/net/sctp/proc.c
+index a644292f9fafd..84f79ac4b9842 100644
+--- a/net/sctp/proc.c
++++ b/net/sctp/proc.c
+@@ -230,6 +230,12 @@ static void sctp_transport_seq_stop(struct seq_file *seq, void *v)
+ {
+ struct sctp_ht_iter *iter = seq->private;
+
++ if (v && v != SEQ_START_TOKEN) {
++ struct sctp_transport *transport = v;
++
++ sctp_transport_put(transport);
++ }
++
+ sctp_transport_walk_stop(&iter->hti);
+ }
+
+@@ -237,6 +243,12 @@ static void *sctp_transport_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+ struct sctp_ht_iter *iter = seq->private;
+
++ if (v && v != SEQ_START_TOKEN) {
++ struct sctp_transport *transport = v;
++
++ sctp_transport_put(transport);
++ }
++
+ ++*pos;
+
+ return sctp_transport_get_next(seq_file_net(seq), &iter->hti);
+@@ -292,8 +304,6 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
+ sk->sk_rcvbuf);
+ seq_printf(seq, "\n");
+
+- sctp_transport_put(transport);
+-
+ return 0;
+ }
+
+@@ -369,8 +379,6 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
+ seq_printf(seq, "\n");
+ }
+
+- sctp_transport_put(transport);
+-
+ return 0;
+ }
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 02374459c4179..4b65db13e1bba 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -816,10 +816,12 @@ static int vsock_shutdown(struct socket *sock, int mode)
+ */
+
+ sk = sock->sk;
++
++ lock_sock(sk);
+ if (sock->state == SS_UNCONNECTED) {
+ err = -ENOTCONN;
+ if (sk->sk_type == SOCK_STREAM)
+- return err;
++ goto out;
+ } else {
+ sock->state = SS_DISCONNECTING;
+ err = 0;
+@@ -828,10 +830,8 @@ static int vsock_shutdown(struct socket *sock, int mode)
+ /* Receive and send shutdowns are treated alike. */
+ mode = mode & (RCV_SHUTDOWN | SEND_SHUTDOWN);
+ if (mode) {
+- lock_sock(sk);
+ sk->sk_shutdown |= mode;
+ sk->sk_state_change(sk);
+- release_sock(sk);
+
+ if (sk->sk_type == SOCK_STREAM) {
+ sock_reset_flag(sk, SOCK_DONE);
+@@ -839,6 +839,8 @@ static int vsock_shutdown(struct socket *sock, int mode)
+ }
+ }
+
++out:
++ release_sock(sk);
+ return err;
+ }
+
+@@ -1107,7 +1109,6 @@ static void vsock_connect_timeout(struct work_struct *work)
+ {
+ struct sock *sk;
+ struct vsock_sock *vsk;
+- int cancel = 0;
+
+ vsk = container_of(work, struct vsock_sock, connect_work.work);
+ sk = sk_vsock(vsk);
+@@ -1118,11 +1119,9 @@ static void vsock_connect_timeout(struct work_struct *work)
+ sk->sk_state = TCP_CLOSE;
+ sk->sk_err = ETIMEDOUT;
+ sk->sk_error_report(sk);
+- cancel = 1;
++ vsock_transport_cancel_pkt(vsk);
+ }
+ release_sock(sk);
+- if (cancel)
+- vsock_transport_cancel_pkt(vsk);
+
+ sock_put(sk);
+ }
+diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
+index db6ca51228d2f..2bdf36845a5f3 100644
+--- a/net/vmw_vsock/hyperv_transport.c
++++ b/net/vmw_vsock/hyperv_transport.c
+@@ -443,14 +443,10 @@ static void hvs_shutdown_lock_held(struct hvsock *hvs, int mode)
+
+ static int hvs_shutdown(struct vsock_sock *vsk, int mode)
+ {
+- struct sock *sk = sk_vsock(vsk);
+-
+ if (!(mode & SEND_SHUTDOWN))
+ return 0;
+
+- lock_sock(sk);
+ hvs_shutdown_lock_held(vsk->trans, mode);
+- release_sock(sk);
+ return 0;
+ }
+
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 5f8a72d34d313..cbb336f01cf2b 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -1033,10 +1033,10 @@ void virtio_transport_recv_pkt(struct virtio_transport *t,
+
+ vsk = vsock_sk(sk);
+
+- space_available = virtio_transport_space_update(sk, pkt);
+-
+ lock_sock(sk);
+
++ space_available = virtio_transport_space_update(sk, pkt);
++
+ /* Update CID in case it has changed after a transport reset event */
+ vsk->local_addr.svm_cid = dst.svm_cid;
+
+diff --git a/security/commoncap.c b/security/commoncap.c
+index f86557a8e43f6..a1dee0ab345a2 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -377,10 +377,11 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ {
+ int size, ret;
+ kuid_t kroot;
++ u32 nsmagic, magic;
+ uid_t root, mappedroot;
+ char *tmpbuf = NULL;
+ struct vfs_cap_data *cap;
+- struct vfs_ns_cap_data *nscap;
++ struct vfs_ns_cap_data *nscap = NULL;
+ struct dentry *dentry;
+ struct user_namespace *fs_ns;
+
+@@ -402,46 +403,61 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ fs_ns = inode->i_sb->s_user_ns;
+ cap = (struct vfs_cap_data *) tmpbuf;
+ if (is_v2header((size_t) ret, cap)) {
+- /* If this is sizeof(vfs_cap_data) then we're ok with the
+- * on-disk value, so return that. */
+- if (alloc)
+- *buffer = tmpbuf;
+- else
+- kfree(tmpbuf);
+- return ret;
+- } else if (!is_v3header((size_t) ret, cap)) {
+- kfree(tmpbuf);
+- return -EINVAL;
++ root = 0;
++ } else if (is_v3header((size_t) ret, cap)) {
++ nscap = (struct vfs_ns_cap_data *) tmpbuf;
++ root = le32_to_cpu(nscap->rootid);
++ } else {
++ size = -EINVAL;
++ goto out_free;
+ }
+
+- nscap = (struct vfs_ns_cap_data *) tmpbuf;
+- root = le32_to_cpu(nscap->rootid);
+ kroot = make_kuid(fs_ns, root);
+
+ /* If the root kuid maps to a valid uid in current ns, then return
+ * this as a nscap. */
+ mappedroot = from_kuid(current_user_ns(), kroot);
+ if (mappedroot != (uid_t)-1 && mappedroot != (uid_t)0) {
++ size = sizeof(struct vfs_ns_cap_data);
+ if (alloc) {
+- *buffer = tmpbuf;
++ if (!nscap) {
++ /* v2 -> v3 conversion */
++ nscap = kzalloc(size, GFP_ATOMIC);
++ if (!nscap) {
++ size = -ENOMEM;
++ goto out_free;
++ }
++ nsmagic = VFS_CAP_REVISION_3;
++ magic = le32_to_cpu(cap->magic_etc);
++ if (magic & VFS_CAP_FLAGS_EFFECTIVE)
++ nsmagic |= VFS_CAP_FLAGS_EFFECTIVE;
++ memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
++ nscap->magic_etc = cpu_to_le32(nsmagic);
++ } else {
++ /* use allocated v3 buffer */
++ tmpbuf = NULL;
++ }
+ nscap->rootid = cpu_to_le32(mappedroot);
+- } else
+- kfree(tmpbuf);
+- return size;
++ *buffer = nscap;
++ }
++ goto out_free;
+ }
+
+ if (!rootid_owns_currentns(kroot)) {
+- kfree(tmpbuf);
+- return -EOPNOTSUPP;
++ size = -EOVERFLOW;
++ goto out_free;
+ }
+
+ /* This comes from a parent namespace. Return as a v2 capability */
+ size = sizeof(struct vfs_cap_data);
+ if (alloc) {
+- *buffer = kmalloc(size, GFP_ATOMIC);
+- if (*buffer) {
+- struct vfs_cap_data *cap = *buffer;
+- __le32 nsmagic, magic;
++ if (nscap) {
++ /* v3 -> v2 conversion */
++ cap = kzalloc(size, GFP_ATOMIC);
++ if (!cap) {
++ size = -ENOMEM;
++ goto out_free;
++ }
+ magic = VFS_CAP_REVISION_2;
+ nsmagic = le32_to_cpu(nscap->magic_etc);
+ if (nsmagic & VFS_CAP_FLAGS_EFFECTIVE)
+@@ -449,9 +465,12 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
+ cap->magic_etc = cpu_to_le32(magic);
+ } else {
+- size = -ENOMEM;
++ /* use unconverted v2 */
++ tmpbuf = NULL;
+ }
++ *buffer = cap;
+ }
++out_free:
+ kfree(tmpbuf);
+ return size;
+ }
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 9312c7e750ed3..1ecb27b3421a7 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -412,9 +412,8 @@ static int kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
+ */
+ kvm->mmu_notifier_count++;
+ need_tlb_flush = kvm_unmap_hva_range(kvm, start, end, blockable);
+- need_tlb_flush |= kvm->tlbs_dirty;
+ /* we've to flush the tlb before the pages can be freed */
+- if (need_tlb_flush)
++ if (need_tlb_flush || kvm->tlbs_dirty)
+ kvm_flush_remote_tlbs(kvm);
+
+ spin_unlock(&kvm->mmu_lock);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-03-04 12:08 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-03-04 12:08 UTC (permalink / raw
To: gentoo-commits
commit: 9c63f5cd34e8c7530aabcebde683dbdc1cd747b7
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Mar 4 12:08:13 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Mar 4 12:08:13 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9c63f5cd
Linux patch 4.19.178
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1177_linux-4.19.178.patch | 8577 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 8581 insertions(+)
diff --git a/0000_README b/0000_README
index 310ffed..c17ee8c 100644
--- a/0000_README
+++ b/0000_README
@@ -747,6 +747,10 @@ Patch: 1176_linux-4.19.177.patch
From: https://www.kernel.org
Desc: Linux 4.19.177
+Patch: 1177_linux-4.19.178.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.178
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1177_linux-4.19.178.patch b/1177_linux-4.19.178.patch
new file mode 100644
index 0000000..286b59a
--- /dev/null
+++ b/1177_linux-4.19.178.patch
@@ -0,0 +1,8577 @@
+diff --git a/Documentation/filesystems/seq_file.txt b/Documentation/filesystems/seq_file.txt
+index d412b236a9d6f..7cf7143921a1f 100644
+--- a/Documentation/filesystems/seq_file.txt
++++ b/Documentation/filesystems/seq_file.txt
+@@ -192,6 +192,12 @@ between the calls to start() and stop(), so holding a lock during that time
+ is a reasonable thing to do. The seq_file code will also avoid taking any
+ other locks while the iterator is active.
+
++The iterater value returned by start() or next() is guaranteed to be
++passed to a subsequent next() or stop() call. This allows resources
++such as locks that were taken to be reliably released. There is *no*
++guarantee that the iterator will be passed to show(), though in practice
++it often will be.
++
+
+ Formatted output
+
+diff --git a/Makefile b/Makefile
+index 74b9258e7d2ce..6787efa2edc90 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 177
++SUBLEVEL = 178
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index e205bbbe27949..69e661f574a07 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -1090,9 +1090,9 @@ __armv4_mmu_cache_off:
+ __armv7_mmu_cache_off:
+ mrc p15, 0, r0, c1, c0
+ #ifdef CONFIG_MMU
+- bic r0, r0, #0x000d
++ bic r0, r0, #0x0005
+ #else
+- bic r0, r0, #0x000c
++ bic r0, r0, #0x0004
+ #endif
+ mcr p15, 0, r0, c1, c0 @ turn MMU and cache off
+ mov r12, lr
+diff --git a/arch/arm/boot/dts/armada-388-helios4.dts b/arch/arm/boot/dts/armada-388-helios4.dts
+index 705adfa8c680f..a94758090fb0d 100644
+--- a/arch/arm/boot/dts/armada-388-helios4.dts
++++ b/arch/arm/boot/dts/armada-388-helios4.dts
+@@ -70,6 +70,9 @@
+
+ system-leds {
+ compatible = "gpio-leds";
++ pinctrl-names = "default";
++ pinctrl-0 = <&helios_system_led_pins>;
++
+ status-led {
+ label = "helios4:green:status";
+ gpios = <&gpio0 24 GPIO_ACTIVE_LOW>;
+@@ -86,6 +89,9 @@
+
+ io-leds {
+ compatible = "gpio-leds";
++ pinctrl-names = "default";
++ pinctrl-0 = <&helios_io_led_pins>;
++
+ sata1-led {
+ label = "helios4:green:ata1";
+ gpios = <&gpio1 17 GPIO_ACTIVE_LOW>;
+@@ -121,11 +127,15 @@
+ fan1: j10-pwm {
+ compatible = "pwm-fan";
+ pwms = <&gpio1 9 40000>; /* Target freq:25 kHz */
++ pinctrl-names = "default";
++ pinctrl-0 = <&helios_fan1_pins>;
+ };
+
+ fan2: j17-pwm {
+ compatible = "pwm-fan";
+ pwms = <&gpio1 23 40000>; /* Target freq:25 kHz */
++ pinctrl-names = "default";
++ pinctrl-0 = <&helios_fan2_pins>;
+ };
+
+ usb2_phy: usb2-phy {
+@@ -291,16 +301,22 @@
+ "mpp39", "mpp40";
+ marvell,function = "sd0";
+ };
+- helios_led_pins: helios-led-pins {
+- marvell,pins = "mpp24", "mpp25",
+- "mpp49", "mpp50",
++ helios_system_led_pins: helios-system-led-pins {
++ marvell,pins = "mpp24", "mpp25";
++ marvell,function = "gpio";
++ };
++ helios_io_led_pins: helios-io-led-pins {
++ marvell,pins = "mpp49", "mpp50",
+ "mpp52", "mpp53",
+ "mpp54";
+ marvell,function = "gpio";
+ };
+- helios_fan_pins: helios-fan-pins {
+- marvell,pins = "mpp41", "mpp43",
+- "mpp48", "mpp55";
++ helios_fan1_pins: helios_fan1_pins {
++ marvell,pins = "mpp41", "mpp43";
++ marvell,function = "gpio";
++ };
++ helios_fan2_pins: helios_fan2_pins {
++ marvell,pins = "mpp48", "mpp55";
+ marvell,function = "gpio";
+ };
+ microsom_spi1_cs_pins: spi1-cs-pins {
+diff --git a/arch/arm/boot/dts/aspeed-g4.dtsi b/arch/arm/boot/dts/aspeed-g4.dtsi
+index 69f6b9d2e7e7d..2af093759143c 100644
+--- a/arch/arm/boot/dts/aspeed-g4.dtsi
++++ b/arch/arm/boot/dts/aspeed-g4.dtsi
+@@ -312,6 +312,7 @@
+ compatible = "aspeed,ast2400-ibt-bmc";
+ reg = <0xc0 0x18>;
+ interrupts = <8>;
++ clocks = <&syscon ASPEED_CLK_GATE_LCLK>;
+ status = "disabled";
+ };
+ };
+diff --git a/arch/arm/boot/dts/aspeed-g5.dtsi b/arch/arm/boot/dts/aspeed-g5.dtsi
+index f2e1015d75ab4..bcd57e6c51e51 100644
+--- a/arch/arm/boot/dts/aspeed-g5.dtsi
++++ b/arch/arm/boot/dts/aspeed-g5.dtsi
+@@ -372,6 +372,7 @@
+ compatible = "aspeed,ast2500-ibt-bmc";
+ reg = <0xc0 0x18>;
+ interrupts = <8>;
++ clocks = <&syscon ASPEED_CLK_GATE_LCLK>;
+ status = "disabled";
+ };
+ };
+diff --git a/arch/arm/boot/dts/exynos3250-artik5.dtsi b/arch/arm/boot/dts/exynos3250-artik5.dtsi
+index 7c22cbf6f3d41..6e30db644c83a 100644
+--- a/arch/arm/boot/dts/exynos3250-artik5.dtsi
++++ b/arch/arm/boot/dts/exynos3250-artik5.dtsi
+@@ -68,7 +68,7 @@
+ s2mps14_pmic@66 {
+ compatible = "samsung,s2mps14-pmic";
+ interrupt-parent = <&gpx3>;
+- interrupts = <5 IRQ_TYPE_NONE>;
++ interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&s2mps14_irq>;
+ reg = <0x66>;
+diff --git a/arch/arm/boot/dts/exynos3250-monk.dts b/arch/arm/boot/dts/exynos3250-monk.dts
+index 6ffedf4ed9f2b..d343dc13ceecd 100644
+--- a/arch/arm/boot/dts/exynos3250-monk.dts
++++ b/arch/arm/boot/dts/exynos3250-monk.dts
+@@ -188,7 +188,7 @@
+ s2mps14_pmic@66 {
+ compatible = "samsung,s2mps14-pmic";
+ interrupt-parent = <&gpx0>;
+- interrupts = <7 IRQ_TYPE_NONE>;
++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ reg = <0x66>;
+ wakeup-source;
+
+diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts
+index 2a6b828c01b7c..29df4cfa9165f 100644
+--- a/arch/arm/boot/dts/exynos3250-rinato.dts
++++ b/arch/arm/boot/dts/exynos3250-rinato.dts
+@@ -253,7 +253,7 @@
+ s2mps14_pmic@66 {
+ compatible = "samsung,s2mps14-pmic";
+ interrupt-parent = <&gpx0>;
+- interrupts = <7 IRQ_TYPE_NONE>;
++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ reg = <0x66>;
+ wakeup-source;
+
+diff --git a/arch/arm/boot/dts/exynos5250-spring.dts b/arch/arm/boot/dts/exynos5250-spring.dts
+index 3d501926c2278..2355c53164840 100644
+--- a/arch/arm/boot/dts/exynos5250-spring.dts
++++ b/arch/arm/boot/dts/exynos5250-spring.dts
+@@ -108,7 +108,7 @@
+ compatible = "samsung,s5m8767-pmic";
+ reg = <0x66>;
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&s5m8767_irq &s5m8767_dvs &s5m8767_ds>;
+ wakeup-source;
+diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+index a370857beac0d..fbaca74cbaea4 100644
+--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts
++++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+@@ -84,7 +84,7 @@
+ reg = <0x66>;
+
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&s2mps11_irq>;
+
+diff --git a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+index d476ba0f07b6b..ba7187a74be36 100644
+--- a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
++++ b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+@@ -136,7 +136,7 @@
+ samsung,s2mps11-acokb-ground;
+
+ interrupt-parent = <&gpx0>;
+- interrupts = <4 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <4 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&s2mps11_irq>;
+
+diff --git a/arch/arm/boot/dts/omap443x.dtsi b/arch/arm/boot/dts/omap443x.dtsi
+index 86b9caf461dfa..6e320efd9fc1d 100644
+--- a/arch/arm/boot/dts/omap443x.dtsi
++++ b/arch/arm/boot/dts/omap443x.dtsi
+@@ -33,10 +33,12 @@
+ };
+
+ ocp {
++ /* 4430 has only gpio_86 tshut and no talert interrupt */
+ bandgap: bandgap@4a002260 {
+ reg = <0x4a002260 0x4
+ 0x4a00232C 0x4>;
+ compatible = "ti,omap4430-bandgap";
++ gpios = <&gpio3 22 GPIO_ACTIVE_HIGH>;
+
+ #thermal-sensor-cells = <0>;
+ };
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 1fe3e5cb29278..1daefa57e2742 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -473,7 +473,7 @@ config ARM64_ERRATUM_1024718
+ help
+ This option adds work around for Arm Cortex-A55 Erratum 1024718.
+
+- Affected Cortex-A55 cores (r0p0, r0p1, r1p0) could cause incorrect
++ Affected Cortex-A55 cores (all revisions) could cause incorrect
+ update of the hardware dirty bit when the DBM/AP bits are updated
+ without a break-before-make. The work around is to disable the usage
+ of hardware DBM locally on the affected cores. CPUs not affected by
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+index 897e60cbe38d1..ecb3e10c85e07 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+@@ -67,8 +67,6 @@
+ };
+
+ &ehci0 {
+- phys = <&usbphy 0>;
+- phy-names = "usb";
+ status = "okay";
+ };
+
+@@ -107,6 +105,7 @@
+ pinctrl-0 = <&mmc2_pins>;
+ vmmc-supply = <®_dcdc1>;
+ vqmmc-supply = <®_eldo1>;
++ max-frequency = <200000000>;
+ bus-width = <8>;
+ non-removable;
+ cap-mmc-hw-reset;
+@@ -115,8 +114,6 @@
+ };
+
+ &ohci0 {
+- phys = <&usbphy 0>;
+- phy-names = "usb";
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
+index 6723b8695e0bb..ca39084fddc0b 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
+@@ -51,7 +51,6 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc0_pins>;
+ vmmc-supply = <®_dcdc1>;
+- non-removable;
+ disable-wp;
+ bus-width = <4>;
+ cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>; /* PF6 */
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index 7abc4ea305410..30cc2e83a288e 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -264,7 +264,7 @@
+ resets = <&ccu RST_BUS_MMC2>;
+ reset-names = "ahb";
+ interrupts = <GIC_SPI 62 IRQ_TYPE_LEVEL_HIGH>;
+- max-frequency = <200000000>;
++ max-frequency = <150000000>;
+ status = "disabled";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -312,6 +312,8 @@
+ <&ccu CLK_USB_OHCI0>;
+ resets = <&ccu RST_BUS_OHCI0>,
+ <&ccu RST_BUS_EHCI0>;
++ phys = <&usbphy 0>;
++ phy-names = "usb";
+ status = "disabled";
+ };
+
+@@ -322,6 +324,8 @@
+ clocks = <&ccu CLK_BUS_OHCI0>,
+ <&ccu CLK_USB_OHCI0>;
+ resets = <&ccu RST_BUS_OHCI0>;
++ phys = <&usbphy 0>;
++ phy-names = "usb";
+ status = "disabled";
+ };
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi b/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
+index a1e3194b74837..d64f97d97c350 100644
+--- a/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
+@@ -378,7 +378,7 @@
+ s2mps13-pmic@66 {
+ compatible = "samsung,s2mps13-pmic";
+ interrupt-parent = <&gpa0>;
+- interrupts = <7 IRQ_TYPE_NONE>;
++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ reg = <0x66>;
+ samsung,s2mps11-wrstbi-ground;
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+index d991eae5202f2..2ba62118ae906 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
++++ b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+@@ -85,7 +85,7 @@
+ s2mps15_pmic@66 {
+ compatible = "samsung,s2mps15-pmic";
+ reg = <0x66>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-parent = <&gpa0>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pmic_irq>;
+diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+index de2c47bdbe646..2bcee994898a2 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -641,6 +641,8 @@
+ clocks = <&pericfg CLK_PERI_MSDC30_1_PD>,
+ <&topckgen CLK_TOP_AXI_SEL>;
+ clock-names = "source", "hclk";
++ resets = <&pericfg MT7622_PERI_MSDC1_SW_RST>;
++ reset-names = "hrst";
+ status = "disabled";
+ };
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210.dtsi b/arch/arm64/boot/dts/nvidia/tegra210.dtsi
+index 6597c0894137a..4eecf3b024688 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210.dtsi
+@@ -826,6 +826,7 @@
+ <&tegra_car 128>, /* hda2hdmi */
+ <&tegra_car 111>; /* hda2codec_2x */
+ reset-names = "hda", "hda2hdmi", "hda2codec_2x";
++ power-domains = <&pd_sor>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 2c5193ae20277..ba42c62399226 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -64,7 +64,7 @@
+ no-map;
+ };
+
+- reserved@8668000 {
++ reserved@86680000 {
+ reg = <0x0 0x86680000 0x0 0x80000>;
+ no-map;
+ };
+@@ -77,7 +77,7 @@
+ qcom,client-id = <1>;
+ };
+
+- rfsa@867e00000 {
++ rfsa@867e0000 {
+ reg = <0x0 0x867e0000 0x0 0x20000>;
+ no-map;
+ };
+diff --git a/arch/arm64/crypto/sha1-ce-glue.c b/arch/arm64/crypto/sha1-ce-glue.c
+index d8c521c757e83..3f51743c01d86 100644
+--- a/arch/arm64/crypto/sha1-ce-glue.c
++++ b/arch/arm64/crypto/sha1-ce-glue.c
+@@ -21,6 +21,7 @@
+ MODULE_DESCRIPTION("SHA1 secure hash using ARMv8 Crypto Extensions");
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
++MODULE_ALIAS_CRYPTO("sha1");
+
+ struct sha1_ce_state {
+ struct sha1_state sst;
+diff --git a/arch/arm64/crypto/sha2-ce-glue.c b/arch/arm64/crypto/sha2-ce-glue.c
+index c47d1a28ff6bb..4022c51a377bf 100644
+--- a/arch/arm64/crypto/sha2-ce-glue.c
++++ b/arch/arm64/crypto/sha2-ce-glue.c
+@@ -21,6 +21,8 @@
+ MODULE_DESCRIPTION("SHA-224/SHA-256 secure hash using ARMv8 Crypto Extensions");
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
++MODULE_ALIAS_CRYPTO("sha224");
++MODULE_ALIAS_CRYPTO("sha256");
+
+ struct sha256_ce_state {
+ struct sha256_state sst;
+diff --git a/arch/arm64/crypto/sha3-ce-glue.c b/arch/arm64/crypto/sha3-ce-glue.c
+index a336feac0f59a..df20ab645487c 100644
+--- a/arch/arm64/crypto/sha3-ce-glue.c
++++ b/arch/arm64/crypto/sha3-ce-glue.c
+@@ -22,6 +22,10 @@
+ MODULE_DESCRIPTION("SHA3 secure hash using ARMv8 Crypto Extensions");
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
++MODULE_ALIAS_CRYPTO("sha3-224");
++MODULE_ALIAS_CRYPTO("sha3-256");
++MODULE_ALIAS_CRYPTO("sha3-384");
++MODULE_ALIAS_CRYPTO("sha3-512");
+
+ asmlinkage void sha3_ce_transform(u64 *st, const u8 *data, int blocks,
+ int md_len);
+diff --git a/arch/arm64/crypto/sha512-ce-glue.c b/arch/arm64/crypto/sha512-ce-glue.c
+index f2c5f28c622ac..2871e68ae3df4 100644
+--- a/arch/arm64/crypto/sha512-ce-glue.c
++++ b/arch/arm64/crypto/sha512-ce-glue.c
+@@ -22,6 +22,8 @@
+ MODULE_DESCRIPTION("SHA-384/SHA-512 secure hash using ARMv8 Crypto Extensions");
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
++MODULE_ALIAS_CRYPTO("sha384");
++MODULE_ALIAS_CRYPTO("sha512");
+
+ asmlinkage void sha512_ce_transform(struct sha512_state *sst, u8 const *src,
+ int blocks);
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index de6fa9b4abfa0..1719d21a171a9 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -1012,7 +1012,7 @@ static bool cpu_has_broken_dbm(void)
+ /* List of CPUs which have broken DBM support. */
+ static const struct midr_range cpus[] = {
+ #ifdef CONFIG_ARM64_ERRATUM_1024718
+- MIDR_RANGE(MIDR_CORTEX_A55, 0, 0, 1, 0), // A55 r0p0 -r1p0
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A55),
+ #endif
+ {},
+ };
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index d22ab8d9edc95..c85ea70b92936 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -867,6 +867,7 @@ __primary_switch:
+
+ tlbi vmalle1 // Remove any stale TLB entries
+ dsb nsh
++ isb
+
+ msr sctlr_el1, x19 // re-enable the MMU
+ isb
+diff --git a/arch/arm64/kernel/probes/uprobes.c b/arch/arm64/kernel/probes/uprobes.c
+index 636ca0119c0ef..6aeb11aa7e283 100644
+--- a/arch/arm64/kernel/probes/uprobes.c
++++ b/arch/arm64/kernel/probes/uprobes.c
+@@ -41,7 +41,7 @@ int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
+
+ /* TODO: Currently we do not support AARCH32 instruction probing */
+ if (mm->context.flags & MMCF_AARCH32)
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+ else if (!IS_ALIGNED(addr, AARCH64_INSN_SIZE))
+ return -EINVAL;
+
+diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
+index be63fff95b2ab..968c5765020c9 100644
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -93,6 +93,7 @@ SECTIONS
+
+ INIT_TASK_DATA(THREAD_SIZE)
+ NOSAVE_DATA
++ PAGE_ALIGNED_DATA(PAGE_SIZE)
+ CACHELINE_ALIGNED_DATA(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
+ READ_MOSTLY_DATA(1 << CONFIG_MIPS_L1_CACHE_SHIFT)
+ DATA_DATA
+diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
+index 37caeadb2964c..0476d7e97a03f 100644
+--- a/arch/mips/lantiq/irq.c
++++ b/arch/mips/lantiq/irq.c
+@@ -244,7 +244,7 @@ static void ltq_hw_irq_handler(struct irq_desc *desc)
+ generic_handle_irq(irq_linear_revmap(ltq_domain, hwirq));
+
+ /* if this is a EBU irq, we need to ack it or get a deadlock */
+- if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
++ if (irq == LTQ_ICU_EBU_IRQ && !module && LTQ_EBU_PCC_ISTAT != 0)
+ ltq_ebu_w32(ltq_ebu_r32(LTQ_EBU_PCC_ISTAT) | 0x10,
+ LTQ_EBU_PCC_ISTAT);
+ }
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index 7650edd5cf7ff..60fe72170856d 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -1673,7 +1673,7 @@ static int probe_scache(void)
+ return 1;
+ }
+
+-static void __init loongson2_sc_init(void)
++static void loongson2_sc_init(void)
+ {
+ struct cpuinfo_mips *c = ¤t_cpu_data;
+
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index d18ea3c1f4fac..6dd2a14e1ebcd 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -709,7 +709,7 @@ config PPC_64K_PAGES
+
+ config PPC_256K_PAGES
+ bool "256k page size"
+- depends on 44x && !STDBINUTILS
++ depends on 44x && !STDBINUTILS && !PPC_47x
+ help
+ Make the page size 256k.
+
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index dc99258f2e8c6..08c16aa0dd534 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -269,7 +269,7 @@ SystemCall:
+ /* On the MPC8xx, this is a software emulation interrupt. It occurs
+ * for all unimplemented and illegal instructions.
+ */
+- EXCEPTION(0x1000, SoftEmu, program_check_exception, EXC_XFER_STD)
++ EXCEPTION(0x1000, SoftEmu, emulation_assist_interrupt, EXC_XFER_STD)
+
+ . = 0x1100
+ /*
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index 51cd66dc1bb09..7c8354dfe80e2 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -1497,7 +1497,7 @@ int kvmppc_handle_vmx_load(struct kvm_run *run, struct kvm_vcpu *vcpu,
+ return emulated;
+ }
+
+-int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ union kvmppc_one_reg reg;
+ int vmx_offset = 0;
+@@ -1515,7 +1515,7 @@ int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ return result;
+ }
+
+-int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ union kvmppc_one_reg reg;
+ int vmx_offset = 0;
+@@ -1533,7 +1533,7 @@ int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val)
+ return result;
+ }
+
+-int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ union kvmppc_one_reg reg;
+ int vmx_offset = 0;
+@@ -1551,7 +1551,7 @@ int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ return result;
+ }
+
+-int kvmppc_get_vmx_byte(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_byte(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ union kvmppc_one_reg reg;
+ int vmx_offset = 0;
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index c5ffcadab7302..90fd03b9d3c25 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -132,7 +132,6 @@ void dlpar_free_cc_nodes(struct device_node *dn)
+ #define NEXT_PROPERTY 3
+ #define PREV_PARENT 4
+ #define MORE_MEMORY 5
+-#define CALL_AGAIN -2
+ #define ERR_CFG_USE -9003
+
+ struct device_node *dlpar_configure_connector(__be32 drc_index,
+@@ -173,6 +172,9 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
+
+ spin_unlock(&rtas_data_buf_lock);
+
++ if (rtas_busy_delay(rc))
++ continue;
++
+ switch (rc) {
+ case COMPLETE:
+ break;
+@@ -221,9 +223,6 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
+ last_dn = last_dn->parent;
+ break;
+
+- case CALL_AGAIN:
+- break;
+-
+ case MORE_MEMORY:
+ case ERR_CFG_USE:
+ default:
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index e6f2a38d2e61e..1f1a7583fa905 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -554,7 +554,7 @@ config COMPAT
+ bool
+ depends on SPARC64
+ default y
+- select COMPAT_BINFMT_ELF
++ select COMPAT_BINFMT_ELF if BINFMT_ELF
+ select HAVE_UID16
+ select ARCH_WANT_OLD_COMPAT_IPC
+ select COMPAT_OLD_SIGACTION
+diff --git a/arch/sparc/lib/memset.S b/arch/sparc/lib/memset.S
+index b89d42b29e344..f427f34b8b79b 100644
+--- a/arch/sparc/lib/memset.S
++++ b/arch/sparc/lib/memset.S
+@@ -142,6 +142,7 @@ __bzero:
+ ZERO_LAST_BLOCKS(%o0, 0x48, %g2)
+ ZERO_LAST_BLOCKS(%o0, 0x08, %g2)
+ 13:
++ EXT(12b, 13b, 21f)
+ be 8f
+ andcc %o1, 4, %g0
+
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 39f3cad58b6cd..a19706bee6874 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -538,29 +538,20 @@ static void emergency_vmx_disable_all(void)
+ local_irq_disable();
+
+ /*
+- * We need to disable VMX on all CPUs before rebooting, otherwise
+- * we risk hanging up the machine, because the CPU ignore INIT
+- * signals when VMX is enabled.
++ * Disable VMX on all CPUs before rebooting, otherwise we risk hanging
++ * the machine, because the CPU blocks INIT when it's in VMX root.
+ *
+- * We can't take any locks and we may be on an inconsistent
+- * state, so we use NMIs as IPIs to tell the other CPUs to disable
+- * VMX and halt.
++ * We can't take any locks and we may be on an inconsistent state, so
++ * use NMIs as IPIs to tell the other CPUs to exit VMX root and halt.
+ *
+- * For safety, we will avoid running the nmi_shootdown_cpus()
+- * stuff unnecessarily, but we don't have a way to check
+- * if other CPUs have VMX enabled. So we will call it only if the
+- * CPU we are running on has VMX enabled.
+- *
+- * We will miss cases where VMX is not enabled on all CPUs. This
+- * shouldn't do much harm because KVM always enable VMX on all
+- * CPUs anyway. But we can miss it on the small window where KVM
+- * is still enabling VMX.
++ * Do the NMI shootdown even if VMX if off on _this_ CPU, as that
++ * doesn't prevent a different CPU from being in VMX root operation.
+ */
+- if (cpu_has_vmx() && cpu_vmx_enabled()) {
+- /* Disable VMX on this CPU. */
+- cpu_vmxoff();
++ if (cpu_has_vmx()) {
++ /* Safely force _this_ CPU out of VMX root operation. */
++ __cpu_emergency_vmxoff();
+
+- /* Halt and disable VMX on the other CPUs */
++ /* Halt and exit VMX root operation on the other CPUs. */
+ nmi_shootdown_cpus(vmxoff_nmi);
+
+ }
+diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
+index a3c9ea29d7cc3..324e26d0607ba 100644
+--- a/arch/x86/mm/pat.c
++++ b/arch/x86/mm/pat.c
+@@ -1131,12 +1131,14 @@ static void *memtype_seq_start(struct seq_file *seq, loff_t *pos)
+
+ static void *memtype_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
++ kfree(v);
+ ++*pos;
+ return memtype_get_idx(*pos);
+ }
+
+ static void memtype_seq_stop(struct seq_file *seq, void *v)
+ {
++ kfree(v);
+ }
+
+ static int memtype_seq_show(struct seq_file *seq, void *v)
+@@ -1145,7 +1147,6 @@ static int memtype_seq_show(struct seq_file *seq, void *v)
+
+ seq_printf(seq, "%s @ 0x%Lx-0x%Lx\n", cattr_name(print_entry->type),
+ print_entry->start, print_entry->end);
+- kfree(print_entry);
+
+ return 0;
+ }
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 5198ed1b36690..d984592b0995e 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2478,6 +2478,7 @@ static void __bfq_set_in_service_queue(struct bfq_data *bfqd,
+ }
+
+ bfqd->in_service_queue = bfqq;
++ bfqd->in_serv_last_pos = 0;
+ }
+
+ /*
+diff --git a/block/blk-core.c b/block/blk-core.c
+index ce3710404544c..80f3e729fdd4d 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -1059,6 +1059,7 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id,
+ mutex_init(&q->blk_trace_mutex);
+ #endif
+ mutex_init(&q->sysfs_lock);
++ mutex_init(&q->sysfs_dir_lock);
+ spin_lock_init(&q->__queue_lock);
+
+ if (!q->mq_ops)
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 5006a0d009901..5e4b7ed1e897a 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -264,7 +264,7 @@ void blk_mq_unregister_dev(struct device *dev, struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ int i;
+
+- lockdep_assert_held(&q->sysfs_lock);
++ lockdep_assert_held(&q->sysfs_dir_lock);
+
+ queue_for_each_hw_ctx(q, hctx, i)
+ blk_mq_unregister_hctx(hctx);
+@@ -312,7 +312,7 @@ int __blk_mq_register_dev(struct device *dev, struct request_queue *q)
+ int ret, i;
+
+ WARN_ON_ONCE(!q->kobj.parent);
+- lockdep_assert_held(&q->sysfs_lock);
++ lockdep_assert_held(&q->sysfs_dir_lock);
+
+ ret = kobject_add(&q->mq_kobj, kobject_get(&dev->kobj), "%s", "mq");
+ if (ret < 0)
+@@ -358,7 +358,7 @@ void blk_mq_sysfs_unregister(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ int i;
+
+- mutex_lock(&q->sysfs_lock);
++ mutex_lock(&q->sysfs_dir_lock);
+ if (!q->mq_sysfs_init_done)
+ goto unlock;
+
+@@ -366,7 +366,7 @@ void blk_mq_sysfs_unregister(struct request_queue *q)
+ blk_mq_unregister_hctx(hctx);
+
+ unlock:
+- mutex_unlock(&q->sysfs_lock);
++ mutex_unlock(&q->sysfs_dir_lock);
+ }
+
+ int blk_mq_sysfs_register(struct request_queue *q)
+@@ -374,7 +374,7 @@ int blk_mq_sysfs_register(struct request_queue *q)
+ struct blk_mq_hw_ctx *hctx;
+ int i, ret = 0;
+
+- mutex_lock(&q->sysfs_lock);
++ mutex_lock(&q->sysfs_dir_lock);
+ if (!q->mq_sysfs_init_done)
+ goto unlock;
+
+@@ -385,7 +385,7 @@ int blk_mq_sysfs_register(struct request_queue *q)
+ }
+
+ unlock:
+- mutex_unlock(&q->sysfs_lock);
++ mutex_unlock(&q->sysfs_dir_lock);
+
+ return ret;
+ }
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 01093b8f3e624..2c01b6f651102 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -513,6 +513,14 @@ void blk_queue_io_opt(struct request_queue *q, unsigned int opt)
+ }
+ EXPORT_SYMBOL(blk_queue_io_opt);
+
++static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lbs)
++{
++ sectors = round_down(sectors, lbs >> SECTOR_SHIFT);
++ if (sectors < PAGE_SIZE >> SECTOR_SHIFT)
++ sectors = PAGE_SIZE >> SECTOR_SHIFT;
++ return sectors;
++}
++
+ /**
+ * blk_queue_stack_limits - inherit underlying queue limits for stacked drivers
+ * @t: the stacking driver (top)
+@@ -639,6 +647,10 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+ ret = -1;
+ }
+
++ t->max_sectors = blk_round_down_sectors(t->max_sectors, t->logical_block_size);
++ t->max_hw_sectors = blk_round_down_sectors(t->max_hw_sectors, t->logical_block_size);
++ t->max_dev_sectors = blk_round_down_sectors(t->max_dev_sectors, t->logical_block_size);
++
+ /* Discard alignment and granularity */
+ if (b->discard_granularity) {
+ alignment = queue_limit_discard_alignment(b, start);
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 8286640d4d663..07494deb1a26f 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -892,14 +892,14 @@ int blk_register_queue(struct gendisk *disk)
+ int ret;
+ struct device *dev = disk_to_dev(disk);
+ struct request_queue *q = disk->queue;
++ bool has_elevator = false;
+
+ if (WARN_ON(!q))
+ return -ENXIO;
+
+- WARN_ONCE(test_bit(QUEUE_FLAG_REGISTERED, &q->queue_flags),
++ WARN_ONCE(blk_queue_registered(q),
+ "%s is registering an already registered queue\n",
+ kobject_name(&dev->kobj));
+- queue_flag_set_unlocked(QUEUE_FLAG_REGISTERED, q);
+
+ /*
+ * SCSI probing may synchronously create and destroy a lot of
+@@ -920,8 +920,7 @@ int blk_register_queue(struct gendisk *disk)
+ if (ret)
+ return ret;
+
+- /* Prevent changes through sysfs until registration is completed. */
+- mutex_lock(&q->sysfs_lock);
++ mutex_lock(&q->sysfs_dir_lock);
+
+ ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue");
+ if (ret < 0) {
+@@ -934,26 +933,37 @@ int blk_register_queue(struct gendisk *disk)
+ blk_mq_debugfs_register(q);
+ }
+
+- kobject_uevent(&q->kobj, KOBJ_ADD);
+-
+- wbt_enable_default(q);
+-
+- blk_throtl_register_queue(q);
+-
++ mutex_lock(&q->sysfs_lock);
++ /*
++ * The flag of QUEUE_FLAG_REGISTERED isn't set yet, so elevator
++ * switch won't happen at all.
++ */
+ if (q->request_fn || (q->mq_ops && q->elevator)) {
+- ret = elv_register_queue(q);
++ ret = elv_register_queue(q, false);
+ if (ret) {
+ mutex_unlock(&q->sysfs_lock);
+- kobject_uevent(&q->kobj, KOBJ_REMOVE);
++ mutex_unlock(&q->sysfs_dir_lock);
+ kobject_del(&q->kobj);
+ blk_trace_remove_sysfs(dev);
+ kobject_put(&dev->kobj);
+ return ret;
+ }
++ has_elevator = true;
+ }
++
++ blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q);
++ wbt_enable_default(q);
++ blk_throtl_register_queue(q);
++
++ /* Now everything is ready and send out KOBJ_ADD uevent */
++ kobject_uevent(&q->kobj, KOBJ_ADD);
++ if (has_elevator)
++ kobject_uevent(&q->elevator->kobj, KOBJ_ADD);
++ mutex_unlock(&q->sysfs_lock);
++
+ ret = 0;
+ unlock:
+- mutex_unlock(&q->sysfs_lock);
++ mutex_unlock(&q->sysfs_dir_lock);
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(blk_register_queue);
+@@ -973,7 +983,7 @@ void blk_unregister_queue(struct gendisk *disk)
+ return;
+
+ /* Return early if disk->queue was never registered. */
+- if (!test_bit(QUEUE_FLAG_REGISTERED, &q->queue_flags))
++ if (!blk_queue_registered(q))
+ return;
+
+ /*
+@@ -982,25 +992,30 @@ void blk_unregister_queue(struct gendisk *disk)
+ * concurrent elv_iosched_store() calls.
+ */
+ mutex_lock(&q->sysfs_lock);
+-
+ blk_queue_flag_clear(QUEUE_FLAG_REGISTERED, q);
++ mutex_unlock(&q->sysfs_lock);
+
++ mutex_lock(&q->sysfs_dir_lock);
+ /*
+ * Remove the sysfs attributes before unregistering the queue data
+ * structures that can be modified through sysfs.
+ */
+ if (q->mq_ops)
+ blk_mq_unregister_dev(disk_to_dev(disk), q);
+- mutex_unlock(&q->sysfs_lock);
+
+ kobject_uevent(&q->kobj, KOBJ_REMOVE);
+ kobject_del(&q->kobj);
+ blk_trace_remove_sysfs(disk_to_dev(disk));
+
+ mutex_lock(&q->sysfs_lock);
+- if (q->request_fn || (q->mq_ops && q->elevator))
++ /*
++ * q->kobj has been removed, so it is safe to check if elevator
++ * exists without holding q->sysfs_lock.
++ */
++ if (q->request_fn || q->elevator)
+ elv_unregister_queue(q);
+ mutex_unlock(&q->sysfs_lock);
++ mutex_unlock(&q->sysfs_dir_lock);
+
+ kobject_put(&disk_to_dev(disk)->kobj);
+ }
+diff --git a/block/blk-wbt.c b/block/blk-wbt.c
+index f1de8ba483a97..50f2abfa1a60e 100644
+--- a/block/blk-wbt.c
++++ b/block/blk-wbt.c
+@@ -708,7 +708,7 @@ void wbt_enable_default(struct request_queue *q)
+ return;
+
+ /* Queue not registered? Maybe shutting down... */
+- if (!test_bit(QUEUE_FLAG_REGISTERED, &q->queue_flags))
++ if (!blk_queue_registered(q))
+ return;
+
+ if ((q->mq_ops && IS_ENABLED(CONFIG_BLK_WBT_MQ)) ||
+diff --git a/block/blk.h b/block/blk.h
+index 1a5b67b57e6b2..ae87e2a5f2bd1 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -244,7 +244,7 @@ int elevator_init_mq(struct request_queue *q);
+ int elevator_switch_mq(struct request_queue *q,
+ struct elevator_type *new_e);
+ void elevator_exit(struct request_queue *, struct elevator_queue *);
+-int elv_register_queue(struct request_queue *q);
++int elv_register_queue(struct request_queue *q, bool uevent);
+ void elv_unregister_queue(struct request_queue *q);
+
+ struct hd_struct *__disk_get_part(struct gendisk *disk, int partno);
+diff --git a/block/elevator.c b/block/elevator.c
+index ddbcd36616a8d..5b51bc5fad9fe 100644
+--- a/block/elevator.c
++++ b/block/elevator.c
+@@ -833,13 +833,16 @@ static struct kobj_type elv_ktype = {
+ .release = elevator_release,
+ };
+
+-int elv_register_queue(struct request_queue *q)
++/*
++ * elv_register_queue is called from either blk_register_queue or
++ * elevator_switch, elevator switch is prevented from being happen
++ * in the two paths, so it is safe to not hold q->sysfs_lock.
++ */
++int elv_register_queue(struct request_queue *q, bool uevent)
+ {
+ struct elevator_queue *e = q->elevator;
+ int error;
+
+- lockdep_assert_held(&q->sysfs_lock);
+-
+ error = kobject_add(&e->kobj, &q->kobj, "%s", "iosched");
+ if (!error) {
+ struct elv_fs_entry *attr = e->type->elevator_attrs;
+@@ -850,7 +853,9 @@ int elv_register_queue(struct request_queue *q)
+ attr++;
+ }
+ }
+- kobject_uevent(&e->kobj, KOBJ_ADD);
++ if (uevent)
++ kobject_uevent(&e->kobj, KOBJ_ADD);
++
+ e->registered = 1;
+ if (!e->uses_mq && e->type->ops.sq.elevator_registered_fn)
+ e->type->ops.sq.elevator_registered_fn(q);
+@@ -858,15 +863,19 @@ int elv_register_queue(struct request_queue *q)
+ return error;
+ }
+
++/*
++ * elv_unregister_queue is called from either blk_unregister_queue or
++ * elevator_switch, elevator switch is prevented from being happen
++ * in the two paths, so it is safe to not hold q->sysfs_lock.
++ */
+ void elv_unregister_queue(struct request_queue *q)
+ {
+- lockdep_assert_held(&q->sysfs_lock);
+-
+ if (q) {
+ struct elevator_queue *e = q->elevator;
+
+ kobject_uevent(&e->kobj, KOBJ_REMOVE);
+ kobject_del(&e->kobj);
++
+ e->registered = 0;
+ /* Re-enable throttling in case elevator disabled it */
+ wbt_enable_default(q);
+@@ -942,6 +951,7 @@ int elevator_switch_mq(struct request_queue *q,
+ if (q->elevator) {
+ if (q->elevator->registered)
+ elv_unregister_queue(q);
++
+ ioc_clear_queue(q);
+ elevator_exit(q, q->elevator);
+ }
+@@ -951,7 +961,7 @@ int elevator_switch_mq(struct request_queue *q,
+ goto out;
+
+ if (new_e) {
+- ret = elv_register_queue(q);
++ ret = elv_register_queue(q, true);
+ if (ret) {
+ elevator_exit(q, q->elevator);
+ goto out;
+@@ -1047,7 +1057,7 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
+ if (err)
+ goto fail_init;
+
+- err = elv_register_queue(q);
++ err = elv_register_queue(q, true);
+ if (err)
+ goto fail_register;
+
+@@ -1067,7 +1077,7 @@ fail_init:
+ /* switch failed, restore and re-register old elevator */
+ if (old) {
+ q->elevator = old;
+- elv_register_queue(q);
++ elv_register_queue(q, true);
+ blk_queue_bypass_end(q);
+ }
+
+@@ -1083,7 +1093,7 @@ static int __elevator_change(struct request_queue *q, const char *name)
+ struct elevator_type *e;
+
+ /* Make sure queue is not in the middle of being removed */
+- if (!test_bit(QUEUE_FLAG_REGISTERED, &q->queue_flags))
++ if (!blk_queue_registered(q))
+ return -ENOENT;
+
+ /*
+diff --git a/certs/blacklist.c b/certs/blacklist.c
+index 3a507b9e2568a..e9f3f81c51f96 100644
+--- a/certs/blacklist.c
++++ b/certs/blacklist.c
+@@ -157,7 +157,7 @@ static int __init blacklist_init(void)
+ KEY_USR_VIEW | KEY_USR_READ |
+ KEY_USR_SEARCH,
+ KEY_ALLOC_NOT_IN_QUOTA |
+- KEY_FLAG_KEEP,
++ KEY_ALLOC_SET_KEEP,
+ NULL, NULL);
+ if (IS_ERR(blacklist_keyring))
+ panic("Can't allocate system blacklist keyring\n");
+diff --git a/crypto/ecdh_helper.c b/crypto/ecdh_helper.c
+index d3af8e8b0b5e4..25711de445848 100644
+--- a/crypto/ecdh_helper.c
++++ b/crypto/ecdh_helper.c
+@@ -71,6 +71,9 @@ int crypto_ecdh_decode_key(const char *buf, unsigned int len,
+ if (secret.type != CRYPTO_KPP_SECRET_TYPE_ECDH)
+ return -EINVAL;
+
++ if (unlikely(len < secret.len))
++ return -EINVAL;
++
+ ptr = ecdh_unpack_data(¶ms->curve_id, ptr, sizeof(params->curve_id));
+ ptr = ecdh_unpack_data(¶ms->key_size, ptr, sizeof(params->key_size));
+ if (secret.len != crypto_ecdh_key_len(params))
+diff --git a/drivers/acpi/acpi_configfs.c b/drivers/acpi/acpi_configfs.c
+index b588503890941..c0325556a897b 100644
+--- a/drivers/acpi/acpi_configfs.c
++++ b/drivers/acpi/acpi_configfs.c
+@@ -269,7 +269,12 @@ static int __init acpi_configfs_init(void)
+
+ acpi_table_group = configfs_register_default_group(root, "table",
+ &acpi_tables_type);
+- return PTR_ERR_OR_ZERO(acpi_table_group);
++ if (IS_ERR(acpi_table_group)) {
++ configfs_unregister_subsystem(&acpi_configfs);
++ return PTR_ERR(acpi_table_group);
++ }
++
++ return 0;
+ }
+ module_init(acpi_configfs_init);
+
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index 288673cff85ea..27db1a968241b 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -720,9 +720,6 @@ static int acpi_data_prop_read_single(const struct acpi_device_data *data,
+ const union acpi_object *obj;
+ int ret;
+
+- if (!val)
+- return -EINVAL;
+-
+ if (proptype >= DEV_PROP_U8 && proptype <= DEV_PROP_U64) {
+ ret = acpi_data_get_property(data, propname, ACPI_TYPE_INTEGER, &obj);
+ if (ret)
+@@ -732,28 +729,43 @@ static int acpi_data_prop_read_single(const struct acpi_device_data *data,
+ case DEV_PROP_U8:
+ if (obj->integer.value > U8_MAX)
+ return -EOVERFLOW;
+- *(u8 *)val = obj->integer.value;
++
++ if (val)
++ *(u8 *)val = obj->integer.value;
++
+ break;
+ case DEV_PROP_U16:
+ if (obj->integer.value > U16_MAX)
+ return -EOVERFLOW;
+- *(u16 *)val = obj->integer.value;
++
++ if (val)
++ *(u16 *)val = obj->integer.value;
++
+ break;
+ case DEV_PROP_U32:
+ if (obj->integer.value > U32_MAX)
+ return -EOVERFLOW;
+- *(u32 *)val = obj->integer.value;
++
++ if (val)
++ *(u32 *)val = obj->integer.value;
++
+ break;
+ default:
+- *(u64 *)val = obj->integer.value;
++ if (val)
++ *(u64 *)val = obj->integer.value;
++
+ break;
+ }
++
++ if (!val)
++ return 1;
+ } else if (proptype == DEV_PROP_STRING) {
+ ret = acpi_data_get_property(data, propname, ACPI_TYPE_STRING, &obj);
+ if (ret)
+ return ret;
+
+- *(char **)val = obj->string.pointer;
++ if (val)
++ *(char **)val = obj->string.pointer;
+
+ return 1;
+ } else {
+@@ -767,7 +779,7 @@ int acpi_dev_prop_read_single(struct acpi_device *adev, const char *propname,
+ {
+ int ret;
+
+- if (!adev)
++ if (!adev || !val)
+ return -EINVAL;
+
+ ret = acpi_data_prop_read_single(&adev->data, propname, proptype, val);
+@@ -861,10 +873,20 @@ static int acpi_data_prop_read(const struct acpi_device_data *data,
+ const union acpi_object *items;
+ int ret;
+
+- if (val && nval == 1) {
++ if (nval == 1 || !val) {
+ ret = acpi_data_prop_read_single(data, propname, proptype, val);
+- if (ret >= 0)
++ /*
++ * The overflow error means that the property is there and it is
++ * single-value, but its type does not match, so return.
++ */
++ if (ret >= 0 || ret == -EOVERFLOW)
+ return ret;
++
++ /*
++ * Reading this property as a single-value one failed, but its
++ * value may still be represented as one-element array, so
++ * continue.
++ */
+ }
+
+ ret = acpi_data_get_property_array(data, propname, ACPI_TYPE_ANY, &obj);
+diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
+index 41b706403ef72..2380ebd9b7fda 100644
+--- a/drivers/amba/bus.c
++++ b/drivers/amba/bus.c
+@@ -284,10 +284,11 @@ static int amba_remove(struct device *dev)
+ {
+ struct amba_device *pcdev = to_amba_device(dev);
+ struct amba_driver *drv = to_amba_driver(dev->driver);
+- int ret;
++ int ret = 0;
+
+ pm_runtime_get_sync(dev);
+- ret = drv->remove(pcdev);
++ if (drv->remove)
++ ret = drv->remove(pcdev);
+ pm_runtime_put_noidle(dev);
+
+ /* Undo the runtime PM settings in amba_probe() */
+@@ -304,7 +305,9 @@ static int amba_remove(struct device *dev)
+ static void amba_shutdown(struct device *dev)
+ {
+ struct amba_driver *drv = to_amba_driver(dev->driver);
+- drv->shutdown(to_amba_device(dev));
++
++ if (drv->shutdown)
++ drv->shutdown(to_amba_device(dev));
+ }
+
+ /**
+@@ -317,12 +320,13 @@ static void amba_shutdown(struct device *dev)
+ */
+ int amba_driver_register(struct amba_driver *drv)
+ {
+- drv->drv.bus = &amba_bustype;
++ if (!drv->probe)
++ return -EINVAL;
+
+-#define SETFN(fn) if (drv->fn) drv->drv.fn = amba_##fn
+- SETFN(probe);
+- SETFN(remove);
+- SETFN(shutdown);
++ drv->drv.bus = &amba_bustype;
++ drv->drv.probe = amba_probe;
++ drv->drv.remove = amba_remove;
++ drv->drv.shutdown = amba_shutdown;
+
+ return driver_register(&drv->drv);
+ }
+diff --git a/drivers/ata/ahci_brcm.c b/drivers/ata/ahci_brcm.c
+index 0192cab1b862f..e58b336d1324c 100644
+--- a/drivers/ata/ahci_brcm.c
++++ b/drivers/ata/ahci_brcm.c
+@@ -370,6 +370,10 @@ static int brcm_ahci_resume(struct device *dev)
+ if (ret)
+ return ret;
+
++ ret = ahci_platform_enable_regulators(hpriv);
++ if (ret)
++ goto out_disable_clks;
++
+ brcm_sata_init(priv);
+ brcm_sata_phys_enable(priv);
+ brcm_sata_alpm_init(hpriv);
+@@ -399,6 +403,8 @@ out_disable_platform_phys:
+ ahci_platform_disable_phys(hpriv);
+ out_disable_phys:
+ brcm_sata_phys_disable(priv);
++ ahci_platform_disable_regulators(hpriv);
++out_disable_clks:
+ ahci_platform_disable_clks(hpriv);
+ return ret;
+ }
+@@ -471,6 +477,10 @@ static int brcm_ahci_probe(struct platform_device *pdev)
+ if (ret)
+ goto out_reset;
+
++ ret = ahci_platform_enable_regulators(hpriv);
++ if (ret)
++ goto out_disable_clks;
++
+ /* Must be first so as to configure endianness including that
+ * of the standard AHCI register space.
+ */
+@@ -480,7 +490,7 @@ static int brcm_ahci_probe(struct platform_device *pdev)
+ priv->port_mask = brcm_ahci_get_portmask(hpriv, priv);
+ if (!priv->port_mask) {
+ ret = -ENODEV;
+- goto out_disable_clks;
++ goto out_disable_regulators;
+ }
+
+ /* Must be done before ahci_platform_enable_phys() */
+@@ -505,6 +515,8 @@ out_disable_platform_phys:
+ ahci_platform_disable_phys(hpriv);
+ out_disable_phys:
+ brcm_sata_phys_disable(priv);
++out_disable_regulators:
++ ahci_platform_disable_regulators(hpriv);
+ out_disable_clks:
+ ahci_platform_disable_clks(hpriv);
+ out_reset:
+diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
+index 21393ec3b9a4a..194370ae37dd0 100644
+--- a/drivers/auxdisplay/ht16k33.c
++++ b/drivers/auxdisplay/ht16k33.c
+@@ -117,8 +117,7 @@ static void ht16k33_fb_queue(struct ht16k33_priv *priv)
+ {
+ struct ht16k33_fbdev *fbdev = &priv->fbdev;
+
+- schedule_delayed_work(&fbdev->work,
+- msecs_to_jiffies(HZ / fbdev->refresh_rate));
++ schedule_delayed_work(&fbdev->work, HZ / fbdev->refresh_rate);
+ }
+
+ /*
+diff --git a/drivers/base/regmap/regmap-sdw.c b/drivers/base/regmap/regmap-sdw.c
+index 50a66382d87d0..e75168b941d0c 100644
+--- a/drivers/base/regmap/regmap-sdw.c
++++ b/drivers/base/regmap/regmap-sdw.c
+@@ -12,7 +12,7 @@ static int regmap_sdw_write(void *context, unsigned int reg, unsigned int val)
+ struct device *dev = context;
+ struct sdw_slave *slave = dev_to_sdw_dev(dev);
+
+- return sdw_write(slave, reg, val);
++ return sdw_write_no_pm(slave, reg, val);
+ }
+
+ static int regmap_sdw_read(void *context, unsigned int reg, unsigned int *val)
+@@ -21,7 +21,7 @@ static int regmap_sdw_read(void *context, unsigned int reg, unsigned int *val)
+ struct sdw_slave *slave = dev_to_sdw_dev(dev);
+ int read;
+
+- read = sdw_read(slave, reg);
++ read = sdw_read_no_pm(slave, reg);
+ if (read < 0)
+ return read;
+
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index bf222c4b2f82f..56d4c7df91857 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -4074,21 +4074,22 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+ if (UFDCS->rawcmd == 1)
+ UFDCS->rawcmd = 2;
+
+- if (!(mode & FMODE_NDELAY)) {
+- if (mode & (FMODE_READ|FMODE_WRITE)) {
+- UDRS->last_checked = 0;
+- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+- check_disk_change(bdev);
+- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+- goto out;
+- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+- goto out;
+- }
+- res = -EROFS;
+- if ((mode & FMODE_WRITE) &&
+- !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
++ if (mode & (FMODE_READ|FMODE_WRITE)) {
++ UDRS->last_checked = 0;
++ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
++ check_disk_change(bdev);
++ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
++ goto out;
++ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+ goto out;
+ }
++
++ res = -EROFS;
++
++ if ((mode & FMODE_WRITE) &&
++ !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
++ goto out;
++
+ mutex_unlock(&open_lock);
+ mutex_unlock(&floppy_mutex);
+ return 0;
+diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c
+index 7df3eed1ef5e9..874172aa8e417 100644
+--- a/drivers/bluetooth/btqcomsmd.c
++++ b/drivers/bluetooth/btqcomsmd.c
+@@ -166,8 +166,10 @@ static int btqcomsmd_probe(struct platform_device *pdev)
+
+ btq->cmd_channel = qcom_wcnss_open_channel(wcnss, "APPS_RIVA_BT_CMD",
+ btqcomsmd_cmd_callback, btq);
+- if (IS_ERR(btq->cmd_channel))
+- return PTR_ERR(btq->cmd_channel);
++ if (IS_ERR(btq->cmd_channel)) {
++ ret = PTR_ERR(btq->cmd_channel);
++ goto destroy_acl_channel;
++ }
+
+ /* The local-bd-address property is usually injected by the
+ * bootloader which has access to the allocated BD address.
+@@ -179,8 +181,10 @@ static int btqcomsmd_probe(struct platform_device *pdev)
+ }
+
+ hdev = hci_alloc_dev();
+- if (!hdev)
+- return -ENOMEM;
++ if (!hdev) {
++ ret = -ENOMEM;
++ goto destroy_cmd_channel;
++ }
+
+ hci_set_drvdata(hdev, btq);
+ btq->hdev = hdev;
+@@ -194,14 +198,21 @@ static int btqcomsmd_probe(struct platform_device *pdev)
+ hdev->set_bdaddr = qca_set_bdaddr_rome;
+
+ ret = hci_register_dev(hdev);
+- if (ret < 0) {
+- hci_free_dev(hdev);
+- return ret;
+- }
++ if (ret < 0)
++ goto hci_free_dev;
+
+ platform_set_drvdata(pdev, btq);
+
+ return 0;
++
++hci_free_dev:
++ hci_free_dev(hdev);
++destroy_cmd_channel:
++ rpmsg_destroy_ept(btq->cmd_channel);
++destroy_acl_channel:
++ rpmsg_destroy_ept(btq->acl_channel);
++
++ return ret;
+ }
+
+ static int btqcomsmd_remove(struct platform_device *pdev)
+diff --git a/drivers/char/hw_random/timeriomem-rng.c b/drivers/char/hw_random/timeriomem-rng.c
+index f615684028af7..ba01f24db6db0 100644
+--- a/drivers/char/hw_random/timeriomem-rng.c
++++ b/drivers/char/hw_random/timeriomem-rng.c
+@@ -72,7 +72,7 @@ static int timeriomem_rng_read(struct hwrng *hwrng, void *data,
+ */
+ if (retval > 0)
+ usleep_range(period_us,
+- period_us + min(1, period_us / 100));
++ period_us + max(1, period_us / 100));
+
+ *(u32 *)data = readl(priv->io_base);
+ retval += sizeof(u32);
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 98925d49c96be..297a716f5a560 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -2071,7 +2071,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+ return -EPERM;
+ if (crng_init < 2)
+ return -ENODATA;
+- crng_reseed(&primary_crng, NULL);
++ crng_reseed(&primary_crng, &input_pool);
+ crng_global_init_time = jiffies - 1;
+ return 0;
+ default:
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 280d60cba1f8c..c9a5f34097df5 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -129,7 +129,8 @@ static bool check_locality(struct tpm_chip *chip, int l)
+ if (rc < 0)
+ return false;
+
+- if ((access & (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) ==
++ if ((access & (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID
++ | TPM_ACCESS_REQUEST_USE)) ==
+ (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) {
+ priv->locality = l;
+ return true;
+@@ -138,58 +139,13 @@ static bool check_locality(struct tpm_chip *chip, int l)
+ return false;
+ }
+
+-static bool locality_inactive(struct tpm_chip *chip, int l)
+-{
+- struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+- int rc;
+- u8 access;
+-
+- rc = tpm_tis_read8(priv, TPM_ACCESS(l), &access);
+- if (rc < 0)
+- return false;
+-
+- if ((access & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY))
+- == TPM_ACCESS_VALID)
+- return true;
+-
+- return false;
+-}
+-
+ static int release_locality(struct tpm_chip *chip, int l)
+ {
+ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+- unsigned long stop, timeout;
+- long rc;
+
+ tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY);
+
+- stop = jiffies + chip->timeout_a;
+-
+- if (chip->flags & TPM_CHIP_FLAG_IRQ) {
+-again:
+- timeout = stop - jiffies;
+- if ((long)timeout <= 0)
+- return -1;
+-
+- rc = wait_event_interruptible_timeout(priv->int_queue,
+- (locality_inactive(chip, l)),
+- timeout);
+-
+- if (rc > 0)
+- return 0;
+-
+- if (rc == -ERESTARTSYS && freezing(current)) {
+- clear_thread_flag(TIF_SIGPENDING);
+- goto again;
+- }
+- } else {
+- do {
+- if (locality_inactive(chip, l))
+- return 0;
+- tpm_msleep(TPM_TIMEOUT);
+- } while (time_before(jiffies, stop));
+- }
+- return -1;
++ return 0;
+ }
+
+ static int request_locality(struct tpm_chip *chip, int l)
+diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
+index 3e04617ac47f6..6fdad22a583d9 100644
+--- a/drivers/clk/meson/clk-pll.c
++++ b/drivers/clk/meson/clk-pll.c
+@@ -197,7 +197,7 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+ if (parent_rate == 0 || rate == 0)
+ return -EINVAL;
+
+- old_rate = rate;
++ old_rate = clk_hw_get_rate(hw);
+
+ pllt = meson_clk_get_pll_settings(rate, pll);
+ if (!pllt)
+diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
+index 772a08101ddf2..0ccd6b79cb5e7 100644
+--- a/drivers/clk/qcom/gcc-msm8998.c
++++ b/drivers/clk/qcom/gcc-msm8998.c
+@@ -124,7 +124,7 @@ static struct pll_vco fabia_vco[] = {
+
+ static struct clk_alpha_pll gpll0 = {
+ .offset = 0x0,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .vco_table = fabia_vco,
+ .num_vco = ARRAY_SIZE(fabia_vco),
+ .clkr = {
+@@ -134,58 +134,58 @@ static struct clk_alpha_pll gpll0 = {
+ .name = "gpll0",
+ .parent_names = (const char *[]){ "xo" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_ops,
++ .ops = &clk_alpha_pll_fixed_fabia_ops,
+ }
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll0_out_even = {
+ .offset = 0x0,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll0_out_even",
+ .parent_names = (const char *[]){ "gpll0" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll0_out_main = {
+ .offset = 0x0,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll0_out_main",
+ .parent_names = (const char *[]){ "gpll0" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll0_out_odd = {
+ .offset = 0x0,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll0_out_odd",
+ .parent_names = (const char *[]){ "gpll0" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll0_out_test = {
+ .offset = 0x0,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll0_out_test",
+ .parent_names = (const char *[]){ "gpll0" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll gpll1 = {
+ .offset = 0x1000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .vco_table = fabia_vco,
+ .num_vco = ARRAY_SIZE(fabia_vco),
+ .clkr = {
+@@ -195,58 +195,58 @@ static struct clk_alpha_pll gpll1 = {
+ .name = "gpll1",
+ .parent_names = (const char *[]){ "xo" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_ops,
++ .ops = &clk_alpha_pll_fixed_fabia_ops,
+ }
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll1_out_even = {
+ .offset = 0x1000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll1_out_even",
+ .parent_names = (const char *[]){ "gpll1" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll1_out_main = {
+ .offset = 0x1000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll1_out_main",
+ .parent_names = (const char *[]){ "gpll1" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll1_out_odd = {
+ .offset = 0x1000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll1_out_odd",
+ .parent_names = (const char *[]){ "gpll1" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll1_out_test = {
+ .offset = 0x1000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll1_out_test",
+ .parent_names = (const char *[]){ "gpll1" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll gpll2 = {
+ .offset = 0x2000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .vco_table = fabia_vco,
+ .num_vco = ARRAY_SIZE(fabia_vco),
+ .clkr = {
+@@ -256,58 +256,58 @@ static struct clk_alpha_pll gpll2 = {
+ .name = "gpll2",
+ .parent_names = (const char *[]){ "xo" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_ops,
++ .ops = &clk_alpha_pll_fixed_fabia_ops,
+ }
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll2_out_even = {
+ .offset = 0x2000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll2_out_even",
+ .parent_names = (const char *[]){ "gpll2" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll2_out_main = {
+ .offset = 0x2000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll2_out_main",
+ .parent_names = (const char *[]){ "gpll2" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll2_out_odd = {
+ .offset = 0x2000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll2_out_odd",
+ .parent_names = (const char *[]){ "gpll2" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll2_out_test = {
+ .offset = 0x2000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll2_out_test",
+ .parent_names = (const char *[]){ "gpll2" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll gpll3 = {
+ .offset = 0x3000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .vco_table = fabia_vco,
+ .num_vco = ARRAY_SIZE(fabia_vco),
+ .clkr = {
+@@ -317,58 +317,58 @@ static struct clk_alpha_pll gpll3 = {
+ .name = "gpll3",
+ .parent_names = (const char *[]){ "xo" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_ops,
++ .ops = &clk_alpha_pll_fixed_fabia_ops,
+ }
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll3_out_even = {
+ .offset = 0x3000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll3_out_even",
+ .parent_names = (const char *[]){ "gpll3" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll3_out_main = {
+ .offset = 0x3000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll3_out_main",
+ .parent_names = (const char *[]){ "gpll3" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll3_out_odd = {
+ .offset = 0x3000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll3_out_odd",
+ .parent_names = (const char *[]){ "gpll3" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll3_out_test = {
+ .offset = 0x3000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll3_out_test",
+ .parent_names = (const char *[]){ "gpll3" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll gpll4 = {
+ .offset = 0x77000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .vco_table = fabia_vco,
+ .num_vco = ARRAY_SIZE(fabia_vco),
+ .clkr = {
+@@ -378,52 +378,52 @@ static struct clk_alpha_pll gpll4 = {
+ .name = "gpll4",
+ .parent_names = (const char *[]){ "xo" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_ops,
++ .ops = &clk_alpha_pll_fixed_fabia_ops,
+ }
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll4_out_even = {
+ .offset = 0x77000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll4_out_even",
+ .parent_names = (const char *[]){ "gpll4" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll4_out_main = {
+ .offset = 0x77000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll4_out_main",
+ .parent_names = (const char *[]){ "gpll4" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll4_out_odd = {
+ .offset = 0x77000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll4_out_odd",
+ .parent_names = (const char *[]){ "gpll4" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll4_out_test = {
+ .offset = 0x77000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll4_out_test",
+ .parent_names = (const char *[]){ "gpll4" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+index d425b47cef179..1197ace591247 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+@@ -223,7 +223,7 @@ static const char * const psi_ahb1_ahb2_parents[] = { "osc24M", "osc32k",
+ static SUNXI_CCU_MP_WITH_MUX(psi_ahb1_ahb2_clk, "psi-ahb1-ahb2",
+ psi_ahb1_ahb2_parents,
+ 0x510,
+- 0, 5, /* M */
++ 0, 2, /* M */
+ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+@@ -232,19 +232,19 @@ static const char * const ahb3_apb1_apb2_parents[] = { "osc24M", "osc32k",
+ "psi-ahb1-ahb2",
+ "pll-periph0" };
+ static SUNXI_CCU_MP_WITH_MUX(ahb3_clk, "ahb3", ahb3_apb1_apb2_parents, 0x51c,
+- 0, 5, /* M */
++ 0, 2, /* M */
+ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+ static SUNXI_CCU_MP_WITH_MUX(apb1_clk, "apb1", ahb3_apb1_apb2_parents, 0x520,
+- 0, 5, /* M */
++ 0, 2, /* M */
+ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+ static SUNXI_CCU_MP_WITH_MUX(apb2_clk, "apb2", ahb3_apb1_apb2_parents, 0x524,
+- 0, 5, /* M */
++ 0, 2, /* M */
+ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+@@ -662,7 +662,7 @@ static struct ccu_mux hdmi_cec_clk = {
+
+ .common = {
+ .reg = 0xb10,
+- .features = CCU_FEATURE_VARIABLE_PREDIV,
++ .features = CCU_FEATURE_FIXED_PREDIV,
+ .hw.init = CLK_HW_INIT_PARENTS("hdmi-cec",
+ hdmi_cec_parents,
+ &ccu_mux_ops,
+diff --git a/drivers/clocksource/mxs_timer.c b/drivers/clocksource/mxs_timer.c
+index f6ddae30933f7..dae8c0c2e606f 100644
+--- a/drivers/clocksource/mxs_timer.c
++++ b/drivers/clocksource/mxs_timer.c
+@@ -138,10 +138,7 @@ static void mxs_irq_clear(char *state)
+
+ /* Clear pending interrupt */
+ timrot_irq_acknowledge();
+-
+-#ifdef DEBUG
+- pr_info("%s: changing mode to %s\n", __func__, state)
+-#endif /* DEBUG */
++ pr_debug("%s: changing mode to %s\n", __func__, state);
+ }
+
+ static int mxs_shutdown(struct clock_event_device *evt)
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index 77b0e5d0fb134..a3c82f530d608 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -566,6 +566,16 @@ unmap_base:
+ return ret;
+ }
+
++static void brcm_avs_prepare_uninit(struct platform_device *pdev)
++{
++ struct private_data *priv;
++
++ priv = platform_get_drvdata(pdev);
++
++ iounmap(priv->avs_intr_base);
++ iounmap(priv->base);
++}
++
+ static int brcm_avs_cpufreq_init(struct cpufreq_policy *policy)
+ {
+ struct cpufreq_frequency_table *freq_table;
+@@ -701,21 +711,21 @@ static int brcm_avs_cpufreq_probe(struct platform_device *pdev)
+
+ brcm_avs_driver.driver_data = pdev;
+
+- return cpufreq_register_driver(&brcm_avs_driver);
++ ret = cpufreq_register_driver(&brcm_avs_driver);
++ if (ret)
++ brcm_avs_prepare_uninit(pdev);
++
++ return ret;
+ }
+
+ static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
+ {
+- struct private_data *priv;
+ int ret;
+
+ ret = cpufreq_unregister_driver(&brcm_avs_driver);
+- if (ret)
+- return ret;
++ WARN_ON(ret);
+
+- priv = platform_get_drvdata(pdev);
+- iounmap(priv->base);
+- iounmap(priv->avs_intr_base);
++ brcm_avs_prepare_uninit(pdev);
+
+ return 0;
+ }
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 864a7e8ebdfc3..c2d222f97db79 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -1420,11 +1420,9 @@ static void intel_pstate_max_within_limits(struct cpudata *cpu)
+ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
+ {
+ cpu->pstate.min_pstate = pstate_funcs.get_min();
+- cpu->pstate.max_pstate = pstate_funcs.get_max();
+ cpu->pstate.max_pstate_physical = pstate_funcs.get_max_physical();
+ cpu->pstate.turbo_pstate = pstate_funcs.get_turbo();
+ cpu->pstate.scaling = pstate_funcs.get_scaling();
+- cpu->pstate.max_freq = cpu->pstate.max_pstate * cpu->pstate.scaling;
+
+ if (hwp_active && !hwp_mode_bdw) {
+ unsigned int phy_max, current_max;
+@@ -1432,9 +1430,12 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
+ intel_pstate_get_hwp_max(cpu->cpu, &phy_max, ¤t_max);
+ cpu->pstate.turbo_freq = phy_max * cpu->pstate.scaling;
+ cpu->pstate.turbo_pstate = phy_max;
++ cpu->pstate.max_pstate = HWP_GUARANTEED_PERF(READ_ONCE(cpu->hwp_cap_cached));
+ } else {
+ cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
++ cpu->pstate.max_pstate = pstate_funcs.get_max();
+ }
++ cpu->pstate.max_freq = cpu->pstate.max_pstate * cpu->pstate.scaling;
+
+ if (pstate_funcs.get_aperf_mperf_shift)
+ cpu->aperf_mperf_shift = pstate_funcs.get_aperf_mperf_shift();
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index c2736274ad634..c63992fbbc988 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -52,7 +52,7 @@
+
+ /* ================= Device Structure ================== */
+
+-struct device_private iproc_priv;
++struct bcm_device_private iproc_priv;
+
+ /* ==================== Parameters ===================== */
+
+diff --git a/drivers/crypto/bcm/cipher.h b/drivers/crypto/bcm/cipher.h
+index 763c425c41cae..36452d26c7c5c 100644
+--- a/drivers/crypto/bcm/cipher.h
++++ b/drivers/crypto/bcm/cipher.h
+@@ -431,7 +431,7 @@ struct spu_hw {
+ u32 num_chan;
+ };
+
+-struct device_private {
++struct bcm_device_private {
+ struct platform_device *pdev;
+
+ struct spu_hw spu;
+@@ -478,6 +478,6 @@ struct device_private {
+ struct mbox_chan **mbox;
+ };
+
+-extern struct device_private iproc_priv;
++extern struct bcm_device_private iproc_priv;
+
+ #endif
+diff --git a/drivers/crypto/bcm/util.c b/drivers/crypto/bcm/util.c
+index a912c6ad3e850..f96d1dade010a 100644
+--- a/drivers/crypto/bcm/util.c
++++ b/drivers/crypto/bcm/util.c
+@@ -400,7 +400,7 @@ char *spu_alg_name(enum spu_cipher_alg alg, enum spu_cipher_mode mode)
+ static ssize_t spu_debugfs_read(struct file *filp, char __user *ubuf,
+ size_t count, loff_t *offp)
+ {
+- struct device_private *ipriv;
++ struct bcm_device_private *ipriv;
+ char *buf;
+ ssize_t ret, out_offset, out_count;
+ int i;
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.h b/drivers/crypto/chelsio/chtls/chtls_cm.h
+index 4282d8a4eae48..ef72610724348 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.h
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.h
+@@ -53,9 +53,6 @@
+ #define MIN_RCV_WND (24 * 1024U)
+ #define LOOPBACK(x) (((x) & htonl(0xff000000)) == htonl(0x7f000000))
+
+-/* ulp_mem_io + ulptx_idata + payload + padding */
+-#define MAX_IMM_ULPTX_WR_LEN (32 + 8 + 256 + 8)
+-
+ /* for TX: a skb must have a headroom of at least TX_HEADER_LEN bytes */
+ #define TX_HEADER_LEN \
+ (sizeof(struct fw_ofld_tx_data_wr) + sizeof(struct sge_opaque_hdr))
+diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+index 22e4918579254..aa3d2f439965e 100644
+--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+@@ -34,6 +34,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq)
+ unsigned int ileft = areq->cryptlen;
+ unsigned int oleft = areq->cryptlen;
+ unsigned int todo;
++ unsigned long pi = 0, po = 0; /* progress for in and out */
++ bool miter_err;
+ struct sg_mapping_iter mi, mo;
+ unsigned int oi, oo; /* offset for in and out */
+ unsigned long flags;
+@@ -53,50 +55,62 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq)
+
+ spin_lock_irqsave(&ss->slock, flags);
+
+- for (i = 0; i < op->keylen; i += 4)
+- writel(*(op->key + i / 4), ss->base + SS_KEY0 + i);
++ for (i = 0; i < op->keylen / 4; i++)
++ writesl(ss->base + SS_KEY0 + i * 4, &op->key[i], 1);
+
+ if (areq->iv) {
+ for (i = 0; i < 4 && i < ivsize / 4; i++) {
+ v = *(u32 *)(areq->iv + i * 4);
+- writel(v, ss->base + SS_IV0 + i * 4);
++ writesl(ss->base + SS_IV0 + i * 4, &v, 1);
+ }
+ }
+ writel(mode, ss->base + SS_CTL);
+
+- sg_miter_start(&mi, areq->src, sg_nents(areq->src),
+- SG_MITER_FROM_SG | SG_MITER_ATOMIC);
+- sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
+- SG_MITER_TO_SG | SG_MITER_ATOMIC);
+- sg_miter_next(&mi);
+- sg_miter_next(&mo);
+- if (!mi.addr || !mo.addr) {
+- dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
+- err = -EINVAL;
+- goto release_ss;
+- }
+
+ ileft = areq->cryptlen / 4;
+ oleft = areq->cryptlen / 4;
+ oi = 0;
+ oo = 0;
+ do {
+- todo = min(rx_cnt, ileft);
+- todo = min_t(size_t, todo, (mi.length - oi) / 4);
+- if (todo) {
+- ileft -= todo;
+- writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo);
+- oi += todo * 4;
+- }
+- if (oi == mi.length) {
+- sg_miter_next(&mi);
+- oi = 0;
++ if (ileft) {
++ sg_miter_start(&mi, areq->src, sg_nents(areq->src),
++ SG_MITER_FROM_SG | SG_MITER_ATOMIC);
++ if (pi)
++ sg_miter_skip(&mi, pi);
++ miter_err = sg_miter_next(&mi);
++ if (!miter_err || !mi.addr) {
++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++ err = -EINVAL;
++ goto release_ss;
++ }
++ todo = min(rx_cnt, ileft);
++ todo = min_t(size_t, todo, (mi.length - oi) / 4);
++ if (todo) {
++ ileft -= todo;
++ writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo);
++ oi += todo * 4;
++ }
++ if (oi == mi.length) {
++ pi += mi.length;
++ oi = 0;
++ }
++ sg_miter_stop(&mi);
+ }
+
+ spaces = readl(ss->base + SS_FCSR);
+ rx_cnt = SS_RXFIFO_SPACES(spaces);
+ tx_cnt = SS_TXFIFO_SPACES(spaces);
+
++ sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
++ SG_MITER_TO_SG | SG_MITER_ATOMIC);
++ if (po)
++ sg_miter_skip(&mo, po);
++ miter_err = sg_miter_next(&mo);
++ if (!miter_err || !mo.addr) {
++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++ err = -EINVAL;
++ goto release_ss;
++ }
+ todo = min(tx_cnt, oleft);
+ todo = min_t(size_t, todo, (mo.length - oo) / 4);
+ if (todo) {
+@@ -105,9 +119,10 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq)
+ oo += todo * 4;
+ }
+ if (oo == mo.length) {
+- sg_miter_next(&mo);
+ oo = 0;
++ po += mo.length;
+ }
++ sg_miter_stop(&mo);
+ } while (oleft);
+
+ if (areq->iv) {
+@@ -118,8 +133,6 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq)
+ }
+
+ release_ss:
+- sg_miter_stop(&mi);
+- sg_miter_stop(&mo);
+ writel(0, ss->base + SS_CTL);
+ spin_unlock_irqrestore(&ss->slock, flags);
+ return err;
+@@ -148,6 +161,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ unsigned int oleft = areq->cryptlen;
+ unsigned int todo;
+ struct sg_mapping_iter mi, mo;
++ unsigned long pi = 0, po = 0; /* progress for in and out */
++ bool miter_err;
+ unsigned int oi, oo; /* offset for in and out */
+ char buf[4 * SS_RX_MAX];/* buffer for linearize SG src */
+ char bufo[4 * SS_TX_MAX]; /* buffer for linearize SG dst */
+@@ -174,12 +189,12 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ * we can use the SS optimized function
+ */
+ while (in_sg && no_chunk == 1) {
+- if (in_sg->length % 4)
++ if ((in_sg->length | in_sg->offset) & 3u)
+ no_chunk = 0;
+ in_sg = sg_next(in_sg);
+ }
+ while (out_sg && no_chunk == 1) {
+- if (out_sg->length % 4)
++ if ((out_sg->length | out_sg->offset) & 3u)
+ no_chunk = 0;
+ out_sg = sg_next(out_sg);
+ }
+@@ -189,28 +204,17 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+
+ spin_lock_irqsave(&ss->slock, flags);
+
+- for (i = 0; i < op->keylen; i += 4)
+- writel(*(op->key + i / 4), ss->base + SS_KEY0 + i);
++ for (i = 0; i < op->keylen / 4; i++)
++ writesl(ss->base + SS_KEY0 + i * 4, &op->key[i], 1);
+
+ if (areq->iv) {
+ for (i = 0; i < 4 && i < ivsize / 4; i++) {
+ v = *(u32 *)(areq->iv + i * 4);
+- writel(v, ss->base + SS_IV0 + i * 4);
++ writesl(ss->base + SS_IV0 + i * 4, &v, 1);
+ }
+ }
+ writel(mode, ss->base + SS_CTL);
+
+- sg_miter_start(&mi, areq->src, sg_nents(areq->src),
+- SG_MITER_FROM_SG | SG_MITER_ATOMIC);
+- sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
+- SG_MITER_TO_SG | SG_MITER_ATOMIC);
+- sg_miter_next(&mi);
+- sg_miter_next(&mo);
+- if (!mi.addr || !mo.addr) {
+- dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
+- err = -EINVAL;
+- goto release_ss;
+- }
+ ileft = areq->cryptlen;
+ oleft = areq->cryptlen;
+ oi = 0;
+@@ -218,6 +222,16 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+
+ while (oleft) {
+ if (ileft) {
++ sg_miter_start(&mi, areq->src, sg_nents(areq->src),
++ SG_MITER_FROM_SG | SG_MITER_ATOMIC);
++ if (pi)
++ sg_miter_skip(&mi, pi);
++ miter_err = sg_miter_next(&mi);
++ if (!miter_err || !mi.addr) {
++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++ err = -EINVAL;
++ goto release_ss;
++ }
+ /*
+ * todo is the number of consecutive 4byte word that we
+ * can read from current SG
+@@ -250,31 +264,38 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ }
+ }
+ if (oi == mi.length) {
+- sg_miter_next(&mi);
++ pi += mi.length;
+ oi = 0;
+ }
++ sg_miter_stop(&mi);
+ }
+
+ spaces = readl(ss->base + SS_FCSR);
+ rx_cnt = SS_RXFIFO_SPACES(spaces);
+ tx_cnt = SS_TXFIFO_SPACES(spaces);
+- dev_dbg(ss->dev,
+- "%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n",
+- mode,
+- oi, mi.length, ileft, areq->cryptlen, rx_cnt,
+- oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob);
+
+ if (!tx_cnt)
+ continue;
++ sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
++ SG_MITER_TO_SG | SG_MITER_ATOMIC);
++ if (po)
++ sg_miter_skip(&mo, po);
++ miter_err = sg_miter_next(&mo);
++ if (!miter_err || !mo.addr) {
++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++ err = -EINVAL;
++ goto release_ss;
++ }
+ /* todo in 4bytes word */
+ todo = min(tx_cnt, oleft / 4);
+ todo = min_t(size_t, todo, (mo.length - oo) / 4);
++
+ if (todo) {
+ readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo);
+ oleft -= todo * 4;
+ oo += todo * 4;
+ if (oo == mo.length) {
+- sg_miter_next(&mo);
++ po += mo.length;
+ oo = 0;
+ }
+ } else {
+@@ -299,12 +320,14 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ obo += todo;
+ oo += todo;
+ if (oo == mo.length) {
++ po += mo.length;
+ sg_miter_next(&mo);
+ oo = 0;
+ }
+ } while (obo < obl);
+ /* bufo must be fully used here */
+ }
++ sg_miter_stop(&mo);
+ }
+ if (areq->iv) {
+ for (i = 0; i < 4 && i < ivsize / 4; i++) {
+@@ -314,8 +337,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ }
+
+ release_ss:
+- sg_miter_stop(&mi);
+- sg_miter_stop(&mo);
+ writel(0, ss->base + SS_CTL);
+ spin_unlock_irqrestore(&ss->slock, flags);
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index c70a7c4f5b739..7a55baa861e58 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -1066,11 +1066,12 @@ static void ipsec_esp_decrypt_hwauth_done(struct device *dev,
+ */
+ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
+ unsigned int offset, int datalen, int elen,
+- struct talitos_ptr *link_tbl_ptr)
++ struct talitos_ptr *link_tbl_ptr, int align)
+ {
+ int n_sg = elen ? sg_count + 1 : sg_count;
+ int count = 0;
+ int cryptlen = datalen + elen;
++ int padding = ALIGN(cryptlen, align) - cryptlen;
+
+ while (cryptlen && sg && n_sg--) {
+ unsigned int len = sg_dma_len(sg);
+@@ -1094,7 +1095,7 @@ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
+ offset += datalen;
+ }
+ to_talitos_ptr(link_tbl_ptr + count,
+- sg_dma_address(sg) + offset, len, 0);
++ sg_dma_address(sg) + offset, sg_next(sg) ? len : len + padding, 0);
+ to_talitos_ptr_ext_set(link_tbl_ptr + count, 0, 0);
+ count++;
+ cryptlen -= len;
+@@ -1117,10 +1118,11 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ unsigned int len, struct talitos_edesc *edesc,
+ struct talitos_ptr *ptr, int sg_count,
+ unsigned int offset, int tbl_off, int elen,
+- bool force)
++ bool force, int align)
+ {
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
++ int aligned_len = ALIGN(len, align);
+
+ if (!src) {
+ to_talitos_ptr(ptr, 0, 0, is_sec1);
+@@ -1128,22 +1130,22 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ }
+ to_talitos_ptr_ext_set(ptr, elen, is_sec1);
+ if (sg_count == 1 && !force) {
+- to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1);
++ to_talitos_ptr(ptr, sg_dma_address(src) + offset, aligned_len, is_sec1);
+ return sg_count;
+ }
+ if (is_sec1) {
+- to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, len, is_sec1);
++ to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, aligned_len, is_sec1);
+ return sg_count;
+ }
+ sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len, elen,
+- &edesc->link_tbl[tbl_off]);
++ &edesc->link_tbl[tbl_off], align);
+ if (sg_count == 1 && !force) {
+ /* Only one segment now, so no link tbl needed*/
+ copy_talitos_ptr(ptr, &edesc->link_tbl[tbl_off], is_sec1);
+ return sg_count;
+ }
+ to_talitos_ptr(ptr, edesc->dma_link_tbl +
+- tbl_off * sizeof(struct talitos_ptr), len, is_sec1);
++ tbl_off * sizeof(struct talitos_ptr), aligned_len, is_sec1);
+ to_talitos_ptr_ext_or(ptr, DESC_PTR_LNKTBL_JUMP, is_sec1);
+
+ return sg_count;
+@@ -1155,7 +1157,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
+ unsigned int offset, int tbl_off)
+ {
+ return talitos_sg_map_ext(dev, src, len, edesc, ptr, sg_count, offset,
+- tbl_off, 0, false);
++ tbl_off, 0, false, 1);
+ }
+
+ /*
+@@ -1224,7 +1226,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+
+ ret = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[4],
+ sg_count, areq->assoclen, tbl_off, elen,
+- false);
++ false, 1);
+
+ if (ret > 1) {
+ tbl_off += ret;
+@@ -1244,7 +1246,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ elen = 0;
+ ret = talitos_sg_map_ext(dev, areq->dst, cryptlen, edesc, &desc->ptr[5],
+ sg_count, areq->assoclen, tbl_off, elen,
+- is_ipsec_esp && !encrypt);
++ is_ipsec_esp && !encrypt, 1);
+ tbl_off += ret;
+
+ /* ICV data */
+@@ -1554,6 +1556,8 @@ static int common_nonsnoop(struct talitos_edesc *edesc,
+ bool sync_needed = false;
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
++ bool is_ctr = (desc->hdr & DESC_HDR_SEL0_MASK) == DESC_HDR_SEL0_AESU &&
++ (desc->hdr & DESC_HDR_MODE0_AESU_MASK) == DESC_HDR_MODE0_AESU_CTR;
+
+ /* first DWORD empty */
+
+@@ -1574,8 +1578,8 @@ static int common_nonsnoop(struct talitos_edesc *edesc,
+ /*
+ * cipher in
+ */
+- sg_count = talitos_sg_map(dev, areq->src, cryptlen, edesc,
+- &desc->ptr[3], sg_count, 0, 0);
++ sg_count = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[3],
++ sg_count, 0, 0, 0, false, is_ctr ? 16 : 1);
+ if (sg_count > 1)
+ sync_needed = true;
+
+diff --git a/drivers/crypto/talitos.h b/drivers/crypto/talitos.h
+index cb0137e131cc8..16f96c57de341 100644
+--- a/drivers/crypto/talitos.h
++++ b/drivers/crypto/talitos.h
+@@ -377,6 +377,7 @@ static inline bool has_ftr_sec1(struct talitos_private *priv)
+
+ /* primary execution unit mode (MODE0) and derivatives */
+ #define DESC_HDR_MODE0_ENCRYPT cpu_to_be32(0x00100000)
++#define DESC_HDR_MODE0_AESU_MASK cpu_to_be32(0x00600000)
+ #define DESC_HDR_MODE0_AESU_CBC cpu_to_be32(0x00200000)
+ #define DESC_HDR_MODE0_AESU_CTR cpu_to_be32(0x00600000)
+ #define DESC_HDR_MODE0_DEU_CBC cpu_to_be32(0x00400000)
+diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
+index 1117b5123a6fc..e7ca3175dbc30 100644
+--- a/drivers/dma/fsldma.c
++++ b/drivers/dma/fsldma.c
+@@ -1218,6 +1218,7 @@ static int fsldma_of_probe(struct platform_device *op)
+ {
+ struct fsldma_device *fdev;
+ struct device_node *child;
++ unsigned int i;
+ int err;
+
+ fdev = kzalloc(sizeof(*fdev), GFP_KERNEL);
+@@ -1296,6 +1297,10 @@ static int fsldma_of_probe(struct platform_device *op)
+ return 0;
+
+ out_free_fdev:
++ for (i = 0; i < FSL_DMA_MAX_CHANS_PER_DEVICE; i++) {
++ if (fdev->chan[i])
++ fsl_dma_chan_remove(fdev->chan[i]);
++ }
+ irq_dispose_mapping(fdev->irq);
+ iounmap(fdev->regs);
+ out_free:
+@@ -1318,6 +1323,7 @@ static int fsldma_of_remove(struct platform_device *op)
+ if (fdev->chan[i])
+ fsl_dma_chan_remove(fdev->chan[i]);
+ }
++ irq_dispose_mapping(fdev->irq);
+
+ iounmap(fdev->regs);
+ kfree(fdev);
+diff --git a/drivers/dma/hsu/pci.c b/drivers/dma/hsu/pci.c
+index ad45cd344bbae..78836526d2e07 100644
+--- a/drivers/dma/hsu/pci.c
++++ b/drivers/dma/hsu/pci.c
+@@ -29,22 +29,12 @@
+ static irqreturn_t hsu_pci_irq(int irq, void *dev)
+ {
+ struct hsu_dma_chip *chip = dev;
+- struct pci_dev *pdev = to_pci_dev(chip->dev);
+ u32 dmaisr;
+ u32 status;
+ unsigned short i;
+ int ret = 0;
+ int err;
+
+- /*
+- * On Intel Tangier B0 and Anniedale the interrupt line, disregarding
+- * to have different numbers, is shared between HSU DMA and UART IPs.
+- * Thus on such SoCs we are expecting that IRQ handler is called in
+- * UART driver only.
+- */
+- if (pdev->device == PCI_DEVICE_ID_INTEL_MRFLD_HSU_DMA)
+- return IRQ_HANDLED;
+-
+ dmaisr = readl(chip->regs + HSU_PCI_DMAISR);
+ for (i = 0; i < chip->hsu->nr_channels; i++) {
+ if (dmaisr & 0x1) {
+@@ -108,6 +98,17 @@ static int hsu_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ if (ret)
+ goto err_register_irq;
+
++ /*
++ * On Intel Tangier B0 and Anniedale the interrupt line, disregarding
++ * to have different numbers, is shared between HSU DMA and UART IPs.
++ * Thus on such SoCs we are expecting that IRQ handler is called in
++ * UART driver only. Instead of handling the spurious interrupt
++ * from HSU DMA here and waste CPU time and delay HSU UART interrupt
++ * handling, disable the interrupt entirely.
++ */
++ if (pdev->device == PCI_DEVICE_ID_INTEL_MRFLD_HSU_DMA)
++ disable_irq_nosync(chip->irq);
++
+ pci_set_drvdata(pdev, chip);
+
+ return 0;
+diff --git a/drivers/dma/owl-dma.c b/drivers/dma/owl-dma.c
+index 7ff04bf04b31b..da5050ab7f387 100644
+--- a/drivers/dma/owl-dma.c
++++ b/drivers/dma/owl-dma.c
+@@ -932,6 +932,7 @@ static int owl_dma_remove(struct platform_device *pdev)
+ owl_dma_free(od);
+
+ clk_disable_unprepare(od->clk);
++ dma_pool_destroy(od->lli_pool);
+
+ return 0;
+ }
+diff --git a/drivers/gpio/gpio-pcf857x.c b/drivers/gpio/gpio-pcf857x.c
+index 68a35b65925ac..d3fcc0d15eb85 100644
+--- a/drivers/gpio/gpio-pcf857x.c
++++ b/drivers/gpio/gpio-pcf857x.c
+@@ -357,7 +357,7 @@ static int pcf857x_probe(struct i2c_client *client,
+ * reset state. Otherwise it flags pins to be driven low.
+ */
+ gpio->out = ~n_latch;
+- gpio->status = gpio->out;
++ gpio->status = gpio->read(gpio->client);
+
+ status = devm_gpiochip_add_data(&client->dev, &gpio->chip, gpio);
+ if (status < 0)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+index e63a253eb4255..cbb969a870f6a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+@@ -617,7 +617,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,
+ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
+ {
+ int ret;
+- long level;
++ unsigned long level;
+ char *sub_str = NULL;
+ char *tmp;
+ char buf_cpy[AMDGPU_MASK_BUF_MAX + 1];
+@@ -633,8 +633,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
+ while (tmp[0]) {
+ sub_str = strsep(&tmp, delimiter);
+ if (strlen(sub_str)) {
+- ret = kstrtol(sub_str, 0, &level);
+- if (ret)
++ ret = kstrtoul(sub_str, 0, &level);
++ if (ret || level > 31)
+ return -EINVAL;
+ *mask |= 1 << level;
+ } else
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+index 7206a0025b17a..db9907fb99f3f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+@@ -21,7 +21,7 @@
+ *
+ */
+
+-#if !defined(_AMDGPU_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
++#if !defined(_AMDGPU_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ)
+ #define _AMDGPU_TRACE_H_
+
+ #include <linux/stringify.h>
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index ab63d0d0304cb..6fd57cfb112f5 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -429,12 +429,12 @@ static void set_clamp(
+ clamp_max = 0x3FC0;
+ break;
+ case COLOR_DEPTH_101010:
+- /* 10bit MSB aligned on 14 bit bus '11 1111 1111 1100' */
+- clamp_max = 0x3FFC;
++ /* 10bit MSB aligned on 14 bit bus '11 1111 1111 0000' */
++ clamp_max = 0x3FF0;
+ break;
+ case COLOR_DEPTH_121212:
+- /* 12bit MSB aligned on 14 bit bus '11 1111 1111 1111' */
+- clamp_max = 0x3FFF;
++ /* 12bit MSB aligned on 14 bit bus '11 1111 1111 1100' */
++ clamp_max = 0x3FFC;
+ break;
+ default:
+ clamp_max = 0x3FC0;
+diff --git a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
+index e281070611480..fc9a34ed58bd1 100644
+--- a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
++++ b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
+@@ -279,11 +279,8 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
+ hdmi_dev = pci_get_drvdata(dev);
+
+ i2c_dev = kzalloc(sizeof(struct hdmi_i2c_dev), GFP_KERNEL);
+- if (i2c_dev == NULL) {
+- DRM_ERROR("Can't allocate interface\n");
+- ret = -ENOMEM;
+- goto exit;
+- }
++ if (!i2c_dev)
++ return -ENOMEM;
+
+ i2c_dev->adap = &oaktrail_hdmi_i2c_adapter;
+ i2c_dev->status = I2C_STAT_INIT;
+@@ -300,16 +297,23 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
+ oaktrail_hdmi_i2c_adapter.name, hdmi_dev);
+ if (ret) {
+ DRM_ERROR("Failed to request IRQ for I2C controller\n");
+- goto err;
++ goto free_dev;
+ }
+
+ /* Adapter registration */
+ ret = i2c_add_numbered_adapter(&oaktrail_hdmi_i2c_adapter);
+- return ret;
++ if (ret) {
++ DRM_ERROR("Failed to add I2C adapter\n");
++ goto free_irq;
++ }
+
+-err:
++ return 0;
++
++free_irq:
++ free_irq(dev->irq, hdmi_dev);
++free_dev:
+ kfree(i2c_dev);
+-exit:
++
+ return ret;
+ }
+
+diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
+index ac32ab5aa0027..2fa3c7fc4b6d5 100644
+--- a/drivers/gpu/drm/gma500/psb_drv.c
++++ b/drivers/gpu/drm/gma500/psb_drv.c
+@@ -316,6 +316,8 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
+ if (ret)
+ goto out_err;
+
++ ret = -ENOMEM;
++
+ dev_priv->mmu = psb_mmu_driver_init(dev, 1, 0, 0);
+ if (!dev_priv->mmu)
+ goto out_err;
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c
+index 1ca6c69516f57..4c037d855b272 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c
+@@ -147,7 +147,7 @@ const struct msm_dsi_phy_cfg dsi_phy_20nm_cfgs = {
+ .disable = dsi_20nm_phy_disable,
+ .init = msm_dsi_phy_init_common,
+ },
+- .io_start = { 0xfd998300, 0xfd9a0300 },
++ .io_start = { 0xfd998500, 0xfd9a0500 },
+ .num_dsi_phy = 2,
+ };
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 05122167d9d85..9b66eb1d42c2d 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -93,7 +93,7 @@ EXPORT_SYMBOL_GPL(hid_register_report);
+ * Register a new field for this report.
+ */
+
+-static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values)
++static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages)
+ {
+ struct hid_field *field;
+
+@@ -104,7 +104,7 @@ static struct hid_field *hid_register_field(struct hid_report *report, unsigned
+
+ field = kzalloc((sizeof(struct hid_field) +
+ usages * sizeof(struct hid_usage) +
+- values * sizeof(unsigned)), GFP_KERNEL);
++ usages * sizeof(unsigned)), GFP_KERNEL);
+ if (!field)
+ return NULL;
+
+@@ -300,7 +300,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
+ usages = max_t(unsigned, parser->local.usage_index,
+ parser->global.report_count);
+
+- field = hid_register_field(report, usages, parser->global.report_count);
++ field = hid_register_field(report, usages);
+ if (!field)
+ return 0;
+
+@@ -1128,6 +1128,9 @@ EXPORT_SYMBOL_GPL(hid_open_report);
+
+ static s32 snto32(__u32 value, unsigned n)
+ {
++ if (!value || !n)
++ return 0;
++
+ switch (n) {
+ case 8: return ((__s8)value);
+ case 16: return ((__s16)value);
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index da83884b90d25..274a55702784a 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2557,7 +2557,12 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
+ wacom_wac->hid_data.tipswitch = value;
+ break;
+ case HID_DG_CONTACTMAX:
+- features->touch_max = value;
++ if (!features->touch_max) {
++ features->touch_max = value;
++ } else {
++ hid_warn(hdev, "%s: ignoring attempt to overwrite non-zero touch_max "
++ "%d -> %d\n", __func__, features->touch_max, value);
++ }
+ return;
+ }
+
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 7920b0d7e35a7..ac9617671757c 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -1001,8 +1001,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
+ vmbus_device_unregister(channel->device_obj);
+ put_device(dev);
+ }
+- }
+- if (channel->primary_channel != NULL) {
++ } else if (channel->primary_channel != NULL) {
+ /*
+ * Sub-channel is being rescinded. Following is the channel
+ * close sequence when initiated from the driveri (refer to
+diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
+index 826d320499961..2086a96307bf9 100644
+--- a/drivers/i2c/busses/i2c-brcmstb.c
++++ b/drivers/i2c/busses/i2c-brcmstb.c
+@@ -318,7 +318,7 @@ static int brcmstb_send_i2c_cmd(struct brcmstb_i2c_dev *dev,
+ goto cmd_out;
+ }
+
+- if ((CMD_RD || CMD_WR) &&
++ if ((cmd == CMD_RD || cmd == CMD_WR) &&
+ bsc_readl(dev, iic_enable) & BSC_IIC_EN_NOACK_MASK) {
+ rc = -EREMOTEIO;
+ dev_dbg(dev->device, "controller received NOACK intr for %s\n",
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index a18f3f8ad77fe..471a824be86c4 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -366,6 +366,11 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
+
+ mutex_lock(&file->mutex);
+
++ if (file->agents_dead) {
++ mutex_unlock(&file->mutex);
++ return -EIO;
++ }
++
+ while (list_empty(&file->recv_list)) {
+ mutex_unlock(&file->mutex);
+
+@@ -379,6 +384,11 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
+ mutex_lock(&file->mutex);
+ }
+
++ if (file->agents_dead) {
++ mutex_unlock(&file->mutex);
++ return -EIO;
++ }
++
+ packet = list_entry(file->recv_list.next, struct ib_umad_packet, list);
+ list_del(&packet->list);
+
+@@ -508,7 +518,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
+
+ agent = __get_agent(file, packet->mad.hdr.id);
+ if (!agent) {
+- ret = -EINVAL;
++ ret = -EIO;
+ goto err_up;
+ }
+
+@@ -637,10 +647,14 @@ static __poll_t ib_umad_poll(struct file *filp, struct poll_table_struct *wait)
+ /* we will always be able to post a MAD send */
+ __poll_t mask = EPOLLOUT | EPOLLWRNORM;
+
++ mutex_lock(&file->mutex);
+ poll_wait(filp, &file->recv_wait, wait);
+
+ if (!list_empty(&file->recv_list))
+ mask |= EPOLLIN | EPOLLRDNORM;
++ if (file->agents_dead)
++ mask = EPOLLERR;
++ mutex_unlock(&file->mutex);
+
+ return mask;
+ }
+@@ -1257,6 +1271,7 @@ static void ib_umad_kill_port(struct ib_umad_port *port)
+ list_for_each_entry(file, &port->file_list, port_list) {
+ mutex_lock(&file->mutex);
+ file->agents_dead = 1;
++ wake_up_interruptible(&file->recv_wait);
+ mutex_unlock(&file->mutex);
+
+ for (id = 0; id < IB_UMAD_MAX_AGENTS; ++id)
+diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
+index 4c90a007e09db..c89aec834972e 100644
+--- a/drivers/infiniband/hw/mlx5/devx.c
++++ b/drivers/infiniband/hw/mlx5/devx.c
+@@ -572,7 +572,9 @@ static void devx_obj_build_destroy_cmd(void *in, void *out, void *din,
+ MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_RQT);
+ break;
+ case MLX5_CMD_OP_CREATE_TIR:
+- MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_TIR);
++ *obj_id = MLX5_GET(create_tir_out, out, tirn);
++ MLX5_SET(destroy_tir_in, din, opcode, MLX5_CMD_OP_DESTROY_TIR);
++ MLX5_SET(destroy_tir_in, din, tirn, *obj_id);
+ break;
+ case MLX5_CMD_OP_CREATE_TIS:
+ MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_TIS);
+diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
+index 7903bd5c639ea..04bfc36cc8d76 100644
+--- a/drivers/infiniband/sw/rxe/rxe_net.c
++++ b/drivers/infiniband/sw/rxe/rxe_net.c
+@@ -500,6 +500,11 @@ int rxe_send(struct rxe_pkt_info *pkt, struct sk_buff *skb)
+
+ void rxe_loopback(struct sk_buff *skb)
+ {
++ if (skb->protocol == htons(ETH_P_IP))
++ skb_pull(skb, sizeof(struct iphdr));
++ else
++ skb_pull(skb, sizeof(struct ipv6hdr));
++
+ rxe_rcv(skb);
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
+index b8f3e65402d1d..d94e2c5bc317d 100644
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -36,21 +36,26 @@
+ #include "rxe.h"
+ #include "rxe_loc.h"
+
++/* check that QP matches packet opcode type and is in a valid state */
+ static int check_type_state(struct rxe_dev *rxe, struct rxe_pkt_info *pkt,
+ struct rxe_qp *qp)
+ {
++ unsigned int pkt_type;
++
+ if (unlikely(!qp->valid))
+ goto err1;
+
++ pkt_type = pkt->opcode & 0xe0;
++
+ switch (qp_type(qp)) {
+ case IB_QPT_RC:
+- if (unlikely((pkt->opcode & IB_OPCODE_RC) != 0)) {
++ if (unlikely(pkt_type != IB_OPCODE_RC)) {
+ pr_warn_ratelimited("bad qp type\n");
+ goto err1;
+ }
+ break;
+ case IB_QPT_UC:
+- if (unlikely(!(pkt->opcode & IB_OPCODE_UC))) {
++ if (unlikely(pkt_type != IB_OPCODE_UC)) {
+ pr_warn_ratelimited("bad qp type\n");
+ goto err1;
+ }
+@@ -58,7 +63,7 @@ static int check_type_state(struct rxe_dev *rxe, struct rxe_pkt_info *pkt,
+ case IB_QPT_UD:
+ case IB_QPT_SMI:
+ case IB_QPT_GSI:
+- if (unlikely(!(pkt->opcode & IB_OPCODE_UD))) {
++ if (unlikely(pkt_type != IB_OPCODE_UD)) {
+ pr_warn_ratelimited("bad qp type\n");
+ goto err1;
+ }
+diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
+index 4c1e427dfabb9..7ef6e1c165e35 100644
+--- a/drivers/input/joydev.c
++++ b/drivers/input/joydev.c
+@@ -460,7 +460,7 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
+ if (IS_ERR(abspam))
+ return PTR_ERR(abspam);
+
+- for (i = 0; i < joydev->nabs; i++) {
++ for (i = 0; i < len && i < joydev->nabs; i++) {
+ if (abspam[i] > ABS_MAX) {
+ retval = -EINVAL;
+ goto out;
+@@ -484,6 +484,9 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev,
+ int i;
+ int retval = 0;
+
++ if (len % sizeof(*keypam))
++ return -EINVAL;
++
+ len = min(len, sizeof(joydev->keypam));
+
+ /* Validate the map. */
+@@ -491,7 +494,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev,
+ if (IS_ERR(keypam))
+ return PTR_ERR(keypam);
+
+- for (i = 0; i < joydev->nkey; i++) {
++ for (i = 0; i < (len / 2) && i < joydev->nkey; i++) {
+ if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) {
+ retval = -EINVAL;
+ goto out;
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index ef4e8423843f3..eacb8af8b4fc0 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -319,6 +319,7 @@ static const struct xpad_device {
+ { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 },
+ { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE },
++ { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE },
+ { 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
+ { 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 844875df8cad7..0463ab79160b7 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -592,6 +592,10 @@ static const struct dmi_system_id i8042_dmi_noselftest_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_CHASSIS_TYPE, "10"), /* Notebook */
+ },
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
++ },
+ },
+ { }
+ };
+diff --git a/drivers/input/touchscreen/elo.c b/drivers/input/touchscreen/elo.c
+index 7f2942f3cec6e..0f3146bcfcd0f 100644
+--- a/drivers/input/touchscreen/elo.c
++++ b/drivers/input/touchscreen/elo.c
+@@ -345,8 +345,10 @@ static int elo_connect(struct serio *serio, struct serio_driver *drv)
+ switch (elo->id) {
+
+ case 0: /* 10-byte protocol */
+- if (elo_setup_10(elo))
++ if (elo_setup_10(elo)) {
++ err = -EIO;
+ goto fail3;
++ }
+
+ break;
+
+diff --git a/drivers/input/touchscreen/raydium_i2c_ts.c b/drivers/input/touchscreen/raydium_i2c_ts.c
+index 05c1054330b71..1a8c7403cfe6d 100644
+--- a/drivers/input/touchscreen/raydium_i2c_ts.c
++++ b/drivers/input/touchscreen/raydium_i2c_ts.c
+@@ -419,6 +419,7 @@ static int raydium_i2c_write_object(struct i2c_client *client,
+ enum raydium_bl_ack state)
+ {
+ int error;
++ static const u8 cmd[] = { 0xFF, 0x39 };
+
+ error = raydium_i2c_send(client, RM_CMD_BOOT_WRT, data, len);
+ if (error) {
+@@ -427,7 +428,7 @@ static int raydium_i2c_write_object(struct i2c_client *client,
+ return error;
+ }
+
+- error = raydium_i2c_send(client, RM_CMD_BOOT_ACK, NULL, 0);
++ error = raydium_i2c_send(client, RM_CMD_BOOT_ACK, cmd, sizeof(cmd));
+ if (error) {
+ dev_err(&client->dev, "Ack obj command failed: %d\n", error);
+ return error;
+diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
+index caa3aca2ea541..d5956854ac983 100644
+--- a/drivers/input/touchscreen/sur40.c
++++ b/drivers/input/touchscreen/sur40.c
+@@ -778,6 +778,7 @@ static int sur40_probe(struct usb_interface *interface,
+ dev_err(&interface->dev,
+ "Unable to register video controls.");
+ v4l2_ctrl_handler_free(&sur40->hdl);
++ error = sur40->hdl.error;
+ goto err_unreg_v4l2;
+ }
+
+diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
+index 7e426e4d13528..8cda3f7ddbae8 100644
+--- a/drivers/md/dm-core.h
++++ b/drivers/md/dm-core.h
+@@ -110,6 +110,10 @@ struct mapped_device {
+ /* zero-length flush that will be cloned and submitted to targets */
+ struct bio flush_bio;
+
++ int swap_bios;
++ struct semaphore swap_bios_semaphore;
++ struct mutex swap_bios_lock;
++
+ struct dm_stats stats;
+
+ struct kthread_worker kworker;
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 07661c3c1513f..85559f772d0d6 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -2852,6 +2852,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ wake_up_process(cc->write_thread);
+
+ ti->num_flush_bios = 1;
++ ti->limit_swap_bios = true;
+
+ return 0;
+
+diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
+index 8e48920a3ffa6..c596fc564a589 100644
+--- a/drivers/md/dm-era-target.c
++++ b/drivers/md/dm-era-target.c
+@@ -46,6 +46,7 @@ struct writeset {
+ static void writeset_free(struct writeset *ws)
+ {
+ vfree(ws->bits);
++ ws->bits = NULL;
+ }
+
+ static int setup_on_disk_bitset(struct dm_disk_bitset *info,
+@@ -70,8 +71,6 @@ static size_t bitset_size(unsigned nr_bits)
+ */
+ static int writeset_alloc(struct writeset *ws, dm_block_t nr_blocks)
+ {
+- ws->md.nr_bits = nr_blocks;
+- ws->md.root = INVALID_WRITESET_ROOT;
+ ws->bits = vzalloc(bitset_size(nr_blocks));
+ if (!ws->bits) {
+ DMERR("%s: couldn't allocate in memory bitset", __func__);
+@@ -84,12 +83,14 @@ static int writeset_alloc(struct writeset *ws, dm_block_t nr_blocks)
+ /*
+ * Wipes the in-core bitset, and creates a new on disk bitset.
+ */
+-static int writeset_init(struct dm_disk_bitset *info, struct writeset *ws)
++static int writeset_init(struct dm_disk_bitset *info, struct writeset *ws,
++ dm_block_t nr_blocks)
+ {
+ int r;
+
+- memset(ws->bits, 0, bitset_size(ws->md.nr_bits));
++ memset(ws->bits, 0, bitset_size(nr_blocks));
+
++ ws->md.nr_bits = nr_blocks;
+ r = setup_on_disk_bitset(info, ws->md.nr_bits, &ws->md.root);
+ if (r) {
+ DMERR("%s: setup_on_disk_bitset failed", __func__);
+@@ -133,7 +134,7 @@ static int writeset_test_and_set(struct dm_disk_bitset *info,
+ {
+ int r;
+
+- if (!test_and_set_bit(block, ws->bits)) {
++ if (!test_bit(block, ws->bits)) {
+ r = dm_bitset_set_bit(info, ws->md.root, block, &ws->md.root);
+ if (r) {
+ /* FIXME: fail mode */
+@@ -387,7 +388,7 @@ static void ws_dec(void *context, const void *value)
+
+ static int ws_eq(void *context, const void *value1, const void *value2)
+ {
+- return !memcmp(value1, value2, sizeof(struct writeset_metadata));
++ return !memcmp(value1, value2, sizeof(struct writeset_disk));
+ }
+
+ /*----------------------------------------------------------------*/
+@@ -563,6 +564,15 @@ static int open_metadata(struct era_metadata *md)
+ }
+
+ disk = dm_block_data(sblock);
++
++ /* Verify the data block size hasn't changed */
++ if (le32_to_cpu(disk->data_block_size) != md->block_size) {
++ DMERR("changing the data block size (from %u to %llu) is not supported",
++ le32_to_cpu(disk->data_block_size), md->block_size);
++ r = -EINVAL;
++ goto bad;
++ }
++
+ r = dm_tm_open_with_sm(md->bm, SUPERBLOCK_LOCATION,
+ disk->metadata_space_map_root,
+ sizeof(disk->metadata_space_map_root),
+@@ -574,10 +584,10 @@ static int open_metadata(struct era_metadata *md)
+
+ setup_infos(md);
+
+- md->block_size = le32_to_cpu(disk->data_block_size);
+ md->nr_blocks = le32_to_cpu(disk->nr_blocks);
+ md->current_era = le32_to_cpu(disk->current_era);
+
++ ws_unpack(&disk->current_writeset, &md->current_writeset->md);
+ md->writeset_tree_root = le64_to_cpu(disk->writeset_tree_root);
+ md->era_array_root = le64_to_cpu(disk->era_array_root);
+ md->metadata_snap = le64_to_cpu(disk->metadata_snap);
+@@ -745,6 +755,12 @@ static int metadata_digest_lookup_writeset(struct era_metadata *md,
+ ws_unpack(&disk, &d->writeset);
+ d->value = cpu_to_le32(key);
+
++ /*
++ * We initialise another bitset info to avoid any caching side effects
++ * with the previous one.
++ */
++ dm_disk_bitset_init(md->tm, &d->info);
++
+ d->nr_bits = min(d->writeset.nr_bits, md->nr_blocks);
+ d->current_bit = 0;
+ d->step = metadata_digest_transcribe_writeset;
+@@ -758,12 +774,6 @@ static int metadata_digest_start(struct era_metadata *md, struct digest *d)
+ return 0;
+
+ memset(d, 0, sizeof(*d));
+-
+- /*
+- * We initialise another bitset info to avoid any caching side
+- * effects with the previous one.
+- */
+- dm_disk_bitset_init(md->tm, &d->info);
+ d->step = metadata_digest_lookup_writeset;
+
+ return 0;
+@@ -801,6 +811,8 @@ static struct era_metadata *metadata_open(struct block_device *bdev,
+
+ static void metadata_close(struct era_metadata *md)
+ {
++ writeset_free(&md->writesets[0]);
++ writeset_free(&md->writesets[1]);
+ destroy_persistent_data_objects(md);
+ kfree(md);
+ }
+@@ -838,6 +850,7 @@ static int metadata_resize(struct era_metadata *md, void *arg)
+ r = writeset_alloc(&md->writesets[1], *new_size);
+ if (r) {
+ DMERR("%s: writeset_alloc failed for writeset 1", __func__);
++ writeset_free(&md->writesets[0]);
+ return r;
+ }
+
+@@ -848,6 +861,8 @@ static int metadata_resize(struct era_metadata *md, void *arg)
+ &value, &md->era_array_root);
+ if (r) {
+ DMERR("%s: dm_array_resize failed", __func__);
++ writeset_free(&md->writesets[0]);
++ writeset_free(&md->writesets[1]);
+ return r;
+ }
+
+@@ -869,7 +884,6 @@ static int metadata_era_archive(struct era_metadata *md)
+ }
+
+ ws_pack(&md->current_writeset->md, &value);
+- md->current_writeset->md.root = INVALID_WRITESET_ROOT;
+
+ keys[0] = md->current_era;
+ __dm_bless_for_disk(&value);
+@@ -881,6 +895,7 @@ static int metadata_era_archive(struct era_metadata *md)
+ return r;
+ }
+
++ md->current_writeset->md.root = INVALID_WRITESET_ROOT;
+ md->archived_writesets = true;
+
+ return 0;
+@@ -897,7 +912,7 @@ static int metadata_new_era(struct era_metadata *md)
+ int r;
+ struct writeset *new_writeset = next_writeset(md);
+
+- r = writeset_init(&md->bitset_info, new_writeset);
++ r = writeset_init(&md->bitset_info, new_writeset, md->nr_blocks);
+ if (r) {
+ DMERR("%s: writeset_init failed", __func__);
+ return r;
+@@ -950,7 +965,7 @@ static int metadata_commit(struct era_metadata *md)
+ int r;
+ struct dm_block *sblock;
+
+- if (md->current_writeset->md.root != SUPERBLOCK_LOCATION) {
++ if (md->current_writeset->md.root != INVALID_WRITESET_ROOT) {
+ r = dm_bitset_flush(&md->bitset_info, md->current_writeset->md.root,
+ &md->current_writeset->md.root);
+ if (r) {
+@@ -1225,8 +1240,10 @@ static void process_deferred_bios(struct era *era)
+ int r;
+ struct bio_list deferred_bios, marked_bios;
+ struct bio *bio;
++ struct blk_plug plug;
+ bool commit_needed = false;
+ bool failed = false;
++ struct writeset *ws = era->md->current_writeset;
+
+ bio_list_init(&deferred_bios);
+ bio_list_init(&marked_bios);
+@@ -1236,9 +1253,11 @@ static void process_deferred_bios(struct era *era)
+ bio_list_init(&era->deferred_bios);
+ spin_unlock(&era->deferred_lock);
+
++ if (bio_list_empty(&deferred_bios))
++ return;
++
+ while ((bio = bio_list_pop(&deferred_bios))) {
+- r = writeset_test_and_set(&era->md->bitset_info,
+- era->md->current_writeset,
++ r = writeset_test_and_set(&era->md->bitset_info, ws,
+ get_block(era, bio));
+ if (r < 0) {
+ /*
+@@ -1246,7 +1265,6 @@ static void process_deferred_bios(struct era *era)
+ * FIXME: finish.
+ */
+ failed = true;
+-
+ } else if (r == 0)
+ commit_needed = true;
+
+@@ -1262,9 +1280,19 @@ static void process_deferred_bios(struct era *era)
+ if (failed)
+ while ((bio = bio_list_pop(&marked_bios)))
+ bio_io_error(bio);
+- else
+- while ((bio = bio_list_pop(&marked_bios)))
++ else {
++ blk_start_plug(&plug);
++ while ((bio = bio_list_pop(&marked_bios))) {
++ /*
++ * Only update the in-core writeset if the on-disk one
++ * was updated too.
++ */
++ if (commit_needed)
++ set_bit(get_block(era, bio), ws->bits);
+ generic_make_request(bio);
++ }
++ blk_finish_plug(&plug);
++ }
+ }
+
+ static void process_rpc_calls(struct era *era)
+@@ -1485,15 +1513,6 @@ static int era_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ }
+ era->md = md;
+
+- era->nr_blocks = calc_nr_blocks(era);
+-
+- r = metadata_resize(era->md, &era->nr_blocks);
+- if (r) {
+- ti->error = "couldn't resize metadata";
+- era_destroy(era);
+- return -ENOMEM;
+- }
+-
+ era->wq = alloc_ordered_workqueue("dm-" DM_MSG_PREFIX, WQ_MEM_RECLAIM);
+ if (!era->wq) {
+ ti->error = "could not create workqueue for metadata object";
+@@ -1570,16 +1589,24 @@ static int era_preresume(struct dm_target *ti)
+ dm_block_t new_size = calc_nr_blocks(era);
+
+ if (era->nr_blocks != new_size) {
+- r = in_worker1(era, metadata_resize, &new_size);
+- if (r)
++ r = metadata_resize(era->md, &new_size);
++ if (r) {
++ DMERR("%s: metadata_resize failed", __func__);
++ return r;
++ }
++
++ r = metadata_commit(era->md);
++ if (r) {
++ DMERR("%s: metadata_commit failed", __func__);
+ return r;
++ }
+
+ era->nr_blocks = new_size;
+ }
+
+ start_worker(era);
+
+- r = in_worker0(era, metadata_new_era);
++ r = in_worker0(era, metadata_era_rollover);
+ if (r) {
+ DMERR("%s: metadata_era_rollover failed", __func__);
+ return r;
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 13237b85cfec5..01bf5bc925d0b 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -146,6 +146,16 @@ EXPORT_SYMBOL_GPL(dm_bio_get_target_bio_nr);
+ #define DM_NUMA_NODE NUMA_NO_NODE
+ static int dm_numa_node = DM_NUMA_NODE;
+
++#define DEFAULT_SWAP_BIOS (8 * 1048576 / PAGE_SIZE)
++static int swap_bios = DEFAULT_SWAP_BIOS;
++static int get_swap_bios(void)
++{
++ int latch = READ_ONCE(swap_bios);
++ if (unlikely(latch <= 0))
++ latch = DEFAULT_SWAP_BIOS;
++ return latch;
++}
++
+ /*
+ * For mempools pre-allocation at the table loading time.
+ */
+@@ -935,6 +945,11 @@ void disable_write_zeroes(struct mapped_device *md)
+ limits->max_write_zeroes_sectors = 0;
+ }
+
++static bool swap_bios_limit(struct dm_target *ti, struct bio *bio)
++{
++ return unlikely((bio->bi_opf & REQ_SWAP) != 0) && unlikely(ti->limit_swap_bios);
++}
++
+ static void clone_endio(struct bio *bio)
+ {
+ blk_status_t error = bio->bi_status;
+@@ -972,6 +987,11 @@ static void clone_endio(struct bio *bio)
+ }
+ }
+
++ if (unlikely(swap_bios_limit(tio->ti, bio))) {
++ struct mapped_device *md = io->md;
++ up(&md->swap_bios_semaphore);
++ }
++
+ free_tio(tio);
+ dec_pending(io, error);
+ }
+@@ -1250,6 +1270,22 @@ void dm_remap_zone_report(struct dm_target *ti, struct bio *bio, sector_t start)
+ }
+ EXPORT_SYMBOL_GPL(dm_remap_zone_report);
+
++static noinline void __set_swap_bios_limit(struct mapped_device *md, int latch)
++{
++ mutex_lock(&md->swap_bios_lock);
++ while (latch < md->swap_bios) {
++ cond_resched();
++ down(&md->swap_bios_semaphore);
++ md->swap_bios--;
++ }
++ while (latch > md->swap_bios) {
++ cond_resched();
++ up(&md->swap_bios_semaphore);
++ md->swap_bios++;
++ }
++ mutex_unlock(&md->swap_bios_lock);
++}
++
+ static blk_qc_t __map_bio(struct dm_target_io *tio)
+ {
+ int r;
+@@ -1270,6 +1306,14 @@ static blk_qc_t __map_bio(struct dm_target_io *tio)
+ atomic_inc(&io->io_count);
+ sector = clone->bi_iter.bi_sector;
+
++ if (unlikely(swap_bios_limit(ti, clone))) {
++ struct mapped_device *md = io->md;
++ int latch = get_swap_bios();
++ if (unlikely(latch != md->swap_bios))
++ __set_swap_bios_limit(md, latch);
++ down(&md->swap_bios_semaphore);
++ }
++
+ r = ti->type->map(ti, clone);
+ switch (r) {
+ case DM_MAPIO_SUBMITTED:
+@@ -1284,10 +1328,18 @@ static blk_qc_t __map_bio(struct dm_target_io *tio)
+ ret = generic_make_request(clone);
+ break;
+ case DM_MAPIO_KILL:
++ if (unlikely(swap_bios_limit(ti, clone))) {
++ struct mapped_device *md = io->md;
++ up(&md->swap_bios_semaphore);
++ }
+ free_tio(tio);
+ dec_pending(io, BLK_STS_IOERR);
+ break;
+ case DM_MAPIO_REQUEUE:
++ if (unlikely(swap_bios_limit(ti, clone))) {
++ struct mapped_device *md = io->md;
++ up(&md->swap_bios_semaphore);
++ }
+ free_tio(tio);
+ dec_pending(io, BLK_STS_DM_REQUEUE);
+ break;
+@@ -1859,6 +1911,7 @@ static void cleanup_mapped_device(struct mapped_device *md)
+ mutex_destroy(&md->suspend_lock);
+ mutex_destroy(&md->type_lock);
+ mutex_destroy(&md->table_devices_lock);
++ mutex_destroy(&md->swap_bios_lock);
+
+ dm_mq_cleanup_mapped_device(md);
+ }
+@@ -1933,6 +1986,10 @@ static struct mapped_device *alloc_dev(int minor)
+ init_completion(&md->kobj_holder.completion);
+ md->kworker_task = NULL;
+
++ md->swap_bios = get_swap_bios();
++ sema_init(&md->swap_bios_semaphore, md->swap_bios);
++ mutex_init(&md->swap_bios_lock);
++
+ md->disk->major = _major;
+ md->disk->first_minor = minor;
+ md->disk->fops = &dm_blk_dops;
+@@ -3228,6 +3285,9 @@ MODULE_PARM_DESC(reserved_bio_based_ios, "Reserved IOs in bio-based mempools");
+ module_param(dm_numa_node, int, S_IRUGO | S_IWUSR);
+ MODULE_PARM_DESC(dm_numa_node, "NUMA node for DM device memory allocations");
+
++module_param(swap_bios, int, S_IRUGO | S_IWUSR);
++MODULE_PARM_DESC(swap_bios, "Maximum allowed inflight swap IOs");
++
+ MODULE_DESCRIPTION(DM_NAME " driver");
+ MODULE_AUTHOR("Joe Thornber <dm-devel@redhat.com>");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/media/i2c/ov5670.c b/drivers/media/i2c/ov5670.c
+index 53dd30d96e691..62dfdcb6e0bd6 100644
+--- a/drivers/media/i2c/ov5670.c
++++ b/drivers/media/i2c/ov5670.c
+@@ -2081,7 +2081,8 @@ static int ov5670_init_controls(struct ov5670 *ov5670)
+
+ /* By default, V4L2_CID_PIXEL_RATE is read only */
+ ov5670->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &ov5670_ctrl_ops,
+- V4L2_CID_PIXEL_RATE, 0,
++ V4L2_CID_PIXEL_RATE,
++ link_freq_configs[0].pixel_rate,
+ link_freq_configs[0].pixel_rate,
+ 1,
+ link_freq_configs[0].pixel_rate);
+diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
+index 2f0171134f7e1..e04fe9f17b7aa 100644
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -986,8 +986,10 @@ int cx25821_riscmem_alloc(struct pci_dev *pci,
+ __le32 *cpu;
+ dma_addr_t dma = 0;
+
+- if (NULL != risc->cpu && risc->size < size)
++ if (risc->cpu && risc->size < size) {
+ pci_free_consistent(pci, risc->size, risc->cpu, risc->dma);
++ risc->cpu = NULL;
++ }
+ if (NULL == risc->cpu) {
+ cpu = pci_zalloc_consistent(pci, size, &dma);
+ if (NULL == cpu)
+diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+index 2ad2870c03ae2..cdf4d07343a71 100644
+--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+@@ -1290,7 +1290,7 @@ static int cio2_subdev_set_fmt(struct v4l2_subdev *sd,
+ fmt->format.code = formats[0].mbus_code;
+
+ for (i = 0; i < ARRAY_SIZE(formats); i++) {
+- if (formats[i].mbus_code == fmt->format.code) {
++ if (formats[i].mbus_code == mbus_code) {
+ fmt->format.code = mbus_code;
+ break;
+ }
+diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
+index 66acfd35ffc60..8680eb08b654d 100644
+--- a/drivers/media/pci/saa7134/saa7134-empress.c
++++ b/drivers/media/pci/saa7134/saa7134-empress.c
+@@ -293,8 +293,11 @@ static int empress_init(struct saa7134_dev *dev)
+ q->lock = &dev->lock;
+ q->dev = &dev->pci->dev;
+ err = vb2_queue_init(q);
+- if (err)
++ if (err) {
++ video_device_release(dev->empress_dev);
++ dev->empress_dev = NULL;
+ return err;
++ }
+ dev->empress_dev->queue = q;
+
+ video_set_drvdata(dev->empress_dev, dev);
+diff --git a/drivers/media/platform/pxa_camera.c b/drivers/media/platform/pxa_camera.c
+index 406ac673ad84c..0281b8e53fef2 100644
+--- a/drivers/media/platform/pxa_camera.c
++++ b/drivers/media/platform/pxa_camera.c
+@@ -1452,6 +1452,9 @@ static int pxac_vb2_prepare(struct vb2_buffer *vb)
+ struct pxa_camera_dev *pcdev = vb2_get_drv_priv(vb->vb2_queue);
+ struct pxa_buffer *buf = vb2_to_pxa_buffer(vb);
+ int ret = 0;
++#ifdef DEBUG
++ int i;
++#endif
+
+ switch (pcdev->channels) {
+ case 1:
+diff --git a/drivers/media/platform/qcom/camss/camss-video.c b/drivers/media/platform/qcom/camss/camss-video.c
+index c9bb0d023db48..e81ebeb0506e4 100644
+--- a/drivers/media/platform/qcom/camss/camss-video.c
++++ b/drivers/media/platform/qcom/camss/camss-video.c
+@@ -901,6 +901,7 @@ int msm_video_register(struct camss_video *video, struct v4l2_device *v4l2_dev,
+ video->nformats = ARRAY_SIZE(formats_rdi_8x96);
+ }
+ } else {
++ ret = -EINVAL;
+ goto error_video_register;
+ }
+
+diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c
+index 4e6530ee809af..022f84569d0e5 100644
+--- a/drivers/media/platform/vsp1/vsp1_drv.c
++++ b/drivers/media/platform/vsp1/vsp1_drv.c
+@@ -882,8 +882,10 @@ static int vsp1_probe(struct platform_device *pdev)
+ }
+
+ done:
+- if (ret)
++ if (ret) {
+ pm_runtime_disable(&pdev->dev);
++ rcar_fcp_put(vsp1->fcp);
++ }
+
+ return ret;
+ }
+diff --git a/drivers/media/tuners/qm1d1c0042.c b/drivers/media/tuners/qm1d1c0042.c
+index 83ca5dc047ea2..baa9950783b66 100644
+--- a/drivers/media/tuners/qm1d1c0042.c
++++ b/drivers/media/tuners/qm1d1c0042.c
+@@ -343,8 +343,10 @@ static int qm1d1c0042_init(struct dvb_frontend *fe)
+ if (val == reg_initval[reg_index][0x00])
+ break;
+ }
+- if (reg_index >= QM1D1C0042_NUM_REG_ROWS)
++ if (reg_index >= QM1D1C0042_NUM_REG_ROWS) {
++ ret = -EINVAL;
+ goto failed;
++ }
+ memcpy(state->regs, reg_initval[reg_index], QM1D1C0042_NUM_REGS);
+ usleep_range(2000, 3000);
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 0750a975bcb89..316edb2dd6c4a 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -436,7 +436,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+ ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
+
+ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
+- lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa),
++ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa);
+
+ lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
+index 69445c8e38e28..d0f95a5cb4d23 100644
+--- a/drivers/media/usb/em28xx/em28xx-core.c
++++ b/drivers/media/usb/em28xx/em28xx-core.c
+@@ -955,14 +955,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
+
+ usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
+ if (!usb_bufs->buf[i]) {
+- em28xx_uninit_usb_xfer(dev, mode);
+-
+ for (i--; i >= 0; i--)
+ kfree(usb_bufs->buf[i]);
+
+- kfree(usb_bufs->buf);
+- usb_bufs->buf = NULL;
+-
++ em28xx_uninit_usb_xfer(dev, mode);
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c
+index 3db2fd7f5d7c4..e4f2160f46ff1 100644
+--- a/drivers/media/usb/tm6000/tm6000-dvb.c
++++ b/drivers/media/usb/tm6000/tm6000-dvb.c
+@@ -149,6 +149,10 @@ static int tm6000_start_stream(struct tm6000_core *dev)
+ if (ret < 0) {
+ printk(KERN_ERR "tm6000: error %i in %s during pipe reset\n",
+ ret, __func__);
++
++ kfree(dvb->bulk_urb->transfer_buffer);
++ usb_free_urb(dvb->bulk_urb);
++ dvb->bulk_urb = NULL;
+ return ret;
+ } else
+ printk(KERN_ERR "tm6000: pipe resetted\n");
+diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
+index 0921c95a1dca5..06167c51af128 100644
+--- a/drivers/media/usb/uvc/uvc_v4l2.c
++++ b/drivers/media/usb/uvc/uvc_v4l2.c
+@@ -253,7 +253,9 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
+ goto done;
+
+ /* After the probe, update fmt with the values returned from
+- * negotiation with the device.
++ * negotiation with the device. Some devices return invalid bFormatIndex
++ * and bFrameIndex values, in which case we can only assume they have
++ * accepted the requested format as-is.
+ */
+ for (i = 0; i < stream->nformats; ++i) {
+ if (probe->bFormatIndex == stream->format[i].index) {
+@@ -262,11 +264,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
+ }
+ }
+
+- if (i == stream->nformats) {
+- uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n",
++ if (i == stream->nformats)
++ uvc_trace(UVC_TRACE_FORMAT,
++ "Unknown bFormatIndex %u, using default\n",
+ probe->bFormatIndex);
+- return -EINVAL;
+- }
+
+ for (i = 0; i < format->nframes; ++i) {
+ if (probe->bFrameIndex == format->frame[i].bFrameIndex) {
+@@ -275,11 +276,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
+ }
+ }
+
+- if (i == format->nframes) {
+- uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n",
++ if (i == format->nframes)
++ uvc_trace(UVC_TRACE_FORMAT,
++ "Unknown bFrameIndex %u, using default\n",
+ probe->bFrameIndex);
+- return -EINVAL;
+- }
+
+ fmt->fmt.pix.width = frame->wWidth;
+ fmt->fmt.pix.height = frame->wHeight;
+diff --git a/drivers/memory/ti-aemif.c b/drivers/memory/ti-aemif.c
+index 475e5b3790edb..be3d978648f57 100644
+--- a/drivers/memory/ti-aemif.c
++++ b/drivers/memory/ti-aemif.c
+@@ -381,8 +381,10 @@ static int aemif_probe(struct platform_device *pdev)
+ */
+ for_each_available_child_of_node(np, child_np) {
+ ret = of_aemif_parse_abus_config(pdev, child_np);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(child_np);
+ goto error;
++ }
+ }
+ } else if (pdata && pdata->num_abus_data > 0) {
+ for (i = 0; i < pdata->num_abus_data; i++, aemif->num_cs++) {
+@@ -408,8 +410,10 @@ static int aemif_probe(struct platform_device *pdev)
+ for_each_available_child_of_node(np, child_np) {
+ ret = of_platform_populate(child_np, NULL,
+ dev_lookup, dev);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(child_np);
+ goto error;
++ }
+ }
+ } else if (pdata) {
+ for (i = 0; i < pdata->num_sub_devices; i++) {
+diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c
+index fab3cdc27ed64..19d57a45134c6 100644
+--- a/drivers/mfd/bd9571mwv.c
++++ b/drivers/mfd/bd9571mwv.c
+@@ -185,9 +185,9 @@ static int bd9571mwv_probe(struct i2c_client *client,
+ return ret;
+ }
+
+- ret = mfd_add_devices(bd->dev, PLATFORM_DEVID_AUTO, bd9571mwv_cells,
+- ARRAY_SIZE(bd9571mwv_cells), NULL, 0,
+- regmap_irq_get_domain(bd->irq_data));
++ ret = devm_mfd_add_devices(bd->dev, PLATFORM_DEVID_AUTO,
++ bd9571mwv_cells, ARRAY_SIZE(bd9571mwv_cells),
++ NULL, 0, regmap_irq_get_domain(bd->irq_data));
+ if (ret) {
+ regmap_del_irq_chip(bd->irq, bd->irq_data);
+ return ret;
+diff --git a/drivers/mfd/wm831x-auxadc.c b/drivers/mfd/wm831x-auxadc.c
+index fd789d2eb0f52..9f7ae1e1ebcd6 100644
+--- a/drivers/mfd/wm831x-auxadc.c
++++ b/drivers/mfd/wm831x-auxadc.c
+@@ -98,11 +98,10 @@ static int wm831x_auxadc_read_irq(struct wm831x *wm831x,
+ wait_for_completion_timeout(&req->done, msecs_to_jiffies(500));
+
+ mutex_lock(&wm831x->auxadc_lock);
+-
+- list_del(&req->list);
+ ret = req->val;
+
+ out:
++ list_del(&req->list);
+ mutex_unlock(&wm831x->auxadc_lock);
+
+ kfree(req);
+diff --git a/drivers/misc/aspeed-lpc-snoop.c b/drivers/misc/aspeed-lpc-snoop.c
+index c10be21a1663d..b4a776bf44bc5 100644
+--- a/drivers/misc/aspeed-lpc-snoop.c
++++ b/drivers/misc/aspeed-lpc-snoop.c
+@@ -15,6 +15,7 @@
+ */
+
+ #include <linux/bitops.h>
++#include <linux/clk.h>
+ #include <linux/interrupt.h>
+ #include <linux/fs.h>
+ #include <linux/kfifo.h>
+@@ -71,6 +72,7 @@ struct aspeed_lpc_snoop_channel {
+ struct aspeed_lpc_snoop {
+ struct regmap *regmap;
+ int irq;
++ struct clk *clk;
+ struct aspeed_lpc_snoop_channel chan[NUM_SNOOP_CHANNELS];
+ };
+
+@@ -286,22 +288,42 @@ static int aspeed_lpc_snoop_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
++ lpc_snoop->clk = devm_clk_get(dev, NULL);
++ if (IS_ERR(lpc_snoop->clk)) {
++ rc = PTR_ERR(lpc_snoop->clk);
++ if (rc != -EPROBE_DEFER)
++ dev_err(dev, "couldn't get clock\n");
++ return rc;
++ }
++ rc = clk_prepare_enable(lpc_snoop->clk);
++ if (rc) {
++ dev_err(dev, "couldn't enable clock\n");
++ return rc;
++ }
++
+ rc = aspeed_lpc_snoop_config_irq(lpc_snoop, pdev);
+ if (rc)
+- return rc;
++ goto err;
+
+ rc = aspeed_lpc_enable_snoop(lpc_snoop, dev, 0, port);
+ if (rc)
+- return rc;
++ goto err;
+
+ /* Configuration of 2nd snoop channel port is optional */
+ if (of_property_read_u32_index(dev->of_node, "snoop-ports",
+ 1, &port) == 0) {
+ rc = aspeed_lpc_enable_snoop(lpc_snoop, dev, 1, port);
+- if (rc)
++ if (rc) {
+ aspeed_lpc_disable_snoop(lpc_snoop, 0);
++ goto err;
++ }
+ }
+
++ return 0;
++
++err:
++ clk_disable_unprepare(lpc_snoop->clk);
++
+ return rc;
+ }
+
+@@ -313,6 +335,8 @@ static int aspeed_lpc_snoop_remove(struct platform_device *pdev)
+ aspeed_lpc_disable_snoop(lpc_snoop, 0);
+ aspeed_lpc_disable_snoop(lpc_snoop, 1);
+
++ clk_disable_unprepare(lpc_snoop->clk);
++
+ return 0;
+ }
+
+diff --git a/drivers/misc/cardreader/rts5227.c b/drivers/misc/cardreader/rts5227.c
+index f0e845c8e6a76..d3ce9fe08eafb 100644
+--- a/drivers/misc/cardreader/rts5227.c
++++ b/drivers/misc/cardreader/rts5227.c
+@@ -339,6 +339,11 @@ static int rts522a_extra_init_hw(struct rtsx_pcr *pcr)
+ {
+ rts5227_extra_init_hw(pcr);
+
++ /* Power down OCP for power consumption */
++ if (!pcr->card_exist)
++ rtsx_pci_write_register(pcr, FPDCTL, OC_POWER_DOWN,
++ OC_POWER_DOWN);
++
+ rtsx_pci_write_register(pcr, FUNC_FORCE_CTL, FUNC_FORCE_UPME_XMT_DBG,
+ FUNC_FORCE_UPME_XMT_DBG);
+ rtsx_pci_write_register(pcr, PCLK_CTL, 0x04, 0x04);
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index 38766968bfa20..a3248ebd28c62 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -523,3 +523,4 @@ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Driver for 93xx46 EEPROMs");
+ MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
+ MODULE_ALIAS("spi:93xx46");
++MODULE_ALIAS("spi:eeprom-93xx46");
+diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+index 5e0d1ac67f73f..9bc97d6a651db 100644
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -552,6 +552,9 @@ static struct vmci_queue *qp_host_alloc_queue(u64 size)
+
+ queue_page_size = num_pages * sizeof(*queue->kernel_if->u.h.page);
+
++ if (queue_size + queue_page_size > KMALLOC_MAX_SIZE)
++ return NULL;
++
+ queue = kzalloc(queue_size + queue_page_size, GFP_KERNEL);
+ if (queue) {
+ queue->q_header = NULL;
+@@ -645,7 +648,7 @@ static void qp_release_pages(struct page **pages,
+
+ for (i = 0; i < num_pages; i++) {
+ if (dirty)
+- set_page_dirty(pages[i]);
++ set_page_dirty_lock(pages[i]);
+
+ put_page(pages[i]);
+ pages[i] = NULL;
+diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+index 74eea8247490d..6e2685c9e9cb5 100644
+--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+@@ -180,8 +180,8 @@ renesas_sdhi_internal_dmac_start_dma(struct tmio_mmc_host *host,
+ mmc_get_dma_dir(data)))
+ goto force_pio;
+
+- /* This DMAC cannot handle if buffer is not 8-bytes alignment */
+- if (!IS_ALIGNED(sg_dma_address(sg), 8))
++ /* This DMAC cannot handle if buffer is not 128-bytes alignment */
++ if (!IS_ALIGNED(sg_dma_address(sg), 128))
+ goto force_pio_with_unmap;
+
+ if (data->flags & MMC_DATA_READ) {
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index bd502f4f47045..5099353e6f137 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -1370,9 +1370,10 @@ static int sdhci_esdhc_imx_remove(struct platform_device *pdev)
+ struct sdhci_host *host = platform_get_drvdata(pdev);
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
+- int dead = (readl(host->ioaddr + SDHCI_INT_STATUS) == 0xffffffff);
++ int dead;
+
+ pm_runtime_get_sync(&pdev->dev);
++ dead = (readl(host->ioaddr + SDHCI_INT_STATUS) == 0xffffffff);
+ pm_runtime_disable(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
+
+diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c
+index cdfeb15b6f051..ef3aa8b520787 100644
+--- a/drivers/mmc/host/usdhi6rol0.c
++++ b/drivers/mmc/host/usdhi6rol0.c
+@@ -1866,10 +1866,12 @@ static int usdhi6_probe(struct platform_device *pdev)
+
+ ret = mmc_add_host(mmc);
+ if (ret < 0)
+- goto e_clk_off;
++ goto e_release_dma;
+
+ return 0;
+
++e_release_dma:
++ usdhi6_dma_release(host);
+ e_clk_off:
+ clk_disable_unprepare(host->clk);
+ e_free_mmc:
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index 04cedd3a2bf66..a92f531ad23a3 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -473,7 +473,7 @@ static int cqspi_read_setup(struct spi_nor *nor)
+ /* Setup dummy clock cycles */
+ dummy_clk = nor->read_dummy;
+ if (dummy_clk > CQSPI_DUMMY_CLKS_MAX)
+- dummy_clk = CQSPI_DUMMY_CLKS_MAX;
++ return -EOPNOTSUPP;
+
+ if (dummy_clk / 8) {
+ reg |= (1 << CQSPI_REG_RD_INSTR_MODE_EN_LSB);
+diff --git a/drivers/mtd/spi-nor/hisi-sfc.c b/drivers/mtd/spi-nor/hisi-sfc.c
+index dea7b0c4b339f..184ba5069ac51 100644
+--- a/drivers/mtd/spi-nor/hisi-sfc.c
++++ b/drivers/mtd/spi-nor/hisi-sfc.c
+@@ -408,8 +408,10 @@ static int hisi_spi_nor_register_all(struct hifmc_host *host)
+
+ for_each_available_child_of_node(dev->of_node, np) {
+ ret = hisi_spi_nor_register(np, host);
+- if (ret)
++ if (ret) {
++ of_node_put(np);
+ goto fail;
++ }
+
+ if (host->num_chip == HIFMC_MAX_CHIP_NUM) {
+ dev_warn(dev, "Flash device number exceeds the maximum chipselect number\n");
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+index b40d4377cc71d..b2cd3bdba9f89 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+@@ -1279,10 +1279,18 @@
+ #define MDIO_PMA_10GBR_FECCTRL 0x00ab
+ #endif
+
++#ifndef MDIO_PMA_RX_CTRL1
++#define MDIO_PMA_RX_CTRL1 0x8051
++#endif
++
+ #ifndef MDIO_PCS_DIG_CTRL
+ #define MDIO_PCS_DIG_CTRL 0x8000
+ #endif
+
++#ifndef MDIO_PCS_DIGITAL_STAT
++#define MDIO_PCS_DIGITAL_STAT 0x8010
++#endif
++
+ #ifndef MDIO_AN_XNP
+ #define MDIO_AN_XNP 0x0016
+ #endif
+@@ -1358,6 +1366,8 @@
+ #define XGBE_KR_TRAINING_ENABLE BIT(1)
+
+ #define XGBE_PCS_CL37_BP BIT(12)
++#define XGBE_PCS_PSEQ_STATE_MASK 0x1c
++#define XGBE_PCS_PSEQ_STATE_POWER_GOOD 0x10
+
+ #define XGBE_AN_CL37_INT_CMPLT BIT(0)
+ #define XGBE_AN_CL37_INT_MASK 0x01
+@@ -1375,6 +1385,10 @@
+ #define XGBE_PMA_CDR_TRACK_EN_OFF 0x00
+ #define XGBE_PMA_CDR_TRACK_EN_ON 0x01
+
++#define XGBE_PMA_RX_RST_0_MASK BIT(4)
++#define XGBE_PMA_RX_RST_0_RESET_ON 0x10
++#define XGBE_PMA_RX_RST_0_RESET_OFF 0x00
++
+ /* Bit setting and getting macros
+ * The get macro will extract the current bit field value from within
+ * the variable
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 5519eff584417..80cf6af822f72 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1444,6 +1444,7 @@ static void xgbe_stop(struct xgbe_prv_data *pdata)
+ return;
+
+ netif_tx_stop_all_queues(netdev);
++ netif_carrier_off(pdata->netdev);
+
+ xgbe_stop_timers(pdata);
+ flush_workqueue(pdata->dev_workqueue);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 8a3a60bb26888..156a0bc8ab01d 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1345,7 +1345,7 @@ static void xgbe_phy_status(struct xgbe_prv_data *pdata)
+ &an_restart);
+ if (an_restart) {
+ xgbe_phy_config_aneg(pdata);
+- return;
++ goto adjust_link;
+ }
+
+ if (pdata->phy.link) {
+@@ -1396,7 +1396,6 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
+ pdata->phy_if.phy_impl.stop(pdata);
+
+ pdata->phy.link = 0;
+- netif_carrier_off(pdata->netdev);
+
+ xgbe_phy_adjust_link(pdata);
+ }
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index 3ceb4f95ca7ca..54753c8a6a9d7 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -912,6 +912,9 @@ static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata)
+ if ((phy_id & 0xfffffff0) != 0x03625d10)
+ return false;
+
++ /* Reset PHY - wait for self-clearing reset bit to clear */
++ genphy_soft_reset(phy_data->phydev);
++
+ /* Disable RGMII mode */
+ phy_write(phy_data->phydev, 0x18, 0x7007);
+ reg = phy_read(phy_data->phydev, 0x18);
+@@ -1942,6 +1945,27 @@ static void xgbe_phy_set_redrv_mode(struct xgbe_prv_data *pdata)
+ xgbe_phy_put_comm_ownership(pdata);
+ }
+
++static void xgbe_phy_rx_reset(struct xgbe_prv_data *pdata)
++{
++ int reg;
++
++ reg = XMDIO_READ_BITS(pdata, MDIO_MMD_PCS, MDIO_PCS_DIGITAL_STAT,
++ XGBE_PCS_PSEQ_STATE_MASK);
++ if (reg == XGBE_PCS_PSEQ_STATE_POWER_GOOD) {
++ /* Mailbox command timed out, reset of RX block is required.
++ * This can be done by asseting the reset bit and wait for
++ * its compeletion.
++ */
++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_CTRL1,
++ XGBE_PMA_RX_RST_0_MASK, XGBE_PMA_RX_RST_0_RESET_ON);
++ ndelay(20);
++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_CTRL1,
++ XGBE_PMA_RX_RST_0_MASK, XGBE_PMA_RX_RST_0_RESET_OFF);
++ usleep_range(40, 50);
++ netif_err(pdata, link, pdata->netdev, "firmware mailbox reset performed\n");
++ }
++}
++
+ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+ unsigned int cmd, unsigned int sub_cmd)
+ {
+@@ -1949,9 +1973,11 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+ unsigned int wait;
+
+ /* Log if a previous command did not complete */
+- if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS))
++ if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) {
+ netif_dbg(pdata, link, pdata->netdev,
+ "firmware mailbox not ready for command\n");
++ xgbe_phy_rx_reset(pdata);
++ }
+
+ /* Construct the command */
+ XP_SET_BITS(s0, XP_DRIVER_SCRATCH_0, COMMAND, cmd);
+@@ -1973,6 +1999,9 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+
+ netif_dbg(pdata, link, pdata->netdev,
+ "firmware mailbox command did not complete\n");
++
++ /* Reset on error */
++ xgbe_phy_rx_reset(pdata);
+ }
+
+ static void xgbe_phy_rrc(struct xgbe_prv_data *pdata)
+@@ -2569,6 +2598,14 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart)
+ if (reg & MDIO_STAT1_LSTATUS)
+ return 1;
+
++ if (pdata->phy.autoneg == AUTONEG_ENABLE &&
++ phy_data->port_mode == XGBE_PORT_MODE_BACKPLANE) {
++ if (!test_bit(XGBE_LINK_INIT, &pdata->dev_state)) {
++ netif_carrier_off(pdata->netdev);
++ *an_restart = 1;
++ }
++ }
++
+ /* No link, attempt a receiver reset cycle */
+ if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) {
+ phy_data->rrc_count = 0;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index db1a23b8d531d..44ed2f6e2d96c 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -6298,9 +6298,10 @@ void bnxt_tx_disable(struct bnxt *bp)
+ txr->dev_state = BNXT_DEV_STATE_CLOSING;
+ }
+ }
++ /* Drop carrier first to prevent TX timeout */
++ netif_carrier_off(bp->dev);
+ /* Stop all TX queues */
+ netif_tx_disable(bp->dev);
+- netif_carrier_off(bp->dev);
+ }
+
+ void bnxt_tx_enable(struct bnxt *bp)
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+index de9ad311dacd8..ea0758de8ac89 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+@@ -44,6 +44,9 @@
+
+ #define MAX_ULD_QSETS 16
+
++/* ulp_mem_io + ulptx_idata + payload + padding */
++#define MAX_IMM_ULPTX_WR_LEN (32 + 8 + 256 + 8)
++
+ /* CPL message priority levels */
+ enum {
+ CPL_PRIORITY_DATA = 0, /* data messages */
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+index 7801f2aeeb30e..0a2d10a000ca4 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+@@ -2084,17 +2084,22 @@ int t4_mgmt_tx(struct adapter *adap, struct sk_buff *skb)
+ * @skb: the packet
+ *
+ * Returns true if a packet can be sent as an offload WR with immediate
+- * data. We currently use the same limit as for Ethernet packets.
++ * data.
++ * FW_OFLD_TX_DATA_WR limits the payload to 255 bytes due to 8-bit field.
++ * However, FW_ULPTX_WR commands have a 256 byte immediate only
++ * payload limit.
+ */
+ static inline int is_ofld_imm(const struct sk_buff *skb)
+ {
+ struct work_request_hdr *req = (struct work_request_hdr *)skb->data;
+ unsigned long opcode = FW_WR_OP_G(ntohl(req->wr_hi));
+
+- if (opcode == FW_CRYPTO_LOOKASIDE_WR)
++ if (unlikely(opcode == FW_ULPTX_WR))
++ return skb->len <= MAX_IMM_ULPTX_WR_LEN;
++ else if (opcode == FW_CRYPTO_LOOKASIDE_WR)
+ return skb->len <= SGE_MAX_WR_LEN;
+ else
+- return skb->len <= MAX_IMM_TX_PKT_LEN;
++ return skb->len <= MAX_IMM_OFLD_TX_DATA_WR_LEN;
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 68d5971c200a1..0c7c0206b1be5 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -212,8 +212,13 @@ static void free_long_term_buff(struct ibmvnic_adapter *adapter,
+ if (!ltb->buff)
+ return;
+
++ /* VIOS automatically unmaps the long term buffer at remote
++ * end for the following resets:
++ * FAILOVER, MOBILITY, TIMEOUT.
++ */
+ if (adapter->reset_reason != VNIC_RESET_FAILOVER &&
+- adapter->reset_reason != VNIC_RESET_MOBILITY)
++ adapter->reset_reason != VNIC_RESET_MOBILITY &&
++ adapter->reset_reason != VNIC_RESET_TIMEOUT)
+ send_request_unmap(adapter, ltb->map_id);
+ dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr);
+ }
+@@ -1257,10 +1262,8 @@ static int __ibmvnic_close(struct net_device *netdev)
+
+ adapter->state = VNIC_CLOSING;
+ rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_DN);
+- if (rc)
+- return rc;
+ adapter->state = VNIC_CLOSED;
+- return 0;
++ return rc;
+ }
+
+ static int ibmvnic_close(struct net_device *netdev)
+@@ -1523,6 +1526,9 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ skb_copy_from_linear_data(skb, dst, skb->len);
+ }
+
++ /* post changes to long_term_buff *dst before VIOS accessing it */
++ dma_wmb();
++
+ tx_pool->consumer_index =
+ (tx_pool->consumer_index + 1) % tx_pool->num_buffers;
+
+@@ -2188,6 +2194,8 @@ restart_poll:
+ offset = be16_to_cpu(next->rx_comp.off_frame_data);
+ flags = next->rx_comp.flags;
+ skb = rx_buff->skb;
++ /* load long_term_buff before copying to skb */
++ dma_rmb();
+ skb_copy_to_linear_data(skb, rx_buff->data + offset,
+ length);
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index a728b6a7872cb..fe9da568ee196 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -2577,7 +2577,7 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
+ return;
+ if (!test_and_clear_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state))
+ return;
+- if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) {
++ if (test_bit(__I40E_VF_DISABLE, pf->state)) {
+ set_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state);
+ return;
+ }
+@@ -2595,7 +2595,6 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
+ }
+ }
+ }
+- clear_bit(__I40E_VF_DISABLE, pf->state);
+ }
+
+ /**
+@@ -7007,6 +7006,8 @@ int i40e_add_del_cloud_filter(struct i40e_vsi *vsi,
+ if (filter->flags >= ARRAY_SIZE(flag_table))
+ return I40E_ERR_CONFIG;
+
++ memset(&cld_filter, 0, sizeof(cld_filter));
++
+ /* copy element needed to add cloud filter from filter */
+ i40e_set_cld_element(filter, &cld_filter);
+
+@@ -7070,10 +7071,13 @@ int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
+ return -EOPNOTSUPP;
+
+ /* adding filter using src_port/src_ip is not supported at this stage */
+- if (filter->src_port || filter->src_ipv4 ||
++ if (filter->src_port ||
++ (filter->src_ipv4 && filter->n_proto != ETH_P_IPV6) ||
+ !ipv6_addr_any(&filter->ip.v6.src_ip6))
+ return -EOPNOTSUPP;
+
++ memset(&cld_filter, 0, sizeof(cld_filter));
++
+ /* copy element needed to add cloud filter from filter */
+ i40e_set_cld_element(filter, &cld_filter.element);
+
+@@ -7097,7 +7101,7 @@ int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
+ cpu_to_le16(I40E_AQC_ADD_CLOUD_FILTER_MAC_VLAN_PORT);
+ }
+
+- } else if (filter->dst_ipv4 ||
++ } else if ((filter->dst_ipv4 && filter->n_proto != ETH_P_IPV6) ||
+ !ipv6_addr_any(&filter->ip.v6.dst_ip6)) {
+ cld_filter.element.flags =
+ cpu_to_le16(I40E_AQC_ADD_CLOUD_FILTER_IP_PORT);
+@@ -9399,7 +9403,6 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
+ {
+ struct i40e_vsi *vsi = pf->vsi[pf->lan_vsi];
+ struct i40e_hw *hw = &pf->hw;
+- u8 set_fc_aq_fail = 0;
+ i40e_status ret;
+ u32 val;
+ int v;
+@@ -9480,13 +9483,6 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
+ i40e_stat_str(&pf->hw, ret),
+ i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
+
+- /* make sure our flow control settings are restored */
+- ret = i40e_set_fc(&pf->hw, &set_fc_aq_fail, true);
+- if (ret)
+- dev_dbg(&pf->pdev->dev, "setting flow control: ret = %s last_status = %s\n",
+- i40e_stat_str(&pf->hw, ret),
+- i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
+-
+ /* Rebuild the VSIs and VEBs that existed before reset.
+ * They are still in our local switch element arrays, so only
+ * need to rebuild the switch model in the HW.
+@@ -11107,6 +11103,8 @@ i40e_status i40e_set_partition_bw_setting(struct i40e_pf *pf)
+ struct i40e_aqc_configure_partition_bw_data bw_data;
+ i40e_status status;
+
++ memset(&bw_data, 0, sizeof(bw_data));
++
+ /* Set the valid bit for this PF */
+ bw_data.pf_valid_bits = cpu_to_le16(BIT(pf->hw.pf_id));
+ bw_data.max_bw[pf->hw.pf_id] = pf->max_bw & I40E_ALT_BW_VALUE_MASK;
+@@ -13623,7 +13621,6 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ int err;
+ u32 val;
+ u32 i;
+- u8 set_fc_aq_fail;
+
+ err = pci_enable_device_mem(pdev);
+ if (err)
+@@ -13903,24 +13900,6 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ }
+ INIT_LIST_HEAD(&pf->vsi[pf->lan_vsi]->ch_list);
+
+- /* Make sure flow control is set according to current settings */
+- err = i40e_set_fc(hw, &set_fc_aq_fail, true);
+- if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_GET)
+- dev_dbg(&pf->pdev->dev,
+- "Set fc with err %s aq_err %s on get_phy_cap\n",
+- i40e_stat_str(hw, err),
+- i40e_aq_str(hw, hw->aq.asq_last_status));
+- if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_SET)
+- dev_dbg(&pf->pdev->dev,
+- "Set fc with err %s aq_err %s on set_phy_config\n",
+- i40e_stat_str(hw, err),
+- i40e_aq_str(hw, hw->aq.asq_last_status));
+- if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_UPDATE)
+- dev_dbg(&pf->pdev->dev,
+- "Set fc with err %s aq_err %s on get_link_info\n",
+- i40e_stat_str(hw, err),
+- i40e_aq_str(hw, hw->aq.asq_last_status));
+-
+ /* if FDIR VSI was set up, start it now */
+ for (i = 0; i < pf->num_alloc_vsi; i++) {
+ if (pf->vsi[i] && pf->vsi[i]->type == I40E_VSI_FDIR) {
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index b5042d1a63c0b..9ccbcd88bf1e6 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -3070,13 +3070,16 @@ static int i40e_tx_enable_csum(struct sk_buff *skb, u32 *tx_flags,
+
+ l4_proto = ip.v4->protocol;
+ } else if (*tx_flags & I40E_TX_FLAGS_IPV6) {
++ int ret;
++
+ tunnel |= I40E_TX_CTX_EXT_IP_IPV6;
+
+ exthdr = ip.hdr + sizeof(*ip.v6);
+ l4_proto = ip.v6->nexthdr;
+- if (l4.hdr != exthdr)
+- ipv6_skip_exthdr(skb, exthdr - skb->data,
+- &l4_proto, &frag_off);
++ ret = ipv6_skip_exthdr(skb, exthdr - skb->data,
++ &l4_proto, &frag_off);
++ if (ret < 0)
++ return -1;
+ }
+
+ /* define outer transport */
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 30a16cf796c7a..fda5dd8c71ebd 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -3022,7 +3022,9 @@ static int mvneta_txq_sw_init(struct mvneta_port *pp,
+ }
+
+ /* Setup XPS mapping */
+- if (txq_number > 1)
++ if (pp->neta_armada3700)
++ cpu = 0;
++ else if (txq_number > 1)
+ cpu = txq->id % num_present_cpus();
+ else
+ cpu = pp->rxq_def % num_present_cpus();
+@@ -3667,6 +3669,11 @@ static int mvneta_cpu_online(unsigned int cpu, struct hlist_node *node)
+ node_online);
+ struct mvneta_pcpu_port *port = per_cpu_ptr(pp->ports, cpu);
+
++ /* Armada 3700's per-cpu interrupt for mvneta is broken, all interrupts
++ * are routed to CPU 0, so we don't need all the cpu-hotplug support
++ */
++ if (pp->neta_armada3700)
++ return 0;
+
+ spin_lock(&pp->lock);
+ /*
+diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+index a4c1ed65f620c..550e4893253ee 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -4990,6 +4990,7 @@ static int mlx4_do_mirror_rule(struct mlx4_dev *dev, struct res_fs_rule *fs_rule
+
+ if (!fs_rule->mirr_mbox) {
+ mlx4_err(dev, "rule mirroring mailbox is null\n");
++ mlx4_free_cmd_mailbox(dev, mailbox);
+ return -EINVAL;
+ }
+ memcpy(mailbox->buf, fs_rule->mirr_mbox, fs_rule->mirr_mbox_size);
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 6b901bf1cd54d..6fd1a639ec533 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -4365,7 +4365,7 @@ static void r8168dp_hw_jumbo_disable(struct rtl8169_private *tp)
+
+ static void r8168e_hw_jumbo_enable(struct rtl8169_private *tp)
+ {
+- RTL_W8(tp, MaxTxPacketSize, 0x3f);
++ RTL_W8(tp, MaxTxPacketSize, 0x24);
+ RTL_W8(tp, Config3, RTL_R8(tp, Config3) | Jumbo_En0);
+ RTL_W8(tp, Config4, RTL_R8(tp, Config4) | 0x01);
+ rtl_tx_performance_tweak(tp, PCI_EXP_DEVCTL_READRQ_512B);
+@@ -4373,7 +4373,7 @@ static void r8168e_hw_jumbo_enable(struct rtl8169_private *tp)
+
+ static void r8168e_hw_jumbo_disable(struct rtl8169_private *tp)
+ {
+- RTL_W8(tp, MaxTxPacketSize, 0x0c);
++ RTL_W8(tp, MaxTxPacketSize, 0x3f);
+ RTL_W8(tp, Config3, RTL_R8(tp, Config3) & ~Jumbo_En0);
+ RTL_W8(tp, Config4, RTL_R8(tp, Config4) & ~0x01);
+ rtl_tx_performance_tweak(tp, PCI_EXP_DEVCTL_READRQ_4096B);
+diff --git a/drivers/net/ethernet/sun/sunvnet_common.c b/drivers/net/ethernet/sun/sunvnet_common.c
+index baa3088b475c7..59fc14b58c838 100644
+--- a/drivers/net/ethernet/sun/sunvnet_common.c
++++ b/drivers/net/ethernet/sun/sunvnet_common.c
+@@ -1353,27 +1353,12 @@ sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
+ if (vio_version_after_eq(&port->vio, 1, 3))
+ localmtu -= VLAN_HLEN;
+
+- if (skb->protocol == htons(ETH_P_IP)) {
+- struct flowi4 fl4;
+- struct rtable *rt = NULL;
+-
+- memset(&fl4, 0, sizeof(fl4));
+- fl4.flowi4_oif = dev->ifindex;
+- fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
+- fl4.daddr = ip_hdr(skb)->daddr;
+- fl4.saddr = ip_hdr(skb)->saddr;
+-
+- rt = ip_route_output_key(dev_net(dev), &fl4);
+- if (!IS_ERR(rt)) {
+- skb_dst_set(skb, &rt->dst);
+- icmp_send(skb, ICMP_DEST_UNREACH,
+- ICMP_FRAG_NEEDED,
+- htonl(localmtu));
+- }
+- }
++ if (skb->protocol == htons(ETH_P_IP))
++ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
++ htonl(localmtu));
+ #if IS_ENABLED(CONFIG_IPV6)
+ else if (skb->protocol == htons(ETH_P_IPV6))
+- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, localmtu);
++ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, localmtu);
+ #endif
+ goto out_dropped;
+ }
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index bb9cd1262cc99..e18d06cb2173c 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -549,9 +549,8 @@ static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev,
+ if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) &&
+ mtu < ntohs(iph->tot_len)) {
+ netdev_dbg(dev, "packet too big, fragmentation needed\n");
+- memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+- htonl(mtu));
++ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
++ htonl(mtu));
+ goto err_rt;
+ }
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index bdfe88c754dfe..d2e5f5b7adf18 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1291,6 +1291,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1e2d, 0x0082, 5)}, /* Cinterion PHxx,PXxx (2 RmNet) */
+ {QMI_FIXED_INTF(0x1e2d, 0x0083, 4)}, /* Cinterion PHxx,PXxx (1 RmNet + USB Audio)*/
+ {QMI_QUIRK_SET_DTR(0x1e2d, 0x00b0, 4)}, /* Cinterion CLS8 */
++ {QMI_FIXED_INTF(0x1e2d, 0x00b7, 0)}, /* Cinterion MV31 RmNet */
+ {QMI_FIXED_INTF(0x413c, 0x81a2, 8)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
+ {QMI_FIXED_INTF(0x413c, 0x81a3, 8)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
+ {QMI_FIXED_INTF(0x413c, 0x81a4, 8)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 66fffbd64a33f..49e8c6d42cda4 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3812,7 +3812,6 @@ static void vxlan_destroy_tunnels(struct net *net, struct list_head *head)
+ struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+ struct vxlan_dev *vxlan, *next;
+ struct net_device *dev, *aux;
+- unsigned int h;
+
+ for_each_netdev_safe(net, dev, aux)
+ if (dev->rtnl_link_ops == &vxlan_link_ops)
+@@ -3826,14 +3825,13 @@ static void vxlan_destroy_tunnels(struct net *net, struct list_head *head)
+ unregister_netdevice_queue(vxlan->dev, head);
+ }
+
+- for (h = 0; h < PORT_HASH_SIZE; ++h)
+- WARN_ON_ONCE(!hlist_empty(&vn->sock_list[h]));
+ }
+
+ static void __net_exit vxlan_exit_batch_net(struct list_head *net_list)
+ {
+ struct net *net;
+ LIST_HEAD(list);
++ unsigned int h;
+
+ rtnl_lock();
+ list_for_each_entry(net, net_list, exit_list)
+@@ -3841,6 +3839,13 @@ static void __net_exit vxlan_exit_batch_net(struct list_head *net_list)
+
+ unregister_netdevice_many(&list);
+ rtnl_unlock();
++
++ list_for_each_entry(net, net_list, exit_list) {
++ struct vxlan_net *vn = net_generic(net, vxlan_net_id);
++
++ for (h = 0; h < PORT_HASH_SIZE; ++h)
++ WARN_ON_ONCE(!hlist_empty(&vn->sock_list[h]));
++ }
+ }
+
+ static struct pernet_operations vxlan_net_ops = {
+diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c
+index e2d78f77edb70..241e6f0e1dfe2 100644
+--- a/drivers/net/wireless/ath/ath10k/snoc.c
++++ b/drivers/net/wireless/ath/ath10k/snoc.c
+@@ -789,13 +789,14 @@ static int ath10k_snoc_hif_power_up(struct ath10k *ar)
+ ret = ath10k_snoc_init_pipes(ar);
+ if (ret) {
+ ath10k_err(ar, "failed to initialize CE: %d\n", ret);
+- goto err_wlan_enable;
++ goto err_free_rri;
+ }
+
+ napi_enable(&ar->napi);
+ return 0;
+
+-err_wlan_enable:
++err_free_rri:
++ ath10k_ce_free_rri(ar);
+ ath10k_snoc_wlan_disable(ar);
+
+ return ret;
+diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
+index 0a6eb8a8c1ed0..84fe686709496 100644
+--- a/drivers/net/wireless/ath/ath9k/debug.c
++++ b/drivers/net/wireless/ath/ath9k/debug.c
+@@ -1236,8 +1236,11 @@ static ssize_t write_file_nf_override(struct file *file,
+
+ ah->nf_override = val;
+
+- if (ah->curchan)
++ if (ah->curchan) {
++ ath9k_ps_wakeup(sc);
+ ath9k_hw_loadnf(ah, ah->curchan);
++ ath9k_ps_restore(sc);
++ }
+
+ return count;
+ }
+diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c
+index 44ab080d65182..88446258e7751 100644
+--- a/drivers/net/wireless/broadcom/b43/phy_n.c
++++ b/drivers/net/wireless/broadcom/b43/phy_n.c
+@@ -5320,7 +5320,7 @@ static void b43_nphy_restore_cal(struct b43_wldev *dev)
+
+ for (i = 0; i < 4; i++) {
+ if (dev->phy.rev >= 3)
+- table[i] = coef[i];
++ coef[i] = table[i];
+ else
+ coef[i] = 0;
+ }
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index c960cb7e3251f..3b5fdb24ef1b9 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -162,13 +162,15 @@ irqreturn_t xenvif_interrupt(int irq, void *dev_id)
+ {
+ struct xenvif_queue *queue = dev_id;
+ int old;
++ bool has_rx, has_tx;
+
+ old = atomic_fetch_or(NETBK_COMMON_EOI, &queue->eoi_pending);
+ WARN(old, "Interrupt while EOI pending\n");
+
+- /* Use bitwise or as we need to call both functions. */
+- if ((!xenvif_handle_tx_interrupt(queue) |
+- !xenvif_handle_rx_interrupt(queue))) {
++ has_tx = xenvif_handle_tx_interrupt(queue);
++ has_rx = xenvif_handle_rx_interrupt(queue);
++
++ if (!has_rx && !has_tx) {
+ atomic_andnot(NETBK_COMMON_EOI, &queue->eoi_pending);
+ xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
+ }
+diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
+index 863cabc352159..f0e0e3b42c91f 100644
+--- a/drivers/nvdimm/dimm_devs.c
++++ b/drivers/nvdimm/dimm_devs.c
+@@ -359,16 +359,16 @@ static ssize_t state_show(struct device *dev, struct device_attribute *attr,
+ }
+ static DEVICE_ATTR_RO(state);
+
+-static ssize_t available_slots_show(struct device *dev,
+- struct device_attribute *attr, char *buf)
++static ssize_t __available_slots_show(struct nvdimm_drvdata *ndd, char *buf)
+ {
+- struct nvdimm_drvdata *ndd = dev_get_drvdata(dev);
++ struct device *dev;
+ ssize_t rc;
+ u32 nfree;
+
+ if (!ndd)
+ return -ENXIO;
+
++ dev = ndd->dev;
+ nvdimm_bus_lock(dev);
+ nfree = nd_label_nfree(ndd);
+ if (nfree - 1 > nfree) {
+@@ -380,6 +380,18 @@ static ssize_t available_slots_show(struct device *dev,
+ nvdimm_bus_unlock(dev);
+ return rc;
+ }
++
++static ssize_t available_slots_show(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ ssize_t rc;
++
++ device_lock(dev);
++ rc = __available_slots_show(dev_get_drvdata(dev), buf);
++ device_unlock(dev);
++
++ return rc;
++}
+ static DEVICE_ATTR_RO(available_slots);
+
+ static struct attribute *nvdimm_attributes[] = {
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 800ad252cf9c6..21160a08ead4b 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1172,8 +1172,16 @@ int __init __weak early_init_dt_mark_hotplug_memory_arch(u64 base, u64 size)
+ int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
+ phys_addr_t size, bool nomap)
+ {
+- if (nomap)
+- return memblock_remove(base, size);
++ if (nomap) {
++ /*
++ * If the memory is already reserved (by another region), we
++ * should not allow it to be marked nomap.
++ */
++ if (memblock_is_region_reserved(base, size))
++ return -EBUSY;
++
++ return memblock_mark_nomap(base, size);
++ }
+ return memblock_reserve(base, size);
+ }
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 791d6b671ee0b..33e5103939767 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -371,7 +371,9 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie)
+
+ /* enable external reference clock */
+ val = readl(pcie->parf + PCIE20_PARF_PHY_REFCLK);
+- val &= ~PHY_REFCLK_USE_PAD;
++ /* USE_PAD is required only for ipq806x */
++ if (!of_device_is_compatible(node, "qcom,pcie-apq8064"))
++ val &= ~PHY_REFCLK_USE_PAD;
+ val |= PHY_REFCLK_SSP_EN;
+ writel(val, pcie->parf + PCIE20_PARF_PHY_REFCLK);
+
+diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
+index d96626c614f56..a7bdd10fccf33 100644
+--- a/drivers/pci/syscall.c
++++ b/drivers/pci/syscall.c
+@@ -19,7 +19,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
+ u16 word;
+ u32 dword;
+ long err;
+- long cfg_ret;
++ int cfg_ret;
+
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+@@ -45,7 +45,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
+ }
+
+ err = -EIO;
+- if (cfg_ret != PCIBIOS_SUCCESSFUL)
++ if (cfg_ret)
+ goto error;
+
+ switch (len) {
+@@ -103,7 +103,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
+ if (err)
+ break;
+ err = pci_user_write_config_byte(dev, off, byte);
+- if (err != PCIBIOS_SUCCESSFUL)
++ if (err)
+ err = -EIO;
+ break;
+
+@@ -112,7 +112,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
+ if (err)
+ break;
+ err = pci_user_write_config_word(dev, off, word);
+- if (err != PCIBIOS_SUCCESSFUL)
++ if (err)
+ err = -EIO;
+ break;
+
+@@ -121,7 +121,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
+ if (err)
+ break;
+ err = pci_user_write_config_dword(dev, off, dword);
+- if (err != PCIBIOS_SUCCESSFUL)
++ if (err)
+ err = -EIO;
+ break;
+
+diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c
+index d9493e893d64e..7cf59e764ef28 100644
+--- a/drivers/power/reset/at91-sama5d2_shdwc.c
++++ b/drivers/power/reset/at91-sama5d2_shdwc.c
+@@ -36,7 +36,7 @@
+
+ #define AT91_SHDW_MR 0x04 /* Shut Down Mode Register */
+ #define AT91_SHDW_WKUPDBC_SHIFT 24
+-#define AT91_SHDW_WKUPDBC_MASK GENMASK(31, 16)
++#define AT91_SHDW_WKUPDBC_MASK GENMASK(26, 24)
+ #define AT91_SHDW_WKUPDBC(x) (((x) << AT91_SHDW_WKUPDBC_SHIFT) \
+ & AT91_SHDW_WKUPDBC_MASK)
+
+diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
+index 4d99d468df09a..48bcc853d57a7 100644
+--- a/drivers/pwm/pwm-rockchip.c
++++ b/drivers/pwm/pwm-rockchip.c
+@@ -370,7 +370,6 @@ static int rockchip_pwm_probe(struct platform_device *pdev)
+
+ ret = pwmchip_add(&pc->chip);
+ if (ret < 0) {
+- clk_unprepare(pc->clk);
+ dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret);
+ goto err_pclk;
+ }
+diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
+index 91b8ff8bac157..c9e3677ac734b 100644
+--- a/drivers/regulator/axp20x-regulator.c
++++ b/drivers/regulator/axp20x-regulator.c
+@@ -558,7 +558,7 @@ static int axp20x_set_dcdc_freq(struct platform_device *pdev, u32 dcdcfreq)
+ static int axp20x_regulator_parse_dt(struct platform_device *pdev)
+ {
+ struct device_node *np, *regulators;
+- int ret;
++ int ret = 0;
+ u32 dcdcfreq = 0;
+
+ np = of_node_get(pdev->dev.parent->of_node);
+@@ -573,13 +573,12 @@ static int axp20x_regulator_parse_dt(struct platform_device *pdev)
+ ret = axp20x_set_dcdc_freq(pdev, dcdcfreq);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Error setting dcdc frequency: %d\n", ret);
+- return ret;
+ }
+-
+ of_node_put(regulators);
+ }
+
+- return 0;
++ of_node_put(np);
++ return ret;
+ }
+
+ static int axp20x_set_dcdc_workmode(struct regulator_dev *rdev, int id, u32 workmode)
+diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
+index 667d16dc83ce1..7ff94695eee72 100644
+--- a/drivers/regulator/s5m8767.c
++++ b/drivers/regulator/s5m8767.c
+@@ -548,14 +548,18 @@ static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
+ rdata = devm_kcalloc(&pdev->dev,
+ pdata->num_regulators, sizeof(*rdata),
+ GFP_KERNEL);
+- if (!rdata)
++ if (!rdata) {
++ of_node_put(regulators_np);
+ return -ENOMEM;
++ }
+
+ rmode = devm_kcalloc(&pdev->dev,
+ pdata->num_regulators, sizeof(*rmode),
+ GFP_KERNEL);
+- if (!rmode)
++ if (!rmode) {
++ of_node_put(regulators_np);
+ return -ENOMEM;
++ }
+
+ pdata->regulators = rdata;
+ pdata->opmode = rmode;
+diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
+index 28a4505a1bc82..b5845f16a3a26 100644
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -639,6 +639,7 @@ config RTC_DRV_S5M
+ tristate "Samsung S2M/S5M series"
+ depends on MFD_SEC_CORE || COMPILE_TEST
+ select REGMAP_IRQ
++ select REGMAP_I2C
+ help
+ If you say yes here you will get support for the
+ RTC of Samsung S2MPS14 and S5M PMIC series.
+diff --git a/drivers/scsi/bnx2fc/Kconfig b/drivers/scsi/bnx2fc/Kconfig
+index d401a096dfc7e..2eb2476852b11 100644
+--- a/drivers/scsi/bnx2fc/Kconfig
++++ b/drivers/scsi/bnx2fc/Kconfig
+@@ -4,6 +4,7 @@ config SCSI_BNX2X_FCOE
+ depends on (IPV6 || IPV6=n)
+ depends on LIBFC
+ depends on LIBFCOE
++ depends on MMU
+ select NETDEVICES
+ select ETHERNET
+ select NET_VENDOR_BROADCOM
+diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
+index 5a9d7e252a77c..2254e36c7f468 100644
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -1605,7 +1605,7 @@ static int atmel_spi_probe(struct platform_device *pdev)
+ if (ret == 0) {
+ as->use_dma = true;
+ } else if (ret == -EPROBE_DEFER) {
+- return ret;
++ goto out_unmap_regs;
+ }
+ } else if (as->caps.has_pdc_support) {
+ as->use_pdc = true;
+diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
+index 869f188b02eb3..1736a48bbccec 100644
+--- a/drivers/spi/spi-pxa2xx-pci.c
++++ b/drivers/spi/spi-pxa2xx-pci.c
+@@ -21,7 +21,8 @@ enum {
+ PORT_BSW1,
+ PORT_BSW2,
+ PORT_CE4100,
+- PORT_LPT,
++ PORT_LPT0,
++ PORT_LPT1,
+ };
+
+ struct pxa_spi_info {
+@@ -55,8 +56,10 @@ static struct dw_dma_slave bsw1_rx_param = { .src_id = 7 };
+ static struct dw_dma_slave bsw2_tx_param = { .dst_id = 8 };
+ static struct dw_dma_slave bsw2_rx_param = { .src_id = 9 };
+
+-static struct dw_dma_slave lpt_tx_param = { .dst_id = 0 };
+-static struct dw_dma_slave lpt_rx_param = { .src_id = 1 };
++static struct dw_dma_slave lpt1_tx_param = { .dst_id = 0 };
++static struct dw_dma_slave lpt1_rx_param = { .src_id = 1 };
++static struct dw_dma_slave lpt0_tx_param = { .dst_id = 2 };
++static struct dw_dma_slave lpt0_rx_param = { .src_id = 3 };
+
+ static bool lpss_dma_filter(struct dma_chan *chan, void *param)
+ {
+@@ -182,12 +185,19 @@ static struct pxa_spi_info spi_info_configs[] = {
+ .num_chipselect = 1,
+ .max_clk_rate = 50000000,
+ },
+- [PORT_LPT] = {
++ [PORT_LPT0] = {
+ .type = LPSS_LPT_SSP,
+ .port_id = 0,
+ .setup = lpss_spi_setup,
+- .tx_param = &lpt_tx_param,
+- .rx_param = &lpt_rx_param,
++ .tx_param = &lpt0_tx_param,
++ .rx_param = &lpt0_rx_param,
++ },
++ [PORT_LPT1] = {
++ .type = LPSS_LPT_SSP,
++ .port_id = 1,
++ .setup = lpss_spi_setup,
++ .tx_param = &lpt1_tx_param,
++ .rx_param = &lpt1_rx_param,
+ },
+ };
+
+@@ -281,8 +291,9 @@ static const struct pci_device_id pxa2xx_spi_pci_devices[] = {
+ { PCI_VDEVICE(INTEL, 0x2290), PORT_BSW1 },
+ { PCI_VDEVICE(INTEL, 0x22ac), PORT_BSW2 },
+ { PCI_VDEVICE(INTEL, 0x2e6a), PORT_CE4100 },
+- { PCI_VDEVICE(INTEL, 0x9ce6), PORT_LPT },
+- { },
++ { PCI_VDEVICE(INTEL, 0x9ce5), PORT_LPT0 },
++ { PCI_VDEVICE(INTEL, 0x9ce6), PORT_LPT1 },
++ { }
+ };
+ MODULE_DEVICE_TABLE(pci, pxa2xx_spi_pci_devices);
+
+diff --git a/drivers/spi/spi-s3c24xx-fiq.S b/drivers/spi/spi-s3c24xx-fiq.S
+index 059f2dc1fda2d..1565c792da079 100644
+--- a/drivers/spi/spi-s3c24xx-fiq.S
++++ b/drivers/spi/spi-s3c24xx-fiq.S
+@@ -36,7 +36,6 @@
+ @ and an offset to the irq acknowledgment word
+
+ ENTRY(s3c24xx_spi_fiq_rx)
+-s3c24xx_spi_fix_rx:
+ .word fiq_rx_end - fiq_rx_start
+ .word fiq_rx_irq_ack - fiq_rx_start
+ fiq_rx_start:
+@@ -50,7 +49,7 @@ fiq_rx_start:
+ strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+
+ subs fiq_rcount, fiq_rcount, #1
+- subnes pc, lr, #4 @@ return, still have work to do
++ subsne pc, lr, #4 @@ return, still have work to do
+
+ @@ set IRQ controller so that next op will trigger IRQ
+ mov fiq_rtmp, #0
+@@ -62,7 +61,6 @@ fiq_rx_irq_ack:
+ fiq_rx_end:
+
+ ENTRY(s3c24xx_spi_fiq_txrx)
+-s3c24xx_spi_fiq_txrx:
+ .word fiq_txrx_end - fiq_txrx_start
+ .word fiq_txrx_irq_ack - fiq_txrx_start
+ fiq_txrx_start:
+@@ -77,7 +75,7 @@ fiq_txrx_start:
+ strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+
+ subs fiq_rcount, fiq_rcount, #1
+- subnes pc, lr, #4 @@ return, still have work to do
++ subsne pc, lr, #4 @@ return, still have work to do
+
+ mov fiq_rtmp, #0
+ str fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD - S3C24XX_VA_IRQ ]
+@@ -89,7 +87,6 @@ fiq_txrx_irq_ack:
+ fiq_txrx_end:
+
+ ENTRY(s3c24xx_spi_fiq_tx)
+-s3c24xx_spi_fix_tx:
+ .word fiq_tx_end - fiq_tx_start
+ .word fiq_tx_irq_ack - fiq_tx_start
+ fiq_tx_start:
+@@ -102,7 +99,7 @@ fiq_tx_start:
+ strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+
+ subs fiq_rcount, fiq_rcount, #1
+- subnes pc, lr, #4 @@ return, still have work to do
++ subsne pc, lr, #4 @@ return, still have work to do
+
+ mov fiq_rtmp, #0
+ str fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD - S3C24XX_VA_IRQ ]
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 8eb2644506dd3..8d692f16d90ac 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -992,6 +992,10 @@ static int stm32_spi_transfer_one(struct spi_master *master,
+ struct stm32_spi *spi = spi_master_get_devdata(master);
+ int ret;
+
++ /* Don't do anything on 0 bytes transfers */
++ if (transfer->len == 0)
++ return 0;
++
+ spi->tx_buf = transfer->tx_buf;
+ spi->rx_buf = transfer->rx_buf;
+ spi->tx_len = spi->tx_buf ? transfer->len : 0;
+diff --git a/drivers/staging/gdm724x/gdm_usb.c b/drivers/staging/gdm724x/gdm_usb.c
+index dc4da66c3695b..54bdb64f52e88 100644
+--- a/drivers/staging/gdm724x/gdm_usb.c
++++ b/drivers/staging/gdm724x/gdm_usb.c
+@@ -56,20 +56,24 @@ static int gdm_usb_recv(void *priv_dev,
+
+ static int request_mac_address(struct lte_udev *udev)
+ {
+- u8 buf[16] = {0,};
+- struct hci_packet *hci = (struct hci_packet *)buf;
++ struct hci_packet *hci;
+ struct usb_device *usbdev = udev->usbdev;
+ int actual;
+ int ret = -1;
+
++ hci = kmalloc(struct_size(hci, data, 1), GFP_KERNEL);
++ if (!hci)
++ return -ENOMEM;
++
+ hci->cmd_evt = gdm_cpu_to_dev16(udev->gdm_ed, LTE_GET_INFORMATION);
+ hci->len = gdm_cpu_to_dev16(udev->gdm_ed, 1);
+ hci->data[0] = MAC_ADDRESS;
+
+- ret = usb_bulk_msg(usbdev, usb_sndbulkpipe(usbdev, 2), buf, 5,
++ ret = usb_bulk_msg(usbdev, usb_sndbulkpipe(usbdev, 2), hci, 5,
+ &actual, 1000);
+
+ udev->request_mac_addr = 1;
++ kfree(hci);
+
+ return ret;
+ }
+diff --git a/drivers/staging/mt7621-dma/Makefile b/drivers/staging/mt7621-dma/Makefile
+index d3152d45cf450..e3ab560ed35ac 100644
+--- a/drivers/staging/mt7621-dma/Makefile
++++ b/drivers/staging/mt7621-dma/Makefile
+@@ -1,4 +1,4 @@
+ obj-$(CONFIG_DMA_RALINK) += ralink-gdma.o
+-obj-$(CONFIG_MTK_HSDMA) += mtk-hsdma.o
++obj-$(CONFIG_MTK_HSDMA) += hsdma-mt7621.o
+
+ ccflags-y += -I$(srctree)/drivers/dma
+diff --git a/drivers/staging/mt7621-dma/hsdma-mt7621.c b/drivers/staging/mt7621-dma/hsdma-mt7621.c
+new file mode 100644
+index 0000000000000..f487cbc91dee6
+--- /dev/null
++++ b/drivers/staging/mt7621-dma/hsdma-mt7621.c
+@@ -0,0 +1,771 @@
++/*
++ * Copyright (C) 2015, Michael Lee <igvtee@gmail.com>
++ * MTK HSDMA support
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ *
++ */
++
++#include <linux/dmaengine.h>
++#include <linux/dma-mapping.h>
++#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/spinlock.h>
++#include <linux/irq.h>
++#include <linux/of_dma.h>
++#include <linux/reset.h>
++#include <linux/of_device.h>
++
++#include "virt-dma.h"
++
++#define HSDMA_BASE_OFFSET 0x800
++
++#define HSDMA_REG_TX_BASE 0x00
++#define HSDMA_REG_TX_CNT 0x04
++#define HSDMA_REG_TX_CTX 0x08
++#define HSDMA_REG_TX_DTX 0x0c
++#define HSDMA_REG_RX_BASE 0x100
++#define HSDMA_REG_RX_CNT 0x104
++#define HSDMA_REG_RX_CRX 0x108
++#define HSDMA_REG_RX_DRX 0x10c
++#define HSDMA_REG_INFO 0x200
++#define HSDMA_REG_GLO_CFG 0x204
++#define HSDMA_REG_RST_CFG 0x208
++#define HSDMA_REG_DELAY_INT 0x20c
++#define HSDMA_REG_FREEQ_THRES 0x210
++#define HSDMA_REG_INT_STATUS 0x220
++#define HSDMA_REG_INT_MASK 0x228
++#define HSDMA_REG_SCH_Q01 0x280
++#define HSDMA_REG_SCH_Q23 0x284
++
++#define HSDMA_DESCS_MAX 0xfff
++#define HSDMA_DESCS_NUM 8
++#define HSDMA_DESCS_MASK (HSDMA_DESCS_NUM - 1)
++#define HSDMA_NEXT_DESC(x) (((x) + 1) & HSDMA_DESCS_MASK)
++
++/* HSDMA_REG_INFO */
++#define HSDMA_INFO_INDEX_MASK 0xf
++#define HSDMA_INFO_INDEX_SHIFT 24
++#define HSDMA_INFO_BASE_MASK 0xff
++#define HSDMA_INFO_BASE_SHIFT 16
++#define HSDMA_INFO_RX_MASK 0xff
++#define HSDMA_INFO_RX_SHIFT 8
++#define HSDMA_INFO_TX_MASK 0xff
++#define HSDMA_INFO_TX_SHIFT 0
++
++/* HSDMA_REG_GLO_CFG */
++#define HSDMA_GLO_TX_2B_OFFSET BIT(31)
++#define HSDMA_GLO_CLK_GATE BIT(30)
++#define HSDMA_GLO_BYTE_SWAP BIT(29)
++#define HSDMA_GLO_MULTI_DMA BIT(10)
++#define HSDMA_GLO_TWO_BUF BIT(9)
++#define HSDMA_GLO_32B_DESC BIT(8)
++#define HSDMA_GLO_BIG_ENDIAN BIT(7)
++#define HSDMA_GLO_TX_DONE BIT(6)
++#define HSDMA_GLO_BT_MASK 0x3
++#define HSDMA_GLO_BT_SHIFT 4
++#define HSDMA_GLO_RX_BUSY BIT(3)
++#define HSDMA_GLO_RX_DMA BIT(2)
++#define HSDMA_GLO_TX_BUSY BIT(1)
++#define HSDMA_GLO_TX_DMA BIT(0)
++
++#define HSDMA_BT_SIZE_16BYTES (0 << HSDMA_GLO_BT_SHIFT)
++#define HSDMA_BT_SIZE_32BYTES (1 << HSDMA_GLO_BT_SHIFT)
++#define HSDMA_BT_SIZE_64BYTES (2 << HSDMA_GLO_BT_SHIFT)
++#define HSDMA_BT_SIZE_128BYTES (3 << HSDMA_GLO_BT_SHIFT)
++
++#define HSDMA_GLO_DEFAULT (HSDMA_GLO_MULTI_DMA | \
++ HSDMA_GLO_RX_DMA | HSDMA_GLO_TX_DMA | HSDMA_BT_SIZE_32BYTES)
++
++/* HSDMA_REG_RST_CFG */
++#define HSDMA_RST_RX_SHIFT 16
++#define HSDMA_RST_TX_SHIFT 0
++
++/* HSDMA_REG_DELAY_INT */
++#define HSDMA_DELAY_INT_EN BIT(15)
++#define HSDMA_DELAY_PEND_OFFSET 8
++#define HSDMA_DELAY_TIME_OFFSET 0
++#define HSDMA_DELAY_TX_OFFSET 16
++#define HSDMA_DELAY_RX_OFFSET 0
++
++#define HSDMA_DELAY_INIT(x) (HSDMA_DELAY_INT_EN | \
++ ((x) << HSDMA_DELAY_PEND_OFFSET))
++#define HSDMA_DELAY(x) ((HSDMA_DELAY_INIT(x) << \
++ HSDMA_DELAY_TX_OFFSET) | HSDMA_DELAY_INIT(x))
++
++/* HSDMA_REG_INT_STATUS */
++#define HSDMA_INT_DELAY_RX_COH BIT(31)
++#define HSDMA_INT_DELAY_RX_INT BIT(30)
++#define HSDMA_INT_DELAY_TX_COH BIT(29)
++#define HSDMA_INT_DELAY_TX_INT BIT(28)
++#define HSDMA_INT_RX_MASK 0x3
++#define HSDMA_INT_RX_SHIFT 16
++#define HSDMA_INT_RX_Q0 BIT(16)
++#define HSDMA_INT_TX_MASK 0xf
++#define HSDMA_INT_TX_SHIFT 0
++#define HSDMA_INT_TX_Q0 BIT(0)
++
++/* tx/rx dma desc flags */
++#define HSDMA_PLEN_MASK 0x3fff
++#define HSDMA_DESC_DONE BIT(31)
++#define HSDMA_DESC_LS0 BIT(30)
++#define HSDMA_DESC_PLEN0(_x) (((_x) & HSDMA_PLEN_MASK) << 16)
++#define HSDMA_DESC_TAG BIT(15)
++#define HSDMA_DESC_LS1 BIT(14)
++#define HSDMA_DESC_PLEN1(_x) ((_x) & HSDMA_PLEN_MASK)
++
++/* align 4 bytes */
++#define HSDMA_ALIGN_SIZE 3
++/* align size 128bytes */
++#define HSDMA_MAX_PLEN 0x3f80
++
++struct hsdma_desc {
++ u32 addr0;
++ u32 flags;
++ u32 addr1;
++ u32 unused;
++};
++
++struct mtk_hsdma_sg {
++ dma_addr_t src_addr;
++ dma_addr_t dst_addr;
++ u32 len;
++};
++
++struct mtk_hsdma_desc {
++ struct virt_dma_desc vdesc;
++ unsigned int num_sgs;
++ struct mtk_hsdma_sg sg[1];
++};
++
++struct mtk_hsdma_chan {
++ struct virt_dma_chan vchan;
++ unsigned int id;
++ dma_addr_t desc_addr;
++ int tx_idx;
++ int rx_idx;
++ struct hsdma_desc *tx_ring;
++ struct hsdma_desc *rx_ring;
++ struct mtk_hsdma_desc *desc;
++ unsigned int next_sg;
++};
++
++struct mtk_hsdam_engine {
++ struct dma_device ddev;
++ struct device_dma_parameters dma_parms;
++ void __iomem *base;
++ struct tasklet_struct task;
++ volatile unsigned long chan_issued;
++
++ struct mtk_hsdma_chan chan[1];
++};
++
++static inline struct mtk_hsdam_engine *mtk_hsdma_chan_get_dev(
++ struct mtk_hsdma_chan *chan)
++{
++ return container_of(chan->vchan.chan.device, struct mtk_hsdam_engine,
++ ddev);
++}
++
++static inline struct mtk_hsdma_chan *to_mtk_hsdma_chan(struct dma_chan *c)
++{
++ return container_of(c, struct mtk_hsdma_chan, vchan.chan);
++}
++
++static inline struct mtk_hsdma_desc *to_mtk_hsdma_desc(
++ struct virt_dma_desc *vdesc)
++{
++ return container_of(vdesc, struct mtk_hsdma_desc, vdesc);
++}
++
++static inline u32 mtk_hsdma_read(struct mtk_hsdam_engine *hsdma, u32 reg)
++{
++ return readl(hsdma->base + reg);
++}
++
++static inline void mtk_hsdma_write(struct mtk_hsdam_engine *hsdma,
++ unsigned reg, u32 val)
++{
++ writel(val, hsdma->base + reg);
++}
++
++static void mtk_hsdma_reset_chan(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ chan->tx_idx = 0;
++ chan->rx_idx = HSDMA_DESCS_NUM - 1;
++
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx);
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx);
++
++ mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG,
++ 0x1 << (chan->id + HSDMA_RST_TX_SHIFT));
++ mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG,
++ 0x1 << (chan->id + HSDMA_RST_RX_SHIFT));
++}
++
++static void hsdma_dump_reg(struct mtk_hsdam_engine *hsdma)
++{
++ dev_dbg(hsdma->ddev.dev, "tbase %08x, tcnt %08x, " \
++ "tctx %08x, tdtx: %08x, rbase %08x, " \
++ "rcnt %08x, rctx %08x, rdtx %08x\n",
++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_BASE),
++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_CNT),
++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_CTX),
++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_DTX),
++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_BASE),
++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_CNT),
++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_CRX),
++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX));
++
++ dev_dbg(hsdma->ddev.dev, "info %08x, glo %08x, delay %08x, " \
++ "intr_stat %08x, intr_mask %08x\n",
++ mtk_hsdma_read(hsdma, HSDMA_REG_INFO),
++ mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG),
++ mtk_hsdma_read(hsdma, HSDMA_REG_DELAY_INT),
++ mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS),
++ mtk_hsdma_read(hsdma, HSDMA_REG_INT_MASK));
++}
++
++static void hsdma_dump_desc(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ struct hsdma_desc *tx_desc;
++ struct hsdma_desc *rx_desc;
++ int i;
++
++ dev_dbg(hsdma->ddev.dev, "tx idx: %d, rx idx: %d\n",
++ chan->tx_idx, chan->rx_idx);
++
++ for (i = 0; i < HSDMA_DESCS_NUM; i++) {
++ tx_desc = &chan->tx_ring[i];
++ rx_desc = &chan->rx_ring[i];
++
++ dev_dbg(hsdma->ddev.dev, "%d tx addr0: %08x, flags %08x, " \
++ "tx addr1: %08x, rx addr0 %08x, flags %08x\n",
++ i, tx_desc->addr0, tx_desc->flags, \
++ tx_desc->addr1, rx_desc->addr0, rx_desc->flags);
++ }
++}
++
++static void mtk_hsdma_reset(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ int i;
++
++ /* disable dma */
++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0);
++
++ /* disable intr */
++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0);
++
++ /* init desc value */
++ for (i = 0; i < HSDMA_DESCS_NUM; i++) {
++ chan->tx_ring[i].addr0 = 0;
++ chan->tx_ring[i].flags = HSDMA_DESC_LS0 |
++ HSDMA_DESC_DONE;
++ }
++ for (i = 0; i < HSDMA_DESCS_NUM; i++) {
++ chan->rx_ring[i].addr0 = 0;
++ chan->rx_ring[i].flags = 0;
++ }
++
++ /* reset */
++ mtk_hsdma_reset_chan(hsdma, chan);
++
++ /* enable intr */
++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0);
++
++ /* enable dma */
++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT);
++}
++
++static int mtk_hsdma_terminate_all(struct dma_chan *c)
++{
++ struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
++ struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan);
++ unsigned long timeout;
++ LIST_HEAD(head);
++
++ spin_lock_bh(&chan->vchan.lock);
++ chan->desc = NULL;
++ clear_bit(chan->id, &hsdma->chan_issued);
++ vchan_get_all_descriptors(&chan->vchan, &head);
++ spin_unlock_bh(&chan->vchan.lock);
++
++ vchan_dma_desc_free_list(&chan->vchan, &head);
++
++ /* wait dma transfer complete */
++ timeout = jiffies + msecs_to_jiffies(2000);
++ while (mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG) &
++ (HSDMA_GLO_RX_BUSY | HSDMA_GLO_TX_BUSY)) {
++ if (time_after_eq(jiffies, timeout)) {
++ hsdma_dump_desc(hsdma, chan);
++ mtk_hsdma_reset(hsdma, chan);
++ dev_err(hsdma->ddev.dev, "timeout, reset it\n");
++ break;
++ }
++ cpu_relax();
++ }
++
++ return 0;
++}
++
++static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ dma_addr_t src, dst;
++ size_t len, tlen;
++ struct hsdma_desc *tx_desc, *rx_desc;
++ struct mtk_hsdma_sg *sg;
++ unsigned int i;
++ int rx_idx;
++
++ sg = &chan->desc->sg[0];
++ len = sg->len;
++ chan->desc->num_sgs = DIV_ROUND_UP(len, HSDMA_MAX_PLEN);
++
++ /* tx desc */
++ src = sg->src_addr;
++ for (i = 0; i < chan->desc->num_sgs; i++) {
++ tx_desc = &chan->tx_ring[chan->tx_idx];
++
++ if (len > HSDMA_MAX_PLEN)
++ tlen = HSDMA_MAX_PLEN;
++ else
++ tlen = len;
++
++ if (i & 0x1) {
++ tx_desc->addr1 = src;
++ tx_desc->flags |= HSDMA_DESC_PLEN1(tlen);
++ } else {
++ tx_desc->addr0 = src;
++ tx_desc->flags = HSDMA_DESC_PLEN0(tlen);
++
++ /* update index */
++ chan->tx_idx = HSDMA_NEXT_DESC(chan->tx_idx);
++ }
++
++ src += tlen;
++ len -= tlen;
++ }
++ if (i & 0x1)
++ tx_desc->flags |= HSDMA_DESC_LS0;
++ else
++ tx_desc->flags |= HSDMA_DESC_LS1;
++
++ /* rx desc */
++ rx_idx = HSDMA_NEXT_DESC(chan->rx_idx);
++ len = sg->len;
++ dst = sg->dst_addr;
++ for (i = 0; i < chan->desc->num_sgs; i++) {
++ rx_desc = &chan->rx_ring[rx_idx];
++ if (len > HSDMA_MAX_PLEN)
++ tlen = HSDMA_MAX_PLEN;
++ else
++ tlen = len;
++
++ rx_desc->addr0 = dst;
++ rx_desc->flags = HSDMA_DESC_PLEN0(tlen);
++
++ dst += tlen;
++ len -= tlen;
++
++ /* update index */
++ rx_idx = HSDMA_NEXT_DESC(rx_idx);
++ }
++
++ /* make sure desc and index all up to date */
++ wmb();
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx);
++
++ return 0;
++}
++
++static int gdma_next_desc(struct mtk_hsdma_chan *chan)
++{
++ struct virt_dma_desc *vdesc;
++
++ vdesc = vchan_next_desc(&chan->vchan);
++ if (!vdesc) {
++ chan->desc = NULL;
++ return 0;
++ }
++ chan->desc = to_mtk_hsdma_desc(vdesc);
++ chan->next_sg = 0;
++
++ return 1;
++}
++
++static void mtk_hsdma_chan_done(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ struct mtk_hsdma_desc *desc;
++ int chan_issued;
++
++ chan_issued = 0;
++ spin_lock_bh(&chan->vchan.lock);
++ desc = chan->desc;
++ if (likely(desc)) {
++ if (chan->next_sg == desc->num_sgs) {
++ list_del(&desc->vdesc.node);
++ vchan_cookie_complete(&desc->vdesc);
++ chan_issued = gdma_next_desc(chan);
++ }
++ } else
++ dev_dbg(hsdma->ddev.dev, "no desc to complete\n");
++
++ if (chan_issued)
++ set_bit(chan->id, &hsdma->chan_issued);
++ spin_unlock_bh(&chan->vchan.lock);
++}
++
++static irqreturn_t mtk_hsdma_irq(int irq, void *devid)
++{
++ struct mtk_hsdam_engine *hsdma = devid;
++ u32 status;
++
++ status = mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS);
++ if (unlikely(!status))
++ return IRQ_NONE;
++
++ if (likely(status & HSDMA_INT_RX_Q0))
++ tasklet_schedule(&hsdma->task);
++ else
++ dev_dbg(hsdma->ddev.dev, "unhandle irq status %08x\n",
++ status);
++ /* clean intr bits */
++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_STATUS, status);
++
++ return IRQ_HANDLED;
++}
++
++static void mtk_hsdma_issue_pending(struct dma_chan *c)
++{
++ struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
++ struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan);
++
++ spin_lock_bh(&chan->vchan.lock);
++ if (vchan_issue_pending(&chan->vchan) && !chan->desc) {
++ if (gdma_next_desc(chan)) {
++ set_bit(chan->id, &hsdma->chan_issued);
++ tasklet_schedule(&hsdma->task);
++ } else
++ dev_dbg(hsdma->ddev.dev, "no desc to issue\n");
++ }
++ spin_unlock_bh(&chan->vchan.lock);
++}
++
++static struct dma_async_tx_descriptor *mtk_hsdma_prep_dma_memcpy(
++ struct dma_chan *c, dma_addr_t dest, dma_addr_t src,
++ size_t len, unsigned long flags)
++{
++ struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
++ struct mtk_hsdma_desc *desc;
++
++ if (len <= 0)
++ return NULL;
++
++ desc = kzalloc(sizeof(struct mtk_hsdma_desc), GFP_ATOMIC);
++ if (!desc) {
++ dev_err(c->device->dev, "alloc memcpy decs error\n");
++ return NULL;
++ }
++
++ desc->sg[0].src_addr = src;
++ desc->sg[0].dst_addr = dest;
++ desc->sg[0].len = len;
++
++ return vchan_tx_prep(&chan->vchan, &desc->vdesc, flags);
++}
++
++static enum dma_status mtk_hsdma_tx_status(struct dma_chan *c,
++ dma_cookie_t cookie,
++ struct dma_tx_state *state)
++{
++ return dma_cookie_status(c, cookie, state);
++}
++
++static void mtk_hsdma_free_chan_resources(struct dma_chan *c)
++{
++ vchan_free_chan_resources(to_virt_chan(c));
++}
++
++static void mtk_hsdma_desc_free(struct virt_dma_desc *vdesc)
++{
++ kfree(container_of(vdesc, struct mtk_hsdma_desc, vdesc));
++}
++
++static void mtk_hsdma_tx(struct mtk_hsdam_engine *hsdma)
++{
++ struct mtk_hsdma_chan *chan;
++
++ if (test_and_clear_bit(0, &hsdma->chan_issued)) {
++ chan = &hsdma->chan[0];
++ if (chan->desc)
++ mtk_hsdma_start_transfer(hsdma, chan);
++ else
++ dev_dbg(hsdma->ddev.dev, "chan 0 no desc to issue\n");
++ }
++}
++
++static void mtk_hsdma_rx(struct mtk_hsdam_engine *hsdma)
++{
++ struct mtk_hsdma_chan *chan;
++ int next_idx, drx_idx, cnt;
++
++ chan = &hsdma->chan[0];
++ next_idx = HSDMA_NEXT_DESC(chan->rx_idx);
++ drx_idx = mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX);
++
++ cnt = (drx_idx - next_idx) & HSDMA_DESCS_MASK;
++ if (!cnt)
++ return;
++
++ chan->next_sg += cnt;
++ chan->rx_idx = (chan->rx_idx + cnt) & HSDMA_DESCS_MASK;
++
++ /* update rx crx */
++ wmb();
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx);
++
++ mtk_hsdma_chan_done(hsdma, chan);
++}
++
++static void mtk_hsdma_tasklet(unsigned long arg)
++{
++ struct mtk_hsdam_engine *hsdma = (struct mtk_hsdam_engine *)arg;
++
++ mtk_hsdma_rx(hsdma);
++ mtk_hsdma_tx(hsdma);
++}
++
++static int mtk_hsdam_alloc_desc(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ int i;
++
++ chan->tx_ring = dma_alloc_coherent(hsdma->ddev.dev,
++ 2 * HSDMA_DESCS_NUM * sizeof(*chan->tx_ring),
++ &chan->desc_addr, GFP_ATOMIC | __GFP_ZERO);
++ if (!chan->tx_ring)
++ goto no_mem;
++
++ chan->rx_ring = &chan->tx_ring[HSDMA_DESCS_NUM];
++
++ /* init tx ring value */
++ for (i = 0; i < HSDMA_DESCS_NUM; i++)
++ chan->tx_ring[i].flags = HSDMA_DESC_LS0 | HSDMA_DESC_DONE;
++
++ return 0;
++no_mem:
++ return -ENOMEM;
++}
++
++static void mtk_hsdam_free_desc(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ if (chan->tx_ring) {
++ dma_free_coherent(hsdma->ddev.dev,
++ 2 * HSDMA_DESCS_NUM * sizeof(*chan->tx_ring),
++ chan->tx_ring, chan->desc_addr);
++ chan->tx_ring = NULL;
++ chan->rx_ring = NULL;
++ }
++}
++
++static int mtk_hsdma_init(struct mtk_hsdam_engine *hsdma)
++{
++ struct mtk_hsdma_chan *chan;
++ int ret;
++ u32 reg;
++
++ /* init desc */
++ chan = &hsdma->chan[0];
++ ret = mtk_hsdam_alloc_desc(hsdma, chan);
++ if (ret)
++ return ret;
++
++ /* tx */
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, chan->desc_addr);
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, HSDMA_DESCS_NUM);
++ /* rx */
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, chan->desc_addr +
++ (sizeof(struct hsdma_desc) * HSDMA_DESCS_NUM));
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, HSDMA_DESCS_NUM);
++ /* reset */
++ mtk_hsdma_reset_chan(hsdma, chan);
++
++ /* enable rx intr */
++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0);
++
++ /* enable dma */
++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT);
++
++ /* hardware info */
++ reg = mtk_hsdma_read(hsdma, HSDMA_REG_INFO);
++ dev_info(hsdma->ddev.dev, "rx: %d, tx: %d\n",
++ (reg >> HSDMA_INFO_RX_SHIFT) & HSDMA_INFO_RX_MASK,
++ (reg >> HSDMA_INFO_TX_SHIFT) & HSDMA_INFO_TX_MASK);
++
++ hsdma_dump_reg(hsdma);
++
++ return ret;
++}
++
++static void mtk_hsdma_uninit(struct mtk_hsdam_engine *hsdma)
++{
++ struct mtk_hsdma_chan *chan;
++
++ /* disable dma */
++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0);
++
++ /* disable intr */
++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0);
++
++ /* free desc */
++ chan = &hsdma->chan[0];
++ mtk_hsdam_free_desc(hsdma, chan);
++
++ /* tx */
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, 0);
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, 0);
++ /* rx */
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, 0);
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, 0);
++ /* reset */
++ mtk_hsdma_reset_chan(hsdma, chan);
++}
++
++static const struct of_device_id mtk_hsdma_of_match[] = {
++ { .compatible = "mediatek,mt7621-hsdma" },
++ { },
++};
++
++static int mtk_hsdma_probe(struct platform_device *pdev)
++{
++ const struct of_device_id *match;
++ struct mtk_hsdma_chan *chan;
++ struct mtk_hsdam_engine *hsdma;
++ struct dma_device *dd;
++ struct resource *res;
++ int ret;
++ int irq;
++ void __iomem *base;
++
++ ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
++ if (ret)
++ return ret;
++
++ match = of_match_device(mtk_hsdma_of_match, &pdev->dev);
++ if (!match)
++ return -EINVAL;
++
++ hsdma = devm_kzalloc(&pdev->dev, sizeof(*hsdma), GFP_KERNEL);
++ if (!hsdma) {
++ dev_err(&pdev->dev, "alloc dma device failed\n");
++ return -EINVAL;
++ }
++
++ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ base = devm_ioremap_resource(&pdev->dev, res);
++ if (IS_ERR(base))
++ return PTR_ERR(base);
++ hsdma->base = base + HSDMA_BASE_OFFSET;
++ tasklet_init(&hsdma->task, mtk_hsdma_tasklet, (unsigned long)hsdma);
++
++ irq = platform_get_irq(pdev, 0);
++ if (irq < 0) {
++ dev_err(&pdev->dev, "failed to get irq\n");
++ return -EINVAL;
++ }
++ ret = devm_request_irq(&pdev->dev, irq, mtk_hsdma_irq,
++ 0, dev_name(&pdev->dev), hsdma);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to request irq\n");
++ return ret;
++ }
++
++ device_reset(&pdev->dev);
++
++ dd = &hsdma->ddev;
++ dma_cap_set(DMA_MEMCPY, dd->cap_mask);
++ dd->copy_align = HSDMA_ALIGN_SIZE;
++ dd->device_free_chan_resources = mtk_hsdma_free_chan_resources;
++ dd->device_prep_dma_memcpy = mtk_hsdma_prep_dma_memcpy;
++ dd->device_terminate_all = mtk_hsdma_terminate_all;
++ dd->device_tx_status = mtk_hsdma_tx_status;
++ dd->device_issue_pending = mtk_hsdma_issue_pending;
++ dd->dev = &pdev->dev;
++ dd->dev->dma_parms = &hsdma->dma_parms;
++ dma_set_max_seg_size(dd->dev, HSDMA_MAX_PLEN);
++ INIT_LIST_HEAD(&dd->channels);
++
++ chan = &hsdma->chan[0];
++ chan->id = 0;
++ chan->vchan.desc_free = mtk_hsdma_desc_free;
++ vchan_init(&chan->vchan, dd);
++
++ /* init hardware */
++ ret = mtk_hsdma_init(hsdma);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to alloc ring descs\n");
++ return ret;
++ }
++
++ ret = dma_async_device_register(dd);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to register dma device\n");
++ goto err_uninit_hsdma;
++ }
++
++ ret = of_dma_controller_register(pdev->dev.of_node,
++ of_dma_xlate_by_chan_id, hsdma);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to register of dma controller\n");
++ goto err_unregister;
++ }
++
++ platform_set_drvdata(pdev, hsdma);
++
++ return 0;
++
++err_unregister:
++ dma_async_device_unregister(dd);
++err_uninit_hsdma:
++ mtk_hsdma_uninit(hsdma);
++ return ret;
++}
++
++static int mtk_hsdma_remove(struct platform_device *pdev)
++{
++ struct mtk_hsdam_engine *hsdma = platform_get_drvdata(pdev);
++
++ mtk_hsdma_uninit(hsdma);
++
++ of_dma_controller_free(pdev->dev.of_node);
++ dma_async_device_unregister(&hsdma->ddev);
++
++ return 0;
++}
++
++static struct platform_driver mtk_hsdma_driver = {
++ .probe = mtk_hsdma_probe,
++ .remove = mtk_hsdma_remove,
++ .driver = {
++ .name = KBUILD_MODNAME,
++ .of_match_table = mtk_hsdma_of_match,
++ },
++};
++module_platform_driver(mtk_hsdma_driver);
++
++MODULE_AUTHOR("Michael Lee <igvtee@gmail.com>");
++MODULE_DESCRIPTION("MTK HSDMA driver");
++MODULE_LICENSE("GPL v2");
+diff --git a/drivers/staging/mt7621-dma/mtk-hsdma.c b/drivers/staging/mt7621-dma/mtk-hsdma.c
+deleted file mode 100644
+index f60302b711813..0000000000000
+--- a/drivers/staging/mt7621-dma/mtk-hsdma.c
++++ /dev/null
+@@ -1,771 +0,0 @@
+-/*
+- * Copyright (C) 2015, Michael Lee <igvtee@gmail.com>
+- * MTK HSDMA support
+- *
+- * This program is free software; you can redistribute it and/or modify it
+- * under the terms of the GNU General Public License as published by the
+- * Free Software Foundation; either version 2 of the License, or (at your
+- * option) any later version.
+- *
+- */
+-
+-#include <linux/dmaengine.h>
+-#include <linux/dma-mapping.h>
+-#include <linux/err.h>
+-#include <linux/init.h>
+-#include <linux/list.h>
+-#include <linux/module.h>
+-#include <linux/platform_device.h>
+-#include <linux/slab.h>
+-#include <linux/spinlock.h>
+-#include <linux/irq.h>
+-#include <linux/of_dma.h>
+-#include <linux/reset.h>
+-#include <linux/of_device.h>
+-
+-#include "virt-dma.h"
+-
+-#define HSDMA_BASE_OFFSET 0x800
+-
+-#define HSDMA_REG_TX_BASE 0x00
+-#define HSDMA_REG_TX_CNT 0x04
+-#define HSDMA_REG_TX_CTX 0x08
+-#define HSDMA_REG_TX_DTX 0x0c
+-#define HSDMA_REG_RX_BASE 0x100
+-#define HSDMA_REG_RX_CNT 0x104
+-#define HSDMA_REG_RX_CRX 0x108
+-#define HSDMA_REG_RX_DRX 0x10c
+-#define HSDMA_REG_INFO 0x200
+-#define HSDMA_REG_GLO_CFG 0x204
+-#define HSDMA_REG_RST_CFG 0x208
+-#define HSDMA_REG_DELAY_INT 0x20c
+-#define HSDMA_REG_FREEQ_THRES 0x210
+-#define HSDMA_REG_INT_STATUS 0x220
+-#define HSDMA_REG_INT_MASK 0x228
+-#define HSDMA_REG_SCH_Q01 0x280
+-#define HSDMA_REG_SCH_Q23 0x284
+-
+-#define HSDMA_DESCS_MAX 0xfff
+-#define HSDMA_DESCS_NUM 8
+-#define HSDMA_DESCS_MASK (HSDMA_DESCS_NUM - 1)
+-#define HSDMA_NEXT_DESC(x) (((x) + 1) & HSDMA_DESCS_MASK)
+-
+-/* HSDMA_REG_INFO */
+-#define HSDMA_INFO_INDEX_MASK 0xf
+-#define HSDMA_INFO_INDEX_SHIFT 24
+-#define HSDMA_INFO_BASE_MASK 0xff
+-#define HSDMA_INFO_BASE_SHIFT 16
+-#define HSDMA_INFO_RX_MASK 0xff
+-#define HSDMA_INFO_RX_SHIFT 8
+-#define HSDMA_INFO_TX_MASK 0xff
+-#define HSDMA_INFO_TX_SHIFT 0
+-
+-/* HSDMA_REG_GLO_CFG */
+-#define HSDMA_GLO_TX_2B_OFFSET BIT(31)
+-#define HSDMA_GLO_CLK_GATE BIT(30)
+-#define HSDMA_GLO_BYTE_SWAP BIT(29)
+-#define HSDMA_GLO_MULTI_DMA BIT(10)
+-#define HSDMA_GLO_TWO_BUF BIT(9)
+-#define HSDMA_GLO_32B_DESC BIT(8)
+-#define HSDMA_GLO_BIG_ENDIAN BIT(7)
+-#define HSDMA_GLO_TX_DONE BIT(6)
+-#define HSDMA_GLO_BT_MASK 0x3
+-#define HSDMA_GLO_BT_SHIFT 4
+-#define HSDMA_GLO_RX_BUSY BIT(3)
+-#define HSDMA_GLO_RX_DMA BIT(2)
+-#define HSDMA_GLO_TX_BUSY BIT(1)
+-#define HSDMA_GLO_TX_DMA BIT(0)
+-
+-#define HSDMA_BT_SIZE_16BYTES (0 << HSDMA_GLO_BT_SHIFT)
+-#define HSDMA_BT_SIZE_32BYTES (1 << HSDMA_GLO_BT_SHIFT)
+-#define HSDMA_BT_SIZE_64BYTES (2 << HSDMA_GLO_BT_SHIFT)
+-#define HSDMA_BT_SIZE_128BYTES (3 << HSDMA_GLO_BT_SHIFT)
+-
+-#define HSDMA_GLO_DEFAULT (HSDMA_GLO_MULTI_DMA | \
+- HSDMA_GLO_RX_DMA | HSDMA_GLO_TX_DMA | HSDMA_BT_SIZE_32BYTES)
+-
+-/* HSDMA_REG_RST_CFG */
+-#define HSDMA_RST_RX_SHIFT 16
+-#define HSDMA_RST_TX_SHIFT 0
+-
+-/* HSDMA_REG_DELAY_INT */
+-#define HSDMA_DELAY_INT_EN BIT(15)
+-#define HSDMA_DELAY_PEND_OFFSET 8
+-#define HSDMA_DELAY_TIME_OFFSET 0
+-#define HSDMA_DELAY_TX_OFFSET 16
+-#define HSDMA_DELAY_RX_OFFSET 0
+-
+-#define HSDMA_DELAY_INIT(x) (HSDMA_DELAY_INT_EN | \
+- ((x) << HSDMA_DELAY_PEND_OFFSET))
+-#define HSDMA_DELAY(x) ((HSDMA_DELAY_INIT(x) << \
+- HSDMA_DELAY_TX_OFFSET) | HSDMA_DELAY_INIT(x))
+-
+-/* HSDMA_REG_INT_STATUS */
+-#define HSDMA_INT_DELAY_RX_COH BIT(31)
+-#define HSDMA_INT_DELAY_RX_INT BIT(30)
+-#define HSDMA_INT_DELAY_TX_COH BIT(29)
+-#define HSDMA_INT_DELAY_TX_INT BIT(28)
+-#define HSDMA_INT_RX_MASK 0x3
+-#define HSDMA_INT_RX_SHIFT 16
+-#define HSDMA_INT_RX_Q0 BIT(16)
+-#define HSDMA_INT_TX_MASK 0xf
+-#define HSDMA_INT_TX_SHIFT 0
+-#define HSDMA_INT_TX_Q0 BIT(0)
+-
+-/* tx/rx dma desc flags */
+-#define HSDMA_PLEN_MASK 0x3fff
+-#define HSDMA_DESC_DONE BIT(31)
+-#define HSDMA_DESC_LS0 BIT(30)
+-#define HSDMA_DESC_PLEN0(_x) (((_x) & HSDMA_PLEN_MASK) << 16)
+-#define HSDMA_DESC_TAG BIT(15)
+-#define HSDMA_DESC_LS1 BIT(14)
+-#define HSDMA_DESC_PLEN1(_x) ((_x) & HSDMA_PLEN_MASK)
+-
+-/* align 4 bytes */
+-#define HSDMA_ALIGN_SIZE 3
+-/* align size 128bytes */
+-#define HSDMA_MAX_PLEN 0x3f80
+-
+-struct hsdma_desc {
+- u32 addr0;
+- u32 flags;
+- u32 addr1;
+- u32 unused;
+-};
+-
+-struct mtk_hsdma_sg {
+- dma_addr_t src_addr;
+- dma_addr_t dst_addr;
+- u32 len;
+-};
+-
+-struct mtk_hsdma_desc {
+- struct virt_dma_desc vdesc;
+- unsigned int num_sgs;
+- struct mtk_hsdma_sg sg[1];
+-};
+-
+-struct mtk_hsdma_chan {
+- struct virt_dma_chan vchan;
+- unsigned int id;
+- dma_addr_t desc_addr;
+- int tx_idx;
+- int rx_idx;
+- struct hsdma_desc *tx_ring;
+- struct hsdma_desc *rx_ring;
+- struct mtk_hsdma_desc *desc;
+- unsigned int next_sg;
+-};
+-
+-struct mtk_hsdam_engine {
+- struct dma_device ddev;
+- struct device_dma_parameters dma_parms;
+- void __iomem *base;
+- struct tasklet_struct task;
+- volatile unsigned long chan_issued;
+-
+- struct mtk_hsdma_chan chan[1];
+-};
+-
+-static inline struct mtk_hsdam_engine *mtk_hsdma_chan_get_dev(
+- struct mtk_hsdma_chan *chan)
+-{
+- return container_of(chan->vchan.chan.device, struct mtk_hsdam_engine,
+- ddev);
+-}
+-
+-static inline struct mtk_hsdma_chan *to_mtk_hsdma_chan(struct dma_chan *c)
+-{
+- return container_of(c, struct mtk_hsdma_chan, vchan.chan);
+-}
+-
+-static inline struct mtk_hsdma_desc *to_mtk_hsdma_desc(
+- struct virt_dma_desc *vdesc)
+-{
+- return container_of(vdesc, struct mtk_hsdma_desc, vdesc);
+-}
+-
+-static inline u32 mtk_hsdma_read(struct mtk_hsdam_engine *hsdma, u32 reg)
+-{
+- return readl(hsdma->base + reg);
+-}
+-
+-static inline void mtk_hsdma_write(struct mtk_hsdam_engine *hsdma,
+- unsigned reg, u32 val)
+-{
+- writel(val, hsdma->base + reg);
+-}
+-
+-static void mtk_hsdma_reset_chan(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- chan->tx_idx = 0;
+- chan->rx_idx = HSDMA_DESCS_NUM - 1;
+-
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx);
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx);
+-
+- mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG,
+- 0x1 << (chan->id + HSDMA_RST_TX_SHIFT));
+- mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG,
+- 0x1 << (chan->id + HSDMA_RST_RX_SHIFT));
+-}
+-
+-static void hsdma_dump_reg(struct mtk_hsdam_engine *hsdma)
+-{
+- dev_dbg(hsdma->ddev.dev, "tbase %08x, tcnt %08x, " \
+- "tctx %08x, tdtx: %08x, rbase %08x, " \
+- "rcnt %08x, rctx %08x, rdtx %08x\n",
+- mtk_hsdma_read(hsdma, HSDMA_REG_TX_BASE),
+- mtk_hsdma_read(hsdma, HSDMA_REG_TX_CNT),
+- mtk_hsdma_read(hsdma, HSDMA_REG_TX_CTX),
+- mtk_hsdma_read(hsdma, HSDMA_REG_TX_DTX),
+- mtk_hsdma_read(hsdma, HSDMA_REG_RX_BASE),
+- mtk_hsdma_read(hsdma, HSDMA_REG_RX_CNT),
+- mtk_hsdma_read(hsdma, HSDMA_REG_RX_CRX),
+- mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX));
+-
+- dev_dbg(hsdma->ddev.dev, "info %08x, glo %08x, delay %08x, " \
+- "intr_stat %08x, intr_mask %08x\n",
+- mtk_hsdma_read(hsdma, HSDMA_REG_INFO),
+- mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG),
+- mtk_hsdma_read(hsdma, HSDMA_REG_DELAY_INT),
+- mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS),
+- mtk_hsdma_read(hsdma, HSDMA_REG_INT_MASK));
+-}
+-
+-static void hsdma_dump_desc(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- struct hsdma_desc *tx_desc;
+- struct hsdma_desc *rx_desc;
+- int i;
+-
+- dev_dbg(hsdma->ddev.dev, "tx idx: %d, rx idx: %d\n",
+- chan->tx_idx, chan->rx_idx);
+-
+- for (i = 0; i < HSDMA_DESCS_NUM; i++) {
+- tx_desc = &chan->tx_ring[i];
+- rx_desc = &chan->rx_ring[i];
+-
+- dev_dbg(hsdma->ddev.dev, "%d tx addr0: %08x, flags %08x, " \
+- "tx addr1: %08x, rx addr0 %08x, flags %08x\n",
+- i, tx_desc->addr0, tx_desc->flags, \
+- tx_desc->addr1, rx_desc->addr0, rx_desc->flags);
+- }
+-}
+-
+-static void mtk_hsdma_reset(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- int i;
+-
+- /* disable dma */
+- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0);
+-
+- /* disable intr */
+- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0);
+-
+- /* init desc value */
+- for (i = 0; i < HSDMA_DESCS_NUM; i++) {
+- chan->tx_ring[i].addr0 = 0;
+- chan->tx_ring[i].flags = HSDMA_DESC_LS0 |
+- HSDMA_DESC_DONE;
+- }
+- for (i = 0; i < HSDMA_DESCS_NUM; i++) {
+- chan->rx_ring[i].addr0 = 0;
+- chan->rx_ring[i].flags = 0;
+- }
+-
+- /* reset */
+- mtk_hsdma_reset_chan(hsdma, chan);
+-
+- /* enable intr */
+- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0);
+-
+- /* enable dma */
+- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT);
+-}
+-
+-static int mtk_hsdma_terminate_all(struct dma_chan *c)
+-{
+- struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
+- struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan);
+- unsigned long timeout;
+- LIST_HEAD(head);
+-
+- spin_lock_bh(&chan->vchan.lock);
+- chan->desc = NULL;
+- clear_bit(chan->id, &hsdma->chan_issued);
+- vchan_get_all_descriptors(&chan->vchan, &head);
+- spin_unlock_bh(&chan->vchan.lock);
+-
+- vchan_dma_desc_free_list(&chan->vchan, &head);
+-
+- /* wait dma transfer complete */
+- timeout = jiffies + msecs_to_jiffies(2000);
+- while (mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG) &
+- (HSDMA_GLO_RX_BUSY | HSDMA_GLO_TX_BUSY)) {
+- if (time_after_eq(jiffies, timeout)) {
+- hsdma_dump_desc(hsdma, chan);
+- mtk_hsdma_reset(hsdma, chan);
+- dev_err(hsdma->ddev.dev, "timeout, reset it\n");
+- break;
+- }
+- cpu_relax();
+- }
+-
+- return 0;
+-}
+-
+-static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- dma_addr_t src, dst;
+- size_t len, tlen;
+- struct hsdma_desc *tx_desc, *rx_desc;
+- struct mtk_hsdma_sg *sg;
+- unsigned int i;
+- int rx_idx;
+-
+- sg = &chan->desc->sg[0];
+- len = sg->len;
+- chan->desc->num_sgs = DIV_ROUND_UP(len, HSDMA_MAX_PLEN);
+-
+- /* tx desc */
+- src = sg->src_addr;
+- for (i = 0; i < chan->desc->num_sgs; i++) {
+- tx_desc = &chan->tx_ring[chan->tx_idx];
+-
+- if (len > HSDMA_MAX_PLEN)
+- tlen = HSDMA_MAX_PLEN;
+- else
+- tlen = len;
+-
+- if (i & 0x1) {
+- tx_desc->addr1 = src;
+- tx_desc->flags |= HSDMA_DESC_PLEN1(tlen);
+- } else {
+- tx_desc->addr0 = src;
+- tx_desc->flags = HSDMA_DESC_PLEN0(tlen);
+-
+- /* update index */
+- chan->tx_idx = HSDMA_NEXT_DESC(chan->tx_idx);
+- }
+-
+- src += tlen;
+- len -= tlen;
+- }
+- if (i & 0x1)
+- tx_desc->flags |= HSDMA_DESC_LS0;
+- else
+- tx_desc->flags |= HSDMA_DESC_LS1;
+-
+- /* rx desc */
+- rx_idx = HSDMA_NEXT_DESC(chan->rx_idx);
+- len = sg->len;
+- dst = sg->dst_addr;
+- for (i = 0; i < chan->desc->num_sgs; i++) {
+- rx_desc = &chan->rx_ring[rx_idx];
+- if (len > HSDMA_MAX_PLEN)
+- tlen = HSDMA_MAX_PLEN;
+- else
+- tlen = len;
+-
+- rx_desc->addr0 = dst;
+- rx_desc->flags = HSDMA_DESC_PLEN0(tlen);
+-
+- dst += tlen;
+- len -= tlen;
+-
+- /* update index */
+- rx_idx = HSDMA_NEXT_DESC(rx_idx);
+- }
+-
+- /* make sure desc and index all up to date */
+- wmb();
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx);
+-
+- return 0;
+-}
+-
+-static int gdma_next_desc(struct mtk_hsdma_chan *chan)
+-{
+- struct virt_dma_desc *vdesc;
+-
+- vdesc = vchan_next_desc(&chan->vchan);
+- if (!vdesc) {
+- chan->desc = NULL;
+- return 0;
+- }
+- chan->desc = to_mtk_hsdma_desc(vdesc);
+- chan->next_sg = 0;
+-
+- return 1;
+-}
+-
+-static void mtk_hsdma_chan_done(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- struct mtk_hsdma_desc *desc;
+- int chan_issued;
+-
+- chan_issued = 0;
+- spin_lock_bh(&chan->vchan.lock);
+- desc = chan->desc;
+- if (likely(desc)) {
+- if (chan->next_sg == desc->num_sgs) {
+- list_del(&desc->vdesc.node);
+- vchan_cookie_complete(&desc->vdesc);
+- chan_issued = gdma_next_desc(chan);
+- }
+- } else
+- dev_dbg(hsdma->ddev.dev, "no desc to complete\n");
+-
+- if (chan_issued)
+- set_bit(chan->id, &hsdma->chan_issued);
+- spin_unlock_bh(&chan->vchan.lock);
+-}
+-
+-static irqreturn_t mtk_hsdma_irq(int irq, void *devid)
+-{
+- struct mtk_hsdam_engine *hsdma = devid;
+- u32 status;
+-
+- status = mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS);
+- if (unlikely(!status))
+- return IRQ_NONE;
+-
+- if (likely(status & HSDMA_INT_RX_Q0))
+- tasklet_schedule(&hsdma->task);
+- else
+- dev_dbg(hsdma->ddev.dev, "unhandle irq status %08x\n",
+- status);
+- /* clean intr bits */
+- mtk_hsdma_write(hsdma, HSDMA_REG_INT_STATUS, status);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static void mtk_hsdma_issue_pending(struct dma_chan *c)
+-{
+- struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
+- struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan);
+-
+- spin_lock_bh(&chan->vchan.lock);
+- if (vchan_issue_pending(&chan->vchan) && !chan->desc) {
+- if (gdma_next_desc(chan)) {
+- set_bit(chan->id, &hsdma->chan_issued);
+- tasklet_schedule(&hsdma->task);
+- } else
+- dev_dbg(hsdma->ddev.dev, "no desc to issue\n");
+- }
+- spin_unlock_bh(&chan->vchan.lock);
+-}
+-
+-static struct dma_async_tx_descriptor *mtk_hsdma_prep_dma_memcpy(
+- struct dma_chan *c, dma_addr_t dest, dma_addr_t src,
+- size_t len, unsigned long flags)
+-{
+- struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
+- struct mtk_hsdma_desc *desc;
+-
+- if (len <= 0)
+- return NULL;
+-
+- desc = kzalloc(sizeof(struct mtk_hsdma_desc), GFP_ATOMIC);
+- if (!desc) {
+- dev_err(c->device->dev, "alloc memcpy decs error\n");
+- return NULL;
+- }
+-
+- desc->sg[0].src_addr = src;
+- desc->sg[0].dst_addr = dest;
+- desc->sg[0].len = len;
+-
+- return vchan_tx_prep(&chan->vchan, &desc->vdesc, flags);
+-}
+-
+-static enum dma_status mtk_hsdma_tx_status(struct dma_chan *c,
+- dma_cookie_t cookie,
+- struct dma_tx_state *state)
+-{
+- return dma_cookie_status(c, cookie, state);
+-}
+-
+-static void mtk_hsdma_free_chan_resources(struct dma_chan *c)
+-{
+- vchan_free_chan_resources(to_virt_chan(c));
+-}
+-
+-static void mtk_hsdma_desc_free(struct virt_dma_desc *vdesc)
+-{
+- kfree(container_of(vdesc, struct mtk_hsdma_desc, vdesc));
+-}
+-
+-static void mtk_hsdma_tx(struct mtk_hsdam_engine *hsdma)
+-{
+- struct mtk_hsdma_chan *chan;
+-
+- if (test_and_clear_bit(0, &hsdma->chan_issued)) {
+- chan = &hsdma->chan[0];
+- if (chan->desc)
+- mtk_hsdma_start_transfer(hsdma, chan);
+- else
+- dev_dbg(hsdma->ddev.dev, "chan 0 no desc to issue\n");
+- }
+-}
+-
+-static void mtk_hsdma_rx(struct mtk_hsdam_engine *hsdma)
+-{
+- struct mtk_hsdma_chan *chan;
+- int next_idx, drx_idx, cnt;
+-
+- chan = &hsdma->chan[0];
+- next_idx = HSDMA_NEXT_DESC(chan->rx_idx);
+- drx_idx = mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX);
+-
+- cnt = (drx_idx - next_idx) & HSDMA_DESCS_MASK;
+- if (!cnt)
+- return;
+-
+- chan->next_sg += cnt;
+- chan->rx_idx = (chan->rx_idx + cnt) & HSDMA_DESCS_MASK;
+-
+- /* update rx crx */
+- wmb();
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx);
+-
+- mtk_hsdma_chan_done(hsdma, chan);
+-}
+-
+-static void mtk_hsdma_tasklet(unsigned long arg)
+-{
+- struct mtk_hsdam_engine *hsdma = (struct mtk_hsdam_engine *)arg;
+-
+- mtk_hsdma_rx(hsdma);
+- mtk_hsdma_tx(hsdma);
+-}
+-
+-static int mtk_hsdam_alloc_desc(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- int i;
+-
+- chan->tx_ring = dma_alloc_coherent(hsdma->ddev.dev,
+- 2 * HSDMA_DESCS_NUM * sizeof(*chan->tx_ring),
+- &chan->desc_addr, GFP_ATOMIC | __GFP_ZERO);
+- if (!chan->tx_ring)
+- goto no_mem;
+-
+- chan->rx_ring = &chan->tx_ring[HSDMA_DESCS_NUM];
+-
+- /* init tx ring value */
+- for (i = 0; i < HSDMA_DESCS_NUM; i++)
+- chan->tx_ring[i].flags = HSDMA_DESC_LS0 | HSDMA_DESC_DONE;
+-
+- return 0;
+-no_mem:
+- return -ENOMEM;
+-}
+-
+-static void mtk_hsdam_free_desc(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- if (chan->tx_ring) {
+- dma_free_coherent(hsdma->ddev.dev,
+- 2 * HSDMA_DESCS_NUM * sizeof(*chan->tx_ring),
+- chan->tx_ring, chan->desc_addr);
+- chan->tx_ring = NULL;
+- chan->rx_ring = NULL;
+- }
+-}
+-
+-static int mtk_hsdma_init(struct mtk_hsdam_engine *hsdma)
+-{
+- struct mtk_hsdma_chan *chan;
+- int ret;
+- u32 reg;
+-
+- /* init desc */
+- chan = &hsdma->chan[0];
+- ret = mtk_hsdam_alloc_desc(hsdma, chan);
+- if (ret)
+- return ret;
+-
+- /* tx */
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, chan->desc_addr);
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, HSDMA_DESCS_NUM);
+- /* rx */
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, chan->desc_addr +
+- (sizeof(struct hsdma_desc) * HSDMA_DESCS_NUM));
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, HSDMA_DESCS_NUM);
+- /* reset */
+- mtk_hsdma_reset_chan(hsdma, chan);
+-
+- /* enable rx intr */
+- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0);
+-
+- /* enable dma */
+- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT);
+-
+- /* hardware info */
+- reg = mtk_hsdma_read(hsdma, HSDMA_REG_INFO);
+- dev_info(hsdma->ddev.dev, "rx: %d, tx: %d\n",
+- (reg >> HSDMA_INFO_RX_SHIFT) & HSDMA_INFO_RX_MASK,
+- (reg >> HSDMA_INFO_TX_SHIFT) & HSDMA_INFO_TX_MASK);
+-
+- hsdma_dump_reg(hsdma);
+-
+- return ret;
+-}
+-
+-static void mtk_hsdma_uninit(struct mtk_hsdam_engine *hsdma)
+-{
+- struct mtk_hsdma_chan *chan;
+-
+- /* disable dma */
+- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0);
+-
+- /* disable intr */
+- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0);
+-
+- /* free desc */
+- chan = &hsdma->chan[0];
+- mtk_hsdam_free_desc(hsdma, chan);
+-
+- /* tx */
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, 0);
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, 0);
+- /* rx */
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, 0);
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, 0);
+- /* reset */
+- mtk_hsdma_reset_chan(hsdma, chan);
+-}
+-
+-static const struct of_device_id mtk_hsdma_of_match[] = {
+- { .compatible = "mediatek,mt7621-hsdma" },
+- { },
+-};
+-
+-static int mtk_hsdma_probe(struct platform_device *pdev)
+-{
+- const struct of_device_id *match;
+- struct mtk_hsdma_chan *chan;
+- struct mtk_hsdam_engine *hsdma;
+- struct dma_device *dd;
+- struct resource *res;
+- int ret;
+- int irq;
+- void __iomem *base;
+-
+- ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+- if (ret)
+- return ret;
+-
+- match = of_match_device(mtk_hsdma_of_match, &pdev->dev);
+- if (!match)
+- return -EINVAL;
+-
+- hsdma = devm_kzalloc(&pdev->dev, sizeof(*hsdma), GFP_KERNEL);
+- if (!hsdma) {
+- dev_err(&pdev->dev, "alloc dma device failed\n");
+- return -EINVAL;
+- }
+-
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- base = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(base))
+- return PTR_ERR(base);
+- hsdma->base = base + HSDMA_BASE_OFFSET;
+- tasklet_init(&hsdma->task, mtk_hsdma_tasklet, (unsigned long)hsdma);
+-
+- irq = platform_get_irq(pdev, 0);
+- if (irq < 0) {
+- dev_err(&pdev->dev, "failed to get irq\n");
+- return -EINVAL;
+- }
+- ret = devm_request_irq(&pdev->dev, irq, mtk_hsdma_irq,
+- 0, dev_name(&pdev->dev), hsdma);
+- if (ret) {
+- dev_err(&pdev->dev, "failed to request irq\n");
+- return ret;
+- }
+-
+- device_reset(&pdev->dev);
+-
+- dd = &hsdma->ddev;
+- dma_cap_set(DMA_MEMCPY, dd->cap_mask);
+- dd->copy_align = HSDMA_ALIGN_SIZE;
+- dd->device_free_chan_resources = mtk_hsdma_free_chan_resources;
+- dd->device_prep_dma_memcpy = mtk_hsdma_prep_dma_memcpy;
+- dd->device_terminate_all = mtk_hsdma_terminate_all;
+- dd->device_tx_status = mtk_hsdma_tx_status;
+- dd->device_issue_pending = mtk_hsdma_issue_pending;
+- dd->dev = &pdev->dev;
+- dd->dev->dma_parms = &hsdma->dma_parms;
+- dma_set_max_seg_size(dd->dev, HSDMA_MAX_PLEN);
+- INIT_LIST_HEAD(&dd->channels);
+-
+- chan = &hsdma->chan[0];
+- chan->id = 0;
+- chan->vchan.desc_free = mtk_hsdma_desc_free;
+- vchan_init(&chan->vchan, dd);
+-
+- /* init hardware */
+- ret = mtk_hsdma_init(hsdma);
+- if (ret) {
+- dev_err(&pdev->dev, "failed to alloc ring descs\n");
+- return ret;
+- }
+-
+- ret = dma_async_device_register(dd);
+- if (ret) {
+- dev_err(&pdev->dev, "failed to register dma device\n");
+- goto err_uninit_hsdma;
+- }
+-
+- ret = of_dma_controller_register(pdev->dev.of_node,
+- of_dma_xlate_by_chan_id, hsdma);
+- if (ret) {
+- dev_err(&pdev->dev, "failed to register of dma controller\n");
+- goto err_unregister;
+- }
+-
+- platform_set_drvdata(pdev, hsdma);
+-
+- return 0;
+-
+-err_unregister:
+- dma_async_device_unregister(dd);
+-err_uninit_hsdma:
+- mtk_hsdma_uninit(hsdma);
+- return ret;
+-}
+-
+-static int mtk_hsdma_remove(struct platform_device *pdev)
+-{
+- struct mtk_hsdam_engine *hsdma = platform_get_drvdata(pdev);
+-
+- mtk_hsdma_uninit(hsdma);
+-
+- of_dma_controller_free(pdev->dev.of_node);
+- dma_async_device_unregister(&hsdma->ddev);
+-
+- return 0;
+-}
+-
+-static struct platform_driver mtk_hsdma_driver = {
+- .probe = mtk_hsdma_probe,
+- .remove = mtk_hsdma_remove,
+- .driver = {
+- .name = "hsdma-mt7621",
+- .of_match_table = mtk_hsdma_of_match,
+- },
+-};
+-module_platform_driver(mtk_hsdma_driver);
+-
+-MODULE_AUTHOR("Michael Lee <igvtee@gmail.com>");
+-MODULE_DESCRIPTION("MTK HSDMA driver");
+-MODULE_LICENSE("GPL v2");
+diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+index 276c965afc114..5c6630255ac20 100644
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -41,6 +41,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
+ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */
+ {USB_DEVICE(0x2C4E, 0x0102)}, /* MERCUSYS MW150US v2 */
+ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
++ {USB_DEVICE(0x7392, 0xb811)}, /* Edimax EW-7811UN V2 */
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
+ {} /* Terminating entry */
+ };
+diff --git a/drivers/staging/rtl8723bs/os_dep/wifi_regd.c b/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
+index aa2f62acc994d..4dd6f3fb59060 100644
+--- a/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
++++ b/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
+@@ -39,7 +39,7 @@
+ NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_OFDM)
+
+ static const struct ieee80211_regdomain rtw_regdom_rd = {
+- .n_reg_rules = 3,
++ .n_reg_rules = 2,
+ .alpha2 = "99",
+ .reg_rules = {
+ RTW_2GHZ_CH01_11,
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c
+index 25eb3891e34b8..56bfb30b0ef58 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c
+@@ -89,8 +89,7 @@ static int cxgbit_is_ofld_imm(const struct sk_buff *skb)
+ if (likely(cxgbit_skcb_flags(skb) & SKCBF_TX_ISO))
+ length += sizeof(struct cpl_tx_data_iso);
+
+-#define MAX_IMM_TX_PKT_LEN 256
+- return length <= MAX_IMM_TX_PKT_LEN;
++ return length <= MAX_IMM_OFLD_TX_DATA_WR_LEN;
+ }
+
+ /*
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index c1592403222f5..239443ce52001 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -391,6 +391,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
+ { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
+
++ /* ELMO L-12F document camera */
++ { USB_DEVICE(0x09a1, 0x0028), .driver_info = USB_QUIRK_DELAY_CTRL_MSG },
++
+ /* Broadcom BCM92035DGROM BT dongle */
+ { USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME },
+
+@@ -415,6 +418,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x10d6, 0x2200), .driver_info =
+ USB_QUIRK_STRING_FETCH_255 },
+
++ /* novation SoundControl XL */
++ { USB_DEVICE(0x1235, 0x0061), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Huawei 4G LTE module */
+ { USB_DEVICE(0x12d1, 0x15bb), .driver_info =
+ USB_QUIRK_DISCONNECT_SUSPEND },
+@@ -495,9 +501,6 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* INTEL VALUE SSD */
+ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+
+- /* novation SoundControl XL */
+- { USB_DEVICE(0x1235, 0x0061), .driver_info = USB_QUIRK_RESET_RESUME },
+-
+ { } /* terminating entry must be last */
+ };
+
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index a5c8329fd4625..56a35e0160392 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -1512,19 +1512,20 @@ static void dwc2_hc_start_transfer(struct dwc2_hsotg *hsotg,
+ if (num_packets > max_hc_pkt_count) {
+ num_packets = max_hc_pkt_count;
+ chan->xfer_len = num_packets * chan->max_packet;
++ } else if (chan->ep_is_in) {
++ /*
++ * Always program an integral # of max packets
++ * for IN transfers.
++ * Note: This assumes that the input buffer is
++ * aligned and sized accordingly.
++ */
++ chan->xfer_len = num_packets * chan->max_packet;
+ }
+ } else {
+ /* Need 1 packet for transfer length of 0 */
+ num_packets = 1;
+ }
+
+- if (chan->ep_is_in)
+- /*
+- * Always program an integral # of max packets for IN
+- * transfers
+- */
+- chan->xfer_len = num_packets * chan->max_packet;
+-
+ if (chan->ep_type == USB_ENDPOINT_XFER_INT ||
+ chan->ep_type == USB_ENDPOINT_XFER_ISOC)
+ /*
+diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
+index a052d39b4375e..d5f4ec1b73b15 100644
+--- a/drivers/usb/dwc2/hcd_intr.c
++++ b/drivers/usb/dwc2/hcd_intr.c
+@@ -500,7 +500,7 @@ static int dwc2_update_urb_state(struct dwc2_hsotg *hsotg,
+ &short_read);
+
+ if (urb->actual_length + xfer_length > urb->length) {
+- dev_warn(hsotg->dev, "%s(): trimming xfer length\n", __func__);
++ dev_dbg(hsotg->dev, "%s(): trimming xfer length\n", __func__);
+ xfer_length = urb->length - urb->actual_length;
+ }
+
+@@ -1977,6 +1977,18 @@ error:
+ qtd->error_count++;
+ dwc2_update_urb_state_abn(hsotg, chan, chnum, qtd->urb,
+ qtd, DWC2_HC_XFER_XACT_ERR);
++ /*
++ * We can get here after a completed transaction
++ * (urb->actual_length >= urb->length) which was not reported
++ * as completed. If that is the case, and we do not abort
++ * the transfer, a transfer of size 0 will be enqueued
++ * subsequently. If urb->actual_length is not DMA-aligned,
++ * the buffer will then point to an unaligned address, and
++ * the resulting behavior is undefined. Bail out in that
++ * situation.
++ */
++ if (qtd->urb->actual_length >= qtd->urb->length)
++ qtd->error_count = 3;
+ dwc2_hcd_save_data_toggle(hsotg, chan, chnum, qtd);
+ dwc2_halt_channel(hsotg, chan, qtd, DWC2_HC_XFER_XACT_ERR);
+ }
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 6ab5c48f5d873..a0806dca3de9d 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -593,8 +593,23 @@ static int dwc3_gadget_set_ep_config(struct dwc3_ep *dep, unsigned int action)
+ params.param0 |= DWC3_DEPCFG_FIFO_NUMBER(dep->number >> 1);
+
+ if (desc->bInterval) {
+- params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(desc->bInterval - 1);
+- dep->interval = 1 << (desc->bInterval - 1);
++ u8 bInterval_m1;
++
++ /*
++ * Valid range for DEPCFG.bInterval_m1 is from 0 to 13, and it
++ * must be set to 0 when the controller operates in full-speed.
++ */
++ bInterval_m1 = min_t(u8, desc->bInterval - 1, 13);
++ if (dwc->gadget.speed == USB_SPEED_FULL)
++ bInterval_m1 = 0;
++
++ if (usb_endpoint_type(desc) == USB_ENDPOINT_XFER_INT &&
++ dwc->gadget.speed == USB_SPEED_FULL)
++ dep->interval = desc->bInterval;
++ else
++ dep->interval = 1 << (desc->bInterval - 1);
++
++ params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(bInterval_m1);
+ }
+
+ return dwc3_send_gadget_ep_cmd(dep, DWC3_DEPCMD_SETEPCONFIG, ¶ms);
+diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
+index fb5ed97572e5f..0cb0c638fd131 100644
+--- a/drivers/usb/gadget/function/u_audio.c
++++ b/drivers/usb/gadget/function/u_audio.c
+@@ -89,7 +89,12 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
+ struct snd_uac_chip *uac = prm->uac;
+
+ /* i/f shutting down */
+- if (!prm->ep_enabled || req->status == -ESHUTDOWN)
++ if (!prm->ep_enabled) {
++ usb_ep_free_request(ep, req);
++ return;
++ }
++
++ if (req->status == -ESHUTDOWN)
+ return;
+
+ /*
+@@ -351,8 +356,14 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
+
+ for (i = 0; i < params->req_number; i++) {
+ if (prm->ureq[i].req) {
+- usb_ep_dequeue(ep, prm->ureq[i].req);
+- usb_ep_free_request(ep, prm->ureq[i].req);
++ if (usb_ep_dequeue(ep, prm->ureq[i].req))
++ usb_ep_free_request(ep, prm->ureq[i].req);
++ /*
++ * If usb_ep_dequeue() cannot successfully dequeue the
++ * request, the request will be freed by the completion
++ * callback.
++ */
++
+ prm->ureq[i].req = NULL;
+ }
+ }
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index 28b4cacf7a787..9ce21b8caf35c 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -2108,32 +2108,35 @@ int musb_queue_resume_work(struct musb *musb,
+ {
+ struct musb_pending_work *w;
+ unsigned long flags;
++ bool is_suspended;
+ int error;
+
+ if (WARN_ON(!callback))
+ return -EINVAL;
+
+- if (pm_runtime_active(musb->controller))
+- return callback(musb, data);
++ spin_lock_irqsave(&musb->list_lock, flags);
++ is_suspended = musb->is_runtime_suspended;
++
++ if (is_suspended) {
++ w = devm_kzalloc(musb->controller, sizeof(*w), GFP_ATOMIC);
++ if (!w) {
++ error = -ENOMEM;
++ goto out_unlock;
++ }
+
+- w = devm_kzalloc(musb->controller, sizeof(*w), GFP_ATOMIC);
+- if (!w)
+- return -ENOMEM;
++ w->callback = callback;
++ w->data = data;
+
+- w->callback = callback;
+- w->data = data;
+- spin_lock_irqsave(&musb->list_lock, flags);
+- if (musb->is_runtime_suspended) {
+ list_add_tail(&w->node, &musb->pending_list);
+ error = 0;
+- } else {
+- dev_err(musb->controller, "could not add resume work %p\n",
+- callback);
+- devm_kfree(musb->controller, w);
+- error = -EINPROGRESS;
+ }
++
++out_unlock:
+ spin_unlock_irqrestore(&musb->list_lock, flags);
+
++ if (!is_suspended)
++ error = callback(musb, data);
++
+ return error;
+ }
+ EXPORT_SYMBOL_GPL(musb_queue_resume_work);
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index b2364e3794295..a5891cb2c72e3 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1370,8 +1370,9 @@ static int change_speed(struct tty_struct *tty, struct usb_serial_port *port)
+ index_value = get_ftdi_divisor(tty, port);
+ value = (u16)index_value;
+ index = (u16)(index_value >> 16);
+- if ((priv->chip_type == FT2232C) || (priv->chip_type == FT2232H) ||
+- (priv->chip_type == FT4232H) || (priv->chip_type == FT232H)) {
++ if (priv->chip_type == FT2232C || priv->chip_type == FT2232H ||
++ priv->chip_type == FT4232H || priv->chip_type == FT232H ||
++ priv->chip_type == FTX) {
+ /* Probably the BM type needs the MSB of the encoded fractional
+ * divider also moved like for the chips above. Any infos? */
+ index = (u16)((index << 8) | priv->interface);
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index 1f65bee521e69..1e3ee2bfbcd03 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -1250,8 +1250,10 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port,
+ if (urb->transfer_buffer == NULL) {
+ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+ GFP_ATOMIC);
+- if (!urb->transfer_buffer)
++ if (!urb->transfer_buffer) {
++ bytes_sent = -ENOMEM;
+ goto exit;
++ }
+ }
+ transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE);
+
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 4a7bd26841af0..c78dfb7fd3948 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -1340,8 +1340,10 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
+ if (urb->transfer_buffer == NULL) {
+ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+ GFP_ATOMIC);
+- if (!urb->transfer_buffer)
++ if (!urb->transfer_buffer) {
++ bytes_sent = -ENOMEM;
+ goto exit;
++ }
+ }
+ transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE);
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index cdf25a39fca79..aeaa3756f6ee8 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1569,7 +1569,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1274, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1275, 0xff, 0xff, 0xff) },
++ { USB_DEVICE(ZTE_VENDOR_ID, 0x1275), /* ZTE P685M */
++ .driver_info = RSVD(3) | RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1276, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1277, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1278, 0xff, 0xff, 0xff) },
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index f99558d006bf4..97c4319797d5c 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -1303,6 +1303,7 @@ config FB_ATY
+ select FB_CFB_IMAGEBLIT
+ select FB_BACKLIGHT if FB_ATY_BACKLIGHT
+ select FB_MACMODES if PPC
++ select FB_ATY_CT if SPARC64 && PCI
+ help
+ This driver supports graphics boards with the ATI Mach64 chips.
+ Say Y if you have such a graphics board.
+@@ -1313,7 +1314,6 @@ config FB_ATY
+ config FB_ATY_CT
+ bool "Mach64 CT/VT/GT/LT (incl. 3D RAGE) support"
+ depends on PCI && FB_ATY
+- default y if SPARC64 && PCI
+ help
+ Say Y here to support use of ATI's 64-bit Rage boards (or other
+ boards based on the Mach64 CT, VT, GT, and LT chipsets) as a
+diff --git a/drivers/watchdog/mei_wdt.c b/drivers/watchdog/mei_wdt.c
+index 8023cf28657ab..c862dd38b6f5d 100644
+--- a/drivers/watchdog/mei_wdt.c
++++ b/drivers/watchdog/mei_wdt.c
+@@ -382,6 +382,7 @@ static int mei_wdt_register(struct mei_wdt *wdt)
+
+ watchdog_set_drvdata(&wdt->wdd, wdt);
+ watchdog_stop_on_reboot(&wdt->wdd);
++ watchdog_stop_on_unregister(&wdt->wdd);
+
+ ret = watchdog_register_device(&wdt->wdd);
+ if (ret) {
+diff --git a/fs/affs/namei.c b/fs/affs/namei.c
+index 41c5749f4db78..5400a876d73fb 100644
+--- a/fs/affs/namei.c
++++ b/fs/affs/namei.c
+@@ -460,8 +460,10 @@ affs_xrename(struct inode *old_dir, struct dentry *old_dentry,
+ return -EIO;
+
+ bh_new = affs_bread(sb, d_inode(new_dentry)->i_ino);
+- if (!bh_new)
++ if (!bh_new) {
++ affs_brelse(bh_old);
+ return -EIO;
++ }
+
+ /* Remove old header from its parent directory. */
+ affs_lock_dir(old_dir);
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index f36b2a386aae8..49db37b1f6e36 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -267,9 +267,12 @@ int btrfs_copy_root(struct btrfs_trans_handle *trans,
+ ret = btrfs_inc_ref(trans, root, cow, 1);
+ else
+ ret = btrfs_inc_ref(trans, root, cow, 0);
+-
+- if (ret)
++ if (ret) {
++ btrfs_tree_unlock(cow);
++ free_extent_buffer(cow);
++ btrfs_abort_transaction(trans, ret);
+ return ret;
++ }
+
+ btrfs_mark_buffer_dirty(cow);
+ *cow_ret = cow;
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index 652b0b16e93e2..6511cb71986c9 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -743,8 +743,10 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
+ while (num_entries) {
+ e = kmem_cache_zalloc(btrfs_free_space_cachep,
+ GFP_NOFS);
+- if (!e)
++ if (!e) {
++ ret = -ENOMEM;
+ goto free_cache;
++ }
+
+ ret = io_ctl_read_entry(&io_ctl, e, &type);
+ if (ret) {
+@@ -753,6 +755,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
+ }
+
+ if (!e->bytes) {
++ ret = -1;
+ kmem_cache_free(btrfs_free_space_cachep, e);
+ goto free_cache;
+ }
+@@ -773,6 +776,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
+ e->bitmap = kmem_cache_zalloc(
+ btrfs_free_space_bitmap_cachep, GFP_NOFS);
+ if (!e->bitmap) {
++ ret = -ENOMEM;
+ kmem_cache_free(
+ btrfs_free_space_cachep, e);
+ goto free_cache;
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index eedcb7bf50e9e..e6e4e6fb2adde 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1291,9 +1291,7 @@ static void __del_reloc_root(struct btrfs_root *root)
+ RB_CLEAR_NODE(&node->rb_node);
+ }
+ spin_unlock(&rc->reloc_root_tree.lock);
+- if (!node)
+- return;
+- BUG_ON((struct btrfs_root *)node->data != root);
++ ASSERT(!node || (struct btrfs_root *)node->data == root);
+ }
+
+ spin_lock(&fs_info->trans_lock);
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 6285085195c15..632249ce61eba 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3882,6 +3882,7 @@ int cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
+ cifs_sb->prepath = kstrdup(pvolume_info->prepath, GFP_KERNEL);
+ if (cifs_sb->prepath == NULL)
+ return -ENOMEM;
++ cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
+ }
+
+ return 0;
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 8f7e0ad5b5ef1..0dde6385a1258 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2315,11 +2315,10 @@ again:
+ (frame - 1)->bh);
+ if (err)
+ goto journal_error;
+- if (restart) {
+- err = ext4_handle_dirty_dx_node(handle, dir,
+- frame->bh);
++ err = ext4_handle_dirty_dx_node(handle, dir,
++ frame->bh);
++ if (err)
+ goto journal_error;
+- }
+ } else {
+ struct dx_root *dxroot;
+ memcpy((char *) entries2, (char *) entries,
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 59b5c0b032bb5..95330dfdbb1af 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -675,6 +675,10 @@ int f2fs_truncate(struct inode *inode)
+ return -EIO;
+ }
+
++ err = dquot_initialize(inode);
++ if (err)
++ return err;
++
+ /* we should check inline_data size */
+ if (!f2fs_may_inline_data(inode)) {
+ err = f2fs_convert_inline_inode(inode);
+@@ -756,7 +760,8 @@ static void __setattr_copy(struct inode *inode, const struct iattr *attr)
+ if (ia_valid & ATTR_MODE) {
+ umode_t mode = attr->ia_mode;
+
+- if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
++ if (!in_group_p(inode->i_gid) &&
++ !capable_wrt_inode_uidgid(inode, CAP_FSETID))
+ mode &= ~S_ISGID;
+ set_acl_inode(inode, mode);
+ }
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index 2fabeb0bb28fd..299f295fcb6c7 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -193,6 +193,10 @@ int f2fs_convert_inline_inode(struct inode *inode)
+ if (!f2fs_has_inline_data(inode))
+ return 0;
+
++ err = dquot_initialize(inode);
++ if (err)
++ return err;
++
+ page = f2fs_grab_cache_page(inode->i_mapping, 0, false);
+ if (!page)
+ return -ENOMEM;
+diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
+index 62edf8f5615fa..56dddc1f8dddc 100644
+--- a/fs/gfs2/lock_dlm.c
++++ b/fs/gfs2/lock_dlm.c
+@@ -283,7 +283,6 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
+ {
+ struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+ struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+- int lvb_needs_unlock = 0;
+ int error;
+
+ if (gl->gl_lksb.sb_lkid == 0) {
+@@ -296,13 +295,10 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
+ gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
+ gfs2_update_request_times(gl);
+
+- /* don't want to skip dlm_unlock writing the lvb when lock is ex */
+-
+- if (gl->gl_lksb.sb_lvbptr && (gl->gl_state == LM_ST_EXCLUSIVE))
+- lvb_needs_unlock = 1;
++ /* don't want to skip dlm_unlock writing the lvb when lock has one */
+
+ if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&
+- !lvb_needs_unlock) {
++ !gl->gl_lksb.sb_lvbptr) {
+ gfs2_glock_free(gl);
+ return;
+ }
+diff --git a/fs/isofs/dir.c b/fs/isofs/dir.c
+index 947ce22f5b3c3..55df4d80793ba 100644
+--- a/fs/isofs/dir.c
++++ b/fs/isofs/dir.c
+@@ -152,6 +152,7 @@ static int do_isofs_readdir(struct inode *inode, struct file *file,
+ printk(KERN_NOTICE "iso9660: Corrupted directory entry"
+ " in block %lu of inode %lu\n", block,
+ inode->i_ino);
++ brelse(bh);
+ return -EIO;
+ }
+
+diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c
+index cac468f04820e..558e7c51ce0d4 100644
+--- a/fs/isofs/namei.c
++++ b/fs/isofs/namei.c
+@@ -102,6 +102,7 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
+ printk(KERN_NOTICE "iso9660: Corrupted directory entry"
+ " in block %lu of inode %lu\n", block,
+ dir->i_ino);
++ brelse(bh);
+ return 0;
+ }
+
+diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c
+index be7c8a6a57480..4fe64519870f1 100644
+--- a/fs/jffs2/summary.c
++++ b/fs/jffs2/summary.c
+@@ -783,6 +783,8 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
+ dbg_summary("Writing unknown RWCOMPAT_COPY node type %x\n",
+ je16_to_cpu(temp->u.nodetype));
+ jffs2_sum_disable_collecting(c->summary);
++ /* The above call removes the list, nothing more to do */
++ goto bail_rwcompat;
+ } else {
+ BUG(); /* unknown node in summary information */
+ }
+@@ -794,6 +796,7 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
+
+ c->summary->sum_num--;
+ }
++ bail_rwcompat:
+
+ jffs2_sum_reset_collected(c->summary);
+
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 49263e220dbcf..687b07b9b4f62 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -1669,7 +1669,7 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen)
+ } else if (rc == -ENOSPC) {
+ /* search for next smaller log2 block */
+ l2nb = BLKSTOL2(nblocks) - 1;
+- nblocks = 1 << l2nb;
++ nblocks = 1LL << l2nb;
+ } else {
+ /* Trim any already allocated blocks */
+ jfs_error(bmp->db_ipbmap->i_sb, "-EIO\n");
+diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
+index 0d4b5b9843b62..a2fb866ff76e8 100644
+--- a/fs/ntfs/inode.c
++++ b/fs/ntfs/inode.c
+@@ -654,6 +654,12 @@ static int ntfs_read_locked_inode(struct inode *vi)
+ }
+ a = ctx->attr;
+ /* Get the standard information attribute value. */
++ if ((u8 *)a + le16_to_cpu(a->data.resident.value_offset)
++ + le32_to_cpu(a->data.resident.value_length) >
++ (u8 *)ctx->mrec + vol->mft_record_size) {
++ ntfs_error(vi->i_sb, "Corrupt standard information attribute in inode.");
++ goto unm_err_out;
++ }
+ si = (STANDARD_INFORMATION*)((u8*)a +
+ le16_to_cpu(a->data.resident.value_offset));
+
+diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
+index 9b2ed62dd6385..19b0d358a0d6e 100644
+--- a/fs/ocfs2/cluster/heartbeat.c
++++ b/fs/ocfs2/cluster/heartbeat.c
+@@ -2154,7 +2154,7 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
+ o2hb_nego_timeout_handler,
+ reg, NULL, ®->hr_handler_list);
+ if (ret)
+- goto free;
++ goto remove_item;
+
+ ret = o2net_register_handler(O2HB_NEGO_APPROVE_MSG, reg->hr_key,
+ sizeof(struct o2hb_nego_msg),
+@@ -2173,6 +2173,12 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
+
+ unregister_handler:
+ o2net_unregister_handler_list(®->hr_handler_list);
++remove_item:
++ spin_lock(&o2hb_live_lock);
++ list_del(®->hr_all_item);
++ if (o2hb_global_heartbeat_active())
++ clear_bit(reg->hr_region_num, o2hb_region_bitmap);
++ spin_unlock(&o2hb_live_lock);
+ free:
+ kfree(reg);
+ return ERR_PTR(ret);
+diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
+index 2197bf68f2786..904c2a60f5bab 100644
+--- a/fs/pstore/platform.c
++++ b/fs/pstore/platform.c
+@@ -250,7 +250,7 @@ static int pstore_compress(const void *in, void *out,
+ {
+ int ret;
+
+- if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION))
++ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESS))
+ return -EINVAL;
+
+ ret = crypto_comp_compress(tfm, in, inlen, out, &outlen);
+@@ -650,7 +650,7 @@ static void decompress_record(struct pstore_record *record)
+ int unzipped_len;
+ char *decompressed;
+
+- if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION) || !record->compressed)
++ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESS) || !record->compressed)
+ return;
+
+ /* Only PSTORE_TYPE_DMESG support compression. */
+diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
+index d99710270a373..addfaae8decfd 100644
+--- a/fs/quota/quota_v2.c
++++ b/fs/quota/quota_v2.c
+@@ -165,19 +165,24 @@ static int v2_read_file_info(struct super_block *sb, int type)
+ quota_error(sb, "Number of blocks too big for quota file size (%llu > %llu).",
+ (loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits,
+ i_size_read(sb_dqopt(sb)->files[type]));
+- goto out;
++ goto out_free;
+ }
+ if (qinfo->dqi_free_blk >= qinfo->dqi_blocks) {
+ quota_error(sb, "Free block number too big (%u >= %u).",
+ qinfo->dqi_free_blk, qinfo->dqi_blocks);
+- goto out;
++ goto out_free;
+ }
+ if (qinfo->dqi_free_entry >= qinfo->dqi_blocks) {
+ quota_error(sb, "Block with free entry too big (%u >= %u).",
+ qinfo->dqi_free_entry, qinfo->dqi_blocks);
+- goto out;
++ goto out_free;
+ }
+ ret = 0;
++out_free:
++ if (ret) {
++ kfree(info->dqi_priv);
++ info->dqi_priv = NULL;
++ }
+ out:
+ up_read(&dqopt->dqio_sem);
+ return ret;
+diff --git a/include/acpi/acexcep.h b/include/acpi/acexcep.h
+index 856c56ef01431..878b8e26c6c50 100644
+--- a/include/acpi/acexcep.h
++++ b/include/acpi/acexcep.h
+@@ -59,11 +59,11 @@ struct acpi_exception_info {
+
+ #define AE_OK (acpi_status) 0x0000
+
+-#define ACPI_ENV_EXCEPTION(status) (status & AE_CODE_ENVIRONMENTAL)
+-#define ACPI_AML_EXCEPTION(status) (status & AE_CODE_AML)
+-#define ACPI_PROG_EXCEPTION(status) (status & AE_CODE_PROGRAMMER)
+-#define ACPI_TABLE_EXCEPTION(status) (status & AE_CODE_ACPI_TABLES)
+-#define ACPI_CNTL_EXCEPTION(status) (status & AE_CODE_CONTROL)
++#define ACPI_ENV_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_ENVIRONMENTAL)
++#define ACPI_AML_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_AML)
++#define ACPI_PROG_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_PROGRAMMER)
++#define ACPI_TABLE_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_ACPI_TABLES)
++#define ACPI_CNTL_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_CONTROL)
+
+ /*
+ * Environmental exceptions
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index e71c97c3c25ef..2d632a74cc5e9 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -701,8 +701,13 @@
+ /* DWARF 4 */ \
+ .debug_types 0 : { *(.debug_types) } \
+ /* DWARF 5 */ \
++ .debug_addr 0 : { *(.debug_addr) } \
++ .debug_line_str 0 : { *(.debug_line_str) } \
++ .debug_loclists 0 : { *(.debug_loclists) } \
+ .debug_macro 0 : { *(.debug_macro) } \
+- .debug_addr 0 : { *(.debug_addr) }
++ .debug_names 0 : { *(.debug_names) } \
++ .debug_rnglists 0 : { *(.debug_rnglists) } \
++ .debug_str_offsets 0 : { *(.debug_str_offsets) }
+
+ /* Stabs debugging sections. */
+ #define STABS_DEBUG \
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 745b2d0dcf78c..209ba8e7bd317 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -637,6 +637,7 @@ struct request_queue {
+ struct delayed_work requeue_work;
+
+ struct mutex sysfs_lock;
++ struct mutex sysfs_dir_lock;
+
+ int bypass_depth;
+ atomic_t mq_freeze_depth;
+@@ -743,6 +744,7 @@ bool blk_queue_flag_test_and_clear(unsigned int flag, struct request_queue *q);
+ #define blk_queue_quiesced(q) test_bit(QUEUE_FLAG_QUIESCED, &(q)->queue_flags)
+ #define blk_queue_pm_only(q) atomic_read(&(q)->pm_only)
+ #define blk_queue_fua(q) test_bit(QUEUE_FLAG_FUA, &(q)->queue_flags)
++#define blk_queue_registered(q) test_bit(QUEUE_FLAG_REGISTERED, &(q)->queue_flags)
+
+ extern void blk_set_pm_only(struct request_queue *q);
+ extern void blk_clear_pm_only(struct request_queue *q);
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index ff60ba537cf2c..cde6708644aed 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -315,6 +315,11 @@ struct dm_target {
+ * on max_io_len boundary.
+ */
+ bool split_discard_bios:1;
++
++ /*
++ * Set if we need to limit the number of in-flight bios when swapping.
++ */
++ bool limit_swap_bios:1;
+ };
+
+ /* Each target can link one of these into the table */
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index d61dc72ebb960..117f9380069a8 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -746,7 +746,7 @@ void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp);
+ u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
+ #define __bpf_call_base_args \
+ ((u64 (*)(u64, u64, u64, u64, u64, const struct bpf_insn *)) \
+- __bpf_call_base)
++ (void *)__bpf_call_base)
+
+ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog);
+ void bpf_jit_compile(struct bpf_prog *prog);
+diff --git a/include/linux/icmpv6.h b/include/linux/icmpv6.h
+index a8f8889761378..0be0d68fbb009 100644
+--- a/include/linux/icmpv6.h
++++ b/include/linux/icmpv6.h
+@@ -3,6 +3,7 @@
+ #define _LINUX_ICMPV6_H
+
+ #include <linux/skbuff.h>
++#include <linux/ipv6.h>
+ #include <uapi/linux/icmpv6.h>
+
+ static inline struct icmp6hdr *icmp6_hdr(const struct sk_buff *skb)
+@@ -13,21 +14,64 @@ static inline struct icmp6hdr *icmp6_hdr(const struct sk_buff *skb)
+ #include <linux/netdevice.h>
+
+ #if IS_ENABLED(CONFIG_IPV6)
+-extern void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info);
+
+ typedef void ip6_icmp_send_t(struct sk_buff *skb, u8 type, u8 code, __u32 info,
+- const struct in6_addr *force_saddr);
++ const struct in6_addr *force_saddr,
++ const struct inet6_skb_parm *parm);
++void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
++ const struct in6_addr *force_saddr,
++ const struct inet6_skb_parm *parm);
++#if IS_BUILTIN(CONFIG_IPV6)
++static inline void __icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
++ const struct inet6_skb_parm *parm)
++{
++ icmp6_send(skb, type, code, info, NULL, parm);
++}
++static inline int inet6_register_icmp_sender(ip6_icmp_send_t *fn)
++{
++ BUILD_BUG_ON(fn != icmp6_send);
++ return 0;
++}
++static inline int inet6_unregister_icmp_sender(ip6_icmp_send_t *fn)
++{
++ BUILD_BUG_ON(fn != icmp6_send);
++ return 0;
++}
++#else
++extern void __icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
++ const struct inet6_skb_parm *parm);
+ extern int inet6_register_icmp_sender(ip6_icmp_send_t *fn);
+ extern int inet6_unregister_icmp_sender(ip6_icmp_send_t *fn);
++#endif
++
++static inline void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
++{
++ __icmpv6_send(skb, type, code, info, IP6CB(skb));
++}
++
+ int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type,
+ unsigned int data_len);
+
++#if IS_ENABLED(CONFIG_NF_NAT)
++void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info);
++#else
++static inline void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info)
++{
++ struct inet6_skb_parm parm = { 0 };
++ __icmpv6_send(skb_in, type, code, info, &parm);
++}
++#endif
++
+ #else
+
+ static inline void icmpv6_send(struct sk_buff *skb,
+ u8 type, u8 code, __u32 info)
+ {
++}
+
++static inline void icmpv6_ndo_send(struct sk_buff *skb,
++ u8 type, u8 code, __u32 info)
++{
+ }
+ #endif
+
+diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
+index 8415bf1a97762..0ebd180e7f91a 100644
+--- a/include/linux/ipv6.h
++++ b/include/linux/ipv6.h
+@@ -3,6 +3,7 @@
+ #define _IPV6_H
+
+ #include <uapi/linux/ipv6.h>
++#include <uapi/linux/icmpv6.h>
+
+ #define ipv6_optlen(p) (((p)->hdrlen+1) << 3)
+ #define ipv6_authlen(p) (((p)->hdrlen+2) << 2)
+@@ -83,7 +84,6 @@ struct ipv6_params {
+ __s32 autoconf;
+ };
+ extern struct ipv6_params ipv6_defaults;
+-#include <linux/icmpv6.h>
+ #include <linux/tcp.h>
+ #include <linux/udp.h>
+
+diff --git a/include/linux/kexec.h b/include/linux/kexec.h
+index 9e4e638fb5051..fe9f6f2dd811d 100644
+--- a/include/linux/kexec.h
++++ b/include/linux/kexec.h
+@@ -260,6 +260,11 @@ struct kimage {
+ /* Information for loading purgatory */
+ struct purgatory_info purgatory_info;
+ #endif
++
++#ifdef CONFIG_IMA_KEXEC
++ /* Virtual address of IMA measurement buffer for kexec syscall */
++ void *ima_buffer;
++#endif
+ };
+
+ /* kexec interface functions */
+diff --git a/include/linux/key.h b/include/linux/key.h
+index e58ee10f6e585..3683c6a6fca30 100644
+--- a/include/linux/key.h
++++ b/include/linux/key.h
+@@ -249,6 +249,7 @@ extern struct key *key_alloc(struct key_type *type,
+ #define KEY_ALLOC_BUILT_IN 0x0004 /* Key is built into kernel */
+ #define KEY_ALLOC_BYPASS_RESTRICTION 0x0008 /* Override the check on restricted keyrings */
+ #define KEY_ALLOC_UID_KEYRING 0x0010 /* allocating a user or user session keyring */
++#define KEY_ALLOC_SET_KEEP 0x0020 /* Set the KEEP flag on the key/keyring */
+
+ extern void key_revoke(struct key *key);
+ extern void key_invalidate(struct key *key);
+diff --git a/include/linux/rmap.h b/include/linux/rmap.h
+index 988d176472df7..d7d6d4eb17949 100644
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -214,7 +214,8 @@ struct page_vma_mapped_walk {
+
+ static inline void page_vma_mapped_walk_done(struct page_vma_mapped_walk *pvmw)
+ {
+- if (pvmw->pte)
++ /* HugeTLB pte is set to the relevant page table entry without pte_mapped. */
++ if (pvmw->pte && !PageHuge(pvmw->page))
+ pte_unmap(pvmw->pte);
+ if (pvmw->ptl)
+ spin_unlock(pvmw->ptl);
+diff --git a/include/net/icmp.h b/include/net/icmp.h
+index 8665bf24e3b7a..ffe4a5d2bbe7e 100644
+--- a/include/net/icmp.h
++++ b/include/net/icmp.h
+@@ -47,6 +47,16 @@ static inline void icmp_send(struct sk_buff *skb_in, int type, int code, __be32
+ __icmp_send(skb_in, type, code, info, &IPCB(skb_in)->opt);
+ }
+
++#if IS_ENABLED(CONFIG_NF_NAT)
++void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info);
++#else
++static inline void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info)
++{
++ struct ip_options opts = { 0 };
++ __icmp_send(skb_in, type, code, info, &opts);
++}
++#endif
++
+ int icmp_rcv(struct sk_buff *skb);
+ void icmp_err(struct sk_buff *skb, u32 info);
+ int icmp_init(void);
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index afbe1d3991f21..4fe3ab47b4803 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1380,8 +1380,13 @@ static inline int tcp_full_space(const struct sock *sk)
+ */
+ static inline bool tcp_rmem_pressure(const struct sock *sk)
+ {
+- int rcvbuf = READ_ONCE(sk->sk_rcvbuf);
+- int threshold = rcvbuf - (rcvbuf >> 3);
++ int rcvbuf, threshold;
++
++ if (tcp_under_memory_pressure(sk))
++ return true;
++
++ rcvbuf = READ_ONCE(sk->sk_rcvbuf);
++ threshold = rcvbuf - (rcvbuf >> 3);
+
+ return atomic_read(&sk->sk_rmem_alloc) > threshold;
+ }
+diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c
+index e6ef4401a1380..9b5eeff72fd37 100644
+--- a/kernel/bpf/bpf_lru_list.c
++++ b/kernel/bpf/bpf_lru_list.c
+@@ -505,13 +505,14 @@ struct bpf_lru_node *bpf_lru_pop_free(struct bpf_lru *lru, u32 hash)
+ static void bpf_common_lru_push_free(struct bpf_lru *lru,
+ struct bpf_lru_node *node)
+ {
++ u8 node_type = READ_ONCE(node->type);
+ unsigned long flags;
+
+- if (WARN_ON_ONCE(node->type == BPF_LRU_LIST_T_FREE) ||
+- WARN_ON_ONCE(node->type == BPF_LRU_LOCAL_LIST_T_FREE))
++ if (WARN_ON_ONCE(node_type == BPF_LRU_LIST_T_FREE) ||
++ WARN_ON_ONCE(node_type == BPF_LRU_LOCAL_LIST_T_FREE))
+ return;
+
+- if (node->type == BPF_LRU_LOCAL_LIST_T_PENDING) {
++ if (node_type == BPF_LRU_LOCAL_LIST_T_PENDING) {
+ struct bpf_lru_locallist *loc_l;
+
+ loc_l = per_cpu_ptr(lru->common_lru.local_list, node->cpu);
+diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
+index 2118d8258b7c9..ad53b19734e9b 100644
+--- a/kernel/debug/kdb/kdb_private.h
++++ b/kernel/debug/kdb/kdb_private.h
+@@ -233,7 +233,7 @@ extern struct task_struct *kdb_curr_task(int);
+ #define kdb_do_each_thread(g, p) do_each_thread(g, p)
+ #define kdb_while_each_thread(g, p) while_each_thread(g, p)
+
+-#define GFP_KDB (in_interrupt() ? GFP_ATOMIC : GFP_KERNEL)
++#define GFP_KDB (in_dbg_master() ? GFP_ATOMIC : GFP_KERNEL)
+
+ extern void *debug_kmalloc(size_t size, gfp_t flags);
+ extern void debug_kfree(void *);
+diff --git a/kernel/jump_label.c b/kernel/jump_label.c
+index 7c8262635b292..01c6737218949 100644
+--- a/kernel/jump_label.c
++++ b/kernel/jump_label.c
+@@ -83,6 +83,7 @@ void static_key_slow_inc_cpuslocked(struct static_key *key)
+ int v, v1;
+
+ STATIC_KEY_CHECK_USE(key);
++ lockdep_assert_cpus_held();
+
+ /*
+ * Careful if we get concurrent static_key_slow_inc() calls;
+@@ -128,6 +129,7 @@ EXPORT_SYMBOL_GPL(static_key_slow_inc);
+ void static_key_enable_cpuslocked(struct static_key *key)
+ {
+ STATIC_KEY_CHECK_USE(key);
++ lockdep_assert_cpus_held();
+
+ if (atomic_read(&key->enabled) > 0) {
+ WARN_ON_ONCE(atomic_read(&key->enabled) != 1);
+@@ -158,6 +160,7 @@ EXPORT_SYMBOL_GPL(static_key_enable);
+ void static_key_disable_cpuslocked(struct static_key *key)
+ {
+ STATIC_KEY_CHECK_USE(key);
++ lockdep_assert_cpus_held();
+
+ if (atomic_read(&key->enabled) != 1) {
+ WARN_ON_ONCE(atomic_read(&key->enabled) != 0);
+@@ -183,6 +186,10 @@ static void __static_key_slow_dec_cpuslocked(struct static_key *key,
+ unsigned long rate_limit,
+ struct delayed_work *work)
+ {
++ int val;
++
++ lockdep_assert_cpus_held();
++
+ /*
+ * The negative count check is valid even when a negative
+ * key->enabled is in use by static_key_slow_inc(); a
+@@ -190,17 +197,20 @@ static void __static_key_slow_dec_cpuslocked(struct static_key *key,
+ * returns is unbalanced, because all other static_key_slow_inc()
+ * instances block while the update is in progress.
+ */
+- if (!atomic_dec_and_mutex_lock(&key->enabled, &jump_label_mutex)) {
+- WARN(atomic_read(&key->enabled) < 0,
+- "jump label: negative count!\n");
++ val = atomic_fetch_add_unless(&key->enabled, -1, 1);
++ if (val != 1) {
++ WARN(val < 0, "jump label: negative count!\n");
+ return;
+ }
+
+- if (rate_limit) {
+- atomic_inc(&key->enabled);
+- schedule_delayed_work(work, rate_limit);
+- } else {
+- jump_label_update(key);
++ jump_label_lock();
++ if (atomic_dec_and_test(&key->enabled)) {
++ if (rate_limit) {
++ atomic_inc(&key->enabled);
++ schedule_delayed_work(work, rate_limit);
++ } else {
++ jump_label_update(key);
++ }
+ }
+ jump_label_unlock();
+ }
+diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
+index c6a3b6851372c..2fbdb78d66c80 100644
+--- a/kernel/kexec_file.c
++++ b/kernel/kexec_file.c
+@@ -168,6 +168,11 @@ void kimage_file_post_load_cleanup(struct kimage *image)
+ vfree(pi->sechdrs);
+ pi->sechdrs = NULL;
+
++#ifdef CONFIG_IMA_KEXEC
++ vfree(image->ima_buffer);
++ image->ima_buffer = NULL;
++#endif /* CONFIG_IMA_KEXEC */
++
+ /* See if architecture has anything to cleanup post load */
+ arch_kimage_file_post_load_cleanup(image);
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 429769605871d..d5d01ece720c4 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2274,6 +2274,21 @@ static int verify_export_symbols(struct module *mod)
+ return 0;
+ }
+
++static bool ignore_undef_symbol(Elf_Half emachine, const char *name)
++{
++ /*
++ * On x86, PIC code and Clang non-PIC code may have call foo@PLT. GNU as
++ * before 2.37 produces an unreferenced _GLOBAL_OFFSET_TABLE_ on x86-64.
++ * i386 has a similar problem but may not deserve a fix.
++ *
++ * If we ever have to ignore many symbols, consider refactoring the code to
++ * only warn if referenced by a relocation.
++ */
++ if (emachine == EM_386 || emachine == EM_X86_64)
++ return !strcmp(name, "_GLOBAL_OFFSET_TABLE_");
++ return false;
++}
++
+ /* Change all symbols so that st_value encodes the pointer directly. */
+ static int simplify_symbols(struct module *mod, const struct load_info *info)
+ {
+@@ -2319,8 +2334,10 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
+ break;
+ }
+
+- /* Ok if weak. */
+- if (!ksym && ELF_ST_BIND(sym[i].st_info) == STB_WEAK)
++ /* Ok if weak or ignored. */
++ if (!ksym &&
++ (ELF_ST_BIND(sym[i].st_info) == STB_WEAK ||
++ ignore_undef_symbol(info->hdr->e_machine, name)))
+ break;
+
+ ret = PTR_ERR(ksym) ?: -ENOENT;
+diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c
+index 82003d0d2e9f7..0dbc060331136 100644
+--- a/kernel/printk/printk_safe.c
++++ b/kernel/printk/printk_safe.c
+@@ -55,6 +55,8 @@ struct printk_safe_seq_buf {
+ static DEFINE_PER_CPU(struct printk_safe_seq_buf, safe_print_seq);
+ static DEFINE_PER_CPU(int, printk_context);
+
++static DEFINE_RAW_SPINLOCK(safe_read_lock);
++
+ #ifdef CONFIG_PRINTK_NMI
+ static DEFINE_PER_CPU(struct printk_safe_seq_buf, nmi_print_seq);
+ #endif
+@@ -190,8 +192,6 @@ static void report_message_lost(struct printk_safe_seq_buf *s)
+ */
+ static void __printk_safe_flush(struct irq_work *work)
+ {
+- static raw_spinlock_t read_lock =
+- __RAW_SPIN_LOCK_INITIALIZER(read_lock);
+ struct printk_safe_seq_buf *s =
+ container_of(work, struct printk_safe_seq_buf, work);
+ unsigned long flags;
+@@ -205,7 +205,7 @@ static void __printk_safe_flush(struct irq_work *work)
+ * different CPUs. This is especially important when printing
+ * a backtrace.
+ */
+- raw_spin_lock_irqsave(&read_lock, flags);
++ raw_spin_lock_irqsave(&safe_read_lock, flags);
+
+ i = 0;
+ more:
+@@ -242,7 +242,7 @@ more:
+
+ out:
+ report_message_lost(s);
+- raw_spin_unlock_irqrestore(&read_lock, flags);
++ raw_spin_unlock_irqrestore(&safe_read_lock, flags);
+ }
+
+ /**
+@@ -288,6 +288,14 @@ void printk_safe_flush_on_panic(void)
+ raw_spin_lock_init(&logbuf_lock);
+ }
+
++ if (raw_spin_is_locked(&safe_read_lock)) {
++ if (num_online_cpus() > 1)
++ return;
++
++ debug_locks_off();
++ raw_spin_lock_init(&safe_read_lock);
++ }
++
+ printk_safe_flush();
+ }
+
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index b9bd5a6b51386..a9dd2325bdda6 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -771,6 +771,8 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
+ const bool recheck_after_trace)
+ {
+ BUG();
++
++ return -1;
+ }
+ #endif
+
+diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
+index a3be42304485f..d5ce692319128 100644
+--- a/kernel/tracepoint.c
++++ b/kernel/tracepoint.c
+@@ -66,6 +66,12 @@ struct tp_probes {
+ struct tracepoint_func probes[0];
+ };
+
++/* Called in removal of a func but failed to allocate a new tp_funcs */
++static void tp_stub_func(void)
++{
++ return;
++}
++
+ static inline void *allocate_probes(int count)
+ {
+ struct tp_probes *p = kmalloc(count * sizeof(struct tracepoint_func)
+@@ -144,6 +150,7 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func,
+ {
+ struct tracepoint_func *old, *new;
+ int nr_probes = 0;
++ int stub_funcs = 0;
+ int pos = -1;
+
+ if (WARN_ON(!tp_func->func))
+@@ -160,14 +167,34 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func,
+ if (old[nr_probes].func == tp_func->func &&
+ old[nr_probes].data == tp_func->data)
+ return ERR_PTR(-EEXIST);
++ if (old[nr_probes].func == tp_stub_func)
++ stub_funcs++;
+ }
+ }
+- /* + 2 : one for new probe, one for NULL func */
+- new = allocate_probes(nr_probes + 2);
++ /* + 2 : one for new probe, one for NULL func - stub functions */
++ new = allocate_probes(nr_probes + 2 - stub_funcs);
+ if (new == NULL)
+ return ERR_PTR(-ENOMEM);
+ if (old) {
+- if (pos < 0) {
++ if (stub_funcs) {
++ /* Need to copy one at a time to remove stubs */
++ int probes = 0;
++
++ pos = -1;
++ for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
++ if (old[nr_probes].func == tp_stub_func)
++ continue;
++ if (pos < 0 && old[nr_probes].prio < prio)
++ pos = probes++;
++ new[probes++] = old[nr_probes];
++ }
++ nr_probes = probes;
++ if (pos < 0)
++ pos = probes;
++ else
++ nr_probes--; /* Account for insertion */
++
++ } else if (pos < 0) {
+ pos = nr_probes;
+ memcpy(new, old, nr_probes * sizeof(struct tracepoint_func));
+ } else {
+@@ -201,8 +228,9 @@ static void *func_remove(struct tracepoint_func **funcs,
+ /* (N -> M), (N > 1, M >= 0) probes */
+ if (tp_func->func) {
+ for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
+- if (old[nr_probes].func == tp_func->func &&
+- old[nr_probes].data == tp_func->data)
++ if ((old[nr_probes].func == tp_func->func &&
++ old[nr_probes].data == tp_func->data) ||
++ old[nr_probes].func == tp_stub_func)
+ nr_del++;
+ }
+ }
+@@ -221,14 +249,32 @@ static void *func_remove(struct tracepoint_func **funcs,
+ /* N -> M, (N > 1, M > 0) */
+ /* + 1 for NULL */
+ new = allocate_probes(nr_probes - nr_del + 1);
+- if (new == NULL)
+- return ERR_PTR(-ENOMEM);
+- for (i = 0; old[i].func; i++)
+- if (old[i].func != tp_func->func
+- || old[i].data != tp_func->data)
+- new[j++] = old[i];
+- new[nr_probes - nr_del].func = NULL;
+- *funcs = new;
++ if (new) {
++ for (i = 0; old[i].func; i++)
++ if ((old[i].func != tp_func->func
++ || old[i].data != tp_func->data)
++ && old[i].func != tp_stub_func)
++ new[j++] = old[i];
++ new[nr_probes - nr_del].func = NULL;
++ *funcs = new;
++ } else {
++ /*
++ * Failed to allocate, replace the old function
++ * with calls to tp_stub_func.
++ */
++ for (i = 0; old[i].func; i++)
++ if (old[i].func == tp_func->func &&
++ old[i].data == tp_func->data) {
++ old[i].func = tp_stub_func;
++ /* Set the prio to the next event. */
++ if (old[i + 1].func)
++ old[i].prio =
++ old[i + 1].prio;
++ else
++ old[i].prio = -1;
++ }
++ *funcs = old;
++ }
+ }
+ debug_print_probes(*funcs);
+ return old;
+@@ -284,10 +330,12 @@ static int tracepoint_remove_func(struct tracepoint *tp,
+ tp_funcs = rcu_dereference_protected(tp->funcs,
+ lockdep_is_held(&tracepoints_mutex));
+ old = func_remove(&tp_funcs, func);
+- if (IS_ERR(old)) {
+- WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM);
++ if (WARN_ON_ONCE(IS_ERR(old)))
+ return PTR_ERR(old);
+- }
++
++ if (tp_funcs == old)
++ /* Failed allocating new tp_funcs, replaced func with stub */
++ return 0;
+
+ if (!tp_funcs) {
+ /* Removed last function */
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index df89aed023029..9eb5c25fabc9e 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2648,8 +2648,10 @@ static int hugetlb_sysfs_add_hstate(struct hstate *h, struct kobject *parent,
+ return -ENOMEM;
+
+ retval = sysfs_create_group(hstate_kobjs[hi], hstate_attr_group);
+- if (retval)
++ if (retval) {
+ kobject_put(hstate_kobjs[hi]);
++ hstate_kobjs[hi] = NULL;
++ }
+
+ return retval;
+ }
+diff --git a/mm/memory.c b/mm/memory.c
+index eeae63bd95027..c1a05c2484b09 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1995,11 +1995,11 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
+ unsigned long addr, unsigned long end,
+ unsigned long pfn, pgprot_t prot)
+ {
+- pte_t *pte;
++ pte_t *pte, *mapped_pte;
+ spinlock_t *ptl;
+ int err = 0;
+
+- pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
++ mapped_pte = pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
+ if (!pte)
+ return -ENOMEM;
+ arch_enter_lazy_mmu_mode();
+@@ -2013,7 +2013,7 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
+ pfn++;
+ } while (pte++, addr += PAGE_SIZE, addr != end);
+ arch_leave_lazy_mmu_mode();
+- pte_unmap_unlock(pte - 1, ptl);
++ pte_unmap_unlock(mapped_pte, ptl);
+ return err;
+ }
+
+@@ -4885,17 +4885,19 @@ long copy_huge_page_from_user(struct page *dst_page,
+ void *page_kaddr;
+ unsigned long i, rc = 0;
+ unsigned long ret_val = pages_per_huge_page * PAGE_SIZE;
++ struct page *subpage = dst_page;
+
+- for (i = 0; i < pages_per_huge_page; i++) {
++ for (i = 0; i < pages_per_huge_page;
++ i++, subpage = mem_map_next(subpage, dst_page, i)) {
+ if (allow_pagefault)
+- page_kaddr = kmap(dst_page + i);
++ page_kaddr = kmap(subpage);
+ else
+- page_kaddr = kmap_atomic(dst_page + i);
++ page_kaddr = kmap_atomic(subpage);
+ rc = copy_from_user(page_kaddr,
+ (const void __user *)(src + i * PAGE_SIZE),
+ PAGE_SIZE);
+ if (allow_pagefault)
+- kunmap(dst_page + i);
++ kunmap(subpage);
+ else
+ kunmap_atomic(page_kaddr);
+
+diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
+index be9640e9ca006..e09ea78356c36 100644
+--- a/net/bluetooth/a2mp.c
++++ b/net/bluetooth/a2mp.c
+@@ -388,9 +388,9 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
+ hdev = hci_dev_get(req->id);
+ if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) {
+ struct a2mp_amp_assoc_rsp rsp;
+- rsp.id = req->id;
+
+ memset(&rsp, 0, sizeof(rsp));
++ rsp.id = req->id;
+
+ if (tmp) {
+ rsp.status = A2MP_STATUS_COLLISION_OCCURED;
+@@ -519,6 +519,7 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
+ assoc = kmemdup(req->amp_assoc, assoc_len, GFP_KERNEL);
+ if (!assoc) {
+ amp_ctrl_put(ctrl);
++ hci_dev_put(hdev);
+ return -ENOMEM;
+ }
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index e03faca84919e..04d6f50798c98 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1316,8 +1316,10 @@ int hci_inquiry(void __user *arg)
+ * cleared). If it is interrupted by a signal, return -EINTR.
+ */
+ if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
+- TASK_INTERRUPTIBLE))
+- return -EINTR;
++ TASK_INTERRUPTIBLE)) {
++ err = -EINTR;
++ goto done;
++ }
+ }
+
+ /* for unlimited number of responses we will use buffer with
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 557bd5cc8f94c..bbf5dbb95644d 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4500,6 +4500,7 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
+ {
+ struct net *net = dev_net(skb->dev);
+ int rc = -EAFNOSUPPORT;
++ bool check_mtu = false;
+
+ if (plen < sizeof(*params))
+ return -EINVAL;
+@@ -4507,22 +4508,28 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
+ if (flags & ~(BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_OUTPUT))
+ return -EINVAL;
+
++ if (params->tot_len)
++ check_mtu = true;
++
+ switch (params->family) {
+ #if IS_ENABLED(CONFIG_INET)
+ case AF_INET:
+- rc = bpf_ipv4_fib_lookup(net, params, flags, false);
++ rc = bpf_ipv4_fib_lookup(net, params, flags, check_mtu);
+ break;
+ #endif
+ #if IS_ENABLED(CONFIG_IPV6)
+ case AF_INET6:
+- rc = bpf_ipv6_fib_lookup(net, params, flags, false);
++ rc = bpf_ipv6_fib_lookup(net, params, flags, check_mtu);
+ break;
+ #endif
+ }
+
+- if (!rc) {
++ if (rc == BPF_FIB_LKUP_RET_SUCCESS && !check_mtu) {
+ struct net_device *dev;
+
++ /* When tot_len isn't provided by user, check skb
++ * against MTU of FIB lookup resulting net_device
++ */
+ dev = dev_get_by_index_rcu(net, params->ifindex);
+ if (!is_skb_forwardable(dev, skb))
+ rc = BPF_FIB_LKUP_RET_FRAG_NEEDED;
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index 59c0b1a86e51b..b048125ea0994 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -755,6 +755,40 @@ out:;
+ }
+ EXPORT_SYMBOL(__icmp_send);
+
++#if IS_ENABLED(CONFIG_NF_NAT)
++#include <net/netfilter/nf_conntrack.h>
++void icmp_ndo_send(struct sk_buff *skb_in, int type, int code, __be32 info)
++{
++ struct sk_buff *cloned_skb = NULL;
++ struct ip_options opts = { 0 };
++ enum ip_conntrack_info ctinfo;
++ struct nf_conn *ct;
++ __be32 orig_ip;
++
++ ct = nf_ct_get(skb_in, &ctinfo);
++ if (!ct || !(ct->status & IPS_SRC_NAT)) {
++ __icmp_send(skb_in, type, code, info, &opts);
++ return;
++ }
++
++ if (skb_shared(skb_in))
++ skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);
++
++ if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||
++ (skb_network_header(skb_in) + sizeof(struct iphdr)) >
++ skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,
++ skb_network_offset(skb_in) + sizeof(struct iphdr))))
++ goto out;
++
++ orig_ip = ip_hdr(skb_in)->saddr;
++ ip_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.ip;
++ __icmp_send(skb_in, type, code, info, &opts);
++ ip_hdr(skb_in)->saddr = orig_ip;
++out:
++ consume_skb(cloned_skb);
++}
++EXPORT_SYMBOL(icmp_ndo_send);
++#endif
+
+ static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
+ {
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index 6d14cbe443f82..fbc8746371b6d 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -309,10 +309,9 @@ static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, st
+ }
+
+ #if IS_ENABLED(CONFIG_IPV6_MIP6)
+-static void mip6_addr_swap(struct sk_buff *skb)
++static void mip6_addr_swap(struct sk_buff *skb, const struct inet6_skb_parm *opt)
+ {
+ struct ipv6hdr *iph = ipv6_hdr(skb);
+- struct inet6_skb_parm *opt = IP6CB(skb);
+ struct ipv6_destopt_hao *hao;
+ struct in6_addr tmp;
+ int off;
+@@ -329,7 +328,7 @@ static void mip6_addr_swap(struct sk_buff *skb)
+ }
+ }
+ #else
+-static inline void mip6_addr_swap(struct sk_buff *skb) {}
++static inline void mip6_addr_swap(struct sk_buff *skb, const struct inet6_skb_parm *opt) {}
+ #endif
+
+ static struct dst_entry *icmpv6_route_lookup(struct net *net,
+@@ -418,8 +417,9 @@ static int icmp6_iif(const struct sk_buff *skb)
+ /*
+ * Send an ICMP message in response to a packet in error
+ */
+-static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
+- const struct in6_addr *force_saddr)
++void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
++ const struct in6_addr *force_saddr,
++ const struct inet6_skb_parm *parm)
+ {
+ struct inet6_dev *idev = NULL;
+ struct ipv6hdr *hdr = ipv6_hdr(skb);
+@@ -512,7 +512,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
+ if (!(skb->dev->flags&IFF_LOOPBACK) && !icmpv6_global_allow(type))
+ goto out_bh_enable;
+
+- mip6_addr_swap(skb);
++ mip6_addr_swap(skb, parm);
+
+ memset(&fl6, 0, sizeof(fl6));
+ fl6.flowi6_proto = IPPROTO_ICMPV6;
+@@ -592,12 +592,13 @@ out:
+ out_bh_enable:
+ local_bh_enable();
+ }
++EXPORT_SYMBOL(icmp6_send);
+
+ /* Slightly more convenient version of icmp6_send.
+ */
+ void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
+ {
+- icmp6_send(skb, ICMPV6_PARAMPROB, code, pos, NULL);
++ icmp6_send(skb, ICMPV6_PARAMPROB, code, pos, NULL, IP6CB(skb));
+ kfree_skb(skb);
+ }
+
+@@ -654,10 +655,10 @@ int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type,
+ }
+ if (type == ICMP_TIME_EXCEEDED)
+ icmp6_send(skb2, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
+- info, &temp_saddr);
++ info, &temp_saddr, IP6CB(skb2));
+ else
+ icmp6_send(skb2, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH,
+- info, &temp_saddr);
++ info, &temp_saddr, IP6CB(skb2));
+ if (rt)
+ ip6_rt_put(rt);
+
+diff --git a/net/ipv6/ip6_icmp.c b/net/ipv6/ip6_icmp.c
+index 02045494c24cc..9e3574880cb03 100644
+--- a/net/ipv6/ip6_icmp.c
++++ b/net/ipv6/ip6_icmp.c
+@@ -9,6 +9,8 @@
+
+ #if IS_ENABLED(CONFIG_IPV6)
+
++#if !IS_BUILTIN(CONFIG_IPV6)
++
+ static ip6_icmp_send_t __rcu *ip6_icmp_send;
+
+ int inet6_register_icmp_sender(ip6_icmp_send_t *fn)
+@@ -31,18 +33,52 @@ int inet6_unregister_icmp_sender(ip6_icmp_send_t *fn)
+ }
+ EXPORT_SYMBOL(inet6_unregister_icmp_sender);
+
+-void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
++void __icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
++ const struct inet6_skb_parm *parm)
+ {
+ ip6_icmp_send_t *send;
+
+ rcu_read_lock();
+ send = rcu_dereference(ip6_icmp_send);
++ if (send)
++ send(skb, type, code, info, NULL, parm);
++ rcu_read_unlock();
++}
++EXPORT_SYMBOL(__icmpv6_send);
++#endif
++
++#if IS_ENABLED(CONFIG_NF_NAT)
++#include <net/netfilter/nf_conntrack.h>
++void icmpv6_ndo_send(struct sk_buff *skb_in, u8 type, u8 code, __u32 info)
++{
++ struct inet6_skb_parm parm = { 0 };
++ struct sk_buff *cloned_skb = NULL;
++ enum ip_conntrack_info ctinfo;
++ struct in6_addr orig_ip;
++ struct nf_conn *ct;
+
+- if (!send)
++ ct = nf_ct_get(skb_in, &ctinfo);
++ if (!ct || !(ct->status & IPS_SRC_NAT)) {
++ __icmpv6_send(skb_in, type, code, info, &parm);
++ return;
++ }
++
++ if (skb_shared(skb_in))
++ skb_in = cloned_skb = skb_clone(skb_in, GFP_ATOMIC);
++
++ if (unlikely(!skb_in || skb_network_header(skb_in) < skb_in->head ||
++ (skb_network_header(skb_in) + sizeof(struct ipv6hdr)) >
++ skb_tail_pointer(skb_in) || skb_ensure_writable(skb_in,
++ skb_network_offset(skb_in) + sizeof(struct ipv6hdr))))
+ goto out;
+- send(skb, type, code, info, NULL);
++
++ orig_ip = ipv6_hdr(skb_in)->saddr;
++ ipv6_hdr(skb_in)->saddr = ct->tuplehash[0].tuple.src.u3.in6;
++ __icmpv6_send(skb_in, type, code, info, &parm);
++ ipv6_hdr(skb_in)->saddr = orig_ip;
+ out:
+- rcu_read_unlock();
++ consume_skb(cloned_skb);
+ }
+-EXPORT_SYMBOL(icmpv6_send);
++EXPORT_SYMBOL(icmpv6_ndo_send);
++#endif
+ #endif
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index 6219b6b0c7e17..18158855d98c4 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -355,7 +355,7 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
+ */
+ tx_time = (device_constant + 10 * test_frame_len / rate);
+ estimated_retx = ((1 << (2 * ARITH_SHIFT)) / (s_unit - err));
+- result = (tx_time * estimated_retx) >> (2 * ARITH_SHIFT);
++ result = ((u64)tx_time * estimated_retx) >> (2 * ARITH_SHIFT);
+ return (u32)result;
+ }
+
+diff --git a/net/qrtr/tun.c b/net/qrtr/tun.c
+index 997af345ce374..cb425e216d461 100644
+--- a/net/qrtr/tun.c
++++ b/net/qrtr/tun.c
+@@ -31,6 +31,7 @@ static int qrtr_tun_send(struct qrtr_endpoint *ep, struct sk_buff *skb)
+ static int qrtr_tun_open(struct inode *inode, struct file *filp)
+ {
+ struct qrtr_tun *tun;
++ int ret;
+
+ tun = kzalloc(sizeof(*tun), GFP_KERNEL);
+ if (!tun)
+@@ -43,7 +44,16 @@ static int qrtr_tun_open(struct inode *inode, struct file *filp)
+
+ filp->private_data = tun;
+
+- return qrtr_endpoint_register(&tun->ep, QRTR_EP_NID_AUTO);
++ ret = qrtr_endpoint_register(&tun->ep, QRTR_EP_NID_AUTO);
++ if (ret)
++ goto out;
++
++ return 0;
++
++out:
++ filp->private_data = NULL;
++ kfree(tun);
++ return ret;
+ }
+
+ static ssize_t qrtr_tun_read_iter(struct kiocb *iocb, struct iov_iter *to)
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 6cc9f6e2dd2b7..eae8b90864978 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -300,10 +300,10 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ if (mtu < IPV6_MIN_MTU)
+ mtu = IPV6_MIN_MTU;
+
+- icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
++ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+ } else {
+- icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+- htonl(mtu));
++ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
++ htonl(mtu));
+ }
+
+ dst_release(dst);
+diff --git a/scripts/Makefile b/scripts/Makefile
+index 61affa300d25d..3ce4981bb2b66 100644
+--- a/scripts/Makefile
++++ b/scripts/Makefile
+@@ -10,6 +10,9 @@
+
+ HOST_EXTRACFLAGS += -I$(srctree)/tools/include
+
++CRYPTO_LIBS = $(shell pkg-config --libs libcrypto 2> /dev/null || echo -lcrypto)
++CRYPTO_CFLAGS = $(shell pkg-config --cflags libcrypto 2> /dev/null)
++
+ hostprogs-$(CONFIG_BUILD_BIN2C) += bin2c
+ hostprogs-$(CONFIG_KALLSYMS) += kallsyms
+ hostprogs-$(CONFIG_LOGO) += pnmtologo
+@@ -23,8 +26,10 @@ hostprogs-$(CONFIG_SYSTEM_EXTRA_CERTIFICATE) += insert-sys-cert
+
+ HOSTCFLAGS_sortextable.o = -I$(srctree)/tools/include
+ HOSTCFLAGS_asn1_compiler.o = -I$(srctree)/include
+-HOSTLDLIBS_sign-file = -lcrypto
+-HOSTLDLIBS_extract-cert = -lcrypto
++HOSTCFLAGS_sign-file.o = $(CRYPTO_CFLAGS)
++HOSTLDLIBS_sign-file = $(CRYPTO_LIBS)
++HOSTCFLAGS_extract-cert.o = $(CRYPTO_CFLAGS)
++HOSTLDLIBS_extract-cert = $(CRYPTO_LIBS)
+
+ always := $(hostprogs-y) $(hostprogs-m)
+
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index f599031260d51..7f6f96256b09f 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -263,7 +263,11 @@ if ($arch eq "x86_64") {
+
+ # force flags for this arch
+ $ld .= " -m shlelf_linux";
+- $objcopy .= " -O elf32-sh-linux";
++ if ($endian eq "big") {
++ $objcopy .= " -O elf32-shbig-linux";
++ } else {
++ $objcopy .= " -O elf32-sh-linux";
++ }
+
+ } elsif ($arch eq "powerpc") {
+ my $ldemulation;
+diff --git a/security/commoncap.c b/security/commoncap.c
+index a1dee0ab345a2..1bc40e78fa7ff 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -506,7 +506,8 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
+ __u32 magic, nsmagic;
+ struct inode *inode = d_backing_inode(dentry);
+ struct user_namespace *task_ns = current_user_ns(),
+- *fs_ns = inode->i_sb->s_user_ns;
++ *fs_ns = inode->i_sb->s_user_ns,
++ *ancestor;
+ kuid_t rootid;
+ size_t newsize;
+
+@@ -529,6 +530,15 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
+ if (nsrootid == -1)
+ return -EINVAL;
+
++ /*
++ * Do not allow allow adding a v3 filesystem capability xattr
++ * if the rootid field is ambiguous.
++ */
++ for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) {
++ if (from_kuid(ancestor, rootid) == 0)
++ return -EINVAL;
++ }
++
+ newsize = sizeof(struct vfs_ns_cap_data);
+ nscap = kmalloc(newsize, GFP_ATOMIC);
+ if (!nscap)
+diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
+index 16bd18747cfa0..6a10d4d8b6e1d 100644
+--- a/security/integrity/ima/ima_kexec.c
++++ b/security/integrity/ima/ima_kexec.c
+@@ -124,6 +124,7 @@ void ima_add_kexec_buffer(struct kimage *image)
+ ret = kexec_add_buffer(&kbuf);
+ if (ret) {
+ pr_err("Error passing over kexec measurement buffer.\n");
++ vfree(kexec_buffer);
+ return;
+ }
+
+@@ -133,6 +134,8 @@ void ima_add_kexec_buffer(struct kimage *image)
+ return;
+ }
+
++ image->ima_buffer = kexec_buffer;
++
+ pr_debug("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
+ kbuf.mem);
+ }
+diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c
+index 073ddc9bce5ba..3e7a1523663b8 100644
+--- a/security/integrity/ima/ima_mok.c
++++ b/security/integrity/ima/ima_mok.c
+@@ -43,13 +43,12 @@ __init int ima_mok_init(void)
+ (KEY_POS_ALL & ~KEY_POS_SETATTR) |
+ KEY_USR_VIEW | KEY_USR_READ |
+ KEY_USR_WRITE | KEY_USR_SEARCH,
+- KEY_ALLOC_NOT_IN_QUOTA,
++ KEY_ALLOC_NOT_IN_QUOTA |
++ KEY_ALLOC_SET_KEEP,
+ restriction, NULL);
+
+ if (IS_ERR(ima_blacklist_keyring))
+ panic("Can't allocate IMA blacklist keyring.");
+-
+- set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags);
+ return 0;
+ }
+ device_initcall(ima_mok_init);
+diff --git a/security/keys/key.c b/security/keys/key.c
+index d5fa8c4fc5544..d3ebc0533e3ad 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -305,6 +305,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
+ key->flags |= 1 << KEY_FLAG_BUILTIN;
+ if (flags & KEY_ALLOC_UID_KEYRING)
+ key->flags |= 1 << KEY_FLAG_UID_KEYRING;
++ if (flags & KEY_ALLOC_SET_KEEP)
++ key->flags |= 1 << KEY_FLAG_KEEP;
+
+ #ifdef KEY_DEBUGGING
+ key->magic = KEY_DEBUG_MAGIC;
+diff --git a/security/keys/trusted.c b/security/keys/trusted.c
+index 09545c42977e8..9179a5bbf998b 100644
+--- a/security/keys/trusted.c
++++ b/security/keys/trusted.c
+@@ -796,7 +796,7 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
+ case Opt_migratable:
+ if (*args[0].from == '0')
+ pay->migratable = 0;
+- else
++ else if (*args[0].from != '1')
+ return -EINVAL;
+ break;
+ case Opt_pcrlock:
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9f0b05bcbd867..70571092db8d4 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1880,6 +1880,7 @@ enum {
+ ALC889_FIXUP_FRONT_HP_NO_PRESENCE,
+ ALC889_FIXUP_VAIO_TT,
+ ALC888_FIXUP_EEE1601,
++ ALC886_FIXUP_EAPD,
+ ALC882_FIXUP_EAPD,
+ ALC883_FIXUP_EAPD,
+ ALC883_FIXUP_ACER_EAPD,
+@@ -2213,6 +2214,15 @@ static const struct hda_fixup alc882_fixups[] = {
+ { }
+ }
+ },
++ [ALC886_FIXUP_EAPD] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* change to EAPD mode */
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x07 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0068 },
++ { }
++ }
++ },
+ [ALC882_FIXUP_EAPD] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -2485,6 +2495,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
+
+ SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
++ SND_PCI_QUIRK(0x13fe, 0x1009, "Advantech MIT-W101", ALC886_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_CLEVO_P950),
+diff --git a/sound/soc/codecs/cpcap.c b/sound/soc/codecs/cpcap.c
+index d7f05b384f1fb..1902689c5ea2c 100644
+--- a/sound/soc/codecs/cpcap.c
++++ b/sound/soc/codecs/cpcap.c
+@@ -1263,12 +1263,12 @@ static int cpcap_voice_hw_params(struct snd_pcm_substream *substream,
+
+ if (direction == SNDRV_PCM_STREAM_CAPTURE) {
+ mask = 0x0000;
+- mask |= CPCAP_BIT_MIC1_RX_TIMESLOT0;
+- mask |= CPCAP_BIT_MIC1_RX_TIMESLOT1;
+- mask |= CPCAP_BIT_MIC1_RX_TIMESLOT2;
+- mask |= CPCAP_BIT_MIC2_TIMESLOT0;
+- mask |= CPCAP_BIT_MIC2_TIMESLOT1;
+- mask |= CPCAP_BIT_MIC2_TIMESLOT2;
++ mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT0);
++ mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT1);
++ mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT2);
++ mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT0);
++ mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT1);
++ mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT2);
+ val = 0x0000;
+ if (channels >= 2)
+ val = BIT(CPCAP_BIT_MIC1_RX_TIMESLOT0);
+diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c
+index a5c8736fad777..04f89b751304c 100644
+--- a/sound/soc/codecs/cs42l56.c
++++ b/sound/soc/codecs/cs42l56.c
+@@ -1260,6 +1260,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
+ dev_err(&i2c_client->dev,
+ "CS42L56 Device ID (%X). Expected %X\n",
+ devid, CS42L56_DEVID);
++ ret = -EINVAL;
+ goto err_enable;
+ }
+ alpha_rev = reg & CS42L56_AREV_MASK;
+@@ -1317,7 +1318,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
+ ret = devm_snd_soc_register_component(&i2c_client->dev,
+ &soc_component_dev_cs42l56, &cs42l56_dai, 1);
+ if (ret < 0)
+- return ret;
++ goto err_enable;
+
+ return 0;
+
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index e4d2fcc89c306..4c9ab611aa3ef 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1853,7 +1853,7 @@ void snd_usb_preallocate_buffer(struct snd_usb_substream *subs)
+ {
+ struct snd_pcm *pcm = subs->stream->pcm;
+ struct snd_pcm_substream *s = pcm->streams[subs->direction].substream;
+- struct device *dev = subs->dev->bus->controller;
++ struct device *dev = subs->dev->bus->sysdev;
+
+ if (!snd_usb_use_vmalloc)
+ snd_pcm_lib_preallocate_pages(s, SNDRV_DMA_TYPE_DEV_SG,
+diff --git a/tools/perf/tests/sample-parsing.c b/tools/perf/tests/sample-parsing.c
+index 0e2d00d69e6e2..66e46bc8d6f1d 100644
+--- a/tools/perf/tests/sample-parsing.c
++++ b/tools/perf/tests/sample-parsing.c
+@@ -173,7 +173,7 @@ static int do_test(u64 sample_type, u64 sample_regs, u64 read_format)
+ .data = {1, 211, 212, 213},
+ };
+ u64 regs[64];
+- const u64 raw_data[] = {0x123456780a0b0c0dULL, 0x1102030405060708ULL};
++ const u32 raw_data[] = {0x12345678, 0x0a0b0c0d, 0x11020304, 0x05060708, 0 };
+ const u64 data[] = {0x2211443366558877ULL, 0, 0xaabbccddeeff4321ULL};
+ struct perf_sample sample = {
+ .ip = 101,
+diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
+index 9c22729e2ad60..538c935b40b8b 100644
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -1660,6 +1660,8 @@ int machine__resolve(struct machine *machine, struct addr_location *al,
+ }
+
+ al->sym = map__find_symbol(al->map, al->addr);
++ } else if (symbol_conf.dso_list) {
++ al->filtered |= (1 << HIST_FILTER__DSO);
+ }
+
+ if (symbol_conf.sym_list &&
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index 6522b6513895c..e2f038f84dbc1 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -1596,6 +1596,9 @@ static int intel_pt_walk_psbend(struct intel_pt_decoder *decoder)
+ break;
+
+ case INTEL_PT_CYC:
++ intel_pt_calc_cyc_timestamp(decoder);
++ break;
++
+ case INTEL_PT_VMCS:
+ case INTEL_PT_MNT:
+ case INTEL_PT_PAD:
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-03-07 15:15 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-03-07 15:15 UTC (permalink / raw
To: gentoo-commits
commit: d453b951f4417eb9c58f35f5c70550cea9def09b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Mar 7 15:14:56 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Mar 7 15:14:56 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d453b951
Linux patch 4.19.179
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1178_linux-4.19.179.patch | 2526 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2530 insertions(+)
diff --git a/0000_README b/0000_README
index c17ee8c..340b3da 100644
--- a/0000_README
+++ b/0000_README
@@ -751,6 +751,10 @@ Patch: 1177_linux-4.19.178.patch
From: https://www.kernel.org
Desc: Linux 4.19.178
+Patch: 1178_linux-4.19.179.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.179
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1178_linux-4.19.179.patch b/1178_linux-4.19.179.patch
new file mode 100644
index 0000000..819af64
--- /dev/null
+++ b/1178_linux-4.19.179.patch
@@ -0,0 +1,2526 @@
+diff --git a/Documentation/devicetree/bindings/net/btusb.txt b/Documentation/devicetree/bindings/net/btusb.txt
+index 37d67926dd6d9..d883a35641d1e 100644
+--- a/Documentation/devicetree/bindings/net/btusb.txt
++++ b/Documentation/devicetree/bindings/net/btusb.txt
+@@ -35,7 +35,7 @@ Following example uses irq pin number 3 of gpio0 for out of band wake-on-bt:
+ compatible = "usb1286,204e";
+ reg = <1>;
+ interrupt-parent = <&gpio0>;
+- interrupt-name = "wakeup";
++ interrupt-names = "wakeup";
+ interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+ };
+ };
+diff --git a/Documentation/filesystems/sysfs.txt b/Documentation/filesystems/sysfs.txt
+index a1426cabcef12..2e38fafc1b632 100644
+--- a/Documentation/filesystems/sysfs.txt
++++ b/Documentation/filesystems/sysfs.txt
+@@ -211,12 +211,10 @@ Other notes:
+ is 4096.
+
+ - show() methods should return the number of bytes printed into the
+- buffer. This is the return value of scnprintf().
++ buffer.
+
+-- show() must not use snprintf() when formatting the value to be
+- returned to user space. If you can guarantee that an overflow
+- will never happen you can use sprintf() otherwise you must use
+- scnprintf().
++- show() should only use sysfs_emit() or sysfs_emit_at() when formatting
++ the value to be returned to user space.
+
+ - store() should return the number of bytes used from the buffer. If the
+ entire buffer has been used, just return the count argument.
+diff --git a/Makefile b/Makefile
+index 6787efa2edc90..040b3cd699b01 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 178
++SUBLEVEL = 179
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/xen/p2m.c b/arch/arm/xen/p2m.c
+index ce538c51fa3fb..8a8a388549e7a 100644
+--- a/arch/arm/xen/p2m.c
++++ b/arch/arm/xen/p2m.c
+@@ -91,12 +91,39 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
+ int i;
+
+ for (i = 0; i < count; i++) {
++ struct gnttab_unmap_grant_ref unmap;
++ int rc;
++
+ if (map_ops[i].status)
+ continue;
+- if (unlikely(!set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
+- map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT))) {
+- return -ENOMEM;
+- }
++ if (likely(set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
++ map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT)))
++ continue;
++
++ /*
++ * Signal an error for this slot. This in turn requires
++ * immediate unmapping.
++ */
++ map_ops[i].status = GNTST_general_error;
++ unmap.host_addr = map_ops[i].host_addr,
++ unmap.handle = map_ops[i].handle;
++ map_ops[i].handle = ~0;
++ if (map_ops[i].flags & GNTMAP_device_map)
++ unmap.dev_bus_addr = map_ops[i].dev_bus_addr;
++ else
++ unmap.dev_bus_addr = 0;
++
++ /*
++ * Pre-populate the status field, to be recognizable in
++ * the log message below.
++ */
++ unmap.status = 1;
++
++ rc = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref,
++ &unmap, 1);
++ if (rc || unmap.status != GNTST_okay)
++ pr_err_once("gnttab unmap failed: rc=%d st=%d\n",
++ rc, unmap.status);
+ }
+
+ return 0;
+diff --git a/arch/arm64/include/asm/atomic_ll_sc.h b/arch/arm64/include/asm/atomic_ll_sc.h
+index f5a2d09afb384..1cc42441bc672 100644
+--- a/arch/arm64/include/asm/atomic_ll_sc.h
++++ b/arch/arm64/include/asm/atomic_ll_sc.h
+@@ -37,7 +37,7 @@
+ * (the optimize attribute silently ignores these options).
+ */
+
+-#define ATOMIC_OP(op, asm_op) \
++#define ATOMIC_OP(op, asm_op, constraint) \
+ __LL_SC_INLINE void \
+ __LL_SC_PREFIX(atomic_##op(int i, atomic_t *v)) \
+ { \
+@@ -51,11 +51,11 @@ __LL_SC_PREFIX(atomic_##op(int i, atomic_t *v)) \
+ " stxr %w1, %w0, %2\n" \
+ " cbnz %w1, 1b" \
+ : "=&r" (result), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i)); \
++ : #constraint "r" (i)); \
+ } \
+ __LL_SC_EXPORT(atomic_##op);
+
+-#define ATOMIC_OP_RETURN(name, mb, acq, rel, cl, op, asm_op) \
++#define ATOMIC_OP_RETURN(name, mb, acq, rel, cl, op, asm_op, constraint)\
+ __LL_SC_INLINE int \
+ __LL_SC_PREFIX(atomic_##op##_return##name(int i, atomic_t *v)) \
+ { \
+@@ -70,14 +70,14 @@ __LL_SC_PREFIX(atomic_##op##_return##name(int i, atomic_t *v)) \
+ " cbnz %w1, 1b\n" \
+ " " #mb \
+ : "=&r" (result), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i) \
++ : #constraint "r" (i) \
+ : cl); \
+ \
+ return result; \
+ } \
+ __LL_SC_EXPORT(atomic_##op##_return##name);
+
+-#define ATOMIC_FETCH_OP(name, mb, acq, rel, cl, op, asm_op) \
++#define ATOMIC_FETCH_OP(name, mb, acq, rel, cl, op, asm_op, constraint) \
+ __LL_SC_INLINE int \
+ __LL_SC_PREFIX(atomic_fetch_##op##name(int i, atomic_t *v)) \
+ { \
+@@ -92,7 +92,7 @@ __LL_SC_PREFIX(atomic_fetch_##op##name(int i, atomic_t *v)) \
+ " cbnz %w2, 1b\n" \
+ " " #mb \
+ : "=&r" (result), "=&r" (val), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i) \
++ : #constraint "r" (i) \
+ : cl); \
+ \
+ return result; \
+@@ -110,8 +110,8 @@ __LL_SC_EXPORT(atomic_fetch_##op##name);
+ ATOMIC_FETCH_OP (_acquire, , a, , "memory", __VA_ARGS__)\
+ ATOMIC_FETCH_OP (_release, , , l, "memory", __VA_ARGS__)
+
+-ATOMIC_OPS(add, add)
+-ATOMIC_OPS(sub, sub)
++ATOMIC_OPS(add, add, I)
++ATOMIC_OPS(sub, sub, J)
+
+ #undef ATOMIC_OPS
+ #define ATOMIC_OPS(...) \
+@@ -121,17 +121,17 @@ ATOMIC_OPS(sub, sub)
+ ATOMIC_FETCH_OP (_acquire, , a, , "memory", __VA_ARGS__)\
+ ATOMIC_FETCH_OP (_release, , , l, "memory", __VA_ARGS__)
+
+-ATOMIC_OPS(and, and)
+-ATOMIC_OPS(andnot, bic)
+-ATOMIC_OPS(or, orr)
+-ATOMIC_OPS(xor, eor)
++ATOMIC_OPS(and, and, )
++ATOMIC_OPS(andnot, bic, )
++ATOMIC_OPS(or, orr, )
++ATOMIC_OPS(xor, eor, )
+
+ #undef ATOMIC_OPS
+ #undef ATOMIC_FETCH_OP
+ #undef ATOMIC_OP_RETURN
+ #undef ATOMIC_OP
+
+-#define ATOMIC64_OP(op, asm_op) \
++#define ATOMIC64_OP(op, asm_op, constraint) \
+ __LL_SC_INLINE void \
+ __LL_SC_PREFIX(atomic64_##op(long i, atomic64_t *v)) \
+ { \
+@@ -145,11 +145,11 @@ __LL_SC_PREFIX(atomic64_##op(long i, atomic64_t *v)) \
+ " stxr %w1, %0, %2\n" \
+ " cbnz %w1, 1b" \
+ : "=&r" (result), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i)); \
++ : #constraint "r" (i)); \
+ } \
+ __LL_SC_EXPORT(atomic64_##op);
+
+-#define ATOMIC64_OP_RETURN(name, mb, acq, rel, cl, op, asm_op) \
++#define ATOMIC64_OP_RETURN(name, mb, acq, rel, cl, op, asm_op, constraint)\
+ __LL_SC_INLINE long \
+ __LL_SC_PREFIX(atomic64_##op##_return##name(long i, atomic64_t *v)) \
+ { \
+@@ -164,14 +164,14 @@ __LL_SC_PREFIX(atomic64_##op##_return##name(long i, atomic64_t *v)) \
+ " cbnz %w1, 1b\n" \
+ " " #mb \
+ : "=&r" (result), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i) \
++ : #constraint "r" (i) \
+ : cl); \
+ \
+ return result; \
+ } \
+ __LL_SC_EXPORT(atomic64_##op##_return##name);
+
+-#define ATOMIC64_FETCH_OP(name, mb, acq, rel, cl, op, asm_op) \
++#define ATOMIC64_FETCH_OP(name, mb, acq, rel, cl, op, asm_op, constraint)\
+ __LL_SC_INLINE long \
+ __LL_SC_PREFIX(atomic64_fetch_##op##name(long i, atomic64_t *v)) \
+ { \
+@@ -186,7 +186,7 @@ __LL_SC_PREFIX(atomic64_fetch_##op##name(long i, atomic64_t *v)) \
+ " cbnz %w2, 1b\n" \
+ " " #mb \
+ : "=&r" (result), "=&r" (val), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i) \
++ : #constraint "r" (i) \
+ : cl); \
+ \
+ return result; \
+@@ -204,8 +204,8 @@ __LL_SC_EXPORT(atomic64_fetch_##op##name);
+ ATOMIC64_FETCH_OP (_acquire,, a, , "memory", __VA_ARGS__) \
+ ATOMIC64_FETCH_OP (_release,, , l, "memory", __VA_ARGS__)
+
+-ATOMIC64_OPS(add, add)
+-ATOMIC64_OPS(sub, sub)
++ATOMIC64_OPS(add, add, I)
++ATOMIC64_OPS(sub, sub, J)
+
+ #undef ATOMIC64_OPS
+ #define ATOMIC64_OPS(...) \
+@@ -215,10 +215,10 @@ ATOMIC64_OPS(sub, sub)
+ ATOMIC64_FETCH_OP (_acquire,, a, , "memory", __VA_ARGS__) \
+ ATOMIC64_FETCH_OP (_release,, , l, "memory", __VA_ARGS__)
+
+-ATOMIC64_OPS(and, and)
+-ATOMIC64_OPS(andnot, bic)
+-ATOMIC64_OPS(or, orr)
+-ATOMIC64_OPS(xor, eor)
++ATOMIC64_OPS(and, and, L)
++ATOMIC64_OPS(andnot, bic, )
++ATOMIC64_OPS(or, orr, L)
++ATOMIC64_OPS(xor, eor, L)
+
+ #undef ATOMIC64_OPS
+ #undef ATOMIC64_FETCH_OP
+@@ -248,48 +248,54 @@ __LL_SC_PREFIX(atomic64_dec_if_positive(atomic64_t *v))
+ }
+ __LL_SC_EXPORT(atomic64_dec_if_positive);
+
+-#define __CMPXCHG_CASE(w, sz, name, mb, acq, rel, cl) \
+-__LL_SC_INLINE unsigned long \
+-__LL_SC_PREFIX(__cmpxchg_case_##name(volatile void *ptr, \
+- unsigned long old, \
+- unsigned long new)) \
++#define __CMPXCHG_CASE(w, sfx, name, sz, mb, acq, rel, cl, constraint) \
++__LL_SC_INLINE u##sz \
++__LL_SC_PREFIX(__cmpxchg_case_##name##sz(volatile void *ptr, \
++ unsigned long old, \
++ u##sz new)) \
+ { \
+- unsigned long tmp, oldval; \
++ unsigned long tmp; \
++ u##sz oldval; \
+ \
+ asm volatile( \
+ " prfm pstl1strm, %[v]\n" \
+- "1: ld" #acq "xr" #sz "\t%" #w "[oldval], %[v]\n" \
++ "1: ld" #acq "xr" #sfx "\t%" #w "[oldval], %[v]\n" \
+ " eor %" #w "[tmp], %" #w "[oldval], %" #w "[old]\n" \
+ " cbnz %" #w "[tmp], 2f\n" \
+- " st" #rel "xr" #sz "\t%w[tmp], %" #w "[new], %[v]\n" \
++ " st" #rel "xr" #sfx "\t%w[tmp], %" #w "[new], %[v]\n" \
+ " cbnz %w[tmp], 1b\n" \
+ " " #mb "\n" \
+ "2:" \
+ : [tmp] "=&r" (tmp), [oldval] "=&r" (oldval), \
+- [v] "+Q" (*(unsigned long *)ptr) \
+- : [old] "Lr" (old), [new] "r" (new) \
++ [v] "+Q" (*(u##sz *)ptr) \
++ : [old] #constraint "r" (old), [new] "r" (new) \
+ : cl); \
+ \
+ return oldval; \
+ } \
+-__LL_SC_EXPORT(__cmpxchg_case_##name);
++__LL_SC_EXPORT(__cmpxchg_case_##name##sz);
+
+-__CMPXCHG_CASE(w, b, 1, , , , )
+-__CMPXCHG_CASE(w, h, 2, , , , )
+-__CMPXCHG_CASE(w, , 4, , , , )
+-__CMPXCHG_CASE( , , 8, , , , )
+-__CMPXCHG_CASE(w, b, acq_1, , a, , "memory")
+-__CMPXCHG_CASE(w, h, acq_2, , a, , "memory")
+-__CMPXCHG_CASE(w, , acq_4, , a, , "memory")
+-__CMPXCHG_CASE( , , acq_8, , a, , "memory")
+-__CMPXCHG_CASE(w, b, rel_1, , , l, "memory")
+-__CMPXCHG_CASE(w, h, rel_2, , , l, "memory")
+-__CMPXCHG_CASE(w, , rel_4, , , l, "memory")
+-__CMPXCHG_CASE( , , rel_8, , , l, "memory")
+-__CMPXCHG_CASE(w, b, mb_1, dmb ish, , l, "memory")
+-__CMPXCHG_CASE(w, h, mb_2, dmb ish, , l, "memory")
+-__CMPXCHG_CASE(w, , mb_4, dmb ish, , l, "memory")
+-__CMPXCHG_CASE( , , mb_8, dmb ish, , l, "memory")
++/*
++ * Earlier versions of GCC (no later than 8.1.0) appear to incorrectly
++ * handle the 'K' constraint for the value 4294967295 - thus we use no
++ * constraint for 32 bit operations.
++ */
++__CMPXCHG_CASE(w, b, , 8, , , , , )
++__CMPXCHG_CASE(w, h, , 16, , , , , )
++__CMPXCHG_CASE(w, , , 32, , , , , )
++__CMPXCHG_CASE( , , , 64, , , , , L)
++__CMPXCHG_CASE(w, b, acq_, 8, , a, , "memory", )
++__CMPXCHG_CASE(w, h, acq_, 16, , a, , "memory", )
++__CMPXCHG_CASE(w, , acq_, 32, , a, , "memory", )
++__CMPXCHG_CASE( , , acq_, 64, , a, , "memory", L)
++__CMPXCHG_CASE(w, b, rel_, 8, , , l, "memory", )
++__CMPXCHG_CASE(w, h, rel_, 16, , , l, "memory", )
++__CMPXCHG_CASE(w, , rel_, 32, , , l, "memory", )
++__CMPXCHG_CASE( , , rel_, 64, , , l, "memory", L)
++__CMPXCHG_CASE(w, b, mb_, 8, dmb ish, , l, "memory", )
++__CMPXCHG_CASE(w, h, mb_, 16, dmb ish, , l, "memory", )
++__CMPXCHG_CASE(w, , mb_, 32, dmb ish, , l, "memory", )
++__CMPXCHG_CASE( , , mb_, 64, dmb ish, , l, "memory", L)
+
+ #undef __CMPXCHG_CASE
+
+diff --git a/arch/arm64/include/asm/atomic_lse.h b/arch/arm64/include/asm/atomic_lse.h
+index eab3de4f2ad25..80cadc789f1a7 100644
+--- a/arch/arm64/include/asm/atomic_lse.h
++++ b/arch/arm64/include/asm/atomic_lse.h
+@@ -480,24 +480,24 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
+
+ #define __LL_SC_CMPXCHG(op) __LL_SC_CALL(__cmpxchg_case_##op)
+
+-#define __CMPXCHG_CASE(w, sz, name, mb, cl...) \
+-static inline unsigned long __cmpxchg_case_##name(volatile void *ptr, \
+- unsigned long old, \
+- unsigned long new) \
++#define __CMPXCHG_CASE(w, sfx, name, sz, mb, cl...) \
++static inline u##sz __cmpxchg_case_##name##sz(volatile void *ptr, \
++ unsigned long old, \
++ u##sz new) \
+ { \
+ register unsigned long x0 asm ("x0") = (unsigned long)ptr; \
+ register unsigned long x1 asm ("x1") = old; \
+- register unsigned long x2 asm ("x2") = new; \
++ register u##sz x2 asm ("x2") = new; \
+ \
+ asm volatile( \
+ __LSE_PREAMBLE \
+ ARM64_LSE_ATOMIC_INSN( \
+ /* LL/SC */ \
+- __LL_SC_CMPXCHG(name) \
++ __LL_SC_CMPXCHG(name##sz) \
+ __nops(2), \
+ /* LSE atomics */ \
+ " mov " #w "30, %" #w "[old]\n" \
+- " cas" #mb #sz "\t" #w "30, %" #w "[new], %[v]\n" \
++ " cas" #mb #sfx "\t" #w "30, %" #w "[new], %[v]\n" \
+ " mov %" #w "[ret], " #w "30") \
+ : [ret] "+r" (x0), [v] "+Q" (*(unsigned long *)ptr) \
+ : [old] "r" (x1), [new] "r" (x2) \
+@@ -506,22 +506,22 @@ static inline unsigned long __cmpxchg_case_##name(volatile void *ptr, \
+ return x0; \
+ }
+
+-__CMPXCHG_CASE(w, b, 1, )
+-__CMPXCHG_CASE(w, h, 2, )
+-__CMPXCHG_CASE(w, , 4, )
+-__CMPXCHG_CASE(x, , 8, )
+-__CMPXCHG_CASE(w, b, acq_1, a, "memory")
+-__CMPXCHG_CASE(w, h, acq_2, a, "memory")
+-__CMPXCHG_CASE(w, , acq_4, a, "memory")
+-__CMPXCHG_CASE(x, , acq_8, a, "memory")
+-__CMPXCHG_CASE(w, b, rel_1, l, "memory")
+-__CMPXCHG_CASE(w, h, rel_2, l, "memory")
+-__CMPXCHG_CASE(w, , rel_4, l, "memory")
+-__CMPXCHG_CASE(x, , rel_8, l, "memory")
+-__CMPXCHG_CASE(w, b, mb_1, al, "memory")
+-__CMPXCHG_CASE(w, h, mb_2, al, "memory")
+-__CMPXCHG_CASE(w, , mb_4, al, "memory")
+-__CMPXCHG_CASE(x, , mb_8, al, "memory")
++__CMPXCHG_CASE(w, b, , 8, )
++__CMPXCHG_CASE(w, h, , 16, )
++__CMPXCHG_CASE(w, , , 32, )
++__CMPXCHG_CASE(x, , , 64, )
++__CMPXCHG_CASE(w, b, acq_, 8, a, "memory")
++__CMPXCHG_CASE(w, h, acq_, 16, a, "memory")
++__CMPXCHG_CASE(w, , acq_, 32, a, "memory")
++__CMPXCHG_CASE(x, , acq_, 64, a, "memory")
++__CMPXCHG_CASE(w, b, rel_, 8, l, "memory")
++__CMPXCHG_CASE(w, h, rel_, 16, l, "memory")
++__CMPXCHG_CASE(w, , rel_, 32, l, "memory")
++__CMPXCHG_CASE(x, , rel_, 64, l, "memory")
++__CMPXCHG_CASE(w, b, mb_, 8, al, "memory")
++__CMPXCHG_CASE(w, h, mb_, 16, al, "memory")
++__CMPXCHG_CASE(w, , mb_, 32, al, "memory")
++__CMPXCHG_CASE(x, , mb_, 64, al, "memory")
+
+ #undef __LL_SC_CMPXCHG
+ #undef __CMPXCHG_CASE
+diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h
+index d8b01c7c9cd3f..94ccb3bfbd613 100644
+--- a/arch/arm64/include/asm/cmpxchg.h
++++ b/arch/arm64/include/asm/cmpxchg.h
+@@ -30,46 +30,46 @@
+ * barrier case is generated as release+dmb for the former and
+ * acquire+release for the latter.
+ */
+-#define __XCHG_CASE(w, sz, name, mb, nop_lse, acq, acq_lse, rel, cl) \
+-static inline unsigned long __xchg_case_##name(unsigned long x, \
+- volatile void *ptr) \
+-{ \
+- unsigned long ret, tmp; \
+- \
+- asm volatile(ARM64_LSE_ATOMIC_INSN( \
+- /* LL/SC */ \
+- " prfm pstl1strm, %2\n" \
+- "1: ld" #acq "xr" #sz "\t%" #w "0, %2\n" \
+- " st" #rel "xr" #sz "\t%w1, %" #w "3, %2\n" \
+- " cbnz %w1, 1b\n" \
+- " " #mb, \
+- /* LSE atomics */ \
+- " swp" #acq_lse #rel #sz "\t%" #w "3, %" #w "0, %2\n" \
+- __nops(3) \
+- " " #nop_lse) \
+- : "=&r" (ret), "=&r" (tmp), "+Q" (*(unsigned long *)ptr) \
+- : "r" (x) \
+- : cl); \
+- \
+- return ret; \
++#define __XCHG_CASE(w, sfx, name, sz, mb, nop_lse, acq, acq_lse, rel, cl) \
++static inline u##sz __xchg_case_##name##sz(u##sz x, volatile void *ptr) \
++{ \
++ u##sz ret; \
++ unsigned long tmp; \
++ \
++ asm volatile(ARM64_LSE_ATOMIC_INSN( \
++ /* LL/SC */ \
++ " prfm pstl1strm, %2\n" \
++ "1: ld" #acq "xr" #sfx "\t%" #w "0, %2\n" \
++ " st" #rel "xr" #sfx "\t%w1, %" #w "3, %2\n" \
++ " cbnz %w1, 1b\n" \
++ " " #mb, \
++ /* LSE atomics */ \
++ " swp" #acq_lse #rel #sfx "\t%" #w "3, %" #w "0, %2\n" \
++ __nops(3) \
++ " " #nop_lse) \
++ : "=&r" (ret), "=&r" (tmp), "+Q" (*(u##sz *)ptr) \
++ : "r" (x) \
++ : cl); \
++ \
++ return ret; \
+ }
+
+-__XCHG_CASE(w, b, 1, , , , , , )
+-__XCHG_CASE(w, h, 2, , , , , , )
+-__XCHG_CASE(w, , 4, , , , , , )
+-__XCHG_CASE( , , 8, , , , , , )
+-__XCHG_CASE(w, b, acq_1, , , a, a, , "memory")
+-__XCHG_CASE(w, h, acq_2, , , a, a, , "memory")
+-__XCHG_CASE(w, , acq_4, , , a, a, , "memory")
+-__XCHG_CASE( , , acq_8, , , a, a, , "memory")
+-__XCHG_CASE(w, b, rel_1, , , , , l, "memory")
+-__XCHG_CASE(w, h, rel_2, , , , , l, "memory")
+-__XCHG_CASE(w, , rel_4, , , , , l, "memory")
+-__XCHG_CASE( , , rel_8, , , , , l, "memory")
+-__XCHG_CASE(w, b, mb_1, dmb ish, nop, , a, l, "memory")
+-__XCHG_CASE(w, h, mb_2, dmb ish, nop, , a, l, "memory")
+-__XCHG_CASE(w, , mb_4, dmb ish, nop, , a, l, "memory")
+-__XCHG_CASE( , , mb_8, dmb ish, nop, , a, l, "memory")
++__XCHG_CASE(w, b, , 8, , , , , , )
++__XCHG_CASE(w, h, , 16, , , , , , )
++__XCHG_CASE(w, , , 32, , , , , , )
++__XCHG_CASE( , , , 64, , , , , , )
++__XCHG_CASE(w, b, acq_, 8, , , a, a, , "memory")
++__XCHG_CASE(w, h, acq_, 16, , , a, a, , "memory")
++__XCHG_CASE(w, , acq_, 32, , , a, a, , "memory")
++__XCHG_CASE( , , acq_, 64, , , a, a, , "memory")
++__XCHG_CASE(w, b, rel_, 8, , , , , l, "memory")
++__XCHG_CASE(w, h, rel_, 16, , , , , l, "memory")
++__XCHG_CASE(w, , rel_, 32, , , , , l, "memory")
++__XCHG_CASE( , , rel_, 64, , , , , l, "memory")
++__XCHG_CASE(w, b, mb_, 8, dmb ish, nop, , a, l, "memory")
++__XCHG_CASE(w, h, mb_, 16, dmb ish, nop, , a, l, "memory")
++__XCHG_CASE(w, , mb_, 32, dmb ish, nop, , a, l, "memory")
++__XCHG_CASE( , , mb_, 64, dmb ish, nop, , a, l, "memory")
+
+ #undef __XCHG_CASE
+
+@@ -80,13 +80,13 @@ static __always_inline unsigned long __xchg##sfx(unsigned long x, \
+ { \
+ switch (size) { \
+ case 1: \
+- return __xchg_case##sfx##_1(x, ptr); \
++ return __xchg_case##sfx##_8(x, ptr); \
+ case 2: \
+- return __xchg_case##sfx##_2(x, ptr); \
++ return __xchg_case##sfx##_16(x, ptr); \
+ case 4: \
+- return __xchg_case##sfx##_4(x, ptr); \
++ return __xchg_case##sfx##_32(x, ptr); \
+ case 8: \
+- return __xchg_case##sfx##_8(x, ptr); \
++ return __xchg_case##sfx##_64(x, ptr); \
+ default: \
+ BUILD_BUG(); \
+ } \
+@@ -123,13 +123,13 @@ static __always_inline unsigned long __cmpxchg##sfx(volatile void *ptr, \
+ { \
+ switch (size) { \
+ case 1: \
+- return __cmpxchg_case##sfx##_1(ptr, (u8)old, new); \
++ return __cmpxchg_case##sfx##_8(ptr, (u8)old, new); \
+ case 2: \
+- return __cmpxchg_case##sfx##_2(ptr, (u16)old, new); \
++ return __cmpxchg_case##sfx##_16(ptr, (u16)old, new); \
+ case 4: \
+- return __cmpxchg_case##sfx##_4(ptr, old, new); \
++ return __cmpxchg_case##sfx##_32(ptr, old, new); \
+ case 8: \
+- return __cmpxchg_case##sfx##_8(ptr, old, new); \
++ return __cmpxchg_case##sfx##_64(ptr, old, new); \
+ default: \
+ BUILD_BUG(); \
+ } \
+@@ -197,16 +197,16 @@ __CMPXCHG_GEN(_mb)
+ __ret; \
+ })
+
+-#define __CMPWAIT_CASE(w, sz, name) \
+-static inline void __cmpwait_case_##name(volatile void *ptr, \
+- unsigned long val) \
++#define __CMPWAIT_CASE(w, sfx, sz) \
++static inline void __cmpwait_case_##sz(volatile void *ptr, \
++ unsigned long val) \
+ { \
+ unsigned long tmp; \
+ \
+ asm volatile( \
+ " sevl\n" \
+ " wfe\n" \
+- " ldxr" #sz "\t%" #w "[tmp], %[v]\n" \
++ " ldxr" #sfx "\t%" #w "[tmp], %[v]\n" \
+ " eor %" #w "[tmp], %" #w "[tmp], %" #w "[val]\n" \
+ " cbnz %" #w "[tmp], 1f\n" \
+ " wfe\n" \
+@@ -215,10 +215,10 @@ static inline void __cmpwait_case_##name(volatile void *ptr, \
+ : [val] "r" (val)); \
+ }
+
+-__CMPWAIT_CASE(w, b, 1);
+-__CMPWAIT_CASE(w, h, 2);
+-__CMPWAIT_CASE(w, , 4);
+-__CMPWAIT_CASE( , , 8);
++__CMPWAIT_CASE(w, b, 8);
++__CMPWAIT_CASE(w, h, 16);
++__CMPWAIT_CASE(w, , 32);
++__CMPWAIT_CASE( , , 64);
+
+ #undef __CMPWAIT_CASE
+
+@@ -229,13 +229,13 @@ static __always_inline void __cmpwait##sfx(volatile void *ptr, \
+ { \
+ switch (size) { \
+ case 1: \
+- return __cmpwait_case##sfx##_1(ptr, (u8)val); \
++ return __cmpwait_case##sfx##_8(ptr, (u8)val); \
+ case 2: \
+- return __cmpwait_case##sfx##_2(ptr, (u16)val); \
++ return __cmpwait_case##sfx##_16(ptr, (u16)val); \
+ case 4: \
+- return __cmpwait_case##sfx##_4(ptr, val); \
++ return __cmpwait_case##sfx##_32(ptr, val); \
+ case 8: \
+- return __cmpwait_case##sfx##_8(ptr, val); \
++ return __cmpwait_case##sfx##_64(ptr, val); \
+ default: \
+ BUILD_BUG(); \
+ } \
+diff --git a/arch/arm64/kernel/module.lds b/arch/arm64/kernel/module.lds
+index 22e36a21c1134..09a0eef71d12b 100644
+--- a/arch/arm64/kernel/module.lds
++++ b/arch/arm64/kernel/module.lds
+@@ -1,5 +1,5 @@
+ SECTIONS {
+- .plt (NOLOAD) : { BYTE(0) }
+- .init.plt (NOLOAD) : { BYTE(0) }
+- .text.ftrace_trampoline (NOLOAD) : { BYTE(0) }
++ .plt 0 (NOLOAD) : { BYTE(0) }
++ .init.plt 0 (NOLOAD) : { BYTE(0) }
++ .text.ftrace_trampoline 0 (NOLOAD) : { BYTE(0) }
+ }
+diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile
+index c99fa1c1bd9cc..a876b1657bf4e 100644
+--- a/arch/mips/vdso/Makefile
++++ b/arch/mips/vdso/Makefile
+@@ -10,12 +10,9 @@ ccflags-vdso := \
+ $(filter -march=%,$(KBUILD_CFLAGS)) \
+ $(filter -m%-float,$(KBUILD_CFLAGS)) \
+ $(filter -mno-loongson-%,$(KBUILD_CFLAGS)) \
++ $(CLANG_FLAGS) \
+ -D__VDSO__
+
+-ifeq ($(cc-name),clang)
+-ccflags-vdso += $(filter --target=%,$(KBUILD_CFLAGS))
+-endif
+-
+ cflags-vdso := $(ccflags-vdso) \
+ $(filter -W%,$(filter-out -Wa$(comma)%,$(KBUILD_CFLAGS))) \
+ -O2 -g -fPIC -fno-strict-aliasing -fno-common -fno-builtin -G 0 \
+diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c
+index 0ca254085a662..c152c30c2d06d 100644
+--- a/arch/parisc/kernel/irq.c
++++ b/arch/parisc/kernel/irq.c
+@@ -380,7 +380,11 @@ static inline int eirr_to_irq(unsigned long eirr)
+ /*
+ * IRQ STACK - used for irq handler
+ */
++#ifdef CONFIG_64BIT
++#define IRQ_STACK_SIZE (4096 << 4) /* 64k irq stack size */
++#else
+ #define IRQ_STACK_SIZE (4096 << 3) /* 32k irq stack size */
++#endif
+
+ union irq_stack_union {
+ unsigned long stack[IRQ_STACK_SIZE/sizeof(unsigned long)];
+diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
+index 6645f123419c6..9f0be2c7e3466 100644
+--- a/arch/x86/kernel/module.c
++++ b/arch/x86/kernel/module.c
+@@ -126,6 +126,7 @@ int apply_relocate(Elf32_Shdr *sechdrs,
+ *location += sym->st_value;
+ break;
+ case R_386_PC32:
++ case R_386_PLT32:
+ /* Add the value, subtract its position */
+ *location += sym->st_value - (uint32_t)location;
+ break;
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index a19706bee6874..6489cc19ed069 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -477,6 +477,15 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = {
+ },
+ },
+
++ { /* PCIe Wifi card isn't detected after reboot otherwise */
++ .callback = set_pci_reboot,
++ .ident = "Zotac ZBOX CI327 nano",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "NA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ZBOX-CI327NANO-GS-01"),
++ },
++ },
++
+ /* Sony */
+ { /* Handle problems with rebooting on Sony VGN-Z540N */
+ .callback = set_bios_reboot,
+diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
+index 3a6c8ebc8032e..aa046d46ff8ff 100644
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -841,9 +841,11 @@ static int do_reloc32(struct section *sec, Elf_Rel *rel, Elf_Sym *sym,
+ case R_386_PC32:
+ case R_386_PC16:
+ case R_386_PC8:
++ case R_386_PLT32:
+ /*
+- * NONE can be ignored and PC relative relocations don't
+- * need to be adjusted.
++ * NONE can be ignored and PC relative relocations don't need
++ * to be adjusted. Because sym must be defined, R_386_PLT32 can
++ * be treated the same way as R_386_PC32.
+ */
+ break;
+
+@@ -884,9 +886,11 @@ static int do_reloc_real(struct section *sec, Elf_Rel *rel, Elf_Sym *sym,
+ case R_386_PC32:
+ case R_386_PC16:
+ case R_386_PC8:
++ case R_386_PLT32:
+ /*
+- * NONE can be ignored and PC relative relocations don't
+- * need to be adjusted.
++ * NONE can be ignored and PC relative relocations don't need
++ * to be adjusted. Because sym must be defined, R_386_PLT32 can
++ * be treated the same way as R_386_PC32.
+ */
+ break;
+
+diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
+index e8ef994c7243c..82577eec6d0a7 100644
+--- a/arch/x86/xen/p2m.c
++++ b/arch/x86/xen/p2m.c
+@@ -706,6 +706,8 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
+
+ for (i = 0; i < count; i++) {
+ unsigned long mfn, pfn;
++ struct gnttab_unmap_grant_ref unmap[2];
++ int rc;
+
+ /* Do not add to override if the map failed. */
+ if (map_ops[i].status != GNTST_okay ||
+@@ -723,10 +725,46 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
+
+ WARN(pfn_to_mfn(pfn) != INVALID_P2M_ENTRY, "page must be ballooned");
+
+- if (unlikely(!set_phys_to_machine(pfn, FOREIGN_FRAME(mfn)))) {
+- ret = -ENOMEM;
+- goto out;
++ if (likely(set_phys_to_machine(pfn, FOREIGN_FRAME(mfn))))
++ continue;
++
++ /*
++ * Signal an error for this slot. This in turn requires
++ * immediate unmapping.
++ */
++ map_ops[i].status = GNTST_general_error;
++ unmap[0].host_addr = map_ops[i].host_addr,
++ unmap[0].handle = map_ops[i].handle;
++ map_ops[i].handle = ~0;
++ if (map_ops[i].flags & GNTMAP_device_map)
++ unmap[0].dev_bus_addr = map_ops[i].dev_bus_addr;
++ else
++ unmap[0].dev_bus_addr = 0;
++
++ if (kmap_ops) {
++ kmap_ops[i].status = GNTST_general_error;
++ unmap[1].host_addr = kmap_ops[i].host_addr,
++ unmap[1].handle = kmap_ops[i].handle;
++ kmap_ops[i].handle = ~0;
++ if (kmap_ops[i].flags & GNTMAP_device_map)
++ unmap[1].dev_bus_addr = kmap_ops[i].dev_bus_addr;
++ else
++ unmap[1].dev_bus_addr = 0;
+ }
++
++ /*
++ * Pre-populate both status fields, to be recognizable in
++ * the log message below.
++ */
++ unmap[0].status = 1;
++ unmap[1].status = 1;
++
++ rc = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref,
++ unmap, 1 + !!kmap_ops);
++ if (rc || unmap[0].status != GNTST_okay ||
++ unmap[1].status != GNTST_okay)
++ pr_err_once("gnttab unmap failed: rc=%d st0=%d st1=%d\n",
++ rc, unmap[0].status, unmap[1].status);
+ }
+
+ out:
+diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
+index d332988eb8dea..bf797c613ba2d 100644
+--- a/crypto/tcrypt.c
++++ b/crypto/tcrypt.c
+@@ -202,8 +202,8 @@ static int test_mb_aead_jiffies(struct test_mb_aead_data *data, int enc,
+ goto out;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount * num_mb, secs, (long)bcount * blen * num_mb);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount * num_mb, secs, (u64)bcount * blen * num_mb);
+
+ out:
+ kfree(rc);
+@@ -472,8 +472,8 @@ static int test_aead_jiffies(struct aead_request *req, int enc,
+ return ret;
+ }
+
+- printk("%d operations in %d seconds (%ld bytes)\n",
+- bcount, secs, (long)bcount * blen);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount, secs, (u64)bcount * blen);
+ return 0;
+ }
+
+@@ -763,8 +763,8 @@ static int test_mb_ahash_jiffies(struct test_mb_ahash_data *data, int blen,
+ goto out;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount * num_mb, secs, (long)bcount * blen * num_mb);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount * num_mb, secs, (u64)bcount * blen * num_mb);
+
+ out:
+ kfree(rc);
+@@ -1200,8 +1200,8 @@ static int test_mb_acipher_jiffies(struct test_mb_skcipher_data *data, int enc,
+ goto out;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount * num_mb, secs, (long)bcount * blen * num_mb);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount * num_mb, secs, (u64)bcount * blen * num_mb);
+
+ out:
+ kfree(rc);
+@@ -1438,8 +1438,8 @@ static int test_acipher_jiffies(struct skcipher_request *req, int enc,
+ return ret;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount, secs, (long)bcount * blen);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount, secs, (u64)bcount * blen);
+ return 0;
+ }
+
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 52850c10165e1..2c7f412df2eb3 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -873,7 +873,7 @@ static ssize_t mm_stat_show(struct device *dev,
+ zram->limit_pages << PAGE_SHIFT,
+ max_used << PAGE_SHIFT,
+ (u64)atomic64_read(&zram->stats.same_pages),
+- pool_stats.pages_compacted,
++ atomic_long_read(&pool_stats.pages_compacted),
+ (u64)atomic64_read(&zram->stats.huge_pages));
+ up_read(&zram->init_lock);
+
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index 7ffeb37e8f202..79b96251de806 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -885,6 +885,11 @@ static int h5_btrtl_setup(struct h5 *h5)
+ /* Give the device some time before the hci-core sends it a reset */
+ usleep_range(10000, 20000);
+
++ /* Enable controller to do both LE scan and BR/EDR inquiry
++ * simultaneously.
++ */
++ set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &h5->hu->hdev->quirks);
++
+ out_free:
+ btrtl_free(btrtl_dev);
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index fa0e6c8e2447c..e3bedf4cc9c03 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -1124,6 +1124,11 @@ static bool construct(
+ goto ddc_create_fail;
+ }
+
++ if (!link->ddc->ddc_pin) {
++ DC_ERROR("Failed to get I2C info for connector!\n");
++ goto ddc_create_fail;
++ }
++
+ link->ddc_hw_inst =
+ dal_ddc_get_line(
+ dal_ddc_service_get_ddc_pin(link->ddc));
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index 3e72c6dac0ffe..6e45d6b0dad92 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -868,9 +868,9 @@ int virtio_gpu_object_attach(struct virtio_gpu_device *vgdev,
+ }
+
+ /* gets freed when the ring has consumed it */
+- ents = kmalloc_array(obj->pages->nents,
+- sizeof(struct virtio_gpu_mem_entry),
+- GFP_KERNEL);
++ ents = kvmalloc_array(obj->pages->nents,
++ sizeof(struct virtio_gpu_mem_entry),
++ GFP_KERNEL);
+ if (!ents) {
+ DRM_ERROR("failed to allocate ent list\n");
+ return -ENOMEM;
+diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
+index f1dfb84094328..845583e2af4d5 100644
+--- a/drivers/media/rc/mceusb.c
++++ b/drivers/media/rc/mceusb.c
+@@ -685,11 +685,18 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len,
+ data[0], data[1]);
+ break;
+ case MCE_RSP_EQIRCFS:
++ if (!data[0] && !data[1]) {
++ dev_dbg(dev, "%s: no carrier", inout);
++ break;
++ }
++ // prescaler should make sense
++ if (data[0] > 8)
++ break;
+ period = DIV_ROUND_CLOSEST((1U << data[0] * 2) *
+ (data[1] + 1), 10);
+ if (!period)
+ break;
+- carrier = (1000 * 1000) / period;
++ carrier = USEC_PER_SEC / period;
+ dev_dbg(dev, "%s carrier of %u Hz (period %uus)",
+ inout, carrier, period);
+ break;
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 38c73cdbef70e..998ce712978ae 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -940,7 +940,10 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
+ unsigned int i;
+
+ extra_size = roundup(extra_size, sizeof(*entity->pads));
+- num_inputs = (type & UVC_TERM_OUTPUT) ? num_pads : num_pads - 1;
++ if (num_pads)
++ num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1;
++ else
++ num_inputs = 0;
+ size = sizeof(*entity) + extra_size + sizeof(*entity->pads) * num_pads
+ + num_inputs;
+ entity = kzalloc(size, GFP_KERNEL);
+@@ -956,7 +959,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
+
+ for (i = 0; i < num_inputs; ++i)
+ entity->pads[i].flags = MEDIA_PAD_FL_SINK;
+- if (!UVC_ENTITY_IS_OTERM(entity))
++ if (!UVC_ENTITY_IS_OTERM(entity) && num_pads)
+ entity->pads[num_pads-1].flags = MEDIA_PAD_FL_SOURCE;
+
+ entity->bNrInPins = num_inputs;
+diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
+index f75d892b6f033..76ef79733a4e5 100644
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -2939,7 +2939,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
+ v4l2_kioctl func)
+ {
+ char sbuf[128];
+- void *mbuf = NULL;
++ void *mbuf = NULL, *array_buf = NULL;
+ void *parg = (void *)arg;
+ long err = -EINVAL;
+ bool has_array_args;
+@@ -2998,20 +2998,14 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
+ has_array_args = err;
+
+ if (has_array_args) {
+- /*
+- * When adding new types of array args, make sure that the
+- * parent argument to ioctl (which contains the pointer to the
+- * array) fits into sbuf (so that mbuf will still remain
+- * unused up to here).
+- */
+- mbuf = kvmalloc(array_size, GFP_KERNEL);
++ array_buf = kvmalloc(array_size, GFP_KERNEL);
+ err = -ENOMEM;
+- if (NULL == mbuf)
++ if (array_buf == NULL)
+ goto out_array_args;
+ err = -EFAULT;
+- if (copy_from_user(mbuf, user_ptr, array_size))
++ if (copy_from_user(array_buf, user_ptr, array_size))
+ goto out_array_args;
+- *kernel_ptr = mbuf;
++ *kernel_ptr = array_buf;
+ }
+
+ /* Handles IOCTL */
+@@ -3030,7 +3024,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
+
+ if (has_array_args) {
+ *kernel_ptr = (void __force *)user_ptr;
+- if (copy_to_user(user_ptr, mbuf, array_size))
++ if (copy_to_user(user_ptr, array_buf, array_size))
+ err = -EFAULT;
+ goto out_array_args;
+ }
+@@ -3052,6 +3046,7 @@ out_array_args:
+ }
+
+ out:
++ kvfree(array_buf);
+ kvfree(mbuf);
+ return err;
+ }
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index d2e5f5b7adf18..9a359c41cfa63 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1217,6 +1217,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x19d2, 0x1255, 4)},
+ {QMI_FIXED_INTF(0x19d2, 0x1256, 4)},
+ {QMI_FIXED_INTF(0x19d2, 0x1270, 5)}, /* ZTE MF667 */
++ {QMI_FIXED_INTF(0x19d2, 0x1275, 3)}, /* ZTE P685M */
+ {QMI_FIXED_INTF(0x19d2, 0x1401, 2)},
+ {QMI_FIXED_INTF(0x19d2, 0x1402, 2)}, /* ZTE MF60 */
+ {QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index faaca7fe9ad1e..f32d35e03708f 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -3567,23 +3567,16 @@ bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar)
+ static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb)
+ {
+ struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue;
+- int ret = 0;
+-
+- spin_lock_bh(&ar->data_lock);
+
+- if (skb_queue_len(q) == ATH10K_MAX_NUM_MGMT_PENDING) {
++ if (skb_queue_len_lockless(q) >= ATH10K_MAX_NUM_MGMT_PENDING) {
+ ath10k_warn(ar, "wmi mgmt tx queue is full\n");
+- ret = -ENOSPC;
+- goto unlock;
++ return -ENOSPC;
+ }
+
+- __skb_queue_tail(q, skb);
++ skb_queue_tail(q, skb);
+ ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work);
+
+-unlock:
+- spin_unlock_bh(&ar->data_lock);
+-
+- return ret;
++ return 0;
+ }
+
+ static enum ath10k_mac_tx_path
+diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
+index a7b341e95e764..0da95777f1c15 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
+@@ -238,7 +238,8 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb)
+ rsi_set_len_qno(&data_desc->len_qno,
+ (skb->len - FRAME_DESC_SZ),
+ RSI_WIFI_MGMT_Q);
+- if ((skb->len - header_size) == EAPOL4_PACKET_LEN) {
++ if (((skb->len - header_size) == EAPOL4_PACKET_LEN) ||
++ ((skb->len - header_size) == EAPOL4_PACKET_LEN - 2)) {
+ data_desc->misc_flags |=
+ RSI_DESC_REQUIRE_CFM_TO_HOST;
+ xtend_desc->confirm_frame_type = EAPOL4_CONFIRM;
+diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+index 81cc1044532d1..f76a360cf1e35 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -153,9 +153,7 @@ static void rsi_handle_interrupt(struct sdio_func *function)
+ if (adapter->priv->fsm_state == FSM_FW_NOT_LOADED)
+ return;
+
+- dev->sdio_irq_task = current;
+- rsi_interrupt_handler(adapter);
+- dev->sdio_irq_task = NULL;
++ rsi_set_event(&dev->rx_thread.event);
+ }
+
+ /**
+@@ -973,8 +971,6 @@ static int rsi_probe(struct sdio_func *pfunction,
+ rsi_dbg(ERR_ZONE, "%s: Unable to init rx thrd\n", __func__);
+ goto fail_kill_thread;
+ }
+- skb_queue_head_init(&sdev->rx_q.head);
+- sdev->rx_q.num_rx_pkts = 0;
+
+ sdio_claim_host(pfunction);
+ if (sdio_claim_irq(pfunction, rsi_handle_interrupt)) {
+diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+index 612c211e21a15..d66ae2f573140 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+@@ -60,39 +60,20 @@ int rsi_sdio_master_access_msword(struct rsi_hw *adapter, u16 ms_word)
+ return status;
+ }
+
++static void rsi_rx_handler(struct rsi_hw *adapter);
++
+ void rsi_sdio_rx_thread(struct rsi_common *common)
+ {
+ struct rsi_hw *adapter = common->priv;
+ struct rsi_91x_sdiodev *sdev = adapter->rsi_dev;
+- struct sk_buff *skb;
+- int status;
+
+ do {
+ rsi_wait_event(&sdev->rx_thread.event, EVENT_WAIT_FOREVER);
+ rsi_reset_event(&sdev->rx_thread.event);
++ rsi_rx_handler(adapter);
++ } while (!atomic_read(&sdev->rx_thread.thread_done));
+
+- while (true) {
+- if (atomic_read(&sdev->rx_thread.thread_done))
+- goto out;
+-
+- skb = skb_dequeue(&sdev->rx_q.head);
+- if (!skb)
+- break;
+- if (sdev->rx_q.num_rx_pkts > 0)
+- sdev->rx_q.num_rx_pkts--;
+- status = rsi_read_pkt(common, skb->data, skb->len);
+- if (status) {
+- rsi_dbg(ERR_ZONE, "Failed to read the packet\n");
+- dev_kfree_skb(skb);
+- break;
+- }
+- dev_kfree_skb(skb);
+- }
+- } while (1);
+-
+-out:
+ rsi_dbg(INFO_ZONE, "%s: Terminated SDIO RX thread\n", __func__);
+- skb_queue_purge(&sdev->rx_q.head);
+ atomic_inc(&sdev->rx_thread.thread_done);
+ complete_and_exit(&sdev->rx_thread.completion, 0);
+ }
+@@ -113,10 +94,6 @@ static int rsi_process_pkt(struct rsi_common *common)
+ u32 rcv_pkt_len = 0;
+ int status = 0;
+ u8 value = 0;
+- struct sk_buff *skb;
+-
+- if (dev->rx_q.num_rx_pkts >= RSI_MAX_RX_PKTS)
+- return 0;
+
+ num_blks = ((adapter->interrupt_status & 1) |
+ ((adapter->interrupt_status >> RECV_NUM_BLOCKS) << 1));
+@@ -144,22 +121,19 @@ static int rsi_process_pkt(struct rsi_common *common)
+
+ rcv_pkt_len = (num_blks * 256);
+
+- skb = dev_alloc_skb(rcv_pkt_len);
+- if (!skb)
+- return -ENOMEM;
+-
+- status = rsi_sdio_host_intf_read_pkt(adapter, skb->data, rcv_pkt_len);
++ status = rsi_sdio_host_intf_read_pkt(adapter, dev->pktbuffer,
++ rcv_pkt_len);
+ if (status) {
+ rsi_dbg(ERR_ZONE, "%s: Failed to read packet from card\n",
+ __func__);
+- dev_kfree_skb(skb);
+ return status;
+ }
+- skb_put(skb, rcv_pkt_len);
+- skb_queue_tail(&dev->rx_q.head, skb);
+- dev->rx_q.num_rx_pkts++;
+
+- rsi_set_event(&dev->rx_thread.event);
++ status = rsi_read_pkt(common, dev->pktbuffer, rcv_pkt_len);
++ if (status) {
++ rsi_dbg(ERR_ZONE, "Failed to read the packet\n");
++ return status;
++ }
+
+ return 0;
+ }
+@@ -251,12 +225,12 @@ int rsi_init_sdio_slave_regs(struct rsi_hw *adapter)
+ }
+
+ /**
+- * rsi_interrupt_handler() - This function read and process SDIO interrupts.
++ * rsi_rx_handler() - Read and process SDIO interrupts.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: None.
+ */
+-void rsi_interrupt_handler(struct rsi_hw *adapter)
++static void rsi_rx_handler(struct rsi_hw *adapter)
+ {
+ struct rsi_common *common = adapter->priv;
+ struct rsi_91x_sdiodev *dev =
+diff --git a/drivers/net/wireless/rsi/rsi_sdio.h b/drivers/net/wireless/rsi/rsi_sdio.h
+index 66dcd2ec90515..fd11f16fc74f1 100644
+--- a/drivers/net/wireless/rsi/rsi_sdio.h
++++ b/drivers/net/wireless/rsi/rsi_sdio.h
+@@ -110,11 +110,6 @@ struct receive_info {
+ u32 buf_available_counter;
+ };
+
+-struct rsi_sdio_rx_q {
+- u8 num_rx_pkts;
+- struct sk_buff_head head;
+-};
+-
+ struct rsi_91x_sdiodev {
+ struct sdio_func *pfunction;
+ struct task_struct *sdio_irq_task;
+@@ -127,11 +122,10 @@ struct rsi_91x_sdiodev {
+ u16 tx_blk_size;
+ u8 write_fail;
+ bool buff_status_updated;
+- struct rsi_sdio_rx_q rx_q;
+ struct rsi_thread rx_thread;
++ u8 pktbuffer[8192] __aligned(4);
+ };
+
+-void rsi_interrupt_handler(struct rsi_hw *adapter);
+ int rsi_init_sdio_slave_regs(struct rsi_hw *adapter);
+ int rsi_sdio_read_register(struct rsi_hw *adapter, u32 addr, u8 *data);
+ int rsi_sdio_host_intf_read_pkt(struct rsi_hw *adapter, u8 *pkt, u32 length);
+diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
+index 4a4f797bb10f5..e10fff42751ef 100644
+--- a/drivers/net/wireless/ti/wl12xx/main.c
++++ b/drivers/net/wireless/ti/wl12xx/main.c
+@@ -649,7 +649,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
+ wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
+ WLCORE_QUIRK_DUAL_PROBE_TMPL |
+ WLCORE_QUIRK_TKIP_HEADER_SPACE |
+- WLCORE_QUIRK_START_STA_FAILS |
+ WLCORE_QUIRK_AP_ZERO_SESSION_ID;
+ wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
+ wl->mr_fw_name = WL127X_FW_NAME_MULTI;
+@@ -673,7 +672,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
+ wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
+ WLCORE_QUIRK_DUAL_PROBE_TMPL |
+ WLCORE_QUIRK_TKIP_HEADER_SPACE |
+- WLCORE_QUIRK_START_STA_FAILS |
+ WLCORE_QUIRK_AP_ZERO_SESSION_ID;
+ wl->plt_fw_name = WL127X_PLT_FW_NAME;
+ wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
+@@ -702,7 +700,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
+ wl->quirks |= WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN |
+ WLCORE_QUIRK_DUAL_PROBE_TMPL |
+ WLCORE_QUIRK_TKIP_HEADER_SPACE |
+- WLCORE_QUIRK_START_STA_FAILS |
+ WLCORE_QUIRK_AP_ZERO_SESSION_ID;
+
+ wlcore_set_min_fw_ver(wl, WL128X_CHIP_VER,
+diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
+index 43c7b37dec0c9..e24ffdff5bdc1 100644
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -2875,21 +2875,8 @@ static int wlcore_join(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+
+ if (is_ibss)
+ ret = wl12xx_cmd_role_start_ibss(wl, wlvif);
+- else {
+- if (wl->quirks & WLCORE_QUIRK_START_STA_FAILS) {
+- /*
+- * TODO: this is an ugly workaround for wl12xx fw
+- * bug - we are not able to tx/rx after the first
+- * start_sta, so make dummy start+stop calls,
+- * and then call start_sta again.
+- * this should be fixed in the fw.
+- */
+- wl12xx_cmd_role_start_sta(wl, wlvif);
+- wl12xx_cmd_role_stop_sta(wl, wlvif);
+- }
+-
++ else
+ ret = wl12xx_cmd_role_start_sta(wl, wlvif);
+- }
+
+ return ret;
+ }
+diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
+index d4b1f66ef4570..af7cf70b38326 100644
+--- a/drivers/net/wireless/ti/wlcore/wlcore.h
++++ b/drivers/net/wireless/ti/wlcore/wlcore.h
+@@ -559,9 +559,6 @@ wlcore_set_min_fw_ver(struct wl1271 *wl, unsigned int chip,
+ /* Each RX/TX transaction requires an end-of-transaction transfer */
+ #define WLCORE_QUIRK_END_OF_TRANSACTION BIT(0)
+
+-/* the first start_role(sta) sometimes doesn't work on wl12xx */
+-#define WLCORE_QUIRK_START_STA_FAILS BIT(1)
+-
+ /* wl127x and SPI don't support SDIO block size alignment */
+ #define WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN BIT(2)
+
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index b29a1b279fff4..41bdfb684d468 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -1326,11 +1326,21 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget)
+ return 0;
+
+ gnttab_batch_copy(queue->tx_copy_ops, nr_cops);
+- if (nr_mops != 0)
++ if (nr_mops != 0) {
+ ret = gnttab_map_refs(queue->tx_map_ops,
+ NULL,
+ queue->pages_to_map,
+ nr_mops);
++ if (ret) {
++ unsigned int i;
++
++ netdev_err(queue->vif->dev, "Map fail: nr %u ret %d\n",
++ nr_mops, ret);
++ for (i = 0; i < nr_mops; ++i)
++ WARN_ON_ONCE(queue->tx_map_ops[i].status ==
++ GNTST_okay);
++ }
++ }
+
+ work_done = xenvif_tx_submit(queue);
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index cd628dd73719b..83fda1987d1f9 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -3361,7 +3361,14 @@ u32 pci_rebar_get_possible_sizes(struct pci_dev *pdev, int bar)
+ return 0;
+
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CAP, &cap);
+- return (cap & PCI_REBAR_CAP_SIZES) >> 4;
++ cap &= PCI_REBAR_CAP_SIZES;
++
++ /* Sapphire RX 5600 XT Pulse has an invalid cap dword for BAR 0 */
++ if (pdev->vendor == PCI_VENDOR_ID_ATI && pdev->device == 0x731f &&
++ bar == 0 && cap == 0x7000)
++ cap = 0x3f000;
++
++ return cap >> 4;
+ }
+
+ /**
+diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
+index 67efdf25657f3..0447ae2781ba1 100644
+--- a/drivers/s390/virtio/virtio_ccw.c
++++ b/drivers/s390/virtio/virtio_ccw.c
+@@ -103,7 +103,7 @@ struct virtio_rev_info {
+ };
+
+ /* the highest virtio-ccw revision we support */
+-#define VIRTIO_CCW_REV_MAX 1
++#define VIRTIO_CCW_REV_MAX 2
+
+ struct virtio_ccw_vq_info {
+ struct virtqueue *vq;
+@@ -911,7 +911,7 @@ static u8 virtio_ccw_get_status(struct virtio_device *vdev)
+ u8 old_status = *vcdev->status;
+ struct ccw1 *ccw;
+
+- if (vcdev->revision < 1)
++ if (vcdev->revision < 2)
+ return *vcdev->status;
+
+ ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 1c69515e870cb..2e40fd78e7b3f 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -3368,125 +3368,125 @@ int iscsi_session_get_param(struct iscsi_cls_session *cls_session,
+
+ switch(param) {
+ case ISCSI_PARAM_FAST_ABORT:
+- len = sprintf(buf, "%d\n", session->fast_abort);
++ len = sysfs_emit(buf, "%d\n", session->fast_abort);
+ break;
+ case ISCSI_PARAM_ABORT_TMO:
+- len = sprintf(buf, "%d\n", session->abort_timeout);
++ len = sysfs_emit(buf, "%d\n", session->abort_timeout);
+ break;
+ case ISCSI_PARAM_LU_RESET_TMO:
+- len = sprintf(buf, "%d\n", session->lu_reset_timeout);
++ len = sysfs_emit(buf, "%d\n", session->lu_reset_timeout);
+ break;
+ case ISCSI_PARAM_TGT_RESET_TMO:
+- len = sprintf(buf, "%d\n", session->tgt_reset_timeout);
++ len = sysfs_emit(buf, "%d\n", session->tgt_reset_timeout);
+ break;
+ case ISCSI_PARAM_INITIAL_R2T_EN:
+- len = sprintf(buf, "%d\n", session->initial_r2t_en);
++ len = sysfs_emit(buf, "%d\n", session->initial_r2t_en);
+ break;
+ case ISCSI_PARAM_MAX_R2T:
+- len = sprintf(buf, "%hu\n", session->max_r2t);
++ len = sysfs_emit(buf, "%hu\n", session->max_r2t);
+ break;
+ case ISCSI_PARAM_IMM_DATA_EN:
+- len = sprintf(buf, "%d\n", session->imm_data_en);
++ len = sysfs_emit(buf, "%d\n", session->imm_data_en);
+ break;
+ case ISCSI_PARAM_FIRST_BURST:
+- len = sprintf(buf, "%u\n", session->first_burst);
++ len = sysfs_emit(buf, "%u\n", session->first_burst);
+ break;
+ case ISCSI_PARAM_MAX_BURST:
+- len = sprintf(buf, "%u\n", session->max_burst);
++ len = sysfs_emit(buf, "%u\n", session->max_burst);
+ break;
+ case ISCSI_PARAM_PDU_INORDER_EN:
+- len = sprintf(buf, "%d\n", session->pdu_inorder_en);
++ len = sysfs_emit(buf, "%d\n", session->pdu_inorder_en);
+ break;
+ case ISCSI_PARAM_DATASEQ_INORDER_EN:
+- len = sprintf(buf, "%d\n", session->dataseq_inorder_en);
++ len = sysfs_emit(buf, "%d\n", session->dataseq_inorder_en);
+ break;
+ case ISCSI_PARAM_DEF_TASKMGMT_TMO:
+- len = sprintf(buf, "%d\n", session->def_taskmgmt_tmo);
++ len = sysfs_emit(buf, "%d\n", session->def_taskmgmt_tmo);
+ break;
+ case ISCSI_PARAM_ERL:
+- len = sprintf(buf, "%d\n", session->erl);
++ len = sysfs_emit(buf, "%d\n", session->erl);
+ break;
+ case ISCSI_PARAM_TARGET_NAME:
+- len = sprintf(buf, "%s\n", session->targetname);
++ len = sysfs_emit(buf, "%s\n", session->targetname);
+ break;
+ case ISCSI_PARAM_TARGET_ALIAS:
+- len = sprintf(buf, "%s\n", session->targetalias);
++ len = sysfs_emit(buf, "%s\n", session->targetalias);
+ break;
+ case ISCSI_PARAM_TPGT:
+- len = sprintf(buf, "%d\n", session->tpgt);
++ len = sysfs_emit(buf, "%d\n", session->tpgt);
+ break;
+ case ISCSI_PARAM_USERNAME:
+- len = sprintf(buf, "%s\n", session->username);
++ len = sysfs_emit(buf, "%s\n", session->username);
+ break;
+ case ISCSI_PARAM_USERNAME_IN:
+- len = sprintf(buf, "%s\n", session->username_in);
++ len = sysfs_emit(buf, "%s\n", session->username_in);
+ break;
+ case ISCSI_PARAM_PASSWORD:
+- len = sprintf(buf, "%s\n", session->password);
++ len = sysfs_emit(buf, "%s\n", session->password);
+ break;
+ case ISCSI_PARAM_PASSWORD_IN:
+- len = sprintf(buf, "%s\n", session->password_in);
++ len = sysfs_emit(buf, "%s\n", session->password_in);
+ break;
+ case ISCSI_PARAM_IFACE_NAME:
+- len = sprintf(buf, "%s\n", session->ifacename);
++ len = sysfs_emit(buf, "%s\n", session->ifacename);
+ break;
+ case ISCSI_PARAM_INITIATOR_NAME:
+- len = sprintf(buf, "%s\n", session->initiatorname);
++ len = sysfs_emit(buf, "%s\n", session->initiatorname);
+ break;
+ case ISCSI_PARAM_BOOT_ROOT:
+- len = sprintf(buf, "%s\n", session->boot_root);
++ len = sysfs_emit(buf, "%s\n", session->boot_root);
+ break;
+ case ISCSI_PARAM_BOOT_NIC:
+- len = sprintf(buf, "%s\n", session->boot_nic);
++ len = sysfs_emit(buf, "%s\n", session->boot_nic);
+ break;
+ case ISCSI_PARAM_BOOT_TARGET:
+- len = sprintf(buf, "%s\n", session->boot_target);
++ len = sysfs_emit(buf, "%s\n", session->boot_target);
+ break;
+ case ISCSI_PARAM_AUTO_SND_TGT_DISABLE:
+- len = sprintf(buf, "%u\n", session->auto_snd_tgt_disable);
++ len = sysfs_emit(buf, "%u\n", session->auto_snd_tgt_disable);
+ break;
+ case ISCSI_PARAM_DISCOVERY_SESS:
+- len = sprintf(buf, "%u\n", session->discovery_sess);
++ len = sysfs_emit(buf, "%u\n", session->discovery_sess);
+ break;
+ case ISCSI_PARAM_PORTAL_TYPE:
+- len = sprintf(buf, "%s\n", session->portal_type);
++ len = sysfs_emit(buf, "%s\n", session->portal_type);
+ break;
+ case ISCSI_PARAM_CHAP_AUTH_EN:
+- len = sprintf(buf, "%u\n", session->chap_auth_en);
++ len = sysfs_emit(buf, "%u\n", session->chap_auth_en);
+ break;
+ case ISCSI_PARAM_DISCOVERY_LOGOUT_EN:
+- len = sprintf(buf, "%u\n", session->discovery_logout_en);
++ len = sysfs_emit(buf, "%u\n", session->discovery_logout_en);
+ break;
+ case ISCSI_PARAM_BIDI_CHAP_EN:
+- len = sprintf(buf, "%u\n", session->bidi_chap_en);
++ len = sysfs_emit(buf, "%u\n", session->bidi_chap_en);
+ break;
+ case ISCSI_PARAM_DISCOVERY_AUTH_OPTIONAL:
+- len = sprintf(buf, "%u\n", session->discovery_auth_optional);
++ len = sysfs_emit(buf, "%u\n", session->discovery_auth_optional);
+ break;
+ case ISCSI_PARAM_DEF_TIME2WAIT:
+- len = sprintf(buf, "%d\n", session->time2wait);
++ len = sysfs_emit(buf, "%d\n", session->time2wait);
+ break;
+ case ISCSI_PARAM_DEF_TIME2RETAIN:
+- len = sprintf(buf, "%d\n", session->time2retain);
++ len = sysfs_emit(buf, "%d\n", session->time2retain);
+ break;
+ case ISCSI_PARAM_TSID:
+- len = sprintf(buf, "%u\n", session->tsid);
++ len = sysfs_emit(buf, "%u\n", session->tsid);
+ break;
+ case ISCSI_PARAM_ISID:
+- len = sprintf(buf, "%02x%02x%02x%02x%02x%02x\n",
++ len = sysfs_emit(buf, "%02x%02x%02x%02x%02x%02x\n",
+ session->isid[0], session->isid[1],
+ session->isid[2], session->isid[3],
+ session->isid[4], session->isid[5]);
+ break;
+ case ISCSI_PARAM_DISCOVERY_PARENT_IDX:
+- len = sprintf(buf, "%u\n", session->discovery_parent_idx);
++ len = sysfs_emit(buf, "%u\n", session->discovery_parent_idx);
+ break;
+ case ISCSI_PARAM_DISCOVERY_PARENT_TYPE:
+ if (session->discovery_parent_type)
+- len = sprintf(buf, "%s\n",
++ len = sysfs_emit(buf, "%s\n",
+ session->discovery_parent_type);
+ else
+- len = sprintf(buf, "\n");
++ len = sysfs_emit(buf, "\n");
+ break;
+ default:
+ return -ENOSYS;
+@@ -3518,16 +3518,16 @@ int iscsi_conn_get_addr_param(struct sockaddr_storage *addr,
+ case ISCSI_PARAM_CONN_ADDRESS:
+ case ISCSI_HOST_PARAM_IPADDRESS:
+ if (sin)
+- len = sprintf(buf, "%pI4\n", &sin->sin_addr.s_addr);
++ len = sysfs_emit(buf, "%pI4\n", &sin->sin_addr.s_addr);
+ else
+- len = sprintf(buf, "%pI6\n", &sin6->sin6_addr);
++ len = sysfs_emit(buf, "%pI6\n", &sin6->sin6_addr);
+ break;
+ case ISCSI_PARAM_CONN_PORT:
+ case ISCSI_PARAM_LOCAL_PORT:
+ if (sin)
+- len = sprintf(buf, "%hu\n", be16_to_cpu(sin->sin_port));
++ len = sysfs_emit(buf, "%hu\n", be16_to_cpu(sin->sin_port));
+ else
+- len = sprintf(buf, "%hu\n",
++ len = sysfs_emit(buf, "%hu\n",
+ be16_to_cpu(sin6->sin6_port));
+ break;
+ default:
+@@ -3546,88 +3546,88 @@ int iscsi_conn_get_param(struct iscsi_cls_conn *cls_conn,
+
+ switch(param) {
+ case ISCSI_PARAM_PING_TMO:
+- len = sprintf(buf, "%u\n", conn->ping_timeout);
++ len = sysfs_emit(buf, "%u\n", conn->ping_timeout);
+ break;
+ case ISCSI_PARAM_RECV_TMO:
+- len = sprintf(buf, "%u\n", conn->recv_timeout);
++ len = sysfs_emit(buf, "%u\n", conn->recv_timeout);
+ break;
+ case ISCSI_PARAM_MAX_RECV_DLENGTH:
+- len = sprintf(buf, "%u\n", conn->max_recv_dlength);
++ len = sysfs_emit(buf, "%u\n", conn->max_recv_dlength);
+ break;
+ case ISCSI_PARAM_MAX_XMIT_DLENGTH:
+- len = sprintf(buf, "%u\n", conn->max_xmit_dlength);
++ len = sysfs_emit(buf, "%u\n", conn->max_xmit_dlength);
+ break;
+ case ISCSI_PARAM_HDRDGST_EN:
+- len = sprintf(buf, "%d\n", conn->hdrdgst_en);
++ len = sysfs_emit(buf, "%d\n", conn->hdrdgst_en);
+ break;
+ case ISCSI_PARAM_DATADGST_EN:
+- len = sprintf(buf, "%d\n", conn->datadgst_en);
++ len = sysfs_emit(buf, "%d\n", conn->datadgst_en);
+ break;
+ case ISCSI_PARAM_IFMARKER_EN:
+- len = sprintf(buf, "%d\n", conn->ifmarker_en);
++ len = sysfs_emit(buf, "%d\n", conn->ifmarker_en);
+ break;
+ case ISCSI_PARAM_OFMARKER_EN:
+- len = sprintf(buf, "%d\n", conn->ofmarker_en);
++ len = sysfs_emit(buf, "%d\n", conn->ofmarker_en);
+ break;
+ case ISCSI_PARAM_EXP_STATSN:
+- len = sprintf(buf, "%u\n", conn->exp_statsn);
++ len = sysfs_emit(buf, "%u\n", conn->exp_statsn);
+ break;
+ case ISCSI_PARAM_PERSISTENT_PORT:
+- len = sprintf(buf, "%d\n", conn->persistent_port);
++ len = sysfs_emit(buf, "%d\n", conn->persistent_port);
+ break;
+ case ISCSI_PARAM_PERSISTENT_ADDRESS:
+- len = sprintf(buf, "%s\n", conn->persistent_address);
++ len = sysfs_emit(buf, "%s\n", conn->persistent_address);
+ break;
+ case ISCSI_PARAM_STATSN:
+- len = sprintf(buf, "%u\n", conn->statsn);
++ len = sysfs_emit(buf, "%u\n", conn->statsn);
+ break;
+ case ISCSI_PARAM_MAX_SEGMENT_SIZE:
+- len = sprintf(buf, "%u\n", conn->max_segment_size);
++ len = sysfs_emit(buf, "%u\n", conn->max_segment_size);
+ break;
+ case ISCSI_PARAM_KEEPALIVE_TMO:
+- len = sprintf(buf, "%u\n", conn->keepalive_tmo);
++ len = sysfs_emit(buf, "%u\n", conn->keepalive_tmo);
+ break;
+ case ISCSI_PARAM_LOCAL_PORT:
+- len = sprintf(buf, "%u\n", conn->local_port);
++ len = sysfs_emit(buf, "%u\n", conn->local_port);
+ break;
+ case ISCSI_PARAM_TCP_TIMESTAMP_STAT:
+- len = sprintf(buf, "%u\n", conn->tcp_timestamp_stat);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_timestamp_stat);
+ break;
+ case ISCSI_PARAM_TCP_NAGLE_DISABLE:
+- len = sprintf(buf, "%u\n", conn->tcp_nagle_disable);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_nagle_disable);
+ break;
+ case ISCSI_PARAM_TCP_WSF_DISABLE:
+- len = sprintf(buf, "%u\n", conn->tcp_wsf_disable);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_wsf_disable);
+ break;
+ case ISCSI_PARAM_TCP_TIMER_SCALE:
+- len = sprintf(buf, "%u\n", conn->tcp_timer_scale);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_timer_scale);
+ break;
+ case ISCSI_PARAM_TCP_TIMESTAMP_EN:
+- len = sprintf(buf, "%u\n", conn->tcp_timestamp_en);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_timestamp_en);
+ break;
+ case ISCSI_PARAM_IP_FRAGMENT_DISABLE:
+- len = sprintf(buf, "%u\n", conn->fragment_disable);
++ len = sysfs_emit(buf, "%u\n", conn->fragment_disable);
+ break;
+ case ISCSI_PARAM_IPV4_TOS:
+- len = sprintf(buf, "%u\n", conn->ipv4_tos);
++ len = sysfs_emit(buf, "%u\n", conn->ipv4_tos);
+ break;
+ case ISCSI_PARAM_IPV6_TC:
+- len = sprintf(buf, "%u\n", conn->ipv6_traffic_class);
++ len = sysfs_emit(buf, "%u\n", conn->ipv6_traffic_class);
+ break;
+ case ISCSI_PARAM_IPV6_FLOW_LABEL:
+- len = sprintf(buf, "%u\n", conn->ipv6_flow_label);
++ len = sysfs_emit(buf, "%u\n", conn->ipv6_flow_label);
+ break;
+ case ISCSI_PARAM_IS_FW_ASSIGNED_IPV6:
+- len = sprintf(buf, "%u\n", conn->is_fw_assigned_ipv6);
++ len = sysfs_emit(buf, "%u\n", conn->is_fw_assigned_ipv6);
+ break;
+ case ISCSI_PARAM_TCP_XMIT_WSF:
+- len = sprintf(buf, "%u\n", conn->tcp_xmit_wsf);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_xmit_wsf);
+ break;
+ case ISCSI_PARAM_TCP_RECV_WSF:
+- len = sprintf(buf, "%u\n", conn->tcp_recv_wsf);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_recv_wsf);
+ break;
+ case ISCSI_PARAM_LOCAL_IPADDR:
+- len = sprintf(buf, "%s\n", conn->local_ipaddr);
++ len = sysfs_emit(buf, "%s\n", conn->local_ipaddr);
+ break;
+ default:
+ return -ENOSYS;
+@@ -3645,13 +3645,13 @@ int iscsi_host_get_param(struct Scsi_Host *shost, enum iscsi_host_param param,
+
+ switch (param) {
+ case ISCSI_HOST_PARAM_NETDEV_NAME:
+- len = sprintf(buf, "%s\n", ihost->netdev);
++ len = sysfs_emit(buf, "%s\n", ihost->netdev);
+ break;
+ case ISCSI_HOST_PARAM_HWADDRESS:
+- len = sprintf(buf, "%s\n", ihost->hwaddress);
++ len = sysfs_emit(buf, "%s\n", ihost->hwaddress);
+ break;
+ case ISCSI_HOST_PARAM_INITIATOR_NAME:
+- len = sprintf(buf, "%s\n", ihost->initiatorname);
++ len = sysfs_emit(buf, "%s\n", ihost->initiatorname);
+ break;
+ default:
+ return -ENOSYS;
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 6983473011980..e340b05278b63 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -119,7 +119,11 @@ show_transport_handle(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+ struct iscsi_internal *priv = dev_to_iscsi_internal(dev);
+- return sprintf(buf, "%llu\n", (unsigned long long)iscsi_handle(priv->iscsi_transport));
++
++ if (!capable(CAP_SYS_ADMIN))
++ return -EACCES;
++ return sysfs_emit(buf, "%llu\n",
++ (unsigned long long)iscsi_handle(priv->iscsi_transport));
+ }
+ static DEVICE_ATTR(handle, S_IRUGO, show_transport_handle, NULL);
+
+@@ -129,7 +133,7 @@ show_transport_##name(struct device *dev, \
+ struct device_attribute *attr,char *buf) \
+ { \
+ struct iscsi_internal *priv = dev_to_iscsi_internal(dev); \
+- return sprintf(buf, format"\n", priv->iscsi_transport->name); \
++ return sysfs_emit(buf, format"\n", priv->iscsi_transport->name);\
+ } \
+ static DEVICE_ATTR(name, S_IRUGO, show_transport_##name, NULL);
+
+@@ -170,7 +174,7 @@ static ssize_t
+ show_ep_handle(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+ struct iscsi_endpoint *ep = iscsi_dev_to_endpoint(dev);
+- return sprintf(buf, "%llu\n", (unsigned long long) ep->id);
++ return sysfs_emit(buf, "%llu\n", (unsigned long long) ep->id);
+ }
+ static ISCSI_ATTR(ep, handle, S_IRUGO, show_ep_handle, NULL);
+
+@@ -2763,6 +2767,9 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+ struct iscsi_cls_session *session;
+ int err = 0, value = 0;
+
++ if (ev->u.set_param.len > PAGE_SIZE)
++ return -EINVAL;
++
+ session = iscsi_session_lookup(ev->u.set_param.sid);
+ conn = iscsi_conn_lookup(ev->u.set_param.sid, ev->u.set_param.cid);
+ if (!conn || !session)
+@@ -2910,6 +2917,9 @@ iscsi_set_host_param(struct iscsi_transport *transport,
+ if (!transport->set_host_param)
+ return -ENOSYS;
+
++ if (ev->u.set_host_param.len > PAGE_SIZE)
++ return -EINVAL;
++
+ shost = scsi_host_lookup(ev->u.set_host_param.host_no);
+ if (!shost) {
+ printk(KERN_ERR "set_host_param could not find host no %u\n",
+@@ -3497,6 +3507,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
+ {
+ int err = 0;
+ u32 portid;
++ u32 pdu_len;
+ struct iscsi_uevent *ev = nlmsg_data(nlh);
+ struct iscsi_transport *transport = NULL;
+ struct iscsi_internal *priv;
+@@ -3504,6 +3515,9 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
+ struct iscsi_cls_conn *conn;
+ struct iscsi_endpoint *ep = NULL;
+
++ if (!netlink_capable(skb, CAP_SYS_ADMIN))
++ return -EPERM;
++
+ if (nlh->nlmsg_type == ISCSI_UEVENT_PATH_UPDATE)
+ *group = ISCSI_NL_GRP_UIP;
+ else
+@@ -3611,6 +3625,14 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
+ err = -EINVAL;
+ break;
+ case ISCSI_UEVENT_SEND_PDU:
++ pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev);
++
++ if ((ev->u.send_pdu.hdr_size > pdu_len) ||
++ (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) {
++ err = -EINVAL;
++ break;
++ }
++
+ conn = iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid);
+ if (conn)
+ ev->r.retcode = transport->send_pdu(conn,
+@@ -4017,7 +4039,7 @@ show_priv_session_state(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+ struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent);
+- return sprintf(buf, "%s\n", iscsi_session_state_name(session->state));
++ return sysfs_emit(buf, "%s\n", iscsi_session_state_name(session->state));
+ }
+ static ISCSI_CLASS_ATTR(priv_sess, state, S_IRUGO, show_priv_session_state,
+ NULL);
+@@ -4026,7 +4048,7 @@ show_priv_session_creator(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+ struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent);
+- return sprintf(buf, "%d\n", session->creator);
++ return sysfs_emit(buf, "%d\n", session->creator);
+ }
+ static ISCSI_CLASS_ATTR(priv_sess, creator, S_IRUGO, show_priv_session_creator,
+ NULL);
+@@ -4035,7 +4057,7 @@ show_priv_session_target_id(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+ struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent);
+- return sprintf(buf, "%d\n", session->target_id);
++ return sysfs_emit(buf, "%d\n", session->target_id);
+ }
+ static ISCSI_CLASS_ATTR(priv_sess, target_id, S_IRUGO,
+ show_priv_session_target_id, NULL);
+@@ -4048,8 +4070,8 @@ show_priv_session_##field(struct device *dev, \
+ struct iscsi_cls_session *session = \
+ iscsi_dev_to_session(dev->parent); \
+ if (session->field == -1) \
+- return sprintf(buf, "off\n"); \
+- return sprintf(buf, format"\n", session->field); \
++ return sysfs_emit(buf, "off\n"); \
++ return sysfs_emit(buf, format"\n", session->field); \
+ }
+
+ #define iscsi_priv_session_attr_store(field) \
+diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c
+index fa0dd425b4549..cd062628a46b0 100644
+--- a/drivers/staging/fwserial/fwserial.c
++++ b/drivers/staging/fwserial/fwserial.c
+@@ -2219,6 +2219,7 @@ static int fwserial_create(struct fw_unit *unit)
+ err = fw_core_add_address_handler(&port->rx_handler,
+ &fw_high_memory_region);
+ if (err) {
++ tty_port_destroy(&port->port);
+ kfree(port);
+ goto free_ports;
+ }
+@@ -2301,6 +2302,7 @@ unregister_ttys:
+
+ free_ports:
+ for (--i; i >= 0; --i) {
++ fw_core_remove_address_handler(&serial->ports[i]->rx_handler);
+ tty_port_destroy(&serial->ports[i]->port);
+ kfree(serial->ports[i]);
+ }
+diff --git a/drivers/staging/most/sound/sound.c b/drivers/staging/most/sound/sound.c
+index 89b02fc305b8b..fd9245d7eeb9a 100644
+--- a/drivers/staging/most/sound/sound.c
++++ b/drivers/staging/most/sound/sound.c
+@@ -86,6 +86,8 @@ static void swap_copy24(u8 *dest, const u8 *source, unsigned int bytes)
+ {
+ unsigned int i = 0;
+
++ if (bytes < 2)
++ return;
+ while (i < bytes - 2) {
+ dest[i] = source[i + 2];
+ dest[i + 1] = source[i + 1];
+diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
+index 7c7ada0b3ea00..90c6e10b1ef96 100644
+--- a/drivers/tty/vt/consolemap.c
++++ b/drivers/tty/vt/consolemap.c
+@@ -495,7 +495,7 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos)
+
+ p2[unicode & 0x3f] = fontpos;
+
+- p->sum += (fontpos << 20) + unicode;
++ p->sum += (fontpos << 20U) + unicode;
+
+ return 0;
+ }
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index 5a0d6fb02bbc5..f7823aa99340d 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -1020,6 +1020,7 @@ static void dlfb_ops_destroy(struct fb_info *info)
+ }
+ vfree(dlfb->backing_buffer);
+ kfree(dlfb->edid);
++ dlfb_free_urb_list(dlfb);
+ usb_put_dev(dlfb->udev);
+ kfree(dlfb);
+
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 8829d89eb4aff..1b52c960682d6 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1249,7 +1249,6 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)
+ struct btrfs_root *gang[8];
+ int i;
+ int ret;
+- int err = 0;
+
+ spin_lock(&fs_info->fs_roots_radix_lock);
+ while (1) {
+@@ -1261,6 +1260,8 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)
+ break;
+ for (i = 0; i < ret; i++) {
+ struct btrfs_root *root = gang[i];
++ int ret2;
++
+ radix_tree_tag_clear(&fs_info->fs_roots_radix,
+ (unsigned long)root->root_key.objectid,
+ BTRFS_ROOT_TRANS_TAG);
+@@ -1282,17 +1283,17 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)
+ root->node);
+ }
+
+- err = btrfs_update_root(trans, fs_info->tree_root,
++ ret2 = btrfs_update_root(trans, fs_info->tree_root,
+ &root->root_key,
+ &root->root_item);
++ if (ret2)
++ return ret2;
+ spin_lock(&fs_info->fs_roots_radix_lock);
+- if (err)
+- break;
+ btrfs_qgroup_free_meta_all_pertrans(root);
+ }
+ }
+ spin_unlock(&fs_info->fs_roots_radix_lock);
+- return err;
++ return 0;
+ }
+
+ /*
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index 8617e742d0878..e20a0f9e68455 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -772,7 +772,11 @@ static int __f2fs_tmpfile(struct inode *dir, struct dentry *dentry,
+
+ if (whiteout) {
+ f2fs_i_links_write(inode, false);
++
++ spin_lock(&inode->i_lock);
+ inode->i_state |= I_LINKABLE;
++ spin_unlock(&inode->i_lock);
++
+ *whiteout = inode;
+ } else {
+ d_tmpfile(dentry, inode);
+@@ -966,7 +970,11 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ err = f2fs_add_link(old_dentry, whiteout);
+ if (err)
+ goto put_out_dir;
++
++ spin_lock(&whiteout->i_lock);
+ whiteout->i_state &= ~I_LINKABLE;
++ spin_unlock(&whiteout->i_lock);
++
+ iput(whiteout);
+ }
+
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index 9c2a55ad61bc5..1f5db4cbc499e 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -91,11 +91,11 @@
+ #define BLKS_PER_SEC(sbi) \
+ ((sbi)->segs_per_sec * (sbi)->blocks_per_seg)
+ #define GET_SEC_FROM_SEG(sbi, segno) \
+- ((segno) / (sbi)->segs_per_sec)
++ (((segno) == -1) ? -1: (segno) / (sbi)->segs_per_sec)
+ #define GET_SEG_FROM_SEC(sbi, secno) \
+ ((secno) * (sbi)->segs_per_sec)
+ #define GET_ZONE_FROM_SEC(sbi, secno) \
+- ((secno) / (sbi)->secs_per_zone)
++ (((secno) == -1) ? -1: (secno) / (sbi)->secs_per_zone)
+ #define GET_ZONE_FROM_SEG(sbi, segno) \
+ GET_ZONE_FROM_SEC(sbi, GET_SEC_FROM_SEG(sbi, segno))
+
+diff --git a/fs/jfs/jfs_filsys.h b/fs/jfs/jfs_filsys.h
+index b67d64671bb40..415bfa90607a2 100644
+--- a/fs/jfs/jfs_filsys.h
++++ b/fs/jfs/jfs_filsys.h
+@@ -281,5 +281,6 @@
+ * fsck() must be run to repair
+ */
+ #define FM_EXTENDFS 0x00000008 /* file system extendfs() in progress */
++#define FM_STATE_MAX 0x0000000f /* max value of s_state */
+
+ #endif /* _H_JFS_FILSYS */
+diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
+index d8658607bf468..b5214c9ac47ac 100644
+--- a/fs/jfs/jfs_mount.c
++++ b/fs/jfs/jfs_mount.c
+@@ -49,6 +49,7 @@
+
+ #include <linux/fs.h>
+ #include <linux/buffer_head.h>
++#include <linux/log2.h>
+
+ #include "jfs_incore.h"
+ #include "jfs_filsys.h"
+@@ -378,6 +379,15 @@ static int chkSuper(struct super_block *sb)
+ sbi->bsize = bsize;
+ sbi->l2bsize = le16_to_cpu(j_sb->s_l2bsize);
+
++ /* check some fields for possible corruption */
++ if (sbi->l2bsize != ilog2((u32)bsize) ||
++ j_sb->pad != 0 ||
++ le32_to_cpu(j_sb->s_state) > FM_STATE_MAX) {
++ rc = -EINVAL;
++ jfs_err("jfs_mount: Mount Failure: superblock is corrupt!");
++ goto out;
++ }
++
+ /*
+ * For now, ignore s_pbsize, l2bfactor. All I/O going through buffer
+ * cache.
+diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
+index 0a7252aecfa53..5166eb40917da 100644
+--- a/fs/sysfs/file.c
++++ b/fs/sysfs/file.c
+@@ -15,6 +15,7 @@
+ #include <linux/list.h>
+ #include <linux/mutex.h>
+ #include <linux/seq_file.h>
++#include <linux/mm.h>
+
+ #include "sysfs.h"
+ #include "../kernfs/kernfs-internal.h"
+@@ -556,3 +557,57 @@ void sysfs_remove_bin_file(struct kobject *kobj,
+ kernfs_remove_by_name(kobj->sd, attr->attr.name);
+ }
+ EXPORT_SYMBOL_GPL(sysfs_remove_bin_file);
++
++/**
++ * sysfs_emit - scnprintf equivalent, aware of PAGE_SIZE buffer.
++ * @buf: start of PAGE_SIZE buffer.
++ * @fmt: format
++ * @...: optional arguments to @format
++ *
++ *
++ * Returns number of characters written to @buf.
++ */
++int sysfs_emit(char *buf, const char *fmt, ...)
++{
++ va_list args;
++ int len;
++
++ if (WARN(!buf || offset_in_page(buf),
++ "invalid sysfs_emit: buf:%p\n", buf))
++ return 0;
++
++ va_start(args, fmt);
++ len = vscnprintf(buf, PAGE_SIZE, fmt, args);
++ va_end(args);
++
++ return len;
++}
++EXPORT_SYMBOL_GPL(sysfs_emit);
++
++/**
++ * sysfs_emit_at - scnprintf equivalent, aware of PAGE_SIZE buffer.
++ * @buf: start of PAGE_SIZE buffer.
++ * @at: offset in @buf to start write in bytes
++ * @at must be >= 0 && < PAGE_SIZE
++ * @fmt: format
++ * @...: optional arguments to @fmt
++ *
++ *
++ * Returns number of characters written starting at &@buf[@at].
++ */
++int sysfs_emit_at(char *buf, int at, const char *fmt, ...)
++{
++ va_list args;
++ int len;
++
++ if (WARN(!buf || offset_in_page(buf) || at < 0 || at >= PAGE_SIZE,
++ "invalid sysfs_emit_at: buf:%p at:%d\n", buf, at))
++ return 0;
++
++ va_start(args, fmt);
++ len = vscnprintf(buf + at, PAGE_SIZE - at, fmt, args);
++ va_end(args);
++
++ return len;
++}
++EXPORT_SYMBOL_GPL(sysfs_emit_at);
+diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
+index 948ac1290121b..6011086b51deb 100644
+--- a/fs/xfs/xfs_iops.c
++++ b/fs/xfs/xfs_iops.c
+@@ -849,7 +849,7 @@ xfs_setattr_size(
+ ASSERT(xfs_isilocked(ip, XFS_MMAPLOCK_EXCL));
+ ASSERT(S_ISREG(inode->i_mode));
+ ASSERT((iattr->ia_valid & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET|
+- ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0);
++ ATTR_MTIME_SET|ATTR_TIMES_SET)) == 0);
+
+ oldsize = inode->i_size;
+ newsize = iattr->ia_size;
+diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
+index 987cefa337de6..1cd7bad56075b 100644
+--- a/include/linux/sysfs.h
++++ b/include/linux/sysfs.h
+@@ -299,6 +299,11 @@ static inline void sysfs_enable_ns(struct kernfs_node *kn)
+ return kernfs_enable_ns(kn);
+ }
+
++__printf(2, 3)
++int sysfs_emit(char *buf, const char *fmt, ...);
++__printf(3, 4)
++int sysfs_emit_at(char *buf, int at, const char *fmt, ...);
++
+ #else /* CONFIG_SYSFS */
+
+ static inline int sysfs_create_dir_ns(struct kobject *kobj, const void *ns)
+@@ -505,6 +510,17 @@ static inline void sysfs_enable_ns(struct kernfs_node *kn)
+ {
+ }
+
++__printf(2, 3)
++static inline int sysfs_emit(char *buf, const char *fmt, ...)
++{
++ return 0;
++}
++
++__printf(3, 4)
++static inline int sysfs_emit_at(char *buf, int at, const char *fmt, ...)
++{
++ return 0;
++}
+ #endif /* CONFIG_SYSFS */
+
+ static inline int __must_check sysfs_create_file(struct kobject *kobj,
+diff --git a/include/linux/zsmalloc.h b/include/linux/zsmalloc.h
+index 2219cce81ca48..4638dddc040be 100644
+--- a/include/linux/zsmalloc.h
++++ b/include/linux/zsmalloc.h
+@@ -36,7 +36,7 @@ enum zs_mapmode {
+
+ struct zs_pool_stats {
+ /* How many pages were migrated (freed) */
+- unsigned long pages_compacted;
++ atomic_long_t pages_compacted;
+ };
+
+ struct zs_pool;
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 9eb5c25fabc9e..f37a821dc5ce2 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1171,14 +1171,16 @@ static inline void destroy_compound_gigantic_page(struct page *page,
+ static void update_and_free_page(struct hstate *h, struct page *page)
+ {
+ int i;
++ struct page *subpage = page;
+
+ if (hstate_is_gigantic(h) && !gigantic_page_supported())
+ return;
+
+ h->nr_huge_pages--;
+ h->nr_huge_pages_node[page_to_nid(page)]--;
+- for (i = 0; i < pages_per_huge_page(h); i++) {
+- page[i].flags &= ~(1 << PG_locked | 1 << PG_error |
++ for (i = 0; i < pages_per_huge_page(h);
++ i++, subpage = mem_map_next(subpage, page, i)) {
++ subpage->flags &= ~(1 << PG_locked | 1 << PG_error |
+ 1 << PG_referenced | 1 << PG_dirty |
+ 1 << PG_active | 1 << PG_private |
+ 1 << PG_writeback);
+@@ -4704,21 +4706,23 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr)
+ void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
+ unsigned long *start, unsigned long *end)
+ {
+- unsigned long a_start, a_end;
++ unsigned long v_start = ALIGN(vma->vm_start, PUD_SIZE),
++ v_end = ALIGN_DOWN(vma->vm_end, PUD_SIZE);
+
+- if (!(vma->vm_flags & VM_MAYSHARE))
++ /*
++ * vma need span at least one aligned PUD size and the start,end range
++ * must at least partialy within it.
++ */
++ if (!(vma->vm_flags & VM_MAYSHARE) || !(v_end > v_start) ||
++ (*end <= v_start) || (*start >= v_end))
+ return;
+
+ /* Extend the range to be PUD aligned for a worst case scenario */
+- a_start = ALIGN_DOWN(*start, PUD_SIZE);
+- a_end = ALIGN(*end, PUD_SIZE);
++ if (*start > v_start)
++ *start = ALIGN_DOWN(*start, PUD_SIZE);
+
+- /*
+- * Intersect the range with the vma range, since pmd sharing won't be
+- * across vma after all
+- */
+- *start = max(vma->vm_start, a_start);
+- *end = min(vma->vm_end, a_end);
++ if (*end < v_end)
++ *end = ALIGN(*end, PUD_SIZE);
+ }
+
+ /*
+diff --git a/mm/page_io.c b/mm/page_io.c
+index 08d2eae58fcee..9b646f07f47f1 100644
+--- a/mm/page_io.c
++++ b/mm/page_io.c
+@@ -38,7 +38,6 @@ static struct bio *get_swap_bio(gfp_t gfp_flags,
+
+ bio->bi_iter.bi_sector = map_swap_page(page, &bdev);
+ bio_set_dev(bio, bdev);
+- bio->bi_iter.bi_sector <<= PAGE_SHIFT - 9;
+ bio->bi_end_io = end_io;
+
+ for (i = 0; i < nr; i++)
+@@ -262,11 +261,6 @@ out:
+ return ret;
+ }
+
+-static sector_t swap_page_sector(struct page *page)
+-{
+- return (sector_t)__page_file_index(page) << (PAGE_SHIFT - 9);
+-}
+-
+ static inline void count_swpout_vm_event(struct page *page)
+ {
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+@@ -325,7 +319,8 @@ int __swap_writepage(struct page *page, struct writeback_control *wbc,
+ return ret;
+ }
+
+- ret = bdev_write_page(sis->bdev, swap_page_sector(page), page, wbc);
++ ret = bdev_write_page(sis->bdev, map_swap_page(page, &sis->bdev),
++ page, wbc);
+ if (!ret) {
+ count_swpout_vm_event(page);
+ return 0;
+@@ -376,7 +371,7 @@ int swap_readpage(struct page *page, bool synchronous)
+ return ret;
+ }
+
+- ret = bdev_read_page(sis->bdev, swap_page_sector(page), page);
++ ret = bdev_read_page(sis->bdev, map_swap_page(page, &sis->bdev), page);
+ if (!ret) {
+ if (trylock_page(page)) {
+ swap_slot_free_notify(page);
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 130e2e41a48ce..057e6907bf7b9 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2305,7 +2305,7 @@ sector_t map_swap_page(struct page *page, struct block_device **bdev)
+ {
+ swp_entry_t entry;
+ entry.val = page_private(page);
+- return map_swap_entry(entry, bdev);
++ return map_swap_entry(entry, bdev) << (PAGE_SHIFT - 9);
+ }
+
+ /*
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index 85cc29c93d93a..d52c005a060f1 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -2285,11 +2285,13 @@ static unsigned long zs_can_compact(struct size_class *class)
+ return obj_wasted * class->pages_per_zspage;
+ }
+
+-static void __zs_compact(struct zs_pool *pool, struct size_class *class)
++static unsigned long __zs_compact(struct zs_pool *pool,
++ struct size_class *class)
+ {
+ struct zs_compact_control cc;
+ struct zspage *src_zspage;
+ struct zspage *dst_zspage = NULL;
++ unsigned long pages_freed = 0;
+
+ spin_lock(&class->lock);
+ while ((src_zspage = isolate_zspage(class, true))) {
+@@ -2319,7 +2321,7 @@ static void __zs_compact(struct zs_pool *pool, struct size_class *class)
+ putback_zspage(class, dst_zspage);
+ if (putback_zspage(class, src_zspage) == ZS_EMPTY) {
+ free_zspage(pool, class, src_zspage);
+- pool->stats.pages_compacted += class->pages_per_zspage;
++ pages_freed += class->pages_per_zspage;
+ }
+ spin_unlock(&class->lock);
+ cond_resched();
+@@ -2330,12 +2332,15 @@ static void __zs_compact(struct zs_pool *pool, struct size_class *class)
+ putback_zspage(class, src_zspage);
+
+ spin_unlock(&class->lock);
++
++ return pages_freed;
+ }
+
+ unsigned long zs_compact(struct zs_pool *pool)
+ {
+ int i;
+ struct size_class *class;
++ unsigned long pages_freed = 0;
+
+ for (i = ZS_SIZE_CLASSES - 1; i >= 0; i--) {
+ class = pool->size_class[i];
+@@ -2343,10 +2348,11 @@ unsigned long zs_compact(struct zs_pool *pool)
+ continue;
+ if (class->index != i)
+ continue;
+- __zs_compact(pool, class);
++ pages_freed += __zs_compact(pool, class);
+ }
++ atomic_long_add(pages_freed, &pool->stats.pages_compacted);
+
+- return pool->stats.pages_compacted;
++ return pages_freed;
+ }
+ EXPORT_SYMBOL_GPL(zs_compact);
+
+@@ -2363,13 +2369,12 @@ static unsigned long zs_shrinker_scan(struct shrinker *shrinker,
+ struct zs_pool *pool = container_of(shrinker, struct zs_pool,
+ shrinker);
+
+- pages_freed = pool->stats.pages_compacted;
+ /*
+ * Compact classes and calculate compaction delta.
+ * Can run concurrently with a manually triggered
+ * (by user) compaction.
+ */
+- pages_freed = zs_compact(pool) - pages_freed;
++ pages_freed = zs_compact(pool);
+
+ return pages_freed ? pages_freed : SHRINK_STOP;
+ }
+diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c
+index 78bec8df8525b..72ef967c56630 100644
+--- a/net/bluetooth/amp.c
++++ b/net/bluetooth/amp.c
+@@ -305,6 +305,9 @@ void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
+ struct hci_request req;
+ int err;
+
++ if (!mgr)
++ return;
++
+ cp.phy_handle = hcon->handle;
+ cp.len_so_far = cpu_to_le16(0);
+ cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
+diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
+index 7c87a2fe52480..e9e2a3b1f477e 100644
+--- a/net/bridge/br_sysfs_if.c
++++ b/net/bridge/br_sysfs_if.c
+@@ -59,9 +59,8 @@ static BRPORT_ATTR(_name, 0644, \
+ static int store_flag(struct net_bridge_port *p, unsigned long v,
+ unsigned long mask)
+ {
+- unsigned long flags;
+-
+- flags = p->flags;
++ unsigned long flags = p->flags;
++ int err;
+
+ if (v)
+ flags |= mask;
+@@ -69,6 +68,10 @@ static int store_flag(struct net_bridge_port *p, unsigned long v,
+ flags &= ~mask;
+
+ if (flags != p->flags) {
++ err = br_switchdev_set_port_flag(p, flags, mask);
++ if (err)
++ return err;
++
+ p->flags = flags;
+ br_port_flags_change(p, mask);
+ }
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 092fa3d75b32a..3714cd9e3111f 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -3471,7 +3471,7 @@ static int pktgen_thread_worker(void *arg)
+ struct pktgen_dev *pkt_dev = NULL;
+ int cpu = t->cpu;
+
+- BUG_ON(smp_processor_id() != cpu);
++ WARN_ON(smp_processor_id() != cpu);
+
+ init_waitqueue_head(&t->queue);
+ complete(&t->start_done);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 4a9ab2596e782..ea9684bcc2e8d 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3092,7 +3092,19 @@ EXPORT_SYMBOL(skb_split);
+ */
+ static int skb_prepare_for_shift(struct sk_buff *skb)
+ {
+- return skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
++ int ret = 0;
++
++ if (skb_cloned(skb)) {
++ /* Save and restore truesize: pskb_expand_head() may reallocate
++ * memory where ksize(kmalloc(S)) != ksize(kmalloc(S)), but we
++ * cannot change truesize at this point.
++ */
++ unsigned int save_truesize = skb->truesize;
++
++ ret = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
++ skb->truesize = save_truesize;
++ }
++ return ret;
+ }
+
+ /**
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index accd3846f1e3e..4f8c1a272df07 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -1191,7 +1191,7 @@ static ssize_t smk_write_net4addr(struct file *file, const char __user *buf,
+ return -EPERM;
+ if (*ppos != 0)
+ return -EINVAL;
+- if (count < SMK_NETLBLADDRMIN)
++ if (count < SMK_NETLBLADDRMIN || count > PAGE_SIZE - 1)
+ return -EINVAL;
+
+ data = memdup_user_nul(buf, count);
+@@ -1451,7 +1451,7 @@ static ssize_t smk_write_net6addr(struct file *file, const char __user *buf,
+ return -EPERM;
+ if (*ppos != 0)
+ return -EINVAL;
+- if (count < SMK_NETLBLADDRMIN)
++ if (count < SMK_NETLBLADDRMIN || count > PAGE_SIZE - 1)
+ return -EINVAL;
+
+ data = memdup_user_nul(buf, count);
+@@ -1858,6 +1858,10 @@ static ssize_t smk_write_ambient(struct file *file, const char __user *buf,
+ if (!smack_privileged(CAP_MAC_ADMIN))
+ return -EPERM;
+
++ /* Enough data must be present */
++ if (count == 0 || count > PAGE_SIZE)
++ return -EINVAL;
++
+ data = memdup_user_nul(buf, count);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
+@@ -2029,6 +2033,9 @@ static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
+ if (!smack_privileged(CAP_MAC_ADMIN))
+ return -EPERM;
+
++ if (count > PAGE_SIZE)
++ return -EINVAL;
++
+ data = memdup_user_nul(buf, count);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
+@@ -2116,6 +2123,9 @@ static ssize_t smk_write_unconfined(struct file *file, const char __user *buf,
+ if (!smack_privileged(CAP_MAC_ADMIN))
+ return -EPERM;
+
++ if (count > PAGE_SIZE)
++ return -EINVAL;
++
+ data = memdup_user_nul(buf, count);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
+@@ -2669,6 +2679,10 @@ static ssize_t smk_write_syslog(struct file *file, const char __user *buf,
+ if (!smack_privileged(CAP_MAC_ADMIN))
+ return -EPERM;
+
++ /* Enough data must be present */
++ if (count == 0 || count > PAGE_SIZE)
++ return -EINVAL;
++
+ data = memdup_user_nul(buf, count);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
+@@ -2761,10 +2775,13 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
+ return -EPERM;
+
+ /*
++ * No partial write.
+ * Enough data must be present.
+ */
+ if (*ppos != 0)
+ return -EINVAL;
++ if (count == 0 || count > PAGE_SIZE)
++ return -EINVAL;
+
+ data = memdup_user_nul(buf, count);
+ if (IS_ERR(data))
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 70571092db8d4..6a419b23adbc8 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2507,6 +2507,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
++ SND_PCI_QUIRK(0x1462, 0xcc34, "MSI Godlike X570", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+ SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
+@@ -7179,6 +7180,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x8551, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8560, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1558, 0x8561, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1558, 0x8562, "Clevo NH[5|7][0-9]RZ[Q]", ALC269_FIXUP_DMIC),
+ SND_PCI_QUIRK(0x1558, 0x8668, "Clevo NP50B[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8680, "Clevo NJ50LU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8686, "Clevo NH50[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index ec630127ef2f3..8a943de1e5b55 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -409,6 +409,19 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Acer One 10 S1002 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "One S1002"),
++ },
++ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_DIFF_MIC |
++ BYT_RT5640_SSP0_AIF2 |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+@@ -510,6 +523,16 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_MONO_SPEAKER |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Estar Beauty HD MID 7316R */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Estar"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "eSTAR BEAUTY HD Intel Quad core"),
++ },
++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS |
++ BYT_RT5640_MONO_SPEAKER |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+@@ -746,6 +769,20 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF2 |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Voyo Winpad A15 */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
++ /* Above strings are too generic, also match on BIOS date */
++ DMI_MATCH(DMI_BIOS_DATE, "11/20/2014"),
++ },
++ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_DIFF_MIC |
++ BYT_RT5640_MCLK_EN),
++ },
+ { /* Catch-all for generic Insyde tablets, must be last */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-03-11 14:05 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-03-11 14:05 UTC (permalink / raw
To: gentoo-commits
commit: 9b93b6b322f2a3c33538c6122c9070ca0ff60adf
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Mar 11 14:05:35 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Mar 11 14:05:35 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9b93b6b3
Linux patch 4.19.180
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1179_linux-4.19.180.patch | 2354 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2358 insertions(+)
diff --git a/0000_README b/0000_README
index 340b3da..c965714 100644
--- a/0000_README
+++ b/0000_README
@@ -755,6 +755,10 @@ Patch: 1178_linux-4.19.179.patch
From: https://www.kernel.org
Desc: Linux 4.19.179
+Patch: 1179_linux-4.19.180.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.180
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1179_linux-4.19.180.patch b/1179_linux-4.19.180.patch
new file mode 100644
index 0000000..6ffc129
--- /dev/null
+++ b/1179_linux-4.19.180.patch
@@ -0,0 +1,2354 @@
+diff --git a/Makefile b/Makefile
+index 040b3cd699b01..48cdfe5ce9921 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 179
++SUBLEVEL = 180
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
+index 748bd0921dfff..788c80abff5d3 100644
+--- a/arch/um/drivers/ubd_kern.c
++++ b/arch/um/drivers/ubd_kern.c
+@@ -891,7 +891,7 @@ static int ubd_disk_register(int major, u64 size, int unit,
+
+ disk->private_data = &ubd_devs[unit];
+ disk->queue = ubd_devs[unit].queue;
+- device_add_disk(parent, disk);
++ device_add_disk(parent, disk, NULL);
+
+ *disk_out = disk;
+ return 0;
+diff --git a/block/genhd.c b/block/genhd.c
+index 6965dde963736..aee2fa9de1a7d 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -582,7 +582,8 @@ static int exact_lock(dev_t devt, void *data)
+ return 0;
+ }
+
+-static void register_disk(struct device *parent, struct gendisk *disk)
++static void register_disk(struct device *parent, struct gendisk *disk,
++ const struct attribute_group **groups)
+ {
+ struct device *ddev = disk_to_dev(disk);
+ struct block_device *bdev;
+@@ -597,6 +598,10 @@ static void register_disk(struct device *parent, struct gendisk *disk)
+ /* delay uevents, until we scanned partition table */
+ dev_set_uevent_suppress(ddev, 1);
+
++ if (groups) {
++ WARN_ON(ddev->groups);
++ ddev->groups = groups;
++ }
+ if (device_add(ddev))
+ return;
+ if (!sysfs_deprecated) {
+@@ -664,6 +669,7 @@ exit:
+ * __device_add_disk - add disk information to kernel list
+ * @parent: parent device for the disk
+ * @disk: per-device partitioning information
++ * @groups: Additional per-device sysfs groups
+ * @register_queue: register the queue if set to true
+ *
+ * This function registers the partitioning information in @disk
+@@ -672,6 +678,7 @@ exit:
+ * FIXME: error handling
+ */
+ static void __device_add_disk(struct device *parent, struct gendisk *disk,
++ const struct attribute_group **groups,
+ bool register_queue)
+ {
+ dev_t devt;
+@@ -715,7 +722,7 @@ static void __device_add_disk(struct device *parent, struct gendisk *disk,
+ blk_register_region(disk_devt(disk), disk->minors, NULL,
+ exact_match, exact_lock, disk);
+ }
+- register_disk(parent, disk);
++ register_disk(parent, disk, groups);
+ if (register_queue)
+ blk_register_queue(disk);
+
+@@ -729,15 +736,17 @@ static void __device_add_disk(struct device *parent, struct gendisk *disk,
+ blk_integrity_add(disk);
+ }
+
+-void device_add_disk(struct device *parent, struct gendisk *disk)
++void device_add_disk(struct device *parent, struct gendisk *disk,
++ const struct attribute_group **groups)
++
+ {
+- __device_add_disk(parent, disk, true);
++ __device_add_disk(parent, disk, groups, true);
+ }
+ EXPORT_SYMBOL(device_add_disk);
+
+ void device_add_disk_no_queue_reg(struct device *parent, struct gendisk *disk)
+ {
+- __device_add_disk(parent, disk, false);
++ __device_add_disk(parent, disk, NULL, false);
+ }
+ EXPORT_SYMBOL(device_add_disk_no_queue_reg);
+
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 2c99f93020bc9..b118b5a500c9a 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -304,22 +304,22 @@ static void rpm_put_suppliers(struct device *dev)
+ static int __rpm_callback(int (*cb)(struct device *), struct device *dev)
+ __releases(&dev->power.lock) __acquires(&dev->power.lock)
+ {
+- int retval, idx;
+ bool use_links = dev->power.links_count > 0;
++ bool get = false;
++ int retval, idx;
++ bool put;
+
+ if (dev->power.irq_safe) {
+ spin_unlock(&dev->power.lock);
++ } else if (!use_links) {
++ spin_unlock_irq(&dev->power.lock);
+ } else {
++ get = dev->power.runtime_status == RPM_RESUMING;
++
+ spin_unlock_irq(&dev->power.lock);
+
+- /*
+- * Resume suppliers if necessary.
+- *
+- * The device's runtime PM status cannot change until this
+- * routine returns, so it is safe to read the status outside of
+- * the lock.
+- */
+- if (use_links && dev->power.runtime_status == RPM_RESUMING) {
++ /* Resume suppliers if necessary. */
++ if (get) {
+ idx = device_links_read_lock();
+
+ retval = rpm_get_suppliers(dev);
+@@ -334,24 +334,36 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev)
+
+ if (dev->power.irq_safe) {
+ spin_lock(&dev->power.lock);
+- } else {
+- /*
+- * If the device is suspending and the callback has returned
+- * success, drop the usage counters of the suppliers that have
+- * been reference counted on its resume.
+- *
+- * Do that if resume fails too.
+- */
+- if (use_links
+- && ((dev->power.runtime_status == RPM_SUSPENDING && !retval)
+- || (dev->power.runtime_status == RPM_RESUMING && retval))) {
+- idx = device_links_read_lock();
++ return retval;
++ }
+
+- fail:
+- rpm_put_suppliers(dev);
++ spin_lock_irq(&dev->power.lock);
+
+- device_links_read_unlock(idx);
+- }
++ if (!use_links)
++ return retval;
++
++ /*
++ * If the device is suspending and the callback has returned success,
++ * drop the usage counters of the suppliers that have been reference
++ * counted on its resume.
++ *
++ * Do that if the resume fails too.
++ */
++ put = dev->power.runtime_status == RPM_SUSPENDING && !retval;
++ if (put)
++ __update_runtime_status(dev, RPM_SUSPENDED);
++ else
++ put = get && retval;
++
++ if (put) {
++ spin_unlock_irq(&dev->power.lock);
++
++ idx = device_links_read_lock();
++
++fail:
++ rpm_put_suppliers(dev);
++
++ device_links_read_unlock(idx);
+
+ spin_lock_irq(&dev->power.lock);
+ }
+diff --git a/drivers/block/aoe/aoe.h b/drivers/block/aoe/aoe.h
+index c0ebda1283cca..015c68017a1c9 100644
+--- a/drivers/block/aoe/aoe.h
++++ b/drivers/block/aoe/aoe.h
+@@ -201,7 +201,6 @@ int aoeblk_init(void);
+ void aoeblk_exit(void);
+ void aoeblk_gdalloc(void *);
+ void aoedisk_rm_debugfs(struct aoedev *d);
+-void aoedisk_rm_sysfs(struct aoedev *d);
+
+ int aoechr_init(void);
+ void aoechr_exit(void);
+diff --git a/drivers/block/aoe/aoeblk.c b/drivers/block/aoe/aoeblk.c
+index 429ebb84b5926..ff770e7d9e528 100644
+--- a/drivers/block/aoe/aoeblk.c
++++ b/drivers/block/aoe/aoeblk.c
+@@ -177,10 +177,15 @@ static struct attribute *aoe_attrs[] = {
+ NULL,
+ };
+
+-static const struct attribute_group attr_group = {
++static const struct attribute_group aoe_attr_group = {
+ .attrs = aoe_attrs,
+ };
+
++static const struct attribute_group *aoe_attr_groups[] = {
++ &aoe_attr_group,
++ NULL,
++};
++
+ static const struct file_operations aoe_debugfs_fops = {
+ .open = aoe_debugfs_open,
+ .read = seq_read,
+@@ -219,17 +224,6 @@ aoedisk_rm_debugfs(struct aoedev *d)
+ d->debugfs = NULL;
+ }
+
+-static int
+-aoedisk_add_sysfs(struct aoedev *d)
+-{
+- return sysfs_create_group(&disk_to_dev(d->gd)->kobj, &attr_group);
+-}
+-void
+-aoedisk_rm_sysfs(struct aoedev *d)
+-{
+- sysfs_remove_group(&disk_to_dev(d->gd)->kobj, &attr_group);
+-}
+-
+ static int
+ aoeblk_open(struct block_device *bdev, fmode_t mode)
+ {
+@@ -417,8 +411,7 @@ aoeblk_gdalloc(void *vp)
+
+ spin_unlock_irqrestore(&d->lock, flags);
+
+- add_disk(gd);
+- aoedisk_add_sysfs(d);
++ device_add_disk(NULL, gd, aoe_attr_groups);
+ aoedisk_add_debugfs(d);
+
+ spin_lock_irqsave(&d->lock, flags);
+diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c
+index 41060e9cedf20..f29a140cdbc13 100644
+--- a/drivers/block/aoe/aoedev.c
++++ b/drivers/block/aoe/aoedev.c
+@@ -275,7 +275,6 @@ freedev(struct aoedev *d)
+ del_timer_sync(&d->timer);
+ if (d->gd) {
+ aoedisk_rm_debugfs(d);
+- aoedisk_rm_sysfs(d);
+ del_gendisk(d->gd);
+ put_disk(d->gd);
+ blk_cleanup_queue(d->blkq);
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 56d4c7df91857..04383f14c74a9 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -4714,7 +4714,7 @@ static int __init do_floppy_init(void)
+ /* to be cleaned up... */
+ disks[drive]->private_data = (void *)(long)drive;
+ disks[drive]->flags |= GENHD_FL_REMOVABLE;
+- device_add_disk(&floppy_device[drive].dev, disks[drive]);
++ device_add_disk(&floppy_device[drive].dev, disks[drive], NULL);
+ }
+
+ return 0;
+diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
+index d0666f5ce0036..1d7d48d8a2050 100644
+--- a/drivers/block/mtip32xx/mtip32xx.c
++++ b/drivers/block/mtip32xx/mtip32xx.c
+@@ -3861,7 +3861,7 @@ skip_create_disk:
+ set_capacity(dd->disk, capacity);
+
+ /* Enable the block device and add it to /dev */
+- device_add_disk(&dd->pdev->dev, dd->disk);
++ device_add_disk(&dd->pdev->dev, dd->disk, NULL);
+
+ dd->bdev = bdget_disk(dd->disk, 0);
+ /*
+diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c
+index bd1c66f5631a5..42bff6b1d6a89 100644
+--- a/drivers/block/ps3disk.c
++++ b/drivers/block/ps3disk.c
+@@ -499,7 +499,7 @@ static int ps3disk_probe(struct ps3_system_bus_device *_dev)
+ gendisk->disk_name, priv->model, priv->raw_capacity >> 11,
+ get_capacity(gendisk) >> 11);
+
+- device_add_disk(&dev->sbd.core, gendisk);
++ device_add_disk(&dev->sbd.core, gendisk, NULL);
+ return 0;
+
+ fail_cleanup_queue:
+diff --git a/drivers/block/ps3vram.c b/drivers/block/ps3vram.c
+index 1e3d5de9d8387..c0c50816a10bb 100644
+--- a/drivers/block/ps3vram.c
++++ b/drivers/block/ps3vram.c
+@@ -769,7 +769,7 @@ static int ps3vram_probe(struct ps3_system_bus_device *dev)
+ dev_info(&dev->core, "%s: Using %lu MiB of GPU memory\n",
+ gendisk->disk_name, get_capacity(gendisk) >> 11);
+
+- device_add_disk(&dev->core, gendisk);
++ device_add_disk(&dev->core, gendisk, NULL);
+ return 0;
+
+ fail_cleanup_queue:
+diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
+index 14056dc450642..d8ef8b16fb2e9 100644
+--- a/drivers/block/rsxx/core.c
++++ b/drivers/block/rsxx/core.c
+@@ -179,15 +179,17 @@ static ssize_t rsxx_cram_read(struct file *fp, char __user *ubuf,
+ {
+ struct rsxx_cardinfo *card = file_inode(fp)->i_private;
+ char *buf;
+- ssize_t st;
++ int st;
+
+ buf = kzalloc(cnt, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ st = rsxx_creg_read(card, CREG_ADD_CRAM + (u32)*ppos, cnt, buf, 1);
+- if (!st)
+- st = copy_to_user(ubuf, buf, cnt);
++ if (!st) {
++ if (copy_to_user(ubuf, buf, cnt))
++ st = -EFAULT;
++ }
+ kfree(buf);
+ if (st)
+ return st;
+diff --git a/drivers/block/rsxx/dev.c b/drivers/block/rsxx/dev.c
+index 1a92f9e659374..3894aa0f350b7 100644
+--- a/drivers/block/rsxx/dev.c
++++ b/drivers/block/rsxx/dev.c
+@@ -226,7 +226,7 @@ int rsxx_attach_dev(struct rsxx_cardinfo *card)
+ set_capacity(card->gendisk, card->size8 >> 9);
+ else
+ set_capacity(card->gendisk, 0);
+- device_add_disk(CARD_TO_DEV(card), card->gendisk);
++ device_add_disk(CARD_TO_DEV(card), card->gendisk, NULL);
+ card->bdev_attached = 1;
+ }
+
+diff --git a/drivers/block/skd_main.c b/drivers/block/skd_main.c
+index 27323fa23997d..80a5806ede039 100644
+--- a/drivers/block/skd_main.c
++++ b/drivers/block/skd_main.c
+@@ -3104,7 +3104,7 @@ static int skd_bdev_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+ static int skd_bdev_attach(struct device *parent, struct skd_device *skdev)
+ {
+ dev_dbg(&skdev->pdev->dev, "add_disk\n");
+- device_add_disk(parent, skdev->disk);
++ device_add_disk(parent, skdev->disk, NULL);
+ return 0;
+ }
+
+diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
+index 5d7024057540a..6b7b0d8a2acbc 100644
+--- a/drivers/block/sunvdc.c
++++ b/drivers/block/sunvdc.c
+@@ -862,7 +862,7 @@ static int probe_disk(struct vdc_port *port)
+ port->vdisk_size, (port->vdisk_size >> (20 - 9)),
+ port->vio.ver.major, port->vio.ver.minor);
+
+- device_add_disk(&port->vio.vdev->dev, g);
++ device_add_disk(&port->vio.vdev->dev, g, NULL);
+
+ return 0;
+ }
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 075523777a4a9..c2d9459ec5d12 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -423,8 +423,8 @@ static int minor_to_index(int minor)
+ return minor >> PART_BITS;
+ }
+
+-static ssize_t virtblk_serial_show(struct device *dev,
+- struct device_attribute *attr, char *buf)
++static ssize_t serial_show(struct device *dev,
++ struct device_attribute *attr, char *buf)
+ {
+ struct gendisk *disk = dev_to_disk(dev);
+ int err;
+@@ -443,7 +443,7 @@ static ssize_t virtblk_serial_show(struct device *dev,
+ return err;
+ }
+
+-static DEVICE_ATTR(serial, 0444, virtblk_serial_show, NULL);
++static DEVICE_ATTR_RO(serial);
+
+ /* The queue's logical block size must be set before calling this */
+ static void virtblk_update_capacity(struct virtio_blk *vblk, bool resize)
+@@ -619,8 +619,8 @@ static const char *const virtblk_cache_types[] = {
+ };
+
+ static ssize_t
+-virtblk_cache_type_store(struct device *dev, struct device_attribute *attr,
+- const char *buf, size_t count)
++cache_type_store(struct device *dev, struct device_attribute *attr,
++ const char *buf, size_t count)
+ {
+ struct gendisk *disk = dev_to_disk(dev);
+ struct virtio_blk *vblk = disk->private_data;
+@@ -638,8 +638,7 @@ virtblk_cache_type_store(struct device *dev, struct device_attribute *attr,
+ }
+
+ static ssize_t
+-virtblk_cache_type_show(struct device *dev, struct device_attribute *attr,
+- char *buf)
++cache_type_show(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+ struct gendisk *disk = dev_to_disk(dev);
+ struct virtio_blk *vblk = disk->private_data;
+@@ -649,12 +648,38 @@ virtblk_cache_type_show(struct device *dev, struct device_attribute *attr,
+ return snprintf(buf, 40, "%s\n", virtblk_cache_types[writeback]);
+ }
+
+-static const struct device_attribute dev_attr_cache_type_ro =
+- __ATTR(cache_type, 0444,
+- virtblk_cache_type_show, NULL);
+-static const struct device_attribute dev_attr_cache_type_rw =
+- __ATTR(cache_type, 0644,
+- virtblk_cache_type_show, virtblk_cache_type_store);
++static DEVICE_ATTR_RW(cache_type);
++
++static struct attribute *virtblk_attrs[] = {
++ &dev_attr_serial.attr,
++ &dev_attr_cache_type.attr,
++ NULL,
++};
++
++static umode_t virtblk_attrs_are_visible(struct kobject *kobj,
++ struct attribute *a, int n)
++{
++ struct device *dev = container_of(kobj, struct device, kobj);
++ struct gendisk *disk = dev_to_disk(dev);
++ struct virtio_blk *vblk = disk->private_data;
++ struct virtio_device *vdev = vblk->vdev;
++
++ if (a == &dev_attr_cache_type.attr &&
++ !virtio_has_feature(vdev, VIRTIO_BLK_F_CONFIG_WCE))
++ return S_IRUGO;
++
++ return a->mode;
++}
++
++static const struct attribute_group virtblk_attr_group = {
++ .attrs = virtblk_attrs,
++ .is_visible = virtblk_attrs_are_visible,
++};
++
++static const struct attribute_group *virtblk_attr_groups[] = {
++ &virtblk_attr_group,
++ NULL,
++};
+
+ static int virtblk_init_request(struct blk_mq_tag_set *set, struct request *rq,
+ unsigned int hctx_idx, unsigned int numa_node)
+@@ -858,24 +883,9 @@ static int virtblk_probe(struct virtio_device *vdev)
+ virtblk_update_capacity(vblk, false);
+ virtio_device_ready(vdev);
+
+- device_add_disk(&vdev->dev, vblk->disk);
+- err = device_create_file(disk_to_dev(vblk->disk), &dev_attr_serial);
+- if (err)
+- goto out_del_disk;
+-
+- if (virtio_has_feature(vdev, VIRTIO_BLK_F_CONFIG_WCE))
+- err = device_create_file(disk_to_dev(vblk->disk),
+- &dev_attr_cache_type_rw);
+- else
+- err = device_create_file(disk_to_dev(vblk->disk),
+- &dev_attr_cache_type_ro);
+- if (err)
+- goto out_del_disk;
++ device_add_disk(&vdev->dev, vblk->disk, virtblk_attr_groups);
+ return 0;
+
+-out_del_disk:
+- del_gendisk(vblk->disk);
+- blk_cleanup_queue(vblk->disk->queue);
+ out_free_tags:
+ blk_mq_free_tag_set(&vblk->tag_set);
+ out_put_disk:
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index d4ceee3825f8d..1b06c8e46ffa4 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -2422,7 +2422,7 @@ static void blkfront_connect(struct blkfront_info *info)
+ for (i = 0; i < info->nr_rings; i++)
+ kick_pending_request_queues(&info->rinfo[i]);
+
+- device_add_disk(&info->xbdev->dev, info->gd);
++ device_add_disk(&info->xbdev->dev, info->gd, NULL);
+
+ info->is_ready = 1;
+ return;
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 2c7f412df2eb3..104206a795015 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -1729,8 +1729,7 @@ static int zram_add(void)
+
+ zram->disk->queue->backing_dev_info->capabilities |=
+ (BDI_CAP_STABLE_WRITES | BDI_CAP_SYNCHRONOUS_IO);
+- disk_to_dev(zram->disk)->groups = zram_disk_attr_groups;
+- add_disk(zram->disk);
++ device_add_disk(NULL, zram->disk, zram_disk_attr_groups);
+
+ strlcpy(zram->compressor, default_compressor, sizeof(zram->compressor));
+
+@@ -1766,6 +1765,7 @@ static int zram_remove(struct zram *zram)
+ mutex_unlock(&bdev->bd_mutex);
+
+ zram_debugfs_unregister(zram);
++
+ /* Make sure all the pending I/O are finished */
+ fsync_bdev(bdev);
+ zram_reset_device(zram);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index a90e83e5ab575..ee4a0b7cb452f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -239,7 +239,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_read(struct file *f, char __user *buf,
+ while (size) {
+ uint32_t value;
+
+- value = RREG32_PCIE(*pos >> 2);
++ value = RREG32_PCIE(*pos);
+ r = put_user(value, (uint32_t *)buf);
+ if (r)
+ return r;
+@@ -282,7 +282,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user
+ if (r)
+ return r;
+
+- WREG32_PCIE(*pos >> 2, value);
++ WREG32_PCIE(*pos, value);
+
+ result += 4;
+ buf += 4;
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index d29a58bd2f7a3..776bbe9775e9d 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -681,8 +681,6 @@ static int a5xx_hw_init(struct msm_gpu *gpu)
+ if (adreno_gpu->info->quirks & ADRENO_QUIRK_TWO_PASS_USE_WFI)
+ gpu_rmw(gpu, REG_A5XX_PC_DBG_ECO_CNTL, 0, (1 << 8));
+
+- gpu_write(gpu, REG_A5XX_PC_DBG_ECO_CNTL, 0xc0200100);
+-
+ /* Enable USE_RETENTION_FLOPS */
+ gpu_write(gpu, REG_A5XX_CP_CHICKEN_DBG, 0x02000000);
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index ab2be7a115d8f..2f1516b328372 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -358,6 +358,7 @@
+ #define USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR 0x1803
+ #define USB_DEVICE_ID_DRAGONRISE_GAMECUBE1 0x1843
+ #define USB_DEVICE_ID_DRAGONRISE_GAMECUBE2 0x1844
++#define USB_DEVICE_ID_DRAGONRISE_GAMECUBE3 0x1846
+
+ #define USB_VENDOR_ID_DWAV 0x0eef
+ #define USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER 0x0001
+diff --git a/drivers/hid/hid-mf.c b/drivers/hid/hid-mf.c
+index 03f10516131df..a41202d385096 100644
+--- a/drivers/hid/hid-mf.c
++++ b/drivers/hid/hid-mf.c
+@@ -161,6 +161,8 @@ static const struct hid_device_id mf_devices[] = {
+ .driver_data = HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2),
+ .driver_data = 0 }, /* No quirk required */
++ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE3),
++ .driver_data = HID_QUIRK_MULTI_INPUT },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, mf_devices);
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 10cb42a00fe87..8fbe7b9cd84a3 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -74,6 +74,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_REDRAGON_SEYMUR2), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1), HID_QUIRK_MULTI_INPUT },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE3), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER), HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET },
+@@ -498,6 +499,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE3) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_MICROSOFT)
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500) },
+diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
+index 44a7a255ef74a..f9b59d41813f9 100644
+--- a/drivers/ide/ide-cd.c
++++ b/drivers/ide/ide-cd.c
+@@ -1784,7 +1784,7 @@ static int ide_cd_probe(ide_drive_t *drive)
+ ide_cd_read_toc(drive);
+ g->fops = &idecd_ops;
+ g->flags |= GENHD_FL_REMOVABLE | GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE;
+- device_add_disk(&drive->gendev, g);
++ device_add_disk(&drive->gendev, g, NULL);
+ return 0;
+
+ out_free_disk:
+diff --git a/drivers/ide/ide-gd.c b/drivers/ide/ide-gd.c
+index e823394ed5434..04e008e8f6f9d 100644
+--- a/drivers/ide/ide-gd.c
++++ b/drivers/ide/ide-gd.c
+@@ -416,7 +416,7 @@ static int ide_gd_probe(ide_drive_t *drive)
+ if (drive->dev_flags & IDE_DFLAG_REMOVABLE)
+ g->flags = GENHD_FL_REMOVABLE;
+ g->fops = &ide_gd_ops;
+- device_add_disk(&drive->gendev, g);
++ device_add_disk(&drive->gendev, g, NULL);
+ return 0;
+
+ out_free_disk:
+diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig
+index 67ae960ab523b..1fa19a77583ea 100644
+--- a/drivers/infiniband/sw/rxe/Kconfig
++++ b/drivers/infiniband/sw/rxe/Kconfig
+@@ -3,6 +3,7 @@ config RDMA_RXE
+ depends on INET && PCI && INFINIBAND
+ depends on !64BIT || ARCH_DMA_ADDR_T_64BIT
+ select NET_UDP_TUNNEL
++ select CRYPTO
+ select CRYPTO_CRC32
+ select DMA_VIRT_OPS
+ ---help---
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index d0cbe910ee9db..5d5941aca16ad 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -1348,24 +1348,26 @@ static void increase_address_space(struct protection_domain *domain,
+ unsigned long flags;
+ u64 *pte;
+
++ pte = (void *)get_zeroed_page(gfp);
++ if (!pte)
++ return;
++
+ spin_lock_irqsave(&domain->lock, flags);
+
+ if (WARN_ON_ONCE(domain->mode == PAGE_MODE_6_LEVEL))
+ /* address space already 64 bit large */
+ goto out;
+
+- pte = (void *)get_zeroed_page(gfp);
+- if (!pte)
+- goto out;
+-
+ *pte = PM_LEVEL_PDE(domain->mode,
+ iommu_virt_to_phys(domain->pt_root));
+ domain->pt_root = pte;
+ domain->mode += 1;
+ domain->updated = true;
++ pte = NULL;
+
+ out:
+ spin_unlock_irqrestore(&domain->lock, flags);
++ free_page((unsigned long)pte);
+
+ return;
+ }
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index b6e4ab67ae449..b3b799f84dcc6 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1463,6 +1463,10 @@ EXPORT_SYMBOL_GPL(dm_bufio_get_block_size);
+ sector_t dm_bufio_get_device_size(struct dm_bufio_client *c)
+ {
+ sector_t s = i_size_read(c->bdev->bd_inode) >> SECTOR_SHIFT;
++ if (s >= c->start)
++ s -= c->start;
++ else
++ s = 0;
+ if (likely(c->sectors_per_block_bits >= 0))
+ s >>= c->sectors_per_block_bits;
+ else
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 9164337424856..71d3fdbce50a3 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -891,10 +891,10 @@ void dm_table_set_type(struct dm_table *t, enum dm_queue_mode type)
+ }
+ EXPORT_SYMBOL_GPL(dm_table_set_type);
+
+-static int device_supports_dax(struct dm_target *ti, struct dm_dev *dev,
++static int device_not_dax_capable(struct dm_target *ti, struct dm_dev *dev,
+ sector_t start, sector_t len, void *data)
+ {
+- return bdev_dax_supported(dev->bdev, PAGE_SIZE);
++ return !bdev_dax_supported(dev->bdev, PAGE_SIZE);
+ }
+
+ static bool dm_table_supports_dax(struct dm_table *t)
+@@ -910,7 +910,7 @@ static bool dm_table_supports_dax(struct dm_table *t)
+ return false;
+
+ if (!ti->type->iterate_devices ||
+- !ti->type->iterate_devices(ti, device_supports_dax, NULL))
++ ti->type->iterate_devices(ti, device_not_dax_capable, NULL))
+ return false;
+ }
+
+@@ -1392,6 +1392,46 @@ struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
+ return &t->targets[(KEYS_PER_NODE * n) + k];
+ }
+
++/*
++ * type->iterate_devices() should be called when the sanity check needs to
++ * iterate and check all underlying data devices. iterate_devices() will
++ * iterate all underlying data devices until it encounters a non-zero return
++ * code, returned by whether the input iterate_devices_callout_fn, or
++ * iterate_devices() itself internally.
++ *
++ * For some target type (e.g. dm-stripe), one call of iterate_devices() may
++ * iterate multiple underlying devices internally, in which case a non-zero
++ * return code returned by iterate_devices_callout_fn will stop the iteration
++ * in advance.
++ *
++ * Cases requiring _any_ underlying device supporting some kind of attribute,
++ * should use the iteration structure like dm_table_any_dev_attr(), or call
++ * it directly. @func should handle semantics of positive examples, e.g.
++ * capable of something.
++ *
++ * Cases requiring _all_ underlying devices supporting some kind of attribute,
++ * should use the iteration structure like dm_table_supports_nowait() or
++ * dm_table_supports_discards(). Or introduce dm_table_all_devs_attr() that
++ * uses an @anti_func that handle semantics of counter examples, e.g. not
++ * capable of something. So: return !dm_table_any_dev_attr(t, anti_func, data);
++ */
++static bool dm_table_any_dev_attr(struct dm_table *t,
++ iterate_devices_callout_fn func, void *data)
++{
++ struct dm_target *ti;
++ unsigned int i;
++
++ for (i = 0; i < dm_table_get_num_targets(t); i++) {
++ ti = dm_table_get_target(t, i);
++
++ if (ti->type->iterate_devices &&
++ ti->type->iterate_devices(ti, func, data))
++ return true;
++ }
++
++ return false;
++}
++
+ static int count_device(struct dm_target *ti, struct dm_dev *dev,
+ sector_t start, sector_t len, void *data)
+ {
+@@ -1428,13 +1468,13 @@ bool dm_table_has_no_data_devices(struct dm_table *table)
+ return true;
+ }
+
+-static int device_is_zoned_model(struct dm_target *ti, struct dm_dev *dev,
+- sector_t start, sector_t len, void *data)
++static int device_not_zoned_model(struct dm_target *ti, struct dm_dev *dev,
++ sector_t start, sector_t len, void *data)
+ {
+ struct request_queue *q = bdev_get_queue(dev->bdev);
+ enum blk_zoned_model *zoned_model = data;
+
+- return q && blk_queue_zoned_model(q) == *zoned_model;
++ return !q || blk_queue_zoned_model(q) != *zoned_model;
+ }
+
+ static bool dm_table_supports_zoned_model(struct dm_table *t,
+@@ -1451,37 +1491,20 @@ static bool dm_table_supports_zoned_model(struct dm_table *t,
+ return false;
+
+ if (!ti->type->iterate_devices ||
+- !ti->type->iterate_devices(ti, device_is_zoned_model, &zoned_model))
++ ti->type->iterate_devices(ti, device_not_zoned_model, &zoned_model))
+ return false;
+ }
+
+ return true;
+ }
+
+-static int device_matches_zone_sectors(struct dm_target *ti, struct dm_dev *dev,
+- sector_t start, sector_t len, void *data)
++static int device_not_matches_zone_sectors(struct dm_target *ti, struct dm_dev *dev,
++ sector_t start, sector_t len, void *data)
+ {
+ struct request_queue *q = bdev_get_queue(dev->bdev);
+ unsigned int *zone_sectors = data;
+
+- return q && blk_queue_zone_sectors(q) == *zone_sectors;
+-}
+-
+-static bool dm_table_matches_zone_sectors(struct dm_table *t,
+- unsigned int zone_sectors)
+-{
+- struct dm_target *ti;
+- unsigned i;
+-
+- for (i = 0; i < dm_table_get_num_targets(t); i++) {
+- ti = dm_table_get_target(t, i);
+-
+- if (!ti->type->iterate_devices ||
+- !ti->type->iterate_devices(ti, device_matches_zone_sectors, &zone_sectors))
+- return false;
+- }
+-
+- return true;
++ return !q || blk_queue_zone_sectors(q) != *zone_sectors;
+ }
+
+ static int validate_hardware_zoned_model(struct dm_table *table,
+@@ -1501,7 +1524,7 @@ static int validate_hardware_zoned_model(struct dm_table *table,
+ if (!zone_sectors || !is_power_of_2(zone_sectors))
+ return -EINVAL;
+
+- if (!dm_table_matches_zone_sectors(table, zone_sectors)) {
++ if (dm_table_any_dev_attr(table, device_not_matches_zone_sectors, &zone_sectors)) {
+ DMERR("%s: zone sectors is not consistent across all devices",
+ dm_device_name(table->md));
+ return -EINVAL;
+@@ -1691,29 +1714,12 @@ static int device_dax_write_cache_enabled(struct dm_target *ti,
+ return false;
+ }
+
+-static int dm_table_supports_dax_write_cache(struct dm_table *t)
+-{
+- struct dm_target *ti;
+- unsigned i;
+-
+- for (i = 0; i < dm_table_get_num_targets(t); i++) {
+- ti = dm_table_get_target(t, i);
+-
+- if (ti->type->iterate_devices &&
+- ti->type->iterate_devices(ti,
+- device_dax_write_cache_enabled, NULL))
+- return true;
+- }
+-
+- return false;
+-}
+-
+-static int device_is_nonrot(struct dm_target *ti, struct dm_dev *dev,
+- sector_t start, sector_t len, void *data)
++static int device_is_rotational(struct dm_target *ti, struct dm_dev *dev,
++ sector_t start, sector_t len, void *data)
+ {
+ struct request_queue *q = bdev_get_queue(dev->bdev);
+
+- return q && blk_queue_nonrot(q);
++ return q && !blk_queue_nonrot(q);
+ }
+
+ static int device_is_not_random(struct dm_target *ti, struct dm_dev *dev,
+@@ -1724,43 +1730,26 @@ static int device_is_not_random(struct dm_target *ti, struct dm_dev *dev,
+ return q && !blk_queue_add_random(q);
+ }
+
+-static int queue_supports_sg_merge(struct dm_target *ti, struct dm_dev *dev,
+- sector_t start, sector_t len, void *data)
++static int queue_no_sg_merge(struct dm_target *ti, struct dm_dev *dev,
++ sector_t start, sector_t len, void *data)
+ {
+ struct request_queue *q = bdev_get_queue(dev->bdev);
+
+- return q && !test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags);
+-}
+-
+-static bool dm_table_all_devices_attribute(struct dm_table *t,
+- iterate_devices_callout_fn func)
+-{
+- struct dm_target *ti;
+- unsigned i;
+-
+- for (i = 0; i < dm_table_get_num_targets(t); i++) {
+- ti = dm_table_get_target(t, i);
+-
+- if (!ti->type->iterate_devices ||
+- !ti->type->iterate_devices(ti, func, NULL))
+- return false;
+- }
+-
+- return true;
++ return q && test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags);
+ }
+
+-static int device_no_partial_completion(struct dm_target *ti, struct dm_dev *dev,
++static int device_is_partial_completion(struct dm_target *ti, struct dm_dev *dev,
+ sector_t start, sector_t len, void *data)
+ {
+ char b[BDEVNAME_SIZE];
+
+ /* For now, NVMe devices are the only devices of this class */
+- return (strncmp(bdevname(dev->bdev, b), "nvme", 4) == 0);
++ return (strncmp(bdevname(dev->bdev, b), "nvme", 4) != 0);
+ }
+
+ static bool dm_table_does_not_support_partial_completion(struct dm_table *t)
+ {
+- return dm_table_all_devices_attribute(t, device_no_partial_completion);
++ return !dm_table_any_dev_attr(t, device_is_partial_completion, NULL);
+ }
+
+ static int device_not_write_same_capable(struct dm_target *ti, struct dm_dev *dev,
+@@ -1887,27 +1876,6 @@ static int device_requires_stable_pages(struct dm_target *ti,
+ return q && bdi_cap_stable_pages_required(q->backing_dev_info);
+ }
+
+-/*
+- * If any underlying device requires stable pages, a table must require
+- * them as well. Only targets that support iterate_devices are considered:
+- * don't want error, zero, etc to require stable pages.
+- */
+-static bool dm_table_requires_stable_pages(struct dm_table *t)
+-{
+- struct dm_target *ti;
+- unsigned i;
+-
+- for (i = 0; i < dm_table_get_num_targets(t); i++) {
+- ti = dm_table_get_target(t, i);
+-
+- if (ti->type->iterate_devices &&
+- ti->type->iterate_devices(ti, device_requires_stable_pages, NULL))
+- return true;
+- }
+-
+- return false;
+-}
+-
+ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
+ struct queue_limits *limits)
+ {
+@@ -1944,32 +1912,35 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
+ else
+ blk_queue_flag_clear(QUEUE_FLAG_DAX, q);
+
+- if (dm_table_supports_dax_write_cache(t))
++ if (dm_table_any_dev_attr(t, device_dax_write_cache_enabled, NULL))
+ dax_write_cache(t->md->dax_dev, true);
+
+ /* Ensure that all underlying devices are non-rotational. */
+- if (dm_table_all_devices_attribute(t, device_is_nonrot))
+- blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
+- else
++ if (dm_table_any_dev_attr(t, device_is_rotational, NULL))
+ blk_queue_flag_clear(QUEUE_FLAG_NONROT, q);
++ else
++ blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
+
+ if (!dm_table_supports_write_same(t))
+ q->limits.max_write_same_sectors = 0;
+ if (!dm_table_supports_write_zeroes(t))
+ q->limits.max_write_zeroes_sectors = 0;
+
+- if (dm_table_all_devices_attribute(t, queue_supports_sg_merge))
+- blk_queue_flag_clear(QUEUE_FLAG_NO_SG_MERGE, q);
+- else
++ if (dm_table_any_dev_attr(t, queue_no_sg_merge, NULL))
+ blk_queue_flag_set(QUEUE_FLAG_NO_SG_MERGE, q);
++ else
++ blk_queue_flag_clear(QUEUE_FLAG_NO_SG_MERGE, q);
+
+ dm_table_verify_integrity(t);
+
+ /*
+ * Some devices don't use blk_integrity but still want stable pages
+ * because they do their own checksumming.
++ * If any underlying device requires stable pages, a table must require
++ * them as well. Only targets that support iterate_devices are considered:
++ * don't want error, zero, etc to require stable pages.
+ */
+- if (dm_table_requires_stable_pages(t))
++ if (dm_table_any_dev_attr(t, device_requires_stable_pages, NULL))
+ q->backing_dev_info->capabilities |= BDI_CAP_STABLE_WRITES;
+ else
+ q->backing_dev_info->capabilities &= ~BDI_CAP_STABLE_WRITES;
+@@ -1980,7 +1951,8 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
+ * Clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not
+ * have it set.
+ */
+- if (blk_queue_add_random(q) && dm_table_all_devices_attribute(t, device_is_not_random))
++ if (blk_queue_add_random(q) &&
++ dm_table_any_dev_attr(t, device_is_not_random, NULL))
+ blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, q);
+ }
+
+diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
+index bb8327999705e..dd7684333d90a 100644
+--- a/drivers/md/dm-verity-fec.c
++++ b/drivers/md/dm-verity-fec.c
+@@ -65,19 +65,18 @@ static int fec_decode_rs8(struct dm_verity *v, struct dm_verity_fec_io *fio,
+ static u8 *fec_read_parity(struct dm_verity *v, u64 rsb, int index,
+ unsigned *offset, struct dm_buffer **buf)
+ {
+- u64 position, block;
++ u64 position, block, rem;
+ u8 *res;
+
+ position = (index + rsb) * v->fec->roots;
+- block = position >> v->data_dev_block_bits;
+- *offset = (unsigned)(position - (block << v->data_dev_block_bits));
++ block = div64_u64_rem(position, v->fec->roots << SECTOR_SHIFT, &rem);
++ *offset = (unsigned)rem;
+
+- res = dm_bufio_read(v->fec->bufio, v->fec->start + block, buf);
++ res = dm_bufio_read(v->fec->bufio, block, buf);
+ if (unlikely(IS_ERR(res))) {
+ DMERR("%s: FEC %llu: parity read failed (block %llu): %ld",
+ v->data_dev->name, (unsigned long long)rsb,
+- (unsigned long long)(v->fec->start + block),
+- PTR_ERR(res));
++ (unsigned long long)block, PTR_ERR(res));
+ *buf = NULL;
+ }
+
+@@ -159,7 +158,7 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio,
+
+ /* read the next block when we run out of parity bytes */
+ offset += v->fec->roots;
+- if (offset >= 1 << v->data_dev_block_bits) {
++ if (offset >= v->fec->roots << SECTOR_SHIFT) {
+ dm_bufio_release(buf);
+
+ par = fec_read_parity(v, rsb, block_offset, &offset, &buf);
+@@ -675,7 +674,7 @@ int verity_fec_ctr(struct dm_verity *v)
+ {
+ struct dm_verity_fec *f = v->fec;
+ struct dm_target *ti = v->ti;
+- u64 hash_blocks;
++ u64 hash_blocks, fec_blocks;
+ int ret;
+
+ if (!verity_fec_is_enabled(v)) {
+@@ -745,15 +744,17 @@ int verity_fec_ctr(struct dm_verity *v)
+ }
+
+ f->bufio = dm_bufio_client_create(f->dev->bdev,
+- 1 << v->data_dev_block_bits,
++ f->roots << SECTOR_SHIFT,
+ 1, 0, NULL, NULL);
+ if (IS_ERR(f->bufio)) {
+ ti->error = "Cannot initialize FEC bufio client";
+ return PTR_ERR(f->bufio);
+ }
+
+- if (dm_bufio_get_device_size(f->bufio) <
+- ((f->start + f->rounds * f->roots) >> v->data_dev_block_bits)) {
++ dm_bufio_set_sector_offset(f->bufio, f->start << (v->data_dev_block_bits - SECTOR_SHIFT));
++
++ fec_blocks = div64_u64(f->rounds * f->roots, v->fec->roots << SECTOR_SHIFT);
++ if (dm_bufio_get_device_size(f->bufio) < fec_blocks) {
+ ti->error = "FEC device is too small";
+ return -E2BIG;
+ }
+diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
+index fd5c52b21436b..a1d738969d7b1 100644
+--- a/drivers/media/pci/cx23885/cx23885-core.c
++++ b/drivers/media/pci/cx23885/cx23885-core.c
+@@ -2084,6 +2084,10 @@ static struct {
+ * 0x1451 is PCI ID for the IOMMU found on Ryzen
+ */
+ { PCI_VENDOR_ID_AMD, 0x1451 },
++ /* According to sudo lspci -nn,
++ * 0x1423 is the PCI ID for the IOMMU found on Kaveri
++ */
++ { PCI_VENDOR_ID_AMD, 0x1423 },
+ };
+
+ static bool cx23885_does_need_dma_reset(void)
+diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
+index 716fc8ed31d32..8a02f11076f9a 100644
+--- a/drivers/memstick/core/ms_block.c
++++ b/drivers/memstick/core/ms_block.c
+@@ -2146,7 +2146,7 @@ static int msb_init_disk(struct memstick_dev *card)
+ set_disk_ro(msb->disk, 1);
+
+ msb_start(card);
+- device_add_disk(&card->dev, msb->disk);
++ device_add_disk(&card->dev, msb->disk, NULL);
+ dbg("Disk added");
+ return 0;
+
+diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
+index 5ee932631faed..0cd30dcb68017 100644
+--- a/drivers/memstick/core/mspro_block.c
++++ b/drivers/memstick/core/mspro_block.c
+@@ -1236,7 +1236,7 @@ static int mspro_block_init_disk(struct memstick_dev *card)
+ set_capacity(msb->disk, capacity);
+ dev_dbg(&card->dev, "capacity set %ld\n", capacity);
+
+- device_add_disk(&card->dev, msb->disk);
++ device_add_disk(&card->dev, msb->disk, NULL);
+ msb->active = 1;
+ return 0;
+
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index a3248ebd28c62..182feab6da25b 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -38,6 +38,10 @@ static const struct eeprom_93xx46_devtype_data atmel_at93c46d_data = {
+ EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH,
+ };
+
++static const struct eeprom_93xx46_devtype_data microchip_93lc46b_data = {
++ .quirks = EEPROM_93XX46_QUIRK_EXTRA_READ_CYCLE,
++};
++
+ struct eeprom_93xx46_dev {
+ struct spi_device *spi;
+ struct eeprom_93xx46_platform_data *pdata;
+@@ -58,6 +62,11 @@ static inline bool has_quirk_instruction_length(struct eeprom_93xx46_dev *edev)
+ return edev->pdata->quirks & EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH;
+ }
+
++static inline bool has_quirk_extra_read_cycle(struct eeprom_93xx46_dev *edev)
++{
++ return edev->pdata->quirks & EEPROM_93XX46_QUIRK_EXTRA_READ_CYCLE;
++}
++
+ static int eeprom_93xx46_read(void *priv, unsigned int off,
+ void *val, size_t count)
+ {
+@@ -99,6 +108,11 @@ static int eeprom_93xx46_read(void *priv, unsigned int off,
+ dev_dbg(&edev->spi->dev, "read cmd 0x%x, %d Hz\n",
+ cmd_addr, edev->spi->max_speed_hz);
+
++ if (has_quirk_extra_read_cycle(edev)) {
++ cmd_addr <<= 1;
++ bits += 1;
++ }
++
+ spi_message_init(&m);
+
+ t[0].tx_buf = (char *)&cmd_addr;
+@@ -366,6 +380,7 @@ static void select_deassert(void *context)
+ static const struct of_device_id eeprom_93xx46_of_table[] = {
+ { .compatible = "eeprom-93xx46", },
+ { .compatible = "atmel,at93c46d", .data = &atmel_at93c46d_data, },
++ { .compatible = "microchip,93lc46b", .data = µchip_93lc46b_data, },
+ {}
+ };
+ MODULE_DEVICE_TABLE(of, eeprom_93xx46_of_table);
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 90656b625b9a6..77324ea4eb93e 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2671,7 +2671,7 @@ static int mmc_add_disk(struct mmc_blk_data *md)
+ int ret;
+ struct mmc_card *card = md->queue.card;
+
+- device_add_disk(md->parent, md->disk);
++ device_add_disk(md->parent, md->disk, NULL);
+ md->force_ro.show = force_ro_show;
+ md->force_ro.store = force_ro_store;
+ sysfs_attr_init(&md->force_ro.attr);
+diff --git a/drivers/mmc/host/sdhci-of-dwcmshc.c b/drivers/mmc/host/sdhci-of-dwcmshc.c
+index 1b7cd144fb01a..a34b17b284a53 100644
+--- a/drivers/mmc/host/sdhci-of-dwcmshc.c
++++ b/drivers/mmc/host/sdhci-of-dwcmshc.c
+@@ -28,6 +28,7 @@ static const struct sdhci_ops sdhci_dwcmshc_ops = {
+ static const struct sdhci_pltfm_data sdhci_dwcmshc_pdata = {
+ .ops = &sdhci_dwcmshc_ops,
+ .quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN,
++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
+ };
+
+ static int dwcmshc_probe(struct platform_device *pdev)
+diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
+index 29c0bfd74e8a1..6a41dfa3c36ba 100644
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -447,7 +447,7 @@ int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new)
+ if (new->readonly)
+ set_disk_ro(gd, 1);
+
+- device_add_disk(&new->mtd->dev, gd);
++ device_add_disk(&new->mtd->dev, gd, NULL);
+
+ if (new->disk_attributes) {
+ ret = sysfs_create_group(&disk_to_dev(gd)->kobj,
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 6fd1a639ec533..0c9e6cb0e3418 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -4238,6 +4238,7 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
+
+ switch (tp->mac_version) {
+ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26:
++ case RTL_GIGA_MAC_VER_29 ... RTL_GIGA_MAC_VER_30:
+ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33:
+ case RTL_GIGA_MAC_VER_37:
+ case RTL_GIGA_MAC_VER_39:
+@@ -4265,6 +4266,7 @@ static void r8168_pll_power_up(struct rtl8169_private *tp)
+ {
+ switch (tp->mac_version) {
+ case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26:
++ case RTL_GIGA_MAC_VER_29 ... RTL_GIGA_MAC_VER_30:
+ case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33:
+ case RTL_GIGA_MAC_VER_37:
+ case RTL_GIGA_MAC_VER_39:
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
+index 991b9cc180006..5907b34037c24 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -381,6 +381,8 @@ static void mwifiex_pcie_reset_prepare(struct pci_dev *pdev)
+ clear_bit(MWIFIEX_IFACE_WORK_DEVICE_DUMP, &card->work_flags);
+ clear_bit(MWIFIEX_IFACE_WORK_CARD_RESET, &card->work_flags);
+ mwifiex_dbg(adapter, INFO, "%s, successful\n", __func__);
++
++ card->pci_reset_ongoing = true;
+ }
+
+ /*
+@@ -409,6 +411,8 @@ static void mwifiex_pcie_reset_done(struct pci_dev *pdev)
+ dev_err(&pdev->dev, "reinit failed: %d\n", ret);
+ else
+ mwifiex_dbg(adapter, INFO, "%s, successful\n", __func__);
++
++ card->pci_reset_ongoing = false;
+ }
+
+ static const struct pci_error_handlers mwifiex_pcie_err_handler = {
+@@ -3000,7 +3004,19 @@ static void mwifiex_cleanup_pcie(struct mwifiex_adapter *adapter)
+ int ret;
+ u32 fw_status;
+
+- cancel_work_sync(&card->work);
++ /* Perform the cancel_work_sync() only when we're not resetting
++ * the card. It's because that function never returns if we're
++ * in reset path. If we're here when resetting the card, it means
++ * that we failed to reset the card (reset failure path).
++ */
++ if (!card->pci_reset_ongoing) {
++ mwifiex_dbg(adapter, MSG, "performing cancel_work_sync()...\n");
++ cancel_work_sync(&card->work);
++ mwifiex_dbg(adapter, MSG, "cancel_work_sync() done\n");
++ } else {
++ mwifiex_dbg(adapter, MSG,
++ "skipped cancel_work_sync() because we're in card reset failure path\n");
++ }
+
+ ret = mwifiex_read_reg(adapter, reg->fw_status, &fw_status);
+ if (fw_status == FIRMWARE_READY_PCIE) {
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.h b/drivers/net/wireless/marvell/mwifiex/pcie.h
+index f7ce9b6db6b41..72d0c01ff3592 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.h
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.h
+@@ -391,6 +391,8 @@ struct pcie_service_card {
+ struct mwifiex_msix_context share_irq_ctx;
+ struct work_struct work;
+ unsigned long work_flags;
++
++ bool pci_reset_ongoing;
+ };
+
+ static inline int
+diff --git a/drivers/nvdimm/blk.c b/drivers/nvdimm/blk.c
+index 62e9cb167aad5..db45c6bbb7bb1 100644
+--- a/drivers/nvdimm/blk.c
++++ b/drivers/nvdimm/blk.c
+@@ -290,7 +290,7 @@ static int nsblk_attach_disk(struct nd_namespace_blk *nsblk)
+ }
+
+ set_capacity(disk, available_disk_size >> SECTOR_SHIFT);
+- device_add_disk(dev, disk);
++ device_add_disk(dev, disk, NULL);
+ revalidate_disk(disk);
+ return 0;
+ }
+diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
+index 853edc649ed41..b6823e66af13c 100644
+--- a/drivers/nvdimm/btt.c
++++ b/drivers/nvdimm/btt.c
+@@ -1565,7 +1565,7 @@ static int btt_blk_init(struct btt *btt)
+ }
+ }
+ set_capacity(btt->btt_disk, btt->nlba * btt->sector_size >> 9);
+- device_add_disk(&btt->nd_btt->dev, btt->btt_disk);
++ device_add_disk(&btt->nd_btt->dev, btt->btt_disk, NULL);
+ btt->nd_btt->size = btt->nlba * (u64)btt->sector_size;
+ revalidate_disk(btt->btt_disk);
+
+diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
+index a7ce2f1761a2c..d6f981f6ef592 100644
+--- a/drivers/nvdimm/pmem.c
++++ b/drivers/nvdimm/pmem.c
+@@ -479,7 +479,7 @@ static int pmem_attach_disk(struct device *dev,
+ gendev = disk_to_dev(disk);
+ gendev->groups = pmem_attribute_groups;
+
+- device_add_disk(dev, disk);
++ device_add_disk(dev, disk, NULL);
+ if (devm_add_action_or_reset(dev, pmem_release_disk, pmem))
+ return -ENOMEM;
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index b633ea40430ee..513dd1e2aac76 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2842,6 +2842,14 @@ const struct attribute_group nvme_ns_id_attr_group = {
+ .is_visible = nvme_ns_id_attrs_are_visible,
+ };
+
++const struct attribute_group *nvme_ns_id_attr_groups[] = {
++ &nvme_ns_id_attr_group,
++#ifdef CONFIG_NVM
++ &nvme_nvm_attr_group,
++#endif
++ NULL,
++};
++
+ #define nvme_show_str_function(field) \
+ static ssize_t field##_show(struct device *dev, \
+ struct device_attribute *attr, char *buf) \
+@@ -3211,14 +3219,7 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
+
+ nvme_get_ctrl(ctrl);
+
+- device_add_disk(ctrl->device, ns->disk);
+- if (sysfs_create_group(&disk_to_dev(ns->disk)->kobj,
+- &nvme_ns_id_attr_group))
+- pr_warn("%s: failed to create sysfs group for identification\n",
+- ns->disk->disk_name);
+- if (ns->ndev && nvme_nvm_register_sysfs(ns))
+- pr_warn("%s: failed to register lightnvm sysfs group for identification\n",
+- ns->disk->disk_name);
++ device_add_disk(ctrl->device, ns->disk, nvme_ns_id_attr_groups);
+
+ nvme_mpath_add_disk(ns, id);
+ nvme_fault_inject_init(ns);
+@@ -3252,10 +3253,6 @@ static void nvme_ns_remove(struct nvme_ns *ns)
+ synchronize_srcu(&ns->head->srcu); /* wait for concurrent submissions */
+
+ if (ns->disk && ns->disk->flags & GENHD_FL_UP) {
+- sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
+- &nvme_ns_id_attr_group);
+- if (ns->ndev)
+- nvme_nvm_unregister_sysfs(ns);
+ del_gendisk(ns->disk);
+ blk_cleanup_queue(ns->queue);
+ if (blk_get_integrity(ns->disk))
+diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
+index a69553e75f38e..d10257b9c5236 100644
+--- a/drivers/nvme/host/lightnvm.c
++++ b/drivers/nvme/host/lightnvm.c
+@@ -1193,10 +1193,29 @@ static NVM_DEV_ATTR_12_RO(multiplane_modes);
+ static NVM_DEV_ATTR_12_RO(media_capabilities);
+ static NVM_DEV_ATTR_12_RO(max_phys_secs);
+
+-static struct attribute *nvm_dev_attrs_12[] = {
++/* 2.0 values */
++static NVM_DEV_ATTR_20_RO(groups);
++static NVM_DEV_ATTR_20_RO(punits);
++static NVM_DEV_ATTR_20_RO(chunks);
++static NVM_DEV_ATTR_20_RO(clba);
++static NVM_DEV_ATTR_20_RO(ws_min);
++static NVM_DEV_ATTR_20_RO(ws_opt);
++static NVM_DEV_ATTR_20_RO(maxoc);
++static NVM_DEV_ATTR_20_RO(maxocpu);
++static NVM_DEV_ATTR_20_RO(mw_cunits);
++static NVM_DEV_ATTR_20_RO(write_typ);
++static NVM_DEV_ATTR_20_RO(write_max);
++static NVM_DEV_ATTR_20_RO(reset_typ);
++static NVM_DEV_ATTR_20_RO(reset_max);
++
++static struct attribute *nvm_dev_attrs[] = {
++ /* version agnostic attrs */
+ &dev_attr_version.attr,
+ &dev_attr_capabilities.attr,
++ &dev_attr_read_typ.attr,
++ &dev_attr_read_max.attr,
+
++ /* 1.2 attrs */
+ &dev_attr_vendor_opcode.attr,
+ &dev_attr_device_mode.attr,
+ &dev_attr_media_manager.attr,
+@@ -1211,8 +1230,6 @@ static struct attribute *nvm_dev_attrs_12[] = {
+ &dev_attr_page_size.attr,
+ &dev_attr_hw_sector_size.attr,
+ &dev_attr_oob_sector_size.attr,
+- &dev_attr_read_typ.attr,
+- &dev_attr_read_max.attr,
+ &dev_attr_prog_typ.attr,
+ &dev_attr_prog_max.attr,
+ &dev_attr_erase_typ.attr,
+@@ -1221,33 +1238,7 @@ static struct attribute *nvm_dev_attrs_12[] = {
+ &dev_attr_media_capabilities.attr,
+ &dev_attr_max_phys_secs.attr,
+
+- NULL,
+-};
+-
+-static const struct attribute_group nvm_dev_attr_group_12 = {
+- .name = "lightnvm",
+- .attrs = nvm_dev_attrs_12,
+-};
+-
+-/* 2.0 values */
+-static NVM_DEV_ATTR_20_RO(groups);
+-static NVM_DEV_ATTR_20_RO(punits);
+-static NVM_DEV_ATTR_20_RO(chunks);
+-static NVM_DEV_ATTR_20_RO(clba);
+-static NVM_DEV_ATTR_20_RO(ws_min);
+-static NVM_DEV_ATTR_20_RO(ws_opt);
+-static NVM_DEV_ATTR_20_RO(maxoc);
+-static NVM_DEV_ATTR_20_RO(maxocpu);
+-static NVM_DEV_ATTR_20_RO(mw_cunits);
+-static NVM_DEV_ATTR_20_RO(write_typ);
+-static NVM_DEV_ATTR_20_RO(write_max);
+-static NVM_DEV_ATTR_20_RO(reset_typ);
+-static NVM_DEV_ATTR_20_RO(reset_max);
+-
+-static struct attribute *nvm_dev_attrs_20[] = {
+- &dev_attr_version.attr,
+- &dev_attr_capabilities.attr,
+-
++ /* 2.0 attrs */
+ &dev_attr_groups.attr,
+ &dev_attr_punits.attr,
+ &dev_attr_chunks.attr,
+@@ -1258,8 +1249,6 @@ static struct attribute *nvm_dev_attrs_20[] = {
+ &dev_attr_maxocpu.attr,
+ &dev_attr_mw_cunits.attr,
+
+- &dev_attr_read_typ.attr,
+- &dev_attr_read_max.attr,
+ &dev_attr_write_typ.attr,
+ &dev_attr_write_max.attr,
+ &dev_attr_reset_typ.attr,
+@@ -1268,44 +1257,38 @@ static struct attribute *nvm_dev_attrs_20[] = {
+ NULL,
+ };
+
+-static const struct attribute_group nvm_dev_attr_group_20 = {
+- .name = "lightnvm",
+- .attrs = nvm_dev_attrs_20,
+-};
+-
+-int nvme_nvm_register_sysfs(struct nvme_ns *ns)
++static umode_t nvm_dev_attrs_visible(struct kobject *kobj,
++ struct attribute *attr, int index)
+ {
++ struct device *dev = container_of(kobj, struct device, kobj);
++ struct gendisk *disk = dev_to_disk(dev);
++ struct nvme_ns *ns = disk->private_data;
+ struct nvm_dev *ndev = ns->ndev;
+- struct nvm_geo *geo = &ndev->geo;
++ struct device_attribute *dev_attr =
++ container_of(attr, typeof(*dev_attr), attr);
+
+ if (!ndev)
+- return -EINVAL;
+-
+- switch (geo->major_ver_id) {
+- case 1:
+- return sysfs_create_group(&disk_to_dev(ns->disk)->kobj,
+- &nvm_dev_attr_group_12);
+- case 2:
+- return sysfs_create_group(&disk_to_dev(ns->disk)->kobj,
+- &nvm_dev_attr_group_20);
+- }
+-
+- return -EINVAL;
+-}
++ return 0;
+
+-void nvme_nvm_unregister_sysfs(struct nvme_ns *ns)
+-{
+- struct nvm_dev *ndev = ns->ndev;
+- struct nvm_geo *geo = &ndev->geo;
++ if (dev_attr->show == nvm_dev_attr_show)
++ return attr->mode;
+
+- switch (geo->major_ver_id) {
++ switch (ndev->geo.major_ver_id) {
+ case 1:
+- sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
+- &nvm_dev_attr_group_12);
++ if (dev_attr->show == nvm_dev_attr_show_12)
++ return attr->mode;
+ break;
+ case 2:
+- sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
+- &nvm_dev_attr_group_20);
++ if (dev_attr->show == nvm_dev_attr_show_20)
++ return attr->mode;
+ break;
+ }
++
++ return 0;
+ }
++
++const struct attribute_group nvme_nvm_attr_group = {
++ .name = "lightnvm",
++ .attrs = nvm_dev_attrs,
++ .is_visible = nvm_dev_attrs_visible,
++};
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index e71075338ff5c..4ef05fe00dace 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -313,13 +313,9 @@ static void nvme_mpath_set_live(struct nvme_ns *ns)
+ if (!head->disk)
+ return;
+
+- if (!(head->disk->flags & GENHD_FL_UP)) {
+- device_add_disk(&head->subsys->dev, head->disk);
+- if (sysfs_create_group(&disk_to_dev(head->disk)->kobj,
+- &nvme_ns_id_attr_group))
+- dev_warn(&head->subsys->dev,
+- "failed to create id group.\n");
+- }
++ if (!(head->disk->flags & GENHD_FL_UP))
++ device_add_disk(&head->subsys->dev, head->disk,
++ nvme_ns_id_attr_groups);
+
+ synchronize_srcu(&ns->head->srcu);
+ kblockd_schedule_work(&ns->head->requeue_work);
+@@ -541,11 +537,8 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head)
+ {
+ if (!head->disk)
+ return;
+- if (head->disk->flags & GENHD_FL_UP) {
+- sysfs_remove_group(&disk_to_dev(head->disk)->kobj,
+- &nvme_ns_id_attr_group);
++ if (head->disk->flags & GENHD_FL_UP)
+ del_gendisk(head->disk);
+- }
+ blk_set_queue_dying(head->disk->queue);
+ /* make sure all pending bios are cleaned up */
+ kblockd_schedule_work(&head->requeue_work);
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index 9c2e7a151e400..2769755067093 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -464,7 +464,7 @@ int nvme_delete_ctrl_sync(struct nvme_ctrl *ctrl);
+ int nvme_get_log(struct nvme_ctrl *ctrl, u32 nsid, u8 log_page, u8 lsp,
+ void *log, size_t size, u64 offset);
+
+-extern const struct attribute_group nvme_ns_id_attr_group;
++extern const struct attribute_group *nvme_ns_id_attr_groups[];
+ extern const struct block_device_operations nvme_ns_head_ops;
+
+ #ifdef CONFIG_NVME_MULTIPATH
+@@ -589,8 +589,7 @@ static inline void nvme_mpath_update_disk_size(struct gendisk *disk)
+ void nvme_nvm_update_nvm_info(struct nvme_ns *ns);
+ int nvme_nvm_register(struct nvme_ns *ns, char *disk_name, int node);
+ void nvme_nvm_unregister(struct nvme_ns *ns);
+-int nvme_nvm_register_sysfs(struct nvme_ns *ns);
+-void nvme_nvm_unregister_sysfs(struct nvme_ns *ns);
++extern const struct attribute_group nvme_nvm_attr_group;
+ int nvme_nvm_ioctl(struct nvme_ns *ns, unsigned int cmd, unsigned long arg);
+ #else
+ static inline void nvme_nvm_update_nvm_info(struct nvme_ns *ns) {};
+@@ -601,11 +600,6 @@ static inline int nvme_nvm_register(struct nvme_ns *ns, char *disk_name,
+ }
+
+ static inline void nvme_nvm_unregister(struct nvme_ns *ns) {};
+-static inline int nvme_nvm_register_sysfs(struct nvme_ns *ns)
+-{
+- return 0;
+-}
+-static inline void nvme_nvm_unregister_sysfs(struct nvme_ns *ns) {};
+ static inline int nvme_nvm_ioctl(struct nvme_ns *ns, unsigned int cmd,
+ unsigned long arg)
+ {
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index af2149632102a..70f05595da60d 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3961,6 +3961,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9183,
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c46 */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x91a0,
+ quirk_dma_func1_alias);
++/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c135 */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9215,
++ quirk_dma_func1_alias);
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c127 */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9220,
+ quirk_dma_func1_alias);
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index 92400abe35520..bd25c8a156d24 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -43,6 +43,7 @@
+ #include <linux/input/sparse-keymap.h>
+ #include <acpi/video.h>
+
++ACPI_MODULE_NAME(KBUILD_MODNAME);
+ MODULE_AUTHOR("Carlos Corbacho");
+ MODULE_DESCRIPTION("Acer Laptop WMI Extras Driver");
+ MODULE_LICENSE("GPL");
+@@ -93,7 +94,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");
+
+ enum acer_wmi_event_ids {
+ WMID_HOTKEY_EVENT = 0x1,
+- WMID_ACCEL_EVENT = 0x5,
++ WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5,
+ };
+
+ static const struct key_entry acer_wmi_keymap[] __initconst = {
+@@ -141,7 +142,9 @@ struct event_return_value {
+ u8 function;
+ u8 key_num;
+ u16 device_state;
+- u32 reserved;
++ u16 reserved1;
++ u8 kbd_dock_state;
++ u8 reserved2;
+ } __attribute__((packed));
+
+ /*
+@@ -219,14 +222,13 @@ struct hotkey_function_type_aa {
+ /*
+ * Interface capability flags
+ */
+-#define ACER_CAP_MAILLED (1<<0)
+-#define ACER_CAP_WIRELESS (1<<1)
+-#define ACER_CAP_BLUETOOTH (1<<2)
+-#define ACER_CAP_BRIGHTNESS (1<<3)
+-#define ACER_CAP_THREEG (1<<4)
+-#define ACER_CAP_ACCEL (1<<5)
+-#define ACER_CAP_RFBTN (1<<6)
+-#define ACER_CAP_ANY (0xFFFFFFFF)
++#define ACER_CAP_MAILLED BIT(0)
++#define ACER_CAP_WIRELESS BIT(1)
++#define ACER_CAP_BLUETOOTH BIT(2)
++#define ACER_CAP_BRIGHTNESS BIT(3)
++#define ACER_CAP_THREEG BIT(4)
++#define ACER_CAP_SET_FUNCTION_MODE BIT(5)
++#define ACER_CAP_KBD_DOCK BIT(6)
+
+ /*
+ * Interface type flags
+@@ -249,6 +251,7 @@ static int mailled = -1;
+ static int brightness = -1;
+ static int threeg = -1;
+ static int force_series;
++static int force_caps = -1;
+ static bool ec_raw_mode;
+ static bool has_type_aa;
+ static u16 commun_func_bitmap;
+@@ -258,11 +261,13 @@ module_param(mailled, int, 0444);
+ module_param(brightness, int, 0444);
+ module_param(threeg, int, 0444);
+ module_param(force_series, int, 0444);
++module_param(force_caps, int, 0444);
+ module_param(ec_raw_mode, bool, 0444);
+ MODULE_PARM_DESC(mailled, "Set initial state of Mail LED");
+ MODULE_PARM_DESC(brightness, "Set initial LCD backlight brightness");
+ MODULE_PARM_DESC(threeg, "Set initial state of 3G hardware");
+ MODULE_PARM_DESC(force_series, "Force a different laptop series");
++MODULE_PARM_DESC(force_caps, "Force the capability bitmask to this value");
+ MODULE_PARM_DESC(ec_raw_mode, "Enable EC raw mode");
+
+ struct acer_data {
+@@ -333,6 +338,15 @@ static int __init dmi_matched(const struct dmi_system_id *dmi)
+ return 1;
+ }
+
++static int __init set_force_caps(const struct dmi_system_id *dmi)
++{
++ if (force_caps == -1) {
++ force_caps = (uintptr_t)dmi->driver_data;
++ pr_info("Found %s, set force_caps to 0x%x\n", dmi->ident, force_caps);
++ }
++ return 1;
++}
++
+ static struct quirk_entry quirk_unknown = {
+ };
+
+@@ -511,6 +525,33 @@ static const struct dmi_system_id acer_quirks[] __initconst = {
+ },
+ .driver_data = &quirk_acer_travelmate_2490,
+ },
++ {
++ .callback = set_force_caps,
++ .ident = "Acer Aspire Switch 10E SW3-016",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW3-016"),
++ },
++ .driver_data = (void *)ACER_CAP_KBD_DOCK,
++ },
++ {
++ .callback = set_force_caps,
++ .ident = "Acer Aspire Switch 10 SW5-012",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"),
++ },
++ .driver_data = (void *)ACER_CAP_KBD_DOCK,
++ },
++ {
++ .callback = set_force_caps,
++ .ident = "Acer One 10 (S1003)",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"),
++ },
++ .driver_data = (void *)ACER_CAP_KBD_DOCK,
++ },
+ {}
+ };
+
+@@ -1266,10 +1307,8 @@ static void __init type_aa_dmi_decode(const struct dmi_header *header, void *d)
+ interface->capability |= ACER_CAP_THREEG;
+ if (type_aa->commun_func_bitmap & ACER_WMID3_GDS_BLUETOOTH)
+ interface->capability |= ACER_CAP_BLUETOOTH;
+- if (type_aa->commun_func_bitmap & ACER_WMID3_GDS_RFBTN) {
+- interface->capability |= ACER_CAP_RFBTN;
++ if (type_aa->commun_func_bitmap & ACER_WMID3_GDS_RFBTN)
+ commun_func_bitmap &= ~ACER_WMID3_GDS_RFBTN;
+- }
+
+ commun_fn_key_number = type_aa->commun_fn_key_number;
+ }
+@@ -1530,7 +1569,7 @@ static int acer_gsensor_event(void)
+ struct acpi_buffer output;
+ union acpi_object out_obj[5];
+
+- if (!has_cap(ACER_CAP_ACCEL))
++ if (!acer_wmi_accel_dev)
+ return -1;
+
+ output.length = sizeof(out_obj);
+@@ -1553,6 +1592,71 @@ static int acer_gsensor_event(void)
+ return 0;
+ }
+
++/*
++ * Switch series keyboard dock status
++ */
++static int acer_kbd_dock_state_to_sw_tablet_mode(u8 kbd_dock_state)
++{
++ switch (kbd_dock_state) {
++ case 0x01: /* Docked, traditional clamshell laptop mode */
++ return 0;
++ case 0x04: /* Stand-alone tablet */
++ case 0x40: /* Docked, tent mode, keyboard not usable */
++ return 1;
++ default:
++ pr_warn("Unknown kbd_dock_state 0x%02x\n", kbd_dock_state);
++ }
++
++ return 0;
++}
++
++static void acer_kbd_dock_get_initial_state(void)
++{
++ u8 *output, input[8] = { 0x05, 0x00, };
++ struct acpi_buffer input_buf = { sizeof(input), input };
++ struct acpi_buffer output_buf = { ACPI_ALLOCATE_BUFFER, NULL };
++ union acpi_object *obj;
++ acpi_status status;
++ int sw_tablet_mode;
++
++ status = wmi_evaluate_method(WMID_GUID3, 0, 0x2, &input_buf, &output_buf);
++ if (ACPI_FAILURE(status)) {
++ ACPI_EXCEPTION((AE_INFO, status, "Error getting keyboard-dock initial status"));
++ return;
++ }
++
++ obj = output_buf.pointer;
++ if (!obj || obj->type != ACPI_TYPE_BUFFER || obj->buffer.length != 8) {
++ pr_err("Unexpected output format getting keyboard-dock initial status\n");
++ goto out_free_obj;
++ }
++
++ output = obj->buffer.pointer;
++ if (output[0] != 0x00 || (output[3] != 0x05 && output[3] != 0x45)) {
++ pr_err("Unexpected output [0]=0x%02x [3]=0x%02x getting keyboard-dock initial status\n",
++ output[0], output[3]);
++ goto out_free_obj;
++ }
++
++ sw_tablet_mode = acer_kbd_dock_state_to_sw_tablet_mode(output[4]);
++ input_report_switch(acer_wmi_input_dev, SW_TABLET_MODE, sw_tablet_mode);
++
++out_free_obj:
++ kfree(obj);
++}
++
++static void acer_kbd_dock_event(const struct event_return_value *event)
++{
++ int sw_tablet_mode;
++
++ if (!has_cap(ACER_CAP_KBD_DOCK))
++ return;
++
++ sw_tablet_mode = acer_kbd_dock_state_to_sw_tablet_mode(event->kbd_dock_state);
++ input_report_switch(acer_wmi_input_dev, SW_TABLET_MODE, sw_tablet_mode);
++ input_sync(acer_wmi_input_dev);
++}
++
+ /*
+ * Rfkill devices
+ */
+@@ -1780,8 +1884,9 @@ static void acer_wmi_notify(u32 value, void *context)
+ sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true);
+ }
+ break;
+- case WMID_ACCEL_EVENT:
++ case WMID_ACCEL_OR_KBD_DOCK_EVENT:
+ acer_gsensor_event();
++ acer_kbd_dock_event(&return_value);
+ break;
+ default:
+ pr_warn("Unknown function number - %d - %d\n",
+@@ -1939,8 +2044,6 @@ static int __init acer_wmi_accel_setup(void)
+ if (err)
+ return err;
+
+- interface->capability |= ACER_CAP_ACCEL;
+-
+ acer_wmi_accel_dev = input_allocate_device();
+ if (!acer_wmi_accel_dev)
+ return -ENOMEM;
+@@ -1966,11 +2069,6 @@ err_free_dev:
+ return err;
+ }
+
+-static void acer_wmi_accel_destroy(void)
+-{
+- input_unregister_device(acer_wmi_accel_dev);
+-}
+-
+ static int __init acer_wmi_input_setup(void)
+ {
+ acpi_status status;
+@@ -1988,6 +2086,9 @@ static int __init acer_wmi_input_setup(void)
+ if (err)
+ goto err_free_dev;
+
++ if (has_cap(ACER_CAP_KBD_DOCK))
++ input_set_capability(acer_wmi_input_dev, EV_SW, SW_TABLET_MODE);
++
+ status = wmi_install_notify_handler(ACERWMID_EVENT_GUID,
+ acer_wmi_notify, NULL);
+ if (ACPI_FAILURE(status)) {
+@@ -1995,6 +2096,9 @@ static int __init acer_wmi_input_setup(void)
+ goto err_free_dev;
+ }
+
++ if (has_cap(ACER_CAP_KBD_DOCK))
++ acer_kbd_dock_get_initial_state();
++
+ err = input_register_device(acer_wmi_input_dev);
+ if (err)
+ goto err_uninstall_notifier;
+@@ -2125,7 +2229,7 @@ static int acer_resume(struct device *dev)
+ if (has_cap(ACER_CAP_BRIGHTNESS))
+ set_u32(data->brightness, ACER_CAP_BRIGHTNESS);
+
+- if (has_cap(ACER_CAP_ACCEL))
++ if (acer_wmi_accel_dev)
+ acer_gsensor_init();
+
+ return 0;
+@@ -2240,7 +2344,7 @@ static int __init acer_wmi_init(void)
+ }
+ /* WMID always provides brightness methods */
+ interface->capability |= ACER_CAP_BRIGHTNESS;
+- } else if (!wmi_has_guid(WMID_GUID2) && interface && !has_type_aa) {
++ } else if (!wmi_has_guid(WMID_GUID2) && interface && !has_type_aa && force_caps == -1) {
+ pr_err("No WMID device detection method found\n");
+ return -ENODEV;
+ }
+@@ -2270,7 +2374,14 @@ static int __init acer_wmi_init(void)
+ if (acpi_video_get_backlight_type() != acpi_backlight_vendor)
+ interface->capability &= ~ACER_CAP_BRIGHTNESS;
+
+- if (wmi_has_guid(WMID_GUID3)) {
++ if (wmi_has_guid(WMID_GUID3))
++ interface->capability |= ACER_CAP_SET_FUNCTION_MODE;
++
++ if (force_caps != -1)
++ interface->capability = force_caps;
++
++ if (wmi_has_guid(WMID_GUID3) &&
++ (interface->capability & ACER_CAP_SET_FUNCTION_MODE)) {
+ if (ACPI_FAILURE(acer_wmi_enable_rf_button()))
+ pr_warn("Cannot enable RF Button Driver\n");
+
+@@ -2333,8 +2444,8 @@ error_device_alloc:
+ error_platform_register:
+ if (wmi_has_guid(ACERWMID_EVENT_GUID))
+ acer_wmi_input_destroy();
+- if (has_cap(ACER_CAP_ACCEL))
+- acer_wmi_accel_destroy();
++ if (acer_wmi_accel_dev)
++ input_unregister_device(acer_wmi_accel_dev);
+
+ return err;
+ }
+@@ -2344,8 +2455,8 @@ static void __exit acer_wmi_exit(void)
+ if (wmi_has_guid(ACERWMID_EVENT_GUID))
+ acer_wmi_input_destroy();
+
+- if (has_cap(ACER_CAP_ACCEL))
+- acer_wmi_accel_destroy();
++ if (acer_wmi_accel_dev)
++ input_unregister_device(acer_wmi_accel_dev);
+
+ remove_debugfs();
+ platform_device_unregister(acer_platform_device);
+diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
+index 7036a6c6f86ff..5542d9eadfe0e 100644
+--- a/drivers/s390/block/dasd_genhd.c
++++ b/drivers/s390/block/dasd_genhd.c
+@@ -76,7 +76,7 @@ int dasd_gendisk_alloc(struct dasd_block *block)
+ gdp->queue = block->request_queue;
+ block->gdp = gdp;
+ set_capacity(block->gdp, 0);
+- device_add_disk(&base->cdev->dev, block->gdp);
++ device_add_disk(&base->cdev->dev, block->gdp, NULL);
+ return 0;
+ }
+
+diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
+index 23e526cda5c10..4e8aedd50cb0d 100644
+--- a/drivers/s390/block/dcssblk.c
++++ b/drivers/s390/block/dcssblk.c
+@@ -685,7 +685,7 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
+ }
+
+ get_device(&dev_info->dev);
+- device_add_disk(&dev_info->dev, dev_info->gd);
++ device_add_disk(&dev_info->dev, dev_info->gd, NULL);
+
+ switch (dev_info->segment_type) {
+ case SEG_TYPE_SR:
+diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
+index 98f66b7b67945..e01889394c841 100644
+--- a/drivers/s390/block/scm_blk.c
++++ b/drivers/s390/block/scm_blk.c
+@@ -500,7 +500,7 @@ int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
+
+ /* 512 byte sectors */
+ set_capacity(bdev->gendisk, scmdev->size >> 9);
+- device_add_disk(&scmdev->dev, bdev->gendisk);
++ device_add_disk(&scmdev->dev, bdev->gendisk, NULL);
+ return 0;
+
+ out_queue:
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index f2f14d8d59432..342352d8e7bf9 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3348,7 +3348,7 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
+ }
+
+ blk_pm_runtime_init(sdp->request_queue, dev);
+- device_add_disk(dev, gd);
++ device_add_disk(dev, gd, NULL);
+ if (sdkp->capacity)
+ sd_dif_config_host(sdkp);
+
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index 5be3d6b7991b4..45c8bf39ad238 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -758,7 +758,7 @@ static int sr_probe(struct device *dev)
+
+ dev_set_drvdata(dev, cd);
+ disk->flags |= GENHD_FL_REMOVABLE;
+- device_add_disk(&sdev->sdev_gendev, disk);
++ device_add_disk(&sdev->sdev_gendev, disk, NULL);
+
+ sdev_printk(KERN_DEBUG, sdev,
+ "Attached scsi CD-ROM %s\n", cd->cdi.name);
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index 14855972dee30..fea5ccfade5c6 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -642,7 +642,7 @@ static int btrfs_delayed_inode_reserve_metadata(
+ btrfs_ino(inode),
+ num_bytes, 1);
+ } else {
+- btrfs_qgroup_free_meta_prealloc(root, fs_info->nodesize);
++ btrfs_qgroup_free_meta_prealloc(root, num_bytes);
+ }
+ return ret;
+ }
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 646152f305843..a202f2f12b1c0 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -3016,8 +3016,11 @@ reserve_space:
+ goto out;
+ ret = btrfs_qgroup_reserve_data(inode, &data_reserved,
+ alloc_start, bytes_to_reserve);
+- if (ret)
++ if (ret) {
++ unlock_extent_cached(&BTRFS_I(inode)->io_tree, lockstart,
++ lockend, &cached_state);
+ goto out;
++ }
+ ret = btrfs_prealloc_file_range(inode, mode, alloc_start,
+ alloc_end - alloc_start,
+ i_blocksize(inode),
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index f3658d6ea6571..1c053e10b33ba 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1842,7 +1842,10 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file,
+ if (vol_args->flags & BTRFS_SUBVOL_RDONLY)
+ readonly = true;
+ if (vol_args->flags & BTRFS_SUBVOL_QGROUP_INHERIT) {
+- if (vol_args->size > PAGE_SIZE) {
++ u64 nums;
++
++ if (vol_args->size < sizeof(*inherit) ||
++ vol_args->size > PAGE_SIZE) {
+ ret = -EINVAL;
+ goto free_args;
+ }
+@@ -1851,6 +1854,20 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file,
+ ret = PTR_ERR(inherit);
+ goto free_args;
+ }
++
++ if (inherit->num_qgroups > PAGE_SIZE ||
++ inherit->num_ref_copies > PAGE_SIZE ||
++ inherit->num_excl_copies > PAGE_SIZE) {
++ ret = -EINVAL;
++ goto free_inherit;
++ }
++
++ nums = inherit->num_qgroups + 2 * inherit->num_ref_copies +
++ 2 * inherit->num_excl_copies;
++ if (vol_args->size != struct_size(inherit, qgroups, nums)) {
++ ret = -EINVAL;
++ goto free_inherit;
++ }
+ }
+
+ ret = btrfs_ioctl_snap_create_transid(file, vol_args->name,
+diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
+index 927f9f3daddbf..a91f74cf5cd18 100644
+--- a/fs/btrfs/raid56.c
++++ b/fs/btrfs/raid56.c
+@@ -1182,22 +1182,19 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
+ int nr_data = rbio->nr_data;
+ int stripe;
+ int pagenr;
+- int p_stripe = -1;
+- int q_stripe = -1;
++ bool has_qstripe;
+ struct bio_list bio_list;
+ struct bio *bio;
+ int ret;
+
+ bio_list_init(&bio_list);
+
+- if (rbio->real_stripes - rbio->nr_data == 1) {
+- p_stripe = rbio->real_stripes - 1;
+- } else if (rbio->real_stripes - rbio->nr_data == 2) {
+- p_stripe = rbio->real_stripes - 2;
+- q_stripe = rbio->real_stripes - 1;
+- } else {
++ if (rbio->real_stripes - rbio->nr_data == 1)
++ has_qstripe = false;
++ else if (rbio->real_stripes - rbio->nr_data == 2)
++ has_qstripe = true;
++ else
+ BUG();
+- }
+
+ /* at this point we either have a full stripe,
+ * or we've read the full stripe from the drive.
+@@ -1241,7 +1238,7 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
+ SetPageUptodate(p);
+ pointers[stripe++] = kmap(p);
+
+- if (q_stripe != -1) {
++ if (has_qstripe) {
+
+ /*
+ * raid6, add the qstripe and call the
+@@ -2340,8 +2337,7 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio,
+ int nr_data = rbio->nr_data;
+ int stripe;
+ int pagenr;
+- int p_stripe = -1;
+- int q_stripe = -1;
++ bool has_qstripe;
+ struct page *p_page = NULL;
+ struct page *q_page = NULL;
+ struct bio_list bio_list;
+@@ -2351,14 +2347,12 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio,
+
+ bio_list_init(&bio_list);
+
+- if (rbio->real_stripes - rbio->nr_data == 1) {
+- p_stripe = rbio->real_stripes - 1;
+- } else if (rbio->real_stripes - rbio->nr_data == 2) {
+- p_stripe = rbio->real_stripes - 2;
+- q_stripe = rbio->real_stripes - 1;
+- } else {
++ if (rbio->real_stripes - rbio->nr_data == 1)
++ has_qstripe = false;
++ else if (rbio->real_stripes - rbio->nr_data == 2)
++ has_qstripe = true;
++ else
+ BUG();
+- }
+
+ if (bbio->num_tgtdevs && bbio->tgtdev_map[rbio->scrubp]) {
+ is_replace = 1;
+@@ -2380,17 +2374,22 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio,
+ goto cleanup;
+ SetPageUptodate(p_page);
+
+- if (q_stripe != -1) {
++ if (has_qstripe) {
++ /* RAID6, allocate and map temp space for the Q stripe */
+ q_page = alloc_page(GFP_NOFS | __GFP_HIGHMEM);
+ if (!q_page) {
+ __free_page(p_page);
+ goto cleanup;
+ }
+ SetPageUptodate(q_page);
++ pointers[rbio->real_stripes - 1] = kmap(q_page);
+ }
+
+ atomic_set(&rbio->error, 0);
+
++ /* Map the parity stripe just once */
++ pointers[nr_data] = kmap(p_page);
++
+ for_each_set_bit(pagenr, rbio->dbitmap, rbio->stripe_npages) {
+ struct page *p;
+ void *parity;
+@@ -2400,17 +2399,8 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio,
+ pointers[stripe] = kmap(p);
+ }
+
+- /* then add the parity stripe */
+- pointers[stripe++] = kmap(p_page);
+-
+- if (q_stripe != -1) {
+-
+- /*
+- * raid6, add the qstripe and call the
+- * library function to fill in our p/q
+- */
+- pointers[stripe++] = kmap(q_page);
+-
++ if (has_qstripe) {
++ /* RAID6, call the library function to fill in our P/Q */
+ raid6_call.gen_syndrome(rbio->real_stripes, PAGE_SIZE,
+ pointers);
+ } else {
+@@ -2431,12 +2421,14 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio,
+
+ for (stripe = 0; stripe < nr_data; stripe++)
+ kunmap(page_in_rbio(rbio, stripe, pagenr, 0));
+- kunmap(p_page);
+ }
+
++ kunmap(p_page);
+ __free_page(p_page);
+- if (q_page)
++ if (q_page) {
++ kunmap(q_page);
+ __free_page(q_page);
++ }
+
+ writeback:
+ /*
+diff --git a/include/linux/eeprom_93xx46.h b/include/linux/eeprom_93xx46.h
+index eec7928ff8fe0..99580c22f91a4 100644
+--- a/include/linux/eeprom_93xx46.h
++++ b/include/linux/eeprom_93xx46.h
+@@ -16,6 +16,8 @@ struct eeprom_93xx46_platform_data {
+ #define EEPROM_93XX46_QUIRK_SINGLE_WORD_READ (1 << 0)
+ /* Instructions such as EWEN are (addrlen + 2) in length. */
+ #define EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH (1 << 1)
++/* Add extra cycle after address during a read */
++#define EEPROM_93XX46_QUIRK_EXTRA_READ_CYCLE BIT(2)
+
+ /*
+ * optional hooks to control additional logic
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index f993bc86f3bac..a488098f8638d 100644
+--- a/include/linux/genhd.h
++++ b/include/linux/genhd.h
+@@ -402,10 +402,11 @@ static inline void free_part_info(struct hd_struct *part)
+ extern void part_round_stats(struct request_queue *q, int cpu, struct hd_struct *part);
+
+ /* block/genhd.c */
+-extern void device_add_disk(struct device *parent, struct gendisk *disk);
++extern void device_add_disk(struct device *parent, struct gendisk *disk,
++ const struct attribute_group **groups);
+ static inline void add_disk(struct gendisk *disk)
+ {
+- device_add_disk(NULL, disk);
++ device_add_disk(NULL, disk, NULL);
+ }
+ extern void device_add_disk_no_queue_reg(struct device *parent, struct gendisk *disk);
+ static inline void add_disk_no_queue_reg(struct gendisk *disk)
+diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
+index 4183e4ba27a50..81f620a3c32b1 100644
+--- a/net/dsa/Kconfig
++++ b/net/dsa/Kconfig
+@@ -8,6 +8,7 @@ config NET_DSA
+ tristate "Distributed Switch Architecture"
+ depends on HAVE_NET_DSA && MAY_USE_DEVLINK
+ depends on BRIDGE || BRIDGE=n
++ select GRO_CELLS
+ select NET_SWITCHDEV
+ select PHYLINK
+ ---help---
+diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
+index 601534a5bfe8c..598200e9d5226 100644
+--- a/net/dsa/dsa.c
++++ b/net/dsa/dsa.c
+@@ -191,7 +191,7 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
+ if (dsa_skb_defer_rx_timestamp(p, skb))
+ return 0;
+
+- netif_receive_skb(skb);
++ gro_cells_receive(&p->gcells, skb);
+
+ return 0;
+ }
+diff --git a/net/dsa/dsa_priv.h b/net/dsa/dsa_priv.h
+index 3964c6f7a7c0d..79d17507609ab 100644
+--- a/net/dsa/dsa_priv.h
++++ b/net/dsa/dsa_priv.h
+@@ -15,6 +15,7 @@
+ #include <linux/netdevice.h>
+ #include <linux/netpoll.h>
+ #include <net/dsa.h>
++#include <net/gro_cells.h>
+
+ enum {
+ DSA_NOTIFIER_AGEING_TIME,
+@@ -72,6 +73,8 @@ struct dsa_slave_priv {
+
+ struct pcpu_sw_netstats *stats64;
+
++ struct gro_cells gcells;
++
+ /* DSA port data, such as switch, port index, etc. */
+ struct dsa_port *dp;
+
+diff --git a/net/dsa/slave.c b/net/dsa/slave.c
+index d03c67e761dfa..11f1560de6391 100644
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -1337,6 +1337,11 @@ int dsa_slave_create(struct dsa_port *port)
+ free_netdev(slave_dev);
+ return -ENOMEM;
+ }
++
++ ret = gro_cells_init(&p->gcells, slave_dev);
++ if (ret)
++ goto out_free;
++
+ p->dp = port;
+ INIT_LIST_HEAD(&p->mall_tc_list);
+ p->xmit = cpu_dp->tag_ops->xmit;
+@@ -1347,7 +1352,7 @@ int dsa_slave_create(struct dsa_port *port)
+ ret = dsa_slave_phy_setup(slave_dev);
+ if (ret) {
+ netdev_err(master, "error %d setting up slave phy\n", ret);
+- goto out_free;
++ goto out_gcells;
+ }
+
+ dsa_slave_notify(slave_dev, DSA_PORT_REGISTER);
+@@ -1366,6 +1371,8 @@ out_phy:
+ phylink_disconnect_phy(p->dp->pl);
+ rtnl_unlock();
+ phylink_destroy(p->dp->pl);
++out_gcells:
++ gro_cells_destroy(&p->gcells);
+ out_free:
+ free_percpu(p->stats64);
+ free_netdev(slave_dev);
+@@ -1386,6 +1393,7 @@ void dsa_slave_destroy(struct net_device *slave_dev)
+ dsa_slave_notify(slave_dev, DSA_PORT_UNREGISTER);
+ unregister_netdev(slave_dev);
+ phylink_destroy(dp->pl);
++ gro_cells_destroy(&p->gcells);
+ free_percpu(p->stats64);
+ free_netdev(slave_dev);
+ }
+diff --git a/sound/pci/ctxfi/cthw20k2.c b/sound/pci/ctxfi/cthw20k2.c
+index 3c966fafc754a..6c9ab602212ea 100644
+--- a/sound/pci/ctxfi/cthw20k2.c
++++ b/sound/pci/ctxfi/cthw20k2.c
+@@ -995,7 +995,7 @@ static int daio_mgr_dao_init(void *blk, unsigned int idx, unsigned int conf)
+
+ if (idx < 4) {
+ /* S/PDIF output */
+- switch ((conf & 0x7)) {
++ switch ((conf & 0xf)) {
+ case 1:
+ set_field(&ctl->txctl[idx], ATXCTL_NUC, 0);
+ break;
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 8a943de1e5b55..d63d997763845 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -444,6 +444,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ {
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ARCHOS 140 CESIUM"),
++ },
++ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+diff --git a/tools/usb/usbip/libsrc/usbip_host_common.c b/tools/usb/usbip/libsrc/usbip_host_common.c
+index b0f7489d069d0..84d0fa85939ed 100644
+--- a/tools/usb/usbip/libsrc/usbip_host_common.c
++++ b/tools/usb/usbip/libsrc/usbip_host_common.c
+@@ -35,7 +35,7 @@
+ #include "list.h"
+ #include "sysfs_utils.h"
+
+-struct udev *udev_context;
++extern struct udev *udev_context;
+
+ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
+ {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-03-17 16:21 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-03-17 16:21 UTC (permalink / raw
To: gentoo-commits
commit: f591674c53c00a2514adf3608656f2ea539e2d84
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 17 16:21:15 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 17 16:21:15 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f591674c
Linux patch 4.19.181
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1180_linux-4.19.181.patch | 3871 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3875 insertions(+)
diff --git a/0000_README b/0000_README
index c965714..3095bd6 100644
--- a/0000_README
+++ b/0000_README
@@ -759,6 +759,10 @@ Patch: 1179_linux-4.19.180.patch
From: https://www.kernel.org
Desc: Linux 4.19.180
+Patch: 1180_linux-4.19.181.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.181
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1180_linux-4.19.181.patch b/1180_linux-4.19.181.patch
new file mode 100644
index 0000000..637db0e
--- /dev/null
+++ b/1180_linux-4.19.181.patch
@@ -0,0 +1,3871 @@
+diff --git a/Makefile b/Makefile
+index 48cdfe5ce9921..29930269b4860 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 180
++SUBLEVEL = 181
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h
+index 31733a95bbd05..4cd6e19ee90f4 100644
+--- a/arch/powerpc/include/asm/code-patching.h
++++ b/arch/powerpc/include/asm/code-patching.h
+@@ -52,7 +52,7 @@ void __patch_exception(int exc, unsigned long addr);
+ #endif
+
+ #define OP_RT_RA_MASK 0xffff0000UL
+-#define LIS_R2 0x3c020000UL
++#define LIS_R2 0x3c400000UL
+ #define ADDIS_R2_R12 0x3c4c0000UL
+ #define ADDI_R2_R2 0x38420000UL
+
+diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h
+index a47de82fb8e27..bda87cbf106d4 100644
+--- a/arch/powerpc/include/asm/machdep.h
++++ b/arch/powerpc/include/asm/machdep.h
+@@ -71,6 +71,9 @@ struct machdep_calls {
+ int (*pcibios_root_bridge_prepare)(struct pci_host_bridge
+ *bridge);
+
++ /* finds all the pci_controllers present at boot */
++ void (*discover_phbs)(void);
++
+ /* To setup PHBs when using automatic OF platform driver for PCI */
+ int (*pci_setup_phb)(struct pci_controller *host);
+
+diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
+index 88e4f69a09e52..74628aca2bf12 100644
+--- a/arch/powerpc/kernel/pci-common.c
++++ b/arch/powerpc/kernel/pci-common.c
+@@ -1671,3 +1671,13 @@ static void fixup_hide_host_resource_fsl(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MOTOROLA, PCI_ANY_ID, fixup_hide_host_resource_fsl);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_FREESCALE, PCI_ANY_ID, fixup_hide_host_resource_fsl);
++
++
++static int __init discover_phbs(void)
++{
++ if (ppc_md.discover_phbs)
++ ppc_md.discover_phbs();
++
++ return 0;
++}
++core_initcall(discover_phbs);
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 1b2d84cb373bb..2379c4bf3979e 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -433,8 +433,11 @@ out:
+ die("Unrecoverable nested System Reset", regs, SIGABRT);
+ #endif
+ /* Must die if the interrupt is not recoverable */
+- if (!(regs->msr & MSR_RI))
++ if (!(regs->msr & MSR_RI)) {
++ /* For the reason explained in die_mce, nmi_exit before die */
++ nmi_exit();
+ die("Unrecoverable System Reset", regs, SIGABRT);
++ }
+
+ if (!nested)
+ nmi_exit();
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index 70de138228286..091bdeaf02a3b 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -2046,7 +2046,17 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
+ left += period;
+ if (left <= 0)
+ left = period;
+- record = siar_valid(regs);
++
++ /*
++ * If address is not requested in the sample via
++ * PERF_SAMPLE_IP, just record that sample irrespective
++ * of SIAR valid check.
++ */
++ if (event->attr.sample_type & PERF_SAMPLE_IP)
++ record = siar_valid(regs);
++ else
++ record = 1;
++
+ event->hw.last_period = event->hw.sample_period;
+ }
+ if (left < 0x80000000LL)
+@@ -2064,9 +2074,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
+ * MMCR2. Check attr.exclude_kernel and address to drop the sample in
+ * these cases.
+ */
+- if (event->attr.exclude_kernel && record)
+- if (is_kernel_addr(mfspr(SPRN_SIAR)))
+- record = 0;
++ if (event->attr.exclude_kernel &&
++ (event->attr.sample_type & PERF_SAMPLE_IP) &&
++ is_kernel_addr(mfspr(SPRN_SIAR)))
++ record = 0;
+
+ /*
+ * Finally record data if requested.
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index c47bd581a08a9..bce678c7179c8 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -751,7 +751,7 @@ static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail,
+ static int __smp_rescan_cpus(struct sclp_core_info *info, bool early)
+ {
+ struct sclp_core_entry *core;
+- cpumask_t avail;
++ static cpumask_t avail;
+ bool configured;
+ u16 core_id;
+ int nr, i;
+diff --git a/arch/sparc/include/asm/mman.h b/arch/sparc/include/asm/mman.h
+index f94532f25db14..274217e7ed702 100644
+--- a/arch/sparc/include/asm/mman.h
++++ b/arch/sparc/include/asm/mman.h
+@@ -57,35 +57,39 @@ static inline int sparc_validate_prot(unsigned long prot, unsigned long addr)
+ {
+ if (prot & ~(PROT_READ | PROT_WRITE | PROT_EXEC | PROT_SEM | PROT_ADI))
+ return 0;
+- if (prot & PROT_ADI) {
+- if (!adi_capable())
+- return 0;
++ return 1;
++}
+
+- if (addr) {
+- struct vm_area_struct *vma;
++#define arch_validate_flags(vm_flags) arch_validate_flags(vm_flags)
++/* arch_validate_flags() - Ensure combination of flags is valid for a
++ * VMA.
++ */
++static inline bool arch_validate_flags(unsigned long vm_flags)
++{
++ /* If ADI is being enabled on this VMA, check for ADI
++ * capability on the platform and ensure VMA is suitable
++ * for ADI
++ */
++ if (vm_flags & VM_SPARC_ADI) {
++ if (!adi_capable())
++ return false;
+
+- vma = find_vma(current->mm, addr);
+- if (vma) {
+- /* ADI can not be enabled on PFN
+- * mapped pages
+- */
+- if (vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
+- return 0;
++ /* ADI can not be enabled on PFN mapped pages */
++ if (vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
++ return false;
+
+- /* Mergeable pages can become unmergeable
+- * if ADI is enabled on them even if they
+- * have identical data on them. This can be
+- * because ADI enabled pages with identical
+- * data may still not have identical ADI
+- * tags on them. Disallow ADI on mergeable
+- * pages.
+- */
+- if (vma->vm_flags & VM_MERGEABLE)
+- return 0;
+- }
+- }
++ /* Mergeable pages can become unmergeable
++ * if ADI is enabled on them even if they
++ * have identical data on them. This can be
++ * because ADI enabled pages with identical
++ * data may still not have identical ADI
++ * tags on them. Disallow ADI on mergeable
++ * pages.
++ */
++ if (vm_flags & VM_MERGEABLE)
++ return false;
+ }
+- return 1;
++ return true;
+ }
+ #endif /* CONFIG_SPARC64 */
+
+diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c
+index 92634d4e440c2..89a9244f2cf01 100644
+--- a/arch/sparc/mm/init_32.c
++++ b/arch/sparc/mm/init_32.c
+@@ -199,6 +199,9 @@ unsigned long __init bootmem_init(unsigned long *pages_avail)
+ size = memblock_phys_mem_size() - memblock_reserved_size();
+ *pages_avail = (size >> PAGE_SHIFT) - high_pages;
+
++ /* Only allow low memory to be allocated via memblock allocation */
++ memblock_set_current_limit(max_low_pfn << PAGE_SHIFT);
++
+ return max_pfn;
+ }
+
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 8fa9ca3c3bd7f..4f17c1c949498 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -346,8 +346,8 @@ static bool deref_stack_regs(struct unwind_state *state, unsigned long addr,
+ if (!stack_access_ok(state, addr, sizeof(struct pt_regs)))
+ return false;
+
+- *ip = regs->ip;
+- *sp = regs->sp;
++ *ip = READ_ONCE_NOCHECK(regs->ip);
++ *sp = READ_ONCE_NOCHECK(regs->sp);
+ return true;
+ }
+
+@@ -359,8 +359,8 @@ static bool deref_stack_iret_regs(struct unwind_state *state, unsigned long addr
+ if (!stack_access_ok(state, addr, IRET_FRAME_SIZE))
+ return false;
+
+- *ip = regs->ip;
+- *sp = regs->sp;
++ *ip = READ_ONCE_NOCHECK(regs->ip);
++ *sp = READ_ONCE_NOCHECK(regs->sp);
+ return true;
+ }
+
+@@ -381,12 +381,12 @@ static bool get_reg(struct unwind_state *state, unsigned int reg_off,
+ return false;
+
+ if (state->full_regs) {
+- *val = ((unsigned long *)state->regs)[reg];
++ *val = READ_ONCE_NOCHECK(((unsigned long *)state->regs)[reg]);
+ return true;
+ }
+
+ if (state->prev_regs) {
+- *val = ((unsigned long *)state->prev_regs)[reg];
++ *val = READ_ONCE_NOCHECK(((unsigned long *)state->prev_regs)[reg]);
+ return true;
+ }
+
+diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
+index d8ef8b16fb2e9..08acfe11752b0 100644
+--- a/drivers/block/rsxx/core.c
++++ b/drivers/block/rsxx/core.c
+@@ -883,6 +883,7 @@ static int rsxx_pci_probe(struct pci_dev *dev,
+ card->event_wq = create_singlethread_workqueue(DRIVER_NAME"_event");
+ if (!card->event_wq) {
+ dev_err(CARD_TO_DEV(card), "Failed card event setup.\n");
++ st = -ENOMEM;
+ goto failed_event_handler;
+ }
+
+diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
+index f8672238d444b..ab8847c7dd964 100644
+--- a/drivers/gpu/drm/drm_ioc32.c
++++ b/drivers/gpu/drm/drm_ioc32.c
+@@ -96,6 +96,8 @@ static int compat_drm_version(struct file *file, unsigned int cmd,
+ if (copy_from_user(&v32, (void __user *)arg, sizeof(v32)))
+ return -EFAULT;
+
++ memset(&v, 0, sizeof(v));
++
+ v = (struct drm_version) {
+ .name_len = v32.name_len,
+ .name = compat_ptr(v32.name),
+@@ -134,6 +136,9 @@ static int compat_drm_getunique(struct file *file, unsigned int cmd,
+
+ if (copy_from_user(&uq32, (void __user *)arg, sizeof(uq32)))
+ return -EFAULT;
++
++ memset(&uq, 0, sizeof(uq));
++
+ uq = (struct drm_unique){
+ .unique_len = uq32.unique_len,
+ .unique = compat_ptr(uq32.unique),
+@@ -260,6 +265,8 @@ static int compat_drm_getclient(struct file *file, unsigned int cmd,
+ if (copy_from_user(&c32, argp, sizeof(c32)))
+ return -EFAULT;
+
++ memset(&client, 0, sizeof(client));
++
+ client.idx = c32.idx;
+
+ err = drm_ioctl_kernel(file, drm_getclient, &client, DRM_UNLOCKED);
+@@ -842,6 +849,8 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
+ if (copy_from_user(&req32, argp, sizeof(req32)))
+ return -EFAULT;
+
++ memset(&req, 0, sizeof(req));
++
+ req.request.type = req32.request.type;
+ req.request.sequence = req32.request.sequence;
+ req.request.signal = req32.request.signal;
+@@ -879,6 +888,8 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
+ struct drm_mode_fb_cmd2 req64;
+ int err;
+
++ memset(&req64, 0, sizeof(req64));
++
+ if (copy_from_user(&req64, argp,
+ offsetof(drm_mode_fb_cmd232_t, modifier)))
+ return -EFAULT;
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 588b3b0c8315d..25b06771f2387 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -384,6 +384,16 @@ static int meson_probe_remote(struct platform_device *pdev,
+ return count;
+ }
+
++static void meson_drv_shutdown(struct platform_device *pdev)
++{
++ struct meson_drm *priv = dev_get_drvdata(&pdev->dev);
++ struct drm_device *drm = priv->drm;
++
++ DRM_DEBUG_DRIVER("\n");
++ drm_kms_helper_poll_fini(drm);
++ drm_atomic_helper_shutdown(drm);
++}
++
+ static int meson_drv_probe(struct platform_device *pdev)
+ {
+ struct component_match *match = NULL;
+@@ -428,6 +438,7 @@ MODULE_DEVICE_TABLE(of, dt_match);
+
+ static struct platform_driver meson_drm_platform_driver = {
+ .probe = meson_drv_probe,
++ .shutdown = meson_drv_shutdown,
+ .driver = {
+ .name = "meson-drm",
+ .of_match_table = dt_match,
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index c2f411c290bf9..c187e557678ef 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -187,6 +187,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ #define LM90_HAVE_EMERGENCY_ALARM (1 << 5)/* emergency alarm */
+ #define LM90_HAVE_TEMP3 (1 << 6) /* 3rd temperature sensor */
+ #define LM90_HAVE_BROKEN_ALERT (1 << 7) /* Broken alert */
++#define LM90_PAUSE_FOR_CONFIG (1 << 8) /* Pause conversion for config */
+
+ /* LM90 status */
+ #define LM90_STATUS_LTHRM (1 << 0) /* local THERM limit tripped */
+@@ -380,6 +381,7 @@ static const struct lm90_params lm90_params[] = {
+ .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+ },
+ [max6657] = {
++ .flags = LM90_PAUSE_FOR_CONFIG,
+ .alert_alarms = 0x7c,
+ .max_convrate = 8,
+ .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
+@@ -580,6 +582,38 @@ static inline int lm90_select_remote_channel(struct i2c_client *client,
+ return 0;
+ }
+
++static int lm90_write_convrate(struct i2c_client *client,
++ struct lm90_data *data, int val)
++{
++ int err;
++ int config_orig, config_stop;
++
++ /* Save config and pause conversion */
++ if (data->flags & LM90_PAUSE_FOR_CONFIG) {
++ config_orig = lm90_read_reg(client, LM90_REG_R_CONFIG1);
++ if (config_orig < 0)
++ return config_orig;
++ config_stop = config_orig | 0x40;
++ if (config_orig != config_stop) {
++ err = i2c_smbus_write_byte_data(client,
++ LM90_REG_W_CONFIG1,
++ config_stop);
++ if (err < 0)
++ return err;
++ }
++ }
++
++ /* Set conv rate */
++ err = i2c_smbus_write_byte_data(client, LM90_REG_W_CONVRATE, val);
++
++ /* Revert change to config */
++ if (data->flags & LM90_PAUSE_FOR_CONFIG && config_orig != config_stop)
++ i2c_smbus_write_byte_data(client, LM90_REG_W_CONFIG1,
++ config_orig);
++
++ return err;
++}
++
+ /*
+ * Set conversion rate.
+ * client->update_lock must be held when calling this function (unless we are
+@@ -600,7 +634,7 @@ static int lm90_set_convrate(struct i2c_client *client, struct lm90_data *data,
+ if (interval >= update_interval * 3 / 4)
+ break;
+
+- err = i2c_smbus_write_byte_data(client, LM90_REG_W_CONVRATE, i);
++ err = lm90_write_convrate(client, data, i);
+ data->update_interval = DIV_ROUND_CLOSEST(update_interval, 64);
+ return err;
+ }
+@@ -1606,8 +1640,7 @@ static void lm90_restore_conf(void *_data)
+ struct i2c_client *client = data->client;
+
+ /* Restore initial configuration */
+- i2c_smbus_write_byte_data(client, LM90_REG_W_CONVRATE,
+- data->convrate_orig);
++ lm90_write_convrate(client, data, data->convrate_orig);
+ i2c_smbus_write_byte_data(client, LM90_REG_W_CONFIG1,
+ data->config_orig);
+ }
+@@ -1624,12 +1657,13 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data)
+ /*
+ * Start the conversions.
+ */
+- lm90_set_convrate(client, data, 500); /* 500ms; 2Hz conversion rate */
+ config = lm90_read_reg(client, LM90_REG_R_CONFIG1);
+ if (config < 0)
+ return config;
+ data->config_orig = config;
+
++ lm90_set_convrate(client, data, 500); /* 500ms; 2Hz conversion rate */
++
+ /* Check Temperature Range Select */
+ if (data->kind == adt7461 || data->kind == tmp451) {
+ if (config & 0x04)
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index f9029800d3996..3ea2ceec676c1 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -117,6 +117,7 @@ enum rcar_i2c_type {
+ };
+
+ struct rcar_i2c_priv {
++ u32 flags;
+ void __iomem *io;
+ struct i2c_adapter adap;
+ struct i2c_msg *msg;
+@@ -127,7 +128,6 @@ struct rcar_i2c_priv {
+
+ int pos;
+ u32 icccr;
+- u32 flags;
+ u8 recovery_icmcr; /* protected by adapter lock */
+ enum rcar_i2c_type devtype;
+ struct i2c_client *slave;
+diff --git a/drivers/media/platform/vsp1/vsp1_drm.c b/drivers/media/platform/vsp1/vsp1_drm.c
+index 8d86f618ec776..8824c4ce67f1f 100644
+--- a/drivers/media/platform/vsp1/vsp1_drm.c
++++ b/drivers/media/platform/vsp1/vsp1_drm.c
+@@ -243,7 +243,7 @@ static int vsp1_du_pipeline_setup_brx(struct vsp1_device *vsp1,
+ brx = &vsp1->bru->entity;
+ else if (pipe->brx && !drm_pipe->force_brx_release)
+ brx = pipe->brx;
+- else if (!vsp1->bru->entity.pipe)
++ else if (vsp1_feature(vsp1, VSP1_HAS_BRU) && !vsp1->bru->entity.pipe)
+ brx = &vsp1->bru->entity;
+ else
+ brx = &vsp1->brs->entity;
+@@ -460,9 +460,9 @@ static int vsp1_du_pipeline_setup_inputs(struct vsp1_device *vsp1,
+ * make sure it is present in the pipeline's list of entities if it
+ * wasn't already.
+ */
+- if (!use_uif) {
++ if (drm_pipe->uif && !use_uif) {
+ drm_pipe->uif->pipe = NULL;
+- } else if (!drm_pipe->uif->pipe) {
++ } else if (drm_pipe->uif && !drm_pipe->uif->pipe) {
+ drm_pipe->uif->pipe = pipe;
+ list_add_tail(&drm_pipe->uif->list_pipe, &pipe->entities);
+ }
+diff --git a/drivers/media/usb/usbtv/usbtv-audio.c b/drivers/media/usb/usbtv/usbtv-audio.c
+index 4ce38246ed641..95657a7029c9c 100644
+--- a/drivers/media/usb/usbtv/usbtv-audio.c
++++ b/drivers/media/usb/usbtv/usbtv-audio.c
+@@ -399,7 +399,7 @@ void usbtv_audio_free(struct usbtv *usbtv)
+ cancel_work_sync(&usbtv->snd_trigger);
+
+ if (usbtv->snd && usbtv->udev) {
+- snd_card_free(usbtv->snd);
++ snd_card_free_when_closed(usbtv->snd);
+ usbtv->snd = NULL;
+ }
+ }
+diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
+index fc92c6c1c9a4b..941f39ca4eb70 100644
+--- a/drivers/mmc/core/bus.c
++++ b/drivers/mmc/core/bus.c
+@@ -376,11 +376,6 @@ void mmc_remove_card(struct mmc_card *card)
+ mmc_remove_card_debugfs(card);
+ #endif
+
+- if (host->cqe_enabled) {
+- host->cqe_ops->cqe_disable(host);
+- host->cqe_enabled = false;
+- }
+-
+ if (mmc_card_present(card)) {
+ if (mmc_host_is_spi(card->host)) {
+ pr_info("%s: SPI card removed\n",
+@@ -393,6 +388,10 @@ void mmc_remove_card(struct mmc_card *card)
+ of_node_put(card->dev.of_node);
+ }
+
++ if (host->cqe_enabled) {
++ host->cqe_ops->cqe_disable(host);
++ host->cqe_enabled = false;
++ }
++
+ put_device(&card->dev);
+ }
+-
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index 4b18034537f53..1b5139a906b83 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -426,10 +426,6 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd)
+
+ /* EXT_CSD value is in units of 10ms, but we store in ms */
+ card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME];
+- /* Some eMMC set the value too low so set a minimum */
+- if (card->ext_csd.part_time &&
+- card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME)
+- card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME;
+
+ /* Sleep / awake timeout in 100ns units */
+ if (sa_shift > 0 && sa_shift <= 0x17)
+@@ -619,6 +615,17 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd)
+ card->ext_csd.data_sector_size = 512;
+ }
+
++ /*
++ * GENERIC_CMD6_TIME is to be used "unless a specific timeout is defined
++ * when accessing a specific field", so use it here if there is no
++ * PARTITION_SWITCH_TIME.
++ */
++ if (!card->ext_csd.part_time)
++ card->ext_csd.part_time = card->ext_csd.generic_cmd6_time;
++ /* Some eMMC set the value too low so set a minimum */
++ if (card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME)
++ card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME;
++
+ /* eMMC v5 or later */
+ if (card->ext_csd.rev >= 7) {
+ memcpy(card->ext_csd.fwrev, &ext_csd[EXT_CSD_FIRMWARE_VERSION],
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index 9ecf86ba4bb0b..967e47770af67 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -928,13 +928,13 @@ static void msdc_track_cmd_data(struct msdc_host *host,
+ static void msdc_request_done(struct msdc_host *host, struct mmc_request *mrq)
+ {
+ unsigned long flags;
+- bool ret;
+
+- ret = cancel_delayed_work(&host->req_timeout);
+- if (!ret) {
+- /* delay work already running */
+- return;
+- }
++ /*
++ * No need check the return value of cancel_delayed_work, as only ONE
++ * path will go here!
++ */
++ cancel_delayed_work(&host->req_timeout);
++
+ spin_lock_irqsave(&host->lock, flags);
+ host->mrq = NULL;
+ spin_unlock_irqrestore(&host->lock, flags);
+@@ -952,7 +952,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events,
+ bool done = false;
+ bool sbc_error;
+ unsigned long flags;
+- u32 *rsp = cmd->resp;
++ u32 *rsp;
+
+ if (mrq->sbc && cmd == mrq->cmd &&
+ (events & (MSDC_INT_ACMDRDY | MSDC_INT_ACMDCRCERR
+@@ -973,6 +973,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events,
+
+ if (done)
+ return true;
++ rsp = cmd->resp;
+
+ sdr_clr_bits(host->base + MSDC_INTEN, cmd_ints_mask);
+
+@@ -1154,7 +1155,7 @@ static void msdc_data_xfer_next(struct msdc_host *host,
+ static bool msdc_data_xfer_done(struct msdc_host *host, u32 events,
+ struct mmc_request *mrq, struct mmc_data *data)
+ {
+- struct mmc_command *stop = data->stop;
++ struct mmc_command *stop;
+ unsigned long flags;
+ bool done;
+ unsigned int check_data = events &
+@@ -1170,6 +1171,7 @@ static bool msdc_data_xfer_done(struct msdc_host *host, u32 events,
+
+ if (done)
+ return true;
++ stop = data->stop;
+
+ if (check_data || (stop && stop->error)) {
+ dev_dbg(host->dev, "DMA status: 0x%8X\n",
+diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
+index add1e70195ea6..7125687faf76a 100644
+--- a/drivers/mmc/host/mxs-mmc.c
++++ b/drivers/mmc/host/mxs-mmc.c
+@@ -659,7 +659,7 @@ static int mxs_mmc_probe(struct platform_device *pdev)
+
+ ret = mmc_of_parse(mmc);
+ if (ret)
+- goto out_clk_disable;
++ goto out_free_dma;
+
+ mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 92fe345e48ab7..cb6bc20585428 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -426,7 +426,7 @@ static int flexcan_chip_freeze(struct flexcan_priv *priv)
+ u32 reg;
+
+ reg = priv->read(®s->mcr);
+- reg |= FLEXCAN_MCR_HALT;
++ reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT;
+ priv->write(reg, ®s->mcr);
+
+ while (timeout-- && !(priv->read(®s->mcr) & FLEXCAN_MCR_FRZ_ACK))
+@@ -1252,10 +1252,14 @@ static int register_flexcandev(struct net_device *dev)
+ if (err)
+ goto out_chip_disable;
+
+- /* set freeze, halt and activate FIFO, restrict register access */
++ /* set freeze, halt */
++ err = flexcan_chip_freeze(priv);
++ if (err)
++ goto out_chip_disable;
++
++ /* activate FIFO, restrict register access */
+ reg = priv->read(®s->mcr);
+- reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT |
+- FLEXCAN_MCR_FEN | FLEXCAN_MCR_SUPV;
++ reg |= FLEXCAN_MCR_FEN | FLEXCAN_MCR_SUPV;
+ priv->write(reg, ®s->mcr);
+
+ /* Currently we only support newer versions of this core
+diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
+index dd63b993ce7b3..d83ad06bf1991 100644
+--- a/drivers/net/ethernet/atheros/alx/main.c
++++ b/drivers/net/ethernet/atheros/alx/main.c
+@@ -1902,13 +1902,16 @@ static int alx_resume(struct device *dev)
+
+ if (!netif_running(alx->dev))
+ return 0;
+- netif_device_attach(alx->dev);
+
+ rtnl_lock();
+ err = __alx_open(alx, true);
+ rtnl_unlock();
++ if (err)
++ return err;
+
+- return err;
++ netif_device_attach(alx->dev);
++
++ return 0;
+ }
+
+ static SIMPLE_DEV_PM_OPS(alx_pm_ops, alx_suspend, alx_resume);
+diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
+index 50222b7b81f3e..a339ea2fd4961 100644
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -143,6 +143,8 @@ struct board_info {
+ u32 wake_state;
+
+ int ip_summed;
++
++ struct regulator *power_supply;
+ };
+
+ /* debug code */
+@@ -1460,7 +1462,7 @@ dm9000_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(dev, "failed to request reset gpio %d: %d\n",
+ reset_gpios, ret);
+- return -ENODEV;
++ goto out_regulator_disable;
+ }
+
+ /* According to manual PWRST# Low Period Min 1ms */
+@@ -1472,8 +1474,10 @@ dm9000_probe(struct platform_device *pdev)
+
+ if (!pdata) {
+ pdata = dm9000_parse_dt(&pdev->dev);
+- if (IS_ERR(pdata))
+- return PTR_ERR(pdata);
++ if (IS_ERR(pdata)) {
++ ret = PTR_ERR(pdata);
++ goto out_regulator_disable;
++ }
+ }
+
+ /* Init network device */
+@@ -1490,6 +1494,8 @@ dm9000_probe(struct platform_device *pdev)
+
+ db->dev = &pdev->dev;
+ db->ndev = ndev;
++ if (!IS_ERR(power))
++ db->power_supply = power;
+
+ spin_lock_init(&db->lock);
+ mutex_init(&db->addr_lock);
+@@ -1716,6 +1722,10 @@ out:
+ dm9000_release_board(pdev, db);
+ free_netdev(ndev);
+
++out_regulator_disable:
++ if (!IS_ERR(power))
++ regulator_disable(power);
++
+ return ret;
+ }
+
+@@ -1775,10 +1785,13 @@ static int
+ dm9000_drv_remove(struct platform_device *pdev)
+ {
+ struct net_device *ndev = platform_get_drvdata(pdev);
++ struct board_info *dm = to_dm9000_board(ndev);
+
+ unregister_netdev(ndev);
+- dm9000_release_board(pdev, netdev_priv(ndev));
++ dm9000_release_board(pdev, dm);
+ free_netdev(ndev); /* free device structure */
++ if (dm->power_supply)
++ regulator_disable(dm->power_supply);
+
+ dev_dbg(&pdev->dev, "released and freed device\n");
+ return 0;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index fe9da568ee196..1591f81d8ae3b 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -13956,6 +13956,8 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (err) {
+ dev_info(&pdev->dev,
+ "setup of misc vector failed: %d\n", err);
++ i40e_cloud_filter_exit(pf);
++ i40e_fdir_teardown(pf);
+ goto err_vsis;
+ }
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+index e639a365ac2d4..7a99eb1572fd9 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -47,7 +47,7 @@
+ #define EN_ETHTOOL_SHORT_MASK cpu_to_be16(0xffff)
+ #define EN_ETHTOOL_WORD_MASK cpu_to_be32(0xffffffff)
+
+-static int mlx4_en_moderation_update(struct mlx4_en_priv *priv)
++int mlx4_en_moderation_update(struct mlx4_en_priv *priv)
+ {
+ int i, t;
+ int err = 0;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 47eee3e083ece..f3a0617733d8f 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -3667,6 +3667,8 @@ int mlx4_en_reset_config(struct net_device *dev,
+ en_err(priv, "Failed starting port\n");
+ }
+
++ if (!err)
++ err = mlx4_en_moderation_update(priv);
+ out:
+ mutex_unlock(&mdev->state_lock);
+ kfree(tmp);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index 1a57ea9a7ea59..3d5597d5b10d2 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -798,6 +798,7 @@ void mlx4_en_ptp_overflow_check(struct mlx4_en_dev *mdev);
+ #define DEV_FEATURE_CHANGED(dev, new_features, feature) \
+ ((dev->features & feature) ^ (new_features & feature))
+
++int mlx4_en_moderation_update(struct mlx4_en_priv *priv);
+ int mlx4_en_reset_config(struct net_device *dev,
+ struct hwtstamp_config ts_config,
+ netdev_features_t new_features);
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 9ac7b09badca6..24638cb157ca2 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -610,6 +610,8 @@ static struct sh_eth_cpu_data r7s72100_data = {
+ EESR_TDE,
+ .fdr_value = 0x0000070f,
+
++ .trscer_err_mask = DESC_I_RINT8 | DESC_I_RINT5,
++
+ .no_psr = 1,
+ .apr = 1,
+ .mpr = 1,
+@@ -825,6 +827,8 @@ static struct sh_eth_cpu_data r7s9210_data = {
+
+ .fdr_value = 0x0000070f,
+
++ .trscer_err_mask = DESC_I_RINT8 | DESC_I_RINT5,
++
+ .apr = 1,
+ .mpr = 1,
+ .tpauser = 1,
+@@ -1126,6 +1130,9 @@ static struct sh_eth_cpu_data sh771x_data = {
+ EESIPR_CEEFIP | EESIPR_CELFIP |
+ EESIPR_RRFIP | EESIPR_RTLFIP | EESIPR_RTSFIP |
+ EESIPR_PREIP | EESIPR_CERFIP,
++
++ .trscer_err_mask = DESC_I_RINT8,
++
+ .tsu = 1,
+ .dual_port = 1,
+ };
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+index edb6053bd9802..8c3780d1105fe 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+@@ -119,6 +119,23 @@ static void dwmac4_dma_init_channel(void __iomem *ioaddr,
+ ioaddr + DMA_CHAN_INTR_ENA(chan));
+ }
+
++static void dwmac410_dma_init_channel(void __iomem *ioaddr,
++ struct stmmac_dma_cfg *dma_cfg, u32 chan)
++{
++ u32 value;
++
++ /* common channel control register config */
++ value = readl(ioaddr + DMA_CHAN_CONTROL(chan));
++ if (dma_cfg->pblx8)
++ value = value | DMA_BUS_MODE_PBL;
++
++ writel(value, ioaddr + DMA_CHAN_CONTROL(chan));
++
++ /* Mask interrupts by writing to CSR7 */
++ writel(DMA_CHAN_INTR_DEFAULT_MASK_4_10,
++ ioaddr + DMA_CHAN_INTR_ENA(chan));
++}
++
+ static void dwmac4_dma_init(void __iomem *ioaddr,
+ struct stmmac_dma_cfg *dma_cfg, int atds)
+ {
+@@ -461,7 +478,7 @@ const struct stmmac_dma_ops dwmac4_dma_ops = {
+ const struct stmmac_dma_ops dwmac410_dma_ops = {
+ .reset = dwmac4_dma_reset,
+ .init = dwmac4_dma_init,
+- .init_chan = dwmac4_dma_init_channel,
++ .init_chan = dwmac410_dma_init_channel,
+ .init_rx_chan = dwmac4_dma_init_rx_chan,
+ .init_tx_chan = dwmac4_dma_init_tx_chan,
+ .axi = dwmac4_dma_axi,
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
+index 49f5687879df2..32461909264a7 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
+@@ -63,10 +63,6 @@ void dwmac4_dma_stop_tx(void __iomem *ioaddr, u32 chan)
+
+ value &= ~DMA_CONTROL_ST;
+ writel(value, ioaddr + DMA_CHAN_TX_CONTROL(chan));
+-
+- value = readl(ioaddr + GMAC_CONFIG);
+- value &= ~GMAC_CONFIG_TE;
+- writel(value, ioaddr + GMAC_CONFIG);
+ }
+
+ void dwmac4_dma_start_rx(void __iomem *ioaddr, u32 chan)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 76d4b8e6ac3e8..a1443d7197e87 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4566,6 +4566,8 @@ static void stmmac_reset_queues_param(struct stmmac_priv *priv)
+ tx_q->cur_tx = 0;
+ tx_q->dirty_tx = 0;
+ tx_q->mss = 0;
++
++ netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, queue));
+ }
+ }
+
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index cc454b8c032cd..dd4bf4265a5e8 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -335,7 +335,10 @@ int phy_ethtool_ksettings_set(struct phy_device *phydev,
+
+ phydev->autoneg = autoneg;
+
+- phydev->speed = speed;
++ if (autoneg == AUTONEG_DISABLE) {
++ phydev->speed = speed;
++ phydev->duplex = duplex;
++ }
+
+ phydev->advertising = advertising;
+
+@@ -344,8 +347,6 @@ int phy_ethtool_ksettings_set(struct phy_device *phydev,
+ else
+ phydev->advertising &= ~ADVERTISED_Autoneg;
+
+- phydev->duplex = duplex;
+-
+ phydev->mdix_ctrl = cmd->base.eth_tp_mdix_ctrl;
+
+ /* Restart the PHY */
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 9a359c41cfa63..d08e1de26030e 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -378,13 +378,6 @@ static ssize_t add_mux_store(struct device *d, struct device_attribute *attr, c
+ goto err;
+ }
+
+- /* we don't want to modify a running netdev */
+- if (netif_running(dev->net)) {
+- netdev_err(dev->net, "Cannot change a running device\n");
+- ret = -EBUSY;
+- goto err;
+- }
+-
+ ret = qmimux_register_device(dev->net, mux_id);
+ if (!ret) {
+ info->flags |= QMI_WWAN_FLAG_MUX;
+@@ -414,13 +407,6 @@ static ssize_t del_mux_store(struct device *d, struct device_attribute *attr, c
+ if (!rtnl_trylock())
+ return restart_syscall();
+
+- /* we don't want to modify a running netdev */
+- if (netif_running(dev->net)) {
+- netdev_err(dev->net, "Cannot change a running device\n");
+- ret = -EBUSY;
+- goto err;
+- }
+-
+ del_dev = qmimux_find_dev(dev, mux_id);
+ if (!del_dev) {
+ netdev_err(dev->net, "mux_id not present\n");
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index e5fc1b95cea6a..fad5fc8b9edb9 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -286,7 +286,6 @@ static int lapbeth_open(struct net_device *dev)
+ return -ENODEV;
+ }
+
+- netif_start_queue(dev);
+ return 0;
+ }
+
+@@ -294,8 +293,6 @@ static int lapbeth_close(struct net_device *dev)
+ {
+ int err;
+
+- netif_stop_queue(dev);
+-
+ if ((err = lapb_unregister(dev)) != LAPB_OK)
+ pr_err("lapb_unregister error: %d\n", err);
+
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 0fca44e91a712..de3befc2edd18 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -179,7 +179,8 @@ struct ath_frame_info {
+ s8 txq;
+ u8 keyix;
+ u8 rtscts_rate;
+- u8 retries : 7;
++ u8 retries : 6;
++ u8 dyn_smps : 1;
+ u8 baw_tracked : 1;
+ u8 tx_power;
+ enum ath9k_key_type keytype:2;
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 4b7a7fc2a0fe0..29f71457e26bf 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1324,6 +1324,11 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
+ is_40, is_sgi, is_sp);
+ if (rix < 8 && (tx_info->flags & IEEE80211_TX_CTL_STBC))
+ info->rates[i].RateFlags |= ATH9K_RATESERIES_STBC;
++ if (rix >= 8 && fi->dyn_smps) {
++ info->rates[i].RateFlags |=
++ ATH9K_RATESERIES_RTS_CTS;
++ info->flags |= ATH9K_TXDESC_CTSENA;
++ }
+
+ info->txpower[i] = ath_get_rate_txpower(sc, bf, rix,
+ is_40, false);
+@@ -2206,6 +2211,7 @@ static void setup_frame_info(struct ieee80211_hw *hw,
+ fi->keyix = an->ps_key;
+ else
+ fi->keyix = ATH9K_TXKEYIX_INVALID;
++ fi->dyn_smps = sta && sta->smps_mode == IEEE80211_SMPS_DYNAMIC;
+ fi->keytype = keytype;
+ fi->framelen = framelen;
+ fi->tx_power = txpower;
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index 8ce6a167dd2cc..57866c1e9c982 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -395,13 +395,13 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+ {
+ struct sk_buff *skb = q->rx_head;
+ struct skb_shared_info *shinfo = skb_shinfo(skb);
++ int nr_frags = shinfo->nr_frags;
+
+- if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) {
++ if (nr_frags < ARRAY_SIZE(shinfo->frags)) {
+ struct page *page = virt_to_head_page(data);
+ int offset = data - page_address(page) + q->buf_offset;
+
+- skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len,
+- q->buf_size);
++ skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
+ } else {
+ skb_free_frag(data);
+ }
+@@ -410,7 +410,10 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+ return;
+
+ q->rx_head = NULL;
+- dev->drv->rx_skb(dev, q - dev->q_rx, skb);
++ if (nr_frags < ARRAY_SIZE(shinfo->frags))
++ dev->drv->rx_skb(dev, q - dev->q_rx, skb);
++ else
++ dev_kfree_skb(skb);
+ }
+
+ static int
+diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c
+index f4c02da84e599..0bfa5065b4405 100644
+--- a/drivers/pci/controller/pci-xgene-msi.c
++++ b/drivers/pci/controller/pci-xgene-msi.c
+@@ -384,13 +384,9 @@ static int xgene_msi_hwirq_alloc(unsigned int cpu)
+ if (!msi_group->gic_irq)
+ continue;
+
+- irq_set_chained_handler(msi_group->gic_irq,
+- xgene_msi_isr);
+- err = irq_set_handler_data(msi_group->gic_irq, msi_group);
+- if (err) {
+- pr_err("failed to register GIC IRQ handler\n");
+- return -EINVAL;
+- }
++ irq_set_chained_handler_and_data(msi_group->gic_irq,
++ xgene_msi_isr, msi_group);
++
+ /*
+ * Statically allocate MSI GIC IRQs to each CPU core.
+ * With 8-core X-Gene v1, 2 MSI GIC IRQs are allocated
+diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
+index ca06d8bc01e74..066e9e00de11e 100644
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -1089,14 +1089,14 @@ static int mtk_pcie_setup(struct mtk_pcie *pcie)
+ err = of_pci_get_devfn(child);
+ if (err < 0) {
+ dev_err(dev, "failed to parse devfn: %d\n", err);
+- return err;
++ goto error_put_node;
+ }
+
+ slot = PCI_SLOT(err);
+
+ err = mtk_pcie_parse_port(pcie, child, slot);
+ if (err)
+- return err;
++ goto error_put_node;
+ }
+
+ err = mtk_pcie_subsys_powerup(pcie);
+@@ -1112,6 +1112,9 @@ static int mtk_pcie_setup(struct mtk_pcie *pcie)
+ mtk_pcie_subsys_powerdown(pcie);
+
+ return 0;
++error_put_node:
++ of_node_put(child);
++ return err;
+ }
+
+ static int mtk_pcie_request_resources(struct mtk_pcie *pcie)
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 83fda1987d1f9..9ebf32de85757 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -3817,6 +3817,10 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr,
+ ret = logic_pio_register_range(range);
+ if (ret)
+ kfree(range);
++
++ /* Ignore duplicates due to deferred probing */
++ if (ret == -EEXIST)
++ ret = 0;
+ #endif
+
+ return ret;
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index 157bbb13c26c6..7beda20cf1221 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -2940,7 +2940,8 @@ static blk_status_t do_dasd_request(struct blk_mq_hw_ctx *hctx,
+
+ basedev = block->base;
+ spin_lock_irq(&dq->lock);
+- if (basedev->state < DASD_STATE_READY) {
++ if (basedev->state < DASD_STATE_READY ||
++ test_bit(DASD_FLAG_OFFLINE, &basedev->flags)) {
+ DBF_DEV_EVENT(DBF_ERR, basedev,
+ "device not ready for request %p", req);
+ rc = BLK_STS_IOERR;
+@@ -3426,8 +3427,6 @@ void dasd_generic_remove(struct ccw_device *cdev)
+ struct dasd_device *device;
+ struct dasd_block *block;
+
+- cdev->handler = NULL;
+-
+ device = dasd_device_from_cdev(cdev);
+ if (IS_ERR(device)) {
+ dasd_remove_sysfs_files(cdev);
+@@ -3446,6 +3445,7 @@ void dasd_generic_remove(struct ccw_device *cdev)
+ * no quite down yet.
+ */
+ dasd_set_target_state(device, DASD_STATE_NEW);
++ cdev->handler = NULL;
+ /* dasd_delete_device destroys the device reference. */
+ block = device->block;
+ dasd_delete_device(device);
+diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c
+index dc5ff47de3fee..6873ab5fe57a8 100644
+--- a/drivers/s390/cio/vfio_ccw_ops.c
++++ b/drivers/s390/cio/vfio_ccw_ops.c
+@@ -341,7 +341,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struct mdev_device *mdev,
+ if (ret)
+ return ret;
+
+- return copy_to_user((void __user *)arg, &info, minsz);
++ return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0;
+ }
+ case VFIO_DEVICE_GET_REGION_INFO:
+ {
+@@ -362,7 +362,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struct mdev_device *mdev,
+ if (ret)
+ return ret;
+
+- return copy_to_user((void __user *)arg, &info, minsz);
++ return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0;
+ }
+ case VFIO_DEVICE_GET_IRQ_INFO:
+ {
+@@ -383,7 +383,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struct mdev_device *mdev,
+ if (info.count == -1)
+ return -EINVAL;
+
+- return copy_to_user((void __user *)arg, &info, minsz);
++ return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0;
+ }
+ case VFIO_DEVICE_SET_IRQS:
+ {
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 2e40fd78e7b3f..81471c3049916 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -1569,14 +1569,9 @@ check_mgmt:
+ }
+ rc = iscsi_prep_scsi_cmd_pdu(conn->task);
+ if (rc) {
+- if (rc == -ENOMEM || rc == -EACCES) {
+- spin_lock_bh(&conn->taskqueuelock);
+- list_add_tail(&conn->task->running,
+- &conn->cmdqueue);
+- conn->task = NULL;
+- spin_unlock_bh(&conn->taskqueuelock);
+- goto done;
+- } else
++ if (rc == -ENOMEM || rc == -EACCES)
++ fail_scsi_task(conn->task, DID_IMM_RETRY);
++ else
+ fail_scsi_task(conn->task, DID_ABORT);
+ spin_lock_bh(&conn->taskqueuelock);
+ continue;
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c
+index e035c9f757a1c..2176d3289eff5 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1032.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1032.c
+@@ -260,6 +260,7 @@ static irqreturn_t apci1032_interrupt(int irq, void *d)
+ struct apci1032_private *devpriv = dev->private;
+ struct comedi_subdevice *s = dev->read_subdev;
+ unsigned int ctrl;
++ unsigned short val;
+
+ /* check interrupt is from this device */
+ if ((inl(devpriv->amcc_iobase + AMCC_OP_REG_INTCSR) &
+@@ -275,7 +276,8 @@ static irqreturn_t apci1032_interrupt(int irq, void *d)
+ outl(ctrl & ~APCI1032_CTRL_INT_ENA, dev->iobase + APCI1032_CTRL_REG);
+
+ s->state = inl(dev->iobase + APCI1032_STATUS_REG) & 0xffff;
+- comedi_buf_write_samples(s, &s->state, 1);
++ val = s->state;
++ comedi_buf_write_samples(s, &val, 1);
+ comedi_handle_events(dev, s);
+
+ /* enable the interrupt */
+diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c
+index 816dd25b9d0e4..8c3eff7cf465c 100644
+--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
+@@ -208,7 +208,7 @@ static irqreturn_t apci1500_interrupt(int irq, void *d)
+ struct comedi_device *dev = d;
+ struct apci1500_private *devpriv = dev->private;
+ struct comedi_subdevice *s = dev->read_subdev;
+- unsigned int status = 0;
++ unsigned short status = 0;
+ unsigned int val;
+
+ val = inl(devpriv->amcc + AMCC_OP_REG_INTCSR);
+@@ -238,14 +238,14 @@ static irqreturn_t apci1500_interrupt(int irq, void *d)
+ *
+ * Mask Meaning
+ * ---------- ------------------------------------------
+- * 0x00000001 Event 1 has occurred
+- * 0x00000010 Event 2 has occurred
+- * 0x00000100 Counter/timer 1 has run down (not implemented)
+- * 0x00001000 Counter/timer 2 has run down (not implemented)
+- * 0x00010000 Counter 3 has run down (not implemented)
+- * 0x00100000 Watchdog has run down (not implemented)
+- * 0x01000000 Voltage error
+- * 0x10000000 Short-circuit error
++ * 0b00000001 Event 1 has occurred
++ * 0b00000010 Event 2 has occurred
++ * 0b00000100 Counter/timer 1 has run down (not implemented)
++ * 0b00001000 Counter/timer 2 has run down (not implemented)
++ * 0b00010000 Counter 3 has run down (not implemented)
++ * 0b00100000 Watchdog has run down (not implemented)
++ * 0b01000000 Voltage error
++ * 0b10000000 Short-circuit error
+ */
+ comedi_buf_write_samples(s, &status, 1);
+ comedi_handle_events(dev, s);
+diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
+index c1c3b18793d50..8cdee455e8a53 100644
+--- a/drivers/staging/comedi/drivers/adv_pci1710.c
++++ b/drivers/staging/comedi/drivers/adv_pci1710.c
+@@ -300,11 +300,11 @@ static int pci1710_ai_eoc(struct comedi_device *dev,
+ static int pci1710_ai_read_sample(struct comedi_device *dev,
+ struct comedi_subdevice *s,
+ unsigned int cur_chan,
+- unsigned int *val)
++ unsigned short *val)
+ {
+ const struct boardtype *board = dev->board_ptr;
+ struct pci1710_private *devpriv = dev->private;
+- unsigned int sample;
++ unsigned short sample;
+ unsigned int chan;
+
+ sample = inw(dev->iobase + PCI171X_AD_DATA_REG);
+@@ -345,7 +345,7 @@ static int pci1710_ai_insn_read(struct comedi_device *dev,
+ pci1710_ai_setup_chanlist(dev, s, &insn->chanspec, 1, 1);
+
+ for (i = 0; i < insn->n; i++) {
+- unsigned int val;
++ unsigned short val;
+
+ /* start conversion */
+ outw(0, dev->iobase + PCI171X_SOFTTRG_REG);
+@@ -395,7 +395,7 @@ static void pci1710_handle_every_sample(struct comedi_device *dev,
+ {
+ struct comedi_cmd *cmd = &s->async->cmd;
+ unsigned int status;
+- unsigned int val;
++ unsigned short val;
+ int ret;
+
+ status = inw(dev->iobase + PCI171X_STATUS_REG);
+@@ -455,7 +455,7 @@ static void pci1710_handle_fifo(struct comedi_device *dev,
+ }
+
+ for (i = 0; i < devpriv->max_samples; i++) {
+- unsigned int val;
++ unsigned short val;
+ int ret;
+
+ ret = pci1710_ai_read_sample(dev, s, s->async->cur_chan, &val);
+diff --git a/drivers/staging/comedi/drivers/das6402.c b/drivers/staging/comedi/drivers/das6402.c
+index f99211ec46deb..0034005bdf8f1 100644
+--- a/drivers/staging/comedi/drivers/das6402.c
++++ b/drivers/staging/comedi/drivers/das6402.c
+@@ -186,7 +186,7 @@ static irqreturn_t das6402_interrupt(int irq, void *d)
+ if (status & DAS6402_STATUS_FFULL) {
+ async->events |= COMEDI_CB_OVERFLOW;
+ } else if (status & DAS6402_STATUS_FFNE) {
+- unsigned int val;
++ unsigned short val;
+
+ val = das6402_ai_read_sample(dev, s);
+ comedi_buf_write_samples(s, &val, 1);
+diff --git a/drivers/staging/comedi/drivers/das800.c b/drivers/staging/comedi/drivers/das800.c
+index 8cf09ef3012fa..4bd8fd5218c8f 100644
+--- a/drivers/staging/comedi/drivers/das800.c
++++ b/drivers/staging/comedi/drivers/das800.c
+@@ -427,7 +427,7 @@ static irqreturn_t das800_interrupt(int irq, void *d)
+ struct comedi_cmd *cmd;
+ unsigned long irq_flags;
+ unsigned int status;
+- unsigned int val;
++ unsigned short val;
+ bool fifo_empty;
+ bool fifo_overflow;
+ int i;
+diff --git a/drivers/staging/comedi/drivers/dmm32at.c b/drivers/staging/comedi/drivers/dmm32at.c
+index 75693cdde3138..c180d18ce517f 100644
+--- a/drivers/staging/comedi/drivers/dmm32at.c
++++ b/drivers/staging/comedi/drivers/dmm32at.c
+@@ -404,7 +404,7 @@ static irqreturn_t dmm32at_isr(int irq, void *d)
+ {
+ struct comedi_device *dev = d;
+ unsigned char intstat;
+- unsigned int val;
++ unsigned short val;
+ int i;
+
+ if (!dev->attached) {
+diff --git a/drivers/staging/comedi/drivers/me4000.c b/drivers/staging/comedi/drivers/me4000.c
+index ee53571a89698..ead8000b5929b 100644
+--- a/drivers/staging/comedi/drivers/me4000.c
++++ b/drivers/staging/comedi/drivers/me4000.c
+@@ -924,7 +924,7 @@ static irqreturn_t me4000_ai_isr(int irq, void *dev_id)
+ struct comedi_subdevice *s = dev->read_subdev;
+ int i;
+ int c = 0;
+- unsigned int lval;
++ unsigned short lval;
+
+ if (!dev->attached)
+ return IRQ_NONE;
+diff --git a/drivers/staging/comedi/drivers/pcl711.c b/drivers/staging/comedi/drivers/pcl711.c
+index a5937206bf1cd..e9abae4180625 100644
+--- a/drivers/staging/comedi/drivers/pcl711.c
++++ b/drivers/staging/comedi/drivers/pcl711.c
+@@ -184,7 +184,7 @@ static irqreturn_t pcl711_interrupt(int irq, void *d)
+ struct comedi_device *dev = d;
+ struct comedi_subdevice *s = dev->read_subdev;
+ struct comedi_cmd *cmd = &s->async->cmd;
+- unsigned int data;
++ unsigned short data;
+
+ if (!dev->attached) {
+ dev_err(dev->class_dev, "spurious interrupt\n");
+diff --git a/drivers/staging/comedi/drivers/pcl818.c b/drivers/staging/comedi/drivers/pcl818.c
+index 0af5315d43575..fc8afffc1815f 100644
+--- a/drivers/staging/comedi/drivers/pcl818.c
++++ b/drivers/staging/comedi/drivers/pcl818.c
+@@ -423,7 +423,7 @@ static int pcl818_ai_eoc(struct comedi_device *dev,
+
+ static bool pcl818_ai_write_sample(struct comedi_device *dev,
+ struct comedi_subdevice *s,
+- unsigned int chan, unsigned int val)
++ unsigned int chan, unsigned short val)
+ {
+ struct pcl818_private *devpriv = dev->private;
+ struct comedi_cmd *cmd = &s->async->cmd;
+diff --git a/drivers/staging/ks7010/ks_wlan_net.c b/drivers/staging/ks7010/ks_wlan_net.c
+index dc5459ae0b51e..f624d0d53a8f2 100644
+--- a/drivers/staging/ks7010/ks_wlan_net.c
++++ b/drivers/staging/ks7010/ks_wlan_net.c
+@@ -1120,6 +1120,7 @@ static int ks_wlan_set_scan(struct net_device *dev,
+ {
+ struct ks_wlan_private *priv = netdev_priv(dev);
+ struct iw_scan_req *req = NULL;
++ int len;
+
+ if (priv->sleep_mode == SLP_SLEEP)
+ return -EPERM;
+@@ -1129,8 +1130,9 @@ static int ks_wlan_set_scan(struct net_device *dev,
+ if (wrqu->data.length == sizeof(struct iw_scan_req) &&
+ wrqu->data.flags & IW_SCAN_THIS_ESSID) {
+ req = (struct iw_scan_req *)extra;
+- priv->scan_ssid_len = req->essid_len;
+- memcpy(priv->scan_ssid, req->essid, priv->scan_ssid_len);
++ len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
++ priv->scan_ssid_len = len;
++ memcpy(priv->scan_ssid, req->essid, len);
+ } else {
+ priv->scan_ssid_len = 0;
+ }
+diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c
+index 676d549ef7869..a8365e23157b6 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
++++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
+@@ -794,6 +794,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len)
+ /* SSID */
+ p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SSID_IE_, &ie_len, (pbss_network->ie_length - _BEACON_IE_OFFSET_));
+ if (p && ie_len > 0) {
++ ie_len = min_t(int, ie_len, sizeof(pbss_network->Ssid.Ssid));
+ memset(&pbss_network->Ssid, 0, sizeof(struct ndis_802_11_ssid));
+ memcpy(pbss_network->Ssid.Ssid, (p + 2), ie_len);
+ pbss_network->Ssid.SsidLength = ie_len;
+@@ -812,6 +813,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len)
+ /* get supported rates */
+ p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SUPPORTEDRATES_IE_, &ie_len, (pbss_network->ie_length - _BEACON_IE_OFFSET_));
+ if (p) {
++ ie_len = min_t(int, ie_len, NDIS_802_11_LENGTH_RATES_EX);
+ memcpy(supportRate, p + 2, ie_len);
+ supportRateNum = ie_len;
+ }
+@@ -819,6 +821,8 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len)
+ /* get ext_supported rates */
+ p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _EXT_SUPPORTEDRATES_IE_, &ie_len, pbss_network->ie_length - _BEACON_IE_OFFSET_);
+ if (p) {
++ ie_len = min_t(int, ie_len,
++ NDIS_802_11_LENGTH_RATES_EX - supportRateNum);
+ memcpy(supportRate + supportRateNum, p + 2, ie_len);
+ supportRateNum += ie_len;
+ }
+@@ -932,6 +936,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len)
+
+ pht_cap->mcs.rx_mask[0] = 0xff;
+ pht_cap->mcs.rx_mask[1] = 0x0;
++ ie_len = min_t(int, ie_len, sizeof(pmlmepriv->htpriv.ht_cap));
+ memcpy(&pmlmepriv->htpriv.ht_cap, p+2, ie_len);
+ }
+
+diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+index 0003f0c38038b..2e1f31b08e8b6 100644
+--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+@@ -1161,9 +1161,11 @@ static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
+ break;
+ }
+ sec_len = *(pos++); len -= 1;
+- if (sec_len > 0 && sec_len <= len) {
++ if (sec_len > 0 &&
++ sec_len <= len &&
++ sec_len <= 32) {
+ ssid[ssid_index].SsidLength = sec_len;
+- memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
++ memcpy(ssid[ssid_index].Ssid, pos, sec_len);
+ ssid_index++;
+ }
+ pos += sec_len;
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
+index 843e874b8a060..c5d67525b0306 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
+@@ -415,9 +415,10 @@ static int _rtl92e_wx_set_scan(struct net_device *dev,
+ struct iw_scan_req *req = (struct iw_scan_req *)b;
+
+ if (req->essid_len) {
+- ieee->current_network.ssid_len = req->essid_len;
+- memcpy(ieee->current_network.ssid, req->essid,
+- req->essid_len);
++ int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
++
++ ieee->current_network.ssid_len = len;
++ memcpy(ieee->current_network.ssid, req->essid, len);
+ }
+ }
+
+diff --git a/drivers/staging/rtl8192u/r8192U_wx.c b/drivers/staging/rtl8192u/r8192U_wx.c
+index e4e6c979bedf3..aa2206ccecee6 100644
+--- a/drivers/staging/rtl8192u/r8192U_wx.c
++++ b/drivers/staging/rtl8192u/r8192U_wx.c
+@@ -333,8 +333,10 @@ static int r8192_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
+ struct iw_scan_req *req = (struct iw_scan_req *)b;
+
+ if (req->essid_len) {
+- ieee->current_network.ssid_len = req->essid_len;
+- memcpy(ieee->current_network.ssid, req->essid, req->essid_len);
++ int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
++
++ ieee->current_network.ssid_len = len;
++ memcpy(ieee->current_network.ssid, req->essid, len);
+ }
+ }
+
+diff --git a/drivers/staging/rtl8712/rtl871x_cmd.c b/drivers/staging/rtl8712/rtl871x_cmd.c
+index 620cee8b85144..db7bfdf9b4b27 100644
+--- a/drivers/staging/rtl8712/rtl871x_cmd.c
++++ b/drivers/staging/rtl8712/rtl871x_cmd.c
+@@ -242,8 +242,10 @@ u8 r8712_sitesurvey_cmd(struct _adapter *padapter,
+ psurveyPara->ss_ssidlen = 0;
+ memset(psurveyPara->ss_ssid, 0, IW_ESSID_MAX_SIZE + 1);
+ if ((pssid != NULL) && (pssid->SsidLength)) {
+- memcpy(psurveyPara->ss_ssid, pssid->Ssid, pssid->SsidLength);
+- psurveyPara->ss_ssidlen = cpu_to_le32(pssid->SsidLength);
++ int len = min_t(int, pssid->SsidLength, IW_ESSID_MAX_SIZE);
++
++ memcpy(psurveyPara->ss_ssid, pssid->Ssid, len);
++ psurveyPara->ss_ssidlen = cpu_to_le32(len);
+ }
+ set_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
+ r8712_enqueue_cmd(pcmdpriv, ph2c);
+diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+index 2f490a4bf60ac..4472dc76276a2 100644
+--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
++++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+@@ -946,7 +946,7 @@ static int r871x_wx_set_priv(struct net_device *dev,
+ struct iw_point *dwrq = (struct iw_point *)awrq;
+
+ len = dwrq->length;
+- ext = memdup_user(dwrq->pointer, len);
++ ext = strndup_user(dwrq->pointer, len);
+ if (IS_ERR(ext))
+ return PTR_ERR(ext);
+
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index 10db5656fd5dc..949879f2f1d15 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -3742,6 +3742,7 @@ core_scsi3_pri_read_keys(struct se_cmd *cmd)
+ spin_unlock(&dev->t10_pr.registration_lock);
+
+ put_unaligned_be32(add_len, &buf[4]);
++ target_set_cmd_data_length(cmd, 8 + add_len);
+
+ transport_kunmap_data_sg(cmd);
+
+@@ -3760,7 +3761,7 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
+ struct t10_pr_registration *pr_reg;
+ unsigned char *buf;
+ u64 pr_res_key;
+- u32 add_len = 16; /* Hardcoded to 16 when a reservation is held. */
++ u32 add_len = 0;
+
+ if (cmd->data_length < 8) {
+ pr_err("PRIN SA READ_RESERVATIONS SCSI Data Length: %u"
+@@ -3778,8 +3779,9 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
+ pr_reg = dev->dev_pr_res_holder;
+ if (pr_reg) {
+ /*
+- * Set the hardcoded Additional Length
++ * Set the Additional Length to 16 when a reservation is held
+ */
++ add_len = 16;
+ put_unaligned_be32(add_len, &buf[4]);
+
+ if (cmd->data_length < 22)
+@@ -3815,6 +3817,8 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
+ (pr_reg->pr_res_type & 0x0f);
+ }
+
++ target_set_cmd_data_length(cmd, 8 + add_len);
++
+ err:
+ spin_unlock(&dev->dev_reservation_lock);
+ transport_kunmap_data_sg(cmd);
+@@ -3833,7 +3837,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
+ struct se_device *dev = cmd->se_dev;
+ struct t10_reservation *pr_tmpl = &dev->t10_pr;
+ unsigned char *buf;
+- u16 add_len = 8; /* Hardcoded to 8. */
++ u16 len = 8; /* Hardcoded to 8. */
+
+ if (cmd->data_length < 6) {
+ pr_err("PRIN SA REPORT_CAPABILITIES SCSI Data Length:"
+@@ -3845,7 +3849,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
+ if (!buf)
+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+
+- put_unaligned_be16(add_len, &buf[0]);
++ put_unaligned_be16(len, &buf[0]);
+ buf[2] |= 0x10; /* CRH: Compatible Reservation Hanlding bit. */
+ buf[2] |= 0x08; /* SIP_C: Specify Initiator Ports Capable bit */
+ buf[2] |= 0x04; /* ATP_C: All Target Ports Capable bit */
+@@ -3874,6 +3878,8 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
+ buf[4] |= 0x02; /* PR_TYPE_WRITE_EXCLUSIVE */
+ buf[5] |= 0x01; /* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */
+
++ target_set_cmd_data_length(cmd, len);
++
+ transport_kunmap_data_sg(cmd);
+
+ return 0;
+@@ -4034,6 +4040,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
+ * Set ADDITIONAL_LENGTH
+ */
+ put_unaligned_be32(add_len, &buf[4]);
++ target_set_cmd_data_length(cmd, 8 + add_len);
+
+ transport_kunmap_data_sg(cmd);
+
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index f1b730b77a312..bdada97cd4fe2 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -841,11 +841,9 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
+ }
+ EXPORT_SYMBOL(target_complete_cmd);
+
+-void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length)
++void target_set_cmd_data_length(struct se_cmd *cmd, int length)
+ {
+- if ((scsi_status == SAM_STAT_GOOD ||
+- cmd->se_cmd_flags & SCF_TREAT_READ_AS_NORMAL) &&
+- length < cmd->data_length) {
++ if (length < cmd->data_length) {
+ if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
+ cmd->residual_count += cmd->data_length - length;
+ } else {
+@@ -855,6 +853,15 @@ void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int len
+
+ cmd->data_length = length;
+ }
++}
++EXPORT_SYMBOL(target_set_cmd_data_length);
++
++void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length)
++{
++ if (scsi_status == SAM_STAT_GOOD ||
++ cmd->se_cmd_flags & SCF_TREAT_READ_AS_NORMAL) {
++ target_set_cmd_data_length(cmd, length);
++ }
+
+ target_complete_cmd(cmd, scsi_status);
+ }
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index e847d0de67607..c523dfe408d51 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1973,6 +1973,11 @@ static const struct usb_device_id acm_ids[] = {
+ .driver_info = SEND_ZERO_PACKET,
+ },
+
++ /* Exclude Goodix Fingerprint Reader */
++ { USB_DEVICE(0x27c6, 0x5395),
++ .driver_info = IGNORE_DEVICE,
++ },
++
+ /* control interfaces without any protocol set */
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
+ USB_CDC_PROTO_NONE) },
+diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
+index c9560d8ba3cb1..5edf52a6edfca 100644
+--- a/drivers/usb/class/usblp.c
++++ b/drivers/usb/class/usblp.c
+@@ -494,16 +494,24 @@ static int usblp_release(struct inode *inode, struct file *file)
+ /* No kernel lock - fine */
+ static __poll_t usblp_poll(struct file *file, struct poll_table_struct *wait)
+ {
+- __poll_t ret;
++ struct usblp *usblp = file->private_data;
++ __poll_t ret = 0;
+ unsigned long flags;
+
+- struct usblp *usblp = file->private_data;
+ /* Should we check file->f_mode & FMODE_WRITE before poll_wait()? */
+ poll_wait(file, &usblp->rwait, wait);
+ poll_wait(file, &usblp->wwait, wait);
++
++ mutex_lock(&usblp->mut);
++ if (!usblp->present)
++ ret |= EPOLLHUP;
++ mutex_unlock(&usblp->mut);
++
+ spin_lock_irqsave(&usblp->lock, flags);
+- ret = ((usblp->bidir && usblp->rcomplete) ? EPOLLIN | EPOLLRDNORM : 0) |
+- ((usblp->no_paper || usblp->wcomplete) ? EPOLLOUT | EPOLLWRNORM : 0);
++ if (usblp->bidir && usblp->rcomplete)
++ ret |= EPOLLIN | EPOLLRDNORM;
++ if (usblp->no_paper || usblp->wcomplete)
++ ret |= EPOLLOUT | EPOLLWRNORM;
+ spin_unlock_irqrestore(&usblp->lock, flags);
+ return ret;
+ }
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index a6d0203e40b6e..5bb5384f36125 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -234,8 +234,10 @@ static int dwc3_qcom_suspend(struct dwc3_qcom *qcom)
+ for (i = qcom->num_clocks - 1; i >= 0; i--)
+ clk_disable_unprepare(qcom->clks[i]);
+
++ if (device_may_wakeup(qcom->dev))
++ dwc3_qcom_enable_interrupts(qcom);
++
+ qcom->is_suspended = true;
+- dwc3_qcom_enable_interrupts(qcom);
+
+ return 0;
+ }
+@@ -248,7 +250,8 @@ static int dwc3_qcom_resume(struct dwc3_qcom *qcom)
+ if (!qcom->is_suspended)
+ return 0;
+
+- dwc3_qcom_disable_interrupts(qcom);
++ if (device_may_wakeup(qcom->dev))
++ dwc3_qcom_disable_interrupts(qcom);
+
+ for (i = 0; i < qcom->num_clocks; i++) {
+ ret = clk_prepare_enable(qcom->clks[i]);
+diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
+index 2746a926a8d97..a215c836eba4b 100644
+--- a/drivers/usb/gadget/function/f_uac1.c
++++ b/drivers/usb/gadget/function/f_uac1.c
+@@ -499,6 +499,7 @@ static void f_audio_disable(struct usb_function *f)
+ uac1->as_out_alt = 0;
+ uac1->as_in_alt = 0;
+
++ u_audio_stop_playback(&uac1->g_audio);
+ u_audio_stop_capture(&uac1->g_audio);
+ }
+
+diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
+index 425981ab7a4dc..8e563f56fbc26 100644
+--- a/drivers/usb/gadget/function/f_uac2.c
++++ b/drivers/usb/gadget/function/f_uac2.c
+@@ -482,7 +482,7 @@ static int set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts,
+ }
+
+ max_size_bw = num_channels(chmask) * ssize *
+- DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1)));
++ ((srate / (factor / (1 << (ep_desc->bInterval - 1)))) + 1);
+ ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_size_bw,
+ max_size_ep));
+
+diff --git a/drivers/usb/gadget/function/u_ether_configfs.h b/drivers/usb/gadget/function/u_ether_configfs.h
+index cd33cee4d78b6..1321e773626df 100644
+--- a/drivers/usb/gadget/function/u_ether_configfs.h
++++ b/drivers/usb/gadget/function/u_ether_configfs.h
+@@ -169,12 +169,11 @@ out: \
+ size_t len) \
+ { \
+ struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \
+- int ret; \
++ int ret = -EINVAL; \
+ u8 val; \
+ \
+ mutex_lock(&opts->lock); \
+- ret = sscanf(page, "%02hhx", &val); \
+- if (ret > 0) { \
++ if (sscanf(page, "%02hhx", &val) > 0) { \
+ opts->_n_ = val; \
+ ret = len; \
+ } \
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 0c6b6f14b1696..42ff11e3c4dcf 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -53,6 +53,7 @@
+ #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142
+ #define PCI_DEVICE_ID_ASMEDIA_1142_XHCI 0x1242
+ #define PCI_DEVICE_ID_ASMEDIA_2142_XHCI 0x2142
++#define PCI_DEVICE_ID_ASMEDIA_3242_XHCI 0x3242
+
+ static const char hcd_name[] = "xhci_hcd";
+
+@@ -237,11 +238,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI)
+ xhci->quirks |= XHCI_BROKEN_STREAMS;
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+- pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI)
++ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) {
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
++ xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
++ }
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+ (pdev->device == PCI_DEVICE_ID_ASMEDIA_1142_XHCI ||
+- pdev->device == PCI_DEVICE_ID_ASMEDIA_2142_XHCI))
++ pdev->device == PCI_DEVICE_ID_ASMEDIA_2142_XHCI ||
++ pdev->device == PCI_DEVICE_ID_ASMEDIA_3242_XHCI))
+ xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
+
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index a753221c2268e..6c508d0313f7f 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1078,6 +1078,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ struct usb_hcd *secondary_hcd;
+ int retval = 0;
+ bool comp_timer_running = false;
++ bool pending_portevent = false;
+
+ if (!hcd->state)
+ return 0;
+@@ -1216,13 +1217,22 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+
+ done:
+ if (retval == 0) {
+- /* Resume root hubs only when have pending events. */
+- if (xhci_pending_portevent(xhci)) {
++ /*
++ * Resume roothubs only if there are pending events.
++ * USB 3 devices resend U3 LFPS wake after a 100ms delay if
++ * the first wake signalling failed, give it that chance.
++ */
++ pending_portevent = xhci_pending_portevent(xhci);
++ if (!pending_portevent) {
++ msleep(120);
++ pending_portevent = xhci_pending_portevent(xhci);
++ }
++
++ if (pending_portevent) {
+ usb_hcd_resume_root_hub(xhci->shared_hcd);
+ usb_hcd_resume_root_hub(hcd);
+ }
+ }
+-
+ /*
+ * If system is subject to the Quirk, Compliance Mode Timer needs to
+ * be re-initialized Always after a system resume. Ports are subject
+diff --git a/drivers/usb/renesas_usbhs/pipe.c b/drivers/usb/renesas_usbhs/pipe.c
+index 9e5afdde1adbf..40576e7176d8b 100644
+--- a/drivers/usb/renesas_usbhs/pipe.c
++++ b/drivers/usb/renesas_usbhs/pipe.c
+@@ -746,6 +746,8 @@ struct usbhs_pipe *usbhs_pipe_malloc(struct usbhs_priv *priv,
+
+ void usbhs_pipe_free(struct usbhs_pipe *pipe)
+ {
++ usbhsp_pipe_select(pipe);
++ usbhsp_pipe_cfg_set(pipe, 0xFFFF, 0);
+ usbhsp_put_pipe(pipe);
+ }
+
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index c6bdf533016a5..c87cb25e70ec5 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -85,6 +85,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1a86, 0x7522) },
+ { USB_DEVICE(0x1a86, 0x7523) },
+ { USB_DEVICE(0x4348, 0x5523) },
++ { USB_DEVICE(0x9986, 0x7523) },
+ { },
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 07a2c72fc3a71..7d602e6ccbc09 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -146,6 +146,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */
+ { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
++ { USB_DEVICE(0x10C4, 0x88D8) }, /* Acuity Brands nLight Air Adapter */
+ { USB_DEVICE(0x10C4, 0x88FB) }, /* CESINEL MEDCAL STII Network Analyzer */
+ { USB_DEVICE(0x10C4, 0x8938) }, /* CESINEL MEDCAL S II Network Analyzer */
+ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+@@ -202,6 +203,8 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */
+ { USB_DEVICE(0x1901, 0x0195) }, /* GE B850/B650/B450 CP2104 DP UART interface */
+ { USB_DEVICE(0x1901, 0x0196) }, /* GE B850 CP2105 DP UART interface */
++ { USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 Display serial interface */
++ { USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 M.2 Key E serial interface */
+ { USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */
+ { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
+index dab8c18e726f5..44c902c7d240c 100644
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -3021,26 +3021,32 @@ static int edge_startup(struct usb_serial *serial)
+ response = -ENODEV;
+ }
+
+- usb_free_urb(edge_serial->interrupt_read_urb);
+- kfree(edge_serial->interrupt_in_buffer);
+-
+- usb_free_urb(edge_serial->read_urb);
+- kfree(edge_serial->bulk_in_buffer);
+-
+- kfree(edge_serial);
+-
+- return response;
++ goto error;
+ }
+
+ /* start interrupt read for this edgeport this interrupt will
+ * continue as long as the edgeport is connected */
+ response = usb_submit_urb(edge_serial->interrupt_read_urb,
+ GFP_KERNEL);
+- if (response)
++ if (response) {
+ dev_err(ddev, "%s - Error %d submitting control urb\n",
+ __func__, response);
++
++ goto error;
++ }
+ }
+ return response;
++
++error:
++ usb_free_urb(edge_serial->interrupt_read_urb);
++ kfree(edge_serial->interrupt_in_buffer);
++
++ usb_free_urb(edge_serial->read_urb);
++ kfree(edge_serial->bulk_in_buffer);
++
++ kfree(edge_serial);
++
++ return response;
+ }
+
+
+diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
+index 7931e6cecc704..6ca3d063686c9 100644
+--- a/drivers/usb/usbip/stub_dev.c
++++ b/drivers/usb/usbip/stub_dev.c
+@@ -46,6 +46,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
+ int sockfd = 0;
+ struct socket *socket;
+ int rv;
++ struct task_struct *tcp_rx = NULL;
++ struct task_struct *tcp_tx = NULL;
+
+ if (!sdev) {
+ dev_err(dev, "sdev is null\n");
+@@ -69,23 +71,47 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
+ }
+
+ socket = sockfd_lookup(sockfd, &err);
+- if (!socket)
++ if (!socket) {
++ dev_err(dev, "failed to lookup sock");
+ goto err;
++ }
+
+- sdev->ud.tcp_socket = socket;
+- sdev->ud.sockfd = sockfd;
++ if (socket->type != SOCK_STREAM) {
++ dev_err(dev, "Expecting SOCK_STREAM - found %d",
++ socket->type);
++ goto sock_err;
++ }
+
++ /* unlock and create threads and get tasks */
+ spin_unlock_irq(&sdev->ud.lock);
++ tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx");
++ if (IS_ERR(tcp_rx)) {
++ sockfd_put(socket);
++ return -EINVAL;
++ }
++ tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx");
++ if (IS_ERR(tcp_tx)) {
++ kthread_stop(tcp_rx);
++ sockfd_put(socket);
++ return -EINVAL;
++ }
+
+- sdev->ud.tcp_rx = kthread_get_run(stub_rx_loop, &sdev->ud,
+- "stub_rx");
+- sdev->ud.tcp_tx = kthread_get_run(stub_tx_loop, &sdev->ud,
+- "stub_tx");
++ /* get task structs now */
++ get_task_struct(tcp_rx);
++ get_task_struct(tcp_tx);
+
++ /* lock and update sdev->ud state */
+ spin_lock_irq(&sdev->ud.lock);
++ sdev->ud.tcp_socket = socket;
++ sdev->ud.sockfd = sockfd;
++ sdev->ud.tcp_rx = tcp_rx;
++ sdev->ud.tcp_tx = tcp_tx;
+ sdev->ud.status = SDEV_ST_USED;
+ spin_unlock_irq(&sdev->ud.lock);
+
++ wake_up_process(sdev->ud.tcp_rx);
++ wake_up_process(sdev->ud.tcp_tx);
++
+ } else {
+ dev_info(dev, "stub down\n");
+
+@@ -100,6 +126,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
+
+ return count;
+
++sock_err:
++ sockfd_put(socket);
+ err:
+ spin_unlock_irq(&sdev->ud.lock);
+ return -EINVAL;
+diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
+index be37aec250c2b..e64ea314930be 100644
+--- a/drivers/usb/usbip/vhci_sysfs.c
++++ b/drivers/usb/usbip/vhci_sysfs.c
+@@ -312,6 +312,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr,
+ struct vhci *vhci;
+ int err;
+ unsigned long flags;
++ struct task_struct *tcp_rx = NULL;
++ struct task_struct *tcp_tx = NULL;
+
+ /*
+ * @rhport: port number of vhci_hcd
+@@ -349,12 +351,35 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr,
+
+ /* Extract socket from fd. */
+ socket = sockfd_lookup(sockfd, &err);
+- if (!socket)
++ if (!socket) {
++ dev_err(dev, "failed to lookup sock");
+ return -EINVAL;
++ }
++ if (socket->type != SOCK_STREAM) {
++ dev_err(dev, "Expecting SOCK_STREAM - found %d",
++ socket->type);
++ sockfd_put(socket);
++ return -EINVAL;
++ }
++
++ /* create threads before locking */
++ tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx");
++ if (IS_ERR(tcp_rx)) {
++ sockfd_put(socket);
++ return -EINVAL;
++ }
++ tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx");
++ if (IS_ERR(tcp_tx)) {
++ kthread_stop(tcp_rx);
++ sockfd_put(socket);
++ return -EINVAL;
++ }
+
+- /* now need lock until setting vdev status as used */
++ /* get task structs now */
++ get_task_struct(tcp_rx);
++ get_task_struct(tcp_tx);
+
+- /* begin a lock */
++ /* now begin lock until setting vdev status set */
+ spin_lock_irqsave(&vhci->lock, flags);
+ spin_lock(&vdev->ud.lock);
+
+@@ -364,6 +389,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr,
+ spin_unlock_irqrestore(&vhci->lock, flags);
+
+ sockfd_put(socket);
++ kthread_stop_put(tcp_rx);
++ kthread_stop_put(tcp_tx);
+
+ dev_err(dev, "port %d already used\n", rhport);
+ /*
+@@ -382,14 +409,16 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr,
+ vdev->speed = speed;
+ vdev->ud.sockfd = sockfd;
+ vdev->ud.tcp_socket = socket;
++ vdev->ud.tcp_rx = tcp_rx;
++ vdev->ud.tcp_tx = tcp_tx;
+ vdev->ud.status = VDEV_ST_NOTASSIGNED;
+
+ spin_unlock(&vdev->ud.lock);
+ spin_unlock_irqrestore(&vhci->lock, flags);
+ /* end the lock */
+
+- vdev->ud.tcp_rx = kthread_get_run(vhci_rx_loop, &vdev->ud, "vhci_rx");
+- vdev->ud.tcp_tx = kthread_get_run(vhci_tx_loop, &vdev->ud, "vhci_tx");
++ wake_up_process(vdev->ud.tcp_rx);
++ wake_up_process(vdev->ud.tcp_tx);
+
+ rh_port_connect(vdev, speed);
+
+diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
+index 6dcd3ff655c33..741852bd148ea 100644
+--- a/drivers/usb/usbip/vudc_sysfs.c
++++ b/drivers/usb/usbip/vudc_sysfs.c
+@@ -12,6 +12,7 @@
+ #include <linux/usb/ch9.h>
+ #include <linux/sysfs.h>
+ #include <linux/kthread.h>
++#include <linux/file.h>
+ #include <linux/byteorder/generic.h>
+
+ #include "usbip_common.h"
+@@ -90,8 +91,9 @@ unlock:
+ }
+ static BIN_ATTR_RO(dev_desc, sizeof(struct usb_device_descriptor));
+
+-static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *attr,
+- const char *in, size_t count)
++static ssize_t usbip_sockfd_store(struct device *dev,
++ struct device_attribute *attr,
++ const char *in, size_t count)
+ {
+ struct vudc *udc = (struct vudc *) dev_get_drvdata(dev);
+ int rv;
+@@ -100,6 +102,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
+ struct socket *socket;
+ unsigned long flags;
+ int ret;
++ struct task_struct *tcp_rx = NULL;
++ struct task_struct *tcp_tx = NULL;
+
+ rv = kstrtoint(in, 0, &sockfd);
+ if (rv != 0)
+@@ -138,24 +142,54 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
+ goto unlock_ud;
+ }
+
+- udc->ud.tcp_socket = socket;
++ if (socket->type != SOCK_STREAM) {
++ dev_err(dev, "Expecting SOCK_STREAM - found %d",
++ socket->type);
++ ret = -EINVAL;
++ goto sock_err;
++ }
+
++ /* unlock and create threads and get tasks */
+ spin_unlock_irq(&udc->ud.lock);
+ spin_unlock_irqrestore(&udc->lock, flags);
+
+- udc->ud.tcp_rx = kthread_get_run(&v_rx_loop,
+- &udc->ud, "vudc_rx");
+- udc->ud.tcp_tx = kthread_get_run(&v_tx_loop,
+- &udc->ud, "vudc_tx");
++ tcp_rx = kthread_create(&v_rx_loop, &udc->ud, "vudc_rx");
++ if (IS_ERR(tcp_rx)) {
++ sockfd_put(socket);
++ return -EINVAL;
++ }
++ tcp_tx = kthread_create(&v_tx_loop, &udc->ud, "vudc_tx");
++ if (IS_ERR(tcp_tx)) {
++ kthread_stop(tcp_rx);
++ sockfd_put(socket);
++ return -EINVAL;
++ }
++
++ /* get task structs now */
++ get_task_struct(tcp_rx);
++ get_task_struct(tcp_tx);
+
++ /* lock and update udc->ud state */
+ spin_lock_irqsave(&udc->lock, flags);
+ spin_lock_irq(&udc->ud.lock);
++
++ udc->ud.tcp_socket = socket;
++ udc->ud.tcp_rx = tcp_rx;
++ udc->ud.tcp_rx = tcp_tx;
+ udc->ud.status = SDEV_ST_USED;
++
+ spin_unlock_irq(&udc->ud.lock);
+
+ ktime_get_ts64(&udc->start_time);
+ v_start_timer(udc);
+ udc->connected = 1;
++
++ spin_unlock_irqrestore(&udc->lock, flags);
++
++ wake_up_process(udc->ud.tcp_rx);
++ wake_up_process(udc->ud.tcp_tx);
++ return count;
++
+ } else {
+ if (!udc->connected) {
+ dev_err(dev, "Device not connected");
+@@ -177,6 +211,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
+
+ return count;
+
++sock_err:
++ sockfd_put(socket);
+ unlock_ud:
+ spin_unlock_irq(&udc->ud.lock);
+ unlock:
+diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c
+index f026624898e7a..77cc80bcb479c 100644
+--- a/drivers/xen/events/events_2l.c
++++ b/drivers/xen/events/events_2l.c
+@@ -47,6 +47,11 @@ static unsigned evtchn_2l_max_channels(void)
+ return EVTCHN_2L_NR_CHANNELS;
+ }
+
++static void evtchn_2l_remove(evtchn_port_t evtchn, unsigned int cpu)
++{
++ clear_bit(evtchn, BM(per_cpu(cpu_evtchn_mask, cpu)));
++}
++
+ static void evtchn_2l_bind_to_cpu(struct irq_info *info, unsigned cpu)
+ {
+ clear_bit(info->evtchn, BM(per_cpu(cpu_evtchn_mask, info->cpu)));
+@@ -71,12 +76,6 @@ static bool evtchn_2l_is_pending(unsigned port)
+ return sync_test_bit(port, BM(&s->evtchn_pending[0]));
+ }
+
+-static bool evtchn_2l_test_and_set_mask(unsigned port)
+-{
+- struct shared_info *s = HYPERVISOR_shared_info;
+- return sync_test_and_set_bit(port, BM(&s->evtchn_mask[0]));
+-}
+-
+ static void evtchn_2l_mask(unsigned port)
+ {
+ struct shared_info *s = HYPERVISOR_shared_info;
+@@ -354,18 +353,27 @@ static void evtchn_2l_resume(void)
+ EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
+ }
+
++static int evtchn_2l_percpu_deinit(unsigned int cpu)
++{
++ memset(per_cpu(cpu_evtchn_mask, cpu), 0, sizeof(xen_ulong_t) *
++ EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
++
++ return 0;
++}
++
+ static const struct evtchn_ops evtchn_ops_2l = {
+ .max_channels = evtchn_2l_max_channels,
+ .nr_channels = evtchn_2l_max_channels,
++ .remove = evtchn_2l_remove,
+ .bind_to_cpu = evtchn_2l_bind_to_cpu,
+ .clear_pending = evtchn_2l_clear_pending,
+ .set_pending = evtchn_2l_set_pending,
+ .is_pending = evtchn_2l_is_pending,
+- .test_and_set_mask = evtchn_2l_test_and_set_mask,
+ .mask = evtchn_2l_mask,
+ .unmask = evtchn_2l_unmask,
+ .handle_events = evtchn_2l_handle_events,
+ .resume = evtchn_2l_resume,
++ .percpu_deinit = evtchn_2l_percpu_deinit,
+ };
+
+ void __init xen_evtchn_2l_init(void)
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index 8c08c7d46d3d0..fae2a536acc67 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -98,6 +98,7 @@ static DEFINE_RWLOCK(evtchn_rwlock);
+ * evtchn_rwlock
+ * IRQ-desc lock
+ * percpu eoi_list_lock
++ * irq_info->lock
+ */
+
+ static LIST_HEAD(xen_irq_list_head);
+@@ -219,6 +220,8 @@ static int xen_irq_info_common_setup(struct irq_info *info,
+ info->irq = irq;
+ info->evtchn = evtchn;
+ info->cpu = cpu;
++ info->mask_reason = EVT_MASK_REASON_EXPLICIT;
++ spin_lock_init(&info->lock);
+
+ ret = set_evtchn_to_irq(evtchn, irq);
+ if (ret < 0)
+@@ -285,6 +288,7 @@ static int xen_irq_info_pirq_setup(unsigned irq,
+ static void xen_irq_info_cleanup(struct irq_info *info)
+ {
+ set_evtchn_to_irq(info->evtchn, -1);
++ xen_evtchn_port_remove(info->evtchn, info->cpu);
+ info->evtchn = 0;
+ }
+
+@@ -365,6 +369,34 @@ unsigned int cpu_from_evtchn(unsigned int evtchn)
+ return ret;
+ }
+
++static void do_mask(struct irq_info *info, u8 reason)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&info->lock, flags);
++
++ if (!info->mask_reason)
++ mask_evtchn(info->evtchn);
++
++ info->mask_reason |= reason;
++
++ spin_unlock_irqrestore(&info->lock, flags);
++}
++
++static void do_unmask(struct irq_info *info, u8 reason)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&info->lock, flags);
++
++ info->mask_reason &= ~reason;
++
++ if (!info->mask_reason)
++ unmask_evtchn(info->evtchn);
++
++ spin_unlock_irqrestore(&info->lock, flags);
++}
++
+ #ifdef CONFIG_X86
+ static bool pirq_check_eoi_map(unsigned irq)
+ {
+@@ -492,7 +524,7 @@ static void xen_irq_lateeoi_locked(struct irq_info *info, bool spurious)
+ }
+
+ info->eoi_time = 0;
+- unmask_evtchn(evtchn);
++ do_unmask(info, EVT_MASK_REASON_EOI_PENDING);
+ }
+
+ static void xen_irq_lateeoi_worker(struct work_struct *work)
+@@ -661,6 +693,12 @@ static void xen_evtchn_close(unsigned int port)
+ BUG();
+ }
+
++static void event_handler_exit(struct irq_info *info)
++{
++ smp_store_release(&info->is_active, 0);
++ clear_evtchn(info->evtchn);
++}
++
+ static void pirq_query_unmask(int irq)
+ {
+ struct physdev_irq_status_query irq_status;
+@@ -679,7 +717,8 @@ static void pirq_query_unmask(int irq)
+
+ static void eoi_pirq(struct irq_data *data)
+ {
+- int evtchn = evtchn_from_irq(data->irq);
++ struct irq_info *info = info_for_irq(data->irq);
++ int evtchn = info ? info->evtchn : 0;
+ struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) };
+ int rc = 0;
+
+@@ -688,16 +727,15 @@ static void eoi_pirq(struct irq_data *data)
+
+ if (unlikely(irqd_is_setaffinity_pending(data)) &&
+ likely(!irqd_irq_disabled(data))) {
+- int masked = test_and_set_mask(evtchn);
++ do_mask(info, EVT_MASK_REASON_TEMPORARY);
+
+- clear_evtchn(evtchn);
++ event_handler_exit(info);
+
+ irq_move_masked_irq(data);
+
+- if (!masked)
+- unmask_evtchn(evtchn);
++ do_unmask(info, EVT_MASK_REASON_TEMPORARY);
+ } else
+- clear_evtchn(evtchn);
++ event_handler_exit(info);
+
+ if (pirq_needs_eoi(data->irq)) {
+ rc = HYPERVISOR_physdev_op(PHYSDEVOP_eoi, &eoi);
+@@ -748,7 +786,8 @@ static unsigned int __startup_pirq(unsigned int irq)
+ goto err;
+
+ out:
+- unmask_evtchn(evtchn);
++ do_unmask(info, EVT_MASK_REASON_EXPLICIT);
++
+ eoi_pirq(irq_get_irq_data(irq));
+
+ return 0;
+@@ -775,7 +814,7 @@ static void shutdown_pirq(struct irq_data *data)
+ if (!VALID_EVTCHN(evtchn))
+ return;
+
+- mask_evtchn(evtchn);
++ do_mask(info, EVT_MASK_REASON_EXPLICIT);
+ xen_evtchn_close(evtchn);
+ xen_irq_info_cleanup(info);
+ }
+@@ -1532,6 +1571,8 @@ void handle_irq_for_port(evtchn_port_t port, struct evtchn_loop_ctrl *ctrl)
+ }
+
+ info = info_for_irq(irq);
++ if (xchg_acquire(&info->is_active, 1))
++ return;
+
+ if (ctrl->defer_eoi) {
+ info->eoi_cpu = smp_processor_id();
+@@ -1634,10 +1675,10 @@ void rebind_evtchn_irq(int evtchn, int irq)
+ }
+
+ /* Rebind an evtchn so that it gets delivered to a specific cpu */
+-static int xen_rebind_evtchn_to_cpu(int evtchn, unsigned int tcpu)
++static int xen_rebind_evtchn_to_cpu(struct irq_info *info, unsigned int tcpu)
+ {
+ struct evtchn_bind_vcpu bind_vcpu;
+- int masked;
++ evtchn_port_t evtchn = info ? info->evtchn : 0;
+
+ if (!VALID_EVTCHN(evtchn))
+ return -1;
+@@ -1653,7 +1694,7 @@ static int xen_rebind_evtchn_to_cpu(int evtchn, unsigned int tcpu)
+ * Mask the event while changing the VCPU binding to prevent
+ * it being delivered on an unexpected VCPU.
+ */
+- masked = test_and_set_mask(evtchn);
++ do_mask(info, EVT_MASK_REASON_TEMPORARY);
+
+ /*
+ * If this fails, it usually just indicates that we're dealing with a
+@@ -1663,8 +1704,7 @@ static int xen_rebind_evtchn_to_cpu(int evtchn, unsigned int tcpu)
+ if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
+ bind_evtchn_to_cpu(evtchn, tcpu);
+
+- if (!masked)
+- unmask_evtchn(evtchn);
++ do_unmask(info, EVT_MASK_REASON_TEMPORARY);
+
+ return 0;
+ }
+@@ -1673,7 +1713,7 @@ static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest,
+ bool force)
+ {
+ unsigned tcpu = cpumask_first_and(dest, cpu_online_mask);
+- int ret = xen_rebind_evtchn_to_cpu(evtchn_from_irq(data->irq), tcpu);
++ int ret = xen_rebind_evtchn_to_cpu(info_for_irq(data->irq), tcpu);
+
+ if (!ret)
+ irq_data_update_effective_affinity(data, cpumask_of(tcpu));
+@@ -1692,39 +1732,41 @@ EXPORT_SYMBOL_GPL(xen_set_affinity_evtchn);
+
+ static void enable_dynirq(struct irq_data *data)
+ {
+- int evtchn = evtchn_from_irq(data->irq);
++ struct irq_info *info = info_for_irq(data->irq);
++ evtchn_port_t evtchn = info ? info->evtchn : 0;
+
+ if (VALID_EVTCHN(evtchn))
+- unmask_evtchn(evtchn);
++ do_unmask(info, EVT_MASK_REASON_EXPLICIT);
+ }
+
+ static void disable_dynirq(struct irq_data *data)
+ {
+- int evtchn = evtchn_from_irq(data->irq);
++ struct irq_info *info = info_for_irq(data->irq);
++ evtchn_port_t evtchn = info ? info->evtchn : 0;
+
+ if (VALID_EVTCHN(evtchn))
+- mask_evtchn(evtchn);
++ do_mask(info, EVT_MASK_REASON_EXPLICIT);
+ }
+
+ static void ack_dynirq(struct irq_data *data)
+ {
+- int evtchn = evtchn_from_irq(data->irq);
++ struct irq_info *info = info_for_irq(data->irq);
++ evtchn_port_t evtchn = info ? info->evtchn : 0;
+
+ if (!VALID_EVTCHN(evtchn))
+ return;
+
+ if (unlikely(irqd_is_setaffinity_pending(data)) &&
+ likely(!irqd_irq_disabled(data))) {
+- int masked = test_and_set_mask(evtchn);
++ do_mask(info, EVT_MASK_REASON_TEMPORARY);
+
+- clear_evtchn(evtchn);
++ event_handler_exit(info);
+
+ irq_move_masked_irq(data);
+
+- if (!masked)
+- unmask_evtchn(evtchn);
++ do_unmask(info, EVT_MASK_REASON_TEMPORARY);
+ } else
+- clear_evtchn(evtchn);
++ event_handler_exit(info);
+ }
+
+ static void mask_ack_dynirq(struct irq_data *data)
+@@ -1733,18 +1775,39 @@ static void mask_ack_dynirq(struct irq_data *data)
+ ack_dynirq(data);
+ }
+
++static void lateeoi_ack_dynirq(struct irq_data *data)
++{
++ struct irq_info *info = info_for_irq(data->irq);
++ evtchn_port_t evtchn = info ? info->evtchn : 0;
++
++ if (VALID_EVTCHN(evtchn)) {
++ do_mask(info, EVT_MASK_REASON_EOI_PENDING);
++ event_handler_exit(info);
++ }
++}
++
++static void lateeoi_mask_ack_dynirq(struct irq_data *data)
++{
++ struct irq_info *info = info_for_irq(data->irq);
++ evtchn_port_t evtchn = info ? info->evtchn : 0;
++
++ if (VALID_EVTCHN(evtchn)) {
++ do_mask(info, EVT_MASK_REASON_EXPLICIT);
++ event_handler_exit(info);
++ }
++}
++
+ static int retrigger_dynirq(struct irq_data *data)
+ {
+- unsigned int evtchn = evtchn_from_irq(data->irq);
+- int masked;
++ struct irq_info *info = info_for_irq(data->irq);
++ evtchn_port_t evtchn = info ? info->evtchn : 0;
+
+ if (!VALID_EVTCHN(evtchn))
+ return 0;
+
+- masked = test_and_set_mask(evtchn);
++ do_mask(info, EVT_MASK_REASON_TEMPORARY);
+ set_evtchn(evtchn);
+- if (!masked)
+- unmask_evtchn(evtchn);
++ do_unmask(info, EVT_MASK_REASON_TEMPORARY);
+
+ return 1;
+ }
+@@ -1839,10 +1902,11 @@ static void restore_cpu_ipis(unsigned int cpu)
+ /* Clear an irq's pending state, in preparation for polling on it */
+ void xen_clear_irq_pending(int irq)
+ {
+- int evtchn = evtchn_from_irq(irq);
++ struct irq_info *info = info_for_irq(irq);
++ evtchn_port_t evtchn = info ? info->evtchn : 0;
+
+ if (VALID_EVTCHN(evtchn))
+- clear_evtchn(evtchn);
++ event_handler_exit(info);
+ }
+ EXPORT_SYMBOL(xen_clear_irq_pending);
+ void xen_set_irq_pending(int irq)
+@@ -1950,8 +2014,8 @@ static struct irq_chip xen_lateeoi_chip __read_mostly = {
+ .irq_mask = disable_dynirq,
+ .irq_unmask = enable_dynirq,
+
+- .irq_ack = mask_ack_dynirq,
+- .irq_mask_ack = mask_ack_dynirq,
++ .irq_ack = lateeoi_ack_dynirq,
++ .irq_mask_ack = lateeoi_mask_ack_dynirq,
+
+ .irq_set_affinity = set_affinity_irq,
+ .irq_retrigger = retrigger_dynirq,
+diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
+index 33462521bfd0f..360a7f8cdf754 100644
+--- a/drivers/xen/events/events_fifo.c
++++ b/drivers/xen/events/events_fifo.c
+@@ -209,12 +209,6 @@ static bool evtchn_fifo_is_pending(unsigned port)
+ return sync_test_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
+ }
+
+-static bool evtchn_fifo_test_and_set_mask(unsigned port)
+-{
+- event_word_t *word = event_word_from_port(port);
+- return sync_test_and_set_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
+-}
+-
+ static void evtchn_fifo_mask(unsigned port)
+ {
+ event_word_t *word = event_word_from_port(port);
+@@ -420,7 +414,6 @@ static const struct evtchn_ops evtchn_ops_fifo = {
+ .clear_pending = evtchn_fifo_clear_pending,
+ .set_pending = evtchn_fifo_set_pending,
+ .is_pending = evtchn_fifo_is_pending,
+- .test_and_set_mask = evtchn_fifo_test_and_set_mask,
+ .mask = evtchn_fifo_mask,
+ .unmask = evtchn_fifo_unmask,
+ .handle_events = evtchn_fifo_handle_events,
+diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h
+index b9b4f59198930..3df6f28b75e69 100644
+--- a/drivers/xen/events/events_internal.h
++++ b/drivers/xen/events/events_internal.h
+@@ -35,13 +35,19 @@ struct irq_info {
+ struct list_head eoi_list;
+ short refcnt;
+ short spurious_cnt;
+- enum xen_irq_type type; /* type */
++ short type; /* type */
++ u8 mask_reason; /* Why is event channel masked */
++#define EVT_MASK_REASON_EXPLICIT 0x01
++#define EVT_MASK_REASON_TEMPORARY 0x02
++#define EVT_MASK_REASON_EOI_PENDING 0x04
++ u8 is_active; /* Is event just being handled? */
+ unsigned irq;
+ unsigned int evtchn; /* event channel */
+ unsigned short cpu; /* cpu bound */
+ unsigned short eoi_cpu; /* EOI must happen on this cpu */
+ unsigned int irq_epoch; /* If eoi_cpu valid: irq_epoch of event */
+ u64 eoi_time; /* Time in jiffies when to EOI. */
++ spinlock_t lock;
+
+ union {
+ unsigned short virq;
+@@ -67,12 +73,12 @@ struct evtchn_ops {
+ unsigned (*nr_channels)(void);
+
+ int (*setup)(struct irq_info *info);
++ void (*remove)(evtchn_port_t port, unsigned int cpu);
+ void (*bind_to_cpu)(struct irq_info *info, unsigned cpu);
+
+ void (*clear_pending)(unsigned port);
+ void (*set_pending)(unsigned port);
+ bool (*is_pending)(unsigned port);
+- bool (*test_and_set_mask)(unsigned port);
+ void (*mask)(unsigned port);
+ void (*unmask)(unsigned port);
+
+@@ -109,6 +115,13 @@ static inline int xen_evtchn_port_setup(struct irq_info *info)
+ return 0;
+ }
+
++static inline void xen_evtchn_port_remove(evtchn_port_t evtchn,
++ unsigned int cpu)
++{
++ if (evtchn_ops->remove)
++ evtchn_ops->remove(evtchn, cpu);
++}
++
+ static inline void xen_evtchn_port_bind_to_cpu(struct irq_info *info,
+ unsigned cpu)
+ {
+@@ -130,11 +143,6 @@ static inline bool test_evtchn(unsigned port)
+ return evtchn_ops->is_pending(port);
+ }
+
+-static inline bool test_and_set_mask(unsigned port)
+-{
+- return evtchn_ops->test_and_set_mask(port);
+-}
+-
+ static inline void mask_evtchn(unsigned port)
+ {
+ return evtchn_ops->mask(port);
+diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
+index aa4a7a23ff99d..27a04f4925416 100644
+--- a/fs/binfmt_misc.c
++++ b/fs/binfmt_misc.c
+@@ -694,12 +694,24 @@ static ssize_t bm_register_write(struct file *file, const char __user *buffer,
+ struct super_block *sb = file_inode(file)->i_sb;
+ struct dentry *root = sb->s_root, *dentry;
+ int err = 0;
++ struct file *f = NULL;
+
+ e = create_entry(buffer, count);
+
+ if (IS_ERR(e))
+ return PTR_ERR(e);
+
++ if (e->flags & MISC_FMT_OPEN_FILE) {
++ f = open_exec(e->interpreter);
++ if (IS_ERR(f)) {
++ pr_notice("register: failed to install interpreter file %s\n",
++ e->interpreter);
++ kfree(e);
++ return PTR_ERR(f);
++ }
++ e->interp_file = f;
++ }
++
+ inode_lock(d_inode(root));
+ dentry = lookup_one_len(e->name, root, strlen(e->name));
+ err = PTR_ERR(dentry);
+@@ -723,21 +735,6 @@ static ssize_t bm_register_write(struct file *file, const char __user *buffer,
+ goto out2;
+ }
+
+- if (e->flags & MISC_FMT_OPEN_FILE) {
+- struct file *f;
+-
+- f = open_exec(e->interpreter);
+- if (IS_ERR(f)) {
+- err = PTR_ERR(f);
+- pr_notice("register: failed to install interpreter file %s\n", e->interpreter);
+- simple_release_fs(&bm_mnt, &entry_count);
+- iput(inode);
+- inode = NULL;
+- goto out2;
+- }
+- e->interp_file = f;
+- }
+-
+ e->dentry = dget(dentry);
+ inode->i_private = e;
+ inode->i_fop = &bm_entry_operations;
+@@ -754,6 +751,8 @@ out:
+ inode_unlock(d_inode(root));
+
+ if (err) {
++ if (f)
++ filp_close(f, NULL);
+ kfree(e);
+ return err;
+ }
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index d5457015801d8..bc906fcf3f6db 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -229,7 +229,7 @@ cifs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ rc = server->ops->queryfs(xid, tcon, buf);
+
+ free_xid(xid);
+- return 0;
++ return rc;
+ }
+
+ static long cifs_fallocate(struct file *file, int mode, loff_t off, loff_t len)
+diff --git a/fs/configfs/file.c b/fs/configfs/file.c
+index bb0a427517e92..50b7c4c4310e0 100644
+--- a/fs/configfs/file.c
++++ b/fs/configfs/file.c
+@@ -392,7 +392,7 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type
+
+ attr = to_attr(dentry);
+ if (!attr)
+- goto out_put_item;
++ goto out_free_buffer;
+
+ if (type & CONFIGFS_ITEM_BIN_ATTR) {
+ buffer->bin_attr = to_bin_attr(dentry);
+@@ -405,7 +405,7 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type
+ /* Grab the module reference for this attribute if we have one */
+ error = -ENODEV;
+ if (!try_module_get(buffer->owner))
+- goto out_put_item;
++ goto out_free_buffer;
+
+ error = -EACCES;
+ if (!buffer->item->ci_type)
+@@ -449,8 +449,6 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type
+
+ out_put_module:
+ module_put(buffer->owner);
+-out_put_item:
+- config_item_put(buffer->item);
+ out_free_buffer:
+ up_read(&frag->frag_sem);
+ kfree(buffer);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index d89a815f7c31f..d63b248582d1a 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5611,7 +5611,7 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,
+ return ret;
+ if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
+ return -ENOENT;
+- return 0;
++ return label.len;
+ }
+
+ static int nfs4_get_security_label(struct inode *inode, void *buf,
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 3bf89a6338367..f5500d2a38797 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -540,11 +540,14 @@ static int udf_do_extend_file(struct inode *inode,
+
+ udf_write_aext(inode, last_pos, &last_ext->extLocation,
+ last_ext->extLength, 1);
++
+ /*
+- * We've rewritten the last extent but there may be empty
+- * indirect extent after it - enter it.
++ * We've rewritten the last extent. If we are going to add
++ * more extents, we may need to enter possible following
++ * empty indirect extent.
+ */
+- udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
++ if (new_block_bytes || prealloc_len)
++ udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
+ }
+
+ /* Managed to do everything necessary? */
+diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
+index a34694e675c9a..fd1ae79072503 100644
+--- a/include/linux/can/skb.h
++++ b/include/linux/can/skb.h
+@@ -49,8 +49,12 @@ static inline void can_skb_reserve(struct sk_buff *skb)
+
+ static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk)
+ {
+- if (sk) {
+- sock_hold(sk);
++ /* If the socket has already been closed by user space, the
++ * refcount may already be 0 (and the socket will be freed
++ * after the last TX skb has been freed). So only increase
++ * socket refcount if the refcount is > 0.
++ */
++ if (sk && refcount_inc_not_zero(&sk->sk_refcnt)) {
+ skb->destructor = sock_efree;
+ skb->sk = sk;
+ }
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 9770e08c7e029..ca5f053c6b66a 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -274,6 +274,7 @@ struct header_ops {
+ const struct net_device *dev,
+ const unsigned char *haddr);
+ bool (*validate)(const char *ll_header, unsigned int len);
++ __be16 (*parse_protocol)(const struct sk_buff *skb);
+ };
+
+ /* These flag bits are private to the generic network queueing
+@@ -2895,6 +2896,15 @@ static inline int dev_parse_header(const struct sk_buff *skb,
+ return dev->header_ops->parse(skb, haddr);
+ }
+
++static inline __be16 dev_parse_header_protocol(const struct sk_buff *skb)
++{
++ const struct net_device *dev = skb->dev;
++
++ if (!dev->header_ops || !dev->header_ops->parse_protocol)
++ return 0;
++ return dev->header_ops->parse_protocol(skb);
++}
++
+ /* ll_header must have at least hard_header_len allocated */
+ static inline bool dev_validate_header(const struct net_device *dev,
+ char *ll_header, int len)
+diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
+index 8d3b7e731b742..ef54f4b3f1e44 100644
+--- a/include/linux/sched/mm.h
++++ b/include/linux/sched/mm.h
+@@ -167,7 +167,8 @@ static inline bool in_vfork(struct task_struct *tsk)
+ * another oom-unkillable task does this it should blame itself.
+ */
+ rcu_read_lock();
+- ret = tsk->vfork_done && tsk->real_parent->mm == tsk->mm;
++ ret = tsk->vfork_done &&
++ rcu_dereference(tsk->real_parent)->mm == tsk->mm;
+ rcu_read_unlock();
+
+ return ret;
+diff --git a/include/linux/stop_machine.h b/include/linux/stop_machine.h
+index 6d3635c86dbeb..ccdaa8fd5657f 100644
+--- a/include/linux/stop_machine.h
++++ b/include/linux/stop_machine.h
+@@ -138,7 +138,7 @@ int stop_machine_from_inactive_cpu(cpu_stop_fn_t fn, void *data,
+ const struct cpumask *cpus);
+ #else /* CONFIG_SMP || CONFIG_HOTPLUG_CPU */
+
+-static inline int stop_machine_cpuslocked(cpu_stop_fn_t fn, void *data,
++static __always_inline int stop_machine_cpuslocked(cpu_stop_fn_t fn, void *data,
+ const struct cpumask *cpus)
+ {
+ unsigned long flags;
+@@ -149,14 +149,15 @@ static inline int stop_machine_cpuslocked(cpu_stop_fn_t fn, void *data,
+ return ret;
+ }
+
+-static inline int stop_machine(cpu_stop_fn_t fn, void *data,
+- const struct cpumask *cpus)
++static __always_inline int
++stop_machine(cpu_stop_fn_t fn, void *data, const struct cpumask *cpus)
+ {
+ return stop_machine_cpuslocked(fn, data, cpus);
+ }
+
+-static inline int stop_machine_from_inactive_cpu(cpu_stop_fn_t fn, void *data,
+- const struct cpumask *cpus)
++static __always_inline int
++stop_machine_from_inactive_cpu(cpu_stop_fn_t fn, void *data,
++ const struct cpumask *cpus)
+ {
+ return stop_machine(fn, data, cpus);
+ }
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index f32fe7080d2ec..98e7716e03413 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -79,8 +79,13 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ if (gso_type && skb->network_header) {
+ struct flow_keys_basic keys;
+
+- if (!skb->protocol)
++ if (!skb->protocol) {
++ __be16 protocol = dev_parse_header_protocol(skb);
++
+ virtio_net_hdr_set_proto(skb, hdr);
++ if (protocol && protocol != skb->protocol)
++ return -EINVAL;
++ }
+ retry:
+ if (!skb_flow_dissect_flow_keys_basic(skb, &keys,
+ NULL, 0, 0, 0,
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 4fe3ab47b4803..3f0d654984cf4 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1880,7 +1880,7 @@ static inline u32 tcp_notsent_lowat(const struct tcp_sock *tp)
+ static inline bool tcp_stream_memory_free(const struct sock *sk)
+ {
+ const struct tcp_sock *tp = tcp_sk(sk);
+- u32 notsent_bytes = tp->write_seq - tp->snd_nxt;
++ u32 notsent_bytes = READ_ONCE(tp->write_seq) - tp->snd_nxt;
+
+ return notsent_bytes < tcp_notsent_lowat(tp);
+ }
+diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
+index 51b6f50eabeeb..0deeff9b4496a 100644
+--- a/include/target/target_core_backend.h
++++ b/include/target/target_core_backend.h
+@@ -69,6 +69,7 @@ int transport_backend_register(const struct target_backend_ops *);
+ void target_backend_unregister(const struct target_backend_ops *);
+
+ void target_complete_cmd(struct se_cmd *, u8);
++void target_set_cmd_data_length(struct se_cmd *, int);
+ void target_complete_cmd_with_length(struct se_cmd *, u8, int);
+
+ void transport_copy_sense_to_cmd(struct se_cmd *, unsigned char *);
+diff --git a/include/uapi/linux/netfilter/nfnetlink_cthelper.h b/include/uapi/linux/netfilter/nfnetlink_cthelper.h
+index a13137afc4299..70af02092d16e 100644
+--- a/include/uapi/linux/netfilter/nfnetlink_cthelper.h
++++ b/include/uapi/linux/netfilter/nfnetlink_cthelper.h
+@@ -5,7 +5,7 @@
+ #define NFCT_HELPER_STATUS_DISABLED 0
+ #define NFCT_HELPER_STATUS_ENABLED 1
+
+-enum nfnl_acct_msg_types {
++enum nfnl_cthelper_msg_types {
+ NFNL_MSG_CTHELPER_NEW,
+ NFNL_MSG_CTHELPER_GET,
+ NFNL_MSG_CTHELPER_DEL,
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index 7362554416fd7..ccde4dc8462cc 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -536,8 +536,11 @@ static ktime_t __hrtimer_next_event_base(struct hrtimer_cpu_base *cpu_base,
+ }
+
+ /*
+- * Recomputes cpu_base::*next_timer and returns the earliest expires_next but
+- * does not set cpu_base::*expires_next, that is done by hrtimer_reprogram.
++ * Recomputes cpu_base::*next_timer and returns the earliest expires_next
++ * but does not set cpu_base::*expires_next, that is done by
++ * hrtimer[_force]_reprogram and hrtimer_interrupt only. When updating
++ * cpu_base::*expires_next right away, reprogramming logic would no longer
++ * work.
+ *
+ * When a softirq is pending, we can ignore the HRTIMER_ACTIVE_SOFT bases,
+ * those timers will get run whenever the softirq gets handled, at the end of
+@@ -578,6 +581,37 @@ __hrtimer_get_next_event(struct hrtimer_cpu_base *cpu_base, unsigned int active_
+ return expires_next;
+ }
+
++static ktime_t hrtimer_update_next_event(struct hrtimer_cpu_base *cpu_base)
++{
++ ktime_t expires_next, soft = KTIME_MAX;
++
++ /*
++ * If the soft interrupt has already been activated, ignore the
++ * soft bases. They will be handled in the already raised soft
++ * interrupt.
++ */
++ if (!cpu_base->softirq_activated) {
++ soft = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_SOFT);
++ /*
++ * Update the soft expiry time. clock_settime() might have
++ * affected it.
++ */
++ cpu_base->softirq_expires_next = soft;
++ }
++
++ expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_HARD);
++ /*
++ * If a softirq timer is expiring first, update cpu_base->next_timer
++ * and program the hardware with the soft expiry time.
++ */
++ if (expires_next > soft) {
++ cpu_base->next_timer = cpu_base->softirq_next_timer;
++ expires_next = soft;
++ }
++
++ return expires_next;
++}
++
+ static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base)
+ {
+ ktime_t *offs_real = &base->clock_base[HRTIMER_BASE_REALTIME].offset;
+@@ -618,23 +652,7 @@ hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal)
+ {
+ ktime_t expires_next;
+
+- /*
+- * Find the current next expiration time.
+- */
+- expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_ALL);
+-
+- if (cpu_base->next_timer && cpu_base->next_timer->is_soft) {
+- /*
+- * When the softirq is activated, hrtimer has to be
+- * programmed with the first hard hrtimer because soft
+- * timer interrupt could occur too late.
+- */
+- if (cpu_base->softirq_activated)
+- expires_next = __hrtimer_get_next_event(cpu_base,
+- HRTIMER_ACTIVE_HARD);
+- else
+- cpu_base->softirq_expires_next = expires_next;
+- }
++ expires_next = hrtimer_update_next_event(cpu_base);
+
+ if (skip_equal && expires_next == cpu_base->expires_next)
+ return;
+@@ -1520,8 +1538,8 @@ retry:
+
+ __hrtimer_run_queues(cpu_base, now, flags, HRTIMER_ACTIVE_HARD);
+
+- /* Reevaluate the clock bases for the next expiry */
+- expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_ALL);
++ /* Reevaluate the clock bases for the [soft] next expiry */
++ expires_next = hrtimer_update_next_event(cpu_base);
+ /*
+ * Store the new expiry value so the migration code can verify
+ * against it.
+diff --git a/lib/logic_pio.c b/lib/logic_pio.c
+index 905027574e5d8..774bb02fff10a 100644
+--- a/lib/logic_pio.c
++++ b/lib/logic_pio.c
+@@ -27,6 +27,8 @@ static DEFINE_MUTEX(io_range_mutex);
+ * @new_range: pointer to the IO range to be registered.
+ *
+ * Returns 0 on success, the error code in case of failure.
++ * If the range already exists, -EEXIST will be returned, which should be
++ * considered a success.
+ *
+ * Register a new IO range node in the IO range list.
+ */
+@@ -49,6 +51,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
+ list_for_each_entry(range, &io_range_list, list) {
+ if (range->fwnode == new_range->fwnode) {
+ /* range already there */
++ ret = -EEXIST;
+ goto end_register;
+ }
+ if (range->flags == LOGIC_PIO_CPU_MMIO &&
+diff --git a/mm/slub.c b/mm/slub.c
+index eac80b0516fe8..da141e5974f2b 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1830,7 +1830,7 @@ static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n,
+
+ t = acquire_slab(s, n, page, object == NULL, &objects);
+ if (!t)
+- continue; /* cmpxchg raced */
++ break;
+
+ available += objects;
+ if (!object) {
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index 5535b722f66d6..6a1b52b34e205 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -533,16 +533,10 @@ int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info)
+ ret_val = -ENOENT;
+ goto doi_remove_return;
+ }
+- if (!refcount_dec_and_test(&doi_def->refcount)) {
+- spin_unlock(&cipso_v4_doi_list_lock);
+- ret_val = -EBUSY;
+- goto doi_remove_return;
+- }
+ list_del_rcu(&doi_def->list);
+ spin_unlock(&cipso_v4_doi_list_lock);
+
+- cipso_v4_cache_invalidate();
+- call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
++ cipso_v4_doi_putdef(doi_def);
+ ret_val = 0;
+
+ doi_remove_return:
+@@ -599,9 +593,6 @@ void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def)
+
+ if (!refcount_dec_and_test(&doi_def->refcount))
+ return;
+- spin_lock(&cipso_v4_doi_list_lock);
+- list_del_rcu(&doi_def->list);
+- spin_unlock(&cipso_v4_doi_list_lock);
+
+ cipso_v4_cache_invalidate();
+ call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 98e8ee8bb7593..769e1f683471a 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -567,7 +567,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ (state != TCP_SYN_RECV || tp->fastopen_rsk)) {
+ int target = sock_rcvlowat(sk, 0, INT_MAX);
+
+- if (tp->urg_seq == tp->copied_seq &&
++ if (tp->urg_seq == READ_ONCE(tp->copied_seq) &&
+ !sock_flag(sk, SOCK_URGINLINE) &&
+ tp->urg_data)
+ target++;
+@@ -628,7 +628,7 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
+ unlock_sock_fast(sk, slow);
+ break;
+ case SIOCATMARK:
+- answ = tp->urg_data && tp->urg_seq == tp->copied_seq;
++ answ = tp->urg_data && tp->urg_seq == READ_ONCE(tp->copied_seq);
+ break;
+ case SIOCOUTQ:
+ if (sk->sk_state == TCP_LISTEN)
+@@ -637,7 +637,7 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
+ if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))
+ answ = 0;
+ else
+- answ = tp->write_seq - tp->snd_una;
++ answ = READ_ONCE(tp->write_seq) - tp->snd_una;
+ break;
+ case SIOCOUTQNSD:
+ if (sk->sk_state == TCP_LISTEN)
+@@ -646,7 +646,7 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
+ if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))
+ answ = 0;
+ else
+- answ = tp->write_seq - tp->snd_nxt;
++ answ = READ_ONCE(tp->write_seq) - tp->snd_nxt;
+ break;
+ default:
+ return -ENOIOCTLCMD;
+@@ -1037,7 +1037,7 @@ new_segment:
+ sk->sk_wmem_queued += copy;
+ sk_mem_charge(sk, copy);
+ skb->ip_summed = CHECKSUM_PARTIAL;
+- tp->write_seq += copy;
++ WRITE_ONCE(tp->write_seq, tp->write_seq + copy);
+ TCP_SKB_CB(skb)->end_seq += copy;
+ tcp_skb_pcount_set(skb, 0);
+
+@@ -1391,7 +1391,7 @@ new_segment:
+ if (!copied)
+ TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_PSH;
+
+- tp->write_seq += copy;
++ WRITE_ONCE(tp->write_seq, tp->write_seq + copy);
+ TCP_SKB_CB(skb)->end_seq += copy;
+ tcp_skb_pcount_set(skb, 0);
+
+@@ -1696,9 +1696,9 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
+ sk_eat_skb(sk, skb);
+ if (!desc->count)
+ break;
+- tp->copied_seq = seq;
++ WRITE_ONCE(tp->copied_seq, seq);
+ }
+- tp->copied_seq = seq;
++ WRITE_ONCE(tp->copied_seq, seq);
+
+ tcp_rcv_space_adjust(sk);
+
+@@ -1835,7 +1835,7 @@ static int tcp_zerocopy_receive(struct sock *sk,
+ out:
+ up_read(¤t->mm->mmap_sem);
+ if (length) {
+- tp->copied_seq = seq;
++ WRITE_ONCE(tp->copied_seq, seq);
+ tcp_rcv_space_adjust(sk);
+
+ /* Clean up data we have read: This will do ACK frames. */
+@@ -2112,7 +2112,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
+ if (urg_offset < used) {
+ if (!urg_offset) {
+ if (!sock_flag(sk, SOCK_URGINLINE)) {
+- ++*seq;
++ WRITE_ONCE(*seq, *seq + 1);
+ urg_hole++;
+ offset++;
+ used--;
+@@ -2134,7 +2134,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
+ }
+ }
+
+- *seq += used;
++ WRITE_ONCE(*seq, *seq + used);
+ copied += used;
+ len -= used;
+
+@@ -2163,7 +2163,7 @@ skip_copy:
+
+ found_fin_ok:
+ /* Process the FIN. */
+- ++*seq;
++ WRITE_ONCE(*seq, *seq + 1);
+ if (!(flags & MSG_PEEK))
+ sk_eat_skb(sk, skb);
+ break;
+@@ -2556,6 +2556,7 @@ int tcp_disconnect(struct sock *sk, int flags)
+ struct inet_connection_sock *icsk = inet_csk(sk);
+ struct tcp_sock *tp = tcp_sk(sk);
+ int old_state = sk->sk_state;
++ u32 seq;
+
+ if (old_state != TCP_CLOSE)
+ tcp_set_state(sk, TCP_CLOSE);
+@@ -2578,7 +2579,7 @@ int tcp_disconnect(struct sock *sk, int flags)
+
+ tcp_clear_xmit_timers(sk);
+ __skb_queue_purge(&sk->sk_receive_queue);
+- tp->copied_seq = tp->rcv_nxt;
++ WRITE_ONCE(tp->copied_seq, tp->rcv_nxt);
+ tp->urg_data = 0;
+ tcp_write_queue_purge(sk);
+ tcp_fastopen_active_disable_ofo_check(sk);
+@@ -2593,9 +2594,12 @@ int tcp_disconnect(struct sock *sk, int flags)
+ sock_reset_flag(sk, SOCK_DONE);
+ tp->srtt_us = 0;
+ tp->rcv_rtt_last_tsecr = 0;
+- tp->write_seq += tp->max_window + 2;
+- if (tp->write_seq == 0)
+- tp->write_seq = 1;
++
++ seq = tp->write_seq + tp->max_window + 2;
++ if (!seq)
++ seq = 1;
++ WRITE_ONCE(tp->write_seq, seq);
++
+ tp->snd_cwnd = 2;
+ icsk->icsk_probes_out = 0;
+ tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+@@ -2882,16 +2886,23 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ break;
+
+ case TCP_QUEUE_SEQ:
+- if (sk->sk_state != TCP_CLOSE)
++ if (sk->sk_state != TCP_CLOSE) {
+ err = -EPERM;
+- else if (tp->repair_queue == TCP_SEND_QUEUE)
+- tp->write_seq = val;
+- else if (tp->repair_queue == TCP_RECV_QUEUE) {
+- WRITE_ONCE(tp->rcv_nxt, val);
+- WRITE_ONCE(tp->copied_seq, val);
+- }
+- else
++ } else if (tp->repair_queue == TCP_SEND_QUEUE) {
++ if (!tcp_rtx_queue_empty(sk))
++ err = -EPERM;
++ else
++ WRITE_ONCE(tp->write_seq, val);
++ } else if (tp->repair_queue == TCP_RECV_QUEUE) {
++ if (tp->rcv_nxt != tp->copied_seq) {
++ err = -EPERM;
++ } else {
++ WRITE_ONCE(tp->rcv_nxt, val);
++ WRITE_ONCE(tp->copied_seq, val);
++ }
++ } else {
+ err = -EINVAL;
++ }
+ break;
+
+ case TCP_REPAIR_OPTIONS:
+diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
+index c9e97f304f984..2a46f9f81ba09 100644
+--- a/net/ipv4/tcp_diag.c
++++ b/net/ipv4/tcp_diag.c
+@@ -30,8 +30,9 @@ static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
+ } else if (sk->sk_type == SOCK_STREAM) {
+ const struct tcp_sock *tp = tcp_sk(sk);
+
+- r->idiag_rqueue = max_t(int, READ_ONCE(tp->rcv_nxt) - tp->copied_seq, 0);
+- r->idiag_wqueue = tp->write_seq - tp->snd_una;
++ r->idiag_rqueue = max_t(int, READ_ONCE(tp->rcv_nxt) -
++ READ_ONCE(tp->copied_seq), 0);
++ r->idiag_wqueue = READ_ONCE(tp->write_seq) - tp->snd_una;
+ }
+ if (info)
+ tcp_get_info(sk, info);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 5ffc85c8952a0..36bff9291530b 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -5889,7 +5889,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
+ /* Remember, tcp_poll() does not lock socket!
+ * Change state from SYN-SENT only after copied_seq
+ * is initialized. */
+- tp->copied_seq = tp->rcv_nxt;
++ WRITE_ONCE(tp->copied_seq, tp->rcv_nxt);
+
+ smc_check_reset_syn(tp);
+
+@@ -5964,7 +5964,7 @@ discard:
+ }
+
+ WRITE_ONCE(tp->rcv_nxt, TCP_SKB_CB(skb)->seq + 1);
+- tp->copied_seq = tp->rcv_nxt;
++ WRITE_ONCE(tp->copied_seq, tp->rcv_nxt);
+ tp->rcv_wup = TCP_SKB_CB(skb)->seq + 1;
+
+ /* RFC1323: The window in SYN & SYN/ACK segments is
+@@ -6126,7 +6126,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
+ tcp_rearm_rto(sk);
+ } else {
+ tcp_init_transfer(sk, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB);
+- tp->copied_seq = tp->rcv_nxt;
++ WRITE_ONCE(tp->copied_seq, tp->rcv_nxt);
+ }
+ smp_mb();
+ tcp_set_state(sk, TCP_ESTABLISHED);
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 7536f4c0bbf4f..ac6135555e24a 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -169,9 +169,11 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
+ * without appearing to create any others.
+ */
+ if (likely(!tp->repair)) {
+- tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
+- if (tp->write_seq == 0)
+- tp->write_seq = 1;
++ u32 seq = tcptw->tw_snd_nxt + 65535 + 2;
++
++ if (!seq)
++ seq = 1;
++ WRITE_ONCE(tp->write_seq, seq);
+ tp->rx_opt.ts_recent = tcptw->tw_ts_recent;
+ tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
+ }
+@@ -258,7 +260,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ tp->rx_opt.ts_recent = 0;
+ tp->rx_opt.ts_recent_stamp = 0;
+ if (likely(!tp->repair))
+- tp->write_seq = 0;
++ WRITE_ONCE(tp->write_seq, 0);
+ }
+
+ inet->inet_dport = usin->sin_port;
+@@ -296,10 +298,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+
+ if (likely(!tp->repair)) {
+ if (!tp->write_seq)
+- tp->write_seq = secure_tcp_seq(inet->inet_saddr,
+- inet->inet_daddr,
+- inet->inet_sport,
+- usin->sin_port);
++ WRITE_ONCE(tp->write_seq,
++ secure_tcp_seq(inet->inet_saddr,
++ inet->inet_daddr,
++ inet->inet_sport,
++ usin->sin_port));
+ tp->tsoffset = secure_tcp_ts_off(sock_net(sk),
+ inet->inet_saddr,
+ inet->inet_daddr);
+@@ -2340,12 +2343,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
+ * we might find a transient negative value.
+ */
+ rx_queue = max_t(int, READ_ONCE(tp->rcv_nxt) -
+- tp->copied_seq, 0);
++ READ_ONCE(tp->copied_seq), 0);
+
+ seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
+ "%08X %5u %8d %lu %d %pK %lu %lu %u %u %d",
+ i, src, srcp, dest, destp, state,
+- tp->write_seq - tp->snd_una,
++ READ_ONCE(tp->write_seq) - tp->snd_una,
+ rx_queue,
+ timer_active,
+ jiffies_delta_to_clock_t(timer_expires - jiffies),
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 7ba8a90772b0a..9436fb9b6a3d3 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -470,7 +470,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
+
+ seq = treq->rcv_isn + 1;
+ newtp->rcv_wup = seq;
+- newtp->copied_seq = seq;
++ WRITE_ONCE(newtp->copied_seq, seq);
+ WRITE_ONCE(newtp->rcv_nxt, seq);
+ newtp->segs_in = 1;
+
+@@ -510,7 +510,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
+ newtp->app_limited = ~0U;
+
+ tcp_init_xmit_timers(newsk);
+- newtp->write_seq = newtp->pushed_seq = treq->snt_isn + 1;
++ WRITE_ONCE(newtp->write_seq, newtp->pushed_seq = treq->snt_isn + 1);
+
+ newtp->rx_opt.saw_tstamp = 0;
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 3cfefec819758..9b74041e8dd10 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1175,7 +1175,7 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
+ struct tcp_sock *tp = tcp_sk(sk);
+
+ /* Advance write_seq and place onto the write_queue. */
+- tp->write_seq = TCP_SKB_CB(skb)->end_seq;
++ WRITE_ONCE(tp->write_seq, TCP_SKB_CB(skb)->end_seq);
+ __skb_header_release(skb);
+ tcp_add_write_queue_tail(sk, skb);
+ sk->sk_wmem_queued += skb->truesize;
+@@ -3381,7 +3381,7 @@ static void tcp_connect_init(struct sock *sk)
+ else
+ tp->rcv_tstamp = tcp_jiffies32;
+ tp->rcv_wup = tp->rcv_nxt;
+- tp->copied_seq = tp->rcv_nxt;
++ WRITE_ONCE(tp->copied_seq, tp->rcv_nxt);
+
+ inet_csk(sk)->icsk_rto = tcp_timeout_init(sk);
+ inet_csk(sk)->icsk_retransmits = 0;
+@@ -3397,7 +3397,7 @@ static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb)
+ __skb_header_release(skb);
+ sk->sk_wmem_queued += skb->truesize;
+ sk_mem_charge(sk, skb->truesize);
+- tp->write_seq = tcb->end_seq;
++ WRITE_ONCE(tp->write_seq, tcb->end_seq);
+ tp->packets_out += tcp_skb_pcount(skb);
+ }
+
+diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
+index aa343654abfc0..2d22d39952da8 100644
+--- a/net/ipv4/udp_offload.c
++++ b/net/ipv4/udp_offload.c
+@@ -359,7 +359,7 @@ struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb,
+ struct sock *sk;
+
+ if (NAPI_GRO_CB(skb)->encap_mark ||
+- (skb->ip_summed != CHECKSUM_PARTIAL &&
++ (uh->check && skb->ip_summed != CHECKSUM_PARTIAL &&
+ NAPI_GRO_CB(skb)->csum_cnt == 0 &&
+ !NAPI_GRO_CB(skb)->csum_valid))
+ goto out;
+diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
+index 70611784c071f..afc76062e1a11 100644
+--- a/net/ipv6/calipso.c
++++ b/net/ipv6/calipso.c
+@@ -97,6 +97,9 @@ struct calipso_map_cache_entry {
+
+ static struct calipso_map_cache_bkt *calipso_cache;
+
++static void calipso_cache_invalidate(void);
++static void calipso_doi_putdef(struct calipso_doi *doi_def);
++
+ /* Label Mapping Cache Functions
+ */
+
+@@ -458,15 +461,10 @@ static int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info)
+ ret_val = -ENOENT;
+ goto doi_remove_return;
+ }
+- if (!refcount_dec_and_test(&doi_def->refcount)) {
+- spin_unlock(&calipso_doi_list_lock);
+- ret_val = -EBUSY;
+- goto doi_remove_return;
+- }
+ list_del_rcu(&doi_def->list);
+ spin_unlock(&calipso_doi_list_lock);
+
+- call_rcu(&doi_def->rcu, calipso_doi_free_rcu);
++ calipso_doi_putdef(doi_def);
+ ret_val = 0;
+
+ doi_remove_return:
+@@ -522,10 +520,8 @@ static void calipso_doi_putdef(struct calipso_doi *doi_def)
+
+ if (!refcount_dec_and_test(&doi_def->refcount))
+ return;
+- spin_lock(&calipso_doi_list_lock);
+- list_del_rcu(&doi_def->list);
+- spin_unlock(&calipso_doi_list_lock);
+
++ calipso_cache_invalidate();
+ call_rcu(&doi_def->rcu, calipso_doi_free_rcu);
+ }
+
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 2e76ebfdc907d..6e84f2eb08d64 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -206,7 +206,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+ !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
+ tp->rx_opt.ts_recent = 0;
+ tp->rx_opt.ts_recent_stamp = 0;
+- tp->write_seq = 0;
++ WRITE_ONCE(tp->write_seq, 0);
+ }
+
+ sk->sk_v6_daddr = usin->sin6_addr;
+@@ -304,10 +304,11 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+
+ if (likely(!tp->repair)) {
+ if (!tp->write_seq)
+- tp->write_seq = secure_tcpv6_seq(np->saddr.s6_addr32,
+- sk->sk_v6_daddr.s6_addr32,
+- inet->inet_sport,
+- inet->inet_dport);
++ WRITE_ONCE(tp->write_seq,
++ secure_tcpv6_seq(np->saddr.s6_addr32,
++ sk->sk_v6_daddr.s6_addr32,
++ inet->inet_sport,
++ inet->inet_dport));
+ tp->tsoffset = secure_tcpv6_ts_off(sock_net(sk),
+ np->saddr.s6_addr32,
+ sk->sk_v6_daddr.s6_addr32);
+@@ -1839,7 +1840,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
+ * we might find a transient negative value.
+ */
+ rx_queue = max_t(int, READ_ONCE(tp->rcv_nxt) -
+- tp->copied_seq, 0);
++ READ_ONCE(tp->copied_seq), 0);
+
+ seq_printf(seq,
+ "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
+@@ -1850,7 +1851,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
+ dest->s6_addr32[0], dest->s6_addr32[1],
+ dest->s6_addr32[2], dest->s6_addr32[3], destp,
+ state,
+- tp->write_seq - tp->snd_una,
++ READ_ONCE(tp->write_seq) - tp->snd_una,
+ rx_queue,
+ timer_active,
+ jiffies_delta_to_clock_t(timer_expires - jiffies),
+diff --git a/net/mpls/mpls_gso.c b/net/mpls/mpls_gso.c
+index b4da6d8e8632c..2129856b59330 100644
+--- a/net/mpls/mpls_gso.c
++++ b/net/mpls/mpls_gso.c
+@@ -18,6 +18,7 @@
+ #include <linux/netdev_features.h>
+ #include <linux/netdevice.h>
+ #include <linux/skbuff.h>
++#include <net/mpls.h>
+
+ static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
+ netdev_features_t features)
+@@ -31,6 +32,8 @@ static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
+
+ skb_reset_network_header(skb);
+ mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb);
++ if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN))
++ goto out;
+ if (unlikely(!pskb_may_pull(skb, mpls_hlen)))
+ goto out;
+
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index 6a7d0303d058f..1314de5f317f0 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -335,6 +335,7 @@ static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
+ const struct xt_match *m;
+ int have_rev = 0;
+
++ mutex_lock(&xt[af].mutex);
+ list_for_each_entry(m, &xt[af].match, list) {
+ if (strcmp(m->name, name) == 0) {
+ if (m->revision > *bestp)
+@@ -343,6 +344,7 @@ static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
+ have_rev = 1;
+ }
+ }
++ mutex_unlock(&xt[af].mutex);
+
+ if (af != NFPROTO_UNSPEC && !have_rev)
+ return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
+@@ -355,6 +357,7 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
+ const struct xt_target *t;
+ int have_rev = 0;
+
++ mutex_lock(&xt[af].mutex);
+ list_for_each_entry(t, &xt[af].target, list) {
+ if (strcmp(t->name, name) == 0) {
+ if (t->revision > *bestp)
+@@ -363,6 +366,7 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
+ have_rev = 1;
+ }
+ }
++ mutex_unlock(&xt[af].mutex);
+
+ if (af != NFPROTO_UNSPEC && !have_rev)
+ return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
+@@ -376,12 +380,10 @@ int xt_find_revision(u8 af, const char *name, u8 revision, int target,
+ {
+ int have_rev, best = -1;
+
+- mutex_lock(&xt[af].mutex);
+ if (target == 1)
+ have_rev = target_revfn(af, name, revision, &best);
+ else
+ have_rev = match_revfn(af, name, revision, &best);
+- mutex_unlock(&xt[af].mutex);
+
+ /* Nothing at all? Return 0 to try loading module. */
+ if (best == -1) {
+diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
+index 9aacf2da3d98f..3e3494c8d42f8 100644
+--- a/net/netlabel/netlabel_cipso_v4.c
++++ b/net/netlabel/netlabel_cipso_v4.c
+@@ -581,6 +581,7 @@ list_start:
+
+ break;
+ }
++ cipso_v4_doi_putdef(doi_def);
+ rcu_read_unlock();
+
+ genlmsg_end(ans_skb, data);
+@@ -589,12 +590,14 @@ list_start:
+ list_retry:
+ /* XXX - this limit is a guesstimate */
+ if (nlsze_mult < 4) {
++ cipso_v4_doi_putdef(doi_def);
+ rcu_read_unlock();
+ kfree_skb(ans_skb);
+ nlsze_mult *= 2;
+ goto list_start;
+ }
+ list_failure_lock:
++ cipso_v4_doi_putdef(doi_def);
+ rcu_read_unlock();
+ list_failure:
+ kfree_skb(ans_skb);
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 69cf9cbbb05f6..8f3e1f0a1781d 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -797,8 +797,10 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ plen = (len + 3) & ~3;
+ skb = sock_alloc_send_skb(sk, plen + QRTR_HDR_MAX_SIZE,
+ msg->msg_flags & MSG_DONTWAIT, &rc);
+- if (!skb)
++ if (!skb) {
++ rc = -ENOMEM;
+ goto out_node;
++ }
+
+ skb_reserve(skb, QRTR_HDR_MAX_SIZE);
+
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index ed065c3432e5f..1f12be9f02070 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -2048,7 +2048,7 @@ static int tc_dump_tclass_qdisc(struct Qdisc *q, struct sk_buff *skb,
+
+ static int tc_dump_tclass_root(struct Qdisc *root, struct sk_buff *skb,
+ struct tcmsg *tcm, struct netlink_callback *cb,
+- int *t_p, int s_t)
++ int *t_p, int s_t, bool recur)
+ {
+ struct Qdisc *q;
+ int b;
+@@ -2059,7 +2059,7 @@ static int tc_dump_tclass_root(struct Qdisc *root, struct sk_buff *skb,
+ if (tc_dump_tclass_qdisc(root, skb, tcm, cb, t_p, s_t) < 0)
+ return -1;
+
+- if (!qdisc_dev(root))
++ if (!qdisc_dev(root) || !recur)
+ return 0;
+
+ if (tcm->tcm_parent) {
+@@ -2094,13 +2094,13 @@ static int tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb)
+ s_t = cb->args[0];
+ t = 0;
+
+- if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t) < 0)
++ if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t, true) < 0)
+ goto done;
+
+ dev_queue = dev_ingress_queue(dev);
+ if (dev_queue &&
+ tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb,
+- &t, s_t) < 0)
++ &t, s_t, false) < 0)
+ goto done;
+
+ done:
+diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
+index 3b0dcf38fd8b0..d3e61dcc61295 100644
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -401,7 +401,7 @@ static uint32_t (*w2)(uint16_t);
+ static int
+ is_mcounted_section_name(char const *const txtname)
+ {
+- return strcmp(".text", txtname) == 0 ||
++ return strncmp(".text", txtname, 5) == 0 ||
+ strcmp(".init.text", txtname) == 0 ||
+ strcmp(".ref.text", txtname) == 0 ||
+ strcmp(".sched.text", txtname) == 0 ||
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index 7f6f96256b09f..9a8fe8ea6b037 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -142,6 +142,11 @@ my %text_sections = (
+ ".text.unlikely" => 1,
+ );
+
++# Acceptable section-prefixes to record.
++my %text_section_prefixes = (
++ ".text." => 1,
++);
++
+ # Note: we are nice to C-programmers here, thus we skip the '||='-idiom.
+ $objdump = 'objdump' if (!$objdump);
+ $objcopy = 'objcopy' if (!$objcopy);
+@@ -523,6 +528,14 @@ while (<IN>) {
+
+ # Only record text sections that we know are safe
+ $read_function = defined($text_sections{$1});
++ if (!$read_function) {
++ foreach my $prefix (keys %text_section_prefixes) {
++ if (substr($1, 0, length $prefix) eq $prefix) {
++ $read_function = 1;
++ last;
++ }
++ }
++ }
+ # print out any recorded offsets
+ update_funcs();
+
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 1bc40e78fa7ff..a1dee0ab345a2 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -506,8 +506,7 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
+ __u32 magic, nsmagic;
+ struct inode *inode = d_backing_inode(dentry);
+ struct user_namespace *task_ns = current_user_ns(),
+- *fs_ns = inode->i_sb->s_user_ns,
+- *ancestor;
++ *fs_ns = inode->i_sb->s_user_ns;
+ kuid_t rootid;
+ size_t newsize;
+
+@@ -530,15 +529,6 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
+ if (nsrootid == -1)
+ return -EINVAL;
+
+- /*
+- * Do not allow allow adding a v3 filesystem capability xattr
+- * if the rootid field is ambiguous.
+- */
+- for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) {
+- if (from_kuid(ancestor, rootid) == 0)
+- return -EINVAL;
+- }
+-
+ newsize = sizeof(struct vfs_ns_cap_data);
+ nscap = kmalloc(newsize, GFP_ATOMIC);
+ if (!nscap)
+diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
+index c175b2cf63f77..66010d0774b43 100644
+--- a/sound/pci/hda/hda_bind.c
++++ b/sound/pci/hda/hda_bind.c
+@@ -46,6 +46,10 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev)
+ if (codec->bus->shutdown)
+ return;
+
++ /* ignore unsol events during system suspend/resume */
++ if (codec->core.dev.power.power_state.event != PM_EVENT_ON)
++ return;
++
+ if (codec->patch_ops.unsol_event)
+ codec->patch_ops.unsol_event(codec, ev);
+ }
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index 8198d2e53b7df..0c5d41e5d1468 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -624,13 +624,6 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
+ 20,
+ 178000000);
+
+- /* by some reason, the playback stream stalls on PulseAudio with
+- * tsched=1 when a capture stream triggers. Until we figure out the
+- * real cause, disable tsched mode by telling the PCM info flag.
+- */
+- if (chip->driver_caps & AZX_DCAPS_AMD_WORKAROUND)
+- runtime->hw.info |= SNDRV_PCM_INFO_BATCH;
+-
+ if (chip->align_buffer_size)
+ /* constrain buffer sizes to be multiple of 128
+ bytes. This is more efficient in terms of memory
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index f86b9b0a0607e..d21a4eb1ca492 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2326,6 +2326,18 @@ static void generic_hdmi_free(struct hda_codec *codec)
+ }
+
+ #ifdef CONFIG_PM
++static int generic_hdmi_suspend(struct hda_codec *codec)
++{
++ struct hdmi_spec *spec = codec->spec;
++ int pin_idx;
++
++ for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
++ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
++ cancel_delayed_work_sync(&per_pin->work);
++ }
++ return 0;
++}
++
+ static int generic_hdmi_resume(struct hda_codec *codec)
+ {
+ struct hdmi_spec *spec = codec->spec;
+@@ -2349,6 +2361,7 @@ static const struct hda_codec_ops generic_hdmi_patch_ops = {
+ .build_controls = generic_hdmi_build_controls,
+ .unsol_event = hdmi_unsol_event,
+ #ifdef CONFIG_PM
++ .suspend = generic_hdmi_suspend,
+ .resume = generic_hdmi_resume,
+ #endif
+ };
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index d52ab6d49d18c..f08da98d0192a 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1186,6 +1186,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
+ case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
+ case USB_ID(0x2912, 0x30c8): /* Audioengine D1 */
++ case USB_ID(0x413c, 0xa506): /* Dell AE515 sound bar */
+ return true;
+ }
+
+@@ -1338,6 +1339,14 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+ && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ msleep(20);
+
++ /*
++ * Plantronics headsets (C320, C320-M, etc) need a delay to avoid
++ * random microhpone failures.
++ */
++ if (USB_ID_VENDOR(chip->usb_id) == 0x047f &&
++ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
++ msleep(20);
++
+ /* Zoom R16/24, many Logitech(at least H650e/H570e/BCC950),
+ * Jabra 550a, Kingston HyperX needs a tiny delay here,
+ * otherwise requests like get/set frequency return
+diff --git a/tools/perf/util/trace-event-read.c b/tools/perf/util/trace-event-read.c
+index 5eb1b2469bba6..12324325ea0b9 100644
+--- a/tools/perf/util/trace-event-read.c
++++ b/tools/perf/util/trace-event-read.c
+@@ -381,6 +381,7 @@ static int read_saved_cmdline(struct tep_handle *pevent)
+ pr_debug("error reading saved cmdlines\n");
+ goto out;
+ }
++ buf[ret] = '\0';
+
+ parse_saved_cmdline(pevent, buf, size);
+ ret = 0;
+diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh
+index 197e769c2ed16..f8cda822c1cec 100755
+--- a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh
+@@ -86,11 +86,20 @@ test_ip6gretap()
+
+ test_gretap_stp()
+ {
++ # Sometimes after mirror installation, the neighbor's state is not valid.
++ # The reason is that there is no SW datapath activity related to the
++ # neighbor for the remote GRE address. Therefore whether the corresponding
++ # neighbor will be valid is a matter of luck, and the test is thus racy.
++ # Set the neighbor's state to permanent, so it would be always valid.
++ ip neigh replace 192.0.2.130 lladdr $(mac_get $h3) \
++ nud permanent dev br2
+ full_test_span_gre_stp gt4 $swp3.555 "mirror to gretap"
+ }
+
+ test_ip6gretap_stp()
+ {
++ ip neigh replace 2001:db8:2::2 lladdr $(mac_get $h3) \
++ nud permanent dev br2
+ full_test_span_gre_stp gt6 $swp3.555 "mirror to ip6gretap"
+ }
+
+diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
+index 787f7329d1b7f..11103b75c5960 100644
+--- a/virt/kvm/arm/mmu.c
++++ b/virt/kvm/arm/mmu.c
+@@ -2080,7 +2080,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
+ * Prevent userspace from creating a memory region outside of the IPA
+ * space addressable by the KVM guest IPA space.
+ */
+- if (memslot->base_gfn + memslot->npages >=
++ if (memslot->base_gfn + memslot->npages >
+ (KVM_PHYS_SIZE >> PAGE_SHIFT))
+ return -EFAULT;
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-03-20 14:26 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-03-20 14:26 UTC (permalink / raw
To: gentoo-commits
commit: 6a53709581956033128a6cbb16fb300b611decca
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 20 14:26:22 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Mar 20 14:26:22 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6a537095
Linux patch 4.19.182
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1181_linux-4.19.182.patch | 607 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 611 insertions(+)
diff --git a/0000_README b/0000_README
index 3095bd6..edcc0c7 100644
--- a/0000_README
+++ b/0000_README
@@ -763,6 +763,10 @@ Patch: 1180_linux-4.19.181.patch
From: https://www.kernel.org
Desc: Linux 4.19.181
+Patch: 1181_linux-4.19.182.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.182
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1181_linux-4.19.182.patch b/1181_linux-4.19.182.patch
new file mode 100644
index 0000000..b00bc69
--- /dev/null
+++ b/1181_linux-4.19.182.patch
@@ -0,0 +1,607 @@
+diff --git a/Makefile b/Makefile
+index 29930269b4860..5956638e0f4d0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 181
++SUBLEVEL = 182
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h
+index 384c343976198..5f52d6d670e95 100644
+--- a/arch/arm64/include/asm/kvm_hyp.h
++++ b/arch/arm64/include/asm/kvm_hyp.h
+@@ -144,6 +144,9 @@ void __sysreg32_restore_state(struct kvm_vcpu *vcpu);
+
+ void __debug_switch_to_guest(struct kvm_vcpu *vcpu);
+ void __debug_switch_to_host(struct kvm_vcpu *vcpu);
++void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu);
++void __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu);
++
+
+ void __fpsimd_save_state(struct user_fpsimd_state *fp_regs);
+ void __fpsimd_restore_state(struct user_fpsimd_state *fp_regs);
+diff --git a/arch/arm64/kvm/hyp/debug-sr.c b/arch/arm64/kvm/hyp/debug-sr.c
+index 50009766e5e56..3c5414633bb7c 100644
+--- a/arch/arm64/kvm/hyp/debug-sr.c
++++ b/arch/arm64/kvm/hyp/debug-sr.c
+@@ -149,6 +149,21 @@ static void __hyp_text __debug_restore_state(struct kvm_vcpu *vcpu,
+ write_sysreg(ctxt->sys_regs[MDCCINT_EL1], mdccint_el1);
+ }
+
++void __hyp_text __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu)
++{
++ /*
++ * Non-VHE: Disable and flush SPE data generation
++ * VHE: The vcpu can run, but it can't hide.
++ */
++ __debug_save_spe_nvhe(&vcpu->arch.host_debug_state.pmscr_el1);
++
++}
++
++void __hyp_text __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu)
++{
++ __debug_restore_spe_nvhe(vcpu->arch.host_debug_state.pmscr_el1);
++}
++
+ void __hyp_text __debug_switch_to_guest(struct kvm_vcpu *vcpu)
+ {
+ struct kvm_cpu_context *host_ctxt;
+@@ -156,13 +171,6 @@ void __hyp_text __debug_switch_to_guest(struct kvm_vcpu *vcpu)
+ struct kvm_guest_debug_arch *host_dbg;
+ struct kvm_guest_debug_arch *guest_dbg;
+
+- /*
+- * Non-VHE: Disable and flush SPE data generation
+- * VHE: The vcpu can run, but it can't hide.
+- */
+- if (!has_vhe())
+- __debug_save_spe_nvhe(&vcpu->arch.host_debug_state.pmscr_el1);
+-
+ if (!(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY))
+ return;
+
+@@ -182,8 +190,6 @@ void __hyp_text __debug_switch_to_host(struct kvm_vcpu *vcpu)
+ struct kvm_guest_debug_arch *host_dbg;
+ struct kvm_guest_debug_arch *guest_dbg;
+
+- if (!has_vhe())
+- __debug_restore_spe_nvhe(vcpu->arch.host_debug_state.pmscr_el1);
+
+ if (!(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY))
+ return;
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index 15312e429b7d1..1d16ce0b7e0d6 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -560,6 +560,7 @@ int __hyp_text __kvm_vcpu_run_nvhe(struct kvm_vcpu *vcpu)
+ guest_ctxt = &vcpu->arch.ctxt;
+
+ __sysreg_save_state_nvhe(host_ctxt);
++ __debug_save_host_buffers_nvhe(vcpu);
+
+ __activate_traps(vcpu);
+ __activate_vm(kern_hyp_va(vcpu->kvm));
+@@ -599,11 +600,12 @@ int __hyp_text __kvm_vcpu_run_nvhe(struct kvm_vcpu *vcpu)
+ if (vcpu->arch.flags & KVM_ARM64_FP_ENABLED)
+ __fpsimd_save_fpexc32(vcpu);
+
++ __debug_switch_to_host(vcpu);
+ /*
+ * This must come after restoring the host sysregs, since a non-VHE
+ * system may enable SPE here and make use of the TTBRs.
+ */
+- __debug_switch_to_host(vcpu);
++ __debug_restore_host_buffers_nvhe(vcpu);
+
+ return exit_code;
+ }
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 335ce1e849044..7eaeab65d39f5 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -507,12 +507,27 @@ void b53_imp_vlan_setup(struct dsa_switch *ds, int cpu_port)
+ }
+ EXPORT_SYMBOL(b53_imp_vlan_setup);
+
++static void b53_port_set_learning(struct b53_device *dev, int port,
++ bool learning)
++{
++ u16 reg;
++
++ b53_read16(dev, B53_CTRL_PAGE, B53_DIS_LEARNING, ®);
++ if (learning)
++ reg &= ~BIT(port);
++ else
++ reg |= BIT(port);
++ b53_write16(dev, B53_CTRL_PAGE, B53_DIS_LEARNING, reg);
++}
++
+ int b53_enable_port(struct dsa_switch *ds, int port, struct phy_device *phy)
+ {
+ struct b53_device *dev = ds->priv;
+ unsigned int cpu_port = ds->ports[port].cpu_dp->index;
+ u16 pvlan;
+
++ b53_port_set_learning(dev, port, false);
++
+ /* Clear the Rx and Tx disable bits and set to no spanning tree */
+ b53_write8(dev, B53_CTRL_PAGE, B53_PORT_CTRL(port), 0);
+
+@@ -620,6 +635,7 @@ static void b53_enable_cpu_port(struct b53_device *dev, int port)
+ b53_write8(dev, B53_CTRL_PAGE, B53_PORT_CTRL(port), port_ctrl);
+
+ b53_brcm_hdr_setup(dev->ds, port);
++ b53_port_set_learning(dev, port, false);
+ }
+
+ static void b53_enable_mib(struct b53_device *dev)
+@@ -1517,6 +1533,8 @@ int b53_br_join(struct dsa_switch *ds, int port, struct net_device *br)
+ b53_write16(dev, B53_PVLAN_PAGE, B53_PVLAN_PORT_MASK(port), pvlan);
+ dev->ports[port].vlan_ctl_mask = pvlan;
+
++ b53_port_set_learning(dev, port, true);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(b53_br_join);
+@@ -1564,6 +1582,7 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct net_device *br)
+ vl->untag |= BIT(port) | BIT(cpu_port);
+ b53_set_vlan_entry(dev, pvid, vl);
+ }
++ b53_port_set_learning(dev, port, false);
+ }
+ EXPORT_SYMBOL(b53_br_leave);
+
+diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
+index c90985c294a2e..b2c539a421545 100644
+--- a/drivers/net/dsa/b53/b53_regs.h
++++ b/drivers/net/dsa/b53/b53_regs.h
+@@ -115,6 +115,7 @@
+ #define B53_UC_FLOOD_MASK 0x32
+ #define B53_MC_FLOOD_MASK 0x34
+ #define B53_IPMC_FLOOD_MASK 0x36
++#define B53_DIS_LEARNING 0x3c
+
+ /*
+ * Override Ports 0-7 State on devices with xMII interfaces (8 bit)
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 613f03f9d9eca..e9fe3897bd9cc 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -173,11 +173,6 @@ static int bcm_sf2_port_setup(struct dsa_switch *ds, int port,
+ reg &= ~P_TXQ_PSM_VDD(port);
+ core_writel(priv, reg, CORE_MEM_PSM_VDD_CTRL);
+
+- /* Enable learning */
+- reg = core_readl(priv, CORE_DIS_LEARN);
+- reg &= ~BIT(port);
+- core_writel(priv, reg, CORE_DIS_LEARN);
+-
+ /* Enable Broadcom tags for that port if requested */
+ if (priv->brcm_tag_mask & BIT(port))
+ b53_brcm_hdr_setup(ds, port);
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index f22a89cdb4072..1ea8fc9ff048f 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -24,6 +24,7 @@ struct ext4_system_zone {
+ struct rb_node node;
+ ext4_fsblk_t start_blk;
+ unsigned int count;
++ u32 ino;
+ };
+
+ static struct kmem_cache *ext4_system_zone_cachep;
+@@ -45,7 +46,8 @@ void ext4_exit_system_zone(void)
+ static inline int can_merge(struct ext4_system_zone *entry1,
+ struct ext4_system_zone *entry2)
+ {
+- if ((entry1->start_blk + entry1->count) == entry2->start_blk)
++ if ((entry1->start_blk + entry1->count) == entry2->start_blk &&
++ entry1->ino == entry2->ino)
+ return 1;
+ return 0;
+ }
+@@ -66,7 +68,7 @@ static void release_system_zone(struct ext4_system_blocks *system_blks)
+ */
+ static int add_system_zone(struct ext4_system_blocks *system_blks,
+ ext4_fsblk_t start_blk,
+- unsigned int count)
++ unsigned int count, u32 ino)
+ {
+ struct ext4_system_zone *new_entry, *entry;
+ struct rb_node **n = &system_blks->root.rb_node, *node;
+@@ -89,6 +91,7 @@ static int add_system_zone(struct ext4_system_blocks *system_blks,
+ return -ENOMEM;
+ new_entry->start_blk = start_blk;
+ new_entry->count = count;
++ new_entry->ino = ino;
+ new_node = &new_entry->node;
+
+ rb_link_node(new_node, parent, n);
+@@ -145,7 +148,7 @@ static void debug_print_tree(struct ext4_sb_info *sbi)
+ static int ext4_data_block_valid_rcu(struct ext4_sb_info *sbi,
+ struct ext4_system_blocks *system_blks,
+ ext4_fsblk_t start_blk,
+- unsigned int count)
++ unsigned int count, ino_t ino)
+ {
+ struct ext4_system_zone *entry;
+ struct rb_node *n;
+@@ -169,7 +172,7 @@ static int ext4_data_block_valid_rcu(struct ext4_sb_info *sbi,
+ n = n->rb_right;
+ else {
+ sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
+- return 0;
++ return entry->ino == ino;
+ }
+ }
+ return 1;
+@@ -204,17 +207,16 @@ static int ext4_protect_reserved_inode(struct super_block *sb,
+ if (n == 0) {
+ i++;
+ } else {
+- if (!ext4_data_block_valid_rcu(sbi, system_blks,
+- map.m_pblk, n)) {
+- ext4_error(sb, "blocks %llu-%llu from inode %u "
++ err = add_system_zone(system_blks, map.m_pblk, n, ino);
++ if (err < 0) {
++ if (err == -EFSCORRUPTED) {
++ ext4_error(sb,
++ "blocks %llu-%llu from inode %u "
+ "overlap system zone", map.m_pblk,
+ map.m_pblk + map.m_len - 1, ino);
+- err = -EFSCORRUPTED;
++ }
+ break;
+ }
+- err = add_system_zone(system_blks, map.m_pblk, n);
+- if (err < 0)
+- break;
+ i += n;
+ }
+ }
+@@ -259,19 +261,19 @@ int ext4_setup_system_zone(struct super_block *sb)
+ ((i < 5) || ((i % flex_size) == 0)))
+ add_system_zone(system_blks,
+ ext4_group_first_block_no(sb, i),
+- ext4_bg_num_gdb(sb, i) + 1);
++ ext4_bg_num_gdb(sb, i) + 1, 0);
+ gdp = ext4_get_group_desc(sb, i, NULL);
+ ret = add_system_zone(system_blks,
+- ext4_block_bitmap(sb, gdp), 1);
++ ext4_block_bitmap(sb, gdp), 1, 0);
+ if (ret)
+ goto err;
+ ret = add_system_zone(system_blks,
+- ext4_inode_bitmap(sb, gdp), 1);
++ ext4_inode_bitmap(sb, gdp), 1, 0);
+ if (ret)
+ goto err;
+ ret = add_system_zone(system_blks,
+ ext4_inode_table(sb, gdp),
+- sbi->s_itb_per_group);
++ sbi->s_itb_per_group, 0);
+ if (ret)
+ goto err;
+ }
+@@ -320,7 +322,7 @@ void ext4_release_system_zone(struct super_block *sb)
+ call_rcu(&system_blks->rcu, ext4_destroy_system_zone);
+ }
+
+-int ext4_data_block_valid(struct ext4_sb_info *sbi, ext4_fsblk_t start_blk,
++int ext4_inode_block_valid(struct inode *inode, ext4_fsblk_t start_blk,
+ unsigned int count)
+ {
+ struct ext4_system_blocks *system_blks;
+@@ -332,9 +334,9 @@ int ext4_data_block_valid(struct ext4_sb_info *sbi, ext4_fsblk_t start_blk,
+ * mount option.
+ */
+ rcu_read_lock();
+- system_blks = rcu_dereference(sbi->system_blks);
+- ret = ext4_data_block_valid_rcu(sbi, system_blks, start_blk,
+- count);
++ system_blks = rcu_dereference(EXT4_SB(inode->i_sb)->system_blks);
++ ret = ext4_data_block_valid_rcu(EXT4_SB(inode->i_sb), system_blks,
++ start_blk, count, inode->i_ino);
+ rcu_read_unlock();
+ return ret;
+ }
+@@ -354,8 +356,7 @@ int ext4_check_blockref(const char *function, unsigned int line,
+ while (bref < p+max) {
+ blk = le32_to_cpu(*bref++);
+ if (blk &&
+- unlikely(!ext4_data_block_valid(EXT4_SB(inode->i_sb),
+- blk, 1))) {
++ unlikely(!ext4_inode_block_valid(inode, blk, 1))) {
+ es->s_last_error_block = cpu_to_le64(blk);
+ ext4_error_inode(inode, function, line, blk,
+ "invalid block");
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index a436307eed001..6938dff9f04bd 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -3180,9 +3180,9 @@ extern void ext4_release_system_zone(struct super_block *sb);
+ extern int ext4_setup_system_zone(struct super_block *sb);
+ extern int __init ext4_init_system_zone(void);
+ extern void ext4_exit_system_zone(void);
+-extern int ext4_data_block_valid(struct ext4_sb_info *sbi,
+- ext4_fsblk_t start_blk,
+- unsigned int count);
++extern int ext4_inode_block_valid(struct inode *inode,
++ ext4_fsblk_t start_blk,
++ unsigned int count);
+ extern int ext4_check_blockref(const char *, unsigned int,
+ struct inode *, __le32 *, unsigned int);
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 3a4570e37cb0b..36708d9d71cbb 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -377,7 +377,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
+ */
+ if (lblock + len <= lblock)
+ return 0;
+- return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
++ return ext4_inode_block_valid(inode, block, len);
+ }
+
+ static int ext4_valid_extent_idx(struct inode *inode,
+@@ -385,7 +385,7 @@ static int ext4_valid_extent_idx(struct inode *inode,
+ {
+ ext4_fsblk_t block = ext4_idx_pblock(ext_idx);
+
+- return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, 1);
++ return ext4_inode_block_valid(inode, block, 1);
+ }
+
+ static int ext4_valid_extent_entries(struct inode *inode,
+@@ -542,14 +542,10 @@ __read_extent_tree_block(const char *function, unsigned int line,
+ }
+ if (buffer_verified(bh) && !(flags & EXT4_EX_FORCE_CACHE))
+ return bh;
+- if (!ext4_has_feature_journal(inode->i_sb) ||
+- (inode->i_ino !=
+- le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) {
+- err = __ext4_ext_check(function, line, inode,
+- ext_block_hdr(bh), depth, pblk);
+- if (err)
+- goto errout;
+- }
++ err = __ext4_ext_check(function, line, inode,
++ ext_block_hdr(bh), depth, pblk);
++ if (err)
++ goto errout;
+ set_buffer_verified(bh);
+ /*
+ * If this is a leaf block, cache all of its entries
+diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
+index e1801b288847a..a5442528a60d2 100644
+--- a/fs/ext4/indirect.c
++++ b/fs/ext4/indirect.c
+@@ -842,8 +842,7 @@ static int ext4_clear_blocks(handle_t *handle, struct inode *inode,
+ else if (ext4_should_journal_data(inode))
+ flags |= EXT4_FREE_BLOCKS_FORGET;
+
+- if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), block_to_free,
+- count)) {
++ if (!ext4_inode_block_valid(inode, block_to_free, count)) {
+ EXT4_ERROR_INODE(inode, "attempt to clear invalid "
+ "blocks %llu len %lu",
+ (unsigned long long) block_to_free, count);
+@@ -1005,8 +1004,7 @@ static void ext4_free_branches(handle_t *handle, struct inode *inode,
+ if (!nr)
+ continue; /* A hole */
+
+- if (!ext4_data_block_valid(EXT4_SB(inode->i_sb),
+- nr, 1)) {
++ if (!ext4_inode_block_valid(inode, nr, 1)) {
+ EXT4_ERROR_INODE(inode,
+ "invalid indirect mapped "
+ "block %lu (level %d)",
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index edeb837081c80..296ffe92e2503 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -421,8 +421,7 @@ static int __check_block_validity(struct inode *inode, const char *func,
+ (inode->i_ino ==
+ le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum)))
+ return 0;
+- if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), map->m_pblk,
+- map->m_len)) {
++ if (!ext4_inode_block_valid(inode, map->m_pblk, map->m_len)) {
+ ext4_error_inode(inode, func, line, map->m_pblk,
+ "lblock %lu mapped to illegal pblock %llu "
+ "(length %d)", (unsigned long) map->m_lblk,
+@@ -5072,7 +5071,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
+
+ ret = 0;
+ if (ei->i_file_acl &&
+- !ext4_data_block_valid(EXT4_SB(sb), ei->i_file_acl, 1)) {
++ !ext4_inode_block_valid(inode, ei->i_file_acl, 1)) {
+ ext4_error_inode(inode, function, line, 0,
+ "iget: bad extended attribute block %llu",
+ ei->i_file_acl);
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index ec6f65c91d93c..db47a06cfb74e 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -2990,7 +2990,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
+ block = ext4_grp_offs_to_block(sb, &ac->ac_b_ex);
+
+ len = EXT4_C2B(sbi, ac->ac_b_ex.fe_len);
+- if (!ext4_data_block_valid(sbi, block, len)) {
++ if (!ext4_inode_block_valid(ac->ac_inode, block, len)) {
+ ext4_error(sb, "Allocating blocks %llu-%llu which overlap "
+ "fs metadata", block, block+len);
+ /* File system mounted not to panic on error
+@@ -4755,7 +4755,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
+
+ sbi = EXT4_SB(sb);
+ if (!(flags & EXT4_FREE_BLOCKS_VALIDATED) &&
+- !ext4_data_block_valid(sbi, block, count)) {
++ !ext4_inode_block_valid(inode, block, count)) {
+ ext4_error(sb, "Freeing blocks not in datazone - "
+ "block = %llu, count = %lu", block, count);
+ goto error_return;
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index daf0a9637d73a..a0cdb6c4a330f 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -2734,24 +2734,29 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
+ {
+ bool mask_to_left = (opcode == BPF_ADD && off_is_neg) ||
+ (opcode == BPF_SUB && !off_is_neg);
+- u32 off;
++ u32 off, max;
+
+ switch (ptr_reg->type) {
+ case PTR_TO_STACK:
++ /* Offset 0 is out-of-bounds, but acceptable start for the
++ * left direction, see BPF_REG_FP.
++ */
++ max = MAX_BPF_STACK + mask_to_left;
+ off = ptr_reg->off + ptr_reg->var_off.value;
+ if (mask_to_left)
+ *ptr_limit = MAX_BPF_STACK + off;
+ else
+- *ptr_limit = -off;
+- return 0;
++ *ptr_limit = -off - 1;
++ return *ptr_limit >= max ? -ERANGE : 0;
+ case PTR_TO_MAP_VALUE:
++ max = ptr_reg->map_ptr->value_size;
+ if (mask_to_left) {
+ *ptr_limit = ptr_reg->umax_value + ptr_reg->off;
+ } else {
+ off = ptr_reg->smin_value + ptr_reg->off;
+- *ptr_limit = ptr_reg->map_ptr->value_size - off;
++ *ptr_limit = ptr_reg->map_ptr->value_size - off - 1;
+ }
+- return 0;
++ return *ptr_limit >= max ? -ERANGE : 0;
+ default:
+ return -EINVAL;
+ }
+@@ -2804,6 +2809,7 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
+ u32 alu_state, alu_limit;
+ struct bpf_reg_state tmp;
+ bool ret;
++ int err;
+
+ if (can_skip_alu_sanitation(env, insn))
+ return 0;
+@@ -2819,10 +2825,13 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
+ alu_state |= ptr_is_dst_reg ?
+ BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST;
+
+- if (retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg))
+- return 0;
+- if (update_alu_sanitation_state(aux, alu_state, alu_limit))
+- return -EACCES;
++ err = retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg);
++ if (err < 0)
++ return err;
++
++ err = update_alu_sanitation_state(aux, alu_state, alu_limit);
++ if (err < 0)
++ return err;
+ do_sim:
+ /* Simulate and find potential out-of-bounds access under
+ * speculative execution from truncation as a result of
+@@ -2920,7 +2929,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ case BPF_ADD:
+ ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
+ if (ret < 0) {
+- verbose(env, "R%d tried to add from different maps or paths\n", dst);
++ verbose(env, "R%d tried to add from different maps, paths, or prohibited types\n", dst);
+ return ret;
+ }
+ /* We can take a fixed offset as long as it doesn't overflow
+@@ -2975,7 +2984,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ case BPF_SUB:
+ ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
+ if (ret < 0) {
+- verbose(env, "R%d tried to sub from different maps or paths\n", dst);
++ verbose(env, "R%d tried to sub from different maps, paths, or prohibited types\n", dst);
+ return ret;
+ }
+ if (dst_reg == off_reg) {
+@@ -6085,7 +6094,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
+ off_reg = issrc ? insn->src_reg : insn->dst_reg;
+ if (isneg)
+ *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);
+- *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit - 1);
++ *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit);
+ *patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg);
+ *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);
+ *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);
+diff --git a/net/dsa/tag_mtk.c b/net/dsa/tag_mtk.c
+index 6574425ad94c1..1f57dce969f70 100644
+--- a/net/dsa/tag_mtk.c
++++ b/net/dsa/tag_mtk.c
+@@ -20,6 +20,7 @@
+ #define MTK_HDR_LEN 4
+ #define MTK_HDR_XMIT_UNTAGGED 0
+ #define MTK_HDR_XMIT_TAGGED_TPID_8100 1
++#define MTK_HDR_XMIT_TAGGED_TPID_88A8 2
+ #define MTK_HDR_RECV_SOURCE_PORT_MASK GENMASK(2, 0)
+ #define MTK_HDR_XMIT_DP_BIT_MASK GENMASK(5, 0)
+ #define MTK_HDR_XMIT_SA_DIS BIT(6)
+@@ -28,8 +29,8 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb,
+ struct net_device *dev)
+ {
+ struct dsa_port *dp = dsa_slave_to_port(dev);
++ u8 xmit_tpid;
+ u8 *mtk_tag;
+- bool is_vlan_skb = true;
+ unsigned char *dest = eth_hdr(skb)->h_dest;
+ bool is_multicast_skb = is_multicast_ether_addr(dest) &&
+ !is_broadcast_ether_addr(dest);
+@@ -40,13 +41,20 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb,
+ * the both special and VLAN tag at the same time and then look up VLAN
+ * table with VID.
+ */
+- if (!skb_vlan_tagged(skb)) {
++ switch (skb->protocol) {
++ case htons(ETH_P_8021Q):
++ xmit_tpid = MTK_HDR_XMIT_TAGGED_TPID_8100;
++ break;
++ case htons(ETH_P_8021AD):
++ xmit_tpid = MTK_HDR_XMIT_TAGGED_TPID_88A8;
++ break;
++ default:
+ if (skb_cow_head(skb, MTK_HDR_LEN) < 0)
+ return NULL;
+
++ xmit_tpid = MTK_HDR_XMIT_UNTAGGED;
+ skb_push(skb, MTK_HDR_LEN);
+ memmove(skb->data, skb->data + MTK_HDR_LEN, 2 * ETH_ALEN);
+- is_vlan_skb = false;
+ }
+
+ mtk_tag = skb->data + 2 * ETH_ALEN;
+@@ -54,8 +62,7 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb,
+ /* Mark tag attribute on special tag insertion to notify hardware
+ * whether that's a combined special tag with 802.1Q header.
+ */
+- mtk_tag[0] = is_vlan_skb ? MTK_HDR_XMIT_TAGGED_TPID_8100 :
+- MTK_HDR_XMIT_UNTAGGED;
++ mtk_tag[0] = xmit_tpid;
+ mtk_tag[1] = (1 << dp->index) & MTK_HDR_XMIT_DP_BIT_MASK;
+
+ /* Disable SA learning for multicast frames */
+@@ -63,7 +70,7 @@ static struct sk_buff *mtk_tag_xmit(struct sk_buff *skb,
+ mtk_tag[1] |= MTK_HDR_XMIT_SA_DIS;
+
+ /* Tag control information is kept for 802.1Q */
+- if (!is_vlan_skb) {
++ if (xmit_tpid == MTK_HDR_XMIT_UNTAGGED) {
+ mtk_tag[2] = 0;
+ mtk_tag[3] = 0;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-03-22 15:50 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-03-22 15:50 UTC (permalink / raw
To: gentoo-commits
commit: d51ce7eb76f7d799a196cd0a3fa8f0a8c4421bfc
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 22 15:48:24 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Mar 22 15:48:24 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d51ce7eb
Updates for CPU Optimization patch for 4.19.X gcc v9.1 and v10
Bug: https://bugs.gentoo.org/777666
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
5012_enable-cpu-optimizations-for-gcc91.patch | 447 +++++++++++--------------
5013_enable-cpu-optimizations-for-gcc10.patch | 450 ++++++++++----------------
2 files changed, 357 insertions(+), 540 deletions(-)
diff --git a/5012_enable-cpu-optimizations-for-gcc91.patch b/5012_enable-cpu-optimizations-for-gcc91.patch
index dffd36d..8662cb5 100644
--- a/5012_enable-cpu-optimizations-for-gcc91.patch
+++ b/5012_enable-cpu-optimizations-for-gcc91.patch
@@ -1,5 +1,10 @@
+From 7dc4b32d619ba7c8e1558d37a74183b6d86bf7d2 Mon Sep 17 00:00:00 2001
+From: graysky <graysky@archlinux.us>
+Date: Tue, 9 Mar 2021 02:14:13 -0500
+Subject: [PATCH] more-uarches-for-gcc-v9-and-kernel-4.19-5.4
+
WARNING
-This patch works with gcc versions 9.1+ and with kernel version 4.13+ and should
+This patch works with gcc versions 9.1+ and with kernel version 4.19-5.4 and
NOT be applied when compiling on older versions of gcc due to key name changes
of the march flags introduced with the version 4.9 release of gcc.[1]
@@ -42,14 +47,18 @@ It also offers to compile passing the 'native' option which, "selects the CPU
to generate code for at compilation time by determining the processor type of
the compiling machine. Using -march=native enables all instruction subsets
supported by the local machine and will produce code optimized for the local
-machine under the constraints of the selected instruction set."[3]
+machine under the constraints of the selected instruction set."[2]
+
+Do NOT try using the 'native' option on AMD Piledriver, Steamroller, or
+Excavator CPUs (-march=bdver{2,3,4} flag). The build will error out due the
+kernel's objtool issue with these.[3a,b]
MINOR NOTES
This patch also changes 'atom' to 'bonnell' in accordance with the gcc v4.9
changes. Note that upstream is using the deprecated 'match=atom' flags when I
-believe it should use the newer 'march=bonnell' flag for atom processors.[2]
+believe it should use the newer 'march=bonnell' flag for atom processors.[4]
-It is not recommended to compile on Atom-CPUs with the 'native' option.[4] The
+It is not recommended to compile on Atom-CPUs with the 'native' option.[5] The
recommendation is to use the 'atom' option instead.
BENEFITS
@@ -60,102 +69,33 @@ See the following experimental evidence supporting this statement:
https://github.com/graysky2/kernel_gcc_patch
REQUIREMENTS
-linux version >=4.13
-gcc version >=9.1
+linux version >=4.19 and <5.5
+gcc version >=9.1 and <10
ACKNOWLEDGMENTS
-This patch builds on the seminal work by Jeroen.[5]
+This patch builds on the seminal work by Jeroen.[6]
REFERENCES
-1. https://gcc.gnu.org/gcc-4.9/changes.html
-2. https://bugzilla.kernel.org/show_bug.cgi?id=77461
-3. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
-4. https://github.com/graysky2/kernel_gcc_patch/issues/15
-5. http://www.linuxforge.net/docs/linux/linux-gcc.php
+1. https://gcc.gnu.org/gcc-4.9/changes.html
+2. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
+3a. https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95671#c11
+3b. https://github.com/graysky2/kernel_gcc_patch/issues/55
+4. https://bugzilla.kernel.org/show_bug.cgi?id=77461
+5. https://github.com/graysky2/kernel_gcc_patch/issues/15
+6. http://www.linuxforge.net/docs/linux/linux-gcc.php
+---
+ arch/x86/Kconfig.cpu | 240 ++++++++++++++++++++++++++++++++--
+ arch/x86/Makefile | 37 +++++-
+ arch/x86/include/asm/module.h | 52 ++++++++
+ 3 files changed, 312 insertions(+), 17 deletions(-)
---- a/arch/x86/include/asm/module.h 2019-08-16 04:11:12.000000000 -0400
-+++ b/arch/x86/include/asm/module.h 2019-08-22 15:56:23.988050322 -0400
-@@ -25,6 +25,36 @@ struct mod_arch_specific {
- #define MODULE_PROC_FAMILY "586MMX "
- #elif defined CONFIG_MCORE2
- #define MODULE_PROC_FAMILY "CORE2 "
-+#elif defined CONFIG_MNATIVE
-+#define MODULE_PROC_FAMILY "NATIVE "
-+#elif defined CONFIG_MNEHALEM
-+#define MODULE_PROC_FAMILY "NEHALEM "
-+#elif defined CONFIG_MWESTMERE
-+#define MODULE_PROC_FAMILY "WESTMERE "
-+#elif defined CONFIG_MSILVERMONT
-+#define MODULE_PROC_FAMILY "SILVERMONT "
-+#elif defined CONFIG_MGOLDMONT
-+#define MODULE_PROC_FAMILY "GOLDMONT "
-+#elif defined CONFIG_MGOLDMONTPLUS
-+#define MODULE_PROC_FAMILY "GOLDMONTPLUS "
-+#elif defined CONFIG_MSANDYBRIDGE
-+#define MODULE_PROC_FAMILY "SANDYBRIDGE "
-+#elif defined CONFIG_MIVYBRIDGE
-+#define MODULE_PROC_FAMILY "IVYBRIDGE "
-+#elif defined CONFIG_MHASWELL
-+#define MODULE_PROC_FAMILY "HASWELL "
-+#elif defined CONFIG_MBROADWELL
-+#define MODULE_PROC_FAMILY "BROADWELL "
-+#elif defined CONFIG_MSKYLAKE
-+#define MODULE_PROC_FAMILY "SKYLAKE "
-+#elif defined CONFIG_MSKYLAKEX
-+#define MODULE_PROC_FAMILY "SKYLAKEX "
-+#elif defined CONFIG_MCANNONLAKE
-+#define MODULE_PROC_FAMILY "CANNONLAKE "
-+#elif defined CONFIG_MICELAKE
-+#define MODULE_PROC_FAMILY "ICELAKE "
-+#elif defined CONFIG_MCASCADELAKE
-+#define MODULE_PROC_FAMILY "CASCADELAKE "
- #elif defined CONFIG_MATOM
- #define MODULE_PROC_FAMILY "ATOM "
- #elif defined CONFIG_M686
-@@ -43,6 +73,28 @@ struct mod_arch_specific {
- #define MODULE_PROC_FAMILY "K7 "
- #elif defined CONFIG_MK8
- #define MODULE_PROC_FAMILY "K8 "
-+#elif defined CONFIG_MK8SSE3
-+#define MODULE_PROC_FAMILY "K8SSE3 "
-+#elif defined CONFIG_MK10
-+#define MODULE_PROC_FAMILY "K10 "
-+#elif defined CONFIG_MBARCELONA
-+#define MODULE_PROC_FAMILY "BARCELONA "
-+#elif defined CONFIG_MBOBCAT
-+#define MODULE_PROC_FAMILY "BOBCAT "
-+#elif defined CONFIG_MBULLDOZER
-+#define MODULE_PROC_FAMILY "BULLDOZER "
-+#elif defined CONFIG_MPILEDRIVER
-+#define MODULE_PROC_FAMILY "PILEDRIVER "
-+#elif defined CONFIG_MSTEAMROLLER
-+#define MODULE_PROC_FAMILY "STEAMROLLER "
-+#elif defined CONFIG_MJAGUAR
-+#define MODULE_PROC_FAMILY "JAGUAR "
-+#elif defined CONFIG_MEXCAVATOR
-+#define MODULE_PROC_FAMILY "EXCAVATOR "
-+#elif defined CONFIG_MZEN
-+#define MODULE_PROC_FAMILY "ZEN "
-+#elif defined CONFIG_MZEN2
-+#define MODULE_PROC_FAMILY "ZEN2 "
- #elif defined CONFIG_MELAN
- #define MODULE_PROC_FAMILY "ELAN "
- #elif defined CONFIG_MCRUSOE
---- a/arch/x86/Kconfig.cpu 2019-08-16 04:11:12.000000000 -0400
-+++ b/arch/x86/Kconfig.cpu 2019-08-22 15:59:31.596946943 -0400
-@@ -116,6 +116,7 @@ config MPENTIUMM
- config MPENTIUM4
- bool "Pentium-4/Celeron(P4-based)/Pentium-4 M/older Xeon"
- depends on X86_32
-+ select X86_P6_NOP
- ---help---
- Select this for Intel Pentium 4 chips. This includes the
- Pentium 4, Pentium D, P4-based Celeron and Xeon, and
-@@ -148,9 +149,8 @@ config MPENTIUM4
- -Paxville
- -Dempsey
+diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
+index 638411f22267..18f0f04b9cb7 100644
+--- a/arch/x86/Kconfig.cpu
++++ b/arch/x86/Kconfig.cpu
+@@ -150,7 +150,7 @@ config MPENTIUM4
+
--
config MK6
- bool "K6/K6-II/K6-III"
+ bool "AMD K6/K6-II/K6-III"
@@ -193,7 +133,7 @@ REFERENCES
+ bool "AMD 61xx/7x50/PhenomX3/X4/II/K10"
+ ---help---
+ Select this for an AMD 61xx Eight-Core Magny-Cours, Athlon X2 7x50,
-+ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
++ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
+ Enables use of some extended instructions, and passes appropriate
+ optimization flags to GCC.
+
@@ -263,52 +203,33 @@ REFERENCES
config MCRUSOE
bool "Crusoe"
depends on X86_32
-@@ -253,6 +331,7 @@ config MVIAC7
-
- config MPSC
- bool "Intel P4 / older Netburst based Xeon"
-+ select X86_P6_NOP
- depends on X86_64
- ---help---
- Optimize for Intel Pentium 4, Pentium D and older Nocona/Dempsey
-@@ -262,8 +341,19 @@ config MPSC
- using the cpu family field
+@@ -263,7 +341,7 @@ config MPSC
in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
-+config MATOM
-+ bool "Intel Atom"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Atom platform. Intel Atom CPUs have an
-+ in-order pipelining architecture and thus can benefit from
-+ accordingly optimized code. Use a recent GCC with specific Atom
-+ support in order to fully benefit from selecting this option.
-+
config MCORE2
- bool "Core 2/newer Xeon"
+ bool "Intel Core 2"
-+ select X86_P6_NOP
---help---
Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
-@@ -271,14 +361,133 @@ config MCORE2
+@@ -271,6 +349,8 @@ config MCORE2
family in /proc/cpuinfo. Newer ones have 6 and older ones 15
(not a typo)
--config MATOM
-- bool "Intel Atom"
+ Enables -march=core2
+
+ config MATOM
+ bool "Intel Atom"
+ ---help---
+@@ -280,6 +360,132 @@ config MATOM
+ accordingly optimized code. Use a recent GCC with specific Atom
+ support in order to fully benefit from selecting this option.
+
+config MNEHALEM
+ bool "Intel Nehalem"
+ select X86_P6_NOP
- ---help---
-
-- Select this for the Intel Atom platform. Intel Atom CPUs have an
-- in-order pipelining architecture and thus can benefit from
-- accordingly optimized code. Use a recent GCC with specific Atom
-- support in order to fully benefit from selecting this option.
++ ---help---
++
+ Select this for 1st Gen Core processors in the Nehalem family.
+
+ Enables -march=nehalem
@@ -429,204 +350,200 @@ REFERENCES
+ Select this for Xeon processors in the Cascade Lake family.
+
+ Enables -march=cascadelake
-
++
config GENERIC_CPU
bool "Generic-x86-64"
-@@ -287,6 +496,19 @@ config GENERIC_CPU
+ depends on X86_64
+@@ -287,6 +493,16 @@ config GENERIC_CPU
Generic x86-64 CPU.
Run equally well on all x86-64 CPUs.
+config MNATIVE
-+ bool "Native optimizations autodetected by GCC"
-+ ---help---
++ bool "Native optimizations autodetected by GCC"
++ ---help---
+
-+ GCC 4.2 and above support -march=native, which automatically detects
-+ the optimum settings to use based on your processor. -march=native
-+ also detects and applies additional settings beyond -march specific
-+ to your CPU, (eg. -msse4). Unless you have a specific reason not to
-+ (e.g. distcc cross-compiling), you should probably be using
-+ -march=native rather than anything listed below.
++ GCC 4.2 and above support -march=native, which automatically detects
++ the optimum settings to use based on your processor. Do NOT use this
++ for AMD CPUs. Intel Only!
+
-+ Enables -march=native
++ Enables -march=native
+
endchoice
config X86_GENERIC
-@@ -311,7 +533,7 @@ config X86_INTERNODE_CACHE_SHIFT
+@@ -311,7 +527,7 @@ config X86_INTERNODE_CACHE_SHIFT
config X86_L1_CACHE_SHIFT
int
default "7" if MPENTIUM4 || MPSC
- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
-+ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
++ default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE || X86_GENERIC || GENERIC_CPU
default "4" if MELAN || M486 || MGEODEGX1
default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
-@@ -329,35 +551,36 @@ config X86_ALIGNMENT_16
+@@ -329,11 +545,11 @@ config X86_ALIGNMENT_16
config X86_INTEL_USERCOPY
def_bool y
- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
-+ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE
++ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE
config X86_USE_PPRO_CHECKSUM
def_bool y
- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
-+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MATOM || MNATIVE
++ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE
config X86_USE_3DNOW
def_bool y
- depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
-
--#
--# P6_NOPs are a relatively minor optimization that require a family >=
--# 6 processor, except that it is broken on certain VIA chips.
--# Furthermore, AMD chips prefer a totally different sequence of NOPs
--# (which work on all CPUs). In addition, it looks like Virtual PC
--# does not understand them.
--#
--# As a result, disallow these if we're not compiling for X86_64 (these
--# NOPs do work on all x86-64 capable chips); the list of processors in
--# the right-hand clause are the cores that benefit from this optimization.
--#
+@@ -353,26 +569,26 @@ config X86_USE_3DNOW
config X86_P6_NOP
-- def_bool y
-- depends on X86_64
+ def_bool y
+ depends on X86_64
- depends on (MCORE2 || MPENTIUM4 || MPSC)
-+ default n
-+ bool "Support for P6_NOPs on Intel chips"
-+ depends on (MCORE2 || MPENTIUM4 || MPSC || MATOM || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE)
-+ ---help---
-+ P6_NOPs are a relatively minor optimization that require a family >=
-+ 6 processor, except that it is broken on certain VIA chips.
-+ Furthermore, AMD chips prefer a totally different sequence of NOPs
-+ (which work on all CPUs). In addition, it looks like Virtual PC
-+ does not understand them.
-+
-+ As a result, disallow these if we're not compiling for X86_64 (these
-+ NOPs do work on all x86-64 capable chips); the list of processors in
-+ the right-hand clause are the cores that benefit from this optimization.
-+
-+ Say Y if you have Intel CPU newer than Pentium Pro, N otherwise.
++ depends on (MCORE2 || MPENTIUM4 || MPSC || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE)
config X86_TSC
def_bool y
- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
-+ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE || MATOM) || X86_64
++ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE) || X86_64
config X86_CMPXCHG64
def_bool y
-@@ -367,7 +590,7 @@ config X86_CMPXCHG64
+- depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8
++ depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE
+
+ # this should be set for all -march=.. options where the compiler
# generates cmov.
config X86_CMOV
def_bool y
- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
-+ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
++ depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE)
config X86_MINIMUM_CPU_FAMILY
int
---- a/arch/x86/Makefile 2019-08-16 04:11:12.000000000 -0400
-+++ b/arch/x86/Makefile 2019-08-22 16:01:22.559789904 -0400
-@@ -118,13 +118,53 @@ else
- KBUILD_CFLAGS += $(call cc-option,-mskip-rax-setup)
+ default "64" if X86_64
+- default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8)
++ default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE)
+ default "5" if X86_32 && X86_CMPXCHG64
+ default "4"
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 4833dd7e2cc0..a0289273da72 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -121,11 +121,38 @@ else
# FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
-+ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
-+ cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-mtune=k8)
+ cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
+-
+- cflags-$(CONFIG_MCORE2) += \
+- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
+- cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
+- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
++ cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3)
+ cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10)
+ cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona)
+ cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1)
+ cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2)
+ cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1)
+ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2)
++ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-mno-tbm)
+ cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3)
++ cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-mno-tbm)
+ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4)
++ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-mno-tbm)
+ cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1)
-+ cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2)
- cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
-
- cflags-$(CONFIG_MCORE2) += \
-- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
-- cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
-- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
-+ $(call cc-option,-march=core2,$(call cc-option,-mtune=core2))
-+ cflags-$(CONFIG_MNEHALEM) += \
-+ $(call cc-option,-march=nehalem,$(call cc-option,-mtune=nehalem))
-+ cflags-$(CONFIG_MWESTMERE) += \
-+ $(call cc-option,-march=westmere,$(call cc-option,-mtune=westmere))
-+ cflags-$(CONFIG_MSILVERMONT) += \
-+ $(call cc-option,-march=silvermont,$(call cc-option,-mtune=silvermont))
-+ cflags-$(CONFIG_MGOLDMONT) += \
-+ $(call cc-option,-march=goldmont,$(call cc-option,-mtune=goldmont))
-+ cflags-$(CONFIG_MGOLDMONTPLUS) += \
-+ $(call cc-option,-march=goldmont-plus,$(call cc-option,-mtune=goldmont-plus))
-+ cflags-$(CONFIG_MSANDYBRIDGE) += \
-+ $(call cc-option,-march=sandybridge,$(call cc-option,-mtune=sandybridge))
-+ cflags-$(CONFIG_MIVYBRIDGE) += \
-+ $(call cc-option,-march=ivybridge,$(call cc-option,-mtune=ivybridge))
-+ cflags-$(CONFIG_MHASWELL) += \
-+ $(call cc-option,-march=haswell,$(call cc-option,-mtune=haswell))
-+ cflags-$(CONFIG_MBROADWELL) += \
-+ $(call cc-option,-march=broadwell,$(call cc-option,-mtune=broadwell))
-+ cflags-$(CONFIG_MSKYLAKE) += \
-+ $(call cc-option,-march=skylake,$(call cc-option,-mtune=skylake))
-+ cflags-$(CONFIG_MSKYLAKEX) += \
-+ $(call cc-option,-march=skylake-avx512,$(call cc-option,-mtune=skylake-avx512))
-+ cflags-$(CONFIG_MCANNONLAKE) += \
-+ $(call cc-option,-march=cannonlake,$(call cc-option,-mtune=cannonlake))
-+ cflags-$(CONFIG_MICELAKE) += \
-+ $(call cc-option,-march=icelake-client,$(call cc-option,-mtune=icelake-client))
-+ cflags-$(CONFIG_MCASCADE) += \
-+ $(call cc-option,-march=cascadelake,$(call cc-option,-mtune=cascadelake))
-+ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell) \
-+ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
++ cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2)
++
++ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
++ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell)
++ cflags-$(CONFIG_MCORE2) += $(call cc-option,-march=core2)
++ cflags-$(CONFIG_MNEHALEM) += $(call cc-option,-march=nehalem)
++ cflags-$(CONFIG_MWESTMERE) += $(call cc-option,-march=westmere)
++ cflags-$(CONFIG_MSILVERMONT) += $(call cc-option,-march=silvermont)
++ cflags-$(CONFIG_MGOLDMONT) += $(call cc-option,-march=goldmont)
++ cflags-$(CONFIG_MGOLDMONTPLUS) += $(call cc-option,-march=goldmont-plus)
++ cflags-$(CONFIG_MSANDYBRIDGE) += $(call cc-option,-march=sandybridge)
++ cflags-$(CONFIG_MIVYBRIDGE) += $(call cc-option,-march=ivybridge)
++ cflags-$(CONFIG_MHASWELL) += $(call cc-option,-march=haswell)
++ cflags-$(CONFIG_MBROADWELL) += $(call cc-option,-march=broadwell)
++ cflags-$(CONFIG_MSKYLAKE) += $(call cc-option,-march=skylake)
++ cflags-$(CONFIG_MSKYLAKEX) += $(call cc-option,-march=skylake-avx512)
++ cflags-$(CONFIG_MCANNONLAKE) += $(call cc-option,-march=cannonlake)
++ cflags-$(CONFIG_MICELAKE) += $(call cc-option,-march=icelake-client)
++ cflags-$(CONFIG_MCASCADELAKE) += $(call cc-option,-march=cascadelake)
cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
KBUILD_CFLAGS += $(cflags-y)
---- a/arch/x86/Makefile_32.cpu 2019-08-16 04:11:12.000000000 -0400
-+++ b/arch/x86/Makefile_32.cpu 2019-08-22 16:02:14.687701216 -0400
-@@ -23,7 +23,19 @@ cflags-$(CONFIG_MK6) += -march=k6
- # Please note, that patches that add -march=athlon-xp and friends are pointless.
- # They make zero difference whatsosever to performance at this time.
- cflags-$(CONFIG_MK7) += -march=athlon
-+cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
- cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8,-march=athlon)
-+cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-march=athlon)
-+cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10,-march=athlon)
-+cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona,-march=athlon)
-+cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1,-march=athlon)
-+cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2,-march=athlon)
-+cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1,-march=athlon)
-+cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2,-march=athlon)
-+cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3,-march=athlon)
-+cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4,-march=athlon)
-+cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1,-march=athlon)
-+cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2,-march=athlon)
- cflags-$(CONFIG_MCRUSOE) += -march=i686 -falign-functions=0 -falign-jumps=0 -falign-loops=0
- cflags-$(CONFIG_MEFFICEON) += -march=i686 $(call tune,pentium3) -falign-functions=0 -falign-jumps=0 -falign-loops=0
- cflags-$(CONFIG_MWINCHIPC6) += $(call cc-option,-march=winchip-c6,-march=i586)
-@@ -32,8 +44,22 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
- cflags-$(CONFIG_MVIAC3_2) += $(call cc-option,-march=c3-2,-march=i686)
- cflags-$(CONFIG_MVIAC7) += -march=i686
- cflags-$(CONFIG_MCORE2) += -march=i686 $(call tune,core2)
--cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom,$(call cc-option,-march=core2,-march=i686)) \
-- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
-+cflags-$(CONFIG_MNEHALEM) += -march=i686 $(call tune,nehalem)
-+cflags-$(CONFIG_MWESTMERE) += -march=i686 $(call tune,westmere)
-+cflags-$(CONFIG_MSILVERMONT) += -march=i686 $(call tune,silvermont)
-+cflags-$(CONFIG_MGOLDMONT) += -march=i686 $(call tune,goldmont)
-+cflags-$(CONFIG_MGOLDMONTPLUS) += -march=i686 $(call tune,goldmont-plus)
-+cflags-$(CONFIG_MSANDYBRIDGE) += -march=i686 $(call tune,sandybridge)
-+cflags-$(CONFIG_MIVYBRIDGE) += -march=i686 $(call tune,ivybridge)
-+cflags-$(CONFIG_MHASWELL) += -march=i686 $(call tune,haswell)
-+cflags-$(CONFIG_MBROADWELL) += -march=i686 $(call tune,broadwell)
-+cflags-$(CONFIG_MSKYLAKE) += -march=i686 $(call tune,skylake)
-+cflags-$(CONFIG_MSKYLAKEX) += -march=i686 $(call tune,skylake-avx512)
-+cflags-$(CONFIG_MCANNONLAKE) += -march=i686 $(call tune,cannonlake)
-+cflags-$(CONFIG_MICELAKE) += -march=i686 $(call tune,icelake-client)
-+cflags-$(CONFIG_MCASCADELAKE) += -march=i686 $(call tune,cascadelake)
-+cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell,$(call cc-option,-march=core2,-march=i686)) \
-+ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
-
- # AMD Elan support
- cflags-$(CONFIG_MELAN) += -march=i486
+diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
+index 7948a17febb4..50b5e6ee4934 100644
+--- a/arch/x86/include/asm/module.h
++++ b/arch/x86/include/asm/module.h
+@@ -25,6 +25,36 @@ struct mod_arch_specific {
+ #define MODULE_PROC_FAMILY "586MMX "
+ #elif defined CONFIG_MCORE2
+ #define MODULE_PROC_FAMILY "CORE2 "
++#elif defined CONFIG_MNATIVE
++#define MODULE_PROC_FAMILY "NATIVE "
++#elif defined CONFIG_MNEHALEM
++#define MODULE_PROC_FAMILY "NEHALEM "
++#elif defined CONFIG_MWESTMERE
++#define MODULE_PROC_FAMILY "WESTMERE "
++#elif defined CONFIG_MSILVERMONT
++#define MODULE_PROC_FAMILY "SILVERMONT "
++#elif defined CONFIG_MGOLDMONT
++#define MODULE_PROC_FAMILY "GOLDMONT "
++#elif defined CONFIG_MGOLDMONTPLUS
++#define MODULE_PROC_FAMILY "GOLDMONTPLUS "
++#elif defined CONFIG_MSANDYBRIDGE
++#define MODULE_PROC_FAMILY "SANDYBRIDGE "
++#elif defined CONFIG_MIVYBRIDGE
++#define MODULE_PROC_FAMILY "IVYBRIDGE "
++#elif defined CONFIG_MHASWELL
++#define MODULE_PROC_FAMILY "HASWELL "
++#elif defined CONFIG_MBROADWELL
++#define MODULE_PROC_FAMILY "BROADWELL "
++#elif defined CONFIG_MSKYLAKE
++#define MODULE_PROC_FAMILY "SKYLAKE "
++#elif defined CONFIG_MSKYLAKEX
++#define MODULE_PROC_FAMILY "SKYLAKEX "
++#elif defined CONFIG_MCANNONLAKE
++#define MODULE_PROC_FAMILY "CANNONLAKE "
++#elif defined CONFIG_MICELAKE
++#define MODULE_PROC_FAMILY "ICELAKE "
++#elif defined CONFIG_MCASCADELAKE
++#define MODULE_PROC_FAMILY "CASCADELAKE "
+ #elif defined CONFIG_MATOM
+ #define MODULE_PROC_FAMILY "ATOM "
+ #elif defined CONFIG_M686
+@@ -43,6 +73,28 @@ struct mod_arch_specific {
+ #define MODULE_PROC_FAMILY "K7 "
+ #elif defined CONFIG_MK8
+ #define MODULE_PROC_FAMILY "K8 "
++#elif defined CONFIG_MK8SSE3
++#define MODULE_PROC_FAMILY "K8SSE3 "
++#elif defined CONFIG_MK10
++#define MODULE_PROC_FAMILY "K10 "
++#elif defined CONFIG_MBARCELONA
++#define MODULE_PROC_FAMILY "BARCELONA "
++#elif defined CONFIG_MBOBCAT
++#define MODULE_PROC_FAMILY "BOBCAT "
++#elif defined CONFIG_MBULLDOZER
++#define MODULE_PROC_FAMILY "BULLDOZER "
++#elif defined CONFIG_MPILEDRIVER
++#define MODULE_PROC_FAMILY "PILEDRIVER "
++#elif defined CONFIG_MSTEAMROLLER
++#define MODULE_PROC_FAMILY "STEAMROLLER "
++#elif defined CONFIG_MJAGUAR
++#define MODULE_PROC_FAMILY "JAGUAR "
++#elif defined CONFIG_MEXCAVATOR
++#define MODULE_PROC_FAMILY "EXCAVATOR "
++#elif defined CONFIG_MZEN
++#define MODULE_PROC_FAMILY "ZEN "
++#elif defined CONFIG_MZEN2
++#define MODULE_PROC_FAMILY "ZEN2 "
+ #elif defined CONFIG_MELAN
+ #define MODULE_PROC_FAMILY "ELAN "
+ #elif defined CONFIG_MCRUSOE
+--
+2.30.1
+
diff --git a/5013_enable-cpu-optimizations-for-gcc10.patch b/5013_enable-cpu-optimizations-for-gcc10.patch
index 2a1e27d..6951f13 100644
--- a/5013_enable-cpu-optimizations-for-gcc10.patch
+++ b/5013_enable-cpu-optimizations-for-gcc10.patch
@@ -1,5 +1,10 @@
+From cde505774da8b00eb3a67513488b417fadb8e2c3 Mon Sep 17 00:00:00 2001
+From: graysky <graysky@archlinux.us>
+Date: Mon, 8 Mar 2021 15:44:59 -0500
+Subject: [PATCH] more-uarches-for-gcc-v10-and-kernel-4.19-v5.4
+
WARNING
-This patch works with gcc versions 10.1+ and with kernel versions 4.19-5.4 and should
+This patch works with gcc versions 10.1+ and with kernel versions 4.19-5.4 and
NOT be applied when compiling on older versions of gcc due to key name changes
of the march flags introduced with the version 4.9 release of gcc.[1]
@@ -46,16 +51,14 @@ the compiling machine. Using -march=native enables all instruction subsets
supported by the local machine and will produce code optimized for the local
machine under the constraints of the selected instruction set."[2]
-Do NOT try using the 'native' option on AMD Piledriver, Steamroller, or
-Excavator CPUs (-march=bdver{2,3,4} flag). The build will error out due the
-kernel's objtool issue with these.[3a,b]
+Do NOT use 'native' when building for AMD chips! Intel ONLY!
MINOR NOTES
This patch also changes 'atom' to 'bonnell' in accordance with the gcc v4.9
changes. Note that upstream is using the deprecated 'match=atom' flags when I
-believe it should use the newer 'march=bonnell' flag for atom processors.[4]
+believe it should use the newer 'march=bonnell' flag for atom processors.[3]
-It is not recommended to compile on Atom-CPUs with the 'native' option.[5] The
+It is not recommended to compile on Atom-CPUs with the 'native' option.[4] The
recommendation is to use the 'atom' option instead.
BENEFITS
@@ -70,104 +73,27 @@ linux version 4.19-lts and 5.4-lts
gcc version >=10.1
ACKNOWLEDGMENTS
-This patch builds on the seminal work by Jeroen.[6]
+This patch builds on the seminal work by Jeroen.[5]
REFERENCES
1. https://gcc.gnu.org/gcc-4.9/changes.html
2. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
-3a. https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95671#c11
-3b. https://github.com/graysky2/kernel_gcc_patch/issues/55
-4. https://bugzilla.kernel.org/show_bug.cgi?id=77461
-5. https://github.com/graysky2/kernel_gcc_patch/issues/15
-6. http://www.linuxforge.net/docs/linux/linux-gcc.php
+3. https://bugzilla.kernel.org/show_bug.cgi?id=77461
+4. https://github.com/graysky2/kernel_gcc_patch/issues/15
+5. http://www.linuxforge.net/docs/linux/linux-gcc.php
+---
+ arch/x86/Kconfig.cpu | 258 ++++++++++++++++++++++++++++++++--
+ arch/x86/Makefile | 39 ++++-
+ arch/x86/include/asm/module.h | 56 ++++++++
+ 3 files changed, 336 insertions(+), 17 deletions(-)
---- a/arch/x86/include/asm/module.h 2020-06-10 15:35:02.000000000 -0400
-+++ b/arch/x86/include/asm/module.h 2020-06-15 10:31:48.627486708 -0400
-@@ -25,6 +25,40 @@ struct mod_arch_specific {
- #define MODULE_PROC_FAMILY "586MMX "
- #elif defined CONFIG_MCORE2
- #define MODULE_PROC_FAMILY "CORE2 "
-+#elif defined CONFIG_MNATIVE
-+#define MODULE_PROC_FAMILY "NATIVE "
-+#elif defined CONFIG_MNEHALEM
-+#define MODULE_PROC_FAMILY "NEHALEM "
-+#elif defined CONFIG_MWESTMERE
-+#define MODULE_PROC_FAMILY "WESTMERE "
-+#elif defined CONFIG_MSILVERMONT
-+#define MODULE_PROC_FAMILY "SILVERMONT "
-+#elif defined CONFIG_MGOLDMONT
-+#define MODULE_PROC_FAMILY "GOLDMONT "
-+#elif defined CONFIG_MGOLDMONTPLUS
-+#define MODULE_PROC_FAMILY "GOLDMONTPLUS "
-+#elif defined CONFIG_MSANDYBRIDGE
-+#define MODULE_PROC_FAMILY "SANDYBRIDGE "
-+#elif defined CONFIG_MIVYBRIDGE
-+#define MODULE_PROC_FAMILY "IVYBRIDGE "
-+#elif defined CONFIG_MHASWELL
-+#define MODULE_PROC_FAMILY "HASWELL "
-+#elif defined CONFIG_MBROADWELL
-+#define MODULE_PROC_FAMILY "BROADWELL "
-+#elif defined CONFIG_MSKYLAKE
-+#define MODULE_PROC_FAMILY "SKYLAKE "
-+#elif defined CONFIG_MSKYLAKEX
-+#define MODULE_PROC_FAMILY "SKYLAKEX "
-+#elif defined CONFIG_MCANNONLAKE
-+#define MODULE_PROC_FAMILY "CANNONLAKE "
-+#elif defined CONFIG_MICELAKE
-+#define MODULE_PROC_FAMILY "ICELAKE "
-+#elif defined CONFIG_MCASCADELAKE
-+#define MODULE_PROC_FAMILY "CASCADELAKE "
-+#elif defined CONFIG_MCOOPERLAKE
-+#define MODULE_PROC_FAMILY "COOPERLAKE "
-+#elif defined CONFIG_MTIGERLAKE
-+#define MODULE_PROC_FAMILY "TIGERLAKE "
- #elif defined CONFIG_MATOM
- #define MODULE_PROC_FAMILY "ATOM "
- #elif defined CONFIG_M686
-@@ -43,6 +77,28 @@ struct mod_arch_specific {
- #define MODULE_PROC_FAMILY "K7 "
- #elif defined CONFIG_MK8
- #define MODULE_PROC_FAMILY "K8 "
-+#elif defined CONFIG_MK8SSE3
-+#define MODULE_PROC_FAMILY "K8SSE3 "
-+#elif defined CONFIG_MK10
-+#define MODULE_PROC_FAMILY "K10 "
-+#elif defined CONFIG_MBARCELONA
-+#define MODULE_PROC_FAMILY "BARCELONA "
-+#elif defined CONFIG_MBOBCAT
-+#define MODULE_PROC_FAMILY "BOBCAT "
-+#elif defined CONFIG_MBULLDOZER
-+#define MODULE_PROC_FAMILY "BULLDOZER "
-+#elif defined CONFIG_MPILEDRIVER
-+#define MODULE_PROC_FAMILY "PILEDRIVER "
-+#elif defined CONFIG_MSTEAMROLLER
-+#define MODULE_PROC_FAMILY "STEAMROLLER "
-+#elif defined CONFIG_MJAGUAR
-+#define MODULE_PROC_FAMILY "JAGUAR "
-+#elif defined CONFIG_MEXCAVATOR
-+#define MODULE_PROC_FAMILY "EXCAVATOR "
-+#elif defined CONFIG_MZEN
-+#define MODULE_PROC_FAMILY "ZEN "
-+#elif defined CONFIG_MZEN2
-+#define MODULE_PROC_FAMILY "ZEN2 "
- #elif defined CONFIG_MELAN
- #define MODULE_PROC_FAMILY "ELAN "
- #elif defined CONFIG_MCRUSOE
---- a/arch/x86/Kconfig.cpu 2020-06-10 15:35:02.000000000 -0400
-+++ b/arch/x86/Kconfig.cpu 2020-06-15 10:31:48.627486708 -0400
-@@ -116,6 +116,7 @@ config MPENTIUMM
- config MPENTIUM4
- bool "Pentium-4/Celeron(P4-based)/Pentium-4 M/older Xeon"
- depends on X86_32
-+ select X86_P6_NOP
- ---help---
- Select this for Intel Pentium 4 chips. This includes the
- Pentium 4, Pentium D, P4-based Celeron and Xeon, and
-@@ -148,9 +149,8 @@ config MPENTIUM4
- -Paxville
- -Dempsey
+diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
+index 8e29c991ba3e..a1a12d8dfc50 100644
+--- a/arch/x86/Kconfig.cpu
++++ b/arch/x86/Kconfig.cpu
+@@ -150,7 +150,7 @@ config MPENTIUM4
+
--
config MK6
- bool "K6/K6-II/K6-III"
+ bool "AMD K6/K6-II/K6-III"
@@ -205,7 +131,7 @@ REFERENCES
+ bool "AMD 61xx/7x50/PhenomX3/X4/II/K10"
+ ---help---
+ Select this for an AMD 61xx Eight-Core Magny-Cours, Athlon X2 7x50,
-+ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
++ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
+ Enables use of some extended instructions, and passes appropriate
+ optimization flags to GCC.
+
@@ -275,52 +201,33 @@ REFERENCES
config MCRUSOE
bool "Crusoe"
depends on X86_32
-@@ -253,6 +331,7 @@ config MVIAC7
-
- config MPSC
- bool "Intel P4 / older Netburst based Xeon"
-+ select X86_P6_NOP
- depends on X86_64
- ---help---
- Optimize for Intel Pentium 4, Pentium D and older Nocona/Dempsey
-@@ -262,8 +341,19 @@ config MPSC
- using the cpu family field
+@@ -263,7 +341,7 @@ config MPSC
in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
-+config MATOM
-+ bool "Intel Atom"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Atom platform. Intel Atom CPUs have an
-+ in-order pipelining architecture and thus can benefit from
-+ accordingly optimized code. Use a recent GCC with specific Atom
-+ support in order to fully benefit from selecting this option.
-+
config MCORE2
- bool "Core 2/newer Xeon"
+ bool "Intel Core 2"
-+ select X86_P6_NOP
---help---
Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
-@@ -271,14 +361,151 @@ config MCORE2
+@@ -271,6 +349,8 @@ config MCORE2
family in /proc/cpuinfo. Newer ones have 6 and older ones 15
(not a typo)
--config MATOM
-- bool "Intel Atom"
+ Enables -march=core2
+
+ config MATOM
+ bool "Intel Atom"
+ ---help---
+@@ -280,6 +360,150 @@ config MATOM
+ accordingly optimized code. Use a recent GCC with specific Atom
+ support in order to fully benefit from selecting this option.
+
+config MNEHALEM
+ bool "Intel Nehalem"
+ select X86_P6_NOP
- ---help---
-
-- Select this for the Intel Atom platform. Intel Atom CPUs have an
-- in-order pipelining architecture and thus can benefit from
-- accordingly optimized code. Use a recent GCC with specific Atom
-- support in order to fully benefit from selecting this option.
++ ---help---
++
+ Select this for 1st Gen Core processors in the Nehalem family.
+
+ Enables -march=nehalem
@@ -459,110 +366,96 @@ REFERENCES
+ Select this for third-generation 10 nm process processors in the Tiger Lake family.
+
+ Enables -march=tigerlake
-
++
config GENERIC_CPU
bool "Generic-x86-64"
-@@ -287,6 +514,19 @@ config GENERIC_CPU
+ depends on X86_64
+@@ -287,6 +511,16 @@ config GENERIC_CPU
Generic x86-64 CPU.
Run equally well on all x86-64 CPUs.
+config MNATIVE
-+ bool "Native optimizations autodetected by GCC"
-+ ---help---
++ bool "Native optimizations autodetected by GCC"
++ ---help---
+
-+ GCC 4.2 and above support -march=native, which automatically detects
-+ the optimum settings to use based on your processor. -march=native
-+ also detects and applies additional settings beyond -march specific
-+ to your CPU, (eg. -msse4). Unless you have a specific reason not to
-+ (e.g. distcc cross-compiling), you should probably be using
-+ -march=native rather than anything listed below.
++ GCC 4.2 and above support -march=native, which automatically detects
++ the optimum settings to use based on your processor. Do NOT use this
++ for AMD CPUs. Intel Only!
+
-+ Enables -march=native
++ Enables -march=native
+
endchoice
config X86_GENERIC
-@@ -311,7 +551,7 @@ config X86_INTERNODE_CACHE_SHIFT
+@@ -311,7 +545,7 @@ config X86_INTERNODE_CACHE_SHIFT
config X86_L1_CACHE_SHIFT
int
default "7" if MPENTIUM4 || MPSC
- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
-+ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
++ default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE || X86_GENERIC || GENERIC_CPU
default "4" if MELAN || M486 || MGEODEGX1
default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
-@@ -329,35 +569,36 @@ config X86_ALIGNMENT_16
+@@ -329,11 +563,11 @@ config X86_ALIGNMENT_16
config X86_INTEL_USERCOPY
def_bool y
- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
-+ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE
++ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE
config X86_USE_PPRO_CHECKSUM
def_bool y
- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
-+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MATOM || MNATIVE
++ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE
config X86_USE_3DNOW
def_bool y
- depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
-
--#
--# P6_NOPs are a relatively minor optimization that require a family >=
--# 6 processor, except that it is broken on certain VIA chips.
--# Furthermore, AMD chips prefer a totally different sequence of NOPs
--# (which work on all CPUs). In addition, it looks like Virtual PC
--# does not understand them.
--#
--# As a result, disallow these if we're not compiling for X86_64 (these
--# NOPs do work on all x86-64 capable chips); the list of processors in
--# the right-hand clause are the cores that benefit from this optimization.
--#
+@@ -353,26 +587,26 @@ config X86_USE_3DNOW
config X86_P6_NOP
-- def_bool y
-- depends on X86_64
+ def_bool y
+ depends on X86_64
- depends on (MCORE2 || MPENTIUM4 || MPSC)
-+ default n
-+ bool "Support for P6_NOPs on Intel chips"
-+ depends on (MCORE2 || MPENTIUM4 || MPSC || MATOM || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE)
-+ ---help---
-+ P6_NOPs are a relatively minor optimization that require a family >=
-+ 6 processor, except that it is broken on certain VIA chips.
-+ Furthermore, AMD chips prefer a totally different sequence of NOPs
-+ (which work on all CPUs). In addition, it looks like Virtual PC
-+ does not understand them.
-+
-+ As a result, disallow these if we're not compiling for X86_64 (these
-+ NOPs do work on all x86-64 capable chips); the list of processors in
-+ the right-hand clause are the cores that benefit from this optimization.
-+
-+ Say Y if you have Intel CPU newer than Pentium Pro, N otherwise.
++ depends on (MCORE2 || MPENTIUM4 || MPSC || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE)
config X86_TSC
def_bool y
- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
-+ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE || MATOM) || X86_64
++ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE) || X86_64
config X86_CMPXCHG64
def_bool y
-@@ -367,7 +608,7 @@ config X86_CMPXCHG64
+- depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8
++ depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE
+
+ # this should be set for all -march=.. options where the compiler
# generates cmov.
config X86_CMOV
def_bool y
- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
-+ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
++ depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE)
config X86_MINIMUM_CPU_FAMILY
int
---- a/arch/x86/Makefile 2020-06-10 15:35:02.000000000 -0400
-+++ b/arch/x86/Makefile 2020-06-15 10:32:39.508648036 -0400
-@@ -119,13 +119,60 @@ else
- KBUILD_CFLAGS += $(call cc-option,-mskip-rax-setup)
+ default "64" if X86_64
+- default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8)
++ default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE)
+ default "5" if X86_32 && X86_CMPXCHG64
+ default "4"
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 8ca3cf7c5ec9..d954e5be917e 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -124,11 +124,40 @@ else
# FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
-+ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
-+ cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-mtune=k8)
+ cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
+-
+- cflags-$(CONFIG_MCORE2) += \
+- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
+- cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
+- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
++ cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3)
+ cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10)
+ cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona)
+ cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1)
@@ -575,97 +468,104 @@ REFERENCES
+ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4)
+ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-mno-tbm)
+ cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1)
-+ cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2)
- cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
-
- cflags-$(CONFIG_MCORE2) += \
-- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
-- cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
-- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
-+ $(call cc-option,-march=core2,$(call cc-option,-mtune=core2))
-+ cflags-$(CONFIG_MNEHALEM) += \
-+ $(call cc-option,-march=nehalem,$(call cc-option,-mtune=nehalem))
-+ cflags-$(CONFIG_MWESTMERE) += \
-+ $(call cc-option,-march=westmere,$(call cc-option,-mtune=westmere))
-+ cflags-$(CONFIG_MSILVERMONT) += \
-+ $(call cc-option,-march=silvermont,$(call cc-option,-mtune=silvermont))
-+ cflags-$(CONFIG_MGOLDMONT) += \
-+ $(call cc-option,-march=goldmont,$(call cc-option,-mtune=goldmont))
-+ cflags-$(CONFIG_MGOLDMONTPLUS) += \
-+ $(call cc-option,-march=goldmont-plus,$(call cc-option,-mtune=goldmont-plus))
-+ cflags-$(CONFIG_MSANDYBRIDGE) += \
-+ $(call cc-option,-march=sandybridge,$(call cc-option,-mtune=sandybridge))
-+ cflags-$(CONFIG_MIVYBRIDGE) += \
-+ $(call cc-option,-march=ivybridge,$(call cc-option,-mtune=ivybridge))
-+ cflags-$(CONFIG_MHASWELL) += \
-+ $(call cc-option,-march=haswell,$(call cc-option,-mtune=haswell))
-+ cflags-$(CONFIG_MBROADWELL) += \
-+ $(call cc-option,-march=broadwell,$(call cc-option,-mtune=broadwell))
-+ cflags-$(CONFIG_MSKYLAKE) += \
-+ $(call cc-option,-march=skylake,$(call cc-option,-mtune=skylake))
-+ cflags-$(CONFIG_MSKYLAKEX) += \
-+ $(call cc-option,-march=skylake-avx512,$(call cc-option,-mtune=skylake-avx512))
-+ cflags-$(CONFIG_MCANNONLAKE) += \
-+ $(call cc-option,-march=cannonlake,$(call cc-option,-mtune=cannonlake))
-+ cflags-$(CONFIG_MICELAKE) += \
-+ $(call cc-option,-march=icelake-client,$(call cc-option,-mtune=icelake-client))
-+ cflags-$(CONFIG_MCASCADELAKE) += \
-+ $(call cc-option,-march=cascadelake,$(call cc-option,-mtune=cascadelake))
-+ cflags-$(CONFIG_MCOOPERLAKE) += \
-+ $(call cc-option,-march=cooperlake,$(call cc-option,-mtune=cooperlake))
-+ cflags-$(CONFIG_MTIGERLAKE) += \
-+ $(call cc-option,-march=tigerlake,$(call cc-option,-mtune=tigerlake))
-+ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell) \
-+ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
++ cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2)
++
++ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
++ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell)
++ cflags-$(CONFIG_MCORE2) += $(call cc-option,-march=core2)
++ cflags-$(CONFIG_MNEHALEM) += $(call cc-option,-march=nehalem)
++ cflags-$(CONFIG_MWESTMERE) += $(call cc-option,-march=westmere)
++ cflags-$(CONFIG_MSILVERMONT) += $(call cc-option,-march=silvermont)
++ cflags-$(CONFIG_MGOLDMONT) += $(call cc-option,-march=goldmont)
++ cflags-$(CONFIG_MGOLDMONTPLUS) += $(call cc-option,-march=goldmont-plus)
++ cflags-$(CONFIG_MSANDYBRIDGE) += $(call cc-option,-march=sandybridge)
++ cflags-$(CONFIG_MIVYBRIDGE) += $(call cc-option,-march=ivybridge)
++ cflags-$(CONFIG_MHASWELL) += $(call cc-option,-march=haswell)
++ cflags-$(CONFIG_MBROADWELL) += $(call cc-option,-march=broadwell)
++ cflags-$(CONFIG_MSKYLAKE) += $(call cc-option,-march=skylake)
++ cflags-$(CONFIG_MSKYLAKEX) += $(call cc-option,-march=skylake-avx512)
++ cflags-$(CONFIG_MCANNONLAKE) += $(call cc-option,-march=cannonlake)
++ cflags-$(CONFIG_MICELAKE) += $(call cc-option,-march=icelake-client)
++ cflags-$(CONFIG_MCASCADELAKE) += $(call cc-option,-march=cascadelake)
++ cflags-$(CONFIG_MCOOPERLAKE) += $(call cc-option,-march=cooperlake)
++ cflags-$(CONFIG_MTIGERLAKE) += $(call cc-option,-march=tigerlake)
cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
KBUILD_CFLAGS += $(cflags-y)
---- a/arch/x86/Makefile_32.cpu 2020-06-10 15:35:02.000000000 -0400
-+++ b/arch/x86/Makefile_32.cpu 2020-06-15 10:31:48.627486708 -0400
-@@ -23,7 +23,19 @@ cflags-$(CONFIG_MK6) += -march=k6
- # Please note, that patches that add -march=athlon-xp and friends are pointless.
- # They make zero difference whatsosever to performance at this time.
- cflags-$(CONFIG_MK7) += -march=athlon
-+cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
- cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8,-march=athlon)
-+cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-march=athlon)
-+cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10,-march=athlon)
-+cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona,-march=athlon)
-+cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1,-march=athlon)
-+cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2,-march=athlon)
-+cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1,-march=athlon)
-+cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2,-march=athlon)
-+cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3,-march=athlon)
-+cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4,-march=athlon)
-+cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1,-march=athlon)
-+cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2,-march=athlon)
- cflags-$(CONFIG_MCRUSOE) += -march=i686 -falign-functions=0 -falign-jumps=0 -falign-loops=0
- cflags-$(CONFIG_MEFFICEON) += -march=i686 $(call tune,pentium3) -falign-functions=0 -falign-jumps=0 -falign-loops=0
- cflags-$(CONFIG_MWINCHIPC6) += $(call cc-option,-march=winchip-c6,-march=i586)
-@@ -32,8 +44,24 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
- cflags-$(CONFIG_MVIAC3_2) += $(call cc-option,-march=c3-2,-march=i686)
- cflags-$(CONFIG_MVIAC7) += -march=i686
- cflags-$(CONFIG_MCORE2) += -march=i686 $(call tune,core2)
--cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom,$(call cc-option,-march=core2,-march=i686)) \
-- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
-+cflags-$(CONFIG_MNEHALEM) += -march=i686 $(call tune,nehalem)
-+cflags-$(CONFIG_MWESTMERE) += -march=i686 $(call tune,westmere)
-+cflags-$(CONFIG_MSILVERMONT) += -march=i686 $(call tune,silvermont)
-+cflags-$(CONFIG_MGOLDMONT) += -march=i686 $(call tune,goldmont)
-+cflags-$(CONFIG_MGOLDMONTPLUS) += -march=i686 $(call tune,goldmont-plus)
-+cflags-$(CONFIG_MSANDYBRIDGE) += -march=i686 $(call tune,sandybridge)
-+cflags-$(CONFIG_MIVYBRIDGE) += -march=i686 $(call tune,ivybridge)
-+cflags-$(CONFIG_MHASWELL) += -march=i686 $(call tune,haswell)
-+cflags-$(CONFIG_MBROADWELL) += -march=i686 $(call tune,broadwell)
-+cflags-$(CONFIG_MSKYLAKE) += -march=i686 $(call tune,skylake)
-+cflags-$(CONFIG_MSKYLAKEX) += -march=i686 $(call tune,skylake-avx512)
-+cflags-$(CONFIG_MCANNONLAKE) += -march=i686 $(call tune,cannonlake)
-+cflags-$(CONFIG_MICELAKE) += -march=i686 $(call tune,icelake-client)
-+cflags-$(CONFIG_MCASCADELAKE) += -march=i686 $(call tune,cascadelake)
-+cflags-$(CONFIG_MCOOPERLAKE) += -march=i686 $(call tune,cooperlake)
-+cflags-$(CONFIG_MTIGERLAKE) += -march=i686 $(call tune,tigerlake)
-+cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell,$(call cc-option,-march=core2,-march=i686)) \
-+ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
-
- # AMD Elan support
- cflags-$(CONFIG_MELAN) += -march=i486
+diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
+index 7948a17febb4..eaf4ff82561f 100644
+--- a/arch/x86/include/asm/module.h
++++ b/arch/x86/include/asm/module.h
+@@ -25,6 +25,40 @@ struct mod_arch_specific {
+ #define MODULE_PROC_FAMILY "586MMX "
+ #elif defined CONFIG_MCORE2
+ #define MODULE_PROC_FAMILY "CORE2 "
++#elif defined CONFIG_MNATIVE
++#define MODULE_PROC_FAMILY "NATIVE "
++#elif defined CONFIG_MNEHALEM
++#define MODULE_PROC_FAMILY "NEHALEM "
++#elif defined CONFIG_MWESTMERE
++#define MODULE_PROC_FAMILY "WESTMERE "
++#elif defined CONFIG_MSILVERMONT
++#define MODULE_PROC_FAMILY "SILVERMONT "
++#elif defined CONFIG_MGOLDMONT
++#define MODULE_PROC_FAMILY "GOLDMONT "
++#elif defined CONFIG_MGOLDMONTPLUS
++#define MODULE_PROC_FAMILY "GOLDMONTPLUS "
++#elif defined CONFIG_MSANDYBRIDGE
++#define MODULE_PROC_FAMILY "SANDYBRIDGE "
++#elif defined CONFIG_MIVYBRIDGE
++#define MODULE_PROC_FAMILY "IVYBRIDGE "
++#elif defined CONFIG_MHASWELL
++#define MODULE_PROC_FAMILY "HASWELL "
++#elif defined CONFIG_MBROADWELL
++#define MODULE_PROC_FAMILY "BROADWELL "
++#elif defined CONFIG_MSKYLAKE
++#define MODULE_PROC_FAMILY "SKYLAKE "
++#elif defined CONFIG_MSKYLAKEX
++#define MODULE_PROC_FAMILY "SKYLAKEX "
++#elif defined CONFIG_MCANNONLAKE
++#define MODULE_PROC_FAMILY "CANNONLAKE "
++#elif defined CONFIG_MICELAKE
++#define MODULE_PROC_FAMILY "ICELAKE "
++#elif defined CONFIG_MCASCADELAKE
++#define MODULE_PROC_FAMILY "CASCADELAKE "
++#elif defined CONFIG_MCOOPERLAKE
++#define MODULE_PROC_FAMILY "COOPERLAKE "
++#elif defined CONFIG_MTIGERLAKE
++#define MODULE_PROC_FAMILY "TIGERLAKE "
+ #elif defined CONFIG_MATOM
+ #define MODULE_PROC_FAMILY "ATOM "
+ #elif defined CONFIG_M686
+@@ -43,6 +77,28 @@ struct mod_arch_specific {
+ #define MODULE_PROC_FAMILY "K7 "
+ #elif defined CONFIG_MK8
+ #define MODULE_PROC_FAMILY "K8 "
++#elif defined CONFIG_MK8SSE3
++#define MODULE_PROC_FAMILY "K8SSE3 "
++#elif defined CONFIG_MK10
++#define MODULE_PROC_FAMILY "K10 "
++#elif defined CONFIG_MBARCELONA
++#define MODULE_PROC_FAMILY "BARCELONA "
++#elif defined CONFIG_MBOBCAT
++#define MODULE_PROC_FAMILY "BOBCAT "
++#elif defined CONFIG_MBULLDOZER
++#define MODULE_PROC_FAMILY "BULLDOZER "
++#elif defined CONFIG_MPILEDRIVER
++#define MODULE_PROC_FAMILY "PILEDRIVER "
++#elif defined CONFIG_MSTEAMROLLER
++#define MODULE_PROC_FAMILY "STEAMROLLER "
++#elif defined CONFIG_MJAGUAR
++#define MODULE_PROC_FAMILY "JAGUAR "
++#elif defined CONFIG_MEXCAVATOR
++#define MODULE_PROC_FAMILY "EXCAVATOR "
++#elif defined CONFIG_MZEN
++#define MODULE_PROC_FAMILY "ZEN "
++#elif defined CONFIG_MZEN2
++#define MODULE_PROC_FAMILY "ZEN2 "
+ #elif defined CONFIG_MELAN
+ #define MODULE_PROC_FAMILY "ELAN "
+ #elif defined CONFIG_MCRUSOE
+--
+2.30.1
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-03-24 12:08 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-03-24 12:08 UTC (permalink / raw
To: gentoo-commits
commit: 7f7edc2ea3215794edee8c776b4ef1e234fb2f8d
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 24 12:08:31 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 24 12:08:31 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7f7edc2e
Linux patch 4.19.183
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1182_linux-4.19.183.patch | 1585 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1589 insertions(+)
diff --git a/0000_README b/0000_README
index edcc0c7..d06c180 100644
--- a/0000_README
+++ b/0000_README
@@ -767,6 +767,10 @@ Patch: 1181_linux-4.19.182.patch
From: https://www.kernel.org
Desc: Linux 4.19.182
+Patch: 1182_linux-4.19.183.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.183
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1182_linux-4.19.183.patch b/1182_linux-4.19.183.patch
new file mode 100644
index 0000000..2fea81e
--- /dev/null
+++ b/1182_linux-4.19.183.patch
@@ -0,0 +1,1585 @@
+diff --git a/Makefile b/Makefile
+index 5956638e0f4d0..9347445b2027b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 182
++SUBLEVEL = 183
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/include/asm/cpu_has_feature.h b/arch/powerpc/include/asm/cpu_has_feature.h
+index 7897d16e09904..727d4b3219379 100644
+--- a/arch/powerpc/include/asm/cpu_has_feature.h
++++ b/arch/powerpc/include/asm/cpu_has_feature.h
+@@ -7,7 +7,7 @@
+ #include <linux/bug.h>
+ #include <asm/cputable.h>
+
+-static inline bool early_cpu_has_feature(unsigned long feature)
++static __always_inline bool early_cpu_has_feature(unsigned long feature)
+ {
+ return !!((CPU_FTRS_ALWAYS & feature) ||
+ (CPU_FTRS_POSSIBLE & cur_cpu_spec->cpu_features & feature));
+@@ -46,7 +46,7 @@ static __always_inline bool cpu_has_feature(unsigned long feature)
+ return static_branch_likely(&cpu_feature_keys[i]);
+ }
+ #else
+-static inline bool cpu_has_feature(unsigned long feature)
++static __always_inline bool cpu_has_feature(unsigned long feature)
+ {
+ return early_cpu_has_feature(feature);
+ }
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 695432965f206..9b346f3d2814c 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -99,6 +99,7 @@ SECTIONS
+ #endif
+ /* careful! __ftr_alt_* sections need to be close to .text */
+ *(.text.hot TEXT_MAIN .text.fixup .text.unlikely .fixup __ftr_alt_* .ref.text);
++ NOINSTR_TEXT
+ SCHED_TEXT
+ CPUIDLE_TEXT
+ LOCK_TEXT
+diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
+index 79caeba8b6f08..b3279feff458b 100644
+--- a/arch/x86/events/intel/ds.c
++++ b/arch/x86/events/intel/ds.c
+@@ -1557,7 +1557,7 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs)
+ */
+ if (!pebs_status && cpuc->pebs_enabled &&
+ !(cpuc->pebs_enabled & (cpuc->pebs_enabled-1)))
+- pebs_status = cpuc->pebs_enabled;
++ pebs_status = p->status = cpuc->pebs_enabled;
+
+ bit = find_first_bit((unsigned long *)&pebs_status,
+ x86_pmu.max_pebs_events);
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index 0f750e7b24071..cc4bb218f1c60 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -521,15 +521,6 @@ static inline void arch_thread_struct_whitelist(unsigned long *offset,
+ *size = fpu_kernel_xstate_size;
+ }
+
+-/*
+- * Thread-synchronous status.
+- *
+- * This is different from the flags in that nobody else
+- * ever touches our thread-synchronous status, so we don't
+- * have to worry about atomic accesses.
+- */
+-#define TS_COMPAT 0x0002 /* 32bit syscall active (64BIT)*/
+-
+ /*
+ * Set IOPL bits in EFLAGS from given mask
+ */
+diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
+index 82b73b75d67ca..b5e4c357523e8 100644
+--- a/arch/x86/include/asm/thread_info.h
++++ b/arch/x86/include/asm/thread_info.h
+@@ -227,10 +227,31 @@ static inline int arch_within_stack_frames(const void * const stack,
+
+ #endif
+
++/*
++ * Thread-synchronous status.
++ *
++ * This is different from the flags in that nobody else
++ * ever touches our thread-synchronous status, so we don't
++ * have to worry about atomic accesses.
++ */
++#define TS_COMPAT 0x0002 /* 32bit syscall active (64BIT)*/
++
++#ifndef __ASSEMBLY__
+ #ifdef CONFIG_COMPAT
+ #define TS_I386_REGS_POKED 0x0004 /* regs poked by 32-bit ptracer */
++#define TS_COMPAT_RESTART 0x0008
++
++#define arch_set_restart_data arch_set_restart_data
++
++static inline void arch_set_restart_data(struct restart_block *restart)
++{
++ struct thread_info *ti = current_thread_info();
++ if (ti->status & TS_COMPAT)
++ ti->status |= TS_COMPAT_RESTART;
++ else
++ ti->status &= ~TS_COMPAT_RESTART;
++}
+ #endif
+-#ifndef __ASSEMBLY__
+
+ #ifdef CONFIG_X86_32
+ #define in_ia32_syscall() true
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index e891b33ccfe5f..da6b52c709641 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -2279,6 +2279,11 @@ static int cpuid_to_apicid[] = {
+ [0 ... NR_CPUS - 1] = -1,
+ };
+
++bool arch_match_cpu_phys_id(int cpu, u64 phys_id)
++{
++ return phys_id == cpuid_to_apicid[cpu];
++}
++
+ #ifdef CONFIG_SMP
+ /**
+ * apic_id_is_primary_thread - Check whether APIC ID belongs to a primary thread
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 15234885e60bc..a89dac380243a 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -1043,6 +1043,16 @@ static int mp_map_pin_to_irq(u32 gsi, int idx, int ioapic, int pin,
+ if (idx >= 0 && test_bit(mp_irqs[idx].srcbus, mp_bus_not_pci)) {
+ irq = mp_irqs[idx].srcbusirq;
+ legacy = mp_is_legacy_irq(irq);
++ /*
++ * IRQ2 is unusable for historical reasons on systems which
++ * have a legacy PIC. See the comment vs. IRQ2 further down.
++ *
++ * If this gets removed at some point then the related code
++ * in lapic_assign_system_vectors() needs to be adjusted as
++ * well.
++ */
++ if (legacy && irq == PIC_CASCADE_IR)
++ return -EINVAL;
+ }
+
+ mutex_lock(&ioapic_mutex);
+diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
+index 44e647a65de88..16e908000550f 100644
+--- a/arch/x86/kernel/signal.c
++++ b/arch/x86/kernel/signal.c
+@@ -776,30 +776,8 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs)
+
+ static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs)
+ {
+- /*
+- * This function is fundamentally broken as currently
+- * implemented.
+- *
+- * The idea is that we want to trigger a call to the
+- * restart_block() syscall and that we want in_ia32_syscall(),
+- * in_x32_syscall(), etc. to match whatever they were in the
+- * syscall being restarted. We assume that the syscall
+- * instruction at (regs->ip - 2) matches whatever syscall
+- * instruction we used to enter in the first place.
+- *
+- * The problem is that we can get here when ptrace pokes
+- * syscall-like values into regs even if we're not in a syscall
+- * at all.
+- *
+- * For now, we maintain historical behavior and guess based on
+- * stored state. We could do better by saving the actual
+- * syscall arch in restart_block or (with caveats on x32) by
+- * checking if regs->ip points to 'int $0x80'. The current
+- * behavior is incorrect if a tracer has a different bitness
+- * than the tracee.
+- */
+ #ifdef CONFIG_IA32_EMULATION
+- if (current_thread_info()->status & (TS_COMPAT|TS_I386_REGS_POKED))
++ if (current_thread_info()->status & TS_COMPAT_RESTART)
+ return __NR_ia32_restart_syscall;
+ #endif
+ #ifdef CONFIG_X86_X32_ABI
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index b118b5a500c9a..2c99f93020bc9 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -304,22 +304,22 @@ static void rpm_put_suppliers(struct device *dev)
+ static int __rpm_callback(int (*cb)(struct device *), struct device *dev)
+ __releases(&dev->power.lock) __acquires(&dev->power.lock)
+ {
+- bool use_links = dev->power.links_count > 0;
+- bool get = false;
+ int retval, idx;
+- bool put;
++ bool use_links = dev->power.links_count > 0;
+
+ if (dev->power.irq_safe) {
+ spin_unlock(&dev->power.lock);
+- } else if (!use_links) {
+- spin_unlock_irq(&dev->power.lock);
+ } else {
+- get = dev->power.runtime_status == RPM_RESUMING;
+-
+ spin_unlock_irq(&dev->power.lock);
+
+- /* Resume suppliers if necessary. */
+- if (get) {
++ /*
++ * Resume suppliers if necessary.
++ *
++ * The device's runtime PM status cannot change until this
++ * routine returns, so it is safe to read the status outside of
++ * the lock.
++ */
++ if (use_links && dev->power.runtime_status == RPM_RESUMING) {
+ idx = device_links_read_lock();
+
+ retval = rpm_get_suppliers(dev);
+@@ -334,36 +334,24 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev)
+
+ if (dev->power.irq_safe) {
+ spin_lock(&dev->power.lock);
+- return retval;
+- }
+-
+- spin_lock_irq(&dev->power.lock);
+-
+- if (!use_links)
+- return retval;
+-
+- /*
+- * If the device is suspending and the callback has returned success,
+- * drop the usage counters of the suppliers that have been reference
+- * counted on its resume.
+- *
+- * Do that if the resume fails too.
+- */
+- put = dev->power.runtime_status == RPM_SUSPENDING && !retval;
+- if (put)
+- __update_runtime_status(dev, RPM_SUSPENDED);
+- else
+- put = get && retval;
+-
+- if (put) {
+- spin_unlock_irq(&dev->power.lock);
+-
+- idx = device_links_read_lock();
++ } else {
++ /*
++ * If the device is suspending and the callback has returned
++ * success, drop the usage counters of the suppliers that have
++ * been reference counted on its resume.
++ *
++ * Do that if resume fails too.
++ */
++ if (use_links
++ && ((dev->power.runtime_status == RPM_SUSPENDING && !retval)
++ || (dev->power.runtime_status == RPM_RESUMING && retval))) {
++ idx = device_links_read_lock();
+
+-fail:
+- rpm_put_suppliers(dev);
++ fail:
++ rpm_put_suppliers(dev);
+
+- device_links_read_unlock(idx);
++ device_links_read_unlock(idx);
++ }
+
+ spin_lock_irq(&dev->power.lock);
+ }
+diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
+index 9421c1ec86f73..1dabd366ec0bc 100644
+--- a/drivers/iio/adc/Kconfig
++++ b/drivers/iio/adc/Kconfig
+@@ -658,6 +658,7 @@ config STM32_ADC_CORE
+ depends on ARCH_STM32 || COMPILE_TEST
+ depends on OF
+ depends on REGULATOR
++ depends on HAS_IOMEM
+ select IIO_BUFFER
+ select MFD_STM32_TIMERS
+ select IIO_STM32_TIMER_TRIGGER
+diff --git a/drivers/iio/adc/qcom-spmi-vadc.c b/drivers/iio/adc/qcom-spmi-vadc.c
+index 3680e0d474120..2640155b26443 100644
+--- a/drivers/iio/adc/qcom-spmi-vadc.c
++++ b/drivers/iio/adc/qcom-spmi-vadc.c
+@@ -606,7 +606,7 @@ static const struct vadc_channels vadc_chans[] = {
+ VADC_CHAN_NO_SCALE(P_MUX16_1_3, 1)
+
+ VADC_CHAN_NO_SCALE(LR_MUX1_BAT_THERM, 0)
+- VADC_CHAN_NO_SCALE(LR_MUX2_BAT_ID, 0)
++ VADC_CHAN_VOLT(LR_MUX2_BAT_ID, 0, SCALE_DEFAULT)
+ VADC_CHAN_NO_SCALE(LR_MUX3_XO_THERM, 0)
+ VADC_CHAN_NO_SCALE(LR_MUX4_AMUX_THM1, 0)
+ VADC_CHAN_NO_SCALE(LR_MUX5_AMUX_THM2, 0)
+diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
+index 5ddebede31a6f..33120ccff87ff 100644
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -549,6 +549,8 @@ static irqreturn_t mpu3050_trigger_handler(int irq, void *p)
+ MPU3050_FIFO_R,
+ &fifo_values[offset],
+ toread);
++ if (ret)
++ goto out_trigger_unlock;
+
+ dev_dbg(mpu3050->dev,
+ "%04x %04x %04x %04x %04x\n",
+diff --git a/drivers/iio/humidity/hid-sensor-humidity.c b/drivers/iio/humidity/hid-sensor-humidity.c
+index 4bc95f31c730e..d8c30d94d742e 100644
+--- a/drivers/iio/humidity/hid-sensor-humidity.c
++++ b/drivers/iio/humidity/hid-sensor-humidity.c
+@@ -28,7 +28,10 @@
+ struct hid_humidity_state {
+ struct hid_sensor_common common_attributes;
+ struct hid_sensor_hub_attribute_info humidity_attr;
+- s32 humidity_data;
++ struct {
++ s32 humidity_data;
++ u64 timestamp __aligned(8);
++ } scan;
+ int scale_pre_decml;
+ int scale_post_decml;
+ int scale_precision;
+@@ -138,9 +141,8 @@ static int humidity_proc_event(struct hid_sensor_hub_device *hsdev,
+ struct hid_humidity_state *humid_st = iio_priv(indio_dev);
+
+ if (atomic_read(&humid_st->common_attributes.data_ready))
+- iio_push_to_buffers_with_timestamp(indio_dev,
+- &humid_st->humidity_data,
+- iio_get_time_ns(indio_dev));
++ iio_push_to_buffers_with_timestamp(indio_dev, &humid_st->scan,
++ iio_get_time_ns(indio_dev));
+
+ return 0;
+ }
+@@ -155,7 +157,7 @@ static int humidity_capture_sample(struct hid_sensor_hub_device *hsdev,
+
+ switch (usage_id) {
+ case HID_USAGE_SENSOR_ATMOSPHERIC_HUMIDITY:
+- humid_st->humidity_data = *(s32 *)raw_data;
++ humid_st->scan.humidity_data = *(s32 *)raw_data;
+
+ return 0;
+ default:
+diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
+index 46a569005a138..ec0f50ec813e9 100644
+--- a/drivers/iio/imu/adis16400_core.c
++++ b/drivers/iio/imu/adis16400_core.c
+@@ -288,8 +288,7 @@ static int adis16400_initial_setup(struct iio_dev *indio_dev)
+ if (ret)
+ goto err_ret;
+
+- ret = sscanf(indio_dev->name, "adis%u\n", &device_id);
+- if (ret != 1) {
++ if (sscanf(indio_dev->name, "adis%u\n", &device_id) != 1) {
+ ret = -EINVAL;
+ goto err_ret;
+ }
+diff --git a/drivers/iio/light/hid-sensor-prox.c b/drivers/iio/light/hid-sensor-prox.c
+index cf5a0c242609d..3c25d6bb37648 100644
+--- a/drivers/iio/light/hid-sensor-prox.c
++++ b/drivers/iio/light/hid-sensor-prox.c
+@@ -37,6 +37,9 @@ struct prox_state {
+ struct hid_sensor_common common_attributes;
+ struct hid_sensor_hub_attribute_info prox_attr;
+ u32 human_presence;
++ int scale_pre_decml;
++ int scale_post_decml;
++ int scale_precision;
+ };
+
+ /* Channel definitions */
+@@ -107,8 +110,9 @@ static int prox_read_raw(struct iio_dev *indio_dev,
+ ret_type = IIO_VAL_INT;
+ break;
+ case IIO_CHAN_INFO_SCALE:
+- *val = prox_state->prox_attr.units;
+- ret_type = IIO_VAL_INT;
++ *val = prox_state->scale_pre_decml;
++ *val2 = prox_state->scale_post_decml;
++ ret_type = prox_state->scale_precision;
+ break;
+ case IIO_CHAN_INFO_OFFSET:
+ *val = hid_sensor_convert_exponent(
+@@ -248,6 +252,11 @@ static int prox_parse_report(struct platform_device *pdev,
+ HID_USAGE_SENSOR_HUMAN_PRESENCE,
+ &st->common_attributes.sensitivity);
+
++ st->scale_precision = hid_sensor_format_scale(
++ hsdev->usage,
++ &st->prox_attr,
++ &st->scale_pre_decml, &st->scale_post_decml);
++
+ return ret;
+ }
+
+diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
+index b592fc4f007e4..d710a1a668170 100644
+--- a/drivers/iio/temperature/hid-sensor-temperature.c
++++ b/drivers/iio/temperature/hid-sensor-temperature.c
+@@ -28,7 +28,10 @@
+ struct temperature_state {
+ struct hid_sensor_common common_attributes;
+ struct hid_sensor_hub_attribute_info temperature_attr;
+- s32 temperature_data;
++ struct {
++ s32 temperature_data;
++ u64 timestamp __aligned(8);
++ } scan;
+ int scale_pre_decml;
+ int scale_post_decml;
+ int scale_precision;
+@@ -45,7 +48,7 @@ static const struct iio_chan_spec temperature_channels[] = {
+ BIT(IIO_CHAN_INFO_SAMP_FREQ) |
+ BIT(IIO_CHAN_INFO_HYSTERESIS),
+ },
+- IIO_CHAN_SOFT_TIMESTAMP(3),
++ IIO_CHAN_SOFT_TIMESTAMP(1),
+ };
+
+ /* Adjust channel real bits based on report descriptor */
+@@ -136,9 +139,8 @@ static int temperature_proc_event(struct hid_sensor_hub_device *hsdev,
+ struct temperature_state *temp_st = iio_priv(indio_dev);
+
+ if (atomic_read(&temp_st->common_attributes.data_ready))
+- iio_push_to_buffers_with_timestamp(indio_dev,
+- &temp_st->temperature_data,
+- iio_get_time_ns(indio_dev));
++ iio_push_to_buffers_with_timestamp(indio_dev, &temp_st->scan,
++ iio_get_time_ns(indio_dev));
+
+ return 0;
+ }
+@@ -153,7 +155,7 @@ static int temperature_capture_sample(struct hid_sensor_hub_device *hsdev,
+
+ switch (usage_id) {
+ case HID_USAGE_SENSOR_DATA_ENVIRONMENTAL_TEMPERATURE:
+- temp_st->temperature_data = *(s32 *)raw_data;
++ temp_st->scan.temperature_data = *(s32 *)raw_data;
+ return 0;
+ default:
+ return -EINVAL;
+diff --git a/drivers/misc/lkdtm/Makefile b/drivers/misc/lkdtm/Makefile
+index cce47a15a79f2..aeb960cb096d6 100644
+--- a/drivers/misc/lkdtm/Makefile
++++ b/drivers/misc/lkdtm/Makefile
+@@ -13,7 +13,7 @@ KCOV_INSTRUMENT_rodata.o := n
+
+ OBJCOPYFLAGS :=
+ OBJCOPYFLAGS_rodata_objcopy.o := \
+- --rename-section .text=.rodata,alloc,readonly,load
++ --rename-section .noinstr.text=.rodata,alloc,readonly,load
+ targets += rodata.o rodata_objcopy.o
+ $(obj)/rodata_objcopy.o: $(obj)/rodata.o FORCE
+ $(call if_changed,objcopy)
+diff --git a/drivers/misc/lkdtm/rodata.c b/drivers/misc/lkdtm/rodata.c
+index 58d180af72cf0..baacb876d1d94 100644
+--- a/drivers/misc/lkdtm/rodata.c
++++ b/drivers/misc/lkdtm/rodata.c
+@@ -5,7 +5,7 @@
+ */
+ #include "lkdtm.h"
+
+-void notrace lkdtm_rodata_do_nothing(void)
++void noinstr lkdtm_rodata_do_nothing(void)
+ {
+ /* Does nothing. We just want an architecture agnostic "return". */
+ }
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 134e14e778f8e..8798274dc3ba7 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -644,8 +644,11 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)
+ return ret;
+
+ ctrl->ctrl.queue_count = nr_io_queues + 1;
+- if (ctrl->ctrl.queue_count < 2)
+- return 0;
++ if (ctrl->ctrl.queue_count < 2) {
++ dev_err(ctrl->ctrl.device,
++ "unable to set any I/O queues\n");
++ return -ENOMEM;
++ }
+
+ dev_info(ctrl->ctrl.device,
+ "creating %d I/O queues.\n", nr_io_queues);
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index 2b492ad55f0e4..1a35d73c39c35 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -770,9 +770,20 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl)
+ {
+ lockdep_assert_held(&ctrl->lock);
+
+- if (nvmet_cc_iosqes(ctrl->cc) != NVME_NVM_IOSQES ||
+- nvmet_cc_iocqes(ctrl->cc) != NVME_NVM_IOCQES ||
+- nvmet_cc_mps(ctrl->cc) != 0 ||
++ /*
++ * Only I/O controllers should verify iosqes,iocqes.
++ * Strictly speaking, the spec says a discovery controller
++ * should verify iosqes,iocqes are zeroed, however that
++ * would break backwards compatibility, so don't enforce it.
++ */
++ if (ctrl->subsys->type != NVME_NQN_DISC &&
++ (nvmet_cc_iosqes(ctrl->cc) != NVME_NVM_IOSQES ||
++ nvmet_cc_iocqes(ctrl->cc) != NVME_NVM_IOCQES)) {
++ ctrl->csts = NVME_CSTS_CFS;
++ return;
++ }
++
++ if (nvmet_cc_mps(ctrl->cc) != 0 ||
+ nvmet_cc_ams(ctrl->cc) != 0 ||
+ nvmet_cc_css(ctrl->cc) != 0) {
+ ctrl->csts = NVME_CSTS_CFS;
+diff --git a/drivers/pci/hotplug/rpadlpar_sysfs.c b/drivers/pci/hotplug/rpadlpar_sysfs.c
+index cdbfa5df3a51f..dbfa0b55d31a5 100644
+--- a/drivers/pci/hotplug/rpadlpar_sysfs.c
++++ b/drivers/pci/hotplug/rpadlpar_sysfs.c
+@@ -34,12 +34,11 @@ static ssize_t add_slot_store(struct kobject *kobj, struct kobj_attribute *attr,
+ if (nbytes >= MAX_DRC_NAME_LEN)
+ return 0;
+
+- memcpy(drc_name, buf, nbytes);
++ strscpy(drc_name, buf, nbytes + 1);
+
+ end = strchr(drc_name, '\n');
+- if (!end)
+- end = &drc_name[nbytes];
+- *end = '\0';
++ if (end)
++ *end = '\0';
+
+ rc = dlpar_add_slot(drc_name);
+ if (rc)
+@@ -65,12 +64,11 @@ static ssize_t remove_slot_store(struct kobject *kobj,
+ if (nbytes >= MAX_DRC_NAME_LEN)
+ return 0;
+
+- memcpy(drc_name, buf, nbytes);
++ strscpy(drc_name, buf, nbytes + 1);
+
+ end = strchr(drc_name, '\n');
+- if (!end)
+- end = &drc_name[nbytes];
+- *end = '\0';
++ if (end)
++ *end = '\0';
+
+ rc = dlpar_remove_slot(drc_name);
+ if (rc)
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index f1951c432766d..2c70e311943ac 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -1843,7 +1843,7 @@ lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf,
+ memset(dstbuf, 0, 33);
+ size = (nbytes < 32) ? nbytes : 32;
+ if (copy_from_user(dstbuf, buf, size))
+- return 0;
++ return -EFAULT;
+
+ if (dent == phba->debug_InjErrLBA) {
+ if ((buf[0] == 'o') && (buf[1] == 'f') && (buf[2] == 'f'))
+@@ -1851,7 +1851,7 @@ lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf,
+ }
+
+ if ((tmp == 0) && (kstrtoull(dstbuf, 0, &tmp)))
+- return 0;
++ return -EINVAL;
+
+ if (dent == phba->debug_writeGuard)
+ phba->lpfc_injerr_wgrd_cnt = (uint32_t)tmp;
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 4cfcc73f39790..d85bb3ba8263f 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1077,7 +1077,7 @@ static void collect_langs(struct usb_gadget_strings **sp, __le16 *buf)
+ while (*sp) {
+ s = *sp;
+ language = cpu_to_le16(s->language);
+- for (tmp = buf; *tmp && tmp < &buf[126]; tmp++) {
++ for (tmp = buf; *tmp && tmp < &buf[USB_MAX_STRING_LEN]; tmp++) {
+ if (*tmp == language)
+ goto repeat;
+ }
+@@ -1152,7 +1152,7 @@ static int get_string(struct usb_composite_dev *cdev,
+ collect_langs(sp, s->wData);
+ }
+
+- for (len = 0; len <= 126 && s->wData[len]; len++)
++ for (len = 0; len <= USB_MAX_STRING_LEN && s->wData[len]; len++)
+ continue;
+ if (!len)
+ return -EINVAL;
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 5b8b2ca4376cb..3d4710cc34bc1 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -109,21 +109,27 @@ struct gadget_config_name {
+ struct list_head list;
+ };
+
++#define USB_MAX_STRING_WITH_NULL_LEN (USB_MAX_STRING_LEN+1)
++
+ static int usb_string_copy(const char *s, char **s_copy)
+ {
+ int ret;
+ char *str;
+ char *copy = *s_copy;
+ ret = strlen(s);
+- if (ret > 126)
++ if (ret > USB_MAX_STRING_LEN)
+ return -EOVERFLOW;
+
+- str = kstrdup(s, GFP_KERNEL);
+- if (!str)
+- return -ENOMEM;
++ if (copy) {
++ str = copy;
++ } else {
++ str = kmalloc(USB_MAX_STRING_WITH_NULL_LEN, GFP_KERNEL);
++ if (!str)
++ return -ENOMEM;
++ }
++ strcpy(str, s);
+ if (str[ret - 1] == '\n')
+ str[ret - 1] = '\0';
+- kfree(copy);
+ *s_copy = str;
+ return 0;
+ }
+diff --git a/drivers/usb/gadget/usbstring.c b/drivers/usb/gadget/usbstring.c
+index 7c24d1ce10889..33f77e59aa6fb 100644
+--- a/drivers/usb/gadget/usbstring.c
++++ b/drivers/usb/gadget/usbstring.c
+@@ -55,9 +55,9 @@ usb_gadget_get_string (const struct usb_gadget_strings *table, int id, u8 *buf)
+ return -EINVAL;
+
+ /* string descriptors have length, tag, then UTF16-LE text */
+- len = min ((size_t) 126, strlen (s->s));
++ len = min((size_t)USB_MAX_STRING_LEN, strlen(s->s));
+ len = utf8s_to_utf16s(s->s, len, UTF16_LITTLE_ENDIAN,
+- (wchar_t *) &buf[2], 126);
++ (wchar_t *) &buf[2], USB_MAX_STRING_LEN);
+ if (len < 0)
+ return -EINVAL;
+ buf [0] = (len + 1) * 2;
+diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
+index 96cb0409dd893..737b765d0f6ea 100644
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -651,6 +651,13 @@ void usb_stor_invoke_transport(struct scsi_cmnd *srb, struct us_data *us)
+ need_auto_sense = 1;
+ }
+
++ /* Some devices (Kindle) require another command after SYNC CACHE */
++ if ((us->fflags & US_FL_SENSE_AFTER_SYNC) &&
++ srb->cmnd[0] == SYNCHRONIZE_CACHE) {
++ usb_stor_dbg(us, "-- sense after SYNC CACHE\n");
++ need_auto_sense = 1;
++ }
++
+ /*
+ * If we have a failure, we're going to do a REQUEST_SENSE
+ * automatically. Note that we differentiate between a command
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 88275842219ef..861153d294b67 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2211,6 +2211,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_READ_DISC_INFO ),
+
++/*
++ * Reported by Matthias Schwarzott <zzam@gentoo.org>
++ * The Amazon Kindle treats SYNCHRONIZE CACHE as an indication that
++ * the host may be finished with it, and automatically ejects its
++ * emulated media unless it receives another command within one second.
++ */
++UNUSUAL_DEV( 0x1949, 0x0004, 0x0000, 0x9999,
++ "Amazon",
++ "Kindle",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_SENSE_AFTER_SYNC ),
++
+ /*
+ * Reported by Oliver Neukum <oneukum@suse.com>
+ * This device morphes spontaneously into another device if the access
+diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
+index 741852bd148ea..1bde09e5cb478 100644
+--- a/drivers/usb/usbip/vudc_sysfs.c
++++ b/drivers/usb/usbip/vudc_sysfs.c
+@@ -175,7 +175,7 @@ static ssize_t usbip_sockfd_store(struct device *dev,
+
+ udc->ud.tcp_socket = socket;
+ udc->ud.tcp_rx = tcp_rx;
+- udc->ud.tcp_rx = tcp_tx;
++ udc->ud.tcp_tx = tcp_tx;
+ udc->ud.status = SDEV_ST_USED;
+
+ spin_unlock_irq(&udc->ud.lock);
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 49db37b1f6e36..2bdd24425a683 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1414,7 +1414,9 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+ "failed to read tree block %llu from get_old_root",
+ logical);
+ } else {
++ btrfs_tree_read_lock(old);
+ eb = btrfs_clone_extent_buffer(old);
++ btrfs_tree_read_unlock(old);
+ free_extent_buffer(old);
+ }
+ } else if (old_root) {
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 64d459ca76d06..8c6f619c9ee6a 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -9472,7 +9472,7 @@ int __init btrfs_init_cachep(void)
+
+ btrfs_free_space_bitmap_cachep = kmem_cache_create("btrfs_free_space_bitmap",
+ PAGE_SIZE, PAGE_SIZE,
+- SLAB_RED_ZONE, NULL);
++ SLAB_MEM_SPREAD, NULL);
+ if (!btrfs_free_space_bitmap_cachep)
+ goto fail;
+
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 70412944b267d..59643acb6d679 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -891,9 +891,12 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ /*
+ * Compounding is never used during session establish.
+ */
+- if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP))
++ if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) {
++ mutex_lock(&ses->server->srv_mutex);
+ smb311_update_preauth_hash(ses, rqst[0].rq_iov,
+ rqst[0].rq_nvec);
++ mutex_unlock(&ses->server->srv_mutex);
++ }
+
+ if (timeout == CIFS_ASYNC_OP)
+ goto out;
+@@ -964,7 +967,9 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ .iov_base = resp_iov[0].iov_base,
+ .iov_len = resp_iov[0].iov_len
+ };
++ mutex_lock(&ses->server->srv_mutex);
+ smb311_update_preauth_hash(ses, &iov, 1);
++ mutex_unlock(&ses->server->srv_mutex);
+ }
+
+ out:
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 296ffe92e2503..1c6fd526ea978 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5266,7 +5266,7 @@ static int ext4_do_update_inode(handle_t *handle,
+ struct ext4_inode_info *ei = EXT4_I(inode);
+ struct buffer_head *bh = iloc->bh;
+ struct super_block *sb = inode->i_sb;
+- int err = 0, rc, block;
++ int err = 0, block;
+ int need_datasync = 0, set_large_file = 0;
+ uid_t i_uid;
+ gid_t i_gid;
+@@ -5378,9 +5378,9 @@ static int ext4_do_update_inode(handle_t *handle,
+ bh->b_data);
+
+ BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
+- rc = ext4_handle_dirty_metadata(handle, NULL, bh);
+- if (!err)
+- err = rc;
++ err = ext4_handle_dirty_metadata(handle, NULL, bh);
++ if (err)
++ goto out_brelse;
+ ext4_clear_inode_state(inode, EXT4_STATE_NEW);
+ if (set_large_file) {
+ BUFFER_TRACE(EXT4_SB(sb)->s_sbh, "get write access");
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 0dde6385a1258..5f701d8dce478 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -3440,6 +3440,31 @@ static int ext4_setent(handle_t *handle, struct ext4_renament *ent,
+ return 0;
+ }
+
++static void ext4_resetent(handle_t *handle, struct ext4_renament *ent,
++ unsigned ino, unsigned file_type)
++{
++ struct ext4_renament old = *ent;
++ int retval = 0;
++
++ /*
++ * old->de could have moved from under us during make indexed dir,
++ * so the old->de may no longer valid and need to find it again
++ * before reset old inode info.
++ */
++ old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, NULL);
++ if (IS_ERR(old.bh))
++ retval = PTR_ERR(old.bh);
++ if (!old.bh)
++ retval = -ENOENT;
++ if (retval) {
++ ext4_std_error(old.dir->i_sb, retval);
++ return;
++ }
++
++ ext4_setent(handle, &old, ino, file_type);
++ brelse(old.bh);
++}
++
+ static int ext4_find_delete_entry(handle_t *handle, struct inode *dir,
+ const struct qstr *d_name)
+ {
+@@ -3736,8 +3761,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ end_rename:
+ if (whiteout) {
+ if (retval) {
+- ext4_setent(handle, &old,
+- old.inode->i_ino, old_file_type);
++ ext4_resetent(handle, &old,
++ old.inode->i_ino, old_file_type);
+ drop_nlink(whiteout);
+ }
+ unlock_new_inode(whiteout);
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 899567d74c2a9..4e95b4f8a2ad9 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -2419,7 +2419,7 @@ retry_inode:
+ * external inode if possible.
+ */
+ if (ext4_has_feature_ea_inode(inode->i_sb) &&
+- !i.in_inode) {
++ i.value_len && !i.in_inode) {
+ i.in_inode = 1;
+ goto retry_inode;
+ }
+diff --git a/fs/select.c b/fs/select.c
+index 4a6b6e4b21cb9..11a7051075b4f 100644
+--- a/fs/select.c
++++ b/fs/select.c
+@@ -1003,10 +1003,9 @@ static long do_restart_poll(struct restart_block *restart_block)
+
+ ret = do_sys_poll(ufds, nfds, to);
+
+- if (ret == -EINTR) {
+- restart_block->fn = do_restart_poll;
+- ret = -ERESTART_RESTARTBLOCK;
+- }
++ if (ret == -EINTR)
++ ret = set_restart_fn(restart_block, do_restart_poll);
++
+ return ret;
+ }
+
+@@ -1028,7 +1027,6 @@ SYSCALL_DEFINE3(poll, struct pollfd __user *, ufds, unsigned int, nfds,
+ struct restart_block *restart_block;
+
+ restart_block = ¤t->restart_block;
+- restart_block->fn = do_restart_poll;
+ restart_block->poll.ufds = ufds;
+ restart_block->poll.nfds = nfds;
+
+@@ -1039,7 +1037,7 @@ SYSCALL_DEFINE3(poll, struct pollfd __user *, ufds, unsigned int, nfds,
+ } else
+ restart_block->poll.has_timeout = 0;
+
+- ret = -ERESTART_RESTARTBLOCK;
++ ret = set_restart_fn(restart_block, do_restart_poll);
+ }
+ return ret;
+ }
+diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
+index 849cd8eb5ca06..ea5987bb0b84a 100644
+--- a/include/asm-generic/sections.h
++++ b/include/asm-generic/sections.h
+@@ -53,6 +53,9 @@ extern char __ctors_start[], __ctors_end[];
+ /* Start and end of .opd section - used for function descriptors. */
+ extern char __start_opd[], __end_opd[];
+
++/* Start and end of instrumentation protected text section */
++extern char __noinstr_text_start[], __noinstr_text_end[];
++
+ extern __visible const void __nosave_begin, __nosave_end;
+
+ /* Function descriptor handling (if any). Override in asm/sections.h */
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index 2d632a74cc5e9..88484ee023ca3 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -482,6 +482,15 @@
+ __security_initcall_end = .; \
+ }
+
++/*
++ * Non-instrumentable text section
++ */
++#define NOINSTR_TEXT \
++ ALIGN_FUNCTION(); \
++ __noinstr_text_start = .; \
++ *(.noinstr.text) \
++ __noinstr_text_end = .;
++
+ /*
+ * .text section. Map to function alignment to avoid address changes
+ * during second ld run in second ld pass when generating System.map
+@@ -496,6 +505,7 @@
+ *(TEXT_MAIN .text.fixup) \
+ *(.text.unlikely .text.unlikely.*) \
+ *(.text.unknown .text.unknown.*) \
++ NOINSTR_TEXT \
+ *(.text..refcount) \
+ *(.ref.text) \
+ MEM_KEEP(init.text*) \
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 6b6505e3b2c70..6a53300cbd1ed 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -129,11 +129,65 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ ".pushsection .discard.unreachable\n\t" \
+ ".long 999b - .\n\t" \
+ ".popsection\n\t"
++
++#ifdef CONFIG_DEBUG_ENTRY
++/* Begin/end of an instrumentation safe region */
++#define instrumentation_begin() ({ \
++ asm volatile("%c0:\n\t" \
++ ".pushsection .discard.instr_begin\n\t" \
++ ".long %c0b - .\n\t" \
++ ".popsection\n\t" : : "i" (__COUNTER__)); \
++})
++
++/*
++ * Because instrumentation_{begin,end}() can nest, objtool validation considers
++ * _begin() a +1 and _end() a -1 and computes a sum over the instructions.
++ * When the value is greater than 0, we consider instrumentation allowed.
++ *
++ * There is a problem with code like:
++ *
++ * noinstr void foo()
++ * {
++ * instrumentation_begin();
++ * ...
++ * if (cond) {
++ * instrumentation_begin();
++ * ...
++ * instrumentation_end();
++ * }
++ * bar();
++ * instrumentation_end();
++ * }
++ *
++ * If instrumentation_end() would be an empty label, like all the other
++ * annotations, the inner _end(), which is at the end of a conditional block,
++ * would land on the instruction after the block.
++ *
++ * If we then consider the sum of the !cond path, we'll see that the call to
++ * bar() is with a 0-value, even though, we meant it to happen with a positive
++ * value.
++ *
++ * To avoid this, have _end() be a NOP instruction, this ensures it will be
++ * part of the condition block and does not escape.
++ */
++#define instrumentation_end() ({ \
++ asm volatile("%c0: nop\n\t" \
++ ".pushsection .discard.instr_end\n\t" \
++ ".long %c0b - .\n\t" \
++ ".popsection\n\t" : : "i" (__COUNTER__)); \
++})
++#endif /* CONFIG_DEBUG_ENTRY */
++
+ #else
+ #define annotate_reachable()
+ #define annotate_unreachable()
+ #endif
+
++#ifndef instrumentation_begin
++#define instrumentation_begin() do { } while(0)
++#define instrumentation_end() do { } while(0)
++#endif
++
+ #ifndef ASM_UNREACHABLE
+ # define ASM_UNREACHABLE
+ #endif
+diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
+index 2b8ed70c4c774..c01100318b254 100644
+--- a/include/linux/compiler_types.h
++++ b/include/linux/compiler_types.h
+@@ -234,6 +234,12 @@ struct ftrace_likely_data {
+ #define notrace __attribute__((no_instrument_function))
+ #endif
+
++#if defined(__KERNEL__) && !defined(__ASSEMBLY__)
++/* Section for code which can't be instrumented at all */
++#define noinstr \
++ noinline notrace __attribute((__section__(".noinstr.text")))
++#endif
++
+ /*
+ * it doesn't make sense on ARM (currently the only user of __naked)
+ * to trace naked functions because then mcount is called without
+diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
+index 8d8821b3689a2..62dbecfe91328 100644
+--- a/include/linux/thread_info.h
++++ b/include/linux/thread_info.h
+@@ -11,6 +11,7 @@
+ #include <linux/types.h>
+ #include <linux/bug.h>
+ #include <linux/restart_block.h>
++#include <linux/errno.h>
+
+ #ifdef CONFIG_THREAD_INFO_IN_TASK
+ /*
+@@ -39,6 +40,18 @@ enum {
+
+ #ifdef __KERNEL__
+
++#ifndef arch_set_restart_data
++#define arch_set_restart_data(restart) do { } while (0)
++#endif
++
++static inline long set_restart_fn(struct restart_block *restart,
++ long (*fn)(struct restart_block *))
++{
++ restart->fn = fn;
++ arch_set_restart_data(restart);
++ return -ERESTART_RESTARTBLOCK;
++}
++
+ #ifndef THREAD_ALIGN
+ #define THREAD_ALIGN THREAD_SIZE
+ #endif
+diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
+index a7f7ebdd3069e..0a958c7948324 100644
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -86,6 +86,8 @@
+ /* lies about caching, so always sync */ \
+ US_FLAG(NO_SAME, 0x40000000) \
+ /* Cannot handle WRITE_SAME */ \
++ US_FLAG(SENSE_AFTER_SYNC, 0x80000000) \
++ /* Do REQUEST_SENSE after SYNCHRONIZE_CACHE */ \
+
+ #define US_FLAG(name, value) US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
+diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
+index d5a5caec8fbca..3f376688bd043 100644
+--- a/include/uapi/linux/usb/ch9.h
++++ b/include/uapi/linux/usb/ch9.h
+@@ -364,6 +364,9 @@ struct usb_config_descriptor {
+
+ /*-------------------------------------------------------------------------*/
+
++/* USB String descriptors can contain at most 126 characters. */
++#define USB_MAX_STRING_LEN 126
++
+ /* USB_DT_STRING: String descriptor */
+ struct usb_string_descriptor {
+ __u8 bLength;
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 224adcdac6c19..7d0d8a45f9ae7 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2857,14 +2857,13 @@ retry:
+ goto out;
+
+ restart = ¤t->restart_block;
+- restart->fn = futex_wait_restart;
+ restart->futex.uaddr = uaddr;
+ restart->futex.val = val;
+ restart->futex.time = *abs_time;
+ restart->futex.bitset = bitset;
+ restart->futex.flags = flags | FLAGS_HAS_TIMEOUT;
+
+- ret = -ERESTART_RESTARTBLOCK;
++ ret = set_restart_fn(restart, futex_wait_restart);
+
+ out:
+ if (to) {
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 3b66c77670d9b..c377dbb869f80 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -987,11 +987,15 @@ irq_forced_thread_fn(struct irq_desc *desc, struct irqaction *action)
+ irqreturn_t ret;
+
+ local_bh_disable();
++ if (!IS_ENABLED(CONFIG_PREEMPT_RT_BASE))
++ local_irq_disable();
+ ret = action->thread_fn(action->irq, action->dev_id);
+ if (ret == IRQ_HANDLED)
+ atomic_inc(&desc->threads_handled);
+
+ irq_finalize_oneshot(desc, action);
++ if (!IS_ENABLED(CONFIG_PREEMPT_RT_BASE))
++ local_irq_enable();
+ local_bh_enable();
+ return ret;
+ }
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index 9eece67f29f34..6a2ba39889bd0 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -822,9 +822,9 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags,
+ if (flags == TIMER_ABSTIME)
+ return -ERESTARTNOHAND;
+
+- restart->fn = alarm_timer_nsleep_restart;
+ restart->nanosleep.clockid = type;
+ restart->nanosleep.expires = exp;
++ set_restart_fn(restart, alarm_timer_nsleep_restart);
+ return ret;
+ }
+
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index ccde4dc8462cc..0e04b24cec818 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -1771,9 +1771,9 @@ long hrtimer_nanosleep(const struct timespec64 *rqtp,
+ }
+
+ restart = ¤t->restart_block;
+- restart->fn = hrtimer_nanosleep_restart;
+ restart->nanosleep.clockid = t.timer.base->clockid;
+ restart->nanosleep.expires = hrtimer_get_expires_tv64(&t.timer);
++ set_restart_fn(restart, hrtimer_nanosleep_restart);
+ out:
+ destroy_hrtimer_on_stack(&t.timer);
+ return ret;
+diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
+index d62d7ae5201c5..bfaa44a80c034 100644
+--- a/kernel/time/posix-cpu-timers.c
++++ b/kernel/time/posix-cpu-timers.c
+@@ -1371,8 +1371,8 @@ static int posix_cpu_nsleep(const clockid_t which_clock, int flags,
+ if (flags & TIMER_ABSTIME)
+ return -ERESTARTNOHAND;
+
+- restart_block->fn = posix_cpu_nsleep_restart;
+ restart_block->nanosleep.clockid = which_clock;
++ set_restart_fn(restart_block, posix_cpu_nsleep_restart);
+ }
+ return error;
+ }
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 8f3e1f0a1781d..0c7cacd854e06 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -271,7 +271,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
+ if (len == 0 || len & 3)
+ return -EINVAL;
+
+- skb = netdev_alloc_skb(NULL, len);
++ skb = __netdev_alloc_skb(NULL, len, GFP_ATOMIC | __GFP_NOWARN);
+ if (!skb)
+ return -ENOMEM;
+
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index d65f8d35de87e..11d393c047728 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -1330,7 +1330,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
+
+ sendit:
+ if (svc_authorise(rqstp))
+- goto close;
++ goto close_xprt;
+ return 1; /* Caller can now send it */
+
+ dropit:
+@@ -1339,6 +1339,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
+ return 0;
+
+ close:
++ svc_authorise(rqstp);
++close_xprt:
+ if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ svc_close_xprt(rqstp->rq_xprt);
+ dprintk("svc: svc_process close\n");
+@@ -1347,7 +1349,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
+ err_short_len:
+ svc_printk(rqstp, "short len %zd, dropping request\n",
+ argv->iov_len);
+- goto close;
++ goto close_xprt;
+
+ err_bad_rpc:
+ serv->sv_stats->rpcbadfmt++;
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 709c082dc9059..4b56b949a4637 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -1052,7 +1052,7 @@ static int svc_close_list(struct svc_serv *serv, struct list_head *xprt_list, st
+ struct svc_xprt *xprt;
+ int ret = 0;
+
+- spin_lock(&serv->sv_lock);
++ spin_lock_bh(&serv->sv_lock);
+ list_for_each_entry(xprt, xprt_list, xpt_list) {
+ if (xprt->xpt_net != net)
+ continue;
+@@ -1060,7 +1060,7 @@ static int svc_close_list(struct svc_serv *serv, struct list_head *xprt_list, st
+ set_bit(XPT_CLOSE, &xprt->xpt_flags);
+ svc_xprt_enqueue(xprt);
+ }
+- spin_unlock(&serv->sv_lock);
++ spin_unlock_bh(&serv->sv_lock);
+ return ret;
+ }
+
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+index d183d4aee822c..cf2272a90f133 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+@@ -308,9 +308,9 @@ xprt_setup_rdma_bc(struct xprt_create *args)
+ xprt->timeout = &xprt_rdma_bc_timeout;
+ xprt_set_bound(xprt);
+ xprt_set_connected(xprt);
+- xprt->bind_timeout = RPCRDMA_BIND_TO;
+- xprt->reestablish_timeout = RPCRDMA_INIT_REEST_TO;
+- xprt->idle_timeout = RPCRDMA_IDLE_DISC_TO;
++ xprt->bind_timeout = 0;
++ xprt->reestablish_timeout = 0;
++ xprt->idle_timeout = 0;
+
+ xprt->prot = XPRT_TRANSPORT_BC_RDMA;
+ xprt->tsh_size = 0;
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 91a80036c05d5..7c693bd775c1b 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -895,7 +895,7 @@ static void check_section(const char *modname, struct elf_info *elf,
+
+ #define DATA_SECTIONS ".data", ".data.rel"
+ #define TEXT_SECTIONS ".text", ".text.unlikely", ".sched.text", \
+- ".kprobes.text", ".cpuidle.text"
++ ".kprobes.text", ".cpuidle.text", ".noinstr.text"
+ #define OTHER_TEXT_SECTIONS ".ref.text", ".head.text", ".spinlock.text", \
+ ".fixup", ".entry.text", ".exception.text", ".text.*", \
+ ".coldtext"
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 0a196be90b2e5..b9f7b23ae3789 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -4029,7 +4029,7 @@ int snd_hda_gen_add_micmute_led(struct hda_codec *codec,
+
+ spec->micmute_led.led_mode = MICMUTE_LED_FOLLOW_MUTE;
+ spec->micmute_led.capture = 0;
+- spec->micmute_led.led_value = 0;
++ spec->micmute_led.led_value = -1;
+ spec->micmute_led.old_hook = spec->cap_sync_hook;
+ spec->micmute_led.update = hook;
+ spec->cap_sync_hook = update_micmute_led;
+diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c
+index 3bd57c02e6fd8..0b35b84abb611 100644
+--- a/sound/soc/codecs/ak4458.c
++++ b/sound/soc/codecs/ak4458.c
+@@ -642,6 +642,7 @@ static const struct of_device_id ak4458_of_match[] = {
+ { .compatible = "asahi-kasei,ak4458", },
+ { },
+ };
++MODULE_DEVICE_TABLE(of, ak4458_of_match);
+
+ static struct i2c_driver ak4458_i2c_driver = {
+ .driver = {
+diff --git a/sound/soc/codecs/ak5558.c b/sound/soc/codecs/ak5558.c
+index 448bb90c9c8e0..73c418517f8d4 100644
+--- a/sound/soc/codecs/ak5558.c
++++ b/sound/soc/codecs/ak5558.c
+@@ -396,6 +396,7 @@ static const struct of_device_id ak5558_i2c_dt_ids[] = {
+ { .compatible = "asahi-kasei,ak5558"},
+ { }
+ };
++MODULE_DEVICE_TABLE(of, ak5558_i2c_dt_ids);
+
+ static struct i2c_driver ak5558_i2c_driver = {
+ .driver = {
+diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
+index 0e2bdad373d66..d6a1573b457af 100644
+--- a/sound/soc/fsl/fsl_ssi.c
++++ b/sound/soc/fsl/fsl_ssi.c
+@@ -873,6 +873,7 @@ static int fsl_ssi_hw_free(struct snd_pcm_substream *substream,
+ static int _fsl_ssi_set_dai_fmt(struct fsl_ssi *ssi, unsigned int fmt)
+ {
+ u32 strcr = 0, scr = 0, stcr, srcr, mask;
++ unsigned int slots;
+
+ ssi->dai_fmt = fmt;
+
+@@ -904,10 +905,11 @@ static int _fsl_ssi_set_dai_fmt(struct fsl_ssi *ssi, unsigned int fmt)
+ return -EINVAL;
+ }
+
++ slots = ssi->slots ? : 2;
+ regmap_update_bits(ssi->regs, REG_SSI_STCCR,
+- SSI_SxCCR_DC_MASK, SSI_SxCCR_DC(2));
++ SSI_SxCCR_DC_MASK, SSI_SxCCR_DC(slots));
+ regmap_update_bits(ssi->regs, REG_SSI_SRCCR,
+- SSI_SxCCR_DC_MASK, SSI_SxCCR_DC(2));
++ SSI_SxCCR_DC_MASK, SSI_SxCCR_DC(slots));
+
+ /* Data on rising edge of bclk, frame low, 1clk before data */
+ strcr |= SSI_STCR_TFSI | SSI_STCR_TSCKP | SSI_STCR_TEFS;
+diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
+index 7c17f17ea2cd2..7f91b6013ddc7 100644
+--- a/tools/build/Makefile.feature
++++ b/tools/build/Makefile.feature
+@@ -31,8 +31,11 @@ FEATURE_TESTS_BASIC := \
+ backtrace \
+ dwarf \
+ dwarf_getlocations \
++ eventfd \
+ fortify-source \
+ sync-compare-and-swap \
++ get_current_dir_name \
++ gettid \
+ glibc \
+ gtk2 \
+ gtk2-infobar \
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index c4845b66b9baa..6df574750bc9c 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -5,8 +5,10 @@ FILES= \
+ test-bionic.bin \
+ test-dwarf.bin \
+ test-dwarf_getlocations.bin \
++ test-eventfd.bin \
+ test-fortify-source.bin \
+ test-sync-compare-and-swap.bin \
++ test-get_current_dir_name.bin \
+ test-glibc.bin \
+ test-gtk2.bin \
+ test-gtk2-infobar.bin \
+@@ -52,6 +54,7 @@ FILES= \
+ test-get_cpuid.bin \
+ test-sdt.bin \
+ test-cxx.bin \
++ test-gettid.bin \
+ test-jvmti.bin \
+ test-sched_getcpu.bin \
+ test-setns.bin \
+@@ -99,6 +102,12 @@ $(OUTPUT)test-bionic.bin:
+ $(OUTPUT)test-libelf.bin:
+ $(BUILD) -lelf
+
++$(OUTPUT)test-eventfd.bin:
++ $(BUILD)
++
++$(OUTPUT)test-get_current_dir_name.bin:
++ $(BUILD)
++
+ $(OUTPUT)test-glibc.bin:
+ $(BUILD)
+
+@@ -254,6 +263,9 @@ $(OUTPUT)test-sdt.bin:
+ $(OUTPUT)test-cxx.bin:
+ $(BUILDXX) -std=gnu++11
+
++$(OUTPUT)test-gettid.bin:
++ $(BUILD)
++
+ $(OUTPUT)test-jvmti.bin:
+ $(BUILD)
+
+diff --git a/tools/build/feature/test-all.c b/tools/build/feature/test-all.c
+index 8dc20a61341f6..8282bbe547c4e 100644
+--- a/tools/build/feature/test-all.c
++++ b/tools/build/feature/test-all.c
+@@ -34,6 +34,14 @@
+ # include "test-libelf-mmap.c"
+ #undef main
+
++#define main main_test_get_current_dir_name
++# include "test-get_current_dir_name.c"
++#undef main
++
++#define main main_test_gettid
++# include "test-gettid.c"
++#undef main
++
+ #define main main_test_glibc
+ # include "test-glibc.c"
+ #undef main
+@@ -46,6 +54,10 @@
+ # include "test-dwarf_getlocations.c"
+ #undef main
+
++#define main main_test_eventfd
++# include "test-eventfd.c"
++#undef main
++
+ #define main main_test_libelf_getphdrnum
+ # include "test-libelf-getphdrnum.c"
+ #undef main
+@@ -174,9 +186,12 @@ int main(int argc, char *argv[])
+ main_test_hello();
+ main_test_libelf();
+ main_test_libelf_mmap();
++ main_test_get_current_dir_name();
++ main_test_gettid();
+ main_test_glibc();
+ main_test_dwarf();
+ main_test_dwarf_getlocations();
++ main_test_eventfd();
+ main_test_libelf_getphdrnum();
+ main_test_libelf_gelf_getnote();
+ main_test_libelf_getshdrstrndx();
+diff --git a/tools/build/feature/test-eventfd.c b/tools/build/feature/test-eventfd.c
+new file mode 100644
+index 0000000000000..f4de7ef00ccb6
+--- /dev/null
++++ b/tools/build/feature/test-eventfd.c
+@@ -0,0 +1,9 @@
++// SPDX-License-Identifier: GPL-2.0
++// Copyright (C) 2018, Red Hat Inc, Arnaldo Carvalho de Melo <acme@redhat.com>
++
++#include <sys/eventfd.h>
++
++int main(void)
++{
++ return eventfd(0, EFD_NONBLOCK);
++}
+diff --git a/tools/build/feature/test-get_current_dir_name.c b/tools/build/feature/test-get_current_dir_name.c
+new file mode 100644
+index 0000000000000..573000f932124
+--- /dev/null
++++ b/tools/build/feature/test-get_current_dir_name.c
+@@ -0,0 +1,10 @@
++// SPDX-License-Identifier: GPL-2.0
++#define _GNU_SOURCE
++#include <unistd.h>
++#include <stdlib.h>
++
++int main(void)
++{
++ free(get_current_dir_name());
++ return 0;
++}
+diff --git a/tools/build/feature/test-gettid.c b/tools/build/feature/test-gettid.c
+new file mode 100644
+index 0000000000000..ef24e42d3f1b8
+--- /dev/null
++++ b/tools/build/feature/test-gettid.c
+@@ -0,0 +1,11 @@
++// SPDX-License-Identifier: GPL-2.0
++// Copyright (C) 2019, Red Hat Inc, Arnaldo Carvalho de Melo <acme@redhat.com>
++#define _GNU_SOURCE
++#include <unistd.h>
++
++int main(void)
++{
++ return gettid();
++}
++
++#undef _GNU_SOURCE
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index ae0c5bee80140..a328beb9f505c 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -310,6 +310,18 @@ ifndef NO_BIONIC
+ endif
+ endif
+
++ifeq ($(feature-eventfd), 1)
++ CFLAGS += -DHAVE_EVENTFD
++endif
++
++ifeq ($(feature-get_current_dir_name), 1)
++ CFLAGS += -DHAVE_GET_CURRENT_DIR_NAME
++endif
++
++ifeq ($(feature-gettid), 1)
++ CFLAGS += -DHAVE_GETTID
++endif
++
+ ifdef NO_LIBELF
+ NO_DWARF := 1
+ NO_DEMANGLE := 1
+diff --git a/tools/perf/jvmti/jvmti_agent.c b/tools/perf/jvmti/jvmti_agent.c
+index f7eb63cbbc655..88108598d6e94 100644
+--- a/tools/perf/jvmti/jvmti_agent.c
++++ b/tools/perf/jvmti/jvmti_agent.c
+@@ -45,10 +45,12 @@
+ static char jit_path[PATH_MAX];
+ static void *marker_addr;
+
++#ifndef HAVE_GETTID
+ static inline pid_t gettid(void)
+ {
+ return (pid_t)syscall(__NR_gettid);
+ }
++#endif
+
+ static int get_e_machine(struct jitheader *hdr)
+ {
+diff --git a/tools/perf/util/Build b/tools/perf/util/Build
+index 7efe15b9618d0..4eaac6aaaefef 100644
+--- a/tools/perf/util/Build
++++ b/tools/perf/util/Build
+@@ -10,6 +10,7 @@ libperf-y += evlist.o
+ libperf-y += evsel.o
+ libperf-y += evsel_fprintf.o
+ libperf-y += find_bit.o
++libperf-y += get_current_dir_name.o
+ libperf-y += kallsyms.o
+ libperf-y += levenshtein.o
+ libperf-y += llvm-utils.o
+diff --git a/tools/perf/util/expr.y b/tools/perf/util/expr.y
+index 432b8560cf51c..e7bd19c384aed 100644
+--- a/tools/perf/util/expr.y
++++ b/tools/perf/util/expr.y
+@@ -10,7 +10,8 @@
+ #define MAXIDLEN 256
+ %}
+
+-%pure-parser
++%define api.pure full
++
+ %parse-param { double *final_val }
+ %parse-param { struct parse_ctx *ctx }
+ %parse-param { const char **pp }
+diff --git a/tools/perf/util/get_current_dir_name.c b/tools/perf/util/get_current_dir_name.c
+new file mode 100644
+index 0000000000000..267aa609a5823
+--- /dev/null
++++ b/tools/perf/util/get_current_dir_name.c
+@@ -0,0 +1,18 @@
++// SPDX-License-Identifier: GPL-2.0
++// Copyright (C) 2018, Red Hat Inc, Arnaldo Carvalho de Melo <acme@redhat.com>
++//
++#ifndef HAVE_GET_CURRENT_DIR_NAME
++#include "util.h"
++#include <unistd.h>
++#include <stdlib.h>
++#include <stdlib.h>
++
++/* Android's 'bionic' library, for one, doesn't have this */
++
++char *get_current_dir_name(void)
++{
++ char pwd[PATH_MAX];
++
++ return getcwd(pwd, sizeof(pwd)) == NULL ? NULL : strdup(pwd);
++}
++#endif // HAVE_GET_CURRENT_DIR_NAME
+diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
+index da8fe57691b8c..8d7578be708a2 100644
+--- a/tools/perf/util/parse-events.y
++++ b/tools/perf/util/parse-events.y
+@@ -1,4 +1,4 @@
+-%pure-parser
++%define api.pure full
+ %parse-param {void *_parse_state}
+ %parse-param {void *scanner}
+ %lex-param {void* scanner}
+diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h
+index 8c01b2cfdb1ad..2efec9e77753b 100644
+--- a/tools/perf/util/util.h
++++ b/tools/perf/util/util.h
+@@ -57,6 +57,10 @@ int fetch_kernel_version(unsigned int *puint,
+
+ const char *perf_tip(const char *dirpath);
+
++#ifndef HAVE_GET_CURRENT_DIR_NAME
++char *get_current_dir_name(void);
++#endif
++
+ #ifndef HAVE_SCHED_GETCPU_SUPPORT
+ int sched_getcpu(void);
+ #endif
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-03-30 14:17 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-03-30 14:17 UTC (permalink / raw
To: gentoo-commits
commit: b8333a8735d3dfe948c35ef9664ea592d0a3d659
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 30 14:17:29 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Mar 30 14:17:29 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b8333a87
Linux patch 4.19.184
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1183_linux-4.19.184.patch | 2060 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2064 insertions(+)
diff --git a/0000_README b/0000_README
index d06c180..51936a2 100644
--- a/0000_README
+++ b/0000_README
@@ -771,6 +771,10 @@ Patch: 1182_linux-4.19.183.patch
From: https://www.kernel.org
Desc: Linux 4.19.183
+Patch: 1183_linux-4.19.184.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.184
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1183_linux-4.19.184.patch b/1183_linux-4.19.184.patch
new file mode 100644
index 0000000..ad28fd3
--- /dev/null
+++ b/1183_linux-4.19.184.patch
@@ -0,0 +1,2060 @@
+diff --git a/Makefile b/Makefile
+index 9347445b2027b..8a3821f74b54e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 183
++SUBLEVEL = 184
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/at91-sama5d27_som1.dtsi b/arch/arm/boot/dts/at91-sama5d27_som1.dtsi
+index cf0087b4c9e18..ea02a51c71e23 100644
+--- a/arch/arm/boot/dts/at91-sama5d27_som1.dtsi
++++ b/arch/arm/boot/dts/at91-sama5d27_som1.dtsi
+@@ -67,8 +67,8 @@
+ pinctrl-0 = <&pinctrl_macb0_default>;
+ phy-mode = "rmii";
+
+- ethernet-phy@0 {
+- reg = <0x0>;
++ ethernet-phy@7 {
++ reg = <0x7>;
+ interrupt-parent = <&pioA>;
+ interrupts = <PIN_PD31 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
+index 5da732f82fa0c..712264e4e26ec 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
+@@ -177,6 +177,7 @@
+ ranges = <0x0 0x00 0x1700000 0x100000>;
+ reg = <0x00 0x1700000 0x0 0x100000>;
+ interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>;
++ dma-coherent;
+
+ sec_jr0: jr@10000 {
+ compatible = "fsl,sec-v5.4-job-ring",
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
+index b9c0f2de8f12c..3ec60e33f2997 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
+@@ -237,6 +237,7 @@
+ ranges = <0x0 0x00 0x1700000 0x100000>;
+ reg = <0x00 0x1700000 0x0 0x100000>;
+ interrupts = <0 75 0x4>;
++ dma-coherent;
+
+ sec_jr0: jr@10000 {
+ compatible = "fsl,sec-v5.4-job-ring",
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
+index f4eb4d3b6cabf..3452971a8e1c2 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
+@@ -243,6 +243,7 @@
+ ranges = <0x0 0x00 0x1700000 0x100000>;
+ reg = <0x00 0x1700000 0x0 0x100000>;
+ interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>;
++ dma-coherent;
+
+ sec_jr0: jr@10000 {
+ compatible = "fsl,sec-v5.4-job-ring",
+diff --git a/arch/arm64/kernel/crash_dump.c b/arch/arm64/kernel/crash_dump.c
+index f46d57c314430..76905a2585505 100644
+--- a/arch/arm64/kernel/crash_dump.c
++++ b/arch/arm64/kernel/crash_dump.c
+@@ -67,5 +67,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
+ ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos)
+ {
+ memcpy(buf, phys_to_virt((phys_addr_t)*ppos), count);
++ *ppos += count;
++
+ return count;
+ }
+diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
+index 1d0b875fec44f..ec909eec0b4c6 100644
+--- a/arch/ia64/include/asm/syscall.h
++++ b/arch/ia64/include/asm/syscall.h
+@@ -35,7 +35,7 @@ static inline void syscall_rollback(struct task_struct *task,
+ static inline long syscall_get_error(struct task_struct *task,
+ struct pt_regs *regs)
+ {
+- return regs->r10 == -1 ? regs->r8:0;
++ return regs->r10 == -1 ? -regs->r8:0;
+ }
+
+ static inline long syscall_get_return_value(struct task_struct *task,
+diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
+index 427cd565fd61d..799400287cdac 100644
+--- a/arch/ia64/kernel/ptrace.c
++++ b/arch/ia64/kernel/ptrace.c
+@@ -2147,27 +2147,39 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data)
+ {
+ struct syscall_get_set_args *args = data;
+ struct pt_regs *pt = args->regs;
+- unsigned long *krbs, cfm, ndirty;
++ unsigned long *krbs, cfm, ndirty, nlocals, nouts;
+ int i, count;
+
+ if (unw_unwind_to_user(info) < 0)
+ return;
+
++ /*
++ * We get here via a few paths:
++ * - break instruction: cfm is shared with caller.
++ * syscall args are in out= regs, locals are non-empty.
++ * - epsinstruction: cfm is set by br.call
++ * locals don't exist.
++ *
++ * For both cases argguments are reachable in cfm.sof - cfm.sol.
++ * CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ]
++ */
+ cfm = pt->cr_ifs;
++ nlocals = (cfm >> 7) & 0x7f; /* aka sol */
++ nouts = (cfm & 0x7f) - nlocals; /* aka sof - sol */
+ krbs = (unsigned long *)info->task + IA64_RBS_OFFSET/8;
+ ndirty = ia64_rse_num_regs(krbs, krbs + (pt->loadrs >> 19));
+
+ count = 0;
+ if (in_syscall(pt))
+- count = min_t(int, args->n, cfm & 0x7f);
++ count = min_t(int, args->n, nouts);
+
++ /* Iterate over outs. */
+ for (i = 0; i < count; i++) {
++ int j = ndirty + nlocals + i + args->i;
+ if (args->rw)
+- *ia64_rse_skip_regs(krbs, ndirty + i + args->i) =
+- args->args[i];
++ *ia64_rse_skip_regs(krbs, j) = args->args[i];
+ else
+- args->args[i] = *ia64_rse_skip_regs(krbs,
+- ndirty + i + args->i);
++ args->args[i] = *ia64_rse_skip_regs(krbs, j);
+ }
+
+ if (!args->rw) {
+diff --git a/arch/powerpc/include/asm/dcr-native.h b/arch/powerpc/include/asm/dcr-native.h
+index 151dff555f503..9d9e323f5e9b5 100644
+--- a/arch/powerpc/include/asm/dcr-native.h
++++ b/arch/powerpc/include/asm/dcr-native.h
+@@ -66,8 +66,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)
+ #define mfdcr(rn) \
+ ({unsigned int rval; \
+ if (__builtin_constant_p(rn) && rn < 1024) \
+- asm volatile("mfdcr %0," __stringify(rn) \
+- : "=r" (rval)); \
++ asm volatile("mfdcr %0, %1" : "=r" (rval) \
++ : "n" (rn)); \
+ else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \
+ rval = mfdcrx(rn); \
+ else \
+@@ -77,8 +77,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)
+ #define mtdcr(rn, v) \
+ do { \
+ if (__builtin_constant_p(rn) && rn < 1024) \
+- asm volatile("mtdcr " __stringify(rn) ",%0" \
+- : : "r" (v)); \
++ asm volatile("mtdcr %0, %1" \
++ : : "n" (rn), "r" (v)); \
+ else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \
+ mtdcrx(rn, v); \
+ else \
+diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
+index aa624ed79db1a..86879c28910b7 100644
+--- a/arch/sparc/kernel/traps_64.c
++++ b/arch/sparc/kernel/traps_64.c
+@@ -274,14 +274,13 @@ bool is_no_fault_exception(struct pt_regs *regs)
+ asi = (regs->tstate >> 24); /* saved %asi */
+ else
+ asi = (insn >> 5); /* immediate asi */
+- if ((asi & 0xf2) == ASI_PNF) {
+- if (insn & 0x1000000) { /* op3[5:4]=3 */
+- handle_ldf_stq(insn, regs);
+- return true;
+- } else if (insn & 0x200000) { /* op3[2], stores */
++ if ((asi & 0xf6) == ASI_PNF) {
++ if (insn & 0x200000) /* op3[2], stores */
+ return false;
+- }
+- handle_ld_nf(insn, regs);
++ if (insn & 0x1000000) /* op3[5:4]=3 (fp) */
++ handle_ldf_stq(insn, regs);
++ else
++ handle_ld_nf(insn, regs);
+ return true;
+ }
+ }
+diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
+index 006f373f54aba..c0499c38962ba 100644
+--- a/arch/x86/mm/mem_encrypt.c
++++ b/arch/x86/mm/mem_encrypt.c
+@@ -228,7 +228,7 @@ static void __init __set_clr_pte_enc(pte_t *kpte, int level, bool enc)
+ if (pgprot_val(old_prot) == pgprot_val(new_prot))
+ return;
+
+- pa = pfn << page_level_shift(level);
++ pa = pfn << PAGE_SHIFT;
+ size = page_level_size(level);
+
+ /*
+diff --git a/block/genhd.c b/block/genhd.c
+index aee2fa9de1a7d..27a410d310870 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -623,10 +623,8 @@ static void register_disk(struct device *parent, struct gendisk *disk,
+ disk->part0.holder_dir = kobject_create_and_add("holders", &ddev->kobj);
+ disk->slave_dir = kobject_create_and_add("slaves", &ddev->kobj);
+
+- if (disk->flags & GENHD_FL_HIDDEN) {
+- dev_set_uevent_suppress(ddev, 0);
++ if (disk->flags & GENHD_FL_HIDDEN)
+ return;
+- }
+
+ /* No minors to use for partitions */
+ if (!disk_part_scan_enabled(disk))
+diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
+index 6def196cc23cf..913613cf5c53f 100644
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -18,6 +18,8 @@
+ #ifndef _ACPI_INTERNAL_H_
+ #define _ACPI_INTERNAL_H_
+
++#include <linux/idr.h>
++
+ #define PREFIX "ACPI: "
+
+ int early_acpi_osi_init(void);
+@@ -97,9 +99,11 @@ void acpi_scan_table_handler(u32 event, void *table, void *context);
+
+ extern struct list_head acpi_bus_id_list;
+
++#define ACPI_MAX_DEVICE_INSTANCES 4096
++
+ struct acpi_device_bus_id {
+ const char *bus_id;
+- unsigned int instance_no;
++ struct ida instance_ida;
+ struct list_head node;
+ };
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index d614cb72041e1..d3c551bdc2dac 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -482,9 +482,8 @@ static void acpi_device_del(struct acpi_device *device)
+ list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node)
+ if (!strcmp(acpi_device_bus_id->bus_id,
+ acpi_device_hid(device))) {
+- if (acpi_device_bus_id->instance_no > 0)
+- acpi_device_bus_id->instance_no--;
+- else {
++ ida_simple_remove(&acpi_device_bus_id->instance_ida, device->pnp.instance_no);
++ if (ida_is_empty(&acpi_device_bus_id->instance_ida)) {
+ list_del(&acpi_device_bus_id->node);
+ kfree_const(acpi_device_bus_id->bus_id);
+ kfree(acpi_device_bus_id);
+@@ -623,12 +622,38 @@ void acpi_bus_put_acpi_device(struct acpi_device *adev)
+ put_device(&adev->dev);
+ }
+
++static struct acpi_device_bus_id *acpi_device_bus_id_match(const char *dev_id)
++{
++ struct acpi_device_bus_id *acpi_device_bus_id;
++
++ /* Find suitable bus_id and instance number in acpi_bus_id_list. */
++ list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) {
++ if (!strcmp(acpi_device_bus_id->bus_id, dev_id))
++ return acpi_device_bus_id;
++ }
++ return NULL;
++}
++
++static int acpi_device_set_name(struct acpi_device *device,
++ struct acpi_device_bus_id *acpi_device_bus_id)
++{
++ struct ida *instance_ida = &acpi_device_bus_id->instance_ida;
++ int result;
++
++ result = ida_simple_get(instance_ida, 0, ACPI_MAX_DEVICE_INSTANCES, GFP_KERNEL);
++ if (result < 0)
++ return result;
++
++ device->pnp.instance_no = result;
++ dev_set_name(&device->dev, "%s:%02x", acpi_device_bus_id->bus_id, result);
++ return 0;
++}
++
+ int acpi_device_add(struct acpi_device *device,
+ void (*release)(struct device *))
+ {
++ struct acpi_device_bus_id *acpi_device_bus_id;
+ int result;
+- struct acpi_device_bus_id *acpi_device_bus_id, *new_bus_id;
+- int found = 0;
+
+ if (device->handle) {
+ acpi_status status;
+@@ -654,41 +679,38 @@ int acpi_device_add(struct acpi_device *device,
+ INIT_LIST_HEAD(&device->del_list);
+ mutex_init(&device->physical_node_lock);
+
+- new_bus_id = kzalloc(sizeof(struct acpi_device_bus_id), GFP_KERNEL);
+- if (!new_bus_id) {
+- pr_err(PREFIX "Memory allocation error\n");
+- result = -ENOMEM;
+- goto err_detach;
+- }
+-
+ mutex_lock(&acpi_device_lock);
+- /*
+- * Find suitable bus_id and instance number in acpi_bus_id_list
+- * If failed, create one and link it into acpi_bus_id_list
+- */
+- list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) {
+- if (!strcmp(acpi_device_bus_id->bus_id,
+- acpi_device_hid(device))) {
+- acpi_device_bus_id->instance_no++;
+- found = 1;
+- kfree(new_bus_id);
+- break;
++
++ acpi_device_bus_id = acpi_device_bus_id_match(acpi_device_hid(device));
++ if (acpi_device_bus_id) {
++ result = acpi_device_set_name(device, acpi_device_bus_id);
++ if (result)
++ goto err_unlock;
++ } else {
++ acpi_device_bus_id = kzalloc(sizeof(*acpi_device_bus_id),
++ GFP_KERNEL);
++ if (!acpi_device_bus_id) {
++ result = -ENOMEM;
++ goto err_unlock;
+ }
+- }
+- if (!found) {
+- acpi_device_bus_id = new_bus_id;
+ acpi_device_bus_id->bus_id =
+ kstrdup_const(acpi_device_hid(device), GFP_KERNEL);
+ if (!acpi_device_bus_id->bus_id) {
+- pr_err(PREFIX "Memory allocation error for bus id\n");
++ kfree(acpi_device_bus_id);
+ result = -ENOMEM;
+- goto err_free_new_bus_id;
++ goto err_unlock;
++ }
++
++ ida_init(&acpi_device_bus_id->instance_ida);
++
++ result = acpi_device_set_name(device, acpi_device_bus_id);
++ if (result) {
++ kfree(acpi_device_bus_id);
++ goto err_unlock;
+ }
+
+- acpi_device_bus_id->instance_no = 0;
+ list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list);
+ }
+- dev_set_name(&device->dev, "%s:%02x", acpi_device_bus_id->bus_id, acpi_device_bus_id->instance_no);
+
+ if (device->parent)
+ list_add_tail(&device->node, &device->parent->children);
+@@ -720,13 +742,9 @@ int acpi_device_add(struct acpi_device *device,
+ list_del(&device->node);
+ list_del(&device->wakeup_list);
+
+- err_free_new_bus_id:
+- if (!found)
+- kfree(new_bus_id);
+-
++ err_unlock:
+ mutex_unlock(&acpi_device_lock);
+
+- err_detach:
+ acpi_detach_data(device->handle, acpi_scan_drop_device);
+ return result;
+ }
+diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
+index 38fec976e62d4..1409d48affb70 100644
+--- a/drivers/atm/eni.c
++++ b/drivers/atm/eni.c
+@@ -2279,7 +2279,8 @@ out:
+ return rc;
+
+ err_eni_release:
+- eni_do_release(dev);
++ dev->phy = NULL;
++ iounmap(ENI_DEV(dev)->ioaddr);
+ err_unregister:
+ atm_dev_deregister(dev);
+ err_free_consistent:
+diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c
+index 0a67487c0b1d3..a2ecb4190f789 100644
+--- a/drivers/atm/idt77105.c
++++ b/drivers/atm/idt77105.c
+@@ -261,7 +261,7 @@ static int idt77105_start(struct atm_dev *dev)
+ {
+ unsigned long flags;
+
+- if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
++ if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
+ return -ENOMEM;
+ PRIV(dev)->dev = dev;
+ spin_lock_irqsave(&idt77105_priv_lock, flags);
+@@ -336,7 +336,7 @@ static int idt77105_stop(struct atm_dev *dev)
+ else
+ idt77105_all = walk->next;
+ dev->phy = NULL;
+- dev->dev_data = NULL;
++ dev->phy_data = NULL;
+ kfree(walk);
+ break;
+ }
+diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
+index 5f8e009b2da1c..34e6e4b90f741 100644
+--- a/drivers/atm/lanai.c
++++ b/drivers/atm/lanai.c
+@@ -2238,6 +2238,7 @@ static int lanai_dev_open(struct atm_dev *atmdev)
+ conf1_write(lanai);
+ #endif
+ iounmap(lanai->base);
++ lanai->base = NULL;
+ error_pci:
+ pci_disable_device(lanai->pci);
+ error:
+@@ -2250,6 +2251,8 @@ static int lanai_dev_open(struct atm_dev *atmdev)
+ static void lanai_dev_close(struct atm_dev *atmdev)
+ {
+ struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data;
++ if (lanai->base==NULL)
++ return;
+ printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n",
+ lanai->number);
+ lanai_timed_poll_stop(lanai);
+@@ -2559,7 +2562,7 @@ static int lanai_init_one(struct pci_dev *pci,
+ struct atm_dev *atmdev;
+ int result;
+
+- lanai = kmalloc(sizeof(*lanai), GFP_KERNEL);
++ lanai = kzalloc(sizeof(*lanai), GFP_KERNEL);
+ if (lanai == NULL) {
+ printk(KERN_ERR DEV_LABEL
+ ": couldn't allocate dev_data structure!\n");
+diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
+index 4fa13a8078739..cf517fd148ea1 100644
+--- a/drivers/atm/uPD98402.c
++++ b/drivers/atm/uPD98402.c
+@@ -210,7 +210,7 @@ static void uPD98402_int(struct atm_dev *dev)
+ static int uPD98402_start(struct atm_dev *dev)
+ {
+ DPRINTK("phy_start\n");
+- if (!(dev->dev_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL)))
++ if (!(dev->phy_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL)))
+ return -ENOMEM;
+ spin_lock_init(&PRIV(dev)->lock);
+ memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats));
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index 208f3eea3641f..d98cfd3b64ff0 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -944,7 +944,7 @@ next:
+ out:
+ for (i = last_map; i < num; i++) {
+ /* Don't zap current batch's valid persistent grants. */
+- if(i >= last_map + segs_to_map)
++ if(i >= map_until)
+ pages[i]->persistent_gnt = NULL;
+ pages[i]->handle = BLKBACK_INVALID_HANDLE;
+ }
+diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c
+index b040447575adc..dcfb32ee5cb60 100644
+--- a/drivers/bus/omap_l3_noc.c
++++ b/drivers/bus/omap_l3_noc.c
+@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev)
+ */
+ l3->debug_irq = platform_get_irq(pdev, 0);
+ ret = devm_request_irq(l3->dev, l3->debug_irq, l3_interrupt_handler,
+- 0x0, "l3-dbg-irq", l3);
++ IRQF_NO_THREAD, "l3-dbg-irq", l3);
+ if (ret) {
+ dev_err(l3->dev, "request_irq failed for %d\n",
+ l3->debug_irq);
+@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev)
+
+ l3->app_irq = platform_get_irq(pdev, 1);
+ ret = devm_request_irq(l3->dev, l3->app_irq, l3_interrupt_handler,
+- 0x0, "l3-app-irq", l3);
++ IRQF_NO_THREAD, "l3-app-irq", l3);
+ if (ret)
+ dev_err(l3->dev, "request_irq failed for %d\n", l3->app_irq);
+
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 18f5973b9697f..4ad34c6803ade 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -177,7 +177,7 @@ static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio,
+ int ret, value;
+
+ ret = request_threaded_irq(event->irq, NULL, event->handler,
+- event->irqflags, "ACPI:Event", event);
++ event->irqflags | IRQF_ONESHOT, "ACPI:Event", event);
+ if (ret) {
+ dev_err(acpi_gpio->chip->parent,
+ "Failed to setup interrupt handler for %d\n",
+diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
+index e44e567bd7892..a050a9aa9a5e5 100644
+--- a/drivers/gpu/drm/Kconfig
++++ b/drivers/gpu/drm/Kconfig
+@@ -192,6 +192,7 @@ source "drivers/gpu/drm/arm/Kconfig"
+ config DRM_RADEON
+ tristate "ATI Radeon"
+ depends on DRM && PCI && MMU
++ depends on AGP || !AGP
+ select FW_LOADER
+ select DRM_KMS_HELPER
+ select DRM_TTM
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 81de5e1659551..08ff9d7645d74 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -1363,6 +1363,10 @@ static int msm_pdev_remove(struct platform_device *pdev)
+ static void msm_pdev_shutdown(struct platform_device *pdev)
+ {
+ struct drm_device *drm = platform_get_drvdata(pdev);
++ struct msm_drm_private *priv = drm ? drm->dev_private : NULL;
++
++ if (!priv || !priv->kms)
++ return;
+
+ drm_atomic_helper_shutdown(drm);
+ }
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 3fd3dfa3478b7..b728a1bf916f4 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -3517,13 +3517,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id)
+ ep->com.local_addr.ss_family == AF_INET) {
+ err = cxgb4_remove_server_filter(
+ ep->com.dev->rdev.lldi.ports[0], ep->stid,
+- ep->com.dev->rdev.lldi.rxq_ids[0], 0);
++ ep->com.dev->rdev.lldi.rxq_ids[0], false);
+ } else {
+ struct sockaddr_in6 *sin6;
+ c4iw_init_wr_wait(ep->com.wr_waitp);
+ err = cxgb4_remove_server(
+ ep->com.dev->rdev.lldi.ports[0], ep->stid,
+- ep->com.dev->rdev.lldi.rxq_ids[0], 0);
++ ep->com.dev->rdev.lldi.rxq_ids[0], true);
+ if (err)
+ goto done;
+ err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp,
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index 439277f48ff8b..17cbad58834fc 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -529,7 +529,7 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
+ * Grab our output buffer.
+ */
+ nl = orig_nl = get_result_buffer(param, param_size, &len);
+- if (len < needed) {
++ if (len < needed || len < sizeof(nl->dev)) {
+ param->flags |= DM_BUFFER_FULL_FLAG;
+ goto out;
+ }
+diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
+index 599be2d2b0ae9..fa8c201fca778 100644
+--- a/drivers/md/dm-verity-target.c
++++ b/drivers/md/dm-verity-target.c
+@@ -34,7 +34,7 @@
+ #define DM_VERITY_OPT_IGN_ZEROES "ignore_zero_blocks"
+ #define DM_VERITY_OPT_AT_MOST_ONCE "check_at_most_once"
+
+-#define DM_VERITY_OPTS_MAX (2 + DM_VERITY_OPTS_FEC)
++#define DM_VERITY_OPTS_MAX (3 + DM_VERITY_OPTS_FEC)
+
+ static unsigned dm_verity_prefetch_cluster = DM_VERITY_DEFAULT_PREFETCH_SIZE;
+
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 24c6015f6c92b..2278c5fff5c69 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = {
+ .brp_inc = 1,
+ };
+
+-static inline void c_can_pm_runtime_enable(const struct c_can_priv *priv)
+-{
+- if (priv->device)
+- pm_runtime_enable(priv->device);
+-}
+-
+-static inline void c_can_pm_runtime_disable(const struct c_can_priv *priv)
+-{
+- if (priv->device)
+- pm_runtime_disable(priv->device);
+-}
+-
+ static inline void c_can_pm_runtime_get_sync(const struct c_can_priv *priv)
+ {
+ if (priv->device)
+@@ -1318,7 +1306,6 @@ static const struct net_device_ops c_can_netdev_ops = {
+
+ int register_c_can_dev(struct net_device *dev)
+ {
+- struct c_can_priv *priv = netdev_priv(dev);
+ int err;
+
+ /* Deactivate pins to prevent DRA7 DCAN IP from being
+@@ -1328,28 +1315,19 @@ int register_c_can_dev(struct net_device *dev)
+ */
+ pinctrl_pm_select_sleep_state(dev->dev.parent);
+
+- c_can_pm_runtime_enable(priv);
+-
+ dev->flags |= IFF_ECHO; /* we support local echo */
+ dev->netdev_ops = &c_can_netdev_ops;
+
+ err = register_candev(dev);
+- if (err)
+- c_can_pm_runtime_disable(priv);
+- else
++ if (!err)
+ devm_can_led_init(dev);
+-
+ return err;
+ }
+ EXPORT_SYMBOL_GPL(register_c_can_dev);
+
+ void unregister_c_can_dev(struct net_device *dev)
+ {
+- struct c_can_priv *priv = netdev_priv(dev);
+-
+ unregister_candev(dev);
+-
+- c_can_pm_runtime_disable(priv);
+ }
+ EXPORT_SYMBOL_GPL(unregister_c_can_dev);
+
+diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c
+index 406b4847e5dc3..7efb60b508762 100644
+--- a/drivers/net/can/c_can/c_can_pci.c
++++ b/drivers/net/can/c_can/c_can_pci.c
+@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev)
+ {
+ struct net_device *dev = pci_get_drvdata(pdev);
+ struct c_can_priv *priv = netdev_priv(dev);
++ void __iomem *addr = priv->base;
+
+ unregister_c_can_dev(dev);
+
+ free_c_can_dev(dev);
+
+- pci_iounmap(pdev, priv->base);
++ pci_iounmap(pdev, addr);
+ pci_disable_msi(pdev);
+ pci_clear_master(pdev);
+ pci_release_regions(pdev);
+diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
+index b5145a7f874c2..f2b0408ce87d1 100644
+--- a/drivers/net/can/c_can/c_can_platform.c
++++ b/drivers/net/can/c_can/c_can_platform.c
+@@ -29,6 +29,7 @@
+ #include <linux/list.h>
+ #include <linux/io.h>
+ #include <linux/platform_device.h>
++#include <linux/pm_runtime.h>
+ #include <linux/clk.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+@@ -385,6 +386,7 @@ static int c_can_plat_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, dev);
+ SET_NETDEV_DEV(dev, &pdev->dev);
+
++ pm_runtime_enable(priv->device);
+ ret = register_c_can_dev(dev);
+ if (ret) {
+ dev_err(&pdev->dev, "registering %s failed (err=%d)\n",
+@@ -397,6 +399,7 @@ static int c_can_plat_probe(struct platform_device *pdev)
+ return 0;
+
+ exit_free_device:
++ pm_runtime_disable(priv->device);
+ free_c_can_dev(dev);
+ exit:
+ dev_err(&pdev->dev, "probe failed\n");
+@@ -407,9 +410,10 @@ exit:
+ static int c_can_plat_remove(struct platform_device *pdev)
+ {
+ struct net_device *dev = platform_get_drvdata(pdev);
++ struct c_can_priv *priv = netdev_priv(dev);
+
+ unregister_c_can_dev(dev);
+-
++ pm_runtime_disable(priv->device);
+ free_c_can_dev(dev);
+
+ return 0;
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 1bd181b33c24f..8738d37f72737 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -1235,6 +1235,7 @@ static void can_dellink(struct net_device *dev, struct list_head *head)
+
+ static struct rtnl_link_ops can_link_ops __read_mostly = {
+ .kind = "can",
++ .netns_refund = true,
+ .maxtype = IFLA_CAN_MAX,
+ .policy = can_policy,
+ .setup = can_setup,
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index cb6bc20585428..d4dfa0247ebbc 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -422,9 +422,15 @@ static int flexcan_chip_disable(struct flexcan_priv *priv)
+ static int flexcan_chip_freeze(struct flexcan_priv *priv)
+ {
+ struct flexcan_regs __iomem *regs = priv->regs;
+- unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate;
++ unsigned int timeout;
++ u32 bitrate = priv->can.bittiming.bitrate;
+ u32 reg;
+
++ if (bitrate)
++ timeout = 1000 * 1000 * 10 / bitrate;
++ else
++ timeout = FLEXCAN_TIMEOUT_US / 10;
++
+ reg = priv->read(®s->mcr);
+ reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT;
+ priv->write(reg, ®s->mcr);
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index fbb970220c2d7..e87c3bb820817 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -520,9 +520,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota)
+ }
+
+ while ((rxfs & RXFS_FFL_MASK) && (quota > 0)) {
+- if (rxfs & RXFS_RFL)
+- netdev_warn(dev, "Rx FIFO 0 Message Lost\n");
+-
+ m_can_read_fifo(dev, rxfs);
+
+ quota--;
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index e9fe3897bd9cc..3deda0321c00d 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -482,8 +482,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port)
+ * in bits 15:8 and the patch level in bits 7:0 which is exactly what
+ * the REG_PHY_REVISION register layout is.
+ */
+-
+- return priv->hw_params.gphy_rev;
++ if (priv->int_phy_mask & BIT(port))
++ return priv->hw_params.gphy_rev;
++ else
++ return 0;
+ }
+
+ static void bcm_sf2_sw_validate(struct dsa_switch *ds, int port,
+diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
+index acf27c3952865..964407deca350 100644
+--- a/drivers/net/ethernet/faraday/ftgmac100.c
++++ b/drivers/net/ethernet/faraday/ftgmac100.c
+@@ -1333,6 +1333,7 @@ static int ftgmac100_poll(struct napi_struct *napi, int budget)
+ */
+ if (unlikely(priv->need_mac_restart)) {
+ ftgmac100_start_hw(priv);
++ priv->need_mac_restart = false;
+
+ /* Re-enable "bad" interrupts */
+ iowrite32(FTGMAC100_INT_BAD,
+diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
+index 7e892b1cbd3de..09a762eb4f09e 100644
+--- a/drivers/net/ethernet/freescale/fec_ptp.c
++++ b/drivers/net/ethernet/freescale/fec_ptp.c
+@@ -382,9 +382,16 @@ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
+ u64 ns;
+ unsigned long flags;
+
++ mutex_lock(&adapter->ptp_clk_mutex);
++ /* Check the ptp clock */
++ if (!adapter->ptp_clk_on) {
++ mutex_unlock(&adapter->ptp_clk_mutex);
++ return -EINVAL;
++ }
+ spin_lock_irqsave(&adapter->tmreg_lock, flags);
+ ns = timecounter_read(&adapter->tc);
+ spin_unlock_irqrestore(&adapter->tmreg_lock, flags);
++ mutex_unlock(&adapter->ptp_clk_mutex);
+
+ *ts = ns_to_timespec64(ns);
+
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index 8db0924ec681c..df03cf63cb026 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -2940,6 +2940,10 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
+ if (lstatus & BD_LFLAG(RXBD_LAST))
+ size -= skb->len;
+
++ WARN(size < 0, "gianfar: rx fragment size underflow");
++ if (size < 0)
++ return false;
++
+ skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+ rxb->page_offset + RXBUF_ALIGNMENT,
+ size, GFAR_RXB_TRUESIZE);
+@@ -3101,6 +3105,17 @@ int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, int rx_work_limit)
+ if (lstatus & BD_LFLAG(RXBD_EMPTY))
+ break;
+
++ /* lost RXBD_LAST descriptor due to overrun */
++ if (skb &&
++ (lstatus & BD_LFLAG(RXBD_FIRST))) {
++ /* discard faulty buffer */
++ dev_kfree_skb(skb);
++ skb = NULL;
++ rx_queue->stats.rx_dropped++;
++
++ /* can continue normally */
++ }
++
+ /* order rx buffer descriptor reads */
+ rmb();
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 4de65a9de0a63..b7fe3e849872e 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1677,8 +1677,10 @@ static int hns_nic_clear_all_rx_fetch(struct net_device *ndev)
+ for (j = 0; j < fetch_num; j++) {
+ /* alloc one skb and init */
+ skb = hns_assemble_skb(ndev);
+- if (!skb)
++ if (!skb) {
++ ret = -ENOMEM;
+ goto out;
++ }
+ rd = &tx_ring_data(priv, skb->queue_mapping);
+ hns_nic_net_xmit_hw(ndev, skb, rd);
+
+diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
+index b9309302c29e5..16653e94009e1 100644
+--- a/drivers/net/ethernet/intel/e1000e/82571.c
++++ b/drivers/net/ethernet/intel/e1000e/82571.c
+@@ -899,6 +899,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active)
+ } else {
+ data &= ~IGP02E1000_PM_D0_LPLU;
+ ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data);
++ if (ret_val)
++ return ret_val;
+ /* LPLU and SmartSpeed are mutually exclusive. LPLU is used
+ * during Dx states where the power conservation is most
+ * important. During driver activity we should enable
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 7216825e049c2..6bbe7afdf30c4 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -5922,15 +5922,19 @@ static void e1000_reset_task(struct work_struct *work)
+ struct e1000_adapter *adapter;
+ adapter = container_of(work, struct e1000_adapter, reset_task);
+
++ rtnl_lock();
+ /* don't run the task if already down */
+- if (test_bit(__E1000_DOWN, &adapter->state))
++ if (test_bit(__E1000_DOWN, &adapter->state)) {
++ rtnl_unlock();
+ return;
++ }
+
+ if (!(adapter->flags & FLAG_RESTART_NOW)) {
+ e1000e_dump(adapter);
+ e_err("Reset adapter unexpectedly\n");
+ }
+ e1000e_reinit_locked(adapter);
++ rtnl_unlock();
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index faee77fa08044..8fcd3ffb43e00 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -9487,8 +9487,10 @@ static int ixgbe_configure_clsu32(struct ixgbe_adapter *adapter,
+ ixgbe_atr_compute_perfect_hash_82599(&input->filter, mask);
+ err = ixgbe_fdir_write_perfect_filter_82599(hw, &input->filter,
+ input->sw_idx, queue);
+- if (!err)
+- ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
++ if (err)
++ goto err_out_w_lock;
++
++ ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
+ spin_unlock(&adapter->fdir_perfect_lock);
+
+ if ((uhtid != 0x800) && (adapter->jump_tables[uhtid]))
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index a383276eb816a..3d824c20d2a46 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1460,6 +1460,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev,
+ {
+ struct mlx5e_priv *priv = netdev_priv(netdev);
+ struct mlx5_core_dev *mdev = priv->mdev;
++ int err;
+
+ if (!MLX5_CAP_GEN(mdev, cqe_compression))
+ return -EOPNOTSUPP;
+@@ -1469,7 +1470,10 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev,
+ return -EINVAL;
+ }
+
+- mlx5e_modify_rx_cqe_compression_locked(priv, enable);
++ err = mlx5e_modify_rx_cqe_compression_locked(priv, enable);
++ if (err)
++ return err;
++
+ priv->channels.params.rx_cqe_compress_def = enable;
+
+ return 0;
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+index f34ae8c75bc5e..61a39d167c8bc 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+@@ -1426,6 +1426,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)
+
+ if (fw_dump->tmpl_hdr == NULL || current_version > prev_version) {
+ vfree(fw_dump->tmpl_hdr);
++ fw_dump->tmpl_hdr = NULL;
+
+ if (qlcnic_83xx_md_check_extended_dump_capability(adapter))
+ extended = !qlcnic_83xx_extend_md_capab(adapter);
+@@ -1444,6 +1445,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)
+ struct qlcnic_83xx_dump_template_hdr *hdr;
+
+ hdr = fw_dump->tmpl_hdr;
++ if (!hdr)
++ return;
+ hdr->drv_cap_mask = 0x1f;
+ fw_dump->cap_mask = 0x1f;
+ dev_info(&pdev->dev,
+diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
+index 027367b9cc480..3693a59b6d010 100644
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -1386,14 +1386,17 @@ static int netsec_netdev_init(struct net_device *ndev)
+ goto err1;
+
+ /* set phy power down */
+- data = netsec_phy_read(priv->mii_bus, priv->phy_addr, MII_BMCR) |
+- BMCR_PDOWN;
+- netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR, data);
++ data = netsec_phy_read(priv->mii_bus, priv->phy_addr, MII_BMCR);
++ netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR,
++ data | BMCR_PDOWN);
+
+ ret = netsec_reset_hardware(priv, true);
+ if (ret)
+ goto err2;
+
++ /* Restore phy power state */
++ netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR, data);
++
+ return 0;
+ err2:
+ netsec_free_dring(priv, NETSEC_RING_RX);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index 1e5e831718dbd..4382deaeb570d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -1179,6 +1179,8 @@ static int sun8i_dwmac_probe(struct platform_device *pdev)
+ plat_dat->init = sun8i_dwmac_init;
+ plat_dat->exit = sun8i_dwmac_exit;
+ plat_dat->setup = sun8i_dwmac_setup;
++ plat_dat->tx_fifo_size = 4096;
++ plat_dat->rx_fifo_size = 16384;
+
+ ret = sun8i_dwmac_init(pdev, plat_dat->bsp_priv);
+ if (ret)
+diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
+index d84501441edde..602a2025717ab 100644
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -3933,8 +3933,6 @@ static void niu_xmac_interrupt(struct niu *np)
+ mp->rx_mcasts += RXMAC_MC_FRM_CNT_COUNT;
+ if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP)
+ mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT;
+- if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP)
+- mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT;
+ if (val & XRXMAC_STATUS_RXHIST1_CNT_EXP)
+ mp->rx_hist_cnt1 += RXMAC_HIST_CNT1_COUNT;
+ if (val & XRXMAC_STATUS_RXHIST2_CNT_EXP)
+diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
+index dc966ddb6d815..358f911fcd9d5 100644
+--- a/drivers/net/ethernet/tehuti/tehuti.c
++++ b/drivers/net/ethernet/tehuti/tehuti.c
+@@ -2056,6 +2056,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /*bdx_hw_reset(priv); */
+ if (bdx_read_mac(priv)) {
+ pr_err("load MAC address failed\n");
++ err = -EFAULT;
+ goto err_out_iomap;
+ }
+ SET_NETDEV_DEV(ndev, &pdev->dev);
+diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
+index 78b16eb9e58c8..f448e484a341f 100644
+--- a/drivers/net/usb/cdc-phonet.c
++++ b/drivers/net/usb/cdc-phonet.c
+@@ -400,6 +400,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i
+
+ err = register_netdev(dev);
+ if (err) {
++ /* Set disconnected flag so that disconnect() returns early. */
++ pnd->disconnected = 1;
+ usb_driver_release_interface(&usbpn_driver, data_intf);
+ goto out;
+ }
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 7dc6055855354..a27ea04cfa6c3 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -2593,29 +2593,6 @@ static void __rtl_set_wol(struct r8152 *tp, u32 wolopts)
+ device_set_wakeup_enable(&tp->udev->dev, false);
+ }
+
+-static void r8153_mac_clk_spd(struct r8152 *tp, bool enable)
+-{
+- /* MAC clock speed down */
+- if (enable) {
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL,
+- ALDPS_SPDWN_RATIO);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2,
+- EEE_SPDWN_RATIO);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3,
+- PKT_AVAIL_SPDWN_EN | SUSPEND_SPDWN_EN |
+- U1U2_SPDWN_EN | L1_SPDWN_EN);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4,
+- PWRSAVE_SPDWN_EN | RXDV_SPDWN_EN | TX10MIDLE_EN |
+- TP100_SPDWN_EN | TP500_SPDWN_EN | EEE_SPDWN_EN |
+- TP1000_SPDWN_EN);
+- } else {
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
+- }
+-}
+-
+ static void r8153_u1u2en(struct r8152 *tp, bool enable)
+ {
+ u8 u1u2[8];
+@@ -2847,11 +2824,9 @@ static void rtl8153_runtime_enable(struct r8152 *tp, bool enable)
+ if (enable) {
+ r8153_u1u2en(tp, false);
+ r8153_u2p3en(tp, false);
+- r8153_mac_clk_spd(tp, true);
+ rtl_runtime_suspend_enable(tp, true);
+ } else {
+ rtl_runtime_suspend_enable(tp, false);
+- r8153_mac_clk_spd(tp, false);
+
+ switch (tp->version) {
+ case RTL_VER_03:
+@@ -3413,7 +3388,6 @@ static void r8153_first_init(struct r8152 *tp)
+ u32 ocp_data;
+ int i;
+
+- r8153_mac_clk_spd(tp, false);
+ rxdy_gated_en(tp, true);
+ r8153_teredo_off(tp);
+
+@@ -3475,8 +3449,6 @@ static void r8153_enter_oob(struct r8152 *tp)
+ u32 ocp_data;
+ int i;
+
+- r8153_mac_clk_spd(tp, true);
+-
+ ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
+ ocp_data &= ~NOW_IS_OOB;
+ ocp_write_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL, ocp_data);
+@@ -4141,9 +4113,14 @@ static void r8153_init(struct r8152 *tp)
+
+ ocp_write_word(tp, MCU_TYPE_USB, USB_CONNECT_TIMER, 0x0001);
+
++ /* MAC clock speed down */
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0);
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0);
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
++
+ r8153_power_cut_en(tp, false);
+ r8153_u1u2en(tp, true);
+- r8153_mac_clk_spd(tp, false);
+ usb_enable_lpm(tp->udev);
+
+ /* rx aggregation */
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c
+index 2abbad1abaf2e..fd1843fd256bb 100644
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -197,8 +197,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (rxq < rcv->real_num_rx_queues) {
+ rq = &rcv_priv->rq[rxq];
+ rcv_xdp = rcu_access_pointer(rq->xdp_prog);
+- if (rcv_xdp)
+- skb_record_rx_queue(skb, rxq);
++ skb_record_rx_queue(skb, rxq);
+ }
+
+ if (likely(veth_forward_skb(rcv, skb, rq, rcv_xdp) == NET_RX_SUCCESS)) {
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index 9ab04ef532f34..5df6e85e7ccb7 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -201,14 +201,18 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ priv->rx_skbuff = kcalloc(priv->rx_ring_size,
+ sizeof(*priv->rx_skbuff),
+ GFP_KERNEL);
+- if (!priv->rx_skbuff)
++ if (!priv->rx_skbuff) {
++ ret = -ENOMEM;
+ goto free_ucc_pram;
++ }
+
+ priv->tx_skbuff = kcalloc(priv->tx_ring_size,
+ sizeof(*priv->tx_skbuff),
+ GFP_KERNEL);
+- if (!priv->tx_skbuff)
++ if (!priv->tx_skbuff) {
++ ret = -ENOMEM;
+ goto free_rx_skbuff;
++ }
+
+ priv->skb_curtx = 0;
+ priv->skb_dirtytx = 0;
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index cf8587f96fc45..772f9ae3d7e92 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -46,8 +46,16 @@ static const struct key_entry intel_vbtn_keymap[] = {
+ };
+
+ static const struct key_entry intel_vbtn_switchmap[] = {
+- { KE_SW, 0xCA, { .sw = { SW_DOCK, 1 } } }, /* Docked */
+- { KE_SW, 0xCB, { .sw = { SW_DOCK, 0 } } }, /* Undocked */
++ /*
++ * SW_DOCK should only be reported for docking stations, but DSDTs using the
++ * intel-vbtn code, always seem to use this for 2-in-1s / convertibles and set
++ * SW_DOCK=1 when in laptop-mode (in tandem with setting SW_TABLET_MODE=0).
++ * This causes userspace to think the laptop is docked to a port-replicator
++ * and to disable suspend-on-lid-close, which is undesirable.
++ * Map the dock events to KEY_IGNORE to avoid this broken SW_DOCK reporting.
++ */
++ { KE_IGNORE, 0xCA, { .sw = { SW_DOCK, 1 } } }, /* Docked */
++ { KE_IGNORE, 0xCB, { .sw = { SW_DOCK, 0 } } }, /* Undocked */
+ { KE_SW, 0xCC, { .sw = { SW_TABLET_MODE, 1 } } }, /* Tablet */
+ { KE_SW, 0xCD, { .sw = { SW_TABLET_MODE, 0 } } }, /* Laptop */
+ };
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 07959047d4dc4..447ac667f4b2b 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -6629,14 +6629,18 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
+ ioc->pend_os_device_add_sz++;
+ ioc->pend_os_device_add = kzalloc(ioc->pend_os_device_add_sz,
+ GFP_KERNEL);
+- if (!ioc->pend_os_device_add)
++ if (!ioc->pend_os_device_add) {
++ r = -ENOMEM;
+ goto out_free_resources;
++ }
+
+ ioc->device_remove_in_progress_sz = ioc->pend_os_device_add_sz;
+ ioc->device_remove_in_progress =
+ kzalloc(ioc->device_remove_in_progress_sz, GFP_KERNEL);
+- if (!ioc->device_remove_in_progress)
++ if (!ioc->device_remove_in_progress) {
++ r = -ENOMEM;
+ goto out_free_resources;
++ }
+
+ ioc->fwfault_debug = mpt3sas_fwfault_debug;
+
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index e201c163ea1c8..fe26144d390a9 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -1559,6 +1559,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
+ if (!qedi->global_queues[i]) {
+ QEDI_ERR(&qedi->dbg_ctx,
+ "Unable to allocation global queue %d.\n", i);
++ status = -ENOMEM;
+ goto mem_alloc_failure;
+ }
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 4e95b4f8a2ad9..0cd9b84bdd9db 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1480,6 +1480,9 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
+ if (!ce)
+ return NULL;
+
++ WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) &&
++ !(current->flags & PF_MEMALLOC_NOFS));
++
+ ea_data = ext4_kvmalloc(value_len, GFP_NOFS);
+ if (!ea_data) {
+ mb_cache_entry_put(ea_inode_cache, ce);
+@@ -2346,6 +2349,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
+ error = -ENOSPC;
+ goto cleanup;
+ }
++ WARN_ON_ONCE(!(current->flags & PF_MEMALLOC_NOFS));
+ }
+
+ error = ext4_reserve_inode_write(handle, inode, &is.iloc);
+diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
+index ac3e06367cb68..e55f86713948b 100644
+--- a/fs/nfs/Kconfig
++++ b/fs/nfs/Kconfig
+@@ -127,7 +127,7 @@ config PNFS_BLOCK
+ config PNFS_FLEXFILE_LAYOUT
+ tristate
+ depends on NFS_V4_1 && NFS_V3
+- default m
++ default NFS_V4
+
+ config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN
+ string "NFSv4.1 Implementation ID Domain"
+diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
+index 9956453aa6ffc..0ed419bb02b0f 100644
+--- a/fs/nfs/nfs3xdr.c
++++ b/fs/nfs/nfs3xdr.c
+@@ -34,6 +34,7 @@
+ */
+ #define NFS3_fhandle_sz (1+16)
+ #define NFS3_fh_sz (NFS3_fhandle_sz) /* shorthand */
++#define NFS3_post_op_fh_sz (1+NFS3_fh_sz)
+ #define NFS3_sattr_sz (15)
+ #define NFS3_filename_sz (1+(NFS3_MAXNAMLEN>>2))
+ #define NFS3_path_sz (1+(NFS3_MAXPATHLEN>>2))
+@@ -71,7 +72,7 @@
+ #define NFS3_readlinkres_sz (1+NFS3_post_op_attr_sz+1)
+ #define NFS3_readres_sz (1+NFS3_post_op_attr_sz+3)
+ #define NFS3_writeres_sz (1+NFS3_wcc_data_sz+4)
+-#define NFS3_createres_sz (1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
++#define NFS3_createres_sz (1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
+ #define NFS3_renameres_sz (1+(2 * NFS3_wcc_data_sz))
+ #define NFS3_linkres_sz (1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
+ #define NFS3_readdirres_sz (1+NFS3_post_op_attr_sz+2)
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index d63b248582d1a..bcad052db0650 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5535,6 +5535,9 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl
+ unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE);
+ int ret, i;
+
++ /* You can't remove system.nfs4_acl: */
++ if (buflen == 0)
++ return -EINVAL;
+ if (!nfs4_server_supports_acls(server))
+ return -EOPNOTSUPP;
+ if (npages > ARRAY_SIZE(pages))
+diff --git a/fs/squashfs/export.c b/fs/squashfs/export.c
+index d2a806416c3ab..1d406a2094a56 100644
+--- a/fs/squashfs/export.c
++++ b/fs/squashfs/export.c
+@@ -165,14 +165,18 @@ __le64 *squashfs_read_inode_lookup_table(struct super_block *sb,
+ start = le64_to_cpu(table[n]);
+ end = le64_to_cpu(table[n + 1]);
+
+- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
++ if (start >= end
++ || (end - start) >
++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ kfree(table);
+ return ERR_PTR(-EINVAL);
+ }
+ }
+
+ start = le64_to_cpu(table[indexes - 1]);
+- if (start >= lookup_table_start || (lookup_table_start - start) > SQUASHFS_METADATA_SIZE) {
++ if (start >= lookup_table_start ||
++ (lookup_table_start - start) >
++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ kfree(table);
+ return ERR_PTR(-EINVAL);
+ }
+diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c
+index 8ccc0e3f6ea5a..d2e15baab5378 100644
+--- a/fs/squashfs/id.c
++++ b/fs/squashfs/id.c
+@@ -110,14 +110,16 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb,
+ start = le64_to_cpu(table[n]);
+ end = le64_to_cpu(table[n + 1]);
+
+- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
++ if (start >= end || (end - start) >
++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ kfree(table);
+ return ERR_PTR(-EINVAL);
+ }
+ }
+
+ start = le64_to_cpu(table[indexes - 1]);
+- if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) {
++ if (start >= id_table_start || (id_table_start - start) >
++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ kfree(table);
+ return ERR_PTR(-EINVAL);
+ }
+diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h
+index 4e6853f084d07..10e93345b6153 100644
+--- a/fs/squashfs/squashfs_fs.h
++++ b/fs/squashfs/squashfs_fs.h
+@@ -30,6 +30,7 @@
+
+ /* size of metadata (inode and directory) blocks */
+ #define SQUASHFS_METADATA_SIZE 8192
++#define SQUASHFS_BLOCK_OFFSET 2
+
+ /* default size of block device I/O */
+ #ifdef CONFIG_SQUASHFS_4K_DEVBLK_SIZE
+diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c
+index 3a655d879600c..7f718d2bf3579 100644
+--- a/fs/squashfs/xattr_id.c
++++ b/fs/squashfs/xattr_id.c
+@@ -122,14 +122,16 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
+ start = le64_to_cpu(table[n]);
+ end = le64_to_cpu(table[n + 1]);
+
+- if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
++ if (start >= end || (end - start) >
++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ kfree(table);
+ return ERR_PTR(-EINVAL);
+ }
+ }
+
+ start = le64_to_cpu(table[indexes - 1]);
+- if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) {
++ if (start >= table_start || (table_start - start) >
++ (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ kfree(table);
+ return ERR_PTR(-EINVAL);
+ }
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index d9773df60a360..8b19618bad0a0 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -248,6 +248,7 @@ struct acpi_pnp_type {
+
+ struct acpi_device_pnp {
+ acpi_bus_id bus_id; /* Object name */
++ int instance_no; /* Instance number of this object */
+ struct acpi_pnp_type type; /* ID type */
+ acpi_bus_address bus_address; /* _ADR */
+ char *unique_id; /* _UID */
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 16f6beef5cad7..3b3337333cfd6 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -382,7 +382,7 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
+ struct bpf_prog *include_prog,
+ struct bpf_prog_array **new_array);
+
+-#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null) \
++#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null, set_cg_storage) \
+ ({ \
+ struct bpf_prog_array_item *_item; \
+ struct bpf_prog *_prog; \
+@@ -395,7 +395,8 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
+ goto _out; \
+ _item = &_array->items[0]; \
+ while ((_prog = READ_ONCE(_item->prog))) { \
+- bpf_cgroup_storage_set(_item->cgroup_storage); \
++ if (set_cg_storage) \
++ bpf_cgroup_storage_set(_item->cgroup_storage); \
+ _ret &= func(_prog, ctx); \
+ _item++; \
+ } \
+@@ -406,10 +407,10 @@ _out: \
+ })
+
+ #define BPF_PROG_RUN_ARRAY(array, ctx, func) \
+- __BPF_PROG_RUN_ARRAY(array, ctx, func, false)
++ __BPF_PROG_RUN_ARRAY(array, ctx, func, false, true)
+
+ #define BPF_PROG_RUN_ARRAY_CHECK(array, ctx, func) \
+- __BPF_PROG_RUN_ARRAY(array, ctx, func, true)
++ __BPF_PROG_RUN_ARRAY(array, ctx, func, true, false)
+
+ #ifdef CONFIG_BPF_SYSCALL
+ DECLARE_PER_CPU(int, bpf_prog_active);
+diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
+index 2e55e4cdbd8aa..1261559d70b41 100644
+--- a/include/linux/if_macvlan.h
++++ b/include/linux/if_macvlan.h
+@@ -43,13 +43,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan,
+ if (likely(success)) {
+ struct vlan_pcpu_stats *pcpu_stats;
+
+- pcpu_stats = this_cpu_ptr(vlan->pcpu_stats);
++ pcpu_stats = get_cpu_ptr(vlan->pcpu_stats);
+ u64_stats_update_begin(&pcpu_stats->syncp);
+ pcpu_stats->rx_packets++;
+ pcpu_stats->rx_bytes += len;
+ if (multicast)
+ pcpu_stats->rx_multicast++;
+ u64_stats_update_end(&pcpu_stats->syncp);
++ put_cpu_ptr(vlan->pcpu_stats);
+ } else {
+ this_cpu_inc(vlan->pcpu_stats->rx_errors);
+ }
+diff --git a/include/linux/mutex.h b/include/linux/mutex.h
+index 3093dd1624243..8f7cdf83f3592 100644
+--- a/include/linux/mutex.h
++++ b/include/linux/mutex.h
+@@ -184,7 +184,7 @@ extern void mutex_lock_io(struct mutex *lock);
+ # define mutex_lock_interruptible_nested(lock, subclass) mutex_lock_interruptible(lock)
+ # define mutex_lock_killable_nested(lock, subclass) mutex_lock_killable(lock)
+ # define mutex_lock_nest_lock(lock, nest_lock) mutex_lock(lock)
+-# define mutex_lock_io_nested(lock, subclass) mutex_lock(lock)
++# define mutex_lock_io_nested(lock, subclass) mutex_lock_io(lock)
+ #endif
+
+ /*
+diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
+index 728d7716bf4f4..0ade4d1e4dd96 100644
+--- a/include/linux/netfilter/x_tables.h
++++ b/include/linux/netfilter/x_tables.h
+@@ -227,7 +227,7 @@ struct xt_table {
+ unsigned int valid_hooks;
+
+ /* Man behind the curtain... */
+- struct xt_table_info __rcu *private;
++ struct xt_table_info *private;
+
+ /* Set this to THIS_MODULE if you are a module, otherwise NULL */
+ struct module *me;
+@@ -377,7 +377,7 @@ static inline unsigned int xt_write_recseq_begin(void)
+ * since addend is most likely 1
+ */
+ __this_cpu_add(xt_recseq.sequence, addend);
+- smp_wmb();
++ smp_mb();
+
+ return addend;
+ }
+@@ -449,9 +449,6 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
+
+ struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);
+
+-struct xt_table_info
+-*xt_table_get_private_protected(const struct xt_table *table);
+-
+ #ifdef CONFIG_COMPAT
+ #include <net/compat.h>
+
+diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h
+index a27604f99ed04..11096b561dab6 100644
+--- a/include/linux/u64_stats_sync.h
++++ b/include/linux/u64_stats_sync.h
+@@ -69,12 +69,13 @@ struct u64_stats_sync {
+ };
+
+
++#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
++#define u64_stats_init(syncp) seqcount_init(&(syncp)->seq)
++#else
+ static inline void u64_stats_init(struct u64_stats_sync *syncp)
+ {
+-#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
+- seqcount_init(&syncp->seq);
+-#endif
+ }
++#endif
+
+ static inline void u64_stats_update_begin(struct u64_stats_sync *syncp)
+ {
+diff --git a/include/net/red.h b/include/net/red.h
+index e21e7fd4fe077..8fe55b8b2fb81 100644
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -168,7 +168,8 @@ static inline void red_set_vars(struct red_vars *v)
+ v->qcount = -1;
+ }
+
+-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log)
++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog,
++ u8 Scell_log, u8 *stab)
+ {
+ if (fls(qth_min) + Wlog > 32)
+ return false;
+@@ -178,6 +179,13 @@ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_
+ return false;
+ if (qth_max < qth_min)
+ return false;
++ if (stab) {
++ int i;
++
++ for (i = 0; i < RED_STAB_SIZE; i++)
++ if (stab[i] >= 32)
++ return false;
++ }
+ return true;
+ }
+
+diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
+index 0bbaa54884233..3d961a3cf3c4a 100644
+--- a/include/net/rtnetlink.h
++++ b/include/net/rtnetlink.h
+@@ -33,6 +33,7 @@ static inline int rtnl_msg_family(const struct nlmsghdr *nlh)
+ *
+ * @list: Used internally
+ * @kind: Identifier
++ * @netns_refund: Physical device, move to init_net on netns exit
+ * @maxtype: Highest device specific netlink attribute number
+ * @policy: Netlink policy for device specific attribute validation
+ * @validate: Optional validation function for netlink/changelink parameters
+@@ -64,6 +65,7 @@ struct rtnl_link_ops {
+ size_t priv_size;
+ void (*setup)(struct net_device *dev);
+
++ bool netns_refund;
+ unsigned int maxtype;
+ const struct nla_policy *policy;
+ int (*validate)(struct nlattr *tb[],
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 5d9800804d4a4..7803bd9628dc2 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -9708,7 +9708,7 @@ static void __net_exit default_device_exit(struct net *net)
+ continue;
+
+ /* Leave virtual devices for the generic cleanup */
+- if (dev->rtnl_link_ops)
++ if (dev->rtnl_link_ops && !dev->rtnl_link_ops->netns_refund)
+ continue;
+
+ /* Push remaining network devices to init_net */
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index a2cae543a285a..10d8f95eb7712 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -202,7 +202,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
+
+ local_bh_disable();
+ addend = xt_write_recseq_begin();
+- private = rcu_access_pointer(table->private);
++ private = READ_ONCE(table->private); /* Address dependency. */
+ cpu = smp_processor_id();
+ table_base = private->entries;
+ jumpstack = (struct arpt_entry **)private->jumpstack[cpu];
+@@ -648,7 +648,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ unsigned int countersize;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = xt_table_get_private_protected(table);
++ const struct xt_table_info *private = table->private;
+
+ /* We need atomic snapshot of counters: rest doesn't change
+ * (other than comefrom, which userspace doesn't care
+@@ -672,7 +672,7 @@ static int copy_entries_to_user(unsigned int total_size,
+ unsigned int off, num;
+ const struct arpt_entry *e;
+ struct xt_counters *counters;
+- struct xt_table_info *private = xt_table_get_private_protected(table);
++ struct xt_table_info *private = table->private;
+ int ret = 0;
+ void *loc_cpu_entry;
+
+@@ -807,7 +807,7 @@ static int get_info(struct net *net, void __user *user,
+ t = xt_request_find_table_lock(net, NFPROTO_ARP, name);
+ if (!IS_ERR(t)) {
+ struct arpt_getinfo info;
+- const struct xt_table_info *private = xt_table_get_private_protected(t);
++ const struct xt_table_info *private = t->private;
+ #ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
+@@ -860,7 +860,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
+
+ t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = xt_table_get_private_protected(t);
++ const struct xt_table_info *private = t->private;
+
+ if (get.size == private->size)
+ ret = copy_entries_to_user(private->size,
+@@ -1019,7 +1019,7 @@ static int do_add_counters(struct net *net, const void __user *user,
+ }
+
+ local_bh_disable();
+- private = xt_table_get_private_protected(t);
++ private = t->private;
+ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+@@ -1356,7 +1356,7 @@ static int compat_copy_entries_to_user(unsigned int total_size,
+ void __user *userptr)
+ {
+ struct xt_counters *counters;
+- const struct xt_table_info *private = xt_table_get_private_protected(table);
++ const struct xt_table_info *private = table->private;
+ void __user *pos;
+ unsigned int size;
+ int ret = 0;
+@@ -1405,7 +1405,7 @@ static int compat_get_entries(struct net *net,
+ xt_compat_lock(NFPROTO_ARP);
+ t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = xt_table_get_private_protected(t);
++ const struct xt_table_info *private = t->private;
+ struct xt_table_info info;
+
+ ret = compat_table_info(private, &info);
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index 6672172a7512d..e77872c93c206 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -261,7 +261,7 @@ ipt_do_table(struct sk_buff *skb,
+ WARN_ON(!(table->valid_hooks & (1 << hook)));
+ local_bh_disable();
+ addend = xt_write_recseq_begin();
+- private = rcu_access_pointer(table->private);
++ private = READ_ONCE(table->private); /* Address dependency. */
+ cpu = smp_processor_id();
+ table_base = private->entries;
+ jumpstack = (struct ipt_entry **)private->jumpstack[cpu];
+@@ -794,7 +794,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ unsigned int countersize;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = xt_table_get_private_protected(table);
++ const struct xt_table_info *private = table->private;
+
+ /* We need atomic snapshot of counters: rest doesn't change
+ (other than comefrom, which userspace doesn't care
+@@ -818,7 +818,7 @@ copy_entries_to_user(unsigned int total_size,
+ unsigned int off, num;
+ const struct ipt_entry *e;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = xt_table_get_private_protected(table);
++ const struct xt_table_info *private = table->private;
+ int ret = 0;
+ const void *loc_cpu_entry;
+
+@@ -968,7 +968,7 @@ static int get_info(struct net *net, void __user *user,
+ t = xt_request_find_table_lock(net, AF_INET, name);
+ if (!IS_ERR(t)) {
+ struct ipt_getinfo info;
+- const struct xt_table_info *private = xt_table_get_private_protected(t);
++ const struct xt_table_info *private = t->private;
+ #ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
+@@ -1022,7 +1022,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr,
+
+ t = xt_find_table_lock(net, AF_INET, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = xt_table_get_private_protected(t);
++ const struct xt_table_info *private = t->private;
+ if (get.size == private->size)
+ ret = copy_entries_to_user(private->size,
+ t, uptr->entrytable);
+@@ -1178,7 +1178,7 @@ do_add_counters(struct net *net, const void __user *user,
+ }
+
+ local_bh_disable();
+- private = xt_table_get_private_protected(t);
++ private = t->private;
+ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+@@ -1573,7 +1573,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
+ void __user *userptr)
+ {
+ struct xt_counters *counters;
+- const struct xt_table_info *private = xt_table_get_private_protected(table);
++ const struct xt_table_info *private = table->private;
+ void __user *pos;
+ unsigned int size;
+ int ret = 0;
+@@ -1619,7 +1619,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
+ xt_compat_lock(AF_INET);
+ t = xt_find_table_lock(net, AF_INET, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = xt_table_get_private_protected(t);
++ const struct xt_table_info *private = t->private;
+ struct xt_table_info info;
+ ret = compat_table_info(private, &info);
+ if (!ret && get.size == info.size)
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index 3b067d5a62ee0..daf2e9e9193d1 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -283,7 +283,7 @@ ip6t_do_table(struct sk_buff *skb,
+
+ local_bh_disable();
+ addend = xt_write_recseq_begin();
+- private = rcu_access_pointer(table->private);
++ private = READ_ONCE(table->private); /* Address dependency. */
+ cpu = smp_processor_id();
+ table_base = private->entries;
+ jumpstack = (struct ip6t_entry **)private->jumpstack[cpu];
+@@ -810,7 +810,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ unsigned int countersize;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = xt_table_get_private_protected(table);
++ const struct xt_table_info *private = table->private;
+
+ /* We need atomic snapshot of counters: rest doesn't change
+ (other than comefrom, which userspace doesn't care
+@@ -834,7 +834,7 @@ copy_entries_to_user(unsigned int total_size,
+ unsigned int off, num;
+ const struct ip6t_entry *e;
+ struct xt_counters *counters;
+- const struct xt_table_info *private = xt_table_get_private_protected(table);
++ const struct xt_table_info *private = table->private;
+ int ret = 0;
+ const void *loc_cpu_entry;
+
+@@ -984,7 +984,7 @@ static int get_info(struct net *net, void __user *user,
+ t = xt_request_find_table_lock(net, AF_INET6, name);
+ if (!IS_ERR(t)) {
+ struct ip6t_getinfo info;
+- const struct xt_table_info *private = xt_table_get_private_protected(t);
++ const struct xt_table_info *private = t->private;
+ #ifdef CONFIG_COMPAT
+ struct xt_table_info tmp;
+
+@@ -1039,7 +1039,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
+
+ t = xt_find_table_lock(net, AF_INET6, get.name);
+ if (!IS_ERR(t)) {
+- struct xt_table_info *private = xt_table_get_private_protected(t);
++ struct xt_table_info *private = t->private;
+ if (get.size == private->size)
+ ret = copy_entries_to_user(private->size,
+ t, uptr->entrytable);
+@@ -1194,7 +1194,7 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
+ }
+
+ local_bh_disable();
+- private = xt_table_get_private_protected(t);
++ private = t->private;
+ if (private->number != tmp.num_counters) {
+ ret = -EINVAL;
+ goto unlock_up_free;
+@@ -1582,7 +1582,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
+ void __user *userptr)
+ {
+ struct xt_counters *counters;
+- const struct xt_table_info *private = xt_table_get_private_protected(table);
++ const struct xt_table_info *private = table->private;
+ void __user *pos;
+ unsigned int size;
+ int ret = 0;
+@@ -1628,7 +1628,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
+ xt_compat_lock(AF_INET6);
+ t = xt_find_table_lock(net, AF_INET6, get.name);
+ if (!IS_ERR(t)) {
+- const struct xt_table_info *private = xt_table_get_private_protected(t);
++ const struct xt_table_info *private = t->private;
+ struct xt_table_info info;
+ ret = compat_table_info(private, &info);
+ if (!ret && get.size == info.size)
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 9926455dd546d..f484f9fc62ca9 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2777,14 +2777,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
+ continue;
+
+ for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) {
+- if (~sdata->rc_rateidx_mcs_mask[i][j]) {
++ if (sdata->rc_rateidx_mcs_mask[i][j] != 0xff) {
+ sdata->rc_has_mcs_mask[i] = true;
+ break;
+ }
+ }
+
+ for (j = 0; j < NL80211_VHT_NSS_MAX; j++) {
+- if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) {
++ if (sdata->rc_rateidx_vht_mcs_mask[i][j] != 0xffff) {
+ sdata->rc_has_vht_mcs_mask[i] = true;
+ break;
+ }
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index f0f5fedb8caac..fa13eef25f2c9 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -1861,6 +1861,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
+
+ /* remove beacon */
+ kfree(sdata->u.ibss.ie);
++ sdata->u.ibss.ie = NULL;
++ sdata->u.ibss.ie_len = 0;
+
+ /* on the next join, re-program HT parameters */
+ memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa));
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 0b89609a6e9d6..15c9fbcd32f29 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -2656,6 +2656,7 @@ static int ctnetlink_exp_dump_mask(struct sk_buff *skb,
+ memset(&m, 0xFF, sizeof(m));
+ memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
+ m.src.u.all = mask->src.u.all;
++ m.src.l3num = tuple->src.l3num;
+ m.dst.protonum = tuple->dst.protonum;
+
+ nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index 1314de5f317f0..c9fe35118b33a 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -1356,14 +1356,6 @@ struct xt_counters *xt_counters_alloc(unsigned int counters)
+ }
+ EXPORT_SYMBOL(xt_counters_alloc);
+
+-struct xt_table_info
+-*xt_table_get_private_protected(const struct xt_table *table)
+-{
+- return rcu_dereference_protected(table->private,
+- mutex_is_locked(&xt[table->af].mutex));
+-}
+-EXPORT_SYMBOL(xt_table_get_private_protected);
+-
+ struct xt_table_info *
+ xt_replace_table(struct xt_table *table,
+ unsigned int num_counters,
+@@ -1371,6 +1363,7 @@ xt_replace_table(struct xt_table *table,
+ int *error)
+ {
+ struct xt_table_info *private;
++ unsigned int cpu;
+ int ret;
+
+ ret = xt_jumpstack_alloc(newinfo);
+@@ -1380,20 +1373,47 @@ xt_replace_table(struct xt_table *table,
+ }
+
+ /* Do the substitution. */
+- private = xt_table_get_private_protected(table);
++ local_bh_disable();
++ private = table->private;
+
+ /* Check inside lock: is the old number correct? */
+ if (num_counters != private->number) {
+ pr_debug("num_counters != table->private->number (%u/%u)\n",
+ num_counters, private->number);
++ local_bh_enable();
+ *error = -EAGAIN;
+ return NULL;
+ }
+
+ newinfo->initial_entries = private->initial_entries;
++ /*
++ * Ensure contents of newinfo are visible before assigning to
++ * private.
++ */
++ smp_wmb();
++ table->private = newinfo;
++
++ /* make sure all cpus see new ->private value */
++ smp_mb();
+
+- rcu_assign_pointer(table->private, newinfo);
+- synchronize_rcu();
++ /*
++ * Even though table entries have now been swapped, other CPU's
++ * may still be using the old entries...
++ */
++ local_bh_enable();
++
++ /* ... so wait for even xt_recseq on all cpus */
++ for_each_possible_cpu(cpu) {
++ seqcount_t *s = &per_cpu(xt_recseq, cpu);
++ u32 seq = raw_read_seqcount(s);
++
++ if (seq & 1) {
++ do {
++ cond_resched();
++ cpu_relax();
++ } while (seq == raw_read_seqcount(s));
++ }
++ }
+
+ #ifdef CONFIG_AUDIT
+ if (audit_enabled) {
+@@ -1434,12 +1454,12 @@ struct xt_table *xt_register_table(struct net *net,
+ }
+
+ /* Simplifies replace_table code. */
+- rcu_assign_pointer(table->private, bootstrap);
++ table->private = bootstrap;
+
+ if (!xt_replace_table(table, 0, newinfo, &ret))
+ goto unlock;
+
+- private = xt_table_get_private_protected(table);
++ private = table->private;
+ pr_debug("table->private->number = %u\n", private->number);
+
+ /* save number of initial entries */
+@@ -1462,8 +1482,7 @@ void *xt_unregister_table(struct xt_table *table)
+ struct xt_table_info *private;
+
+ mutex_lock(&xt[table->af].mutex);
+- private = xt_table_get_private_protected(table);
+- RCU_INIT_POINTER(table->private, NULL);
++ private = table->private;
+ list_del(&table->list);
+ mutex_unlock(&xt[table->af].mutex);
+ kfree(table);
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 0c7cacd854e06..43f63d0606ec1 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -868,6 +868,11 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg,
+ rc = copied;
+
+ if (addr) {
++ /* There is an anonymous 2-byte hole after sq_family,
++ * make sure to clear it.
++ */
++ memset(addr, 0, sizeof(*addr));
++
+ cb = (struct qrtr_cb *)skb->cb;
+ addr->sq_family = AF_QIPCRTR;
+ addr->sq_node = cb->src_node;
+diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
+index d058397d284bf..8b72aed77ed4f 100644
+--- a/net/sched/sch_choke.c
++++ b/net/sched/sch_choke.c
+@@ -355,6 +355,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt,
+ struct sk_buff **old = NULL;
+ unsigned int mask;
+ u32 max_P;
++ u8 *stab;
+
+ if (opt == NULL)
+ return -EINVAL;
+@@ -370,8 +371,8 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt,
+ max_P = tb[TCA_CHOKE_MAX_P] ? nla_get_u32(tb[TCA_CHOKE_MAX_P]) : 0;
+
+ ctl = nla_data(tb[TCA_CHOKE_PARMS]);
+-
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
++ stab = nla_data(tb[TCA_CHOKE_STAB]);
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab))
+ return -EINVAL;
+
+ if (ctl->limit > CHOKE_MAX_QUEUE)
+@@ -421,7 +422,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt,
+
+ red_set_parms(&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog,
+ ctl->Plog, ctl->Scell_log,
+- nla_data(tb[TCA_CHOKE_STAB]),
++ stab,
+ max_P);
+ red_set_vars(&q->vars);
+
+diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
+index 6f94bca75520b..db7a91a29b59c 100644
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -357,7 +357,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
+ struct gred_sched *table = qdisc_priv(sch);
+ struct gred_sched_data *q = table->tab[dp];
+
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab))
+ return -EINVAL;
+
+ if (!q) {
+diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
+index a3dc2118539b9..e42f890fa1478 100644
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -199,6 +199,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt,
+ struct Qdisc *child = NULL;
+ int err;
+ u32 max_P;
++ u8 *stab;
+
+ if (opt == NULL)
+ return -EINVAL;
+@@ -214,7 +215,9 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt,
+ max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
+
+ ctl = nla_data(tb[TCA_RED_PARMS]);
+- if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
++ stab = nla_data(tb[TCA_RED_STAB]);
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog,
++ ctl->Scell_log, stab))
+ return -EINVAL;
+
+ if (ctl->limit > 0) {
+@@ -240,7 +243,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt,
+ red_set_parms(&q->parms,
+ ctl->qth_min, ctl->qth_max, ctl->Wlog,
+ ctl->Plog, ctl->Scell_log,
+- nla_data(tb[TCA_RED_STAB]),
++ stab,
+ max_P);
+ red_set_vars(&q->vars);
+
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index 74f697c4a4d30..1bfdf90fa0cce 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -651,7 +651,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
+ }
+
+ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
+- ctl_v1->Wlog, ctl_v1->Scell_log))
++ ctl_v1->Wlog, ctl_v1->Scell_log, NULL))
+ return -EINVAL;
+ if (ctl_v1 && ctl_v1->qth_min) {
+ p = kmalloc(sizeof(*p), GFP_KERNEL);
+diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
+index 3624557550a1f..6f57d38443c73 100644
+--- a/tools/lib/bpf/Makefile
++++ b/tools/lib/bpf/Makefile
+@@ -179,7 +179,7 @@ define do_install
+ if [ ! -d '$(DESTDIR_SQ)$2' ]; then \
+ $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \
+ fi; \
+- $(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2'
++ $(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2'
+ endef
+
+ install_lib: all_cmd
+diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
+index 40c93d8158b5a..f7c4dcb9d5821 100644
+--- a/tools/perf/util/auxtrace.c
++++ b/tools/perf/util/auxtrace.c
+@@ -256,10 +256,6 @@ static int auxtrace_queues__queue_buffer(struct auxtrace_queues *queues,
+ queue->set = true;
+ queue->tid = buffer->tid;
+ queue->cpu = buffer->cpu;
+- } else if (buffer->cpu != queue->cpu || buffer->tid != queue->tid) {
+- pr_err("auxtrace queue conflict: cpu %d, tid %d vs cpu %d, tid %d\n",
+- queue->cpu, queue->tid, buffer->cpu, buffer->tid);
+- return -EINVAL;
+ }
+
+ buffer->buffer_nr = queues->next_buffer_nr++;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-04-07 12:21 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-04-07 12:21 UTC (permalink / raw
To: gentoo-commits
commit: 7b510ac39f9c900c4043c37a29c91f4c18e13e4c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 7 12:21:20 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 7 12:21:20 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7b510ac3
Linux patch 4.19.185
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1184_linux-4.19.185.patch | 1482 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1486 insertions(+)
diff --git a/0000_README b/0000_README
index 51936a2..8399430 100644
--- a/0000_README
+++ b/0000_README
@@ -775,6 +775,10 @@ Patch: 1183_linux-4.19.184.patch
From: https://www.kernel.org
Desc: Linux 4.19.184
+Patch: 1184_linux-4.19.185.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.185
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1184_linux-4.19.185.patch b/1184_linux-4.19.185.patch
new file mode 100644
index 0000000..83cf418
--- /dev/null
+++ b/1184_linux-4.19.185.patch
@@ -0,0 +1,1482 @@
+diff --git a/Makefile b/Makefile
+index 8a3821f74b54e..e4f0127745732 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 184
++SUBLEVEL = 185
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 2c99f93020bc9..eaae4adf9ce4b 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1572,8 +1572,8 @@ void pm_runtime_get_suppliers(struct device *dev)
+ list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
+ if (link->flags & DL_FLAG_PM_RUNTIME) {
+ link->supplier_preactivated = true;
+- refcount_inc(&link->rpm_active);
+ pm_runtime_get_sync(link->supplier);
++ refcount_inc(&link->rpm_active);
+ }
+
+ device_links_read_unlock(idx);
+@@ -1586,6 +1586,8 @@ void pm_runtime_get_suppliers(struct device *dev)
+ void pm_runtime_put_suppliers(struct device *dev)
+ {
+ struct device_link *link;
++ unsigned long flags;
++ bool put;
+ int idx;
+
+ idx = device_links_read_lock();
+@@ -1593,7 +1595,11 @@ void pm_runtime_put_suppliers(struct device *dev)
+ list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
+ if (link->supplier_preactivated) {
+ link->supplier_preactivated = false;
+- if (refcount_dec_not_one(&link->rpm_active))
++ spin_lock_irqsave(&dev->power.lock, flags);
++ put = pm_runtime_status_suspended(dev) &&
++ refcount_dec_not_one(&link->rpm_active);
++ spin_unlock_irqrestore(&dev->power.lock, flags);
++ if (put)
+ pm_runtime_put(link->supplier);
+ }
+
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index b9d27c8fe57e6..e70f21ae85ffa 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -1256,6 +1256,7 @@ int extcon_dev_register(struct extcon_dev *edev)
+ sizeof(*edev->nh), GFP_KERNEL);
+ if (!edev->nh) {
+ ret = -ENOMEM;
++ device_unregister(&edev->dev);
+ goto err_dev;
+ }
+
+diff --git a/drivers/firewire/nosy.c b/drivers/firewire/nosy.c
+index a128dd1126ae4..ac85e03e88e16 100644
+--- a/drivers/firewire/nosy.c
++++ b/drivers/firewire/nosy.c
+@@ -359,6 +359,7 @@ nosy_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ struct client *client = file->private_data;
+ spinlock_t *client_list_lock = &client->lynx->client_list_lock;
+ struct nosy_stats stats;
++ int ret;
+
+ switch (cmd) {
+ case NOSY_IOC_GET_STATS:
+@@ -373,11 +374,15 @@ nosy_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ return 0;
+
+ case NOSY_IOC_START:
++ ret = -EBUSY;
+ spin_lock_irq(client_list_lock);
+- list_add_tail(&client->link, &client->lynx->client_list);
++ if (list_empty(&client->link)) {
++ list_add_tail(&client->link, &client->lynx->client_list);
++ ret = 0;
++ }
+ spin_unlock_irq(client_list_lock);
+
+- return 0;
++ return ret;
+
+ case NOSY_IOC_STOP:
+ spin_lock_irq(client_list_lock);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index f67c332b16a42..6a1f5df4bc07e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -2076,8 +2076,8 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
+ uint64_t eaddr;
+
+ /* validate the parameters */
+- if (saddr & AMDGPU_GPU_PAGE_MASK || offset & AMDGPU_GPU_PAGE_MASK ||
+- size == 0 || size & AMDGPU_GPU_PAGE_MASK)
++ if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK ||
++ size == 0 || size & ~PAGE_MASK)
+ return -EINVAL;
+
+ /* make sure object fit at this offset */
+@@ -2141,8 +2141,8 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev,
+ int r;
+
+ /* validate the parameters */
+- if (saddr & AMDGPU_GPU_PAGE_MASK || offset & AMDGPU_GPU_PAGE_MASK ||
+- size == 0 || size & AMDGPU_GPU_PAGE_MASK)
++ if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK ||
++ size == 0 || size & ~PAGE_MASK)
+ return -EINVAL;
+
+ /* make sure object fit at this offset */
+@@ -2286,7 +2286,7 @@ int amdgpu_vm_bo_clear_mappings(struct amdgpu_device *adev,
+ after->start = eaddr + 1;
+ after->last = tmp->last;
+ after->offset = tmp->offset;
+- after->offset += after->start - tmp->start;
++ after->offset += (after->start - tmp->start) << PAGE_SHIFT;
+ after->flags = tmp->flags;
+ after->bo_va = tmp->bo_va;
+ list_add(&after->list, &tmp->bo_va->invalids);
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+index e3ae29e523f0e..daf841ae337d5 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+@@ -50,8 +50,10 @@ static int aq_ndev_open(struct net_device *ndev)
+ if (err < 0)
+ goto err_exit;
+ err = aq_nic_start(aq_nic);
+- if (err < 0)
++ if (err < 0) {
++ aq_nic_stop(aq_nic);
+ goto err_exit;
++ }
+
+ err_exit:
+ if (err < 0)
+diff --git a/drivers/net/wan/lmc/lmc_main.c b/drivers/net/wan/lmc/lmc_main.c
+index 4907453f17f5e..937f56d0a31da 100644
+--- a/drivers/net/wan/lmc/lmc_main.c
++++ b/drivers/net/wan/lmc/lmc_main.c
+@@ -915,6 +915,8 @@ static int lmc_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ break;
+ default:
+ printk(KERN_WARNING "%s: LMC UNKNOWN CARD!\n", dev->name);
++ unregister_hdlc_device(dev);
++ return -EIO;
+ break;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index a6f7bf28a8b2d..04dc5714aa725 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -449,13 +449,13 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb)
+ case WMI_TDLS_TEARDOWN_REASON_TX:
+ case WMI_TDLS_TEARDOWN_REASON_RSSI:
+ case WMI_TDLS_TEARDOWN_REASON_PTR_TIMEOUT:
++ rcu_read_lock();
+ station = ieee80211_find_sta_by_ifaddr(ar->hw,
+ ev->peer_macaddr.addr,
+ NULL);
+ if (!station) {
+ ath10k_warn(ar, "did not find station from tdls peer event");
+- kfree(tb);
+- return;
++ goto exit;
+ }
+ arvif = ath10k_get_arvif(ar, __le32_to_cpu(ev->vdev_id));
+ ieee80211_tdls_oper_request(
+@@ -466,6 +466,9 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb)
+ );
+ break;
+ }
++
++exit:
++ rcu_read_unlock();
+ kfree(tb);
+ }
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index bbdc6000afb9b..96dc9e5ab23f4 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5282,7 +5282,8 @@ static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
+ return false;
+ }
+
+-static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
++static bool brcmf_is_linkdown(struct brcmf_cfg80211_vif *vif,
++ const struct brcmf_event_msg *e)
+ {
+ u32 event = e->event_code;
+ u16 flags = e->flags;
+@@ -5291,6 +5292,8 @@ static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
+ (event == BRCMF_E_DISASSOC_IND) ||
+ ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
+ brcmf_dbg(CONN, "Processing link down\n");
++ clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
++ clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
+ return true;
+ }
+ return false;
+@@ -5581,7 +5584,7 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
+ } else
+ brcmf_bss_connect_done(cfg, ndev, e, true);
+ brcmf_net_setcarrier(ifp, true);
+- } else if (brcmf_is_linkdown(e)) {
++ } else if (brcmf_is_linkdown(ifp->vif, e)) {
+ brcmf_dbg(CONN, "Linkdown\n");
+ if (!brcmf_is_ibssmode(ifp->vif)) {
+ brcmf_bss_connect_done(cfg, ndev, e, false);
+diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
+index 4d3b62707524a..d0d5b8bdbc105 100644
+--- a/drivers/pinctrl/pinctrl-rockchip.c
++++ b/drivers/pinctrl/pinctrl-rockchip.c
+@@ -3353,12 +3353,15 @@ static int __maybe_unused rockchip_pinctrl_suspend(struct device *dev)
+ static int __maybe_unused rockchip_pinctrl_resume(struct device *dev)
+ {
+ struct rockchip_pinctrl *info = dev_get_drvdata(dev);
+- int ret = regmap_write(info->regmap_base, RK3288_GRF_GPIO6C_IOMUX,
+- rk3288_grf_gpio6c_iomux |
+- GPIO6C6_SEL_WRITE_ENABLE);
++ int ret;
+
+- if (ret)
+- return ret;
++ if (info->ctrl->type == RK3288) {
++ ret = regmap_write(info->regmap_base, RK3288_GRF_GPIO6C_IOMUX,
++ rk3288_grf_gpio6c_iomux |
++ GPIO6C6_SEL_WRITE_ENABLE);
++ if (ret)
++ return ret;
++ }
+
+ return pinctrl_force_default(info->pctl_dev);
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
+index 199d3ba1916d5..67a74720c02c3 100644
+--- a/drivers/scsi/qla2xxx/qla_target.h
++++ b/drivers/scsi/qla2xxx/qla_target.h
+@@ -124,7 +124,6 @@
+ (min(1270, ((ql) > 0) ? (QLA_TGT_DATASEGS_PER_CMD_24XX + \
+ QLA_TGT_DATASEGS_PER_CONT_24XX*((ql) - 1)) : 0))
+ #endif
+-#endif
+
+ #define GET_TARGET_ID(ha, iocb) ((HAS_EXTENDED_IDS(ha)) \
+ ? le16_to_cpu((iocb)->u.isp2x.target.extended) \
+@@ -257,6 +256,7 @@ struct ctio_to_2xxx {
+ #ifndef CTIO_RET_TYPE
+ #define CTIO_RET_TYPE 0x17 /* CTIO return entry */
+ #define ATIO_TYPE7 0x06 /* Accept target I/O entry for 24xx */
++#endif
+
+ struct fcp_hdr {
+ uint8_t r_ctl;
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index 307df2fa39a38..5078db7743cd0 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -1265,8 +1265,8 @@ static int st_open(struct inode *inode, struct file *filp)
+ spin_lock(&st_use_lock);
+ if (STp->in_use) {
+ spin_unlock(&st_use_lock);
+- scsi_tape_put(STp);
+ DEBC_printk(STp, "Device already in use.\n");
++ scsi_tape_put(STp);
+ return (-EBUSY);
+ }
+
+diff --git a/drivers/staging/comedi/drivers/cb_pcidas.c b/drivers/staging/comedi/drivers/cb_pcidas.c
+index 9b716c6964776..86cae5d0e9832 100644
+--- a/drivers/staging/comedi/drivers/cb_pcidas.c
++++ b/drivers/staging/comedi/drivers/cb_pcidas.c
+@@ -1281,7 +1281,7 @@ static int cb_pcidas_auto_attach(struct comedi_device *dev,
+ devpriv->amcc + AMCC_OP_REG_INTCSR);
+
+ ret = request_irq(pcidev->irq, cb_pcidas_interrupt, IRQF_SHARED,
+- dev->board_name, dev);
++ "cb_pcidas", dev);
+ if (ret) {
+ dev_dbg(dev->class_dev, "unable to allocate irq %d\n",
+ pcidev->irq);
+diff --git a/drivers/staging/comedi/drivers/cb_pcidas64.c b/drivers/staging/comedi/drivers/cb_pcidas64.c
+index 631a703b345d1..91403cc1bbf9b 100644
+--- a/drivers/staging/comedi/drivers/cb_pcidas64.c
++++ b/drivers/staging/comedi/drivers/cb_pcidas64.c
+@@ -4021,7 +4021,7 @@ static int auto_attach(struct comedi_device *dev,
+ init_stc_registers(dev);
+
+ retval = request_irq(pcidev->irq, handle_interrupt, IRQF_SHARED,
+- dev->board_name, dev);
++ "cb_pcidas64", dev);
+ if (retval) {
+ dev_dbg(dev->class_dev, "unable to allocate irq %u\n",
+ pcidev->irq);
+diff --git a/drivers/staging/rtl8192e/rtllib.h b/drivers/staging/rtl8192e/rtllib.h
+index c01474a6db1e8..2574275475d16 100644
+--- a/drivers/staging/rtl8192e/rtllib.h
++++ b/drivers/staging/rtl8192e/rtllib.h
+@@ -1110,7 +1110,7 @@ struct rtllib_network {
+ bool bWithAironetIE;
+ bool bCkipSupported;
+ bool bCcxRmEnable;
+- u16 CcxRmState[2];
++ u8 CcxRmState[2];
+ bool bMBssidValid;
+ u8 MBssidMask;
+ u8 MBssid[ETH_ALEN];
+diff --git a/drivers/staging/rtl8192e/rtllib_rx.c b/drivers/staging/rtl8192e/rtllib_rx.c
+index fa580ce1cf43d..3bfd63fe4ac10 100644
+--- a/drivers/staging/rtl8192e/rtllib_rx.c
++++ b/drivers/staging/rtl8192e/rtllib_rx.c
+@@ -1978,7 +1978,7 @@ static void rtllib_parse_mife_generic(struct rtllib_device *ieee,
+ info_element->data[2] == 0x96 &&
+ info_element->data[3] == 0x01) {
+ if (info_element->len == 6) {
+- memcpy(network->CcxRmState, &info_element[4], 2);
++ memcpy(network->CcxRmState, &info_element->data[4], 2);
+ if (network->CcxRmState[0] != 0)
+ network->bCcxRmEnable = true;
+ else
+diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c
+index aa99edb4dff7d..4dce4a8f71ed9 100644
+--- a/drivers/thermal/thermal_sysfs.c
++++ b/drivers/thermal/thermal_sysfs.c
+@@ -770,6 +770,9 @@ void thermal_cooling_device_stats_update(struct thermal_cooling_device *cdev,
+ {
+ struct cooling_dev_stats *stats = cdev->stats;
+
++ if (!stats)
++ return;
++
+ spin_lock(&stats->lock);
+
+ if (stats->state == new_state)
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index c523dfe408d51..a1fa16a03ab9d 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -147,17 +147,29 @@ static inline int acm_set_control(struct acm *acm, int control)
+ #define acm_send_break(acm, ms) \
+ acm_ctrl_msg(acm, USB_CDC_REQ_SEND_BREAK, ms, NULL, 0)
+
+-static void acm_kill_urbs(struct acm *acm)
++static void acm_poison_urbs(struct acm *acm)
+ {
+ int i;
+
+- usb_kill_urb(acm->ctrlurb);
++ usb_poison_urb(acm->ctrlurb);
+ for (i = 0; i < ACM_NW; i++)
+- usb_kill_urb(acm->wb[i].urb);
++ usb_poison_urb(acm->wb[i].urb);
+ for (i = 0; i < acm->rx_buflimit; i++)
+- usb_kill_urb(acm->read_urbs[i]);
++ usb_poison_urb(acm->read_urbs[i]);
+ }
+
++static void acm_unpoison_urbs(struct acm *acm)
++{
++ int i;
++
++ for (i = 0; i < acm->rx_buflimit; i++)
++ usb_unpoison_urb(acm->read_urbs[i]);
++ for (i = 0; i < ACM_NW; i++)
++ usb_unpoison_urb(acm->wb[i].urb);
++ usb_unpoison_urb(acm->ctrlurb);
++}
++
++
+ /*
+ * Write buffer management.
+ * All of these assume proper locks taken by the caller.
+@@ -225,9 +237,10 @@ static int acm_start_wb(struct acm *acm, struct acm_wb *wb)
+
+ rc = usb_submit_urb(wb->urb, GFP_ATOMIC);
+ if (rc < 0) {
+- dev_err(&acm->data->dev,
+- "%s - usb_submit_urb(write bulk) failed: %d\n",
+- __func__, rc);
++ if (rc != -EPERM)
++ dev_err(&acm->data->dev,
++ "%s - usb_submit_urb(write bulk) failed: %d\n",
++ __func__, rc);
+ acm_write_done(acm, wb);
+ }
+ return rc;
+@@ -312,8 +325,10 @@ static void acm_process_notification(struct acm *acm, unsigned char *buf)
+ acm->iocount.dsr++;
+ if (difference & ACM_CTRL_DCD)
+ acm->iocount.dcd++;
+- if (newctrl & ACM_CTRL_BRK)
++ if (newctrl & ACM_CTRL_BRK) {
+ acm->iocount.brk++;
++ tty_insert_flip_char(&acm->port, 0, TTY_BREAK);
++ }
+ if (newctrl & ACM_CTRL_RI)
+ acm->iocount.rng++;
+ if (newctrl & ACM_CTRL_FRAMING)
+@@ -480,11 +495,6 @@ static void acm_read_bulk_callback(struct urb *urb)
+ dev_vdbg(&acm->data->dev, "got urb %d, len %d, status %d\n",
+ rb->index, urb->actual_length, status);
+
+- if (!acm->dev) {
+- dev_dbg(&acm->data->dev, "%s - disconnected\n", __func__);
+- return;
+- }
+-
+ switch (status) {
+ case 0:
+ usb_mark_last_busy(acm->dev);
+@@ -654,7 +664,8 @@ static void acm_port_dtr_rts(struct tty_port *port, int raise)
+
+ res = acm_set_control(acm, val);
+ if (res && (acm->ctrl_caps & USB_CDC_CAP_LINE))
+- dev_err(&acm->control->dev, "failed to set dtr/rts\n");
++ /* This is broken in too many devices to spam the logs */
++ dev_dbg(&acm->control->dev, "failed to set dtr/rts\n");
+ }
+
+ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
+@@ -739,6 +750,7 @@ static void acm_port_shutdown(struct tty_port *port)
+ * Need to grab write_lock to prevent race with resume, but no need to
+ * hold it due to the tty-port initialised flag.
+ */
++ acm_poison_urbs(acm);
+ spin_lock_irq(&acm->write_lock);
+ spin_unlock_irq(&acm->write_lock);
+
+@@ -755,7 +767,8 @@ static void acm_port_shutdown(struct tty_port *port)
+ usb_autopm_put_interface_async(acm->control);
+ }
+
+- acm_kill_urbs(acm);
++ acm_unpoison_urbs(acm);
++
+ }
+
+ static void acm_tty_cleanup(struct tty_struct *tty)
+@@ -1548,12 +1561,16 @@ skip_countries:
+
+ return 0;
+ alloc_fail6:
++ if (!acm->combined_interfaces) {
++ /* Clear driver data so that disconnect() returns early. */
++ usb_set_intfdata(data_interface, NULL);
++ usb_driver_release_interface(&acm_driver, data_interface);
++ }
+ if (acm->country_codes) {
+ device_remove_file(&acm->control->dev,
+ &dev_attr_wCountryCodes);
+ device_remove_file(&acm->control->dev,
+ &dev_attr_iCountryCodeRelDate);
+- kfree(acm->country_codes);
+ }
+ device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
+ alloc_fail5:
+@@ -1585,8 +1602,14 @@ static void acm_disconnect(struct usb_interface *intf)
+ if (!acm)
+ return;
+
+- mutex_lock(&acm->mutex);
+ acm->disconnected = true;
++ /*
++ * there is a circular dependency. acm_softint() can resubmit
++ * the URBs in error handling so we need to block any
++ * submission right away
++ */
++ acm_poison_urbs(acm);
++ mutex_lock(&acm->mutex);
+ if (acm->country_codes) {
+ device_remove_file(&acm->control->dev,
+ &dev_attr_wCountryCodes);
+@@ -1605,7 +1628,6 @@ static void acm_disconnect(struct usb_interface *intf)
+ tty_kref_put(tty);
+ }
+
+- acm_kill_urbs(acm);
+ cancel_delayed_work_sync(&acm->dwork);
+
+ tty_unregister_device(acm_tty_driver, acm->minor);
+@@ -1647,7 +1669,7 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message)
+ if (cnt)
+ return 0;
+
+- acm_kill_urbs(acm);
++ acm_poison_urbs(acm);
+ cancel_delayed_work_sync(&acm->dwork);
+ acm->urbs_in_error_delay = 0;
+
+@@ -1660,6 +1682,7 @@ static int acm_resume(struct usb_interface *intf)
+ struct urb *urb;
+ int rv = 0;
+
++ acm_unpoison_urbs(acm);
+ spin_lock_irq(&acm->write_lock);
+
+ if (--acm->susp_count)
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 239443ce52001..b8a4707dfafab 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -498,6 +498,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* DJI CineSSD */
+ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* Fibocom L850-GL LTE Modem */
++ { USB_DEVICE(0x2cb7, 0x0007), .driver_info =
++ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
++
+ /* INTEL VALUE SSD */
+ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 56a35e0160392..91686e1b24d97 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -5560,7 +5560,7 @@ int dwc2_host_enter_hibernation(struct dwc2_hsotg *hsotg)
+ dwc2_writel(hsotg, hprt0, HPRT0);
+
+ /* Wait for the HPRT0.PrtSusp register field to be set */
+- if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 3000))
++ if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 5000))
+ dev_warn(hsotg->dev, "Suspend wasn't generated\n");
+
+ /*
+diff --git a/drivers/usb/gadget/udc/amd5536udc_pci.c b/drivers/usb/gadget/udc/amd5536udc_pci.c
+index 57b6f66331cfa..362284057d307 100644
+--- a/drivers/usb/gadget/udc/amd5536udc_pci.c
++++ b/drivers/usb/gadget/udc/amd5536udc_pci.c
+@@ -154,6 +154,11 @@ static int udc_pci_probe(
+ pci_set_master(pdev);
+ pci_try_set_mwi(pdev);
+
++ dev->phys_addr = resource;
++ dev->irq = pdev->irq;
++ dev->pdev = pdev;
++ dev->dev = &pdev->dev;
++
+ /* init dma pools */
+ if (use_dma) {
+ retval = init_dma_pools(dev);
+@@ -161,11 +166,6 @@ static int udc_pci_probe(
+ goto err_dma;
+ }
+
+- dev->phys_addr = resource;
+- dev->irq = pdev->irq;
+- dev->pdev = pdev;
+- dev->dev = &pdev->dev;
+-
+ /* general probing */
+ if (udc_probe(dev)) {
+ retval = -ENODEV;
+diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
+index 2c3b31109e168..09d5a789fcd5d 100644
+--- a/drivers/usb/host/xhci-mtk.c
++++ b/drivers/usb/host/xhci-mtk.c
+@@ -395,6 +395,13 @@ static void xhci_mtk_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
+ if (mtk->lpm_support)
+ xhci->quirks |= XHCI_LPM_SUPPORT;
++
++ /*
++ * MTK xHCI 0.96: PSA is 1 by default even if doesn't support stream,
++ * and it's 3 when support it.
++ */
++ if (xhci->hci_version < 0x100 && HCC_MAX_PSA(xhci->hcc_params) == 4)
++ xhci->quirks |= XHCI_BROKEN_STREAMS;
+ }
+
+ /* called during probe() after chip reset completes */
+@@ -551,7 +558,8 @@ static int xhci_mtk_probe(struct platform_device *pdev)
+ if (ret)
+ goto put_usb3_hcd;
+
+- if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
++ if (HCC_MAX_PSA(xhci->hcc_params) >= 4 &&
++ !(xhci->quirks & XHCI_BROKEN_STREAMS))
+ xhci->shared_hcd->can_do_streams = 1;
+
+ ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED);
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index 9ce21b8caf35c..2a874058dff11 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1868,10 +1868,14 @@ static void musb_pm_runtime_check_session(struct musb *musb)
+ MUSB_DEVCTL_HR;
+ switch (devctl & ~s) {
+ case MUSB_QUIRK_B_DISCONNECT_99:
+- musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n");
+- schedule_delayed_work(&musb->irq_work,
+- msecs_to_jiffies(1000));
+- break;
++ if (musb->quirk_retries && !musb->flush_irq_work) {
++ musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n");
++ schedule_delayed_work(&musb->irq_work,
++ msecs_to_jiffies(1000));
++ musb->quirk_retries--;
++ break;
++ }
++ /* fall through */
+ case MUSB_QUIRK_B_INVALID_VBUS_91:
+ if (musb->quirk_retries && !musb->flush_irq_work) {
+ musb_dbg(musb,
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 0909cfcbf7205..32a4dfeea06af 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -594,6 +594,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ pr_err("invalid port number %d\n", wIndex);
+ goto error;
+ }
++ if (wValue >= 32)
++ goto error;
+ if (hcd->speed == HCD_USB3) {
+ if ((vhci_hcd->port_status[rhport] &
+ USB_SS_PORT_STAT_POWER) != 0) {
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 98b6eb902df9e..732327756ee11 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -322,8 +322,8 @@ static void vhost_vq_reset(struct vhost_dev *dev,
+ vq->kick = NULL;
+ vq->call_ctx = NULL;
+ vq->log_ctx = NULL;
+- vhost_reset_is_le(vq);
+ vhost_disable_cross_endian(vq);
++ vhost_reset_is_le(vq);
+ vq->busyloop_timeout = 0;
+ vq->umem = NULL;
+ vq->iotlb = NULL;
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 5742a0dc774e9..cf0e025416e5e 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -1306,6 +1306,9 @@ static void fbcon_cursor(struct vc_data *vc, int mode)
+
+ ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1;
+
++ if (!ops->cursor)
++ return;
++
+ ops->cursor(vc, info, mode, get_color(vc, info, c, 1),
+ get_color(vc, info, c, 0));
+ }
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 1c6fd526ea978..7959aae4857e1 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -2072,13 +2072,13 @@ static int __ext4_journalled_writepage(struct page *page,
+ if (!ret)
+ ret = err;
+
+- if (!ext4_has_inline_data(inode))
+- ext4_walk_page_buffers(NULL, page_bufs, 0, len,
+- NULL, bput_one);
+ ext4_set_inode_state(inode, EXT4_STATE_JDATA);
+ out:
+ unlock_page(page);
+ out_no_pagelock:
++ if (!inline_data && page_bufs)
++ ext4_walk_page_buffers(NULL, page_bufs, 0, len,
++ NULL, bput_one);
+ brelse(inode_bh);
+ return ret;
+ }
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 5f701d8dce478..358f6378882f4 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -3624,14 +3624,14 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ */
+ retval = -ENOENT;
+ if (!old.bh || le32_to_cpu(old.de->inode) != old.inode->i_ino)
+- goto end_rename;
++ goto release_bh;
+
+ new.bh = ext4_find_entry(new.dir, &new.dentry->d_name,
+ &new.de, &new.inlined);
+ if (IS_ERR(new.bh)) {
+ retval = PTR_ERR(new.bh);
+ new.bh = NULL;
+- goto end_rename;
++ goto release_bh;
+ }
+ if (new.bh) {
+ if (!new.inode) {
+@@ -3648,15 +3648,13 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ handle = ext4_journal_start(old.dir, EXT4_HT_DIR, credits);
+ if (IS_ERR(handle)) {
+ retval = PTR_ERR(handle);
+- handle = NULL;
+- goto end_rename;
++ goto release_bh;
+ }
+ } else {
+ whiteout = ext4_whiteout_for_rename(&old, credits, &handle);
+ if (IS_ERR(whiteout)) {
+ retval = PTR_ERR(whiteout);
+- whiteout = NULL;
+- goto end_rename;
++ goto release_bh;
+ }
+ }
+
+@@ -3764,16 +3762,18 @@ end_rename:
+ ext4_resetent(handle, &old,
+ old.inode->i_ino, old_file_type);
+ drop_nlink(whiteout);
++ ext4_orphan_add(handle, whiteout);
+ }
+ unlock_new_inode(whiteout);
++ ext4_journal_stop(handle);
+ iput(whiteout);
+-
++ } else {
++ ext4_journal_stop(handle);
+ }
++release_bh:
+ brelse(old.dir_bh);
+ brelse(old.bh);
+ brelse(new.bh);
+- if (handle)
+- ext4_journal_stop(handle);
+ return retval;
+ }
+
+diff --git a/fs/reiserfs/xattr.h b/fs/reiserfs/xattr.h
+index c764352447ba1..81bec2c80b25c 100644
+--- a/fs/reiserfs/xattr.h
++++ b/fs/reiserfs/xattr.h
+@@ -43,7 +43,7 @@ void reiserfs_security_free(struct reiserfs_security_handle *sec);
+
+ static inline int reiserfs_xattrs_initialized(struct super_block *sb)
+ {
+- return REISERFS_SB(sb)->priv_root != NULL;
++ return REISERFS_SB(sb)->priv_root && REISERFS_SB(sb)->xattr_root;
+ }
+
+ #define xattr_size(size) ((size) + sizeof(struct reiserfs_xattr_header))
+diff --git a/include/linux/extcon.h b/include/linux/extcon.h
+index 7f033b1ea5680..fdef4c784d03c 100644
+--- a/include/linux/extcon.h
++++ b/include/linux/extcon.h
+@@ -279,6 +279,29 @@ static inline void devm_extcon_unregister_notifier(struct device *dev,
+ struct extcon_dev *edev, unsigned int id,
+ struct notifier_block *nb) { }
+
++static inline int extcon_register_notifier_all(struct extcon_dev *edev,
++ struct notifier_block *nb)
++{
++ return 0;
++}
++
++static inline int extcon_unregister_notifier_all(struct extcon_dev *edev,
++ struct notifier_block *nb)
++{
++ return 0;
++}
++
++static inline int devm_extcon_register_notifier_all(struct device *dev,
++ struct extcon_dev *edev,
++ struct notifier_block *nb)
++{
++ return 0;
++}
++
++static inline void devm_extcon_unregister_notifier_all(struct device *dev,
++ struct extcon_dev *edev,
++ struct notifier_block *nb) { }
++
+ static inline struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
+ {
+ return ERR_PTR(-ENODEV);
+diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
+index fc9d6e37552d3..da8a582ab032e 100644
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -288,7 +288,7 @@ static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk)
+ return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog;
+ }
+
+-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req);
++bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req);
+ void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req);
+
+ void inet_csk_destroy_sock(struct sock *sk);
+diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
+index 3f8a35104285a..b3da782cdfbd7 100644
+--- a/kernel/locking/mutex.c
++++ b/kernel/locking/mutex.c
+@@ -609,7 +609,7 @@ static inline int mutex_can_spin_on_owner(struct mutex *lock)
+ */
+ static __always_inline bool
+ mutex_optimistic_spin(struct mutex *lock, struct ww_acquire_ctx *ww_ctx,
+- const bool use_ww_ctx, struct mutex_waiter *waiter)
++ struct mutex_waiter *waiter)
+ {
+ if (!waiter) {
+ /*
+@@ -685,7 +685,7 @@ fail:
+ #else
+ static __always_inline bool
+ mutex_optimistic_spin(struct mutex *lock, struct ww_acquire_ctx *ww_ctx,
+- const bool use_ww_ctx, struct mutex_waiter *waiter)
++ struct mutex_waiter *waiter)
+ {
+ return false;
+ }
+@@ -905,10 +905,13 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ struct ww_mutex *ww;
+ int ret;
+
++ if (!use_ww_ctx)
++ ww_ctx = NULL;
++
+ might_sleep();
+
+ ww = container_of(lock, struct ww_mutex, base);
+- if (use_ww_ctx && ww_ctx) {
++ if (ww_ctx) {
+ if (unlikely(ww_ctx == READ_ONCE(ww->ctx)))
+ return -EALREADY;
+
+@@ -925,10 +928,10 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ mutex_acquire_nest(&lock->dep_map, subclass, 0, nest_lock, ip);
+
+ if (__mutex_trylock(lock) ||
+- mutex_optimistic_spin(lock, ww_ctx, use_ww_ctx, NULL)) {
++ mutex_optimistic_spin(lock, ww_ctx, NULL)) {
+ /* got the lock, yay! */
+ lock_acquired(&lock->dep_map, ip);
+- if (use_ww_ctx && ww_ctx)
++ if (ww_ctx)
+ ww_mutex_set_context_fastpath(ww, ww_ctx);
+ preempt_enable();
+ return 0;
+@@ -939,7 +942,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ * After waiting to acquire the wait_lock, try again.
+ */
+ if (__mutex_trylock(lock)) {
+- if (use_ww_ctx && ww_ctx)
++ if (ww_ctx)
+ __ww_mutex_check_waiters(lock, ww_ctx);
+
+ goto skip_wait;
+@@ -992,7 +995,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ goto err;
+ }
+
+- if (use_ww_ctx && ww_ctx) {
++ if (ww_ctx) {
+ ret = __ww_mutex_check_kill(lock, &waiter, ww_ctx);
+ if (ret)
+ goto err;
+@@ -1005,7 +1008,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ * ww_mutex needs to always recheck its position since its waiter
+ * list is not FIFO ordered.
+ */
+- if ((use_ww_ctx && ww_ctx) || !first) {
++ if (ww_ctx || !first) {
+ first = __mutex_waiter_is_first(lock, &waiter);
+ if (first)
+ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
+@@ -1018,7 +1021,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ * or we must see its unlock and acquire.
+ */
+ if (__mutex_trylock(lock) ||
+- (first && mutex_optimistic_spin(lock, ww_ctx, use_ww_ctx, &waiter)))
++ (first && mutex_optimistic_spin(lock, ww_ctx, &waiter)))
+ break;
+
+ spin_lock(&lock->wait_lock);
+@@ -1027,7 +1030,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ acquired:
+ __set_current_state(TASK_RUNNING);
+
+- if (use_ww_ctx && ww_ctx) {
++ if (ww_ctx) {
+ /*
+ * Wound-Wait; we stole the lock (!first_waiter), check the
+ * waiters as anyone might want to wound us.
+@@ -1047,7 +1050,7 @@ skip_wait:
+ /* got the lock - cleanup and rejoice! */
+ lock_acquired(&lock->dep_map, ip);
+
+- if (use_ww_ctx && ww_ctx)
++ if (ww_ctx)
+ ww_mutex_lock_acquired(ww, ww_ctx);
+
+ spin_unlock(&lock->wait_lock);
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 88a4f9e2d06c7..bca0b6df53caf 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2645,7 +2645,8 @@ static void __ftrace_trace_stack(struct ring_buffer *buffer,
+ size *= sizeof(unsigned long);
+
+ event = __trace_buffer_lock_reserve(buffer, TRACE_STACK,
+- sizeof(*entry) + size, flags, pc);
++ (sizeof(*entry) - sizeof(entry->caller)) + size,
++ flags, pc);
+ if (!event)
+ goto out;
+ entry = ring_buffer_event_data(event);
+diff --git a/mm/memory.c b/mm/memory.c
+index c1a05c2484b09..c2011c51f15de 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -148,7 +148,7 @@ static int __init init_zero_pfn(void)
+ zero_pfn = page_to_pfn(ZERO_PAGE(0));
+ return 0;
+ }
+-core_initcall(init_zero_pfn);
++early_initcall(init_zero_pfn);
+
+
+ #if defined(SPLIT_RSS_COUNTING)
+diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
+index 2880ac4703790..20ec8e7f94236 100644
+--- a/net/appletalk/ddp.c
++++ b/net/appletalk/ddp.c
+@@ -1573,8 +1573,8 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ struct sk_buff *skb;
+ struct net_device *dev;
+ struct ddpehdr *ddp;
+- int size;
+- struct atalk_route *rt;
++ int size, hard_header_len;
++ struct atalk_route *rt, *rt_lo = NULL;
+ int err;
+
+ if (flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))
+@@ -1637,7 +1637,22 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ SOCK_DEBUG(sk, "SK %p: Size needed %d, device %s\n",
+ sk, size, dev->name);
+
+- size += dev->hard_header_len;
++ hard_header_len = dev->hard_header_len;
++ /* Leave room for loopback hardware header if necessary */
++ if (usat->sat_addr.s_node == ATADDR_BCAST &&
++ (dev->flags & IFF_LOOPBACK || !(rt->flags & RTF_GATEWAY))) {
++ struct atalk_addr at_lo;
++
++ at_lo.s_node = 0;
++ at_lo.s_net = 0;
++
++ rt_lo = atrtr_find(&at_lo);
++
++ if (rt_lo && rt_lo->dev->hard_header_len > hard_header_len)
++ hard_header_len = rt_lo->dev->hard_header_len;
++ }
++
++ size += hard_header_len;
+ release_sock(sk);
+ skb = sock_alloc_send_skb(sk, size, (flags & MSG_DONTWAIT), &err);
+ lock_sock(sk);
+@@ -1645,7 +1660,7 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ goto out;
+
+ skb_reserve(skb, ddp_dl->header_length);
+- skb_reserve(skb, dev->hard_header_len);
++ skb_reserve(skb, hard_header_len);
+ skb->dev = dev;
+
+ SOCK_DEBUG(sk, "SK %p: Begin build.\n", sk);
+@@ -1696,18 +1711,12 @@ static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ /* loop back */
+ skb_orphan(skb);
+ if (ddp->deh_dnode == ATADDR_BCAST) {
+- struct atalk_addr at_lo;
+-
+- at_lo.s_node = 0;
+- at_lo.s_net = 0;
+-
+- rt = atrtr_find(&at_lo);
+- if (!rt) {
++ if (!rt_lo) {
+ kfree_skb(skb);
+ err = -ENETUNREACH;
+ goto out;
+ }
+- dev = rt->dev;
++ dev = rt_lo->dev;
+ skb->dev = dev;
+ }
+ ddp_dl->request(ddp_dl, skb, dev->dev_addr);
+diff --git a/net/core/filter.c b/net/core/filter.c
+index bbf5dbb95644d..6272570fe1396 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2836,18 +2836,14 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
+ return 0;
+ }
+
+-static u32 __bpf_skb_max_len(const struct sk_buff *skb)
+-{
+- return skb->dev ? skb->dev->mtu + skb->dev->hard_header_len :
+- SKB_MAX_ALLOC;
+-}
++#define BPF_SKB_MAX_LEN SKB_MAX_ALLOC
+
+ static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff)
+ {
+ bool trans_same = skb->transport_header == skb->network_header;
+ u32 len_cur, len_diff_abs = abs(len_diff);
+ u32 len_min = bpf_skb_net_base_len(skb);
+- u32 len_max = __bpf_skb_max_len(skb);
++ u32 len_max = BPF_SKB_MAX_LEN;
+ __be16 proto = skb_protocol(skb, true);
+ bool shrink = len_diff < 0;
+ int ret;
+@@ -2926,7 +2922,7 @@ static int bpf_skb_trim_rcsum(struct sk_buff *skb, unsigned int new_len)
+ static inline int __bpf_skb_change_tail(struct sk_buff *skb, u32 new_len,
+ u64 flags)
+ {
+- u32 max_len = __bpf_skb_max_len(skb);
++ u32 max_len = BPF_SKB_MAX_LEN;
+ u32 min_len = __bpf_skb_min_len(skb);
+ int ret;
+
+@@ -3002,7 +2998,7 @@ static const struct bpf_func_proto sk_skb_change_tail_proto = {
+ static inline int __bpf_skb_change_head(struct sk_buff *skb, u32 head_room,
+ u64 flags)
+ {
+- u32 max_len = __bpf_skb_max_len(skb);
++ u32 max_len = BPF_SKB_MAX_LEN;
+ u32 new_len = skb->len + head_room;
+ int ret;
+
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index b438bed6749d4..2cd3508a37869 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -319,6 +319,11 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
+ if (!ipv6_unicast_destination(skb))
+ return 0; /* discard, don't send a reset here */
+
++ if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
++ __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
++ return 0;
++ }
++
+ if (dccp_bad_service_code(sk, service)) {
+ dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE;
+ goto drop;
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 534e2598981df..439a55d1aa993 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -698,12 +698,15 @@ static bool reqsk_queue_unlink(struct request_sock_queue *queue,
+ return found;
+ }
+
+-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req)
++bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req)
+ {
+- if (reqsk_queue_unlink(&inet_csk(sk)->icsk_accept_queue, req)) {
++ bool unlinked = reqsk_queue_unlink(&inet_csk(sk)->icsk_accept_queue, req);
++
++ if (unlinked) {
+ reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req);
+ reqsk_put(req);
+ }
++ return unlinked;
+ }
+ EXPORT_SYMBOL(inet_csk_reqsk_queue_drop);
+
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 9436fb9b6a3d3..a20b393b45016 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -815,8 +815,11 @@ embryonic_reset:
+ tcp_reset(sk);
+ }
+ if (!fastopen) {
+- inet_csk_reqsk_queue_drop(sk, req);
+- __NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
++ bool unlinked = inet_csk_reqsk_queue_drop(sk, req);
++
++ if (unlinked)
++ __NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
++ *req_stolen = !unlinked;
+ }
+ return NULL;
+ }
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index acf0749ee5bbd..57d84accbf1e3 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -222,16 +222,6 @@ static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev,
+ if (ipv6_addr_is_multicast(&hdr->saddr))
+ goto err;
+
+- /* While RFC4291 is not explicit about v4mapped addresses
+- * in IPv6 headers, it seems clear linux dual-stack
+- * model can not deal properly with these.
+- * Security models could be fooled by ::ffff:127.0.0.1 for example.
+- *
+- * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02
+- */
+- if (ipv6_addr_v4mapped(&hdr->saddr))
+- goto err;
+-
+ skb->transport_header = skb->network_header + sizeof(*hdr);
+ IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
+
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 6e84f2eb08d64..8d822df83b082 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1039,6 +1039,11 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
+ if (!ipv6_unicast_destination(skb))
+ goto drop;
+
++ if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
++ __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
++ return 0;
++ }
++
+ return tcp_conn_request(&tcp6_request_sock_ops,
+ &tcp_request_sock_ipv6_ops, sk, skb);
+
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index ab086081be9c7..a85d78d2bdb73 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -1766,11 +1766,14 @@ static int
+ svcauth_gss_release(struct svc_rqst *rqstp)
+ {
+ struct gss_svc_data *gsd = (struct gss_svc_data *)rqstp->rq_auth_data;
+- struct rpc_gss_wire_cred *gc = &gsd->clcred;
++ struct rpc_gss_wire_cred *gc;
+ struct xdr_buf *resbuf = &rqstp->rq_res;
+ int stat = -EINVAL;
+ struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
+
++ if (!gsd)
++ goto out;
++ gc = &gsd->clcred;
+ if (gc->gc_proc != RPC_GSS_PROC_DATA)
+ goto out;
+ /* Release can be called twice, but we only wrap once. */
+@@ -1811,10 +1814,10 @@ out_err:
+ if (rqstp->rq_cred.cr_group_info)
+ put_group_info(rqstp->rq_cred.cr_group_info);
+ rqstp->rq_cred.cr_group_info = NULL;
+- if (gsd->rsci)
++ if (gsd && gsd->rsci) {
+ cache_put(&gsd->rsci->h, sn->rsc_cache);
+- gsd->rsci = NULL;
+-
++ gsd->rsci = NULL;
++ }
+ return stat;
+ }
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 4b65db13e1bba..aceafec612a8f 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -628,6 +628,7 @@ struct sock *__vsock_create(struct net *net,
+ vsk->trusted = psk->trusted;
+ vsk->owner = get_cred(psk->owner);
+ vsk->connect_timeout = psk->connect_timeout;
++ security_sk_clone(parent, sk);
+ } else {
+ vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN);
+ vsk->owner = get_current_cred();
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 6a419b23adbc8..f456e5f67824c 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4870,7 +4870,7 @@ static void alc_determine_headset_type(struct hda_codec *codec)
+ case 0x10ec0274:
+ case 0x10ec0294:
+ alc_process_coef_fw(codec, coef0274);
+- msleep(80);
++ msleep(850);
+ val = alc_read_coef_idx(codec, 0x46);
+ is_ctia = (val & 0x00f0) == 0x00f0;
+ break;
+@@ -5054,6 +5054,7 @@ static void alc_update_headset_jack_cb(struct hda_codec *codec,
+ struct alc_spec *spec = codec->spec;
+ spec->current_headset_type = ALC_HEADSET_TYPE_UNKNOWN;
+ snd_hda_gen_hp_automute(codec, jack);
++ alc_update_headset_mode(codec);
+ }
+
+ static void alc_probe_headset_mode(struct hda_codec *codec)
+diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
+index 651329bf97432..fddfd227a9c0e 100644
+--- a/sound/soc/codecs/cs42l42.c
++++ b/sound/soc/codecs/cs42l42.c
+@@ -405,7 +405,7 @@ static const struct regmap_config cs42l42_regmap = {
+ };
+
+ static DECLARE_TLV_DB_SCALE(adc_tlv, -9600, 100, false);
+-static DECLARE_TLV_DB_SCALE(mixer_tlv, -6200, 100, false);
++static DECLARE_TLV_DB_SCALE(mixer_tlv, -6300, 100, true);
+
+ static const char * const cs42l42_hpf_freq_text[] = {
+ "1.86Hz", "120Hz", "235Hz", "466Hz"
+@@ -462,7 +462,7 @@ static const struct snd_kcontrol_new cs42l42_snd_controls[] = {
+ CS42L42_DAC_HPF_EN_SHIFT, true, false),
+ SOC_DOUBLE_R_TLV("Mixer Volume", CS42L42_MIXER_CHA_VOL,
+ CS42L42_MIXER_CHB_VOL, CS42L42_MIXER_CH_VOL_SHIFT,
+- 0x3e, 1, mixer_tlv)
++ 0x3f, 1, mixer_tlv)
+ };
+
+ static int cs42l42_hpdrv_evt(struct snd_soc_dapm_widget *w,
+@@ -695,24 +695,6 @@ static int cs42l42_pll_config(struct snd_soc_component *component)
+ CS42L42_CLK_OASRC_SEL_MASK,
+ CS42L42_CLK_OASRC_SEL_12 <<
+ CS42L42_CLK_OASRC_SEL_SHIFT);
+- /* channel 1 on low LRCLK, 32 bit */
+- snd_soc_component_update_bits(component,
+- CS42L42_ASP_RX_DAI0_CH1_AP_RES,
+- CS42L42_ASP_RX_CH_AP_MASK |
+- CS42L42_ASP_RX_CH_RES_MASK,
+- (CS42L42_ASP_RX_CH_AP_LOW <<
+- CS42L42_ASP_RX_CH_AP_SHIFT) |
+- (CS42L42_ASP_RX_CH_RES_32 <<
+- CS42L42_ASP_RX_CH_RES_SHIFT));
+- /* Channel 2 on high LRCLK, 32 bit */
+- snd_soc_component_update_bits(component,
+- CS42L42_ASP_RX_DAI0_CH2_AP_RES,
+- CS42L42_ASP_RX_CH_AP_MASK |
+- CS42L42_ASP_RX_CH_RES_MASK,
+- (CS42L42_ASP_RX_CH_AP_HI <<
+- CS42L42_ASP_RX_CH_AP_SHIFT) |
+- (CS42L42_ASP_RX_CH_RES_32 <<
+- CS42L42_ASP_RX_CH_RES_SHIFT));
+ if (pll_ratio_table[i].mclk_src_sel == 0) {
+ /* Pass the clock straight through */
+ snd_soc_component_update_bits(component,
+@@ -801,27 +783,23 @@ static int cs42l42_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
+ /* Bitclock/frame inversion */
+ switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+ case SND_SOC_DAIFMT_NB_NF:
++ asp_cfg_val |= CS42L42_ASP_SCPOL_NOR << CS42L42_ASP_SCPOL_SHIFT;
+ break;
+ case SND_SOC_DAIFMT_NB_IF:
+- asp_cfg_val |= CS42L42_ASP_POL_INV <<
+- CS42L42_ASP_LCPOL_IN_SHIFT;
++ asp_cfg_val |= CS42L42_ASP_SCPOL_NOR << CS42L42_ASP_SCPOL_SHIFT;
++ asp_cfg_val |= CS42L42_ASP_LCPOL_INV << CS42L42_ASP_LCPOL_SHIFT;
+ break;
+ case SND_SOC_DAIFMT_IB_NF:
+- asp_cfg_val |= CS42L42_ASP_POL_INV <<
+- CS42L42_ASP_SCPOL_IN_DAC_SHIFT;
+ break;
+ case SND_SOC_DAIFMT_IB_IF:
+- asp_cfg_val |= CS42L42_ASP_POL_INV <<
+- CS42L42_ASP_LCPOL_IN_SHIFT;
+- asp_cfg_val |= CS42L42_ASP_POL_INV <<
+- CS42L42_ASP_SCPOL_IN_DAC_SHIFT;
++ asp_cfg_val |= CS42L42_ASP_LCPOL_INV << CS42L42_ASP_LCPOL_SHIFT;
+ break;
+ }
+
+- snd_soc_component_update_bits(component, CS42L42_ASP_CLK_CFG,
+- CS42L42_ASP_MODE_MASK |
+- CS42L42_ASP_SCPOL_IN_DAC_MASK |
+- CS42L42_ASP_LCPOL_IN_MASK, asp_cfg_val);
++ snd_soc_component_update_bits(component, CS42L42_ASP_CLK_CFG, CS42L42_ASP_MODE_MASK |
++ CS42L42_ASP_SCPOL_MASK |
++ CS42L42_ASP_LCPOL_MASK,
++ asp_cfg_val);
+
+ return 0;
+ }
+@@ -832,14 +810,29 @@ static int cs42l42_pcm_hw_params(struct snd_pcm_substream *substream,
+ {
+ struct snd_soc_component *component = dai->component;
+ struct cs42l42_private *cs42l42 = snd_soc_component_get_drvdata(component);
+- int retval;
++ unsigned int width = (params_width(params) / 8) - 1;
++ unsigned int val = 0;
+
+ cs42l42->srate = params_rate(params);
+- cs42l42->swidth = params_width(params);
+
+- retval = cs42l42_pll_config(component);
++ switch(substream->stream) {
++ case SNDRV_PCM_STREAM_PLAYBACK:
++ val |= width << CS42L42_ASP_RX_CH_RES_SHIFT;
++ /* channel 1 on low LRCLK */
++ snd_soc_component_update_bits(component, CS42L42_ASP_RX_DAI0_CH1_AP_RES,
++ CS42L42_ASP_RX_CH_AP_MASK |
++ CS42L42_ASP_RX_CH_RES_MASK, val);
++ /* Channel 2 on high LRCLK */
++ val |= CS42L42_ASP_RX_CH_AP_HI << CS42L42_ASP_RX_CH_AP_SHIFT;
++ snd_soc_component_update_bits(component, CS42L42_ASP_RX_DAI0_CH2_AP_RES,
++ CS42L42_ASP_RX_CH_AP_MASK |
++ CS42L42_ASP_RX_CH_RES_MASK, val);
++ break;
++ default:
++ break;
++ }
+
+- return retval;
++ return cs42l42_pll_config(component);
+ }
+
+ static int cs42l42_set_sysclk(struct snd_soc_dai *dai,
+@@ -904,9 +897,9 @@ static int cs42l42_digital_mute(struct snd_soc_dai *dai, int mute)
+ return 0;
+ }
+
+-#define CS42L42_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S18_3LE | \
+- SNDRV_PCM_FMTBIT_S20_3LE | SNDRV_PCM_FMTBIT_S24_LE | \
+- SNDRV_PCM_FMTBIT_S32_LE)
++#define CS42L42_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\
++ SNDRV_PCM_FMTBIT_S24_LE |\
++ SNDRV_PCM_FMTBIT_S32_LE )
+
+
+ static const struct snd_soc_dai_ops cs42l42_ops = {
+@@ -1807,7 +1800,7 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,
+ dev_dbg(&i2c_client->dev, "Found reset GPIO\n");
+ gpiod_set_value_cansleep(cs42l42->reset_gpio, 1);
+ }
+- mdelay(3);
++ usleep_range(CS42L42_BOOT_TIME_US, CS42L42_BOOT_TIME_US * 2);
+
+ /* Request IRQ */
+ ret = devm_request_threaded_irq(&i2c_client->dev,
+@@ -1932,6 +1925,7 @@ static int cs42l42_runtime_resume(struct device *dev)
+ }
+
+ gpiod_set_value_cansleep(cs42l42->reset_gpio, 1);
++ usleep_range(CS42L42_BOOT_TIME_US, CS42L42_BOOT_TIME_US * 2);
+
+ regcache_cache_only(cs42l42->regmap, false);
+ regcache_sync(cs42l42->regmap);
+diff --git a/sound/soc/codecs/cs42l42.h b/sound/soc/codecs/cs42l42.h
+index 09b0a93203efb..bcaf4f22408d6 100644
+--- a/sound/soc/codecs/cs42l42.h
++++ b/sound/soc/codecs/cs42l42.h
+@@ -262,11 +262,12 @@
+ #define CS42L42_ASP_SLAVE_MODE 0x00
+ #define CS42L42_ASP_MODE_SHIFT 4
+ #define CS42L42_ASP_MODE_MASK (1 << CS42L42_ASP_MODE_SHIFT)
+-#define CS42L42_ASP_SCPOL_IN_DAC_SHIFT 2
+-#define CS42L42_ASP_SCPOL_IN_DAC_MASK (1 << CS42L42_ASP_SCPOL_IN_DAC_SHIFT)
+-#define CS42L42_ASP_LCPOL_IN_SHIFT 0
+-#define CS42L42_ASP_LCPOL_IN_MASK (1 << CS42L42_ASP_LCPOL_IN_SHIFT)
+-#define CS42L42_ASP_POL_INV 1
++#define CS42L42_ASP_SCPOL_SHIFT 2
++#define CS42L42_ASP_SCPOL_MASK (3 << CS42L42_ASP_SCPOL_SHIFT)
++#define CS42L42_ASP_SCPOL_NOR 3
++#define CS42L42_ASP_LCPOL_SHIFT 0
++#define CS42L42_ASP_LCPOL_MASK (3 << CS42L42_ASP_LCPOL_SHIFT)
++#define CS42L42_ASP_LCPOL_INV 3
+
+ #define CS42L42_ASP_FRM_CFG (CS42L42_PAGE_12 + 0x08)
+ #define CS42L42_ASP_STP_SHIFT 4
+@@ -743,6 +744,7 @@
+ #define CS42L42_FRAC2_VAL(val) (((val) & 0xff0000) >> 16)
+
+ #define CS42L42_NUM_SUPPLIES 5
++#define CS42L42_BOOT_TIME_US 3000
+
+ static const char *const cs42l42_supply_names[CS42L42_NUM_SUPPLIES] = {
+ "VA",
+@@ -760,7 +762,6 @@ struct cs42l42_private {
+ struct completion pdn_done;
+ u32 sclk;
+ u32 srate;
+- u32 swidth;
+ u8 plug_state;
+ u8 hs_type;
+ u8 ts_inv;
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index 9ebe77c3784a8..57130edaf3aba 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -56,13 +56,8 @@ static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(adc_pga_gain_tlv,
+ 1, 1, TLV_DB_SCALE_ITEM(0, 0, 0),
+ 2, 2, TLV_DB_SCALE_ITEM(250, 0, 0),
+ 3, 3, TLV_DB_SCALE_ITEM(450, 0, 0),
+- 4, 4, TLV_DB_SCALE_ITEM(700, 0, 0),
+- 5, 5, TLV_DB_SCALE_ITEM(1000, 0, 0),
+- 6, 6, TLV_DB_SCALE_ITEM(1300, 0, 0),
+- 7, 7, TLV_DB_SCALE_ITEM(1600, 0, 0),
+- 8, 8, TLV_DB_SCALE_ITEM(1800, 0, 0),
+- 9, 9, TLV_DB_SCALE_ITEM(2100, 0, 0),
+- 10, 10, TLV_DB_SCALE_ITEM(2400, 0, 0),
++ 4, 7, TLV_DB_SCALE_ITEM(700, 300, 0),
++ 8, 10, TLV_DB_SCALE_ITEM(1800, 300, 0),
+ );
+
+ static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(hpout_vol_tlv,
+diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
+index 974e1a4491723..63e19a6a9790e 100644
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -342,9 +342,9 @@ static bool rt5640_readable_register(struct device *dev, unsigned int reg)
+ }
+
+ static const DECLARE_TLV_DB_SCALE(out_vol_tlv, -4650, 150, 0);
+-static const DECLARE_TLV_DB_SCALE(dac_vol_tlv, -65625, 375, 0);
++static const DECLARE_TLV_DB_MINMAX(dac_vol_tlv, -6562, 0);
+ static const DECLARE_TLV_DB_SCALE(in_vol_tlv, -3450, 150, 0);
+-static const DECLARE_TLV_DB_SCALE(adc_vol_tlv, -17625, 375, 0);
++static const DECLARE_TLV_DB_MINMAX(adc_vol_tlv, -1762, 3000);
+ static const DECLARE_TLV_DB_SCALE(adc_bst_tlv, 0, 1200, 0);
+
+ /* {0, +20, +24, +30, +35, +40, +44, +50, +52} dB */
+diff --git a/sound/soc/codecs/rt5651.c b/sound/soc/codecs/rt5651.c
+index 985852fd97238..318a4c9b380fb 100644
+--- a/sound/soc/codecs/rt5651.c
++++ b/sound/soc/codecs/rt5651.c
+@@ -288,9 +288,9 @@ static bool rt5651_readable_register(struct device *dev, unsigned int reg)
+ }
+
+ static const DECLARE_TLV_DB_SCALE(out_vol_tlv, -4650, 150, 0);
+-static const DECLARE_TLV_DB_SCALE(dac_vol_tlv, -65625, 375, 0);
++static const DECLARE_TLV_DB_MINMAX(dac_vol_tlv, -6562, 0);
+ static const DECLARE_TLV_DB_SCALE(in_vol_tlv, -3450, 150, 0);
+-static const DECLARE_TLV_DB_SCALE(adc_vol_tlv, -17625, 375, 0);
++static const DECLARE_TLV_DB_MINMAX(adc_vol_tlv, -1762, 3000);
+ static const DECLARE_TLV_DB_SCALE(adc_bst_tlv, 0, 1200, 0);
+
+ /* {0, +20, +24, +30, +35, +40, +44, +50, +52} dB */
+diff --git a/sound/soc/codecs/rt5659.c b/sound/soc/codecs/rt5659.c
+index 1c1a521c73cb4..b331b3ba61a9b 100644
+--- a/sound/soc/codecs/rt5659.c
++++ b/sound/soc/codecs/rt5659.c
+@@ -3466,12 +3466,17 @@ static int rt5659_set_component_sysclk(struct snd_soc_component *component, int
+ {
+ struct rt5659_priv *rt5659 = snd_soc_component_get_drvdata(component);
+ unsigned int reg_val = 0;
++ int ret;
+
+ if (freq == rt5659->sysclk && clk_id == rt5659->sysclk_src)
+ return 0;
+
+ switch (clk_id) {
+ case RT5659_SCLK_S_MCLK:
++ ret = clk_set_rate(rt5659->mclk, freq);
++ if (ret)
++ return ret;
++
+ reg_val |= RT5659_SCLK_SRC_MCLK;
+ break;
+ case RT5659_SCLK_S_PLL1:
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 7c0a06b487f74..17255e9683f59 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -71,7 +71,7 @@ static const struct reg_default sgtl5000_reg_defaults[] = {
+ { SGTL5000_DAP_EQ_BASS_BAND4, 0x002f },
+ { SGTL5000_DAP_MAIN_CHAN, 0x8000 },
+ { SGTL5000_DAP_MIX_CHAN, 0x0000 },
+- { SGTL5000_DAP_AVC_CTRL, 0x0510 },
++ { SGTL5000_DAP_AVC_CTRL, 0x5100 },
+ { SGTL5000_DAP_AVC_THRESHOLD, 0x1473 },
+ { SGTL5000_DAP_AVC_ATTACK, 0x0028 },
+ { SGTL5000_DAP_AVC_DECAY, 0x0050 },
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index f08da98d0192a..717edf3b5d3e3 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1187,6 +1187,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
+ case USB_ID(0x2912, 0x30c8): /* Audioengine D1 */
+ case USB_ID(0x413c, 0xa506): /* Dell AE515 sound bar */
++ case USB_ID(0x046d, 0x084c): /* Logitech ConferenceCam Connect */
+ return true;
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-04-10 13:24 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-04-10 13:24 UTC (permalink / raw
To: gentoo-commits
commit: 416839b83f9e0ded7b2b9413a2998375852a1910
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Apr 10 13:24:45 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Apr 10 13:24:45 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=416839b8
Linuxpatch 4.19.186
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1185_linux-4.19.186.patch | 360 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 364 insertions(+)
diff --git a/0000_README b/0000_README
index 8399430..d2cbfb4 100644
--- a/0000_README
+++ b/0000_README
@@ -779,6 +779,10 @@ Patch: 1184_linux-4.19.185.patch
From: https://www.kernel.org
Desc: Linux 4.19.185
+Patch: 1185_linux-4.19.186.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.186
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1185_linux-4.19.186.patch b/1185_linux-4.19.186.patch
new file mode 100644
index 0000000..5bebd4e
--- /dev/null
+++ b/1185_linux-4.19.186.patch
@@ -0,0 +1,360 @@
+diff --git a/Makefile b/Makefile
+index e4f0127745732..fae98a0dc155b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 185
++SUBLEVEL = 186
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
+index d3dd6a16e70a7..e321acaf35d66 100644
+--- a/arch/arm/boot/dts/am33xx.dtsi
++++ b/arch/arm/boot/dts/am33xx.dtsi
+@@ -39,6 +39,9 @@
+ ethernet1 = &cpsw_emac1;
+ spi0 = &spi0;
+ spi1 = &spi1;
++ mmc0 = &mmc1;
++ mmc1 = &mmc2;
++ mmc2 = &mmc3;
+ };
+
+ cpus {
+diff --git a/arch/ia64/kernel/err_inject.c b/arch/ia64/kernel/err_inject.c
+index 8b5b8e6bc9d9a..dd5bfed52031d 100644
+--- a/arch/ia64/kernel/err_inject.c
++++ b/arch/ia64/kernel/err_inject.c
+@@ -59,7 +59,7 @@ show_##name(struct device *dev, struct device_attribute *attr, \
+ char *buf) \
+ { \
+ u32 cpu=dev->id; \
+- return sprintf(buf, "%lx\n", name[cpu]); \
++ return sprintf(buf, "%llx\n", name[cpu]); \
+ }
+
+ #define store(name) \
+@@ -86,9 +86,9 @@ store_call_start(struct device *dev, struct device_attribute *attr,
+
+ #ifdef ERR_INJ_DEBUG
+ printk(KERN_DEBUG "pal_mc_err_inject for cpu%d:\n", cpu);
+- printk(KERN_DEBUG "err_type_info=%lx,\n", err_type_info[cpu]);
+- printk(KERN_DEBUG "err_struct_info=%lx,\n", err_struct_info[cpu]);
+- printk(KERN_DEBUG "err_data_buffer=%lx, %lx, %lx.\n",
++ printk(KERN_DEBUG "err_type_info=%llx,\n", err_type_info[cpu]);
++ printk(KERN_DEBUG "err_struct_info=%llx,\n", err_struct_info[cpu]);
++ printk(KERN_DEBUG "err_data_buffer=%llx, %llx, %llx.\n",
+ err_data_buffer[cpu].data1,
+ err_data_buffer[cpu].data2,
+ err_data_buffer[cpu].data3);
+@@ -117,8 +117,8 @@ store_call_start(struct device *dev, struct device_attribute *attr,
+
+ #ifdef ERR_INJ_DEBUG
+ printk(KERN_DEBUG "Returns: status=%d,\n", (int)status[cpu]);
+- printk(KERN_DEBUG "capabilities=%lx,\n", capabilities[cpu]);
+- printk(KERN_DEBUG "resources=%lx\n", resources[cpu]);
++ printk(KERN_DEBUG "capabilities=%llx,\n", capabilities[cpu]);
++ printk(KERN_DEBUG "resources=%llx\n", resources[cpu]);
+ #endif
+ return size;
+ }
+@@ -131,7 +131,7 @@ show_virtual_to_phys(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+ unsigned int cpu=dev->id;
+- return sprintf(buf, "%lx\n", phys_addr[cpu]);
++ return sprintf(buf, "%llx\n", phys_addr[cpu]);
+ }
+
+ static ssize_t
+@@ -145,7 +145,7 @@ store_virtual_to_phys(struct device *dev, struct device_attribute *attr,
+ ret = get_user_pages_fast(virt_addr, 1, FOLL_WRITE, NULL);
+ if (ret<=0) {
+ #ifdef ERR_INJ_DEBUG
+- printk("Virtual address %lx is not existing.\n",virt_addr);
++ printk("Virtual address %llx is not existing.\n", virt_addr);
+ #endif
+ return -EINVAL;
+ }
+@@ -163,7 +163,7 @@ show_err_data_buffer(struct device *dev,
+ {
+ unsigned int cpu=dev->id;
+
+- return sprintf(buf, "%lx, %lx, %lx\n",
++ return sprintf(buf, "%llx, %llx, %llx\n",
+ err_data_buffer[cpu].data1,
+ err_data_buffer[cpu].data2,
+ err_data_buffer[cpu].data3);
+@@ -178,13 +178,13 @@ store_err_data_buffer(struct device *dev,
+ int ret;
+
+ #ifdef ERR_INJ_DEBUG
+- printk("write err_data_buffer=[%lx,%lx,%lx] on cpu%d\n",
++ printk("write err_data_buffer=[%llx,%llx,%llx] on cpu%d\n",
+ err_data_buffer[cpu].data1,
+ err_data_buffer[cpu].data2,
+ err_data_buffer[cpu].data3,
+ cpu);
+ #endif
+- ret=sscanf(buf, "%lx, %lx, %lx",
++ ret = sscanf(buf, "%llx, %llx, %llx",
+ &err_data_buffer[cpu].data1,
+ &err_data_buffer[cpu].data2,
+ &err_data_buffer[cpu].data3);
+diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
+index 6115464d5f03d..d7400b2844f1c 100644
+--- a/arch/ia64/kernel/mca.c
++++ b/arch/ia64/kernel/mca.c
+@@ -1860,7 +1860,7 @@ ia64_mca_cpu_init(void *cpu_data)
+ data = mca_bootmem();
+ first_time = 0;
+ } else
+- data = (void *)__get_free_pages(GFP_KERNEL,
++ data = (void *)__get_free_pages(GFP_ATOMIC,
+ get_order(sz));
+ if (!data)
+ panic("Could not allocate MCA memory for cpu %d\n",
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 75200b421f29b..6ebdbad21fb2a 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -34,7 +34,7 @@ M16_CFLAGS := $(call cc-option, -m16, $(CODE16GCC_CFLAGS))
+ REALMODE_CFLAGS := $(M16_CFLAGS) -g -Os -DDISABLE_BRANCH_PROFILING \
+ -Wall -Wstrict-prototypes -march=i386 -mregparm=3 \
+ -fno-strict-aliasing -fomit-frame-pointer -fno-pic \
+- -mno-mmx -mno-sse
++ -mno-mmx -mno-sse $(call cc-option,-fcf-protection=none)
+
+ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -ffreestanding)
+ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -fno-stack-protector)
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 46ab928312517..924ca27a6139b 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -1019,7 +1019,16 @@ emit_jmp:
+ }
+
+ if (image) {
+- if (unlikely(proglen + ilen > oldproglen)) {
++ /*
++ * When populating the image, assert that:
++ *
++ * i) We do not write beyond the allocated space, and
++ * ii) addrs[i] did not change from the prior run, in order
++ * to validate assumptions made for computing branch
++ * displacements.
++ */
++ if (unlikely(proglen + ilen > oldproglen ||
++ proglen + ilen != addrs[i])) {
+ pr_err("bpf_jit: fatal error\n");
+ return -EFAULT;
+ }
+diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
+index 2eaf1900ba673..adee990abab14 100644
+--- a/arch/x86/net/bpf_jit_comp32.c
++++ b/arch/x86/net/bpf_jit_comp32.c
+@@ -2201,7 +2201,16 @@ notyet:
+ }
+
+ if (image) {
+- if (unlikely(proglen + ilen > oldproglen)) {
++ /*
++ * When populating the image, assert that:
++ *
++ * i) We do not write beyond the allocated space, and
++ * ii) addrs[i] did not change from the prior run, in order
++ * to validate assumptions made for computing branch
++ * displacements.
++ */
++ if (unlikely(proglen + ilen > oldproglen ||
++ proglen + ilen != addrs[i])) {
+ pr_err("bpf_jit: fatal error\n");
+ return -EFAULT;
+ }
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 54c8c8644df2e..b6a278183d827 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -1814,7 +1814,9 @@ static int sysc_remove(struct platform_device *pdev)
+
+ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- reset_control_assert(ddata->rsts);
++
++ if (!reset_control_status(ddata->rsts))
++ reset_control_assert(ddata->rsts);
+
+ unprepare:
+ sysc_unprepare(ddata);
+diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c
+index 349c12f670eb8..6c11be79574e5 100644
+--- a/drivers/gpu/drm/msm/msm_fence.c
++++ b/drivers/gpu/drm/msm/msm_fence.c
+@@ -56,7 +56,7 @@ int msm_wait_fence(struct msm_fence_context *fctx, uint32_t fence,
+ int ret;
+
+ if (fence > fctx->last_fence) {
+- DRM_ERROR("%s: waiting on invalid fence: %u (of %u)\n",
++ DRM_ERROR_RATELIMITED("%s: waiting on invalid fence: %u (of %u)\n",
+ fctx->name, fence, fctx->last_fence);
+ return -EINVAL;
+ }
+diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
+index 4d78f870435ec..71e635d6c64a2 100644
+--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
++++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
+@@ -710,7 +710,7 @@ isac_release(struct isac_hw *isac)
+ {
+ if (isac->type & IPAC_TYPE_ISACX)
+ WriteISAC(isac, ISACX_MASK, 0xff);
+- else
++ else if (isac->type != 0)
+ WriteISAC(isac, ISAC_MASK, 0xff);
+ if (isac->dch.timer.function != NULL) {
+ del_timer(&isac->dch.timer);
+diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
+index ff2fea0f8b751..0d6a4e47e7a50 100644
+--- a/drivers/net/ethernet/marvell/pxa168_eth.c
++++ b/drivers/net/ethernet/marvell/pxa168_eth.c
+@@ -1564,8 +1564,8 @@ static int pxa168_eth_remove(struct platform_device *pdev)
+
+ mdiobus_unregister(pep->smi_bus);
+ mdiobus_free(pep->smi_bus);
+- unregister_netdev(dev);
+ cancel_work_sync(&pep->tx_timeout_task);
++ unregister_netdev(dev);
+ free_netdev(dev);
+ return 0;
+ }
+diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
+index d7d69eadb9bba..fa3cda69cec96 100644
+--- a/drivers/platform/x86/intel-hid.c
++++ b/drivers/platform/x86/intel-hid.c
+@@ -94,6 +94,13 @@ static const struct dmi_system_id button_array_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x2 Detachable"),
+ },
+ },
++ {
++ .ident = "Lenovo ThinkPad X1 Tablet Gen 2",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Tablet Gen 2"),
++ },
++ },
+ { }
+ };
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index a6e69f2495d23..559698640fe29 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -4102,13 +4102,19 @@ static bool hotkey_notify_6xxx(const u32 hkey,
+
+ case TP_HKEY_EV_KEY_NUMLOCK:
+ case TP_HKEY_EV_KEY_FN:
+- case TP_HKEY_EV_KEY_FN_ESC:
+ /* key press events, we just ignore them as long as the EC
+ * is still reporting them in the normal keyboard stream */
+ *send_acpi_ev = false;
+ *ignore_acpi_ev = true;
+ return true;
+
++ case TP_HKEY_EV_KEY_FN_ESC:
++ /* Get the media key status to foce the status LED to update */
++ acpi_evalf(hkey_handle, NULL, "GMKS", "v");
++ *send_acpi_ev = false;
++ *ignore_acpi_ev = true;
++ return true;
++
+ case TP_HKEY_EV_TABLET_CHANGED:
+ tpacpi_input_send_tabletsw();
+ hotkey_tablet_mode_notify_change();
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index 47d76c8620147..02c4e3beb2640 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -970,6 +970,14 @@ new_bio:
+
+ return 0;
+ fail:
++ if (bio)
++ bio_put(bio);
++ while (req->bio) {
++ bio = req->bio;
++ req->bio = bio->bi_next;
++ bio_put(bio);
++ }
++ req->biotail = NULL;
+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+ }
+
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 5cb15649adb07..7b482489bd227 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -163,6 +163,7 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
+ goto posix_open_ret;
+ }
+ } else {
++ cifs_revalidate_mapping(*pinode);
+ cifs_fattr_to_inode(*pinode, &fattr);
+ }
+
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 7d875a47d0226..7177720e822e1 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -738,8 +738,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ }
+ }
+ spin_unlock(&cifs_tcp_ses_lock);
+- cifs_dbg(FYI, "Can not process oplock break for non-existent connection\n");
+- return false;
++ cifs_dbg(FYI, "No file id matched, oplock break ignored\n");
++ return true;
+ }
+
+ void
+diff --git a/init/Kconfig b/init/Kconfig
+index 5eb91dde4018c..b56a125b5a76d 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -66,8 +66,7 @@ config INIT_ENV_ARG_LIMIT
+
+ config COMPILE_TEST
+ bool "Compile also drivers which will not load"
+- depends on !UML
+- default n
++ depends on HAS_IOMEM
+ help
+ Some drivers can be compiled on a different platform than they are
+ intended to be run on. Despite they cannot be loaded there (or even
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 68db2a3564431..f44d00f35fe7b 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -931,8 +931,19 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ continue;
+
+ if (!dflt_chandef.chan) {
++ /*
++ * Assign the first enabled channel to dflt_chandef
++ * from the list of channels
++ */
++ for (i = 0; i < sband->n_channels; i++)
++ if (!(sband->channels[i].flags &
++ IEEE80211_CHAN_DISABLED))
++ break;
++ /* if none found then use the first anyway */
++ if (i == sband->n_channels)
++ i = 0;
+ cfg80211_chandef_create(&dflt_chandef,
+- &sband->channels[0],
++ &sband->channels[i],
+ NL80211_CHAN_NO_HT);
+ /* init channel we're on */
+ if (!local->use_chanctx && !local->_oper_chandef.chan) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-04-14 11:22 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-04-14 11:22 UTC (permalink / raw
To: gentoo-commits
commit: 86344ecc0450c084f9a9c87ffcf6c9746c1653e9
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 14 11:22:08 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Apr 14 11:22:20 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=86344ecc
Linux patch 4.19.187
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1186_linux-4.19.187.patch | 1900 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1904 insertions(+)
diff --git a/0000_README b/0000_README
index d2cbfb4..0fdb045 100644
--- a/0000_README
+++ b/0000_README
@@ -783,6 +783,10 @@ Patch: 1185_linux-4.19.186.patch
From: https://www.kernel.org
Desc: Linux 4.19.186
+Patch: 1186_linux-4.19.187.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.187
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1186_linux-4.19.187.patch b/1186_linux-4.19.187.patch
new file mode 100644
index 0000000..ed90e91
--- /dev/null
+++ b/1186_linux-4.19.187.patch
@@ -0,0 +1,1900 @@
+diff --git a/Makefile b/Makefile
+index fae98a0dc155b..ceec39b530bbe 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 186
++SUBLEVEL = 187
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/armada-385-turris-omnia.dts b/arch/arm/boot/dts/armada-385-turris-omnia.dts
+index 768b6c5d2129a..fde4c302f08ec 100644
+--- a/arch/arm/boot/dts/armada-385-turris-omnia.dts
++++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts
+@@ -236,6 +236,7 @@
+ status = "okay";
+ compatible = "ethernet-phy-id0141.0DD1", "ethernet-phy-ieee802.3-c22";
+ reg = <1>;
++ marvell,reg-init = <3 18 0 0x4985>;
+
+ /* irq is connected to &pcawan pin 7 */
+ };
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+index fe4e89d773f54..9499d113b1394 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+@@ -423,6 +423,7 @@
+ pinctrl-0 = <&pinctrl_usdhc2>;
+ cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+ wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
++ vmmc-supply = <&vdd_sd1_reg>;
+ status = "disabled";
+ };
+
+@@ -432,5 +433,6 @@
+ &pinctrl_usdhc3_cdwp>;
+ cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
+ wp-gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>;
++ vmmc-supply = <&vdd_sd0_reg>;
+ status = "disabled";
+ };
+diff --git a/arch/ia64/include/asm/ptrace.h b/arch/ia64/include/asm/ptrace.h
+index 7ff574d56429c..f31e07fc936d9 100644
+--- a/arch/ia64/include/asm/ptrace.h
++++ b/arch/ia64/include/asm/ptrace.h
+@@ -54,8 +54,7 @@
+
+ static inline unsigned long user_stack_pointer(struct pt_regs *regs)
+ {
+- /* FIXME: should this be bspstore + nr_dirty regs? */
+- return regs->ar_bspstore;
++ return regs->r12;
+ }
+
+ static inline int is_syscall_success(struct pt_regs *regs)
+@@ -79,11 +78,6 @@ static inline long regs_return_value(struct pt_regs *regs)
+ unsigned long __ip = instruction_pointer(regs); \
+ (__ip & ~3UL) + ((__ip & 3UL) << 2); \
+ })
+-/*
+- * Why not default? Because user_stack_pointer() on ia64 gives register
+- * stack backing store instead...
+- */
+-#define current_user_stack_pointer() (current_pt_regs()->r12)
+
+ /* given a pointer to a task_struct, return the user's pt_regs */
+ # define task_pt_regs(t) (((struct pt_regs *) ((char *) (t) + IA64_STK_OFFSET)) - 1)
+diff --git a/arch/nds32/mm/cacheflush.c b/arch/nds32/mm/cacheflush.c
+index 254703653b6f5..f34dc9bc6758e 100644
+--- a/arch/nds32/mm/cacheflush.c
++++ b/arch/nds32/mm/cacheflush.c
+@@ -239,7 +239,7 @@ void flush_dcache_page(struct page *page)
+ {
+ struct address_space *mapping;
+
+- mapping = page_mapping(page);
++ mapping = page_mapping_file(page);
+ if (mapping && !mapping_mapped(mapping))
+ set_bit(PG_dcache_dirty, &page->flags);
+ else {
+diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h
+index 0689585758717..a736dc59bbef8 100644
+--- a/arch/parisc/include/asm/cmpxchg.h
++++ b/arch/parisc/include/asm/cmpxchg.h
+@@ -72,7 +72,7 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new_, int size)
+ #endif
+ case 4: return __cmpxchg_u32((unsigned int *)ptr,
+ (unsigned int)old, (unsigned int)new_);
+- case 1: return __cmpxchg_u8((u8 *)ptr, (u8)old, (u8)new_);
++ case 1: return __cmpxchg_u8((u8 *)ptr, old & 0xff, new_ & 0xff);
+ }
+ __cmpxchg_called_with_bad_pointer();
+ return old;
+diff --git a/arch/s390/kernel/cpcmd.c b/arch/s390/kernel/cpcmd.c
+index af013b4244d34..2da0273597989 100644
+--- a/arch/s390/kernel/cpcmd.c
++++ b/arch/s390/kernel/cpcmd.c
+@@ -37,10 +37,12 @@ static int diag8_noresponse(int cmdlen)
+
+ static int diag8_response(int cmdlen, char *response, int *rlen)
+ {
++ unsigned long _cmdlen = cmdlen | 0x40000000L;
++ unsigned long _rlen = *rlen;
+ register unsigned long reg2 asm ("2") = (addr_t) cpcmd_buf;
+ register unsigned long reg3 asm ("3") = (addr_t) response;
+- register unsigned long reg4 asm ("4") = cmdlen | 0x40000000L;
+- register unsigned long reg5 asm ("5") = *rlen;
++ register unsigned long reg4 asm ("4") = _cmdlen;
++ register unsigned long reg5 asm ("5") = _rlen;
+
+ asm volatile(
+ " diag %2,%0,0x8\n"
+diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
+index 6231714ef3c8f..cee9e42ce5478 100644
+--- a/drivers/char/agp/Kconfig
++++ b/drivers/char/agp/Kconfig
+@@ -125,7 +125,7 @@ config AGP_HP_ZX1
+
+ config AGP_PARISC
+ tristate "HP Quicksilver AGP support"
+- depends on AGP && PARISC && 64BIT
++ depends on AGP && PARISC && 64BIT && IOMMU_SBA
+ help
+ This option gives you AGP GART support for the HP Quicksilver
+ AGP bus adapter on HP PA-RISC machines (Ok, just on the C8000
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index c5cf9e77fe862..3806fd8fef0b1 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3628,20 +3628,19 @@ int clk_notifier_register(struct clk *clk, struct notifier_block *nb)
+ /* search the list of notifiers for this clk */
+ list_for_each_entry(cn, &clk_notifier_list, node)
+ if (cn->clk == clk)
+- break;
++ goto found;
+
+ /* if clk wasn't in the notifier list, allocate new clk_notifier */
+- if (cn->clk != clk) {
+- cn = kzalloc(sizeof(*cn), GFP_KERNEL);
+- if (!cn)
+- goto out;
++ cn = kzalloc(sizeof(*cn), GFP_KERNEL);
++ if (!cn)
++ goto out;
+
+- cn->clk = clk;
+- srcu_init_notifier_head(&cn->notifier_head);
++ cn->clk = clk;
++ srcu_init_notifier_head(&cn->notifier_head);
+
+- list_add(&cn->node, &clk_notifier_list);
+- }
++ list_add(&cn->node, &clk_notifier_list);
+
++found:
+ ret = srcu_notifier_chain_register(&cn->notifier_head, nb);
+
+ clk->core->notifier_count++;
+@@ -3666,32 +3665,28 @@ EXPORT_SYMBOL_GPL(clk_notifier_register);
+ */
+ int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb)
+ {
+- struct clk_notifier *cn = NULL;
+- int ret = -EINVAL;
++ struct clk_notifier *cn;
++ int ret = -ENOENT;
+
+ if (!clk || !nb)
+ return -EINVAL;
+
+ clk_prepare_lock();
+
+- list_for_each_entry(cn, &clk_notifier_list, node)
+- if (cn->clk == clk)
+- break;
+-
+- if (cn->clk == clk) {
+- ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb);
++ list_for_each_entry(cn, &clk_notifier_list, node) {
++ if (cn->clk == clk) {
++ ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb);
+
+- clk->core->notifier_count--;
++ clk->core->notifier_count--;
+
+- /* XXX the notifier code should handle this better */
+- if (!cn->notifier_head.head) {
+- srcu_cleanup_notifier_head(&cn->notifier_head);
+- list_del(&cn->node);
+- kfree(cn);
++ /* XXX the notifier code should handle this better */
++ if (!cn->notifier_head.head) {
++ srcu_cleanup_notifier_head(&cn->notifier_head);
++ list_del(&cn->node);
++ kfree(cn);
++ }
++ break;
+ }
+-
+- } else {
+- ret = -ENOENT;
+ }
+
+ clk_prepare_unlock();
+diff --git a/drivers/clk/socfpga/clk-gate.c b/drivers/clk/socfpga/clk-gate.c
+index aa7a6e6a15b65..14918896811d6 100644
+--- a/drivers/clk/socfpga/clk-gate.c
++++ b/drivers/clk/socfpga/clk-gate.c
+@@ -107,7 +107,7 @@ static unsigned long socfpga_clk_recalc_rate(struct clk_hw *hwclk,
+ val = readl(socfpgaclk->div_reg) >> socfpgaclk->shift;
+ val &= GENMASK(socfpgaclk->width - 1, 0);
+ /* Check for GPIO_DB_CLK by its offset */
+- if ((int) socfpgaclk->div_reg & SOCFPGA_GPIO_DB_CLK_OFFSET)
++ if ((uintptr_t) socfpgaclk->div_reg & SOCFPGA_GPIO_DB_CLK_OFFSET)
+ div = val + 1;
+ else
+ div = (1 << val);
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 41dd0a08a625c..39be53b6f9838 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -262,13 +262,14 @@ EXPORT_SYMBOL_GPL(i2c_recover_bus);
+ static void i2c_init_recovery(struct i2c_adapter *adap)
+ {
+ struct i2c_bus_recovery_info *bri = adap->bus_recovery_info;
+- char *err_str;
++ char *err_str, *err_level = KERN_ERR;
+
+ if (!bri)
+ return;
+
+ if (!bri->recover_bus) {
+- err_str = "no recover_bus() found";
++ err_str = "no suitable method provided";
++ err_level = KERN_DEBUG;
+ goto err;
+ }
+
+@@ -298,7 +299,7 @@ static void i2c_init_recovery(struct i2c_adapter *adap)
+
+ return;
+ err:
+- dev_err(&adap->dev, "Not using recovery: %s\n", err_str);
++ dev_printk(err_level, &adap->dev, "Not using recovery: %s\n", err_str);
+ adap->bus_recovery_info = NULL;
+ }
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index b728a1bf916f4..6c1a093b164e0 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -3523,7 +3523,8 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id)
+ c4iw_init_wr_wait(ep->com.wr_waitp);
+ err = cxgb4_remove_server(
+ ep->com.dev->rdev.lldi.ports[0], ep->stid,
+- ep->com.dev->rdev.lldi.rxq_ids[0], true);
++ ep->com.dev->rdev.lldi.rxq_ids[0],
++ ep->com.local_addr.ss_family == AF_INET6);
+ if (err)
+ goto done;
+ err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp,
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index f7d653d48a1e4..c235d1e6bc528 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -864,7 +864,7 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
+ if (dev->adapter->dev_set_bus) {
+ err = dev->adapter->dev_set_bus(dev, 0);
+ if (err)
+- goto lbl_unregister_candev;
++ goto adap_dev_free;
+ }
+
+ /* get device number early */
+@@ -876,6 +876,10 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
+
+ return 0;
+
++adap_dev_free:
++ if (dev->adapter->dev_free)
++ dev->adapter->dev_free(dev);
++
+ lbl_unregister_candev:
+ unregister_candev(netdev);
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
+index 47bcbcf58048c..0c93a552b921d 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
+@@ -181,9 +181,9 @@
+ #define XGBE_DMA_SYS_AWCR 0x30303030
+
+ /* DMA cache settings - PCI device */
+-#define XGBE_DMA_PCI_ARCR 0x00000003
+-#define XGBE_DMA_PCI_AWCR 0x13131313
+-#define XGBE_DMA_PCI_AWARCR 0x00000313
++#define XGBE_DMA_PCI_ARCR 0x000f0f0f
++#define XGBE_DMA_PCI_AWCR 0x0f0f0f0f
++#define XGBE_DMA_PCI_AWARCR 0x00000f0f
+
+ /* DMA channel interrupt modes */
+ #define XGBE_IRQ_MODE_EDGE 0
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+index c91e155c147ca..544c88f19f24c 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+@@ -1400,11 +1400,25 @@ int cudbg_collect_sge_indirect(struct cudbg_init *pdbg_init,
+ struct cudbg_buffer temp_buff = { 0 };
+ struct sge_qbase_reg_field *sge_qbase;
+ struct ireg_buf *ch_sge_dbg;
++ u8 padap_running = 0;
+ int i, rc;
++ u32 size;
+
+- rc = cudbg_get_buff(pdbg_init, dbg_buff,
+- sizeof(*ch_sge_dbg) * 2 + sizeof(*sge_qbase),
+- &temp_buff);
++ /* Accessing SGE_QBASE_MAP[0-3] and SGE_QBASE_INDEX regs can
++ * lead to SGE missing doorbells under heavy traffic. So, only
++ * collect them when adapter is idle.
++ */
++ for_each_port(padap, i) {
++ padap_running = netif_running(padap->port[i]);
++ if (padap_running)
++ break;
++ }
++
++ size = sizeof(*ch_sge_dbg) * 2;
++ if (!padap_running)
++ size += sizeof(*sge_qbase);
++
++ rc = cudbg_get_buff(pdbg_init, dbg_buff, size, &temp_buff);
+ if (rc)
+ return rc;
+
+@@ -1426,7 +1440,8 @@ int cudbg_collect_sge_indirect(struct cudbg_init *pdbg_init,
+ ch_sge_dbg++;
+ }
+
+- if (CHELSIO_CHIP_VERSION(padap->params.chip) > CHELSIO_T5) {
++ if (CHELSIO_CHIP_VERSION(padap->params.chip) > CHELSIO_T5 &&
++ !padap_running) {
+ sge_qbase = (struct sge_qbase_reg_field *)ch_sge_dbg;
+ /* 1 addr reg SGE_QBASE_INDEX and 4 data reg
+ * SGE_QBASE_MAP[0-3]
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index abc2a66754bd0..812f4b743d97e 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -2093,7 +2093,8 @@ void t4_get_regs(struct adapter *adap, void *buf, size_t buf_size)
+ 0x1190, 0x1194,
+ 0x11a0, 0x11a4,
+ 0x11b0, 0x11b4,
+- 0x11fc, 0x1274,
++ 0x11fc, 0x123c,
++ 0x1254, 0x1274,
+ 0x1280, 0x133c,
+ 0x1800, 0x18fc,
+ 0x3000, 0x302c,
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index df03cf63cb026..4feab06b7ad7a 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -485,7 +485,11 @@ static struct net_device_stats *gfar_get_stats(struct net_device *dev)
+
+ static int gfar_set_mac_addr(struct net_device *dev, void *p)
+ {
+- eth_mac_addr(dev, p);
++ int ret;
++
++ ret = eth_mac_addr(dev, p);
++ if (ret)
++ return ret;
+
+ gfar_set_mac_for_addr(dev, 0, dev->dev_addr);
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
+index 738acba7a9a3c..3c921dfc20564 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -149,6 +149,7 @@ enum i40e_state_t {
+ __I40E_CLIENT_L2_CHANGE,
+ __I40E_CLIENT_RESET,
+ __I40E_VF_RESETS_DISABLED, /* disable resets during i40e_remove */
++ __I40E_VFS_RELEASING,
+ /* This must be last as it determines the size of the BITMAP */
+ __I40E_STATE_SIZE__,
+ };
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index a6b0f605a7d8b..9148d93c5c63c 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -796,6 +796,7 @@ static int i40e_get_link_ksettings(struct net_device *netdev,
+
+ /* Set flow control settings */
+ ethtool_link_ksettings_add_link_mode(ks, supported, Pause);
++ ethtool_link_ksettings_add_link_mode(ks, supported, Asym_Pause);
+
+ switch (hw->fc.requested_mode) {
+ case I40E_FC_FULL:
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 5d782148d35f8..3c1533c627fd0 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -137,6 +137,7 @@ void i40e_vc_notify_vf_reset(struct i40e_vf *vf)
+ **/
+ static inline void i40e_vc_disable_vf(struct i40e_vf *vf)
+ {
++ struct i40e_pf *pf = vf->pf;
+ int i;
+
+ i40e_vc_notify_vf_reset(vf);
+@@ -147,6 +148,11 @@ static inline void i40e_vc_disable_vf(struct i40e_vf *vf)
+ * ensure a reset.
+ */
+ for (i = 0; i < 20; i++) {
++ /* If PF is in VFs releasing state reset VF is impossible,
++ * so leave it.
++ */
++ if (test_bit(__I40E_VFS_RELEASING, pf->state))
++ return;
+ if (i40e_reset_vf(vf, false))
+ return;
+ usleep_range(10000, 20000);
+@@ -1381,6 +1387,8 @@ void i40e_free_vfs(struct i40e_pf *pf)
+
+ if (!pf->vf)
+ return;
++
++ set_bit(__I40E_VFS_RELEASING, pf->state);
+ while (test_and_set_bit(__I40E_VF_DISABLE, pf->state))
+ usleep_range(1000, 2000);
+
+@@ -1438,6 +1446,7 @@ void i40e_free_vfs(struct i40e_pf *pf)
+ }
+ }
+ clear_bit(__I40E_VF_DISABLE, pf->state);
++ clear_bit(__I40E_VFS_RELEASING, pf->state);
+ }
+
+ #ifdef CONFIG_PCI_IOV
+diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.h b/drivers/net/ethernet/intel/ice/ice_controlq.h
+index 0f2cdb06e6efa..7960f0e4d8729 100644
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.h
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.h
+@@ -30,8 +30,8 @@ enum ice_ctl_q {
+ ICE_CTL_Q_ADMIN,
+ };
+
+-/* Control Queue timeout settings - max delay 250ms */
+-#define ICE_CTL_Q_SQ_CMD_TIMEOUT 2500 /* Count 2500 times */
++/* Control Queue timeout settings - max delay 1s */
++#define ICE_CTL_Q_SQ_CMD_TIMEOUT 10000 /* Count 10000 times */
+ #define ICE_CTL_Q_SQ_CMD_USEC 100 /* Check every 100usec */
+
+ struct ice_ctl_q_ring {
+diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
+index 078027bbe0025..a2b876abb03b2 100644
+--- a/drivers/net/ieee802154/atusb.c
++++ b/drivers/net/ieee802154/atusb.c
+@@ -368,6 +368,7 @@ static int atusb_alloc_urbs(struct atusb *atusb, int n)
+ return -ENOMEM;
+ }
+ usb_anchor_urb(urb, &atusb->idle_urbs);
++ usb_free_urb(urb);
+ n--;
+ }
+ return 0;
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 1a86b016b8420..8ee2c519c9bf0 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -77,6 +77,14 @@
+ #include <linux/bpf.h>
+ #include <linux/bpf_trace.h>
+ #include <linux/mutex.h>
++#include <linux/ieee802154.h>
++#include <linux/if_ltalk.h>
++#include <uapi/linux/if_fddi.h>
++#include <uapi/linux/if_hippi.h>
++#include <uapi/linux/if_fc.h>
++#include <net/ax25.h>
++#include <net/rose.h>
++#include <net/6lowpan.h>
+
+ #include <linux/uaccess.h>
+ #include <linux/proc_fs.h>
+@@ -2864,6 +2872,45 @@ static int tun_set_ebpf(struct tun_struct *tun, struct tun_prog **prog_p,
+ return __tun_set_ebpf(tun, prog_p, prog);
+ }
+
++/* Return correct value for tun->dev->addr_len based on tun->dev->type. */
++static unsigned char tun_get_addr_len(unsigned short type)
++{
++ switch (type) {
++ case ARPHRD_IP6GRE:
++ case ARPHRD_TUNNEL6:
++ return sizeof(struct in6_addr);
++ case ARPHRD_IPGRE:
++ case ARPHRD_TUNNEL:
++ case ARPHRD_SIT:
++ return 4;
++ case ARPHRD_ETHER:
++ return ETH_ALEN;
++ case ARPHRD_IEEE802154:
++ case ARPHRD_IEEE802154_MONITOR:
++ return IEEE802154_EXTENDED_ADDR_LEN;
++ case ARPHRD_PHONET_PIPE:
++ case ARPHRD_PPP:
++ case ARPHRD_NONE:
++ return 0;
++ case ARPHRD_6LOWPAN:
++ return EUI64_ADDR_LEN;
++ case ARPHRD_FDDI:
++ return FDDI_K_ALEN;
++ case ARPHRD_HIPPI:
++ return HIPPI_ALEN;
++ case ARPHRD_IEEE802:
++ return FC_ALEN;
++ case ARPHRD_ROSE:
++ return ROSE_ADDR_LEN;
++ case ARPHRD_NETROM:
++ return AX25_ADDR_LEN;
++ case ARPHRD_LOCALTLK:
++ return LTALK_ALEN;
++ default:
++ return 0;
++ }
++}
++
+ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
+ unsigned long arg, int ifreq_len)
+ {
+@@ -3018,6 +3065,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
+ ret = -EBUSY;
+ } else {
+ tun->dev->type = (int) arg;
++ tun->dev->addr_len = tun_get_addr_len(tun->dev->type);
+ tun_debug(KERN_INFO, tun, "linktype set to %d\n",
+ tun->dev->type);
+ ret = 0;
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index bff268b4a9a46..2eb33d2bb7ad4 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -625,7 +625,7 @@ static struct hso_serial *get_serial_by_index(unsigned index)
+ return serial;
+ }
+
+-static int get_free_serial_index(void)
++static int obtain_minor(struct hso_serial *serial)
+ {
+ int index;
+ unsigned long flags;
+@@ -633,8 +633,10 @@ static int get_free_serial_index(void)
+ spin_lock_irqsave(&serial_table_lock, flags);
+ for (index = 0; index < HSO_SERIAL_TTY_MINORS; index++) {
+ if (serial_table[index] == NULL) {
++ serial_table[index] = serial->parent;
++ serial->minor = index;
+ spin_unlock_irqrestore(&serial_table_lock, flags);
+- return index;
++ return 0;
+ }
+ }
+ spin_unlock_irqrestore(&serial_table_lock, flags);
+@@ -643,15 +645,12 @@ static int get_free_serial_index(void)
+ return -1;
+ }
+
+-static void set_serial_by_index(unsigned index, struct hso_serial *serial)
++static void release_minor(struct hso_serial *serial)
+ {
+ unsigned long flags;
+
+ spin_lock_irqsave(&serial_table_lock, flags);
+- if (serial)
+- serial_table[index] = serial->parent;
+- else
+- serial_table[index] = NULL;
++ serial_table[serial->minor] = NULL;
+ spin_unlock_irqrestore(&serial_table_lock, flags);
+ }
+
+@@ -2244,6 +2243,7 @@ static int hso_stop_serial_device(struct hso_device *hso_dev)
+ static void hso_serial_tty_unregister(struct hso_serial *serial)
+ {
+ tty_unregister_device(tty_drv, serial->minor);
++ release_minor(serial);
+ }
+
+ static void hso_serial_common_free(struct hso_serial *serial)
+@@ -2267,24 +2267,22 @@ static void hso_serial_common_free(struct hso_serial *serial)
+ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
+ int rx_size, int tx_size)
+ {
+- int minor;
+ int i;
+
+ tty_port_init(&serial->port);
+
+- minor = get_free_serial_index();
+- if (minor < 0)
++ if (obtain_minor(serial))
+ goto exit2;
+
+ /* register our minor number */
+ serial->parent->dev = tty_port_register_device_attr(&serial->port,
+- tty_drv, minor, &serial->parent->interface->dev,
++ tty_drv, serial->minor, &serial->parent->interface->dev,
+ serial->parent, hso_serial_dev_groups);
+- if (IS_ERR(serial->parent->dev))
++ if (IS_ERR(serial->parent->dev)) {
++ release_minor(serial);
+ goto exit2;
++ }
+
+- /* fill in specific data for later use */
+- serial->minor = minor;
+ serial->magic = HSO_SERIAL_MAGIC;
+ spin_lock_init(&serial->serial_lock);
+ serial->num_rx_urbs = num_urbs;
+@@ -2677,9 +2675,6 @@ static struct hso_device *hso_create_bulk_serial_device(
+
+ serial->write_data = hso_std_serial_write_data;
+
+- /* and record this serial */
+- set_serial_by_index(serial->minor, serial);
+-
+ /* setup the proc dirs and files if needed */
+ hso_log_port(hso_dev);
+
+@@ -2736,9 +2731,6 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface,
+ serial->shared_int->ref_count++;
+ mutex_unlock(&serial->shared_int->shared_int_lock);
+
+- /* and record this serial */
+- set_serial_by_index(serial->minor, serial);
+-
+ /* setup the proc dirs and files if needed */
+ hso_log_port(hso_dev);
+
+@@ -3123,7 +3115,6 @@ static void hso_free_interface(struct usb_interface *interface)
+ cancel_work_sync(&serial_table[i]->async_get_intf);
+ hso_serial_tty_unregister(serial);
+ kref_put(&serial_table[i]->ref, hso_serial_ref_free);
+- set_serial_by_index(i, NULL);
+ }
+ }
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index d41d5f63f211f..0b1c6a8906b99 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -383,7 +383,7 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
+ struct receive_queue *rq,
+ struct page *page, unsigned int offset,
+ unsigned int len, unsigned int truesize,
+- bool hdr_valid)
++ bool hdr_valid, unsigned int metasize)
+ {
+ struct sk_buff *skb;
+ struct virtio_net_hdr_mrg_rxbuf *hdr;
+@@ -405,6 +405,7 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
+ else
+ hdr_padded_len = sizeof(struct padded_vnet_hdr);
+
++ /* hdr_valid means no XDP, so we can copy the vnet header */
+ if (hdr_valid)
+ memcpy(hdr, p, hdr_len);
+
+@@ -417,6 +418,11 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
+ copy = skb_tailroom(skb);
+ skb_put_data(skb, p, copy);
+
++ if (metasize) {
++ __skb_pull(skb, metasize);
++ skb_metadata_set(skb, metasize);
++ }
++
+ len -= copy;
+ offset += copy;
+
+@@ -462,10 +468,6 @@ static int __virtnet_xdp_xmit_one(struct virtnet_info *vi,
+ struct virtio_net_hdr_mrg_rxbuf *hdr;
+ int err;
+
+- /* virtqueue want to use data area in-front of packet */
+- if (unlikely(xdpf->metasize > 0))
+- return -EOPNOTSUPP;
+-
+ if (unlikely(xdpf->headroom < vi->hdr_len))
+ return -EOVERFLOW;
+
+@@ -656,6 +658,7 @@ static struct sk_buff *receive_small(struct net_device *dev,
+ unsigned int delta = 0;
+ struct page *xdp_page;
+ int err;
++ unsigned int metasize = 0;
+
+ len -= vi->hdr_len;
+ stats->bytes += len;
+@@ -695,8 +698,8 @@ static struct sk_buff *receive_small(struct net_device *dev,
+
+ xdp.data_hard_start = buf + VIRTNET_RX_PAD + vi->hdr_len;
+ xdp.data = xdp.data_hard_start + xdp_headroom;
+- xdp_set_data_meta_invalid(&xdp);
+ xdp.data_end = xdp.data + len;
++ xdp.data_meta = xdp.data;
+ xdp.rxq = &rq->xdp_rxq;
+ orig_data = xdp.data;
+ act = bpf_prog_run_xdp(xdp_prog, &xdp);
+@@ -707,6 +710,7 @@ static struct sk_buff *receive_small(struct net_device *dev,
+ /* Recalculate length in case bpf program changed it */
+ delta = orig_data - xdp.data;
+ len = xdp.data_end - xdp.data;
++ metasize = xdp.data - xdp.data_meta;
+ break;
+ case XDP_TX:
+ stats->xdp_tx++;
+@@ -752,6 +756,9 @@ static struct sk_buff *receive_small(struct net_device *dev,
+ memcpy(skb_vnet_hdr(skb), buf, vi->hdr_len);
+ } /* keep zeroed vnet hdr since packet was changed by bpf */
+
++ if (metasize)
++ skb_metadata_set(skb, metasize);
++
+ err:
+ return skb;
+
+@@ -772,8 +779,8 @@ static struct sk_buff *receive_big(struct net_device *dev,
+ struct virtnet_rq_stats *stats)
+ {
+ struct page *page = buf;
+- struct sk_buff *skb = page_to_skb(vi, rq, page, 0, len,
+- PAGE_SIZE, true);
++ struct sk_buff *skb =
++ page_to_skb(vi, rq, page, 0, len, PAGE_SIZE, true, 0);
+
+ stats->bytes += len - vi->hdr_len;
+ if (unlikely(!skb))
+@@ -805,6 +812,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
+ unsigned int truesize;
+ unsigned int headroom = mergeable_ctx_to_headroom(ctx);
+ int err;
++ unsigned int metasize = 0;
+
+ head_skb = NULL;
+ stats->bytes += len - vi->hdr_len;
+@@ -851,8 +859,8 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
+ data = page_address(xdp_page) + offset;
+ xdp.data_hard_start = data - VIRTIO_XDP_HEADROOM + vi->hdr_len;
+ xdp.data = data + vi->hdr_len;
+- xdp_set_data_meta_invalid(&xdp);
+ xdp.data_end = xdp.data + (len - vi->hdr_len);
++ xdp.data_meta = xdp.data;
+ xdp.rxq = &rq->xdp_rxq;
+
+ act = bpf_prog_run_xdp(xdp_prog, &xdp);
+@@ -860,24 +868,27 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
+
+ switch (act) {
+ case XDP_PASS:
++ metasize = xdp.data - xdp.data_meta;
++
+ /* recalculate offset to account for any header
+- * adjustments. Note other cases do not build an
+- * skb and avoid using offset
++ * adjustments and minus the metasize to copy the
++ * metadata in page_to_skb(). Note other cases do not
++ * build an skb and avoid using offset
+ */
+- offset = xdp.data -
+- page_address(xdp_page) - vi->hdr_len;
++ offset = xdp.data - page_address(xdp_page) -
++ vi->hdr_len - metasize;
+
+- /* recalculate len if xdp.data or xdp.data_end were
+- * adjusted
++ /* recalculate len if xdp.data, xdp.data_end or
++ * xdp.data_meta were adjusted
+ */
+- len = xdp.data_end - xdp.data + vi->hdr_len;
++ len = xdp.data_end - xdp.data + vi->hdr_len + metasize;
+ /* We can only create skb based on xdp_page. */
+ if (unlikely(xdp_page != page)) {
+ rcu_read_unlock();
+ put_page(page);
+- head_skb = page_to_skb(vi, rq, xdp_page,
+- offset, len,
+- PAGE_SIZE, false);
++ head_skb = page_to_skb(vi, rq, xdp_page, offset,
++ len, PAGE_SIZE, false,
++ metasize);
+ return head_skb;
+ }
+ break;
+@@ -933,7 +944,8 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
+ goto err_skb;
+ }
+
+- head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog);
++ head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog,
++ metasize);
+ curr_skb = head_skb;
+
+ if (unlikely(!curr_skb))
+diff --git a/drivers/regulator/bd9571mwv-regulator.c b/drivers/regulator/bd9571mwv-regulator.c
+index 274c5ed7cd737..713730757b140 100644
+--- a/drivers/regulator/bd9571mwv-regulator.c
++++ b/drivers/regulator/bd9571mwv-regulator.c
+@@ -132,7 +132,7 @@ static struct regulator_ops vid_ops = {
+
+ static struct regulator_desc regulators[] = {
+ BD9571MWV_REG("VD09", "vd09", VD09, avs_ops, 0, 0x7f,
+- 0x80, 600000, 10000, 0x3c),
++ 0x6f, 600000, 10000, 0x3c),
+ BD9571MWV_REG("VD18", "vd18", VD18, vid_ops, BD9571MWV_VD18_VID, 0xf,
+ 16, 1625000, 25000, 0),
+ BD9571MWV_REG("VD25", "vd25", VD25, vid_ops, BD9571MWV_VD25_VID, 0xf,
+@@ -141,7 +141,7 @@ static struct regulator_desc regulators[] = {
+ 11, 2800000, 100000, 0),
+ BD9571MWV_REG("DVFS", "dvfs", DVFS, reg_ops,
+ BD9571MWV_DVFS_MONIVDAC, 0x7f,
+- 0x80, 600000, 10000, 0x3c),
++ 0x6f, 600000, 10000, 0x3c),
+ };
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
+index a4ac6073c555d..d7bf456fd10e4 100644
+--- a/drivers/soc/fsl/qbman/qman.c
++++ b/drivers/soc/fsl/qbman/qman.c
+@@ -184,7 +184,7 @@ struct qm_eqcr_entry {
+ __be32 tag;
+ struct qm_fd fd;
+ u8 __reserved3[32];
+-} __packed;
++} __packed __aligned(8);
+ #define QM_EQCR_VERB_VBIT 0x80
+ #define QM_EQCR_VERB_CMD_MASK 0x61 /* but only one value; */
+ #define QM_EQCR_VERB_CMD_ENQUEUE 0x01
+diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
+index 6ca3d063686c9..0081c1073b083 100644
+--- a/drivers/usb/usbip/stub_dev.c
++++ b/drivers/usb/usbip/stub_dev.c
+@@ -63,6 +63,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
+
+ dev_info(dev, "stub up\n");
+
++ mutex_lock(&sdev->ud.sysfs_lock);
+ spin_lock_irq(&sdev->ud.lock);
+
+ if (sdev->ud.status != SDEV_ST_AVAILABLE) {
+@@ -87,13 +88,13 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
+ tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx");
+ if (IS_ERR(tcp_rx)) {
+ sockfd_put(socket);
+- return -EINVAL;
++ goto unlock_mutex;
+ }
+ tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx");
+ if (IS_ERR(tcp_tx)) {
+ kthread_stop(tcp_rx);
+ sockfd_put(socket);
+- return -EINVAL;
++ goto unlock_mutex;
+ }
+
+ /* get task structs now */
+@@ -112,6 +113,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
+ wake_up_process(sdev->ud.tcp_rx);
+ wake_up_process(sdev->ud.tcp_tx);
+
++ mutex_unlock(&sdev->ud.sysfs_lock);
++
+ } else {
+ dev_info(dev, "stub down\n");
+
+@@ -122,6 +125,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
+ spin_unlock_irq(&sdev->ud.lock);
+
+ usbip_event_add(&sdev->ud, SDEV_EVENT_DOWN);
++ mutex_unlock(&sdev->ud.sysfs_lock);
+ }
+
+ return count;
+@@ -130,6 +134,8 @@ sock_err:
+ sockfd_put(socket);
+ err:
+ spin_unlock_irq(&sdev->ud.lock);
++unlock_mutex:
++ mutex_unlock(&sdev->ud.sysfs_lock);
+ return -EINVAL;
+ }
+ static DEVICE_ATTR_WO(usbip_sockfd);
+@@ -295,6 +301,7 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev)
+ sdev->ud.side = USBIP_STUB;
+ sdev->ud.status = SDEV_ST_AVAILABLE;
+ spin_lock_init(&sdev->ud.lock);
++ mutex_init(&sdev->ud.sysfs_lock);
+ sdev->ud.tcp_socket = NULL;
+ sdev->ud.sockfd = -1;
+
+diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
+index 8be857a4fa132..a7e6ce96f62c7 100644
+--- a/drivers/usb/usbip/usbip_common.h
++++ b/drivers/usb/usbip/usbip_common.h
+@@ -263,6 +263,9 @@ struct usbip_device {
+ /* lock for status */
+ spinlock_t lock;
+
++ /* mutex for synchronizing sysfs store paths */
++ struct mutex sysfs_lock;
++
+ int sockfd;
+ struct socket *tcp_socket;
+
+diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
+index 5d88917c96314..086ca76dd0531 100644
+--- a/drivers/usb/usbip/usbip_event.c
++++ b/drivers/usb/usbip/usbip_event.c
+@@ -70,6 +70,7 @@ static void event_handler(struct work_struct *work)
+ while ((ud = get_event()) != NULL) {
+ usbip_dbg_eh("pending event %lx\n", ud->event);
+
++ mutex_lock(&ud->sysfs_lock);
+ /*
+ * NOTE: shutdown must come first.
+ * Shutdown the device.
+@@ -90,6 +91,7 @@ static void event_handler(struct work_struct *work)
+ ud->eh_ops.unusable(ud);
+ unset_event(ud, USBIP_EH_UNUSABLE);
+ }
++ mutex_unlock(&ud->sysfs_lock);
+
+ wake_up(&ud->eh_waitq);
+ }
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 32a4dfeea06af..b13ed5a7618d8 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -1101,6 +1101,7 @@ static void vhci_device_init(struct vhci_device *vdev)
+ vdev->ud.side = USBIP_VHCI;
+ vdev->ud.status = VDEV_ST_NULL;
+ spin_lock_init(&vdev->ud.lock);
++ mutex_init(&vdev->ud.sysfs_lock);
+
+ INIT_LIST_HEAD(&vdev->priv_rx);
+ INIT_LIST_HEAD(&vdev->priv_tx);
+diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
+index e64ea314930be..ebc7be1d98207 100644
+--- a/drivers/usb/usbip/vhci_sysfs.c
++++ b/drivers/usb/usbip/vhci_sysfs.c
+@@ -185,6 +185,8 @@ static int vhci_port_disconnect(struct vhci_hcd *vhci_hcd, __u32 rhport)
+
+ usbip_dbg_vhci_sysfs("enter\n");
+
++ mutex_lock(&vdev->ud.sysfs_lock);
++
+ /* lock */
+ spin_lock_irqsave(&vhci->lock, flags);
+ spin_lock(&vdev->ud.lock);
+@@ -195,6 +197,7 @@ static int vhci_port_disconnect(struct vhci_hcd *vhci_hcd, __u32 rhport)
+ /* unlock */
+ spin_unlock(&vdev->ud.lock);
+ spin_unlock_irqrestore(&vhci->lock, flags);
++ mutex_unlock(&vdev->ud.sysfs_lock);
+
+ return -EINVAL;
+ }
+@@ -205,6 +208,8 @@ static int vhci_port_disconnect(struct vhci_hcd *vhci_hcd, __u32 rhport)
+
+ usbip_event_add(&vdev->ud, VDEV_EVENT_DOWN);
+
++ mutex_unlock(&vdev->ud.sysfs_lock);
++
+ return 0;
+ }
+
+@@ -349,30 +354,36 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr,
+ else
+ vdev = &vhci->vhci_hcd_hs->vdev[rhport];
+
++ mutex_lock(&vdev->ud.sysfs_lock);
++
+ /* Extract socket from fd. */
+ socket = sockfd_lookup(sockfd, &err);
+ if (!socket) {
+ dev_err(dev, "failed to lookup sock");
+- return -EINVAL;
++ err = -EINVAL;
++ goto unlock_mutex;
+ }
+ if (socket->type != SOCK_STREAM) {
+ dev_err(dev, "Expecting SOCK_STREAM - found %d",
+ socket->type);
+ sockfd_put(socket);
+- return -EINVAL;
++ err = -EINVAL;
++ goto unlock_mutex;
+ }
+
+ /* create threads before locking */
+ tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx");
+ if (IS_ERR(tcp_rx)) {
+ sockfd_put(socket);
+- return -EINVAL;
++ err = -EINVAL;
++ goto unlock_mutex;
+ }
+ tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx");
+ if (IS_ERR(tcp_tx)) {
+ kthread_stop(tcp_rx);
+ sockfd_put(socket);
+- return -EINVAL;
++ err = -EINVAL;
++ goto unlock_mutex;
+ }
+
+ /* get task structs now */
+@@ -397,7 +408,8 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr,
+ * Will be retried from userspace
+ * if there's another free port.
+ */
+- return -EBUSY;
++ err = -EBUSY;
++ goto unlock_mutex;
+ }
+
+ dev_info(dev, "pdev(%u) rhport(%u) sockfd(%d)\n",
+@@ -422,7 +434,15 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr,
+
+ rh_port_connect(vdev, speed);
+
++ dev_info(dev, "Device attached\n");
++
++ mutex_unlock(&vdev->ud.sysfs_lock);
++
+ return count;
++
++unlock_mutex:
++ mutex_unlock(&vdev->ud.sysfs_lock);
++ return err;
+ }
+ static DEVICE_ATTR_WO(attach);
+
+diff --git a/drivers/usb/usbip/vudc_dev.c b/drivers/usb/usbip/vudc_dev.c
+index 1634d8698e151..74568325d8c0b 100644
+--- a/drivers/usb/usbip/vudc_dev.c
++++ b/drivers/usb/usbip/vudc_dev.c
+@@ -571,6 +571,7 @@ static int init_vudc_hw(struct vudc *udc)
+ init_waitqueue_head(&udc->tx_waitq);
+
+ spin_lock_init(&ud->lock);
++ mutex_init(&ud->sysfs_lock);
+ ud->status = SDEV_ST_AVAILABLE;
+ ud->side = USBIP_VUDC;
+
+diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
+index 1bde09e5cb478..de2babadd1465 100644
+--- a/drivers/usb/usbip/vudc_sysfs.c
++++ b/drivers/usb/usbip/vudc_sysfs.c
+@@ -113,6 +113,7 @@ static ssize_t usbip_sockfd_store(struct device *dev,
+ dev_err(dev, "no device");
+ return -ENODEV;
+ }
++ mutex_lock(&udc->ud.sysfs_lock);
+ spin_lock_irqsave(&udc->lock, flags);
+ /* Don't export what we don't have */
+ if (!udc->driver || !udc->pullup) {
+@@ -188,6 +189,8 @@ static ssize_t usbip_sockfd_store(struct device *dev,
+
+ wake_up_process(udc->ud.tcp_rx);
+ wake_up_process(udc->ud.tcp_tx);
++
++ mutex_unlock(&udc->ud.sysfs_lock);
+ return count;
+
+ } else {
+@@ -208,6 +211,7 @@ static ssize_t usbip_sockfd_store(struct device *dev,
+ }
+
+ spin_unlock_irqrestore(&udc->lock, flags);
++ mutex_unlock(&udc->ud.sysfs_lock);
+
+ return count;
+
+@@ -217,6 +221,7 @@ unlock_ud:
+ spin_unlock_irq(&udc->ud.lock);
+ unlock:
+ spin_unlock_irqrestore(&udc->lock, flags);
++ mutex_unlock(&udc->ud.sysfs_lock);
+
+ return ret;
+ }
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index fae2a536acc67..8c577f0ae2bb3 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -221,7 +221,7 @@ static int xen_irq_info_common_setup(struct irq_info *info,
+ info->evtchn = evtchn;
+ info->cpu = cpu;
+ info->mask_reason = EVT_MASK_REASON_EXPLICIT;
+- spin_lock_init(&info->lock);
++ raw_spin_lock_init(&info->lock);
+
+ ret = set_evtchn_to_irq(evtchn, irq);
+ if (ret < 0)
+@@ -373,28 +373,28 @@ static void do_mask(struct irq_info *info, u8 reason)
+ {
+ unsigned long flags;
+
+- spin_lock_irqsave(&info->lock, flags);
++ raw_spin_lock_irqsave(&info->lock, flags);
+
+ if (!info->mask_reason)
+ mask_evtchn(info->evtchn);
+
+ info->mask_reason |= reason;
+
+- spin_unlock_irqrestore(&info->lock, flags);
++ raw_spin_unlock_irqrestore(&info->lock, flags);
+ }
+
+ static void do_unmask(struct irq_info *info, u8 reason)
+ {
+ unsigned long flags;
+
+- spin_lock_irqsave(&info->lock, flags);
++ raw_spin_lock_irqsave(&info->lock, flags);
+
+ info->mask_reason &= ~reason;
+
+ if (!info->mask_reason)
+ unmask_evtchn(info->evtchn);
+
+- spin_unlock_irqrestore(&info->lock, flags);
++ raw_spin_unlock_irqrestore(&info->lock, flags);
+ }
+
+ #ifdef CONFIG_X86
+diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h
+index 3df6f28b75e69..cc37b711491ce 100644
+--- a/drivers/xen/events/events_internal.h
++++ b/drivers/xen/events/events_internal.h
+@@ -47,7 +47,7 @@ struct irq_info {
+ unsigned short eoi_cpu; /* EOI must happen on this cpu */
+ unsigned int irq_epoch; /* If eoi_cpu valid: irq_epoch of event */
+ u64 eoi_time; /* Time in jiffies when to EOI. */
+- spinlock_t lock;
++ raw_spinlock_t lock;
+
+ union {
+ unsigned short virq;
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 632249ce61eba..6285085195c15 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3882,7 +3882,6 @@ int cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
+ cifs_sb->prepath = kstrdup(pvolume_info->prepath, GFP_KERNEL);
+ if (cifs_sb->prepath == NULL)
+ return -ENOMEM;
+- cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
+ }
+
+ return 0;
+diff --git a/fs/direct-io.c b/fs/direct-io.c
+index 1abb7634b2d58..ec7c7d1c03297 100644
+--- a/fs/direct-io.c
++++ b/fs/direct-io.c
+@@ -856,6 +856,7 @@ submit_page_section(struct dio *dio, struct dio_submit *sdio, struct page *page,
+ struct buffer_head *map_bh)
+ {
+ int ret = 0;
++ int boundary = sdio->boundary; /* dio_send_cur_page may clear it */
+
+ if (dio->op == REQ_OP_WRITE) {
+ /*
+@@ -894,10 +895,10 @@ submit_page_section(struct dio *dio, struct dio_submit *sdio, struct page *page,
+ sdio->cur_page_fs_offset = sdio->block_in_file << sdio->blkbits;
+ out:
+ /*
+- * If sdio->boundary then we want to schedule the IO now to
++ * If boundary then we want to schedule the IO now to
+ * avoid metadata seeks.
+ */
+- if (sdio->boundary) {
++ if (boundary) {
+ ret = dio_send_cur_page(dio, sdio, map_bh);
+ if (sdio->bio)
+ dio_bio_submit(dio, sdio);
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
+index 543efa3e5655f..b6948813eb063 100644
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -2311,7 +2311,7 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
+ struct ocfs2_alloc_context *meta_ac = NULL;
+ handle_t *handle = NULL;
+ loff_t end = offset + bytes;
+- int ret = 0, credits = 0, locked = 0;
++ int ret = 0, credits = 0;
+
+ ocfs2_init_dealloc_ctxt(&dealloc);
+
+@@ -2322,13 +2322,6 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
+ !dwc->dw_orphaned)
+ goto out;
+
+- /* ocfs2_file_write_iter will get i_mutex, so we need not lock if we
+- * are in that context. */
+- if (dwc->dw_writer_pid != task_pid_nr(current)) {
+- inode_lock(inode);
+- locked = 1;
+- }
+-
+ ret = ocfs2_inode_lock(inode, &di_bh, 1);
+ if (ret < 0) {
+ mlog_errno(ret);
+@@ -2409,8 +2402,6 @@ out:
+ if (meta_ac)
+ ocfs2_free_alloc_context(meta_ac);
+ ocfs2_run_deallocs(osb, &dealloc);
+- if (locked)
+- inode_unlock(inode);
+ ocfs2_dio_free_write_ctx(inode, dwc);
+
+ return ret;
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index fbd70111a2f12..5c507569ef704 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -1252,22 +1252,24 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr)
+ goto bail_unlock;
+ }
+ }
++ down_write(&OCFS2_I(inode)->ip_alloc_sem);
+ handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS +
+ 2 * ocfs2_quota_trans_credits(sb));
+ if (IS_ERR(handle)) {
+ status = PTR_ERR(handle);
+ mlog_errno(status);
+- goto bail_unlock;
++ goto bail_unlock_alloc;
+ }
+ status = __dquot_transfer(inode, transfer_to);
+ if (status < 0)
+ goto bail_commit;
+ } else {
++ down_write(&OCFS2_I(inode)->ip_alloc_sem);
+ handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
+ if (IS_ERR(handle)) {
+ status = PTR_ERR(handle);
+ mlog_errno(status);
+- goto bail_unlock;
++ goto bail_unlock_alloc;
+ }
+ }
+
+@@ -1280,6 +1282,8 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr)
+
+ bail_commit:
+ ocfs2_commit_trans(osb, handle);
++bail_unlock_alloc:
++ up_write(&OCFS2_I(inode)->ip_alloc_sem);
+ bail_unlock:
+ if (status && inode_locked) {
+ ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock);
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index b87b1569d15b5..5f711b2983db6 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -357,11 +357,11 @@ struct mlx5_ifc_flow_table_prop_layout_bits {
+ u8 reserved_at_60[0x18];
+ u8 log_max_ft_num[0x8];
+
+- u8 reserved_at_80[0x18];
++ u8 reserved_at_80[0x10];
++ u8 log_max_flow_counter[0x8];
+ u8 log_max_destination[0x8];
+
+- u8 log_max_flow_counter[0x8];
+- u8 reserved_at_a8[0x10];
++ u8 reserved_at_a0[0x18];
+ u8 log_max_flow[0x8];
+
+ u8 reserved_at_c0[0x40];
+@@ -8929,7 +8929,7 @@ struct mlx5_ifc_pbmc_reg_bits {
+
+ struct mlx5_ifc_bufferx_reg_bits buffer[10];
+
+- u8 reserved_at_2e0[0x40];
++ u8 reserved_at_2e0[0x80];
+ };
+
+ struct mlx5_ifc_qtct_reg_bits {
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index 98e7716e03413..a1829139ff4af 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -62,6 +62,8 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ return -EINVAL;
+ }
+
++ skb_reset_mac_header(skb);
++
+ if (hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
+ u16 start = __virtio16_to_cpu(little_endian, hdr->csum_start);
+ u16 off = __virtio16_to_cpu(little_endian, hdr->csum_offset);
+diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
+index 9991e5ef52cc5..fbfa59801454d 100644
+--- a/include/net/netns/xfrm.h
++++ b/include/net/netns/xfrm.h
+@@ -70,7 +70,9 @@ struct netns_xfrm {
+ #if IS_ENABLED(CONFIG_IPV6)
+ struct dst_ops xfrm6_dst_ops;
+ #endif
+- spinlock_t xfrm_state_lock;
++ spinlock_t xfrm_state_lock;
++ seqcount_t xfrm_state_hash_generation;
++
+ spinlock_t xfrm_policy_lock;
+ struct mutex xfrm_cfg_mutex;
+ };
+diff --git a/include/net/red.h b/include/net/red.h
+index 8fe55b8b2fb81..ff07a7cedf685 100644
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -171,9 +171,9 @@ static inline void red_set_vars(struct red_vars *v)
+ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog,
+ u8 Scell_log, u8 *stab)
+ {
+- if (fls(qth_min) + Wlog > 32)
++ if (fls(qth_min) + Wlog >= 32)
+ return false;
+- if (fls(qth_max) + Wlog > 32)
++ if (fls(qth_max) + Wlog >= 32)
+ return false;
+ if (Scell_log >= 32)
+ return false;
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 78600f97ffa72..1cc49340b68ab 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1377,7 +1377,6 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
+ */
+ lockdep_assert_irqs_disabled();
+
+- debug_work_activate(work);
+
+ /* if draining, only works from the same workqueue are allowed */
+ if (unlikely(wq->flags & __WQ_DRAINING) &&
+@@ -1460,6 +1459,7 @@ retry:
+ worklist = &pwq->delayed_works;
+ }
+
++ debug_work_activate(work);
+ insert_work(pwq, work, worklist, work_flags);
+
+ spin_unlock(&pwq->pool->lock);
+diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
+index 9fa5389ea244c..cc350ab4de0a9 100644
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -904,6 +904,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node,
+ hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list) {
+ tt_vlan->vid = htons(vlan->vid);
+ tt_vlan->crc = htonl(vlan->tt.crc);
++ tt_vlan->reserved = 0;
+
+ tt_vlan++;
+ }
+@@ -987,6 +988,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv,
+
+ tt_vlan->vid = htons(vlan->vid);
+ tt_vlan->crc = htonl(vlan->tt.crc);
++ tt_vlan->reserved = 0;
+
+ tt_vlan++;
+ }
+diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
+index d3cbb32587187..c0930b9fe848b 100644
+--- a/net/ieee802154/nl-mac.c
++++ b/net/ieee802154/nl-mac.c
+@@ -559,9 +559,7 @@ ieee802154_llsec_parse_key_id(struct genl_info *info,
+ desc->mode = nla_get_u8(info->attrs[IEEE802154_ATTR_LLSEC_KEY_MODE]);
+
+ if (desc->mode == IEEE802154_SCF_KEY_IMPLICIT) {
+- if (!info->attrs[IEEE802154_ATTR_PAN_ID] &&
+- !(info->attrs[IEEE802154_ATTR_SHORT_ADDR] ||
+- info->attrs[IEEE802154_ATTR_HW_ADDR]))
++ if (!info->attrs[IEEE802154_ATTR_PAN_ID])
+ return -EINVAL;
+
+ desc->device_addr.pan_id = nla_get_shortaddr(info->attrs[IEEE802154_ATTR_PAN_ID]);
+@@ -570,6 +568,9 @@ ieee802154_llsec_parse_key_id(struct genl_info *info,
+ desc->device_addr.mode = IEEE802154_ADDR_SHORT;
+ desc->device_addr.short_addr = nla_get_shortaddr(info->attrs[IEEE802154_ATTR_SHORT_ADDR]);
+ } else {
++ if (!info->attrs[IEEE802154_ATTR_HW_ADDR])
++ return -EINVAL;
++
+ desc->device_addr.mode = IEEE802154_ADDR_LONG;
+ desc->device_addr.extended_addr = nla_get_hwaddr(info->attrs[IEEE802154_ATTR_HW_ADDR]);
+ }
+diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
+index 99f6c254ea777..b10b297e76b78 100644
+--- a/net/ieee802154/nl802154.c
++++ b/net/ieee802154/nl802154.c
+@@ -836,8 +836,13 @@ nl802154_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
+ goto nla_put_failure;
+
+ #ifdef CONFIG_IEEE802154_NL802154_EXPERIMENTAL
++ if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
++ goto out;
++
+ if (nl802154_get_llsec_params(msg, rdev, wpan_dev) < 0)
+ goto nla_put_failure;
++
++out:
+ #endif /* CONFIG_IEEE802154_NL802154_EXPERIMENTAL */
+
+ genlmsg_end(msg, hdr);
+@@ -1402,6 +1407,9 @@ static int nl802154_set_llsec_params(struct sk_buff *skb,
+ u32 changed = 0;
+ int ret;
+
++ if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
++ return -EOPNOTSUPP;
++
+ if (info->attrs[NL802154_ATTR_SEC_ENABLED]) {
+ u8 enabled;
+
+@@ -1562,7 +1570,8 @@ static int nl802154_add_llsec_key(struct sk_buff *skb, struct genl_info *info)
+ struct ieee802154_llsec_key_id id = { };
+ u32 commands[NL802154_CMD_FRAME_NR_IDS / 32] = { };
+
+- if (nla_parse_nested(attrs, NL802154_KEY_ATTR_MAX,
++ if (!info->attrs[NL802154_ATTR_SEC_KEY] ||
++ nla_parse_nested(attrs, NL802154_KEY_ATTR_MAX,
+ info->attrs[NL802154_ATTR_SEC_KEY],
+ nl802154_key_policy, info->extack))
+ return -EINVAL;
+@@ -1612,7 +1621,8 @@ static int nl802154_del_llsec_key(struct sk_buff *skb, struct genl_info *info)
+ struct nlattr *attrs[NL802154_KEY_ATTR_MAX + 1];
+ struct ieee802154_llsec_key_id id;
+
+- if (nla_parse_nested(attrs, NL802154_KEY_ATTR_MAX,
++ if (!info->attrs[NL802154_ATTR_SEC_KEY] ||
++ nla_parse_nested(attrs, NL802154_KEY_ATTR_MAX,
+ info->attrs[NL802154_ATTR_SEC_KEY],
+ nl802154_key_policy, info->extack))
+ return -EINVAL;
+@@ -1780,7 +1790,8 @@ static int nl802154_del_llsec_dev(struct sk_buff *skb, struct genl_info *info)
+ struct nlattr *attrs[NL802154_DEV_ATTR_MAX + 1];
+ __le64 extended_addr;
+
+- if (nla_parse_nested(attrs, NL802154_DEV_ATTR_MAX,
++ if (!info->attrs[NL802154_ATTR_SEC_DEVICE] ||
++ nla_parse_nested(attrs, NL802154_DEV_ATTR_MAX,
+ info->attrs[NL802154_ATTR_SEC_DEVICE],
+ nl802154_dev_policy, info->extack))
+ return -EINVAL;
+@@ -1940,7 +1951,8 @@ static int nl802154_del_llsec_devkey(struct sk_buff *skb, struct genl_info *info
+ struct ieee802154_llsec_device_key key;
+ __le64 extended_addr;
+
+- if (nla_parse_nested(attrs, NL802154_DEVKEY_ATTR_MAX,
++ if (!info->attrs[NL802154_ATTR_SEC_DEVKEY] ||
++ nla_parse_nested(attrs, NL802154_DEVKEY_ATTR_MAX,
+ info->attrs[NL802154_ATTR_SEC_DEVKEY],
+ nl802154_devkey_policy, info->extack))
+ return -EINVAL;
+@@ -2115,6 +2127,9 @@ static int nl802154_del_llsec_seclevel(struct sk_buff *skb,
+ struct wpan_dev *wpan_dev = dev->ieee802154_ptr;
+ struct ieee802154_llsec_seclevel sl;
+
++ if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
++ return -EOPNOTSUPP;
++
+ if (!info->attrs[NL802154_ATTR_SEC_LEVEL] ||
+ llsec_parse_seclevel(info->attrs[NL802154_ATTR_SEC_LEVEL],
+ &sl) < 0)
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 8d19729f85162..98c8f98a7660e 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -303,7 +303,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ */
+ v4addr = LOOPBACK4_IPV6;
+ if (!(addr_type & IPV6_ADDR_MULTICAST) &&
+- !sock_net(sk)->ipv6.sysctl.ip_nonlocal_bind) {
++ !ipv6_can_nonlocal_bind(sock_net(sk), inet)) {
+ err = -EADDRNOTAVAIL;
+ if (!ipv6_chk_addr(sock_net(sk), &addr->sin6_addr,
+ dev, 0)) {
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index dad35cd48807e..f884739a0c1c7 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -4514,9 +4514,11 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
+ * nexthops have been replaced by first new, the rest should
+ * be added to it.
+ */
+- cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
+- NLM_F_REPLACE);
+- cfg->fc_nlinfo.nlh->nlmsg_flags |= NLM_F_CREATE;
++ if (cfg->fc_nlinfo.nlh) {
++ cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
++ NLM_F_REPLACE);
++ cfg->fc_nlinfo.nlh->nlmsg_flags |= NLM_F_CREATE;
++ }
+ nhn++;
+ }
+
+diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c
+index 2fb703d70803c..d742e635ad07b 100644
+--- a/net/mac802154/llsec.c
++++ b/net/mac802154/llsec.c
+@@ -160,7 +160,7 @@ err_tfm0:
+ crypto_free_skcipher(key->tfm0);
+ err_tfm:
+ for (i = 0; i < ARRAY_SIZE(key->tfm); i++)
+- if (key->tfm[i])
++ if (!IS_ERR_OR_NULL(key->tfm[i]))
+ crypto_free_aead(key->tfm[i]);
+
+ kzfree(key);
+diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
+index f65afa7e7d289..9fd20fa90000b 100644
+--- a/net/ncsi/ncsi-manage.c
++++ b/net/ncsi/ncsi-manage.c
+@@ -84,13 +84,20 @@ static void ncsi_channel_monitor(struct timer_list *t)
+ monitor_state = nc->monitor.state;
+ spin_unlock_irqrestore(&nc->lock, flags);
+
+- if (!enabled || chained) {
+- ncsi_stop_channel_monitor(nc);
+- return;
+- }
++ if (!enabled)
++ return; /* expected race disabling timer */
++ if (WARN_ON_ONCE(chained))
++ goto bad_state;
++
+ if (state != NCSI_CHANNEL_INACTIVE &&
+ state != NCSI_CHANNEL_ACTIVE) {
+- ncsi_stop_channel_monitor(nc);
++bad_state:
++ netdev_warn(ndp->ndev.dev,
++ "Bad NCSI monitor state channel %d 0x%x %s queue\n",
++ nc->id, state, chained ? "on" : "off");
++ spin_lock_irqsave(&nc->lock, flags);
++ nc->monitor.enabled = false;
++ spin_unlock_irqrestore(&nc->lock, flags);
+ return;
+ }
+
+@@ -117,10 +124,9 @@ static void ncsi_channel_monitor(struct timer_list *t)
+ ndp->flags |= NCSI_DEV_RESHUFFLE;
+ }
+
+- ncsi_stop_channel_monitor(nc);
+-
+ ncm = &nc->modes[NCSI_MODE_LINK];
+ spin_lock_irqsave(&nc->lock, flags);
++ nc->monitor.enabled = false;
+ nc->state = NCSI_CHANNEL_INVISIBLE;
+ ncm->data[2] &= ~0x1;
+ spin_unlock_irqrestore(&nc->lock, flags);
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index 7d766350c08e1..bc269e83e1e55 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -120,11 +120,13 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
+ llcp_sock->service_name_len,
+ GFP_KERNEL);
+ if (!llcp_sock->service_name) {
++ nfc_llcp_local_put(llcp_sock->local);
+ ret = -ENOMEM;
+ goto put_dev;
+ }
+ llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
+ if (llcp_sock->ssap == LLCP_SAP_MAX) {
++ nfc_llcp_local_put(llcp_sock->local);
+ kfree(llcp_sock->service_name);
+ llcp_sock->service_name = NULL;
+ ret = -EADDRINUSE;
+@@ -683,6 +685,10 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
+ ret = -EISCONN;
+ goto error;
+ }
++ if (sk->sk_state == LLCP_CONNECTING) {
++ ret = -EINPROGRESS;
++ goto error;
++ }
+
+ dev = nfc_get_device(addr->dev_idx);
+ if (dev == NULL) {
+@@ -714,6 +720,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
+ llcp_sock->local = nfc_llcp_local_get(local);
+ llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
+ if (llcp_sock->ssap == LLCP_SAP_MAX) {
++ nfc_llcp_local_put(llcp_sock->local);
+ ret = -ENOMEM;
+ goto put_dev;
+ }
+@@ -751,8 +758,11 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
+
+ sock_unlink:
+ nfc_llcp_put_ssap(local, llcp_sock->ssap);
++ nfc_llcp_local_put(llcp_sock->local);
+
+ nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
++ kfree(llcp_sock->service_name);
++ llcp_sock->service_name = NULL;
+
+ put_dev:
+ nfc_put_device(dev);
+diff --git a/net/sched/act_api.c b/net/sched/act_api.c
+index f2c4bfc796633..26710b297dcbb 100644
+--- a/net/sched/act_api.c
++++ b/net/sched/act_api.c
+@@ -900,6 +900,9 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
+ return ERR_PTR(-EINVAL);
+ }
+
++ if (!bind && ovr && err == ACT_P_CREATED)
++ refcount_set(&a->tcfa_refcnt, 2);
++
+ return a;
+
+ err_mod:
+diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
+index 7ed53124069ce..163364124691c 100644
+--- a/net/sched/sch_teql.c
++++ b/net/sched/sch_teql.c
+@@ -138,6 +138,9 @@ teql_destroy(struct Qdisc *sch)
+ struct teql_sched_data *dat = qdisc_priv(sch);
+ struct teql_master *master = dat->m;
+
++ if (!master)
++ return;
++
+ prev = master->slaves;
+ if (prev) {
+ do {
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 736d8ca9821bc..4cc5739244935 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -655,8 +655,8 @@ static int sctp_v6_available(union sctp_addr *addr, struct sctp_sock *sp)
+ if (!(type & IPV6_ADDR_UNICAST))
+ return 0;
+
+- return sp->inet.freebind || net->ipv6.sysctl.ip_nonlocal_bind ||
+- ipv6_chk_addr(net, in6, NULL, 0);
++ return ipv6_can_nonlocal_bind(net, &sp->inet) ||
++ ipv6_chk_addr(net, in6, NULL, 0);
+ }
+
+ /* This function checks if the address is a valid address to be used for
+@@ -945,8 +945,7 @@ static int sctp_inet6_bind_verify(struct sctp_sock *opt, union sctp_addr *addr)
+ net = sock_net(&opt->inet.sk);
+ rcu_read_lock();
+ dev = dev_get_by_index_rcu(net, addr->v6.sin6_scope_id);
+- if (!dev || !(opt->inet.freebind ||
+- net->ipv6.sysctl.ip_nonlocal_bind ||
++ if (!dev || !(ipv6_can_nonlocal_bind(net, &opt->inet) ||
+ ipv6_chk_addr(net, &addr->v6.sin6_addr,
+ dev, 0))) {
+ rcu_read_unlock();
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 16e2af3a00ccb..4c35f9893081c 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -1187,7 +1187,7 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
+ spin_lock_bh(&inputq->lock);
+ if (skb_peek(arrvq) == skb) {
+ skb_queue_splice_tail_init(&tmpq, inputq);
+- kfree_skb(__skb_dequeue(arrvq));
++ __skb_dequeue(arrvq);
+ }
+ spin_unlock_bh(&inputq->lock);
+ __skb_queue_purge(&tmpq);
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index f455b9af6815c..9d8b106deb0b7 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -530,7 +530,7 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
+ cfg80211_sme_free(wdev);
+ }
+
+- if (WARN_ON(wdev->conn))
++ if (wdev->conn)
+ return -EINPROGRESS;
+
+ wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index eae8b90864978..35a020a709852 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -302,6 +302,8 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+
+ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+ } else {
++ if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
++ goto xmit;
+ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+ htonl(mtu));
+ }
+@@ -310,6 +312,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ return -EMSGSIZE;
+ }
+
++xmit:
+ xfrmi_scrub_packet(skb, !net_eq(xi->net, dev_net(dev)));
+ skb_dst_set(skb, dst);
+ skb->dev = tdev;
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 84dea0ad16661..44acc724122bb 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -41,7 +41,6 @@ static void xfrm_state_gc_task(struct work_struct *work);
+ */
+
+ static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
+-static __read_mostly seqcount_t xfrm_state_hash_generation = SEQCNT_ZERO(xfrm_state_hash_generation);
+ static struct kmem_cache *xfrm_state_cache __ro_after_init;
+
+ static DECLARE_WORK(xfrm_state_gc_work, xfrm_state_gc_task);
+@@ -137,7 +136,7 @@ static void xfrm_hash_resize(struct work_struct *work)
+ }
+
+ spin_lock_bh(&net->xfrm.xfrm_state_lock);
+- write_seqcount_begin(&xfrm_state_hash_generation);
++ write_seqcount_begin(&net->xfrm.xfrm_state_hash_generation);
+
+ nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
+ odst = xfrm_state_deref_prot(net->xfrm.state_bydst, net);
+@@ -153,7 +152,7 @@ static void xfrm_hash_resize(struct work_struct *work)
+ rcu_assign_pointer(net->xfrm.state_byspi, nspi);
+ net->xfrm.state_hmask = nhashmask;
+
+- write_seqcount_end(&xfrm_state_hash_generation);
++ write_seqcount_end(&net->xfrm.xfrm_state_hash_generation);
+ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+
+ osize = (ohashmask + 1) * sizeof(struct hlist_head);
+@@ -965,7 +964,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
+
+ to_put = NULL;
+
+- sequence = read_seqcount_begin(&xfrm_state_hash_generation);
++ sequence = read_seqcount_begin(&net->xfrm.xfrm_state_hash_generation);
+
+ rcu_read_lock();
+ h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
+@@ -1076,7 +1075,7 @@ out:
+ if (to_put)
+ xfrm_state_put(to_put);
+
+- if (read_seqcount_retry(&xfrm_state_hash_generation, sequence)) {
++ if (read_seqcount_retry(&net->xfrm.xfrm_state_hash_generation, sequence)) {
+ *err = -EAGAIN;
+ if (x) {
+ xfrm_state_put(x);
+@@ -2406,6 +2405,7 @@ int __net_init xfrm_state_init(struct net *net)
+ net->xfrm.state_num = 0;
+ INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
+ spin_lock_init(&net->xfrm.xfrm_state_lock);
++ seqcount_init(&net->xfrm.xfrm_state_hash_generation);
+ return 0;
+
+ out_byspi:
+diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
+index 1e34e6381baad..3c65e52b014c1 100644
+--- a/sound/drivers/aloop.c
++++ b/sound/drivers/aloop.c
+@@ -1047,6 +1047,14 @@ static int loopback_mixer_new(struct loopback *loopback, int notify)
+ return -ENOMEM;
+ kctl->id.device = dev;
+ kctl->id.subdevice = substr;
++
++ /* Add the control before copying the id so that
++ * the numid field of the id is set in the copy.
++ */
++ err = snd_ctl_add(card, kctl);
++ if (err < 0)
++ return err;
++
+ switch (idx) {
+ case ACTIVE_IDX:
+ setup->active_id = kctl->id;
+@@ -1063,9 +1071,6 @@ static int loopback_mixer_new(struct loopback *loopback, int notify)
+ default:
+ break;
+ }
+- err = snd_ctl_add(card, kctl);
+- if (err < 0)
+- return err;
+ }
+ }
+ }
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index c4c00297ada6e..88e869d16714b 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -710,7 +710,13 @@ int wm8960_configure_pll(struct snd_soc_component *component, int freq_in,
+ best_freq_out = -EINVAL;
+ *sysclk_idx = *dac_idx = *bclk_idx = -1;
+
+- for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) {
++ /*
++ * From Datasheet, the PLL performs best when f2 is between
++ * 90MHz and 100MHz, the desired sysclk output is 11.2896MHz
++ * or 12.288MHz, then sysclkdiv = 2 is the best choice.
++ * So search sysclk_divs from 2 to 1 other than from 1 to 2.
++ */
++ for (i = ARRAY_SIZE(sysclk_divs) - 1; i >= 0; --i) {
+ if (sysclk_divs[i] == -1)
+ continue;
+ for (j = 0; j < ARRAY_SIZE(dac_divs); ++j) {
+diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+index 0572c3c964506..be773101d8760 100644
+--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+@@ -508,14 +508,14 @@ static struct snd_soc_dai_driver sst_platform_dai[] = {
+ .channels_min = SST_STEREO,
+ .channels_max = SST_STEREO,
+ .rates = SNDRV_PCM_RATE_44100|SNDRV_PCM_RATE_48000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE,
+ },
+ .capture = {
+ .stream_name = "Headset Capture",
+ .channels_min = 1,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_44100|SNDRV_PCM_RATE_48000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE,
+ },
+ },
+ {
+@@ -526,7 +526,7 @@ static struct snd_soc_dai_driver sst_platform_dai[] = {
+ .channels_min = SST_STEREO,
+ .channels_max = SST_STEREO,
+ .rates = SNDRV_PCM_RATE_44100|SNDRV_PCM_RATE_48000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE,
+ },
+ },
+ {
+diff --git a/sound/soc/sunxi/sun4i-codec.c b/sound/soc/sunxi/sun4i-codec.c
+index 9a3cb77048105..16e8f74288a5e 100644
+--- a/sound/soc/sunxi/sun4i-codec.c
++++ b/sound/soc/sunxi/sun4i-codec.c
+@@ -1235,6 +1235,7 @@ static struct snd_soc_card *sun4i_codec_create_card(struct device *dev)
+ return ERR_PTR(-ENOMEM);
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ card->name = "sun4i-codec";
+ card->dapm_widgets = sun4i_codec_card_dapm_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(sun4i_codec_card_dapm_widgets);
+@@ -1267,6 +1268,7 @@ static struct snd_soc_card *sun6i_codec_create_card(struct device *dev)
+ return ERR_PTR(-ENOMEM);
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ card->name = "A31 Audio Codec";
+ card->dapm_widgets = sun6i_codec_card_dapm_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+@@ -1320,6 +1322,7 @@ static struct snd_soc_card *sun8i_a23_codec_create_card(struct device *dev)
+ return ERR_PTR(-ENOMEM);
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ card->name = "A23 Audio Codec";
+ card->dapm_widgets = sun6i_codec_card_dapm_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+@@ -1358,6 +1361,7 @@ static struct snd_soc_card *sun8i_h3_codec_create_card(struct device *dev)
+ return ERR_PTR(-ENOMEM);
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ card->name = "H3 Audio Codec";
+ card->dapm_widgets = sun6i_codec_card_dapm_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+@@ -1396,6 +1400,7 @@ static struct snd_soc_card *sun8i_v3s_codec_create_card(struct device *dev)
+ return ERR_PTR(-ENOMEM);
+
+ card->dev = dev;
++ card->owner = THIS_MODULE;
+ card->name = "V3s Audio Codec";
+ card->dapm_widgets = sun6i_codec_card_dapm_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-04-16 11:15 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-04-16 11:15 UTC (permalink / raw
To: gentoo-commits
commit: c9b7de80c8386cbd1e7033401062a566d8bf90b1
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Fri Apr 16 11:15:24 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Fri Apr 16 11:15:33 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c9b7de80
linux patch 4.19.188
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1187_linux-4.19.188.patch | 3892 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3896 insertions(+)
diff --git a/0000_README b/0000_README
index 0fdb045..32b1ad4 100644
--- a/0000_README
+++ b/0000_README
@@ -787,6 +787,10 @@ Patch: 1186_linux-4.19.187.patch
From: https://www.kernel.org
Desc: Linux 4.19.187
+Patch: 1187_linux-4.19.188.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.188
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1187_linux-4.19.188.patch b/1187_linux-4.19.188.patch
new file mode 100644
index 0000000..aa0f999
--- /dev/null
+++ b/1187_linux-4.19.188.patch
@@ -0,0 +1,3892 @@
+diff --git a/Makefile b/Makefile
+index ceec39b530bbe..85f071709a619 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 187
++SUBLEVEL = 188
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
+index a3b6f58d188c9..6d43f7901da23 100644
+--- a/arch/arm64/include/asm/kvm_arm.h
++++ b/arch/arm64/include/asm/kvm_arm.h
+@@ -198,6 +198,7 @@
+ #define CPTR_EL2_DEFAULT CPTR_EL2_RES1
+
+ /* Hyp Debug Configuration Register bits */
++#define MDCR_EL2_TTRF (1 << 19)
+ #define MDCR_EL2_TPMS (1 << 14)
+ #define MDCR_EL2_E2PB_MASK (UL(0x3))
+ #define MDCR_EL2_E2PB_SHIFT (UL(12))
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index 1719d21a171a9..122d5e843ab6d 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -258,7 +258,6 @@ static const struct arm64_ftr_bits ftr_id_aa64dfr0[] = {
+ * of support.
+ */
+ S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_EXACT, ID_AA64DFR0_PMUVER_SHIFT, 4, 0),
+- ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_EXACT, ID_AA64DFR0_TRACEVER_SHIFT, 4, 0),
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_EXACT, ID_AA64DFR0_DEBUGVER_SHIFT, 4, 0x6),
+ ARM64_FTR_END,
+ };
+diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c
+index 4e722d73a3c34..3606f6b890942 100644
+--- a/arch/arm64/kvm/debug.c
++++ b/arch/arm64/kvm/debug.c
+@@ -100,6 +100,7 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu)
+ * - Debug ROM Address (MDCR_EL2_TDRA)
+ * - OS related registers (MDCR_EL2_TDOSA)
+ * - Statistical profiler (MDCR_EL2_TPMS/MDCR_EL2_E2PB)
++ * - Self-hosted Trace Filter controls (MDCR_EL2_TTRF)
+ *
+ * Additionally, KVM only traps guest accesses to the debug registers if
+ * the guest is not actively using them (see the KVM_ARM64_DEBUG_DIRTY
+@@ -123,6 +124,7 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ vcpu->arch.mdcr_el2 = __this_cpu_read(mdcr_el2) & MDCR_EL2_HPMN_MASK;
+ vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM |
+ MDCR_EL2_TPMS |
++ MDCR_EL2_TTRF |
+ MDCR_EL2_TPMCR |
+ MDCR_EL2_TDRA |
+ MDCR_EL2_TDOSA);
+diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
+index a03821b2656aa..d9de22686e27d 100644
+--- a/arch/riscv/kernel/entry.S
++++ b/arch/riscv/kernel/entry.S
+@@ -449,6 +449,7 @@ ENDPROC(__fstate_restore)
+
+
+ .section ".rodata"
++ .align LGREG
+ /* Exception vector table */
+ ENTRY(excp_vect_table)
+ RISCV_PTR do_trap_insn_misaligned
+diff --git a/block/bio.c b/block/bio.c
+index 3d757055305f9..fe749404ef93b 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -314,7 +314,7 @@ static struct bio *__bio_chain_endio(struct bio *bio)
+ {
+ struct bio *parent = bio->bi_private;
+
+- if (!parent->bi_status)
++ if (bio->bi_status && !parent->bi_status)
+ parent->bi_status = bio->bi_status;
+ bio_put(bio);
+ return parent;
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 4ba9231a6be80..26ba7a99b7d5b 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -254,14 +254,16 @@ int driver_deferred_probe_check_state(struct device *dev)
+
+ static void deferred_probe_timeout_work_func(struct work_struct *work)
+ {
+- struct device_private *private, *p;
++ struct device_private *p;
+
+ deferred_probe_timeout = 0;
+ driver_deferred_probe_trigger();
+ flush_work(&deferred_probe_work);
+
+- list_for_each_entry_safe(private, p, &deferred_probe_pending_list, deferred_probe)
+- dev_info(private->device, "deferred probe pending");
++ mutex_lock(&deferred_probe_mutex);
++ list_for_each_entry(p, &deferred_probe_pending_list, deferred_probe)
++ dev_info(p->device, "deferred probe pending\n");
++ mutex_unlock(&deferred_probe_mutex);
+ }
+ static DECLARE_DELAYED_WORK(deferred_probe_timeout_work, deferred_probe_timeout_work_func);
+
+diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
+index 221a8cbc57f90..a4dba034dca48 100644
+--- a/drivers/gpu/drm/imx/imx-ldb.c
++++ b/drivers/gpu/drm/imx/imx-ldb.c
+@@ -206,6 +206,11 @@ static void imx_ldb_encoder_enable(struct drm_encoder *encoder)
+ int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN;
+ int mux = drm_of_encoder_active_port_id(imx_ldb_ch->child, encoder);
+
++ if (mux < 0 || mux >= ARRAY_SIZE(ldb->clk_sel)) {
++ dev_warn(ldb->dev, "%s: invalid mux %d\n", __func__, mux);
++ return;
++ }
++
+ drm_panel_prepare(imx_ldb_ch->panel);
+
+ if (dual) {
+@@ -264,6 +269,11 @@ imx_ldb_encoder_atomic_mode_set(struct drm_encoder *encoder,
+ int mux = drm_of_encoder_active_port_id(imx_ldb_ch->child, encoder);
+ u32 bus_format = imx_ldb_ch->bus_format;
+
++ if (mux < 0 || mux >= ARRAY_SIZE(ldb->clk_sel)) {
++ dev_warn(ldb->dev, "%s: invalid mux %d\n", __func__, mux);
++ return;
++ }
++
+ if (mode->clock > 170000) {
+ dev_warn(ldb->dev,
+ "%s: mode exceeds 170 MHz pixel clock\n", __func__);
+diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
+index 965088afcfade..03adb4cf325b9 100644
+--- a/drivers/gpu/drm/tegra/dc.c
++++ b/drivers/gpu/drm/tegra/dc.c
+@@ -1670,6 +1670,11 @@ static void tegra_dc_commit_state(struct tegra_dc *dc,
+ dev_err(dc->dev,
+ "failed to set clock rate to %lu Hz\n",
+ state->pclk);
++
++ err = clk_set_rate(dc->clk, state->pclk);
++ if (err < 0)
++ dev_err(dc->dev, "failed to set clock %pC to %lu Hz: %d\n",
++ dc->clk, state->pclk, err);
+ }
+
+ DRM_DEBUG_KMS("rate: %lu, div: %u\n", clk_get_rate(dc->clk),
+@@ -1680,11 +1685,6 @@ static void tegra_dc_commit_state(struct tegra_dc *dc,
+ value = SHIFT_CLK_DIVIDER(state->div) | PIXEL_CLK_DIVIDER_PCD1;
+ tegra_dc_writel(dc, value, DC_DISP_DISP_CLOCK_CONTROL);
+ }
+-
+- err = clk_set_rate(dc->clk, state->pclk);
+- if (err < 0)
+- dev_err(dc->dev, "failed to set clock %pC to %lu Hz: %d\n",
+- dc->clk, state->pclk, err);
+ }
+
+ static void tegra_dc_stop(struct tegra_dc *dc)
+diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c
+index e10e7b54ec4b6..7e5892597533e 100644
+--- a/drivers/net/phy/bcm-phy-lib.c
++++ b/drivers/net/phy/bcm-phy-lib.c
+@@ -198,7 +198,7 @@ EXPORT_SYMBOL_GPL(bcm_phy_enable_apd);
+
+ int bcm_phy_set_eee(struct phy_device *phydev, bool enable)
+ {
+- int val;
++ int val, mask = 0;
+
+ /* Enable EEE at PHY level */
+ val = phy_read_mmd(phydev, MDIO_MMD_AN, BRCM_CL45VEN_EEE_CONTROL);
+@@ -217,10 +217,15 @@ int bcm_phy_set_eee(struct phy_device *phydev, bool enable)
+ if (val < 0)
+ return val;
+
++ if (phydev->supported & SUPPORTED_1000baseT_Full)
++ mask |= MDIO_EEE_1000T;
++ if (phydev->supported & SUPPORTED_100baseT_Full)
++ mask |= MDIO_EEE_100TX;
++
+ if (enable)
+- val |= (MDIO_EEE_100TX | MDIO_EEE_1000T);
++ val |= mask;
+ else
+- val &= ~(MDIO_EEE_100TX | MDIO_EEE_1000T);
++ val &= ~mask;
+
+ phy_write_mmd(phydev, MDIO_MMD_AN, BCM_CL45VEN_EEE_ADV, (u32)val);
+
+diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
+index 1abf76be2aa8c..58e8140c1f57a 100644
+--- a/drivers/staging/Kconfig
++++ b/drivers/staging/Kconfig
+@@ -114,8 +114,6 @@ source "drivers/staging/mt7621-spi/Kconfig"
+
+ source "drivers/staging/mt7621-dma/Kconfig"
+
+-source "drivers/staging/mt7621-mmc/Kconfig"
+-
+ source "drivers/staging/mt7621-eth/Kconfig"
+
+ source "drivers/staging/mt7621-dts/Kconfig"
+diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
+index ab0cbe8815b1c..6f3065569fa00 100644
+--- a/drivers/staging/Makefile
++++ b/drivers/staging/Makefile
+@@ -47,7 +47,6 @@ obj-$(CONFIG_SOC_MT7621) += mt7621-pci/
+ obj-$(CONFIG_SOC_MT7621) += mt7621-pinctrl/
+ obj-$(CONFIG_SOC_MT7621) += mt7621-spi/
+ obj-$(CONFIG_SOC_MT7621) += mt7621-dma/
+-obj-$(CONFIG_SOC_MT7621) += mt7621-mmc/
+ obj-$(CONFIG_SOC_MT7621) += mt7621-eth/
+ obj-$(CONFIG_SOC_MT7621) += mt7621-dts/
+ obj-$(CONFIG_STAGING_GASKET_FRAMEWORK) += gasket/
+diff --git a/drivers/staging/mt7621-mmc/Kconfig b/drivers/staging/mt7621-mmc/Kconfig
+deleted file mode 100644
+index c6dfe8c637dc3..0000000000000
+--- a/drivers/staging/mt7621-mmc/Kconfig
++++ /dev/null
+@@ -1,16 +0,0 @@
+-config MTK_MMC
+- tristate "MTK SD/MMC"
+- depends on !MTD_NAND_RALINK && MMC
+-
+-config MTK_AEE_KDUMP
+- bool "MTK AEE KDUMP"
+- depends on MTK_MMC
+-
+-config MTK_MMC_CD_POLL
+- bool "Card Detect with Polling"
+- depends on MTK_MMC
+-
+-config MTK_MMC_EMMC_8BIT
+- bool "eMMC 8-bit support"
+- depends on MTK_MMC && RALINK_MT7628
+-
+diff --git a/drivers/staging/mt7621-mmc/Makefile b/drivers/staging/mt7621-mmc/Makefile
+deleted file mode 100644
+index caead0b547035..0000000000000
+--- a/drivers/staging/mt7621-mmc/Makefile
++++ /dev/null
+@@ -1,42 +0,0 @@
+-# Copyright Statement:
+-#
+-# This software/firmware and related documentation ("MediaTek Software") are
+-# protected under relevant copyright laws. The information contained herein
+-# is confidential and proprietary to MediaTek Inc. and/or its licensors.
+-# Without the prior written permission of MediaTek inc. and/or its licensors,
+-# any reproduction, modification, use or disclosure of MediaTek Software,
+-# and information contained herein, in whole or in part, shall be strictly prohibited.
+-#
+-# MediaTek Inc. (C) 2010. All rights reserved.
+-#
+-# BY OPENING THIS FILE, RECEIVER HEREBY UNEQUIVOCALLY ACKNOWLEDGES AND AGREES
+-# THAT THE SOFTWARE/FIRMWARE AND ITS DOCUMENTATIONS ("MEDIATEK SOFTWARE")
+-# RECEIVED FROM MEDIATEK AND/OR ITS REPRESENTATIVES ARE PROVIDED TO RECEIVER ON
+-# AN "AS-IS" BASIS ONLY. MEDIATEK EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES,
+-# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
+-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.
+-# NEITHER DOES MEDIATEK PROVIDE ANY WARRANTY WHATSOEVER WITH RESPECT TO THE
+-# SOFTWARE OF ANY THIRD PARTY WHICH MAY BE USED BY, INCORPORATED IN, OR
+-# SUPPLIED WITH THE MEDIATEK SOFTWARE, AND RECEIVER AGREES TO LOOK ONLY TO SUCH
+-# THIRD PARTY FOR ANY WARRANTY CLAIM RELATING THERETO. RECEIVER EXPRESSLY ACKNOWLEDGES
+-# THAT IT IS RECEIVER'S SOLE RESPONSIBILITY TO OBTAIN FROM ANY THIRD PARTY ALL PROPER LICENSES
+-# CONTAINED IN MEDIATEK SOFTWARE. MEDIATEK SHALL ALSO NOT BE RESPONSIBLE FOR ANY MEDIATEK
+-# SOFTWARE RELEASES MADE TO RECEIVER'S SPECIFICATION OR TO CONFORM TO A PARTICULAR
+-# STANDARD OR OPEN FORUM. RECEIVER'S SOLE AND EXCLUSIVE REMEDY AND MEDIATEK'S ENTIRE AND
+-# CUMULATIVE LIABILITY WITH RESPECT TO THE MEDIATEK SOFTWARE RELEASED HEREUNDER WILL BE,
+-# AT MEDIATEK'S OPTION, TO REVISE OR REPLACE THE MEDIATEK SOFTWARE AT ISSUE,
+-# OR REFUND ANY SOFTWARE LICENSE FEES OR SERVICE CHARGE PAID BY RECEIVER TO
+-# MEDIATEK FOR SUCH MEDIATEK SOFTWARE AT ISSUE.
+-#
+-# The following software/firmware and/or related documentation ("MediaTek Software")
+-# have been modified by MediaTek Inc. All revisions are subject to any receiver's
+-# applicable license agreements with MediaTek Inc.
+-
+-obj-$(CONFIG_MTK_MMC) += mtk_sd.o
+-mtk_sd-objs := sd.o dbg.o
+-ifeq ($(CONFIG_MTK_AEE_KDUMP),y)
+-EXTRA_CFLAGS += -DMT6575_SD_DEBUG
+-endif
+-
+-clean:
+- @rm -f *.o modules.order .*.cmd
+diff --git a/drivers/staging/mt7621-mmc/TODO b/drivers/staging/mt7621-mmc/TODO
+deleted file mode 100644
+index febb32d37e07b..0000000000000
+--- a/drivers/staging/mt7621-mmc/TODO
++++ /dev/null
+@@ -1,8 +0,0 @@
+-
+-- general code review and clean up
+-- ensure device-tree requirements are documented
+-- should probably be merged with drivers/mmc/host/mtk-sd.c
+-- possibly fix to work with highmem pages so a bounce buffer isn't
+- needed.
+-
+-Cc: NeilBrown <neil@brown.name>
+diff --git a/drivers/staging/mt7621-mmc/board.h b/drivers/staging/mt7621-mmc/board.h
+deleted file mode 100644
+index 983791ee308dd..0000000000000
+--- a/drivers/staging/mt7621-mmc/board.h
++++ /dev/null
+@@ -1,63 +0,0 @@
+-/* Copyright Statement:
+- *
+- * This software/firmware and related documentation ("MediaTek Software") are
+- * protected under relevant copyright laws. The information contained herein
+- * is confidential and proprietary to MediaTek Inc. and/or its licensors.
+- * Without the prior written permission of MediaTek inc. and/or its licensors,
+- * any reproduction, modification, use or disclosure of MediaTek Software,
+- * and information contained herein, in whole or in part, shall be strictly prohibited.
+- */
+-/* MediaTek Inc. (C) 2010. All rights reserved.
+- *
+- * BY OPENING THIS FILE, RECEIVER HEREBY UNEQUIVOCALLY ACKNOWLEDGES AND AGREES
+- * THAT THE SOFTWARE/FIRMWARE AND ITS DOCUMENTATIONS ("MEDIATEK SOFTWARE")
+- * RECEIVED FROM MEDIATEK AND/OR ITS REPRESENTATIVES ARE PROVIDED TO RECEIVER ON
+- * AN "AS-IS" BASIS ONLY. MEDIATEK EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES,
+- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
+- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.
+- * NEITHER DOES MEDIATEK PROVIDE ANY WARRANTY WHATSOEVER WITH RESPECT TO THE
+- * SOFTWARE OF ANY THIRD PARTY WHICH MAY BE USED BY, INCORPORATED IN, OR
+- * SUPPLIED WITH THE MEDIATEK SOFTWARE, AND RECEIVER AGREES TO LOOK ONLY TO SUCH
+- * THIRD PARTY FOR ANY WARRANTY CLAIM RELATING THERETO. RECEIVER EXPRESSLY ACKNOWLEDGES
+- * THAT IT IS RECEIVER'S SOLE RESPONSIBILITY TO OBTAIN FROM ANY THIRD PARTY ALL PROPER LICENSES
+- * CONTAINED IN MEDIATEK SOFTWARE. MEDIATEK SHALL ALSO NOT BE RESPONSIBLE FOR ANY MEDIATEK
+- * SOFTWARE RELEASES MADE TO RECEIVER'S SPECIFICATION OR TO CONFORM TO A PARTICULAR
+- * STANDARD OR OPEN FORUM. RECEIVER'S SOLE AND EXCLUSIVE REMEDY AND MEDIATEK'S ENTIRE AND
+- * CUMULATIVE LIABILITY WITH RESPECT TO THE MEDIATEK SOFTWARE RELEASED HEREUNDER WILL BE,
+- * AT MEDIATEK'S OPTION, TO REVISE OR REPLACE THE MEDIATEK SOFTWARE AT ISSUE,
+- * OR REFUND ANY SOFTWARE LICENSE FEES OR SERVICE CHARGE PAID BY RECEIVER TO
+- * MEDIATEK FOR SUCH MEDIATEK SOFTWARE AT ISSUE.
+- *
+- * The following software/firmware and/or related documentation ("MediaTek Software")
+- * have been modified by MediaTek Inc. All revisions are subject to any receiver's
+- * applicable license agreements with MediaTek Inc.
+- */
+-
+-#ifndef __ARCH_ARM_MACH_BOARD_H
+-#define __ARCH_ARM_MACH_BOARD_H
+-
+-#define MSDC_CD_PIN_EN BIT(0) /* card detection pin is wired */
+-#define MSDC_WP_PIN_EN BIT(1) /* write protection pin is wired */
+-#define MSDC_RST_PIN_EN BIT(2) /* emmc reset pin is wired */
+-#define MSDC_REMOVABLE BIT(5) /* removable slot */
+-
+-#define MSDC_SMPL_RISING (0)
+-#define MSDC_SMPL_FALLING (1)
+-
+-#define MSDC_CMD_PIN (0)
+-#define MSDC_DAT_PIN (1)
+-#define MSDC_CD_PIN (2)
+-#define MSDC_WP_PIN (3)
+-#define MSDC_RST_PIN (4)
+-
+-struct msdc_hw {
+- unsigned char clk_src; /* host clock source */
+- unsigned long flags; /* hardware capability flags */
+-
+- /* config gpio pull mode */
+- void (*config_gpio_pin)(int type, int pull);
+-};
+-
+-extern struct msdc_hw msdc0_hw;
+-
+-#endif /* __ARCH_ARM_MACH_BOARD_H */
+diff --git a/drivers/staging/mt7621-mmc/dbg.c b/drivers/staging/mt7621-mmc/dbg.c
+deleted file mode 100644
+index 6e518dce9029a..0000000000000
+--- a/drivers/staging/mt7621-mmc/dbg.c
++++ /dev/null
+@@ -1,307 +0,0 @@
+-/* Copyright Statement:
+- *
+- * This software/firmware and related documentation ("MediaTek Software") are
+- * protected under relevant copyright laws. The information contained herein
+- * is confidential and proprietary to MediaTek Inc. and/or its licensors.
+- * Without the prior written permission of MediaTek inc. and/or its licensors,
+- * any reproduction, modification, use or disclosure of MediaTek Software,
+- * and information contained herein, in whole or in part, shall be strictly prohibited.
+- *
+- * MediaTek Inc. (C) 2010. All rights reserved.
+- *
+- * BY OPENING THIS FILE, RECEIVER HEREBY UNEQUIVOCALLY ACKNOWLEDGES AND AGREES
+- * THAT THE SOFTWARE/FIRMWARE AND ITS DOCUMENTATIONS ("MEDIATEK SOFTWARE")
+- * RECEIVED FROM MEDIATEK AND/OR ITS REPRESENTATIVES ARE PROVIDED TO RECEIVER ON
+- * AN "AS-IS" BASIS ONLY. MEDIATEK EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES,
+- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
+- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.
+- * NEITHER DOES MEDIATEK PROVIDE ANY WARRANTY WHATSOEVER WITH RESPECT TO THE
+- * SOFTWARE OF ANY THIRD PARTY WHICH MAY BE USED BY, INCORPORATED IN, OR
+- * SUPPLIED WITH THE MEDIATEK SOFTWARE, AND RECEIVER AGREES TO LOOK ONLY TO SUCH
+- * THIRD PARTY FOR ANY WARRANTY CLAIM RELATING THERETO. RECEIVER EXPRESSLY ACKNOWLEDGES
+- * THAT IT IS RECEIVER'S SOLE RESPONSIBILITY TO OBTAIN FROM ANY THIRD PARTY ALL PROPER LICENSES
+- * CONTAINED IN MEDIATEK SOFTWARE. MEDIATEK SHALL ALSO NOT BE RESPONSIBLE FOR ANY MEDIATEK
+- * SOFTWARE RELEASES MADE TO RECEIVER'S SPECIFICATION OR TO CONFORM TO A PARTICULAR
+- * STANDARD OR OPEN FORUM. RECEIVER'S SOLE AND EXCLUSIVE REMEDY AND MEDIATEK'S ENTIRE AND
+- * CUMULATIVE LIABILITY WITH RESPECT TO THE MEDIATEK SOFTWARE RELEASED HEREUNDER WILL BE,
+- * AT MEDIATEK'S OPTION, TO REVISE OR REPLACE THE MEDIATEK SOFTWARE AT ISSUE,
+- * OR REFUND ANY SOFTWARE LICENSE FEES OR SERVICE CHARGE PAID BY RECEIVER TO
+- * MEDIATEK FOR SUCH MEDIATEK SOFTWARE AT ISSUE.
+- *
+- * The following software/firmware and/or related documentation ("MediaTek Software")
+- * have been modified by MediaTek Inc. All revisions are subject to any receiver's
+- * applicable license agreements with MediaTek Inc.
+- */
+-
+-#include <linux/version.h>
+-#include <linux/kernel.h>
+-#include <linux/sched.h>
+-#include <linux/kthread.h>
+-#include <linux/delay.h>
+-#include <linux/module.h>
+-#include <linux/init.h>
+-#include <linux/proc_fs.h>
+-#include <linux/string.h>
+-#include <linux/uaccess.h>
+-// #include <mach/mt6575_gpt.h> /* --- by chhung */
+-#include "dbg.h"
+-#include "mt6575_sd.h"
+-#include <linux/seq_file.h>
+-
+-static char cmd_buf[256];
+-
+-/* for debug zone */
+-unsigned int sd_debug_zone[4] = {
+- 0,
+- 0,
+- 0,
+- 0
+-};
+-
+-#if defined(MT6575_SD_DEBUG)
+-/* for driver profile */
+-#define TICKS_ONE_MS (13000)
+-u32 gpt_enable;
+-u32 sdio_pro_enable; /* make sure gpt is enabled */
+-u32 sdio_pro_time; /* no more than 30s */
+-struct sdio_profile sdio_perfomance = {0};
+-
+-#if 0 /* --- chhung */
+-void msdc_init_gpt(void)
+-{
+- GPT_CONFIG config;
+-
+- config.num = GPT6;
+- config.mode = GPT_FREE_RUN;
+- config.clkSrc = GPT_CLK_SRC_SYS;
+- config.clkDiv = GPT_CLK_DIV_1; /* 13MHz GPT6 */
+-
+- if (GPT_Config(config) == FALSE)
+- return;
+-
+- GPT_Start(GPT6);
+-}
+-#endif /* end of --- */
+-
+-u32 msdc_time_calc(u32 old_L32, u32 old_H32, u32 new_L32, u32 new_H32)
+-{
+- u32 ret = 0;
+-
+- if (new_H32 == old_H32) {
+- ret = new_L32 - old_L32;
+- } else if (new_H32 == (old_H32 + 1)) {
+- if (new_L32 > old_L32)
+- pr_debug("msdc old_L<0x%x> new_L<0x%x>\n", old_L32, new_L32);
+- ret = (0xffffffff - old_L32);
+- ret += new_L32;
+- } else {
+- pr_debug("msdc old_H<0x%x> new_H<0x%x>\n", old_H32, new_H32);
+- }
+-
+- return ret;
+-}
+-
+-void msdc_sdio_profile(struct sdio_profile *result)
+-{
+- struct cmd_profile *cmd;
+- u32 i;
+-
+- pr_debug("sdio === performance dump ===\n");
+- pr_debug("sdio === total execute tick<%d> time<%dms> Tx<%dB> Rx<%dB>\n",
+- result->total_tc, result->total_tc / TICKS_ONE_MS,
+- result->total_tx_bytes, result->total_rx_bytes);
+-
+- /* CMD52 Dump */
+- cmd = &result->cmd52_rx;
+- pr_debug("sdio === CMD52 Rx <%d>times tick<%d> Max<%d> Min<%d> Aver<%d>\n", cmd->count, cmd->tot_tc,
+- cmd->max_tc, cmd->min_tc, cmd->tot_tc / cmd->count);
+- cmd = &result->cmd52_tx;
+- pr_debug("sdio === CMD52 Tx <%d>times tick<%d> Max<%d> Min<%d> Aver<%d>\n", cmd->count, cmd->tot_tc,
+- cmd->max_tc, cmd->min_tc, cmd->tot_tc / cmd->count);
+-
+- /* CMD53 Rx bytes + block mode */
+- for (i = 0; i < 512; i++) {
+- cmd = &result->cmd53_rx_byte[i];
+- if (cmd->count) {
+- pr_debug("sdio<%6d><%3dB>_Rx_<%9d><%9d><%6d><%6d>_<%9dB><%2dM>\n", cmd->count, i, cmd->tot_tc,
+- cmd->max_tc, cmd->min_tc, cmd->tot_tc / cmd->count,
+- cmd->tot_bytes, (cmd->tot_bytes / 10) * 13 / (cmd->tot_tc / 10));
+- }
+- }
+- for (i = 0; i < 100; i++) {
+- cmd = &result->cmd53_rx_blk[i];
+- if (cmd->count) {
+- pr_debug("sdio<%6d><%3d>B_Rx_<%9d><%9d><%6d><%6d>_<%9dB><%2dM>\n", cmd->count, i, cmd->tot_tc,
+- cmd->max_tc, cmd->min_tc, cmd->tot_tc / cmd->count,
+- cmd->tot_bytes, (cmd->tot_bytes / 10) * 13 / (cmd->tot_tc / 10));
+- }
+- }
+-
+- /* CMD53 Tx bytes + block mode */
+- for (i = 0; i < 512; i++) {
+- cmd = &result->cmd53_tx_byte[i];
+- if (cmd->count) {
+- pr_debug("sdio<%6d><%3dB>_Tx_<%9d><%9d><%6d><%6d>_<%9dB><%2dM>\n", cmd->count, i, cmd->tot_tc,
+- cmd->max_tc, cmd->min_tc, cmd->tot_tc / cmd->count,
+- cmd->tot_bytes, (cmd->tot_bytes / 10) * 13 / (cmd->tot_tc / 10));
+- }
+- }
+- for (i = 0; i < 100; i++) {
+- cmd = &result->cmd53_tx_blk[i];
+- if (cmd->count) {
+- pr_debug("sdio<%6d><%3d>B_Tx_<%9d><%9d><%6d><%6d>_<%9dB><%2dM>\n", cmd->count, i, cmd->tot_tc,
+- cmd->max_tc, cmd->min_tc, cmd->tot_tc / cmd->count,
+- cmd->tot_bytes, (cmd->tot_bytes / 10) * 13 / (cmd->tot_tc / 10));
+- }
+- }
+-
+- pr_debug("sdio === performance dump done ===\n");
+-}
+-
+-//========= sdio command table ===========
+-void msdc_performance(u32 opcode, u32 sizes, u32 bRx, u32 ticks)
+-{
+- struct sdio_profile *result = &sdio_perfomance;
+- struct cmd_profile *cmd;
+- u32 block;
+-
+- if (sdio_pro_enable == 0)
+- return;
+-
+- if (opcode == 52) {
+- cmd = bRx ? &result->cmd52_rx : &result->cmd52_tx;
+- } else if (opcode == 53) {
+- if (sizes < 512) {
+- cmd = bRx ? &result->cmd53_rx_byte[sizes] : &result->cmd53_tx_byte[sizes];
+- } else {
+- block = sizes / 512;
+- if (block >= 99) {
+- pr_err("cmd53 error blocks\n");
+- while (1)
+- ;
+- }
+- cmd = bRx ? &result->cmd53_rx_blk[block] : &result->cmd53_tx_blk[block];
+- }
+- } else {
+- return;
+- }
+-
+- /* update the members */
+- if (ticks > cmd->max_tc)
+- cmd->max_tc = ticks;
+- if (cmd->min_tc == 0 || ticks < cmd->min_tc)
+- cmd->min_tc = ticks;
+- cmd->tot_tc += ticks;
+- cmd->tot_bytes += sizes;
+- cmd->count++;
+-
+- if (bRx)
+- result->total_rx_bytes += sizes;
+- else
+- result->total_tx_bytes += sizes;
+- result->total_tc += ticks;
+-
+- /* dump when total_tc > 30s */
+- if (result->total_tc >= sdio_pro_time * TICKS_ONE_MS * 1000) {
+- msdc_sdio_profile(result);
+- memset(result, 0, sizeof(struct sdio_profile));
+- }
+-}
+-
+-//========== driver proc interface ===========
+-static int msdc_debug_proc_read(struct seq_file *s, void *p)
+-{
+- seq_puts(s, "\n=========================================\n");
+- seq_puts(s, "Index<0> + Id + Zone\n");
+- seq_puts(s, "-> PWR<9> WRN<8> | FIO<7> OPS<6> FUN<5> CFG<4> | INT<3> RSP<2> CMD<1> DMA<0>\n");
+- seq_puts(s, "-> echo 0 3 0x3ff >msdc_bebug -> host[3] debug zone set to 0x3ff\n");
+- seq_printf(s, "-> MSDC[0] Zone: 0x%.8x\n", sd_debug_zone[0]);
+- seq_printf(s, "-> MSDC[1] Zone: 0x%.8x\n", sd_debug_zone[1]);
+- seq_printf(s, "-> MSDC[2] Zone: 0x%.8x\n", sd_debug_zone[2]);
+- seq_printf(s, "-> MSDC[3] Zone: 0x%.8x\n", sd_debug_zone[3]);
+-
+- seq_puts(s, "Index<3> + SDIO_PROFILE + TIME\n");
+- seq_puts(s, "-> echo 3 1 0x1E >msdc_bebug -> enable sdio_profile, 30s\n");
+- seq_printf(s, "-> SDIO_PROFILE<%d> TIME<%ds>\n", sdio_pro_enable, sdio_pro_time);
+- seq_puts(s, "=========================================\n\n");
+-
+- return 0;
+-}
+-
+-static ssize_t msdc_debug_proc_write(struct file *file,
+- const char __user *buf,
+- size_t count, loff_t *data)
+-{
+- int ret;
+-
+- int cmd, p1, p2;
+- int id, zone;
+- int mode, size;
+-
+- if (count == 0)
+- return -1;
+- if (count > 255)
+- count = 255;
+-
+- if (copy_from_user(cmd_buf, buf, count))
+- return -EFAULT;
+-
+- cmd_buf[count] = '\0';
+- pr_debug("msdc Write %s\n", cmd_buf);
+-
+- sscanf(cmd_buf, "%x %x %x", &cmd, &p1, &p2);
+-
+- if (cmd == SD_TOOL_ZONE) {
+- id = p1;
+- zone = p2;
+- zone &= 0x3ff;
+- pr_debug("msdc host_id<%d> zone<0x%.8x>\n", id, zone);
+- if (id >= 0 && id <= 3) {
+- sd_debug_zone[id] = zone;
+- } else if (id == 4) {
+- sd_debug_zone[0] = sd_debug_zone[1] = zone;
+- sd_debug_zone[2] = sd_debug_zone[3] = zone;
+- } else {
+- pr_err("msdc host_id error when set debug zone\n");
+- }
+- } else if (cmd == SD_TOOL_SDIO_PROFILE) {
+- if (p1 == 1) { /* enable profile */
+- if (gpt_enable == 0) {
+- // msdc_init_gpt(); /* --- by chhung */
+- gpt_enable = 1;
+- }
+- sdio_pro_enable = 1;
+- if (p2 == 0)
+- p2 = 1;
+- if (p2 >= 30)
+- p2 = 30;
+- sdio_pro_time = p2;
+- } else if (p1 == 0) {
+- /* todo */
+- sdio_pro_enable = 0;
+- }
+- }
+-
+- return count;
+-}
+-
+-static int msdc_debug_show(struct inode *inode, struct file *file)
+-{
+- return single_open(file, msdc_debug_proc_read, NULL);
+-}
+-
+-static const struct file_operations msdc_debug_fops = {
+- .owner = THIS_MODULE,
+- .open = msdc_debug_show,
+- .read = seq_read,
+- .write = msdc_debug_proc_write,
+- .llseek = seq_lseek,
+- .release = single_release,
+-};
+-
+-void msdc_debug_proc_init(void)
+-{
+- proc_create("msdc_debug", 0660, NULL, &msdc_debug_fops);
+-}
+-EXPORT_SYMBOL_GPL(msdc_debug_proc_init);
+-#endif
+diff --git a/drivers/staging/mt7621-mmc/dbg.h b/drivers/staging/mt7621-mmc/dbg.h
+deleted file mode 100644
+index 2f2c56b739874..0000000000000
+--- a/drivers/staging/mt7621-mmc/dbg.h
++++ /dev/null
+@@ -1,149 +0,0 @@
+-/* Copyright Statement:
+- *
+- * This software/firmware and related documentation ("MediaTek Software") are
+- * protected under relevant copyright laws. The information contained herein
+- * is confidential and proprietary to MediaTek Inc. and/or its licensors.
+- * Without the prior written permission of MediaTek inc. and/or its licensors,
+- * any reproduction, modification, use or disclosure of MediaTek Software,
+- * and information contained herein, in whole or in part, shall be strictly prohibited.
+- *
+- * MediaTek Inc. (C) 2010. All rights reserved.
+- *
+- * BY OPENING THIS FILE, RECEIVER HEREBY UNEQUIVOCALLY ACKNOWLEDGES AND AGREES
+- * THAT THE SOFTWARE/FIRMWARE AND ITS DOCUMENTATIONS ("MEDIATEK SOFTWARE")
+- * RECEIVED FROM MEDIATEK AND/OR ITS REPRESENTATIVES ARE PROVIDED TO RECEIVER ON
+- * AN "AS-IS" BASIS ONLY. MEDIATEK EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES,
+- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
+- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.
+- * NEITHER DOES MEDIATEK PROVIDE ANY WARRANTY WHATSOEVER WITH RESPECT TO THE
+- * SOFTWARE OF ANY THIRD PARTY WHICH MAY BE USED BY, INCORPORATED IN, OR
+- * SUPPLIED WITH THE MEDIATEK SOFTWARE, AND RECEIVER AGREES TO LOOK ONLY TO SUCH
+- * THIRD PARTY FOR ANY WARRANTY CLAIM RELATING THERETO. RECEIVER EXPRESSLY ACKNOWLEDGES
+- * THAT IT IS RECEIVER'S SOLE RESPONSIBILITY TO OBTAIN FROM ANY THIRD PARTY ALL PROPER LICENSES
+- * CONTAINED IN MEDIATEK SOFTWARE. MEDIATEK SHALL ALSO NOT BE RESPONSIBLE FOR ANY MEDIATEK
+- * SOFTWARE RELEASES MADE TO RECEIVER'S SPECIFICATION OR TO CONFORM TO A PARTICULAR
+- * STANDARD OR OPEN FORUM. RECEIVER'S SOLE AND EXCLUSIVE REMEDY AND MEDIATEK'S ENTIRE AND
+- * CUMULATIVE LIABILITY WITH RESPECT TO THE MEDIATEK SOFTWARE RELEASED HEREUNDER WILL BE,
+- * AT MEDIATEK'S OPTION, TO REVISE OR REPLACE THE MEDIATEK SOFTWARE AT ISSUE,
+- * OR REFUND ANY SOFTWARE LICENSE FEES OR SERVICE CHARGE PAID BY RECEIVER TO
+- * MEDIATEK FOR SUCH MEDIATEK SOFTWARE AT ISSUE.
+- *
+- * The following software/firmware and/or related documentation ("MediaTek Software")
+- * have been modified by MediaTek Inc. All revisions are subject to any receiver's
+- * applicable license agreements with MediaTek Inc.
+- */
+-#ifndef __MT_MSDC_DEUBG__
+-#define __MT_MSDC_DEUBG__
+-
+-//==========================
+-extern u32 sdio_pro_enable;
+-/* for a type command, e.g. CMD53, 2 blocks */
+-struct cmd_profile {
+- u32 max_tc; /* Max tick count */
+- u32 min_tc;
+- u32 tot_tc; /* total tick count */
+- u32 tot_bytes;
+- u32 count; /* the counts of the command */
+-};
+-
+-/* dump when total_tc and total_bytes */
+-struct sdio_profile {
+- u32 total_tc; /* total tick count of CMD52 and CMD53 */
+- u32 total_tx_bytes; /* total bytes of CMD53 Tx */
+- u32 total_rx_bytes; /* total bytes of CMD53 Rx */
+-
+- /*CMD52*/
+- struct cmd_profile cmd52_tx;
+- struct cmd_profile cmd52_rx;
+-
+- /*CMD53 in byte unit */
+- struct cmd_profile cmd53_tx_byte[512];
+- struct cmd_profile cmd53_rx_byte[512];
+-
+- /*CMD53 in block unit */
+- struct cmd_profile cmd53_tx_blk[100];
+- struct cmd_profile cmd53_rx_blk[100];
+-};
+-
+-//==========================
+-enum msdc_dbg {
+- SD_TOOL_ZONE = 0,
+- SD_TOOL_DMA_SIZE = 1,
+- SD_TOOL_PM_ENABLE = 2,
+- SD_TOOL_SDIO_PROFILE = 3,
+-};
+-
+-/* Debug message event */
+-#define DBG_EVT_NONE (0) /* No event */
+-#define DBG_EVT_DMA (1 << 0) /* DMA related event */
+-#define DBG_EVT_CMD (1 << 1) /* MSDC CMD related event */
+-#define DBG_EVT_RSP (1 << 2) /* MSDC CMD RSP related event */
+-#define DBG_EVT_INT (1 << 3) /* MSDC INT event */
+-#define DBG_EVT_CFG (1 << 4) /* MSDC CFG event */
+-#define DBG_EVT_FUC (1 << 5) /* Function event */
+-#define DBG_EVT_OPS (1 << 6) /* Read/Write operation event */
+-#define DBG_EVT_FIO (1 << 7) /* FIFO operation event */
+-#define DBG_EVT_WRN (1 << 8) /* Warning event */
+-#define DBG_EVT_PWR (1 << 9) /* Power event */
+-#define DBG_EVT_ALL (0xffffffff)
+-
+-#define DBG_EVT_MASK (DBG_EVT_ALL)
+-
+-extern unsigned int sd_debug_zone[4];
+-#define TAG "msdc"
+-#if 0 /* +++ chhung */
+-#define BUG_ON(x) \
+-do { \
+- if (x) { \
+- printk("[BUG] %s LINE:%d FILE:%s\n", #x, __LINE__, __FILE__); \
+- while (1) \
+- ; \
+- } \
+-} while (0)
+-#endif /* end of +++ */
+-
+-#define N_MSG(evt, fmt, args...)
+-/*
+-do { \
+- if ((DBG_EVT_##evt) & sd_debug_zone[host->id]) { \
+- printk(KERN_ERR TAG"%d -> "fmt" <- %s() : L<%d> PID<%s><0x%x>\n", \
+- host->id, ##args , __FUNCTION__, __LINE__, current->comm, current->pid); \
+- } \
+-} while(0)
+-*/
+-
+-#define ERR_MSG(fmt, args...) \
+-do { \
+- printk(KERN_ERR TAG"%d -> "fmt" <- %s() : L<%d> PID<%s><0x%x>\n", \
+- host->id, ##args, __FUNCTION__, __LINE__, current->comm, current->pid); \
+-} while (0);
+-
+-#if 1
+-//defined CONFIG_MTK_MMC_CD_POLL
+-#define INIT_MSG(fmt, args...)
+-#define IRQ_MSG(fmt, args...)
+-#else
+-#define INIT_MSG(fmt, args...) \
+-do { \
+- printk(KERN_ERR TAG"%d -> "fmt" <- %s() : L<%d> PID<%s><0x%x>\n", \
+- host->id, ##args, __FUNCTION__, __LINE__, current->comm, current->pid); \
+-} while (0);
+-
+-/* PID in ISR in not corrent */
+-#define IRQ_MSG(fmt, args...) \
+-do { \
+- printk(KERN_ERR TAG"%d -> "fmt" <- %s() : L<%d>\n", \
+- host->id, ##args, __FUNCTION__, __LINE__); \
+-} while (0);
+-#endif
+-
+-void msdc_debug_proc_init(void);
+-
+-#if 0 /* --- chhung */
+-void msdc_init_gpt(void);
+-extern void GPT_GetCounter64(UINT32 *cntL32, UINT32 *cntH32);
+-#endif /* end of --- */
+-u32 msdc_time_calc(u32 old_L32, u32 old_H32, u32 new_L32, u32 new_H32);
+-void msdc_performance(u32 opcode, u32 sizes, u32 bRx, u32 ticks);
+-
+-#endif
+diff --git a/drivers/staging/mt7621-mmc/mt6575_sd.h b/drivers/staging/mt7621-mmc/mt6575_sd.h
+deleted file mode 100644
+index 4e287c140acb4..0000000000000
+--- a/drivers/staging/mt7621-mmc/mt6575_sd.h
++++ /dev/null
+@@ -1,488 +0,0 @@
+-/* Copyright Statement:
+- *
+- * This software/firmware and related documentation ("MediaTek Software") are
+- * protected under relevant copyright laws. The information contained herein
+- * is confidential and proprietary to MediaTek Inc. and/or its licensors.
+- * Without the prior written permission of MediaTek inc. and/or its licensors,
+- * any reproduction, modification, use or disclosure of MediaTek Software,
+- * and information contained herein, in whole or in part, shall be strictly prohibited.
+- */
+-/* MediaTek Inc. (C) 2010. All rights reserved.
+- *
+- * BY OPENING THIS FILE, RECEIVER HEREBY UNEQUIVOCALLY ACKNOWLEDGES AND AGREES
+- * THAT THE SOFTWARE/FIRMWARE AND ITS DOCUMENTATIONS ("MEDIATEK SOFTWARE")
+- * RECEIVED FROM MEDIATEK AND/OR ITS REPRESENTATIVES ARE PROVIDED TO RECEIVER ON
+- * AN "AS-IS" BASIS ONLY. MEDIATEK EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES,
+- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
+- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.
+- * NEITHER DOES MEDIATEK PROVIDE ANY WARRANTY WHATSOEVER WITH RESPECT TO THE
+- * SOFTWARE OF ANY THIRD PARTY WHICH MAY BE USED BY, INCORPORATED IN, OR
+- * SUPPLIED WITH THE MEDIATEK SOFTWARE, AND RECEIVER AGREES TO LOOK ONLY TO SUCH
+- * THIRD PARTY FOR ANY WARRANTY CLAIM RELATING THERETO. RECEIVER EXPRESSLY ACKNOWLEDGES
+- * THAT IT IS RECEIVER'S SOLE RESPONSIBILITY TO OBTAIN FROM ANY THIRD PARTY ALL PROPER LICENSES
+- * CONTAINED IN MEDIATEK SOFTWARE. MEDIATEK SHALL ALSO NOT BE RESPONSIBLE FOR ANY MEDIATEK
+- * SOFTWARE RELEASES MADE TO RECEIVER'S SPECIFICATION OR TO CONFORM TO A PARTICULAR
+- * STANDARD OR OPEN FORUM. RECEIVER'S SOLE AND EXCLUSIVE REMEDY AND MEDIATEK'S ENTIRE AND
+- * CUMULATIVE LIABILITY WITH RESPECT TO THE MEDIATEK SOFTWARE RELEASED HEREUNDER WILL BE,
+- * AT MEDIATEK'S OPTION, TO REVISE OR REPLACE THE MEDIATEK SOFTWARE AT ISSUE,
+- * OR REFUND ANY SOFTWARE LICENSE FEES OR SERVICE CHARGE PAID BY RECEIVER TO
+- * MEDIATEK FOR SUCH MEDIATEK SOFTWARE AT ISSUE.
+- *
+- * The following software/firmware and/or related documentation ("MediaTek Software")
+- * have been modified by MediaTek Inc. All revisions are subject to any receiver's
+- * applicable license agreements with MediaTek Inc.
+- */
+-
+-#ifndef MT6575_SD_H
+-#define MT6575_SD_H
+-
+-#include <linux/bitops.h>
+-#include <linux/mmc/host.h>
+-
+-// #include <mach/mt6575_reg_base.h> /* --- by chhung */
+-
+-/*--------------------------------------------------------------------------*/
+-/* Common Definition */
+-/*--------------------------------------------------------------------------*/
+-#define MSDC_FIFO_SZ (128)
+-#define MSDC_FIFO_THD (64) // (128)
+-#define MSDC_NUM (4)
+-
+-#define MSDC_MS (0)
+-#define MSDC_SDMMC (1)
+-
+-#define MSDC_BUS_1BITS (0)
+-#define MSDC_BUS_4BITS (1)
+-#define MSDC_BUS_8BITS (2)
+-
+-#define MSDC_BRUST_8B (3)
+-#define MSDC_BRUST_16B (4)
+-#define MSDC_BRUST_32B (5)
+-#define MSDC_BRUST_64B (6)
+-
+-#define MSDC_PIN_PULL_NONE (0)
+-#define MSDC_PIN_PULL_DOWN (1)
+-#define MSDC_PIN_PULL_UP (2)
+-#define MSDC_PIN_KEEP (3)
+-
+-#define MSDC_MAX_SCLK (48000000) /* +/- by chhung */
+-#define MSDC_MIN_SCLK (260000)
+-
+-#define MSDC_AUTOCMD12 (0x0001)
+-#define MSDC_AUTOCMD23 (0x0002)
+-#define MSDC_AUTOCMD19 (0x0003)
+-
+-#define MSDC_EMMC_BOOTMODE0 (0) /* Pull low CMD mode */
+-#define MSDC_EMMC_BOOTMODE1 (1) /* Reset CMD mode */
+-
+-enum {
+- RESP_NONE = 0,
+- RESP_R1,
+- RESP_R2,
+- RESP_R3,
+- RESP_R4,
+- RESP_R5,
+- RESP_R6,
+- RESP_R7,
+- RESP_R1B
+-};
+-
+-/*--------------------------------------------------------------------------*/
+-/* Register Offset */
+-/*--------------------------------------------------------------------------*/
+-#define MSDC_CFG (0x0)
+-#define MSDC_IOCON (0x04)
+-#define MSDC_PS (0x08)
+-#define MSDC_INT (0x0c)
+-#define MSDC_INTEN (0x10)
+-#define MSDC_FIFOCS (0x14)
+-#define MSDC_TXDATA (0x18)
+-#define MSDC_RXDATA (0x1c)
+-#define SDC_CFG (0x30)
+-#define SDC_CMD (0x34)
+-#define SDC_ARG (0x38)
+-#define SDC_STS (0x3c)
+-#define SDC_RESP0 (0x40)
+-#define SDC_RESP1 (0x44)
+-#define SDC_RESP2 (0x48)
+-#define SDC_RESP3 (0x4c)
+-#define SDC_BLK_NUM (0x50)
+-#define SDC_CSTS (0x58)
+-#define SDC_CSTS_EN (0x5c)
+-#define SDC_DCRC_STS (0x60)
+-#define EMMC_CFG0 (0x70)
+-#define EMMC_CFG1 (0x74)
+-#define EMMC_STS (0x78)
+-#define EMMC_IOCON (0x7c)
+-#define SDC_ACMD_RESP (0x80)
+-#define SDC_ACMD19_TRG (0x84)
+-#define SDC_ACMD19_STS (0x88)
+-#define MSDC_DMA_SA (0x90)
+-#define MSDC_DMA_CA (0x94)
+-#define MSDC_DMA_CTRL (0x98)
+-#define MSDC_DMA_CFG (0x9c)
+-#define MSDC_DBG_SEL (0xa0)
+-#define MSDC_DBG_OUT (0xa4)
+-#define MSDC_PATCH_BIT (0xb0)
+-#define MSDC_PATCH_BIT0 MSDC_PATCH_BIT
+-#define MSDC_PATCH_BIT1 (0xb4)
+-#define MSDC_PAD_CTL0 (0xe0)
+-#define MSDC_PAD_CTL1 (0xe4)
+-#define MSDC_PAD_CTL2 (0xe8)
+-#define MSDC_PAD_TUNE (0xec)
+-#define MSDC_DAT_RDDLY0 (0xf0)
+-#define MSDC_DAT_RDDLY1 (0xf4)
+-#define MSDC_HW_DBG (0xf8)
+-#define MSDC_VERSION (0x100)
+-#define MSDC_ECO_VER (0x104)
+-
+-/*--------------------------------------------------------------------------*/
+-/* Register Mask */
+-/*--------------------------------------------------------------------------*/
+-
+-/* MSDC_CFG mask */
+-#define MSDC_CFG_MODE (0x1 << 0) /* RW */
+-#define MSDC_CFG_CKPDN (0x1 << 1) /* RW */
+-#define MSDC_CFG_RST (0x1 << 2) /* RW */
+-#define MSDC_CFG_PIO (0x1 << 3) /* RW */
+-#define MSDC_CFG_CKDRVEN (0x1 << 4) /* RW */
+-#define MSDC_CFG_BV18SDT (0x1 << 5) /* RW */
+-#define MSDC_CFG_BV18PSS (0x1 << 6) /* R */
+-#define MSDC_CFG_CKSTB (0x1 << 7) /* R */
+-#define MSDC_CFG_CKDIV (0xff << 8) /* RW */
+-#define MSDC_CFG_CKMOD (0x3 << 16) /* RW */
+-
+-/* MSDC_IOCON mask */
+-#define MSDC_IOCON_SDR104CKS (0x1 << 0) /* RW */
+-#define MSDC_IOCON_RSPL (0x1 << 1) /* RW */
+-#define MSDC_IOCON_DSPL (0x1 << 2) /* RW */
+-#define MSDC_IOCON_DDLSEL (0x1 << 3) /* RW */
+-#define MSDC_IOCON_DDR50CKD (0x1 << 4) /* RW */
+-#define MSDC_IOCON_DSPLSEL (0x1 << 5) /* RW */
+-#define MSDC_IOCON_D0SPL (0x1 << 16) /* RW */
+-#define MSDC_IOCON_D1SPL (0x1 << 17) /* RW */
+-#define MSDC_IOCON_D2SPL (0x1 << 18) /* RW */
+-#define MSDC_IOCON_D3SPL (0x1 << 19) /* RW */
+-#define MSDC_IOCON_D4SPL (0x1 << 20) /* RW */
+-#define MSDC_IOCON_D5SPL (0x1 << 21) /* RW */
+-#define MSDC_IOCON_D6SPL (0x1 << 22) /* RW */
+-#define MSDC_IOCON_D7SPL (0x1 << 23) /* RW */
+-#define MSDC_IOCON_RISCSZ (0x3 << 24) /* RW */
+-
+-/* MSDC_PS mask */
+-#define MSDC_PS_CDEN (0x1 << 0) /* RW */
+-#define MSDC_PS_CDSTS (0x1 << 1) /* R */
+-#define MSDC_PS_CDDEBOUNCE (0xf << 12) /* RW */
+-#define MSDC_PS_DAT (0xff << 16) /* R */
+-#define MSDC_PS_CMD (0x1 << 24) /* R */
+-#define MSDC_PS_WP (0x1UL << 31) /* R */
+-
+-/* MSDC_INT mask */
+-#define MSDC_INT_MMCIRQ (0x1 << 0) /* W1C */
+-#define MSDC_INT_CDSC (0x1 << 1) /* W1C */
+-#define MSDC_INT_ACMDRDY (0x1 << 3) /* W1C */
+-#define MSDC_INT_ACMDTMO (0x1 << 4) /* W1C */
+-#define MSDC_INT_ACMDCRCERR (0x1 << 5) /* W1C */
+-#define MSDC_INT_DMAQ_EMPTY (0x1 << 6) /* W1C */
+-#define MSDC_INT_SDIOIRQ (0x1 << 7) /* W1C */
+-#define MSDC_INT_CMDRDY (0x1 << 8) /* W1C */
+-#define MSDC_INT_CMDTMO (0x1 << 9) /* W1C */
+-#define MSDC_INT_RSPCRCERR (0x1 << 10) /* W1C */
+-#define MSDC_INT_CSTA (0x1 << 11) /* R */
+-#define MSDC_INT_XFER_COMPL (0x1 << 12) /* W1C */
+-#define MSDC_INT_DXFER_DONE (0x1 << 13) /* W1C */
+-#define MSDC_INT_DATTMO (0x1 << 14) /* W1C */
+-#define MSDC_INT_DATCRCERR (0x1 << 15) /* W1C */
+-#define MSDC_INT_ACMD19_DONE (0x1 << 16) /* W1C */
+-
+-/* MSDC_INTEN mask */
+-#define MSDC_INTEN_MMCIRQ (0x1 << 0) /* RW */
+-#define MSDC_INTEN_CDSC (0x1 << 1) /* RW */
+-#define MSDC_INTEN_ACMDRDY (0x1 << 3) /* RW */
+-#define MSDC_INTEN_ACMDTMO (0x1 << 4) /* RW */
+-#define MSDC_INTEN_ACMDCRCERR (0x1 << 5) /* RW */
+-#define MSDC_INTEN_DMAQ_EMPTY (0x1 << 6) /* RW */
+-#define MSDC_INTEN_SDIOIRQ (0x1 << 7) /* RW */
+-#define MSDC_INTEN_CMDRDY (0x1 << 8) /* RW */
+-#define MSDC_INTEN_CMDTMO (0x1 << 9) /* RW */
+-#define MSDC_INTEN_RSPCRCERR (0x1 << 10) /* RW */
+-#define MSDC_INTEN_CSTA (0x1 << 11) /* RW */
+-#define MSDC_INTEN_XFER_COMPL (0x1 << 12) /* RW */
+-#define MSDC_INTEN_DXFER_DONE (0x1 << 13) /* RW */
+-#define MSDC_INTEN_DATTMO (0x1 << 14) /* RW */
+-#define MSDC_INTEN_DATCRCERR (0x1 << 15) /* RW */
+-#define MSDC_INTEN_ACMD19_DONE (0x1 << 16) /* RW */
+-
+-/* MSDC_FIFOCS mask */
+-#define MSDC_FIFOCS_RXCNT (0xff << 0) /* R */
+-#define MSDC_FIFOCS_TXCNT (0xff << 16) /* R */
+-#define MSDC_FIFOCS_CLR (0x1UL << 31) /* RW */
+-
+-/* SDC_CFG mask */
+-#define SDC_CFG_SDIOINTWKUP (0x1 << 0) /* RW */
+-#define SDC_CFG_INSWKUP (0x1 << 1) /* RW */
+-#define SDC_CFG_BUSWIDTH (0x3 << 16) /* RW */
+-#define SDC_CFG_SDIO (0x1 << 19) /* RW */
+-#define SDC_CFG_SDIOIDE (0x1 << 20) /* RW */
+-#define SDC_CFG_INTATGAP (0x1 << 21) /* RW */
+-#define SDC_CFG_DTOC (0xffUL << 24) /* RW */
+-
+-/* SDC_CMD mask */
+-#define SDC_CMD_OPC (0x3f << 0) /* RW */
+-#define SDC_CMD_BRK (0x1 << 6) /* RW */
+-#define SDC_CMD_RSPTYP (0x7 << 7) /* RW */
+-#define SDC_CMD_DTYP (0x3 << 11) /* RW */
+-#define SDC_CMD_DTYP (0x3 << 11) /* RW */
+-#define SDC_CMD_RW (0x1 << 13) /* RW */
+-#define SDC_CMD_STOP (0x1 << 14) /* RW */
+-#define SDC_CMD_GOIRQ (0x1 << 15) /* RW */
+-#define SDC_CMD_BLKLEN (0xfff << 16) /* RW */
+-#define SDC_CMD_AUTOCMD (0x3 << 28) /* RW */
+-#define SDC_CMD_VOLSWTH (0x1 << 30) /* RW */
+-
+-/* SDC_STS mask */
+-#define SDC_STS_SDCBUSY (0x1 << 0) /* RW */
+-#define SDC_STS_CMDBUSY (0x1 << 1) /* RW */
+-#define SDC_STS_SWR_COMPL (0x1 << 31) /* RW */
+-
+-/* SDC_DCRC_STS mask */
+-#define SDC_DCRC_STS_NEG (0xf << 8) /* RO */
+-#define SDC_DCRC_STS_POS (0xff << 0) /* RO */
+-
+-/* EMMC_CFG0 mask */
+-#define EMMC_CFG0_BOOTSTART (0x1 << 0) /* W */
+-#define EMMC_CFG0_BOOTSTOP (0x1 << 1) /* W */
+-#define EMMC_CFG0_BOOTMODE (0x1 << 2) /* RW */
+-#define EMMC_CFG0_BOOTACKDIS (0x1 << 3) /* RW */
+-#define EMMC_CFG0_BOOTWDLY (0x7 << 12) /* RW */
+-#define EMMC_CFG0_BOOTSUPP (0x1 << 15) /* RW */
+-
+-/* EMMC_CFG1 mask */
+-#define EMMC_CFG1_BOOTDATTMC (0xfffff << 0) /* RW */
+-#define EMMC_CFG1_BOOTACKTMC (0xfffUL << 20) /* RW */
+-
+-/* EMMC_STS mask */
+-#define EMMC_STS_BOOTCRCERR (0x1 << 0) /* W1C */
+-#define EMMC_STS_BOOTACKERR (0x1 << 1) /* W1C */
+-#define EMMC_STS_BOOTDATTMO (0x1 << 2) /* W1C */
+-#define EMMC_STS_BOOTACKTMO (0x1 << 3) /* W1C */
+-#define EMMC_STS_BOOTUPSTATE (0x1 << 4) /* R */
+-#define EMMC_STS_BOOTACKRCV (0x1 << 5) /* W1C */
+-#define EMMC_STS_BOOTDATRCV (0x1 << 6) /* R */
+-
+-/* EMMC_IOCON mask */
+-#define EMMC_IOCON_BOOTRST (0x1 << 0) /* RW */
+-
+-/* SDC_ACMD19_TRG mask */
+-#define SDC_ACMD19_TRG_TUNESEL (0xf << 0) /* RW */
+-
+-/* MSDC_DMA_CTRL mask */
+-#define MSDC_DMA_CTRL_START (0x1 << 0) /* W */
+-#define MSDC_DMA_CTRL_STOP (0x1 << 1) /* W */
+-#define MSDC_DMA_CTRL_RESUME (0x1 << 2) /* W */
+-#define MSDC_DMA_CTRL_MODE (0x1 << 8) /* RW */
+-#define MSDC_DMA_CTRL_LASTBUF (0x1 << 10) /* RW */
+-#define MSDC_DMA_CTRL_BRUSTSZ (0x7 << 12) /* RW */
+-#define MSDC_DMA_CTRL_XFERSZ (0xffffUL << 16)/* RW */
+-
+-/* MSDC_DMA_CFG mask */
+-#define MSDC_DMA_CFG_STS (0x1 << 0) /* R */
+-#define MSDC_DMA_CFG_DECSEN (0x1 << 1) /* RW */
+-#define MSDC_DMA_CFG_BDCSERR (0x1 << 4) /* R */
+-#define MSDC_DMA_CFG_GPDCSERR (0x1 << 5) /* R */
+-
+-/* MSDC_PATCH_BIT mask */
+-#define MSDC_PATCH_BIT_WFLSMODE (0x1 << 0) /* RW */
+-#define MSDC_PATCH_BIT_ODDSUPP (0x1 << 1) /* RW */
+-#define MSDC_PATCH_BIT_CKGEN_CK (0x1 << 6) /* E2: Fixed to 1 */
+-#define MSDC_PATCH_BIT_IODSSEL (0x1 << 16) /* RW */
+-#define MSDC_PATCH_BIT_IOINTSEL (0x1 << 17) /* RW */
+-#define MSDC_PATCH_BIT_BUSYDLY (0xf << 18) /* RW */
+-#define MSDC_PATCH_BIT_WDOD (0xf << 22) /* RW */
+-#define MSDC_PATCH_BIT_IDRTSEL (0x1 << 26) /* RW */
+-#define MSDC_PATCH_BIT_CMDFSEL (0x1 << 27) /* RW */
+-#define MSDC_PATCH_BIT_INTDLSEL (0x1 << 28) /* RW */
+-#define MSDC_PATCH_BIT_SPCPUSH (0x1 << 29) /* RW */
+-#define MSDC_PATCH_BIT_DECRCTMO (0x1 << 30) /* RW */
+-
+-/* MSDC_PATCH_BIT1 mask */
+-#define MSDC_PATCH_BIT1_WRDAT_CRCS (0x7 << 3)
+-#define MSDC_PATCH_BIT1_CMD_RSP (0x7 << 0)
+-
+-/* MSDC_PAD_CTL0 mask */
+-#define MSDC_PAD_CTL0_CLKDRVN (0x7 << 0) /* RW */
+-#define MSDC_PAD_CTL0_CLKDRVP (0x7 << 4) /* RW */
+-#define MSDC_PAD_CTL0_CLKSR (0x1 << 8) /* RW */
+-#define MSDC_PAD_CTL0_CLKPD (0x1 << 16) /* RW */
+-#define MSDC_PAD_CTL0_CLKPU (0x1 << 17) /* RW */
+-#define MSDC_PAD_CTL0_CLKSMT (0x1 << 18) /* RW */
+-#define MSDC_PAD_CTL0_CLKIES (0x1 << 19) /* RW */
+-#define MSDC_PAD_CTL0_CLKTDSEL (0xf << 20) /* RW */
+-#define MSDC_PAD_CTL0_CLKRDSEL (0xffUL << 24) /* RW */
+-
+-/* MSDC_PAD_CTL1 mask */
+-#define MSDC_PAD_CTL1_CMDDRVN (0x7 << 0) /* RW */
+-#define MSDC_PAD_CTL1_CMDDRVP (0x7 << 4) /* RW */
+-#define MSDC_PAD_CTL1_CMDSR (0x1 << 8) /* RW */
+-#define MSDC_PAD_CTL1_CMDPD (0x1 << 16) /* RW */
+-#define MSDC_PAD_CTL1_CMDPU (0x1 << 17) /* RW */
+-#define MSDC_PAD_CTL1_CMDSMT (0x1 << 18) /* RW */
+-#define MSDC_PAD_CTL1_CMDIES (0x1 << 19) /* RW */
+-#define MSDC_PAD_CTL1_CMDTDSEL (0xf << 20) /* RW */
+-#define MSDC_PAD_CTL1_CMDRDSEL (0xffUL << 24) /* RW */
+-
+-/* MSDC_PAD_CTL2 mask */
+-#define MSDC_PAD_CTL2_DATDRVN (0x7 << 0) /* RW */
+-#define MSDC_PAD_CTL2_DATDRVP (0x7 << 4) /* RW */
+-#define MSDC_PAD_CTL2_DATSR (0x1 << 8) /* RW */
+-#define MSDC_PAD_CTL2_DATPD (0x1 << 16) /* RW */
+-#define MSDC_PAD_CTL2_DATPU (0x1 << 17) /* RW */
+-#define MSDC_PAD_CTL2_DATIES (0x1 << 19) /* RW */
+-#define MSDC_PAD_CTL2_DATSMT (0x1 << 18) /* RW */
+-#define MSDC_PAD_CTL2_DATTDSEL (0xf << 20) /* RW */
+-#define MSDC_PAD_CTL2_DATRDSEL (0xffUL << 24) /* RW */
+-
+-/* MSDC_PAD_TUNE mask */
+-#define MSDC_PAD_TUNE_DATWRDLY (0x1F << 0) /* RW */
+-#define MSDC_PAD_TUNE_DATRRDLY (0x1F << 8) /* RW */
+-#define MSDC_PAD_TUNE_CMDRDLY (0x1F << 16) /* RW */
+-#define MSDC_PAD_TUNE_CMDRRDLY (0x1FUL << 22) /* RW */
+-#define MSDC_PAD_TUNE_CLKTXDLY (0x1FUL << 27) /* RW */
+-
+-/* MSDC_DAT_RDDLY0/1 mask */
+-#define MSDC_DAT_RDDLY0_D0 (0x1F << 0) /* RW */
+-#define MSDC_DAT_RDDLY0_D1 (0x1F << 8) /* RW */
+-#define MSDC_DAT_RDDLY0_D2 (0x1F << 16) /* RW */
+-#define MSDC_DAT_RDDLY0_D3 (0x1F << 24) /* RW */
+-
+-#define MSDC_DAT_RDDLY1_D4 (0x1F << 0) /* RW */
+-#define MSDC_DAT_RDDLY1_D5 (0x1F << 8) /* RW */
+-#define MSDC_DAT_RDDLY1_D6 (0x1F << 16) /* RW */
+-#define MSDC_DAT_RDDLY1_D7 (0x1F << 24) /* RW */
+-
+-#define MSDC_CKGEN_MSDC_DLY_SEL (0x1F << 10)
+-#define MSDC_INT_DAT_LATCH_CK_SEL (0x7 << 7)
+-#define MSDC_CKGEN_MSDC_CK_SEL (0x1 << 6)
+-#define CARD_READY_FOR_DATA (1 << 8)
+-#define CARD_CURRENT_STATE(x) ((x & 0x00001E00) >> 9)
+-
+-/*--------------------------------------------------------------------------*/
+-/* Descriptor Structure */
+-/*--------------------------------------------------------------------------*/
+-struct gpd {
+- u32 hwo:1; /* could be changed by hw */
+- u32 bdp:1;
+- u32 rsv0:6;
+- u32 chksum:8;
+- u32 intr:1;
+- u32 rsv1:15;
+- void *next;
+- void *ptr;
+- u32 buflen:16;
+- u32 extlen:8;
+- u32 rsv2:8;
+- u32 arg;
+- u32 blknum;
+- u32 cmd;
+-};
+-
+-struct bd {
+- u32 eol:1;
+- u32 rsv0:7;
+- u32 chksum:8;
+- u32 rsv1:1;
+- u32 blkpad:1;
+- u32 dwpad:1;
+- u32 rsv2:13;
+- void *next;
+- void *ptr;
+- u32 buflen:16;
+- u32 rsv3:16;
+-};
+-
+-struct msdc_dma {
+- struct gpd *gpd; /* pointer to gpd array */
+- struct bd *bd; /* pointer to bd array */
+- dma_addr_t gpd_addr; /* the physical address of gpd array */
+- dma_addr_t bd_addr; /* the physical address of bd array */
+-};
+-
+-struct msdc_host {
+- struct msdc_hw *hw;
+-
+- struct mmc_host *mmc; /* mmc structure */
+- struct mmc_command *cmd;
+- struct mmc_data *data;
+- struct mmc_request *mrq;
+- int cmd_rsp;
+-
+- int error;
+- spinlock_t lock; /* mutex */
+- struct semaphore sem;
+-
+- u32 blksz; /* host block size */
+- void __iomem *base; /* host base address */
+- int id; /* host id */
+- int pwr_ref; /* core power reference count */
+-
+- u32 xfer_size; /* total transferred size */
+-
+- struct msdc_dma dma; /* dma channel */
+- u32 dma_xfer_size; /* dma transfer size in bytes */
+-
+- u32 timeout_ns; /* data timeout ns */
+- u32 timeout_clks; /* data timeout clks */
+-
+- int irq; /* host interrupt */
+-
+- struct delayed_work card_delaywork;
+-
+- struct completion cmd_done;
+- struct completion xfer_done;
+- struct pm_message pm_state;
+-
+- u32 mclk; /* mmc subsystem clock */
+- u32 hclk; /* host clock speed */
+- u32 sclk; /* SD/MS clock speed */
+- u8 core_clkon; /* Host core clock on ? */
+- u8 card_clkon; /* Card clock on ? */
+- u8 core_power; /* core power */
+- u8 power_mode; /* host power mode */
+- u8 card_inserted; /* card inserted ? */
+- u8 suspend; /* host suspended ? */
+- u8 app_cmd; /* for app command */
+- u32 app_cmd_arg;
+-};
+-
+-static inline void sdr_set_bits(void __iomem *reg, u32 bs)
+-{
+- u32 val = readl(reg);
+-
+- val |= bs;
+- writel(val, reg);
+-}
+-
+-static inline void sdr_clr_bits(void __iomem *reg, u32 bs)
+-{
+- u32 val = readl(reg);
+-
+- val &= ~bs;
+- writel(val, reg);
+-}
+-
+-static inline void sdr_set_field(void __iomem *reg, u32 field, u32 val)
+-{
+- unsigned int tv = readl(reg);
+-
+- tv &= ~field;
+- tv |= ((val) << (ffs((unsigned int)field) - 1));
+- writel(tv, reg);
+-}
+-
+-static inline void sdr_get_field(void __iomem *reg, u32 field, u32 *val)
+-{
+- unsigned int tv = readl(reg);
+- *val = ((tv & field) >> (ffs((unsigned int)field) - 1));
+-}
+-
+-#endif
+diff --git a/drivers/staging/mt7621-mmc/sd.c b/drivers/staging/mt7621-mmc/sd.c
+deleted file mode 100644
+index 04d23cc7cd4a6..0000000000000
+--- a/drivers/staging/mt7621-mmc/sd.c
++++ /dev/null
+@@ -1,2392 +0,0 @@
+-/* Copyright Statement:
+- *
+- * This software/firmware and related documentation ("MediaTek Software") are
+- * protected under relevant copyright laws. The information contained herein
+- * is confidential and proprietary to MediaTek Inc. and/or its licensors.
+- * Without the prior written permission of MediaTek inc. and/or its licensors,
+- * any reproduction, modification, use or disclosure of MediaTek Software,
+- * and information contained herein, in whole or in part, shall be strictly prohibited.
+- *
+- * MediaTek Inc. (C) 2010. All rights reserved.
+- *
+- * BY OPENING THIS FILE, RECEIVER HEREBY UNEQUIVOCALLY ACKNOWLEDGES AND AGREES
+- * THAT THE SOFTWARE/FIRMWARE AND ITS DOCUMENTATIONS ("MEDIATEK SOFTWARE")
+- * RECEIVED FROM MEDIATEK AND/OR ITS REPRESENTATIVES ARE PROVIDED TO RECEIVER ON
+- * AN "AS-IS" BASIS ONLY. MEDIATEK EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES,
+- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
+- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.
+- * NEITHER DOES MEDIATEK PROVIDE ANY WARRANTY WHATSOEVER WITH RESPECT TO THE
+- * SOFTWARE OF ANY THIRD PARTY WHICH MAY BE USED BY, INCORPORATED IN, OR
+- * SUPPLIED WITH THE MEDIATEK SOFTWARE, AND RECEIVER AGREES TO LOOK ONLY TO SUCH
+- * THIRD PARTY FOR ANY WARRANTY CLAIM RELATING THERETO. RECEIVER EXPRESSLY ACKNOWLEDGES
+- * THAT IT IS RECEIVER'S SOLE RESPONSIBILITY TO OBTAIN FROM ANY THIRD PARTY ALL PROPER LICENSES
+- * CONTAINED IN MEDIATEK SOFTWARE. MEDIATEK SHALL ALSO NOT BE RESPONSIBLE FOR ANY MEDIATEK
+- * SOFTWARE RELEASES MADE TO RECEIVER'S SPECIFICATION OR TO CONFORM TO A PARTICULAR
+- * STANDARD OR OPEN FORUM. RECEIVER'S SOLE AND EXCLUSIVE REMEDY AND MEDIATEK'S ENTIRE AND
+- * CUMULATIVE LIABILITY WITH RESPECT TO THE MEDIATEK SOFTWARE RELEASED HEREUNDER WILL BE,
+- * AT MEDIATEK'S OPTION, TO REVISE OR REPLACE THE MEDIATEK SOFTWARE AT ISSUE,
+- * OR REFUND ANY SOFTWARE LICENSE FEES OR SERVICE CHARGE PAID BY RECEIVER TO
+- * MEDIATEK FOR SUCH MEDIATEK SOFTWARE AT ISSUE.
+- *
+- * The following software/firmware and/or related documentation ("MediaTek Software")
+- * have been modified by MediaTek Inc. All revisions are subject to any receiver's
+- * applicable license agreements with MediaTek Inc.
+- */
+-
+-#include <linux/module.h>
+-#include <linux/delay.h>
+-#include <linux/dma-mapping.h>
+-#include <linux/spinlock.h>
+-#include <linux/platform_device.h>
+-
+-#include <linux/mmc/host.h>
+-#include <linux/mmc/mmc.h>
+-#include <linux/mmc/sd.h>
+-#include <linux/mmc/sdio.h>
+-
+-#include <asm/mach-ralink/ralink_regs.h>
+-
+-#include "board.h"
+-#include "dbg.h"
+-#include "mt6575_sd.h"
+-
+-#ifdef CONFIG_SOC_MT7621
+-#define RALINK_SYSCTL_BASE 0xbe000000
+-#else
+-#define RALINK_SYSCTL_BASE 0xb0000000
+-#endif
+-
+-#define DRV_NAME "mtk-sd"
+-
+-#if defined(CONFIG_SOC_MT7620)
+-#define HOST_MAX_MCLK (48000000) /* +/- by chhung */
+-#elif defined(CONFIG_SOC_MT7621)
+-#define HOST_MAX_MCLK (50000000) /* +/- by chhung */
+-#endif
+-#define HOST_MIN_MCLK (260000)
+-
+-#define HOST_MAX_BLKSZ (2048)
+-
+-#define MSDC_OCR_AVAIL (MMC_VDD_28_29 | MMC_VDD_29_30 | MMC_VDD_30_31 | MMC_VDD_31_32 | MMC_VDD_32_33)
+-
+-#define GPIO_PULL_DOWN (0)
+-#define GPIO_PULL_UP (1)
+-
+-#if 0 /* --- by chhung */
+-#define MSDC_CLKSRC_REG (0xf100000C)
+-#define PDN_REG (0xF1000010)
+-#endif /* end of --- */
+-
+-#define DEFAULT_DEBOUNCE (8) /* 8 cycles */
+-#define DEFAULT_DTOC (40) /* data timeout counter. 65536x40 sclk. */
+-
+-#define CMD_TIMEOUT (HZ / 10) /* 100ms */
+-#define DAT_TIMEOUT (HZ / 2 * 5) /* 500ms x5 */
+-
+-#define MAX_DMA_CNT (64 * 1024 - 512) /* a single transaction for WIFI may be 50K*/
+-
+-#define MAX_GPD_NUM (1 + 1) /* one null gpd */
+-#define MAX_BD_NUM (1024)
+-
+-#define MAX_HW_SGMTS (MAX_BD_NUM)
+-#define MAX_SGMT_SZ (MAX_DMA_CNT)
+-#define MAX_REQ_SZ (MAX_SGMT_SZ * 8)
+-
+-static int cd_active_low = 1;
+-
+-//=================================
+-#define PERI_MSDC0_PDN (15)
+-//#define PERI_MSDC1_PDN (16)
+-//#define PERI_MSDC2_PDN (17)
+-//#define PERI_MSDC3_PDN (18)
+-
+-#if 0 /* --- by chhung */
+-/* gate means clock power down */
+-static int g_clk_gate = 0;
+-#define msdc_gate_clock(id) \
+- do { \
+- g_clk_gate &= ~(1 << ((id) + PERI_MSDC0_PDN)); \
+- } while (0)
+-/* not like power down register. 1 means clock on. */
+-#define msdc_ungate_clock(id) \
+- do { \
+- g_clk_gate |= 1 << ((id) + PERI_MSDC0_PDN); \
+- } while (0)
+-
+-// do we need sync object or not
+-void msdc_clk_status(int *status)
+-{
+- *status = g_clk_gate;
+-}
+-#endif /* end of --- */
+-
+-/* +++ by chhung */
+-struct msdc_hw msdc0_hw = {
+- .clk_src = 0,
+- .flags = MSDC_CD_PIN_EN | MSDC_REMOVABLE,
+-// .flags = MSDC_WP_PIN_EN | MSDC_CD_PIN_EN | MSDC_REMOVABLE,
+-};
+-
+-/* end of +++ */
+-
+-static int msdc_rsp[] = {
+- 0, /* RESP_NONE */
+- 1, /* RESP_R1 */
+- 2, /* RESP_R2 */
+- 3, /* RESP_R3 */
+- 4, /* RESP_R4 */
+- 1, /* RESP_R5 */
+- 1, /* RESP_R6 */
+- 1, /* RESP_R7 */
+- 7, /* RESP_R1b */
+-};
+-
+-#define msdc_dma_on() sdr_clr_bits(host->base + MSDC_CFG, MSDC_CFG_PIO)
+-
+-static void msdc_reset_hw(struct msdc_host *host)
+-{
+- sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_RST);
+- while (readl(host->base + MSDC_CFG) & MSDC_CFG_RST)
+- cpu_relax();
+-}
+-
+-#define msdc_clr_int() \
+- do { \
+- volatile u32 val = readl(host->base + MSDC_INT); \
+- writel(val, host->base + MSDC_INT); \
+- } while (0)
+-
+-static void msdc_clr_fifo(struct msdc_host *host)
+-{
+- sdr_set_bits(host->base + MSDC_FIFOCS, MSDC_FIFOCS_CLR);
+- while (readl(host->base + MSDC_FIFOCS) & MSDC_FIFOCS_CLR)
+- cpu_relax();
+-}
+-
+-#define msdc_irq_save(val) \
+- do { \
+- val = readl(host->base + MSDC_INTEN); \
+- sdr_clr_bits(host->base + MSDC_INTEN, val); \
+- } while (0)
+-
+-#define msdc_irq_restore(val) \
+- do { \
+- sdr_set_bits(host->base + MSDC_INTEN, val); \
+- } while (0)
+-
+-/* clock source for host: global */
+-#if defined(CONFIG_SOC_MT7620)
+-static u32 hclks[] = {48000000}; /* +/- by chhung */
+-#elif defined(CONFIG_SOC_MT7621)
+-static u32 hclks[] = {50000000}; /* +/- by chhung */
+-#endif
+-
+-//============================================
+-// the power for msdc host controller: global
+-// always keep the VMC on.
+-//============================================
+-#define msdc_vcore_on(host) \
+- do { \
+- INIT_MSG("[+]VMC ref. count<%d>", ++host->pwr_ref); \
+- (void)hwPowerOn(MT65XX_POWER_LDO_VMC, VOL_3300, "SD"); \
+- } while (0)
+-#define msdc_vcore_off(host) \
+- do { \
+- INIT_MSG("[-]VMC ref. count<%d>", --host->pwr_ref); \
+- (void)hwPowerDown(MT65XX_POWER_LDO_VMC, "SD"); \
+- } while (0)
+-
+-//====================================
+-// the vdd output for card: global
+-// always keep the VMCH on.
+-//====================================
+-#define msdc_vdd_on(host) \
+- do { \
+- (void)hwPowerOn(MT65XX_POWER_LDO_VMCH, VOL_3300, "SD"); \
+- } while (0)
+-#define msdc_vdd_off(host) \
+- do { \
+- (void)hwPowerDown(MT65XX_POWER_LDO_VMCH, "SD"); \
+- } while (0)
+-
+-#define sdc_is_busy() (readl(host->base + SDC_STS) & SDC_STS_SDCBUSY)
+-#define sdc_is_cmd_busy() (readl(host->base + SDC_STS) & SDC_STS_CMDBUSY)
+-
+-#define sdc_send_cmd(cmd, arg) \
+- do { \
+- writel((arg), host->base + SDC_ARG); \
+- writel((cmd), host->base + SDC_CMD); \
+- } while (0)
+-
+-/* +++ by chhung */
+-#ifndef __ASSEMBLY__
+-#define PHYSADDR(a) (((unsigned long)(a)) & 0x1fffffff)
+-#else
+-#define PHYSADDR(a) ((a) & 0x1fffffff)
+-#endif
+-/* end of +++ */
+-static unsigned int msdc_do_command(struct msdc_host *host,
+- struct mmc_command *cmd,
+- int tune,
+- unsigned long timeout);
+-
+-static int msdc_tune_cmdrsp(struct msdc_host *host, struct mmc_command *cmd);
+-
+-#ifdef MT6575_SD_DEBUG
+-static void msdc_dump_card_status(struct msdc_host *host, u32 status)
+-{
+-/* N_MSG is currently a no-op */
+-#if 0
+- static char *state[] = {
+- "Idle", /* 0 */
+- "Ready", /* 1 */
+- "Ident", /* 2 */
+- "Stby", /* 3 */
+- "Tran", /* 4 */
+- "Data", /* 5 */
+- "Rcv", /* 6 */
+- "Prg", /* 7 */
+- "Dis", /* 8 */
+- "Reserved", /* 9 */
+- "Reserved", /* 10 */
+- "Reserved", /* 11 */
+- "Reserved", /* 12 */
+- "Reserved", /* 13 */
+- "Reserved", /* 14 */
+- "I/O mode", /* 15 */
+- };
+-#endif
+- if (status & R1_OUT_OF_RANGE)
+- N_MSG(RSP, "[CARD_STATUS] Out of Range");
+- if (status & R1_ADDRESS_ERROR)
+- N_MSG(RSP, "[CARD_STATUS] Address Error");
+- if (status & R1_BLOCK_LEN_ERROR)
+- N_MSG(RSP, "[CARD_STATUS] Block Len Error");
+- if (status & R1_ERASE_SEQ_ERROR)
+- N_MSG(RSP, "[CARD_STATUS] Erase Seq Error");
+- if (status & R1_ERASE_PARAM)
+- N_MSG(RSP, "[CARD_STATUS] Erase Param");
+- if (status & R1_WP_VIOLATION)
+- N_MSG(RSP, "[CARD_STATUS] WP Violation");
+- if (status & R1_CARD_IS_LOCKED)
+- N_MSG(RSP, "[CARD_STATUS] Card is Locked");
+- if (status & R1_LOCK_UNLOCK_FAILED)
+- N_MSG(RSP, "[CARD_STATUS] Lock/Unlock Failed");
+- if (status & R1_COM_CRC_ERROR)
+- N_MSG(RSP, "[CARD_STATUS] Command CRC Error");
+- if (status & R1_ILLEGAL_COMMAND)
+- N_MSG(RSP, "[CARD_STATUS] Illegal Command");
+- if (status & R1_CARD_ECC_FAILED)
+- N_MSG(RSP, "[CARD_STATUS] Card ECC Failed");
+- if (status & R1_CC_ERROR)
+- N_MSG(RSP, "[CARD_STATUS] CC Error");
+- if (status & R1_ERROR)
+- N_MSG(RSP, "[CARD_STATUS] Error");
+- if (status & R1_UNDERRUN)
+- N_MSG(RSP, "[CARD_STATUS] Underrun");
+- if (status & R1_OVERRUN)
+- N_MSG(RSP, "[CARD_STATUS] Overrun");
+- if (status & R1_CID_CSD_OVERWRITE)
+- N_MSG(RSP, "[CARD_STATUS] CID/CSD Overwrite");
+- if (status & R1_WP_ERASE_SKIP)
+- N_MSG(RSP, "[CARD_STATUS] WP Eraser Skip");
+- if (status & R1_CARD_ECC_DISABLED)
+- N_MSG(RSP, "[CARD_STATUS] Card ECC Disabled");
+- if (status & R1_ERASE_RESET)
+- N_MSG(RSP, "[CARD_STATUS] Erase Reset");
+- if (status & R1_READY_FOR_DATA)
+- N_MSG(RSP, "[CARD_STATUS] Ready for Data");
+- if (status & R1_SWITCH_ERROR)
+- N_MSG(RSP, "[CARD_STATUS] Switch error");
+- if (status & R1_APP_CMD)
+- N_MSG(RSP, "[CARD_STATUS] App Command");
+-
+- N_MSG(RSP, "[CARD_STATUS] '%s' State", state[R1_CURRENT_STATE(status)]);
+-}
+-
+-static void msdc_dump_ocr_reg(struct msdc_host *host, u32 resp)
+-{
+- if (resp & (1 << 7))
+- N_MSG(RSP, "[OCR] Low Voltage Range");
+- if (resp & (1 << 15))
+- N_MSG(RSP, "[OCR] 2.7-2.8 volt");
+- if (resp & (1 << 16))
+- N_MSG(RSP, "[OCR] 2.8-2.9 volt");
+- if (resp & (1 << 17))
+- N_MSG(RSP, "[OCR] 2.9-3.0 volt");
+- if (resp & (1 << 18))
+- N_MSG(RSP, "[OCR] 3.0-3.1 volt");
+- if (resp & (1 << 19))
+- N_MSG(RSP, "[OCR] 3.1-3.2 volt");
+- if (resp & (1 << 20))
+- N_MSG(RSP, "[OCR] 3.2-3.3 volt");
+- if (resp & (1 << 21))
+- N_MSG(RSP, "[OCR] 3.3-3.4 volt");
+- if (resp & (1 << 22))
+- N_MSG(RSP, "[OCR] 3.4-3.5 volt");
+- if (resp & (1 << 23))
+- N_MSG(RSP, "[OCR] 3.5-3.6 volt");
+- if (resp & (1 << 24))
+- N_MSG(RSP, "[OCR] Switching to 1.8V Accepted (S18A)");
+- if (resp & (1 << 30))
+- N_MSG(RSP, "[OCR] Card Capacity Status (CCS)");
+- if (resp & (1 << 31))
+- N_MSG(RSP, "[OCR] Card Power Up Status (Idle)");
+- else
+- N_MSG(RSP, "[OCR] Card Power Up Status (Busy)");
+-}
+-
+-static void msdc_dump_rca_resp(struct msdc_host *host, u32 resp)
+-{
+- u32 status = (((resp >> 15) & 0x1) << 23) |
+- (((resp >> 14) & 0x1) << 22) |
+- (((resp >> 13) & 0x1) << 19) |
+- (resp & 0x1fff);
+-
+- N_MSG(RSP, "[RCA] 0x%.4x", resp >> 16);
+- msdc_dump_card_status(host, status);
+-}
+-
+-static void msdc_dump_io_resp(struct msdc_host *host, u32 resp)
+-{
+- u32 flags = (resp >> 8) & 0xFF;
+-#if 0
+- char *state[] = {"DIS", "CMD", "TRN", "RFU"};
+-#endif
+- if (flags & (1 << 7))
+- N_MSG(RSP, "[IO] COM_CRC_ERR");
+- if (flags & (1 << 6))
+- N_MSG(RSP, "[IO] Illegal command");
+- if (flags & (1 << 3))
+- N_MSG(RSP, "[IO] Error");
+- if (flags & (1 << 2))
+- N_MSG(RSP, "[IO] RFU");
+- if (flags & (1 << 1))
+- N_MSG(RSP, "[IO] Function number error");
+- if (flags & (1 << 0))
+- N_MSG(RSP, "[IO] Out of range");
+-
+- N_MSG(RSP, "[IO] State: %s, Data:0x%x", state[(resp >> 12) & 0x3], resp & 0xFF);
+-}
+-#endif
+-
+-static void msdc_set_timeout(struct msdc_host *host, u32 ns, u32 clks)
+-{
+- u32 timeout, clk_ns;
+-
+- host->timeout_ns = ns;
+- host->timeout_clks = clks;
+-
+- clk_ns = 1000000000UL / host->sclk;
+- timeout = ns / clk_ns + clks;
+- timeout = timeout >> 16; /* in 65536 sclk cycle unit */
+- timeout = timeout > 1 ? timeout - 1 : 0;
+- timeout = timeout > 255 ? 255 : timeout;
+-
+- sdr_set_field(host->base + SDC_CFG, SDC_CFG_DTOC, timeout);
+-
+- N_MSG(OPS, "Set read data timeout: %dns %dclks -> %d x 65536 cycles",
+- ns, clks, timeout + 1);
+-}
+-
+-static void msdc_tasklet_card(struct work_struct *work)
+-{
+- struct msdc_host *host = (struct msdc_host *)container_of(work,
+- struct msdc_host, card_delaywork.work);
+- u32 inserted;
+- u32 status = 0;
+- //u32 change = 0;
+-
+- spin_lock(&host->lock);
+-
+- status = readl(host->base + MSDC_PS);
+- if (cd_active_low)
+- inserted = (status & MSDC_PS_CDSTS) ? 0 : 1;
+- else
+- inserted = (status & MSDC_PS_CDSTS) ? 1 : 0;
+-
+-#if 0
+- change = host->card_inserted ^ inserted;
+- host->card_inserted = inserted;
+-
+- if (change && !host->suspend) {
+- if (inserted)
+- host->mmc->f_max = HOST_MAX_MCLK; // work around
+- mmc_detect_change(host->mmc, msecs_to_jiffies(20));
+- }
+-#else /* Make sure: handle the last interrupt */
+- host->card_inserted = inserted;
+-
+- if (!host->suspend) {
+- host->mmc->f_max = HOST_MAX_MCLK;
+- mmc_detect_change(host->mmc, msecs_to_jiffies(20));
+- }
+-
+- IRQ_MSG("card found<%s>", inserted ? "inserted" : "removed");
+-#endif
+-
+- spin_unlock(&host->lock);
+-}
+-
+-#if 0 /* --- by chhung */
+-/* For E2 only */
+-static u8 clk_src_bit[4] = {
+- 0, 3, 5, 7
+-};
+-
+-static void msdc_select_clksrc(struct msdc_host *host, unsigned char clksrc)
+-{
+- u32 val;
+-
+- BUG_ON(clksrc > 3);
+- INIT_MSG("set clock source to <%d>", clksrc);
+-
+- val = readl(host->base + MSDC_CLKSRC_REG);
+- if (readl(host->base + MSDC_ECO_VER) >= 4) {
+- val &= ~(0x3 << clk_src_bit[host->id]);
+- val |= clksrc << clk_src_bit[host->id];
+- } else {
+- val &= ~0x3; val |= clksrc;
+- }
+- writel(val, host->base + MSDC_CLKSRC_REG);
+-
+- host->hclk = hclks[clksrc];
+- host->hw->clk_src = clksrc;
+-}
+-#endif /* end of --- */
+-
+-static void msdc_set_mclk(struct msdc_host *host, int ddr, unsigned int hz)
+-{
+- //struct msdc_hw *hw = host->hw;
+- u32 mode;
+- u32 flags;
+- u32 div;
+- u32 sclk;
+- u32 hclk = host->hclk;
+- //u8 clksrc = hw->clk_src;
+-
+- if (!hz) { // set mmc system clock to 0 ?
+- //ERR_MSG("set mclk to 0!!!");
+- msdc_reset_hw(host);
+- return;
+- }
+-
+- msdc_irq_save(flags);
+-
+- if (ddr) {
+- mode = 0x2; /* ddr mode and use divisor */
+- if (hz >= (hclk >> 2)) {
+- div = 1; /* mean div = 1/4 */
+- sclk = hclk >> 2; /* sclk = clk / 4 */
+- } else {
+- div = (hclk + ((hz << 2) - 1)) / (hz << 2);
+- sclk = (hclk >> 2) / div;
+- }
+- } else if (hz >= hclk) { /* bug fix */
+- mode = 0x1; /* no divisor and divisor is ignored */
+- div = 0;
+- sclk = hclk;
+- } else {
+- mode = 0x0; /* use divisor */
+- if (hz >= (hclk >> 1)) {
+- div = 0; /* mean div = 1/2 */
+- sclk = hclk >> 1; /* sclk = clk / 2 */
+- } else {
+- div = (hclk + ((hz << 2) - 1)) / (hz << 2);
+- sclk = (hclk >> 2) / div;
+- }
+- }
+-
+- /* set clock mode and divisor */
+- sdr_set_field(host->base + MSDC_CFG, MSDC_CFG_CKMOD, mode);
+- sdr_set_field(host->base + MSDC_CFG, MSDC_CFG_CKDIV, div);
+-
+- /* wait clock stable */
+- while (!(readl(host->base + MSDC_CFG) & MSDC_CFG_CKSTB))
+- cpu_relax();
+-
+- host->sclk = sclk;
+- host->mclk = hz;
+- msdc_set_timeout(host, host->timeout_ns, host->timeout_clks); // need?
+-
+- INIT_MSG("================");
+- INIT_MSG("!!! Set<%dKHz> Source<%dKHz> -> sclk<%dKHz>", hz / 1000, hclk / 1000, sclk / 1000);
+- INIT_MSG("================");
+-
+- msdc_irq_restore(flags);
+-}
+-
+-/* Fix me. when need to abort */
+-static void msdc_abort_data(struct msdc_host *host)
+-{
+- struct mmc_command *stop = host->mrq->stop;
+-
+- ERR_MSG("Need to Abort.");
+-
+- msdc_reset_hw(host);
+- msdc_clr_fifo(host);
+- msdc_clr_int();
+-
+- // need to check FIFO count 0 ?
+-
+- if (stop) { /* try to stop, but may not success */
+- ERR_MSG("stop when abort CMD<%d>", stop->opcode);
+- (void)msdc_do_command(host, stop, 0, CMD_TIMEOUT);
+- }
+-
+- //if (host->mclk >= 25000000) {
+- // msdc_set_mclk(host, 0, host->mclk >> 1);
+- //}
+-}
+-
+-#if 0 /* --- by chhung */
+-static void msdc_pin_config(struct msdc_host *host, int mode)
+-{
+- struct msdc_hw *hw = host->hw;
+- int pull = (mode == MSDC_PIN_PULL_UP) ? GPIO_PULL_UP : GPIO_PULL_DOWN;
+-
+- /* Config WP pin */
+- if (hw->flags & MSDC_WP_PIN_EN) {
+- if (hw->config_gpio_pin) /* NULL */
+- hw->config_gpio_pin(MSDC_WP_PIN, pull);
+- }
+-
+- switch (mode) {
+- case MSDC_PIN_PULL_UP:
+- //sdr_set_field(MSDC_PAD_CTL0, MSDC_PAD_CTL0_CLKPU, 1); /* Check & FIXME */
+- //sdr_set_field(MSDC_PAD_CTL0, MSDC_PAD_CTL0_CLKPD, 0); /* Check & FIXME */
+- sdr_set_field(host->base + MSDC_PAD_CTL1, MSDC_PAD_CTL1_CMDPU, 1);
+- sdr_set_field(host->base + MSDC_PAD_CTL1, MSDC_PAD_CTL1_CMDPD, 0);
+- sdr_set_field(host->base + MSDC_PAD_CTL2, MSDC_PAD_CTL2_DATPU, 1);
+- sdr_set_field(host->base + MSDC_PAD_CTL2, MSDC_PAD_CTL2_DATPD, 0);
+- break;
+- case MSDC_PIN_PULL_DOWN:
+- //sdr_set_field(MSDC_PAD_CTL0, MSDC_PAD_CTL0_CLKPU, 0); /* Check & FIXME */
+- //sdr_set_field(MSDC_PAD_CTL0, MSDC_PAD_CTL0_CLKPD, 1); /* Check & FIXME */
+- sdr_set_field(host->base + MSDC_PAD_CTL1, MSDC_PAD_CTL1_CMDPU, 0);
+- sdr_set_field(host->base + MSDC_PAD_CTL1, MSDC_PAD_CTL1_CMDPD, 1);
+- sdr_set_field(host->base + MSDC_PAD_CTL2, MSDC_PAD_CTL2_DATPU, 0);
+- sdr_set_field(host->base + MSDC_PAD_CTL2, MSDC_PAD_CTL2_DATPD, 1);
+- break;
+- case MSDC_PIN_PULL_NONE:
+- default:
+- //sdr_set_field(MSDC_PAD_CTL0, MSDC_PAD_CTL0_CLKPU, 0); /* Check & FIXME */
+- //sdr_set_field(MSDC_PAD_CTL0, MSDC_PAD_CTL0_CLKPD, 0); /* Check & FIXME */
+- sdr_set_field(host->base + MSDC_PAD_CTL1, MSDC_PAD_CTL1_CMDPU, 0);
+- sdr_set_field(host->base + MSDC_PAD_CTL1, MSDC_PAD_CTL1_CMDPD, 0);
+- sdr_set_field(host->base + MSDC_PAD_CTL2, MSDC_PAD_CTL2_DATPU, 0);
+- sdr_set_field(host->base + MSDC_PAD_CTL2, MSDC_PAD_CTL2_DATPD, 0);
+- break;
+- }
+-
+- N_MSG(CFG, "Pins mode(%d), down(%d), up(%d)",
+- mode, MSDC_PIN_PULL_DOWN, MSDC_PIN_PULL_UP);
+-}
+-
+-void msdc_pin_reset(struct msdc_host *host, int mode)
+-{
+- struct msdc_hw *hw = (struct msdc_hw *)host->hw;
+- int pull = (mode == MSDC_PIN_PULL_UP) ? GPIO_PULL_UP : GPIO_PULL_DOWN;
+-
+- /* Config reset pin */
+- if (hw->flags & MSDC_RST_PIN_EN) {
+- if (hw->config_gpio_pin) /* NULL */
+- hw->config_gpio_pin(MSDC_RST_PIN, pull);
+-
+- if (mode == MSDC_PIN_PULL_UP)
+- sdr_clr_bits(host->base + EMMC_IOCON, EMMC_IOCON_BOOTRST);
+- else
+- sdr_set_bits(host->base + EMMC_IOCON, EMMC_IOCON_BOOTRST);
+- }
+-}
+-
+-static void msdc_core_power(struct msdc_host *host, int on)
+-{
+- N_MSG(CFG, "Turn %s %s power (copower: %d -> %d)",
+- on ? "on" : "off", "core", host->core_power, on);
+-
+- if (on && host->core_power == 0) {
+- msdc_vcore_on(host);
+- host->core_power = 1;
+- msleep(1);
+- } else if (!on && host->core_power == 1) {
+- msdc_vcore_off(host);
+- host->core_power = 0;
+- msleep(1);
+- }
+-}
+-
+-static void msdc_host_power(struct msdc_host *host, int on)
+-{
+- N_MSG(CFG, "Turn %s %s power ", on ? "on" : "off", "host");
+-
+- if (on) {
+- //msdc_core_power(host, 1); // need do card detection.
+- msdc_pin_reset(host, MSDC_PIN_PULL_UP);
+- } else {
+- msdc_pin_reset(host, MSDC_PIN_PULL_DOWN);
+- //msdc_core_power(host, 0);
+- }
+-}
+-
+-static void msdc_card_power(struct msdc_host *host, int on)
+-{
+- N_MSG(CFG, "Turn %s %s power ", on ? "on" : "off", "card");
+-
+- if (on) {
+- msdc_pin_config(host, MSDC_PIN_PULL_UP);
+- //msdc_vdd_on(host); // need todo card detection.
+- msleep(1);
+- } else {
+- //msdc_vdd_off(host);
+- msdc_pin_config(host, MSDC_PIN_PULL_DOWN);
+- msleep(1);
+- }
+-}
+-
+-static void msdc_set_power_mode(struct msdc_host *host, u8 mode)
+-{
+- N_MSG(CFG, "Set power mode(%d)", mode);
+-
+- if (host->power_mode == MMC_POWER_OFF && mode != MMC_POWER_OFF) {
+- msdc_host_power(host, 1);
+- msdc_card_power(host, 1);
+- } else if (host->power_mode != MMC_POWER_OFF && mode == MMC_POWER_OFF) {
+- msdc_card_power(host, 0);
+- msdc_host_power(host, 0);
+- }
+- host->power_mode = mode;
+-}
+-#endif /* end of --- */
+-
+-#ifdef CONFIG_PM
+-/*
+- register as callback function of WIFI(combo_sdio_register_pm) .
+- can called by msdc_drv_suspend/resume too.
+-*/
+-static void msdc_pm(pm_message_t state, void *data)
+-{
+- struct msdc_host *host = (struct msdc_host *)data;
+- int evt = state.event;
+-
+- if (evt == PM_EVENT_USER_RESUME || evt == PM_EVENT_USER_SUSPEND) {
+- INIT_MSG("USR_%s: suspend<%d> power<%d>",
+- evt == PM_EVENT_USER_RESUME ? "EVENT_USER_RESUME" : "EVENT_USER_SUSPEND",
+- host->suspend, host->power_mode);
+- }
+-
+- if (evt == PM_EVENT_SUSPEND || evt == PM_EVENT_USER_SUSPEND) {
+- if (host->suspend) /* already suspend */ /* default 0*/
+- return;
+-
+- /* for memory card. already power off by mmc */
+- if (evt == PM_EVENT_SUSPEND && host->power_mode == MMC_POWER_OFF)
+- return;
+-
+- host->suspend = 1;
+- host->pm_state = state; /* default PMSG_RESUME */
+-
+- } else if (evt == PM_EVENT_RESUME || evt == PM_EVENT_USER_RESUME) {
+- if (!host->suspend) {
+- //ERR_MSG("warning: already resume");
+- return;
+- }
+-
+- /* No PM resume when USR suspend */
+- if (evt == PM_EVENT_RESUME && host->pm_state.event == PM_EVENT_USER_SUSPEND) {
+- ERR_MSG("PM Resume when in USR Suspend"); /* won't happen. */
+- return;
+- }
+-
+- host->suspend = 0;
+- host->pm_state = state;
+-
+- }
+-}
+-#endif
+-
+-static inline u32 msdc_cmd_find_resp(struct mmc_command *cmd)
+-{
+- u32 opcode = cmd->opcode;
+- u32 resp;
+-
+- if (opcode == MMC_SET_RELATIVE_ADDR) {
+- resp = (mmc_cmd_type(cmd) == MMC_CMD_BCR) ? RESP_R6 : RESP_R1;
+- } else if (opcode == MMC_FAST_IO) {
+- resp = RESP_R4;
+- } else if (opcode == MMC_GO_IRQ_STATE) {
+- resp = RESP_R5;
+- } else if (opcode == MMC_SELECT_CARD) {
+- resp = (cmd->arg != 0) ? RESP_R1B : RESP_NONE;
+- } else if (opcode == SD_IO_RW_DIRECT || opcode == SD_IO_RW_EXTENDED) {
+- resp = RESP_R1; /* SDIO workaround. */
+- } else if (opcode == SD_SEND_IF_COND && (mmc_cmd_type(cmd) == MMC_CMD_BCR)) {
+- resp = RESP_R1;
+- } else {
+- switch (mmc_resp_type(cmd)) {
+- case MMC_RSP_R1:
+- resp = RESP_R1;
+- break;
+- case MMC_RSP_R1B:
+- resp = RESP_R1B;
+- break;
+- case MMC_RSP_R2:
+- resp = RESP_R2;
+- break;
+- case MMC_RSP_R3:
+- resp = RESP_R3;
+- break;
+- case MMC_RSP_NONE:
+- default:
+- resp = RESP_NONE;
+- break;
+- }
+- }
+-
+- return resp;
+-}
+-
+-/*--------------------------------------------------------------------------*/
+-/* mmc_host_ops members */
+-/*--------------------------------------------------------------------------*/
+-static unsigned int msdc_command_start(struct msdc_host *host,
+- struct mmc_command *cmd,
+- unsigned long timeout)
+-{
+- u32 opcode = cmd->opcode;
+- u32 rawcmd;
+- u32 wints = MSDC_INT_CMDRDY | MSDC_INT_RSPCRCERR | MSDC_INT_CMDTMO |
+- MSDC_INT_ACMDRDY | MSDC_INT_ACMDCRCERR | MSDC_INT_ACMDTMO |
+- MSDC_INT_ACMD19_DONE;
+-
+- u32 resp;
+- unsigned long tmo;
+-
+- /* Protocol layer does not provide response type, but our hardware needs
+- * to know exact type, not just size!
+- */
+- resp = msdc_cmd_find_resp(cmd);
+-
+- cmd->error = 0;
+- /* rawcmd :
+- * vol_swt << 30 | auto_cmd << 28 | blklen << 16 | go_irq << 15 |
+- * stop << 14 | rw << 13 | dtype << 11 | rsptyp << 7 | brk << 6 | opcode
+- */
+- rawcmd = opcode | msdc_rsp[resp] << 7 | host->blksz << 16;
+-
+- if (opcode == MMC_READ_MULTIPLE_BLOCK) {
+- rawcmd |= (2 << 11);
+- } else if (opcode == MMC_READ_SINGLE_BLOCK) {
+- rawcmd |= (1 << 11);
+- } else if (opcode == MMC_WRITE_MULTIPLE_BLOCK) {
+- rawcmd |= ((2 << 11) | (1 << 13));
+- } else if (opcode == MMC_WRITE_BLOCK) {
+- rawcmd |= ((1 << 11) | (1 << 13));
+- } else if (opcode == SD_IO_RW_EXTENDED) {
+- if (cmd->data->flags & MMC_DATA_WRITE)
+- rawcmd |= (1 << 13);
+- if (cmd->data->blocks > 1)
+- rawcmd |= (2 << 11);
+- else
+- rawcmd |= (1 << 11);
+- } else if (opcode == SD_IO_RW_DIRECT && cmd->flags == (unsigned int)-1) {
+- rawcmd |= (1 << 14);
+- } else if ((opcode == SD_APP_SEND_SCR) ||
+- (opcode == SD_APP_SEND_NUM_WR_BLKS) ||
+- (opcode == SD_SWITCH && (mmc_cmd_type(cmd) == MMC_CMD_ADTC)) ||
+- (opcode == SD_APP_SD_STATUS && (mmc_cmd_type(cmd) == MMC_CMD_ADTC)) ||
+- (opcode == MMC_SEND_EXT_CSD && (mmc_cmd_type(cmd) == MMC_CMD_ADTC))) {
+- rawcmd |= (1 << 11);
+- } else if (opcode == MMC_STOP_TRANSMISSION) {
+- rawcmd |= (1 << 14);
+- rawcmd &= ~(0x0FFF << 16);
+- }
+-
+- N_MSG(CMD, "CMD<%d><0x%.8x> Arg<0x%.8x>", opcode, rawcmd, cmd->arg);
+-
+- tmo = jiffies + timeout;
+-
+- if (opcode == MMC_SEND_STATUS) {
+- for (;;) {
+- if (!sdc_is_cmd_busy())
+- break;
+-
+- if (time_after(jiffies, tmo)) {
+- ERR_MSG("XXX cmd_busy timeout: before CMD<%d>", opcode);
+- cmd->error = -ETIMEDOUT;
+- msdc_reset_hw(host);
+- goto end;
+- }
+- }
+- } else {
+- for (;;) {
+- if (!sdc_is_busy())
+- break;
+- if (time_after(jiffies, tmo)) {
+- ERR_MSG("XXX sdc_busy timeout: before CMD<%d>", opcode);
+- cmd->error = -ETIMEDOUT;
+- msdc_reset_hw(host);
+- goto end;
+- }
+- }
+- }
+-
+- //BUG_ON(in_interrupt());
+- host->cmd = cmd;
+- host->cmd_rsp = resp;
+-
+- init_completion(&host->cmd_done);
+-
+- sdr_set_bits(host->base + MSDC_INTEN, wints);
+- sdc_send_cmd(rawcmd, cmd->arg);
+-
+-end:
+- return cmd->error;
+-}
+-
+-static unsigned int msdc_command_resp(struct msdc_host *host,
+- struct mmc_command *cmd,
+- int tune,
+- unsigned long timeout)
+- __must_hold(&host->lock)
+-{
+- u32 opcode = cmd->opcode;
+- //u32 rawcmd;
+- u32 wints = MSDC_INT_CMDRDY | MSDC_INT_RSPCRCERR | MSDC_INT_CMDTMO |
+- MSDC_INT_ACMDRDY | MSDC_INT_ACMDCRCERR | MSDC_INT_ACMDTMO |
+- MSDC_INT_ACMD19_DONE;
+-
+- BUG_ON(in_interrupt());
+- //init_completion(&host->cmd_done);
+- //sdr_set_bits(host->base + MSDC_INTEN, wints);
+-
+- spin_unlock(&host->lock);
+- if (!wait_for_completion_timeout(&host->cmd_done, 10 * timeout)) {
+- ERR_MSG("XXX CMD<%d> wait_for_completion timeout ARG<0x%.8x>", opcode, cmd->arg);
+- cmd->error = -ETIMEDOUT;
+- msdc_reset_hw(host);
+- }
+- spin_lock(&host->lock);
+-
+- sdr_clr_bits(host->base + MSDC_INTEN, wints);
+- host->cmd = NULL;
+-
+-//end:
+-#ifdef MT6575_SD_DEBUG
+- switch (resp) {
+- case RESP_NONE:
+- N_MSG(RSP, "CMD_RSP(%d): %d RSP(%d)", opcode, cmd->error, resp);
+- break;
+- case RESP_R2:
+- N_MSG(RSP, "CMD_RSP(%d): %d RSP(%d)= %.8x %.8x %.8x %.8x",
+- opcode, cmd->error, resp, cmd->resp[0], cmd->resp[1],
+- cmd->resp[2], cmd->resp[3]);
+- break;
+- default: /* Response types 1, 3, 4, 5, 6, 7(1b) */
+- N_MSG(RSP, "CMD_RSP(%d): %d RSP(%d)= 0x%.8x",
+- opcode, cmd->error, resp, cmd->resp[0]);
+- if (cmd->error == 0) {
+- switch (resp) {
+- case RESP_R1:
+- case RESP_R1B:
+- msdc_dump_card_status(host, cmd->resp[0]);
+- break;
+- case RESP_R3:
+- msdc_dump_ocr_reg(host, cmd->resp[0]);
+- break;
+- case RESP_R5:
+- msdc_dump_io_resp(host, cmd->resp[0]);
+- break;
+- case RESP_R6:
+- msdc_dump_rca_resp(host, cmd->resp[0]);
+- break;
+- }
+- }
+- break;
+- }
+-#endif
+-
+- /* do we need to save card's RCA when SD_SEND_RELATIVE_ADDR */
+-
+- if (!tune)
+- return cmd->error;
+-
+- /* memory card CRC */
+- if (host->hw->flags & MSDC_REMOVABLE && cmd->error == -EIO) {
+- /* check if has data phase */
+- if (readl(host->base + SDC_CMD) & 0x1800) {
+- msdc_abort_data(host);
+- } else {
+- /* do basic: reset*/
+- msdc_reset_hw(host);
+- msdc_clr_fifo(host);
+- msdc_clr_int();
+- }
+- cmd->error = msdc_tune_cmdrsp(host, cmd);
+- }
+-
+- // check DAT0
+- /* if (resp == RESP_R1B) {
+- while ((readl(host->base + MSDC_PS) & 0x10000) != 0x10000);
+- } */
+- /* CMD12 Error Handle */
+-
+- return cmd->error;
+-}
+-
+-static unsigned int msdc_do_command(struct msdc_host *host,
+- struct mmc_command *cmd,
+- int tune,
+- unsigned long timeout)
+-{
+- if (msdc_command_start(host, cmd, timeout))
+- goto end;
+-
+- if (msdc_command_resp(host, cmd, tune, timeout))
+- goto end;
+-
+-end:
+-
+- N_MSG(CMD, " return<%d> resp<0x%.8x>", cmd->error, cmd->resp[0]);
+- return cmd->error;
+-}
+-
+-#if 0 /* --- by chhung */
+-// DMA resume / start / stop
+-static void msdc_dma_resume(struct msdc_host *host)
+-{
+- sdr_set_field(host->base + MSDC_DMA_CTRL, MSDC_DMA_CTRL_RESUME, 1);
+-
+- N_MSG(DMA, "DMA resume");
+-}
+-#endif /* end of --- */
+-
+-static void msdc_dma_start(struct msdc_host *host)
+-{
+- u32 wints = MSDC_INTEN_XFER_COMPL | MSDC_INTEN_DATTMO | MSDC_INTEN_DATCRCERR;
+-
+- sdr_set_bits(host->base + MSDC_INTEN, wints);
+- //dsb(); /* --- by chhung */
+- sdr_set_field(host->base + MSDC_DMA_CTRL, MSDC_DMA_CTRL_START, 1);
+-
+- N_MSG(DMA, "DMA start");
+-}
+-
+-static void msdc_dma_stop(struct msdc_host *host)
+-{
+- //u32 retries=500;
+- u32 wints = MSDC_INTEN_XFER_COMPL | MSDC_INTEN_DATTMO | MSDC_INTEN_DATCRCERR;
+-
+- N_MSG(DMA, "DMA status: 0x%.8x", readl(host->base + MSDC_DMA_CFG));
+- //while (readl(host->base + MSDC_DMA_CFG) & MSDC_DMA_CFG_STS);
+-
+- sdr_set_field(host->base + MSDC_DMA_CTRL, MSDC_DMA_CTRL_STOP, 1);
+- while (readl(host->base + MSDC_DMA_CFG) & MSDC_DMA_CFG_STS)
+- ;
+-
+- //dsb(); /* --- by chhung */
+- sdr_clr_bits(host->base + MSDC_INTEN, wints); /* Not just xfer_comp */
+-
+- N_MSG(DMA, "DMA stop");
+-}
+-
+-/* calc checksum */
+-static u8 msdc_dma_calcs(u8 *buf, u32 len)
+-{
+- u32 i, sum = 0;
+-
+- for (i = 0; i < len; i++)
+- sum += buf[i];
+- return 0xFF - (u8)sum;
+-}
+-
+-static void msdc_dma_setup(struct msdc_host *host, struct msdc_dma *dma,
+- struct scatterlist *sg_cmd, unsigned int sglen)
+-{
+- struct scatterlist *sg;
+- struct gpd *gpd;
+- struct bd *bd;
+- u32 j;
+-
+- BUG_ON(sglen > MAX_BD_NUM); /* not support currently */
+-
+- N_MSG(DMA, "DMA sglen<%d> xfersz<%d>", sglen, host->xfer_size);
+-
+- gpd = dma->gpd;
+- bd = dma->bd;
+-
+- /* modify gpd*/
+- //gpd->intr = 0;
+- gpd->hwo = 1; /* hw will clear it */
+- gpd->bdp = 1;
+- gpd->chksum = 0; /* need to clear first. */
+- gpd->chksum = msdc_dma_calcs((u8 *)gpd, 16);
+-
+- /* modify bd*/
+- for_each_sg(sg_cmd, sg, sglen, j) {
+- bd[j].blkpad = 0;
+- bd[j].dwpad = 0;
+- bd[j].ptr = (void *)sg_dma_address(sg);
+- bd[j].buflen = sg_dma_len(sg);
+-
+- if (j == sglen - 1)
+- bd[j].eol = 1; /* the last bd */
+- else
+- bd[j].eol = 0;
+-
+- bd[j].chksum = 0; /* checksume need to clear first */
+- bd[j].chksum = msdc_dma_calcs((u8 *)(&bd[j]), 16);
+- }
+-
+- sdr_set_field(host->base + MSDC_DMA_CFG, MSDC_DMA_CFG_DECSEN, 1);
+- sdr_set_field(host->base + MSDC_DMA_CTRL, MSDC_DMA_CTRL_BRUSTSZ,
+- MSDC_BRUST_64B);
+- sdr_set_field(host->base + MSDC_DMA_CTRL, MSDC_DMA_CTRL_MODE, 1);
+-
+- writel(PHYSADDR((u32)dma->gpd_addr), host->base + MSDC_DMA_SA);
+-
+- N_MSG(DMA, "DMA_CTRL = 0x%x", readl(host->base + MSDC_DMA_CTRL));
+- N_MSG(DMA, "DMA_CFG = 0x%x", readl(host->base + MSDC_DMA_CFG));
+- N_MSG(DMA, "DMA_SA = 0x%x", readl(host->base + MSDC_DMA_SA));
+-}
+-
+-static int msdc_do_request(struct mmc_host *mmc, struct mmc_request *mrq)
+- __must_hold(&host->lock)
+-{
+- struct msdc_host *host = mmc_priv(mmc);
+- struct mmc_command *cmd;
+- struct mmc_data *data;
+- //u32 intsts = 0;
+- int read = 1, send_type = 0;
+-
+-#define SND_DAT 0
+-#define SND_CMD 1
+-
+- BUG_ON(mmc == NULL);
+- BUG_ON(mrq == NULL);
+-
+- host->error = 0;
+-
+- cmd = mrq->cmd;
+- data = mrq->cmd->data;
+-
+-#if 0 /* --- by chhung */
+- //if(host->id ==1){
+- N_MSG(OPS, "enable clock!");
+- msdc_ungate_clock(host->id);
+- //}
+-#endif /* end of --- */
+-
+- if (!data) {
+- send_type = SND_CMD;
+- if (msdc_do_command(host, cmd, 1, CMD_TIMEOUT) != 0)
+- goto done;
+- } else {
+- BUG_ON(data->blksz > HOST_MAX_BLKSZ);
+- send_type = SND_DAT;
+-
+- data->error = 0;
+- read = data->flags & MMC_DATA_READ ? 1 : 0;
+- host->data = data;
+- host->xfer_size = data->blocks * data->blksz;
+- host->blksz = data->blksz;
+-
+- if (read) {
+- if ((host->timeout_ns != data->timeout_ns) ||
+- (host->timeout_clks != data->timeout_clks)) {
+- msdc_set_timeout(host, data->timeout_ns, data->timeout_clks);
+- }
+- }
+-
+- writel(data->blocks, host->base + SDC_BLK_NUM);
+- //msdc_clr_fifo(host); /* no need */
+-
+- msdc_dma_on(); /* enable DMA mode first!! */
+- init_completion(&host->xfer_done);
+-
+- /* start the command first*/
+- if (msdc_command_start(host, cmd, CMD_TIMEOUT) != 0)
+- goto done;
+-
+- data->sg_count = dma_map_sg(mmc_dev(mmc), data->sg,
+- data->sg_len,
+- mmc_get_dma_dir(data));
+- msdc_dma_setup(host, &host->dma, data->sg,
+- data->sg_count);
+-
+- /* then wait command done */
+- if (msdc_command_resp(host, cmd, 1, CMD_TIMEOUT) != 0)
+- goto done;
+-
+- /* for read, the data coming too fast, then CRC error
+- start DMA no business with CRC. */
+- //init_completion(&host->xfer_done);
+- msdc_dma_start(host);
+-
+- spin_unlock(&host->lock);
+- if (!wait_for_completion_timeout(&host->xfer_done, DAT_TIMEOUT)) {
+- ERR_MSG("XXX CMD<%d> wait xfer_done<%d> timeout!!", cmd->opcode, data->blocks * data->blksz);
+- ERR_MSG(" DMA_SA = 0x%x",
+- readl(host->base + MSDC_DMA_SA));
+- ERR_MSG(" DMA_CA = 0x%x",
+- readl(host->base + MSDC_DMA_CA));
+- ERR_MSG(" DMA_CTRL = 0x%x",
+- readl(host->base + MSDC_DMA_CTRL));
+- ERR_MSG(" DMA_CFG = 0x%x",
+- readl(host->base + MSDC_DMA_CFG));
+- data->error = -ETIMEDOUT;
+-
+- msdc_reset_hw(host);
+- msdc_clr_fifo(host);
+- msdc_clr_int();
+- }
+- spin_lock(&host->lock);
+- msdc_dma_stop(host);
+-
+- /* Last: stop transfer */
+- if (data->stop) {
+- if (msdc_do_command(host, data->stop, 0, CMD_TIMEOUT) != 0)
+- goto done;
+- }
+- }
+-
+-done:
+- if (data != NULL) {
+- host->data = NULL;
+- dma_unmap_sg(mmc_dev(mmc), data->sg, data->sg_len,
+- mmc_get_dma_dir(data));
+- host->blksz = 0;
+-
+-#if 0 // don't stop twice!
+- if (host->hw->flags & MSDC_REMOVABLE && data->error) {
+- msdc_abort_data(host);
+- /* reset in IRQ, stop command has issued. -> No need */
+- }
+-#endif
+-
+- N_MSG(OPS, "CMD<%d> data<%s %s> blksz<%d> block<%d> error<%d>", cmd->opcode, (dma ? "dma" : "pio"),
+- (read ? "read " : "write"), data->blksz, data->blocks, data->error);
+- }
+-
+-#if 0 /* --- by chhung */
+-#if 1
+- //if(host->id==1) {
+- if (send_type == SND_CMD) {
+- if (cmd->opcode == MMC_SEND_STATUS) {
+- if ((cmd->resp[0] & CARD_READY_FOR_DATA) || (CARD_CURRENT_STATE(cmd->resp[0]) != 7)) {
+- N_MSG(OPS, "disable clock, CMD13 IDLE");
+- msdc_gate_clock(host->id);
+- }
+- } else {
+- N_MSG(OPS, "disable clock, CMD<%d>", cmd->opcode);
+- msdc_gate_clock(host->id);
+- }
+- } else {
+- if (read) {
+- N_MSG(OPS, "disable clock!!! Read CMD<%d>", cmd->opcode);
+- msdc_gate_clock(host->id);
+- }
+- }
+- //}
+-#else
+- msdc_gate_clock(host->id);
+-#endif
+-#endif /* end of --- */
+-
+- if (mrq->cmd->error)
+- host->error = 0x001;
+- if (mrq->data && mrq->data->error)
+- host->error |= 0x010;
+- if (mrq->stop && mrq->stop->error)
+- host->error |= 0x100;
+-
+- //if (host->error) ERR_MSG("host->error<%d>", host->error);
+-
+- return host->error;
+-}
+-
+-static int msdc_app_cmd(struct mmc_host *mmc, struct msdc_host *host)
+-{
+- struct mmc_command cmd;
+- struct mmc_request mrq;
+- u32 err;
+-
+- memset(&cmd, 0, sizeof(struct mmc_command));
+- cmd.opcode = MMC_APP_CMD;
+-#if 0 /* bug: we meet mmc->card is null when ACMD6 */
+- cmd.arg = mmc->card->rca << 16;
+-#else
+- cmd.arg = host->app_cmd_arg;
+-#endif
+- cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_AC;
+-
+- memset(&mrq, 0, sizeof(struct mmc_request));
+- mrq.cmd = &cmd; cmd.mrq = &mrq;
+- cmd.data = NULL;
+-
+- err = msdc_do_command(host, &cmd, 0, CMD_TIMEOUT);
+- return err;
+-}
+-
+-static int msdc_tune_cmdrsp(struct msdc_host *host, struct mmc_command *cmd)
+-{
+- int result = -1;
+- u32 rsmpl, cur_rsmpl, orig_rsmpl;
+- u32 rrdly, cur_rrdly = 0xffffffff, orig_rrdly;
+- u32 skip = 1;
+-
+- /* ==== don't support 3.0 now ====
+- 1: R_SMPL[1]
+- 2: PAD_CMD_RESP_RXDLY[26:22]
+- ==========================*/
+-
+- // save the previous tune result
+- sdr_get_field(host->base + MSDC_IOCON, MSDC_IOCON_RSPL, &orig_rsmpl);
+- sdr_get_field(host->base + MSDC_PAD_TUNE, MSDC_PAD_TUNE_CMDRRDLY,
+- &orig_rrdly);
+-
+- rrdly = 0;
+- do {
+- for (rsmpl = 0; rsmpl < 2; rsmpl++) {
+- /* Lv1: R_SMPL[1] */
+- cur_rsmpl = (orig_rsmpl + rsmpl) % 2;
+- if (skip == 1) {
+- skip = 0;
+- continue;
+- }
+- sdr_set_field(host->base + MSDC_IOCON, MSDC_IOCON_RSPL,
+- cur_rsmpl);
+-
+- if (host->app_cmd) {
+- result = msdc_app_cmd(host->mmc, host);
+- if (result) {
+- ERR_MSG("TUNE_CMD app_cmd<%d> failed: RESP_RXDLY<%d>,R_SMPL<%d>",
+- host->mrq->cmd->opcode, cur_rrdly, cur_rsmpl);
+- continue;
+- }
+- }
+- result = msdc_do_command(host, cmd, 0, CMD_TIMEOUT); // not tune.
+- ERR_MSG("TUNE_CMD<%d> %s PAD_CMD_RESP_RXDLY[26:22]<%d> R_SMPL[1]<%d>", cmd->opcode,
+- (result == 0) ? "PASS" : "FAIL", cur_rrdly, cur_rsmpl);
+-
+- if (result == 0)
+- return 0;
+- if (result != -EIO) {
+- ERR_MSG("TUNE_CMD<%d> Error<%d> not -EIO", cmd->opcode, result);
+- return result;
+- }
+-
+- /* should be EIO */
+- /* check if has data phase */
+- if (readl(host->base + SDC_CMD) & 0x1800)
+- msdc_abort_data(host);
+- }
+-
+- /* Lv2: PAD_CMD_RESP_RXDLY[26:22] */
+- cur_rrdly = (orig_rrdly + rrdly + 1) % 32;
+- sdr_set_field(host->base + MSDC_PAD_TUNE,
+- MSDC_PAD_TUNE_CMDRRDLY, cur_rrdly);
+- } while (++rrdly < 32);
+-
+- return result;
+-}
+-
+-/* Support SD2.0 Only */
+-static int msdc_tune_bread(struct mmc_host *mmc, struct mmc_request *mrq)
+-{
+- struct msdc_host *host = mmc_priv(mmc);
+- u32 ddr = 0;
+- u32 dcrc = 0;
+- u32 rxdly, cur_rxdly0, cur_rxdly1;
+- u32 dsmpl, cur_dsmpl, orig_dsmpl;
+- u32 cur_dat0, cur_dat1, cur_dat2, cur_dat3;
+- u32 cur_dat4, cur_dat5, cur_dat6, cur_dat7;
+- u32 orig_dat0, orig_dat1, orig_dat2, orig_dat3;
+- u32 orig_dat4, orig_dat5, orig_dat6, orig_dat7;
+- int result = -1;
+- u32 skip = 1;
+-
+- sdr_get_field(host->base + MSDC_IOCON, MSDC_IOCON_DSPL, &orig_dsmpl);
+-
+- /* Tune Method 2. */
+- sdr_set_field(host->base + MSDC_IOCON, MSDC_IOCON_DDLSEL, 1);
+-
+- rxdly = 0;
+- do {
+- for (dsmpl = 0; dsmpl < 2; dsmpl++) {
+- cur_dsmpl = (orig_dsmpl + dsmpl) % 2;
+- if (skip == 1) {
+- skip = 0;
+- continue;
+- }
+- sdr_set_field(host->base + MSDC_IOCON, MSDC_IOCON_DSPL,
+- cur_dsmpl);
+-
+- if (host->app_cmd) {
+- result = msdc_app_cmd(host->mmc, host);
+- if (result) {
+- ERR_MSG("TUNE_BREAD app_cmd<%d> failed", host->mrq->cmd->opcode);
+- continue;
+- }
+- }
+- result = msdc_do_request(mmc, mrq);
+-
+- sdr_get_field(host->base + SDC_DCRC_STS,
+- SDC_DCRC_STS_POS | SDC_DCRC_STS_NEG,
+- &dcrc); /* RO */
+- if (!ddr)
+- dcrc &= ~SDC_DCRC_STS_NEG;
+- ERR_MSG("TUNE_BREAD<%s> dcrc<0x%x> DATRDDLY0/1<0x%x><0x%x> dsmpl<0x%x>",
+- (result == 0 && dcrc == 0) ? "PASS" : "FAIL", dcrc,
+- readl(host->base + MSDC_DAT_RDDLY0),
+- readl(host->base + MSDC_DAT_RDDLY1), cur_dsmpl);
+-
+- /* Fix me: result is 0, but dcrc is still exist */
+- if (result == 0 && dcrc == 0) {
+- goto done;
+- } else {
+- /* there is a case: command timeout, and data phase not processed */
+- if (mrq->data->error != 0 &&
+- mrq->data->error != -EIO) {
+- ERR_MSG("TUNE_READ: result<0x%x> cmd_error<%d> data_error<%d>",
+- result, mrq->cmd->error, mrq->data->error);
+- goto done;
+- }
+- }
+- }
+-
+- cur_rxdly0 = readl(host->base + MSDC_DAT_RDDLY0);
+- cur_rxdly1 = readl(host->base + MSDC_DAT_RDDLY1);
+-
+- /* E1 ECO. YD: Reverse */
+- if (readl(host->base + MSDC_ECO_VER) >= 4) {
+- orig_dat0 = (cur_rxdly0 >> 24) & 0x1F;
+- orig_dat1 = (cur_rxdly0 >> 16) & 0x1F;
+- orig_dat2 = (cur_rxdly0 >> 8) & 0x1F;
+- orig_dat3 = (cur_rxdly0 >> 0) & 0x1F;
+- orig_dat4 = (cur_rxdly1 >> 24) & 0x1F;
+- orig_dat5 = (cur_rxdly1 >> 16) & 0x1F;
+- orig_dat6 = (cur_rxdly1 >> 8) & 0x1F;
+- orig_dat7 = (cur_rxdly1 >> 0) & 0x1F;
+- } else {
+- orig_dat0 = (cur_rxdly0 >> 0) & 0x1F;
+- orig_dat1 = (cur_rxdly0 >> 8) & 0x1F;
+- orig_dat2 = (cur_rxdly0 >> 16) & 0x1F;
+- orig_dat3 = (cur_rxdly0 >> 24) & 0x1F;
+- orig_dat4 = (cur_rxdly1 >> 0) & 0x1F;
+- orig_dat5 = (cur_rxdly1 >> 8) & 0x1F;
+- orig_dat6 = (cur_rxdly1 >> 16) & 0x1F;
+- orig_dat7 = (cur_rxdly1 >> 24) & 0x1F;
+- }
+-
+- if (ddr) {
+- cur_dat0 = (dcrc & (1 << 0) || dcrc & (1 << 8)) ? ((orig_dat0 + 1) % 32) : orig_dat0;
+- cur_dat1 = (dcrc & (1 << 1) || dcrc & (1 << 9)) ? ((orig_dat1 + 1) % 32) : orig_dat1;
+- cur_dat2 = (dcrc & (1 << 2) || dcrc & (1 << 10)) ? ((orig_dat2 + 1) % 32) : orig_dat2;
+- cur_dat3 = (dcrc & (1 << 3) || dcrc & (1 << 11)) ? ((orig_dat3 + 1) % 32) : orig_dat3;
+- } else {
+- cur_dat0 = (dcrc & (1 << 0)) ? ((orig_dat0 + 1) % 32) : orig_dat0;
+- cur_dat1 = (dcrc & (1 << 1)) ? ((orig_dat1 + 1) % 32) : orig_dat1;
+- cur_dat2 = (dcrc & (1 << 2)) ? ((orig_dat2 + 1) % 32) : orig_dat2;
+- cur_dat3 = (dcrc & (1 << 3)) ? ((orig_dat3 + 1) % 32) : orig_dat3;
+- }
+- cur_dat4 = (dcrc & (1 << 4)) ? ((orig_dat4 + 1) % 32) : orig_dat4;
+- cur_dat5 = (dcrc & (1 << 5)) ? ((orig_dat5 + 1) % 32) : orig_dat5;
+- cur_dat6 = (dcrc & (1 << 6)) ? ((orig_dat6 + 1) % 32) : orig_dat6;
+- cur_dat7 = (dcrc & (1 << 7)) ? ((orig_dat7 + 1) % 32) : orig_dat7;
+-
+- cur_rxdly0 = (cur_dat0 << 24) | (cur_dat1 << 16) | (cur_dat2 << 8) | (cur_dat3 << 0);
+- cur_rxdly1 = (cur_dat4 << 24) | (cur_dat5 << 16) | (cur_dat6 << 8) | (cur_dat7 << 0);
+-
+- writel(cur_rxdly0, host->base + MSDC_DAT_RDDLY0);
+- writel(cur_rxdly1, host->base + MSDC_DAT_RDDLY1);
+-
+- } while (++rxdly < 32);
+-
+-done:
+- return result;
+-}
+-
+-static int msdc_tune_bwrite(struct mmc_host *mmc, struct mmc_request *mrq)
+-{
+- struct msdc_host *host = mmc_priv(mmc);
+-
+- u32 wrrdly, cur_wrrdly = 0xffffffff, orig_wrrdly;
+- u32 dsmpl, cur_dsmpl, orig_dsmpl;
+- u32 rxdly, cur_rxdly0;
+- u32 orig_dat0, orig_dat1, orig_dat2, orig_dat3;
+- u32 cur_dat0, cur_dat1, cur_dat2, cur_dat3;
+- int result = -1;
+- u32 skip = 1;
+-
+- // MSDC_IOCON_DDR50CKD need to check. [Fix me]
+-
+- sdr_get_field(host->base + MSDC_PAD_TUNE, MSDC_PAD_TUNE_DATWRDLY,
+- &orig_wrrdly);
+- sdr_get_field(host->base + MSDC_IOCON, MSDC_IOCON_DSPL, &orig_dsmpl);
+-
+- /* Tune Method 2. just DAT0 */
+- sdr_set_field(host->base + MSDC_IOCON, MSDC_IOCON_DDLSEL, 1);
+- cur_rxdly0 = readl(host->base + MSDC_DAT_RDDLY0);
+-
+- /* E1 ECO. YD: Reverse */
+- if (readl(host->base + MSDC_ECO_VER) >= 4) {
+- orig_dat0 = (cur_rxdly0 >> 24) & 0x1F;
+- orig_dat1 = (cur_rxdly0 >> 16) & 0x1F;
+- orig_dat2 = (cur_rxdly0 >> 8) & 0x1F;
+- orig_dat3 = (cur_rxdly0 >> 0) & 0x1F;
+- } else {
+- orig_dat0 = (cur_rxdly0 >> 0) & 0x1F;
+- orig_dat1 = (cur_rxdly0 >> 8) & 0x1F;
+- orig_dat2 = (cur_rxdly0 >> 16) & 0x1F;
+- orig_dat3 = (cur_rxdly0 >> 24) & 0x1F;
+- }
+-
+- rxdly = 0;
+- do {
+- wrrdly = 0;
+- do {
+- for (dsmpl = 0; dsmpl < 2; dsmpl++) {
+- cur_dsmpl = (orig_dsmpl + dsmpl) % 2;
+- if (skip == 1) {
+- skip = 0;
+- continue;
+- }
+- sdr_set_field(host->base + MSDC_IOCON,
+- MSDC_IOCON_DSPL, cur_dsmpl);
+-
+- if (host->app_cmd) {
+- result = msdc_app_cmd(host->mmc, host);
+- if (result) {
+- ERR_MSG("TUNE_BWRITE app_cmd<%d> failed", host->mrq->cmd->opcode);
+- continue;
+- }
+- }
+- result = msdc_do_request(mmc, mrq);
+-
+- ERR_MSG("TUNE_BWRITE<%s> DSPL<%d> DATWRDLY<%d> MSDC_DAT_RDDLY0<0x%x>",
+- result == 0 ? "PASS" : "FAIL",
+- cur_dsmpl, cur_wrrdly, cur_rxdly0);
+-
+- if (result == 0) {
+- goto done;
+- } else {
+- /* there is a case: command timeout, and data phase not processed */
+- if (mrq->data->error != -EIO) {
+- ERR_MSG("TUNE_READ: result<0x%x> cmd_error<%d> data_error<%d>",
+- result, mrq->cmd->error, mrq->data->error);
+- goto done;
+- }
+- }
+- }
+- cur_wrrdly = (orig_wrrdly + wrrdly + 1) % 32;
+- sdr_set_field(host->base + MSDC_PAD_TUNE,
+- MSDC_PAD_TUNE_DATWRDLY, cur_wrrdly);
+- } while (++wrrdly < 32);
+-
+- cur_dat0 = (orig_dat0 + rxdly) % 32; /* only adjust bit-1 for crc */
+- cur_dat1 = orig_dat1;
+- cur_dat2 = orig_dat2;
+- cur_dat3 = orig_dat3;
+-
+- cur_rxdly0 = (cur_dat0 << 24) | (cur_dat1 << 16) | (cur_dat2 << 8) | (cur_dat3 << 0);
+- writel(cur_rxdly0, host->base + MSDC_DAT_RDDLY0);
+- } while (++rxdly < 32);
+-
+-done:
+- return result;
+-}
+-
+-static int msdc_get_card_status(struct mmc_host *mmc, struct msdc_host *host, u32 *status)
+-{
+- struct mmc_command cmd;
+- struct mmc_request mrq;
+- u32 err;
+-
+- memset(&cmd, 0, sizeof(struct mmc_command));
+- cmd.opcode = MMC_SEND_STATUS;
+- if (mmc->card) {
+- cmd.arg = mmc->card->rca << 16;
+- } else {
+- ERR_MSG("cmd13 mmc card is null");
+- cmd.arg = host->app_cmd_arg;
+- }
+- cmd.flags = MMC_RSP_SPI_R2 | MMC_RSP_R1 | MMC_CMD_AC;
+-
+- memset(&mrq, 0, sizeof(struct mmc_request));
+- mrq.cmd = &cmd; cmd.mrq = &mrq;
+- cmd.data = NULL;
+-
+- err = msdc_do_command(host, &cmd, 1, CMD_TIMEOUT);
+-
+- if (status)
+- *status = cmd.resp[0];
+-
+- return err;
+-}
+-
+-static int msdc_check_busy(struct mmc_host *mmc, struct msdc_host *host)
+-{
+- u32 err = 0;
+- u32 status = 0;
+-
+- do {
+- err = msdc_get_card_status(mmc, host, &status);
+- if (err)
+- return err;
+- /* need cmd12? */
+- ERR_MSG("cmd<13> resp<0x%x>", status);
+- } while (R1_CURRENT_STATE(status) == 7);
+-
+- return err;
+-}
+-
+-/* failed when msdc_do_request */
+-static int msdc_tune_request(struct mmc_host *mmc, struct mmc_request *mrq)
+-{
+- struct msdc_host *host = mmc_priv(mmc);
+- struct mmc_data *data;
+- //u32 base = host->base;
+- int ret = 0, read;
+-
+- data = mrq->cmd->data;
+-
+- read = data->flags & MMC_DATA_READ ? 1 : 0;
+-
+- if (read) {
+- if (data->error == -EIO)
+- ret = msdc_tune_bread(mmc, mrq);
+- } else {
+- ret = msdc_check_busy(mmc, host);
+- if (ret) {
+- ERR_MSG("XXX cmd13 wait program done failed");
+- return ret;
+- }
+- /* CRC and TO */
+- /* Fix me: don't care card status? */
+- ret = msdc_tune_bwrite(mmc, mrq);
+- }
+-
+- return ret;
+-}
+-
+-/* ops.request */
+-static void msdc_ops_request(struct mmc_host *mmc, struct mmc_request *mrq)
+-{
+- struct msdc_host *host = mmc_priv(mmc);
+-
+- //=== for sdio profile ===
+-#if 0 /* --- by chhung */
+- u32 old_H32, old_L32, new_H32, new_L32;
+- u32 ticks = 0, opcode = 0, sizes = 0, bRx = 0;
+-#endif /* end of --- */
+-
+- WARN_ON(host->mrq);
+-
+- /* start to process */
+- spin_lock(&host->lock);
+-#if 0 /* --- by chhung */
+- if (sdio_pro_enable) { //=== for sdio profile ===
+- if (mrq->cmd->opcode == 52 || mrq->cmd->opcode == 53)
+- GPT_GetCounter64(&old_L32, &old_H32);
+- }
+-#endif /* end of --- */
+-
+- host->mrq = mrq;
+-
+- if (msdc_do_request(mmc, mrq)) {
+- if (host->hw->flags & MSDC_REMOVABLE && ralink_soc == MT762X_SOC_MT7621AT && mrq->data && mrq->data->error)
+- msdc_tune_request(mmc, mrq);
+- }
+-
+- /* ==== when request done, check if app_cmd ==== */
+- if (mrq->cmd->opcode == MMC_APP_CMD) {
+- host->app_cmd = 1;
+- host->app_cmd_arg = mrq->cmd->arg; /* save the RCA */
+- } else {
+- host->app_cmd = 0;
+- //host->app_cmd_arg = 0;
+- }
+-
+- host->mrq = NULL;
+-
+-#if 0 /* --- by chhung */
+- //=== for sdio profile ===
+- if (sdio_pro_enable) {
+- if (mrq->cmd->opcode == 52 || mrq->cmd->opcode == 53) {
+- GPT_GetCounter64(&new_L32, &new_H32);
+- ticks = msdc_time_calc(old_L32, old_H32, new_L32, new_H32);
+-
+- opcode = mrq->cmd->opcode;
+- if (mrq->cmd->data) {
+- sizes = mrq->cmd->data->blocks * mrq->cmd->data->blksz;
+- bRx = mrq->cmd->data->flags & MMC_DATA_READ ? 1 : 0;
+- } else {
+- bRx = mrq->cmd->arg & 0x80000000 ? 1 : 0;
+- }
+-
+- if (!mrq->cmd->error)
+- msdc_performance(opcode, sizes, bRx, ticks);
+- }
+- }
+-#endif /* end of --- */
+- spin_unlock(&host->lock);
+-
+- mmc_request_done(mmc, mrq);
+-
+- return;
+-}
+-
+-/* called by ops.set_ios */
+-static void msdc_set_buswidth(struct msdc_host *host, u32 width)
+-{
+- u32 val = readl(host->base + SDC_CFG);
+-
+- val &= ~SDC_CFG_BUSWIDTH;
+-
+- switch (width) {
+- default:
+- case MMC_BUS_WIDTH_1:
+- width = 1;
+- val |= (MSDC_BUS_1BITS << 16);
+- break;
+- case MMC_BUS_WIDTH_4:
+- val |= (MSDC_BUS_4BITS << 16);
+- break;
+- case MMC_BUS_WIDTH_8:
+- val |= (MSDC_BUS_8BITS << 16);
+- break;
+- }
+-
+- writel(val, host->base + SDC_CFG);
+-
+- N_MSG(CFG, "Bus Width = %d", width);
+-}
+-
+-/* ops.set_ios */
+-static void msdc_ops_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+-{
+- struct msdc_host *host = mmc_priv(mmc);
+- u32 ddr = 0;
+-
+-#ifdef MT6575_SD_DEBUG
+- static char *vdd[] = {
+- "1.50v", "1.55v", "1.60v", "1.65v", "1.70v", "1.80v", "1.90v",
+- "2.00v", "2.10v", "2.20v", "2.30v", "2.40v", "2.50v", "2.60v",
+- "2.70v", "2.80v", "2.90v", "3.00v", "3.10v", "3.20v", "3.30v",
+- "3.40v", "3.50v", "3.60v"
+- };
+- static char *power_mode[] = {
+- "OFF", "UP", "ON"
+- };
+- static char *bus_mode[] = {
+- "UNKNOWN", "OPENDRAIN", "PUSHPULL"
+- };
+- static char *timing[] = {
+- "LEGACY", "MMC_HS", "SD_HS"
+- };
+-
+- printk("SET_IOS: CLK(%dkHz), BUS(%s), BW(%u), PWR(%s), VDD(%s), TIMING(%s)",
+- ios->clock / 1000, bus_mode[ios->bus_mode],
+- (ios->bus_width == MMC_BUS_WIDTH_4) ? 4 : 1,
+- power_mode[ios->power_mode], vdd[ios->vdd], timing[ios->timing]);
+-#endif
+-
+- msdc_set_buswidth(host, ios->bus_width);
+-
+- /* Power control ??? */
+- switch (ios->power_mode) {
+- case MMC_POWER_OFF:
+- case MMC_POWER_UP:
+- // msdc_set_power_mode(host, ios->power_mode); /* --- by chhung */
+- break;
+- case MMC_POWER_ON:
+- host->power_mode = MMC_POWER_ON;
+- break;
+- default:
+- break;
+- }
+-
+- /* Clock control */
+- if (host->mclk != ios->clock) {
+- if (ios->clock > 25000000) {
+- //if (!(host->hw->flags & MSDC_REMOVABLE)) {
+- INIT_MSG("SD data latch edge<%d>", MSDC_SMPL_FALLING);
+- sdr_set_field(host->base + MSDC_IOCON, MSDC_IOCON_RSPL,
+- MSDC_SMPL_FALLING);
+- sdr_set_field(host->base + MSDC_IOCON, MSDC_IOCON_DSPL,
+- MSDC_SMPL_FALLING);
+- //} /* for tuning debug */
+- } else { /* default value */
+- writel(0x00000000, host->base + MSDC_IOCON);
+- // writel(0x00000000, host->base + MSDC_DAT_RDDLY0);
+-
+- // for MT7620 E2 and afterward
+- writel(0x10101010, host->base + MSDC_DAT_RDDLY0);
+-
+- writel(0x00000000, host->base + MSDC_DAT_RDDLY1);
+- // writel(0x00000000, host->base + MSDC_PAD_TUNE);
+-
+- // for MT7620 E2 and afterward
+- writel(0x84101010, host->base + MSDC_PAD_TUNE);
+- }
+- msdc_set_mclk(host, ddr, ios->clock);
+- }
+-}
+-
+-/* ops.get_ro */
+-static int msdc_ops_get_ro(struct mmc_host *mmc)
+-{
+- struct msdc_host *host = mmc_priv(mmc);
+- unsigned long flags;
+- int ro = 0;
+-
+- if (host->hw->flags & MSDC_WP_PIN_EN) { /* set for card */
+- spin_lock_irqsave(&host->lock, flags);
+- ro = (readl(host->base + MSDC_PS) >> 31);
+- spin_unlock_irqrestore(&host->lock, flags);
+- }
+- return ro;
+-}
+-
+-/* ops.get_cd */
+-static int msdc_ops_get_cd(struct mmc_host *mmc)
+-{
+- struct msdc_host *host = mmc_priv(mmc);
+- unsigned long flags;
+- int present = 1;
+-
+- /* for sdio, MSDC_REMOVABLE not set, always return 1 */
+- if (!(host->hw->flags & MSDC_REMOVABLE)) {
+- /* For sdio, read H/W always get<1>, but may timeout some times */
+-#if 1
+- host->card_inserted = 1;
+- return 1;
+-#else
+- host->card_inserted = (host->pm_state.event == PM_EVENT_USER_RESUME) ? 1 : 0;
+- INIT_MSG("sdio ops_get_cd<%d>", host->card_inserted);
+- return host->card_inserted;
+-#endif
+- }
+-
+- /* MSDC_CD_PIN_EN set for card */
+- if (host->hw->flags & MSDC_CD_PIN_EN) {
+- spin_lock_irqsave(&host->lock, flags);
+-#if 0
+- present = host->card_inserted; /* why not read from H/W: Fix me*/
+-#else
+- // CD
+- present = readl(host->base + MSDC_PS) & MSDC_PS_CDSTS;
+- if (cd_active_low)
+- present = present ? 0 : 1;
+- else
+- present = present ? 1 : 0;
+- host->card_inserted = present;
+-#endif
+- spin_unlock_irqrestore(&host->lock, flags);
+- } else {
+- present = 0; /* TODO? Check DAT3 pins for card detection */
+- }
+-
+- INIT_MSG("ops_get_cd return<%d>", present);
+- return present;
+-}
+-
+-static struct mmc_host_ops mt_msdc_ops = {
+- .request = msdc_ops_request,
+- .set_ios = msdc_ops_set_ios,
+- .get_ro = msdc_ops_get_ro,
+- .get_cd = msdc_ops_get_cd,
+-};
+-
+-/*--------------------------------------------------------------------------*/
+-/* interrupt handler */
+-/*--------------------------------------------------------------------------*/
+-static irqreturn_t msdc_irq(int irq, void *dev_id)
+-{
+- struct msdc_host *host = (struct msdc_host *)dev_id;
+- struct mmc_data *data = host->data;
+- struct mmc_command *cmd = host->cmd;
+-
+- u32 cmdsts = MSDC_INT_RSPCRCERR | MSDC_INT_CMDTMO | MSDC_INT_CMDRDY |
+- MSDC_INT_ACMDCRCERR | MSDC_INT_ACMDTMO | MSDC_INT_ACMDRDY |
+- MSDC_INT_ACMD19_DONE;
+- u32 datsts = MSDC_INT_DATCRCERR | MSDC_INT_DATTMO;
+-
+- u32 intsts = readl(host->base + MSDC_INT);
+- u32 inten = readl(host->base + MSDC_INTEN); inten &= intsts;
+-
+- writel(intsts, host->base + MSDC_INT); /* clear interrupts */
+- /* MSG will cause fatal error */
+-
+- /* card change interrupt */
+- if (intsts & MSDC_INT_CDSC) {
+- if (host->mmc->caps & MMC_CAP_NEEDS_POLL)
+- return IRQ_HANDLED;
+- IRQ_MSG("MSDC_INT_CDSC irq<0x%.8x>", intsts);
+- schedule_delayed_work(&host->card_delaywork, HZ);
+- /* tuning when plug card ? */
+- }
+-
+- /* sdio interrupt */
+- if (intsts & MSDC_INT_SDIOIRQ) {
+- IRQ_MSG("XXX MSDC_INT_SDIOIRQ"); /* seems not sdio irq */
+- //mmc_signal_sdio_irq(host->mmc);
+- }
+-
+- /* transfer complete interrupt */
+- if (data != NULL) {
+- if (inten & MSDC_INT_XFER_COMPL) {
+- data->bytes_xfered = host->xfer_size;
+- complete(&host->xfer_done);
+- }
+-
+- if (intsts & datsts) {
+- /* do basic reset, or stop command will sdc_busy */
+- msdc_reset_hw(host);
+- msdc_clr_fifo(host);
+- msdc_clr_int();
+-
+- if (intsts & MSDC_INT_DATTMO) {
+- IRQ_MSG("XXX CMD<%d> MSDC_INT_DATTMO", host->mrq->cmd->opcode);
+- data->error = -ETIMEDOUT;
+- } else if (intsts & MSDC_INT_DATCRCERR) {
+- IRQ_MSG("XXX CMD<%d> MSDC_INT_DATCRCERR, SDC_DCRC_STS<0x%x>", host->mrq->cmd->opcode, readl(host->base + SDC_DCRC_STS));
+- data->error = -EIO;
+- }
+-
+- //if(readl(MSDC_INTEN) & MSDC_INT_XFER_COMPL) {
+- complete(&host->xfer_done); /* Read CRC come fast, XFER_COMPL not enabled */
+- }
+- }
+-
+- /* command interrupts */
+- if ((cmd != NULL) && (intsts & cmdsts)) {
+- if ((intsts & MSDC_INT_CMDRDY) || (intsts & MSDC_INT_ACMDRDY) ||
+- (intsts & MSDC_INT_ACMD19_DONE)) {
+- u32 *rsp = &cmd->resp[0];
+-
+- switch (host->cmd_rsp) {
+- case RESP_NONE:
+- break;
+- case RESP_R2:
+- *rsp++ = readl(host->base + SDC_RESP3);
+- *rsp++ = readl(host->base + SDC_RESP2);
+- *rsp++ = readl(host->base + SDC_RESP1);
+- *rsp++ = readl(host->base + SDC_RESP0);
+- break;
+- default: /* Response types 1, 3, 4, 5, 6, 7(1b) */
+- if ((intsts & MSDC_INT_ACMDRDY) || (intsts & MSDC_INT_ACMD19_DONE))
+- *rsp = readl(host->base + SDC_ACMD_RESP);
+- else
+- *rsp = readl(host->base + SDC_RESP0);
+- break;
+- }
+- } else if ((intsts & MSDC_INT_RSPCRCERR) || (intsts & MSDC_INT_ACMDCRCERR)) {
+- if (intsts & MSDC_INT_ACMDCRCERR)
+- IRQ_MSG("XXX CMD<%d> MSDC_INT_ACMDCRCERR", cmd->opcode);
+- else
+- IRQ_MSG("XXX CMD<%d> MSDC_INT_RSPCRCERR", cmd->opcode);
+- cmd->error = -EIO;
+- } else if ((intsts & MSDC_INT_CMDTMO) || (intsts & MSDC_INT_ACMDTMO)) {
+- if (intsts & MSDC_INT_ACMDTMO)
+- IRQ_MSG("XXX CMD<%d> MSDC_INT_ACMDTMO", cmd->opcode);
+- else
+- IRQ_MSG("XXX CMD<%d> MSDC_INT_CMDTMO", cmd->opcode);
+- cmd->error = -ETIMEDOUT;
+- msdc_reset_hw(host);
+- msdc_clr_fifo(host);
+- msdc_clr_int();
+- }
+- complete(&host->cmd_done);
+- }
+-
+- /* mmc irq interrupts */
+- if (intsts & MSDC_INT_MMCIRQ)
+- printk(KERN_INFO "msdc[%d] MMCIRQ: SDC_CSTS=0x%.8x\r\n",
+- host->id, readl(host->base + SDC_CSTS));
+-
+-#ifdef MT6575_SD_DEBUG
+- {
+-/* msdc_int_reg *int_reg = (msdc_int_reg*)&intsts;*/
+- N_MSG(INT, "IRQ_EVT(0x%x): MMCIRQ(%d) CDSC(%d), ACRDY(%d), ACTMO(%d), ACCRE(%d) AC19DN(%d)",
+- intsts,
+- int_reg->mmcirq,
+- int_reg->cdsc,
+- int_reg->atocmdrdy,
+- int_reg->atocmdtmo,
+- int_reg->atocmdcrc,
+- int_reg->atocmd19done);
+- N_MSG(INT, "IRQ_EVT(0x%x): SDIO(%d) CMDRDY(%d), CMDTMO(%d), RSPCRC(%d), CSTA(%d)",
+- intsts,
+- int_reg->sdioirq,
+- int_reg->cmdrdy,
+- int_reg->cmdtmo,
+- int_reg->rspcrc,
+- int_reg->csta);
+- N_MSG(INT, "IRQ_EVT(0x%x): XFCMP(%d) DXDONE(%d), DATTMO(%d), DATCRC(%d), DMAEMP(%d)",
+- intsts,
+- int_reg->xfercomp,
+- int_reg->dxferdone,
+- int_reg->dattmo,
+- int_reg->datcrc,
+- int_reg->dmaqempty);
+- }
+-#endif
+-
+- return IRQ_HANDLED;
+-}
+-
+-/*--------------------------------------------------------------------------*/
+-/* platform_driver members */
+-/*--------------------------------------------------------------------------*/
+-/* called by msdc_drv_probe/remove */
+-static void msdc_enable_cd_irq(struct msdc_host *host, int enable)
+-{
+- struct msdc_hw *hw = host->hw;
+-
+- /* for sdio, not set */
+- if ((hw->flags & MSDC_CD_PIN_EN) == 0) {
+- /* Pull down card detection pin since it is not avaiable */
+- /*
+- if (hw->config_gpio_pin)
+- hw->config_gpio_pin(MSDC_CD_PIN, GPIO_PULL_DOWN);
+- */
+- sdr_clr_bits(host->base + MSDC_PS, MSDC_PS_CDEN);
+- sdr_clr_bits(host->base + MSDC_INTEN, MSDC_INTEN_CDSC);
+- sdr_clr_bits(host->base + SDC_CFG, SDC_CFG_INSWKUP);
+- return;
+- }
+-
+- N_MSG(CFG, "CD IRQ Enable(%d)", enable);
+-
+- if (enable) {
+- /* card detection circuit relies on the core power so that the core power
+- * shouldn't be turned off. Here adds a reference count to keep
+- * the core power alive.
+- */
+- //msdc_vcore_on(host); //did in msdc_init_hw()
+-
+- if (hw->config_gpio_pin) /* NULL */
+- hw->config_gpio_pin(MSDC_CD_PIN, GPIO_PULL_UP);
+-
+- sdr_set_field(host->base + MSDC_PS, MSDC_PS_CDDEBOUNCE,
+- DEFAULT_DEBOUNCE);
+- sdr_set_bits(host->base + MSDC_PS, MSDC_PS_CDEN);
+- sdr_set_bits(host->base + MSDC_INTEN, MSDC_INTEN_CDSC);
+-
+- /* not in document! Fix me */
+- sdr_set_bits(host->base + SDC_CFG, SDC_CFG_INSWKUP);
+- } else {
+- if (hw->config_gpio_pin) /* NULL */
+- hw->config_gpio_pin(MSDC_CD_PIN, GPIO_PULL_DOWN);
+-
+- sdr_clr_bits(host->base + SDC_CFG, SDC_CFG_INSWKUP);
+- sdr_clr_bits(host->base + MSDC_PS, MSDC_PS_CDEN);
+- sdr_clr_bits(host->base + MSDC_INTEN, MSDC_INTEN_CDSC);
+-
+- /* Here decreases a reference count to core power since card
+- * detection circuit is shutdown.
+- */
+- //msdc_vcore_off(host);
+- }
+-}
+-
+-/* called by msdc_drv_probe */
+-static void msdc_init_hw(struct msdc_host *host)
+-{
+-
+- /* Power on */
+-#if 0 /* --- by chhung */
+- msdc_vcore_on(host);
+- msdc_pin_reset(host, MSDC_PIN_PULL_UP);
+- msdc_select_clksrc(host, hw->clk_src);
+- enable_clock(PERI_MSDC0_PDN + host->id, "SD");
+- msdc_vdd_on(host);
+-#endif /* end of --- */
+- /* Configure to MMC/SD mode */
+- sdr_set_field(host->base + MSDC_CFG, MSDC_CFG_MODE, MSDC_SDMMC);
+-
+- /* Reset */
+- msdc_reset_hw(host);
+- msdc_clr_fifo(host);
+-
+- /* Disable card detection */
+- sdr_clr_bits(host->base + MSDC_PS, MSDC_PS_CDEN);
+-
+- /* Disable and clear all interrupts */
+- sdr_clr_bits(host->base + MSDC_INTEN, readl(host->base + MSDC_INTEN));
+- writel(readl(host->base + MSDC_INT), host->base + MSDC_INT);
+-
+-#if 1
+- /* reset tuning parameter */
+- writel(0x00090000, host->base + MSDC_PAD_CTL0);
+- writel(0x000A0000, host->base + MSDC_PAD_CTL1);
+- writel(0x000A0000, host->base + MSDC_PAD_CTL2);
+- // writel( 0x00000000, host->base + MSDC_PAD_TUNE);
+-
+- // for MT7620 E2 and afterward
+- writel(0x84101010, host->base + MSDC_PAD_TUNE);
+-
+- // writel(0x00000000, host->base + MSDC_DAT_RDDLY0);
+-
+- // for MT7620 E2 and afterward
+- writel(0x10101010, host->base + MSDC_DAT_RDDLY0);
+-
+- writel(0x00000000, host->base + MSDC_DAT_RDDLY1);
+- writel(0x00000000, host->base + MSDC_IOCON);
+-#if 0 // use MT7620 default value: 0x403c004f
+- /* bit0 modified: Rx Data Clock Source: 1 -> 2.0*/
+- writel(0x003C000F, host->base + MSDC_PATCH_BIT0);
+-#endif
+-
+- if (readl(host->base + MSDC_ECO_VER) >= 4) {
+- if (host->id == 1) {
+- sdr_set_field(host->base + MSDC_PATCH_BIT1,
+- MSDC_PATCH_BIT1_WRDAT_CRCS, 1);
+- sdr_set_field(host->base + MSDC_PATCH_BIT1,
+- MSDC_PATCH_BIT1_CMD_RSP, 1);
+-
+- /* internal clock: latch read data */
+- sdr_set_bits(host->base + MSDC_PATCH_BIT0,
+- MSDC_PATCH_BIT_CKGEN_CK);
+- }
+- }
+-#endif
+-
+- /* for safety, should clear SDC_CFG.SDIO_INT_DET_EN & set SDC_CFG.SDIO in
+- pre-loader,uboot,kernel drivers. and SDC_CFG.SDIO_INT_DET_EN will be only
+- set when kernel driver wants to use SDIO bus interrupt */
+- /* Configure to enable SDIO mode. it's must otherwise sdio cmd5 failed */
+- sdr_set_bits(host->base + SDC_CFG, SDC_CFG_SDIO);
+-
+- /* disable detect SDIO device interupt function */
+- sdr_clr_bits(host->base + SDC_CFG, SDC_CFG_SDIOIDE);
+-
+- /* eneable SMT for glitch filter */
+- sdr_set_bits(host->base + MSDC_PAD_CTL0, MSDC_PAD_CTL0_CLKSMT);
+- sdr_set_bits(host->base + MSDC_PAD_CTL1, MSDC_PAD_CTL1_CMDSMT);
+- sdr_set_bits(host->base + MSDC_PAD_CTL2, MSDC_PAD_CTL2_DATSMT);
+-
+-#if 1
+- /* set clk, cmd, dat pad driving */
+- sdr_set_field(host->base + MSDC_PAD_CTL0, MSDC_PAD_CTL0_CLKDRVN, 4);
+- sdr_set_field(host->base + MSDC_PAD_CTL0, MSDC_PAD_CTL0_CLKDRVP, 4);
+- sdr_set_field(host->base + MSDC_PAD_CTL1, MSDC_PAD_CTL1_CMDDRVN, 4);
+- sdr_set_field(host->base + MSDC_PAD_CTL1, MSDC_PAD_CTL1_CMDDRVP, 4);
+- sdr_set_field(host->base + MSDC_PAD_CTL2, MSDC_PAD_CTL2_DATDRVN, 4);
+- sdr_set_field(host->base + MSDC_PAD_CTL2, MSDC_PAD_CTL2_DATDRVP, 4);
+-#else
+- sdr_set_field(host->base + MSDC_PAD_CTL0, MSDC_PAD_CTL0_CLKDRVN, 0);
+- sdr_set_field(host->base + MSDC_PAD_CTL0, MSDC_PAD_CTL0_CLKDRVP, 0);
+- sdr_set_field(host->base + MSDC_PAD_CTL1, MSDC_PAD_CTL1_CMDDRVN, 0);
+- sdr_set_field(host->base + MSDC_PAD_CTL1, MSDC_PAD_CTL1_CMDDRVP, 0);
+- sdr_set_field(host->base + MSDC_PAD_CTL2, MSDC_PAD_CTL2_DATDRVN, 0);
+- sdr_set_field(host->base + MSDC_PAD_CTL2, MSDC_PAD_CTL2_DATDRVP, 0);
+-#endif
+-
+- /* set sampling edge */
+-
+- /* write crc timeout detection */
+- sdr_set_field(host->base + MSDC_PATCH_BIT0, 1 << 30, 1);
+-
+- /* Configure to default data timeout */
+- sdr_set_field(host->base + SDC_CFG, SDC_CFG_DTOC, DEFAULT_DTOC);
+-
+- msdc_set_buswidth(host, MMC_BUS_WIDTH_1);
+-
+- N_MSG(FUC, "init hardware done!");
+-}
+-
+-/* called by msdc_drv_remove */
+-static void msdc_deinit_hw(struct msdc_host *host)
+-{
+- /* Disable and clear all interrupts */
+- sdr_clr_bits(host->base + MSDC_INTEN, readl(host->base + MSDC_INTEN));
+- writel(readl(host->base + MSDC_INT), host->base + MSDC_INT);
+-
+- /* Disable card detection */
+- msdc_enable_cd_irq(host, 0);
+- // msdc_set_power_mode(host, MMC_POWER_OFF); /* make sure power down */ /* --- by chhung */
+-}
+-
+-/* init gpd and bd list in msdc_drv_probe */
+-static void msdc_init_gpd_bd(struct msdc_host *host, struct msdc_dma *dma)
+-{
+- struct gpd *gpd = dma->gpd;
+- struct bd *bd = dma->bd;
+- int i;
+-
+- /* we just support one gpd, but gpd->next must be set for desc
+- * DMA. That's why we alloc 2 gpd structurs.
+- */
+-
+- memset(gpd, 0, sizeof(struct gpd) * 2);
+-
+- gpd->bdp = 1; /* hwo, cs, bd pointer */
+- gpd->ptr = (void *)dma->bd_addr; /* physical address */
+- gpd->next = (void *)((u32)dma->gpd_addr + sizeof(struct gpd));
+-
+- memset(bd, 0, sizeof(struct bd) * MAX_BD_NUM);
+- for (i = 0; i < (MAX_BD_NUM - 1); i++)
+- bd[i].next = (void *)(dma->bd_addr + sizeof(*bd) * (i + 1));
+-}
+-
+-static int msdc_drv_probe(struct platform_device *pdev)
+-{
+- struct resource *res;
+- __iomem void *base;
+- struct mmc_host *mmc;
+- struct msdc_host *host;
+- struct msdc_hw *hw;
+- int ret;
+-
+- hw = &msdc0_hw;
+-
+- if (of_property_read_bool(pdev->dev.of_node, "mtk,wp-en"))
+- msdc0_hw.flags |= MSDC_WP_PIN_EN;
+-
+- /* Allocate MMC host for this device */
+- mmc = mmc_alloc_host(sizeof(struct msdc_host), &pdev->dev);
+- if (!mmc)
+- return -ENOMEM;
+-
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- base = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(base)) {
+- ret = PTR_ERR(base);
+- goto host_free;
+- }
+-
+- /* Set host parameters to mmc */
+- mmc->ops = &mt_msdc_ops;
+- mmc->f_min = HOST_MIN_MCLK;
+- mmc->f_max = HOST_MAX_MCLK;
+- mmc->ocr_avail = MSDC_OCR_AVAIL;
+-
+- mmc->caps = MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED;
+-
+- //TODO: read this as bus-width from dt (via mmc_of_parse)
+- mmc->caps |= MMC_CAP_4_BIT_DATA;
+-
+- cd_active_low = !of_property_read_bool(pdev->dev.of_node, "mediatek,cd-high");
+-
+- if (of_property_read_bool(pdev->dev.of_node, "mediatek,cd-poll"))
+- mmc->caps |= MMC_CAP_NEEDS_POLL;
+-
+- /* MMC core transfer sizes tunable parameters */
+- mmc->max_segs = MAX_HW_SGMTS;
+-
+- mmc->max_seg_size = MAX_SGMT_SZ;
+- mmc->max_blk_size = HOST_MAX_BLKSZ;
+- mmc->max_req_size = MAX_REQ_SZ;
+- mmc->max_blk_count = mmc->max_req_size;
+-
+- host = mmc_priv(mmc);
+- host->hw = hw;
+- host->mmc = mmc;
+- host->id = pdev->id;
+- if (host->id < 0 || host->id >= 4)
+- host->id = 0;
+- host->error = 0;
+-
+- host->irq = platform_get_irq(pdev, 0);
+- if (host->irq < 0) {
+- ret = -EINVAL;
+- goto host_free;
+- }
+-
+- host->base = base;
+- host->mclk = 0; /* mclk: the request clock of mmc sub-system */
+- host->hclk = hclks[hw->clk_src]; /* hclk: clock of clock source to msdc controller */
+- host->sclk = 0; /* sclk: the really clock after divition */
+- host->pm_state = PMSG_RESUME;
+- host->suspend = 0;
+- host->core_clkon = 0;
+- host->card_clkon = 0;
+- host->core_power = 0;
+- host->power_mode = MMC_POWER_OFF;
+-// host->card_inserted = hw->flags & MSDC_REMOVABLE ? 0 : 1;
+- host->timeout_ns = 0;
+- host->timeout_clks = DEFAULT_DTOC * 65536;
+-
+- host->mrq = NULL;
+- //init_MUTEX(&host->sem); /* we don't need to support multiple threads access */
+-
+- mmc_dev(mmc)->dma_mask = NULL;
+-
+- /* using dma_alloc_coherent*/ /* todo: using 1, for all 4 slots */
+- host->dma.gpd = dma_alloc_coherent(&pdev->dev,
+- MAX_GPD_NUM * sizeof(struct gpd),
+- &host->dma.gpd_addr, GFP_KERNEL);
+- host->dma.bd = dma_alloc_coherent(&pdev->dev,
+- MAX_BD_NUM * sizeof(struct bd),
+- &host->dma.bd_addr, GFP_KERNEL);
+- if (!host->dma.gpd || !host->dma.bd) {
+- ret = -ENOMEM;
+- goto release_mem;
+- }
+- msdc_init_gpd_bd(host, &host->dma);
+-
+- INIT_DELAYED_WORK(&host->card_delaywork, msdc_tasklet_card);
+- spin_lock_init(&host->lock);
+- msdc_init_hw(host);
+-
+- /* TODO check weather flags 0 is correct, the mtk-sd driver uses
+- * IRQF_TRIGGER_LOW | IRQF_ONESHOT for flags
+- *
+- * for flags 0 the trigger polarity is determined by the
+- * device tree, but not the oneshot flag, but maybe it is also
+- * not needed because the soc could be oneshot safe.
+- */
+- ret = devm_request_irq(&pdev->dev, host->irq, msdc_irq, 0, pdev->name,
+- host);
+- if (ret)
+- goto release;
+-
+- platform_set_drvdata(pdev, mmc);
+-
+- ret = mmc_add_host(mmc);
+- if (ret)
+- goto release;
+-
+- /* Config card detection pin and enable interrupts */
+- if (hw->flags & MSDC_CD_PIN_EN) { /* set for card */
+- msdc_enable_cd_irq(host, 1);
+- } else {
+- msdc_enable_cd_irq(host, 0);
+- }
+-
+- return 0;
+-
+-release:
+- platform_set_drvdata(pdev, NULL);
+- msdc_deinit_hw(host);
+- cancel_delayed_work_sync(&host->card_delaywork);
+-
+-release_mem:
+- if (host->dma.gpd)
+- dma_free_coherent(&pdev->dev, MAX_GPD_NUM * sizeof(struct gpd),
+- host->dma.gpd, host->dma.gpd_addr);
+- if (host->dma.bd)
+- dma_free_coherent(&pdev->dev, MAX_BD_NUM * sizeof(struct bd),
+- host->dma.bd, host->dma.bd_addr);
+-host_free:
+- mmc_free_host(mmc);
+-
+- return ret;
+-}
+-
+-/* 4 device share one driver, using "drvdata" to show difference */
+-static int msdc_drv_remove(struct platform_device *pdev)
+-{
+- struct mmc_host *mmc;
+- struct msdc_host *host;
+-
+- mmc = platform_get_drvdata(pdev);
+- BUG_ON(!mmc);
+-
+- host = mmc_priv(mmc);
+- BUG_ON(!host);
+-
+- ERR_MSG("removed !!!");
+-
+- platform_set_drvdata(pdev, NULL);
+- mmc_remove_host(host->mmc);
+- msdc_deinit_hw(host);
+-
+- cancel_delayed_work_sync(&host->card_delaywork);
+-
+- dma_free_coherent(&pdev->dev, MAX_GPD_NUM * sizeof(struct gpd),
+- host->dma.gpd, host->dma.gpd_addr);
+- dma_free_coherent(&pdev->dev, MAX_BD_NUM * sizeof(struct bd),
+- host->dma.bd, host->dma.bd_addr);
+-
+- mmc_free_host(host->mmc);
+-
+- return 0;
+-}
+-
+-/* Fix me: Power Flow */
+-#ifdef CONFIG_PM
+-
+-static void msdc_drv_pm(struct platform_device *pdev, pm_message_t state)
+-{
+- struct mmc_host *mmc = platform_get_drvdata(pdev);
+- if (mmc) {
+- struct msdc_host *host = mmc_priv(mmc);
+- msdc_pm(state, (void *)host);
+- }
+-}
+-
+-static int msdc_drv_suspend(struct platform_device *pdev, pm_message_t state)
+-{
+- if (state.event == PM_EVENT_SUSPEND)
+- msdc_drv_pm(pdev, state);
+- return 0;
+-}
+-
+-static int msdc_drv_resume(struct platform_device *pdev)
+-{
+- struct pm_message state;
+-
+- state.event = PM_EVENT_RESUME;
+- msdc_drv_pm(pdev, state);
+- return 0;
+-}
+-#endif
+-
+-static const struct of_device_id mt7620_sdhci_match[] = {
+- { .compatible = "ralink,mt7620-sdhci" },
+- {},
+-};
+-MODULE_DEVICE_TABLE(of, mt7620_sdhci_match);
+-
+-static struct platform_driver mt_msdc_driver = {
+- .probe = msdc_drv_probe,
+- .remove = msdc_drv_remove,
+-#ifdef CONFIG_PM
+- .suspend = msdc_drv_suspend,
+- .resume = msdc_drv_resume,
+-#endif
+- .driver = {
+- .name = DRV_NAME,
+- .of_match_table = mt7620_sdhci_match,
+- },
+-};
+-
+-/*--------------------------------------------------------------------------*/
+-/* module init/exit */
+-/*--------------------------------------------------------------------------*/
+-static int __init mt_msdc_init(void)
+-{
+- int ret;
+- u32 reg;
+-
+- // Set the pins for sdxc to sdxc mode
+- //FIXME: this should be done by pinctl and not by the sd driver
+- reg = readl((void __iomem *)(RALINK_SYSCTL_BASE + 0x60)) & ~(0x3 << 18);
+- writel(reg, (void __iomem *)(RALINK_SYSCTL_BASE + 0x60));
+-
+- ret = platform_driver_register(&mt_msdc_driver);
+- if (ret) {
+- printk(KERN_ERR DRV_NAME ": Can't register driver");
+- return ret;
+- }
+-
+-#if defined(MT6575_SD_DEBUG)
+- msdc_debug_proc_init();
+-#endif
+- return 0;
+-}
+-
+-static void __exit mt_msdc_exit(void)
+-{
+- platform_driver_unregister(&mt_msdc_driver);
+-}
+-
+-module_init(mt_msdc_init);
+-module_exit(mt_msdc_exit);
+-MODULE_LICENSE("GPL");
+-MODULE_DESCRIPTION("MediaTek MT6575 SD/MMC Card Driver");
+-MODULE_AUTHOR("Infinity Chen <infinity.chen@mediatek.com>");
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index 8c577f0ae2bb3..b370144682ed5 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1782,7 +1782,7 @@ static void lateeoi_ack_dynirq(struct irq_data *data)
+
+ if (VALID_EVTCHN(evtchn)) {
+ do_mask(info, EVT_MASK_REASON_EOI_PENDING);
+- event_handler_exit(info);
++ ack_dynirq(data);
+ }
+ }
+
+@@ -1793,7 +1793,7 @@ static void lateeoi_mask_ack_dynirq(struct irq_data *data)
+
+ if (VALID_EVTCHN(evtchn)) {
+ do_mask(info, EVT_MASK_REASON_EXPLICIT);
+- event_handler_exit(info);
++ ack_dynirq(data);
+ }
+ }
+
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index 22cd68bd8c9b0..3cc2237e58967 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -1000,11 +1000,13 @@ void gfs2_freeze_func(struct work_struct *work)
+ static int gfs2_freeze(struct super_block *sb)
+ {
+ struct gfs2_sbd *sdp = sb->s_fs_info;
+- int error = 0;
++ int error;
+
+ mutex_lock(&sdp->sd_freeze_mutex);
+- if (atomic_read(&sdp->sd_freeze_state) != SFS_UNFROZEN)
++ if (atomic_read(&sdp->sd_freeze_state) != SFS_UNFROZEN) {
++ error = -EBUSY;
+ goto out;
++ }
+
+ if (test_bit(SDF_SHUTDOWN, &sdp->sd_flags)) {
+ error = -EINVAL;
+@@ -1046,10 +1048,10 @@ static int gfs2_unfreeze(struct super_block *sb)
+ struct gfs2_sbd *sdp = sb->s_fs_info;
+
+ mutex_lock(&sdp->sd_freeze_mutex);
+- if (atomic_read(&sdp->sd_freeze_state) != SFS_FROZEN ||
++ if (atomic_read(&sdp->sd_freeze_state) != SFS_FROZEN ||
+ !gfs2_holder_initialized(&sdp->sd_freeze_gh)) {
+ mutex_unlock(&sdp->sd_freeze_mutex);
+- return 0;
++ return -EINVAL;
+ }
+
+ gfs2_glock_dq_uninit(&sdp->sd_freeze_gh);
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index 10d8f95eb7712..fba56cd958961 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -1195,6 +1195,8 @@ static int translate_compat_table(struct net *net,
+ if (!newinfo)
+ goto out_unlock;
+
++ memset(newinfo->entries, 0, size);
++
+ newinfo->number = compatr->num_entries;
+ for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
+ newinfo->hook_entry[i] = compatr->hook_entry[i];
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index e77872c93c206..730a40dc829aa 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -1433,6 +1433,8 @@ translate_compat_table(struct net *net,
+ if (!newinfo)
+ goto out_unlock;
+
++ memset(newinfo->entries, 0, size);
++
+ newinfo->number = compatr->num_entries;
+ for (i = 0; i < NF_INET_NUMHOOKS; i++) {
+ newinfo->hook_entry[i] = compatr->hook_entry[i];
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index daf2e9e9193d1..dd0c1073dc8ee 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -1448,6 +1448,8 @@ translate_compat_table(struct net *net,
+ if (!newinfo)
+ goto out_unlock;
+
++ memset(newinfo->entries, 0, size);
++
+ newinfo->number = compatr->num_entries;
+ for (i = 0; i < NF_INET_NUMHOOKS; i++) {
+ newinfo->hook_entry[i] = compatr->hook_entry[i];
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index c9fe35118b33a..5dd6f6ce92e6b 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -738,7 +738,7 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
+ {
+ const struct xt_match *match = m->u.kernel.match;
+ struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
+- int pad, off = xt_compat_match_offset(match);
++ int off = xt_compat_match_offset(match);
+ u_int16_t msize = cm->u.user.match_size;
+ char name[sizeof(m->u.user.name)];
+
+@@ -748,9 +748,6 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
+ match->compat_from_user(m->data, cm->data);
+ else
+ memcpy(m->data, cm->data, msize - sizeof(*cm));
+- pad = XT_ALIGN(match->matchsize) - match->matchsize;
+- if (pad > 0)
+- memset(m->data + match->matchsize, 0, pad);
+
+ msize += off;
+ m->u.user.match_size = msize;
+@@ -1121,7 +1118,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
+ {
+ const struct xt_target *target = t->u.kernel.target;
+ struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
+- int pad, off = xt_compat_target_offset(target);
++ int off = xt_compat_target_offset(target);
+ u_int16_t tsize = ct->u.user.target_size;
+ char name[sizeof(t->u.user.name)];
+
+@@ -1131,9 +1128,6 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
+ target->compat_from_user(t->data, ct->data);
+ else
+ memcpy(t->data, ct->data, tsize - sizeof(*ct));
+- pad = XT_ALIGN(target->targetsize) - target->targetsize;
+- if (pad > 0)
+- memset(t->data + target->targetsize, 0, pad);
+
+ tsize += off;
+ t->u.user.target_size = tsize;
+diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
+index d3d3601f41cc6..769d11575a7b3 100644
+--- a/tools/perf/util/map.c
++++ b/tools/perf/util/map.c
+@@ -88,8 +88,7 @@ static inline bool replace_android_lib(const char *filename, char *newfilename)
+ if (!strncmp(filename, "/system/lib/", 12)) {
+ char *ndk, *app;
+ const char *arch;
+- size_t ndk_length;
+- size_t app_length;
++ int ndk_length, app_length;
+
+ ndk = getenv("NDK_ROOT");
+ app = getenv("APP_PLATFORM");
+@@ -117,8 +116,8 @@ static inline bool replace_android_lib(const char *filename, char *newfilename)
+ if (new_length > PATH_MAX)
+ return false;
+ snprintf(newfilename, new_length,
+- "%s/platforms/%s/arch-%s/usr/lib/%s",
+- ndk, app, arch, libname);
++ "%.*s/platforms/%.*s/arch-%s/usr/lib/%s",
++ ndk_length, ndk, app_length, app, arch, libname);
+
+ return true;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-04-28 11:44 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-04-28 11:44 UTC (permalink / raw
To: gentoo-commits
commit: 555c6226f41d9bb863aef0eee0db88f419e48695
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 28 11:44:02 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Apr 28 11:44:35 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=555c6226
Linux patch 4.19.189
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1188_linux-4.19.189.patch | 1590 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1594 insertions(+)
diff --git a/0000_README b/0000_README
index 32b1ad4..a3a9c1c 100644
--- a/0000_README
+++ b/0000_README
@@ -791,6 +791,10 @@ Patch: 1187_linux-4.19.188.patch
From: https://www.kernel.org
Desc: Linux 4.19.188
+Patch: 1188_linux-4.19.189.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.189
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1188_linux-4.19.189.patch b/1188_linux-4.19.189.patch
new file mode 100644
index 0000000..e63483d
--- /dev/null
+++ b/1188_linux-4.19.189.patch
@@ -0,0 +1,1590 @@
+diff --git a/Makefile b/Makefile
+index 85f071709a619..b19e0e7b7eb34 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 188
++SUBLEVEL = 189
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
+index 48685445002e7..da243420bcb58 100644
+--- a/arch/arc/kernel/signal.c
++++ b/arch/arc/kernel/signal.c
+@@ -99,7 +99,7 @@ stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs,
+ sizeof(sf->uc.uc_mcontext.regs.scratch));
+ err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t));
+
+- return err;
++ return err ? -EFAULT : 0;
+ }
+
+ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
+@@ -113,7 +113,7 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
+ &(sf->uc.uc_mcontext.regs.scratch),
+ sizeof(sf->uc.uc_mcontext.regs.scratch));
+ if (err)
+- return err;
++ return -EFAULT;
+
+ set_current_blocked(&set);
+ regs->bta = uregs.scratch.bta;
+diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
+index 4043ecb380168..0c8fcfb292bf9 100644
+--- a/arch/arm/boot/dts/omap3.dtsi
++++ b/arch/arm/boot/dts/omap3.dtsi
+@@ -23,6 +23,9 @@
+ i2c0 = &i2c1;
+ i2c1 = &i2c2;
+ i2c2 = &i2c3;
++ mmc0 = &mmc1;
++ mmc1 = &mmc2;
++ mmc2 = &mmc3;
+ serial0 = &uart1;
+ serial1 = &uart2;
+ serial2 = &uart3;
+diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
+index 8f907c235b02c..046e77024567b 100644
+--- a/arch/arm/boot/dts/omap4.dtsi
++++ b/arch/arm/boot/dts/omap4.dtsi
+@@ -25,6 +25,11 @@
+ i2c1 = &i2c2;
+ i2c2 = &i2c3;
+ i2c3 = &i2c4;
++ mmc0 = &mmc1;
++ mmc1 = &mmc2;
++ mmc2 = &mmc3;
++ mmc3 = &mmc4;
++ mmc4 = &mmc5;
+ serial0 = &uart1;
+ serial1 = &uart2;
+ serial2 = &uart3;
+diff --git a/arch/arm/boot/dts/omap44xx-clocks.dtsi b/arch/arm/boot/dts/omap44xx-clocks.dtsi
+index 279ff2f419df6..c654588f9e8cc 100644
+--- a/arch/arm/boot/dts/omap44xx-clocks.dtsi
++++ b/arch/arm/boot/dts/omap44xx-clocks.dtsi
+@@ -773,14 +773,6 @@
+ ti,max-div = <2>;
+ };
+
+- sha2md5_fck: sha2md5_fck@15c8 {
+- #clock-cells = <0>;
+- compatible = "ti,gate-clock";
+- clocks = <&l3_div_ck>;
+- ti,bit-shift = <1>;
+- reg = <0x15c8>;
+- };
+-
+ usb_phy_cm_clk32k: usb_phy_cm_clk32k@640 {
+ #clock-cells = <0>;
+ compatible = "ti,gate-clock";
+diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
+index 3c0bafe0fb05f..cf66c374de4f2 100644
+--- a/arch/arm/boot/dts/omap5.dtsi
++++ b/arch/arm/boot/dts/omap5.dtsi
+@@ -26,6 +26,11 @@
+ i2c2 = &i2c3;
+ i2c3 = &i2c4;
+ i2c4 = &i2c5;
++ mmc0 = &mmc1;
++ mmc1 = &mmc2;
++ mmc2 = &mmc3;
++ mmc3 = &mmc4;
++ mmc4 = &mmc5;
+ serial0 = &uart1;
+ serial1 = &uart2;
+ serial2 = &uart3;
+diff --git a/arch/arm/mach-footbridge/cats-pci.c b/arch/arm/mach-footbridge/cats-pci.c
+index 0b2fd7e2e9b42..90b1e9be430e9 100644
+--- a/arch/arm/mach-footbridge/cats-pci.c
++++ b/arch/arm/mach-footbridge/cats-pci.c
+@@ -15,14 +15,14 @@
+ #include <asm/mach-types.h>
+
+ /* cats host-specific stuff */
+-static int irqmap_cats[] __initdata = { IRQ_PCI, IRQ_IN0, IRQ_IN1, IRQ_IN3 };
++static int irqmap_cats[] = { IRQ_PCI, IRQ_IN0, IRQ_IN1, IRQ_IN3 };
+
+ static u8 cats_no_swizzle(struct pci_dev *dev, u8 *pin)
+ {
+ return 0;
+ }
+
+-static int __init cats_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
++static int cats_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
+ if (dev->irq >= 255)
+ return -1; /* not a valid interrupt. */
+diff --git a/arch/arm/mach-footbridge/ebsa285-pci.c b/arch/arm/mach-footbridge/ebsa285-pci.c
+index 6f28aaa9ca79b..c3f280d08fa7f 100644
+--- a/arch/arm/mach-footbridge/ebsa285-pci.c
++++ b/arch/arm/mach-footbridge/ebsa285-pci.c
+@@ -14,9 +14,9 @@
+ #include <asm/mach/pci.h>
+ #include <asm/mach-types.h>
+
+-static int irqmap_ebsa285[] __initdata = { IRQ_IN3, IRQ_IN1, IRQ_IN0, IRQ_PCI };
++static int irqmap_ebsa285[] = { IRQ_IN3, IRQ_IN1, IRQ_IN0, IRQ_PCI };
+
+-static int __init ebsa285_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
++static int ebsa285_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
+ if (dev->vendor == PCI_VENDOR_ID_CONTAQ &&
+ dev->device == PCI_DEVICE_ID_CONTAQ_82C693)
+diff --git a/arch/arm/mach-footbridge/netwinder-pci.c b/arch/arm/mach-footbridge/netwinder-pci.c
+index 9473aa0305e5f..e8304392074b8 100644
+--- a/arch/arm/mach-footbridge/netwinder-pci.c
++++ b/arch/arm/mach-footbridge/netwinder-pci.c
+@@ -18,7 +18,7 @@
+ * We now use the slot ID instead of the device identifiers to select
+ * which interrupt is routed where.
+ */
+-static int __init netwinder_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
++static int netwinder_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
+ switch (slot) {
+ case 0: /* host bridge */
+diff --git a/arch/arm/mach-footbridge/personal-pci.c b/arch/arm/mach-footbridge/personal-pci.c
+index 4391e433a4b2f..9d19aa98a663e 100644
+--- a/arch/arm/mach-footbridge/personal-pci.c
++++ b/arch/arm/mach-footbridge/personal-pci.c
+@@ -14,13 +14,12 @@
+ #include <asm/mach/pci.h>
+ #include <asm/mach-types.h>
+
+-static int irqmap_personal_server[] __initdata = {
++static int irqmap_personal_server[] = {
+ IRQ_IN0, IRQ_IN1, IRQ_IN2, IRQ_IN3, 0, 0, 0,
+ IRQ_DOORBELLHOST, IRQ_DMA1, IRQ_DMA2, IRQ_PCI
+ };
+
+-static int __init personal_server_map_irq(const struct pci_dev *dev, u8 slot,
+- u8 pin)
++static int personal_server_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
+ unsigned char line;
+
+diff --git a/arch/arm/mach-keystone/keystone.c b/arch/arm/mach-keystone/keystone.c
+index 84613abf35a33..79ff5b9534313 100644
+--- a/arch/arm/mach-keystone/keystone.c
++++ b/arch/arm/mach-keystone/keystone.c
+@@ -65,7 +65,7 @@ static void __init keystone_init(void)
+ static long long __init keystone_pv_fixup(void)
+ {
+ long long offset;
+- phys_addr_t mem_start, mem_end;
++ u64 mem_start, mem_end;
+
+ mem_start = memblock_start_of_DRAM();
+ mem_end = memblock_end_of_DRAM();
+@@ -78,7 +78,7 @@ static long long __init keystone_pv_fixup(void)
+ if (mem_start < KEYSTONE_HIGH_PHYS_START ||
+ mem_end > KEYSTONE_HIGH_PHYS_END) {
+ pr_crit("Invalid address space for memory (%08llx-%08llx)\n",
+- (u64)mem_start, (u64)mem_end);
++ mem_start, mem_end);
+ return 0;
+ }
+
+diff --git a/arch/arm/probes/uprobes/core.c b/arch/arm/probes/uprobes/core.c
+index bf992264060ef..b1b7b51c938c4 100644
+--- a/arch/arm/probes/uprobes/core.c
++++ b/arch/arm/probes/uprobes/core.c
+@@ -207,7 +207,7 @@ unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
+ static struct undef_hook uprobes_arm_break_hook = {
+ .instr_mask = 0x0fffffff,
+ .instr_val = (UPROBE_SWBP_ARM_INSN & 0x0fffffff),
+- .cpsr_mask = MODE_MASK,
++ .cpsr_mask = (PSR_T_BIT | MODE_MASK),
+ .cpsr_val = USR_MODE,
+ .fn = uprobe_trap_handler,
+ };
+@@ -215,7 +215,7 @@ static struct undef_hook uprobes_arm_break_hook = {
+ static struct undef_hook uprobes_arm_ss_hook = {
+ .instr_mask = 0x0fffffff,
+ .instr_val = (UPROBE_SS_ARM_INSN & 0x0fffffff),
+- .cpsr_mask = MODE_MASK,
++ .cpsr_mask = (PSR_T_BIT | MODE_MASK),
+ .cpsr_val = USR_MODE,
+ .fn = uprobe_trap_handler,
+ };
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+index 844f05b23115a..4fbbcdda70d76 100644
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -119,9 +119,9 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ .popsection
+ .subsection 1
+ 663: \insn2
+-664: .previous
+- .org . - (664b-663b) + (662b-661b)
++664: .org . - (664b-663b) + (662b-661b)
+ .org . - (662b-661b) + (664b-663b)
++ .previous
+ .endif
+ .endm
+
+@@ -191,11 +191,11 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ */
+ .macro alternative_endif
+ 664:
++ .org . - (664b-663b) + (662b-661b)
++ .org . - (662b-661b) + (664b-663b)
+ .if .Lasm_alt_mode==0
+ .previous
+ .endif
+- .org . - (664b-663b) + (662b-661b)
+- .org . - (662b-661b) + (664b-663b)
+ .endm
+
+ /*
+diff --git a/arch/arm64/include/asm/word-at-a-time.h b/arch/arm64/include/asm/word-at-a-time.h
+index b0d708ff7f4e5..a2601c1ccf435 100644
+--- a/arch/arm64/include/asm/word-at-a-time.h
++++ b/arch/arm64/include/asm/word-at-a-time.h
+@@ -64,7 +64,7 @@ static inline unsigned long find_zero(unsigned long mask)
+ */
+ static inline unsigned long load_unaligned_zeropad(const void *addr)
+ {
+- unsigned long ret, offset;
++ unsigned long ret, tmp;
+
+ /* Load word from unaligned pointer addr */
+ asm(
+@@ -72,9 +72,9 @@ static inline unsigned long load_unaligned_zeropad(const void *addr)
+ "2:\n"
+ " .pushsection .fixup,\"ax\"\n"
+ " .align 2\n"
+- "3: and %1, %2, #0x7\n"
+- " bic %2, %2, #0x7\n"
+- " ldr %0, [%2]\n"
++ "3: bic %1, %2, #0x7\n"
++ " ldr %0, [%1]\n"
++ " and %1, %2, #0x7\n"
+ " lsl %1, %1, #0x3\n"
+ #ifndef __AARCH64EB__
+ " lsr %0, %0, %1\n"
+@@ -84,7 +84,7 @@ static inline unsigned long load_unaligned_zeropad(const void *addr)
+ " b 2b\n"
+ " .popsection\n"
+ _ASM_EXTABLE(1b, 3b)
+- : "=&r" (ret), "=&r" (offset)
++ : "=&r" (ret), "=&r" (tmp)
+ : "r" (addr), "Q" (*(unsigned long *)addr));
+
+ return ret;
+diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c
+index 1928d5719e417..db3104c9fac53 100644
+--- a/arch/ia64/mm/discontig.c
++++ b/arch/ia64/mm/discontig.c
+@@ -96,7 +96,7 @@ static int __init build_node_maps(unsigned long start, unsigned long len,
+ * acpi_boot_init() (which builds the node_to_cpu_mask array) hasn't been
+ * called yet. Note that node 0 will also count all non-existent cpus.
+ */
+-static int __meminit early_nr_cpus_node(int node)
++static int early_nr_cpus_node(int node)
+ {
+ int cpu, n = 0;
+
+@@ -111,7 +111,7 @@ static int __meminit early_nr_cpus_node(int node)
+ * compute_pernodesize - compute size of pernode data
+ * @node: the node id.
+ */
+-static unsigned long __meminit compute_pernodesize(int node)
++static unsigned long compute_pernodesize(int node)
+ {
+ unsigned long pernodesize = 0, cpus;
+
+@@ -371,7 +371,7 @@ static void __init reserve_pernode_space(void)
+ }
+ }
+
+-static void __meminit scatter_node_data(void)
++static void scatter_node_data(void)
+ {
+ pg_data_t **dst;
+ int node;
+diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
+index 150130c897c39..7e6a9cf863c73 100644
+--- a/arch/s390/kernel/entry.S
++++ b/arch/s390/kernel/entry.S
+@@ -949,6 +949,7 @@ ENTRY(ext_int_handler)
+ * Load idle PSW. The second "half" of this function is in .Lcleanup_idle.
+ */
+ ENTRY(psw_idle)
++ stg %r14,(__SF_GPRS+8*8)(%r15)
+ stg %r3,__SF_EMPTY(%r15)
+ larl %r1,.Lpsw_idle_lpsw+4
+ stg %r1,__SF_EMPTY+8(%r15)
+diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
+index 8e4e8e423839a..c06074b847fa6 100644
+--- a/arch/x86/events/intel/uncore_snbep.c
++++ b/arch/x86/events/intel/uncore_snbep.c
+@@ -1030,7 +1030,6 @@ enum {
+ SNBEP_PCI_QPI_PORT0_FILTER,
+ SNBEP_PCI_QPI_PORT1_FILTER,
+ BDX_PCI_QPI_PORT2_FILTER,
+- HSWEP_PCI_PCU_3,
+ };
+
+ static int snbep_qpi_hw_config(struct intel_uncore_box *box, struct perf_event *event)
+@@ -2687,22 +2686,33 @@ static struct intel_uncore_type *hswep_msr_uncores[] = {
+ NULL,
+ };
+
+-void hswep_uncore_cpu_init(void)
++#define HSWEP_PCU_DID 0x2fc0
++#define HSWEP_PCU_CAPID4_OFFET 0x94
++#define hswep_get_chop(_cap) (((_cap) >> 6) & 0x3)
++
++static bool hswep_has_limit_sbox(unsigned int device)
+ {
+- int pkg = boot_cpu_data.logical_proc_id;
++ struct pci_dev *dev = pci_get_device(PCI_VENDOR_ID_INTEL, device, NULL);
++ u32 capid4;
++
++ if (!dev)
++ return false;
++
++ pci_read_config_dword(dev, HSWEP_PCU_CAPID4_OFFET, &capid4);
++ if (!hswep_get_chop(capid4))
++ return true;
+
++ return false;
++}
++
++void hswep_uncore_cpu_init(void)
++{
+ if (hswep_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores)
+ hswep_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores;
+
+ /* Detect 6-8 core systems with only two SBOXes */
+- if (uncore_extra_pci_dev[pkg].dev[HSWEP_PCI_PCU_3]) {
+- u32 capid4;
+-
+- pci_read_config_dword(uncore_extra_pci_dev[pkg].dev[HSWEP_PCI_PCU_3],
+- 0x94, &capid4);
+- if (((capid4 >> 6) & 0x3) == 0)
+- hswep_uncore_sbox.num_boxes = 2;
+- }
++ if (hswep_has_limit_sbox(HSWEP_PCU_DID))
++ hswep_uncore_sbox.num_boxes = 2;
+
+ uncore_msr_uncores = hswep_msr_uncores;
+ }
+@@ -2965,11 +2975,6 @@ static const struct pci_device_id hswep_uncore_pci_ids[] = {
+ .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+ SNBEP_PCI_QPI_PORT1_FILTER),
+ },
+- { /* PCU.3 (for Capability registers) */
+- PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fc0),
+- .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+- HSWEP_PCI_PCU_3),
+- },
+ { /* end: all zeroes */ }
+ };
+
+@@ -3061,27 +3066,18 @@ static struct event_constraint bdx_uncore_pcu_constraints[] = {
+ EVENT_CONSTRAINT_END
+ };
+
++#define BDX_PCU_DID 0x6fc0
++
+ void bdx_uncore_cpu_init(void)
+ {
+- int pkg = topology_phys_to_logical_pkg(boot_cpu_data.phys_proc_id);
+-
+ if (bdx_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores)
+ bdx_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores;
+ uncore_msr_uncores = bdx_msr_uncores;
+
+- /* BDX-DE doesn't have SBOX */
+- if (boot_cpu_data.x86_model == 86) {
+- uncore_msr_uncores[BDX_MSR_UNCORE_SBOX] = NULL;
+ /* Detect systems with no SBOXes */
+- } else if (uncore_extra_pci_dev[pkg].dev[HSWEP_PCI_PCU_3]) {
+- struct pci_dev *pdev;
+- u32 capid4;
+-
+- pdev = uncore_extra_pci_dev[pkg].dev[HSWEP_PCI_PCU_3];
+- pci_read_config_dword(pdev, 0x94, &capid4);
+- if (((capid4 >> 6) & 0x3) == 0)
+- bdx_msr_uncores[BDX_MSR_UNCORE_SBOX] = NULL;
+- }
++ if ((boot_cpu_data.x86_model == 86) || hswep_has_limit_sbox(BDX_PCU_DID))
++ uncore_msr_uncores[BDX_MSR_UNCORE_SBOX] = NULL;
++
+ hswep_uncore_pcu.constraints = bdx_uncore_pcu_constraints;
+ }
+
+@@ -3302,11 +3298,6 @@ static const struct pci_device_id bdx_uncore_pci_ids[] = {
+ .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+ BDX_PCI_QPI_PORT2_FILTER),
+ },
+- { /* PCU.3 (for Capability registers) */
+- PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x6fc0),
+- .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+- HSWEP_PCI_PCU_3),
+- },
+ { /* end: all zeroes */ }
+ };
+
+diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
+index f631a3f155875..91b3483e5085f 100644
+--- a/arch/x86/kernel/crash.c
++++ b/arch/x86/kernel/crash.c
+@@ -356,7 +356,7 @@ int crash_setup_memmap_entries(struct kimage *image, struct boot_params *params)
+ struct crash_memmap_data cmd;
+ struct crash_mem *cmem;
+
+- cmem = vzalloc(sizeof(struct crash_mem));
++ cmem = vzalloc(struct_size(cmem, ranges, 1));
+ if (!cmem)
+ return -ENOMEM;
+
+diff --git a/drivers/dma/dw/Kconfig b/drivers/dma/dw/Kconfig
+index 04b9728c1d269..070860ec0ef1d 100644
+--- a/drivers/dma/dw/Kconfig
++++ b/drivers/dma/dw/Kconfig
+@@ -8,6 +8,7 @@ config DW_DMAC_CORE
+
+ config DW_DMAC
+ tristate "Synopsys DesignWare AHB DMA platform driver"
++ depends on HAS_IOMEM
+ select DW_DMAC_CORE
+ help
+ Support the Synopsys DesignWare AHB DMA controller. This
+@@ -16,6 +17,7 @@ config DW_DMAC
+ config DW_DMAC_PCI
+ tristate "Synopsys DesignWare AHB DMA PCI driver"
+ depends on PCI
++ depends on HAS_IOMEM
+ select DW_DMAC_CORE
+ help
+ Support the Synopsys DesignWare AHB DMA controller on the
+diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
+index 3dbaf489a8a52..e0ccc79b239a5 100644
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -462,6 +462,8 @@ static ssize_t export_store(struct class *class,
+ long gpio;
+ struct gpio_desc *desc;
+ int status;
++ struct gpio_chip *gc;
++ int offset;
+
+ status = kstrtol(buf, 0, &gpio);
+ if (status < 0)
+@@ -473,6 +475,12 @@ static ssize_t export_store(struct class *class,
+ pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
+ return -EINVAL;
+ }
++ gc = desc->gdev->chip;
++ offset = gpio_chip_hwgpio(desc);
++ if (!gpiochip_line_is_valid(gc, offset)) {
++ pr_warn("%s: GPIO %ld masked\n", __func__, gpio);
++ return -EINVAL;
++ }
+
+ /* No extra locking here; FLAG_SYSFS just signifies that the
+ * request and export were done by on behalf of userspace, so
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index 776bbe9775e9d..ba513018534e3 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -1194,8 +1194,8 @@ static int a5xx_pm_suspend(struct msm_gpu *gpu)
+
+ static int a5xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+ {
+- *value = gpu_read64(gpu, REG_A5XX_RBBM_PERFCTR_CP_0_LO,
+- REG_A5XX_RBBM_PERFCTR_CP_0_HI);
++ *value = gpu_read64(gpu, REG_A5XX_RBBM_ALWAYSON_COUNTER_LO,
++ REG_A5XX_RBBM_ALWAYSON_COUNTER_HI);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index c629f742a1d19..c280fdc44939f 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -713,8 +713,8 @@ static int a6xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+ /* Force the GPU power on so we can read this register */
+ a6xx_gmu_set_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET);
+
+- *value = gpu_read64(gpu, REG_A6XX_RBBM_PERFCTR_CP_0_LO,
+- REG_A6XX_RBBM_PERFCTR_CP_0_HI);
++ *value = gpu_read64(gpu, REG_A6XX_CP_ALWAYS_ON_COUNTER_LO,
++ REG_A6XX_CP_ALWAYS_ON_COUNTER_HI);
+
+ a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET);
+ return 0;
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index f4cf541d13e08..3eddd8f73b577 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -766,6 +766,7 @@ static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi)
+
+ if (input_register_device(data->input2)) {
+ input_free_device(input2);
++ ret = -ENOENT;
+ goto exit;
+ }
+ }
+diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c
+index fab8fd7082e04..3e58d4c3cf2c0 100644
+--- a/drivers/hid/hid-google-hammer.c
++++ b/drivers/hid/hid-google-hammer.c
+@@ -118,6 +118,8 @@ static int hammer_input_configured(struct hid_device *hdev,
+ }
+
+ static const struct hid_device_id hammer_devices[] = {
++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_DON) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_HAMMER) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 2f1516b328372..68908dac5835e 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -478,6 +478,7 @@
+ #define USB_DEVICE_ID_GOOGLE_MASTERBALL 0x503c
+ #define USB_DEVICE_ID_GOOGLE_MAGNEMITE 0x503d
+ #define USB_DEVICE_ID_GOOGLE_MOONBALL 0x5044
++#define USB_DEVICE_ID_GOOGLE_DON 0x5050
+
+ #define USB_VENDOR_ID_GOTOP 0x08f2
+ #define USB_DEVICE_ID_SUPER_Q2 0x007f
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 274a55702784a..10524c93f8b62 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2496,7 +2496,7 @@ static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac,
+ !wacom_wac->shared->is_touch_on) {
+ if (!wacom_wac->shared->touch_down)
+ return;
+- prox = 0;
++ prox = false;
+ }
+
+ wacom_wac->hid_data.num_received++;
+@@ -3528,8 +3528,6 @@ int wacom_setup_pen_input_capabilities(struct input_dev *input_dev,
+ {
+ struct wacom_features *features = &wacom_wac->features;
+
+- input_dev->evbit[0] |= BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
+-
+ if (!(features->device_type & WACOM_DEVICETYPE_PEN))
+ return -ENODEV;
+
+@@ -3544,6 +3542,7 @@ int wacom_setup_pen_input_capabilities(struct input_dev *input_dev,
+ return 0;
+ }
+
++ input_dev->evbit[0] |= BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
+ __set_bit(BTN_TOUCH, input_dev->keybit);
+ __set_bit(ABS_MISC, input_dev->absbit);
+
+@@ -3694,8 +3693,6 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
+ {
+ struct wacom_features *features = &wacom_wac->features;
+
+- input_dev->evbit[0] |= BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
+-
+ if (!(features->device_type & WACOM_DEVICETYPE_TOUCH))
+ return -ENODEV;
+
+@@ -3708,6 +3705,7 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
+ /* setup has already been done */
+ return 0;
+
++ input_dev->evbit[0] |= BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
+ __set_bit(BTN_TOUCH, input_dev->keybit);
+
+ if (features->touch_max == 1) {
+diff --git a/drivers/input/keyboard/nspire-keypad.c b/drivers/input/keyboard/nspire-keypad.c
+index c7f26fa3034ca..cf138d836eec6 100644
+--- a/drivers/input/keyboard/nspire-keypad.c
++++ b/drivers/input/keyboard/nspire-keypad.c
+@@ -96,9 +96,15 @@ static irqreturn_t nspire_keypad_irq(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-static int nspire_keypad_chip_init(struct nspire_keypad *keypad)
++static int nspire_keypad_open(struct input_dev *input)
+ {
++ struct nspire_keypad *keypad = input_get_drvdata(input);
+ unsigned long val = 0, cycles_per_us, delay_cycles, row_delay_cycles;
++ int error;
++
++ error = clk_prepare_enable(keypad->clk);
++ if (error)
++ return error;
+
+ cycles_per_us = (clk_get_rate(keypad->clk) / 1000000);
+ if (cycles_per_us == 0)
+@@ -124,30 +130,6 @@ static int nspire_keypad_chip_init(struct nspire_keypad *keypad)
+ keypad->int_mask = 1 << 1;
+ writel(keypad->int_mask, keypad->reg_base + KEYPAD_INTMSK);
+
+- /* Disable GPIO interrupts to prevent hanging on touchpad */
+- /* Possibly used to detect touchpad events */
+- writel(0, keypad->reg_base + KEYPAD_UNKNOWN_INT);
+- /* Acknowledge existing interrupts */
+- writel(~0, keypad->reg_base + KEYPAD_UNKNOWN_INT_STS);
+-
+- return 0;
+-}
+-
+-static int nspire_keypad_open(struct input_dev *input)
+-{
+- struct nspire_keypad *keypad = input_get_drvdata(input);
+- int error;
+-
+- error = clk_prepare_enable(keypad->clk);
+- if (error)
+- return error;
+-
+- error = nspire_keypad_chip_init(keypad);
+- if (error) {
+- clk_disable_unprepare(keypad->clk);
+- return error;
+- }
+-
+ return 0;
+ }
+
+@@ -155,6 +137,11 @@ static void nspire_keypad_close(struct input_dev *input)
+ {
+ struct nspire_keypad *keypad = input_get_drvdata(input);
+
++ /* Disable interrupts */
++ writel(0, keypad->reg_base + KEYPAD_INTMSK);
++ /* Acknowledge existing interrupts */
++ writel(~0, keypad->reg_base + KEYPAD_INT);
++
+ clk_disable_unprepare(keypad->clk);
+ }
+
+@@ -215,6 +202,25 @@ static int nspire_keypad_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
++ error = clk_prepare_enable(keypad->clk);
++ if (error) {
++ dev_err(&pdev->dev, "failed to enable clock\n");
++ return error;
++ }
++
++ /* Disable interrupts */
++ writel(0, keypad->reg_base + KEYPAD_INTMSK);
++ /* Acknowledge existing interrupts */
++ writel(~0, keypad->reg_base + KEYPAD_INT);
++
++ /* Disable GPIO interrupts to prevent hanging on touchpad */
++ /* Possibly used to detect touchpad events */
++ writel(0, keypad->reg_base + KEYPAD_UNKNOWN_INT);
++ /* Acknowledge existing GPIO interrupts */
++ writel(~0, keypad->reg_base + KEYPAD_UNKNOWN_INT_STS);
++
++ clk_disable_unprepare(keypad->clk);
++
+ input_set_drvdata(input, keypad);
+
+ input->id.bustype = BUS_HOST;
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 0463ab79160b7..f20e54f41dde9 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -592,6 +592,7 @@ static const struct dmi_system_id i8042_dmi_noselftest_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_CHASSIS_TYPE, "10"), /* Notebook */
+ },
++ }, {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
+diff --git a/drivers/input/touchscreen/s6sy761.c b/drivers/input/touchscreen/s6sy761.c
+index b63d7fdf0cd20..85a1f465c097e 100644
+--- a/drivers/input/touchscreen/s6sy761.c
++++ b/drivers/input/touchscreen/s6sy761.c
+@@ -145,8 +145,8 @@ static void s6sy761_report_coordinates(struct s6sy761_data *sdata,
+ u8 major = event[4];
+ u8 minor = event[5];
+ u8 z = event[6] & S6SY761_MASK_Z;
+- u16 x = (event[1] << 3) | ((event[3] & S6SY761_MASK_X) >> 4);
+- u16 y = (event[2] << 3) | (event[3] & S6SY761_MASK_Y);
++ u16 x = (event[1] << 4) | ((event[3] & S6SY761_MASK_X) >> 4);
++ u16 y = (event[2] << 4) | (event[3] & S6SY761_MASK_Y);
+
+ input_mt_slot(sdata->input, tid);
+
+diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
+index dd7684333d90a..a433f5824f188 100644
+--- a/drivers/md/dm-verity-fec.c
++++ b/drivers/md/dm-verity-fec.c
+@@ -69,7 +69,7 @@ static u8 *fec_read_parity(struct dm_verity *v, u64 rsb, int index,
+ u8 *res;
+
+ position = (index + rsb) * v->fec->roots;
+- block = div64_u64_rem(position, v->fec->roots << SECTOR_SHIFT, &rem);
++ block = div64_u64_rem(position, v->fec->io_size, &rem);
+ *offset = (unsigned)rem;
+
+ res = dm_bufio_read(v->fec->bufio, block, buf);
+@@ -158,7 +158,7 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio,
+
+ /* read the next block when we run out of parity bytes */
+ offset += v->fec->roots;
+- if (offset >= v->fec->roots << SECTOR_SHIFT) {
++ if (offset >= v->fec->io_size) {
+ dm_bufio_release(buf);
+
+ par = fec_read_parity(v, rsb, block_offset, &offset, &buf);
+@@ -743,8 +743,13 @@ int verity_fec_ctr(struct dm_verity *v)
+ return -E2BIG;
+ }
+
++ if ((f->roots << SECTOR_SHIFT) & ((1 << v->data_dev_block_bits) - 1))
++ f->io_size = 1 << v->data_dev_block_bits;
++ else
++ f->io_size = v->fec->roots << SECTOR_SHIFT;
++
+ f->bufio = dm_bufio_client_create(f->dev->bdev,
+- f->roots << SECTOR_SHIFT,
++ f->io_size,
+ 1, 0, NULL, NULL);
+ if (IS_ERR(f->bufio)) {
+ ti->error = "Cannot initialize FEC bufio client";
+diff --git a/drivers/md/dm-verity-fec.h b/drivers/md/dm-verity-fec.h
+index 6ad803b2b36ca..b9f0bb0f63c42 100644
+--- a/drivers/md/dm-verity-fec.h
++++ b/drivers/md/dm-verity-fec.h
+@@ -40,6 +40,7 @@ struct dm_verity_fec {
+ struct dm_dev *dev; /* parity data device */
+ struct dm_bufio_client *data_bufio; /* for data dev access */
+ struct dm_bufio_client *bufio; /* for parity data access */
++ size_t io_size; /* IO size for roots */
+ sector_t start; /* parity data start in blocks */
+ sector_t blocks; /* number of blocks covered */
+ sector_t rounds; /* number of interleaving rounds */
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index e04b7fa068aff..67c0ad3b80795 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2634,10 +2634,17 @@ unlock:
+ return err;
+ }
+
++/* prod_id for switch families which do not have a PHY model number */
++static const u16 family_prod_id_table[] = {
++ [MV88E6XXX_FAMILY_6341] = MV88E6XXX_PORT_SWITCH_ID_PROD_6341,
++ [MV88E6XXX_FAMILY_6390] = MV88E6XXX_PORT_SWITCH_ID_PROD_6390,
++};
++
+ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg)
+ {
+ struct mv88e6xxx_mdio_bus *mdio_bus = bus->priv;
+ struct mv88e6xxx_chip *chip = mdio_bus->chip;
++ u16 prod_id;
+ u16 val;
+ int err;
+
+@@ -2648,23 +2655,12 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg)
+ err = chip->info->ops->phy_read(chip, bus, phy, reg, &val);
+ mutex_unlock(&chip->reg_lock);
+
+- if (reg == MII_PHYSID2) {
+- /* Some internal PHYs don't have a model number. */
+- if (chip->info->family != MV88E6XXX_FAMILY_6165)
+- /* Then there is the 6165 family. It gets is
+- * PHYs correct. But it can also have two
+- * SERDES interfaces in the PHY address
+- * space. And these don't have a model
+- * number. But they are not PHYs, so we don't
+- * want to give them something a PHY driver
+- * will recognise.
+- *
+- * Use the mv88e6390 family model number
+- * instead, for anything which really could be
+- * a PHY,
+- */
+- if (!(val & 0x3f0))
+- val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4;
++ /* Some internal PHYs don't have a model number. */
++ if (reg == MII_PHYSID2 && !(val & 0x3f0) &&
++ chip->info->family < ARRAY_SIZE(family_prod_id_table)) {
++ prod_id = family_prod_id_table[chip->info->family];
++ if (prod_id)
++ val |= prod_id >> 4;
+ }
+
+ return err ? err : val;
+diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
+index f5ad12c109344..da84660ceae1f 100644
+--- a/drivers/net/ethernet/amd/pcnet32.c
++++ b/drivers/net/ethernet/amd/pcnet32.c
+@@ -1548,8 +1548,7 @@ pcnet32_probe_pci(struct pci_dev *pdev, const struct pci_device_id *ent)
+ }
+ pci_set_master(pdev);
+
+- ioaddr = pci_resource_start(pdev, 0);
+- if (!ioaddr) {
++ if (!pci_resource_len(pdev, 0)) {
+ if (pcnet32_debug & NETIF_MSG_PROBE)
+ pr_err("card has no PCI IO resources, aborting\n");
+ err = -ENODEV;
+@@ -1562,6 +1561,8 @@ pcnet32_probe_pci(struct pci_dev *pdev, const struct pci_device_id *ent)
+ pr_err("architecture does not support 32bit PCI busmaster DMA\n");
+ goto err_disable_dev;
+ }
++
++ ioaddr = pci_resource_start(pdev, 0);
+ if (!request_region(ioaddr, PCNET32_TOTAL_SIZE, "pcnet32_probe_pci")) {
+ if (pcnet32_debug & NETIF_MSG_PROBE)
+ pr_err("io address range already allocated\n");
+diff --git a/drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h b/drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h
+index b248966837b4c..7aad40b2aa736 100644
+--- a/drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h
++++ b/drivers/net/ethernet/cavium/liquidio/cn66xx_regs.h
+@@ -412,7 +412,7 @@
+ | CN6XXX_INTR_M0UNWI_ERR \
+ | CN6XXX_INTR_M1UPB0_ERR \
+ | CN6XXX_INTR_M1UPWI_ERR \
+- | CN6XXX_INTR_M1UPB0_ERR \
++ | CN6XXX_INTR_M1UNB0_ERR \
+ | CN6XXX_INTR_M1UNWI_ERR \
+ | CN6XXX_INTR_INSTR_DB_OF_ERR \
+ | CN6XXX_INTR_SLIST_DB_OF_ERR \
+diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
+index a339ea2fd4961..8b07890b0b232 100644
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -1482,8 +1482,10 @@ dm9000_probe(struct platform_device *pdev)
+
+ /* Init network device */
+ ndev = alloc_etherdev(sizeof(struct board_info));
+- if (!ndev)
+- return -ENOMEM;
++ if (!ndev) {
++ ret = -ENOMEM;
++ goto out_regulator_disable;
++ }
+
+ SET_NETDEV_DEV(ndev, &pdev->dev);
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 0c7c0206b1be5..9f72cd3b1d244 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1092,19 +1092,13 @@ static int __ibmvnic_open(struct net_device *netdev)
+
+ rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_UP);
+ if (rc) {
+- for (i = 0; i < adapter->req_rx_queues; i++)
+- napi_disable(&adapter->napi[i]);
++ ibmvnic_napi_disable(adapter);
+ release_resources(adapter);
+ return rc;
+ }
+
+ netif_tx_start_all_queues(netdev);
+
+- if (prev_state == VNIC_CLOSED) {
+- for (i = 0; i < adapter->req_rx_queues; i++)
+- napi_schedule(&adapter->napi[i]);
+- }
+-
+ adapter->state = VNIC_OPEN;
+ return rc;
+ }
+@@ -1761,7 +1755,7 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ u64 old_num_rx_queues, old_num_tx_queues;
+ u64 old_num_rx_slots, old_num_tx_slots;
+ struct net_device *netdev = adapter->netdev;
+- int i, rc;
++ int rc;
+
+ netdev_dbg(adapter->netdev, "Re-setting driver (%d)\n",
+ rwi->reset_reason);
+@@ -1879,10 +1873,6 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ /* refresh device's multicast list */
+ ibmvnic_set_multi(netdev);
+
+- /* kick napi */
+- for (i = 0; i < adapter->req_rx_queues; i++)
+- napi_schedule(&adapter->napi[i]);
+-
+ if (adapter->reset_reason != VNIC_RESET_FAILOVER &&
+ adapter->reset_reason != VNIC_RESET_CHANGE_PARAM) {
+ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 1591f81d8ae3b..fa0e7582159ff 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -11211,6 +11211,7 @@ static int i40e_sw_init(struct i40e_pf *pf)
+ {
+ int err = 0;
+ int size;
++ u16 pow;
+
+ /* Set default capability flags */
+ pf->flags = I40E_FLAG_RX_CSUM_ENABLED |
+@@ -11229,6 +11230,11 @@ static int i40e_sw_init(struct i40e_pf *pf)
+ pf->rss_table_size = pf->hw.func_caps.rss_table_size;
+ pf->rss_size_max = min_t(int, pf->rss_size_max,
+ pf->hw.func_caps.num_tx_qp);
++
++ /* find the next higher power-of-2 of num cpus */
++ pow = roundup_pow_of_two(num_online_cpus());
++ pf->rss_size_max = min_t(int, pf->rss_size_max, pow);
++
+ if (pf->hw.func_caps.rss) {
+ pf->flags |= I40E_FLAG_RSS_ENABLED;
+ pf->alloc_rss_size = min_t(int, pf->rss_size_max,
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 2e2afc824a6a8..ce6fecf421f86 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -839,6 +839,9 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ __be16 df;
+ int err;
+
++ if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
++ return -EINVAL;
++
+ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+ rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info,
+ geneve->info.key.tp_dst, sport);
+@@ -882,6 +885,9 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ __be16 sport;
+ int err;
+
++ if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
++ return -EINVAL;
++
+ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+ dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info,
+ geneve->info.key.tp_dst, sport);
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index bb6107f3b947b..832a401c5fa56 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -2329,9 +2329,30 @@ static struct phy_driver marvell_drivers[] = {
+ .get_stats = marvell_get_stats,
+ },
+ {
+- .phy_id = MARVELL_PHY_ID_88E6390,
++ .phy_id = MARVELL_PHY_ID_88E6341_FAMILY,
+ .phy_id_mask = MARVELL_PHY_ID_MASK,
+- .name = "Marvell 88E6390",
++ .name = "Marvell 88E6341 Family",
++ .features = PHY_GBIT_FEATURES,
++ .flags = PHY_HAS_INTERRUPT,
++ .probe = m88e1510_probe,
++ .config_init = &marvell_config_init,
++ .config_aneg = &m88e6390_config_aneg,
++ .read_status = &marvell_read_status,
++ .ack_interrupt = &marvell_ack_interrupt,
++ .config_intr = &marvell_config_intr,
++ .did_interrupt = &m88e1121_did_interrupt,
++ .resume = &genphy_resume,
++ .suspend = &genphy_suspend,
++ .read_page = marvell_read_page,
++ .write_page = marvell_write_page,
++ .get_sset_count = marvell_get_sset_count,
++ .get_strings = marvell_get_strings,
++ .get_stats = marvell_get_stats,
++ },
++ {
++ .phy_id = MARVELL_PHY_ID_88E6390_FAMILY,
++ .phy_id_mask = MARVELL_PHY_ID_MASK,
++ .name = "Marvell 88E6390 Family",
+ .features = PHY_GBIT_FEATURES,
+ .flags = PHY_HAS_INTERRUPT,
+ .probe = m88e6390_probe,
+@@ -2368,7 +2389,8 @@ static struct mdio_device_id __maybe_unused marvell_tbl[] = {
+ { MARVELL_PHY_ID_88E1540, MARVELL_PHY_ID_MASK },
+ { MARVELL_PHY_ID_88E1545, MARVELL_PHY_ID_MASK },
+ { MARVELL_PHY_ID_88E3016, MARVELL_PHY_ID_MASK },
+- { MARVELL_PHY_ID_88E6390, MARVELL_PHY_ID_MASK },
++ { MARVELL_PHY_ID_88E6341_FAMILY, MARVELL_PHY_ID_MASK },
++ { MARVELL_PHY_ID_88E6390_FAMILY, MARVELL_PHY_ID_MASK },
+ { }
+ };
+
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index 2eb33d2bb7ad4..94f1c2422f844 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -3114,7 +3114,7 @@ static void hso_free_interface(struct usb_interface *interface)
+ cancel_work_sync(&serial_table[i]->async_put_intf);
+ cancel_work_sync(&serial_table[i]->async_get_intf);
+ hso_serial_tty_unregister(serial);
+- kref_put(&serial_table[i]->ref, hso_serial_ref_free);
++ kref_put(&serial->parent->ref, hso_serial_ref_free);
+ }
+ }
+
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index 107bbd4ae825e..78c56149559ce 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -1043,11 +1043,15 @@ static void connect(struct backend_info *be)
+ xenvif_carrier_on(be->vif);
+
+ unregister_hotplug_status_watch(be);
+- err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, NULL,
+- hotplug_status_changed,
+- "%s/%s", dev->nodename, "hotplug-status");
+- if (!err)
++ if (xenbus_exists(XBT_NIL, dev->nodename, "hotplug-status")) {
++ err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
++ NULL, hotplug_status_changed,
++ "%s/%s", dev->nodename,
++ "hotplug-status");
++ if (err)
++ goto err;
+ be->have_hotplug_status_watch = 1;
++ }
+
+ netif_tx_wake_all_queues(be->vif->dev);
+
+diff --git a/drivers/pinctrl/intel/pinctrl-lewisburg.c b/drivers/pinctrl/intel/pinctrl-lewisburg.c
+index dc32c22bf19fa..8388aa671b21a 100644
+--- a/drivers/pinctrl/intel/pinctrl-lewisburg.c
++++ b/drivers/pinctrl/intel/pinctrl-lewisburg.c
+@@ -297,9 +297,9 @@ static const struct pinctrl_pin_desc lbg_pins[] = {
+ static const struct intel_community lbg_communities[] = {
+ LBG_COMMUNITY(0, 0, 71),
+ LBG_COMMUNITY(1, 72, 132),
+- LBG_COMMUNITY(3, 133, 144),
+- LBG_COMMUNITY(4, 145, 180),
+- LBG_COMMUNITY(5, 181, 246),
++ LBG_COMMUNITY(3, 133, 143),
++ LBG_COMMUNITY(4, 144, 178),
++ LBG_COMMUNITY(5, 179, 246),
+ };
+
+ static const struct intel_pinctrl_soc_data lbg_soc_data = {
+diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
+index d82698b7dfe6c..e032af6547334 100644
+--- a/drivers/scsi/libsas/sas_ata.c
++++ b/drivers/scsi/libsas/sas_ata.c
+@@ -215,18 +215,17 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
+ memcpy(task->ata_task.atapi_packet, qc->cdb, qc->dev->cdb_len);
+ task->total_xfer_len = qc->nbytes;
+ task->num_scatter = qc->n_elem;
++ task->data_dir = qc->dma_dir;
++ } else if (qc->tf.protocol == ATA_PROT_NODATA) {
++ task->data_dir = DMA_NONE;
+ } else {
+ for_each_sg(qc->sg, sg, qc->n_elem, si)
+ xfer += sg_dma_len(sg);
+
+ task->total_xfer_len = xfer;
+ task->num_scatter = si;
+- }
+-
+- if (qc->tf.protocol == ATA_PROT_NODATA)
+- task->data_dir = DMA_NONE;
+- else
+ task->data_dir = qc->dma_dir;
++ }
+ task->scatter = qc->sg;
+ task->ata_task.retry_count = 1;
+ task->task_state_flags = SAS_TASK_STATE_PENDING;
+diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
+index 2aaf1b7103981..9ac89462a8e02 100644
+--- a/drivers/scsi/scsi_transport_srp.c
++++ b/drivers/scsi/scsi_transport_srp.c
+@@ -555,7 +555,7 @@ int srp_reconnect_rport(struct srp_rport *rport)
+ res = mutex_lock_interruptible(&rport->mutex);
+ if (res)
+ goto out;
+- if (rport->state != SRP_RPORT_FAIL_FAST)
++ if (rport->state != SRP_RPORT_FAIL_FAST && rport->state != SRP_RPORT_LOST)
+ /*
+ * sdev state must be SDEV_TRANSPORT_OFFLINE, transition
+ * to SDEV_BLOCK is illegal. Calling scsi_target_unblock()
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index a1fa16a03ab9d..7f4f21ba8efcf 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1682,12 +1682,13 @@ static int acm_resume(struct usb_interface *intf)
+ struct urb *urb;
+ int rv = 0;
+
+- acm_unpoison_urbs(acm);
+ spin_lock_irq(&acm->write_lock);
+
+ if (--acm->susp_count)
+ goto out;
+
++ acm_unpoison_urbs(acm);
++
+ if (tty_port_initialized(&acm->port)) {
+ rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC);
+
+diff --git a/fs/readdir.c b/fs/readdir.c
+index 443270f635f43..3c5ce8a0ddc99 100644
+--- a/fs/readdir.c
++++ b/fs/readdir.c
+@@ -132,6 +132,9 @@ static int fillonedir(struct dir_context *ctx, const char *name, int namlen,
+
+ if (buf->result)
+ return -EINVAL;
++ buf->result = verify_dirent_name(name, namlen);
++ if (buf->result < 0)
++ return buf->result;
+ d_ino = ino;
+ if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
+ buf->result = -EOVERFLOW;
+@@ -398,6 +401,9 @@ static int compat_fillonedir(struct dir_context *ctx, const char *name,
+
+ if (buf->result)
+ return -EINVAL;
++ buf->result = verify_dirent_name(name, namlen);
++ if (buf->result < 0)
++ return buf->result;
+ d_ino = ino;
+ if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
+ buf->result = -EOVERFLOW;
+diff --git a/include/linux/marvell_phy.h b/include/linux/marvell_phy.h
+index 1eb6f244588da..9a488497ebc29 100644
+--- a/include/linux/marvell_phy.h
++++ b/include/linux/marvell_phy.h
+@@ -21,11 +21,12 @@
+ #define MARVELL_PHY_ID_88E1545 0x01410ea0
+ #define MARVELL_PHY_ID_88E3016 0x01410e60
+
+-/* The MV88e6390 Ethernet switch contains embedded PHYs. These PHYs do
++/* These Ethernet switch families contain embedded PHYs, but they do
+ * not have a model ID. So the switch driver traps reads to the ID2
+ * register and returns the switch family ID
+ */
+-#define MARVELL_PHY_ID_88E6390 0x01410f90
++#define MARVELL_PHY_ID_88E6341_FAMILY 0x01410f41
++#define MARVELL_PHY_ID_88E6390_FAMILY 0x01410f90
+
+ #define MARVELL_PHY_FAMILY_ID(id) ((id) >> 4)
+
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 8a1758b094b70..126c6d524a0f2 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -722,7 +722,8 @@ static bool assign_lock_key(struct lockdep_map *lock)
+ /* Debug-check: all keys must be persistent! */
+ debug_locks_off();
+ pr_err("INFO: trying to register non-static key.\n");
+- pr_err("the code is fine but needs lockdep annotation.\n");
++ pr_err("The code is fine but needs lockdep annotation, or maybe\n");
++ pr_err("you didn't initialize this object before use?\n");
+ pr_err("turning off the locking correctness validator.\n");
+ dump_stack();
+ return false;
+diff --git a/kernel/locking/qrwlock.c b/kernel/locking/qrwlock.c
+index c7471c3fb7989..16c09cda3b02e 100644
+--- a/kernel/locking/qrwlock.c
++++ b/kernel/locking/qrwlock.c
+@@ -70,6 +70,8 @@ EXPORT_SYMBOL(queued_read_lock_slowpath);
+ */
+ void queued_write_lock_slowpath(struct qrwlock *lock)
+ {
++ int cnts;
++
+ /* Put the writer into the wait queue */
+ arch_spin_lock(&lock->wait_lock);
+
+@@ -83,9 +85,8 @@ void queued_write_lock_slowpath(struct qrwlock *lock)
+
+ /* When no more readers or writers, set the locked flag */
+ do {
+- atomic_cond_read_acquire(&lock->cnts, VAL == _QW_WAITING);
+- } while (atomic_cmpxchg_relaxed(&lock->cnts, _QW_WAITING,
+- _QW_LOCKED) != _QW_WAITING);
++ cnts = atomic_cond_read_relaxed(&lock->cnts, VAL == _QW_WAITING);
++ } while (!atomic_try_cmpxchg_acquire(&lock->cnts, &cnts, _QW_LOCKED));
+ unlock:
+ arch_spin_unlock(&lock->wait_lock);
+ }
+diff --git a/mm/gup.c b/mm/gup.c
+index f3088d25bd926..44569927f0ea1 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -61,13 +61,22 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address,
+ }
+
+ /*
+- * FOLL_FORCE can write to even unwritable pte's, but only
+- * after we've gone through a COW cycle and they are dirty.
++ * FOLL_FORCE or a forced COW break can write even to unwritable pte's,
++ * but only after we've gone through a COW cycle and they are dirty.
+ */
+ static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
+ {
+- return pte_write(pte) ||
+- ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
++ return pte_write(pte) || ((flags & FOLL_COW) && pte_dirty(pte));
++}
++
++/*
++ * A (separate) COW fault might break the page the other way and
++ * get_user_pages() would return the page from what is now the wrong
++ * VM. So we need to force a COW break at GUP time even for reads.
++ */
++static inline bool should_force_cow_break(struct vm_area_struct *vma, unsigned int flags)
++{
++ return is_cow_mapping(vma->vm_flags) && (flags & FOLL_GET);
+ }
+
+ static struct page *follow_page_pte(struct vm_area_struct *vma,
+@@ -710,12 +719,18 @@ static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ if (!vma || check_vma_flags(vma, gup_flags))
+ return i ? : -EFAULT;
+ if (is_vm_hugetlb_page(vma)) {
++ if (should_force_cow_break(vma, foll_flags))
++ foll_flags |= FOLL_WRITE;
+ i = follow_hugetlb_page(mm, vma, pages, vmas,
+ &start, &nr_pages, i,
+- gup_flags, nonblocking);
++ foll_flags, nonblocking);
+ continue;
+ }
+ }
++
++ if (should_force_cow_break(vma, foll_flags))
++ foll_flags |= FOLL_WRITE;
++
+ retry:
+ /*
+ * If we have a pending SIGKILL, don't keep faulting pages and
+@@ -1804,6 +1819,10 @@ bool gup_fast_permitted(unsigned long start, int nr_pages, int write)
+ * the regular GUP.
+ * Note a difference with get_user_pages_fast: this always returns the
+ * number of pages pinned, 0 if no pages were pinned.
++ *
++ * Careful, careful! COW breaking can go either way, so a non-write
++ * access can get ambiguous page results. If you call this function without
++ * 'write' set, you'd better be sure that you're ok with that ambiguity.
+ */
+ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ struct page **pages)
+@@ -1831,6 +1850,12 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ *
+ * We do not adopt an rcu_read_lock(.) here as we also want to
+ * block IPIs that come from THPs splitting.
++ *
++ * NOTE! We allow read-only gup_fast() here, but you'd better be
++ * careful about possible COW pages. You'll get _a_ COW page, but
++ * not necessarily the one you intended to get depending on what
++ * COW event happens after this. COW may break the page copy in a
++ * random direction.
+ */
+
+ if (gup_fast_permitted(start, nr_pages, write)) {
+@@ -1876,9 +1901,16 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ (void __user *)start, len)))
+ return -EFAULT;
+
++ /*
++ * The FAST_GUP case requires FOLL_WRITE even for pure reads,
++ * because get_user_pages() may need to cause an early COW in
++ * order to avoid confusing the normal COW routines. So only
++ * targets that are already writable are safe to do by just
++ * looking at the page tables.
++ */
+ if (gup_fast_permitted(start, nr_pages, write)) {
+ local_irq_disable();
+- gup_pgd_range(addr, end, write, pages, &nr);
++ gup_pgd_range(addr, end, 1, pages, &nr);
+ local_irq_enable();
+ ret = nr;
+ }
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index cf9e2bbffdc1a..7c374c0fcf0c7 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1432,13 +1432,12 @@ out_unlock:
+ }
+
+ /*
+- * FOLL_FORCE can write to even unwritable pmd's, but only
+- * after we've gone through a COW cycle and they are dirty.
++ * FOLL_FORCE or a forced COW break can write even to unwritable pmd's,
++ * but only after we've gone through a COW cycle and they are dirty.
+ */
+ static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags)
+ {
+- return pmd_write(pmd) ||
+- ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd));
++ return pmd_write(pmd) || ((flags & FOLL_COW) && pmd_dirty(pmd));
+ }
+
+ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 6e890f51b7d86..e471c32e448f6 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1271,7 +1271,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ * we can reinject the packet there.
+ */
+ n2 = NULL;
+- if (dst) {
++ if (dst && dst->obsolete != DST_OBSOLETE_DEAD) {
+ n2 = dst_neigh_lookup_skb(dst, skb);
+ if (n2)
+ n1 = n2;
+diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
+index b10b297e76b78..b1c55db737648 100644
+--- a/net/ieee802154/nl802154.c
++++ b/net/ieee802154/nl802154.c
+@@ -1516,6 +1516,11 @@ nl802154_dump_llsec_key(struct sk_buff *skb, struct netlink_callback *cb)
+ if (err)
+ return err;
+
++ if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
++ err = skb->len;
++ goto out_err;
++ }
++
+ if (!wpan_dev->netdev) {
+ err = -EINVAL;
+ goto out_err;
+@@ -1688,6 +1693,11 @@ nl802154_dump_llsec_dev(struct sk_buff *skb, struct netlink_callback *cb)
+ if (err)
+ return err;
+
++ if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
++ err = skb->len;
++ goto out_err;
++ }
++
+ if (!wpan_dev->netdev) {
+ err = -EINVAL;
+ goto out_err;
+@@ -1775,6 +1785,9 @@ static int nl802154_add_llsec_dev(struct sk_buff *skb, struct genl_info *info)
+ struct wpan_dev *wpan_dev = dev->ieee802154_ptr;
+ struct ieee802154_llsec_device dev_desc;
+
++ if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
++ return -EOPNOTSUPP;
++
+ if (ieee802154_llsec_parse_device(info->attrs[NL802154_ATTR_SEC_DEVICE],
+ &dev_desc) < 0)
+ return -EINVAL;
+@@ -1861,6 +1874,11 @@ nl802154_dump_llsec_devkey(struct sk_buff *skb, struct netlink_callback *cb)
+ if (err)
+ return err;
+
++ if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
++ err = skb->len;
++ goto out_err;
++ }
++
+ if (!wpan_dev->netdev) {
+ err = -EINVAL;
+ goto out_err;
+@@ -1918,6 +1936,9 @@ static int nl802154_add_llsec_devkey(struct sk_buff *skb, struct genl_info *info
+ struct ieee802154_llsec_device_key key;
+ __le64 extended_addr;
+
++ if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
++ return -EOPNOTSUPP;
++
+ if (!info->attrs[NL802154_ATTR_SEC_DEVKEY] ||
+ nla_parse_nested(attrs, NL802154_DEVKEY_ATTR_MAX,
+ info->attrs[NL802154_ATTR_SEC_DEVKEY],
+@@ -2027,6 +2048,11 @@ nl802154_dump_llsec_seclevel(struct sk_buff *skb, struct netlink_callback *cb)
+ if (err)
+ return err;
+
++ if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
++ err = skb->len;
++ goto out_err;
++ }
++
+ if (!wpan_dev->netdev) {
+ err = -EINVAL;
+ goto out_err;
+@@ -2112,6 +2138,9 @@ static int nl802154_add_llsec_seclevel(struct sk_buff *skb,
+ struct wpan_dev *wpan_dev = dev->ieee802154_ptr;
+ struct ieee802154_llsec_seclevel sl;
+
++ if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
++ return -EOPNOTSUPP;
++
+ if (llsec_parse_seclevel(info->attrs[NL802154_ATTR_SEC_LEVEL],
+ &sl) < 0)
+ return -EINVAL;
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index b825ac025d5bd..28c4a693ab98d 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -2222,6 +2222,16 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct net *net, struct list_head
+ t = rtnl_dereference(t->next);
+ }
+ }
++
++ t = rtnl_dereference(ip6n->tnls_wc[0]);
++ while (t) {
++ /* If dev is in the same netns, it has already
++ * been added to the list by the previous loop.
++ */
++ if (!net_eq(dev_net(t->dev), net))
++ unregister_netdevice_queue(t->dev, list);
++ t = rtnl_dereference(t->next);
++ }
+ }
+
+ static int __net_init ip6_tnl_init_net(struct net *net)
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index bcf29201f87b3..ad737b68b8e96 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1818,9 +1818,9 @@ static void __net_exit sit_destroy_tunnels(struct net *net,
+ if (dev->rtnl_link_ops == &sit_link_ops)
+ unregister_netdevice_queue(dev, head);
+
+- for (prio = 1; prio < 4; prio++) {
++ for (prio = 0; prio < 4; prio++) {
+ int h;
+- for (h = 0; h < IP6_SIT_HASH_SIZE; h++) {
++ for (h = 0; h < (prio ? IP6_SIT_HASH_SIZE : 1); h++) {
+ struct ip_tunnel *t;
+
+ t = rtnl_dereference(sitn->tunnels[prio][h]);
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index f484f9fc62ca9..6804cdd43befc 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1548,8 +1548,10 @@ static int ieee80211_change_station(struct wiphy *wiphy,
+ }
+
+ if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+- sta->sdata->u.vlan.sta)
++ sta->sdata->u.vlan.sta) {
++ ieee80211_clear_fast_rx(sta);
+ RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
++ }
+
+ if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
+ ieee80211_vif_dec_num_mcast(sta->sdata);
+diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
+index dcd8e79229515..2e3ae494f3697 100644
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -262,6 +262,7 @@ static const char* l4proto_name(u16 proto)
+ case IPPROTO_GRE: return "gre";
+ case IPPROTO_SCTP: return "sctp";
+ case IPPROTO_UDPLITE: return "udplite";
++ case IPPROTO_ICMPV6: return "icmpv6";
+ }
+
+ return "unknown";
+diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
+index 72f13a1144dd6..a7bdc532479a3 100644
+--- a/net/netfilter/nft_limit.c
++++ b/net/netfilter/nft_limit.c
+@@ -79,13 +79,13 @@ static int nft_limit_init(struct nft_limit *limit,
+ return -EOVERFLOW;
+
+ if (pkts) {
+- tokens = div_u64(limit->nsecs, limit->rate) * limit->burst;
++ tokens = div64_u64(limit->nsecs, limit->rate) * limit->burst;
+ } else {
+ /* The token bucket size limits the number of tokens can be
+ * accumulated. tokens_max specifies the bucket size.
+ * tokens_max = unit * (rate + burst) / rate.
+ */
+- tokens = div_u64(limit->nsecs * (limit->rate + limit->burst),
++ tokens = div64_u64(limit->nsecs * (limit->rate + limit->burst),
+ limit->rate);
+ }
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 4a2873f70b372..656bd15328836 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1569,11 +1569,9 @@ static void sctp_close(struct sock *sk, long timeout)
+
+ /* Supposedly, no process has access to the socket, but
+ * the net layers still may.
+- * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
+- * held and that should be grabbed before socket lock.
+ */
+- spin_lock_bh(&net->sctp.addr_wq_lock);
+- bh_lock_sock_nested(sk);
++ local_bh_disable();
++ bh_lock_sock(sk);
+
+ /* Hold the sock, since sk_common_release() will put sock_put()
+ * and we have just a little more cleanup.
+@@ -1582,7 +1580,7 @@ static void sctp_close(struct sock *sk, long timeout)
+ sk_common_release(sk);
+
+ bh_unlock_sock(sk);
+- spin_unlock_bh(&net->sctp.addr_wq_lock);
++ local_bh_enable();
+
+ sock_put(sk);
+
+@@ -4776,9 +4774,6 @@ static int sctp_init_sock(struct sock *sk)
+ sk_sockets_allocated_inc(sk);
+ sock_prot_inuse_add(net, sk->sk_prot, 1);
+
+- /* Nothing can fail after this block, otherwise
+- * sctp_destroy_sock() will be called without addr_wq_lock held
+- */
+ if (net->sctp.default_auto_asconf) {
+ spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
+ list_add_tail(&sp->auto_asconf_list,
+@@ -4813,7 +4808,9 @@ static void sctp_destroy_sock(struct sock *sk)
+
+ if (sp->do_auto_asconf) {
+ sp->do_auto_asconf = 0;
++ spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
+ list_del(&sp->auto_asconf_list);
++ spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
+ }
+ sctp_endpoint_free(sp->ep);
+ local_bh_disable();
+diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
+index ff96db91f818a..baa76337c33f3 100644
+--- a/sound/soc/fsl/fsl_esai.c
++++ b/sound/soc/fsl/fsl_esai.c
+@@ -497,11 +497,13 @@ static int fsl_esai_startup(struct snd_pcm_substream *substream,
+ ESAI_SAICR_SYNC, esai_priv->synchronous ?
+ ESAI_SAICR_SYNC : 0);
+
+- /* Set a default slot number -- 2 */
++ /* Set slots count */
+ regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR,
+- ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(2));
++ ESAI_xCCR_xDC_MASK,
++ ESAI_xCCR_xDC(esai_priv->slots));
+ regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR,
+- ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(2));
++ ESAI_xCCR_xDC_MASK,
++ ESAI_xCCR_xDC(esai_priv->slots));
+ }
+
+ return 0;
+diff --git a/tools/arch/ia64/include/asm/barrier.h b/tools/arch/ia64/include/asm/barrier.h
+index d808ee0e77b58..90f8bbd9aede7 100644
+--- a/tools/arch/ia64/include/asm/barrier.h
++++ b/tools/arch/ia64/include/asm/barrier.h
+@@ -39,9 +39,6 @@
+ * sequential memory pages only.
+ */
+
+-/* XXX From arch/ia64/include/uapi/asm/gcc_intrin.h */
+-#define ia64_mf() asm volatile ("mf" ::: "memory")
+-
+ #define mb() ia64_mf()
+ #define rmb() mb()
+ #define wmb() mb()
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-04-28 18:31 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-04-28 18:31 UTC (permalink / raw
To: gentoo-commits
commit: 9b011d8f5602cd19e7e6be5c6a7cc908f3da0679
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 28 18:31:00 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 28 18:31:00 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9b011d8f
Remove CPU OPT patch for gcc=4.9, long out of the tree
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 -
...-additional-cpu-optimizations-for-gcc-4.9.patch | 545 ---------------------
2 files changed, 549 deletions(-)
diff --git a/0000_README b/0000_README
index a3a9c1c..2d7a098 100644
--- a/0000_README
+++ b/0000_README
@@ -819,10 +819,6 @@ Patch: 4567_distro-Gentoo-Kconfig.patch
From: Tom Wijsman <TomWij@gentoo.org>
Desc: Add Gentoo Linux support config settings and defaults.
-Patch: 5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
-From: https://github.com/graysky2/kernel_gcc_patch/
-Desc: Kernel patch enables gcc >= v4.13 optimizations for additional CPUs.
-
Patch: 5011_enable-cpu-optimizations-for-gcc8.patch
From: https://github.com/graysky2/kernel_gcc_patch/
Desc: Kernel patch for >= gccv8 enables kernel >= v4.13 optimizations for additional CPUs.
diff --git a/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch b/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
deleted file mode 100644
index a8aa759..0000000
--- a/5010_enable-additional-cpu-optimizations-for-gcc-4.9.patch
+++ /dev/null
@@ -1,545 +0,0 @@
-WARNING
-This patch works with gcc versions 4.9+ and with kernel version 4.13+ and should
-NOT be applied when compiling on older versions of gcc due to key name changes
-of the march flags introduced with the version 4.9 release of gcc.[1]
-
-Use the older version of this patch hosted on the same github for older
-versions of gcc.
-
-FEATURES
-This patch adds additional CPU options to the Linux kernel accessible under:
- Processor type and features --->
- Processor family --->
-
-The expanded microarchitectures include:
-* AMD Improved K8-family
-* AMD K10-family
-* AMD Family 10h (Barcelona)
-* AMD Family 14h (Bobcat)
-* AMD Family 16h (Jaguar)
-* AMD Family 15h (Bulldozer)
-* AMD Family 15h (Piledriver)
-* AMD Family 15h (Steamroller)
-* AMD Family 15h (Excavator)
-* AMD Family 17h (Zen)
-* Intel Silvermont low-power processors
-* Intel 1st Gen Core i3/i5/i7 (Nehalem)
-* Intel 1.5 Gen Core i3/i5/i7 (Westmere)
-* Intel 2nd Gen Core i3/i5/i7 (Sandybridge)
-* Intel 3rd Gen Core i3/i5/i7 (Ivybridge)
-* Intel 4th Gen Core i3/i5/i7 (Haswell)
-* Intel 5th Gen Core i3/i5/i7 (Broadwell)
-* Intel 6th Gen Core i3/i5/i7 (Skylake)
-* Intel 6th Gen Core i7/i9 (Skylake X)
-
-It also offers to compile passing the 'native' option which, "selects the CPU
-to generate code for at compilation time by determining the processor type of
-the compiling machine. Using -march=native enables all instruction subsets
-supported by the local machine and will produce code optimized for the local
-machine under the constraints of the selected instruction set."[3]
-
-MINOR NOTES
-This patch also changes 'atom' to 'bonnell' in accordance with the gcc v4.9
-changes. Note that upstream is using the deprecated 'match=atom' flags when I
-believe it should use the newer 'march=bonnell' flag for atom processors.[2]
-
-It is not recommended to compile on Atom-CPUs with the 'native' option.[4] The
-recommendation is to use the 'atom' option instead.
-
-BENEFITS
-Small but real speed increases are measurable using a make endpoint comparing
-a generic kernel to one built with one of the respective microarchs.
-
-See the following experimental evidence supporting this statement:
-https://github.com/graysky2/kernel_gcc_patch
-
-REQUIREMENTS
-linux version >=4.13
-gcc version >=4.9
-
-ACKNOWLEDGMENTS
-This patch builds on the seminal work by Jeroen.[5]
-
-REFERENCES
-1. https://gcc.gnu.org/gcc-4.9/changes.html
-2. https://bugzilla.kernel.org/show_bug.cgi?id=77461
-3. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
-4. https://github.com/graysky2/kernel_gcc_patch/issues/15
-5. http://www.linuxforge.net/docs/linux/linux-gcc.php
-
---- a/arch/x86/include/asm/module.h 2018-01-28 16:20:33.000000000 -0500
-+++ b/arch/x86/include/asm/module.h 2018-03-10 06:42:38.688317317 -0500
-@@ -25,6 +25,26 @@ struct mod_arch_specific {
- #define MODULE_PROC_FAMILY "586MMX "
- #elif defined CONFIG_MCORE2
- #define MODULE_PROC_FAMILY "CORE2 "
-+#elif defined CONFIG_MNATIVE
-+#define MODULE_PROC_FAMILY "NATIVE "
-+#elif defined CONFIG_MNEHALEM
-+#define MODULE_PROC_FAMILY "NEHALEM "
-+#elif defined CONFIG_MWESTMERE
-+#define MODULE_PROC_FAMILY "WESTMERE "
-+#elif defined CONFIG_MSILVERMONT
-+#define MODULE_PROC_FAMILY "SILVERMONT "
-+#elif defined CONFIG_MSANDYBRIDGE
-+#define MODULE_PROC_FAMILY "SANDYBRIDGE "
-+#elif defined CONFIG_MIVYBRIDGE
-+#define MODULE_PROC_FAMILY "IVYBRIDGE "
-+#elif defined CONFIG_MHASWELL
-+#define MODULE_PROC_FAMILY "HASWELL "
-+#elif defined CONFIG_MBROADWELL
-+#define MODULE_PROC_FAMILY "BROADWELL "
-+#elif defined CONFIG_MSKYLAKE
-+#define MODULE_PROC_FAMILY "SKYLAKE "
-+#elif defined CONFIG_MSKYLAKEX
-+#define MODULE_PROC_FAMILY "SKYLAKEX "
- #elif defined CONFIG_MATOM
- #define MODULE_PROC_FAMILY "ATOM "
- #elif defined CONFIG_M686
-@@ -43,6 +63,26 @@ struct mod_arch_specific {
- #define MODULE_PROC_FAMILY "K7 "
- #elif defined CONFIG_MK8
- #define MODULE_PROC_FAMILY "K8 "
-+#elif defined CONFIG_MK8SSE3
-+#define MODULE_PROC_FAMILY "K8SSE3 "
-+#elif defined CONFIG_MK10
-+#define MODULE_PROC_FAMILY "K10 "
-+#elif defined CONFIG_MBARCELONA
-+#define MODULE_PROC_FAMILY "BARCELONA "
-+#elif defined CONFIG_MBOBCAT
-+#define MODULE_PROC_FAMILY "BOBCAT "
-+#elif defined CONFIG_MBULLDOZER
-+#define MODULE_PROC_FAMILY "BULLDOZER "
-+#elif defined CONFIG_MPILEDRIVER
-+#define MODULE_PROC_FAMILY "PILEDRIVER "
-+#elif defined CONFIG_MSTEAMROLLER
-+#define MODULE_PROC_FAMILY "STEAMROLLER "
-+#elif defined CONFIG_MJAGUAR
-+#define MODULE_PROC_FAMILY "JAGUAR "
-+#elif defined CONFIG_MEXCAVATOR
-+#define MODULE_PROC_FAMILY "EXCAVATOR "
-+#elif defined CONFIG_MZEN
-+#define MODULE_PROC_FAMILY "ZEN "
- #elif defined CONFIG_MELAN
- #define MODULE_PROC_FAMILY "ELAN "
- #elif defined CONFIG_MCRUSOE
---- a/arch/x86/Kconfig.cpu 2018-01-28 16:20:33.000000000 -0500
-+++ b/arch/x86/Kconfig.cpu 2018-03-10 06:45:50.244371799 -0500
-@@ -116,6 +116,7 @@ config MPENTIUMM
- config MPENTIUM4
- bool "Pentium-4/Celeron(P4-based)/Pentium-4 M/older Xeon"
- depends on X86_32
-+ select X86_P6_NOP
- ---help---
- Select this for Intel Pentium 4 chips. This includes the
- Pentium 4, Pentium D, P4-based Celeron and Xeon, and
-@@ -148,9 +149,8 @@ config MPENTIUM4
- -Paxville
- -Dempsey
-
--
- config MK6
-- bool "K6/K6-II/K6-III"
-+ bool "AMD K6/K6-II/K6-III"
- depends on X86_32
- ---help---
- Select this for an AMD K6-family processor. Enables use of
-@@ -158,7 +158,7 @@ config MK6
- flags to GCC.
-
- config MK7
-- bool "Athlon/Duron/K7"
-+ bool "AMD Athlon/Duron/K7"
- depends on X86_32
- ---help---
- Select this for an AMD Athlon K7-family processor. Enables use of
-@@ -166,12 +166,83 @@ config MK7
- flags to GCC.
-
- config MK8
-- bool "Opteron/Athlon64/Hammer/K8"
-+ bool "AMD Opteron/Athlon64/Hammer/K8"
- ---help---
- Select this for an AMD Opteron or Athlon64 Hammer-family processor.
- Enables use of some extended instructions, and passes appropriate
- optimization flags to GCC.
-
-+config MK8SSE3
-+ bool "AMD Opteron/Athlon64/Hammer/K8 with SSE3"
-+ ---help---
-+ Select this for improved AMD Opteron or Athlon64 Hammer-family processors.
-+ Enables use of some extended instructions, and passes appropriate
-+ optimization flags to GCC.
-+
-+config MK10
-+ bool "AMD 61xx/7x50/PhenomX3/X4/II/K10"
-+ ---help---
-+ Select this for an AMD 61xx Eight-Core Magny-Cours, Athlon X2 7x50,
-+ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
-+ Enables use of some extended instructions, and passes appropriate
-+ optimization flags to GCC.
-+
-+config MBARCELONA
-+ bool "AMD Barcelona"
-+ ---help---
-+ Select this for AMD Family 10h Barcelona processors.
-+
-+ Enables -march=barcelona
-+
-+config MBOBCAT
-+ bool "AMD Bobcat"
-+ ---help---
-+ Select this for AMD Family 14h Bobcat processors.
-+
-+ Enables -march=btver1
-+
-+config MJAGUAR
-+ bool "AMD Jaguar"
-+ ---help---
-+ Select this for AMD Family 16h Jaguar processors.
-+
-+ Enables -march=btver2
-+
-+config MBULLDOZER
-+ bool "AMD Bulldozer"
-+ ---help---
-+ Select this for AMD Family 15h Bulldozer processors.
-+
-+ Enables -march=bdver1
-+
-+config MPILEDRIVER
-+ bool "AMD Piledriver"
-+ ---help---
-+ Select this for AMD Family 15h Piledriver processors.
-+
-+ Enables -march=bdver2
-+
-+config MSTEAMROLLER
-+ bool "AMD Steamroller"
-+ ---help---
-+ Select this for AMD Family 15h Steamroller processors.
-+
-+ Enables -march=bdver3
-+
-+config MEXCAVATOR
-+ bool "AMD Excavator"
-+ ---help---
-+ Select this for AMD Family 15h Excavator processors.
-+
-+ Enables -march=bdver4
-+
-+config MZEN
-+ bool "AMD Zen"
-+ ---help---
-+ Select this for AMD Family 17h Zen processors.
-+
-+ Enables -march=znver1
-+
- config MCRUSOE
- bool "Crusoe"
- depends on X86_32
-@@ -253,6 +324,7 @@ config MVIAC7
-
- config MPSC
- bool "Intel P4 / older Netburst based Xeon"
-+ select X86_P6_NOP
- depends on X86_64
- ---help---
- Optimize for Intel Pentium 4, Pentium D and older Nocona/Dempsey
-@@ -262,8 +334,19 @@ config MPSC
- using the cpu family field
- in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
-
-+config MATOM
-+ bool "Intel Atom"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Atom platform. Intel Atom CPUs have an
-+ in-order pipelining architecture and thus can benefit from
-+ accordingly optimized code. Use a recent GCC with specific Atom
-+ support in order to fully benefit from selecting this option.
-+
- config MCORE2
-- bool "Core 2/newer Xeon"
-+ bool "Intel Core 2"
-+ select X86_P6_NOP
- ---help---
-
- Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
-@@ -271,14 +354,88 @@ config MCORE2
- family in /proc/cpuinfo. Newer ones have 6 and older ones 15
- (not a typo)
-
--config MATOM
-- bool "Intel Atom"
-+ Enables -march=core2
-+
-+config MNEHALEM
-+ bool "Intel Nehalem"
-+ select X86_P6_NOP
- ---help---
-
-- Select this for the Intel Atom platform. Intel Atom CPUs have an
-- in-order pipelining architecture and thus can benefit from
-- accordingly optimized code. Use a recent GCC with specific Atom
-- support in order to fully benefit from selecting this option.
-+ Select this for 1st Gen Core processors in the Nehalem family.
-+
-+ Enables -march=nehalem
-+
-+config MWESTMERE
-+ bool "Intel Westmere"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Westmere formerly Nehalem-C family.
-+
-+ Enables -march=westmere
-+
-+config MSILVERMONT
-+ bool "Intel Silvermont"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Silvermont platform.
-+
-+ Enables -march=silvermont
-+
-+config MSANDYBRIDGE
-+ bool "Intel Sandy Bridge"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 2nd Gen Core processors in the Sandy Bridge family.
-+
-+ Enables -march=sandybridge
-+
-+config MIVYBRIDGE
-+ bool "Intel Ivy Bridge"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 3rd Gen Core processors in the Ivy Bridge family.
-+
-+ Enables -march=ivybridge
-+
-+config MHASWELL
-+ bool "Intel Haswell"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 4th Gen Core processors in the Haswell family.
-+
-+ Enables -march=haswell
-+
-+config MBROADWELL
-+ bool "Intel Broadwell"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 5th Gen Core processors in the Broadwell family.
-+
-+ Enables -march=broadwell
-+
-+config MSKYLAKE
-+ bool "Intel Skylake"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 6th Gen Core processors in the Skylake family.
-+
-+ Enables -march=skylake
-+
-+config MSKYLAKEX
-+ bool "Intel Skylake X"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 6th Gen Core processors in the Skylake X family.
-+
-+ Enables -march=skylake-avx512
-
- config GENERIC_CPU
- bool "Generic-x86-64"
-@@ -287,6 +444,19 @@ config GENERIC_CPU
- Generic x86-64 CPU.
- Run equally well on all x86-64 CPUs.
-
-+config MNATIVE
-+ bool "Native optimizations autodetected by GCC"
-+ ---help---
-+
-+ GCC 4.2 and above support -march=native, which automatically detects
-+ the optimum settings to use based on your processor. -march=native
-+ also detects and applies additional settings beyond -march specific
-+ to your CPU, (eg. -msse4). Unless you have a specific reason not to
-+ (e.g. distcc cross-compiling), you should probably be using
-+ -march=native rather than anything listed below.
-+
-+ Enables -march=native
-+
- endchoice
-
- config X86_GENERIC
-@@ -311,7 +481,7 @@ config X86_INTERNODE_CACHE_SHIFT
- config X86_L1_CACHE_SHIFT
- int
- default "7" if MPENTIUM4 || MPSC
-- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
-+ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
- default "4" if MELAN || M486 || MGEODEGX1
- default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
-
-@@ -342,35 +512,36 @@ config X86_ALIGNMENT_16
-
- config X86_INTEL_USERCOPY
- def_bool y
-- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
-+ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MNATIVE
-
- config X86_USE_PPRO_CHECKSUM
- def_bool y
-- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
-+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MATOM || MNATIVE
-
- config X86_USE_3DNOW
- def_bool y
- depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
-
--#
--# P6_NOPs are a relatively minor optimization that require a family >=
--# 6 processor, except that it is broken on certain VIA chips.
--# Furthermore, AMD chips prefer a totally different sequence of NOPs
--# (which work on all CPUs). In addition, it looks like Virtual PC
--# does not understand them.
--#
--# As a result, disallow these if we're not compiling for X86_64 (these
--# NOPs do work on all x86-64 capable chips); the list of processors in
--# the right-hand clause are the cores that benefit from this optimization.
--#
- config X86_P6_NOP
-- def_bool y
-- depends on X86_64
-- depends on (MCORE2 || MPENTIUM4 || MPSC)
-+ default n
-+ bool "Support for P6_NOPs on Intel chips"
-+ depends on (MCORE2 || MPENTIUM4 || MPSC || MATOM || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MNATIVE)
-+ ---help---
-+ P6_NOPs are a relatively minor optimization that require a family >=
-+ 6 processor, except that it is broken on certain VIA chips.
-+ Furthermore, AMD chips prefer a totally different sequence of NOPs
-+ (which work on all CPUs). In addition, it looks like Virtual PC
-+ does not understand them.
-+
-+ As a result, disallow these if we're not compiling for X86_64 (these
-+ NOPs do work on all x86-64 capable chips); the list of processors in
-+ the right-hand clause are the cores that benefit from this optimization.
-+
-+ Say Y if you have Intel CPU newer than Pentium Pro, N otherwise.
-
- config X86_TSC
- def_bool y
-- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
-+ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MNATIVE || MATOM) || X86_64
-
- config X86_CMPXCHG64
- def_bool y
-@@ -380,7 +551,7 @@ config X86_CMPXCHG64
- # generates cmov.
- config X86_CMOV
- def_bool y
-- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
-+ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
-
- config X86_MINIMUM_CPU_FAMILY
- int
---- a/arch/x86/Makefile 2018-01-28 16:20:33.000000000 -0500
-+++ b/arch/x86/Makefile 2018-03-10 06:47:00.284240139 -0500
-@@ -124,13 +124,42 @@ else
- KBUILD_CFLAGS += $(call cc-option,-mskip-rax-setup)
-
- # FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
-+ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
- cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
-+ cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-mtune=k8)
-+ cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10)
-+ cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona)
-+ cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1)
-+ cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2)
-+ cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1)
-+ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2)
-+ cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3)
-+ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4)
-+ cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1)
- cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
-
- cflags-$(CONFIG_MCORE2) += \
-- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
-- cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
-- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
-+ $(call cc-option,-march=core2,$(call cc-option,-mtune=core2))
-+ cflags-$(CONFIG_MNEHALEM) += \
-+ $(call cc-option,-march=nehalem,$(call cc-option,-mtune=nehalem))
-+ cflags-$(CONFIG_MWESTMERE) += \
-+ $(call cc-option,-march=westmere,$(call cc-option,-mtune=westmere))
-+ cflags-$(CONFIG_MSILVERMONT) += \
-+ $(call cc-option,-march=silvermont,$(call cc-option,-mtune=silvermont))
-+ cflags-$(CONFIG_MSANDYBRIDGE) += \
-+ $(call cc-option,-march=sandybridge,$(call cc-option,-mtune=sandybridge))
-+ cflags-$(CONFIG_MIVYBRIDGE) += \
-+ $(call cc-option,-march=ivybridge,$(call cc-option,-mtune=ivybridge))
-+ cflags-$(CONFIG_MHASWELL) += \
-+ $(call cc-option,-march=haswell,$(call cc-option,-mtune=haswell))
-+ cflags-$(CONFIG_MBROADWELL) += \
-+ $(call cc-option,-march=broadwell,$(call cc-option,-mtune=broadwell))
-+ cflags-$(CONFIG_MSKYLAKE) += \
-+ $(call cc-option,-march=skylake,$(call cc-option,-mtune=skylake))
-+ cflags-$(CONFIG_MSKYLAKEX) += \
-+ $(call cc-option,-march=skylake-avx512,$(call cc-option,-mtune=skylake-avx512))
-+ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell) \
-+ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
- cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
- KBUILD_CFLAGS += $(cflags-y)
-
---- a/arch/x86/Makefile_32.cpu 2018-01-28 16:20:33.000000000 -0500
-+++ b/arch/x86/Makefile_32.cpu 2018-03-10 06:47:46.025992644 -0500
-@@ -23,7 +23,18 @@ cflags-$(CONFIG_MK6) += -march=k6
- # Please note, that patches that add -march=athlon-xp and friends are pointless.
- # They make zero difference whatsosever to performance at this time.
- cflags-$(CONFIG_MK7) += -march=athlon
-+cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
- cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8,-march=athlon)
-+cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-march=athlon)
-+cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10,-march=athlon)
-+cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona,-march=athlon)
-+cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1,-march=athlon)
-+cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2,-march=athlon)
-+cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1,-march=athlon)
-+cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2,-march=athlon)
-+cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3,-march=athlon)
-+cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4,-march=athlon)
-+cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1,-march=athlon)
- cflags-$(CONFIG_MCRUSOE) += -march=i686 -falign-functions=0 -falign-jumps=0 -falign-loops=0
- cflags-$(CONFIG_MEFFICEON) += -march=i686 $(call tune,pentium3) -falign-functions=0 -falign-jumps=0 -falign-loops=0
- cflags-$(CONFIG_MWINCHIPC6) += $(call cc-option,-march=winchip-c6,-march=i586)
-@@ -32,8 +43,17 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
- cflags-$(CONFIG_MVIAC3_2) += $(call cc-option,-march=c3-2,-march=i686)
- cflags-$(CONFIG_MVIAC7) += -march=i686
- cflags-$(CONFIG_MCORE2) += -march=i686 $(call tune,core2)
--cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom,$(call cc-option,-march=core2,-march=i686)) \
-- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
-+cflags-$(CONFIG_MNEHALEM) += -march=i686 $(call tune,nehalem)
-+cflags-$(CONFIG_MWESTMERE) += -march=i686 $(call tune,westmere)
-+cflags-$(CONFIG_MSILVERMONT) += -march=i686 $(call tune,silvermont)
-+cflags-$(CONFIG_MSANDYBRIDGE) += -march=i686 $(call tune,sandybridge)
-+cflags-$(CONFIG_MIVYBRIDGE) += -march=i686 $(call tune,ivybridge)
-+cflags-$(CONFIG_MHASWELL) += -march=i686 $(call tune,haswell)
-+cflags-$(CONFIG_MBROADWELL) += -march=i686 $(call tune,broadwell)
-+cflags-$(CONFIG_MSKYLAKE) += -march=i686 $(call tune,skylake)
-+cflags-$(CONFIG_MSKYLAKEX) += -march=i686 $(call tune,skylake-avx512)
-+cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell,$(call cc-option,-march=core2,-march=i686)) \
-+ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
-
- # AMD Elan support
- cflags-$(CONFIG_MELAN) += -march=i486
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-04-30 19:02 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-04-30 19:02 UTC (permalink / raw
To: gentoo-commits
commit: f313e958177a633561f7f951a063fd5f64e01976
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Apr 30 19:02:39 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Apr 30 19:02:39 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f313e958
Rename cpu opt patch to standardize on naming format
Remove redundant patches
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 12 +-
...> 5010_enable-cpu-optimizations-universal.patch | 288 +++++++----
5011_enable-cpu-optimizations-for-gcc8.patch | 569 ---------------------
5012_enable-cpu-optimizations-for-gcc91.patch | 549 --------------------
4 files changed, 204 insertions(+), 1214 deletions(-)
diff --git a/0000_README b/0000_README
index 2d7a098..e6e43df 100644
--- a/0000_README
+++ b/0000_README
@@ -819,14 +819,6 @@ Patch: 4567_distro-Gentoo-Kconfig.patch
From: Tom Wijsman <TomWij@gentoo.org>
Desc: Add Gentoo Linux support config settings and defaults.
-Patch: 5011_enable-cpu-optimizations-for-gcc8.patch
+Patch: 5010_enable-cpu-optimizations-universal.patch
From: https://github.com/graysky2/kernel_gcc_patch/
-Desc: Kernel patch for >= gccv8 enables kernel >= v4.13 optimizations for additional CPUs.
-
-Patch: 5012_enable-cpu-optimizations-for-gcc91.patch
-From: https://github.com/graysky2/kernel_gcc_patch/
-Desc: Kernel patch enables gcc >= v9.1 optimizations for additional CPUs.
-
-Patch: 5013_enable-cpu-optimizations-for-gcc10.patch
-From: https://github.com/graysky2/kernel_gcc_patch/
-Desc: Kernel patch enables gcc = v10.1+ optimizations for additional CPUs.
+Desc: Kernel 4.19-5.4 patch enables gcc = v9+ optimizations for additional CPUs.
diff --git a/5013_enable-cpu-optimizations-for-gcc10.patch b/5010_enable-cpu-optimizations-universal.patch
similarity index 64%
rename from 5013_enable-cpu-optimizations-for-gcc10.patch
rename to 5010_enable-cpu-optimizations-universal.patch
index 6951f13..2cc90b0 100644
--- a/5013_enable-cpu-optimizations-for-gcc10.patch
+++ b/5010_enable-cpu-optimizations-universal.patch
@@ -1,64 +1,85 @@
-From cde505774da8b00eb3a67513488b417fadb8e2c3 Mon Sep 17 00:00:00 2001
+From cda27318e4b73d20f0edb497dd86ed4c1d051ad6 Mon Sep 17 00:00:00 2001
From: graysky <graysky@archlinux.us>
-Date: Mon, 8 Mar 2021 15:44:59 -0500
-Subject: [PATCH] more-uarches-for-gcc-v10-and-kernel-4.19-v5.4
+Date: Mon, 12 Apr 2021 07:14:01 -0400
+Subject: [PATCH] more uarches for kernel 4.19-5.4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
WARNING
-This patch works with gcc versions 10.1+ and with kernel versions 4.19-5.4 and
-NOT be applied when compiling on older versions of gcc due to key name changes
-of the march flags introduced with the version 4.9 release of gcc.[1]
-
-Use the older version of this patch hosted on the same github for older
-versions of gcc.
+This patch works with all gcc versions 9.0+ and with kernel version 4.19-5.4
+and should NOT be applied when compiling on older versions of gcc due to key
+name changes of the march flags introduced with the version 4.9 release of
+gcc.[1]
FEATURES
This patch adds additional CPU options to the Linux kernel accessible under:
Processor type and features --->
Processor family --->
-The expanded microarchitectures include:
-* AMD Improved K8-family
-* AMD K10-family
-* AMD Family 10h (Barcelona)
-* AMD Family 14h (Bobcat)
-* AMD Family 16h (Jaguar)
-* AMD Family 15h (Bulldozer)
-* AMD Family 15h (Piledriver)
-* AMD Family 15h (Steamroller)
-* AMD Family 15h (Excavator)
-* AMD Family 17h (Zen)
-* AMD Family 17h (Zen 2)
-* Intel Silvermont low-power processors
-* Intel Goldmont low-power processors (Apollo Lake and Denverton)
-* Intel Goldmont Plus low-power processors (Gemini Lake)
-* Intel 1st Gen Core i3/i5/i7 (Nehalem)
-* Intel 1.5 Gen Core i3/i5/i7 (Westmere)
-* Intel 2nd Gen Core i3/i5/i7 (Sandybridge)
-* Intel 3rd Gen Core i3/i5/i7 (Ivybridge)
-* Intel 4th Gen Core i3/i5/i7 (Haswell)
-* Intel 5th Gen Core i3/i5/i7 (Broadwell)
-* Intel 6th Gen Core i3/i5/i7 (Skylake)
-* Intel 6th Gen Core i7/i9 (Skylake X)
-* Intel 8th Gen Core i3/i5/i7 (Cannon Lake)
-* Intel 10th Gen Core i7/i9 (Ice Lake)
-* Intel Xeon (Cascade Lake)
-* Intel Xeon (Cooper Lake)
-* Intel 3rd Gen 10nm++ i3/i5/i7/i9-family (Tiger Lake)
+With the release of gcc 11.0, several generic 64-bit levels are offered which
+are good for supported Intel or AMD CPUs:
+• x86-64-v2
+• x86-64-v3
+• x86-64-v4
+
+Users of glibc 2.33 and above can see which level is supported by current
+hardware by running:
+ /lib/ld-linux-x86-64.so.2 --help | grep supported
+
+Alternatively, compare the flags from /proc/cpuinfo to this list.[2]
+
+CPU-specific microarchitectures include:
+• AMD Improved K8-family
+• AMD K10-family
+• AMD Family 10h (Barcelona)
+• AMD Family 14h (Bobcat)
+• AMD Family 16h (Jaguar)
+• AMD Family 15h (Bulldozer)
+• AMD Family 15h (Piledriver)
+• AMD Family 15h (Steamroller)
+• AMD Family 15h (Excavator)
+• AMD Family 17h (Zen)
+• AMD Family 17h (Zen 2)
+• AMD Family 19h (Zen 3)†
+• Intel Silvermont low-power processors
+• Intel Goldmont low-power processors (Apollo Lake and Denverton)
+• Intel Goldmont Plus low-power processors (Gemini Lake)
+• Intel 1st Gen Core i3/i5/i7 (Nehalem)
+• Intel 1.5 Gen Core i3/i5/i7 (Westmere)
+• Intel 2nd Gen Core i3/i5/i7 (Sandybridge)
+• Intel 3rd Gen Core i3/i5/i7 (Ivybridge)
+• Intel 4th Gen Core i3/i5/i7 (Haswell)
+• Intel 5th Gen Core i3/i5/i7 (Broadwell)
+• Intel 6th Gen Core i3/i5/i7 (Skylake)
+• Intel 6th Gen Core i7/i9 (Skylake X)
+• Intel 8th Gen Core i3/i5/i7 (Cannon Lake)
+• Intel 10th Gen Core i7/i9 (Ice Lake)
+• Intel Xeon (Cascade Lake)
+• Intel Xeon (Cooper Lake)*
+• Intel 3rd Gen 10nm++ i3/i5/i7/i9-family (Tiger Lake)*
+• Intel 3rd Gen 10nm++ Xeon (Sapphire Rapids)‡
+• Intel 11th Gen i3/i5/i7/i9-family (Rocket Lake)‡
+• Intel 12th Gen i3/i5/i7/i9-family (Alder Lake)‡
+
+Notes: If not otherwise noted, gcc >=9.1 is required for support.
+ *Requires gcc >=10.1 †Required gcc >=10.3 ‡Required gcc >=11.0
It also offers to compile passing the 'native' option which, "selects the CPU
to generate code for at compilation time by determining the processor type of
the compiling machine. Using -march=native enables all instruction subsets
supported by the local machine and will produce code optimized for the local
-machine under the constraints of the selected instruction set."[2]
+machine under the constraints of the selected instruction set."[3]
-Do NOT use 'native' when building for AMD chips! Intel ONLY!
+Users of Intel CPUs should select the 'Intel-Native' option and users of AMD
+CPUs should select the 'AMD-Native' option.
-MINOR NOTES
-This patch also changes 'atom' to 'bonnell' in accordance with the gcc v4.9
-changes. Note that upstream is using the deprecated 'match=atom' flags when I
-believe it should use the newer 'march=bonnell' flag for atom processors.[3]
+MINOR NOTES RELATING TO INTEL ATOM PROCESSORS
+This patch also changes -march=atom to -march=bonnell in accordance with the
+gcc v4.9 changes. Upstream is using the deprecated -match=atom flags when I
+believe it should use the newer -march=bonnell flag for atom processors.[4]
-It is not recommended to compile on Atom-CPUs with the 'native' option.[4] The
+It is not recommended to compile on Atom-CPUs with the 'native' option.[5] The
recommendation is to use the 'atom' option instead.
BENEFITS
@@ -69,38 +90,41 @@ See the following experimental evidence supporting this statement:
https://github.com/graysky2/kernel_gcc_patch
REQUIREMENTS
-linux version 4.19-lts and 5.4-lts
-gcc version >=10.1
+linux version 4.19-5.4
+gcc version >=9.0
ACKNOWLEDGMENTS
-This patch builds on the seminal work by Jeroen.[5]
+This patch builds on the seminal work by Jeroen.[6]
REFERENCES
1. https://gcc.gnu.org/gcc-4.9/changes.html
-2. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
-3. https://bugzilla.kernel.org/show_bug.cgi?id=77461
-4. https://github.com/graysky2/kernel_gcc_patch/issues/15
-5. http://www.linuxforge.net/docs/linux/linux-gcc.php
+2. https://gitlab.com/x86-psABIs/x86-64-ABI/-/commit/77566eb03bc6a326811cb7e9
+3. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html#index-x86-Options
+4. https://bugzilla.kernel.org/show_bug.cgi?id=77461
+5. https://github.com/graysky2/kernel_gcc_patch/issues/15
+6. http://www.linuxforge.net/docs/linux/linux-gcc.php
---
- arch/x86/Kconfig.cpu | 258 ++++++++++++++++++++++++++++++++--
- arch/x86/Makefile | 39 ++++-
- arch/x86/include/asm/module.h | 56 ++++++++
- 3 files changed, 336 insertions(+), 17 deletions(-)
+ arch/x86/Kconfig.cpu | 333 ++++++++++++++++++++++++++++++++--
+ arch/x86/Makefile | 47 ++++-
+ arch/x86/include/asm/module.h | 66 +++++++
+ 3 files changed, 428 insertions(+), 18 deletions(-)
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
-index 8e29c991ba3e..a1a12d8dfc50 100644
+index 8e29c991ba3e..bc76256532bb 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
-@@ -150,7 +150,7 @@ config MPENTIUM4
-
+@@ -148,9 +148,8 @@ config MPENTIUM4
+ -Paxville
+ -Dempsey
+-
config MK6
- bool "K6/K6-II/K6-III"
+ bool "AMD K6/K6-II/K6-III"
depends on X86_32
---help---
Select this for an AMD K6-family processor. Enables use of
-@@ -158,7 +158,7 @@ config MK6
+@@ -158,7 +157,7 @@ config MK6
flags to GCC.
config MK7
@@ -109,7 +133,7 @@ index 8e29c991ba3e..a1a12d8dfc50 100644
depends on X86_32
---help---
Select this for an AMD Athlon K7-family processor. Enables use of
-@@ -166,12 +166,90 @@ config MK7
+@@ -166,12 +165,98 @@ config MK7
flags to GCC.
config MK8
@@ -197,11 +221,19 @@ index 8e29c991ba3e..a1a12d8dfc50 100644
+ Select this for AMD Family 17h Zen 2 processors.
+
+ Enables -march=znver2
++
++config MZEN3
++ bool "AMD Zen 3"
++ depends on GCC_VERSION > 100300
++ ---help---
++ Select this for AMD Family 19h Zen 3 processors.
++
++ Enables -march=znver3
+
config MCRUSOE
bool "Crusoe"
depends on X86_32
-@@ -263,7 +341,7 @@ config MPSC
+@@ -263,7 +348,7 @@ config MPSC
in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
config MCORE2
@@ -210,7 +242,7 @@ index 8e29c991ba3e..a1a12d8dfc50 100644
---help---
Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
-@@ -271,6 +349,8 @@ config MCORE2
+@@ -271,6 +356,8 @@ config MCORE2
family in /proc/cpuinfo. Newer ones have 6 and older ones 15
(not a typo)
@@ -219,7 +251,7 @@ index 8e29c991ba3e..a1a12d8dfc50 100644
config MATOM
bool "Intel Atom"
---help---
-@@ -280,6 +360,150 @@ config MATOM
+@@ -280,6 +367,182 @@ config MATOM
accordingly optimized code. Use a recent GCC with specific Atom
support in order to fully benefit from selecting this option.
@@ -351,6 +383,7 @@ index 8e29c991ba3e..a1a12d8dfc50 100644
+
+config MCOOPERLAKE
+ bool "Intel Cooper Lake"
++ depends on GCC_VERSION > 100100
+ select X86_P6_NOP
+ ---help---
+
@@ -360,22 +393,77 @@ index 8e29c991ba3e..a1a12d8dfc50 100644
+
+config MTIGERLAKE
+ bool "Intel Tiger Lake"
++ depends on GCC_VERSION > 100100
+ select X86_P6_NOP
+ ---help---
+
+ Select this for third-generation 10 nm process processors in the Tiger Lake family.
+
+ Enables -march=tigerlake
++
++config MSAPPHIRERAPIDS
++ bool "Intel Sapphire Rapids"
++ depends on GCC_VERSION > 110000
++ select X86_P6_NOP
++ ---help---
++
++ Select this for third-generation 10 nm process processors in the Sapphire Rapids family.
++
++ Enables -march=sapphirerapids
++
++config MROCKETLAKE
++ bool "Intel Rocket Lake"
++ depends on GCC_VERSION > 110000
++ select X86_P6_NOP
++ ---help---
++
++ Select this for eleventh-generation processors in the Rocket Lake family.
++
++ Enables -march=rocketlake
++
++config MALDERLAKE
++ bool "Intel Alder Lake"
++ depends on GCC_VERSION > 110000
++ select X86_P6_NOP
++ ---help---
++
++ Select this for twelfth-generation processors in the Alder Lake family.
++
++ Enables -march=alderlake
+
config GENERIC_CPU
bool "Generic-x86-64"
depends on X86_64
-@@ -287,6 +511,16 @@ config GENERIC_CPU
+@@ -287,6 +550,50 @@ config GENERIC_CPU
Generic x86-64 CPU.
Run equally well on all x86-64 CPUs.
-+config MNATIVE
-+ bool "Native optimizations autodetected by GCC"
++config GENERIC_CPU2
++ bool "Generic-x86-64-v2"
++ depends on GCC_VERSION > 110000
++ depends on X86_64
++ ---help---
++ Generic x86-64 CPU.
++ Run equally well on all x86-64 CPUs with min support of x86-64-v2.
++
++config GENERIC_CPU3
++ bool "Generic-x86-64-v3"
++ depends on GCC_VERSION > 110000
++ depends on X86_64
++ ---help---
++ Generic x86-64-v3 CPU with v3 instructions.
++ Run equally well on all x86-64 CPUs with min support of x86-64-v3.
++
++config GENERIC_CPU4
++ bool "Generic-x86-64-v4"
++ depends on GCC_VERSION > 110000
++ depends on X86_64
++ ---help---
++ Generic x86-64 CPU with v4 instructions.
++ Run equally well on all x86-64 CPUs with min support of x86-64-v4.
++
++config MNATIVE_INTEL
++ bool "Intel-Native optimizations autodetected by GCC"
+ ---help---
+
+ GCC 4.2 and above support -march=native, which automatically detects
@@ -383,70 +471,80 @@ index 8e29c991ba3e..a1a12d8dfc50 100644
+ for AMD CPUs. Intel Only!
+
+ Enables -march=native
++
++config MNATIVE_AMD
++ bool "AMD-Native optimizations autodetected by GCC"
++ ---help---
++
++ GCC 4.2 and above support -march=native, which automatically detects
++ the optimum settings to use based on your processor. Do NOT use this
++ for AMD CPUs. AMD Only!
++
++ Enables -march=native
+
endchoice
config X86_GENERIC
-@@ -311,7 +545,7 @@ config X86_INTERNODE_CACHE_SHIFT
+@@ -311,7 +618,7 @@ config X86_INTERNODE_CACHE_SHIFT
config X86_L1_CACHE_SHIFT
int
default "7" if MPENTIUM4 || MPSC
- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
-+ default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE || X86_GENERIC || GENERIC_CPU
++ default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MNATIVE_INTEL || MNATIVE_AMD || X86_GENERIC || GENERIC_CPU || GENERIC_CPU2 || GENERIC_CPU3 || GENERIC_CPU4
default "4" if MELAN || M486 || MGEODEGX1
default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
-@@ -329,11 +563,11 @@ config X86_ALIGNMENT_16
+@@ -329,11 +636,11 @@ config X86_ALIGNMENT_16
config X86_INTEL_USERCOPY
def_bool y
- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
-+ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE
++ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MNATIVE_INTEL
config X86_USE_PPRO_CHECKSUM
def_bool y
- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
-+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE
++ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MNATIVE_INTEL || MNATIVE_AMD
config X86_USE_3DNOW
def_bool y
-@@ -353,26 +587,26 @@ config X86_USE_3DNOW
+@@ -353,26 +660,26 @@ config X86_USE_3DNOW
config X86_P6_NOP
def_bool y
depends on X86_64
- depends on (MCORE2 || MPENTIUM4 || MPSC)
-+ depends on (MCORE2 || MPENTIUM4 || MPSC || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE)
++ depends on (MCORE2 || MPENTIUM4 || MPSC || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MNATIVE_INTEL)
config X86_TSC
def_bool y
- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
-+ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE) || X86_64
++ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MNATIVE_INTEL || MNATIVE_AMD) || X86_64
config X86_CMPXCHG64
def_bool y
- depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8
-+ depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE
++ depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MNATIVE_INTEL || MNATIVE_AMD
# this should be set for all -march=.. options where the compiler
# generates cmov.
config X86_CMOV
def_bool y
- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
-+ depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE)
++ depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MNATIVE_INTEL || MNATIVE_AMD)
config X86_MINIMUM_CPU_FAMILY
int
default "64" if X86_64
- default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8)
-+ default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MNATIVE)
++ default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MNATIVE_INTEL || MNATIVE_AMD)
default "5" if X86_32 && X86_CMPXCHG64
default "4"
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
-index 8ca3cf7c5ec9..d954e5be917e 100644
+index 94df0868804b..09b1905de4cb 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
-@@ -124,11 +124,40 @@ else
+@@ -121,11 +121,48 @@ else
# FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
@@ -469,8 +567,10 @@ index 8ca3cf7c5ec9..d954e5be917e 100644
+ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-mno-tbm)
+ cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1)
+ cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2)
++ cflags-$(CONFIG_MZEN3) += $(call cc-option,-march=znver3)
+
-+ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
++ cflags-$(CONFIG_MNATIVE_INTEL) += $(call cc-option,-march=native)
++ cflags-$(CONFIG_MNATIVE_AMD) += $(call cc-option,-march=native)
+ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell)
+ cflags-$(CONFIG_MCORE2) += $(call cc-option,-march=core2)
+ cflags-$(CONFIG_MNEHALEM) += $(call cc-option,-march=nehalem)
@@ -489,19 +589,27 @@ index 8ca3cf7c5ec9..d954e5be917e 100644
+ cflags-$(CONFIG_MCASCADELAKE) += $(call cc-option,-march=cascadelake)
+ cflags-$(CONFIG_MCOOPERLAKE) += $(call cc-option,-march=cooperlake)
+ cflags-$(CONFIG_MTIGERLAKE) += $(call cc-option,-march=tigerlake)
++ cflags-$(CONFIG_MSAPPHIRERAPIDS) += $(call cc-option,-march=sapphirerapids)
++ cflags-$(CONFIG_MROCKETLAKE) += $(call cc-option,-march=rocketlake)
++ cflags-$(CONFIG_MALDERLAKE) += $(call cc-option,-march=alderlake)
++ cflags-$(CONFIG_GENERIC_CPU2) += $(call cc-option,-march=x86-64-v2)
++ cflags-$(CONFIG_GENERIC_CPU3) += $(call cc-option,-march=x86-64-v3)
++ cflags-$(CONFIG_GENERIC_CPU4) += $(call cc-option,-march=x86-64-v4)
cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
KBUILD_CFLAGS += $(cflags-y)
diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
-index 7948a17febb4..eaf4ff82561f 100644
+index 7948a17febb4..6651f4d8dc51 100644
--- a/arch/x86/include/asm/module.h
+++ b/arch/x86/include/asm/module.h
-@@ -25,6 +25,40 @@ struct mod_arch_specific {
+@@ -25,6 +25,48 @@ struct mod_arch_specific {
#define MODULE_PROC_FAMILY "586MMX "
#elif defined CONFIG_MCORE2
#define MODULE_PROC_FAMILY "CORE2 "
-+#elif defined CONFIG_MNATIVE
-+#define MODULE_PROC_FAMILY "NATIVE "
++#elif defined CONFIG_MNATIVE_INTEL
++#define MODULE_PROC_FAMILY "NATIVE_INTEL "
++#elif defined CONFIG_MNATIVE_AMD
++#define MODULE_PROC_FAMILY "NATIVE_AMD "
+#elif defined CONFIG_MNEHALEM
+#define MODULE_PROC_FAMILY "NEHALEM "
+#elif defined CONFIG_MWESTMERE
@@ -534,10 +642,16 @@ index 7948a17febb4..eaf4ff82561f 100644
+#define MODULE_PROC_FAMILY "COOPERLAKE "
+#elif defined CONFIG_MTIGERLAKE
+#define MODULE_PROC_FAMILY "TIGERLAKE "
++#elif defined CONFIG_MSAPPHIRERAPIDS
++#define MODULE_PROC_FAMILY "SAPPHIRERAPIDS "
++#elif defined CONFIG_MROCKETLAKE
++#define MODULE_PROC_FAMILY "ROCKETLAKE "
++#elif defined CONFIG_MALDERLAKE
++#define MODULE_PROC_FAMILY "ALDERLAKE "
#elif defined CONFIG_MATOM
#define MODULE_PROC_FAMILY "ATOM "
#elif defined CONFIG_M686
-@@ -43,6 +77,28 @@ struct mod_arch_specific {
+@@ -43,6 +85,30 @@ struct mod_arch_specific {
#define MODULE_PROC_FAMILY "K7 "
#elif defined CONFIG_MK8
#define MODULE_PROC_FAMILY "K8 "
@@ -563,9 +677,11 @@ index 7948a17febb4..eaf4ff82561f 100644
+#define MODULE_PROC_FAMILY "ZEN "
+#elif defined CONFIG_MZEN2
+#define MODULE_PROC_FAMILY "ZEN2 "
++#elif defined CONFIG_MZEN3
++#define MODULE_PROC_FAMILY "ZEN3 "
#elif defined CONFIG_MELAN
#define MODULE_PROC_FAMILY "ELAN "
#elif defined CONFIG_MCRUSOE
--
-2.30.1
+2.31.1
diff --git a/5011_enable-cpu-optimizations-for-gcc8.patch b/5011_enable-cpu-optimizations-for-gcc8.patch
deleted file mode 100644
index bfd2065..0000000
--- a/5011_enable-cpu-optimizations-for-gcc8.patch
+++ /dev/null
@@ -1,569 +0,0 @@
-WARNING
-This patch works with gcc versions 8.1+ and with kernel version 4.13+ and should
-NOT be applied when compiling on older versions of gcc due to key name changes
-of the march flags introduced with the version 4.9 release of gcc.[1]
-
-Use the older version of this patch hosted on the same github for older
-versions of gcc.
-
-FEATURES
-This patch adds additional CPU options to the Linux kernel accessible under:
- Processor type and features --->
- Processor family --->
-
-The expanded microarchitectures include:
-* AMD Improved K8-family
-* AMD K10-family
-* AMD Family 10h (Barcelona)
-* AMD Family 14h (Bobcat)
-* AMD Family 16h (Jaguar)
-* AMD Family 15h (Bulldozer)
-* AMD Family 15h (Piledriver)
-* AMD Family 15h (Steamroller)
-* AMD Family 15h (Excavator)
-* AMD Family 17h (Zen)
-* Intel Silvermont low-power processors
-* Intel 1st Gen Core i3/i5/i7 (Nehalem)
-* Intel 1.5 Gen Core i3/i5/i7 (Westmere)
-* Intel 2nd Gen Core i3/i5/i7 (Sandybridge)
-* Intel 3rd Gen Core i3/i5/i7 (Ivybridge)
-* Intel 4th Gen Core i3/i5/i7 (Haswell)
-* Intel 5th Gen Core i3/i5/i7 (Broadwell)
-* Intel 6th Gen Core i3/i5/i7 (Skylake)
-* Intel 6th Gen Core i7/i9 (Skylake X)
-* Intel 8th Gen Core i3/i5/i7 (Cannon Lake)
-* Intel 8th Gen Core i7/i9 (Ice Lake)
-
-It also offers to compile passing the 'native' option which, "selects the CPU
-to generate code for at compilation time by determining the processor type of
-the compiling machine. Using -march=native enables all instruction subsets
-supported by the local machine and will produce code optimized for the local
-machine under the constraints of the selected instruction set."[3]
-
-MINOR NOTES
-This patch also changes 'atom' to 'bonnell' in accordance with the gcc v4.9
-changes. Note that upstream is using the deprecated 'match=atom' flags when I
-believe it should use the newer 'march=bonnell' flag for atom processors.[2]
-
-It is not recommended to compile on Atom-CPUs with the 'native' option.[4] The
-recommendation is to use the 'atom' option instead.
-
-BENEFITS
-Small but real speed increases are measurable using a make endpoint comparing
-a generic kernel to one built with one of the respective microarchs.
-
-See the following experimental evidence supporting this statement:
-https://github.com/graysky2/kernel_gcc_patch
-
-REQUIREMENTS
-linux version >=4.20
-gcc version >=8.1
-
-ACKNOWLEDGMENTS
-This patch builds on the seminal work by Jeroen.[5]
-
-REFERENCES
-1. https://gcc.gnu.org/gcc-4.9/changes.html
-2. https://bugzilla.kernel.org/show_bug.cgi?id=77461
-3. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
-4. https://github.com/graysky2/kernel_gcc_patch/issues/15
-5. http://www.linuxforge.net/docs/linux/linux-gcc.php
-
---- a/arch/x86/Makefile_32.cpu 2019-02-22 09:22:03.426937735 -0500
-+++ b/arch/x86/Makefile_32.cpu 2019-02-22 09:37:58.680968580 -0500
-@@ -23,7 +23,18 @@ cflags-$(CONFIG_MK6) += -march=k6
- # Please note, that patches that add -march=athlon-xp and friends are pointless.
- # They make zero difference whatsosever to performance at this time.
- cflags-$(CONFIG_MK7) += -march=athlon
-+cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
- cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8,-march=athlon)
-+cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-march=athlon)
-+cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10,-march=athlon)
-+cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona,-march=athlon)
-+cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1,-march=athlon)
-+cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2,-march=athlon)
-+cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1,-march=athlon)
-+cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2,-march=athlon)
-+cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3,-march=athlon)
-+cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4,-march=athlon)
-+cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1,-march=athlon)
- cflags-$(CONFIG_MCRUSOE) += -march=i686 -falign-functions=0 -falign-jumps=0 -falign-loops=0
- cflags-$(CONFIG_MEFFICEON) += -march=i686 $(call tune,pentium3) -falign-functions=0 -falign-jumps=0 -falign-loops=0
- cflags-$(CONFIG_MWINCHIPC6) += $(call cc-option,-march=winchip-c6,-march=i586)
-@@ -32,9 +43,20 @@ cflags-$(CONFIG_MCYRIXIII) += $(call cc-
- cflags-$(CONFIG_MVIAC3_2) += $(call cc-option,-march=c3-2,-march=i686)
- cflags-$(CONFIG_MVIAC7) += -march=i686
- cflags-$(CONFIG_MCORE2) += -march=i686 $(call tune,core2)
--cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom,$(call cc-option,-march=core2,-march=i686)) \
-- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
--
-+cflags-$(CONFIG_MNEHALEM) += -march=i686 $(call tune,nehalem)
-+cflags-$(CONFIG_MWESTMERE) += -march=i686 $(call tune,westmere)
-+cflags-$(CONFIG_MSILVERMONT) += -march=i686 $(call tune,silvermont)
-+cflags-$(CONFIG_MSANDYBRIDGE) += -march=i686 $(call tune,sandybridge)
-+cflags-$(CONFIG_MIVYBRIDGE) += -march=i686 $(call tune,ivybridge)
-+cflags-$(CONFIG_MHASWELL) += -march=i686 $(call tune,haswell)
-+cflags-$(CONFIG_MBROADWELL) += -march=i686 $(call tune,broadwell)
-+cflags-$(CONFIG_MSKYLAKE) += -march=i686 $(call tune,skylake)
-+cflags-$(CONFIG_MSKYLAKEX) += -march=i686 $(call tune,skylake-avx512)
-+cflags-$(CONFIG_MCANNONLAKE) += -march=i686 $(call tune,cannonlake)
-+cflags-$(CONFIG_MICELAKE) += -march=i686 $(call tune,icelake)
-+cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell,$(call cc-option,-march=core2,-march=i686)) \
-+ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
-+
- # AMD Elan support
- cflags-$(CONFIG_MELAN) += -march=i486
-
---- a/arch/x86/Kconfig.cpu 2019-02-22 09:22:11.576958595 -0500
-+++ b/arch/x86/Kconfig.cpu 2019-02-22 09:34:16.490003911 -0500
-@@ -116,6 +116,7 @@ config MPENTIUMM
- config MPENTIUM4
- bool "Pentium-4/Celeron(P4-based)/Pentium-4 M/older Xeon"
- depends on X86_32
-+ select X86_P6_NOP
- ---help---
- Select this for Intel Pentium 4 chips. This includes the
- Pentium 4, Pentium D, P4-based Celeron and Xeon, and
-@@ -150,7 +151,7 @@ config MPENTIUM4
-
-
- config MK6
-- bool "K6/K6-II/K6-III"
-+ bool "AMD K6/K6-II/K6-III"
- depends on X86_32
- ---help---
- Select this for an AMD K6-family processor. Enables use of
-@@ -158,7 +159,7 @@ config MK6
- flags to GCC.
-
- config MK7
-- bool "Athlon/Duron/K7"
-+ bool "AMD Athlon/Duron/K7"
- depends on X86_32
- ---help---
- Select this for an AMD Athlon K7-family processor. Enables use of
-@@ -166,11 +167,81 @@ config MK7
- flags to GCC.
-
- config MK8
-- bool "Opteron/Athlon64/Hammer/K8"
-+ bool "AMD Opteron/Athlon64/Hammer/K8"
- ---help---
- Select this for an AMD Opteron or Athlon64 Hammer-family processor.
- Enables use of some extended instructions, and passes appropriate
- optimization flags to GCC.
-+config MK8SSE3
-+ bool "AMD Opteron/Athlon64/Hammer/K8 with SSE3"
-+ ---help---
-+ Select this for improved AMD Opteron or Athlon64 Hammer-family processors.
-+ Enables use of some extended instructions, and passes appropriate
-+ optimization flags to GCC.
-+
-+config MK10
-+ bool "AMD 61xx/7x50/PhenomX3/X4/II/K10"
-+ ---help---
-+ Select this for an AMD 61xx Eight-Core Magny-Cours, Athlon X2 7x50,
-+ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
-+ Enables use of some extended instructions, and passes appropriate
-+ optimization flags to GCC.
-+
-+config MBARCELONA
-+ bool "AMD Barcelona"
-+ ---help---
-+ Select this for AMD Family 10h Barcelona processors.
-+
-+ Enables -march=barcelona
-+
-+config MBOBCAT
-+ bool "AMD Bobcat"
-+ ---help---
-+ Select this for AMD Family 14h Bobcat processors.
-+
-+ Enables -march=btver1
-+
-+config MJAGUAR
-+ bool "AMD Jaguar"
-+ ---help---
-+ Select this for AMD Family 16h Jaguar processors.
-+
-+ Enables -march=btver2
-+
-+config MBULLDOZER
-+ bool "AMD Bulldozer"
-+ ---help---
-+ Select this for AMD Family 15h Bulldozer processors.
-+
-+ Enables -march=bdver1
-+
-+config MPILEDRIVER
-+ bool "AMD Piledriver"
-+ ---help---
-+ Select this for AMD Family 15h Piledriver processors.
-+
-+ Enables -march=bdver2
-+
-+config MSTEAMROLLER
-+ bool "AMD Steamroller"
-+ ---help---
-+ Select this for AMD Family 15h Steamroller processors.
-+
-+ Enables -march=bdver3
-+
-+config MEXCAVATOR
-+ bool "AMD Excavator"
-+ ---help---
-+ Select this for AMD Family 15h Excavator processors.
-+
-+ Enables -march=bdver4
-+
-+config MZEN
-+ bool "AMD Zen"
-+ ---help---
-+ Select this for AMD Family 17h Zen processors.
-+
-+ Enables -march=znver1
-
- config MCRUSOE
- bool "Crusoe"
-@@ -253,6 +324,7 @@ config MVIAC7
-
- config MPSC
- bool "Intel P4 / older Netburst based Xeon"
-+ select X86_P6_NOP
- depends on X86_64
- ---help---
- Optimize for Intel Pentium 4, Pentium D and older Nocona/Dempsey
-@@ -262,23 +334,126 @@ config MPSC
- using the cpu family field
- in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
-
-+config MATOM
-+ bool "Intel Atom"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Atom platform. Intel Atom CPUs have an
-+ in-order pipelining architecture and thus can benefit from
-+ accordingly optimized code. Use a recent GCC with specific Atom
-+ support in order to fully benefit from selecting this option.
-+
- config MCORE2
-- bool "Core 2/newer Xeon"
-+ bool "Intel Core 2"
-+ select X86_P6_NOP
-+
- ---help---
-
- Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
- 53xx) CPUs. You can distinguish newer from older Xeons by the CPU
- family in /proc/cpuinfo. Newer ones have 6 and older ones 15
- (not a typo)
-+ Enables -march=core2
-
--config MATOM
-- bool "Intel Atom"
-+config MNEHALEM
-+ bool "Intel Nehalem"
-+ select X86_P6_NOP
- ---help---
-
-- Select this for the Intel Atom platform. Intel Atom CPUs have an
-- in-order pipelining architecture and thus can benefit from
-- accordingly optimized code. Use a recent GCC with specific Atom
-- support in order to fully benefit from selecting this option.
-+ Select this for 1st Gen Core processors in the Nehalem family.
-+
-+ Enables -march=nehalem
-+
-+config MWESTMERE
-+ bool "Intel Westmere"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Westmere formerly Nehalem-C family.
-+
-+ Enables -march=westmere
-+
-+config MSILVERMONT
-+ bool "Intel Silvermont"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Silvermont platform.
-+
-+ Enables -march=silvermont
-+
-+config MSANDYBRIDGE
-+ bool "Intel Sandy Bridge"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 2nd Gen Core processors in the Sandy Bridge family.
-+
-+ Enables -march=sandybridge
-+
-+config MIVYBRIDGE
-+ bool "Intel Ivy Bridge"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 3rd Gen Core processors in the Ivy Bridge family.
-+
-+ Enables -march=ivybridge
-+
-+config MHASWELL
-+ bool "Intel Haswell"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 4th Gen Core processors in the Haswell family.
-+
-+ Enables -march=haswell
-+
-+config MBROADWELL
-+ bool "Intel Broadwell"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 5th Gen Core processors in the Broadwell family.
-+
-+ Enables -march=broadwell
-+
-+config MSKYLAKE
-+ bool "Intel Skylake"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 6th Gen Core processors in the Skylake family.
-+
-+ Enables -march=skylake
-+
-+config MSKYLAKEX
-+ bool "Intel Skylake X"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 6th Gen Core processors in the Skylake X family.
-+
-+ Enables -march=skylake-avx512
-+
-+config MCANNONLAKE
-+ bool "Intel Cannon Lake"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 8th Gen Core processors
-+
-+ Enables -march=cannonlake
-+
-+config MICELAKE
-+ bool "Intel Ice Lake"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 8th Gen Core processors in the Ice Lake family.
-+
-+ Enables -march=icelake
-
- config GENERIC_CPU
- bool "Generic-x86-64"
-@@ -287,6 +462,19 @@ config GENERIC_CPU
- Generic x86-64 CPU.
- Run equally well on all x86-64 CPUs.
-
-+config MNATIVE
-+ bool "Native optimizations autodetected by GCC"
-+ ---help---
-+
-+ GCC 4.2 and above support -march=native, which automatically detects
-+ the optimum settings to use based on your processor. -march=native
-+ also detects and applies additional settings beyond -march specific
-+ to your CPU, (eg. -msse4). Unless you have a specific reason not to
-+ (e.g. distcc cross-compiling), you should probably be using
-+ -march=native rather than anything listed below.
-+
-+ Enables -march=native
-+
- endchoice
-
- config X86_GENERIC
-@@ -311,7 +499,7 @@ config X86_INTERNODE_CACHE_SHIFT
- config X86_L1_CACHE_SHIFT
- int
- default "7" if MPENTIUM4 || MPSC
-- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
-+ default "6" if MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MJAGUAR || MPENTIUMM || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MNATIVE || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
- default "4" if MELAN || M486 || MGEODEGX1
- default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
-
-@@ -329,39 +517,40 @@ config X86_ALIGNMENT_16
-
- config X86_INTEL_USERCOPY
- def_bool y
-- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
-+ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK8SSE3 || MK7 || MEFFICEON || MCORE2 || MK10 || MBARCELONA || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MNATIVE
-
- config X86_USE_PPRO_CHECKSUM
- def_bool y
-- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
-+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MK10 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MATOM || MNATIVE
-
- config X86_USE_3DNOW
- def_bool y
- depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
-
--#
--# P6_NOPs are a relatively minor optimization that require a family >=
--# 6 processor, except that it is broken on certain VIA chips.
--# Furthermore, AMD chips prefer a totally different sequence of NOPs
--# (which work on all CPUs). In addition, it looks like Virtual PC
--# does not understand them.
--#
--# As a result, disallow these if we're not compiling for X86_64 (these
--# NOPs do work on all x86-64 capable chips); the list of processors in
--# the right-hand clause are the cores that benefit from this optimization.
--#
- config X86_P6_NOP
-- def_bool y
-- depends on X86_64
-- depends on (MCORE2 || MPENTIUM4 || MPSC)
-+ default n
-+ bool "Support for P6_NOPs on Intel chips"
-+ depends on (MCORE2 || MPENTIUM4 || MPSC || MATOM || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MNATIVE)
-+ ---help---
-+ P6_NOPs are a relatively minor optimization that require a family >=
-+ 6 processor, except that it is broken on certain VIA chips.
-+ Furthermore, AMD chips prefer a totally different sequence of NOPs
-+ (which work on all CPUs). In addition, it looks like Virtual PC
-+ does not understand them.
-+
-+ As a result, disallow these if we're not compiling for X86_64 (these
-+ NOPs do work on all x86-64 capable chips); the list of processors in
-+ the right-hand clause are the cores that benefit from this optimization.
-
-+ Say Y if you have Intel CPU newer than Pentium Pro, N otherwise.
-+
- config X86_TSC
- def_bool y
-- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
-+ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MK8SSE3 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MNATIVE || MATOM) || X86_64
-
- config X86_CMPXCHG64
- def_bool y
-- depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8
-+ depends on (MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MJAGUAR || MK7 || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MNATIVE || MATOM || MGEODE_LX)
-
- # this should be set for all -march=.. options where the compiler
- # generates cmov.
---- a/arch/x86/Makefile 2019-02-22 09:21:58.196924367 -0500
-+++ b/arch/x86/Makefile 2019-02-22 09:36:27.310577832 -0500
-@@ -118,13 +118,46 @@ else
- KBUILD_CFLAGS += $(call cc-option,-mskip-rax-setup)
-
- # FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
-+ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
- cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
-+ cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3,-mtune=k8)
-+ cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10)
-+ cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona)
-+ cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1)
-+ cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2)
-+ cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1)
-+ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2)
-+ cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3)
-+ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4)
-+ cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1)
- cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
-
- cflags-$(CONFIG_MCORE2) += \
-- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
-- cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
-- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
-+ $(call cc-option,-march=core2,$(call cc-option,-mtune=core2))
-+ cflags-$(CONFIG_MNEHALEM) += \
-+ $(call cc-option,-march=nehalem,$(call cc-option,-mtune=nehalem))
-+ cflags-$(CONFIG_MWESTMERE) += \
-+ $(call cc-option,-march=westmere,$(call cc-option,-mtune=westmere))
-+ cflags-$(CONFIG_MSILVERMONT) += \
-+ $(call cc-option,-march=silvermont,$(call cc-option,-mtune=silvermont))
-+ cflags-$(CONFIG_MSANDYBRIDGE) += \
-+ $(call cc-option,-march=sandybridge,$(call cc-option,-mtune=sandybridge))
-+ cflags-$(CONFIG_MIVYBRIDGE) += \
-+ $(call cc-option,-march=ivybridge,$(call cc-option,-mtune=ivybridge))
-+ cflags-$(CONFIG_MHASWELL) += \
-+ $(call cc-option,-march=haswell,$(call cc-option,-mtune=haswell))
-+ cflags-$(CONFIG_MBROADWELL) += \
-+ $(call cc-option,-march=broadwell,$(call cc-option,-mtune=broadwell))
-+ cflags-$(CONFIG_MSKYLAKE) += \
-+ $(call cc-option,-march=skylake,$(call cc-option,-mtune=skylake))
-+ cflags-$(CONFIG_MSKYLAKEX) += \
-+ $(call cc-option,-march=skylake-avx512,$(call cc-option,-mtune=skylake-avx512))
-+ cflags-$(CONFIG_MCANNONLAKE) += \
-+ $(call cc-option,-march=cannonlake,$(call cc-option,-mtune=cannonlake))
-+ cflags-$(CONFIG_MICELAKE) += \
-+ $(call cc-option,-march=icelake,$(call cc-option,-mtune=icelake))
-+ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell) \
-+ $(call cc-option,-mtune=bonnell,$(call cc-option,-mtune=generic))
- cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
- KBUILD_CFLAGS += $(cflags-y)
-
---- a/arch/x86/include/asm/module.h 2019-02-22 09:22:26.726997480 -0500
-+++ b/arch/x86/include/asm/module.h 2019-02-22 09:40:04.231493392 -0500
-@@ -25,6 +25,30 @@ struct mod_arch_specific {
- #define MODULE_PROC_FAMILY "586MMX "
- #elif defined CONFIG_MCORE2
- #define MODULE_PROC_FAMILY "CORE2 "
-+#elif defined CONFIG_MNATIVE
-+#define MODULE_PROC_FAMILY "NATIVE "
-+#elif defined CONFIG_MNEHALEM
-+#define MODULE_PROC_FAMILY "NEHALEM "
-+#elif defined CONFIG_MWESTMERE
-+#define MODULE_PROC_FAMILY "WESTMERE "
-+#elif defined CONFIG_MSILVERMONT
-+#define MODULE_PROC_FAMILY "SILVERMONT "
-+#elif defined CONFIG_MSANDYBRIDGE
-+#define MODULE_PROC_FAMILY "SANDYBRIDGE "
-+#elif defined CONFIG_MIVYBRIDGE
-+#define MODULE_PROC_FAMILY "IVYBRIDGE "
-+#elif defined CONFIG_MHASWELL
-+#define MODULE_PROC_FAMILY "HASWELL "
-+#elif defined CONFIG_MBROADWELL
-+#define MODULE_PROC_FAMILY "BROADWELL "
-+#elif defined CONFIG_MSKYLAKE
-+#define MODULE_PROC_FAMILY "SKYLAKE "
-+#elif defined CONFIG_MSKYLAKEX
-+#define MODULE_PROC_FAMILY "SKYLAKEX "
-+#elif defined CONFIG_MCANNONLAKE
-+#define MODULE_PROC_FAMILY "CANNONLAKE "
-+#elif defined CONFIG_MICELAKE
-+#define MODULE_PROC_FAMILY "ICELAKE "
- #elif defined CONFIG_MATOM
- #define MODULE_PROC_FAMILY "ATOM "
- #elif defined CONFIG_M686
-@@ -43,6 +67,26 @@ struct mod_arch_specific {
- #define MODULE_PROC_FAMILY "K7 "
- #elif defined CONFIG_MK8
- #define MODULE_PROC_FAMILY "K8 "
-+#elif defined CONFIG_MK8SSE3
-+#define MODULE_PROC_FAMILY "K8SSE3 "
-+#elif defined CONFIG_MK10
-+#define MODULE_PROC_FAMILY "K10 "
-+#elif defined CONFIG_MBARCELONA
-+#define MODULE_PROC_FAMILY "BARCELONA "
-+#elif defined CONFIG_MBOBCAT
-+#define MODULE_PROC_FAMILY "BOBCAT "
-+#elif defined CONFIG_MBULLDOZER
-+#define MODULE_PROC_FAMILY "BULLDOZER "
-+#elif defined CONFIG_MPILEDRIVER
-+#define MODULE_PROC_FAMILY "PILEDRIVER "
-+#elif defined CONFIG_MSTEAMROLLER
-+#define MODULE_PROC_FAMILY "STEAMROLLER "
-+#elif defined CONFIG_MJAGUAR
-+#define MODULE_PROC_FAMILY "JAGUAR "
-+#elif defined CONFIG_MEXCAVATOR
-+#define MODULE_PROC_FAMILY "EXCAVATOR "
-+#elif defined CONFIG_MZEN
-+#define MODULE_PROC_FAMILY "ZEN "
- #elif defined CONFIG_MELAN
- #define MODULE_PROC_FAMILY "ELAN "
- #elif defined CONFIG_MCRUSOE
diff --git a/5012_enable-cpu-optimizations-for-gcc91.patch b/5012_enable-cpu-optimizations-for-gcc91.patch
deleted file mode 100644
index 8662cb5..0000000
--- a/5012_enable-cpu-optimizations-for-gcc91.patch
+++ /dev/null
@@ -1,549 +0,0 @@
-From 7dc4b32d619ba7c8e1558d37a74183b6d86bf7d2 Mon Sep 17 00:00:00 2001
-From: graysky <graysky@archlinux.us>
-Date: Tue, 9 Mar 2021 02:14:13 -0500
-Subject: [PATCH] more-uarches-for-gcc-v9-and-kernel-4.19-5.4
-
-WARNING
-This patch works with gcc versions 9.1+ and with kernel version 4.19-5.4 and
-NOT be applied when compiling on older versions of gcc due to key name changes
-of the march flags introduced with the version 4.9 release of gcc.[1]
-
-Use the older version of this patch hosted on the same github for older
-versions of gcc.
-
-FEATURES
-This patch adds additional CPU options to the Linux kernel accessible under:
- Processor type and features --->
- Processor family --->
-
-The expanded microarchitectures include:
-* AMD Improved K8-family
-* AMD K10-family
-* AMD Family 10h (Barcelona)
-* AMD Family 14h (Bobcat)
-* AMD Family 16h (Jaguar)
-* AMD Family 15h (Bulldozer)
-* AMD Family 15h (Piledriver)
-* AMD Family 15h (Steamroller)
-* AMD Family 15h (Excavator)
-* AMD Family 17h (Zen)
-* AMD Family 17h (Zen 2)
-* Intel Silvermont low-power processors
-* Intel Goldmont low-power processors (Apollo Lake and Denverton)
-* Intel Goldmont Plus low-power processors (Gemini Lake)
-* Intel 1st Gen Core i3/i5/i7 (Nehalem)
-* Intel 1.5 Gen Core i3/i5/i7 (Westmere)
-* Intel 2nd Gen Core i3/i5/i7 (Sandybridge)
-* Intel 3rd Gen Core i3/i5/i7 (Ivybridge)
-* Intel 4th Gen Core i3/i5/i7 (Haswell)
-* Intel 5th Gen Core i3/i5/i7 (Broadwell)
-* Intel 6th Gen Core i3/i5/i7 (Skylake)
-* Intel 6th Gen Core i7/i9 (Skylake X)
-* Intel 8th Gen Core i3/i5/i7 (Cannon Lake)
-* Intel 10th Gen Core i7/i9 (Ice Lake)
-* Intel Xeon (Cascade Lake)
-
-It also offers to compile passing the 'native' option which, "selects the CPU
-to generate code for at compilation time by determining the processor type of
-the compiling machine. Using -march=native enables all instruction subsets
-supported by the local machine and will produce code optimized for the local
-machine under the constraints of the selected instruction set."[2]
-
-Do NOT try using the 'native' option on AMD Piledriver, Steamroller, or
-Excavator CPUs (-march=bdver{2,3,4} flag). The build will error out due the
-kernel's objtool issue with these.[3a,b]
-
-MINOR NOTES
-This patch also changes 'atom' to 'bonnell' in accordance with the gcc v4.9
-changes. Note that upstream is using the deprecated 'match=atom' flags when I
-believe it should use the newer 'march=bonnell' flag for atom processors.[4]
-
-It is not recommended to compile on Atom-CPUs with the 'native' option.[5] The
-recommendation is to use the 'atom' option instead.
-
-BENEFITS
-Small but real speed increases are measurable using a make endpoint comparing
-a generic kernel to one built with one of the respective microarchs.
-
-See the following experimental evidence supporting this statement:
-https://github.com/graysky2/kernel_gcc_patch
-
-REQUIREMENTS
-linux version >=4.19 and <5.5
-gcc version >=9.1 and <10
-
-ACKNOWLEDGMENTS
-This patch builds on the seminal work by Jeroen.[6]
-
-REFERENCES
-1. https://gcc.gnu.org/gcc-4.9/changes.html
-2. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html
-3a. https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95671#c11
-3b. https://github.com/graysky2/kernel_gcc_patch/issues/55
-4. https://bugzilla.kernel.org/show_bug.cgi?id=77461
-5. https://github.com/graysky2/kernel_gcc_patch/issues/15
-6. http://www.linuxforge.net/docs/linux/linux-gcc.php
----
- arch/x86/Kconfig.cpu | 240 ++++++++++++++++++++++++++++++++--
- arch/x86/Makefile | 37 +++++-
- arch/x86/include/asm/module.h | 52 ++++++++
- 3 files changed, 312 insertions(+), 17 deletions(-)
-
-diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
-index 638411f22267..18f0f04b9cb7 100644
---- a/arch/x86/Kconfig.cpu
-+++ b/arch/x86/Kconfig.cpu
-@@ -150,7 +150,7 @@ config MPENTIUM4
-
-
- config MK6
-- bool "K6/K6-II/K6-III"
-+ bool "AMD K6/K6-II/K6-III"
- depends on X86_32
- ---help---
- Select this for an AMD K6-family processor. Enables use of
-@@ -158,7 +158,7 @@ config MK6
- flags to GCC.
-
- config MK7
-- bool "Athlon/Duron/K7"
-+ bool "AMD Athlon/Duron/K7"
- depends on X86_32
- ---help---
- Select this for an AMD Athlon K7-family processor. Enables use of
-@@ -166,12 +166,90 @@ config MK7
- flags to GCC.
-
- config MK8
-- bool "Opteron/Athlon64/Hammer/K8"
-+ bool "AMD Opteron/Athlon64/Hammer/K8"
- ---help---
- Select this for an AMD Opteron or Athlon64 Hammer-family processor.
- Enables use of some extended instructions, and passes appropriate
- optimization flags to GCC.
-
-+config MK8SSE3
-+ bool "AMD Opteron/Athlon64/Hammer/K8 with SSE3"
-+ ---help---
-+ Select this for improved AMD Opteron or Athlon64 Hammer-family processors.
-+ Enables use of some extended instructions, and passes appropriate
-+ optimization flags to GCC.
-+
-+config MK10
-+ bool "AMD 61xx/7x50/PhenomX3/X4/II/K10"
-+ ---help---
-+ Select this for an AMD 61xx Eight-Core Magny-Cours, Athlon X2 7x50,
-+ Phenom X3/X4/II, Athlon II X2/X3/X4, or Turion II-family processor.
-+ Enables use of some extended instructions, and passes appropriate
-+ optimization flags to GCC.
-+
-+config MBARCELONA
-+ bool "AMD Barcelona"
-+ ---help---
-+ Select this for AMD Family 10h Barcelona processors.
-+
-+ Enables -march=barcelona
-+
-+config MBOBCAT
-+ bool "AMD Bobcat"
-+ ---help---
-+ Select this for AMD Family 14h Bobcat processors.
-+
-+ Enables -march=btver1
-+
-+config MJAGUAR
-+ bool "AMD Jaguar"
-+ ---help---
-+ Select this for AMD Family 16h Jaguar processors.
-+
-+ Enables -march=btver2
-+
-+config MBULLDOZER
-+ bool "AMD Bulldozer"
-+ ---help---
-+ Select this for AMD Family 15h Bulldozer processors.
-+
-+ Enables -march=bdver1
-+
-+config MPILEDRIVER
-+ bool "AMD Piledriver"
-+ ---help---
-+ Select this for AMD Family 15h Piledriver processors.
-+
-+ Enables -march=bdver2
-+
-+config MSTEAMROLLER
-+ bool "AMD Steamroller"
-+ ---help---
-+ Select this for AMD Family 15h Steamroller processors.
-+
-+ Enables -march=bdver3
-+
-+config MEXCAVATOR
-+ bool "AMD Excavator"
-+ ---help---
-+ Select this for AMD Family 15h Excavator processors.
-+
-+ Enables -march=bdver4
-+
-+config MZEN
-+ bool "AMD Zen"
-+ ---help---
-+ Select this for AMD Family 17h Zen processors.
-+
-+ Enables -march=znver1
-+
-+config MZEN2
-+ bool "AMD Zen 2"
-+ ---help---
-+ Select this for AMD Family 17h Zen 2 processors.
-+
-+ Enables -march=znver2
-+
- config MCRUSOE
- bool "Crusoe"
- depends on X86_32
-@@ -263,7 +341,7 @@ config MPSC
- in /proc/cpuinfo. Family 15 is an older Xeon, Family 6 a newer one.
-
- config MCORE2
-- bool "Core 2/newer Xeon"
-+ bool "Intel Core 2"
- ---help---
-
- Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
-@@ -271,6 +349,8 @@ config MCORE2
- family in /proc/cpuinfo. Newer ones have 6 and older ones 15
- (not a typo)
-
-+ Enables -march=core2
-+
- config MATOM
- bool "Intel Atom"
- ---help---
-@@ -280,6 +360,132 @@ config MATOM
- accordingly optimized code. Use a recent GCC with specific Atom
- support in order to fully benefit from selecting this option.
-
-+config MNEHALEM
-+ bool "Intel Nehalem"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 1st Gen Core processors in the Nehalem family.
-+
-+ Enables -march=nehalem
-+
-+config MWESTMERE
-+ bool "Intel Westmere"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Westmere formerly Nehalem-C family.
-+
-+ Enables -march=westmere
-+
-+config MSILVERMONT
-+ bool "Intel Silvermont"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Silvermont platform.
-+
-+ Enables -march=silvermont
-+
-+config MGOLDMONT
-+ bool "Intel Goldmont"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Goldmont platform including Apollo Lake and Denverton.
-+
-+ Enables -march=goldmont
-+
-+config MGOLDMONTPLUS
-+ bool "Intel Goldmont Plus"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for the Intel Goldmont Plus platform including Gemini Lake.
-+
-+ Enables -march=goldmont-plus
-+
-+config MSANDYBRIDGE
-+ bool "Intel Sandy Bridge"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 2nd Gen Core processors in the Sandy Bridge family.
-+
-+ Enables -march=sandybridge
-+
-+config MIVYBRIDGE
-+ bool "Intel Ivy Bridge"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 3rd Gen Core processors in the Ivy Bridge family.
-+
-+ Enables -march=ivybridge
-+
-+config MHASWELL
-+ bool "Intel Haswell"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 4th Gen Core processors in the Haswell family.
-+
-+ Enables -march=haswell
-+
-+config MBROADWELL
-+ bool "Intel Broadwell"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 5th Gen Core processors in the Broadwell family.
-+
-+ Enables -march=broadwell
-+
-+config MSKYLAKE
-+ bool "Intel Skylake"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 6th Gen Core processors in the Skylake family.
-+
-+ Enables -march=skylake
-+
-+config MSKYLAKEX
-+ bool "Intel Skylake X"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 6th Gen Core processors in the Skylake X family.
-+
-+ Enables -march=skylake-avx512
-+
-+config MCANNONLAKE
-+ bool "Intel Cannon Lake"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 8th Gen Core processors
-+
-+ Enables -march=cannonlake
-+
-+config MICELAKE
-+ bool "Intel Ice Lake"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for 10th Gen Core processors in the Ice Lake family.
-+
-+ Enables -march=icelake-client
-+
-+config MCASCADELAKE
-+ bool "Intel Cascade Lake"
-+ select X86_P6_NOP
-+ ---help---
-+
-+ Select this for Xeon processors in the Cascade Lake family.
-+
-+ Enables -march=cascadelake
-+
- config GENERIC_CPU
- bool "Generic-x86-64"
- depends on X86_64
-@@ -287,6 +493,16 @@ config GENERIC_CPU
- Generic x86-64 CPU.
- Run equally well on all x86-64 CPUs.
-
-+config MNATIVE
-+ bool "Native optimizations autodetected by GCC"
-+ ---help---
-+
-+ GCC 4.2 and above support -march=native, which automatically detects
-+ the optimum settings to use based on your processor. Do NOT use this
-+ for AMD CPUs. Intel Only!
-+
-+ Enables -march=native
-+
- endchoice
-
- config X86_GENERIC
-@@ -311,7 +527,7 @@ config X86_INTERNODE_CACHE_SHIFT
- config X86_L1_CACHE_SHIFT
- int
- default "7" if MPENTIUM4 || MPSC
-- default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU
-+ default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE || X86_GENERIC || GENERIC_CPU
- default "4" if MELAN || M486 || MGEODEGX1
- default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
-
-@@ -329,11 +545,11 @@ config X86_ALIGNMENT_16
-
- config X86_INTEL_USERCOPY
- def_bool y
-- depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2
-+ depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE
-
- config X86_USE_PPRO_CHECKSUM
- def_bool y
-- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM
-+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE
-
- config X86_USE_3DNOW
- def_bool y
-@@ -353,26 +569,26 @@ config X86_USE_3DNOW
- config X86_P6_NOP
- def_bool y
- depends on X86_64
-- depends on (MCORE2 || MPENTIUM4 || MPSC)
-+ depends on (MCORE2 || MPENTIUM4 || MPSC || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE)
-
- config X86_TSC
- def_bool y
-- depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM) || X86_64
-+ depends on (MWINCHIP3D || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MVIAC7 || MGEODEGX1 || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE) || X86_64
-
- config X86_CMPXCHG64
- def_bool y
-- depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8
-+ depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE
-
- # this should be set for all -march=.. options where the compiler
- # generates cmov.
- config X86_CMOV
- def_bool y
-- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
-+ depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE)
-
- config X86_MINIMUM_CPU_FAMILY
- int
- default "64" if X86_64
-- default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8)
-+ default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8 || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE || MCASCADELAKE || MNATIVE)
- default "5" if X86_32 && X86_CMPXCHG64
- default "4"
-
-diff --git a/arch/x86/Makefile b/arch/x86/Makefile
-index 4833dd7e2cc0..a0289273da72 100644
---- a/arch/x86/Makefile
-+++ b/arch/x86/Makefile
-@@ -121,11 +121,38 @@ else
- # FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
- cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
- cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
--
-- cflags-$(CONFIG_MCORE2) += \
-- $(call cc-option,-march=core2,$(call cc-option,-mtune=generic))
-- cflags-$(CONFIG_MATOM) += $(call cc-option,-march=atom) \
-- $(call cc-option,-mtune=atom,$(call cc-option,-mtune=generic))
-+ cflags-$(CONFIG_MK8SSE3) += $(call cc-option,-march=k8-sse3)
-+ cflags-$(CONFIG_MK10) += $(call cc-option,-march=amdfam10)
-+ cflags-$(CONFIG_MBARCELONA) += $(call cc-option,-march=barcelona)
-+ cflags-$(CONFIG_MBOBCAT) += $(call cc-option,-march=btver1)
-+ cflags-$(CONFIG_MJAGUAR) += $(call cc-option,-march=btver2)
-+ cflags-$(CONFIG_MBULLDOZER) += $(call cc-option,-march=bdver1)
-+ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-march=bdver2)
-+ cflags-$(CONFIG_MPILEDRIVER) += $(call cc-option,-mno-tbm)
-+ cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-march=bdver3)
-+ cflags-$(CONFIG_MSTEAMROLLER) += $(call cc-option,-mno-tbm)
-+ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-march=bdver4)
-+ cflags-$(CONFIG_MEXCAVATOR) += $(call cc-option,-mno-tbm)
-+ cflags-$(CONFIG_MZEN) += $(call cc-option,-march=znver1)
-+ cflags-$(CONFIG_MZEN2) += $(call cc-option,-march=znver2)
-+
-+ cflags-$(CONFIG_MNATIVE) += $(call cc-option,-march=native)
-+ cflags-$(CONFIG_MATOM) += $(call cc-option,-march=bonnell)
-+ cflags-$(CONFIG_MCORE2) += $(call cc-option,-march=core2)
-+ cflags-$(CONFIG_MNEHALEM) += $(call cc-option,-march=nehalem)
-+ cflags-$(CONFIG_MWESTMERE) += $(call cc-option,-march=westmere)
-+ cflags-$(CONFIG_MSILVERMONT) += $(call cc-option,-march=silvermont)
-+ cflags-$(CONFIG_MGOLDMONT) += $(call cc-option,-march=goldmont)
-+ cflags-$(CONFIG_MGOLDMONTPLUS) += $(call cc-option,-march=goldmont-plus)
-+ cflags-$(CONFIG_MSANDYBRIDGE) += $(call cc-option,-march=sandybridge)
-+ cflags-$(CONFIG_MIVYBRIDGE) += $(call cc-option,-march=ivybridge)
-+ cflags-$(CONFIG_MHASWELL) += $(call cc-option,-march=haswell)
-+ cflags-$(CONFIG_MBROADWELL) += $(call cc-option,-march=broadwell)
-+ cflags-$(CONFIG_MSKYLAKE) += $(call cc-option,-march=skylake)
-+ cflags-$(CONFIG_MSKYLAKEX) += $(call cc-option,-march=skylake-avx512)
-+ cflags-$(CONFIG_MCANNONLAKE) += $(call cc-option,-march=cannonlake)
-+ cflags-$(CONFIG_MICELAKE) += $(call cc-option,-march=icelake-client)
-+ cflags-$(CONFIG_MCASCADELAKE) += $(call cc-option,-march=cascadelake)
- cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
- KBUILD_CFLAGS += $(cflags-y)
-
-diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
-index 7948a17febb4..50b5e6ee4934 100644
---- a/arch/x86/include/asm/module.h
-+++ b/arch/x86/include/asm/module.h
-@@ -25,6 +25,36 @@ struct mod_arch_specific {
- #define MODULE_PROC_FAMILY "586MMX "
- #elif defined CONFIG_MCORE2
- #define MODULE_PROC_FAMILY "CORE2 "
-+#elif defined CONFIG_MNATIVE
-+#define MODULE_PROC_FAMILY "NATIVE "
-+#elif defined CONFIG_MNEHALEM
-+#define MODULE_PROC_FAMILY "NEHALEM "
-+#elif defined CONFIG_MWESTMERE
-+#define MODULE_PROC_FAMILY "WESTMERE "
-+#elif defined CONFIG_MSILVERMONT
-+#define MODULE_PROC_FAMILY "SILVERMONT "
-+#elif defined CONFIG_MGOLDMONT
-+#define MODULE_PROC_FAMILY "GOLDMONT "
-+#elif defined CONFIG_MGOLDMONTPLUS
-+#define MODULE_PROC_FAMILY "GOLDMONTPLUS "
-+#elif defined CONFIG_MSANDYBRIDGE
-+#define MODULE_PROC_FAMILY "SANDYBRIDGE "
-+#elif defined CONFIG_MIVYBRIDGE
-+#define MODULE_PROC_FAMILY "IVYBRIDGE "
-+#elif defined CONFIG_MHASWELL
-+#define MODULE_PROC_FAMILY "HASWELL "
-+#elif defined CONFIG_MBROADWELL
-+#define MODULE_PROC_FAMILY "BROADWELL "
-+#elif defined CONFIG_MSKYLAKE
-+#define MODULE_PROC_FAMILY "SKYLAKE "
-+#elif defined CONFIG_MSKYLAKEX
-+#define MODULE_PROC_FAMILY "SKYLAKEX "
-+#elif defined CONFIG_MCANNONLAKE
-+#define MODULE_PROC_FAMILY "CANNONLAKE "
-+#elif defined CONFIG_MICELAKE
-+#define MODULE_PROC_FAMILY "ICELAKE "
-+#elif defined CONFIG_MCASCADELAKE
-+#define MODULE_PROC_FAMILY "CASCADELAKE "
- #elif defined CONFIG_MATOM
- #define MODULE_PROC_FAMILY "ATOM "
- #elif defined CONFIG_M686
-@@ -43,6 +73,28 @@ struct mod_arch_specific {
- #define MODULE_PROC_FAMILY "K7 "
- #elif defined CONFIG_MK8
- #define MODULE_PROC_FAMILY "K8 "
-+#elif defined CONFIG_MK8SSE3
-+#define MODULE_PROC_FAMILY "K8SSE3 "
-+#elif defined CONFIG_MK10
-+#define MODULE_PROC_FAMILY "K10 "
-+#elif defined CONFIG_MBARCELONA
-+#define MODULE_PROC_FAMILY "BARCELONA "
-+#elif defined CONFIG_MBOBCAT
-+#define MODULE_PROC_FAMILY "BOBCAT "
-+#elif defined CONFIG_MBULLDOZER
-+#define MODULE_PROC_FAMILY "BULLDOZER "
-+#elif defined CONFIG_MPILEDRIVER
-+#define MODULE_PROC_FAMILY "PILEDRIVER "
-+#elif defined CONFIG_MSTEAMROLLER
-+#define MODULE_PROC_FAMILY "STEAMROLLER "
-+#elif defined CONFIG_MJAGUAR
-+#define MODULE_PROC_FAMILY "JAGUAR "
-+#elif defined CONFIG_MEXCAVATOR
-+#define MODULE_PROC_FAMILY "EXCAVATOR "
-+#elif defined CONFIG_MZEN
-+#define MODULE_PROC_FAMILY "ZEN "
-+#elif defined CONFIG_MZEN2
-+#define MODULE_PROC_FAMILY "ZEN2 "
- #elif defined CONFIG_MELAN
- #define MODULE_PROC_FAMILY "ELAN "
- #elif defined CONFIG_MCRUSOE
---
-2.30.1
-
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-05-07 11:40 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-05-07 11:40 UTC (permalink / raw
To: gentoo-commits
commit: dd7ec497bda902cd94785b8d97e8e546b640ccde
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Fri May 7 11:39:57 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Fri May 7 11:40:12 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dd7ec497
Linux patch 4.19.190
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1189_linux-4.19.190.patch | 724 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 728 insertions(+)
diff --git a/0000_README b/0000_README
index e6e43df..11fff4a 100644
--- a/0000_README
+++ b/0000_README
@@ -795,6 +795,10 @@ Patch: 1188_linux-4.19.189.patch
From: https://www.kernel.org
Desc: Linux 4.19.189
+Patch: 1189_linux-4.19.190.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.190
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1189_linux-4.19.190.patch b/1189_linux-4.19.190.patch
new file mode 100644
index 0000000..e00d500
--- /dev/null
+++ b/1189_linux-4.19.190.patch
@@ -0,0 +1,724 @@
+diff --git a/Makefile b/Makefile
+index b19e0e7b7eb34..c813c3bb74055 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 189
++SUBLEVEL = 190
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/vdso/gettimeofday.c b/arch/mips/vdso/gettimeofday.c
+index e22b422f282c7..9fdc84fc3985a 100644
+--- a/arch/mips/vdso/gettimeofday.c
++++ b/arch/mips/vdso/gettimeofday.c
+@@ -18,6 +18,12 @@
+ #include <asm/unistd.h>
+ #include <asm/vdso.h>
+
++#if MIPS_ISA_REV < 6
++#define VDSO_SYSCALL_CLOBBERS "hi", "lo",
++#else
++#define VDSO_SYSCALL_CLOBBERS
++#endif
++
+ #ifdef CONFIG_MIPS_CLOCK_VSYSCALL
+
+ static __always_inline long gettimeofday_fallback(struct timeval *_tv,
+@@ -34,7 +40,9 @@ static __always_inline long gettimeofday_fallback(struct timeval *_tv,
+ : "=r" (ret), "=r" (error)
+ : "r" (tv), "r" (tz), "r" (nr)
+ : "$1", "$3", "$8", "$9", "$10", "$11", "$12", "$13",
+- "$14", "$15", "$24", "$25", "hi", "lo", "memory");
++ "$14", "$15", "$24", "$25",
++ VDSO_SYSCALL_CLOBBERS
++ "memory");
+
+ return error ? -ret : ret;
+ }
+@@ -55,7 +63,9 @@ static __always_inline long clock_gettime_fallback(clockid_t _clkid,
+ : "=r" (ret), "=r" (error)
+ : "r" (clkid), "r" (ts), "r" (nr)
+ : "$1", "$3", "$8", "$9", "$10", "$11", "$12", "$13",
+- "$14", "$15", "$24", "$25", "hi", "lo", "memory");
++ "$14", "$15", "$24", "$25",
++ VDSO_SYSCALL_CLOBBERS
++ "memory");
+
+ return error ? -ret : ret;
+ }
+diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
+index 7303bb398862c..b35c34cfbe522 100644
+--- a/arch/x86/kernel/acpi/boot.c
++++ b/arch/x86/kernel/acpi/boot.c
+@@ -1565,10 +1565,18 @@ void __init acpi_boot_table_init(void)
+ /*
+ * Initialize the ACPI boot-time table parser.
+ */
+- if (acpi_table_init()) {
++ if (acpi_locate_initial_tables())
+ disable_acpi();
+- return;
+- }
++ else
++ acpi_reserve_initial_tables();
++}
++
++int __init early_acpi_boot_init(void)
++{
++ if (acpi_disabled)
++ return 1;
++
++ acpi_table_init_complete();
+
+ acpi_table_parse(ACPI_SIG_BOOT, acpi_parse_sbf);
+
+@@ -1581,18 +1589,9 @@ void __init acpi_boot_table_init(void)
+ } else {
+ printk(KERN_WARNING PREFIX "Disabling ACPI support\n");
+ disable_acpi();
+- return;
++ return 1;
+ }
+ }
+-}
+-
+-int __init early_acpi_boot_init(void)
+-{
+- /*
+- * If acpi_disabled, bail out
+- */
+- if (acpi_disabled)
+- return 1;
+
+ /*
+ * Process the Multiple APIC Description Table (MADT), if present
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
+index 90ecc108bc8a5..652a10a3219d9 100644
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -1176,6 +1176,8 @@ void __init setup_arch(char **cmdline_p)
+ reserve_initrd();
+
+ acpi_table_upgrade();
++ /* Look for ACPI tables and reserve memory occupied by them. */
++ acpi_boot_table_init();
+
+ vsmp_init();
+
+@@ -1183,11 +1185,6 @@ void __init setup_arch(char **cmdline_p)
+
+ early_platform_quirks();
+
+- /*
+- * Parse the ACPI tables for possible boot-time SMP configuration.
+- */
+- acpi_boot_table_init();
+-
+ early_acpi_boot_init();
+
+ initmem_init();
+diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
+index a3d012b08fc5c..041ee23819276 100644
+--- a/drivers/acpi/tables.c
++++ b/drivers/acpi/tables.c
+@@ -732,7 +732,7 @@ acpi_os_table_override(struct acpi_table_header *existing_table,
+ }
+
+ /*
+- * acpi_table_init()
++ * acpi_locate_initial_tables()
+ *
+ * find RSDP, find and checksum SDT/XSDT.
+ * checksum all tables, print SDT/XSDT
+@@ -740,7 +740,7 @@ acpi_os_table_override(struct acpi_table_header *existing_table,
+ * result: sdt_entry[] is initialized
+ */
+
+-int __init acpi_table_init(void)
++int __init acpi_locate_initial_tables(void)
+ {
+ acpi_status status;
+
+@@ -755,9 +755,45 @@ int __init acpi_table_init(void)
+ status = acpi_initialize_tables(initial_tables, ACPI_MAX_TABLES, 0);
+ if (ACPI_FAILURE(status))
+ return -EINVAL;
+- acpi_table_initrd_scan();
+
++ return 0;
++}
++
++void __init acpi_reserve_initial_tables(void)
++{
++ int i;
++
++ for (i = 0; i < ACPI_MAX_TABLES; i++) {
++ struct acpi_table_desc *table_desc = &initial_tables[i];
++ u64 start = table_desc->address;
++ u64 size = table_desc->length;
++
++ if (!start || !size)
++ break;
++
++ pr_info("Reserving %4s table memory at [mem 0x%llx-0x%llx]\n",
++ table_desc->signature.ascii, start, start + size - 1);
++
++ memblock_reserve(start, size);
++ }
++}
++
++void __init acpi_table_init_complete(void)
++{
++ acpi_table_initrd_scan();
+ check_multiple_madt();
++}
++
++int __init acpi_table_init(void)
++{
++ int ret;
++
++ ret = acpi_locate_initial_tables();
++ if (ret)
++ return ret;
++
++ acpi_table_init_complete();
++
+ return 0;
+ }
+
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index a9d0df435e266..b2434b4798468 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -307,12 +307,12 @@ static int ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+ int ret;
+
+ if (2 == size) {
+- u16 buf;
++ u16 buf = 0;
+ ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
+ le16_to_cpus(&buf);
+ *((u16 *)data) = buf;
+ } else if (4 == size) {
+- u32 buf;
++ u32 buf = 0;
+ ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
+ le32_to_cpus(&buf);
+ *((u32 *)data) = buf;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+index 93f396d7e6849..dea29a69aaf6a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+@@ -654,6 +654,7 @@ static int iwl_pcie_gen2_enqueue_hcmd(struct iwl_trans *trans,
+ const u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD];
+ u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD];
+ struct iwl_tfh_tfd *tfd;
++ unsigned long flags2;
+
+ copy_size = sizeof(struct iwl_cmd_header_wide);
+ cmd_size = sizeof(struct iwl_cmd_header_wide);
+@@ -722,14 +723,14 @@ static int iwl_pcie_gen2_enqueue_hcmd(struct iwl_trans *trans,
+ goto free_dup_buf;
+ }
+
+- spin_lock_bh(&txq->lock);
++ spin_lock_irqsave(&txq->lock, flags2);
+
+ idx = iwl_pcie_get_cmd_index(txq, txq->write_ptr);
+ tfd = iwl_pcie_get_tfd(trans, txq, txq->write_ptr);
+ memset(tfd, 0, sizeof(*tfd));
+
+ if (iwl_queue_space(trans, txq) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) {
+- spin_unlock_bh(&txq->lock);
++ spin_unlock_irqrestore(&txq->lock, flags2);
+
+ IWL_ERR(trans, "No space in command queue\n");
+ iwl_op_mode_cmd_queue_full(trans->op_mode);
+@@ -870,7 +871,7 @@ static int iwl_pcie_gen2_enqueue_hcmd(struct iwl_trans *trans,
+ spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
+
+ out:
+- spin_unlock_bh(&txq->lock);
++ spin_unlock_irqrestore(&txq->lock, flags2);
+ free_dup_buf:
+ if (idx < 0)
+ kfree(dup_buf);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index b1a71539ca3e5..41ba0a7193753 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -1495,6 +1495,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ u32 cmd_pos;
+ const u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD];
+ u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD];
++ unsigned long flags2;
+
+ if (WARN(!trans->wide_cmd_header &&
+ group_id > IWL_ALWAYS_LONG_GROUP,
+@@ -1578,10 +1579,10 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ goto free_dup_buf;
+ }
+
+- spin_lock_bh(&txq->lock);
++ spin_lock_irqsave(&txq->lock, flags2);
+
+ if (iwl_queue_space(trans, txq) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) {
+- spin_unlock_bh(&txq->lock);
++ spin_unlock_irqrestore(&txq->lock, flags2);
+
+ IWL_ERR(trans, "No space in command queue\n");
+ iwl_op_mode_cmd_queue_full(trans->op_mode);
+@@ -1742,7 +1743,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
+
+ out:
+- spin_unlock_bh(&txq->lock);
++ spin_unlock_irqrestore(&txq->lock, flags2);
+ free_dup_buf:
+ if (idx < 0)
+ kfree(dup_buf);
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 559698640fe29..35c7d3185fea3 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -6300,6 +6300,7 @@ enum thermal_access_mode {
+ enum { /* TPACPI_THERMAL_TPEC_* */
+ TP_EC_THERMAL_TMP0 = 0x78, /* ACPI EC regs TMP 0..7 */
+ TP_EC_THERMAL_TMP8 = 0xC0, /* ACPI EC regs TMP 8..15 */
++ TP_EC_FUNCREV = 0xEF, /* ACPI EC Functional revision */
+ TP_EC_THERMAL_TMP_NA = -128, /* ACPI EC sensor not available */
+
+ TPACPI_THERMAL_SENSOR_NA = -128000, /* Sensor not available */
+@@ -6498,7 +6499,7 @@ static const struct attribute_group thermal_temp_input8_group = {
+
+ static int __init thermal_init(struct ibm_init_struct *iibm)
+ {
+- u8 t, ta1, ta2;
++ u8 t, ta1, ta2, ver = 0;
+ int i;
+ int acpi_tmp7;
+ int res;
+@@ -6513,7 +6514,14 @@ static int __init thermal_init(struct ibm_init_struct *iibm)
+ * 0x78-0x7F, 0xC0-0xC7. Registers return 0x00 for
+ * non-implemented, thermal sensors return 0x80 when
+ * not available
++ * The above rule is unfortunately flawed. This has been seen with
++ * 0xC2 (power supply ID) causing thermal control problems.
++ * The EC version can be determined by offset 0xEF and at least for
++ * version 3 the Lenovo firmware team confirmed that registers 0xC0-0xC7
++ * are not thermal registers.
+ */
++ if (!acpi_ec_read(TP_EC_FUNCREV, &ver))
++ pr_warn("Thinkpad ACPI EC unable to access EC version\n");
+
+ ta1 = ta2 = 0;
+ for (i = 0; i < 8; i++) {
+@@ -6523,11 +6531,13 @@ static int __init thermal_init(struct ibm_init_struct *iibm)
+ ta1 = 0;
+ break;
+ }
+- if (acpi_ec_read(TP_EC_THERMAL_TMP8 + i, &t)) {
+- ta2 |= t;
+- } else {
+- ta1 = 0;
+- break;
++ if (ver < 3) {
++ if (acpi_ec_read(TP_EC_THERMAL_TMP8 + i, &t)) {
++ ta2 |= t;
++ } else {
++ ta1 = 0;
++ break;
++ }
+ }
+ }
+ if (ta1 == 0) {
+@@ -6540,9 +6550,12 @@ static int __init thermal_init(struct ibm_init_struct *iibm)
+ thermal_read_mode = TPACPI_THERMAL_NONE;
+ }
+ } else {
+- thermal_read_mode =
+- (ta2 != 0) ?
+- TPACPI_THERMAL_TPEC_16 : TPACPI_THERMAL_TPEC_8;
++ if (ver >= 3)
++ thermal_read_mode = TPACPI_THERMAL_TPEC_8;
++ else
++ thermal_read_mode =
++ (ta2 != 0) ?
++ TPACPI_THERMAL_TPEC_16 : TPACPI_THERMAL_TPEC_8;
+ }
+ } else if (acpi_tmp7) {
+ if (tpacpi_is_ibm() &&
+diff --git a/drivers/staging/erofs/inode.c b/drivers/staging/erofs/inode.c
+index 12a5be95457f8..a43abd530cc10 100644
+--- a/drivers/staging/erofs/inode.c
++++ b/drivers/staging/erofs/inode.c
+@@ -14,26 +14,78 @@
+
+ #include <trace/events/erofs.h>
+
+-/* no locking */
+-static int read_inode(struct inode *inode, void *data)
++/*
++ * if inode is successfully read, return its inode page (or sometimes
++ * the inode payload page if it's an extended inode) in order to fill
++ * inline data if possible.
++ */
++static struct page *read_inode(struct inode *inode, unsigned int *ofs)
+ {
++ struct super_block *sb = inode->i_sb;
++ struct erofs_sb_info *sbi = EROFS_SB(sb);
+ struct erofs_vnode *vi = EROFS_V(inode);
+- struct erofs_inode_v1 *v1 = data;
+- const unsigned advise = le16_to_cpu(v1->i_advise);
++ const erofs_off_t inode_loc = iloc(sbi, vi->nid);
++ erofs_blk_t blkaddr;
++ struct page *page;
++ struct erofs_inode_v1 *v1;
++ struct erofs_inode_v2 *v2, *copied = NULL;
++ unsigned int ifmt;
++ int err;
+
+- vi->data_mapping_mode = __inode_data_mapping(advise);
++ blkaddr = erofs_blknr(inode_loc);
++ *ofs = erofs_blkoff(inode_loc);
+
++ debugln("%s, reading inode nid %llu at %u of blkaddr %u",
++ __func__, vi->nid, *ofs, blkaddr);
++
++ page = erofs_get_meta_page(sb, blkaddr, false);
++ if (IS_ERR(page)) {
++ errln("failed to get inode (nid: %llu) page, err %ld",
++ vi->nid, PTR_ERR(page));
++ return page;
++ }
++
++ v1 = page_address(page) + *ofs;
++ ifmt = le16_to_cpu(v1->i_advise);
++
++ vi->data_mapping_mode = __inode_data_mapping(ifmt);
+ if (unlikely(vi->data_mapping_mode >= EROFS_INODE_LAYOUT_MAX)) {
+ errln("unknown data mapping mode %u of nid %llu",
+ vi->data_mapping_mode, vi->nid);
+- DBG_BUGON(1);
+- return -EIO;
++ err = -EOPNOTSUPP;
++ goto err_out;
+ }
+
+- if (__inode_version(advise) == EROFS_INODE_LAYOUT_V2) {
+- struct erofs_inode_v2 *v2 = data;
+-
++ switch (__inode_version(ifmt)) {
++ case EROFS_INODE_LAYOUT_V2:
+ vi->inode_isize = sizeof(struct erofs_inode_v2);
++ /* check if the inode acrosses page boundary */
++ if (*ofs + vi->inode_isize <= PAGE_SIZE) {
++ *ofs += vi->inode_isize;
++ v2 = (struct erofs_inode_v2 *)v1;
++ } else {
++ const unsigned int gotten = PAGE_SIZE - *ofs;
++
++ copied = kmalloc(vi->inode_isize, GFP_NOFS);
++ if (!copied) {
++ err = -ENOMEM;
++ goto err_out;
++ }
++ memcpy(copied, v1, gotten);
++ unlock_page(page);
++ put_page(page);
++
++ page = erofs_get_meta_page(sb, blkaddr + 1, false);
++ if (IS_ERR(page)) {
++ errln("failed to get inode payload page (nid: %llu), err %ld",
++ vi->nid, PTR_ERR(page));
++ kfree(copied);
++ return page;
++ }
++ *ofs = vi->inode_isize - gotten;
++ memcpy((u8 *)copied + gotten, page_address(page), *ofs);
++ v2 = copied;
++ }
+ vi->xattr_isize = ondisk_xattr_ibody_size(v2->i_xattr_icount);
+
+ inode->i_mode = le16_to_cpu(v2->i_mode);
+@@ -46,7 +98,7 @@ static int read_inode(struct inode *inode, void *data)
+ } else if (S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
+ inode->i_rdev = 0;
+ } else {
+- return -EIO;
++ goto bogusimode;
+ }
+
+ i_uid_write(inode, le32_to_cpu(v2->i_uid));
+@@ -58,10 +110,11 @@ static int read_inode(struct inode *inode, void *data)
+ inode->i_ctime.tv_nsec = le32_to_cpu(v2->i_ctime_nsec);
+
+ inode->i_size = le64_to_cpu(v2->i_size);
+- } else if (__inode_version(advise) == EROFS_INODE_LAYOUT_V1) {
+- struct erofs_sb_info *sbi = EROFS_SB(inode->i_sb);
+-
++ kfree(copied);
++ break;
++ case EROFS_INODE_LAYOUT_V1:
+ vi->inode_isize = sizeof(struct erofs_inode_v1);
++ *ofs += vi->inode_isize;
+ vi->xattr_isize = ondisk_xattr_ibody_size(v1->i_xattr_icount);
+
+ inode->i_mode = le16_to_cpu(v1->i_mode);
+@@ -74,7 +127,7 @@ static int read_inode(struct inode *inode, void *data)
+ } else if (S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
+ inode->i_rdev = 0;
+ } else {
+- return -EIO;
++ goto bogusimode;
+ }
+
+ i_uid_write(inode, le16_to_cpu(v1->i_uid));
+@@ -86,11 +139,12 @@ static int read_inode(struct inode *inode, void *data)
+ inode->i_ctime.tv_nsec = sbi->build_time_nsec;
+
+ inode->i_size = le32_to_cpu(v1->i_size);
+- } else {
++ break;
++ default:
+ errln("unsupported on-disk inode version %u of nid %llu",
+- __inode_version(advise), vi->nid);
+- DBG_BUGON(1);
+- return -EIO;
++ __inode_version(ifmt), vi->nid);
++ err = -EOPNOTSUPP;
++ goto err_out;
+ }
+
+ inode->i_mtime.tv_sec = inode->i_ctime.tv_sec;
+@@ -100,7 +154,16 @@ static int read_inode(struct inode *inode, void *data)
+
+ /* measure inode.i_blocks as the generic filesystem */
+ inode->i_blocks = ((inode->i_size - 1) >> 9) + 1;
+- return 0;
++ return page;
++bogusimode:
++ errln("bogus i_mode (%o) @ nid %llu", inode->i_mode, vi->nid);
++ err = -EIO;
++err_out:
++ DBG_BUGON(1);
++ kfree(copied);
++ unlock_page(page);
++ put_page(page);
++ return ERR_PTR(err);
+ }
+
+ /*
+@@ -132,7 +195,7 @@ static int fill_inline_data(struct inode *inode, void *data, unsigned m_pofs)
+ if (unlikely(lnk == NULL))
+ return -ENOMEM;
+
+- m_pofs += vi->inode_isize + vi->xattr_isize;
++ m_pofs += vi->xattr_isize;
+
+ /* inline symlink data shouldn't across page boundary as well */
+ if (unlikely(m_pofs + inode->i_size > PAGE_SIZE)) {
+@@ -153,35 +216,17 @@ static int fill_inline_data(struct inode *inode, void *data, unsigned m_pofs)
+
+ static int fill_inode(struct inode *inode, int isdir)
+ {
+- struct erofs_sb_info *sbi = EROFS_SB(inode->i_sb);
+- struct erofs_vnode *vi = EROFS_V(inode);
+ struct page *page;
+- void *data;
+- int err;
+- erofs_blk_t blkaddr;
+- unsigned ofs;
++ unsigned int ofs;
++ int err = 0;
+
+ trace_erofs_fill_inode(inode, isdir);
+
+- blkaddr = erofs_blknr(iloc(sbi, vi->nid));
+- ofs = erofs_blkoff(iloc(sbi, vi->nid));
+-
+- debugln("%s, reading inode nid %llu at %u of blkaddr %u",
+- __func__, vi->nid, ofs, blkaddr);
+-
+- page = erofs_get_meta_page(inode->i_sb, blkaddr, isdir);
+-
++ /* read inode base data from disk */
++ page = read_inode(inode, &ofs);
+ if (IS_ERR(page)) {
+- errln("failed to get inode (nid: %llu) page, err %ld",
+- vi->nid, PTR_ERR(page));
+ return PTR_ERR(page);
+- }
+-
+- DBG_BUGON(!PageUptodate(page));
+- data = page_address(page);
+-
+- err = read_inode(inode, data + ofs);
+- if (!err) {
++ } else {
+ /* setup the new inode */
+ if (S_ISREG(inode->i_mode)) {
+ #ifdef CONFIG_EROFS_FS_XATTR
+@@ -229,7 +274,7 @@ static int fill_inode(struct inode *inode, int isdir)
+ inode->i_mapping->a_ops = &erofs_raw_access_aops;
+
+ /* fill last page if inline data is available */
+- fill_inline_data(inode, data, ofs);
++ fill_inline_data(inode, page_address(page), ofs);
+ }
+
+ out_unlock:
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index b8a4707dfafab..f6a6c54cba35f 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -406,6 +406,7 @@ static const struct usb_device_id usb_quirk_list[] = {
+
+ /* Realtek hub in Dell WD19 (Type-C) */
+ { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM },
++ { USB_DEVICE(0x0bda, 0x5487), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ /* Generic RTL8153 based ethernet adapters */
+ { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM },
+@@ -438,6 +439,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x17ef, 0xa012), .driver_info =
+ USB_QUIRK_DISCONNECT_SUSPEND },
+
++ /* Lenovo ThinkPad USB-C Dock Gen2 Ethernet (RTL8153 GigE) */
++ { USB_DEVICE(0x17ef, 0xa387), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* BUILDWIN Photo Frame */
+ { USB_DEVICE(0x1908, 0x1315), .driver_info =
+ USB_QUIRK_HONOR_BNUMINTERFACES },
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index f0dc432a3ceb3..c97d8d251eb95 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -1479,7 +1479,8 @@ out_err:
+ * - upper/work dir of any overlayfs instance
+ */
+ static int ovl_check_layer(struct super_block *sb, struct ovl_fs *ofs,
+- struct dentry *dentry, const char *name)
++ struct dentry *dentry, const char *name,
++ bool is_lower)
+ {
+ struct dentry *next = dentry, *parent;
+ int err = 0;
+@@ -1491,7 +1492,7 @@ static int ovl_check_layer(struct super_block *sb, struct ovl_fs *ofs,
+
+ /* Walk back ancestors to root (inclusive) looking for traps */
+ while (!err && parent != next) {
+- if (ovl_lookup_trap_inode(sb, parent)) {
++ if (is_lower && ovl_lookup_trap_inode(sb, parent)) {
+ err = -ELOOP;
+ pr_err("overlayfs: overlapping %s path\n", name);
+ } else if (ovl_is_inuse(parent)) {
+@@ -1517,7 +1518,7 @@ static int ovl_check_overlapping_layers(struct super_block *sb,
+
+ if (ofs->upper_mnt) {
+ err = ovl_check_layer(sb, ofs, ofs->upper_mnt->mnt_root,
+- "upperdir");
++ "upperdir", false);
+ if (err)
+ return err;
+
+@@ -1528,7 +1529,8 @@ static int ovl_check_overlapping_layers(struct super_block *sb,
+ * workbasedir. In that case, we already have their traps in
+ * inode cache and we will catch that case on lookup.
+ */
+- err = ovl_check_layer(sb, ofs, ofs->workbasedir, "workdir");
++ err = ovl_check_layer(sb, ofs, ofs->workbasedir, "workdir",
++ false);
+ if (err)
+ return err;
+ }
+@@ -1536,7 +1538,7 @@ static int ovl_check_overlapping_layers(struct super_block *sb,
+ for (i = 0; i < ofs->numlower; i++) {
+ err = ovl_check_layer(sb, ofs,
+ ofs->lower_layers[i].mnt->mnt_root,
+- "lowerdir");
++ "lowerdir", true);
+ if (err)
+ return err;
+ }
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index 019468f072b7d..1a37748766b70 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -230,10 +230,14 @@ void __iomem *__acpi_map_table(unsigned long phys, unsigned long size);
+ void __acpi_unmap_table(void __iomem *map, unsigned long size);
+ int early_acpi_boot_init(void);
+ int acpi_boot_init (void);
++void acpi_boot_table_prepare (void);
+ void acpi_boot_table_init (void);
+ int acpi_mps_check (void);
+ int acpi_numa_init (void);
+
++int acpi_locate_initial_tables (void);
++void acpi_reserve_initial_tables (void);
++void acpi_table_init_complete (void);
+ int acpi_table_init (void);
+ int acpi_table_parse(char *id, acpi_tbl_table_handler handler);
+ int __init acpi_table_parse_entries(char *id, unsigned long table_size,
+@@ -734,9 +738,12 @@ static inline int acpi_boot_init(void)
+ return 0;
+ }
+
++static inline void acpi_boot_table_prepare(void)
++{
++}
++
+ static inline void acpi_boot_table_init(void)
+ {
+- return;
+ }
+
+ static inline int acpi_mps_check(void)
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index a0cdb6c4a330f..f49f84b71a6bc 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -6099,14 +6099,10 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
+ *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);
+ *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);
+ *patch++ = BPF_ALU64_IMM(BPF_ARSH, BPF_REG_AX, 63);
+- if (issrc) {
+- *patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX,
+- off_reg);
+- insn->src_reg = BPF_REG_AX;
+- } else {
+- *patch++ = BPF_ALU64_REG(BPF_AND, off_reg,
+- BPF_REG_AX);
+- }
++ *patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX, off_reg);
++ if (!issrc)
++ *patch++ = BPF_MOV64_REG(insn->dst_reg, insn->src_reg);
++ insn->src_reg = BPF_REG_AX;
+ if (isneg)
+ insn->code = insn->code == code_add ?
+ code_sub : code_add;
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 83f72ddf4fda6..81304c2c11244 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2499,6 +2499,16 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+ },
+
++{
++ USB_DEVICE_VENDOR_SPEC(0x0944, 0x0204),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .vendor_name = "KORG, Inc.",
++ /* .product_name = "ToneLab EX", */
++ .ifnum = 3,
++ .type = QUIRK_MIDI_STANDARD_INTERFACE,
++ }
++},
++
+ /* AKAI devices */
+ {
+ USB_DEVICE(0x09e8, 0x0062),
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-05-22 10:03 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-05-22 10:03 UTC (permalink / raw
To: gentoo-commits
commit: 48294dc5232af9d75fc4a40c0be8307a31eceb01
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat May 22 10:03:46 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat May 22 10:03:46 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=48294dc5
Linux patch 4.19.191
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1190_linux-4.19.191.patch | 13641 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 13645 insertions(+)
diff --git a/0000_README b/0000_README
index 11fff4a..303595a 100644
--- a/0000_README
+++ b/0000_README
@@ -799,6 +799,10 @@ Patch: 1189_linux-4.19.190.patch
From: https://www.kernel.org
Desc: Linux 4.19.190
+Patch: 1190_linux-4.19.191.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.191
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1190_linux-4.19.191.patch b/1190_linux-4.19.191.patch
new file mode 100644
index 0000000..8c760cf
--- /dev/null
+++ b/1190_linux-4.19.191.patch
@@ -0,0 +1,13641 @@
+diff --git a/Documentation/sphinx/parse-headers.pl b/Documentation/sphinx/parse-headers.pl
+index c518050ffc3fb..0dcf369ab9040 100755
+--- a/Documentation/sphinx/parse-headers.pl
++++ b/Documentation/sphinx/parse-headers.pl
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl
++#!/usr/bin/env perl
+ use strict;
+ use Text::Tabs;
+ use Getopt::Long;
+diff --git a/Documentation/target/tcm_mod_builder.py b/Documentation/target/tcm_mod_builder.py
+index 94bf6944bb1e4..7e79ff6b09e0e 100755
+--- a/Documentation/target/tcm_mod_builder.py
++++ b/Documentation/target/tcm_mod_builder.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/env python
+ # The TCM v4 multi-protocol fabric module generation script for drivers/target/$NEW_MOD
+ #
+ # Copyright (c) 2010 Rising Tide Systems
+diff --git a/Documentation/trace/postprocess/decode_msr.py b/Documentation/trace/postprocess/decode_msr.py
+index 0ab40e0db5809..aa9cc7abd5c2b 100644
+--- a/Documentation/trace/postprocess/decode_msr.py
++++ b/Documentation/trace/postprocess/decode_msr.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/env python
+ # add symbolic names to read_msr / write_msr in trace
+ # decode_msr msr-index.h < trace
+ import sys
+diff --git a/Documentation/trace/postprocess/trace-pagealloc-postprocess.pl b/Documentation/trace/postprocess/trace-pagealloc-postprocess.pl
+index 0a120aae33ce5..b9b7d80c2f9d2 100644
+--- a/Documentation/trace/postprocess/trace-pagealloc-postprocess.pl
++++ b/Documentation/trace/postprocess/trace-pagealloc-postprocess.pl
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl
++#!/usr/bin/env perl
+ # This is a POC (proof of concept or piece of crap, take your pick) for reading the
+ # text representation of trace output related to page allocation. It makes an attempt
+ # to extract some high-level information on what is going on. The accuracy of the parser
+diff --git a/Documentation/trace/postprocess/trace-vmscan-postprocess.pl b/Documentation/trace/postprocess/trace-vmscan-postprocess.pl
+index 66bfd8396877f..9efcf5ed8cb50 100644
+--- a/Documentation/trace/postprocess/trace-vmscan-postprocess.pl
++++ b/Documentation/trace/postprocess/trace-vmscan-postprocess.pl
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl
++#!/usr/bin/env perl
+ # This is a POC for reading the text representation of trace output related to
+ # page reclaim. It makes an attempt to extract some high-level information on
+ # what is going on. The accuracy of the parser may vary
+diff --git a/Makefile b/Makefile
+index c813c3bb74055..586a2d128ffb3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 190
++SUBLEVEL = 191
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
+index 85d9ea4a0accc..37ad245cf9899 100644
+--- a/arch/arc/kernel/entry.S
++++ b/arch/arc/kernel/entry.S
+@@ -169,7 +169,7 @@ tracesys:
+
+ ; Do the Sys Call as we normally would.
+ ; Validate the Sys Call number
+- cmp r8, NR_syscalls
++ cmp r8, NR_syscalls - 1
+ mov.hi r0, -ENOSYS
+ bhi tracesys_exit
+
+@@ -252,7 +252,7 @@ ENTRY(EV_Trap)
+ ;============ Normal syscall case
+
+ ; syscall num shd not exceed the total system calls avail
+- cmp r8, NR_syscalls
++ cmp r8, NR_syscalls - 1
+ mov.hi r0, -ENOSYS
+ bhi .Lret_from_system_call
+
+diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
+index c762004572eff..ec2327a3796d5 100644
+--- a/arch/arm/boot/compressed/Makefile
++++ b/arch/arm/boot/compressed/Makefile
+@@ -121,8 +121,8 @@ asflags-y := -DZIMAGE
+
+ # Supply kernel BSS size to the decompressor via a linker symbol.
+ KBSS_SZ = $(shell echo $$(($$($(NM) $(obj)/../../../../vmlinux | \
+- sed -n -e 's/^\([^ ]*\) [AB] __bss_start$$/-0x\1/p' \
+- -e 's/^\([^ ]*\) [AB] __bss_stop$$/+0x\1/p') )) )
++ sed -n -e 's/^\([^ ]*\) [ABD] __bss_start$$/-0x\1/p' \
++ -e 's/^\([^ ]*\) [ABD] __bss_stop$$/+0x\1/p') )) )
+ LDFLAGS_vmlinux = --defsym _kernel_bss_size=$(KBSS_SZ)
+ # Supply ZRELADDR to the decompressor via a linker symbol.
+ ifneq ($(CONFIG_AUTO_ZRELADDR),y)
+diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi
+index c0476c2909774..60fbad25b5f26 100644
+--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
+@@ -139,7 +139,7 @@
+ max77693@66 {
+ compatible = "maxim,max77693";
+ interrupt-parent = <&gpx1>;
+- interrupts = <5 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77693_irq>;
+ reg = <0x66>;
+@@ -187,7 +187,7 @@
+ max77693-fuel-gauge@36 {
+ compatible = "maxim,max17047";
+ interrupt-parent = <&gpx2>;
+- interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77693_fuel_irq>;
+ reg = <0x36>;
+@@ -579,7 +579,7 @@
+ max77686: max77686_pmic@9 {
+ compatible = "maxim,max77686";
+ interrupt-parent = <&gpx0>;
+- interrupts = <7 IRQ_TYPE_NONE>;
++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-0 = <&max77686_irq>;
+ pinctrl-names = "default";
+ reg = <0x09>;
+diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+index 00820d2397537..dbca8eeefae13 100644
+--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
++++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+@@ -265,7 +265,7 @@
+ max77686: pmic@9 {
+ compatible = "maxim,max77686";
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77686_irq>;
+ reg = <0x09>;
+diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts
+index d5e66189ed2a0..594b246afbedc 100644
+--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts
++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts
+@@ -132,7 +132,7 @@
+ compatible = "maxim,max77686";
+ reg = <0x09>;
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77686_irq>;
+ wakeup-source;
+diff --git a/arch/arm/boot/dts/exynos5250-snow-common.dtsi b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
+index fd9226d3b207e..3981acb00b5e4 100644
+--- a/arch/arm/boot/dts/exynos5250-snow-common.dtsi
++++ b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
+@@ -292,7 +292,7 @@
+ max77686: max77686@9 {
+ compatible = "maxim,max77686";
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max77686_irq>;
+ wakeup-source;
+diff --git a/arch/arm/boot/dts/uniphier-pxs2.dtsi b/arch/arm/boot/dts/uniphier-pxs2.dtsi
+index e2d1a22c5950d..d8a32104aad0b 100644
+--- a/arch/arm/boot/dts/uniphier-pxs2.dtsi
++++ b/arch/arm/boot/dts/uniphier-pxs2.dtsi
+@@ -513,7 +513,7 @@
+ clocks = <&sys_clk 6>;
+ reset-names = "ether";
+ resets = <&sys_rst 6>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 0>;
+
+diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
+index 471859cbfe0bb..ae073fceb3f05 100644
+--- a/arch/arm/include/asm/kvm_host.h
++++ b/arch/arm/include/asm/kvm_host.h
+@@ -303,6 +303,7 @@ static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
+ static inline void kvm_arch_vcpu_block_finish(struct kvm_vcpu *vcpu) {}
+
+ static inline void kvm_arm_init_debug(void) {}
++static inline void kvm_arm_vcpu_init_debug(struct kvm_vcpu *vcpu) {}
+ static inline void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) {}
+ static inline void kvm_arm_clear_debug(struct kvm_vcpu *vcpu) {}
+ static inline void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu) {}
+diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c
+index ae85f67a63520..40afe953a0e2d 100644
+--- a/arch/arm/kernel/asm-offsets.c
++++ b/arch/arm/kernel/asm-offsets.c
+@@ -30,6 +30,7 @@
+ #include <asm/vdso_datapage.h>
+ #include <asm/hardware/cache-l2x0.h>
+ #include <linux/kbuild.h>
++#include <linux/arm-smccc.h>
+ #include "signal.h"
+
+ /*
+@@ -159,6 +160,8 @@ int main(void)
+ DEFINE(SLEEP_SAVE_SP_PHYS, offsetof(struct sleep_save_sp, save_ptr_stash_phys));
+ DEFINE(SLEEP_SAVE_SP_VIRT, offsetof(struct sleep_save_sp, save_ptr_stash));
+ #endif
++ DEFINE(ARM_SMCCC_QUIRK_ID_OFFS, offsetof(struct arm_smccc_quirk, id));
++ DEFINE(ARM_SMCCC_QUIRK_STATE_OFFS, offsetof(struct arm_smccc_quirk, state));
+ BLANK();
+ DEFINE(DMA_BIDIRECTIONAL, DMA_BIDIRECTIONAL);
+ DEFINE(DMA_TO_DEVICE, DMA_TO_DEVICE);
+diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
+index 97fa9c1677576..2ee5b7f5e7ad0 100644
+--- a/arch/arm/kernel/hw_breakpoint.c
++++ b/arch/arm/kernel/hw_breakpoint.c
+@@ -891,7 +891,7 @@ static void breakpoint_handler(unsigned long unknown, struct pt_regs *regs)
+ info->trigger = addr;
+ pr_debug("breakpoint fired: address = 0x%x\n", addr);
+ perf_bp_event(bp, regs);
+- if (!bp->overflow_handler)
++ if (is_default_overflow_handler(bp))
+ enable_single_step(bp, addr);
+ goto unlock;
+ }
+diff --git a/arch/arm/kernel/smccc-call.S b/arch/arm/kernel/smccc-call.S
+index e5d43066b8894..13d307cd364c5 100644
+--- a/arch/arm/kernel/smccc-call.S
++++ b/arch/arm/kernel/smccc-call.S
+@@ -12,7 +12,9 @@
+ *
+ */
+ #include <linux/linkage.h>
++#include <linux/arm-smccc.h>
+
++#include <asm/asm-offsets.h>
+ #include <asm/opcodes-sec.h>
+ #include <asm/opcodes-virt.h>
+ #include <asm/unwind.h>
+@@ -36,7 +38,14 @@ UNWIND( .fnstart)
+ UNWIND( .save {r4-r7})
+ ldm r12, {r4-r7}
+ \instr
+- pop {r4-r7}
++ ldr r4, [sp, #36]
++ cmp r4, #0
++ beq 1f // No quirk structure
++ ldr r5, [r4, #ARM_SMCCC_QUIRK_ID_OFFS]
++ cmp r5, #ARM_SMCCC_QUIRK_QCOM_A6
++ bne 1f // No quirk present
++ str r6, [r4, #ARM_SMCCC_QUIRK_STATE_OFFS]
++1: pop {r4-r7}
+ ldr r12, [sp, #(4 * 4)]
+ stm r12, {r0-r3}
+ bx lr
+diff --git a/arch/arm/kernel/suspend.c b/arch/arm/kernel/suspend.c
+index d08099269e35b..e126386fb78a8 100644
+--- a/arch/arm/kernel/suspend.c
++++ b/arch/arm/kernel/suspend.c
+@@ -1,4 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0
++#include <linux/ftrace.h>
+ #include <linux/init.h>
+ #include <linux/slab.h>
+ #include <linux/mm_types.h>
+@@ -26,6 +27,13 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
+ if (!idmap_pgd)
+ return -EINVAL;
+
++ /*
++ * Function graph tracer state gets incosistent when the kernel
++ * calls functions that never return (aka suspend finishers) hence
++ * disable graph tracing during their execution.
++ */
++ pause_graph_tracing();
++
+ /*
+ * Provide a temporary page table with an identity mapping for
+ * the MMU-enable code, required for resuming. On successful
+@@ -33,6 +41,9 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
+ * back to the correct page tables.
+ */
+ ret = __cpu_suspend(arg, fn, __mpidr);
++
++ unpause_graph_tracing();
++
+ if (ret == 0) {
+ cpu_switch_mm(mm->pgd, mm);
+ local_flush_bp_all();
+@@ -46,7 +57,13 @@ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
+ int cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
+ {
+ u32 __mpidr = cpu_logical_map(smp_processor_id());
+- return __cpu_suspend(arg, fn, __mpidr);
++ int ret;
++
++ pause_graph_tracing();
++ ret = __cpu_suspend(arg, fn, __mpidr);
++ unpause_graph_tracing();
++
++ return ret;
+ }
+ #define idmap_pgd NULL
+ #endif
+diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+index d9531e242eb4c..3a611250f598d 100644
+--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+@@ -143,7 +143,8 @@
+ };
+
+ nb_periph_clk: nb-periph-clk@13000 {
+- compatible = "marvell,armada-3700-periph-clock-nb";
++ compatible = "marvell,armada-3700-periph-clock-nb",
++ "syscon";
+ reg = <0x13000 0x100>;
+ clocks = <&tbg 0>, <&tbg 1>, <&tbg 2>,
+ <&tbg 3>, <&xtalclk>;
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+index bd9fc50ac1540..12837523dac8c 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+@@ -1111,7 +1111,7 @@
+ <&mmsys CLK_MM_DSI1_DIGITAL>,
+ <&mipi_tx1>;
+ clock-names = "engine", "digital", "hs";
+- phy = <&mipi_tx1>;
++ phys = <&mipi_tx1>;
+ phy-names = "dphy";
+ status = "disabled";
+ };
+diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
+index caf112629caad..62429c412b335 100644
+--- a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi
+@@ -610,7 +610,7 @@
+ clocks = <&sys_clk 6>;
+ reset-names = "ether";
+ resets = <&sys_rst 6>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 0>;
+
+diff --git a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
+index 2a4cf427f5d37..8fe9a57b95620 100644
+--- a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
++++ b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
+@@ -416,7 +416,7 @@
+ clocks = <&sys_clk 6>;
+ reset-names = "ether";
+ resets = <&sys_rst 6>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 0>;
+
+@@ -437,7 +437,7 @@
+ clocks = <&sys_clk 7>;
+ reset-names = "ether";
+ resets = <&sys_rst 7>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ local-mac-address = [00 00 00 00 00 00];
+ socionext,syscon-phy-mode = <&soc_glue 1>;
+
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index 151e69a93e341..07472c138ced9 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -455,6 +455,7 @@ static inline void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) {}
+ static inline void kvm_arch_vcpu_block_finish(struct kvm_vcpu *vcpu) {}
+
+ void kvm_arm_init_debug(void);
++void kvm_arm_vcpu_init_debug(struct kvm_vcpu *vcpu);
+ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu);
+ void kvm_arm_clear_debug(struct kvm_vcpu *vcpu);
+ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu);
+diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S
+index 856fee6d35129..b6faf8b5d1fe6 100644
+--- a/arch/arm64/kernel/vdso/gettimeofday.S
++++ b/arch/arm64/kernel/vdso/gettimeofday.S
+@@ -227,7 +227,7 @@ realtime:
+ seqcnt_check fail=realtime
+ get_ts_realtime res_sec=x10, res_nsec=x11, \
+ clock_nsec=x15, xtime_sec=x13, xtime_nsec=x14, nsec_to_sec=x9
+- clock_gettime_return, shift=1
++ clock_gettime_return shift=1
+
+ ALIGN
+ monotonic:
+@@ -250,7 +250,7 @@ monotonic:
+ clock_nsec=x15, xtime_sec=x13, xtime_nsec=x14, nsec_to_sec=x9
+
+ add_ts sec=x10, nsec=x11, ts_sec=x3, ts_nsec=x4, nsec_to_sec=x9
+- clock_gettime_return, shift=1
++ clock_gettime_return shift=1
+
+ ALIGN
+ monotonic_raw:
+@@ -271,7 +271,7 @@ monotonic_raw:
+ clock_nsec=x15, nsec_to_sec=x9
+
+ add_ts sec=x10, nsec=x11, ts_sec=x13, ts_nsec=x14, nsec_to_sec=x9
+- clock_gettime_return, shift=1
++ clock_gettime_return shift=1
+
+ ALIGN
+ realtime_coarse:
+diff --git a/arch/arm64/kernel/vdso/vdso.lds.S b/arch/arm64/kernel/vdso/vdso.lds.S
+index beca249bc2f39..b3e6c4d5b75c8 100644
+--- a/arch/arm64/kernel/vdso/vdso.lds.S
++++ b/arch/arm64/kernel/vdso/vdso.lds.S
+@@ -39,6 +39,13 @@ SECTIONS
+ .gnu.version_d : { *(.gnu.version_d) }
+ .gnu.version_r : { *(.gnu.version_r) }
+
++ /*
++ * Discard .note.gnu.property sections which are unused and have
++ * different alignment requirement from vDSO note sections.
++ */
++ /DISCARD/ : {
++ *(.note.GNU-stack .note.gnu.property)
++ }
+ .note : { *(.note.*) } :text :note
+
+ . = ALIGN(16);
+@@ -59,7 +66,6 @@ SECTIONS
+ PROVIDE(end = .);
+
+ /DISCARD/ : {
+- *(.note.GNU-stack)
+ *(.data .data.* .gnu.linkonce.d.* .sdata*)
+ *(.bss .sbss .dynbss .dynsbss)
+ }
+diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c
+index 3606f6b890942..7fe195ef7c3fd 100644
+--- a/arch/arm64/kvm/debug.c
++++ b/arch/arm64/kvm/debug.c
+@@ -79,6 +79,64 @@ void kvm_arm_init_debug(void)
+ __this_cpu_write(mdcr_el2, kvm_call_hyp(__kvm_get_mdcr_el2));
+ }
+
++/**
++ * kvm_arm_setup_mdcr_el2 - configure vcpu mdcr_el2 value
++ *
++ * @vcpu: the vcpu pointer
++ *
++ * This ensures we will trap access to:
++ * - Performance monitors (MDCR_EL2_TPM/MDCR_EL2_TPMCR)
++ * - Debug ROM Address (MDCR_EL2_TDRA)
++ * - OS related registers (MDCR_EL2_TDOSA)
++ * - Statistical profiler (MDCR_EL2_TPMS/MDCR_EL2_E2PB)
++ * - Self-hosted Trace Filter controls (MDCR_EL2_TTRF)
++ */
++static void kvm_arm_setup_mdcr_el2(struct kvm_vcpu *vcpu)
++{
++ /*
++ * This also clears MDCR_EL2_E2PB_MASK to disable guest access
++ * to the profiling buffer.
++ */
++ vcpu->arch.mdcr_el2 = __this_cpu_read(mdcr_el2) & MDCR_EL2_HPMN_MASK;
++ vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM |
++ MDCR_EL2_TPMS |
++ MDCR_EL2_TTRF |
++ MDCR_EL2_TPMCR |
++ MDCR_EL2_TDRA |
++ MDCR_EL2_TDOSA);
++
++ /* Is the VM being debugged by userspace? */
++ if (vcpu->guest_debug)
++ /* Route all software debug exceptions to EL2 */
++ vcpu->arch.mdcr_el2 |= MDCR_EL2_TDE;
++
++ /*
++ * Trap debug register access when one of the following is true:
++ * - Userspace is using the hardware to debug the guest
++ * (KVM_GUESTDBG_USE_HW is set).
++ * - The guest is not using debug (KVM_ARM64_DEBUG_DIRTY is clear).
++ */
++ if ((vcpu->guest_debug & KVM_GUESTDBG_USE_HW) ||
++ !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY))
++ vcpu->arch.mdcr_el2 |= MDCR_EL2_TDA;
++
++ trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2);
++}
++
++/**
++ * kvm_arm_vcpu_init_debug - setup vcpu debug traps
++ *
++ * @vcpu: the vcpu pointer
++ *
++ * Set vcpu initial mdcr_el2 value.
++ */
++void kvm_arm_vcpu_init_debug(struct kvm_vcpu *vcpu)
++{
++ preempt_disable();
++ kvm_arm_setup_mdcr_el2(vcpu);
++ preempt_enable();
++}
++
+ /**
+ * kvm_arm_reset_debug_ptr - reset the debug ptr to point to the vcpu state
+ */
+@@ -94,13 +152,7 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu)
+ * @vcpu: the vcpu pointer
+ *
+ * This is called before each entry into the hypervisor to setup any
+- * debug related registers. Currently this just ensures we will trap
+- * access to:
+- * - Performance monitors (MDCR_EL2_TPM/MDCR_EL2_TPMCR)
+- * - Debug ROM Address (MDCR_EL2_TDRA)
+- * - OS related registers (MDCR_EL2_TDOSA)
+- * - Statistical profiler (MDCR_EL2_TPMS/MDCR_EL2_E2PB)
+- * - Self-hosted Trace Filter controls (MDCR_EL2_TTRF)
++ * debug related registers.
+ *
+ * Additionally, KVM only traps guest accesses to the debug registers if
+ * the guest is not actively using them (see the KVM_ARM64_DEBUG_DIRTY
+@@ -112,28 +164,14 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu)
+
+ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ {
+- bool trap_debug = !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY);
+ unsigned long mdscr, orig_mdcr_el2 = vcpu->arch.mdcr_el2;
+
+ trace_kvm_arm_setup_debug(vcpu, vcpu->guest_debug);
+
+- /*
+- * This also clears MDCR_EL2_E2PB_MASK to disable guest access
+- * to the profiling buffer.
+- */
+- vcpu->arch.mdcr_el2 = __this_cpu_read(mdcr_el2) & MDCR_EL2_HPMN_MASK;
+- vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM |
+- MDCR_EL2_TPMS |
+- MDCR_EL2_TTRF |
+- MDCR_EL2_TPMCR |
+- MDCR_EL2_TDRA |
+- MDCR_EL2_TDOSA);
++ kvm_arm_setup_mdcr_el2(vcpu);
+
+ /* Is Guest debugging in effect? */
+ if (vcpu->guest_debug) {
+- /* Route all software debug exceptions to EL2 */
+- vcpu->arch.mdcr_el2 |= MDCR_EL2_TDE;
+-
+ /* Save guest debug state */
+ save_guest_debug_regs(vcpu);
+
+@@ -187,7 +225,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+
+ vcpu->arch.debug_ptr = &vcpu->arch.external_debug_state;
+ vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY;
+- trap_debug = true;
+
+ trace_kvm_arm_set_regset("BKPTS", get_num_brps(),
+ &vcpu->arch.debug_ptr->dbg_bcr[0],
+@@ -202,10 +239,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ BUG_ON(!vcpu->guest_debug &&
+ vcpu->arch.debug_ptr != &vcpu->arch.vcpu_debug_state);
+
+- /* Trap debug register access */
+- if (trap_debug)
+- vcpu->arch.mdcr_el2 |= MDCR_EL2_TDA;
+-
+ /* If KDE or MDE are set, perform a full save/restore cycle. */
+ if (vcpu_read_sys_reg(vcpu, MDSCR_EL1) & (DBG_MDSCR_KDE | DBG_MDSCR_MDE))
+ vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY;
+@@ -214,7 +247,6 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu)
+ if (has_vhe() && orig_mdcr_el2 != vcpu->arch.mdcr_el2)
+ write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
+
+- trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2);
+ trace_kvm_arm_set_dreg32("MDSCR_EL1", vcpu_read_sys_reg(vcpu, MDSCR_EL1));
+ }
+
+diff --git a/arch/ia64/include/asm/module.h b/arch/ia64/include/asm/module.h
+index f319144260ce1..9fbf32e6e8813 100644
+--- a/arch/ia64/include/asm/module.h
++++ b/arch/ia64/include/asm/module.h
+@@ -14,16 +14,20 @@
+ struct elf64_shdr; /* forward declration */
+
+ struct mod_arch_specific {
++ /* Used only at module load time. */
+ struct elf64_shdr *core_plt; /* core PLT section */
+ struct elf64_shdr *init_plt; /* init PLT section */
+ struct elf64_shdr *got; /* global offset table */
+ struct elf64_shdr *opd; /* official procedure descriptors */
+ struct elf64_shdr *unwind; /* unwind-table section */
+ unsigned long gp; /* global-pointer for module */
++ unsigned int next_got_entry; /* index of next available got entry */
+
++ /* Used at module run and cleanup time. */
+ void *core_unw_table; /* core unwind-table cookie returned by unwinder */
+ void *init_unw_table; /* init unwind-table cookie returned by unwinder */
+- unsigned int next_got_entry; /* index of next available got entry */
++ void *opd_addr; /* symbolize uses .opd to get to actual function */
++ unsigned long opd_size;
+ };
+
+ #define MODULE_PROC_FAMILY "ia64"
+diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
+index 1a42ba885188a..ee693c8cec498 100644
+--- a/arch/ia64/kernel/module.c
++++ b/arch/ia64/kernel/module.c
+@@ -905,9 +905,31 @@ register_unwind_table (struct module *mod)
+ int
+ module_finalize (const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs, struct module *mod)
+ {
++ struct mod_arch_specific *mas = &mod->arch;
++
+ DEBUGP("%s: init: entry=%p\n", __func__, mod->init);
+- if (mod->arch.unwind)
++ if (mas->unwind)
+ register_unwind_table(mod);
++
++ /*
++ * ".opd" was already relocated to the final destination. Store
++ * it's address for use in symbolizer.
++ */
++ mas->opd_addr = (void *)mas->opd->sh_addr;
++ mas->opd_size = mas->opd->sh_size;
++
++ /*
++ * Module relocation was already done at this point. Section
++ * headers are about to be deleted. Wipe out load-time context.
++ */
++ mas->core_plt = NULL;
++ mas->init_plt = NULL;
++ mas->got = NULL;
++ mas->opd = NULL;
++ mas->unwind = NULL;
++ mas->gp = 0;
++ mas->next_got_entry = 0;
++
+ return 0;
+ }
+
+@@ -926,10 +948,9 @@ module_arch_cleanup (struct module *mod)
+
+ void *dereference_module_function_descriptor(struct module *mod, void *ptr)
+ {
+- Elf64_Shdr *opd = mod->arch.opd;
++ struct mod_arch_specific *mas = &mod->arch;
+
+- if (ptr < (void *)opd->sh_addr ||
+- ptr >= (void *)(opd->sh_addr + opd->sh_size))
++ if (ptr < mas->opd_addr || ptr >= mas->opd_addr + mas->opd_size)
+ return ptr;
+
+ return dereference_function_descriptor(ptr);
+diff --git a/arch/ia64/scripts/unwcheck.py b/arch/ia64/scripts/unwcheck.py
+index c55276e31b6b6..bfd1b671e35fc 100644
+--- a/arch/ia64/scripts/unwcheck.py
++++ b/arch/ia64/scripts/unwcheck.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/env python
+ # SPDX-License-Identifier: GPL-2.0
+ #
+ # Usage: unwcheck.py FILE
+diff --git a/arch/mips/include/asm/div64.h b/arch/mips/include/asm/div64.h
+index dc5ea57364408..ceece76fc971a 100644
+--- a/arch/mips/include/asm/div64.h
++++ b/arch/mips/include/asm/div64.h
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (C) 2000, 2004 Maciej W. Rozycki
++ * Copyright (C) 2000, 2004, 2021 Maciej W. Rozycki
+ * Copyright (C) 2003, 07 Ralf Baechle (ralf@linux-mips.org)
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+@@ -9,25 +9,18 @@
+ #ifndef __ASM_DIV64_H
+ #define __ASM_DIV64_H
+
+-#include <asm-generic/div64.h>
+-
+-#if BITS_PER_LONG == 64
++#include <asm/bitsperlong.h>
+
+-#include <linux/types.h>
++#if BITS_PER_LONG == 32
+
+ /*
+ * No traps on overflows for any of these...
+ */
+
+-#define __div64_32(n, base) \
+-({ \
++#define do_div64_32(res, high, low, base) ({ \
+ unsigned long __cf, __tmp, __tmp2, __i; \
+ unsigned long __quot32, __mod32; \
+- unsigned long __high, __low; \
+- unsigned long long __n; \
+ \
+- __high = *__n >> 32; \
+- __low = __n; \
+ __asm__( \
+ " .set push \n" \
+ " .set noat \n" \
+@@ -51,18 +44,48 @@
+ " subu %0, %0, %z6 \n" \
+ " addiu %2, %2, 1 \n" \
+ "3: \n" \
+- " bnez %4, 0b\n\t" \
+- " srl %5, %1, 0x1f\n\t" \
++ " bnez %4, 0b \n" \
++ " srl %5, %1, 0x1f \n" \
+ " .set pop" \
+ : "=&r" (__mod32), "=&r" (__tmp), \
+ "=&r" (__quot32), "=&r" (__cf), \
+ "=&r" (__i), "=&r" (__tmp2) \
+- : "Jr" (base), "0" (__high), "1" (__low)); \
++ : "Jr" (base), "0" (high), "1" (low)); \
+ \
+- (__n) = __quot32; \
++ (res) = __quot32; \
+ __mod32; \
+ })
+
+-#endif /* BITS_PER_LONG == 64 */
++#define __div64_32(n, base) ({ \
++ unsigned long __upper, __low, __high, __radix; \
++ unsigned long long __quot; \
++ unsigned long long __div; \
++ unsigned long __mod; \
++ \
++ __div = (*n); \
++ __radix = (base); \
++ \
++ __high = __div >> 32; \
++ __low = __div; \
++ \
++ if (__high < __radix) { \
++ __upper = __high; \
++ __high = 0; \
++ } else { \
++ __upper = __high % __radix; \
++ __high /= __radix; \
++ } \
++ \
++ __mod = do_div64_32(__low, __upper, __low, __radix); \
++ \
++ __quot = __high; \
++ __quot = __quot << 32 | __low; \
++ (*n) = __quot; \
++ __mod; \
++})
++
++#endif /* BITS_PER_LONG == 32 */
++
++#include <asm-generic/div64.h>
+
+ #endif /* __ASM_DIV64_H */
+diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c
+index 3c3b1e6abb535..e8b0751d5b76b 100644
+--- a/arch/mips/pci/pci-legacy.c
++++ b/arch/mips/pci/pci-legacy.c
+@@ -169,8 +169,13 @@ void pci_load_of_ranges(struct pci_controller *hose, struct device_node *node)
+ res = hose->mem_resource;
+ break;
+ }
+- if (res != NULL)
+- of_pci_range_to_resource(&range, node, res);
++ if (res != NULL) {
++ res->name = node->full_name;
++ res->flags = range.flags;
++ res->start = range.cpu_addr;
++ res->end = range.cpu_addr + range.size - 1;
++ res->parent = res->child = res->sibling = NULL;
++ }
+ }
+ }
+
+diff --git a/arch/mips/pci/pci-mt7620.c b/arch/mips/pci/pci-mt7620.c
+index f6b77788124af..5ae11aeff4b78 100644
+--- a/arch/mips/pci/pci-mt7620.c
++++ b/arch/mips/pci/pci-mt7620.c
+@@ -33,6 +33,7 @@
+ #define RALINK_GPIOMODE 0x60
+
+ #define PPLL_CFG1 0x9c
++#define PPLL_LD BIT(23)
+
+ #define PPLL_DRV 0xa0
+ #define PDRV_SW_SET BIT(31)
+@@ -242,8 +243,8 @@ static int mt7620_pci_hw_init(struct platform_device *pdev)
+ rt_sysc_m32(0, RALINK_PCIE0_CLK_EN, RALINK_CLKCFG1);
+ mdelay(100);
+
+- if (!(rt_sysc_r32(PPLL_CFG1) & PDRV_SW_SET)) {
+- dev_err(&pdev->dev, "MT7620 PPLL unlock\n");
++ if (!(rt_sysc_r32(PPLL_CFG1) & PPLL_LD)) {
++ dev_err(&pdev->dev, "pcie PLL not locked, aborting init\n");
+ reset_control_assert(rstpcie0);
+ rt_sysc_m32(RALINK_PCIE0_CLK_EN, 0, RALINK_CLKCFG1);
+ return -1;
+diff --git a/arch/mips/pci/pci-rt2880.c b/arch/mips/pci/pci-rt2880.c
+index 711cdccdf65ba..f7926a964441b 100644
+--- a/arch/mips/pci/pci-rt2880.c
++++ b/arch/mips/pci/pci-rt2880.c
+@@ -183,7 +183,6 @@ static inline void rt2880_pci_write_u32(unsigned long reg, u32 val)
+
+ int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
+- u16 cmd;
+ int irq = -1;
+
+ if (dev->bus->number != 0)
+@@ -191,8 +190,6 @@ int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+
+ switch (PCI_SLOT(dev->devfn)) {
+ case 0x00:
+- rt2880_pci_write_u32(PCI_BASE_ADDRESS_0, 0x08000000);
+- (void) rt2880_pci_read_u32(PCI_BASE_ADDRESS_0);
+ break;
+ case 0x11:
+ irq = RT288X_CPU_IRQ_PCI;
+@@ -204,16 +201,6 @@ int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ break;
+ }
+
+- pci_write_config_byte((struct pci_dev *) dev,
+- PCI_CACHE_LINE_SIZE, 0x14);
+- pci_write_config_byte((struct pci_dev *) dev, PCI_LATENCY_TIMER, 0xFF);
+- pci_read_config_word((struct pci_dev *) dev, PCI_COMMAND, &cmd);
+- cmd |= PCI_COMMAND_MASTER | PCI_COMMAND_IO | PCI_COMMAND_MEMORY |
+- PCI_COMMAND_INVALIDATE | PCI_COMMAND_FAST_BACK |
+- PCI_COMMAND_SERR | PCI_COMMAND_WAIT | PCI_COMMAND_PARITY;
+- pci_write_config_word((struct pci_dev *) dev, PCI_COMMAND, cmd);
+- pci_write_config_byte((struct pci_dev *) dev, PCI_INTERRUPT_LINE,
+- dev->irq);
+ return irq;
+ }
+
+@@ -252,6 +239,30 @@ static int rt288x_pci_probe(struct platform_device *pdev)
+
+ int pcibios_plat_dev_init(struct pci_dev *dev)
+ {
++ static bool slot0_init;
++
++ /*
++ * Nobody seems to initialize slot 0, but this platform requires it, so
++ * do it once when some other slot is being enabled. The PCI subsystem
++ * should configure other slots properly, so no need to do anything
++ * special for those.
++ */
++ if (!slot0_init && dev->bus->number == 0) {
++ u16 cmd;
++ u32 bar0;
++
++ slot0_init = true;
++
++ pci_bus_write_config_dword(dev->bus, 0, PCI_BASE_ADDRESS_0,
++ 0x08000000);
++ pci_bus_read_config_dword(dev->bus, 0, PCI_BASE_ADDRESS_0,
++ &bar0);
++
++ pci_bus_read_config_word(dev->bus, 0, PCI_COMMAND, &cmd);
++ cmd |= PCI_COMMAND_MASTER | PCI_COMMAND_IO | PCI_COMMAND_MEMORY;
++ pci_bus_write_config_word(dev->bus, 0, PCI_COMMAND, cmd);
++ }
++
+ return 0;
+ }
+
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index 6dd2a14e1ebcd..f0e09d5f0bedd 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -208,7 +208,7 @@ config PPC
+ select HAVE_MEMBLOCK_NODE_MAP
+ select HAVE_MOD_ARCH_SPECIFIC
+ select HAVE_NMI if PERF_EVENTS || (PPC64 && PPC_BOOK3S)
+- select HAVE_HARDLOCKUP_DETECTOR_ARCH if (PPC64 && PPC_BOOK3S)
++ select HAVE_HARDLOCKUP_DETECTOR_ARCH if PPC64 && PPC_BOOK3S && SMP
+ select HAVE_OPROFILE
+ select HAVE_OPTPROBES if PPC64
+ select HAVE_PERF_EVENTS
+diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
+index fd63cd914a74f..ffe0cf0f0bea2 100644
+--- a/arch/powerpc/Kconfig.debug
++++ b/arch/powerpc/Kconfig.debug
+@@ -350,6 +350,7 @@ config PPC_EARLY_DEBUG_CPM_ADDR
+ config FAIL_IOMMU
+ bool "Fault-injection capability for IOMMU"
+ depends on FAULT_INJECTION
++ depends on PCI || IBMVIO
+ help
+ Provide fault-injection capability for IOMMU. Each device can
+ be selectively enabled via the fail_iommu property.
+diff --git a/arch/powerpc/include/asm/book3s/64/radix.h b/arch/powerpc/include/asm/book3s/64/radix.h
+index da01badef0cbc..04b2bffbc5c95 100644
+--- a/arch/powerpc/include/asm/book3s/64/radix.h
++++ b/arch/powerpc/include/asm/book3s/64/radix.h
+@@ -204,8 +204,10 @@ static inline void radix__set_pte_at(struct mm_struct *mm, unsigned long addr,
+ * from ptesync, it should probably go into update_mmu_cache, rather
+ * than set_pte_at (which is used to set ptes unrelated to faults).
+ *
+- * Spurious faults to vmalloc region are not tolerated, so there is
+- * a ptesync in flush_cache_vmap.
++ * Spurious faults from the kernel memory are not tolerated, so there
++ * is a ptesync in flush_cache_vmap, and __map_kernel_page() follows
++ * the pte update sequence from ISA Book III 6.10 Translation Table
++ * Update Synchronization Requirements.
+ */
+ }
+
+diff --git a/arch/powerpc/include/uapi/asm/errno.h b/arch/powerpc/include/uapi/asm/errno.h
+index cc79856896a19..4ba87de32be00 100644
+--- a/arch/powerpc/include/uapi/asm/errno.h
++++ b/arch/powerpc/include/uapi/asm/errno.h
+@@ -2,6 +2,7 @@
+ #ifndef _ASM_POWERPC_ERRNO_H
+ #define _ASM_POWERPC_ERRNO_H
+
++#undef EDEADLOCK
+ #include <asm-generic/errno.h>
+
+ #undef EDEADLOCK
+diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
+index d123cba0992d0..44bb522fb4a20 100644
+--- a/arch/powerpc/kernel/eeh.c
++++ b/arch/powerpc/kernel/eeh.c
+@@ -364,14 +364,11 @@ static inline unsigned long eeh_token_to_phys(unsigned long token)
+ pa = pte_pfn(*ptep);
+
+ /* On radix we can do hugepage mappings for io, so handle that */
+- if (hugepage_shift) {
+- pa <<= hugepage_shift;
+- pa |= token & ((1ul << hugepage_shift) - 1);
+- } else {
+- pa <<= PAGE_SHIFT;
+- pa |= token & (PAGE_SIZE - 1);
+- }
++ if (!hugepage_shift)
++ hugepage_shift = PAGE_SHIFT;
+
++ pa <<= PAGE_SHIFT;
++ pa |= token & ((1ul << hugepage_shift) - 1);
+ return pa;
+ }
+
+diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
+index f0dc680e659af..c3d2d5cd7c10c 100644
+--- a/arch/powerpc/kernel/iommu.c
++++ b/arch/powerpc/kernel/iommu.c
+@@ -1030,7 +1030,7 @@ int iommu_take_ownership(struct iommu_table *tbl)
+
+ spin_lock_irqsave(&tbl->large_pool.lock, flags);
+ for (i = 0; i < tbl->nr_pools; i++)
+- spin_lock(&tbl->pools[i].lock);
++ spin_lock_nest_lock(&tbl->pools[i].lock, &tbl->large_pool.lock);
+
+ if (tbl->it_offset == 0)
+ clear_bit(0, tbl->it_map);
+@@ -1059,7 +1059,7 @@ void iommu_release_ownership(struct iommu_table *tbl)
+
+ spin_lock_irqsave(&tbl->large_pool.lock, flags);
+ for (i = 0; i < tbl->nr_pools; i++)
+- spin_lock(&tbl->pools[i].lock);
++ spin_lock_nest_lock(&tbl->pools[i].lock, &tbl->large_pool.lock);
+
+ memset(tbl->it_map, 0, sz);
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index fd04692412db3..f8c49e5d4bd3b 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -266,7 +266,7 @@ static struct feature_property {
+ };
+
+ #if defined(CONFIG_44x) && defined(CONFIG_PPC_FPU)
+-static inline void identical_pvr_fixup(unsigned long node)
++static __init void identical_pvr_fixup(unsigned long node)
+ {
+ unsigned int pvr;
+ const char *model = of_get_flat_dt_prop(node, "model", NULL);
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index 6dc43205382ba..a9ec4467705ca 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -1032,6 +1032,9 @@ void start_secondary(void *unused)
+
+ vdso_getcpu_init();
+ #endif
++ set_numa_node(numa_cpu_lookup_table[cpu]);
++ set_numa_mem(local_memory_node(numa_cpu_lookup_table[cpu]));
++
+ /* Update topology CPU masks */
+ add_cpu_to_masks(cpu);
+
+@@ -1042,9 +1045,6 @@ void start_secondary(void *unused)
+ if (!cpumask_equal(cpu_l2_cache_mask(cpu), cpu_sibling_mask(cpu)))
+ shared_caches = true;
+
+- set_numa_node(numa_cpu_lookup_table[cpu]);
+- set_numa_mem(local_memory_node(numa_cpu_lookup_table[cpu]));
+-
+ smp_wmb();
+ notify_cpu_starting(cpu);
+ set_cpu_online(cpu, true);
+diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c
+index 065a3426f0ebc..1561094ea4a58 100644
+--- a/arch/powerpc/lib/feature-fixups.c
++++ b/arch/powerpc/lib/feature-fixups.c
+@@ -18,6 +18,7 @@
+ #include <linux/string.h>
+ #include <linux/init.h>
+ #include <linux/sched/mm.h>
++#include <linux/stop_machine.h>
+ #include <asm/cputable.h>
+ #include <asm/code-patching.h>
+ #include <asm/page.h>
+@@ -225,11 +226,25 @@ void do_stf_exit_barrier_fixups(enum stf_barrier_type types)
+ : "unknown");
+ }
+
++static int __do_stf_barrier_fixups(void *data)
++{
++ enum stf_barrier_type *types = data;
++
++ do_stf_entry_barrier_fixups(*types);
++ do_stf_exit_barrier_fixups(*types);
++
++ return 0;
++}
+
+ void do_stf_barrier_fixups(enum stf_barrier_type types)
+ {
+- do_stf_entry_barrier_fixups(types);
+- do_stf_exit_barrier_fixups(types);
++ /*
++ * The call to the fallback entry flush, and the fallback/sync-ori exit
++ * flush can not be safely patched in/out while other CPUs are executing
++ * them. So call __do_stf_barrier_fixups() on one CPU while all other CPUs
++ * spin in the stop machine core with interrupts hard disabled.
++ */
++ stop_machine(__do_stf_barrier_fixups, &types, NULL);
+ }
+
+ void do_uaccess_flush_fixups(enum l1d_flush_type types)
+@@ -282,8 +297,9 @@ void do_uaccess_flush_fixups(enum l1d_flush_type types)
+ : "unknown");
+ }
+
+-void do_entry_flush_fixups(enum l1d_flush_type types)
++static int __do_entry_flush_fixups(void *data)
+ {
++ enum l1d_flush_type types = *(enum l1d_flush_type *)data;
+ unsigned int instrs[3], *dest;
+ long *start, *end;
+ int i;
+@@ -334,6 +350,19 @@ void do_entry_flush_fixups(enum l1d_flush_type types)
+ : "ori type" :
+ (types & L1D_FLUSH_MTTRIG) ? "mttrig type"
+ : "unknown");
++
++ return 0;
++}
++
++void do_entry_flush_fixups(enum l1d_flush_type types)
++{
++ /*
++ * The call to the fallback flush can not be safely patched in/out while
++ * other CPUs are executing it. So call __do_entry_flush_fixups() on one
++ * CPU while all other CPUs spin in the stop machine core with interrupts
++ * hard disabled.
++ */
++ stop_machine(__do_entry_flush_fixups, &types, NULL);
+ }
+
+ void do_rfi_flush_fixups(enum l1d_flush_type types)
+diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
+index 5404a631d5834..9ee235fca4278 100644
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -115,7 +115,7 @@ static int early_map_kernel_page(unsigned long ea, unsigned long pa,
+
+ set_the_pte:
+ set_pte_at(&init_mm, ea, ptep, pfn_pte(pfn, flags));
+- smp_wmb();
++ asm volatile("ptesync": : :"memory");
+ return 0;
+ }
+
+@@ -169,7 +169,7 @@ static int __map_kernel_page(unsigned long ea, unsigned long pa,
+
+ set_the_pte:
+ set_pte_at(&init_mm, ea, ptep, pfn_pte(pfn, flags));
+- smp_wmb();
++ asm volatile("ptesync": : :"memory");
+ return 0;
+ }
+
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 69a2dc2b16cf1..a1ff4142cc6a4 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -359,8 +359,8 @@ ebb_bhrb:
+ * EBB events are pinned & exclusive, so this should never actually
+ * hit, but we leave it as a fallback in case.
+ */
+- mask |= CNST_EBB_VAL(ebb);
+- value |= CNST_EBB_MASK;
++ mask |= CNST_EBB_MASK;
++ value |= CNST_EBB_VAL(ebb);
+
+ *maskp = mask;
+ *valp = value;
+diff --git a/arch/powerpc/platforms/52xx/lite5200_sleep.S b/arch/powerpc/platforms/52xx/lite5200_sleep.S
+index 3a9969c429b39..054f927bfef93 100644
+--- a/arch/powerpc/platforms/52xx/lite5200_sleep.S
++++ b/arch/powerpc/platforms/52xx/lite5200_sleep.S
+@@ -181,7 +181,7 @@ sram_code:
+ udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */
+ mullw r12, r12, r11
+ mftb r13 /* start */
+- addi r12, r13, r12 /* end */
++ add r12, r13, r12 /* end */
+ 1:
+ mftb r13 /* current */
+ cmp cr0, r13, r12
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index 1d3f9313c02ff..8bfb97d07d100 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -95,9 +95,6 @@ static void rtas_stop_self(void)
+
+ BUG_ON(rtas_stop_self_token == RTAS_UNKNOWN_SERVICE);
+
+- printk("cpu %u (hwid %u) Ready to die...\n",
+- smp_processor_id(), hard_smp_processor_id());
+-
+ rtas_call_unlocked(&args, rtas_stop_self_token, 0, 1, NULL);
+
+ panic("Alas, I survived.\n");
+diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
+index 561917fa54a8a..afca4b737e80f 100644
+--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
++++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
+@@ -66,6 +66,7 @@ EXPORT_SYMBOL_GPL(init_phb_dynamic);
+ int remove_phb_dynamic(struct pci_controller *phb)
+ {
+ struct pci_bus *b = phb->bus;
++ struct pci_host_bridge *host_bridge = to_pci_host_bridge(b->bridge);
+ struct resource *res;
+ int rc, i;
+
+@@ -92,7 +93,8 @@ int remove_phb_dynamic(struct pci_controller *phb)
+ /* Remove the PCI bus and unregister the bridge device from sysfs */
+ phb->bus = NULL;
+ pci_remove_bus(b);
+- device_unregister(b->bridge);
++ host_bridge->bus = NULL;
++ device_unregister(&host_bridge->dev);
+
+ /* Now release the IO resource */
+ if (res->flags & IORESOURCE_IO)
+diff --git a/arch/riscv/include/asm/ftrace.h b/arch/riscv/include/asm/ftrace.h
+index 02fbc175142e2..693c3839a7dfe 100644
+--- a/arch/riscv/include/asm/ftrace.h
++++ b/arch/riscv/include/asm/ftrace.h
+@@ -10,9 +10,19 @@
+ #endif
+ #define HAVE_FUNCTION_GRAPH_RET_ADDR_PTR
+
++/*
++ * Clang prior to 13 had "mcount" instead of "_mcount":
++ * https://reviews.llvm.org/D98881
++ */
++#if defined(CONFIG_CC_IS_GCC) || CONFIG_CLANG_VERSION >= 130000
++#define MCOUNT_NAME _mcount
++#else
++#define MCOUNT_NAME mcount
++#endif
++
+ #define ARCH_SUPPORTS_FTRACE_OPS 1
+ #ifndef __ASSEMBLY__
+-void _mcount(void);
++void MCOUNT_NAME(void);
+ static inline unsigned long ftrace_call_adjust(unsigned long addr)
+ {
+ return addr;
+@@ -33,7 +43,7 @@ struct dyn_arch_ftrace {
+ * both auipc and jalr at the same time.
+ */
+
+-#define MCOUNT_ADDR ((unsigned long)_mcount)
++#define MCOUNT_ADDR ((unsigned long)MCOUNT_NAME)
+ #define JALR_SIGN_MASK (0x00000800)
+ #define JALR_OFFSET_MASK (0x00000fff)
+ #define AUIPC_OFFSET_MASK (0xfffff000)
+diff --git a/arch/riscv/kernel/mcount.S b/arch/riscv/kernel/mcount.S
+index 5721624886a1c..fabddee90d1bd 100644
+--- a/arch/riscv/kernel/mcount.S
++++ b/arch/riscv/kernel/mcount.S
+@@ -47,8 +47,8 @@
+
+ ENTRY(ftrace_stub)
+ #ifdef CONFIG_DYNAMIC_FTRACE
+- .global _mcount
+- .set _mcount, ftrace_stub
++ .global MCOUNT_NAME
++ .set MCOUNT_NAME, ftrace_stub
+ #endif
+ ret
+ ENDPROC(ftrace_stub)
+@@ -79,7 +79,7 @@ EXPORT_SYMBOL(return_to_handler)
+ #endif
+
+ #ifndef CONFIG_DYNAMIC_FTRACE
+-ENTRY(_mcount)
++ENTRY(MCOUNT_NAME)
+ la t4, ftrace_stub
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ la t0, ftrace_graph_return
+@@ -125,6 +125,6 @@ do_trace:
+ jalr t5
+ RESTORE_ABI_STATE
+ ret
+-ENDPROC(_mcount)
++ENDPROC(MCOUNT_NAME)
+ #endif
+-EXPORT_SYMBOL(_mcount)
++EXPORT_SYMBOL(MCOUNT_NAME)
+diff --git a/arch/s390/crypto/arch_random.c b/arch/s390/crypto/arch_random.c
+index dd95cdbd22ce8..4cbb4b6d85a83 100644
+--- a/arch/s390/crypto/arch_random.c
++++ b/arch/s390/crypto/arch_random.c
+@@ -53,6 +53,10 @@ static DECLARE_DELAYED_WORK(arch_rng_work, arch_rng_refill_buffer);
+
+ bool s390_arch_random_generate(u8 *buf, unsigned int nbytes)
+ {
++ /* max hunk is ARCH_RNG_BUF_SIZE */
++ if (nbytes > ARCH_RNG_BUF_SIZE)
++ return false;
++
+ /* lock rng buffer */
+ if (!spin_trylock(&arch_rng_lock))
+ return false;
+diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
+index 41925f2206940..01307db4b4dd4 100644
+--- a/arch/s390/kernel/dis.c
++++ b/arch/s390/kernel/dis.c
+@@ -558,7 +558,7 @@ void show_code(struct pt_regs *regs)
+
+ void print_fn_code(unsigned char *code, unsigned long len)
+ {
+- char buffer[64], *ptr;
++ char buffer[128], *ptr;
+ int opsize, i;
+
+ while (len) {
+diff --git a/arch/s390/kvm/gaccess.h b/arch/s390/kvm/gaccess.h
+index f4c51756c4623..4c56de5429608 100644
+--- a/arch/s390/kvm/gaccess.h
++++ b/arch/s390/kvm/gaccess.h
+@@ -18,17 +18,14 @@
+
+ /**
+ * kvm_s390_real_to_abs - convert guest real address to guest absolute address
+- * @vcpu - guest virtual cpu
++ * @prefix - guest prefix
+ * @gra - guest real address
+ *
+ * Returns the guest absolute address that corresponds to the passed guest real
+- * address @gra of a virtual guest cpu by applying its prefix.
++ * address @gra of by applying the given prefix.
+ */
+-static inline unsigned long kvm_s390_real_to_abs(struct kvm_vcpu *vcpu,
+- unsigned long gra)
++static inline unsigned long _kvm_s390_real_to_abs(u32 prefix, unsigned long gra)
+ {
+- unsigned long prefix = kvm_s390_get_prefix(vcpu);
+-
+ if (gra < 2 * PAGE_SIZE)
+ gra += prefix;
+ else if (gra >= prefix && gra < prefix + 2 * PAGE_SIZE)
+@@ -36,6 +33,43 @@ static inline unsigned long kvm_s390_real_to_abs(struct kvm_vcpu *vcpu,
+ return gra;
+ }
+
++/**
++ * kvm_s390_real_to_abs - convert guest real address to guest absolute address
++ * @vcpu - guest virtual cpu
++ * @gra - guest real address
++ *
++ * Returns the guest absolute address that corresponds to the passed guest real
++ * address @gra of a virtual guest cpu by applying its prefix.
++ */
++static inline unsigned long kvm_s390_real_to_abs(struct kvm_vcpu *vcpu,
++ unsigned long gra)
++{
++ return _kvm_s390_real_to_abs(kvm_s390_get_prefix(vcpu), gra);
++}
++
++/**
++ * _kvm_s390_logical_to_effective - convert guest logical to effective address
++ * @psw: psw of the guest
++ * @ga: guest logical address
++ *
++ * Convert a guest logical address to an effective address by applying the
++ * rules of the addressing mode defined by bits 31 and 32 of the given PSW
++ * (extendended/basic addressing mode).
++ *
++ * Depending on the addressing mode, the upper 40 bits (24 bit addressing
++ * mode), 33 bits (31 bit addressing mode) or no bits (64 bit addressing
++ * mode) of @ga will be zeroed and the remaining bits will be returned.
++ */
++static inline unsigned long _kvm_s390_logical_to_effective(psw_t *psw,
++ unsigned long ga)
++{
++ if (psw_bits(*psw).eaba == PSW_BITS_AMODE_64BIT)
++ return ga;
++ if (psw_bits(*psw).eaba == PSW_BITS_AMODE_31BIT)
++ return ga & ((1UL << 31) - 1);
++ return ga & ((1UL << 24) - 1);
++}
++
+ /**
+ * kvm_s390_logical_to_effective - convert guest logical to effective address
+ * @vcpu: guest virtual cpu
+@@ -52,13 +86,7 @@ static inline unsigned long kvm_s390_real_to_abs(struct kvm_vcpu *vcpu,
+ static inline unsigned long kvm_s390_logical_to_effective(struct kvm_vcpu *vcpu,
+ unsigned long ga)
+ {
+- psw_t *psw = &vcpu->arch.sie_block->gpsw;
+-
+- if (psw_bits(*psw).eaba == PSW_BITS_AMODE_64BIT)
+- return ga;
+- if (psw_bits(*psw).eaba == PSW_BITS_AMODE_31BIT)
+- return ga & ((1UL << 31) - 1);
+- return ga & ((1UL << 24) - 1);
++ return _kvm_s390_logical_to_effective(&vcpu->arch.sie_block->gpsw, ga);
+ }
+
+ /*
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 18662c1a93611..71c67a1d2849a 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -3624,16 +3624,16 @@ static void store_regs(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+ current->thread.fpu.fpc = vcpu->arch.host_fpregs.fpc;
+ current->thread.fpu.regs = vcpu->arch.host_fpregs.regs;
+ if (MACHINE_HAS_GS) {
++ preempt_disable();
+ __ctl_set_bit(2, 4);
+ if (vcpu->arch.gs_enabled)
+ save_gs_cb(current->thread.gs_cb);
+- preempt_disable();
+ current->thread.gs_cb = vcpu->arch.host_gscb;
+ restore_gs_cb(vcpu->arch.host_gscb);
+- preempt_enable();
+ if (!vcpu->arch.host_gscb)
+ __ctl_clear_bit(2, 4);
+ vcpu->arch.host_gscb = NULL;
++ preempt_enable();
+ }
+ /* SIE will save etoken directly into SDNX and therefore kvm_run */
+ }
+diff --git a/arch/um/kernel/dyn.lds.S b/arch/um/kernel/dyn.lds.S
+index 5568cf8823711..8992336254673 100644
+--- a/arch/um/kernel/dyn.lds.S
++++ b/arch/um/kernel/dyn.lds.S
+@@ -6,6 +6,12 @@ OUTPUT_ARCH(ELF_ARCH)
+ ENTRY(_start)
+ jiffies = jiffies_64;
+
++VERSION {
++ {
++ local: *;
++ };
++}
++
+ SECTIONS
+ {
+ PROVIDE (__executable_start = START);
+diff --git a/arch/um/kernel/uml.lds.S b/arch/um/kernel/uml.lds.S
+index 36b07ec09742a..22ff701d9b710 100644
+--- a/arch/um/kernel/uml.lds.S
++++ b/arch/um/kernel/uml.lds.S
+@@ -7,6 +7,12 @@ OUTPUT_ARCH(ELF_ARCH)
+ ENTRY(_start)
+ jiffies = jiffies_64;
+
++VERSION {
++ {
++ local: *;
++ };
++}
++
+ SECTIONS
+ {
+ /* This must contain the right address - not quite the default ELF one.*/
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index af35f5caadbe5..d994501d9179f 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -533,6 +533,7 @@ config X86_UV
+ depends on X86_EXTENDED_PLATFORM
+ depends on NUMA
+ depends on EFI
++ depends on KEXEC_CORE
+ depends on X86_X2APIC
+ depends on PCI
+ ---help---
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 6ebdbad21fb2a..65a8722e784c6 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -40,6 +40,7 @@ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -ffreestanding
+ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -fno-stack-protector)
+ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -Wno-address-of-packed-member)
+ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), $(cc_stack_align4))
++REALMODE_CFLAGS += $(CLANG_FLAGS)
+ export REALMODE_CFLAGS
+
+ # BITS is used as extension for files which are available in a 32 bit
+diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c
+index 5b8b556dbb12a..46caca4d9141b 100644
+--- a/arch/x86/entry/vdso/vma.c
++++ b/arch/x86/entry/vdso/vma.c
+@@ -343,7 +343,7 @@ static void vgetcpu_cpu_init(void *arg)
+ #ifdef CONFIG_NUMA
+ node = cpu_to_node(cpu);
+ #endif
+- if (static_cpu_has(X86_FEATURE_RDTSCP))
++ if (boot_cpu_has(X86_FEATURE_RDTSCP) || boot_cpu_has(X86_FEATURE_RDPID))
+ write_rdtscp_aux((node << 12) | cpu);
+
+ /*
+diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c
+index 0014d26391fa6..c08bcba5c3a99 100644
+--- a/arch/x86/events/amd/iommu.c
++++ b/arch/x86/events/amd/iommu.c
+@@ -84,12 +84,12 @@ static struct attribute_group amd_iommu_events_group = {
+ };
+
+ struct amd_iommu_event_desc {
+- struct kobj_attribute attr;
++ struct device_attribute attr;
+ const char *event;
+ };
+
+-static ssize_t _iommu_event_show(struct kobject *kobj,
+- struct kobj_attribute *attr, char *buf)
++static ssize_t _iommu_event_show(struct device *dev,
++ struct device_attribute *attr, char *buf)
+ {
+ struct amd_iommu_event_desc *event =
+ container_of(attr, struct amd_iommu_event_desc, attr);
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index a96091d44a459..eab4de387ce64 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -627,16 +627,16 @@ static ssize_t reload_store(struct device *dev,
+ if (val != 1)
+ return size;
+
+- tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true);
+- if (tmp_ret != UCODE_NEW)
+- return size;
+-
+ get_online_cpus();
+
+ ret = check_online_cpus();
+ if (ret)
+ goto put;
+
++ tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true);
++ if (tmp_ret != UCODE_NEW)
++ goto put;
++
+ mutex_lock(µcode_mutex);
+ ret = microcode_reload_late();
+ mutex_unlock(µcode_mutex);
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index dfc3ab44bc5d3..3334e14003457 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -170,6 +170,8 @@ NOKPROBE_SYMBOL(skip_prefixes);
+ int can_boost(struct insn *insn, void *addr)
+ {
+ kprobe_opcode_t opcode;
++ insn_byte_t prefix;
++ int i;
+
+ if (search_exception_tables((unsigned long)addr))
+ return 0; /* Page fault may occur on this address. */
+@@ -182,9 +184,14 @@ int can_boost(struct insn *insn, void *addr)
+ if (insn->opcode.nbytes != 1)
+ return 0;
+
+- /* Can't boost Address-size override prefix */
+- if (unlikely(inat_is_address_size_prefix(insn->attr)))
+- return 0;
++ for_each_insn_prefix(insn, i, prefix) {
++ insn_attr_t attr;
++
++ attr = inat_get_opcode_attribute(prefix);
++ /* Can't boost Address-size override prefix and CS override prefix */
++ if (prefix == 0x2e || inat_is_address_size_prefix(attr))
++ return 0;
++ }
+
+ opcode = insn->opcode.bytes[0];
+
+@@ -209,8 +216,8 @@ int can_boost(struct insn *insn, void *addr)
+ /* clear and set flags are boostable */
+ return (opcode == 0xf5 || (0xf7 < opcode && opcode < 0xfe));
+ default:
+- /* CS override prefix and call are not boostable */
+- return (opcode != 0x2e && opcode != 0x9a);
++ /* call is not boostable */
++ return opcode != 0x9a;
+ }
+ }
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 8e4eef73531a5..435e74e1f2e54 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6911,6 +6911,7 @@ void kvm_arch_exit(void)
+ cpuhp_remove_state_nocalls(CPUHP_AP_X86_KVM_CLK_ONLINE);
+ #ifdef CONFIG_X86_64
+ pvclock_gtod_unregister_notifier(&pvclock_gtod_notifier);
++ cancel_work_sync(&pvclock_gtod_work);
+ #endif
+ kvm_x86_ops = NULL;
+ kvm_mmu_module_exit();
+diff --git a/arch/x86/lib/msr-smp.c b/arch/x86/lib/msr-smp.c
+index fee8b9c0520c9..9009393f44c78 100644
+--- a/arch/x86/lib/msr-smp.c
++++ b/arch/x86/lib/msr-smp.c
+@@ -253,7 +253,7 @@ static void __wrmsr_safe_regs_on_cpu(void *info)
+ rv->err = wrmsr_safe_regs(rv->regs);
+ }
+
+-int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
++int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8])
+ {
+ int err;
+ struct msr_regs_info rv;
+@@ -266,7 +266,7 @@ int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
+ }
+ EXPORT_SYMBOL(rdmsr_safe_regs_on_cpu);
+
+-int wrmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
++int wrmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8])
+ {
+ int err;
+ struct msr_regs_info rv;
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 195526b93895e..ae70b4809bec4 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2673,10 +2673,12 @@ EXPORT_SYMBOL(blk_mq_init_allocated_queue);
+ /* tags can _not_ be used after returning from blk_mq_exit_queue */
+ void blk_mq_exit_queue(struct request_queue *q)
+ {
+- struct blk_mq_tag_set *set = q->tag_set;
++ struct blk_mq_tag_set *set = q->tag_set;
+
+- blk_mq_del_queue_tag_set(q);
++ /* Checks hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED. */
+ blk_mq_exit_hw_queues(q, set, set->nr_hw_queues);
++ /* May clear BLK_MQ_F_TAG_QUEUE_SHARED in hctx->flags. */
++ blk_mq_del_queue_tag_set(q);
+ }
+
+ /* Basically redo blk_mq_init_queue with queue frozen */
+diff --git a/crypto/api.c b/crypto/api.c
+index 1909195b2c70b..5efd4d6e63125 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -571,7 +571,7 @@ void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm)
+ {
+ struct crypto_alg *alg;
+
+- if (unlikely(!mem))
++ if (IS_ERR_OR_NULL(mem))
+ return;
+
+ alg = tfm->__crt_alg;
+diff --git a/drivers/acpi/arm64/gtdt.c b/drivers/acpi/arm64/gtdt.c
+index 92f9edf9d11ed..c39b36c558d6f 100644
+--- a/drivers/acpi/arm64/gtdt.c
++++ b/drivers/acpi/arm64/gtdt.c
+@@ -332,7 +332,7 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd,
+ int index)
+ {
+ struct platform_device *pdev;
+- int irq = map_gt_gsi(wd->timer_interrupt, wd->timer_flags);
++ int irq;
+
+ /*
+ * According to SBSA specification the size of refresh and control
+@@ -341,7 +341,7 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd,
+ struct resource res[] = {
+ DEFINE_RES_MEM(wd->control_frame_address, SZ_4K),
+ DEFINE_RES_MEM(wd->refresh_frame_address, SZ_4K),
+- DEFINE_RES_IRQ(irq),
++ {},
+ };
+ int nr_res = ARRAY_SIZE(res);
+
+@@ -351,10 +351,11 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd,
+
+ if (!(wd->refresh_frame_address && wd->control_frame_address)) {
+ pr_err(FW_BUG "failed to get the Watchdog base address.\n");
+- acpi_unregister_gsi(wd->timer_interrupt);
+ return -EINVAL;
+ }
+
++ irq = map_gt_gsi(wd->timer_interrupt, wd->timer_flags);
++ res[2] = (struct resource)DEFINE_RES_IRQ(irq);
+ if (irq <= 0) {
+ pr_warn("failed to map the Watchdog interrupt.\n");
+ nr_res--;
+@@ -367,7 +368,8 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd,
+ */
+ pdev = platform_device_register_simple("sbsa-gwdt", index, res, nr_res);
+ if (IS_ERR(pdev)) {
+- acpi_unregister_gsi(wd->timer_interrupt);
++ if (irq > 0)
++ acpi_unregister_gsi(wd->timer_interrupt);
+ return PTR_ERR(pdev);
+ }
+
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index 5c6ecbb666081..1b43f8ebfabea 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -122,23 +122,15 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr);
+ */
+ #define NUM_RETRIES 500ULL
+
+-struct cppc_attr {
+- struct attribute attr;
+- ssize_t (*show)(struct kobject *kobj,
+- struct attribute *attr, char *buf);
+- ssize_t (*store)(struct kobject *kobj,
+- struct attribute *attr, const char *c, ssize_t count);
+-};
+-
+ #define define_one_cppc_ro(_name) \
+-static struct cppc_attr _name = \
++static struct kobj_attribute _name = \
+ __ATTR(_name, 0444, show_##_name, NULL)
+
+ #define to_cpc_desc(a) container_of(a, struct cpc_desc, kobj)
+
+ #define show_cppc_data(access_fn, struct_name, member_name) \
+ static ssize_t show_##member_name(struct kobject *kobj, \
+- struct attribute *attr, char *buf) \
++ struct kobj_attribute *attr, char *buf) \
+ { \
+ struct cpc_desc *cpc_ptr = to_cpc_desc(kobj); \
+ struct struct_name st_name = {0}; \
+@@ -164,7 +156,7 @@ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, reference_perf);
+ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);
+
+ static ssize_t show_feedback_ctrs(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ struct cpc_desc *cpc_ptr = to_cpc_desc(kobj);
+ struct cppc_perf_fb_ctrs fb_ctrs = {0};
+diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c
+index 222ea3f12f41e..613041870872b 100644
+--- a/drivers/acpi/custom_method.c
++++ b/drivers/acpi/custom_method.c
+@@ -37,6 +37,8 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
+ sizeof(struct acpi_table_header)))
+ return -EFAULT;
+ uncopied_bytes = max_size = table.length;
++ /* make sure the buf is not allocated */
++ kfree(buf);
+ buf = kzalloc(max_size, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+@@ -50,6 +52,7 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
+ (*ppos + count < count) ||
+ (count > uncopied_bytes)) {
+ kfree(buf);
++ buf = NULL;
+ return -EINVAL;
+ }
+
+@@ -71,7 +74,6 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
+ add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE);
+ }
+
+- kfree(buf);
+ return count;
+ }
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index d3c551bdc2dac..1e7e2c438acf0 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -705,6 +705,7 @@ int acpi_device_add(struct acpi_device *device,
+
+ result = acpi_device_set_name(device, acpi_device_bus_id);
+ if (result) {
++ kfree_const(acpi_device_bus_id->bus_id);
+ kfree(acpi_device_bus_id);
+ goto err_unlock;
+ }
+diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
+index 522b543f718d8..6a55aac0c60fc 100644
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -544,11 +544,13 @@ int ahci_platform_init_host(struct platform_device *pdev,
+ int i, irq, n_ports, rc;
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq <= 0) {
++ if (irq < 0) {
+ if (irq != -EPROBE_DEFER)
+ dev_err(dev, "no irq\n");
+ return irq;
+ }
++ if (!irq)
++ return -EINVAL;
+
+ hpriv->irq = irq;
+
+diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
+index ebecab8c3f36c..7c1c399450f32 100644
+--- a/drivers/ata/pata_arasan_cf.c
++++ b/drivers/ata/pata_arasan_cf.c
+@@ -817,12 +817,19 @@ static int arasan_cf_probe(struct platform_device *pdev)
+ else
+ quirk = CF_BROKEN_UDMA; /* as it is on spear1340 */
+
+- /* if irq is 0, support only PIO */
+- acdev->irq = platform_get_irq(pdev, 0);
+- if (acdev->irq)
++ /*
++ * If there's an error getting IRQ (or we do get IRQ0),
++ * support only PIO
++ */
++ ret = platform_get_irq(pdev, 0);
++ if (ret > 0) {
++ acdev->irq = ret;
+ irq_handler = arasan_cf_interrupt;
+- else
++ } else if (ret == -EPROBE_DEFER) {
++ return ret;
++ } else {
+ quirk |= CF_BROKEN_MWDMA | CF_BROKEN_UDMA;
++ }
+
+ acdev->pbase = res->start;
+ acdev->vbase = devm_ioremap_nocache(&pdev->dev, res->start,
+diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
+index 0b0d93065f5a1..867621f8c3873 100644
+--- a/drivers/ata/pata_ixp4xx_cf.c
++++ b/drivers/ata/pata_ixp4xx_cf.c
+@@ -169,8 +169,12 @@ static int ixp4xx_pata_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq)
++ if (irq > 0)
+ irq_set_irq_type(irq, IRQ_TYPE_EDGE_RISING);
++ else if (irq < 0)
++ return irq;
++ else
++ return -EINVAL;
+
+ /* Setup expansion bus chip selects */
+ *data->cs0_cfg = data->cs0_bits;
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index 2910b22fac117..57ef11ecbb9be 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -4110,6 +4110,10 @@ static int mv_platform_probe(struct platform_device *pdev)
+ n_ports = mv_platform_data->n_ports;
+ irq = platform_get_irq(pdev, 0);
+ }
++ if (irq < 0)
++ return irq;
++ if (!irq)
++ return -EINVAL;
+
+ host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports);
+ hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL);
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index c9e5381a887bf..de706734b9214 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -665,6 +665,7 @@ void regmap_debugfs_exit(struct regmap *map)
+ regmap_debugfs_free_dump_cache(map);
+ mutex_unlock(&map->cache_lock);
+ kfree(map->debugfs_name);
++ map->debugfs_name = NULL;
+ } else {
+ struct regmap_debugfs_node *node, *tmp;
+
+diff --git a/drivers/block/null_blk_zoned.c b/drivers/block/null_blk_zoned.c
+index 079ed33fd8067..ba018f1da5120 100644
+--- a/drivers/block/null_blk_zoned.c
++++ b/drivers/block/null_blk_zoned.c
+@@ -56,6 +56,7 @@ int null_zone_init(struct nullb_device *dev)
+ void null_zone_exit(struct nullb_device *dev)
+ {
+ kvfree(dev->zones);
++ dev->zones = NULL;
+ }
+
+ static void null_zone_fill_bio(struct nullb_device *dev, struct bio *bio,
+diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c
+index a6444244c4111..bfb67aa00becc 100644
+--- a/drivers/bus/qcom-ebi2.c
++++ b/drivers/bus/qcom-ebi2.c
+@@ -357,8 +357,10 @@ static int qcom_ebi2_probe(struct platform_device *pdev)
+
+ /* Figure out the chipselect */
+ ret = of_property_read_u32(child, "reg", &csindex);
+- if (ret)
++ if (ret) {
++ of_node_put(child);
+ return ret;
++ }
+
+ if (csindex > 5) {
+ dev_err(dev,
+diff --git a/drivers/char/tpm/eventlog/common.c b/drivers/char/tpm/eventlog/common.c
+index 7d70b654df04d..462476467bffe 100644
+--- a/drivers/char/tpm/eventlog/common.c
++++ b/drivers/char/tpm/eventlog/common.c
+@@ -112,6 +112,9 @@ void tpm_bios_log_setup(struct tpm_chip *chip)
+ int log_version;
+ int rc = 0;
+
++ if (chip->flags & TPM_CHIP_FLAG_VIRTUAL)
++ return;
++
+ rc = tpm_read_log(chip);
+ if (rc < 0)
+ return;
+diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
+index ef381caf5f43e..e71c6b24aed1c 100644
+--- a/drivers/char/tpm/tpm2-cmd.c
++++ b/drivers/char/tpm/tpm2-cmd.c
+@@ -960,6 +960,7 @@ static int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip)
+
+ if (nr_commands !=
+ be32_to_cpup((__be32 *)&buf.data[TPM_HEADER_SIZE + 5])) {
++ rc = -EFAULT;
+ tpm_buf_destroy(&buf);
+ goto out;
+ }
+diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
+index 774748497aced..e56ac5adb5fcc 100644
+--- a/drivers/char/ttyprintk.c
++++ b/drivers/char/ttyprintk.c
+@@ -159,12 +159,23 @@ static int tpk_ioctl(struct tty_struct *tty,
+ return 0;
+ }
+
++/*
++ * TTY operations hangup function.
++ */
++static void tpk_hangup(struct tty_struct *tty)
++{
++ struct ttyprintk_port *tpkp = tty->driver_data;
++
++ tty_port_hangup(&tpkp->port);
++}
++
+ static const struct tty_operations ttyprintk_ops = {
+ .open = tpk_open,
+ .close = tpk_close,
+ .write = tpk_write,
+ .write_room = tpk_write_room,
+ .ioctl = tpk_ioctl,
++ .hangup = tpk_hangup,
+ };
+
+ static const struct tty_port_operations null_ops = { };
+diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c
+index 499f5962c8b06..5d10733d6c041 100644
+--- a/drivers/clk/mvebu/armada-37xx-periph.c
++++ b/drivers/clk/mvebu/armada-37xx-periph.c
+@@ -74,6 +74,7 @@ struct clk_pm_cpu {
+ void __iomem *reg_div;
+ u8 shift_div;
+ struct regmap *nb_pm_base;
++ unsigned long l1_expiration;
+ };
+
+ #define to_clk_double_div(_hw) container_of(_hw, struct clk_double_div, hw)
+@@ -428,33 +429,6 @@ static u8 clk_pm_cpu_get_parent(struct clk_hw *hw)
+ return val;
+ }
+
+-static int clk_pm_cpu_set_parent(struct clk_hw *hw, u8 index)
+-{
+- struct clk_pm_cpu *pm_cpu = to_clk_pm_cpu(hw);
+- struct regmap *base = pm_cpu->nb_pm_base;
+- int load_level;
+-
+- /*
+- * We set the clock parent only if the DVFS is available but
+- * not enabled.
+- */
+- if (IS_ERR(base) || armada_3700_pm_dvfs_is_enabled(base))
+- return -EINVAL;
+-
+- /* Set the parent clock for all the load level */
+- for (load_level = 0; load_level < LOAD_LEVEL_NR; load_level++) {
+- unsigned int reg, mask, val,
+- offset = ARMADA_37XX_NB_TBG_SEL_OFF;
+-
+- armada_3700_pm_dvfs_update_regs(load_level, ®, &offset);
+-
+- val = index << offset;
+- mask = ARMADA_37XX_NB_TBG_SEL_MASK << offset;
+- regmap_update_bits(base, reg, mask, val);
+- }
+- return 0;
+-}
+-
+ static unsigned long clk_pm_cpu_recalc_rate(struct clk_hw *hw,
+ unsigned long parent_rate)
+ {
+@@ -502,8 +476,10 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate,
+ }
+
+ /*
+- * Switching the CPU from the L2 or L3 frequencies (300 and 200 Mhz
+- * respectively) to L0 frequency (1.2 Ghz) requires a significant
++ * Workaround when base CPU frequnecy is 1000 or 1200 MHz
++ *
++ * Switching the CPU from the L2 or L3 frequencies (250/300 or 200 MHz
++ * respectively) to L0 frequency (1/1.2 GHz) requires a significant
+ * amount of time to let VDD stabilize to the appropriate
+ * voltage. This amount of time is large enough that it cannot be
+ * covered by the hardware countdown register. Due to this, the CPU
+@@ -513,26 +489,56 @@ static long clk_pm_cpu_round_rate(struct clk_hw *hw, unsigned long rate,
+ * To work around this problem, we prevent switching directly from the
+ * L2/L3 frequencies to the L0 frequency, and instead switch to the L1
+ * frequency in-between. The sequence therefore becomes:
+- * 1. First switch from L2/L3(200/300MHz) to L1(600MHZ)
++ * 1. First switch from L2/L3 (200/250/300 MHz) to L1 (500/600 MHz)
+ * 2. Sleep 20ms for stabling VDD voltage
+- * 3. Then switch from L1(600MHZ) to L0(1200Mhz).
++ * 3. Then switch from L1 (500/600 MHz) to L0 (1000/1200 MHz).
+ */
+-static void clk_pm_cpu_set_rate_wa(unsigned long rate, struct regmap *base)
++static void clk_pm_cpu_set_rate_wa(struct clk_pm_cpu *pm_cpu,
++ unsigned int new_level, unsigned long rate,
++ struct regmap *base)
+ {
+ unsigned int cur_level;
+
+- if (rate != 1200 * 1000 * 1000)
+- return;
+-
+ regmap_read(base, ARMADA_37XX_NB_CPU_LOAD, &cur_level);
+ cur_level &= ARMADA_37XX_NB_CPU_LOAD_MASK;
+- if (cur_level <= ARMADA_37XX_DVFS_LOAD_1)
++
++ if (cur_level == new_level)
++ return;
++
++ /*
++ * System wants to go to L1 on its own. If we are going from L2/L3,
++ * remember when 20ms will expire. If from L0, set the value so that
++ * next switch to L0 won't have to wait.
++ */
++ if (new_level == ARMADA_37XX_DVFS_LOAD_1) {
++ if (cur_level == ARMADA_37XX_DVFS_LOAD_0)
++ pm_cpu->l1_expiration = jiffies;
++ else
++ pm_cpu->l1_expiration = jiffies + msecs_to_jiffies(20);
+ return;
++ }
++
++ /*
++ * If we are setting to L2/L3, just invalidate L1 expiration time,
++ * sleeping is not needed.
++ */
++ if (rate < 1000*1000*1000)
++ goto invalidate_l1_exp;
++
++ /*
++ * We are going to L0 with rate >= 1GHz. Check whether we have been at
++ * L1 for long enough time. If not, go to L1 for 20ms.
++ */
++ if (pm_cpu->l1_expiration && jiffies >= pm_cpu->l1_expiration)
++ goto invalidate_l1_exp;
+
+ regmap_update_bits(base, ARMADA_37XX_NB_CPU_LOAD,
+ ARMADA_37XX_NB_CPU_LOAD_MASK,
+ ARMADA_37XX_DVFS_LOAD_1);
+ msleep(20);
++
++invalidate_l1_exp:
++ pm_cpu->l1_expiration = 0;
+ }
+
+ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -566,7 +572,9 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
+ reg = ARMADA_37XX_NB_CPU_LOAD;
+ mask = ARMADA_37XX_NB_CPU_LOAD_MASK;
+
+- clk_pm_cpu_set_rate_wa(rate, base);
++ /* Apply workaround when base CPU frequency is 1000 or 1200 MHz */
++ if (parent_rate >= 1000*1000*1000)
++ clk_pm_cpu_set_rate_wa(pm_cpu, load_level, rate, base);
+
+ regmap_update_bits(base, reg, mask, load_level);
+
+@@ -580,7 +588,6 @@ static int clk_pm_cpu_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ static const struct clk_ops clk_pm_cpu_ops = {
+ .get_parent = clk_pm_cpu_get_parent,
+- .set_parent = clk_pm_cpu_set_parent,
+ .round_rate = clk_pm_cpu_round_rate,
+ .set_rate = clk_pm_cpu_set_rate,
+ .recalc_rate = clk_pm_cpu_recalc_rate,
+diff --git a/drivers/clk/qcom/a53-pll.c b/drivers/clk/qcom/a53-pll.c
+index 45cfc57bff924..af6ac17c7daeb 100644
+--- a/drivers/clk/qcom/a53-pll.c
++++ b/drivers/clk/qcom/a53-pll.c
+@@ -93,6 +93,7 @@ static const struct of_device_id qcom_a53pll_match_table[] = {
+ { .compatible = "qcom,msm8916-a53pll" },
+ { }
+ };
++MODULE_DEVICE_TABLE(of, qcom_a53pll_match_table);
+
+ static struct platform_driver qcom_a53pll_driver = {
+ .probe = qcom_a53pll_probe,
+diff --git a/drivers/clk/samsung/clk-exynos7.c b/drivers/clk/samsung/clk-exynos7.c
+index 492d516910800..9b02980ee929b 100644
+--- a/drivers/clk/samsung/clk-exynos7.c
++++ b/drivers/clk/samsung/clk-exynos7.c
+@@ -541,8 +541,13 @@ static const struct samsung_gate_clock top1_gate_clks[] __initconst = {
+ GATE(CLK_ACLK_FSYS0_200, "aclk_fsys0_200", "dout_aclk_fsys0_200",
+ ENABLE_ACLK_TOP13, 28, CLK_SET_RATE_PARENT |
+ CLK_IS_CRITICAL, 0),
++ /*
++ * This clock is required for the CMU_FSYS1 registers access, keep it
++ * enabled permanently until proper runtime PM support is added.
++ */
+ GATE(CLK_ACLK_FSYS1_200, "aclk_fsys1_200", "dout_aclk_fsys1_200",
+- ENABLE_ACLK_TOP13, 24, CLK_SET_RATE_PARENT, 0),
++ ENABLE_ACLK_TOP13, 24, CLK_SET_RATE_PARENT |
++ CLK_IS_CRITICAL, 0),
+
+ GATE(CLK_SCLK_PHY_FSYS1_26M, "sclk_phy_fsys1_26m",
+ "dout_sclk_phy_fsys1_26m", ENABLE_SCLK_TOP1_FSYS11,
+diff --git a/drivers/clk/socfpga/clk-gate-a10.c b/drivers/clk/socfpga/clk-gate-a10.c
+index 36376c542055c..637e26babf898 100644
+--- a/drivers/clk/socfpga/clk-gate-a10.c
++++ b/drivers/clk/socfpga/clk-gate-a10.c
+@@ -157,6 +157,7 @@ static void __init __socfpga_gate_init(struct device_node *node,
+ if (IS_ERR(socfpga_clk->sys_mgr_base_addr)) {
+ pr_err("%s: failed to find altr,sys-mgr regmap!\n",
+ __func__);
++ kfree(socfpga_clk);
+ return;
+ }
+ }
+diff --git a/drivers/clk/uniphier/clk-uniphier-mux.c b/drivers/clk/uniphier/clk-uniphier-mux.c
+index 2c243a894f3b9..3a52ab968ac24 100644
+--- a/drivers/clk/uniphier/clk-uniphier-mux.c
++++ b/drivers/clk/uniphier/clk-uniphier-mux.c
+@@ -40,10 +40,10 @@ static int uniphier_clk_mux_set_parent(struct clk_hw *hw, u8 index)
+ static u8 uniphier_clk_mux_get_parent(struct clk_hw *hw)
+ {
+ struct uniphier_clk_mux *mux = to_uniphier_clk_mux(hw);
+- int num_parents = clk_hw_get_num_parents(hw);
++ unsigned int num_parents = clk_hw_get_num_parents(hw);
+ int ret;
+ unsigned int val;
+- u8 i;
++ unsigned int i;
+
+ ret = regmap_read(mux->regmap, mux->reg, &val);
+ if (ret)
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index 9b0b490d70ff4..a36452bd9612d 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -25,6 +25,10 @@
+
+ #include "cpufreq-dt.h"
+
++/* Clk register set */
++#define ARMADA_37XX_CLK_TBG_SEL 0
++#define ARMADA_37XX_CLK_TBG_SEL_CPU_OFF 22
++
+ /* Power management in North Bridge register set */
+ #define ARMADA_37XX_NB_L0L1 0x18
+ #define ARMADA_37XX_NB_L2L3 0x1C
+@@ -69,6 +73,8 @@
+ #define LOAD_LEVEL_NR 4
+
+ #define MIN_VOLT_MV 1000
++#define MIN_VOLT_MV_FOR_L1_1000MHZ 1108
++#define MIN_VOLT_MV_FOR_L1_1200MHZ 1155
+
+ /* AVS value for the corresponding voltage (in mV) */
+ static int avs_map[] = {
+@@ -120,10 +126,15 @@ static struct armada_37xx_dvfs *armada_37xx_cpu_freq_info_get(u32 freq)
+ * will be configured then the DVFS will be enabled.
+ */
+ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base,
+- struct clk *clk, u8 *divider)
++ struct regmap *clk_base, u8 *divider)
+ {
++ u32 cpu_tbg_sel;
+ int load_lvl;
+- struct clk *parent;
++
++ /* Determine to which TBG clock is CPU connected */
++ regmap_read(clk_base, ARMADA_37XX_CLK_TBG_SEL, &cpu_tbg_sel);
++ cpu_tbg_sel >>= ARMADA_37XX_CLK_TBG_SEL_CPU_OFF;
++ cpu_tbg_sel &= ARMADA_37XX_NB_TBG_SEL_MASK;
+
+ for (load_lvl = 0; load_lvl < LOAD_LEVEL_NR; load_lvl++) {
+ unsigned int reg, mask, val, offset = 0;
+@@ -142,6 +153,11 @@ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base,
+ mask = (ARMADA_37XX_NB_CLK_SEL_MASK
+ << ARMADA_37XX_NB_CLK_SEL_OFF);
+
++ /* Set TBG index, for all levels we use the same TBG */
++ val = cpu_tbg_sel << ARMADA_37XX_NB_TBG_SEL_OFF;
++ mask = (ARMADA_37XX_NB_TBG_SEL_MASK
++ << ARMADA_37XX_NB_TBG_SEL_OFF);
++
+ /*
+ * Set cpu divider based on the pre-computed array in
+ * order to have balanced step.
+@@ -160,14 +176,6 @@ static void __init armada37xx_cpufreq_dvfs_setup(struct regmap *base,
+
+ regmap_update_bits(base, reg, mask, val);
+ }
+-
+- /*
+- * Set cpu clock source, for all the level we keep the same
+- * clock source that the one already configured. For this one
+- * we need to use the clock framework
+- */
+- parent = clk_get_parent(clk);
+- clk_set_parent(clk, parent);
+ }
+
+ /*
+@@ -202,6 +210,8 @@ static u32 armada_37xx_avs_val_match(int target_vm)
+ * - L2 & L3 voltage should be about 150mv smaller than L0 voltage.
+ * This function calculates L1 & L2 & L3 AVS values dynamically based
+ * on L0 voltage and fill all AVS values to the AVS value table.
++ * When base CPU frequency is 1000 or 1200 MHz then there is additional
++ * minimal avs value for load L1.
+ */
+ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base,
+ struct armada_37xx_dvfs *dvfs)
+@@ -233,6 +243,19 @@ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base,
+ for (load_level = 1; load_level < LOAD_LEVEL_NR; load_level++)
+ dvfs->avs[load_level] = avs_min;
+
++ /*
++ * Set the avs values for load L0 and L1 when base CPU frequency
++ * is 1000/1200 MHz to its typical initial values according to
++ * the Armada 3700 Hardware Specifications.
++ */
++ if (dvfs->cpu_freq_max >= 1000*1000*1000) {
++ if (dvfs->cpu_freq_max >= 1200*1000*1000)
++ avs_min = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1200MHZ);
++ else
++ avs_min = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1000MHZ);
++ dvfs->avs[0] = dvfs->avs[1] = avs_min;
++ }
++
+ return;
+ }
+
+@@ -252,6 +275,26 @@ static void __init armada37xx_cpufreq_avs_configure(struct regmap *base,
+ target_vm = avs_map[l0_vdd_min] - 150;
+ target_vm = target_vm > MIN_VOLT_MV ? target_vm : MIN_VOLT_MV;
+ dvfs->avs[2] = dvfs->avs[3] = armada_37xx_avs_val_match(target_vm);
++
++ /*
++ * Fix the avs value for load L1 when base CPU frequency is 1000/1200 MHz,
++ * otherwise the CPU gets stuck when switching from load L1 to load L0.
++ * Also ensure that avs value for load L1 is not higher than for L0.
++ */
++ if (dvfs->cpu_freq_max >= 1000*1000*1000) {
++ u32 avs_min_l1;
++
++ if (dvfs->cpu_freq_max >= 1200*1000*1000)
++ avs_min_l1 = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1200MHZ);
++ else
++ avs_min_l1 = armada_37xx_avs_val_match(MIN_VOLT_MV_FOR_L1_1000MHZ);
++
++ if (avs_min_l1 > dvfs->avs[0])
++ avs_min_l1 = dvfs->avs[0];
++
++ if (dvfs->avs[1] < avs_min_l1)
++ dvfs->avs[1] = avs_min_l1;
++ }
+ }
+
+ static void __init armada37xx_cpufreq_avs_setup(struct regmap *base,
+@@ -360,11 +403,16 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ struct platform_device *pdev;
+ unsigned long freq;
+ unsigned int cur_frequency, base_frequency;
+- struct regmap *nb_pm_base, *avs_base;
++ struct regmap *nb_clk_base, *nb_pm_base, *avs_base;
+ struct device *cpu_dev;
+ int load_lvl, ret;
+ struct clk *clk, *parent;
+
++ nb_clk_base =
++ syscon_regmap_lookup_by_compatible("marvell,armada-3700-periph-clock-nb");
++ if (IS_ERR(nb_clk_base))
++ return -ENODEV;
++
+ nb_pm_base =
+ syscon_regmap_lookup_by_compatible("marvell,armada-3700-nb-pm");
+
+@@ -423,7 +471,7 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ return -EINVAL;
+ }
+
+- dvfs = armada_37xx_cpu_freq_info_get(cur_frequency);
++ dvfs = armada_37xx_cpu_freq_info_get(base_frequency);
+ if (!dvfs) {
+ clk_put(clk);
+ return -EINVAL;
+@@ -441,7 +489,7 @@ static int __init armada37xx_cpufreq_driver_init(void)
+ armada37xx_cpufreq_avs_configure(avs_base, dvfs);
+ armada37xx_cpufreq_avs_setup(avs_base, dvfs);
+
+- armada37xx_cpufreq_dvfs_setup(nb_pm_base, clk, dvfs->divider);
++ armada37xx_cpufreq_dvfs_setup(nb_pm_base, nb_clk_base, dvfs->divider);
+ clk_put(clk);
+
+ for (load_lvl = ARMADA_37XX_DVFS_LOAD_0; load_lvl < LOAD_LEVEL_NR;
+@@ -475,7 +523,7 @@ disable_dvfs:
+ remove_opp:
+ /* clean-up the already added opp before leaving */
+ while (load_lvl-- > ARMADA_37XX_DVFS_LOAD_0) {
+- freq = cur_frequency / dvfs->divider[load_lvl];
++ freq = base_frequency / dvfs->divider[load_lvl];
+ dev_pm_opp_remove(cpu_dev, freq);
+ }
+
+diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+index 613c7d5644ced..e87b7c466bdbf 100644
+--- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (ret)
+ goto out_err_free_reg;
+
+- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+-
+ ret = adf_dev_init(accel_dev);
+ if (ret)
+ goto out_err_dev_shutdown;
+
++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
++
+ ret = adf_dev_start(accel_dev);
+ if (ret)
+ goto out_err_dev_stop;
+diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+index 278452b8ef81c..a8f3f2ecae70d 100644
+--- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (ret)
+ goto out_err_free_reg;
+
+- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+-
+ ret = adf_dev_init(accel_dev);
+ if (ret)
+ goto out_err_dev_shutdown;
+
++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
++
+ ret = adf_dev_start(accel_dev);
+ if (ret)
+ goto out_err_dev_stop;
+diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c
+index cd1cdf5305bc9..4898ef41fd9fd 100644
+--- a/drivers/crypto/qat/qat_common/adf_isr.c
++++ b/drivers/crypto/qat/qat_common/adf_isr.c
+@@ -330,19 +330,32 @@ int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev)
+
+ ret = adf_isr_alloc_msix_entry_table(accel_dev);
+ if (ret)
+- return ret;
+- if (adf_enable_msix(accel_dev))
+ goto err_out;
+
+- if (adf_setup_bh(accel_dev))
+- goto err_out;
++ ret = adf_enable_msix(accel_dev);
++ if (ret)
++ goto err_free_msix_table;
+
+- if (adf_request_irqs(accel_dev))
+- goto err_out;
++ ret = adf_setup_bh(accel_dev);
++ if (ret)
++ goto err_disable_msix;
++
++ ret = adf_request_irqs(accel_dev);
++ if (ret)
++ goto err_cleanup_bh;
+
+ return 0;
++
++err_cleanup_bh:
++ adf_cleanup_bh(accel_dev);
++
++err_disable_msix:
++ adf_disable_msix(&accel_dev->accel_pci_dev);
++
++err_free_msix_table:
++ adf_isr_free_msix_entry_table(accel_dev);
++
+ err_out:
+- adf_isr_resource_free(accel_dev);
+- return -EFAULT;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(adf_isr_resource_alloc);
+diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c
+index 57d2622728a57..4c0067f8c079f 100644
+--- a/drivers/crypto/qat/qat_common/adf_transport.c
++++ b/drivers/crypto/qat/qat_common/adf_transport.c
+@@ -197,6 +197,7 @@ static int adf_init_ring(struct adf_etr_ring_data *ring)
+ dev_err(&GET_DEV(accel_dev), "Ring address not aligned\n");
+ dma_free_coherent(&GET_DEV(accel_dev), ring_size_bytes,
+ ring->base_addr, ring->dma_addr);
++ ring->base_addr = NULL;
+ return -EFAULT;
+ }
+
+diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+index 4a73fc70f7a97..df9a1f35b8320 100644
+--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
++++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+@@ -304,17 +304,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev)
+ goto err_out;
+
+ if (adf_setup_pf2vf_bh(accel_dev))
+- goto err_out;
++ goto err_disable_msi;
+
+ if (adf_setup_bh(accel_dev))
+- goto err_out;
++ goto err_cleanup_pf2vf_bh;
+
+ if (adf_request_msi_irq(accel_dev))
+- goto err_out;
++ goto err_cleanup_bh;
+
+ return 0;
++
++err_cleanup_bh:
++ adf_cleanup_bh(accel_dev);
++
++err_cleanup_pf2vf_bh:
++ adf_cleanup_pf2vf_bh(accel_dev);
++
++err_disable_msi:
++ adf_disable_msi(accel_dev);
++
+ err_out:
+- adf_vf_isr_resource_free(accel_dev);
+ return -EFAULT;
+ }
+ EXPORT_SYMBOL_GPL(adf_vf_isr_resource_alloc);
+diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+index 3da0f951cb590..1b954abf67fb8 100644
+--- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (ret)
+ goto out_err_free_reg;
+
+- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+-
+ ret = adf_dev_init(accel_dev);
+ if (ret)
+ goto out_err_dev_shutdown;
+
++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
++
+ ret = adf_dev_start(accel_dev);
+ if (ret)
+ goto out_err_dev_stop;
+diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c
+index 9327479c719c2..c857120c00d94 100644
+--- a/drivers/extcon/extcon-arizona.c
++++ b/drivers/extcon/extcon-arizona.c
+@@ -602,7 +602,7 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data)
+ struct arizona *arizona = info->arizona;
+ int id_gpio = arizona->pdata.hpdet_id_gpio;
+ unsigned int report = EXTCON_JACK_HEADPHONE;
+- int ret, reading;
++ int ret, reading, state;
+ bool mic = false;
+
+ mutex_lock(&info->lock);
+@@ -615,12 +615,11 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data)
+ }
+
+ /* If the cable was removed while measuring ignore the result */
+- ret = extcon_get_state(info->edev, EXTCON_MECHANICAL);
+- if (ret < 0) {
+- dev_err(arizona->dev, "Failed to check cable state: %d\n",
+- ret);
++ state = extcon_get_state(info->edev, EXTCON_MECHANICAL);
++ if (state < 0) {
++ dev_err(arizona->dev, "Failed to check cable state: %d\n", state);
+ goto out;
+- } else if (!ret) {
++ } else if (!state) {
+ dev_dbg(arizona->dev, "Ignoring HPDET for removed cable\n");
+ goto done;
+ }
+@@ -673,7 +672,7 @@ done:
+ ARIZONA_ACCDET_MODE_MASK, ARIZONA_ACCDET_MODE_MIC);
+
+ /* If we have a mic then reenable MICDET */
+- if (mic || info->mic)
++ if (state && (mic || info->mic))
+ arizona_start_mic(info);
+
+ if (info->hpdet_active) {
+@@ -681,7 +680,9 @@ done:
+ info->hpdet_active = false;
+ }
+
+- info->hpdet_done = true;
++ /* Do not set hp_det done when the cable has been unplugged */
++ if (state)
++ info->hpdet_done = true;
+
+ out:
+ mutex_unlock(&info->lock);
+diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
+index ed212c8b41083..1c419e4cea839 100644
+--- a/drivers/firmware/Kconfig
++++ b/drivers/firmware/Kconfig
+@@ -248,6 +248,7 @@ config FW_CFG_SYSFS_CMDLINE
+ config QCOM_SCM
+ bool
+ depends on ARM || ARM64
++ depends on HAVE_ARM_SMCCC
+ select RESET_CONTROLLER
+
+ config QCOM_SCM_32
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 4ad34c6803ade..b018909a4e46c 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -1355,6 +1355,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = {
+ .no_edge_events_on_boot = true,
+ },
+ },
++ {
++ /*
++ * The Dell Venue 10 Pro 5055, with Bay Trail SoC + TI PMIC uses an
++ * external embedded-controller connected via I2C + an ACPI GPIO
++ * event handler on INT33FFC:02 pin 12, causing spurious wakeups.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Venue 10 Pro 5055"),
++ },
++ .driver_data = &(struct acpi_gpiolib_dmi_quirk) {
++ .ignore_wake = "INT33FC:02@12",
++ },
++ },
+ {
+ /*
+ * HP X2 10 models with Cherry Trail SoC + TI PMIC use an
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
+index 1abf5b5bac9e5..18402a6ba8fe3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
+@@ -447,7 +447,7 @@ void amdgpu_irq_gpu_reset_resume_helper(struct amdgpu_device *adev)
+ for (j = 0; j < AMDGPU_MAX_IRQ_SRC_ID; ++j) {
+ struct amdgpu_irq_src *src = adev->irq.client[i].sources[j];
+
+- if (!src)
++ if (!src || !src->funcs || !src->funcs->set)
+ continue;
+ for (k = 0; k < src->num_types; k++)
+ amdgpu_irq_update(adev, src, k);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+index abad7460084f2..757fa486aac41 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -971,7 +971,7 @@ static void amdgpu_ttm_tt_unpin_userptr(struct ttm_tt *ttm)
+ DMA_BIDIRECTIONAL : DMA_TO_DEVICE;
+
+ /* double check that we don't free the table twice */
+- if (!ttm->sg->sgl)
++ if (!ttm->sg || !ttm->sg->sgl)
+ return;
+
+ /* unmap the pages mapped to the device */
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+index e5a6db6beab7a..8c5f39beee7cf 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+@@ -231,7 +231,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_device *adev)
+ if ((adev->asic_type == CHIP_POLARIS10 ||
+ adev->asic_type == CHIP_POLARIS11) &&
+ (adev->uvd.fw_version < FW_1_66_16))
+- DRM_ERROR("POLARIS10/11 UVD firmware version %hu.%hu is too old.\n",
++ DRM_ERROR("POLARIS10/11 UVD firmware version %u.%u is too old.\n",
+ version_major, version_minor);
+ } else {
+ unsigned int enc_major, enc_minor, dec_minor;
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
+index 01494752c36a8..f3a526ed8059d 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.c
+@@ -20,6 +20,10 @@
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
++#include <linux/kconfig.h>
++
++#if IS_REACHABLE(CONFIG_AMD_IOMMU_V2)
++
+ #include <linux/printk.h>
+ #include <linux/device.h>
+ #include <linux/slab.h>
+@@ -366,3 +370,5 @@ int kfd_iommu_add_perf_counters(struct kfd_topology_device *kdev)
+
+ return 0;
+ }
++
++#endif
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h
+index dd23d9fdf6a82..afd420b01a0c2 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_iommu.h
+@@ -23,7 +23,9 @@
+ #ifndef __KFD_IOMMU_H__
+ #define __KFD_IOMMU_H__
+
+-#if defined(CONFIG_AMD_IOMMU_V2_MODULE) || defined(CONFIG_AMD_IOMMU_V2)
++#include <linux/kconfig.h>
++
++#if IS_REACHABLE(CONFIG_AMD_IOMMU_V2)
+
+ #define KFD_SUPPORT_IOMMU_V2
+
+@@ -46,6 +48,9 @@ static inline int kfd_iommu_check_device(struct kfd_dev *kfd)
+ }
+ static inline int kfd_iommu_device_init(struct kfd_dev *kfd)
+ {
++#if IS_MODULE(CONFIG_AMD_IOMMU_V2)
++ WARN_ONCE(1, "iommu_v2 module is not usable by built-in KFD");
++#endif
+ return 0;
+ }
+
+@@ -73,6 +78,6 @@ static inline int kfd_iommu_add_perf_counters(struct kfd_topology_device *kdev)
+ return 0;
+ }
+
+-#endif /* defined(CONFIG_AMD_IOMMU_V2) */
++#endif /* IS_REACHABLE(CONFIG_AMD_IOMMU_V2) */
+
+ #endif /* __KFD_IOMMU_H__ */
+diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c
+index 46c8b720e3363..3e3876d141cef 100644
+--- a/drivers/gpu/drm/i915/gvt/gvt.c
++++ b/drivers/gpu/drm/i915/gvt/gvt.c
+@@ -128,7 +128,7 @@ static bool intel_get_gvt_attrs(struct attribute ***type_attrs,
+ return true;
+ }
+
+-static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt)
++static int intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt)
+ {
+ int i, j;
+ struct intel_vgpu_type *type;
+@@ -146,7 +146,7 @@ static bool intel_gvt_init_vgpu_type_groups(struct intel_gvt *gvt)
+ gvt_vgpu_type_groups[i] = group;
+ }
+
+- return true;
++ return 0;
+
+ unwind:
+ for (j = 0; j < i; j++) {
+@@ -154,7 +154,7 @@ unwind:
+ kfree(group);
+ }
+
+- return false;
++ return -ENOMEM;
+ }
+
+ static void intel_gvt_cleanup_vgpu_type_groups(struct intel_gvt *gvt)
+@@ -416,7 +416,7 @@ int intel_gvt_init_device(struct drm_i915_private *dev_priv)
+ goto out_clean_thread;
+
+ ret = intel_gvt_init_vgpu_type_groups(gvt);
+- if (ret == false) {
++ if (ret) {
+ gvt_err("failed to init vgpu type groups: %d\n", ret);
+ goto out_clean_types;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 8d731eb1de69c..aa8d2aca0f02f 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2951,7 +2951,7 @@ int ilk_wm_max_level(const struct drm_i915_private *dev_priv)
+
+ static void intel_print_wm_latency(struct drm_i915_private *dev_priv,
+ const char *name,
+- const uint16_t wm[8])
++ const uint16_t wm[])
+ {
+ int level, max_level = ilk_wm_max_level(dev_priv);
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c
+index d6f79dc755b46..14e2ce87bab10 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cmd_encoder.c
+@@ -78,9 +78,17 @@ static int pingpong_tearcheck_setup(struct drm_encoder *encoder,
+ | MDP5_PP_SYNC_CONFIG_VSYNC_IN_EN;
+ cfg |= MDP5_PP_SYNC_CONFIG_VSYNC_COUNT(vclks_line);
+
++ /*
++ * Tearcheck emits a blanking signal every vclks_line * vtotal * 2 ticks on
++ * the vsync_clk equating to roughly half the desired panel refresh rate.
++ * This is only necessary as stability fallback if interrupts from the
++ * panel arrive too late or not at all, but is currently used by default
++ * because these panel interrupts are not wired up yet.
++ */
+ mdp5_write(mdp5_kms, REG_MDP5_PP_SYNC_CONFIG_VSYNC(pp_id), cfg);
+ mdp5_write(mdp5_kms,
+- REG_MDP5_PP_SYNC_CONFIG_HEIGHT(pp_id), 0xfff0);
++ REG_MDP5_PP_SYNC_CONFIG_HEIGHT(pp_id), (2 * mode->vtotal));
++
+ mdp5_write(mdp5_kms,
+ REG_MDP5_PP_VSYNC_INIT_VAL(pp_id), mode->vdisplay);
+ mdp5_write(mdp5_kms, REG_MDP5_PP_RD_PTR_IRQ(pp_id), mode->vdisplay + 1);
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index 1a6f6edb35151..62e6e3b73e4e6 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -1558,6 +1558,7 @@ struct radeon_dpm {
+ void *priv;
+ u32 new_active_crtcs;
+ int new_active_crtc_count;
++ int high_pixelclock_count;
+ u32 current_active_crtcs;
+ int current_active_crtc_count;
+ bool single_display;
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index f422a8d6aec40..821b03d6142b0 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -2133,11 +2133,14 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev)
+ return state_index;
+ /* last mode is usually default, array is low to high */
+ for (i = 0; i < num_modes; i++) {
+- rdev->pm.power_state[state_index].clock_info =
+- kcalloc(1, sizeof(struct radeon_pm_clock_info),
+- GFP_KERNEL);
++ /* avoid memory leaks from invalid modes or unknown frev. */
++ if (!rdev->pm.power_state[state_index].clock_info) {
++ rdev->pm.power_state[state_index].clock_info =
++ kzalloc(sizeof(struct radeon_pm_clock_info),
++ GFP_KERNEL);
++ }
+ if (!rdev->pm.power_state[state_index].clock_info)
+- return state_index;
++ goto out;
+ rdev->pm.power_state[state_index].num_clock_modes = 1;
+ rdev->pm.power_state[state_index].clock_info[0].voltage.type = VOLTAGE_NONE;
+ switch (frev) {
+@@ -2256,17 +2259,24 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev)
+ break;
+ }
+ }
++out:
++ /* free any unused clock_info allocation. */
++ if (state_index && state_index < num_modes) {
++ kfree(rdev->pm.power_state[state_index].clock_info);
++ rdev->pm.power_state[state_index].clock_info = NULL;
++ }
++
+ /* last mode is usually default */
+- if (rdev->pm.default_power_state_index == -1) {
++ if (state_index && rdev->pm.default_power_state_index == -1) {
+ rdev->pm.power_state[state_index - 1].type =
+ POWER_STATE_TYPE_DEFAULT;
+ rdev->pm.default_power_state_index = state_index - 1;
+ rdev->pm.power_state[state_index - 1].default_clock_mode =
+ &rdev->pm.power_state[state_index - 1].clock_info[0];
+- rdev->pm.power_state[state_index].flags &=
++ rdev->pm.power_state[state_index - 1].flags &=
+ ~RADEON_PM_STATE_SINGLE_DISPLAY_ONLY;
+- rdev->pm.power_state[state_index].misc = 0;
+- rdev->pm.power_state[state_index].misc2 = 0;
++ rdev->pm.power_state[state_index - 1].misc = 0;
++ rdev->pm.power_state[state_index - 1].misc2 = 0;
+ }
+ return state_index;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index 34b3cb6c146f9..3f75b4be7fa4a 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -501,6 +501,7 @@ static int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file
+ *value = rdev->config.si.backend_enable_mask;
+ } else {
+ DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n");
++ return -EINVAL;
+ }
+ break;
+ case RADEON_INFO_MAX_SCLK:
+diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
+index 4b6542538ff91..c213a5c9227ed 100644
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -1715,6 +1715,7 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev)
+ struct drm_device *ddev = rdev->ddev;
+ struct drm_crtc *crtc;
+ struct radeon_crtc *radeon_crtc;
++ struct radeon_connector *radeon_connector;
+
+ if (!rdev->pm.dpm_enabled)
+ return;
+@@ -1724,6 +1725,7 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev)
+ /* update active crtc counts */
+ rdev->pm.dpm.new_active_crtcs = 0;
+ rdev->pm.dpm.new_active_crtc_count = 0;
++ rdev->pm.dpm.high_pixelclock_count = 0;
+ if (rdev->num_crtc && rdev->mode_info.mode_config_initialized) {
+ list_for_each_entry(crtc,
+ &ddev->mode_config.crtc_list, head) {
+@@ -1731,6 +1733,12 @@ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev)
+ if (crtc->enabled) {
+ rdev->pm.dpm.new_active_crtcs |= (1 << radeon_crtc->crtc_id);
+ rdev->pm.dpm.new_active_crtc_count++;
++ if (!radeon_crtc->connector)
++ continue;
++
++ radeon_connector = to_radeon_connector(radeon_crtc->connector);
++ if (radeon_connector->pixelclock_for_modeset > 297000)
++ rdev->pm.dpm.high_pixelclock_count++;
+ }
+ }
+ }
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index db2d8b84e137b..aac18d527c01b 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -3000,6 +3000,9 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ (rdev->pdev->device == 0x6605)) {
+ max_sclk = 75000;
+ }
++
++ if (rdev->pm.dpm.high_pixelclock_count > 1)
++ disable_sclk_switching = true;
+ }
+
+ if (rps->vce_active) {
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 68908dac5835e..75342f3dfb863 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -904,6 +904,7 @@
+ #define USB_DEVICE_ID_ORTEK_IHOME_IMAC_A210S 0x8003
+
+ #define USB_VENDOR_ID_PLANTRONICS 0x047f
++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES 0xc056
+
+ #define USB_VENDOR_ID_PANASONIC 0x04da
+ #define USB_DEVICE_ID_PANABOARD_UBT780 0x1044
+diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c
+index 584b10d3fc3d8..460711c1124ac 100644
+--- a/drivers/hid/hid-plantronics.c
++++ b/drivers/hid/hid-plantronics.c
+@@ -16,6 +16,7 @@
+
+ #include <linux/hid.h>
+ #include <linux/module.h>
++#include <linux/jiffies.h>
+
+ #define PLT_HID_1_0_PAGE 0xffa00000
+ #define PLT_HID_2_0_PAGE 0xffa20000
+@@ -39,6 +40,16 @@
+ #define PLT_ALLOW_CONSUMER (field->application == HID_CP_CONSUMERCONTROL && \
+ (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER)
+
++#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0)
++
++#define PLT_DOUBLE_KEY_TIMEOUT 5 /* ms */
++
++struct plt_drv_data {
++ unsigned long device_type;
++ unsigned long last_volume_key_ts;
++ u32 quirks;
++};
++
+ static int plantronics_input_mapping(struct hid_device *hdev,
+ struct hid_input *hi,
+ struct hid_field *field,
+@@ -46,7 +57,8 @@ static int plantronics_input_mapping(struct hid_device *hdev,
+ unsigned long **bit, int *max)
+ {
+ unsigned short mapped_key;
+- unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev);
++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev);
++ unsigned long plt_type = drv_data->device_type;
+
+ /* special case for PTT products */
+ if (field->application == HID_GD_JOYSTICK)
+@@ -108,6 +120,30 @@ mapped:
+ return 1;
+ }
+
++static int plantronics_event(struct hid_device *hdev, struct hid_field *field,
++ struct hid_usage *usage, __s32 value)
++{
++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev);
++
++ if (drv_data->quirks & PLT_QUIRK_DOUBLE_VOLUME_KEYS) {
++ unsigned long prev_ts, cur_ts;
++
++ /* Usages are filtered in plantronics_usages. */
++
++ if (!value) /* Handle key presses only. */
++ return 0;
++
++ prev_ts = drv_data->last_volume_key_ts;
++ cur_ts = jiffies;
++ if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_DOUBLE_KEY_TIMEOUT)
++ return 1; /* Ignore the repeated key. */
++
++ drv_data->last_volume_key_ts = cur_ts;
++ }
++
++ return 0;
++}
++
+ static unsigned long plantronics_device_type(struct hid_device *hdev)
+ {
+ unsigned i, col_page;
+@@ -136,15 +172,24 @@ exit:
+ static int plantronics_probe(struct hid_device *hdev,
+ const struct hid_device_id *id)
+ {
++ struct plt_drv_data *drv_data;
+ int ret;
+
++ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL);
++ if (!drv_data)
++ return -ENOMEM;
++
+ ret = hid_parse(hdev);
+ if (ret) {
+ hid_err(hdev, "parse failed\n");
+ goto err;
+ }
+
+- hid_set_drvdata(hdev, (void *)plantronics_device_type(hdev));
++ drv_data->device_type = plantronics_device_type(hdev);
++ drv_data->quirks = id->driver_data;
++ drv_data->last_volume_key_ts = jiffies - msecs_to_jiffies(PLT_DOUBLE_KEY_TIMEOUT);
++
++ hid_set_drvdata(hdev, drv_data);
+
+ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT |
+ HID_CONNECT_HIDINPUT_FORCE | HID_CONNECT_HIDDEV_FORCE);
+@@ -156,15 +201,26 @@ err:
+ }
+
+ static const struct hid_device_id plantronics_devices[] = {
++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES),
++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, plantronics_devices);
+
++static const struct hid_usage_id plantronics_usages[] = {
++ { HID_CP_VOLUMEUP, EV_KEY, HID_ANY_ID },
++ { HID_CP_VOLUMEDOWN, EV_KEY, HID_ANY_ID },
++ { HID_TERMINATOR, HID_TERMINATOR, HID_TERMINATOR }
++};
++
+ static struct hid_driver plantronics_driver = {
+ .name = "plantronics",
+ .id_table = plantronics_devices,
++ .usage_table = plantronics_usages,
+ .input_mapping = plantronics_input_mapping,
++ .event = plantronics_event,
+ .probe = plantronics_probe,
+ };
+ module_hid_driver(plantronics_driver);
+diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c
+index 9065efd21851d..71895da63810b 100644
+--- a/drivers/hsi/hsi_core.c
++++ b/drivers/hsi/hsi_core.c
+@@ -223,8 +223,6 @@ static void hsi_add_client_from_dt(struct hsi_port *port,
+ if (err)
+ goto err;
+
+- dev_set_name(&cl->device, "%s", name);
+-
+ err = hsi_of_property_parse_mode(client, "hsi-mode", &mode);
+ if (err) {
+ err = hsi_of_property_parse_mode(client, "hsi-rx-mode",
+@@ -306,6 +304,7 @@ static void hsi_add_client_from_dt(struct hsi_port *port,
+ cl->device.release = hsi_client_release;
+ cl->device.of_node = client;
+
++ dev_set_name(&cl->device, "%s", name);
+ if (device_register(&cl->device) < 0) {
+ pr_err("hsi: failed to register client: %s\n", name);
+ put_device(&cl->device);
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index ac9617671757c..cdd4392c589d3 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -773,6 +773,12 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ free_cpumask_var(available_mask);
+ }
+
++#define UNLOAD_DELAY_UNIT_MS 10 /* 10 milliseconds */
++#define UNLOAD_WAIT_MS (100*1000) /* 100 seconds */
++#define UNLOAD_WAIT_LOOPS (UNLOAD_WAIT_MS/UNLOAD_DELAY_UNIT_MS)
++#define UNLOAD_MSG_MS (5*1000) /* Every 5 seconds */
++#define UNLOAD_MSG_LOOPS (UNLOAD_MSG_MS/UNLOAD_DELAY_UNIT_MS)
++
+ static void vmbus_wait_for_unload(void)
+ {
+ int cpu;
+@@ -790,12 +796,17 @@ static void vmbus_wait_for_unload(void)
+ * vmbus_connection.unload_event. If not, the last thing we can do is
+ * read message pages for all CPUs directly.
+ *
+- * Wait no more than 10 seconds so that the panic path can't get
+- * hung forever in case the response message isn't seen.
++ * Wait up to 100 seconds since an Azure host must writeback any dirty
++ * data in its disk cache before the VMbus UNLOAD request will
++ * complete. This flushing has been empirically observed to take up
++ * to 50 seconds in cases with a lot of dirty data, so allow additional
++ * leeway and for inaccuracies in mdelay(). But eventually time out so
++ * that the panic path can't get hung forever in case the response
++ * message isn't seen.
+ */
+- for (i = 0; i < 1000; i++) {
++ for (i = 1; i <= UNLOAD_WAIT_LOOPS; i++) {
+ if (completion_done(&vmbus_connection.unload_event))
+- break;
++ goto completed;
+
+ for_each_online_cpu(cpu) {
+ struct hv_per_cpu_context *hv_cpu
+@@ -818,9 +829,18 @@ static void vmbus_wait_for_unload(void)
+ vmbus_signal_eom(msg, message_type);
+ }
+
+- mdelay(10);
++ /*
++ * Give a notice periodically so someone watching the
++ * serial output won't think it is completely hung.
++ */
++ if (!(i % UNLOAD_MSG_LOOPS))
++ pr_notice("Waiting for VMBus UNLOAD to complete\n");
++
++ mdelay(UNLOAD_DELAY_UNIT_MS);
+ }
++ pr_err("Continuing even though VMBus UNLOAD did not complete\n");
+
++completed:
+ /*
+ * We're crashing and already got the UNLOAD_RESPONSE, cleanup all
+ * maybe-pending messages on all CPUs to be able to receive new
+diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c
+index edc52d75e6bdc..5041fe7fee9ed 100644
+--- a/drivers/hwtracing/intel_th/gth.c
++++ b/drivers/hwtracing/intel_th/gth.c
+@@ -477,7 +477,7 @@ static void intel_th_gth_disable(struct intel_th_device *thdev,
+ output->active = false;
+
+ for_each_set_bit(master, gth->output[output->port].master,
+- TH_CONFIGURABLE_MASTERS) {
++ TH_CONFIGURABLE_MASTERS + 1) {
+ gth_master_set(gth, master, -1);
+ }
+ spin_unlock(>h->gth_lock);
+@@ -616,7 +616,7 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev,
+ othdev->output.port = -1;
+ othdev->output.active = false;
+ gth->output[port].output = NULL;
+- for (master = 0; master <= TH_CONFIGURABLE_MASTERS; master++)
++ for (master = 0; master < TH_CONFIGURABLE_MASTERS + 1; master++)
+ if (gth->master[master] == port)
+ gth->master[master] = -1;
+ spin_unlock(>h->gth_lock);
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 2a16171033941..83fab06ccfebd 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -240,6 +240,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x1bcc),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Alder Lake-M */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x54a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
++ {
++ /* Rocket Lake CPU */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4c19),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ { 0 },
+ };
+
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index b136057182916..c5475bb4fae6b 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -906,7 +906,10 @@ static int cdns_i2c_probe(struct platform_device *pdev)
+ if (IS_ERR(id->membase))
+ return PTR_ERR(id->membase);
+
+- id->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ return ret;
++ id->irq = ret;
+
+ id->adap.owner = THIS_MODULE;
+ id->adap.dev.of_node = pdev->dev.of_node;
+diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c
+index 959d4912ec0d5..0230a13a6ab72 100644
+--- a/drivers/i2c/busses/i2c-emev2.c
++++ b/drivers/i2c/busses/i2c-emev2.c
+@@ -397,7 +397,10 @@ static int em_i2c_probe(struct platform_device *pdev)
+
+ em_i2c_reset(&priv->adap);
+
+- priv->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto err_clk;
++ priv->irq = ret;
+ ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0,
+ "em_i2c", priv);
+ if (ret)
+diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c
+index 41ca9ff7b5da7..4dd800c0db14a 100644
+--- a/drivers/i2c/busses/i2c-jz4780.c
++++ b/drivers/i2c/busses/i2c-jz4780.c
+@@ -760,7 +760,10 @@ static int jz4780_i2c_probe(struct platform_device *pdev)
+
+ jz4780_i2c_writew(i2c, JZ4780_I2C_INTM, 0x0);
+
+- i2c->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto err;
++ i2c->irq = ret;
+ ret = devm_request_irq(&pdev->dev, i2c->irq, jz4780_i2c_irq, 0,
+ dev_name(&pdev->dev), i2c);
+ if (ret)
+diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c
+index c2005c789d2b0..319d1fa617c88 100644
+--- a/drivers/i2c/busses/i2c-sh7760.c
++++ b/drivers/i2c/busses/i2c-sh7760.c
+@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev)
+ goto out2;
+ }
+
+- id->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto out3;
++ id->irq = ret;
+
+ id->adap.nr = pdev->id;
+ id->adap.algo = &sh7760_i2c_algo;
+diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
+index cbda91a0cb5f8..1d10ee86299d8 100644
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -448,8 +448,13 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ sizeof(rdwr_arg)))
+ return -EFAULT;
+
+- /* Put an arbitrary limit on the number of messages that can
+- * be sent at once */
++ if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0)
++ return -EINVAL;
++
++ /*
++ * Put an arbitrary limit on the number of messages that can
++ * be sent at once
++ */
+ if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS)
+ return -EINVAL;
+
+diff --git a/drivers/iio/accel/adis16201.c b/drivers/iio/accel/adis16201.c
+index 4c1d482ea73a7..94a80f8fdd10b 100644
+--- a/drivers/iio/accel/adis16201.c
++++ b/drivers/iio/accel/adis16201.c
+@@ -216,7 +216,7 @@ static const struct iio_chan_spec adis16201_channels[] = {
+ ADIS_AUX_ADC_CHAN(ADIS16201_AUX_ADC_REG, ADIS16201_SCAN_AUX_ADC, 0, 12),
+ ADIS_INCLI_CHAN(X, ADIS16201_XINCL_OUT_REG, ADIS16201_SCAN_INCLI_X,
+ BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14),
+- ADIS_INCLI_CHAN(X, ADIS16201_YINCL_OUT_REG, ADIS16201_SCAN_INCLI_Y,
++ ADIS_INCLI_CHAN(Y, ADIS16201_YINCL_OUT_REG, ADIS16201_SCAN_INCLI_Y,
+ BIT(IIO_CHAN_INFO_CALIBBIAS), 0, 14),
+ IIO_CHAN_SOFT_TIMESTAMP(7)
+ };
+diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
+index 33120ccff87ff..e6fdd0f4b4bcb 100644
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -270,7 +270,16 @@ static int mpu3050_read_raw(struct iio_dev *indio_dev,
+ case IIO_CHAN_INFO_OFFSET:
+ switch (chan->type) {
+ case IIO_TEMP:
+- /* The temperature scaling is (x+23000)/280 Celsius */
++ /*
++ * The temperature scaling is (x+23000)/280 Celsius
++ * for the "best fit straight line" temperature range
++ * of -30C..85C. The 23000 includes room temperature
++ * offset of +35C, 280 is the precision scale and x is
++ * the 16-bit signed integer reported by hardware.
++ *
++ * Temperature value itself represents temperature of
++ * the sensor die.
++ */
+ *val = 23000;
+ return IIO_VAL_INT;
+ default:
+@@ -327,7 +336,7 @@ static int mpu3050_read_raw(struct iio_dev *indio_dev,
+ goto out_read_raw_unlock;
+ }
+
+- *val = be16_to_cpu(raw_val);
++ *val = (s16)be16_to_cpu(raw_val);
+ ret = IIO_VAL_INT;
+
+ goto out_read_raw_unlock;
+diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
+index 4b5d9988f0256..23295fec5be59 100644
+--- a/drivers/iio/light/tsl2583.c
++++ b/drivers/iio/light/tsl2583.c
+@@ -350,6 +350,14 @@ static int tsl2583_als_calibrate(struct iio_dev *indio_dev)
+ return lux_val;
+ }
+
++ /* Avoid division by zero of lux_value later on */
++ if (lux_val == 0) {
++ dev_err(&chip->client->dev,
++ "%s: lux_val of 0 will produce out of range trim_value\n",
++ __func__);
++ return -ENODATA;
++ }
++
+ gain_trim_val = (unsigned int)(((chip->als_settings.als_cal_target)
+ * chip->als_settings.als_gain_trim) / lux_val);
+ if ((gain_trim_val < 250) || (gain_trim_val > 4000)) {
+diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
+index 47af54f14756b..67f85268b63db 100644
+--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
++++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
+@@ -158,6 +158,7 @@ static int lidar_get_measurement(struct lidar_data *data, u16 *reg)
+ ret = lidar_write_control(data, LIDAR_REG_CONTROL_ACQUIRE);
+ if (ret < 0) {
+ dev_err(&client->dev, "cannot send start measurement command");
++ pm_runtime_put_noidle(&client->dev);
+ return ret;
+ }
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
+index 539a5d44e6dbe..655952a6c0e60 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
+@@ -725,6 +725,7 @@ static int bnxt_qplib_alloc_dpi_tbl(struct bnxt_qplib_res *res,
+
+ unmap_io:
+ pci_iounmap(res->pdev, dpit->dbr_bar_reg_iomem);
++ dpit->dbr_bar_reg_iomem = NULL;
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/infiniband/hw/hfi1/firmware.c b/drivers/infiniband/hw/hfi1/firmware.c
+index 2b57ba70ddd6a..c090807124858 100644
+--- a/drivers/infiniband/hw/hfi1/firmware.c
++++ b/drivers/infiniband/hw/hfi1/firmware.c
+@@ -1924,6 +1924,7 @@ int parse_platform_config(struct hfi1_devdata *dd)
+ dd_dev_err(dd, "%s: Failed CRC check at offset %ld\n",
+ __func__, (ptr -
+ (u32 *)dd->platform_config.data));
++ ret = -EINVAL;
+ goto bail;
+ }
+ /* Jump the CRC DWORD */
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_pble.c b/drivers/infiniband/hw/i40iw/i40iw_pble.c
+index 540aab5e502dd..3fafc5424e76d 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_pble.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_pble.c
+@@ -392,12 +392,9 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev,
+ i40iw_debug(dev, I40IW_DEBUG_PBLE, "next_fpm_addr = %llx chunk_size[%u] = 0x%x\n",
+ pble_rsrc->next_fpm_addr, chunk->size, chunk->size);
+ pble_rsrc->unallocated_pble -= (chunk->size >> 3);
+- list_add(&chunk->list, &pble_rsrc->pinfo.clist);
+ sd_reg_val = (sd_entry_type == I40IW_SD_TYPE_PAGED) ?
+ sd_entry->u.pd_table.pd_page_addr.pa : sd_entry->u.bp.addr.pa;
+- if (sd_entry->valid)
+- return 0;
+- if (dev->is_pf) {
++ if (dev->is_pf && !sd_entry->valid) {
+ ret_code = i40iw_hmc_sd_one(dev, hmc_info->hmc_fn_id,
+ sd_reg_val, idx->sd_idx,
+ sd_entry->entry_type, true);
+@@ -408,6 +405,7 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev,
+ }
+
+ sd_entry->valid = true;
++ list_add(&chunk->list, &pble_rsrc->pinfo.clist);
+ return 0;
+ error:
+ kfree(chunk);
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index bc979a85a505d..6090f1ce0c56f 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2301,6 +2301,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev,
+ pr_info("rejected SRP_LOGIN_REQ because target %s_%d is not enabled\n",
+ sdev->device->name, port_num);
+ mutex_unlock(&sport->mutex);
++ ret = -EINVAL;
+ goto reject;
+ }
+
+diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c
+index d21ca39b0fdb0..adfae2d88707b 100644
+--- a/drivers/input/touchscreen/elants_i2c.c
++++ b/drivers/input/touchscreen/elants_i2c.c
+@@ -41,6 +41,7 @@
+ #include <linux/of.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/regulator/consumer.h>
++#include <linux/uuid.h>
+ #include <asm/unaligned.h>
+
+ /* Device, Driver information */
+@@ -1131,6 +1132,40 @@ static void elants_i2c_power_off(void *_data)
+ }
+ }
+
++#ifdef CONFIG_ACPI
++static const struct acpi_device_id i2c_hid_ids[] = {
++ {"ACPI0C50", 0 },
++ {"PNP0C50", 0 },
++ { },
++};
++
++static const guid_t i2c_hid_guid =
++ GUID_INIT(0x3CDFF6F7, 0x4267, 0x4555,
++ 0xAD, 0x05, 0xB3, 0x0A, 0x3D, 0x89, 0x38, 0xDE);
++
++static bool elants_acpi_is_hid_device(struct device *dev)
++{
++ acpi_handle handle = ACPI_HANDLE(dev);
++ union acpi_object *obj;
++
++ if (acpi_match_device_ids(ACPI_COMPANION(dev), i2c_hid_ids))
++ return false;
++
++ obj = acpi_evaluate_dsm_typed(handle, &i2c_hid_guid, 1, 1, NULL, ACPI_TYPE_INTEGER);
++ if (obj) {
++ ACPI_FREE(obj);
++ return true;
++ }
++
++ return false;
++}
++#else
++static bool elants_acpi_is_hid_device(struct device *dev)
++{
++ return false;
++}
++#endif
++
+ static int elants_i2c_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+@@ -1139,9 +1174,14 @@ static int elants_i2c_probe(struct i2c_client *client,
+ unsigned long irqflags;
+ int error;
+
++ /* Don't bind to i2c-hid compatible devices, these are handled by the i2c-hid drv. */
++ if (elants_acpi_is_hid_device(&client->dev)) {
++ dev_warn(&client->dev, "This device appears to be an I2C-HID device, not binding\n");
++ return -ENODEV;
++ }
++
+ if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+- dev_err(&client->dev,
+- "%s: i2c check functionality error\n", DEVICE_NAME);
++ dev_err(&client->dev, "I2C check functionality error\n");
+ return -ENXIO;
+ }
+
+diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
+index 06f0eb04a8fd4..a787a6aefc69f 100644
+--- a/drivers/input/touchscreen/silead.c
++++ b/drivers/input/touchscreen/silead.c
+@@ -28,6 +28,7 @@
+ #include <linux/input/mt.h>
+ #include <linux/input/touchscreen.h>
+ #include <linux/pm.h>
++#include <linux/pm_runtime.h>
+ #include <linux/irq.h>
+ #include <linux/regulator/consumer.h>
+
+@@ -343,10 +344,8 @@ static int silead_ts_get_id(struct i2c_client *client)
+
+ error = i2c_smbus_read_i2c_block_data(client, SILEAD_REG_ID,
+ sizeof(chip_id), (u8 *)&chip_id);
+- if (error < 0) {
+- dev_err(&client->dev, "Chip ID read error %d\n", error);
++ if (error < 0)
+ return error;
+- }
+
+ data->chip_id = le32_to_cpu(chip_id);
+ dev_info(&client->dev, "Silead chip ID: 0x%8X", data->chip_id);
+@@ -359,12 +358,49 @@ static int silead_ts_setup(struct i2c_client *client)
+ int error;
+ u32 status;
+
++ /*
++ * Some buggy BIOS-es bring up the chip in a stuck state where it
++ * blocks the I2C bus. The following steps are necessary to
++ * unstuck the chip / bus:
++ * 1. Turn off the Silead chip.
++ * 2. Try to do an I2C transfer with the chip, this will fail in
++ * response to which the I2C-bus-driver will call:
++ * i2c_recover_bus() which will unstuck the I2C-bus. Note the
++ * unstuck-ing of the I2C bus only works if we first drop the
++ * chip off the bus by turning it off.
++ * 3. Turn the chip back on.
++ *
++ * On the x86/ACPI systems were this problem is seen, step 1. and
++ * 3. require making ACPI calls and dealing with ACPI Power
++ * Resources. The workaround below runtime-suspends the chip to
++ * turn it off, leaving it up to the ACPI subsystem to deal with
++ * this.
++ */
++
++ if (device_property_read_bool(&client->dev,
++ "silead,stuck-controller-bug")) {
++ pm_runtime_set_active(&client->dev);
++ pm_runtime_enable(&client->dev);
++ pm_runtime_allow(&client->dev);
++
++ pm_runtime_suspend(&client->dev);
++
++ dev_warn(&client->dev, FW_BUG "Stuck I2C bus: please ignore the next 'controller timed out' error\n");
++ silead_ts_get_id(client);
++
++ /* The forbid will also resume the device */
++ pm_runtime_forbid(&client->dev);
++ pm_runtime_disable(&client->dev);
++ }
++
+ silead_ts_set_power(client, SILEAD_POWER_OFF);
+ silead_ts_set_power(client, SILEAD_POWER_ON);
+
+ error = silead_ts_get_id(client);
+- if (error)
++ if (error) {
++ dev_err(&client->dev, "Chip ID read error %d\n", error);
+ return error;
++ }
+
+ error = silead_ts_init(client);
+ if (error)
+diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c
+index fbfa7ff6deb16..9d011281d4b5c 100644
+--- a/drivers/irqchip/irq-gic-v3-mbi.c
++++ b/drivers/irqchip/irq-gic-v3-mbi.c
+@@ -297,7 +297,7 @@ int __init mbi_init(struct fwnode_handle *fwnode, struct irq_domain *parent)
+ reg = of_get_property(np, "mbi-alias", NULL);
+ if (reg) {
+ mbi_phys_base = of_translate_address(np, reg);
+- if (mbi_phys_base == OF_BAD_ADDR) {
++ if (mbi_phys_base == (phys_addr_t)OF_BAD_ADDR) {
+ ret = -ENXIO;
+ goto err_free_mbi;
+ }
+diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
+index a4ceb61c5b603..18de41a266ebe 100644
+--- a/drivers/isdn/capi/kcapi.c
++++ b/drivers/isdn/capi/kcapi.c
+@@ -846,7 +846,7 @@ EXPORT_SYMBOL(capi20_put_message);
+ * Return value: CAPI result code
+ */
+
+-u16 capi20_get_manufacturer(u32 contr, u8 *buf)
++u16 capi20_get_manufacturer(u32 contr, u8 buf[CAPI_MANUFACTURER_LEN])
+ {
+ struct capi_ctr *ctr;
+ u16 ret;
+@@ -916,7 +916,7 @@ EXPORT_SYMBOL(capi20_get_version);
+ * Return value: CAPI result code
+ */
+
+-u16 capi20_get_serial(u32 contr, u8 *serial)
++u16 capi20_get_serial(u32 contr, u8 serial[CAPI_SERIAL_LEN])
+ {
+ struct capi_ctr *ctr;
+ u16 ret;
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 23de59a692c51..b163329172208 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -1892,6 +1892,14 @@ static bool rs_takeover_requested(struct raid_set *rs)
+ return rs->md.new_level != rs->md.level;
+ }
+
++/* True if layout is set to reshape. */
++static bool rs_is_layout_change(struct raid_set *rs, bool use_mddev)
++{
++ return (use_mddev ? rs->md.delta_disks : rs->delta_disks) ||
++ rs->md.new_layout != rs->md.layout ||
++ rs->md.new_chunk_sectors != rs->md.chunk_sectors;
++}
++
+ /* True if @rs is requested to reshape by ctr */
+ static bool rs_reshape_requested(struct raid_set *rs)
+ {
+@@ -1904,9 +1912,7 @@ static bool rs_reshape_requested(struct raid_set *rs)
+ if (rs_is_raid0(rs))
+ return false;
+
+- change = mddev->new_layout != mddev->layout ||
+- mddev->new_chunk_sectors != mddev->chunk_sectors ||
+- rs->delta_disks;
++ change = rs_is_layout_change(rs, false);
+
+ /* Historical case to support raid1 reshape without delta disks */
+ if (rs_is_raid1(rs)) {
+@@ -2843,7 +2849,7 @@ static sector_t _get_reshape_sectors(struct raid_set *rs)
+ }
+
+ /*
+- *
++ * Reshape:
+ * - change raid layout
+ * - change chunk size
+ * - add disks
+@@ -2952,6 +2958,20 @@ static int rs_setup_reshape(struct raid_set *rs)
+ return r;
+ }
+
++/*
++ * If the md resync thread has updated superblock with max reshape position
++ * at the end of a reshape but not (yet) reset the layout configuration
++ * changes -> reset the latter.
++ */
++static void rs_reset_inconclusive_reshape(struct raid_set *rs)
++{
++ if (!rs_is_reshaping(rs) && rs_is_layout_change(rs, true)) {
++ rs_set_cur(rs);
++ rs->md.delta_disks = 0;
++ rs->md.reshape_backwards = 0;
++ }
++}
++
+ /*
+ * Enable/disable discard support on RAID set depending on
+ * RAID level and discard properties of underlying RAID members.
+@@ -3221,11 +3241,14 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ if (r)
+ goto bad;
+
++ /* Catch any inconclusive reshape superblock content. */
++ rs_reset_inconclusive_reshape(rs);
++
+ /* Start raid set read-only and assumed clean to change in raid_resume() */
+ rs->md.ro = 1;
+ rs->md.in_sync = 1;
+
+- /* Keep array frozen */
++ /* Keep array frozen until resume. */
+ set_bit(MD_RECOVERY_FROZEN, &rs->md.recovery);
+
+ /* Has to be held on running the array */
+@@ -3239,7 +3262,6 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ }
+
+ r = md_start(&rs->md);
+-
+ if (r) {
+ ti->error = "Failed to start raid array";
+ mddev_unlock(&rs->md);
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 9fde174ce3961..2957a3763f019 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -831,6 +831,7 @@ out_tag_set:
+ blk_mq_free_tag_set(md->tag_set);
+ out_kfree_tag_set:
+ kfree(md->tag_set);
++ md->tag_set = NULL;
+
+ return err;
+ }
+@@ -840,6 +841,7 @@ void dm_mq_cleanup_mapped_device(struct mapped_device *md)
+ if (md->tag_set) {
+ blk_mq_free_tag_set(md->tag_set);
+ kfree(md->tag_set);
++ md->tag_set = NULL;
+ }
+ }
+
+diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
+index 503f5e06fa86f..e79d2aa2372f4 100644
+--- a/drivers/md/md-bitmap.c
++++ b/drivers/md/md-bitmap.c
+@@ -1725,6 +1725,8 @@ void md_bitmap_flush(struct mddev *mddev)
+ md_bitmap_daemon_work(mddev);
+ bitmap->daemon_lastrun -= sleep;
+ md_bitmap_daemon_work(mddev);
++ if (mddev->bitmap_info.external)
++ md_super_wait(mddev);
+ md_bitmap_update_sb(bitmap);
+ }
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 09f0d8e70b709..fae6a983ceee1 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -583,7 +583,34 @@ void mddev_init(struct mddev *mddev)
+ }
+ EXPORT_SYMBOL_GPL(mddev_init);
+
++static struct mddev *mddev_find_locked(dev_t unit)
++{
++ struct mddev *mddev;
++
++ list_for_each_entry(mddev, &all_mddevs, all_mddevs)
++ if (mddev->unit == unit)
++ return mddev;
++
++ return NULL;
++}
++
+ static struct mddev *mddev_find(dev_t unit)
++{
++ struct mddev *mddev;
++
++ if (MAJOR(unit) != MD_MAJOR)
++ unit &= ~((1 << MdpMinorShift) - 1);
++
++ spin_lock(&all_mddevs_lock);
++ mddev = mddev_find_locked(unit);
++ if (mddev)
++ mddev_get(mddev);
++ spin_unlock(&all_mddevs_lock);
++
++ return mddev;
++}
++
++static struct mddev *mddev_find_or_alloc(dev_t unit)
+ {
+ struct mddev *mddev, *new = NULL;
+
+@@ -594,13 +621,13 @@ static struct mddev *mddev_find(dev_t unit)
+ spin_lock(&all_mddevs_lock);
+
+ if (unit) {
+- list_for_each_entry(mddev, &all_mddevs, all_mddevs)
+- if (mddev->unit == unit) {
+- mddev_get(mddev);
+- spin_unlock(&all_mddevs_lock);
+- kfree(new);
+- return mddev;
+- }
++ mddev = mddev_find_locked(unit);
++ if (mddev) {
++ mddev_get(mddev);
++ spin_unlock(&all_mddevs_lock);
++ kfree(new);
++ return mddev;
++ }
+
+ if (new) {
+ list_add(&new->all_mddevs, &all_mddevs);
+@@ -626,12 +653,7 @@ static struct mddev *mddev_find(dev_t unit)
+ return NULL;
+ }
+
+- is_free = 1;
+- list_for_each_entry(mddev, &all_mddevs, all_mddevs)
+- if (mddev->unit == dev) {
+- is_free = 0;
+- break;
+- }
++ is_free = !mddev_find_locked(dev);
+ }
+ new->unit = dev;
+ new->md_minor = MINOR(dev);
+@@ -5302,7 +5324,7 @@ static int md_alloc(dev_t dev, char *name)
+ * writing to /sys/module/md_mod/parameters/new_array.
+ */
+ static DEFINE_MUTEX(disks_mutex);
+- struct mddev *mddev = mddev_find(dev);
++ struct mddev *mddev = mddev_find_or_alloc(dev);
+ struct gendisk *disk;
+ int partitioned;
+ int shift;
+@@ -6155,11 +6177,9 @@ static void autorun_devices(int part)
+
+ md_probe(dev, NULL, NULL);
+ mddev = mddev_find(dev);
+- if (!mddev || !mddev->gendisk) {
+- if (mddev)
+- mddev_put(mddev);
++ if (!mddev)
+ break;
+- }
++
+ if (mddev_lock(mddev))
+ pr_warn("md: %s locked, cannot run\n", mdname(mddev));
+ else if (mddev->raid_disks || mddev->major_version
+@@ -7461,8 +7481,7 @@ static int md_open(struct block_device *bdev, fmode_t mode)
+ /* Wait until bdev->bd_disk is definitely gone */
+ if (work_pending(&mddev->del_work))
+ flush_workqueue(md_misc_wq);
+- /* Then retry the open from the top */
+- return -ERESTARTSYS;
++ return -EBUSY;
+ }
+ BUG_ON(mddev != bdev->bd_disk->private_data);
+
+@@ -7795,7 +7814,11 @@ static void *md_seq_start(struct seq_file *seq, loff_t *pos)
+ loff_t l = *pos;
+ struct mddev *mddev;
+
+- if (l >= 0x10000)
++ if (l == 0x10000) {
++ ++*pos;
++ return (void *)2;
++ }
++ if (l > 0x10000)
+ return NULL;
+ if (!l--)
+ /* header */
+@@ -8883,11 +8906,11 @@ void md_check_recovery(struct mddev *mddev)
+ }
+
+ if (mddev_is_clustered(mddev)) {
+- struct md_rdev *rdev;
++ struct md_rdev *rdev, *tmp;
+ /* kick the device if another node issued a
+ * remove disk.
+ */
+- rdev_for_each(rdev, mddev) {
++ rdev_for_each_safe(rdev, tmp, mddev) {
+ if (test_and_clear_bit(ClusterRemove, &rdev->flags) &&
+ rdev->raid_disk < 0)
+ md_kick_rdev_from_array(rdev);
+@@ -9187,7 +9210,7 @@ err_wq:
+ static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)
+ {
+ struct mdp_superblock_1 *sb = page_address(rdev->sb_page);
+- struct md_rdev *rdev2;
++ struct md_rdev *rdev2, *tmp;
+ int role, ret;
+ char b[BDEVNAME_SIZE];
+
+@@ -9204,7 +9227,7 @@ static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)
+ }
+
+ /* Check for change of roles in the active devices */
+- rdev_for_each(rdev2, mddev) {
++ rdev_for_each_safe(rdev2, tmp, mddev) {
+ if (test_bit(Faulty, &rdev2->flags))
+ continue;
+
+diff --git a/drivers/md/persistent-data/dm-btree-internal.h b/drivers/md/persistent-data/dm-btree-internal.h
+index a240990a7f333..5673f8eb5f88f 100644
+--- a/drivers/md/persistent-data/dm-btree-internal.h
++++ b/drivers/md/persistent-data/dm-btree-internal.h
+@@ -34,12 +34,12 @@ struct node_header {
+ __le32 max_entries;
+ __le32 value_size;
+ __le32 padding;
+-} __packed;
++} __attribute__((packed, aligned(8)));
+
+ struct btree_node {
+ struct node_header header;
+ __le64 keys[0];
+-} __packed;
++} __attribute__((packed, aligned(8)));
+
+
+ /*
+diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c
+index 17aef55ed708a..a284762e548e1 100644
+--- a/drivers/md/persistent-data/dm-space-map-common.c
++++ b/drivers/md/persistent-data/dm-space-map-common.c
+@@ -337,6 +337,8 @@ int sm_ll_find_free_block(struct ll_disk *ll, dm_block_t begin,
+ */
+ begin = do_div(index_begin, ll->entries_per_block);
+ end = do_div(end, ll->entries_per_block);
++ if (end == 0)
++ end = ll->entries_per_block;
+
+ for (i = index_begin; i < index_end; i++, begin = 0) {
+ struct dm_block *blk;
+diff --git a/drivers/md/persistent-data/dm-space-map-common.h b/drivers/md/persistent-data/dm-space-map-common.h
+index 8de63ce39bdd5..87e17909ef521 100644
+--- a/drivers/md/persistent-data/dm-space-map-common.h
++++ b/drivers/md/persistent-data/dm-space-map-common.h
+@@ -33,7 +33,7 @@ struct disk_index_entry {
+ __le64 blocknr;
+ __le32 nr_free;
+ __le32 none_free_before;
+-} __packed;
++} __attribute__ ((packed, aligned(8)));
+
+
+ #define MAX_METADATA_BITMAPS 255
+@@ -43,7 +43,7 @@ struct disk_metadata_index {
+ __le64 blocknr;
+
+ struct disk_index_entry index[MAX_METADATA_BITMAPS];
+-} __packed;
++} __attribute__ ((packed, aligned(8)));
+
+ struct ll_disk;
+
+@@ -86,7 +86,7 @@ struct disk_sm_root {
+ __le64 nr_allocated;
+ __le64 bitmap_root;
+ __le64 ref_count_root;
+-} __packed;
++} __attribute__ ((packed, aligned(8)));
+
+ #define ENTRIES_PER_BYTE 4
+
+@@ -94,7 +94,7 @@ struct disk_bitmap_header {
+ __le32 csum;
+ __le32 not_used;
+ __le64 blocknr;
+-} __packed;
++} __attribute__ ((packed, aligned(8)));
+
+ enum allocation_event {
+ SM_NONE,
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index abcb4c3a76c18..876d3e1339d17 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -445,6 +445,8 @@ static void raid1_end_write_request(struct bio *bio)
+ if (!test_bit(Faulty, &rdev->flags))
+ set_bit(R1BIO_WriteError, &r1_bio->state);
+ else {
++ /* Fail the request */
++ set_bit(R1BIO_Degraded, &r1_bio->state);
+ /* Finished with this branch */
+ r1_bio->bios[mirror] = NULL;
+ to_put = bio;
+diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
+index 04dc2f4bc7aaf..d8f19a4d214aa 100644
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -241,6 +241,7 @@ static void dvb_media_device_free(struct dvb_device *dvbdev)
+
+ if (dvbdev->adapter->conn) {
+ media_device_unregister_entity(dvbdev->adapter->conn);
++ kfree(dvbdev->adapter->conn);
+ dvbdev->adapter->conn = NULL;
+ kfree(dvbdev->adapter->conn_pads);
+ dvbdev->adapter->conn_pads = NULL;
+diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c
+index 6869bb593a682..4052abeead502 100644
+--- a/drivers/media/i2c/adv7511-v4l2.c
++++ b/drivers/media/i2c/adv7511-v4l2.c
+@@ -1965,7 +1965,7 @@ static int adv7511_remove(struct i2c_client *client)
+
+ adv7511_set_isr(sd, false);
+ adv7511_init_setup(sd);
+- cancel_delayed_work(&state->edid_handler);
++ cancel_delayed_work_sync(&state->edid_handler);
+ i2c_unregister_device(state->i2c_edid);
+ if (state->i2c_cec)
+ i2c_unregister_device(state->i2c_cec);
+diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
+index a4b0a89c7e7e6..04577d409e63c 100644
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -3560,7 +3560,7 @@ static int adv76xx_remove(struct i2c_client *client)
+ io_write(sd, 0x6e, 0);
+ io_write(sd, 0x73, 0);
+
+- cancel_delayed_work(&state->delayed_work_enable_hotplug);
++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug);
+ v4l2_async_unregister_subdev(sd);
+ media_entity_cleanup(&sd->entity);
+ adv76xx_unregister_clients(to_state(sd));
+diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
+index 58662ba92d4f8..d0ed20652ddb2 100644
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -3585,7 +3585,7 @@ static int adv7842_remove(struct i2c_client *client)
+ struct adv7842_state *state = to_state(sd);
+
+ adv7842_irq_enable(sd, false);
+- cancel_delayed_work(&state->delayed_work_enable_hotplug);
++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug);
+ v4l2_device_unregister_subdev(sd);
+ media_entity_cleanup(&sd->entity);
+ adv7842_unregister_clients(sd);
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index d9bc3851bf63b..041b16965b967 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -2192,7 +2192,7 @@ static int tc358743_remove(struct i2c_client *client)
+ del_timer_sync(&state->timer);
+ flush_work(&state->work_i2c_poll);
+ }
+- cancel_delayed_work(&state->delayed_work_enable_hotplug);
++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug);
+ cec_unregister_adapter(state->cec_adap);
+ v4l2_async_unregister_subdev(sd);
+ v4l2_device_unregister_subdev(sd);
+diff --git a/drivers/media/pci/saa7164/saa7164-encoder.c b/drivers/media/pci/saa7164/saa7164-encoder.c
+index 32136ebe4f61c..962f8eb73b053 100644
+--- a/drivers/media/pci/saa7164/saa7164-encoder.c
++++ b/drivers/media/pci/saa7164/saa7164-encoder.c
+@@ -1024,7 +1024,7 @@ int saa7164_encoder_register(struct saa7164_port *port)
+ printk(KERN_ERR "%s() failed (errno = %d), NO PCI configuration\n",
+ __func__, result);
+ result = -ENOMEM;
+- goto failed;
++ goto fail_pci;
+ }
+
+ /* Establish encoder defaults here */
+@@ -1078,7 +1078,7 @@ int saa7164_encoder_register(struct saa7164_port *port)
+ 100000, ENCODER_DEF_BITRATE);
+ if (hdl->error) {
+ result = hdl->error;
+- goto failed;
++ goto fail_hdl;
+ }
+
+ port->std = V4L2_STD_NTSC_M;
+@@ -1096,7 +1096,7 @@ int saa7164_encoder_register(struct saa7164_port *port)
+ printk(KERN_INFO "%s: can't allocate mpeg device\n",
+ dev->name);
+ result = -ENOMEM;
+- goto failed;
++ goto fail_hdl;
+ }
+
+ port->v4l_device->ctrl_handler = hdl;
+@@ -1107,10 +1107,7 @@ int saa7164_encoder_register(struct saa7164_port *port)
+ if (result < 0) {
+ printk(KERN_INFO "%s: can't register mpeg device\n",
+ dev->name);
+- /* TODO: We're going to leak here if we don't dealloc
+- The buffers above. The unreg function can't deal wit it.
+- */
+- goto failed;
++ goto fail_reg;
+ }
+
+ printk(KERN_INFO "%s: registered device video%d [mpeg]\n",
+@@ -1132,9 +1129,14 @@ int saa7164_encoder_register(struct saa7164_port *port)
+
+ saa7164_api_set_encoder(port);
+ saa7164_api_get_encoder(port);
++ return 0;
+
+- result = 0;
+-failed:
++fail_reg:
++ video_device_release(port->v4l_device);
++ port->v4l_device = NULL;
++fail_hdl:
++ v4l2_ctrl_handler_free(hdl);
++fail_pci:
+ return result;
+ }
+
+diff --git a/drivers/media/pci/sta2x11/Kconfig b/drivers/media/pci/sta2x11/Kconfig
+index 4407b9f881e40..bd690613fe68d 100644
+--- a/drivers/media/pci/sta2x11/Kconfig
++++ b/drivers/media/pci/sta2x11/Kconfig
+@@ -1,6 +1,7 @@
+ config STA2X11_VIP
+ tristate "STA2X11 VIP Video For Linux"
+ depends on STA2X11 || COMPILE_TEST
++ select GPIOLIB if MEDIA_SUBDRV_AUTOSELECT
+ select VIDEO_ADV7180 if MEDIA_SUBDRV_AUTOSELECT
+ select VIDEOBUF2_DMA_CONTIG
+ depends on PCI && VIDEO_V4L2 && VIRT_TO_BUS
+diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
+index 31db363602e53..b603ca412387b 100644
+--- a/drivers/media/platform/vivid/vivid-core.c
++++ b/drivers/media/platform/vivid/vivid-core.c
+@@ -174,13 +174,13 @@ static const u8 vivid_hdmi_edid[256] = {
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x7b,
+
+- 0x02, 0x03, 0x3f, 0xf0, 0x51, 0x61, 0x60, 0x5f,
++ 0x02, 0x03, 0x3f, 0xf1, 0x51, 0x61, 0x60, 0x5f,
+ 0x5e, 0x5d, 0x10, 0x1f, 0x04, 0x13, 0x22, 0x21,
+ 0x20, 0x05, 0x14, 0x02, 0x11, 0x01, 0x23, 0x09,
+ 0x07, 0x07, 0x83, 0x01, 0x00, 0x00, 0x6d, 0x03,
+ 0x0c, 0x00, 0x10, 0x00, 0x00, 0x3c, 0x21, 0x00,
+ 0x60, 0x01, 0x02, 0x03, 0x67, 0xd8, 0x5d, 0xc4,
+- 0x01, 0x78, 0x00, 0x00, 0xe2, 0x00, 0xea, 0xe3,
++ 0x01, 0x78, 0x00, 0x00, 0xe2, 0x00, 0xca, 0xe3,
+ 0x05, 0x00, 0x00, 0xe3, 0x06, 0x01, 0x00, 0x4d,
+ 0xd0, 0x00, 0xa0, 0xf0, 0x70, 0x3e, 0x80, 0x30,
+ 0x20, 0x35, 0x00, 0xc0, 0x1c, 0x32, 0x00, 0x00,
+@@ -189,7 +189,7 @@ static const u8 vivid_hdmi_edid[256] = {
+ 0x00, 0x00, 0x1a, 0x1a, 0x1d, 0x00, 0x80, 0x51,
+ 0xd0, 0x1c, 0x20, 0x40, 0x80, 0x35, 0x00, 0xc0,
+ 0x1c, 0x32, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00,
+- 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x63,
++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x82,
+ };
+
+ static int vidioc_querycap(struct file *file, void *priv,
+diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
+index 0f909500a0b80..ecd9e36ef3f63 100644
+--- a/drivers/media/platform/vivid/vivid-vid-out.c
++++ b/drivers/media/platform/vivid/vivid-vid-out.c
+@@ -998,7 +998,7 @@ int vivid_vid_out_s_fbuf(struct file *file, void *fh,
+ return -EINVAL;
+ }
+ dev->fbuf_out_flags &= ~(chroma_flags | alpha_flags);
+- dev->fbuf_out_flags = a->flags & (chroma_flags | alpha_flags);
++ dev->fbuf_out_flags |= a->flags & (chroma_flags | alpha_flags);
+ return 0;
+ }
+
+diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
+index de77d22c30a70..18f3718315a83 100644
+--- a/drivers/media/rc/ite-cir.c
++++ b/drivers/media/rc/ite-cir.c
+@@ -285,8 +285,14 @@ static irqreturn_t ite_cir_isr(int irq, void *data)
+ /* read the interrupt flags */
+ iflags = dev->params.get_irq_causes(dev);
+
++ /* Check for RX overflow */
++ if (iflags & ITE_IRQ_RX_FIFO_OVERRUN) {
++ dev_warn(&dev->rdev->dev, "receive overflow\n");
++ ir_raw_event_reset(dev->rdev);
++ }
++
+ /* check for the receive interrupt */
+- if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) {
++ if (iflags & ITE_IRQ_RX_FIFO) {
+ /* read the FIFO bytes */
+ rx_bytes =
+ dev->params.get_rx_bytes(dev, rx_buf,
+diff --git a/drivers/media/tuners/m88rs6000t.c b/drivers/media/tuners/m88rs6000t.c
+index 3df2f23a40beb..3fe13de487771 100644
+--- a/drivers/media/tuners/m88rs6000t.c
++++ b/drivers/media/tuners/m88rs6000t.c
+@@ -534,7 +534,7 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength)
+ PGA2_cri = PGA2_GC >> 2;
+ PGA2_crf = PGA2_GC & 0x03;
+
+- for (i = 0; i <= RF_GC; i++)
++ for (i = 0; i <= RF_GC && i < ARRAY_SIZE(RFGS); i++)
+ RFG += RFGS[i];
+
+ if (RF_GC == 0)
+@@ -546,12 +546,12 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength)
+ if (RF_GC == 3)
+ RFG += 100;
+
+- for (i = 0; i <= IF_GC; i++)
++ for (i = 0; i <= IF_GC && i < ARRAY_SIZE(IFGS); i++)
+ IFG += IFGS[i];
+
+ TIAG = TIA_GC * TIA_GS;
+
+- for (i = 0; i <= BB_GC; i++)
++ for (i = 0; i <= BB_GC && i < ARRAY_SIZE(BBGS); i++)
+ BBG += BBGS[i];
+
+ PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS;
+diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
+index 39ac22486bcd9..4b1445d806e5b 100644
+--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
+@@ -82,11 +82,17 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs)
+ }
+ }
+
+- if ((ret = dvb_usb_adapter_stream_init(adap)) ||
+- (ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) ||
+- (ret = dvb_usb_adapter_frontend_init(adap))) {
++ ret = dvb_usb_adapter_stream_init(adap);
++ if (ret)
+ return ret;
+- }
++
++ ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs);
++ if (ret)
++ goto dvb_init_err;
++
++ ret = dvb_usb_adapter_frontend_init(adap);
++ if (ret)
++ goto frontend_init_err;
+
+ /* use exclusive FE lock if there is multiple shared FEs */
+ if (adap->fe_adap[1].fe)
+@@ -106,6 +112,12 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs)
+ }
+
+ return 0;
++
++frontend_init_err:
++ dvb_usb_adapter_dvb_exit(adap);
++dvb_init_err:
++ dvb_usb_adapter_stream_exit(adap);
++ return ret;
+ }
+
+ static int dvb_usb_adapter_exit(struct dvb_usb_device *d)
+diff --git a/drivers/media/usb/dvb-usb/dvb-usb.h b/drivers/media/usb/dvb-usb/dvb-usb.h
+index 317ed6a82d194..89702eef66aa0 100644
+--- a/drivers/media/usb/dvb-usb/dvb-usb.h
++++ b/drivers/media/usb/dvb-usb/dvb-usb.h
+@@ -475,7 +475,7 @@ extern int __must_check
+ dvb_usb_generic_write(struct dvb_usb_device *, u8 *, u16);
+
+ /* commonly used remote control parsing */
+-extern int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *, u8[], u32 *, int *);
++extern int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *, u8[5], u32 *, int *);
+
+ /* commonly used firmware download types and function */
+ struct hexline {
+diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c
+index a73faf12f7e47..e1946237ac8cd 100644
+--- a/drivers/media/usb/em28xx/em28xx-dvb.c
++++ b/drivers/media/usb/em28xx/em28xx-dvb.c
+@@ -1924,6 +1924,7 @@ ret:
+ return result;
+
+ out_free:
++ em28xx_uninit_usb_xfer(dev, EM28XX_DIGITAL_MODE);
+ kfree(dvb);
+ dev->dvb = NULL;
+ goto ret;
+diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
+index 93212ed80bf85..f0562b8eef562 100644
+--- a/drivers/media/usb/gspca/gspca.c
++++ b/drivers/media/usb/gspca/gspca.c
+@@ -1586,6 +1586,8 @@ out:
+ #endif
+ v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+ v4l2_device_unregister(&gspca_dev->v4l2_dev);
++ if (sd_desc->probe_error)
++ sd_desc->probe_error(gspca_dev);
+ kfree(gspca_dev->usb_buf);
+ kfree(gspca_dev);
+ return ret;
+diff --git a/drivers/media/usb/gspca/gspca.h b/drivers/media/usb/gspca/gspca.h
+index b0ced2e140064..a6554d5e9e1a5 100644
+--- a/drivers/media/usb/gspca/gspca.h
++++ b/drivers/media/usb/gspca/gspca.h
+@@ -105,6 +105,7 @@ struct sd_desc {
+ cam_cf_op config; /* called on probe */
+ cam_op init; /* called on probe and resume */
+ cam_op init_controls; /* called on probe */
++ cam_v_op probe_error; /* called if probe failed, do cleanup here */
+ cam_op start; /* called on stream on after URBs creation */
+ cam_pkt_op pkt_scan;
+ /* optional operations */
+diff --git a/drivers/media/usb/gspca/sq905.c b/drivers/media/usb/gspca/sq905.c
+index ffea9c35b0a06..13676af42cfc7 100644
+--- a/drivers/media/usb/gspca/sq905.c
++++ b/drivers/media/usb/gspca/sq905.c
+@@ -167,7 +167,7 @@ static int
+ sq905_read_data(struct gspca_dev *gspca_dev, u8 *data, int size, int need_lock)
+ {
+ int ret;
+- int act_len;
++ int act_len = 0;
+
+ gspca_dev->usb_buf[0] = '\0';
+ if (need_lock)
+diff --git a/drivers/media/usb/gspca/stv06xx/stv06xx.c b/drivers/media/usb/gspca/stv06xx/stv06xx.c
+index b7ea4f9829648..ccec6138f6789 100644
+--- a/drivers/media/usb/gspca/stv06xx/stv06xx.c
++++ b/drivers/media/usb/gspca/stv06xx/stv06xx.c
+@@ -538,12 +538,21 @@ static int sd_int_pkt_scan(struct gspca_dev *gspca_dev,
+ static int stv06xx_config(struct gspca_dev *gspca_dev,
+ const struct usb_device_id *id);
+
++static void stv06xx_probe_error(struct gspca_dev *gspca_dev)
++{
++ struct sd *sd = (struct sd *)gspca_dev;
++
++ kfree(sd->sensor_priv);
++ sd->sensor_priv = NULL;
++}
++
+ /* sub-driver description */
+ static const struct sd_desc sd_desc = {
+ .name = MODULE_NAME,
+ .config = stv06xx_config,
+ .init = stv06xx_init,
+ .init_controls = stv06xx_init_controls,
++ .probe_error = stv06xx_probe_error,
+ .start = stv06xx_start,
+ .stopN = stv06xx_stopN,
+ .pkt_scan = stv06xx_pkt_scan,
+diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
+index 2ca507f3a58c3..d8f2cacea750d 100644
+--- a/drivers/memory/omap-gpmc.c
++++ b/drivers/memory/omap-gpmc.c
+@@ -1028,8 +1028,8 @@ EXPORT_SYMBOL(gpmc_cs_request);
+
+ void gpmc_cs_free(int cs)
+ {
+- struct gpmc_cs_data *gpmc = &gpmc_cs[cs];
+- struct resource *res = &gpmc->mem;
++ struct gpmc_cs_data *gpmc;
++ struct resource *res;
+
+ spin_lock(&gpmc_mem_lock);
+ if (cs >= gpmc_cs_num || cs < 0 || !gpmc_cs_reserved(cs)) {
+@@ -1038,6 +1038,9 @@ void gpmc_cs_free(int cs)
+ spin_unlock(&gpmc_mem_lock);
+ return;
+ }
++ gpmc = &gpmc_cs[cs];
++ res = &gpmc->mem;
++
+ gpmc_cs_disable_mem(cs);
+ if (res->flags)
+ release_resource(res);
+diff --git a/drivers/mfd/stm32-timers.c b/drivers/mfd/stm32-timers.c
+index efcd4b980c94c..1adba6a46dcb1 100644
+--- a/drivers/mfd/stm32-timers.c
++++ b/drivers/mfd/stm32-timers.c
+@@ -158,13 +158,18 @@ static const struct regmap_config stm32_timers_regmap_cfg = {
+
+ static void stm32_timers_get_arr_size(struct stm32_timers *ddata)
+ {
++ u32 arr;
++
++ /* Backup ARR to restore it after getting the maximum value */
++ regmap_read(ddata->regmap, TIM_ARR, &arr);
++
+ /*
+ * Only the available bits will be written so when readback
+ * we get the maximum value of auto reload register
+ */
+ regmap_write(ddata->regmap, TIM_ARR, ~0L);
+ regmap_read(ddata->regmap, TIM_ARR, &ddata->max_arr);
+- regmap_write(ddata->regmap, TIM_ARR, 0x0);
++ regmap_write(ddata->regmap, TIM_ARR, arr);
+ }
+
+ static void stm32_timers_dma_probe(struct device *dev,
+diff --git a/drivers/misc/aspeed-lpc-snoop.c b/drivers/misc/aspeed-lpc-snoop.c
+index b4a776bf44bc5..e2cb0b9607d11 100644
+--- a/drivers/misc/aspeed-lpc-snoop.c
++++ b/drivers/misc/aspeed-lpc-snoop.c
+@@ -99,8 +99,10 @@ static ssize_t snoop_file_read(struct file *file, char __user *buffer,
+ return -EINTR;
+ }
+ ret = kfifo_to_user(&chan->fifo, buffer, count, &copied);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static __poll_t snoop_file_poll(struct file *file,
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index 8b01257783dd8..f2cfc96194250 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -107,19 +107,19 @@
+
+ #include <asm/sections.h>
+
+-#define v1printk(a...) do { \
+- if (verbose) \
+- printk(KERN_INFO a); \
+- } while (0)
+-#define v2printk(a...) do { \
+- if (verbose > 1) \
+- printk(KERN_INFO a); \
+- touch_nmi_watchdog(); \
+- } while (0)
+-#define eprintk(a...) do { \
+- printk(KERN_ERR a); \
+- WARN_ON(1); \
+- } while (0)
++#define v1printk(a...) do { \
++ if (verbose) \
++ printk(KERN_INFO a); \
++} while (0)
++#define v2printk(a...) do { \
++ if (verbose > 1) \
++ printk(KERN_INFO a); \
++ touch_nmi_watchdog(); \
++} while (0)
++#define eprintk(a...) do { \
++ printk(KERN_ERR a); \
++ WARN_ON(1); \
++} while (0)
+ #define MAX_CONFIG_LEN 40
+
+ static struct kgdb_io kgdbts_io_ops;
+diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
+index e9bb1cfa6a7a2..21ac34b383950 100644
+--- a/drivers/misc/lis3lv02d/lis3lv02d.c
++++ b/drivers/misc/lis3lv02d/lis3lv02d.c
+@@ -221,7 +221,7 @@ static int lis3_3dc_rates[16] = {0, 1, 10, 25, 50, 100, 200, 400, 1600, 5000};
+ static int lis3_3dlh_rates[4] = {50, 100, 400, 1000};
+
+ /* ODR is Output Data Rate */
+-static int lis3lv02d_get_odr(struct lis3lv02d *lis3)
++static int lis3lv02d_get_odr_index(struct lis3lv02d *lis3)
+ {
+ u8 ctrl;
+ int shift;
+@@ -229,15 +229,23 @@ static int lis3lv02d_get_odr(struct lis3lv02d *lis3)
+ lis3->read(lis3, CTRL_REG1, &ctrl);
+ ctrl &= lis3->odr_mask;
+ shift = ffs(lis3->odr_mask) - 1;
+- return lis3->odrs[(ctrl >> shift)];
++ return (ctrl >> shift);
+ }
+
+ static int lis3lv02d_get_pwron_wait(struct lis3lv02d *lis3)
+ {
+- int div = lis3lv02d_get_odr(lis3);
++ int odr_idx = lis3lv02d_get_odr_index(lis3);
++ int div = lis3->odrs[odr_idx];
+
+- if (WARN_ONCE(div == 0, "device returned spurious data"))
++ if (div == 0) {
++ if (odr_idx == 0) {
++ /* Power-down mode, not sampling no need to sleep */
++ return 0;
++ }
++
++ dev_err(&lis3->pdev->dev, "Error unknown odrs-index: %d\n", odr_idx);
+ return -ENXIO;
++ }
+
+ /* LIS3 power on delay is quite long */
+ msleep(lis3->pwron_delay / div);
+@@ -820,9 +828,12 @@ static ssize_t lis3lv02d_rate_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ struct lis3lv02d *lis3 = dev_get_drvdata(dev);
++ int odr_idx;
+
+ lis3lv02d_sysfs_poweron(lis3);
+- return sprintf(buf, "%d\n", lis3lv02d_get_odr(lis3));
++
++ odr_idx = lis3lv02d_get_odr_index(lis3);
++ return sprintf(buf, "%d\n", lis3->odrs[odr_idx]);
+ }
+
+ static ssize_t lis3lv02d_rate_set(struct device *dev,
+diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c
+index f005206d9033b..4581210349d29 100644
+--- a/drivers/misc/vmw_vmci/vmci_doorbell.c
++++ b/drivers/misc/vmw_vmci/vmci_doorbell.c
+@@ -334,7 +334,7 @@ int vmci_dbell_host_context_notify(u32 src_cid, struct vmci_handle handle)
+ bool vmci_dbell_register_notification_bitmap(u32 bitmap_ppn)
+ {
+ int result;
+- struct vmci_notify_bm_set_msg bitmap_set_msg;
++ struct vmci_notify_bm_set_msg bitmap_set_msg = { };
+
+ bitmap_set_msg.hdr.dst = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID,
+ VMCI_SET_NOTIFY_BITMAP);
+diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c
+index dad5abee656ef..dd20ea4ad0c47 100644
+--- a/drivers/misc/vmw_vmci/vmci_guest.c
++++ b/drivers/misc/vmw_vmci/vmci_guest.c
+@@ -169,7 +169,7 @@ static int vmci_check_host_caps(struct pci_dev *pdev)
+ VMCI_UTIL_NUM_RESOURCES * sizeof(u32);
+ struct vmci_datagram *check_msg;
+
+- check_msg = kmalloc(msg_size, GFP_KERNEL);
++ check_msg = kzalloc(msg_size, GFP_KERNEL);
+ if (!check_msg) {
+ dev_err(&pdev->dev, "%s: Insufficient memory\n", __func__);
+ return -ENOMEM;
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 77324ea4eb93e..c2c45c148ae76 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -622,6 +622,18 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ main_md->part_curr = value & EXT_CSD_PART_CONFIG_ACC_MASK;
+ }
+
++ /*
++ * Make sure to update CACHE_CTRL in case it was changed. The cache
++ * will get turned back on if the card is re-initialized, e.g.
++ * suspend/resume or hw reset in recovery.
++ */
++ if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_CACHE_CTRL) &&
++ (cmd.opcode == MMC_SWITCH)) {
++ u8 value = MMC_EXTRACT_VALUE_FROM_ARG(cmd.arg) & 1;
++
++ card->ext_csd.cache_ctrl = value;
++ }
++
+ /*
+ * According to the SD specs, some commands require a delay after
+ * issuing the command.
+@@ -2224,6 +2236,10 @@ enum mmc_issued mmc_blk_mq_issue_rq(struct mmc_queue *mq, struct request *req)
+ case MMC_ISSUE_ASYNC:
+ switch (req_op(req)) {
+ case REQ_OP_FLUSH:
++ if (!mmc_cache_enabled(host)) {
++ blk_mq_end_request(req, BLK_STS_OK);
++ return MMC_REQ_FINISHED;
++ }
+ ret = mmc_blk_cqe_issue_flush(mq, req);
+ break;
+ case REQ_OP_READ:
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 56f7f3600469a..798bcb65b4df4 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1537,7 +1537,7 @@ int mmc_set_uhs_voltage(struct mmc_host *host, u32 ocr)
+
+ err = mmc_wait_for_cmd(host, &cmd, 0);
+ if (err)
+- return err;
++ goto power_cycle;
+
+ if (!mmc_host_is_spi(host) && (cmd.resp[0] & R1_ERROR))
+ return -EIO;
+diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h
+index 087ba68b29209..3071b644e94a6 100644
+--- a/drivers/mmc/core/core.h
++++ b/drivers/mmc/core/core.h
+@@ -32,6 +32,7 @@ struct mmc_bus_ops {
+ int (*shutdown)(struct mmc_host *);
+ int (*hw_reset)(struct mmc_host *);
+ int (*sw_reset)(struct mmc_host *);
++ bool (*cache_enabled)(struct mmc_host *);
+ };
+
+ void mmc_attach_bus(struct mmc_host *host, const struct mmc_bus_ops *ops);
+@@ -173,4 +174,12 @@ static inline void mmc_post_req(struct mmc_host *host, struct mmc_request *mrq,
+ host->ops->post_req(host, mrq, err);
+ }
+
++static inline bool mmc_cache_enabled(struct mmc_host *host)
++{
++ if (host->bus_ops->cache_enabled)
++ return host->bus_ops->cache_enabled(host);
++
++ return false;
++}
++
+ #endif
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index 1b5139a906b83..d9202f2726d1a 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -2009,6 +2009,12 @@ static void mmc_detect(struct mmc_host *host)
+ }
+ }
+
++static bool _mmc_cache_enabled(struct mmc_host *host)
++{
++ return host->card->ext_csd.cache_size > 0 &&
++ host->card->ext_csd.cache_ctrl & 1;
++}
++
+ static int _mmc_suspend(struct mmc_host *host, bool is_suspend)
+ {
+ int err = 0;
+@@ -2193,6 +2199,7 @@ static const struct mmc_bus_ops mmc_ops = {
+ .alive = mmc_alive,
+ .shutdown = mmc_shutdown,
+ .hw_reset = _mmc_hw_reset,
++ .cache_enabled = _mmc_cache_enabled,
+ };
+
+ /*
+diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
+index 693b99eff74b5..334678707deb7 100644
+--- a/drivers/mmc/core/mmc_ops.c
++++ b/drivers/mmc/core/mmc_ops.c
+@@ -1014,9 +1014,7 @@ int mmc_flush_cache(struct mmc_card *card)
+ {
+ int err = 0;
+
+- if (mmc_card_mmc(card) &&
+- (card->ext_csd.cache_size > 0) &&
+- (card->ext_csd.cache_ctrl & 1)) {
++ if (mmc_cache_enabled(card->host)) {
+ err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+ EXT_CSD_FLUSH_CACHE, 1, 0);
+ if (err)
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index 04738359ec029..aa3de584b90cd 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -138,6 +138,9 @@ static int mmc_decode_csd(struct mmc_card *card)
+ csd->erase_size = UNSTUFF_BITS(resp, 39, 7) + 1;
+ csd->erase_size <<= csd->write_blkbits - 9;
+ }
++
++ if (UNSTUFF_BITS(resp, 13, 1))
++ mmc_card_set_readonly(card);
+ break;
+ case 1:
+ /*
+@@ -172,6 +175,9 @@ static int mmc_decode_csd(struct mmc_card *card)
+ csd->write_blkbits = 9;
+ csd->write_partial = 0;
+ csd->erase_size = 1;
++
++ if (UNSTUFF_BITS(resp, 13, 1))
++ mmc_card_set_readonly(card);
+ break;
+ default:
+ pr_err("%s: unrecognised CSD structure version %d\n",
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index a411300f9d6dc..cb4a0458f098c 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -465,6 +465,7 @@ struct intel_host {
+ int drv_strength;
+ bool d3_retune;
+ bool rpm_retune_ok;
++ bool needs_pwr_off;
+ u32 glk_rx_ctrl1;
+ u32 glk_tun_val;
+ };
+@@ -590,9 +591,25 @@ out:
+ static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode,
+ unsigned short vdd)
+ {
++ struct sdhci_pci_slot *slot = sdhci_priv(host);
++ struct intel_host *intel_host = sdhci_pci_priv(slot);
+ int cntr;
+ u8 reg;
+
++ /*
++ * Bus power may control card power, but a full reset still may not
++ * reset the power, whereas a direct write to SDHCI_POWER_CONTROL can.
++ * That might be needed to initialize correctly, if the card was left
++ * powered on previously.
++ */
++ if (intel_host->needs_pwr_off) {
++ intel_host->needs_pwr_off = false;
++ if (mode != MMC_POWER_OFF) {
++ sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
++ usleep_range(10000, 12500);
++ }
++ }
++
+ sdhci_set_power(host, mode, vdd);
+
+ if (mode == MMC_POWER_OFF)
+@@ -926,6 +943,14 @@ static int byt_sdio_probe_slot(struct sdhci_pci_slot *slot)
+ return 0;
+ }
+
++static void byt_needs_pwr_off(struct sdhci_pci_slot *slot)
++{
++ struct intel_host *intel_host = sdhci_pci_priv(slot);
++ u8 reg = sdhci_readb(slot->host, SDHCI_POWER_CONTROL);
++
++ intel_host->needs_pwr_off = reg & SDHCI_POWER_ON;
++}
++
+ static int byt_sd_probe_slot(struct sdhci_pci_slot *slot)
+ {
+ byt_probe_slot(slot);
+@@ -943,6 +968,8 @@ static int byt_sd_probe_slot(struct sdhci_pci_slot *slot)
+ slot->chip->pdev->subsystem_device == PCI_SUBDEVICE_ID_NI_78E3)
+ slot->host->mmc->caps2 |= MMC_CAP2_AVOID_3_3V;
+
++ byt_needs_pwr_off(slot);
++
+ return 0;
+ }
+
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index 5afc653c09e20..82d38001d5175 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -663,16 +663,12 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ case MEMGETINFO:
+ case MEMREADOOB:
+ case MEMREADOOB64:
+- case MEMLOCK:
+- case MEMUNLOCK:
+ case MEMISLOCKED:
+ case MEMGETOOBSEL:
+ case MEMGETBADBLOCK:
+- case MEMSETBADBLOCK:
+ case OTPSELECT:
+ case OTPGETREGIONCOUNT:
+ case OTPGETREGIONINFO:
+- case OTPLOCK:
+ case ECCGETLAYOUT:
+ case ECCGETSTATS:
+ case MTDFILEMODE:
+@@ -683,9 +679,13 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ /* "dangerous" commands */
+ case MEMERASE:
+ case MEMERASE64:
++ case MEMLOCK:
++ case MEMUNLOCK:
++ case MEMSETBADBLOCK:
+ case MEMWRITEOOB:
+ case MEMWRITEOOB64:
+ case MEMWRITE:
++ case OTPLOCK:
+ if (!(file->f_mode & FMODE_WRITE))
+ return -EPERM;
+ break;
+diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
+index 97ac219c082e7..a0b1a7814e2e7 100644
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -712,6 +712,9 @@ int mtd_device_parse_register(struct mtd_info *mtd, const char * const *types,
+
+ /* Prefer parsed partitions over driver-provided fallback */
+ ret = parse_mtd_partitions(mtd, types, parser_data);
++ if (ret == -EPROBE_DEFER)
++ goto out;
++
+ if (ret > 0)
+ ret = 0;
+ else if (nr_parts)
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index ee1c401f131f4..7887629304872 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -826,10 +826,12 @@ static int atmel_nand_pmecc_correct_data(struct nand_chip *chip, void *buf,
+ NULL, 0,
+ chip->ecc.strength);
+
+- if (ret >= 0)
++ if (ret >= 0) {
++ mtd->ecc_stats.corrected += ret;
+ max_bitflips = max(ret, max_bitflips);
+- else
++ } else {
+ mtd->ecc_stats.failed++;
++ }
+
+ databuf += chip->ecc.size;
+ eccbuf += chip->ecc.bytes;
+diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+index aad8d107b85d2..774ffa9e23f38 100644
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -2239,6 +2239,12 @@ static int brcmnand_attach_chip(struct nand_chip *chip)
+
+ ret = brcmstb_choose_ecc_layout(host);
+
++ /* If OOB is written with ECC enabled it will cause ECC errors */
++ if (is_hamming_ecc(host->ctrl, &host->hwcfg)) {
++ chip->ecc.write_oob = brcmnand_write_oob_raw;
++ chip->ecc.read_oob = brcmnand_read_oob_raw;
++ }
++
+ return ret;
+ }
+
+diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c
+index 25d354e9448ec..a31bb1da44ec9 100644
+--- a/drivers/mtd/nand/raw/fsmc_nand.c
++++ b/drivers/mtd/nand/raw/fsmc_nand.c
+@@ -1099,11 +1099,13 @@ static int __init fsmc_nand_probe(struct platform_device *pdev)
+ host->read_dma_chan = dma_request_channel(mask, filter, NULL);
+ if (!host->read_dma_chan) {
+ dev_err(&pdev->dev, "Unable to get read dma channel\n");
++ ret = -ENODEV;
+ goto disable_clk;
+ }
+ host->write_dma_chan = dma_request_channel(mask, filter, NULL);
+ if (!host->write_dma_chan) {
+ dev_err(&pdev->dev, "Unable to get write dma channel\n");
++ ret = -ENODEV;
+ goto release_dma_read_chan;
+ }
+ }
+diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+index fe99d9323d4ac..6bd414bac34d1 100644
+--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+@@ -1931,7 +1931,7 @@ static int gpmi_nand_init(struct gpmi_nand_data *this)
+ this->bch_geometry.auxiliary_size = 128;
+ ret = gpmi_alloc_dma_buffer(this);
+ if (ret)
+- goto err_out;
++ return ret;
+
+ chip->dummy_controller.ops = &gpmi_nand_controller_ops;
+ ret = nand_scan(chip, GPMI_IS_MX6(this) ? 2 : 1);
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index 2726f18242333..148c7a16f3188 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -2865,7 +2865,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc)
+ struct device *dev = nandc->dev;
+ struct device_node *dn = dev->of_node, *child;
+ struct qcom_nand_host *host;
+- int ret;
++ int ret = -ENODEV;
+
+ for_each_available_child_of_node(dn, child) {
+ host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
+@@ -2883,10 +2883,7 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc)
+ list_add_tail(&host->node, &nandc->host_list);
+ }
+
+- if (list_empty(&nandc->host_list))
+- return -ENODEV;
+-
+- return 0;
++ return ret;
+ }
+
+ /* parse custom DT properties here */
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index 1d61ae7aaa66c..4a3dc5953b002 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -1129,12 +1129,14 @@ static const struct spi_device_id spinand_ids[] = {
+ { .name = "spi-nand" },
+ { /* sentinel */ },
+ };
++MODULE_DEVICE_TABLE(spi, spinand_ids);
+
+ #ifdef CONFIG_OF
+ static const struct of_device_id spinand_of_ids[] = {
+ { .compatible = "spi-nand" },
+ { /* sentinel */ },
+ };
++MODULE_DEVICE_TABLE(of, spinand_of_ids);
+ #endif
+
+ static struct spi_mem_driver spinand_drv = {
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 44ed2f6e2d96c..6033970fb667b 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -6851,7 +6851,9 @@ static ssize_t bnxt_show_temp(struct device *dev,
+ if (!rc)
+ len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */
+ mutex_unlock(&bp->hwrm_cmd_lock);
+- return rc ?: len;
++ if (rc)
++ return rc;
++ return len;
+ }
+ static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0);
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
+index e6d4ad99cc387..3f1c189646f4e 100644
+--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h
+@@ -521,7 +521,7 @@
+ #define CN23XX_BAR1_INDEX_OFFSET 3
+
+ #define CN23XX_PEM_BAR1_INDEX_REG(port, idx) \
+- (CN23XX_PEM_BAR1_INDEX_START + ((port) << CN23XX_PEM_OFFSET) + \
++ (CN23XX_PEM_BAR1_INDEX_START + (((u64)port) << CN23XX_PEM_OFFSET) + \
+ ((idx) << CN23XX_BAR1_INDEX_OFFSET))
+
+ /*############################ DPI #########################*/
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+index 9a4cfa61ed93a..d9bcbe469ab98 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+@@ -779,7 +779,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs,
+ mbx.rq.msg = NIC_MBOX_MSG_RQ_CFG;
+ mbx.rq.qs_num = qs->vnic_id;
+ mbx.rq.rq_num = qidx;
+- mbx.rq.cfg = (rq->caching << 26) | (rq->cq_qs << 19) |
++ mbx.rq.cfg = ((u64)rq->caching << 26) | (rq->cq_qs << 19) |
+ (rq->cq_idx << 16) | (rq->cont_rbdr_qs << 9) |
+ (rq->cont_qs_rbdr_idx << 8) |
+ (rq->start_rbdr_qs << 1) | (rq->start_qs_rbdr_idx);
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+index 4af6e6ffc5df2..3caf8bd1e00e7 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+@@ -2730,7 +2730,7 @@ do { \
+ seq_printf(seq, "%-12s", s); \
+ for (i = 0; i < n; ++i) \
+ seq_printf(seq, " %16" fmt_spec, v); \
+- seq_putc(seq, '\n'); \
++ seq_putc(seq, '\n'); \
+ } while (0)
+ #define S(s, v) S3("s", s, v)
+ #define T3(fmt_spec, s, v) S3(fmt_spec, s, tx[i].v)
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
+index 810cbe2210463..bfe0e820956ca 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -803,7 +803,7 @@ static inline int enic_queue_wq_skb_encap(struct enic *enic, struct vnic_wq *wq,
+ return err;
+ }
+
+-static inline void enic_queue_wq_skb(struct enic *enic,
++static inline int enic_queue_wq_skb(struct enic *enic,
+ struct vnic_wq *wq, struct sk_buff *skb)
+ {
+ unsigned int mss = skb_shinfo(skb)->gso_size;
+@@ -849,6 +849,7 @@ static inline void enic_queue_wq_skb(struct enic *enic,
+ wq->to_use = buf->next;
+ dev_kfree_skb(skb);
+ }
++ return err;
+ }
+
+ /* netif_tx_lock held, process context with BHs disabled, or BH */
+@@ -892,7 +893,8 @@ static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb,
+ return NETDEV_TX_BUSY;
+ }
+
+- enic_queue_wq_skb(enic, wq, skb);
++ if (enic_queue_wq_skb(enic, wq, skb))
++ goto error;
+
+ if (vnic_wq_desc_avail(wq) < MAX_SKB_FRAGS + ENIC_DESC_MAX_SPLITS)
+ netif_tx_stop_queue(txq);
+@@ -900,6 +902,7 @@ static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb,
+ if (!skb->xmit_more || netif_xmit_stopped(txq))
+ vnic_wq_doorbell(wq);
+
++error:
+ spin_unlock(&enic->wq_lock[txq_map]);
+
+ return NETDEV_TX_OK;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 3eb8b85f6afb6..3b89673f09daf 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -2639,7 +2639,6 @@ static void hns3_add_ring_to_group(struct hns3_enet_ring_group *group,
+
+ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ {
+- struct hnae3_ring_chain_node vector_ring_chain;
+ struct hnae3_handle *h = priv->ae_handle;
+ struct hns3_enet_tqp_vector *tqp_vector;
+ int ret = 0;
+@@ -2669,6 +2668,8 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ }
+
+ for (i = 0; i < priv->vector_num; i++) {
++ struct hnae3_ring_chain_node vector_ring_chain;
++
+ tqp_vector = &priv->tqp_vector[i];
+
+ tqp_vector->rx_group.total_bytes = 0;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
+index 03491e8ebb730..d0fa344f0a84f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
+@@ -235,6 +235,8 @@ void hclge_mac_start_phy(struct hclge_dev *hdev)
+ if (!phydev)
+ return;
+
++ phy_loopback(phydev, false);
++
+ phy_start(phydev);
+ }
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
+index 5f3b8b9ff511d..c1832a8487140 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
+@@ -377,6 +377,7 @@ void i40e_client_subtask(struct i40e_pf *pf)
+ clear_bit(__I40E_CLIENT_INSTANCE_OPENED,
+ &cdev->state);
+ i40e_client_del_instance(pf);
++ return;
+ }
+ }
+ }
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index b72a4fad7bc8f..59f3dce3ab1d9 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1041,7 +1041,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
+ skb->protocol = eth_type_trans(skb, netdev);
+
+ if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX &&
+- RX_DMA_VID(trxd.rxd3))
++ (trxd.rxd2 & RX_DMA_VTAG))
+ __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
+ RX_DMA_VID(trxd.rxd3));
+ skb_record_rx_queue(skb, 0);
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+index 46819297fc3ed..cb6b27861afa5 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -285,6 +285,7 @@
+ #define RX_DMA_DONE BIT(31)
+ #define RX_DMA_PLEN0(_x) (((_x) & 0x3fff) << 16)
+ #define RX_DMA_GET_PLEN0(_x) (((_x) >> 16) & 0x3fff)
++#define RX_DMA_VTAG BIT(15)
+
+ /* QDMA descriptor rxd3 */
+ #define RX_DMA_VID(_x) ((_x) & 0xfff)
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c
+index 336e5ecc68f86..f1874578aa141 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c
+@@ -524,6 +524,16 @@ mlxsw_sp_mr_route_evif_resolve(struct mlxsw_sp_mr_table *mr_table,
+ u16 erif_index = 0;
+ int err;
+
++ /* Add the eRIF */
++ if (mlxsw_sp_mr_vif_valid(rve->mr_vif)) {
++ erif_index = mlxsw_sp_rif_index(rve->mr_vif->rif);
++ err = mr->mr_ops->route_erif_add(mlxsw_sp,
++ rve->mr_route->route_priv,
++ erif_index);
++ if (err)
++ return err;
++ }
++
+ /* Update the route action, as the new eVIF can be a tunnel or a pimreg
+ * device which will require updating the action.
+ */
+@@ -533,17 +543,7 @@ mlxsw_sp_mr_route_evif_resolve(struct mlxsw_sp_mr_table *mr_table,
+ rve->mr_route->route_priv,
+ route_action);
+ if (err)
+- return err;
+- }
+-
+- /* Add the eRIF */
+- if (mlxsw_sp_mr_vif_valid(rve->mr_vif)) {
+- erif_index = mlxsw_sp_rif_index(rve->mr_vif->rif);
+- err = mr->mr_ops->route_erif_add(mlxsw_sp,
+- rve->mr_route->route_priv,
+- erif_index);
+- if (err)
+- goto err_route_erif_add;
++ goto err_route_action_update;
+ }
+
+ /* Update the minimum MTU */
+@@ -561,14 +561,14 @@ mlxsw_sp_mr_route_evif_resolve(struct mlxsw_sp_mr_table *mr_table,
+ return 0;
+
+ err_route_min_mtu_update:
+- if (mlxsw_sp_mr_vif_valid(rve->mr_vif))
+- mr->mr_ops->route_erif_del(mlxsw_sp, rve->mr_route->route_priv,
+- erif_index);
+-err_route_erif_add:
+ if (route_action != rve->mr_route->route_action)
+ mr->mr_ops->route_action_update(mlxsw_sp,
+ rve->mr_route->route_priv,
+ rve->mr_route->route_action);
++err_route_action_update:
++ if (mlxsw_sp_mr_vif_valid(rve->mr_vif))
++ mr->mr_ops->route_erif_del(mlxsw_sp, rve->mr_route->route_priv,
++ erif_index);
+ return err;
+ }
+
+diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+index 031f6e6ee9c17..351a906980103 100644
+--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
++++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+@@ -1449,6 +1449,7 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q,
+ {
+ struct emac_tpd tpd;
+ u32 prod_idx;
++ int len;
+
+ memset(&tpd, 0, sizeof(tpd));
+
+@@ -1468,9 +1469,10 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q,
+ if (skb_network_offset(skb) != ETH_HLEN)
+ TPD_TYP_SET(&tpd, 1);
+
++ len = skb->len;
+ emac_tx_fill_tpd(adpt, tx_q, skb, &tpd);
+
+- netdev_sent_queue(adpt->netdev, skb->len);
++ netdev_sent_queue(adpt->netdev, len);
+
+ /* Make sure the are enough free descriptors to hold one
+ * maximum-sized SKB. We need one desc for each fragment,
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+index 826626e870d5c..0f56f8e336917 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -351,6 +351,8 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
+ plat_dat->bsp_priv = gmac;
+ plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed;
+ plat_dat->multicast_filter_bins = 0;
++ plat_dat->tx_fifo_size = 8192;
++ plat_dat->rx_fifo_size = 8192;
+
+ err = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+ if (err)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+index 8c3780d1105fe..232efe17ac2c6 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+@@ -214,7 +214,7 @@ static void dwmac4_dma_rx_chan_op_mode(void __iomem *ioaddr, int mode,
+ u32 channel, int fifosz, u8 qmode)
+ {
+ unsigned int rqs = fifosz / 256 - 1;
+- u32 mtl_rx_op, mtl_rx_int;
++ u32 mtl_rx_op;
+
+ mtl_rx_op = readl(ioaddr + MTL_CHAN_RX_OP_MODE(channel));
+
+@@ -285,11 +285,6 @@ static void dwmac4_dma_rx_chan_op_mode(void __iomem *ioaddr, int mode,
+ }
+
+ writel(mtl_rx_op, ioaddr + MTL_CHAN_RX_OP_MODE(channel));
+-
+- /* Enable MTL RX overflow */
+- mtl_rx_int = readl(ioaddr + MTL_CHAN_INT_CTRL(channel));
+- writel(mtl_rx_int | MTL_RX_OVERFLOW_INT_EN,
+- ioaddr + MTL_CHAN_INT_CTRL(channel));
+ }
+
+ static void dwmac4_dma_tx_chan_op_mode(void __iomem *ioaddr, int mode,
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index a1443d7197e87..af59761ddfa07 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3706,7 +3706,6 @@ static irqreturn_t stmmac_interrupt(int irq, void *dev_id)
+ /* To handle GMAC own interrupts */
+ if ((priv->plat->has_gmac) || xmac) {
+ int status = stmmac_host_irq_status(priv, priv->hw, &priv->xstats);
+- int mtl_status;
+
+ if (unlikely(status)) {
+ /* For LPI we need to save the tx status */
+@@ -3717,17 +3716,8 @@ static irqreturn_t stmmac_interrupt(int irq, void *dev_id)
+ }
+
+ for (queue = 0; queue < queues_count; queue++) {
+- struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
+-
+- mtl_status = stmmac_host_mtl_irq_status(priv, priv->hw,
+- queue);
+- if (mtl_status != -EINVAL)
+- status |= mtl_status;
+-
+- if (status & CORE_IRQ_MTL_RX_OVERFLOW)
+- stmmac_set_rx_tail_ptr(priv, priv->ioaddr,
+- rx_q->rx_tail_addr,
+- queue);
++ status = stmmac_host_mtl_irq_status(priv, priv->hw,
++ queue);
+ }
+
+ /* PCS link status */
+diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
+index f270beebb4289..9bb84d83afc15 100644
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -183,11 +183,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1";
+ /* EMAC mac_status register */
+ #define EMAC_MACSTATUS_TXERRCODE_MASK (0xF00000)
+ #define EMAC_MACSTATUS_TXERRCODE_SHIFT (20)
+-#define EMAC_MACSTATUS_TXERRCH_MASK (0x7)
++#define EMAC_MACSTATUS_TXERRCH_MASK (0x70000)
+ #define EMAC_MACSTATUS_TXERRCH_SHIFT (16)
+ #define EMAC_MACSTATUS_RXERRCODE_MASK (0xF000)
+ #define EMAC_MACSTATUS_RXERRCODE_SHIFT (12)
+-#define EMAC_MACSTATUS_RXERRCH_MASK (0x7)
++#define EMAC_MACSTATUS_RXERRCH_MASK (0x700)
+ #define EMAC_MACSTATUS_RXERRCH_SHIFT (8)
+
+ /* EMAC RX register masks */
+diff --git a/drivers/net/fddi/Kconfig b/drivers/net/fddi/Kconfig
+index 3a424c864f4db..ecebeeb9b2a02 100644
+--- a/drivers/net/fddi/Kconfig
++++ b/drivers/net/fddi/Kconfig
+@@ -28,17 +28,20 @@ config DEFXX
+
+ config DEFXX_MMIO
+ bool
+- prompt "Use MMIO instead of PIO" if PCI || EISA
++ prompt "Use MMIO instead of IOP" if PCI || EISA
+ depends on DEFXX
+- default n if PCI || EISA
++ default n if EISA
+ default y
+ ---help---
+ This instructs the driver to use EISA or PCI memory-mapped I/O
+- (MMIO) as appropriate instead of programmed I/O ports (PIO).
++ (MMIO) as appropriate instead of programmed I/O ports (IOP).
+ Enabling this gives an improvement in processing time in parts
+- of the driver, but it may cause problems with EISA (DEFEA)
+- adapters. TURBOchannel does not have the concept of I/O ports,
+- so MMIO is always used for these (DEFTA) adapters.
++ of the driver, but it requires a memory window to be configured
++ for EISA (DEFEA) adapters that may not always be available.
++ Conversely some PCIe host bridges do not support IOP, so MMIO
++ may be required to access PCI (DEFPA) adapters on downstream PCI
++ buses with some systems. TURBOchannel does not have the concept
++ of I/O ports, so MMIO is always used for these (DEFTA) adapters.
+
+ If unsure, say N.
+
+diff --git a/drivers/net/fddi/defxx.c b/drivers/net/fddi/defxx.c
+index 61fceee73c1ba..3b48c890540ac 100644
+--- a/drivers/net/fddi/defxx.c
++++ b/drivers/net/fddi/defxx.c
+@@ -495,6 +495,25 @@ static const struct net_device_ops dfx_netdev_ops = {
+ .ndo_set_mac_address = dfx_ctl_set_mac_address,
+ };
+
++static void dfx_register_res_alloc_err(const char *print_name, bool mmio,
++ bool eisa)
++{
++ pr_err("%s: Cannot use %s, no address set, aborting\n",
++ print_name, mmio ? "MMIO" : "I/O");
++ pr_err("%s: Recompile driver with \"CONFIG_DEFXX_MMIO=%c\"\n",
++ print_name, mmio ? 'n' : 'y');
++ if (eisa && mmio)
++ pr_err("%s: Or run ECU and set adapter's MMIO location\n",
++ print_name);
++}
++
++static void dfx_register_res_err(const char *print_name, bool mmio,
++ unsigned long start, unsigned long len)
++{
++ pr_err("%s: Cannot reserve %s resource 0x%lx @ 0x%lx, aborting\n",
++ print_name, mmio ? "MMIO" : "I/O", len, start);
++}
++
+ /*
+ * ================
+ * = dfx_register =
+@@ -568,15 +587,12 @@ static int dfx_register(struct device *bdev)
+ dev_set_drvdata(bdev, dev);
+
+ dfx_get_bars(bdev, bar_start, bar_len);
+- if (dfx_bus_eisa && dfx_use_mmio && bar_start[0] == 0) {
+- pr_err("%s: Cannot use MMIO, no address set, aborting\n",
+- print_name);
+- pr_err("%s: Run ECU and set adapter's MMIO location\n",
+- print_name);
+- pr_err("%s: Or recompile driver with \"CONFIG_DEFXX_MMIO=n\""
+- "\n", print_name);
++ if (bar_len[0] == 0 ||
++ (dfx_bus_eisa && dfx_use_mmio && bar_start[0] == 0)) {
++ dfx_register_res_alloc_err(print_name, dfx_use_mmio,
++ dfx_bus_eisa);
+ err = -ENXIO;
+- goto err_out;
++ goto err_out_disable;
+ }
+
+ if (dfx_use_mmio)
+@@ -585,18 +601,16 @@ static int dfx_register(struct device *bdev)
+ else
+ region = request_region(bar_start[0], bar_len[0], print_name);
+ if (!region) {
+- pr_err("%s: Cannot reserve %s resource 0x%lx @ 0x%lx, "
+- "aborting\n", dfx_use_mmio ? "MMIO" : "I/O", print_name,
+- (long)bar_len[0], (long)bar_start[0]);
++ dfx_register_res_err(print_name, dfx_use_mmio,
++ bar_start[0], bar_len[0]);
+ err = -EBUSY;
+ goto err_out_disable;
+ }
+ if (bar_start[1] != 0) {
+ region = request_region(bar_start[1], bar_len[1], print_name);
+ if (!region) {
+- pr_err("%s: Cannot reserve I/O resource "
+- "0x%lx @ 0x%lx, aborting\n", print_name,
+- (long)bar_len[1], (long)bar_start[1]);
++ dfx_register_res_err(print_name, 0,
++ bar_start[1], bar_len[1]);
+ err = -EBUSY;
+ goto err_out_csr_region;
+ }
+@@ -604,9 +618,8 @@ static int dfx_register(struct device *bdev)
+ if (bar_start[2] != 0) {
+ region = request_region(bar_start[2], bar_len[2], print_name);
+ if (!region) {
+- pr_err("%s: Cannot reserve I/O resource "
+- "0x%lx @ 0x%lx, aborting\n", print_name,
+- (long)bar_len[2], (long)bar_start[2]);
++ dfx_register_res_err(print_name, 0,
++ bar_start[2], bar_len[2]);
+ err = -EBUSY;
+ goto err_out_bh_region;
+ }
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index ce6fecf421f86..8c458c8f57a3b 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -839,7 +839,7 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ __be16 df;
+ int err;
+
+- if (!pskb_network_may_pull(skb, sizeof(struct iphdr)))
++ if (!pskb_inet_may_pull(skb))
+ return -EINVAL;
+
+ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+@@ -885,7 +885,7 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ __be16 sport;
+ int err;
+
+- if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
++ if (!pskb_inet_may_pull(skb))
+ return -EINVAL;
+
+ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index fad5fc8b9edb9..3ec922bed2d84 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -56,6 +56,8 @@ struct lapbethdev {
+ struct list_head node;
+ struct net_device *ethdev; /* link to ethernet device */
+ struct net_device *axdev; /* lapbeth device (lapb#) */
++ bool up;
++ spinlock_t up_lock; /* Protects "up" */
+ };
+
+ static LIST_HEAD(lapbeth_devices);
+@@ -103,8 +105,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
+ rcu_read_lock();
+ lapbeth = lapbeth_get_x25_dev(dev);
+ if (!lapbeth)
+- goto drop_unlock;
+- if (!netif_running(lapbeth->axdev))
++ goto drop_unlock_rcu;
++ spin_lock_bh(&lapbeth->up_lock);
++ if (!lapbeth->up)
+ goto drop_unlock;
+
+ len = skb->data[0] + skb->data[1] * 256;
+@@ -119,11 +122,14 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
+ goto drop_unlock;
+ }
+ out:
++ spin_unlock_bh(&lapbeth->up_lock);
+ rcu_read_unlock();
+ return 0;
+ drop_unlock:
+ kfree_skb(skb);
+ goto out;
++drop_unlock_rcu:
++ rcu_read_unlock();
+ drop:
+ kfree_skb(skb);
+ return 0;
+@@ -151,13 +157,11 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb)
+ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
+ struct net_device *dev)
+ {
++ struct lapbethdev *lapbeth = netdev_priv(dev);
+ int err;
+
+- /*
+- * Just to be *really* sure not to send anything if the interface
+- * is down, the ethernet device may have gone.
+- */
+- if (!netif_running(dev))
++ spin_lock_bh(&lapbeth->up_lock);
++ if (!lapbeth->up)
+ goto drop;
+
+ /* There should be a pseudo header of 1 byte added by upper layers.
+@@ -188,6 +192,7 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
+ goto drop;
+ }
+ out:
++ spin_unlock_bh(&lapbeth->up_lock);
+ return NETDEV_TX_OK;
+ drop:
+ kfree_skb(skb);
+@@ -279,6 +284,7 @@ static const struct lapb_register_struct lapbeth_callbacks = {
+ */
+ static int lapbeth_open(struct net_device *dev)
+ {
++ struct lapbethdev *lapbeth = netdev_priv(dev);
+ int err;
+
+ if ((err = lapb_register(dev, &lapbeth_callbacks)) != LAPB_OK) {
+@@ -286,13 +292,22 @@ static int lapbeth_open(struct net_device *dev)
+ return -ENODEV;
+ }
+
++ spin_lock_bh(&lapbeth->up_lock);
++ lapbeth->up = true;
++ spin_unlock_bh(&lapbeth->up_lock);
++
+ return 0;
+ }
+
+ static int lapbeth_close(struct net_device *dev)
+ {
++ struct lapbethdev *lapbeth = netdev_priv(dev);
+ int err;
+
++ spin_lock_bh(&lapbeth->up_lock);
++ lapbeth->up = false;
++ spin_unlock_bh(&lapbeth->up_lock);
++
+ if ((err = lapb_unregister(dev)) != LAPB_OK)
+ pr_err("lapb_unregister error: %d\n", err);
+
+@@ -350,6 +365,9 @@ static int lapbeth_new_device(struct net_device *dev)
+ dev_hold(dev);
+ lapbeth->ethdev = dev;
+
++ lapbeth->up = false;
++ spin_lock_init(&lapbeth->up_lock);
++
+ rc = -EIO;
+ if (register_netdevice(ndev))
+ goto fail;
+diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c
+index dc6fe93ce71f6..e8473047b2d1e 100644
+--- a/drivers/net/wimax/i2400m/op-rfkill.c
++++ b/drivers/net/wimax/i2400m/op-rfkill.c
+@@ -101,7 +101,7 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev,
+ if (cmd == NULL)
+ goto error_alloc;
+ cmd->hdr.type = cpu_to_le16(I2400M_MT_CMD_RF_CONTROL);
+- cmd->hdr.length = sizeof(cmd->sw_rf);
++ cmd->hdr.length = cpu_to_le16(sizeof(cmd->sw_rf));
+ cmd->hdr.version = cpu_to_le16(I2400M_L3L4_VERSION);
+ cmd->sw_rf.hdr.type = cpu_to_le16(I2400M_TLV_RF_OPERATION);
+ cmd->sw_rf.hdr.length = cpu_to_le16(sizeof(cmd->sw_rf.status));
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index 04dc5714aa725..243887fdb343e 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -465,6 +465,9 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb)
+ GFP_ATOMIC
+ );
+ break;
++ default:
++ kfree(tb);
++ return;
+ }
+
+ exit:
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 27d9fe6799f58..cb136d9d46214 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -246,7 +246,7 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)
+ if (unlikely(r)) {
+ ath_dbg(common, WMI, "REGISTER READ FAILED: (0x%04x, %d)\n",
+ reg_offset, r);
+- return -EIO;
++ return -1;
+ }
+
+ return be32_to_cpu(val);
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index b4f7ee423d407..9f438d8e59f2f 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -287,7 +287,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah)
+
+ srev = REG_READ(ah, AR_SREV);
+
+- if (srev == -EIO) {
++ if (srev == -1) {
+ ath_err(ath9k_hw_common(ah),
+ "Failed to read SREV register");
+ return false;
+diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_wx.c b/drivers/net/wireless/intel/ipw2x00/libipw_wx.c
+index d32d39fa26862..c129291d3a173 100644
+--- a/drivers/net/wireless/intel/ipw2x00/libipw_wx.c
++++ b/drivers/net/wireless/intel/ipw2x00/libipw_wx.c
+@@ -647,8 +647,10 @@ int libipw_wx_set_encodeext(struct libipw_device *ieee,
+ }
+
+ if (ext->alg != IW_ENCODE_ALG_NONE) {
+- memcpy(sec.keys[idx], ext->key, ext->key_len);
+- sec.key_sizes[idx] = ext->key_len;
++ int key_len = clamp_val(ext->key_len, 0, SCM_KEY_LEN);
++
++ memcpy(sec.keys[idx], ext->key, key_len);
++ sec.key_sizes[idx] = key_len;
+ sec.flags |= (1 << idx);
+ if (ext->alg == IW_ENCODE_ALG_WEP) {
+ sec.encode_alg[idx] = SEC_ALG_WEP;
+diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
+index ffc565ac21924..6769b0c5a5cde 100644
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -1469,6 +1469,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index)
+ txq->skb = kcalloc(MWL8K_TX_DESCS, sizeof(*txq->skb), GFP_KERNEL);
+ if (txq->skb == NULL) {
+ pci_free_consistent(priv->pdev, size, txq->txd, txq->txd_dma);
++ txq->txd = NULL;
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.c b/drivers/net/wireless/mediatek/mt7601u/eeprom.c
+index 76117b4028805..6ab1035e4a121 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.c
+@@ -107,7 +107,7 @@ mt7601u_has_tssi(struct mt7601u_dev *dev, u8 *eeprom)
+ {
+ u16 nic_conf1 = get_unaligned_le16(eeprom + MT_EE_NIC_CONF_1);
+
+- return ~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN);
++ return (u16)~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN);
+ }
+
+ static void
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
+index f87f9d03b9fa2..ac44fd5d05977 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
+@@ -272,7 +272,7 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {
+ 0x824, 0x00030FE0,
+ 0x828, 0x00000000,
+ 0x82C, 0x002081DD,
+- 0x830, 0x2AAA8E24,
++ 0x830, 0x2AAAEEC8,
+ 0x834, 0x0037A706,
+ 0x838, 0x06489B44,
+ 0x83C, 0x0000095B,
+@@ -347,10 +347,10 @@ u32 RTL8821AE_PHY_REG_ARRAY[] = {
+ 0x9D8, 0x00000000,
+ 0x9DC, 0x00000000,
+ 0x9E0, 0x00005D00,
+- 0x9E4, 0x00000002,
++ 0x9E4, 0x00000003,
+ 0x9E8, 0x00000001,
+ 0xA00, 0x00D047C8,
+- 0xA04, 0x01FF000C,
++ 0xA04, 0x01FF800C,
+ 0xA08, 0x8C8A8300,
+ 0xA0C, 0x2E68000F,
+ 0xA10, 0x9500BB78,
+@@ -1343,7 +1343,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x083, 0x00021800,
+ 0x084, 0x00028000,
+ 0x085, 0x00048000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
++ 0x086, 0x0009483A,
++ 0xA0000000, 0x00000000,
+ 0x086, 0x00094838,
++ 0xB0000000, 0x00000000,
+ 0x087, 0x00044980,
+ 0x088, 0x00048000,
+ 0x089, 0x0000D480,
+@@ -1432,36 +1436,32 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x03C, 0x000CA000,
+ 0x0EF, 0x00000000,
+ 0x0EF, 0x00001100,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004ADF3,
+ 0x034, 0x00049DF0,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004ADF3,
+ 0x034, 0x00049DF0,
+- 0xFF0F0404, 0xCDEF,
+- 0x034, 0x0004ADF3,
+- 0x034, 0x00049DF0,
+- 0xFF0F0200, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004ADF5,
+ 0x034, 0x00049DF2,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0004A0F3,
++ 0x034, 0x000490B1,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0004A0F3,
+ 0x034, 0x000490B1,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0004ADF5,
++ 0x034, 0x00049DF2,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0004ADF3,
++ 0x034, 0x00049DF0,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x0004ADF7,
+ 0x034, 0x00049DF3,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00048DED,
+- 0x034, 0x00047DEA,
+- 0x034, 0x00046DE7,
+- 0x034, 0x00045CE9,
+- 0x034, 0x00044CE6,
+- 0x034, 0x000438C6,
+- 0x034, 0x00042886,
+- 0x034, 0x00041486,
+- 0x034, 0x00040447,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00048DED,
+ 0x034, 0x00047DEA,
+ 0x034, 0x00046DE7,
+@@ -1471,7 +1471,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00042886,
+ 0x034, 0x00041486,
+ 0x034, 0x00040447,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00048DED,
+ 0x034, 0x00047DEA,
+ 0x034, 0x00046DE7,
+@@ -1481,7 +1481,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00042886,
+ 0x034, 0x00041486,
+ 0x034, 0x00040447,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x000480AE,
++ 0x034, 0x000470AB,
++ 0x034, 0x0004608B,
++ 0x034, 0x00045069,
++ 0x034, 0x00044048,
++ 0x034, 0x00043045,
++ 0x034, 0x00042026,
++ 0x034, 0x00041023,
++ 0x034, 0x00040002,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x000480AE,
+ 0x034, 0x000470AB,
+ 0x034, 0x0004608B,
+@@ -1491,7 +1501,17 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00042026,
+ 0x034, 0x00041023,
+ 0x034, 0x00040002,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00048DED,
++ 0x034, 0x00047DEA,
++ 0x034, 0x00046DE7,
++ 0x034, 0x00045CE9,
++ 0x034, 0x00044CE6,
++ 0x034, 0x000438C6,
++ 0x034, 0x00042886,
++ 0x034, 0x00041486,
++ 0x034, 0x00040447,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00048DEF,
+ 0x034, 0x00047DEC,
+ 0x034, 0x00046DE9,
+@@ -1501,38 +1521,36 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x0004248A,
+ 0x034, 0x0004108D,
+ 0x034, 0x0004008A,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0200, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0002ADF4,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0002A0F3,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0002A0F3,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0002ADF4,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x0002ADF7,
+- 0xFF0F0200, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00029DF4,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00029DF4,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00029DF4,
+- 0xFF0F0200, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00029DF1,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x000290F0,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x000290F0,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00029DF1,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00029DF4,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00029DF2,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00028DF1,
+- 0x034, 0x00027DEE,
+- 0x034, 0x00026DEB,
+- 0x034, 0x00025CEC,
+- 0x034, 0x00024CE9,
+- 0x034, 0x000238CA,
+- 0x034, 0x00022889,
+- 0x034, 0x00021489,
+- 0x034, 0x0002044A,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00028DF1,
+ 0x034, 0x00027DEE,
+ 0x034, 0x00026DEB,
+@@ -1542,7 +1560,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022889,
+ 0x034, 0x00021489,
+ 0x034, 0x0002044A,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00028DF1,
+ 0x034, 0x00027DEE,
+ 0x034, 0x00026DEB,
+@@ -1552,7 +1570,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022889,
+ 0x034, 0x00021489,
+ 0x034, 0x0002044A,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x000280AF,
+ 0x034, 0x000270AC,
+ 0x034, 0x0002608B,
+@@ -1562,7 +1580,27 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022026,
+ 0x034, 0x00021023,
+ 0x034, 0x00020002,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x000280AF,
++ 0x034, 0x000270AC,
++ 0x034, 0x0002608B,
++ 0x034, 0x00025069,
++ 0x034, 0x00024048,
++ 0x034, 0x00023045,
++ 0x034, 0x00022026,
++ 0x034, 0x00021023,
++ 0x034, 0x00020002,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00028DF1,
++ 0x034, 0x00027DEE,
++ 0x034, 0x00026DEB,
++ 0x034, 0x00025CEC,
++ 0x034, 0x00024CE9,
++ 0x034, 0x000238CA,
++ 0x034, 0x00022889,
++ 0x034, 0x00021489,
++ 0x034, 0x0002044A,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00028DEE,
+ 0x034, 0x00027DEB,
+ 0x034, 0x00026CCD,
+@@ -1572,27 +1610,24 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00022849,
+ 0x034, 0x00021449,
+ 0x034, 0x0002004D,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F02C0, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x8000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0000A0D7,
++ 0x034, 0x000090D3,
++ 0x034, 0x000080B1,
++ 0x034, 0x000070AE,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0000A0D7,
+ 0x034, 0x000090D3,
+ 0x034, 0x000080B1,
+ 0x034, 0x000070AE,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x0000ADF7,
+ 0x034, 0x00009DF4,
+ 0x034, 0x00008DF1,
+ 0x034, 0x00007DEE,
+- 0xFF0F02C0, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
+- 0x034, 0x00006DEB,
+- 0x034, 0x00005CEC,
+- 0x034, 0x00004CE9,
+- 0x034, 0x000038CA,
+- 0x034, 0x00002889,
+- 0x034, 0x00001489,
+- 0x034, 0x0000044A,
+- 0xFF0F0204, 0xCDEF,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00006DEB,
+ 0x034, 0x00005CEC,
+ 0x034, 0x00004CE9,
+@@ -1600,7 +1635,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002889,
+ 0x034, 0x00001489,
+ 0x034, 0x0000044A,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x00006DEB,
+ 0x034, 0x00005CEC,
+ 0x034, 0x00004CE9,
+@@ -1608,7 +1643,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002889,
+ 0x034, 0x00001489,
+ 0x034, 0x0000044A,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x034, 0x0000608D,
+ 0x034, 0x0000506B,
+ 0x034, 0x0000404A,
+@@ -1616,7 +1651,23 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002044,
+ 0x034, 0x00001025,
+ 0x034, 0x00000004,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x0000608D,
++ 0x034, 0x0000506B,
++ 0x034, 0x0000404A,
++ 0x034, 0x00003047,
++ 0x034, 0x00002044,
++ 0x034, 0x00001025,
++ 0x034, 0x00000004,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x034, 0x00006DEB,
++ 0x034, 0x00005CEC,
++ 0x034, 0x00004CE9,
++ 0x034, 0x000038CA,
++ 0x034, 0x00002889,
++ 0x034, 0x00001489,
++ 0x034, 0x0000044A,
++ 0xA0000000, 0x00000000,
+ 0x034, 0x00006DCD,
+ 0x034, 0x00005CCD,
+ 0x034, 0x00004CCA,
+@@ -1624,11 +1675,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x034, 0x00002888,
+ 0x034, 0x00001488,
+ 0x034, 0x00000486,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x018, 0x0001712A,
+ 0x0EF, 0x00000040,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x035, 0x00000187,
+ 0x035, 0x00008187,
+ 0x035, 0x00010187,
+@@ -1638,7 +1689,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x00040188,
+ 0x035, 0x00048188,
+ 0x035, 0x00050188,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x035, 0x00000187,
+ 0x035, 0x00008187,
+ 0x035, 0x00010187,
+@@ -1648,7 +1699,37 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x00040188,
+ 0x035, 0x00048188,
+ 0x035, 0x00050188,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x035, 0x00000128,
++ 0x035, 0x00008128,
++ 0x035, 0x00010128,
++ 0x035, 0x000201C8,
++ 0x035, 0x000281C8,
++ 0x035, 0x000301C8,
++ 0x035, 0x000401C8,
++ 0x035, 0x000481C8,
++ 0x035, 0x000501C8,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x035, 0x00000145,
++ 0x035, 0x00008145,
++ 0x035, 0x00010145,
++ 0x035, 0x00020196,
++ 0x035, 0x00028196,
++ 0x035, 0x00030196,
++ 0x035, 0x000401C7,
++ 0x035, 0x000481C7,
++ 0x035, 0x000501C7,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x035, 0x00000128,
++ 0x035, 0x00008128,
++ 0x035, 0x00010128,
++ 0x035, 0x000201C8,
++ 0x035, 0x000281C8,
++ 0x035, 0x000301C8,
++ 0x035, 0x000401C8,
++ 0x035, 0x000481C8,
++ 0x035, 0x000501C8,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x035, 0x00000187,
+ 0x035, 0x00008187,
+ 0x035, 0x00010187,
+@@ -1658,7 +1739,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x00040188,
+ 0x035, 0x00048188,
+ 0x035, 0x00050188,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x035, 0x00000145,
+ 0x035, 0x00008145,
+ 0x035, 0x00010145,
+@@ -1668,11 +1749,11 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x035, 0x000401C7,
+ 0x035, 0x000481C7,
+ 0x035, 0x000501C7,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x018, 0x0001712A,
+ 0x0EF, 0x00000010,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x036, 0x00085733,
+ 0x036, 0x0008D733,
+ 0x036, 0x00095733,
+@@ -1685,7 +1766,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x000CE4B4,
+ 0x036, 0x000D64B4,
+ 0x036, 0x000DE4B4,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x036, 0x00085733,
+ 0x036, 0x0008D733,
+ 0x036, 0x00095733,
+@@ -1698,7 +1779,46 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x000CE4B4,
+ 0x036, 0x000D64B4,
+ 0x036, 0x000DE4B4,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x036, 0x000063B5,
++ 0x036, 0x0000E3B5,
++ 0x036, 0x000163B5,
++ 0x036, 0x0001E3B5,
++ 0x036, 0x000263B5,
++ 0x036, 0x0002E3B5,
++ 0x036, 0x000363B5,
++ 0x036, 0x0003E3B5,
++ 0x036, 0x000463B5,
++ 0x036, 0x0004E3B5,
++ 0x036, 0x000563B5,
++ 0x036, 0x0005E3B5,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x036, 0x000056B3,
++ 0x036, 0x0000D6B3,
++ 0x036, 0x000156B3,
++ 0x036, 0x0001D6B3,
++ 0x036, 0x00026634,
++ 0x036, 0x0002E634,
++ 0x036, 0x00036634,
++ 0x036, 0x0003E634,
++ 0x036, 0x000467B4,
++ 0x036, 0x0004E7B4,
++ 0x036, 0x000567B4,
++ 0x036, 0x0005E7B4,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x036, 0x000063B5,
++ 0x036, 0x0000E3B5,
++ 0x036, 0x000163B5,
++ 0x036, 0x0001E3B5,
++ 0x036, 0x000263B5,
++ 0x036, 0x0002E3B5,
++ 0x036, 0x000363B5,
++ 0x036, 0x0003E3B5,
++ 0x036, 0x000463B5,
++ 0x036, 0x0004E3B5,
++ 0x036, 0x000563B5,
++ 0x036, 0x0005E3B5,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x036, 0x00085733,
+ 0x036, 0x0008D733,
+ 0x036, 0x00095733,
+@@ -1711,7 +1831,7 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x000CE4B4,
+ 0x036, 0x000D64B4,
+ 0x036, 0x000DE4B4,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x036, 0x000056B3,
+ 0x036, 0x0000D6B3,
+ 0x036, 0x000156B3,
+@@ -1724,103 +1844,162 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x036, 0x0004E7B4,
+ 0x036, 0x000567B4,
+ 0x036, 0x0005E7B4,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x0EF, 0x00000008,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x000001C8,
+ 0x03C, 0x00000492,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x000001C8,
+ 0x03C, 0x00000492,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x000001B6,
++ 0x03C, 0x00000492,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x0000022A,
++ 0x03C, 0x00000594,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x000001B6,
++ 0x03C, 0x00000492,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x000001C8,
+ 0x03C, 0x00000492,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x03C, 0x0000022A,
+ 0x03C, 0x00000594,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000800,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000800,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000800,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x03C, 0x00000820,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x00000820,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x00000800,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x03C, 0x00000800,
++ 0xA0000000, 0x00000000,
+ 0x03C, 0x00000900,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x018, 0x0001712A,
+ 0x0EF, 0x00000002,
+- 0xFF0F0104, 0xABCD,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x008, 0x0004E400,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x008, 0x0004E400,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x008, 0x00002000,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x008, 0x0004E400,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x008, 0x00002000,
+- 0xFF0F0104, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x0EF, 0x00000000,
+ 0x0DF, 0x000000C0,
+- 0x01F, 0x00040064,
+- 0xFF0F0104, 0xABCD,
++ 0x01F, 0x00000064,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x058, 0x000A7284,
+ 0x059, 0x000600EC,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x058, 0x000A7284,
+ 0x059, 0x000600EC,
+- 0xFF0F0404, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x058, 0x00081184,
++ 0x059, 0x0006016C,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x058, 0x00081184,
++ 0x059, 0x0006016C,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x058, 0x00081184,
++ 0x059, 0x0006016C,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x058, 0x000A7284,
+ 0x059, 0x000600EC,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x058, 0x00081184,
+ 0x059, 0x0006016C,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x061, 0x000E8D73,
+ 0x062, 0x00093FC5,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x061, 0x000E8D73,
+ 0x062, 0x00093FC5,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x061, 0x000EFD83,
++ 0x062, 0x00093FCC,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x061, 0x000EAD53,
++ 0x062, 0x00093BC4,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x061, 0x000EFD83,
++ 0x062, 0x00093FCC,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x061, 0x000E8D73,
+ 0x062, 0x00093FC5,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x061, 0x000EAD53,
+ 0x062, 0x00093BC4,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xFF0F0204, 0xCDEF,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
++ 0x063, 0x000110EB,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xFF0F0200, 0xCDEF,
+- 0x063, 0x000710E9,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x063, 0x000110E9,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x063, 0x000110EB,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
++ 0x063, 0x000110E9,
++ 0xA0000000, 0x00000000,
+ 0x063, 0x000714E9,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0104, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
++ 0x064, 0x0001C27C,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
++ 0x064, 0x0001C27C,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x064, 0x0001C27C,
+- 0xFF0F0204, 0xCDEF,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x064, 0x0001C67C,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
+ 0x064, 0x0001C27C,
+- 0xFF0F0404, 0xCDEF,
++ 0x90000410, 0x00000000, 0x40000000, 0x00000000,
+ 0x064, 0x0001C27C,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x064, 0x0001C67C,
+- 0xFF0F0104, 0xDEAD,
+- 0xFF0F0200, 0xABCD,
++ 0xB0000000, 0x00000000,
++ 0x80000111, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00091016,
++ 0x90000110, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00091016,
++ 0x90000210, 0x00000000, 0x40000000, 0x00000000,
+ 0x065, 0x00093016,
+- 0xFF0F02C0, 0xCDEF,
++ 0x9000020c, 0x00000000, 0x40000000, 0x00000000,
+ 0x065, 0x00093015,
+- 0xCDCDCDCD, 0xCDCD,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00093015,
++ 0x90000200, 0x00000000, 0x40000000, 0x00000000,
++ 0x065, 0x00093016,
++ 0xA0000000, 0x00000000,
+ 0x065, 0x00091016,
+- 0xFF0F0200, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x018, 0x00000006,
+ 0x0EF, 0x00002000,
+ 0x03B, 0x0003824B,
+@@ -1918,9 +2097,10 @@ u32 RTL8821AE_RADIOA_ARRAY[] = {
+ 0x0B4, 0x0001214C,
+ 0x0B7, 0x0003000C,
+ 0x01C, 0x000539D2,
++ 0x0C4, 0x000AFE00,
+ 0x018, 0x0001F12A,
+- 0x0FE, 0x00000000,
+- 0x0FE, 0x00000000,
++ 0xFFE, 0x00000000,
++ 0xFFE, 0x00000000,
+ 0x018, 0x0001712A,
+
+ };
+@@ -2040,6 +2220,7 @@ u32 RTL8812AE_MAC_REG_ARRAY[] = {
+ u32 RTL8812AE_MAC_1T_ARRAYLEN = ARRAY_SIZE(RTL8812AE_MAC_REG_ARRAY);
+
+ u32 RTL8821AE_MAC_REG_ARRAY[] = {
++ 0x421, 0x0000000F,
+ 0x428, 0x0000000A,
+ 0x429, 0x00000010,
+ 0x430, 0x00000000,
+@@ -2508,7 +2689,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0xA6360001,
+ 0x81C, 0xA5380001,
+ 0x81C, 0xA43A0001,
+- 0x81C, 0xA33C0001,
++ 0x81C, 0x683C0001,
+ 0x81C, 0x673E0001,
+ 0x81C, 0x66400001,
+ 0x81C, 0x65420001,
+@@ -2542,7 +2723,66 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0x017A0001,
+ 0x81C, 0x017C0001,
+ 0x81C, 0x017E0001,
+- 0xFF0F02C0, 0xABCD,
++ 0x8000020c, 0x00000000, 0x40000000, 0x00000000,
++ 0x81C, 0xFB000101,
++ 0x81C, 0xFA020101,
++ 0x81C, 0xF9040101,
++ 0x81C, 0xF8060101,
++ 0x81C, 0xF7080101,
++ 0x81C, 0xF60A0101,
++ 0x81C, 0xF50C0101,
++ 0x81C, 0xF40E0101,
++ 0x81C, 0xF3100101,
++ 0x81C, 0xF2120101,
++ 0x81C, 0xF1140101,
++ 0x81C, 0xF0160101,
++ 0x81C, 0xEF180101,
++ 0x81C, 0xEE1A0101,
++ 0x81C, 0xED1C0101,
++ 0x81C, 0xEC1E0101,
++ 0x81C, 0xEB200101,
++ 0x81C, 0xEA220101,
++ 0x81C, 0xE9240101,
++ 0x81C, 0xE8260101,
++ 0x81C, 0xE7280101,
++ 0x81C, 0xE62A0101,
++ 0x81C, 0xE52C0101,
++ 0x81C, 0xE42E0101,
++ 0x81C, 0xE3300101,
++ 0x81C, 0xA5320101,
++ 0x81C, 0xA4340101,
++ 0x81C, 0xA3360101,
++ 0x81C, 0x87380101,
++ 0x81C, 0x863A0101,
++ 0x81C, 0x853C0101,
++ 0x81C, 0x843E0101,
++ 0x81C, 0x69400101,
++ 0x81C, 0x68420101,
++ 0x81C, 0x67440101,
++ 0x81C, 0x66460101,
++ 0x81C, 0x49480101,
++ 0x81C, 0x484A0101,
++ 0x81C, 0x474C0101,
++ 0x81C, 0x2A4E0101,
++ 0x81C, 0x29500101,
++ 0x81C, 0x28520101,
++ 0x81C, 0x27540101,
++ 0x81C, 0x26560101,
++ 0x81C, 0x25580101,
++ 0x81C, 0x245A0101,
++ 0x81C, 0x235C0101,
++ 0x81C, 0x055E0101,
++ 0x81C, 0x04600101,
++ 0x81C, 0x03620101,
++ 0x81C, 0x02640101,
++ 0x81C, 0x01660101,
++ 0x81C, 0x01680101,
++ 0x81C, 0x016A0101,
++ 0x81C, 0x016C0101,
++ 0x81C, 0x016E0101,
++ 0x81C, 0x01700101,
++ 0x81C, 0x01720101,
++ 0x9000040c, 0x00000000, 0x40000000, 0x00000000,
+ 0x81C, 0xFB000101,
+ 0x81C, 0xFA020101,
+ 0x81C, 0xF9040101,
+@@ -2601,7 +2841,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0x016E0101,
+ 0x81C, 0x01700101,
+ 0x81C, 0x01720101,
+- 0xCDCDCDCD, 0xCDCD,
++ 0xA0000000, 0x00000000,
+ 0x81C, 0xFF000101,
+ 0x81C, 0xFF020101,
+ 0x81C, 0xFE040101,
+@@ -2660,7 +2900,7 @@ u32 RTL8821AE_AGC_TAB_ARRAY[] = {
+ 0x81C, 0x046E0101,
+ 0x81C, 0x03700101,
+ 0x81C, 0x02720101,
+- 0xFF0F02C0, 0xDEAD,
++ 0xB0000000, 0x00000000,
+ 0x81C, 0x01740101,
+ 0x81C, 0x01760101,
+ 0x81C, 0x01780101,
+diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+index f76a360cf1e35..609cd07eeafca 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -1400,7 +1400,7 @@ static int rsi_restore(struct device *dev)
+ }
+ static const struct dev_pm_ops rsi_pm_ops = {
+ .suspend = rsi_suspend,
+- .resume = rsi_resume,
++ .resume_noirq = rsi_resume,
+ .freeze = rsi_freeze,
+ .thaw = rsi_thaw,
+ .restore = rsi_restore,
+diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h
+index efdce9ae36ea7..a10ee5a680129 100644
+--- a/drivers/net/wireless/wl3501.h
++++ b/drivers/net/wireless/wl3501.h
+@@ -379,16 +379,7 @@ struct wl3501_get_confirm {
+ u8 mib_value[100];
+ };
+
+-struct wl3501_join_req {
+- u16 next_blk;
+- u8 sig_id;
+- u8 reserved;
+- struct iw_mgmt_data_rset operational_rset;
+- u16 reserved2;
+- u16 timeout;
+- u16 probe_delay;
+- u8 timestamp[8];
+- u8 local_time[8];
++struct wl3501_req {
+ u16 beacon_period;
+ u16 dtim_period;
+ u16 cap_info;
+@@ -401,6 +392,19 @@ struct wl3501_join_req {
+ struct iw_mgmt_data_rset bss_basic_rset;
+ };
+
++struct wl3501_join_req {
++ u16 next_blk;
++ u8 sig_id;
++ u8 reserved;
++ struct iw_mgmt_data_rset operational_rset;
++ u16 reserved2;
++ u16 timeout;
++ u16 probe_delay;
++ u8 timestamp[8];
++ u8 local_time[8];
++ struct wl3501_req req;
++};
++
+ struct wl3501_join_confirm {
+ u16 next_blk;
+ u8 sig_id;
+@@ -443,16 +447,7 @@ struct wl3501_scan_confirm {
+ u16 status;
+ char timestamp[8];
+ char localtime[8];
+- u16 beacon_period;
+- u16 dtim_period;
+- u16 cap_info;
+- u8 bss_type;
+- u8 bssid[ETH_ALEN];
+- struct iw_mgmt_essid_pset ssid;
+- struct iw_mgmt_ds_pset ds_pset;
+- struct iw_mgmt_cf_pset cf_pset;
+- struct iw_mgmt_ibss_pset ibss_pset;
+- struct iw_mgmt_data_rset bss_basic_rset;
++ struct wl3501_req req;
+ u8 rssi;
+ };
+
+@@ -471,8 +466,10 @@ struct wl3501_md_req {
+ u16 size;
+ u8 pri;
+ u8 service_class;
+- u8 daddr[ETH_ALEN];
+- u8 saddr[ETH_ALEN];
++ struct {
++ u8 daddr[ETH_ALEN];
++ u8 saddr[ETH_ALEN];
++ } addr;
+ };
+
+ struct wl3501_md_ind {
+@@ -484,8 +481,10 @@ struct wl3501_md_ind {
+ u8 reception;
+ u8 pri;
+ u8 service_class;
+- u8 daddr[ETH_ALEN];
+- u8 saddr[ETH_ALEN];
++ struct {
++ u8 daddr[ETH_ALEN];
++ u8 saddr[ETH_ALEN];
++ } addr;
+ };
+
+ struct wl3501_md_confirm {
+diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
+index da62220b9c01a..f33ece9370473 100644
+--- a/drivers/net/wireless/wl3501_cs.c
++++ b/drivers/net/wireless/wl3501_cs.c
+@@ -468,6 +468,7 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len)
+ struct wl3501_md_req sig = {
+ .sig_id = WL3501_SIG_MD_REQ,
+ };
++ size_t sig_addr_len = sizeof(sig.addr);
+ u8 *pdata = (char *)data;
+ int rc = -EIO;
+
+@@ -483,9 +484,9 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len)
+ goto out;
+ }
+ rc = 0;
+- memcpy(&sig.daddr[0], pdata, 12);
+- pktlen = len - 12;
+- pdata += 12;
++ memcpy(&sig.addr, pdata, sig_addr_len);
++ pktlen = len - sig_addr_len;
++ pdata += sig_addr_len;
+ sig.data = bf;
+ if (((*pdata) * 256 + (*(pdata + 1))) > 1500) {
+ u8 addr4[ETH_ALEN] = {
+@@ -588,7 +589,7 @@ static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas)
+ struct wl3501_join_req sig = {
+ .sig_id = WL3501_SIG_JOIN_REQ,
+ .timeout = 10,
+- .ds_pset = {
++ .req.ds_pset = {
+ .el = {
+ .id = IW_MGMT_INFO_ELEMENT_DS_PARAMETER_SET,
+ .len = 1,
+@@ -597,7 +598,7 @@ static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas)
+ },
+ };
+
+- memcpy(&sig.beacon_period, &this->bss_set[stas].beacon_period, 72);
++ memcpy(&sig.req, &this->bss_set[stas].req, sizeof(sig.req));
+ return wl3501_esbq_exec(this, &sig, sizeof(sig));
+ }
+
+@@ -665,35 +666,37 @@ static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr)
+ if (sig.status == WL3501_STATUS_SUCCESS) {
+ pr_debug("success");
+ if ((this->net_type == IW_MODE_INFRA &&
+- (sig.cap_info & WL3501_MGMT_CAPABILITY_ESS)) ||
++ (sig.req.cap_info & WL3501_MGMT_CAPABILITY_ESS)) ||
+ (this->net_type == IW_MODE_ADHOC &&
+- (sig.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) ||
++ (sig.req.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) ||
+ this->net_type == IW_MODE_AUTO) {
+ if (!this->essid.el.len)
+ matchflag = 1;
+ else if (this->essid.el.len == 3 &&
+ !memcmp(this->essid.essid, "ANY", 3))
+ matchflag = 1;
+- else if (this->essid.el.len != sig.ssid.el.len)
++ else if (this->essid.el.len != sig.req.ssid.el.len)
+ matchflag = 0;
+- else if (memcmp(this->essid.essid, sig.ssid.essid,
++ else if (memcmp(this->essid.essid, sig.req.ssid.essid,
+ this->essid.el.len))
+ matchflag = 0;
+ else
+ matchflag = 1;
+ if (matchflag) {
+ for (i = 0; i < this->bss_cnt; i++) {
+- if (ether_addr_equal_unaligned(this->bss_set[i].bssid, sig.bssid)) {
++ if (ether_addr_equal_unaligned(this->bss_set[i].req.bssid,
++ sig.req.bssid)) {
+ matchflag = 0;
+ break;
+ }
+ }
+ }
+ if (matchflag && (i < 20)) {
+- memcpy(&this->bss_set[i].beacon_period,
+- &sig.beacon_period, 73);
++ memcpy(&this->bss_set[i].req,
++ &sig.req, sizeof(sig.req));
+ this->bss_cnt++;
+ this->rssi = sig.rssi;
++ this->bss_set[i].rssi = sig.rssi;
+ }
+ }
+ } else if (sig.status == WL3501_STATUS_TIMEOUT) {
+@@ -885,19 +888,19 @@ static void wl3501_mgmt_join_confirm(struct net_device *dev, u16 addr)
+ if (this->join_sta_bss < this->bss_cnt) {
+ const int i = this->join_sta_bss;
+ memcpy(this->bssid,
+- this->bss_set[i].bssid, ETH_ALEN);
+- this->chan = this->bss_set[i].ds_pset.chan;
++ this->bss_set[i].req.bssid, ETH_ALEN);
++ this->chan = this->bss_set[i].req.ds_pset.chan;
+ iw_copy_mgmt_info_element(&this->keep_essid.el,
+- &this->bss_set[i].ssid.el);
++ &this->bss_set[i].req.ssid.el);
+ wl3501_mgmt_auth(this);
+ }
+ } else {
+ const int i = this->join_sta_bss;
+
+- memcpy(&this->bssid, &this->bss_set[i].bssid, ETH_ALEN);
+- this->chan = this->bss_set[i].ds_pset.chan;
++ memcpy(&this->bssid, &this->bss_set[i].req.bssid, ETH_ALEN);
++ this->chan = this->bss_set[i].req.ds_pset.chan;
+ iw_copy_mgmt_info_element(&this->keep_essid.el,
+- &this->bss_set[i].ssid.el);
++ &this->bss_set[i].req.ssid.el);
+ wl3501_online(dev);
+ }
+ } else {
+@@ -979,7 +982,8 @@ static inline void wl3501_md_ind_interrupt(struct net_device *dev,
+ } else {
+ skb->dev = dev;
+ skb_reserve(skb, 2); /* IP headers on 16 bytes boundaries */
+- skb_copy_to_linear_data(skb, (unsigned char *)&sig.daddr, 12);
++ skb_copy_to_linear_data(skb, (unsigned char *)&sig.addr,
++ sizeof(sig.addr));
+ wl3501_receive(this, skb->data, pkt_len);
+ skb_put(skb, pkt_len);
+ skb->protocol = eth_type_trans(skb, dev);
+@@ -1574,30 +1578,30 @@ static int wl3501_get_scan(struct net_device *dev, struct iw_request_info *info,
+ for (i = 0; i < this->bss_cnt; ++i) {
+ iwe.cmd = SIOCGIWAP;
+ iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+- memcpy(iwe.u.ap_addr.sa_data, this->bss_set[i].bssid, ETH_ALEN);
++ memcpy(iwe.u.ap_addr.sa_data, this->bss_set[i].req.bssid, ETH_ALEN);
+ current_ev = iwe_stream_add_event(info, current_ev,
+ extra + IW_SCAN_MAX_DATA,
+ &iwe, IW_EV_ADDR_LEN);
+ iwe.cmd = SIOCGIWESSID;
+ iwe.u.data.flags = 1;
+- iwe.u.data.length = this->bss_set[i].ssid.el.len;
++ iwe.u.data.length = this->bss_set[i].req.ssid.el.len;
+ current_ev = iwe_stream_add_point(info, current_ev,
+ extra + IW_SCAN_MAX_DATA,
+ &iwe,
+- this->bss_set[i].ssid.essid);
++ this->bss_set[i].req.ssid.essid);
+ iwe.cmd = SIOCGIWMODE;
+- iwe.u.mode = this->bss_set[i].bss_type;
++ iwe.u.mode = this->bss_set[i].req.bss_type;
+ current_ev = iwe_stream_add_event(info, current_ev,
+ extra + IW_SCAN_MAX_DATA,
+ &iwe, IW_EV_UINT_LEN);
+ iwe.cmd = SIOCGIWFREQ;
+- iwe.u.freq.m = this->bss_set[i].ds_pset.chan;
++ iwe.u.freq.m = this->bss_set[i].req.ds_pset.chan;
+ iwe.u.freq.e = 0;
+ current_ev = iwe_stream_add_event(info, current_ev,
+ extra + IW_SCAN_MAX_DATA,
+ &iwe, IW_EV_FREQ_LEN);
+ iwe.cmd = SIOCGIWENCODE;
+- if (this->bss_set[i].cap_info & WL3501_MGMT_CAPABILITY_PRIVACY)
++ if (this->bss_set[i].req.cap_info & WL3501_MGMT_CAPABILITY_PRIVACY)
+ iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+ else
+ iwe.u.data.flags = IW_ENCODE_DISABLED;
+diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
+index a0cc1cc452927..01da9331f4cb6 100644
+--- a/drivers/nfc/pn533/pn533.c
++++ b/drivers/nfc/pn533/pn533.c
+@@ -692,6 +692,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
+ if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0)
+ return false;
+
++ if (type_a->nfcid_len > NFC_NFCID1_MAXSIZE)
++ return false;
++
+ return true;
+ }
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 513dd1e2aac76..e64310f2296f8 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2091,7 +2091,8 @@ static void nvme_set_latency_tolerance(struct device *dev, s32 val)
+
+ if (ctrl->ps_max_latency_us != latency) {
+ ctrl->ps_max_latency_us = latency;
+- nvme_configure_apst(ctrl);
++ if (ctrl->state == NVME_CTRL_LIVE)
++ nvme_configure_apst(ctrl);
+ }
+ }
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 4ef05fe00dace..64f699a1afd72 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -516,6 +516,10 @@ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id)
+ if (desc.state) {
+ /* found the group desc: update */
+ nvme_update_ns_ana_state(&desc, ns);
++ } else {
++ /* group desc not found: trigger a re-read */
++ set_bit(NVME_NS_ANA_PENDING, &ns->flags);
++ queue_work(nvme_wq, &ns->ctrl->ana_work);
+ }
+ } else {
+ mutex_lock(&ns->head->lock);
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 21160a08ead4b..800ad252cf9c6 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1172,16 +1172,8 @@ int __init __weak early_init_dt_mark_hotplug_memory_arch(u64 base, u64 size)
+ int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
+ phys_addr_t size, bool nomap)
+ {
+- if (nomap) {
+- /*
+- * If the memory is already reserved (by another region), we
+- * should not allow it to be marked nomap.
+- */
+- if (memblock_is_region_reserved(base, size))
+- return -EBUSY;
+-
+- return memblock_mark_nomap(base, size);
+- }
++ if (nomap)
++ return memblock_remove(base, size);
+ return memblock_reserve(base, size);
+ }
+
+diff --git a/drivers/pci/controller/pci-thunder-ecam.c b/drivers/pci/controller/pci-thunder-ecam.c
+index 32d1d7b81ef4e..18715d2ce0229 100644
+--- a/drivers/pci/controller/pci-thunder-ecam.c
++++ b/drivers/pci/controller/pci-thunder-ecam.c
+@@ -116,7 +116,7 @@ static int thunder_ecam_p2_config_read(struct pci_bus *bus, unsigned int devfn,
+ * the config space access window. Since we are working with
+ * the high-order 32 bits, shift everything down by 32 bits.
+ */
+- node_bits = (cfg->res.start >> 32) & (1 << 12);
++ node_bits = upper_32_bits(cfg->res.start) & (1 << 12);
+
+ v |= node_bits;
+ set_val(v, where, size, val);
+diff --git a/drivers/pci/controller/pci-thunder-pem.c b/drivers/pci/controller/pci-thunder-pem.c
+index f127ce8bd4ef3..1650ec2c35f9a 100644
+--- a/drivers/pci/controller/pci-thunder-pem.c
++++ b/drivers/pci/controller/pci-thunder-pem.c
+@@ -11,6 +11,7 @@
+ #include <linux/pci-acpi.h>
+ #include <linux/pci-ecam.h>
+ #include <linux/platform_device.h>
++#include <linux/io-64-nonatomic-lo-hi.h>
+ #include "../pci.h"
+
+ #if defined(CONFIG_PCI_HOST_THUNDER_PEM) || (defined(CONFIG_ACPI) && defined(CONFIG_PCI_QUIRKS))
+@@ -314,9 +315,9 @@ static int thunder_pem_init(struct device *dev, struct pci_config_window *cfg,
+ * structure here for the BAR.
+ */
+ bar4_start = res_pem->start + 0xf00000;
+- pem_pci->ea_entry[0] = (u32)bar4_start | 2;
+- pem_pci->ea_entry[1] = (u32)(res_pem->end - bar4_start) & ~3u;
+- pem_pci->ea_entry[2] = (u32)(bar4_start >> 32);
++ pem_pci->ea_entry[0] = lower_32_bits(bar4_start) | 2;
++ pem_pci->ea_entry[1] = lower_32_bits(res_pem->end - bar4_start) & ~3u;
++ pem_pci->ea_entry[2] = upper_32_bits(bar4_start);
+
+ cfg->priv = pem_pci;
+ return 0;
+@@ -324,9 +325,9 @@ static int thunder_pem_init(struct device *dev, struct pci_config_window *cfg,
+
+ #if defined(CONFIG_ACPI) && defined(CONFIG_PCI_QUIRKS)
+
+-#define PEM_RES_BASE 0x87e0c0000000UL
+-#define PEM_NODE_MASK GENMASK(45, 44)
+-#define PEM_INDX_MASK GENMASK(26, 24)
++#define PEM_RES_BASE 0x87e0c0000000ULL
++#define PEM_NODE_MASK GENMASK_ULL(45, 44)
++#define PEM_INDX_MASK GENMASK_ULL(26, 24)
+ #define PEM_MIN_DOM_IN_NODE 4
+ #define PEM_MAX_DOM_IN_NODE 10
+
+diff --git a/drivers/pci/controller/pcie-iproc-msi.c b/drivers/pci/controller/pcie-iproc-msi.c
+index ea612382599cf..dc953c73cb56a 100644
+--- a/drivers/pci/controller/pcie-iproc-msi.c
++++ b/drivers/pci/controller/pcie-iproc-msi.c
+@@ -271,7 +271,7 @@ static int iproc_msi_irq_domain_alloc(struct irq_domain *domain,
+ NULL, NULL);
+ }
+
+- return hwirq;
++ return 0;
+ }
+
+ static void iproc_msi_irq_domain_free(struct irq_domain *domain,
+diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
+index 4bbd26e8a9e2f..09a1e449cd1c6 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-test.c
++++ b/drivers/pci/endpoint/functions/pci-epf-test.c
+@@ -572,6 +572,7 @@ static int __init pci_epf_test_init(void)
+ WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+ ret = pci_epf_register_driver(&test_driver);
+ if (ret) {
++ destroy_workqueue(kpcitest_workqueue);
+ pr_err("Failed to register pci epf test driver --> %d\n", ret);
+ return ret;
+ }
+@@ -582,6 +583,8 @@ module_init(pci_epf_test_init);
+
+ static void __exit pci_epf_test_exit(void)
+ {
++ if (kpcitest_workqueue)
++ destroy_workqueue(kpcitest_workqueue);
+ pci_epf_unregister_driver(&test_driver);
+ }
+ module_exit(pci_epf_test_exit);
+diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
+index be35bbfa69687..3d8844e7090a8 100644
+--- a/drivers/pci/hotplug/acpiphp_glue.c
++++ b/drivers/pci/hotplug/acpiphp_glue.c
+@@ -540,6 +540,7 @@ static void enable_slot(struct acpiphp_slot *slot, bool bridge)
+ slot->flags &= ~SLOT_ENABLED;
+ continue;
+ }
++ pci_dev_put(dev);
+ }
+ }
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 9ebf32de85757..3d59bbe4a5d56 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1585,20 +1585,10 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags)
+ int err;
+ int i, bars = 0;
+
+- /*
+- * Power state could be unknown at this point, either due to a fresh
+- * boot or a device removal call. So get the current power state
+- * so that things like MSI message writing will behave as expected
+- * (e.g. if the device really is in D0 at enable time).
+- */
+- if (dev->pm_cap) {
+- u16 pmcsr;
+- pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
+- dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK);
+- }
+-
+- if (atomic_inc_return(&dev->enable_cnt) > 1)
++ if (atomic_inc_return(&dev->enable_cnt) > 1) {
++ pci_update_current_state(dev, dev->current_state);
+ return 0; /* already enabled */
++ }
+
+ bridge = pci_upstream_bridge(dev);
+ if (bridge)
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index e9ede82ee2c25..39725b71300f8 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -473,6 +473,12 @@ static inline int pci_dev_specific_reset(struct pci_dev *dev, int probe)
+ #if defined(CONFIG_PCI_QUIRKS) && defined(CONFIG_ARM64)
+ int acpi_get_rc_resources(struct device *dev, const char *hid, u16 segment,
+ struct resource *res);
++#else
++static inline int acpi_get_rc_resources(struct device *dev, const char *hid,
++ u16 segment, struct resource *res)
++{
++ return -ENODEV;
++}
+ #endif
+
+ u32 pci_rebar_get_possible_sizes(struct pci_dev *pdev, int bar);
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 9a5b6a8e2502f..113b7bdf86dd9 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -2359,6 +2359,7 @@ static struct pci_dev *pci_scan_device(struct pci_bus *bus, int devfn)
+ pci_set_of_node(dev);
+
+ if (pci_setup_device(dev)) {
++ pci_release_of_node(dev);
+ pci_bus_put(dev->bus);
+ kfree(dev);
+ return NULL;
+diff --git a/drivers/perf/arm_pmu_platform.c b/drivers/perf/arm_pmu_platform.c
+index 96075cecb0aec..199293450acfc 100644
+--- a/drivers/perf/arm_pmu_platform.c
++++ b/drivers/perf/arm_pmu_platform.c
+@@ -236,7 +236,7 @@ int arm_pmu_device_probe(struct platform_device *pdev,
+
+ ret = armpmu_register(pmu);
+ if (ret)
+- goto out_free;
++ goto out_free_irqs;
+
+ return 0;
+
+diff --git a/drivers/phy/marvell/Kconfig b/drivers/phy/marvell/Kconfig
+index 68e3212254005..ed4d3904e53f9 100644
+--- a/drivers/phy/marvell/Kconfig
++++ b/drivers/phy/marvell/Kconfig
+@@ -2,8 +2,8 @@
+ # Phy drivers for Marvell platforms
+ #
+ config ARMADA375_USBCLUSTER_PHY
+- def_bool y
+- depends on MACH_ARMADA_375 || COMPILE_TEST
++ bool "Armada 375 USB cluster PHY support" if COMPILE_TEST
++ default y if MACH_ARMADA_375
+ depends on OF && HAS_IOMEM
+ select GENERIC_PHY
+
+diff --git a/drivers/phy/ti/phy-twl4030-usb.c b/drivers/phy/ti/phy-twl4030-usb.c
+index c267afb68f077..ea7564392108c 100644
+--- a/drivers/phy/ti/phy-twl4030-usb.c
++++ b/drivers/phy/ti/phy-twl4030-usb.c
+@@ -801,7 +801,7 @@ static int twl4030_usb_remove(struct platform_device *pdev)
+
+ usb_remove_phy(&twl->phy);
+ pm_runtime_get_sync(twl->dev);
+- cancel_delayed_work(&twl->id_workaround_work);
++ cancel_delayed_work_sync(&twl->id_workaround_work);
+ device_remove_file(twl->dev, &dev_attr_vbus);
+
+ /* set transceiver mode to power on defaults */
+diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c
+index a5accffbc8c91..babf6d011264e 100644
+--- a/drivers/pinctrl/pinctrl-ingenic.c
++++ b/drivers/pinctrl/pinctrl-ingenic.c
+@@ -642,7 +642,8 @@ static int ingenic_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,
+ break;
+
+ default:
+- unreachable();
++ /* unreachable */
++ break;
+ }
+ }
+
+diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c
+index 24956f6c6324f..7f764f751c4f1 100644
+--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
+@@ -55,7 +55,7 @@ static void exynos_irq_mask(struct irq_data *irqd)
+ struct exynos_irq_chip *our_chip = to_exynos_irq_chip(chip);
+ struct samsung_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+ unsigned long reg_mask = our_chip->eint_mask + bank->eint_offset;
+- unsigned long mask;
++ unsigned int mask;
+ unsigned long flags;
+
+ spin_lock_irqsave(&bank->slock, flags);
+@@ -83,7 +83,7 @@ static void exynos_irq_unmask(struct irq_data *irqd)
+ struct exynos_irq_chip *our_chip = to_exynos_irq_chip(chip);
+ struct samsung_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+ unsigned long reg_mask = our_chip->eint_mask + bank->eint_offset;
+- unsigned long mask;
++ unsigned int mask;
+ unsigned long flags;
+
+ /*
+@@ -482,7 +482,7 @@ static void exynos_irq_eint0_15(struct irq_desc *desc)
+ chained_irq_exit(chip, desc);
+ }
+
+-static inline void exynos_irq_demux_eint(unsigned long pend,
++static inline void exynos_irq_demux_eint(unsigned int pend,
+ struct irq_domain *domain)
+ {
+ unsigned int irq;
+@@ -499,8 +499,8 @@ static void exynos_irq_demux_eint16_31(struct irq_desc *desc)
+ {
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+ struct exynos_muxed_weint_data *eintd = irq_desc_get_handler_data(desc);
+- unsigned long pend;
+- unsigned long mask;
++ unsigned int pend;
++ unsigned int mask;
+ int i;
+
+ chained_irq_enter(chip, desc);
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index 26351e9e0aafe..682fc49d172cb 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -423,34 +423,10 @@ static const struct dmi_system_id critclk_systems[] = {
+ },
+ {
+ /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB3163",
++ .ident = "Beckhoff Baytrail",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB3163"),
+- },
+- },
+- {
+- /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB4063",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB4063"),
+- },
+- },
+- {
+- /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB6263",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB6263"),
+- },
+- },
+- {
+- /* pmc_plt_clk* - are used for ethernet controllers */
+- .ident = "Beckhoff CB6363",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
+- DMI_MATCH(DMI_BOARD_NAME, "CB6363"),
++ DMI_MATCH(DMI_PRODUCT_FAMILY, "CBxx63"),
+ },
+ },
+ {
+diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
+index 93e3d9c747aa0..b7dc881268666 100644
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -1490,27 +1490,6 @@ static int bq27xxx_battery_read_time(struct bq27xxx_device_info *di, u8 reg)
+ return tval * 60;
+ }
+
+-/*
+- * Read an average power register.
+- * Return < 0 if something fails.
+- */
+-static int bq27xxx_battery_read_pwr_avg(struct bq27xxx_device_info *di)
+-{
+- int tval;
+-
+- tval = bq27xxx_read(di, BQ27XXX_REG_AP, false);
+- if (tval < 0) {
+- dev_err(di->dev, "error reading average power register %02x: %d\n",
+- BQ27XXX_REG_AP, tval);
+- return tval;
+- }
+-
+- if (di->opts & BQ27XXX_O_ZERO)
+- return (tval * BQ27XXX_POWER_CONSTANT) / BQ27XXX_RS;
+- else
+- return tval;
+-}
+-
+ /*
+ * Returns true if a battery over temperature condition is detected
+ */
+@@ -1607,8 +1586,6 @@ void bq27xxx_battery_update(struct bq27xxx_device_info *di)
+ }
+ if (di->regs[BQ27XXX_REG_CYCT] != INVALID_REG_ADDR)
+ cache.cycle_count = bq27xxx_battery_read_cyct(di);
+- if (di->regs[BQ27XXX_REG_AP] != INVALID_REG_ADDR)
+- cache.power_avg = bq27xxx_battery_read_pwr_avg(di);
+
+ /* We only have to read charge design full once */
+ if (di->charge_design_full <= 0)
+@@ -1670,6 +1647,32 @@ static int bq27xxx_battery_current(struct bq27xxx_device_info *di,
+ return 0;
+ }
+
++/*
++ * Get the average power in µW
++ * Return < 0 if something fails.
++ */
++static int bq27xxx_battery_pwr_avg(struct bq27xxx_device_info *di,
++ union power_supply_propval *val)
++{
++ int power;
++
++ power = bq27xxx_read(di, BQ27XXX_REG_AP, false);
++ if (power < 0) {
++ dev_err(di->dev,
++ "error reading average power register %02x: %d\n",
++ BQ27XXX_REG_AP, power);
++ return power;
++ }
++
++ if (di->opts & BQ27XXX_O_ZERO)
++ val->intval = (power * BQ27XXX_POWER_CONSTANT) / BQ27XXX_RS;
++ else
++ /* Other gauges return a signed value in units of 10mW */
++ val->intval = (int)((s16)power) * 10000;
++
++ return 0;
++}
++
+ static int bq27xxx_battery_status(struct bq27xxx_device_info *di,
+ union power_supply_propval *val)
+ {
+@@ -1837,7 +1840,7 @@ static int bq27xxx_battery_get_property(struct power_supply *psy,
+ ret = bq27xxx_simple_value(di->cache.energy, val);
+ break;
+ case POWER_SUPPLY_PROP_POWER_AVG:
+- ret = bq27xxx_simple_value(di->cache.power_avg, val);
++ ret = bq27xxx_battery_pwr_avg(di, val);
+ break;
+ case POWER_SUPPLY_PROP_HEALTH:
+ ret = bq27xxx_simple_value(di->cache.health, val);
+diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c
+index bc462d1ec9630..97b0e873e87d2 100644
+--- a/drivers/power/supply/generic-adc-battery.c
++++ b/drivers/power/supply/generic-adc-battery.c
+@@ -382,7 +382,7 @@ static int gab_remove(struct platform_device *pdev)
+ }
+
+ kfree(adc_bat->psy_desc.properties);
+- cancel_delayed_work(&adc_bat->bat_work);
++ cancel_delayed_work_sync(&adc_bat->bat_work);
+ return 0;
+ }
+
+diff --git a/drivers/power/supply/lp8788-charger.c b/drivers/power/supply/lp8788-charger.c
+index b8f7dac7ac3fe..6dcabbeccde12 100644
+--- a/drivers/power/supply/lp8788-charger.c
++++ b/drivers/power/supply/lp8788-charger.c
+@@ -529,7 +529,7 @@ static int lp8788_set_irqs(struct platform_device *pdev,
+
+ ret = request_threaded_irq(virq, NULL,
+ lp8788_charger_irq_thread,
+- 0, name, pchg);
++ IRQF_ONESHOT, name, pchg);
+ if (ret)
+ break;
+ }
+diff --git a/drivers/power/supply/pm2301_charger.c b/drivers/power/supply/pm2301_charger.c
+index 78561b6884fc7..9ef218d76aa9c 100644
+--- a/drivers/power/supply/pm2301_charger.c
++++ b/drivers/power/supply/pm2301_charger.c
+@@ -1098,7 +1098,7 @@ static int pm2xxx_wall_charger_probe(struct i2c_client *i2c_client,
+ ret = request_threaded_irq(gpio_to_irq(pm2->pdata->gpio_irq_number),
+ NULL,
+ pm2xxx_charger_irq[0].isr,
+- pm2->pdata->irq_type,
++ pm2->pdata->irq_type | IRQF_ONESHOT,
+ pm2xxx_charger_irq[0].name, pm2);
+
+ if (ret != 0) {
+diff --git a/drivers/power/supply/s3c_adc_battery.c b/drivers/power/supply/s3c_adc_battery.c
+index 3d00b35cafc9e..8be31f80035c6 100644
+--- a/drivers/power/supply/s3c_adc_battery.c
++++ b/drivers/power/supply/s3c_adc_battery.c
+@@ -394,7 +394,7 @@ static int s3c_adc_bat_remove(struct platform_device *pdev)
+ gpio_free(pdata->gpio_charge_finished);
+ }
+
+- cancel_delayed_work(&bat_work);
++ cancel_delayed_work_sync(&bat_work);
+
+ if (pdata->exit)
+ pdata->exit();
+diff --git a/drivers/power/supply/tps65090-charger.c b/drivers/power/supply/tps65090-charger.c
+index 1b4b5e09538e1..297bf58f0d4fb 100644
+--- a/drivers/power/supply/tps65090-charger.c
++++ b/drivers/power/supply/tps65090-charger.c
+@@ -311,7 +311,7 @@ static int tps65090_charger_probe(struct platform_device *pdev)
+
+ if (irq != -ENXIO) {
+ ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
+- tps65090_charger_isr, 0, "tps65090-charger", cdata);
++ tps65090_charger_isr, IRQF_ONESHOT, "tps65090-charger", cdata);
+ if (ret) {
+ dev_err(cdata->dev,
+ "Unable to register irq %d err %d\n", irq,
+diff --git a/drivers/power/supply/tps65217_charger.c b/drivers/power/supply/tps65217_charger.c
+index 814c2b81fdfec..ba33d1617e0b6 100644
+--- a/drivers/power/supply/tps65217_charger.c
++++ b/drivers/power/supply/tps65217_charger.c
+@@ -238,7 +238,7 @@ static int tps65217_charger_probe(struct platform_device *pdev)
+ for (i = 0; i < NUM_CHARGER_IRQS; i++) {
+ ret = devm_request_threaded_irq(&pdev->dev, irq[i], NULL,
+ tps65217_charger_irq,
+- 0, "tps65217-charger",
++ IRQF_ONESHOT, "tps65217-charger",
+ charger);
+ if (ret) {
+ dev_err(charger->dev,
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index a755f85686e53..8fa0f0eaaf430 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -857,6 +857,7 @@ static int qcom_glink_rx_data(struct qcom_glink *glink, size_t avail)
+ dev_err(glink->dev,
+ "no intent found for channel %s intent %d",
+ channel->name, liid);
++ ret = -ENOENT;
+ goto advance_rx;
+ }
+ }
+diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
+index ebd59e86a567b..94d31779933f1 100644
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -434,7 +434,11 @@ static int ds1307_get_time(struct device *dev, struct rtc_time *t)
+ t->tm_min = bcd2bin(regs[DS1307_REG_MIN] & 0x7f);
+ tmp = regs[DS1307_REG_HOUR] & 0x3f;
+ t->tm_hour = bcd2bin(tmp);
+- t->tm_wday = bcd2bin(regs[DS1307_REG_WDAY] & 0x07) - 1;
++ /* rx8130 is bit position, not BCD */
++ if (ds1307->type == rx_8130)
++ t->tm_wday = fls(regs[DS1307_REG_WDAY] & 0x7f);
++ else
++ t->tm_wday = bcd2bin(regs[DS1307_REG_WDAY] & 0x07) - 1;
+ t->tm_mday = bcd2bin(regs[DS1307_REG_MDAY] & 0x3f);
+ tmp = regs[DS1307_REG_MONTH] & 0x1f;
+ t->tm_mon = bcd2bin(tmp) - 1;
+@@ -481,7 +485,11 @@ static int ds1307_set_time(struct device *dev, struct rtc_time *t)
+ regs[DS1307_REG_SECS] = bin2bcd(t->tm_sec);
+ regs[DS1307_REG_MIN] = bin2bcd(t->tm_min);
+ regs[DS1307_REG_HOUR] = bin2bcd(t->tm_hour);
+- regs[DS1307_REG_WDAY] = bin2bcd(t->tm_wday + 1);
++ /* rx8130 is bit position, not BCD */
++ if (ds1307->type == rx_8130)
++ regs[DS1307_REG_WDAY] = 1 << t->tm_wday;
++ else
++ regs[DS1307_REG_WDAY] = bin2bcd(t->tm_wday + 1);
+ regs[DS1307_REG_MDAY] = bin2bcd(t->tm_mday);
+ regs[DS1307_REG_MONTH] = bin2bcd(t->tm_mon + 1);
+
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index 60c48dc5d9453..efd2b43125286 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -579,10 +579,11 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ * even though it shouldn't according to T10.
+ * The retry without rtpg_ext_hdr_req set
+ * handles this.
++ * Note: some arrays return a sense key of ILLEGAL_REQUEST
++ * with ASC 00h if they don't support the extended header.
+ */
+ if (!(pg->flags & ALUA_RTPG_EXT_HDR_UNSUPP) &&
+- sense_hdr.sense_key == ILLEGAL_REQUEST &&
+- sense_hdr.asc == 0x24 && sense_hdr.ascq == 0) {
++ sense_hdr.sense_key == ILLEGAL_REQUEST) {
+ pg->flags |= ALUA_RTPG_EXT_HDR_UNSUPP;
+ goto retry;
+ }
+diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
+index 50078a199fea0..b811436a46d01 100644
+--- a/drivers/scsi/ibmvscsi/ibmvfc.c
++++ b/drivers/scsi/ibmvscsi/ibmvfc.c
+@@ -506,8 +506,17 @@ static void ibmvfc_set_host_action(struct ibmvfc_host *vhost,
+ if (vhost->action == IBMVFC_HOST_ACTION_ALLOC_TGTS)
+ vhost->action = action;
+ break;
++ case IBMVFC_HOST_ACTION_REENABLE:
++ case IBMVFC_HOST_ACTION_RESET:
++ vhost->action = action;
++ break;
+ case IBMVFC_HOST_ACTION_INIT:
+ case IBMVFC_HOST_ACTION_TGT_DEL:
++ case IBMVFC_HOST_ACTION_LOGO:
++ case IBMVFC_HOST_ACTION_QUERY_TGTS:
++ case IBMVFC_HOST_ACTION_TGT_DEL_FAILED:
++ case IBMVFC_HOST_ACTION_NONE:
++ default:
+ switch (vhost->action) {
+ case IBMVFC_HOST_ACTION_RESET:
+ case IBMVFC_HOST_ACTION_REENABLE:
+@@ -517,15 +526,6 @@ static void ibmvfc_set_host_action(struct ibmvfc_host *vhost,
+ break;
+ }
+ break;
+- case IBMVFC_HOST_ACTION_LOGO:
+- case IBMVFC_HOST_ACTION_QUERY_TGTS:
+- case IBMVFC_HOST_ACTION_TGT_DEL_FAILED:
+- case IBMVFC_HOST_ACTION_NONE:
+- case IBMVFC_HOST_ACTION_RESET:
+- case IBMVFC_HOST_ACTION_REENABLE:
+- default:
+- vhost->action = action;
+- break;
+ }
+ }
+
+@@ -4346,26 +4346,45 @@ static void ibmvfc_do_work(struct ibmvfc_host *vhost)
+ case IBMVFC_HOST_ACTION_INIT_WAIT:
+ break;
+ case IBMVFC_HOST_ACTION_RESET:
+- vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
+ spin_unlock_irqrestore(vhost->host->host_lock, flags);
+ rc = ibmvfc_reset_crq(vhost);
++
+ spin_lock_irqsave(vhost->host->host_lock, flags);
+- if (rc == H_CLOSED)
++ if (!rc || rc == H_CLOSED)
+ vio_enable_interrupts(to_vio_dev(vhost->dev));
+- if (rc || (rc = ibmvfc_send_crq_init(vhost)) ||
+- (rc = vio_enable_interrupts(to_vio_dev(vhost->dev)))) {
+- ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
+- dev_err(vhost->dev, "Error after reset (rc=%d)\n", rc);
++ if (vhost->action == IBMVFC_HOST_ACTION_RESET) {
++ /*
++ * The only action we could have changed to would have
++ * been reenable, in which case, we skip the rest of
++ * this path and wait until we've done the re-enable
++ * before sending the crq init.
++ */
++ vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
++
++ if (rc || (rc = ibmvfc_send_crq_init(vhost)) ||
++ (rc = vio_enable_interrupts(to_vio_dev(vhost->dev)))) {
++ ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
++ dev_err(vhost->dev, "Error after reset (rc=%d)\n", rc);
++ }
+ }
+ break;
+ case IBMVFC_HOST_ACTION_REENABLE:
+- vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
+ spin_unlock_irqrestore(vhost->host->host_lock, flags);
+ rc = ibmvfc_reenable_crq_queue(vhost);
++
+ spin_lock_irqsave(vhost->host->host_lock, flags);
+- if (rc || (rc = ibmvfc_send_crq_init(vhost))) {
+- ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
+- dev_err(vhost->dev, "Error after enable (rc=%d)\n", rc);
++ if (vhost->action == IBMVFC_HOST_ACTION_REENABLE) {
++ /*
++ * The only action we could have changed to would have
++ * been reset, in which case, we skip the rest of this
++ * path and wait until we've done the reset before
++ * sending the crq init.
++ */
++ vhost->action = IBMVFC_HOST_ACTION_TGT_DEL;
++ if (rc || (rc = ibmvfc_send_crq_init(vhost))) {
++ ibmvfc_link_down(vhost, IBMVFC_LINK_DEAD);
++ dev_err(vhost->dev, "Error after enable (rc=%d)\n", rc);
++ }
+ }
+ break;
+ case IBMVFC_HOST_ACTION_LOGO:
+diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c
+index 6eb5ff3e2e611..7dfe4237e5e8e 100644
+--- a/drivers/scsi/jazz_esp.c
++++ b/drivers/scsi/jazz_esp.c
+@@ -170,7 +170,9 @@ static int esp_jazz_probe(struct platform_device *dev)
+ if (!esp->command_block)
+ goto fail_unmap_regs;
+
+- host->irq = platform_get_irq(dev, 0);
++ host->irq = err = platform_get_irq(dev, 0);
++ if (err < 0)
++ goto fail_unmap_command_block;
+ err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, "ESP", esp);
+ if (err < 0)
+ goto fail_unmap_command_block;
+diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
+index ff943f477d6f0..f653109d56af0 100644
+--- a/drivers/scsi/libfc/fc_lport.c
++++ b/drivers/scsi/libfc/fc_lport.c
+@@ -1741,7 +1741,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
+
+ if (mfs < FC_SP_MIN_MAX_PAYLOAD || mfs > FC_SP_MAX_MAX_PAYLOAD) {
+ FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, "
+- "lport->mfs:%hu\n", mfs, lport->mfs);
++ "lport->mfs:%u\n", mfs, lport->mfs);
+ fc_lport_error(lport, fp);
+ goto out;
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
+index bea24bc4410a7..1a0b1cb9de787 100644
+--- a/drivers/scsi/lpfc/lpfc_crtn.h
++++ b/drivers/scsi/lpfc/lpfc_crtn.h
+@@ -56,9 +56,6 @@ void lpfc_register_new_vport(struct lpfc_hba *, struct lpfc_vport *,
+ void lpfc_unreg_vpi(struct lpfc_hba *, uint16_t, LPFC_MBOXQ_t *);
+ void lpfc_init_link(struct lpfc_hba *, LPFC_MBOXQ_t *, uint32_t, uint32_t);
+ void lpfc_request_features(struct lpfc_hba *, struct lpfcMboxq *);
+-void lpfc_supported_pages(struct lpfcMboxq *);
+-void lpfc_pc_sli4_params(struct lpfcMboxq *);
+-int lpfc_pc_sli4_params_get(struct lpfc_hba *, LPFC_MBOXQ_t *);
+ int lpfc_sli4_mbox_rsrc_extent(struct lpfc_hba *, struct lpfcMboxq *,
+ uint16_t, uint16_t, bool);
+ int lpfc_get_sli4_parameters(struct lpfc_hba *, LPFC_MBOXQ_t *);
+diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h
+index 083f8c8706e51..a9bd12bfc15e5 100644
+--- a/drivers/scsi/lpfc/lpfc_hw4.h
++++ b/drivers/scsi/lpfc/lpfc_hw4.h
+@@ -122,6 +122,7 @@ struct lpfc_sli_intf {
+ /* Define SLI4 Alignment requirements. */
+ #define LPFC_ALIGN_16_BYTE 16
+ #define LPFC_ALIGN_64_BYTE 64
++#define SLI4_PAGE_SIZE 4096
+
+ /* Define SLI4 specific definitions. */
+ #define LPFC_MQ_CQE_BYTE_OFFSET 256
+@@ -2886,62 +2887,6 @@ struct lpfc_mbx_request_features {
+ #define lpfc_mbx_rq_ftr_rsp_mrqp_WORD word3
+ };
+
+-struct lpfc_mbx_supp_pages {
+- uint32_t word1;
+-#define qs_SHIFT 0
+-#define qs_MASK 0x00000001
+-#define qs_WORD word1
+-#define wr_SHIFT 1
+-#define wr_MASK 0x00000001
+-#define wr_WORD word1
+-#define pf_SHIFT 8
+-#define pf_MASK 0x000000ff
+-#define pf_WORD word1
+-#define cpn_SHIFT 16
+-#define cpn_MASK 0x000000ff
+-#define cpn_WORD word1
+- uint32_t word2;
+-#define list_offset_SHIFT 0
+-#define list_offset_MASK 0x000000ff
+-#define list_offset_WORD word2
+-#define next_offset_SHIFT 8
+-#define next_offset_MASK 0x000000ff
+-#define next_offset_WORD word2
+-#define elem_cnt_SHIFT 16
+-#define elem_cnt_MASK 0x000000ff
+-#define elem_cnt_WORD word2
+- uint32_t word3;
+-#define pn_0_SHIFT 24
+-#define pn_0_MASK 0x000000ff
+-#define pn_0_WORD word3
+-#define pn_1_SHIFT 16
+-#define pn_1_MASK 0x000000ff
+-#define pn_1_WORD word3
+-#define pn_2_SHIFT 8
+-#define pn_2_MASK 0x000000ff
+-#define pn_2_WORD word3
+-#define pn_3_SHIFT 0
+-#define pn_3_MASK 0x000000ff
+-#define pn_3_WORD word3
+- uint32_t word4;
+-#define pn_4_SHIFT 24
+-#define pn_4_MASK 0x000000ff
+-#define pn_4_WORD word4
+-#define pn_5_SHIFT 16
+-#define pn_5_MASK 0x000000ff
+-#define pn_5_WORD word4
+-#define pn_6_SHIFT 8
+-#define pn_6_MASK 0x000000ff
+-#define pn_6_WORD word4
+-#define pn_7_SHIFT 0
+-#define pn_7_MASK 0x000000ff
+-#define pn_7_WORD word4
+- uint32_t rsvd[27];
+-#define LPFC_SUPP_PAGES 0
+-#define LPFC_BLOCK_GUARD_PROFILES 1
+-#define LPFC_SLI4_PARAMETERS 2
+-};
+-
+ struct lpfc_mbx_memory_dump_type3 {
+ uint32_t word1;
+ #define lpfc_mbx_memory_dump_type3_type_SHIFT 0
+@@ -3158,121 +3103,6 @@ struct user_eeprom {
+ uint8_t reserved191[57];
+ };
+
+-struct lpfc_mbx_pc_sli4_params {
+- uint32_t word1;
+-#define qs_SHIFT 0
+-#define qs_MASK 0x00000001
+-#define qs_WORD word1
+-#define wr_SHIFT 1
+-#define wr_MASK 0x00000001
+-#define wr_WORD word1
+-#define pf_SHIFT 8
+-#define pf_MASK 0x000000ff
+-#define pf_WORD word1
+-#define cpn_SHIFT 16
+-#define cpn_MASK 0x000000ff
+-#define cpn_WORD word1
+- uint32_t word2;
+-#define if_type_SHIFT 0
+-#define if_type_MASK 0x00000007
+-#define if_type_WORD word2
+-#define sli_rev_SHIFT 4
+-#define sli_rev_MASK 0x0000000f
+-#define sli_rev_WORD word2
+-#define sli_family_SHIFT 8
+-#define sli_family_MASK 0x000000ff
+-#define sli_family_WORD word2
+-#define featurelevel_1_SHIFT 16
+-#define featurelevel_1_MASK 0x000000ff
+-#define featurelevel_1_WORD word2
+-#define featurelevel_2_SHIFT 24
+-#define featurelevel_2_MASK 0x0000001f
+-#define featurelevel_2_WORD word2
+- uint32_t word3;
+-#define fcoe_SHIFT 0
+-#define fcoe_MASK 0x00000001
+-#define fcoe_WORD word3
+-#define fc_SHIFT 1
+-#define fc_MASK 0x00000001
+-#define fc_WORD word3
+-#define nic_SHIFT 2
+-#define nic_MASK 0x00000001
+-#define nic_WORD word3
+-#define iscsi_SHIFT 3
+-#define iscsi_MASK 0x00000001
+-#define iscsi_WORD word3
+-#define rdma_SHIFT 4
+-#define rdma_MASK 0x00000001
+-#define rdma_WORD word3
+- uint32_t sge_supp_len;
+-#define SLI4_PAGE_SIZE 4096
+- uint32_t word5;
+-#define if_page_sz_SHIFT 0
+-#define if_page_sz_MASK 0x0000ffff
+-#define if_page_sz_WORD word5
+-#define loopbk_scope_SHIFT 24
+-#define loopbk_scope_MASK 0x0000000f
+-#define loopbk_scope_WORD word5
+-#define rq_db_window_SHIFT 28
+-#define rq_db_window_MASK 0x0000000f
+-#define rq_db_window_WORD word5
+- uint32_t word6;
+-#define eq_pages_SHIFT 0
+-#define eq_pages_MASK 0x0000000f
+-#define eq_pages_WORD word6
+-#define eqe_size_SHIFT 8
+-#define eqe_size_MASK 0x000000ff
+-#define eqe_size_WORD word6
+- uint32_t word7;
+-#define cq_pages_SHIFT 0
+-#define cq_pages_MASK 0x0000000f
+-#define cq_pages_WORD word7
+-#define cqe_size_SHIFT 8
+-#define cqe_size_MASK 0x000000ff
+-#define cqe_size_WORD word7
+- uint32_t word8;
+-#define mq_pages_SHIFT 0
+-#define mq_pages_MASK 0x0000000f
+-#define mq_pages_WORD word8
+-#define mqe_size_SHIFT 8
+-#define mqe_size_MASK 0x000000ff
+-#define mqe_size_WORD word8
+-#define mq_elem_cnt_SHIFT 16
+-#define mq_elem_cnt_MASK 0x000000ff
+-#define mq_elem_cnt_WORD word8
+- uint32_t word9;
+-#define wq_pages_SHIFT 0
+-#define wq_pages_MASK 0x0000ffff
+-#define wq_pages_WORD word9
+-#define wqe_size_SHIFT 8
+-#define wqe_size_MASK 0x000000ff
+-#define wqe_size_WORD word9
+- uint32_t word10;
+-#define rq_pages_SHIFT 0
+-#define rq_pages_MASK 0x0000ffff
+-#define rq_pages_WORD word10
+-#define rqe_size_SHIFT 8
+-#define rqe_size_MASK 0x000000ff
+-#define rqe_size_WORD word10
+- uint32_t word11;
+-#define hdr_pages_SHIFT 0
+-#define hdr_pages_MASK 0x0000000f
+-#define hdr_pages_WORD word11
+-#define hdr_size_SHIFT 8
+-#define hdr_size_MASK 0x0000000f
+-#define hdr_size_WORD word11
+-#define hdr_pp_align_SHIFT 16
+-#define hdr_pp_align_MASK 0x0000ffff
+-#define hdr_pp_align_WORD word11
+- uint32_t word12;
+-#define sgl_pages_SHIFT 0
+-#define sgl_pages_MASK 0x0000000f
+-#define sgl_pages_WORD word12
+-#define sgl_pp_align_SHIFT 16
+-#define sgl_pp_align_MASK 0x0000ffff
+-#define sgl_pp_align_WORD word12
+- uint32_t rsvd_13_63[51];
+-};
+ #define SLI4_PAGE_ALIGN(addr) (((addr)+((SLI4_PAGE_SIZE)-1)) \
+ &(~((SLI4_PAGE_SIZE)-1)))
+
+@@ -3854,8 +3684,6 @@ struct lpfc_mqe {
+ struct lpfc_mbx_post_hdr_tmpl hdr_tmpl;
+ struct lpfc_mbx_query_fw_config query_fw_cfg;
+ struct lpfc_mbx_set_beacon_config beacon_config;
+- struct lpfc_mbx_supp_pages supp_pages;
+- struct lpfc_mbx_pc_sli4_params sli4_params;
+ struct lpfc_mbx_get_sli4_parameters get_sli4_parameters;
+ struct lpfc_mbx_set_link_diag_state link_diag_state;
+ struct lpfc_mbx_set_link_diag_loopback link_diag_loopback;
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 57510a831735b..c6caacaa3e7a3 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -5854,8 +5854,6 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
+ LPFC_MBOXQ_t *mboxq;
+ MAILBOX_t *mb;
+ int rc, i, max_buf_size;
+- uint8_t pn_page[LPFC_MAX_SUPPORTED_PAGES] = {0};
+- struct lpfc_mqe *mqe;
+ int longs;
+ int fof_vectors = 0;
+ int extra;
+@@ -6150,32 +6148,6 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
+
+ lpfc_nvme_mod_param_dep(phba);
+
+- /* Get the Supported Pages if PORT_CAPABILITIES is supported by port. */
+- lpfc_supported_pages(mboxq);
+- rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_POLL);
+- if (!rc) {
+- mqe = &mboxq->u.mqe;
+- memcpy(&pn_page[0], ((uint8_t *)&mqe->un.supp_pages.word3),
+- LPFC_MAX_SUPPORTED_PAGES);
+- for (i = 0; i < LPFC_MAX_SUPPORTED_PAGES; i++) {
+- switch (pn_page[i]) {
+- case LPFC_SLI4_PARAMETERS:
+- phba->sli4_hba.pc_sli4_params.supported = 1;
+- break;
+- default:
+- break;
+- }
+- }
+- /* Read the port's SLI4 Parameters capabilities if supported. */
+- if (phba->sli4_hba.pc_sli4_params.supported)
+- rc = lpfc_pc_sli4_params_get(phba, mboxq);
+- if (rc) {
+- mempool_free(mboxq, phba->mbox_mem_pool);
+- rc = -EIO;
+- goto out_free_bsmbx;
+- }
+- }
+-
+ /*
+ * Get sli4 parameters that override parameters from Port capabilities.
+ * If this call fails, it isn't critical unless the SLI4 parameters come
+@@ -10517,78 +10489,6 @@ lpfc_sli4_hba_unset(struct lpfc_hba *phba)
+ phba->pport->work_port_events = 0;
+ }
+
+- /**
+- * lpfc_pc_sli4_params_get - Get the SLI4_PARAMS port capabilities.
+- * @phba: Pointer to HBA context object.
+- * @mboxq: Pointer to the mailboxq memory for the mailbox command response.
+- *
+- * This function is called in the SLI4 code path to read the port's
+- * sli4 capabilities.
+- *
+- * This function may be be called from any context that can block-wait
+- * for the completion. The expectation is that this routine is called
+- * typically from probe_one or from the online routine.
+- **/
+-int
+-lpfc_pc_sli4_params_get(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
+-{
+- int rc;
+- struct lpfc_mqe *mqe;
+- struct lpfc_pc_sli4_params *sli4_params;
+- uint32_t mbox_tmo;
+-
+- rc = 0;
+- mqe = &mboxq->u.mqe;
+-
+- /* Read the port's SLI4 Parameters port capabilities */
+- lpfc_pc_sli4_params(mboxq);
+- if (!phba->sli4_hba.intr_enable)
+- rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_POLL);
+- else {
+- mbox_tmo = lpfc_mbox_tmo_val(phba, mboxq);
+- rc = lpfc_sli_issue_mbox_wait(phba, mboxq, mbox_tmo);
+- }
+-
+- if (unlikely(rc))
+- return 1;
+-
+- sli4_params = &phba->sli4_hba.pc_sli4_params;
+- sli4_params->if_type = bf_get(if_type, &mqe->un.sli4_params);
+- sli4_params->sli_rev = bf_get(sli_rev, &mqe->un.sli4_params);
+- sli4_params->sli_family = bf_get(sli_family, &mqe->un.sli4_params);
+- sli4_params->featurelevel_1 = bf_get(featurelevel_1,
+- &mqe->un.sli4_params);
+- sli4_params->featurelevel_2 = bf_get(featurelevel_2,
+- &mqe->un.sli4_params);
+- sli4_params->proto_types = mqe->un.sli4_params.word3;
+- sli4_params->sge_supp_len = mqe->un.sli4_params.sge_supp_len;
+- sli4_params->if_page_sz = bf_get(if_page_sz, &mqe->un.sli4_params);
+- sli4_params->rq_db_window = bf_get(rq_db_window, &mqe->un.sli4_params);
+- sli4_params->loopbk_scope = bf_get(loopbk_scope, &mqe->un.sli4_params);
+- sli4_params->eq_pages_max = bf_get(eq_pages, &mqe->un.sli4_params);
+- sli4_params->eqe_size = bf_get(eqe_size, &mqe->un.sli4_params);
+- sli4_params->cq_pages_max = bf_get(cq_pages, &mqe->un.sli4_params);
+- sli4_params->cqe_size = bf_get(cqe_size, &mqe->un.sli4_params);
+- sli4_params->mq_pages_max = bf_get(mq_pages, &mqe->un.sli4_params);
+- sli4_params->mqe_size = bf_get(mqe_size, &mqe->un.sli4_params);
+- sli4_params->mq_elem_cnt = bf_get(mq_elem_cnt, &mqe->un.sli4_params);
+- sli4_params->wq_pages_max = bf_get(wq_pages, &mqe->un.sli4_params);
+- sli4_params->wqe_size = bf_get(wqe_size, &mqe->un.sli4_params);
+- sli4_params->rq_pages_max = bf_get(rq_pages, &mqe->un.sli4_params);
+- sli4_params->rqe_size = bf_get(rqe_size, &mqe->un.sli4_params);
+- sli4_params->hdr_pages_max = bf_get(hdr_pages, &mqe->un.sli4_params);
+- sli4_params->hdr_size = bf_get(hdr_size, &mqe->un.sli4_params);
+- sli4_params->hdr_pp_align = bf_get(hdr_pp_align, &mqe->un.sli4_params);
+- sli4_params->sgl_pages_max = bf_get(sgl_pages, &mqe->un.sli4_params);
+- sli4_params->sgl_pp_align = bf_get(sgl_pp_align, &mqe->un.sli4_params);
+-
+- /* Make sure that sge_supp_len can be handled by the driver */
+- if (sli4_params->sge_supp_len > LPFC_MAX_SGE_SIZE)
+- sli4_params->sge_supp_len = LPFC_MAX_SGE_SIZE;
+-
+- return rc;
+-}
+-
+ /**
+ * lpfc_get_sli4_parameters - Get the SLI4 Config PARAMETERS.
+ * @phba: Pointer to HBA context object.
+@@ -10647,7 +10547,8 @@ lpfc_get_sli4_parameters(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
+ else
+ phba->sli3_options &= ~LPFC_SLI4_PHWQ_ENABLED;
+ sli4_params->sge_supp_len = mbx_sli4_parameters->sge_supp_len;
+- sli4_params->loopbk_scope = bf_get(loopbk_scope, mbx_sli4_parameters);
++ sli4_params->loopbk_scope = bf_get(cfg_loopbk_scope,
++ mbx_sli4_parameters);
+ sli4_params->oas_supported = bf_get(cfg_oas, mbx_sli4_parameters);
+ sli4_params->cqv = bf_get(cfg_cqv, mbx_sli4_parameters);
+ sli4_params->mqv = bf_get(cfg_mqv, mbx_sli4_parameters);
+diff --git a/drivers/scsi/lpfc/lpfc_mbox.c b/drivers/scsi/lpfc/lpfc_mbox.c
+index e6bf5e8bc7670..a4c382d2ce792 100644
+--- a/drivers/scsi/lpfc/lpfc_mbox.c
++++ b/drivers/scsi/lpfc/lpfc_mbox.c
+@@ -2622,39 +2622,3 @@ lpfc_resume_rpi(struct lpfcMboxq *mbox, struct lpfc_nodelist *ndlp)
+ resume_rpi->event_tag = ndlp->phba->fc_eventTag;
+ }
+
+-/**
+- * lpfc_supported_pages - Initialize the PORT_CAPABILITIES supported pages
+- * mailbox command.
+- * @mbox: pointer to lpfc mbox command to initialize.
+- *
+- * The PORT_CAPABILITIES supported pages mailbox command is issued to
+- * retrieve the particular feature pages supported by the port.
+- **/
+-void
+-lpfc_supported_pages(struct lpfcMboxq *mbox)
+-{
+- struct lpfc_mbx_supp_pages *supp_pages;
+-
+- memset(mbox, 0, sizeof(*mbox));
+- supp_pages = &mbox->u.mqe.un.supp_pages;
+- bf_set(lpfc_mqe_command, &mbox->u.mqe, MBX_PORT_CAPABILITIES);
+- bf_set(cpn, supp_pages, LPFC_SUPP_PAGES);
+-}
+-
+-/**
+- * lpfc_pc_sli4_params - Initialize the PORT_CAPABILITIES SLI4 Params mbox cmd.
+- * @mbox: pointer to lpfc mbox command to initialize.
+- *
+- * The PORT_CAPABILITIES SLI4 parameters mailbox command is issued to
+- * retrieve the particular SLI4 features supported by the port.
+- **/
+-void
+-lpfc_pc_sli4_params(struct lpfcMboxq *mbox)
+-{
+- struct lpfc_mbx_pc_sli4_params *sli4_params;
+-
+- memset(mbox, 0, sizeof(*mbox));
+- sli4_params = &mbox->u.mqe.un.sli4_params;
+- bf_set(lpfc_mqe_command, &mbox->u.mqe, MBX_PORT_CAPABILITIES);
+- bf_set(cpn, sli4_params, LPFC_SLI4_PARAMETERS);
+-}
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index 3dfed191252cf..9442fb30e7cd8 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -708,9 +708,14 @@ lpfc_rcv_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ }
+ } else if ((!(ndlp->nlp_type & NLP_FABRIC) &&
+ ((ndlp->nlp_type & NLP_FCP_TARGET) ||
+- !(ndlp->nlp_type & NLP_FCP_INITIATOR))) ||
++ (ndlp->nlp_type & NLP_NVME_TARGET) ||
++ (vport->fc_flag & FC_PT2PT))) ||
+ (ndlp->nlp_state == NLP_STE_ADISC_ISSUE)) {
+- /* Only try to re-login if this is NOT a Fabric Node */
++ /* Only try to re-login if this is NOT a Fabric Node
++ * AND the remote NPORT is a FCP/NVME Target or we
++ * are in pt2pt mode. NLP_STE_ADISC_ISSUE is a special
++ * case for LOGO as a response to ADISC behavior.
++ */
+ mod_timer(&ndlp->nlp_delayfunc,
+ jiffies + msecs_to_jiffies(1000 * 1));
+ spin_lock_irq(shost->host_lock);
+@@ -1738,8 +1743,6 @@ lpfc_cmpl_reglogin_reglogin_issue(struct lpfc_vport *vport,
+ ndlp->nlp_last_elscmd = ELS_CMD_PLOGI;
+
+ lpfc_issue_els_logo(vport, ndlp, 0);
+- ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE;
+- lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE);
+ return ndlp->nlp_state;
+ }
+
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index 5bc33817568ea..23ead17e60fe2 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -2912,7 +2912,6 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba,
+ bf_set(wqe_rcvoxid, &wqe_abts->xmit_sequence.wqe_com, xri);
+
+ /* Word 10 */
+- bf_set(wqe_dbde, &wqe_abts->xmit_sequence.wqe_com, 1);
+ bf_set(wqe_iod, &wqe_abts->xmit_sequence.wqe_com, LPFC_WQE_IOD_WRITE);
+ bf_set(wqe_lenloc, &wqe_abts->xmit_sequence.wqe_com,
+ LPFC_WQE_LENLOC_WORD12);
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index a7b14875af5fa..f4633c9f8183f 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -17018,7 +17018,6 @@ lpfc_sli4_seq_abort_rsp_cmpl(struct lpfc_hba *phba,
+ if (cmd_iocbq) {
+ ndlp = (struct lpfc_nodelist *)cmd_iocbq->context1;
+ lpfc_nlp_put(ndlp);
+- lpfc_nlp_not_used(ndlp);
+ lpfc_sli_release_iocbq(phba, cmd_iocbq);
+ }
+
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index 0ab9d2fd4a14a..d46a10d24ed4b 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -1934,6 +1934,8 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost)
+ vha->qla_stats.jiffies_at_last_reset = get_jiffies_64();
+
+ if (IS_FWI2_CAPABLE(ha)) {
++ int rval;
++
+ stats = dma_alloc_coherent(&ha->pdev->dev,
+ sizeof(*stats), &stats_dma, GFP_KERNEL);
+ if (!stats) {
+@@ -1943,7 +1945,11 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost)
+ }
+
+ /* reset firmware statistics */
+- qla24xx_get_isp_stats(base_vha, stats, stats_dma, BIT_0);
++ rval = qla24xx_get_isp_stats(base_vha, stats, stats_dma, BIT_0);
++ if (rval != QLA_SUCCESS)
++ ql_log(ql_log_warn, vha, 0x70de,
++ "Resetting ISP statistics failed: rval = %d\n",
++ rval);
+
+ dma_free_coherent(&ha->pdev->dev, sizeof(*stats),
+ stats, stats_dma);
+diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
+index 47f062e96e62c..eae1665729643 100644
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -19,10 +19,11 @@ qla2x00_bsg_job_done(void *ptr, int res)
+ struct bsg_job *bsg_job = sp->u.bsg_job;
+ struct fc_bsg_reply *bsg_reply = bsg_job->reply;
+
++ sp->free(sp);
++
+ bsg_reply->result = res;
+ bsg_job_done(bsg_job, bsg_reply->result,
+ bsg_reply->reply_payload_rcv_len);
+- sp->free(sp);
+ }
+
+ void
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 83ef790afb5df..7cbdd32a238d4 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1028,8 +1028,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd,
+ if (rval != QLA_SUCCESS) {
+ ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x3078,
+ "Start scsi failed rval=%d for cmd=%p.\n", rval, cmd);
+- if (rval == QLA_INTERFACE_ERROR)
+- goto qc24_free_sp_fail_command;
+ goto qc24_host_busy_free_sp;
+ }
+
+@@ -1044,11 +1042,6 @@ qc24_host_busy:
+ qc24_target_busy:
+ return SCSI_MLQUEUE_TARGET_BUSY;
+
+-qc24_free_sp_fail_command:
+- sp->free(sp);
+- CMD_SP(cmd) = NULL;
+- qla2xxx_rel_qpair_sp(sp->qpair, sp);
+-
+ qc24_fail_command:
+ cmd->scsi_done(cmd);
+
+diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c
+index 3102a75984d3b..aed91afb79b68 100644
+--- a/drivers/scsi/sni_53c710.c
++++ b/drivers/scsi/sni_53c710.c
+@@ -71,6 +71,7 @@ static int snirm710_probe(struct platform_device *dev)
+ struct NCR_700_Host_Parameters *hostdata;
+ struct Scsi_Host *host;
+ struct resource *res;
++ int rc;
+
+ res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+ if (!res)
+@@ -96,7 +97,9 @@ static int snirm710_probe(struct platform_device *dev)
+ goto out_kfree;
+ host->this_id = 7;
+ host->base = base;
+- host->irq = platform_get_irq(dev, 0);
++ host->irq = rc = platform_get_irq(dev, 0);
++ if (rc < 0)
++ goto out_put_host;
+ if(request_irq(host->irq, NCR_700_intr, IRQF_SHARED, "snirm710", host)) {
+ printk(KERN_ERR "snirm710: request_irq failed!\n");
+ goto out_put_host;
+diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c
+index 0b1421cdf8a0e..f9aa95e48eeea 100644
+--- a/drivers/scsi/sun3x_esp.c
++++ b/drivers/scsi/sun3x_esp.c
+@@ -233,7 +233,9 @@ static int esp_sun3x_probe(struct platform_device *dev)
+ if (!esp->command_block)
+ goto fail_unmap_regs_dma;
+
+- host->irq = platform_get_irq(dev, 0);
++ host->irq = err = platform_get_irq(dev, 0);
++ if (err < 0)
++ goto fail_unmap_command_block;
+ err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED,
+ "SUN3X ESP", esp);
+ if (err < 0)
+diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
+index 1c488024c6987..47dffe7736ff8 100644
+--- a/drivers/soc/qcom/mdt_loader.c
++++ b/drivers/soc/qcom/mdt_loader.c
+@@ -168,6 +168,14 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
+ break;
+ }
+
++ if (phdr->p_filesz > phdr->p_memsz) {
++ dev_err(dev,
++ "refusing to load segment %d with p_filesz > p_memsz\n",
++ i);
++ ret = -EINVAL;
++ break;
++ }
++
+ ptr = mem_region + offset;
+
+ if (phdr->p_filesz) {
+@@ -179,6 +187,15 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw,
+ break;
+ }
+
++ if (seg_fw->size != phdr->p_filesz) {
++ dev_err(dev,
++ "failed to load segment %d from truncated file %s\n",
++ i, fw_name);
++ release_firmware(seg_fw);
++ ret = -EINVAL;
++ break;
++ }
++
+ release_firmware(seg_fw);
+ }
+
+diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
+index df172bf3925f6..0089b606b70df 100644
+--- a/drivers/soundwire/bus.c
++++ b/drivers/soundwire/bus.c
+@@ -514,7 +514,7 @@ static int sdw_program_device_num(struct sdw_bus *bus)
+ struct sdw_slave *slave, *_s;
+ struct sdw_slave_id id;
+ struct sdw_msg msg;
+- bool found = false;
++ bool found;
+ int count = 0, ret;
+ u64 addr;
+
+@@ -545,6 +545,7 @@ static int sdw_program_device_num(struct sdw_bus *bus)
+
+ sdw_extract_slave_id(bus, addr, &id);
+
++ found = false;
+ /* Now compare with entries */
+ list_for_each_entry_safe(slave, _s, &bus->slaves, node) {
+ if (sdw_compare_devid(slave, id) == 0) {
+diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
+index 907a548645b75..42bc701e23040 100644
+--- a/drivers/soundwire/stream.c
++++ b/drivers/soundwire/stream.c
+@@ -1182,8 +1182,16 @@ int sdw_stream_add_slave(struct sdw_slave *slave,
+ }
+
+ ret = sdw_config_stream(&slave->dev, stream, stream_config, true);
+- if (ret)
++ if (ret) {
++ /*
++ * sdw_release_master_stream will release s_rt in slave_rt_list in
++ * stream_error case, but s_rt is only added to slave_rt_list
++ * when sdw_config_stream is successful, so free s_rt explicitly
++ * when sdw_config_stream is failed.
++ */
++ kfree(s_rt);
+ goto stream_error;
++ }
+
+ list_add_tail(&s_rt->m_rt_node, &m_rt->slave_rt_list);
+
+diff --git a/drivers/spi/spi-dln2.c b/drivers/spi/spi-dln2.c
+index b62a99caacc06..a41adea486182 100644
+--- a/drivers/spi/spi-dln2.c
++++ b/drivers/spi/spi-dln2.c
+@@ -783,7 +783,7 @@ exit_free_master:
+
+ static int dln2_spi_remove(struct platform_device *pdev)
+ {
+- struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
++ struct spi_master *master = platform_get_drvdata(pdev);
+ struct dln2_spi *dln2 = spi_master_get_devdata(master);
+
+ pm_runtime_disable(&pdev->dev);
+diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c
+index 76a8425be227b..1eccdc4a45817 100644
+--- a/drivers/spi/spi-omap-100k.c
++++ b/drivers/spi/spi-omap-100k.c
+@@ -435,7 +435,7 @@ err:
+
+ static int omap1_spi100k_remove(struct platform_device *pdev)
+ {
+- struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
++ struct spi_master *master = platform_get_drvdata(pdev);
+ struct omap1_spi100k *spi100k = spi_master_get_devdata(master);
+
+ pm_runtime_disable(&pdev->dev);
+@@ -449,7 +449,7 @@ static int omap1_spi100k_remove(struct platform_device *pdev)
+ #ifdef CONFIG_PM
+ static int omap1_spi100k_runtime_suspend(struct device *dev)
+ {
+- struct spi_master *master = spi_master_get(dev_get_drvdata(dev));
++ struct spi_master *master = dev_get_drvdata(dev);
+ struct omap1_spi100k *spi100k = spi_master_get_devdata(master);
+
+ clk_disable_unprepare(spi100k->ick);
+@@ -460,7 +460,7 @@ static int omap1_spi100k_runtime_suspend(struct device *dev)
+
+ static int omap1_spi100k_runtime_resume(struct device *dev)
+ {
+- struct spi_master *master = spi_master_get(dev_get_drvdata(dev));
++ struct spi_master *master = dev_get_drvdata(dev);
+ struct omap1_spi100k *spi100k = spi_master_get_devdata(master);
+ int ret;
+
+diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
+index 73a08724034ba..c70b1790a959f 100644
+--- a/drivers/spi/spi-ti-qspi.c
++++ b/drivers/spi/spi-ti-qspi.c
+@@ -663,6 +663,17 @@ static int ti_qspi_runtime_resume(struct device *dev)
+ return 0;
+ }
+
++static void ti_qspi_dma_cleanup(struct ti_qspi *qspi)
++{
++ if (qspi->rx_bb_addr)
++ dma_free_coherent(qspi->dev, QSPI_DMA_BUFFER_SIZE,
++ qspi->rx_bb_addr,
++ qspi->rx_bb_dma_addr);
++
++ if (qspi->rx_chan)
++ dma_release_channel(qspi->rx_chan);
++}
++
+ static const struct of_device_id ti_qspi_match[] = {
+ {.compatible = "ti,dra7xxx-qspi" },
+ {.compatible = "ti,am4372-qspi" },
+@@ -817,6 +828,8 @@ no_dma:
+ if (!ret)
+ return 0;
+
++ ti_qspi_dma_cleanup(qspi);
++
+ pm_runtime_disable(&pdev->dev);
+ free_master:
+ spi_master_put(master);
+@@ -835,12 +848,7 @@ static int ti_qspi_remove(struct platform_device *pdev)
+ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+
+- if (qspi->rx_bb_addr)
+- dma_free_coherent(qspi->dev, QSPI_DMA_BUFFER_SIZE,
+- qspi->rx_bb_addr,
+- qspi->rx_bb_dma_addr);
+- if (qspi->rx_chan)
+- dma_release_channel(qspi->rx_chan);
++ ti_qspi_dma_cleanup(qspi);
+
+ return 0;
+ }
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 7dabbc82b6463..bbe33016d3718 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2084,6 +2084,7 @@ struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
+
+ ctlr = __spi_alloc_controller(dev, size, slave);
+ if (ctlr) {
++ ctlr->devm_allocated = true;
+ *ptr = ctlr;
+ devres_add(dev, ptr);
+ } else {
+@@ -2344,11 +2345,6 @@ int devm_spi_register_controller(struct device *dev,
+ }
+ EXPORT_SYMBOL_GPL(devm_spi_register_controller);
+
+-static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr)
+-{
+- return *(struct spi_controller **)res == ctlr;
+-}
+-
+ static int __unregister(struct device *dev, void *null)
+ {
+ spi_unregister_device(to_spi_device(dev));
+@@ -2395,8 +2391,7 @@ void spi_unregister_controller(struct spi_controller *ctlr)
+ /* Release the last reference on the controller if its driver
+ * has not yet been converted to devm_spi_alloc_master/slave().
+ */
+- if (!devres_find(ctlr->dev.parent, devm_spi_release_controller,
+- devm_spi_match_controller, ctlr))
++ if (!ctlr->devm_allocated)
+ put_device(&ctlr->dev);
+
+ /* free bus id */
+diff --git a/drivers/staging/erofs/erofs_fs.h b/drivers/staging/erofs/erofs_fs.h
+index 7677da889f125..d8838ce669416 100644
+--- a/drivers/staging/erofs/erofs_fs.h
++++ b/drivers/staging/erofs/erofs_fs.h
+@@ -71,6 +71,9 @@ enum {
+ #define EROFS_I_VERSION_BIT 0
+ __EROFS_BIT(EROFS_I_, DATA_MAPPING, VERSION);
+
++#define EROFS_I_ALL \
++ ((1 << (EROFS_I_DATA_MAPPING_BIT + EROFS_I_DATA_MAPPING_BITS)) - 1)
++
+ struct erofs_inode_v1 {
+ /* 0 */__le16 i_advise;
+
+diff --git a/drivers/staging/erofs/inode.c b/drivers/staging/erofs/inode.c
+index a43abd530cc10..02398c7eb4a40 100644
+--- a/drivers/staging/erofs/inode.c
++++ b/drivers/staging/erofs/inode.c
+@@ -48,6 +48,12 @@ static struct page *read_inode(struct inode *inode, unsigned int *ofs)
+ v1 = page_address(page) + *ofs;
+ ifmt = le16_to_cpu(v1->i_advise);
+
++ if (ifmt & ~EROFS_I_ALL) {
++ errln("unsupported i_format %u of nid %llu", ifmt, vi->nid);
++ err = -EOPNOTSUPP;
++ goto err_out;
++ }
++
+ vi->data_mapping_mode = __inode_data_mapping(ifmt);
+ if (unlikely(vi->data_mapping_mode >= EROFS_INODE_LAYOUT_MAX)) {
+ errln("unknown data mapping mode %u of nid %llu",
+diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c
+index f36d470aed241..2343914f7548a 100644
+--- a/drivers/staging/greybus/uart.c
++++ b/drivers/staging/greybus/uart.c
+@@ -656,8 +656,6 @@ static int set_serial_info(struct gb_tty *gb_tty,
+ if ((close_delay != gb_tty->port.close_delay) ||
+ (closing_wait != gb_tty->port.closing_wait))
+ retval = -EPERM;
+- else
+- retval = -EOPNOTSUPP;
+ } else {
+ gb_tty->port.close_delay = close_delay;
+ gb_tty->port.closing_wait = closing_wait;
+diff --git a/drivers/staging/media/omap4iss/iss.c b/drivers/staging/media/omap4iss/iss.c
+index b1036baebb035..d796e754610cb 100644
+--- a/drivers/staging/media/omap4iss/iss.c
++++ b/drivers/staging/media/omap4iss/iss.c
+@@ -1244,8 +1244,10 @@ static int iss_probe(struct platform_device *pdev)
+ if (ret < 0)
+ goto error;
+
+- if (!omap4iss_get(iss))
++ if (!omap4iss_get(iss)) {
++ ret = -EINVAL;
+ goto error;
++ }
+
+ ret = iss_reset(iss);
+ if (ret < 0)
+diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
+index 87244a2089763..cc12e6c36fed9 100644
+--- a/drivers/staging/rtl8192u/r8192U_core.c
++++ b/drivers/staging/rtl8192u/r8192U_core.c
+@@ -3379,7 +3379,7 @@ static void rtl819x_update_rxcounts(struct r8192_priv *priv, u32 *TotalRxBcnNum,
+ u32 *TotalRxDataNum)
+ {
+ u16 SlotIndex;
+- u8 i;
++ u16 i;
+
+ *TotalRxBcnNum = 0;
+ *TotalRxDataNum = 0;
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index 02c4e3beb2640..1b52cd4d793f5 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -633,8 +633,9 @@ static void pscsi_complete_cmd(struct se_cmd *cmd, u8 scsi_status,
+ unsigned char *buf;
+
+ buf = transport_kmap_data_sg(cmd);
+- if (!buf)
++ if (!buf) {
+ ; /* XXX: TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE */
++ }
+
+ if (cdb[0] == MODE_SENSE_10) {
+ if (!(buf[3] & 0x80))
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 0219b5a865bee..dd73073755047 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -1216,7 +1216,7 @@ static void tcmu_set_next_deadline(struct list_head *queue,
+ del_timer(timer);
+ }
+
+-static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
++static bool tcmu_handle_completions(struct tcmu_dev *udev)
+ {
+ struct tcmu_mailbox *mb;
+ struct tcmu_cmd *cmd;
+@@ -1256,7 +1256,7 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ pr_err("cmd_id %u not found, ring is broken\n",
+ entry->hdr.cmd_id);
+ set_bit(TCMU_DEV_BIT_BROKEN, &udev->flags);
+- break;
++ return false;
+ }
+
+ tcmu_handle_completion(cmd, entry);
+diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
+index 2f254f957b0af..1d71fcb13dba6 100644
+--- a/drivers/tee/optee/core.c
++++ b/drivers/tee/optee/core.c
+@@ -87,16 +87,6 @@ int optee_from_msg_param(struct tee_param *params, size_t num_params,
+ return rc;
+ p->u.memref.shm_offs = mp->u.tmem.buf_ptr - pa;
+ p->u.memref.shm = shm;
+-
+- /* Check that the memref is covered by the shm object */
+- if (p->u.memref.size) {
+- size_t o = p->u.memref.shm_offs +
+- p->u.memref.size - 1;
+-
+- rc = tee_shm_get_pa(shm, o, NULL);
+- if (rc)
+- return rc;
+- }
+ break;
+ case OPTEE_MSG_ATTR_TYPE_RMEM_INPUT:
+ case OPTEE_MSG_ATTR_TYPE_RMEM_OUTPUT:
+diff --git a/drivers/thermal/fair_share.c b/drivers/thermal/fair_share.c
+index d3469fbc52072..26d7387f58349 100644
+--- a/drivers/thermal/fair_share.c
++++ b/drivers/thermal/fair_share.c
+@@ -94,6 +94,8 @@ static int fair_share_throttle(struct thermal_zone_device *tz, int trip)
+ int total_instance = 0;
+ int cur_trip_level = get_trip_level(tz);
+
++ mutex_lock(&tz->lock);
++
+ list_for_each_entry(instance, &tz->thermal_instances, tz_node) {
+ if (instance->trip != trip)
+ continue;
+@@ -122,6 +124,8 @@ static int fair_share_throttle(struct thermal_zone_device *tz, int trip)
+ mutex_unlock(&instance->cdev->lock);
+ thermal_cdev_update(cdev);
+ }
++
++ mutex_unlock(&tz->lock);
+ return 0;
+ }
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index bce4ac1787add..50073ead5881b 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -472,7 +472,10 @@ static unsigned int stm32_tx_empty(struct uart_port *port)
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+
+- return readl_relaxed(port->membase + ofs->isr) & USART_SR_TXE;
++ if (readl_relaxed(port->membase + ofs->isr) & USART_SR_TC)
++ return TIOCSER_TEMT;
++
++ return 0;
+ }
+
+ static void stm32_set_mctrl(struct uart_port *port, unsigned int mctrl)
+@@ -637,8 +640,9 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ unsigned int baud, bits;
+ u32 usartdiv, mantissa, fraction, oversampling;
+ tcflag_t cflag = termios->c_cflag;
+- u32 cr1, cr2, cr3;
++ u32 cr1, cr2, cr3, isr;
+ unsigned long flags;
++ int ret;
+
+ if (!stm32_port->hw_flow_control)
+ cflag &= ~CRTSCTS;
+@@ -647,6 +651,15 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+
+ spin_lock_irqsave(&port->lock, flags);
+
++ ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr,
++ isr,
++ (isr & USART_SR_TC),
++ 10, 100000);
++
++ /* Send the TC error message only when ISR_TC is not set. */
++ if (ret)
++ dev_err(port->dev, "Transmission is not complete\n");
++
+ /* Stop serial port and reset value */
+ writel_relaxed(0, port->membase + ofs->cr1);
+
+diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
+index 30d2433e27c3c..00daee7f83ee2 100644
+--- a/drivers/tty/serial/stm32-usart.h
++++ b/drivers/tty/serial/stm32-usart.h
+@@ -123,9 +123,6 @@ struct stm32_usart_info stm32h7_info = {
+ /* Dummy bits */
+ #define USART_SR_DUMMY_RX BIT(16)
+
+-/* USART_ICR (F7) */
+-#define USART_CR_TC BIT(6)
+-
+ /* USART_DR */
+ #define USART_DR_MASK GENMASK(8, 0)
+
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index ff6a360eef1ed..9e9343adc2b46 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2432,14 +2432,14 @@ out:
+ * @p: pointer to result
+ *
+ * Obtain the modem status bits from the tty driver if the feature
+- * is supported. Return -EINVAL if it is not available.
++ * is supported. Return -ENOTTY if it is not available.
+ *
+ * Locking: none (up to the driver)
+ */
+
+ static int tty_tiocmget(struct tty_struct *tty, int __user *p)
+ {
+- int retval = -EINVAL;
++ int retval = -ENOTTY;
+
+ if (tty->ops->tiocmget) {
+ retval = tty->ops->tiocmget(tty);
+@@ -2457,7 +2457,7 @@ static int tty_tiocmget(struct tty_struct *tty, int __user *p)
+ * @p: pointer to desired bits
+ *
+ * Set the modem status bits from the tty driver if the feature
+- * is supported. Return -EINVAL if it is not available.
++ * is supported. Return -ENOTTY if it is not available.
+ *
+ * Locking: none (up to the driver)
+ */
+@@ -2469,7 +2469,7 @@ static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd,
+ unsigned int set, clear, val;
+
+ if (tty->ops->tiocmset == NULL)
+- return -EINVAL;
++ return -ENOTTY;
+
+ retval = get_user(val, p);
+ if (retval)
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 13ea0579f104c..1fad4978a3b41 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1380,6 +1380,7 @@ struct vc_data *vc_deallocate(unsigned int currcons)
+ atomic_notifier_call_chain(&vt_notifier_list, VT_DEALLOCATE, ¶m);
+ vcs_remove_sysfs(currcons);
+ visual_deinit(vc);
++ con_free_unimap(vc);
+ put_pid(vc->vt_pid);
+ vc_uniscr_set(vc, NULL);
+ kfree(vc->vc_screenbuf);
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 7f4f21ba8efcf..738de8c9c354b 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -987,8 +987,6 @@ static int set_serial_info(struct acm *acm,
+ if ((new_serial.close_delay != old_close_delay) ||
+ (new_serial.closing_wait != old_closing_wait))
+ retval = -EPERM;
+- else
+- retval = -EOPNOTSUPP;
+ } else {
+ acm->port.close_delay = close_delay;
+ acm->port.closing_wait = closing_wait;
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index ae69635bb1fb5..48e775fff16d6 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -321,12 +321,23 @@ exit:
+
+ }
+
+-static void kill_urbs(struct wdm_device *desc)
++static void poison_urbs(struct wdm_device *desc)
+ {
+ /* the order here is essential */
+- usb_kill_urb(desc->command);
+- usb_kill_urb(desc->validity);
+- usb_kill_urb(desc->response);
++ usb_poison_urb(desc->command);
++ usb_poison_urb(desc->validity);
++ usb_poison_urb(desc->response);
++}
++
++static void unpoison_urbs(struct wdm_device *desc)
++{
++ /*
++ * the order here is not essential
++ * it is symmetrical just to be nice
++ */
++ usb_unpoison_urb(desc->response);
++ usb_unpoison_urb(desc->validity);
++ usb_unpoison_urb(desc->command);
+ }
+
+ static void free_urbs(struct wdm_device *desc)
+@@ -741,11 +752,12 @@ static int wdm_release(struct inode *inode, struct file *file)
+ if (!desc->count) {
+ if (!test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ dev_dbg(&desc->intf->dev, "wdm_release: cleanup\n");
+- kill_urbs(desc);
++ poison_urbs(desc);
+ spin_lock_irq(&desc->iuspin);
+ desc->resp_count = 0;
+ spin_unlock_irq(&desc->iuspin);
+ desc->manage_power(desc->intf, 0);
++ unpoison_urbs(desc);
+ } else {
+ /* must avoid dev_printk here as desc->intf is invalid */
+ pr_debug(KBUILD_MODNAME " %s: device gone - cleaning up\n", __func__);
+@@ -1036,9 +1048,9 @@ static void wdm_disconnect(struct usb_interface *intf)
+ wake_up_all(&desc->wait);
+ mutex_lock(&desc->rlock);
+ mutex_lock(&desc->wlock);
++ poison_urbs(desc);
+ cancel_work_sync(&desc->rxwork);
+ cancel_work_sync(&desc->service_outs_intr);
+- kill_urbs(desc);
+ mutex_unlock(&desc->wlock);
+ mutex_unlock(&desc->rlock);
+
+@@ -1079,9 +1091,10 @@ static int wdm_suspend(struct usb_interface *intf, pm_message_t message)
+ set_bit(WDM_SUSPENDING, &desc->flags);
+ spin_unlock_irq(&desc->iuspin);
+ /* callback submits work - order is essential */
+- kill_urbs(desc);
++ poison_urbs(desc);
+ cancel_work_sync(&desc->rxwork);
+ cancel_work_sync(&desc->service_outs_intr);
++ unpoison_urbs(desc);
+ }
+ if (!PMSG_IS_AUTO(message)) {
+ mutex_unlock(&desc->wlock);
+@@ -1139,7 +1152,7 @@ static int wdm_pre_reset(struct usb_interface *intf)
+ wake_up_all(&desc->wait);
+ mutex_lock(&desc->rlock);
+ mutex_lock(&desc->wlock);
+- kill_urbs(desc);
++ poison_urbs(desc);
+ cancel_work_sync(&desc->rxwork);
+ cancel_work_sync(&desc->service_outs_intr);
+ return 0;
+@@ -1150,6 +1163,7 @@ static int wdm_post_reset(struct usb_interface *intf)
+ struct wdm_device *desc = wdm_find_device(intf);
+ int rv;
+
++ unpoison_urbs(desc);
+ clear_bit(WDM_OVERFLOW, &desc->flags);
+ clear_bit(WDM_RESETTING, &desc->flags);
+ rv = recover_from_urb_loss(desc);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index fa28f23a4a336..0ddc2e30065f5 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3539,9 +3539,6 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
+ * sequence.
+ */
+ status = hub_port_status(hub, port1, &portstatus, &portchange);
+-
+- /* TRSMRCY = 10 msec */
+- msleep(10);
+ }
+
+ SuspendCleared:
+@@ -3556,6 +3553,9 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
+ usb_clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_SUSPEND);
+ }
++
++ /* TRSMRCY = 10 msec */
++ msleep(10);
+ }
+
+ if (udev->persist_enabled)
+diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
+index cc9c93affa148..828803b672aa5 100644
+--- a/drivers/usb/dwc2/core.h
++++ b/drivers/usb/dwc2/core.h
+@@ -112,6 +112,7 @@ struct dwc2_hsotg_req;
+ * @debugfs: File entry for debugfs file for this endpoint.
+ * @dir_in: Set to true if this endpoint is of the IN direction, which
+ * means that it is sending data to the Host.
++ * @map_dir: Set to the value of dir_in when the DMA buffer is mapped.
+ * @index: The index for the endpoint registers.
+ * @mc: Multi Count - number of transactions per microframe
+ * @interval: Interval for periodic endpoints, in frames or microframes.
+@@ -161,6 +162,7 @@ struct dwc2_hsotg_ep {
+ unsigned short fifo_index;
+
+ unsigned char dir_in;
++ unsigned char map_dir;
+ unsigned char index;
+ unsigned char mc;
+ u16 interval;
+diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
+index b23ce535c12e1..af26a8a20e0bc 100644
+--- a/drivers/usb/dwc2/core_intr.c
++++ b/drivers/usb/dwc2/core_intr.c
+@@ -312,6 +312,7 @@ static void dwc2_handle_conn_id_status_change_intr(struct dwc2_hsotg *hsotg)
+ static void dwc2_handle_session_req_intr(struct dwc2_hsotg *hsotg)
+ {
+ int ret;
++ u32 hprt0;
+
+ /* Clear interrupt */
+ dwc2_writel(hsotg, GINTSTS_SESSREQINT, GINTSTS);
+@@ -332,6 +333,13 @@ static void dwc2_handle_session_req_intr(struct dwc2_hsotg *hsotg)
+ * established
+ */
+ dwc2_hsotg_disconnect(hsotg);
++ } else {
++ /* Turn on the port power bit. */
++ hprt0 = dwc2_read_hprt0(hsotg);
++ hprt0 |= HPRT0_PWR;
++ dwc2_writel(hsotg, hprt0, HPRT0);
++ /* Connect hcd after port power is set. */
++ dwc2_hcd_connect(hsotg);
+ }
+ }
+
+@@ -645,6 +653,71 @@ static u32 dwc2_read_common_intr(struct dwc2_hsotg *hsotg)
+ return 0;
+ }
+
++/**
++ * dwc_handle_gpwrdn_disc_det() - Handles the gpwrdn disconnect detect.
++ * Exits hibernation without restoring registers.
++ *
++ * @hsotg: Programming view of DWC_otg controller
++ * @gpwrdn: GPWRDN register
++ */
++static inline void dwc_handle_gpwrdn_disc_det(struct dwc2_hsotg *hsotg,
++ u32 gpwrdn)
++{
++ u32 gpwrdn_tmp;
++
++ /* Switch-on voltage to the core */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PWRDNSWTCH;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Reset core */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PWRDNRSTN;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Disable Power Down Clamp */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PWRDNCLMP;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Deassert reset core */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp |= GPWRDN_PWRDNRSTN;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++ udelay(5);
++
++ /* Disable PMU interrupt */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PMUINTSEL;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++
++ /* De-assert Wakeup Logic */
++ gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
++ gpwrdn_tmp &= ~GPWRDN_PMUACTV;
++ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
++
++ hsotg->hibernated = 0;
++ hsotg->bus_suspended = 0;
++
++ if (gpwrdn & GPWRDN_IDSTS) {
++ hsotg->op_state = OTG_STATE_B_PERIPHERAL;
++ dwc2_core_init(hsotg, false);
++ dwc2_enable_global_interrupts(hsotg);
++ dwc2_hsotg_core_init_disconnected(hsotg, false);
++ dwc2_hsotg_core_connect(hsotg);
++ } else {
++ hsotg->op_state = OTG_STATE_A_HOST;
++
++ /* Initialize the Core for Host mode */
++ dwc2_core_init(hsotg, false);
++ dwc2_enable_global_interrupts(hsotg);
++ dwc2_hcd_start(hsotg);
++ }
++}
++
+ /*
+ * GPWRDN interrupt handler.
+ *
+@@ -666,64 +739,14 @@ static void dwc2_handle_gpwrdn_intr(struct dwc2_hsotg *hsotg)
+
+ if ((gpwrdn & GPWRDN_DISCONN_DET) &&
+ (gpwrdn & GPWRDN_DISCONN_DET_MSK) && !linestate) {
+- u32 gpwrdn_tmp;
+-
+ dev_dbg(hsotg->dev, "%s: GPWRDN_DISCONN_DET\n", __func__);
+-
+- /* Switch-on voltage to the core */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PWRDNSWTCH;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Reset core */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PWRDNRSTN;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Disable Power Down Clamp */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PWRDNCLMP;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Deassert reset core */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp |= GPWRDN_PWRDNRSTN;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+- udelay(10);
+-
+- /* Disable PMU interrupt */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PMUINTSEL;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+-
+- /* De-assert Wakeup Logic */
+- gpwrdn_tmp = dwc2_readl(hsotg, GPWRDN);
+- gpwrdn_tmp &= ~GPWRDN_PMUACTV;
+- dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+-
+- hsotg->hibernated = 0;
+-
+- if (gpwrdn & GPWRDN_IDSTS) {
+- hsotg->op_state = OTG_STATE_B_PERIPHERAL;
+- dwc2_core_init(hsotg, false);
+- dwc2_enable_global_interrupts(hsotg);
+- dwc2_hsotg_core_init_disconnected(hsotg, false);
+- dwc2_hsotg_core_connect(hsotg);
+- } else {
+- hsotg->op_state = OTG_STATE_A_HOST;
+-
+- /* Initialize the Core for Host mode */
+- dwc2_core_init(hsotg, false);
+- dwc2_enable_global_interrupts(hsotg);
+- dwc2_hcd_start(hsotg);
+- }
+- }
+-
+- if ((gpwrdn & GPWRDN_LNSTSCHG) &&
+- (gpwrdn & GPWRDN_LNSTSCHG_MSK) && linestate) {
++ /*
++ * Call disconnect detect function to exit from
++ * hibernation
++ */
++ dwc_handle_gpwrdn_disc_det(hsotg, gpwrdn);
++ } else if ((gpwrdn & GPWRDN_LNSTSCHG) &&
++ (gpwrdn & GPWRDN_LNSTSCHG_MSK) && linestate) {
+ dev_dbg(hsotg->dev, "%s: GPWRDN_LNSTSCHG\n", __func__);
+ if (hsotg->hw_params.hibernation &&
+ hsotg->hibernated) {
+@@ -734,24 +757,21 @@ static void dwc2_handle_gpwrdn_intr(struct dwc2_hsotg *hsotg)
+ dwc2_exit_hibernation(hsotg, 1, 0, 1);
+ }
+ }
+- }
+- if ((gpwrdn & GPWRDN_RST_DET) && (gpwrdn & GPWRDN_RST_DET_MSK)) {
++ } else if ((gpwrdn & GPWRDN_RST_DET) &&
++ (gpwrdn & GPWRDN_RST_DET_MSK)) {
+ dev_dbg(hsotg->dev, "%s: GPWRDN_RST_DET\n", __func__);
+ if (!linestate && (gpwrdn & GPWRDN_BSESSVLD))
+ dwc2_exit_hibernation(hsotg, 0, 1, 0);
+- }
+- if ((gpwrdn & GPWRDN_STS_CHGINT) &&
+- (gpwrdn & GPWRDN_STS_CHGINT_MSK) && linestate) {
++ } else if ((gpwrdn & GPWRDN_STS_CHGINT) &&
++ (gpwrdn & GPWRDN_STS_CHGINT_MSK)) {
+ dev_dbg(hsotg->dev, "%s: GPWRDN_STS_CHGINT\n", __func__);
+- if (hsotg->hw_params.hibernation &&
+- hsotg->hibernated) {
+- if (gpwrdn & GPWRDN_IDSTS) {
+- dwc2_exit_hibernation(hsotg, 0, 0, 0);
+- call_gadget(hsotg, resume);
+- } else {
+- dwc2_exit_hibernation(hsotg, 1, 0, 1);
+- }
+- }
++ /*
++ * As GPWRDN_STS_CHGINT exit from hibernation flow is
++ * the same as in GPWRDN_DISCONN_DET flow. Call
++ * disconnect detect helper function to exit from
++ * hibernation.
++ */
++ dwc_handle_gpwrdn_disc_det(hsotg, gpwrdn);
+ }
+ }
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 42f66718bc184..d0edb7e453c07 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -380,7 +380,7 @@ static void dwc2_hsotg_unmap_dma(struct dwc2_hsotg *hsotg,
+ {
+ struct usb_request *req = &hs_req->req;
+
+- usb_gadget_unmap_request(&hsotg->gadget, req, hs_ep->dir_in);
++ usb_gadget_unmap_request(&hsotg->gadget, req, hs_ep->map_dir);
+ }
+
+ /*
+@@ -1163,6 +1163,7 @@ static int dwc2_hsotg_map_dma(struct dwc2_hsotg *hsotg,
+ {
+ int ret;
+
++ hs_ep->map_dir = hs_ep->dir_in;
+ ret = usb_gadget_map_request(&hsotg->gadget, req, hs_ep->dir_in);
+ if (ret)
+ goto dma_error;
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 91686e1b24d97..58e53e3d905be 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -5741,7 +5741,15 @@ int dwc2_host_exit_hibernation(struct dwc2_hsotg *hsotg, int rem_wakeup,
+ return ret;
+ }
+
+- dwc2_hcd_rem_wakeup(hsotg);
++ if (rem_wakeup) {
++ dwc2_hcd_rem_wakeup(hsotg);
++ /*
++ * Change "port_connect_status_change" flag to re-enumerate,
++ * because after exit from hibernation port connection status
++ * is not detected.
++ */
++ hsotg->flags.b.port_connect_status_change = 1;
++ }
+
+ hsotg->hibernated = 0;
+ hsotg->bus_suspended = 0;
+diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
+index ed8b865176758..0dfb710f48b5e 100644
+--- a/drivers/usb/dwc3/dwc3-omap.c
++++ b/drivers/usb/dwc3/dwc3-omap.c
+@@ -432,8 +432,13 @@ static int dwc3_omap_extcon_register(struct dwc3_omap *omap)
+
+ if (extcon_get_state(edev, EXTCON_USB) == true)
+ dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_VALID);
++ else
++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_OFF);
++
+ if (extcon_get_state(edev, EXTCON_USB_HOST) == true)
+ dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_GROUND);
++ else
++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_FLOAT);
+
+ omap->edev = edev;
+ }
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 389ec4c689c44..bf40a2f36e976 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -133,6 +133,7 @@ static const struct property_entry dwc3_pci_amd_properties[] = {
+ PROPERTY_ENTRY_BOOL("snps,disable_scramble_quirk"),
+ PROPERTY_ENTRY_BOOL("snps,dis_u3_susphy_quirk"),
+ PROPERTY_ENTRY_BOOL("snps,dis_u2_susphy_quirk"),
++ PROPERTY_ENTRY_BOOL("snps,usb2-gadget-lpm-disable"),
+ PROPERTY_ENTRY_BOOL("linux,sysdev_is_parent"),
+ {}
+ };
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index a0806dca3de9d..8ce13f5e83c73 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -304,13 +304,12 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
+ }
+
+ if (DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) {
+- int needs_wakeup;
++ int link_state;
+
+- needs_wakeup = (dwc->link_state == DWC3_LINK_STATE_U1 ||
+- dwc->link_state == DWC3_LINK_STATE_U2 ||
+- dwc->link_state == DWC3_LINK_STATE_U3);
+-
+- if (unlikely(needs_wakeup)) {
++ link_state = dwc3_gadget_get_link_state(dwc);
++ if (link_state == DWC3_LINK_STATE_U1 ||
++ link_state == DWC3_LINK_STATE_U2 ||
++ link_state == DWC3_LINK_STATE_U3) {
+ ret = __dwc3_gadget_wakeup(dwc);
+ dev_WARN_ONCE(dwc->dev, ret, "wakeup failed --> %d\n",
+ ret);
+@@ -1414,7 +1413,9 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
+ }
+ }
+
+- return __dwc3_gadget_kick_transfer(dep);
++ __dwc3_gadget_kick_transfer(dep);
++
++ return 0;
+ }
+
+ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request,
+@@ -1674,6 +1675,8 @@ static int __dwc3_gadget_wakeup(struct dwc3 *dwc)
+ case DWC3_LINK_STATE_RESET:
+ case DWC3_LINK_STATE_RX_DET: /* in HS, means Early Suspend */
+ case DWC3_LINK_STATE_U3: /* in HS, means SUSPEND */
++ case DWC3_LINK_STATE_U2: /* in HS, means Sleep (L1) */
++ case DWC3_LINK_STATE_U1:
+ case DWC3_LINK_STATE_RESUME:
+ break;
+ default:
+@@ -2717,6 +2720,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
+
+ dwc->connected = true;
+
++ /*
++ * Ideally, dwc3_reset_gadget() would trigger the function
++ * drivers to stop any active transfers through ep disable.
++ * However, for functions which defer ep disable, such as mass
++ * storage, we will need to rely on the call to stop active
++ * transfers here, and avoid allowing of request queuing.
++ */
++ dwc->connected = false;
++
+ /*
+ * WORKAROUND: DWC3 revisions <1.88a have an issue which
+ * would cause a missing Disconnect Event if there's a
+diff --git a/drivers/usb/gadget/config.c b/drivers/usb/gadget/config.c
+index 2d115353424c2..8bb25773b61e9 100644
+--- a/drivers/usb/gadget/config.c
++++ b/drivers/usb/gadget/config.c
+@@ -194,9 +194,13 @@ EXPORT_SYMBOL_GPL(usb_assign_descriptors);
+ void usb_free_all_descriptors(struct usb_function *f)
+ {
+ usb_free_descriptors(f->fs_descriptors);
++ f->fs_descriptors = NULL;
+ usb_free_descriptors(f->hs_descriptors);
++ f->hs_descriptors = NULL;
+ usb_free_descriptors(f->ss_descriptors);
++ f->ss_descriptors = NULL;
+ usb_free_descriptors(f->ssp_descriptors);
++ f->ssp_descriptors = NULL;
+ }
+ EXPORT_SYMBOL_GPL(usb_free_all_descriptors);
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 5c1846d1372ec..dcb432860d062 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -2553,6 +2553,7 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
+
+ do { /* lang_count > 0 so we can use do-while */
+ unsigned needed = needed_count;
++ u32 str_per_lang = str_count;
+
+ if (unlikely(len < 3))
+ goto error_free;
+@@ -2588,7 +2589,7 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
+
+ data += length + 1;
+ len -= length + 1;
+- } while (--str_count);
++ } while (--str_per_lang);
+
+ s->id = 0; /* terminator */
+ s->s = NULL;
+diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
+index a215c836eba4b..41e7b29f58dfe 100644
+--- a/drivers/usb/gadget/function/f_uac1.c
++++ b/drivers/usb/gadget/function/f_uac1.c
+@@ -19,6 +19,9 @@
+ #include "u_audio.h"
+ #include "u_uac1.h"
+
++/* UAC1 spec: 3.7.2.3 Audio Channel Cluster Format */
++#define UAC1_CHANNEL_MASK 0x0FFF
++
+ struct f_uac1 {
+ struct g_audio g_audio;
+ u8 ac_intf, as_in_intf, as_out_intf;
+@@ -30,6 +33,11 @@ static inline struct f_uac1 *func_to_uac1(struct usb_function *f)
+ return container_of(f, struct f_uac1, g_audio.func);
+ }
+
++static inline struct f_uac1_opts *g_audio_to_uac1_opts(struct g_audio *audio)
++{
++ return container_of(audio->func.fi, struct f_uac1_opts, func_inst);
++}
++
+ /*
+ * DESCRIPTORS ... most are static, but strings and full
+ * configuration descriptors are built on demand.
+@@ -505,11 +513,42 @@ static void f_audio_disable(struct usb_function *f)
+
+ /*-------------------------------------------------------------------------*/
+
++static int f_audio_validate_opts(struct g_audio *audio, struct device *dev)
++{
++ struct f_uac1_opts *opts = g_audio_to_uac1_opts(audio);
++
++ if (!opts->p_chmask && !opts->c_chmask) {
++ dev_err(dev, "Error: no playback and capture channels\n");
++ return -EINVAL;
++ } else if (opts->p_chmask & ~UAC1_CHANNEL_MASK) {
++ dev_err(dev, "Error: unsupported playback channels mask\n");
++ return -EINVAL;
++ } else if (opts->c_chmask & ~UAC1_CHANNEL_MASK) {
++ dev_err(dev, "Error: unsupported capture channels mask\n");
++ return -EINVAL;
++ } else if ((opts->p_ssize < 1) || (opts->p_ssize > 4)) {
++ dev_err(dev, "Error: incorrect playback sample size\n");
++ return -EINVAL;
++ } else if ((opts->c_ssize < 1) || (opts->c_ssize > 4)) {
++ dev_err(dev, "Error: incorrect capture sample size\n");
++ return -EINVAL;
++ } else if (!opts->p_srate) {
++ dev_err(dev, "Error: incorrect playback sampling rate\n");
++ return -EINVAL;
++ } else if (!opts->c_srate) {
++ dev_err(dev, "Error: incorrect capture sampling rate\n");
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ /* audio function driver setup/binding */
+ static int f_audio_bind(struct usb_configuration *c, struct usb_function *f)
+ {
+ struct usb_composite_dev *cdev = c->cdev;
+ struct usb_gadget *gadget = cdev->gadget;
++ struct device *dev = &gadget->dev;
+ struct f_uac1 *uac1 = func_to_uac1(f);
+ struct g_audio *audio = func_to_g_audio(f);
+ struct f_uac1_opts *audio_opts;
+@@ -519,6 +558,10 @@ static int f_audio_bind(struct usb_configuration *c, struct usb_function *f)
+ int rate;
+ int status;
+
++ status = f_audio_validate_opts(audio, dev);
++ if (status)
++ return status;
++
+ audio_opts = container_of(f->fi, struct f_uac1_opts, func_inst);
+
+ us = usb_gstrings_attach(cdev, uac1_strings, ARRAY_SIZE(strings_uac1));
+diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
+index d8ce7868fe225..169e73ed128c8 100644
+--- a/drivers/usb/gadget/function/f_uvc.c
++++ b/drivers/usb/gadget/function/f_uvc.c
+@@ -645,7 +645,12 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
+
+ uvc_hs_streaming_ep.wMaxPacketSize =
+ cpu_to_le16(max_packet_size | ((max_packet_mult - 1) << 11));
+- uvc_hs_streaming_ep.bInterval = opts->streaming_interval;
++
++ /* A high-bandwidth endpoint must specify a bInterval value of 1 */
++ if (max_packet_mult > 1)
++ uvc_hs_streaming_ep.bInterval = 1;
++ else
++ uvc_hs_streaming_ep.bInterval = opts->streaming_interval;
+
+ uvc_ss_streaming_ep.wMaxPacketSize = cpu_to_le16(max_packet_size);
+ uvc_ss_streaming_ep.bInterval = opts->streaming_interval;
+diff --git a/drivers/usb/gadget/udc/aspeed-vhub/core.c b/drivers/usb/gadget/udc/aspeed-vhub/core.c
+index db3628be38c07..902e61be4d642 100644
+--- a/drivers/usb/gadget/udc/aspeed-vhub/core.c
++++ b/drivers/usb/gadget/udc/aspeed-vhub/core.c
+@@ -36,6 +36,7 @@ void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
+ int status)
+ {
+ bool internal = req->internal;
++ struct ast_vhub *vhub = ep->vhub;
+
+ EPVDBG(ep, "completing request @%p, status %d\n", req, status);
+
+@@ -46,7 +47,7 @@ void ast_vhub_done(struct ast_vhub_ep *ep, struct ast_vhub_req *req,
+
+ if (req->req.dma) {
+ if (!WARN_ON(!ep->dev))
+- usb_gadget_unmap_request(&ep->dev->gadget,
++ usb_gadget_unmap_request_by_dev(&vhub->pdev->dev,
+ &req->req, ep->epn.is_in);
+ req->req.dma = 0;
+ }
+diff --git a/drivers/usb/gadget/udc/aspeed-vhub/epn.c b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+index ae853cf369662..931f540a747e9 100644
+--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c
++++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+@@ -376,7 +376,7 @@ static int ast_vhub_epn_queue(struct usb_ep* u_ep, struct usb_request *u_req,
+ if (ep->epn.desc_mode ||
+ ((((unsigned long)u_req->buf & 7) == 0) &&
+ (ep->epn.is_in || !(u_req->length & (u_ep->maxpacket - 1))))) {
+- rc = usb_gadget_map_request(&ep->dev->gadget, u_req,
++ rc = usb_gadget_map_request_by_dev(&vhub->pdev->dev, u_req,
+ ep->epn.is_in);
+ if (rc) {
+ dev_warn(&vhub->pdev->dev,
+diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
+index fdbce8529dbb4..d25d25da6875d 100644
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -914,6 +914,21 @@ static int dummy_pullup(struct usb_gadget *_gadget, int value)
+ spin_lock_irqsave(&dum->lock, flags);
+ dum->pullup = (value != 0);
+ set_link_state(dum_hcd);
++ if (value == 0) {
++ /*
++ * Emulate synchronize_irq(): wait for callbacks to finish.
++ * This seems to be the best place to emulate the call to
++ * synchronize_irq() that's in usb_gadget_remove_driver().
++ * Doing it in dummy_udc_stop() would be too late since it
++ * is called after the unbind callback and unbind shouldn't
++ * be invoked until all the other callbacks are finished.
++ */
++ while (dum->callback_usage > 0) {
++ spin_unlock_irqrestore(&dum->lock, flags);
++ usleep_range(1000, 2000);
++ spin_lock_irqsave(&dum->lock, flags);
++ }
++ }
+ spin_unlock_irqrestore(&dum->lock, flags);
+
+ usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd));
+@@ -1015,14 +1030,6 @@ static int dummy_udc_stop(struct usb_gadget *g)
+ spin_lock_irq(&dum->lock);
+ dum->ints_enabled = 0;
+ stop_activity(dum);
+-
+- /* emulate synchronize_irq(): wait for callbacks to finish */
+- while (dum->callback_usage > 0) {
+- spin_unlock_irq(&dum->lock);
+- usleep_range(1000, 2000);
+- spin_lock_irq(&dum->lock);
+- }
+-
+ dum->driver = NULL;
+ spin_unlock_irq(&dum->lock);
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index bc6abaea907d8..785822ecc3f1a 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -337,15 +337,16 @@ static void fotg210_start_dma(struct fotg210_ep *ep,
+ } else {
+ buffer = req->req.buf + req->req.actual;
+ length = ioread32(ep->fotg210->reg +
+- FOTG210_FIBCR(ep->epnum - 1));
+- length &= FIBCR_BCFX;
++ FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX;
++ if (length > req->req.length - req->req.actual)
++ length = req->req.length - req->req.actual;
+ }
+ } else {
+ buffer = req->req.buf + req->req.actual;
+ if (req->req.length - req->req.actual > ep->ep.maxpacket)
+ length = ep->ep.maxpacket;
+ else
+- length = req->req.length;
++ length = req->req.length - req->req.actual;
+ }
+
+ d = dma_map_single(NULL, buffer, length,
+@@ -382,8 +383,7 @@ static void fotg210_ep0_queue(struct fotg210_ep *ep,
+ }
+ if (ep->dir_in) { /* if IN */
+ fotg210_start_dma(ep, req);
+- if ((req->req.length == req->req.actual) ||
+- (req->req.actual < ep->ep.maxpacket))
++ if (req->req.length == req->req.actual)
+ fotg210_done(ep, req, 0);
+ } else { /* OUT */
+ u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR0);
+@@ -824,7 +824,7 @@ static void fotg210_ep0in(struct fotg210_udc *fotg210)
+ if (req->req.length)
+ fotg210_start_dma(ep, req);
+
+- if ((req->req.length - req->req.actual) < ep->ep.maxpacket)
++ if (req->req.actual == req->req.length)
+ fotg210_done(ep, req, 0);
+ } else {
+ fotg210_set_cxdone(fotg210);
+@@ -853,12 +853,16 @@ static void fotg210_out_fifo_handler(struct fotg210_ep *ep)
+ {
+ struct fotg210_request *req = list_entry(ep->queue.next,
+ struct fotg210_request, queue);
++ int disgr1 = ioread32(ep->fotg210->reg + FOTG210_DISGR1);
+
+ fotg210_start_dma(ep, req);
+
+- /* finish out transfer */
++ /* Complete the request when it's full or a short packet arrived.
++ * Like other drivers, short_not_ok isn't handled.
++ */
++
+ if (req->req.length == req->req.actual ||
+- req->req.actual < ep->ep.maxpacket)
++ (disgr1 & DISGR1_SPK_INT(ep->epnum - 1)))
+ fotg210_done(ep, req, 0);
+ }
+
+@@ -1031,6 +1035,12 @@ static void fotg210_init(struct fotg210_udc *fotg210)
+ value &= ~DMCR_GLINT_EN;
+ iowrite32(value, fotg210->reg + FOTG210_DMCR);
+
++ /* enable only grp2 irqs we handle */
++ iowrite32(~(DISGR2_DMA_ERROR | DISGR2_RX0BYTE_INT | DISGR2_TX0BYTE_INT
++ | DISGR2_ISO_SEQ_ABORT_INT | DISGR2_ISO_SEQ_ERR_INT
++ | DISGR2_RESM_INT | DISGR2_SUSP_INT | DISGR2_USBRST_INT),
++ fotg210->reg + FOTG210_DMISGR2);
++
+ /* disable all fifo interrupt */
+ iowrite32(~(u32)0, fotg210->reg + FOTG210_DMISGR1);
+
+diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
+index 667011c993727..14e99905cbeef 100644
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -600,18 +600,22 @@ static void pch_udc_reconnect(struct pch_udc_dev *dev)
+ static inline void pch_udc_vbus_session(struct pch_udc_dev *dev,
+ int is_active)
+ {
++ unsigned long iflags;
++
++ spin_lock_irqsave(&dev->lock, iflags);
+ if (is_active) {
+ pch_udc_reconnect(dev);
+ dev->vbus_session = 1;
+ } else {
+ if (dev->driver && dev->driver->disconnect) {
+- spin_lock(&dev->lock);
++ spin_unlock_irqrestore(&dev->lock, iflags);
+ dev->driver->disconnect(&dev->gadget);
+- spin_unlock(&dev->lock);
++ spin_lock_irqsave(&dev->lock, iflags);
+ }
+ pch_udc_set_disconnect(dev);
+ dev->vbus_session = 0;
+ }
++ spin_unlock_irqrestore(&dev->lock, iflags);
+ }
+
+ /**
+@@ -1168,20 +1172,25 @@ static int pch_udc_pcd_selfpowered(struct usb_gadget *gadget, int value)
+ static int pch_udc_pcd_pullup(struct usb_gadget *gadget, int is_on)
+ {
+ struct pch_udc_dev *dev;
++ unsigned long iflags;
+
+ if (!gadget)
+ return -EINVAL;
++
+ dev = container_of(gadget, struct pch_udc_dev, gadget);
++
++ spin_lock_irqsave(&dev->lock, iflags);
+ if (is_on) {
+ pch_udc_reconnect(dev);
+ } else {
+ if (dev->driver && dev->driver->disconnect) {
+- spin_lock(&dev->lock);
++ spin_unlock_irqrestore(&dev->lock, iflags);
+ dev->driver->disconnect(&dev->gadget);
+- spin_unlock(&dev->lock);
++ spin_lock_irqsave(&dev->lock, iflags);
+ }
+ pch_udc_set_disconnect(dev);
+ }
++ spin_unlock_irqrestore(&dev->lock, iflags);
+
+ return 0;
+ }
+@@ -1773,7 +1782,7 @@ static struct usb_request *pch_udc_alloc_request(struct usb_ep *usbep,
+ }
+ /* prevent from using desc. - set HOST BUSY */
+ dma_desc->status |= PCH_UDC_BS_HST_BSY;
+- dma_desc->dataptr = cpu_to_le32(DMA_ADDR_INVALID);
++ dma_desc->dataptr = lower_32_bits(DMA_ADDR_INVALID);
+ req->td_data = dma_desc;
+ req->td_data_last = dma_desc;
+ req->chain_len = 1;
+@@ -2316,6 +2325,21 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num)
+ pch_udc_set_dma(dev, DMA_DIR_RX);
+ }
+
++static int pch_udc_gadget_setup(struct pch_udc_dev *dev)
++ __must_hold(&dev->lock)
++{
++ int rc;
++
++ /* In some cases we can get an interrupt before driver gets setup */
++ if (!dev->driver)
++ return -ESHUTDOWN;
++
++ spin_unlock(&dev->lock);
++ rc = dev->driver->setup(&dev->gadget, &dev->setup_data);
++ spin_lock(&dev->lock);
++ return rc;
++}
++
+ /**
+ * pch_udc_svc_control_in() - Handle Control IN endpoint interrupts
+ * @dev: Reference to the device structure
+@@ -2387,15 +2411,12 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev)
+ dev->gadget.ep0 = &dev->ep[UDC_EP0IN_IDX].ep;
+ else /* OUT */
+ dev->gadget.ep0 = &ep->ep;
+- spin_lock(&dev->lock);
+ /* If Mass storage Reset */
+ if ((dev->setup_data.bRequestType == 0x21) &&
+ (dev->setup_data.bRequest == 0xFF))
+ dev->prot_stall = 0;
+ /* call gadget with setup data received */
+- setup_supported = dev->driver->setup(&dev->gadget,
+- &dev->setup_data);
+- spin_unlock(&dev->lock);
++ setup_supported = pch_udc_gadget_setup(dev);
+
+ if (dev->setup_data.bRequestType & USB_DIR_IN) {
+ ep->td_data->status = (ep->td_data->status &
+@@ -2643,9 +2664,7 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev)
+ dev->ep[i].halted = 0;
+ }
+ dev->stall = 0;
+- spin_unlock(&dev->lock);
+- dev->driver->setup(&dev->gadget, &dev->setup_data);
+- spin_lock(&dev->lock);
++ pch_udc_gadget_setup(dev);
+ }
+
+ /**
+@@ -2680,9 +2699,7 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev)
+ dev->stall = 0;
+
+ /* call gadget zero with setup data received */
+- spin_unlock(&dev->lock);
+- dev->driver->setup(&dev->gadget, &dev->setup_data);
+- spin_lock(&dev->lock);
++ pch_udc_gadget_setup(dev);
+ }
+
+ /**
+@@ -2956,7 +2973,7 @@ static int init_dma_pools(struct pch_udc_dev *dev)
+ dev->dma_addr = dma_map_single(&dev->pdev->dev, ep0out_buf,
+ UDC_EP0OUT_BUFF_SIZE * 4,
+ DMA_FROM_DEVICE);
+- return 0;
++ return dma_mapping_error(&dev->pdev->dev, dev->dma_addr);
+ }
+
+ static int pch_udc_start(struct usb_gadget *g,
+diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
+index 11e25a3f4f1fa..a766476fd742e 100644
+--- a/drivers/usb/gadget/udc/r8a66597-udc.c
++++ b/drivers/usb/gadget/udc/r8a66597-udc.c
+@@ -1852,6 +1852,8 @@ static int r8a66597_probe(struct platform_device *pdev)
+ return PTR_ERR(reg);
+
+ ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
++ if (!ires)
++ return -EINVAL;
+ irq = ires->start;
+ irq_trigger = ires->flags & IRQF_TRIGGER_MASK;
+
+diff --git a/drivers/usb/gadget/udc/snps_udc_plat.c b/drivers/usb/gadget/udc/snps_udc_plat.c
+index 32f1d3e90c264..99805d60a7ab3 100644
+--- a/drivers/usb/gadget/udc/snps_udc_plat.c
++++ b/drivers/usb/gadget/udc/snps_udc_plat.c
+@@ -114,8 +114,8 @@ static int udc_plat_probe(struct platform_device *pdev)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ udc->virt_addr = devm_ioremap_resource(dev, res);
+- if (IS_ERR(udc->regs))
+- return PTR_ERR(udc->regs);
++ if (IS_ERR(udc->virt_addr))
++ return PTR_ERR(udc->virt_addr);
+
+ /* udc csr registers base */
+ udc->csr = udc->virt_addr + UDC_CSR_ADDR;
+diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
+index 2d5a72c15069e..226b38274a6ef 100644
+--- a/drivers/usb/host/fotg210-hcd.c
++++ b/drivers/usb/host/fotg210-hcd.c
+@@ -5569,7 +5569,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev)
+ struct usb_hcd *hcd;
+ struct resource *res;
+ int irq;
+- int retval = -ENODEV;
++ int retval;
+ struct fotg210_hcd *fotg210;
+
+ if (usb_disabled())
+@@ -5589,7 +5589,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev)
+ hcd = usb_create_hcd(&fotg210_fotg210_hc_driver, dev,
+ dev_name(dev));
+ if (!hcd) {
+- dev_err(dev, "failed to create hcd with err %d\n", retval);
++ dev_err(dev, "failed to create hcd\n");
+ retval = -ENOMEM;
+ goto fail_create_hcd;
+ }
+diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
+index 5b061e5999489..6dedefada92b1 100644
+--- a/drivers/usb/host/sl811-hcd.c
++++ b/drivers/usb/host/sl811-hcd.c
+@@ -1287,11 +1287,10 @@ sl811h_hub_control(
+ goto error;
+ put_unaligned_le32(sl811->port1, buf);
+
+-#ifndef VERBOSE
+- if (*(u16*)(buf+2)) /* only if wPortChange is interesting */
+-#endif
+- dev_dbg(hcd->self.controller, "GetPortStatus %08x\n",
+- sl811->port1);
++ if (__is_defined(VERBOSE) ||
++ *(u16*)(buf+2)) /* only if wPortChange is interesting */
++ dev_dbg(hcd->self.controller, "GetPortStatus %08x\n",
++ sl811->port1);
+ break;
+ case SetPortFeature:
+ if (wIndex != 1 || wLength != 0)
+diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h
+index 268328c206816..2208fa6c74109 100644
+--- a/drivers/usb/host/xhci-ext-caps.h
++++ b/drivers/usb/host/xhci-ext-caps.h
+@@ -7,8 +7,9 @@
+ * Author: Sarah Sharp
+ * Some code borrowed from the Linux EHCI driver.
+ */
+-/* Up to 16 ms to halt an HC */
+-#define XHCI_MAX_HALT_USEC (16*1000)
++
++/* HC should halt within 16 ms, but use 32 ms as some hosts take longer */
++#define XHCI_MAX_HALT_USEC (32 * 1000)
+ /* HC not running - set to 1 when run/stop bit is cleared. */
+ #define XHCI_STS_HALT (1<<0)
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 9e87c282a7435..2461be2a8748c 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -2134,6 +2134,15 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
+
+ if (major_revision == 0x03) {
+ rhub = &xhci->usb3_rhub;
++ /*
++ * Some hosts incorrectly use sub-minor version for minor
++ * version (i.e. 0x02 instead of 0x20 for bcdUSB 0x320 and 0x01
++ * for bcdUSB 0x310). Since there is no USB release with sub
++ * minor version 0x301 to 0x309, we can assume that they are
++ * incorrect and fix it here.
++ */
++ if (minor_revision > 0x00 && minor_revision < 0x10)
++ minor_revision <<= 4;
+ } else if (major_revision <= 0x02) {
+ rhub = &xhci->usb2_rhub;
+ } else {
+diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
+index 09d5a789fcd5d..f4b2e766f195b 100644
+--- a/drivers/usb/host/xhci-mtk.c
++++ b/drivers/usb/host/xhci-mtk.c
+@@ -395,6 +395,8 @@ static void xhci_mtk_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
+ if (mtk->lpm_support)
+ xhci->quirks |= XHCI_LPM_SUPPORT;
++ if (mtk->u2_lpm_disable)
++ xhci->quirks |= XHCI_HW_LPM_DISABLE;
+
+ /*
+ * MTK xHCI 0.96: PSA is 1 by default even if doesn't support stream,
+@@ -467,6 +469,7 @@ static int xhci_mtk_probe(struct platform_device *pdev)
+ return ret;
+
+ mtk->lpm_support = of_property_read_bool(node, "usb3-lpm-capable");
++ mtk->u2_lpm_disable = of_property_read_bool(node, "usb2-lpm-disable");
+ /* optional property, ignore the error if it does not exist */
+ of_property_read_u32(node, "mediatek,u3p-dis-msk",
+ &mtk->u3p_dis_msk);
+diff --git a/drivers/usb/host/xhci-mtk.h b/drivers/usb/host/xhci-mtk.h
+index cc59d80b663b4..1601ca9a388e8 100644
+--- a/drivers/usb/host/xhci-mtk.h
++++ b/drivers/usb/host/xhci-mtk.h
+@@ -123,6 +123,7 @@ struct xhci_hcd_mtk {
+ struct phy **phys;
+ int num_phys;
+ bool lpm_support;
++ bool u2_lpm_disable;
+ /* usb remote wakeup */
+ bool uwk_en;
+ struct regmap *uwk;
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 42ff11e3c4dcf..19485c076ba30 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -144,8 +144,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ (pdev->device == 0x15e0 || pdev->device == 0x15e1))
+ xhci->quirks |= XHCI_SNPS_BROKEN_SUSPEND;
+
+- if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x15e5)
++ if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x15e5) {
+ xhci->quirks |= XHCI_DISABLE_SPARSE;
++ xhci->quirks |= XHCI_RESET_ON_RESUME;
++ }
+
+ if (pdev->vendor == PCI_VENDOR_ID_AMD)
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 6c508d0313f7f..c4e3760abd5b4 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -227,6 +227,7 @@ static void xhci_zero_64b_regs(struct xhci_hcd *xhci)
+ struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
+ int err, i;
+ u64 val;
++ u32 intrs;
+
+ /*
+ * Some Renesas controllers get into a weird state if they are
+@@ -265,7 +266,10 @@ static void xhci_zero_64b_regs(struct xhci_hcd *xhci)
+ if (upper_32_bits(val))
+ xhci_write_64(xhci, 0, &xhci->op_regs->cmd_ring);
+
+- for (i = 0; i < HCS_MAX_INTRS(xhci->hcs_params1); i++) {
++ intrs = min_t(u32, HCS_MAX_INTRS(xhci->hcs_params1),
++ ARRAY_SIZE(xhci->run_regs->ir_set));
++
++ for (i = 0; i < intrs; i++) {
+ struct xhci_intr_reg __iomem *ir;
+
+ ir = &xhci->run_regs->ir_set[i];
+@@ -1370,7 +1374,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
+ * we need to issue an evaluate context command and wait on it.
+ */
+ static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id,
+- unsigned int ep_index, struct urb *urb)
++ unsigned int ep_index, struct urb *urb, gfp_t mem_flags)
+ {
+ struct xhci_container_ctx *out_ctx;
+ struct xhci_input_control_ctx *ctrl_ctx;
+@@ -1401,7 +1405,7 @@ static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id,
+ * changes max packet sizes.
+ */
+
+- command = xhci_alloc_command(xhci, true, GFP_KERNEL);
++ command = xhci_alloc_command(xhci, true, mem_flags);
+ if (!command)
+ return -ENOMEM;
+
+@@ -1498,7 +1502,7 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ */
+ if (urb->dev->speed == USB_SPEED_FULL) {
+ ret = xhci_check_maxpacket(xhci, slot_id,
+- ep_index, urb);
++ ep_index, urb, mem_flags);
+ if (ret < 0) {
+ xhci_urb_free_priv(urb_priv);
+ urb->hcpriv = NULL;
+@@ -3148,6 +3152,14 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
+
+ /* config ep command clears toggle if add and drop ep flags are set */
+ ctrl_ctx = xhci_get_input_control_ctx(cfg_cmd->in_ctx);
++ if (!ctrl_ctx) {
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ xhci_free_command(xhci, cfg_cmd);
++ xhci_warn(xhci, "%s: Could not get input context, bad type.\n",
++ __func__);
++ goto cleanup;
++ }
++
+ xhci_setup_input_ctx_for_config_ep(xhci, cfg_cmd->in_ctx, vdev->out_ctx,
+ ctrl_ctx, ep_flag, ep_flag);
+ xhci_endpoint_copy(xhci, cfg_cmd->in_ctx, vdev->out_ctx, ep_index);
+diff --git a/drivers/usb/typec/tcpci.c b/drivers/usb/typec/tcpci.c
+index dfae41fe13310..2c34add377085 100644
+--- a/drivers/usb/typec/tcpci.c
++++ b/drivers/usb/typec/tcpci.c
+@@ -20,6 +20,15 @@
+
+ #define PD_RETRY_COUNT 3
+
++#define tcpc_presenting_cc1_rd(reg) \
++ (!(TCPC_ROLE_CTRL_DRP & (reg)) && \
++ (((reg) & (TCPC_ROLE_CTRL_CC1_MASK << TCPC_ROLE_CTRL_CC1_SHIFT)) == \
++ (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC1_SHIFT)))
++#define tcpc_presenting_cc2_rd(reg) \
++ (!(TCPC_ROLE_CTRL_DRP & (reg)) && \
++ (((reg) & (TCPC_ROLE_CTRL_CC2_MASK << TCPC_ROLE_CTRL_CC2_SHIFT)) == \
++ (TCPC_ROLE_CTRL_CC_RD << TCPC_ROLE_CTRL_CC2_SHIFT)))
++
+ struct tcpci {
+ struct device *dev;
+
+@@ -168,19 +177,25 @@ static int tcpci_get_cc(struct tcpc_dev *tcpc,
+ enum typec_cc_status *cc1, enum typec_cc_status *cc2)
+ {
+ struct tcpci *tcpci = tcpc_to_tcpci(tcpc);
+- unsigned int reg;
++ unsigned int reg, role_control;
+ int ret;
+
++ ret = regmap_read(tcpci->regmap, TCPC_ROLE_CTRL, &role_control);
++ if (ret < 0)
++ return ret;
++
+ ret = regmap_read(tcpci->regmap, TCPC_CC_STATUS, ®);
+ if (ret < 0)
+ return ret;
+
+ *cc1 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC1_SHIFT) &
+ TCPC_CC_STATUS_CC1_MASK,
+- reg & TCPC_CC_STATUS_TERM);
++ reg & TCPC_CC_STATUS_TERM ||
++ tcpc_presenting_cc1_rd(role_control));
+ *cc2 = tcpci_to_typec_cc((reg >> TCPC_CC_STATUS_CC2_SHIFT) &
+ TCPC_CC_STATUS_CC2_MASK,
+- reg & TCPC_CC_STATUS_TERM);
++ reg & TCPC_CC_STATUS_TERM ||
++ tcpc_presenting_cc2_rd(role_control));
+
+ return 0;
+ }
+diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
+index de2babadd1465..7b1437a51304a 100644
+--- a/drivers/usb/usbip/vudc_sysfs.c
++++ b/drivers/usb/usbip/vudc_sysfs.c
+@@ -157,12 +157,14 @@ static ssize_t usbip_sockfd_store(struct device *dev,
+ tcp_rx = kthread_create(&v_rx_loop, &udc->ud, "vudc_rx");
+ if (IS_ERR(tcp_rx)) {
+ sockfd_put(socket);
++ mutex_unlock(&udc->ud.sysfs_lock);
+ return -EINVAL;
+ }
+ tcp_tx = kthread_create(&v_tx_loop, &udc->ud, "vudc_tx");
+ if (IS_ERR(tcp_tx)) {
+ kthread_stop(tcp_rx);
+ sockfd_put(socket);
++ mutex_unlock(&udc->ud.sysfs_lock);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c
+index 1692a0cc30360..c99fcc6c2eba8 100644
+--- a/drivers/vfio/mdev/mdev_sysfs.c
++++ b/drivers/vfio/mdev/mdev_sysfs.c
+@@ -108,6 +108,7 @@ struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent,
+ return ERR_PTR(-ENOMEM);
+
+ type->kobj.kset = parent->mdev_types_kset;
++ type->parent = parent;
+
+ ret = kobject_init_and_add(&type->kobj, &mdev_type_ktype, NULL,
+ "%s-%s", dev_driver_string(parent->dev),
+@@ -135,7 +136,6 @@ struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent,
+ }
+
+ type->group = group;
+- type->parent = parent;
+ return type;
+
+ attrs_failed:
+diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c
+index 2811c4afde01c..e8ea768481049 100644
+--- a/drivers/video/fbdev/core/fbcmap.c
++++ b/drivers/video/fbdev/core/fbcmap.c
+@@ -101,17 +101,17 @@ int fb_alloc_cmap_gfp(struct fb_cmap *cmap, int len, int transp, gfp_t flags)
+ if (!len)
+ return 0;
+
+- cmap->red = kmalloc(size, flags);
++ cmap->red = kzalloc(size, flags);
+ if (!cmap->red)
+ goto fail;
+- cmap->green = kmalloc(size, flags);
++ cmap->green = kzalloc(size, flags);
+ if (!cmap->green)
+ goto fail;
+- cmap->blue = kmalloc(size, flags);
++ cmap->blue = kzalloc(size, flags);
+ if (!cmap->blue)
+ goto fail;
+ if (transp) {
+- cmap->transp = kmalloc(size, flags);
++ cmap->transp = kzalloc(size, flags);
+ if (!cmap->transp)
+ goto fail;
+ } else {
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 9f3faac490259..b34f76af59c4f 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1919,6 +1919,7 @@ ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ struct inode *bd_inode = bdev_file_inode(file);
+ loff_t size = i_size_read(bd_inode);
+ struct blk_plug plug;
++ size_t shorted = 0;
+ ssize_t ret;
+
+ if (bdev_read_only(I_BDEV(bd_inode)))
+@@ -1933,12 +1934,17 @@ ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ if ((iocb->ki_flags & (IOCB_NOWAIT | IOCB_DIRECT)) == IOCB_NOWAIT)
+ return -EOPNOTSUPP;
+
+- iov_iter_truncate(from, size - iocb->ki_pos);
++ size -= iocb->ki_pos;
++ if (iov_iter_count(from) > size) {
++ shorted = iov_iter_count(from) - size;
++ iov_iter_truncate(from, size);
++ }
+
+ blk_start_plug(&plug);
+ ret = __generic_file_write_iter(iocb, from);
+ if (ret > 0)
+ ret = generic_write_sync(iocb, ret);
++ iov_iter_reexpand(from, iov_iter_count(from) + shorted);
+ blk_finish_plug(&plug);
+ return ret;
+ }
+@@ -1950,13 +1956,21 @@ ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ struct inode *bd_inode = bdev_file_inode(file);
+ loff_t size = i_size_read(bd_inode);
+ loff_t pos = iocb->ki_pos;
++ size_t shorted = 0;
++ ssize_t ret;
+
+ if (pos >= size)
+ return 0;
+
+ size -= pos;
+- iov_iter_truncate(to, size);
+- return generic_file_read_iter(iocb, to);
++ if (iov_iter_count(to) > size) {
++ shorted = iov_iter_count(to) - size;
++ iov_iter_truncate(to, size);
++ }
++
++ ret = generic_file_read_iter(iocb, to);
++ iov_iter_reexpand(to, iov_iter_count(to) + shorted);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(blkdev_read_iter);
+
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 2bdd24425a683..00dc1b5c87372 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1414,10 +1414,30 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
+ "failed to read tree block %llu from get_old_root",
+ logical);
+ } else {
++ struct tree_mod_elem *tm2;
++
+ btrfs_tree_read_lock(old);
+ eb = btrfs_clone_extent_buffer(old);
++ /*
++ * After the lookup for the most recent tree mod operation
++ * above and before we locked and cloned the extent buffer
++ * 'old', a new tree mod log operation may have been added.
++ * So lookup for a more recent one to make sure the number
++ * of mod log operations we replay is consistent with the
++ * number of items we have in the cloned extent buffer,
++ * otherwise we can hit a BUG_ON when rewinding the extent
++ * buffer.
++ */
++ tm2 = tree_mod_log_search(fs_info, logical, time_seq);
+ btrfs_tree_read_unlock(old);
+ free_extent_buffer(old);
++ ASSERT(tm2);
++ ASSERT(tm2 == tm || tm2->seq > tm->seq);
++ if (!tm2 || tm2->seq < tm->seq) {
++ free_extent_buffer(eb);
++ return NULL;
++ }
++ tm = tm2;
+ }
+ } else if (old_root) {
+ eb_root_owner = btrfs_header_owner(eb_root);
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 1c053e10b33ba..717385b7f66f7 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -656,8 +656,6 @@ static noinline int create_subvol(struct inode *dir,
+ btrfs_set_root_otransid(root_item, trans->transid);
+
+ btrfs_tree_unlock(leaf);
+- free_extent_buffer(leaf);
+- leaf = NULL;
+
+ btrfs_set_root_dirid(root_item, new_dirid);
+
+@@ -666,8 +664,22 @@ static noinline int create_subvol(struct inode *dir,
+ key.type = BTRFS_ROOT_ITEM_KEY;
+ ret = btrfs_insert_root(trans, fs_info->tree_root, &key,
+ root_item);
+- if (ret)
++ if (ret) {
++ /*
++ * Since we don't abort the transaction in this case, free the
++ * tree block so that we don't leak space and leave the
++ * filesystem in an inconsistent state (an extent item in the
++ * extent tree without backreferences). Also no need to have
++ * the tree block locked since it is not in any tree at this
++ * point, so no other task can find it and use it.
++ */
++ btrfs_free_tree_block(trans, root, leaf, 0, 1);
++ free_extent_buffer(leaf);
+ goto fail;
++ }
++
++ free_extent_buffer(leaf);
++ leaf = NULL;
+
+ key.offset = (u64)-1;
+ new_root = btrfs_read_fs_root_no_name(fs_info, &key);
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index e6e4e6fb2adde..06c6a66a991f2 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1755,8 +1755,8 @@ int replace_path(struct btrfs_trans_handle *trans,
+ int ret;
+ int slot;
+
+- BUG_ON(src->root_key.objectid != BTRFS_TREE_RELOC_OBJECTID);
+- BUG_ON(dest->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID);
++ ASSERT(src->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID);
++ ASSERT(dest->root_key.objectid != BTRFS_TREE_RELOC_OBJECTID);
+
+ last_snapshot = btrfs_root_last_snapshot(&src->root_item);
+ again:
+@@ -1790,7 +1790,7 @@ again:
+ struct btrfs_key first_key;
+
+ level = btrfs_header_level(parent);
+- BUG_ON(level < lowest_level);
++ ASSERT(level >= lowest_level);
+
+ ret = btrfs_bin_search(parent, &key, level, &slot);
+ if (ret && slot > 0)
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 6e871a382209b..918781c51f0ba 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1779,6 +1779,7 @@ static int try_nonblocking_invalidate(struct inode *inode)
+ u32 invalidating_gen = ci->i_rdcache_gen;
+
+ spin_unlock(&ci->i_ceph_lock);
++ ceph_fscache_invalidate(inode);
+ invalidate_mapping_pages(&inode->i_data, 0, -1);
+ spin_lock(&ci->i_ceph_lock);
+
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 3c24fb77ef325..5f041fede7aa9 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1823,6 +1823,7 @@ static void ceph_invalidate_work(struct work_struct *work)
+ orig_gen = ci->i_rdcache_gen;
+ spin_unlock(&ci->i_ceph_lock);
+
++ ceph_fscache_invalidate(inode);
+ if (invalidate_inode_pages2(inode->i_mapping) < 0) {
+ pr_err("invalidate_pages %p fails\n", inode);
+ }
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index faafa9a557c23..9d94abaff8fc4 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2700,7 +2700,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key)
+ }
+ spin_unlock(&cifs_tcp_ses_lock);
+
+- return 1;
++ return -EAGAIN;
+ }
+ /*
+ * Encrypt or decrypt @rqst message. @rqst[0] has the following format:
+diff --git a/fs/dlm/debug_fs.c b/fs/dlm/debug_fs.c
+index fa08448e35dd7..bb87dad03cd40 100644
+--- a/fs/dlm/debug_fs.c
++++ b/fs/dlm/debug_fs.c
+@@ -544,6 +544,7 @@ static void *table_seq_next(struct seq_file *seq, void *iter_ptr, loff_t *pos)
+
+ if (bucket >= ls->ls_rsbtbl_size) {
+ kfree(ri);
++ ++*pos;
+ return NULL;
+ }
+ tree = toss ? &ls->ls_rsbtbl[bucket].toss : &ls->ls_rsbtbl[bucket].keep;
+diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
+index 025d66a705db6..b86a9b3a39c06 100644
+--- a/fs/ecryptfs/main.c
++++ b/fs/ecryptfs/main.c
+@@ -506,6 +506,12 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
+ goto out;
+ }
+
++ if (!dev_name) {
++ rc = -EINVAL;
++ err = "Device name cannot be null";
++ goto out;
++ }
++
+ rc = ecryptfs_parse_options(sbi, raw_data, &check_ruid);
+ if (rc) {
+ err = "Error parsing options";
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 8876eaad10f68..16abe23b1417a 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -1358,6 +1358,7 @@ int ext4_init_inode_table(struct super_block *sb, ext4_group_t group,
+ handle_t *handle;
+ ext4_fsblk_t blk;
+ int num, ret = 0, used_blks = 0;
++ unsigned long used_inos = 0;
+
+ /* This should not happen, but just to be sure check this */
+ if (sb_rdonly(sb)) {
+@@ -1388,22 +1389,37 @@ int ext4_init_inode_table(struct super_block *sb, ext4_group_t group,
+ * used inodes so we need to skip blocks with used inodes in
+ * inode table.
+ */
+- if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT)))
+- used_blks = DIV_ROUND_UP((EXT4_INODES_PER_GROUP(sb) -
+- ext4_itable_unused_count(sb, gdp)),
+- sbi->s_inodes_per_block);
+-
+- if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group) ||
+- ((group == 0) && ((EXT4_INODES_PER_GROUP(sb) -
+- ext4_itable_unused_count(sb, gdp)) <
+- EXT4_FIRST_INO(sb)))) {
+- ext4_error(sb, "Something is wrong with group %u: "
+- "used itable blocks: %d; "
+- "itable unused count: %u",
+- group, used_blks,
+- ext4_itable_unused_count(sb, gdp));
+- ret = 1;
+- goto err_out;
++ if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT))) {
++ used_inos = EXT4_INODES_PER_GROUP(sb) -
++ ext4_itable_unused_count(sb, gdp);
++ used_blks = DIV_ROUND_UP(used_inos, sbi->s_inodes_per_block);
++
++ /* Bogus inode unused count? */
++ if (used_blks < 0 || used_blks > sbi->s_itb_per_group) {
++ ext4_error(sb, "Something is wrong with group %u: "
++ "used itable blocks: %d; "
++ "itable unused count: %u",
++ group, used_blks,
++ ext4_itable_unused_count(sb, gdp));
++ ret = 1;
++ goto err_out;
++ }
++
++ used_inos += group * EXT4_INODES_PER_GROUP(sb);
++ /*
++ * Are there some uninitialized inodes in the inode table
++ * before the first normal inode?
++ */
++ if ((used_blks != sbi->s_itb_per_group) &&
++ (used_inos < EXT4_FIRST_INO(sb))) {
++ ext4_error(sb, "Something is wrong with group %u: "
++ "itable unused count: %u; "
++ "itables initialized count: %ld",
++ group, ext4_itable_unused_count(sb, gdp),
++ used_inos);
++ ret = 1;
++ goto err_out;
++ }
+ }
+
+ blk = ext4_inode_table(sb, gdp) + used_blks;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index e9e9f09f5370d..535ab6713732a 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2629,9 +2629,6 @@ static void ext4_orphan_cleanup(struct super_block *sb,
+ sb->s_flags &= ~SB_RDONLY;
+ }
+ #ifdef CONFIG_QUOTA
+- /* Needed for iput() to work correctly and not trash data */
+- sb->s_flags |= SB_ACTIVE;
+-
+ /*
+ * Turn on quotas which were not enabled for read-only mounts if
+ * filesystem has quota feature, so that they are updated correctly.
+@@ -4962,8 +4959,10 @@ static int ext4_commit_super(struct super_block *sb, int sync)
+ struct buffer_head *sbh = EXT4_SB(sb)->s_sbh;
+ int error = 0;
+
+- if (!sbh || block_device_ejected(sb))
+- return error;
++ if (!sbh)
++ return -EINVAL;
++ if (block_device_ejected(sb))
++ return -ENODEV;
+
+ /*
+ * If the file system is mounted read-only, don't update the
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index 299f295fcb6c7..6bf78cf63ea2e 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -220,7 +220,8 @@ out:
+
+ f2fs_put_page(page, 1);
+
+- f2fs_balance_fs(sbi, dn.node_changed);
++ if (!err)
++ f2fs_balance_fs(sbi, dn.node_changed);
+
+ return err;
+ }
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 1934dc6ad1ccd..ff3f97ba1a555 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -2654,6 +2654,9 @@ static void remove_nats_in_journal(struct f2fs_sb_info *sbi)
+ struct f2fs_nat_entry raw_ne;
+ nid_t nid = le32_to_cpu(nid_in_journal(journal, i));
+
++ if (f2fs_check_nid_range(sbi, nid))
++ continue;
++
+ raw_ne = nat_in_journal(journal, i);
+
+ ne = __lookup_nat_cache(nm_i, nid);
+diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
+index f057c213c453a..e10e2b62ccf45 100644
+--- a/fs/fuse/cuse.c
++++ b/fs/fuse/cuse.c
+@@ -621,6 +621,8 @@ static int __init cuse_init(void)
+ cuse_channel_fops.owner = THIS_MODULE;
+ cuse_channel_fops.open = cuse_channel_open;
+ cuse_channel_fops.release = cuse_channel_release;
++ /* CUSE is not prepared for FUSE_DEV_IOC_CLONE */
++ cuse_channel_fops.unlocked_ioctl = NULL;
+
+ cuse_class = class_create(THIS_MODULE, "cuse");
+ if (IS_ERR(cuse_class))
+diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
+index a930ddd156819..7054a542689f9 100644
+--- a/fs/hfsplus/extents.c
++++ b/fs/hfsplus/extents.c
+@@ -598,13 +598,15 @@ void hfsplus_file_truncate(struct inode *inode)
+ res = __hfsplus_ext_cache_extent(&fd, inode, alloc_cnt);
+ if (res)
+ break;
+- hfs_brec_remove(&fd);
+
+- mutex_unlock(&fd.tree->tree_lock);
+ start = hip->cached_start;
++ if (blk_cnt <= start)
++ hfs_brec_remove(&fd);
++ mutex_unlock(&fd.tree->tree_lock);
+ hfsplus_free_extents(sb, hip->cached_extents,
+ alloc_cnt - start, alloc_cnt - blk_cnt);
+ hfsplus_dump_extent(hip->cached_extents);
++ mutex_lock(&fd.tree->tree_lock);
+ if (blk_cnt > start) {
+ hip->extent_state |= HFSPLUS_EXT_DIRTY;
+ break;
+@@ -612,7 +614,6 @@ void hfsplus_file_truncate(struct inode *inode)
+ alloc_cnt = start;
+ hip->cached_start = hip->cached_blocks = 0;
+ hip->extent_state &= ~(HFSPLUS_EXT_DIRTY | HFSPLUS_EXT_NEW);
+- mutex_lock(&fd.tree->tree_lock);
+ }
+ hfs_find_exit(&fd);
+
+diff --git a/fs/iomap.c b/fs/iomap.c
+index 03edf62633dcc..ac7b2152c3ad1 100644
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -116,6 +116,7 @@ iomap_page_create(struct inode *inode, struct page *page)
+ iop = kmalloc(sizeof(*iop), GFP_NOFS | __GFP_NOFAIL);
+ atomic_set(&iop->read_count, 0);
+ atomic_set(&iop->write_count, 0);
++ spin_lock_init(&iop->uptodate_lock);
+ bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
+
+ /*
+@@ -204,25 +205,38 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
+ }
+
+ static void
+-iomap_set_range_uptodate(struct page *page, unsigned off, unsigned len)
++iomap_iop_set_range_uptodate(struct page *page, unsigned off, unsigned len)
+ {
+ struct iomap_page *iop = to_iomap_page(page);
+ struct inode *inode = page->mapping->host;
+ unsigned first = off >> inode->i_blkbits;
+ unsigned last = (off + len - 1) >> inode->i_blkbits;
+- unsigned int i;
+ bool uptodate = true;
++ unsigned long flags;
++ unsigned int i;
+
+- if (iop) {
+- for (i = 0; i < PAGE_SIZE / i_blocksize(inode); i++) {
+- if (i >= first && i <= last)
+- set_bit(i, iop->uptodate);
+- else if (!test_bit(i, iop->uptodate))
+- uptodate = false;
+- }
++ spin_lock_irqsave(&iop->uptodate_lock, flags);
++ for (i = 0; i < PAGE_SIZE / i_blocksize(inode); i++) {
++ if (i >= first && i <= last)
++ set_bit(i, iop->uptodate);
++ else if (!test_bit(i, iop->uptodate))
++ uptodate = false;
+ }
+
+- if (uptodate && !PageError(page))
++ if (uptodate)
++ SetPageUptodate(page);
++ spin_unlock_irqrestore(&iop->uptodate_lock, flags);
++}
++
++static void
++iomap_set_range_uptodate(struct page *page, unsigned off, unsigned len)
++{
++ if (PageError(page))
++ return;
++
++ if (page_has_private(page))
++ iomap_iop_set_range_uptodate(page, off, len);
++ else
+ SetPageUptodate(page);
+ }
+
+diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c
+index 406d9cc84ba8d..79e771ab624f4 100644
+--- a/fs/jffs2/compr_rtime.c
++++ b/fs/jffs2/compr_rtime.c
+@@ -37,6 +37,9 @@ static int jffs2_rtime_compress(unsigned char *data_in,
+ int outpos = 0;
+ int pos=0;
+
++ if (*dstlen <= 3)
++ return -1;
++
+ memset(positions,0,sizeof(positions));
+
+ while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
+diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
+index 90431dd613b8d..08813789fcf06 100644
+--- a/fs/jffs2/scan.c
++++ b/fs/jffs2/scan.c
+@@ -1075,7 +1075,7 @@ static int jffs2_scan_dirent_node(struct jffs2_sb_info *c, struct jffs2_eraseblo
+ memcpy(&fd->name, rd->name, checkedlen);
+ fd->name[checkedlen] = 0;
+
+- crc = crc32(0, fd->name, rd->nsize);
++ crc = crc32(0, fd->name, checkedlen);
+ if (crc != je32_to_cpu(rd->name_crc)) {
+ pr_notice("%s(): Name CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
+ __func__, ofs, je32_to_cpu(rd->name_crc), crc);
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index d8cba46a9395c..fee421da21975 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -101,7 +101,7 @@ static int decode_nfs_fh(struct xdr_stream *xdr, struct nfs_fh *fh)
+ if (unlikely(!p))
+ return -ENOBUFS;
+ fh->size = be32_to_cpup(p++);
+- if (fh->size > sizeof(struct nfs_fh)) {
++ if (fh->size > NFS_MAXFHSIZE) {
+ printk(KERN_ERR "NFS flexfiles: Too big fh received %d\n",
+ fh->size);
+ return -EOVERFLOW;
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index aee66d8f13305..dc55ecc3bec46 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1607,10 +1607,10 @@ EXPORT_SYMBOL_GPL(_nfs_display_fhandle);
+ */
+ static int nfs_inode_attrs_need_update(const struct inode *inode, const struct nfs_fattr *fattr)
+ {
+- const struct nfs_inode *nfsi = NFS_I(inode);
++ unsigned long attr_gencount = NFS_I(inode)->attr_gencount;
+
+- return ((long)fattr->gencount - (long)nfsi->attr_gencount) > 0 ||
+- ((long)nfsi->attr_gencount - (long)nfs_read_attr_generation_counter() > 0);
++ return (long)(fattr->gencount - attr_gencount) > 0 ||
++ (long)(attr_gencount - nfs_read_attr_generation_counter()) > 0;
+ }
+
+ static int nfs_refresh_inode_locked(struct inode *inode, struct nfs_fattr *fattr)
+@@ -2034,7 +2034,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ nfsi->attrtimeo_timestamp = now;
+ }
+ /* Set the barrier to be more recent than this fattr */
+- if ((long)fattr->gencount - (long)nfsi->attr_gencount > 0)
++ if ((long)(fattr->gencount - nfsi->attr_gencount) > 0)
+ nfsi->attr_gencount = fattr->gencount;
+ }
+
+diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
+index 526441de89c1d..be252795a6f70 100644
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -59,7 +59,8 @@ static int _nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep,
+ static int nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep,
+ loff_t offset, loff_t len)
+ {
+- struct nfs_server *server = NFS_SERVER(file_inode(filep));
++ struct inode *inode = file_inode(filep);
++ struct nfs_server *server = NFS_SERVER(inode);
+ struct nfs4_exception exception = { };
+ struct nfs_lock_context *lock;
+ int err;
+@@ -68,9 +69,13 @@ static int nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep,
+ if (IS_ERR(lock))
+ return PTR_ERR(lock);
+
+- exception.inode = file_inode(filep);
++ exception.inode = inode;
+ exception.state = lock->open_context->state;
+
++ err = nfs_sync_inode(inode);
++ if (err)
++ goto out;
++
+ do {
+ err = _nfs42_proc_fallocate(msg, filep, lock, offset, len);
+ if (err == -ENOTSUPP) {
+@@ -79,7 +84,7 @@ static int nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep,
+ }
+ err = nfs4_handle_exception(server, err, &exception);
+ } while (exception.retry);
+-
++out:
+ nfs_put_lock_context(lock);
+ return err;
+ }
+@@ -117,16 +122,13 @@ int nfs42_proc_deallocate(struct file *filep, loff_t offset, loff_t len)
+ return -EOPNOTSUPP;
+
+ inode_lock(inode);
+- err = nfs_sync_inode(inode);
+- if (err)
+- goto out_unlock;
+
+ err = nfs42_proc_fallocate(&msg, filep, offset, len);
+ if (err == 0)
+ truncate_pagecache_range(inode, offset, (offset + len) -1);
+ if (err == -EOPNOTSUPP)
+ NFS_SERVER(inode)->caps &= ~NFS_CAP_DEALLOCATE;
+-out_unlock:
++
+ inode_unlock(inode);
+ return err;
+ }
+@@ -498,7 +500,10 @@ static loff_t _nfs42_proc_llseek(struct file *filep,
+ if (status)
+ return status;
+
+- return vfs_setpos(filep, res.sr_offset, inode->i_sb->s_maxbytes);
++ if (whence == SEEK_DATA && res.sr_eof)
++ return -NFS4ERR_NXIO;
++ else
++ return vfs_setpos(filep, res.sr_offset, inode->i_sb->s_maxbytes);
+ }
+
+ loff_t nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 55965e8e9a2ed..af255109c5bf9 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1294,7 +1294,7 @@ _pnfs_return_layout(struct inode *ino)
+ }
+ valid_layout = pnfs_layout_is_valid(lo);
+ pnfs_clear_layoutcommit(ino, &tmp_list);
+- pnfs_mark_matching_lsegs_invalid(lo, &tmp_list, NULL, 0);
++ pnfs_mark_matching_lsegs_return(lo, &tmp_list, NULL, 0);
+
+ if (NFS_SERVER(ino)->pnfs_curr_ld->return_range) {
+ struct pnfs_layout_range range = {
+@@ -2359,6 +2359,9 @@ pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo,
+
+ assert_spin_locked(&lo->plh_inode->i_lock);
+
++ if (test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags))
++ tmp_list = &lo->plh_return_segs;
++
+ list_for_each_entry_safe(lseg, next, &lo->plh_segs, pls_list)
+ if (pnfs_match_lseg_recall(lseg, return_range, seq)) {
+ dprintk("%s: marking lseg %p iomode %d "
+@@ -2366,6 +2369,8 @@ pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo,
+ lseg, lseg->pls_range.iomode,
+ lseg->pls_range.offset,
+ lseg->pls_range.length);
++ if (test_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags))
++ tmp_list = &lo->plh_return_segs;
+ if (mark_lseg_invalid(lseg, tmp_list))
+ continue;
+ remaining++;
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index e164f489d01d9..30abafcd4ecce 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -824,7 +824,7 @@ static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
+ int ovl_copy_up_flags(struct dentry *dentry, int flags)
+ {
+ int err = 0;
+- const struct cred *old_cred = ovl_override_creds(dentry->d_sb);
++ const struct cred *old_cred;
+ bool disconnected = (dentry->d_flags & DCACHE_DISCONNECTED);
+
+ /*
+@@ -835,6 +835,7 @@ int ovl_copy_up_flags(struct dentry *dentry, int flags)
+ if (WARN_ON(disconnected && d_is_dir(dentry)))
+ return -EIO;
+
++ old_cred = ovl_override_creds(dentry->d_sb);
+ while (!err) {
+ struct dentry *next;
+ struct dentry *parent = NULL;
+diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
+index f1c1430ae7213..0bcb83479fcba 100644
+--- a/fs/squashfs/file.c
++++ b/fs/squashfs/file.c
+@@ -224,11 +224,11 @@ failure:
+ * If the skip factor is limited in this way then the file will use multiple
+ * slots.
+ */
+-static inline int calculate_skip(int blocks)
++static inline int calculate_skip(u64 blocks)
+ {
+- int skip = blocks / ((SQUASHFS_META_ENTRIES + 1)
++ u64 skip = blocks / ((SQUASHFS_META_ENTRIES + 1)
+ * SQUASHFS_META_INDEXES);
+- return min(SQUASHFS_CACHED_BLKS - 1, skip + 1);
++ return min((u64) SQUASHFS_CACHED_BLKS - 1, skip + 1);
+ }
+
+
+diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
+index c6f9b2225387f..673d1f08b9a4b 100644
+--- a/fs/ubifs/replay.c
++++ b/fs/ubifs/replay.c
+@@ -232,7 +232,8 @@ static bool inode_still_linked(struct ubifs_info *c, struct replay_entry *rino)
+ */
+ list_for_each_entry_reverse(r, &c->replay_list, list) {
+ ubifs_assert(c, r->sqnum >= rino->sqnum);
+- if (key_inum(c, &r->key) == key_inum(c, &rino->key))
++ if (key_inum(c, &r->key) == key_inum(c, &rino->key) &&
++ key_type(c, &r->key) == UBIFS_INO_KEY)
+ return r->deletion == 0;
+
+ }
+diff --git a/include/crypto/acompress.h b/include/crypto/acompress.h
+index e328b52425a85..1ff78365607cd 100644
+--- a/include/crypto/acompress.h
++++ b/include/crypto/acompress.h
+@@ -152,6 +152,8 @@ static inline struct crypto_acomp *crypto_acomp_reqtfm(struct acomp_req *req)
+ * crypto_free_acomp() -- free ACOMPRESS tfm handle
+ *
+ * @tfm: ACOMPRESS tfm handle allocated with crypto_alloc_acomp()
++ *
++ * If @tfm is a NULL or error pointer, this function does nothing.
+ */
+ static inline void crypto_free_acomp(struct crypto_acomp *tfm)
+ {
+diff --git a/include/crypto/aead.h b/include/crypto/aead.h
+index 1e26f790b03fa..c69c545ba39a9 100644
+--- a/include/crypto/aead.h
++++ b/include/crypto/aead.h
+@@ -187,6 +187,8 @@ static inline struct crypto_tfm *crypto_aead_tfm(struct crypto_aead *tfm)
+ /**
+ * crypto_free_aead() - zeroize and free aead handle
+ * @tfm: cipher handle to be freed
++ *
++ * If @tfm is a NULL or error pointer, this function does nothing.
+ */
+ static inline void crypto_free_aead(struct crypto_aead *tfm)
+ {
+diff --git a/include/crypto/akcipher.h b/include/crypto/akcipher.h
+index b5e11de4d497d..9817f2e5bff83 100644
+--- a/include/crypto/akcipher.h
++++ b/include/crypto/akcipher.h
+@@ -174,6 +174,8 @@ static inline struct crypto_akcipher *crypto_akcipher_reqtfm(
+ * crypto_free_akcipher() - free AKCIPHER tfm handle
+ *
+ * @tfm: AKCIPHER tfm handle allocated with crypto_alloc_akcipher()
++ *
++ * If @tfm is a NULL or error pointer, this function does nothing.
+ */
+ static inline void crypto_free_akcipher(struct crypto_akcipher *tfm)
+ {
+diff --git a/include/crypto/hash.h b/include/crypto/hash.h
+index 76e432cab75db..552517dcf9e4f 100644
+--- a/include/crypto/hash.h
++++ b/include/crypto/hash.h
+@@ -257,6 +257,8 @@ static inline struct crypto_tfm *crypto_ahash_tfm(struct crypto_ahash *tfm)
+ /**
+ * crypto_free_ahash() - zeroize and free the ahash handle
+ * @tfm: cipher handle to be freed
++ *
++ * If @tfm is a NULL or error pointer, this function does nothing.
+ */
+ static inline void crypto_free_ahash(struct crypto_ahash *tfm)
+ {
+@@ -692,6 +694,8 @@ static inline struct crypto_tfm *crypto_shash_tfm(struct crypto_shash *tfm)
+ /**
+ * crypto_free_shash() - zeroize and free the message digest handle
+ * @tfm: cipher handle to be freed
++ *
++ * If @tfm is a NULL or error pointer, this function does nothing.
+ */
+ static inline void crypto_free_shash(struct crypto_shash *tfm)
+ {
+diff --git a/include/crypto/kpp.h b/include/crypto/kpp.h
+index 1bde0a6514fa6..1a34630fc3718 100644
+--- a/include/crypto/kpp.h
++++ b/include/crypto/kpp.h
+@@ -159,6 +159,8 @@ static inline void crypto_kpp_set_flags(struct crypto_kpp *tfm, u32 flags)
+ * crypto_free_kpp() - free KPP tfm handle
+ *
+ * @tfm: KPP tfm handle allocated with crypto_alloc_kpp()
++ *
++ * If @tfm is a NULL or error pointer, this function does nothing.
+ */
+ static inline void crypto_free_kpp(struct crypto_kpp *tfm)
+ {
+diff --git a/include/crypto/rng.h b/include/crypto/rng.h
+index b95ede354a665..a788c1e5a1217 100644
+--- a/include/crypto/rng.h
++++ b/include/crypto/rng.h
+@@ -116,6 +116,8 @@ static inline struct rng_alg *crypto_rng_alg(struct crypto_rng *tfm)
+ /**
+ * crypto_free_rng() - zeroize and free RNG handle
+ * @tfm: cipher handle to be freed
++ *
++ * If @tfm is a NULL or error pointer, this function does nothing.
+ */
+ static inline void crypto_free_rng(struct crypto_rng *tfm)
+ {
+diff --git a/include/crypto/skcipher.h b/include/crypto/skcipher.h
+index 2f327f090c3e9..c7553f8b1bb69 100644
+--- a/include/crypto/skcipher.h
++++ b/include/crypto/skcipher.h
+@@ -206,6 +206,8 @@ static inline struct crypto_tfm *crypto_skcipher_tfm(
+ /**
+ * crypto_free_skcipher() - zeroize and free cipher handle
+ * @tfm: cipher handle to be freed
++ *
++ * If @tfm is a NULL or error pointer, this function does nothing.
+ */
+ static inline void crypto_free_skcipher(struct crypto_skcipher *tfm)
+ {
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index a46b6832b3733..4dcce83ca3784 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -270,6 +270,8 @@ struct hid_item {
+ #define HID_CP_SELECTION 0x000c0080
+ #define HID_CP_MEDIASELECTION 0x000c0087
+ #define HID_CP_SELECTDISC 0x000c00ba
++#define HID_CP_VOLUMEUP 0x000c00e9
++#define HID_CP_VOLUMEDOWN 0x000c00ea
+ #define HID_CP_PLAYBACKSPEED 0x000c00f1
+ #define HID_CP_PROXIMITY 0x000c0109
+ #define HID_CP_SPEAKERSYSTEM 0x000c0160
+diff --git a/include/linux/i2c.h b/include/linux/i2c.h
+index 7e748648c7d3d..6fda0458745dc 100644
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -662,6 +662,8 @@ struct i2c_adapter_quirks {
+ #define I2C_AQ_NO_ZERO_LEN_READ BIT(5)
+ #define I2C_AQ_NO_ZERO_LEN_WRITE BIT(6)
+ #define I2C_AQ_NO_ZERO_LEN (I2C_AQ_NO_ZERO_LEN_READ | I2C_AQ_NO_ZERO_LEN_WRITE)
++/* adapter cannot do repeated START */
++#define I2C_AQ_NO_REP_START BIT(7)
+
+ /*
+ * i2c_adapter is the structure used to identify a physical i2c bus along
+diff --git a/include/linux/iomap.h b/include/linux/iomap.h
+index 3555d54bf79a5..e93ecacb5eaf3 100644
+--- a/include/linux/iomap.h
++++ b/include/linux/iomap.h
+@@ -108,6 +108,7 @@ struct iomap_ops {
+ struct iomap_page {
+ atomic_t read_count;
+ atomic_t write_count;
++ spinlock_t uptodate_lock;
+ DECLARE_BITMAP(uptodate, PAGE_SIZE / 512);
+ };
+
+diff --git a/include/linux/module.h b/include/linux/module.h
+index 9915397715fc2..008cfc08a6643 100644
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -359,6 +359,7 @@ struct module {
+ unsigned int num_gpl_syms;
+ const struct kernel_symbol *gpl_syms;
+ const s32 *gpl_crcs;
++ bool using_gplonly_symbols;
+
+ #ifdef CONFIG_UNUSED_SYMBOLS
+ /* unused exported symbols. */
+@@ -529,34 +530,14 @@ struct module *find_module(const char *name);
+ struct symsearch {
+ const struct kernel_symbol *start, *stop;
+ const s32 *crcs;
+- enum {
++ enum mod_license {
+ NOT_GPL_ONLY,
+ GPL_ONLY,
+ WILL_BE_GPL_ONLY,
+- } licence;
++ } license;
+ bool unused;
+ };
+
+-/*
+- * Search for an exported symbol by name.
+- *
+- * Must be called with module_mutex held or preemption disabled.
+- */
+-const struct kernel_symbol *find_symbol(const char *name,
+- struct module **owner,
+- const s32 **crc,
+- bool gplok,
+- bool warn);
+-
+-/*
+- * Walk the exported symbol table
+- *
+- * Must be called with module_mutex held or preemption disabled.
+- */
+-bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
+- struct module *owner,
+- void *data), void *data);
+-
+ /* Returns 0 and fills in value, defined and namebuf, or -ERANGE if
+ symnum out of range. */
+ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
+@@ -604,7 +585,6 @@ static inline void __module_get(struct module *module)
+ #define symbol_put_addr(p) do { } while (0)
+
+ #endif /* CONFIG_MODULE_UNLOAD */
+-int ref_module(struct module *a, struct module *b);
+
+ /* This is a #define so the string doesn't get put in every .o file */
+ #define module_name(mod) \
+diff --git a/include/linux/power/bq27xxx_battery.h b/include/linux/power/bq27xxx_battery.h
+index d6355f49fbae6..13d5dd4eb40b4 100644
+--- a/include/linux/power/bq27xxx_battery.h
++++ b/include/linux/power/bq27xxx_battery.h
+@@ -49,7 +49,6 @@ struct bq27xxx_reg_cache {
+ int capacity;
+ int energy;
+ int flags;
+- int power_avg;
+ int health;
+ };
+
+diff --git a/include/linux/smp.h b/include/linux/smp.h
+index 9fb239e12b824..6bb7f07bc1dd2 100644
+--- a/include/linux/smp.h
++++ b/include/linux/smp.h
+@@ -53,7 +53,7 @@ void on_each_cpu_cond(bool (*cond_func)(int cpu, void *info),
+ smp_call_func_t func, void *info, bool wait,
+ gfp_t gfp_flags);
+
+-int smp_call_function_single_async(int cpu, call_single_data_t *csd);
++int smp_call_function_single_async(int cpu, struct __call_single_data *csd);
+
+ #ifdef CONFIG_SMP
+
+diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
+index 8ceba9b8e51e3..16158fe097a82 100644
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -450,6 +450,9 @@ struct spi_controller {
+
+ #define SPI_MASTER_GPIO_SS BIT(5) /* GPIO CS must select slave */
+
++ /* flag indicating this is a non-devres managed controller */
++ bool devm_allocated;
++
+ /* flag indicating this is an SPI slave controller */
+ bool slave;
+
+diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
+index 71dbc891851a4..e10b09672345b 100644
+--- a/include/linux/tty_driver.h
++++ b/include/linux/tty_driver.h
+@@ -236,7 +236,7 @@
+ *
+ * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel
+ * structure to complete. This method is optional and will only be called
+- * if provided (otherwise EINVAL will be returned).
++ * if provided (otherwise ENOTTY will be returned).
+ */
+
+ #include <linux/export.h>
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 3195728095752..6a61faf0cc79a 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -526,6 +526,7 @@ struct hci_chan {
+ struct sk_buff_head data_q;
+ unsigned int sent;
+ __u8 state;
++ bool amp;
+ };
+
+ struct hci_conn_params {
+diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h
+index 58507c7783cf0..eafccb2d4d6f7 100644
+--- a/include/scsi/libfcoe.h
++++ b/include/scsi/libfcoe.h
+@@ -261,7 +261,7 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *, struct fc_lport *,
+ struct fc_frame *);
+
+ /* libfcoe funcs */
+-u64 fcoe_wwn_from_mac(unsigned char mac[], unsigned int, unsigned int);
++u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
+ int fcoe_libfc_config(struct fc_lport *, struct fcoe_ctlr *,
+ const struct libfc_function_template *, int init_fcp);
+ u32 fcoe_fc_crc(struct fc_frame *fp);
+diff --git a/include/uapi/linux/netfilter/xt_SECMARK.h b/include/uapi/linux/netfilter/xt_SECMARK.h
+index 1f2a708413f5d..beb2cadba8a9c 100644
+--- a/include/uapi/linux/netfilter/xt_SECMARK.h
++++ b/include/uapi/linux/netfilter/xt_SECMARK.h
+@@ -20,4 +20,10 @@ struct xt_secmark_target_info {
+ char secctx[SECMARK_SECCTX_MAX];
+ };
+
++struct xt_secmark_target_info_v1 {
++ __u8 mode;
++ char secctx[SECMARK_SECCTX_MAX];
++ __u32 secid;
++};
++
+ #endif /*_XT_SECMARK_H_target */
+diff --git a/include/uapi/linux/tty_flags.h b/include/uapi/linux/tty_flags.h
+index 900a32e634247..6a3ac496a56c1 100644
+--- a/include/uapi/linux/tty_flags.h
++++ b/include/uapi/linux/tty_flags.h
+@@ -39,7 +39,7 @@
+ * WARNING: These flags are no longer used and have been superceded by the
+ * TTY_PORT_ flags in the iflags field (and not userspace-visible)
+ */
+-#ifndef _KERNEL_
++#ifndef __KERNEL__
+ #define ASYNCB_INITIALIZED 31 /* Serial port was initialized */
+ #define ASYNCB_SUSPENDED 30 /* Serial port is suspended */
+ #define ASYNCB_NORMAL_ACTIVE 29 /* Normal device is active */
+@@ -81,7 +81,7 @@
+ #define ASYNC_SPD_WARP (ASYNC_SPD_HI|ASYNC_SPD_SHI)
+ #define ASYNC_SPD_MASK (ASYNC_SPD_HI|ASYNC_SPD_VHI|ASYNC_SPD_SHI)
+
+-#ifndef _KERNEL_
++#ifndef __KERNEL__
+ /* These flags are no longer used (and were always masked from userspace) */
+ #define ASYNC_INITIALIZED (1U << ASYNCB_INITIALIZED)
+ #define ASYNC_NORMAL_ACTIVE (1U << ASYNCB_NORMAL_ACTIVE)
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 7d0d8a45f9ae7..526ebcff5a0a9 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -3867,8 +3867,7 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
+
+ if (op & FUTEX_CLOCK_REALTIME) {
+ flags |= FLAGS_CLOCKRT;
+- if (cmd != FUTEX_WAIT && cmd != FUTEX_WAIT_BITSET && \
+- cmd != FUTEX_WAIT_REQUEUE_PI)
++ if (cmd != FUTEX_WAIT_BITSET && cmd != FUTEX_WAIT_REQUEUE_PI)
+ return -ENOSYS;
+ }
+
+diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
+index 651a4ad6d711f..8e586858bcf41 100644
+--- a/kernel/irq/matrix.c
++++ b/kernel/irq/matrix.c
+@@ -423,7 +423,9 @@ void irq_matrix_free(struct irq_matrix *m, unsigned int cpu,
+ if (WARN_ON_ONCE(bit < m->alloc_start || bit >= m->alloc_end))
+ return;
+
+- clear_bit(bit, cm->alloc_map);
++ if (WARN_ON_ONCE(!test_and_clear_bit(bit, cm->alloc_map)))
++ return;
++
+ cm->allocated--;
+ if(managed)
+ cm->managed_allocated--;
+diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
+index 2fbdb78d66c80..89d41c0a10f1e 100644
+--- a/kernel/kexec_file.c
++++ b/kernel/kexec_file.c
+@@ -631,8 +631,10 @@ static int kexec_calculate_store_digests(struct kimage *image)
+
+ sha_region_sz = KEXEC_SEGMENT_MAX * sizeof(struct kexec_sha_region);
+ sha_regions = vzalloc(sha_region_sz);
+- if (!sha_regions)
++ if (!sha_regions) {
++ ret = -ENOMEM;
+ goto out_free_desc;
++ }
+
+ desc->tfm = tfm;
+ desc->flags = 0;
+diff --git a/kernel/module.c b/kernel/module.c
+index d5d01ece720c4..92d8610742c7d 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -415,7 +415,7 @@ static bool each_symbol_in_section(const struct symsearch *arr,
+ }
+
+ /* Returns true as soon as fn returns true, otherwise false. */
+-bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
++static bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
+ struct module *owner,
+ void *data),
+ void *data)
+@@ -476,7 +476,6 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
+ }
+ return false;
+ }
+-EXPORT_SYMBOL_GPL(each_symbol_section);
+
+ struct find_symbol_arg {
+ /* Input */
+@@ -488,6 +487,7 @@ struct find_symbol_arg {
+ struct module *owner;
+ const s32 *crc;
+ const struct kernel_symbol *sym;
++ enum mod_license license;
+ };
+
+ static bool check_symbol(const struct symsearch *syms,
+@@ -497,9 +497,9 @@ static bool check_symbol(const struct symsearch *syms,
+ struct find_symbol_arg *fsa = data;
+
+ if (!fsa->gplok) {
+- if (syms->licence == GPL_ONLY)
++ if (syms->license == GPL_ONLY)
+ return false;
+- if (syms->licence == WILL_BE_GPL_ONLY && fsa->warn) {
++ if (syms->license == WILL_BE_GPL_ONLY && fsa->warn) {
+ pr_warn("Symbol %s is being used by a non-GPL module, "
+ "which will not be allowed in the future\n",
+ fsa->name);
+@@ -521,6 +521,7 @@ static bool check_symbol(const struct symsearch *syms,
+ fsa->owner = owner;
+ fsa->crc = symversion(syms->crcs, symnum);
+ fsa->sym = &syms->start[symnum];
++ fsa->license = syms->license;
+ return true;
+ }
+
+@@ -568,9 +569,10 @@ static bool find_symbol_in_section(const struct symsearch *syms,
+
+ /* Find a symbol and return it, along with, (optional) crc and
+ * (optional) module which owns it. Needs preempt disabled or module_mutex. */
+-const struct kernel_symbol *find_symbol(const char *name,
++static const struct kernel_symbol *find_symbol(const char *name,
+ struct module **owner,
+ const s32 **crc,
++ enum mod_license *license,
+ bool gplok,
+ bool warn)
+ {
+@@ -585,13 +587,14 @@ const struct kernel_symbol *find_symbol(const char *name,
+ *owner = fsa.owner;
+ if (crc)
+ *crc = fsa.crc;
++ if (license)
++ *license = fsa.license;
+ return fsa.sym;
+ }
+
+ pr_debug("Failed to find symbol %s\n", name);
+ return NULL;
+ }
+-EXPORT_SYMBOL_GPL(find_symbol);
+
+ /*
+ * Search for module by name: must hold module_mutex (or preempt disabled
+@@ -851,7 +854,7 @@ static int add_module_usage(struct module *a, struct module *b)
+ }
+
+ /* Module a uses b: caller needs module_mutex() */
+-int ref_module(struct module *a, struct module *b)
++static int ref_module(struct module *a, struct module *b)
+ {
+ int err;
+
+@@ -870,7 +873,6 @@ int ref_module(struct module *a, struct module *b)
+ }
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(ref_module);
+
+ /* Clear the unload stuff of the module. */
+ static void module_unload_free(struct module *mod)
+@@ -1059,7 +1061,7 @@ void __symbol_put(const char *symbol)
+ struct module *owner;
+
+ preempt_disable();
+- if (!find_symbol(symbol, &owner, NULL, true, false))
++ if (!find_symbol(symbol, &owner, NULL, NULL, true, false))
+ BUG();
+ module_put(owner);
+ preempt_enable();
+@@ -1151,11 +1153,10 @@ static inline void module_unload_free(struct module *mod)
+ {
+ }
+
+-int ref_module(struct module *a, struct module *b)
++static int ref_module(struct module *a, struct module *b)
+ {
+ return strong_try_module_get(b);
+ }
+-EXPORT_SYMBOL_GPL(ref_module);
+
+ static inline int module_unload_init(struct module *mod)
+ {
+@@ -1338,7 +1339,7 @@ static inline int check_modstruct_version(const struct load_info *info,
+ * locking is necessary -- use preempt_disable() to placate lockdep.
+ */
+ preempt_disable();
+- if (!find_symbol("module_layout", NULL, &crc, true, false)) {
++ if (!find_symbol("module_layout", NULL, &crc, NULL, true, false)) {
+ preempt_enable();
+ BUG();
+ }
+@@ -1378,6 +1379,25 @@ static inline int same_magic(const char *amagic, const char *bmagic,
+ }
+ #endif /* CONFIG_MODVERSIONS */
+
++static bool inherit_taint(struct module *mod, struct module *owner)
++{
++ if (!owner || !test_bit(TAINT_PROPRIETARY_MODULE, &owner->taints))
++ return true;
++
++ if (mod->using_gplonly_symbols) {
++ pr_err("%s: module using GPL-only symbols uses symbols from proprietary module %s.\n",
++ mod->name, owner->name);
++ return false;
++ }
++
++ if (!test_bit(TAINT_PROPRIETARY_MODULE, &mod->taints)) {
++ pr_warn("%s: module uses symbols from proprietary module %s, inheriting taint.\n",
++ mod->name, owner->name);
++ set_bit(TAINT_PROPRIETARY_MODULE, &mod->taints);
++ }
++ return true;
++}
++
+ /* Resolve a symbol for this module. I.e. if we find one, record usage. */
+ static const struct kernel_symbol *resolve_symbol(struct module *mod,
+ const struct load_info *info,
+@@ -1387,6 +1407,7 @@ static const struct kernel_symbol *resolve_symbol(struct module *mod,
+ struct module *owner;
+ const struct kernel_symbol *sym;
+ const s32 *crc;
++ enum mod_license license;
+ int err;
+
+ /*
+@@ -1396,11 +1417,19 @@ static const struct kernel_symbol *resolve_symbol(struct module *mod,
+ */
+ sched_annotate_sleep();
+ mutex_lock(&module_mutex);
+- sym = find_symbol(name, &owner, &crc,
++ sym = find_symbol(name, &owner, &crc, &license,
+ !(mod->taints & (1 << TAINT_PROPRIETARY_MODULE)), true);
+ if (!sym)
+ goto unlock;
+
++ if (license == GPL_ONLY)
++ mod->using_gplonly_symbols = true;
++
++ if (!inherit_taint(mod, owner)) {
++ sym = NULL;
++ goto getname;
++ }
++
+ if (!check_version(info, name, mod, crc)) {
+ sym = ERR_PTR(-EINVAL);
+ goto getname;
+@@ -2226,7 +2255,7 @@ void *__symbol_get(const char *symbol)
+ const struct kernel_symbol *sym;
+
+ preempt_disable();
+- sym = find_symbol(symbol, &owner, NULL, true, true);
++ sym = find_symbol(symbol, &owner, NULL, NULL, true, true);
+ if (sym && strong_try_module_get(owner))
+ sym = NULL;
+ preempt_enable();
+@@ -2262,7 +2291,7 @@ static int verify_export_symbols(struct module *mod)
+ for (i = 0; i < ARRAY_SIZE(arr); i++) {
+ for (s = arr[i].sym; s < arr[i].sym + arr[i].num; s++) {
+ if (find_symbol(kernel_symbol_name(s), &owner, NULL,
+- true, false)) {
++ NULL, true, false)) {
+ pr_err("%s: exports duplicate symbol %s"
+ " (owned by %s)\n",
+ mod->name, kernel_symbol_name(s),
+@@ -4385,7 +4414,6 @@ struct module *__module_address(unsigned long addr)
+ }
+ return mod;
+ }
+-EXPORT_SYMBOL_GPL(__module_address);
+
+ /*
+ * is_module_text_address - is this address inside module code?
+@@ -4424,7 +4452,6 @@ struct module *__module_text_address(unsigned long addr)
+ }
+ return mod;
+ }
+-EXPORT_SYMBOL_GPL(__module_text_address);
+
+ /* Don't grab lock, we're oopsing. */
+ void print_modules(void)
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index 78fadf0438ea0..9518606fa1e58 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -11,8 +11,6 @@
+ */
+ #include "sched.h"
+
+-static DEFINE_SPINLOCK(sched_debug_lock);
+-
+ /*
+ * This allows printing both to /proc/sched_debug and
+ * to the console
+@@ -434,16 +432,37 @@ static void print_cfs_group_stats(struct seq_file *m, int cpu, struct task_group
+ #endif
+
+ #ifdef CONFIG_CGROUP_SCHED
++static DEFINE_SPINLOCK(sched_debug_lock);
+ static char group_path[PATH_MAX];
+
+-static char *task_group_path(struct task_group *tg)
++static void task_group_path(struct task_group *tg, char *path, int plen)
+ {
+- if (autogroup_path(tg, group_path, PATH_MAX))
+- return group_path;
++ if (autogroup_path(tg, path, plen))
++ return;
+
+- cgroup_path(tg->css.cgroup, group_path, PATH_MAX);
++ cgroup_path(tg->css.cgroup, path, plen);
++}
+
+- return group_path;
++/*
++ * Only 1 SEQ_printf_task_group_path() caller can use the full length
++ * group_path[] for cgroup path. Other simultaneous callers will have
++ * to use a shorter stack buffer. A "..." suffix is appended at the end
++ * of the stack buffer so that it will show up in case the output length
++ * matches the given buffer size to indicate possible path name truncation.
++ */
++#define SEQ_printf_task_group_path(m, tg, fmt...) \
++{ \
++ if (spin_trylock(&sched_debug_lock)) { \
++ task_group_path(tg, group_path, sizeof(group_path)); \
++ SEQ_printf(m, fmt, group_path); \
++ spin_unlock(&sched_debug_lock); \
++ } else { \
++ char buf[128]; \
++ char *bufend = buf + sizeof(buf) - 3; \
++ task_group_path(tg, buf, bufend - buf); \
++ strcpy(bufend - 1, "..."); \
++ SEQ_printf(m, fmt, buf); \
++ } \
+ }
+ #endif
+
+@@ -470,7 +489,7 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
+ SEQ_printf(m, " %d %d", task_node(p), task_numa_group_id(p));
+ #endif
+ #ifdef CONFIG_CGROUP_SCHED
+- SEQ_printf(m, " %s", task_group_path(task_group(p)));
++ SEQ_printf_task_group_path(m, task_group(p), " %s")
+ #endif
+
+ SEQ_printf(m, "\n");
+@@ -507,7 +526,7 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
+
+ #ifdef CONFIG_FAIR_GROUP_SCHED
+ SEQ_printf(m, "\n");
+- SEQ_printf(m, "cfs_rq[%d]:%s\n", cpu, task_group_path(cfs_rq->tg));
++ SEQ_printf_task_group_path(m, cfs_rq->tg, "cfs_rq[%d]:%s\n", cpu);
+ #else
+ SEQ_printf(m, "\n");
+ SEQ_printf(m, "cfs_rq[%d]:\n", cpu);
+@@ -579,7 +598,7 @@ void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq)
+ {
+ #ifdef CONFIG_RT_GROUP_SCHED
+ SEQ_printf(m, "\n");
+- SEQ_printf(m, "rt_rq[%d]:%s\n", cpu, task_group_path(rt_rq->tg));
++ SEQ_printf_task_group_path(m, rt_rq->tg, "rt_rq[%d]:%s\n", cpu);
+ #else
+ SEQ_printf(m, "\n");
+ SEQ_printf(m, "rt_rq[%d]:\n", cpu);
+@@ -631,7 +650,6 @@ void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq)
+ static void print_cpu(struct seq_file *m, int cpu)
+ {
+ struct rq *rq = cpu_rq(cpu);
+- unsigned long flags;
+
+ #ifdef CONFIG_X86
+ {
+@@ -690,13 +708,11 @@ do { \
+ }
+ #undef P
+
+- spin_lock_irqsave(&sched_debug_lock, flags);
+ print_cfs_stats(m, cpu);
+ print_rt_stats(m, cpu);
+ print_dl_stats(m, cpu);
+
+ print_rq(m, rq, cpu);
+- spin_unlock_irqrestore(&sched_debug_lock, flags);
+ SEQ_printf(m, "\n");
+ }
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 696d08a4593ef..80392cdd5f3b2 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9903,16 +9903,22 @@ static void propagate_entity_cfs_rq(struct sched_entity *se)
+ {
+ struct cfs_rq *cfs_rq;
+
++ list_add_leaf_cfs_rq(cfs_rq_of(se));
++
+ /* Start to propagate at parent */
+ se = se->parent;
+
+ for_each_sched_entity(se) {
+ cfs_rq = cfs_rq_of(se);
+
+- if (cfs_rq_throttled(cfs_rq))
+- break;
++ if (!cfs_rq_throttled(cfs_rq)){
++ update_load_avg(cfs_rq, se, UPDATE_TG);
++ list_add_leaf_cfs_rq(cfs_rq);
++ continue;
++ }
+
+- update_load_avg(cfs_rq, se, UPDATE_TG);
++ if (list_add_leaf_cfs_rq(cfs_rq))
++ break;
+ }
+ }
+ #else
+diff --git a/kernel/smp.c b/kernel/smp.c
+index 084c8b3a26812..00d208ef07c76 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -103,12 +103,12 @@ void __init call_function_init(void)
+ * previous function call. For multi-cpu calls its even more interesting
+ * as we'll have to ensure no other cpu is observing our csd.
+ */
+-static __always_inline void csd_lock_wait(call_single_data_t *csd)
++static __always_inline void csd_lock_wait(struct __call_single_data *csd)
+ {
+ smp_cond_load_acquire(&csd->flags, !(VAL & CSD_FLAG_LOCK));
+ }
+
+-static __always_inline void csd_lock(call_single_data_t *csd)
++static __always_inline void csd_lock(struct __call_single_data *csd)
+ {
+ csd_lock_wait(csd);
+ csd->flags |= CSD_FLAG_LOCK;
+@@ -121,7 +121,7 @@ static __always_inline void csd_lock(call_single_data_t *csd)
+ smp_wmb();
+ }
+
+-static __always_inline void csd_unlock(call_single_data_t *csd)
++static __always_inline void csd_unlock(struct __call_single_data *csd)
+ {
+ WARN_ON(!(csd->flags & CSD_FLAG_LOCK));
+
+@@ -138,7 +138,7 @@ static DEFINE_PER_CPU_SHARED_ALIGNED(call_single_data_t, csd_data);
+ * for execution on the given CPU. data must already have
+ * ->func, ->info, and ->flags set.
+ */
+-static int generic_exec_single(int cpu, call_single_data_t *csd,
++static int generic_exec_single(int cpu, struct __call_single_data *csd,
+ smp_call_func_t func, void *info)
+ {
+ if (cpu == smp_processor_id()) {
+@@ -323,7 +323,7 @@ EXPORT_SYMBOL(smp_call_function_single);
+ * NOTE: Be careful, there is unfortunately no current debugging facility to
+ * validate the correctness of this serialization.
+ */
+-int smp_call_function_single_async(int cpu, call_single_data_t *csd)
++int smp_call_function_single_async(int cpu, struct __call_single_data *csd)
+ {
+ int err = 0;
+
+diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
+index 5a01c4fdbfef4..48758108e055c 100644
+--- a/kernel/time/posix-timers.c
++++ b/kernel/time/posix-timers.c
+@@ -1166,8 +1166,8 @@ COMPAT_SYSCALL_DEFINE2(clock_adjtime, clockid_t, which_clock,
+
+ err = kc->clock_adj(which_clock, &ktx);
+
+- if (err >= 0)
+- err = compat_put_timex(utp, &ktx);
++ if (err >= 0 && compat_put_timex(utp, &ktx))
++ return -EFAULT;
+
+ return err;
+ }
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 3492202762c73..f8d82b36dd668 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -5023,7 +5023,10 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
+
+ parser = &iter->parser;
+ if (trace_parser_loaded(parser)) {
+- ftrace_match_records(iter->hash, parser->buffer, parser->idx);
++ int enable = !(iter->flags & FTRACE_ITER_NOTRACE);
++
++ ftrace_process_regex(iter, parser->buffer,
++ parser->idx, enable);
+ }
+
+ trace_parser_put(parser);
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index bca0b6df53caf..4eea58a907f08 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1935,14 +1935,13 @@ static void tracing_stop_tr(struct trace_array *tr)
+
+ static int trace_save_cmdline(struct task_struct *tsk)
+ {
+- unsigned pid, idx;
++ unsigned tpid, idx;
+
+ /* treat recording of idle task as a success */
+ if (!tsk->pid)
+ return 1;
+
+- if (unlikely(tsk->pid > PID_MAX_DEFAULT))
+- return 0;
++ tpid = tsk->pid & (PID_MAX_DEFAULT - 1);
+
+ /*
+ * It's not the end of the world if we don't get
+@@ -1953,26 +1952,15 @@ static int trace_save_cmdline(struct task_struct *tsk)
+ if (!arch_spin_trylock(&trace_cmdline_lock))
+ return 0;
+
+- idx = savedcmd->map_pid_to_cmdline[tsk->pid];
++ idx = savedcmd->map_pid_to_cmdline[tpid];
+ if (idx == NO_CMDLINE_MAP) {
+ idx = (savedcmd->cmdline_idx + 1) % savedcmd->cmdline_num;
+
+- /*
+- * Check whether the cmdline buffer at idx has a pid
+- * mapped. We are going to overwrite that entry so we
+- * need to clear the map_pid_to_cmdline. Otherwise we
+- * would read the new comm for the old pid.
+- */
+- pid = savedcmd->map_cmdline_to_pid[idx];
+- if (pid != NO_CMDLINE_MAP)
+- savedcmd->map_pid_to_cmdline[pid] = NO_CMDLINE_MAP;
+-
+- savedcmd->map_cmdline_to_pid[idx] = tsk->pid;
+- savedcmd->map_pid_to_cmdline[tsk->pid] = idx;
+-
++ savedcmd->map_pid_to_cmdline[tpid] = idx;
+ savedcmd->cmdline_idx = idx;
+ }
+
++ savedcmd->map_cmdline_to_pid[idx] = tsk->pid;
+ set_cmdline(idx, tsk->comm);
+
+ arch_spin_unlock(&trace_cmdline_lock);
+@@ -1983,6 +1971,7 @@ static int trace_save_cmdline(struct task_struct *tsk)
+ static void __trace_find_cmdline(int pid, char comm[])
+ {
+ unsigned map;
++ int tpid;
+
+ if (!pid) {
+ strcpy(comm, "<idle>");
+@@ -1994,16 +1983,16 @@ static void __trace_find_cmdline(int pid, char comm[])
+ return;
+ }
+
+- if (pid > PID_MAX_DEFAULT) {
+- strcpy(comm, "<...>");
+- return;
++ tpid = pid & (PID_MAX_DEFAULT - 1);
++ map = savedcmd->map_pid_to_cmdline[tpid];
++ if (map != NO_CMDLINE_MAP) {
++ tpid = savedcmd->map_cmdline_to_pid[map];
++ if (tpid == pid) {
++ strlcpy(comm, get_saved_cmdlines(map), TASK_COMM_LEN);
++ return;
++ }
+ }
+-
+- map = savedcmd->map_pid_to_cmdline[pid];
+- if (map != NO_CMDLINE_MAP)
+- strlcpy(comm, get_saved_cmdlines(map), TASK_COMM_LEN);
+- else
+- strcpy(comm, "<...>");
++ strcpy(comm, "<...>");
+ }
+
+ void trace_find_cmdline(int pid, char comm[])
+diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c
+index aaf6793ededaa..c1637f90c8a38 100644
+--- a/kernel/trace/trace_clock.c
++++ b/kernel/trace/trace_clock.c
+@@ -95,33 +95,49 @@ u64 notrace trace_clock_global(void)
+ {
+ unsigned long flags;
+ int this_cpu;
+- u64 now;
++ u64 now, prev_time;
+
+ raw_local_irq_save(flags);
+
+ this_cpu = raw_smp_processor_id();
+- now = sched_clock_cpu(this_cpu);
++
+ /*
+- * If in an NMI context then dont risk lockups and return the
+- * cpu_clock() time:
++ * The global clock "guarantees" that the events are ordered
++ * between CPUs. But if two events on two different CPUS call
++ * trace_clock_global at roughly the same time, it really does
++ * not matter which one gets the earlier time. Just make sure
++ * that the same CPU will always show a monotonic clock.
++ *
++ * Use a read memory barrier to get the latest written
++ * time that was recorded.
+ */
+- if (unlikely(in_nmi()))
+- goto out;
++ smp_rmb();
++ prev_time = READ_ONCE(trace_clock_struct.prev_time);
++ now = sched_clock_cpu(this_cpu);
+
+- arch_spin_lock(&trace_clock_struct.lock);
++ /* Make sure that now is always greater than prev_time */
++ if ((s64)(now - prev_time) < 0)
++ now = prev_time + 1;
+
+ /*
+- * TODO: if this happens often then maybe we should reset
+- * my_scd->clock to prev_time+1, to make sure
+- * we start ticking with the local clock from now on?
++ * If in an NMI context then dont risk lockups and simply return
++ * the current time.
+ */
+- if ((s64)(now - trace_clock_struct.prev_time) < 0)
+- now = trace_clock_struct.prev_time + 1;
++ if (unlikely(in_nmi()))
++ goto out;
+
+- trace_clock_struct.prev_time = now;
++ /* Tracing can cause strange recursion, always use a try lock */
++ if (arch_spin_trylock(&trace_clock_struct.lock)) {
++ /* Reread prev_time in case it was already updated */
++ prev_time = READ_ONCE(trace_clock_struct.prev_time);
++ if ((s64)(now - prev_time) < 0)
++ now = prev_time + 1;
+
+- arch_spin_unlock(&trace_clock_struct.lock);
++ trace_clock_struct.prev_time = now;
+
++ /* The unlock acts as the wmb for the above rmb */
++ arch_spin_unlock(&trace_clock_struct.lock);
++ }
+ out:
+ raw_local_irq_restore(flags);
+
+diff --git a/kernel/up.c b/kernel/up.c
+index 42c46bf3e0a5c..2080f75e0e65c 100644
+--- a/kernel/up.c
++++ b/kernel/up.c
+@@ -23,7 +23,7 @@ int smp_call_function_single(int cpu, void (*func) (void *info), void *info,
+ }
+ EXPORT_SYMBOL(smp_call_function_single);
+
+-int smp_call_function_single_async(int cpu, call_single_data_t *csd)
++int smp_call_function_single_async(int cpu, struct __call_single_data *csd)
+ {
+ unsigned long flags;
+
+diff --git a/lib/bug.c b/lib/bug.c
+index 1077366f496ba..f4fcac5dd766f 100644
+--- a/lib/bug.c
++++ b/lib/bug.c
+@@ -155,30 +155,27 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
+
+ file = NULL;
+ line = 0;
+- warning = 0;
+
+- if (bug) {
+ #ifdef CONFIG_DEBUG_BUGVERBOSE
+ #ifndef CONFIG_GENERIC_BUG_RELATIVE_POINTERS
+- file = bug->file;
++ file = bug->file;
+ #else
+- file = (const char *)bug + bug->file_disp;
++ file = (const char *)bug + bug->file_disp;
+ #endif
+- line = bug->line;
++ line = bug->line;
+ #endif
+- warning = (bug->flags & BUGFLAG_WARNING) != 0;
+- once = (bug->flags & BUGFLAG_ONCE) != 0;
+- done = (bug->flags & BUGFLAG_DONE) != 0;
+-
+- if (warning && once) {
+- if (done)
+- return BUG_TRAP_TYPE_WARN;
+-
+- /*
+- * Since this is the only store, concurrency is not an issue.
+- */
+- bug->flags |= BUGFLAG_DONE;
+- }
++ warning = (bug->flags & BUGFLAG_WARNING) != 0;
++ once = (bug->flags & BUGFLAG_ONCE) != 0;
++ done = (bug->flags & BUGFLAG_DONE) != 0;
++
++ if (warning && once) {
++ if (done)
++ return BUG_TRAP_TYPE_WARN;
++
++ /*
++ * Since this is the only store, concurrency is not an issue.
++ */
++ bug->flags |= BUGFLAG_DONE;
+ }
+
+ if (warning) {
+diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
+index 7761f32943391..26d21339bef27 100644
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -250,12 +250,13 @@ static int kobj_usermode_filter(struct kobject *kobj)
+
+ static int init_uevent_argv(struct kobj_uevent_env *env, const char *subsystem)
+ {
++ int buffer_size = sizeof(env->buf) - env->buflen;
+ int len;
+
+- len = strlcpy(&env->buf[env->buflen], subsystem,
+- sizeof(env->buf) - env->buflen);
+- if (len >= (sizeof(env->buf) - env->buflen)) {
+- WARN(1, KERN_ERR "init_uevent_argv: buffer size too small\n");
++ len = strlcpy(&env->buf[env->buflen], subsystem, buffer_size);
++ if (len >= buffer_size) {
++ pr_warn("init_uevent_argv: buffer size of %d too small, needed %d\n",
++ buffer_size, len);
+ return -ENOMEM;
+ }
+
+diff --git a/lib/nlattr.c b/lib/nlattr.c
+index e335bcafa9e4c..00bfc6aece055 100644
+--- a/lib/nlattr.c
++++ b/lib/nlattr.c
+@@ -402,7 +402,7 @@ int nla_strcmp(const struct nlattr *nla, const char *str)
+ int attrlen = nla_len(nla);
+ int d;
+
+- if (attrlen > 0 && buf[attrlen - 1] == '\0')
++ while (attrlen > 0 && buf[attrlen - 1] == '\0')
+ attrlen--;
+
+ d = attrlen - len;
+diff --git a/lib/stackdepot.c b/lib/stackdepot.c
+index 3376a32911864..d0f1b7d0ce2e7 100644
+--- a/lib/stackdepot.c
++++ b/lib/stackdepot.c
+@@ -78,7 +78,7 @@ static void *stack_slabs[STACK_ALLOC_MAX_SLABS];
+ static int depot_index;
+ static int next_slab_inited;
+ static size_t depot_offset;
+-static DEFINE_SPINLOCK(depot_lock);
++static DEFINE_RAW_SPINLOCK(depot_lock);
+
+ static bool init_stack_slab(void **prealloc)
+ {
+@@ -266,7 +266,7 @@ depot_stack_handle_t depot_save_stack(struct stack_trace *trace,
+ prealloc = page_address(page);
+ }
+
+- spin_lock_irqsave(&depot_lock, flags);
++ raw_spin_lock_irqsave(&depot_lock, flags);
+
+ found = find_stack(*bucket, trace->entries, trace->nr_entries, hash);
+ if (!found) {
+@@ -290,7 +290,7 @@ depot_stack_handle_t depot_save_stack(struct stack_trace *trace,
+ WARN_ON(!init_stack_slab(&prealloc));
+ }
+
+- spin_unlock_irqrestore(&depot_lock, flags);
++ raw_spin_unlock_irqrestore(&depot_lock, flags);
+ exit:
+ if (prealloc) {
+ /* Nobody used this memory, ok to free it. */
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index f37a821dc5ce2..1dfaec50ff933 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -588,13 +588,20 @@ void hugetlb_fix_reserve_counts(struct inode *inode)
+ {
+ struct hugepage_subpool *spool = subpool_inode(inode);
+ long rsv_adjust;
++ bool reserved = false;
+
+ rsv_adjust = hugepage_subpool_get_pages(spool, 1);
+- if (rsv_adjust) {
++ if (rsv_adjust > 0) {
+ struct hstate *h = hstate_inode(inode);
+
+- hugetlb_acct_memory(h, 1);
++ if (!hugetlb_acct_memory(h, 1))
++ reserved = true;
++ } else if (!rsv_adjust) {
++ reserved = true;
+ }
++
++ if (!reserved)
++ pr_warn("hugetlb: Huge Page Reserved count may go negative.\n");
+ }
+
+ /*
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index 9c7dc2276156b..5dd14ef2e1de8 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -616,17 +616,17 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
+ mmu_notifier_test_young(vma->vm_mm, address))
+ referenced++;
+ }
+- if (likely(writable)) {
+- if (likely(referenced)) {
+- result = SCAN_SUCCEED;
+- trace_mm_collapse_huge_page_isolate(page, none_or_zero,
+- referenced, writable, result);
+- return 1;
+- }
+- } else {
++
++ if (unlikely(!writable)) {
+ result = SCAN_PAGE_RO;
++ } else if (unlikely(!referenced)) {
++ result = SCAN_LACK_REFERENCED_PAGE;
++ } else {
++ result = SCAN_SUCCEED;
++ trace_mm_collapse_huge_page_isolate(page, none_or_zero,
++ referenced, writable, result);
++ return 1;
+ }
+-
+ out:
+ release_pte_pages(pte, _pte);
+ trace_mm_collapse_huge_page_isolate(page, none_or_zero,
+diff --git a/mm/ksm.c b/mm/ksm.c
+index d021bcf94c41d..87a541ab1474f 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -778,6 +778,7 @@ static void remove_rmap_item_from_tree(struct rmap_item *rmap_item)
+ stable_node->rmap_hlist_len--;
+
+ put_anon_vma(rmap_item->anon_vma);
++ rmap_item->head = NULL;
+ rmap_item->address &= PAGE_MASK;
+
+ } else if (rmap_item->address & UNSTABLE_FLAG) {
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 148fdd929a195..034607a68ccb3 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1220,7 +1220,7 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,
+ * communicated in siginfo, see kill_proc()
+ */
+ start = (page->index << PAGE_SHIFT) & ~(size - 1);
+- unmap_mapping_range(page->mapping, start, start + size, 0);
++ unmap_mapping_range(page->mapping, start, size, 0);
+ }
+ kill_procs(&tokill, flags & MF_MUST_KILL, !unmap_success, pfn, flags);
+ rc = 0;
+diff --git a/mm/shmem.c b/mm/shmem.c
+index dea5120565d30..9fd0e72757cfa 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2271,8 +2271,18 @@ static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
+ pgoff_t offset, max_off;
+
+ ret = -ENOMEM;
+- if (!shmem_inode_acct_block(inode, 1))
++ if (!shmem_inode_acct_block(inode, 1)) {
++ /*
++ * We may have got a page, returned -ENOENT triggering a retry,
++ * and now we find ourselves with -ENOMEM. Release the page, to
++ * avoid a BUG_ON in our caller.
++ */
++ if (unlikely(*pagep)) {
++ put_page(*pagep);
++ *pagep = NULL;
++ }
+ goto out;
++ }
+
+ if (!*pagep) {
+ page = shmem_alloc_page(gfp, info, pgoff);
+diff --git a/mm/sparse.c b/mm/sparse.c
+index 3b24ba903d9ee..ed60f0a375fec 100644
+--- a/mm/sparse.c
++++ b/mm/sparse.c
+@@ -467,6 +467,7 @@ static void __init sparse_init_nid(int nid, unsigned long pnum_begin,
+ pr_err("%s: node[%d] memory map backing failed. Some memory will not be available.",
+ __func__, nid);
+ pnum_begin = pnum;
++ sparse_buffer_fini();
+ goto failed;
+ }
+ check_usemap_section_nr(nid, usemap);
+diff --git a/net/bluetooth/ecdh_helper.h b/net/bluetooth/ecdh_helper.h
+index a6f8d03d4aaf6..830723971cf83 100644
+--- a/net/bluetooth/ecdh_helper.h
++++ b/net/bluetooth/ecdh_helper.h
+@@ -25,6 +25,6 @@
+
+ int compute_ecdh_secret(struct crypto_kpp *tfm, const u8 pair_public_key[64],
+ u8 secret[32]);
+-int set_ecdh_privkey(struct crypto_kpp *tfm, const u8 *private_key);
++int set_ecdh_privkey(struct crypto_kpp *tfm, const u8 private_key[32]);
+ int generate_ecdh_public_key(struct crypto_kpp *tfm, u8 public_key[64]);
+ int generate_ecdh_keys(struct crypto_kpp *tfm, u8 public_key[64]);
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index b58afd2d5ebf4..2e2cad58b6ccf 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -4721,6 +4721,7 @@ static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ return;
+
+ hchan->handle = le16_to_cpu(ev->handle);
++ hchan->amp = true;
+
+ BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
+
+@@ -4753,7 +4754,7 @@ static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
+ hci_dev_lock(hdev);
+
+ hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
+- if (!hchan)
++ if (!hchan || !hchan->amp)
+ goto unlock;
+
+ amp_destroy_logical_link(hchan, ev->reason);
+diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
+index a8ddd211e94c2..76bd6b1227240 100644
+--- a/net/bluetooth/hci_request.c
++++ b/net/bluetooth/hci_request.c
+@@ -271,12 +271,16 @@ int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
+ {
+ int ret;
+
+- if (!test_bit(HCI_UP, &hdev->flags))
+- return -ENETDOWN;
+-
+ /* Serialize all requests */
+ hci_req_sync_lock(hdev);
+- ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
++ /* check the state after obtaing the lock to protect the HCI_UP
++ * against any races from hci_dev_do_close when the controller
++ * gets removed.
++ */
++ if (test_bit(HCI_UP, &hdev->flags))
++ ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
++ else
++ ret = -ENETDOWN;
+ hci_req_sync_unlock(hdev);
+
+ return ret;
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index f1ff833210231..c0d64b4144d4a 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -445,6 +445,8 @@ struct l2cap_chan *l2cap_chan_create(void)
+ if (!chan)
+ return NULL;
+
++ skb_queue_head_init(&chan->tx_q);
++ skb_queue_head_init(&chan->srej_q);
+ mutex_init(&chan->lock);
+
+ /* Set default lock nesting level */
+@@ -510,7 +512,9 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan)
+ chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
+ chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
+ chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
++
+ chan->conf_state = 0;
++ set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
+
+ set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
+ }
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index 198a1fdd6709e..967a9bb144157 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -179,9 +179,17 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
+ struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+ struct sockaddr_l2 la;
+ int len, err = 0;
++ bool zapped;
+
+ BT_DBG("sk %p", sk);
+
++ lock_sock(sk);
++ zapped = sock_flag(sk, SOCK_ZAPPED);
++ release_sock(sk);
++
++ if (zapped)
++ return -EINVAL;
++
+ if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
+ addr->sa_family != AF_BLUETOOTH)
+ return -EINVAL;
+diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
+index eb44ae05abaaf..b52e703622682 100644
+--- a/net/bridge/br_arp_nd_proxy.c
++++ b/net/bridge/br_arp_nd_proxy.c
+@@ -158,7 +158,9 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
+ if (br->neigh_suppress_enabled) {
+ if (p && (p->flags & BR_NEIGH_SUPPRESS))
+ return;
+- if (ipv4_is_zeronet(sip) || sip == tip) {
++ if (parp->ar_op != htons(ARPOP_RREQUEST) &&
++ parp->ar_op != htons(ARPOP_RREPLY) &&
++ (ipv4_is_zeronet(sip) || sip == tip)) {
+ /* prevent flooding to neigh suppress ports */
+ BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+ return;
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 1011625a0ca4b..83028017c26dd 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -618,7 +618,7 @@ store_link_ksettings_for_user(void __user *to,
+ {
+ struct ethtool_link_usettings link_usettings;
+
+- memcpy(&link_usettings.base, &from->base, sizeof(link_usettings));
++ memcpy(&link_usettings, from, sizeof(link_usettings));
+ bitmap_to_arr32(link_usettings.link_modes.supported,
+ from->link_modes.supported,
+ __ETHTOOL_LINK_MODE_MASK_NBITS);
+diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
+index f5a3601948ca0..37795502bb511 100644
+--- a/net/hsr/hsr_framereg.c
++++ b/net/hsr/hsr_framereg.c
+@@ -310,7 +310,8 @@ void hsr_addr_subst_dest(struct hsr_node *node_src, struct sk_buff *skb,
+
+ node_dst = find_node_by_AddrA(&port->hsr->node_db, eth_hdr(skb)->h_dest);
+ if (!node_dst) {
+- WARN_ONCE(1, "%s: Unknown node\n", __func__);
++ if (net_ratelimit())
++ netdev_err(skb->dev, "%s: Unknown node\n", __func__);
+ return;
+ }
+ if (port->type != node_dst->AddrB_port)
+diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
+index 00a7482b6fbd9..533f8d84d2f71 100644
+--- a/net/ipv4/tcp_cong.c
++++ b/net/ipv4/tcp_cong.c
+@@ -228,6 +228,10 @@ int tcp_set_default_congestion_control(struct net *net, const char *name)
+ ret = -ENOENT;
+ } else if (!try_module_get(ca->owner)) {
+ ret = -EBUSY;
++ } else if (!net_eq(net, &init_net) &&
++ !(ca->flags & TCP_CONG_NON_RESTRICTED)) {
++ /* Only init netns can set default to a restricted algorithm */
++ ret = -EPERM;
+ } else {
+ prev = xchg(&net->ipv4.tcp_congestion_control, ca);
+ if (prev)
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 86c8ea7d70067..043e57d08a3e9 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -392,7 +392,6 @@ static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net,
+ if (!(nt->parms.o_flags & TUNNEL_SEQ))
+ dev->features |= NETIF_F_LLTX;
+
+- dev_hold(dev);
+ ip6gre_tunnel_link(ign, nt);
+ return nt;
+
+@@ -1503,6 +1502,7 @@ static int ip6gre_tunnel_init_common(struct net_device *dev)
+ }
+ ip6gre_tnl_init_features(dev);
+
++ dev_hold(dev);
+ return 0;
+
+ cleanup_dst_cache_init:
+@@ -1545,8 +1545,6 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev)
+ strcpy(tunnel->parms.name, dev->name);
+
+ tunnel->hlen = sizeof(struct ipv6hdr) + 4;
+-
+- dev_hold(dev);
+ }
+
+ static struct inet6_protocol ip6gre_protocol __read_mostly = {
+@@ -1896,6 +1894,7 @@ static int ip6erspan_tap_init(struct net_device *dev)
+ dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+ ip6erspan_tnl_link_config(tunnel, 1);
+
++ dev_hold(dev);
+ return 0;
+
+ cleanup_dst_cache_init:
+@@ -2001,8 +2000,6 @@ static int ip6gre_newlink_common(struct net *src_net, struct net_device *dev,
+ if (tb[IFLA_MTU])
+ ip6_tnl_change_mtu(dev, nla_get_u32(tb[IFLA_MTU]));
+
+- dev_hold(dev);
+-
+ out:
+ return err;
+ }
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 28c4a693ab98d..35c127c3eee78 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -272,7 +272,6 @@ static int ip6_tnl_create2(struct net_device *dev)
+
+ strcpy(t->parms.name, dev->name);
+
+- dev_hold(dev);
+ ip6_tnl_link(ip6n, t);
+ return 0;
+
+@@ -1866,6 +1865,7 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
+ dev->min_mtu = ETH_MIN_MTU;
+ dev->max_mtu = IP6_MAX_MTU - dev->hard_header_len;
+
++ dev_hold(dev);
+ return 0;
+
+ destroy_dst:
+@@ -1909,7 +1909,6 @@ static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
+ struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+
+ t->parms.proto = IPPROTO_IPV6;
+- dev_hold(dev);
+
+ rcu_assign_pointer(ip6n->tnls_wc[0], t);
+ return 0;
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 94f16e82a4581..290badfe70e06 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -196,7 +196,6 @@ static int vti6_tnl_create2(struct net_device *dev)
+
+ strcpy(t->parms.name, dev->name);
+
+- dev_hold(dev);
+ vti6_tnl_link(ip6n, t);
+
+ return 0;
+@@ -925,6 +924,7 @@ static inline int vti6_dev_init_gen(struct net_device *dev)
+ dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+ if (!dev->tstats)
+ return -ENOMEM;
++ dev_hold(dev);
+ return 0;
+ }
+
+@@ -956,7 +956,6 @@ static int __net_init vti6_fb_tnl_dev_init(struct net_device *dev)
+ struct vti6_net *ip6n = net_generic(net, vti6_net_id);
+
+ t->parms.proto = IPPROTO_IPV6;
+- dev_hold(dev);
+
+ rcu_assign_pointer(ip6n->tnls_wc[0], t);
+ return 0;
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index ad737b68b8e96..4a49200d0d11c 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -215,8 +215,6 @@ static int ipip6_tunnel_create(struct net_device *dev)
+
+ ipip6_tunnel_clone_6rd(dev, sitn);
+
+- dev_hold(dev);
+-
+ ipip6_tunnel_link(sitn, t);
+ return 0;
+
+@@ -1407,7 +1405,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
+ dev->tstats = NULL;
+ return err;
+ }
+-
++ dev_hold(dev);
+ return 0;
+ }
+
+@@ -1423,7 +1421,6 @@ static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
+ iph->ihl = 5;
+ iph->ttl = 64;
+
+- dev_hold(dev);
+ rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
+ }
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index f44d00f35fe7b..e8c4e9c0c5a09 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1080,8 +1080,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ if (local->hw.wiphy->max_scan_ie_len)
+ local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len;
+
+- WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes,
+- local->hw.n_cipher_schemes));
++ if (WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes,
++ local->hw.n_cipher_schemes))) {
++ result = -EINVAL;
++ goto fail_workqueue;
++ }
+
+ result = ieee80211_init_cipher_suites(local);
+ if (result < 0)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index c53a332f7d65a..cbcb60face2c5 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1185,6 +1185,11 @@ static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
+
+ sdata->vif.csa_active = false;
+ ifmgd->csa_waiting_bcn = false;
++ /*
++ * If the CSA IE is still present on the beacon after the switch,
++ * we need to consider it as a new CSA (possibly to self).
++ */
++ ifmgd->beacon_crc_valid = false;
+
+ ret = drv_post_channel_switch(sdata);
+ if (ret) {
+diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
+index 2e3ae494f3697..da0c9fa381d20 100644
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -594,8 +594,11 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
+ if (net->user_ns != &init_user_ns)
+ table[0].procname = NULL;
+
+- if (!net_eq(&init_net, net))
++ if (!net_eq(&init_net, net)) {
++ table[0].mode = 0444;
+ table[2].mode = 0444;
++ table[5].mode = 0444;
++ }
+
+ net->ct.sysctl_header = register_net_sysctl(net, "net/netfilter", table);
+ if (!net->ct.sysctl_header)
+diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
+index 131f9f8c0b092..917f06110c823 100644
+--- a/net/netfilter/nfnetlink_osf.c
++++ b/net/netfilter/nfnetlink_osf.c
+@@ -191,6 +191,8 @@ static const struct tcphdr *nf_osf_hdr_ctx_init(struct nf_osf_hdr_ctx *ctx,
+
+ ctx->optp = skb_header_pointer(skb, ip_hdrlen(skb) +
+ sizeof(struct tcphdr), ctx->optsize, opts);
++ if (!ctx->optp)
++ return NULL;
+ }
+
+ return tcp;
+diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
+index 05118e03c3e48..dbc4ed643b4bc 100644
+--- a/net/netfilter/nft_set_hash.c
++++ b/net/netfilter/nft_set_hash.c
+@@ -392,9 +392,17 @@ static void nft_rhash_destroy(const struct nft_set *set)
+ (void *)set);
+ }
+
++/* Number of buckets is stored in u32, so cap our result to 1U<<31 */
++#define NFT_MAX_BUCKETS (1U << 31)
++
+ static u32 nft_hash_buckets(u32 size)
+ {
+- return roundup_pow_of_two(size * 4 / 3);
++ u64 val = div_u64((u64)size * 4, 3);
++
++ if (val >= NFT_MAX_BUCKETS)
++ return NFT_MAX_BUCKETS;
++
++ return roundup_pow_of_two(val);
+ }
+
+ static bool nft_rhash_estimate(const struct nft_set_desc *desc, u32 features,
+diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
+index 4ad5fe27e08bc..097534dbc6226 100644
+--- a/net/netfilter/xt_SECMARK.c
++++ b/net/netfilter/xt_SECMARK.c
+@@ -30,10 +30,9 @@ MODULE_ALIAS("ip6t_SECMARK");
+ static u8 mode;
+
+ static unsigned int
+-secmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
++secmark_tg(struct sk_buff *skb, const struct xt_secmark_target_info_v1 *info)
+ {
+ u32 secmark = 0;
+- const struct xt_secmark_target_info *info = par->targinfo;
+
+ BUG_ON(info->mode != mode);
+
+@@ -49,7 +48,7 @@ secmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ return XT_CONTINUE;
+ }
+
+-static int checkentry_lsm(struct xt_secmark_target_info *info)
++static int checkentry_lsm(struct xt_secmark_target_info_v1 *info)
+ {
+ int err;
+
+@@ -81,15 +80,15 @@ static int checkentry_lsm(struct xt_secmark_target_info *info)
+ return 0;
+ }
+
+-static int secmark_tg_check(const struct xt_tgchk_param *par)
++static int
++secmark_tg_check(const char *table, struct xt_secmark_target_info_v1 *info)
+ {
+- struct xt_secmark_target_info *info = par->targinfo;
+ int err;
+
+- if (strcmp(par->table, "mangle") != 0 &&
+- strcmp(par->table, "security") != 0) {
++ if (strcmp(table, "mangle") != 0 &&
++ strcmp(table, "security") != 0) {
+ pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
+- par->table);
++ table);
+ return -EINVAL;
+ }
+
+@@ -124,25 +123,76 @@ static void secmark_tg_destroy(const struct xt_tgdtor_param *par)
+ }
+ }
+
+-static struct xt_target secmark_tg_reg __read_mostly = {
+- .name = "SECMARK",
+- .revision = 0,
+- .family = NFPROTO_UNSPEC,
+- .checkentry = secmark_tg_check,
+- .destroy = secmark_tg_destroy,
+- .target = secmark_tg,
+- .targetsize = sizeof(struct xt_secmark_target_info),
+- .me = THIS_MODULE,
++static int secmark_tg_check_v0(const struct xt_tgchk_param *par)
++{
++ struct xt_secmark_target_info *info = par->targinfo;
++ struct xt_secmark_target_info_v1 newinfo = {
++ .mode = info->mode,
++ };
++ int ret;
++
++ memcpy(newinfo.secctx, info->secctx, SECMARK_SECCTX_MAX);
++
++ ret = secmark_tg_check(par->table, &newinfo);
++ info->secid = newinfo.secid;
++
++ return ret;
++}
++
++static unsigned int
++secmark_tg_v0(struct sk_buff *skb, const struct xt_action_param *par)
++{
++ const struct xt_secmark_target_info *info = par->targinfo;
++ struct xt_secmark_target_info_v1 newinfo = {
++ .secid = info->secid,
++ };
++
++ return secmark_tg(skb, &newinfo);
++}
++
++static int secmark_tg_check_v1(const struct xt_tgchk_param *par)
++{
++ return secmark_tg_check(par->table, par->targinfo);
++}
++
++static unsigned int
++secmark_tg_v1(struct sk_buff *skb, const struct xt_action_param *par)
++{
++ return secmark_tg(skb, par->targinfo);
++}
++
++static struct xt_target secmark_tg_reg[] __read_mostly = {
++ {
++ .name = "SECMARK",
++ .revision = 0,
++ .family = NFPROTO_UNSPEC,
++ .checkentry = secmark_tg_check_v0,
++ .destroy = secmark_tg_destroy,
++ .target = secmark_tg_v0,
++ .targetsize = sizeof(struct xt_secmark_target_info),
++ .me = THIS_MODULE,
++ },
++ {
++ .name = "SECMARK",
++ .revision = 1,
++ .family = NFPROTO_UNSPEC,
++ .checkentry = secmark_tg_check_v1,
++ .destroy = secmark_tg_destroy,
++ .target = secmark_tg_v1,
++ .targetsize = sizeof(struct xt_secmark_target_info_v1),
++ .usersize = offsetof(struct xt_secmark_target_info_v1, secid),
++ .me = THIS_MODULE,
++ },
+ };
+
+ static int __init secmark_tg_init(void)
+ {
+- return xt_register_target(&secmark_tg_reg);
++ return xt_register_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
+ }
+
+ static void __exit secmark_tg_exit(void)
+ {
+- xt_unregister_target(&secmark_tg_reg);
++ xt_unregister_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
+ }
+
+ module_init(secmark_tg_init);
+diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
+index 4f9a973988b2b..1eed0cf591908 100644
+--- a/net/nfc/digital_dep.c
++++ b/net/nfc/digital_dep.c
+@@ -1285,6 +1285,8 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,
+ }
+
+ rc = nfc_tm_data_received(ddev->nfc_dev, resp);
++ if (rc)
++ resp = NULL;
+
+ exit:
+ kfree_skb(ddev->chaining_skb);
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index bc269e83e1e55..59de4f54dd18c 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -121,12 +121,14 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
+ GFP_KERNEL);
+ if (!llcp_sock->service_name) {
+ nfc_llcp_local_put(llcp_sock->local);
++ llcp_sock->local = NULL;
+ ret = -ENOMEM;
+ goto put_dev;
+ }
+ llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
+ if (llcp_sock->ssap == LLCP_SAP_MAX) {
+ nfc_llcp_local_put(llcp_sock->local);
++ llcp_sock->local = NULL;
+ kfree(llcp_sock->service_name);
+ llcp_sock->service_name = NULL;
+ ret = -EADDRINUSE;
+@@ -721,6 +723,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
+ llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
+ if (llcp_sock->ssap == LLCP_SAP_MAX) {
+ nfc_llcp_local_put(llcp_sock->local);
++ llcp_sock->local = NULL;
+ ret = -ENOMEM;
+ goto put_dev;
+ }
+@@ -759,6 +762,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
+ sock_unlink:
+ nfc_llcp_put_ssap(local, llcp_sock->ssap);
+ nfc_llcp_local_put(llcp_sock->local);
++ llcp_sock->local = NULL;
+
+ nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
+ kfree(llcp_sock->service_name);
+diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
+index 8211e8e97c964..849fcf973c74b 100644
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -892,17 +892,17 @@ static void ovs_fragment(struct net *net, struct vport *vport,
+ }
+
+ if (key->eth.type == htons(ETH_P_IP)) {
+- struct dst_entry ovs_dst;
++ struct rtable ovs_rt = { 0 };
+ unsigned long orig_dst;
+
+ prepare_frag(vport, skb, orig_network_offset,
+ ovs_key_mac_proto(key));
+- dst_init(&ovs_dst, &ovs_dst_ops, NULL, 1,
++ dst_init(&ovs_rt.dst, &ovs_dst_ops, NULL, 1,
+ DST_OBSOLETE_NONE, DST_NOCOUNT);
+- ovs_dst.dev = vport->dev;
++ ovs_rt.dst.dev = vport->dev;
+
+ orig_dst = skb->_skb_refdst;
+- skb_dst_set_noref(skb, &ovs_dst);
++ skb_dst_set_noref(skb, &ovs_rt.dst);
+ IPCB(skb)->frag_max_size = mru;
+
+ ip_do_fragment(net, skb->sk, skb, ovs_vport_output);
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index ce6053be60bc8..dc51e14f568ee 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -3148,7 +3148,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
+ * primary.
+ */
+ if (af->is_any(&addr))
+- memcpy(&addr.v4, sctp_source(asconf), sizeof(addr));
++ memcpy(&addr, sctp_source(asconf), sizeof(addr));
+
+ if (security_sctp_bind_connect(asoc->ep->base.sk,
+ SCTP_PARAM_SET_PRIMARY,
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index a3033b74df54a..be5ea5e8b19e7 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -1856,20 +1856,35 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
+ SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
+ sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_ASCONF_QUEUE, SCTP_NULL());
+
+- repl = sctp_make_cookie_ack(new_asoc, chunk);
++ /* Update the content of current association. */
++ if (sctp_assoc_update((struct sctp_association *)asoc, new_asoc)) {
++ struct sctp_chunk *abort;
++
++ abort = sctp_make_abort(asoc, NULL, sizeof(struct sctp_errhdr));
++ if (abort) {
++ sctp_init_cause(abort, SCTP_ERROR_RSRC_LOW, 0);
++ sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
++ }
++ sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNABORTED));
++ sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
++ SCTP_PERR(SCTP_ERROR_RSRC_LOW));
++ SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
++ SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
++ goto nomem;
++ }
++
++ repl = sctp_make_cookie_ack(asoc, chunk);
+ if (!repl)
+ goto nomem;
+
+ /* Report association restart to upper layer. */
+ ev = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_RESTART, 0,
+- new_asoc->c.sinit_num_ostreams,
+- new_asoc->c.sinit_max_instreams,
++ asoc->c.sinit_num_ostreams,
++ asoc->c.sinit_max_instreams,
+ NULL, GFP_ATOMIC);
+ if (!ev)
+ goto nomem_ev;
+
+- /* Update the content of current association. */
+- sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
+ sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
+ if ((sctp_state(asoc, SHUTDOWN_PENDING) ||
+ sctp_state(asoc, SHUTDOWN_SENT)) &&
+@@ -1933,7 +1948,8 @@ static enum sctp_disposition sctp_sf_do_dupcook_b(
+ sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
+ sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
+ SCTP_STATE(SCTP_STATE_ESTABLISHED));
+- SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
++ if (asoc->state < SCTP_STATE_ESTABLISHED)
++ SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
+ sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
+
+ repl = sctp_make_cookie_ack(new_asoc, chunk);
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 656bd15328836..1148f66917079 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -375,6 +375,18 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
+ return af;
+ }
+
++static void sctp_auto_asconf_init(struct sctp_sock *sp)
++{
++ struct net *net = sock_net(&sp->inet.sk);
++
++ if (net->sctp.default_auto_asconf) {
++ spin_lock(&net->sctp.addr_wq_lock);
++ list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist);
++ spin_unlock(&net->sctp.addr_wq_lock);
++ sp->do_auto_asconf = 1;
++ }
++}
++
+ /* Bind a local address either to an endpoint or to an association. */
+ static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
+ {
+@@ -437,8 +449,10 @@ static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
+ }
+
+ /* Refresh ephemeral port. */
+- if (!bp->port)
++ if (!bp->port) {
+ bp->port = inet_sk(sk)->inet_num;
++ sctp_auto_asconf_init(sp);
++ }
+
+ /* Add the address to the bind address list.
+ * Use GFP_ATOMIC since BHs will be disabled.
+@@ -1569,9 +1583,11 @@ static void sctp_close(struct sock *sk, long timeout)
+
+ /* Supposedly, no process has access to the socket, but
+ * the net layers still may.
++ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
++ * held and that should be grabbed before socket lock.
+ */
+- local_bh_disable();
+- bh_lock_sock(sk);
++ spin_lock_bh(&net->sctp.addr_wq_lock);
++ bh_lock_sock_nested(sk);
+
+ /* Hold the sock, since sk_common_release() will put sock_put()
+ * and we have just a little more cleanup.
+@@ -1580,7 +1596,7 @@ static void sctp_close(struct sock *sk, long timeout)
+ sk_common_release(sk);
+
+ bh_unlock_sock(sk);
+- local_bh_enable();
++ spin_unlock_bh(&net->sctp.addr_wq_lock);
+
+ sock_put(sk);
+
+@@ -4774,16 +4790,6 @@ static int sctp_init_sock(struct sock *sk)
+ sk_sockets_allocated_inc(sk);
+ sock_prot_inuse_add(net, sk->sk_prot, 1);
+
+- if (net->sctp.default_auto_asconf) {
+- spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
+- list_add_tail(&sp->auto_asconf_list,
+- &net->sctp.auto_asconf_splist);
+- sp->do_auto_asconf = 1;
+- spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);
+- } else {
+- sp->do_auto_asconf = 0;
+- }
+-
+ local_bh_enable();
+
+ return 0;
+@@ -4808,9 +4814,7 @@ static void sctp_destroy_sock(struct sock *sk)
+
+ if (sp->do_auto_asconf) {
+ sp->do_auto_asconf = 0;
+- spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
+ list_del(&sp->auto_asconf_list);
+- spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
+ }
+ sctp_endpoint_free(sp->ep);
+ local_bh_disable();
+@@ -8845,6 +8849,8 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ sctp_bind_addr_dup(&newsp->ep->base.bind_addr,
+ &oldsp->ep->base.bind_addr, GFP_KERNEL);
+
++ sctp_auto_asconf_init(newsp);
++
+ /* Move any messages in the old socket's receive queue that are for the
+ * peeled off association to the new socket's receive queue.
+ */
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 26dcd02b2d0ce..9aab4ab8161bd 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1644,6 +1644,9 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
+ struct smc_sock *smc;
+ int val, rc;
+
++ if (level == SOL_TCP && optname == TCP_ULP)
++ return -EOPNOTSUPP;
++
+ smc = smc_sk(sk);
+
+ /* generic setsockopts reaching us here always apply to the
+@@ -1665,7 +1668,6 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
+
+ lock_sock(sk);
+ switch (optname) {
+- case TCP_ULP:
+ case TCP_FASTOPEN:
+ case TCP_FASTOPEN_CONNECT:
+ case TCP_FASTOPEN_KEY:
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index f8e111218a0ec..5086e27d3011e 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -671,7 +671,7 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,
+ if (err)
+ return err;
+
+- link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]);
++ link_info.dest = htonl(nla_get_flag(link[TIPC_NLA_LINK_DEST]));
+ link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP]));
+ nla_strlcpy(link_info.str, link[TIPC_NLA_LINK_NAME],
+ TIPC_MAX_LINK_NAME);
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index c3d5ab01fba7b..42ab3e2ac0602 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -584,8 +584,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair,
+ peer, flags, VMCI_NO_PRIVILEGE_FLAGS);
+ out:
+ if (err < 0) {
+- pr_err("Could not attach to queue pair with %d\n",
+- err);
++ pr_err_once("Could not attach to queue pair with %d\n", err);
+ err = vmci_transport_error_to_vsock_error(err);
+ }
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index e5d61ba837add..67b2747ad9ef8 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -1036,6 +1036,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,
+
+ if (rdev->bss_entries >= bss_entries_limit &&
+ !cfg80211_bss_expire_oldest(rdev)) {
++ if (!list_empty(&new->hidden_list))
++ list_del(&new->hidden_list);
+ kfree(new);
+ goto drop;
+ }
+diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
+index fe96c0d039f2f..cf7cbb5dd9180 100644
+--- a/net/xdp/xsk_queue.h
++++ b/net/xdp/xsk_queue.h
+@@ -245,12 +245,15 @@ static inline void xskq_produce_flush_desc(struct xsk_queue *q)
+
+ static inline bool xskq_full_desc(struct xsk_queue *q)
+ {
+- return xskq_nb_avail(q, q->nentries) == q->nentries;
++ /* No barriers needed since data is not accessed */
++ return READ_ONCE(q->ring->producer) - READ_ONCE(q->ring->consumer) ==
++ q->nentries;
+ }
+
+ static inline bool xskq_empty_desc(struct xsk_queue *q)
+ {
+- return xskq_nb_free(q, q->prod_tail, q->nentries) == q->nentries;
++ /* No barriers needed since data is not accessed */
++ return READ_ONCE(q->ring->consumer) == READ_ONCE(q->ring->producer);
+ }
+
+ void xskq_set_umem(struct xsk_queue *q, struct xdp_umem_props *umem_props);
+diff --git a/samples/bpf/tracex1_kern.c b/samples/bpf/tracex1_kern.c
+index 107da148820fc..9c74b45c5720f 100644
+--- a/samples/bpf/tracex1_kern.c
++++ b/samples/bpf/tracex1_kern.c
+@@ -20,7 +20,7 @@
+ SEC("kprobe/__netif_receive_skb_core")
+ int bpf_prog1(struct pt_regs *ctx)
+ {
+- /* attaches to kprobe netif_receive_skb,
++ /* attaches to kprobe __netif_receive_skb_core,
+ * looks for packets on loobpack device and prints them
+ */
+ char devname[IFNAMSIZ];
+@@ -29,7 +29,7 @@ int bpf_prog1(struct pt_regs *ctx)
+ int len;
+
+ /* non-portable! works for the given kernel only */
+- skb = (struct sk_buff *) PT_REGS_PARM1(ctx);
++ bpf_probe_read_kernel(&skb, sizeof(skb), (void *)PT_REGS_PARM1(ctx));
+ dev = _(skb->dev);
+ len = _(skb->len);
+
+diff --git a/samples/kfifo/bytestream-example.c b/samples/kfifo/bytestream-example.c
+index 2fca916d9edfd..a7f5ee8b6edcf 100644
+--- a/samples/kfifo/bytestream-example.c
++++ b/samples/kfifo/bytestream-example.c
+@@ -124,8 +124,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
+ ret = kfifo_from_user(&test, buf, count, &copied);
+
+ mutex_unlock(&write_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static ssize_t fifo_read(struct file *file, char __user *buf,
+@@ -140,8 +142,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
+ ret = kfifo_to_user(&test, buf, count, &copied);
+
+ mutex_unlock(&read_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static const struct file_operations fifo_fops = {
+diff --git a/samples/kfifo/inttype-example.c b/samples/kfifo/inttype-example.c
+index 8dc3c2e7105a0..a326a37e91631 100644
+--- a/samples/kfifo/inttype-example.c
++++ b/samples/kfifo/inttype-example.c
+@@ -117,8 +117,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
+ ret = kfifo_from_user(&test, buf, count, &copied);
+
+ mutex_unlock(&write_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static ssize_t fifo_read(struct file *file, char __user *buf,
+@@ -133,8 +135,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
+ ret = kfifo_to_user(&test, buf, count, &copied);
+
+ mutex_unlock(&read_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static const struct file_operations fifo_fops = {
+diff --git a/samples/kfifo/record-example.c b/samples/kfifo/record-example.c
+index 2d7529eeb2940..deb87a2e4e6bc 100644
+--- a/samples/kfifo/record-example.c
++++ b/samples/kfifo/record-example.c
+@@ -131,8 +131,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf,
+ ret = kfifo_from_user(&test, buf, count, &copied);
+
+ mutex_unlock(&write_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static ssize_t fifo_read(struct file *file, char __user *buf,
+@@ -147,8 +149,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf,
+ ret = kfifo_to_user(&test, buf, count, &copied);
+
+ mutex_unlock(&read_lock);
++ if (ret)
++ return ret;
+
+- return ret ? ret : copied;
++ return copied;
+ }
+
+ static const struct file_operations fifo_fops = {
+diff --git a/scripts/bloat-o-meter b/scripts/bloat-o-meter
+index a923f05edb366..e12daed3f41d7 100755
+--- a/scripts/bloat-o-meter
++++ b/scripts/bloat-o-meter
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/env python3
+ #
+ # Copyright 2004 Matt Mackall <mpm@selenic.com>
+ #
+diff --git a/scripts/config b/scripts/config
+index eee5b7f3a092a..8c8d7c3d7accc 100755
+--- a/scripts/config
++++ b/scripts/config
+@@ -1,4 +1,4 @@
+-#!/bin/bash
++#!/usr/bin/env bash
+ # SPDX-License-Identifier: GPL-2.0
+ # Manipulate options in a .config file from the command line
+
+diff --git a/scripts/diffconfig b/scripts/diffconfig
+index 89abf777f1973..d5da5fa05d1d3 100755
+--- a/scripts/diffconfig
++++ b/scripts/diffconfig
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/env python3
+ # SPDX-License-Identifier: GPL-2.0
+ #
+ # diffconfig - a tool to compare .config files.
+diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c
+index c8ff1c99dd5c7..552cf7557c7a9 100644
+--- a/scripts/kconfig/nconf.c
++++ b/scripts/kconfig/nconf.c
+@@ -504,8 +504,8 @@ static int get_mext_match(const char *match_str, match_f flag)
+ else if (flag == FIND_NEXT_MATCH_UP)
+ --match_start;
+
++ match_start = (match_start + items_num) % items_num;
+ index = match_start;
+- index = (index + items_num) % items_num;
+ while (true) {
+ char *str = k_menu_items[index].str;
+ if (strcasestr(str, match_str) != NULL)
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index 9a8fe8ea6b037..657e69125a462 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -395,7 +395,7 @@ if ($arch eq "x86_64") {
+ $mcount_regex = "^\\s*([0-9a-fA-F]+):.*\\s_mcount\$";
+ } elsif ($arch eq "riscv") {
+ $function_regex = "^([0-9a-fA-F]+)\\s+<([^.0-9][0-9a-zA-Z_\\.]+)>:";
+- $mcount_regex = "^\\s*([0-9a-fA-F]+):\\sR_RISCV_CALL\\s_mcount\$";
++ $mcount_regex = "^\\s*([0-9a-fA-F]+):\\sR_RISCV_CALL(_PLT)?\\s_?mcount\$";
+ $type = ".quad";
+ $alignment = 2;
+ } elsif ($arch eq "nds32") {
+diff --git a/scripts/split-man.pl b/scripts/split-man.pl
+index c3db607ee9ec1..96bd99dc977a5 100755
+--- a/scripts/split-man.pl
++++ b/scripts/split-man.pl
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl
++#!/usr/bin/env perl
+ # SPDX-License-Identifier: GPL-2.0
+ #
+ # Author: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+diff --git a/security/commoncap.c b/security/commoncap.c
+index a1dee0ab345a2..876cfe01d9391 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -397,7 +397,7 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ &tmpbuf, size, GFP_NOFS);
+ dput(dentry);
+
+- if (ret < 0)
++ if (ret < 0 || !tmpbuf)
+ return ret;
+
+ fs_ns = inode->i_sb->s_user_ns;
+diff --git a/sound/core/init.c b/sound/core/init.c
+index 16b7cc7aa66b5..3eafa15006f8a 100644
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -405,10 +405,8 @@ int snd_card_disconnect(struct snd_card *card)
+ return 0;
+ }
+ card->shutdown = 1;
+- spin_unlock(&card->files_lock);
+
+ /* replace file->f_op with special dummy operations */
+- spin_lock(&card->files_lock);
+ list_for_each_entry(mfile, &card->files_list, list) {
+ /* it's critical part, use endless loop */
+ /* we have no room to fail */
+diff --git a/sound/isa/sb/emu8000.c b/sound/isa/sb/emu8000.c
+index d56973b770c7d..24b91cb328399 100644
+--- a/sound/isa/sb/emu8000.c
++++ b/sound/isa/sb/emu8000.c
+@@ -1042,8 +1042,10 @@ snd_emu8000_create_mixer(struct snd_card *card, struct snd_emu8000 *emu)
+
+ memset(emu->controls, 0, sizeof(emu->controls));
+ for (i = 0; i < EMU8000_NUM_CONTROLS; i++) {
+- if ((err = snd_ctl_add(card, emu->controls[i] = snd_ctl_new1(mixer_defs[i], emu))) < 0)
++ if ((err = snd_ctl_add(card, emu->controls[i] = snd_ctl_new1(mixer_defs[i], emu))) < 0) {
++ emu->controls[i] = NULL;
+ goto __error;
++ }
+ }
+ return 0;
+
+diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
+index bf3db0d2ea12b..2e00b64ef13bf 100644
+--- a/sound/isa/sb/sb16_csp.c
++++ b/sound/isa/sb/sb16_csp.c
+@@ -1059,10 +1059,14 @@ static int snd_sb_qsound_build(struct snd_sb_csp * p)
+
+ spin_lock_init(&p->q_lock);
+
+- if ((err = snd_ctl_add(card, p->qsound_switch = snd_ctl_new1(&snd_sb_qsound_switch, p))) < 0)
++ if ((err = snd_ctl_add(card, p->qsound_switch = snd_ctl_new1(&snd_sb_qsound_switch, p))) < 0) {
++ p->qsound_switch = NULL;
+ goto __error;
+- if ((err = snd_ctl_add(card, p->qsound_space = snd_ctl_new1(&snd_sb_qsound_space, p))) < 0)
++ }
++ if ((err = snd_ctl_add(card, p->qsound_space = snd_ctl_new1(&snd_sb_qsound_space, p))) < 0) {
++ p->qsound_space = NULL;
+ goto __error;
++ }
+
+ return 0;
+
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index b9f7b23ae3789..6099a9f1cb3d6 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -1214,11 +1214,17 @@ static const char *get_line_out_pfx(struct hda_codec *codec, int ch,
+ *index = ch;
+ return "Headphone";
+ case AUTO_PIN_LINE_OUT:
+- /* This deals with the case where we have two DACs and
+- * one LO, one HP and one Speaker */
+- if (!ch && cfg->speaker_outs && cfg->hp_outs) {
+- bool hp_lo_shared = !path_has_mixer(codec, spec->hp_paths[0], ctl_type);
+- bool spk_lo_shared = !path_has_mixer(codec, spec->speaker_paths[0], ctl_type);
++ /* This deals with the case where one HP or one Speaker or
++ * one HP + one Speaker need to share the DAC with LO
++ */
++ if (!ch) {
++ bool hp_lo_shared = false, spk_lo_shared = false;
++
++ if (cfg->speaker_outs)
++ spk_lo_shared = !path_has_mixer(codec,
++ spec->speaker_paths[0], ctl_type);
++ if (cfg->hp_outs)
++ hp_lo_shared = !path_has_mixer(codec, spec->hp_paths[0], ctl_type);
+ if (hp_lo_shared && spk_lo_shared)
+ return spec->vmaster_mute.hook ? "PCM" : "Master";
+ if (hp_lo_shared)
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 7d471ecc1ca03..8851cd11dc9ca 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -911,18 +911,18 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
+- SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
+- SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK),
+- SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
+- SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
+- SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
+ SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
+ SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
++ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
+ SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
+- SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO),
+- SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO),
++ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO),
++ SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO),
++ SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK),
++ SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
++ SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index f456e5f67824c..c4a9141a449cc 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2445,13 +2445,13 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ ALC882_FIXUP_ACER_ASPIRE_8930G),
+ SND_PCI_QUIRK(0x1025, 0x0146, "Acer Aspire 6935G",
+ ALC882_FIXUP_ACER_ASPIRE_8930G),
++ SND_PCI_QUIRK(0x1025, 0x0142, "Acer Aspire 7730G",
++ ALC882_FIXUP_ACER_ASPIRE_4930G),
++ SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210),
+ SND_PCI_QUIRK(0x1025, 0x015e, "Acer Aspire 6930G",
+ ALC882_FIXUP_ACER_ASPIRE_4930G),
+ SND_PCI_QUIRK(0x1025, 0x0166, "Acer Aspire 6530G",
+ ALC882_FIXUP_ACER_ASPIRE_4930G),
+- SND_PCI_QUIRK(0x1025, 0x0142, "Acer Aspire 7730G",
+- ALC882_FIXUP_ACER_ASPIRE_4930G),
+- SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210),
+ SND_PCI_QUIRK(0x1025, 0x021e, "Acer Aspire 5739G",
+ ALC882_FIXUP_ACER_ASPIRE_4930G),
+ SND_PCI_QUIRK(0x1025, 0x0259, "Acer Aspire 5935", ALC889_FIXUP_DAC_ROUTE),
+@@ -2464,11 +2464,11 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
+ SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
+ SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
++ SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
++ SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
+ SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
+ SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
+ SND_PCI_QUIRK(0x104d, 0x9060, "Sony Vaio VPCL14M1R", ALC882_FIXUP_NO_PRIMARY_HP),
+- SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
+- SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
+
+ /* All Apple entries are in codec SSIDs */
+ SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
+@@ -2511,9 +2511,19 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+ SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
++ SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x65d2, "Clevo PB51R[CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x9506, "Clevo P955HQ", ALC1220_FIXUP_CLEVO_P950),
+- SND_PCI_QUIRK(0x1558, 0x950A, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x950a, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e3, "Clevo P955[ER]T", ALC1220_FIXUP_CLEVO_P950),
+@@ -2523,14 +2533,6 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x96e1, "Clevo P960[ER][CDFN]-K", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x97e1, "Clevo P970[ER][CDFN]", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x97e2, "Clevo P970RC-M", ALC1220_FIXUP_CLEVO_P950),
+- SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x65d2, "Clevo PB51R[CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
+@@ -7007,8 +7009,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP),
+ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+- SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
+ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
++ SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
+ SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+@@ -7018,8 +7020,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+- SND_PCI_QUIRK(0x1028, 0x097e, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
+ SND_PCI_QUIRK(0x1028, 0x097d, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
++ SND_PCI_QUIRK(0x1028, 0x097e, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
+ SND_PCI_QUIRK(0x1028, 0x098d, "Dell Precision", ALC233_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x09bf, "Dell Precision", ALC233_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+@@ -7027,35 +7029,18 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
+ SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
+- SND_PCI_QUIRK(0x103c, 0x225f, "HP", ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY),
+- /* ALC282 */
+ SND_PCI_QUIRK(0x103c, 0x21f9, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x221b, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
++ SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x103c, 0x2221, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
++ SND_PCI_QUIRK(0x103c, 0x2225, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x2236, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x2237, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x2238, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x2239, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x224b, "HP", ALC269_FIXUP_HP_LINE1_MIC1_LED),
+- SND_PCI_QUIRK(0x103c, 0x2268, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+- SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+- SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+- SND_PCI_QUIRK(0x103c, 0x226e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+- SND_PCI_QUIRK(0x103c, 0x2271, "HP", ALC286_FIXUP_HP_GPIO_LED),
+- SND_PCI_QUIRK(0x103c, 0x2272, "HP", ALC280_FIXUP_HP_DOCK_PINS),
+- SND_PCI_QUIRK(0x103c, 0x2273, "HP", ALC280_FIXUP_HP_DOCK_PINS),
+- SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+- SND_PCI_QUIRK(0x103c, 0x22b2, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+- SND_PCI_QUIRK(0x103c, 0x22b7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+- SND_PCI_QUIRK(0x103c, 0x22bf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+- SND_PCI_QUIRK(0x103c, 0x22cf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+- SND_PCI_QUIRK(0x103c, 0x22db, "HP", ALC280_FIXUP_HP_9480M),
+- SND_PCI_QUIRK(0x103c, 0x22dc, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+- SND_PCI_QUIRK(0x103c, 0x22fb, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+- /* ALC290 */
+- SND_PCI_QUIRK(0x103c, 0x221b, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+- SND_PCI_QUIRK(0x103c, 0x2221, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+- SND_PCI_QUIRK(0x103c, 0x2225, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x2253, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x2254, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x2255, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+@@ -7063,26 +7048,41 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x2257, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x2259, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x225a, "HP", ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED),
++ SND_PCI_QUIRK(0x103c, 0x225f, "HP", ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x103c, 0x2260, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2263, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2264, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2265, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x2268, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x226e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x2271, "HP", ALC286_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x2272, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
++ SND_PCI_QUIRK(0x103c, 0x2272, "HP", ALC280_FIXUP_HP_DOCK_PINS),
+ SND_PCI_QUIRK(0x103c, 0x2273, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
++ SND_PCI_QUIRK(0x103c, 0x2273, "HP", ALC280_FIXUP_HP_DOCK_PINS),
+ SND_PCI_QUIRK(0x103c, 0x2278, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x227f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2282, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x228b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x228e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x22b2, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x22b7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x22bf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x22c4, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x22c5, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x22c7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x22c8, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+- SND_PCI_QUIRK(0x103c, 0x22c4, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x22cf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x22db, "HP", ALC280_FIXUP_HP_9480M),
++ SND_PCI_QUIRK(0x103c, 0x22dc, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
++ SND_PCI_QUIRK(0x103c, 0x22fb, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+ SND_PCI_QUIRK(0x103c, 0x2334, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+- SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x103c, 0x802e, "HP Z240 SFF", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x802f, "HP Z240", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+@@ -7128,12 +7128,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101),
+- SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+- SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2),
+ SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
+ SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
+ SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX),
++ SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
+ SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
+ SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
+@@ -7199,9 +7199,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
++ SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK),
+- SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2208, "Thinkpad T431s", ALC269_FIXUP_LENOVO_DOCK),
+@@ -7243,6 +7243,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
++ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+ SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK),
+@@ -7261,7 +7262,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+- SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+ SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
+ SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MBXP", ALC256_FIXUP_HUAWEI_MBXP_PINS),
+ SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
+@@ -8175,8 +8175,7 @@ static const struct snd_pci_quirk alc861_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", ALC861_FIXUP_ASUS_A6RP),
+ SND_PCI_QUIRK_VENDOR(0x1043, "ASUS laptop", ALC861_FIXUP_AMP_VREF_0F),
+ SND_PCI_QUIRK(0x1462, 0x7254, "HP DX2200", ALC861_FIXUP_NO_JACK_DETECT),
+- SND_PCI_QUIRK(0x1584, 0x2b01, "Haier W18", ALC861_FIXUP_AMP_VREF_0F),
+- SND_PCI_QUIRK(0x1584, 0x0000, "Uniwill ECS M31EI", ALC861_FIXUP_AMP_VREF_0F),
++ SND_PCI_QUIRK_VENDOR(0x1584, "Haier/Uniwill", ALC861_FIXUP_AMP_VREF_0F),
+ SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", ALC861_FIXUP_FSC_AMILO_PI1505),
+ {}
+ };
+diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
+index ba99ff0e93e03..a0797fc17d957 100644
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -5343,7 +5343,8 @@ static int snd_hdsp_free(struct hdsp *hdsp)
+ if (hdsp->port)
+ pci_release_regions(hdsp->pci);
+
+- pci_disable_device(hdsp->pci);
++ if (pci_is_enabled(hdsp->pci))
++ pci_disable_device(hdsp->pci);
+ return 0;
+ }
+
+diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
+index 11b5b5e0e0580..5dfddade1bae9 100644
+--- a/sound/pci/rme9652/hdspm.c
++++ b/sound/pci/rme9652/hdspm.c
+@@ -6913,7 +6913,8 @@ static int snd_hdspm_free(struct hdspm * hdspm)
+ if (hdspm->port)
+ pci_release_regions(hdspm->pci);
+
+- pci_disable_device(hdspm->pci);
++ if (pci_is_enabled(hdspm->pci))
++ pci_disable_device(hdspm->pci);
+ return 0;
+ }
+
+diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c
+index edd765e223770..f82fa5be7d337 100644
+--- a/sound/pci/rme9652/rme9652.c
++++ b/sound/pci/rme9652/rme9652.c
+@@ -1761,7 +1761,8 @@ static int snd_rme9652_free(struct snd_rme9652 *rme9652)
+ if (rme9652->port)
+ pci_release_regions(rme9652->pci);
+
+- pci_disable_device(rme9652->pci);
++ if (pci_is_enabled(rme9652->pci))
++ pci_disable_device(rme9652->pci);
+ return 0;
+ }
+
+diff --git a/sound/soc/codecs/ak5558.c b/sound/soc/codecs/ak5558.c
+index 73c418517f8d4..dda165b142225 100644
+--- a/sound/soc/codecs/ak5558.c
++++ b/sound/soc/codecs/ak5558.c
+@@ -271,7 +271,7 @@ static void ak5558_power_off(struct ak5558_priv *ak5558)
+ if (!ak5558->reset_gpiod)
+ return;
+
+- gpiod_set_value_cansleep(ak5558->reset_gpiod, 0);
++ gpiod_set_value_cansleep(ak5558->reset_gpiod, 1);
+ usleep_range(1000, 2000);
+ }
+
+@@ -280,7 +280,7 @@ static void ak5558_power_on(struct ak5558_priv *ak5558)
+ if (!ak5558->reset_gpiod)
+ return;
+
+- gpiod_set_value_cansleep(ak5558->reset_gpiod, 1);
++ gpiod_set_value_cansleep(ak5558->reset_gpiod, 0);
+ usleep_range(1000, 2000);
+ }
+
+diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
+index 0b0f748bffbe7..c29c6cf41ece6 100644
+--- a/sound/soc/codecs/rt286.c
++++ b/sound/soc/codecs/rt286.c
+@@ -174,6 +174,9 @@ static bool rt286_readable_register(struct device *dev, unsigned int reg)
+ case RT286_PROC_COEF:
+ case RT286_SET_AMP_GAIN_ADC_IN1:
+ case RT286_SET_AMP_GAIN_ADC_IN2:
++ case RT286_SET_GPIO_MASK:
++ case RT286_SET_GPIO_DIRECTION:
++ case RT286_SET_GPIO_DATA:
+ case RT286_SET_POWER(RT286_DAC_OUT1):
+ case RT286_SET_POWER(RT286_DAC_OUT2):
+ case RT286_SET_POWER(RT286_ADC_IN1):
+@@ -1118,12 +1121,11 @@ static const struct dmi_system_id force_combo_jack_table[] = {
+ { }
+ };
+
+-static const struct dmi_system_id dmi_dell_dino[] = {
++static const struct dmi_system_id dmi_dell[] = {
+ {
+- .ident = "Dell Dino",
++ .ident = "Dell",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9343")
+ }
+ },
+ { }
+@@ -1134,7 +1136,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c,
+ {
+ struct rt286_platform_data *pdata = dev_get_platdata(&i2c->dev);
+ struct rt286_priv *rt286;
+- int i, ret, val;
++ int i, ret, vendor_id;
+
+ rt286 = devm_kzalloc(&i2c->dev, sizeof(*rt286),
+ GFP_KERNEL);
+@@ -1150,14 +1152,15 @@ static int rt286_i2c_probe(struct i2c_client *i2c,
+ }
+
+ ret = regmap_read(rt286->regmap,
+- RT286_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val);
++ RT286_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &vendor_id);
+ if (ret != 0) {
+ dev_err(&i2c->dev, "I2C error %d\n", ret);
+ return ret;
+ }
+- if (val != RT286_VENDOR_ID && val != RT288_VENDOR_ID) {
++ if (vendor_id != RT286_VENDOR_ID && vendor_id != RT288_VENDOR_ID) {
+ dev_err(&i2c->dev,
+- "Device with ID register %#x is not rt286\n", val);
++ "Device with ID register %#x is not rt286\n",
++ vendor_id);
+ return -ENODEV;
+ }
+
+@@ -1181,8 +1184,8 @@ static int rt286_i2c_probe(struct i2c_client *i2c,
+ if (pdata)
+ rt286->pdata = *pdata;
+
+- if (dmi_check_system(force_combo_jack_table) ||
+- dmi_check_system(dmi_dell_dino))
++ if ((vendor_id == RT288_VENDOR_ID && dmi_check_system(dmi_dell)) ||
++ dmi_check_system(force_combo_jack_table))
+ rt286->pdata.cbj_en = true;
+
+ regmap_write(rt286->regmap, RT286_SET_AUDIO_POWER, AC_PWRST_D3);
+@@ -1221,7 +1224,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c,
+ regmap_update_bits(rt286->regmap, RT286_DEPOP_CTRL3, 0xf777, 0x4737);
+ regmap_update_bits(rt286->regmap, RT286_DEPOP_CTRL4, 0x00ff, 0x003f);
+
+- if (dmi_check_system(dmi_dell_dino)) {
++ if (vendor_id == RT288_VENDOR_ID && dmi_check_system(dmi_dell)) {
+ regmap_update_bits(rt286->regmap,
+ RT286_SET_GPIO_MASK, 0x40, 0x40);
+ regmap_update_bits(rt286->regmap,
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index d63d997763845..4ebc023f1507b 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -473,6 +473,9 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TAF"),
+ },
+ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
+ BYT_RT5640_MONO_SPEAKER |
+ BYT_RT5640_DIFF_MIC |
+ BYT_RT5640_SSP0_AIF2 |
+@@ -506,6 +509,23 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ {
++ /* Chuwi Hi8 (CWI509) */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Hampoo"),
++ DMI_MATCH(DMI_BOARD_NAME, "BYT-PA03C"),
++ DMI_MATCH(DMI_SYS_VENDOR, "ilife"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "S806"),
++ },
++ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_MONO_SPEAKER |
++ BYT_RT5640_DIFF_MIC |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Circuitco"),
+diff --git a/sound/soc/samsung/tm2_wm5110.c b/sound/soc/samsung/tm2_wm5110.c
+index 43332c32d7e9b..e5890485fc5e4 100644
+--- a/sound/soc/samsung/tm2_wm5110.c
++++ b/sound/soc/samsung/tm2_wm5110.c
+@@ -541,7 +541,7 @@ static int tm2_probe(struct platform_device *pdev)
+
+ ret = of_parse_phandle_with_args(dev->of_node, "i2s-controller",
+ cells_name, i, &args);
+- if (!args.np) {
++ if (ret) {
+ dev_err(dev, "i2s-controller property parse error: %d\n", i);
+ ret = -EINVAL;
+ goto dai_node_put;
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index ba096cb4a53e4..ce8925e8419eb 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -189,9 +189,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int
+ ctrlif, interface);
+ return -EINVAL;
+ }
+- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L);
+-
+- return 0;
++ return usb_driver_claim_interface(&usb_audio_driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
+ }
+
+ if ((altsd->bInterfaceClass != USB_CLASS_AUDIO &&
+@@ -211,7 +210,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int
+
+ if (! snd_usb_parse_audio_interface(chip, interface)) {
+ usb_set_interface(dev, interface, 0); /* reset the current interface */
+- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L);
++ return usb_driver_claim_interface(&usb_audio_driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
+ }
+
+ return 0;
+@@ -707,7 +707,7 @@ static void usb_audio_disconnect(struct usb_interface *intf)
+ struct snd_card *card;
+ struct list_head *p;
+
+- if (chip == (void *)-1L)
++ if (chip == USB_AUDIO_IFACE_UNUSED)
+ return;
+
+ card = chip->card;
+@@ -807,7 +807,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message)
+ struct usb_mixer_interface *mixer;
+ struct list_head *p;
+
+- if (chip == (void *)-1L)
++ if (chip == USB_AUDIO_IFACE_UNUSED)
+ return 0;
+
+ if (!chip->num_suspended_intf++) {
+@@ -839,7 +839,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)
+ struct list_head *p;
+ int err = 0;
+
+- if (chip == (void *)-1L)
++ if (chip == USB_AUDIO_IFACE_UNUSED)
+ return 0;
+
+ atomic_inc(&chip->active); /* avoid autopm */
+diff --git a/sound/usb/clock.c b/sound/usb/clock.c
+index 54818658d0217..863ac42076e55 100644
+--- a/sound/usb/clock.c
++++ b/sound/usb/clock.c
+@@ -273,7 +273,7 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip,
+
+ selector = snd_usb_find_clock_selector(chip->ctrl_intf, entity_id);
+ if (selector) {
+- int ret, i, cur;
++ int ret, i, cur, err;
+
+ /* the entity ID we are looking for is a selector.
+ * find out what it currently selects */
+@@ -295,13 +295,17 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip,
+ ret = __uac_clock_find_source(chip, fmt,
+ selector->baCSourceID[ret - 1],
+ visited, validate);
++ if (ret > 0) {
++ err = uac_clock_selector_set_val(chip, entity_id, cur);
++ if (err < 0)
++ return err;
++ }
++
+ if (!validate || ret > 0 || !chip->autoclock)
+ return ret;
+
+ /* The current clock source is invalid, try others. */
+ for (i = 1; i <= selector->bNrInPins; i++) {
+- int err;
+-
+ if (i == cur)
+ continue;
+
+@@ -367,7 +371,7 @@ static int __uac3_clock_find_source(struct snd_usb_audio *chip,
+
+ selector = snd_usb_find_clock_selector_v3(chip->ctrl_intf, entity_id);
+ if (selector) {
+- int ret, i, cur;
++ int ret, i, cur, err;
+
+ /* the entity ID we are looking for is a selector.
+ * find out what it currently selects */
+@@ -389,6 +393,12 @@ static int __uac3_clock_find_source(struct snd_usb_audio *chip,
+ ret = __uac3_clock_find_source(chip, fmt,
+ selector->baCSourceID[ret - 1],
+ visited, validate);
++ if (ret > 0) {
++ err = uac_clock_selector_set_val(chip, entity_id, cur);
++ if (err < 0)
++ return err;
++ }
++
+ if (!validate || ret > 0 || !chip->autoclock)
+ return ret;
+
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 26548f760bc1c..4553db0ef0841 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1333,7 +1333,7 @@ static int snd_usbmidi_in_endpoint_create(struct snd_usb_midi *umidi,
+
+ error:
+ snd_usbmidi_in_endpoint_delete(ep);
+- return -ENOMEM;
++ return err;
+ }
+
+ /*
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 451b8ea383c61..4ad6eeb43476b 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1045,7 +1045,7 @@ struct usb_feature_control_info {
+ int type_uac2; /* data type for uac2 if different from uac1, else -1 */
+ };
+
+-static struct usb_feature_control_info audio_feature_info[] = {
++static const struct usb_feature_control_info audio_feature_info[] = {
+ { UAC_FU_MUTE, "Mute", USB_MIXER_INV_BOOLEAN, -1 },
+ { UAC_FU_VOLUME, "Volume", USB_MIXER_S16, -1 },
+ { UAC_FU_BASS, "Tone Control - Bass", USB_MIXER_S8, -1 },
+@@ -1559,7 +1559,7 @@ static void check_no_speaker_on_headset(struct snd_kcontrol *kctl,
+ strlcpy(kctl->id.name, "Headphone", sizeof(kctl->id.name));
+ }
+
+-static struct usb_feature_control_info *get_feature_control_info(int control)
++static const struct usb_feature_control_info *get_feature_control_info(int control)
+ {
+ int i;
+
+@@ -1577,7 +1577,7 @@ static void __build_feature_ctl(struct usb_mixer_interface *mixer,
+ struct usb_audio_term *oterm,
+ int unitid, int nameid, int readonly_mask)
+ {
+- struct usb_feature_control_info *ctl_info;
++ const struct usb_feature_control_info *ctl_info;
+ unsigned int len = 0;
+ int mapped_name = 0;
+ struct snd_kcontrol *kctl;
+@@ -2256,7 +2256,7 @@ static const struct snd_kcontrol_new mixer_procunit_ctl = {
+ */
+ struct procunit_value_info {
+ int control;
+- char *suffix;
++ const char *suffix;
+ int val_type;
+ int min_value;
+ };
+@@ -2264,44 +2264,44 @@ struct procunit_value_info {
+ struct procunit_info {
+ int type;
+ char *name;
+- struct procunit_value_info *values;
++ const struct procunit_value_info *values;
+ };
+
+-static struct procunit_value_info undefined_proc_info[] = {
++static const struct procunit_value_info undefined_proc_info[] = {
+ { 0x00, "Control Undefined", 0 },
+ { 0 }
+ };
+
+-static struct procunit_value_info updown_proc_info[] = {
++static const struct procunit_value_info updown_proc_info[] = {
+ { UAC_UD_ENABLE, "Switch", USB_MIXER_BOOLEAN },
+ { UAC_UD_MODE_SELECT, "Mode Select", USB_MIXER_U8, 1 },
+ { 0 }
+ };
+-static struct procunit_value_info prologic_proc_info[] = {
++static const struct procunit_value_info prologic_proc_info[] = {
+ { UAC_DP_ENABLE, "Switch", USB_MIXER_BOOLEAN },
+ { UAC_DP_MODE_SELECT, "Mode Select", USB_MIXER_U8, 1 },
+ { 0 }
+ };
+-static struct procunit_value_info threed_enh_proc_info[] = {
++static const struct procunit_value_info threed_enh_proc_info[] = {
+ { UAC_3D_ENABLE, "Switch", USB_MIXER_BOOLEAN },
+ { UAC_3D_SPACE, "Spaciousness", USB_MIXER_U8 },
+ { 0 }
+ };
+-static struct procunit_value_info reverb_proc_info[] = {
++static const struct procunit_value_info reverb_proc_info[] = {
+ { UAC_REVERB_ENABLE, "Switch", USB_MIXER_BOOLEAN },
+ { UAC_REVERB_LEVEL, "Level", USB_MIXER_U8 },
+ { UAC_REVERB_TIME, "Time", USB_MIXER_U16 },
+ { UAC_REVERB_FEEDBACK, "Feedback", USB_MIXER_U8 },
+ { 0 }
+ };
+-static struct procunit_value_info chorus_proc_info[] = {
++static const struct procunit_value_info chorus_proc_info[] = {
+ { UAC_CHORUS_ENABLE, "Switch", USB_MIXER_BOOLEAN },
+ { UAC_CHORUS_LEVEL, "Level", USB_MIXER_U8 },
+ { UAC_CHORUS_RATE, "Rate", USB_MIXER_U16 },
+ { UAC_CHORUS_DEPTH, "Depth", USB_MIXER_U16 },
+ { 0 }
+ };
+-static struct procunit_value_info dcr_proc_info[] = {
++static const struct procunit_value_info dcr_proc_info[] = {
+ { UAC_DCR_ENABLE, "Switch", USB_MIXER_BOOLEAN },
+ { UAC_DCR_RATE, "Ratio", USB_MIXER_U16 },
+ { UAC_DCR_MAXAMPL, "Max Amp", USB_MIXER_S16 },
+@@ -2311,7 +2311,7 @@ static struct procunit_value_info dcr_proc_info[] = {
+ { 0 }
+ };
+
+-static struct procunit_info procunits[] = {
++static const struct procunit_info procunits[] = {
+ { UAC_PROCESS_UP_DOWNMIX, "Up Down", updown_proc_info },
+ { UAC_PROCESS_DOLBY_PROLOGIC, "Dolby Prologic", prologic_proc_info },
+ { UAC_PROCESS_STEREO_EXTENDER, "3D Stereo Extender", threed_enh_proc_info },
+@@ -2321,16 +2321,16 @@ static struct procunit_info procunits[] = {
+ { 0 },
+ };
+
+-static struct procunit_value_info uac3_updown_proc_info[] = {
++static const struct procunit_value_info uac3_updown_proc_info[] = {
+ { UAC3_UD_MODE_SELECT, "Mode Select", USB_MIXER_U8, 1 },
+ { 0 }
+ };
+-static struct procunit_value_info uac3_stereo_ext_proc_info[] = {
++static const struct procunit_value_info uac3_stereo_ext_proc_info[] = {
+ { UAC3_EXT_WIDTH_CONTROL, "Width Control", USB_MIXER_U8 },
+ { 0 }
+ };
+
+-static struct procunit_info uac3_procunits[] = {
++static const struct procunit_info uac3_procunits[] = {
+ { UAC3_PROCESS_UP_DOWNMIX, "Up Down", uac3_updown_proc_info },
+ { UAC3_PROCESS_STEREO_EXTENDER, "3D Stereo Extender", uac3_stereo_ext_proc_info },
+ { UAC3_PROCESS_MULTI_FUNCTION, "Multi-Function", undefined_proc_info },
+@@ -2340,23 +2340,23 @@ static struct procunit_info uac3_procunits[] = {
+ /*
+ * predefined data for extension units
+ */
+-static struct procunit_value_info clock_rate_xu_info[] = {
++static const struct procunit_value_info clock_rate_xu_info[] = {
+ { USB_XU_CLOCK_RATE_SELECTOR, "Selector", USB_MIXER_U8, 0 },
+ { 0 }
+ };
+-static struct procunit_value_info clock_source_xu_info[] = {
++static const struct procunit_value_info clock_source_xu_info[] = {
+ { USB_XU_CLOCK_SOURCE_SELECTOR, "External", USB_MIXER_BOOLEAN },
+ { 0 }
+ };
+-static struct procunit_value_info spdif_format_xu_info[] = {
++static const struct procunit_value_info spdif_format_xu_info[] = {
+ { USB_XU_DIGITAL_FORMAT_SELECTOR, "SPDIF/AC3", USB_MIXER_BOOLEAN },
+ { 0 }
+ };
+-static struct procunit_value_info soft_limit_xu_info[] = {
++static const struct procunit_value_info soft_limit_xu_info[] = {
+ { USB_XU_SOFT_LIMIT_SELECTOR, " ", USB_MIXER_BOOLEAN },
+ { 0 }
+ };
+-static struct procunit_info extunits[] = {
++static const struct procunit_info extunits[] = {
+ { USB_XU_CLOCK_RATE, "Clock rate", clock_rate_xu_info },
+ { USB_XU_CLOCK_SOURCE, "DigitalIn CLK source", clock_source_xu_info },
+ { USB_XU_DIGITAL_IO_STATUS, "DigitalOut format:", spdif_format_xu_info },
+@@ -2368,7 +2368,7 @@ static struct procunit_info extunits[] = {
+ * build a processing/extension unit
+ */
+ static int build_audio_procunit(struct mixer_build *state, int unitid,
+- void *raw_desc, struct procunit_info *list,
++ void *raw_desc, const struct procunit_info *list,
+ bool extension_unit)
+ {
+ struct uac_processing_unit_descriptor *desc = raw_desc;
+@@ -2376,14 +2376,14 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ struct usb_mixer_elem_info *cval;
+ struct snd_kcontrol *kctl;
+ int i, err, nameid, type, len;
+- struct procunit_info *info;
+- struct procunit_value_info *valinfo;
++ const struct procunit_info *info;
++ const struct procunit_value_info *valinfo;
+ const struct usbmix_name_map *map;
+- static struct procunit_value_info default_value_info[] = {
++ static const struct procunit_value_info default_value_info[] = {
+ { 0x01, "Switch", USB_MIXER_BOOLEAN },
+ { 0 }
+ };
+- static struct procunit_info default_info = {
++ static const struct procunit_info default_info = {
+ 0, NULL, default_value_info
+ };
+ const char *name = extension_unit ?
+@@ -2861,7 +2861,7 @@ struct uac3_badd_profile {
+ int st_chmask; /* side tone mixing channel mask */
+ };
+
+-static struct uac3_badd_profile uac3_badd_profiles[] = {
++static const struct uac3_badd_profile uac3_badd_profiles[] = {
+ {
+ /*
+ * BAIF, BAOF or combination of both
+@@ -2922,7 +2922,7 @@ static struct uac3_badd_profile uac3_badd_profiles[] = {
+ };
+
+ static bool uac3_badd_func_has_valid_channels(struct usb_mixer_interface *mixer,
+- struct uac3_badd_profile *f,
++ const struct uac3_badd_profile *f,
+ int c_chmask, int p_chmask)
+ {
+ /*
+@@ -2966,7 +2966,7 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer,
+ struct usb_device *dev = mixer->chip->dev;
+ struct usb_interface_assoc_descriptor *assoc;
+ int badd_profile = mixer->chip->badd_profile;
+- struct uac3_badd_profile *f;
++ const struct uac3_badd_profile *f;
+ const struct usbmix_ctl_map *map;
+ int p_chmask = 0, c_chmask = 0, st_chmask = 0;
+ int i;
+@@ -3260,7 +3260,7 @@ static void snd_usb_mixer_dump_cval(struct snd_info_buffer *buffer,
+ struct usb_mixer_elem_list *list)
+ {
+ struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list);
+- static char *val_types[] = {"BOOLEAN", "INV_BOOLEAN",
++ static const char * const val_types[] = {"BOOLEAN", "INV_BOOLEAN",
+ "S8", "U8", "S16", "U16"};
+ snd_iprintf(buffer, " Info: id=%i, control=%i, cmask=0x%x, "
+ "channels=%i, type=\"%s\"\n", cval->head.id,
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 10323e6f7f97e..1d4e535e2c117 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -28,7 +28,7 @@ struct usbmix_name_map {
+ int id;
+ const char *name;
+ int control;
+- struct usbmix_dB_map *dB;
++ const struct usbmix_dB_map *dB;
+ };
+
+ struct usbmix_selector_map {
+@@ -67,7 +67,7 @@ Mic-IN[9] --+->FU[10]----------------------------+ |
+ ++--+->SU[11]-->FU[12] --------------------------------------------------------------------------------------> USB_OUT[13]
+ */
+
+-static struct usbmix_name_map extigy_map[] = {
++static const struct usbmix_name_map extigy_map[] = {
+ /* 1: IT pcm */
+ { 2, "PCM Playback" }, /* FU */
+ /* 3: IT pcm */
+@@ -108,12 +108,12 @@ static struct usbmix_name_map extigy_map[] = {
+ * e.g. no Master and fake PCM volume
+ * Pavel Mihaylov <bin@bash.info>
+ */
+-static struct usbmix_dB_map mp3plus_dB_1 = {.min = -4781, .max = 0};
++static const struct usbmix_dB_map mp3plus_dB_1 = {.min = -4781, .max = 0};
+ /* just guess */
+-static struct usbmix_dB_map mp3plus_dB_2 = {.min = -1781, .max = 618};
++static const struct usbmix_dB_map mp3plus_dB_2 = {.min = -1781, .max = 618};
+ /* just guess */
+
+-static struct usbmix_name_map mp3plus_map[] = {
++static const struct usbmix_name_map mp3plus_map[] = {
+ /* 1: IT pcm */
+ /* 2: IT mic */
+ /* 3: IT line */
+@@ -154,7 +154,7 @@ Lin_IN[7]-+--->FU[8]---+ +->EU[23]->FU[28]------------->Spk_OUT[19]
+ | ^
+ +->FU[13]--------------------------------------+
+ */
+-static struct usbmix_name_map audigy2nx_map[] = {
++static const struct usbmix_name_map audigy2nx_map[] = {
+ /* 1: IT pcm playback */
+ /* 4: IT digital in */
+ { 6, "Digital In Playback" }, /* FU */
+@@ -182,12 +182,12 @@ static struct usbmix_name_map audigy2nx_map[] = {
+ { 0 } /* terminator */
+ };
+
+-static struct usbmix_name_map mbox1_map[] = {
++static const struct usbmix_name_map mbox1_map[] = {
+ { 1, "Clock" },
+ { 0 } /* terminator */
+ };
+
+-static struct usbmix_selector_map c400_selectors[] = {
++static const struct usbmix_selector_map c400_selectors[] = {
+ {
+ .id = 0x80,
+ .count = 2,
+@@ -196,7 +196,7 @@ static struct usbmix_selector_map c400_selectors[] = {
+ { 0 } /* terminator */
+ };
+
+-static struct usbmix_selector_map audigy2nx_selectors[] = {
++static const struct usbmix_selector_map audigy2nx_selectors[] = {
+ {
+ .id = 14, /* Capture Source */
+ .count = 3,
+@@ -216,21 +216,21 @@ static struct usbmix_selector_map audigy2nx_selectors[] = {
+ };
+
+ /* Creative SoundBlaster Live! 24-bit External */
+-static struct usbmix_name_map live24ext_map[] = {
++static const struct usbmix_name_map live24ext_map[] = {
+ /* 2: PCM Playback Volume */
+ { 5, "Mic Capture" }, /* FU, default PCM Capture Volume */
+ { 0 } /* terminator */
+ };
+
+ /* LineX FM Transmitter entry - needed to bypass controls bug */
+-static struct usbmix_name_map linex_map[] = {
++static const struct usbmix_name_map linex_map[] = {
+ /* 1: IT pcm */
+ /* 2: OT Speaker */
+ { 3, "Master" }, /* FU: master volume - left / right / mute */
+ { 0 } /* terminator */
+ };
+
+-static struct usbmix_name_map maya44_map[] = {
++static const struct usbmix_name_map maya44_map[] = {
+ /* 1: IT line */
+ { 2, "Line Playback" }, /* FU */
+ /* 3: IT line */
+@@ -253,7 +253,7 @@ static struct usbmix_name_map maya44_map[] = {
+ * so this map removes all unwanted sliders from alsamixer
+ */
+
+-static struct usbmix_name_map justlink_map[] = {
++static const struct usbmix_name_map justlink_map[] = {
+ /* 1: IT pcm playback */
+ /* 2: Not present */
+ { 3, NULL}, /* IT mic (No mic input on device) */
+@@ -270,7 +270,7 @@ static struct usbmix_name_map justlink_map[] = {
+ };
+
+ /* TerraTec Aureon 5.1 MkII USB */
+-static struct usbmix_name_map aureon_51_2_map[] = {
++static const struct usbmix_name_map aureon_51_2_map[] = {
+ /* 1: IT USB */
+ /* 2: IT Mic */
+ /* 3: IT Line */
+@@ -289,7 +289,7 @@ static struct usbmix_name_map aureon_51_2_map[] = {
+ {} /* terminator */
+ };
+
+-static struct usbmix_name_map scratch_live_map[] = {
++static const struct usbmix_name_map scratch_live_map[] = {
+ /* 1: IT Line 1 (USB streaming) */
+ /* 2: OT Line 1 (Speaker) */
+ /* 3: IT Line 1 (Line connector) */
+@@ -305,7 +305,7 @@ static struct usbmix_name_map scratch_live_map[] = {
+ { 0 } /* terminator */
+ };
+
+-static struct usbmix_name_map ebox44_map[] = {
++static const struct usbmix_name_map ebox44_map[] = {
+ { 4, NULL }, /* FU */
+ { 6, NULL }, /* MU */
+ { 7, NULL }, /* FU */
+@@ -320,7 +320,7 @@ static struct usbmix_name_map ebox44_map[] = {
+ * FIXME: or mp3plus_map should use "Capture Source" too,
+ * so this maps can be merget
+ */
+-static struct usbmix_name_map hercules_usb51_map[] = {
++static const struct usbmix_name_map hercules_usb51_map[] = {
+ { 8, "Capture Source" }, /* SU, default "PCM Capture Source" */
+ { 9, "Master Playback" }, /* FU, default "Speaker Playback" */
+ { 10, "Mic Boost", 7 }, /* FU, default "Auto Gain Input" */
+@@ -331,7 +331,7 @@ static struct usbmix_name_map hercules_usb51_map[] = {
+ };
+
+ /* Plantronics Gamecom 780 has a broken volume control, better to disable it */
+-static struct usbmix_name_map gamecom780_map[] = {
++static const struct usbmix_name_map gamecom780_map[] = {
+ { 9, NULL }, /* FU, speaker out */
+ {}
+ };
+@@ -345,12 +345,19 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
+ };
+
+ /* Bose companion 5, the dB conversion factor is 16 instead of 256 */
+-static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
+-static struct usbmix_name_map bose_companion5_map[] = {
++static const struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
++static const struct usbmix_name_map bose_companion5_map[] = {
+ { 3, NULL, .dB = &bose_companion5_dB },
+ { 0 } /* terminator */
+ };
+
++/* Sennheiser Communications Headset [PC 8], the dB value is reported as -6 negative maximum */
++static const struct usbmix_dB_map sennheiser_pc8_dB = {-9500, 0};
++static const struct usbmix_name_map sennheiser_pc8_map[] = {
++ { 9, NULL, .dB = &sennheiser_pc8_dB },
++ { 0 } /* terminator */
++};
++
+ /*
+ * Dell usb dock with ALC4020 codec had a firmware problem where it got
+ * screwed up when zero volume is passed; just skip it as a workaround
+@@ -420,7 +427,7 @@ static const struct usbmix_name_map aorus_master_alc1220vb_map[] = {
+ * Control map entries
+ */
+
+-static struct usbmix_ctl_map usbmix_ctl_maps[] = {
++static const struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ {
+ .id = USB_ID(0x041e, 0x3000),
+ .map = extigy_map,
+@@ -574,37 +581,37 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ * Control map entries for UAC3 BADD profiles
+ */
+
+-static struct usbmix_name_map uac3_badd_generic_io_map[] = {
++static const struct usbmix_name_map uac3_badd_generic_io_map[] = {
+ { UAC3_BADD_FU_ID2, "Generic Out Playback" },
+ { UAC3_BADD_FU_ID5, "Generic In Capture" },
+ { 0 } /* terminator */
+ };
+-static struct usbmix_name_map uac3_badd_headphone_map[] = {
++static const struct usbmix_name_map uac3_badd_headphone_map[] = {
+ { UAC3_BADD_FU_ID2, "Headphone Playback" },
+ { 0 } /* terminator */
+ };
+-static struct usbmix_name_map uac3_badd_speaker_map[] = {
++static const struct usbmix_name_map uac3_badd_speaker_map[] = {
+ { UAC3_BADD_FU_ID2, "Speaker Playback" },
+ { 0 } /* terminator */
+ };
+-static struct usbmix_name_map uac3_badd_microphone_map[] = {
++static const struct usbmix_name_map uac3_badd_microphone_map[] = {
+ { UAC3_BADD_FU_ID5, "Mic Capture" },
+ { 0 } /* terminator */
+ };
+ /* Covers also 'headset adapter' profile */
+-static struct usbmix_name_map uac3_badd_headset_map[] = {
++static const struct usbmix_name_map uac3_badd_headset_map[] = {
+ { UAC3_BADD_FU_ID2, "Headset Playback" },
+ { UAC3_BADD_FU_ID5, "Headset Capture" },
+ { UAC3_BADD_FU_ID7, "Sidetone Mixing" },
+ { 0 } /* terminator */
+ };
+-static struct usbmix_name_map uac3_badd_speakerphone_map[] = {
++static const struct usbmix_name_map uac3_badd_speakerphone_map[] = {
+ { UAC3_BADD_FU_ID2, "Speaker Playback" },
+ { UAC3_BADD_FU_ID5, "Mic Capture" },
+ { 0 } /* terminator */
+ };
+
+-static struct usbmix_ctl_map uac3_badd_usbmix_ctl_maps[] = {
++static const struct usbmix_ctl_map uac3_badd_usbmix_ctl_maps[] = {
+ {
+ .id = UAC3_FUNCTION_SUBCLASS_GENERIC_IO,
+ .map = uac3_badd_generic_io_map,
+@@ -633,5 +640,10 @@ static struct usbmix_ctl_map uac3_badd_usbmix_ctl_maps[] = {
+ .id = UAC3_FUNCTION_SUBCLASS_SPEAKERPHONE,
+ .map = uac3_badd_speakerphone_map,
+ },
++ {
++ /* Sennheiser Communications Headset [PC 8] */
++ .id = USB_ID(0x1395, 0x0025),
++ .map = sennheiser_pc8_map,
++ },
+ { 0 } /* terminator */
+ };
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index d1328abd1bc49..169679419b398 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -130,7 +130,7 @@ static int snd_create_std_mono_ctl(struct usb_mixer_interface *mixer,
+ * Create a set of standard UAC controls from a table
+ */
+ static int snd_create_std_mono_table(struct usb_mixer_interface *mixer,
+- struct std_mono_table *t)
++ const struct std_mono_table *t)
+ {
+ int err;
+
+@@ -1399,7 +1399,7 @@ static int snd_c400_create_mixer(struct usb_mixer_interface *mixer)
+ * are valid they presents mono controls as L and R channels of
+ * stereo. So we provide a good mixer here.
+ */
+-static struct std_mono_table ebox44_table[] = {
++static const struct std_mono_table ebox44_table[] = {
+ {
+ .unitid = 4,
+ .control = 1,
+@@ -1708,7 +1708,7 @@ static struct snd_kcontrol_new snd_microii_mixer_spdif[] = {
+ static int snd_microii_controls_create(struct usb_mixer_interface *mixer)
+ {
+ int err, i;
+- static usb_mixer_elem_resume_func_t resume_funcs[] = {
++ const static usb_mixer_elem_resume_func_t resume_funcs[] = {
+ snd_microii_spdif_default_update,
+ NULL,
+ snd_microii_spdif_switch_update
+diff --git a/sound/usb/mixer_scarlett.c b/sound/usb/mixer_scarlett.c
+index 4aeb9488a0c99..2e93c0b2e8e32 100644
+--- a/sound/usb/mixer_scarlett.c
++++ b/sound/usb/mixer_scarlett.c
+@@ -633,7 +633,7 @@ static int add_output_ctls(struct usb_mixer_interface *mixer,
+ /********************** device-specific config *************************/
+
+ /* untested... */
+-static struct scarlett_device_info s6i6_info = {
++static const struct scarlett_device_info s6i6_info = {
+ .matrix_in = 18,
+ .matrix_out = 8,
+ .input_len = 6,
+@@ -675,7 +675,7 @@ static struct scarlett_device_info s6i6_info = {
+ };
+
+ /* untested... */
+-static struct scarlett_device_info s8i6_info = {
++static const struct scarlett_device_info s8i6_info = {
+ .matrix_in = 18,
+ .matrix_out = 6,
+ .input_len = 8,
+@@ -714,7 +714,7 @@ static struct scarlett_device_info s8i6_info = {
+ }
+ };
+
+-static struct scarlett_device_info s18i6_info = {
++static const struct scarlett_device_info s18i6_info = {
+ .matrix_in = 18,
+ .matrix_out = 6,
+ .input_len = 18,
+@@ -751,7 +751,7 @@ static struct scarlett_device_info s18i6_info = {
+ }
+ };
+
+-static struct scarlett_device_info s18i8_info = {
++static const struct scarlett_device_info s18i8_info = {
+ .matrix_in = 18,
+ .matrix_out = 8,
+ .input_len = 18,
+@@ -793,7 +793,7 @@ static struct scarlett_device_info s18i8_info = {
+ }
+ };
+
+-static struct scarlett_device_info s18i20_info = {
++static const struct scarlett_device_info s18i20_info = {
+ .matrix_in = 18,
+ .matrix_out = 8,
+ .input_len = 18,
+@@ -843,7 +843,7 @@ static struct scarlett_device_info s18i20_info = {
+
+
+ static int scarlett_controls_create_generic(struct usb_mixer_interface *mixer,
+- struct scarlett_device_info *info)
++ const struct scarlett_device_info *info)
+ {
+ int i, err;
+ char mx[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
+@@ -906,7 +906,7 @@ int snd_scarlett_controls_create(struct usb_mixer_interface *mixer)
+ {
+ int err, i, o;
+ char mx[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
+- struct scarlett_device_info *info;
++ const struct scarlett_device_info *info;
+ struct usb_mixer_elem_info *elem;
+ static char sample_rate_buffer[4] = { '\x80', '\xbb', '\x00', '\x00' };
+
+diff --git a/sound/usb/proc.c b/sound/usb/proc.c
+index 0ac89e294d31d..28192b0b25481 100644
+--- a/sound/usb/proc.c
++++ b/sound/usb/proc.c
+@@ -74,7 +74,7 @@ void snd_usb_audio_create_proc(struct snd_usb_audio *chip)
+ static void proc_dump_substream_formats(struct snd_usb_substream *subs, struct snd_info_buffer *buffer)
+ {
+ struct audioformat *fp;
+- static char *sync_types[4] = {
++ static const char * const sync_types[4] = {
+ "NONE", "ASYNC", "ADAPTIVE", "SYNC"
+ };
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 717edf3b5d3e3..b5f2b18b8b422 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -66,8 +66,12 @@ static int create_composite_quirk(struct snd_usb_audio *chip,
+ if (!iface)
+ continue;
+ if (quirk->ifnum != probed_ifnum &&
+- !usb_interface_claimed(iface))
+- usb_driver_claim_interface(driver, iface, (void *)-1L);
++ !usb_interface_claimed(iface)) {
++ err = usb_driver_claim_interface(driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
++ if (err < 0)
++ return err;
++ }
+ }
+
+ return 0;
+@@ -401,8 +405,12 @@ static int create_autodetect_quirks(struct snd_usb_audio *chip,
+ continue;
+
+ err = create_autodetect_quirk(chip, iface, driver);
+- if (err >= 0)
+- usb_driver_claim_interface(driver, iface, (void *)-1L);
++ if (err >= 0) {
++ err = usb_driver_claim_interface(driver, iface,
++ USB_AUDIO_IFACE_UNUSED);
++ if (err < 0)
++ return err;
++ }
+ }
+
+ return 0;
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index 94bef3d043786..9a950aaf5e356 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -245,7 +245,7 @@ static int add_chmap(struct snd_pcm *pcm, int stream,
+ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
+ int protocol)
+ {
+- static unsigned int uac1_maps[] = {
++ static const unsigned int uac1_maps[] = {
+ SNDRV_CHMAP_FL, /* left front */
+ SNDRV_CHMAP_FR, /* right front */
+ SNDRV_CHMAP_FC, /* center front */
+@@ -260,7 +260,7 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
+ SNDRV_CHMAP_TC, /* top */
+ 0 /* terminator */
+ };
+- static unsigned int uac2_maps[] = {
++ static const unsigned int uac2_maps[] = {
+ SNDRV_CHMAP_FL, /* front left */
+ SNDRV_CHMAP_FR, /* front right */
+ SNDRV_CHMAP_FC, /* front center */
+diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
+index 0d620c267e7a3..0c7ea78317fca 100644
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -68,6 +68,8 @@ struct snd_usb_audio {
+ struct usb_host_interface *ctrl_intf; /* the audio control interface */
+ };
+
++#define USB_AUDIO_IFACE_UNUSED ((void *)-1L)
++
+ #define usb_audio_err(chip, fmt, args...) \
+ dev_err(&(chip)->dev->dev, fmt, ##args)
+ #define usb_audio_warn(chip, fmt, args...) \
+diff --git a/sound/usb/validate.c b/sound/usb/validate.c
+index 5a3c4f7882b00..89a48d7317199 100644
+--- a/sound/usb/validate.c
++++ b/sound/usb/validate.c
+@@ -233,7 +233,7 @@ static bool validate_midi_out_jack(const void *p,
+ #define FIXED(p, t, s) { .protocol = (p), .type = (t), .size = sizeof(s) }
+ #define FUNC(p, t, f) { .protocol = (p), .type = (t), .func = (f) }
+
+-static struct usb_desc_validator audio_validators[] = {
++static const struct usb_desc_validator audio_validators[] = {
+ /* UAC1 */
+ FUNC(UAC_VERSION_1, UAC_HEADER, validate_uac1_header),
+ FIXED(UAC_VERSION_1, UAC_INPUT_TERMINAL,
+@@ -288,7 +288,7 @@ static struct usb_desc_validator audio_validators[] = {
+ { } /* terminator */
+ };
+
+-static struct usb_desc_validator midi_validators[] = {
++static const struct usb_desc_validator midi_validators[] = {
+ FIXED(UAC_VERSION_ALL, USB_MS_HEADER,
+ struct usb_ms_header_descriptor),
+ FIXED(UAC_VERSION_ALL, USB_MS_MIDI_IN_JACK,
+diff --git a/tools/perf/python/tracepoint.py b/tools/perf/python/tracepoint.py
+index eb76f6516247e..461848c7f57dc 100755
+--- a/tools/perf/python/tracepoint.py
++++ b/tools/perf/python/tracepoint.py
+@@ -1,4 +1,4 @@
+-#! /usr/bin/python
++#! /usr/bin/env python
+ # SPDX-License-Identifier: GPL-2.0
+ # -*- python -*-
+ # -*- coding: utf-8 -*-
+diff --git a/tools/perf/util/symbol_fprintf.c b/tools/perf/util/symbol_fprintf.c
+index ed0205cc79426..1fd175bb46004 100644
+--- a/tools/perf/util/symbol_fprintf.c
++++ b/tools/perf/util/symbol_fprintf.c
+@@ -66,7 +66,7 @@ size_t dso__fprintf_symbols_by_name(struct dso *dso,
+
+ for (nd = rb_first(&dso->symbol_names); nd; nd = rb_next(nd)) {
+ pos = rb_entry(nd, struct symbol_name_rb_node, rb_node);
+- fprintf(fp, "%s\n", pos->sym.name);
++ ret += fprintf(fp, "%s\n", pos->sym.name);
+ }
+
+ return ret;
+diff --git a/tools/testing/ktest/compare-ktest-sample.pl b/tools/testing/ktest/compare-ktest-sample.pl
+index 4118eb4a842d2..ebea21d0a1be8 100755
+--- a/tools/testing/ktest/compare-ktest-sample.pl
++++ b/tools/testing/ktest/compare-ktest-sample.pl
+@@ -1,4 +1,4 @@
+-#!/usr/bin/perl
++#!/usr/bin/env perl
+ # SPDX-License-Identifier: GPL-2.0
+
+ open (IN,"ktest.pl");
+diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
+index 2229e55216a97..6b46db61c6d3f 100755
+--- a/tools/testing/selftests/bpf/test_offload.py
++++ b/tools/testing/selftests/bpf/test_offload.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3
++#!/usr/bin/env python3
+
+ # Copyright (C) 2017 Netronome Systems, Inc.
+ #
+diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
+index 0ef203ec59fdc..a5d40653a9211 100644
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -1,6 +1,10 @@
+ # This mimics the top-level Makefile. We do it explicitly here so that this
+ # Makefile can operate with or without the kbuild infrastructure.
++ifneq ($(LLVM),)
++CC := clang
++else
+ CC := $(CROSS_COMPILE)gcc
++endif
+
+ ifeq (0,$(MAKELEVEL))
+ OUTPUT := $(shell pwd)
+diff --git a/tools/testing/selftests/tc-testing/tdc_batch.py b/tools/testing/selftests/tc-testing/tdc_batch.py
+index 52fa539dc662b..3d8350d6bfe18 100755
+--- a/tools/testing/selftests/tc-testing/tdc_batch.py
++++ b/tools/testing/selftests/tc-testing/tdc_batch.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3
++#!/usr/bin/env python3
+
+ """
+ tdc_batch.py - a script to generate TC batch file
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index d982650deb33f..39706799ecdf8 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -574,6 +574,8 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
+
+ vcpu->arch.has_run_once = true;
+
++ kvm_arm_vcpu_init_debug(vcpu);
++
+ if (likely(irqchip_in_kernel(kvm))) {
+ /*
+ * Map the VGIC hardware resources before running a vcpu the
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-05-26 12:05 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-05-26 12:05 UTC (permalink / raw
To: gentoo-commits
commit: 5ea815bec95ab0ee62acf3f6393d811ba8209eba
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 26 12:05:18 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 26 12:05:18 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5ea815be
Linux patch 4.19.192
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1191_linux-4.19.192.patch | 1246 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1250 insertions(+)
diff --git a/0000_README b/0000_README
index 303595a..a935472 100644
--- a/0000_README
+++ b/0000_README
@@ -803,6 +803,10 @@ Patch: 1190_linux-4.19.191.patch
From: https://www.kernel.org
Desc: Linux 4.19.191
+Patch: 1191_linux-4.19.192.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.192
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1191_linux-4.19.192.patch b/1191_linux-4.19.192.patch
new file mode 100644
index 0000000..07efafd
--- /dev/null
+++ b/1191_linux-4.19.192.patch
@@ -0,0 +1,1246 @@
+diff --git a/Makefile b/Makefile
+index 586a2d128ffb3..51ee6da4c1ab5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 191
++SUBLEVEL = 192
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/openrisc/kernel/setup.c b/arch/openrisc/kernel/setup.c
+index 9d28ab14d139c..f3a7375ac3cd9 100644
+--- a/arch/openrisc/kernel/setup.c
++++ b/arch/openrisc/kernel/setup.c
+@@ -281,6 +281,8 @@ void calibrate_delay(void)
+ pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n",
+ loops_per_jiffy / (500000 / HZ),
+ (loops_per_jiffy / (5000 / HZ)) % 100, loops_per_jiffy);
++
++ of_node_put(cpu);
+ }
+
+ void __init setup_arch(char **cmdline_p)
+diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
+index 72cd96a8eb19d..c4192f9e4db9d 100644
+--- a/drivers/cdrom/gdrom.c
++++ b/drivers/cdrom/gdrom.c
+@@ -775,6 +775,13 @@ static int probe_gdrom_setupqueue(void)
+ static int probe_gdrom(struct platform_device *devptr)
+ {
+ int err;
++
++ /*
++ * Ensure our "one" device is initialized properly in case of previous
++ * usages of it
++ */
++ memset(&gd, 0, sizeof(gd));
++
+ /* Start the device */
+ if (gdrom_execute_diagnostic() != 1) {
+ pr_warning("ATA Probe for GDROM failed\n");
+@@ -857,6 +864,8 @@ static int remove_gdrom(struct platform_device *devptr)
+ if (gdrom_major)
+ unregister_blkdev(gdrom_major, GDROM_DEV_NAME);
+ unregister_cdrom(gd.cd_info);
++ kfree(gd.cd_info);
++ kfree(gd.toc);
+
+ return 0;
+ }
+@@ -872,7 +881,7 @@ static struct platform_driver gdrom_driver = {
+ static int __init init_gdrom(void)
+ {
+ int rc;
+- gd.toc = NULL;
++
+ rc = platform_driver_register(&gdrom_driver);
+ if (rc)
+ return rc;
+@@ -888,8 +897,6 @@ static void __exit exit_gdrom(void)
+ {
+ platform_device_unregister(pd);
+ platform_driver_unregister(&gdrom_driver);
+- kfree(gd.toc);
+- kfree(gd.cd_info);
+ }
+
+ module_init(init_gdrom);
+diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
+index c7d06a36b23a5..baa7280eccb34 100644
+--- a/drivers/firmware/arm_scpi.c
++++ b/drivers/firmware/arm_scpi.c
+@@ -563,8 +563,10 @@ static unsigned long scpi_clk_get_val(u16 clk_id)
+
+ ret = scpi_send_message(CMD_GET_CLOCK_VALUE, &le_clk_id,
+ sizeof(le_clk_id), &rate, sizeof(rate));
++ if (ret)
++ return 0;
+
+- return ret ? ret : le32_to_cpu(rate);
++ return le32_to_cpu(rate);
+ }
+
+ static int scpi_clk_set_val(u16 clk_id, unsigned long rate)
+diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
+index f9b8e3e23a8e8..dc2bd82b32021 100644
+--- a/drivers/hwmon/lm80.c
++++ b/drivers/hwmon/lm80.c
+@@ -630,7 +630,6 @@ static int lm80_probe(struct i2c_client *client,
+ struct device *dev = &client->dev;
+ struct device *hwmon_dev;
+ struct lm80_data *data;
+- int rv;
+
+ data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL);
+ if (!data)
+@@ -643,14 +642,8 @@ static int lm80_probe(struct i2c_client *client,
+ lm80_init_client(client);
+
+ /* A few vars need to be filled upon startup */
+- rv = lm80_read_value(client, LM80_REG_FAN_MIN(1));
+- if (rv < 0)
+- return rv;
+- data->fan[f_min][0] = rv;
+- rv = lm80_read_value(client, LM80_REG_FAN_MIN(2));
+- if (rv < 0)
+- return rv;
+- data->fan[f_min][1] = rv;
++ data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1));
++ data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2));
+
+ hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
+ data, lm80_groups);
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 1695605eeb528..13513466df01f 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -6339,6 +6339,7 @@ static void *mlx5_ib_add_slave_port(struct mlx5_core_dev *mdev)
+
+ if (bound) {
+ rdma_roce_rescan_device(&dev->ib_dev);
++ mpi->ibdev->ib_active = true;
+ break;
+ }
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 8a22ab8b29e9b..41c9ede98c265 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -250,6 +250,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
+ if (err) {
+ vfree(qp->sq.queue->buf);
+ kfree(qp->sq.queue);
++ qp->sq.queue = NULL;
+ return err;
+ }
+
+@@ -303,6 +304,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
+ if (err) {
+ vfree(qp->rq.queue->buf);
+ kfree(qp->rq.queue);
++ qp->rq.queue = NULL;
+ return err;
+ }
+ }
+@@ -363,6 +365,11 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd,
+ err2:
+ rxe_queue_cleanup(qp->sq.queue);
+ err1:
++ qp->pd = NULL;
++ qp->rcq = NULL;
++ qp->scq = NULL;
++ qp->srq = NULL;
++
+ if (srq)
+ rxe_drop_ref(srq);
+ rxe_drop_ref(scq);
+diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
+index fd64df5a57a5e..e5413d93f0a1c 100644
+--- a/drivers/leds/leds-lp5523.c
++++ b/drivers/leds/leds-lp5523.c
+@@ -320,7 +320,7 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
+ usleep_range(3000, 6000);
+ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
+ if (ret)
+- return ret;
++ goto out;
+ status &= LP5523_ENG_STATUS_MASK;
+
+ if (status != LP5523_ENG_STATUS_MASK) {
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index 9e930a150aa29..7d96836294713 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1286,6 +1286,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+
+ if (!s->store->chunk_size) {
+ ti->error = "Chunk size not set";
++ r = -EINVAL;
+ goto bad_read_metadata;
+ }
+
+diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c
+index b677d014e7bab..81413ab52475d 100644
+--- a/drivers/media/platform/rcar_drif.c
++++ b/drivers/media/platform/rcar_drif.c
+@@ -912,7 +912,6 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv,
+ {
+ struct rcar_drif_sdr *sdr = video_drvdata(file);
+
+- memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved));
+ f->fmt.sdr.pixelformat = sdr->fmt->pixelformat;
+ f->fmt.sdr.buffersize = sdr->fmt->buffersize;
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+index a4cd6f2cfb862..4fb3dcb038196 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+@@ -1049,7 +1049,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode)
+ for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) {
+ skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE);
+ if (!skb)
+- break;
++ goto error;
+ qlcnic_create_loopback_buff(skb->data, adapter->mac_addr);
+ skb_put(skb, QLCNIC_ILB_PKT_SIZE);
+ adapter->ahw->diag_cnt = 0;
+@@ -1073,6 +1073,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode)
+ cnt++;
+ }
+ if (cnt != i) {
++error:
+ dev_err(&adapter->pdev->dev,
+ "LB Test: failed, TX[%d], RX[%d]\n", i, cnt);
+ if (mode != QLCNIC_ILB_MODE)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+index 57694eada9955..f31067659e95f 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+@@ -39,7 +39,7 @@ struct sunxi_priv_data {
+ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
+ {
+ struct sunxi_priv_data *gmac = priv;
+- int ret;
++ int ret = 0;
+
+ if (gmac->regulator) {
+ ret = regulator_enable(gmac->regulator);
+@@ -60,11 +60,11 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
+ } else {
+ clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
+ ret = clk_prepare(gmac->tx_clk);
+- if (ret)
+- return ret;
++ if (ret && gmac->regulator)
++ regulator_disable(gmac->regulator);
+ }
+
+- return 0;
++ return ret;
+ }
+
+ static void sun7i_gmac_exit(struct platform_device *pdev, void *priv)
+diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
+index 602a2025717ab..5894edf79d659 100644
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -8145,10 +8145,10 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
+ "VPD_SCAN: Reading in property [%s] len[%d]\n",
+ namebuf, prop_len);
+ for (i = 0; i < prop_len; i++) {
+- err = niu_pci_eeprom_read(np, off + i);
+- if (err >= 0)
+- *prop_buf = err;
+- ++prop_buf;
++ err = niu_pci_eeprom_read(np, off + i);
++ if (err < 0)
++ return err;
++ *prop_buf++ = err;
+ }
+ }
+
+@@ -8159,14 +8159,14 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end)
+ }
+
+ /* ESPC_PIO_EN_ENABLE must be set */
+-static void niu_pci_vpd_fetch(struct niu *np, u32 start)
++static int niu_pci_vpd_fetch(struct niu *np, u32 start)
+ {
+ u32 offset;
+ int err;
+
+ err = niu_pci_eeprom_read16_swp(np, start + 1);
+ if (err < 0)
+- return;
++ return err;
+
+ offset = err + 3;
+
+@@ -8175,12 +8175,14 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start)
+ u32 end;
+
+ err = niu_pci_eeprom_read(np, here);
++ if (err < 0)
++ return err;
+ if (err != 0x90)
+- return;
++ return -EINVAL;
+
+ err = niu_pci_eeprom_read16_swp(np, here + 1);
+ if (err < 0)
+- return;
++ return err;
+
+ here = start + offset + 3;
+ end = start + offset + err;
+@@ -8188,9 +8190,12 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start)
+ offset += err;
+
+ err = niu_pci_vpd_scan_props(np, here, end);
+- if (err < 0 || err == 1)
+- return;
++ if (err < 0)
++ return err;
++ if (err == 1)
++ return -EINVAL;
+ }
++ return 0;
+ }
+
+ /* ESPC_PIO_EN_ENABLE must be set */
+@@ -9281,8 +9286,11 @@ static int niu_get_invariants(struct niu *np)
+ offset = niu_pci_vpd_offset(np);
+ netif_printk(np, probe, KERN_DEBUG, np->dev,
+ "%s() VPD offset [%08x]\n", __func__, offset);
+- if (offset)
+- niu_pci_vpd_fetch(np, offset);
++ if (offset) {
++ err = niu_pci_vpd_fetch(np, offset);
++ if (err < 0)
++ return err;
++ }
+ nw64(ESPC_PIO_EN, 0);
+
+ if (np->flags & NIU_FLAGS_VPD_VALID) {
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index a3189294ecb80..6d1b6a4a81502 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -457,9 +457,14 @@ static void _rtl_init_mac80211(struct ieee80211_hw *hw)
+ }
+ }
+
+-static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
++static int _rtl_init_deferred_work(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
++ struct workqueue_struct *wq;
++
++ wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
++ if (!wq)
++ return -ENOMEM;
+
+ /* <1> timer */
+ timer_setup(&rtlpriv->works.watchdog_timer,
+@@ -468,11 +473,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
+ rtl_easy_concurrent_retrytimer_callback, 0);
+ /* <2> work queue */
+ rtlpriv->works.hw = hw;
+- rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
+- if (unlikely(!rtlpriv->works.rtl_wq)) {
+- pr_err("Failed to allocate work queue\n");
+- return;
+- }
++ rtlpriv->works.rtl_wq = wq;
+
+ INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
+ (void *)rtl_watchdog_wq_callback);
+@@ -486,7 +487,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
+ (void *)rtl_fwevt_wq_callback);
+ INIT_DELAYED_WORK(&rtlpriv->works.c2hcmd_wq,
+ (void *)rtl_c2hcmd_wq_callback);
+-
++ return 0;
+ }
+
+ void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq)
+@@ -586,9 +587,7 @@ int rtl_init_core(struct ieee80211_hw *hw)
+ rtlmac->link_state = MAC80211_NOLINK;
+
+ /* <6> init deferred work */
+- _rtl_init_deferred_work(hw);
+-
+- return 0;
++ return _rtl_init_deferred_work(hw);
+ }
+ EXPORT_SYMBOL_GPL(rtl_init_core);
+
+diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
+index 39d972e2595f0..ad6263cf7303c 100644
+--- a/drivers/nvme/target/io-cmd-file.c
++++ b/drivers/nvme/target/io-cmd-file.c
+@@ -38,9 +38,11 @@ int nvmet_file_ns_enable(struct nvmet_ns *ns)
+
+ ns->file = filp_open(ns->device_path, flags, 0);
+ if (IS_ERR(ns->file)) {
+- pr_err("failed to open file %s: (%ld)\n",
+- ns->device_path, PTR_ERR(ns->file));
+- return PTR_ERR(ns->file);
++ ret = PTR_ERR(ns->file);
++ pr_err("failed to open file %s: (%d)\n",
++ ns->device_path, ret);
++ ns->file = NULL;
++ return ret;
+ }
+
+ ret = vfs_getattr(&ns->file->f_path,
+diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c
+index cf2229ece9ff6..ccccce9b67efe 100644
+--- a/drivers/platform/x86/dell-smbios-wmi.c
++++ b/drivers/platform/x86/dell-smbios-wmi.c
+@@ -274,7 +274,8 @@ int init_dell_smbios_wmi(void)
+
+ void exit_dell_smbios_wmi(void)
+ {
+- wmi_driver_unregister(&dell_smbios_wmi_driver);
++ if (wmi_supported)
++ wmi_driver_unregister(&dell_smbios_wmi_driver);
+ }
+
+ MODULE_ALIAS("wmi:" DELL_WMI_SMBIOS_GUID);
+diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
+index b29fc258eeba4..ab57a1eb519fc 100644
+--- a/drivers/rapidio/rio_cm.c
++++ b/drivers/rapidio/rio_cm.c
+@@ -2136,6 +2136,14 @@ static int riocm_add_mport(struct device *dev,
+ return -ENODEV;
+ }
+
++ cm->rx_wq = create_workqueue(DRV_NAME "/rxq");
++ if (!cm->rx_wq) {
++ rio_release_inb_mbox(mport, cmbox);
++ rio_release_outb_mbox(mport, cmbox);
++ kfree(cm);
++ return -ENOMEM;
++ }
++
+ /*
+ * Allocate and register inbound messaging buffers to be ready
+ * to receive channel and system management requests
+@@ -2146,15 +2154,6 @@ static int riocm_add_mport(struct device *dev,
+ cm->rx_slots = RIOCM_RX_RING_SIZE;
+ mutex_init(&cm->rx_lock);
+ riocm_rx_fill(cm, RIOCM_RX_RING_SIZE);
+- cm->rx_wq = create_workqueue(DRV_NAME "/rxq");
+- if (!cm->rx_wq) {
+- riocm_error("failed to allocate IBMBOX_%d on %s",
+- cmbox, mport->name);
+- rio_release_outb_mbox(mport, cmbox);
+- kfree(cm);
+- return -ENOMEM;
+- }
+-
+ INIT_WORK(&cm->rx_work, rio_ibmsg_handler);
+
+ cm->tx_slot = 0;
+diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
+index 3007eecfa509b..7451355f20e08 100644
+--- a/drivers/scsi/qla2xxx/qla_nx.c
++++ b/drivers/scsi/qla2xxx/qla_nx.c
+@@ -1107,7 +1107,8 @@ qla82xx_write_flash_dword(struct qla_hw_data *ha, uint32_t flashaddr,
+ return ret;
+ }
+
+- if (qla82xx_flash_set_write_enable(ha))
++ ret = qla82xx_flash_set_write_enable(ha);
++ if (ret < 0)
+ goto done_write;
+
+ qla82xx_wr_32(ha, QLA82XX_ROMUSB_ROM_WDATA, data);
+diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c
+index c2cee73a8560d..2bb8bdc2539bc 100644
+--- a/drivers/scsi/ufs/ufs-hisi.c
++++ b/drivers/scsi/ufs/ufs-hisi.c
+@@ -543,21 +543,24 @@ static int ufs_hisi_init_common(struct ufs_hba *hba)
+ host->hba = hba;
+ ufshcd_set_variant(hba, host);
+
+- host->rst = devm_reset_control_get(dev, "rst");
++ host->rst = devm_reset_control_get(dev, "rst");
+ if (IS_ERR(host->rst)) {
+ dev_err(dev, "%s: failed to get reset control\n", __func__);
+- return PTR_ERR(host->rst);
++ err = PTR_ERR(host->rst);
++ goto error;
+ }
+
+ ufs_hisi_set_pm_lvl(hba);
+
+ err = ufs_hisi_get_resource(host);
+- if (err) {
+- ufshcd_set_variant(hba, NULL);
+- return err;
+- }
++ if (err)
++ goto error;
+
+ return 0;
++
++error:
++ ufshcd_set_variant(hba, NULL);
++ return err;
+ }
+
+ static int ufs_hi3660_init(struct ufs_hba *hba)
+diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
+index 330522be708fa..0515b5e6326d7 100644
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -807,9 +807,6 @@ static int mvebu_uart_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
+- if (!match)
+- return -ENODEV;
+-
+ /* Assume that all UART ports have a DT alias or none has */
+ id = of_alias_get_id(pdev->dev.of_node, "serial");
+ if (!pdev->dev.of_node || id < 0)
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 1fad4978a3b41..b2b5f19fb2fb9 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1169,7 +1169,7 @@ static inline int resize_screen(struct vc_data *vc, int width, int height,
+ /* Resizes the resolution of the display adapater */
+ int err = 0;
+
+- if (vc->vc_mode != KD_GRAPHICS && vc->vc_sw->con_resize)
++ if (vc->vc_sw->con_resize)
+ err = vc->vc_sw->con_resize(vc, width, height, user);
+
+ return err;
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index 2e959563af534..ce6c7dd7bc126 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -895,17 +895,17 @@ int vt_ioctl(struct tty_struct *tty,
+ if (vcp) {
+ int ret;
+ int save_scan_lines = vcp->vc_scan_lines;
+- int save_font_height = vcp->vc_font.height;
++ int save_cell_height = vcp->vc_cell_height;
+
+ if (v.v_vlin)
+ vcp->vc_scan_lines = v.v_vlin;
+ if (v.v_clin)
+- vcp->vc_font.height = v.v_clin;
++ vcp->vc_cell_height = v.v_clin;
+ vcp->vc_resize_user = 1;
+ ret = vc_resize(vcp, v.v_cols, v.v_rows);
+ if (ret) {
+ vcp->vc_scan_lines = save_scan_lines;
+- vcp->vc_font.height = save_font_height;
++ vcp->vc_cell_height = save_cell_height;
+ console_unlock();
+ return ret;
+ }
+diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
+index 55507df335bdd..a992d922b3a71 100644
+--- a/drivers/video/console/vgacon.c
++++ b/drivers/video/console/vgacon.c
+@@ -384,7 +384,7 @@ static void vgacon_init(struct vc_data *c, int init)
+ vc_resize(c, vga_video_num_columns, vga_video_num_lines);
+
+ c->vc_scan_lines = vga_scan_lines;
+- c->vc_font.height = vga_video_font_height;
++ c->vc_font.height = c->vc_cell_height = vga_video_font_height;
+ c->vc_complement_mask = 0x7700;
+ if (vga_512_chars)
+ c->vc_hi_font_mask = 0x0800;
+@@ -517,32 +517,32 @@ static void vgacon_cursor(struct vc_data *c, int mode)
+ switch (c->vc_cursor_type & 0x0f) {
+ case CUR_UNDERLINE:
+ vgacon_set_cursor_size(c->vc_x,
+- c->vc_font.height -
+- (c->vc_font.height <
++ c->vc_cell_height -
++ (c->vc_cell_height <
+ 10 ? 2 : 3),
+- c->vc_font.height -
+- (c->vc_font.height <
++ c->vc_cell_height -
++ (c->vc_cell_height <
+ 10 ? 1 : 2));
+ break;
+ case CUR_TWO_THIRDS:
+ vgacon_set_cursor_size(c->vc_x,
+- c->vc_font.height / 3,
+- c->vc_font.height -
+- (c->vc_font.height <
++ c->vc_cell_height / 3,
++ c->vc_cell_height -
++ (c->vc_cell_height <
+ 10 ? 1 : 2));
+ break;
+ case CUR_LOWER_THIRD:
+ vgacon_set_cursor_size(c->vc_x,
+- (c->vc_font.height * 2) / 3,
+- c->vc_font.height -
+- (c->vc_font.height <
++ (c->vc_cell_height * 2) / 3,
++ c->vc_cell_height -
++ (c->vc_cell_height <
+ 10 ? 1 : 2));
+ break;
+ case CUR_LOWER_HALF:
+ vgacon_set_cursor_size(c->vc_x,
+- c->vc_font.height / 2,
+- c->vc_font.height -
+- (c->vc_font.height <
++ c->vc_cell_height / 2,
++ c->vc_cell_height -
++ (c->vc_cell_height <
+ 10 ? 1 : 2));
+ break;
+ case CUR_NONE:
+@@ -553,7 +553,7 @@ static void vgacon_cursor(struct vc_data *c, int mode)
+ break;
+ default:
+ vgacon_set_cursor_size(c->vc_x, 1,
+- c->vc_font.height);
++ c->vc_cell_height);
+ break;
+ }
+ break;
+@@ -564,13 +564,13 @@ static int vgacon_doresize(struct vc_data *c,
+ unsigned int width, unsigned int height)
+ {
+ unsigned long flags;
+- unsigned int scanlines = height * c->vc_font.height;
++ unsigned int scanlines = height * c->vc_cell_height;
+ u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan;
+
+ raw_spin_lock_irqsave(&vga_lock, flags);
+
+ vgacon_xres = width * VGA_FONTWIDTH;
+- vgacon_yres = height * c->vc_font.height;
++ vgacon_yres = height * c->vc_cell_height;
+ if (vga_video_type >= VIDEO_TYPE_VGAC) {
+ outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg);
+ max_scan = inb_p(vga_video_port_val);
+@@ -625,9 +625,9 @@ static int vgacon_doresize(struct vc_data *c,
+ static int vgacon_switch(struct vc_data *c)
+ {
+ int x = c->vc_cols * VGA_FONTWIDTH;
+- int y = c->vc_rows * c->vc_font.height;
++ int y = c->vc_rows * c->vc_cell_height;
+ int rows = screen_info.orig_video_lines * vga_default_font_height/
+- c->vc_font.height;
++ c->vc_cell_height;
+ /*
+ * We need to save screen size here as it's the only way
+ * we can spot the screen has been resized and we need to
+@@ -1058,7 +1058,7 @@ static int vgacon_adjust_height(struct vc_data *vc, unsigned fontheight)
+ cursor_size_lastto = 0;
+ c->vc_sw->con_cursor(c, CM_DRAW);
+ }
+- c->vc_font.height = fontheight;
++ c->vc_font.height = c->vc_cell_height = fontheight;
+ vc_resize(c, 0, rows); /* Adjust console size */
+ }
+ }
+@@ -1106,12 +1106,20 @@ static int vgacon_resize(struct vc_data *c, unsigned int width,
+ if ((width << 1) * height > vga_vram_size)
+ return -EINVAL;
+
++ if (user) {
++ /*
++ * Ho ho! Someone (svgatextmode, eh?) may have reprogrammed
++ * the video mode! Set the new defaults then and go away.
++ */
++ screen_info.orig_video_cols = width;
++ screen_info.orig_video_lines = height;
++ vga_default_font_height = c->vc_cell_height;
++ return 0;
++ }
+ if (width % 2 || width > screen_info.orig_video_cols ||
+ height > (screen_info.orig_video_lines * vga_default_font_height)/
+- c->vc_font.height)
+- /* let svgatextmode tinker with video timings and
+- return success */
+- return (user) ? 0 : -EINVAL;
++ c->vc_cell_height)
++ return -EINVAL;
+
+ if (con_is_visible(c) && !vga_is_gfx) /* who knows */
+ vgacon_doresize(c, width, height);
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index cf0e025416e5e..bf7959fdf9f44 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -2025,7 +2025,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
+ return -EINVAL;
+
+ DPRINTK("resize now %ix%i\n", var.xres, var.yres);
+- if (con_is_visible(vc)) {
++ if (con_is_visible(vc) && vc->vc_mode == KD_TEXT) {
+ var.activate = FB_ACTIVATE_NOW |
+ FB_ACTIVATE_FORCE;
+ fb_set_var(info, &var);
+diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c
+index 59e1cae579481..03c0b1b8747b9 100644
+--- a/drivers/video/fbdev/hgafb.c
++++ b/drivers/video/fbdev/hgafb.c
+@@ -286,7 +286,7 @@ static int hga_card_detect(void)
+
+ hga_vram = ioremap(0xb0000, hga_vram_len);
+ if (!hga_vram)
+- goto error;
++ return -ENOMEM;
+
+ if (request_region(0x3b0, 12, "hgafb"))
+ release_io_ports = 1;
+@@ -346,13 +346,18 @@ static int hga_card_detect(void)
+ hga_type_name = "Hercules";
+ break;
+ }
+- return 1;
++ return 0;
+ error:
+ if (release_io_ports)
+ release_region(0x3b0, 12);
+ if (release_io_port)
+ release_region(0x3bf, 1);
+- return 0;
++
++ iounmap(hga_vram);
++
++ pr_err("hgafb: HGA card not detected.\n");
++
++ return -EINVAL;
+ }
+
+ /**
+@@ -550,13 +555,11 @@ static struct fb_ops hgafb_ops = {
+ static int hgafb_probe(struct platform_device *pdev)
+ {
+ struct fb_info *info;
++ int ret;
+
+- if (! hga_card_detect()) {
+- printk(KERN_INFO "hgafb: HGA card not detected.\n");
+- if (hga_vram)
+- iounmap(hga_vram);
+- return -EINVAL;
+- }
++ ret = hga_card_detect();
++ if (ret)
++ return ret;
+
+ printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n",
+ hga_type_name, hga_vram_len/1024);
+diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
+index ffcf553719a31..ecdcf358ad5ea 100644
+--- a/drivers/video/fbdev/imsttfb.c
++++ b/drivers/video/fbdev/imsttfb.c
+@@ -1516,11 +1516,6 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ info->fix.smem_start = addr;
+ info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ?
+ 0x400000 : 0x800000);
+- if (!info->screen_base) {
+- release_mem_region(addr, size);
+- framebuffer_release(info);
+- return -ENOMEM;
+- }
+ info->fix.mmio_start = addr + 0x800000;
+ par->dc_regs = ioremap(addr + 0x800000, 0x1000);
+ par->cmap_regs_phys = addr + 0x840000;
+diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
+index 1e2a996c75158..4fb6aacf96143 100644
+--- a/drivers/xen/xen-pciback/xenbus.c
++++ b/drivers/xen/xen-pciback/xenbus.c
+@@ -358,7 +358,8 @@ out:
+ return err;
+ }
+
+-static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev)
++static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev,
++ enum xenbus_state state)
+ {
+ int err = 0;
+ int num_devs;
+@@ -372,9 +373,7 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev)
+ dev_dbg(&pdev->xdev->dev, "Reconfiguring device ...\n");
+
+ mutex_lock(&pdev->dev_lock);
+- /* Make sure we only reconfigure once */
+- if (xenbus_read_driver_state(pdev->xdev->nodename) !=
+- XenbusStateReconfiguring)
++ if (xenbus_read_driver_state(pdev->xdev->nodename) != state)
+ goto out;
+
+ err = xenbus_scanf(XBT_NIL, pdev->xdev->nodename, "num_devs", "%d",
+@@ -499,6 +498,10 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev)
+ }
+ }
+
++ if (state != XenbusStateReconfiguring)
++ /* Make sure we only reconfigure once. */
++ goto out;
++
+ err = xenbus_switch_state(pdev->xdev, XenbusStateReconfigured);
+ if (err) {
+ xenbus_dev_fatal(pdev->xdev, err,
+@@ -524,7 +527,7 @@ static void xen_pcibk_frontend_changed(struct xenbus_device *xdev,
+ break;
+
+ case XenbusStateReconfiguring:
+- xen_pcibk_reconfigure(pdev);
++ xen_pcibk_reconfigure(pdev, XenbusStateReconfiguring);
+ break;
+
+ case XenbusStateConnected:
+@@ -663,6 +666,15 @@ static void xen_pcibk_be_watch(struct xenbus_watch *watch,
+ xen_pcibk_setup_backend(pdev);
+ break;
+
++ case XenbusStateInitialised:
++ /*
++ * We typically move to Initialised when the first device was
++ * added. Hence subsequent devices getting added may need
++ * reconfiguring.
++ */
++ xen_pcibk_reconfigure(pdev, XenbusStateInitialised);
++ break;
++
+ default:
+ break;
+ }
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 9d94abaff8fc4..5a14f518cd979 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1174,6 +1174,8 @@ smb2_copychunk_range(const unsigned int xid,
+ cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk));
+
+ /* Request server copy to target from src identified by key */
++ kfree(retbuf);
++ retbuf = NULL;
+ rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
+ trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE,
+ true /* is_fsctl */, (char *)pcchunk,
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 8e5353bd72cfd..708f931c36f14 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -325,10 +325,8 @@ static int crypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
+ struct extent_crypt_result ecr;
+ int rc = 0;
+
+- if (!crypt_stat || !crypt_stat->tfm
+- || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
+- return -EINVAL;
+-
++ BUG_ON(!crypt_stat || !crypt_stat->tfm
++ || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED));
+ if (unlikely(ecryptfs_verbosity > 0)) {
+ ecryptfs_printk(KERN_DEBUG, "Key size [%zd]; key:\n",
+ crypt_stat->key_size);
+diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h
+index fea64f2692a05..8b5bc3a47bf5f 100644
+--- a/include/linux/console_struct.h
++++ b/include/linux/console_struct.h
+@@ -62,6 +62,7 @@ struct vc_data {
+ unsigned int vc_rows;
+ unsigned int vc_size_row; /* Bytes per row */
+ unsigned int vc_scan_lines; /* # of scan lines */
++ unsigned int vc_cell_height; /* CRTC character cell height */
+ unsigned long vc_origin; /* [!] Start of real screen */
+ unsigned long vc_scr_end; /* [!] End of real screen */
+ unsigned long vc_visible_origin; /* [!] Top of visible window */
+diff --git a/kernel/locking/mutex-debug.c b/kernel/locking/mutex-debug.c
+index 9aa713629387c..839df4383799c 100644
+--- a/kernel/locking/mutex-debug.c
++++ b/kernel/locking/mutex-debug.c
+@@ -57,7 +57,7 @@ void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+ task->blocked_on = waiter;
+ }
+
+-void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
++void debug_mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+ struct task_struct *task)
+ {
+ DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
+@@ -65,7 +65,7 @@ void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
+ task->blocked_on = NULL;
+
+- list_del_init(&waiter->list);
++ INIT_LIST_HEAD(&waiter->list);
+ waiter->task = NULL;
+ }
+
+diff --git a/kernel/locking/mutex-debug.h b/kernel/locking/mutex-debug.h
+index 1edd3f45a4ecb..53e631e1d76da 100644
+--- a/kernel/locking/mutex-debug.h
++++ b/kernel/locking/mutex-debug.h
+@@ -22,7 +22,7 @@ extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
+ extern void debug_mutex_add_waiter(struct mutex *lock,
+ struct mutex_waiter *waiter,
+ struct task_struct *task);
+-extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
++extern void debug_mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+ struct task_struct *task);
+ extern void debug_mutex_unlock(struct mutex *lock);
+ extern void debug_mutex_init(struct mutex *lock, const char *name,
+diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
+index b3da782cdfbd7..354151fef06ae 100644
+--- a/kernel/locking/mutex.c
++++ b/kernel/locking/mutex.c
+@@ -177,7 +177,7 @@ static inline bool __mutex_waiter_is_first(struct mutex *lock, struct mutex_wait
+ * Add @waiter to a given location in the lock wait_list and set the
+ * FLAG_WAITERS flag if it's the first waiter.
+ */
+-static void __sched
++static void
+ __mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+ struct list_head *list)
+ {
+@@ -188,6 +188,16 @@ __mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+ __mutex_set_flag(lock, MUTEX_FLAG_WAITERS);
+ }
+
++static void
++__mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter)
++{
++ list_del(&waiter->list);
++ if (likely(list_empty(&lock->wait_list)))
++ __mutex_clear_flag(lock, MUTEX_FLAGS);
++
++ debug_mutex_remove_waiter(lock, waiter, current);
++}
++
+ /*
+ * Give up ownership to a specific task, when @task = NULL, this is equivalent
+ * to a regular unlock. Sets PICKUP on a handoff, clears HANDOF, preserves
+@@ -1040,9 +1050,7 @@ acquired:
+ __ww_mutex_check_waiters(lock, ww_ctx);
+ }
+
+- mutex_remove_waiter(lock, &waiter, current);
+- if (likely(list_empty(&lock->wait_list)))
+- __mutex_clear_flag(lock, MUTEX_FLAGS);
++ __mutex_remove_waiter(lock, &waiter);
+
+ debug_mutex_free_waiter(&waiter);
+
+@@ -1059,7 +1067,7 @@ skip_wait:
+
+ err:
+ __set_current_state(TASK_RUNNING);
+- mutex_remove_waiter(lock, &waiter, current);
++ __mutex_remove_waiter(lock, &waiter);
+ err_early_kill:
+ spin_unlock(&lock->wait_lock);
+ debug_mutex_free_waiter(&waiter);
+diff --git a/kernel/locking/mutex.h b/kernel/locking/mutex.h
+index 1c2287d3fa719..f0c710b1d1927 100644
+--- a/kernel/locking/mutex.h
++++ b/kernel/locking/mutex.h
+@@ -10,12 +10,10 @@
+ * !CONFIG_DEBUG_MUTEXES case. Most of them are NOPs:
+ */
+
+-#define mutex_remove_waiter(lock, waiter, task) \
+- __list_del((waiter)->list.prev, (waiter)->list.next)
+-
+ #define debug_mutex_wake_waiter(lock, waiter) do { } while (0)
+ #define debug_mutex_free_waiter(waiter) do { } while (0)
+ #define debug_mutex_add_waiter(lock, waiter, ti) do { } while (0)
++#define debug_mutex_remove_waiter(lock, waiter, ti) do { } while (0)
+ #define debug_mutex_unlock(lock) do { } while (0)
+ #define debug_mutex_init(lock, name, key) do { } while (0)
+
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index ecdb7402072fa..af74e843221b3 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -163,6 +163,21 @@ void __ptrace_unlink(struct task_struct *child)
+ spin_unlock(&child->sighand->siglock);
+ }
+
++static bool looks_like_a_spurious_pid(struct task_struct *task)
++{
++ if (task->exit_code != ((PTRACE_EVENT_EXEC << 8) | SIGTRAP))
++ return false;
++
++ if (task_pid_vnr(task) == task->ptrace_message)
++ return false;
++ /*
++ * The tracee changed its pid but the PTRACE_EVENT_EXEC event
++ * was not wait()'ed, most probably debugger targets the old
++ * leader which was destroyed in de_thread().
++ */
++ return true;
++}
++
+ /* Ensure that nothing can wake it up, even SIGKILL */
+ static bool ptrace_freeze_traced(struct task_struct *task)
+ {
+@@ -173,7 +188,8 @@ static bool ptrace_freeze_traced(struct task_struct *task)
+ return ret;
+
+ spin_lock_irq(&task->sighand->siglock);
+- if (task_is_traced(task) && !__fatal_signal_pending(task)) {
++ if (task_is_traced(task) && !looks_like_a_spurious_pid(task) &&
++ !__fatal_signal_pending(task)) {
+ task->state = __TASK_TRACED;
+ ret = true;
+ }
+diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
+index cc2f7ca91ccdd..719ae1dff7b4e 100644
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -2703,6 +2703,15 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
+ if (skb->len < sizeof(*key))
+ return SMP_INVALID_PARAMS;
+
++ /* Check if remote and local public keys are the same and debug key is
++ * not in use.
++ */
++ if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
++ !crypto_memneq(key, smp->local_pk, 64)) {
++ bt_dev_err(hdev, "Remote and local public keys are identical");
++ return SMP_UNSPECIFIED;
++ }
++
+ memcpy(smp->remote_pk, key, 64);
+
+ if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) {
+diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig
+index 0cb65d0864cc0..a2ed164d80b49 100644
+--- a/sound/firewire/Kconfig
++++ b/sound/firewire/Kconfig
+@@ -37,7 +37,7 @@ config SND_OXFW
+ * Mackie(Loud) Onyx 1640i (former model)
+ * Mackie(Loud) Onyx Satellite
+ * Mackie(Loud) Tapco Link.Firewire
+- * Mackie(Loud) d.2 pro/d.4 pro
++ * Mackie(Loud) d.4 pro
+ * Mackie(Loud) U.420/U.420d
+ * TASCAM FireOne
+ * Stanton Controllers & Systems 1 Deck/Mixer
+@@ -83,7 +83,7 @@ config SND_BEBOB
+ * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394
+ * BridgeCo RDAudio1/Audio5
+ * Mackie Onyx 1220/1620/1640 (FireWire I/O Card)
+- * Mackie d.2 (FireWire Option)
++ * Mackie d.2 (FireWire Option) and d.2 Pro
+ * Stanton FinalScratch 2 (ScratchAmp)
+ * Tascam IF-FW/DM
+ * Behringer XENIX UFX 1204/1604
+diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
+index 5636e89ce5c75..2bcfeee758538 100644
+--- a/sound/firewire/bebob/bebob.c
++++ b/sound/firewire/bebob/bebob.c
+@@ -414,7 +414,7 @@ static const struct ieee1394_device_id bebob_id_table[] = {
+ SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal),
+ /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */
+ SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal),
+- /* Mackie, d.2 (Firewire Option) */
++ // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in).
+ SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal),
+ /* Stanton, ScratchAmp */
+ SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal),
+diff --git a/sound/firewire/dice/dice-alesis.c b/sound/firewire/dice/dice-alesis.c
+index f5b325263b674..39a4ef8c85430 100644
+--- a/sound/firewire/dice/dice-alesis.c
++++ b/sound/firewire/dice/dice-alesis.c
+@@ -16,7 +16,7 @@ alesis_io14_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = {
+ static const unsigned int
+ alesis_io26_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = {
+ {10, 10, 4}, /* Tx0 = Analog + S/PDIF. */
+- {16, 8, 0}, /* Tx1 = ADAT1 + ADAT2. */
++ {16, 4, 0}, /* Tx1 = ADAT1 + ADAT2 (available at low rate). */
+ };
+
+ int snd_dice_detect_alesis_formats(struct snd_dice *dice)
+diff --git a/sound/firewire/dice/dice-tcelectronic.c b/sound/firewire/dice/dice-tcelectronic.c
+index a8875d24ba2aa..43a3bcb15b3d1 100644
+--- a/sound/firewire/dice/dice-tcelectronic.c
++++ b/sound/firewire/dice/dice-tcelectronic.c
+@@ -38,8 +38,8 @@ static const struct dice_tc_spec konnekt_24d = {
+ };
+
+ static const struct dice_tc_spec konnekt_live = {
+- .tx_pcm_chs = {{16, 16, 16}, {0, 0, 0} },
+- .rx_pcm_chs = {{16, 16, 16}, {0, 0, 0} },
++ .tx_pcm_chs = {{16, 16, 6}, {0, 0, 0} },
++ .rx_pcm_chs = {{16, 16, 6}, {0, 0, 0} },
+ .has_midi = true,
+ };
+
+diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
+index 4ecaf69569dcb..3c9aa797747b0 100644
+--- a/sound/firewire/oxfw/oxfw.c
++++ b/sound/firewire/oxfw/oxfw.c
+@@ -400,7 +400,6 @@ static const struct ieee1394_device_id oxfw_id_table[] = {
+ * Onyx-i series (former models): 0x081216
+ * Mackie Onyx Satellite: 0x00200f
+ * Tapco LINK.firewire 4x6: 0x000460
+- * d.2 pro: Unknown
+ * d.4 pro: Unknown
+ * U.420: Unknown
+ * U.420d: Unknown
+diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c
+index 1eb8b61a185be..d77dcba276b54 100644
+--- a/sound/isa/sb/sb8.c
++++ b/sound/isa/sb/sb8.c
+@@ -111,10 +111,6 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev)
+
+ /* block the 0x388 port to avoid PnP conflicts */
+ acard->fm_res = request_region(0x388, 4, "SoundBlaster FM");
+- if (!acard->fm_res) {
+- err = -EBUSY;
+- goto _err;
+- }
+
+ if (port[dev] != SNDRV_AUTO_PORT) {
+ if ((err = snd_sbdsp_create(card, port[dev], irq[dev],
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c4a9141a449cc..f9ebbee3824bb 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -388,7 +388,6 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0282:
+ case 0x10ec0283:
+ case 0x10ec0286:
+- case 0x10ec0287:
+ case 0x10ec0288:
+ case 0x10ec0285:
+ case 0x10ec0298:
+@@ -399,6 +398,10 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0275:
+ alc_update_coef_idx(codec, 0xe, 0, 1<<0);
+ break;
++ case 0x10ec0287:
++ alc_update_coef_idx(codec, 0x10, 1<<9, 0);
++ alc_write_coef_idx(codec, 0x8, 0x4ab7);
++ break;
+ case 0x10ec0293:
+ alc_update_coef_idx(codec, 0xa, 1<<13, 0);
+ break;
+@@ -7166,12 +7169,19 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x50b8, "Clevo NK50SZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x50d5, "Clevo NP50D5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x50f0, "Clevo NH50A[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x50f2, "Clevo NH50E[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x50f3, "Clevo NH58DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x50f5, "Clevo NH55EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x50f6, "Clevo NH55DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x5101, "Clevo S510WU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x5157, "Clevo W517GU1", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x51a1, "Clevo NS50MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x70f2, "Clevo NH79EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x70f3, "Clevo NH77DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x70f4, "Clevo NH77EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x70f6, "Clevo NH77DPQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8228, "Clevo NR40BU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8520, "Clevo NH50D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8521, "Clevo NH77D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+@@ -7189,9 +7199,17 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x8a51, "Clevo NH70RCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8d50, "Clevo NH55RCQ-M", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x951d, "Clevo N950T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x9600, "Clevo N960K[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x961d, "Clevo N960S[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL53RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0xa600, "Clevo NL5XNU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0xb022, "Clevo NH77D[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0xc018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0xc019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0xc022, "Clevo NH77[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
+ SND_PCI_QUIRK(0x17aa, 0x1048, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index 18b436e7a2cc1..2163fd6dce664 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -705,6 +705,10 @@ static int line6_init_cap_control(struct usb_line6 *line6)
+ line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL);
+ if (!line6->buffer_message)
+ return -ENOMEM;
++
++ ret = line6_init_midi(line6);
++ if (ret < 0)
++ return ret;
+ } else {
+ ret = line6_hwdep_init(line6);
+ if (ret < 0)
+diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c
+index 020c81818951d..dff8e7d5f3050 100644
+--- a/sound/usb/line6/pod.c
++++ b/sound/usb/line6/pod.c
+@@ -420,11 +420,6 @@ static int pod_init(struct usb_line6 *line6,
+ if (err < 0)
+ return err;
+
+- /* initialize MIDI subsystem: */
+- err = line6_init_midi(line6);
+- if (err < 0)
+- return err;
+-
+ /* initialize PCM subsystem: */
+ err = line6_init_pcm(line6, &pod_pcm_properties);
+ if (err < 0)
+diff --git a/sound/usb/line6/variax.c b/sound/usb/line6/variax.c
+index e8c852b2ce350..163a08a8244d7 100644
+--- a/sound/usb/line6/variax.c
++++ b/sound/usb/line6/variax.c
+@@ -217,7 +217,6 @@ static int variax_init(struct usb_line6 *line6,
+ const struct usb_device_id *id)
+ {
+ struct usb_line6_variax *variax = (struct usb_line6_variax *) line6;
+- int err;
+
+ line6->process_message = line6_variax_process_message;
+ line6->disconnect = line6_variax_disconnect;
+@@ -233,11 +232,6 @@ static int variax_init(struct usb_line6 *line6,
+ if (variax->buffer_activate == NULL)
+ return -ENOMEM;
+
+- /* initialize MIDI subsystem: */
+- err = line6_init_midi(&variax->line6);
+- if (err < 0)
+- return err;
+-
+ /* initiate startup procedure: */
+ variax_startup1(variax);
+ return 0;
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 4553db0ef0841..1ac8c84c3369a 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1890,8 +1890,12 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi,
+ ms_ep = find_usb_ms_endpoint_descriptor(hostep);
+ if (!ms_ep)
+ continue;
++ if (ms_ep->bLength <= sizeof(*ms_ep))
++ continue;
+ if (ms_ep->bNumEmbMIDIJack > 0x10)
+ continue;
++ if (ms_ep->bLength < sizeof(*ms_ep) + ms_ep->bNumEmbMIDIJack)
++ continue;
+ if (usb_endpoint_dir_out(ep)) {
+ if (endpoints[epidx].out_ep) {
+ if (++epidx >= MIDI_MAX_ENDPOINTS) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-06-03 10:32 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-06-03 10:32 UTC (permalink / raw
To: gentoo-commits
commit: 050be68ee8c0b57473adf52cd98ffef922a49596
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 3 10:32:31 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Thu Jun 3 10:32:43 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=050be68e
Linux patch 4.19.193
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1192_linux-4.19.193.patch | 4207 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4211 insertions(+)
diff --git a/0000_README b/0000_README
index a935472..757010f 100644
--- a/0000_README
+++ b/0000_README
@@ -807,6 +807,10 @@ Patch: 1191_linux-4.19.192.patch
From: https://www.kernel.org
Desc: Linux 4.19.192
+Patch: 1192_linux-4.19.193.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.193
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1192_linux-4.19.193.patch b/1192_linux-4.19.193.patch
new file mode 100644
index 0000000..866e21f
--- /dev/null
+++ b/1192_linux-4.19.193.patch
@@ -0,0 +1,4207 @@
+diff --git a/Makefile b/Makefile
+index 51ee6da4c1ab5..e5d41b6792d7f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 192
++SUBLEVEL = 193
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/alchemy/board-xxs1500.c b/arch/mips/alchemy/board-xxs1500.c
+index 5f05b8714385d..b968cff5baa77 100644
+--- a/arch/mips/alchemy/board-xxs1500.c
++++ b/arch/mips/alchemy/board-xxs1500.c
+@@ -31,6 +31,7 @@
+ #include <asm/reboot.h>
+ #include <asm/setup.h>
+ #include <asm/mach-au1x00/au1000.h>
++#include <asm/mach-au1x00/gpio-au1000.h>
+ #include <prom.h>
+
+ const char *get_system_type(void)
+diff --git a/arch/mips/ralink/of.c b/arch/mips/ralink/of.c
+index 1ada8492733b6..92b3d48499967 100644
+--- a/arch/mips/ralink/of.c
++++ b/arch/mips/ralink/of.c
+@@ -10,6 +10,7 @@
+
+ #include <linux/io.h>
+ #include <linux/clk.h>
++#include <linux/export.h>
+ #include <linux/init.h>
+ #include <linux/sizes.h>
+ #include <linux/of_fdt.h>
+@@ -27,6 +28,7 @@
+
+ __iomem void *rt_sysc_membase;
+ __iomem void *rt_memc_membase;
++EXPORT_SYMBOL_GPL(rt_sysc_membase);
+
+ __iomem void *plat_of_remap_node(const char *node)
+ {
+diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
+new file mode 100644
+index 0000000000000..7538294721bed
+--- /dev/null
++++ b/arch/openrisc/include/asm/barrier.h
+@@ -0,0 +1,9 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __ASM_BARRIER_H
++#define __ASM_BARRIER_H
++
++#define mb() asm volatile ("l.msync" ::: "memory")
++
++#include <asm-generic/barrier.h>
++
++#endif /* __ASM_BARRIER_H */
+diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
+index c0732f0322484..68f02318cee32 100644
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -975,6 +975,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
+ if (ACPI_SUCCESS(status)) {
+ hdp->hd_phys_address = addr.address.minimum;
+ hdp->hd_address = ioremap(addr.address.minimum, addr.address.address_length);
++ if (!hdp->hd_address)
++ return AE_ERROR;
+
+ if (hpet_is_known(hdp)) {
+ iounmap(hdp->hd_address);
+@@ -988,6 +990,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
+ hdp->hd_phys_address = fixmem32->address;
+ hdp->hd_address = ioremap(fixmem32->address,
+ HPET_RANGE_SIZE);
++ if (!hdp->hd_address)
++ return AE_ERROR;
+
+ if (hpet_is_known(hdp)) {
+ iounmap(hdp->hd_address);
+diff --git a/drivers/dma/qcom/hidma_mgmt.c b/drivers/dma/qcom/hidma_mgmt.c
+index d64edeb6771a9..f9640e37b1397 100644
+--- a/drivers/dma/qcom/hidma_mgmt.c
++++ b/drivers/dma/qcom/hidma_mgmt.c
+@@ -423,6 +423,20 @@ static int __init hidma_mgmt_init(void)
+ hidma_mgmt_of_populate_channels(child);
+ }
+ #endif
++ /*
++ * We do not check for return value here, as it is assumed that
++ * platform_driver_register must not fail. The reason for this is that
++ * the (potential) hidma_mgmt_of_populate_channels calls above are not
++ * cleaned up if it does fail, and to do this work is quite
++ * complicated. In particular, various calls of of_address_to_resource,
++ * of_irq_to_resource, platform_device_register_full, of_dma_configure,
++ * and of_msi_configure which then call other functions and so on, must
++ * be cleaned up - this is not a trivial exercise.
++ *
++ * Currently, this module is not intended to be unloaded, and there is
++ * no module_exit function defined which does the needed cleanup. For
++ * this reason, we have to assume success here.
++ */
+ platform_driver_register(&hidma_mgmt_driver);
+
+ return 0;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+index 69c5d22f29bdf..d55ff59584c82 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+@@ -297,10 +297,13 @@ out:
+ static int amdgpu_fbdev_destroy(struct drm_device *dev, struct amdgpu_fbdev *rfbdev)
+ {
+ struct amdgpu_framebuffer *rfb = &rfbdev->rfb;
++ int i;
+
+ drm_fb_helper_unregister_fbi(&rfbdev->helper);
+
+ if (rfb->base.obj[0]) {
++ for (i = 0; i < rfb->base.format->num_planes; i++)
++ drm_gem_object_put(rfb->base.obj[0]);
+ amdgpufb_destroy_pinned_object(rfb->base.obj[0]);
+ rfb->base.obj[0] = NULL;
+ drm_framebuffer_unregister_private(&rfb->base);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+index 757fa486aac41..50807d621ecac 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -1277,6 +1277,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm)
+ if (gtt && gtt->userptr) {
+ amdgpu_ttm_tt_set_user_pages(ttm, NULL);
+ kfree(ttm->sg);
++ ttm->sg = NULL;
+ ttm->page_flags &= ~TTM_PAGE_FLAG_SG;
+ return;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index e3bedf4cc9c03..c9c81090d580a 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -768,6 +768,24 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
+ dc_is_dvi_signal(link->connector_signal)) {
+ if (prev_sink != NULL)
+ dc_sink_release(prev_sink);
++ link_disconnect_sink(link);
++
++ return false;
++ }
++ /*
++ * Abort detection for DP connectors if we have
++ * no EDID and connector is active converter
++ * as there are no display downstream
++ *
++ */
++ if (dc_is_dp_sst_signal(link->connector_signal) &&
++ (link->dpcd_caps.dongle_type ==
++ DISPLAY_DONGLE_DP_VGA_CONVERTER ||
++ link->dpcd_caps.dongle_type ==
++ DISPLAY_DONGLE_DP_DVI_CONVERTER)) {
++ if (prev_sink)
++ dc_sink_release(prev_sink);
++ link_disconnect_sink(link);
+
+ return false;
+ }
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 25b06771f2387..1887473cdd79c 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -387,11 +387,12 @@ static int meson_probe_remote(struct platform_device *pdev,
+ static void meson_drv_shutdown(struct platform_device *pdev)
+ {
+ struct meson_drm *priv = dev_get_drvdata(&pdev->dev);
+- struct drm_device *drm = priv->drm;
+
+- DRM_DEBUG_DRIVER("\n");
+- drm_kms_helper_poll_fini(drm);
+- drm_atomic_helper_shutdown(drm);
++ if (!priv)
++ return;
++
++ drm_kms_helper_poll_fini(priv->drm);
++ drm_atomic_helper_shutdown(priv->drm);
+ }
+
+ static int meson_drv_probe(struct platform_device *pdev)
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 3ac3b26cc9317..efafd028c5d16 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -384,11 +384,9 @@ static int i801_check_post(struct i801_priv *priv, int status)
+ dev_err(&priv->pci_dev->dev, "Transaction timeout\n");
+ /* try to stop the current command */
+ dev_dbg(&priv->pci_dev->dev, "Terminating the current operation\n");
+- outb_p(inb_p(SMBHSTCNT(priv)) | SMBHSTCNT_KILL,
+- SMBHSTCNT(priv));
++ outb_p(SMBHSTCNT_KILL, SMBHSTCNT(priv));
+ usleep_range(1000, 2000);
+- outb_p(inb_p(SMBHSTCNT(priv)) & (~SMBHSTCNT_KILL),
+- SMBHSTCNT(priv));
++ outb_p(0, SMBHSTCNT(priv));
+
+ /* Check if it worked */
+ status = inb_p(SMBHSTSTS(priv));
+diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
+index 2f2e28d60ef52..d3603e261a847 100644
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -493,7 +493,10 @@ static int i2c_s3c_irq_nextbyte(struct s3c24xx_i2c *i2c, unsigned long iicstat)
+ * forces us to send a new START
+ * when we change direction
+ */
++ dev_dbg(i2c->dev,
++ "missing START before write->read\n");
+ s3c24xx_i2c_stop(i2c, -EINVAL);
++ break;
+ }
+
+ goto retry_write;
+diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
+index 23a6e7baa396b..b5952ee3031c7 100644
+--- a/drivers/iio/adc/ad7793.c
++++ b/drivers/iio/adc/ad7793.c
+@@ -279,6 +279,7 @@ static int ad7793_setup(struct iio_dev *indio_dev,
+ id &= AD7793_ID_MASK;
+
+ if (id != st->chip_info->id) {
++ ret = -ENODEV;
+ dev_err(&st->sd.spi->dev, "device ID query failed\n");
+ goto out;
+ }
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 3f0c2c1ef0cb2..bc565f8e8ac2b 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1119,7 +1119,7 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
+
+ err = iommu_device_register(&iommu->iommu);
+ if (err)
+- goto err_unmap;
++ goto err_sysfs;
+ }
+
+ drhd->iommu = iommu;
+@@ -1127,6 +1127,8 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
+
+ return 0;
+
++err_sysfs:
++ iommu_device_sysfs_remove(&iommu->iommu);
+ err_unmap:
+ unmap_iommu(iommu);
+ error_free_seq_id:
+diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
+index 3e01012be4abc..95a0d728eecc5 100644
+--- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c
++++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
+@@ -645,17 +645,19 @@ static void
+ release_io(struct inf_hw *hw)
+ {
+ if (hw->cfg.mode) {
+- if (hw->cfg.p) {
++ if (hw->cfg.mode == AM_MEMIO) {
+ release_mem_region(hw->cfg.start, hw->cfg.size);
+- iounmap(hw->cfg.p);
++ if (hw->cfg.p)
++ iounmap(hw->cfg.p);
+ } else
+ release_region(hw->cfg.start, hw->cfg.size);
+ hw->cfg.mode = AM_NONE;
+ }
+ if (hw->addr.mode) {
+- if (hw->addr.p) {
++ if (hw->addr.mode == AM_MEMIO) {
+ release_mem_region(hw->addr.start, hw->addr.size);
+- iounmap(hw->addr.p);
++ if (hw->addr.p)
++ iounmap(hw->addr.p);
+ } else
+ release_region(hw->addr.start, hw->addr.size);
+ hw->addr.mode = AM_NONE;
+@@ -685,9 +687,12 @@ setup_io(struct inf_hw *hw)
+ (ulong)hw->cfg.start, (ulong)hw->cfg.size);
+ return err;
+ }
+- if (hw->ci->cfg_mode == AM_MEMIO)
+- hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size);
+ hw->cfg.mode = hw->ci->cfg_mode;
++ if (hw->ci->cfg_mode == AM_MEMIO) {
++ hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size);
++ if (!hw->cfg.p)
++ return -ENOMEM;
++ }
+ if (debug & DEBUG_HW)
+ pr_notice("%s: IO cfg %lx (%lu bytes) mode%d\n",
+ hw->name, (ulong)hw->cfg.start,
+@@ -712,9 +717,12 @@ setup_io(struct inf_hw *hw)
+ (ulong)hw->addr.start, (ulong)hw->addr.size);
+ return err;
+ }
+- if (hw->ci->addr_mode == AM_MEMIO)
+- hw->addr.p = ioremap(hw->addr.start, hw->addr.size);
+ hw->addr.mode = hw->ci->addr_mode;
++ if (hw->ci->addr_mode == AM_MEMIO) {
++ hw->addr.p = ioremap(hw->addr.start, hw->addr.size);
++ if (!hw->addr.p)
++ return -ENOMEM;
++ }
+ if (debug & DEBUG_HW)
+ pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n",
+ hw->name, (ulong)hw->addr.start,
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index 7d96836294713..52101e5c72588 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -794,7 +794,7 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new)
+ static uint32_t __minimum_chunk_size(struct origin *o)
+ {
+ struct dm_snapshot *snap;
+- unsigned chunk_size = 0;
++ unsigned chunk_size = rounddown_pow_of_two(UINT_MAX);
+
+ if (o)
+ list_for_each_entry(snap, &o->snapshots, list)
+diff --git a/drivers/media/dvb-frontends/sp8870.c b/drivers/media/dvb-frontends/sp8870.c
+index 8d31cf3f4f078..3a577788041d5 100644
+--- a/drivers/media/dvb-frontends/sp8870.c
++++ b/drivers/media/dvb-frontends/sp8870.c
+@@ -293,7 +293,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe)
+ sp8870_writereg(state, 0xc05, reg0xc05);
+
+ // read status reg in order to clear pending irqs
+- sp8870_readreg(state, 0x200);
++ err = sp8870_readreg(state, 0x200);
++ if (err < 0)
++ return err;
+
+ // system controller start
+ sp8870_microcontroller_start(state);
+diff --git a/drivers/media/usb/gspca/m5602/m5602_po1030.c b/drivers/media/usb/gspca/m5602/m5602_po1030.c
+index 37d2891e5f5b6..81d8eb72ac41c 100644
+--- a/drivers/media/usb/gspca/m5602/m5602_po1030.c
++++ b/drivers/media/usb/gspca/m5602/m5602_po1030.c
+@@ -159,6 +159,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = {
+ int po1030_probe(struct sd *sd)
+ {
+ u8 dev_id_h = 0, i;
++ int err;
+ struct gspca_dev *gspca_dev = (struct gspca_dev *)sd;
+
+ if (force_sensor) {
+@@ -177,10 +178,13 @@ int po1030_probe(struct sd *sd)
+ for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) {
+ u8 data = preinit_po1030[i][2];
+ if (preinit_po1030[i][0] == SENSOR)
+- m5602_write_sensor(sd,
+- preinit_po1030[i][1], &data, 1);
++ err = m5602_write_sensor(sd, preinit_po1030[i][1],
++ &data, 1);
+ else
+- m5602_write_bridge(sd, preinit_po1030[i][1], data);
++ err = m5602_write_bridge(sd, preinit_po1030[i][1],
++ data);
++ if (err < 0)
++ return err;
+ }
+
+ if (m5602_read_sensor(sd, PO1030_DEVID_H, &dev_id_h, 1))
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index f2cfc96194250..49e08b6133f50 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -112,8 +112,9 @@
+ printk(KERN_INFO a); \
+ } while (0)
+ #define v2printk(a...) do { \
+- if (verbose > 1) \
++ if (verbose > 1) { \
+ printk(KERN_INFO a); \
++ } \
+ touch_nmi_watchdog(); \
+ } while (0)
+ #define eprintk(a...) do { \
+diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h
+index c439c827eea80..0ef759671b546 100644
+--- a/drivers/misc/lis3lv02d/lis3lv02d.h
++++ b/drivers/misc/lis3lv02d/lis3lv02d.h
+@@ -284,6 +284,7 @@ struct lis3lv02d {
+ int regs_size;
+ u8 *reg_cache;
+ bool regs_stored;
++ bool init_required;
+ u8 odr_mask; /* ODR bit mask */
+ u8 whoami; /* indicates measurement precision */
+ s16 (*read_data) (struct lis3lv02d *lis3, int reg);
+diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
+index 5a661cbdf2aef..66f4d12d00602 100644
+--- a/drivers/misc/mei/interrupt.c
++++ b/drivers/misc/mei/interrupt.c
+@@ -224,6 +224,9 @@ static int mei_cl_irq_read(struct mei_cl *cl, struct mei_cl_cb *cb,
+ return ret;
+ }
+
++ pm_runtime_mark_last_busy(dev->dev);
++ pm_request_autosuspend(dev->dev);
++
+ list_move_tail(&cb->list, &cl->rd_pending);
+
+ return 0;
+diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
+index a0f954f36c09f..94d5ce9419ca6 100644
+--- a/drivers/net/caif/caif_serial.c
++++ b/drivers/net/caif/caif_serial.c
+@@ -279,7 +279,6 @@ static int caif_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ser_device *ser;
+
+- BUG_ON(dev == NULL);
+ ser = netdev_priv(dev);
+
+ /* Send flow off once, on high water mark */
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 616afd81536af..6335c4ea09577 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -851,14 +851,6 @@ mt7530_port_set_vlan_aware(struct dsa_switch *ds, int port)
+ {
+ struct mt7530_priv *priv = ds->priv;
+
+- /* The real fabric path would be decided on the membership in the
+- * entry of VLAN table. PCR_MATRIX set up here with ALL_MEMBERS
+- * means potential VLAN can be consisting of certain subset of all
+- * ports.
+- */
+- mt7530_rmw(priv, MT7530_PCR_P(port),
+- PCR_MATRIX_MASK, PCR_MATRIX(MT7530_ALL_MEMBERS));
+-
+ /* Trapped into security mode allows packet forwarding through VLAN
+ * table lookup. CPU port is set to fallback mode to let untagged
+ * frames pass through.
+diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
+index 122fdb80a7899..9993f1162ac68 100644
+--- a/drivers/net/ethernet/broadcom/bnx2.c
++++ b/drivers/net/ethernet/broadcom/bnx2.c
+@@ -8253,9 +8253,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
+ BNX2_WR(bp, PCI_COMMAND, reg);
+ } else if ((BNX2_CHIP_ID(bp) == BNX2_CHIP_ID_5706_A1) &&
+ !(bp->flags & BNX2_FLAG_PCIX)) {
+-
+ dev_err(&pdev->dev,
+ "5706 A1 can only be used in a PCIX bus, aborting\n");
++ rc = -EPERM;
+ goto err_out_unmap;
+ }
+
+diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
+index ea5f32ea308a9..1e25c3b5f563b 100644
+--- a/drivers/net/ethernet/brocade/bna/bnad.c
++++ b/drivers/net/ethernet/brocade/bna/bnad.c
+@@ -3290,7 +3290,7 @@ bnad_change_mtu(struct net_device *netdev, int new_mtu)
+ {
+ int err, mtu;
+ struct bnad *bnad = netdev_priv(netdev);
+- u32 rx_count = 0, frame, new_frame;
++ u32 frame, new_frame;
+
+ mutex_lock(&bnad->conf_mutex);
+
+@@ -3306,12 +3306,9 @@ bnad_change_mtu(struct net_device *netdev, int new_mtu)
+ /* only when transition is over 4K */
+ if ((frame <= 4096 && new_frame > 4096) ||
+ (frame > 4096 && new_frame <= 4096))
+- rx_count = bnad_reinit_rx(bnad);
++ bnad_reinit_rx(bnad);
+ }
+
+- /* rx_count > 0 - new rx created
+- * - Linux set err = 0 and return
+- */
+ err = bnad_mtu_set(bnad, new_frame);
+ if (err)
+ err = -EBUSY;
+diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
+index f16853c3c851a..c813e6f2b371e 100644
+--- a/drivers/net/ethernet/dec/tulip/de4x5.c
++++ b/drivers/net/ethernet/dec/tulip/de4x5.c
+@@ -4927,11 +4927,11 @@ mii_get_oui(u_char phyaddr, u_long ioaddr)
+ u_char breg[2];
+ } a;
+ int i, r2, r3, ret=0;*/
+- int r2, r3;
++ int r2;
+
+ /* Read r2 and r3 */
+ r2 = mii_rd(MII_ID0, phyaddr, ioaddr);
+- r3 = mii_rd(MII_ID1, phyaddr, ioaddr);
++ mii_rd(MII_ID1, phyaddr, ioaddr);
+ /* SEEQ and Cypress way * /
+ / * Shuffle r2 and r3 * /
+ a.reg=0;
+diff --git a/drivers/net/ethernet/dec/tulip/media.c b/drivers/net/ethernet/dec/tulip/media.c
+index dcf21a36a9cf4..011604787b8ed 100644
+--- a/drivers/net/ethernet/dec/tulip/media.c
++++ b/drivers/net/ethernet/dec/tulip/media.c
+@@ -319,13 +319,8 @@ void tulip_select_media(struct net_device *dev, int startup)
+ break;
+ }
+ case 5: case 6: {
+- u16 setup[5];
+-
+ new_csr6 = 0; /* FIXME */
+
+- for (i = 0; i < 5; i++)
+- setup[i] = get_u16(&p[i*2 + 1]);
+-
+ if (startup && mtable->has_reset) {
+ struct medialeaf *rleaf = &mtable->mleaf[mtable->has_reset];
+ unsigned char *rst = rleaf->leafdata;
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 7d1a669416f20..6b9eada1feb21 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3221,7 +3221,9 @@ static int fec_enet_init(struct net_device *ndev)
+ return ret;
+ }
+
+- fec_enet_alloc_queue(ndev);
++ ret = fec_enet_alloc_queue(ndev);
++ if (ret)
++ return ret;
+
+ bd_size = (fep->total_tx_ring_size + fep->total_rx_ring_size) * dsize;
+
+@@ -3229,7 +3231,8 @@ static int fec_enet_init(struct net_device *ndev)
+ cbd_base = dmam_alloc_coherent(&fep->pdev->dev, bd_size, &bd_dma,
+ GFP_KERNEL);
+ if (!cbd_base) {
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto free_queue_mem;
+ }
+
+ memset(cbd_base, 0, bd_size);
+@@ -3309,6 +3312,10 @@ static int fec_enet_init(struct net_device *ndev)
+ fec_enet_update_ethtool_stats(ndev);
+
+ return 0;
++
++free_queue_mem:
++ fec_enet_free_queue(ndev);
++ return ret;
+ }
+
+ #ifdef CONFIG_OF
+diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
+index a69cd19a55ae2..b8fc9bbeca2c7 100644
+--- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
++++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
+@@ -547,6 +547,11 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id)
+ return -1;
+
+ base = ioremap(link->resource[2]->start, resource_size(link->resource[2]));
++ if (!base) {
++ pcmcia_release_window(link, link->resource[2]);
++ return -1;
++ }
++
+ pcmcia_map_mem_page(link, link->resource[2], 0);
+
+ /*
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 3b89673f09daf..19165a3548bfd 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -702,8 +702,6 @@ static bool hns3_tunnel_csum_bug(struct sk_buff *skb)
+ if (!(!skb->encapsulation && l4.udp->dest == htons(IANA_VXLAN_PORT)))
+ return false;
+
+- skb_checksum_help(skb);
+-
+ return true;
+ }
+
+@@ -764,8 +762,7 @@ static int hns3_set_l3l4_type_csum(struct sk_buff *skb, u8 ol4_proto,
+ /* the stack computes the IP header already,
+ * driver calculate l4 checksum when not TSO.
+ */
+- skb_checksum_help(skb);
+- return 0;
++ return skb_checksum_help(skb);
+ }
+
+ l3.hdr = skb_inner_network_header(skb);
+@@ -796,7 +793,7 @@ static int hns3_set_l3l4_type_csum(struct sk_buff *skb, u8 ol4_proto,
+ break;
+ case IPPROTO_UDP:
+ if (hns3_tunnel_csum_bug(skb))
+- break;
++ return skb_checksum_help(skb);
+
+ hnae3_set_bit(*type_cs_vlan_tso, HNS3_TXD_L4CS_B, 1);
+ hnae3_set_field(*type_cs_vlan_tso,
+@@ -821,8 +818,7 @@ static int hns3_set_l3l4_type_csum(struct sk_buff *skb, u8 ol4_proto,
+ /* the stack computes the IP header already,
+ * driver calculate l4 checksum when not TSO.
+ */
+- skb_checksum_help(skb);
+- return 0;
++ return skb_checksum_help(skb);
+ }
+
+ return 0;
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+index f6ffd9fb20793..8aaf856771d7b 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+@@ -467,12 +467,16 @@ static int ixgbe_set_vf_vlan(struct ixgbe_adapter *adapter, int add, int vid,
+ return err;
+ }
+
+-static s32 ixgbe_set_vf_lpe(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf)
++static int ixgbe_set_vf_lpe(struct ixgbe_adapter *adapter, u32 max_frame, u32 vf)
+ {
+ struct ixgbe_hw *hw = &adapter->hw;
+- int max_frame = msgbuf[1];
+ u32 max_frs;
+
++ if (max_frame < ETH_MIN_MTU || max_frame > IXGBE_MAX_JUMBO_FRAME_SIZE) {
++ e_err(drv, "VF max_frame %d out of range\n", max_frame);
++ return -EINVAL;
++ }
++
+ /*
+ * For 82599EB we have to keep all PFs and VFs operating with
+ * the same max_frame value in order to avoid sending an oversize
+@@ -532,12 +536,6 @@ static s32 ixgbe_set_vf_lpe(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf)
+ }
+ }
+
+- /* MTU < 68 is an error and causes problems on some kernels */
+- if (max_frame > IXGBE_MAX_JUMBO_FRAME_SIZE) {
+- e_err(drv, "VF max_frame %d out of range\n", max_frame);
+- return -EINVAL;
+- }
+-
+ /* pull current max frame size from hardware */
+ max_frs = IXGBE_READ_REG(hw, IXGBE_MAXFRS);
+ max_frs &= IXGBE_MHADD_MFS_MASK;
+@@ -1240,7 +1238,7 @@ static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf)
+ retval = ixgbe_set_vf_vlan_msg(adapter, msgbuf, vf);
+ break;
+ case IXGBE_VF_SET_LPE:
+- retval = ixgbe_set_vf_lpe(adapter, msgbuf, vf);
++ retval = ixgbe_set_vf_lpe(adapter, msgbuf[1], vf);
+ break;
+ case IXGBE_VF_SET_MACVLAN:
+ retval = ixgbe_set_vf_macvlan_msg(adapter, msgbuf, vf);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+index 7a99eb1572fd9..6a005014d46af 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -2011,8 +2011,6 @@ static int mlx4_en_set_tunable(struct net_device *dev,
+ return ret;
+ }
+
+-#define MLX4_EEPROM_PAGE_LEN 256
+-
+ static int mlx4_en_get_module_info(struct net_device *dev,
+ struct ethtool_modinfo *modinfo)
+ {
+@@ -2047,7 +2045,7 @@ static int mlx4_en_get_module_info(struct net_device *dev,
+ break;
+ case MLX4_MODULE_ID_SFP:
+ modinfo->type = ETH_MODULE_SFF_8472;
+- modinfo->eeprom_len = MLX4_EEPROM_PAGE_LEN;
++ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
+ break;
+ default:
+ return -EINVAL;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+index 29041d4a3f28e..6517e53da520d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+@@ -862,6 +862,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
+ struct mlx4_en_tx_desc *tx_desc;
+ struct mlx4_wqe_data_seg *data;
+ struct mlx4_en_tx_info *tx_info;
++ u32 __maybe_unused ring_cons;
+ int tx_ind;
+ int nr_txbb;
+ int desc_size;
+@@ -875,7 +876,6 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
+ bool stop_queue;
+ bool inline_ok;
+ u8 data_offset;
+- u32 ring_cons;
+ bool bf_ok;
+
+ tx_ind = skb_get_queue_mapping(skb);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
+index ba6ac31a339dc..256a06b3c096b 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/port.c
++++ b/drivers/net/ethernet/mellanox/mlx4/port.c
+@@ -1973,6 +1973,7 @@ EXPORT_SYMBOL(mlx4_get_roce_gid_from_slave);
+ #define I2C_ADDR_LOW 0x50
+ #define I2C_ADDR_HIGH 0x51
+ #define I2C_PAGE_SIZE 256
++#define I2C_HIGH_PAGE_SIZE 128
+
+ /* Module Info Data */
+ struct mlx4_cable_info {
+@@ -2026,6 +2027,88 @@ static inline const char *cable_info_mad_err_str(u16 mad_status)
+ return "Unknown Error";
+ }
+
++static int mlx4_get_module_id(struct mlx4_dev *dev, u8 port, u8 *module_id)
++{
++ struct mlx4_cmd_mailbox *inbox, *outbox;
++ struct mlx4_mad_ifc *inmad, *outmad;
++ struct mlx4_cable_info *cable_info;
++ int ret;
++
++ inbox = mlx4_alloc_cmd_mailbox(dev);
++ if (IS_ERR(inbox))
++ return PTR_ERR(inbox);
++
++ outbox = mlx4_alloc_cmd_mailbox(dev);
++ if (IS_ERR(outbox)) {
++ mlx4_free_cmd_mailbox(dev, inbox);
++ return PTR_ERR(outbox);
++ }
++
++ inmad = (struct mlx4_mad_ifc *)(inbox->buf);
++ outmad = (struct mlx4_mad_ifc *)(outbox->buf);
++
++ inmad->method = 0x1; /* Get */
++ inmad->class_version = 0x1;
++ inmad->mgmt_class = 0x1;
++ inmad->base_version = 0x1;
++ inmad->attr_id = cpu_to_be16(0xFF60); /* Module Info */
++
++ cable_info = (struct mlx4_cable_info *)inmad->data;
++ cable_info->dev_mem_address = 0;
++ cable_info->page_num = 0;
++ cable_info->i2c_addr = I2C_ADDR_LOW;
++ cable_info->size = cpu_to_be16(1);
++
++ ret = mlx4_cmd_box(dev, inbox->dma, outbox->dma, port, 3,
++ MLX4_CMD_MAD_IFC, MLX4_CMD_TIME_CLASS_C,
++ MLX4_CMD_NATIVE);
++ if (ret)
++ goto out;
++
++ if (be16_to_cpu(outmad->status)) {
++ /* Mad returned with bad status */
++ ret = be16_to_cpu(outmad->status);
++ mlx4_warn(dev,
++ "MLX4_CMD_MAD_IFC Get Module ID attr(%x) port(%d) i2c_addr(%x) offset(%d) size(%d): Response Mad Status(%x) - %s\n",
++ 0xFF60, port, I2C_ADDR_LOW, 0, 1, ret,
++ cable_info_mad_err_str(ret));
++ ret = -ret;
++ goto out;
++ }
++ cable_info = (struct mlx4_cable_info *)outmad->data;
++ *module_id = cable_info->data[0];
++out:
++ mlx4_free_cmd_mailbox(dev, inbox);
++ mlx4_free_cmd_mailbox(dev, outbox);
++ return ret;
++}
++
++static void mlx4_sfp_eeprom_params_set(u8 *i2c_addr, u8 *page_num, u16 *offset)
++{
++ *i2c_addr = I2C_ADDR_LOW;
++ *page_num = 0;
++
++ if (*offset < I2C_PAGE_SIZE)
++ return;
++
++ *i2c_addr = I2C_ADDR_HIGH;
++ *offset -= I2C_PAGE_SIZE;
++}
++
++static void mlx4_qsfp_eeprom_params_set(u8 *i2c_addr, u8 *page_num, u16 *offset)
++{
++ /* Offsets 0-255 belong to page 0.
++ * Offsets 256-639 belong to pages 01, 02, 03.
++ * For example, offset 400 is page 02: 1 + (400 - 256) / 128 = 2
++ */
++ if (*offset < I2C_PAGE_SIZE)
++ *page_num = 0;
++ else
++ *page_num = 1 + (*offset - I2C_PAGE_SIZE) / I2C_HIGH_PAGE_SIZE;
++ *i2c_addr = I2C_ADDR_LOW;
++ *offset -= *page_num * I2C_HIGH_PAGE_SIZE;
++}
++
+ /**
+ * mlx4_get_module_info - Read cable module eeprom data
+ * @dev: mlx4_dev.
+@@ -2045,12 +2128,30 @@ int mlx4_get_module_info(struct mlx4_dev *dev, u8 port,
+ struct mlx4_cmd_mailbox *inbox, *outbox;
+ struct mlx4_mad_ifc *inmad, *outmad;
+ struct mlx4_cable_info *cable_info;
+- u16 i2c_addr;
++ u8 module_id, i2c_addr, page_num;
+ int ret;
+
+ if (size > MODULE_INFO_MAX_READ)
+ size = MODULE_INFO_MAX_READ;
+
++ ret = mlx4_get_module_id(dev, port, &module_id);
++ if (ret)
++ return ret;
++
++ switch (module_id) {
++ case MLX4_MODULE_ID_SFP:
++ mlx4_sfp_eeprom_params_set(&i2c_addr, &page_num, &offset);
++ break;
++ case MLX4_MODULE_ID_QSFP:
++ case MLX4_MODULE_ID_QSFP_PLUS:
++ case MLX4_MODULE_ID_QSFP28:
++ mlx4_qsfp_eeprom_params_set(&i2c_addr, &page_num, &offset);
++ break;
++ default:
++ mlx4_err(dev, "Module ID not recognized: %#x\n", module_id);
++ return -EINVAL;
++ }
++
+ inbox = mlx4_alloc_cmd_mailbox(dev);
+ if (IS_ERR(inbox))
+ return PTR_ERR(inbox);
+@@ -2076,11 +2177,9 @@ int mlx4_get_module_info(struct mlx4_dev *dev, u8 port,
+ */
+ size -= offset + size - I2C_PAGE_SIZE;
+
+- i2c_addr = I2C_ADDR_LOW;
+-
+ cable_info = (struct mlx4_cable_info *)inmad->data;
+ cable_info->dev_mem_address = cpu_to_be16(offset);
+- cable_info->page_num = 0;
++ cable_info->page_num = page_num;
+ cable_info->i2c_addr = i2c_addr;
+ cable_info->size = cpu_to_be16(size);
+
+diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
+index ebbdfb9087451..623a05d78343d 100644
+--- a/drivers/net/ethernet/micrel/ksz884x.c
++++ b/drivers/net/ethernet/micrel/ksz884x.c
+@@ -1657,8 +1657,7 @@ static inline void set_tx_len(struct ksz_desc *desc, u32 len)
+
+ #define HW_DELAY(hw, reg) \
+ do { \
+- u16 dummy; \
+- dummy = readw(hw->io + reg); \
++ readw(hw->io + reg); \
+ } while (0)
+
+ /**
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index df4519c04ba07..0d681714878b1 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -156,9 +156,8 @@ static void lan743x_tx_isr(void *context, u32 int_sts, u32 flags)
+ struct lan743x_tx *tx = context;
+ struct lan743x_adapter *adapter = tx->adapter;
+ bool enable_flag = true;
+- u32 int_en = 0;
+
+- int_en = lan743x_csr_read(adapter, INT_EN_SET);
++ lan743x_csr_read(adapter, INT_EN_SET);
+ if (flags & LAN743X_VECTOR_FLAG_SOURCE_ENABLE_CLEAR) {
+ lan743x_csr_write(adapter, INT_EN_CLR,
+ INT_BIT_DMA_TX_(tx->channel_number));
+@@ -1635,10 +1634,9 @@ static int lan743x_tx_napi_poll(struct napi_struct *napi, int weight)
+ bool start_transmitter = false;
+ unsigned long irq_flags = 0;
+ u32 ioc_bit = 0;
+- u32 int_sts = 0;
+
+ ioc_bit = DMAC_INT_BIT_TX_IOC_(tx->channel_number);
+- int_sts = lan743x_csr_read(adapter, DMAC_INT_STS);
++ lan743x_csr_read(adapter, DMAC_INT_STS);
+ if (tx->vector_flags & LAN743X_VECTOR_FLAG_SOURCE_STATUS_W2C)
+ lan743x_csr_write(adapter, DMAC_INT_STS, ioc_bit);
+ spin_lock_irqsave(&tx->ring_lock, irq_flags);
+diff --git a/drivers/net/ethernet/neterion/vxge/vxge-traffic.c b/drivers/net/ethernet/neterion/vxge/vxge-traffic.c
+index 0c3b5dea2858a..ad3702d3d8310 100644
+--- a/drivers/net/ethernet/neterion/vxge/vxge-traffic.c
++++ b/drivers/net/ethernet/neterion/vxge/vxge-traffic.c
+@@ -29,8 +29,6 @@
+ */
+ enum vxge_hw_status vxge_hw_vpath_intr_enable(struct __vxge_hw_vpath_handle *vp)
+ {
+- u64 val64;
+-
+ struct __vxge_hw_virtualpath *vpath;
+ struct vxge_hw_vpath_reg __iomem *vp_reg;
+ enum vxge_hw_status status = VXGE_HW_OK;
+@@ -83,7 +81,7 @@ enum vxge_hw_status vxge_hw_vpath_intr_enable(struct __vxge_hw_vpath_handle *vp)
+ __vxge_hw_pio_mem_write32_upper((u32)VXGE_HW_INTR_MASK_ALL,
+ &vp_reg->xgmac_vp_int_status);
+
+- val64 = readq(&vp_reg->vpath_general_int_status);
++ readq(&vp_reg->vpath_general_int_status);
+
+ /* Mask unwanted interrupts */
+
+@@ -156,8 +154,6 @@ exit:
+ enum vxge_hw_status vxge_hw_vpath_intr_disable(
+ struct __vxge_hw_vpath_handle *vp)
+ {
+- u64 val64;
+-
+ struct __vxge_hw_virtualpath *vpath;
+ enum vxge_hw_status status = VXGE_HW_OK;
+ struct vxge_hw_vpath_reg __iomem *vp_reg;
+@@ -178,8 +174,6 @@ enum vxge_hw_status vxge_hw_vpath_intr_disable(
+ (u32)VXGE_HW_INTR_MASK_ALL,
+ &vp_reg->vpath_general_int_mask);
+
+- val64 = VXGE_HW_TIM_CLR_INT_EN_VP(1 << (16 - vpath->vp_id));
+-
+ writeq(VXGE_HW_INTR_MASK_ALL, &vp_reg->kdfcctl_errors_mask);
+
+ __vxge_hw_pio_mem_write32_upper((u32)VXGE_HW_INTR_MASK_ALL,
+@@ -486,9 +480,7 @@ void vxge_hw_device_unmask_all(struct __vxge_hw_device *hldev)
+ */
+ void vxge_hw_device_flush_io(struct __vxge_hw_device *hldev)
+ {
+- u32 val32;
+-
+- val32 = readl(&hldev->common_reg->titan_general_int_status);
++ readl(&hldev->common_reg->titan_general_int_status);
+ }
+
+ /**
+@@ -1726,8 +1718,8 @@ void vxge_hw_fifo_txdl_free(struct __vxge_hw_fifo *fifo, void *txdlh)
+ enum vxge_hw_status
+ vxge_hw_vpath_mac_addr_add(
+ struct __vxge_hw_vpath_handle *vp,
+- u8 (macaddr)[ETH_ALEN],
+- u8 (macaddr_mask)[ETH_ALEN],
++ u8 *macaddr,
++ u8 *macaddr_mask,
+ enum vxge_hw_vpath_mac_addr_add_mode duplicate_mode)
+ {
+ u32 i;
+@@ -1789,8 +1781,8 @@ exit:
+ enum vxge_hw_status
+ vxge_hw_vpath_mac_addr_get(
+ struct __vxge_hw_vpath_handle *vp,
+- u8 (macaddr)[ETH_ALEN],
+- u8 (macaddr_mask)[ETH_ALEN])
++ u8 *macaddr,
++ u8 *macaddr_mask)
+ {
+ u32 i;
+ u64 data1 = 0ULL;
+@@ -1841,8 +1833,8 @@ exit:
+ enum vxge_hw_status
+ vxge_hw_vpath_mac_addr_get_next(
+ struct __vxge_hw_vpath_handle *vp,
+- u8 (macaddr)[ETH_ALEN],
+- u8 (macaddr_mask)[ETH_ALEN])
++ u8 *macaddr,
++ u8 *macaddr_mask)
+ {
+ u32 i;
+ u64 data1 = 0ULL;
+@@ -1894,8 +1886,8 @@ exit:
+ enum vxge_hw_status
+ vxge_hw_vpath_mac_addr_delete(
+ struct __vxge_hw_vpath_handle *vp,
+- u8 (macaddr)[ETH_ALEN],
+- u8 (macaddr_mask)[ETH_ALEN])
++ u8 *macaddr,
++ u8 *macaddr_mask)
+ {
+ u32 i;
+ u64 data1 = 0ULL;
+@@ -2385,7 +2377,6 @@ enum vxge_hw_status vxge_hw_vpath_poll_rx(struct __vxge_hw_ring *ring)
+ u8 t_code;
+ enum vxge_hw_status status = VXGE_HW_OK;
+ void *first_rxdh;
+- u64 val64 = 0;
+ int new_count = 0;
+
+ ring->cmpl_cnt = 0;
+@@ -2413,8 +2404,7 @@ enum vxge_hw_status vxge_hw_vpath_poll_rx(struct __vxge_hw_ring *ring)
+ }
+ writeq(VXGE_HW_PRC_RXD_DOORBELL_NEW_QW_CNT(new_count),
+ &ring->vp_reg->prc_rxd_doorbell);
+- val64 =
+- readl(&ring->common_reg->titan_general_int_status);
++ readl(&ring->common_reg->titan_general_int_status);
+ ring->doorbell_cnt = 0;
+ }
+ }
+diff --git a/drivers/net/ethernet/sfc/falcon/farch.c b/drivers/net/ethernet/sfc/falcon/farch.c
+index 411a2f419447c..8a14f77163026 100644
+--- a/drivers/net/ethernet/sfc/falcon/farch.c
++++ b/drivers/net/ethernet/sfc/falcon/farch.c
+@@ -873,17 +873,12 @@ static u16 ef4_farch_handle_rx_not_ok(struct ef4_rx_queue *rx_queue,
+ {
+ struct ef4_channel *channel = ef4_rx_queue_channel(rx_queue);
+ struct ef4_nic *efx = rx_queue->efx;
+- bool rx_ev_buf_owner_id_err, rx_ev_ip_hdr_chksum_err;
++ bool __maybe_unused rx_ev_buf_owner_id_err, rx_ev_ip_hdr_chksum_err;
+ bool rx_ev_tcp_udp_chksum_err, rx_ev_eth_crc_err;
+ bool rx_ev_frm_trunc, rx_ev_drib_nib, rx_ev_tobe_disc;
+- bool rx_ev_other_err, rx_ev_pause_frm;
+- bool rx_ev_hdr_type, rx_ev_mcast_pkt;
+- unsigned rx_ev_pkt_type;
++ bool rx_ev_pause_frm;
+
+- rx_ev_hdr_type = EF4_QWORD_FIELD(*event, FSF_AZ_RX_EV_HDR_TYPE);
+- rx_ev_mcast_pkt = EF4_QWORD_FIELD(*event, FSF_AZ_RX_EV_MCAST_PKT);
+ rx_ev_tobe_disc = EF4_QWORD_FIELD(*event, FSF_AZ_RX_EV_TOBE_DISC);
+- rx_ev_pkt_type = EF4_QWORD_FIELD(*event, FSF_AZ_RX_EV_PKT_TYPE);
+ rx_ev_buf_owner_id_err = EF4_QWORD_FIELD(*event,
+ FSF_AZ_RX_EV_BUF_OWNER_ID_ERR);
+ rx_ev_ip_hdr_chksum_err = EF4_QWORD_FIELD(*event,
+@@ -896,10 +891,6 @@ static u16 ef4_farch_handle_rx_not_ok(struct ef4_rx_queue *rx_queue,
+ 0 : EF4_QWORD_FIELD(*event, FSF_AA_RX_EV_DRIB_NIB));
+ rx_ev_pause_frm = EF4_QWORD_FIELD(*event, FSF_AZ_RX_EV_PAUSE_FRM_ERR);
+
+- /* Every error apart from tobe_disc and pause_frm */
+- rx_ev_other_err = (rx_ev_drib_nib | rx_ev_tcp_udp_chksum_err |
+- rx_ev_buf_owner_id_err | rx_ev_eth_crc_err |
+- rx_ev_frm_trunc | rx_ev_ip_hdr_chksum_err);
+
+ /* Count errors that are not in MAC stats. Ignore expected
+ * checksum errors during self-test. */
+@@ -919,6 +910,13 @@ static u16 ef4_farch_handle_rx_not_ok(struct ef4_rx_queue *rx_queue,
+ * to a FIFO overflow.
+ */
+ #ifdef DEBUG
++ {
++ /* Every error apart from tobe_disc and pause_frm */
++
++ bool rx_ev_other_err = (rx_ev_drib_nib | rx_ev_tcp_udp_chksum_err |
++ rx_ev_buf_owner_id_err | rx_ev_eth_crc_err |
++ rx_ev_frm_trunc | rx_ev_ip_hdr_chksum_err);
++
+ if (rx_ev_other_err && net_ratelimit()) {
+ netif_dbg(efx, rx_err, efx->net_dev,
+ " RX queue %d unexpected RX event "
+@@ -935,6 +933,7 @@ static u16 ef4_farch_handle_rx_not_ok(struct ef4_rx_queue *rx_queue,
+ rx_ev_tobe_disc ? " [TOBE_DISC]" : "",
+ rx_ev_pause_frm ? " [PAUSE]" : "");
+ }
++ }
+ #endif
+
+ /* The frame must be discarded if any of these are true. */
+@@ -1646,15 +1645,11 @@ void ef4_farch_rx_push_indir_table(struct ef4_nic *efx)
+ */
+ void ef4_farch_dimension_resources(struct ef4_nic *efx, unsigned sram_lim_qw)
+ {
+- unsigned vi_count, buftbl_min;
++ unsigned vi_count;
+
+ /* Account for the buffer table entries backing the datapath channels
+ * and the descriptor caches for those channels.
+ */
+- buftbl_min = ((efx->n_rx_channels * EF4_MAX_DMAQ_SIZE +
+- efx->n_tx_channels * EF4_TXQ_TYPES * EF4_MAX_DMAQ_SIZE +
+- efx->n_channels * EF4_MAX_EVQ_SIZE)
+- * sizeof(ef4_qword_t) / EF4_BUF_SIZE);
+ vi_count = max(efx->n_channels, efx->n_tx_channels * EF4_TXQ_TYPES);
+
+ efx->tx_dc_base = sram_lim_qw - vi_count * TX_DC_ENTRIES;
+@@ -2535,7 +2530,6 @@ int ef4_farch_filter_remove_safe(struct ef4_nic *efx,
+ enum ef4_farch_filter_table_id table_id;
+ struct ef4_farch_filter_table *table;
+ unsigned int filter_idx;
+- struct ef4_farch_filter_spec *spec;
+ int rc;
+
+ table_id = ef4_farch_filter_id_table_id(filter_id);
+@@ -2546,7 +2540,6 @@ int ef4_farch_filter_remove_safe(struct ef4_nic *efx,
+ filter_idx = ef4_farch_filter_id_index(filter_id);
+ if (filter_idx >= table->size)
+ return -ENOENT;
+- spec = &table->spec[filter_idx];
+
+ spin_lock_bh(&efx->filter_lock);
+ rc = ef4_farch_filter_remove(efx, table, filter_idx, priority);
+diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c
+index d5bcbc40a55fc..823873030a218 100644
+--- a/drivers/net/ethernet/sis/sis900.c
++++ b/drivers/net/ethernet/sis/sis900.c
+@@ -783,10 +783,9 @@ static u16 sis900_default_phy(struct net_device * net_dev)
+ static void sis900_set_capability(struct net_device *net_dev, struct mii_phy *phy)
+ {
+ u16 cap;
+- u16 status;
+
+- status = mdio_read(net_dev, phy->phy_addr, MII_STATUS);
+- status = mdio_read(net_dev, phy->phy_addr, MII_STATUS);
++ mdio_read(net_dev, phy->phy_addr, MII_STATUS);
++ mdio_read(net_dev, phy->phy_addr, MII_STATUS);
+
+ cap = MII_NWAY_CSMA_CD |
+ ((phy->status & MII_STAT_CAN_TX_FDX)? MII_NWAY_TX_FDX:0) |
+diff --git a/drivers/net/ethernet/synopsys/dwc-xlgmac-common.c b/drivers/net/ethernet/synopsys/dwc-xlgmac-common.c
+index eb1c6b03c329a..df26cea459048 100644
+--- a/drivers/net/ethernet/synopsys/dwc-xlgmac-common.c
++++ b/drivers/net/ethernet/synopsys/dwc-xlgmac-common.c
+@@ -513,7 +513,7 @@ void xlgmac_get_all_hw_features(struct xlgmac_pdata *pdata)
+
+ void xlgmac_print_all_hw_features(struct xlgmac_pdata *pdata)
+ {
+- char *str = NULL;
++ char __maybe_unused *str = NULL;
+
+ XLGMAC_PR("\n");
+ XLGMAC_PR("=====================================================\n");
+diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
+index 9bb84d83afc15..56130cf293f37 100644
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -1240,7 +1240,7 @@ static int emac_poll(struct napi_struct *napi, int budget)
+ struct net_device *ndev = priv->ndev;
+ struct device *emac_dev = &ndev->dev;
+ u32 status = 0;
+- u32 num_tx_pkts = 0, num_rx_pkts = 0;
++ u32 num_rx_pkts = 0;
+
+ /* Check interrupt vectors and call packet processing */
+ status = emac_read(EMAC_MACINVECTOR);
+@@ -1251,8 +1251,7 @@ static int emac_poll(struct napi_struct *napi, int budget)
+ mask = EMAC_DM646X_MAC_IN_VECTOR_TX_INT_VEC;
+
+ if (status & mask) {
+- num_tx_pkts = cpdma_chan_process(priv->txchan,
+- EMAC_DEF_TX_MAX_SERVICE);
++ cpdma_chan_process(priv->txchan, EMAC_DEF_TX_MAX_SERVICE);
+ } /* TX processing */
+
+ mask = EMAC_DM644X_MAC_IN_VECTOR_RX_INT_VEC;
+diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
+index a1d335a3c5e43..6099865217f29 100644
+--- a/drivers/net/ethernet/ti/netcp_core.c
++++ b/drivers/net/ethernet/ti/netcp_core.c
+@@ -1364,9 +1364,9 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe)
+ tx_pipe->dma_queue = knav_queue_open(name, tx_pipe->dma_queue_id,
+ KNAV_QUEUE_SHARED);
+ if (IS_ERR(tx_pipe->dma_queue)) {
++ ret = PTR_ERR(tx_pipe->dma_queue);
+ dev_err(dev, "Could not open DMA queue for channel \"%s\": %d\n",
+ name, ret);
+- ret = PTR_ERR(tx_pipe->dma_queue);
+ goto err;
+ }
+
+diff --git a/drivers/net/ethernet/ti/tlan.c b/drivers/net/ethernet/ti/tlan.c
+index 93d142867c2af..01f99e5df1456 100644
+--- a/drivers/net/ethernet/ti/tlan.c
++++ b/drivers/net/ethernet/ti/tlan.c
+@@ -671,7 +671,6 @@ module_exit(tlan_exit);
+ static void __init tlan_eisa_probe(void)
+ {
+ long ioaddr;
+- int rc = -ENODEV;
+ int irq;
+ u16 device_id;
+
+@@ -736,8 +735,7 @@ static void __init tlan_eisa_probe(void)
+
+
+ /* Setup the newly found eisa adapter */
+- rc = tlan_probe1(NULL, ioaddr, irq,
+- 12, NULL);
++ tlan_probe1(NULL, ioaddr, irq, 12, NULL);
+ continue;
+
+ out:
+diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
+index ef9538ee53d0d..f0c33d00dcb41 100644
+--- a/drivers/net/ethernet/via/via-velocity.c
++++ b/drivers/net/ethernet/via/via-velocity.c
+@@ -875,26 +875,13 @@ static u32 check_connection_type(struct mac_regs __iomem *regs)
+ */
+ static int velocity_set_media_mode(struct velocity_info *vptr, u32 mii_status)
+ {
+- u32 curr_status;
+ struct mac_regs __iomem *regs = vptr->mac_regs;
+
+ vptr->mii_status = mii_check_media_mode(vptr->mac_regs);
+- curr_status = vptr->mii_status & (~VELOCITY_LINK_FAIL);
+
+ /* Set mii link status */
+ set_mii_flow_control(vptr);
+
+- /*
+- Check if new status is consistent with current status
+- if (((mii_status & curr_status) & VELOCITY_AUTONEG_ENABLE) ||
+- (mii_status==curr_status)) {
+- vptr->mii_status=mii_check_media_mode(vptr->mac_regs);
+- vptr->mii_status=check_connection_type(vptr->mac_regs);
+- VELOCITY_PRT(MSG_LEVEL_INFO, "Velocity link no change\n");
+- return 0;
+- }
+- */
+-
+ if (PHYID_GET_PHY_ID(vptr->phy_id) == PHYID_CICADA_CS8201)
+ MII_REG_BITS_ON(AUXCR_MDPPS, MII_NCONFIG, vptr->mac_regs);
+
+diff --git a/drivers/net/phy/mdio-octeon.c b/drivers/net/phy/mdio-octeon.c
+index ab6914f8bd50f..1da104150f445 100644
+--- a/drivers/net/phy/mdio-octeon.c
++++ b/drivers/net/phy/mdio-octeon.c
+@@ -75,7 +75,6 @@ static int octeon_mdiobus_probe(struct platform_device *pdev)
+
+ return 0;
+ fail_register:
+- mdiobus_free(bus->mii_bus);
+ smi_en.u64 = 0;
+ oct_mdio_writeq(smi_en.u64, bus->register_base + SMI_EN);
+ return err;
+@@ -89,7 +88,6 @@ static int octeon_mdiobus_remove(struct platform_device *pdev)
+ bus = platform_get_drvdata(pdev);
+
+ mdiobus_unregister(bus->mii_bus);
+- mdiobus_free(bus->mii_bus);
+ smi_en.u64 = 0;
+ oct_mdio_writeq(smi_en.u64, bus->register_base + SMI_EN);
+ return 0;
+diff --git a/drivers/net/phy/mdio-thunder.c b/drivers/net/phy/mdio-thunder.c
+index 564616968cad4..c0c922eff760c 100644
+--- a/drivers/net/phy/mdio-thunder.c
++++ b/drivers/net/phy/mdio-thunder.c
+@@ -129,7 +129,6 @@ static void thunder_mdiobus_pci_remove(struct pci_dev *pdev)
+ continue;
+
+ mdiobus_unregister(bus->mii_bus);
+- mdiobus_free(bus->mii_bus);
+ oct_mdio_writeq(0, bus->register_base + SMI_EN);
+ }
+ pci_set_drvdata(pdev, NULL);
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index 94f1c2422f844..a66077f514572 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -1703,7 +1703,7 @@ static int hso_serial_tiocmset(struct tty_struct *tty,
+ spin_unlock_irqrestore(&serial->serial_lock, flags);
+
+ return usb_control_msg(serial->parent->usb,
+- usb_rcvctrlpipe(serial->parent->usb, 0), 0x22,
++ usb_sndctrlpipe(serial->parent->usb, 0), 0x22,
+ 0x21, val, if_num, NULL, 0,
+ USB_CTRL_SET_TIMEOUT);
+ }
+@@ -2450,7 +2450,7 @@ static int hso_rfkill_set_block(void *data, bool blocked)
+ if (hso_dev->usb_gone)
+ rv = 0;
+ else
+- rv = usb_control_msg(hso_dev->usb, usb_rcvctrlpipe(hso_dev->usb, 0),
++ rv = usb_control_msg(hso_dev->usb, usb_sndctrlpipe(hso_dev->usb, 0),
+ enabled ? 0x82 : 0x81, 0x40, 0, 0, NULL, 0,
+ USB_CTRL_SET_TIMEOUT);
+ mutex_unlock(&hso_dev->mutex);
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index ec287c9741e83..62f2862c9775e 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -1495,7 +1495,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ ret = smsc75xx_wait_ready(dev, 0);
+ if (ret < 0) {
+ netdev_warn(dev->net, "device not ready in smsc75xx_bind\n");
+- return ret;
++ goto err;
+ }
+
+ smsc75xx_init_mac_address(dev);
+@@ -1504,7 +1504,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ ret = smsc75xx_reset(dev);
+ if (ret < 0) {
+ netdev_warn(dev->net, "smsc75xx_reset error %d\n", ret);
+- return ret;
++ goto err;
+ }
+
+ dev->net->netdev_ops = &smsc75xx_netdev_ops;
+@@ -1514,6 +1514,10 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+ dev->net->max_mtu = MAX_SINGLE_PACKET_SIZE;
+ return 0;
++
++err:
++ kfree(pdata);
++ return ret;
+ }
+
+ static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf)
+diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
+index 68cda1564c77a..0a7551dc0f945 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -1769,14 +1769,62 @@ static void ath10k_htt_rx_h_unchain(struct ath10k *ar,
+ ath10k_unchain_msdu(amsdu, unchain_cnt);
+ }
+
++static bool ath10k_htt_rx_validate_amsdu(struct ath10k *ar,
++ struct sk_buff_head *amsdu)
++{
++ u8 *subframe_hdr;
++ struct sk_buff *first;
++ bool is_first, is_last;
++ struct htt_rx_desc *rxd;
++ struct ieee80211_hdr *hdr;
++ size_t hdr_len, crypto_len;
++ enum htt_rx_mpdu_encrypt_type enctype;
++ int bytes_aligned = ar->hw_params.decap_align_bytes;
++
++ first = skb_peek(amsdu);
++
++ rxd = (void *)first->data - sizeof(*rxd);
++ hdr = (void *)rxd->rx_hdr_status;
++
++ is_first = !!(rxd->msdu_end.common.info0 &
++ __cpu_to_le32(RX_MSDU_END_INFO0_FIRST_MSDU));
++ is_last = !!(rxd->msdu_end.common.info0 &
++ __cpu_to_le32(RX_MSDU_END_INFO0_LAST_MSDU));
++
++ /* Return in case of non-aggregated msdu */
++ if (is_first && is_last)
++ return true;
++
++ /* First msdu flag is not set for the first msdu of the list */
++ if (!is_first)
++ return false;
++
++ enctype = MS(__le32_to_cpu(rxd->mpdu_start.info0),
++ RX_MPDU_START_INFO0_ENCRYPT_TYPE);
++
++ hdr_len = ieee80211_hdrlen(hdr->frame_control);
++ crypto_len = ath10k_htt_rx_crypto_param_len(ar, enctype);
++
++ subframe_hdr = (u8 *)hdr + round_up(hdr_len, bytes_aligned) +
++ crypto_len;
++
++ /* Validate if the amsdu has a proper first subframe.
++ * There are chances a single msdu can be received as amsdu when
++ * the unauthenticated amsdu flag of a QoS header
++ * gets flipped in non-SPP AMSDU's, in such cases the first
++ * subframe has llc/snap header in place of a valid da.
++ * return false if the da matches rfc1042 pattern
++ */
++ if (ether_addr_equal(subframe_hdr, rfc1042_header))
++ return false;
++
++ return true;
++}
++
+ static bool ath10k_htt_rx_amsdu_allowed(struct ath10k *ar,
+ struct sk_buff_head *amsdu,
+ struct ieee80211_rx_status *rx_status)
+ {
+- /* FIXME: It might be a good idea to do some fuzzy-testing to drop
+- * invalid/dangerous frames.
+- */
+-
+ if (!rx_status->freq) {
+ ath10k_dbg(ar, ATH10K_DBG_HTT, "no channel configured; ignoring frame(s)!\n");
+ return false;
+@@ -1787,6 +1835,11 @@ static bool ath10k_htt_rx_amsdu_allowed(struct ath10k *ar,
+ return false;
+ }
+
++ if (!ath10k_htt_rx_validate_amsdu(ar, amsdu)) {
++ ath10k_dbg(ar, ATH10K_DBG_HTT, "invalid amsdu received\n");
++ return false;
++ }
++
+ return true;
+ }
+
+diff --git a/drivers/net/wireless/marvell/libertas/mesh.c b/drivers/net/wireless/marvell/libertas/mesh.c
+index b0cb16ef8d1d0..b313c78e21544 100644
+--- a/drivers/net/wireless/marvell/libertas/mesh.c
++++ b/drivers/net/wireless/marvell/libertas/mesh.c
+@@ -793,19 +793,6 @@ static const struct attribute_group mesh_ie_group = {
+ .attrs = mesh_ie_attrs,
+ };
+
+-static void lbs_persist_config_init(struct net_device *dev)
+-{
+- int ret;
+- ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group);
+- ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group);
+-}
+-
+-static void lbs_persist_config_remove(struct net_device *dev)
+-{
+- sysfs_remove_group(&(dev->dev.kobj), &boot_opts_group);
+- sysfs_remove_group(&(dev->dev.kobj), &mesh_ie_group);
+-}
+-
+
+ /***************************************************************************
+ * Initializing and starting, stopping mesh
+@@ -1005,6 +992,10 @@ static int lbs_add_mesh(struct lbs_private *priv)
+ SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent);
+
+ mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
++ mesh_dev->sysfs_groups[0] = &lbs_mesh_attr_group;
++ mesh_dev->sysfs_groups[1] = &boot_opts_group;
++ mesh_dev->sysfs_groups[2] = &mesh_ie_group;
++
+ /* Register virtual mesh interface */
+ ret = register_netdev(mesh_dev);
+ if (ret) {
+@@ -1012,19 +1003,10 @@ static int lbs_add_mesh(struct lbs_private *priv)
+ goto err_free_netdev;
+ }
+
+- ret = sysfs_create_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
+- if (ret)
+- goto err_unregister;
+-
+- lbs_persist_config_init(mesh_dev);
+-
+ /* Everything successful */
+ ret = 0;
+ goto done;
+
+-err_unregister:
+- unregister_netdev(mesh_dev);
+-
+ err_free_netdev:
+ free_netdev(mesh_dev);
+
+@@ -1045,8 +1027,6 @@ void lbs_remove_mesh(struct lbs_private *priv)
+
+ netif_stop_queue(mesh_dev);
+ netif_carrier_off(mesh_dev);
+- sysfs_remove_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group);
+- lbs_persist_config_remove(mesh_dev);
+ unregister_netdev(mesh_dev);
+ priv->mesh_dev = NULL;
+ kfree(mesh_dev->ieee80211_ptr);
+diff --git a/drivers/platform/x86/hp-wireless.c b/drivers/platform/x86/hp-wireless.c
+index d6ea5e998fb88..bb95bec0b110d 100644
+--- a/drivers/platform/x86/hp-wireless.c
++++ b/drivers/platform/x86/hp-wireless.c
+@@ -30,12 +30,14 @@ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Alex Hung");
+ MODULE_ALIAS("acpi*:HPQ6001:*");
+ MODULE_ALIAS("acpi*:WSTADEF:*");
++MODULE_ALIAS("acpi*:AMDI0051:*");
+
+ static struct input_dev *hpwl_input_dev;
+
+ static const struct acpi_device_id hpwl_ids[] = {
+ {"HPQ6001", 0},
+ {"WSTADEF", 0},
++ {"AMDI0051", 0},
+ {"", 0},
+ };
+
+diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
+index 7b12abe86b94f..9c3c83ef445bf 100644
+--- a/drivers/platform/x86/hp_accel.c
++++ b/drivers/platform/x86/hp_accel.c
+@@ -101,6 +101,9 @@ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids);
+ static int lis3lv02d_acpi_init(struct lis3lv02d *lis3)
+ {
+ struct acpi_device *dev = lis3->bus_priv;
++ if (!lis3->init_required)
++ return 0;
++
+ if (acpi_evaluate_object(dev->handle, METHOD_NAME__INI,
+ NULL, NULL) != AE_OK)
+ return -EINVAL;
+@@ -367,6 +370,7 @@ static int lis3lv02d_add(struct acpi_device *device)
+ }
+
+ /* call the core layer do its init */
++ lis3_dev.init_required = true;
+ ret = lis3lv02d_init_device(&lis3_dev);
+ if (ret)
+ return ret;
+@@ -414,11 +418,27 @@ static int lis3lv02d_suspend(struct device *dev)
+
+ static int lis3lv02d_resume(struct device *dev)
+ {
++ lis3_dev.init_required = false;
++ lis3lv02d_poweron(&lis3_dev);
++ return 0;
++}
++
++static int lis3lv02d_restore(struct device *dev)
++{
++ lis3_dev.init_required = true;
+ lis3lv02d_poweron(&lis3_dev);
+ return 0;
+ }
+
+-static SIMPLE_DEV_PM_OPS(hp_accel_pm, lis3lv02d_suspend, lis3lv02d_resume);
++static const struct dev_pm_ops hp_accel_pm = {
++ .suspend = lis3lv02d_suspend,
++ .resume = lis3lv02d_resume,
++ .freeze = lis3lv02d_suspend,
++ .thaw = lis3lv02d_resume,
++ .poweroff = lis3lv02d_suspend,
++ .restore = lis3lv02d_restore,
++};
++
+ #define HP_ACCEL_PM (&hp_accel_pm)
+ #else
+ #define HP_ACCEL_PM NULL
+diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c
+index 2efeab650345c..d6a7039a0591b 100644
+--- a/drivers/platform/x86/intel_punit_ipc.c
++++ b/drivers/platform/x86/intel_punit_ipc.c
+@@ -331,6 +331,7 @@ static const struct acpi_device_id punit_ipc_acpi_ids[] = {
+ { "INT34D4", 0 },
+ { }
+ };
++MODULE_DEVICE_TABLE(acpi, punit_ipc_acpi_ids);
+
+ static struct platform_driver intel_punit_ipc_driver = {
+ .probe = intel_punit_ipc_probe,
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index 0d4ffe0ae3065..79b5c5457cc22 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -3081,11 +3081,11 @@ static int blogic_qcmd_lck(struct scsi_cmnd *command,
+ ccb->opcode = BLOGIC_INITIATOR_CCB_SG;
+ ccb->datalen = count * sizeof(struct blogic_sg_seg);
+ if (blogic_multimaster_type(adapter))
+- ccb->data = (void *)((unsigned int) ccb->dma_handle +
++ ccb->data = (unsigned int) ccb->dma_handle +
+ ((unsigned long) &ccb->sglist -
+- (unsigned long) ccb));
++ (unsigned long) ccb);
+ else
+- ccb->data = ccb->sglist;
++ ccb->data = virt_to_32bit_virt(ccb->sglist);
+
+ scsi_for_each_sg(command, sg, count, i) {
+ ccb->sglist[i].segbytes = sg_dma_len(sg);
+diff --git a/drivers/scsi/BusLogic.h b/drivers/scsi/BusLogic.h
+index 8d47e2c88d242..1a33a4b28d45d 100644
+--- a/drivers/scsi/BusLogic.h
++++ b/drivers/scsi/BusLogic.h
+@@ -821,7 +821,7 @@ struct blogic_ccb {
+ unsigned char cdblen; /* Byte 2 */
+ unsigned char sense_datalen; /* Byte 3 */
+ u32 datalen; /* Bytes 4-7 */
+- void *data; /* Bytes 8-11 */
++ u32 data; /* Bytes 8-11 */
+ unsigned char:8; /* Byte 12 */
+ unsigned char:8; /* Byte 13 */
+ enum blogic_adapter_status adapter_status; /* Byte 14 */
+diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c
+index fad23dd391143..1a0b2ce398f7c 100644
+--- a/drivers/scsi/libsas/sas_port.c
++++ b/drivers/scsi/libsas/sas_port.c
+@@ -41,7 +41,7 @@ static bool phy_is_wideport_member(struct asd_sas_port *port, struct asd_sas_phy
+
+ static void sas_resume_port(struct asd_sas_phy *phy)
+ {
+- struct domain_device *dev;
++ struct domain_device *dev, *n;
+ struct asd_sas_port *port = phy->port;
+ struct sas_ha_struct *sas_ha = phy->ha;
+ struct sas_internal *si = to_sas_internal(sas_ha->core.shost->transportt);
+@@ -60,7 +60,7 @@ static void sas_resume_port(struct asd_sas_phy *phy)
+ * 1/ presume every device came back
+ * 2/ force the next revalidation to check all expander phys
+ */
+- list_for_each_entry(dev, &port->dev_list, dev_list_node) {
++ list_for_each_entry_safe(dev, n, &port->dev_list, dev_list_node) {
+ int i, rc;
+
+ rc = sas_notify_lldd_dev_found(dev);
+diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
+index 77838d8fd9bb6..341d2953d7fca 100644
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -382,7 +382,7 @@ static int spi_gpio_probe(struct platform_device *pdev)
+ return -ENODEV;
+ #endif
+
+- master = spi_alloc_master(&pdev->dev, sizeof(*spi_gpio));
++ master = devm_spi_alloc_master(&pdev->dev, sizeof(*spi_gpio));
+ if (!master)
+ return -ENOMEM;
+
+@@ -438,11 +438,7 @@ static int spi_gpio_probe(struct platform_device *pdev)
+ }
+ spi_gpio->bitbang.setup_transfer = spi_bitbang_setup_transfer;
+
+- status = spi_bitbang_start(&spi_gpio->bitbang);
+- if (status)
+- spi_master_put(master);
+-
+- return status;
++ return spi_bitbang_start(&spi_gpio->bitbang);
+ }
+
+ static int spi_gpio_remove(struct platform_device *pdev)
+diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c
+index 3e51476a70451..d2cb2bd6d9133 100644
+--- a/drivers/staging/emxx_udc/emxx_udc.c
++++ b/drivers/staging/emxx_udc/emxx_udc.c
+@@ -2148,7 +2148,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc,
+ struct nbu2ss_ep *ep,
+ int status)
+ {
+- struct nbu2ss_req *req;
++ struct nbu2ss_req *req, *n;
+
+ /* Endpoint Disable */
+ _nbu2ss_epn_exit(udc, ep);
+@@ -2160,7 +2160,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc,
+ return 0;
+
+ /* called with irqs blocked */
+- list_for_each_entry(req, &ep->queue, queue) {
++ list_for_each_entry_safe(req, n, &ep->queue, queue) {
+ _nbu2ss_ep_done(ep, req, status);
+ }
+
+diff --git a/drivers/staging/iio/cdc/ad7746.c b/drivers/staging/iio/cdc/ad7746.c
+index f53612a6461d6..18a73ee48e7c6 100644
+--- a/drivers/staging/iio/cdc/ad7746.c
++++ b/drivers/staging/iio/cdc/ad7746.c
+@@ -703,7 +703,6 @@ static int ad7746_probe(struct i2c_client *client,
+ indio_dev->num_channels = ARRAY_SIZE(ad7746_channels);
+ else
+ indio_dev->num_channels = ARRAY_SIZE(ad7746_channels) - 2;
+- indio_dev->num_channels = ARRAY_SIZE(ad7746_channels);
+ indio_dev->modes = INDIO_DIRECT_MODE;
+
+ if (pdata) {
+diff --git a/drivers/staging/mt7621-spi/spi-mt7621.c b/drivers/staging/mt7621-spi/spi-mt7621.c
+index 33c747bc83202..75ed48f60c8c7 100644
+--- a/drivers/staging/mt7621-spi/spi-mt7621.c
++++ b/drivers/staging/mt7621-spi/spi-mt7621.c
+@@ -452,7 +452,7 @@ static int mt7621_spi_probe(struct platform_device *pdev)
+ if (status)
+ return status;
+
+- master = spi_alloc_master(&pdev->dev, sizeof(*rs));
++ master = devm_spi_alloc_master(&pdev->dev, sizeof(*rs));
+ if (master == NULL) {
+ dev_info(&pdev->dev, "master allocation failed\n");
+ clk_disable_unprepare(clk);
+@@ -487,7 +487,11 @@ static int mt7621_spi_probe(struct platform_device *pdev)
+
+ mt7621_spi_reset(rs, 0);
+
+- return spi_register_master(master);
++ ret = spi_register_master(master);
++ if (ret)
++ clk_disable_unprepare(clk);
++
++ return ret;
+ }
+
+ static int mt7621_spi_remove(struct platform_device *pdev)
+@@ -498,8 +502,8 @@ static int mt7621_spi_remove(struct platform_device *pdev)
+ master = dev_get_drvdata(&pdev->dev);
+ rs = spi_master_get_devdata(master);
+
+- clk_disable(rs->clk);
+ spi_unregister_master(master);
++ clk_disable_unprepare(rs->clk);
+
+ return 0;
+ }
+diff --git a/drivers/thunderbolt/dma_port.c b/drivers/thunderbolt/dma_port.c
+index f2701194f8100..994ac759d364f 100644
+--- a/drivers/thunderbolt/dma_port.c
++++ b/drivers/thunderbolt/dma_port.c
+@@ -367,15 +367,15 @@ int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address,
+ void *buf, size_t size)
+ {
+ unsigned int retries = DMA_PORT_RETRIES;
+- unsigned int offset;
+-
+- offset = address & 3;
+- address = address & ~3;
+
+ do {
+- u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4);
++ unsigned int offset;
++ size_t nbytes;
+ int ret;
+
++ offset = address & 3;
++ nbytes = min_t(size_t, size + offset, MAIL_DATA_DWORDS * 4);
++
+ ret = dma_port_flash_read_block(dma, address, dma->buf,
+ ALIGN(nbytes, 4));
+ if (ret) {
+@@ -387,6 +387,7 @@ int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address,
+ return ret;
+ }
+
++ nbytes -= offset;
+ memcpy(buf, dma->buf + offset, nbytes);
+
+ size -= nbytes;
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 0c35c3c5e3734..c1ab0dbda8a90 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1480,10 +1480,12 @@ static int __init max310x_uart_init(void)
+ return ret;
+
+ #ifdef CONFIG_SPI_MASTER
+- spi_register_driver(&max310x_spi_driver);
++ ret = spi_register_driver(&max310x_spi_driver);
++ if (ret)
++ uart_unregister_driver(&max310x_uart);
+ #endif
+
+- return 0;
++ return ret;
+ }
+ module_init(max310x_uart_init);
+
+diff --git a/drivers/tty/serial/rp2.c b/drivers/tty/serial/rp2.c
+index 5690c09cc0417..944a4c0105795 100644
+--- a/drivers/tty/serial/rp2.c
++++ b/drivers/tty/serial/rp2.c
+@@ -195,7 +195,6 @@ struct rp2_card {
+ void __iomem *bar0;
+ void __iomem *bar1;
+ spinlock_t card_lock;
+- struct completion fw_loaded;
+ };
+
+ #define RP_ID(prod) PCI_VDEVICE(RP, (prod))
+@@ -664,17 +663,10 @@ static void rp2_remove_ports(struct rp2_card *card)
+ card->initialized_ports = 0;
+ }
+
+-static void rp2_fw_cb(const struct firmware *fw, void *context)
++static int rp2_load_firmware(struct rp2_card *card, const struct firmware *fw)
+ {
+- struct rp2_card *card = context;
+ resource_size_t phys_base;
+- int i, rc = -ENOENT;
+-
+- if (!fw) {
+- dev_err(&card->pdev->dev, "cannot find '%s' firmware image\n",
+- RP2_FW_NAME);
+- goto no_fw;
+- }
++ int i, rc = 0;
+
+ phys_base = pci_resource_start(card->pdev, 1);
+
+@@ -720,23 +712,13 @@ static void rp2_fw_cb(const struct firmware *fw, void *context)
+ card->initialized_ports++;
+ }
+
+- release_firmware(fw);
+-no_fw:
+- /*
+- * rp2_fw_cb() is called from a workqueue long after rp2_probe()
+- * has already returned success. So if something failed here,
+- * we'll just leave the now-dormant device in place until somebody
+- * unbinds it.
+- */
+- if (rc)
+- dev_warn(&card->pdev->dev, "driver initialization failed\n");
+-
+- complete(&card->fw_loaded);
++ return rc;
+ }
+
+ static int rp2_probe(struct pci_dev *pdev,
+ const struct pci_device_id *id)
+ {
++ const struct firmware *fw;
+ struct rp2_card *card;
+ struct rp2_uart_port *ports;
+ void __iomem * const *bars;
+@@ -747,7 +729,6 @@ static int rp2_probe(struct pci_dev *pdev,
+ return -ENOMEM;
+ pci_set_drvdata(pdev, card);
+ spin_lock_init(&card->card_lock);
+- init_completion(&card->fw_loaded);
+
+ rc = pcim_enable_device(pdev);
+ if (rc)
+@@ -780,21 +761,23 @@ static int rp2_probe(struct pci_dev *pdev,
+ return -ENOMEM;
+ card->ports = ports;
+
+- rc = devm_request_irq(&pdev->dev, pdev->irq, rp2_uart_interrupt,
+- IRQF_SHARED, DRV_NAME, card);
+- if (rc)
++ rc = request_firmware(&fw, RP2_FW_NAME, &pdev->dev);
++ if (rc < 0) {
++ dev_err(&pdev->dev, "cannot find '%s' firmware image\n",
++ RP2_FW_NAME);
+ return rc;
++ }
+
+- /*
+- * Only catastrophic errors (e.g. ENOMEM) are reported here.
+- * If the FW image is missing, we'll find out in rp2_fw_cb()
+- * and print an error message.
+- */
+- rc = request_firmware_nowait(THIS_MODULE, 1, RP2_FW_NAME, &pdev->dev,
+- GFP_KERNEL, card, rp2_fw_cb);
++ rc = rp2_load_firmware(card, fw);
++
++ release_firmware(fw);
++ if (rc < 0)
++ return rc;
++
++ rc = devm_request_irq(&pdev->dev, pdev->irq, rp2_uart_interrupt,
++ IRQF_SHARED, DRV_NAME, card);
+ if (rc)
+ return rc;
+- dev_dbg(&pdev->dev, "waiting for firmware blob...\n");
+
+ return 0;
+ }
+@@ -803,7 +786,6 @@ static void rp2_remove(struct pci_dev *pdev)
+ {
+ struct rp2_card *card = pci_get_drvdata(pdev);
+
+- wait_for_completion(&card->fw_loaded);
+ rp2_remove_ports(card);
+ }
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 8aaa7900927a8..bfbfe0d68d828 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1026,10 +1026,10 @@ static int scif_set_rtrg(struct uart_port *port, int rx_trig)
+ {
+ unsigned int bits;
+
++ if (rx_trig >= port->fifosize)
++ rx_trig = port->fifosize - 1;
+ if (rx_trig < 1)
+ rx_trig = 1;
+- if (rx_trig >= port->fifosize)
+- rx_trig = port->fifosize;
+
+ /* HSCIF can be set to an arbitrary level. */
+ if (sci_getreg(port, HSRTRGR)->size) {
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 732e7f1687dd2..a45443482e0b4 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1189,7 +1189,12 @@ static int proc_bulk(struct usb_dev_state *ps, void __user *arg)
+ ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb));
+ if (ret)
+ return ret;
+- tbuf = kmalloc(len1, GFP_KERNEL);
++
++ /*
++ * len1 can be almost arbitrarily large. Don't WARN if it's
++ * too big, just fail the request.
++ */
++ tbuf = kmalloc(len1, GFP_KERNEL | __GFP_NOWARN);
+ if (!tbuf) {
+ ret = -ENOMEM;
+ goto done;
+@@ -1631,7 +1636,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ if (num_sgs) {
+ as->urb->sg = kmalloc_array(num_sgs,
+ sizeof(struct scatterlist),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (!as->urb->sg) {
+ ret = -ENOMEM;
+ goto error;
+@@ -1666,7 +1671,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ (uurb_start - as->usbm->vm_start);
+ } else {
+ as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (!as->urb->transfer_buffer) {
+ ret = -ENOMEM;
+ goto error;
+diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h
+index d0bbbd76ba8e9..df3aa0b69188f 100644
+--- a/drivers/usb/core/hub.h
++++ b/drivers/usb/core/hub.h
+@@ -146,8 +146,10 @@ static inline unsigned hub_power_on_good_delay(struct usb_hub *hub)
+ {
+ unsigned delay = hub->descriptor->bPwrOn2PwrGood * 2;
+
+- /* Wait at least 100 msec for power to become stable */
+- return max(delay, 100U);
++ if (!hub->hdev->parent) /* root hub */
++ return delay;
++ else /* Wait at least 100 msec for power to become stable */
++ return max(delay, 100U);
+ }
+
+ static inline int hub_port_debounce_be_connected(struct usb_hub *hub,
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 8ce13f5e83c73..1396ee5297923 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1162,6 +1162,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ req->start_sg = sg_next(s);
+
+ req->num_queued_sgs++;
++ req->num_pending_sgs--;
+
+ /*
+ * The number of pending SG entries may not correspond to the
+@@ -1169,7 +1170,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ * don't include unused SG entries.
+ */
+ if (length == 0) {
+- req->num_pending_sgs -= req->request.num_mapped_sgs - req->num_queued_sgs;
++ req->num_pending_sgs = 0;
+ break;
+ }
+
+@@ -1834,6 +1835,10 @@ static void dwc3_gadget_enable_irq(struct dwc3 *dwc)
+ if (dwc->revision < DWC3_REVISION_250A)
+ reg |= DWC3_DEVTEN_ULSTCNGEN;
+
++ /* On 2.30a and above this bit enables U3/L2-L1 Suspend Events */
++ if (dwc->revision >= DWC3_REVISION_230A)
++ reg |= DWC3_DEVTEN_EOPFEN;
++
+ dwc3_writel(dwc->regs, DWC3_DEVTEN, reg);
+ }
+
+@@ -2357,15 +2362,15 @@ static int dwc3_gadget_ep_reclaim_trb_sg(struct dwc3_ep *dep,
+ struct dwc3_trb *trb = &dep->trb_pool[dep->trb_dequeue];
+ struct scatterlist *sg = req->sg;
+ struct scatterlist *s;
+- unsigned int pending = req->num_pending_sgs;
++ unsigned int num_queued = req->num_queued_sgs;
+ unsigned int i;
+ int ret = 0;
+
+- for_each_sg(sg, s, pending, i) {
++ for_each_sg(sg, s, num_queued, i) {
+ trb = &dep->trb_pool[dep->trb_dequeue];
+
+ req->sg = sg_next(s);
+- req->num_pending_sgs--;
++ req->num_queued_sgs--;
+
+ ret = dwc3_gadget_ep_reclaim_completed_trb(dep, req,
+ trb, event, status, true);
+@@ -2388,7 +2393,7 @@ static int dwc3_gadget_ep_reclaim_trb_linear(struct dwc3_ep *dep,
+
+ static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req)
+ {
+- return req->num_pending_sgs == 0;
++ return req->num_pending_sgs == 0 && req->num_queued_sgs == 0;
+ }
+
+ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+@@ -2397,7 +2402,7 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+ {
+ int ret;
+
+- if (req->num_pending_sgs)
++ if (req->request.num_mapped_sgs)
+ ret = dwc3_gadget_ep_reclaim_trb_sg(dep, req, event,
+ status);
+ else
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index a5254e82d6282..c17d7a71e29a3 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -1466,7 +1466,7 @@ static void usb3_start_pipen(struct renesas_usb3_ep *usb3_ep,
+ struct renesas_usb3_request *usb3_req)
+ {
+ struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
+- struct renesas_usb3_request *usb3_req_first = usb3_get_request(usb3_ep);
++ struct renesas_usb3_request *usb3_req_first;
+ unsigned long flags;
+ int ret = -EAGAIN;
+ u32 enable_bits = 0;
+@@ -1474,7 +1474,8 @@ static void usb3_start_pipen(struct renesas_usb3_ep *usb3_ep,
+ spin_lock_irqsave(&usb3->lock, flags);
+ if (usb3_ep->halt || usb3_ep->started)
+ goto out;
+- if (usb3_req != usb3_req_first)
++ usb3_req_first = __usb3_get_request(usb3_ep);
++ if (!usb3_req_first || usb3_req != usb3_req_first)
+ goto out;
+
+ if (usb3_pn_change(usb3, usb3_ep->num) < 0)
+diff --git a/drivers/usb/misc/trancevibrator.c b/drivers/usb/misc/trancevibrator.c
+index b3e1f553954a4..ed63e954970a7 100644
+--- a/drivers/usb/misc/trancevibrator.c
++++ b/drivers/usb/misc/trancevibrator.c
+@@ -59,9 +59,9 @@ static ssize_t speed_store(struct device *dev, struct device_attribute *attr,
+ /* Set speed */
+ retval = usb_control_msg(tv->udev, usb_sndctrlpipe(tv->udev, 0),
+ 0x01, /* vendor request: set speed */
+- USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER,
++ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+ tv->speed, /* speed value */
+- 0, NULL, 0, USB_CTRL_GET_TIMEOUT);
++ 0, NULL, 0, USB_CTRL_SET_TIMEOUT);
+ if (retval) {
+ tv->speed = old;
+ dev_dbg(&tv->udev->dev, "retval = %d\n", retval);
+diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
+index b5d6616442635..748139d262633 100644
+--- a/drivers/usb/misc/uss720.c
++++ b/drivers/usb/misc/uss720.c
+@@ -736,6 +736,7 @@ static int uss720_probe(struct usb_interface *intf,
+ parport_announce_port(pp);
+
+ usb_set_intfdata(intf, pp);
++ usb_put_dev(usbdev);
+ return 0;
+
+ probe_abort:
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index a5891cb2c72e3..37575d7983c0b 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1024,6 +1024,9 @@ static const struct usb_device_id id_table_combined[] = {
+ /* Sienna devices */
+ { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) },
+ { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) },
++ /* IDS GmbH devices */
++ { USB_DEVICE(IDS_VID, IDS_SI31A_PID) },
++ { USB_DEVICE(IDS_VID, IDS_CM31A_PID) },
+ /* U-Blox devices */
+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 3d47c6d72256e..d854e04a4286e 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1567,6 +1567,13 @@
+ #define UNJO_VID 0x22B7
+ #define UNJO_ISODEBUG_V1_PID 0x150D
+
++/*
++ * IDS GmbH
++ */
++#define IDS_VID 0x2CAF
++#define IDS_SI31A_PID 0x13A2
++#define IDS_CM31A_PID 0x13A3
++
+ /*
+ * U-Blox products (http://www.u-blox.com).
+ */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index aeaa3756f6ee8..5e3430d456f36 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1240,6 +1240,10 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
+ .driver_info = NCTRL(0) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7010, 0xff), /* Telit LE910-S1 (RNDIS) */
++ .driver_info = NCTRL(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */
++ .driver_info = NCTRL(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */
+ .driver_info = NCTRL(0) | ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 2d78ad2842a44..7df0fbede21bc 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -107,6 +107,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
+ { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
+ { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
++ { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530GC_PRODUCT_ID) },
+ { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
+ { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) },
+ { } /* Terminating entry */
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index a897680473a78..3e5442573fe4e 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -152,6 +152,7 @@
+ /* ADLINK ND-6530 RS232,RS485 and RS422 adapter */
+ #define ADLINK_VENDOR_ID 0x0b63
+ #define ADLINK_ND6530_PRODUCT_ID 0x6530
++#define ADLINK_ND6530GC_PRODUCT_ID 0x653a
+
+ /* SMART USB Serial Adapter */
+ #define SMART_VENDOR_ID 0x0b8c
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index c9201e0a82417..ccd516ea29626 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -37,6 +37,7 @@
+ /* Vendor and product ids */
+ #define TI_VENDOR_ID 0x0451
+ #define IBM_VENDOR_ID 0x04b3
++#define STARTECH_VENDOR_ID 0x14b0
+ #define TI_3410_PRODUCT_ID 0x3410
+ #define IBM_4543_PRODUCT_ID 0x4543
+ #define IBM_454B_PRODUCT_ID 0x454b
+@@ -374,6 +375,7 @@ static const struct usb_device_id ti_id_table_3410[] = {
+ { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1131_PRODUCT_ID) },
+ { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1150_PRODUCT_ID) },
+ { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1151_PRODUCT_ID) },
++ { USB_DEVICE(STARTECH_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ { } /* terminator */
+ };
+
+@@ -412,6 +414,7 @@ static const struct usb_device_id ti_id_table_combined[] = {
+ { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1131_PRODUCT_ID) },
+ { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1150_PRODUCT_ID) },
+ { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1151_PRODUCT_ID) },
++ { USB_DEVICE(STARTECH_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ { } /* terminator */
+ };
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 7b940264c7b9d..1cd610ddbb244 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1770,8 +1770,6 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans,
+ ret = btrfs_update_inode(trans, root, inode);
+ } else if (ret == -EEXIST) {
+ ret = 0;
+- } else {
+- BUG(); /* Logic Error */
+ }
+ iput(inode);
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index ee824131c02e4..43478ec6fd67a 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -791,6 +791,13 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
+ /* Internal types */
+ server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES;
+
++ /*
++ * SMB3.0 supports only 1 cipher and doesn't have a encryption neg context
++ * Set the cipher type manually.
++ */
++ if (server->dialect == SMB30_PROT_ID && (server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
++ server->cipher_type = SMB2_ENCRYPTION_AES128_CCM;
++
+ security_blob = smb2_get_data_area_len(&blob_offset, &blob_length,
+ (struct smb2_sync_hdr *)rsp);
+ /*
+@@ -3117,10 +3124,10 @@ smb2_new_read_req(void **buf, unsigned int *total_len,
+ * Related requests use info from previous read request
+ * in chain.
+ */
+- shdr->SessionId = 0xFFFFFFFF;
++ shdr->SessionId = 0xFFFFFFFFFFFFFFFF;
+ shdr->TreeId = 0xFFFFFFFF;
+- req->PersistentFileId = 0xFFFFFFFF;
+- req->VolatileFileId = 0xFFFFFFFF;
++ req->PersistentFileId = 0xFFFFFFFFFFFFFFFF;
++ req->VolatileFileId = 0xFFFFFFFFFFFFFFFF;
+ }
+ }
+ if (remaining_bytes > io_parms->length)
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 3a2fea8d211d7..b313627b1801b 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -426,7 +426,7 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
+ u32 hash;
+
+ index = page->index;
+- hash = hugetlb_fault_mutex_hash(h, mapping, index, 0);
++ hash = hugetlb_fault_mutex_hash(h, mapping, index);
+ mutex_lock(&hugetlb_fault_mutex_table[hash]);
+
+ /*
+@@ -623,7 +623,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
+ addr = index * hpage_size;
+
+ /* mutex taken here, fault path and hole punch */
+- hash = hugetlb_fault_mutex_hash(h, mapping, index, addr);
++ hash = hugetlb_fault_mutex_hash(h, mapping, index);
+ mutex_lock(&hugetlb_fault_mutex_table[hash]);
+
+ /* See if already present in mapping to avoid alloc/free */
+diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
+index 2478a69da0f0c..e8e825497cbdc 100644
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -717,7 +717,7 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
+ if (unlikely(!p))
+ goto out_err;
+ fl->fh_array[i]->size = be32_to_cpup(p++);
+- if (sizeof(struct nfs_fh) < fl->fh_array[i]->size) {
++ if (fl->fh_array[i]->size > NFS_MAXFHSIZE) {
+ printk(KERN_ERR "NFS: Too big fh %d received %d\n",
+ i, fl->fh_array[i]->size);
+ goto out_err;
+diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
+index 75d3cf86f1723..e053a883d08d4 100644
+--- a/fs/nfs/nfs4file.c
++++ b/fs/nfs/nfs4file.c
+@@ -148,7 +148,7 @@ static loff_t nfs4_file_llseek(struct file *filep, loff_t offset, int whence)
+ case SEEK_HOLE:
+ case SEEK_DATA:
+ ret = nfs42_proc_llseek(filep, offset, whence);
+- if (ret != -ENOTSUPP)
++ if (ret != -EOPNOTSUPP)
+ return ret;
+ /* Fall through */
+ default:
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index 2c7d76b4c5e18..a9e1bcdd9394d 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -987,17 +987,16 @@ static void nfs_pageio_doio(struct nfs_pageio_descriptor *desc)
+ {
+ struct nfs_pgio_mirror *mirror = nfs_pgio_current_mirror(desc);
+
+-
+ if (!list_empty(&mirror->pg_list)) {
+ int error = desc->pg_ops->pg_doio(desc);
+ if (error < 0)
+ desc->pg_error = error;
+- else
++ if (list_empty(&mirror->pg_list)) {
+ mirror->pg_bytes_written += mirror->pg_count;
+- }
+- if (list_empty(&mirror->pg_list)) {
+- mirror->pg_count = 0;
+- mirror->pg_base = 0;
++ mirror->pg_count = 0;
++ mirror->pg_base = 0;
++ mirror->pg_recoalesce = 0;
++ }
+ }
+ }
+
+@@ -1095,7 +1094,6 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
+
+ do {
+ list_splice_init(&mirror->pg_list, &head);
+- mirror->pg_bytes_written -= mirror->pg_count;
+ mirror->pg_count = 0;
+ mirror->pg_base = 0;
+ mirror->pg_recoalesce = 0;
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index af255109c5bf9..c900cb2119bae 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1268,6 +1268,11 @@ _pnfs_return_layout(struct inode *ino)
+ {
+ struct pnfs_layout_hdr *lo = NULL;
+ struct nfs_inode *nfsi = NFS_I(ino);
++ struct pnfs_layout_range range = {
++ .iomode = IOMODE_ANY,
++ .offset = 0,
++ .length = NFS4_MAX_UINT64,
++ };
+ LIST_HEAD(tmp_list);
+ nfs4_stateid stateid;
+ int status = 0;
+@@ -1294,16 +1299,10 @@ _pnfs_return_layout(struct inode *ino)
+ }
+ valid_layout = pnfs_layout_is_valid(lo);
+ pnfs_clear_layoutcommit(ino, &tmp_list);
+- pnfs_mark_matching_lsegs_return(lo, &tmp_list, NULL, 0);
++ pnfs_mark_matching_lsegs_return(lo, &tmp_list, &range, 0);
+
+- if (NFS_SERVER(ino)->pnfs_curr_ld->return_range) {
+- struct pnfs_layout_range range = {
+- .iomode = IOMODE_ANY,
+- .offset = 0,
+- .length = NFS4_MAX_UINT64,
+- };
++ if (NFS_SERVER(ino)->pnfs_curr_ld->return_range)
+ NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo, &range);
+- }
+
+ /* Don't send a LAYOUTRETURN if list was initially empty */
+ if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) ||
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 5e705fa9a913d..bc736ea1192ad 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2564,6 +2564,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
+ void *page;
+ int rv;
+
++ /* A task may only write when it was the opener. */
++ if (file->f_cred != current_real_cred())
++ return -EPERM;
++
+ rcu_read_lock();
+ task = pid_task(proc_pid(inode), PIDTYPE_PID);
+ if (!task) {
+diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
+index 91393724e9331..1c8517320ea64 100644
+--- a/include/linux/bpf_verifier.h
++++ b/include/linux/bpf_verifier.h
+@@ -144,10 +144,11 @@ struct bpf_verifier_state_list {
+ };
+
+ /* Possible states for alu_state member. */
+-#define BPF_ALU_SANITIZE_SRC 1U
+-#define BPF_ALU_SANITIZE_DST 2U
++#define BPF_ALU_SANITIZE_SRC (1U << 0)
++#define BPF_ALU_SANITIZE_DST (1U << 1)
+ #define BPF_ALU_NEG_VALUE (1U << 2)
+ #define BPF_ALU_NON_POINTER (1U << 3)
++#define BPF_ALU_IMMEDIATE (1U << 4)
+ #define BPF_ALU_SANITIZE (BPF_ALU_SANITIZE_SRC | \
+ BPF_ALU_SANITIZE_DST)
+
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index cae7fd6804488..c129c1c14c5f2 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -124,7 +124,7 @@ void free_huge_page(struct page *page);
+ void hugetlb_fix_reserve_counts(struct inode *inode);
+ extern struct mutex *hugetlb_fault_mutex_table;
+ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
+- pgoff_t idx, unsigned long address);
++ pgoff_t idx);
+
+ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud);
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index ae936cd5567e0..b96debd18e142 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4605,7 +4605,7 @@ unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
+ */
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+ const u8 *addr, enum nl80211_iftype iftype,
+- u8 data_offset);
++ u8 data_offset, bool is_amsdu);
+
+ /**
+ * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3
+@@ -4617,7 +4617,7 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+ static inline int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
+ enum nl80211_iftype iftype)
+ {
+- return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype, 0);
++ return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype, 0, false);
+ }
+
+ /**
+diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
+index df5c69db68afc..e67564af6f934 100644
+--- a/include/net/nfc/nci_core.h
++++ b/include/net/nfc/nci_core.h
+@@ -310,6 +310,7 @@ int nci_nfcc_loopback(struct nci_dev *ndev, void *data, size_t data_len,
+ struct sk_buff **resp);
+
+ struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev);
++void nci_hci_deallocate(struct nci_dev *ndev);
+ int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event,
+ const u8 *param, size_t param_len);
+ int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate,
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index f49f84b71a6bc..1f4c88ce58deb 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -2729,37 +2729,43 @@ static struct bpf_insn_aux_data *cur_aux(struct bpf_verifier_env *env)
+ return &env->insn_aux_data[env->insn_idx];
+ }
+
++enum {
++ REASON_BOUNDS = -1,
++ REASON_TYPE = -2,
++ REASON_PATHS = -3,
++ REASON_LIMIT = -4,
++ REASON_STACK = -5,
++};
++
+ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
+- u32 *ptr_limit, u8 opcode, bool off_is_neg)
++ u32 *alu_limit, bool mask_to_left)
+ {
+- bool mask_to_left = (opcode == BPF_ADD && off_is_neg) ||
+- (opcode == BPF_SUB && !off_is_neg);
+- u32 off, max;
++ u32 max = 0, ptr_limit = 0;
+
+ switch (ptr_reg->type) {
+ case PTR_TO_STACK:
+ /* Offset 0 is out-of-bounds, but acceptable start for the
+- * left direction, see BPF_REG_FP.
++ * left direction, see BPF_REG_FP. Also, unknown scalar
++ * offset where we would need to deal with min/max bounds is
++ * currently prohibited for unprivileged.
+ */
+ max = MAX_BPF_STACK + mask_to_left;
+- off = ptr_reg->off + ptr_reg->var_off.value;
+- if (mask_to_left)
+- *ptr_limit = MAX_BPF_STACK + off;
+- else
+- *ptr_limit = -off - 1;
+- return *ptr_limit >= max ? -ERANGE : 0;
++ ptr_limit = -(ptr_reg->var_off.value + ptr_reg->off);
++ break;
+ case PTR_TO_MAP_VALUE:
+ max = ptr_reg->map_ptr->value_size;
+- if (mask_to_left) {
+- *ptr_limit = ptr_reg->umax_value + ptr_reg->off;
+- } else {
+- off = ptr_reg->smin_value + ptr_reg->off;
+- *ptr_limit = ptr_reg->map_ptr->value_size - off - 1;
+- }
+- return *ptr_limit >= max ? -ERANGE : 0;
++ ptr_limit = (mask_to_left ?
++ ptr_reg->smin_value :
++ ptr_reg->umax_value) + ptr_reg->off;
++ break;
+ default:
+- return -EINVAL;
++ return REASON_TYPE;
+ }
++
++ if (ptr_limit >= max)
++ return REASON_LIMIT;
++ *alu_limit = ptr_limit;
++ return 0;
+ }
+
+ static bool can_skip_alu_sanitation(const struct bpf_verifier_env *env,
+@@ -2777,7 +2783,7 @@ static int update_alu_sanitation_state(struct bpf_insn_aux_data *aux,
+ if (aux->alu_state &&
+ (aux->alu_state != alu_state ||
+ aux->alu_limit != alu_limit))
+- return -EACCES;
++ return REASON_PATHS;
+
+ /* Corresponding fixup done in fixup_bpf_calls(). */
+ aux->alu_state = alu_state;
+@@ -2796,14 +2802,28 @@ static int sanitize_val_alu(struct bpf_verifier_env *env,
+ return update_alu_sanitation_state(aux, BPF_ALU_NON_POINTER, 0);
+ }
+
++static bool sanitize_needed(u8 opcode)
++{
++ return opcode == BPF_ADD || opcode == BPF_SUB;
++}
++
++struct bpf_sanitize_info {
++ struct bpf_insn_aux_data aux;
++ bool mask_to_left;
++};
++
+ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
+ struct bpf_insn *insn,
+ const struct bpf_reg_state *ptr_reg,
++ const struct bpf_reg_state *off_reg,
+ struct bpf_reg_state *dst_reg,
+- bool off_is_neg)
++ struct bpf_sanitize_info *info,
++ const bool commit_window)
+ {
++ struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : &info->aux;
+ struct bpf_verifier_state *vstate = env->cur_state;
+- struct bpf_insn_aux_data *aux = cur_aux(env);
++ bool off_is_imm = tnum_is_const(off_reg->var_off);
++ bool off_is_neg = off_reg->smin_value < 0;
+ bool ptr_is_dst_reg = ptr_reg == dst_reg;
+ u8 opcode = BPF_OP(insn->code);
+ u32 alu_state, alu_limit;
+@@ -2821,18 +2841,47 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
+ if (vstate->speculative)
+ goto do_sim;
+
+- alu_state = off_is_neg ? BPF_ALU_NEG_VALUE : 0;
+- alu_state |= ptr_is_dst_reg ?
+- BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST;
++ if (!commit_window) {
++ if (!tnum_is_const(off_reg->var_off) &&
++ (off_reg->smin_value < 0) != (off_reg->smax_value < 0))
++ return REASON_BOUNDS;
++
++ info->mask_to_left = (opcode == BPF_ADD && off_is_neg) ||
++ (opcode == BPF_SUB && !off_is_neg);
++ }
+
+- err = retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg);
++ err = retrieve_ptr_limit(ptr_reg, &alu_limit, info->mask_to_left);
+ if (err < 0)
+ return err;
+
++ if (commit_window) {
++ /* In commit phase we narrow the masking window based on
++ * the observed pointer move after the simulated operation.
++ */
++ alu_state = info->aux.alu_state;
++ alu_limit = abs(info->aux.alu_limit - alu_limit);
++ } else {
++ alu_state = off_is_neg ? BPF_ALU_NEG_VALUE : 0;
++ alu_state |= off_is_imm ? BPF_ALU_IMMEDIATE : 0;
++ alu_state |= ptr_is_dst_reg ?
++ BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST;
++ }
++
+ err = update_alu_sanitation_state(aux, alu_state, alu_limit);
+ if (err < 0)
+ return err;
+ do_sim:
++ /* If we're in commit phase, we're done here given we already
++ * pushed the truncated dst_reg into the speculative verification
++ * stack.
++ *
++ * Also, when register is a known constant, we rewrite register-based
++ * operation to immediate-based, and thus do not need masking (and as
++ * a consequence, do not need to simulate the zero-truncation either).
++ */
++ if (commit_window || off_is_imm)
++ return 0;
++
+ /* Simulate and find potential out-of-bounds access under
+ * speculative execution from truncation as a result of
+ * masking when off was not within expected range. If off
+@@ -2849,7 +2898,81 @@ do_sim:
+ ret = push_stack(env, env->insn_idx + 1, env->insn_idx, true);
+ if (!ptr_is_dst_reg && ret)
+ *dst_reg = tmp;
+- return !ret ? -EFAULT : 0;
++ return !ret ? REASON_STACK : 0;
++}
++
++static int sanitize_err(struct bpf_verifier_env *env,
++ const struct bpf_insn *insn, int reason,
++ const struct bpf_reg_state *off_reg,
++ const struct bpf_reg_state *dst_reg)
++{
++ static const char *err = "pointer arithmetic with it prohibited for !root";
++ const char *op = BPF_OP(insn->code) == BPF_ADD ? "add" : "sub";
++ u32 dst = insn->dst_reg, src = insn->src_reg;
++
++ switch (reason) {
++ case REASON_BOUNDS:
++ verbose(env, "R%d has unknown scalar with mixed signed bounds, %s\n",
++ off_reg == dst_reg ? dst : src, err);
++ break;
++ case REASON_TYPE:
++ verbose(env, "R%d has pointer with unsupported alu operation, %s\n",
++ off_reg == dst_reg ? src : dst, err);
++ break;
++ case REASON_PATHS:
++ verbose(env, "R%d tried to %s from different maps, paths or scalars, %s\n",
++ dst, op, err);
++ break;
++ case REASON_LIMIT:
++ verbose(env, "R%d tried to %s beyond pointer bounds, %s\n",
++ dst, op, err);
++ break;
++ case REASON_STACK:
++ verbose(env, "R%d could not be pushed for speculative verification, %s\n",
++ dst, err);
++ break;
++ default:
++ verbose(env, "verifier internal error: unknown reason (%d)\n",
++ reason);
++ break;
++ }
++
++ return -EACCES;
++}
++
++static int sanitize_check_bounds(struct bpf_verifier_env *env,
++ const struct bpf_insn *insn,
++ const struct bpf_reg_state *dst_reg)
++{
++ u32 dst = insn->dst_reg;
++
++ /* For unprivileged we require that resulting offset must be in bounds
++ * in order to be able to sanitize access later on.
++ */
++ if (env->allow_ptr_leaks)
++ return 0;
++
++ switch (dst_reg->type) {
++ case PTR_TO_STACK:
++ if (check_stack_access(env, dst_reg, dst_reg->off +
++ dst_reg->var_off.value, 1)) {
++ verbose(env, "R%d stack pointer arithmetic goes out of range, "
++ "prohibited for !root\n", dst);
++ return -EACCES;
++ }
++ break;
++ case PTR_TO_MAP_VALUE:
++ if (check_map_access(env, dst, dst_reg->off, 1, false)) {
++ verbose(env, "R%d pointer arithmetic of map value goes out of range, "
++ "prohibited for !root\n", dst);
++ return -EACCES;
++ }
++ break;
++ default:
++ break;
++ }
++
++ return 0;
+ }
+
+ /* Handles arithmetic on a pointer and a scalar: computes new min/max and var_off.
+@@ -2870,8 +2993,9 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value;
+ u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value,
+ umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value;
+- u32 dst = insn->dst_reg, src = insn->src_reg;
++ struct bpf_sanitize_info info = {};
+ u8 opcode = BPF_OP(insn->code);
++ u32 dst = insn->dst_reg;
+ int ret;
+
+ dst_reg = ®s[dst];
+@@ -2908,12 +3032,6 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ dst);
+ return -EACCES;
+ }
+- if (ptr_reg->type == PTR_TO_MAP_VALUE &&
+- !env->allow_ptr_leaks && !known && (smin_val < 0) != (smax_val < 0)) {
+- verbose(env, "R%d has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root\n",
+- off_reg == dst_reg ? dst : src);
+- return -EACCES;
+- }
+
+ /* In case of 'scalar += pointer', dst_reg inherits pointer type and id.
+ * The id may be overwritten later if we create a new variable offset.
+@@ -2925,13 +3043,15 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ !check_reg_sane_offset(env, ptr_reg, ptr_reg->type))
+ return -EINVAL;
+
++ if (sanitize_needed(opcode)) {
++ ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg,
++ &info, false);
++ if (ret < 0)
++ return sanitize_err(env, insn, ret, off_reg, dst_reg);
++ }
++
+ switch (opcode) {
+ case BPF_ADD:
+- ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
+- if (ret < 0) {
+- verbose(env, "R%d tried to add from different maps, paths, or prohibited types\n", dst);
+- return ret;
+- }
+ /* We can take a fixed offset as long as it doesn't overflow
+ * the s32 'off' field
+ */
+@@ -2982,11 +3102,6 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ }
+ break;
+ case BPF_SUB:
+- ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
+- if (ret < 0) {
+- verbose(env, "R%d tried to sub from different maps, paths, or prohibited types\n", dst);
+- return ret;
+- }
+ if (dst_reg == off_reg) {
+ /* scalar -= pointer. Creates an unknown scalar */
+ verbose(env, "R%d tried to subtract pointer from scalar\n",
+@@ -3067,22 +3182,13 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+ __reg_deduce_bounds(dst_reg);
+ __reg_bound_offset(dst_reg);
+
+- /* For unprivileged we require that resulting offset must be in bounds
+- * in order to be able to sanitize access later on.
+- */
+- if (!env->allow_ptr_leaks) {
+- if (dst_reg->type == PTR_TO_MAP_VALUE &&
+- check_map_access(env, dst, dst_reg->off, 1, false)) {
+- verbose(env, "R%d pointer arithmetic of map value goes out of range, "
+- "prohibited for !root\n", dst);
+- return -EACCES;
+- } else if (dst_reg->type == PTR_TO_STACK &&
+- check_stack_access(env, dst_reg, dst_reg->off +
+- dst_reg->var_off.value, 1)) {
+- verbose(env, "R%d stack pointer arithmetic goes out of range, "
+- "prohibited for !root\n", dst);
+- return -EACCES;
+- }
++ if (sanitize_check_bounds(env, insn, dst_reg) < 0)
++ return -EACCES;
++ if (sanitize_needed(opcode)) {
++ ret = sanitize_ptr_alu(env, insn, dst_reg, off_reg, dst_reg,
++ &info, true);
++ if (ret < 0)
++ return sanitize_err(env, insn, ret, off_reg, dst_reg);
+ }
+
+ return 0;
+@@ -3103,7 +3209,6 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ s64 smin_val, smax_val;
+ u64 umin_val, umax_val;
+ u64 insn_bitness = (BPF_CLASS(insn->code) == BPF_ALU64) ? 64 : 32;
+- u32 dst = insn->dst_reg;
+ int ret;
+
+ if (insn_bitness == 32) {
+@@ -3137,13 +3242,14 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ return 0;
+ }
+
++ if (sanitize_needed(opcode)) {
++ ret = sanitize_val_alu(env, insn);
++ if (ret < 0)
++ return sanitize_err(env, insn, ret, NULL, NULL);
++ }
++
+ switch (opcode) {
+ case BPF_ADD:
+- ret = sanitize_val_alu(env, insn);
+- if (ret < 0) {
+- verbose(env, "R%d tried to add from different pointers or scalars\n", dst);
+- return ret;
+- }
+ if (signed_add_overflows(dst_reg->smin_value, smin_val) ||
+ signed_add_overflows(dst_reg->smax_value, smax_val)) {
+ dst_reg->smin_value = S64_MIN;
+@@ -3163,11 +3269,6 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ dst_reg->var_off = tnum_add(dst_reg->var_off, src_reg.var_off);
+ break;
+ case BPF_SUB:
+- ret = sanitize_val_alu(env, insn);
+- if (ret < 0) {
+- verbose(env, "R%d tried to sub from different pointers or scalars\n", dst);
+- return ret;
+- }
+ if (signed_sub_overflows(dst_reg->smin_value, smax_val) ||
+ signed_sub_overflows(dst_reg->smax_value, smin_val)) {
+ /* Overflow possible, we know nothing */
+@@ -4127,8 +4228,9 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *this_branch = env->cur_state;
+ struct bpf_verifier_state *other_branch;
+ struct bpf_reg_state *regs = this_branch->frame[this_branch->curframe]->regs;
+- struct bpf_reg_state *dst_reg, *other_branch_regs;
++ struct bpf_reg_state *dst_reg, *other_branch_regs, *src_reg = NULL;
+ u8 opcode = BPF_OP(insn->code);
++ int pred = -1;
+ int err;
+
+ if (opcode > BPF_JSLE) {
+@@ -4152,6 +4254,7 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,
+ insn->src_reg);
+ return -EACCES;
+ }
++ src_reg = ®s[insn->src_reg];
+ } else {
+ if (insn->src_reg != BPF_REG_0) {
+ verbose(env, "BPF_JMP uses reserved fields\n");
+@@ -4166,19 +4269,21 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,
+
+ dst_reg = ®s[insn->dst_reg];
+
+- if (BPF_SRC(insn->code) == BPF_K) {
+- int pred = is_branch_taken(dst_reg, insn->imm, opcode);
+-
+- if (pred == 1) {
+- /* only follow the goto, ignore fall-through */
+- *insn_idx += insn->off;
+- return 0;
+- } else if (pred == 0) {
+- /* only follow fall-through branch, since
+- * that's where the program will go
+- */
+- return 0;
+- }
++ if (BPF_SRC(insn->code) == BPF_K)
++ pred = is_branch_taken(dst_reg, insn->imm, opcode);
++ else if (src_reg->type == SCALAR_VALUE &&
++ tnum_is_const(src_reg->var_off))
++ pred = is_branch_taken(dst_reg, src_reg->var_off.value,
++ opcode);
++ if (pred == 1) {
++ /* only follow the goto, ignore fall-through */
++ *insn_idx += insn->off;
++ return 0;
++ } else if (pred == 0) {
++ /* only follow fall-through branch, since
++ * that's where the program will go
++ */
++ return 0;
+ }
+
+ other_branch = push_stack(env, *insn_idx + insn->off + 1, *insn_idx,
+@@ -6079,7 +6184,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
+ const u8 code_sub = BPF_ALU64 | BPF_SUB | BPF_X;
+ struct bpf_insn insn_buf[16];
+ struct bpf_insn *patch = &insn_buf[0];
+- bool issrc, isneg;
++ bool issrc, isneg, isimm;
+ u32 off_reg;
+
+ aux = &env->insn_aux_data[i + delta];
+@@ -6090,16 +6195,21 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
+ isneg = aux->alu_state & BPF_ALU_NEG_VALUE;
+ issrc = (aux->alu_state & BPF_ALU_SANITIZE) ==
+ BPF_ALU_SANITIZE_SRC;
++ isimm = aux->alu_state & BPF_ALU_IMMEDIATE;
+
+ off_reg = issrc ? insn->src_reg : insn->dst_reg;
+- if (isneg)
+- *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);
+- *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit);
+- *patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg);
+- *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);
+- *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);
+- *patch++ = BPF_ALU64_IMM(BPF_ARSH, BPF_REG_AX, 63);
+- *patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX, off_reg);
++ if (isimm) {
++ *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit);
++ } else {
++ if (isneg)
++ *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);
++ *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit);
++ *patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg);
++ *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);
++ *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);
++ *patch++ = BPF_ALU64_IMM(BPF_ARSH, BPF_REG_AX, 63);
++ *patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX, off_reg);
++ }
+ if (!issrc)
+ *patch++ = BPF_MOV64_REG(insn->dst_reg, insn->src_reg);
+ insn->src_reg = BPF_REG_AX;
+@@ -6107,7 +6217,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
+ insn->code = insn->code == code_add ?
+ code_sub : code_add;
+ *patch++ = *insn;
+- if (issrc && isneg)
++ if (issrc && isneg && !isimm)
+ *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);
+ cnt = patch - insn_buf;
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 1dfaec50ff933..2f769a6615688 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3862,7 +3862,7 @@ retry:
+ * handling userfault. Reacquire after handling
+ * fault to make calling code simpler.
+ */
+- hash = hugetlb_fault_mutex_hash(h, mapping, idx, haddr);
++ hash = hugetlb_fault_mutex_hash(h, mapping, idx);
+ mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ ret = handle_userfault(&vmf, VM_UFFD_MISSING);
+ mutex_lock(&hugetlb_fault_mutex_table[hash]);
+@@ -3971,7 +3971,7 @@ backout_unlocked:
+
+ #ifdef CONFIG_SMP
+ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
+- pgoff_t idx, unsigned long address)
++ pgoff_t idx)
+ {
+ unsigned long key[2];
+ u32 hash;
+@@ -3979,7 +3979,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
+ key[0] = (unsigned long) mapping;
+ key[1] = idx;
+
+- hash = jhash2((u32 *)&key, sizeof(key)/sizeof(u32), 0);
++ hash = jhash2((u32 *)&key, sizeof(key)/(sizeof(u32)), 0);
+
+ return hash & (num_fault_mutexes - 1);
+ }
+@@ -3989,7 +3989,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
+ * return 0 and avoid the hashing overhead.
+ */
+ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
+- pgoff_t idx, unsigned long address)
++ pgoff_t idx)
+ {
+ return 0;
+ }
+@@ -4033,7 +4033,7 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ * get spurious allocation failures if two CPUs race to instantiate
+ * the same page in the page cache.
+ */
+- hash = hugetlb_fault_mutex_hash(h, mapping, idx, haddr);
++ hash = hugetlb_fault_mutex_hash(h, mapping, idx);
+ mutex_lock(&hugetlb_fault_mutex_table[hash]);
+
+ entry = huge_ptep_get(ptep);
+diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
+index 7529d3fcc8999..93a12cc107c98 100644
+--- a/mm/userfaultfd.c
++++ b/mm/userfaultfd.c
+@@ -271,7 +271,7 @@ retry:
+ */
+ idx = linear_page_index(dst_vma, dst_addr);
+ mapping = dst_vma->vm_file->f_mapping;
+- hash = hugetlb_fault_mutex_hash(h, mapping, idx, dst_addr);
++ hash = hugetlb_fault_mutex_hash(h, mapping, idx);
+ mutex_lock(&hugetlb_fault_mutex_table[hash]);
+
+ err = -ENOMEM;
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index ce81b0a7d0186..21e07e71ea2df 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -1384,6 +1384,9 @@ static void pagetypeinfo_showfree_print(struct seq_file *m,
+ list_for_each(curr, &area->free_list[mtype])
+ freecount++;
+ seq_printf(m, "%6lu ", freecount);
++ spin_unlock_irq(&zone->lock);
++ cond_resched();
++ spin_lock_irq(&zone->lock);
+ }
+ seq_putc(m, '\n');
+ }
+diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
+index 7f26a5a19ff6d..9873684a9d8ff 100644
+--- a/net/bluetooth/cmtp/core.c
++++ b/net/bluetooth/cmtp/core.c
+@@ -391,6 +391,11 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
+ if (!(session->flags & BIT(CMTP_LOOPBACK))) {
+ err = cmtp_attach_device(session);
+ if (err < 0) {
++ /* Caller will call fput in case of failure, and so
++ * will cmtp_session kthread.
++ */
++ get_file(session->sock->file);
++
+ atomic_inc(&session->terminate);
+ wake_up_interruptible(sk_sleep(session->sock->sk));
+ up_write(&cmtp_session_sem);
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 6272570fe1396..01561268d2166 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3020,6 +3020,7 @@ static inline int __bpf_skb_change_head(struct sk_buff *skb, u32 head_room,
+ __skb_push(skb, head_room);
+ memset(skb->data, 0, head_room);
+ skb_reset_mac_header(skb);
++ skb_reset_mac_len(skb);
+ }
+
+ return ret;
+diff --git a/net/dsa/master.c b/net/dsa/master.c
+index aae478d611018..22e9ce6e51a48 100644
+--- a/net/dsa/master.c
++++ b/net/dsa/master.c
+@@ -87,8 +87,7 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset,
+ struct dsa_switch *ds = cpu_dp->ds;
+ int port = cpu_dp->index;
+ int len = ETH_GSTRING_LEN;
+- int mcount = 0, count;
+- unsigned int i;
++ int mcount = 0, count, i;
+ uint8_t pfx[4];
+ uint8_t *ndata;
+
+@@ -118,6 +117,8 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset,
+ */
+ ds->ops->get_strings(ds, port, stringset, ndata);
+ count = ds->ops->get_sset_count(ds, port, stringset);
++ if (count < 0)
++ return;
+ for (i = 0; i < count; i++) {
+ memmove(ndata + (i * len + sizeof(pfx)),
+ ndata + i * len, len - sizeof(pfx));
+diff --git a/net/dsa/slave.c b/net/dsa/slave.c
+index 11f1560de6391..b887d9edb9c38 100644
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -598,13 +598,15 @@ static int dsa_slave_get_sset_count(struct net_device *dev, int sset)
+ struct dsa_switch *ds = dp->ds;
+
+ if (sset == ETH_SS_STATS) {
+- int count;
++ int count = 0;
+
+- count = 4;
+- if (ds->ops->get_sset_count)
+- count += ds->ops->get_sset_count(ds, dp->index, sset);
++ if (ds->ops->get_sset_count) {
++ count = ds->ops->get_sset_count(ds, dp->index, sset);
++ if (count < 0)
++ return count;
++ }
+
+- return count;
++ return count + 4;
+ }
+
+ return -EOPNOTSUPP;
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index f2f8551416c33..3d048401141f3 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -1606,10 +1606,7 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu)
+ IPV6_TLV_PADN, 0 };
+
+ /* we assume size > sizeof(ra) here */
+- /* limit our allocations to order-0 page */
+- size = min_t(int, size, SKB_MAX_ORDER(0, 0));
+ skb = sock_alloc_send_skb(sk, size, 1, &err);
+-
+ if (!skb)
+ return NULL;
+
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index c6132e39ab16b..60dfd0d118512 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -347,7 +347,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
+ hdr = ipv6_hdr(skb);
+ fhdr = (struct frag_hdr *)skb_transport_header(skb);
+
+- if (!(fhdr->frag_off & htons(0xFFF9))) {
++ if (!(fhdr->frag_off & htons(IP6_OFFSET | IP6_MF))) {
+ /* It is not a fragmented frame */
+ skb->transport_header += sizeof(struct frag_hdr);
+ __IP6_INC_STATS(net,
+@@ -355,6 +355,8 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
+
+ IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
+ IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
++ IP6CB(skb)->frag_max_size = ntohs(hdr->payload_len) +
++ sizeof(struct ipv6hdr);
+ return 1;
+ }
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index fc715bba59146..6c9d9c94983ba 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -53,12 +53,6 @@ struct ieee80211_local;
+ #define IEEE80211_ENCRYPT_HEADROOM 8
+ #define IEEE80211_ENCRYPT_TAILROOM 18
+
+-/* IEEE 802.11 (Ch. 9.5 Defragmentation) requires support for concurrent
+- * reception of at least three fragmented frames. This limit can be increased
+- * by changing this define, at the cost of slower frame reassembly and
+- * increased memory use (about 2 kB of RAM per entry). */
+-#define IEEE80211_FRAGMENT_MAX 4
+-
+ /* power level hasn't been configured (or set to automatic) */
+ #define IEEE80211_UNSET_POWER_LEVEL INT_MIN
+
+@@ -91,18 +85,6 @@ extern const u8 ieee80211_ac_to_qos_mask[IEEE80211_NUM_ACS];
+
+ #define IEEE80211_MAX_NAN_INSTANCE_ID 255
+
+-struct ieee80211_fragment_entry {
+- struct sk_buff_head skb_list;
+- unsigned long first_frag_time;
+- u16 seq;
+- u16 extra_len;
+- u16 last_frag;
+- u8 rx_queue;
+- bool check_sequential_pn; /* needed for CCMP/GCMP */
+- u8 last_pn[6]; /* PN of the last fragment if CCMP was used */
+-};
+-
+-
+ struct ieee80211_bss {
+ u32 device_ts_beacon, device_ts_presp;
+
+@@ -243,8 +225,15 @@ struct ieee80211_rx_data {
+ */
+ int security_idx;
+
+- u32 tkip_iv32;
+- u16 tkip_iv16;
++ union {
++ struct {
++ u32 iv32;
++ u16 iv16;
++ } tkip;
++ struct {
++ u8 pn[IEEE80211_CCMP_PN_LEN];
++ } ccm_gcm;
++ };
+ };
+
+ struct ieee80211_csa_settings {
+@@ -884,9 +873,7 @@ struct ieee80211_sub_if_data {
+
+ char name[IFNAMSIZ];
+
+- /* Fragment table for host-based reassembly */
+- struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX];
+- unsigned int fragment_next;
++ struct ieee80211_fragment_cache frags;
+
+ /* TID bitmap for NoAck policy */
+ u16 noack_map;
+@@ -2204,4 +2191,7 @@ extern const struct ethtool_ops ieee80211_ethtool_ops;
+ #define debug_noinline
+ #endif
+
++void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache);
++void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache);
++
+ #endif /* IEEE80211_I_H */
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 511ca6f74239d..358028a09ce4d 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -7,7 +7,7 @@
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
+ * Copyright (c) 2016 Intel Deutschland GmbH
+- * Copyright (C) 2018 Intel Corporation
++ * Copyright (C) 2018-2021 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -1111,16 +1111,12 @@ static void ieee80211_set_multicast_list(struct net_device *dev)
+ */
+ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
+ {
+- int i;
+-
+ /* free extra data */
+ ieee80211_free_keys(sdata, false);
+
+ ieee80211_debugfs_remove_netdev(sdata);
+
+- for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
+- __skb_queue_purge(&sdata->fragments[i].skb_list);
+- sdata->fragment_next = 0;
++ ieee80211_destroy_frag_cache(&sdata->frags);
+
+ if (ieee80211_vif_is_mesh(&sdata->vif))
+ ieee80211_mesh_teardown_sdata(sdata);
+@@ -1832,8 +1828,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
+ sdata->wdev.wiphy = local->hw.wiphy;
+ sdata->local = local;
+
+- for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
+- skb_queue_head_init(&sdata->fragments[i].skb_list);
++ ieee80211_init_frag_cache(&sdata->frags);
+
+ INIT_LIST_HEAD(&sdata->key_list);
+
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index f20bb39f492da..6775d6cb7d3d4 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -653,6 +653,7 @@ int ieee80211_key_link(struct ieee80211_key *key,
+ struct ieee80211_sub_if_data *sdata,
+ struct sta_info *sta)
+ {
++ static atomic_t key_color = ATOMIC_INIT(0);
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_key *old_key;
+ int idx = key->conf.keyidx;
+@@ -688,6 +689,12 @@ int ieee80211_key_link(struct ieee80211_key *key,
+ key->sdata = sdata;
+ key->sta = sta;
+
++ /*
++ * Assign a unique ID to every key so we can easily prevent mixed
++ * key and fragment cache attacks.
++ */
++ key->color = atomic_inc_return(&key_color);
++
+ increment_tailroom_need_count(sdata);
+
+ ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
+diff --git a/net/mac80211/key.h b/net/mac80211/key.h
+index ebdb80b85dc3a..d8e187bcb7510 100644
+--- a/net/mac80211/key.h
++++ b/net/mac80211/key.h
+@@ -127,6 +127,8 @@ struct ieee80211_key {
+ } debugfs;
+ #endif
+
++ unsigned int color;
++
+ /*
+ * key config, must be last because it contains key
+ * material as variable length member
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 9e92e5e2336be..2ba19decb1261 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -5,7 +5,7 @@
+ * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+- * Copyright (C) 2018 Intel Corporation
++ * Copyright (C) 2018-2021 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -2009,19 +2009,34 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
+ return result;
+ }
+
++void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache)
++{
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
++ skb_queue_head_init(&cache->entries[i].skb_list);
++}
++
++void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache)
++{
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
++ __skb_queue_purge(&cache->entries[i].skb_list);
++}
++
+ static inline struct ieee80211_fragment_entry *
+-ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
++ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache,
+ unsigned int frag, unsigned int seq, int rx_queue,
+ struct sk_buff **skb)
+ {
+ struct ieee80211_fragment_entry *entry;
+
+- entry = &sdata->fragments[sdata->fragment_next++];
+- if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
+- sdata->fragment_next = 0;
++ entry = &cache->entries[cache->next++];
++ if (cache->next >= IEEE80211_FRAGMENT_MAX)
++ cache->next = 0;
+
+- if (!skb_queue_empty(&entry->skb_list))
+- __skb_queue_purge(&entry->skb_list);
++ __skb_queue_purge(&entry->skb_list);
+
+ __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
+ *skb = NULL;
+@@ -2036,14 +2051,14 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
+ }
+
+ static inline struct ieee80211_fragment_entry *
+-ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
++ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache,
+ unsigned int frag, unsigned int seq,
+ int rx_queue, struct ieee80211_hdr *hdr)
+ {
+ struct ieee80211_fragment_entry *entry;
+ int i, idx;
+
+- idx = sdata->fragment_next;
++ idx = cache->next;
+ for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
+ struct ieee80211_hdr *f_hdr;
+
+@@ -2051,7 +2066,7 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
+ if (idx < 0)
+ idx = IEEE80211_FRAGMENT_MAX - 1;
+
+- entry = &sdata->fragments[idx];
++ entry = &cache->entries[idx];
+ if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
+ entry->rx_queue != rx_queue ||
+ entry->last_frag + 1 != frag)
+@@ -2078,15 +2093,27 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
+ return NULL;
+ }
+
++static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)
++{
++ return rx->key &&
++ (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
++ ieee80211_has_protected(fc);
++}
++
+ static ieee80211_rx_result debug_noinline
+ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ {
++ struct ieee80211_fragment_cache *cache = &rx->sdata->frags;
+ struct ieee80211_hdr *hdr;
+ u16 sc;
+ __le16 fc;
+ unsigned int frag, seq;
+ struct ieee80211_fragment_entry *entry;
+ struct sk_buff *skb;
++ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
+
+ hdr = (struct ieee80211_hdr *)rx->skb->data;
+ fc = hdr->frame_control;
+@@ -2102,6 +2129,9 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ goto out_no_led;
+ }
+
++ if (rx->sta)
++ cache = &rx->sta->frags;
++
+ if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
+ goto out;
+
+@@ -2120,20 +2150,17 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+
+ if (frag == 0) {
+ /* This is the first fragment of a new frame. */
+- entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
++ entry = ieee80211_reassemble_add(cache, frag, seq,
+ rx->seqno_idx, &(rx->skb));
+- if (rx->key &&
+- (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
+- rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
+- rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
+- rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
+- ieee80211_has_protected(fc)) {
++ if (requires_sequential_pn(rx, fc)) {
+ int queue = rx->security_idx;
+
+ /* Store CCMP/GCMP PN so that we can verify that the
+ * next fragment has a sequential PN value.
+ */
+ entry->check_sequential_pn = true;
++ entry->is_protected = true;
++ entry->key_color = rx->key->color;
+ memcpy(entry->last_pn,
+ rx->key->u.ccmp.rx_pn[queue],
+ IEEE80211_CCMP_PN_LEN);
+@@ -2145,6 +2172,11 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ sizeof(rx->key->u.gcmp.rx_pn[queue]));
+ BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
+ IEEE80211_GCMP_PN_LEN);
++ } else if (rx->key &&
++ (ieee80211_has_protected(fc) ||
++ (status->flag & RX_FLAG_DECRYPTED))) {
++ entry->is_protected = true;
++ entry->key_color = rx->key->color;
+ }
+ return RX_QUEUED;
+ }
+@@ -2152,7 +2184,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ /* This is a fragment for a frame that should already be pending in
+ * fragment cache. Add this fragment to the end of the pending entry.
+ */
+- entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
++ entry = ieee80211_reassemble_find(cache, frag, seq,
+ rx->seqno_idx, hdr);
+ if (!entry) {
+ I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
+@@ -2167,25 +2199,39 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ if (entry->check_sequential_pn) {
+ int i;
+ u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
+- int queue;
+
+- if (!rx->key ||
+- (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
+- rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 &&
+- rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP &&
+- rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256))
++ if (!requires_sequential_pn(rx, fc))
++ return RX_DROP_UNUSABLE;
++
++ /* Prevent mixed key and fragment cache attacks */
++ if (entry->key_color != rx->key->color)
+ return RX_DROP_UNUSABLE;
++
+ memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
+ for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
+ pn[i]++;
+ if (pn[i])
+ break;
+ }
+- queue = rx->security_idx;
+- rpn = rx->key->u.ccmp.rx_pn[queue];
++
++ rpn = rx->ccm_gcm.pn;
+ if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
+ return RX_DROP_UNUSABLE;
+ memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
++ } else if (entry->is_protected &&
++ (!rx->key ||
++ (!ieee80211_has_protected(fc) &&
++ !(status->flag & RX_FLAG_DECRYPTED)) ||
++ rx->key->color != entry->key_color)) {
++ /* Drop this as a mixed key or fragment cache attack, even
++ * if for TKIP Michael MIC should protect us, and WEP is a
++ * lost cause anyway.
++ */
++ return RX_DROP_UNUSABLE;
++ } else if (entry->is_protected && rx->key &&
++ entry->key_color != rx->key->color &&
++ (status->flag & RX_FLAG_DECRYPTED)) {
++ return RX_DROP_UNUSABLE;
+ }
+
+ skb_pull(rx->skb, ieee80211_hdrlen(fc));
+@@ -2371,13 +2417,13 @@ static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
+ struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
+
+ /*
+- * Allow EAPOL frames to us/the PAE group address regardless
+- * of whether the frame was encrypted or not.
++ * Allow EAPOL frames to us/the PAE group address regardless of
++ * whether the frame was encrypted or not, and always disallow
++ * all other destination addresses for them.
+ */
+- if (ehdr->h_proto == rx->sdata->control_port_protocol &&
+- (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
+- ether_addr_equal(ehdr->h_dest, pae_group_addr)))
+- return true;
++ if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol))
++ return ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
++ ether_addr_equal(ehdr->h_dest, pae_group_addr);
+
+ if (ieee80211_802_1x_port_control(rx) ||
+ ieee80211_drop_unencrypted(rx, fc))
+@@ -2401,8 +2447,28 @@ static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
+ cfg80211_rx_control_port(dev, skb, noencrypt);
+ dev_kfree_skb(skb);
+ } else {
++ struct ethhdr *ehdr = (void *)skb_mac_header(skb);
++
+ memset(skb->cb, 0, sizeof(skb->cb));
+
++ /*
++ * 802.1X over 802.11 requires that the authenticator address
++ * be used for EAPOL frames. However, 802.1X allows the use of
++ * the PAE group address instead. If the interface is part of
++ * a bridge and we pass the frame with the PAE group address,
++ * then the bridge will forward it to the network (even if the
++ * client was not associated yet), which isn't supposed to
++ * happen.
++ * To avoid that, rewrite the destination address to our own
++ * address, so that the authenticator (e.g. hostapd) will see
++ * the frame, but bridge won't forward it anywhere else. Note
++ * that due to earlier filtering, the only other address can
++ * be the PAE group address.
++ */
++ if (unlikely(skb->protocol == sdata->control_port_protocol &&
++ !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
++ ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
++
+ /* deliver to local stack */
+ if (rx->napi)
+ napi_gro_receive(rx->napi, skb);
+@@ -2442,6 +2508,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
+ if ((sdata->vif.type == NL80211_IFTYPE_AP ||
+ sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
+ !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
++ ehdr->h_proto != rx->sdata->control_port_protocol &&
+ (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
+ if (is_multicast_ether_addr(ehdr->h_dest) &&
+ ieee80211_vif_get_num_mcast_if(sdata) != 0) {
+@@ -2550,7 +2617,7 @@ __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
+ if (ieee80211_data_to_8023_exthdr(skb, ðhdr,
+ rx->sdata->vif.addr,
+ rx->sdata->vif.type,
+- data_offset))
++ data_offset, true))
+ return RX_DROP_UNUSABLE;
+
+ ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
+@@ -2607,6 +2674,23 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
+ if (is_multicast_ether_addr(hdr->addr1))
+ return RX_DROP_UNUSABLE;
+
++ if (rx->key) {
++ /*
++ * We should not receive A-MSDUs on pre-HT connections,
++ * and HT connections cannot use old ciphers. Thus drop
++ * them, as in those cases we couldn't even have SPP
++ * A-MSDUs or such.
++ */
++ switch (rx->key->conf.cipher) {
++ case WLAN_CIPHER_SUITE_WEP40:
++ case WLAN_CIPHER_SUITE_WEP104:
++ case WLAN_CIPHER_SUITE_TKIP:
++ return RX_DROP_UNUSABLE;
++ default:
++ break;
++ }
++ }
++
+ return __ieee80211_rx_h_amsdu(rx, 0);
+ }
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index c0fae954082b7..71c6a462277fa 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -3,7 +3,7 @@
+ * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
+ * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
+- * Copyright (C) 2018-2020 Intel Corporation
++ * Copyright (C) 2018-2021 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -369,6 +369,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
+
+ u64_stats_init(&sta->rx_stats.syncp);
+
++ ieee80211_init_frag_cache(&sta->frags);
++
+ sta->sta_state = IEEE80211_STA_NONE;
+
+ /* Mark TID as unreserved */
+@@ -1032,6 +1034,8 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
+ rate_control_remove_sta_debugfs(sta);
+ ieee80211_sta_debugfs_remove(sta);
+
++ ieee80211_destroy_frag_cache(&sta->frags);
++
+ cleanup_single_sta(sta);
+ }
+
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index 9a04327d71d1d..c33bc5fc0f2d8 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -2,6 +2,7 @@
+ * Copyright 2002-2005, Devicescape Software, Inc.
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
++ * Copyright(c) 2020-2021 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -411,6 +412,34 @@ struct ieee80211_sta_rx_stats {
+ u64 msdu[IEEE80211_NUM_TIDS + 1];
+ };
+
++/*
++ * IEEE 802.11-2016 (10.6 "Defragmentation") recommends support for "concurrent
++ * reception of at least one MSDU per access category per associated STA"
++ * on APs, or "at least one MSDU per access category" on other interface types.
++ *
++ * This limit can be increased by changing this define, at the cost of slower
++ * frame reassembly and increased memory use while fragments are pending.
++ */
++#define IEEE80211_FRAGMENT_MAX 4
++
++struct ieee80211_fragment_entry {
++ struct sk_buff_head skb_list;
++ unsigned long first_frag_time;
++ u16 seq;
++ u16 extra_len;
++ u16 last_frag;
++ u8 rx_queue;
++ u8 check_sequential_pn:1, /* needed for CCMP/GCMP */
++ is_protected:1;
++ u8 last_pn[6]; /* PN of the last fragment if CCMP was used */
++ unsigned int key_color;
++};
++
++struct ieee80211_fragment_cache {
++ struct ieee80211_fragment_entry entries[IEEE80211_FRAGMENT_MAX];
++ unsigned int next;
++};
++
+ /*
+ * The bandwidth threshold below which the per-station CoDel parameters will be
+ * scaled to be more lenient (to prevent starvation of slow stations). This
+@@ -482,6 +511,7 @@ struct ieee80211_sta_rx_stats {
+ * @pcpu_rx_stats: per-CPU RX statistics, assigned only if the driver needs
+ * this (by advertising the USES_RSS hw flag)
+ * @status_stats: TX status statistics
++ * @frags: fragment cache
+ */
+ struct sta_info {
+ /* General information, mostly static */
+@@ -583,6 +613,8 @@ struct sta_info {
+
+ struct cfg80211_chan_def tdls_chandef;
+
++ struct ieee80211_fragment_cache frags;
++
+ /* keep last! */
+ struct ieee80211_sta sta;
+ };
+diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
+index 5dd48f0a4b1bd..dbeccccf0fdf3 100644
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -2,6 +2,7 @@
+ * Copyright 2002-2004, Instant802 Networks, Inc.
+ * Copyright 2008, Jouni Malinen <j@w1.fi>
+ * Copyright (C) 2016-2017 Intel Deutschland GmbH
++ * Copyright (C) 2020-2021 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -170,8 +171,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
+
+ update_iv:
+ /* update IV in key information to be able to detect replays */
+- rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32;
+- rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16;
++ rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip.iv32;
++ rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip.iv16;
+
+ return RX_CONTINUE;
+
+@@ -297,8 +298,8 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
+ key, skb->data + hdrlen,
+ skb->len - hdrlen, rx->sta->sta.addr,
+ hdr->addr1, hwaccel, rx->security_idx,
+- &rx->tkip_iv32,
+- &rx->tkip_iv16);
++ &rx->tkip.iv32,
++ &rx->tkip.iv16);
+ if (res != TKIP_DECRYPT_OK)
+ return RX_DROP_UNUSABLE;
+
+@@ -556,6 +557,8 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
+ }
+
+ memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
++ if (unlikely(ieee80211_is_frag(hdr)))
++ memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN);
+ }
+
+ /* Remove CCMP header and MIC */
+@@ -784,6 +787,8 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
+ }
+
+ memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN);
++ if (unlikely(ieee80211_is_frag(hdr)))
++ memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN);
+ }
+
+ /* Remove GCMP header and MIC */
+diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
+index 074960154993f..33c23af6709d4 100644
+--- a/net/nfc/nci/core.c
++++ b/net/nfc/nci/core.c
+@@ -1187,6 +1187,7 @@ EXPORT_SYMBOL(nci_allocate_device);
+ void nci_free_device(struct nci_dev *ndev)
+ {
+ nfc_free_device(ndev->nfc_dev);
++ nci_hci_deallocate(ndev);
+ kfree(ndev);
+ }
+ EXPORT_SYMBOL(nci_free_device);
+diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
+index c0d323b58e732..c972c212e7caf 100644
+--- a/net/nfc/nci/hci.c
++++ b/net/nfc/nci/hci.c
+@@ -807,3 +807,8 @@ struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev)
+
+ return hdev;
+ }
++
++void nci_hci_deallocate(struct nci_dev *ndev)
++{
++ kfree(ndev->hci_dev);
++}
+diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c
+index 5ea2471ffc03f..9b0c54f0702c0 100644
+--- a/net/openvswitch/meter.c
++++ b/net/openvswitch/meter.c
+@@ -464,6 +464,14 @@ bool ovs_meter_execute(struct datapath *dp, struct sk_buff *skb,
+ spin_lock(&meter->lock);
+
+ long_delta_ms = (now_ms - meter->used); /* ms */
++ if (long_delta_ms < 0) {
++ /* This condition means that we have several threads fighting
++ * for a meter lock, and the one who received the packets a
++ * bit later wins. Assuming that all racing threads received
++ * packets at the same time to avoid overflow.
++ */
++ long_delta_ms = 0;
++ }
+
+ /* Make sure delta_ms will not be too large, so that bucket will not
+ * wrap around below.
+diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
+index 1c2fce8c45b2d..fe030af9272c4 100644
+--- a/net/sched/sch_dsmark.c
++++ b/net/sched/sch_dsmark.c
+@@ -402,7 +402,8 @@ static void dsmark_reset(struct Qdisc *sch)
+ struct dsmark_qdisc_data *p = qdisc_priv(sch);
+
+ pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
+- qdisc_reset(p->q);
++ if (p->q)
++ qdisc_reset(p->q);
+ sch->qstats.backlog = 0;
+ sch->q.qlen = 0;
+ }
+diff --git a/net/tipc/msg.c b/net/tipc/msg.c
+index f04843ca82162..0ac2704449744 100644
+--- a/net/tipc/msg.c
++++ b/net/tipc/msg.c
+@@ -141,18 +141,13 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
+ if (unlikely(head))
+ goto err;
+ *buf = NULL;
++ if (skb_has_frag_list(frag) && __skb_linearize(frag))
++ goto err;
+ frag = skb_unshare(frag, GFP_ATOMIC);
+ if (unlikely(!frag))
+ goto err;
+ head = *headbuf = frag;
+ TIPC_SKB_CB(head)->tail = NULL;
+- if (skb_is_nonlinear(head)) {
+- skb_walk_frags(head, tail) {
+- TIPC_SKB_CB(head)->tail = tail;
+- }
+- } else {
+- skb_frag_list_init(head);
+- }
+ return 0;
+ }
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 4c35f9893081c..3c41fb8edc5f1 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -1187,7 +1187,10 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
+ spin_lock_bh(&inputq->lock);
+ if (skb_peek(arrvq) == skb) {
+ skb_queue_splice_tail_init(&tmpq, inputq);
+- __skb_dequeue(arrvq);
++ /* Decrease the skb's refcnt as increasing in the
++ * function tipc_skb_peek
++ */
++ kfree_skb(__skb_dequeue(arrvq));
+ }
+ spin_unlock_bh(&inputq->lock);
+ __skb_queue_purge(&tmpq);
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 1a878b84cbd0d..6f9cff2ee7953 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -422,7 +422,7 @@ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
+
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+ const u8 *addr, enum nl80211_iftype iftype,
+- u8 data_offset)
++ u8 data_offset, bool is_amsdu)
+ {
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+ struct {
+@@ -510,7 +510,7 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+ skb_copy_bits(skb, hdrlen, &payload, sizeof(payload));
+ tmp.h_proto = payload.proto;
+
+- if (likely((ether_addr_equal(payload.hdr, rfc1042_header) &&
++ if (likely((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) &&
+ tmp.h_proto != htons(ETH_P_AARP) &&
+ tmp.h_proto != htons(ETH_P_IPX)) ||
+ ether_addr_equal(payload.hdr, bridge_tunnel_header)))
+@@ -652,6 +652,9 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+ remaining = skb->len - offset;
+ if (subframe_len > remaining)
+ goto purge;
++ /* mitigate A-MSDU aggregation injection attacks */
++ if (ether_addr_equal(eth.h_dest, rfc1042_header))
++ goto purge;
+
+ offset += sizeof(struct ethhdr);
+ last = remaining <= subframe_len + padding;
+diff --git a/sound/soc/codecs/cs35l33.c b/sound/soc/codecs/cs35l33.c
+index 668cd3754209d..73fa784646e5a 100644
+--- a/sound/soc/codecs/cs35l33.c
++++ b/sound/soc/codecs/cs35l33.c
+@@ -1204,6 +1204,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client,
+ dev_err(&i2c_client->dev,
+ "CS35L33 Device ID (%X). Expected ID %X\n",
+ devid, CS35L33_CHIP_ID);
++ ret = -EINVAL;
+ goto err_enable;
+ }
+
+diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c
+index 80dc421971548..cf29dec28b5e3 100644
+--- a/sound/soc/codecs/cs43130.c
++++ b/sound/soc/codecs/cs43130.c
+@@ -1738,6 +1738,14 @@ static DEVICE_ATTR(hpload_dc_r, 0444, cs43130_show_dc_r, NULL);
+ static DEVICE_ATTR(hpload_ac_l, 0444, cs43130_show_ac_l, NULL);
+ static DEVICE_ATTR(hpload_ac_r, 0444, cs43130_show_ac_r, NULL);
+
++static struct attribute *hpload_attrs[] = {
++ &dev_attr_hpload_dc_l.attr,
++ &dev_attr_hpload_dc_r.attr,
++ &dev_attr_hpload_ac_l.attr,
++ &dev_attr_hpload_ac_r.attr,
++};
++ATTRIBUTE_GROUPS(hpload);
++
+ static struct reg_sequence hp_en_cal_seq[] = {
+ {CS43130_INT_MASK_4, CS43130_INT_MASK_ALL},
+ {CS43130_HP_MEAS_LOAD_1, 0},
+@@ -2305,23 +2313,15 @@ static int cs43130_probe(struct snd_soc_component *component)
+
+ cs43130->hpload_done = false;
+ if (cs43130->dc_meas) {
+- ret = device_create_file(component->dev, &dev_attr_hpload_dc_l);
+- if (ret < 0)
+- return ret;
+-
+- ret = device_create_file(component->dev, &dev_attr_hpload_dc_r);
+- if (ret < 0)
+- return ret;
+-
+- ret = device_create_file(component->dev, &dev_attr_hpload_ac_l);
+- if (ret < 0)
+- return ret;
+-
+- ret = device_create_file(component->dev, &dev_attr_hpload_ac_r);
+- if (ret < 0)
++ ret = sysfs_create_groups(&component->dev->kobj, hpload_groups);
++ if (ret)
+ return ret;
+
+ cs43130->wq = create_singlethread_workqueue("cs43130_hp");
++ if (!cs43130->wq) {
++ sysfs_remove_groups(&component->dev->kobj, hpload_groups);
++ return -ENOMEM;
++ }
+ INIT_WORK(&cs43130->work, cs43130_imp_meas);
+ }
+
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index 6631970f96832..31331c42b0e35 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -858,7 +858,7 @@ static int get_maxfds(void)
+ struct rlimit rlim;
+
+ if (getrlimit(RLIMIT_NOFILE, &rlim) == 0)
+- return min((int)rlim.rlim_max / 2, 512);
++ return min(rlim.rlim_max / 2, (rlim_t)512);
+
+ return 512;
+ }
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index e2f038f84dbc1..e2a6c22959f26 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -1063,6 +1063,8 @@ static bool intel_pt_fup_event(struct intel_pt_decoder *decoder)
+ decoder->set_fup_tx_flags = false;
+ decoder->tx_flags = decoder->fup_tx_flags;
+ decoder->state.type = INTEL_PT_TRANSACTION;
++ if (decoder->fup_tx_flags & INTEL_PT_ABORT_TX)
++ decoder->state.type |= INTEL_PT_BRANCH;
+ decoder->state.from_ip = decoder->ip;
+ decoder->state.to_ip = 0;
+ decoder->state.flags = decoder->fup_tx_flags;
+@@ -1129,8 +1131,10 @@ static int intel_pt_walk_fup(struct intel_pt_decoder *decoder)
+ return 0;
+ if (err == -EAGAIN ||
+ intel_pt_fup_with_nlip(decoder, &intel_pt_insn, ip, err)) {
++ bool no_tip = decoder->pkt_state != INTEL_PT_STATE_FUP;
++
+ decoder->pkt_state = INTEL_PT_STATE_IN_SYNC;
+- if (intel_pt_fup_event(decoder))
++ if (intel_pt_fup_event(decoder) && no_tip)
+ return 0;
+ return -EAGAIN;
+ }
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index 2434a0014491f..256b4755c0870 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -505,8 +505,10 @@ static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn,
+
+ *ip += intel_pt_insn->length;
+
+- if (to_ip && *ip == to_ip)
++ if (to_ip && *ip == to_ip) {
++ intel_pt_insn->length = 0;
+ goto out_no_cache;
++ }
+
+ if (*ip >= al.map->end)
+ break;
+@@ -893,6 +895,7 @@ static void intel_pt_set_pid_tid_cpu(struct intel_pt *pt,
+
+ static void intel_pt_sample_flags(struct intel_pt_queue *ptq)
+ {
++ ptq->insn_len = 0;
+ if (ptq->state->flags & INTEL_PT_ABORT_TX) {
+ ptq->flags = PERF_IP_FLAG_BRANCH | PERF_IP_FLAG_TX_ABORT;
+ } else if (ptq->state->flags & INTEL_PT_ASYNC) {
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index 9db5a7378f40f..e1e4b6ab83f74 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -2002,29 +2002,27 @@ static struct bpf_test tests[] = {
+ .result = ACCEPT,
+ },
+ {
+- "check skb->hash byte load not permitted 1",
++ "check skb->hash byte load permitted 1",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+ offsetof(struct __sk_buff, hash) + 1),
+ BPF_EXIT_INSN(),
+ },
+- .errstr = "invalid bpf_context access",
+- .result = REJECT,
++ .result = ACCEPT,
+ },
+ {
+- "check skb->hash byte load not permitted 2",
++ "check skb->hash byte load permitted 2",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+ offsetof(struct __sk_buff, hash) + 2),
+ BPF_EXIT_INSN(),
+ },
+- .errstr = "invalid bpf_context access",
+- .result = REJECT,
++ .result = ACCEPT,
+ },
+ {
+- "check skb->hash byte load not permitted 3",
++ "check skb->hash byte load permitted 3",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ #if __BYTE_ORDER == __LITTLE_ENDIAN
+@@ -2036,8 +2034,7 @@ static struct bpf_test tests[] = {
+ #endif
+ BPF_EXIT_INSN(),
+ },
+- .errstr = "invalid bpf_context access",
+- .result = REJECT,
++ .result = ACCEPT,
+ },
+ {
+ "check cb access: byte, wrong type",
+@@ -2149,7 +2146,7 @@ static struct bpf_test tests[] = {
+ .result = ACCEPT,
+ },
+ {
+- "check skb->hash half load not permitted",
++ "check skb->hash half load permitted 2",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ #if __BYTE_ORDER == __LITTLE_ENDIAN
+@@ -2158,6 +2155,37 @@ static struct bpf_test tests[] = {
+ #else
+ BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+ offsetof(struct __sk_buff, hash)),
++#endif
++ BPF_EXIT_INSN(),
++ },
++ .result = ACCEPT,
++ },
++ {
++ "check skb->hash half load not permitted, unaligned 1",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++#if __BYTE_ORDER == __LITTLE_ENDIAN
++ BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
++ offsetof(struct __sk_buff, hash) + 1),
++#else
++ BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
++ offsetof(struct __sk_buff, hash) + 3),
++#endif
++ BPF_EXIT_INSN(),
++ },
++ .errstr = "invalid bpf_context access",
++ .result = REJECT,
++ },
++ {
++ "check skb->hash half load not permitted, unaligned 3",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++#if __BYTE_ORDER == __LITTLE_ENDIAN
++ BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
++ offsetof(struct __sk_buff, hash) + 3),
++#else
++ BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
++ offsetof(struct __sk_buff, hash) + 1),
+ #endif
+ BPF_EXIT_INSN(),
+ },
+@@ -2448,6 +2476,7 @@ static struct bpf_test tests[] = {
+ },
+ .result = REJECT,
+ .errstr = "invalid stack off=-79992 size=8",
++ .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
+ },
+ {
+ "PTR_TO_STACK store/load - out of bounds high",
+@@ -2836,7 +2865,7 @@ static struct bpf_test tests[] = {
+ .result = ACCEPT,
+ },
+ {
+- "unpriv: adding of fp",
++ "unpriv: adding of fp, reg",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_MOV64_IMM(BPF_REG_1, 0),
+@@ -2844,6 +2873,21 @@ static struct bpf_test tests[] = {
+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
+ BPF_EXIT_INSN(),
+ },
++ .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
++ .result_unpriv = REJECT,
++ .result = ACCEPT,
++ },
++ {
++ "unpriv: adding of fp, imm",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0),
++ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
++ BPF_EXIT_INSN(),
++ },
++ .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
++ .result_unpriv = REJECT,
+ .result = ACCEPT,
+ },
+ {
+@@ -7813,7 +7857,7 @@ static struct bpf_test tests[] = {
+ BPF_JMP_IMM(BPF_JA, 0, 0, -7),
+ },
+ .fixup_map1 = { 4 },
+- .errstr = "R0 invalid mem access 'inv'",
++ .errstr = "unbounded min value",
+ .result = REJECT,
+ },
+ {
+@@ -7894,6 +7938,7 @@ static struct bpf_test tests[] = {
+ },
+ .fixup_map1 = { 3 },
+ .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
++ .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
+ .result = REJECT,
+ },
+ {
+@@ -8266,6 +8311,7 @@ static struct bpf_test tests[] = {
+ },
+ .fixup_map1 = { 3 },
+ .errstr = "pointer offset 1073741822",
++ .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+ .result = REJECT
+ },
+ {
+@@ -8287,6 +8333,7 @@ static struct bpf_test tests[] = {
+ },
+ .fixup_map1 = { 3 },
+ .errstr = "pointer offset -1073741822",
++ .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+ .result = REJECT
+ },
+ {
+@@ -8458,6 +8505,7 @@ static struct bpf_test tests[] = {
+ BPF_EXIT_INSN()
+ },
+ .errstr = "fp pointer offset 1073741822",
++ .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
+ .result = REJECT
+ },
+ {
+@@ -9739,8 +9787,9 @@ static struct bpf_test tests[] = {
+ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+ BPF_EXIT_INSN(),
+ },
+- .result = REJECT,
++ .errstr_unpriv = "R1 has pointer with unsupported alu operation",
+ .errstr = "R0 tried to subtract pointer from scalar",
++ .result = REJECT,
+ },
+ {
+ "check deducing bounds from const, 2",
+@@ -9753,6 +9802,8 @@ static struct bpf_test tests[] = {
+ BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
+ BPF_EXIT_INSN(),
+ },
++ .errstr_unpriv = "R1 has pointer with unsupported alu operation",
++ .result_unpriv = REJECT,
+ .result = ACCEPT,
+ .retval = 1,
+ },
+@@ -9764,32 +9815,37 @@ static struct bpf_test tests[] = {
+ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+ BPF_EXIT_INSN(),
+ },
+- .result = REJECT,
++ .errstr_unpriv = "R1 has pointer with unsupported alu operation",
+ .errstr = "R0 tried to subtract pointer from scalar",
++ .result = REJECT,
+ },
+ {
+ "check deducing bounds from const, 4",
+ .insns = {
++ BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
+ BPF_EXIT_INSN(),
+ BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
+ BPF_EXIT_INSN(),
+- BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
++ BPF_ALU64_REG(BPF_SUB, BPF_REG_6, BPF_REG_0),
+ BPF_EXIT_INSN(),
+ },
++ .errstr_unpriv = "R6 has pointer with unsupported alu operation",
++ .result_unpriv = REJECT,
+ .result = ACCEPT,
+ },
+ {
+ "check deducing bounds from const, 5",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+- BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
++ BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
+ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+ BPF_EXIT_INSN(),
+ },
+- .result = REJECT,
++ .errstr_unpriv = "R1 has pointer with unsupported alu operation",
+ .errstr = "R0 tried to subtract pointer from scalar",
++ .result = REJECT,
+ },
+ {
+ "check deducing bounds from const, 6",
+@@ -9800,8 +9856,9 @@ static struct bpf_test tests[] = {
+ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+ BPF_EXIT_INSN(),
+ },
+- .result = REJECT,
++ .errstr_unpriv = "R1 has pointer with unsupported alu operation",
+ .errstr = "R0 tried to subtract pointer from scalar",
++ .result = REJECT,
+ },
+ {
+ "check deducing bounds from const, 7",
+@@ -9813,8 +9870,9 @@ static struct bpf_test tests[] = {
+ offsetof(struct __sk_buff, mark)),
+ BPF_EXIT_INSN(),
+ },
+- .result = REJECT,
++ .errstr_unpriv = "R1 has pointer with unsupported alu operation",
+ .errstr = "dereference of modified ctx ptr",
++ .result = REJECT,
+ },
+ {
+ "check deducing bounds from const, 8",
+@@ -9826,8 +9884,9 @@ static struct bpf_test tests[] = {
+ offsetof(struct __sk_buff, mark)),
+ BPF_EXIT_INSN(),
+ },
+- .result = REJECT,
++ .errstr_unpriv = "R1 has pointer with unsupported alu operation",
+ .errstr = "dereference of modified ctx ptr",
++ .result = REJECT,
+ },
+ {
+ "check deducing bounds from const, 9",
+@@ -9837,8 +9896,9 @@ static struct bpf_test tests[] = {
+ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+ BPF_EXIT_INSN(),
+ },
+- .result = REJECT,
++ .errstr_unpriv = "R1 has pointer with unsupported alu operation",
+ .errstr = "R0 tried to subtract pointer from scalar",
++ .result = REJECT,
+ },
+ {
+ "check deducing bounds from const, 10",
+@@ -9850,8 +9910,8 @@ static struct bpf_test tests[] = {
+ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+ BPF_EXIT_INSN(),
+ },
+- .result = REJECT,
+ .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
++ .result = REJECT,
+ },
+ {
+ "bpf_exit with invalid return code. test1",
+@@ -12182,17 +12242,17 @@ static struct bpf_test tests[] = {
+ BPF_FUNC_map_lookup_elem),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 28),
+ BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
+- BPF_MOV64_IMM(BPF_REG_9, sizeof(struct test_val)),
++ BPF_MOV64_IMM(BPF_REG_9, sizeof(struct test_val)/2),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
+- BPF_MOV64_IMM(BPF_REG_3, sizeof(struct test_val)),
++ BPF_MOV64_IMM(BPF_REG_3, sizeof(struct test_val)/2),
+ BPF_MOV64_IMM(BPF_REG_4, 256),
+ BPF_EMIT_CALL(BPF_FUNC_get_stack),
+ BPF_MOV64_IMM(BPF_REG_1, 0),
+ BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
+ BPF_ALU64_IMM(BPF_LSH, BPF_REG_8, 32),
+ BPF_ALU64_IMM(BPF_ARSH, BPF_REG_8, 32),
+- BPF_JMP_REG(BPF_JSLT, BPF_REG_1, BPF_REG_8, 16),
++ BPF_JMP_REG(BPF_JSLT, BPF_REG_8, BPF_REG_1, 16),
+ BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_8),
+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
+ BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_8),
+@@ -12202,7 +12262,7 @@ static struct bpf_test tests[] = {
+ BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
+ BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_1),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
+- BPF_MOV64_IMM(BPF_REG_5, sizeof(struct test_val)),
++ BPF_MOV64_IMM(BPF_REG_5, sizeof(struct test_val)/2),
+ BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_5),
+ BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 4),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-06-10 11:46 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-06-10 11:46 UTC (permalink / raw
To: gentoo-commits
commit: 6b2a68bf1a50782b86e60e62e8f5b8fa1f87dd59
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 10 11:46:44 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jun 10 11:46:44 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6b2a68bf
Linux patch 4.19.194
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1193_linux-4.19.194.patch | 2835 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2839 insertions(+)
diff --git a/0000_README b/0000_README
index 757010f..50ca271 100644
--- a/0000_README
+++ b/0000_README
@@ -811,6 +811,10 @@ Patch: 1192_linux-4.19.193.patch
From: https://www.kernel.org
Desc: Linux 4.19.193
+Patch: 1193_linux-4.19.194.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.194
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1193_linux-4.19.194.patch b/1193_linux-4.19.194.patch
new file mode 100644
index 0000000..4d073e2
--- /dev/null
+++ b/1193_linux-4.19.194.patch
@@ -0,0 +1,2835 @@
+diff --git a/Makefile b/Makefile
+index e5d41b6792d7f..8ea26b64b3347 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 193
++SUBLEVEL = 194
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+index fe97b2ad82b91..98e8bc9195830 100644
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -426,14 +426,14 @@ static bool trap_bvr(struct kvm_vcpu *vcpu,
+ struct sys_reg_params *p,
+ const struct sys_reg_desc *rd)
+ {
+- u64 *dbg_reg = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
++ u64 *dbg_reg = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->CRm];
+
+ if (p->is_write)
+ reg_to_dbg(vcpu, p, dbg_reg);
+ else
+ dbg_to_reg(vcpu, p, dbg_reg);
+
+- trace_trap_reg(__func__, rd->reg, p->is_write, *dbg_reg);
++ trace_trap_reg(__func__, rd->CRm, p->is_write, *dbg_reg);
+
+ return true;
+ }
+@@ -441,7 +441,7 @@ static bool trap_bvr(struct kvm_vcpu *vcpu,
+ static int set_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ const struct kvm_one_reg *reg, void __user *uaddr)
+ {
+- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
++ __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->CRm];
+
+ if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ return -EFAULT;
+@@ -451,7 +451,7 @@ static int set_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ static int get_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ const struct kvm_one_reg *reg, void __user *uaddr)
+ {
+- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
++ __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->CRm];
+
+ if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ return -EFAULT;
+@@ -461,21 +461,21 @@ static int get_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ static void reset_bvr(struct kvm_vcpu *vcpu,
+ const struct sys_reg_desc *rd)
+ {
+- vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg] = rd->val;
++ vcpu->arch.vcpu_debug_state.dbg_bvr[rd->CRm] = rd->val;
+ }
+
+ static bool trap_bcr(struct kvm_vcpu *vcpu,
+ struct sys_reg_params *p,
+ const struct sys_reg_desc *rd)
+ {
+- u64 *dbg_reg = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
++ u64 *dbg_reg = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->CRm];
+
+ if (p->is_write)
+ reg_to_dbg(vcpu, p, dbg_reg);
+ else
+ dbg_to_reg(vcpu, p, dbg_reg);
+
+- trace_trap_reg(__func__, rd->reg, p->is_write, *dbg_reg);
++ trace_trap_reg(__func__, rd->CRm, p->is_write, *dbg_reg);
+
+ return true;
+ }
+@@ -483,7 +483,7 @@ static bool trap_bcr(struct kvm_vcpu *vcpu,
+ static int set_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ const struct kvm_one_reg *reg, void __user *uaddr)
+ {
+- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
++ __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->CRm];
+
+ if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ return -EFAULT;
+@@ -494,7 +494,7 @@ static int set_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ static int get_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ const struct kvm_one_reg *reg, void __user *uaddr)
+ {
+- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
++ __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->CRm];
+
+ if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ return -EFAULT;
+@@ -504,22 +504,22 @@ static int get_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ static void reset_bcr(struct kvm_vcpu *vcpu,
+ const struct sys_reg_desc *rd)
+ {
+- vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg] = rd->val;
++ vcpu->arch.vcpu_debug_state.dbg_bcr[rd->CRm] = rd->val;
+ }
+
+ static bool trap_wvr(struct kvm_vcpu *vcpu,
+ struct sys_reg_params *p,
+ const struct sys_reg_desc *rd)
+ {
+- u64 *dbg_reg = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
++ u64 *dbg_reg = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->CRm];
+
+ if (p->is_write)
+ reg_to_dbg(vcpu, p, dbg_reg);
+ else
+ dbg_to_reg(vcpu, p, dbg_reg);
+
+- trace_trap_reg(__func__, rd->reg, p->is_write,
+- vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg]);
++ trace_trap_reg(__func__, rd->CRm, p->is_write,
++ vcpu->arch.vcpu_debug_state.dbg_wvr[rd->CRm]);
+
+ return true;
+ }
+@@ -527,7 +527,7 @@ static bool trap_wvr(struct kvm_vcpu *vcpu,
+ static int set_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ const struct kvm_one_reg *reg, void __user *uaddr)
+ {
+- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
++ __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->CRm];
+
+ if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ return -EFAULT;
+@@ -537,7 +537,7 @@ static int set_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ static int get_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ const struct kvm_one_reg *reg, void __user *uaddr)
+ {
+- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
++ __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->CRm];
+
+ if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ return -EFAULT;
+@@ -547,21 +547,21 @@ static int get_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ static void reset_wvr(struct kvm_vcpu *vcpu,
+ const struct sys_reg_desc *rd)
+ {
+- vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg] = rd->val;
++ vcpu->arch.vcpu_debug_state.dbg_wvr[rd->CRm] = rd->val;
+ }
+
+ static bool trap_wcr(struct kvm_vcpu *vcpu,
+ struct sys_reg_params *p,
+ const struct sys_reg_desc *rd)
+ {
+- u64 *dbg_reg = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
++ u64 *dbg_reg = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->CRm];
+
+ if (p->is_write)
+ reg_to_dbg(vcpu, p, dbg_reg);
+ else
+ dbg_to_reg(vcpu, p, dbg_reg);
+
+- trace_trap_reg(__func__, rd->reg, p->is_write, *dbg_reg);
++ trace_trap_reg(__func__, rd->CRm, p->is_write, *dbg_reg);
+
+ return true;
+ }
+@@ -569,7 +569,7 @@ static bool trap_wcr(struct kvm_vcpu *vcpu,
+ static int set_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ const struct kvm_one_reg *reg, void __user *uaddr)
+ {
+- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
++ __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->CRm];
+
+ if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ return -EFAULT;
+@@ -579,7 +579,7 @@ static int set_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ static int get_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ const struct kvm_one_reg *reg, void __user *uaddr)
+ {
+- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
++ __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->CRm];
+
+ if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ return -EFAULT;
+@@ -589,7 +589,7 @@ static int get_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
+ static void reset_wcr(struct kvm_vcpu *vcpu,
+ const struct sys_reg_desc *rd)
+ {
+- vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg] = rd->val;
++ vcpu->arch.vcpu_debug_state.dbg_wcr[rd->CRm] = rd->val;
+ }
+
+ static void reset_amair_el1(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
+diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
+index b5354e216b07c..163c2af44a44f 100644
+--- a/arch/x86/include/asm/apic.h
++++ b/arch/x86/include/asm/apic.h
+@@ -172,6 +172,7 @@ static inline int apic_is_clustered_box(void)
+ extern int setup_APIC_eilvt(u8 lvt_off, u8 vector, u8 msg_type, u8 mask);
+ extern void lapic_assign_system_vectors(void);
+ extern void lapic_assign_legacy_vector(unsigned int isairq, bool replace);
++extern void lapic_update_legacy_vectors(void);
+ extern void lapic_online(void);
+ extern void lapic_offline(void);
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index da6b52c709641..9791828f3fcdd 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -2507,6 +2507,7 @@ void __init apic_bsp_setup(bool upmode)
+ end_local_APIC_setup();
+ irq_remap_enable_fault_handling();
+ setup_IO_APIC();
++ lapic_update_legacy_vectors();
+ }
+
+ #ifdef CONFIG_UP_LATE_INIT
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index f0d0535e8f345..dc7c759442f17 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -682,6 +682,26 @@ void lapic_assign_legacy_vector(unsigned int irq, bool replace)
+ irq_matrix_assign_system(vector_matrix, ISA_IRQ_VECTOR(irq), replace);
+ }
+
++void __init lapic_update_legacy_vectors(void)
++{
++ unsigned int i;
++
++ if (IS_ENABLED(CONFIG_X86_IO_APIC) && nr_ioapics > 0)
++ return;
++
++ /*
++ * If the IO/APIC is disabled via config, kernel command line or
++ * lack of enumeration then all legacy interrupts are routed
++ * through the PIC. Make sure that they are marked as legacy
++ * vectors. PIC_CASCADE_IRQ has already been marked in
++ * lapic_assign_system_vectors().
++ */
++ for (i = 0; i < nr_legacy_irqs(); i++) {
++ if (i != PIC_CASCADE_IR)
++ lapic_assign_legacy_vector(i, true);
++ }
++}
++
+ void __init lapic_assign_system_vectors(void)
+ {
+ unsigned int i, vector = 0;
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 8cb9277aa6ff2..ad24e67772778 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -4033,7 +4033,7 @@ static int cr_interception(struct vcpu_svm *svm)
+ err = 0;
+ if (cr >= 16) { /* mov to cr */
+ cr -= 16;
+- val = kvm_register_read(&svm->vcpu, reg);
++ val = kvm_register_readl(&svm->vcpu, reg);
+ switch (cr) {
+ case 0:
+ if (!check_selective_cr0_intercepted(svm, val))
+@@ -4078,7 +4078,7 @@ static int cr_interception(struct vcpu_svm *svm)
+ kvm_queue_exception(&svm->vcpu, UD_VECTOR);
+ return 1;
+ }
+- kvm_register_write(&svm->vcpu, reg, val);
++ kvm_register_writel(&svm->vcpu, reg, val);
+ }
+ return kvm_complete_insn_gp(&svm->vcpu, err);
+ }
+@@ -4108,13 +4108,13 @@ static int dr_interception(struct vcpu_svm *svm)
+ if (dr >= 16) { /* mov to DRn */
+ if (!kvm_require_dr(&svm->vcpu, dr - 16))
+ return 1;
+- val = kvm_register_read(&svm->vcpu, reg);
++ val = kvm_register_readl(&svm->vcpu, reg);
+ kvm_set_dr(&svm->vcpu, dr - 16, val);
+ } else {
+ if (!kvm_require_dr(&svm->vcpu, dr))
+ return 1;
+ kvm_get_dr(&svm->vcpu, dr, &val);
+- kvm_register_write(&svm->vcpu, reg, val);
++ kvm_register_writel(&svm->vcpu, reg, val);
+ }
+
+ return kvm_skip_emulated_instruction(&svm->vcpu);
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index 92a1468610867..d60e57d14c859 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -1054,16 +1054,6 @@ void __init acpi_early_init(void)
+ goto error0;
+ }
+
+- if (!acpi_gbl_execute_tables_as_methods &&
+- acpi_gbl_group_module_level_code) {
+- status = acpi_load_tables();
+- if (ACPI_FAILURE(status)) {
+- printk(KERN_ERR PREFIX
+- "Unable to load the System Description Tables\n");
+- goto error0;
+- }
+- }
+-
+ #ifdef CONFIG_X86
+ if (!acpi_ioapic) {
+ /* compatible (0) means level (3) */
+@@ -1133,26 +1123,24 @@ static int __init acpi_bus_init(void)
+
+ acpi_os_initialize1();
+
++ status = acpi_load_tables();
++ if (ACPI_FAILURE(status)) {
++ printk(KERN_ERR PREFIX
++ "Unable to load the System Description Tables\n");
++ goto error1;
++ }
++
+ /*
+- * ACPI 2.0 requires the EC driver to be loaded and work before
+- * the EC device is found in the namespace (i.e. before
+- * acpi_load_tables() is called).
++ * ACPI 2.0 requires the EC driver to be loaded and work before the EC
++ * device is found in the namespace.
++ *
++ * This is accomplished by looking for the ECDT table and getting the EC
++ * parameters out of that.
+ *
+- * This is accomplished by looking for the ECDT table, and getting
+- * the EC parameters out of that.
++ * Do that before calling acpi_initialize_objects() which may trigger EC
++ * address space accesses.
+ */
+- status = acpi_ec_ecdt_probe();
+- /* Ignore result. Not having an ECDT is not fatal. */
+-
+- if (acpi_gbl_execute_tables_as_methods ||
+- !acpi_gbl_group_module_level_code) {
+- status = acpi_load_tables();
+- if (ACPI_FAILURE(status)) {
+- printk(KERN_ERR PREFIX
+- "Unable to load the System Description Tables\n");
+- goto error1;
+- }
+- }
++ acpi_ec_ecdt_probe();
+
+ status = acpi_enable_subsystem(ACPI_NO_ACPI_ENABLE);
+ if (ACPI_FAILURE(status)) {
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 116989cf3d457..97da083afd324 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -275,8 +275,7 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg)
+ if (!msg || !(mem->validation_bits & CPER_MEM_VALID_MODULE_HANDLE))
+ return 0;
+
+- n = 0;
+- len = CPER_REC_LEN - 1;
++ len = CPER_REC_LEN;
+ dmi_memdev_name(mem->mem_dev_handle, &bank, &device);
+ if (bank && device)
+ n = snprintf(msg, len, "DIMM location: %s %s ", bank, device);
+@@ -285,7 +284,6 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg)
+ "DIMM location: not present. DMI handle: 0x%.4x ",
+ mem->mem_dev_handle);
+
+- msg[n] = '\0';
+ return n;
+ }
+
+diff --git a/drivers/firmware/efi/memattr.c b/drivers/firmware/efi/memattr.c
+index aac972b056d91..e0889922cc6d7 100644
+--- a/drivers/firmware/efi/memattr.c
++++ b/drivers/firmware/efi/memattr.c
+@@ -69,11 +69,6 @@ static bool entry_is_valid(const efi_memory_desc_t *in, efi_memory_desc_t *out)
+ return false;
+ }
+
+- if (!(in->attribute & (EFI_MEMORY_RO | EFI_MEMORY_XP))) {
+- pr_warn("Entry attributes invalid: RO and XP bits both cleared\n");
+- return false;
+- }
+-
+ if (PAGE_SIZE > EFI_PAGE_SIZE &&
+ (!PAGE_ALIGNED(in->phys_addr) ||
+ !PAGE_ALIGNED(in->num_pages << EFI_PAGE_SHIFT))) {
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index ccda72f748ee5..c20945ed1dc19 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -588,9 +588,13 @@ static struct mt_report_data *mt_allocate_report_data(struct mt_device *td,
+ if (!(HID_MAIN_ITEM_VARIABLE & field->flags))
+ continue;
+
+- for (n = 0; n < field->report_count; n++) {
+- if (field->usage[n].hid == HID_DG_CONTACTID)
+- rdata->is_mt_collection = true;
++ if (field->logical == HID_DG_FINGER || td->hdev->group != HID_GROUP_MULTITOUCH_WIN_8) {
++ for (n = 0; n < field->report_count; n++) {
++ if (field->usage[n].hid == HID_DG_CONTACTID) {
++ rdata->is_mt_collection = true;
++ break;
++ }
++ }
+ }
+ }
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 1f8d403d3db4d..19f4b807a5d1d 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -1160,8 +1160,8 @@ static int i2c_hid_probe(struct i2c_client *client,
+ hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID);
+ hid->product = le16_to_cpu(ihid->hdesc.wProductID);
+
+- snprintf(hid->name, sizeof(hid->name), "%s %04hX:%04hX",
+- client->name, hid->vendor, hid->product);
++ snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X",
++ client->name, (u16)hid->vendor, (u16)hid->product);
+ strlcpy(hid->phys, dev_name(&client->dev), sizeof(hid->phys));
+
+ ihid->quirks = i2c_hid_lookup_quirk(hid->vendor, hid->product);
+diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
+index 08174d341f4a1..bc75f1efa0f4c 100644
+--- a/drivers/hid/usbhid/hid-pidff.c
++++ b/drivers/hid/usbhid/hid-pidff.c
+@@ -1304,6 +1304,7 @@ int hid_pidff_init(struct hid_device *hid)
+
+ if (pidff->pool[PID_DEVICE_MANAGED_POOL].value &&
+ pidff->pool[PID_DEVICE_MANAGED_POOL].value[0] == 0) {
++ error = -EPERM;
+ hid_notice(hid,
+ "device does not support device managed pool\n");
+ goto fail;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 6033970fb667b..ebcf4ea66385a 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -5252,7 +5252,6 @@ static int __bnxt_hwrm_func_qcaps(struct bnxt *bp)
+
+ pf->fw_fid = le16_to_cpu(resp->fid);
+ pf->port_id = le16_to_cpu(resp->port_id);
+- bp->dev->dev_port = pf->port_id;
+ memcpy(pf->mac_addr, resp->mac_address, ETH_ALEN);
+ pf->first_vf_id = le16_to_cpu(resp->first_vf_id);
+ pf->max_vfs = le16_to_cpu(resp->max_vfs);
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index a10756f0b0d8b..7f94b445595ce 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -1071,11 +1071,14 @@ static struct sk_buff *ixgbevf_run_xdp(struct ixgbevf_adapter *adapter,
+ case XDP_TX:
+ xdp_ring = adapter->xdp_ring[rx_ring->queue_index];
+ result = ixgbevf_xmit_xdp_ring(xdp_ring, xdp);
++ if (result == IXGBEVF_XDP_CONSUMED)
++ goto out_failure;
+ break;
+ default:
+ bpf_warn_invalid_xdp_action(act);
+ /* fallthrough */
+ case XDP_ABORTED:
++out_failure:
+ trace_xdp_exception(rx_ring->netdev, xdp_prog, act);
+ /* fallthrough -- handle aborts by dropping packet */
+ case XDP_DROP:
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index faca70c3647d3..82ec00a7370d4 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1590,6 +1590,15 @@ cdc_ncm_speed_change(struct usbnet *dev,
+ uint32_t rx_speed = le32_to_cpu(data->DLBitRRate);
+ uint32_t tx_speed = le32_to_cpu(data->ULBitRate);
+
++ /* if the speed hasn't changed, don't report it.
++ * RTL8156 shipped before 2021 sends notification about every 32ms.
++ */
++ if (dev->rx_speed == rx_speed && dev->tx_speed == tx_speed)
++ return;
++
++ dev->rx_speed = rx_speed;
++ dev->tx_speed = tx_speed;
++
+ /*
+ * Currently the USB-NET API does not support reporting the actual
+ * device speed. Do print it instead.
+@@ -1633,7 +1642,8 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
+ * USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be
+ * sent by device after USB_CDC_NOTIFY_SPEED_CHANGE.
+ */
+- usbnet_link_change(dev, !!event->wValue, 0);
++ if (netif_carrier_ok(dev->net) != !!event->wValue)
++ usbnet_link_change(dev, !!event->wValue, 0);
+ break;
+
+ case USB_CDC_NOTIFY_SPEED_CHANGE:
+diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
+index af26a8a20e0bc..5919ecb7d4b76 100644
+--- a/drivers/usb/dwc2/core_intr.c
++++ b/drivers/usb/dwc2/core_intr.c
+@@ -700,7 +700,11 @@ static inline void dwc_handle_gpwrdn_disc_det(struct dwc2_hsotg *hsotg,
+ dwc2_writel(hsotg, gpwrdn_tmp, GPWRDN);
+
+ hsotg->hibernated = 0;
++
++#if IS_ENABLED(CONFIG_USB_DWC2_HOST) || \
++ IS_ENABLED(CONFIG_USB_DWC2_DUAL_ROLE)
+ hsotg->bus_suspended = 0;
++#endif
+
+ if (gpwrdn & GPWRDN_IDSTS) {
+ hsotg->op_state = OTG_STATE_B_PERIPHERAL;
+diff --git a/drivers/vfio/pci/Kconfig b/drivers/vfio/pci/Kconfig
+index 42dc1d3d71cf0..fcbfd0aacebcd 100644
+--- a/drivers/vfio/pci/Kconfig
++++ b/drivers/vfio/pci/Kconfig
+@@ -1,6 +1,7 @@
+ config VFIO_PCI
+ tristate "VFIO support for PCI devices"
+ depends on VFIO && PCI && EVENTFD
++ depends on MMU
+ select VFIO_VIRQFD
+ select IRQ_BYPASS_MANAGER
+ help
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index a1a26465d224c..86e917f1cc211 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -1579,7 +1579,7 @@ static int vfio_ecap_init(struct vfio_pci_device *vdev)
+ if (len == 0xFF) {
+ len = vfio_ext_cap_len(vdev, ecap, epos);
+ if (len < 0)
+- return ret;
++ return len;
+ }
+ }
+
+diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
+index 460760d0becfe..c29fc6844f845 100644
+--- a/drivers/vfio/platform/vfio_platform_common.c
++++ b/drivers/vfio/platform/vfio_platform_common.c
+@@ -295,7 +295,7 @@ err_irq:
+ vfio_platform_regions_cleanup(vdev);
+ err_reg:
+ mutex_unlock(&driver_lock);
+- module_put(THIS_MODULE);
++ module_put(vdev->parent_module);
+ return ret;
+ }
+
+diff --git a/drivers/xen/xen-pciback/vpci.c b/drivers/xen/xen-pciback/vpci.c
+index f6ba18191c0f9..30313084f06c1 100644
+--- a/drivers/xen/xen-pciback/vpci.c
++++ b/drivers/xen/xen-pciback/vpci.c
+@@ -69,7 +69,7 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
+ struct pci_dev *dev, int devid,
+ publish_pci_dev_cb publish_cb)
+ {
+- int err = 0, slot, func = -1;
++ int err = 0, slot, func = PCI_FUNC(dev->devfn);
+ struct pci_dev_entry *t, *dev_entry;
+ struct vpci_dev_data *vpci_dev = pdev->pci_dev_data;
+
+@@ -94,23 +94,26 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
+
+ /*
+ * Keep multi-function devices together on the virtual PCI bus, except
+- * virtual functions.
++ * that we want to keep virtual functions at func 0 on their own. They
++ * aren't multi-function devices and hence their presence at func 0
++ * may cause guests to not scan the other functions.
+ */
+- if (!dev->is_virtfn) {
++ if (!dev->is_virtfn || func) {
+ for (slot = 0; slot < PCI_SLOT_MAX; slot++) {
+ if (list_empty(&vpci_dev->dev_list[slot]))
+ continue;
+
+ t = list_entry(list_first(&vpci_dev->dev_list[slot]),
+ struct pci_dev_entry, list);
++ if (t->dev->is_virtfn && !PCI_FUNC(t->dev->devfn))
++ continue;
+
+ if (match_slot(dev, t->dev)) {
+ pr_info("vpci: %s: assign to virtual slot %d func %d\n",
+ pci_name(dev), slot,
+- PCI_FUNC(dev->devfn));
++ func);
+ list_add_tail(&dev_entry->list,
+ &vpci_dev->dev_list[slot]);
+- func = PCI_FUNC(dev->devfn);
+ goto unlock;
+ }
+ }
+@@ -123,7 +126,6 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
+ pci_name(dev), slot);
+ list_add_tail(&dev_entry->list,
+ &vpci_dev->dev_list[slot]);
+- func = dev->is_virtfn ? 0 : PCI_FUNC(dev->devfn);
+ goto unlock;
+ }
+ }
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index ce5e0f6c6af4f..bf46ed74eae67 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1984,16 +1984,20 @@ int btrfs_discard_extent(struct btrfs_fs_info *fs_info, u64 bytenr,
+ for (i = 0; i < bbio->num_stripes; i++, stripe++) {
+ u64 bytes;
+ struct request_queue *req_q;
++ struct btrfs_device *device = stripe->dev;
+
+- if (!stripe->dev->bdev) {
++ if (!device->bdev) {
+ ASSERT(btrfs_test_opt(fs_info, DEGRADED));
+ continue;
+ }
+- req_q = bdev_get_queue(stripe->dev->bdev);
++ req_q = bdev_get_queue(device->bdev);
+ if (!blk_queue_discard(req_q))
+ continue;
+
+- ret = btrfs_issue_discard(stripe->dev->bdev,
++ if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state))
++ continue;
++
++ ret = btrfs_issue_discard(device->bdev,
+ stripe->physical,
+ stripe->length,
+ &bytes);
+@@ -2501,7 +2505,7 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
+ head->qgroup_reserved);
+ btrfs_delayed_ref_unlock(head);
+ btrfs_put_delayed_ref_head(head);
+- return 0;
++ return ret;
+ }
+
+ /*
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index 1b8a04b767ffd..40db31b69ef7b 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -586,7 +586,7 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
+ u64 end_byte = bytenr + len;
+ u64 csum_end;
+ struct extent_buffer *leaf;
+- int ret;
++ int ret = 0;
+ u16 csum_size = btrfs_super_csum_size(fs_info->super_copy);
+ int blocksize_bits = fs_info->sb->s_blocksize_bits;
+
+@@ -605,6 +605,7 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
+ path->leave_spinning = 1;
+ ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
+ if (ret > 0) {
++ ret = 0;
+ if (path->slots[0] == 0)
+ break;
+ path->slots[0]--;
+@@ -661,7 +662,7 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
+ ret = btrfs_del_items(trans, root, path,
+ path->slots[0], del_nr);
+ if (ret)
+- goto out;
++ break;
+ if (key.offset == bytenr)
+ break;
+ } else if (key.offset < bytenr && csum_end > end_byte) {
+@@ -705,8 +706,9 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
+ ret = btrfs_split_item(trans, root, path, &key, offset);
+ if (ret && ret != -EAGAIN) {
+ btrfs_abort_transaction(trans, ret);
+- goto out;
++ break;
+ }
++ ret = 0;
+
+ key.offset = end_byte - 1;
+ } else {
+@@ -716,8 +718,6 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
+ }
+ btrfs_release_path(path);
+ }
+- ret = 0;
+-out:
+ btrfs_free_path(path);
+ return ret;
+ }
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 8c6f619c9ee6a..bf0e0e3e09c5d 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -3162,6 +3162,18 @@ out:
+ if (ret || truncated) {
+ u64 start, end;
+
++ /*
++ * If we failed to finish this ordered extent for any reason we
++ * need to make sure BTRFS_ORDERED_IOERR is set on the ordered
++ * extent, and mark the inode with the error if it wasn't
++ * already set. Any error during writeback would have already
++ * set the mapping error, so we need to set it if we're the ones
++ * marking this ordered extent as failed.
++ */
++ if (ret && !test_and_set_bit(BTRFS_ORDERED_IOERR,
++ &ordered_extent->flags))
++ mapping_set_error(ordered_extent->inode->i_mapping, -EIO);
++
+ if (truncated)
+ start = ordered_extent->file_offset + logical_len;
+ else
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 1cd610ddbb244..93e59ce001742 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1699,6 +1699,7 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans,
+ break;
+
+ if (ret == 1) {
++ ret = 0;
+ if (path->slots[0] == 0)
+ break;
+ path->slots[0]--;
+@@ -1711,17 +1712,19 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans,
+
+ ret = btrfs_del_item(trans, root, path);
+ if (ret)
+- goto out;
++ break;
+
+ btrfs_release_path(path);
+ inode = read_one_inode(root, key.offset);
+- if (!inode)
+- return -EIO;
++ if (!inode) {
++ ret = -EIO;
++ break;
++ }
+
+ ret = fixup_inode_link_count(trans, root, inode);
+ iput(inode);
+ if (ret)
+- goto out;
++ break;
+
+ /*
+ * fixup on a directory may create new entries,
+@@ -1730,8 +1733,6 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans,
+ */
+ key.offset = (u64)-1;
+ }
+- ret = 0;
+-out:
+ btrfs_release_path(path);
+ return ret;
+ }
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 36708d9d71cbb..093cb675841b0 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3263,7 +3263,10 @@ static int ext4_split_extent_at(handle_t *handle,
+ ext4_ext_mark_unwritten(ex2);
+
+ err = ext4_ext_insert_extent(handle, inode, ppath, &newex, flags);
+- if (err == -ENOSPC && (EXT4_EXT_MAY_ZEROOUT & split_flag)) {
++ if (err != -ENOSPC && err != -EDQUOT)
++ goto out;
++
++ if (EXT4_EXT_MAY_ZEROOUT & split_flag) {
+ if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) {
+ if (split_flag & EXT4_EXT_DATA_VALID1) {
+ err = ext4_ext_zeroout(inode, ex2);
+@@ -3289,30 +3292,30 @@ static int ext4_split_extent_at(handle_t *handle,
+ ext4_ext_pblock(&orig_ex));
+ }
+
+- if (err)
+- goto fix_extent_len;
+- /* update the extent length and mark as initialized */
+- ex->ee_len = cpu_to_le16(ee_len);
+- ext4_ext_try_to_merge(handle, inode, path, ex);
+- err = ext4_ext_dirty(handle, inode, path + path->p_depth);
+- if (err)
+- goto fix_extent_len;
+-
+- /* update extent status tree */
+- err = ext4_zeroout_es(inode, &zero_ex);
+-
+- goto out;
+- } else if (err)
+- goto fix_extent_len;
+-
+-out:
+- ext4_ext_show_leaf(inode, path);
+- return err;
++ if (!err) {
++ /* update the extent length and mark as initialized */
++ ex->ee_len = cpu_to_le16(ee_len);
++ ext4_ext_try_to_merge(handle, inode, path, ex);
++ err = ext4_ext_dirty(handle, inode, path + path->p_depth);
++ if (!err)
++ /* update extent status tree */
++ err = ext4_zeroout_es(inode, &zero_ex);
++ /* If we failed at this point, we don't know in which
++ * state the extent tree exactly is so don't try to fix
++ * length of the original extent as it may do even more
++ * damage.
++ */
++ goto out;
++ }
++ }
+
+ fix_extent_len:
+ ex->ee_len = orig_ex.ee_len;
+ ext4_ext_dirty(handle, inode, path + path->p_depth);
+ return err;
++out:
++ ext4_ext_show_leaf(inode, path);
++ return err;
+ }
+
+ /*
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 5c507569ef704..94df697e26385 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -1863,6 +1863,45 @@ out:
+ return ret;
+ }
+
++/*
++ * zero out partial blocks of one cluster.
++ *
++ * start: file offset where zero starts, will be made upper block aligned.
++ * len: it will be trimmed to the end of current cluster if "start + len"
++ * is bigger than it.
++ */
++static int ocfs2_zeroout_partial_cluster(struct inode *inode,
++ u64 start, u64 len)
++{
++ int ret;
++ u64 start_block, end_block, nr_blocks;
++ u64 p_block, offset;
++ u32 cluster, p_cluster, nr_clusters;
++ struct super_block *sb = inode->i_sb;
++ u64 end = ocfs2_align_bytes_to_clusters(sb, start);
++
++ if (start + len < end)
++ end = start + len;
++
++ start_block = ocfs2_blocks_for_bytes(sb, start);
++ end_block = ocfs2_blocks_for_bytes(sb, end);
++ nr_blocks = end_block - start_block;
++ if (!nr_blocks)
++ return 0;
++
++ cluster = ocfs2_bytes_to_clusters(sb, start);
++ ret = ocfs2_get_clusters(inode, cluster, &p_cluster,
++ &nr_clusters, NULL);
++ if (ret)
++ return ret;
++ if (!p_cluster)
++ return 0;
++
++ offset = start_block - ocfs2_clusters_to_blocks(sb, cluster);
++ p_block = ocfs2_clusters_to_blocks(sb, p_cluster) + offset;
++ return sb_issue_zeroout(sb, p_block, nr_blocks, GFP_NOFS);
++}
++
+ /*
+ * Parts of this function taken from xfs_change_file_space()
+ */
+@@ -1873,7 +1912,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
+ {
+ int ret;
+ s64 llen;
+- loff_t size;
++ loff_t size, orig_isize;
+ struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+ struct buffer_head *di_bh = NULL;
+ handle_t *handle;
+@@ -1904,6 +1943,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
+ goto out_inode_unlock;
+ }
+
++ orig_isize = i_size_read(inode);
+ switch (sr->l_whence) {
+ case 0: /*SEEK_SET*/
+ break;
+@@ -1911,7 +1951,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
+ sr->l_start += f_pos;
+ break;
+ case 2: /*SEEK_END*/
+- sr->l_start += i_size_read(inode);
++ sr->l_start += orig_isize;
+ break;
+ default:
+ ret = -EINVAL;
+@@ -1965,6 +2005,14 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
+ default:
+ ret = -EINVAL;
+ }
++
++ /* zeroout eof blocks in the cluster. */
++ if (!ret && change_size && orig_isize < size) {
++ ret = ocfs2_zeroout_partial_cluster(inode, orig_isize,
++ size - orig_isize);
++ if (!ret)
++ i_size_write(inode, size);
++ }
+ up_write(&OCFS2_I(inode)->ip_alloc_sem);
+ if (ret) {
+ mlog_errno(ret);
+@@ -1981,9 +2029,6 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
+ goto out_inode_unlock;
+ }
+
+- if (change_size && i_size_read(inode) < size)
+- i_size_write(inode, size);
+-
+ inode->i_ctime = inode->i_mtime = current_time(inode);
+ ret = ocfs2_mark_inode_dirty(handle, inode, di_bh);
+ if (ret < 0)
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index d8b4d31acd18e..efe30b9b11908 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -747,6 +747,11 @@ struct perf_event_context {
+ int nr_stat;
+ int nr_freq;
+ int rotate_disable;
++ /*
++ * Set when nr_events != nr_active, except tolerant to events not
++ * necessary to be active due to scheduling constraints, such as cgroups.
++ */
++ int rotate_necessary;
+ atomic_t refcount;
+ struct task_struct *task;
+
+diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
+index e2ec3582e5493..452ca06ed2534 100644
+--- a/include/linux/usb/usbnet.h
++++ b/include/linux/usb/usbnet.h
+@@ -83,6 +83,8 @@ struct usbnet {
+ # define EVENT_LINK_CHANGE 11
+ # define EVENT_SET_RX_MODE 12
+ # define EVENT_NO_IP_ALIGN 13
++ u32 rx_speed; /* in bps - NOT Mbps */
++ u32 tx_speed; /* in bps - NOT Mbps */
+ };
+
+ static inline struct usb_driver *driver_of(struct usb_interface *intf)
+diff --git a/include/net/caif/caif_dev.h b/include/net/caif/caif_dev.h
+index 028b754ae9b17..0baf2e21a533f 100644
+--- a/include/net/caif/caif_dev.h
++++ b/include/net/caif/caif_dev.h
+@@ -119,7 +119,7 @@ void caif_free_client(struct cflayer *adap_layer);
+ * The link_support layer is used to add any Link Layer specific
+ * framing.
+ */
+-void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
++int caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
+ struct cflayer *link_support, int head_room,
+ struct cflayer **layer, int (**rcv_func)(
+ struct sk_buff *, struct net_device *,
+diff --git a/include/net/caif/cfcnfg.h b/include/net/caif/cfcnfg.h
+index 70bfd017581fb..219094ace893c 100644
+--- a/include/net/caif/cfcnfg.h
++++ b/include/net/caif/cfcnfg.h
+@@ -62,7 +62,7 @@ void cfcnfg_remove(struct cfcnfg *cfg);
+ * @fcs: Specify if checksum is used in CAIF Framing Layer.
+ * @head_room: Head space needed by link specific protocol.
+ */
+-void
++int
+ cfcnfg_add_phy_layer(struct cfcnfg *cnfg,
+ struct net_device *dev, struct cflayer *phy_layer,
+ enum cfcnfg_phy_preference pref,
+diff --git a/include/net/caif/cfserl.h b/include/net/caif/cfserl.h
+index b5b020f3c72eb..bc3fae07a25f9 100644
+--- a/include/net/caif/cfserl.h
++++ b/include/net/caif/cfserl.h
+@@ -9,4 +9,5 @@
+ #include <net/caif/caif_layer.h>
+
+ struct cflayer *cfserl_create(int instance, bool use_stx);
++void cfserl_release(struct cflayer *layer);
+ #endif
+diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
+index 71ca8c4dc290f..8481fc7676c0b 100644
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -228,6 +228,20 @@ enum bpf_attach_type {
+ */
+ #define BPF_F_STRICT_ALIGNMENT (1U << 0)
+
++/* If BPF_F_ANY_ALIGNMENT is used in BPF_PROF_LOAD command, the
++ * verifier will allow any alignment whatsoever. On platforms
++ * with strict alignment requirements for loads ands stores (such
++ * as sparc and mips) the verifier validates that all loads and
++ * stores provably follow this requirement. This flag turns that
++ * checking and enforcement off.
++ *
++ * It is mostly used for testing when we want to validate the
++ * context and memory access aspects of the verifier, but because
++ * of an unaligned access the alignment check would trigger before
++ * the one we are interested in.
++ */
++#define BPF_F_ANY_ALIGNMENT (1U << 1)
++
+ /* when bpf_ldimm64->src_reg == BPF_PSEUDO_MAP_FD, bpf_ldimm64->imm == fd */
+ #define BPF_PSEUDO_MAP_FD 1
+
+diff --git a/init/main.c b/init/main.c
+index fdfef08da0c4b..7baad67c2e937 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -1124,7 +1124,7 @@ static noinline void __init kernel_init_freeable(void)
+ */
+ set_mems_allowed(node_states[N_MEMORY]);
+
+- cad_pid = task_pid(current);
++ cad_pid = get_pid(task_pid(current));
+
+ smp_prepare_cpus(setup_max_cpus);
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 21a366a661acd..353a8d672302b 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1367,9 +1367,14 @@ static int bpf_prog_load(union bpf_attr *attr)
+ if (CHECK_ATTR(BPF_PROG_LOAD))
+ return -EINVAL;
+
+- if (attr->prog_flags & ~BPF_F_STRICT_ALIGNMENT)
++ if (attr->prog_flags & ~(BPF_F_STRICT_ALIGNMENT | BPF_F_ANY_ALIGNMENT))
+ return -EINVAL;
+
++ if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) &&
++ (attr->prog_flags & BPF_F_ANY_ALIGNMENT) &&
++ !capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ /* copy eBPF program license from user space */
+ if (strncpy_from_user(license, u64_to_user_ptr(attr->license),
+ sizeof(license) - 1) < 0)
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 1f4c88ce58deb..4ce032c4acd03 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -6440,6 +6440,9 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr)
+ if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
+ env->strict_alignment = true;
+
++ if (attr->prog_flags & BPF_F_ANY_ALIGNMENT)
++ env->strict_alignment = false;
++
+ ret = replace_map_fd_with_map_ptr(env);
+ if (ret < 0)
+ goto skip_full_check;
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index b8b74a4a524c1..d3be2cd57af12 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -2952,6 +2952,12 @@ static void ctx_sched_out(struct perf_event_context *ctx,
+ if (!ctx->nr_active || !(is_active & EVENT_ALL))
+ return;
+
++ /*
++ * If we had been multiplexing, no rotations are necessary, now no events
++ * are active.
++ */
++ ctx->rotate_necessary = 0;
++
+ perf_pmu_disable(ctx->pmu);
+ if (is_active & EVENT_PINNED) {
+ list_for_each_entry_safe(event, tmp, &ctx->pinned_active, active_list)
+@@ -3319,10 +3325,13 @@ static int flexible_sched_in(struct perf_event *event, void *data)
+ return 0;
+
+ if (group_can_go_on(event, sid->cpuctx, sid->can_add_hw)) {
+- if (!group_sched_in(event, sid->cpuctx, sid->ctx))
+- list_add_tail(&event->active_list, &sid->ctx->flexible_active);
+- else
++ int ret = group_sched_in(event, sid->cpuctx, sid->ctx);
++ if (ret) {
+ sid->can_add_hw = 0;
++ sid->ctx->rotate_necessary = 1;
++ return 0;
++ }
++ list_add_tail(&event->active_list, &sid->ctx->flexible_active);
+ }
+
+ return 0;
+@@ -3680,34 +3689,39 @@ static void rotate_ctx(struct perf_event_context *ctx, struct perf_event *event)
+ perf_event_groups_insert(&ctx->flexible_groups, event);
+ }
+
++/* pick an event from the flexible_groups to rotate */
+ static inline struct perf_event *
+-ctx_first_active(struct perf_event_context *ctx)
++ctx_event_to_rotate(struct perf_event_context *ctx)
+ {
+- return list_first_entry_or_null(&ctx->flexible_active,
+- struct perf_event, active_list);
++ struct perf_event *event;
++
++ /* pick the first active flexible event */
++ event = list_first_entry_or_null(&ctx->flexible_active,
++ struct perf_event, active_list);
++
++ /* if no active flexible event, pick the first event */
++ if (!event) {
++ event = rb_entry_safe(rb_first(&ctx->flexible_groups.tree),
++ typeof(*event), group_node);
++ }
++
++ return event;
+ }
+
+ static bool perf_rotate_context(struct perf_cpu_context *cpuctx)
+ {
+ struct perf_event *cpu_event = NULL, *task_event = NULL;
+- bool cpu_rotate = false, task_rotate = false;
+- struct perf_event_context *ctx = NULL;
++ struct perf_event_context *task_ctx = NULL;
++ int cpu_rotate, task_rotate;
+
+ /*
+ * Since we run this from IRQ context, nobody can install new
+ * events, thus the event count values are stable.
+ */
+
+- if (cpuctx->ctx.nr_events) {
+- if (cpuctx->ctx.nr_events != cpuctx->ctx.nr_active)
+- cpu_rotate = true;
+- }
+-
+- ctx = cpuctx->task_ctx;
+- if (ctx && ctx->nr_events) {
+- if (ctx->nr_events != ctx->nr_active)
+- task_rotate = true;
+- }
++ cpu_rotate = cpuctx->ctx.rotate_necessary;
++ task_ctx = cpuctx->task_ctx;
++ task_rotate = task_ctx ? task_ctx->rotate_necessary : 0;
+
+ if (!(cpu_rotate || task_rotate))
+ return false;
+@@ -3716,25 +3730,25 @@ static bool perf_rotate_context(struct perf_cpu_context *cpuctx)
+ perf_pmu_disable(cpuctx->ctx.pmu);
+
+ if (task_rotate)
+- task_event = ctx_first_active(ctx);
++ task_event = ctx_event_to_rotate(task_ctx);
+ if (cpu_rotate)
+- cpu_event = ctx_first_active(&cpuctx->ctx);
++ cpu_event = ctx_event_to_rotate(&cpuctx->ctx);
+
+ /*
+ * As per the order given at ctx_resched() first 'pop' task flexible
+ * and then, if needed CPU flexible.
+ */
+- if (task_event || (ctx && cpu_event))
+- ctx_sched_out(ctx, cpuctx, EVENT_FLEXIBLE);
++ if (task_event || (task_ctx && cpu_event))
++ ctx_sched_out(task_ctx, cpuctx, EVENT_FLEXIBLE);
+ if (cpu_event)
+ cpu_ctx_sched_out(cpuctx, EVENT_FLEXIBLE);
+
+ if (task_event)
+- rotate_ctx(ctx, task_event);
++ rotate_ctx(task_ctx, task_event);
+ if (cpu_event)
+ rotate_ctx(&cpuctx->ctx, cpu_event);
+
+- perf_event_sched_in(cpuctx, ctx, current);
++ perf_event_sched_in(cpuctx, task_ctx, current);
+
+ perf_pmu_enable(cpuctx->ctx.pmu);
+ perf_ctx_unlock(cpuctx, cpuctx->task_ctx);
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 80392cdd5f3b2..f06687053f96b 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -6154,6 +6154,7 @@ static inline int select_idle_smt(struct task_struct *p, struct sched_domain *sd
+ */
+ static int select_idle_cpu(struct task_struct *p, struct sched_domain *sd, int target)
+ {
++ struct cpumask *cpus = this_cpu_cpumask_var_ptr(select_idle_mask);
+ struct sched_domain *this_sd;
+ u64 avg_cost, avg_idle;
+ u64 time, cost;
+@@ -6184,11 +6185,11 @@ static int select_idle_cpu(struct task_struct *p, struct sched_domain *sd, int t
+
+ time = local_clock();
+
+- for_each_cpu_wrap(cpu, sched_domain_span(sd), target) {
++ cpumask_and(cpus, sched_domain_span(sd), &p->cpus_allowed);
++
++ for_each_cpu_wrap(cpu, cpus, target) {
+ if (!--nr)
+ return -1;
+- if (!cpumask_test_cpu(cpu, &p->cpus_allowed))
+- continue;
+ if (available_idle_cpu(cpu))
+ break;
+ }
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 2f769a6615688..c69f12e4c1499 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4154,10 +4154,20 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
+ struct page *page;
+
+ if (!*pagep) {
+- ret = -ENOMEM;
++ /* If a page already exists, then it's UFFDIO_COPY for
++ * a non-missing case. Return -EEXIST.
++ */
++ if (vm_shared &&
++ hugetlbfs_pagecache_present(h, dst_vma, dst_addr)) {
++ ret = -EEXIST;
++ goto out;
++ }
++
+ page = alloc_huge_page(dst_vma, dst_addr, 0);
+- if (IS_ERR(page))
++ if (IS_ERR(page)) {
++ ret = -ENOMEM;
+ goto out;
++ }
+
+ ret = copy_huge_page_from_user(page,
+ (const void __user *) src_addr,
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 04d6f50798c98..219cdbb476fb7 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1498,8 +1498,13 @@ static int hci_dev_do_open(struct hci_dev *hdev)
+ } else {
+ /* Init failed, cleanup */
+ flush_work(&hdev->tx_work);
+- flush_work(&hdev->cmd_work);
++
++ /* Since hci_rx_work() is possible to awake new cmd_work
++ * it should be flushed first to avoid unexpected call of
++ * hci_cmd_work()
++ */
+ flush_work(&hdev->rx_work);
++ flush_work(&hdev->cmd_work);
+
+ skb_queue_purge(&hdev->cmd_q);
+ skb_queue_purge(&hdev->rx_q);
+diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
+index e506c51ff7653..06156de24c50b 100644
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -755,7 +755,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event)
+ /* Detach sockets from device */
+ read_lock(&hci_sk_list.lock);
+ sk_for_each(sk, &hci_sk_list.head) {
+- bh_lock_sock_nested(sk);
++ lock_sock(sk);
+ if (hci_pi(sk)->hdev == hdev) {
+ hci_pi(sk)->hdev = NULL;
+ sk->sk_err = EPIPE;
+@@ -764,7 +764,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event)
+
+ hci_dev_put(hdev);
+ }
+- bh_unlock_sock(sk);
++ release_sock(sk);
+ }
+ read_unlock(&hci_sk_list.lock);
+ }
+diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
+index 711d7156efd8b..cc305d84168f4 100644
+--- a/net/caif/caif_dev.c
++++ b/net/caif/caif_dev.c
+@@ -303,7 +303,7 @@ static void dev_flowctrl(struct net_device *dev, int on)
+ caifd_put(caifd);
+ }
+
+-void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
++int caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
+ struct cflayer *link_support, int head_room,
+ struct cflayer **layer,
+ int (**rcv_func)(struct sk_buff *, struct net_device *,
+@@ -314,11 +314,12 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
+ enum cfcnfg_phy_preference pref;
+ struct cfcnfg *cfg = get_cfcnfg(dev_net(dev));
+ struct caif_device_entry_list *caifdevs;
++ int res;
+
+ caifdevs = caif_device_list(dev_net(dev));
+ caifd = caif_device_alloc(dev);
+ if (!caifd)
+- return;
++ return -ENOMEM;
+ *layer = &caifd->layer;
+ spin_lock_init(&caifd->flow_lock);
+
+@@ -339,7 +340,7 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
+ strlcpy(caifd->layer.name, dev->name,
+ sizeof(caifd->layer.name));
+ caifd->layer.transmit = transmit;
+- cfcnfg_add_phy_layer(cfg,
++ res = cfcnfg_add_phy_layer(cfg,
+ dev,
+ &caifd->layer,
+ pref,
+@@ -349,6 +350,7 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
+ mutex_unlock(&caifdevs->lock);
+ if (rcv_func)
+ *rcv_func = receive;
++ return res;
+ }
+ EXPORT_SYMBOL(caif_enroll_dev);
+
+@@ -363,6 +365,7 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
+ struct cflayer *layer, *link_support;
+ int head_room = 0;
+ struct caif_device_entry_list *caifdevs;
++ int res;
+
+ cfg = get_cfcnfg(dev_net(dev));
+ caifdevs = caif_device_list(dev_net(dev));
+@@ -388,8 +391,10 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
+ break;
+ }
+ }
+- caif_enroll_dev(dev, caifdev, link_support, head_room,
++ res = caif_enroll_dev(dev, caifdev, link_support, head_room,
+ &layer, NULL);
++ if (res)
++ cfserl_release(link_support);
+ caifdev->flowctrl = dev_flowctrl;
+ break;
+
+diff --git a/net/caif/caif_usb.c b/net/caif/caif_usb.c
+index 1a082a946045e..76d49a1bc6f68 100644
+--- a/net/caif/caif_usb.c
++++ b/net/caif/caif_usb.c
+@@ -116,6 +116,11 @@ static struct cflayer *cfusbl_create(int phyid, u8 ethaddr[ETH_ALEN],
+ return (struct cflayer *) this;
+ }
+
++static void cfusbl_release(struct cflayer *layer)
++{
++ kfree(layer);
++}
++
+ static struct packet_type caif_usb_type __read_mostly = {
+ .type = cpu_to_be16(ETH_P_802_EX1),
+ };
+@@ -128,6 +133,7 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what,
+ struct cflayer *layer, *link_support;
+ struct usbnet *usbnet;
+ struct usb_device *usbdev;
++ int res;
+
+ /* Check whether we have a NCM device, and find its VID/PID. */
+ if (!(dev->dev.parent && dev->dev.parent->driver &&
+@@ -170,8 +176,11 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what,
+ if (dev->num_tx_queues > 1)
+ pr_warn("USB device uses more than one tx queue\n");
+
+- caif_enroll_dev(dev, &common, link_support, CFUSB_MAX_HEADLEN,
++ res = caif_enroll_dev(dev, &common, link_support, CFUSB_MAX_HEADLEN,
+ &layer, &caif_usb_type.func);
++ if (res)
++ goto err;
++
+ if (!pack_added)
+ dev_add_pack(&caif_usb_type);
+ pack_added = true;
+@@ -179,6 +188,9 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what,
+ strlcpy(layer->name, dev->name, sizeof(layer->name));
+
+ return 0;
++err:
++ cfusbl_release(link_support);
++ return res;
+ }
+
+ static struct notifier_block caif_device_notifier = {
+diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
+index 8f00bea093b94..b456b79abd3b7 100644
+--- a/net/caif/cfcnfg.c
++++ b/net/caif/cfcnfg.c
+@@ -450,7 +450,7 @@ unlock:
+ rcu_read_unlock();
+ }
+
+-void
++int
+ cfcnfg_add_phy_layer(struct cfcnfg *cnfg,
+ struct net_device *dev, struct cflayer *phy_layer,
+ enum cfcnfg_phy_preference pref,
+@@ -459,7 +459,7 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg,
+ {
+ struct cflayer *frml;
+ struct cfcnfg_phyinfo *phyinfo = NULL;
+- int i;
++ int i, res = 0;
+ u8 phyid;
+
+ mutex_lock(&cnfg->lock);
+@@ -473,12 +473,15 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg,
+ goto got_phyid;
+ }
+ pr_warn("Too many CAIF Link Layers (max 6)\n");
++ res = -EEXIST;
+ goto out;
+
+ got_phyid:
+ phyinfo = kzalloc(sizeof(struct cfcnfg_phyinfo), GFP_ATOMIC);
+- if (!phyinfo)
++ if (!phyinfo) {
++ res = -ENOMEM;
+ goto out_err;
++ }
+
+ phy_layer->id = phyid;
+ phyinfo->pref = pref;
+@@ -492,8 +495,10 @@ got_phyid:
+
+ frml = cffrml_create(phyid, fcs);
+
+- if (!frml)
++ if (!frml) {
++ res = -ENOMEM;
+ goto out_err;
++ }
+ phyinfo->frm_layer = frml;
+ layer_set_up(frml, cnfg->mux);
+
+@@ -511,11 +516,12 @@ got_phyid:
+ list_add_rcu(&phyinfo->node, &cnfg->phys);
+ out:
+ mutex_unlock(&cnfg->lock);
+- return;
++ return res;
+
+ out_err:
+ kfree(phyinfo);
+ mutex_unlock(&cnfg->lock);
++ return res;
+ }
+ EXPORT_SYMBOL(cfcnfg_add_phy_layer);
+
+diff --git a/net/caif/cfserl.c b/net/caif/cfserl.c
+index ce60f06d76de3..af1e1e36dc90a 100644
+--- a/net/caif/cfserl.c
++++ b/net/caif/cfserl.c
+@@ -31,6 +31,11 @@ static int cfserl_transmit(struct cflayer *layr, struct cfpkt *pkt);
+ static void cfserl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
+ int phyid);
+
++void cfserl_release(struct cflayer *layer)
++{
++ kfree(layer);
++}
++
+ struct cflayer *cfserl_create(int instance, bool use_stx)
+ {
+ struct cfserl *this = kzalloc(sizeof(struct cfserl), GFP_ATOMIC);
+diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
+index c0930b9fe848b..7531cb1665d2b 100644
+--- a/net/ieee802154/nl-mac.c
++++ b/net/ieee802154/nl-mac.c
+@@ -688,8 +688,10 @@ int ieee802154_llsec_getparams(struct sk_buff *skb, struct genl_info *info)
+ nla_put_u8(msg, IEEE802154_ATTR_LLSEC_SECLEVEL, params.out_level) ||
+ nla_put_u32(msg, IEEE802154_ATTR_LLSEC_FRAME_COUNTER,
+ be32_to_cpu(params.frame_counter)) ||
+- ieee802154_llsec_fill_key_id(msg, ¶ms.out_key))
++ ieee802154_llsec_fill_key_id(msg, ¶ms.out_key)) {
++ rc = -ENOBUFS;
+ goto out_free;
++ }
+
+ dev_put(dev);
+
+diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
+index b231e40f006a6..ca1dd9ff07aba 100644
+--- a/net/ieee802154/nl-phy.c
++++ b/net/ieee802154/nl-phy.c
+@@ -249,8 +249,10 @@ int ieee802154_add_iface(struct sk_buff *skb, struct genl_info *info)
+ }
+
+ if (nla_put_string(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy)) ||
+- nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name))
++ nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name)) {
++ rc = -EMSGSIZE;
+ goto nla_put_failure;
++ }
+ dev_put(dev);
+
+ wpan_phy_put(phy);
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 3ad1de081e3c7..6208fa09fe713 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -1269,7 +1269,7 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
+ ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
+ svc->port = u->port;
+ svc->fwmark = u->fwmark;
+- svc->flags = u->flags;
++ svc->flags = u->flags & ~IP_VS_SVC_F_HASHED;
+ svc->timeout = u->timeout * HZ;
+ svc->netmask = u->netmask;
+ svc->ipvs = ipvs;
+diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
+index ddcb1b6074745..c8b0f1122c44d 100644
+--- a/net/netfilter/nfnetlink_cthelper.c
++++ b/net/netfilter/nfnetlink_cthelper.c
+@@ -381,10 +381,14 @@ static int
+ nfnl_cthelper_update(const struct nlattr * const tb[],
+ struct nf_conntrack_helper *helper)
+ {
++ u32 size;
+ int ret;
+
+- if (tb[NFCTH_PRIV_DATA_LEN])
+- return -EBUSY;
++ if (tb[NFCTH_PRIV_DATA_LEN]) {
++ size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
++ if (size != helper->data_len)
++ return -EBUSY;
++ }
+
+ if (tb[NFCTH_POLICY]) {
+ ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]);
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index 59de4f54dd18c..23f7116d122a2 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -122,6 +122,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
+ if (!llcp_sock->service_name) {
+ nfc_llcp_local_put(llcp_sock->local);
+ llcp_sock->local = NULL;
++ llcp_sock->dev = NULL;
+ ret = -ENOMEM;
+ goto put_dev;
+ }
+@@ -131,6 +132,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
+ llcp_sock->local = NULL;
+ kfree(llcp_sock->service_name);
+ llcp_sock->service_name = NULL;
++ llcp_sock->dev = NULL;
+ ret = -EADDRINUSE;
+ goto put_dev;
+ }
+diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
+index 2649a0a0d45e0..e1006ed4d90ab 100644
+--- a/net/tipc/bearer.c
++++ b/net/tipc/bearer.c
+@@ -231,7 +231,8 @@ void tipc_bearer_remove_dest(struct net *net, u32 bearer_id, u32 dest)
+ */
+ static int tipc_enable_bearer(struct net *net, const char *name,
+ u32 disc_domain, u32 prio,
+- struct nlattr *attr[])
++ struct nlattr *attr[],
++ struct netlink_ext_ack *extack)
+ {
+ struct tipc_net *tn = tipc_net(net);
+ struct tipc_bearer_names b_names;
+@@ -242,20 +243,24 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ int bearer_id = 0;
+ int res = -EINVAL;
+ char *errstr = "";
++ u32 i;
+
+ if (!bearer_name_validate(name, &b_names)) {
+ errstr = "illegal name";
++ NL_SET_ERR_MSG(extack, "Illegal name");
+ goto rejected;
+ }
+
+ if (prio > TIPC_MAX_LINK_PRI && prio != TIPC_MEDIA_LINK_PRI) {
+ errstr = "illegal priority";
++ NL_SET_ERR_MSG(extack, "Illegal priority");
+ goto rejected;
+ }
+
+ m = tipc_media_find(b_names.media_name);
+ if (!m) {
+ errstr = "media not registered";
++ NL_SET_ERR_MSG(extack, "Media not registered");
+ goto rejected;
+ }
+
+@@ -263,33 +268,43 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ prio = m->priority;
+
+ /* Check new bearer vs existing ones and find free bearer id if any */
+- while (bearer_id < MAX_BEARERS) {
+- b = rtnl_dereference(tn->bearer_list[bearer_id]);
+- if (!b)
+- break;
++ bearer_id = MAX_BEARERS;
++ i = MAX_BEARERS;
++ while (i-- != 0) {
++ b = rtnl_dereference(tn->bearer_list[i]);
++ if (!b) {
++ bearer_id = i;
++ continue;
++ }
+ if (!strcmp(name, b->name)) {
+ errstr = "already enabled";
++ NL_SET_ERR_MSG(extack, "Already enabled");
+ goto rejected;
+ }
+- bearer_id++;
+- if (b->priority != prio)
+- continue;
+- if (++with_this_prio <= 2)
+- continue;
+- pr_warn("Bearer <%s>: already 2 bearers with priority %u\n",
+- name, prio);
+- if (prio == TIPC_MIN_LINK_PRI) {
+- errstr = "cannot adjust to lower";
+- goto rejected;
++
++ if (b->priority == prio &&
++ (++with_this_prio > 2)) {
++ pr_warn("Bearer <%s>: already 2 bearers with priority %u\n",
++ name, prio);
++
++ if (prio == TIPC_MIN_LINK_PRI) {
++ errstr = "cannot adjust to lower";
++ NL_SET_ERR_MSG(extack, "Cannot adjust to lower");
++ goto rejected;
++ }
++
++ pr_warn("Bearer <%s>: trying with adjusted priority\n",
++ name);
++ prio--;
++ bearer_id = MAX_BEARERS;
++ i = MAX_BEARERS;
++ with_this_prio = 1;
+ }
+- pr_warn("Bearer <%s>: trying with adjusted priority\n", name);
+- prio--;
+- bearer_id = 0;
+- with_this_prio = 1;
+ }
+
+ if (bearer_id >= MAX_BEARERS) {
+ errstr = "max 3 bearers permitted";
++ NL_SET_ERR_MSG(extack, "Max 3 bearers permitted");
+ goto rejected;
+ }
+
+@@ -303,6 +318,7 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ if (res) {
+ kfree(b);
+ errstr = "failed to enable media";
++ NL_SET_ERR_MSG(extack, "Failed to enable media");
+ goto rejected;
+ }
+
+@@ -318,6 +334,7 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ if (res) {
+ bearer_disable(net, b);
+ errstr = "failed to create discoverer";
++ NL_SET_ERR_MSG(extack, "Failed to create discoverer");
+ goto rejected;
+ }
+
+@@ -795,6 +812,7 @@ int tipc_nl_bearer_get(struct sk_buff *skb, struct genl_info *info)
+ bearer = tipc_bearer_find(net, name);
+ if (!bearer) {
+ err = -EINVAL;
++ NL_SET_ERR_MSG(info->extack, "Bearer not found");
+ goto err_out;
+ }
+
+@@ -834,8 +852,10 @@ int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
+ name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
+
+ bearer = tipc_bearer_find(net, name);
+- if (!bearer)
++ if (!bearer) {
++ NL_SET_ERR_MSG(info->extack, "Bearer not found");
+ return -EINVAL;
++ }
+
+ bearer_disable(net, bearer);
+
+@@ -893,7 +913,8 @@ int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+ prio = nla_get_u32(props[TIPC_NLA_PROP_PRIO]);
+ }
+
+- return tipc_enable_bearer(net, bearer, domain, prio, attrs);
++ return tipc_enable_bearer(net, bearer, domain, prio, attrs,
++ info->extack);
+ }
+
+ int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+@@ -932,6 +953,7 @@ int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
+ b = tipc_bearer_find(net, name);
+ if (!b) {
+ rtnl_unlock();
++ NL_SET_ERR_MSG(info->extack, "Bearer not found");
+ return -EINVAL;
+ }
+
+@@ -972,8 +994,10 @@ int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+ name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
+
+ b = tipc_bearer_find(net, name);
+- if (!b)
++ if (!b) {
++ NL_SET_ERR_MSG(info->extack, "Bearer not found");
+ return -EINVAL;
++ }
+
+ if (attrs[TIPC_NLA_BEARER_PROP]) {
+ struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
+@@ -992,12 +1016,18 @@ int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+ if (props[TIPC_NLA_PROP_WIN])
+ b->window = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
+ if (props[TIPC_NLA_PROP_MTU]) {
+- if (b->media->type_id != TIPC_MEDIA_TYPE_UDP)
++ if (b->media->type_id != TIPC_MEDIA_TYPE_UDP) {
++ NL_SET_ERR_MSG(info->extack,
++ "MTU property is unsupported");
+ return -EINVAL;
++ }
+ #ifdef CONFIG_TIPC_MEDIA_UDP
+ if (tipc_udp_mtu_bad(nla_get_u32
+- (props[TIPC_NLA_PROP_MTU])))
++ (props[TIPC_NLA_PROP_MTU]))) {
++ NL_SET_ERR_MSG(info->extack,
++ "MTU value is out-of-range");
+ return -EINVAL;
++ }
+ b->mtu = nla_get_u32(props[TIPC_NLA_PROP_MTU]);
+ tipc_node_apply_property(net, b, TIPC_NLA_PROP_MTU);
+ #endif
+@@ -1125,6 +1155,7 @@ int tipc_nl_media_get(struct sk_buff *skb, struct genl_info *info)
+ rtnl_lock();
+ media = tipc_media_find(name);
+ if (!media) {
++ NL_SET_ERR_MSG(info->extack, "Media not found");
+ err = -EINVAL;
+ goto err_out;
+ }
+@@ -1161,9 +1192,10 @@ int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+ name = nla_data(attrs[TIPC_NLA_MEDIA_NAME]);
+
+ m = tipc_media_find(name);
+- if (!m)
++ if (!m) {
++ NL_SET_ERR_MSG(info->extack, "Media not found");
+ return -EINVAL;
+-
++ }
+ if (attrs[TIPC_NLA_MEDIA_PROP]) {
+ struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
+
+@@ -1179,12 +1211,18 @@ int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+ if (props[TIPC_NLA_PROP_WIN])
+ m->window = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
+ if (props[TIPC_NLA_PROP_MTU]) {
+- if (m->type_id != TIPC_MEDIA_TYPE_UDP)
++ if (m->type_id != TIPC_MEDIA_TYPE_UDP) {
++ NL_SET_ERR_MSG(info->extack,
++ "MTU property is unsupported");
+ return -EINVAL;
++ }
+ #ifdef CONFIG_TIPC_MEDIA_UDP
+ if (tipc_udp_mtu_bad(nla_get_u32
+- (props[TIPC_NLA_PROP_MTU])))
++ (props[TIPC_NLA_PROP_MTU]))) {
++ NL_SET_ERR_MSG(info->extack,
++ "MTU value is out-of-range");
+ return -EINVAL;
++ }
+ m->mtu = nla_get_u32(props[TIPC_NLA_PROP_MTU]);
+ #endif
+ }
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index f5d58652108dd..5f177dad2fa80 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -404,6 +404,8 @@ void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev);
+
+ /* internal helpers */
+ bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);
++bool cfg80211_valid_key_idx(struct cfg80211_registered_device *rdev,
++ int key_idx, bool pairwise);
+ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
+ struct key_params *params, int key_idx,
+ bool pairwise, const u8 *mac_addr);
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 5f0605275fa39..04c4fd376e1d5 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3624,9 +3624,6 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
+ if (err)
+ return err;
+
+- if (key.idx < 0)
+- return -EINVAL;
+-
+ if (info->attrs[NL80211_ATTR_MAC])
+ mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+
+@@ -3642,6 +3639,10 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
+ key.type != NL80211_KEYTYPE_GROUP)
+ return -EINVAL;
+
++ if (!cfg80211_valid_key_idx(rdev, key.idx,
++ key.type == NL80211_KEYTYPE_PAIRWISE))
++ return -EINVAL;
++
+ if (!rdev->ops->del_key)
+ return -EOPNOTSUPP;
+
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 6f9cff2ee7953..c4536468dfbea 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -214,11 +214,48 @@ bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher)
+ return false;
+ }
+
++static bool
++cfg80211_igtk_cipher_supported(struct cfg80211_registered_device *rdev)
++{
++ struct wiphy *wiphy = &rdev->wiphy;
++ int i;
++
++ for (i = 0; i < wiphy->n_cipher_suites; i++) {
++ switch (wiphy->cipher_suites[i]) {
++ case WLAN_CIPHER_SUITE_AES_CMAC:
++ case WLAN_CIPHER_SUITE_BIP_CMAC_256:
++ case WLAN_CIPHER_SUITE_BIP_GMAC_128:
++ case WLAN_CIPHER_SUITE_BIP_GMAC_256:
++ return true;
++ }
++ }
++
++ return false;
++}
++
++bool cfg80211_valid_key_idx(struct cfg80211_registered_device *rdev,
++ int key_idx, bool pairwise)
++{
++ int max_key_idx;
++
++ if (pairwise)
++ max_key_idx = 3;
++ else if (cfg80211_igtk_cipher_supported(rdev))
++ max_key_idx = 5;
++ else
++ max_key_idx = 3;
++
++ if (key_idx < 0 || key_idx > max_key_idx)
++ return false;
++
++ return true;
++}
++
+ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
+ struct key_params *params, int key_idx,
+ bool pairwise, const u8 *mac_addr)
+ {
+- if (key_idx < 0 || key_idx > 5)
++ if (!cfg80211_valid_key_idx(rdev, key_idx, pairwise))
+ return -EINVAL;
+
+ if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
+diff --git a/samples/vfio-mdev/mdpy-fb.c b/samples/vfio-mdev/mdpy-fb.c
+index 2719bb2596530..a760e130bd0d6 100644
+--- a/samples/vfio-mdev/mdpy-fb.c
++++ b/samples/vfio-mdev/mdpy-fb.c
+@@ -117,22 +117,27 @@ static int mdpy_fb_probe(struct pci_dev *pdev,
+ if (format != DRM_FORMAT_XRGB8888) {
+ pci_err(pdev, "format mismatch (0x%x != 0x%x)\n",
+ format, DRM_FORMAT_XRGB8888);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_release_regions;
+ }
+ if (width < 100 || width > 10000) {
+ pci_err(pdev, "width (%d) out of range\n", width);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_release_regions;
+ }
+ if (height < 100 || height > 10000) {
+ pci_err(pdev, "height (%d) out of range\n", height);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_release_regions;
+ }
+ pci_info(pdev, "mdpy found: %dx%d framebuffer\n",
+ width, height);
+
+ info = framebuffer_alloc(sizeof(struct mdpy_fb_par), &pdev->dev);
+- if (!info)
++ if (!info) {
++ ret = -ENOMEM;
+ goto err_release_regions;
++ }
+ pci_set_drvdata(pdev, info);
+ par = info->par;
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index b5dc51030316a..b4fe1324b56c2 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -500,9 +500,10 @@ static void snd_timer_notify1(struct snd_timer_instance *ti, int event)
+ return;
+ if (timer->hw.flags & SNDRV_TIMER_HW_SLAVE)
+ return;
++ event += 10; /* convert to SNDRV_TIMER_EVENT_MXXX */
+ list_for_each_entry(ts, &ti->slave_active_head, active_list)
+ if (ts->ccallback)
+- ts->ccallback(ts, event + 100, &tstamp, resolution);
++ ts->ccallback(ts, event, &tstamp, resolution);
+ }
+
+ /* start/continue a master timer */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index f9ebbee3824bb..42c30fba699fb 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7095,6 +7095,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
++ SND_PCI_QUIRK(0x103c, 0x841c, "HP Pavilion 15-CK0xx", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_LED),
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 169679419b398..a74e07eff60c3 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -1708,7 +1708,7 @@ static struct snd_kcontrol_new snd_microii_mixer_spdif[] = {
+ static int snd_microii_controls_create(struct usb_mixer_interface *mixer)
+ {
+ int err, i;
+- const static usb_mixer_elem_resume_func_t resume_funcs[] = {
++ static const usb_mixer_elem_resume_func_t resume_funcs[] = {
+ snd_microii_spdif_default_update,
+ NULL,
+ snd_microii_spdif_switch_update
+diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
+index 13944978ada5b..9e060c6a01ac2 100644
+--- a/tools/include/uapi/linux/bpf.h
++++ b/tools/include/uapi/linux/bpf.h
+@@ -226,6 +226,20 @@ enum bpf_attach_type {
+ */
+ #define BPF_F_STRICT_ALIGNMENT (1U << 0)
+
++/* If BPF_F_ANY_ALIGNMENT is used in BPF_PROF_LOAD command, the
++ * verifier will allow any alignment whatsoever. On platforms
++ * with strict alignment requirements for loads ands stores (such
++ * as sparc and mips) the verifier validates that all loads and
++ * stores provably follow this requirement. This flag turns that
++ * checking and enforcement off.
++ *
++ * It is mostly used for testing when we want to validate the
++ * context and memory access aspects of the verifier, but because
++ * of an unaligned access the alignment check would trigger before
++ * the one we are interested in.
++ */
++#define BPF_F_ANY_ALIGNMENT (1U << 1)
++
+ /* when bpf_ldimm64->src_reg == BPF_PSEUDO_MAP_FD, bpf_ldimm64->imm == fd */
+ #define BPF_PSEUDO_MAP_FD 1
+
+diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
+index 482025b728399..f28ae6a68697a 100644
+--- a/tools/lib/bpf/bpf.c
++++ b/tools/lib/bpf/bpf.c
+@@ -261,9 +261,9 @@ int bpf_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+ }
+
+ int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+- size_t insns_cnt, int strict_alignment,
+- const char *license, __u32 kern_version,
+- char *log_buf, size_t log_buf_sz, int log_level)
++ size_t insns_cnt, __u32 prog_flags, const char *license,
++ __u32 kern_version, char *log_buf, size_t log_buf_sz,
++ int log_level)
+ {
+ union bpf_attr attr;
+
+@@ -277,7 +277,7 @@ int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+ attr.log_level = log_level;
+ log_buf[0] = 0;
+ attr.kern_version = kern_version;
+- attr.prog_flags = strict_alignment ? BPF_F_STRICT_ALIGNMENT : 0;
++ attr.prog_flags = prog_flags;
+
+ return sys_bpf_prog_load(&attr, sizeof(attr));
+ }
+diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
+index c3145ab3bdcac..7f2e947d940c1 100644
+--- a/tools/lib/bpf/bpf.h
++++ b/tools/lib/bpf/bpf.h
+@@ -79,7 +79,7 @@ int bpf_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+ __u32 kern_version, char *log_buf,
+ size_t log_buf_sz);
+ int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+- size_t insns_cnt, int strict_alignment,
++ size_t insns_cnt, __u32 prog_flags,
+ const char *license, __u32 kern_version,
+ char *log_buf, size_t log_buf_sz, int log_level);
+
+diff --git a/tools/testing/selftests/bpf/test_align.c b/tools/testing/selftests/bpf/test_align.c
+index 5f377ec53f2f8..3c789d03b629d 100644
+--- a/tools/testing/selftests/bpf/test_align.c
++++ b/tools/testing/selftests/bpf/test_align.c
+@@ -620,8 +620,8 @@ static int do_test_single(struct bpf_align_test *test)
+
+ prog_len = probe_filter_length(prog);
+ fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
+- prog, prog_len, 1, "GPL", 0,
+- bpf_vlog, sizeof(bpf_vlog), 2);
++ prog, prog_len, BPF_F_STRICT_ALIGNMENT,
++ "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 2);
+ if (fd_prog < 0 && test->result != REJECT) {
+ printf("Failed to load program.\n");
+ printf("%s", bpf_vlog);
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index e1e4b6ab83f74..b44324530948d 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -70,7 +70,7 @@ struct bpf_test {
+ int fixup_cgroup_storage[MAX_FIXUPS];
+ const char *errstr;
+ const char *errstr_unpriv;
+- uint32_t retval;
++ uint32_t retval, retval_unpriv;
+ enum {
+ UNDEF,
+ ACCEPT,
+@@ -963,6 +963,7 @@ static struct bpf_test tests[] = {
+ .errstr_unpriv = "attempt to corrupt spilled",
+ .errstr = "corrupted spill",
+ .result = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "invalid src register in STX",
+@@ -1777,6 +1778,7 @@ static struct bpf_test tests[] = {
+ .errstr = "invalid bpf_context access",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_SK_MSG,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "invalid read past end of SK_MSG",
+@@ -1799,6 +1801,7 @@ static struct bpf_test tests[] = {
+ .errstr = "invalid bpf_context access",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_SK_MSG,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "direct packet read for SK_MSG",
+@@ -2175,6 +2178,7 @@ static struct bpf_test tests[] = {
+ },
+ .errstr = "invalid bpf_context access",
+ .result = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "check skb->hash half load not permitted, unaligned 3",
+@@ -2191,6 +2195,7 @@ static struct bpf_test tests[] = {
+ },
+ .errstr = "invalid bpf_context access",
+ .result = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "check cb access: half, wrong type",
+@@ -2986,6 +2991,8 @@ static struct bpf_test tests[] = {
+ .fixup_prog1 = { 2 },
+ .result = ACCEPT,
+ .retval = 42,
++ /* Verifier rewrite for unpriv skips tail call here. */
++ .retval_unpriv = 2,
+ },
+ {
+ "stack pointer arithmetic",
+@@ -3149,6 +3156,7 @@ static struct bpf_test tests[] = {
+ .result = REJECT,
+ .errstr = "R0 invalid mem access 'inv'",
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "raw_stack: skb_load_bytes, spilled regs corruption 2",
+@@ -3179,6 +3187,7 @@ static struct bpf_test tests[] = {
+ .result = REJECT,
+ .errstr = "R3 invalid mem access 'inv'",
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "raw_stack: skb_load_bytes, spilled regs + data",
+@@ -3678,6 +3687,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R2 invalid mem access 'inv'",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "direct packet access: test16 (arith on data_end)",
+@@ -3780,6 +3790,7 @@ static struct bpf_test tests[] = {
+ },
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .result = ACCEPT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "direct packet access: test21 (x += pkt_ptr, 2)",
+@@ -3805,6 +3816,7 @@ static struct bpf_test tests[] = {
+ },
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .result = ACCEPT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "direct packet access: test22 (x += pkt_ptr, 3)",
+@@ -3835,6 +3847,7 @@ static struct bpf_test tests[] = {
+ },
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .result = ACCEPT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "direct packet access: test23 (x += pkt_ptr, 4)",
+@@ -3861,6 +3874,7 @@ static struct bpf_test tests[] = {
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .result = REJECT,
+ .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "direct packet access: test24 (x += pkt_ptr, 5)",
+@@ -3886,6 +3900,7 @@ static struct bpf_test tests[] = {
+ },
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .result = ACCEPT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "direct packet access: test25 (marking on <, good access)",
+@@ -4765,6 +4780,7 @@ static struct bpf_test tests[] = {
+ .result = REJECT,
+ .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
+ .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "invalid cgroup storage access 5",
+@@ -4798,6 +4814,7 @@ static struct bpf_test tests[] = {
+ .fixup_cgroup_storage = { 1 },
+ .result = REJECT,
+ .errstr = "get_local_storage() doesn't support non-zero flags",
++ .errstr_unpriv = "R2 leaks addr into helper function",
+ .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+ },
+ {
+@@ -6430,6 +6447,7 @@ static struct bpf_test tests[] = {
+ .errstr = "invalid mem access 'inv'",
+ .result = REJECT,
+ .result_unpriv = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "map element value illegal alu op, 5",
+@@ -6452,6 +6470,7 @@ static struct bpf_test tests[] = {
+ .fixup_map2 = { 3 },
+ .errstr = "R0 invalid mem access 'inv'",
+ .result = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "map element value is preserved across register spilling",
+@@ -6945,6 +6964,7 @@ static struct bpf_test tests[] = {
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .retval = 0 /* csum_diff of 64-byte packet */,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
+@@ -8911,6 +8931,7 @@ static struct bpf_test tests[] = {
+ },
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data' > pkt_end, bad access 1",
+@@ -8948,6 +8969,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_end > pkt_data', good access",
+@@ -8986,6 +9008,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_end > pkt_data', bad access 2",
+@@ -9004,6 +9027,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data' < pkt_end, good access",
+@@ -9042,6 +9066,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data' < pkt_end, bad access 2",
+@@ -9060,6 +9085,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_end < pkt_data', good access",
+@@ -9077,6 +9103,7 @@ static struct bpf_test tests[] = {
+ },
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_end < pkt_data', bad access 1",
+@@ -9114,6 +9141,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data' >= pkt_end, good access",
+@@ -9150,6 +9178,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
+@@ -9187,6 +9216,7 @@ static struct bpf_test tests[] = {
+ },
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_end >= pkt_data', bad access 1",
+@@ -9225,6 +9255,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data' <= pkt_end, good access",
+@@ -9243,6 +9274,7 @@ static struct bpf_test tests[] = {
+ },
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
+@@ -9281,6 +9313,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_end <= pkt_data', good access",
+@@ -9317,6 +9350,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_end <= pkt_data', bad access 2",
+@@ -9353,6 +9387,7 @@ static struct bpf_test tests[] = {
+ },
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_meta' > pkt_data, bad access 1",
+@@ -9390,6 +9425,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data > pkt_meta', good access",
+@@ -9428,6 +9464,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data > pkt_meta', bad access 2",
+@@ -9446,6 +9483,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_meta' < pkt_data, good access",
+@@ -9484,6 +9522,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_meta' < pkt_data, bad access 2",
+@@ -9502,6 +9541,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data < pkt_meta', good access",
+@@ -9519,6 +9559,7 @@ static struct bpf_test tests[] = {
+ },
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data < pkt_meta', bad access 1",
+@@ -9556,6 +9597,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_meta' >= pkt_data, good access",
+@@ -9592,6 +9634,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
+@@ -9629,6 +9672,7 @@ static struct bpf_test tests[] = {
+ },
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data >= pkt_meta', bad access 1",
+@@ -9667,6 +9711,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_meta' <= pkt_data, good access",
+@@ -9685,6 +9730,7 @@ static struct bpf_test tests[] = {
+ },
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
+@@ -9723,6 +9769,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data <= pkt_meta', good access",
+@@ -9759,6 +9806,7 @@ static struct bpf_test tests[] = {
+ .errstr = "R1 offset is outside of the packet",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "XDP pkt read, pkt_data <= pkt_meta', bad access 2",
+@@ -9873,6 +9921,7 @@ static struct bpf_test tests[] = {
+ .errstr_unpriv = "R1 has pointer with unsupported alu operation",
+ .errstr = "dereference of modified ctx ptr",
+ .result = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "check deducing bounds from const, 8",
+@@ -9887,6 +9936,7 @@ static struct bpf_test tests[] = {
+ .errstr_unpriv = "R1 has pointer with unsupported alu operation",
+ .errstr = "dereference of modified ctx ptr",
+ .result = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "check deducing bounds from const, 9",
+@@ -10362,6 +10412,7 @@ static struct bpf_test tests[] = {
+ .result = REJECT,
+ .errstr = "R6 invalid mem access 'inv'",
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: two calls with args",
+@@ -11227,6 +11278,7 @@ static struct bpf_test tests[] = {
+ .fixup_map1 = { 12, 22 },
+ .result = REJECT,
+ .errstr = "invalid access to map value, value_size=8 off=2 size=8",
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2",
+@@ -11370,6 +11422,7 @@ static struct bpf_test tests[] = {
+ .fixup_map1 = { 12, 22 },
+ .result = REJECT,
+ .errstr = "invalid access to map value, value_size=8 off=2 size=8",
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: two calls that receive map_value_ptr_or_null via arg. test1",
+@@ -11541,6 +11594,7 @@ static struct bpf_test tests[] = {
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .retval = POINTER_VALUE,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: pkt_ptr spill into caller stack 2",
+@@ -11572,6 +11626,7 @@ static struct bpf_test tests[] = {
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .errstr = "invalid access to packet",
+ .result = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: pkt_ptr spill into caller stack 3",
+@@ -11607,6 +11662,7 @@ static struct bpf_test tests[] = {
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .result = ACCEPT,
+ .retval = 1,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: pkt_ptr spill into caller stack 4",
+@@ -11641,6 +11697,7 @@ static struct bpf_test tests[] = {
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .result = ACCEPT,
+ .retval = 1,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: pkt_ptr spill into caller stack 5",
+@@ -11674,6 +11731,7 @@ static struct bpf_test tests[] = {
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .errstr = "same insn cannot be used with different",
+ .result = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: pkt_ptr spill into caller stack 6",
+@@ -11709,6 +11767,7 @@ static struct bpf_test tests[] = {
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .errstr = "R4 invalid mem access",
+ .result = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: pkt_ptr spill into caller stack 7",
+@@ -11743,6 +11802,7 @@ static struct bpf_test tests[] = {
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .errstr = "R4 invalid mem access",
+ .result = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: pkt_ptr spill into caller stack 8",
+@@ -11783,6 +11843,7 @@ static struct bpf_test tests[] = {
+ },
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .result = ACCEPT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: pkt_ptr spill into caller stack 9",
+@@ -11824,6 +11885,7 @@ static struct bpf_test tests[] = {
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ .errstr = "invalid access to packet",
+ .result = REJECT,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "calls: caller stack init to zero or map_value_or_null",
+@@ -12189,6 +12251,7 @@ static struct bpf_test tests[] = {
+ .result = REJECT,
+ .errstr = "BPF_XADD stores into R2 packet",
+ .prog_type = BPF_PROG_TYPE_XDP,
++ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
+ {
+ "xadd/w check whether src/dst got mangled, 1",
+@@ -12628,18 +12691,18 @@ static int create_map(uint32_t type, uint32_t size_key,
+ return fd;
+ }
+
+-static int create_prog_dummy1(void)
++static int create_prog_dummy1(enum bpf_map_type prog_type)
+ {
+ struct bpf_insn prog[] = {
+ BPF_MOV64_IMM(BPF_REG_0, 42),
+ BPF_EXIT_INSN(),
+ };
+
+- return bpf_load_program(BPF_PROG_TYPE_SOCKET_FILTER, prog,
++ return bpf_load_program(prog_type, prog,
+ ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
+ }
+
+-static int create_prog_dummy2(int mfd, int idx)
++static int create_prog_dummy2(enum bpf_map_type prog_type, int mfd, int idx)
+ {
+ struct bpf_insn prog[] = {
+ BPF_MOV64_IMM(BPF_REG_3, idx),
+@@ -12650,11 +12713,12 @@ static int create_prog_dummy2(int mfd, int idx)
+ BPF_EXIT_INSN(),
+ };
+
+- return bpf_load_program(BPF_PROG_TYPE_SOCKET_FILTER, prog,
++ return bpf_load_program(prog_type, prog,
+ ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
+ }
+
+-static int create_prog_array(uint32_t max_elem, int p1key)
++static int create_prog_array(enum bpf_map_type prog_type, uint32_t max_elem,
++ int p1key)
+ {
+ int p2key = 1;
+ int mfd, p1fd, p2fd;
+@@ -12666,8 +12730,8 @@ static int create_prog_array(uint32_t max_elem, int p1key)
+ return -1;
+ }
+
+- p1fd = create_prog_dummy1();
+- p2fd = create_prog_dummy2(mfd, p2key);
++ p1fd = create_prog_dummy1(prog_type);
++ p2fd = create_prog_dummy2(prog_type, mfd, p2key);
+ if (p1fd < 0 || p2fd < 0)
+ goto out;
+ if (bpf_map_update_elem(mfd, &p1key, &p1fd, BPF_ANY) < 0)
+@@ -12722,8 +12786,8 @@ static int create_cgroup_storage(void)
+
+ static char bpf_vlog[UINT_MAX >> 8];
+
+-static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
+- int *map_fds)
++static void do_test_fixup(struct bpf_test *test, enum bpf_map_type prog_type,
++ struct bpf_insn *prog, int *map_fds)
+ {
+ int *fixup_map1 = test->fixup_map1;
+ int *fixup_map2 = test->fixup_map2;
+@@ -12778,7 +12842,7 @@ static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
+ }
+
+ if (*fixup_prog1) {
+- map_fds[4] = create_prog_array(4, 0);
++ map_fds[4] = create_prog_array(prog_type, 4, 0);
+ do {
+ prog[*fixup_prog1].imm = map_fds[4];
+ fixup_prog1++;
+@@ -12786,7 +12850,7 @@ static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
+ }
+
+ if (*fixup_prog2) {
+- map_fds[5] = create_prog_array(8, 7);
++ map_fds[5] = create_prog_array(prog_type, 8, 7);
+ do {
+ prog[*fixup_prog2].imm = map_fds[5];
+ fixup_prog2++;
+@@ -12810,54 +12874,90 @@ static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
+ }
+ }
+
++static int set_admin(bool admin)
++{
++ cap_t caps;
++ const cap_value_t cap_val = CAP_SYS_ADMIN;
++ int ret = -1;
++
++ caps = cap_get_proc();
++ if (!caps) {
++ perror("cap_get_proc");
++ return -1;
++ }
++ if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
++ admin ? CAP_SET : CAP_CLEAR)) {
++ perror("cap_set_flag");
++ goto out;
++ }
++ if (cap_set_proc(caps)) {
++ perror("cap_set_proc");
++ goto out;
++ }
++ ret = 0;
++out:
++ if (cap_free(caps))
++ perror("cap_free");
++ return ret;
++}
++
+ static void do_test_single(struct bpf_test *test, bool unpriv,
+ int *passes, int *errors)
+ {
+- int fd_prog, expected_ret, reject_from_alignment;
++ int fd_prog, expected_ret, alignment_prevented_execution;
+ int prog_len, prog_type = test->prog_type;
+ struct bpf_insn *prog = test->insns;
+ int map_fds[MAX_NR_MAPS];
+ const char *expected_err;
++ uint32_t expected_val;
+ uint32_t retval;
++ __u32 pflags;
+ int i, err;
+
+ for (i = 0; i < MAX_NR_MAPS; i++)
+ map_fds[i] = -1;
+
+- do_test_fixup(test, prog, map_fds);
++ if (!prog_type)
++ prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
++ do_test_fixup(test, prog_type, prog, map_fds);
+ prog_len = probe_filter_length(prog);
+
+- fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
+- prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
++ pflags = 0;
++ if (test->flags & F_LOAD_WITH_STRICT_ALIGNMENT)
++ pflags |= BPF_F_STRICT_ALIGNMENT;
++ if (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS)
++ pflags |= BPF_F_ANY_ALIGNMENT;
++ fd_prog = bpf_verify_program(prog_type, prog, prog_len, pflags,
+ "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
+
+ expected_ret = unpriv && test->result_unpriv != UNDEF ?
+ test->result_unpriv : test->result;
+ expected_err = unpriv && test->errstr_unpriv ?
+ test->errstr_unpriv : test->errstr;
++ expected_val = unpriv && test->retval_unpriv ?
++ test->retval_unpriv : test->retval;
++
++ alignment_prevented_execution = 0;
+
+- reject_from_alignment = fd_prog < 0 &&
+- (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
+- strstr(bpf_vlog, "misaligned");
+-#ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+- if (reject_from_alignment) {
+- printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
+- strerror(errno));
+- goto fail_log;
+- }
+-#endif
+ if (expected_ret == ACCEPT) {
+- if (fd_prog < 0 && !reject_from_alignment) {
++ if (fd_prog < 0) {
+ printf("FAIL\nFailed to load prog '%s'!\n",
+ strerror(errno));
+ goto fail_log;
+ }
++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
++ if (fd_prog >= 0 &&
++ (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS)) {
++ alignment_prevented_execution = 1;
++ goto test_ok;
++ }
++#endif
+ } else {
+ if (fd_prog >= 0) {
+ printf("FAIL\nUnexpected success to load!\n");
+ goto fail_log;
+ }
+- if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
++ if (!strstr(bpf_vlog, expected_err)) {
+ printf("FAIL\nUnexpected error message!\n\tEXP: %s\n\tRES: %s\n",
+ expected_err, bpf_vlog);
+ goto fail_log;
+@@ -12868,22 +12968,29 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
+ __u8 tmp[TEST_DATA_LEN << 2];
+ __u32 size_tmp = sizeof(tmp);
+
++ if (unpriv)
++ set_admin(true);
+ err = bpf_prog_test_run(fd_prog, 1, test->data,
+ sizeof(test->data), tmp, &size_tmp,
+ &retval, NULL);
++ if (unpriv)
++ set_admin(false);
+ if (err && errno != 524/*ENOTSUPP*/ && errno != EPERM) {
+ printf("Unexpected bpf_prog_test_run error\n");
+ goto fail_log;
+ }
+- if (!err && retval != test->retval &&
+- test->retval != POINTER_VALUE) {
+- printf("FAIL retval %d != %d\n", retval, test->retval);
++ if (!err && retval != expected_val &&
++ expected_val != POINTER_VALUE) {
++ printf("FAIL retval %d != %d\n", retval, expected_val);
+ goto fail_log;
+ }
+ }
++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
++test_ok:
++#endif
+ (*passes)++;
+- printf("OK%s\n", reject_from_alignment ?
+- " (NOTE: reject due to unknown alignment)" : "");
++ printf("OK%s\n", alignment_prevented_execution ?
++ " (NOTE: not executed due to unknown alignment)" : "");
+ close_fds:
+ close(fd_prog);
+ for (i = 0; i < MAX_NR_MAPS; i++)
+@@ -12920,33 +13027,6 @@ static bool is_admin(void)
+ return (sysadmin == CAP_SET);
+ }
+
+-static int set_admin(bool admin)
+-{
+- cap_t caps;
+- const cap_value_t cap_val = CAP_SYS_ADMIN;
+- int ret = -1;
+-
+- caps = cap_get_proc();
+- if (!caps) {
+- perror("cap_get_proc");
+- return -1;
+- }
+- if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
+- admin ? CAP_SET : CAP_CLEAR)) {
+- perror("cap_set_flag");
+- goto out;
+- }
+- if (cap_set_proc(caps)) {
+- perror("cap_set_proc");
+- goto out;
+- }
+- ret = 0;
+-out:
+- if (cap_free(caps))
+- perror("cap_free");
+- return ret;
+-}
+-
+ static void get_unpriv_disabled()
+ {
+ char buf[2];
+@@ -12963,6 +13043,26 @@ static void get_unpriv_disabled()
+ fclose(fd);
+ }
+
++static bool test_as_unpriv(struct bpf_test *test)
++{
++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
++ /* Some architectures have strict alignment requirements. In
++ * that case, the BPF verifier detects if a program has
++ * unaligned accesses and rejects them. A user can pass
++ * BPF_F_ANY_ALIGNMENT to a program to override this
++ * check. That, however, will only work when a privileged user
++ * loads a program. An unprivileged user loading a program
++ * with this flag will be rejected prior entering the
++ * verifier.
++ */
++ if (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS)
++ return false;
++#endif
++ return !test->prog_type ||
++ test->prog_type == BPF_PROG_TYPE_SOCKET_FILTER ||
++ test->prog_type == BPF_PROG_TYPE_CGROUP_SKB;
++}
++
+ static int do_test(bool unpriv, unsigned int from, unsigned int to)
+ {
+ int i, passes = 0, errors = 0, skips = 0;
+@@ -12973,10 +13073,10 @@ static int do_test(bool unpriv, unsigned int from, unsigned int to)
+ /* Program types that are not supported by non-root we
+ * skip right away.
+ */
+- if (!test->prog_type && unpriv_disabled) {
++ if (test_as_unpriv(test) && unpriv_disabled) {
+ printf("#%d/u %s SKIP\n", i, test->descr);
+ skips++;
+- } else if (!test->prog_type) {
++ } else if (test_as_unpriv(test)) {
+ if (!unpriv)
+ set_admin(false);
+ printf("#%d/u %s ", i, test->descr);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-06-16 12:22 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-06-16 12:22 UTC (permalink / raw
To: gentoo-commits
commit: 7e3269715d863e004f6716a9bfb2f858def7a42f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 16 12:22:12 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jun 16 12:22:12 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7e326971
Linux patch 4.19.195
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1194_linux-4.19.195.patch | 1827 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1831 insertions(+)
diff --git a/0000_README b/0000_README
index 50ca271..3d05639 100644
--- a/0000_README
+++ b/0000_README
@@ -815,6 +815,10 @@ Patch: 1193_linux-4.19.194.patch
From: https://www.kernel.org
Desc: Linux 4.19.194
+Patch: 1194_linux-4.19.195.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.195
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1194_linux-4.19.195.patch b/1194_linux-4.19.195.patch
new file mode 100644
index 0000000..c0c879e
--- /dev/null
+++ b/1194_linux-4.19.195.patch
@@ -0,0 +1,1827 @@
+diff --git a/Makefile b/Makefile
+index 8ea26b64b3347..9ff7a4b7b8cbd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 194
++SUBLEVEL = 195
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+index 5b4d78999f809..8d4a4cd01e07b 100644
+--- a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
++++ b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+@@ -407,6 +407,18 @@
+ vin-supply = <&sw1_reg>;
+ };
+
++®_pu {
++ vin-supply = <&sw1_reg>;
++};
++
++®_vdd1p1 {
++ vin-supply = <&sw2_reg>;
++};
++
++®_vdd2p5 {
++ vin-supply = <&sw2_reg>;
++};
++
+ &uart1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_uart1>;
+diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+index 6e46a195b3997..41384bbd2f60c 100644
+--- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+@@ -671,6 +671,18 @@
+ vin-supply = <&sw1c_reg>;
+ };
+
++®_vdd1p1 {
++ vin-supply = <&vgen5_reg>;
++};
++
++®_vdd3p0 {
++ vin-supply = <&sw2_reg>;
++};
++
++®_vdd2p5 {
++ vin-supply = <&vgen5_reg>;
++};
++
+ &snvs_poweroff {
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
+index e64ff80c83c54..9f88b5691f052 100644
+--- a/arch/arm/boot/dts/imx6qdl.dtsi
++++ b/arch/arm/boot/dts/imx6qdl.dtsi
+@@ -686,7 +686,7 @@
+ <0 54 IRQ_TYPE_LEVEL_HIGH>,
+ <0 127 IRQ_TYPE_LEVEL_HIGH>;
+
+- regulator-1p1 {
++ reg_vdd1p1: regulator-1p1 {
+ compatible = "fsl,anatop-regulator";
+ regulator-name = "vdd1p1";
+ regulator-min-microvolt = <1000000>;
+@@ -701,7 +701,7 @@
+ anatop-enable-bit = <0>;
+ };
+
+- regulator-3p0 {
++ reg_vdd3p0: regulator-3p0 {
+ compatible = "fsl,anatop-regulator";
+ regulator-name = "vdd3p0";
+ regulator-min-microvolt = <2800000>;
+@@ -716,7 +716,7 @@
+ anatop-enable-bit = <0>;
+ };
+
+- regulator-2p5 {
++ reg_vdd2p5: regulator-2p5 {
+ compatible = "fsl,anatop-regulator";
+ regulator-name = "vdd2p5";
+ regulator-min-microvolt = <2250000>;
+diff --git a/arch/mips/lib/mips-atomic.c b/arch/mips/lib/mips-atomic.c
+index 5530070e0d05d..57497a26e79cb 100644
+--- a/arch/mips/lib/mips-atomic.c
++++ b/arch/mips/lib/mips-atomic.c
+@@ -37,7 +37,7 @@
+ */
+ notrace void arch_local_irq_disable(void)
+ {
+- preempt_disable();
++ preempt_disable_notrace();
+
+ __asm__ __volatile__(
+ " .set push \n"
+@@ -53,7 +53,7 @@ notrace void arch_local_irq_disable(void)
+ : /* no inputs */
+ : "memory");
+
+- preempt_enable();
++ preempt_enable_notrace();
+ }
+ EXPORT_SYMBOL(arch_local_irq_disable);
+
+@@ -61,7 +61,7 @@ notrace unsigned long arch_local_irq_save(void)
+ {
+ unsigned long flags;
+
+- preempt_disable();
++ preempt_disable_notrace();
+
+ __asm__ __volatile__(
+ " .set push \n"
+@@ -78,7 +78,7 @@ notrace unsigned long arch_local_irq_save(void)
+ : /* no inputs */
+ : "memory");
+
+- preempt_enable();
++ preempt_enable_notrace();
+
+ return flags;
+ }
+@@ -88,7 +88,7 @@ notrace void arch_local_irq_restore(unsigned long flags)
+ {
+ unsigned long __tmp1;
+
+- preempt_disable();
++ preempt_disable_notrace();
+
+ __asm__ __volatile__(
+ " .set push \n"
+@@ -106,7 +106,7 @@ notrace void arch_local_irq_restore(unsigned long flags)
+ : "0" (flags)
+ : "memory");
+
+- preempt_enable();
++ preempt_enable_notrace();
+ }
+ EXPORT_SYMBOL(arch_local_irq_restore);
+
+diff --git a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi
+index 1b4aafc1f6a27..9716a0484ecf0 100644
+--- a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi
++++ b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi
+@@ -122,7 +122,15 @@
+ };
+
+ /include/ "pq3-i2c-0.dtsi"
++ i2c@3000 {
++ fsl,i2c-erratum-a004447;
++ };
++
+ /include/ "pq3-i2c-1.dtsi"
++ i2c@3100 {
++ fsl,i2c-erratum-a004447;
++ };
++
+ /include/ "pq3-duart-0.dtsi"
+ /include/ "pq3-espi-0.dtsi"
+ spi0: spi@7000 {
+diff --git a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
+index 51e975d7631aa..8921f17fca42e 100644
+--- a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
++++ b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
+@@ -389,7 +389,23 @@
+ };
+
+ /include/ "qoriq-i2c-0.dtsi"
++ i2c@118000 {
++ fsl,i2c-erratum-a004447;
++ };
++
++ i2c@118100 {
++ fsl,i2c-erratum-a004447;
++ };
++
+ /include/ "qoriq-i2c-1.dtsi"
++ i2c@119000 {
++ fsl,i2c-erratum-a004447;
++ };
++
++ i2c@119100 {
++ fsl,i2c-erratum-a004447;
++ };
++
+ /include/ "qoriq-duart-0.dtsi"
+ /include/ "qoriq-duart-1.dtsi"
+ /include/ "qoriq-gpio-0.dtsi"
+diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
+index 1669c42c40ed3..ce098eb57de54 100644
+--- a/drivers/gpu/drm/drm_auth.c
++++ b/drivers/gpu/drm/drm_auth.c
+@@ -265,9 +265,10 @@ int drm_master_open(struct drm_file *file_priv)
+ void drm_master_release(struct drm_file *file_priv)
+ {
+ struct drm_device *dev = file_priv->minor->dev;
+- struct drm_master *master = file_priv->master;
++ struct drm_master *master;
+
+ mutex_lock(&dev->master_mutex);
++ master = file_priv->master;
+ if (file_priv->magic)
+ idr_remove(&file_priv->master->magic_map, file_priv->magic);
+
+diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
+index b92682f037b22..2449b357f524b 100644
+--- a/drivers/gpu/drm/drm_ioctl.c
++++ b/drivers/gpu/drm/drm_ioctl.c
+@@ -112,17 +112,18 @@ int drm_getunique(struct drm_device *dev, void *data,
+ struct drm_file *file_priv)
+ {
+ struct drm_unique *u = data;
+- struct drm_master *master = file_priv->master;
++ struct drm_master *master;
+
+- mutex_lock(&master->dev->master_mutex);
++ mutex_lock(&dev->master_mutex);
++ master = file_priv->master;
+ if (u->unique_len >= master->unique_len) {
+ if (copy_to_user(u->unique, master->unique, master->unique_len)) {
+- mutex_unlock(&master->dev->master_mutex);
++ mutex_unlock(&dev->master_mutex);
+ return -EFAULT;
+ }
+ }
+ u->unique_len = master->unique_len;
+- mutex_unlock(&master->dev->master_mutex);
++ mutex_unlock(&dev->master_mutex);
+
+ return 0;
+ }
+diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
+index d94f05c8b8b79..af349661fd769 100644
+--- a/drivers/i2c/busses/i2c-mpc.c
++++ b/drivers/i2c/busses/i2c-mpc.c
+@@ -23,6 +23,7 @@
+
+ #include <linux/clk.h>
+ #include <linux/io.h>
++#include <linux/iopoll.h>
+ #include <linux/fsl_devices.h>
+ #include <linux/i2c.h>
+ #include <linux/interrupt.h>
+@@ -49,6 +50,7 @@
+ #define CCR_MTX 0x10
+ #define CCR_TXAK 0x08
+ #define CCR_RSTA 0x04
++#define CCR_RSVD 0x02
+
+ #define CSR_MCF 0x80
+ #define CSR_MAAS 0x40
+@@ -70,6 +72,7 @@ struct mpc_i2c {
+ u8 fdr, dfsrr;
+ #endif
+ struct clk *clk_per;
++ bool has_errata_A004447;
+ };
+
+ struct mpc_i2c_divider {
+@@ -176,6 +179,75 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
+ return 0;
+ }
+
++static int i2c_mpc_wait_sr(struct mpc_i2c *i2c, int mask)
++{
++ void __iomem *addr = i2c->base + MPC_I2C_SR;
++ u8 val;
++
++ return readb_poll_timeout(addr, val, val & mask, 0, 100);
++}
++
++/*
++ * Workaround for Erratum A004447. From the P2040CE Rev Q
++ *
++ * 1. Set up the frequency divider and sampling rate.
++ * 2. I2CCR - a0h
++ * 3. Poll for I2CSR[MBB] to get set.
++ * 4. If I2CSR[MAL] is set (an indication that SDA is stuck low), then go to
++ * step 5. If MAL is not set, then go to step 13.
++ * 5. I2CCR - 00h
++ * 6. I2CCR - 22h
++ * 7. I2CCR - a2h
++ * 8. Poll for I2CSR[MBB] to get set.
++ * 9. Issue read to I2CDR.
++ * 10. Poll for I2CSR[MIF] to be set.
++ * 11. I2CCR - 82h
++ * 12. Workaround complete. Skip the next steps.
++ * 13. Issue read to I2CDR.
++ * 14. Poll for I2CSR[MIF] to be set.
++ * 15. I2CCR - 80h
++ */
++static void mpc_i2c_fixup_A004447(struct mpc_i2c *i2c)
++{
++ int ret;
++ u32 val;
++
++ writeccr(i2c, CCR_MEN | CCR_MSTA);
++ ret = i2c_mpc_wait_sr(i2c, CSR_MBB);
++ if (ret) {
++ dev_err(i2c->dev, "timeout waiting for CSR_MBB\n");
++ return;
++ }
++
++ val = readb(i2c->base + MPC_I2C_SR);
++
++ if (val & CSR_MAL) {
++ writeccr(i2c, 0x00);
++ writeccr(i2c, CCR_MSTA | CCR_RSVD);
++ writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSVD);
++ ret = i2c_mpc_wait_sr(i2c, CSR_MBB);
++ if (ret) {
++ dev_err(i2c->dev, "timeout waiting for CSR_MBB\n");
++ return;
++ }
++ val = readb(i2c->base + MPC_I2C_DR);
++ ret = i2c_mpc_wait_sr(i2c, CSR_MIF);
++ if (ret) {
++ dev_err(i2c->dev, "timeout waiting for CSR_MIF\n");
++ return;
++ }
++ writeccr(i2c, CCR_MEN | CCR_RSVD);
++ } else {
++ val = readb(i2c->base + MPC_I2C_DR);
++ ret = i2c_mpc_wait_sr(i2c, CSR_MIF);
++ if (ret) {
++ dev_err(i2c->dev, "timeout waiting for CSR_MIF\n");
++ return;
++ }
++ writeccr(i2c, CCR_MEN);
++ }
++}
++
+ #if defined(CONFIG_PPC_MPC52xx) || defined(CONFIG_PPC_MPC512x)
+ static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
+ {20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23},
+@@ -586,7 +658,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) {
+ writeb(status & ~CSR_MAL,
+ i2c->base + MPC_I2C_SR);
+- mpc_i2c_fixup(i2c);
++ i2c_recover_bus(&i2c->adap);
+ }
+ return -EIO;
+ }
+@@ -622,7 +694,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) {
+ writeb(status & ~CSR_MAL,
+ i2c->base + MPC_I2C_SR);
+- mpc_i2c_fixup(i2c);
++ i2c_recover_bus(&i2c->adap);
+ }
+ return -EIO;
+ }
+@@ -637,6 +709,18 @@ static u32 mpc_functionality(struct i2c_adapter *adap)
+ | I2C_FUNC_SMBUS_READ_BLOCK_DATA | I2C_FUNC_SMBUS_BLOCK_PROC_CALL;
+ }
+
++static int fsl_i2c_bus_recovery(struct i2c_adapter *adap)
++{
++ struct mpc_i2c *i2c = i2c_get_adapdata(adap);
++
++ if (i2c->has_errata_A004447)
++ mpc_i2c_fixup_A004447(i2c);
++ else
++ mpc_i2c_fixup(i2c);
++
++ return 0;
++}
++
+ static const struct i2c_algorithm mpc_algo = {
+ .master_xfer = mpc_xfer,
+ .functionality = mpc_functionality,
+@@ -648,6 +732,10 @@ static struct i2c_adapter mpc_ops = {
+ .timeout = HZ,
+ };
+
++static struct i2c_bus_recovery_info fsl_i2c_recovery_info = {
++ .recover_bus = fsl_i2c_bus_recovery,
++};
++
+ static const struct of_device_id mpc_i2c_of_match[];
+ static int fsl_i2c_probe(struct platform_device *op)
+ {
+@@ -732,6 +820,8 @@ static int fsl_i2c_probe(struct platform_device *op)
+ dev_info(i2c->dev, "timeout %u us\n", mpc_ops.timeout * 1000000 / HZ);
+
+ platform_set_drvdata(op, i2c);
++ if (of_property_read_bool(op->dev.of_node, "fsl,i2c-erratum-a004447"))
++ i2c->has_errata_A004447 = true;
+
+ i2c->adap = mpc_ops;
+ of_address_to_resource(op->dev.of_node, 0, &res);
+@@ -740,6 +830,7 @@ static int fsl_i2c_probe(struct platform_device *op)
+ i2c_set_adapdata(&i2c->adap, i2c);
+ i2c->adap.dev.parent = &op->dev;
+ i2c->adap.dev.of_node = of_node_get(op->dev.of_node);
++ i2c->adap.bus_recovery_info = &fsl_i2c_recovery_info;
+
+ result = i2c_add_adapter(&i2c->adap);
+ if (result < 0)
+diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
+index eac4ade456119..e64d934f7bac7 100644
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -577,12 +577,9 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
+ props->cq_caps.max_cq_moderation_count = MLX4_MAX_CQ_COUNT;
+ props->cq_caps.max_cq_moderation_period = MLX4_MAX_CQ_PERIOD;
+
+- if (!mlx4_is_slave(dev->dev))
+- err = mlx4_get_internal_clock_params(dev->dev, &clock_params);
+-
+ if (uhw->outlen >= resp.response_length + sizeof(resp.hca_core_clock_offset)) {
+ resp.response_length += sizeof(resp.hca_core_clock_offset);
+- if (!err && !mlx4_is_slave(dev->dev)) {
++ if (!mlx4_get_internal_clock_params(dev->dev, &clock_params)) {
+ resp.comp_mask |= MLX4_IB_QUERY_DEV_RESP_MASK_CORE_CLOCK_OFFSET;
+ resp.hca_core_clock_offset = clock_params.offset % PAGE_SIZE;
+ }
+diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
+index 088205d7f1a19..872985e4eebec 100644
+--- a/drivers/infiniband/hw/mlx5/cq.c
++++ b/drivers/infiniband/hw/mlx5/cq.c
+@@ -896,15 +896,14 @@ static void destroy_cq_user(struct mlx5_ib_cq *cq, struct ib_ucontext *context)
+ ib_umem_release(cq->buf.umem);
+ }
+
+-static void init_cq_frag_buf(struct mlx5_ib_cq *cq,
+- struct mlx5_ib_cq_buf *buf)
++static void init_cq_frag_buf(struct mlx5_ib_cq_buf *buf)
+ {
+ int i;
+ void *cqe;
+ struct mlx5_cqe64 *cqe64;
+
+ for (i = 0; i < buf->nent; i++) {
+- cqe = get_cqe(cq, i);
++ cqe = mlx5_frag_buf_get_wqe(&buf->fbc, i);
+ cqe64 = buf->cqe_size == 64 ? cqe : cqe + 64;
+ cqe64->op_own = MLX5_CQE_INVALID << 4;
+ }
+@@ -930,7 +929,7 @@ static int create_cq_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq,
+ if (err)
+ goto err_db;
+
+- init_cq_frag_buf(cq, &cq->buf);
++ init_cq_frag_buf(&cq->buf);
+
+ *inlen = MLX5_ST_SZ_BYTES(create_cq_in) +
+ MLX5_FLD_SZ_BYTES(create_cq_in, pas[0]) *
+@@ -1253,7 +1252,7 @@ static int resize_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq,
+ if (err)
+ goto ex;
+
+- init_cq_frag_buf(cq, cq->resize_buf);
++ init_cq_frag_buf(cq->resize_buf);
+
+ return 0;
+
+diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
+index 2b317cb63d068..448370da2c3f2 100644
+--- a/drivers/isdn/hardware/mISDN/netjet.c
++++ b/drivers/isdn/hardware/mISDN/netjet.c
+@@ -1114,7 +1114,6 @@ nj_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ card->typ = NETJET_S_TJ300;
+
+ card->base = pci_resource_start(pdev, 0);
+- card->irq = pdev->irq;
+ pci_set_drvdata(pdev, card);
+ err = setup_instance(card);
+ if (err)
+diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c
+index bb49f6e40a19e..0a7889abf2b2e 100644
+--- a/drivers/net/appletalk/cops.c
++++ b/drivers/net/appletalk/cops.c
+@@ -325,6 +325,8 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr)
+ break;
+ }
+
++ dev->base_addr = ioaddr;
++
+ /* Reserve any actual interrupt. */
+ if (dev->irq) {
+ retval = request_irq(dev->irq, cops_interrupt, 0, dev->name, dev);
+@@ -332,8 +334,6 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr)
+ goto err_out;
+ }
+
+- dev->base_addr = ioaddr;
+-
+ lp = netdev_priv(dev);
+ spin_lock_init(&lp->lock);
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index c21c4291921f6..c814b266af794 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1310,6 +1310,7 @@ static struct slave *bond_alloc_slave(struct bonding *bond,
+
+ slave->bond = bond;
+ slave->dev = slave_dev;
++ INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work);
+
+ if (bond_kobj_init(slave))
+ return NULL;
+@@ -1322,7 +1323,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond,
+ return NULL;
+ }
+ }
+- INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work);
+
+ return slave;
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+index ab60f4f9cc246..77005f6366eb1 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+@@ -1244,8 +1244,10 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param,
+ goto failed;
+
+ /* SR-IOV capability was enabled but there are no VFs*/
+- if (iov->total == 0)
++ if (iov->total == 0) {
++ err = -EINVAL;
+ goto failed;
++ }
+
+ iov->nr_virtfn = min_t(u16, iov->total, num_vfs_param);
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 0374a1ba10103..d110aa616a957 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -2513,6 +2513,9 @@ static struct net_device_stats *gem_get_stats(struct macb *bp)
+ struct gem_stats *hwstat = &bp->hw_stats.gem;
+ struct net_device_stats *nstat = &bp->dev->stats;
+
++ if (!netif_running(bp->dev))
++ return nstat;
++
+ gem_update_stats(bp);
+
+ nstat->rx_errors = (hwstat->rx_frame_check_sequence_errors +
+diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
+index 926407f0bbd9d..ce57df04ae87d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
+@@ -822,6 +822,7 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
+ #define QUERY_DEV_CAP_MAD_DEMUX_OFFSET 0xb0
+ #define QUERY_DEV_CAP_DMFS_HIGH_RATE_QPN_BASE_OFFSET 0xa8
+ #define QUERY_DEV_CAP_DMFS_HIGH_RATE_QPN_RANGE_OFFSET 0xac
++#define QUERY_DEV_CAP_MAP_CLOCK_TO_USER 0xc1
+ #define QUERY_DEV_CAP_QP_RATE_LIMIT_NUM_OFFSET 0xcc
+ #define QUERY_DEV_CAP_QP_RATE_LIMIT_MAX_OFFSET 0xd0
+ #define QUERY_DEV_CAP_QP_RATE_LIMIT_MIN_OFFSET 0xd2
+@@ -840,6 +841,8 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
+
+ if (mlx4_is_mfunc(dev))
+ disable_unsupported_roce_caps(outbox);
++ MLX4_GET(field, outbox, QUERY_DEV_CAP_MAP_CLOCK_TO_USER);
++ dev_cap->map_clock_to_user = field & 0x80;
+ MLX4_GET(field, outbox, QUERY_DEV_CAP_RSVD_QP_OFFSET);
+ dev_cap->reserved_qps = 1 << (field & 0xf);
+ MLX4_GET(field, outbox, QUERY_DEV_CAP_MAX_QP_OFFSET);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.h b/drivers/net/ethernet/mellanox/mlx4/fw.h
+index 8f020f26ebf5f..cf64e54eecb05 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.h
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.h
+@@ -131,6 +131,7 @@ struct mlx4_dev_cap {
+ u32 health_buffer_addrs;
+ struct mlx4_port_cap port_cap[MLX4_MAX_PORTS + 1];
+ bool wol_port[MLX4_MAX_PORTS + 1];
++ bool map_clock_to_user;
+ };
+
+ struct mlx4_func_cap {
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index 8d7bb9a889677..a0affcb090a05 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -498,6 +498,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
+ }
+ }
+
++ dev->caps.map_clock_to_user = dev_cap->map_clock_to_user;
+ dev->caps.uar_page_size = PAGE_SIZE;
+ dev->caps.num_uars = dev_cap->uar_size / PAGE_SIZE;
+ dev->caps.local_ca_ack_delay = dev_cap->local_ca_ack_delay;
+@@ -1949,6 +1950,11 @@ int mlx4_get_internal_clock_params(struct mlx4_dev *dev,
+ if (mlx4_is_slave(dev))
+ return -EOPNOTSUPP;
+
++ if (!dev->caps.map_clock_to_user) {
++ mlx4_dbg(dev, "Map clock to user is not supported.\n");
++ return -EOPNOTSUPP;
++ }
++
+ if (!params)
+ return -EINVAL;
+
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
+index 1b5e098b2367e..2d71646640ac5 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -115,7 +115,7 @@ static int ql_sem_spinlock(struct ql3_adapter *qdev,
+ value = readl(&port_regs->CommonRegs.semaphoreReg);
+ if ((value & (sem_mask >> 16)) == sem_bits)
+ return 0;
+- ssleep(1);
++ mdelay(1000);
+ } while (--seconds);
+ return -1;
+ }
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index 5c89a310359de..08c81d4cfca86 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -446,7 +446,8 @@ void mdiobus_unregister(struct mii_bus *bus)
+ struct mdio_device *mdiodev;
+ int i;
+
+- BUG_ON(bus->state != MDIOBUS_REGISTERED);
++ if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED))
++ return;
+ bus->state = MDIOBUS_UNREGISTERED;
+
+ for (i = 0; i < PHY_MAX_ADDR; i++) {
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index 05dd46f984414..3ae800e879994 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -344,6 +344,11 @@ static void nvmf_log_connect_error(struct nvme_ctrl *ctrl,
+ cmd->connect.recfmt);
+ break;
+
++ case NVME_SC_HOST_PATH_ERROR:
++ dev_err(ctrl->device,
++ "Connect command failed: host path error\n");
++ break;
++
+ default:
+ dev_err(ctrl->device,
+ "Connect command failed, error wo/DNR bit: %d\n",
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 65e1cde13d59e..088ed4ee6d83e 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1191,6 +1191,12 @@ static int set_machine_constraints(struct regulator_dev *rdev)
+ * and we have control then make sure it is enabled.
+ */
+ if (rdev->constraints->always_on || rdev->constraints->boot_on) {
++ /* If we want to enable this regulator, make sure that we know
++ * the supplying regulator.
++ */
++ if (rdev->supply_name && !rdev->supply)
++ return -EPROBE_DEFER;
++
+ if (rdev->supply) {
+ ret = regulator_enable(rdev->supply);
+ if (ret < 0) {
+diff --git a/drivers/regulator/max77620-regulator.c b/drivers/regulator/max77620-regulator.c
+index cd93cf53e23c0..28baeac3a5a45 100644
+--- a/drivers/regulator/max77620-regulator.c
++++ b/drivers/regulator/max77620-regulator.c
+@@ -792,6 +792,13 @@ static int max77620_regulator_probe(struct platform_device *pdev)
+ config.dev = dev;
+ config.driver_data = pmic;
+
++ /*
++ * Set of_node_reuse flag to prevent driver core from attempting to
++ * claim any pinmux resources already claimed by the parent device.
++ * Otherwise PMIC driver will fail to re-probe.
++ */
++ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
++
+ for (id = 0; id < MAX77620_NUM_REGS; id++) {
+ struct regulator_dev *rdev;
+ struct regulator_desc *rdesc;
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
+index bc9f2a2365f4d..5d89cc30bf301 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
+@@ -1218,6 +1218,7 @@ int bnx2fc_eh_abort(struct scsi_cmnd *sc_cmd)
+ was a result from the ABTS request rather than the CLEANUP
+ request */
+ set_bit(BNX2FC_FLAG_IO_CLEANUP, &io_req->req_flags);
++ rc = FAILED;
+ goto done;
+ }
+
+diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
+index ea4b0bb0c1cd4..fa03be813f2cb 100644
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -261,12 +261,11 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
+
+ device_enable_async_suspend(&shost->shost_dev);
+
++ get_device(&shost->shost_gendev);
+ error = device_add(&shost->shost_dev);
+ if (error)
+ goto out_del_gendev;
+
+- get_device(&shost->shost_gendev);
+-
+ if (shost->transportt->host_size) {
+ shost->shost_data = kzalloc(shost->transportt->host_size,
+ GFP_KERNEL);
+@@ -303,6 +302,11 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
+ out_del_dev:
+ device_del(&shost->shost_dev);
+ out_del_gendev:
++ /*
++ * Host state is SHOST_RUNNING so we have to explicitly release
++ * ->shost_dev.
++ */
++ put_device(&shost->shost_dev);
+ device_del(&shost->shost_gendev);
+ out_disable_runtime_pm:
+ device_disable_async_suspend(&shost->shost_gendev);
+@@ -356,7 +360,7 @@ static void scsi_host_dev_release(struct device *dev)
+
+ ida_simple_remove(&host_index_ida, shost->host_no);
+
+- if (parent)
++ if (shost->shost_state != SHOST_CREATED)
+ put_device(parent);
+ kfree(shost);
+ }
+@@ -403,8 +407,10 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
+ mutex_init(&shost->scan_mutex);
+
+ index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL);
+- if (index < 0)
+- goto fail_kfree;
++ if (index < 0) {
++ kfree(shost);
++ return NULL;
++ }
+ shost->host_no = index;
+
+ shost->dma_channel = 0xff;
+@@ -491,7 +497,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
+ shost_printk(KERN_WARNING, shost,
+ "error handler thread failed to spawn, error = %ld\n",
+ PTR_ERR(shost->ehandler));
+- goto fail_index_remove;
++ goto fail;
+ }
+
+ shost->tmf_work_q = alloc_workqueue("scsi_tmf_%d",
+@@ -500,17 +506,18 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
+ if (!shost->tmf_work_q) {
+ shost_printk(KERN_WARNING, shost,
+ "failed to create tmf workq\n");
+- goto fail_kthread;
++ goto fail;
+ }
+ scsi_proc_hostdir_add(shost->hostt);
+ return shost;
++ fail:
++ /*
++ * Host state is still SHOST_CREATED and that is enough to release
++ * ->shost_gendev. scsi_host_dev_release() will free
++ * dev_name(&shost->shost_dev).
++ */
++ put_device(&shost->shost_gendev);
+
+- fail_kthread:
+- kthread_stop(shost->ehandler);
+- fail_index_remove:
+- ida_simple_remove(&host_index_ida, shost->host_no);
+- fail_kfree:
+- kfree(shost);
+ return NULL;
+ }
+ EXPORT_SYMBOL(scsi_host_alloc);
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index eb6112eb475e9..ec54c8f34bc84 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1571,10 +1571,12 @@ void qlt_stop_phase2(struct qla_tgt *tgt)
+ return;
+ }
+
++ mutex_lock(&tgt->ha->optrom_mutex);
+ mutex_lock(&vha->vha_tgt.tgt_mutex);
+ tgt->tgt_stop = 0;
+ tgt->tgt_stopped = 1;
+ mutex_unlock(&vha->vha_tgt.tgt_mutex);
++ mutex_unlock(&tgt->ha->optrom_mutex);
+
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf00c, "Stop of tgt %p finished\n",
+ tgt);
+diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
+index 64eb8ffb2ddfa..2c707b5c7b0b7 100644
+--- a/drivers/scsi/vmw_pvscsi.c
++++ b/drivers/scsi/vmw_pvscsi.c
+@@ -574,7 +574,13 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
+ case BTSTAT_SUCCESS:
+ case BTSTAT_LINKED_COMMAND_COMPLETED:
+ case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG:
+- /* If everything went fine, let's move on.. */
++ /*
++ * Commands like INQUIRY may transfer less data than
++ * requested by the initiator via bufflen. Set residual
++ * count to make upper layer aware of the actual amount
++ * of data returned.
++ */
++ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen);
+ cmd->result = (DID_OK << 16);
+ break;
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+index db553f2e4c0b8..da2e6fde938ea 100644
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+@@ -2416,7 +2416,7 @@ void rtw_cfg80211_indicate_sta_assoc(struct adapter *padapter, u8 *pmgmt_frame,
+ DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+ {
+- struct station_info sinfo;
++ struct station_info sinfo = {};
+ u8 ie_offset;
+ if (GetFrameSubType(pmgmt_frame) == WIFI_ASSOCREQ)
+ ie_offset = _ASOCREQ_IE_OFFSET_;
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index 0d95ca804c1e2..f0e492e25f480 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -292,6 +292,9 @@ static struct dwc3_ep *dwc3_wIndex_to_dep(struct dwc3 *dwc, __le16 wIndex_le)
+ epnum |= 1;
+
+ dep = dwc->eps[epnum];
++ if (dep == NULL)
++ return NULL;
++
+ if (dep->flags & DWC3_EP_ENABLED)
+ return dep;
+
+diff --git a/drivers/usb/gadget/config.c b/drivers/usb/gadget/config.c
+index 8bb25773b61e9..05507606b2b42 100644
+--- a/drivers/usb/gadget/config.c
++++ b/drivers/usb/gadget/config.c
+@@ -164,6 +164,14 @@ int usb_assign_descriptors(struct usb_function *f,
+ {
+ struct usb_gadget *g = f->config->cdev->gadget;
+
++ /* super-speed-plus descriptor falls back to super-speed one,
++ * if such a descriptor was provided, thus avoiding a NULL
++ * pointer dereference if a 5gbps capable gadget is used with
++ * a 10gbps capable config (device port + cable + host port)
++ */
++ if (!ssp)
++ ssp = ss;
++
+ if (fs) {
+ f->fs_descriptors = usb_copy_descriptors(fs);
+ if (!f->fs_descriptors)
+diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c
+index 7f5cf488b2b1e..ffe2486fce71c 100644
+--- a/drivers/usb/gadget/function/f_ecm.c
++++ b/drivers/usb/gadget/function/f_ecm.c
+@@ -791,7 +791,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f)
+ fs_ecm_notify_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, ecm_fs_function, ecm_hs_function,
+- ecm_ss_function, NULL);
++ ecm_ss_function, ecm_ss_function);
+ if (status)
+ goto fail;
+
+diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
+index c13befa311107..bdd964ac9fa9a 100644
+--- a/drivers/usb/gadget/function/f_eem.c
++++ b/drivers/usb/gadget/function/f_eem.c
+@@ -305,7 +305,7 @@ static int eem_bind(struct usb_configuration *c, struct usb_function *f)
+ eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, eem_fs_function, eem_hs_function,
+- eem_ss_function, NULL);
++ eem_ss_function, eem_ss_function);
+ if (status)
+ goto fail;
+
+@@ -498,7 +498,7 @@ static int eem_unwrap(struct gether *port,
+ skb2 = skb_clone(skb, GFP_ATOMIC);
+ if (unlikely(!skb2)) {
+ DBG(cdev, "unable to unframe EEM packet\n");
+- continue;
++ goto next;
+ }
+ skb_trim(skb2, len - ETH_FCS_LEN);
+
+@@ -508,7 +508,7 @@ static int eem_unwrap(struct gether *port,
+ GFP_ATOMIC);
+ if (unlikely(!skb3)) {
+ dev_kfree_skb_any(skb2);
+- continue;
++ goto next;
+ }
+ dev_kfree_skb_any(skb2);
+ skb_queue_tail(list, skb3);
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index dcb432860d062..f13ec86371e72 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -3469,6 +3469,9 @@ static void ffs_func_unbind(struct usb_configuration *c,
+ ffs->func = NULL;
+ }
+
++ /* Drain any pending AIO completions */
++ drain_workqueue(ffs->io_completion_wq);
++
+ if (!--opts->refcnt)
+ functionfs_unbind(ffs);
+
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index 492bb44153b34..bc0a693c3260d 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -808,7 +808,8 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
+ hidg_fs_out_ep_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, hidg_fs_descriptors,
+- hidg_hs_descriptors, hidg_ss_descriptors, NULL);
++ hidg_hs_descriptors, hidg_ss_descriptors,
++ hidg_ss_descriptors);
+ if (status)
+ goto fail;
+
+diff --git a/drivers/usb/gadget/function/f_loopback.c b/drivers/usb/gadget/function/f_loopback.c
+index 1803646b36780..90215a81c178b 100644
+--- a/drivers/usb/gadget/function/f_loopback.c
++++ b/drivers/usb/gadget/function/f_loopback.c
+@@ -207,7 +207,7 @@ autoconf_fail:
+ ss_loop_sink_desc.bEndpointAddress = fs_loop_sink_desc.bEndpointAddress;
+
+ ret = usb_assign_descriptors(f, fs_loopback_descs, hs_loopback_descs,
+- ss_loopback_descs, NULL);
++ ss_loopback_descs, ss_loopback_descs);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index e4aa370e86a9e..10b4612df8a77 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -583,7 +583,7 @@ static void ncm_do_notify(struct f_ncm *ncm)
+ data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
+ data[1] = data[0];
+
+- DBG(cdev, "notify speed %d\n", ncm_bitrate(cdev->gadget));
++ DBG(cdev, "notify speed %u\n", ncm_bitrate(cdev->gadget));
+ ncm->notify_state = NCM_NOTIFY_CONNECT;
+ break;
+ }
+@@ -1104,11 +1104,11 @@ static struct sk_buff *ncm_wrap_ntb(struct gether *port,
+ ncm->ndp_dgram_count = 1;
+
+ /* Note: we skip opts->next_ndp_index */
+- }
+
+- /* Delay the timer. */
+- hrtimer_start(&ncm->task_timer, TX_TIMEOUT_NSECS,
+- HRTIMER_MODE_REL_SOFT);
++ /* Start the timer. */
++ hrtimer_start(&ncm->task_timer, TX_TIMEOUT_NSECS,
++ HRTIMER_MODE_REL_SOFT);
++ }
+
+ /* Add the datagram position entries */
+ ntb_ndp = skb_put_zero(ncm->skb_tx_ndp, dgram_idx_len);
+diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
+index 0f47cd398d60a..2a1868b2d24cf 100644
+--- a/drivers/usb/gadget/function/f_printer.c
++++ b/drivers/usb/gadget/function/f_printer.c
+@@ -1063,7 +1063,8 @@ autoconf_fail:
+ ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;
+
+ ret = usb_assign_descriptors(f, fs_printer_function,
+- hs_printer_function, ss_printer_function, NULL);
++ hs_printer_function, ss_printer_function,
++ ss_printer_function);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
+index cc1ff5b7b60c4..f20c55d42f219 100644
+--- a/drivers/usb/gadget/function/f_rndis.c
++++ b/drivers/usb/gadget/function/f_rndis.c
+@@ -789,7 +789,7 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
+ ss_notify_desc.bEndpointAddress = fs_notify_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, eth_fs_function, eth_hs_function,
+- eth_ss_function, NULL);
++ eth_ss_function, eth_ss_function);
+ if (status)
+ goto fail;
+
+diff --git a/drivers/usb/gadget/function/f_serial.c b/drivers/usb/gadget/function/f_serial.c
+index c860f30a0ea2b..6db973d0c252e 100644
+--- a/drivers/usb/gadget/function/f_serial.c
++++ b/drivers/usb/gadget/function/f_serial.c
+@@ -233,7 +233,7 @@ static int gser_bind(struct usb_configuration *c, struct usb_function *f)
+ gser_ss_out_desc.bEndpointAddress = gser_fs_out_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, gser_fs_function, gser_hs_function,
+- gser_ss_function, NULL);
++ gser_ss_function, gser_ss_function);
+ if (status)
+ goto fail;
+ dev_dbg(&cdev->gadget->dev, "generic ttyGS%d: %s speed IN/%s OUT/%s\n",
+diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
+index ed68a4860b7d8..282737e4609ce 100644
+--- a/drivers/usb/gadget/function/f_sourcesink.c
++++ b/drivers/usb/gadget/function/f_sourcesink.c
+@@ -431,7 +431,8 @@ no_iso:
+ ss_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress;
+
+ ret = usb_assign_descriptors(f, fs_source_sink_descs,
+- hs_source_sink_descs, ss_source_sink_descs, NULL);
++ hs_source_sink_descs, ss_source_sink_descs,
++ ss_source_sink_descs);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/usb/gadget/function/f_subset.c b/drivers/usb/gadget/function/f_subset.c
+index 4d945254905d9..51c1cae162d9b 100644
+--- a/drivers/usb/gadget/function/f_subset.c
++++ b/drivers/usb/gadget/function/f_subset.c
+@@ -358,7 +358,7 @@ geth_bind(struct usb_configuration *c, struct usb_function *f)
+ fs_subset_out_desc.bEndpointAddress;
+
+ status = usb_assign_descriptors(f, fs_eth_function, hs_eth_function,
+- ss_eth_function, NULL);
++ ss_eth_function, ss_eth_function);
+ if (status)
+ goto fail;
+
+diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
+index 785826ab5348e..3c68b3ccb8a82 100644
+--- a/drivers/usb/gadget/function/f_tcm.c
++++ b/drivers/usb/gadget/function/f_tcm.c
+@@ -2071,7 +2071,8 @@ static int tcm_bind(struct usb_configuration *c, struct usb_function *f)
+ uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
+
+ ret = usb_assign_descriptors(f, uasp_fs_function_desc,
+- uasp_hs_function_desc, uasp_ss_function_desc, NULL);
++ uasp_hs_function_desc, uasp_ss_function_desc,
++ uasp_ss_function_desc);
+ if (ret)
+ goto ep_fail;
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 7d602e6ccbc09..851f178ff56fc 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -485,6 +485,12 @@ struct cp210x_config {
+ #define CP210X_2NCONFIG_GPIO_RSTLATCH_IDX 587
+ #define CP210X_2NCONFIG_GPIO_CONTROL_IDX 600
+
++/* CP2102N QFN20 port configuration values */
++#define CP2102N_QFN20_GPIO2_TXLED_MODE BIT(2)
++#define CP2102N_QFN20_GPIO3_RXLED_MODE BIT(3)
++#define CP2102N_QFN20_GPIO1_RS485_MODE BIT(4)
++#define CP2102N_QFN20_GPIO0_CLK_MODE BIT(6)
++
+ /* CP210X_VENDOR_SPECIFIC, CP210X_WRITE_LATCH call writes these 0x2 bytes. */
+ struct cp210x_gpio_write {
+ u8 mask;
+@@ -1630,7 +1636,19 @@ static int cp2102n_gpioconf_init(struct usb_serial *serial)
+ priv->gpio_pushpull = (gpio_pushpull >> 3) & 0x0f;
+
+ /* 0 indicates GPIO mode, 1 is alternate function */
+- priv->gpio_altfunc = (gpio_ctrl >> 2) & 0x0f;
++ if (priv->partnum == CP210X_PARTNUM_CP2102N_QFN20) {
++ /* QFN20 is special... */
++ if (gpio_ctrl & CP2102N_QFN20_GPIO0_CLK_MODE) /* GPIO 0 */
++ priv->gpio_altfunc |= BIT(0);
++ if (gpio_ctrl & CP2102N_QFN20_GPIO1_RS485_MODE) /* GPIO 1 */
++ priv->gpio_altfunc |= BIT(1);
++ if (gpio_ctrl & CP2102N_QFN20_GPIO2_TXLED_MODE) /* GPIO 2 */
++ priv->gpio_altfunc |= BIT(2);
++ if (gpio_ctrl & CP2102N_QFN20_GPIO3_RXLED_MODE) /* GPIO 3 */
++ priv->gpio_altfunc |= BIT(3);
++ } else {
++ priv->gpio_altfunc = (gpio_ctrl >> 2) & 0x0f;
++ }
+
+ /*
+ * The CP2102N does not strictly has input and output pin modes,
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 37575d7983c0b..8242bf6863035 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -601,6 +601,7 @@ static const struct usb_device_id id_table_combined[] = {
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONMX_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index d854e04a4286e..add602bebd820 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -581,6 +581,7 @@
+ #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
+ #define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */
+ #define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */
++#define FTDI_NT_ORIONMX_PID 0x7c93 /* OrionMX */
+
+ /*
+ * Synapse Wireless product ids (FTDI_VID)
+diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
+index e51c9464ea426..a9b0849c5ef67 100644
+--- a/drivers/usb/serial/omninet.c
++++ b/drivers/usb/serial/omninet.c
+@@ -26,6 +26,7 @@
+
+ #define ZYXEL_VENDOR_ID 0x0586
+ #define ZYXEL_OMNINET_ID 0x1000
++#define ZYXEL_OMNI_56K_PLUS_ID 0x1500
+ /* This one seems to be a re-branded ZyXEL device */
+ #define BT_IGNITIONPRO_ID 0x2000
+
+@@ -40,6 +41,7 @@ static int omninet_port_remove(struct usb_serial_port *port);
+
+ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(ZYXEL_VENDOR_ID, ZYXEL_OMNINET_ID) },
++ { USB_DEVICE(ZYXEL_VENDOR_ID, ZYXEL_OMNI_56K_PLUS_ID) },
+ { USB_DEVICE(ZYXEL_VENDOR_ID, BT_IGNITIONPRO_ID) },
+ { } /* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
+index 9ae57a961027a..d212c80c59ace 100644
+--- a/drivers/usb/serial/quatech2.c
++++ b/drivers/usb/serial/quatech2.c
+@@ -416,7 +416,7 @@ static void qt2_close(struct usb_serial_port *port)
+
+ /* flush the port transmit buffer */
+ i = usb_control_msg(serial->dev,
+- usb_rcvctrlpipe(serial->dev, 0),
++ usb_sndctrlpipe(serial->dev, 0),
+ QT2_FLUSH_DEVICE, 0x40, 1,
+ port_priv->device_port, NULL, 0, QT2_USB_TIMEOUT);
+
+@@ -426,7 +426,7 @@ static void qt2_close(struct usb_serial_port *port)
+
+ /* flush the port receive buffer */
+ i = usb_control_msg(serial->dev,
+- usb_rcvctrlpipe(serial->dev, 0),
++ usb_sndctrlpipe(serial->dev, 0),
+ QT2_FLUSH_DEVICE, 0x40, 0,
+ port_priv->device_port, NULL, 0, QT2_USB_TIMEOUT);
+
+@@ -693,7 +693,7 @@ static int qt2_attach(struct usb_serial *serial)
+ int status;
+
+ /* power on unit */
+- status = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
++ status = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+ 0xc2, 0x40, 0x8000, 0, NULL, 0,
+ QT2_USB_TIMEOUT);
+ if (status < 0) {
+diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
+index 8d0a6fe748bdc..b7a8aad35c89e 100644
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -735,6 +735,7 @@ err_unregister:
+ }
+
+ err_reset:
++ memset(&ucsi->cap, 0, sizeof(ucsi->cap));
+ ucsi_reset_ppm(ucsi);
+ err:
+ mutex_unlock(&ucsi->ppm_lock);
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index a202f2f12b1c0..41ad37f8062a9 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1154,7 +1154,7 @@ int btrfs_mark_extent_written(struct btrfs_trans_handle *trans,
+ int del_nr = 0;
+ int del_slot = 0;
+ int recow;
+- int ret;
++ int ret = 0;
+ u64 ino = btrfs_ino(inode);
+
+ path = btrfs_alloc_path();
+@@ -1374,7 +1374,7 @@ again:
+ }
+ out:
+ btrfs_free_path(path);
+- return 0;
++ return ret;
+ }
+
+ /*
+diff --git a/fs/nfs/client.c b/fs/nfs/client.c
+index 07c5ddd5d6d50..78b6f8bc9d76b 100644
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -407,7 +407,7 @@ struct nfs_client *nfs_get_client(const struct nfs_client_initdata *cl_init)
+
+ if (cl_init->hostname == NULL) {
+ WARN_ON(1);
+- return NULL;
++ return ERR_PTR(-EINVAL);
+ }
+
+ /* see if the client already exists */
+diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
+index 5b61520dce888..4dc9bd7ddf073 100644
+--- a/fs/nfs/nfs4_fs.h
++++ b/fs/nfs/nfs4_fs.h
+@@ -201,6 +201,7 @@ struct nfs4_exception {
+ struct inode *inode;
+ nfs4_stateid *stateid;
+ long timeout;
++ unsigned char task_is_privileged : 1;
+ unsigned char delay : 1,
+ recovering : 1,
+ retry : 1;
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index faaabbedc891d..b5ce70c4ec87f 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -431,8 +431,8 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
+ */
+ nfs_mark_client_ready(clp, -EPERM);
+ }
+- nfs_put_client(clp);
+ clear_bit(NFS_CS_TSM_POSSIBLE, &clp->cl_flags);
++ nfs_put_client(clp);
+ return old;
+
+ error:
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index bcad052db0650..759c834b60fd6 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -550,6 +550,8 @@ int nfs4_handle_exception(struct nfs_server *server, int errorcode, struct nfs4_
+ goto out_retry;
+ }
+ if (exception->recovering) {
++ if (exception->task_is_privileged)
++ return -EDEADLOCK;
+ ret = nfs4_wait_clnt_recover(clp);
+ if (test_bit(NFS_MIG_FAILED, &server->mig_status))
+ return -EIO;
+@@ -575,6 +577,8 @@ nfs4_async_handle_exception(struct rpc_task *task, struct nfs_server *server,
+ goto out_retry;
+ }
+ if (exception->recovering) {
++ if (exception->task_is_privileged)
++ return -EDEADLOCK;
+ rpc_sleep_on(&clp->cl_rpcwaitq, task, NULL);
+ if (test_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) == 0)
+ rpc_wake_up_queued_task(&clp->cl_rpcwaitq, task);
+@@ -5576,6 +5580,14 @@ static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen
+ do {
+ err = __nfs4_proc_set_acl(inode, buf, buflen);
+ trace_nfs4_set_acl(inode, err);
++ if (err == -NFS4ERR_BADOWNER || err == -NFS4ERR_BADNAME) {
++ /*
++ * no need to retry since the kernel
++ * isn't involved in encoding the ACEs.
++ */
++ err = -EINVAL;
++ break;
++ }
+ err = nfs4_handle_exception(NFS_SERVER(inode), err,
+ &exception);
+ } while (exception.retry);
+@@ -6017,6 +6029,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata)
+ struct nfs4_exception exception = {
+ .inode = data->inode,
+ .stateid = &data->stateid,
++ .task_is_privileged = data->args.seq_args.sa_privileged,
+ };
+
+ if (!nfs4_sequence_done(task, &data->res.seq_res))
+@@ -6160,7 +6173,6 @@ static int _nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, co
+ data = kzalloc(sizeof(*data), GFP_NOFS);
+ if (data == NULL)
+ return -ENOMEM;
+- nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 1, 0);
+
+ nfs4_state_protect(server->nfs_client,
+ NFS_SP4_MACH_CRED_CLEANUP,
+@@ -6190,6 +6202,12 @@ static int _nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, co
+ data->lr.roc = false;
+ }
+
++ if (!data->inode)
++ nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 1,
++ 1);
++ else
++ nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 1,
++ 0);
+ task_setup_data.callback_data = data;
+ msg.rpc_argp = &data->args;
+ msg.rpc_resp = &data->res;
+@@ -9057,15 +9075,20 @@ int nfs4_proc_layoutreturn(struct nfs4_layoutreturn *lrp, bool sync)
+ &task_setup_data.rpc_client, &msg);
+
+ dprintk("--> %s\n", __func__);
++ lrp->inode = nfs_igrab_and_active(lrp->args.inode);
+ if (!sync) {
+- lrp->inode = nfs_igrab_and_active(lrp->args.inode);
+ if (!lrp->inode) {
+ nfs4_layoutreturn_release(lrp);
+ return -EAGAIN;
+ }
+ task_setup_data.flags |= RPC_TASK_ASYNC;
+ }
+- nfs4_init_sequence(&lrp->args.seq_args, &lrp->res.seq_res, 1, 0);
++ if (!lrp->inode)
++ nfs4_init_sequence(&lrp->args.seq_args, &lrp->res.seq_res, 1,
++ 1);
++ else
++ nfs4_init_sequence(&lrp->args.seq_args, &lrp->res.seq_res, 1,
++ 0);
+ task = rpc_run_task(&task_setup_data);
+ if (IS_ERR(task))
+ return PTR_ERR(task);
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index bc736ea1192ad..317a0762fc5f2 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2535,6 +2535,13 @@ out:
+ }
+
+ #ifdef CONFIG_SECURITY
++static int proc_pid_attr_open(struct inode *inode, struct file *file)
++{
++ file->private_data = NULL;
++ __mem_open(inode, file, PTRACE_MODE_READ_FSCREDS);
++ return 0;
++}
++
+ static ssize_t proc_pid_attr_read(struct file * file, char __user * buf,
+ size_t count, loff_t *ppos)
+ {
+@@ -2565,7 +2572,7 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
+ int rv;
+
+ /* A task may only write when it was the opener. */
+- if (file->f_cred != current_real_cred())
++ if (file->private_data != current->mm)
+ return -EPERM;
+
+ rcu_read_lock();
+@@ -2613,9 +2620,11 @@ out:
+ }
+
+ static const struct file_operations proc_pid_attr_operations = {
++ .open = proc_pid_attr_open,
+ .read = proc_pid_attr_read,
+ .write = proc_pid_attr_write,
+ .llseek = generic_file_llseek,
++ .release = mem_release,
+ };
+
+ static const struct pid_entry attr_dir_stuff[] = {
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index 88484ee023ca3..ad8766e1635e4 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -842,6 +842,7 @@
+ #ifdef CONFIG_AMD_MEM_ENCRYPT
+ #define PERCPU_DECRYPTED_SECTION \
+ . = ALIGN(PAGE_SIZE); \
++ *(.data..decrypted) \
+ *(.data..percpu..decrypted) \
+ . = ALIGN(PAGE_SIZE);
+ #else
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index a0de4c7dc9d3f..8dd4ebb58e973 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -1017,7 +1017,15 @@ __gfn_to_memslot(struct kvm_memslots *slots, gfn_t gfn)
+ static inline unsigned long
+ __gfn_to_hva_memslot(struct kvm_memory_slot *slot, gfn_t gfn)
+ {
+- return slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE;
++ /*
++ * The index was checked originally in search_memslots. To avoid
++ * that a malicious guest builds a Spectre gadget out of e.g. page
++ * table walks, do not let the processor speculate loads outside
++ * the guest's registered memslots.
++ */
++ unsigned long offset = gfn - slot->base_gfn;
++ offset = array_index_nospec(offset, slot->npages);
++ return slot->userspace_addr + offset * PAGE_SIZE;
+ }
+
+ static inline int memslot_id(struct kvm *kvm, gfn_t gfn)
+diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
+index dca6ab4eaa992..3ebdd384ae335 100644
+--- a/include/linux/mlx4/device.h
++++ b/include/linux/mlx4/device.h
+@@ -631,6 +631,7 @@ struct mlx4_caps {
+ bool wol_port[MLX4_MAX_PORTS + 1];
+ struct mlx4_rate_limit_caps rl_caps;
+ u32 health_buffer_addrs;
++ bool map_clock_to_user;
+ };
+
+ struct mlx4_buf_list {
+diff --git a/include/linux/usb/pd.h b/include/linux/usb/pd.h
+index bdf4c88d2aa0a..c16574d4bd855 100644
+--- a/include/linux/usb/pd.h
++++ b/include/linux/usb/pd.h
+@@ -434,7 +434,7 @@ static inline unsigned int rdo_max_power(u32 rdo)
+ #define PD_T_SENDER_RESPONSE 60 /* 24 - 30 ms, relaxed */
+ #define PD_T_SOURCE_ACTIVITY 45
+ #define PD_T_SINK_ACTIVITY 135
+-#define PD_T_SINK_WAIT_CAP 240
++#define PD_T_SINK_WAIT_CAP 310 /* 310 - 620 ms */
+ #define PD_T_PS_TRANSITION 500
+ #define PD_T_SRC_TRANSITION 35
+ #define PD_T_DRP_SNK 40
+diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
+index dd8bdbfbbde1e..5456611874eb5 100644
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -849,6 +849,10 @@ static int cgroup1_rename(struct kernfs_node *kn, struct kernfs_node *new_parent
+ struct cgroup *cgrp = kn->priv;
+ int ret;
+
++ /* do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable */
++ if (strchr(new_name_str, '\n'))
++ return -EINVAL;
++
+ if (kernfs_type(kn) != KERNFS_DIR)
+ return -ENOTDIR;
+ if (kn->parent != new_parent)
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 2a879d34bbe58..a74549693e7f5 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -5347,8 +5347,6 @@ int __init cgroup_init_early(void)
+ return 0;
+ }
+
+-static u16 cgroup_disable_mask __initdata;
+-
+ /**
+ * cgroup_init - cgroup initialization
+ *
+@@ -5408,12 +5406,8 @@ int __init cgroup_init(void)
+ * disabled flag and cftype registration needs kmalloc,
+ * both of which aren't available during early_init.
+ */
+- if (cgroup_disable_mask & (1 << ssid)) {
+- static_branch_disable(cgroup_subsys_enabled_key[ssid]);
+- printk(KERN_INFO "Disabling %s control group subsystem\n",
+- ss->name);
++ if (!cgroup_ssid_enabled(ssid))
+ continue;
+- }
+
+ if (cgroup1_ssid_disabled(ssid))
+ printk(KERN_INFO "Disabling %s control group subsystem in v1 mounts\n",
+@@ -5772,7 +5766,10 @@ static int __init cgroup_disable(char *str)
+ if (strcmp(token, ss->name) &&
+ strcmp(token, ss->legacy_name))
+ continue;
+- cgroup_disable_mask |= 1 << i;
++
++ static_branch_disable(cgroup_subsys_enabled_key[i]);
++ pr_info("Disabling %s control group subsystem\n",
++ ss->name);
+ }
+ }
+ return 1;
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index d3be2cd57af12..dd740f91de478 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -2086,6 +2086,7 @@ __perf_remove_from_context(struct perf_event *event,
+
+ if (!ctx->nr_events && ctx->is_active) {
+ ctx->is_active = 0;
++ ctx->rotate_necessary = 0;
+ if (ctx->task) {
+ WARN_ON_ONCE(cpuctx->task_ctx != ctx);
+ cpuctx->task_ctx = NULL;
+@@ -2952,12 +2953,6 @@ static void ctx_sched_out(struct perf_event_context *ctx,
+ if (!ctx->nr_active || !(is_active & EVENT_ALL))
+ return;
+
+- /*
+- * If we had been multiplexing, no rotations are necessary, now no events
+- * are active.
+- */
+- ctx->rotate_necessary = 0;
+-
+ perf_pmu_disable(ctx->pmu);
+ if (is_active & EVENT_PINNED) {
+ list_for_each_entry_safe(event, tmp, &ctx->pinned_active, active_list)
+@@ -2967,6 +2962,13 @@ static void ctx_sched_out(struct perf_event_context *ctx,
+ if (is_active & EVENT_FLEXIBLE) {
+ list_for_each_entry_safe(event, tmp, &ctx->flexible_active, active_list)
+ group_sched_out(event, cpuctx, ctx);
++
++ /*
++ * Since we cleared EVENT_FLEXIBLE, also clear
++ * rotate_necessary, is will be reset by
++ * ctx_flexible_sched_in() when needed.
++ */
++ ctx->rotate_necessary = 0;
+ }
+ perf_pmu_enable(ctx->pmu);
+ }
+@@ -3705,6 +3707,12 @@ ctx_event_to_rotate(struct perf_event_context *ctx)
+ typeof(*event), group_node);
+ }
+
++ /*
++ * Unconditionally clear rotate_necessary; if ctx_flexible_sched_in()
++ * finds there are unschedulable events, it will set it again.
++ */
++ ctx->rotate_necessary = 0;
++
+ return event;
+ }
+
+@@ -4147,7 +4155,9 @@ find_get_context(struct pmu *pmu, struct task_struct *task,
+ cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
+ ctx = &cpuctx->ctx;
+ get_ctx(ctx);
++ raw_spin_lock_irqsave(&ctx->lock, flags);
+ ++ctx->pin_count;
++ raw_spin_unlock_irqrestore(&ctx->lock, flags);
+
+ return ctx;
+ }
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index f06687053f96b..acb34e9df5515 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7512,7 +7512,7 @@ static void update_blocked_averages(int cpu)
+ /* Propagate pending load changes to the parent, if any: */
+ se = cfs_rq->tg->se[cpu];
+ if (se && !skip_blocked_update(se))
+- update_load_avg(cfs_rq_of(se), se, 0);
++ update_load_avg(cfs_rq_of(se), se, UPDATE_TG);
+
+ /*
+ * There can be a lot of idle CPU cgroups. Don't let fully
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index f8d82b36dd668..c5c8aafa29cfc 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1977,12 +1977,18 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
+
+ static void print_ip_ins(const char *fmt, const unsigned char *p)
+ {
++ char ins[MCOUNT_INSN_SIZE];
+ int i;
+
++ if (probe_kernel_read(ins, p, MCOUNT_INSN_SIZE)) {
++ printk(KERN_CONT "%s[FAULT] %px\n", fmt, p);
++ return;
++ }
++
+ printk(KERN_CONT "%s", fmt);
+
+ for (i = 0; i < MCOUNT_INSN_SIZE; i++)
+- printk(KERN_CONT "%s%02x", i ? ":" : "", p[i]);
++ printk(KERN_CONT "%s%02x", i ? ":" : "", ins[i]);
+ }
+
+ enum ftrace_bug_type ftrace_bug_type;
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 4eea58a907f08..f8aaa7879d7d6 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2281,7 +2281,7 @@ trace_event_buffer_lock_reserve(struct ring_buffer **current_rb,
+ (entry = this_cpu_read(trace_buffered_event))) {
+ /* Try to use the per cpu buffer first */
+ val = this_cpu_inc_return(trace_buffered_event_cnt);
+- if ((len < (PAGE_SIZE - sizeof(*entry))) && val == 1) {
++ if ((len < (PAGE_SIZE - sizeof(*entry) - sizeof(entry->array[0]))) && val == 1) {
+ trace_event_setup(entry, type, flags, pc);
+ entry->array[0] = len;
+ return entry;
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 1cc49340b68ab..f278e2f584fd2 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -49,6 +49,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/sched/isolation.h>
+ #include <linux/nmi.h>
++#include <linux/kvm_para.h>
+
+ #include "workqueue_internal.h"
+
+@@ -5555,6 +5556,7 @@ static void wq_watchdog_timer_fn(struct timer_list *unused)
+ {
+ unsigned long thresh = READ_ONCE(wq_watchdog_thresh) * HZ;
+ bool lockup_detected = false;
++ unsigned long now = jiffies;
+ struct worker_pool *pool;
+ int pi;
+
+@@ -5569,6 +5571,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused)
+ if (list_empty(&pool->worklist))
+ continue;
+
++ /*
++ * If a virtual machine is stopped by the host it can look to
++ * the watchdog like a stall.
++ */
++ kvm_check_and_clear_guest_paused();
++
+ /* get the latest of pool and touched timestamps */
+ pool_ts = READ_ONCE(pool->watchdog_ts);
+ touched = READ_ONCE(wq_watchdog_touched);
+@@ -5587,12 +5595,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused)
+ }
+
+ /* did we stall? */
+- if (time_after(jiffies, ts + thresh)) {
++ if (time_after(now, ts + thresh)) {
+ lockup_detected = true;
+ pr_emerg("BUG: workqueue lockup - pool");
+ pr_cont_pool_info(pool);
+ pr_cont(" stuck for %us!\n",
+- jiffies_to_msecs(jiffies - pool_ts) / 1000);
++ jiffies_to_msecs(now - pool_ts) / 1000);
+ }
+ }
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 1bb9f219f07d3..ac3fe507bc1c4 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -461,11 +461,13 @@ void netlink_table_ungrab(void)
+ static inline void
+ netlink_lock_table(void)
+ {
++ unsigned long flags;
++
+ /* read_lock() synchronizes us to netlink_table_grab */
+
+- read_lock(&nl_table_lock);
++ read_lock_irqsave(&nl_table_lock, flags);
+ atomic_inc(&nl_table_users);
+- read_unlock(&nl_table_lock);
++ read_unlock_irqrestore(&nl_table_lock, flags);
+ }
+
+ static inline void
+diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
+index 57a07ab80d924..bdc72737fe240 100644
+--- a/net/nfc/rawsock.c
++++ b/net/nfc/rawsock.c
+@@ -345,7 +345,7 @@ static int rawsock_create(struct net *net, struct socket *sock,
+ return -ESOCKTNOSUPPORT;
+
+ if (sock->type == SOCK_RAW) {
+- if (!capable(CAP_NET_RAW))
++ if (!ns_capable(net->user_ns, CAP_NET_RAW))
+ return -EPERM;
+ sock->ops = &rawsock_raw_ops;
+ } else {
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 3bd2f4a5a30d9..ac3300b204a6f 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -237,12 +237,23 @@ static struct rds_connection *__rds_conn_create(struct net *net,
+ if (loop_trans) {
+ rds_trans_put(loop_trans);
+ conn->c_loopback = 1;
+- if (is_outgoing && trans->t_prefer_loopback) {
+- /* "outgoing" connection - and the transport
+- * says it wants the connection handled by the
+- * loopback transport. This is what TCP does.
+- */
+- trans = &rds_loop_transport;
++ if (trans->t_prefer_loopback) {
++ if (likely(is_outgoing)) {
++ /* "outgoing" connection to local address.
++ * Protocol says it wants the connection
++ * handled by the loopback transport.
++ * This is what TCP does.
++ */
++ trans = &rds_loop_transport;
++ } else {
++ /* No transport currently in use
++ * should end up here, but if it
++ * does, reset/destroy the connection.
++ */
++ kmem_cache_free(rds_conn_slab, conn);
++ conn = ERR_PTR(-EOPNOTSUPP);
++ goto out;
++ }
+ }
+ }
+
+diff --git a/net/rds/tcp.c b/net/rds/tcp.c
+index 18bb522df2823..d0bce439198fc 100644
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -322,8 +322,8 @@ out:
+ }
+ #endif
+
+-static int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr,
+- __u32 scope_id)
++int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr,
++ __u32 scope_id)
+ {
+ struct net_device *dev = NULL;
+ #if IS_ENABLED(CONFIG_IPV6)
+diff --git a/net/rds/tcp.h b/net/rds/tcp.h
+index 3c69361d21c73..4620549ecbebe 100644
+--- a/net/rds/tcp.h
++++ b/net/rds/tcp.h
+@@ -60,7 +60,8 @@ u32 rds_tcp_snd_una(struct rds_tcp_connection *tc);
+ u64 rds_tcp_map_seq(struct rds_tcp_connection *tc, u32 seq);
+ extern struct rds_transport rds_tcp_transport;
+ void rds_tcp_accept_work(struct sock *sk);
+-
++int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr,
++ __u32 scope_id);
+ /* tcp_connect.c */
+ int rds_tcp_conn_path_connect(struct rds_conn_path *cp);
+ void rds_tcp_conn_path_shutdown(struct rds_conn_path *conn);
+diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
+index c12203f646da9..0d095d3f5feec 100644
+--- a/net/rds/tcp_listen.c
++++ b/net/rds/tcp_listen.c
+@@ -198,6 +198,12 @@ int rds_tcp_accept_one(struct socket *sock)
+ }
+ #endif
+
++ if (!rds_tcp_laddr_check(sock_net(sock->sk), peer_addr, dev_if)) {
++ /* local address connection is only allowed via loopback */
++ ret = -EOPNOTSUPP;
++ goto out;
++ }
++
+ conn = rds_conn_create(sock_net(sock->sk),
+ my_addr, peer_addr,
+ &rds_tcp_transport, GFP_KERNEL, dev_if);
+diff --git a/sound/soc/codecs/sti-sas.c b/sound/soc/codecs/sti-sas.c
+index 7316c80b81798..27196126f7107 100644
+--- a/sound/soc/codecs/sti-sas.c
++++ b/sound/soc/codecs/sti-sas.c
+@@ -411,6 +411,7 @@ static const struct of_device_id sti_sas_dev_match[] = {
+ },
+ {},
+ };
++MODULE_DEVICE_TABLE(of, sti_sas_dev_match);
+
+ static int sti_sas_driver_probe(struct platform_device *pdev)
+ {
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 4ebc023f1507b..186c0ee059da7 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -565,6 +565,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Glavey TM800A550L */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
++ /* Above strings are too generic, also match on BIOS version */
++ DMI_MATCH(DMI_BIOS_VERSION, "ZY-8-BI-PX4S70VTR400-X423B-005-D"),
++ },
++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+@@ -632,6 +643,20 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_MONO_SPEAKER |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Lenovo Miix 3-830 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 3-830"),
++ },
++ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_MONO_SPEAKER |
++ BYT_RT5640_DIFF_MIC |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ { /* Linx Linx7 tablet */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LINX"),
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 6a2037b52098b..3be1534f1f033 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1478,6 +1478,7 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset,
+ if (event->header.size < hdr_sz || event->header.size > buf_sz)
+ return -1;
+
++ buf += hdr_sz;
+ rest = event->header.size - hdr_sz;
+
+ if (readn(fd, buf, rest) != (ssize_t)rest)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-06-30 14:25 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-06-30 14:25 UTC (permalink / raw
To: gentoo-commits
commit: f0242eaa0eed2447119f316e38a8949bdcb03e26
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 30 14:25:14 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jun 30 14:25:14 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f0242eaa
Linux patch 4.19.196
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1195_linux-4.19.196.patch | 3617 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3621 insertions(+)
diff --git a/0000_README b/0000_README
index 3d05639..2009bef 100644
--- a/0000_README
+++ b/0000_README
@@ -819,6 +819,10 @@ Patch: 1194_linux-4.19.195.patch
From: https://www.kernel.org
Desc: Linux 4.19.195
+Patch: 1195_linux-4.19.196.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.196
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1195_linux-4.19.196.patch b/1195_linux-4.19.196.patch
new file mode 100644
index 0000000..ad359a6
--- /dev/null
+++ b/1195_linux-4.19.196.patch
@@ -0,0 +1,3617 @@
+diff --git a/Documentation/vm/slub.rst b/Documentation/vm/slub.rst
+index 3a775fd64e2db..3602959d5f92b 100644
+--- a/Documentation/vm/slub.rst
++++ b/Documentation/vm/slub.rst
+@@ -154,7 +154,7 @@ SLUB Debug output
+ Here is a sample of slub debug output::
+
+ ====================================================================
+- BUG kmalloc-8: Redzone overwritten
++ BUG kmalloc-8: Right Redzone overwritten
+ --------------------------------------------------------------------
+
+ INFO: 0xc90f6d28-0xc90f6d2b. First byte 0x00 instead of 0xcc
+@@ -162,10 +162,10 @@ Here is a sample of slub debug output::
+ INFO: Object 0xc90f6d20 @offset=3360 fp=0xc90f6d58
+ INFO: Allocated in get_modalias+0x61/0xf5 age=53 cpu=1 pid=554
+
+- Bytes b4 0xc90f6d10: 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
+- Object 0xc90f6d20: 31 30 31 39 2e 30 30 35 1019.005
+- Redzone 0xc90f6d28: 00 cc cc cc .
+- Padding 0xc90f6d50: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
++ Bytes b4 (0xc90f6d10): 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
++ Object (0xc90f6d20): 31 30 31 39 2e 30 30 35 1019.005
++ Redzone (0xc90f6d28): 00 cc cc cc .
++ Padding (0xc90f6d50): 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
+
+ [<c010523d>] dump_trace+0x63/0x1eb
+ [<c01053df>] show_trace_log_lvl+0x1a/0x2f
+diff --git a/Makefile b/Makefile
+index 9ff7a4b7b8cbd..63b0bc92a0fa6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 195
++SUBLEVEL = 196
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -716,12 +716,11 @@ KBUILD_CFLAGS += $(call cc-disable-warning, tautological-compare)
+ # See modpost pattern 2
+ KBUILD_CFLAGS += $(call cc-option, -mno-global-merge,)
+ KBUILD_CFLAGS += $(call cc-option, -fcatch-undefined-behavior)
+-else
++endif
+
+ # These warnings generated too much noise in a regular build.
+ # Use make W=1 to enable them (see scripts/Makefile.extrawarn)
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
+-endif
+
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable)
+ ifdef CONFIG_FRAME_POINTER
+diff --git a/arch/arc/include/uapi/asm/sigcontext.h b/arch/arc/include/uapi/asm/sigcontext.h
+index 95f8a4380e110..7a5449dfcb290 100644
+--- a/arch/arc/include/uapi/asm/sigcontext.h
++++ b/arch/arc/include/uapi/asm/sigcontext.h
+@@ -18,6 +18,7 @@
+ */
+ struct sigcontext {
+ struct user_regs_struct regs;
++ struct user_regs_arcv2 v2abi;
+ };
+
+ #endif /* _ASM_ARC_SIGCONTEXT_H */
+diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
+index da243420bcb58..68901f6f18bab 100644
+--- a/arch/arc/kernel/signal.c
++++ b/arch/arc/kernel/signal.c
+@@ -64,6 +64,41 @@ struct rt_sigframe {
+ unsigned int sigret_magic;
+ };
+
++static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
++{
++ int err = 0;
++#ifndef CONFIG_ISA_ARCOMPACT
++ struct user_regs_arcv2 v2abi;
++
++ v2abi.r30 = regs->r30;
++#ifdef CONFIG_ARC_HAS_ACCL_REGS
++ v2abi.r58 = regs->r58;
++ v2abi.r59 = regs->r59;
++#else
++ v2abi.r58 = v2abi.r59 = 0;
++#endif
++ err = __copy_to_user(&mctx->v2abi, &v2abi, sizeof(v2abi));
++#endif
++ return err;
++}
++
++static int restore_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
++{
++ int err = 0;
++#ifndef CONFIG_ISA_ARCOMPACT
++ struct user_regs_arcv2 v2abi;
++
++ err = __copy_from_user(&v2abi, &mctx->v2abi, sizeof(v2abi));
++
++ regs->r30 = v2abi.r30;
++#ifdef CONFIG_ARC_HAS_ACCL_REGS
++ regs->r58 = v2abi.r58;
++ regs->r59 = v2abi.r59;
++#endif
++#endif
++ return err;
++}
++
+ static int
+ stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs,
+ sigset_t *set)
+@@ -97,6 +132,10 @@ stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs,
+
+ err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), &uregs.scratch,
+ sizeof(sf->uc.uc_mcontext.regs.scratch));
++
++ if (is_isa_arcv2())
++ err |= save_arcv2_regs(&(sf->uc.uc_mcontext), regs);
++
+ err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t));
+
+ return err ? -EFAULT : 0;
+@@ -112,6 +151,10 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
+ err |= __copy_from_user(&uregs.scratch,
+ &(sf->uc.uc_mcontext.regs.scratch),
+ sizeof(sf->uc.uc_mcontext.regs.scratch));
++
++ if (is_isa_arcv2())
++ err |= restore_arcv2_regs(&(sf->uc.uc_mcontext), regs);
++
+ if (err)
+ return -EFAULT;
+
+diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
+index 7bbaa293a38ce..95db057ed2fab 100644
+--- a/arch/arm/kernel/setup.c
++++ b/arch/arm/kernel/setup.c
+@@ -547,9 +547,11 @@ void notrace cpu_init(void)
+ * In Thumb-2, msr with an immediate value is not allowed.
+ */
+ #ifdef CONFIG_THUMB2_KERNEL
+-#define PLC "r"
++#define PLC_l "l"
++#define PLC_r "r"
+ #else
+-#define PLC "I"
++#define PLC_l "I"
++#define PLC_r "I"
+ #endif
+
+ /*
+@@ -571,15 +573,15 @@ void notrace cpu_init(void)
+ "msr cpsr_c, %9"
+ :
+ : "r" (stk),
+- PLC (PSR_F_BIT | PSR_I_BIT | IRQ_MODE),
++ PLC_r (PSR_F_BIT | PSR_I_BIT | IRQ_MODE),
+ "I" (offsetof(struct stack, irq[0])),
+- PLC (PSR_F_BIT | PSR_I_BIT | ABT_MODE),
++ PLC_r (PSR_F_BIT | PSR_I_BIT | ABT_MODE),
+ "I" (offsetof(struct stack, abt[0])),
+- PLC (PSR_F_BIT | PSR_I_BIT | UND_MODE),
++ PLC_r (PSR_F_BIT | PSR_I_BIT | UND_MODE),
+ "I" (offsetof(struct stack, und[0])),
+- PLC (PSR_F_BIT | PSR_I_BIT | FIQ_MODE),
++ PLC_r (PSR_F_BIT | PSR_I_BIT | FIQ_MODE),
+ "I" (offsetof(struct stack, fiq[0])),
+- PLC (PSR_F_BIT | PSR_I_BIT | SVC_MODE)
++ PLC_l (PSR_F_BIT | PSR_I_BIT | SVC_MODE)
+ : "r14");
+ #endif
+ }
+diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
+index 75bc18646df66..902e9df9b8bbb 100644
+--- a/arch/arm/mach-omap2/board-n8x0.c
++++ b/arch/arm/mach-omap2/board-n8x0.c
+@@ -325,6 +325,7 @@ static int n8x0_mmc_get_cover_state(struct device *dev, int slot)
+
+ static void n8x0_mmc_callback(void *data, u8 card_mask)
+ {
++#ifdef CONFIG_MMC_OMAP
+ int bit, *openp, index;
+
+ if (board_is_n800()) {
+@@ -342,7 +343,6 @@ static void n8x0_mmc_callback(void *data, u8 card_mask)
+ else
+ *openp = 0;
+
+-#ifdef CONFIG_MMC_OMAP
+ omap_mmc_notify_cover_event(mmc_device, index, *openp);
+ #else
+ pr_warn("MMC: notify cover event not available\n");
+diff --git a/arch/mips/generic/board-boston.its.S b/arch/mips/generic/board-boston.its.S
+index a7f51f97b9102..c45ad27594218 100644
+--- a/arch/mips/generic/board-boston.its.S
++++ b/arch/mips/generic/board-boston.its.S
+@@ -1,22 +1,22 @@
+ / {
+ images {
+- fdt@boston {
++ fdt-boston {
+ description = "img,boston Device Tree";
+ data = /incbin/("boot/dts/img/boston.dtb");
+ type = "flat_dt";
+ arch = "mips";
+ compression = "none";
+- hash@0 {
++ hash {
+ algo = "sha1";
+ };
+ };
+ };
+
+ configurations {
+- conf@boston {
++ conf-boston {
+ description = "Boston Linux kernel";
+- kernel = "kernel@0";
+- fdt = "fdt@boston";
++ kernel = "kernel";
++ fdt = "fdt-boston";
+ };
+ };
+ };
+diff --git a/arch/mips/generic/board-ni169445.its.S b/arch/mips/generic/board-ni169445.its.S
+index e4cb4f95a8cc1..0a2e8f7a8526f 100644
+--- a/arch/mips/generic/board-ni169445.its.S
++++ b/arch/mips/generic/board-ni169445.its.S
+@@ -1,22 +1,22 @@
+ / {
+ images {
+- fdt@ni169445 {
++ fdt-ni169445 {
+ description = "NI 169445 device tree";
+ data = /incbin/("boot/dts/ni/169445.dtb");
+ type = "flat_dt";
+ arch = "mips";
+ compression = "none";
+- hash@0 {
++ hash {
+ algo = "sha1";
+ };
+ };
+ };
+
+ configurations {
+- conf@ni169445 {
++ conf-ni169445 {
+ description = "NI 169445 Linux Kernel";
+- kernel = "kernel@0";
+- fdt = "fdt@ni169445";
++ kernel = "kernel";
++ fdt = "fdt-ni169445";
+ };
+ };
+ };
+diff --git a/arch/mips/generic/board-xilfpga.its.S b/arch/mips/generic/board-xilfpga.its.S
+index a2e773d3f14f4..08c1e900eb4ed 100644
+--- a/arch/mips/generic/board-xilfpga.its.S
++++ b/arch/mips/generic/board-xilfpga.its.S
+@@ -1,22 +1,22 @@
+ / {
+ images {
+- fdt@xilfpga {
++ fdt-xilfpga {
+ description = "MIPSfpga (xilfpga) Device Tree";
+ data = /incbin/("boot/dts/xilfpga/nexys4ddr.dtb");
+ type = "flat_dt";
+ arch = "mips";
+ compression = "none";
+- hash@0 {
++ hash {
+ algo = "sha1";
+ };
+ };
+ };
+
+ configurations {
+- conf@xilfpga {
++ conf-xilfpga {
+ description = "MIPSfpga Linux kernel";
+- kernel = "kernel@0";
+- fdt = "fdt@xilfpga";
++ kernel = "kernel";
++ fdt = "fdt-xilfpga";
+ };
+ };
+ };
+diff --git a/arch/mips/generic/vmlinux.its.S b/arch/mips/generic/vmlinux.its.S
+index 1a08438fd8930..3e254676540f4 100644
+--- a/arch/mips/generic/vmlinux.its.S
++++ b/arch/mips/generic/vmlinux.its.S
+@@ -6,7 +6,7 @@
+ #address-cells = <ADDR_CELLS>;
+
+ images {
+- kernel@0 {
++ kernel {
+ description = KERNEL_NAME;
+ data = /incbin/(VMLINUX_BINARY);
+ type = "kernel";
+@@ -15,18 +15,18 @@
+ compression = VMLINUX_COMPRESSION;
+ load = /bits/ ADDR_BITS <VMLINUX_LOAD_ADDRESS>;
+ entry = /bits/ ADDR_BITS <VMLINUX_ENTRY_ADDRESS>;
+- hash@0 {
++ hash {
+ algo = "sha1";
+ };
+ };
+ };
+
+ configurations {
+- default = "conf@default";
++ default = "conf-default";
+
+- conf@default {
++ conf-default {
+ description = "Generic Linux kernel";
+- kernel = "kernel@0";
++ kernel = "kernel";
+ };
+ };
+ };
+diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
+index d99a8ee9e185e..86a231338bbfe 100644
+--- a/arch/x86/kernel/fpu/signal.c
++++ b/arch/x86/kernel/fpu/signal.c
+@@ -272,6 +272,7 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
+ int state_size = fpu_kernel_xstate_size;
+ u64 xfeatures = 0;
+ int fx_only = 0;
++ int ret = 0;
+
+ ia32_fxstate &= (IS_ENABLED(CONFIG_X86_32) ||
+ IS_ENABLED(CONFIG_IA32_EMULATION));
+@@ -281,15 +282,21 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
+ return 0;
+ }
+
+- if (!access_ok(VERIFY_READ, buf, size))
+- return -EACCES;
++ if (!access_ok(VERIFY_READ, buf, size)) {
++ ret = -EACCES;
++ goto out_err;
++ }
+
+ fpu__initialize(fpu);
+
+- if (!static_cpu_has(X86_FEATURE_FPU))
+- return fpregs_soft_set(current, NULL,
+- 0, sizeof(struct user_i387_ia32_struct),
+- NULL, buf) != 0;
++ if (!static_cpu_has(X86_FEATURE_FPU)) {
++ ret = fpregs_soft_set(current, NULL,
++ 0, sizeof(struct user_i387_ia32_struct),
++ NULL, buf) != 0;
++ if (ret)
++ goto out_err;
++ return 0;
++ }
+
+ if (use_xsave()) {
+ struct _fpx_sw_bytes fx_sw_user;
+@@ -349,6 +356,7 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
+ fpu__restore(fpu);
+ local_bh_enable();
+
++ /* Failure is already handled */
+ return err;
+ } else {
+ /*
+@@ -356,13 +364,14 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
+ * state to the registers directly (with exceptions handled).
+ */
+ user_fpu_begin();
+- if (copy_user_to_fpregs_zeroing(buf_fx, xfeatures, fx_only)) {
+- fpu__clear(fpu);
+- return -1;
+- }
++ if (!copy_user_to_fpregs_zeroing(buf_fx, xfeatures, fx_only))
++ return 0;
++ ret = -1;
+ }
+
+- return 0;
++out_err:
++ fpu__clear(fpu);
++ return ret;
+ }
+
+ static inline int xstate_sigframe_size(void)
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index 0c67a5a94de30..76959a7d88c82 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -779,4 +779,48 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
+ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar);
+ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar);
+
++#define RS690_LOWER_TOP_OF_DRAM2 0x30
++#define RS690_LOWER_TOP_OF_DRAM2_VALID 0x1
++#define RS690_UPPER_TOP_OF_DRAM2 0x31
++#define RS690_HTIU_NB_INDEX 0xA8
++#define RS690_HTIU_NB_INDEX_WR_ENABLE 0x100
++#define RS690_HTIU_NB_DATA 0xAC
++
++/*
++ * Some BIOS implementations support RAM above 4GB, but do not configure the
++ * PCI host to respond to bus master accesses for these addresses. These
++ * implementations set the TOP_OF_DRAM_SLOT1 register correctly, so PCI DMA
++ * works as expected for addresses below 4GB.
++ *
++ * Reference: "AMD RS690 ASIC Family Register Reference Guide" (pg. 2-57)
++ * https://www.amd.com/system/files/TechDocs/43372_rs690_rrg_3.00o.pdf
++ */
++static void rs690_fix_64bit_dma(struct pci_dev *pdev)
++{
++ u32 val = 0;
++ phys_addr_t top_of_dram = __pa(high_memory - 1) + 1;
++
++ if (top_of_dram <= (1ULL << 32))
++ return;
++
++ pci_write_config_dword(pdev, RS690_HTIU_NB_INDEX,
++ RS690_LOWER_TOP_OF_DRAM2);
++ pci_read_config_dword(pdev, RS690_HTIU_NB_DATA, &val);
++
++ if (val)
++ return;
++
++ pci_info(pdev, "Adjusting top of DRAM to %pa for 64-bit DMA support\n", &top_of_dram);
++
++ pci_write_config_dword(pdev, RS690_HTIU_NB_INDEX,
++ RS690_UPPER_TOP_OF_DRAM2 | RS690_HTIU_NB_INDEX_WR_ENABLE);
++ pci_write_config_dword(pdev, RS690_HTIU_NB_DATA, top_of_dram >> 32);
++
++ pci_write_config_dword(pdev, RS690_HTIU_NB_INDEX,
++ RS690_LOWER_TOP_OF_DRAM2 | RS690_HTIU_NB_INDEX_WR_ENABLE);
++ pci_write_config_dword(pdev, RS690_HTIU_NB_DATA,
++ top_of_dram | RS690_LOWER_TOP_OF_DRAM2_VALID);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7910, rs690_fix_64bit_dma);
++
+ #endif
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
+index a4f95574eb9ad..52dd4bd7c2098 100644
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -58,6 +58,7 @@ config DMA_OF
+ #devices
+ config ALTERA_MSGDMA
+ tristate "Altera / Intel mSGDMA Engine"
++ depends on HAS_IOMEM
+ select DMA_ENGINE
+ help
+ Enable support for Altera / Intel mSGDMA controller.
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 15b30d2d8f7ed..8166305052946 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2671,13 +2671,15 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic(
+ for (i = 0; i < len / period_len; i++) {
+ desc = pl330_get_desc(pch);
+ if (!desc) {
++ unsigned long iflags;
++
+ dev_err(pch->dmac->ddma.dev, "%s:%d Unable to fetch desc\n",
+ __func__, __LINE__);
+
+ if (!first)
+ return NULL;
+
+- spin_lock_irqsave(&pl330->pool_lock, flags);
++ spin_lock_irqsave(&pl330->pool_lock, iflags);
+
+ while (!list_empty(&first->node)) {
+ desc = list_entry(first->node.next,
+@@ -2687,7 +2689,7 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic(
+
+ list_move_tail(&first->node, &pl330->desc_pool);
+
+- spin_unlock_irqrestore(&pl330->pool_lock, flags);
++ spin_unlock_irqrestore(&pl330->pool_lock, iflags);
+
+ return NULL;
+ }
+diff --git a/drivers/dma/qcom/Kconfig b/drivers/dma/qcom/Kconfig
+index a7761c4025f41..a97c7123d913c 100644
+--- a/drivers/dma/qcom/Kconfig
++++ b/drivers/dma/qcom/Kconfig
+@@ -9,6 +9,7 @@ config QCOM_BAM_DMA
+
+ config QCOM_HIDMA_MGMT
+ tristate "Qualcomm Technologies HIDMA Management support"
++ depends on HAS_IOMEM
+ select DMA_ENGINE
+ help
+ Enable support for the Qualcomm Technologies HIDMA Management.
+diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
+index 3d55405c49cac..e588dc5daaa80 100644
+--- a/drivers/dma/ste_dma40.c
++++ b/drivers/dma/ste_dma40.c
+@@ -3663,6 +3663,9 @@ static int __init d40_probe(struct platform_device *pdev)
+
+ kfree(base->lcla_pool.base_unaligned);
+
++ if (base->lcpa_base)
++ iounmap(base->lcpa_base);
++
+ if (base->phy_lcpa)
+ release_mem_region(base->phy_lcpa,
+ base->lcpa_size);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c
+index 1fefc93af1d78..bbfce7b9d03e1 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_prime.c
++++ b/drivers/gpu/drm/nouveau/nouveau_prime.c
+@@ -98,7 +98,22 @@ int nouveau_gem_prime_pin(struct drm_gem_object *obj)
+ if (ret)
+ return -EINVAL;
+
+- return 0;
++ ret = ttm_bo_reserve(&nvbo->bo, false, false, NULL);
++ if (ret)
++ goto error;
++
++ if (nvbo->bo.moving)
++ ret = dma_fence_wait(nvbo->bo.moving, true);
++
++ ttm_bo_unreserve(&nvbo->bo);
++ if (ret)
++ goto error;
++
++ return ret;
++
++error:
++ nouveau_bo_unpin(nvbo);
++ return ret;
+ }
+
+ void nouveau_gem_prime_unpin(struct drm_gem_object *obj)
+diff --git a/drivers/gpu/drm/radeon/radeon_prime.c b/drivers/gpu/drm/radeon/radeon_prime.c
+index 7110d403322c4..c138e07f51a3e 100644
+--- a/drivers/gpu/drm/radeon/radeon_prime.c
++++ b/drivers/gpu/drm/radeon/radeon_prime.c
+@@ -92,9 +92,19 @@ int radeon_gem_prime_pin(struct drm_gem_object *obj)
+
+ /* pin buffer into GTT */
+ ret = radeon_bo_pin(bo, RADEON_GEM_DOMAIN_GTT, NULL);
+- if (likely(ret == 0))
+- bo->prime_shared_count++;
+-
++ if (unlikely(ret))
++ goto error;
++
++ if (bo->tbo.moving) {
++ ret = dma_fence_wait(bo->tbo.moving, false);
++ if (unlikely(ret)) {
++ radeon_bo_unpin(bo);
++ goto error;
++ }
++ }
++
++ bo->prime_shared_count++;
++error:
+ radeon_bo_unreserve(bo);
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
+index 95f4db70dd223..fde9c69ecc869 100644
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -286,7 +286,7 @@ int radeon_uvd_resume(struct radeon_device *rdev)
+ if (rdev->uvd.vcpu_bo == NULL)
+ return -EINVAL;
+
+- memcpy(rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size);
++ memcpy_toio((void __iomem *)rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size);
+
+ size = radeon_bo_size(rdev->uvd.vcpu_bo);
+ size -= rdev->uvd_fw->size;
+@@ -294,7 +294,7 @@ int radeon_uvd_resume(struct radeon_device *rdev)
+ ptr = rdev->uvd.cpu_addr;
+ ptr += rdev->uvd_fw->size;
+
+- memset(ptr, 0, size);
++ memset_io((void __iomem *)ptr, 0, size);
+
+ return 0;
+ }
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 9b66eb1d42c2d..acbbc21e62338 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1823,6 +1823,9 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask)
+ case BUS_I2C:
+ bus = "I2C";
+ break;
++ case BUS_VIRTUAL:
++ bus = "VIRTUAL";
++ break;
+ default:
+ bus = "<UNKNOWN>";
+ }
+diff --git a/drivers/hid/hid-gt683r.c b/drivers/hid/hid-gt683r.c
+index a298fbd8db6b9..8ca4c1baeda89 100644
+--- a/drivers/hid/hid-gt683r.c
++++ b/drivers/hid/hid-gt683r.c
+@@ -64,6 +64,7 @@ static const struct hid_device_id gt683r_led_id[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL) },
+ { }
+ };
++MODULE_DEVICE_TABLE(hid, gt683r_led_id);
+
+ static void gt683r_brightness_set(struct led_classdev *led_cdev,
+ enum led_brightness brightness)
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 75342f3dfb863..ee5dce862a215 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -999,6 +999,7 @@
+ #define USB_DEVICE_ID_SAITEK_X52 0x075c
+ #define USB_DEVICE_ID_SAITEK_X52_2 0x0255
+ #define USB_DEVICE_ID_SAITEK_X52_PRO 0x0762
++#define USB_DEVICE_ID_SAITEK_X65 0x0b6a
+
+ #define USB_VENDOR_ID_SAMSUNG 0x0419
+ #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 8fbe7b9cd84a3..48e9761d4ace9 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -155,6 +155,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_2), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_PRO), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X65), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index 21fbdcde1faa1..ef62f36ebcf90 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -223,16 +223,21 @@ int sensor_hub_set_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
+ buffer_size = buffer_size / sizeof(__s32);
+ if (buffer_size) {
+ for (i = 0; i < buffer_size; ++i) {
+- hid_set_field(report->field[field_index], i,
+- (__force __s32)cpu_to_le32(*buf32));
++ ret = hid_set_field(report->field[field_index], i,
++ (__force __s32)cpu_to_le32(*buf32));
++ if (ret)
++ goto done_proc;
++
+ ++buf32;
+ }
+ }
+ if (remaining_bytes) {
+ value = 0;
+ memcpy(&value, (u8 *)buf32, remaining_bytes);
+- hid_set_field(report->field[field_index], i,
+- (__force __s32)cpu_to_le32(value));
++ ret = hid_set_field(report->field[field_index], i,
++ (__force __s32)cpu_to_le32(value));
++ if (ret)
++ goto done_proc;
+ }
+ hid_hw_request(hsdev->hdev, report, HID_REQ_SET_REPORT);
+ hid_hw_wait(hsdev->hdev);
+diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
+index 1e6f8b0d00fb6..6b6db57b49d69 100644
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -377,7 +377,7 @@ static int hid_submit_ctrl(struct hid_device *hid)
+ raw_report = usbhid->ctrl[usbhid->ctrltail].raw_report;
+ dir = usbhid->ctrl[usbhid->ctrltail].dir;
+
+- len = ((report->size - 1) >> 3) + 1 + (report->id > 0);
++ len = hid_report_len(report);
+ if (dir == USB_DIR_OUT) {
+ usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0);
+ usbhid->urbctrl->transfer_buffer_length = len;
+diff --git a/drivers/hwmon/scpi-hwmon.c b/drivers/hwmon/scpi-hwmon.c
+index 7e49da50bc69b..562f3e287297a 100644
+--- a/drivers/hwmon/scpi-hwmon.c
++++ b/drivers/hwmon/scpi-hwmon.c
+@@ -107,6 +107,15 @@ scpi_show_sensor(struct device *dev, struct device_attribute *attr, char *buf)
+
+ scpi_scale_reading(&value, sensor);
+
++ /*
++ * Temperature sensor values are treated as signed values based on
++ * observation even though that is not explicitly specified, and
++ * because an unsigned u64 temperature does not really make practical
++ * sense especially when the temperature is below zero degrees Celsius.
++ */
++ if (sensor->info.class == TEMPERATURE)
++ return sprintf(buf, "%lld\n", (s64)value);
++
+ return sprintf(buf, "%llu\n", value);
+ }
+
+diff --git a/drivers/i2c/busses/i2c-robotfuzz-osif.c b/drivers/i2c/busses/i2c-robotfuzz-osif.c
+index d848cf5152349..3fe21397a4f6b 100644
+--- a/drivers/i2c/busses/i2c-robotfuzz-osif.c
++++ b/drivers/i2c/busses/i2c-robotfuzz-osif.c
+@@ -86,7 +86,7 @@ static int osif_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,
+ }
+ }
+
+- ret = osif_usb_read(adapter, OSIFI2C_STOP, 0, 0, NULL, 0);
++ ret = osif_usb_write(adapter, OSIFI2C_STOP, 0, 0, NULL, 0);
+ if (ret) {
+ dev_err(&adapter->dev, "failure sending STOP\n");
+ return -EREMOTEIO;
+@@ -156,7 +156,7 @@ static int osif_probe(struct usb_interface *interface,
+ * Set bus frequency. The frequency is:
+ * 120,000,000 / ( 16 + 2 * div * 4^prescale).
+ * Using dev = 52, prescale = 0 give 100KHz */
+- ret = osif_usb_read(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0,
++ ret = osif_usb_write(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0,
+ NULL, 0);
+ if (ret) {
+ dev_err(&interface->dev, "failure sending bit rate");
+diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
+index 94d5ce9419ca6..81ec17b9c49cf 100644
+--- a/drivers/net/caif/caif_serial.c
++++ b/drivers/net/caif/caif_serial.c
+@@ -360,6 +360,7 @@ static int ldisc_open(struct tty_struct *tty)
+ rtnl_lock();
+ result = register_netdevice(dev);
+ if (result) {
++ tty_kref_put(tty);
+ rtnl_unlock();
+ free_netdev(dev);
+ return -ENODEV;
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
+index 896f5b0227295..3215ba69a9e75 100644
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -93,6 +93,8 @@ struct mcba_priv {
+ bool can_ka_first_pass;
+ bool can_speed_check;
+ atomic_t free_ctx_cnt;
++ void *rxbuf[MCBA_MAX_RX_URBS];
++ dma_addr_t rxbuf_dma[MCBA_MAX_RX_URBS];
+ };
+
+ /* CAN frame */
+@@ -644,6 +646,7 @@ static int mcba_usb_start(struct mcba_priv *priv)
+ for (i = 0; i < MCBA_MAX_RX_URBS; i++) {
+ struct urb *urb = NULL;
+ u8 *buf;
++ dma_addr_t buf_dma;
+
+ /* create a URB, and a buffer for it */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+@@ -653,7 +656,7 @@ static int mcba_usb_start(struct mcba_priv *priv)
+ }
+
+ buf = usb_alloc_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE,
+- GFP_KERNEL, &urb->transfer_dma);
++ GFP_KERNEL, &buf_dma);
+ if (!buf) {
+ netdev_err(netdev, "No memory left for USB buffer\n");
+ usb_free_urb(urb);
+@@ -672,11 +675,14 @@ static int mcba_usb_start(struct mcba_priv *priv)
+ if (err) {
+ usb_unanchor_urb(urb);
+ usb_free_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE,
+- buf, urb->transfer_dma);
++ buf, buf_dma);
+ usb_free_urb(urb);
+ break;
+ }
+
++ priv->rxbuf[i] = buf;
++ priv->rxbuf_dma[i] = buf_dma;
++
+ /* Drop reference, USB core will take care of freeing it */
+ usb_free_urb(urb);
+ }
+@@ -719,7 +725,14 @@ static int mcba_usb_open(struct net_device *netdev)
+
+ static void mcba_urb_unlink(struct mcba_priv *priv)
+ {
++ int i;
++
+ usb_kill_anchored_urbs(&priv->rx_submitted);
++
++ for (i = 0; i < MCBA_MAX_RX_URBS; ++i)
++ usb_free_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE,
++ priv->rxbuf[i], priv->rxbuf_dma[i]);
++
+ usb_kill_anchored_urbs(&priv->tx_submitted);
+ }
+
+diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
+index d83ad06bf1991..54bfe9d84ecd1 100644
+--- a/drivers/net/ethernet/atheros/alx/main.c
++++ b/drivers/net/ethernet/atheros/alx/main.c
+@@ -1855,6 +1855,7 @@ out_free_netdev:
+ free_netdev(netdev);
+ out_pci_release:
+ pci_release_mem_regions(pdev);
++ pci_disable_pcie_error_reporting(pdev);
+ out_pci_disable:
+ pci_disable_device(pdev);
+ return err;
+diff --git a/drivers/net/ethernet/ec_bhf.c b/drivers/net/ethernet/ec_bhf.c
+index d71cba0842c5a..59dc20020c738 100644
+--- a/drivers/net/ethernet/ec_bhf.c
++++ b/drivers/net/ethernet/ec_bhf.c
+@@ -585,10 +585,12 @@ static void ec_bhf_remove(struct pci_dev *dev)
+ struct ec_bhf_priv *priv = netdev_priv(net_dev);
+
+ unregister_netdev(net_dev);
+- free_netdev(net_dev);
+
+ pci_iounmap(dev, priv->dma_io);
+ pci_iounmap(dev, priv->io);
++
++ free_netdev(net_dev);
++
+ pci_release_regions(dev);
+ pci_clear_master(dev);
+ pci_disable_device(dev);
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index 3fe6a28027fe1..05cb2f7cc35c3 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -6029,6 +6029,7 @@ drv_cleanup:
+ unmap_bars:
+ be_unmap_pci_bars(adapter);
+ free_netdev:
++ pci_disable_pcie_error_reporting(pdev);
+ free_netdev(netdev);
+ rel_reg:
+ pci_release_regions(pdev);
+diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
+index 09a762eb4f09e..52a811f913846 100644
+--- a/drivers/net/ethernet/freescale/fec_ptp.c
++++ b/drivers/net/ethernet/freescale/fec_ptp.c
+@@ -220,15 +220,13 @@ static u64 fec_ptp_read(const struct cyclecounter *cc)
+ {
+ struct fec_enet_private *fep =
+ container_of(cc, struct fec_enet_private, cc);
+- const struct platform_device_id *id_entry =
+- platform_get_device_id(fep->pdev);
+ u32 tempval;
+
+ tempval = readl(fep->hwp + FEC_ATIME_CTRL);
+ tempval |= FEC_T_CTRL_CAPTURE;
+ writel(tempval, fep->hwp + FEC_ATIME_CTRL);
+
+- if (id_entry->driver_data & FEC_QUIRK_BUG_CAPTURE)
++ if (fep->quirks & FEC_QUIRK_BUG_CAPTURE)
+ udelay(1);
+
+ return readl(fep->hwp + FEC_ATIME);
+@@ -599,6 +597,10 @@ void fec_ptp_init(struct platform_device *pdev, int irq_idx)
+ fep->ptp_caps.enable = fec_ptp_enable;
+
+ fep->cycle_speed = clk_get_rate(fep->clk_ptp);
++ if (!fep->cycle_speed) {
++ fep->cycle_speed = NSEC_PER_SEC;
++ dev_err(&fep->pdev->dev, "clk_ptp clock rate is zero\n");
++ }
+ fep->ptp_inc = NSEC_PER_SEC / fep->cycle_speed;
+
+ spin_lock_init(&fep->tmreg_lock);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+index cf58c96379047..c467f5e981f61 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+@@ -515,9 +515,6 @@ void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv)
+ struct mlx5_core_dev *mdev = priv->mdev;
+ struct net_device *netdev = priv->netdev;
+
+- if (!priv->ipsec)
+- return;
+-
+ if (!(mlx5_accel_ipsec_device_caps(mdev) & MLX5_ACCEL_IPSEC_CAP_ESP) ||
+ !MLX5_CAP_ETH(mdev, swp)) {
+ mlx5_core_dbg(mdev, "mlx5e: ESP and SWP offload not supported\n");
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 51edc507b7b5d..9003702892cda 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -4679,11 +4679,8 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
+ }
+
+ if (mlx5_vxlan_allowed(mdev->vxlan)) {
+- netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL |
+- NETIF_F_GSO_UDP_TUNNEL_CSUM;
+- netdev->hw_enc_features |= NETIF_F_GSO_UDP_TUNNEL |
+- NETIF_F_GSO_UDP_TUNNEL_CSUM;
+- netdev->gso_partial_features = NETIF_F_GSO_UDP_TUNNEL_CSUM;
++ netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
++ netdev->hw_enc_features |= NETIF_F_GSO_UDP_TUNNEL;
+ }
+
+ if (MLX5_CAP_ETH(mdev, tunnel_stateless_gre)) {
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+index 6789eed78ff70..3bc570c46f81c 100644
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -3853,6 +3853,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ dev_err(&pdev->dev,
+ "invalid sram_size %dB or board span %ldB\n",
+ mgp->sram_size, mgp->board_span);
++ status = -EINVAL;
+ goto abort_with_ioremap;
+ }
+ memcpy_fromio(mgp->eeprom_strings,
+diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+index 42b99b1826163..a331ad406e7ab 100644
+--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+@@ -1618,6 +1618,8 @@ err_out_free_netdev:
+ free_netdev(netdev);
+
+ err_out_free_res:
++ if (NX_IS_REVISION_P3(pdev->revision))
++ pci_disable_pcie_error_reporting(pdev);
+ pci_release_regions(pdev);
+
+ err_out_disable_pdev:
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+index 5900a506bf8df..ff8a7750d3c0d 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+@@ -1294,9 +1294,11 @@ int qed_dcbx_get_config_params(struct qed_hwfn *p_hwfn,
+ p_hwfn->p_dcbx_info->set.ver_num |= DCBX_CONFIG_VERSION_STATIC;
+
+ p_hwfn->p_dcbx_info->set.enabled = dcbx_info->operational.enabled;
++ BUILD_BUG_ON(sizeof(dcbx_info->operational.params) !=
++ sizeof(p_hwfn->p_dcbx_info->set.config.params));
+ memcpy(&p_hwfn->p_dcbx_info->set.config.params,
+ &dcbx_info->operational.params,
+- sizeof(struct qed_dcbx_admin_params));
++ sizeof(p_hwfn->p_dcbx_info->set.config.params));
+ p_hwfn->p_dcbx_info->set.config.valid = true;
+
+ memcpy(params, &p_hwfn->p_dcbx_info->set, sizeof(struct qed_dcbx_set));
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+index ed34b7d1a9e11..43920374beae2 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+@@ -2708,6 +2708,7 @@ err_out_free_hw_res:
+ kfree(ahw);
+
+ err_out_free_res:
++ pci_disable_pcie_error_reporting(pdev);
+ pci_release_regions(pdev);
+
+ err_out_disable_pdev:
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 0c9e6cb0e3418..523626f2ffbeb 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -1823,7 +1823,7 @@ static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data)
+ {
+ switch(stringset) {
+ case ETH_SS_STATS:
+- memcpy(data, *rtl8169_gstrings, sizeof(rtl8169_gstrings));
++ memcpy(data, rtl8169_gstrings, sizeof(rtl8169_gstrings));
+ break;
+ }
+ }
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 24638cb157ca2..394ab9cdfe2c7 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2302,7 +2302,7 @@ static void sh_eth_get_strings(struct net_device *ndev, u32 stringset, u8 *data)
+ {
+ switch (stringset) {
+ case ETH_SS_STATS:
+- memcpy(data, *sh_eth_gstrings_stats,
++ memcpy(data, sh_eth_gstrings_stats,
+ sizeof(sh_eth_gstrings_stats));
+ break;
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h b/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
+index 184ca13c8f790..1a84cf459e400 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000.h
+@@ -86,10 +86,10 @@ enum power_event {
+ #define LPI_CTRL_STATUS_TLPIEN 0x00000001 /* Transmit LPI Entry */
+
+ /* GMAC HW ADDR regs */
+-#define GMAC_ADDR_HIGH(reg) (((reg > 15) ? 0x00000800 : 0x00000040) + \
+- (reg * 8))
+-#define GMAC_ADDR_LOW(reg) (((reg > 15) ? 0x00000804 : 0x00000044) + \
+- (reg * 8))
++#define GMAC_ADDR_HIGH(reg) ((reg > 15) ? 0x00000800 + (reg - 16) * 8 : \
++ 0x00000040 + (reg * 8))
++#define GMAC_ADDR_LOW(reg) ((reg > 15) ? 0x00000804 + (reg - 16) * 8 : \
++ 0x00000044 + (reg * 8))
+ #define GMAC_MAX_PERFECT_ADDRESSES 1
+
+ #define GMAC_PCS_BASE 0x000000c0 /* PCS register base */
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index 2241f98970926..939de185bc6b8 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -736,6 +736,11 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ /* Kick off the transfer */
+ lp->dma_out(lp, TX_TAILDESC_PTR, tail_p); /* DMA start */
+
++ if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) {
++ netdev_info(ndev, "%s -> netif_stop_queue\n", __func__);
++ netif_stop_queue(ndev);
++ }
++
+ return NETDEV_TX_OK;
+ }
+
+diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
+index 3b14e6e281d43..940aa7a19f50b 100644
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -810,6 +810,7 @@ static void mkiss_close(struct tty_struct *tty)
+ ax->tty = NULL;
+
+ unregister_netdev(ax->dev);
++ free_netdev(ax->dev);
+ }
+
+ /* Perform I/O control on an active ax25 channel. */
+diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
+index 61ea4eaace5d0..e3f108080af12 100644
+--- a/drivers/net/usb/cdc_eem.c
++++ b/drivers/net/usb/cdc_eem.c
+@@ -135,10 +135,10 @@ static struct sk_buff *eem_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ }
+
+ skb2 = skb_copy_expand(skb, EEM_HEAD, ETH_FCS_LEN + padlen, flags);
++ dev_kfree_skb_any(skb);
+ if (!skb2)
+ return NULL;
+
+- dev_kfree_skb_any(skb);
+ skb = skb2;
+
+ done:
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index 82ec00a7370d4..f3f78ccdb274c 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1666,7 +1666,7 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
+ static const struct driver_info cdc_ncm_info = {
+ .description = "CDC NCM",
+ .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
+- | FLAG_LINK_INTR,
++ | FLAG_LINK_INTR | FLAG_ETHER,
+ .bind = cdc_ncm_bind,
+ .unbind = cdc_ncm_unbind,
+ .manage_power = usbnet_manage_power,
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index a27ea04cfa6c3..726fb5561a0fb 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -4649,7 +4649,7 @@ static void rtl8152_get_strings(struct net_device *dev, u32 stringset, u8 *data)
+ {
+ switch (stringset) {
+ case ETH_SS_STATS:
+- memcpy(data, *rtl8152_gstrings, sizeof(rtl8152_gstrings));
++ memcpy(data, rtl8152_gstrings, sizeof(rtl8152_gstrings));
+ break;
+ }
+ }
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index 62f2862c9775e..8b9fd4e071f3d 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -1495,7 +1495,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ ret = smsc75xx_wait_ready(dev, 0);
+ if (ret < 0) {
+ netdev_warn(dev->net, "device not ready in smsc75xx_bind\n");
+- goto err;
++ goto free_pdata;
+ }
+
+ smsc75xx_init_mac_address(dev);
+@@ -1504,7 +1504,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ ret = smsc75xx_reset(dev);
+ if (ret < 0) {
+ netdev_warn(dev->net, "smsc75xx_reset error %d\n", ret);
+- goto err;
++ goto cancel_work;
+ }
+
+ dev->net->netdev_ops = &smsc75xx_netdev_ops;
+@@ -1515,8 +1515,11 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ dev->net->max_mtu = MAX_SINGLE_PACKET_SIZE;
+ return 0;
+
+-err:
++cancel_work:
++ cancel_work_sync(&pdata->set_multicast);
++free_pdata:
+ kfree(pdata);
++ dev->data[0] = 0;
+ return ret;
+ }
+
+@@ -1527,7 +1530,6 @@ static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf)
+ cancel_work_sync(&pdata->set_multicast);
+ netif_dbg(dev, ifdown, dev->net, "free pdata\n");
+ kfree(pdata);
+- pdata = NULL;
+ dev->data[0] = 0;
+ }
+ }
+diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
+index 137a27fa369cb..08b52f3ed0c30 100644
+--- a/drivers/nvme/target/loop.c
++++ b/drivers/nvme/target/loop.c
+@@ -274,7 +274,8 @@ static const struct blk_mq_ops nvme_loop_admin_mq_ops = {
+
+ static void nvme_loop_destroy_admin_queue(struct nvme_loop_ctrl *ctrl)
+ {
+- clear_bit(NVME_LOOP_Q_LIVE, &ctrl->queues[0].flags);
++ if (!test_and_clear_bit(NVME_LOOP_Q_LIVE, &ctrl->queues[0].flags))
++ return;
+ nvmet_sq_destroy(&ctrl->queues[0].nvme_sq);
+ blk_cleanup_queue(ctrl->ctrl.admin_q);
+ blk_mq_free_tag_set(&ctrl->admin_tag_set);
+@@ -309,6 +310,7 @@ static void nvme_loop_destroy_io_queues(struct nvme_loop_ctrl *ctrl)
+ clear_bit(NVME_LOOP_Q_LIVE, &ctrl->queues[i].flags);
+ nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+ }
++ ctrl->ctrl.queue_count = 1;
+ }
+
+ static int nvme_loop_init_io_queues(struct nvme_loop_ctrl *ctrl)
+@@ -417,6 +419,7 @@ static int nvme_loop_configure_admin_queue(struct nvme_loop_ctrl *ctrl)
+ return 0;
+
+ out_cleanup_queue:
++ clear_bit(NVME_LOOP_Q_LIVE, &ctrl->queues[0].flags);
+ blk_cleanup_queue(ctrl->ctrl.admin_q);
+ out_free_tagset:
+ blk_mq_free_tag_set(&ctrl->admin_tag_set);
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 3d59bbe4a5d56..9ebf32de85757 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1585,11 +1585,21 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags)
+ int err;
+ int i, bars = 0;
+
+- if (atomic_inc_return(&dev->enable_cnt) > 1) {
+- pci_update_current_state(dev, dev->current_state);
+- return 0; /* already enabled */
++ /*
++ * Power state could be unknown at this point, either due to a fresh
++ * boot or a device removal call. So get the current power state
++ * so that things like MSI message writing will behave as expected
++ * (e.g. if the device really is in D0 at enable time).
++ */
++ if (dev->pm_cap) {
++ u16 pmcsr;
++ pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
++ dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK);
+ }
+
++ if (atomic_inc_return(&dev->enable_cnt) > 1)
++ return 0; /* already enabled */
++
+ bridge = pci_upstream_bridge(dev);
+ if (bridge)
+ pci_enable_bridge(bridge);
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 70f05595da60d..576b5bb6b95f2 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3463,6 +3463,18 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
+ }
+
++/*
++ * Some NVIDIA GPU devices do not work with bus reset, SBR needs to be
++ * prevented for those affected devices.
++ */
++static void quirk_nvidia_no_bus_reset(struct pci_dev *dev)
++{
++ if ((dev->device & 0xffc0) == 0x2340)
++ quirk_no_bus_reset(dev);
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
++ quirk_nvidia_no_bus_reset);
++
+ /*
+ * Some Atheros AR9xxx and QCA988x chips do not behave after a bus reset.
+ * The device will throw a Link Down error on AER-capable systems and
+@@ -3483,6 +3495,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset);
+ */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset);
+
++/*
++ * Some TI KeyStone C667X devices do not support bus/hot reset. The PCIESS
++ * automatically disables LTSSM when Secondary Bus Reset is received and
++ * the device stops working. Prevent bus reset for these devices. With
++ * this change, the device can be assigned to VMs with VFIO, but it will
++ * leak state between VMs. Reference
++ * https://e2e.ti.com/support/processors/f/791/t/954382
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset);
++
+ static void quirk_no_pm_reset(struct pci_dev *dev)
+ {
+ /*
+@@ -3875,6 +3897,69 @@ static int delay_250ms_after_flr(struct pci_dev *dev, int probe)
+ return 0;
+ }
+
++#define PCI_DEVICE_ID_HINIC_VF 0x375E
++#define HINIC_VF_FLR_TYPE 0x1000
++#define HINIC_VF_FLR_CAP_BIT (1UL << 30)
++#define HINIC_VF_OP 0xE80
++#define HINIC_VF_FLR_PROC_BIT (1UL << 18)
++#define HINIC_OPERATION_TIMEOUT 15000 /* 15 seconds */
++
++/* Device-specific reset method for Huawei Intelligent NIC virtual functions */
++static int reset_hinic_vf_dev(struct pci_dev *pdev, int probe)
++{
++ unsigned long timeout;
++ void __iomem *bar;
++ u32 val;
++
++ if (probe)
++ return 0;
++
++ bar = pci_iomap(pdev, 0, 0);
++ if (!bar)
++ return -ENOTTY;
++
++ /* Get and check firmware capabilities */
++ val = ioread32be(bar + HINIC_VF_FLR_TYPE);
++ if (!(val & HINIC_VF_FLR_CAP_BIT)) {
++ pci_iounmap(pdev, bar);
++ return -ENOTTY;
++ }
++
++ /* Set HINIC_VF_FLR_PROC_BIT for the start of FLR */
++ val = ioread32be(bar + HINIC_VF_OP);
++ val = val | HINIC_VF_FLR_PROC_BIT;
++ iowrite32be(val, bar + HINIC_VF_OP);
++
++ pcie_flr(pdev);
++
++ /*
++ * The device must recapture its Bus and Device Numbers after FLR
++ * in order generate Completions. Issue a config write to let the
++ * device capture this information.
++ */
++ pci_write_config_word(pdev, PCI_VENDOR_ID, 0);
++
++ /* Firmware clears HINIC_VF_FLR_PROC_BIT when reset is complete */
++ timeout = jiffies + msecs_to_jiffies(HINIC_OPERATION_TIMEOUT);
++ do {
++ val = ioread32be(bar + HINIC_VF_OP);
++ if (!(val & HINIC_VF_FLR_PROC_BIT))
++ goto reset_complete;
++ msleep(20);
++ } while (time_before(jiffies, timeout));
++
++ val = ioread32be(bar + HINIC_VF_OP);
++ if (!(val & HINIC_VF_FLR_PROC_BIT))
++ goto reset_complete;
++
++ pci_warn(pdev, "Reset dev timeout, FLR ack reg: %#010x\n", val);
++
++reset_complete:
++ pci_iounmap(pdev, bar);
++
++ return 0;
++}
++
+ static const struct pci_dev_reset_methods pci_dev_reset_methods[] = {
+ { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82599_SFP_VF,
+ reset_intel_82599_sfp_virtfn },
+@@ -3886,6 +3971,8 @@ static const struct pci_dev_reset_methods pci_dev_reset_methods[] = {
+ { PCI_VENDOR_ID_INTEL, 0x0953, delay_250ms_after_flr },
+ { PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID,
+ reset_chelsio_generic_dev },
++ { PCI_VENDOR_ID_HUAWEI, PCI_DEVICE_ID_HINIC_VF,
++ reset_hinic_vf_dev },
+ { 0 }
+ };
+
+@@ -4689,6 +4776,8 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_AMPERE, 0xE00A, pci_quirk_xgene_acs },
+ { PCI_VENDOR_ID_AMPERE, 0xE00B, pci_quirk_xgene_acs },
+ { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs },
++ /* Broadcom multi-function device */
++ { PCI_VENDOR_ID_BROADCOM, 0x16D7, pci_quirk_mf_endpoint_acs },
+ { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs },
+ { 0 }
+ };
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index 14dfbbd6c1c37..4e17728f29375 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -978,7 +978,7 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl,
+ struct resource res;
+ struct reset_control *rstc;
+ int npins = STM32_GPIO_PINS_PER_BANK;
+- int bank_nr, err;
++ int bank_nr, err, i = 0;
+
+ rstc = of_reset_control_get_exclusive(np, NULL);
+ if (!IS_ERR(rstc))
+@@ -1007,9 +1007,14 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl,
+
+ of_property_read_string(np, "st,bank-name", &bank->gpio_chip.label);
+
+- if (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, 0, &args)) {
++ if (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, i, &args)) {
+ bank_nr = args.args[1] / STM32_GPIO_PINS_PER_BANK;
+ bank->gpio_chip.base = args.args[1];
++
++ npins = args.args[2];
++ while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3,
++ ++i, &args))
++ npins += args.args[2];
+ } else {
+ bank_nr = pctl->nbanks;
+ bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK;
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index e232233beb8f2..89632cc9c28fc 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -76,7 +76,7 @@ static void enqueue_external_timestamp(struct timestamp_event_queue *queue,
+ spin_unlock_irqrestore(&queue->lock, flags);
+ }
+
+-static s32 scaled_ppm_to_ppb(long ppm)
++long scaled_ppm_to_ppb(long ppm)
+ {
+ /*
+ * The 'freq' field in the 'struct timex' is in parts per
+@@ -93,8 +93,9 @@ static s32 scaled_ppm_to_ppb(long ppm)
+ s64 ppb = 1 + ppm;
+ ppb *= 125;
+ ppb >>= 13;
+- return (s32) ppb;
++ return (long) ppb;
+ }
++EXPORT_SYMBOL(scaled_ppm_to_ppb);
+
+ /* posix clock implementation */
+
+@@ -147,7 +148,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct timex *tx)
+ delta = ktime_to_ns(kt);
+ err = ops->adjtime(ops, delta);
+ } else if (tx->modes & ADJ_FREQUENCY) {
+- s32 ppb = scaled_ppm_to_ppb(tx->freq);
++ long ppb = scaled_ppm_to_ppb(tx->freq);
+ if (ppb > ops->max_adj || ppb < -ops->max_adj)
+ return -ERANGE;
+ if (ops->adjfine)
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index a08ff3bd63105..6a2a413cc97e0 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -184,6 +184,7 @@ static struct {
+ {"HP", "C3323-300", "4269", BLIST_NOTQ},
+ {"HP", "C5713A", NULL, BLIST_NOREPORTLUN},
+ {"HP", "DISK-SUBSYSTEM", "*", BLIST_REPORTLUN2},
++ {"HPE", "OPEN-", "*", BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES},
+ {"IBM", "AuSaV1S2", NULL, BLIST_FORCELUN},
+ {"IBM", "ProFibre 4000R", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
+ {"IBM", "2105", NULL, BLIST_RETRY_HWERROR},
+diff --git a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
+index 80e7067cfb797..ad811c0438cc7 100644
+--- a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
++++ b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
+@@ -127,7 +127,7 @@ static int rt2880_pmx_group_enable(struct pinctrl_dev *pctrldev,
+ if (p->groups[group].enabled) {
+ dev_err(p->dev, "%s is already enabled\n",
+ p->groups[group].name);
+- return -EBUSY;
++ return 0;
+ }
+
+ p->groups[group].enabled = 1;
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index bdada97cd4fe2..9c60a090cfd17 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2982,9 +2982,7 @@ __transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop,
+ __releases(&cmd->t_state_lock)
+ __acquires(&cmd->t_state_lock)
+ {
+-
+- assert_spin_locked(&cmd->t_state_lock);
+- WARN_ON_ONCE(!irqs_disabled());
++ lockdep_assert_held(&cmd->t_state_lock);
+
+ if (fabric_stop)
+ cmd->transport_state |= CMD_T_FABRIC_STOP;
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 0ddc2e30065f5..a7f16dbfffdfa 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -38,6 +38,8 @@
+ #define USB_VENDOR_GENESYS_LOGIC 0x05e3
+ #define USB_VENDOR_SMSC 0x0424
+ #define USB_PRODUCT_USB5534B 0x5534
++#define USB_VENDOR_CYPRESS 0x04b4
++#define USB_PRODUCT_CY7C65632 0x6570
+ #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01
+ #define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02
+
+@@ -5442,6 +5444,11 @@ static const struct usb_device_id hub_id_table[] = {
+ .idProduct = USB_PRODUCT_USB5534B,
+ .bInterfaceClass = USB_CLASS_HUB,
+ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++ | USB_DEVICE_ID_MATCH_PRODUCT,
++ .idVendor = USB_VENDOR_CYPRESS,
++ .idProduct = USB_PRODUCT_CY7C65632,
++ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
+ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
+ | USB_DEVICE_ID_MATCH_INT_CLASS,
+ .idVendor = USB_VENDOR_GENESYS_LOGIC,
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index e890c26b6c826..e223502eafca6 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1550,8 +1550,8 @@ static int dwc3_remove(struct platform_device *pdev)
+
+ pm_runtime_get_sync(&pdev->dev);
+
+- dwc3_debugfs_exit(dwc);
+ dwc3_core_exit_mode(dwc);
++ dwc3_debugfs_exit(dwc);
+
+ dwc3_core_exit(dwc);
+ dwc3_ulpi_exit(dwc);
+diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h
+index 4f75ab3505b77..069db13f3a10a 100644
+--- a/drivers/usb/dwc3/debug.h
++++ b/drivers/usb/dwc3/debug.h
+@@ -653,9 +653,12 @@ static inline const char *dwc3_gadget_generic_cmd_status_string(int status)
+
+
+ #ifdef CONFIG_DEBUG_FS
++extern void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep);
+ extern void dwc3_debugfs_init(struct dwc3 *);
+ extern void dwc3_debugfs_exit(struct dwc3 *);
+ #else
++static inline void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep)
++{ }
+ static inline void dwc3_debugfs_init(struct dwc3 *d)
+ { }
+ static inline void dwc3_debugfs_exit(struct dwc3 *d)
+diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c
+index 04ce7c01a09e6..58a2479d8e6a3 100644
+--- a/drivers/usb/dwc3/debugfs.c
++++ b/drivers/usb/dwc3/debugfs.c
+@@ -725,30 +725,14 @@ static void dwc3_debugfs_create_endpoint_files(struct dwc3_ep *dep,
+ }
+ }
+
+-static void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep,
+- struct dentry *parent)
++void dwc3_debugfs_create_endpoint_dir(struct dwc3_ep *dep)
+ {
+ struct dentry *dir;
+
+- dir = debugfs_create_dir(dep->name, parent);
++ dir = debugfs_create_dir(dep->name, dep->dwc->root);
+ dwc3_debugfs_create_endpoint_files(dep, dir);
+ }
+
+-static void dwc3_debugfs_create_endpoint_dirs(struct dwc3 *dwc,
+- struct dentry *parent)
+-{
+- int i;
+-
+- for (i = 0; i < dwc->num_eps; i++) {
+- struct dwc3_ep *dep = dwc->eps[i];
+-
+- if (!dep)
+- continue;
+-
+- dwc3_debugfs_create_endpoint_dir(dep, parent);
+- }
+-}
+-
+ void dwc3_debugfs_init(struct dwc3 *dwc)
+ {
+ struct dentry *root;
+@@ -777,7 +761,6 @@ void dwc3_debugfs_init(struct dwc3 *dwc)
+ &dwc3_testmode_fops);
+ debugfs_create_file("link_state", S_IRUGO | S_IWUSR, root, dwc,
+ &dwc3_link_state_fops);
+- dwc3_debugfs_create_endpoint_dirs(dwc, root);
+ }
+ }
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 1396ee5297923..c93bed41d988a 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2255,6 +2255,8 @@ static int dwc3_gadget_init_endpoint(struct dwc3 *dwc, u8 epnum)
+ INIT_LIST_HEAD(&dep->started_list);
+ INIT_LIST_HEAD(&dep->cancelled_list);
+
++ dwc3_debugfs_create_endpoint_dir(dep);
++
+ return 0;
+ }
+
+@@ -2298,6 +2300,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
+ list_del(&dep->endpoint.ep_list);
+ }
+
++ debugfs_remove_recursive(debugfs_lookup(dep->name, dwc->root));
+ kfree(dep);
+ }
+ }
+diff --git a/fs/afs/main.c b/fs/afs/main.c
+index 8ecb127be63f9..2eecb2c0a3c0e 100644
+--- a/fs/afs/main.c
++++ b/fs/afs/main.c
+@@ -200,8 +200,8 @@ static int __init afs_init(void)
+ goto error_fs;
+
+ afs_proc_symlink = proc_symlink("fs/afs", NULL, "../self/net/afs");
+- if (IS_ERR(afs_proc_symlink)) {
+- ret = PTR_ERR(afs_proc_symlink);
++ if (!afs_proc_symlink) {
++ ret = -ENOMEM;
+ goto error_proc;
+ }
+
+diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
+index 143e7d518c5d5..7c69486d556fe 100644
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -822,8 +822,11 @@ static ssize_t gfs2_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ current->backing_dev_info = inode_to_bdi(inode);
+ buffered = iomap_file_buffered_write(iocb, from, &gfs2_iomap_ops);
+ current->backing_dev_info = NULL;
+- if (unlikely(buffered <= 0))
++ if (unlikely(buffered <= 0)) {
++ if (!ret)
++ ret = buffered;
+ goto out_unlock;
++ }
+
+ /*
+ * We need to ensure that the page cache pages are written to
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index c20d71d86812a..14d11ccda868d 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -1457,6 +1457,7 @@ __acquires(&lru_lock)
+ while(!list_empty(list)) {
+ gl = list_entry(list->next, struct gfs2_glock, gl_lru);
+ list_del_init(&gl->gl_lru);
++ clear_bit(GLF_LRU, &gl->gl_flags);
+ if (!spin_trylock(&gl->gl_lockref.lock)) {
+ add_back_to_lru:
+ list_add(&gl->gl_lru, &lru_list);
+@@ -1502,7 +1503,6 @@ static long gfs2_scan_glock_lru(int nr)
+ if (!test_bit(GLF_LOCK, &gl->gl_flags)) {
+ list_move(&gl->gl_lru, &dispose);
+ atomic_dec(&lru_count);
+- clear_bit(GLF_LRU, &gl->gl_flags);
+ freed++;
+ continue;
+ }
+diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
+index e60be7bb55b0b..c6c8a33c81d5e 100644
+--- a/fs/nilfs2/sysfs.c
++++ b/fs/nilfs2/sysfs.c
+@@ -1054,6 +1054,7 @@ void nilfs_sysfs_delete_device_group(struct the_nilfs *nilfs)
+ nilfs_sysfs_delete_superblock_group(nilfs);
+ nilfs_sysfs_delete_segctor_group(nilfs);
+ kobject_del(&nilfs->ns_dev_kobj);
++ kobject_put(&nilfs->ns_dev_kobj);
+ kfree(nilfs->ns_dev_subgroups);
+ }
+
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 4dcce83ca3784..c833948aade05 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -1151,8 +1151,7 @@ static inline void hid_hw_wait(struct hid_device *hdev)
+ */
+ static inline u32 hid_report_len(struct hid_report *report)
+ {
+- /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */
+- return ((report->size - 1) >> 3) + 1 + (report->id > 0);
++ return DIV_ROUND_UP(report->size, 8) + (report->id > 0);
+ }
+
+ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
+diff --git a/include/linux/net.h b/include/linux/net.h
+index e0930678c8bf6..41dc703b261cd 100644
+--- a/include/linux/net.h
++++ b/include/linux/net.h
+@@ -83,6 +83,12 @@ enum sock_type {
+
+ #endif /* ARCH_HAS_SOCKET_TYPES */
+
++/**
++ * enum sock_shutdown_cmd - Shutdown types
++ * @SHUT_RD: shutdown receptions
++ * @SHUT_WR: shutdown transmissions
++ * @SHUT_RDWR: shutdown receptions/transmissions
++ */
+ enum sock_shutdown_cmd {
+ SHUT_RD,
+ SHUT_WR,
+diff --git a/include/linux/ptp_clock_kernel.h b/include/linux/ptp_clock_kernel.h
+index 51349d124ee5d..99c3f4ee938e9 100644
+--- a/include/linux/ptp_clock_kernel.h
++++ b/include/linux/ptp_clock_kernel.h
+@@ -204,6 +204,14 @@ extern void ptp_clock_event(struct ptp_clock *ptp,
+
+ extern int ptp_clock_index(struct ptp_clock *ptp);
+
++/**
++ * scaled_ppm_to_ppb() - convert scaled ppm to ppb
++ *
++ * @ppm: Parts per million, but with a 16 bit binary fractional field
++ */
++
++extern long scaled_ppm_to_ppb(long ppm);
++
+ /**
+ * ptp_find_pin() - obtain the pin index of a given auxiliary function
+ *
+diff --git a/include/linux/socket.h b/include/linux/socket.h
+index 7ed4713d53372..15a7eb24f63c9 100644
+--- a/include/linux/socket.h
++++ b/include/linux/socket.h
+@@ -26,7 +26,7 @@ typedef __kernel_sa_family_t sa_family_t;
+ /*
+ * 1003.1g requires sa_family_t and that sa_data is char.
+ */
+-
++
+ struct sockaddr {
+ sa_family_t sa_family; /* address family, AF_xxx */
+ char sa_data[14]; /* 14 bytes of protocol address */
+@@ -44,7 +44,7 @@ struct linger {
+ * system, not 4.3. Thus msg_accrights(len) are now missing. They
+ * belong in an obscure libc emulation or the bin.
+ */
+-
++
+ struct msghdr {
+ void *msg_name; /* ptr to socket address structure */
+ int msg_namelen; /* size of socket address structure */
+@@ -54,7 +54,7 @@ struct msghdr {
+ unsigned int msg_flags; /* flags on received message */
+ struct kiocb *msg_iocb; /* ptr to iocb for async requests */
+ };
+-
++
+ struct user_msghdr {
+ void __user *msg_name; /* ptr to socket address structure */
+ int msg_namelen; /* size of socket address structure */
+@@ -122,7 +122,7 @@ struct cmsghdr {
+ * inside range, given by msg->msg_controllen before using
+ * ancillary object DATA. --ANK (980731)
+ */
+-
++
+ static inline struct cmsghdr * __cmsg_nxthdr(void *__ctl, __kernel_size_t __size,
+ struct cmsghdr *__cmsg)
+ {
+@@ -264,10 +264,10 @@ struct ucred {
+ /* Maximum queue length specifiable by listen. */
+ #define SOMAXCONN 128
+
+-/* Flags we can use with send/ and recv.
++/* Flags we can use with send/ and recv.
+ Added those for 1003.1g not all are supported yet
+ */
+-
++
+ #define MSG_OOB 1
+ #define MSG_PEEK 2
+ #define MSG_DONTROUTE 4
+@@ -384,6 +384,4 @@ extern int __sys_getpeername(int fd, struct sockaddr __user *usockaddr,
+ extern int __sys_socketpair(int family, int type, int protocol,
+ int __user *usockvec);
+ extern int __sys_shutdown(int fd, int how);
+-
+-extern struct ns_common *get_net_ns(struct ns_common *ns);
+ #endif /* _LINUX_SOCKET_H */
+diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
+index 5007eaba207d5..bc88ac6c2e1d7 100644
+--- a/include/net/net_namespace.h
++++ b/include/net/net_namespace.h
+@@ -175,6 +175,8 @@ struct net *copy_net_ns(unsigned long flags, struct user_namespace *user_ns,
+ void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid);
+
+ void net_ns_barrier(void);
++
++struct ns_common *get_net_ns(struct ns_common *ns);
+ #else /* CONFIG_NET_NS */
+ #include <linux/sched.h>
+ #include <linux/nsproxy.h>
+@@ -194,6 +196,11 @@ static inline void net_ns_get_ownership(const struct net *net,
+ }
+
+ static inline void net_ns_barrier(void) {}
++
++static inline struct ns_common *get_net_ns(struct ns_common *ns)
++{
++ return ERR_PTR(-EINVAL);
++}
+ #endif /* CONFIG_NET_NS */
+
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index bc752237dff3f..351749c694ce6 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1832,7 +1832,8 @@ static inline u32 net_tx_rndhash(void)
+
+ static inline void sk_set_txhash(struct sock *sk)
+ {
+- sk->sk_txhash = net_tx_rndhash();
++ /* This pairs with READ_ONCE() in skb_set_hash_from_sk() */
++ WRITE_ONCE(sk->sk_txhash, net_tx_rndhash());
+ }
+
+ static inline void sk_rethink_txhash(struct sock *sk)
+@@ -2103,9 +2104,12 @@ static inline void sock_poll_wait(struct file *filp, struct socket *sock,
+
+ static inline void skb_set_hash_from_sk(struct sk_buff *skb, struct sock *sk)
+ {
+- if (sk->sk_txhash) {
++ /* This pairs with WRITE_ONCE() in sk_set_txhash() */
++ u32 txhash = READ_ONCE(sk->sk_txhash);
++
++ if (txhash) {
+ skb->l4_hash = 1;
+- skb->hash = sk->sk_txhash;
++ skb->hash = txhash;
+ }
+ }
+
+diff --git a/include/uapi/linux/in.h b/include/uapi/linux/in.h
+index 48e8a225b985a..2a66ab49f14dd 100644
+--- a/include/uapi/linux/in.h
++++ b/include/uapi/linux/in.h
+@@ -280,6 +280,9 @@ struct sockaddr_in {
+ /* Address indicating an error return. */
+ #define INADDR_NONE ((unsigned long int) 0xffffffff)
+
++/* Dummy address for src of ICMP replies if no real address is set (RFC7600). */
++#define INADDR_DUMMY ((unsigned long int) 0xc0000008)
++
+ /* Network number for local host loopback. */
+ #define IN_LOOPBACKNET 127
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 92d8610742c7d..68637e661d75c 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -268,9 +268,18 @@ static void module_assert_mutex_or_preempt(void)
+ #endif
+ }
+
++#ifdef CONFIG_MODULE_SIG
+ static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
+ module_param(sig_enforce, bool_enable_only, 0644);
+
++void set_module_sig_enforced(void)
++{
++ sig_enforce = true;
++}
++#else
++#define sig_enforce false
++#endif
++
+ /*
+ * Export sig_enforce kernel cmdline parameter to allow other subsystems rely
+ * on that instead of directly to CONFIG_MODULE_SIG_FORCE config.
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index f8aaa7879d7d6..71bc808fe03a2 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1743,9 +1743,6 @@ struct saved_cmdlines_buffer {
+ };
+ static struct saved_cmdlines_buffer *savedcmd;
+
+-/* temporary disable recording */
+-static atomic_t trace_record_taskinfo_disabled __read_mostly;
+-
+ static inline char *get_saved_cmdlines(int idx)
+ {
+ return &savedcmd->saved_cmdlines[idx * TASK_COMM_LEN];
+@@ -2031,8 +2028,6 @@ static bool tracing_record_taskinfo_skip(int flags)
+ {
+ if (unlikely(!(flags & (TRACE_RECORD_CMDLINE | TRACE_RECORD_TGID))))
+ return true;
+- if (atomic_read(&trace_record_taskinfo_disabled) || !tracing_is_on())
+- return true;
+ if (!__this_cpu_read(trace_taskinfo_save))
+ return true;
+ return false;
+@@ -3261,9 +3256,6 @@ static void *s_start(struct seq_file *m, loff_t *pos)
+ return ERR_PTR(-EBUSY);
+ #endif
+
+- if (!iter->snapshot)
+- atomic_inc(&trace_record_taskinfo_disabled);
+-
+ if (*pos != iter->pos) {
+ iter->ent = NULL;
+ iter->cpu = 0;
+@@ -3306,9 +3298,6 @@ static void s_stop(struct seq_file *m, void *p)
+ return;
+ #endif
+
+- if (!iter->snapshot)
+- atomic_dec(&trace_record_taskinfo_disabled);
+-
+ trace_access_unlock(iter->cpu_file);
+ trace_event_read_unlock();
+ }
+diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c
+index c1637f90c8a38..4702efb00ff21 100644
+--- a/kernel/trace/trace_clock.c
++++ b/kernel/trace/trace_clock.c
+@@ -115,9 +115,9 @@ u64 notrace trace_clock_global(void)
+ prev_time = READ_ONCE(trace_clock_struct.prev_time);
+ now = sched_clock_cpu(this_cpu);
+
+- /* Make sure that now is always greater than prev_time */
++ /* Make sure that now is always greater than or equal to prev_time */
+ if ((s64)(now - prev_time) < 0)
+- now = prev_time + 1;
++ now = prev_time;
+
+ /*
+ * If in an NMI context then dont risk lockups and simply return
+@@ -131,7 +131,7 @@ u64 notrace trace_clock_global(void)
+ /* Reread prev_time in case it was already updated */
+ prev_time = READ_ONCE(trace_clock_struct.prev_time);
+ if ((s64)(now - prev_time) < 0)
+- now = prev_time + 1;
++ now = prev_time;
+
+ trace_clock_struct.prev_time = now;
+
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 034607a68ccb3..3da3c63dccd1a 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1387,7 +1387,12 @@ int memory_failure(unsigned long pfn, int flags)
+ return 0;
+ }
+
+- if (!PageTransTail(p) && !PageLRU(p))
++ /*
++ * __munlock_pagevec may clear a writeback page's LRU flag without
++ * page_lock. We need wait writeback completion for this page or it
++ * may trigger vfs BUG while evict inode.
++ */
++ if (!PageTransTail(p) && !PageLRU(p) && !PageWriteback(p))
+ goto identify_page_state;
+
+ /*
+diff --git a/mm/slub.c b/mm/slub.c
+index da141e5974f2b..b6c5c8fd265d2 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -15,6 +15,7 @@
+ #include <linux/module.h>
+ #include <linux/bit_spinlock.h>
+ #include <linux/interrupt.h>
++#include <linux/swab.h>
+ #include <linux/bitops.h>
+ #include <linux/slab.h>
+ #include "slab.h"
+@@ -672,15 +673,15 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
+ p, p - addr, get_freepointer(s, p));
+
+ if (s->flags & SLAB_RED_ZONE)
+- print_section(KERN_ERR, "Redzone ", p - s->red_left_pad,
++ print_section(KERN_ERR, "Redzone ", p - s->red_left_pad,
+ s->red_left_pad);
+ else if (p > addr + 16)
+ print_section(KERN_ERR, "Bytes b4 ", p - 16, 16);
+
+- print_section(KERN_ERR, "Object ", p,
++ print_section(KERN_ERR, "Object ", p,
+ min_t(unsigned int, s->object_size, PAGE_SIZE));
+ if (s->flags & SLAB_RED_ZONE)
+- print_section(KERN_ERR, "Redzone ", p + s->object_size,
++ print_section(KERN_ERR, "Redzone ", p + s->object_size,
+ s->inuse - s->object_size);
+
+ if (s->offset)
+@@ -695,7 +696,7 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
+
+ if (off != size_from_object(s))
+ /* Beginning of the filler is the free pointer */
+- print_section(KERN_ERR, "Padding ", p + off,
++ print_section(KERN_ERR, "Padding ", p + off,
+ size_from_object(s) - off);
+
+ dump_stack();
+@@ -873,11 +874,11 @@ static int check_object(struct kmem_cache *s, struct page *page,
+ u8 *endobject = object + s->object_size;
+
+ if (s->flags & SLAB_RED_ZONE) {
+- if (!check_bytes_and_report(s, page, object, "Redzone",
++ if (!check_bytes_and_report(s, page, object, "Left Redzone",
+ object - s->red_left_pad, val, s->red_left_pad))
+ return 0;
+
+- if (!check_bytes_and_report(s, page, object, "Redzone",
++ if (!check_bytes_and_report(s, page, object, "Right Redzone",
+ endobject, val, s->inuse - s->object_size))
+ return 0;
+ } else {
+@@ -892,7 +893,7 @@ static int check_object(struct kmem_cache *s, struct page *page,
+ if (val != SLUB_RED_ACTIVE && (s->flags & __OBJECT_POISON) &&
+ (!check_bytes_and_report(s, page, p, "Poison", p,
+ POISON_FREE, s->object_size - 1) ||
+- !check_bytes_and_report(s, page, p, "Poison",
++ !check_bytes_and_report(s, page, p, "End Poison",
+ p + s->object_size - 1, POISON_END, 1)))
+ return 0;
+ /*
+diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
+index 0b052ff51bdeb..cede6826e5b36 100644
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -594,8 +594,10 @@ static void batadv_iv_ogm_emit(struct batadv_forw_packet *forw_packet)
+ if (WARN_ON(!forw_packet->if_outgoing))
+ return;
+
+- if (WARN_ON(forw_packet->if_outgoing->soft_iface != soft_iface))
++ if (forw_packet->if_outgoing->soft_iface != soft_iface) {
++ pr_warn("%s: soft interface switch for queued OGM\n", __func__);
+ return;
++ }
+
+ if (forw_packet->if_incoming->if_status != BATADV_IF_ACTIVE)
+ return;
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index 33b8222db75c4..7ca3b469242e4 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -100,8 +100,8 @@ struct br_vlan_stats {
+ };
+
+ struct br_tunnel_info {
+- __be64 tunnel_id;
+- struct metadata_dst *tunnel_dst;
++ __be64 tunnel_id;
++ struct metadata_dst __rcu *tunnel_dst;
+ };
+
+ /**
+diff --git a/net/bridge/br_vlan_tunnel.c b/net/bridge/br_vlan_tunnel.c
+index 6d2c4eed2dc89..adb6845ceba46 100644
+--- a/net/bridge/br_vlan_tunnel.c
++++ b/net/bridge/br_vlan_tunnel.c
+@@ -46,26 +46,33 @@ static struct net_bridge_vlan *br_vlan_tunnel_lookup(struct rhashtable *tbl,
+ br_vlan_tunnel_rht_params);
+ }
+
++static void vlan_tunnel_info_release(struct net_bridge_vlan *vlan)
++{
++ struct metadata_dst *tdst = rtnl_dereference(vlan->tinfo.tunnel_dst);
++
++ WRITE_ONCE(vlan->tinfo.tunnel_id, 0);
++ RCU_INIT_POINTER(vlan->tinfo.tunnel_dst, NULL);
++ dst_release(&tdst->dst);
++}
++
+ void vlan_tunnel_info_del(struct net_bridge_vlan_group *vg,
+ struct net_bridge_vlan *vlan)
+ {
+- if (!vlan->tinfo.tunnel_dst)
++ if (!rcu_access_pointer(vlan->tinfo.tunnel_dst))
+ return;
+ rhashtable_remove_fast(&vg->tunnel_hash, &vlan->tnode,
+ br_vlan_tunnel_rht_params);
+- vlan->tinfo.tunnel_id = 0;
+- dst_release(&vlan->tinfo.tunnel_dst->dst);
+- vlan->tinfo.tunnel_dst = NULL;
++ vlan_tunnel_info_release(vlan);
+ }
+
+ static int __vlan_tunnel_info_add(struct net_bridge_vlan_group *vg,
+ struct net_bridge_vlan *vlan, u32 tun_id)
+ {
+- struct metadata_dst *metadata = NULL;
++ struct metadata_dst *metadata = rtnl_dereference(vlan->tinfo.tunnel_dst);
+ __be64 key = key32_to_tunnel_id(cpu_to_be32(tun_id));
+ int err;
+
+- if (vlan->tinfo.tunnel_dst)
++ if (metadata)
+ return -EEXIST;
+
+ metadata = __ip_tun_set_dst(0, 0, 0, 0, 0, TUNNEL_KEY,
+@@ -74,8 +81,8 @@ static int __vlan_tunnel_info_add(struct net_bridge_vlan_group *vg,
+ return -EINVAL;
+
+ metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX | IP_TUNNEL_INFO_BRIDGE;
+- vlan->tinfo.tunnel_dst = metadata;
+- vlan->tinfo.tunnel_id = key;
++ rcu_assign_pointer(vlan->tinfo.tunnel_dst, metadata);
++ WRITE_ONCE(vlan->tinfo.tunnel_id, key);
+
+ err = rhashtable_lookup_insert_fast(&vg->tunnel_hash, &vlan->tnode,
+ br_vlan_tunnel_rht_params);
+@@ -84,9 +91,7 @@ static int __vlan_tunnel_info_add(struct net_bridge_vlan_group *vg,
+
+ return 0;
+ out:
+- dst_release(&vlan->tinfo.tunnel_dst->dst);
+- vlan->tinfo.tunnel_dst = NULL;
+- vlan->tinfo.tunnel_id = 0;
++ vlan_tunnel_info_release(vlan);
+
+ return err;
+ }
+@@ -186,12 +191,15 @@ int br_handle_ingress_vlan_tunnel(struct sk_buff *skb,
+ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ struct net_bridge_vlan *vlan)
+ {
++ struct metadata_dst *tunnel_dst;
++ __be64 tunnel_id;
+ int err;
+
+- if (!vlan || !vlan->tinfo.tunnel_id)
++ if (!vlan)
+ return 0;
+
+- if (unlikely(!skb_vlan_tag_present(skb)))
++ tunnel_id = READ_ONCE(vlan->tinfo.tunnel_id);
++ if (!tunnel_id || unlikely(!skb_vlan_tag_present(skb)))
+ return 0;
+
+ skb_dst_drop(skb);
+@@ -199,7 +207,9 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ if (err)
+ return err;
+
+- skb_dst_set(skb, dst_clone(&vlan->tinfo.tunnel_dst->dst));
++ tunnel_dst = rcu_dereference(vlan->tinfo.tunnel_dst);
++ if (tunnel_dst && dst_hold_safe(&tunnel_dst->dst))
++ skb_dst_set(skb, &tunnel_dst->dst);
+
+ return 0;
+ }
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 79bb8afa9c0c0..9f30d7b4389a8 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -125,7 +125,7 @@ struct bcm_sock {
+ struct sock sk;
+ int bound;
+ int ifindex;
+- struct notifier_block notifier;
++ struct list_head notifier;
+ struct list_head rx_ops;
+ struct list_head tx_ops;
+ unsigned long dropped_usr_msgs;
+@@ -133,6 +133,10 @@ struct bcm_sock {
+ char procname [32]; /* inode number in decimal with \0 */
+ };
+
++static LIST_HEAD(bcm_notifier_list);
++static DEFINE_SPINLOCK(bcm_notifier_lock);
++static struct bcm_sock *bcm_busy_notifier;
++
+ static inline struct bcm_sock *bcm_sk(const struct sock *sk)
+ {
+ return (struct bcm_sock *)sk;
+@@ -393,6 +397,7 @@ static void bcm_tx_timeout_tsklet(unsigned long data)
+ if (!op->count && (op->flags & TX_COUNTEVT)) {
+
+ /* create notification to user */
++ memset(&msg_head, 0, sizeof(msg_head));
+ msg_head.opcode = TX_EXPIRED;
+ msg_head.flags = op->flags;
+ msg_head.count = op->count;
+@@ -440,6 +445,7 @@ static void bcm_rx_changed(struct bcm_op *op, struct canfd_frame *data)
+ /* this element is not throttled anymore */
+ data->flags &= (BCM_CAN_FLAGS_MASK|RX_RECV);
+
++ memset(&head, 0, sizeof(head));
+ head.opcode = RX_CHANGED;
+ head.flags = op->flags;
+ head.count = op->count;
+@@ -554,6 +560,7 @@ static void bcm_rx_timeout_tsklet(unsigned long data)
+ struct bcm_msg_head msg_head;
+
+ /* create notification to user */
++ memset(&msg_head, 0, sizeof(msg_head));
+ msg_head.opcode = RX_TIMEOUT;
+ msg_head.flags = op->flags;
+ msg_head.count = op->count;
+@@ -1429,20 +1436,15 @@ static int bcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ /*
+ * notification handler for netdevice status changes
+ */
+-static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
+- void *ptr)
++static void bcm_notify(struct bcm_sock *bo, unsigned long msg,
++ struct net_device *dev)
+ {
+- struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+- struct bcm_sock *bo = container_of(nb, struct bcm_sock, notifier);
+ struct sock *sk = &bo->sk;
+ struct bcm_op *op;
+ int notify_enodev = 0;
+
+ if (!net_eq(dev_net(dev), sock_net(sk)))
+- return NOTIFY_DONE;
+-
+- if (dev->type != ARPHRD_CAN)
+- return NOTIFY_DONE;
++ return;
+
+ switch (msg) {
+
+@@ -1477,7 +1479,28 @@ static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
+ sk->sk_error_report(sk);
+ }
+ }
++}
+
++static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
++ void *ptr)
++{
++ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++
++ if (dev->type != ARPHRD_CAN)
++ return NOTIFY_DONE;
++ if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN)
++ return NOTIFY_DONE;
++ if (unlikely(bcm_busy_notifier)) /* Check for reentrant bug. */
++ return NOTIFY_DONE;
++
++ spin_lock(&bcm_notifier_lock);
++ list_for_each_entry(bcm_busy_notifier, &bcm_notifier_list, notifier) {
++ spin_unlock(&bcm_notifier_lock);
++ bcm_notify(bcm_busy_notifier, msg, dev);
++ spin_lock(&bcm_notifier_lock);
++ }
++ bcm_busy_notifier = NULL;
++ spin_unlock(&bcm_notifier_lock);
+ return NOTIFY_DONE;
+ }
+
+@@ -1497,9 +1520,9 @@ static int bcm_init(struct sock *sk)
+ INIT_LIST_HEAD(&bo->rx_ops);
+
+ /* set notifier */
+- bo->notifier.notifier_call = bcm_notifier;
+-
+- register_netdevice_notifier(&bo->notifier);
++ spin_lock(&bcm_notifier_lock);
++ list_add_tail(&bo->notifier, &bcm_notifier_list);
++ spin_unlock(&bcm_notifier_lock);
+
+ return 0;
+ }
+@@ -1522,7 +1545,14 @@ static int bcm_release(struct socket *sock)
+
+ /* remove bcm_ops, timer, rx_unregister(), etc. */
+
+- unregister_netdevice_notifier(&bo->notifier);
++ spin_lock(&bcm_notifier_lock);
++ while (bcm_busy_notifier == bo) {
++ spin_unlock(&bcm_notifier_lock);
++ schedule_timeout_uninterruptible(1);
++ spin_lock(&bcm_notifier_lock);
++ }
++ list_del(&bo->notifier);
++ spin_unlock(&bcm_notifier_lock);
+
+ lock_sock(sk);
+
+@@ -1737,6 +1767,10 @@ static struct pernet_operations canbcm_pernet_ops __read_mostly = {
+ .exit = canbcm_pernet_exit,
+ };
+
++static struct notifier_block canbcm_notifier = {
++ .notifier_call = bcm_notifier
++};
++
+ static int __init bcm_module_init(void)
+ {
+ int err;
+@@ -1750,12 +1784,14 @@ static int __init bcm_module_init(void)
+ }
+
+ register_pernet_subsys(&canbcm_pernet_ops);
++ register_netdevice_notifier(&canbcm_notifier);
+ return 0;
+ }
+
+ static void __exit bcm_module_exit(void)
+ {
+ can_proto_unregister(&bcm_can_proto);
++ unregister_netdevice_notifier(&canbcm_notifier);
+ unregister_pernet_subsys(&canbcm_pernet_ops);
+ }
+
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 3aab7664933fd..296a11a922e09 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -84,7 +84,7 @@ struct raw_sock {
+ struct sock sk;
+ int bound;
+ int ifindex;
+- struct notifier_block notifier;
++ struct list_head notifier;
+ int loopback;
+ int recv_own_msgs;
+ int fd_frames;
+@@ -96,6 +96,10 @@ struct raw_sock {
+ struct uniqframe __percpu *uniq;
+ };
+
++static LIST_HEAD(raw_notifier_list);
++static DEFINE_SPINLOCK(raw_notifier_lock);
++static struct raw_sock *raw_busy_notifier;
++
+ /*
+ * Return pointer to store the extra msg flags for raw_recvmsg().
+ * We use the space of one unsigned int beyond the 'struct sockaddr_can'
+@@ -266,21 +270,16 @@ static int raw_enable_allfilters(struct net *net, struct net_device *dev,
+ return err;
+ }
+
+-static int raw_notifier(struct notifier_block *nb,
+- unsigned long msg, void *ptr)
++static void raw_notify(struct raw_sock *ro, unsigned long msg,
++ struct net_device *dev)
+ {
+- struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+- struct raw_sock *ro = container_of(nb, struct raw_sock, notifier);
+ struct sock *sk = &ro->sk;
+
+ if (!net_eq(dev_net(dev), sock_net(sk)))
+- return NOTIFY_DONE;
+-
+- if (dev->type != ARPHRD_CAN)
+- return NOTIFY_DONE;
++ return;
+
+ if (ro->ifindex != dev->ifindex)
+- return NOTIFY_DONE;
++ return;
+
+ switch (msg) {
+
+@@ -309,7 +308,28 @@ static int raw_notifier(struct notifier_block *nb,
+ sk->sk_error_report(sk);
+ break;
+ }
++}
++
++static int raw_notifier(struct notifier_block *nb, unsigned long msg,
++ void *ptr)
++{
++ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++
++ if (dev->type != ARPHRD_CAN)
++ return NOTIFY_DONE;
++ if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN)
++ return NOTIFY_DONE;
++ if (unlikely(raw_busy_notifier)) /* Check for reentrant bug. */
++ return NOTIFY_DONE;
+
++ spin_lock(&raw_notifier_lock);
++ list_for_each_entry(raw_busy_notifier, &raw_notifier_list, notifier) {
++ spin_unlock(&raw_notifier_lock);
++ raw_notify(raw_busy_notifier, msg, dev);
++ spin_lock(&raw_notifier_lock);
++ }
++ raw_busy_notifier = NULL;
++ spin_unlock(&raw_notifier_lock);
+ return NOTIFY_DONE;
+ }
+
+@@ -338,9 +358,9 @@ static int raw_init(struct sock *sk)
+ return -ENOMEM;
+
+ /* set notifier */
+- ro->notifier.notifier_call = raw_notifier;
+-
+- register_netdevice_notifier(&ro->notifier);
++ spin_lock(&raw_notifier_lock);
++ list_add_tail(&ro->notifier, &raw_notifier_list);
++ spin_unlock(&raw_notifier_lock);
+
+ return 0;
+ }
+@@ -355,7 +375,14 @@ static int raw_release(struct socket *sock)
+
+ ro = raw_sk(sk);
+
+- unregister_netdevice_notifier(&ro->notifier);
++ spin_lock(&raw_notifier_lock);
++ while (raw_busy_notifier == ro) {
++ spin_unlock(&raw_notifier_lock);
++ schedule_timeout_uninterruptible(1);
++ spin_lock(&raw_notifier_lock);
++ }
++ list_del(&ro->notifier);
++ spin_unlock(&raw_notifier_lock);
+
+ lock_sock(sk);
+
+@@ -870,6 +897,10 @@ static const struct can_proto raw_can_proto = {
+ .prot = &raw_proto,
+ };
+
++static struct notifier_block canraw_notifier = {
++ .notifier_call = raw_notifier
++};
++
+ static __init int raw_module_init(void)
+ {
+ int err;
+@@ -879,6 +910,8 @@ static __init int raw_module_init(void)
+ err = can_proto_register(&raw_can_proto);
+ if (err < 0)
+ printk(KERN_ERR "can: registration of raw protocol failed\n");
++ else
++ register_netdevice_notifier(&canraw_notifier);
+
+ return err;
+ }
+@@ -886,6 +919,7 @@ static __init int raw_module_init(void)
+ static __exit void raw_module_exit(void)
+ {
+ can_proto_unregister(&raw_can_proto);
++ unregister_netdevice_notifier(&canraw_notifier);
+ }
+
+ module_init(raw_module_init);
+diff --git a/net/compat.c b/net/compat.c
+index 2a8c7cb5f06a8..2778a236e0917 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -158,7 +158,7 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg, struct sock *sk,
+ if (kcmlen > stackbuf_size)
+ kcmsg_base = kcmsg = sock_kmalloc(sk, kcmlen, GFP_KERNEL);
+ if (kcmsg == NULL)
+- return -ENOBUFS;
++ return -ENOMEM;
+
+ /* Now copy them over neatly. */
+ memset(kcmsg, 0, kcmlen);
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 83028017c26dd..4db9512feba83 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -1594,7 +1594,7 @@ static int ethtool_get_any_eeprom(struct net_device *dev, void __user *useraddr,
+ if (eeprom.offset + eeprom.len > total_len)
+ return -EINVAL;
+
+- data = kmalloc(PAGE_SIZE, GFP_USER);
++ data = kzalloc(PAGE_SIZE, GFP_USER);
+ if (!data)
+ return -ENOMEM;
+
+@@ -1659,7 +1659,7 @@ static int ethtool_set_eeprom(struct net_device *dev, void __user *useraddr)
+ if (eeprom.offset + eeprom.len > ops->get_eeprom_len(dev))
+ return -EINVAL;
+
+- data = kmalloc(PAGE_SIZE, GFP_USER);
++ data = kzalloc(PAGE_SIZE, GFP_USER);
+ if (!data)
+ return -ENOMEM;
+
+@@ -1840,7 +1840,7 @@ static int ethtool_self_test(struct net_device *dev, char __user *useraddr)
+ return -EFAULT;
+
+ test.len = test_len;
+- data = kmalloc_array(test_len, sizeof(u64), GFP_USER);
++ data = kcalloc(test_len, sizeof(u64), GFP_USER);
+ if (!data)
+ return -ENOMEM;
+
+@@ -2372,7 +2372,7 @@ static int ethtool_get_tunable(struct net_device *dev, void __user *useraddr)
+ ret = ethtool_tunable_valid(&tuna);
+ if (ret)
+ return ret;
+- data = kmalloc(tuna.len, GFP_USER);
++ data = kzalloc(tuna.len, GFP_USER);
+ if (!data)
+ return -ENOMEM;
+ ret = ops->get_tunable(dev, &tuna, data);
+@@ -2552,7 +2552,7 @@ static int get_phy_tunable(struct net_device *dev, void __user *useraddr)
+ ret = ethtool_phy_tunable_valid(&tuna);
+ if (ret)
+ return ret;
+- data = kmalloc(tuna.len, GFP_USER);
++ data = kzalloc(tuna.len, GFP_USER);
+ if (!data)
+ return -ENOMEM;
+ mutex_lock(&phydev->lock);
+diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
+index 8916c5d9b3b3a..46a13ed15c4e8 100644
+--- a/net/core/fib_rules.c
++++ b/net/core/fib_rules.c
+@@ -1105,7 +1105,7 @@ static void notify_rule_change(int event, struct fib_rule *rule,
+ {
+ struct net *net;
+ struct sk_buff *skb;
+- int err = -ENOBUFS;
++ int err = -ENOMEM;
+
+ net = ops->fro_net;
+ skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL);
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index c60123dff8039..939d8a31eb82a 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -598,6 +598,18 @@ void __put_net(struct net *net)
+ }
+ EXPORT_SYMBOL_GPL(__put_net);
+
++/**
++ * get_net_ns - increment the refcount of the network namespace
++ * @ns: common namespace (net)
++ *
++ * Returns the net's common namespace.
++ */
++struct ns_common *get_net_ns(struct ns_common *ns)
++{
++ return &get_net(container_of(ns, struct net, ns))->ns;
++}
++EXPORT_SYMBOL_GPL(get_net_ns);
++
+ struct net *get_net_ns_by_fd(int fd)
+ {
+ struct file *file;
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 935053ee7765d..055fd09ac1114 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -4102,6 +4102,10 @@ static int rtnl_bridge_notify(struct net_device *dev)
+ if (err < 0)
+ goto errout;
+
++ /* Notification info is only filled for bridge ports, not the bridge
++ * device itself. Therefore, a zero notification length is valid and
++ * should not result in an error.
++ */
+ if (!skb->len)
+ goto errout;
+
+diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
+index b1c55db737648..6d4c71a52b6b2 100644
+--- a/net/ieee802154/nl802154.c
++++ b/net/ieee802154/nl802154.c
+@@ -1315,19 +1315,20 @@ ieee802154_llsec_parse_dev_addr(struct nlattr *nla,
+ nl802154_dev_addr_policy, NULL))
+ return -EINVAL;
+
+- if (!attrs[NL802154_DEV_ADDR_ATTR_PAN_ID] ||
+- !attrs[NL802154_DEV_ADDR_ATTR_MODE] ||
+- !(attrs[NL802154_DEV_ADDR_ATTR_SHORT] ||
+- attrs[NL802154_DEV_ADDR_ATTR_EXTENDED]))
++ if (!attrs[NL802154_DEV_ADDR_ATTR_PAN_ID] || !attrs[NL802154_DEV_ADDR_ATTR_MODE])
+ return -EINVAL;
+
+ addr->pan_id = nla_get_le16(attrs[NL802154_DEV_ADDR_ATTR_PAN_ID]);
+ addr->mode = nla_get_u32(attrs[NL802154_DEV_ADDR_ATTR_MODE]);
+ switch (addr->mode) {
+ case NL802154_DEV_ADDR_SHORT:
++ if (!attrs[NL802154_DEV_ADDR_ATTR_SHORT])
++ return -EINVAL;
+ addr->short_addr = nla_get_le16(attrs[NL802154_DEV_ADDR_ATTR_SHORT]);
+ break;
+ case NL802154_DEV_ADDR_EXTENDED:
++ if (!attrs[NL802154_DEV_ADDR_ATTR_EXTENDED])
++ return -EINVAL;
+ addr->extended_addr = nla_get_le64(attrs[NL802154_DEV_ADDR_ATTR_EXTENDED]);
+ break;
+ default:
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index 6a1b52b34e205..e8b8dd1cb1576 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -486,6 +486,7 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
+ kfree(doi_def->map.std->lvl.local);
+ kfree(doi_def->map.std->cat.cipso);
+ kfree(doi_def->map.std->cat.local);
++ kfree(doi_def->map.std);
+ break;
+ }
+ kfree(doi_def);
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index b048125ea0994..dde6cf82e9f0a 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -744,6 +744,13 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
+ icmp_param.data_len = room;
+ icmp_param.head_len = sizeof(struct icmphdr);
+
++ /* if we don't have a source address at this point, fall back to the
++ * dummy address instead of sending out a packet with a source address
++ * of 0.0.0.0
++ */
++ if (!fl4.saddr)
++ fl4.saddr = htonl(INADDR_DUMMY);
++
+ icmp_push_reply(&icmp_param, &fl4, &ipc, &rt);
+ ende:
+ ip_rt_put(rt);
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index 523d26f5e22e2..ffa847fc96194 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -1816,6 +1816,7 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
+ while ((i = rtnl_dereference(in_dev->mc_list)) != NULL) {
+ in_dev->mc_list = i->next_rcu;
+ in_dev->mc_count--;
++ ip_mc_clear_src(i);
+ ip_ma_put(i);
+ }
+ }
+diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
+index 88212615bf4ce..58719b9635d90 100644
+--- a/net/ipv4/ipconfig.c
++++ b/net/ipv4/ipconfig.c
+@@ -866,7 +866,7 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d
+
+
+ /*
+- * Copy BOOTP-supplied string if not already set.
++ * Copy BOOTP-supplied string
+ */
+ static int __init ic_bootp_string(char *dest, char *src, int len, int max)
+ {
+@@ -915,12 +915,15 @@ static void __init ic_do_bootp_ext(u8 *ext)
+ }
+ break;
+ case 12: /* Host name */
+- ic_bootp_string(utsname()->nodename, ext+1, *ext,
+- __NEW_UTS_LEN);
+- ic_host_name_set = 1;
++ if (!ic_host_name_set) {
++ ic_bootp_string(utsname()->nodename, ext+1, *ext,
++ __NEW_UTS_LEN);
++ ic_host_name_set = 1;
++ }
+ break;
+ case 15: /* Domain name (DNS) */
+- ic_bootp_string(ic_domain, ext+1, *ext, sizeof(ic_domain));
++ if (!ic_domain[0])
++ ic_bootp_string(ic_domain, ext+1, *ext, sizeof(ic_domain));
+ break;
+ case 17: /* Root path */
+ if (!root_server_path[0])
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index c59144502ee88..862744c285482 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -968,6 +968,7 @@ bool ping_rcv(struct sk_buff *skb)
+ struct sock *sk;
+ struct net *net = dev_net(skb->dev);
+ struct icmphdr *icmph = icmp_hdr(skb);
++ bool rc = false;
+
+ /* We assume the packet has already been checked by icmp_rcv */
+
+@@ -982,14 +983,15 @@ bool ping_rcv(struct sk_buff *skb)
+ struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
+
+ pr_debug("rcv on socket %p\n", sk);
+- if (skb2)
+- ping_queue_rcv_skb(sk, skb2);
++ if (skb2 && !ping_queue_rcv_skb(sk, skb2))
++ rc = true;
+ sock_put(sk);
+- return true;
+ }
+- pr_debug("no socket, dropping\n");
+
+- return false;
++ if (!rc)
++ pr_debug("no socket, dropping\n");
++
++ return rc;
+ }
+ EXPORT_SYMBOL_GPL(ping_rcv);
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 2fe50f6f876d4..484bd646df5fa 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -70,6 +70,7 @@
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/mm.h>
++#include <linux/bootmem.h>
+ #include <linux/string.h>
+ #include <linux/socket.h>
+ #include <linux/sockios.h>
+@@ -470,8 +471,10 @@ static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *daddr)
+ __ipv4_confirm_neigh(dev, *(__force u32 *)pkey);
+ }
+
+-#define IP_IDENTS_SZ 2048u
+-
++/* Hash tables of size 2048..262144 depending on RAM size.
++ * Each bucket uses 8 bytes.
++ */
++static u32 ip_idents_mask __read_mostly;
+ static atomic_t *ip_idents __read_mostly;
+ static u32 *ip_tstamps __read_mostly;
+
+@@ -481,12 +484,16 @@ static u32 *ip_tstamps __read_mostly;
+ */
+ u32 ip_idents_reserve(u32 hash, int segs)
+ {
+- u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ;
+- atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
+- u32 old = READ_ONCE(*p_tstamp);
+- u32 now = (u32)jiffies;
++ u32 bucket, old, now = (u32)jiffies;
++ atomic_t *p_id;
++ u32 *p_tstamp;
+ u32 delta = 0;
+
++ bucket = hash & ip_idents_mask;
++ p_tstamp = ip_tstamps + bucket;
++ p_id = ip_idents + bucket;
++ old = READ_ONCE(*p_tstamp);
++
+ if (old != now && cmpxchg(p_tstamp, old, now) == old)
+ delta = prandom_u32_max(now - old);
+
+@@ -3197,18 +3204,25 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
+
+ int __init ip_rt_init(void)
+ {
++ void *idents_hash;
+ int cpu;
+
+- ip_idents = kmalloc_array(IP_IDENTS_SZ, sizeof(*ip_idents),
+- GFP_KERNEL);
+- if (!ip_idents)
+- panic("IP: failed to allocate ip_idents\n");
++ /* For modern hosts, this will use 2 MB of memory */
++ idents_hash = alloc_large_system_hash("IP idents",
++ sizeof(*ip_idents) + sizeof(*ip_tstamps),
++ 0,
++ 16, /* one bucket per 64 KB */
++ HASH_ZERO,
++ NULL,
++ &ip_idents_mask,
++ 2048,
++ 256*1024);
++
++ ip_idents = idents_hash;
+
+- prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
++ prandom_bytes(ip_idents, (ip_idents_mask + 1) * sizeof(*ip_idents));
+
+- ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL);
+- if (!ip_tstamps)
+- panic("IP: failed to allocate ip_tstamps\n");
++ ip_tstamps = idents_hash + (ip_idents_mask + 1) * sizeof(*ip_idents);
+
+ for_each_possible_cpu(cpu) {
+ struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 110af0e7dc7b6..2ff9f774d4463 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2432,6 +2432,9 @@ void udp_destroy_sock(struct sock *sk)
+ {
+ struct udp_sock *up = udp_sk(sk);
+ bool slow = lock_sock_fast(sk);
++
++ /* protects from races with udp_abort() */
++ sock_set_flag(sk, SOCK_DEAD);
+ udp_flush_pending_frames(sk);
+ unlock_sock_fast(sk, slow);
+ if (static_branch_unlikely(&udp_encap_needed_key) && up->encap_type) {
+@@ -2673,10 +2676,17 @@ int udp_abort(struct sock *sk, int err)
+ {
+ lock_sock(sk);
+
++ /* udp{v6}_destroy_sock() sets it under the sk lock, avoid racing
++ * with close()
++ */
++ if (sock_flag(sk, SOCK_DEAD))
++ goto out;
++
+ sk->sk_err = err;
+ sk->sk_error_report(sk);
+ __udp_disconnect(sk, 0);
+
++out:
+ release_sock(sk);
+
+ return 0;
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 6799ad462be30..c4a76c6af205d 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1476,6 +1476,9 @@ void udpv6_destroy_sock(struct sock *sk)
+ {
+ struct udp_sock *up = udp_sk(sk);
+ lock_sock(sk);
++
++ /* protects from races with udp_abort() */
++ sock_set_flag(sk, SOCK_DEAD);
+ udp_v6_flush_pending_frames(sk);
+ release_sock(sk);
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 6c9d9c94983ba..dea48696f994d 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1398,7 +1398,7 @@ ieee80211_get_sband(struct ieee80211_sub_if_data *sdata)
+ rcu_read_lock();
+ chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+
+- if (WARN_ON_ONCE(!chanctx_conf)) {
++ if (!chanctx_conf) {
+ rcu_read_unlock();
+ return NULL;
+ }
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 2ba19decb1261..012697efafc35 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2124,17 +2124,15 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ sc = le16_to_cpu(hdr->seq_ctrl);
+ frag = sc & IEEE80211_SCTL_FRAG;
+
+- if (is_multicast_ether_addr(hdr->addr1)) {
+- I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount);
+- goto out_no_led;
+- }
+-
+ if (rx->sta)
+ cache = &rx->sta->frags;
+
+ if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
+ goto out;
+
++ if (is_multicast_ether_addr(hdr->addr1))
++ return RX_DROP_MONITOR;
++
+ I802_DEBUG_INC(rx->local->rx_handlers_fragments);
+
+ if (skb_linearize(rx->skb))
+@@ -2260,7 +2258,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+
+ out:
+ ieee80211_led_rx(rx->local);
+- out_no_led:
+ if (rx->sta)
+ rx->sta->rx_stats.packets++;
+ return RX_CONTINUE;
+diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
+index 353a2aa80c3cc..04b07b63c5408 100644
+--- a/net/netfilter/nf_synproxy_core.c
++++ b/net/netfilter/nf_synproxy_core.c
+@@ -34,6 +34,9 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
+ int length = (th->doff * 4) - sizeof(*th);
+ u8 buf[40], *ptr;
+
++ if (unlikely(length < 0))
++ return false;
++
+ ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
+ if (ptr == NULL)
+ return false;
+@@ -50,6 +53,8 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
+ length--;
+ continue;
+ default:
++ if (length < 2)
++ return true;
+ opsize = *ptr++;
+ if (opsize < 2)
+ return true;
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 16b745d254fea..8d9005019ef78 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2656,7 +2656,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ }
+ if (likely(saddr == NULL)) {
+ dev = packet_cached_dev_get(po);
+- proto = po->num;
++ proto = READ_ONCE(po->num);
+ } else {
+ err = -EINVAL;
+ if (msg->msg_namelen < sizeof(struct sockaddr_ll))
+@@ -2869,7 +2869,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+
+ if (likely(saddr == NULL)) {
+ dev = packet_cached_dev_get(po);
+- proto = po->num;
++ proto = READ_ONCE(po->num);
+ } else {
+ err = -EINVAL;
+ if (msg->msg_namelen < sizeof(struct sockaddr_ll))
+@@ -3141,7 +3141,7 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
+ /* prevents packet_notifier() from calling
+ * register_prot_hook()
+ */
+- po->num = 0;
++ WRITE_ONCE(po->num, 0);
+ __unregister_prot_hook(sk, true);
+ rcu_read_lock();
+ dev_curr = po->prot_hook.dev;
+@@ -3151,17 +3151,17 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
+ }
+
+ BUG_ON(po->running);
+- po->num = proto;
++ WRITE_ONCE(po->num, proto);
+ po->prot_hook.type = proto;
+
+ if (unlikely(unlisted)) {
+ dev_put(dev);
+ po->prot_hook.dev = NULL;
+- po->ifindex = -1;
++ WRITE_ONCE(po->ifindex, -1);
+ packet_cached_dev_reset(po);
+ } else {
+ po->prot_hook.dev = dev;
+- po->ifindex = dev ? dev->ifindex : 0;
++ WRITE_ONCE(po->ifindex, dev ? dev->ifindex : 0);
+ packet_cached_dev_assign(po, dev);
+ }
+ }
+@@ -3476,7 +3476,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
+ uaddr->sa_family = AF_PACKET;
+ memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data));
+ rcu_read_lock();
+- dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex);
++ dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex));
+ if (dev)
+ strlcpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
+ rcu_read_unlock();
+@@ -3491,16 +3491,18 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
+ struct sock *sk = sock->sk;
+ struct packet_sock *po = pkt_sk(sk);
+ DECLARE_SOCKADDR(struct sockaddr_ll *, sll, uaddr);
++ int ifindex;
+
+ if (peer)
+ return -EOPNOTSUPP;
+
++ ifindex = READ_ONCE(po->ifindex);
+ sll->sll_family = AF_PACKET;
+- sll->sll_ifindex = po->ifindex;
+- sll->sll_protocol = po->num;
++ sll->sll_ifindex = ifindex;
++ sll->sll_protocol = READ_ONCE(po->num);
+ sll->sll_pkttype = 0;
+ rcu_read_lock();
+- dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex);
++ dev = dev_get_by_index_rcu(sock_net(sk), ifindex);
+ if (dev) {
+ sll->sll_hatype = dev->type;
+ sll->sll_halen = dev->addr_len;
+@@ -4079,7 +4081,7 @@ static int packet_notifier(struct notifier_block *this,
+ }
+ if (msg == NETDEV_UNREGISTER) {
+ packet_cached_dev_reset(po);
+- po->ifindex = -1;
++ WRITE_ONCE(po->ifindex, -1);
+ if (po->prot_hook.dev)
+ dev_put(po->prot_hook.dev);
+ po->prot_hook.dev = NULL;
+@@ -4391,7 +4393,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ was_running = po->running;
+ num = po->num;
+ if (was_running) {
+- po->num = 0;
++ WRITE_ONCE(po->num, 0);
+ __unregister_prot_hook(sk, false);
+ }
+ spin_unlock(&po->bind_lock);
+@@ -4426,7 +4428,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+
+ spin_lock(&po->bind_lock);
+ if (was_running) {
+- po->num = num;
++ WRITE_ONCE(po->num, num);
+ register_prot_hook(sk);
+ }
+ spin_unlock(&po->bind_lock);
+@@ -4597,8 +4599,8 @@ static int packet_seq_show(struct seq_file *seq, void *v)
+ s,
+ refcount_read(&s->sk_refcnt),
+ s->sk_type,
+- ntohs(po->num),
+- po->ifindex,
++ ntohs(READ_ONCE(po->num)),
++ READ_ONCE(po->ifindex),
+ po->running,
+ atomic_read(&s->sk_rmem_alloc),
+ from_kuid_munged(seq_user_ns(seq), sock_i_uid(s)),
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 43f63d0606ec1..1e2772913957d 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -264,7 +264,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
+ const struct qrtr_hdr_v2 *v2;
+ struct sk_buff *skb;
+ struct qrtr_cb *cb;
+- unsigned int size;
++ size_t size;
+ unsigned int ver;
+ size_t hdrlen;
+
+diff --git a/net/rds/recv.c b/net/rds/recv.c
+index 3ca278988b529..ccf0bf283002c 100644
+--- a/net/rds/recv.c
++++ b/net/rds/recv.c
+@@ -705,7 +705,7 @@ int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+
+ if (rds_cmsg_recv(inc, msg, rs)) {
+ ret = -EFAULT;
+- goto out;
++ break;
+ }
+ rds_recvmsg_zcookie(rs, msg);
+
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index 32712e7dcbdc2..2025f0f559deb 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -900,7 +900,7 @@ static struct tcphdr *cake_get_tcphdr(const struct sk_buff *skb,
+ }
+
+ tcph = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
+- if (!tcph)
++ if (!tcph || tcph->doff < 5)
+ return NULL;
+
+ return skb_header_pointer(skb, offset,
+@@ -924,6 +924,8 @@ static const void *cake_get_tcpopt(const struct tcphdr *tcph,
+ length--;
+ continue;
+ }
++ if (length < 2)
++ break;
+ opsize = *ptr++;
+ if (opsize < 2 || opsize > length)
+ break;
+@@ -1061,6 +1063,8 @@ static bool cake_tcph_may_drop(const struct tcphdr *tcph,
+ length--;
+ continue;
+ }
++ if (length < 2)
++ break;
+ opsize = *ptr++;
+ if (opsize < 2 || opsize > length)
+ break;
+diff --git a/net/socket.c b/net/socket.c
+index 29169045dcfe5..f14bca00ff010 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -384,6 +384,18 @@ static struct file_system_type sock_fs_type = {
+ * but we take care of internal coherence yet.
+ */
+
++/**
++ * sock_alloc_file - Bind a &socket to a &file
++ * @sock: socket
++ * @flags: file status flags
++ * @dname: protocol name
++ *
++ * Returns the &file bound with @sock, implicitly storing it
++ * in sock->file. If dname is %NULL, sets to "".
++ * On failure the return is a ERR pointer (see linux/err.h).
++ * This function uses GFP_KERNEL internally.
++ */
++
+ struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
+ {
+ struct file *file;
+@@ -424,6 +436,14 @@ static int sock_map_fd(struct socket *sock, int flags)
+ return PTR_ERR(newfile);
+ }
+
++/**
++ * sock_from_file - Return the &socket bounded to @file.
++ * @file: file
++ * @err: pointer to an error code return
++ *
++ * On failure returns %NULL and assigns -ENOTSOCK to @err.
++ */
++
+ struct socket *sock_from_file(struct file *file, int *err)
+ {
+ if (file->f_op == &socket_file_ops)
+@@ -532,11 +552,11 @@ static const struct inode_operations sockfs_inode_ops = {
+ };
+
+ /**
+- * sock_alloc - allocate a socket
++ * sock_alloc - allocate a socket
+ *
+ * Allocate a new inode and socket object. The two are bound together
+ * and initialised. The socket is then returned. If we are out of inodes
+- * NULL is returned.
++ * NULL is returned. This functions uses GFP_KERNEL internally.
+ */
+
+ struct socket *sock_alloc(void)
+@@ -561,7 +581,7 @@ struct socket *sock_alloc(void)
+ EXPORT_SYMBOL(sock_alloc);
+
+ /**
+- * sock_release - close a socket
++ * sock_release - close a socket
+ * @sock: socket to close
+ *
+ * The socket is released from the protocol stack if it has a release
+@@ -617,6 +637,15 @@ void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags)
+ }
+ EXPORT_SYMBOL(__sock_tx_timestamp);
+
++/**
++ * sock_sendmsg - send a message through @sock
++ * @sock: socket
++ * @msg: message to send
++ *
++ * Sends @msg through @sock, passing through LSM.
++ * Returns the number of bytes sent, or an error code.
++ */
++
+ static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
+ {
+ int ret = sock->ops->sendmsg(sock, msg, msg_data_left(msg));
+@@ -633,6 +662,18 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg)
+ }
+ EXPORT_SYMBOL(sock_sendmsg);
+
++/**
++ * kernel_sendmsg - send a message through @sock (kernel-space)
++ * @sock: socket
++ * @msg: message header
++ * @vec: kernel vec
++ * @num: vec array length
++ * @size: total message data size
++ *
++ * Builds the message data with @vec and sends it through @sock.
++ * Returns the number of bytes sent, or an error code.
++ */
++
+ int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
+ struct kvec *vec, size_t num, size_t size)
+ {
+@@ -641,6 +682,19 @@ int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
+ }
+ EXPORT_SYMBOL(kernel_sendmsg);
+
++/**
++ * kernel_sendmsg_locked - send a message through @sock (kernel-space)
++ * @sk: sock
++ * @msg: message header
++ * @vec: output s/g array
++ * @num: output s/g array length
++ * @size: total message data size
++ *
++ * Builds the message data with @vec and sends it through @sock.
++ * Returns the number of bytes sent, or an error code.
++ * Caller must hold @sk.
++ */
++
+ int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg,
+ struct kvec *vec, size_t num, size_t size)
+ {
+@@ -789,6 +843,16 @@ void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+ }
+ EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
+
++/**
++ * sock_recvmsg - receive a message from @sock
++ * @sock: socket
++ * @msg: message to receive
++ * @flags: message flags
++ *
++ * Receives @msg from @sock, passing through LSM. Returns the total number
++ * of bytes received, or an error.
++ */
++
+ static inline int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
+ int flags)
+ {
+@@ -804,20 +868,21 @@ int sock_recvmsg(struct socket *sock, struct msghdr *msg, int flags)
+ EXPORT_SYMBOL(sock_recvmsg);
+
+ /**
+- * kernel_recvmsg - Receive a message from a socket (kernel space)
+- * @sock: The socket to receive the message from
+- * @msg: Received message
+- * @vec: Input s/g array for message data
+- * @num: Size of input s/g array
+- * @size: Number of bytes to read
+- * @flags: Message flags (MSG_DONTWAIT, etc...)
++ * kernel_recvmsg - Receive a message from a socket (kernel space)
++ * @sock: The socket to receive the message from
++ * @msg: Received message
++ * @vec: Input s/g array for message data
++ * @num: Size of input s/g array
++ * @size: Number of bytes to read
++ * @flags: Message flags (MSG_DONTWAIT, etc...)
+ *
+- * On return the msg structure contains the scatter/gather array passed in the
+- * vec argument. The array is modified so that it consists of the unfilled
+- * portion of the original array.
++ * On return the msg structure contains the scatter/gather array passed in the
++ * vec argument. The array is modified so that it consists of the unfilled
++ * portion of the original array.
+ *
+- * The returned value is the total number of bytes received, or an error.
++ * The returned value is the total number of bytes received, or an error.
+ */
++
+ int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
+ struct kvec *vec, size_t num, size_t size, int flags)
+ {
+@@ -983,12 +1048,6 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,
+ * what to do with it - that's up to the protocol still.
+ */
+
+-struct ns_common *get_net_ns(struct ns_common *ns)
+-{
+- return &get_net(container_of(ns, struct net, ns))->ns;
+-}
+-EXPORT_SYMBOL_GPL(get_net_ns);
+-
+ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+ {
+ struct socket *sock;
+@@ -1077,6 +1136,19 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+ return err;
+ }
+
++/**
++ * sock_create_lite - creates a socket
++ * @family: protocol family (AF_INET, ...)
++ * @type: communication type (SOCK_STREAM, ...)
++ * @protocol: protocol (0, ...)
++ * @res: new socket
++ *
++ * Creates a new socket and assigns it to @res, passing through LSM.
++ * The new socket initialization is not complete, see kernel_accept().
++ * Returns 0 or an error. On failure @res is set to %NULL.
++ * This function internally uses GFP_KERNEL.
++ */
++
+ int sock_create_lite(int family, int type, int protocol, struct socket **res)
+ {
+ int err;
+@@ -1202,6 +1274,21 @@ call_kill:
+ }
+ EXPORT_SYMBOL(sock_wake_async);
+
++/**
++ * __sock_create - creates a socket
++ * @net: net namespace
++ * @family: protocol family (AF_INET, ...)
++ * @type: communication type (SOCK_STREAM, ...)
++ * @protocol: protocol (0, ...)
++ * @res: new socket
++ * @kern: boolean for kernel space sockets
++ *
++ * Creates a new socket and assigns it to @res, passing through LSM.
++ * Returns 0 or an error. On failure @res is set to %NULL. @kern must
++ * be set to true if the socket resides in kernel space.
++ * This function internally uses GFP_KERNEL.
++ */
++
+ int __sock_create(struct net *net, int family, int type, int protocol,
+ struct socket **res, int kern)
+ {
+@@ -1311,12 +1398,35 @@ out_release:
+ }
+ EXPORT_SYMBOL(__sock_create);
+
++/**
++ * sock_create - creates a socket
++ * @family: protocol family (AF_INET, ...)
++ * @type: communication type (SOCK_STREAM, ...)
++ * @protocol: protocol (0, ...)
++ * @res: new socket
++ *
++ * A wrapper around __sock_create().
++ * Returns 0 or an error. This function internally uses GFP_KERNEL.
++ */
++
+ int sock_create(int family, int type, int protocol, struct socket **res)
+ {
+ return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
+ }
+ EXPORT_SYMBOL(sock_create);
+
++/**
++ * sock_create_kern - creates a socket (kernel space)
++ * @net: net namespace
++ * @family: protocol family (AF_INET, ...)
++ * @type: communication type (SOCK_STREAM, ...)
++ * @protocol: protocol (0, ...)
++ * @res: new socket
++ *
++ * A wrapper around __sock_create().
++ * Returns 0 or an error. This function internally uses GFP_KERNEL.
++ */
++
+ int sock_create_kern(struct net *net, int family, int type, int protocol, struct socket **res)
+ {
+ return __sock_create(net, family, type, protocol, res, 1);
+@@ -3273,18 +3383,46 @@ static long compat_sock_ioctl(struct file *file, unsigned int cmd,
+ }
+ #endif
+
++/**
++ * kernel_bind - bind an address to a socket (kernel space)
++ * @sock: socket
++ * @addr: address
++ * @addrlen: length of address
++ *
++ * Returns 0 or an error.
++ */
++
+ int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
+ {
+ return sock->ops->bind(sock, addr, addrlen);
+ }
+ EXPORT_SYMBOL(kernel_bind);
+
++/**
++ * kernel_listen - move socket to listening state (kernel space)
++ * @sock: socket
++ * @backlog: pending connections queue size
++ *
++ * Returns 0 or an error.
++ */
++
+ int kernel_listen(struct socket *sock, int backlog)
+ {
+ return sock->ops->listen(sock, backlog);
+ }
+ EXPORT_SYMBOL(kernel_listen);
+
++/**
++ * kernel_accept - accept a connection (kernel space)
++ * @sock: listening socket
++ * @newsock: new connected socket
++ * @flags: flags
++ *
++ * @flags must be SOCK_CLOEXEC, SOCK_NONBLOCK or 0.
++ * If it fails, @newsock is guaranteed to be %NULL.
++ * Returns 0 or an error.
++ */
++
+ int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
+ {
+ struct sock *sk = sock->sk;
+@@ -3310,6 +3448,19 @@ done:
+ }
+ EXPORT_SYMBOL(kernel_accept);
+
++/**
++ * kernel_connect - connect a socket (kernel space)
++ * @sock: socket
++ * @addr: address
++ * @addrlen: address length
++ * @flags: flags (O_NONBLOCK, ...)
++ *
++ * For datagram sockets, @addr is the addres to which datagrams are sent
++ * by default, and the only address from which datagrams are received.
++ * For stream sockets, attempts to connect to @addr.
++ * Returns 0 or an error code.
++ */
++
+ int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
+ int flags)
+ {
+@@ -3317,18 +3468,48 @@ int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
+ }
+ EXPORT_SYMBOL(kernel_connect);
+
++/**
++ * kernel_getsockname - get the address which the socket is bound (kernel space)
++ * @sock: socket
++ * @addr: address holder
++ *
++ * Fills the @addr pointer with the address which the socket is bound.
++ * Returns 0 or an error code.
++ */
++
+ int kernel_getsockname(struct socket *sock, struct sockaddr *addr)
+ {
+ return sock->ops->getname(sock, addr, 0);
+ }
+ EXPORT_SYMBOL(kernel_getsockname);
+
++/**
++ * kernel_peername - get the address which the socket is connected (kernel space)
++ * @sock: socket
++ * @addr: address holder
++ *
++ * Fills the @addr pointer with the address which the socket is connected.
++ * Returns 0 or an error code.
++ */
++
+ int kernel_getpeername(struct socket *sock, struct sockaddr *addr)
+ {
+ return sock->ops->getname(sock, addr, 1);
+ }
+ EXPORT_SYMBOL(kernel_getpeername);
+
++/**
++ * kernel_getsockopt - get a socket option (kernel space)
++ * @sock: socket
++ * @level: API level (SOL_SOCKET, ...)
++ * @optname: option tag
++ * @optval: option value
++ * @optlen: option length
++ *
++ * Assigns the option length to @optlen.
++ * Returns 0 or an error.
++ */
++
+ int kernel_getsockopt(struct socket *sock, int level, int optname,
+ char *optval, int *optlen)
+ {
+@@ -3351,6 +3532,17 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
+ }
+ EXPORT_SYMBOL(kernel_getsockopt);
+
++/**
++ * kernel_setsockopt - set a socket option (kernel space)
++ * @sock: socket
++ * @level: API level (SOL_SOCKET, ...)
++ * @optname: option tag
++ * @optval: option value
++ * @optlen: option length
++ *
++ * Returns 0 or an error.
++ */
++
+ int kernel_setsockopt(struct socket *sock, int level, int optname,
+ char *optval, unsigned int optlen)
+ {
+@@ -3371,6 +3563,17 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
+ }
+ EXPORT_SYMBOL(kernel_setsockopt);
+
++/**
++ * kernel_sendpage - send a &page through a socket (kernel space)
++ * @sock: socket
++ * @page: page
++ * @offset: page offset
++ * @size: total size in bytes
++ * @flags: flags (MSG_DONTWAIT, ...)
++ *
++ * Returns the total amount sent in bytes or an error.
++ */
++
+ int kernel_sendpage(struct socket *sock, struct page *page, int offset,
+ size_t size, int flags)
+ {
+@@ -3381,6 +3584,18 @@ int kernel_sendpage(struct socket *sock, struct page *page, int offset,
+ }
+ EXPORT_SYMBOL(kernel_sendpage);
+
++/**
++ * kernel_sendpage_locked - send a &page through the locked sock (kernel space)
++ * @sk: sock
++ * @page: page
++ * @offset: page offset
++ * @size: total size in bytes
++ * @flags: flags (MSG_DONTWAIT, ...)
++ *
++ * Returns the total amount sent in bytes or an error.
++ * Caller must hold @sk.
++ */
++
+ int kernel_sendpage_locked(struct sock *sk, struct page *page, int offset,
+ size_t size, int flags)
+ {
+@@ -3394,17 +3609,30 @@ int kernel_sendpage_locked(struct sock *sk, struct page *page, int offset,
+ }
+ EXPORT_SYMBOL(kernel_sendpage_locked);
+
++/**
++ * kernel_shutdown - shut down part of a full-duplex connection (kernel space)
++ * @sock: socket
++ * @how: connection part
++ *
++ * Returns 0 or an error.
++ */
++
+ int kernel_sock_shutdown(struct socket *sock, enum sock_shutdown_cmd how)
+ {
+ return sock->ops->shutdown(sock, how);
+ }
+ EXPORT_SYMBOL(kernel_sock_shutdown);
+
+-/* This routine returns the IP overhead imposed by a socket i.e.
+- * the length of the underlying IP header, depending on whether
+- * this is an IPv4 or IPv6 socket and the length from IP options turned
+- * on at the socket. Assumes that the caller has a lock on the socket.
++/**
++ * kernel_sock_ip_overhead - returns the IP overhead imposed by a socket
++ * @sk: socket
++ *
++ * This routine returns the IP overhead imposed by a socket i.e.
++ * the length of the underlying IP header, depending on whether
++ * this is an IPv4 or IPv6 socket and the length from IP options turned
++ * on at the socket. Assumes that the caller has a lock on the socket.
+ */
++
+ u32 kernel_sock_ip_overhead(struct sock *sk)
+ {
+ struct inet_sock *inet;
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 2020306468af4..53fe5ada5a83a 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -540,12 +540,14 @@ static void unix_release_sock(struct sock *sk, int embrion)
+ u->path.mnt = NULL;
+ state = sk->sk_state;
+ sk->sk_state = TCP_CLOSE;
++
++ skpair = unix_peer(sk);
++ unix_peer(sk) = NULL;
++
+ unix_state_unlock(sk);
+
+ wake_up_interruptible_all(&u->peer_wait);
+
+- skpair = unix_peer(sk);
+-
+ if (skpair != NULL) {
+ if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {
+ unix_state_lock(skpair);
+@@ -560,7 +562,6 @@ static void unix_release_sock(struct sock *sk, int embrion)
+
+ unix_dgram_peer_wake_disconnect(sk, skpair);
+ sock_put(skpair); /* It may now die */
+- unix_peer(sk) = NULL;
+ }
+
+ /* Try to flush out this socket. Throw out buffers at least */
+diff --git a/net/wireless/Makefile b/net/wireless/Makefile
+index 8158b375d1700..4500ad5f2a616 100644
+--- a/net/wireless/Makefile
++++ b/net/wireless/Makefile
+@@ -27,7 +27,7 @@ $(obj)/shipped-certs.c: $(wildcard $(srctree)/$(src)/certs/*.hex)
+ @$(kecho) " GEN $@"
+ @(echo '#include "reg.h"'; \
+ echo 'const u8 shipped_regdb_certs[] = {'; \
+- cat $^ ; \
++ echo | cat - $^ ; \
+ echo '};'; \
+ echo 'unsigned int shipped_regdb_certs_len = sizeof(shipped_regdb_certs);'; \
+ ) > $@
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index c4536468dfbea..e7be500b64525 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -965,6 +965,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
+ case NL80211_IFTYPE_MESH_POINT:
+ /* mesh should be handled? */
+ break;
++ case NL80211_IFTYPE_OCB:
++ cfg80211_leave_ocb(rdev, dev);
++ break;
+ default:
+ break;
+ }
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index f43d037ea8520..f870027928363 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -551,7 +551,7 @@ static int x25_create(struct net *net, struct socket *sock, int protocol,
+ if (protocol)
+ goto out;
+
+- rc = -ENOBUFS;
++ rc = -ENOMEM;
+ if ((sk = x25_alloc_socket(net, kern)) == NULL)
+ goto out;
+
+diff --git a/sound/soc/codecs/rt5659.c b/sound/soc/codecs/rt5659.c
+index b331b3ba61a9b..ab73f84b59709 100644
+--- a/sound/soc/codecs/rt5659.c
++++ b/sound/soc/codecs/rt5659.c
+@@ -2473,13 +2473,18 @@ static int set_dmic_power(struct snd_soc_dapm_widget *w,
+ return 0;
+ }
+
+-static const struct snd_soc_dapm_widget rt5659_dapm_widgets[] = {
++static const struct snd_soc_dapm_widget rt5659_particular_dapm_widgets[] = {
+ SND_SOC_DAPM_SUPPLY("LDO2", RT5659_PWR_ANLG_3, RT5659_PWR_LDO2_BIT, 0,
+ NULL, 0),
+- SND_SOC_DAPM_SUPPLY("PLL", RT5659_PWR_ANLG_3, RT5659_PWR_PLL_BIT, 0,
+- NULL, 0),
++ SND_SOC_DAPM_SUPPLY("MICBIAS1", RT5659_PWR_ANLG_2, RT5659_PWR_MB1_BIT,
++ 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("Mic Det Power", RT5659_PWR_VOL,
+ RT5659_PWR_MIC_DET_BIT, 0, NULL, 0),
++};
++
++static const struct snd_soc_dapm_widget rt5659_dapm_widgets[] = {
++ SND_SOC_DAPM_SUPPLY("PLL", RT5659_PWR_ANLG_3, RT5659_PWR_PLL_BIT, 0,
++ NULL, 0),
+ SND_SOC_DAPM_SUPPLY("Mono Vref", RT5659_PWR_ANLG_1,
+ RT5659_PWR_VREF3_BIT, 0, NULL, 0),
+
+@@ -2504,8 +2509,6 @@ static const struct snd_soc_dapm_widget rt5659_dapm_widgets[] = {
+ RT5659_ADC_MONO_R_ASRC_SFT, 0, NULL, 0),
+
+ /* Input Side */
+- SND_SOC_DAPM_SUPPLY("MICBIAS1", RT5659_PWR_ANLG_2, RT5659_PWR_MB1_BIT,
+- 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("MICBIAS2", RT5659_PWR_ANLG_2, RT5659_PWR_MB2_BIT,
+ 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("MICBIAS3", RT5659_PWR_ANLG_2, RT5659_PWR_MB3_BIT,
+@@ -3700,10 +3703,23 @@ static int rt5659_set_bias_level(struct snd_soc_component *component,
+
+ static int rt5659_probe(struct snd_soc_component *component)
+ {
++ struct snd_soc_dapm_context *dapm =
++ snd_soc_component_get_dapm(component);
+ struct rt5659_priv *rt5659 = snd_soc_component_get_drvdata(component);
+
+ rt5659->component = component;
+
++ switch (rt5659->pdata.jd_src) {
++ case RT5659_JD_HDA_HEADER:
++ break;
++
++ default:
++ snd_soc_dapm_new_controls(dapm,
++ rt5659_particular_dapm_widgets,
++ ARRAY_SIZE(rt5659_particular_dapm_widgets));
++ break;
++ }
++
+ return 0;
+ }
+
+diff --git a/tools/include/uapi/linux/in.h b/tools/include/uapi/linux/in.h
+index 48e8a225b985a..2a66ab49f14dd 100644
+--- a/tools/include/uapi/linux/in.h
++++ b/tools/include/uapi/linux/in.h
+@@ -280,6 +280,9 @@ struct sockaddr_in {
+ /* Address indicating an error return. */
+ #define INADDR_NONE ((unsigned long int) 0xffffffff)
+
++/* Dummy address for src of ICMP replies if no real address is set (RFC7600). */
++#define INADDR_DUMMY ((unsigned long int) 0xc0000008)
++
+ /* Network number for local host loopback. */
+ #define IN_LOOPBACKNET 127
+
+diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
+index fb5d2d1e0c048..b138fd5e4620a 100644
+--- a/tools/testing/selftests/kvm/lib/kvm_util.c
++++ b/tools/testing/selftests/kvm/lib/kvm_util.c
+@@ -55,7 +55,7 @@ int kvm_check_cap(long cap)
+ exit(KSFT_SKIP);
+
+ ret = ioctl(kvm_fd, KVM_CHECK_EXTENSION, cap);
+- TEST_ASSERT(ret != -1, "KVM_CHECK_EXTENSION IOCTL failed,\n"
++ TEST_ASSERT(ret >= 0, "KVM_CHECK_EXTENSION IOCTL failed,\n"
+ " rc: %i errno: %i", ret, errno);
+
+ close(kvm_fd);
+diff --git a/virt/kvm/arm/vgic/vgic-kvm-device.c b/virt/kvm/arm/vgic/vgic-kvm-device.c
+index 6ada2432e37c7..71d92096776e9 100644
+--- a/virt/kvm/arm/vgic/vgic-kvm-device.c
++++ b/virt/kvm/arm/vgic/vgic-kvm-device.c
+@@ -95,8 +95,8 @@ int kvm_vgic_addr(struct kvm *kvm, unsigned long type, u64 *addr, bool write)
+ r = vgic_v3_set_redist_base(kvm, 0, *addr, 0);
+ goto out;
+ }
+- rdreg = list_first_entry(&vgic->rd_regions,
+- struct vgic_redist_region, list);
++ rdreg = list_first_entry_or_null(&vgic->rd_regions,
++ struct vgic_redist_region, list);
+ if (!rdreg)
+ addr_ptr = &undef_value;
+ else
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-07-11 14:45 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-07-11 14:45 UTC (permalink / raw
To: gentoo-commits
commit: 5d6d793f8ed82a72cedf644601ba72883f9ab36f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Jul 11 14:45:27 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Jul 11 14:45:27 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5d6d793f
Linux patch 4.19.197
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1196_linux-4.19.197.patch | 1701 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1705 insertions(+)
diff --git a/0000_README b/0000_README
index 2009bef..dd8ede9 100644
--- a/0000_README
+++ b/0000_README
@@ -823,6 +823,10 @@ Patch: 1195_linux-4.19.196.patch
From: https://www.kernel.org
Desc: Linux 4.19.196
+Patch: 1196_linux-4.19.197.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.197
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1196_linux-4.19.197.patch b/1196_linux-4.19.197.patch
new file mode 100644
index 0000000..e8a9416
--- /dev/null
+++ b/1196_linux-4.19.197.patch
@@ -0,0 +1,1701 @@
+diff --git a/Makefile b/Makefile
+index 63b0bc92a0fa6..42073a4c6e2e3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 196
++SUBLEVEL = 197
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 0c0781a37c5a7..7f1fe4a724472 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -48,6 +48,7 @@
+
+ timer {
+ compatible = "arm,armv7-timer";
++ status = "disabled"; /* See ARM architected timer wrap erratum i940 */
+ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
+ <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
+ <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
+@@ -910,6 +911,8 @@
+ reg = <0x48032000 0x80>;
+ interrupts = <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>;
+ ti,hwmods = "timer2";
++ clock-names = "fck";
++ clocks = <&l4per_clkctrl DRA7_TIMER2_CLKCTRL 24>;
+ };
+
+ timer3: timer@48034000 {
+@@ -917,6 +920,10 @@
+ reg = <0x48034000 0x80>;
+ interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
+ ti,hwmods = "timer3";
++ clock-names = "fck";
++ clocks = <&l4per_clkctrl DRA7_TIMER3_CLKCTRL 24>;
++ assigned-clocks = <&l4per_clkctrl DRA7_TIMER3_CLKCTRL 24>;
++ assigned-clock-parents = <&timer_sys_clk_div>;
+ };
+
+ timer4: timer@48036000 {
+@@ -924,6 +931,10 @@
+ reg = <0x48036000 0x80>;
+ interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+ ti,hwmods = "timer4";
++ clock-names = "fck";
++ clocks = <&l4per_clkctrl DRA7_TIMER4_CLKCTRL 24>;
++ assigned-clocks = <&l4per_clkctrl DRA7_TIMER4_CLKCTRL 24>;
++ assigned-clock-parents = <&timer_sys_clk_div>;
+ };
+
+ timer5: timer@48820000 {
+diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+index 41384bbd2f60c..03357d39870ee 100644
+--- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+@@ -675,10 +675,6 @@
+ vin-supply = <&vgen5_reg>;
+ };
+
+-®_vdd3p0 {
+- vin-supply = <&sw2_reg>;
+-};
+-
+ ®_vdd2p5 {
+ vin-supply = <&vgen5_reg>;
+ };
+diff --git a/arch/arm/mach-omap1/pm.c b/arch/arm/mach-omap1/pm.c
+index 3e1de14805e48..65b91a8379c90 100644
+--- a/arch/arm/mach-omap1/pm.c
++++ b/arch/arm/mach-omap1/pm.c
+@@ -610,11 +610,6 @@ static irqreturn_t omap_wakeup_interrupt(int irq, void *dev)
+ return IRQ_HANDLED;
+ }
+
+-static struct irqaction omap_wakeup_irq = {
+- .name = "peripheral wakeup",
+- .handler = omap_wakeup_interrupt
+-};
+-
+
+
+ static const struct platform_suspend_ops omap_pm_ops = {
+@@ -627,6 +622,7 @@ static const struct platform_suspend_ops omap_pm_ops = {
+ static int __init omap_pm_init(void)
+ {
+ int error = 0;
++ int irq;
+
+ if (!cpu_class_is_omap1())
+ return -ENODEV;
+@@ -670,9 +666,12 @@ static int __init omap_pm_init(void)
+ arm_pm_idle = omap1_pm_idle;
+
+ if (cpu_is_omap7xx())
+- setup_irq(INT_7XX_WAKE_UP_REQ, &omap_wakeup_irq);
++ irq = INT_7XX_WAKE_UP_REQ;
+ else if (cpu_is_omap16xx())
+- setup_irq(INT_1610_WAKE_UP_REQ, &omap_wakeup_irq);
++ irq = INT_1610_WAKE_UP_REQ;
++ if (request_irq(irq, omap_wakeup_interrupt, 0, "peripheral wakeup",
++ NULL))
++ pr_err("Failed to request irq %d (peripheral wakeup)\n", irq);
+
+ /* Program new power ramp-up time
+ * (0 for most boards since we don't lower voltage when in deep sleep)
+diff --git a/arch/arm/mach-omap1/time.c b/arch/arm/mach-omap1/time.c
+index 524977a31a49c..de590a85a42b3 100644
+--- a/arch/arm/mach-omap1/time.c
++++ b/arch/arm/mach-omap1/time.c
+@@ -155,15 +155,11 @@ static irqreturn_t omap_mpu_timer1_interrupt(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-static struct irqaction omap_mpu_timer1_irq = {
+- .name = "mpu_timer1",
+- .flags = IRQF_TIMER | IRQF_IRQPOLL,
+- .handler = omap_mpu_timer1_interrupt,
+-};
+-
+ static __init void omap_init_mpu_timer(unsigned long rate)
+ {
+- setup_irq(INT_TIMER1, &omap_mpu_timer1_irq);
++ if (request_irq(INT_TIMER1, omap_mpu_timer1_interrupt,
++ IRQF_TIMER | IRQF_IRQPOLL, "mpu_timer1", NULL))
++ pr_err("Failed to request irq %d (mpu_timer1)\n", INT_TIMER1);
+ omap_mpu_timer_start(0, (rate / HZ) - 1, 1);
+
+ clockevent_mpu_timer1.cpumask = cpumask_of(0);
+diff --git a/arch/arm/mach-omap1/timer32k.c b/arch/arm/mach-omap1/timer32k.c
+index 0ae6c52a7d70b..780fdf03c3cee 100644
+--- a/arch/arm/mach-omap1/timer32k.c
++++ b/arch/arm/mach-omap1/timer32k.c
+@@ -148,15 +148,11 @@ static irqreturn_t omap_32k_timer_interrupt(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-static struct irqaction omap_32k_timer_irq = {
+- .name = "32KHz timer",
+- .flags = IRQF_TIMER | IRQF_IRQPOLL,
+- .handler = omap_32k_timer_interrupt,
+-};
+-
+ static __init void omap_init_32k_timer(void)
+ {
+- setup_irq(INT_OS_TIMER, &omap_32k_timer_irq);
++ if (request_irq(INT_OS_TIMER, omap_32k_timer_interrupt,
++ IRQF_TIMER | IRQF_IRQPOLL, "32KHz timer", NULL))
++ pr_err("Failed to request irq %d(32KHz timer)\n", INT_OS_TIMER);
+
+ clockevent_32k_timer.cpumask = cpumask_of(0);
+ clockevents_config_and_register(&clockevent_32k_timer,
+diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
+index 6b4f4975cf7a6..6e59c11131c48 100644
+--- a/arch/arm/mach-omap2/board-generic.c
++++ b/arch/arm/mach-omap2/board-generic.c
+@@ -330,7 +330,7 @@ DT_MACHINE_START(DRA74X_DT, "Generic DRA74X (Flattened Device Tree)")
+ .init_late = dra7xx_init_late,
+ .init_irq = omap_gic_of_init,
+ .init_machine = omap_generic_init,
+- .init_time = omap5_realtime_timer_init,
++ .init_time = omap3_gptimer_timer_init,
+ .dt_compat = dra74x_boards_compat,
+ .restart = omap44xx_restart,
+ MACHINE_END
+@@ -353,7 +353,7 @@ DT_MACHINE_START(DRA72X_DT, "Generic DRA72X (Flattened Device Tree)")
+ .init_late = dra7xx_init_late,
+ .init_irq = omap_gic_of_init,
+ .init_machine = omap_generic_init,
+- .init_time = omap5_realtime_timer_init,
++ .init_time = omap3_gptimer_timer_init,
+ .dt_compat = dra72x_boards_compat,
+ .restart = omap44xx_restart,
+ MACHINE_END
+diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
+index 98ed5ac073bc1..c4ba848e8af62 100644
+--- a/arch/arm/mach-omap2/timer.c
++++ b/arch/arm/mach-omap2/timer.c
+@@ -42,6 +42,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/platform_data/dmtimer-omap.h>
+ #include <linux/sched_clock.h>
++#include <linux/cpu.h>
+
+ #include <asm/mach/time.h>
+ #include <asm/smp_twd.h>
+@@ -64,15 +65,28 @@
+
+ /* Clockevent code */
+
+-static struct omap_dm_timer clkev;
+-static struct clock_event_device clockevent_gpt;
+-
+ /* Clockevent hwmod for am335x and am437x suspend */
+ static struct omap_hwmod *clockevent_gpt_hwmod;
+
+ /* Clockesource hwmod for am437x suspend */
+ static struct omap_hwmod *clocksource_gpt_hwmod;
+
++struct dmtimer_clockevent {
++ struct clock_event_device dev;
++ struct omap_dm_timer timer;
++};
++
++static struct dmtimer_clockevent clockevent;
++
++static struct omap_dm_timer *to_dmtimer(struct clock_event_device *clockevent)
++{
++ struct dmtimer_clockevent *clkevt =
++ container_of(clockevent, struct dmtimer_clockevent, dev);
++ struct omap_dm_timer *timer = &clkevt->timer;
++
++ return timer;
++}
++
+ #ifdef CONFIG_SOC_HAS_REALTIME_COUNTER
+ static unsigned long arch_timer_freq;
+
+@@ -84,24 +98,21 @@ void set_cntfreq(void)
+
+ static irqreturn_t omap2_gp_timer_interrupt(int irq, void *dev_id)
+ {
+- struct clock_event_device *evt = &clockevent_gpt;
+-
+- __omap_dm_timer_write_status(&clkev, OMAP_TIMER_INT_OVERFLOW);
++ struct dmtimer_clockevent *clkevt = dev_id;
++ struct clock_event_device *evt = &clkevt->dev;
++ struct omap_dm_timer *timer = &clkevt->timer;
+
++ __omap_dm_timer_write_status(timer, OMAP_TIMER_INT_OVERFLOW);
+ evt->event_handler(evt);
+ return IRQ_HANDLED;
+ }
+
+-static struct irqaction omap2_gp_timer_irq = {
+- .name = "gp_timer",
+- .flags = IRQF_TIMER | IRQF_IRQPOLL,
+- .handler = omap2_gp_timer_interrupt,
+-};
+-
+ static int omap2_gp_timer_set_next_event(unsigned long cycles,
+ struct clock_event_device *evt)
+ {
+- __omap_dm_timer_load_start(&clkev, OMAP_TIMER_CTRL_ST,
++ struct omap_dm_timer *timer = to_dmtimer(evt);
++
++ __omap_dm_timer_load_start(timer, OMAP_TIMER_CTRL_ST,
+ 0xffffffff - cycles, OMAP_TIMER_POSTED);
+
+ return 0;
+@@ -109,22 +120,26 @@ static int omap2_gp_timer_set_next_event(unsigned long cycles,
+
+ static int omap2_gp_timer_shutdown(struct clock_event_device *evt)
+ {
+- __omap_dm_timer_stop(&clkev, OMAP_TIMER_POSTED, clkev.rate);
++ struct omap_dm_timer *timer = to_dmtimer(evt);
++
++ __omap_dm_timer_stop(timer, OMAP_TIMER_POSTED, timer->rate);
++
+ return 0;
+ }
+
+ static int omap2_gp_timer_set_periodic(struct clock_event_device *evt)
+ {
++ struct omap_dm_timer *timer = to_dmtimer(evt);
+ u32 period;
+
+- __omap_dm_timer_stop(&clkev, OMAP_TIMER_POSTED, clkev.rate);
++ __omap_dm_timer_stop(timer, OMAP_TIMER_POSTED, timer->rate);
+
+- period = clkev.rate / HZ;
++ period = timer->rate / HZ;
+ period -= 1;
+ /* Looks like we need to first set the load value separately */
+- __omap_dm_timer_write(&clkev, OMAP_TIMER_LOAD_REG, 0xffffffff - period,
++ __omap_dm_timer_write(timer, OMAP_TIMER_LOAD_REG, 0xffffffff - period,
+ OMAP_TIMER_POSTED);
+- __omap_dm_timer_load_start(&clkev,
++ __omap_dm_timer_load_start(timer,
+ OMAP_TIMER_CTRL_AR | OMAP_TIMER_CTRL_ST,
+ 0xffffffff - period, OMAP_TIMER_POSTED);
+ return 0;
+@@ -138,25 +153,16 @@ static void omap_clkevt_idle(struct clock_event_device *unused)
+ omap_hwmod_idle(clockevent_gpt_hwmod);
+ }
+
+-static void omap_clkevt_unidle(struct clock_event_device *unused)
++static void omap_clkevt_unidle(struct clock_event_device *evt)
+ {
++ struct omap_dm_timer *timer = to_dmtimer(evt);
++
+ if (!clockevent_gpt_hwmod)
+ return;
+
+ omap_hwmod_enable(clockevent_gpt_hwmod);
+- __omap_dm_timer_int_enable(&clkev, OMAP_TIMER_INT_OVERFLOW);
+-}
+-
+-static struct clock_event_device clockevent_gpt = {
+- .features = CLOCK_EVT_FEAT_PERIODIC |
+- CLOCK_EVT_FEAT_ONESHOT,
+- .rating = 300,
+- .set_next_event = omap2_gp_timer_set_next_event,
+- .set_state_shutdown = omap2_gp_timer_shutdown,
+- .set_state_periodic = omap2_gp_timer_set_periodic,
+- .set_state_oneshot = omap2_gp_timer_shutdown,
+- .tick_resume = omap2_gp_timer_shutdown,
+-};
++ __omap_dm_timer_int_enable(timer, OMAP_TIMER_INT_OVERFLOW);
++}
+
+ static const struct of_device_id omap_timer_match[] __initconst = {
+ { .compatible = "ti,omap2420-timer", },
+@@ -363,47 +369,104 @@ void tick_broadcast(const struct cpumask *mask)
+ }
+ #endif
+
+-static void __init omap2_gp_clockevent_init(int gptimer_id,
+- const char *fck_source,
+- const char *property)
++static void __init dmtimer_clkevt_init_common(struct dmtimer_clockevent *clkevt,
++ int gptimer_id,
++ const char *fck_source,
++ unsigned int features,
++ const struct cpumask *cpumask,
++ const char *property,
++ int rating, const char *name)
+ {
++ struct omap_dm_timer *timer = &clkevt->timer;
+ int res;
+
+- clkev.id = gptimer_id;
+- clkev.errata = omap_dm_timer_get_errata();
++ timer->id = gptimer_id;
++ timer->errata = omap_dm_timer_get_errata();
++ clkevt->dev.features = features;
++ clkevt->dev.rating = rating;
++ clkevt->dev.set_next_event = omap2_gp_timer_set_next_event;
++ clkevt->dev.set_state_shutdown = omap2_gp_timer_shutdown;
++ clkevt->dev.set_state_periodic = omap2_gp_timer_set_periodic;
++ clkevt->dev.set_state_oneshot = omap2_gp_timer_shutdown;
++ clkevt->dev.tick_resume = omap2_gp_timer_shutdown;
+
+ /*
+ * For clock-event timers we never read the timer counter and
+ * so we are not impacted by errata i103 and i767. Therefore,
+ * we can safely ignore this errata for clock-event timers.
+ */
+- __omap_dm_timer_override_errata(&clkev, OMAP_TIMER_ERRATA_I103_I767);
++ __omap_dm_timer_override_errata(timer, OMAP_TIMER_ERRATA_I103_I767);
+
+- res = omap_dm_timer_init_one(&clkev, fck_source, property,
+- &clockevent_gpt.name, OMAP_TIMER_POSTED);
++ res = omap_dm_timer_init_one(timer, fck_source, property,
++ &clkevt->dev.name, OMAP_TIMER_POSTED);
+ BUG_ON(res);
+
+- omap2_gp_timer_irq.dev_id = &clkev;
+- setup_irq(clkev.irq, &omap2_gp_timer_irq);
++ clkevt->dev.cpumask = cpumask;
++ clkevt->dev.irq = omap_dm_timer_get_irq(timer);
+
+- __omap_dm_timer_int_enable(&clkev, OMAP_TIMER_INT_OVERFLOW);
++ if (request_irq(clkevt->dev.irq, omap2_gp_timer_interrupt,
++ IRQF_TIMER | IRQF_IRQPOLL, name, clkevt))
++ pr_err("Failed to request irq %d (gp_timer)\n", clkevt->dev.irq);
+
+- clockevent_gpt.cpumask = cpu_possible_mask;
+- clockevent_gpt.irq = omap_dm_timer_get_irq(&clkev);
+- clockevents_config_and_register(&clockevent_gpt, clkev.rate,
+- 3, /* Timer internal resynch latency */
+- 0xffffffff);
++ __omap_dm_timer_int_enable(timer, OMAP_TIMER_INT_OVERFLOW);
+
+ if (soc_is_am33xx() || soc_is_am43xx()) {
+- clockevent_gpt.suspend = omap_clkevt_idle;
+- clockevent_gpt.resume = omap_clkevt_unidle;
++ clkevt->dev.suspend = omap_clkevt_idle;
++ clkevt->dev.resume = omap_clkevt_unidle;
+
+ clockevent_gpt_hwmod =
+- omap_hwmod_lookup(clockevent_gpt.name);
++ omap_hwmod_lookup(clkevt->dev.name);
++ }
++
++ pr_info("OMAP clockevent source: %s at %lu Hz\n", clkevt->dev.name,
++ timer->rate);
++}
++
++static DEFINE_PER_CPU(struct dmtimer_clockevent, dmtimer_percpu_timer);
++
++static int omap_gptimer_starting_cpu(unsigned int cpu)
++{
++ struct dmtimer_clockevent *clkevt = per_cpu_ptr(&dmtimer_percpu_timer, cpu);
++ struct clock_event_device *dev = &clkevt->dev;
++ struct omap_dm_timer *timer = &clkevt->timer;
++
++ clockevents_config_and_register(dev, timer->rate, 3, ULONG_MAX);
++ irq_force_affinity(dev->irq, cpumask_of(cpu));
++
++ return 0;
++}
++
++static int __init dmtimer_percpu_quirk_init(void)
++{
++ struct dmtimer_clockevent *clkevt;
++ struct clock_event_device *dev;
++ struct device_node *arm_timer;
++ struct omap_dm_timer *timer;
++ int cpu = 0;
++
++ arm_timer = of_find_compatible_node(NULL, NULL, "arm,armv7-timer");
++ if (of_device_is_available(arm_timer)) {
++ pr_warn_once("ARM architected timer wrap issue i940 detected\n");
++ return 0;
++ }
++
++ for_each_possible_cpu(cpu) {
++ clkevt = per_cpu_ptr(&dmtimer_percpu_timer, cpu);
++ dev = &clkevt->dev;
++ timer = &clkevt->timer;
++
++ dmtimer_clkevt_init_common(clkevt, 0, "timer_sys_ck",
++ CLOCK_EVT_FEAT_ONESHOT,
++ cpumask_of(cpu),
++ "assigned-clock-parents",
++ 500, "percpu timer");
+ }
+
+- pr_info("OMAP clockevent source: %s at %lu Hz\n", clockevent_gpt.name,
+- clkev.rate);
++ cpuhp_setup_state(CPUHP_AP_OMAP_DM_TIMER_STARTING,
++ "clockevents/omap/gptimer:starting",
++ omap_gptimer_starting_cpu, NULL);
++
++ return 0;
+ }
+
+ /* Clocksource code */
+@@ -543,7 +606,15 @@ static void __init __omap_sync32k_timer_init(int clkev_nr, const char *clkev_src
+ {
+ omap_clk_init();
+ omap_dmtimer_init();
+- omap2_gp_clockevent_init(clkev_nr, clkev_src, clkev_prop);
++ dmtimer_clkevt_init_common(&clockevent, clkev_nr, clkev_src,
++ CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT,
++ cpu_possible_mask, clkev_prop, 300, "clockevent");
++ clockevents_config_and_register(&clockevent.dev, clockevent.timer.rate,
++ 3, /* Timer internal resynch latency */
++ 0xffffffff);
++
++ if (soc_is_dra7xx())
++ dmtimer_percpu_quirk_init();
+
+ /* Enable the use of clocksource="gp_timer" kernel parameter */
+ if (use_gptimer_clksrc || gptimer)
+@@ -572,7 +643,7 @@ void __init omap3_secure_sync32k_timer_init(void)
+ #endif /* CONFIG_ARCH_OMAP3 */
+
+ #if defined(CONFIG_ARCH_OMAP3) || defined(CONFIG_SOC_AM33XX) || \
+- defined(CONFIG_SOC_AM43XX)
++ defined(CONFIG_SOC_AM43XX) || defined(CONFIG_SOC_DRA7XX)
+ void __init omap3_gptimer_timer_init(void)
+ {
+ __omap_sync32k_timer_init(2, "timer_sys_ck", NULL,
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index ad24e67772778..bd463d6842370 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1791,9 +1791,25 @@ static void sev_asid_free(struct kvm *kvm)
+ __sev_asid_free(sev->asid);
+ }
+
+-static void sev_unbind_asid(struct kvm *kvm, unsigned int handle)
++static void sev_decommission(unsigned int handle)
+ {
+ struct sev_data_decommission *decommission;
++
++ if (!handle)
++ return;
++
++ decommission = kzalloc(sizeof(*decommission), GFP_KERNEL);
++ if (!decommission)
++ return;
++
++ decommission->handle = handle;
++ sev_guest_decommission(decommission, NULL);
++
++ kfree(decommission);
++}
++
++static void sev_unbind_asid(struct kvm *kvm, unsigned int handle)
++{
+ struct sev_data_deactivate *data;
+
+ if (!handle)
+@@ -1811,15 +1827,7 @@ static void sev_unbind_asid(struct kvm *kvm, unsigned int handle)
+ sev_guest_df_flush(NULL);
+ kfree(data);
+
+- decommission = kzalloc(sizeof(*decommission), GFP_KERNEL);
+- if (!decommission)
+- return;
+-
+- /* decommission handle */
+- decommission->handle = handle;
+- sev_guest_decommission(decommission, NULL);
+-
+- kfree(decommission);
++ sev_decommission(handle);
+ }
+
+ static struct page **sev_pin_memory(struct kvm *kvm, unsigned long uaddr,
+@@ -1954,6 +1962,7 @@ static void sev_vm_destroy(struct kvm *kvm)
+ list_for_each_safe(pos, q, head) {
+ __unregister_enc_region_locked(kvm,
+ list_entry(pos, struct enc_region, list));
++ cond_resched();
+ }
+ }
+
+@@ -6468,8 +6477,10 @@ static int sev_launch_start(struct kvm *kvm, struct kvm_sev_cmd *argp)
+
+ /* Bind ASID to this guest */
+ ret = sev_bind_asid(kvm, start->handle, error);
+- if (ret)
++ if (ret) {
++ sev_decommission(start->handle);
+ goto e_free_session;
++ }
+
+ /* return handle to userspace */
+ params.handle = start->handle;
+diff --git a/drivers/clk/ti/clk-7xx.c b/drivers/clk/ti/clk-7xx.c
+index 71a122b2dc67e..b6d1ec49fa01a 100644
+--- a/drivers/clk/ti/clk-7xx.c
++++ b/drivers/clk/ti/clk-7xx.c
+@@ -733,6 +733,7 @@ const struct omap_clkctrl_data dra7_clkctrl_data[] __initconst = {
+ static struct ti_dt_clk dra7xx_clks[] = {
+ DT_CLK(NULL, "timer_32k_ck", "sys_32k_ck"),
+ DT_CLK(NULL, "sys_clkin_ck", "timer_sys_clk_div"),
++ DT_CLK(NULL, "timer_sys_ck", "timer_sys_clk_div"),
+ DT_CLK(NULL, "sys_clkin", "sys_clkin1"),
+ DT_CLK(NULL, "atl_dpll_clk_mux", "atl_cm:0000:24"),
+ DT_CLK(NULL, "atl_gfclk_mux", "atl_cm:0000:26"),
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
+index 7214022dfb911..d230536e7086d 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
+@@ -512,7 +512,7 @@ nouveau_bo_sync_for_device(struct nouveau_bo *nvbo)
+ struct ttm_dma_tt *ttm_dma = (struct ttm_dma_tt *)nvbo->bo.ttm;
+ int i;
+
+- if (!ttm_dma)
++ if (!ttm_dma || !ttm_dma->dma_address)
+ return;
+
+ /* Don't waste time looping if the object is coherent */
+@@ -532,7 +532,7 @@ nouveau_bo_sync_for_cpu(struct nouveau_bo *nvbo)
+ struct ttm_dma_tt *ttm_dma = (struct ttm_dma_tt *)nvbo->bo.ttm;
+ int i;
+
+- if (!ttm_dma)
++ if (!ttm_dma || !ttm_dma->dma_address)
+ return;
+
+ /* Don't waste time looping if the object is coherent */
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index 45c8bf39ad238..acf0c244141f4 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -216,6 +216,8 @@ static unsigned int sr_get_events(struct scsi_device *sdev)
+ return DISK_EVENT_EJECT_REQUEST;
+ else if (med->media_event_code == 2)
+ return DISK_EVENT_MEDIA_CHANGE;
++ else if (med->media_event_code == 3)
++ return DISK_EVENT_EJECT_REQUEST;
+ return 0;
+ }
+
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index b370144682ed5..a2f8130e18fec 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -524,6 +524,9 @@ static void xen_irq_lateeoi_locked(struct irq_info *info, bool spurious)
+ }
+
+ info->eoi_time = 0;
++
++ /* is_active hasn't been reset yet, do it now. */
++ smp_store_release(&info->is_active, 0);
+ do_unmask(info, EVT_MASK_REASON_EOI_PENDING);
+ }
+
+@@ -1780,10 +1783,22 @@ static void lateeoi_ack_dynirq(struct irq_data *data)
+ struct irq_info *info = info_for_irq(data->irq);
+ evtchn_port_t evtchn = info ? info->evtchn : 0;
+
+- if (VALID_EVTCHN(evtchn)) {
+- do_mask(info, EVT_MASK_REASON_EOI_PENDING);
+- ack_dynirq(data);
+- }
++ if (!VALID_EVTCHN(evtchn))
++ return;
++
++ do_mask(info, EVT_MASK_REASON_EOI_PENDING);
++
++ if (unlikely(irqd_is_setaffinity_pending(data)) &&
++ likely(!irqd_irq_disabled(data))) {
++ do_mask(info, EVT_MASK_REASON_TEMPORARY);
++
++ clear_evtchn(evtchn);
++
++ irq_move_masked_irq(data);
++
++ do_unmask(info, EVT_MASK_REASON_TEMPORARY);
++ } else
++ clear_evtchn(evtchn);
+ }
+
+ static void lateeoi_mask_ack_dynirq(struct irq_data *data)
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index 1ea8fc9ff048f..1bc65ecd4bd6d 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -171,8 +171,10 @@ static int ext4_data_block_valid_rcu(struct ext4_sb_info *sbi,
+ else if (start_blk >= (entry->start_blk + entry->count))
+ n = n->rb_right;
+ else {
++ if (entry->ino == ino)
++ return 1;
+ sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
+- return entry->ino == ino;
++ return 0;
+ }
+ }
+ return 1;
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index d67c0035165c2..3d323c6c85260 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -118,6 +118,7 @@ enum cpuhp_state {
+ CPUHP_AP_ARM_L2X0_STARTING,
+ CPUHP_AP_EXYNOS4_MCT_TIMER_STARTING,
+ CPUHP_AP_ARM_ARCH_TIMER_STARTING,
++ CPUHP_AP_OMAP_DM_TIMER_STARTING,
+ CPUHP_AP_ARM_GLOBAL_TIMER_STARTING,
+ CPUHP_AP_JCORE_TIMER_STARTING,
+ CPUHP_AP_ARM_TWD_STARTING,
+diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
+index e375f2249f520..becf9b1eae5a1 100644
+--- a/include/linux/huge_mm.h
++++ b/include/linux/huge_mm.h
+@@ -224,6 +224,7 @@ struct page *follow_devmap_pud(struct vm_area_struct *vma, unsigned long addr,
+ extern vm_fault_t do_huge_pmd_numa_page(struct vm_fault *vmf, pmd_t orig_pmd);
+
+ extern struct page *huge_zero_page;
++extern unsigned long huge_zero_pfn;
+
+ static inline bool is_huge_zero_page(struct page *page)
+ {
+@@ -232,7 +233,7 @@ static inline bool is_huge_zero_page(struct page *page)
+
+ static inline bool is_huge_zero_pmd(pmd_t pmd)
+ {
+- return is_huge_zero_page(pmd_page(pmd));
++ return READ_ONCE(huge_zero_pfn) == pmd_pfn(pmd) && pmd_present(pmd);
+ }
+
+ static inline bool is_huge_zero_pud(pud_t pud)
+@@ -342,6 +343,11 @@ static inline bool is_huge_zero_page(struct page *page)
+ return false;
+ }
+
++static inline bool is_huge_zero_pmd(pmd_t pmd)
++{
++ return false;
++}
++
+ static inline bool is_huge_zero_pud(pud_t pud)
+ {
+ return false;
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index c129c1c14c5f2..2df83a6598182 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -477,17 +477,6 @@ static inline int hstate_index(struct hstate *h)
+ return h - hstates;
+ }
+
+-pgoff_t __basepage_index(struct page *page);
+-
+-/* Return page->index in PAGE_SIZE units */
+-static inline pgoff_t basepage_index(struct page *page)
+-{
+- if (!PageCompound(page))
+- return page->index;
+-
+- return __basepage_index(page);
+-}
+-
+ extern int dissolve_free_huge_page(struct page *page);
+ extern int dissolve_free_huge_pages(unsigned long start_pfn,
+ unsigned long end_pfn);
+@@ -582,11 +571,6 @@ static inline int hstate_index(struct hstate *h)
+ return 0;
+ }
+
+-static inline pgoff_t basepage_index(struct page *page)
+-{
+- return page->index;
+-}
+-
+ static inline int dissolve_free_huge_page(struct page *page)
+ {
+ return 0;
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index f6ecf41aea83d..c736c677b876d 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1338,6 +1338,7 @@ struct zap_details {
+ struct address_space *check_mapping; /* Check page->mapping if set */
+ pgoff_t first_index; /* Lowest page->index to unmap */
+ pgoff_t last_index; /* Highest page->index to unmap */
++ struct page *single_page; /* Locked page to be unmapped */
+ };
+
+ struct page *_vm_normal_page(struct vm_area_struct *vma, unsigned long addr,
+@@ -1428,6 +1429,7 @@ extern vm_fault_t handle_mm_fault(struct vm_area_struct *vma,
+ extern int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+ unsigned long address, unsigned int fault_flags,
+ bool *unlocked);
++void unmap_mapping_page(struct page *page);
+ void unmap_mapping_pages(struct address_space *mapping,
+ pgoff_t start, pgoff_t nr, bool even_cows);
+ void unmap_mapping_range(struct address_space *mapping,
+@@ -1448,6 +1450,7 @@ static inline int fixup_user_fault(struct task_struct *tsk,
+ BUG();
+ return -EFAULT;
+ }
++static inline void unmap_mapping_page(struct page *page) { }
+ static inline void unmap_mapping_pages(struct address_space *mapping,
+ pgoff_t start, pgoff_t nr, bool even_cows) { }
+ static inline void unmap_mapping_range(struct address_space *mapping,
+diff --git a/include/linux/mmdebug.h b/include/linux/mmdebug.h
+index 2ad72d2c8cc52..5d0767cb424aa 100644
+--- a/include/linux/mmdebug.h
++++ b/include/linux/mmdebug.h
+@@ -37,6 +37,18 @@ void dump_mm(const struct mm_struct *mm);
+ BUG(); \
+ } \
+ } while (0)
++#define VM_WARN_ON_ONCE_PAGE(cond, page) ({ \
++ static bool __section(".data.once") __warned; \
++ int __ret_warn_once = !!(cond); \
++ \
++ if (unlikely(__ret_warn_once && !__warned)) { \
++ dump_page(page, "VM_WARN_ON_ONCE_PAGE(" __stringify(cond)")");\
++ __warned = true; \
++ WARN_ON(1); \
++ } \
++ unlikely(__ret_warn_once); \
++})
++
+ #define VM_WARN_ON(cond) (void)WARN_ON(cond)
+ #define VM_WARN_ON_ONCE(cond) (void)WARN_ON_ONCE(cond)
+ #define VM_WARN_ONCE(cond, format...) (void)WARN_ONCE(cond, format)
+@@ -48,6 +60,7 @@ void dump_mm(const struct mm_struct *mm);
+ #define VM_BUG_ON_MM(cond, mm) VM_BUG_ON(cond)
+ #define VM_WARN_ON(cond) BUILD_BUG_ON_INVALID(cond)
+ #define VM_WARN_ON_ONCE(cond) BUILD_BUG_ON_INVALID(cond)
++#define VM_WARN_ON_ONCE_PAGE(cond, page) BUILD_BUG_ON_INVALID(cond)
+ #define VM_WARN_ONCE(cond, format...) BUILD_BUG_ON_INVALID(cond)
+ #define VM_WARN(cond, format...) BUILD_BUG_ON_INVALID(cond)
+ #endif
+diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
+index b1bd2186e6d2b..33b63b2a163f9 100644
+--- a/include/linux/pagemap.h
++++ b/include/linux/pagemap.h
+@@ -403,7 +403,7 @@ static inline struct page *read_mapping_page(struct address_space *mapping,
+ }
+
+ /*
+- * Get index of the page with in radix-tree
++ * Get index of the page within radix-tree (but not for hugetlb pages).
+ * (TODO: remove once hugetlb pages will have ->index in PAGE_SIZE)
+ */
+ static inline pgoff_t page_to_index(struct page *page)
+@@ -422,15 +422,16 @@ static inline pgoff_t page_to_index(struct page *page)
+ return pgoff;
+ }
+
++extern pgoff_t hugetlb_basepage_index(struct page *page);
++
+ /*
+- * Get the offset in PAGE_SIZE.
+- * (TODO: hugepage should have ->index in PAGE_SIZE)
++ * Get the offset in PAGE_SIZE (even for hugetlb pages).
++ * (TODO: hugetlb pages should have ->index in PAGE_SIZE)
+ */
+ static inline pgoff_t page_to_pgoff(struct page *page)
+ {
+- if (unlikely(PageHeadHuge(page)))
+- return page->index << compound_order(page);
+-
++ if (unlikely(PageHuge(page)))
++ return hugetlb_basepage_index(page);
+ return page_to_index(page);
+ }
+
+diff --git a/include/linux/rmap.h b/include/linux/rmap.h
+index d7d6d4eb17949..91ccae9467164 100644
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -98,7 +98,8 @@ enum ttu_flags {
+ * do a final flush if necessary */
+ TTU_RMAP_LOCKED = 0x80, /* do not grab rmap lock:
+ * caller holds it */
+- TTU_SPLIT_FREEZE = 0x100, /* freeze pte under splitting thp */
++ TTU_SPLIT_FREEZE = 0x100, /* freeze pte under splitting thp */
++ TTU_SYNC = 0x200, /* avoid racy checks with PVMW_SYNC */
+ };
+
+ #ifdef CONFIG_MMU
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 526ebcff5a0a9..3c67da9b84086 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -719,7 +719,7 @@ again:
+
+ key->both.offset |= FUT_OFF_INODE; /* inode-based key */
+ key->shared.i_seq = get_inode_sequence_number(inode);
+- key->shared.pgoff = basepage_index(tail);
++ key->shared.pgoff = page_to_pgoff(tail);
+ rcu_read_unlock();
+ }
+
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index 81abfac351272..9750f4f7f9010 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -1010,8 +1010,38 @@ void kthread_flush_work(struct kthread_work *work)
+ EXPORT_SYMBOL_GPL(kthread_flush_work);
+
+ /*
+- * This function removes the work from the worker queue. Also it makes sure
+- * that it won't get queued later via the delayed work's timer.
++ * Make sure that the timer is neither set nor running and could
++ * not manipulate the work list_head any longer.
++ *
++ * The function is called under worker->lock. The lock is temporary
++ * released but the timer can't be set again in the meantime.
++ */
++static void kthread_cancel_delayed_work_timer(struct kthread_work *work,
++ unsigned long *flags)
++{
++ struct kthread_delayed_work *dwork =
++ container_of(work, struct kthread_delayed_work, work);
++ struct kthread_worker *worker = work->worker;
++
++ /*
++ * del_timer_sync() must be called to make sure that the timer
++ * callback is not running. The lock must be temporary released
++ * to avoid a deadlock with the callback. In the meantime,
++ * any queuing is blocked by setting the canceling counter.
++ */
++ work->canceling++;
++ spin_unlock_irqrestore(&worker->lock, *flags);
++ del_timer_sync(&dwork->timer);
++ spin_lock_irqsave(&worker->lock, *flags);
++ work->canceling--;
++}
++
++/*
++ * This function removes the work from the worker queue.
++ *
++ * It is called under worker->lock. The caller must make sure that
++ * the timer used by delayed work is not running, e.g. by calling
++ * kthread_cancel_delayed_work_timer().
+ *
+ * The work might still be in use when this function finishes. See the
+ * current_work proceed by the worker.
+@@ -1019,28 +1049,8 @@ EXPORT_SYMBOL_GPL(kthread_flush_work);
+ * Return: %true if @work was pending and successfully canceled,
+ * %false if @work was not pending
+ */
+-static bool __kthread_cancel_work(struct kthread_work *work, bool is_dwork,
+- unsigned long *flags)
++static bool __kthread_cancel_work(struct kthread_work *work)
+ {
+- /* Try to cancel the timer if exists. */
+- if (is_dwork) {
+- struct kthread_delayed_work *dwork =
+- container_of(work, struct kthread_delayed_work, work);
+- struct kthread_worker *worker = work->worker;
+-
+- /*
+- * del_timer_sync() must be called to make sure that the timer
+- * callback is not running. The lock must be temporary released
+- * to avoid a deadlock with the callback. In the meantime,
+- * any queuing is blocked by setting the canceling counter.
+- */
+- work->canceling++;
+- spin_unlock_irqrestore(&worker->lock, *flags);
+- del_timer_sync(&dwork->timer);
+- spin_lock_irqsave(&worker->lock, *flags);
+- work->canceling--;
+- }
+-
+ /*
+ * Try to remove the work from a worker list. It might either
+ * be from worker->work_list or from worker->delayed_work_list.
+@@ -1093,11 +1103,23 @@ bool kthread_mod_delayed_work(struct kthread_worker *worker,
+ /* Work must not be used with >1 worker, see kthread_queue_work() */
+ WARN_ON_ONCE(work->worker != worker);
+
+- /* Do not fight with another command that is canceling this work. */
++ /*
++ * Temporary cancel the work but do not fight with another command
++ * that is canceling the work as well.
++ *
++ * It is a bit tricky because of possible races with another
++ * mod_delayed_work() and cancel_delayed_work() callers.
++ *
++ * The timer must be canceled first because worker->lock is released
++ * when doing so. But the work can be removed from the queue (list)
++ * only when it can be queued again so that the return value can
++ * be used for reference counting.
++ */
++ kthread_cancel_delayed_work_timer(work, &flags);
+ if (work->canceling)
+ goto out;
++ ret = __kthread_cancel_work(work);
+
+- ret = __kthread_cancel_work(work, true, &flags);
+ fast_queue:
+ __kthread_queue_delayed_work(worker, dwork, delay);
+ out:
+@@ -1119,7 +1141,10 @@ static bool __kthread_cancel_work_sync(struct kthread_work *work, bool is_dwork)
+ /* Work must not be used with >1 worker, see kthread_queue_work(). */
+ WARN_ON_ONCE(work->worker != worker);
+
+- ret = __kthread_cancel_work(work, is_dwork, &flags);
++ if (is_dwork)
++ kthread_cancel_delayed_work_timer(work, &flags);
++
++ ret = __kthread_cancel_work(work);
+
+ if (worker->current_work != work)
+ goto out_fast;
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 7c374c0fcf0c7..4400957d8e4e2 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -62,6 +62,7 @@ static struct shrinker deferred_split_shrinker;
+
+ static atomic_t huge_zero_refcount;
+ struct page *huge_zero_page __read_mostly;
++unsigned long huge_zero_pfn __read_mostly = ~0UL;
+
+ bool transparent_hugepage_enabled(struct vm_area_struct *vma)
+ {
+@@ -93,6 +94,7 @@ retry:
+ __free_pages(zero_page, compound_order(zero_page));
+ goto retry;
+ }
++ WRITE_ONCE(huge_zero_pfn, page_to_pfn(zero_page));
+
+ /* We take additional reference here. It will be put back by shrinker */
+ atomic_set(&huge_zero_refcount, 2);
+@@ -142,6 +144,7 @@ static unsigned long shrink_huge_zero_page_scan(struct shrinker *shrink,
+ if (atomic_cmpxchg(&huge_zero_refcount, 1, 0) == 1) {
+ struct page *zero_page = xchg(&huge_zero_page, NULL);
+ BUG_ON(zero_page == NULL);
++ WRITE_ONCE(huge_zero_pfn, ~0UL);
+ __free_pages(zero_page, compound_order(zero_page));
+ return HPAGE_PMD_NR;
+ }
+@@ -2125,7 +2128,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
+ count_vm_event(THP_SPLIT_PMD);
+
+ if (!vma_is_anonymous(vma)) {
+- _pmd = pmdp_huge_clear_flush_notify(vma, haddr, pmd);
++ old_pmd = pmdp_huge_clear_flush_notify(vma, haddr, pmd);
+ /*
+ * We are going to unmap this huge page. So
+ * just go ahead and zap it
+@@ -2134,16 +2137,25 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
+ zap_deposited_table(mm, pmd);
+ if (vma_is_dax(vma))
+ return;
+- page = pmd_page(_pmd);
+- if (!PageDirty(page) && pmd_dirty(_pmd))
+- set_page_dirty(page);
+- if (!PageReferenced(page) && pmd_young(_pmd))
+- SetPageReferenced(page);
+- page_remove_rmap(page, true);
+- put_page(page);
++ if (unlikely(is_pmd_migration_entry(old_pmd))) {
++ swp_entry_t entry;
++
++ entry = pmd_to_swp_entry(old_pmd);
++ page = migration_entry_to_page(entry);
++ } else {
++ page = pmd_page(old_pmd);
++ if (!PageDirty(page) && pmd_dirty(old_pmd))
++ set_page_dirty(page);
++ if (!PageReferenced(page) && pmd_young(old_pmd))
++ SetPageReferenced(page);
++ page_remove_rmap(page, true);
++ put_page(page);
++ }
+ add_mm_counter(mm, mm_counter_file(page), -HPAGE_PMD_NR);
+ return;
+- } else if (pmd_trans_huge(*pmd) && is_huge_zero_pmd(*pmd)) {
++ }
++
++ if (is_huge_zero_pmd(*pmd)) {
+ /*
+ * FIXME: Do we want to invalidate secondary mmu by calling
+ * mmu_notifier_invalidate_range() see comments below inside
+@@ -2418,16 +2430,16 @@ void vma_adjust_trans_huge(struct vm_area_struct *vma,
+ static void unmap_page(struct page *page)
+ {
+ enum ttu_flags ttu_flags = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS |
+- TTU_RMAP_LOCKED | TTU_SPLIT_HUGE_PMD;
+- bool unmap_success;
++ TTU_RMAP_LOCKED | TTU_SPLIT_HUGE_PMD | TTU_SYNC;
+
+ VM_BUG_ON_PAGE(!PageHead(page), page);
+
+ if (PageAnon(page))
+ ttu_flags |= TTU_SPLIT_FREEZE;
+
+- unmap_success = try_to_unmap(page, ttu_flags);
+- VM_BUG_ON_PAGE(!unmap_success, page);
++ try_to_unmap(page, ttu_flags);
++
++ VM_WARN_ON_ONCE_PAGE(page_mapped(page), page);
+ }
+
+ static void remap_page(struct page *page)
+@@ -2686,7 +2698,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+ struct pglist_data *pgdata = NODE_DATA(page_to_nid(head));
+ struct anon_vma *anon_vma = NULL;
+ struct address_space *mapping = NULL;
+- int count, mapcount, extra_pins, ret;
++ int extra_pins, ret;
+ bool mlocked;
+ unsigned long flags;
+ pgoff_t end;
+@@ -2748,7 +2760,6 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+
+ mlocked = PageMlocked(page);
+ unmap_page(head);
+- VM_BUG_ON_PAGE(compound_mapcount(head), head);
+
+ /* Make sure the page is not on per-CPU pagevec as it takes pin */
+ if (mlocked)
+@@ -2774,9 +2785,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+
+ /* Prevent deferred_split_scan() touching ->_refcount */
+ spin_lock(&pgdata->split_queue_lock);
+- count = page_count(head);
+- mapcount = total_mapcount(head);
+- if (!mapcount && page_ref_freeze(head, 1 + extra_pins)) {
++ if (page_ref_freeze(head, 1 + extra_pins)) {
+ if (!list_empty(page_deferred_list(head))) {
+ pgdata->split_queue_len--;
+ list_del(page_deferred_list(head));
+@@ -2792,16 +2801,9 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
+ } else
+ ret = 0;
+ } else {
+- if (IS_ENABLED(CONFIG_DEBUG_VM) && mapcount) {
+- pr_alert("total_mapcount: %u, page_count(): %u\n",
+- mapcount, count);
+- if (PageTail(page))
+- dump_page(head, NULL);
+- dump_page(page, "total_mapcount(head) > 0");
+- BUG();
+- }
+ spin_unlock(&pgdata->split_queue_lock);
+-fail: if (mapping)
++fail:
++ if (mapping)
+ xa_unlock(&mapping->i_pages);
+ spin_unlock_irqrestore(zone_lru_lock(page_zone(head)), flags);
+ remap_page(head);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index c69f12e4c1499..ebcf26bc4cd4b 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1391,15 +1391,12 @@ int PageHeadHuge(struct page *page_head)
+ return get_compound_page_dtor(page_head) == free_huge_page;
+ }
+
+-pgoff_t __basepage_index(struct page *page)
++pgoff_t hugetlb_basepage_index(struct page *page)
+ {
+ struct page *page_head = compound_head(page);
+ pgoff_t index = page_index(page_head);
+ unsigned long compound_idx;
+
+- if (!PageHuge(page_head))
+- return page_index(page);
+-
+ if (compound_order(page_head) >= MAX_ORDER)
+ compound_idx = page_to_pfn(page) - page_to_pfn(page_head);
+ else
+diff --git a/mm/internal.h b/mm/internal.h
+index 397183c8fe47b..3a2e973138d36 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -331,27 +331,52 @@ static inline void mlock_migrate_page(struct page *newpage, struct page *page)
+ extern pmd_t maybe_pmd_mkwrite(pmd_t pmd, struct vm_area_struct *vma);
+
+ /*
+- * At what user virtual address is page expected in @vma?
++ * At what user virtual address is page expected in vma?
++ * Returns -EFAULT if all of the page is outside the range of vma.
++ * If page is a compound head, the entire compound page is considered.
+ */
+ static inline unsigned long
+-__vma_address(struct page *page, struct vm_area_struct *vma)
++vma_address(struct page *page, struct vm_area_struct *vma)
+ {
+- pgoff_t pgoff = page_to_pgoff(page);
+- return vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
++ pgoff_t pgoff;
++ unsigned long address;
++
++ VM_BUG_ON_PAGE(PageKsm(page), page); /* KSM page->index unusable */
++ pgoff = page_to_pgoff(page);
++ if (pgoff >= vma->vm_pgoff) {
++ address = vma->vm_start +
++ ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
++ /* Check for address beyond vma (or wrapped through 0?) */
++ if (address < vma->vm_start || address >= vma->vm_end)
++ address = -EFAULT;
++ } else if (PageHead(page) &&
++ pgoff + (1UL << compound_order(page)) - 1 >= vma->vm_pgoff) {
++ /* Test above avoids possibility of wrap to 0 on 32-bit */
++ address = vma->vm_start;
++ } else {
++ address = -EFAULT;
++ }
++ return address;
+ }
+
++/*
++ * Then at what user virtual address will none of the page be found in vma?
++ * Assumes that vma_address() already returned a good starting address.
++ * If page is a compound head, the entire compound page is considered.
++ */
+ static inline unsigned long
+-vma_address(struct page *page, struct vm_area_struct *vma)
++vma_address_end(struct page *page, struct vm_area_struct *vma)
+ {
+- unsigned long start, end;
+-
+- start = __vma_address(page, vma);
+- end = start + PAGE_SIZE * (hpage_nr_pages(page) - 1);
+-
+- /* page should be within @vma mapping range */
+- VM_BUG_ON_VMA(end < vma->vm_start || start >= vma->vm_end, vma);
+-
+- return max(start, vma->vm_start);
++ pgoff_t pgoff;
++ unsigned long address;
++
++ VM_BUG_ON_PAGE(PageKsm(page), page); /* KSM page->index unusable */
++ pgoff = page_to_pgoff(page) + (1UL << compound_order(page));
++ address = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
++ /* Check for address beyond vma (or wrapped through 0?) */
++ if (address < vma->vm_start || address > vma->vm_end)
++ address = vma->vm_end;
++ return address;
+ }
+
+ #else /* !CONFIG_MMU */
+diff --git a/mm/memory.c b/mm/memory.c
+index c2011c51f15de..49b546cdce0d2 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1439,7 +1439,18 @@ static inline unsigned long zap_pmd_range(struct mmu_gather *tlb,
+ else if (zap_huge_pmd(tlb, vma, pmd, addr))
+ goto next;
+ /* fall through */
++ } else if (details && details->single_page &&
++ PageTransCompound(details->single_page) &&
++ next - addr == HPAGE_PMD_SIZE && pmd_none(*pmd)) {
++ spinlock_t *ptl = pmd_lock(tlb->mm, pmd);
++ /*
++ * Take and drop THP pmd lock so that we cannot return
++ * prematurely, while zap_huge_pmd() has cleared *pmd,
++ * but not yet decremented compound_mapcount().
++ */
++ spin_unlock(ptl);
+ }
++
+ /*
+ * Here there can be other concurrent MADV_DONTNEED or
+ * trans huge page faults running, and if the pmd is
+@@ -2924,6 +2935,36 @@ static inline void unmap_mapping_range_tree(struct rb_root_cached *root,
+ }
+ }
+
++/**
++ * unmap_mapping_page() - Unmap single page from processes.
++ * @page: The locked page to be unmapped.
++ *
++ * Unmap this page from any userspace process which still has it mmaped.
++ * Typically, for efficiency, the range of nearby pages has already been
++ * unmapped by unmap_mapping_pages() or unmap_mapping_range(). But once
++ * truncation or invalidation holds the lock on a page, it may find that
++ * the page has been remapped again: and then uses unmap_mapping_page()
++ * to unmap it finally.
++ */
++void unmap_mapping_page(struct page *page)
++{
++ struct address_space *mapping = page->mapping;
++ struct zap_details details = { };
++
++ VM_BUG_ON(!PageLocked(page));
++ VM_BUG_ON(PageTail(page));
++
++ details.check_mapping = mapping;
++ details.first_index = page->index;
++ details.last_index = page->index + hpage_nr_pages(page) - 1;
++ details.single_page = page;
++
++ i_mmap_lock_write(mapping);
++ if (unlikely(!RB_EMPTY_ROOT(&mapping->i_mmap.rb_root)))
++ unmap_mapping_range_tree(&mapping->i_mmap, &details);
++ i_mmap_unlock_write(mapping);
++}
++
+ /**
+ * unmap_mapping_pages() - Unmap pages from processes.
+ * @mapping: The address space containing pages to be unmapped.
+diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
+index 11df03e71288c..edca786093187 100644
+--- a/mm/page_vma_mapped.c
++++ b/mm/page_vma_mapped.c
+@@ -111,6 +111,13 @@ static bool check_pte(struct page_vma_mapped_walk *pvmw)
+ return pfn_in_hpage(pvmw->page, pfn);
+ }
+
++static void step_forward(struct page_vma_mapped_walk *pvmw, unsigned long size)
++{
++ pvmw->address = (pvmw->address + size) & ~(size - 1);
++ if (!pvmw->address)
++ pvmw->address = ULONG_MAX;
++}
++
+ /**
+ * page_vma_mapped_walk - check if @pvmw->page is mapped in @pvmw->vma at
+ * @pvmw->address
+@@ -139,6 +146,7 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
+ {
+ struct mm_struct *mm = pvmw->vma->vm_mm;
+ struct page *page = pvmw->page;
++ unsigned long end;
+ pgd_t *pgd;
+ p4d_t *p4d;
+ pud_t *pud;
+@@ -148,10 +156,11 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
+ if (pvmw->pmd && !pvmw->pte)
+ return not_found(pvmw);
+
+- if (pvmw->pte)
+- goto next_pte;
++ if (unlikely(PageHuge(page))) {
++ /* The only possible mapping was handled on last iteration */
++ if (pvmw->pte)
++ return not_found(pvmw);
+
+- if (unlikely(PageHuge(pvmw->page))) {
+ /* when pud is not present, pte will be NULL */
+ pvmw->pte = huge_pte_offset(mm, pvmw->address,
+ PAGE_SIZE << compound_order(page));
+@@ -164,78 +173,108 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
+ return not_found(pvmw);
+ return true;
+ }
+-restart:
+- pgd = pgd_offset(mm, pvmw->address);
+- if (!pgd_present(*pgd))
+- return false;
+- p4d = p4d_offset(pgd, pvmw->address);
+- if (!p4d_present(*p4d))
+- return false;
+- pud = pud_offset(p4d, pvmw->address);
+- if (!pud_present(*pud))
+- return false;
+- pvmw->pmd = pmd_offset(pud, pvmw->address);
++
+ /*
+- * Make sure the pmd value isn't cached in a register by the
+- * compiler and used as a stale value after we've observed a
+- * subsequent update.
++ * Seek to next pte only makes sense for THP.
++ * But more important than that optimization, is to filter out
++ * any PageKsm page: whose page->index misleads vma_address()
++ * and vma_address_end() to disaster.
+ */
+- pmde = READ_ONCE(*pvmw->pmd);
+- if (pmd_trans_huge(pmde) || is_pmd_migration_entry(pmde)) {
+- pvmw->ptl = pmd_lock(mm, pvmw->pmd);
+- if (likely(pmd_trans_huge(*pvmw->pmd))) {
+- if (pvmw->flags & PVMW_MIGRATION)
+- return not_found(pvmw);
+- if (pmd_page(*pvmw->pmd) != page)
+- return not_found(pvmw);
+- return true;
+- } else if (!pmd_present(*pvmw->pmd)) {
+- if (thp_migration_supported()) {
+- if (!(pvmw->flags & PVMW_MIGRATION))
++ end = PageTransCompound(page) ?
++ vma_address_end(page, pvmw->vma) :
++ pvmw->address + PAGE_SIZE;
++ if (pvmw->pte)
++ goto next_pte;
++restart:
++ do {
++ pgd = pgd_offset(mm, pvmw->address);
++ if (!pgd_present(*pgd)) {
++ step_forward(pvmw, PGDIR_SIZE);
++ continue;
++ }
++ p4d = p4d_offset(pgd, pvmw->address);
++ if (!p4d_present(*p4d)) {
++ step_forward(pvmw, P4D_SIZE);
++ continue;
++ }
++ pud = pud_offset(p4d, pvmw->address);
++ if (!pud_present(*pud)) {
++ step_forward(pvmw, PUD_SIZE);
++ continue;
++ }
++
++ pvmw->pmd = pmd_offset(pud, pvmw->address);
++ /*
++ * Make sure the pmd value isn't cached in a register by the
++ * compiler and used as a stale value after we've observed a
++ * subsequent update.
++ */
++ pmde = READ_ONCE(*pvmw->pmd);
++
++ if (pmd_trans_huge(pmde) || is_pmd_migration_entry(pmde)) {
++ pvmw->ptl = pmd_lock(mm, pvmw->pmd);
++ pmde = *pvmw->pmd;
++ if (likely(pmd_trans_huge(pmde))) {
++ if (pvmw->flags & PVMW_MIGRATION)
+ return not_found(pvmw);
+- if (is_migration_entry(pmd_to_swp_entry(*pvmw->pmd))) {
+- swp_entry_t entry = pmd_to_swp_entry(*pvmw->pmd);
++ if (pmd_page(pmde) != page)
++ return not_found(pvmw);
++ return true;
++ }
++ if (!pmd_present(pmde)) {
++ swp_entry_t entry;
+
+- if (migration_entry_to_page(entry) != page)
+- return not_found(pvmw);
+- return true;
+- }
++ if (!thp_migration_supported() ||
++ !(pvmw->flags & PVMW_MIGRATION))
++ return not_found(pvmw);
++ entry = pmd_to_swp_entry(pmde);
++ if (!is_migration_entry(entry) ||
++ migration_entry_to_page(entry) != page)
++ return not_found(pvmw);
++ return true;
+ }
+- return not_found(pvmw);
+- } else {
+ /* THP pmd was split under us: handle on pte level */
+ spin_unlock(pvmw->ptl);
+ pvmw->ptl = NULL;
++ } else if (!pmd_present(pmde)) {
++ /*
++ * If PVMW_SYNC, take and drop THP pmd lock so that we
++ * cannot return prematurely, while zap_huge_pmd() has
++ * cleared *pmd but not decremented compound_mapcount().
++ */
++ if ((pvmw->flags & PVMW_SYNC) &&
++ PageTransCompound(page)) {
++ spinlock_t *ptl = pmd_lock(mm, pvmw->pmd);
++
++ spin_unlock(ptl);
++ }
++ step_forward(pvmw, PMD_SIZE);
++ continue;
+ }
+- } else if (!pmd_present(pmde)) {
+- return false;
+- }
+- if (!map_pte(pvmw))
+- goto next_pte;
+- while (1) {
++ if (!map_pte(pvmw))
++ goto next_pte;
++this_pte:
+ if (check_pte(pvmw))
+ return true;
+ next_pte:
+- /* Seek to next pte only makes sense for THP */
+- if (!PageTransHuge(pvmw->page) || PageHuge(pvmw->page))
+- return not_found(pvmw);
+ do {
+ pvmw->address += PAGE_SIZE;
+- if (pvmw->address >= pvmw->vma->vm_end ||
+- pvmw->address >=
+- __vma_address(pvmw->page, pvmw->vma) +
+- hpage_nr_pages(pvmw->page) * PAGE_SIZE)
++ if (pvmw->address >= end)
+ return not_found(pvmw);
+ /* Did we cross page table boundary? */
+- if (pvmw->address % PMD_SIZE == 0) {
+- pte_unmap(pvmw->pte);
++ if ((pvmw->address & (PMD_SIZE - PAGE_SIZE)) == 0) {
+ if (pvmw->ptl) {
+ spin_unlock(pvmw->ptl);
+ pvmw->ptl = NULL;
+ }
++ pte_unmap(pvmw->pte);
++ pvmw->pte = NULL;
+ goto restart;
+- } else {
+- pvmw->pte++;
++ }
++ pvmw->pte++;
++ if ((pvmw->flags & PVMW_SYNC) && !pvmw->ptl) {
++ pvmw->ptl = pte_lockptr(mm, pvmw->pmd);
++ spin_lock(pvmw->ptl);
+ }
+ } while (pte_none(*pvmw->pte));
+
+@@ -243,7 +282,10 @@ next_pte:
+ pvmw->ptl = pte_lockptr(mm, pvmw->pmd);
+ spin_lock(pvmw->ptl);
+ }
+- }
++ goto this_pte;
++ } while (pvmw->address < end);
++
++ return false;
+ }
+
+ /**
+@@ -262,14 +304,10 @@ int page_mapped_in_vma(struct page *page, struct vm_area_struct *vma)
+ .vma = vma,
+ .flags = PVMW_SYNC,
+ };
+- unsigned long start, end;
+-
+- start = __vma_address(page, vma);
+- end = start + PAGE_SIZE * (hpage_nr_pages(page) - 1);
+
+- if (unlikely(end < vma->vm_start || start >= vma->vm_end))
++ pvmw.address = vma_address(page, vma);
++ if (pvmw.address == -EFAULT)
+ return 0;
+- pvmw.address = max(start, vma->vm_start);
+ if (!page_vma_mapped_walk(&pvmw))
+ return 0;
+ page_vma_mapped_walk_done(&pvmw);
+diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
+index cf2af04b34b97..36770fcdc3582 100644
+--- a/mm/pgtable-generic.c
++++ b/mm/pgtable-generic.c
+@@ -125,8 +125,8 @@ pmd_t pmdp_huge_clear_flush(struct vm_area_struct *vma, unsigned long address,
+ {
+ pmd_t pmd;
+ VM_BUG_ON(address & ~HPAGE_PMD_MASK);
+- VM_BUG_ON((pmd_present(*pmdp) && !pmd_trans_huge(*pmdp) &&
+- !pmd_devmap(*pmdp)) || !pmd_present(*pmdp));
++ VM_BUG_ON(pmd_present(*pmdp) && !pmd_trans_huge(*pmdp) &&
++ !pmd_devmap(*pmdp));
+ pmd = pmdp_huge_get_and_clear(vma->vm_mm, address, pmdp);
+ flush_pmd_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
+ return pmd;
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 1bd94ea62f7f1..699f445e3e78c 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -686,7 +686,6 @@ static bool should_defer_flush(struct mm_struct *mm, enum ttu_flags flags)
+ */
+ unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
+ {
+- unsigned long address;
+ if (PageAnon(page)) {
+ struct anon_vma *page__anon_vma = page_anon_vma(page);
+ /*
+@@ -696,15 +695,13 @@ unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
+ if (!vma->anon_vma || !page__anon_vma ||
+ vma->anon_vma->root != page__anon_vma->root)
+ return -EFAULT;
+- } else if (page->mapping) {
+- if (!vma->vm_file || vma->vm_file->f_mapping != page->mapping)
+- return -EFAULT;
+- } else
++ } else if (!vma->vm_file) {
+ return -EFAULT;
+- address = __vma_address(page, vma);
+- if (unlikely(address < vma->vm_start || address >= vma->vm_end))
++ } else if (vma->vm_file->f_mapping != compound_head(page)->mapping) {
+ return -EFAULT;
+- return address;
++ }
++
++ return vma_address(page, vma);
+ }
+
+ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
+@@ -896,7 +893,7 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
+ * We have to assume the worse case ie pmd for invalidation. Note that
+ * the page can not be free from this function.
+ */
+- end = min(vma->vm_end, start + (PAGE_SIZE << compound_order(page)));
++ end = vma_address_end(page, vma);
+ mmu_notifier_invalidate_range_start(vma->vm_mm, start, end);
+
+ while (page_vma_mapped_walk(&pvmw)) {
+@@ -1348,6 +1345,15 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
+ unsigned long start = address, end;
+ enum ttu_flags flags = (enum ttu_flags)arg;
+
++ /*
++ * When racing against e.g. zap_pte_range() on another cpu,
++ * in between its ptep_get_and_clear_full() and page_remove_rmap(),
++ * try_to_unmap() may return false when it is about to become true,
++ * if page table locking is skipped: use TTU_SYNC to wait for that.
++ */
++ if (flags & TTU_SYNC)
++ pvmw.flags = PVMW_SYNC;
++
+ /* munlock has nothing to gain from examining un-locked vmas */
+ if ((flags & TTU_MUNLOCK) && !(vma->vm_flags & VM_LOCKED))
+ return true;
+@@ -1369,7 +1375,8 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
+ * Note that the page can not be free in this function as call of
+ * try_to_unmap() must hold a reference on the page.
+ */
+- end = min(vma->vm_end, start + (PAGE_SIZE << compound_order(page)));
++ end = PageKsm(page) ?
++ address + PAGE_SIZE : vma_address_end(page, vma);
+ if (PageHuge(page)) {
+ /*
+ * If sharing is possible, start and end will be adjusted
+@@ -1682,9 +1689,9 @@ static bool invalid_migration_vma(struct vm_area_struct *vma, void *arg)
+ return is_vma_temporary_stack(vma);
+ }
+
+-static int page_mapcount_is_zero(struct page *page)
++static int page_not_mapped(struct page *page)
+ {
+- return !total_mapcount(page);
++ return !page_mapped(page);
+ }
+
+ /**
+@@ -1702,7 +1709,7 @@ bool try_to_unmap(struct page *page, enum ttu_flags flags)
+ struct rmap_walk_control rwc = {
+ .rmap_one = try_to_unmap_one,
+ .arg = (void *)flags,
+- .done = page_mapcount_is_zero,
++ .done = page_not_mapped,
+ .anon_lock = page_lock_anon_vma_read,
+ };
+
+@@ -1723,14 +1730,15 @@ bool try_to_unmap(struct page *page, enum ttu_flags flags)
+ else
+ rmap_walk(page, &rwc);
+
+- return !page_mapcount(page) ? true : false;
++ /*
++ * When racing against e.g. zap_pte_range() on another cpu,
++ * in between its ptep_get_and_clear_full() and page_remove_rmap(),
++ * try_to_unmap() may return false when it is about to become true,
++ * if page table locking is skipped: use TTU_SYNC to wait for that.
++ */
++ return !page_mapcount(page);
+ }
+
+-static int page_not_mapped(struct page *page)
+-{
+- return !page_mapped(page);
+-};
+-
+ /**
+ * try_to_munlock - try to munlock a page
+ * @page: the page to be munlocked
+@@ -1825,6 +1833,7 @@ static void rmap_walk_anon(struct page *page, struct rmap_walk_control *rwc,
+ struct vm_area_struct *vma = avc->vma;
+ unsigned long address = vma_address(page, vma);
+
++ VM_BUG_ON_VMA(address == -EFAULT, vma);
+ cond_resched();
+
+ if (rwc->invalid_vma && rwc->invalid_vma(vma, rwc->arg))
+@@ -1879,6 +1888,7 @@ static void rmap_walk_file(struct page *page, struct rmap_walk_control *rwc,
+ pgoff_start, pgoff_end) {
+ unsigned long address = vma_address(page, vma);
+
++ VM_BUG_ON_VMA(address == -EFAULT, vma);
+ cond_resched();
+
+ if (rwc->invalid_vma && rwc->invalid_vma(vma, rwc->arg))
+diff --git a/mm/truncate.c b/mm/truncate.c
+index 71b65aab80775..43c73db17a0a6 100644
+--- a/mm/truncate.c
++++ b/mm/truncate.c
+@@ -175,13 +175,10 @@ void do_invalidatepage(struct page *page, unsigned int offset,
+ * its lock, b) when a concurrent invalidate_mapping_pages got there first and
+ * c) when tmpfs swizzles a page between a tmpfs inode and swapper_space.
+ */
+-static void
+-truncate_cleanup_page(struct address_space *mapping, struct page *page)
++static void truncate_cleanup_page(struct page *page)
+ {
+- if (page_mapped(page)) {
+- pgoff_t nr = PageTransHuge(page) ? HPAGE_PMD_NR : 1;
+- unmap_mapping_pages(mapping, page->index, nr, false);
+- }
++ if (page_mapped(page))
++ unmap_mapping_page(page);
+
+ if (page_has_private(page))
+ do_invalidatepage(page, 0, PAGE_SIZE);
+@@ -226,7 +223,7 @@ int truncate_inode_page(struct address_space *mapping, struct page *page)
+ if (page->mapping != mapping)
+ return -EIO;
+
+- truncate_cleanup_page(mapping, page);
++ truncate_cleanup_page(page);
+ delete_from_page_cache(page);
+ return 0;
+ }
+@@ -364,7 +361,7 @@ void truncate_inode_pages_range(struct address_space *mapping,
+ pagevec_add(&locked_pvec, page);
+ }
+ for (i = 0; i < pagevec_count(&locked_pvec); i++)
+- truncate_cleanup_page(mapping, locked_pvec.pages[i]);
++ truncate_cleanup_page(locked_pvec.pages[i]);
+ delete_from_page_cache_batch(mapping, &locked_pvec);
+ for (i = 0; i < pagevec_count(&locked_pvec); i++)
+ unlock_page(locked_pvec.pages[i]);
+@@ -703,6 +700,16 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
+ continue;
+ }
+
++ if (!did_range_unmap && page_mapped(page)) {
++ /*
++ * If page is mapped, before taking its lock,
++ * zap the rest of the file in one hit.
++ */
++ unmap_mapping_pages(mapping, index,
++ (1 + end - index), false);
++ did_range_unmap = 1;
++ }
++
+ lock_page(page);
+ WARN_ON(page_to_index(page) != index);
+ if (page->mapping != mapping) {
+@@ -710,23 +717,11 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
+ continue;
+ }
+ wait_on_page_writeback(page);
+- if (page_mapped(page)) {
+- if (!did_range_unmap) {
+- /*
+- * Zap the rest of the file in one hit.
+- */
+- unmap_mapping_pages(mapping, index,
+- (1 + end - index), false);
+- did_range_unmap = 1;
+- } else {
+- /*
+- * Just zap this page
+- */
+- unmap_mapping_pages(mapping, index,
+- 1, false);
+- }
+- }
++
++ if (page_mapped(page))
++ unmap_mapping_page(page);
+ BUG_ON(page_mapped(page));
++
+ ret2 = do_launder_page(mapping, page);
+ if (ret2 == 0) {
+ if (!invalidate_complete_page2(mapping, page))
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-07-13 12:38 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-07-13 12:38 UTC (permalink / raw
To: gentoo-commits
commit: be59a203f0f686577aab1cc84b3ed543e7bfd720
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jul 13 12:38:19 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jul 13 12:38:19 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=be59a203
Update Homepage for CPU Optimization patch
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/0000_README b/0000_README
index dd8ede9..3dc1cd2 100644
--- a/0000_README
+++ b/0000_README
@@ -852,5 +852,5 @@ From: Tom Wijsman <TomWij@gentoo.org>
Desc: Add Gentoo Linux support config settings and defaults.
Patch: 5010_enable-cpu-optimizations-universal.patch
-From: https://github.com/graysky2/kernel_gcc_patch/
+From: https://github.com/graysky2/kernel_compiler_patch
Desc: Kernel 4.19-5.4 patch enables gcc = v9+ optimizations for additional CPUs.
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-07-20 15:35 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-07-20 15:35 UTC (permalink / raw
To: gentoo-commits
commit: d699a021908d23b71bb8c3c9552996776db2013f
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Tue Jul 20 15:34:22 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Tue Jul 20 15:34:43 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d699a021
Linux patch 4.19.198
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1197_linux-4.19.198.patch | 11953 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 11957 insertions(+)
diff --git a/0000_README b/0000_README
index 3dc1cd2..c6a0532 100644
--- a/0000_README
+++ b/0000_README
@@ -827,6 +827,10 @@ Patch: 1196_linux-4.19.197.patch
From: https://www.kernel.org
Desc: Linux 4.19.197
+Patch: 1197_linux-4.19.198.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.198
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1197_linux-4.19.198.patch b/1197_linux-4.19.198.patch
new file mode 100644
index 0000000..9ca735a
--- /dev/null
+++ b/1197_linux-4.19.198.patch
@@ -0,0 +1,11953 @@
+diff --git a/Documentation/ABI/testing/evm b/Documentation/ABI/testing/evm
+index 201d10319fa18..1df1177df68ad 100644
+--- a/Documentation/ABI/testing/evm
++++ b/Documentation/ABI/testing/evm
+@@ -42,8 +42,30 @@ Description:
+ modification of EVM-protected metadata and
+ disable all further modification of policy
+
+- Note that once a key has been loaded, it will no longer be
+- possible to enable metadata modification.
++ Echoing a value is additive, the new value is added to the
++ existing initialization flags.
++
++ For example, after::
++
++ echo 2 ><securityfs>/evm
++
++ another echo can be performed::
++
++ echo 1 ><securityfs>/evm
++
++ and the resulting value will be 3.
++
++ Note that once an HMAC key has been loaded, it will no longer
++ be possible to enable metadata modification. Signaling that an
++ HMAC key has been loaded will clear the corresponding flag.
++ For example, if the current value is 6 (2 and 4 set)::
++
++ echo 1 ><securityfs>/evm
++
++ will set the new value to 3 (4 cleared).
++
++ Loading an HMAC key is the only way to disable metadata
++ modification.
+
+ Until key loading has been signaled EVM can not create
+ or validate the 'security.evm' xattr, but returns
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 558332df02a84..6795e9d187d05 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -558,6 +558,12 @@
+ loops can be debugged more effectively on production
+ systems.
+
++ clocksource.max_cswd_read_retries= [KNL]
++ Number of clocksource_watchdog() retries due to
++ external delays before the clock will be marked
++ unstable. Defaults to three retries, that is,
++ four attempts to read the clock under test.
++
+ clearcpuid=BITNUM[,BITNUM...] [X86]
+ Disable CPUID feature X for the kernel. See
+ arch/x86/include/asm/cpufeatures.h for the valid bit
+diff --git a/Makefile b/Makefile
+index 42073a4c6e2e3..09688ffc3f004 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 197
++SUBLEVEL = 198
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am335x-cm-t335.dts b/arch/arm/boot/dts/am335x-cm-t335.dts
+index 947c81b7aaafb..56a04d3086c32 100644
+--- a/arch/arm/boot/dts/am335x-cm-t335.dts
++++ b/arch/arm/boot/dts/am335x-cm-t335.dts
+@@ -552,7 +552,7 @@ status = "okay";
+ status = "okay";
+ pinctrl-names = "default";
+ pinctrl-0 = <&spi0_pins>;
+- ti,pindir-d0-out-d1-in = <1>;
++ ti,pindir-d0-out-d1-in;
+ /* WLS1271 WiFi */
+ wlcore: wlcore@1 {
+ compatible = "ti,wl1271";
+diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
+index b6950eee550b2..02bbdfb3f2582 100644
+--- a/arch/arm/boot/dts/am43x-epos-evm.dts
++++ b/arch/arm/boot/dts/am43x-epos-evm.dts
+@@ -839,7 +839,7 @@
+ pinctrl-names = "default", "sleep";
+ pinctrl-0 = <&spi0_pins_default>;
+ pinctrl-1 = <&spi0_pins_sleep>;
+- ti,pindir-d0-out-d1-in = <1>;
++ ti,pindir-d0-out-d1-in;
+ };
+
+ &spi1 {
+@@ -847,7 +847,7 @@
+ pinctrl-names = "default", "sleep";
+ pinctrl-0 = <&spi1_pins_default>;
+ pinctrl-1 = <&spi1_pins_sleep>;
+- ti,pindir-d0-out-d1-in = <1>;
++ ti,pindir-d0-out-d1-in;
+ };
+
+ &usb2_phy1 {
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index c91716d5980c3..fa3422c4caec1 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -451,27 +451,27 @@
+ <0x1811b408 0x004>,
+ <0x180293a0 0x01c>;
+ reg-names = "mspi", "bspi", "intr_regs", "intr_status_reg";
+- interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>,
++ interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 78 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 77 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 78 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "spi_lr_fullness_reached",
++ <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "mspi_done",
++ "mspi_halted",
++ "spi_lr_fullness_reached",
+ "spi_lr_session_aborted",
+ "spi_lr_impatient",
+ "spi_lr_session_done",
+- "spi_lr_overhead",
+- "mspi_done",
+- "mspi_halted";
++ "spi_lr_overread";
+ clocks = <&iprocmed>;
+ clock-names = "iprocmed";
+ num-cs = <2>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- spi_nor: spi-nor@0 {
++ spi_nor: flash@0 {
+ compatible = "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <20000000>;
+diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts
+index 8f332be143f7b..abc6fb7d27259 100644
+--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts
++++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts
+@@ -22,7 +22,7 @@
+ label = "blue:heartbeat";
+ pwms = <&pwm 2 2000000 0>;
+ pwm-names = "pwm2";
+- max_brightness = <255>;
++ max-brightness = <255>;
+ linux,default-trigger = "heartbeat";
+ };
+ };
+diff --git a/arch/arm/boot/dts/exynos5422-odroidxu4.dts b/arch/arm/boot/dts/exynos5422-odroidxu4.dts
+index 122174ea9e0a3..cb00513b9dd71 100644
+--- a/arch/arm/boot/dts/exynos5422-odroidxu4.dts
++++ b/arch/arm/boot/dts/exynos5422-odroidxu4.dts
+@@ -24,7 +24,7 @@
+ label = "blue:heartbeat";
+ pwms = <&pwm 2 2000000 0>;
+ pwm-names = "pwm2";
+- max_brightness = <255>;
++ max-brightness = <255>;
+ linux,default-trigger = "heartbeat";
+ };
+ };
+diff --git a/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi b/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi
+index 56acd832f0b3c..16e1087ec7172 100644
+--- a/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi
++++ b/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi
+@@ -22,7 +22,7 @@
+ * Green LED is much brighter than the others
+ * so limit its max brightness
+ */
+- max_brightness = <127>;
++ max-brightness = <127>;
+ linux,default-trigger = "mmc0";
+ };
+
+@@ -30,7 +30,7 @@
+ label = "blue:heartbeat";
+ pwms = <&pwm 2 2000000 0>;
+ pwm-names = "pwm2";
+- max_brightness = <255>;
++ max-brightness = <255>;
+ linux,default-trigger = "heartbeat";
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+index 8d4a4cd01e07b..d5161c34a4b1c 100644
+--- a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
++++ b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi
+@@ -97,30 +97,40 @@
+ reg = <0>;
+ max-speed = <100>;
+ reset-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>;
+- reset-delay-us = <1000>;
+- reset-post-delay-us = <1000>;
++ reset-assert-us = <1000>;
++ reset-deassert-us = <1000>;
++ smsc,disable-energy-detect; /* Make plugin detection reliable */
+ };
+ };
+ };
+
+ &i2c1 {
+ clock-frequency = <100000>;
+- pinctrl-names = "default";
++ pinctrl-names = "default", "gpio";
+ pinctrl-0 = <&pinctrl_i2c1>;
++ pinctrl-1 = <&pinctrl_i2c1_gpio>;
++ scl-gpios = <&gpio3 21 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
++ sda-gpios = <&gpio3 28 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+ status = "okay";
+ };
+
+ &i2c2 {
+ clock-frequency = <100000>;
+- pinctrl-names = "default";
++ pinctrl-names = "default", "gpio";
+ pinctrl-0 = <&pinctrl_i2c2>;
++ pinctrl-1 = <&pinctrl_i2c2_gpio>;
++ scl-gpios = <&gpio4 12 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
++ sda-gpios = <&gpio4 13 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+ status = "okay";
+ };
+
+ &i2c3 {
+ clock-frequency = <100000>;
+- pinctrl-names = "default";
++ pinctrl-names = "default", "gpio";
+ pinctrl-0 = <&pinctrl_i2c3>;
++ pinctrl-1 = <&pinctrl_i2c3_gpio>;
++ scl-gpios = <&gpio1 3 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
++ sda-gpios = <&gpio1 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+ status = "okay";
+
+ ltc3676: pmic@3c {
+@@ -286,6 +296,13 @@
+ >;
+ };
+
++ pinctrl_i2c1_gpio: i2c1-gpio-grp {
++ fsl,pins = <
++ MX6QDL_PAD_EIM_D21__GPIO3_IO21 0x4001b8b1
++ MX6QDL_PAD_EIM_D28__GPIO3_IO28 0x4001b8b1
++ >;
++ };
++
+ pinctrl_i2c2: i2c2-grp {
+ fsl,pins = <
+ MX6QDL_PAD_KEY_COL3__I2C2_SCL 0x4001b8b1
+@@ -293,6 +310,13 @@
+ >;
+ };
+
++ pinctrl_i2c2_gpio: i2c2-gpio-grp {
++ fsl,pins = <
++ MX6QDL_PAD_KEY_COL3__GPIO4_IO12 0x4001b8b1
++ MX6QDL_PAD_KEY_ROW3__GPIO4_IO13 0x4001b8b1
++ >;
++ };
++
+ pinctrl_i2c3: i2c3-grp {
+ fsl,pins = <
+ MX6QDL_PAD_GPIO_3__I2C3_SCL 0x4001b8b1
+@@ -300,6 +324,13 @@
+ >;
+ };
+
++ pinctrl_i2c3_gpio: i2c3-gpio-grp {
++ fsl,pins = <
++ MX6QDL_PAD_GPIO_3__GPIO1_IO03 0x4001b8b1
++ MX6QDL_PAD_GPIO_6__GPIO1_IO06 0x4001b8b1
++ >;
++ };
++
+ pinctrl_pmic_hw300: pmic-hw300-grp {
+ fsl,pins = <
+ MX6QDL_PAD_EIM_A25__GPIO5_IO02 0x1B0B0
+diff --git a/arch/arm/boot/dts/r8a7779-marzen.dts b/arch/arm/boot/dts/r8a7779-marzen.dts
+index a4d0038363f00..84e30ed235b53 100644
+--- a/arch/arm/boot/dts/r8a7779-marzen.dts
++++ b/arch/arm/boot/dts/r8a7779-marzen.dts
+@@ -146,7 +146,7 @@
+ status = "okay";
+
+ clocks = <&mstp1_clks R8A7779_CLK_DU>, <&x3_clk>;
+- clock-names = "du", "dclkin.0";
++ clock-names = "du.0", "dclkin.0";
+
+ ports {
+ port@0 {
+diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi
+index f1c9b2bc542c5..c9695f31002a4 100644
+--- a/arch/arm/boot/dts/r8a7779.dtsi
++++ b/arch/arm/boot/dts/r8a7779.dtsi
+@@ -437,6 +437,7 @@
+ reg = <0xfff80000 0x40000>;
+ interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&mstp1_clks R8A7779_CLK_DU>;
++ clock-names = "du.0";
+ power-domains = <&sysc R8A7779_PD_ALWAYS_ON>;
+ status = "disabled";
+
+diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
+index 92a35a1942b6a..1f1d5c0559c16 100644
+--- a/arch/arm/boot/dts/sama5d4.dtsi
++++ b/arch/arm/boot/dts/sama5d4.dtsi
+@@ -1388,7 +1388,7 @@
+ 0xffffffff 0x3ffcfe7c 0x1c010101 /* pioA */
+ 0x7fffffff 0xfffccc3a 0x3f00cc3a /* pioB */
+ 0xffffffff 0x3ff83fff 0xff00ffff /* pioC */
+- 0x0003ff00 0x8002a800 0x00000000 /* pioD */
++ 0xb003ff00 0x8002a800 0x00000000 /* pioD */
+ 0xffffffff 0x7fffffff 0x76fff1bf /* pioE */
+ >;
+
+diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c
+index a4fb0f8b8f84a..443f7aed29f72 100644
+--- a/arch/arm/kernel/perf_event_v7.c
++++ b/arch/arm/kernel/perf_event_v7.c
+@@ -773,10 +773,10 @@ static inline void armv7pmu_write_counter(struct perf_event *event, u64 value)
+ pr_err("CPU%u writing wrong counter %d\n",
+ smp_processor_id(), idx);
+ } else if (idx == ARMV7_IDX_CYCLE_COUNTER) {
+- asm volatile("mcr p15, 0, %0, c9, c13, 0" : : "r" (value));
++ asm volatile("mcr p15, 0, %0, c9, c13, 0" : : "r" ((u32)value));
+ } else {
+ armv7_pmnc_select_counter(idx);
+- asm volatile("mcr p15, 0, %0, c9, c13, 2" : : "r" (value));
++ asm volatile("mcr p15, 0, %0, c9, c13, 2" : : "r" ((u32)value));
+ }
+ }
+
+diff --git a/arch/arm/probes/kprobes/test-thumb.c b/arch/arm/probes/kprobes/test-thumb.c
+index b683b4517458c..4254391f39064 100644
+--- a/arch/arm/probes/kprobes/test-thumb.c
++++ b/arch/arm/probes/kprobes/test-thumb.c
+@@ -444,21 +444,21 @@ void kprobe_thumb32_test_cases(void)
+ "3: mvn r0, r0 \n\t"
+ "2: nop \n\t")
+
+- TEST_RX("tbh [pc, r",7, (9f-(1f+4))>>1,"]",
++ TEST_RX("tbh [pc, r",7, (9f-(1f+4))>>1,", lsl #1]",
+ "9: \n\t"
+ ".short (2f-1b-4)>>1 \n\t"
+ ".short (3f-1b-4)>>1 \n\t"
+ "3: mvn r0, r0 \n\t"
+ "2: nop \n\t")
+
+- TEST_RX("tbh [pc, r",12, ((9f-(1f+4))>>1)+1,"]",
++ TEST_RX("tbh [pc, r",12, ((9f-(1f+4))>>1)+1,", lsl #1]",
+ "9: \n\t"
+ ".short (2f-1b-4)>>1 \n\t"
+ ".short (3f-1b-4)>>1 \n\t"
+ "3: mvn r0, r0 \n\t"
+ "2: nop \n\t")
+
+- TEST_RRX("tbh [r",1,9f, ", r",14,1,"]",
++ TEST_RRX("tbh [r",1,9f, ", r",14,1,", lsl #1]",
+ "9: \n\t"
+ ".short (2f-1b-4)>>1 \n\t"
+ ".short (3f-1b-4)>>1 \n\t"
+@@ -471,10 +471,10 @@ void kprobe_thumb32_test_cases(void)
+
+ TEST_UNSUPPORTED("strexb r0, r1, [r2]")
+ TEST_UNSUPPORTED("strexh r0, r1, [r2]")
+- TEST_UNSUPPORTED("strexd r0, r1, [r2]")
++ TEST_UNSUPPORTED("strexd r0, r1, r2, [r2]")
+ TEST_UNSUPPORTED("ldrexb r0, [r1]")
+ TEST_UNSUPPORTED("ldrexh r0, [r1]")
+- TEST_UNSUPPORTED("ldrexd r0, [r1]")
++ TEST_UNSUPPORTED("ldrexd r0, r1, [r1]")
+
+ TEST_GROUP("Data-processing (shifted register) and (modified immediate)")
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+index 3a611250f598d..1844fb8605f03 100644
+--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+@@ -121,7 +121,7 @@
+
+ uart0: serial@12000 {
+ compatible = "marvell,armada-3700-uart";
+- reg = <0x12000 0x200>;
++ reg = <0x12000 0x18>;
+ clocks = <&xtalclk>;
+ interrupts =
+ <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+diff --git a/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts b/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts
+index 8eac8ca6550b8..d8768c6bdfee3 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts
+@@ -24,7 +24,7 @@
+ memory@48000000 {
+ device_type = "memory";
+ /* first 128MB is reserved for secure area. */
+- reg = <0x0 0x48000000 0x0 0x38000000>;
++ reg = <0x0 0x48000000 0x0 0x78000000>;
+ };
+
+ osc5_clk: osc5-clock {
+diff --git a/arch/hexagon/kernel/vmlinux.lds.S b/arch/hexagon/kernel/vmlinux.lds.S
+index ad69d181c9393..757f9554118e8 100644
+--- a/arch/hexagon/kernel/vmlinux.lds.S
++++ b/arch/hexagon/kernel/vmlinux.lds.S
+@@ -73,13 +73,8 @@ SECTIONS
+
+ _end = .;
+
+- /DISCARD/ : {
+- EXIT_TEXT
+- EXIT_DATA
+- EXIT_CALL
+- }
+-
+ STABS_DEBUG
+ DWARF_DEBUG
+
++ DISCARDS
+ }
+diff --git a/arch/ia64/kernel/mca_drv.c b/arch/ia64/kernel/mca_drv.c
+index dfe40cbdf3b39..06419a95af309 100644
+--- a/arch/ia64/kernel/mca_drv.c
++++ b/arch/ia64/kernel/mca_drv.c
+@@ -343,7 +343,7 @@ init_record_index_pools(void)
+
+ /* - 2 - */
+ sect_min_size = sal_log_sect_min_sizes[0];
+- for (i = 1; i < sizeof sal_log_sect_min_sizes/sizeof(size_t); i++)
++ for (i = 1; i < ARRAY_SIZE(sal_log_sect_min_sizes); i++)
+ if (sect_min_size > sal_log_sect_min_sizes[i])
+ sect_min_size = sal_log_sect_min_sizes[i];
+
+diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
+index 378cbfb31ee70..1d6ebbc2a5d02 100644
+--- a/arch/mips/boot/compressed/Makefile
++++ b/arch/mips/boot/compressed/Makefile
+@@ -33,7 +33,7 @@ KBUILD_AFLAGS := $(KBUILD_AFLAGS) -D__ASSEMBLY__ \
+ KCOV_INSTRUMENT := n
+
+ # decompressor objects (linked with vmlinuz)
+-vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o
++vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o $(obj)/bswapsi.o
+
+ ifdef CONFIG_DEBUG_ZBOOT
+ vmlinuzobjs-$(CONFIG_DEBUG_ZBOOT) += $(obj)/dbg.o
+@@ -47,7 +47,7 @@ extra-y += uart-ath79.c
+ $(obj)/uart-ath79.c: $(srctree)/arch/mips/ath79/early_printk.c
+ $(call cmd,shipped)
+
+-vmlinuzobjs-$(CONFIG_KERNEL_XZ) += $(obj)/ashldi3.o $(obj)/bswapsi.o
++vmlinuzobjs-$(CONFIG_KERNEL_XZ) += $(obj)/ashldi3.o
+
+ extra-y += ashldi3.c
+ $(obj)/ashldi3.c: $(obj)/%.c: $(srctree)/lib/%.c FORCE
+diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c
+index 40218be0b7ce8..6403a65f30b9d 100644
+--- a/arch/mips/boot/compressed/decompress.c
++++ b/arch/mips/boot/compressed/decompress.c
+@@ -11,6 +11,8 @@
+ * option) any later version.
+ */
+
++#define DISABLE_BRANCH_PROFILING
++
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/string.h>
+diff --git a/arch/mips/include/asm/hugetlb.h b/arch/mips/include/asm/hugetlb.h
+index 982bc06853302..4747a46946699 100644
+--- a/arch/mips/include/asm/hugetlb.h
++++ b/arch/mips/include/asm/hugetlb.h
+@@ -67,7 +67,13 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+ static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
+ unsigned long addr, pte_t *ptep)
+ {
+- flush_tlb_page(vma, addr & huge_page_mask(hstate_vma(vma)));
++ /*
++ * clear the huge pte entry firstly, so that the other smp threads will
++ * not get old pte entry after finishing flush_tlb_page and before
++ * setting new huge pte entry
++ */
++ huge_ptep_get_and_clear(vma->vm_mm, addr, ptep);
++ flush_tlb_page(vma, addr);
+ }
+
+ static inline int huge_pte_none(pte_t pte)
+diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
+index f9a7c137be9f2..c8333782a6706 100644
+--- a/arch/mips/include/asm/mipsregs.h
++++ b/arch/mips/include/asm/mipsregs.h
+@@ -1986,7 +1986,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c)
+ ({ int __res; \
+ __asm__ __volatile__( \
+ ".set\tpush\n\t" \
+- ".set\tmips32r2\n\t" \
++ ".set\tmips32r5\n\t" \
+ _ASM_SET_VIRT \
+ "mfgc0\t%0, " #source ", %1\n\t" \
+ ".set\tpop" \
+@@ -1999,7 +1999,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c)
+ ({ unsigned long long __res; \
+ __asm__ __volatile__( \
+ ".set\tpush\n\t" \
+- ".set\tmips64r2\n\t" \
++ ".set\tmips64r5\n\t" \
+ _ASM_SET_VIRT \
+ "dmfgc0\t%0, " #source ", %1\n\t" \
+ ".set\tpop" \
+@@ -2012,7 +2012,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c)
+ do { \
+ __asm__ __volatile__( \
+ ".set\tpush\n\t" \
+- ".set\tmips32r2\n\t" \
++ ".set\tmips32r5\n\t" \
+ _ASM_SET_VIRT \
+ "mtgc0\t%z0, " #register ", %1\n\t" \
+ ".set\tpop" \
+@@ -2024,7 +2024,7 @@ do { \
+ do { \
+ __asm__ __volatile__( \
+ ".set\tpush\n\t" \
+- ".set\tmips64r2\n\t" \
++ ".set\tmips64r5\n\t" \
+ _ASM_SET_VIRT \
+ "dmtgc0\t%z0, " #register ", %1\n\t" \
+ ".set\tpop" \
+diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
+index 39b9f311c4ef4..f800872f867b2 100644
+--- a/arch/mips/include/asm/pgalloc.h
++++ b/arch/mips/include/asm/pgalloc.h
+@@ -93,11 +93,15 @@ do { \
+
+ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
+ {
+- pmd_t *pmd;
++ pmd_t *pmd = NULL;
++ struct page *pg;
+
+- pmd = (pmd_t *) __get_free_pages(GFP_KERNEL, PMD_ORDER);
+- if (pmd)
++ pg = alloc_pages(GFP_KERNEL | __GFP_ACCOUNT, PMD_ORDER);
++ if (pg) {
++ pgtable_pmd_page_ctor(pg);
++ pmd = (pmd_t *)page_address(pg);
+ pmd_init((unsigned long)pmd, (unsigned long)invalid_pte_table);
++ }
+ return pmd;
+ }
+
+diff --git a/arch/mips/vdso/vdso.h b/arch/mips/vdso/vdso.h
+index cfb1be441decc..921589b45bc20 100644
+--- a/arch/mips/vdso/vdso.h
++++ b/arch/mips/vdso/vdso.h
+@@ -81,7 +81,7 @@ static inline const union mips_vdso_data *get_vdso_data(void)
+
+ static inline void __iomem *get_gic(const union mips_vdso_data *data)
+ {
+- return (void __iomem *)data - PAGE_SIZE;
++ return (void __iomem *)((unsigned long)data & PAGE_MASK) - PAGE_SIZE;
+ }
+
+ #endif /* CONFIG_CLKSRC_MIPS_GIC */
+diff --git a/arch/powerpc/boot/devtree.c b/arch/powerpc/boot/devtree.c
+index a7e21a35c03af..27c84b82b588e 100644
+--- a/arch/powerpc/boot/devtree.c
++++ b/arch/powerpc/boot/devtree.c
+@@ -17,6 +17,7 @@
+ #include "string.h"
+ #include "stdio.h"
+ #include "ops.h"
++#include "of.h"
+
+ void dt_fixup_memory(u64 start, u64 size)
+ {
+@@ -27,21 +28,25 @@ void dt_fixup_memory(u64 start, u64 size)
+ root = finddevice("/");
+ if (getprop(root, "#address-cells", &naddr, sizeof(naddr)) < 0)
+ naddr = 2;
++ else
++ naddr = be32_to_cpu(naddr);
+ if (naddr < 1 || naddr > 2)
+ fatal("Can't cope with #address-cells == %d in /\n\r", naddr);
+
+ if (getprop(root, "#size-cells", &nsize, sizeof(nsize)) < 0)
+ nsize = 1;
++ else
++ nsize = be32_to_cpu(nsize);
+ if (nsize < 1 || nsize > 2)
+ fatal("Can't cope with #size-cells == %d in /\n\r", nsize);
+
+ i = 0;
+ if (naddr == 2)
+- memreg[i++] = start >> 32;
+- memreg[i++] = start & 0xffffffff;
++ memreg[i++] = cpu_to_be32(start >> 32);
++ memreg[i++] = cpu_to_be32(start & 0xffffffff);
+ if (nsize == 2)
+- memreg[i++] = size >> 32;
+- memreg[i++] = size & 0xffffffff;
++ memreg[i++] = cpu_to_be32(size >> 32);
++ memreg[i++] = cpu_to_be32(size & 0xffffffff);
+
+ memory = finddevice("/memory");
+ if (! memory) {
+@@ -49,9 +54,9 @@ void dt_fixup_memory(u64 start, u64 size)
+ setprop_str(memory, "device_type", "memory");
+ }
+
+- printf("Memory <- <0x%x", memreg[0]);
++ printf("Memory <- <0x%x", be32_to_cpu(memreg[0]));
+ for (i = 1; i < (naddr + nsize); i++)
+- printf(" 0x%x", memreg[i]);
++ printf(" 0x%x", be32_to_cpu(memreg[i]));
+ printf("> (%ldMB)\n\r", (unsigned long)(size >> 20));
+
+ setprop(memory, "reg", memreg, (naddr + nsize)*sizeof(u32));
+@@ -69,10 +74,10 @@ void dt_fixup_cpu_clocks(u32 cpu, u32 tb, u32 bus)
+ printf("CPU bus-frequency <- 0x%x (%dMHz)\n\r", bus, MHZ(bus));
+
+ while ((devp = find_node_by_devtype(devp, "cpu"))) {
+- setprop_val(devp, "clock-frequency", cpu);
+- setprop_val(devp, "timebase-frequency", tb);
++ setprop_val(devp, "clock-frequency", cpu_to_be32(cpu));
++ setprop_val(devp, "timebase-frequency", cpu_to_be32(tb));
+ if (bus > 0)
+- setprop_val(devp, "bus-frequency", bus);
++ setprop_val(devp, "bus-frequency", cpu_to_be32(bus));
+ }
+
+ timebase_period_ns = 1000000000 / tb;
+@@ -84,7 +89,7 @@ void dt_fixup_clock(const char *path, u32 freq)
+
+ if (devp) {
+ printf("%s: clock-frequency <- %x (%dMHz)\n\r", path, freq, MHZ(freq));
+- setprop_val(devp, "clock-frequency", freq);
++ setprop_val(devp, "clock-frequency", cpu_to_be32(freq));
+ }
+ }
+
+@@ -137,8 +142,12 @@ void dt_get_reg_format(void *node, u32 *naddr, u32 *nsize)
+ {
+ if (getprop(node, "#address-cells", naddr, 4) != 4)
+ *naddr = 2;
++ else
++ *naddr = be32_to_cpu(*naddr);
+ if (getprop(node, "#size-cells", nsize, 4) != 4)
+ *nsize = 1;
++ else
++ *nsize = be32_to_cpu(*nsize);
+ }
+
+ static void copy_val(u32 *dest, u32 *src, int naddr)
+@@ -167,9 +176,9 @@ static int add_reg(u32 *reg, u32 *add, int naddr)
+ int i, carry = 0;
+
+ for (i = MAX_ADDR_CELLS - 1; i >= MAX_ADDR_CELLS - naddr; i--) {
+- u64 tmp = (u64)reg[i] + add[i] + carry;
++ u64 tmp = (u64)be32_to_cpu(reg[i]) + be32_to_cpu(add[i]) + carry;
+ carry = tmp >> 32;
+- reg[i] = (u32)tmp;
++ reg[i] = cpu_to_be32((u32)tmp);
+ }
+
+ return !carry;
+@@ -184,18 +193,18 @@ static int compare_reg(u32 *reg, u32 *range, u32 *rangesize)
+ u32 end;
+
+ for (i = 0; i < MAX_ADDR_CELLS; i++) {
+- if (reg[i] < range[i])
++ if (be32_to_cpu(reg[i]) < be32_to_cpu(range[i]))
+ return 0;
+- if (reg[i] > range[i])
++ if (be32_to_cpu(reg[i]) > be32_to_cpu(range[i]))
+ break;
+ }
+
+ for (i = 0; i < MAX_ADDR_CELLS; i++) {
+- end = range[i] + rangesize[i];
++ end = be32_to_cpu(range[i]) + be32_to_cpu(rangesize[i]);
+
+- if (reg[i] < end)
++ if (be32_to_cpu(reg[i]) < end)
+ break;
+- if (reg[i] > end)
++ if (be32_to_cpu(reg[i]) > end)
+ return 0;
+ }
+
+@@ -244,7 +253,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
+ return 0;
+
+ dt_get_reg_format(parent, &naddr, &nsize);
+-
+ if (nsize > 2)
+ return 0;
+
+@@ -256,10 +264,10 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
+
+ copy_val(last_addr, prop_buf + offset, naddr);
+
+- ret_size = prop_buf[offset + naddr];
++ ret_size = be32_to_cpu(prop_buf[offset + naddr]);
+ if (nsize == 2) {
+ ret_size <<= 32;
+- ret_size |= prop_buf[offset + naddr + 1];
++ ret_size |= be32_to_cpu(prop_buf[offset + naddr + 1]);
+ }
+
+ for (;;) {
+@@ -282,7 +290,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
+
+ offset = find_range(last_addr, prop_buf, prev_naddr,
+ naddr, prev_nsize, buflen / 4);
+-
+ if (offset < 0)
+ return 0;
+
+@@ -300,8 +307,7 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr,
+ if (naddr > 2)
+ return 0;
+
+- ret_addr = ((u64)last_addr[2] << 32) | last_addr[3];
+-
++ ret_addr = ((u64)be32_to_cpu(last_addr[2]) << 32) | be32_to_cpu(last_addr[3]);
+ if (sizeof(void *) == 4 &&
+ (ret_addr >= 0x100000000ULL || ret_size > 0x100000000ULL ||
+ ret_addr + ret_size > 0x100000000ULL))
+@@ -354,11 +360,14 @@ int dt_is_compatible(void *node, const char *compat)
+ int dt_get_virtual_reg(void *node, void **addr, int nres)
+ {
+ unsigned long xaddr;
+- int n;
++ int n, i;
+
+ n = getprop(node, "virtual-reg", addr, nres * 4);
+- if (n > 0)
++ if (n > 0) {
++ for (i = 0; i < n/4; i ++)
++ ((u32 *)addr)[i] = be32_to_cpu(((u32 *)addr)[i]);
+ return n / 4;
++ }
+
+ for (n = 0; n < nres; n++) {
+ if (!dt_xlate_reg(node, n, &xaddr, NULL))
+diff --git a/arch/powerpc/boot/ns16550.c b/arch/powerpc/boot/ns16550.c
+index b0da4466d4198..f16d2be1d0f31 100644
+--- a/arch/powerpc/boot/ns16550.c
++++ b/arch/powerpc/boot/ns16550.c
+@@ -15,6 +15,7 @@
+ #include "stdio.h"
+ #include "io.h"
+ #include "ops.h"
++#include "of.h"
+
+ #define UART_DLL 0 /* Out: Divisor Latch Low */
+ #define UART_DLM 1 /* Out: Divisor Latch High */
+@@ -58,16 +59,20 @@ int ns16550_console_init(void *devp, struct serial_console_data *scdp)
+ int n;
+ u32 reg_offset;
+
+- if (dt_get_virtual_reg(devp, (void **)®_base, 1) < 1)
++ if (dt_get_virtual_reg(devp, (void **)®_base, 1) < 1) {
++ printf("virt reg parse fail...\r\n");
+ return -1;
++ }
+
+ n = getprop(devp, "reg-offset", ®_offset, sizeof(reg_offset));
+ if (n == sizeof(reg_offset))
+- reg_base += reg_offset;
++ reg_base += be32_to_cpu(reg_offset);
+
+ n = getprop(devp, "reg-shift", ®_shift, sizeof(reg_shift));
+ if (n != sizeof(reg_shift))
+ reg_shift = 0;
++ else
++ reg_shift = be32_to_cpu(reg_shift);
+
+ scdp->open = ns16550_open;
+ scdp->putc = ns16550_putc;
+diff --git a/arch/powerpc/include/asm/barrier.h b/arch/powerpc/include/asm/barrier.h
+index fbe8df4330190..dc953d22e3c68 100644
+--- a/arch/powerpc/include/asm/barrier.h
++++ b/arch/powerpc/include/asm/barrier.h
+@@ -44,6 +44,8 @@
+ # define SMPWMB eieio
+ #endif
+
++/* clang defines this macro for a builtin, which will not work with runtime patching */
++#undef __lwsync
+ #define __lwsync() __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory")
+ #define dma_rmb() __lwsync()
+ #define dma_wmb() __asm__ __volatile__ (stringify_in_c(SMPWMB) : : :"memory")
+diff --git a/arch/powerpc/include/asm/ps3.h b/arch/powerpc/include/asm/ps3.h
+index 17ee719e799fa..013d24d246d63 100644
+--- a/arch/powerpc/include/asm/ps3.h
++++ b/arch/powerpc/include/asm/ps3.h
+@@ -83,6 +83,7 @@ struct ps3_dma_region_ops;
+ * @bus_addr: The 'translated' bus address of the region.
+ * @len: The length in bytes of the region.
+ * @offset: The offset from the start of memory of the region.
++ * @dma_mask: Device dma_mask.
+ * @ioid: The IOID of the device who owns this region
+ * @chunk_list: Opaque variable used by the ioc page manager.
+ * @region_ops: struct ps3_dma_region_ops - dma region operations
+@@ -97,6 +98,7 @@ struct ps3_dma_region {
+ enum ps3_dma_region_type region_type;
+ unsigned long len;
+ unsigned long offset;
++ u64 dma_mask;
+
+ /* driver variables (set by ps3_dma_region_create) */
+ unsigned long bus_addr;
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index a9ec4467705ca..14adfeacfa46e 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -570,6 +570,8 @@ static void nmi_stop_this_cpu(struct pt_regs *regs)
+ /*
+ * IRQs are already hard disabled by the smp_handle_nmi_ipi.
+ */
++ set_cpu_online(smp_processor_id(), false);
++
+ spin_begin();
+ while (1)
+ spin_cpu_relax();
+@@ -585,6 +587,15 @@ void smp_send_stop(void)
+ static void stop_this_cpu(void *dummy)
+ {
+ hard_irq_disable();
++
++ /*
++ * Offlining CPUs in stop_this_cpu can result in scheduler warnings,
++ * (see commit de6e5d38417e), but printk_safe_flush_on_panic() wants
++ * to know other CPUs are offline before it breaks locks to flush
++ * printk buffers, in case we panic()ed while holding the lock.
++ */
++ set_cpu_online(smp_processor_id(), false);
++
+ spin_begin();
+ while (1)
+ spin_cpu_relax();
+diff --git a/arch/powerpc/kernel/stacktrace.c b/arch/powerpc/kernel/stacktrace.c
+index e2c50b55138f8..23b5f755e419b 100644
+--- a/arch/powerpc/kernel/stacktrace.c
++++ b/arch/powerpc/kernel/stacktrace.c
+@@ -19,6 +19,7 @@
+ #include <asm/ptrace.h>
+ #include <asm/processor.h>
+ #include <linux/ftrace.h>
++#include <linux/delay.h>
+ #include <asm/kprobes.h>
+
+ #include <asm/paca.h>
+@@ -204,17 +205,31 @@ static void handle_backtrace_ipi(struct pt_regs *regs)
+
+ static void raise_backtrace_ipi(cpumask_t *mask)
+ {
++ struct paca_struct *p;
+ unsigned int cpu;
++ u64 delay_us;
+
+ for_each_cpu(cpu, mask) {
+- if (cpu == smp_processor_id())
++ if (cpu == smp_processor_id()) {
+ handle_backtrace_ipi(NULL);
+- else
+- smp_send_safe_nmi_ipi(cpu, handle_backtrace_ipi, 5 * USEC_PER_SEC);
+- }
++ continue;
++ }
+
+- for_each_cpu(cpu, mask) {
+- struct paca_struct *p = paca_ptrs[cpu];
++ delay_us = 5 * USEC_PER_SEC;
++
++ if (smp_send_safe_nmi_ipi(cpu, handle_backtrace_ipi, delay_us)) {
++ // Now wait up to 5s for the other CPU to do its backtrace
++ while (cpumask_test_cpu(cpu, mask) && delay_us) {
++ udelay(1);
++ delay_us--;
++ }
++
++ // Other CPU cleared itself from the mask
++ if (delay_us)
++ continue;
++ }
++
++ p = paca_ptrs[cpu];
+
+ cpumask_clear_cpu(cpu, mask);
+
+diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c
+index 894f62d77a777..12ed80850a436 100644
+--- a/arch/powerpc/platforms/ps3/mm.c
++++ b/arch/powerpc/platforms/ps3/mm.c
+@@ -18,6 +18,7 @@
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
++#include <linux/dma-mapping.h>
+ #include <linux/kernel.h>
+ #include <linux/export.h>
+ #include <linux/memblock.h>
+@@ -1130,6 +1131,7 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev,
+ enum ps3_dma_region_type region_type, void *addr, unsigned long len)
+ {
+ unsigned long lpar_addr;
++ int result;
+
+ lpar_addr = addr ? ps3_mm_phys_to_lpar(__pa(addr)) : 0;
+
+@@ -1141,6 +1143,16 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev,
+ r->offset -= map.r1.offset;
+ r->len = len ? len : _ALIGN_UP(map.total, 1 << r->page_size);
+
++ dev->core.dma_mask = &r->dma_mask;
++
++ result = dma_set_mask_and_coherent(&dev->core, DMA_BIT_MASK(32));
++
++ if (result < 0) {
++ dev_err(&dev->core, "%s:%d: dma_set_mask_and_coherent failed: %d\n",
++ __func__, __LINE__, result);
++ return result;
++ }
++
+ switch (dev->dev_type) {
+ case PS3_DEVICE_TYPE_SB:
+ r->region_ops = (USE_DYNAMIC_DMA)
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index 9a9c7a6fe9259..ce4c3b659f70c 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -867,7 +867,7 @@ config CMM_IUCV
+ config APPLDATA_BASE
+ def_bool n
+ prompt "Linux - VM Monitor Stream, base infrastructure"
+- depends on PROC_FS
++ depends on PROC_SYSCTL
+ help
+ This provides a kernel interface for creating and updating z/VM APPLDATA
+ monitor records. The monitor records are updated at certain time
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 4bda9055daefa..e8bfd29bb1f9f 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -141,7 +141,7 @@ static void __init set_preferred_console(void)
+ else if (CONSOLE_IS_3270)
+ add_preferred_console("tty3270", 0, NULL);
+ else if (CONSOLE_IS_VT220)
+- add_preferred_console("ttyS", 1, NULL);
++ add_preferred_console("ttysclp", 0, NULL);
+ else if (CONSOLE_IS_HVC)
+ add_preferred_console("hvc", 0, NULL);
+ }
+diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
+index 9cffbbb15c569..669124d5290b8 100644
+--- a/arch/um/drivers/chan_user.c
++++ b/arch/um/drivers/chan_user.c
+@@ -256,7 +256,8 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out,
+ goto out_close;
+ }
+
+- if (os_set_fd_block(*fd_out, 0)) {
++ err = os_set_fd_block(*fd_out, 0);
++ if (err) {
+ printk(UM_KERN_ERR "winch_tramp: failed to set thread_fd "
+ "non-blocking.\n");
+ goto out_close;
+diff --git a/arch/um/drivers/slip_user.c b/arch/um/drivers/slip_user.c
+index 0d6b66c64a813..76d155631c5d7 100644
+--- a/arch/um/drivers/slip_user.c
++++ b/arch/um/drivers/slip_user.c
+@@ -145,7 +145,8 @@ static int slip_open(void *data)
+ }
+ sfd = err;
+
+- if (set_up_tty(sfd))
++ err = set_up_tty(sfd);
++ if (err)
+ goto out_close2;
+
+ pri->slave = sfd;
+diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
+index fa2c93cb42a27..b8c935033d210 100644
+--- a/arch/x86/include/asm/fpu/internal.h
++++ b/arch/x86/include/asm/fpu/internal.h
+@@ -103,6 +103,7 @@ static inline void fpstate_init_fxstate(struct fxregs_state *fx)
+ }
+ extern void fpstate_sanitize_xstate(struct fpu *fpu);
+
++/* Returns 0 or the negated trap number, which results in -EFAULT for #PF */
+ #define user_insn(insn, output, input...) \
+ ({ \
+ int err; \
+@@ -110,14 +111,14 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu);
+ might_fault(); \
+ \
+ asm volatile(ASM_STAC "\n" \
+- "1:" #insn "\n\t" \
++ "1: " #insn "\n" \
+ "2: " ASM_CLAC "\n" \
+ ".section .fixup,\"ax\"\n" \
+- "3: movl $-1,%[err]\n" \
++ "3: negl %%eax\n" \
+ " jmp 2b\n" \
+ ".previous\n" \
+- _ASM_EXTABLE(1b, 3b) \
+- : [err] "=r" (err), output \
++ _ASM_EXTABLE_FAULT(1b, 3b) \
++ : [err] "=a" (err), output \
+ : "0"(0), input); \
+ err; \
+ })
+@@ -221,16 +222,20 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
+ #define XRSTOR ".byte " REX_PREFIX "0x0f,0xae,0x2f"
+ #define XRSTORS ".byte " REX_PREFIX "0x0f,0xc7,0x1f"
+
++/*
++ * After this @err contains 0 on success or the negated trap number when
++ * the operation raises an exception. For faults this results in -EFAULT.
++ */
+ #define XSTATE_OP(op, st, lmask, hmask, err) \
+ asm volatile("1:" op "\n\t" \
+ "xor %[err], %[err]\n" \
+ "2:\n\t" \
+ ".pushsection .fixup,\"ax\"\n\t" \
+- "3: movl $-2,%[err]\n\t" \
++ "3: negl %%eax\n\t" \
+ "jmp 2b\n\t" \
+ ".popsection\n\t" \
+- _ASM_EXTABLE(1b, 3b) \
+- : [err] "=r" (err) \
++ _ASM_EXTABLE_FAULT(1b, 3b) \
++ : [err] "=a" (err) \
+ : "D" (st), "m" (*st), "a" (lmask), "d" (hmask) \
+ : "memory")
+
+diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c
+index bc02f5144b958..621d249ded0b9 100644
+--- a/arch/x86/kernel/fpu/regset.c
++++ b/arch/x86/kernel/fpu/regset.c
+@@ -128,7 +128,7 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset,
+ /*
+ * A whole standard-format XSAVE buffer is needed:
+ */
+- if ((pos != 0) || (count < fpu_user_xstate_size))
++ if (pos != 0 || count != fpu_user_xstate_size)
+ return -EFAULT;
+
+ xsave = &fpu->state.xsave;
+diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
+index 1fe9ccabc082a..097eef712cdc0 100644
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -666,8 +666,14 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ unsigned virt_as = max((entry->eax >> 8) & 0xff, 48U);
+ unsigned phys_as = entry->eax & 0xff;
+
+- if (!g_phys_as)
++ /*
++ * Use bare metal's MAXPHADDR if the CPU doesn't report guest
++ * MAXPHYADDR separately, or if TDP (NPT) is disabled, as the
++ * guest version "applies only to guests using nested paging".
++ */
++ if (!g_phys_as || !tdp_enabled)
+ g_phys_as = phys_as;
++
+ entry->eax = g_phys_as | (virt_as << 8);
+ entry->edx = 0;
+ /*
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 435e74e1f2e54..43fb4e296d8de 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -7772,6 +7772,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ set_debugreg(vcpu->arch.eff_db[3], 3);
+ set_debugreg(vcpu->arch.dr6, 6);
+ vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_RELOAD;
++ } else if (unlikely(hw_breakpoint_active())) {
++ set_debugreg(0, 7);
+ }
+
+ kvm_x86_ops->run(vcpu);
+diff --git a/block/blk-wbt.c b/block/blk-wbt.c
+index 50f2abfa1a60e..880a41adde8f4 100644
+--- a/block/blk-wbt.c
++++ b/block/blk-wbt.c
+@@ -76,7 +76,8 @@ enum {
+
+ static inline bool rwb_enabled(struct rq_wb *rwb)
+ {
+- return rwb && rwb->wb_normal != 0;
++ return rwb && rwb->enable_state != WBT_STATE_OFF_DEFAULT &&
++ rwb->wb_normal != 0;
+ }
+
+ static void wb_timestamp(struct rq_wb *rwb, unsigned long *var)
+@@ -703,9 +704,13 @@ void wbt_set_write_cache(struct request_queue *q, bool write_cache_on)
+ void wbt_enable_default(struct request_queue *q)
+ {
+ struct rq_qos *rqos = wbt_rq_qos(q);
++
+ /* Throttling already enabled? */
+- if (rqos)
++ if (rqos) {
++ if (RQWB(rqos)->enable_state == WBT_STATE_OFF_DEFAULT)
++ RQWB(rqos)->enable_state = WBT_STATE_ON_DEFAULT;
+ return;
++ }
+
+ /* Queue not registered? Maybe shutting down... */
+ if (!blk_queue_registered(q))
+@@ -764,7 +769,7 @@ void wbt_disable_default(struct request_queue *q)
+ rwb = RQWB(rqos);
+ if (rwb->enable_state == WBT_STATE_ON_DEFAULT) {
+ blk_stat_deactivate(rwb->cb);
+- rwb->wb_normal = 0;
++ rwb->enable_state = WBT_STATE_OFF_DEFAULT;
+ }
+ }
+ EXPORT_SYMBOL_GPL(wbt_disable_default);
+diff --git a/block/blk-wbt.h b/block/blk-wbt.h
+index f47218d5b3b20..dd0d0f297d1e0 100644
+--- a/block/blk-wbt.h
++++ b/block/blk-wbt.h
+@@ -34,6 +34,7 @@ enum {
+ enum {
+ WBT_STATE_ON_DEFAULT = 1,
+ WBT_STATE_ON_MANUAL = 2,
++ WBT_STATE_OFF_DEFAULT
+ };
+
+ struct rq_wb {
+diff --git a/crypto/shash.c b/crypto/shash.c
+index a04145e5306a5..55e7a2f63b340 100644
+--- a/crypto/shash.c
++++ b/crypto/shash.c
+@@ -25,12 +25,24 @@
+
+ static const struct crypto_type crypto_shash_type;
+
+-int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
+- unsigned int keylen)
++static int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
++ unsigned int keylen)
+ {
+ return -ENOSYS;
+ }
+-EXPORT_SYMBOL_GPL(shash_no_setkey);
++
++/*
++ * Check whether an shash algorithm has a setkey function.
++ *
++ * For CFI compatibility, this must not be an inline function. This is because
++ * when CFI is enabled, modules won't get the same address for shash_no_setkey
++ * (if it were exported, which inlining would require) as the core kernel will.
++ */
++bool crypto_shash_alg_has_setkey(struct shash_alg *alg)
++{
++ return alg->setkey != shash_no_setkey;
++}
++EXPORT_SYMBOL_GPL(crypto_shash_alg_has_setkey);
+
+ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key,
+ unsigned int keylen)
+diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
+index 6d59aa109a91a..93f667140d8a7 100644
+--- a/drivers/acpi/Makefile
++++ b/drivers/acpi/Makefile
+@@ -8,6 +8,11 @@ ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT
+ #
+ # ACPI Boot-Time Table Parsing
+ #
++ifeq ($(CONFIG_ACPI_CUSTOM_DSDT),y)
++tables.o: $(src)/../../include/$(subst $\",,$(CONFIG_ACPI_CUSTOM_DSDT_FILE)) ;
++
++endif
++
+ obj-$(CONFIG_ACPI) += tables.o
+ obj-$(CONFIG_X86) += blacklist.o
+
+diff --git a/drivers/acpi/acpi_amba.c b/drivers/acpi/acpi_amba.c
+index 7f77c071709a7..eb09ee71ceb2e 100644
+--- a/drivers/acpi/acpi_amba.c
++++ b/drivers/acpi/acpi_amba.c
+@@ -70,6 +70,7 @@ static int amba_handler_attach(struct acpi_device *adev,
+ case IORESOURCE_MEM:
+ if (!address_found) {
+ dev->res = *rentry->res;
++ dev->res.name = dev_name(&dev->dev);
+ address_found = true;
+ }
+ break;
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index 1a23e7aa74df7..ac54fc03cf819 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -556,6 +556,15 @@ static const struct dmi_system_id video_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V131"),
+ },
+ },
++ {
++ .callback = video_set_report_key_events,
++ .driver_data = (void *)((uintptr_t)REPORT_BRIGHTNESS_KEY_EVENTS),
++ .ident = "Dell Vostro 3350",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3350"),
++ },
++ },
+ /*
+ * Some machines change the brightness themselves when a brightness
+ * hotkey gets pressed, despite us telling them not to. In this case
+diff --git a/drivers/acpi/acpica/nsrepair2.c b/drivers/acpi/acpica/nsrepair2.c
+index a3bd6280882c3..4c8ce483805d8 100644
+--- a/drivers/acpi/acpica/nsrepair2.c
++++ b/drivers/acpi/acpica/nsrepair2.c
+@@ -375,6 +375,13 @@ acpi_ns_repair_CID(struct acpi_evaluate_info *info,
+
+ (*element_ptr)->common.reference_count =
+ original_ref_count;
++
++ /*
++ * The original_element holds a reference from the package object
++ * that represents _HID. Since a new element was created by _HID,
++ * remove the reference from the _CID package.
++ */
++ acpi_ut_remove_reference(original_element);
+ }
+
+ element_ptr++;
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index d60e57d14c859..d9dc9d2f38d56 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -1240,6 +1240,7 @@ static int __init acpi_init(void)
+ init_acpi_device_notify();
+ result = acpi_bus_init();
+ if (result) {
++ kobject_put(acpi_kobj);
+ disable_acpi();
+ return result;
+ }
+diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
+index b3b92c54cba8d..f792b149a5745 100644
+--- a/drivers/acpi/device_sysfs.c
++++ b/drivers/acpi/device_sysfs.c
+@@ -452,7 +452,7 @@ static ssize_t description_show(struct device *dev,
+ (wchar_t *)acpi_dev->pnp.str_obj->buffer.pointer,
+ acpi_dev->pnp.str_obj->buffer.length,
+ UTF16_LITTLE_ENDIAN, buf,
+- PAGE_SIZE);
++ PAGE_SIZE - 1);
+
+ buf[result++] = '\n';
+
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 9415a0041aaf7..e3df3dda03321 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -1904,6 +1904,22 @@ static const struct dmi_system_id ec_dmi_table[] __initconst = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "GL702VMK"),}, NULL},
+ {
++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X505BA", {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X505BA"),}, NULL},
++ {
++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X505BP", {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X505BP"),}, NULL},
++ {
++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X542BA", {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X542BA"),}, NULL},
++ {
++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X542BP", {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X542BP"),}, NULL},
++ {
+ ec_honor_ecdt_gpe, "ASUS X550VXK", {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "X550VXK"),}, NULL},
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index abb559cd28d79..d80010ac2a43a 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -29,6 +29,7 @@
+ #include <linux/acpi.h>
+ #include <linux/dmi.h>
+ #include <linux/sched.h> /* need_resched() */
++#include <linux/sort.h>
+ #include <linux/tick.h>
+ #include <linux/cpuidle.h>
+ #include <linux/cpu.h>
+@@ -544,10 +545,37 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
+ return;
+ }
+
++static int acpi_cst_latency_cmp(const void *a, const void *b)
++{
++ const struct acpi_processor_cx *x = a, *y = b;
++
++ if (!(x->valid && y->valid))
++ return 0;
++ if (x->latency > y->latency)
++ return 1;
++ if (x->latency < y->latency)
++ return -1;
++ return 0;
++}
++static void acpi_cst_latency_swap(void *a, void *b, int n)
++{
++ struct acpi_processor_cx *x = a, *y = b;
++ u32 tmp;
++
++ if (!(x->valid && y->valid))
++ return;
++ tmp = x->latency;
++ x->latency = y->latency;
++ y->latency = tmp;
++}
++
+ static int acpi_processor_power_verify(struct acpi_processor *pr)
+ {
+ unsigned int i;
+ unsigned int working = 0;
++ unsigned int last_latency = 0;
++ unsigned int last_type = 0;
++ bool buggy_latency = false;
+
+ pr->power.timer_broadcast_on_state = INT_MAX;
+
+@@ -571,12 +599,24 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
+ }
+ if (!cx->valid)
+ continue;
++ if (cx->type >= last_type && cx->latency < last_latency)
++ buggy_latency = true;
++ last_latency = cx->latency;
++ last_type = cx->type;
+
+ lapic_timer_check_state(i, pr, cx);
+ tsc_check_state(cx->type);
+ working++;
+ }
+
++ if (buggy_latency) {
++ pr_notice("FW issue: working around C-state latencies out of order\n");
++ sort(&pr->power.states[1], max_cstate,
++ sizeof(struct acpi_processor_cx),
++ acpi_cst_latency_cmp,
++ acpi_cst_latency_swap);
++ }
++
+ lapic_timer_propagate_broadcast(pr);
+
+ return (working);
+diff --git a/drivers/ata/ahci_sunxi.c b/drivers/ata/ahci_sunxi.c
+index 631610b72aa58..64141d10e07f7 100644
+--- a/drivers/ata/ahci_sunxi.c
++++ b/drivers/ata/ahci_sunxi.c
+@@ -165,7 +165,7 @@ static void ahci_sunxi_start_engine(struct ata_port *ap)
+ }
+
+ static const struct ata_port_info ahci_sunxi_port_info = {
+- .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ,
++ .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ | ATA_FLAG_NO_DIPM,
+ .pio_mask = ATA_PIO4,
+ .udma_mask = ATA_UDMA6,
+ .port_ops = &ahci_platform_ops,
+diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
+index cc6d06c1b2c70..7ce62cdb63a5d 100644
+--- a/drivers/ata/pata_ep93xx.c
++++ b/drivers/ata/pata_ep93xx.c
+@@ -927,7 +927,7 @@ static int ep93xx_pata_probe(struct platform_device *pdev)
+ /* INT[3] (IRQ_EP93XX_EXT3) line connected as pull down */
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0) {
+- err = -ENXIO;
++ err = irq;
+ goto err_rel_gpio;
+ }
+
+diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c
+index d3d851b014a37..ac3b1fda820ff 100644
+--- a/drivers/ata/pata_octeon_cf.c
++++ b/drivers/ata/pata_octeon_cf.c
+@@ -898,10 +898,11 @@ static int octeon_cf_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
+- irq_handler = octeon_cf_interrupt;
+ i = platform_get_irq(dma_dev, 0);
+- if (i > 0)
++ if (i > 0) {
+ irq = i;
++ irq_handler = octeon_cf_interrupt;
++ }
+ }
+ of_node_put(dma_node);
+ }
+diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c
+index 653b9a0bf7274..0416a390b94c8 100644
+--- a/drivers/ata/pata_rb532_cf.c
++++ b/drivers/ata/pata_rb532_cf.c
+@@ -120,10 +120,12 @@ static int rb532_pata_driver_probe(struct platform_device *pdev)
+ }
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq <= 0) {
++ if (irq < 0) {
+ dev_err(&pdev->dev, "no IRQ resource found\n");
+- return -ENOENT;
++ return irq;
+ }
++ if (!irq)
++ return -EINVAL;
+
+ pdata = dev_get_platdata(&pdev->dev);
+ if (!pdata) {
+diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c
+index e67815b896fcc..1dd47a05b34bc 100644
+--- a/drivers/ata/sata_highbank.c
++++ b/drivers/ata/sata_highbank.c
+@@ -483,10 +483,12 @@ static int ahci_highbank_probe(struct platform_device *pdev)
+ }
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq <= 0) {
++ if (irq < 0) {
+ dev_err(dev, "no irq\n");
+- return -EINVAL;
++ return irq;
+ }
++ if (!irq)
++ return -EINVAL;
+
+ hpriv = devm_kzalloc(dev, sizeof(*hpriv), GFP_KERNEL);
+ if (!hpriv) {
+diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
+index 008905d4152a3..827c6d5e61774 100644
+--- a/drivers/atm/iphase.c
++++ b/drivers/atm/iphase.c
+@@ -3301,7 +3301,7 @@ static void __exit ia_module_exit(void)
+ {
+ pci_unregister_driver(&ia_driver);
+
+- del_timer(&ia_timer);
++ del_timer_sync(&ia_timer);
+ }
+
+ module_init(ia_module_init);
+diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
+index 0d3754a4ac209..78e72b86dc041 100644
+--- a/drivers/atm/nicstar.c
++++ b/drivers/atm/nicstar.c
+@@ -296,7 +296,7 @@ static void __exit nicstar_cleanup(void)
+ {
+ XPRINTK("nicstar: nicstar_cleanup() called.\n");
+
+- del_timer(&ns_timer);
++ del_timer_sync(&ns_timer);
+
+ pci_unregister_driver(&nicstar_driver);
+
+@@ -524,6 +524,15 @@ static int ns_init_card(int i, struct pci_dev *pcidev)
+ /* Set the VPI/VCI MSb mask to zero so we can receive OAM cells */
+ writel(0x00000000, card->membase + VPM);
+
++ card->intcnt = 0;
++ if (request_irq
++ (pcidev->irq, &ns_irq_handler, IRQF_SHARED, "nicstar", card) != 0) {
++ pr_err("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq);
++ error = 9;
++ ns_init_card_error(card, error);
++ return error;
++ }
++
+ /* Initialize TSQ */
+ card->tsq.org = dma_alloc_coherent(&card->pcidev->dev,
+ NS_TSQSIZE + NS_TSQ_ALIGNMENT,
+@@ -750,15 +759,6 @@ static int ns_init_card(int i, struct pci_dev *pcidev)
+
+ card->efbie = 1;
+
+- card->intcnt = 0;
+- if (request_irq
+- (pcidev->irq, &ns_irq_handler, IRQF_SHARED, "nicstar", card) != 0) {
+- printk("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq);
+- error = 9;
+- ns_init_card_error(card, error);
+- return error;
+- }
+-
+ /* Register device */
+ card->atmdev = atm_dev_register("nicstar", &card->pcidev->dev, &atm_ops,
+ -1, NULL);
+@@ -836,10 +836,12 @@ static void ns_init_card_error(ns_dev *card, int error)
+ dev_kfree_skb_any(hb);
+ }
+ if (error >= 12) {
+- kfree(card->rsq.org);
++ dma_free_coherent(&card->pcidev->dev, NS_RSQSIZE + NS_RSQ_ALIGNMENT,
++ card->rsq.org, card->rsq.dma);
+ }
+ if (error >= 11) {
+- kfree(card->tsq.org);
++ dma_free_coherent(&card->pcidev->dev, NS_TSQSIZE + NS_TSQ_ALIGNMENT,
++ card->tsq.org, card->tsq.dma);
+ }
+ if (error >= 10) {
+ free_irq(card->pcidev->irq, card);
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index c2d9459ec5d12..dac1769146d7f 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -944,6 +944,8 @@ static int virtblk_freeze(struct virtio_device *vdev)
+ blk_mq_quiesce_queue(vblk->disk->queue);
+
+ vdev->config->del_vqs(vdev);
++ kfree(vblk->vqs);
++
+ return 0;
+ }
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 1b0adf5c23760..7188f0fb2e050 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -2595,6 +2595,11 @@ static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
+ sent += size;
+ count -= size;
+
++ /* ep2 need time to switch from function acl to function dfu,
++ * so we add 20ms delay here.
++ */
++ msleep(20);
++
+ while (count) {
+ size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
+
+diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
+index ca1c5c5109f04..f016d54b25929 100644
+--- a/drivers/char/ipmi/ipmi_watchdog.c
++++ b/drivers/char/ipmi/ipmi_watchdog.c
+@@ -366,16 +366,18 @@ static int __ipmi_set_timeout(struct ipmi_smi_msg *smi_msg,
+ data[0] = 0;
+ WDOG_SET_TIMER_USE(data[0], WDOG_TIMER_USE_SMS_OS);
+
+- if ((ipmi_version_major > 1)
+- || ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) {
+- /* This is an IPMI 1.5-only feature. */
+- data[0] |= WDOG_DONT_STOP_ON_SET;
+- } else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) {
+- /*
+- * In ipmi 1.0, setting the timer stops the watchdog, we
+- * need to start it back up again.
+- */
+- hbnow = 1;
++ if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) {
++ if ((ipmi_version_major > 1) ||
++ ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) {
++ /* This is an IPMI 1.5-only feature. */
++ data[0] |= WDOG_DONT_STOP_ON_SET;
++ } else {
++ /*
++ * In ipmi 1.0, setting the timer stops the watchdog, we
++ * need to start it back up again.
++ */
++ hbnow = 1;
++ }
+ }
+
+ data[1] = 0;
+diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
+index a219964cb7700..cdc72db29ae04 100644
+--- a/drivers/char/pcmcia/cm4000_cs.c
++++ b/drivers/char/pcmcia/cm4000_cs.c
+@@ -544,6 +544,10 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq)
+ io_read_num_rec_bytes(iobase, &num_bytes_read);
+ if (num_bytes_read >= 4) {
+ DEBUGP(2, dev, "NumRecBytes = %i\n", num_bytes_read);
++ if (num_bytes_read > 4) {
++ rc = -EIO;
++ goto exit_setprotocol;
++ }
+ break;
+ }
+ mdelay(10);
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index ca71ee939533f..cdf441942bae4 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -488,7 +488,7 @@ static struct port_buffer *get_inbuf(struct port *port)
+
+ buf = virtqueue_get_buf(port->in_vq, &len);
+ if (buf) {
+- buf->len = len;
++ buf->len = min_t(size_t, len, buf->size);
+ buf->offset = 0;
+ port->stats.bytes_received += len;
+ }
+@@ -1738,7 +1738,7 @@ static void control_work_handler(struct work_struct *work)
+ while ((buf = virtqueue_get_buf(vq, &len))) {
+ spin_unlock(&portdev->c_ivq_lock);
+
+- buf->len = len;
++ buf->len = min_t(size_t, len, buf->size);
+ buf->offset = 0;
+
+ handle_control_message(vq->vdev, portdev, buf);
+diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c
+index 9e16931e6f28a..e0011db4f2018 100644
+--- a/drivers/clk/renesas/r8a77995-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c
+@@ -73,6 +73,7 @@ static const struct cpg_core_clk r8a77995_core_clks[] __initconst = {
+ DEF_FIXED(".sdsrc", CLK_SDSRC, CLK_PLL1, 2, 1),
+
+ /* Core Clock Outputs */
++ DEF_FIXED("za2", R8A77995_CLK_ZA2, CLK_PLL0D3, 2, 1),
+ DEF_FIXED("z2", R8A77995_CLK_Z2, CLK_PLL0D3, 1, 1),
+ DEF_FIXED("ztr", R8A77995_CLK_ZTR, CLK_PLL1, 6, 1),
+ DEF_FIXED("zt", R8A77995_CLK_ZT, CLK_PLL1, 4, 1),
+diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
+index dc87866233b94..ed3b725ff1029 100644
+--- a/drivers/clk/tegra/clk-pll.c
++++ b/drivers/clk/tegra/clk-pll.c
+@@ -1091,7 +1091,8 @@ static int clk_pllu_enable(struct clk_hw *hw)
+ if (pll->lock)
+ spin_lock_irqsave(pll->lock, flags);
+
+- _clk_pll_enable(hw);
++ if (!clk_pll_is_enabled(hw))
++ _clk_pll_enable(hw);
+
+ ret = clk_pll_wait_for_lock(pll);
+ if (ret < 0)
+@@ -1708,7 +1709,8 @@ static int clk_pllu_tegra114_enable(struct clk_hw *hw)
+ if (pll->lock)
+ spin_lock_irqsave(pll->lock, flags);
+
+- _clk_pll_enable(hw);
++ if (!clk_pll_is_enabled(hw))
++ _clk_pll_enable(hw);
+
+ ret = clk_pll_wait_for_lock(pll);
+ if (ret < 0)
+diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
+index e67ab217eef41..8642504b7e51f 100644
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -334,7 +334,7 @@ static u64 notrace arm64_858921_read_cntvct_el0(void)
+ do { \
+ _val = read_sysreg(reg); \
+ _retries--; \
+- } while (((_val + 1) & GENMASK(9, 0)) <= 1 && _retries); \
++ } while (((_val + 1) & GENMASK(8, 0)) <= 1 && _retries); \
+ \
+ WARN_ON_ONCE(!_retries); \
+ _val; \
+diff --git a/drivers/crypto/ccp/sp-pci.c b/drivers/crypto/ccp/sp-pci.c
+index 7da93e9bebed8..9b2742212ea88 100644
+--- a/drivers/crypto/ccp/sp-pci.c
++++ b/drivers/crypto/ccp/sp-pci.c
+@@ -216,7 +216,7 @@ static int sp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ if (ret) {
+ dev_err(dev, "dma_set_mask_and_coherent failed (%d)\n",
+ ret);
+- goto e_err;
++ goto free_irqs;
+ }
+ }
+
+@@ -224,12 +224,14 @@ static int sp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ ret = sp_init(sp);
+ if (ret)
+- goto e_err;
++ goto free_irqs;
+
+ dev_notice(dev, "enabled\n");
+
+ return 0;
+
++free_irqs:
++ sp_free_irqs(sp);
+ e_err:
+ dev_notice(dev, "initialization failed\n");
+ return ret;
+diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
+index 9b7b8558db31d..abb84996f2ca4 100644
+--- a/drivers/crypto/ixp4xx_crypto.c
++++ b/drivers/crypto/ixp4xx_crypto.c
+@@ -332,7 +332,7 @@ static void free_buf_chain(struct device *dev, struct buffer_desc *buf,u32 phys)
+
+ buf1 = buf->next;
+ phys1 = buf->phys_next;
+- dma_unmap_single(dev, buf->phys_next, buf->buf_len, buf->dir);
++ dma_unmap_single(dev, buf->phys_addr, buf->buf_len, buf->dir);
+ dma_pool_free(buffer_pool, buf, phys);
+ buf = buf1;
+ phys = phys1;
+diff --git a/drivers/crypto/nx/nx-842-pseries.c b/drivers/crypto/nx/nx-842-pseries.c
+index 66869976cfa2b..41f4950c9fc65 100644
+--- a/drivers/crypto/nx/nx-842-pseries.c
++++ b/drivers/crypto/nx/nx-842-pseries.c
+@@ -553,13 +553,15 @@ static int nx842_OF_set_defaults(struct nx842_devdata *devdata)
+ * The status field indicates if the device is enabled when the status
+ * is 'okay'. Otherwise the device driver will be disabled.
+ *
+- * @prop - struct property point containing the maxsyncop for the update
++ * @devdata: struct nx842_devdata to use for dev_info
++ * @prop: struct property point containing the maxsyncop for the update
+ *
+ * Returns:
+ * 0 - Device is available
+ * -ENODEV - Device is not available
+ */
+-static int nx842_OF_upd_status(struct property *prop)
++static int nx842_OF_upd_status(struct nx842_devdata *devdata,
++ struct property *prop)
+ {
+ const char *status = (const char *)prop->value;
+
+@@ -773,7 +775,7 @@ static int nx842_OF_upd(struct property *new_prop)
+ goto out;
+
+ /* Perform property updates */
+- ret = nx842_OF_upd_status(status);
++ ret = nx842_OF_upd_status(new_devdata, status);
+ if (ret)
+ goto error_out;
+
+@@ -1086,6 +1088,7 @@ static const struct vio_device_id nx842_vio_driver_ids[] = {
+ {"ibm,compression-v1", "ibm,compression"},
+ {"", ""},
+ };
++MODULE_DEVICE_TABLE(vio, nx842_vio_driver_ids);
+
+ static struct vio_driver nx842_vio_driver = {
+ .name = KBUILD_MODNAME,
+diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
+index dac130bb807ae..eda692271f0c7 100644
+--- a/drivers/crypto/qat/qat_common/qat_hal.c
++++ b/drivers/crypto/qat/qat_common/qat_hal.c
+@@ -1256,7 +1256,11 @@ static int qat_hal_put_rel_wr_xfer(struct icp_qat_fw_loader_handle *handle,
+ pr_err("QAT: bad xfrAddr=0x%x\n", xfr_addr);
+ return -EINVAL;
+ }
+- qat_hal_rd_rel_reg(handle, ae, ctx, ICP_GPB_REL, gprnum, &gprval);
++ status = qat_hal_rd_rel_reg(handle, ae, ctx, ICP_GPB_REL, gprnum, &gprval);
++ if (status) {
++ pr_err("QAT: failed to read register");
++ return status;
++ }
+ gpr_addr = qat_hal_get_reg_addr(ICP_GPB_REL, gprnum);
+ data16low = 0xffff & data;
+ data16hi = 0xffff & (data >> 0x10);
+diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c
+index aeb03081415cb..9542423bb7ca5 100644
+--- a/drivers/crypto/qat/qat_common/qat_uclo.c
++++ b/drivers/crypto/qat/qat_common/qat_uclo.c
+@@ -385,7 +385,6 @@ static int qat_uclo_init_umem_seg(struct icp_qat_fw_loader_handle *handle,
+ return 0;
+ }
+
+-#define ICP_DH895XCC_PESRAM_BAR_SIZE 0x80000
+ static int qat_uclo_init_ae_memory(struct icp_qat_fw_loader_handle *handle,
+ struct icp_qat_uof_initmem *init_mem)
+ {
+diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
+index a0bb8a6eec3fd..18ef5b8cc18a7 100644
+--- a/drivers/crypto/ux500/hash/hash_core.c
++++ b/drivers/crypto/ux500/hash/hash_core.c
+@@ -1007,6 +1007,7 @@ static int hash_hw_final(struct ahash_request *req)
+ goto out;
+ }
+ } else if (req->nbytes == 0 && ctx->keylen > 0) {
++ ret = -EPERM;
+ dev_err(device_data->dev, "%s: Empty message with keylength > 0, NOT supported\n",
+ __func__);
+ goto out;
+diff --git a/drivers/edac/ti_edac.c b/drivers/edac/ti_edac.c
+index 3247689467435..9ab9fa0a911bd 100644
+--- a/drivers/edac/ti_edac.c
++++ b/drivers/edac/ti_edac.c
+@@ -197,6 +197,7 @@ static const struct of_device_id ti_edac_of_match[] = {
+ { .compatible = "ti,emif-dra7xx", .data = (void *)EMIF_TYPE_DRA7 },
+ {},
+ };
++MODULE_DEVICE_TABLE(of, ti_edac_of_match);
+
+ static int _emif_get_id(struct device_node *node)
+ {
+diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
+index 7a767b66dd865..98285eb8dd79d 100644
+--- a/drivers/extcon/extcon-max8997.c
++++ b/drivers/extcon/extcon-max8997.c
+@@ -783,3 +783,4 @@ module_platform_driver(max8997_muic_driver);
+ MODULE_DESCRIPTION("Maxim MAX8997 Extcon driver");
+ MODULE_AUTHOR("Donggeun Kim <dg77.kim@samsung.com>");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:max8997-muic");
+diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c
+index 2efcd94f74fc6..59ec4c3e7c4d9 100644
+--- a/drivers/extcon/extcon-sm5502.c
++++ b/drivers/extcon/extcon-sm5502.c
+@@ -92,7 +92,6 @@ static struct reg_data sm5502_reg_data[] = {
+ | SM5502_REG_INTM2_MHL_MASK,
+ .invert = true,
+ },
+- { }
+ };
+
+ /* List of detectable cables */
+diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
+index 6945c3c966375..59db70fb45614 100644
+--- a/drivers/firmware/qemu_fw_cfg.c
++++ b/drivers/firmware/qemu_fw_cfg.c
+@@ -296,15 +296,13 @@ static int fw_cfg_do_platform_probe(struct platform_device *pdev)
+ return 0;
+ }
+
+-static ssize_t fw_cfg_showrev(struct kobject *k, struct attribute *a, char *buf)
++static ssize_t fw_cfg_showrev(struct kobject *k, struct kobj_attribute *a,
++ char *buf)
+ {
+ return sprintf(buf, "%u\n", fw_cfg_rev);
+ }
+
+-static const struct {
+- struct attribute attr;
+- ssize_t (*show)(struct kobject *k, struct attribute *a, char *buf);
+-} fw_cfg_rev_attr = {
++static const struct kobj_attribute fw_cfg_rev_attr = {
+ .attr = { .name = "rev", .mode = S_IRUSR },
+ .show = fw_cfg_showrev,
+ };
+diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c
+index bd62236d3f975..5b4ca6142270e 100644
+--- a/drivers/fsi/fsi-core.c
++++ b/drivers/fsi/fsi-core.c
+@@ -726,7 +726,7 @@ static ssize_t cfam_read(struct file *filep, char __user *buf, size_t count,
+ rc = count;
+ fail:
+ *offset = off;
+- return count;
++ return rc;
+ }
+
+ static ssize_t cfam_write(struct file *filep, const char __user *buf,
+@@ -763,7 +763,7 @@ static ssize_t cfam_write(struct file *filep, const char __user *buf,
+ rc = count;
+ fail:
+ *offset = off;
+- return count;
++ return rc;
+ }
+
+ static loff_t cfam_llseek(struct file *file, loff_t offset, int whence)
+diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
+index 9fa3959e08554..ace42cd2915e2 100644
+--- a/drivers/fsi/fsi-sbefifo.c
++++ b/drivers/fsi/fsi-sbefifo.c
+@@ -325,7 +325,8 @@ static int sbefifo_up_write(struct sbefifo *sbefifo, __be32 word)
+ static int sbefifo_request_reset(struct sbefifo *sbefifo)
+ {
+ struct device *dev = &sbefifo->fsi_dev->dev;
+- u32 status, timeout;
++ unsigned long end_time;
++ u32 status;
+ int rc;
+
+ dev_dbg(dev, "Requesting FIFO reset\n");
+@@ -341,7 +342,8 @@ static int sbefifo_request_reset(struct sbefifo *sbefifo)
+ }
+
+ /* Wait for it to complete */
+- for (timeout = 0; timeout < SBEFIFO_RESET_TIMEOUT; timeout++) {
++ end_time = jiffies + msecs_to_jiffies(SBEFIFO_RESET_TIMEOUT);
++ while (!time_after(jiffies, end_time)) {
+ rc = sbefifo_regr(sbefifo, SBEFIFO_UP | SBEFIFO_STS, &status);
+ if (rc) {
+ dev_err(dev, "Failed to read UP fifo status during reset"
+@@ -355,7 +357,7 @@ static int sbefifo_request_reset(struct sbefifo *sbefifo)
+ return 0;
+ }
+
+- msleep(1);
++ cond_resched();
+ }
+ dev_err(dev, "FIFO reset timed out\n");
+
+@@ -400,7 +402,7 @@ static int sbefifo_cleanup_hw(struct sbefifo *sbefifo)
+ /* The FIFO already contains a reset request from the SBE ? */
+ if (down_status & SBEFIFO_STS_RESET_REQ) {
+ dev_info(dev, "Cleanup: FIFO reset request set, resetting\n");
+- rc = sbefifo_regw(sbefifo, SBEFIFO_UP, SBEFIFO_PERFORM_RESET);
++ rc = sbefifo_regw(sbefifo, SBEFIFO_DOWN, SBEFIFO_PERFORM_RESET);
+ if (rc) {
+ sbefifo->broken = true;
+ dev_err(dev, "Cleanup: Reset reg write failed, rc=%d\n", rc);
+diff --git a/drivers/fsi/fsi-scom.c b/drivers/fsi/fsi-scom.c
+index fdc0e458dbaaf..6a48b3144410f 100644
+--- a/drivers/fsi/fsi-scom.c
++++ b/drivers/fsi/fsi-scom.c
+@@ -47,9 +47,10 @@
+ #define SCOM_STATUS_PIB_RESP_MASK 0x00007000
+ #define SCOM_STATUS_PIB_RESP_SHIFT 12
+
+-#define SCOM_STATUS_ANY_ERR (SCOM_STATUS_PROTECTION | \
+- SCOM_STATUS_PARITY | \
+- SCOM_STATUS_PIB_ABORT | \
++#define SCOM_STATUS_FSI2PIB_ERROR (SCOM_STATUS_PROTECTION | \
++ SCOM_STATUS_PARITY | \
++ SCOM_STATUS_PIB_ABORT)
++#define SCOM_STATUS_ANY_ERR (SCOM_STATUS_FSI2PIB_ERROR | \
+ SCOM_STATUS_PIB_RESP_MASK)
+ /* SCOM address encodings */
+ #define XSCOM_ADDR_IND_FLAG BIT_ULL(63)
+@@ -249,13 +250,14 @@ static int handle_fsi2pib_status(struct scom_device *scom, uint32_t status)
+ {
+ uint32_t dummy = -1;
+
+- if (status & SCOM_STATUS_PROTECTION)
+- return -EPERM;
+- if (status & SCOM_STATUS_PARITY) {
++ if (status & SCOM_STATUS_FSI2PIB_ERROR)
+ fsi_device_write(scom->fsi_dev, SCOM_FSI2PIB_RESET_REG, &dummy,
+ sizeof(uint32_t));
++
++ if (status & SCOM_STATUS_PROTECTION)
++ return -EPERM;
++ if (status & SCOM_STATUS_PARITY)
+ return -EIO;
+- }
+ /* Return -EBUSY on PIB abort to force a retry */
+ if (status & SCOM_STATUS_PIB_ABORT)
+ return -EBUSY;
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index 0232c25a15864..dc4088a47ab2d 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -980,6 +980,7 @@ static const struct of_device_id pca953x_dt_ids[] = {
+ { .compatible = "ti,tca6424", .data = OF_953X(24, PCA_INT), },
+
+ { .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), },
++ { .compatible = "onnn,pca9655", .data = OF_953X(16, PCA_INT), },
+
+ { .compatible = "exar,xra1202", .data = OF_953X( 8, 0), },
+ { }
+diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
+index 5dec96155814b..c2279b28bcb9c 100644
+--- a/drivers/gpio/gpio-zynq.c
++++ b/drivers/gpio/gpio-zynq.c
+@@ -919,8 +919,11 @@ err_pm_dis:
+ static int zynq_gpio_remove(struct platform_device *pdev)
+ {
+ struct zynq_gpio *gpio = platform_get_drvdata(pdev);
++ int ret;
+
+- pm_runtime_get_sync(&pdev->dev);
++ ret = pm_runtime_get_sync(&pdev->dev);
++ if (ret < 0)
++ dev_warn(&pdev->dev, "pm_runtime_get_sync() Failed\n");
+ gpiochip_remove(&gpio->chip);
+ clk_disable_unprepare(gpio->clk);
+ device_set_wakeup_capable(&pdev->dev, 0);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 7f6af421d3e98..102b05b8f0c2b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2069,7 +2069,7 @@ static int amdgpu_device_ip_reinit_early_sriov(struct amdgpu_device *adev)
+ AMD_IP_BLOCK_TYPE_IH,
+ };
+
+- for (i = 0; i < ARRAY_SIZE(ip_order); i++) {
++ for (i = 0; i < adev->num_ip_blocks; i++) {
+ int j;
+ struct amdgpu_ip_block *block;
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
+index 321af9af95e86..8f5246308d263 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c
+@@ -476,10 +476,13 @@ static enum lb_memory_config dpp1_dscl_find_lb_memory_config(struct dcn10_dpp *d
+ int vtaps_c = scl_data->taps.v_taps_c;
+ int ceil_vratio = dc_fixpt_ceil(scl_data->ratios.vert);
+ int ceil_vratio_c = dc_fixpt_ceil(scl_data->ratios.vert_c);
+- enum lb_memory_config mem_cfg = LB_MEMORY_CONFIG_0;
+
+- if (dpp->base.ctx->dc->debug.use_max_lb)
+- return mem_cfg;
++ if (dpp->base.ctx->dc->debug.use_max_lb) {
++ if (scl_data->format == PIXEL_FORMAT_420BPP8
++ || scl_data->format == PIXEL_FORMAT_420BPP10)
++ return LB_MEMORY_CONFIG_3;
++ return LB_MEMORY_CONFIG_0;
++ }
+
+ dpp->base.caps->dscl_calc_lb_num_partitions(
+ scl_data, LB_MEMORY_CONFIG_1, &num_part_y, &num_part_c);
+diff --git a/drivers/gpu/drm/amd/display/dc/irq_types.h b/drivers/gpu/drm/amd/display/dc/irq_types.h
+index 0b5f3a278c227..24c38dac597ba 100644
+--- a/drivers/gpu/drm/amd/display/dc/irq_types.h
++++ b/drivers/gpu/drm/amd/display/dc/irq_types.h
+@@ -155,7 +155,7 @@ enum irq_type
+ };
+
+ #define DAL_VALID_IRQ_SRC_NUM(src) \
+- ((src) <= DAL_IRQ_SOURCES_NUMBER && (src) > DC_IRQ_SOURCE_INVALID)
++ ((src) < DAL_IRQ_SOURCES_NUMBER && (src) > DC_IRQ_SOURCE_INVALID)
+
+ /* Number of Page Flip IRQ Sources. */
+ #define DAL_PFLIP_IRQ_SRC_NUM \
+diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+index 44d1cda56974d..9b2b8fa76f94f 100644
+--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+@@ -96,8 +96,6 @@ static int mdp4_hw_init(struct msm_kms *kms)
+ if (mdp4_kms->rev > 1)
+ mdp4_write(mdp4_kms, REG_MDP4_RESET_STATUS, 1);
+
+- dev->mode_config.allow_fb_modifiers = true;
+-
+ out:
+ pm_runtime_put_sync(dev->dev);
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c
+index 79ff653d8081e..f4dacd3b43111 100644
+--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c
++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c
+@@ -356,6 +356,12 @@ enum mdp4_pipe mdp4_plane_pipe(struct drm_plane *plane)
+ return mdp4_plane->pipe;
+ }
+
++static const uint64_t supported_format_modifiers[] = {
++ DRM_FORMAT_MOD_SAMSUNG_64_32_TILE,
++ DRM_FORMAT_MOD_LINEAR,
++ DRM_FORMAT_MOD_INVALID
++};
++
+ /* initialize plane */
+ struct drm_plane *mdp4_plane_init(struct drm_device *dev,
+ enum mdp4_pipe pipe_id, bool private_plane)
+@@ -384,7 +390,7 @@ struct drm_plane *mdp4_plane_init(struct drm_device *dev,
+ type = private_plane ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY;
+ ret = drm_universal_plane_init(dev, plane, 0xff, &mdp4_plane_funcs,
+ mdp4_plane->formats, mdp4_plane->nformats,
+- NULL, type, NULL);
++ supported_format_modifiers, type, NULL);
+ if (ret)
+ goto fail;
+
+diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig
+index e9a8d90e67234..3ed6849d63cba 100644
+--- a/drivers/gpu/drm/mxsfb/Kconfig
++++ b/drivers/gpu/drm/mxsfb/Kconfig
+@@ -9,7 +9,6 @@ config DRM_MXSFB
+ depends on COMMON_CLK
+ select DRM_MXS
+ select DRM_KMS_HELPER
+- select DRM_KMS_FB_HELPER
+ select DRM_KMS_CMA_HELPER
+ select DRM_PANEL
+ help
+diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c
+index c666b89eed5d1..e89491b5155fc 100644
+--- a/drivers/gpu/drm/qxl/qxl_dumb.c
++++ b/drivers/gpu/drm/qxl/qxl_dumb.c
+@@ -57,6 +57,8 @@ int qxl_mode_dumb_create(struct drm_file *file_priv,
+ surf.height = args->height;
+ surf.stride = pitch;
+ surf.format = format;
++ surf.data = 0;
++
+ r = qxl_gem_object_create_with_handle(qdev, file_priv,
+ QXL_GEM_DOMAIN_VRAM,
+ args->size, &surf, &qobj,
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 3f0f3a578ddf0..5985efc5a1f34 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -1327,6 +1327,7 @@ radeon_user_framebuffer_create(struct drm_device *dev,
+ /* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */
+ if (obj->import_attach) {
+ DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n");
++ drm_gem_object_put(obj);
+ return ERR_PTR(-EINVAL);
+ }
+
+diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c
+index 8ad0d773dc33a..3feab563e50a7 100644
+--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
++++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
+@@ -81,6 +81,7 @@ static int cdn_dp_grf_write(struct cdn_dp_device *dp,
+ ret = regmap_write(dp->grf, reg, val);
+ if (ret) {
+ DRM_DEV_ERROR(dp->dev, "Could not write to GRF: %d\n", ret);
++ clk_disable_unprepare(dp->grf_clk);
+ return ret;
+ }
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
+index 22397a23780c0..d7555991d1af9 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
++++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
+@@ -237,6 +237,7 @@ err_ttm:
+ err_vbufs:
+ vgdev->vdev->config->del_vqs(vgdev->vdev);
+ err_vqs:
++ dev->dev_private = NULL;
+ kfree(vgdev);
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/zte/Kconfig b/drivers/gpu/drm/zte/Kconfig
+index 5b36421ef3e55..75b70126d2d30 100644
+--- a/drivers/gpu/drm/zte/Kconfig
++++ b/drivers/gpu/drm/zte/Kconfig
+@@ -2,7 +2,6 @@ config DRM_ZTE
+ tristate "DRM Support for ZTE SoCs"
+ depends on DRM && ARCH_ZX
+ select DRM_KMS_CMA_HELPER
+- select DRM_KMS_FB_HELPER
+ select DRM_KMS_HELPER
+ select SND_SOC_HDMI_CODEC if SND_SOC
+ select VIDEOMODE_HELPERS
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index acbbc21e62338..4549fbb741563 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -2124,12 +2124,8 @@ static int hid_device_remove(struct device *dev)
+ {
+ struct hid_device *hdev = to_hid_device(dev);
+ struct hid_driver *hdrv;
+- int ret = 0;
+
+- if (down_interruptible(&hdev->driver_input_lock)) {
+- ret = -EINTR;
+- goto end;
+- }
++ down(&hdev->driver_input_lock);
+ hdev->io_started = false;
+
+ hdrv = hdev->driver;
+@@ -2144,8 +2140,8 @@ static int hid_device_remove(struct device *dev)
+
+ if (!hdev->io_started)
+ up(&hdev->driver_input_lock);
+-end:
+- return ret;
++
++ return 0;
+ }
+
+ static ssize_t modalias_show(struct device *dev, struct device_attribute *a,
+diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
+index 46da97162ef43..0abed1e5b5260 100644
+--- a/drivers/hid/wacom_wac.h
++++ b/drivers/hid/wacom_wac.h
+@@ -126,7 +126,7 @@
+ #define WACOM_HID_WD_TOUCHONOFF (WACOM_HID_UP_WACOMDIGITIZER | 0x0454)
+ #define WACOM_HID_WD_BATTERY_LEVEL (WACOM_HID_UP_WACOMDIGITIZER | 0x043b)
+ #define WACOM_HID_WD_EXPRESSKEY00 (WACOM_HID_UP_WACOMDIGITIZER | 0x0910)
+-#define WACOM_HID_WD_EXPRESSKEYCAP00 (WACOM_HID_UP_WACOMDIGITIZER | 0x0950)
++#define WACOM_HID_WD_EXPRESSKEYCAP00 (WACOM_HID_UP_WACOMDIGITIZER | 0x0940)
+ #define WACOM_HID_WD_MODE_CHANGE (WACOM_HID_UP_WACOMDIGITIZER | 0x0980)
+ #define WACOM_HID_WD_MUTE_DEVICE (WACOM_HID_UP_WACOMDIGITIZER | 0x0981)
+ #define WACOM_HID_WD_CONTROLPANEL (WACOM_HID_UP_WACOMDIGITIZER | 0x0982)
+diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
+index 423205077bf64..2003314dcfbe7 100644
+--- a/drivers/hv/hv_util.c
++++ b/drivers/hv/hv_util.c
+@@ -548,8 +548,8 @@ static int hv_timesync_init(struct hv_util_service *srv)
+ */
+ hv_ptp_clock = ptp_clock_register(&ptp_hyperv_info, NULL);
+ if (IS_ERR_OR_NULL(hv_ptp_clock)) {
+- pr_err("cannot register PTP clock: %ld\n",
+- PTR_ERR(hv_ptp_clock));
++ pr_err("cannot register PTP clock: %d\n",
++ PTR_ERR_OR_ZERO(hv_ptp_clock));
+ hv_ptp_clock = NULL;
+ }
+
+diff --git a/drivers/hwmon/max31722.c b/drivers/hwmon/max31722.c
+index 30a100e70a0d0..877c3d7dca012 100644
+--- a/drivers/hwmon/max31722.c
++++ b/drivers/hwmon/max31722.c
+@@ -9,7 +9,6 @@
+ * directory of this archive for more details.
+ */
+
+-#include <linux/acpi.h>
+ #include <linux/hwmon.h>
+ #include <linux/hwmon-sysfs.h>
+ #include <linux/kernel.h>
+@@ -138,20 +137,12 @@ static const struct spi_device_id max31722_spi_id[] = {
+ {"max31723", 0},
+ {}
+ };
+-
+-static const struct acpi_device_id __maybe_unused max31722_acpi_id[] = {
+- {"MAX31722", 0},
+- {"MAX31723", 0},
+- {}
+-};
+-
+ MODULE_DEVICE_TABLE(spi, max31722_spi_id);
+
+ static struct spi_driver max31722_driver = {
+ .driver = {
+ .name = "max31722",
+ .pm = &max31722_pm_ops,
+- .acpi_match_table = ACPI_PTR(max31722_acpi_id),
+ },
+ .probe = max31722_probe,
+ .remove = max31722_remove,
+diff --git a/drivers/hwmon/max31790.c b/drivers/hwmon/max31790.c
+index 281491cca5103..66cf772de7d29 100644
+--- a/drivers/hwmon/max31790.c
++++ b/drivers/hwmon/max31790.c
+@@ -179,7 +179,7 @@ static int max31790_read_fan(struct device *dev, u32 attr, int channel,
+
+ switch (attr) {
+ case hwmon_fan_input:
+- sr = get_tach_period(data->fan_dynamics[channel]);
++ sr = get_tach_period(data->fan_dynamics[channel % NR_CHANNEL]);
+ rpm = RPM_FROM_REG(data->tach[channel], sr);
+ *val = rpm;
+ return 0;
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+index 29dc2eac5b065..7f87e2c3b4828 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+@@ -470,7 +470,7 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev,
+ buf_ptr = buf->data_pages[cur] + offset;
+ *buf_ptr = readl_relaxed(drvdata->base + TMC_RRD);
+
+- if (lost && *barrier) {
++ if (lost && i < CORESIGHT_BARRIER_PKT_SIZE) {
+ *buf_ptr = *barrier;
+ barrier++;
+ }
+diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
+index 6c723b57dfc07..be2f02e35067f 100644
+--- a/drivers/hwtracing/intel_th/core.c
++++ b/drivers/hwtracing/intel_th/core.c
+@@ -215,6 +215,22 @@ static ssize_t port_show(struct device *dev, struct device_attribute *attr,
+
+ static DEVICE_ATTR_RO(port);
+
++static void intel_th_trace_prepare(struct intel_th_device *thdev)
++{
++ struct intel_th_device *hub = to_intel_th_hub(thdev);
++ struct intel_th_driver *hubdrv = to_intel_th_driver(hub->dev.driver);
++
++ if (hub->type != INTEL_TH_SWITCH)
++ return;
++
++ if (thdev->type != INTEL_TH_OUTPUT)
++ return;
++
++ pm_runtime_get_sync(&thdev->dev);
++ hubdrv->prepare(hub, &thdev->output);
++ pm_runtime_put(&thdev->dev);
++}
++
+ static int intel_th_output_activate(struct intel_th_device *thdev)
+ {
+ struct intel_th_driver *thdrv =
+@@ -235,6 +251,7 @@ static int intel_th_output_activate(struct intel_th_device *thdev)
+ if (ret)
+ goto fail_put;
+
++ intel_th_trace_prepare(thdev);
+ if (thdrv->activate)
+ ret = thdrv->activate(thdev);
+ else
+diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c
+index 5041fe7fee9ed..ef2751556fd77 100644
+--- a/drivers/hwtracing/intel_th/gth.c
++++ b/drivers/hwtracing/intel_th/gth.c
+@@ -513,6 +513,21 @@ static void gth_tscu_resync(struct gth_device *gth)
+ iowrite32(reg, gth->base + REG_TSCU_TSUCTRL);
+ }
+
++static void intel_th_gth_prepare(struct intel_th_device *thdev,
++ struct intel_th_output *output)
++{
++ struct gth_device *gth = dev_get_drvdata(&thdev->dev);
++ int count;
++
++ /*
++ * Wait until the output port is in reset before we start
++ * programming it.
++ */
++ for (count = GTH_PLE_WAITLOOP_DEPTH;
++ count && !(gth_output_get(gth, output->port) & BIT(5)); count--)
++ cpu_relax();
++}
++
+ /**
+ * intel_th_gth_enable() - enable tracing to an output device
+ * @thdev: GTH device
+@@ -734,6 +749,7 @@ static struct intel_th_driver intel_th_gth_driver = {
+ .assign = intel_th_gth_assign,
+ .unassign = intel_th_gth_unassign,
+ .set_output = intel_th_gth_set_output,
++ .prepare = intel_th_gth_prepare,
+ .enable = intel_th_gth_enable,
+ .disable = intel_th_gth_disable,
+ .driver = {
+diff --git a/drivers/hwtracing/intel_th/intel_th.h b/drivers/hwtracing/intel_th/intel_th.h
+index 780206dc9012c..6b5473f3c16f0 100644
+--- a/drivers/hwtracing/intel_th/intel_th.h
++++ b/drivers/hwtracing/intel_th/intel_th.h
+@@ -134,6 +134,7 @@ intel_th_output_assigned(struct intel_th_device *thdev)
+ * @remove: remove method
+ * @assign: match a given output type device against available outputs
+ * @unassign: deassociate an output type device from an output port
++ * @prepare: prepare output port for tracing
+ * @enable: enable tracing for a given output device
+ * @disable: disable tracing for a given output device
+ * @irq: interrupt callback
+@@ -155,6 +156,8 @@ struct intel_th_driver {
+ struct intel_th_device *othdev);
+ void (*unassign)(struct intel_th_device *thdev,
+ struct intel_th_device *othdev);
++ void (*prepare)(struct intel_th_device *thdev,
++ struct intel_th_output *output);
+ void (*enable)(struct intel_th_device *thdev,
+ struct intel_th_output *output);
+ void (*disable)(struct intel_th_device *thdev,
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 39be53b6f9838..2a43f4e46af04 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -32,6 +32,7 @@
+ #include <linux/i2c-smbus.h>
+ #include <linux/idr.h>
+ #include <linux/init.h>
++#include <linux/interrupt.h>
+ #include <linux/irqflags.h>
+ #include <linux/jump_label.h>
+ #include <linux/kernel.h>
+@@ -457,6 +458,8 @@ static void i2c_device_shutdown(struct device *dev)
+ driver = to_i2c_driver(dev->driver);
+ if (driver->shutdown)
+ driver->shutdown(client);
++ else if (client->irq > 0)
++ disable_irq(client->irq);
+ }
+
+ static void i2c_client_dev_release(struct device *dev)
+diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
+index cb9765a3de607..4bedf48d662a5 100644
+--- a/drivers/iio/accel/bma180.c
++++ b/drivers/iio/accel/bma180.c
+@@ -121,7 +121,11 @@ struct bma180_data {
+ int scale;
+ int bw;
+ bool pmode;
+- u8 buff[16]; /* 3x 16-bit + 8-bit + padding + timestamp */
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ s16 chan[4];
++ s64 timestamp __aligned(8);
++ } scan;
+ };
+
+ enum bma180_chan {
+@@ -667,12 +671,12 @@ static irqreturn_t bma180_trigger_handler(int irq, void *p)
+ mutex_unlock(&data->mutex);
+ goto err;
+ }
+- ((s16 *)data->buff)[i++] = ret;
++ data->scan.chan[i++] = ret;
+ }
+
+ mutex_unlock(&data->mutex);
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buff, time_ns);
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, time_ns);
+ err:
+ iio_trigger_notify_done(indio_dev->trig);
+
+diff --git a/drivers/iio/accel/bma220_spi.c b/drivers/iio/accel/bma220_spi.c
+index e25d91c017ed2..a548dc11e7c7b 100644
+--- a/drivers/iio/accel/bma220_spi.c
++++ b/drivers/iio/accel/bma220_spi.c
+@@ -76,7 +76,11 @@ static const int bma220_scale_table[][4] = {
+ struct bma220_data {
+ struct spi_device *spi_device;
+ struct mutex lock;
+- s8 buffer[16]; /* 3x8-bit channels + 5x8 padding + 8x8 timestamp */
++ struct {
++ s8 chans[3];
++ /* Ensure timestamp is naturally aligned. */
++ s64 timestamp __aligned(8);
++ } scan;
+ u8 tx_buf[2] ____cacheline_aligned;
+ };
+
+@@ -107,12 +111,12 @@ static irqreturn_t bma220_trigger_handler(int irq, void *p)
+
+ mutex_lock(&data->lock);
+ data->tx_buf[0] = BMA220_REG_ACCEL_X | BMA220_READ_MASK;
+- ret = spi_write_then_read(spi, data->tx_buf, 1, data->buffer,
++ ret = spi_write_then_read(spi, data->tx_buf, 1, &data->scan.chans,
+ ARRAY_SIZE(bma220_channels) - 1);
+ if (ret < 0)
+ goto err;
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ pf->timestamp);
+ err:
+ mutex_unlock(&data->lock);
+diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
+index 38ff374a3ca45..32d5438d45194 100644
+--- a/drivers/iio/accel/hid-sensor-accel-3d.c
++++ b/drivers/iio/accel/hid-sensor-accel-3d.c
+@@ -42,8 +42,11 @@ struct accel_3d_state {
+ struct hid_sensor_hub_callbacks callbacks;
+ struct hid_sensor_common common_attributes;
+ struct hid_sensor_hub_attribute_info accel[ACCEL_3D_CHANNEL_MAX];
+- /* Reserve for 3 channels + padding + timestamp */
+- u32 accel_val[ACCEL_3D_CHANNEL_MAX + 3];
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ u32 accel_val[3];
++ s64 timestamp __aligned(8);
++ } scan;
+ int scale_pre_decml;
+ int scale_post_decml;
+ int scale_precision;
+@@ -254,8 +257,8 @@ static int accel_3d_proc_event(struct hid_sensor_hub_device *hsdev,
+ accel_state->timestamp = iio_get_time_ns(indio_dev);
+
+ hid_sensor_push_data(indio_dev,
+- accel_state->accel_val,
+- sizeof(accel_state->accel_val),
++ &accel_state->scan,
++ sizeof(accel_state->scan),
+ accel_state->timestamp);
+
+ accel_state->timestamp = 0;
+@@ -280,7 +283,7 @@ static int accel_3d_capture_sample(struct hid_sensor_hub_device *hsdev,
+ case HID_USAGE_SENSOR_ACCEL_Y_AXIS:
+ case HID_USAGE_SENSOR_ACCEL_Z_AXIS:
+ offset = usage_id - HID_USAGE_SENSOR_ACCEL_X_AXIS;
+- accel_state->accel_val[CHANNEL_SCAN_INDEX_X + offset] =
++ accel_state->scan.accel_val[CHANNEL_SCAN_INDEX_X + offset] =
+ *(u32 *)raw_data;
+ ret = 0;
+ break;
+diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
+index c22afc9792067..0ca6f9de51923 100644
+--- a/drivers/iio/accel/kxcjk-1013.c
++++ b/drivers/iio/accel/kxcjk-1013.c
+@@ -140,12 +140,23 @@ enum kx_acpi_type {
+ ACPI_KIOX010A,
+ };
+
++enum kxcjk1013_axis {
++ AXIS_X,
++ AXIS_Y,
++ AXIS_Z,
++ AXIS_MAX
++};
++
+ struct kxcjk1013_data {
+ struct i2c_client *client;
+ struct iio_trigger *dready_trig;
+ struct iio_trigger *motion_trig;
+ struct mutex mutex;
+- s16 buffer[8];
++ /* Ensure timestamp naturally aligned */
++ struct {
++ s16 chans[AXIS_MAX];
++ s64 timestamp __aligned(8);
++ } scan;
+ u8 odr_bits;
+ u8 range;
+ int wake_thres;
+@@ -159,13 +170,6 @@ struct kxcjk1013_data {
+ enum kx_acpi_type acpi_type;
+ };
+
+-enum kxcjk1013_axis {
+- AXIS_X,
+- AXIS_Y,
+- AXIS_Z,
+- AXIS_MAX,
+-};
+-
+ enum kxcjk1013_mode {
+ STANDBY,
+ OPERATION,
+@@ -1086,12 +1090,12 @@ static irqreturn_t kxcjk1013_trigger_handler(int irq, void *p)
+ ret = i2c_smbus_read_i2c_block_data_or_emulated(data->client,
+ KXCJK1013_REG_XOUT_L,
+ AXIS_MAX * 2,
+- (u8 *)data->buffer);
++ (u8 *)data->scan.chans);
+ mutex_unlock(&data->mutex);
+ if (ret < 0)
+ goto err;
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ data->timestamp);
+ err:
+ iio_trigger_notify_done(indio_dev->trig);
+diff --git a/drivers/iio/accel/stk8312.c b/drivers/iio/accel/stk8312.c
+index cacc0da2f874e..52c33addf47b5 100644
+--- a/drivers/iio/accel/stk8312.c
++++ b/drivers/iio/accel/stk8312.c
+@@ -106,7 +106,11 @@ struct stk8312_data {
+ u8 mode;
+ struct iio_trigger *dready_trig;
+ bool dready_trigger_on;
+- s8 buffer[16]; /* 3x8-bit channels + 5x8 padding + 64-bit timestamp */
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ s8 chans[3];
++ s64 timestamp __aligned(8);
++ } scan;
+ };
+
+ static IIO_CONST_ATTR(in_accel_scale_available, STK8312_SCALE_AVAIL);
+@@ -441,7 +445,7 @@ static irqreturn_t stk8312_trigger_handler(int irq, void *p)
+ ret = i2c_smbus_read_i2c_block_data(data->client,
+ STK8312_REG_XOUT,
+ STK8312_ALL_CHANNEL_SIZE,
+- data->buffer);
++ data->scan.chans);
+ if (ret < STK8312_ALL_CHANNEL_SIZE) {
+ dev_err(&data->client->dev, "register read failed\n");
+ mutex_unlock(&data->lock);
+@@ -455,12 +459,12 @@ static irqreturn_t stk8312_trigger_handler(int irq, void *p)
+ mutex_unlock(&data->lock);
+ goto err;
+ }
+- data->buffer[i++] = ret;
++ data->scan.chans[i++] = ret;
+ }
+ }
+ mutex_unlock(&data->lock);
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ pf->timestamp);
+ err:
+ iio_trigger_notify_done(indio_dev->trig);
+diff --git a/drivers/iio/accel/stk8ba50.c b/drivers/iio/accel/stk8ba50.c
+index 576b6b140f080..0d9067d3ccc48 100644
+--- a/drivers/iio/accel/stk8ba50.c
++++ b/drivers/iio/accel/stk8ba50.c
+@@ -94,12 +94,11 @@ struct stk8ba50_data {
+ u8 sample_rate_idx;
+ struct iio_trigger *dready_trig;
+ bool dready_trigger_on;
+- /*
+- * 3 x 16-bit channels (10-bit data, 6-bit padding) +
+- * 1 x 16 padding +
+- * 4 x 16 64-bit timestamp
+- */
+- s16 buffer[8];
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ s16 chans[3];
++ s64 timetamp __aligned(8);
++ } scan;
+ };
+
+ #define STK8BA50_ACCEL_CHANNEL(index, reg, axis) { \
+@@ -327,7 +326,7 @@ static irqreturn_t stk8ba50_trigger_handler(int irq, void *p)
+ ret = i2c_smbus_read_i2c_block_data(data->client,
+ STK8BA50_REG_XOUT,
+ STK8BA50_ALL_CHANNEL_SIZE,
+- (u8 *)data->buffer);
++ (u8 *)data->scan.chans);
+ if (ret < STK8BA50_ALL_CHANNEL_SIZE) {
+ dev_err(&data->client->dev, "register read failed\n");
+ goto err;
+@@ -340,10 +339,10 @@ static irqreturn_t stk8ba50_trigger_handler(int irq, void *p)
+ if (ret < 0)
+ goto err;
+
+- data->buffer[i++] = ret;
++ data->scan.chans[i++] = ret;
+ }
+ }
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ pf->timestamp);
+ err:
+ mutex_unlock(&data->lock);
+diff --git a/drivers/iio/adc/hx711.c b/drivers/iio/adc/hx711.c
+index 6c5d81a89aec9..0dc487dd16749 100644
+--- a/drivers/iio/adc/hx711.c
++++ b/drivers/iio/adc/hx711.c
+@@ -94,9 +94,9 @@ struct hx711_data {
+ struct mutex lock;
+ /*
+ * triggered buffer
+- * 2x32-bit channel + 64-bit timestamp
++ * 2x32-bit channel + 64-bit naturally aligned timestamp
+ */
+- u32 buffer[4];
++ u32 buffer[4] __aligned(8);
+ /*
+ * delay after a rising edge on SCK until the data is ready DOUT
+ * this is dependent on the hx711 where the datasheet tells a
+diff --git a/drivers/iio/adc/mxs-lradc-adc.c b/drivers/iio/adc/mxs-lradc-adc.c
+index c627513d9f0f2..fc8b70d8d64c9 100644
+--- a/drivers/iio/adc/mxs-lradc-adc.c
++++ b/drivers/iio/adc/mxs-lradc-adc.c
+@@ -124,7 +124,8 @@ struct mxs_lradc_adc {
+ struct device *dev;
+
+ void __iomem *base;
+- u32 buffer[10];
++ /* Maximum of 8 channels + 8 byte ts */
++ u32 buffer[10] __aligned(8);
+ struct iio_trigger *trig;
+ struct completion completion;
+ spinlock_t lock;
+diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
+index dc8d859e4b92c..b1cccc3eeea61 100644
+--- a/drivers/iio/adc/ti-ads1015.c
++++ b/drivers/iio/adc/ti-ads1015.c
+@@ -391,10 +391,14 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct ads1015_data *data = iio_priv(indio_dev);
+- s16 buf[8]; /* 1x s16 ADC val + 3x s16 padding + 4x s16 timestamp */
++ /* Ensure natural alignment of timestamp */
++ struct {
++ s16 chan;
++ s64 timestamp __aligned(8);
++ } scan;
+ int chan, ret, res;
+
+- memset(buf, 0, sizeof(buf));
++ memset(&scan, 0, sizeof(scan));
+
+ mutex_lock(&data->lock);
+ chan = find_first_bit(indio_dev->active_scan_mask,
+@@ -405,10 +409,10 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p)
+ goto err;
+ }
+
+- buf[0] = res;
++ scan.chan = res;
+ mutex_unlock(&data->lock);
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buf,
++ iio_push_to_buffers_with_timestamp(indio_dev, &scan,
+ iio_get_time_ns(indio_dev));
+
+ err:
+diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c
+index 7f16c77b99fb4..9bcb05897c9da 100644
+--- a/drivers/iio/adc/ti-ads8688.c
++++ b/drivers/iio/adc/ti-ads8688.c
+@@ -386,7 +386,8 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p)
+ {
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+- u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)];
++ /* Ensure naturally aligned timestamp */
++ u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)] __aligned(8);
+ int i, j = 0;
+
+ for (i = 0; i < indio_dev->masklength; i++) {
+diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
+index bbcb7a4d7edfd..3e480244ad9a0 100644
+--- a/drivers/iio/adc/vf610_adc.c
++++ b/drivers/iio/adc/vf610_adc.c
+@@ -180,7 +180,11 @@ struct vf610_adc {
+ u32 sample_freq_avail[5];
+
+ struct completion completion;
+- u16 buffer[8];
++ /* Ensure the timestamp is naturally aligned */
++ struct {
++ u16 chan;
++ s64 timestamp __aligned(8);
++ } scan;
+ };
+
+ static const u32 vf610_hw_avgs[] = { 1, 4, 8, 16, 32 };
+@@ -592,9 +596,9 @@ static irqreturn_t vf610_adc_isr(int irq, void *dev_id)
+ if (coco & VF610_ADC_HS_COCO0) {
+ info->value = vf610_adc_read_data(info);
+ if (iio_buffer_enabled(indio_dev)) {
+- info->buffer[0] = info->value;
++ info->scan.chan = info->value;
+ iio_push_to_buffers_with_timestamp(indio_dev,
+- info->buffer,
++ &info->scan,
+ iio_get_time_ns(indio_dev));
+ iio_trigger_notify_done(indio_dev->trig);
+ } else
+diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c
+index 92c07ab826eb3..ef8ef96201f62 100644
+--- a/drivers/iio/gyro/bmg160_core.c
++++ b/drivers/iio/gyro/bmg160_core.c
+@@ -103,7 +103,11 @@ struct bmg160_data {
+ struct iio_trigger *dready_trig;
+ struct iio_trigger *motion_trig;
+ struct mutex mutex;
+- s16 buffer[8];
++ /* Ensure naturally aligned timestamp */
++ struct {
++ s16 chans[3];
++ s64 timestamp __aligned(8);
++ } scan;
+ u32 dps_range;
+ int ev_enable_state;
+ int slope_thres;
+@@ -872,12 +876,12 @@ static irqreturn_t bmg160_trigger_handler(int irq, void *p)
+
+ mutex_lock(&data->mutex);
+ ret = regmap_bulk_read(data->regmap, BMG160_REG_XOUT_L,
+- data->buffer, AXIS_MAX * 2);
++ data->scan.chans, AXIS_MAX * 2);
+ mutex_unlock(&data->mutex);
+ if (ret < 0)
+ goto err;
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ pf->timestamp);
+ err:
+ iio_trigger_notify_done(indio_dev->trig);
+diff --git a/drivers/iio/humidity/am2315.c b/drivers/iio/humidity/am2315.c
+index 7d8669dc6547c..b09bd0b39c9c9 100644
+--- a/drivers/iio/humidity/am2315.c
++++ b/drivers/iio/humidity/am2315.c
+@@ -36,7 +36,11 @@
+ struct am2315_data {
+ struct i2c_client *client;
+ struct mutex lock;
+- s16 buffer[8]; /* 2x16-bit channels + 2x16 padding + 4x16 timestamp */
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ s16 chans[2];
++ s64 timestamp __aligned(8);
++ } scan;
+ };
+
+ struct am2315_sensor_data {
+@@ -170,20 +174,20 @@ static irqreturn_t am2315_trigger_handler(int irq, void *p)
+
+ mutex_lock(&data->lock);
+ if (*(indio_dev->active_scan_mask) == AM2315_ALL_CHANNEL_MASK) {
+- data->buffer[0] = sensor_data.hum_data;
+- data->buffer[1] = sensor_data.temp_data;
++ data->scan.chans[0] = sensor_data.hum_data;
++ data->scan.chans[1] = sensor_data.temp_data;
+ } else {
+ i = 0;
+ for_each_set_bit(bit, indio_dev->active_scan_mask,
+ indio_dev->masklength) {
+- data->buffer[i] = (bit ? sensor_data.temp_data :
+- sensor_data.hum_data);
++ data->scan.chans[i] = (bit ? sensor_data.temp_data :
++ sensor_data.hum_data);
+ i++;
+ }
+ }
+ mutex_unlock(&data->lock);
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ pf->timestamp);
+ err:
+ iio_trigger_notify_done(indio_dev->trig);
+diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c
+index e59d0438de732..bde68462b5ed2 100644
+--- a/drivers/iio/imu/adis_buffer.c
++++ b/drivers/iio/imu/adis_buffer.c
+@@ -83,9 +83,6 @@ static irqreturn_t adis_trigger_handler(int irq, void *p)
+ struct adis *adis = iio_device_get_drvdata(indio_dev);
+ int ret;
+
+- if (!adis->buffer)
+- return -ENOMEM;
+-
+ if (adis->data->has_paging) {
+ mutex_lock(&adis->txrx_lock);
+ if (adis->current_page != 0) {
+diff --git a/drivers/iio/light/isl29125.c b/drivers/iio/light/isl29125.c
+index ed38edcd5efe7..d0f5fd42c0ece 100644
+--- a/drivers/iio/light/isl29125.c
++++ b/drivers/iio/light/isl29125.c
+@@ -54,7 +54,11 @@
+ struct isl29125_data {
+ struct i2c_client *client;
+ u8 conf1;
+- u16 buffer[8]; /* 3x 16-bit, padding, 8 bytes timestamp */
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ u16 chans[3];
++ s64 timestamp __aligned(8);
++ } scan;
+ };
+
+ #define ISL29125_CHANNEL(_color, _si) { \
+@@ -187,10 +191,10 @@ static irqreturn_t isl29125_trigger_handler(int irq, void *p)
+ if (ret < 0)
+ goto done;
+
+- data->buffer[j++] = ret;
++ data->scan.chans[j++] = ret;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ iio_get_time_ns(indio_dev));
+
+ done:
+diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
+index 947f17588024a..f3fb79c231be6 100644
+--- a/drivers/iio/light/ltr501.c
++++ b/drivers/iio/light/ltr501.c
+@@ -35,9 +35,12 @@
+ #define LTR501_PART_ID 0x86
+ #define LTR501_MANUFAC_ID 0x87
+ #define LTR501_ALS_DATA1 0x88 /* 16-bit, little endian */
++#define LTR501_ALS_DATA1_UPPER 0x89 /* upper 8 bits of LTR501_ALS_DATA1 */
+ #define LTR501_ALS_DATA0 0x8a /* 16-bit, little endian */
++#define LTR501_ALS_DATA0_UPPER 0x8b /* upper 8 bits of LTR501_ALS_DATA0 */
+ #define LTR501_ALS_PS_STATUS 0x8c
+ #define LTR501_PS_DATA 0x8d /* 16-bit, little endian */
++#define LTR501_PS_DATA_UPPER 0x8e /* upper 8 bits of LTR501_PS_DATA */
+ #define LTR501_INTR 0x8f /* output mode, polarity, mode */
+ #define LTR501_PS_THRESH_UP 0x90 /* 11 bit, ps upper threshold */
+ #define LTR501_PS_THRESH_LOW 0x92 /* 11 bit, ps lower threshold */
+@@ -408,18 +411,19 @@ static int ltr501_read_als(struct ltr501_data *data, __le16 buf[2])
+
+ static int ltr501_read_ps(struct ltr501_data *data)
+ {
+- int ret, status;
++ __le16 status;
++ int ret;
+
+ ret = ltr501_drdy(data, LTR501_STATUS_PS_RDY);
+ if (ret < 0)
+ return ret;
+
+ ret = regmap_bulk_read(data->regmap, LTR501_PS_DATA,
+- &status, 2);
++ &status, sizeof(status));
+ if (ret < 0)
+ return ret;
+
+- return status;
++ return le16_to_cpu(status);
+ }
+
+ static int ltr501_read_intr_prst(struct ltr501_data *data,
+@@ -1207,7 +1211,7 @@ static struct ltr501_chip_info ltr501_chip_info_tbl[] = {
+ .als_gain_tbl_size = ARRAY_SIZE(ltr559_als_gain_tbl),
+ .ps_gain = ltr559_ps_gain_tbl,
+ .ps_gain_tbl_size = ARRAY_SIZE(ltr559_ps_gain_tbl),
+- .als_mode_active = BIT(1),
++ .als_mode_active = BIT(0),
+ .als_gain_mask = BIT(2) | BIT(3) | BIT(4),
+ .als_gain_shift = 2,
+ .info = <r501_info,
+@@ -1356,9 +1360,12 @@ static bool ltr501_is_volatile_reg(struct device *dev, unsigned int reg)
+ {
+ switch (reg) {
+ case LTR501_ALS_DATA1:
++ case LTR501_ALS_DATA1_UPPER:
+ case LTR501_ALS_DATA0:
++ case LTR501_ALS_DATA0_UPPER:
+ case LTR501_ALS_PS_STATUS:
+ case LTR501_PS_DATA:
++ case LTR501_PS_DATA_UPPER:
+ return true;
+ default:
+ return false;
+diff --git a/drivers/iio/light/tcs3414.c b/drivers/iio/light/tcs3414.c
+index 205e5659ce6b5..c525420e7c62e 100644
+--- a/drivers/iio/light/tcs3414.c
++++ b/drivers/iio/light/tcs3414.c
+@@ -56,7 +56,11 @@ struct tcs3414_data {
+ u8 control;
+ u8 gain;
+ u8 timing;
+- u16 buffer[8]; /* 4x 16-bit + 8 bytes timestamp */
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ u16 chans[4];
++ s64 timestamp __aligned(8);
++ } scan;
+ };
+
+ #define TCS3414_CHANNEL(_color, _si, _addr) { \
+@@ -212,10 +216,10 @@ static irqreturn_t tcs3414_trigger_handler(int irq, void *p)
+ if (ret < 0)
+ goto done;
+
+- data->buffer[j++] = ret;
++ data->scan.chans[j++] = ret;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ iio_get_time_ns(indio_dev));
+
+ done:
+diff --git a/drivers/iio/light/tcs3472.c b/drivers/iio/light/tcs3472.c
+index e7923b514d7ac..82204414c7a1d 100644
+--- a/drivers/iio/light/tcs3472.c
++++ b/drivers/iio/light/tcs3472.c
+@@ -67,7 +67,11 @@ struct tcs3472_data {
+ u8 control;
+ u8 atime;
+ u8 apers;
+- u16 buffer[8]; /* 4 16-bit channels + 64-bit timestamp */
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ u16 chans[4];
++ s64 timestamp __aligned(8);
++ } scan;
+ };
+
+ static const struct iio_event_spec tcs3472_events[] = {
+@@ -389,10 +393,10 @@ static irqreturn_t tcs3472_trigger_handler(int irq, void *p)
+ if (ret < 0)
+ goto done;
+
+- data->buffer[j++] = ret;
++ data->scan.chans[j++] = ret;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ iio_get_time_ns(indio_dev));
+
+ done:
+@@ -535,7 +539,8 @@ static int tcs3472_probe(struct i2c_client *client,
+ return 0;
+
+ free_irq:
+- free_irq(client->irq, indio_dev);
++ if (client->irq)
++ free_irq(client->irq, indio_dev);
+ buffer_cleanup:
+ iio_triggered_buffer_cleanup(indio_dev);
+ return ret;
+@@ -563,7 +568,8 @@ static int tcs3472_remove(struct i2c_client *client)
+ struct iio_dev *indio_dev = i2c_get_clientdata(client);
+
+ iio_device_unregister(indio_dev);
+- free_irq(client->irq, indio_dev);
++ if (client->irq)
++ free_irq(client->irq, indio_dev);
+ iio_triggered_buffer_cleanup(indio_dev);
+ tcs3472_powerdown(iio_priv(indio_dev));
+
+diff --git a/drivers/iio/potentiostat/lmp91000.c b/drivers/iio/potentiostat/lmp91000.c
+index 90e895adf9975..68f4f6fa27da3 100644
+--- a/drivers/iio/potentiostat/lmp91000.c
++++ b/drivers/iio/potentiostat/lmp91000.c
+@@ -71,8 +71,8 @@ struct lmp91000_data {
+
+ struct completion completion;
+ u8 chan_select;
+-
+- u32 buffer[4]; /* 64-bit data + 64-bit timestamp */
++ /* 64-bit data + 64-bit naturally aligned timestamp */
++ u32 buffer[4] __aligned(8);
+ };
+
+ static const struct iio_chan_spec lmp91000_channels[] = {
+diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
+index f130388a16a0c..9069eec46093c 100644
+--- a/drivers/iio/proximity/as3935.c
++++ b/drivers/iio/proximity/as3935.c
+@@ -61,7 +61,11 @@ struct as3935_state {
+ unsigned long noise_tripped;
+ u32 tune_cap;
+ u32 nflwdth_reg;
+- u8 buffer[16]; /* 8-bit data + 56-bit padding + 64-bit timestamp */
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ u8 chan;
++ s64 timestamp __aligned(8);
++ } scan;
+ u8 buf[2] ____cacheline_aligned;
+ };
+
+@@ -227,8 +231,8 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
+ if (ret)
+ goto err_read;
+
+- st->buffer[0] = val & AS3935_DATA_MASK;
+- iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer,
++ st->scan.chan = val & AS3935_DATA_MASK;
++ iio_push_to_buffers_with_timestamp(indio_dev, &st->scan,
+ iio_get_time_ns(indio_dev));
+ err_read:
+ iio_trigger_notify_done(indio_dev->trig);
+diff --git a/drivers/iio/proximity/isl29501.c b/drivers/iio/proximity/isl29501.c
+index e5e94540f404d..a99d26023ef7b 100644
+--- a/drivers/iio/proximity/isl29501.c
++++ b/drivers/iio/proximity/isl29501.c
+@@ -946,7 +946,7 @@ static irqreturn_t isl29501_trigger_handler(int irq, void *p)
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct isl29501_private *isl29501 = iio_priv(indio_dev);
+ const unsigned long *active_mask = indio_dev->active_scan_mask;
+- u32 buffer[4] = {}; /* 1x16-bit + ts */
++ u32 buffer[4] __aligned(8) = {}; /* 1x16-bit + naturally aligned ts */
+
+ if (test_bit(ISL29501_DISTANCE_SCAN_INDEX, active_mask))
+ isl29501_register_read(isl29501, REG_DISTANCE, buffer);
+diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
+index 67f85268b63db..0c76170224071 100644
+--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
++++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
+@@ -43,7 +43,11 @@ struct lidar_data {
+ int (*xfer)(struct lidar_data *data, u8 reg, u8 *val, int len);
+ int i2c_enabled;
+
+- u16 buffer[8]; /* 2 byte distance + 8 byte timestamp */
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ u16 chan;
++ s64 timestamp __aligned(8);
++ } scan;
+ };
+
+ static const struct iio_chan_spec lidar_channels[] = {
+@@ -228,9 +232,9 @@ static irqreturn_t lidar_trigger_handler(int irq, void *private)
+ struct lidar_data *data = iio_priv(indio_dev);
+ int ret;
+
+- ret = lidar_get_measurement(data, data->buffer);
++ ret = lidar_get_measurement(data, &data->scan.chan);
+ if (!ret) {
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ iio_get_time_ns(indio_dev));
+ } else if (ret != -EINVAL) {
+ dev_err(&data->client->dev, "cannot read LIDAR measurement");
+diff --git a/drivers/iio/proximity/srf08.c b/drivers/iio/proximity/srf08.c
+index f2bf783f829a0..5e8d3707738b3 100644
+--- a/drivers/iio/proximity/srf08.c
++++ b/drivers/iio/proximity/srf08.c
+@@ -66,11 +66,11 @@ struct srf08_data {
+ int range_mm;
+ struct mutex lock;
+
+- /*
+- * triggered buffer
+- * 1x16-bit channel + 3x16 padding + 4x16 timestamp
+- */
+- s16 buffer[8];
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ s16 chan;
++ s64 timestamp __aligned(8);
++ } scan;
+
+ /* Sensor-Type */
+ enum srf08_sensor_type sensor_type;
+@@ -193,9 +193,9 @@ static irqreturn_t srf08_trigger_handler(int irq, void *p)
+
+ mutex_lock(&data->lock);
+
+- data->buffer[0] = sensor_data;
++ data->scan.chan = sensor_data;
+ iio_push_to_buffers_with_timestamp(indio_dev,
+- data->buffer, pf->timestamp);
++ &data->scan, pf->timestamp);
+
+ mutex_unlock(&data->lock);
+ err:
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 8cdf933310d15..842a30947bdc0 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2558,7 +2558,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms)
+
+ cma_init_resolve_route_work(work, id_priv);
+
+- route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL);
++ if (!route->path_rec)
++ route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL);
+ if (!route->path_rec) {
+ ret = -ENOMEM;
+ goto err1;
+diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
+index caa6a502c37e2..20e3128f59b14 100644
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -295,6 +295,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
+ if (user && (!wq->sq.bar2_pa || (need_rq && !wq->rq.bar2_pa))) {
+ pr_warn("%s: sqid %u or rqid %u not in BAR2 range\n",
+ pci_name(rdev->lldi.pdev), wq->sq.qid, wq->rq.qid);
++ ret = -EINVAL;
+ goto free_dma;
+ }
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 13513466df01f..1688c06d5c3c7 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -5374,8 +5374,6 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev,
+
+ port->mp.mpi = NULL;
+
+- list_add_tail(&mpi->list, &mlx5_ib_unaffiliated_port_list);
+-
+ spin_unlock(&port->mp.mpi_lock);
+
+ err = mlx5_nic_vport_unaffiliate_multiport(mpi->mdev);
+@@ -5524,6 +5522,8 @@ static void mlx5_ib_cleanup_multiport_master(struct mlx5_ib_dev *dev)
+ dev->port[i].mp.mpi = NULL;
+ } else {
+ mlx5_ib_dbg(dev, "unbinding port_num: %d\n", i + 1);
++ list_add_tail(&dev->port[i].mp.mpi->list,
++ &mlx5_ib_unaffiliated_port_list);
+ mlx5_ib_unbind_slave_port(dev, dev->port[i].mp.mpi);
+ }
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index 2cca89ca08cd4..375e5520865e5 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -175,7 +175,7 @@ int rxe_mem_init_user(struct rxe_pd *pd, u64 start,
+ if (IS_ERR(umem)) {
+ pr_warn("err %d from rxe_umem_get\n",
+ (int)PTR_ERR(umem));
+- err = -EINVAL;
++ err = PTR_ERR(umem);
+ goto err1;
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
+index 04bfc36cc8d76..5874e8e8253d6 100644
+--- a/drivers/infiniband/sw/rxe/rxe_net.c
++++ b/drivers/infiniband/sw/rxe/rxe_net.c
+@@ -290,10 +290,8 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port,
+
+ /* Create UDP socket */
+ err = udp_sock_create(net, &udp_cfg, &sock);
+- if (err < 0) {
+- pr_err("failed to create udp socket. err = %d\n", err);
++ if (err < 0)
+ return ERR_PTR(err);
+- }
+
+ tnl_cfg.encap_type = 1;
+ tnl_cfg.encap_rcv = rxe_udp_encap_recv;
+@@ -717,6 +715,12 @@ static int rxe_net_ipv6_init(void)
+
+ recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net,
+ htons(ROCE_V2_UDP_DPORT), true);
++ if (PTR_ERR(recv_sockets.sk6) == -EAFNOSUPPORT) {
++ recv_sockets.sk6 = NULL;
++ pr_warn("IPv6 is not supported, can not create a UDPv6 socket\n");
++ return 0;
++ }
++
+ if (IS_ERR(recv_sockets.sk6)) {
+ recv_sockets.sk6 = NULL;
+ pr_err("Failed to create IPv6 UDP tunnel\n");
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 41c9ede98c265..4798b718b085b 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -151,7 +151,6 @@ static void free_rd_atomic_resources(struct rxe_qp *qp)
+ void free_rd_atomic_resource(struct rxe_qp *qp, struct resp_res *res)
+ {
+ if (res->type == RXE_ATOMIC_MASK) {
+- rxe_drop_ref(qp);
+ kfree_skb(res->atomic.skb);
+ } else if (res->type == RXE_READ_MASK) {
+ if (res->read.mr)
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 9078cfd3b8bdd..b36d364f0fb54 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -999,8 +999,6 @@ static int send_atomic_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
+ goto out;
+ }
+
+- rxe_add_ref(qp);
+-
+ res = &qp->resp.resources[qp->resp.res_head];
+ free_rd_atomic_resource(qp, res);
+ rxe_advance_resp_resource(qp);
+diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
+index 7ef6e1c165e35..9123799365e63 100644
+--- a/drivers/input/joydev.c
++++ b/drivers/input/joydev.c
+@@ -504,7 +504,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev,
+ memcpy(joydev->keypam, keypam, len);
+
+ for (i = 0; i < joydev->nkey; i++)
+- joydev->keymap[keypam[i] - BTN_MISC] = i;
++ joydev->keymap[joydev->keypam[i] - BTN_MISC] = i;
+
+ out:
+ kfree(keypam);
+diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c
+index bb29a7c9a1c0c..54afb38601b9f 100644
+--- a/drivers/input/keyboard/hil_kbd.c
++++ b/drivers/input/keyboard/hil_kbd.c
+@@ -512,6 +512,7 @@ static int hil_dev_connect(struct serio *serio, struct serio_driver *drv)
+ HIL_IDD_NUM_AXES_PER_SET(*idd)) {
+ printk(KERN_INFO PREFIX
+ "combo devices are not supported.\n");
++ error = -EINVAL;
+ goto bail1;
+ }
+
+diff --git a/drivers/input/touchscreen/hideep.c b/drivers/input/touchscreen/hideep.c
+index f1cd4dd9a4a34..d7775db0b7114 100644
+--- a/drivers/input/touchscreen/hideep.c
++++ b/drivers/input/touchscreen/hideep.c
+@@ -364,13 +364,16 @@ static int hideep_enter_pgm(struct hideep_ts *ts)
+ return -EIO;
+ }
+
+-static void hideep_nvm_unlock(struct hideep_ts *ts)
++static int hideep_nvm_unlock(struct hideep_ts *ts)
+ {
+ u32 unmask_code;
++ int error;
+
+ hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_SFR_RPAGE);
+- hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code);
++ error = hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code);
+ hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE);
++ if (error)
++ return error;
+
+ /* make it unprotected code */
+ unmask_code &= ~HIDEEP_PROT_MODE;
+@@ -387,6 +390,8 @@ static void hideep_nvm_unlock(struct hideep_ts *ts)
+ NVM_W_SFR(HIDEEP_NVM_MASK_OFS, ts->nvm_mask);
+ SET_FLASH_HWCONTROL();
+ hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE);
++
++ return 0;
+ }
+
+ static int hideep_check_status(struct hideep_ts *ts)
+@@ -465,7 +470,9 @@ static int hideep_program_nvm(struct hideep_ts *ts,
+ u32 addr = 0;
+ int error;
+
+- hideep_nvm_unlock(ts);
++ error = hideep_nvm_unlock(ts);
++ if (error)
++ return error;
+
+ while (ucode_len > 0) {
+ xfer_len = min_t(size_t, ucode_len, HIDEEP_NVM_PAGE_SIZE);
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index d939c17985182..3f556af80bc56 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -264,7 +264,7 @@ static int e2i_init(struct usbtouch_usb *usbtouch)
+ int ret;
+ struct usb_device *udev = interface_to_usbdev(usbtouch->interface);
+
+- ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
++ ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ 0x01, 0x02, 0x0000, 0x0081,
+ NULL, 0, USB_CTRL_SET_TIMEOUT);
+
+@@ -544,7 +544,7 @@ static int mtouch_init(struct usbtouch_usb *usbtouch)
+ if (ret)
+ return ret;
+
+- ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
++ ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ MTOUCHUSB_RESET,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 1, 0, NULL, 0, USB_CTRL_SET_TIMEOUT);
+@@ -556,7 +556,7 @@ static int mtouch_init(struct usbtouch_usb *usbtouch)
+ msleep(150);
+
+ for (i = 0; i < 3; i++) {
+- ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
++ ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ MTOUCHUSB_ASYNC_REPORT,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 1, 1, NULL, 0, USB_CTRL_SET_TIMEOUT);
+@@ -735,7 +735,7 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
+ }
+
+ /* start sending data */
+- ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
++ ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+ TSC10_CMD_DATA1,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 0, 0, NULL, 0, USB_CTRL_SET_TIMEOUT);
+diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c
+index b5eec18ad59a5..7895320e50c1e 100644
+--- a/drivers/ipack/carriers/tpci200.c
++++ b/drivers/ipack/carriers/tpci200.c
+@@ -599,8 +599,11 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
+
+ out_err_bus_register:
+ tpci200_uninstall(tpci200);
++ /* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */
++ tpci200->info->cfg_regs = NULL;
+ out_err_install:
+- iounmap(tpci200->info->cfg_regs);
++ if (tpci200->info->cfg_regs)
++ iounmap(tpci200->info->cfg_regs);
+ out_err_ioremap:
+ pci_release_region(pdev, TPCI200_CFG_MEM_BAR);
+ out_err_pci_request:
+diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
+index ebb3fa2e1d00f..53349850f8669 100644
+--- a/drivers/isdn/hardware/mISDN/hfcpci.c
++++ b/drivers/isdn/hardware/mISDN/hfcpci.c
+@@ -2348,7 +2348,7 @@ static void __exit
+ HFC_cleanup(void)
+ {
+ if (timer_pending(&hfc_tl))
+- del_timer(&hfc_tl);
++ del_timer_sync(&hfc_tl);
+
+ pci_unregister_driver(&hfc_driver);
+ }
+diff --git a/drivers/leds/leds-as3645a.c b/drivers/leds/leds-as3645a.c
+index f883616d9e606..821944379f2cf 100644
+--- a/drivers/leds/leds-as3645a.c
++++ b/drivers/leds/leds-as3645a.c
+@@ -565,6 +565,7 @@ static int as3645a_parse_node(struct as3645a *flash,
+ if (!flash->indicator_node) {
+ dev_warn(&flash->client->dev,
+ "can't find indicator node\n");
++ rval = -ENODEV;
+ goto out_err;
+ }
+
+diff --git a/drivers/leds/leds-ktd2692.c b/drivers/leds/leds-ktd2692.c
+index 45296aaca9daa..02738b5b1dbf2 100644
+--- a/drivers/leds/leds-ktd2692.c
++++ b/drivers/leds/leds-ktd2692.c
+@@ -259,6 +259,17 @@ static void ktd2692_setup(struct ktd2692_context *led)
+ | KTD2692_REG_FLASH_CURRENT_BASE);
+ }
+
++static void regulator_disable_action(void *_data)
++{
++ struct device *dev = _data;
++ struct ktd2692_context *led = dev_get_drvdata(dev);
++ int ret;
++
++ ret = regulator_disable(led->regulator);
++ if (ret)
++ dev_err(dev, "Failed to disable supply: %d\n", ret);
++}
++
+ static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev,
+ struct ktd2692_led_config_data *cfg)
+ {
+@@ -289,8 +300,14 @@ static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev,
+
+ if (led->regulator) {
+ ret = regulator_enable(led->regulator);
+- if (ret)
++ if (ret) {
+ dev_err(dev, "Failed to enable supply: %d\n", ret);
++ } else {
++ ret = devm_add_action_or_reset(dev,
++ regulator_disable_action, dev);
++ if (ret)
++ return ret;
++ }
+ }
+
+ child_node = of_get_next_available_child(np, NULL);
+@@ -380,17 +397,9 @@ static int ktd2692_probe(struct platform_device *pdev)
+ static int ktd2692_remove(struct platform_device *pdev)
+ {
+ struct ktd2692_context *led = platform_get_drvdata(pdev);
+- int ret;
+
+ led_classdev_flash_unregister(&led->fled_cdev);
+
+- if (led->regulator) {
+- ret = regulator_disable(led->regulator);
+- if (ret)
+- dev_err(&pdev->dev,
+- "Failed to disable supply: %d\n", ret);
+- }
+-
+ mutex_destroy(&led->lock);
+
+ return 0;
+diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
+index eff04fa23dfad..9e4d1212f4c16 100644
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -549,7 +549,8 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
+ delete_at(n, index);
+ }
+
+- *new_root = shadow_root(&spine);
++ if (!r)
++ *new_root = shadow_root(&spine);
+ exit_shadow_spine(&spine);
+
+ return r;
+diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
+index bf4c5e2ccb6ff..e0acae7a3815d 100644
+--- a/drivers/md/persistent-data/dm-space-map-disk.c
++++ b/drivers/md/persistent-data/dm-space-map-disk.c
+@@ -171,6 +171,14 @@ static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b)
+ * Any block we allocate has to be free in both the old and current ll.
+ */
+ r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, smd->begin, smd->ll.nr_blocks, b);
++ if (r == -ENOSPC) {
++ /*
++ * There's no free block between smd->begin and the end of the metadata device.
++ * We search before smd->begin in case something has been freed.
++ */
++ r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, 0, smd->begin, b);
++ }
++
+ if (r)
+ return r;
+
+@@ -199,7 +207,6 @@ static int sm_disk_commit(struct dm_space_map *sm)
+ return r;
+
+ memcpy(&smd->old_ll, &smd->ll, sizeof(smd->old_ll));
+- smd->begin = 0;
+ smd->nr_allocated_this_transaction = 0;
+
+ r = sm_disk_get_nr_free(sm, &nr_free);
+diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
+index 9e3c64ec2026f..da439ac857963 100644
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -452,6 +452,14 @@ static int sm_metadata_new_block_(struct dm_space_map *sm, dm_block_t *b)
+ * Any block we allocate has to be free in both the old and current ll.
+ */
+ r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, smm->begin, smm->ll.nr_blocks, b);
++ if (r == -ENOSPC) {
++ /*
++ * There's no free block between smm->begin and the end of the metadata device.
++ * We search before smm->begin in case something has been freed.
++ */
++ r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, 0, smm->begin, b);
++ }
++
+ if (r)
+ return r;
+
+@@ -503,7 +511,6 @@ static int sm_metadata_commit(struct dm_space_map *sm)
+ return r;
+
+ memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll));
+- smm->begin = 0;
+ smm->allocated_this_transaction = 0;
+
+ return 0;
+diff --git a/drivers/media/common/siano/smscoreapi.c b/drivers/media/common/siano/smscoreapi.c
+index 3b02cb570a6ea..661920dd84d12 100644
+--- a/drivers/media/common/siano/smscoreapi.c
++++ b/drivers/media/common/siano/smscoreapi.c
+@@ -916,7 +916,7 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev,
+ void *buffer, size_t size)
+ {
+ struct sms_firmware *firmware = (struct sms_firmware *) buffer;
+- struct sms_msg_data4 *msg;
++ struct sms_msg_data5 *msg;
+ u32 mem_address, calc_checksum = 0;
+ u32 i, *ptr;
+ u8 *payload = firmware->payload;
+@@ -997,24 +997,20 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev,
+ goto exit_fw_download;
+
+ if (coredev->mode == DEVICE_MODE_NONE) {
+- struct sms_msg_data *trigger_msg =
+- (struct sms_msg_data *) msg;
+-
+ pr_debug("sending MSG_SMS_SWDOWNLOAD_TRIGGER_REQ\n");
+ SMS_INIT_MSG(&msg->x_msg_header,
+ MSG_SMS_SWDOWNLOAD_TRIGGER_REQ,
+- sizeof(struct sms_msg_hdr) +
+- sizeof(u32) * 5);
++ sizeof(*msg));
+
+- trigger_msg->msg_data[0] = firmware->start_address;
++ msg->msg_data[0] = firmware->start_address;
+ /* Entry point */
+- trigger_msg->msg_data[1] = 6; /* Priority */
+- trigger_msg->msg_data[2] = 0x200; /* Stack size */
+- trigger_msg->msg_data[3] = 0; /* Parameter */
+- trigger_msg->msg_data[4] = 4; /* Task ID */
++ msg->msg_data[1] = 6; /* Priority */
++ msg->msg_data[2] = 0x200; /* Stack size */
++ msg->msg_data[3] = 0; /* Parameter */
++ msg->msg_data[4] = 4; /* Task ID */
+
+- rc = smscore_sendrequest_and_wait(coredev, trigger_msg,
+- trigger_msg->x_msg_header.msg_length,
++ rc = smscore_sendrequest_and_wait(coredev, msg,
++ msg->x_msg_header.msg_length,
+ &coredev->trigger_done);
+ } else {
+ SMS_INIT_MSG(&msg->x_msg_header, MSG_SW_RELOAD_EXEC_REQ,
+diff --git a/drivers/media/common/siano/smscoreapi.h b/drivers/media/common/siano/smscoreapi.h
+index eb58853008c9b..4de4d257c6b6e 100644
+--- a/drivers/media/common/siano/smscoreapi.h
++++ b/drivers/media/common/siano/smscoreapi.h
+@@ -640,9 +640,9 @@ struct sms_msg_data2 {
+ u32 msg_data[2];
+ };
+
+-struct sms_msg_data4 {
++struct sms_msg_data5 {
+ struct sms_msg_hdr x_msg_header;
+- u32 msg_data[4];
++ u32 msg_data[5];
+ };
+
+ struct sms_data_download {
+diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
+index afca47b97c2a2..637ace7a2b5c7 100644
+--- a/drivers/media/common/siano/smsdvb-main.c
++++ b/drivers/media/common/siano/smsdvb-main.c
+@@ -1187,6 +1187,10 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
+ return 0;
+
+ media_graph_error:
++ mutex_lock(&g_smsdvb_clientslock);
++ list_del(&client->entry);
++ mutex_unlock(&g_smsdvb_clientslock);
++
+ smsdvb_debugfs_release(client);
+
+ client_error:
+diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
+index 10f78109bb3fc..3f154755bbc63 100644
+--- a/drivers/media/dvb-core/dvb_net.c
++++ b/drivers/media/dvb-core/dvb_net.c
+@@ -56,6 +56,7 @@
+ #include <linux/module.h>
+ #include <linux/kernel.h>
+ #include <linux/netdevice.h>
++#include <linux/nospec.h>
+ #include <linux/etherdevice.h>
+ #include <linux/dvb/net.h>
+ #include <linux/uio.h>
+@@ -1473,14 +1474,20 @@ static int dvb_net_do_ioctl(struct file *file,
+ struct net_device *netdev;
+ struct dvb_net_priv *priv_data;
+ struct dvb_net_if *dvbnetif = parg;
++ int if_num = dvbnetif->if_num;
+
+- if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX ||
+- !dvbnet->state[dvbnetif->if_num]) {
++ if (if_num >= DVB_NET_DEVICES_MAX) {
+ ret = -EINVAL;
+ goto ioctl_error;
+ }
++ if_num = array_index_nospec(if_num, DVB_NET_DEVICES_MAX);
+
+- netdev = dvbnet->device[dvbnetif->if_num];
++ if (!dvbnet->state[if_num]) {
++ ret = -EINVAL;
++ goto ioctl_error;
++ }
++
++ netdev = dvbnet->device[if_num];
+
+ priv_data = netdev_priv(netdev);
+ dvbnetif->pid=priv_data->pid;
+@@ -1533,14 +1540,20 @@ static int dvb_net_do_ioctl(struct file *file,
+ struct net_device *netdev;
+ struct dvb_net_priv *priv_data;
+ struct __dvb_net_if_old *dvbnetif = parg;
++ int if_num = dvbnetif->if_num;
++
++ if (if_num >= DVB_NET_DEVICES_MAX) {
++ ret = -EINVAL;
++ goto ioctl_error;
++ }
++ if_num = array_index_nospec(if_num, DVB_NET_DEVICES_MAX);
+
+- if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX ||
+- !dvbnet->state[dvbnetif->if_num]) {
++ if (!dvbnet->state[if_num]) {
+ ret = -EINVAL;
+ goto ioctl_error;
+ }
+
+- netdev = dvbnet->device[dvbnetif->if_num];
++ netdev = dvbnet->device[if_num];
+
+ priv_data = netdev_priv(netdev);
+ dvbnetif->pid=priv_data->pid;
+diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
+index a14a74e6b986e..19ff9cb08e884 100644
+--- a/drivers/media/i2c/ir-kbd-i2c.c
++++ b/drivers/media/i2c/ir-kbd-i2c.c
+@@ -688,8 +688,8 @@ static int zilog_tx(struct rc_dev *rcdev, unsigned int *txbuf,
+ goto out_unlock;
+ }
+
+- i = i2c_master_recv(ir->tx_c, buf, 1);
+- if (i != 1) {
++ ret = i2c_master_recv(ir->tx_c, buf, 1);
++ if (ret != 1) {
+ dev_err(&ir->rc->dev, "i2c_master_recv failed with %d\n", ret);
+ ret = -EIO;
+ goto out_unlock;
+diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+index ce196b60f9170..37cb2f82c36b0 100644
+--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c
++++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+@@ -1394,7 +1394,7 @@ static int __s5c73m3_power_on(struct s5c73m3 *state)
+ s5c73m3_gpio_deassert(state, STBY);
+ usleep_range(100, 200);
+
+- s5c73m3_gpio_deassert(state, RST);
++ s5c73m3_gpio_deassert(state, RSET);
+ usleep_range(50, 100);
+
+ return 0;
+@@ -1409,7 +1409,7 @@ static int __s5c73m3_power_off(struct s5c73m3 *state)
+ {
+ int i, ret;
+
+- if (s5c73m3_gpio_assert(state, RST))
++ if (s5c73m3_gpio_assert(state, RSET))
+ usleep_range(10, 50);
+
+ if (s5c73m3_gpio_assert(state, STBY))
+@@ -1614,7 +1614,7 @@ static int s5c73m3_get_platform_data(struct s5c73m3 *state)
+
+ state->mclk_frequency = pdata->mclk_frequency;
+ state->gpio[STBY] = pdata->gpio_stby;
+- state->gpio[RST] = pdata->gpio_reset;
++ state->gpio[RSET] = pdata->gpio_reset;
+ return 0;
+ }
+
+diff --git a/drivers/media/i2c/s5c73m3/s5c73m3.h b/drivers/media/i2c/s5c73m3/s5c73m3.h
+index 653f68e7ea07b..e267b2522149a 100644
+--- a/drivers/media/i2c/s5c73m3/s5c73m3.h
++++ b/drivers/media/i2c/s5c73m3/s5c73m3.h
+@@ -361,7 +361,7 @@ struct s5c73m3_ctrls {
+
+ enum s5c73m3_gpio_id {
+ STBY,
+- RST,
++ RSET,
+ GPIO_NUM,
+ };
+
+diff --git a/drivers/media/i2c/s5k4ecgx.c b/drivers/media/i2c/s5k4ecgx.c
+index 6ebcf254989a5..75fb13a33eab3 100644
+--- a/drivers/media/i2c/s5k4ecgx.c
++++ b/drivers/media/i2c/s5k4ecgx.c
+@@ -177,7 +177,7 @@ static const char * const s5k4ecgx_supply_names[] = {
+
+ enum s5k4ecgx_gpio_id {
+ STBY,
+- RST,
++ RSET,
+ GPIO_NUM,
+ };
+
+@@ -482,7 +482,7 @@ static int __s5k4ecgx_power_on(struct s5k4ecgx *priv)
+ if (s5k4ecgx_gpio_set_value(priv, STBY, priv->gpio[STBY].level))
+ usleep_range(30, 50);
+
+- if (s5k4ecgx_gpio_set_value(priv, RST, priv->gpio[RST].level))
++ if (s5k4ecgx_gpio_set_value(priv, RSET, priv->gpio[RSET].level))
+ usleep_range(30, 50);
+
+ return 0;
+@@ -490,7 +490,7 @@ static int __s5k4ecgx_power_on(struct s5k4ecgx *priv)
+
+ static int __s5k4ecgx_power_off(struct s5k4ecgx *priv)
+ {
+- if (s5k4ecgx_gpio_set_value(priv, RST, !priv->gpio[RST].level))
++ if (s5k4ecgx_gpio_set_value(priv, RSET, !priv->gpio[RSET].level))
+ usleep_range(30, 50);
+
+ if (s5k4ecgx_gpio_set_value(priv, STBY, !priv->gpio[STBY].level))
+@@ -878,7 +878,7 @@ static int s5k4ecgx_config_gpios(struct s5k4ecgx *priv,
+ int ret;
+
+ priv->gpio[STBY].gpio = -EINVAL;
+- priv->gpio[RST].gpio = -EINVAL;
++ priv->gpio[RSET].gpio = -EINVAL;
+
+ ret = s5k4ecgx_config_gpio(gpio->gpio, gpio->level, "S5K4ECGX_STBY");
+
+@@ -897,7 +897,7 @@ static int s5k4ecgx_config_gpios(struct s5k4ecgx *priv,
+ s5k4ecgx_free_gpios(priv);
+ return ret;
+ }
+- priv->gpio[RST] = *gpio;
++ priv->gpio[RSET] = *gpio;
+ if (gpio_is_valid(gpio->gpio))
+ gpio_set_value(gpio->gpio, 0);
+
+diff --git a/drivers/media/i2c/s5k5baf.c b/drivers/media/i2c/s5k5baf.c
+index 5007c9659342d..de3329f04fdf6 100644
+--- a/drivers/media/i2c/s5k5baf.c
++++ b/drivers/media/i2c/s5k5baf.c
+@@ -238,7 +238,7 @@ struct s5k5baf_gpio {
+
+ enum s5k5baf_gpio_id {
+ STBY,
+- RST,
++ RSET,
+ NUM_GPIOS,
+ };
+
+@@ -973,7 +973,7 @@ static int s5k5baf_power_on(struct s5k5baf *state)
+
+ s5k5baf_gpio_deassert(state, STBY);
+ usleep_range(50, 100);
+- s5k5baf_gpio_deassert(state, RST);
++ s5k5baf_gpio_deassert(state, RSET);
+ return 0;
+
+ err_reg_dis:
+@@ -991,7 +991,7 @@ static int s5k5baf_power_off(struct s5k5baf *state)
+ state->apply_cfg = 0;
+ state->apply_crop = 0;
+
+- s5k5baf_gpio_assert(state, RST);
++ s5k5baf_gpio_assert(state, RSET);
+ s5k5baf_gpio_assert(state, STBY);
+
+ if (!IS_ERR(state->clock))
+diff --git a/drivers/media/i2c/s5k6aa.c b/drivers/media/i2c/s5k6aa.c
+index 13c10b5e2b451..e9c6e41cd44d9 100644
+--- a/drivers/media/i2c/s5k6aa.c
++++ b/drivers/media/i2c/s5k6aa.c
+@@ -181,7 +181,7 @@ static const char * const s5k6aa_supply_names[] = {
+
+ enum s5k6aa_gpio_id {
+ STBY,
+- RST,
++ RSET,
+ GPIO_NUM,
+ };
+
+@@ -845,7 +845,7 @@ static int __s5k6aa_power_on(struct s5k6aa *s5k6aa)
+ ret = s5k6aa->s_power(1);
+ usleep_range(4000, 5000);
+
+- if (s5k6aa_gpio_deassert(s5k6aa, RST))
++ if (s5k6aa_gpio_deassert(s5k6aa, RSET))
+ msleep(20);
+
+ return ret;
+@@ -855,7 +855,7 @@ static int __s5k6aa_power_off(struct s5k6aa *s5k6aa)
+ {
+ int ret;
+
+- if (s5k6aa_gpio_assert(s5k6aa, RST))
++ if (s5k6aa_gpio_assert(s5k6aa, RSET))
+ usleep_range(100, 150);
+
+ if (s5k6aa->s_power) {
+@@ -1514,7 +1514,7 @@ static int s5k6aa_configure_gpios(struct s5k6aa *s5k6aa,
+ int ret;
+
+ s5k6aa->gpio[STBY].gpio = -EINVAL;
+- s5k6aa->gpio[RST].gpio = -EINVAL;
++ s5k6aa->gpio[RSET].gpio = -EINVAL;
+
+ gpio = &pdata->gpio_stby;
+ if (gpio_is_valid(gpio->gpio)) {
+@@ -1537,7 +1537,7 @@ static int s5k6aa_configure_gpios(struct s5k6aa *s5k6aa,
+ if (ret < 0)
+ return ret;
+
+- s5k6aa->gpio[RST] = *gpio;
++ s5k6aa->gpio[RSET] = *gpio;
+ }
+
+ return 0;
+diff --git a/drivers/media/i2c/saa6588.c b/drivers/media/i2c/saa6588.c
+index 33d2987f9555e..c074e51834e93 100644
+--- a/drivers/media/i2c/saa6588.c
++++ b/drivers/media/i2c/saa6588.c
+@@ -392,7 +392,7 @@ static void saa6588_configure(struct saa6588 *s)
+
+ /* ---------------------------------------------------------------------- */
+
+-static long saa6588_ioctl(struct v4l2_subdev *sd, unsigned int cmd, void *arg)
++static long saa6588_command(struct v4l2_subdev *sd, unsigned int cmd, void *arg)
+ {
+ struct saa6588 *s = to_saa6588(sd);
+ struct saa6588_command *a = arg;
+@@ -445,7 +445,7 @@ static int saa6588_s_tuner(struct v4l2_subdev *sd, const struct v4l2_tuner *vt)
+ /* ----------------------------------------------------------------------- */
+
+ static const struct v4l2_subdev_core_ops saa6588_core_ops = {
+- .ioctl = saa6588_ioctl,
++ .command = saa6588_command,
+ };
+
+ static const struct v4l2_subdev_tuner_ops saa6588_tuner_ops = {
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index 041b16965b967..079b8db4bc48b 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1972,6 +1972,7 @@ static int tc358743_probe_of(struct tc358743_state *state)
+ bps_pr_lane = 2 * endpoint->link_frequencies[0];
+ if (bps_pr_lane < 62500000U || bps_pr_lane > 1000000000U) {
+ dev_err(dev, "unsupported bps per lane: %u bps\n", bps_pr_lane);
++ ret = -EINVAL;
+ goto disable_clk;
+ }
+
+diff --git a/drivers/media/pci/bt8xx/bt878.c b/drivers/media/pci/bt8xx/bt878.c
+index f5f87e03f94bb..855f8dc2a4ee0 100644
+--- a/drivers/media/pci/bt8xx/bt878.c
++++ b/drivers/media/pci/bt8xx/bt878.c
+@@ -494,6 +494,9 @@ static int bt878_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
+ btwrite(0, BT878_AINT_MASK);
+ bt878_num++;
+
++ if (!bt->tasklet.func)
++ tasklet_disable(&bt->tasklet);
++
+ return 0;
+
+ fail2:
+diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
+index 4c042ba6de918..2a9d25431d733 100644
+--- a/drivers/media/pci/bt8xx/bttv-driver.c
++++ b/drivers/media/pci/bt8xx/bttv-driver.c
+@@ -3243,7 +3243,7 @@ static int radio_release(struct file *file)
+
+ btv->radio_user--;
+
+- bttv_call_all(btv, core, ioctl, SAA6588_CMD_CLOSE, &cmd);
++ bttv_call_all(btv, core, command, SAA6588_CMD_CLOSE, &cmd);
+
+ if (btv->radio_user == 0)
+ btv->has_radio_tuner = 0;
+@@ -3324,7 +3324,7 @@ static ssize_t radio_read(struct file *file, char __user *data,
+ cmd.result = -ENODEV;
+ radio_enable(btv);
+
+- bttv_call_all(btv, core, ioctl, SAA6588_CMD_READ, &cmd);
++ bttv_call_all(btv, core, command, SAA6588_CMD_READ, &cmd);
+
+ return cmd.result;
+ }
+@@ -3345,7 +3345,7 @@ static __poll_t radio_poll(struct file *file, poll_table *wait)
+ cmd.instance = file;
+ cmd.event_list = wait;
+ cmd.poll_mask = res;
+- bttv_call_all(btv, core, ioctl, SAA6588_CMD_POLL, &cmd);
++ bttv_call_all(btv, core, command, SAA6588_CMD_POLL, &cmd);
+
+ return cmd.poll_mask;
+ }
+diff --git a/drivers/media/pci/cobalt/cobalt-driver.c b/drivers/media/pci/cobalt/cobalt-driver.c
+index 4885e833c0522..f422558e63920 100644
+--- a/drivers/media/pci/cobalt/cobalt-driver.c
++++ b/drivers/media/pci/cobalt/cobalt-driver.c
+@@ -675,6 +675,7 @@ static int cobalt_probe(struct pci_dev *pci_dev,
+ return -ENOMEM;
+ cobalt->pci_dev = pci_dev;
+ cobalt->instance = i;
++ mutex_init(&cobalt->pci_lock);
+
+ retval = v4l2_device_register(&pci_dev->dev, &cobalt->v4l2_dev);
+ if (retval) {
+diff --git a/drivers/media/pci/cobalt/cobalt-driver.h b/drivers/media/pci/cobalt/cobalt-driver.h
+index 429bee4ef79c5..883093e5adea9 100644
+--- a/drivers/media/pci/cobalt/cobalt-driver.h
++++ b/drivers/media/pci/cobalt/cobalt-driver.h
+@@ -250,6 +250,8 @@ struct cobalt {
+ int instance;
+ struct pci_dev *pci_dev;
+ struct v4l2_device v4l2_dev;
++ /* serialize PCI access in cobalt_s_bit_sysctrl() */
++ struct mutex pci_lock;
+
+ void __iomem *bar0, *bar1;
+
+@@ -319,10 +321,13 @@ static inline u32 cobalt_g_sysctrl(struct cobalt *cobalt)
+ static inline void cobalt_s_bit_sysctrl(struct cobalt *cobalt,
+ int bit, int val)
+ {
+- u32 ctrl = cobalt_read_bar1(cobalt, COBALT_SYS_CTRL_BASE);
++ u32 ctrl;
+
++ mutex_lock(&cobalt->pci_lock);
++ ctrl = cobalt_read_bar1(cobalt, COBALT_SYS_CTRL_BASE);
+ cobalt_write_bar1(cobalt, COBALT_SYS_CTRL_BASE,
+ (ctrl & ~(1UL << bit)) | (val << bit));
++ mutex_unlock(&cobalt->pci_lock);
+ }
+
+ static inline u32 cobalt_g_sysstat(struct cobalt *cobalt)
+diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
+index 1a50ec9d084f3..079219288af7b 100644
+--- a/drivers/media/pci/saa7134/saa7134-video.c
++++ b/drivers/media/pci/saa7134/saa7134-video.c
+@@ -1202,7 +1202,7 @@ static int video_release(struct file *file)
+
+ saa_call_all(dev, tuner, standby);
+ if (vdev->vfl_type == VFL_TYPE_RADIO)
+- saa_call_all(dev, core, ioctl, SAA6588_CMD_CLOSE, &cmd);
++ saa_call_all(dev, core, command, SAA6588_CMD_CLOSE, &cmd);
+ mutex_unlock(&dev->lock);
+
+ return 0;
+@@ -1221,7 +1221,7 @@ static ssize_t radio_read(struct file *file, char __user *data,
+ cmd.result = -ENODEV;
+
+ mutex_lock(&dev->lock);
+- saa_call_all(dev, core, ioctl, SAA6588_CMD_READ, &cmd);
++ saa_call_all(dev, core, command, SAA6588_CMD_READ, &cmd);
+ mutex_unlock(&dev->lock);
+
+ return cmd.result;
+@@ -1237,7 +1237,7 @@ static __poll_t radio_poll(struct file *file, poll_table *wait)
+ cmd.event_list = wait;
+ cmd.poll_mask = 0;
+ mutex_lock(&dev->lock);
+- saa_call_all(dev, core, ioctl, SAA6588_CMD_POLL, &cmd);
++ saa_call_all(dev, core, command, SAA6588_CMD_POLL, &cmd);
+ mutex_unlock(&dev->lock);
+
+ return rc | cmd.poll_mask;
+diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c
+index 6f82693524331..2a073a6d83e39 100644
+--- a/drivers/media/platform/davinci/vpbe_display.c
++++ b/drivers/media/platform/davinci/vpbe_display.c
+@@ -60,7 +60,7 @@ static int venc_is_second_field(struct vpbe_display *disp_dev)
+
+ ret = v4l2_subdev_call(vpbe_dev->venc,
+ core,
+- ioctl,
++ command,
+ VENC_GET_FLD,
+ &val);
+ if (ret < 0) {
+diff --git a/drivers/media/platform/davinci/vpbe_venc.c b/drivers/media/platform/davinci/vpbe_venc.c
+index ddcad7b3e76c2..c2cfaa9c69577 100644
+--- a/drivers/media/platform/davinci/vpbe_venc.c
++++ b/drivers/media/platform/davinci/vpbe_venc.c
+@@ -534,9 +534,7 @@ static int venc_s_routing(struct v4l2_subdev *sd, u32 input, u32 output,
+ return ret;
+ }
+
+-static long venc_ioctl(struct v4l2_subdev *sd,
+- unsigned int cmd,
+- void *arg)
++static long venc_command(struct v4l2_subdev *sd, unsigned int cmd, void *arg)
+ {
+ u32 val;
+
+@@ -555,7 +553,7 @@ static long venc_ioctl(struct v4l2_subdev *sd,
+ }
+
+ static const struct v4l2_subdev_core_ops venc_core_ops = {
+- .ioctl = venc_ioctl,
++ .command = venc_command,
+ };
+
+ static const struct v4l2_subdev_video_ops venc_video_ops = {
+diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c
+index 39340abefd14d..c9ef74ee476a4 100644
+--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c
++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c
+@@ -308,17 +308,20 @@ static int isp_video_release(struct file *file)
+ struct fimc_is_video *ivc = &isp->video_capture;
+ struct media_entity *entity = &ivc->ve.vdev.entity;
+ struct media_device *mdev = entity->graph_obj.mdev;
++ bool is_singular_file;
+
+ mutex_lock(&isp->video_lock);
+
+- if (v4l2_fh_is_singular_file(file) && ivc->streaming) {
++ is_singular_file = v4l2_fh_is_singular_file(file);
++
++ if (is_singular_file && ivc->streaming) {
+ media_pipeline_stop(entity);
+ ivc->streaming = 0;
+ }
+
+ _vb2_fop_release(file, NULL);
+
+- if (v4l2_fh_is_singular_file(file)) {
++ if (is_singular_file) {
+ fimc_pipeline_call(&ivc->ve, close);
+
+ mutex_lock(&mdev->graph_mutex);
+diff --git a/drivers/media/platform/s5p-cec/s5p_cec.c b/drivers/media/platform/s5p-cec/s5p_cec.c
+index 8837e2678bdeb..3032247c63a51 100644
+--- a/drivers/media/platform/s5p-cec/s5p_cec.c
++++ b/drivers/media/platform/s5p-cec/s5p_cec.c
+@@ -55,7 +55,7 @@ static int s5p_cec_adap_enable(struct cec_adapter *adap, bool enable)
+ } else {
+ s5p_cec_mask_tx_interrupts(cec);
+ s5p_cec_mask_rx_interrupts(cec);
+- pm_runtime_disable(cec->dev);
++ pm_runtime_put(cec->dev);
+ }
+
+ return 0;
+diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c
+index 1f58574d0b965..4cf5b559420f6 100644
+--- a/drivers/media/platform/s5p-g2d/g2d.c
++++ b/drivers/media/platform/s5p-g2d/g2d.c
+@@ -285,6 +285,9 @@ static int g2d_release(struct file *file)
+ struct g2d_dev *dev = video_drvdata(file);
+ struct g2d_ctx *ctx = fh2ctx(file->private_data);
+
++ mutex_lock(&dev->mutex);
++ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
++ mutex_unlock(&dev->mutex);
+ v4l2_ctrl_handler_free(&ctx->ctrl_handler);
+ v4l2_fh_del(&ctx->fh);
+ v4l2_fh_exit(&ctx->fh);
+diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c
+index d826c011c0952..6b852b0bb15ab 100644
+--- a/drivers/media/platform/sti/hva/hva-hw.c
++++ b/drivers/media/platform/sti/hva/hva-hw.c
+@@ -130,8 +130,7 @@ static irqreturn_t hva_hw_its_irq_thread(int irq, void *arg)
+ ctx_id = (hva->sts_reg & 0xFF00) >> 8;
+ if (ctx_id >= HVA_MAX_INSTANCES) {
+ dev_err(dev, "%s %s: bad context identifier: %d\n",
+- ctx->name, __func__, ctx_id);
+- ctx->hw_err = true;
++ HVA_PREFIX, __func__, ctx_id);
+ goto out;
+ }
+
+diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c
+index 8b97fd1f0ceaf..5a0e26e47f59a 100644
+--- a/drivers/media/rc/bpf-lirc.c
++++ b/drivers/media/rc/bpf-lirc.c
+@@ -295,7 +295,8 @@ int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr)
+ }
+
+ if (attr->query.prog_cnt != 0 && prog_ids && cnt)
+- ret = bpf_prog_array_copy_to_user(progs, prog_ids, cnt);
++ ret = bpf_prog_array_copy_to_user(progs, prog_ids,
++ attr->query.prog_cnt);
+
+ unlock:
+ mutex_unlock(&ir_raw_handler_lock);
+diff --git a/drivers/media/usb/cpia2/cpia2.h b/drivers/media/usb/cpia2/cpia2.h
+index ab238ac8bfc06..50c952250dc9b 100644
+--- a/drivers/media/usb/cpia2/cpia2.h
++++ b/drivers/media/usb/cpia2/cpia2.h
+@@ -438,6 +438,7 @@ int cpia2_send_command(struct camera_data *cam, struct cpia2_command *cmd);
+ int cpia2_do_command(struct camera_data *cam,
+ unsigned int command,
+ unsigned char direction, unsigned char param);
++void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf);
+ struct camera_data *cpia2_init_camera_struct(struct usb_interface *intf);
+ int cpia2_init_camera(struct camera_data *cam);
+ int cpia2_allocate_buffers(struct camera_data *cam);
+diff --git a/drivers/media/usb/cpia2/cpia2_core.c b/drivers/media/usb/cpia2/cpia2_core.c
+index 3dfbb545c0e38..42cce7e94101b 100644
+--- a/drivers/media/usb/cpia2/cpia2_core.c
++++ b/drivers/media/usb/cpia2/cpia2_core.c
+@@ -2172,6 +2172,18 @@ static void reset_camera_struct(struct camera_data *cam)
+ cam->height = cam->params.roi.height;
+ }
+
++/******************************************************************************
++ *
++ * cpia2_init_camera_struct
++ *
++ * Deinitialize camera struct
++ *****************************************************************************/
++void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf)
++{
++ v4l2_device_unregister(&cam->v4l2_dev);
++ kfree(cam);
++}
++
+ /******************************************************************************
+ *
+ * cpia2_init_camera_struct
+diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
+index 4c191fcd3a7f5..8392175740695 100644
+--- a/drivers/media/usb/cpia2/cpia2_usb.c
++++ b/drivers/media/usb/cpia2/cpia2_usb.c
+@@ -853,15 +853,13 @@ static int cpia2_usb_probe(struct usb_interface *intf,
+ ret = set_alternate(cam, USBIF_CMDONLY);
+ if (ret < 0) {
+ ERR("%s: usb_set_interface error (ret = %d)\n", __func__, ret);
+- kfree(cam);
+- return ret;
++ goto alt_err;
+ }
+
+
+ if((ret = cpia2_init_camera(cam)) < 0) {
+ ERR("%s: failed to initialize cpia2 camera (ret = %d)\n", __func__, ret);
+- kfree(cam);
+- return ret;
++ goto alt_err;
+ }
+ LOG(" CPiA Version: %d.%02d (%d.%d)\n",
+ cam->params.version.firmware_revision_hi,
+@@ -881,11 +879,14 @@ static int cpia2_usb_probe(struct usb_interface *intf,
+ ret = cpia2_register_camera(cam);
+ if (ret < 0) {
+ ERR("%s: Failed to register cpia2 camera (ret = %d)\n", __func__, ret);
+- kfree(cam);
+- return ret;
++ goto alt_err;
+ }
+
+ return 0;
++
++alt_err:
++ cpia2_deinit_camera_struct(cam, intf);
++ return ret;
+ }
+
+ /******************************************************************************
+diff --git a/drivers/media/usb/dvb-usb/cinergyT2-core.c b/drivers/media/usb/dvb-usb/cinergyT2-core.c
+index 6131aa7914a9a..fb59dda7547a5 100644
+--- a/drivers/media/usb/dvb-usb/cinergyT2-core.c
++++ b/drivers/media/usb/dvb-usb/cinergyT2-core.c
+@@ -88,6 +88,8 @@ static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap)
+
+ ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 3, 0);
+ if (ret < 0) {
++ if (adap->fe_adap[0].fe)
++ adap->fe_adap[0].fe->ops.release(adap->fe_adap[0].fe);
+ deb_rc("cinergyt2_power_ctrl() Failed to retrieve sleep state info\n");
+ }
+ mutex_unlock(&d->data_mutex);
+diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
+index 5400ec99986fc..0c9f12d4ac284 100644
+--- a/drivers/media/usb/dvb-usb/cxusb.c
++++ b/drivers/media/usb/dvb-usb/cxusb.c
+@@ -1659,7 +1659,7 @@ static struct dvb_usb_device_properties cxusb_bluebird_lgz201_properties = {
+
+ .size_of_priv = sizeof(struct cxusb_state),
+
+- .num_adapters = 2,
++ .num_adapters = 1,
+ .adapter = {
+ {
+ .num_frontends = 1,
+diff --git a/drivers/media/usb/dvb-usb/dtv5100.c b/drivers/media/usb/dvb-usb/dtv5100.c
+index 2fa2abd3e7263..07fd0bbf9b802 100644
+--- a/drivers/media/usb/dvb-usb/dtv5100.c
++++ b/drivers/media/usb/dvb-usb/dtv5100.c
+@@ -35,6 +35,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr,
+ u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen)
+ {
+ struct dtv5100_state *st = d->priv;
++ unsigned int pipe;
+ u8 request;
+ u8 type;
+ u16 value;
+@@ -43,6 +44,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr,
+ switch (wlen) {
+ case 1:
+ /* write { reg }, read { value } */
++ pipe = usb_rcvctrlpipe(d->udev, 0);
+ request = (addr == DTV5100_DEMOD_ADDR ? DTV5100_DEMOD_READ :
+ DTV5100_TUNER_READ);
+ type = USB_TYPE_VENDOR | USB_DIR_IN;
+@@ -50,6 +52,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr,
+ break;
+ case 2:
+ /* write { reg, value } */
++ pipe = usb_sndctrlpipe(d->udev, 0);
+ request = (addr == DTV5100_DEMOD_ADDR ? DTV5100_DEMOD_WRITE :
+ DTV5100_TUNER_WRITE);
+ type = USB_TYPE_VENDOR | USB_DIR_OUT;
+@@ -63,7 +66,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr,
+
+ memcpy(st->data, rbuf, rlen);
+ msleep(1); /* avoid I2C errors */
+- return usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), request,
++ return usb_control_msg(d->udev, pipe, request,
+ type, value, index, st->data, rlen,
+ DTV5100_USB_TIMEOUT);
+ }
+@@ -150,7 +153,7 @@ static int dtv5100_probe(struct usb_interface *intf,
+
+ /* initialize non qt1010/zl10353 part? */
+ for (i = 0; dtv5100_init[i].request; i++) {
+- ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
++ ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ dtv5100_init[i].request,
+ USB_TYPE_VENDOR | USB_DIR_OUT,
+ dtv5100_init[i].value,
+diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
+index f84a1208d5d32..3612f0d730ddd 100644
+--- a/drivers/media/usb/em28xx/em28xx-input.c
++++ b/drivers/media/usb/em28xx/em28xx-input.c
+@@ -736,7 +736,8 @@ static int em28xx_ir_init(struct em28xx *dev)
+ dev->board.has_ir_i2c = 0;
+ dev_warn(&dev->intf->dev,
+ "No i2c IR remote control device found.\n");
+- return -ENODEV;
++ err = -ENODEV;
++ goto ref_put;
+ }
+ }
+
+@@ -751,7 +752,7 @@ static int em28xx_ir_init(struct em28xx *dev)
+
+ ir = kzalloc(sizeof(*ir), GFP_KERNEL);
+ if (!ir)
+- return -ENOMEM;
++ goto ref_put;
+ rc = rc_allocate_device(RC_DRIVER_SCANCODE);
+ if (!rc)
+ goto error;
+@@ -862,6 +863,9 @@ error:
+ dev->ir = NULL;
+ rc_free_device(rc);
+ kfree(ir);
++ref_put:
++ em28xx_shutdown_buttons(dev);
++ kref_put(&dev->ref, em28xx_free_device);
+ return err;
+ }
+
+diff --git a/drivers/media/usb/gspca/gl860/gl860.c b/drivers/media/usb/gspca/gl860/gl860.c
+index 262200af76a34..7da437e7785f1 100644
+--- a/drivers/media/usb/gspca/gl860/gl860.c
++++ b/drivers/media/usb/gspca/gl860/gl860.c
+@@ -573,8 +573,8 @@ int gl860_RTx(struct gspca_dev *gspca_dev,
+ len, 400 + 200 * (len > 1));
+ memcpy(pdata, gspca_dev->usb_buf, len);
+ } else {
+- r = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+- req, pref, val, index, NULL, len, 400);
++ gspca_err(gspca_dev, "zero-length read request\n");
++ r = -EINVAL;
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/sq905.c b/drivers/media/usb/gspca/sq905.c
+index 13676af42cfc7..dc3caf1b36e7d 100644
+--- a/drivers/media/usb/gspca/sq905.c
++++ b/drivers/media/usb/gspca/sq905.c
+@@ -125,7 +125,7 @@ static int sq905_command(struct gspca_dev *gspca_dev, u16 index)
+ }
+
+ ret = usb_control_msg(gspca_dev->dev,
+- usb_sndctrlpipe(gspca_dev->dev, 0),
++ usb_rcvctrlpipe(gspca_dev->dev, 0),
+ USB_REQ_SYNCH_FRAME, /* request */
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ SQ905_PING, 0, gspca_dev->usb_buf, 1,
+diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c
+index 26eae69a2562f..15e9d0de4208a 100644
+--- a/drivers/media/usb/gspca/sunplus.c
++++ b/drivers/media/usb/gspca/sunplus.c
+@@ -251,6 +251,10 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ gspca_err(gspca_dev, "reg_r: buffer overflow\n");
+ return;
+ }
++ if (len == 0) {
++ gspca_err(gspca_dev, "reg_r: zero-length read\n");
++ return;
++ }
+ if (gspca_dev->usb_err < 0)
+ return;
+ ret = usb_control_msg(gspca_dev->dev,
+@@ -259,7 +263,7 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 0, /* value */
+ index,
+- len ? gspca_dev->usb_buf : NULL, len,
++ gspca_dev->usb_buf, len,
+ 500);
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+@@ -736,7 +740,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
+ case MegaImageVI:
+ reg_w_riv(gspca_dev, 0xf0, 0, 0);
+ spca504B_WaitCmdStatus(gspca_dev);
+- reg_r(gspca_dev, 0xf0, 4, 0);
++ reg_w_riv(gspca_dev, 0xf0, 4, 0);
+ spca504B_WaitCmdStatus(gspca_dev);
+ break;
+ default:
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index fcb201a40920e..d1bbfe4000ddc 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -2668,9 +2668,8 @@ void pvr2_hdw_destroy(struct pvr2_hdw *hdw)
+ pvr2_stream_destroy(hdw->vid_stream);
+ hdw->vid_stream = NULL;
+ }
+- pvr2_i2c_core_done(hdw);
+ v4l2_device_unregister(&hdw->v4l2_dev);
+- pvr2_hdw_remove_usb_stuff(hdw);
++ pvr2_hdw_disconnect(hdw);
+ mutex_lock(&pvr2_unit_mtx);
+ do {
+ if ((hdw->unit_number >= 0) &&
+@@ -2697,6 +2696,7 @@ void pvr2_hdw_disconnect(struct pvr2_hdw *hdw)
+ {
+ pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_disconnect(hdw=%p)",hdw);
+ LOCK_TAKE(hdw->big_lock);
++ pvr2_i2c_core_done(hdw);
+ LOCK_TAKE(hdw->ctl_lock);
+ pvr2_hdw_remove_usb_stuff(hdw);
+ LOCK_GIVE(hdw->ctl_lock);
+diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
+index ffffb66d51a00..56b058d60a0dc 100644
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -129,10 +129,37 @@ int uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit,
+ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
+ struct uvc_streaming_control *ctrl)
+ {
++ static const struct usb_device_id elgato_cam_link_4k = {
++ USB_DEVICE(0x0fd9, 0x0066)
++ };
+ struct uvc_format *format = NULL;
+ struct uvc_frame *frame = NULL;
+ unsigned int i;
+
++ /*
++ * The response of the Elgato Cam Link 4K is incorrect: The second byte
++ * contains bFormatIndex (instead of being the second byte of bmHint).
++ * The first byte is always zero. The third byte is always 1.
++ *
++ * The UVC 1.5 class specification defines the first five bits in the
++ * bmHint bitfield. The remaining bits are reserved and should be zero.
++ * Therefore a valid bmHint will be less than 32.
++ *
++ * Latest Elgato Cam Link 4K firmware as of 2021-03-23 needs this fix.
++ * MCU: 20.02.19, FPGA: 67
++ */
++ if (usb_match_one_id(stream->dev->intf, &elgato_cam_link_4k) &&
++ ctrl->bmHint > 255) {
++ u8 corrected_format_index = ctrl->bmHint >> 8;
++
++ /* uvc_dbg(stream->dev, VIDEO,
++ "Correct USB video probe response from {bmHint: 0x%04x, bFormatIndex: %u} to {bmHint: 0x%04x, bFormatIndex: %u}\n",
++ ctrl->bmHint, ctrl->bFormatIndex,
++ 1, corrected_format_index); */
++ ctrl->bmHint = 1;
++ ctrl->bFormatIndex = corrected_format_index;
++ }
++
+ for (i = 0; i < stream->nformats; ++i) {
+ if (stream->format[i].index == ctrl->bFormatIndex) {
+ format = &stream->format[i];
+diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c
+index 501030bb2e7d0..f92d7688b07ad 100644
+--- a/drivers/media/usb/zr364xx/zr364xx.c
++++ b/drivers/media/usb/zr364xx/zr364xx.c
+@@ -1058,6 +1058,7 @@ static int zr364xx_start_readpipe(struct zr364xx_camera *cam)
+ DBG("submitting URB %p\n", pipe_info->stream_urb);
+ retval = usb_submit_urb(pipe_info->stream_urb, GFP_KERNEL);
+ if (retval) {
++ usb_free_urb(pipe_info->stream_urb);
+ printk(KERN_ERR KBUILD_MODNAME ": start read pipe failed\n");
+ return retval;
+ }
+diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c
+index c91a7bd3ecfc7..ac8282d059fca 100644
+--- a/drivers/media/v4l2-core/v4l2-fh.c
++++ b/drivers/media/v4l2-core/v4l2-fh.c
+@@ -104,6 +104,7 @@ int v4l2_fh_release(struct file *filp)
+ v4l2_fh_del(fh);
+ v4l2_fh_exit(fh);
+ kfree(fh);
++ filp->private_data = NULL;
+ }
+ return 0;
+ }
+diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
+index b907865d4664d..2b9283d4fcb1e 100644
+--- a/drivers/memory/atmel-ebi.c
++++ b/drivers/memory/atmel-ebi.c
+@@ -579,8 +579,10 @@ static int atmel_ebi_probe(struct platform_device *pdev)
+ child);
+
+ ret = atmel_ebi_dev_disable(ebi, child);
+- if (ret)
++ if (ret) {
++ of_node_put(child);
+ return ret;
++ }
+ }
+ }
+
+diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
+index 1b182b117f9cf..38b945eb410f3 100644
+--- a/drivers/memory/fsl_ifc.c
++++ b/drivers/memory/fsl_ifc.c
+@@ -109,7 +109,6 @@ static int fsl_ifc_ctrl_remove(struct platform_device *dev)
+ iounmap(ctrl->gregs);
+
+ dev_set_drvdata(&dev->dev, NULL);
+- kfree(ctrl);
+
+ return 0;
+ }
+@@ -221,7 +220,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
+
+ dev_info(&dev->dev, "Freescale Integrated Flash Controller\n");
+
+- fsl_ifc_ctrl_dev = kzalloc(sizeof(*fsl_ifc_ctrl_dev), GFP_KERNEL);
++ fsl_ifc_ctrl_dev = devm_kzalloc(&dev->dev, sizeof(*fsl_ifc_ctrl_dev),
++ GFP_KERNEL);
+ if (!fsl_ifc_ctrl_dev)
+ return -ENOMEM;
+
+@@ -231,8 +231,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
+ fsl_ifc_ctrl_dev->gregs = of_iomap(dev->dev.of_node, 0);
+ if (!fsl_ifc_ctrl_dev->gregs) {
+ dev_err(&dev->dev, "failed to get memory region\n");
+- ret = -ENODEV;
+- goto err;
++ return -ENODEV;
+ }
+
+ if (of_property_read_bool(dev->dev.of_node, "little-endian")) {
+@@ -308,6 +307,7 @@ err_irq:
+ free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev);
+ irq_dispose_mapping(fsl_ifc_ctrl_dev->irq);
+ err:
++ iounmap(fsl_ifc_ctrl_dev->gregs);
+ return ret;
+ }
+
+diff --git a/drivers/mfd/da9052-i2c.c b/drivers/mfd/da9052-i2c.c
+index 578e881067a58..4094f97ec7dc7 100644
+--- a/drivers/mfd/da9052-i2c.c
++++ b/drivers/mfd/da9052-i2c.c
+@@ -118,6 +118,7 @@ static const struct i2c_device_id da9052_i2c_id[] = {
+ {"da9053-bc", DA9053_BC},
+ {}
+ };
++MODULE_DEVICE_TABLE(i2c, da9052_i2c_id);
+
+ #ifdef CONFIG_OF
+ static const struct of_device_id dialog_dt_ids[] = {
+diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
+index 863c39a3353c9..d284df25c76ba 100644
+--- a/drivers/mfd/stmpe-i2c.c
++++ b/drivers/mfd/stmpe-i2c.c
+@@ -109,7 +109,7 @@ static const struct i2c_device_id stmpe_i2c_id[] = {
+ { "stmpe2403", STMPE2403 },
+ { }
+ };
+-MODULE_DEVICE_TABLE(i2c, stmpe_id);
++MODULE_DEVICE_TABLE(i2c, stmpe_i2c_id);
+
+ static struct i2c_driver stmpe_i2c_driver = {
+ .driver = {
+diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c
+index 8a4659518c33b..5879ba82c7186 100644
+--- a/drivers/misc/eeprom/idt_89hpesx.c
++++ b/drivers/misc/eeprom/idt_89hpesx.c
+@@ -1128,11 +1128,10 @@ static void idt_get_fw_data(struct idt_89hpesx_dev *pdev)
+
+ device_for_each_child_node(dev, fwnode) {
+ ee_id = idt_ee_match_id(fwnode);
+- if (!ee_id) {
+- dev_warn(dev, "Skip unsupported EEPROM device");
+- continue;
+- } else
++ if (ee_id)
+ break;
++
++ dev_warn(dev, "Skip unsupported EEPROM device %pfw\n", fwnode);
+ }
+
+ /* If there is no fwnode EEPROM device, then set zero size */
+@@ -1163,6 +1162,7 @@ static void idt_get_fw_data(struct idt_89hpesx_dev *pdev)
+ else /* if (!fwnode_property_read_bool(node, "read-only")) */
+ pdev->eero = false;
+
++ fwnode_handle_put(fwnode);
+ dev_info(dev, "EEPROM of %d bytes found by 0x%x",
+ pdev->eesize, pdev->eeaddr);
+ }
+diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c
+index e914b8c809433..9f8344169845c 100644
+--- a/drivers/misc/ibmasm/module.c
++++ b/drivers/misc/ibmasm/module.c
+@@ -125,7 +125,7 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ result = ibmasm_init_remote_input_dev(sp);
+ if (result) {
+ dev_err(sp->dev, "Failed to initialize remote queue\n");
+- goto error_send_message;
++ goto error_init_remote;
+ }
+
+ result = ibmasm_send_driver_vpd(sp);
+@@ -145,8 +145,9 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ return 0;
+
+ error_send_message:
+- disable_sp_interrupts(sp->base_address);
+ ibmasm_free_remote_input_dev(sp);
++error_init_remote:
++ disable_sp_interrupts(sp->base_address);
+ free_irq(sp->irq, (void *)sp);
+ error_request_irq:
+ iounmap(sp->base_address);
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index c2c45c148ae76..7b2bb32e35554 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1054,6 +1054,12 @@ static void mmc_blk_issue_drv_op(struct mmc_queue *mq, struct request *req)
+
+ switch (mq_rq->drv_op) {
+ case MMC_DRV_OP_IOCTL:
++ if (card->ext_csd.cmdq_en) {
++ ret = mmc_cmdq_disable(card);
++ if (ret)
++ break;
++ }
++ /* fallthrough */
+ case MMC_DRV_OP_IOCTL_RPMB:
+ idata = mq_rq->drv_op_data;
+ for (i = 0, ret = 0; i < mq_rq->ioc_count; i++) {
+@@ -1064,6 +1070,8 @@ static void mmc_blk_issue_drv_op(struct mmc_queue *mq, struct request *req)
+ /* Always switch back to main area after RPMB access */
+ if (rpmb_ioctl)
+ mmc_blk_part_switch(card, 0);
++ else if (card->reenable_cmdq && !card->ext_csd.cmdq_en)
++ mmc_cmdq_enable(card);
+ break;
+ case MMC_DRV_OP_BOOT_WP:
+ ret = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, EXT_CSD_BOOT_WP,
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 798bcb65b4df4..e340791a8eab3 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -980,11 +980,14 @@ int mmc_execute_tuning(struct mmc_card *card)
+
+ err = host->ops->execute_tuning(host, opcode);
+
+- if (err)
++ if (err) {
+ pr_err("%s: tuning execution failed: %d\n",
+ mmc_hostname(host), err);
+- else
++ } else {
++ host->retune_now = 0;
++ host->need_retune = 0;
+ mmc_retune_enable(host);
++ }
+
+ return err;
+ }
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index aa3de584b90cd..c179c4984e311 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -781,11 +781,13 @@ try_again:
+ return err;
+
+ /*
+- * In case CCS and S18A in the response is set, start Signal Voltage
+- * Switch procedure. SPI mode doesn't support CMD11.
++ * In case the S18A bit is set in the response, let's start the signal
++ * voltage switch procedure. SPI mode doesn't support CMD11.
++ * Note that, according to the spec, the S18A bit is not valid unless
++ * the CCS bit is set as well. We deliberately deviate from the spec in
++ * regards to this, which allows UHS-I to be supported for SDSC cards.
+ */
+- if (!mmc_host_is_spi(host) && rocr &&
+- ((*rocr & 0x41000000) == 0x41000000)) {
++ if (!mmc_host_is_spi(host) && rocr && (*rocr & 0x01000000)) {
+ err = mmc_set_uhs_voltage(host, pocr);
+ if (err == -EAGAIN) {
+ retries--;
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 499a3d2a8e315..5cb7c2cc501af 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1371,6 +1371,10 @@ static u16 sdhci_get_preset_value(struct sdhci_host *host)
+ u16 preset = 0;
+
+ switch (host->timing) {
++ case MMC_TIMING_MMC_HS:
++ case MMC_TIMING_SD_HS:
++ preset = sdhci_readw(host, SDHCI_PRESET_FOR_HIGH_SPEED);
++ break;
+ case MMC_TIMING_UHS_SDR12:
+ preset = sdhci_readw(host, SDHCI_PRESET_FOR_SDR12);
+ break;
+diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
+index c0372e3443fdf..2959fed39a385 100644
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -252,6 +252,7 @@
+
+ /* 60-FB reserved */
+
++#define SDHCI_PRESET_FOR_HIGH_SPEED 0x64
+ #define SDHCI_PRESET_FOR_SDR12 0x66
+ #define SDHCI_PRESET_FOR_SDR25 0x68
+ #define SDHCI_PRESET_FOR_SDR50 0x6A
+diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c
+index ef3aa8b520787..b88728b686e8a 100644
+--- a/drivers/mmc/host/usdhi6rol0.c
++++ b/drivers/mmc/host/usdhi6rol0.c
+@@ -1809,6 +1809,7 @@ static int usdhi6_probe(struct platform_device *pdev)
+
+ version = usdhi6_read(host, USDHI6_VERSION);
+ if ((version & 0xfff) != 0xa0d) {
++ ret = -EPERM;
+ dev_err(dev, "Version not recognized %x\n", version);
+ goto e_clk_off;
+ }
+diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c
+index 9fdb92729c28b..1b66466d2ed45 100644
+--- a/drivers/mmc/host/via-sdmmc.c
++++ b/drivers/mmc/host/via-sdmmc.c
+@@ -865,6 +865,9 @@ static void via_sdc_data_isr(struct via_crdr_mmc_host *host, u16 intmask)
+ {
+ BUG_ON(intmask == 0);
+
++ if (!host->data)
++ return;
++
+ if (intmask & VIA_CRDR_SDSTS_DT)
+ host->data->error = -ETIMEDOUT;
+ else if (intmask & (VIA_CRDR_SDSTS_RC | VIA_CRDR_SDSTS_WC))
+diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
+index 1fe68137a30f2..a004f2ee15b1e 100644
+--- a/drivers/mmc/host/vub300.c
++++ b/drivers/mmc/host/vub300.c
+@@ -2289,7 +2289,7 @@ static int vub300_probe(struct usb_interface *interface,
+ if (retval < 0)
+ goto error5;
+ retval =
+- usb_control_msg(vub300->udev, usb_rcvctrlpipe(vub300->udev, 0),
++ usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
+ SET_ROM_WAIT_STATES,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ firmware_rom_wait_states, 0x0000, NULL, 0, HZ);
+diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
+index 00b1adcfad86d..07bd41dd43563 100644
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -2880,8 +2880,10 @@ static int __maybe_unused marvell_nfc_resume(struct device *dev)
+ return ret;
+
+ ret = clk_prepare_enable(nfc->reg_clk);
+- if (ret < 0)
++ if (ret < 0) {
++ clk_disable_unprepare(nfc->core_clk);
+ return ret;
++ }
+
+ /*
+ * Reset nfc->selected_chip so the next command will cause the timing
+diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c
+index 4bc5d522c74bb..2d73667ea259a 100644
+--- a/drivers/net/can/peak_canfd/peak_canfd.c
++++ b/drivers/net/can/peak_canfd/peak_canfd.c
+@@ -346,8 +346,8 @@ static int pucan_handle_status(struct peak_canfd_priv *priv,
+ return err;
+ }
+
+- /* start network queue (echo_skb array is empty) */
+- netif_start_queue(ndev);
++ /* wake network queue up (echo_skb array is empty) */
++ netif_wake_queue(ndev);
+
+ return 0;
+ }
+diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
+index b7dfd4109d24e..16b96f978aae7 100644
+--- a/drivers/net/can/usb/ems_usb.c
++++ b/drivers/net/can/usb/ems_usb.c
+@@ -1065,7 +1065,6 @@ static void ems_usb_disconnect(struct usb_interface *intf)
+
+ if (dev) {
+ unregister_netdev(dev->netdev);
+- free_candev(dev->netdev);
+
+ unlink_all_urbs(dev);
+
+@@ -1073,6 +1072,8 @@ static void ems_usb_disconnect(struct usb_interface *intf)
+
+ kfree(dev->intr_in_buffer);
+ kfree(dev->tx_msg_buffer);
++
++ free_candev(dev->netdev);
+ }
+ }
+
+diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c
+index 4309be3724ad4..a20e95b39cf79 100644
+--- a/drivers/net/ethernet/aeroflex/greth.c
++++ b/drivers/net/ethernet/aeroflex/greth.c
+@@ -1546,10 +1546,11 @@ static int greth_of_remove(struct platform_device *of_dev)
+ mdiobus_unregister(greth->mdio);
+
+ unregister_netdev(ndev);
+- free_netdev(ndev);
+
+ of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0]));
+
++ free_netdev(ndev);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index c3e824f5e50e8..1546a9bd9203c 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -3750,3 +3750,4 @@ MODULE_AUTHOR("Broadcom Corporation");
+ MODULE_DESCRIPTION("Broadcom GENET Ethernet controller driver");
+ MODULE_ALIAS("platform:bcmgenet");
+ MODULE_LICENSE("GPL");
++MODULE_SOFTDEP("pre: mdio-bcm-unimac");
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index a5049d637791d..494601c39b847 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -428,6 +428,10 @@ static int bcmgenet_mii_register(struct bcmgenet_priv *priv)
+ int id, ret;
+
+ pres = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!pres) {
++ dev_err(&pdev->dev, "Invalid resource\n");
++ return -EINVAL;
++ }
+ memset(&res, 0, sizeof(res));
+ memset(&ppd, 0, sizeof(ppd));
+
+diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c
+index 659f1ad37e96a..70ccbd11b9e7e 100644
+--- a/drivers/net/ethernet/ezchip/nps_enet.c
++++ b/drivers/net/ethernet/ezchip/nps_enet.c
+@@ -623,7 +623,7 @@ static s32 nps_enet_probe(struct platform_device *pdev)
+
+ /* Get IRQ number */
+ priv->irq = platform_get_irq(pdev, 0);
+- if (!priv->irq) {
++ if (priv->irq < 0) {
+ dev_err(dev, "failed to retrieve <irq Rx-Tx> value from device tree\n");
+ err = -ENODEV;
+ goto out_netdev;
+@@ -658,8 +658,8 @@ static s32 nps_enet_remove(struct platform_device *pdev)
+ struct nps_enet_priv *priv = netdev_priv(ndev);
+
+ unregister_netdev(ndev);
+- free_netdev(ndev);
+ netif_napi_del(&priv->napi);
++ free_netdev(ndev);
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index 0f799e8e093cd..5a1fe49030b11 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -2636,10 +2636,8 @@ static int ehea_restart_qps(struct net_device *dev)
+ u16 dummy16 = 0;
+
+ cb0 = (void *)get_zeroed_page(GFP_KERNEL);
+- if (!cb0) {
+- ret = -ENOMEM;
+- goto out;
+- }
++ if (!cb0)
++ return -ENOMEM;
+
+ for (i = 0; i < (port->num_def_qps); i++) {
+ struct ehea_port_res *pr = &port->port_res[i];
+@@ -2659,6 +2657,7 @@ static int ehea_restart_qps(struct net_device *dev)
+ cb0);
+ if (hret != H_SUCCESS) {
+ netdev_err(dev, "query_ehea_qp failed (1)\n");
++ ret = -EFAULT;
+ goto out;
+ }
+
+@@ -2671,6 +2670,7 @@ static int ehea_restart_qps(struct net_device *dev)
+ &dummy64, &dummy16, &dummy16);
+ if (hret != H_SUCCESS) {
+ netdev_err(dev, "modify_ehea_qp failed (1)\n");
++ ret = -EFAULT;
+ goto out;
+ }
+
+@@ -2679,6 +2679,7 @@ static int ehea_restart_qps(struct net_device *dev)
+ cb0);
+ if (hret != H_SUCCESS) {
+ netdev_err(dev, "query_ehea_qp failed (2)\n");
++ ret = -EFAULT;
+ goto out;
+ }
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 9f72cd3b1d244..4008007c2e340 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -698,8 +698,11 @@ static int init_tx_pools(struct net_device *netdev)
+
+ adapter->tso_pool = kcalloc(tx_subcrqs,
+ sizeof(struct ibmvnic_tx_pool), GFP_KERNEL);
+- if (!adapter->tso_pool)
++ if (!adapter->tso_pool) {
++ kfree(adapter->tx_pool);
++ adapter->tx_pool = NULL;
+ return -1;
++ }
+
+ adapter->num_active_tx_pools = tx_subcrqs;
+
+@@ -1099,6 +1102,11 @@ static int __ibmvnic_open(struct net_device *netdev)
+
+ netif_tx_start_all_queues(netdev);
+
++ if (prev_state == VNIC_CLOSED) {
++ for (i = 0; i < adapter->req_rx_queues; i++)
++ napi_schedule(&adapter->napi[i]);
++ }
++
+ adapter->state = VNIC_OPEN;
+ return rc;
+ }
+diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
+index 78b44d7876386..bf64fab383851 100644
+--- a/drivers/net/ethernet/intel/e100.c
++++ b/drivers/net/ethernet/intel/e100.c
+@@ -1398,7 +1398,7 @@ static int e100_phy_check_without_mii(struct nic *nic)
+ u8 phy_type;
+ int without_mii;
+
+- phy_type = (nic->eeprom[eeprom_phy_iface] >> 8) & 0x0f;
++ phy_type = (le16_to_cpu(nic->eeprom[eeprom_phy_iface]) >> 8) & 0x0f;
+
+ switch (phy_type) {
+ case NoSuchPhy: /* Non-MII PHY; UNTESTED! */
+@@ -1518,7 +1518,7 @@ static int e100_phy_init(struct nic *nic)
+ mdio_write(netdev, nic->mii.phy_id, MII_BMCR, bmcr);
+ } else if ((nic->mac >= mac_82550_D102) || ((nic->flags & ich) &&
+ (mdio_read(netdev, nic->mii.phy_id, MII_TPISTATUS) & 0x8000) &&
+- (nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) {
++ (le16_to_cpu(nic->eeprom[eeprom_cnfg_mdix]) & eeprom_mdix_enabled))) {
+ /* enable/disable MDI/MDI-X auto-switching. */
+ mdio_write(netdev, nic->mii.phy_id, MII_NCONFIG,
+ nic->mii.force_media ? 0 : NCONFIG_AUTO_SWITCH);
+@@ -2264,9 +2264,9 @@ static int e100_asf(struct nic *nic)
+ {
+ /* ASF can be enabled from eeprom */
+ return (nic->pdev->device >= 0x1050) && (nic->pdev->device <= 0x1057) &&
+- (nic->eeprom[eeprom_config_asf] & eeprom_asf) &&
+- !(nic->eeprom[eeprom_config_asf] & eeprom_gcl) &&
+- ((nic->eeprom[eeprom_smbus_addr] & 0xFF) != 0xFE);
++ (le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_asf) &&
++ !(le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_gcl) &&
++ ((le16_to_cpu(nic->eeprom[eeprom_smbus_addr]) & 0xFF) != 0xFE);
+ }
+
+ static int e100_up(struct nic *nic)
+@@ -2922,7 +2922,7 @@ static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ /* Wol magic packet can be enabled from eeprom */
+ if ((nic->mac >= mac_82558_D101_A4) &&
+- (nic->eeprom[eeprom_id] & eeprom_id_wol)) {
++ (le16_to_cpu(nic->eeprom[eeprom_id]) & eeprom_id_wol)) {
+ nic->flags |= wol_magic;
+ device_set_wakeup_enable(&pdev->dev, true);
+ }
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 9148d93c5c63c..4c7c1998f358d 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -948,8 +948,7 @@ static int i40e_set_link_ksettings(struct net_device *netdev,
+ if (ethtool_link_ksettings_test_link_mode(&safe_ks,
+ supported,
+ Autoneg) &&
+- hw->phy.link_info.phy_type !=
+- I40E_PHY_TYPE_10GBASE_T) {
++ hw->phy.media_type != I40E_MEDIA_TYPE_BASET) {
+ netdev_info(netdev, "Autoneg cannot be disabled on this phy\n");
+ err = -EINVAL;
+ goto done;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index fa0e7582159ff..1b101b526ed35 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -7743,6 +7743,8 @@ int i40e_vsi_open(struct i40e_vsi *vsi)
+ dev_driver_string(&pf->pdev->dev),
+ dev_name(&pf->pdev->dev));
+ err = i40e_vsi_request_irq(vsi, int_name);
++ if (err)
++ goto err_setup_rx;
+
+ } else {
+ err = -EINVAL;
+diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h
+index 5ca9d684429d1..8105f11f01990 100644
+--- a/drivers/net/ethernet/intel/ice/ice_type.h
++++ b/drivers/net/ethernet/intel/ice/ice_type.h
+@@ -41,7 +41,7 @@ enum ice_aq_res_ids {
+ /* FW update timeout definitions are in milliseconds */
+ #define ICE_NVM_TIMEOUT 180000
+ #define ICE_CHANGE_LOCK_TIMEOUT 1000
+-#define ICE_GLOBAL_CFG_LOCK_TIMEOUT 3000
++#define ICE_GLOBAL_CFG_LOCK_TIMEOUT 5000
+
+ enum ice_aq_res_access_type {
+ ICE_RES_READ = 1,
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index bc5cfe062b10e..52fdb200a0c79 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -5157,6 +5157,10 @@ static int mvpp2_probe(struct platform_device *pdev)
+ return PTR_ERR(priv->lms_base);
+ } else {
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++ if (!res) {
++ dev_err(&pdev->dev, "Invalid resource\n");
++ return -EINVAL;
++ }
+ if (has_acpi_companion(&pdev->dev)) {
+ /* In case the MDIO memory region is declared in
+ * the ACPI, it can already appear as 'in-use'
+@@ -5314,6 +5318,8 @@ static int mvpp2_probe(struct platform_device *pdev)
+ return 0;
+
+ err_port_probe:
++ fwnode_handle_put(port_fwnode);
++
+ i = 0;
+ fwnode_for_each_available_child_node(fwnode, port_fwnode) {
+ if (priv->port_list[i])
+diff --git a/drivers/net/ethernet/micrel/ks8842.c b/drivers/net/ethernet/micrel/ks8842.c
+index e3d7c74d47bb0..5282c5754ac17 100644
+--- a/drivers/net/ethernet/micrel/ks8842.c
++++ b/drivers/net/ethernet/micrel/ks8842.c
+@@ -1150,6 +1150,10 @@ static int ks8842_probe(struct platform_device *pdev)
+ unsigned i;
+
+ iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!iomem) {
++ dev_err(&pdev->dev, "Invalid resource\n");
++ return -EINVAL;
++ }
+ if (!request_mem_region(iomem->start, resource_size(iomem), DRV_NAME))
+ goto err_mem_region;
+
+diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+index 3a4225837049a..5a45648e31245 100644
+--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
++++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+@@ -118,7 +118,7 @@ static int pch_ptp_match(struct sk_buff *skb, u16 uid_hi, u32 uid_lo, u16 seqid)
+ {
+ u8 *data = skb->data;
+ unsigned int offset;
+- u16 *hi, *id;
++ u16 hi, id;
+ u32 lo;
+
+ if (ptp_classify_raw(skb) == PTP_CLASS_NONE)
+@@ -129,14 +129,11 @@ static int pch_ptp_match(struct sk_buff *skb, u16 uid_hi, u32 uid_lo, u16 seqid)
+ if (skb->len < offset + OFF_PTP_SEQUENCE_ID + sizeof(seqid))
+ return 0;
+
+- hi = (u16 *)(data + offset + OFF_PTP_SOURCE_UUID);
+- id = (u16 *)(data + offset + OFF_PTP_SEQUENCE_ID);
++ hi = get_unaligned_be16(data + offset + OFF_PTP_SOURCE_UUID + 0);
++ lo = get_unaligned_be32(data + offset + OFF_PTP_SOURCE_UUID + 2);
++ id = get_unaligned_be16(data + offset + OFF_PTP_SEQUENCE_ID);
+
+- memcpy(&lo, &hi[1], sizeof(lo));
+-
+- return (uid_hi == *hi &&
+- uid_lo == lo &&
+- seqid == *id);
++ return (uid_hi == hi && uid_lo == lo && seqid == id);
+ }
+
+ static void
+@@ -146,7 +143,6 @@ pch_rx_timestamp(struct pch_gbe_adapter *adapter, struct sk_buff *skb)
+ struct pci_dev *pdev;
+ u64 ns;
+ u32 hi, lo, val;
+- u16 uid, seq;
+
+ if (!adapter->hwts_rx_en)
+ return;
+@@ -162,10 +158,7 @@ pch_rx_timestamp(struct pch_gbe_adapter *adapter, struct sk_buff *skb)
+ lo = pch_src_uuid_lo_read(pdev);
+ hi = pch_src_uuid_hi_read(pdev);
+
+- uid = hi & 0xffff;
+- seq = (hi >> 16) & 0xffff;
+-
+- if (!pch_ptp_match(skb, htons(uid), htonl(lo), htons(seq)))
++ if (!pch_ptp_match(skb, hi, lo, hi >> 16))
+ goto out;
+
+ ns = pch_rx_snap_read(pdev);
+@@ -2546,9 +2539,13 @@ static int pch_gbe_probe(struct pci_dev *pdev,
+ adapter->pdev = pdev;
+ adapter->hw.back = adapter;
+ adapter->hw.reg = pcim_iomap_table(pdev)[PCH_GBE_PCI_BAR];
++
+ adapter->pdata = (struct pch_gbe_privdata *)pci_id->driver_data;
+- if (adapter->pdata && adapter->pdata->platform_init)
+- adapter->pdata->platform_init(pdev);
++ if (adapter->pdata && adapter->pdata->platform_init) {
++ ret = adapter->pdata->platform_init(pdev);
++ if (ret)
++ goto err_free_netdev;
++ }
+
+ adapter->ptp_pdev =
+ pci_get_domain_bus_and_slot(pci_domain_nr(adapter->pdev->bus),
+@@ -2643,7 +2640,7 @@ err_free_netdev:
+ */
+ static int pch_gbe_minnow_platform_init(struct pci_dev *pdev)
+ {
+- unsigned long flags = GPIOF_DIR_OUT | GPIOF_INIT_HIGH | GPIOF_EXPORT;
++ unsigned long flags = GPIOF_OUT_INIT_HIGH;
+ unsigned gpio = MINNOW_PHY_RESET_GPIO;
+ int ret;
+
+diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c
+index 3d76fd1504c2b..f074986a13b1a 100644
+--- a/drivers/net/ethernet/sfc/ef10_sriov.c
++++ b/drivers/net/ethernet/sfc/ef10_sriov.c
+@@ -406,12 +406,17 @@ fail1:
+ return rc;
+ }
+
++/* Disable SRIOV and remove VFs
++ * If some VFs are attached to a guest (using Xen, only) nothing is
++ * done if force=false, and vports are freed if force=true (for the non
++ * attachedc ones, only) but SRIOV is not disabled and VFs are not
++ * removed in either case.
++ */
+ static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force)
+ {
+ struct pci_dev *dev = efx->pci_dev;
+- unsigned int vfs_assigned = 0;
+-
+- vfs_assigned = pci_vfs_assigned(dev);
++ unsigned int vfs_assigned = pci_vfs_assigned(dev);
++ int rc = 0;
+
+ if (vfs_assigned && !force) {
+ netif_info(efx, drv, efx->net_dev, "VFs are assigned to guests; "
+@@ -421,10 +426,12 @@ static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force)
+
+ if (!vfs_assigned)
+ pci_disable_sriov(dev);
++ else
++ rc = -EBUSY;
+
+ efx_ef10_sriov_free_vf_vswitching(efx);
+ efx->vf_count = 0;
+- return 0;
++ return rc;
+ }
+
+ int efx_ef10_sriov_configure(struct efx_nic *efx, int num_vfs)
+@@ -443,7 +450,6 @@ int efx_ef10_sriov_init(struct efx_nic *efx)
+ void efx_ef10_sriov_fini(struct efx_nic *efx)
+ {
+ struct efx_ef10_nic_data *nic_data = efx->nic_data;
+- unsigned int i;
+ int rc;
+
+ if (!nic_data->vf) {
+@@ -453,14 +459,7 @@ void efx_ef10_sriov_fini(struct efx_nic *efx)
+ return;
+ }
+
+- /* Remove any VFs in the host */
+- for (i = 0; i < efx->vf_count; ++i) {
+- struct efx_nic *vf_efx = nic_data->vf[i].efx;
+-
+- if (vf_efx)
+- vf_efx->pci_dev->driver->remove(vf_efx->pci_dev);
+- }
+-
++ /* Disable SRIOV and remove any VFs in the host */
+ rc = efx_ef10_pci_sriov_disable(efx, true);
+ if (rc)
+ netif_dbg(efx, drv, efx->net_dev,
+diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
+index 1979f8f8dac72..778d3729f460a 100644
+--- a/drivers/net/fjes/fjes_main.c
++++ b/drivers/net/fjes/fjes_main.c
+@@ -1277,6 +1277,10 @@ static int fjes_probe(struct platform_device *plat_dev)
+ adapter->interrupt_watch_enable = false;
+
+ res = platform_get_resource(plat_dev, IORESOURCE_MEM, 0);
++ if (!res) {
++ err = -EINVAL;
++ goto err_free_control_wq;
++ }
+ hw->hw_res.start = res->start;
+ hw->hw_res.size = resource_size(res);
+ hw->hw_res.irq = platform_get_irq(plat_dev, 0);
+diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
+index be1f1a86bcd61..06aadebc2d5ba 100644
+--- a/drivers/net/ieee802154/mac802154_hwsim.c
++++ b/drivers/net/ieee802154/mac802154_hwsim.c
+@@ -496,7 +496,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info)
+ struct hwsim_edge *e;
+ u32 v0, v1;
+
+- if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] &&
++ if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] ||
+ !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE])
+ return -EINVAL;
+
+@@ -734,6 +734,8 @@ static int hwsim_subscribe_all_others(struct hwsim_phy *phy)
+
+ return 0;
+
++sub_fail:
++ hwsim_edge_unsubscribe_me(phy);
+ me_fail:
+ rcu_read_lock();
+ list_for_each_entry_rcu(e, &phy->edges, list) {
+@@ -741,8 +743,6 @@ me_fail:
+ hwsim_free_edge(e);
+ }
+ rcu_read_unlock();
+-sub_fail:
+- hwsim_edge_unsubscribe_me(phy);
+ return -ENOMEM;
+ }
+
+@@ -843,12 +843,17 @@ err_pib:
+ static void hwsim_del(struct hwsim_phy *phy)
+ {
+ struct hwsim_pib *pib;
++ struct hwsim_edge *e;
+
+ hwsim_edge_unsubscribe_me(phy);
+
+ list_del(&phy->list);
+
+ rcu_read_lock();
++ list_for_each_entry_rcu(e, &phy->edges, list) {
++ list_del_rcu(&e->list);
++ hwsim_free_edge(e);
++ }
+ pib = rcu_dereference(phy->pib);
+ rcu_read_unlock();
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 0b1c6a8906b99..5e8b406302861 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1506,6 +1506,8 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget)
+ struct virtnet_info *vi = sq->vq->vdev->priv;
+ unsigned int index = vq2txq(sq->vq);
+ struct netdev_queue *txq;
++ int opaque;
++ bool done;
+
+ if (unlikely(is_xdp_raw_buffer_queue(vi, index))) {
+ /* We don't need to enable cb for XDP */
+@@ -1515,10 +1517,28 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget)
+
+ txq = netdev_get_tx_queue(vi->dev, index);
+ __netif_tx_lock(txq, raw_smp_processor_id());
++ virtqueue_disable_cb(sq->vq);
+ free_old_xmit_skbs(sq, true);
++
++ opaque = virtqueue_enable_cb_prepare(sq->vq);
++
++ done = napi_complete_done(napi, 0);
++
++ if (!done)
++ virtqueue_disable_cb(sq->vq);
++
+ __netif_tx_unlock(txq);
+
+- virtqueue_napi_complete(napi, sq->vq, 0);
++ if (done) {
++ if (unlikely(virtqueue_poll(sq->vq, opaque))) {
++ if (napi_schedule_prep(napi)) {
++ __netif_tx_lock(txq, raw_smp_processor_id());
++ virtqueue_disable_cb(sq->vq);
++ __netif_tx_unlock(txq);
++ __napi_schedule(napi);
++ }
++ }
++ }
+
+ if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS)
+ netif_tx_wake_queue(txq);
+@@ -1550,7 +1570,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb)
+ if (virtio_net_hdr_from_skb(skb, &hdr->hdr,
+ virtio_is_little_endian(vi->vdev), false,
+ 0))
+- BUG();
++ return -EPROTO;
+
+ if (vi->mergeable_rx_bufs)
+ hdr->num_buffers = 0;
+@@ -3199,8 +3219,11 @@ static __maybe_unused int virtnet_restore(struct virtio_device *vdev)
+ virtnet_set_queues(vi, vi->curr_queue_pairs);
+
+ err = virtnet_cpu_notif_add(vi);
+- if (err)
++ if (err) {
++ virtnet_freeze_down(vdev);
++ remove_vq_common(vi);
+ return err;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 49e8c6d42cda4..eacc1e32d5478 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -1682,6 +1682,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni)
+ struct neighbour *n;
+ struct nd_msg *msg;
+
++ rcu_read_lock();
+ in6_dev = __in6_dev_get(dev);
+ if (!in6_dev)
+ goto out;
+@@ -1733,6 +1734,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni)
+ }
+
+ out:
++ rcu_read_unlock();
+ consume_skb(skb);
+ return NETDEV_TX_OK;
+ }
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index f32d35e03708f..8102d684be594 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -5125,6 +5125,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
+
+ if (arvif->nohwcrypt &&
+ !test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
++ ret = -EINVAL;
+ ath10k_warn(ar, "cryptmode module param needed for sw crypto\n");
+ goto err;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 3e92b88045a53..e929020d7c9cb 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -304,6 +304,11 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
+ hchan = ah->curchan;
+ }
+
++ if (!hchan) {
++ fastcc = false;
++ hchan = ath9k_cmn_get_channel(sc->hw, ah, &sc->cur_chan->chandef);
++ }
++
+ if (!ath_prepare_reset(sc))
+ fastcc = false;
+
+diff --git a/drivers/net/wireless/ath/carl9170/Kconfig b/drivers/net/wireless/ath/carl9170/Kconfig
+index 2e34baeaf7649..2b782db20fde4 100644
+--- a/drivers/net/wireless/ath/carl9170/Kconfig
++++ b/drivers/net/wireless/ath/carl9170/Kconfig
+@@ -15,13 +15,11 @@ config CARL9170
+
+ config CARL9170_LEDS
+ bool "SoftLED Support"
+- depends on CARL9170
+- select MAC80211_LEDS
+- select LEDS_CLASS
+- select NEW_LEDS
+ default y
++ depends on CARL9170
++ depends on MAC80211_LEDS
+ help
+- This option is necessary, if you want your device' LEDs to blink
++ This option is necessary, if you want your device's LEDs to blink.
+
+ Say Y, unless you need the LEDs for firmware debugging.
+
+diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
+index 46ae4ec4ad47d..556ba3c6c5d8e 100644
+--- a/drivers/net/wireless/ath/wcn36xx/main.c
++++ b/drivers/net/wireless/ath/wcn36xx/main.c
+@@ -293,23 +293,16 @@ static int wcn36xx_start(struct ieee80211_hw *hw)
+ goto out_free_dxe_pool;
+ }
+
+- wcn->hal_buf = kmalloc(WCN36XX_HAL_BUF_SIZE, GFP_KERNEL);
+- if (!wcn->hal_buf) {
+- wcn36xx_err("Failed to allocate smd buf\n");
+- ret = -ENOMEM;
+- goto out_free_dxe_ctl;
+- }
+-
+ ret = wcn36xx_smd_load_nv(wcn);
+ if (ret) {
+ wcn36xx_err("Failed to push NV to chip\n");
+- goto out_free_smd_buf;
++ goto out_free_dxe_ctl;
+ }
+
+ ret = wcn36xx_smd_start(wcn);
+ if (ret) {
+ wcn36xx_err("Failed to start chip\n");
+- goto out_free_smd_buf;
++ goto out_free_dxe_ctl;
+ }
+
+ if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+@@ -336,8 +329,6 @@ static int wcn36xx_start(struct ieee80211_hw *hw)
+
+ out_smd_stop:
+ wcn36xx_smd_stop(wcn);
+-out_free_smd_buf:
+- kfree(wcn->hal_buf);
+ out_free_dxe_ctl:
+ wcn36xx_dxe_free_ctl_blks(wcn);
+ out_free_dxe_pool:
+@@ -374,8 +365,6 @@ static void wcn36xx_stop(struct ieee80211_hw *hw)
+
+ wcn36xx_dxe_free_mem_pools(wcn);
+ wcn36xx_dxe_free_ctl_blks(wcn);
+-
+- kfree(wcn->hal_buf);
+ }
+
+ static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed)
+@@ -1322,6 +1311,12 @@ static int wcn36xx_probe(struct platform_device *pdev)
+ mutex_init(&wcn->hal_mutex);
+ mutex_init(&wcn->scan_lock);
+
++ wcn->hal_buf = devm_kmalloc(wcn->dev, WCN36XX_HAL_BUF_SIZE, GFP_KERNEL);
++ if (!wcn->hal_buf) {
++ ret = -ENOMEM;
++ goto out_wq;
++ }
++
+ ret = dma_set_mask_and_coherent(wcn->dev, DMA_BIT_MASK(32));
+ if (ret < 0) {
+ wcn36xx_err("failed to set DMA mask: %d\n", ret);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index 96dc9e5ab23f4..75790b13c9621 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -2543,8 +2543,9 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
+ struct brcmf_sta_info_le sta_info_le;
+ u32 sta_flags;
+ u32 is_tdls_peer;
+- s32 total_rssi;
+- s32 count_rssi;
++ s32 total_rssi_avg = 0;
++ s32 total_rssi = 0;
++ s32 count_rssi = 0;
+ int rssi;
+ u32 i;
+
+@@ -2610,25 +2611,27 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
+ sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
+ }
+- total_rssi = 0;
+- count_rssi = 0;
+ for (i = 0; i < BRCMF_ANT_MAX; i++) {
+- if (sta_info_le.rssi[i]) {
+- sinfo->chain_signal_avg[count_rssi] =
+- sta_info_le.rssi[i];
+- sinfo->chain_signal[count_rssi] =
+- sta_info_le.rssi[i];
+- total_rssi += sta_info_le.rssi[i];
+- count_rssi++;
+- }
++ if (sta_info_le.rssi[i] == 0 ||
++ sta_info_le.rx_lastpkt_rssi[i] == 0)
++ continue;
++ sinfo->chains |= BIT(count_rssi);
++ sinfo->chain_signal[count_rssi] =
++ sta_info_le.rx_lastpkt_rssi[i];
++ sinfo->chain_signal_avg[count_rssi] =
++ sta_info_le.rssi[i];
++ total_rssi += sta_info_le.rx_lastpkt_rssi[i];
++ total_rssi_avg += sta_info_le.rssi[i];
++ count_rssi++;
+ }
+ if (count_rssi) {
+- sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
+- sinfo->chains = count_rssi;
+-
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
+- total_rssi /= count_rssi;
+- sinfo->signal = total_rssi;
++ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
++ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
++ sinfo->filled |=
++ BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
++ sinfo->signal = total_rssi / count_rssi;
++ sinfo->signal_avg = total_rssi_avg / count_rssi;
+ } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
+ &ifp->vif->sme_state)) {
+ memset(&scb_val, 0, sizeof(scb_val));
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+index 6188275b17e5a..288d4d4d44548 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+@@ -1223,6 +1223,7 @@ static int brcms_bcma_probe(struct bcma_device *pdev)
+ {
+ struct brcms_info *wl;
+ struct ieee80211_hw *hw;
++ int ret;
+
+ dev_info(&pdev->dev, "mfg %x core %x rev %d class %d irq %d\n",
+ pdev->id.manuf, pdev->id.id, pdev->id.rev, pdev->id.class,
+@@ -1247,11 +1248,16 @@ static int brcms_bcma_probe(struct bcma_device *pdev)
+ wl = brcms_attach(pdev);
+ if (!wl) {
+ pr_err("%s: brcms_attach failed!\n", __func__);
+- return -ENODEV;
++ ret = -ENODEV;
++ goto err_free_ieee80211;
+ }
+ brcms_led_register(wl);
+
+ return 0;
++
++err_free_ieee80211:
++ ieee80211_free_hw(hw);
++ return ret;
+ }
+
+ static int brcms_suspend(struct bcma_device *pdev)
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 2fad20c845b47..697a66acba9ce 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -3496,6 +3496,7 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
+ struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+ struct cfg80211_chan_def chandef;
+ struct iwl_mvm_phy_ctxt *phy_ctxt;
++ bool band_change_removal;
+ int ret, i;
+
+ IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
+@@ -3565,19 +3566,30 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
+ cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
+
+ /*
+- * Change the PHY context configuration as it is currently referenced
+- * only by the P2P Device MAC
++ * Check if the remain-on-channel is on a different band and that
++ * requires context removal, see iwl_mvm_phy_ctxt_changed(). If
++ * so, we'll need to release and then re-configure here, since we
++ * must not remove a PHY context that's part of a binding.
+ */
+- if (mvmvif->phy_ctxt->ref == 1) {
++ band_change_removal =
++ fw_has_capa(&mvm->fw->ucode_capa,
++ IWL_UCODE_TLV_CAPA_BINDING_CDB_SUPPORT) &&
++ mvmvif->phy_ctxt->channel->band != chandef.chan->band;
++
++ if (mvmvif->phy_ctxt->ref == 1 && !band_change_removal) {
++ /*
++ * Change the PHY context configuration as it is currently
++ * referenced only by the P2P Device MAC (and we can modify it)
++ */
+ ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
+ &chandef, 1, 1);
+ if (ret)
+ goto out_unlock;
+ } else {
+ /*
+- * The PHY context is shared with other MACs. Need to remove the
+- * P2P Device from the binding, allocate an new PHY context and
+- * create a new binding
++ * The PHY context is shared with other MACs (or we're trying to
++ * switch bands), so remove the P2P Device from the binding,
++ * allocate an new PHY context and create a new binding.
+ */
+ phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
+ if (!phy_ctxt) {
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+index a1cecf4a0e820..addf786fbcaf9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+@@ -63,7 +63,6 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+ struct iwl_prph_scratch *prph_scratch;
+ struct iwl_prph_scratch_ctrl_cfg *prph_sc_ctrl;
+ struct iwl_prph_info *prph_info;
+- void *iml_img;
+ u32 control_flags = 0;
+ int ret;
+
+@@ -157,14 +156,15 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+ trans_pcie->prph_scratch = prph_scratch;
+
+ /* Allocate IML */
+- iml_img = dma_alloc_coherent(trans->dev, trans->iml_len,
+- &trans_pcie->iml_dma_addr, GFP_KERNEL);
+- if (!iml_img) {
++ trans_pcie->iml = dma_alloc_coherent(trans->dev, trans->iml_len,
++ &trans_pcie->iml_dma_addr,
++ GFP_KERNEL);
++ if (!trans_pcie->iml) {
+ ret = -ENOMEM;
+ goto err_free_ctxt_info;
+ }
+
+- memcpy(iml_img, trans->iml, trans->iml_len);
++ memcpy(trans_pcie->iml, trans->iml, trans->iml_len);
+
+ iwl_enable_fw_load_int_ctx_info(trans);
+
+@@ -212,6 +212,11 @@ void iwl_pcie_ctxt_info_gen3_free(struct iwl_trans *trans)
+ trans_pcie->ctxt_info_dma_addr = 0;
+ trans_pcie->ctxt_info_gen3 = NULL;
+
++ dma_free_coherent(trans->dev, trans->iml_len, trans_pcie->iml,
++ trans_pcie->iml_dma_addr);
++ trans_pcie->iml_dma_addr = 0;
++ trans_pcie->iml = NULL;
++
+ iwl_pcie_ctxt_info_free_fw_img(trans);
+
+ dma_free_coherent(trans->dev, sizeof(*trans_pcie->prph_scratch),
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+index e9d67ba3e56dd..f581822b2a7df 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+@@ -447,6 +447,8 @@ struct iwl_self_init_dram {
+ * Context information addresses will be taken from here.
+ * This is driver's local copy for keeping track of size and
+ * count for allocating and freeing the memory.
++ * @iml: image loader image virtual address
++ * @iml_dma_addr: image loader image DMA address
+ * @trans: pointer to the generic transport area
+ * @scd_base_addr: scheduler sram base address in SRAM
+ * @scd_bc_tbls: pointer to the byte count table of the scheduler
+@@ -492,6 +494,7 @@ struct iwl_trans_pcie {
+ };
+ struct iwl_prph_info *prph_info;
+ struct iwl_prph_scratch *prph_scratch;
++ void *iml;
+ dma_addr_t ctxt_info_dma_addr;
+ dma_addr_t prph_info_dma_addr;
+ dma_addr_t prph_scratch_dma_addr;
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
+index 5907b34037c24..2f0141c964e25 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -1084,7 +1084,7 @@ static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifiex_adapter *adapter)
+ static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter)
+ {
+ struct pcie_service_card *card = adapter->card;
+- u32 tmp;
++ u32 *cookie;
+
+ card->sleep_cookie_vbase = pci_alloc_consistent(card->dev, sizeof(u32),
+ &card->sleep_cookie_pbase);
+@@ -1093,13 +1093,11 @@ static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter)
+ "pci_alloc_consistent failed!\n");
+ return -ENOMEM;
+ }
++ cookie = (u32 *)card->sleep_cookie_vbase;
+ /* Init val of Sleep Cookie */
+- tmp = FW_AWAKE_COOKIE;
+- put_unaligned(tmp, card->sleep_cookie_vbase);
++ *cookie = FW_AWAKE_COOKIE;
+
+- mwifiex_dbg(adapter, INFO,
+- "alloc_scook: sleep cookie=0x%x\n",
+- get_unaligned(card->sleep_cookie_vbase));
++ mwifiex_dbg(adapter, INFO, "alloc_scook: sleep cookie=0x%x\n", *cookie);
+
+ return 0;
+ }
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+index 47c2bfe06d030..bd28deff9b8c6 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+@@ -861,15 +861,10 @@ struct rtl8192eu_efuse {
+ u8 usb_optional_function;
+ u8 res9[2];
+ u8 mac_addr[ETH_ALEN]; /* 0xd7 */
+- u8 res10[2];
+- u8 vendor_name[7];
+- u8 res11[2];
+- u8 device_name[0x0b]; /* 0xe8 */
+- u8 res12[2];
+- u8 serial[0x0b]; /* 0xf5 */
+- u8 res13[0x30];
++ u8 device_info[80];
++ u8 res11[3];
+ u8 unknown[0x0d]; /* 0x130 */
+- u8 res14[0xc3];
++ u8 res12[0xc3];
+ };
+
+ struct rtl8xxxu_reg8val {
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
+index 380e86f9e00be..837a1b9d189df 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
+@@ -562,9 +562,43 @@ rtl8192e_set_tx_power(struct rtl8xxxu_priv *priv, int channel, bool ht40)
+ }
+ }
+
++static void rtl8192eu_log_next_device_info(struct rtl8xxxu_priv *priv,
++ char *record_name,
++ char *device_info,
++ unsigned int *record_offset)
++{
++ char *record = device_info + *record_offset;
++
++ /* A record is [ total length | 0x03 | value ] */
++ unsigned char l = record[0];
++
++ /*
++ * The whole device info section seems to be 80 characters, make sure
++ * we don't read further.
++ */
++ if (*record_offset + l > 80) {
++ dev_warn(&priv->udev->dev,
++ "invalid record length %d while parsing \"%s\" at offset %u.\n",
++ l, record_name, *record_offset);
++ return;
++ }
++
++ if (l >= 2) {
++ char value[80];
++
++ memcpy(value, &record[2], l - 2);
++ value[l - 2] = '\0';
++ dev_info(&priv->udev->dev, "%s: %s\n", record_name, value);
++ *record_offset = *record_offset + l;
++ } else {
++ dev_info(&priv->udev->dev, "%s not available.\n", record_name);
++ }
++}
++
+ static int rtl8192eu_parse_efuse(struct rtl8xxxu_priv *priv)
+ {
+ struct rtl8192eu_efuse *efuse = &priv->efuse_wifi.efuse8192eu;
++ unsigned int record_offset;
+ int i;
+
+ if (efuse->rtl_id != cpu_to_le16(0x8129))
+@@ -612,12 +646,25 @@ static int rtl8192eu_parse_efuse(struct rtl8xxxu_priv *priv)
+ priv->has_xtalk = 1;
+ priv->xtalk = priv->efuse_wifi.efuse8192eu.xtal_k & 0x3f;
+
+- dev_info(&priv->udev->dev, "Vendor: %.7s\n", efuse->vendor_name);
+- dev_info(&priv->udev->dev, "Product: %.11s\n", efuse->device_name);
+- if (memchr_inv(efuse->serial, 0xff, 11))
+- dev_info(&priv->udev->dev, "Serial: %.11s\n", efuse->serial);
+- else
+- dev_info(&priv->udev->dev, "Serial not available.\n");
++ /*
++ * device_info section seems to be laid out as records
++ * [ total length | 0x03 | value ] so:
++ * - vendor length + 2
++ * - 0x03
++ * - vendor string (not null terminated)
++ * - product length + 2
++ * - 0x03
++ * - product string (not null terminated)
++ * Then there is one or 2 0x00 on all the 4 devices I own or found
++ * dumped online.
++ * As previous version of the code handled an optional serial
++ * string, I now assume there may be a third record if the
++ * length is not 0.
++ */
++ record_offset = 0;
++ rtl8192eu_log_next_device_info(priv, "Vendor", efuse->device_info, &record_offset);
++ rtl8192eu_log_next_device_info(priv, "Product", efuse->device_info, &record_offset);
++ rtl8192eu_log_next_device_info(priv, "Serial", efuse->device_info, &record_offset);
+
+ if (rtl8xxxu_debug & RTL8XXXU_DEBUG_EFUSE) {
+ unsigned char *raw = priv->efuse_wifi.raw;
+diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
+index 0da95777f1c15..c0301cd10209c 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
+@@ -193,7 +193,7 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb)
+ wh->frame_control |= cpu_to_le16(RSI_SET_PS_ENABLE);
+
+ if ((!(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) &&
+- (common->secinfo.security_enable)) {
++ info->control.hw_key) {
+ if (rsi_is_cipher_wep(common))
+ ieee80211_size += 4;
+ else
+@@ -464,9 +464,9 @@ int rsi_prepare_beacon(struct rsi_common *common, struct sk_buff *skb)
+ }
+
+ if (common->band == NL80211_BAND_2GHZ)
+- bcn_frm->bbp_info |= cpu_to_le16(RSI_RATE_1);
++ bcn_frm->rate_info |= cpu_to_le16(RSI_RATE_1);
+ else
+- bcn_frm->bbp_info |= cpu_to_le16(RSI_RATE_6);
++ bcn_frm->rate_info |= cpu_to_le16(RSI_RATE_6);
+
+ if (mac_bcn->data[tim_offset + 2] == 0)
+ bcn_frm->frame_info |= cpu_to_le16(RSI_DATA_DESC_DTIM_BEACON);
+diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+index be59d66585d6d..bf52091b79182 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -959,7 +959,6 @@ static int rsi_mac80211_set_key(struct ieee80211_hw *hw,
+ mutex_lock(&common->mutex);
+ switch (cmd) {
+ case SET_KEY:
+- secinfo->security_enable = true;
+ status = rsi_hal_key_config(hw, vif, key, sta);
+ if (status) {
+ mutex_unlock(&common->mutex);
+@@ -978,8 +977,6 @@ static int rsi_mac80211_set_key(struct ieee80211_hw *hw,
+ break;
+
+ case DISABLE_KEY:
+- if (vif->type == NL80211_IFTYPE_STATION)
+- secinfo->security_enable = false;
+ rsi_dbg(ERR_ZONE, "%s: RSI del key\n", __func__);
+ memset(key, 0, sizeof(struct ieee80211_key_conf));
+ status = rsi_hal_key_config(hw, vif, key, sta);
+diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+index 1a3a5235cfb8d..934550a66732c 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+@@ -1615,8 +1615,7 @@ int rsi_send_wowlan_request(struct rsi_common *common, u16 flags,
+ RSI_WIFI_MGMT_Q);
+ cmd_frame->desc.desc_dword0.frame_type = WOWLAN_CONFIG_PARAMS;
+ cmd_frame->host_sleep_status = sleep_status;
+- if (common->secinfo.security_enable &&
+- common->secinfo.gtk_cipher)
++ if (common->secinfo.gtk_cipher)
+ flags |= RSI_WOW_GTK_REKEY;
+ if (sleep_status)
+ cmd_frame->wow_flags = flags;
+diff --git a/drivers/net/wireless/rsi/rsi_main.h b/drivers/net/wireless/rsi/rsi_main.h
+index a084f224bb030..a245559abe7c8 100644
+--- a/drivers/net/wireless/rsi/rsi_main.h
++++ b/drivers/net/wireless/rsi/rsi_main.h
+@@ -147,7 +147,6 @@ enum edca_queue {
+ };
+
+ struct security_info {
+- bool security_enable;
+ u32 ptk_cipher;
+ u32 gtk_cipher;
+ };
+diff --git a/drivers/net/wireless/st/cw1200/cw1200_sdio.c b/drivers/net/wireless/st/cw1200/cw1200_sdio.c
+index 1037ec62659d7..ee86436bf152e 100644
+--- a/drivers/net/wireless/st/cw1200/cw1200_sdio.c
++++ b/drivers/net/wireless/st/cw1200/cw1200_sdio.c
+@@ -63,6 +63,7 @@ static const struct sdio_device_id cw1200_sdio_ids[] = {
+ { SDIO_DEVICE(SDIO_VENDOR_ID_STE, SDIO_DEVICE_ID_STE_CW1200) },
+ { /* end: all zeroes */ },
+ };
++MODULE_DEVICE_TABLE(sdio, cw1200_sdio_ids);
+
+ /* hwbus_ops implemetation */
+
+diff --git a/drivers/net/wireless/ti/wl1251/cmd.c b/drivers/net/wireless/ti/wl1251/cmd.c
+index 9547aea01b0fb..ea0215246c5c8 100644
+--- a/drivers/net/wireless/ti/wl1251/cmd.c
++++ b/drivers/net/wireless/ti/wl1251/cmd.c
+@@ -466,9 +466,12 @@ int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len,
+ cmd->channels[i].channel = channels[i]->hw_value;
+ }
+
+- cmd->params.ssid_len = ssid_len;
+- if (ssid)
+- memcpy(cmd->params.ssid, ssid, ssid_len);
++ if (ssid) {
++ int len = clamp_val(ssid_len, 0, IEEE80211_MAX_SSID_LEN);
++
++ cmd->params.ssid_len = len;
++ memcpy(cmd->params.ssid, ssid, len);
++ }
+
+ ret = wl1251_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd));
+ if (ret < 0) {
+diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
+index e10fff42751ef..b88c413f96aca 100644
+--- a/drivers/net/wireless/ti/wl12xx/main.c
++++ b/drivers/net/wireless/ti/wl12xx/main.c
+@@ -1517,6 +1517,13 @@ static int wl12xx_get_fuse_mac(struct wl1271 *wl)
+ u32 mac1, mac2;
+ int ret;
+
++ /* Device may be in ELP from the bootloader or kexec */
++ ret = wlcore_write32(wl, WL12XX_WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
++ if (ret < 0)
++ goto out;
++
++ usleep_range(500000, 700000);
++
+ ret = wlcore_set_partition(wl, &wl->ptable[PART_DRPW]);
+ if (ret < 0)
+ goto out;
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 800ad252cf9c6..1eb6af6439ad6 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -576,11 +576,11 @@ static int __init __reserved_mem_reserve_reg(unsigned long node,
+
+ if (size &&
+ early_init_dt_reserve_memory_arch(base, size, nomap) == 0)
+- pr_debug("Reserved memory: reserved region for node '%s': base %pa, size %ld MiB\n",
+- uname, &base, (unsigned long)size / SZ_1M);
++ pr_debug("Reserved memory: reserved region for node '%s': base %pa, size %lu MiB\n",
++ uname, &base, (unsigned long)(size / SZ_1M));
+ else
+- pr_info("Reserved memory: failed to reserve memory for node '%s': base %pa, size %ld MiB\n",
+- uname, &base, (unsigned long)size / SZ_1M);
++ pr_info("Reserved memory: failed to reserve memory for node '%s': base %pa, size %lu MiB\n",
++ uname, &base, (unsigned long)(size / SZ_1M));
+
+ len -= t_len;
+ if (first) {
+diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
+index 19f95552da4d8..ff230ee2423fb 100644
+--- a/drivers/of/of_reserved_mem.c
++++ b/drivers/of/of_reserved_mem.c
+@@ -154,9 +154,9 @@ static int __init __reserved_mem_alloc_size(unsigned long node,
+ ret = early_init_dt_alloc_reserved_memory_arch(size,
+ align, start, end, nomap, &base);
+ if (ret == 0) {
+- pr_debug("allocated memory for '%s' node: base %pa, size %ld MiB\n",
++ pr_debug("allocated memory for '%s' node: base %pa, size %lu MiB\n",
+ uname, &base,
+- (unsigned long)size / SZ_1M);
++ (unsigned long)(size / SZ_1M));
+ break;
+ }
+ len -= t_len;
+@@ -166,8 +166,8 @@ static int __init __reserved_mem_alloc_size(unsigned long node,
+ ret = early_init_dt_alloc_reserved_memory_arch(size, align,
+ 0, 0, nomap, &base);
+ if (ret == 0)
+- pr_debug("allocated memory for '%s' node: base %pa, size %ld MiB\n",
+- uname, &base, (unsigned long)size / SZ_1M);
++ pr_debug("allocated memory for '%s' node: base %pa, size %lu MiB\n",
++ uname, &base, (unsigned long)(size / SZ_1M));
+ }
+
+ if (base == 0) {
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index 0235b6e7dcd13..74aa9da85aa26 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -54,7 +54,7 @@
+ #define PIO_COMPLETION_STATUS_UR 1
+ #define PIO_COMPLETION_STATUS_CRS 2
+ #define PIO_COMPLETION_STATUS_CA 4
+-#define PIO_NON_POSTED_REQ BIT(0)
++#define PIO_NON_POSTED_REQ BIT(10)
+ #define PIO_ADDR_LS (PIO_BASE_ADDR + 0x8)
+ #define PIO_ADDR_MS (PIO_BASE_ADDR + 0xc)
+ #define PIO_WR_DATA (PIO_BASE_ADDR + 0x10)
+@@ -166,7 +166,8 @@
+ (PCIE_CONF_BUS(bus) | PCIE_CONF_DEV(PCI_SLOT(devfn)) | \
+ PCIE_CONF_FUNC(PCI_FUNC(devfn)) | PCIE_CONF_REG(where))
+
+-#define PIO_TIMEOUT_MS 1
++#define PIO_RETRY_CNT 500
++#define PIO_RETRY_DELAY 2 /* 2 us*/
+
+ #define LINK_WAIT_MAX_RETRIES 10
+ #define LINK_WAIT_USLEEP_MIN 90000
+@@ -369,20 +370,19 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie)
+ static int advk_pcie_wait_pio(struct advk_pcie *pcie)
+ {
+ struct device *dev = &pcie->pdev->dev;
+- unsigned long timeout;
++ int i;
+
+- timeout = jiffies + msecs_to_jiffies(PIO_TIMEOUT_MS);
+-
+- while (time_before(jiffies, timeout)) {
++ for (i = 0; i < PIO_RETRY_CNT; i++) {
+ u32 start, isr;
+
+ start = advk_readl(pcie, PIO_START);
+ isr = advk_readl(pcie, PIO_ISR);
+ if (!start && isr)
+ return 0;
++ udelay(PIO_RETRY_DELAY);
+ }
+
+- dev_err(dev, "config read/write timed out\n");
++ dev_err(dev, "PIO read/write transfer time out\n");
+ return -ETIMEDOUT;
+ }
+
+@@ -395,6 +395,35 @@ static bool advk_pcie_valid_device(struct advk_pcie *pcie, struct pci_bus *bus,
+ return true;
+ }
+
++static bool advk_pcie_pio_is_running(struct advk_pcie *pcie)
++{
++ struct device *dev = &pcie->pdev->dev;
++
++ /*
++ * Trying to start a new PIO transfer when previous has not completed
++ * cause External Abort on CPU which results in kernel panic:
++ *
++ * SError Interrupt on CPU0, code 0xbf000002 -- SError
++ * Kernel panic - not syncing: Asynchronous SError Interrupt
++ *
++ * Functions advk_pcie_rd_conf() and advk_pcie_wr_conf() are protected
++ * by raw_spin_lock_irqsave() at pci_lock_config() level to prevent
++ * concurrent calls at the same time. But because PIO transfer may take
++ * about 1.5s when link is down or card is disconnected, it means that
++ * advk_pcie_wait_pio() does not always have to wait for completion.
++ *
++ * Some versions of ARM Trusted Firmware handles this External Abort at
++ * EL3 level and mask it to prevent kernel panic. Relevant TF-A commit:
++ * https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=3c7dcdac5c50
++ */
++ if (advk_readl(pcie, PIO_START)) {
++ dev_err(dev, "Previous PIO read/write transfer is still running\n");
++ return true;
++ }
++
++ return false;
++}
++
+ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
+ int where, int size, u32 *val)
+ {
+@@ -407,9 +436,10 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
+ return PCIBIOS_DEVICE_NOT_FOUND;
+ }
+
+- /* Start PIO */
+- advk_writel(pcie, 0, PIO_START);
+- advk_writel(pcie, 1, PIO_ISR);
++ if (advk_pcie_pio_is_running(pcie)) {
++ *val = 0xffffffff;
++ return PCIBIOS_SET_FAILED;
++ }
+
+ /* Program the control register */
+ reg = advk_readl(pcie, PIO_CTRL);
+@@ -428,7 +458,8 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
+ /* Program the data strobe */
+ advk_writel(pcie, 0xf, PIO_WR_DATA_STRB);
+
+- /* Start the transfer */
++ /* Clear PIO DONE ISR and start the transfer */
++ advk_writel(pcie, 1, PIO_ISR);
+ advk_writel(pcie, 1, PIO_START);
+
+ ret = advk_pcie_wait_pio(pcie);
+@@ -462,9 +493,8 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
+ if (where % size)
+ return PCIBIOS_SET_FAILED;
+
+- /* Start PIO */
+- advk_writel(pcie, 0, PIO_START);
+- advk_writel(pcie, 1, PIO_ISR);
++ if (advk_pcie_pio_is_running(pcie))
++ return PCIBIOS_SET_FAILED;
+
+ /* Program the control register */
+ reg = advk_readl(pcie, PIO_CTRL);
+@@ -491,7 +521,8 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
+ /* Program the data strobe */
+ advk_writel(pcie, data_strobe, PIO_WR_DATA_STRB);
+
+- /* Start the transfer */
++ /* Clear PIO DONE ISR and start the transfer */
++ advk_writel(pcie, 1, PIO_ISR);
+ advk_writel(pcie, 1, PIO_START);
+
+ ret = advk_pcie_wait_pio(pcie);
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 097c02197ec8f..1f8dd5ca02a91 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -2245,6 +2245,7 @@ static const struct of_device_id tegra_pcie_of_match[] = {
+ { .compatible = "nvidia,tegra20-pcie", .data = &tegra20_pcie },
+ { },
+ };
++MODULE_DEVICE_TABLE(of, tegra_pcie_of_match);
+
+ static void *tegra_pcie_ports_seq_start(struct seq_file *s, loff_t *pos)
+ {
+diff --git a/drivers/pci/controller/pcie-iproc-msi.c b/drivers/pci/controller/pcie-iproc-msi.c
+index dc953c73cb56a..dc4d5a5907959 100644
+--- a/drivers/pci/controller/pcie-iproc-msi.c
++++ b/drivers/pci/controller/pcie-iproc-msi.c
+@@ -171,7 +171,7 @@ static struct irq_chip iproc_msi_irq_chip = {
+
+ static struct msi_domain_info iproc_msi_domain_info = {
+ .flags = MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
+- MSI_FLAG_MULTI_PCI_MSI | MSI_FLAG_PCI_MSIX,
++ MSI_FLAG_PCI_MSIX,
+ .chip = &iproc_msi_irq_chip,
+ };
+
+@@ -250,20 +250,23 @@ static int iproc_msi_irq_domain_alloc(struct irq_domain *domain,
+ struct iproc_msi *msi = domain->host_data;
+ int hwirq, i;
+
++ if (msi->nr_cpus > 1 && nr_irqs > 1)
++ return -EINVAL;
++
+ mutex_lock(&msi->bitmap_lock);
+
+- /* Allocate 'nr_cpus' number of MSI vectors each time */
+- hwirq = bitmap_find_next_zero_area(msi->bitmap, msi->nr_msi_vecs, 0,
+- msi->nr_cpus, 0);
+- if (hwirq < msi->nr_msi_vecs) {
+- bitmap_set(msi->bitmap, hwirq, msi->nr_cpus);
+- } else {
+- mutex_unlock(&msi->bitmap_lock);
+- return -ENOSPC;
+- }
++ /*
++ * Allocate 'nr_irqs' multiplied by 'nr_cpus' number of MSI vectors
++ * each time
++ */
++ hwirq = bitmap_find_free_region(msi->bitmap, msi->nr_msi_vecs,
++ order_base_2(msi->nr_cpus * nr_irqs));
+
+ mutex_unlock(&msi->bitmap_lock);
+
++ if (hwirq < 0)
++ return -ENOSPC;
++
+ for (i = 0; i < nr_irqs; i++) {
+ irq_domain_set_info(domain, virq + i, hwirq + i,
+ &iproc_msi_bottom_irq_chip,
+@@ -284,7 +287,8 @@ static void iproc_msi_irq_domain_free(struct irq_domain *domain,
+ mutex_lock(&msi->bitmap_lock);
+
+ hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq);
+- bitmap_clear(msi->bitmap, hwirq, msi->nr_cpus);
++ bitmap_release_region(msi->bitmap, hwirq,
++ order_base_2(msi->nr_cpus * nr_irqs));
+
+ mutex_unlock(&msi->bitmap_lock);
+
+@@ -538,6 +542,9 @@ int iproc_msi_init(struct iproc_pcie *pcie, struct device_node *node)
+ mutex_init(&msi->bitmap_lock);
+ msi->nr_cpus = num_possible_cpus();
+
++ if (msi->nr_cpus == 1)
++ iproc_msi_domain_info.flags |= MSI_FLAG_MULTI_PCI_MSI;
++
+ msi->nr_irqs = of_irq_count(node);
+ if (!msi->nr_irqs) {
+ dev_err(pcie->dev, "found no MSI GIC interrupt\n");
+diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c
+index a5910f9428576..9fb4ef568f405 100644
+--- a/drivers/pci/pci-label.c
++++ b/drivers/pci/pci-label.c
+@@ -162,7 +162,7 @@ static void dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf)
+ len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer,
+ obj->buffer.length,
+ UTF16_LITTLE_ENDIAN,
+- buf, PAGE_SIZE);
++ buf, PAGE_SIZE - 1);
+ buf[len] = '\n';
+ }
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 576b5bb6b95f2..bfb22de693eb4 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -28,6 +28,7 @@
+ #include <linux/nvme.h>
+ #include <linux/platform_data/x86/apple.h>
+ #include <linux/pm_runtime.h>
++#include <linux/suspend.h>
+ #include <linux/switchtec.h>
+ #include <asm/dma.h> /* isa_dma_bridge_buggy */
+ #include "pci.h"
+@@ -3573,6 +3574,16 @@ static void quirk_apple_poweroff_thunderbolt(struct pci_dev *dev)
+ return;
+ if (pci_pcie_type(dev) != PCI_EXP_TYPE_UPSTREAM)
+ return;
++
++ /*
++ * SXIO/SXFP/SXLF turns off power to the Thunderbolt controller.
++ * We don't know how to turn it back on again, but firmware does,
++ * so we can only use SXIO/SXFP/SXLF if we're suspending via
++ * firmware.
++ */
++ if (!pm_suspend_via_firmware())
++ return;
++
+ bridge = ACPI_HANDLE(&dev->dev);
+ if (!bridge)
+ return;
+diff --git a/drivers/phy/ti/phy-dm816x-usb.c b/drivers/phy/ti/phy-dm816x-usb.c
+index cbcce7cf0028e..2ed5fe20d7792 100644
+--- a/drivers/phy/ti/phy-dm816x-usb.c
++++ b/drivers/phy/ti/phy-dm816x-usb.c
+@@ -246,19 +246,28 @@ static int dm816x_usb_phy_probe(struct platform_device *pdev)
+
+ pm_runtime_enable(phy->dev);
+ generic_phy = devm_phy_create(phy->dev, NULL, &ops);
+- if (IS_ERR(generic_phy))
+- return PTR_ERR(generic_phy);
++ if (IS_ERR(generic_phy)) {
++ error = PTR_ERR(generic_phy);
++ goto clk_unprepare;
++ }
+
+ phy_set_drvdata(generic_phy, phy);
+
+ phy_provider = devm_of_phy_provider_register(phy->dev,
+ of_phy_simple_xlate);
+- if (IS_ERR(phy_provider))
+- return PTR_ERR(phy_provider);
++ if (IS_ERR(phy_provider)) {
++ error = PTR_ERR(phy_provider);
++ goto clk_unprepare;
++ }
+
+ usb_add_phy_dev(&phy->phy);
+
+ return 0;
++
++clk_unprepare:
++ pm_runtime_disable(phy->dev);
++ clk_unprepare(phy->refclk);
++ return error;
+ }
+
+ static int dm816x_usb_phy_remove(struct platform_device *pdev)
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index d9b9c11c7f8f2..8d2dbf607bd15 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -966,6 +966,7 @@ static int amd_gpio_remove(struct platform_device *pdev)
+ static const struct acpi_device_id amd_gpio_acpi_match[] = {
+ { "AMD0030", 0 },
+ { "AMDI0030", 0},
++ { "AMDI0031", 0},
+ { },
+ };
+ MODULE_DEVICE_TABLE(acpi, amd_gpio_acpi_match);
+diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
+index 5b5a4323ae63d..76d8a6099c7b1 100644
+--- a/drivers/pinctrl/pinctrl-mcp23s08.c
++++ b/drivers/pinctrl/pinctrl-mcp23s08.c
+@@ -458,6 +458,11 @@ static irqreturn_t mcp23s08_irq(int irq, void *data)
+ if (mcp_read(mcp, MCP_INTF, &intf))
+ goto unlock;
+
++ if (intf == 0) {
++ /* There is no interrupt pending */
++ goto unlock;
++ }
++
+ if (mcp_read(mcp, MCP_INTCAP, &intcap))
+ goto unlock;
+
+@@ -475,11 +480,6 @@ static irqreturn_t mcp23s08_irq(int irq, void *data)
+ mcp->cached_gpio = gpio;
+ mutex_unlock(&mcp->lock);
+
+- if (intf == 0) {
+- /* There is no interrupt pending */
+- return IRQ_HANDLED;
+- }
+-
+ dev_dbg(mcp->chip.parent,
+ "intcap 0x%04X intf 0x%04X gpio_orig 0x%04X gpio 0x%04X\n",
+ intcap, intf, gpio_orig, gpio);
+diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
+index 8c3e9bac4754c..bed2fd56a6d09 100644
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -2853,6 +2853,7 @@ static int toshiba_acpi_setup_keyboard(struct toshiba_acpi_dev *dev)
+
+ if (!dev->info_supported && !dev->system_event_supported) {
+ pr_warn("No hotkey query interface found\n");
++ error = -EINVAL;
+ goto err_remove_filter;
+ }
+
+diff --git a/drivers/power/reset/gpio-poweroff.c b/drivers/power/reset/gpio-poweroff.c
+index 38206c39b3bff..5f2fa9c0f526f 100644
+--- a/drivers/power/reset/gpio-poweroff.c
++++ b/drivers/power/reset/gpio-poweroff.c
+@@ -88,6 +88,7 @@ static const struct of_device_id of_gpio_poweroff_match[] = {
+ { .compatible = "gpio-poweroff", },
+ {},
+ };
++MODULE_DEVICE_TABLE(of, of_gpio_poweroff_match);
+
+ static struct platform_driver gpio_poweroff_driver = {
+ .probe = gpio_poweroff_probe,
+diff --git a/drivers/power/supply/Kconfig b/drivers/power/supply/Kconfig
+index 76c699b5abdac..1d656aa2c6d64 100644
+--- a/drivers/power/supply/Kconfig
++++ b/drivers/power/supply/Kconfig
+@@ -621,7 +621,8 @@ config BATTERY_GOLDFISH
+
+ config BATTERY_RT5033
+ tristate "RT5033 fuel gauge support"
+- depends on MFD_RT5033
++ depends on I2C
++ select REGMAP_I2C
+ help
+ This adds support for battery fuel gauge in Richtek RT5033 PMIC.
+ The fuelgauge calculates and determines the battery state of charge
+diff --git a/drivers/power/supply/ab8500_btemp.c b/drivers/power/supply/ab8500_btemp.c
+index 708fd58cd62b2..0fd24577112eb 100644
+--- a/drivers/power/supply/ab8500_btemp.c
++++ b/drivers/power/supply/ab8500_btemp.c
+@@ -1120,6 +1120,7 @@ static const struct of_device_id ab8500_btemp_match[] = {
+ { .compatible = "stericsson,ab8500-btemp", },
+ { },
+ };
++MODULE_DEVICE_TABLE(of, ab8500_btemp_match);
+
+ static struct platform_driver ab8500_btemp_driver = {
+ .probe = ab8500_btemp_probe,
+diff --git a/drivers/power/supply/ab8500_charger.c b/drivers/power/supply/ab8500_charger.c
+index 98b335042ba6b..0f379fa3385e6 100644
+--- a/drivers/power/supply/ab8500_charger.c
++++ b/drivers/power/supply/ab8500_charger.c
+@@ -407,6 +407,14 @@ disable_otp:
+ static void ab8500_power_supply_changed(struct ab8500_charger *di,
+ struct power_supply *psy)
+ {
++ /*
++ * This happens if we get notifications or interrupts and
++ * the platform has been configured not to support one or
++ * other type of charging.
++ */
++ if (!psy)
++ return;
++
+ if (di->autopower_cfg) {
+ if (!di->usb.charger_connected &&
+ !di->ac.charger_connected &&
+@@ -433,7 +441,15 @@ static void ab8500_charger_set_usb_connected(struct ab8500_charger *di,
+ if (!connected)
+ di->flags.vbus_drop_end = false;
+
+- sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL, "present");
++ /*
++ * Sometimes the platform is configured not to support
++ * USB charging and no psy has been created, but we still
++ * will get these notifications.
++ */
++ if (di->usb_chg.psy) {
++ sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL,
++ "present");
++ }
+
+ if (connected) {
+ mutex_lock(&di->charger_attached_mutex);
+@@ -3623,6 +3639,7 @@ static const struct of_device_id ab8500_charger_match[] = {
+ { .compatible = "stericsson,ab8500-charger", },
+ { },
+ };
++MODULE_DEVICE_TABLE(of, ab8500_charger_match);
+
+ static struct platform_driver ab8500_charger_driver = {
+ .probe = ab8500_charger_probe,
+diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
+index 8bb89c697c1eb..b0e77324b0167 100644
+--- a/drivers/power/supply/ab8500_fg.c
++++ b/drivers/power/supply/ab8500_fg.c
+@@ -3221,6 +3221,7 @@ static const struct of_device_id ab8500_fg_match[] = {
+ { .compatible = "stericsson,ab8500-fg", },
+ { },
+ };
++MODULE_DEVICE_TABLE(of, ab8500_fg_match);
+
+ static struct platform_driver ab8500_fg_driver = {
+ .probe = ab8500_fg_probe,
+diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c
+index 7ae983e37f648..eec79db9b750e 100644
+--- a/drivers/power/supply/charger-manager.c
++++ b/drivers/power/supply/charger-manager.c
+@@ -1484,6 +1484,7 @@ static const struct of_device_id charger_manager_match[] = {
+ },
+ {},
+ };
++MODULE_DEVICE_TABLE(of, charger_manager_match);
+
+ static struct charger_desc *of_cm_parse_desc(struct device *dev)
+ {
+diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
+index 1a568df383db8..00a3a581e0795 100644
+--- a/drivers/power/supply/max17042_battery.c
++++ b/drivers/power/supply/max17042_battery.c
+@@ -1083,7 +1083,7 @@ static int max17042_probe(struct i2c_client *client,
+ }
+
+ if (client->irq) {
+- unsigned int flags = IRQF_TRIGGER_FALLING | IRQF_ONESHOT;
++ unsigned int flags = IRQF_ONESHOT;
+
+ /*
+ * On ACPI systems the IRQ may be handled by ACPI-event code,
+diff --git a/drivers/power/supply/rt5033_battery.c b/drivers/power/supply/rt5033_battery.c
+index bcdd830484929..9310b85f3405e 100644
+--- a/drivers/power/supply/rt5033_battery.c
++++ b/drivers/power/supply/rt5033_battery.c
+@@ -167,9 +167,16 @@ static const struct i2c_device_id rt5033_battery_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, rt5033_battery_id);
+
++static const struct of_device_id rt5033_battery_of_match[] = {
++ { .compatible = "richtek,rt5033-battery", },
++ { }
++};
++MODULE_DEVICE_TABLE(of, rt5033_battery_of_match);
++
+ static struct i2c_driver rt5033_battery_driver = {
+ .driver = {
+ .name = "rt5033-battery",
++ .of_match_table = rt5033_battery_of_match,
+ },
+ .probe = rt5033_battery_probe,
+ .remove = rt5033_battery_remove,
+diff --git a/drivers/pwm/pwm-spear.c b/drivers/pwm/pwm-spear.c
+index 6c6b44fd3f438..2d11ac277de8d 100644
+--- a/drivers/pwm/pwm-spear.c
++++ b/drivers/pwm/pwm-spear.c
+@@ -231,10 +231,6 @@ static int spear_pwm_probe(struct platform_device *pdev)
+ static int spear_pwm_remove(struct platform_device *pdev)
+ {
+ struct spear_pwm_chip *pc = platform_get_drvdata(pdev);
+- int i;
+-
+- for (i = 0; i < NUM_PWM; i++)
+- pwm_disable(&pc->chip.pwms[i]);
+
+ /* clk was prepared in probe, hence unprepare it here */
+ clk_unprepare(pc->clk);
+diff --git a/drivers/pwm/pwm-tegra.c b/drivers/pwm/pwm-tegra.c
+index f8ebbece57b71..6be14e0f1dc34 100644
+--- a/drivers/pwm/pwm-tegra.c
++++ b/drivers/pwm/pwm-tegra.c
+@@ -245,7 +245,6 @@ static int tegra_pwm_probe(struct platform_device *pdev)
+ static int tegra_pwm_remove(struct platform_device *pdev)
+ {
+ struct tegra_pwm_chip *pc = platform_get_drvdata(pdev);
+- unsigned int i;
+ int err;
+
+ if (WARN_ON(!pc))
+@@ -255,18 +254,6 @@ static int tegra_pwm_remove(struct platform_device *pdev)
+ if (err < 0)
+ return err;
+
+- for (i = 0; i < pc->chip.npwm; i++) {
+- struct pwm_device *pwm = &pc->chip.pwms[i];
+-
+- if (!pwm_is_enabled(pwm))
+- if (clk_prepare_enable(pc->clk) < 0)
+- continue;
+-
+- pwm_writel(pc, i, 0);
+-
+- clk_disable_unprepare(pc->clk);
+- }
+-
+ reset_control_assert(pc->rst);
+ clk_disable_unprepare(pc->clk);
+
+diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c
+index 9ececfef42d67..bd91c95f73e0e 100644
+--- a/drivers/regulator/da9052-regulator.c
++++ b/drivers/regulator/da9052-regulator.c
+@@ -258,7 +258,8 @@ static int da9052_regulator_set_voltage_time_sel(struct regulator_dev *rdev,
+ case DA9052_ID_BUCK3:
+ case DA9052_ID_LDO2:
+ case DA9052_ID_LDO3:
+- ret = (new_sel - old_sel) * info->step_uV / 6250;
++ ret = DIV_ROUND_UP(abs(new_sel - old_sel) * info->step_uV,
++ 6250);
+ break;
+ }
+
+diff --git a/drivers/regulator/uniphier-regulator.c b/drivers/regulator/uniphier-regulator.c
+index abf22acbd13e6..a2e3654b63320 100644
+--- a/drivers/regulator/uniphier-regulator.c
++++ b/drivers/regulator/uniphier-regulator.c
+@@ -197,6 +197,7 @@ static const struct of_device_id uniphier_regulator_match[] = {
+ },
+ { /* Sentinel */ },
+ };
++MODULE_DEVICE_TABLE(of, uniphier_regulator_match);
+
+ static struct platform_driver uniphier_regulator_driver = {
+ .probe = uniphier_regulator_probe,
+diff --git a/drivers/reset/core.c b/drivers/reset/core.c
+index f7bf20493f23e..ccb97f4e31c38 100644
+--- a/drivers/reset/core.c
++++ b/drivers/reset/core.c
+@@ -428,7 +428,10 @@ static struct reset_control *__reset_control_get_internal(
+ if (!rstc)
+ return ERR_PTR(-ENOMEM);
+
+- try_module_get(rcdev->owner);
++ if (!try_module_get(rcdev->owner)) {
++ kfree(rstc);
++ return ERR_PTR(-ENODEV);
++ }
+
+ rstc->rcdev = rcdev;
+ list_add(&rstc->list, &rcdev->reset_control_head);
+diff --git a/drivers/reset/reset-a10sr.c b/drivers/reset/reset-a10sr.c
+index 37496bd27fa2e..306fba5b35193 100644
+--- a/drivers/reset/reset-a10sr.c
++++ b/drivers/reset/reset-a10sr.c
+@@ -129,6 +129,7 @@ static struct platform_driver a10sr_reset_driver = {
+ .probe = a10sr_reset_probe,
+ .driver = {
+ .name = "altr_a10sr_reset",
++ .of_match_table = a10sr_reset_of_match,
+ },
+ };
+ module_platform_driver(a10sr_reset_driver);
+diff --git a/drivers/rtc/rtc-proc.c b/drivers/rtc/rtc-proc.c
+index a9dd9218fae21..b8c5b93102ce9 100644
+--- a/drivers/rtc/rtc-proc.c
++++ b/drivers/rtc/rtc-proc.c
+@@ -26,8 +26,8 @@ static bool is_rtc_hctosys(struct rtc_device *rtc)
+ int size;
+ char name[NAME_SIZE];
+
+- size = scnprintf(name, NAME_SIZE, "rtc%d", rtc->id);
+- if (size > NAME_SIZE)
++ size = snprintf(name, NAME_SIZE, "rtc%d", rtc->id);
++ if (size >= NAME_SIZE)
+ return false;
+
+ return !strncmp(name, CONFIG_RTC_HCTOSYS_DEVICE, NAME_SIZE);
+diff --git a/drivers/rtc/rtc-stm32.c b/drivers/rtc/rtc-stm32.c
+index 8e6c9b3bcc29a..04bffc913ba1b 100644
+--- a/drivers/rtc/rtc-stm32.c
++++ b/drivers/rtc/rtc-stm32.c
+@@ -760,7 +760,7 @@ static int stm32_rtc_probe(struct platform_device *pdev)
+
+ ret = clk_prepare_enable(rtc->rtc_ck);
+ if (ret)
+- goto err;
++ goto err_no_rtc_ck;
+
+ if (rtc->data->need_dbp)
+ regmap_update_bits(rtc->dbp, rtc->dbp_reg,
+@@ -837,10 +837,12 @@ static int stm32_rtc_probe(struct platform_device *pdev)
+ }
+
+ return 0;
++
+ err:
++ clk_disable_unprepare(rtc->rtc_ck);
++err_no_rtc_ck:
+ if (rtc->data->has_pclk)
+ clk_disable_unprepare(rtc->pclk);
+- clk_disable_unprepare(rtc->rtc_ck);
+
+ if (rtc->data->need_dbp)
+ regmap_update_bits(rtc->dbp, rtc->dbp_reg, rtc->dbp_mask, 0);
+diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
+index 3f9a6ef650fac..3c2ed6d013873 100644
+--- a/drivers/s390/char/sclp_vt220.c
++++ b/drivers/s390/char/sclp_vt220.c
+@@ -35,8 +35,8 @@
+ #define SCLP_VT220_MINOR 65
+ #define SCLP_VT220_DRIVER_NAME "sclp_vt220"
+ #define SCLP_VT220_DEVICE_NAME "ttysclp"
+-#define SCLP_VT220_CONSOLE_NAME "ttyS"
+-#define SCLP_VT220_CONSOLE_INDEX 1 /* console=ttyS1 */
++#define SCLP_VT220_CONSOLE_NAME "ttysclp"
++#define SCLP_VT220_CONSOLE_INDEX 0 /* console=ttysclp0 */
+
+ /* Representation of a single write request */
+ struct sclp_vt220_request {
+diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c
+index 51038ec309c12..1fd982b4d64bd 100644
+--- a/drivers/s390/cio/chp.c
++++ b/drivers/s390/cio/chp.c
+@@ -255,6 +255,9 @@ static ssize_t chp_status_write(struct device *dev,
+ if (!num_args)
+ return count;
+
++ /* Wait until previous actions have settled. */
++ css_wait_for_slow_path();
++
+ if (!strncasecmp(cmd, "on", 2) || !strcmp(cmd, "1")) {
+ mutex_lock(&cp->lock);
+ error = s390_vary_chpid(cp->chpid, 1);
+diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
+index a0baee25134c0..3f03163c7a58c 100644
+--- a/drivers/s390/cio/chsc.c
++++ b/drivers/s390/cio/chsc.c
+@@ -770,8 +770,6 @@ int chsc_chp_vary(struct chp_id chpid, int on)
+ {
+ struct channel_path *chp = chpid_to_chp(chpid);
+
+- /* Wait until previous actions have settled. */
+- css_wait_for_slow_path();
+ /*
+ * Redo PathVerification on the devices the chpid connects to
+ */
+diff --git a/drivers/scsi/FlashPoint.c b/drivers/scsi/FlashPoint.c
+index 867b864f50479..4bca37d52bad8 100644
+--- a/drivers/scsi/FlashPoint.c
++++ b/drivers/scsi/FlashPoint.c
+@@ -40,7 +40,7 @@ struct sccb_mgr_info {
+ u16 si_per_targ_ultra_nego;
+ u16 si_per_targ_no_disc;
+ u16 si_per_targ_wide_nego;
+- u16 si_flags;
++ u16 si_mflags;
+ unsigned char si_card_family;
+ unsigned char si_bustype;
+ unsigned char si_card_model[3];
+@@ -1070,22 +1070,22 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo)
+ ScamFlg =
+ (unsigned char)FPT_utilEERead(ioport, SCAM_CONFIG / 2);
+
+- pCardInfo->si_flags = 0x0000;
++ pCardInfo->si_mflags = 0x0000;
+
+ if (i & 0x01)
+- pCardInfo->si_flags |= SCSI_PARITY_ENA;
++ pCardInfo->si_mflags |= SCSI_PARITY_ENA;
+
+ if (!(i & 0x02))
+- pCardInfo->si_flags |= SOFT_RESET;
++ pCardInfo->si_mflags |= SOFT_RESET;
+
+ if (i & 0x10)
+- pCardInfo->si_flags |= EXTENDED_TRANSLATION;
++ pCardInfo->si_mflags |= EXTENDED_TRANSLATION;
+
+ if (ScamFlg & SCAM_ENABLED)
+- pCardInfo->si_flags |= FLAG_SCAM_ENABLED;
++ pCardInfo->si_mflags |= FLAG_SCAM_ENABLED;
+
+ if (ScamFlg & SCAM_LEVEL2)
+- pCardInfo->si_flags |= FLAG_SCAM_LEVEL2;
++ pCardInfo->si_mflags |= FLAG_SCAM_LEVEL2;
+
+ j = (RD_HARPOON(ioport + hp_bm_ctrl) & ~SCSI_TERM_ENA_L);
+ if (i & 0x04) {
+@@ -1101,7 +1101,7 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo)
+
+ if (!(RD_HARPOON(ioport + hp_page_ctrl) & NARROW_SCSI_CARD))
+
+- pCardInfo->si_flags |= SUPPORT_16TAR_32LUN;
++ pCardInfo->si_mflags |= SUPPORT_16TAR_32LUN;
+
+ pCardInfo->si_card_family = HARPOON_FAMILY;
+ pCardInfo->si_bustype = BUSTYPE_PCI;
+@@ -1137,15 +1137,15 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo)
+
+ if (pCardInfo->si_card_model[1] == '3') {
+ if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7))
+- pCardInfo->si_flags |= LOW_BYTE_TERM;
++ pCardInfo->si_mflags |= LOW_BYTE_TERM;
+ } else if (pCardInfo->si_card_model[2] == '0') {
+ temp = RD_HARPOON(ioport + hp_xfer_pad);
+ WR_HARPOON(ioport + hp_xfer_pad, (temp & ~BIT(4)));
+ if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7))
+- pCardInfo->si_flags |= LOW_BYTE_TERM;
++ pCardInfo->si_mflags |= LOW_BYTE_TERM;
+ WR_HARPOON(ioport + hp_xfer_pad, (temp | BIT(4)));
+ if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7))
+- pCardInfo->si_flags |= HIGH_BYTE_TERM;
++ pCardInfo->si_mflags |= HIGH_BYTE_TERM;
+ WR_HARPOON(ioport + hp_xfer_pad, temp);
+ } else {
+ temp = RD_HARPOON(ioport + hp_ee_ctrl);
+@@ -1163,9 +1163,9 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo)
+ WR_HARPOON(ioport + hp_ee_ctrl, temp);
+ WR_HARPOON(ioport + hp_xfer_pad, temp2);
+ if (!(temp3 & BIT(7)))
+- pCardInfo->si_flags |= LOW_BYTE_TERM;
++ pCardInfo->si_mflags |= LOW_BYTE_TERM;
+ if (!(temp3 & BIT(6)))
+- pCardInfo->si_flags |= HIGH_BYTE_TERM;
++ pCardInfo->si_mflags |= HIGH_BYTE_TERM;
+ }
+
+ ARAM_ACCESS(ioport);
+@@ -1272,7 +1272,7 @@ static void *FlashPoint_HardwareResetHostAdapter(struct sccb_mgr_info
+ WR_HARPOON(ioport + hp_arb_id, pCardInfo->si_id);
+ CurrCard->ourId = pCardInfo->si_id;
+
+- i = (unsigned char)pCardInfo->si_flags;
++ i = (unsigned char)pCardInfo->si_mflags;
+ if (i & SCSI_PARITY_ENA)
+ WR_HARPOON(ioport + hp_portctrl_1, (HOST_MODE8 | CHK_SCSI_P));
+
+@@ -1286,14 +1286,14 @@ static void *FlashPoint_HardwareResetHostAdapter(struct sccb_mgr_info
+ j |= SCSI_TERM_ENA_H;
+ WR_HARPOON(ioport + hp_ee_ctrl, j);
+
+- if (!(pCardInfo->si_flags & SOFT_RESET)) {
++ if (!(pCardInfo->si_mflags & SOFT_RESET)) {
+
+ FPT_sresb(ioport, thisCard);
+
+ FPT_scini(thisCard, pCardInfo->si_id, 0);
+ }
+
+- if (pCardInfo->si_flags & POST_ALL_UNDERRRUNS)
++ if (pCardInfo->si_mflags & POST_ALL_UNDERRRUNS)
+ CurrCard->globalFlags |= F_NO_FILTER;
+
+ if (pCurrNvRam) {
+diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
+index 3660059784f74..50e9b4b683574 100644
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -423,7 +423,7 @@ static struct beiscsi_hba *beiscsi_hba_alloc(struct pci_dev *pcidev)
+ "beiscsi_hba_alloc - iscsi_host_alloc failed\n");
+ return NULL;
+ }
+- shost->max_id = BE2_MAX_SESSIONS;
++ shost->max_id = BE2_MAX_SESSIONS - 1;
+ shost->max_channel = 0;
+ shost->max_cmd_len = BEISCSI_MAX_CMD_LEN;
+ shost->max_lun = BEISCSI_NUM_MAX_LUN;
+@@ -5336,7 +5336,7 @@ static int beiscsi_enable_port(struct beiscsi_hba *phba)
+ /* Re-enable UER. If different TPE occurs then it is recoverable. */
+ beiscsi_set_uer_feature(phba);
+
+- phba->shost->max_id = phba->params.cxns_per_ctrl;
++ phba->shost->max_id = phba->params.cxns_per_ctrl - 1;
+ phba->shost->can_queue = phba->params.ios_per_ctrl;
+ ret = beiscsi_init_port(phba);
+ if (ret < 0) {
+@@ -5764,6 +5764,7 @@ free_hba:
+ pci_disable_msix(phba->pcidev);
+ pci_dev_put(phba->pcidev);
+ iscsi_host_free(phba->shost);
++ pci_disable_pcie_error_reporting(pcidev);
+ pci_set_drvdata(pcidev, NULL);
+ disable_pci:
+ pci_release_regions(pcidev);
+diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+index 718a0335cfbb3..9a5795d5a347b 100644
+--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+@@ -793,7 +793,7 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct cnic_dev *cnic)
+ return NULL;
+ shost->dma_boundary = cnic->pcidev->dma_mask;
+ shost->transportt = bnx2i_scsi_xport_template;
+- shost->max_id = ISCSI_MAX_CONNS_PER_HBA;
++ shost->max_id = ISCSI_MAX_CONNS_PER_HBA - 1;
+ shost->max_channel = 0;
+ shost->max_lun = 512;
+ shost->max_cmd_len = 16;
+diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
+index 559d8bda4cca7..01f5ebee32293 100644
+--- a/drivers/scsi/cxgbi/libcxgbi.c
++++ b/drivers/scsi/cxgbi/libcxgbi.c
+@@ -339,7 +339,7 @@ void cxgbi_hbas_remove(struct cxgbi_device *cdev)
+ EXPORT_SYMBOL_GPL(cxgbi_hbas_remove);
+
+ int cxgbi_hbas_add(struct cxgbi_device *cdev, u64 max_lun,
+- unsigned int max_id, struct scsi_host_template *sht,
++ unsigned int max_conns, struct scsi_host_template *sht,
+ struct scsi_transport_template *stt)
+ {
+ struct cxgbi_hba *chba;
+@@ -359,7 +359,7 @@ int cxgbi_hbas_add(struct cxgbi_device *cdev, u64 max_lun,
+
+ shost->transportt = stt;
+ shost->max_lun = max_lun;
+- shost->max_id = max_id;
++ shost->max_id = max_conns - 1;
+ shost->max_channel = 0;
+ shost->max_cmd_len = 16;
+
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index efd2b43125286..4cf7c3348bffe 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -522,7 +522,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ struct alua_port_group *tmp_pg;
+ int len, k, off, bufflen = ALUA_RTPG_SIZE;
+ unsigned char *desc, *buff;
+- unsigned err, retval;
++ unsigned err;
++ int retval;
+ unsigned int tpg_desc_tbl_off;
+ unsigned char orig_transition_tmo;
+ unsigned long flags;
+@@ -562,12 +563,12 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ kfree(buff);
+ return SCSI_DH_OK;
+ }
+- if (!scsi_sense_valid(&sense_hdr)) {
++ if (retval < 0 || !scsi_sense_valid(&sense_hdr)) {
+ sdev_printk(KERN_INFO, sdev,
+ "%s: rtpg failed, result %d\n",
+ ALUA_DH_NAME, retval);
+ kfree(buff);
+- if (driver_byte(retval) == DRIVER_ERROR)
++ if (retval < 0)
+ return SCSI_DH_DEV_TEMP_BUSY;
+ return SCSI_DH_IO;
+ }
+@@ -789,11 +790,11 @@ static unsigned alua_stpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ retval = submit_stpg(sdev, pg->group_id, &sense_hdr);
+
+ if (retval) {
+- if (!scsi_sense_valid(&sense_hdr)) {
++ if (retval < 0 || !scsi_sense_valid(&sense_hdr)) {
+ sdev_printk(KERN_INFO, sdev,
+ "%s: stpg failed, result %d",
+ ALUA_DH_NAME, retval);
+- if (driver_byte(retval) == DRIVER_ERROR)
++ if (retval < 0)
+ return SCSI_DH_DEV_TEMP_BUSY;
+ } else {
+ sdev_printk(KERN_INFO, sdev, "%s: stpg failed\n",
+diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
+index fa03be813f2cb..f3194d634f7f2 100644
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -218,6 +218,9 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
+ goto fail;
+ }
+
++ shost->cmd_per_lun = min_t(short, shost->cmd_per_lun,
++ shost->can_queue);
++
+ error = scsi_init_sense_cache(shost);
+ if (error)
+ goto fail;
+@@ -497,6 +500,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
+ shost_printk(KERN_WARNING, shost,
+ "error handler thread failed to spawn, error = %ld\n",
+ PTR_ERR(shost->ehandler));
++ shost->ehandler = NULL;
+ goto fail;
+ }
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 81471c3049916..5607fe8541c3a 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -259,11 +259,11 @@ static int iscsi_prep_bidi_ahs(struct iscsi_task *task)
+ */
+ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
+ {
+- struct iscsi_conn *conn = task->conn;
+- struct iscsi_tm *tmf = &conn->tmhdr;
++ struct iscsi_session *session = task->conn->session;
++ struct iscsi_tm *tmf = &session->tmhdr;
+ u64 hdr_lun;
+
+- if (conn->tmf_state == TMF_INITIAL)
++ if (session->tmf_state == TMF_INITIAL)
+ return 0;
+
+ if ((tmf->opcode & ISCSI_OPCODE_MASK) != ISCSI_OP_SCSI_TMFUNC)
+@@ -283,24 +283,19 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
+ * Fail all SCSI cmd PDUs
+ */
+ if (opcode != ISCSI_OP_SCSI_DATA_OUT) {
+- iscsi_conn_printk(KERN_INFO, conn,
+- "task [op %x itt "
+- "0x%x/0x%x] "
+- "rejected.\n",
+- opcode, task->itt,
+- task->hdr_itt);
++ iscsi_session_printk(KERN_INFO, session,
++ "task [op %x itt 0x%x/0x%x] rejected.\n",
++ opcode, task->itt, task->hdr_itt);
+ return -EACCES;
+ }
+ /*
+ * And also all data-out PDUs in response to R2T
+ * if fast_abort is set.
+ */
+- if (conn->session->fast_abort) {
+- iscsi_conn_printk(KERN_INFO, conn,
+- "task [op %x itt "
+- "0x%x/0x%x] fast abort.\n",
+- opcode, task->itt,
+- task->hdr_itt);
++ if (session->fast_abort) {
++ iscsi_session_printk(KERN_INFO, session,
++ "task [op %x itt 0x%x/0x%x] fast abort.\n",
++ opcode, task->itt, task->hdr_itt);
+ return -EACCES;
+ }
+ break;
+@@ -313,7 +308,7 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
+ */
+ if (opcode == ISCSI_OP_SCSI_DATA_OUT &&
+ task->hdr_itt == tmf->rtt) {
+- ISCSI_DBG_SESSION(conn->session,
++ ISCSI_DBG_SESSION(session,
+ "Preventing task %x/%x from sending "
+ "data-out due to abort task in "
+ "progress\n", task->itt,
+@@ -970,20 +965,21 @@ iscsi_data_in_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+ static void iscsi_tmf_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr)
+ {
+ struct iscsi_tm_rsp *tmf = (struct iscsi_tm_rsp *)hdr;
++ struct iscsi_session *session = conn->session;
+
+ conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
+ conn->tmfrsp_pdus_cnt++;
+
+- if (conn->tmf_state != TMF_QUEUED)
++ if (session->tmf_state != TMF_QUEUED)
+ return;
+
+ if (tmf->response == ISCSI_TMF_RSP_COMPLETE)
+- conn->tmf_state = TMF_SUCCESS;
++ session->tmf_state = TMF_SUCCESS;
+ else if (tmf->response == ISCSI_TMF_RSP_NO_TASK)
+- conn->tmf_state = TMF_NOT_FOUND;
++ session->tmf_state = TMF_NOT_FOUND;
+ else
+- conn->tmf_state = TMF_FAILED;
+- wake_up(&conn->ehwait);
++ session->tmf_state = TMF_FAILED;
++ wake_up(&session->ehwait);
+ }
+
+ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+@@ -1385,7 +1381,6 @@ void iscsi_session_failure(struct iscsi_session *session,
+ enum iscsi_err err)
+ {
+ struct iscsi_conn *conn;
+- struct device *dev;
+
+ spin_lock_bh(&session->frwd_lock);
+ conn = session->leadconn;
+@@ -1394,10 +1389,8 @@ void iscsi_session_failure(struct iscsi_session *session,
+ return;
+ }
+
+- dev = get_device(&conn->cls_conn->dev);
++ iscsi_get_conn(conn->cls_conn);
+ spin_unlock_bh(&session->frwd_lock);
+- if (!dev)
+- return;
+ /*
+ * if the host is being removed bypass the connection
+ * recovery initialization because we are going to kill
+@@ -1407,7 +1400,7 @@ void iscsi_session_failure(struct iscsi_session *session,
+ iscsi_conn_error_event(conn->cls_conn, err);
+ else
+ iscsi_conn_failure(conn, err);
+- put_device(dev);
++ iscsi_put_conn(conn->cls_conn);
+ }
+ EXPORT_SYMBOL_GPL(iscsi_session_failure);
+
+@@ -1825,15 +1818,14 @@ EXPORT_SYMBOL_GPL(iscsi_target_alloc);
+
+ static void iscsi_tmf_timedout(struct timer_list *t)
+ {
+- struct iscsi_conn *conn = from_timer(conn, t, tmf_timer);
+- struct iscsi_session *session = conn->session;
++ struct iscsi_session *session = from_timer(session, t, tmf_timer);
+
+ spin_lock(&session->frwd_lock);
+- if (conn->tmf_state == TMF_QUEUED) {
+- conn->tmf_state = TMF_TIMEDOUT;
++ if (session->tmf_state == TMF_QUEUED) {
++ session->tmf_state = TMF_TIMEDOUT;
+ ISCSI_DBG_EH(session, "tmf timedout\n");
+ /* unblock eh_abort() */
+- wake_up(&conn->ehwait);
++ wake_up(&session->ehwait);
+ }
+ spin_unlock(&session->frwd_lock);
+ }
+@@ -1856,8 +1848,8 @@ static int iscsi_exec_task_mgmt_fn(struct iscsi_conn *conn,
+ return -EPERM;
+ }
+ conn->tmfcmd_pdus_cnt++;
+- conn->tmf_timer.expires = timeout * HZ + jiffies;
+- add_timer(&conn->tmf_timer);
++ session->tmf_timer.expires = timeout * HZ + jiffies;
++ add_timer(&session->tmf_timer);
+ ISCSI_DBG_EH(session, "tmf set timeout\n");
+
+ spin_unlock_bh(&session->frwd_lock);
+@@ -1871,12 +1863,12 @@ static int iscsi_exec_task_mgmt_fn(struct iscsi_conn *conn,
+ * 3) session is terminated or restarted or userspace has
+ * given up on recovery
+ */
+- wait_event_interruptible(conn->ehwait, age != session->age ||
++ wait_event_interruptible(session->ehwait, age != session->age ||
+ session->state != ISCSI_STATE_LOGGED_IN ||
+- conn->tmf_state != TMF_QUEUED);
++ session->tmf_state != TMF_QUEUED);
+ if (signal_pending(current))
+ flush_signals(current);
+- del_timer_sync(&conn->tmf_timer);
++ del_timer_sync(&session->tmf_timer);
+
+ mutex_lock(&session->eh_mutex);
+ spin_lock_bh(&session->frwd_lock);
+@@ -2236,17 +2228,17 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
+ }
+
+ /* only have one tmf outstanding at a time */
+- if (conn->tmf_state != TMF_INITIAL)
++ if (session->tmf_state != TMF_INITIAL)
+ goto failed;
+- conn->tmf_state = TMF_QUEUED;
++ session->tmf_state = TMF_QUEUED;
+
+- hdr = &conn->tmhdr;
++ hdr = &session->tmhdr;
+ iscsi_prep_abort_task_pdu(task, hdr);
+
+ if (iscsi_exec_task_mgmt_fn(conn, hdr, age, session->abort_timeout))
+ goto failed;
+
+- switch (conn->tmf_state) {
++ switch (session->tmf_state) {
+ case TMF_SUCCESS:
+ spin_unlock_bh(&session->frwd_lock);
+ /*
+@@ -2261,7 +2253,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
+ */
+ spin_lock_bh(&session->frwd_lock);
+ fail_scsi_task(task, DID_ABORT);
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ memset(hdr, 0, sizeof(*hdr));
+ spin_unlock_bh(&session->frwd_lock);
+ iscsi_start_tx(conn);
+@@ -2272,7 +2264,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
+ goto failed_unlocked;
+ case TMF_NOT_FOUND:
+ if (!sc->SCp.ptr) {
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ memset(hdr, 0, sizeof(*hdr));
+ /* task completed before tmf abort response */
+ ISCSI_DBG_EH(session, "sc completed while abort in "
+@@ -2281,7 +2273,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
+ }
+ /* fall through */
+ default:
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ goto failed;
+ }
+
+@@ -2338,11 +2330,11 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc)
+ conn = session->leadconn;
+
+ /* only have one tmf outstanding at a time */
+- if (conn->tmf_state != TMF_INITIAL)
++ if (session->tmf_state != TMF_INITIAL)
+ goto unlock;
+- conn->tmf_state = TMF_QUEUED;
++ session->tmf_state = TMF_QUEUED;
+
+- hdr = &conn->tmhdr;
++ hdr = &session->tmhdr;
+ iscsi_prep_lun_reset_pdu(sc, hdr);
+
+ if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age,
+@@ -2351,7 +2343,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc)
+ goto unlock;
+ }
+
+- switch (conn->tmf_state) {
++ switch (session->tmf_state) {
+ case TMF_SUCCESS:
+ break;
+ case TMF_TIMEDOUT:
+@@ -2359,7 +2351,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc)
+ iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST);
+ goto done;
+ default:
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ goto unlock;
+ }
+
+@@ -2371,7 +2363,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc)
+ spin_lock_bh(&session->frwd_lock);
+ memset(hdr, 0, sizeof(*hdr));
+ fail_scsi_tasks(conn, sc->device->lun, DID_ERROR);
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ spin_unlock_bh(&session->frwd_lock);
+
+ iscsi_start_tx(conn);
+@@ -2394,8 +2386,7 @@ void iscsi_session_recovery_timedout(struct iscsi_cls_session *cls_session)
+ spin_lock_bh(&session->frwd_lock);
+ if (session->state != ISCSI_STATE_LOGGED_IN) {
+ session->state = ISCSI_STATE_RECOVERY_FAILED;
+- if (session->leadconn)
+- wake_up(&session->leadconn->ehwait);
++ wake_up(&session->ehwait);
+ }
+ spin_unlock_bh(&session->frwd_lock);
+ }
+@@ -2440,7 +2431,7 @@ failed:
+ iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST);
+
+ ISCSI_DBG_EH(session, "wait for relogin\n");
+- wait_event_interruptible(conn->ehwait,
++ wait_event_interruptible(session->ehwait,
+ session->state == ISCSI_STATE_TERMINATE ||
+ session->state == ISCSI_STATE_LOGGED_IN ||
+ session->state == ISCSI_STATE_RECOVERY_FAILED);
+@@ -2501,11 +2492,11 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc)
+ conn = session->leadconn;
+
+ /* only have one tmf outstanding at a time */
+- if (conn->tmf_state != TMF_INITIAL)
++ if (session->tmf_state != TMF_INITIAL)
+ goto unlock;
+- conn->tmf_state = TMF_QUEUED;
++ session->tmf_state = TMF_QUEUED;
+
+- hdr = &conn->tmhdr;
++ hdr = &session->tmhdr;
+ iscsi_prep_tgt_reset_pdu(sc, hdr);
+
+ if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age,
+@@ -2514,7 +2505,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc)
+ goto unlock;
+ }
+
+- switch (conn->tmf_state) {
++ switch (session->tmf_state) {
+ case TMF_SUCCESS:
+ break;
+ case TMF_TIMEDOUT:
+@@ -2522,7 +2513,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc)
+ iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST);
+ goto done;
+ default:
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ goto unlock;
+ }
+
+@@ -2534,7 +2525,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc)
+ spin_lock_bh(&session->frwd_lock);
+ memset(hdr, 0, sizeof(*hdr));
+ fail_scsi_tasks(conn, -1, DID_ERROR);
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ spin_unlock_bh(&session->frwd_lock);
+
+ iscsi_start_tx(conn);
+@@ -2839,7 +2830,10 @@ iscsi_session_setup(struct iscsi_transport *iscsit, struct Scsi_Host *shost,
+ session->tt = iscsit;
+ session->dd_data = cls_session->dd_data + sizeof(*session);
+
++ session->tmf_state = TMF_INITIAL;
++ timer_setup(&session->tmf_timer, iscsi_tmf_timedout, 0);
+ mutex_init(&session->eh_mutex);
++
+ spin_lock_init(&session->frwd_lock);
+ spin_lock_init(&session->back_lock);
+
+@@ -2943,7 +2937,6 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
+ conn->c_stage = ISCSI_CONN_INITIAL_STAGE;
+ conn->id = conn_idx;
+ conn->exp_statsn = 0;
+- conn->tmf_state = TMF_INITIAL;
+
+ timer_setup(&conn->transport_timer, iscsi_check_transport_timeouts, 0);
+
+@@ -2969,8 +2962,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
+ goto login_task_data_alloc_fail;
+ conn->login_task->data = conn->data = data;
+
+- timer_setup(&conn->tmf_timer, iscsi_tmf_timedout, 0);
+- init_waitqueue_head(&conn->ehwait);
++ init_waitqueue_head(&session->ehwait);
+
+ return cls_conn;
+
+@@ -3005,7 +2997,7 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
+ * leading connection? then give up on recovery.
+ */
+ session->state = ISCSI_STATE_TERMINATE;
+- wake_up(&conn->ehwait);
++ wake_up(&session->ehwait);
+ }
+ spin_unlock_bh(&session->frwd_lock);
+
+@@ -3080,7 +3072,7 @@ int iscsi_conn_start(struct iscsi_cls_conn *cls_conn)
+ * commands after successful recovery
+ */
+ conn->stop_stage = 0;
+- conn->tmf_state = TMF_INITIAL;
++ session->tmf_state = TMF_INITIAL;
+ session->age++;
+ if (session->age == 16)
+ session->age = 0;
+@@ -3094,7 +3086,7 @@ int iscsi_conn_start(struct iscsi_cls_conn *cls_conn)
+ spin_unlock_bh(&session->frwd_lock);
+
+ iscsi_unblock_session(session->cls_session);
+- wake_up(&conn->ehwait);
++ wake_up(&session->ehwait);
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(iscsi_conn_start);
+@@ -3180,7 +3172,7 @@ static void iscsi_start_session_recovery(struct iscsi_session *session,
+ spin_lock_bh(&session->frwd_lock);
+ fail_scsi_tasks(conn, -1, DID_TRANSPORT_DISRUPTED);
+ fail_mgmt_tasks(session, conn);
+- memset(&conn->tmhdr, 0, sizeof(conn->tmhdr));
++ memset(&session->tmhdr, 0, sizeof(session->tmhdr));
+ spin_unlock_bh(&session->frwd_lock);
+ mutex_unlock(&session->eh_mutex);
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 6a4b496081e4a..c4428249d3d7e 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -1176,6 +1176,15 @@ stop_rr_fcf_flogi:
+ phba->fcf.fcf_redisc_attempted = 0; /* reset */
+ goto out;
+ }
++ } else if (vport->port_state > LPFC_FLOGI &&
++ vport->fc_flag & FC_PT2PT) {
++ /*
++ * In a p2p topology, it is possible that discovery has
++ * already progressed, and this completion can be ignored.
++ * Recheck the indicated topology.
++ */
++ if (!sp->cmn.fPort)
++ goto out;
+ }
+
+ flogifail:
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index f4633c9f8183f..40d6537e64dd6 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -7281,7 +7281,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
+ "0393 Error %d during rpi post operation\n",
+ rc);
+ rc = -ENODEV;
+- goto out_destroy_queue;
++ goto out_free_iocblist;
+ }
+ lpfc_sli4_node_prep(phba);
+
+@@ -7406,8 +7406,9 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
+ out_unset_queue:
+ /* Unset all the queues set up in this routine when error out */
+ lpfc_sli4_queue_unset(phba);
+-out_destroy_queue:
++out_free_iocblist:
+ lpfc_free_iocb_list(phba);
++out_destroy_queue:
+ lpfc_sli4_queue_destroy(phba);
+ out_stop_timers:
+ lpfc_stop_hba_timers(phba);
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index 5a5e5c3da6571..add699b01836f 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -5745,8 +5745,10 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle)
+ handle, parent_handle, (unsigned long long)
+ sas_expander->sas_address, sas_expander->num_phys);
+
+- if (!sas_expander->num_phys)
++ if (!sas_expander->num_phys) {
++ rc = -1;
+ goto out_fail;
++ }
+ sas_expander->phy = kcalloc(sas_expander->num_phys,
+ sizeof(struct _sas_phy), GFP_KERNEL);
+ if (!sas_expander->phy) {
+diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
+index 357a0acc5ed2f..b60b48f3b984f 100644
+--- a/drivers/scsi/qedi/qedi_fw.c
++++ b/drivers/scsi/qedi/qedi_fw.c
+@@ -1466,7 +1466,7 @@ abort_ret:
+
+ ldel_exit:
+ spin_lock_bh(&qedi_conn->tmf_work_lock);
+- if (!qedi_cmd->list_tmf_work) {
++ if (qedi_cmd->list_tmf_work) {
+ list_del_init(&list_work->list);
+ qedi_cmd->list_tmf_work = NULL;
+ kfree(list_work);
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index fe26144d390a9..7665fd641886e 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -629,7 +629,7 @@ static struct qedi_ctx *qedi_host_alloc(struct pci_dev *pdev)
+ goto exit_setup_shost;
+ }
+
+- shost->max_id = QEDI_MAX_ISCSI_CONNS_PER_HBA;
++ shost->max_id = QEDI_MAX_ISCSI_CONNS_PER_HBA - 1;
+ shost->max_channel = 0;
+ shost->max_lun = ~0;
+ shost->max_cmd_len = 16;
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index fe5ae2b221c19..0191708c9dd4e 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -872,6 +872,7 @@ static void scsi_io_completion_action(struct scsi_cmnd *cmd, int result)
+ case 0x07: /* operation in progress */
+ case 0x08: /* Long write in progress */
+ case 0x09: /* self test in progress */
++ case 0x11: /* notify (enable spinup) required */
+ case 0x14: /* space allocation in progress */
+ case 0x1a: /* start stop unit in progress */
+ case 0x1b: /* sanitize in progress */
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index e340b05278b63..2aaa5a2bd6135 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2306,6 +2306,18 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn)
+ }
+ EXPORT_SYMBOL_GPL(iscsi_destroy_conn);
+
++void iscsi_put_conn(struct iscsi_cls_conn *conn)
++{
++ put_device(&conn->dev);
++}
++EXPORT_SYMBOL_GPL(iscsi_put_conn);
++
++void iscsi_get_conn(struct iscsi_cls_conn *conn)
++{
++ get_device(&conn->dev);
++}
++EXPORT_SYMBOL_GPL(iscsi_get_conn);
++
+ /*
+ * iscsi interface functions
+ */
+diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
+index b9a7117b6dce3..85d3475915dda 100644
+--- a/drivers/spi/spi-loopback-test.c
++++ b/drivers/spi/spi-loopback-test.c
+@@ -877,7 +877,7 @@ static int spi_test_run_iter(struct spi_device *spi,
+ test.transfers[i].len = len;
+ if (test.transfers[i].tx_buf)
+ test.transfers[i].tx_buf += tx_off;
+- if (test.transfers[i].tx_buf)
++ if (test.transfers[i].rx_buf)
+ test.transfers[i].rx_buf += rx_off;
+ }
+
+diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c
+index 1eccdc4a45817..2eeb0fe2eed28 100644
+--- a/drivers/spi/spi-omap-100k.c
++++ b/drivers/spi/spi-omap-100k.c
+@@ -251,7 +251,7 @@ static int omap1_spi100k_setup_transfer(struct spi_device *spi,
+ else
+ word_len = spi->bits_per_word;
+
+- if (spi->bits_per_word > 32)
++ if (word_len > 32)
+ return -EINVAL;
+ cs->word_len = word_len;
+
+diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
+index 21a22d42818c8..ef62366899ad8 100644
+--- a/drivers/spi/spi-sun6i.c
++++ b/drivers/spi/spi-sun6i.c
+@@ -301,6 +301,10 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ }
+
+ sun6i_spi_write(sspi, SUN6I_CLK_CTL_REG, reg);
++ /* Finally enable the bus - doing so before might raise SCK to HIGH */
++ reg = sun6i_spi_read(sspi, SUN6I_GBL_CTL_REG);
++ reg |= SUN6I_GBL_CTL_BUS_ENABLE;
++ sun6i_spi_write(sspi, SUN6I_GBL_CTL_REG, reg);
+
+ /* Setup the transfer now... */
+ if (sspi->tx_buf)
+@@ -409,7 +413,7 @@ static int sun6i_spi_runtime_resume(struct device *dev)
+ }
+
+ sun6i_spi_write(sspi, SUN6I_GBL_CTL_REG,
+- SUN6I_GBL_CTL_BUS_ENABLE | SUN6I_GBL_CTL_MASTER | SUN6I_GBL_CTL_TP);
++ SUN6I_GBL_CTL_MASTER | SUN6I_GBL_CTL_TP);
+
+ return 0;
+
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index 8a5966963834c..ef19e050612cd 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -584,8 +584,10 @@ static void pch_spi_set_tx(struct pch_spi_data *data, int *bpw)
+ data->pkt_tx_buff = kzalloc(size, GFP_KERNEL);
+ if (data->pkt_tx_buff != NULL) {
+ data->pkt_rx_buff = kzalloc(size, GFP_KERNEL);
+- if (!data->pkt_rx_buff)
++ if (!data->pkt_rx_buff) {
+ kfree(data->pkt_tx_buff);
++ data->pkt_tx_buff = NULL;
++ }
+ }
+
+ if (!data->pkt_rx_buff) {
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index bbe33016d3718..49f592e433a8d 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1678,6 +1678,7 @@ of_register_spi_device(struct spi_controller *ctlr, struct device_node *nc)
+ /* Store a pointer to the node in the device structure */
+ of_node_get(nc);
+ spi->dev.of_node = nc;
++ spi->dev.fwnode = of_fwnode_handle(nc);
+
+ /* Register the new device */
+ rc = spi_add_device(spi);
+diff --git a/drivers/ssb/scan.c b/drivers/ssb/scan.c
+index 6ceee98ed6ff2..5c7e61cafd195 100644
+--- a/drivers/ssb/scan.c
++++ b/drivers/ssb/scan.c
+@@ -325,6 +325,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
+ if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
+ pr_err("More than %d ssb cores found (%d)\n",
+ SSB_MAX_NR_CORES, bus->nr_devices);
++ err = -EINVAL;
+ goto err_unmap;
+ }
+ if (bus->bustype == SSB_BUSTYPE_SSB) {
+diff --git a/drivers/ssb/sdio.c b/drivers/ssb/sdio.c
+index 7fe0afb42234f..66c5c2169704b 100644
+--- a/drivers/ssb/sdio.c
++++ b/drivers/ssb/sdio.c
+@@ -411,7 +411,6 @@ static void ssb_sdio_block_write(struct ssb_device *dev, const void *buffer,
+ sdio_claim_host(bus->host_sdio);
+ if (unlikely(ssb_sdio_switch_core(bus, dev))) {
+ error = -EIO;
+- memset((void *)buffer, 0xff, count);
+ goto err_out;
+ }
+ offset |= bus->sdio_sbaddr & 0xffff;
+diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c
+index 3c2aab7a921e8..3c537807f4d14 100644
+--- a/drivers/staging/gdm724x/gdm_lte.c
++++ b/drivers/staging/gdm724x/gdm_lte.c
+@@ -611,10 +611,12 @@ static void gdm_lte_netif_rx(struct net_device *dev, char *buf,
+ * bytes (99,130,83,99 dec)
+ */
+ } __packed;
+- void *addr = buf + sizeof(struct iphdr) +
+- sizeof(struct udphdr) +
+- offsetof(struct dhcp_packet, chaddr);
+- ether_addr_copy(nic->dest_mac_addr, addr);
++ int offset = sizeof(struct iphdr) +
++ sizeof(struct udphdr) +
++ offsetof(struct dhcp_packet, chaddr);
++ if (offset + ETH_ALEN > len)
++ return;
++ ether_addr_copy(nic->dest_mac_addr, buf + offset);
+ }
+ }
+
+@@ -677,6 +679,7 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len)
+ struct sdu *sdu = NULL;
+ u8 endian = phy_dev->get_endian(phy_dev->priv_dev);
+ u8 *data = (u8 *)multi_sdu->data;
++ int copied;
+ u16 i = 0;
+ u16 num_packet;
+ u16 hci_len;
+@@ -688,6 +691,12 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len)
+ num_packet = gdm_dev16_to_cpu(endian, multi_sdu->num_packet);
+
+ for (i = 0; i < num_packet; i++) {
++ copied = data - multi_sdu->data;
++ if (len < copied + sizeof(*sdu)) {
++ pr_err("rx prevent buffer overflow");
++ return;
++ }
++
+ sdu = (struct sdu *)data;
+
+ cmd_evt = gdm_dev16_to_cpu(endian, sdu->cmd_evt);
+@@ -698,7 +707,8 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len)
+ pr_err("rx sdu wrong hci %04x\n", cmd_evt);
+ return;
+ }
+- if (hci_len < 12) {
++ if (hci_len < 12 ||
++ len < copied + sizeof(*sdu) + (hci_len - 12)) {
+ pr_err("rx sdu invalid len %d\n", hci_len);
+ return;
+ }
+diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c
+index 0f8fdc347091b..c7df0ffb35108 100644
+--- a/drivers/staging/media/imx/imx-media-csi.c
++++ b/drivers/staging/media/imx/imx-media-csi.c
+@@ -730,9 +730,10 @@ static int csi_setup(struct csi_priv *priv)
+
+ static int csi_start(struct csi_priv *priv)
+ {
+- struct v4l2_fract *output_fi;
++ struct v4l2_fract *input_fi, *output_fi;
+ int ret;
+
++ input_fi = &priv->frame_interval[CSI_SINK_PAD];
+ output_fi = &priv->frame_interval[priv->active_output_pad];
+
+ /* start upstream */
+@@ -741,6 +742,17 @@ static int csi_start(struct csi_priv *priv)
+ if (ret)
+ return ret;
+
++ /* Skip first few frames from a BT.656 source */
++ if (priv->upstream_ep.bus_type == V4L2_MBUS_BT656) {
++ u32 delay_usec, bad_frames = 20;
++
++ delay_usec = DIV_ROUND_UP_ULL((u64)USEC_PER_SEC *
++ input_fi->numerator * bad_frames,
++ input_fi->denominator);
++
++ usleep_range(delay_usec, delay_usec + 1000);
++ }
++
+ if (priv->dest == IPU_CSI_DEST_IDMAC) {
+ ret = csi_idmac_start(priv);
+ if (ret)
+diff --git a/drivers/staging/mt7621-dts/mt7621.dtsi b/drivers/staging/mt7621-dts/mt7621.dtsi
+index 2e837e60663ad..9891e53e7895e 100644
+--- a/drivers/staging/mt7621-dts/mt7621.dtsi
++++ b/drivers/staging/mt7621-dts/mt7621.dtsi
+@@ -409,7 +409,7 @@
+
+ bus-range = <0 255>;
+ ranges = <
+- 0x02000000 0 0x00000000 0x60000000 0 0x10000000 /* pci memory */
++ 0x02000000 0 0x60000000 0x60000000 0 0x10000000 /* pci memory */
+ 0x01000000 0 0x00000000 0x1e160000 0 0x00010000 /* io space */
+ >;
+
+diff --git a/drivers/staging/rtl8723bs/hal/odm.h b/drivers/staging/rtl8723bs/hal/odm.h
+index 23ab160ac2c8f..ff8e22d70d4cf 100644
+--- a/drivers/staging/rtl8723bs/hal/odm.h
++++ b/drivers/staging/rtl8723bs/hal/odm.h
+@@ -197,10 +197,7 @@ typedef struct _ODM_RATE_ADAPTIVE {
+
+ #define AVG_THERMAL_NUM 8
+ #define IQK_Matrix_REG_NUM 8
+-#define IQK_Matrix_Settings_NUM (14 + 24 + 21) /* Channels_2_4G_NUM
+- * + Channels_5G_20M_NUM
+- * + Channels_5G
+- */
++#define IQK_Matrix_Settings_NUM 14 /* Channels_2_4G_NUM */
+
+ #define DM_Type_ByFW 0
+ #define DM_Type_ByDriver 1
+diff --git a/drivers/tty/nozomi.c b/drivers/tty/nozomi.c
+index fed820e9ab9d7..f291f4b06b683 100644
+--- a/drivers/tty/nozomi.c
++++ b/drivers/tty/nozomi.c
+@@ -1403,7 +1403,7 @@ static int nozomi_card_init(struct pci_dev *pdev,
+ NOZOMI_NAME, dc);
+ if (unlikely(ret)) {
+ dev_err(&pdev->dev, "can't request irq %d\n", pdev->irq);
+- goto err_free_kfifo;
++ goto err_free_all_kfifo;
+ }
+
+ DBG1("base_addr: %p", dc->base_addr);
+@@ -1441,12 +1441,15 @@ static int nozomi_card_init(struct pci_dev *pdev,
+ return 0;
+
+ err_free_tty:
+- for (i = 0; i < MAX_PORT; ++i) {
++ for (i--; i >= 0; i--) {
+ tty_unregister_device(ntty_driver, dc->index_start + i);
+ tty_port_destroy(&dc->port[i].port);
+ }
++ free_irq(pdev->irq, dc);
++err_free_all_kfifo:
++ i = MAX_PORT;
+ err_free_kfifo:
+- for (i = 0; i < MAX_PORT; i++)
++ for (i--; i >= PORT_MDM; i--)
+ kfifo_free(&dc->port[i].fifo_ul);
+ err_free_sbuf:
+ kfree(dc->send_buf);
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 60ca19eca1f63..56693dfe0f5b7 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -2646,6 +2646,21 @@ static unsigned int serial8250_get_baud_rate(struct uart_port *port,
+ struct ktermios *old)
+ {
+ unsigned int tolerance = port->uartclk / 100;
++ unsigned int min;
++ unsigned int max;
++
++ /*
++ * Handle magic divisors for baud rates above baud_base on SMSC
++ * Super I/O chips. Enable custom rates of clk/4 and clk/8, but
++ * disable divisor values beyond 32767, which are unavailable.
++ */
++ if (port->flags & UPF_MAGIC_MULTIPLIER) {
++ min = port->uartclk / 16 / UART_DIV_MAX >> 1;
++ max = (port->uartclk + tolerance) / 4;
++ } else {
++ min = port->uartclk / 16 / UART_DIV_MAX;
++ max = (port->uartclk + tolerance) / 16;
++ }
+
+ /*
+ * Ask the core to calculate the divisor for us.
+@@ -2653,9 +2668,7 @@ static unsigned int serial8250_get_baud_rate(struct uart_port *port,
+ * slower than nominal still match standard baud rates without
+ * causing transmission errors.
+ */
+- return uart_get_baud_rate(port, termios, old,
+- port->uartclk / 16 / UART_DIV_MAX,
+- (port->uartclk + tolerance) / 16);
++ return uart_get_baud_rate(port, termios, old, min, max);
+ }
+
+ void
+diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c
+index c8186a05a453c..a05c2b652040c 100644
+--- a/drivers/tty/serial/8250/serial_cs.c
++++ b/drivers/tty/serial/8250/serial_cs.c
+@@ -306,6 +306,7 @@ static int serial_resume(struct pcmcia_device *link)
+ static int serial_probe(struct pcmcia_device *link)
+ {
+ struct serial_info *info;
++ int ret;
+
+ dev_dbg(&link->dev, "serial_attach()\n");
+
+@@ -320,7 +321,15 @@ static int serial_probe(struct pcmcia_device *link)
+ if (do_sound)
+ link->config_flags |= CONF_ENABLE_SPKR;
+
+- return serial_config(link);
++ ret = serial_config(link);
++ if (ret)
++ goto free_info;
++
++ return 0;
++
++free_info:
++ kfree(info);
++ return ret;
+ }
+
+ static void serial_detach(struct pcmcia_device *link)
+@@ -780,6 +789,7 @@ static const struct pcmcia_device_id serial_ids[] = {
+ PCMCIA_DEVICE_PROD_ID12("Multi-Tech", "MT2834LT", 0x5f73be51, 0x4cd7c09e),
+ PCMCIA_DEVICE_PROD_ID12("OEM ", "C288MX ", 0xb572d360, 0xd2385b7a),
+ PCMCIA_DEVICE_PROD_ID12("Option International", "V34bis GSM/PSTN Data/Fax Modem", 0x9d7cd6f5, 0x5cb8bf41),
++ PCMCIA_DEVICE_PROD_ID12("Option International", "GSM-Ready 56K/ISDN", 0x9d7cd6f5, 0xb23844aa),
+ PCMCIA_DEVICE_PROD_ID12("PCMCIA ", "C336MX ", 0x99bcafe9, 0xaa25bcab),
+ PCMCIA_DEVICE_PROD_ID12("Quatech Inc", "PCMCIA Dual RS-232 Serial Port Card", 0xc4420b35, 0x92abc92f),
+ PCMCIA_DEVICE_PROD_ID12("Quatech Inc", "Dual RS-232 Serial Port PC Card", 0xc4420b35, 0x031a380d),
+@@ -807,7 +817,6 @@ static const struct pcmcia_device_id serial_ids[] = {
+ PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-4", 0x96913a85, 0xcec8f102, "cis/COMpad4.cis"),
+ PCMCIA_DEVICE_CIS_PROD_ID123("ADVANTECH", "COMpad-32/85", "1.0", 0x96913a85, 0x8fbe92ae, 0x0877b627, "cis/COMpad2.cis"),
+ PCMCIA_DEVICE_CIS_PROD_ID2("RS-COM 2P", 0xad20b156, "cis/RS-COM-2P.cis"),
+- PCMCIA_DEVICE_CIS_MANF_CARD(0x0013, 0x0000, "cis/GLOBETROTTER.cis"),
+ PCMCIA_DEVICE_PROD_ID12("ELAN DIGITAL SYSTEMS LTD, c1997.", "SERIAL CARD: SL100 1.00.", 0x19ca78af, 0xf964f42b),
+ PCMCIA_DEVICE_PROD_ID12("ELAN DIGITAL SYSTEMS LTD, c1997.", "SERIAL CARD: SL100", 0x19ca78af, 0x71d98e83),
+ PCMCIA_DEVICE_PROD_ID12("ELAN DIGITAL SYSTEMS LTD, c1997.", "SERIAL CARD: SL232 1.00.", 0x19ca78af, 0x69fb7490),
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 4b9f422694779..deb9d4fa9cb09 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1992,6 +1992,9 @@ lpuart32_console_get_options(struct lpuart_port *sport, int *baud,
+
+ bd = lpuart32_read(&sport->port, UARTBAUD);
+ bd &= UARTBAUD_SBR_MASK;
++ if (!bd)
++ return;
++
+ sbr = bd;
+ uartclk = clk_get_rate(sport->clk);
+ /*
+diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
+index 0515b5e6326d7..f0107d5df99e9 100644
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -72,6 +72,7 @@
+ #define BRDV_BAUD_MASK 0x3FF
+
+ #define UART_OSAMP 0x14
++#define OSAMP_DEFAULT_DIVISOR 16
+
+ #define MVEBU_NR_UARTS 2
+
+@@ -444,23 +445,28 @@ static void mvebu_uart_shutdown(struct uart_port *port)
+ static int mvebu_uart_baud_rate_set(struct uart_port *port, unsigned int baud)
+ {
+ struct mvebu_uart *mvuart = to_mvuart(port);
+- unsigned int baud_rate_div;
++ unsigned int d_divisor, m_divisor;
+ u32 brdv;
+
+ if (IS_ERR(mvuart->clk))
+ return -PTR_ERR(mvuart->clk);
+
+ /*
+- * The UART clock is divided by the value of the divisor to generate
+- * UCLK_OUT clock, which is 16 times faster than the baudrate.
+- * This prescaler can achieve all standard baudrates until 230400.
+- * Higher baudrates could be achieved for the extended UART by using the
+- * programmable oversampling stack (also called fractional divisor).
++ * The baudrate is derived from the UART clock thanks to two divisors:
++ * > D ("baud generator"): can divide the clock from 2 to 2^10 - 1.
++ * > M ("fractional divisor"): allows a better accuracy for
++ * baudrates higher than 230400.
++ *
++ * As the derivation of M is rather complicated, the code sticks to its
++ * default value (x16) when all the prescalers are zeroed, and only
++ * makes use of D to configure the desired baudrate.
+ */
+- baud_rate_div = DIV_ROUND_UP(port->uartclk, baud * 16);
++ m_divisor = OSAMP_DEFAULT_DIVISOR;
++ d_divisor = DIV_ROUND_CLOSEST(port->uartclk, baud * m_divisor);
++
+ brdv = readl(port->membase + UART_BRDV);
+ brdv &= ~BRDV_BAUD_MASK;
+- brdv |= baud_rate_div;
++ brdv |= d_divisor;
+ writel(brdv, port->membase + UART_BRDV);
+
+ return 0;
+@@ -471,7 +477,7 @@ static void mvebu_uart_set_termios(struct uart_port *port,
+ struct ktermios *old)
+ {
+ unsigned long flags;
+- unsigned int baud;
++ unsigned int baud, min_baud, max_baud;
+
+ spin_lock_irqsave(&port->lock, flags);
+
+@@ -490,16 +496,21 @@ static void mvebu_uart_set_termios(struct uart_port *port,
+ port->ignore_status_mask |= STAT_RX_RDY(port) | STAT_BRK_ERR;
+
+ /*
++ * Maximal divisor is 1023 * 16 when using default (x16) scheme.
+ * Maximum achievable frequency with simple baudrate divisor is 230400.
+ * Since the error per bit frame would be of more than 15%, achieving
+ * higher frequencies would require to implement the fractional divisor
+ * feature.
+ */
+- baud = uart_get_baud_rate(port, termios, old, 0, 230400);
++ min_baud = DIV_ROUND_UP(port->uartclk, 1023 * 16);
++ max_baud = 230400;
++
++ baud = uart_get_baud_rate(port, termios, old, min_baud, max_baud);
+ if (mvebu_uart_baud_rate_set(port, baud)) {
+ /* No clock available, baudrate cannot be changed */
+ if (old)
+- baud = uart_get_baud_rate(port, old, NULL, 0, 230400);
++ baud = uart_get_baud_rate(port, old, NULL,
++ min_baud, max_baud);
+ } else {
+ tty_termios_encode_baud_rate(termios, baud, baud);
+ uart_update_timeout(port, termios->c_cflag, baud);
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index bfbfe0d68d828..db5b11879910c 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -613,6 +613,14 @@ static void sci_stop_tx(struct uart_port *port)
+ ctrl &= ~SCSCR_TIE;
+
+ serial_port_out(port, SCSCR, ctrl);
++
++#ifdef CONFIG_SERIAL_SH_SCI_DMA
++ if (to_sci_port(port)->chan_tx &&
++ !dma_submit_error(to_sci_port(port)->cookie_tx)) {
++ dmaengine_terminate_async(to_sci_port(port)->chan_tx);
++ to_sci_port(port)->cookie_tx = -EINVAL;
++ }
++#endif
+ }
+
+ static void sci_start_rx(struct uart_port *port)
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 738de8c9c354b..371aae41ed655 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -2000,6 +2000,11 @@ static const struct usb_device_id acm_ids[] = {
+ .driver_info = IGNORE_DEVICE,
+ },
+
++ /* Exclude Heimann Sensor GmbH USB appset demo */
++ { USB_DEVICE(0x32a7, 0x0000),
++ .driver_info = IGNORE_DEVICE,
++ },
++
+ /* control interfaces without any protocol set */
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
+ USB_CDC_PROTO_NONE) },
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index e223502eafca6..87e38a7534581 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1495,17 +1495,18 @@ static int dwc3_probe(struct platform_device *pdev)
+ }
+
+ dwc3_check_params(dwc);
++ dwc3_debugfs_init(dwc);
+
+ ret = dwc3_core_init_mode(dwc);
+ if (ret)
+ goto err5;
+
+- dwc3_debugfs_init(dwc);
+ pm_runtime_put(dev);
+
+ return 0;
+
+ err5:
++ dwc3_debugfs_exit(dwc);
+ dwc3_event_buffers_cleanup(dwc);
+
+ usb_phy_shutdown(dwc->usb2_phy);
+diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
+index bdd964ac9fa9a..dbfaebec24886 100644
+--- a/drivers/usb/gadget/function/f_eem.c
++++ b/drivers/usb/gadget/function/f_eem.c
+@@ -30,6 +30,11 @@ struct f_eem {
+ u8 ctrl_id;
+ };
+
++struct in_context {
++ struct sk_buff *skb;
++ struct usb_ep *ep;
++};
++
+ static inline struct f_eem *func_to_eem(struct usb_function *f)
+ {
+ return container_of(f, struct f_eem, port.func);
+@@ -323,9 +328,12 @@ fail:
+
+ static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
+ {
+- struct sk_buff *skb = (struct sk_buff *)req->context;
++ struct in_context *ctx = req->context;
+
+- dev_kfree_skb_any(skb);
++ dev_kfree_skb_any(ctx->skb);
++ kfree(req->buf);
++ usb_ep_free_request(ctx->ep, req);
++ kfree(ctx);
+ }
+
+ /*
+@@ -413,7 +421,9 @@ static int eem_unwrap(struct gether *port,
+ * b15: bmType (0 == data, 1 == command)
+ */
+ if (header & BIT(15)) {
+- struct usb_request *req = cdev->req;
++ struct usb_request *req;
++ struct in_context *ctx;
++ struct usb_ep *ep;
+ u16 bmEEMCmd;
+
+ /* EEM command packet format:
+@@ -442,11 +452,36 @@ static int eem_unwrap(struct gether *port,
+ skb_trim(skb2, len);
+ put_unaligned_le16(BIT(15) | BIT(11) | len,
+ skb_push(skb2, 2));
++
++ ep = port->in_ep;
++ req = usb_ep_alloc_request(ep, GFP_ATOMIC);
++ if (!req) {
++ dev_kfree_skb_any(skb2);
++ goto next;
++ }
++
++ req->buf = kmalloc(skb2->len, GFP_KERNEL);
++ if (!req->buf) {
++ usb_ep_free_request(ep, req);
++ dev_kfree_skb_any(skb2);
++ goto next;
++ }
++
++ ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
++ if (!ctx) {
++ kfree(req->buf);
++ usb_ep_free_request(ep, req);
++ dev_kfree_skb_any(skb2);
++ goto next;
++ }
++ ctx->skb = skb2;
++ ctx->ep = ep;
++
+ skb_copy_bits(skb2, 0, req->buf, skb2->len);
+ req->length = skb2->len;
+ req->complete = eem_cmd_complete;
+ req->zero = 1;
+- req->context = skb2;
++ req->context = ctx;
+ if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
+ DBG(cdev, "echo response queue fail\n");
+ break;
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index f13ec86371e72..e6805492409f6 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -243,8 +243,8 @@ EXPORT_SYMBOL_GPL(ffs_lock);
+ static struct ffs_dev *_ffs_find_dev(const char *name);
+ static struct ffs_dev *_ffs_alloc_dev(void);
+ static void _ffs_free_dev(struct ffs_dev *dev);
+-static void *ffs_acquire_dev(const char *dev_name);
+-static void ffs_release_dev(struct ffs_data *ffs_data);
++static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data);
++static void ffs_release_dev(struct ffs_dev *ffs_dev);
+ static int ffs_ready(struct ffs_data *ffs);
+ static void ffs_closed(struct ffs_data *ffs);
+
+@@ -1515,7 +1515,6 @@ ffs_fs_mount(struct file_system_type *t, int flags,
+ };
+ struct dentry *rv;
+ int ret;
+- void *ffs_dev;
+ struct ffs_data *ffs;
+
+ ENTER();
+@@ -1536,19 +1535,16 @@ ffs_fs_mount(struct file_system_type *t, int flags,
+ return ERR_PTR(-ENOMEM);
+ }
+
+- ffs_dev = ffs_acquire_dev(dev_name);
+- if (IS_ERR(ffs_dev)) {
++ ret = ffs_acquire_dev(dev_name, ffs);
++ if (ret) {
+ ffs_data_put(ffs);
+- return ERR_CAST(ffs_dev);
++ return ERR_PTR(ret);
+ }
+- ffs->private_data = ffs_dev;
+ data.ffs_data = ffs;
+
+ rv = mount_nodev(t, flags, &data, ffs_sb_fill);
+- if (IS_ERR(rv) && data.ffs_data) {
+- ffs_release_dev(data.ffs_data);
++ if (IS_ERR(rv) && data.ffs_data)
+ ffs_data_put(data.ffs_data);
+- }
+ return rv;
+ }
+
+@@ -1558,10 +1554,8 @@ ffs_fs_kill_sb(struct super_block *sb)
+ ENTER();
+
+ kill_litter_super(sb);
+- if (sb->s_fs_info) {
+- ffs_release_dev(sb->s_fs_info);
++ if (sb->s_fs_info)
+ ffs_data_closed(sb->s_fs_info);
+- }
+ }
+
+ static struct file_system_type ffs_fs_type = {
+@@ -1630,6 +1624,7 @@ static void ffs_data_put(struct ffs_data *ffs)
+ if (unlikely(refcount_dec_and_test(&ffs->ref))) {
+ pr_info("%s(): freeing\n", __func__);
+ ffs_data_clear(ffs);
++ ffs_release_dev(ffs->private_data);
+ BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
+ waitqueue_active(&ffs->ep0req_completion.wait) ||
+ waitqueue_active(&ffs->wait));
+@@ -2934,6 +2929,7 @@ static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
+ struct ffs_function *func = ffs_func_from_usb(f);
+ struct f_fs_opts *ffs_opts =
+ container_of(f->fi, struct f_fs_opts, func_inst);
++ struct ffs_data *ffs_data;
+ int ret;
+
+ ENTER();
+@@ -2948,12 +2944,13 @@ static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
+ if (!ffs_opts->no_configfs)
+ ffs_dev_lock();
+ ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV;
+- func->ffs = ffs_opts->dev->ffs_data;
++ ffs_data = ffs_opts->dev->ffs_data;
+ if (!ffs_opts->no_configfs)
+ ffs_dev_unlock();
+ if (ret)
+ return ERR_PTR(ret);
+
++ func->ffs = ffs_data;
+ func->conf = c;
+ func->gadget = c->cdev->gadget;
+
+@@ -3408,6 +3405,7 @@ static void ffs_free_inst(struct usb_function_instance *f)
+ struct f_fs_opts *opts;
+
+ opts = to_f_fs_opts(f);
++ ffs_release_dev(opts->dev);
+ ffs_dev_lock();
+ _ffs_free_dev(opts->dev);
+ ffs_dev_unlock();
+@@ -3595,47 +3593,48 @@ static void _ffs_free_dev(struct ffs_dev *dev)
+ {
+ list_del(&dev->entry);
+
+- /* Clear the private_data pointer to stop incorrect dev access */
+- if (dev->ffs_data)
+- dev->ffs_data->private_data = NULL;
+-
+ kfree(dev);
+ if (list_empty(&ffs_devices))
+ functionfs_cleanup();
+ }
+
+-static void *ffs_acquire_dev(const char *dev_name)
++static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data)
+ {
++ int ret = 0;
+ struct ffs_dev *ffs_dev;
+
+ ENTER();
+ ffs_dev_lock();
+
+ ffs_dev = _ffs_find_dev(dev_name);
+- if (!ffs_dev)
+- ffs_dev = ERR_PTR(-ENOENT);
+- else if (ffs_dev->mounted)
+- ffs_dev = ERR_PTR(-EBUSY);
+- else if (ffs_dev->ffs_acquire_dev_callback &&
+- ffs_dev->ffs_acquire_dev_callback(ffs_dev))
+- ffs_dev = ERR_PTR(-ENOENT);
+- else
++ if (!ffs_dev) {
++ ret = -ENOENT;
++ } else if (ffs_dev->mounted) {
++ ret = -EBUSY;
++ } else if (ffs_dev->ffs_acquire_dev_callback &&
++ ffs_dev->ffs_acquire_dev_callback(ffs_dev)) {
++ ret = -ENOENT;
++ } else {
+ ffs_dev->mounted = true;
++ ffs_dev->ffs_data = ffs_data;
++ ffs_data->private_data = ffs_dev;
++ }
+
+ ffs_dev_unlock();
+- return ffs_dev;
++ return ret;
+ }
+
+-static void ffs_release_dev(struct ffs_data *ffs_data)
++static void ffs_release_dev(struct ffs_dev *ffs_dev)
+ {
+- struct ffs_dev *ffs_dev;
+-
+ ENTER();
+ ffs_dev_lock();
+
+- ffs_dev = ffs_data->private_data;
+- if (ffs_dev) {
++ if (ffs_dev && ffs_dev->mounted) {
+ ffs_dev->mounted = false;
++ if (ffs_dev->ffs_data) {
++ ffs_dev->ffs_data->private_data = NULL;
++ ffs_dev->ffs_data = NULL;
++ }
+
+ if (ffs_dev->ffs_release_dev_callback)
+ ffs_dev->ffs_release_dev_callback(ffs_dev);
+@@ -3663,7 +3662,6 @@ static int ffs_ready(struct ffs_data *ffs)
+ }
+
+ ffs_obj->desc_ready = true;
+- ffs_obj->ffs_data = ffs;
+
+ if (ffs_obj->ffs_ready_callback) {
+ ret = ffs_obj->ffs_ready_callback(ffs);
+@@ -3691,7 +3689,6 @@ static void ffs_closed(struct ffs_data *ffs)
+ goto done;
+
+ ffs_obj->desc_ready = false;
+- ffs_obj->ffs_data = NULL;
+
+ if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
+ ffs_obj->ffs_closed_callback)
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index bc0a693c3260d..fa8a8e04008ae 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -88,7 +88,7 @@ static struct usb_interface_descriptor hidg_interface_desc = {
+ static struct hid_descriptor hidg_desc = {
+ .bLength = sizeof hidg_desc,
+ .bDescriptorType = HID_DT_HID,
+- .bcdHID = 0x0101,
++ .bcdHID = cpu_to_le16(0x0101),
+ .bCountryCode = 0x00,
+ .bNumDescriptors = 0x1,
+ /*.desc[0].bDescriptorType = DYNAMIC */
+diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c
+index c4eda7fe7ab45..5b27d289443fe 100644
+--- a/drivers/usb/gadget/legacy/hid.c
++++ b/drivers/usb/gadget/legacy/hid.c
+@@ -171,8 +171,10 @@ static int hid_bind(struct usb_composite_dev *cdev)
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto put;
++ }
+ usb_otg_descriptor_init(gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 2461be2a8748c..fb47caf929de5 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1929,6 +1929,7 @@ no_bw:
+ xhci->hw_ports = NULL;
+ xhci->rh_bw = NULL;
+ xhci->ext_caps = NULL;
++ xhci->port_caps = NULL;
+
+ xhci->page_size = 0;
+ xhci->page_shift = 0;
+diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
+index 1916ee1600b47..8dae6ff2377ce 100644
+--- a/drivers/usb/typec/class.c
++++ b/drivers/usb/typec/class.c
+@@ -481,8 +481,10 @@ typec_register_altmode(struct device *parent,
+ int ret;
+
+ alt = kzalloc(sizeof(*alt), GFP_KERNEL);
+- if (!alt)
++ if (!alt) {
++ altmode_id_remove(parent, id);
+ return ERR_PTR(-ENOMEM);
++ }
+
+ alt->adev.svid = desc->svid;
+ alt->adev.mode = desc->mode;
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index c48e1d84efb6b..51b791c750f1b 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -1359,6 +1359,7 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf)
+ {
+ struct vm_area_struct *vma = vmf->vma;
+ struct vfio_pci_device *vdev = vma->vm_private_data;
++ struct vfio_pci_mmap_vma *mmap_vma;
+ vm_fault_t ret = VM_FAULT_NOPAGE;
+
+ mutex_lock(&vdev->vma_lock);
+@@ -1366,24 +1367,36 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf)
+
+ if (!__vfio_pci_memory_enabled(vdev)) {
+ ret = VM_FAULT_SIGBUS;
+- mutex_unlock(&vdev->vma_lock);
+ goto up_out;
+ }
+
+- if (__vfio_pci_add_vma(vdev, vma)) {
+- ret = VM_FAULT_OOM;
+- mutex_unlock(&vdev->vma_lock);
+- goto up_out;
++ /*
++ * We populate the whole vma on fault, so we need to test whether
++ * the vma has already been mapped, such as for concurrent faults
++ * to the same vma. io_remap_pfn_range() will trigger a BUG_ON if
++ * we ask it to fill the same range again.
++ */
++ list_for_each_entry(mmap_vma, &vdev->vma_list, vma_next) {
++ if (mmap_vma->vma == vma)
++ goto up_out;
+ }
+
+- mutex_unlock(&vdev->vma_lock);
+-
+ if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+- vma->vm_end - vma->vm_start, vma->vm_page_prot))
++ vma->vm_end - vma->vm_start,
++ vma->vm_page_prot)) {
+ ret = VM_FAULT_SIGBUS;
++ zap_vma_ptes(vma, vma->vm_start, vma->vm_end - vma->vm_start);
++ goto up_out;
++ }
++
++ if (__vfio_pci_add_vma(vdev, vma)) {
++ ret = VM_FAULT_OOM;
++ zap_vma_ptes(vma, vma->vm_start, vma->vm_end - vma->vm_start);
++ }
+
+ up_out:
+ up_read(&vdev->memory_lock);
++ mutex_unlock(&vdev->vma_lock);
+ return ret;
+ }
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index ef2553f452ca9..f17e5a8860fa7 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -184,7 +184,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
+ if ((pwm_ctrl & LM3630A_PWM_BANK_A) != 0) {
+ lm3630a_pwm_ctrl(pchip, bl->props.brightness,
+ bl->props.max_brightness);
+- return bl->props.brightness;
++ return 0;
+ }
+
+ /* disable sleep */
+@@ -204,8 +204,8 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
+ return 0;
+
+ out_i2c_err:
+- dev_err(pchip->dev, "i2c failed to access\n");
+- return bl->props.brightness;
++ dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret));
++ return ret;
+ }
+
+ static int lm3630a_bank_a_get_brightness(struct backlight_device *bl)
+@@ -261,7 +261,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
+ if ((pwm_ctrl & LM3630A_PWM_BANK_B) != 0) {
+ lm3630a_pwm_ctrl(pchip, bl->props.brightness,
+ bl->props.max_brightness);
+- return bl->props.brightness;
++ return 0;
+ }
+
+ /* disable sleep */
+@@ -281,8 +281,8 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
+ return 0;
+
+ out_i2c_err:
+- dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
+- return bl->props.brightness;
++ dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret));
++ return ret;
+ }
+
+ static int lm3630a_bank_b_get_brightness(struct backlight_device *bl)
+diff --git a/drivers/visorbus/visorchipset.c b/drivers/visorbus/visorchipset.c
+index cb1eb7e05f871..5668cad86e374 100644
+--- a/drivers/visorbus/visorchipset.c
++++ b/drivers/visorbus/visorchipset.c
+@@ -1561,7 +1561,7 @@ schedule_out:
+
+ static int visorchipset_init(struct acpi_device *acpi_device)
+ {
+- int err = -ENODEV;
++ int err = -ENOMEM;
+ struct visorchannel *controlvm_channel;
+
+ chipset_dev = kzalloc(sizeof(*chipset_dev), GFP_KERNEL);
+@@ -1584,8 +1584,10 @@ static int visorchipset_init(struct acpi_device *acpi_device)
+ "controlvm",
+ sizeof(struct visor_controlvm_channel),
+ VISOR_CONTROLVM_CHANNEL_VERSIONID,
+- VISOR_CHANNEL_SIGNATURE))
++ VISOR_CHANNEL_SIGNATURE)) {
++ err = -ENODEV;
+ goto error_delete_groups;
++ }
+ /* if booting in a crash kernel */
+ if (is_kdump_kernel())
+ INIT_DELAYED_WORK(&chipset_dev->periodic_controlvm_work,
+diff --git a/drivers/w1/slaves/w1_ds2438.c b/drivers/w1/slaves/w1_ds2438.c
+index 7c4e33dbee4d5..b005dda9c6978 100644
+--- a/drivers/w1/slaves/w1_ds2438.c
++++ b/drivers/w1/slaves/w1_ds2438.c
+@@ -64,13 +64,13 @@ static int w1_ds2438_get_page(struct w1_slave *sl, int pageno, u8 *buf)
+ if (w1_reset_select_slave(sl))
+ continue;
+ w1_buf[0] = W1_DS2438_RECALL_MEMORY;
+- w1_buf[1] = 0x00;
++ w1_buf[1] = (u8)pageno;
+ w1_write_block(sl->master, w1_buf, 2);
+
+ if (w1_reset_select_slave(sl))
+ continue;
+ w1_buf[0] = W1_DS2438_READ_SCRATCH;
+- w1_buf[1] = 0x00;
++ w1_buf[1] = (u8)pageno;
+ w1_write_block(sl->master, w1_buf, 2);
+
+ count = w1_read_block(sl->master, buf, DS2438_PAGE_SIZE + 1);
+diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c
+index d84d6cbd96977..814041d4e287e 100644
+--- a/drivers/watchdog/aspeed_wdt.c
++++ b/drivers/watchdog/aspeed_wdt.c
+@@ -149,7 +149,7 @@ static int aspeed_wdt_set_timeout(struct watchdog_device *wdd,
+
+ wdd->timeout = timeout;
+
+- actual = min(timeout, wdd->max_hw_heartbeat_ms * 1000);
++ actual = min(timeout, wdd->max_hw_heartbeat_ms / 1000);
+
+ writel(actual * WDT_RATE_1MHZ, wdt->base + WDT_RELOAD_VALUE);
+ writel(WDT_RESTART_MAGIC, wdt->base + WDT_RESTART);
+diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
+index 347f0389b0899..059c9eddb5468 100644
+--- a/drivers/watchdog/iTCO_wdt.c
++++ b/drivers/watchdog/iTCO_wdt.c
+@@ -75,6 +75,8 @@
+ #define TCOBASE(p) ((p)->tco_res->start)
+ /* SMI Control and Enable Register */
+ #define SMI_EN(p) ((p)->smi_res->start)
++#define TCO_EN (1 << 13)
++#define GBL_SMI_EN (1 << 0)
+
+ #define TCO_RLD(p) (TCOBASE(p) + 0x00) /* TCO Timer Reload/Curr. Value */
+ #define TCOv1_TMR(p) (TCOBASE(p) + 0x01) /* TCOv1 Timer Initial Value*/
+@@ -330,8 +332,12 @@ static int iTCO_wdt_set_timeout(struct watchdog_device *wd_dev, unsigned int t)
+
+ tmrval = seconds_to_ticks(p, t);
+
+- /* For TCO v1 the timer counts down twice before rebooting */
+- if (p->iTCO_version == 1)
++ /*
++ * If TCO SMIs are off, the timer counts down twice before rebooting.
++ * Otherwise, the BIOS generally reboots when the SMI triggers.
++ */
++ if (p->smi_res &&
++ (SMI_EN(p) & (TCO_EN | GBL_SMI_EN)) != (TCO_EN | GBL_SMI_EN))
+ tmrval /= 2;
+
+ /* from the specs: */
+@@ -493,7 +499,7 @@ static int iTCO_wdt_probe(struct platform_device *pdev)
+ * Disables TCO logic generating an SMI#
+ */
+ val32 = inl(SMI_EN(p));
+- val32 &= 0xffffdfff; /* Turn off SMI clearing watchdog */
++ val32 &= ~TCO_EN; /* Turn off SMI clearing watchdog */
+ outl(val32, SMI_EN(p));
+ }
+
+diff --git a/drivers/watchdog/lpc18xx_wdt.c b/drivers/watchdog/lpc18xx_wdt.c
+index 331cadb459ac5..48580b6406c25 100644
+--- a/drivers/watchdog/lpc18xx_wdt.c
++++ b/drivers/watchdog/lpc18xx_wdt.c
+@@ -301,7 +301,7 @@ static int lpc18xx_wdt_remove(struct platform_device *pdev)
+ struct lpc18xx_wdt_dev *lpc18xx_wdt = platform_get_drvdata(pdev);
+
+ dev_warn(&pdev->dev, "I quit now, hardware will probably reboot!\n");
+- del_timer(&lpc18xx_wdt->timer);
++ del_timer_sync(&lpc18xx_wdt->timer);
+
+ watchdog_unregister_device(&lpc18xx_wdt->wdt_dev);
+ clk_disable_unprepare(lpc18xx_wdt->wdt_clk);
+diff --git a/drivers/watchdog/sbc60xxwdt.c b/drivers/watchdog/sbc60xxwdt.c
+index 87333a41f7538..1702df7f8c386 100644
+--- a/drivers/watchdog/sbc60xxwdt.c
++++ b/drivers/watchdog/sbc60xxwdt.c
+@@ -152,7 +152,7 @@ static void wdt_startup(void)
+ static void wdt_turnoff(void)
+ {
+ /* Stop the timer */
+- del_timer(&timer);
++ del_timer_sync(&timer);
+ inb_p(wdt_stop);
+ pr_info("Watchdog timer is now disabled...\n");
+ }
+diff --git a/drivers/watchdog/sc520_wdt.c b/drivers/watchdog/sc520_wdt.c
+index 6aadb56e7faaa..809ebcaef51d9 100644
+--- a/drivers/watchdog/sc520_wdt.c
++++ b/drivers/watchdog/sc520_wdt.c
+@@ -190,7 +190,7 @@ static int wdt_startup(void)
+ static int wdt_turnoff(void)
+ {
+ /* Stop the timer */
+- del_timer(&timer);
++ del_timer_sync(&timer);
+
+ /* Stop the watchdog */
+ wdt_config(0);
+diff --git a/drivers/watchdog/w83877f_wdt.c b/drivers/watchdog/w83877f_wdt.c
+index 05658ecc0aa4c..ec4641fc2d211 100644
+--- a/drivers/watchdog/w83877f_wdt.c
++++ b/drivers/watchdog/w83877f_wdt.c
+@@ -170,7 +170,7 @@ static void wdt_startup(void)
+ static void wdt_turnoff(void)
+ {
+ /* Stop the timer */
+- del_timer(&timer);
++ del_timer_sync(&timer);
+
+ wdt_change(WDT_DISABLE);
+
+diff --git a/fs/btrfs/Kconfig b/fs/btrfs/Kconfig
+index 23537bc8c827c..7233127bb93ac 100644
+--- a/fs/btrfs/Kconfig
++++ b/fs/btrfs/Kconfig
+@@ -12,6 +12,8 @@ config BTRFS_FS
+ select RAID6_PQ
+ select XOR_BLOCKS
+ select SRCU
++ depends on !PPC_256K_PAGES # powerpc
++ depends on !PAGE_SIZE_256KB # hexagon
+
+ help
+ Btrfs is a general purpose copy-on-write filesystem with extents,
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index fea5ccfade5c6..1fbe2dee1e705 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -1030,12 +1030,10 @@ static int __btrfs_update_delayed_inode(struct btrfs_trans_handle *trans,
+ nofs_flag = memalloc_nofs_save();
+ ret = btrfs_lookup_inode(trans, root, path, &key, mod);
+ memalloc_nofs_restore(nofs_flag);
+- if (ret > 0) {
+- btrfs_release_path(path);
+- return -ENOENT;
+- } else if (ret < 0) {
+- return ret;
+- }
++ if (ret > 0)
++ ret = -ENOENT;
++ if (ret < 0)
++ goto out;
+
+ leaf = path->nodes[0];
+ inode_item = btrfs_item_ptr(leaf, path->slots[0],
+@@ -1073,6 +1071,14 @@ err_out:
+ btrfs_delayed_inode_release_metadata(fs_info, node, (ret < 0));
+ btrfs_release_delayed_inode(node);
+
++ /*
++ * If we fail to update the delayed inode we need to abort the
++ * transaction, because we could leave the inode with the improper
++ * counts behind.
++ */
++ if (ret && ret != -ENOENT)
++ btrfs_abort_transaction(trans, ret);
++
+ return ret;
+
+ search:
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 128398dde0816..1967d5fa681ad 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -4081,6 +4081,17 @@ static int process_recorded_refs(struct send_ctx *sctx, int *pending_move)
+ if (ret < 0)
+ goto out;
+ } else {
++ /*
++ * If we previously orphanized a directory that
++ * collided with a new reference that we already
++ * processed, recompute the current path because
++ * that directory may be part of the path.
++ */
++ if (orphanized_dir) {
++ ret = refresh_ref_path(sctx, cur);
++ if (ret < 0)
++ goto out;
++ }
+ ret = send_unlink(sctx, cur->full_path);
+ if (ret < 0)
+ goto out;
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 1b52c960682d6..049535115c9dc 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1311,8 +1311,10 @@ int btrfs_defrag_root(struct btrfs_root *root)
+
+ while (1) {
+ trans = btrfs_start_transaction(root, 0);
+- if (IS_ERR(trans))
+- return PTR_ERR(trans);
++ if (IS_ERR(trans)) {
++ ret = PTR_ERR(trans);
++ break;
++ }
+
+ ret = btrfs_defrag_leaves(trans, root);
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 93e59ce001742..3a7b7e9cb8896 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -5970,6 +5970,7 @@ next:
+ error:
+ if (wc.trans)
+ btrfs_end_transaction(wc.trans);
++ clear_bit(BTRFS_FS_LOG_RECOVERING, &fs_info->flags);
+ btrfs_free_path(path);
+ return ret;
+ }
+diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
+index e59b2f53a81f6..de10899da837c 100644
+--- a/fs/ceph/addr.c
++++ b/fs/ceph/addr.c
+@@ -75,10 +75,6 @@ static int ceph_set_page_dirty(struct page *page)
+ struct inode *inode;
+ struct ceph_inode_info *ci;
+ struct ceph_snap_context *snapc;
+- int ret;
+-
+- if (unlikely(!mapping))
+- return !TestSetPageDirty(page);
+
+ if (PageDirty(page)) {
+ dout("%p set_page_dirty %p idx %lu -- already dirty\n",
+@@ -124,11 +120,7 @@ static int ceph_set_page_dirty(struct page *page)
+ page->private = (unsigned long)snapc;
+ SetPagePrivate(page);
+
+- ret = __set_page_dirty_nobuffers(page);
+- WARN_ON(!PageLocked(page));
+- WARN_ON(!page->mapping);
+-
+- return ret;
++ return __set_page_dirty_nobuffers(page);
+ }
+
+ /*
+diff --git a/fs/configfs/file.c b/fs/configfs/file.c
+index 50b7c4c4310e0..38eb80e29715f 100644
+--- a/fs/configfs/file.c
++++ b/fs/configfs/file.c
+@@ -496,13 +496,13 @@ static int configfs_release_bin_file(struct inode *inode, struct file *file)
+ buffer->bin_buffer_size);
+ }
+ up_read(&frag->frag_sem);
+- /* vfree on NULL is safe */
+- vfree(buffer->bin_buffer);
+- buffer->bin_buffer = NULL;
+- buffer->bin_buffer_size = 0;
+- buffer->needs_read_fill = 1;
+ }
+
++ vfree(buffer->bin_buffer);
++ buffer->bin_buffer = NULL;
++ buffer->bin_buffer_size = 0;
++ buffer->needs_read_fill = 1;
++
+ configfs_release(inode, file);
+ return 0;
+ }
+diff --git a/fs/crypto/fname.c b/fs/crypto/fname.c
+index 17bb9a3fc0b01..052c137f1e70e 100644
+--- a/fs/crypto/fname.c
++++ b/fs/crypto/fname.c
+@@ -275,13 +275,8 @@ int fscrypt_fname_disk_to_usr(struct inode *inode,
+ oname->name);
+ return 0;
+ }
+- if (hash) {
+- digested_name.hash = hash;
+- digested_name.minor_hash = minor_hash;
+- } else {
+- digested_name.hash = 0;
+- digested_name.minor_hash = 0;
+- }
++ digested_name.hash = hash;
++ digested_name.minor_hash = minor_hash;
+ memcpy(digested_name.digest,
+ FSCRYPT_FNAME_DIGEST(iname->name, iname->len),
+ FSCRYPT_FNAME_DIGEST_SIZE);
+diff --git a/fs/dlm/config.c b/fs/dlm/config.c
+index f13d865244501..42b53e2a4e96d 100644
+--- a/fs/dlm/config.c
++++ b/fs/dlm/config.c
+@@ -80,6 +80,9 @@ struct dlm_cluster {
+ unsigned int cl_new_rsb_count;
+ unsigned int cl_recover_callbacks;
+ char cl_cluster_name[DLM_LOCKSPACE_LEN];
++
++ struct dlm_spaces *sps;
++ struct dlm_comms *cms;
+ };
+
+ static struct dlm_cluster *config_item_to_cluster(struct config_item *i)
+@@ -356,6 +359,9 @@ static struct config_group *make_cluster(struct config_group *g,
+ if (!cl || !sps || !cms)
+ goto fail;
+
++ cl->sps = sps;
++ cl->cms = cms;
++
+ config_group_init_type_name(&cl->group, name, &cluster_type);
+ config_group_init_type_name(&sps->ss_group, "spaces", &spaces_type);
+ config_group_init_type_name(&cms->cs_group, "comms", &comms_type);
+@@ -405,6 +411,9 @@ static void drop_cluster(struct config_group *g, struct config_item *i)
+ static void release_cluster(struct config_item *i)
+ {
+ struct dlm_cluster *cl = config_item_to_cluster(i);
++
++ kfree(cl->sps);
++ kfree(cl->cms);
+ kfree(cl);
+ }
+
+diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
+index a93ebffe84b38..f476a90e8aae1 100644
+--- a/fs/dlm/lowcomms.c
++++ b/fs/dlm/lowcomms.c
+@@ -609,7 +609,7 @@ static void close_connection(struct connection *con, bool and_other,
+ }
+ if (con->othercon && and_other) {
+ /* Will only re-enter once. */
+- close_connection(con->othercon, false, true, true);
++ close_connection(con->othercon, false, tx, rx);
+ }
+ if (con->rx_page) {
+ __free_page(con->rx_page);
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 093cb675841b0..2a45e0d3e593c 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -858,6 +858,7 @@ int ext4_ext_tree_init(handle_t *handle, struct inode *inode)
+ eh->eh_entries = 0;
+ eh->eh_magic = EXT4_EXT_MAGIC;
+ eh->eh_max = cpu_to_le16(ext4_ext_space_root(inode, 0));
++ eh->eh_generation = 0;
+ ext4_mark_inode_dirty(handle, inode);
+ return 0;
+ }
+@@ -1114,6 +1115,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
+ neh->eh_max = cpu_to_le16(ext4_ext_space_block(inode, 0));
+ neh->eh_magic = EXT4_EXT_MAGIC;
+ neh->eh_depth = 0;
++ neh->eh_generation = 0;
+
+ /* move remainder of path[depth] to the new leaf */
+ if (unlikely(path[depth].p_hdr->eh_entries !=
+@@ -1191,6 +1193,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
+ neh->eh_magic = EXT4_EXT_MAGIC;
+ neh->eh_max = cpu_to_le16(ext4_ext_space_block_idx(inode, 0));
+ neh->eh_depth = cpu_to_le16(depth - i);
++ neh->eh_generation = 0;
+ fidx = EXT_FIRST_INDEX(neh);
+ fidx->ei_block = border;
+ ext4_idx_store_pblock(fidx, oldblock);
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index c4e6fb15101b4..027c3e1b9f61a 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -1080,11 +1080,9 @@ static unsigned long ext4_es_scan(struct shrinker *shrink,
+ ret = percpu_counter_read_positive(&sbi->s_es_stats.es_stats_shk_cnt);
+ trace_ext4_es_shrink_scan_enter(sbi->s_sb, nr_to_scan, ret);
+
+- if (!nr_to_scan)
+- return ret;
+-
+ nr_shrunk = __es_shrink(sbi, nr_to_scan, NULL);
+
++ ret = percpu_counter_read_positive(&sbi->s_es_stats.es_stats_shk_cnt);
+ trace_ext4_es_shrink_scan_exit(sbi->s_sb, nr_shrunk, ret);
+ return nr_shrunk;
+ }
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 16abe23b1417a..5cb19fdf6450c 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -399,7 +399,7 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g,
+ *
+ * We always try to spread first-level directories.
+ *
+- * If there are blockgroups with both free inodes and free blocks counts
++ * If there are blockgroups with both free inodes and free clusters counts
+ * not worse than average we return one with smallest directory count.
+ * Otherwise we simply return a random group.
+ *
+@@ -408,7 +408,7 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g,
+ * It's OK to put directory into a group unless
+ * it has too many directories already (max_dirs) or
+ * it has too few free inodes left (min_inodes) or
+- * it has too few free blocks left (min_blocks) or
++ * it has too few free clusters left (min_clusters) or
+ * Parent's group is preferred, if it doesn't satisfy these
+ * conditions we search cyclically through the rest. If none
+ * of the groups look good we just look for a group with more
+@@ -424,7 +424,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,
+ ext4_group_t real_ngroups = ext4_get_groups_count(sb);
+ int inodes_per_group = EXT4_INODES_PER_GROUP(sb);
+ unsigned int freei, avefreei, grp_free;
+- ext4_fsblk_t freeb, avefreec;
++ ext4_fsblk_t freec, avefreec;
+ unsigned int ndirs;
+ int max_dirs, min_inodes;
+ ext4_grpblk_t min_clusters;
+@@ -443,9 +443,8 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,
+
+ freei = percpu_counter_read_positive(&sbi->s_freeinodes_counter);
+ avefreei = freei / ngroups;
+- freeb = EXT4_C2B(sbi,
+- percpu_counter_read_positive(&sbi->s_freeclusters_counter));
+- avefreec = freeb;
++ freec = percpu_counter_read_positive(&sbi->s_freeclusters_counter);
++ avefreec = freec;
+ do_div(avefreec, ngroups);
+ ndirs = percpu_counter_read_positive(&sbi->s_dirs_counter);
+
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index db47a06cfb74e..447aa17c804e2 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -1542,10 +1542,11 @@ static int mb_find_extent(struct ext4_buddy *e4b, int block,
+ if (ex->fe_start + ex->fe_len > EXT4_CLUSTERS_PER_GROUP(e4b->bd_sb)) {
+ /* Should never happen! (but apparently sometimes does?!?) */
+ WARN_ON(1);
+- ext4_error(e4b->bd_sb, "corruption or bug in mb_find_extent "
+- "block=%d, order=%d needed=%d ex=%u/%d/%d@%u",
+- block, order, needed, ex->fe_group, ex->fe_start,
+- ex->fe_len, ex->fe_logical);
++ ext4_grp_locked_error(e4b->bd_sb, e4b->bd_group, 0, 0,
++ "corruption or bug in mb_find_extent "
++ "block=%d, order=%d needed=%d ex=%u/%d/%d@%u",
++ block, order, needed, ex->fe_group, ex->fe_start,
++ ex->fe_len, ex->fe_logical);
+ ex->fe_len = 0;
+ ex->fe_start = 0;
+ ex->fe_group = 0;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 535ab6713732a..9ae3b6dd72fe8 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2689,8 +2689,15 @@ static void ext4_orphan_cleanup(struct super_block *sb,
+ inode_lock(inode);
+ truncate_inode_pages(inode->i_mapping, inode->i_size);
+ ret = ext4_truncate(inode);
+- if (ret)
++ if (ret) {
++ /*
++ * We need to clean up the in-core orphan list
++ * manually if ext4_truncate() failed to get a
++ * transaction handle.
++ */
++ ext4_orphan_del(NULL, inode);
+ ext4_std_error(inode->i_sb, ret);
++ }
+ inode_unlock(inode);
+ nr_truncates++;
+ } else {
+@@ -4517,6 +4524,7 @@ no_journal:
+ ext4_msg(sb, KERN_ERR,
+ "unable to initialize "
+ "flex_bg meta info!");
++ ret = -ENOMEM;
+ goto failed_mount6;
+ }
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 161ce0eb8891a..89fc8a4ce1497 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -3373,4 +3373,5 @@ module_exit(exit_f2fs_fs)
+ MODULE_AUTHOR("Samsung Electronics's Praesto Team");
+ MODULE_DESCRIPTION("Flash Friendly File System");
+ MODULE_LICENSE("GPL");
++MODULE_SOFTDEP("pre: crc32");
+
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index a247cb4b00e2d..869a34a489587 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -512,9 +512,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
+ /* find and pin the new wb */
+ rcu_read_lock();
+ memcg_css = css_from_id(new_wb_id, &memory_cgrp_subsys);
+- if (memcg_css)
+- isw->new_wb = wb_get_create(bdi, memcg_css, GFP_ATOMIC);
++ if (memcg_css && !css_tryget(memcg_css))
++ memcg_css = NULL;
+ rcu_read_unlock();
++ if (!memcg_css)
++ goto out_free;
++
++ isw->new_wb = wb_get_create(bdi, memcg_css, GFP_ATOMIC);
++ css_put(memcg_css);
+ if (!isw->new_wb)
+ goto out_free;
+
+@@ -2115,28 +2120,6 @@ int dirtytime_interval_handler(struct ctl_table *table, int write,
+ return ret;
+ }
+
+-static noinline void block_dump___mark_inode_dirty(struct inode *inode)
+-{
+- if (inode->i_ino || strcmp(inode->i_sb->s_id, "bdev")) {
+- struct dentry *dentry;
+- const char *name = "?";
+-
+- dentry = d_find_alias(inode);
+- if (dentry) {
+- spin_lock(&dentry->d_lock);
+- name = (const char *) dentry->d_name.name;
+- }
+- printk(KERN_DEBUG
+- "%s(%d): dirtied inode %lu (%s) on %s\n",
+- current->comm, task_pid_nr(current), inode->i_ino,
+- name, inode->i_sb->s_id);
+- if (dentry) {
+- spin_unlock(&dentry->d_lock);
+- dput(dentry);
+- }
+- }
+-}
+-
+ /**
+ * __mark_inode_dirty - internal function
+ *
+@@ -2196,9 +2179,6 @@ void __mark_inode_dirty(struct inode *inode, int flags)
+ (dirtytime && (inode->i_state & I_DIRTY_INODE)))
+ return;
+
+- if (unlikely(block_dump))
+- block_dump___mark_inode_dirty(inode);
+-
+ spin_lock(&inode->i_lock);
+ if (dirtytime && (inode->i_state & I_DIRTY_INODE))
+ goto out_unlock_inode;
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 1ff5a6b21db0b..8b22f8705dd48 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -1310,6 +1310,15 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
+ goto restart;
+ }
+ spin_lock(&fpq->lock);
++ /*
++ * Must not put request on fpq->io queue after having been shut down by
++ * fuse_abort_conn()
++ */
++ if (!fpq->connected) {
++ req->out.h.error = err = -ECONNABORTED;
++ goto out_end;
++
++ }
+ list_add(&req->list, &fpq->io);
+ spin_unlock(&fpq->lock);
+ cs->req = req;
+@@ -1887,7 +1896,7 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
+ }
+
+ err = -EINVAL;
+- if (oh.error <= -1000 || oh.error > 0)
++ if (oh.error <= -512 || oh.error > 0)
+ goto err_finish;
+
+ spin_lock(&fpq->lock);
+diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
+index 054cc761b426f..87b41edc800d0 100644
+--- a/fs/jfs/inode.c
++++ b/fs/jfs/inode.c
+@@ -161,7 +161,8 @@ void jfs_evict_inode(struct inode *inode)
+ if (test_cflag(COMMIT_Freewmap, inode))
+ jfs_free_zero_link(inode);
+
+- diFree(inode);
++ if (JFS_SBI(inode->i_sb)->ipimap)
++ diFree(inode);
+
+ /*
+ * Free the inode from the quota allocation.
+diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
+index 6b68df3958924..356d1fcf71196 100644
+--- a/fs/jfs/jfs_logmgr.c
++++ b/fs/jfs/jfs_logmgr.c
+@@ -1338,6 +1338,7 @@ int lmLogInit(struct jfs_log * log)
+ } else {
+ if (memcmp(logsuper->uuid, log->uuid, 16)) {
+ jfs_warn("wrong uuid on JFS log device");
++ rc = -EINVAL;
+ goto errout20;
+ }
+ log->size = le32_to_cpu(logsuper->size);
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index dc55ecc3bec46..2cdd8883b7c5d 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1038,6 +1038,7 @@ EXPORT_SYMBOL_GPL(nfs_inode_attach_open_context);
+ void nfs_file_set_open_context(struct file *filp, struct nfs_open_context *ctx)
+ {
+ filp->private_data = get_nfs_open_context(ctx);
++ set_bit(NFS_CONTEXT_FILE_OPEN, &ctx->flags);
+ if (list_empty(&ctx->list))
+ nfs_inode_attach_open_context(ctx);
+ }
+@@ -1057,6 +1058,8 @@ struct nfs_open_context *nfs_find_open_context(struct inode *inode, struct rpc_c
+ continue;
+ if ((pos->mode & (FMODE_READ|FMODE_WRITE)) != mode)
+ continue;
++ if (!test_bit(NFS_CONTEXT_FILE_OPEN, &pos->flags))
++ continue;
+ ctx = get_nfs_open_context(pos);
+ break;
+ }
+@@ -1071,6 +1074,7 @@ void nfs_file_clear_open_context(struct file *filp)
+ if (ctx) {
+ struct inode *inode = d_inode(ctx->dentry);
+
++ clear_bit(NFS_CONTEXT_FILE_OPEN, &ctx->flags);
+ /*
+ * We fatal error on write before. Try to writeback
+ * every page again.
+diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
+index ec8a9efa268fe..e302f8370b9b8 100644
+--- a/fs/nfs/nfs3proc.c
++++ b/fs/nfs/nfs3proc.c
+@@ -346,7 +346,7 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
+ break;
+
+ case NFS3_CREATE_UNCHECKED:
+- goto out;
++ goto out_release_acls;
+ }
+ nfs_fattr_init(data->res.dir_attr);
+ nfs_fattr_init(data->res.fattr);
+@@ -695,7 +695,7 @@ nfs3_proc_mknod(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
+ break;
+ default:
+ status = -EINVAL;
+- goto out;
++ goto out_release_acls;
+ }
+
+ status = nfs3_do_create(dir, dentry, data);
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index b5ce70c4ec87f..43659326b5191 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -191,8 +191,11 @@ void nfs40_shutdown_client(struct nfs_client *clp)
+
+ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ {
+- int err;
++ char buf[INET6_ADDRSTRLEN + 1];
++ const char *ip_addr = cl_init->ip_addr;
+ struct nfs_client *clp = nfs_alloc_client(cl_init);
++ int err;
++
+ if (IS_ERR(clp))
+ return clp;
+
+@@ -216,6 +219,44 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ init_waitqueue_head(&clp->cl_lock_waitq);
+ #endif
+ INIT_LIST_HEAD(&clp->pending_cb_stateids);
++
++ if (cl_init->minorversion != 0)
++ __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags);
++ __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags);
++ __set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags);
++
++ /*
++ * Set up the connection to the server before we add add to the
++ * global list.
++ */
++ err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I);
++ if (err == -EINVAL)
++ err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX);
++ if (err < 0)
++ goto error;
++
++ /* If no clientaddr= option was specified, find a usable cb address */
++ if (ip_addr == NULL) {
++ struct sockaddr_storage cb_addr;
++ struct sockaddr *sap = (struct sockaddr *)&cb_addr;
++
++ err = rpc_localaddr(clp->cl_rpcclient, sap, sizeof(cb_addr));
++ if (err < 0)
++ goto error;
++ err = rpc_ntop(sap, buf, sizeof(buf));
++ if (err < 0)
++ goto error;
++ ip_addr = (const char *)buf;
++ }
++ strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
++
++ err = nfs_idmap_new(clp);
++ if (err < 0) {
++ dprintk("%s: failed to create idmapper. Error = %d\n",
++ __func__, err);
++ goto error;
++ }
++ __set_bit(NFS_CS_IDMAP, &clp->cl_res_state);
+ return clp;
+
+ error:
+@@ -368,8 +409,6 @@ static int nfs4_init_client_minor_version(struct nfs_client *clp)
+ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
+ const struct nfs_client_initdata *cl_init)
+ {
+- char buf[INET6_ADDRSTRLEN + 1];
+- const char *ip_addr = cl_init->ip_addr;
+ struct nfs_client *old;
+ int error;
+
+@@ -377,43 +416,6 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
+ /* the client is initialised already */
+ return clp;
+
+- /* Check NFS protocol revision and initialize RPC op vector */
+- clp->rpc_ops = &nfs_v4_clientops;
+-
+- if (clp->cl_minorversion != 0)
+- __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags);
+- __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags);
+- __set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags);
+-
+- error = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I);
+- if (error == -EINVAL)
+- error = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX);
+- if (error < 0)
+- goto error;
+-
+- /* If no clientaddr= option was specified, find a usable cb address */
+- if (ip_addr == NULL) {
+- struct sockaddr_storage cb_addr;
+- struct sockaddr *sap = (struct sockaddr *)&cb_addr;
+-
+- error = rpc_localaddr(clp->cl_rpcclient, sap, sizeof(cb_addr));
+- if (error < 0)
+- goto error;
+- error = rpc_ntop(sap, buf, sizeof(buf));
+- if (error < 0)
+- goto error;
+- ip_addr = (const char *)buf;
+- }
+- strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
+-
+- error = nfs_idmap_new(clp);
+- if (error < 0) {
+- dprintk("%s: failed to create idmapper. Error = %d\n",
+- __func__, error);
+- goto error;
+- }
+- __set_bit(NFS_CS_IDMAP, &clp->cl_res_state);
+-
+ error = nfs4_init_client_minor_version(clp);
+ if (error < 0)
+ goto error;
+diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
+index acfb52bc0007d..3f0c2436254ac 100644
+--- a/fs/nfs/pnfs_nfs.c
++++ b/fs/nfs/pnfs_nfs.c
+@@ -555,19 +555,16 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(nfs4_pnfs_ds_add);
+
+-static void nfs4_wait_ds_connect(struct nfs4_pnfs_ds *ds)
++static int nfs4_wait_ds_connect(struct nfs4_pnfs_ds *ds)
+ {
+ might_sleep();
+- wait_on_bit(&ds->ds_state, NFS4DS_CONNECTING,
+- TASK_KILLABLE);
++ return wait_on_bit(&ds->ds_state, NFS4DS_CONNECTING, TASK_KILLABLE);
+ }
+
+ static void nfs4_clear_ds_conn_bit(struct nfs4_pnfs_ds *ds)
+ {
+ smp_mb__before_atomic();
+- clear_bit(NFS4DS_CONNECTING, &ds->ds_state);
+- smp_mb__after_atomic();
+- wake_up_bit(&ds->ds_state, NFS4DS_CONNECTING);
++ clear_and_wake_up_bit(NFS4DS_CONNECTING, &ds->ds_state);
+ }
+
+ static struct nfs_client *(*get_v3_ds_connect)(
+@@ -728,30 +725,33 @@ int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
+ {
+ int err;
+
+-again:
+- err = 0;
+- if (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) == 0) {
+- if (version == 3) {
+- err = _nfs4_pnfs_v3_ds_connect(mds_srv, ds, timeo,
+- retrans);
+- } else if (version == 4) {
+- err = _nfs4_pnfs_v4_ds_connect(mds_srv, ds, timeo,
+- retrans, minor_version);
+- } else {
+- dprintk("%s: unsupported DS version %d\n", __func__,
+- version);
+- err = -EPROTONOSUPPORT;
+- }
++ do {
++ err = nfs4_wait_ds_connect(ds);
++ if (err || ds->ds_clp)
++ goto out;
++ if (nfs4_test_deviceid_unavailable(devid))
++ return -ENODEV;
++ } while (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) != 0);
+
+- nfs4_clear_ds_conn_bit(ds);
+- } else {
+- nfs4_wait_ds_connect(ds);
++ if (ds->ds_clp)
++ goto connect_done;
+
+- /* what was waited on didn't connect AND didn't mark unavail */
+- if (!ds->ds_clp && !nfs4_test_deviceid_unavailable(devid))
+- goto again;
++ switch (version) {
++ case 3:
++ err = _nfs4_pnfs_v3_ds_connect(mds_srv, ds, timeo, retrans);
++ break;
++ case 4:
++ err = _nfs4_pnfs_v4_ds_connect(mds_srv, ds, timeo, retrans,
++ minor_version);
++ break;
++ default:
++ dprintk("%s: unsupported DS version %d\n", __func__, version);
++ err = -EPROTONOSUPPORT;
+ }
+
++connect_done:
++ nfs4_clear_ds_conn_bit(ds);
++out:
+ /*
+ * At this point the ds->ds_clp should be ready, but it might have
+ * hit an error.
+diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
+index a2fb866ff76e8..e844b43f2eacf 100644
+--- a/fs/ntfs/inode.c
++++ b/fs/ntfs/inode.c
+@@ -502,7 +502,7 @@ err_corrupt_attr:
+ }
+ file_name_attr = (FILE_NAME_ATTR*)((u8*)attr +
+ le16_to_cpu(attr->data.resident.value_offset));
+- p2 = (u8*)attr + le32_to_cpu(attr->data.resident.value_length);
++ p2 = (u8 *)file_name_attr + le32_to_cpu(attr->data.resident.value_length);
+ if (p2 < (u8*)attr || p2 > p)
+ goto err_corrupt_attr;
+ /* This attribute is ok, but is it in the $Extend directory? */
+diff --git a/fs/ocfs2/filecheck.c b/fs/ocfs2/filecheck.c
+index 1906cc962c4d9..345ca9e140289 100644
+--- a/fs/ocfs2/filecheck.c
++++ b/fs/ocfs2/filecheck.c
+@@ -336,11 +336,7 @@ static ssize_t ocfs2_filecheck_attr_show(struct kobject *kobj,
+ ret = snprintf(buf + total, remain, "%lu\t\t%u\t%s\n",
+ p->fe_ino, p->fe_done,
+ ocfs2_filecheck_error(p->fe_status));
+- if (ret < 0) {
+- total = ret;
+- break;
+- }
+- if (ret == remain) {
++ if (ret >= remain) {
+ /* snprintf() didn't fit */
+ total = -E2BIG;
+ break;
+diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
+index c4b029c43464e..e7eb08ac42156 100644
+--- a/fs/ocfs2/stackglue.c
++++ b/fs/ocfs2/stackglue.c
+@@ -510,11 +510,7 @@ static ssize_t ocfs2_loaded_cluster_plugins_show(struct kobject *kobj,
+ list_for_each_entry(p, &ocfs2_stack_list, sp_list) {
+ ret = snprintf(buf, remain, "%s\n",
+ p->sp_name);
+- if (ret < 0) {
+- total = ret;
+- break;
+- }
+- if (ret == remain) {
++ if (ret >= remain) {
+ /* snprintf() didn't fit */
+ total = -E2BIG;
+ break;
+@@ -541,7 +537,7 @@ static ssize_t ocfs2_active_cluster_plugin_show(struct kobject *kobj,
+ if (active_stack) {
+ ret = snprintf(buf, PAGE_SIZE, "%s\n",
+ active_stack->sp_name);
+- if (ret == PAGE_SIZE)
++ if (ret >= PAGE_SIZE)
+ ret = -E2BIG;
+ }
+ spin_unlock(&ocfs2_stack_lock);
+diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
+index dfaee90d30bde..524fd95173b3a 100644
+--- a/fs/orangefs/super.c
++++ b/fs/orangefs/super.c
+@@ -195,7 +195,7 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ buf->f_bavail = (sector_t) new_op->downcall.resp.statfs.blocks_avail;
+ buf->f_files = (sector_t) new_op->downcall.resp.statfs.files_total;
+ buf->f_ffree = (sector_t) new_op->downcall.resp.statfs.files_avail;
+- buf->f_frsize = sb->s_blocksize;
++ buf->f_frsize = 0;
+
+ out_op_release:
+ op_release(new_op);
+diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
+index 8a76f9d14bc66..78be6dbcd7627 100644
+--- a/fs/reiserfs/journal.c
++++ b/fs/reiserfs/journal.c
+@@ -2772,6 +2772,20 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
+ goto free_and_return;
+ }
+
++ /*
++ * Sanity check to see if journal first block is correct.
++ * If journal first block is invalid it can cause
++ * zeroing important superblock members.
++ */
++ if (!SB_ONDISK_JOURNAL_DEVICE(sb) &&
++ SB_ONDISK_JOURNAL_1st_BLOCK(sb) < SB_JOURNAL_1st_RESERVED_BLOCK(sb)) {
++ reiserfs_warning(sb, "journal-1393",
++ "journal 1st super block is invalid: 1st reserved block %d, but actual 1st block is %d",
++ SB_JOURNAL_1st_RESERVED_BLOCK(sb),
++ SB_ONDISK_JOURNAL_1st_BLOCK(sb));
++ goto free_and_return;
++ }
++
+ if (journal_init_dev(sb, journal, j_dev_name) != 0) {
+ reiserfs_warning(sb, "sh-462",
+ "unable to initialize journal device");
+diff --git a/fs/seq_file.c b/fs/seq_file.c
+index 05e58b56f6202..e11f62b29be87 100644
+--- a/fs/seq_file.c
++++ b/fs/seq_file.c
+@@ -29,6 +29,9 @@ static void seq_set_overflow(struct seq_file *m)
+
+ static void *seq_buf_alloc(unsigned long size)
+ {
++ if (unlikely(size > MAX_RW_COUNT))
++ return NULL;
++
+ return kvmalloc(size, GFP_KERNEL_ACCOUNT);
+ }
+
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index 8fe2ee5462a0b..dbdf6a4230fbd 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -1354,7 +1354,10 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
+ goto out_release;
+ }
+
++ spin_lock(&whiteout->i_lock);
+ whiteout->i_state |= I_LINKABLE;
++ spin_unlock(&whiteout->i_lock);
++
+ whiteout_ui = ubifs_inode(whiteout);
+ whiteout_ui->data = dev;
+ whiteout_ui->data_len = ubifs_encode_dev(dev, MKDEV(0, 0));
+@@ -1447,7 +1450,11 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
+
+ inc_nlink(whiteout);
+ mark_inode_dirty(whiteout);
++
++ spin_lock(&whiteout->i_lock);
+ whiteout->i_state &= ~I_LINKABLE;
++ spin_unlock(&whiteout->i_lock);
++
+ iput(whiteout);
+ }
+
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index 58cc2414992b6..9cfb555db1add 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -948,6 +948,10 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry,
+ iinfo->i_location.partitionReferenceNum,
+ 0);
+ epos.bh = udf_tgetblk(sb, block);
++ if (unlikely(!epos.bh)) {
++ err = -ENOMEM;
++ goto out_no_entry;
++ }
+ lock_buffer(epos.bh);
+ memset(epos.bh->b_data, 0x00, bsize);
+ set_buffer_uptodate(epos.bh);
+diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h
+index a0b0ad9d585e6..64283c22f1eef 100644
+--- a/include/crypto/internal/hash.h
++++ b/include/crypto/internal/hash.h
+@@ -82,13 +82,7 @@ int ahash_register_instance(struct crypto_template *tmpl,
+ struct ahash_instance *inst);
+ void ahash_free_instance(struct crypto_instance *inst);
+
+-int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
+- unsigned int keylen);
+-
+-static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg)
+-{
+- return alg->setkey != shash_no_setkey;
+-}
++bool crypto_shash_alg_has_setkey(struct shash_alg *alg);
+
+ bool crypto_hash_alg_has_setkey(struct hash_alg_common *halg);
+
+diff --git a/include/linux/mfd/abx500/ux500_chargalg.h b/include/linux/mfd/abx500/ux500_chargalg.h
+index 669894f434f5b..12c38054f7d1d 100644
+--- a/include/linux/mfd/abx500/ux500_chargalg.h
++++ b/include/linux/mfd/abx500/ux500_chargalg.h
+@@ -15,7 +15,7 @@
+ * - POWER_SUPPLY_TYPE_USB,
+ * because only them store as drv_data pointer to struct ux500_charger.
+ */
+-#define psy_to_ux500_charger(x) power_supply_get_drvdata(psy)
++#define psy_to_ux500_charger(x) power_supply_get_drvdata(x)
+
+ /* Forward declaration */
+ struct ux500_charger;
+diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
+index 4c76fe2c84880..2a8105d204a96 100644
+--- a/include/linux/netdev_features.h
++++ b/include/linux/netdev_features.h
+@@ -88,7 +88,7 @@ enum {
+
+ /*
+ * Add your fresh new feature above and remember to update
+- * netdev_features_strings[] in net/core/ethtool.c and maybe
++ * netdev_features_strings[] in net/ethtool/common.c and maybe
+ * some feature mask #defines below. Please also describe it
+ * in Documentation/networking/netdev-features.txt.
+ */
+diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
+index a0831e9d19c9d..0ff7dd2bf8a4f 100644
+--- a/include/linux/nfs_fs.h
++++ b/include/linux/nfs_fs.h
+@@ -78,6 +78,7 @@ struct nfs_open_context {
+ #define NFS_CONTEXT_RESEND_WRITES (1)
+ #define NFS_CONTEXT_BAD (2)
+ #define NFS_CONTEXT_UNLOCK (3)
++#define NFS_CONTEXT_FILE_OPEN (4)
+ int error;
+
+ struct list_head list;
+diff --git a/include/linux/prandom.h b/include/linux/prandom.h
+index cc1e71334e53c..e20339c78a84c 100644
+--- a/include/linux/prandom.h
++++ b/include/linux/prandom.h
+@@ -93,7 +93,7 @@ static inline u32 __seed(u32 x, u32 m)
+ */
+ static inline void prandom_seed_state(struct rnd_state *state, u64 seed)
+ {
+- u32 i = (seed >> 32) ^ (seed << 10) ^ seed;
++ u32 i = ((seed >> 32) ^ (seed << 10) ^ seed) & 0xffffffffUL;
+
+ state->s1 = __seed(i, 2U);
+ state->s2 = __seed(i, 8U);
+diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
+index 444aa73037f19..4251cbfdb3c8c 100644
+--- a/include/linux/tracepoint.h
++++ b/include/linux/tracepoint.h
+@@ -42,7 +42,17 @@ extern int
+ tracepoint_probe_register_prio(struct tracepoint *tp, void *probe, void *data,
+ int prio);
+ extern int
++tracepoint_probe_register_prio_may_exist(struct tracepoint *tp, void *probe, void *data,
++ int prio);
++extern int
+ tracepoint_probe_unregister(struct tracepoint *tp, void *probe, void *data);
++static inline int
++tracepoint_probe_register_may_exist(struct tracepoint *tp, void *probe,
++ void *data)
++{
++ return tracepoint_probe_register_prio_may_exist(tp, probe, data,
++ TRACEPOINT_DEFAULT_PRIO);
++}
+ extern void
+ for_each_kernel_tracepoint(void (*fct)(struct tracepoint *tp, void *priv),
+ void *priv);
+diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h
+index 9102d6ca566e0..eac37dd3e3bae 100644
+--- a/include/media/v4l2-subdev.h
++++ b/include/media/v4l2-subdev.h
+@@ -171,6 +171,9 @@ struct v4l2_subdev_io_pin_config {
+ * @s_gpio: set GPIO pins. Very simple right now, might need to be extended with
+ * a direction argument if needed.
+ *
++ * @command: called by in-kernel drivers in order to call functions internal
++ * to subdev drivers driver that have a separate callback.
++ *
+ * @ioctl: called at the end of ioctl() syscall handler at the V4L2 core.
+ * used to provide support for private ioctls used on the driver.
+ *
+@@ -202,6 +205,7 @@ struct v4l2_subdev_core_ops {
+ int (*load_fw)(struct v4l2_subdev *sd);
+ int (*reset)(struct v4l2_subdev *sd, u32 val);
+ int (*s_gpio)(struct v4l2_subdev *sd, u32 val);
++ long (*command)(struct v4l2_subdev *sd, unsigned int cmd, void *arg);
+ long (*ioctl)(struct v4l2_subdev *sd, unsigned int cmd, void *arg);
+ #ifdef CONFIG_COMPAT
+ long (*compat_ioctl32)(struct v4l2_subdev *sd, unsigned int cmd,
+diff --git a/include/net/ip.h b/include/net/ip.h
+index aad003685c31d..e8fa25280cbfd 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -34,6 +34,7 @@
+ #include <net/flow.h>
+ #include <net/flow_dissector.h>
+ #include <net/netns/hash.h>
++#include <net/lwtunnel.h>
+
+ #define IPV4_MAX_PMTU 65535U /* RFC 2675, Section 5.1 */
+ #define IPV4_MIN_MTU 68 /* RFC 791 */
+@@ -408,22 +409,25 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
+
+ /* 'forwarding = true' case should always honour route mtu */
+ mtu = dst_metric_raw(dst, RTAX_MTU);
+- if (mtu)
+- return mtu;
++ if (!mtu)
++ mtu = min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU);
+
+- return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU);
++ return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
+ }
+
+ static inline unsigned int ip_skb_dst_mtu(struct sock *sk,
+ const struct sk_buff *skb)
+ {
++ unsigned int mtu;
++
+ if (!sk || !sk_fullsock(sk) || ip_sk_use_pmtu(sk)) {
+ bool forwarding = IPCB(skb)->flags & IPSKB_FORWARDED;
+
+ return ip_dst_mtu_maybe_forward(skb_dst(skb), forwarding);
+ }
+
+- return min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU);
++ mtu = min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU);
++ return mtu - lwtunnel_headroom(skb_dst(skb)->lwtstate, mtu);
+ }
+
+ int ip_metrics_convert(struct net *net, struct nlattr *fc_mx, int fc_mx_len,
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 5e26d61867b21..5c38a80cee3a2 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -243,11 +243,18 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+
+ static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
+ {
++ int mtu;
++
+ struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
+ inet6_sk(skb->sk) : NULL;
+
+- return (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) ?
+- skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
++ if (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) {
++ mtu = READ_ONCE(skb_dst(skb)->dev->mtu);
++ mtu -= lwtunnel_headroom(skb_dst(skb)->lwtstate, mtu);
++ } else
++ mtu = dst_mtu(skb_dst(skb));
++
++ return mtu;
+ }
+
+ static inline bool ip6_sk_accept_pmtu(const struct sock *sk)
+@@ -288,7 +295,7 @@ static inline unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
+ if (dst_metric_locked(dst, RTAX_MTU)) {
+ mtu = dst_metric_raw(dst, RTAX_MTU);
+ if (mtu)
+- return mtu;
++ goto out;
+ }
+
+ mtu = IPV6_MIN_MTU;
+@@ -298,7 +305,8 @@ static inline unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
+ mtu = idev->cnf.mtu6;
+ rcu_read_unlock();
+
+- return mtu;
++out:
++ return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
+ }
+
+ u32 ip6_mtu_from_fib6(struct fib6_info *f6i, struct in6_addr *daddr,
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index 19f8d5881b08d..2882bc7a5b4b8 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -474,7 +474,7 @@ struct sctp_af {
+ int saddr);
+ void (*from_sk) (union sctp_addr *,
+ struct sock *sk);
+- void (*from_addr_param) (union sctp_addr *,
++ bool (*from_addr_param) (union sctp_addr *,
+ union sctp_addr_param *,
+ __be16 port, int iif);
+ int (*to_addr_param) (const union sctp_addr *,
+diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
+index 1ee0f30ae190b..647f1e0e726c9 100644
+--- a/include/scsi/libiscsi.h
++++ b/include/scsi/libiscsi.h
+@@ -208,12 +208,6 @@ struct iscsi_conn {
+ unsigned long suspend_tx; /* suspend Tx */
+ unsigned long suspend_rx; /* suspend Rx */
+
+- /* abort */
+- wait_queue_head_t ehwait; /* used in eh_abort() */
+- struct iscsi_tm tmhdr;
+- struct timer_list tmf_timer;
+- int tmf_state; /* see TMF_INITIAL, etc.*/
+-
+ /* negotiated params */
+ unsigned max_recv_dlength; /* initiator_max_recv_dsl*/
+ unsigned max_xmit_dlength; /* target_max_recv_dsl */
+@@ -283,6 +277,11 @@ struct iscsi_session {
+ * and recv lock.
+ */
+ struct mutex eh_mutex;
++ /* abort */
++ wait_queue_head_t ehwait; /* used in eh_abort() */
++ struct iscsi_tm tmhdr;
++ struct timer_list tmf_timer;
++ int tmf_state; /* see TMF_INITIAL, etc.*/
+
+ /* iSCSI session-wide sequencing */
+ uint32_t cmdsn;
+diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
+index b266d2a3bcb1d..484e9787d817b 100644
+--- a/include/scsi/scsi_transport_iscsi.h
++++ b/include/scsi/scsi_transport_iscsi.h
+@@ -436,6 +436,8 @@ extern void iscsi_remove_session(struct iscsi_cls_session *session);
+ extern void iscsi_free_session(struct iscsi_cls_session *session);
+ extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
+ int dd_size, uint32_t cid);
++extern void iscsi_put_conn(struct iscsi_cls_conn *conn);
++extern void iscsi_get_conn(struct iscsi_cls_conn *conn);
+ extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
+ extern void iscsi_unblock_session(struct iscsi_cls_session *session);
+ extern void iscsi_block_session(struct iscsi_cls_session *session);
+diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
+index fc21d3726b591..35b11c246aeb2 100644
+--- a/include/uapi/linux/ethtool.h
++++ b/include/uapi/linux/ethtool.h
+@@ -227,7 +227,7 @@ enum tunable_id {
+ ETHTOOL_PFC_PREVENTION_TOUT, /* timeout in msecs */
+ /*
+ * Add your fresh new tunable attribute above and remember to update
+- * tunable_strings[] in net/core/ethtool.c
++ * tunable_strings[] in net/ethtool/common.c
+ */
+ __ETHTOOL_TUNABLE_COUNT,
+ };
+@@ -261,7 +261,7 @@ enum phy_tunable_id {
+ ETHTOOL_PHY_DOWNSHIFT,
+ /*
+ * Add your fresh new phy tunable attribute above and remember to update
+- * phy_tunable_strings[] in net/core/ethtool.c
++ * phy_tunable_strings[] in net/ethtool/common.c
+ */
+ __ETHTOOL_PHY_TUNABLE_COUNT,
+ };
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 9a39a24f60253..d6fd362afc81f 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -31,6 +31,7 @@
+ #include <linux/relay.h>
+ #include <linux/slab.h>
+ #include <linux/percpu-rwsem.h>
++#include <linux/cpuset.h>
+
+ #include <trace/events/power.h>
+ #define CREATE_TRACE_POINTS
+@@ -775,6 +776,52 @@ void __init cpuhp_threads_init(void)
+ kthread_unpark(this_cpu_read(cpuhp_state.thread));
+ }
+
++/*
++ *
++ * Serialize hotplug trainwrecks outside of the cpu_hotplug_lock
++ * protected region.
++ *
++ * The operation is still serialized against concurrent CPU hotplug via
++ * cpu_add_remove_lock, i.e. CPU map protection. But it is _not_
++ * serialized against other hotplug related activity like adding or
++ * removing of state callbacks and state instances, which invoke either the
++ * startup or the teardown callback of the affected state.
++ *
++ * This is required for subsystems which are unfixable vs. CPU hotplug and
++ * evade lock inversion problems by scheduling work which has to be
++ * completed _before_ cpu_up()/_cpu_down() returns.
++ *
++ * Don't even think about adding anything to this for any new code or even
++ * drivers. It's only purpose is to keep existing lock order trainwrecks
++ * working.
++ *
++ * For cpu_down() there might be valid reasons to finish cleanups which are
++ * not required to be done under cpu_hotplug_lock, but that's a different
++ * story and would be not invoked via this.
++ */
++static void cpu_up_down_serialize_trainwrecks(bool tasks_frozen)
++{
++ /*
++ * cpusets delegate hotplug operations to a worker to "solve" the
++ * lock order problems. Wait for the worker, but only if tasks are
++ * _not_ frozen (suspend, hibernate) as that would wait forever.
++ *
++ * The wait is required because otherwise the hotplug operation
++ * returns with inconsistent state, which could even be observed in
++ * user space when a new CPU is brought up. The CPU plug uevent
++ * would be delivered and user space reacting on it would fail to
++ * move tasks to the newly plugged CPU up to the point where the
++ * work has finished because up to that point the newly plugged CPU
++ * is not assignable in cpusets/cgroups. On unplug that's not
++ * necessarily a visible issue, but it is still inconsistent state,
++ * which is the real problem which needs to be "fixed". This can't
++ * prevent the transient state between scheduling the work and
++ * returning from waiting for it.
++ */
++ if (!tasks_frozen)
++ cpuset_wait_for_hotplug();
++}
++
+ #ifdef CONFIG_HOTPLUG_CPU
+ #ifndef arch_clear_mm_cpumask_cpu
+ #define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm))
+@@ -1010,6 +1057,7 @@ out:
+ */
+ lockup_detector_cleanup();
+ arch_smt_update();
++ cpu_up_down_serialize_trainwrecks(tasks_frozen);
+ return ret;
+ }
+
+@@ -1145,6 +1193,7 @@ static int _cpu_up(unsigned int cpu, int tasks_frozen, enum cpuhp_state target)
+ out:
+ cpus_write_unlock();
+ arch_smt_update();
++ cpu_up_down_serialize_trainwrecks(tasks_frozen);
+ return ret;
+ }
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index acb34e9df5515..9cdbc07bb70f3 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -2940,7 +2940,7 @@ void reweight_task(struct task_struct *p, int prio)
+ *
+ * tg->weight * grq->load.weight
+ * ge->load.weight = ----------------------------- (1)
+- * \Sum grq->load.weight
++ * \Sum grq->load.weight
+ *
+ * Now, because computing that sum is prohibitively expensive to compute (been
+ * there, done that) we approximate it with this average stuff. The average
+@@ -2954,7 +2954,7 @@ void reweight_task(struct task_struct *p, int prio)
+ *
+ * tg->weight * grq->avg.load_avg
+ * ge->load.weight = ------------------------------ (3)
+- * tg->load_avg
++ * tg->load_avg
+ *
+ * Where: tg->load_avg ~= \Sum grq->avg.load_avg
+ *
+@@ -2970,7 +2970,7 @@ void reweight_task(struct task_struct *p, int prio)
+ *
+ * tg->weight * grq->load.weight
+ * ge->load.weight = ----------------------------- = tg->weight (4)
+- * grp->load.weight
++ * grp->load.weight
+ *
+ * That is, the sum collapses because all other CPUs are idle; the UP scenario.
+ *
+@@ -2989,7 +2989,7 @@ void reweight_task(struct task_struct *p, int prio)
+ *
+ * tg->weight * grq->load.weight
+ * ge->load.weight = ----------------------------- (6)
+- * tg_load_avg'
++ * tg_load_avg'
+ *
+ * Where:
+ *
+diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
+index f80bb104c41a7..221f8e7464c5d 100644
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -142,6 +142,13 @@ static void __clocksource_change_rating(struct clocksource *cs, int rating);
+ #define WATCHDOG_INTERVAL (HZ >> 1)
+ #define WATCHDOG_THRESHOLD (NSEC_PER_SEC >> 4)
+
++/*
++ * Maximum permissible delay between two readouts of the watchdog
++ * clocksource surrounding a read of the clocksource being validated.
++ * This delay could be due to SMIs, NMIs, or to VCPU preemptions.
++ */
++#define WATCHDOG_MAX_SKEW (100 * NSEC_PER_USEC)
++
+ static void clocksource_watchdog_work(struct work_struct *work)
+ {
+ /*
+@@ -202,12 +209,45 @@ void clocksource_mark_unstable(struct clocksource *cs)
+ spin_unlock_irqrestore(&watchdog_lock, flags);
+ }
+
++static ulong max_cswd_read_retries = 3;
++module_param(max_cswd_read_retries, ulong, 0644);
++
++static bool cs_watchdog_read(struct clocksource *cs, u64 *csnow, u64 *wdnow)
++{
++ unsigned int nretries;
++ u64 wd_end, wd_delta;
++ int64_t wd_delay;
++
++ for (nretries = 0; nretries <= max_cswd_read_retries; nretries++) {
++ local_irq_disable();
++ *wdnow = watchdog->read(watchdog);
++ *csnow = cs->read(cs);
++ wd_end = watchdog->read(watchdog);
++ local_irq_enable();
++
++ wd_delta = clocksource_delta(wd_end, *wdnow, watchdog->mask);
++ wd_delay = clocksource_cyc2ns(wd_delta, watchdog->mult,
++ watchdog->shift);
++ if (wd_delay <= WATCHDOG_MAX_SKEW) {
++ if (nretries > 1 || nretries >= max_cswd_read_retries) {
++ pr_warn("timekeeping watchdog on CPU%d: %s retried %d times before success\n",
++ smp_processor_id(), watchdog->name, nretries);
++ }
++ return true;
++ }
++ }
++
++ pr_warn("timekeeping watchdog on CPU%d: %s read-back delay of %lldns, attempt %d, marking unstable\n",
++ smp_processor_id(), watchdog->name, wd_delay, nretries);
++ return false;
++}
++
+ static void clocksource_watchdog(struct timer_list *unused)
+ {
+- struct clocksource *cs;
+ u64 csnow, wdnow, cslast, wdlast, delta;
+- int64_t wd_nsec, cs_nsec;
+ int next_cpu, reset_pending;
++ int64_t wd_nsec, cs_nsec;
++ struct clocksource *cs;
+
+ spin_lock(&watchdog_lock);
+ if (!watchdog_running)
+@@ -224,10 +264,11 @@ static void clocksource_watchdog(struct timer_list *unused)
+ continue;
+ }
+
+- local_irq_disable();
+- csnow = cs->read(cs);
+- wdnow = watchdog->read(watchdog);
+- local_irq_enable();
++ if (!cs_watchdog_read(cs, &csnow, &wdnow)) {
++ /* Clock readout unreliable, so give it up. */
++ __clocksource_unstable(cs);
++ continue;
++ }
+
+ /* Clocksource initialized ? */
+ if (!(cs->flags & CLOCK_SOURCE_WATCHDOG) ||
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 83c4e76f513af..1cb13d6368f3f 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -1221,7 +1221,8 @@ static int __bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *
+ if (prog->aux->max_ctx_offset > btp->num_args * sizeof(u64))
+ return -EINVAL;
+
+- return tracepoint_probe_register(tp, (void *)btp->bpf_func, prog);
++ return tracepoint_probe_register_may_exist(tp, (void *)btp->bpf_func,
++ prog);
+ }
+
+ int bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *prog)
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 71bc808fe03a2..895026ccfea27 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1729,8 +1729,15 @@ void tracing_reset_all_online_cpus(void)
+ }
+ }
+
++/*
++ * The tgid_map array maps from pid to tgid; i.e. the value stored at index i
++ * is the tgid last observed corresponding to pid=i.
++ */
+ static int *tgid_map;
+
++/* The maximum valid index into tgid_map. */
++static size_t tgid_map_max;
++
+ #define SAVED_CMDLINES_DEFAULT 128
+ #define NO_CMDLINE_MAP UINT_MAX
+ static arch_spinlock_t trace_cmdline_lock = __ARCH_SPIN_LOCK_UNLOCKED;
+@@ -2003,24 +2010,41 @@ void trace_find_cmdline(int pid, char comm[])
+ preempt_enable();
+ }
+
++static int *trace_find_tgid_ptr(int pid)
++{
++ /*
++ * Pairs with the smp_store_release in set_tracer_flag() to ensure that
++ * if we observe a non-NULL tgid_map then we also observe the correct
++ * tgid_map_max.
++ */
++ int *map = smp_load_acquire(&tgid_map);
++
++ if (unlikely(!map || pid > tgid_map_max))
++ return NULL;
++
++ return &map[pid];
++}
++
+ int trace_find_tgid(int pid)
+ {
+- if (unlikely(!tgid_map || !pid || pid > PID_MAX_DEFAULT))
+- return 0;
++ int *ptr = trace_find_tgid_ptr(pid);
+
+- return tgid_map[pid];
++ return ptr ? *ptr : 0;
+ }
+
+ static int trace_save_tgid(struct task_struct *tsk)
+ {
++ int *ptr;
++
+ /* treat recording of idle task as a success */
+ if (!tsk->pid)
+ return 1;
+
+- if (unlikely(!tgid_map || tsk->pid > PID_MAX_DEFAULT))
++ ptr = trace_find_tgid_ptr(tsk->pid);
++ if (!ptr)
+ return 0;
+
+- tgid_map[tsk->pid] = tsk->tgid;
++ *ptr = tsk->tgid;
+ return 1;
+ }
+
+@@ -4355,6 +4379,8 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
+
+ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
+ {
++ int *map;
++
+ if ((mask == TRACE_ITER_RECORD_TGID) ||
+ (mask == TRACE_ITER_RECORD_CMD))
+ lockdep_assert_held(&event_mutex);
+@@ -4377,10 +4403,19 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
+ trace_event_enable_cmd_record(enabled);
+
+ if (mask == TRACE_ITER_RECORD_TGID) {
+- if (!tgid_map)
+- tgid_map = kvcalloc(PID_MAX_DEFAULT + 1,
+- sizeof(*tgid_map),
+- GFP_KERNEL);
++ if (!tgid_map) {
++ tgid_map_max = pid_max;
++ map = kvcalloc(tgid_map_max + 1, sizeof(*tgid_map),
++ GFP_KERNEL);
++
++ /*
++ * Pairs with smp_load_acquire() in
++ * trace_find_tgid_ptr() to ensure that if it observes
++ * the tgid_map we just allocated then it also observes
++ * the corresponding tgid_map_max value.
++ */
++ smp_store_release(&tgid_map, map);
++ }
+ if (!tgid_map) {
+ tr->trace_flags &= ~TRACE_ITER_RECORD_TGID;
+ return -ENOMEM;
+@@ -4752,37 +4787,16 @@ static const struct file_operations tracing_readme_fops = {
+
+ static void *saved_tgids_next(struct seq_file *m, void *v, loff_t *pos)
+ {
+- int *ptr = v;
++ int pid = ++(*pos);
+
+- if (*pos || m->count)
+- ptr++;
+-
+- (*pos)++;
+-
+- for (; ptr <= &tgid_map[PID_MAX_DEFAULT]; ptr++) {
+- if (trace_find_tgid(*ptr))
+- return ptr;
+- }
+-
+- return NULL;
++ return trace_find_tgid_ptr(pid);
+ }
+
+ static void *saved_tgids_start(struct seq_file *m, loff_t *pos)
+ {
+- void *v;
+- loff_t l = 0;
++ int pid = *pos;
+
+- if (!tgid_map)
+- return NULL;
+-
+- v = &tgid_map[0];
+- while (l <= *pos) {
+- v = saved_tgids_next(m, v, &l);
+- if (!v)
+- return NULL;
+- }
+-
+- return v;
++ return trace_find_tgid_ptr(pid);
+ }
+
+ static void saved_tgids_stop(struct seq_file *m, void *v)
+@@ -4791,9 +4805,14 @@ static void saved_tgids_stop(struct seq_file *m, void *v)
+
+ static int saved_tgids_show(struct seq_file *m, void *v)
+ {
+- int pid = (int *)v - tgid_map;
++ int *entry = (int *)v;
++ int pid = entry - tgid_map;
++ int tgid = *entry;
++
++ if (tgid == 0)
++ return SEQ_SKIP;
+
+- seq_printf(m, "%d %d\n", pid, trace_find_tgid(pid));
++ seq_printf(m, "%d %d\n", pid, tgid);
+ return 0;
+ }
+
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 3ed2d7f7e5712..28e4ff45cb4c5 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -2211,6 +2211,13 @@ static int contains_operator(char *str)
+
+ switch (*op) {
+ case '-':
++ /*
++ * Unfortunately, the modifier ".sym-offset"
++ * can confuse things.
++ */
++ if (op - str >= 4 && !strncmp(op - 4, ".sym-offset", 11))
++ return FIELD_OP_NONE;
++
+ if (*str == '-')
+ field_op = FIELD_OP_UNARY_MINUS;
+ else
+@@ -2335,7 +2342,9 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data,
+ if (WARN_ON_ONCE(!field))
+ goto out;
+
+- if (is_string_field(field)) {
++ /* Pointers to strings are just pointers and dangerous to dereference */
++ if (is_string_field(field) &&
++ (field->filter_type != FILTER_PTR_STRING)) {
+ flags |= HIST_FIELD_FL_STRING;
+
+ hist_field->size = MAX_FILTER_STR_VAL;
+@@ -4735,8 +4744,6 @@ static inline void add_to_key(char *compound_key, void *key,
+ field = key_field->field;
+ if (field->filter_type == FILTER_DYN_STRING)
+ size = *(u32 *)(rec + field->offset) >> 16;
+- else if (field->filter_type == FILTER_PTR_STRING)
+- size = strlen(key);
+ else if (field->filter_type == FILTER_STATIC_STRING)
+ size = field->size;
+
+diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
+index d5ce692319128..625297a9cae26 100644
+--- a/kernel/tracepoint.c
++++ b/kernel/tracepoint.c
+@@ -284,7 +284,8 @@ static void *func_remove(struct tracepoint_func **funcs,
+ * Add the probe function to a tracepoint.
+ */
+ static int tracepoint_add_func(struct tracepoint *tp,
+- struct tracepoint_func *func, int prio)
++ struct tracepoint_func *func, int prio,
++ bool warn)
+ {
+ struct tracepoint_func *old, *tp_funcs;
+ int ret;
+@@ -299,7 +300,7 @@ static int tracepoint_add_func(struct tracepoint *tp,
+ lockdep_is_held(&tracepoints_mutex));
+ old = func_add(&tp_funcs, func, prio);
+ if (IS_ERR(old)) {
+- WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM);
++ WARN_ON_ONCE(warn && PTR_ERR(old) != -ENOMEM);
+ return PTR_ERR(old);
+ }
+
+@@ -350,6 +351,32 @@ static int tracepoint_remove_func(struct tracepoint *tp,
+ return 0;
+ }
+
++/**
++ * tracepoint_probe_register_prio_may_exist - Connect a probe to a tracepoint with priority
++ * @tp: tracepoint
++ * @probe: probe handler
++ * @data: tracepoint data
++ * @prio: priority of this function over other registered functions
++ *
++ * Same as tracepoint_probe_register_prio() except that it will not warn
++ * if the tracepoint is already registered.
++ */
++int tracepoint_probe_register_prio_may_exist(struct tracepoint *tp, void *probe,
++ void *data, int prio)
++{
++ struct tracepoint_func tp_func;
++ int ret;
++
++ mutex_lock(&tracepoints_mutex);
++ tp_func.func = probe;
++ tp_func.data = data;
++ tp_func.prio = prio;
++ ret = tracepoint_add_func(tp, &tp_func, prio, false);
++ mutex_unlock(&tracepoints_mutex);
++ return ret;
++}
++EXPORT_SYMBOL_GPL(tracepoint_probe_register_prio_may_exist);
++
+ /**
+ * tracepoint_probe_register_prio - Connect a probe to a tracepoint with priority
+ * @tp: tracepoint
+@@ -373,7 +400,7 @@ int tracepoint_probe_register_prio(struct tracepoint *tp, void *probe,
+ tp_func.func = probe;
+ tp_func.data = data;
+ tp_func.prio = prio;
+- ret = tracepoint_add_func(tp, &tp_func, prio);
++ ret = tracepoint_add_func(tp, &tp_func, prio, true);
+ mutex_unlock(&tracepoints_mutex);
+ return ret;
+ }
+diff --git a/lib/decompress_unlz4.c b/lib/decompress_unlz4.c
+index 1b0baf3008ea3..b202aa864c48a 100644
+--- a/lib/decompress_unlz4.c
++++ b/lib/decompress_unlz4.c
+@@ -115,6 +115,9 @@ STATIC inline int INIT unlz4(u8 *input, long in_len,
+ error("data corrupted");
+ goto exit_2;
+ }
++ } else if (size < 4) {
++ /* empty or end-of-file */
++ goto exit_3;
+ }
+
+ chunksize = get_unaligned_le32(inp);
+@@ -128,6 +131,10 @@ STATIC inline int INIT unlz4(u8 *input, long in_len,
+ continue;
+ }
+
++ if (!fill && chunksize == 0) {
++ /* empty or end-of-file */
++ goto exit_3;
++ }
+
+ if (posp)
+ *posp += 4;
+@@ -187,6 +194,7 @@ STATIC inline int INIT unlz4(u8 *input, long in_len,
+ }
+ }
+
++exit_3:
+ ret = 0;
+ exit_2:
+ if (!input)
+diff --git a/lib/iov_iter.c b/lib/iov_iter.c
+index acd7b97c16f24..39e6e978029c1 100644
+--- a/lib/iov_iter.c
++++ b/lib/iov_iter.c
+@@ -417,7 +417,7 @@ int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
+ int err;
+ struct iovec v;
+
+- if (!(i->type & (ITER_BVEC|ITER_KVEC))) {
++ if (iter_is_iovec(i)) {
+ iterate_iovec(i, bytes, v, iov, skip, ({
+ err = fault_in_pages_readable(v.iov_base, v.iov_len);
+ if (unlikely(err))
+diff --git a/lib/kstrtox.c b/lib/kstrtox.c
+index 661a1e807bd1a..1a02b87b19c7e 100644
+--- a/lib/kstrtox.c
++++ b/lib/kstrtox.c
+@@ -39,20 +39,22 @@ const char *_parse_integer_fixup_radix(const char *s, unsigned int *base)
+
+ /*
+ * Convert non-negative integer string representation in explicitly given radix
+- * to an integer.
++ * to an integer. A maximum of max_chars characters will be converted.
++ *
+ * Return number of characters consumed maybe or-ed with overflow bit.
+ * If overflow occurs, result integer (incorrect) is still returned.
+ *
+ * Don't you dare use this function.
+ */
+-unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long *p)
++unsigned int _parse_integer_limit(const char *s, unsigned int base, unsigned long long *p,
++ size_t max_chars)
+ {
+ unsigned long long res;
+ unsigned int rv;
+
+ res = 0;
+ rv = 0;
+- while (1) {
++ while (max_chars--) {
+ unsigned int c = *s;
+ unsigned int lc = c | 0x20; /* don't tolower() this line */
+ unsigned int val;
+@@ -82,6 +84,11 @@ unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long
+ return rv;
+ }
+
++unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long *p)
++{
++ return _parse_integer_limit(s, base, p, INT_MAX);
++}
++
+ static int _kstrtoull(const char *s, unsigned int base, unsigned long long *res)
+ {
+ unsigned long long _res;
+diff --git a/lib/kstrtox.h b/lib/kstrtox.h
+index 3b4637bcd2540..158c400ca8658 100644
+--- a/lib/kstrtox.h
++++ b/lib/kstrtox.h
+@@ -4,6 +4,8 @@
+
+ #define KSTRTOX_OVERFLOW (1U << 31)
+ const char *_parse_integer_fixup_radix(const char *s, unsigned int *base);
++unsigned int _parse_integer_limit(const char *s, unsigned int base, unsigned long long *res,
++ size_t max_chars);
+ unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long *res);
+
+ #endif
+diff --git a/lib/seq_buf.c b/lib/seq_buf.c
+index 6aabb609dd871..562e53c93b7b2 100644
+--- a/lib/seq_buf.c
++++ b/lib/seq_buf.c
+@@ -228,8 +228,10 @@ int seq_buf_putmem_hex(struct seq_buf *s, const void *mem,
+
+ WARN_ON(s->size == 0);
+
++ BUILD_BUG_ON(MAX_MEMHEX_BYTES * 2 >= HEX_CHARS);
++
+ while (len) {
+- start_len = min(len, HEX_CHARS - 1);
++ start_len = min(len, MAX_MEMHEX_BYTES);
+ #ifdef __BIG_ENDIAN
+ for (i = 0, j = 0; i < start_len; i++) {
+ #else
+@@ -242,12 +244,14 @@ int seq_buf_putmem_hex(struct seq_buf *s, const void *mem,
+ break;
+
+ /* j increments twice per loop */
+- len -= j / 2;
+ hex[j++] = ' ';
+
+ seq_buf_putmem(s, hex, j);
+ if (seq_buf_has_overflowed(s))
+ return -1;
++
++ len -= start_len;
++ data += start_len;
+ }
+ return 0;
+ }
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index 812e59e13fe61..c2619510636eb 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -47,6 +47,31 @@
+ #include <linux/string_helpers.h>
+ #include "kstrtox.h"
+
++static unsigned long long simple_strntoull(const char *startp, size_t max_chars,
++ char **endp, unsigned int base)
++{
++ const char *cp;
++ unsigned long long result = 0ULL;
++ size_t prefix_chars;
++ unsigned int rv;
++
++ cp = _parse_integer_fixup_radix(startp, &base);
++ prefix_chars = cp - startp;
++ if (prefix_chars < max_chars) {
++ rv = _parse_integer_limit(cp, base, &result, max_chars - prefix_chars);
++ /* FIXME */
++ cp += (rv & ~KSTRTOX_OVERFLOW);
++ } else {
++ /* Field too short for prefix + digit, skip over without converting */
++ cp = startp + max_chars;
++ }
++
++ if (endp)
++ *endp = (char *)cp;
++
++ return result;
++}
++
+ /**
+ * simple_strtoull - convert a string to an unsigned long long
+ * @cp: The start of the string
+@@ -57,18 +82,7 @@
+ */
+ unsigned long long simple_strtoull(const char *cp, char **endp, unsigned int base)
+ {
+- unsigned long long result;
+- unsigned int rv;
+-
+- cp = _parse_integer_fixup_radix(cp, &base);
+- rv = _parse_integer(cp, base, &result);
+- /* FIXME */
+- cp += (rv & ~KSTRTOX_OVERFLOW);
+-
+- if (endp)
+- *endp = (char *)cp;
+-
+- return result;
++ return simple_strntoull(cp, INT_MAX, endp, base);
+ }
+ EXPORT_SYMBOL(simple_strtoull);
+
+@@ -103,6 +117,21 @@ long simple_strtol(const char *cp, char **endp, unsigned int base)
+ }
+ EXPORT_SYMBOL(simple_strtol);
+
++static long long simple_strntoll(const char *cp, size_t max_chars, char **endp,
++ unsigned int base)
++{
++ /*
++ * simple_strntoull() safely handles receiving max_chars==0 in the
++ * case cp[0] == '-' && max_chars == 1.
++ * If max_chars == 0 we can drop through and pass it to simple_strntoull()
++ * and the content of *cp is irrelevant.
++ */
++ if (*cp == '-' && max_chars > 0)
++ return -simple_strntoull(cp + 1, max_chars - 1, endp, base);
++
++ return simple_strntoull(cp, max_chars, endp, base);
++}
++
+ /**
+ * simple_strtoll - convert a string to a signed long long
+ * @cp: The start of the string
+@@ -113,10 +142,7 @@ EXPORT_SYMBOL(simple_strtol);
+ */
+ long long simple_strtoll(const char *cp, char **endp, unsigned int base)
+ {
+- if (*cp == '-')
+- return -simple_strtoull(cp + 1, endp, base);
+-
+- return simple_strtoull(cp, endp, base);
++ return simple_strntoll(cp, INT_MAX, endp, base);
+ }
+ EXPORT_SYMBOL(simple_strtoll);
+
+@@ -3117,25 +3143,13 @@ int vsscanf(const char *buf, const char *fmt, va_list args)
+ break;
+
+ if (is_sign)
+- val.s = qualifier != 'L' ?
+- simple_strtol(str, &next, base) :
+- simple_strtoll(str, &next, base);
++ val.s = simple_strntoll(str,
++ field_width >= 0 ? field_width : INT_MAX,
++ &next, base);
+ else
+- val.u = qualifier != 'L' ?
+- simple_strtoul(str, &next, base) :
+- simple_strtoull(str, &next, base);
+-
+- if (field_width > 0 && next - str > field_width) {
+- if (base == 0)
+- _parse_integer_fixup_radix(str, &base);
+- while (next - str > field_width) {
+- if (is_sign)
+- val.s = div_s64(val.s, base);
+- else
+- val.u = div_u64(val.u, base);
+- --next;
+- }
+- }
++ val.u = simple_strntoull(str,
++ field_width >= 0 ? field_width : INT_MAX,
++ &next, base);
+
+ switch (qualifier) {
+ case 'H': /* that's 'hh' in format */
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index 0a970be24a28d..2152e85891d1f 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -250,8 +250,8 @@ static int __init default_bdi_init(void)
+ {
+ int err;
+
+- bdi_wq = alloc_workqueue("writeback", WQ_MEM_RECLAIM | WQ_FREEZABLE |
+- WQ_UNBOUND | WQ_SYSFS, 0);
++ bdi_wq = alloc_workqueue("writeback", WQ_MEM_RECLAIM | WQ_UNBOUND |
++ WQ_SYSFS, 0);
+ if (!bdi_wq)
+ return -ENOMEM;
+
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 4400957d8e4e2..800d7de32af8f 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1692,7 +1692,7 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
+ * If other processes are mapping this page, we couldn't discard
+ * the page unless they all do MADV_FREE so let's skip the page.
+ */
+- if (page_mapcount(page) != 1)
++ if (total_mapcount(page) != 1)
+ goto out;
+
+ if (!trylock_page(page))
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 219cdbb476fb7..e9902bf0f137e 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1609,14 +1609,6 @@ int hci_dev_do_close(struct hci_dev *hdev)
+
+ BT_DBG("%s %p", hdev->name, hdev);
+
+- if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
+- !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
+- test_bit(HCI_UP, &hdev->flags)) {
+- /* Execute vendor specific shutdown routine */
+- if (hdev->shutdown)
+- hdev->shutdown(hdev);
+- }
+-
+ cancel_delayed_work(&hdev->power_off);
+
+ hci_request_cancel_all(hdev);
+@@ -1690,6 +1682,14 @@ int hci_dev_do_close(struct hci_dev *hdev)
+ clear_bit(HCI_INIT, &hdev->flags);
+ }
+
++ if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
++ !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
++ test_bit(HCI_UP, &hdev->flags)) {
++ /* Execute vendor specific shutdown routine */
++ if (hdev->shutdown)
++ hdev->shutdown(hdev);
++ }
++
+ /* flush cmd work */
+ flush_work(&hdev->cmd_work);
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 2e2cad58b6ccf..45cc864cf2b38 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -4986,8 +4986,19 @@ static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
+
+ BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
+
+- if (ev->status)
++ if (ev->status) {
++ struct adv_info *adv;
++
++ adv = hci_find_adv_instance(hdev, ev->handle);
++ if (!adv)
++ return;
++
++ /* Remove advertising as it has been terminated */
++ hci_remove_adv_instance(hdev, ev->handle);
++ mgmt_advertising_removed(NULL, hdev, ev->handle);
++
+ return;
++ }
+
+ conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
+ if (conn) {
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 5340b1097afb7..d0ec0e3369096 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -219,12 +219,15 @@ static u8 mgmt_status_table[] = {
+ MGMT_STATUS_TIMEOUT, /* Instant Passed */
+ MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
+ MGMT_STATUS_FAILED, /* Transaction Collision */
++ MGMT_STATUS_FAILED, /* Reserved for future use */
+ MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
+ MGMT_STATUS_REJECTED, /* QoS Rejected */
+ MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
+ MGMT_STATUS_REJECTED, /* Insufficient Security */
+ MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
++ MGMT_STATUS_FAILED, /* Reserved for future use */
+ MGMT_STATUS_BUSY, /* Role Switch Pending */
++ MGMT_STATUS_FAILED, /* Reserved for future use */
+ MGMT_STATUS_FAILED, /* Slot Violation */
+ MGMT_STATUS_FAILED, /* Role Switch Failed */
+ MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
+@@ -6468,6 +6471,9 @@ static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
+ for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
+ cur_len = data[i];
+
++ if (!cur_len)
++ continue;
++
+ if (data[i + 1] == EIR_FLAGS &&
+ (!is_adv_data || flags_managed(adv_flags)))
+ return false;
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 6a362da211e1b..3504c3acd38f6 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1791,7 +1791,9 @@ static void br_multicast_pim(struct net_bridge *br,
+ pim_hdr_type(pimhdr) != PIM_TYPE_HELLO)
+ return;
+
++ spin_lock(&br->multicast_lock);
+ br_multicast_mark_router(br, port);
++ spin_unlock(&br->multicast_lock);
+ }
+
+ static int br_multicast_ipv4_rcv(struct net_bridge *br,
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 9f30d7b4389a8..e75d3fd7da4f9 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -828,6 +828,7 @@ static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh,
+ bcm_rx_handler, op);
+
+ list_del(&op->list);
++ synchronize_rcu();
+ bcm_remove_op(op);
+ return 1; /* done */
+ }
+@@ -1584,9 +1585,13 @@ static int bcm_release(struct socket *sock)
+ REGMASK(op->can_id),
+ bcm_rx_handler, op);
+
+- bcm_remove_op(op);
+ }
+
++ synchronize_rcu();
++
++ list_for_each_entry_safe(op, next, &bo->rx_ops, list)
++ bcm_remove_op(op);
++
+ #if IS_ENABLED(CONFIG_PROC_FS)
+ /* remove procfs entry */
+ if (net->can.bcmproc_dir && bo->bcm_proc_read)
+diff --git a/net/can/gw.c b/net/can/gw.c
+index bd2161470e456..9c20663235292 100644
+--- a/net/can/gw.c
++++ b/net/can/gw.c
+@@ -494,6 +494,7 @@ static int cgw_notifier(struct notifier_block *nb,
+ if (gwj->src.dev == dev || gwj->dst.dev == dev) {
+ hlist_del(&gwj->list);
+ cgw_unregister_filter(net, gwj);
++ synchronize_rcu();
+ kmem_cache_free(cgw_cache, gwj);
+ }
+ }
+@@ -941,6 +942,7 @@ static void cgw_remove_all_jobs(struct net *net)
+ hlist_for_each_entry_safe(gwj, nx, &net->can.cgw_list, list) {
+ hlist_del(&gwj->list);
+ cgw_unregister_filter(net, gwj);
++ synchronize_rcu();
+ kmem_cache_free(cgw_cache, gwj);
+ }
+ }
+@@ -1010,6 +1012,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh,
+
+ hlist_del(&gwj->list);
+ cgw_unregister_filter(net, gwj);
++ synchronize_rcu();
+ kmem_cache_free(cgw_cache, gwj);
+ err = 0;
+ break;
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 7803bd9628dc2..722ae0b57f3fd 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5931,11 +5931,18 @@ EXPORT_SYMBOL(napi_schedule_prep);
+ * __napi_schedule_irqoff - schedule for receive
+ * @n: entry to schedule
+ *
+- * Variant of __napi_schedule() assuming hard irqs are masked
++ * Variant of __napi_schedule() assuming hard irqs are masked.
++ *
++ * On PREEMPT_RT enabled kernels this maps to __napi_schedule()
++ * because the interrupt disabled assumption might not be true
++ * due to force-threaded interrupts and spinlock substitution.
+ */
+ void __napi_schedule_irqoff(struct napi_struct *n)
+ {
+- ____napi_schedule(this_cpu_ptr(&softnet_data), n);
++ if (!IS_ENABLED(CONFIG_PREEMPT_RT))
++ ____napi_schedule(this_cpu_ptr(&softnet_data), n);
++ else
++ __napi_schedule(n);
+ }
+ EXPORT_SYMBOL(__napi_schedule_irqoff);
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 01561268d2166..01496c7cb42d7 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2639,8 +2639,6 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
+ shinfo->gso_type |= SKB_GSO_TCPV6;
+ }
+
+- /* Due to IPv6 header, MSS needs to be downgraded. */
+- skb_decrease_gso_size(shinfo, len_diff);
+ /* Header must be checked, and gso_segs recomputed. */
+ shinfo->gso_type |= SKB_GSO_DODGY;
+ shinfo->gso_segs = 0;
+@@ -2680,8 +2678,6 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
+ shinfo->gso_type |= SKB_GSO_TCPV4;
+ }
+
+- /* Due to IPv4 header, MSS can be upgraded. */
+- skb_increase_gso_size(shinfo, len_diff);
+ /* Header must be checked, and gso_segs recomputed. */
+ shinfo->gso_type |= SKB_GSO_DODGY;
+ shinfo->gso_segs = 0;
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index b96aa88087be1..70e5e9e5d8351 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -353,6 +353,8 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
+ fl4.flowi4_proto = 0;
+ fl4.fl4_sport = 0;
+ fl4.fl4_dport = 0;
++ } else {
++ swap(fl4.fl4_sport, fl4.fl4_dport);
+ }
+
+ if (fib_lookup(net, &fl4, &res, 0))
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index e411c42d84289..e63905f7f6f95 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -940,7 +940,7 @@ static int __ip_append_data(struct sock *sk,
+ unsigned int datalen;
+ unsigned int fraglen;
+ unsigned int fraggap;
+- unsigned int alloclen;
++ unsigned int alloclen, alloc_extra;
+ unsigned int pagedlen;
+ struct sk_buff *skb_prev;
+ alloc_new_skb:
+@@ -960,35 +960,39 @@ alloc_new_skb:
+ fraglen = datalen + fragheaderlen;
+ pagedlen = 0;
+
++ alloc_extra = hh_len + 15;
++ alloc_extra += exthdrlen;
++
++ /* The last fragment gets additional space at tail.
++ * Note, with MSG_MORE we overallocate on fragments,
++ * because we have no idea what fragment will be
++ * the last.
++ */
++ if (datalen == length + fraggap)
++ alloc_extra += rt->dst.trailer_len;
++
+ if ((flags & MSG_MORE) &&
+ !(rt->dst.dev->features&NETIF_F_SG))
+ alloclen = mtu;
+- else if (!paged)
++ else if (!paged &&
++ (fraglen + alloc_extra < SKB_MAX_ALLOC ||
++ !(rt->dst.dev->features & NETIF_F_SG)))
+ alloclen = fraglen;
+ else {
+ alloclen = min_t(int, fraglen, MAX_HEADER);
+ pagedlen = fraglen - alloclen;
+ }
+
+- alloclen += exthdrlen;
+-
+- /* The last fragment gets additional space at tail.
+- * Note, with MSG_MORE we overallocate on fragments,
+- * because we have no idea what fragment will be
+- * the last.
+- */
+- if (datalen == length + fraggap)
+- alloclen += rt->dst.trailer_len;
++ alloclen += alloc_extra;
+
+ if (transhdrlen) {
+- skb = sock_alloc_send_skb(sk,
+- alloclen + hh_len + 15,
++ skb = sock_alloc_send_skb(sk, alloclen,
+ (flags & MSG_DONTWAIT), &err);
+ } else {
+ skb = NULL;
+ if (refcount_read(&sk->sk_wmem_alloc) + wmem_alloc_delta <=
+ 2 * sk->sk_sndbuf)
+- skb = alloc_skb(alloclen + hh_len + 15,
++ skb = alloc_skb(alloclen,
+ sk->sk_allocation);
+ if (unlikely(!skb))
+ err = -ENOBUFS;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 484bd646df5fa..1491d239385e5 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1318,7 +1318,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
+ mtu = dst_metric_raw(dst, RTAX_MTU);
+
+ if (mtu)
+- return mtu;
++ goto out;
+
+ mtu = READ_ONCE(dst->dev->mtu);
+
+@@ -1327,6 +1327,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
+ mtu = 576;
+ }
+
++out:
+ mtu = min_t(unsigned int, mtu, IP_MAX_MTU);
+
+ return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
+diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
+index 20291c2036fcd..fe2497ae4523f 100644
+--- a/net/ipv6/exthdrs.c
++++ b/net/ipv6/exthdrs.c
+@@ -138,18 +138,23 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs,
+ len -= 2;
+
+ while (len > 0) {
+- int optlen = nh[off + 1] + 2;
+- int i;
++ int optlen, i;
+
+- switch (nh[off]) {
+- case IPV6_TLV_PAD1:
+- optlen = 1;
++ if (nh[off] == IPV6_TLV_PAD1) {
+ padlen++;
+ if (padlen > 7)
+ goto bad;
+- break;
++ off++;
++ len--;
++ continue;
++ }
++ if (len < 2)
++ goto bad;
++ optlen = nh[off + 1] + 2;
++ if (optlen > len)
++ goto bad;
+
+- case IPV6_TLV_PADN:
++ if (nh[off] == IPV6_TLV_PADN) {
+ /* RFC 2460 states that the purpose of PadN is
+ * to align the containing header to multiples
+ * of 8. 7 is therefore the highest valid value.
+@@ -166,12 +171,7 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs,
+ if (nh[off + i] != 0)
+ goto bad;
+ }
+- break;
+-
+- default: /* Other TLV code so scan list */
+- if (optlen > len)
+- goto bad;
+-
++ } else {
+ tlv_count++;
+ if (tlv_count > max_count)
+ goto bad;
+@@ -191,7 +191,6 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs,
+ return false;
+
+ padlen = 0;
+- break;
+ }
+ off += optlen;
+ len -= optlen;
+@@ -309,7 +308,7 @@ fail_and_free:
+ #endif
+
+ if (ip6_parse_tlv(tlvprocdestopt_lst, skb,
+- init_net.ipv6.sysctl.max_dst_opts_cnt)) {
++ net->ipv6.sysctl.max_dst_opts_cnt)) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ #if IS_ENABLED(CONFIG_IPV6_MIP6)
+@@ -848,7 +847,7 @@ fail_and_free:
+
+ opt->flags |= IP6SKB_HOPBYHOP;
+ if (ip6_parse_tlv(tlvprochopopt_lst, skb,
+- init_net.ipv6.sysctl.max_hbh_opts_cnt)) {
++ net->ipv6.sysctl.max_hbh_opts_cnt)) {
+ skb->transport_header += extlen;
+ opt = IP6CB(skb);
+ opt->nhoff = sizeof(struct ipv6hdr);
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index e1bb7db88483d..aa8f19f852cc7 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1394,7 +1394,7 @@ emsgsize:
+ unsigned int datalen;
+ unsigned int fraglen;
+ unsigned int fraggap;
+- unsigned int alloclen;
++ unsigned int alloclen, alloc_extra;
+ unsigned int pagedlen;
+ alloc_new_skb:
+ /* There's no room in the current skb */
+@@ -1421,17 +1421,28 @@ alloc_new_skb:
+ fraglen = datalen + fragheaderlen;
+ pagedlen = 0;
+
++ alloc_extra = hh_len;
++ alloc_extra += dst_exthdrlen;
++ alloc_extra += rt->dst.trailer_len;
++
++ /* We just reserve space for fragment header.
++ * Note: this may be overallocation if the message
++ * (without MSG_MORE) fits into the MTU.
++ */
++ alloc_extra += sizeof(struct frag_hdr);
++
+ if ((flags & MSG_MORE) &&
+ !(rt->dst.dev->features&NETIF_F_SG))
+ alloclen = mtu;
+- else if (!paged)
++ else if (!paged &&
++ (fraglen + alloc_extra < SKB_MAX_ALLOC ||
++ !(rt->dst.dev->features & NETIF_F_SG)))
+ alloclen = fraglen;
+ else {
+ alloclen = min_t(int, fraglen, MAX_HEADER);
+ pagedlen = fraglen - alloclen;
+ }
+-
+- alloclen += dst_exthdrlen;
++ alloclen += alloc_extra;
+
+ if (datalen != length + fraggap) {
+ /*
+@@ -1441,30 +1452,21 @@ alloc_new_skb:
+ datalen += rt->dst.trailer_len;
+ }
+
+- alloclen += rt->dst.trailer_len;
+ fraglen = datalen + fragheaderlen;
+
+- /*
+- * We just reserve space for fragment header.
+- * Note: this may be overallocation if the message
+- * (without MSG_MORE) fits into the MTU.
+- */
+- alloclen += sizeof(struct frag_hdr);
+-
+ copy = datalen - transhdrlen - fraggap - pagedlen;
+ if (copy < 0) {
+ err = -EINVAL;
+ goto error;
+ }
+ if (transhdrlen) {
+- skb = sock_alloc_send_skb(sk,
+- alloclen + hh_len,
++ skb = sock_alloc_send_skb(sk, alloclen,
+ (flags & MSG_DONTWAIT), &err);
+ } else {
+ skb = NULL;
+ if (refcount_read(&sk->sk_wmem_alloc) + wmem_alloc_delta <=
+ 2 * sk->sk_sndbuf)
+- skb = alloc_skb(alloclen + hh_len,
++ skb = alloc_skb(alloclen,
+ sk->sk_allocation);
+ if (unlikely(!skb))
+ err = -ENOBUFS;
+diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
+index 868ae23dbae19..3829b565c645d 100644
+--- a/net/ipv6/output_core.c
++++ b/net/ipv6/output_core.c
+@@ -14,29 +14,11 @@ static u32 __ipv6_select_ident(struct net *net,
+ const struct in6_addr *dst,
+ const struct in6_addr *src)
+ {
+- const struct {
+- struct in6_addr dst;
+- struct in6_addr src;
+- } __aligned(SIPHASH_ALIGNMENT) combined = {
+- .dst = *dst,
+- .src = *src,
+- };
+- u32 hash, id;
+-
+- /* Note the following code is not safe, but this is okay. */
+- if (unlikely(siphash_key_is_zero(&net->ipv4.ip_id_key)))
+- get_random_bytes(&net->ipv4.ip_id_key,
+- sizeof(net->ipv4.ip_id_key));
+-
+- hash = siphash(&combined, sizeof(combined), &net->ipv4.ip_id_key);
+-
+- /* Treat id of 0 as unset and if we get 0 back from ip_idents_reserve,
+- * set the hight order instead thus minimizing possible future
+- * collisions.
+- */
+- id = ip_idents_reserve(hash, 1);
+- if (unlikely(!id))
+- id = 1 << 31;
++ u32 id;
++
++ do {
++ id = prandom_u32();
++ } while (!id);
+
+ return id;
+ }
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 71c6a462277fa..3a907ba7f7634 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1344,11 +1344,6 @@ static void ieee80211_send_null_response(struct sta_info *sta, int tid,
+ struct ieee80211_tx_info *info;
+ struct ieee80211_chanctx_conf *chanctx_conf;
+
+- /* Don't send NDPs when STA is connected HE */
+- if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+- !(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE))
+- return;
+-
+ if (qos) {
+ fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
+ IEEE80211_STYPE_QOS_NULLFUNC |
+diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
+index a940c9fd9045e..64e69d6683cab 100644
+--- a/net/netfilter/nft_exthdr.c
++++ b/net/netfilter/nft_exthdr.c
+@@ -45,6 +45,9 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
+ unsigned int offset = 0;
+ int err;
+
++ if (pkt->skb->protocol != htons(ETH_P_IPV6))
++ goto err;
++
+ err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
+ if (priv->flags & NFT_EXTHDR_F_PRESENT) {
+ *dest = (err >= 0);
+diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
+index a003533ff4d93..e259454b6a643 100644
+--- a/net/netfilter/nft_osf.c
++++ b/net/netfilter/nft_osf.c
+@@ -22,6 +22,11 @@ static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs,
+ struct tcphdr _tcph;
+ const char *os_name;
+
++ if (pkt->tprot != IPPROTO_TCP) {
++ regs->verdict.code = NFT_BREAK;
++ return;
++ }
++
+ tcp = skb_header_pointer(skb, ip_hdrlen(skb),
+ sizeof(struct tcphdr), &_tcph);
+ if (!tcp) {
+diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c
+index 95980154ef02c..b97ab1198b03f 100644
+--- a/net/netfilter/nft_tproxy.c
++++ b/net/netfilter/nft_tproxy.c
+@@ -30,6 +30,12 @@ static void nft_tproxy_eval_v4(const struct nft_expr *expr,
+ __be16 tport = 0;
+ struct sock *sk;
+
++ if (pkt->tprot != IPPROTO_TCP &&
++ pkt->tprot != IPPROTO_UDP) {
++ regs->verdict.code = NFT_BREAK;
++ return;
++ }
++
+ hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
+ if (!hp) {
+ regs->verdict.code = NFT_BREAK;
+@@ -91,7 +97,8 @@ static void nft_tproxy_eval_v6(const struct nft_expr *expr,
+
+ memset(&taddr, 0, sizeof(taddr));
+
+- if (!pkt->tprot_set) {
++ if (pkt->tprot != IPPROTO_TCP &&
++ pkt->tprot != IPPROTO_UDP) {
+ regs->verdict.code = NFT_BREAK;
+ return;
+ }
+diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
+index 21e0095b1d142..71ba69cb50c9b 100644
+--- a/net/netlabel/netlabel_mgmt.c
++++ b/net/netlabel/netlabel_mgmt.c
+@@ -90,6 +90,7 @@ static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = {
+ static int netlbl_mgmt_add_common(struct genl_info *info,
+ struct netlbl_audit *audit_info)
+ {
++ void *pmap = NULL;
+ int ret_val = -EINVAL;
+ struct netlbl_domaddr_map *addrmap = NULL;
+ struct cipso_v4_doi *cipsov4 = NULL;
+@@ -189,6 +190,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
+ ret_val = -ENOMEM;
+ goto add_free_addrmap;
+ }
++ pmap = map;
+ map->list.addr = addr->s_addr & mask->s_addr;
+ map->list.mask = mask->s_addr;
+ map->list.valid = 1;
+@@ -197,10 +199,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
+ map->def.cipso = cipsov4;
+
+ ret_val = netlbl_af4list_add(&map->list, &addrmap->list4);
+- if (ret_val != 0) {
+- kfree(map);
+- goto add_free_addrmap;
+- }
++ if (ret_val != 0)
++ goto add_free_map;
+
+ entry->family = AF_INET;
+ entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
+@@ -237,6 +237,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
+ ret_val = -ENOMEM;
+ goto add_free_addrmap;
+ }
++ pmap = map;
+ map->list.addr = *addr;
+ map->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
+ map->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
+@@ -249,10 +250,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
+ map->def.calipso = calipso;
+
+ ret_val = netlbl_af6list_add(&map->list, &addrmap->list6);
+- if (ret_val != 0) {
+- kfree(map);
+- goto add_free_addrmap;
+- }
++ if (ret_val != 0)
++ goto add_free_map;
+
+ entry->family = AF_INET6;
+ entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
+@@ -262,10 +261,12 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
+
+ ret_val = netlbl_domhsh_add(entry, audit_info);
+ if (ret_val != 0)
+- goto add_free_addrmap;
++ goto add_free_map;
+
+ return 0;
+
++add_free_map:
++ kfree(pmap);
+ add_free_addrmap:
+ kfree(addrmap);
+ add_doi_put_def:
+diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
+index e41bc5ecaa092..4070197f95439 100644
+--- a/net/sched/cls_tcindex.c
++++ b/net/sched/cls_tcindex.c
+@@ -276,7 +276,7 @@ static int tcindex_alloc_perfect_hash(struct net *net, struct tcindex_data *cp)
+ int i, err = 0;
+
+ cp->perfect = kcalloc(cp->hash, sizeof(struct tcindex_filter_result),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (!cp->perfect)
+ return -ENOMEM;
+
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index bb1a9c11fc549..a93402fe1a9f8 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -497,11 +497,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
+
+ if (cl->qdisc != &noop_qdisc)
+ qdisc_hash_add(cl->qdisc, true);
+- sch_tree_lock(sch);
+- qdisc_class_hash_insert(&q->clhash, &cl->common);
+- sch_tree_unlock(sch);
+-
+- qdisc_class_hash_grow(sch, &q->clhash);
+
+ set_change_agg:
+ sch_tree_lock(sch);
+@@ -519,8 +514,11 @@ set_change_agg:
+ }
+ if (existing)
+ qfq_deact_rm_from_agg(q, cl);
++ else
++ qdisc_class_hash_insert(&q->clhash, &cl->common);
+ qfq_add_to_agg(q, new_agg, cl);
+ sch_tree_unlock(sch);
++ qdisc_class_hash_grow(sch, &q->clhash);
+
+ *arg = (unsigned long)cl;
+ return 0;
+diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
+index 38d01cfb313e5..f8a2832456728 100644
+--- a/net/sctp/bind_addr.c
++++ b/net/sctp/bind_addr.c
+@@ -285,22 +285,19 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
+ rawaddr = (union sctp_addr_param *)raw_addr_list;
+
+ af = sctp_get_af_specific(param_type2af(param->type));
+- if (unlikely(!af)) {
++ if (unlikely(!af) ||
++ !af->from_addr_param(&addr, rawaddr, htons(port), 0)) {
+ retval = -EINVAL;
+- sctp_bind_addr_clean(bp);
+- break;
++ goto out_err;
+ }
+
+- af->from_addr_param(&addr, rawaddr, htons(port), 0);
+ if (sctp_bind_addr_state(bp, &addr) != -1)
+ goto next;
+ retval = sctp_add_bind_addr(bp, &addr, sizeof(addr),
+ SCTP_ADDR_SRC, gfp);
+- if (retval) {
++ if (retval)
+ /* Can't finish building the list, clean up. */
+- sctp_bind_addr_clean(bp);
+- break;
+- }
++ goto out_err;
+
+ next:
+ len = ntohs(param->length);
+@@ -309,6 +306,12 @@ next:
+ }
+
+ return retval;
++
++out_err:
++ if (retval)
++ sctp_bind_addr_clean(bp);
++
++ return retval;
+ }
+
+ /********************************************************************
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index 3dd900e42b85c..203aaefd8d049 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -1088,7 +1088,8 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
+ if (!af)
+ continue;
+
+- af->from_addr_param(paddr, params.addr, sh->source, 0);
++ if (!af->from_addr_param(paddr, params.addr, sh->source, 0))
++ continue;
+
+ asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
+ if (asoc)
+@@ -1131,7 +1132,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
+ if (unlikely(!af))
+ return NULL;
+
+- af->from_addr_param(&paddr, param, peer_port, 0);
++ if (af->from_addr_param(&paddr, param, peer_port, 0))
++ return NULL;
+
+ return __sctp_lookup_association(net, laddr, &paddr, transportp);
+ }
+@@ -1202,7 +1204,7 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net,
+
+ ch = (struct sctp_chunkhdr *)ch_end;
+ chunk_num++;
+- } while (ch_end < skb_tail_pointer(skb));
++ } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
+
+ return asoc;
+ }
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 4cc5739244935..fc82617b60765 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -542,15 +542,20 @@ static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk)
+ }
+
+ /* Initialize a sctp_addr from an address parameter. */
+-static void sctp_v6_from_addr_param(union sctp_addr *addr,
++static bool sctp_v6_from_addr_param(union sctp_addr *addr,
+ union sctp_addr_param *param,
+ __be16 port, int iif)
+ {
++ if (ntohs(param->v6.param_hdr.length) < sizeof(struct sctp_ipv6addr_param))
++ return false;
++
+ addr->v6.sin6_family = AF_INET6;
+ addr->v6.sin6_port = port;
+ addr->v6.sin6_flowinfo = 0; /* BUG */
+ addr->v6.sin6_addr = param->v6.addr;
+ addr->v6.sin6_scope_id = iif;
++
++ return true;
+ }
+
+ /* Initialize an address parameter from a sctp_addr and return the length
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index af054f38341b9..dd51256582556 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -268,14 +268,19 @@ static void sctp_v4_to_sk_daddr(union sctp_addr *addr, struct sock *sk)
+ }
+
+ /* Initialize a sctp_addr from an address parameter. */
+-static void sctp_v4_from_addr_param(union sctp_addr *addr,
++static bool sctp_v4_from_addr_param(union sctp_addr *addr,
+ union sctp_addr_param *param,
+ __be16 port, int iif)
+ {
++ if (ntohs(param->v4.param_hdr.length) < sizeof(struct sctp_ipv4addr_param))
++ return false;
++
+ addr->v4.sin_family = AF_INET;
+ addr->v4.sin_port = port;
+ addr->v4.sin_addr.s_addr = param->v4.addr.s_addr;
+ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
++
++ return true;
+ }
+
+ /* Initialize an address parameter from a sctp_addr and return the length
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index dc51e14f568ee..a1ca070e36b0a 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -2352,11 +2352,13 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
+
+ /* Process the initialization parameters. */
+ sctp_walk_params(param, peer_init, init_hdr.params) {
+- if (!src_match && (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
+- param.p->type == SCTP_PARAM_IPV6_ADDRESS)) {
++ if (!src_match &&
++ (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
++ param.p->type == SCTP_PARAM_IPV6_ADDRESS)) {
+ af = sctp_get_af_specific(param_type2af(param.p->type));
+- af->from_addr_param(&addr, param.addr,
+- chunk->sctp_hdr->source, 0);
++ if (!af->from_addr_param(&addr, param.addr,
++ chunk->sctp_hdr->source, 0))
++ continue;
+ if (sctp_cmp_addr_exact(sctp_source(chunk), &addr))
+ src_match = 1;
+ }
+@@ -2537,7 +2539,8 @@ static int sctp_process_param(struct sctp_association *asoc,
+ break;
+ do_addr_param:
+ af = sctp_get_af_specific(param_type2af(param.p->type));
+- af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0);
++ if (!af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0))
++ break;
+ scope = sctp_scope(peer_addr);
+ if (sctp_in_scope(net, &addr, scope))
+ if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_UNCONFIRMED))
+@@ -2634,15 +2637,13 @@ do_addr_param:
+ addr_param = param.v + sizeof(struct sctp_addip_param);
+
+ af = sctp_get_af_specific(param_type2af(addr_param->p.type));
+- if (af == NULL)
++ if (!af)
+ break;
+
+- af->from_addr_param(&addr, addr_param,
+- htons(asoc->peer.port), 0);
++ if (!af->from_addr_param(&addr, addr_param,
++ htons(asoc->peer.port), 0))
++ break;
+
+- /* if the address is invalid, we can't process it.
+- * XXX: see spec for what to do.
+- */
+ if (!af->addr_valid(&addr, NULL, NULL))
+ break;
+
+@@ -3059,7 +3060,8 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
+ if (unlikely(!af))
+ return SCTP_ERROR_DNS_FAILED;
+
+- af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0);
++ if (!af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0))
++ return SCTP_ERROR_DNS_FAILED;
+
+ /* ADDIP 4.2.1 This parameter MUST NOT contain a broadcast
+ * or multicast address.
+@@ -3336,7 +3338,8 @@ static void sctp_asconf_param_success(struct sctp_association *asoc,
+
+ /* We have checked the packet before, so we do not check again. */
+ af = sctp_get_af_specific(param_type2af(addr_param->p.type));
+- af->from_addr_param(&addr, addr_param, htons(bp->port), 0);
++ if (!af->from_addr_param(&addr, addr_param, htons(bp->port), 0))
++ return;
+
+ switch (asconf_param->param_hdr.type) {
+ case SCTP_PARAM_ADD_IP:
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index e2808586c9e61..e339f8da1b0a7 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -498,11 +498,21 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
+ struct list_head *q;
+ struct rpc_task *task;
+
++ /*
++ * Service the privileged queue.
++ */
++ q = &queue->tasks[RPC_NR_PRIORITY - 1];
++ if (queue->maxpriority > RPC_PRIORITY_PRIVILEGED && !list_empty(q)) {
++ task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
++ goto out;
++ }
++
+ /*
+ * Service a batch of tasks from a single owner.
+ */
+ q = &queue->tasks[queue->priority];
+- if (!list_empty(q) && --queue->nr) {
++ if (!list_empty(q) && queue->nr) {
++ queue->nr--;
+ task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
+ goto out;
+ }
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index aceafec612a8f..2d31fce5c2185 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1225,7 +1225,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
+
+ if (signal_pending(current)) {
+ err = sock_intr_errno(timeout);
+- sk->sk_state = TCP_CLOSE;
++ sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE;
+ sock->state = SS_UNCONNECTED;
+ vsock_transport_cancel_pkt(vsk);
+ goto out_wait;
+diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c
+index 33bef22e44e95..b379a03716539 100644
+--- a/net/wireless/wext-spy.c
++++ b/net/wireless/wext-spy.c
+@@ -120,8 +120,8 @@ int iw_handler_set_thrspy(struct net_device * dev,
+ return -EOPNOTSUPP;
+
+ /* Just do it */
+- memcpy(&(spydata->spy_thr_low), &(threshold->low),
+- 2 * sizeof(struct iw_quality));
++ spydata->spy_thr_low = threshold->low;
++ spydata->spy_thr_high = threshold->high;
+
+ /* Clear flag */
+ memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under));
+@@ -147,8 +147,8 @@ int iw_handler_get_thrspy(struct net_device * dev,
+ return -EOPNOTSUPP;
+
+ /* Just do it */
+- memcpy(&(threshold->low), &(spydata->spy_thr_low),
+- 2 * sizeof(struct iw_quality));
++ threshold->low = spydata->spy_thr_low;
++ threshold->high = spydata->spy_thr_high;
+
+ return 0;
+ }
+@@ -173,10 +173,10 @@ static void iw_send_thrspy_event(struct net_device * dev,
+ memcpy(threshold.addr.sa_data, address, ETH_ALEN);
+ threshold.addr.sa_family = ARPHRD_ETHER;
+ /* Copy stats */
+- memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality));
++ threshold.qual = *wstats;
+ /* Copy also thresholds */
+- memcpy(&(threshold.low), &(spydata->spy_thr_low),
+- 2 * sizeof(struct iw_quality));
++ threshold.low = spydata->spy_thr_low;
++ threshold.high = spydata->spy_thr_high;
+
+ /* Send event to user space */
+ wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 0b80c79077154..f94abe1fdd58f 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -579,6 +579,20 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
+
+ copy_from_user_state(x, p);
+
++ if (attrs[XFRMA_ENCAP]) {
++ x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
++ sizeof(*x->encap), GFP_KERNEL);
++ if (x->encap == NULL)
++ goto error;
++ }
++
++ if (attrs[XFRMA_COADDR]) {
++ x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
++ sizeof(*x->coaddr), GFP_KERNEL);
++ if (x->coaddr == NULL)
++ goto error;
++ }
++
+ if (attrs[XFRMA_SA_EXTRA_FLAGS])
+ x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]);
+
+@@ -599,23 +613,9 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
+ attrs[XFRMA_ALG_COMP])))
+ goto error;
+
+- if (attrs[XFRMA_ENCAP]) {
+- x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]),
+- sizeof(*x->encap), GFP_KERNEL);
+- if (x->encap == NULL)
+- goto error;
+- }
+-
+ if (attrs[XFRMA_TFCPAD])
+ x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]);
+
+- if (attrs[XFRMA_COADDR]) {
+- x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]),
+- sizeof(*x->coaddr), GFP_KERNEL);
+- if (x->coaddr == NULL)
+- goto error;
+- }
+-
+ xfrm_mark_get(attrs, &x->mark);
+
+ xfrm_smark_init(attrs, &x->props.smark);
+diff --git a/samples/bpf/xdp_redirect_user.c b/samples/bpf/xdp_redirect_user.c
+index 81a69e36cb788..0f96a26b6ec57 100644
+--- a/samples/bpf/xdp_redirect_user.c
++++ b/samples/bpf/xdp_redirect_user.c
+@@ -146,5 +146,5 @@ int main(int argc, char **argv)
+ poll_stats(2, ifindex_out);
+
+ out:
+- return 0;
++ return ret;
+ }
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index 651c0127c00de..d11a61f7b2009 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -523,7 +523,7 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
+ }
+
+ /*
+- * evm_inode_init_security - initializes security.evm
++ * evm_inode_init_security - initializes security.evm HMAC value
+ */
+ int evm_inode_init_security(struct inode *inode,
+ const struct xattr *lsm_xattr,
+@@ -532,7 +532,8 @@ int evm_inode_init_security(struct inode *inode,
+ struct evm_ima_xattr_data *xattr_data;
+ int rc;
+
+- if (!evm_key_loaded() || !evm_protected_xattr(lsm_xattr->name))
++ if (!(evm_initialized & EVM_INIT_HMAC) ||
++ !evm_protected_xattr(lsm_xattr->name))
+ return 0;
+
+ xattr_data = kzalloc(sizeof(*xattr_data), GFP_NOFS);
+diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
+index f112ca593adc1..c5c44203a59c3 100644
+--- a/security/integrity/evm/evm_secfs.c
++++ b/security/integrity/evm/evm_secfs.c
+@@ -71,12 +71,13 @@ static ssize_t evm_read_key(struct file *filp, char __user *buf,
+ static ssize_t evm_write_key(struct file *file, const char __user *buf,
+ size_t count, loff_t *ppos)
+ {
+- int i, ret;
++ unsigned int i;
++ int ret;
+
+ if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_SETUP_COMPLETE))
+ return -EPERM;
+
+- ret = kstrtoint_from_user(buf, count, 0, &i);
++ ret = kstrtouint_from_user(buf, count, 0, &i);
+
+ if (ret)
+ return ret;
+@@ -85,12 +86,12 @@ static ssize_t evm_write_key(struct file *file, const char __user *buf,
+ if (!i || (i & ~EVM_INIT_MASK) != 0)
+ return -EINVAL;
+
+- /* Don't allow a request to freshly enable metadata writes if
+- * keys are loaded.
++ /*
++ * Don't allow a request to enable metadata writes if
++ * an HMAC key is loaded.
+ */
+ if ((i & EVM_ALLOW_METADATA_WRITES) &&
+- ((evm_initialized & EVM_KEY_MASK) != 0) &&
+- !(evm_initialized & EVM_ALLOW_METADATA_WRITES))
++ (evm_initialized & EVM_INIT_HMAC) != 0)
+ return -EPERM;
+
+ if (i & EVM_INIT_HMAC) {
+diff --git a/security/selinux/avc.c b/security/selinux/avc.c
+index d52be7b9f08c8..717a4be771ab0 100644
+--- a/security/selinux/avc.c
++++ b/security/selinux/avc.c
+@@ -366,26 +366,27 @@ static struct avc_xperms_decision_node
+ struct avc_xperms_decision_node *xpd_node;
+ struct extended_perms_decision *xpd;
+
+- xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT);
++ xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep,
++ GFP_NOWAIT | __GFP_NOWARN);
+ if (!xpd_node)
+ return NULL;
+
+ xpd = &xpd_node->xpd;
+ if (which & XPERMS_ALLOWED) {
+ xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep,
+- GFP_NOWAIT);
++ GFP_NOWAIT | __GFP_NOWARN);
+ if (!xpd->allowed)
+ goto error;
+ }
+ if (which & XPERMS_AUDITALLOW) {
+ xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep,
+- GFP_NOWAIT);
++ GFP_NOWAIT | __GFP_NOWARN);
+ if (!xpd->auditallow)
+ goto error;
+ }
+ if (which & XPERMS_DONTAUDIT) {
+ xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep,
+- GFP_NOWAIT);
++ GFP_NOWAIT | __GFP_NOWARN);
+ if (!xpd->dontaudit)
+ goto error;
+ }
+@@ -413,7 +414,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void)
+ {
+ struct avc_xperms_node *xp_node;
+
+- xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT);
++ xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT | __GFP_NOWARN);
+ if (!xp_node)
+ return xp_node;
+ INIT_LIST_HEAD(&xp_node->xpd_head);
+@@ -569,7 +570,7 @@ static struct avc_node *avc_alloc_node(struct selinux_avc *avc)
+ {
+ struct avc_node *node;
+
+- node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT);
++ node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT | __GFP_NOWARN);
+ if (!node)
+ goto out;
+
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index 4f8c1a272df07..009e83ee2d002 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -883,6 +883,8 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
+ if (format == SMK_FIXED24_FMT &&
+ (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX))
+ return -EINVAL;
++ if (count > PAGE_SIZE)
++ return -EINVAL;
+
+ data = memdup_user_nul(buf, count);
+ if (IS_ERR(data))
+diff --git a/sound/ac97/bus.c b/sound/ac97/bus.c
+index ca50ff4447964..d8b227e6d4cfd 100644
+--- a/sound/ac97/bus.c
++++ b/sound/ac97/bus.c
+@@ -523,7 +523,7 @@ static int ac97_bus_remove(struct device *dev)
+ struct ac97_codec_driver *adrv = to_ac97_driver(dev->driver);
+ int ret;
+
+- ret = pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ return ret;
+
+diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig
+index a2ed164d80b49..f7b26b1d7084e 100644
+--- a/sound/firewire/Kconfig
++++ b/sound/firewire/Kconfig
+@@ -37,7 +37,7 @@ config SND_OXFW
+ * Mackie(Loud) Onyx 1640i (former model)
+ * Mackie(Loud) Onyx Satellite
+ * Mackie(Loud) Tapco Link.Firewire
+- * Mackie(Loud) d.4 pro
++ * Mackie(Loud) d.2 pro/d.4 pro (built-in FireWire card with OXFW971 ASIC)
+ * Mackie(Loud) U.420/U.420d
+ * TASCAM FireOne
+ * Stanton Controllers & Systems 1 Deck/Mixer
+@@ -83,7 +83,7 @@ config SND_BEBOB
+ * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394
+ * BridgeCo RDAudio1/Audio5
+ * Mackie Onyx 1220/1620/1640 (FireWire I/O Card)
+- * Mackie d.2 (FireWire Option) and d.2 Pro
++ * Mackie d.2 (optional FireWire card with DM1000 ASIC)
+ * Stanton FinalScratch 2 (ScratchAmp)
+ * Tascam IF-FW/DM
+ * Behringer XENIX UFX 1204/1604
+@@ -109,6 +109,7 @@ config SND_BEBOB
+ * M-Audio Ozonic/NRV10/ProfireLightBridge
+ * M-Audio FireWire 1814/ProjectMix IO
+ * Digidesign Mbox 2 Pro
++ * ToneWeal FW66
+
+ To compile this driver as a module, choose M here: the module
+ will be called snd-bebob.
+diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
+index 2bcfeee758538..eac3ff24e55d1 100644
+--- a/sound/firewire/bebob/bebob.c
++++ b/sound/firewire/bebob/bebob.c
+@@ -60,6 +60,7 @@ static DECLARE_BITMAP(devices_used, SNDRV_CARDS);
+ #define VEN_MAUDIO1 0x00000d6c
+ #define VEN_MAUDIO2 0x000007f5
+ #define VEN_DIGIDESIGN 0x00a07e
++#define OUI_SHOUYO 0x002327
+
+ #define MODEL_FOCUSRITE_SAFFIRE_BOTH 0x00000000
+ #define MODEL_MAUDIO_AUDIOPHILE_BOTH 0x00010060
+@@ -414,7 +415,7 @@ static const struct ieee1394_device_id bebob_id_table[] = {
+ SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal),
+ /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */
+ SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal),
+- // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in).
++ // Mackie, d.2 (optional Firewire card with DM1000).
+ SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal),
+ /* Stanton, ScratchAmp */
+ SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal),
+@@ -513,6 +514,8 @@ static const struct ieee1394_device_id bebob_id_table[] = {
+ &maudio_special_spec),
+ /* Digidesign Mbox 2 Pro */
+ SND_BEBOB_DEV_ENTRY(VEN_DIGIDESIGN, 0x0000a9, &spec_normal),
++ // Toneweal FW66.
++ SND_BEBOB_DEV_ENTRY(OUI_SHOUYO, 0x020002, &spec_normal),
+ /* IDs are unknown but able to be supported */
+ /* Apogee, Mini-ME Firewire */
+ /* Apogee, Mini-DAC Firewire */
+diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
+index 3c9aa797747b0..59c05c5dc1cbf 100644
+--- a/sound/firewire/oxfw/oxfw.c
++++ b/sound/firewire/oxfw/oxfw.c
+@@ -400,7 +400,7 @@ static const struct ieee1394_device_id oxfw_id_table[] = {
+ * Onyx-i series (former models): 0x081216
+ * Mackie Onyx Satellite: 0x00200f
+ * Tapco LINK.firewire 4x6: 0x000460
+- * d.4 pro: Unknown
++ * d.2 pro/d.4 pro (built-in card): Unknown
+ * U.420: Unknown
+ * U.420d: Unknown
+ */
+diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c
+index 6b8c46942efb4..75b3d76eb852e 100644
+--- a/sound/isa/cmi8330.c
++++ b/sound/isa/cmi8330.c
+@@ -564,7 +564,7 @@ static int snd_cmi8330_probe(struct snd_card *card, int dev)
+ }
+ if (acard->sb->hardware != SB_HW_16) {
+ snd_printk(KERN_ERR PFX "SB16 not found during probe\n");
+- return err;
++ return -ENODEV;
+ }
+
+ snd_wss_out(acard->wss, CS4231_MISC_INFO, 0x40); /* switch on MODE2 */
+diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
+index 2e00b64ef13bf..b3eecde0b6125 100644
+--- a/sound/isa/sb/sb16_csp.c
++++ b/sound/isa/sb/sb16_csp.c
+@@ -1086,10 +1086,14 @@ static void snd_sb_qsound_destroy(struct snd_sb_csp * p)
+ card = p->chip->card;
+
+ down_write(&card->controls_rwsem);
+- if (p->qsound_switch)
++ if (p->qsound_switch) {
+ snd_ctl_remove(card, p->qsound_switch);
+- if (p->qsound_space)
++ p->qsound_switch = NULL;
++ }
++ if (p->qsound_space) {
+ snd_ctl_remove(card, p->qsound_space);
++ p->qsound_space = NULL;
++ }
+ up_write(&card->controls_rwsem);
+
+ /* cancel pending transfer of QSound parameters */
+diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
+index e85fb04ec7be6..b567c4bdae000 100644
+--- a/sound/pci/hda/hda_tegra.c
++++ b/sound/pci/hda/hda_tegra.c
+@@ -363,6 +363,9 @@ static int hda_tegra_first_init(struct azx *chip, struct platform_device *pdev)
+ unsigned short gcap;
+ int irq_id = platform_get_irq(pdev, 0);
+
++ if (irq_id < 0)
++ return irq_id;
++
+ err = hda_tegra_init_chip(chip, pdev);
+ if (err)
+ return err;
+diff --git a/sound/ppc/powermac.c b/sound/ppc/powermac.c
+index 33c6be9fb388e..7c70ba5e2540d 100644
+--- a/sound/ppc/powermac.c
++++ b/sound/ppc/powermac.c
+@@ -90,7 +90,11 @@ static int snd_pmac_probe(struct platform_device *devptr)
+ sprintf(card->shortname, "PowerMac %s", name_ext);
+ sprintf(card->longname, "%s (Dev %d) Sub-frame %d",
+ card->shortname, chip->device_id, chip->subframe);
+- if ( snd_pmac_tumbler_init(chip) < 0 || snd_pmac_tumbler_post_init() < 0)
++ err = snd_pmac_tumbler_init(chip);
++ if (err < 0)
++ goto __error;
++ err = snd_pmac_tumbler_post_init();
++ if (err < 0)
+ goto __error;
+ break;
+ case PMAC_AWACS:
+diff --git a/sound/soc/atmel/atmel-i2s.c b/sound/soc/atmel/atmel-i2s.c
+index d88c1d995036c..99cc731505769 100644
+--- a/sound/soc/atmel/atmel-i2s.c
++++ b/sound/soc/atmel/atmel-i2s.c
+@@ -211,6 +211,7 @@ struct atmel_i2s_dev {
+ unsigned int fmt;
+ const struct atmel_i2s_gck_param *gck_param;
+ const struct atmel_i2s_caps *caps;
++ int clk_use_no;
+ };
+
+ static irqreturn_t atmel_i2s_interrupt(int irq, void *dev_id)
+@@ -332,9 +333,16 @@ static int atmel_i2s_hw_params(struct snd_pcm_substream *substream,
+ {
+ struct atmel_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
+ bool is_playback = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK);
+- unsigned int mr = 0;
++ unsigned int mr = 0, mr_mask;
+ int ret;
+
++ mr_mask = ATMEL_I2SC_MR_FORMAT_MASK | ATMEL_I2SC_MR_MODE_MASK |
++ ATMEL_I2SC_MR_DATALENGTH_MASK;
++ if (is_playback)
++ mr_mask |= ATMEL_I2SC_MR_TXMONO;
++ else
++ mr_mask |= ATMEL_I2SC_MR_RXMONO;
++
+ switch (dev->fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+ case SND_SOC_DAIFMT_I2S:
+ mr |= ATMEL_I2SC_MR_FORMAT_I2S;
+@@ -413,7 +421,7 @@ static int atmel_i2s_hw_params(struct snd_pcm_substream *substream,
+ return -EINVAL;
+ }
+
+- return regmap_write(dev->regmap, ATMEL_I2SC_MR, mr);
++ return regmap_update_bits(dev->regmap, ATMEL_I2SC_MR, mr_mask, mr);
+ }
+
+ static int atmel_i2s_switch_mck_generator(struct atmel_i2s_dev *dev,
+@@ -506,18 +514,28 @@ static int atmel_i2s_trigger(struct snd_pcm_substream *substream, int cmd,
+ is_master = (mr & ATMEL_I2SC_MR_MODE_MASK) == ATMEL_I2SC_MR_MODE_MASTER;
+
+ /* If master starts, enable the audio clock. */
+- if (is_master && mck_enabled)
+- err = atmel_i2s_switch_mck_generator(dev, true);
+- if (err)
+- return err;
++ if (is_master && mck_enabled) {
++ if (!dev->clk_use_no) {
++ err = atmel_i2s_switch_mck_generator(dev, true);
++ if (err)
++ return err;
++ }
++ dev->clk_use_no++;
++ }
+
+ err = regmap_write(dev->regmap, ATMEL_I2SC_CR, cr);
+ if (err)
+ return err;
+
+ /* If master stops, disable the audio clock. */
+- if (is_master && !mck_enabled)
+- err = atmel_i2s_switch_mck_generator(dev, false);
++ if (is_master && !mck_enabled) {
++ if (dev->clk_use_no == 1) {
++ err = atmel_i2s_switch_mck_generator(dev, false);
++ if (err)
++ return err;
++ }
++ dev->clk_use_no--;
++ }
+
+ return err;
+ }
+diff --git a/sound/soc/codecs/cs42l42.h b/sound/soc/codecs/cs42l42.h
+index bcaf4f22408d6..5a46e7d4f9a31 100644
+--- a/sound/soc/codecs/cs42l42.h
++++ b/sound/soc/codecs/cs42l42.h
+@@ -81,7 +81,7 @@
+ #define CS42L42_HP_PDN_SHIFT 3
+ #define CS42L42_HP_PDN_MASK (1 << CS42L42_HP_PDN_SHIFT)
+ #define CS42L42_ADC_PDN_SHIFT 2
+-#define CS42L42_ADC_PDN_MASK (1 << CS42L42_HP_PDN_SHIFT)
++#define CS42L42_ADC_PDN_MASK (1 << CS42L42_ADC_PDN_SHIFT)
+ #define CS42L42_PDN_ALL_SHIFT 0
+ #define CS42L42_PDN_ALL_MASK (1 << CS42L42_PDN_ALL_SHIFT)
+
+diff --git a/sound/soc/hisilicon/hi6210-i2s.c b/sound/soc/hisilicon/hi6210-i2s.c
+index 53344a3b7a608..864718ef874f1 100644
+--- a/sound/soc/hisilicon/hi6210-i2s.c
++++ b/sound/soc/hisilicon/hi6210-i2s.c
+@@ -110,18 +110,15 @@ static int hi6210_i2s_startup(struct snd_pcm_substream *substream,
+
+ for (n = 0; n < i2s->clocks; n++) {
+ ret = clk_prepare_enable(i2s->clk[n]);
+- if (ret) {
+- while (n--)
+- clk_disable_unprepare(i2s->clk[n]);
+- return ret;
+- }
++ if (ret)
++ goto err_unprepare_clk;
+ }
+
+ ret = clk_set_rate(i2s->clk[CLK_I2S_BASE], 49152000);
+ if (ret) {
+ dev_err(i2s->dev, "%s: setting 49.152MHz base rate failed %d\n",
+ __func__, ret);
+- return ret;
++ goto err_unprepare_clk;
+ }
+
+ /* enable clock before frequency division */
+@@ -173,6 +170,11 @@ static int hi6210_i2s_startup(struct snd_pcm_substream *substream,
+ hi6210_write_reg(i2s, HII2S_SW_RST_N, val);
+
+ return 0;
++
++err_unprepare_clk:
++ while (n--)
++ clk_disable_unprepare(i2s->clk[n]);
++ return ret;
+ }
+
+ static void hi6210_i2s_shutdown(struct snd_pcm_substream *substream,
+diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
+index 549a137878a65..dc08260031ee0 100644
+--- a/sound/soc/sh/rcar/adg.c
++++ b/sound/soc/sh/rcar/adg.c
+@@ -318,7 +318,6 @@ static void rsnd_adg_set_ssi_clk(struct rsnd_mod *ssi_mod, u32 val)
+ int rsnd_adg_clk_query(struct rsnd_priv *priv, unsigned int rate)
+ {
+ struct rsnd_adg *adg = rsnd_priv_to_adg(priv);
+- struct clk *clk;
+ int i;
+ int sel_table[] = {
+ [CLKA] = 0x1,
+@@ -331,10 +330,9 @@ int rsnd_adg_clk_query(struct rsnd_priv *priv, unsigned int rate)
+ * find suitable clock from
+ * AUDIO_CLKA/AUDIO_CLKB/AUDIO_CLKC/AUDIO_CLKI.
+ */
+- for_each_rsnd_clk(clk, adg, i) {
++ for (i = 0; i < CLKMAX; i++)
+ if (rate == adg->clk_rate[i])
+ return sel_table[i];
+- }
+
+ /*
+ * find divided clock from BRGA/BRGB
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 595fe20bbc6d3..8531b490f6f66 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -3510,7 +3510,7 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
+ if (!routes) {
+ dev_err(card->dev,
+ "ASoC: Could not allocate DAPM route table\n");
+- return -EINVAL;
++ return -ENOMEM;
+ }
+
+ for (i = 0; i < num_routes; i++) {
+diff --git a/sound/soc/tegra/tegra_alc5632.c b/sound/soc/tegra/tegra_alc5632.c
+index 98d87801d57a7..6fea7417332e2 100644
+--- a/sound/soc/tegra/tegra_alc5632.c
++++ b/sound/soc/tegra/tegra_alc5632.c
+@@ -137,6 +137,7 @@ static struct snd_soc_dai_link tegra_alc5632_dai = {
+
+ static struct snd_soc_card snd_soc_tegra_alc5632 = {
+ .name = "tegra-alc5632",
++ .driver_name = "tegra",
+ .owner = THIS_MODULE,
+ .dai_link = &tegra_alc5632_dai,
+ .num_links = 1,
+diff --git a/sound/soc/tegra/tegra_max98090.c b/sound/soc/tegra/tegra_max98090.c
+index cf142e2c7bd79..10998d703dcd1 100644
+--- a/sound/soc/tegra/tegra_max98090.c
++++ b/sound/soc/tegra/tegra_max98090.c
+@@ -188,6 +188,7 @@ static struct snd_soc_dai_link tegra_max98090_dai = {
+
+ static struct snd_soc_card snd_soc_tegra_max98090 = {
+ .name = "tegra-max98090",
++ .driver_name = "tegra",
+ .owner = THIS_MODULE,
+ .dai_link = &tegra_max98090_dai,
+ .num_links = 1,
+diff --git a/sound/soc/tegra/tegra_rt5640.c b/sound/soc/tegra/tegra_rt5640.c
+index fc81b48aa9d6a..e0cbe85b6d461 100644
+--- a/sound/soc/tegra/tegra_rt5640.c
++++ b/sound/soc/tegra/tegra_rt5640.c
+@@ -138,6 +138,7 @@ static struct snd_soc_dai_link tegra_rt5640_dai = {
+
+ static struct snd_soc_card snd_soc_tegra_rt5640 = {
+ .name = "tegra-rt5640",
++ .driver_name = "tegra",
+ .owner = THIS_MODULE,
+ .dai_link = &tegra_rt5640_dai,
+ .num_links = 1,
+diff --git a/sound/soc/tegra/tegra_rt5677.c b/sound/soc/tegra/tegra_rt5677.c
+index 7081f15302cc6..e285793d2b1ca 100644
+--- a/sound/soc/tegra/tegra_rt5677.c
++++ b/sound/soc/tegra/tegra_rt5677.c
+@@ -181,6 +181,7 @@ static struct snd_soc_dai_link tegra_rt5677_dai = {
+
+ static struct snd_soc_card snd_soc_tegra_rt5677 = {
+ .name = "tegra-rt5677",
++ .driver_name = "tegra",
+ .owner = THIS_MODULE,
+ .dai_link = &tegra_rt5677_dai,
+ .num_links = 1,
+diff --git a/sound/soc/tegra/tegra_sgtl5000.c b/sound/soc/tegra/tegra_sgtl5000.c
+index 901457da25ec3..e6cbc89eaa920 100644
+--- a/sound/soc/tegra/tegra_sgtl5000.c
++++ b/sound/soc/tegra/tegra_sgtl5000.c
+@@ -103,6 +103,7 @@ static struct snd_soc_dai_link tegra_sgtl5000_dai = {
+
+ static struct snd_soc_card snd_soc_tegra_sgtl5000 = {
+ .name = "tegra-sgtl5000",
++ .driver_name = "tegra",
+ .owner = THIS_MODULE,
+ .dai_link = &tegra_sgtl5000_dai,
+ .num_links = 1,
+diff --git a/sound/soc/tegra/tegra_wm8753.c b/sound/soc/tegra/tegra_wm8753.c
+index 23a810e3bacc0..3fa0e991308a6 100644
+--- a/sound/soc/tegra/tegra_wm8753.c
++++ b/sound/soc/tegra/tegra_wm8753.c
+@@ -110,6 +110,7 @@ static struct snd_soc_dai_link tegra_wm8753_dai = {
+
+ static struct snd_soc_card snd_soc_tegra_wm8753 = {
+ .name = "tegra-wm8753",
++ .driver_name = "tegra",
+ .owner = THIS_MODULE,
+ .dai_link = &tegra_wm8753_dai,
+ .num_links = 1,
+diff --git a/sound/soc/tegra/tegra_wm8903.c b/sound/soc/tegra/tegra_wm8903.c
+index 301850df368d6..8edcd82038d8d 100644
+--- a/sound/soc/tegra/tegra_wm8903.c
++++ b/sound/soc/tegra/tegra_wm8903.c
+@@ -226,6 +226,7 @@ static struct snd_soc_dai_link tegra_wm8903_dai = {
+
+ static struct snd_soc_card snd_soc_tegra_wm8903 = {
+ .name = "tegra-wm8903",
++ .driver_name = "tegra",
+ .owner = THIS_MODULE,
+ .dai_link = &tegra_wm8903_dai,
+ .num_links = 1,
+diff --git a/sound/soc/tegra/tegra_wm9712.c b/sound/soc/tegra/tegra_wm9712.c
+index 864a3345972e5..7175e6eea9113 100644
+--- a/sound/soc/tegra/tegra_wm9712.c
++++ b/sound/soc/tegra/tegra_wm9712.c
+@@ -59,6 +59,7 @@ static struct snd_soc_dai_link tegra_wm9712_dai = {
+
+ static struct snd_soc_card snd_soc_tegra_wm9712 = {
+ .name = "tegra-wm9712",
++ .driver_name = "tegra",
+ .owner = THIS_MODULE,
+ .dai_link = &tegra_wm9712_dai,
+ .num_links = 1,
+diff --git a/sound/soc/tegra/trimslice.c b/sound/soc/tegra/trimslice.c
+index 99bcdd979eb29..47ef6d6f4ae1c 100644
+--- a/sound/soc/tegra/trimslice.c
++++ b/sound/soc/tegra/trimslice.c
+@@ -103,6 +103,7 @@ static struct snd_soc_dai_link trimslice_tlv320aic23_dai = {
+
+ static struct snd_soc_card snd_soc_trimslice = {
+ .name = "tegra-trimslice",
++ .driver_name = "tegra",
+ .owner = THIS_MODULE,
+ .dai_link = &trimslice_tlv320aic23_dai,
+ .num_links = 1,
+diff --git a/sound/usb/format.c b/sound/usb/format.c
+index a3daf93c565aa..01ba7a939ac4b 100644
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -206,9 +206,11 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof
+ continue;
+ /* C-Media CM6501 mislabels its 96 kHz altsetting */
+ /* Terratec Aureon 7.1 USB C-Media 6206, too */
++ /* Ozone Z90 USB C-Media, too */
+ if (rate == 48000 && nr_rates == 1 &&
+ (chip->usb_id == USB_ID(0x0d8c, 0x0201) ||
+ chip->usb_id == USB_ID(0x0d8c, 0x0102) ||
++ chip->usb_id == USB_ID(0x0d8c, 0x0078) ||
+ chip->usb_id == USB_ID(0x0ccd, 0x00b1)) &&
+ fp->altsetting == 5 && fp->maxpacksize == 392)
+ rate = 96000;
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 4ad6eeb43476b..6c8cdce8156be 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -3260,8 +3260,9 @@ static void snd_usb_mixer_dump_cval(struct snd_info_buffer *buffer,
+ struct usb_mixer_elem_list *list)
+ {
+ struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list);
+- static const char * const val_types[] = {"BOOLEAN", "INV_BOOLEAN",
+- "S8", "U8", "S16", "U16"};
++ static const char * const val_types[] = {
++ "BOOLEAN", "INV_BOOLEAN", "S8", "U8", "S16", "U16", "S32", "U32",
++ };
+ snd_iprintf(buffer, " Info: id=%i, control=%i, cmask=0x%x, "
+ "channels=%i, type=\"%s\"\n", cval->head.id,
+ cval->control, cval->cmask, cval->channels,
+diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
+index d15a62be6cf0f..37610144f6b08 100644
+--- a/tools/bpf/bpftool/main.c
++++ b/tools/bpf/bpftool/main.c
+@@ -291,8 +291,10 @@ static int do_batch(int argc, char **argv)
+ n_argc = make_args(buf, n_argv, BATCH_ARG_NB_MAX, lines);
+ if (!n_argc)
+ continue;
+- if (n_argc < 0)
++ if (n_argc < 0) {
++ err = n_argc;
+ goto err_close;
++ }
+
+ if (json_output) {
+ jsonw_start_object(json_wtr);
+diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
+index 2344d86cd7786..46ec9a1bb94cc 100644
+--- a/tools/perf/util/llvm-utils.c
++++ b/tools/perf/util/llvm-utils.c
+@@ -500,6 +500,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
+ goto errout;
+ }
+
++ err = -ENOMEM;
+ if (asprintf(&pipe_template, "%s -emit-llvm | %s -march=bpf %s -filetype=obj -o -",
+ template, llc_path, opts) < 0) {
+ pr_err("ERROR:\tnot enough memory to setup command line\n");
+@@ -520,6 +521,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
+
+ pr_debug("llvm compiling command template: %s\n", template);
+
++ err = -ENOMEM;
+ if (asprintf(&command_echo, "echo -n \"%s\"", template) < 0)
+ goto errout;
+
+diff --git a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c
+index 8341d7778d5ed..87630d44fb4c7 100644
+--- a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c
++++ b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c
+@@ -50,8 +50,6 @@ static int no_handler_test(void)
+
+ event_close(&event);
+
+- dump_ebb_state();
+-
+ /* The real test is that we never took an EBB at 0x0 */
+
+ return 0;
+diff --git a/tools/testing/selftests/timers/rtcpie.c b/tools/testing/selftests/timers/rtcpie.c
+index 47b5bad1b3933..4ef2184f15588 100644
+--- a/tools/testing/selftests/timers/rtcpie.c
++++ b/tools/testing/selftests/timers/rtcpie.c
+@@ -18,6 +18,8 @@
+ #include <stdlib.h>
+ #include <errno.h>
+
++#include "../kselftest.h"
++
+ /*
+ * This expects the new RTC class driver framework, working with
+ * clocks that will often not be clones of what the PC-AT had.
+@@ -35,8 +37,14 @@ int main(int argc, char **argv)
+ switch (argc) {
+ case 2:
+ rtc = argv[1];
+- /* FALLTHROUGH */
++ break;
+ case 1:
++ fd = open(default_rtc, O_RDONLY);
++ if (fd == -1) {
++ printf("Default RTC %s does not exist. Test Skipped!\n", default_rtc);
++ exit(KSFT_SKIP);
++ }
++ close(fd);
+ break;
+ default:
+ fprintf(stderr, "usage: rtctest [rtcdev] [d]\n");
+diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
+index b8778960da106..27661302a6985 100644
+--- a/tools/testing/selftests/x86/protection_keys.c
++++ b/tools/testing/selftests/x86/protection_keys.c
+@@ -613,7 +613,6 @@ int alloc_random_pkey(void)
+ int nr_alloced = 0;
+ int random_index;
+ memset(alloced_pkeys, 0, sizeof(alloced_pkeys));
+- srand((unsigned int)time(NULL));
+
+ /* allocate every possible key and make a note of which ones we got */
+ max_nr_pkey_allocs = NR_PKEYS;
+@@ -1479,6 +1478,8 @@ int main(void)
+ {
+ int nr_iterations = 22;
+
++ srand((unsigned int)time(NULL));
++
+ setup_handlers();
+
+ printf("has pku: %d\n", cpu_has_pku());
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-07-28 12:37 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-07-28 12:37 UTC (permalink / raw
To: gentoo-commits
commit: a11a5a2eeaeebb570c0cc202ef0c8afe163870b8
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 28 12:37:07 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 28 12:37:07 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a11a5a2e
Linux patch 4.19.199
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1198_linux-4.19.199.patch | 4050 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4054 insertions(+)
diff --git a/0000_README b/0000_README
index c6a0532..f1619e0 100644
--- a/0000_README
+++ b/0000_README
@@ -831,6 +831,10 @@ Patch: 1197_linux-4.19.198.patch
From: https://www.kernel.org
Desc: Linux 4.19.198
+Patch: 1198_linux-4.19.199.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.199
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1198_linux-4.19.199.patch b/1198_linux-4.19.199.patch
new file mode 100644
index 0000000..2765242
--- /dev/null
+++ b/1198_linux-4.19.199.patch
@@ -0,0 +1,4050 @@
+diff --git a/Makefile b/Makefile
+index 09688ffc3f004..f3ad63a089a18 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 198
++SUBLEVEL = 199
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi
+index 887a60c317e9d..56f43a9f603d8 100644
+--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
+@@ -455,7 +455,7 @@
+ status = "disabled";
+ };
+
+- nand: nand@18046000 {
++ nand_controller: nand-controller@18046000 {
+ compatible = "brcm,nand-iproc", "brcm,brcmnand-v6.1";
+ reg = <0x18046000 0x600>, <0xf8105408 0x600>,
+ <0x18046f00 0x20>;
+diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
+index dd71ab08136be..30574101471a5 100644
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -179,7 +179,7 @@
+ status = "disabled";
+ };
+
+- nand: nand@26000 {
++ nand_controller: nand-controller@26000 {
+ compatible = "brcm,nand-iproc", "brcm,brcmnand-v6.1";
+ reg = <0x26000 0x600>,
+ <0x11b408 0x600>,
+diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
+index b395cb195db21..71918d208fb3a 100644
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -259,7 +259,7 @@
+ dma-coherent;
+ };
+
+- nand: nand@26000 {
++ nand_controller: nand-controller@26000 {
+ compatible = "brcm,nand-iproc", "brcm,brcmnand-v6.1";
+ reg = <0x026000 0x600>,
+ <0x11b408 0x600>,
+diff --git a/arch/arm/boot/dts/bcm63138.dtsi b/arch/arm/boot/dts/bcm63138.dtsi
+index 6df61518776f7..557098f5c8d53 100644
+--- a/arch/arm/boot/dts/bcm63138.dtsi
++++ b/arch/arm/boot/dts/bcm63138.dtsi
+@@ -175,7 +175,7 @@
+ status = "disabled";
+ };
+
+- nand: nand@2000 {
++ nand_controller: nand-controller@2000 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ compatible = "brcm,nand-bcm63138", "brcm,brcmnand-v7.0", "brcm,brcmnand";
+diff --git a/arch/arm/boot/dts/bcm7445-bcm97445svmb.dts b/arch/arm/boot/dts/bcm7445-bcm97445svmb.dts
+index 8006c69a3fdf6..5931c02882839 100644
+--- a/arch/arm/boot/dts/bcm7445-bcm97445svmb.dts
++++ b/arch/arm/boot/dts/bcm7445-bcm97445svmb.dts
+@@ -14,10 +14,10 @@
+ };
+ };
+
+-&nand {
++&nand_controller {
+ status = "okay";
+
+- nandcs@1 {
++ nand@1 {
+ compatible = "brcm,nandcs";
+ reg = <1>;
+ nand-ecc-step-size = <512>;
+diff --git a/arch/arm/boot/dts/bcm7445.dtsi b/arch/arm/boot/dts/bcm7445.dtsi
+index c859aa6f358ca..b06845e92acda 100644
+--- a/arch/arm/boot/dts/bcm7445.dtsi
++++ b/arch/arm/boot/dts/bcm7445.dtsi
+@@ -150,7 +150,7 @@
+ reg-names = "aon-ctrl", "aon-sram";
+ };
+
+- nand: nand@3e2800 {
++ nand_controller: nand-controller@3e2800 {
+ status = "disabled";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/bcm911360_entphn.dts b/arch/arm/boot/dts/bcm911360_entphn.dts
+index 53f990defd6ae..423a29a46b771 100644
+--- a/arch/arm/boot/dts/bcm911360_entphn.dts
++++ b/arch/arm/boot/dts/bcm911360_entphn.dts
+@@ -84,8 +84,8 @@
+ status = "okay";
+ };
+
+-&nand {
+- nandcs@1 {
++&nand_controller {
++ nand@1 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-on-flash-bbt;
+diff --git a/arch/arm/boot/dts/bcm958300k.dts b/arch/arm/boot/dts/bcm958300k.dts
+index b4a1392bd5a6c..dda3e11b711f6 100644
+--- a/arch/arm/boot/dts/bcm958300k.dts
++++ b/arch/arm/boot/dts/bcm958300k.dts
+@@ -60,8 +60,8 @@
+ status = "okay";
+ };
+
+-&nand {
+- nandcs@1 {
++&nand_controller {
++ nand@1 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-on-flash-bbt;
+diff --git a/arch/arm/boot/dts/bcm958305k.dts b/arch/arm/boot/dts/bcm958305k.dts
+index 3378683321d3c..ea3c6b88b313b 100644
+--- a/arch/arm/boot/dts/bcm958305k.dts
++++ b/arch/arm/boot/dts/bcm958305k.dts
+@@ -68,8 +68,8 @@
+ status = "okay";
+ };
+
+-&nand {
+- nandcs@1 {
++&nand_controller {
++ nand@1 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-on-flash-bbt;
+diff --git a/arch/arm/boot/dts/bcm958522er.dts b/arch/arm/boot/dts/bcm958522er.dts
+index f9dd342cc2ae4..56f9181975b1a 100644
+--- a/arch/arm/boot/dts/bcm958522er.dts
++++ b/arch/arm/boot/dts/bcm958522er.dts
+@@ -74,8 +74,8 @@
+ status = "okay";
+ };
+
+-&nand {
+- nandcs@0 {
++&nand_controller {
++ nand@0 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-on-flash-bbt;
+diff --git a/arch/arm/boot/dts/bcm958525er.dts b/arch/arm/boot/dts/bcm958525er.dts
+index 374508a9cfbfb..93a3e23ec7ae4 100644
+--- a/arch/arm/boot/dts/bcm958525er.dts
++++ b/arch/arm/boot/dts/bcm958525er.dts
+@@ -74,8 +74,8 @@
+ status = "okay";
+ };
+
+-&nand {
+- nandcs@0 {
++&nand_controller {
++ nand@0 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-on-flash-bbt;
+diff --git a/arch/arm/boot/dts/bcm958525xmc.dts b/arch/arm/boot/dts/bcm958525xmc.dts
+index 403250c5ad8e7..fad974212d8af 100644
+--- a/arch/arm/boot/dts/bcm958525xmc.dts
++++ b/arch/arm/boot/dts/bcm958525xmc.dts
+@@ -90,8 +90,8 @@
+ };
+ };
+
+-&nand {
+- nandcs@0 {
++&nand_controller {
++ nand@0 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-on-flash-bbt;
+diff --git a/arch/arm/boot/dts/bcm958622hr.dts b/arch/arm/boot/dts/bcm958622hr.dts
+index ecd05e26c2629..76ff9c50f62ca 100644
+--- a/arch/arm/boot/dts/bcm958622hr.dts
++++ b/arch/arm/boot/dts/bcm958622hr.dts
+@@ -78,8 +78,8 @@
+ status = "okay";
+ };
+
+-&nand {
+- nandcs@0 {
++&nand_controller {
++ nand@0 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-on-flash-bbt;
+diff --git a/arch/arm/boot/dts/bcm958623hr.dts b/arch/arm/boot/dts/bcm958623hr.dts
+index f5e85b301497c..c2c90ea328a19 100644
+--- a/arch/arm/boot/dts/bcm958623hr.dts
++++ b/arch/arm/boot/dts/bcm958623hr.dts
+@@ -78,8 +78,8 @@
+ status = "okay";
+ };
+
+-&nand {
+- nandcs@0 {
++&nand_controller {
++ nand@0 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-on-flash-bbt;
+diff --git a/arch/arm/boot/dts/bcm958625hr.dts b/arch/arm/boot/dts/bcm958625hr.dts
+index ea3fc194f8f37..6d0179acab38f 100644
+--- a/arch/arm/boot/dts/bcm958625hr.dts
++++ b/arch/arm/boot/dts/bcm958625hr.dts
+@@ -76,8 +76,8 @@
+ status = "okay";
+ };
+
+-&nand {
+- nandcs@0 {
++&nand_controller {
++ nand@0 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-on-flash-bbt;
+diff --git a/arch/arm/boot/dts/bcm958625k.dts b/arch/arm/boot/dts/bcm958625k.dts
+index 3ea5f739e90be..579a88ce5b7f5 100644
+--- a/arch/arm/boot/dts/bcm958625k.dts
++++ b/arch/arm/boot/dts/bcm958625k.dts
+@@ -69,8 +69,8 @@
+ status = "okay";
+ };
+
+-&nand {
+- nandcs@0 {
++&nand_controller {
++ nand@0 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-on-flash-bbt;
+diff --git a/arch/arm/boot/dts/bcm963138dvt.dts b/arch/arm/boot/dts/bcm963138dvt.dts
+index c61673638fa8a..5445fccec5a54 100644
+--- a/arch/arm/boot/dts/bcm963138dvt.dts
++++ b/arch/arm/boot/dts/bcm963138dvt.dts
+@@ -30,10 +30,10 @@
+ status = "okay";
+ };
+
+-&nand {
++&nand_controller {
+ status = "okay";
+
+- nandcs@0 {
++ nand@0 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-ecc-strength = <4>;
+diff --git a/arch/arm/boot/dts/bcm988312hr.dts b/arch/arm/boot/dts/bcm988312hr.dts
+index ea9a0806b4460..a03224c54bbbb 100644
+--- a/arch/arm/boot/dts/bcm988312hr.dts
++++ b/arch/arm/boot/dts/bcm988312hr.dts
+@@ -78,8 +78,8 @@
+ status = "okay";
+ };
+
+-&nand {
+- nandcs@0 {
++&nand_controller {
++ nand@0 {
+ compatible = "brcm,nandcs";
+ reg = <0>;
+ nand-on-flash-bbt;
+diff --git a/arch/arm/boot/dts/gemini-dlink-dns-313.dts b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
+index 361dccd6c7eee..431c705a7b905 100644
+--- a/arch/arm/boot/dts/gemini-dlink-dns-313.dts
++++ b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
+@@ -140,7 +140,7 @@
+ };
+ };
+
+- mdio0: ethernet-phy {
++ mdio0: mdio {
+ compatible = "virtual,mdio-gpio";
+ /* Uses MDC and MDIO */
+ gpios = <&gpio0 22 GPIO_ACTIVE_HIGH>, /* MDC */
+diff --git a/arch/arm/boot/dts/gemini-nas4220b.dts b/arch/arm/boot/dts/gemini-nas4220b.dts
+index 963ea890c87f2..1c5f7f9e7be33 100644
+--- a/arch/arm/boot/dts/gemini-nas4220b.dts
++++ b/arch/arm/boot/dts/gemini-nas4220b.dts
+@@ -62,7 +62,7 @@
+ };
+ };
+
+- mdio0: ethernet-phy {
++ mdio0: mdio {
+ compatible = "virtual,mdio-gpio";
+ gpios = <&gpio0 22 GPIO_ACTIVE_HIGH>, /* MDC */
+ <&gpio0 21 GPIO_ACTIVE_HIGH>; /* MDIO */
+diff --git a/arch/arm/boot/dts/gemini-rut1xx.dts b/arch/arm/boot/dts/gemini-rut1xx.dts
+index eb4f0bf074da3..c067c3778f1da 100644
+--- a/arch/arm/boot/dts/gemini-rut1xx.dts
++++ b/arch/arm/boot/dts/gemini-rut1xx.dts
+@@ -56,7 +56,7 @@
+ };
+ };
+
+- mdio0: ethernet-phy {
++ mdio0: mdio {
+ compatible = "virtual,mdio-gpio";
+ gpios = <&gpio0 22 GPIO_ACTIVE_HIGH>, /* MDC */
+ <&gpio0 21 GPIO_ACTIVE_HIGH>; /* MDIO */
+diff --git a/arch/arm/boot/dts/gemini-wbd111.dts b/arch/arm/boot/dts/gemini-wbd111.dts
+index 29af86cd10f7d..52c10ec0dc725 100644
+--- a/arch/arm/boot/dts/gemini-wbd111.dts
++++ b/arch/arm/boot/dts/gemini-wbd111.dts
+@@ -68,7 +68,7 @@
+ };
+ };
+
+- mdio0: ethernet-phy {
++ mdio0: mdio {
+ compatible = "virtual,mdio-gpio";
+ gpios = <&gpio0 22 GPIO_ACTIVE_HIGH>, /* MDC */
+ <&gpio0 21 GPIO_ACTIVE_HIGH>; /* MDIO */
+diff --git a/arch/arm/boot/dts/gemini-wbd222.dts b/arch/arm/boot/dts/gemini-wbd222.dts
+index 24e6ae3616f71..73de5cfa01f88 100644
+--- a/arch/arm/boot/dts/gemini-wbd222.dts
++++ b/arch/arm/boot/dts/gemini-wbd222.dts
+@@ -67,7 +67,7 @@
+ };
+ };
+
+- mdio0: ethernet-phy {
++ mdio0: mdio {
+ compatible = "virtual,mdio-gpio";
+ gpios = <&gpio0 22 GPIO_ACTIVE_HIGH>, /* MDC */
+ <&gpio0 21 GPIO_ACTIVE_HIGH>; /* MDIO */
+diff --git a/arch/arm/boot/dts/gemini.dtsi b/arch/arm/boot/dts/gemini.dtsi
+index eb752e9495de1..4949951e35972 100644
+--- a/arch/arm/boot/dts/gemini.dtsi
++++ b/arch/arm/boot/dts/gemini.dtsi
+@@ -286,6 +286,7 @@
+ clock-names = "PCLK", "PCICLK";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pci_default_pins>;
++ device_type = "pci";
+ #address-cells = <3>;
+ #size-cells = <2>;
+ #interrupt-cells = <1>;
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+index 9499d113b1394..25462f7789949 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+@@ -306,8 +306,8 @@
+ fsl,pins = <
+ MX6QDL_PAD_EIM_D24__UART3_TX_DATA 0x1b0b1
+ MX6QDL_PAD_EIM_D25__UART3_RX_DATA 0x1b0b1
+- MX6QDL_PAD_EIM_D30__UART3_RTS_B 0x1b0b1
+- MX6QDL_PAD_EIM_D31__UART3_CTS_B 0x1b0b1
++ MX6QDL_PAD_EIM_D31__UART3_RTS_B 0x1b0b1
++ MX6QDL_PAD_EIM_D30__UART3_CTS_B 0x1b0b1
+ >;
+ };
+
+@@ -394,6 +394,7 @@
+ &uart3 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_uart3>;
++ uart-has-rtscts;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm/boot/dts/rk3036-kylin.dts b/arch/arm/boot/dts/rk3036-kylin.dts
+index 0fd19f9723dfc..cd109aebb7831 100644
+--- a/arch/arm/boot/dts/rk3036-kylin.dts
++++ b/arch/arm/boot/dts/rk3036-kylin.dts
+@@ -391,7 +391,7 @@
+ };
+ };
+
+- sleep {
++ suspend {
+ global_pwroff: global-pwroff {
+ rockchip,pins = <2 7 RK_FUNC_1 &pcfg_pull_none>;
+ };
+diff --git a/arch/arm/boot/dts/rk3188.dtsi b/arch/arm/boot/dts/rk3188.dtsi
+index aa123f93f181c..3b7cae6f41275 100644
+--- a/arch/arm/boot/dts/rk3188.dtsi
++++ b/arch/arm/boot/dts/rk3188.dtsi
+@@ -73,16 +73,16 @@
+ compatible = "rockchip,rk3188-timer", "rockchip,rk3288-timer";
+ reg = <0x2000e000 0x20>;
+ interrupts = <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&cru SCLK_TIMER3>, <&cru PCLK_TIMER3>;
+- clock-names = "timer", "pclk";
++ clocks = <&cru PCLK_TIMER3>, <&cru SCLK_TIMER3>;
++ clock-names = "pclk", "timer";
+ };
+
+ timer6: timer@200380a0 {
+ compatible = "rockchip,rk3188-timer", "rockchip,rk3288-timer";
+ reg = <0x200380a0 0x20>;
+ interrupts = <GIC_SPI 64 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&cru SCLK_TIMER6>, <&cru PCLK_TIMER0>;
+- clock-names = "timer", "pclk";
++ clocks = <&cru PCLK_TIMER0>, <&cru SCLK_TIMER6>;
++ clock-names = "pclk", "timer";
+ };
+
+ i2s0: i2s@1011a000 {
+diff --git a/arch/arm/boot/dts/rk322x.dtsi b/arch/arm/boot/dts/rk322x.dtsi
+index 2aa74267ae51d..3fe874cab38c6 100644
+--- a/arch/arm/boot/dts/rk322x.dtsi
++++ b/arch/arm/boot/dts/rk322x.dtsi
+@@ -548,10 +548,9 @@
+ compatible = "rockchip,iommu";
+ reg = <0x20020800 0x100>;
+ interrupts = <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "vpu_mmu";
+ clocks = <&cru ACLK_VPU>, <&cru HCLK_VPU>;
+ clock-names = "aclk", "iface";
+- iommu-cells = <0>;
++ #iommu-cells = <0>;
+ status = "disabled";
+ };
+
+@@ -559,10 +558,9 @@
+ compatible = "rockchip,iommu";
+ reg = <0x20030480 0x40>, <0x200304c0 0x40>;
+ interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "vdec_mmu";
+ clocks = <&cru ACLK_RKVDEC>, <&cru HCLK_RKVDEC>;
+ clock-names = "aclk", "iface";
+- iommu-cells = <0>;
++ #iommu-cells = <0>;
+ status = "disabled";
+ };
+
+@@ -570,7 +568,6 @@
+ compatible = "rockchip,iommu";
+ reg = <0x20053f00 0x100>;
+ interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "vop_mmu";
+ clocks = <&cru ACLK_VOP>, <&cru HCLK_VOP>;
+ clock-names = "aclk", "iface";
+ iommu-cells = <0>;
+@@ -581,10 +578,9 @@
+ compatible = "rockchip,iommu";
+ reg = <0x20070800 0x100>;
+ interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "iep_mmu";
+ clocks = <&cru ACLK_IEP>, <&cru HCLK_IEP>;
+ clock-names = "aclk", "iface";
+- iommu-cells = <0>;
++ #iommu-cells = <0>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm/boot/dts/rk3288-rock2-som.dtsi b/arch/arm/boot/dts/rk3288-rock2-som.dtsi
+index 32e1ab3366629..8c3fa4749de6a 100644
+--- a/arch/arm/boot/dts/rk3288-rock2-som.dtsi
++++ b/arch/arm/boot/dts/rk3288-rock2-som.dtsi
+@@ -218,7 +218,7 @@
+ flash0-supply = <&vcc_flash>;
+ flash1-supply = <&vccio_pmu>;
+ gpio30-supply = <&vccio_pmu>;
+- gpio1830 = <&vcc_io>;
++ gpio1830-supply = <&vcc_io>;
+ lcdc-supply = <&vcc_io>;
+ sdcard-supply = <&vccio_sd>;
+ wifi-supply = <&vcc_18>;
+diff --git a/arch/arm/boot/dts/rk3288-vyasa.dts b/arch/arm/boot/dts/rk3288-vyasa.dts
+index 4856a9fc0aea9..0be70dc8281c7 100644
+--- a/arch/arm/boot/dts/rk3288-vyasa.dts
++++ b/arch/arm/boot/dts/rk3288-vyasa.dts
+@@ -358,10 +358,10 @@
+ audio-supply = <&vcc_18>;
+ bb-supply = <&vcc_io>;
+ dvp-supply = <&vcc_io>;
+- flash0-suuply = <&vcc_18>;
++ flash0-supply = <&vcc_18>;
+ flash1-supply = <&vcc_lan>;
+ gpio30-supply = <&vcc_io>;
+- gpio1830 = <&vcc_io>;
++ gpio1830-supply = <&vcc_io>;
+ lcdc-supply = <&vcc_io>;
+ sdcard-supply = <&vccio_sd>;
+ wifi-supply = <&vcc_18>;
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
+index 440d6783faca5..2ff81f3736c85 100644
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -234,8 +234,8 @@
+ compatible = "rockchip,rk3288-timer";
+ reg = <0x0 0xff810000 0x0 0x20>;
+ interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>, <&cru PCLK_TIMER>;
+- clock-names = "timer", "pclk";
++ clocks = <&cru PCLK_TIMER>, <&xin24m>;
++ clock-names = "pclk", "timer";
+ };
+
+ display-subsystem {
+@@ -759,7 +759,7 @@
+ * *_HDMI HDMI
+ * *_MIPI_* MIPI
+ */
+- pd_vio@RK3288_PD_VIO {
++ power-domain@RK3288_PD_VIO {
+ reg = <RK3288_PD_VIO>;
+ clocks = <&cru ACLK_IEP>,
+ <&cru ACLK_ISP>,
+@@ -801,7 +801,7 @@
+ * Note: The following 3 are HEVC(H.265) clocks,
+ * and on the ACLK_HEVC_NIU (NOC).
+ */
+- pd_hevc@RK3288_PD_HEVC {
++ power-domain@RK3288_PD_HEVC {
+ reg = <RK3288_PD_HEVC>;
+ clocks = <&cru ACLK_HEVC>,
+ <&cru SCLK_HEVC_CABAC>,
+@@ -815,7 +815,7 @@
+ * (video endecoder & decoder) clocks that on the
+ * ACLK_VCODEC_NIU and HCLK_VCODEC_NIU (NOC).
+ */
+- pd_video@RK3288_PD_VIDEO {
++ power-domain@RK3288_PD_VIDEO {
+ reg = <RK3288_PD_VIDEO>;
+ clocks = <&cru ACLK_VCODEC>,
+ <&cru HCLK_VCODEC>;
+@@ -826,7 +826,7 @@
+ * Note: ACLK_GPU is the GPU clock,
+ * and on the ACLK_GPU_NIU (NOC).
+ */
+- pd_gpu@RK3288_PD_GPU {
++ power-domain@RK3288_PD_GPU {
+ reg = <RK3288_PD_GPU>;
+ clocks = <&cru ACLK_GPU>;
+ pm_qos = <&qos_gpu_r>,
+@@ -1541,7 +1541,7 @@
+ drive-strength = <12>;
+ };
+
+- sleep {
++ suspend {
+ global_pwroff: global-pwroff {
+ rockchip,pins = <0 0 RK_FUNC_1 &pcfg_pull_none>;
+ };
+diff --git a/arch/arm/boot/dts/stm32429i-eval.dts b/arch/arm/boot/dts/stm32429i-eval.dts
+index 7eb786a2d6247..f5429e4950242 100644
+--- a/arch/arm/boot/dts/stm32429i-eval.dts
++++ b/arch/arm/boot/dts/stm32429i-eval.dts
+@@ -111,17 +111,15 @@
+ };
+ };
+
+- gpio_keys {
++ gpio-keys {
+ compatible = "gpio-keys";
+- #address-cells = <1>;
+- #size-cells = <0>;
+ autorepeat;
+- button@0 {
++ button-0 {
+ label = "Wake up";
+ linux,code = <KEY_WAKEUP>;
+ gpios = <&gpioa 0 0>;
+ };
+- button@1 {
++ button-1 {
+ label = "Tamper";
+ linux,code = <KEY_RESTART>;
+ gpios = <&gpioc 13 0>;
+diff --git a/arch/arm/boot/dts/stm32746g-eval.dts b/arch/arm/boot/dts/stm32746g-eval.dts
+index 8c081eaf20fea..f99b5df4c12f4 100644
+--- a/arch/arm/boot/dts/stm32746g-eval.dts
++++ b/arch/arm/boot/dts/stm32746g-eval.dts
+@@ -73,12 +73,10 @@
+ };
+ };
+
+- gpio_keys {
++ gpio-keys {
+ compatible = "gpio-keys";
+- #address-cells = <1>;
+- #size-cells = <0>;
+ autorepeat;
+- button@0 {
++ button-0 {
+ label = "Wake up";
+ linux,code = <KEY_WAKEUP>;
+ gpios = <&gpioc 13 0>;
+diff --git a/arch/arm/boot/dts/stm32f429-disco.dts b/arch/arm/boot/dts/stm32f429-disco.dts
+index 5ceb2cf3777ff..bcf2a5cfd6b24 100644
+--- a/arch/arm/boot/dts/stm32f429-disco.dts
++++ b/arch/arm/boot/dts/stm32f429-disco.dts
+@@ -78,12 +78,10 @@
+ };
+ };
+
+- gpio_keys {
++ gpio-keys {
+ compatible = "gpio-keys";
+- #address-cells = <1>;
+- #size-cells = <0>;
+ autorepeat;
+- button@0 {
++ button-0 {
+ label = "User";
+ linux,code = <KEY_HOME>;
+ gpios = <&gpioa 0 0>;
+diff --git a/arch/arm/boot/dts/stm32f429.dtsi b/arch/arm/boot/dts/stm32f429.dtsi
+index e35d782e7e5f2..fdaf432900060 100644
+--- a/arch/arm/boot/dts/stm32f429.dtsi
++++ b/arch/arm/boot/dts/stm32f429.dtsi
+@@ -263,8 +263,6 @@
+ };
+
+ timers13: timers@40001c00 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ compatible = "st,stm32-timers";
+ reg = <0x40001C00 0x400>;
+ clocks = <&rcc 0 STM32F4_APB1_CLOCK(TIM13)>;
+@@ -278,8 +276,6 @@
+ };
+
+ timers14: timers@40002000 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ compatible = "st,stm32-timers";
+ reg = <0x40002000 0x400>;
+ clocks = <&rcc 0 STM32F4_APB1_CLOCK(TIM14)>;
+@@ -558,8 +554,6 @@
+ };
+
+ timers10: timers@40014400 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ compatible = "st,stm32-timers";
+ reg = <0x40014400 0x400>;
+ clocks = <&rcc 0 STM32F4_APB2_CLOCK(TIM10)>;
+@@ -573,8 +567,6 @@
+ };
+
+ timers11: timers@40014800 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ compatible = "st,stm32-timers";
+ reg = <0x40014800 0x400>;
+ clocks = <&rcc 0 STM32F4_APB2_CLOCK(TIM11)>;
+@@ -609,7 +601,7 @@
+ status = "disabled";
+ };
+
+- rcc: rcc@40023810 {
++ rcc: rcc@40023800 {
+ #reset-cells = <1>;
+ #clock-cells = <2>;
+ compatible = "st,stm32f42xx-rcc", "st,stm32-rcc";
+diff --git a/arch/arm/boot/dts/stm32f469-disco.dts b/arch/arm/boot/dts/stm32f469-disco.dts
+index eea979ef5512f..881210d820bb7 100644
+--- a/arch/arm/boot/dts/stm32f469-disco.dts
++++ b/arch/arm/boot/dts/stm32f469-disco.dts
+@@ -103,12 +103,10 @@
+ };
+ };
+
+- gpio_keys {
++ gpio-keys {
+ compatible = "gpio-keys";
+- #address-cells = <1>;
+- #size-cells = <0>;
+ autorepeat;
+- button@0 {
++ button-0 {
+ label = "User";
+ linux,code = <KEY_WAKEUP>;
+ gpios = <&gpioa 0 GPIO_ACTIVE_HIGH>;
+diff --git a/arch/arm/boot/dts/stm32f746.dtsi b/arch/arm/boot/dts/stm32f746.dtsi
+index f48d06a80d1d6..be62d9091e038 100644
+--- a/arch/arm/boot/dts/stm32f746.dtsi
++++ b/arch/arm/boot/dts/stm32f746.dtsi
+@@ -258,8 +258,6 @@
+ };
+
+ timers13: timers@40001c00 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ compatible = "st,stm32-timers";
+ reg = <0x40001C00 0x400>;
+ clocks = <&rcc 0 STM32F7_APB1_CLOCK(TIM13)>;
+@@ -273,8 +271,6 @@
+ };
+
+ timers14: timers@40002000 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ compatible = "st,stm32-timers";
+ reg = <0x40002000 0x400>;
+ clocks = <&rcc 0 STM32F7_APB1_CLOCK(TIM14)>;
+@@ -357,9 +353,9 @@
+ status = "disabled";
+ };
+
+- i2c3: i2c@40005C00 {
++ i2c3: i2c@40005c00 {
+ compatible = "st,stm32f7-i2c";
+- reg = <0x40005C00 0x400>;
++ reg = <0x40005c00 0x400>;
+ interrupts = <72>,
+ <73>;
+ resets = <&rcc STM32F7_APB1_RESET(I2C3)>;
+@@ -521,8 +517,6 @@
+ };
+
+ timers10: timers@40014400 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ compatible = "st,stm32-timers";
+ reg = <0x40014400 0x400>;
+ clocks = <&rcc 0 STM32F7_APB2_CLOCK(TIM10)>;
+@@ -536,8 +530,6 @@
+ };
+
+ timers11: timers@40014800 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ compatible = "st,stm32-timers";
+ reg = <0x40014800 0x400>;
+ clocks = <&rcc 0 STM32F7_APB2_CLOCK(TIM11)>;
+diff --git a/arch/arm/boot/dts/stm32f769-disco.dts b/arch/arm/boot/dts/stm32f769-disco.dts
+index 677276ba4dbe8..80516f44bb19b 100644
+--- a/arch/arm/boot/dts/stm32f769-disco.dts
++++ b/arch/arm/boot/dts/stm32f769-disco.dts
+@@ -74,12 +74,10 @@
+ };
+ };
+
+- gpio_keys {
++ gpio-keys {
+ compatible = "gpio-keys";
+- #address-cells = <1>;
+- #size-cells = <0>;
+ autorepeat;
+- button@0 {
++ button-0 {
+ label = "User";
+ linux,code = <KEY_HOME>;
+ gpios = <&gpioa 0 GPIO_ACTIVE_HIGH>;
+diff --git a/arch/arm/boot/dts/stm32h743.dtsi b/arch/arm/boot/dts/stm32h743.dtsi
+index 637beffe50670..729ff6264776c 100644
+--- a/arch/arm/boot/dts/stm32h743.dtsi
++++ b/arch/arm/boot/dts/stm32h743.dtsi
+@@ -422,8 +422,6 @@
+ };
+
+ lptimer4: timer@58002c00 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ compatible = "st,stm32-lptimer";
+ reg = <0x58002c00 0x400>;
+ clocks = <&rcc LPTIM4_CK>;
+@@ -438,8 +436,6 @@
+ };
+
+ lptimer5: timer@58003000 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ compatible = "st,stm32-lptimer";
+ reg = <0x58003000 0x400>;
+ clocks = <&rcc LPTIM5_CK>;
+diff --git a/arch/arm/boot/dts/stm32mp157c.dtsi b/arch/arm/boot/dts/stm32mp157c.dtsi
+index c50c36baba758..4278a4b228606 100644
+--- a/arch/arm/boot/dts/stm32mp157c.dtsi
++++ b/arch/arm/boot/dts/stm32mp157c.dtsi
+@@ -964,12 +964,6 @@
+ status = "disabled";
+ };
+
+- stmmac_axi_config_0: stmmac-axi-config {
+- snps,wr_osr_lmt = <0x7>;
+- snps,rd_osr_lmt = <0x7>;
+- snps,blen = <0 0 0 0 16 8 4>;
+- };
+-
+ ethernet0: ethernet@5800a000 {
+ compatible = "st,stm32mp1-dwmac", "snps,dwmac-4.20a";
+ reg = <0x5800a000 0x2000>;
+@@ -992,6 +986,12 @@
+ snps,axi-config = <&stmmac_axi_config_0>;
+ snps,tso;
+ status = "disabled";
++
++ stmmac_axi_config_0: stmmac-axi-config {
++ snps,wr_osr_lmt = <0x7>;
++ snps,rd_osr_lmt = <0x7>;
++ snps,blen = <0 0 0 0 16 8 4>;
++ };
+ };
+
+ usbh_ohci: usbh-ohci@5800c000 {
+diff --git a/arch/arm/mach-imx/suspend-imx53.S b/arch/arm/mach-imx/suspend-imx53.S
+index 5ed078ad110aa..f12d24104075b 100644
+--- a/arch/arm/mach-imx/suspend-imx53.S
++++ b/arch/arm/mach-imx/suspend-imx53.S
+@@ -33,11 +33,11 @@
+ * ^
+ * ^
+ * imx53_suspend code
+- * PM_INFO structure(imx53_suspend_info)
++ * PM_INFO structure(imx5_cpu_suspend_info)
+ * ======================== low address =======================
+ */
+
+-/* Offsets of members of struct imx53_suspend_info */
++/* Offsets of members of struct imx5_cpu_suspend_info */
+ #define SUSPEND_INFO_MX53_M4IF_V_OFFSET 0x0
+ #define SUSPEND_INFO_MX53_IOMUXC_V_OFFSET 0x4
+ #define SUSPEND_INFO_MX53_IO_COUNT_OFFSET 0x8
+diff --git a/arch/arm64/boot/dts/arm/juno-base.dtsi b/arch/arm64/boot/dts/arm/juno-base.dtsi
+index b6f486737589a..331862504dc33 100644
+--- a/arch/arm64/boot/dts/arm/juno-base.dtsi
++++ b/arch/arm64/boot/dts/arm/juno-base.dtsi
+@@ -533,13 +533,13 @@
+ clocks {
+ compatible = "arm,scpi-clocks";
+
+- scpi_dvfs: scpi-dvfs {
++ scpi_dvfs: clocks-0 {
+ compatible = "arm,scpi-dvfs-clocks";
+ #clock-cells = <1>;
+ clock-indices = <0>, <1>, <2>;
+ clock-output-names = "atlclk", "aplclk","gpuclk";
+ };
+- scpi_clk: scpi-clk {
++ scpi_clk: clocks-1 {
+ compatible = "arm,scpi-variable-clocks";
+ #clock-cells = <1>;
+ clock-indices = <3>;
+@@ -547,7 +547,7 @@
+ };
+ };
+
+- scpi_devpd: scpi-power-domains {
++ scpi_devpd: power-controller {
+ compatible = "arm,scpi-power-domains";
+ num-domains = <2>;
+ #power-domain-cells = <1>;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
+index ebe0cd4bf2b7e..8c22ce904e655 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
+@@ -479,7 +479,6 @@
+ clocks = <&clockgen 4 3>;
+ clock-names = "dspi";
+ spi-num-chipselects = <5>;
+- bus-num = <0>;
+ };
+
+ esdhc: esdhc@2140000 {
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index 6be7c67584ba9..05fa0dcb4c690 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -255,13 +255,13 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+- pd_hevc@RK3328_PD_HEVC {
++ power-domain@RK3328_PD_HEVC {
+ reg = <RK3328_PD_HEVC>;
+ };
+- pd_video@RK3328_PD_VIDEO {
++ power-domain@RK3328_PD_VIDEO {
+ reg = <RK3328_PD_VIDEO>;
+ };
+- pd_vpu@RK3328_PD_VPU {
++ power-domain@RK3328_PD_VPU {
+ reg = <RK3328_PD_VPU>;
+ };
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index b1c1a88a1c20c..f70c053326865 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -2253,7 +2253,7 @@
+ };
+ };
+
+- sleep {
++ suspend {
+ ap_pwroff: ap-pwroff {
+ rockchip,pins = <1 5 RK_FUNC_1 &pcfg_pull_none>;
+ };
+diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
+index f800872f867b2..39b9f311c4ef4 100644
+--- a/arch/mips/include/asm/pgalloc.h
++++ b/arch/mips/include/asm/pgalloc.h
+@@ -93,15 +93,11 @@ do { \
+
+ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
+ {
+- pmd_t *pmd = NULL;
+- struct page *pg;
++ pmd_t *pmd;
+
+- pg = alloc_pages(GFP_KERNEL | __GFP_ACCOUNT, PMD_ORDER);
+- if (pg) {
+- pgtable_pmd_page_ctor(pg);
+- pmd = (pmd_t *)page_address(pg);
++ pmd = (pmd_t *) __get_free_pages(GFP_KERNEL, PMD_ORDER);
++ if (pmd)
+ pmd_init((unsigned long)pmd, (unsigned long)invalid_pte_table);
+- }
+ return pmd;
+ }
+
+diff --git a/arch/nds32/mm/mmap.c b/arch/nds32/mm/mmap.c
+index c206b31ce07ac..1bdf5e7d1b438 100644
+--- a/arch/nds32/mm/mmap.c
++++ b/arch/nds32/mm/mmap.c
+@@ -59,7 +59,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+
+ vma = find_vma(mm, addr);
+ if (TASK_SIZE - len >= addr &&
+- (!vma || addr + len <= vma->vm_start))
++ (!vma || addr + len <= vm_start_gap(vma)))
+ return addr;
+ }
+
+diff --git a/arch/powerpc/kvm/book3s_rtas.c b/arch/powerpc/kvm/book3s_rtas.c
+index 8f2355138f80b..a56c56aa829c1 100644
+--- a/arch/powerpc/kvm/book3s_rtas.c
++++ b/arch/powerpc/kvm/book3s_rtas.c
+@@ -243,6 +243,17 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
+ * value so we can restore it on the way out.
+ */
+ orig_rets = args.rets;
++ if (be32_to_cpu(args.nargs) >= ARRAY_SIZE(args.args)) {
++ /*
++ * Don't overflow our args array: ensure there is room for
++ * at least rets[0] (even if the call specifies 0 nret).
++ *
++ * Each handler must then check for the correct nargs and nret
++ * values, but they may always return failure in rets[0].
++ */
++ rc = -EINVAL;
++ goto fail;
++ }
+ args.rets = &args.args[be32_to_cpu(args.nargs)];
+
+ mutex_lock(&vcpu->kvm->arch.rtas_token_lock);
+@@ -270,9 +281,17 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
+ fail:
+ /*
+ * We only get here if the guest has called RTAS with a bogus
+- * args pointer. That means we can't get to the args, and so we
+- * can't fail the RTAS call. So fail right out to userspace,
+- * which should kill the guest.
++ * args pointer or nargs/nret values that would overflow the
++ * array. That means we can't get to the args, and so we can't
++ * fail the RTAS call. So fail right out to userspace, which
++ * should kill the guest.
++ *
++ * SLOF should actually pass the hcall return value from the
++ * rtas handler call in r3, so enter_rtas could be modified to
++ * return a failure indication in r3 and we could return such
++ * errors to the guest rather than failing to host userspace.
++ * However old guests that don't test for failure could then
++ * continue silently after errors, so for now we won't do this.
+ */
+ return rc;
+ }
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index 7c8354dfe80e2..ad5a871a6cbfd 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -1995,9 +1995,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
+ {
+ struct kvm_enable_cap cap;
+ r = -EFAULT;
+- vcpu_load(vcpu);
+ if (copy_from_user(&cap, argp, sizeof(cap)))
+ goto out;
++ vcpu_load(vcpu);
+ r = kvm_vcpu_ioctl_enable_cap(vcpu, &cap);
+ vcpu_put(vcpu);
+ break;
+@@ -2021,9 +2021,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
+ case KVM_DIRTY_TLB: {
+ struct kvm_dirty_tlb dirty;
+ r = -EFAULT;
+- vcpu_load(vcpu);
+ if (copy_from_user(&dirty, argp, sizeof(dirty)))
+ goto out;
++ vcpu_load(vcpu);
+ r = kvm_vcpu_ioctl_dirty_tlb(vcpu, &dirty);
+ vcpu_put(vcpu);
+ break;
+diff --git a/arch/s390/include/asm/ftrace.h b/arch/s390/include/asm/ftrace.h
+index 8ea270fdc7fb2..ec698fc52afdb 100644
+--- a/arch/s390/include/asm/ftrace.h
++++ b/arch/s390/include/asm/ftrace.h
+@@ -20,6 +20,7 @@ void ftrace_caller(void);
+
+ extern char ftrace_graph_caller_end;
+ extern unsigned long ftrace_plt;
++extern void *ftrace_func;
+
+ struct dyn_arch_ftrace { };
+
+diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
+index 39b13d71a8fe6..463b9e927501d 100644
+--- a/arch/s390/kernel/ftrace.c
++++ b/arch/s390/kernel/ftrace.c
+@@ -57,6 +57,7 @@
+ * > brasl %r0,ftrace_caller # offset 0
+ */
+
++void *ftrace_func __read_mostly = ftrace_stub;
+ unsigned long ftrace_plt;
+
+ static inline void ftrace_generate_orig_insn(struct ftrace_insn *insn)
+@@ -166,6 +167,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+
+ int ftrace_update_ftrace_func(ftrace_func_t func)
+ {
++ ftrace_func = func;
+ return 0;
+ }
+
+diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
+index 020f9aac7dc0c..a59e6b2b27618 100644
+--- a/arch/s390/kernel/mcount.S
++++ b/arch/s390/kernel/mcount.S
+@@ -60,13 +60,13 @@ ENTRY(ftrace_caller)
+ #ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
+ aghik %r2,%r0,-MCOUNT_INSN_SIZE
+ lgrl %r4,function_trace_op
+- lgrl %r1,ftrace_trace_function
++ lgrl %r1,ftrace_func
+ #else
+ lgr %r2,%r0
+ aghi %r2,-MCOUNT_INSN_SIZE
+ larl %r4,function_trace_op
+ lg %r4,0(%r4)
+- larl %r1,ftrace_trace_function
++ larl %r1,ftrace_func
+ lg %r1,0(%r1)
+ #endif
+ lgr %r3,%r14
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 2617e426c7926..e42354b15e0bc 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -113,7 +113,7 @@ static inline void reg_set_seen(struct bpf_jit *jit, u32 b1)
+ {
+ u32 r1 = reg2hex[b1];
+
+- if (!jit->seen_reg[r1] && r1 >= 6 && r1 <= 15)
++ if (r1 >= 6 && r1 <= 15 && !jit->seen_reg[r1])
+ jit->seen_reg[r1] = 1;
+ }
+
+diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
+index 91d620994123e..b0d2563cde5d2 100644
+--- a/drivers/dma-buf/sync_file.c
++++ b/drivers/dma-buf/sync_file.c
+@@ -220,8 +220,8 @@ static struct sync_file *sync_file_merge(const char *name, struct sync_file *a,
+ struct sync_file *b)
+ {
+ struct sync_file *sync_file;
+- struct dma_fence **fences, **nfences, **a_fences, **b_fences;
+- int i, i_a, i_b, num_fences, a_num_fences, b_num_fences;
++ struct dma_fence **fences = NULL, **nfences, **a_fences, **b_fences;
++ int i = 0, i_a, i_b, num_fences, a_num_fences, b_num_fences;
+
+ sync_file = sync_file_alloc();
+ if (!sync_file)
+@@ -245,7 +245,7 @@ static struct sync_file *sync_file_merge(const char *name, struct sync_file *a,
+ * If a sync_file can only be created with sync_file_merge
+ * and sync_file_create, this is a reasonable assumption.
+ */
+- for (i = i_a = i_b = 0; i_a < a_num_fences && i_b < b_num_fences; ) {
++ for (i_a = i_b = 0; i_a < a_num_fences && i_b < b_num_fences; ) {
+ struct dma_fence *pt_a = a_fences[i_a];
+ struct dma_fence *pt_b = b_fences[i_b];
+
+@@ -286,15 +286,16 @@ static struct sync_file *sync_file_merge(const char *name, struct sync_file *a,
+ fences = nfences;
+ }
+
+- if (sync_file_set_fence(sync_file, fences, i) < 0) {
+- kfree(fences);
++ if (sync_file_set_fence(sync_file, fences, i) < 0)
+ goto err;
+- }
+
+ strlcpy(sync_file->user_name, name, sizeof(sync_file->user_name));
+ return sync_file;
+
+ err:
++ while (i)
++ dma_fence_put(fences[--i]);
++ kfree(fences);
+ fput(sync_file->file);
+ return NULL;
+
+diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
+index 2449b357f524b..babd7ebabfef8 100644
+--- a/drivers/gpu/drm/drm_ioctl.c
++++ b/drivers/gpu/drm/drm_ioctl.c
+@@ -797,6 +797,9 @@ long drm_ioctl(struct file *filp,
+ if (drm_dev_is_unplugged(dev))
+ return -ENODEV;
+
++ if (DRM_IOCTL_TYPE(cmd) != DRM_IOCTL_BASE)
++ return -ENOTTY;
++
+ is_driver_ioctl = nr >= DRM_COMMAND_BASE && nr < DRM_COMMAND_END;
+
+ if (is_driver_ioctl) {
+diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+index aab6a70ece7f0..06bd039159738 100644
+--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+@@ -454,7 +454,6 @@ static int rpi_touchscreen_remove(struct i2c_client *i2c)
+ drm_panel_remove(&ts->base);
+
+ mipi_dsi_device_unregister(ts->dsi);
+- kfree(ts->dsi);
+
+ return 0;
+ }
+diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
+index 4bedf48d662a5..52275dddab3ec 100644
+--- a/drivers/iio/accel/bma180.c
++++ b/drivers/iio/accel/bma180.c
+@@ -50,7 +50,7 @@ struct bma180_part_info {
+
+ u8 int_reset_reg, int_reset_mask;
+ u8 sleep_reg, sleep_mask;
+- u8 bw_reg, bw_mask;
++ u8 bw_reg, bw_mask, bw_offset;
+ u8 scale_reg, scale_mask;
+ u8 power_reg, power_mask, lowpower_val;
+ u8 int_enable_reg, int_enable_mask;
+@@ -106,6 +106,7 @@ struct bma180_part_info {
+
+ #define BMA250_RANGE_MASK GENMASK(3, 0) /* Range of accel values */
+ #define BMA250_BW_MASK GENMASK(4, 0) /* Accel bandwidth */
++#define BMA250_BW_OFFSET 8
+ #define BMA250_SUSPEND_MASK BIT(7) /* chip will sleep */
+ #define BMA250_LOWPOWER_MASK BIT(6)
+ #define BMA250_DATA_INTEN_MASK BIT(4)
+@@ -243,7 +244,8 @@ static int bma180_set_bw(struct bma180_data *data, int val)
+ for (i = 0; i < data->part_info->num_bw; ++i) {
+ if (data->part_info->bw_table[i] == val) {
+ ret = bma180_set_bits(data, data->part_info->bw_reg,
+- data->part_info->bw_mask, i);
++ data->part_info->bw_mask,
++ i + data->part_info->bw_offset);
+ if (ret) {
+ dev_err(&data->client->dev,
+ "failed to set bandwidth\n");
+@@ -625,32 +627,53 @@ static const struct iio_chan_spec bma250_channels[] = {
+
+ static const struct bma180_part_info bma180_part_info[] = {
+ [BMA180] = {
+- bma180_channels, ARRAY_SIZE(bma180_channels),
+- bma180_scale_table, ARRAY_SIZE(bma180_scale_table),
+- bma180_bw_table, ARRAY_SIZE(bma180_bw_table),
+- BMA180_CTRL_REG0, BMA180_RESET_INT,
+- BMA180_CTRL_REG0, BMA180_SLEEP,
+- BMA180_BW_TCS, BMA180_BW,
+- BMA180_OFFSET_LSB1, BMA180_RANGE,
+- BMA180_TCO_Z, BMA180_MODE_CONFIG, BMA180_LOW_POWER,
+- BMA180_CTRL_REG3, BMA180_NEW_DATA_INT,
+- BMA180_RESET,
+- bma180_chip_config,
+- bma180_chip_disable,
++ .channels = bma180_channels,
++ .num_channels = ARRAY_SIZE(bma180_channels),
++ .scale_table = bma180_scale_table,
++ .num_scales = ARRAY_SIZE(bma180_scale_table),
++ .bw_table = bma180_bw_table,
++ .num_bw = ARRAY_SIZE(bma180_bw_table),
++ .int_reset_reg = BMA180_CTRL_REG0,
++ .int_reset_mask = BMA180_RESET_INT,
++ .sleep_reg = BMA180_CTRL_REG0,
++ .sleep_mask = BMA180_SLEEP,
++ .bw_reg = BMA180_BW_TCS,
++ .bw_mask = BMA180_BW,
++ .scale_reg = BMA180_OFFSET_LSB1,
++ .scale_mask = BMA180_RANGE,
++ .power_reg = BMA180_TCO_Z,
++ .power_mask = BMA180_MODE_CONFIG,
++ .lowpower_val = BMA180_LOW_POWER,
++ .int_enable_reg = BMA180_CTRL_REG3,
++ .int_enable_mask = BMA180_NEW_DATA_INT,
++ .softreset_reg = BMA180_RESET,
++ .chip_config = bma180_chip_config,
++ .chip_disable = bma180_chip_disable,
+ },
+ [BMA250] = {
+- bma250_channels, ARRAY_SIZE(bma250_channels),
+- bma250_scale_table, ARRAY_SIZE(bma250_scale_table),
+- bma250_bw_table, ARRAY_SIZE(bma250_bw_table),
+- BMA250_INT_RESET_REG, BMA250_INT_RESET_MASK,
+- BMA250_POWER_REG, BMA250_SUSPEND_MASK,
+- BMA250_BW_REG, BMA250_BW_MASK,
+- BMA250_RANGE_REG, BMA250_RANGE_MASK,
+- BMA250_POWER_REG, BMA250_LOWPOWER_MASK, 1,
+- BMA250_INT_ENABLE_REG, BMA250_DATA_INTEN_MASK,
+- BMA250_RESET_REG,
+- bma250_chip_config,
+- bma250_chip_disable,
++ .channels = bma250_channels,
++ .num_channels = ARRAY_SIZE(bma250_channels),
++ .scale_table = bma250_scale_table,
++ .num_scales = ARRAY_SIZE(bma250_scale_table),
++ .bw_table = bma250_bw_table,
++ .num_bw = ARRAY_SIZE(bma250_bw_table),
++ .int_reset_reg = BMA250_INT_RESET_REG,
++ .int_reset_mask = BMA250_INT_RESET_MASK,
++ .sleep_reg = BMA250_POWER_REG,
++ .sleep_mask = BMA250_SUSPEND_MASK,
++ .bw_reg = BMA250_BW_REG,
++ .bw_mask = BMA250_BW_MASK,
++ .bw_offset = BMA250_BW_OFFSET,
++ .scale_reg = BMA250_RANGE_REG,
++ .scale_mask = BMA250_RANGE_MASK,
++ .power_reg = BMA250_POWER_REG,
++ .power_mask = BMA250_LOWPOWER_MASK,
++ .lowpower_val = 1,
++ .int_enable_reg = BMA250_INT_ENABLE_REG,
++ .int_enable_mask = BMA250_DATA_INTEN_MASK,
++ .softreset_reg = BMA250_RESET_REG,
++ .chip_config = bma250_chip_config,
++ .chip_disable = bma250_chip_disable,
+ },
+ };
+
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index a1d4166864d03..3ca8627c2f1de 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -142,6 +142,7 @@ struct dm_writecache {
+ size_t metadata_sectors;
+ size_t n_blocks;
+ uint64_t seq_count;
++ sector_t data_device_sectors;
+ void *block_start;
+ struct wc_entry *entries;
+ unsigned block_size;
+@@ -153,6 +154,7 @@ struct dm_writecache {
+ bool overwrote_committed:1;
+ bool memory_vmapped:1;
+
++ bool start_sector_set:1;
+ bool high_wm_percent_set:1;
+ bool low_wm_percent_set:1;
+ bool max_writeback_jobs_set:1;
+@@ -161,6 +163,10 @@ struct dm_writecache {
+ bool writeback_fua_set:1;
+ bool flush_on_suspend:1;
+
++ unsigned high_wm_percent_value;
++ unsigned low_wm_percent_value;
++ unsigned autocommit_time_value;
++
+ unsigned writeback_all;
+ struct workqueue_struct *writeback_wq;
+ struct work_struct writeback_work;
+@@ -924,6 +930,8 @@ static void writecache_resume(struct dm_target *ti)
+
+ wc_lock(wc);
+
++ wc->data_device_sectors = i_size_read(wc->dev->bdev->bd_inode) >> SECTOR_SHIFT;
++
+ if (WC_MODE_PMEM(wc)) {
+ persistent_memory_invalidate_cache(wc->memory_map, wc->memory_map_size);
+ } else {
+@@ -1494,6 +1502,10 @@ static bool wc_add_block(struct writeback_struct *wb, struct wc_entry *e, gfp_t
+ void *address = memory_data(wc, e);
+
+ persistent_memory_flush_cache(address, block_size);
++
++ if (unlikely(bio_end_sector(&wb->bio) >= wc->data_device_sectors))
++ return true;
++
+ return bio_add_page(&wb->bio, persistent_memory_page(address),
+ block_size, persistent_memory_page_offset(address)) != 0;
+ }
+@@ -1566,6 +1578,9 @@ static void __writecache_writeback_pmem(struct dm_writecache *wc, struct writeba
+ if (writecache_has_error(wc)) {
+ bio->bi_status = BLK_STS_IOERR;
+ bio_endio(&wb->bio);
++ } else if (unlikely(!bio_sectors(&wb->bio))) {
++ bio->bi_status = BLK_STS_OK;
++ bio_endio(&wb->bio);
+ } else {
+ submit_bio(&wb->bio);
+ }
+@@ -1609,6 +1624,14 @@ static void __writecache_writeback_ssd(struct dm_writecache *wc, struct writebac
+ e = f;
+ }
+
++ if (unlikely(to.sector + to.count > wc->data_device_sectors)) {
++ if (to.sector >= wc->data_device_sectors) {
++ writecache_copy_endio(0, 0, c);
++ continue;
++ }
++ from.count = to.count = wc->data_device_sectors - to.sector;
++ }
++
+ dm_kcopyd_copy(wc->dm_kcopyd, &from, 1, &to, 0, writecache_copy_endio, c);
+
+ __writeback_throttle(wc, wbl);
+@@ -2045,6 +2068,7 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ if (sscanf(string, "%llu%c", &start_sector, &dummy) != 1)
+ goto invalid_optional;
+ wc->start_sector = start_sector;
++ wc->start_sector_set = true;
+ if (wc->start_sector != start_sector ||
+ wc->start_sector >= wc->memory_map_size >> SECTOR_SHIFT)
+ goto invalid_optional;
+@@ -2054,6 +2078,7 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ goto invalid_optional;
+ if (high_wm_percent < 0 || high_wm_percent > 100)
+ goto invalid_optional;
++ wc->high_wm_percent_value = high_wm_percent;
+ wc->high_wm_percent_set = true;
+ } else if (!strcasecmp(string, "low_watermark") && opt_params >= 1) {
+ string = dm_shift_arg(&as), opt_params--;
+@@ -2061,6 +2086,7 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ goto invalid_optional;
+ if (low_wm_percent < 0 || low_wm_percent > 100)
+ goto invalid_optional;
++ wc->low_wm_percent_value = low_wm_percent;
+ wc->low_wm_percent_set = true;
+ } else if (!strcasecmp(string, "writeback_jobs") && opt_params >= 1) {
+ string = dm_shift_arg(&as), opt_params--;
+@@ -2080,6 +2106,7 @@ static int writecache_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ if (autocommit_msecs > 3600000)
+ goto invalid_optional;
+ wc->autocommit_jiffies = msecs_to_jiffies(autocommit_msecs);
++ wc->autocommit_time_value = autocommit_msecs;
+ wc->autocommit_time_set = true;
+ } else if (!strcasecmp(string, "fua")) {
+ if (WC_MODE_PMEM(wc)) {
+@@ -2275,7 +2302,6 @@ static void writecache_status(struct dm_target *ti, status_type_t type,
+ struct dm_writecache *wc = ti->private;
+ unsigned extra_args;
+ unsigned sz = 0;
+- uint64_t x;
+
+ switch (type) {
+ case STATUSTYPE_INFO:
+@@ -2287,7 +2313,7 @@ static void writecache_status(struct dm_target *ti, status_type_t type,
+ DMEMIT("%c %s %s %u ", WC_MODE_PMEM(wc) ? 'p' : 's',
+ wc->dev->name, wc->ssd_dev->name, wc->block_size);
+ extra_args = 0;
+- if (wc->start_sector)
++ if (wc->start_sector_set)
+ extra_args += 2;
+ if (wc->high_wm_percent_set)
+ extra_args += 2;
+@@ -2303,26 +2329,18 @@ static void writecache_status(struct dm_target *ti, status_type_t type,
+ extra_args++;
+
+ DMEMIT("%u", extra_args);
+- if (wc->start_sector)
++ if (wc->start_sector_set)
+ DMEMIT(" start_sector %llu", (unsigned long long)wc->start_sector);
+- if (wc->high_wm_percent_set) {
+- x = (uint64_t)wc->freelist_high_watermark * 100;
+- x += wc->n_blocks / 2;
+- do_div(x, (size_t)wc->n_blocks);
+- DMEMIT(" high_watermark %u", 100 - (unsigned)x);
+- }
+- if (wc->low_wm_percent_set) {
+- x = (uint64_t)wc->freelist_low_watermark * 100;
+- x += wc->n_blocks / 2;
+- do_div(x, (size_t)wc->n_blocks);
+- DMEMIT(" low_watermark %u", 100 - (unsigned)x);
+- }
++ if (wc->high_wm_percent_set)
++ DMEMIT(" high_watermark %u", wc->high_wm_percent_value);
++ if (wc->low_wm_percent_set)
++ DMEMIT(" low_watermark %u", wc->low_wm_percent_value);
+ if (wc->max_writeback_jobs_set)
+ DMEMIT(" writeback_jobs %u", wc->max_writeback_jobs);
+ if (wc->autocommit_blocks_set)
+ DMEMIT(" autocommit_blocks %u", wc->autocommit_blocks);
+ if (wc->autocommit_time_set)
+- DMEMIT(" autocommit_time %u", jiffies_to_msecs(wc->autocommit_jiffies));
++ DMEMIT(" autocommit_time %u", wc->autocommit_time_value);
+ if (wc->writeback_fua_set)
+ DMEMIT(" %sfua", wc->writeback_fua ? "" : "no");
+ break;
+diff --git a/drivers/media/pci/ngene/ngene-core.c b/drivers/media/pci/ngene/ngene-core.c
+index 25f16833a4752..aa60559bbbb49 100644
+--- a/drivers/media/pci/ngene/ngene-core.c
++++ b/drivers/media/pci/ngene/ngene-core.c
+@@ -398,7 +398,7 @@ static int ngene_command_config_free_buf(struct ngene *dev, u8 *config)
+
+ com.cmd.hdr.Opcode = CMD_CONFIGURE_FREE_BUFFER;
+ com.cmd.hdr.Length = 6;
+- memcpy(&com.cmd.ConfigureBuffers.config, config, 6);
++ memcpy(&com.cmd.ConfigureFreeBuffers.config, config, 6);
+ com.in_len = 6;
+ com.out_len = 0;
+
+diff --git a/drivers/media/pci/ngene/ngene.h b/drivers/media/pci/ngene/ngene.h
+index 01d9f1b58fcbd..9728bce1ea1cd 100644
+--- a/drivers/media/pci/ngene/ngene.h
++++ b/drivers/media/pci/ngene/ngene.h
+@@ -419,12 +419,14 @@ enum _BUFFER_CONFIGS {
+
+ struct FW_CONFIGURE_FREE_BUFFERS {
+ struct FW_HEADER hdr;
+- u8 UVI1_BufferLength;
+- u8 UVI2_BufferLength;
+- u8 TVO_BufferLength;
+- u8 AUD1_BufferLength;
+- u8 AUD2_BufferLength;
+- u8 TVA_BufferLength;
++ struct {
++ u8 UVI1_BufferLength;
++ u8 UVI2_BufferLength;
++ u8 TVO_BufferLength;
++ u8 AUD1_BufferLength;
++ u8 AUD2_BufferLength;
++ u8 TVA_BufferLength;
++ } __packed config;
+ } __attribute__ ((__packed__));
+
+ struct FW_CONFIGURE_UART {
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 67c0ad3b80795..1df7aed5ae15d 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3051,7 +3051,7 @@ static const struct mv88e6xxx_ops mv88e6141_ops = {
+ .port_link_state = mv88e6352_port_link_state,
+ .port_get_cmode = mv88e6352_port_get_cmode,
+ .stats_snapshot = mv88e6390_g1_stats_snapshot,
+- .stats_set_histogram = mv88e6095_g1_stats_set_histogram,
++ .stats_set_histogram = mv88e6390_g1_stats_set_histogram,
+ .stats_get_sset_count = mv88e6320_stats_get_sset_count,
+ .stats_get_strings = mv88e6320_stats_get_strings,
+ .stats_get_stats = mv88e6390_stats_get_stats,
+@@ -3672,7 +3672,7 @@ static const struct mv88e6xxx_ops mv88e6341_ops = {
+ .port_link_state = mv88e6352_port_link_state,
+ .port_get_cmode = mv88e6352_port_get_cmode,
+ .stats_snapshot = mv88e6390_g1_stats_snapshot,
+- .stats_set_histogram = mv88e6095_g1_stats_set_histogram,
++ .stats_set_histogram = mv88e6390_g1_stats_set_histogram,
+ .stats_get_sset_count = mv88e6320_stats_get_sset_count,
+ .stats_get_strings = mv88e6320_stats_get_strings,
+ .stats_get_stats = mv88e6390_stats_get_stats,
+@@ -3682,6 +3682,7 @@ static const struct mv88e6xxx_ops mv88e6341_ops = {
+ .mgmt_rsvd2cpu = mv88e6390_g1_mgmt_rsvd2cpu,
+ .pot_clear = mv88e6xxx_g2_pot_clear,
+ .reset = mv88e6352_g1_reset,
++ .rmu_disable = mv88e6390_g1_rmu_disable,
+ .vtu_getnext = mv88e6352_g1_vtu_getnext,
+ .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+ .serdes_power = mv88e6341_serdes_power,
+@@ -3764,6 +3765,7 @@ static const struct mv88e6xxx_ops mv88e6351_ops = {
+ .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
+ .pot_clear = mv88e6xxx_g2_pot_clear,
+ .reset = mv88e6352_g1_reset,
++ .rmu_disable = mv88e6390_g1_rmu_disable,
+ .vtu_getnext = mv88e6352_g1_vtu_getnext,
+ .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+ .avb_ops = &mv88e6352_avb_ops,
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 1546a9bd9203c..79e156e2ad6a0 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1189,7 +1189,8 @@ static void bcmgenet_power_up(struct bcmgenet_priv *priv,
+
+ switch (mode) {
+ case GENET_POWER_PASSIVE:
+- reg &= ~(EXT_PWR_DOWN_DLL | EXT_PWR_DOWN_BIAS);
++ reg &= ~(EXT_PWR_DOWN_DLL | EXT_PWR_DOWN_BIAS |
++ EXT_ENERGY_DET_MASK);
+ if (GENET_IS_V5(priv)) {
+ reg &= ~(EXT_PWR_DOWN_PHY_EN |
+ EXT_PWR_DOWN_PHY_RD |
+@@ -2790,15 +2791,21 @@ static void bcmgenet_set_hw_addr(struct bcmgenet_priv *priv,
+ /* Returns a reusable dma control register value */
+ static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv)
+ {
++ unsigned int i;
+ u32 reg;
+ u32 dma_ctrl;
+
+ /* disable DMA */
+ dma_ctrl = 1 << (DESC_INDEX + DMA_RING_BUF_EN_SHIFT) | DMA_EN;
++ for (i = 0; i < priv->hw_params->tx_queues; i++)
++ dma_ctrl |= (1 << (i + DMA_RING_BUF_EN_SHIFT));
+ reg = bcmgenet_tdma_readl(priv, DMA_CTRL);
+ reg &= ~dma_ctrl;
+ bcmgenet_tdma_writel(priv, reg, DMA_CTRL);
+
++ dma_ctrl = 1 << (DESC_INDEX + DMA_RING_BUF_EN_SHIFT) | DMA_EN;
++ for (i = 0; i < priv->hw_params->rx_queues; i++)
++ dma_ctrl |= (1 << (i + DMA_RING_BUF_EN_SHIFT));
+ reg = bcmgenet_rdma_readl(priv, DMA_CTRL);
+ reg &= ~dma_ctrl;
+ bcmgenet_rdma_writel(priv, reg, DMA_CTRL);
+@@ -2902,12 +2909,6 @@ static int bcmgenet_open(struct net_device *dev)
+
+ bcmgenet_set_hw_addr(priv, dev->dev_addr);
+
+- if (priv->internal_phy) {
+- reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT);
+- reg |= EXT_ENERGY_DET_MASK;
+- bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT);
+- }
+-
+ /* Disable RX/TX DMA and flush TX queues */
+ dma_ctrl = bcmgenet_dma_disable(priv);
+
+@@ -3626,7 +3627,6 @@ static int bcmgenet_resume(struct device *d)
+ struct bcmgenet_priv *priv = netdev_priv(dev);
+ unsigned long dma_ctrl;
+ int ret;
+- u32 reg;
+
+ if (!netif_running(dev))
+ return 0;
+@@ -3658,12 +3658,6 @@ static int bcmgenet_resume(struct device *d)
+
+ bcmgenet_set_hw_addr(priv, dev->dev_addr);
+
+- if (priv->internal_phy) {
+- reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT);
+- reg |= EXT_ENERGY_DET_MASK;
+- bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT);
+- }
+-
+ if (priv->wolopts)
+ bcmgenet_power_up(priv, GENET_POWER_WOL_MAGIC);
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+index 57582efa362df..457ee9ff08515 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+@@ -166,12 +166,6 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv,
+ reg |= CMD_RX_EN;
+ bcmgenet_umac_writel(priv, reg, UMAC_CMD);
+
+- if (priv->hw_params->flags & GENET_HAS_EXT) {
+- reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT);
+- reg &= ~EXT_ENERGY_DET_MASK;
+- bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT);
+- }
+-
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+index 55fe80ca10d39..9e447983d0aa8 100644
+--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+@@ -420,7 +420,7 @@ static int cn23xx_pf_setup_global_input_regs(struct octeon_device *oct)
+ * bits 32:47 indicate the PVF num.
+ */
+ for (q_no = 0; q_no < ern; q_no++) {
+- reg_val = oct->pcie_port << CN23XX_PKT_INPUT_CTL_MAC_NUM_POS;
++ reg_val = (u64)oct->pcie_port << CN23XX_PKT_INPUT_CTL_MAC_NUM_POS;
+
+ /* for VF assigned queues. */
+ if (q_no < oct->sriov_info.pf_srn) {
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 6bbe7afdf30c4..398f5951d11c5 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -7369,6 +7369,7 @@ err_flashmap:
+ err_ioremap:
+ free_netdev(netdev);
+ err_alloc_etherdev:
++ pci_disable_pcie_error_reporting(pdev);
+ pci_release_mem_regions(pdev);
+ err_pci_reg:
+ err_dma:
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
+index c859ababeed50..6e888874010e9 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
+@@ -2228,6 +2228,7 @@ err_sw_init:
+ err_ioremap:
+ free_netdev(netdev);
+ err_alloc_netdev:
++ pci_disable_pcie_error_reporting(pdev);
+ pci_release_mem_regions(pdev);
+ err_pci_reg:
+ err_dma:
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+index f50c19b833686..ac5709624c7ad 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+@@ -3735,6 +3735,7 @@ static int i40evf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ err_ioremap:
+ free_netdev(netdev);
+ err_alloc_etherdev:
++ pci_disable_pcie_error_reporting(pdev);
+ pci_release_regions(pdev);
+ err_pci_reg:
+ err_dma:
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index d85eb80d82497..6221dafc76b95 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -938,6 +938,7 @@ static void igb_configure_msix(struct igb_adapter *adapter)
+ **/
+ static int igb_request_msix(struct igb_adapter *adapter)
+ {
++ unsigned int num_q_vectors = adapter->num_q_vectors;
+ struct net_device *netdev = adapter->netdev;
+ int i, err = 0, vector = 0, free_vector = 0;
+
+@@ -946,7 +947,13 @@ static int igb_request_msix(struct igb_adapter *adapter)
+ if (err)
+ goto err_out;
+
+- for (i = 0; i < adapter->num_q_vectors; i++) {
++ if (num_q_vectors > MAX_Q_VECTORS) {
++ num_q_vectors = MAX_Q_VECTORS;
++ dev_warn(&adapter->pdev->dev,
++ "The number of queue vectors (%d) is higher than max allowed (%d)\n",
++ adapter->num_q_vectors, MAX_Q_VECTORS);
++ }
++ for (i = 0; i < num_q_vectors; i++) {
+ struct igb_q_vector *q_vector = adapter->q_vector[i];
+
+ vector++;
+@@ -1685,14 +1692,15 @@ static bool is_any_txtime_enabled(struct igb_adapter *adapter)
+ **/
+ static void igb_config_tx_modes(struct igb_adapter *adapter, int queue)
+ {
+- struct igb_ring *ring = adapter->tx_ring[queue];
+ struct net_device *netdev = adapter->netdev;
+ struct e1000_hw *hw = &adapter->hw;
++ struct igb_ring *ring;
+ u32 tqavcc, tqavctrl;
+ u16 value;
+
+ WARN_ON(hw->mac.type != e1000_i210);
+ WARN_ON(queue < 0 || queue > 1);
++ ring = adapter->tx_ring[queue];
+
+ /* If any of the Qav features is enabled, configure queues as SR and
+ * with HIGH PRIO. If none is, then configure them with LOW PRIO and
+@@ -3495,6 +3503,7 @@ err_sw_init:
+ err_ioremap:
+ free_netdev(netdev);
+ err_alloc_etherdev:
++ pci_disable_pcie_error_reporting(pdev);
+ pci_release_mem_regions(pdev);
+ err_pci_reg:
+ err_dma:
+@@ -4684,6 +4693,8 @@ static void igb_clean_tx_ring(struct igb_ring *tx_ring)
+ DMA_TO_DEVICE);
+ }
+
++ tx_buffer->next_to_watch = NULL;
++
+ /* move us one more past the eop_desc for start of next pkt */
+ tx_buffer++;
+ i++;
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 8fcd3ffb43e00..ef92438e4e6df 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -1823,7 +1823,8 @@ static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring,
+ struct sk_buff *skb)
+ {
+ if (ring_uses_build_skb(rx_ring)) {
+- unsigned long offset = (unsigned long)(skb->data) & ~PAGE_MASK;
++ unsigned long mask = (unsigned long)ixgbe_rx_pg_size(rx_ring) - 1;
++ unsigned long offset = (unsigned long)(skb->data) & mask;
+
+ dma_sync_single_range_for_cpu(rx_ring->dev,
+ IXGBE_CB(skb)->dma,
+@@ -10925,6 +10926,7 @@ err_ioremap:
+ disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
+ free_netdev(netdev);
+ err_alloc_etherdev:
++ pci_disable_pcie_error_reporting(pdev);
+ pci_release_mem_regions(pdev);
+ err_pci_reg:
+ err_dma:
+diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
+index 4db3431b79ac1..e1a3c3fefc31d 100644
+--- a/drivers/net/ethernet/moxa/moxart_ether.c
++++ b/drivers/net/ethernet/moxa/moxart_ether.c
+@@ -538,10 +538,8 @@ static int moxart_mac_probe(struct platform_device *pdev)
+ SET_NETDEV_DEV(ndev, &pdev->dev);
+
+ ret = register_netdev(ndev);
+- if (ret) {
+- free_netdev(ndev);
++ if (ret)
+ goto init_fail;
+- }
+
+ netdev_dbg(ndev, "%s: IRQ=%d address=%pM\n",
+ __func__, ndev->irq, ndev->dev_addr);
+diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
+index 19673ed929e68..76a9b37c8680f 100644
+--- a/drivers/net/ethernet/qualcomm/emac/emac.c
++++ b/drivers/net/ethernet/qualcomm/emac/emac.c
+@@ -759,12 +759,13 @@ static int emac_remove(struct platform_device *pdev)
+
+ put_device(&adpt->phydev->mdio.dev);
+ mdiobus_unregister(adpt->mii_bus);
+- free_netdev(netdev);
+
+ if (adpt->phy.digital)
+ iounmap(adpt->phy.digital);
+ iounmap(adpt->phy.base);
+
++ free_netdev(netdev);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/ti/tlan.c b/drivers/net/ethernet/ti/tlan.c
+index 01f99e5df1456..9f2129623d189 100644
+--- a/drivers/net/ethernet/ti/tlan.c
++++ b/drivers/net/ethernet/ti/tlan.c
+@@ -312,9 +312,8 @@ static void tlan_remove_one(struct pci_dev *pdev)
+ pci_release_regions(pdev);
+ #endif
+
+- free_netdev(dev);
+-
+ cancel_work_sync(&priv->tlan_tqueue);
++ free_netdev(dev);
+ }
+
+ static void tlan_start(struct net_device *dev)
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 82d87d2e280c2..d7cf3202cdd3b 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2273,7 +2273,9 @@ static void nvme_reset_work(struct work_struct *work)
+ int result;
+ enum nvme_ctrl_state new_state = NVME_CTRL_LIVE;
+
+- if (WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING)) {
++ if (dev->ctrl.state != NVME_CTRL_RESETTING) {
++ dev_warn(dev->ctrl.device, "ctrl state %d is not RESETTING\n",
++ dev->ctrl.state);
+ result = -ENODEV;
+ goto out;
+ }
+@@ -2605,7 +2607,6 @@ static void nvme_remove(struct pci_dev *pdev)
+ if (!pci_device_is_present(pdev)) {
+ nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DEAD);
+ nvme_dev_disable(dev, true);
+- nvme_dev_remove_admin(dev);
+ }
+
+ flush_work(&dev->ctrl.reset_work);
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index bfb22de693eb4..f287a9f919da1 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5172,7 +5172,8 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0422, quirk_no_ext_tags);
+ static void quirk_amd_harvest_no_ats(struct pci_dev *pdev)
+ {
+ if ((pdev->device == 0x7312 && pdev->revision != 0x00) ||
+- (pdev->device == 0x7340 && pdev->revision != 0xc5))
++ (pdev->device == 0x7340 && pdev->revision != 0xc5) ||
++ (pdev->device == 0x7341 && pdev->revision != 0x00))
+ return;
+
+ pci_info(pdev, "disabling ATS\n");
+@@ -5187,6 +5188,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_amd_harvest_no_ats);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7312, quirk_amd_harvest_no_ats);
+ /* AMD Navi14 dGPU */
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7340, quirk_amd_harvest_no_ats);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7341, quirk_amd_harvest_no_ats);
+ #endif /* CONFIG_PCI_ATS */
+
+ /* Freescale PCIe doesn't support MSI in RC mode */
+diff --git a/drivers/reset/reset-ti-syscon.c b/drivers/reset/reset-ti-syscon.c
+index a2635c21db7f8..ecb8873e3a19b 100644
+--- a/drivers/reset/reset-ti-syscon.c
++++ b/drivers/reset/reset-ti-syscon.c
+@@ -58,8 +58,8 @@ struct ti_syscon_reset_data {
+ unsigned int nr_controls;
+ };
+
+-#define to_ti_syscon_reset_data(rcdev) \
+- container_of(rcdev, struct ti_syscon_reset_data, rcdev)
++#define to_ti_syscon_reset_data(_rcdev) \
++ container_of(_rcdev, struct ti_syscon_reset_data, rcdev)
+
+ /**
+ * ti_syscon_reset_assert() - assert device reset
+diff --git a/drivers/rtc/rtc-max77686.c b/drivers/rtc/rtc-max77686.c
+index 4aff349ae301a..8e09450d11a65 100644
+--- a/drivers/rtc/rtc-max77686.c
++++ b/drivers/rtc/rtc-max77686.c
+@@ -710,8 +710,8 @@ static int max77686_init_rtc_regmap(struct max77686_rtc_info *info)
+
+ add_rtc_irq:
+ ret = regmap_add_irq_chip(info->rtc_regmap, info->rtc_irq,
+- IRQF_TRIGGER_FALLING | IRQF_ONESHOT |
+- IRQF_SHARED, 0, info->drv_data->rtc_irq_chip,
++ IRQF_ONESHOT | IRQF_SHARED,
++ 0, info->drv_data->rtc_irq_chip,
+ &info->rtc_irq_data);
+ if (ret < 0) {
+ dev_err(info->dev, "Failed to add RTC irq chip: %d\n", ret);
+diff --git a/drivers/rtc/rtc-mxc_v2.c b/drivers/rtc/rtc-mxc_v2.c
+index 007879a5042dd..45c7366b72862 100644
+--- a/drivers/rtc/rtc-mxc_v2.c
++++ b/drivers/rtc/rtc-mxc_v2.c
+@@ -395,6 +395,7 @@ static const struct of_device_id mxc_ids[] = {
+ { .compatible = "fsl,imx53-rtc", },
+ {}
+ };
++MODULE_DEVICE_TABLE(of, mxc_ids);
+
+ static struct platform_driver mxc_rtc_driver = {
+ .driver = {
+diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c
+index 49e02e8745533..fe15746af520a 100644
+--- a/drivers/scsi/aic7xxx/aic7xxx_core.c
++++ b/drivers/scsi/aic7xxx/aic7xxx_core.c
+@@ -500,7 +500,7 @@ ahc_inq(struct ahc_softc *ahc, u_int port)
+ return ((ahc_inb(ahc, port))
+ | (ahc_inb(ahc, port+1) << 8)
+ | (ahc_inb(ahc, port+2) << 16)
+- | (ahc_inb(ahc, port+3) << 24)
++ | (((uint64_t)ahc_inb(ahc, port+3)) << 24)
+ | (((uint64_t)ahc_inb(ahc, port+4)) << 32)
+ | (((uint64_t)ahc_inb(ahc, port+5)) << 40)
+ | (((uint64_t)ahc_inb(ahc, port+6)) << 48)
+diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
+index 702da909cee5e..ad8a65ab489cf 100644
+--- a/drivers/scsi/aic94xx/aic94xx_init.c
++++ b/drivers/scsi/aic94xx/aic94xx_init.c
+@@ -71,6 +71,7 @@ static struct scsi_host_template aic94xx_sht = {
+ .use_clustering = ENABLE_CLUSTERING,
+ .eh_device_reset_handler = sas_eh_device_reset_handler,
+ .eh_target_reset_handler = sas_eh_target_reset_handler,
++ .slave_alloc = sas_slave_alloc,
+ .target_destroy = sas_target_destroy,
+ .ioctl = sas_ioctl,
+ .track_queue_depth = 1,
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+index 8aa3222fe4865..fea26edd505e1 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+@@ -1814,6 +1814,7 @@ static struct scsi_host_template sht_v1_hw = {
+ .use_clustering = ENABLE_CLUSTERING,
+ .eh_device_reset_handler = sas_eh_device_reset_handler,
+ .eh_target_reset_handler = sas_eh_target_reset_handler,
++ .slave_alloc = sas_slave_alloc,
+ .target_destroy = sas_target_destroy,
+ .ioctl = sas_ioctl,
+ .shost_attrs = host_attrs,
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+index ebc984ffe6a22..7be9431976041 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+@@ -3565,6 +3565,7 @@ static struct scsi_host_template sht_v2_hw = {
+ .use_clustering = ENABLE_CLUSTERING,
+ .eh_device_reset_handler = sas_eh_device_reset_handler,
+ .eh_target_reset_handler = sas_eh_target_reset_handler,
++ .slave_alloc = sas_slave_alloc,
+ .target_destroy = sas_target_destroy,
+ .ioctl = sas_ioctl,
+ .shost_attrs = host_attrs,
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index ce2f232b3df38..16b7ea5561186 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -2115,6 +2115,7 @@ static struct scsi_host_template sht_v3_hw = {
+ .use_clustering = ENABLE_CLUSTERING,
+ .eh_device_reset_handler = sas_eh_device_reset_handler,
+ .eh_target_reset_handler = sas_eh_target_reset_handler,
++ .slave_alloc = sas_slave_alloc,
+ .target_destroy = sas_target_destroy,
+ .ioctl = sas_ioctl,
+ .shost_attrs = host_attrs,
+diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
+index dde84f7443136..07de94ea38192 100644
+--- a/drivers/scsi/isci/init.c
++++ b/drivers/scsi/isci/init.c
+@@ -167,6 +167,7 @@ static struct scsi_host_template isci_sht = {
+ .eh_abort_handler = sas_eh_abort_handler,
+ .eh_device_reset_handler = sas_eh_device_reset_handler,
+ .eh_target_reset_handler = sas_eh_target_reset_handler,
++ .slave_alloc = sas_slave_alloc,
+ .target_destroy = sas_target_destroy,
+ .ioctl = sas_ioctl,
+ .shost_attrs = isci_host_attrs,
+diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
+index 2b3239765c249..afe79d4415e85 100644
+--- a/drivers/scsi/libfc/fc_rport.c
++++ b/drivers/scsi/libfc/fc_rport.c
+@@ -1169,6 +1169,7 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp,
+ resp_code = (pp->spp.spp_flags & FC_SPP_RESP_MASK);
+ FC_RPORT_DBG(rdata, "PRLI spp_flags = 0x%x spp_type 0x%x\n",
+ pp->spp.spp_flags, pp->spp.spp_type);
++
+ rdata->spp_type = pp->spp.spp_type;
+ if (resp_code != FC_SPP_RESP_ACK) {
+ if (resp_code == FC_SPP_RESP_CONF)
+@@ -1189,11 +1190,13 @@ static void fc_rport_prli_resp(struct fc_seq *sp, struct fc_frame *fp,
+ /*
+ * Call prli provider if we should act as a target
+ */
+- prov = fc_passive_prov[rdata->spp_type];
+- if (prov) {
+- memset(&temp_spp, 0, sizeof(temp_spp));
+- prov->prli(rdata, pp->prli.prli_spp_len,
+- &pp->spp, &temp_spp);
++ if (rdata->spp_type < FC_FC4_PROV_SIZE) {
++ prov = fc_passive_prov[rdata->spp_type];
++ if (prov) {
++ memset(&temp_spp, 0, sizeof(temp_spp));
++ prov->prli(rdata, pp->prli.prli_spp_len,
++ &pp->spp, &temp_spp);
++ }
+ }
+ /*
+ * Check if the image pair could be established
+diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
+index 33229348dcb6a..316a111835553 100644
+--- a/drivers/scsi/libsas/sas_scsi_host.c
++++ b/drivers/scsi/libsas/sas_scsi_host.c
+@@ -942,6 +942,14 @@ void sas_task_abort(struct sas_task *task)
+ }
+ }
+
++int sas_slave_alloc(struct scsi_device *sdev)
++{
++ if (dev_is_sata(sdev_to_domain_dev(sdev)) && sdev->lun)
++ return -ENXIO;
++
++ return 0;
++}
++
+ void sas_target_destroy(struct scsi_target *starget)
+ {
+ struct domain_device *found_dev = starget->hostdata;
+@@ -988,5 +996,6 @@ EXPORT_SYMBOL_GPL(sas_task_abort);
+ EXPORT_SYMBOL_GPL(sas_phy_reset);
+ EXPORT_SYMBOL_GPL(sas_eh_device_reset_handler);
+ EXPORT_SYMBOL_GPL(sas_eh_target_reset_handler);
++EXPORT_SYMBOL_GPL(sas_slave_alloc);
+ EXPORT_SYMBOL_GPL(sas_target_destroy);
+ EXPORT_SYMBOL_GPL(sas_ioctl);
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 8c91637cd598d..98d6608068abd 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -62,6 +62,7 @@ static struct scsi_host_template mvs_sht = {
+ .use_clustering = ENABLE_CLUSTERING,
+ .eh_device_reset_handler = sas_eh_device_reset_handler,
+ .eh_target_reset_handler = sas_eh_target_reset_handler,
++ .slave_alloc = sas_slave_alloc,
+ .target_destroy = sas_target_destroy,
+ .ioctl = sas_ioctl,
+ .shost_attrs = mvst_host_attrs,
+diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
+index 1d59d7447a1c8..9547cf516d394 100644
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -87,6 +87,7 @@ static struct scsi_host_template pm8001_sht = {
+ .use_clustering = ENABLE_CLUSTERING,
+ .eh_device_reset_handler = sas_eh_device_reset_handler,
+ .eh_target_reset_handler = sas_eh_target_reset_handler,
++ .slave_alloc = sas_slave_alloc,
+ .target_destroy = sas_target_destroy,
+ .ioctl = sas_ioctl,
+ .shost_attrs = pm8001_host_attrs,
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 2aaa5a2bd6135..20e69052161e6 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -427,39 +427,10 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
+ struct device *dev = container_of(kobj, struct device, kobj);
+ struct iscsi_iface *iface = iscsi_dev_to_iface(dev);
+ struct iscsi_transport *t = iface->transport;
+- int param;
+- int param_type;
++ int param = -1;
+
+ if (attr == &dev_attr_iface_enabled.attr)
+ param = ISCSI_NET_PARAM_IFACE_ENABLE;
+- else if (attr == &dev_attr_iface_vlan_id.attr)
+- param = ISCSI_NET_PARAM_VLAN_ID;
+- else if (attr == &dev_attr_iface_vlan_priority.attr)
+- param = ISCSI_NET_PARAM_VLAN_PRIORITY;
+- else if (attr == &dev_attr_iface_vlan_enabled.attr)
+- param = ISCSI_NET_PARAM_VLAN_ENABLED;
+- else if (attr == &dev_attr_iface_mtu.attr)
+- param = ISCSI_NET_PARAM_MTU;
+- else if (attr == &dev_attr_iface_port.attr)
+- param = ISCSI_NET_PARAM_PORT;
+- else if (attr == &dev_attr_iface_ipaddress_state.attr)
+- param = ISCSI_NET_PARAM_IPADDR_STATE;
+- else if (attr == &dev_attr_iface_delayed_ack_en.attr)
+- param = ISCSI_NET_PARAM_DELAYED_ACK_EN;
+- else if (attr == &dev_attr_iface_tcp_nagle_disable.attr)
+- param = ISCSI_NET_PARAM_TCP_NAGLE_DISABLE;
+- else if (attr == &dev_attr_iface_tcp_wsf_disable.attr)
+- param = ISCSI_NET_PARAM_TCP_WSF_DISABLE;
+- else if (attr == &dev_attr_iface_tcp_wsf.attr)
+- param = ISCSI_NET_PARAM_TCP_WSF;
+- else if (attr == &dev_attr_iface_tcp_timer_scale.attr)
+- param = ISCSI_NET_PARAM_TCP_TIMER_SCALE;
+- else if (attr == &dev_attr_iface_tcp_timestamp_en.attr)
+- param = ISCSI_NET_PARAM_TCP_TIMESTAMP_EN;
+- else if (attr == &dev_attr_iface_cache_id.attr)
+- param = ISCSI_NET_PARAM_CACHE_ID;
+- else if (attr == &dev_attr_iface_redirect_en.attr)
+- param = ISCSI_NET_PARAM_REDIRECT_EN;
+ else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr)
+ param = ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO;
+ else if (attr == &dev_attr_iface_header_digest.attr)
+@@ -496,6 +467,38 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
+ param = ISCSI_IFACE_PARAM_STRICT_LOGIN_COMP_EN;
+ else if (attr == &dev_attr_iface_initiator_name.attr)
+ param = ISCSI_IFACE_PARAM_INITIATOR_NAME;
++
++ if (param != -1)
++ return t->attr_is_visible(ISCSI_IFACE_PARAM, param);
++
++ if (attr == &dev_attr_iface_vlan_id.attr)
++ param = ISCSI_NET_PARAM_VLAN_ID;
++ else if (attr == &dev_attr_iface_vlan_priority.attr)
++ param = ISCSI_NET_PARAM_VLAN_PRIORITY;
++ else if (attr == &dev_attr_iface_vlan_enabled.attr)
++ param = ISCSI_NET_PARAM_VLAN_ENABLED;
++ else if (attr == &dev_attr_iface_mtu.attr)
++ param = ISCSI_NET_PARAM_MTU;
++ else if (attr == &dev_attr_iface_port.attr)
++ param = ISCSI_NET_PARAM_PORT;
++ else if (attr == &dev_attr_iface_ipaddress_state.attr)
++ param = ISCSI_NET_PARAM_IPADDR_STATE;
++ else if (attr == &dev_attr_iface_delayed_ack_en.attr)
++ param = ISCSI_NET_PARAM_DELAYED_ACK_EN;
++ else if (attr == &dev_attr_iface_tcp_nagle_disable.attr)
++ param = ISCSI_NET_PARAM_TCP_NAGLE_DISABLE;
++ else if (attr == &dev_attr_iface_tcp_wsf_disable.attr)
++ param = ISCSI_NET_PARAM_TCP_WSF_DISABLE;
++ else if (attr == &dev_attr_iface_tcp_wsf.attr)
++ param = ISCSI_NET_PARAM_TCP_WSF;
++ else if (attr == &dev_attr_iface_tcp_timer_scale.attr)
++ param = ISCSI_NET_PARAM_TCP_TIMER_SCALE;
++ else if (attr == &dev_attr_iface_tcp_timestamp_en.attr)
++ param = ISCSI_NET_PARAM_TCP_TIMESTAMP_EN;
++ else if (attr == &dev_attr_iface_cache_id.attr)
++ param = ISCSI_NET_PARAM_CACHE_ID;
++ else if (attr == &dev_attr_iface_redirect_en.attr)
++ param = ISCSI_NET_PARAM_REDIRECT_EN;
+ else if (iface->iface_type == ISCSI_IFACE_TYPE_IPV4) {
+ if (attr == &dev_attr_ipv4_iface_ipaddress.attr)
+ param = ISCSI_NET_PARAM_IPV4_ADDR;
+@@ -586,32 +589,7 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
+ return 0;
+ }
+
+- switch (param) {
+- case ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO:
+- case ISCSI_IFACE_PARAM_HDRDGST_EN:
+- case ISCSI_IFACE_PARAM_DATADGST_EN:
+- case ISCSI_IFACE_PARAM_IMM_DATA_EN:
+- case ISCSI_IFACE_PARAM_INITIAL_R2T_EN:
+- case ISCSI_IFACE_PARAM_DATASEQ_INORDER_EN:
+- case ISCSI_IFACE_PARAM_PDU_INORDER_EN:
+- case ISCSI_IFACE_PARAM_ERL:
+- case ISCSI_IFACE_PARAM_MAX_RECV_DLENGTH:
+- case ISCSI_IFACE_PARAM_FIRST_BURST:
+- case ISCSI_IFACE_PARAM_MAX_R2T:
+- case ISCSI_IFACE_PARAM_MAX_BURST:
+- case ISCSI_IFACE_PARAM_CHAP_AUTH_EN:
+- case ISCSI_IFACE_PARAM_BIDI_CHAP_EN:
+- case ISCSI_IFACE_PARAM_DISCOVERY_AUTH_OPTIONAL:
+- case ISCSI_IFACE_PARAM_DISCOVERY_LOGOUT_EN:
+- case ISCSI_IFACE_PARAM_STRICT_LOGIN_COMP_EN:
+- case ISCSI_IFACE_PARAM_INITIATOR_NAME:
+- param_type = ISCSI_IFACE_PARAM;
+- break;
+- default:
+- param_type = ISCSI_NET_PARAM;
+- }
+-
+- return t->attr_is_visible(param_type, param);
++ return t->attr_is_visible(ISCSI_NET_PARAM, param);
+ }
+
+ static struct attribute *iscsi_iface_attrs[] = {
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
+index 0ec6385eb15e6..7c47a0cebf3bb 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
+@@ -48,7 +48,8 @@
+ defined(CONFIG_ARCH_TEGRA_132_SOC) || \
+ defined(CONFIG_ARCH_TEGRA_210_SOC) || \
+ defined(CONFIG_ARCH_TEGRA_186_SOC) || \
+- defined(CONFIG_ARCH_TEGRA_194_SOC)
++ defined(CONFIG_ARCH_TEGRA_194_SOC) || \
++ defined(CONFIG_ARCH_TEGRA_234_SOC)
+ static u32 tegra30_fuse_read_early(struct tegra_fuse *fuse, unsigned int offset)
+ {
+ if (WARN_ON(!fuse->base))
+diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
+index f5055ceb7529d..91f83683c15ad 100644
+--- a/drivers/spi/spi-cadence.c
++++ b/drivers/spi/spi-cadence.c
+@@ -585,6 +585,12 @@ static int cdns_spi_probe(struct platform_device *pdev)
+ goto clk_dis_apb;
+ }
+
++ pm_runtime_use_autosuspend(&pdev->dev);
++ pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
++ pm_runtime_get_noresume(&pdev->dev);
++ pm_runtime_set_active(&pdev->dev);
++ pm_runtime_enable(&pdev->dev);
++
+ ret = of_property_read_u32(pdev->dev.of_node, "num-cs", &num_cs);
+ if (ret < 0)
+ master->num_chipselect = CDNS_SPI_DEFAULT_NUM_CS;
+@@ -599,11 +605,6 @@ static int cdns_spi_probe(struct platform_device *pdev)
+ /* SPI controller initializations */
+ cdns_spi_init_hw(xspi);
+
+- pm_runtime_set_active(&pdev->dev);
+- pm_runtime_enable(&pdev->dev);
+- pm_runtime_use_autosuspend(&pdev->dev);
+- pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
+-
+ irq = platform_get_irq(pdev, 0);
+ if (irq <= 0) {
+ ret = -ENXIO;
+@@ -636,6 +637,9 @@ static int cdns_spi_probe(struct platform_device *pdev)
+
+ master->bits_per_word_mask = SPI_BPW_MASK(8);
+
++ pm_runtime_mark_last_busy(&pdev->dev);
++ pm_runtime_put_autosuspend(&pdev->dev);
++
+ ret = spi_register_master(master);
+ if (ret) {
+ dev_err(&pdev->dev, "spi_register_master failed\n");
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 1b003dba86f9f..25486ee8379b6 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -1124,11 +1124,13 @@ static int dspi_probe(struct platform_device *pdev)
+ ret = spi_register_master(master);
+ if (ret != 0) {
+ dev_err(&pdev->dev, "Problem registering DSPI master\n");
+- goto out_free_irq;
++ goto out_release_dma;
+ }
+
+ return ret;
+
++out_release_dma:
++ dspi_release_dma(dspi);
+ out_free_irq:
+ if (dspi->irq)
+ free_irq(dspi->irq, dspi);
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index da28c52c9da19..e2b171057b3b3 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -392,13 +392,23 @@ static int mtk_spi_fifo_transfer(struct spi_master *master,
+ mtk_spi_setup_packet(master);
+
+ cnt = xfer->len / 4;
+- iowrite32_rep(mdata->base + SPI_TX_DATA_REG, xfer->tx_buf, cnt);
++ if (xfer->tx_buf)
++ iowrite32_rep(mdata->base + SPI_TX_DATA_REG, xfer->tx_buf, cnt);
++
++ if (xfer->rx_buf)
++ ioread32_rep(mdata->base + SPI_RX_DATA_REG, xfer->rx_buf, cnt);
+
+ remainder = xfer->len % 4;
+ if (remainder > 0) {
+ reg_val = 0;
+- memcpy(®_val, xfer->tx_buf + (cnt * 4), remainder);
+- writel(reg_val, mdata->base + SPI_TX_DATA_REG);
++ if (xfer->tx_buf) {
++ memcpy(®_val, xfer->tx_buf + (cnt * 4), remainder);
++ writel(reg_val, mdata->base + SPI_TX_DATA_REG);
++ }
++ if (xfer->rx_buf) {
++ reg_val = readl(mdata->base + SPI_RX_DATA_REG);
++ memcpy(xfer->rx_buf + (cnt * 4), ®_val, remainder);
++ }
+ }
+
+ mtk_spi_enable_transfer(master);
+diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
+index ebac2b49b9c6e..af9b038da3ba6 100644
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -38,7 +38,7 @@
+ #include "target_core_alua.h"
+
+ static sense_reason_t
+-sbc_check_prot(struct se_device *, struct se_cmd *, unsigned char *, u32, bool);
++sbc_check_prot(struct se_device *, struct se_cmd *, unsigned char, u32, bool);
+ static sense_reason_t sbc_execute_unmap(struct se_cmd *cmd);
+
+ static sense_reason_t
+@@ -292,14 +292,14 @@ static inline unsigned long long transport_lba_64_ext(unsigned char *cdb)
+ }
+
+ static sense_reason_t
+-sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *ops)
++sbc_setup_write_same(struct se_cmd *cmd, unsigned char flags, struct sbc_ops *ops)
+ {
+ struct se_device *dev = cmd->se_dev;
+ sector_t end_lba = dev->transport->get_blocks(dev) + 1;
+ unsigned int sectors = sbc_get_write_same_sectors(cmd);
+ sense_reason_t ret;
+
+- if ((flags[0] & 0x04) || (flags[0] & 0x02)) {
++ if ((flags & 0x04) || (flags & 0x02)) {
+ pr_err("WRITE_SAME PBDATA and LBDATA"
+ " bits not supported for Block Discard"
+ " Emulation\n");
+@@ -321,7 +321,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
+ }
+
+ /* We always have ANC_SUP == 0 so setting ANCHOR is always an error */
+- if (flags[0] & 0x10) {
++ if (flags & 0x10) {
+ pr_warn("WRITE SAME with ANCHOR not supported\n");
+ return TCM_INVALID_CDB_FIELD;
+ }
+@@ -329,7 +329,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
+ * Special case for WRITE_SAME w/ UNMAP=1 that ends up getting
+ * translated into block discard requests within backend code.
+ */
+- if (flags[0] & 0x08) {
++ if (flags & 0x08) {
+ if (!ops->execute_unmap)
+ return TCM_UNSUPPORTED_SCSI_OPCODE;
+
+@@ -344,7 +344,7 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
+ if (!ops->execute_write_same)
+ return TCM_UNSUPPORTED_SCSI_OPCODE;
+
+- ret = sbc_check_prot(dev, cmd, &cmd->t_task_cdb[0], sectors, true);
++ ret = sbc_check_prot(dev, cmd, flags >> 5, sectors, true);
+ if (ret)
+ return ret;
+
+@@ -702,10 +702,9 @@ sbc_set_prot_op_checks(u8 protect, bool fabric_prot, enum target_prot_type prot_
+ }
+
+ static sense_reason_t
+-sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb,
++sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char protect,
+ u32 sectors, bool is_write)
+ {
+- u8 protect = cdb[1] >> 5;
+ int sp_ops = cmd->se_sess->sup_prot_ops;
+ int pi_prot_type = dev->dev_attrib.pi_prot_type;
+ bool fabric_prot = false;
+@@ -753,7 +752,7 @@ sbc_check_prot(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb,
+ /* Fallthrough */
+ default:
+ pr_err("Unable to determine pi_prot_type for CDB: 0x%02x "
+- "PROTECT: 0x%02x\n", cdb[0], protect);
++ "PROTECT: 0x%02x\n", cmd->t_task_cdb[0], protect);
+ return TCM_INVALID_CDB_FIELD;
+ }
+
+@@ -828,7 +827,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+ if (sbc_check_dpofua(dev, cmd, cdb))
+ return TCM_INVALID_CDB_FIELD;
+
+- ret = sbc_check_prot(dev, cmd, cdb, sectors, false);
++ ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);
+ if (ret)
+ return ret;
+
+@@ -842,7 +841,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+ if (sbc_check_dpofua(dev, cmd, cdb))
+ return TCM_INVALID_CDB_FIELD;
+
+- ret = sbc_check_prot(dev, cmd, cdb, sectors, false);
++ ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);
+ if (ret)
+ return ret;
+
+@@ -856,7 +855,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+ if (sbc_check_dpofua(dev, cmd, cdb))
+ return TCM_INVALID_CDB_FIELD;
+
+- ret = sbc_check_prot(dev, cmd, cdb, sectors, false);
++ ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, false);
+ if (ret)
+ return ret;
+
+@@ -877,7 +876,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+ if (sbc_check_dpofua(dev, cmd, cdb))
+ return TCM_INVALID_CDB_FIELD;
+
+- ret = sbc_check_prot(dev, cmd, cdb, sectors, true);
++ ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);
+ if (ret)
+ return ret;
+
+@@ -891,7 +890,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+ if (sbc_check_dpofua(dev, cmd, cdb))
+ return TCM_INVALID_CDB_FIELD;
+
+- ret = sbc_check_prot(dev, cmd, cdb, sectors, true);
++ ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);
+ if (ret)
+ return ret;
+
+@@ -906,7 +905,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+ if (sbc_check_dpofua(dev, cmd, cdb))
+ return TCM_INVALID_CDB_FIELD;
+
+- ret = sbc_check_prot(dev, cmd, cdb, sectors, true);
++ ret = sbc_check_prot(dev, cmd, cdb[1] >> 5, sectors, true);
+ if (ret)
+ return ret;
+
+@@ -965,7 +964,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+ size = sbc_get_size(cmd, 1);
+ cmd->t_task_lba = get_unaligned_be64(&cdb[12]);
+
+- ret = sbc_setup_write_same(cmd, &cdb[10], ops);
++ ret = sbc_setup_write_same(cmd, cdb[10], ops);
+ if (ret)
+ return ret;
+ break;
+@@ -1064,7 +1063,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+ size = sbc_get_size(cmd, 1);
+ cmd->t_task_lba = get_unaligned_be64(&cdb[2]);
+
+- ret = sbc_setup_write_same(cmd, &cdb[1], ops);
++ ret = sbc_setup_write_same(cmd, cdb[1], ops);
+ if (ret)
+ return ret;
+ break;
+@@ -1082,7 +1081,7 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
+ * Follow sbcr26 with WRITE_SAME (10) and check for the existence
+ * of byte 1 bit 3 UNMAP instead of original reserved field
+ */
+- ret = sbc_setup_write_same(cmd, &cdb[1], ops);
++ ret = sbc_setup_write_same(cmd, cdb[1], ops);
+ if (ret)
+ return ret;
+ break;
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index 7b0ffc1c0ea92..a24296d68f3ed 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -1303,7 +1303,7 @@ free_tz:
+ EXPORT_SYMBOL_GPL(thermal_zone_device_register);
+
+ /**
+- * thermal_device_unregister - removes the registered thermal zone device
++ * thermal_zone_device_unregister - removes the registered thermal zone device
+ * @tz: the thermal zone device to remove
+ */
+ void thermal_zone_device_unregister(struct thermal_zone_device *tz)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index a7f16dbfffdfa..f1a11032a0a01 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -45,6 +45,7 @@
+
+ #define USB_TP_TRANSMISSION_DELAY 40 /* ns */
+ #define USB_TP_TRANSMISSION_DELAY_MAX 65535 /* ns */
++#define USB_PING_RESPONSE_TIME 400 /* ns */
+
+ /* Protect struct usb_device->state and ->children members
+ * Note: Both are also protected by ->dev.sem, except that ->state can
+@@ -179,8 +180,9 @@ int usb_device_supports_lpm(struct usb_device *udev)
+ }
+
+ /*
+- * Set the Maximum Exit Latency (MEL) for the host to initiate a transition from
+- * either U1 or U2.
++ * Set the Maximum Exit Latency (MEL) for the host to wakup up the path from
++ * U1/U2, send a PING to the device and receive a PING_RESPONSE.
++ * See USB 3.1 section C.1.5.2
+ */
+ static void usb_set_lpm_mel(struct usb_device *udev,
+ struct usb3_lpm_parameters *udev_lpm_params,
+@@ -190,35 +192,37 @@ static void usb_set_lpm_mel(struct usb_device *udev,
+ unsigned int hub_exit_latency)
+ {
+ unsigned int total_mel;
+- unsigned int device_mel;
+- unsigned int hub_mel;
+
+ /*
+- * Calculate the time it takes to transition all links from the roothub
+- * to the parent hub into U0. The parent hub must then decode the
+- * packet (hub header decode latency) to figure out which port it was
+- * bound for.
+- *
+- * The Hub Header decode latency is expressed in 0.1us intervals (0x1
+- * means 0.1us). Multiply that by 100 to get nanoseconds.
++ * tMEL1. time to transition path from host to device into U0.
++ * MEL for parent already contains the delay up to parent, so only add
++ * the exit latency for the last link (pick the slower exit latency),
++ * and the hub header decode latency. See USB 3.1 section C 2.2.1
++ * Store MEL in nanoseconds
+ */
+ total_mel = hub_lpm_params->mel +
+- (hub->descriptor->u.ss.bHubHdrDecLat * 100);
++ max(udev_exit_latency, hub_exit_latency) * 1000 +
++ hub->descriptor->u.ss.bHubHdrDecLat * 100;
+
+ /*
+- * How long will it take to transition the downstream hub's port into
+- * U0? The greater of either the hub exit latency or the device exit
+- * latency.
+- *
+- * The BOS U1/U2 exit latencies are expressed in 1us intervals.
+- * Multiply that by 1000 to get nanoseconds.
++ * tMEL2. Time to submit PING packet. Sum of tTPTransmissionDelay for
++ * each link + wHubDelay for each hub. Add only for last link.
++ * tMEL4, the time for PING_RESPONSE to traverse upstream is similar.
++ * Multiply by 2 to include it as well.
+ */
+- device_mel = udev_exit_latency * 1000;
+- hub_mel = hub_exit_latency * 1000;
+- if (device_mel > hub_mel)
+- total_mel += device_mel;
+- else
+- total_mel += hub_mel;
++ total_mel += (__le16_to_cpu(hub->descriptor->u.ss.wHubDelay) +
++ USB_TP_TRANSMISSION_DELAY) * 2;
++
++ /*
++ * tMEL3, tPingResponse. Time taken by device to generate PING_RESPONSE
++ * after receiving PING. Also add 2100ns as stated in USB 3.1 C 1.5.2.4
++ * to cover the delay if the PING_RESPONSE is queued behind a Max Packet
++ * Size DP.
++ * Note these delays should be added only once for the entire path, so
++ * add them to the MEL of the device connected to the roothub.
++ */
++ if (!hub->hdev->parent)
++ total_mel += USB_PING_RESPONSE_TIME + 2100;
+
+ udev_lpm_params->mel = total_mel;
+ }
+@@ -3988,6 +3992,47 @@ static int usb_set_lpm_timeout(struct usb_device *udev,
+ return 0;
+ }
+
++/*
++ * Don't allow device intiated U1/U2 if the system exit latency + one bus
++ * interval is greater than the minimum service interval of any active
++ * periodic endpoint. See USB 3.2 section 9.4.9
++ */
++static bool usb_device_may_initiate_lpm(struct usb_device *udev,
++ enum usb3_link_state state)
++{
++ unsigned int sel; /* us */
++ int i, j;
++
++ if (state == USB3_LPM_U1)
++ sel = DIV_ROUND_UP(udev->u1_params.sel, 1000);
++ else if (state == USB3_LPM_U2)
++ sel = DIV_ROUND_UP(udev->u2_params.sel, 1000);
++ else
++ return false;
++
++ for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
++ struct usb_interface *intf;
++ struct usb_endpoint_descriptor *desc;
++ unsigned int interval;
++
++ intf = udev->actconfig->interface[i];
++ if (!intf)
++ continue;
++
++ for (j = 0; j < intf->cur_altsetting->desc.bNumEndpoints; j++) {
++ desc = &intf->cur_altsetting->endpoint[j].desc;
++
++ if (usb_endpoint_xfer_int(desc) ||
++ usb_endpoint_xfer_isoc(desc)) {
++ interval = (1 << (desc->bInterval - 1)) * 125;
++ if (sel + 125 > interval)
++ return false;
++ }
++ }
++ }
++ return true;
++}
++
+ /*
+ * Enable the hub-initiated U1/U2 idle timeouts, and enable device-initiated
+ * U1/U2 entry.
+@@ -4060,20 +4105,23 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev,
+ * U1/U2_ENABLE
+ */
+ if (udev->actconfig &&
+- usb_set_device_initiated_lpm(udev, state, true) == 0) {
+- if (state == USB3_LPM_U1)
+- udev->usb3_lpm_u1_enabled = 1;
+- else if (state == USB3_LPM_U2)
+- udev->usb3_lpm_u2_enabled = 1;
+- } else {
+- /* Don't request U1/U2 entry if the device
+- * cannot transition to U1/U2.
+- */
+- usb_set_lpm_timeout(udev, state, 0);
+- hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state);
++ usb_device_may_initiate_lpm(udev, state)) {
++ if (usb_set_device_initiated_lpm(udev, state, true)) {
++ /*
++ * Request to enable device initiated U1/U2 failed,
++ * better to turn off lpm in this case.
++ */
++ usb_set_lpm_timeout(udev, state, 0);
++ hcd->driver->disable_usb3_lpm_timeout(hcd, udev, state);
++ return;
++ }
+ }
+-}
+
++ if (state == USB3_LPM_U1)
++ udev->usb3_lpm_u1_enabled = 1;
++ else if (state == USB3_LPM_U2)
++ udev->usb3_lpm_u2_enabled = 1;
++}
+ /*
+ * Disable the hub-initiated U1/U2 idle timeouts, and disable device-initiated
+ * U1/U2 entry.
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index f6a6c54cba35f..d97544fd339b1 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -502,10 +502,6 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* DJI CineSSD */
+ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
+
+- /* Fibocom L850-GL LTE Modem */
+- { USB_DEVICE(0x2cb7, 0x0007), .driver_info =
+- USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+-
+ /* INTEL VALUE SSD */
+ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index d0edb7e453c07..7fff96dff0a03 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -2645,12 +2645,14 @@ static void dwc2_hsotg_complete_in(struct dwc2_hsotg *hsotg,
+ return;
+ }
+
+- /* Zlp for all endpoints, for ep0 only in DATA IN stage */
++ /* Zlp for all endpoints in non DDMA, for ep0 only in DATA IN stage */
+ if (hs_ep->send_zlp) {
+- dwc2_hsotg_program_zlp(hsotg, hs_ep);
+ hs_ep->send_zlp = 0;
+- /* transfer will be completed on next complete interrupt */
+- return;
++ if (!using_desc_dma(hsotg)) {
++ dwc2_hsotg_program_zlp(hsotg, hs_ep);
++ /* transfer will be completed on next complete interrupt */
++ return;
++ }
+ }
+
+ if (hs_ep->index == 0 && hsotg->ep0_state == DWC2_EP0_DATA_IN) {
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index c9acc59f4addd..16efe37b7558c 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -153,8 +153,6 @@ struct max3421_hcd {
+ */
+ struct urb *curr_urb;
+ enum scheduling_pass sched_pass;
+- struct usb_device *loaded_dev; /* dev that's loaded into the chip */
+- int loaded_epnum; /* epnum whose toggles are loaded */
+ int urb_done; /* > 0 -> no errors, < 0: errno */
+ size_t curr_len;
+ u8 hien;
+@@ -492,39 +490,17 @@ max3421_set_speed(struct usb_hcd *hcd, struct usb_device *dev)
+ * Caller must NOT hold HCD spinlock.
+ */
+ static void
+-max3421_set_address(struct usb_hcd *hcd, struct usb_device *dev, int epnum,
+- int force_toggles)
++max3421_set_address(struct usb_hcd *hcd, struct usb_device *dev, int epnum)
+ {
+- struct max3421_hcd *max3421_hcd = hcd_to_max3421(hcd);
+- int old_epnum, same_ep, rcvtog, sndtog;
+- struct usb_device *old_dev;
++ int rcvtog, sndtog;
+ u8 hctl;
+
+- old_dev = max3421_hcd->loaded_dev;
+- old_epnum = max3421_hcd->loaded_epnum;
+-
+- same_ep = (dev == old_dev && epnum == old_epnum);
+- if (same_ep && !force_toggles)
+- return;
+-
+- if (old_dev && !same_ep) {
+- /* save the old end-points toggles: */
+- u8 hrsl = spi_rd8(hcd, MAX3421_REG_HRSL);
+-
+- rcvtog = (hrsl >> MAX3421_HRSL_RCVTOGRD_BIT) & 1;
+- sndtog = (hrsl >> MAX3421_HRSL_SNDTOGRD_BIT) & 1;
+-
+- /* no locking: HCD (i.e., we) own toggles, don't we? */
+- usb_settoggle(old_dev, old_epnum, 0, rcvtog);
+- usb_settoggle(old_dev, old_epnum, 1, sndtog);
+- }
+ /* setup new endpoint's toggle bits: */
+ rcvtog = usb_gettoggle(dev, epnum, 0);
+ sndtog = usb_gettoggle(dev, epnum, 1);
+ hctl = (BIT(rcvtog + MAX3421_HCTL_RCVTOG0_BIT) |
+ BIT(sndtog + MAX3421_HCTL_SNDTOG0_BIT));
+
+- max3421_hcd->loaded_epnum = epnum;
+ spi_wr8(hcd, MAX3421_REG_HCTL, hctl);
+
+ /*
+@@ -532,7 +508,6 @@ max3421_set_address(struct usb_hcd *hcd, struct usb_device *dev, int epnum,
+ * address-assignment so it's best to just always load the
+ * address whenever the end-point changed/was forced.
+ */
+- max3421_hcd->loaded_dev = dev;
+ spi_wr8(hcd, MAX3421_REG_PERADDR, dev->devnum);
+ }
+
+@@ -667,7 +642,7 @@ max3421_select_and_start_urb(struct usb_hcd *hcd)
+ struct max3421_hcd *max3421_hcd = hcd_to_max3421(hcd);
+ struct urb *urb, *curr_urb = NULL;
+ struct max3421_ep *max3421_ep;
+- int epnum, force_toggles = 0;
++ int epnum;
+ struct usb_host_endpoint *ep;
+ struct list_head *pos;
+ unsigned long flags;
+@@ -777,7 +752,6 @@ done:
+ usb_settoggle(urb->dev, epnum, 0, 1);
+ usb_settoggle(urb->dev, epnum, 1, 1);
+ max3421_ep->pkt_state = PKT_STATE_SETUP;
+- force_toggles = 1;
+ } else
+ max3421_ep->pkt_state = PKT_STATE_TRANSFER;
+ }
+@@ -785,7 +759,7 @@ done:
+ spin_unlock_irqrestore(&max3421_hcd->lock, flags);
+
+ max3421_ep->last_active = max3421_hcd->frame_number;
+- max3421_set_address(hcd, urb->dev, epnum, force_toggles);
++ max3421_set_address(hcd, urb->dev, epnum);
+ max3421_set_speed(hcd, urb->dev);
+ max3421_next_transfer(hcd, 0);
+ return 1;
+@@ -1380,6 +1354,16 @@ max3421_urb_done(struct usb_hcd *hcd)
+ status = 0;
+ urb = max3421_hcd->curr_urb;
+ if (urb) {
++ /* save the old end-points toggles: */
++ u8 hrsl = spi_rd8(hcd, MAX3421_REG_HRSL);
++ int rcvtog = (hrsl >> MAX3421_HRSL_RCVTOGRD_BIT) & 1;
++ int sndtog = (hrsl >> MAX3421_HRSL_SNDTOGRD_BIT) & 1;
++ int epnum = usb_endpoint_num(&urb->ep->desc);
++
++ /* no locking: HCD (i.e., we) own toggles, don't we? */
++ usb_settoggle(urb->dev, epnum, 0, rcvtog);
++ usb_settoggle(urb->dev, epnum, 1, sndtog);
++
+ max3421_hcd->curr_urb = NULL;
+ spin_lock_irqsave(&max3421_hcd->lock, flags);
+ usb_hcd_unlink_urb_from_ep(hcd, urb);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index e6e8bed11aeab..9143e74b70512 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1458,11 +1458,12 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ * Inform the usbcore about resume-in-progress by returning
+ * a non-zero value even if there are no status changes.
+ */
++ spin_lock_irqsave(&xhci->lock, flags);
++
+ status = bus_state->resuming_ports;
+
+ mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
+
+- spin_lock_irqsave(&xhci->lock, flags);
+ /* For each port, did anything change? If so, set that bit in buf. */
+ for (i = 0; i < max_ports; i++) {
+ temp = readl(ports[i]->addr);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 22b1de99d02d1..7c981ad34251d 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -433,6 +433,26 @@ static void ring_doorbell_for_active_rings(struct xhci_hcd *xhci,
+ }
+ }
+
++static struct xhci_virt_ep *xhci_get_virt_ep(struct xhci_hcd *xhci,
++ unsigned int slot_id,
++ unsigned int ep_index)
++{
++ if (slot_id == 0 || slot_id >= MAX_HC_SLOTS) {
++ xhci_warn(xhci, "Invalid slot_id %u\n", slot_id);
++ return NULL;
++ }
++ if (ep_index >= EP_CTX_PER_DEV) {
++ xhci_warn(xhci, "Invalid endpoint index %u\n", ep_index);
++ return NULL;
++ }
++ if (!xhci->devs[slot_id]) {
++ xhci_warn(xhci, "No xhci virt device for slot_id %u\n", slot_id);
++ return NULL;
++ }
++
++ return &xhci->devs[slot_id]->eps[ep_index];
++}
++
+ /* Get the right ring for the given slot_id, ep_index and stream_id.
+ * If the endpoint supports streams, boundary check the URB's stream ID.
+ * If the endpoint doesn't support streams, return the singular endpoint ring.
+@@ -443,7 +463,10 @@ struct xhci_ring *xhci_triad_to_transfer_ring(struct xhci_hcd *xhci,
+ {
+ struct xhci_virt_ep *ep;
+
+- ep = &xhci->devs[slot_id]->eps[ep_index];
++ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
++ if (!ep)
++ return NULL;
++
+ /* Common case: no streams */
+ if (!(ep->ep_state & EP_HAS_STREAMS))
+ return ep->ring;
+@@ -718,11 +741,14 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
+ memset(&deq_state, 0, sizeof(deq_state));
+ ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3]));
+
++ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
++ if (!ep)
++ return;
++
+ vdev = xhci->devs[slot_id];
+ ep_ctx = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
+ trace_xhci_handle_cmd_stop_ep(ep_ctx);
+
+- ep = &xhci->devs[slot_id]->eps[ep_index];
+ last_unlinked_td = list_last_entry(&ep->cancelled_td_list,
+ struct xhci_td, cancelled_td_list);
+
+@@ -1043,9 +1069,11 @@ static void xhci_handle_cmd_set_deq(struct xhci_hcd *xhci, int slot_id,
+
+ ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3]));
+ stream_id = TRB_TO_STREAM_ID(le32_to_cpu(trb->generic.field[2]));
+- dev = xhci->devs[slot_id];
+- ep = &dev->eps[ep_index];
++ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
++ if (!ep)
++ return;
+
++ dev = xhci->devs[slot_id];
+ ep_ring = xhci_stream_id_to_ring(dev, ep_index, stream_id);
+ if (!ep_ring) {
+ xhci_warn(xhci, "WARN Set TR deq ptr command for freed stream ID %u\n",
+@@ -1118,9 +1146,9 @@ static void xhci_handle_cmd_set_deq(struct xhci_hcd *xhci, int slot_id,
+ }
+
+ cleanup:
+- dev->eps[ep_index].ep_state &= ~SET_DEQ_PENDING;
+- dev->eps[ep_index].queued_deq_seg = NULL;
+- dev->eps[ep_index].queued_deq_ptr = NULL;
++ ep->ep_state &= ~SET_DEQ_PENDING;
++ ep->queued_deq_seg = NULL;
++ ep->queued_deq_ptr = NULL;
+ /* Restart any rings with pending URBs */
+ ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+ }
+@@ -1129,10 +1157,15 @@ static void xhci_handle_cmd_reset_ep(struct xhci_hcd *xhci, int slot_id,
+ union xhci_trb *trb, u32 cmd_comp_code)
+ {
+ struct xhci_virt_device *vdev;
++ struct xhci_virt_ep *ep;
+ struct xhci_ep_ctx *ep_ctx;
+ unsigned int ep_index;
+
+ ep_index = TRB_TO_EP_INDEX(le32_to_cpu(trb->generic.field[3]));
++ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
++ if (!ep)
++ return;
++
+ vdev = xhci->devs[slot_id];
+ ep_ctx = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
+ trace_xhci_handle_cmd_reset_ep(ep_ctx);
+@@ -1162,7 +1195,7 @@ static void xhci_handle_cmd_reset_ep(struct xhci_hcd *xhci, int slot_id,
+ xhci_ring_cmd_db(xhci);
+ } else {
+ /* Clear our internal halted state */
+- xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_HALTED;
++ ep->ep_state &= ~EP_HALTED;
+ }
+ }
+
+@@ -2281,14 +2314,13 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ trb_comp_code = GET_COMP_CODE(le32_to_cpu(event->transfer_len));
+ ep_trb_dma = le64_to_cpu(event->buffer);
+
+- xdev = xhci->devs[slot_id];
+- if (!xdev) {
+- xhci_err(xhci, "ERROR Transfer event pointed to bad slot %u\n",
+- slot_id);
++ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
++ if (!ep) {
++ xhci_err(xhci, "ERROR Invalid Transfer event\n");
+ goto err_out;
+ }
+
+- ep = &xdev->eps[ep_index];
++ xdev = xhci->devs[slot_id];
+ ep_ring = xhci_dma_to_transfer_ring(ep, ep_trb_dma);
+ ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
+
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 7a4195f8cd1cc..dfc914713704f 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -991,6 +991,7 @@ struct xhci_interval_bw_table {
+ unsigned int ss_bw_out;
+ };
+
++#define EP_CTX_PER_DEV 31
+
+ struct xhci_virt_device {
+ struct usb_device *udev;
+@@ -1005,7 +1006,7 @@ struct xhci_virt_device {
+ struct xhci_container_ctx *out_ctx;
+ /* Used for addressing devices and configuration changes */
+ struct xhci_container_ctx *in_ctx;
+- struct xhci_virt_ep eps[31];
++ struct xhci_virt_ep eps[EP_CTX_PER_DEV];
+ u8 fake_port;
+ u8 real_port;
+ struct xhci_interval_bw_table *bw_table;
+diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
+index 6b92a57382db3..e49f6d41f5ec4 100644
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -101,6 +101,8 @@ static struct dma_chan *usbhsf_dma_chan_get(struct usbhs_fifo *fifo,
+ #define usbhsf_dma_map(p) __usbhsf_dma_map_ctrl(p, 1)
+ #define usbhsf_dma_unmap(p) __usbhsf_dma_map_ctrl(p, 0)
+ static int __usbhsf_dma_map_ctrl(struct usbhs_pkt *pkt, int map);
++static void usbhsf_tx_irq_ctrl(struct usbhs_pipe *pipe, int enable);
++static void usbhsf_rx_irq_ctrl(struct usbhs_pipe *pipe, int enable);
+ struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt)
+ {
+ struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
+@@ -123,6 +125,11 @@ struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt)
+ if (chan) {
+ dmaengine_terminate_all(chan);
+ usbhsf_dma_unmap(pkt);
++ } else {
++ if (usbhs_pipe_is_dir_in(pipe))
++ usbhsf_rx_irq_ctrl(pipe, 0);
++ else
++ usbhsf_tx_irq_ctrl(pipe, 0);
+ }
+
+ usbhs_pipe_clear_without_sequence(pipe, 0, 0);
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 851f178ff56fc..eaf9155663027 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -156,6 +156,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x89A4) }, /* CESINEL FTBC Flexible Thyristor Bridge Controller */
+ { USB_DEVICE(0x10C4, 0x89FB) }, /* Qivicon ZigBee USB Radio Stick */
+ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
++ { USB_DEVICE(0x10C4, 0x8A5B) }, /* CEL EM3588 ZigBee USB Stick */
+ { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
+ { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+@@ -203,8 +204,8 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */
+ { USB_DEVICE(0x1901, 0x0195) }, /* GE B850/B650/B450 CP2104 DP UART interface */
+ { USB_DEVICE(0x1901, 0x0196) }, /* GE B850 CP2105 DP UART interface */
+- { USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 Display serial interface */
+- { USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 M.2 Key E serial interface */
++ { USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 M.2 Key E serial interface */
++ { USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 Display serial interface */
+ { USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */
+ { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 5e3430d456f36..9370c6fa7bc80 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -238,6 +238,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_UC15 0x9090
+ /* These u-blox products use Qualcomm's vendor ID */
+ #define UBLOX_PRODUCT_R410M 0x90b2
++#define UBLOX_PRODUCT_R6XX 0x90fa
+ /* These Yuga products use Qualcomm's vendor ID */
+ #define YUGA_PRODUCT_CLM920_NC5 0x9625
+
+@@ -1101,6 +1102,8 @@ static const struct usb_device_id option_ids[] = {
+ /* u-blox products using Qualcomm vendor ID */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M),
+ .driver_info = RSVD(1) | RSVD(3) },
++ { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R6XX),
++ .driver_info = RSVD(3) },
+ /* Quectel products using Quectel vendor ID */
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21, 0xff, 0xff, 0xff),
+ .driver_info = NUMEP2 },
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index cb7b15ecb7aba..c7db6c943ba51 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -45,6 +45,13 @@ UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME),
+
++/* Reported-by: Julian Sikorski <belegdol@gmail.com> */
++UNUSUAL_DEV(0x059f, 0x1061, 0x0000, 0x9999,
++ "LaCie",
++ "Rugged USB3-FW",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_IGNORE_UAS),
++
+ /*
+ * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI
+ * commands in UAS mode. Observed with the 1.28 firmware; are there others?
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index bf0e0e3e09c5d..d29f4cf125d27 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -530,7 +530,7 @@ again:
+ * inode has not been flagged as nocompress. This flag can
+ * change at any time if we discover bad compression ratios.
+ */
+- if (inode_need_compress(inode, start, end)) {
++ if (nr_pages > 1 && inode_need_compress(inode, start, end)) {
+ WARN_ON(pages);
+ pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS);
+ if (!pages) {
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 317a0762fc5f2..e3f10c110b74e 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -835,7 +835,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
+ flags = FOLL_FORCE | (write ? FOLL_WRITE : 0);
+
+ while (count > 0) {
+- int this_len = min_t(int, count, PAGE_SIZE);
++ size_t this_len = min_t(size_t, count, PAGE_SIZE);
+
+ if (write && copy_from_user(page, buf, this_len)) {
+ copied = -EFAULT;
+diff --git a/include/drm/drm_ioctl.h b/include/drm/drm_ioctl.h
+index fafb6f592c4b9..b722757a5dc24 100644
+--- a/include/drm/drm_ioctl.h
++++ b/include/drm/drm_ioctl.h
+@@ -68,6 +68,7 @@ typedef int drm_ioctl_compat_t(struct file *filp, unsigned int cmd,
+ unsigned long arg);
+
+ #define DRM_IOCTL_NR(n) _IOC_NR(n)
++#define DRM_IOCTL_TYPE(n) _IOC_TYPE(n)
+ #define DRM_MAJOR 226
+
+ /**
+diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h
+index 56cb3c38569a7..14efa0ded75dd 100644
+--- a/include/net/dst_metadata.h
++++ b/include/net/dst_metadata.h
+@@ -45,7 +45,9 @@ skb_tunnel_info(const struct sk_buff *skb)
+ return &md_dst->u.tun_info;
+
+ dst = skb_dst(skb);
+- if (dst && dst->lwtstate)
++ if (dst && dst->lwtstate &&
++ (dst->lwtstate->type == LWTUNNEL_ENCAP_IP ||
++ dst->lwtstate->type == LWTUNNEL_ENCAP_IP6))
+ return lwt_tun_info(dst->lwtstate);
+
+ return NULL;
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 5c38a80cee3a2..a8f5410ae0d4b 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -241,7 +241,7 @@ static inline bool ipv6_anycast_destination(const struct dst_entry *dst,
+ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ int (*output)(struct net *, struct sock *, struct sk_buff *));
+
+-static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
++static inline unsigned int ip6_skb_dst_mtu(struct sk_buff *skb)
+ {
+ int mtu;
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 9cdbc07bb70f3..84e7efda98daf 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4714,7 +4714,7 @@ static const u64 cfs_bandwidth_slack_period = 5 * NSEC_PER_MSEC;
+ static int runtime_refresh_within(struct cfs_bandwidth *cfs_b, u64 min_expire)
+ {
+ struct hrtimer *refresh_timer = &cfs_b->period_timer;
+- u64 remaining;
++ s64 remaining;
+
+ /* if the call-back is running a quota refresh is already occurring */
+ if (hrtimer_callback_running(refresh_timer))
+@@ -4722,7 +4722,7 @@ static int runtime_refresh_within(struct cfs_bandwidth *cfs_b, u64 min_expire)
+
+ /* is a quota refresh about to occur? */
+ remaining = ktime_to_ns(hrtimer_expires_remaining(refresh_timer));
+- if (remaining < min_expire)
++ if (remaining < (s64)min_expire)
+ return 1;
+
+ return 0;
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 360129e475407..987d3447bf2a1 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -3172,10 +3172,30 @@ static bool rb_per_cpu_empty(struct ring_buffer_per_cpu *cpu_buffer)
+ if (unlikely(!head))
+ return true;
+
+- return reader->read == rb_page_commit(reader) &&
+- (commit == reader ||
+- (commit == head &&
+- head->read == rb_page_commit(commit)));
++ /* Reader should exhaust content in reader page */
++ if (reader->read != rb_page_commit(reader))
++ return false;
++
++ /*
++ * If writers are committing on the reader page, knowing all
++ * committed content has been read, the ring buffer is empty.
++ */
++ if (commit == reader)
++ return true;
++
++ /*
++ * If writers are committing on a page other than reader page
++ * and head page, there should always be content to read.
++ */
++ if (commit != head)
++ return false;
++
++ /*
++ * Writers are committing on the head page, we just need
++ * to care about there're committed data, and the reader will
++ * swap reader page with head page when it is to read data.
++ */
++ return rb_page_commit(commit) == 0;
+ }
+
+ /**
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index a94b9981eb172..282ac40c50704 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -311,14 +311,6 @@ int slab_unmergeable(struct kmem_cache *s)
+ if (s->refcount < 0)
+ return 1;
+
+-#ifdef CONFIG_MEMCG_KMEM
+- /*
+- * Skip the dying kmem_cache.
+- */
+- if (s->memcg_params.dying)
+- return 1;
+-#endif
+-
+ return 0;
+ }
+
+@@ -918,6 +910,16 @@ void kmem_cache_destroy(struct kmem_cache *s)
+ get_online_mems();
+
+ mutex_lock(&slab_mutex);
++
++ /*
++ * Another thread referenced it again
++ */
++ if (READ_ONCE(s->refcount)) {
++ spin_lock_irq(&memcg_kmem_wq_lock);
++ s->memcg_params.dying = false;
++ spin_unlock_irq(&memcg_kmem_wq_lock);
++ goto out_unlock;
++ }
+ #endif
+
+ err = shutdown_memcg_caches(s);
+diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
+index ed2b6002ae537..5aa508a08a691 100644
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -564,7 +564,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev,
+ struct net_bridge_port *p;
+ int err = 0;
+ unsigned br_hr, dev_hr;
+- bool changed_addr;
++ bool changed_addr, fdb_synced = false;
+
+ /* Don't allow bridging non-ethernet like devices, or DSA-enabled
+ * master network devices since the bridge layer rx_handler prevents
+@@ -640,6 +640,19 @@ int br_add_if(struct net_bridge *br, struct net_device *dev,
+ list_add_rcu(&p->list, &br->port_list);
+
+ nbp_update_port_count(br);
++ if (!br_promisc_port(p) && (p->dev->priv_flags & IFF_UNICAST_FLT)) {
++ /* When updating the port count we also update all ports'
++ * promiscuous mode.
++ * A port leaving promiscuous mode normally gets the bridge's
++ * fdb synced to the unicast filter (if supported), however,
++ * `br_port_clear_promisc` does not distinguish between
++ * non-promiscuous ports and *new* ports, so we need to
++ * sync explicitly here.
++ */
++ fdb_synced = br_fdb_sync_static(br, p) == 0;
++ if (!fdb_synced)
++ netdev_err(dev, "failed to sync bridge static fdb addresses to this port\n");
++ }
+
+ netdev_update_features(br->dev);
+
+@@ -680,6 +693,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev,
+ return 0;
+
+ err7:
++ if (fdb_synced)
++ br_fdb_unsync_static(br, p);
+ list_del_rcu(&p->list);
+ br_fdb_delete_by_port(br, p, 0, 1);
+ nbp_update_port_count(br);
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index 4b31f0aaa96d9..348b8cb0bc24c 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -539,7 +539,8 @@ static int caif_seqpkt_sendmsg(struct socket *sock, struct msghdr *msg,
+ goto err;
+
+ ret = -EINVAL;
+- if (unlikely(msg->msg_iter.iov->iov_base == NULL))
++ if (unlikely(msg->msg_iter.nr_segs == 0) ||
++ unlikely(msg->msg_iter.iov->iov_base == NULL))
+ goto err;
+ noblock = msg->msg_flags & MSG_DONTWAIT;
+
+diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
+index 0e6f32defd67b..cc70771059698 100644
+--- a/net/decnet/af_decnet.c
++++ b/net/decnet/af_decnet.c
+@@ -823,7 +823,7 @@ static int dn_auto_bind(struct socket *sock)
+ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)
+ {
+ struct dn_scp *scp = DN_SK(sk);
+- DEFINE_WAIT(wait);
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ int err;
+
+ if (scp->state != DN_CR)
+@@ -833,11 +833,11 @@ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)
+ scp->segsize_loc = dst_metric_advmss(__sk_dst_get(sk));
+ dn_send_conn_conf(sk, allocation);
+
+- prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
++ add_wait_queue(sk_sleep(sk), &wait);
+ for(;;) {
+ release_sock(sk);
+ if (scp->state == DN_CC)
+- *timeo = schedule_timeout(*timeo);
++ *timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, *timeo);
+ lock_sock(sk);
+ err = 0;
+ if (scp->state == DN_RUN)
+@@ -851,9 +851,8 @@ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)
+ err = -EAGAIN;
+ if (!*timeo)
+ break;
+- prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+ }
+- finish_wait(sk_sleep(sk), &wait);
++ remove_wait_queue(sk_sleep(sk), &wait);
+ if (err == 0) {
+ sk->sk_socket->state = SS_CONNECTED;
+ } else if (scp->state != DN_CC) {
+@@ -865,7 +864,7 @@ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)
+ static int dn_wait_run(struct sock *sk, long *timeo)
+ {
+ struct dn_scp *scp = DN_SK(sk);
+- DEFINE_WAIT(wait);
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ int err = 0;
+
+ if (scp->state == DN_RUN)
+@@ -874,11 +873,11 @@ static int dn_wait_run(struct sock *sk, long *timeo)
+ if (!*timeo)
+ return -EALREADY;
+
+- prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
++ add_wait_queue(sk_sleep(sk), &wait);
+ for(;;) {
+ release_sock(sk);
+ if (scp->state == DN_CI || scp->state == DN_CC)
+- *timeo = schedule_timeout(*timeo);
++ *timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, *timeo);
+ lock_sock(sk);
+ err = 0;
+ if (scp->state == DN_RUN)
+@@ -892,9 +891,8 @@ static int dn_wait_run(struct sock *sk, long *timeo)
+ err = -ETIMEDOUT;
+ if (!*timeo)
+ break;
+- prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+ }
+- finish_wait(sk_sleep(sk), &wait);
++ remove_wait_queue(sk_sleep(sk), &wait);
+ out:
+ if (err == 0) {
+ sk->sk_socket->state = SS_CONNECTED;
+@@ -1039,16 +1037,16 @@ static void dn_user_copy(struct sk_buff *skb, struct optdata_dn *opt)
+
+ static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo)
+ {
+- DEFINE_WAIT(wait);
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ struct sk_buff *skb = NULL;
+ int err = 0;
+
+- prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
++ add_wait_queue(sk_sleep(sk), &wait);
+ for(;;) {
+ release_sock(sk);
+ skb = skb_dequeue(&sk->sk_receive_queue);
+ if (skb == NULL) {
+- *timeo = schedule_timeout(*timeo);
++ *timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, *timeo);
+ skb = skb_dequeue(&sk->sk_receive_queue);
+ }
+ lock_sock(sk);
+@@ -1063,9 +1061,8 @@ static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo)
+ err = -EAGAIN;
+ if (!*timeo)
+ break;
+- prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+ }
+- finish_wait(sk_sleep(sk), &wait);
++ remove_wait_queue(sk_sleep(sk), &wait);
+
+ return skb == NULL ? ERR_PTR(err) : skb;
+ }
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index bdd073ea300ae..30e93b4f831f6 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -330,7 +330,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
+ }
+
+ dev->needed_headroom = t_hlen + hlen;
+- mtu -= t_hlen;
++ mtu -= t_hlen + (dev->type == ARPHRD_ETHER ? dev->hard_header_len : 0);
+
+ if (mtu < IPV4_MIN_MTU)
+ mtu = IPV4_MIN_MTU;
+@@ -361,6 +361,9 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
+ t_hlen = nt->hlen + sizeof(struct iphdr);
+ dev->min_mtu = ETH_MIN_MTU;
+ dev->max_mtu = IP_MAX_MTU - t_hlen;
++ if (dev->type == ARPHRD_ETHER)
++ dev->max_mtu -= dev->hard_header_len;
++
+ ip_tunnel_add(itn, nt);
+ return nt;
+
+@@ -502,13 +505,18 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
+ const struct iphdr *inner_iph)
+ {
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+- int pkt_size = skb->len - tunnel->hlen;
++ int pkt_size;
+ int mtu;
+
+- if (df)
++ pkt_size = skb->len - tunnel->hlen;
++ pkt_size -= dev->type == ARPHRD_ETHER ? dev->hard_header_len : 0;
++
++ if (df) {
+ mtu = dst_mtu(&rt->dst) - (sizeof(struct iphdr) + tunnel->hlen);
+- else
++ mtu -= dev->type == ARPHRD_ETHER ? dev->hard_header_len : 0;
++ } else {
+ mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
++ }
+
+ skb_dst_update_pmtu_no_confirm(skb, mtu);
+
+@@ -936,6 +944,9 @@ int __ip_tunnel_change_mtu(struct net_device *dev, int new_mtu, bool strict)
+ int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+ int max_mtu = IP_MAX_MTU - t_hlen;
+
++ if (dev->type == ARPHRD_ETHER)
++ max_mtu -= dev->hard_header_len;
++
+ if (new_mtu < ETH_MIN_MTU)
+ return -EINVAL;
+
+@@ -1113,6 +1124,9 @@ int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
+ if (tb[IFLA_MTU]) {
+ unsigned int max = IP_MAX_MTU - (nt->hlen + sizeof(struct iphdr));
+
++ if (dev->type == ARPHRD_ETHER)
++ max -= dev->hard_header_len;
++
+ mtu = clamp(dev->mtu, (unsigned int)ETH_MIN_MTU, max);
+ }
+
+diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
+index 018a484773551..2ab371f555250 100644
+--- a/net/ipv4/tcp_fastopen.c
++++ b/net/ipv4/tcp_fastopen.c
+@@ -454,8 +454,15 @@ void tcp_fastopen_active_disable(struct sock *sk)
+ {
+ struct net *net = sock_net(sk);
+
++ /* Paired with READ_ONCE() in tcp_fastopen_active_should_disable() */
++ WRITE_ONCE(net->ipv4.tfo_active_disable_stamp, jiffies);
++
++ /* Paired with smp_rmb() in tcp_fastopen_active_should_disable().
++ * We want net->ipv4.tfo_active_disable_stamp to be updated first.
++ */
++ smp_mb__before_atomic();
+ atomic_inc(&net->ipv4.tfo_active_disable_times);
+- net->ipv4.tfo_active_disable_stamp = jiffies;
++
+ NET_INC_STATS(net, LINUX_MIB_TCPFASTOPENBLACKHOLE);
+ }
+
+@@ -473,10 +480,16 @@ bool tcp_fastopen_active_should_disable(struct sock *sk)
+ if (!tfo_da_times)
+ return false;
+
++ /* Paired with smp_mb__before_atomic() in tcp_fastopen_active_disable() */
++ smp_rmb();
++
+ /* Limit timout to max: 2^6 * initial timeout */
+ multiplier = 1 << min(tfo_da_times - 1, 6);
+- timeout = multiplier * tfo_bh_timeout * HZ;
+- if (time_before(jiffies, sock_net(sk)->ipv4.tfo_active_disable_stamp + timeout))
++
++ /* Paired with the WRITE_ONCE() in tcp_fastopen_active_disable(). */
++ timeout = READ_ONCE(sock_net(sk)->ipv4.tfo_active_disable_stamp) +
++ multiplier * tfo_bh_timeout * HZ;
++ if (time_before(jiffies, timeout))
+ return true;
+
+ /* Mark check bit so we can check for successful active TFO
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index ac6135555e24a..71236aa7388d7 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -348,7 +348,7 @@ void tcp_v4_mtu_reduced(struct sock *sk)
+
+ if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
+ return;
+- mtu = tcp_sk(sk)->mtu_info;
++ mtu = READ_ONCE(tcp_sk(sk)->mtu_info);
+ dst = inet_csk_update_pmtu(sk, mtu);
+ if (!dst)
+ return;
+@@ -516,7 +516,7 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
+ if (sk->sk_state == TCP_LISTEN)
+ goto out;
+
+- tp->mtu_info = info;
++ WRITE_ONCE(tp->mtu_info, info);
+ if (!sock_owned_by_user(sk)) {
+ tcp_v4_mtu_reduced(sk);
+ } else {
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 9b74041e8dd10..d55ee43cd1b8f 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1472,6 +1472,7 @@ int tcp_mtu_to_mss(struct sock *sk, int pmtu)
+ return __tcp_mtu_to_mss(sk, pmtu) -
+ (tcp_sk(sk)->tcp_header_len - sizeof(struct tcphdr));
+ }
++EXPORT_SYMBOL(tcp_mtu_to_mss);
+
+ /* Inverse of above */
+ int tcp_mss_to_mtu(struct sock *sk, int mss)
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 2ff9f774d4463..32f0d1bb3b6d5 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -997,7 +997,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ }
+
+ ipcm_init_sk(&ipc, inet);
+- ipc.gso_size = up->gso_size;
++ ipc.gso_size = READ_ONCE(up->gso_size);
+
+ if (msg->msg_controllen) {
+ err = udp_cmsg_send(sk, msg, &ipc.gso_size);
+@@ -2505,7 +2505,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
+ case UDP_SEGMENT:
+ if (val < 0 || val > USHRT_MAX)
+ return -EINVAL;
+- up->gso_size = val;
++ WRITE_ONCE(up->gso_size, val);
+ break;
+
+ /*
+@@ -2599,7 +2599,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
+ break;
+
+ case UDP_SEGMENT:
+- val = up->gso_size;
++ val = READ_ONCE(up->gso_size);
+ break;
+
+ /* The following two cannot be changed on UDP sockets, the return is
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index aa8f19f852cc7..fc36f3b0dceb3 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -459,7 +459,9 @@ int ip6_forward(struct sk_buff *skb)
+ if (skb_warn_if_lro(skb))
+ goto drop;
+
+- if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
++ if (!net->ipv6.devconf_all->disable_policy &&
++ !idev->cnf.disable_policy &&
++ !xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
+ __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
+ goto drop;
+ }
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 8d822df83b082..e8d206725cb75 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -336,11 +336,20 @@ failure:
+ static void tcp_v6_mtu_reduced(struct sock *sk)
+ {
+ struct dst_entry *dst;
++ u32 mtu;
+
+ if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
+ return;
+
+- dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
++ mtu = READ_ONCE(tcp_sk(sk)->mtu_info);
++
++ /* Drop requests trying to increase our current mss.
++ * Check done in __ip6_rt_update_pmtu() is too late.
++ */
++ if (tcp_mtu_to_mss(sk, mtu) >= tcp_sk(sk)->mss_cache)
++ return;
++
++ dst = inet6_csk_update_pmtu(sk, mtu);
+ if (!dst)
+ return;
+
+@@ -419,6 +428,8 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ }
+
+ if (type == ICMPV6_PKT_TOOBIG) {
++ u32 mtu = ntohl(info);
++
+ /* We are not interested in TCP_LISTEN and open_requests
+ * (SYN-ACKs send out by Linux are always <576bytes so
+ * they should go through unfragmented).
+@@ -429,7 +440,11 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ if (!ip6_sk_accept_pmtu(sk))
+ goto out;
+
+- tp->mtu_info = ntohl(info);
++ if (mtu < IPV6_MIN_MTU)
++ goto out;
++
++ WRITE_ONCE(tp->mtu_info, mtu);
++
+ if (!sock_owned_by_user(sk))
+ tcp_v6_mtu_reduced(sk);
+ else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
+@@ -503,7 +518,8 @@ static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
+ opt = ireq->ipv6_opt;
+ if (!opt)
+ opt = rcu_dereference(np->opt);
+- err = ip6_xmit(sk, skb, fl6, sk->sk_mark, opt, np->tclass);
++ err = ip6_xmit(sk, skb, fl6, skb->mark ? : sk->sk_mark, opt,
++ np->tclass);
+ rcu_read_unlock();
+ err = net_xmit_eval(err);
+ }
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index c4a76c6af205d..042ab5428a4ff 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1175,7 +1175,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
+
+ ipcm6_init(&ipc6);
+- ipc6.gso_size = up->gso_size;
++ ipc6.gso_size = READ_ONCE(up->gso_size);
+ ipc6.sockc.tsflags = sk->sk_tsflags;
+
+ /* destination address check */
+diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
+index 71d022704923c..b5941c9475f36 100644
+--- a/net/ipv6/xfrm6_output.c
++++ b/net/ipv6/xfrm6_output.c
+@@ -146,7 +146,7 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+ struct dst_entry *dst = skb_dst(skb);
+ struct xfrm_state *x = dst->xfrm;
+- int mtu;
++ unsigned int mtu;
+ bool toobig;
+
+ #ifdef CONFIG_NETFILTER
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 15c9fbcd32f29..2850a638401d5 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -213,6 +213,7 @@ static int ctnetlink_dump_helpinfo(struct sk_buff *skb,
+ if (!help)
+ return 0;
+
++ rcu_read_lock();
+ helper = rcu_dereference(help->helper);
+ if (!helper)
+ goto out;
+@@ -228,9 +229,11 @@ static int ctnetlink_dump_helpinfo(struct sk_buff *skb,
+
+ nla_nest_end(skb, nest_helper);
+ out:
++ rcu_read_unlock();
+ return 0;
+
+ nla_put_failure:
++ rcu_read_unlock();
+ return -1;
+ }
+
+diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
+index 908e53ab47a47..426d496095244 100644
+--- a/net/netrom/nr_timer.c
++++ b/net/netrom/nr_timer.c
+@@ -124,11 +124,9 @@ static void nr_heartbeat_expiry(struct timer_list *t)
+ is accepted() it isn't 'dead' so doesn't get removed. */
+ if (sock_flag(sk, SOCK_DESTROY) ||
+ (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) {
+- sock_hold(sk);
+ bh_unlock_sock(sk);
+ nr_destroy_socket(sk);
+- sock_put(sk);
+- return;
++ goto out;
+ }
+ break;
+
+@@ -149,6 +147,8 @@ static void nr_heartbeat_expiry(struct timer_list *t)
+
+ nr_start_heartbeat(sk);
+ bh_unlock_sock(sk);
++out:
++ sock_put(sk);
+ }
+
+ static void nr_t2timer_expiry(struct timer_list *t)
+@@ -162,6 +162,7 @@ static void nr_t2timer_expiry(struct timer_list *t)
+ nr_enquiry_response(sk);
+ }
+ bh_unlock_sock(sk);
++ sock_put(sk);
+ }
+
+ static void nr_t4timer_expiry(struct timer_list *t)
+@@ -172,6 +173,7 @@ static void nr_t4timer_expiry(struct timer_list *t)
+ bh_lock_sock(sk);
+ nr_sk(sk)->condition &= ~NR_COND_PEER_RX_BUSY;
+ bh_unlock_sock(sk);
++ sock_put(sk);
+ }
+
+ static void nr_idletimer_expiry(struct timer_list *t)
+@@ -200,6 +202,7 @@ static void nr_idletimer_expiry(struct timer_list *t)
+ sock_set_flag(sk, SOCK_DEAD);
+ }
+ bh_unlock_sock(sk);
++ sock_put(sk);
+ }
+
+ static void nr_t1timer_expiry(struct timer_list *t)
+@@ -212,8 +215,7 @@ static void nr_t1timer_expiry(struct timer_list *t)
+ case NR_STATE_1:
+ if (nr->n2count == nr->n2) {
+ nr_disconnect(sk, ETIMEDOUT);
+- bh_unlock_sock(sk);
+- return;
++ goto out;
+ } else {
+ nr->n2count++;
+ nr_write_internal(sk, NR_CONNREQ);
+@@ -223,8 +225,7 @@ static void nr_t1timer_expiry(struct timer_list *t)
+ case NR_STATE_2:
+ if (nr->n2count == nr->n2) {
+ nr_disconnect(sk, ETIMEDOUT);
+- bh_unlock_sock(sk);
+- return;
++ goto out;
+ } else {
+ nr->n2count++;
+ nr_write_internal(sk, NR_DISCREQ);
+@@ -234,8 +235,7 @@ static void nr_t1timer_expiry(struct timer_list *t)
+ case NR_STATE_3:
+ if (nr->n2count == nr->n2) {
+ nr_disconnect(sk, ETIMEDOUT);
+- bh_unlock_sock(sk);
+- return;
++ goto out;
+ } else {
+ nr->n2count++;
+ nr_requeue_frames(sk);
+@@ -244,5 +244,7 @@ static void nr_t1timer_expiry(struct timer_list *t)
+ }
+
+ nr_start_t1timer(sk);
++out:
+ bh_unlock_sock(sk);
++ sock_put(sk);
+ }
+diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
+index 21d1952961217..03a272af664ae 100644
+--- a/net/sched/act_skbmod.c
++++ b/net/sched/act_skbmod.c
+@@ -10,6 +10,7 @@
+ */
+
+ #include <linux/module.h>
++#include <linux/if_arp.h>
+ #include <linux/init.h>
+ #include <linux/kernel.h>
+ #include <linux/skbuff.h>
+@@ -36,6 +37,13 @@ static int tcf_skbmod_act(struct sk_buff *skb, const struct tc_action *a,
+ tcf_lastuse_update(&d->tcf_tm);
+ bstats_cpu_update(this_cpu_ptr(d->common.cpu_bstats), skb);
+
++ action = READ_ONCE(d->tcf_action);
++ if (unlikely(action == TC_ACT_SHOT))
++ goto drop;
++
++ if (!skb->dev || skb->dev->type != ARPHRD_ETHER)
++ return action;
++
+ /* XXX: if you are going to edit more fields beyond ethernet header
+ * (example when you add IP header replacement or vlan swap)
+ * then MAX_EDIT_LEN needs to change appropriately
+@@ -44,10 +52,6 @@ static int tcf_skbmod_act(struct sk_buff *skb, const struct tc_action *a,
+ if (unlikely(err)) /* best policy is to drop on the floor */
+ goto drop;
+
+- action = READ_ONCE(d->tcf_action);
+- if (unlikely(action == TC_ACT_SHOT))
+- goto drop;
+-
+ p = rcu_dereference_bh(d->skbmod_p);
+ flags = p->flags;
+ if (flags & SKBMOD_F_DMAC)
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 184c20b86393b..4413aa8d4e829 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -1918,7 +1918,7 @@ replay:
+ break;
+ case RTM_GETCHAIN:
+ err = tc_chain_notify(chain, skb, n->nlmsg_seq,
+- n->nlmsg_seq, n->nlmsg_type, true);
++ n->nlmsg_flags, n->nlmsg_type, true);
+ if (err < 0)
+ NL_SET_ERR_MSG(extack, "Failed to send chain notify message");
+ break;
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index 2bd8c80bd85fb..b2ca66c4a21d2 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -883,6 +883,8 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,
+ if (replace) {
+ list_del_init(&shkey->key_list);
+ sctp_auth_shkey_release(shkey);
++ if (asoc && asoc->active_key_id == auth_key->sca_keynumber)
++ sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL);
+ }
+ list_add(&cur_key->key_list, sh_keys);
+
+diff --git a/scripts/mkcompile_h b/scripts/mkcompile_h
+index 87f1fc9801d73..662fe19da990b 100755
+--- a/scripts/mkcompile_h
++++ b/scripts/mkcompile_h
+@@ -78,15 +78,23 @@ UTS_TRUNCATE="cut -b -$UTS_LEN"
+ # Only replace the real compile.h if the new one is different,
+ # in order to preserve the timestamp and avoid unnecessary
+ # recompilations.
+-# We don't consider the file changed if only the date/time changed.
++# We don't consider the file changed if only the date/time changed,
++# unless KBUILD_BUILD_TIMESTAMP was explicitly set (e.g. for
++# reproducible builds with that value referring to a commit timestamp).
+ # A kernel config change will increase the generation number, thus
+ # causing compile.h to be updated (including date/time) due to the
+ # changed comment in the
+ # first line.
+
++if [ -z "$KBUILD_BUILD_TIMESTAMP" ]; then
++ IGNORE_PATTERN="UTS_VERSION"
++else
++ IGNORE_PATTERN="NOT_A_PATTERN_TO_BE_MATCHED"
++fi
++
+ if [ -r $TARGET ] && \
+- grep -v 'UTS_VERSION' $TARGET > .tmpver.1 && \
+- grep -v 'UTS_VERSION' .tmpcompile > .tmpver.2 && \
++ grep -v $IGNORE_PATTERN $TARGET > .tmpver.1 && \
++ grep -v $IGNORE_PATTERN .tmpcompile > .tmpver.2 && \
+ cmp -s .tmpver.1 .tmpver.2; then
+ rm -f .tmpcompile
+ else
+diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
+index b3eecde0b6125..c16c8151160c3 100644
+--- a/sound/isa/sb/sb16_csp.c
++++ b/sound/isa/sb/sb16_csp.c
+@@ -828,6 +828,7 @@ static int snd_sb_csp_start(struct snd_sb_csp * p, int sample_width, int channel
+ mixR = snd_sbmixer_read(p->chip, SB_DSP4_PCM_DEV + 1);
+ snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV, mixL & 0x7);
+ snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV + 1, mixR & 0x7);
++ spin_unlock_irqrestore(&p->chip->mixer_lock, flags);
+
+ spin_lock(&p->chip->reg_lock);
+ set_mode_register(p->chip, 0xc0); /* c0 = STOP */
+@@ -867,6 +868,7 @@ static int snd_sb_csp_start(struct snd_sb_csp * p, int sample_width, int channel
+ spin_unlock(&p->chip->reg_lock);
+
+ /* restore PCM volume */
++ spin_lock_irqsave(&p->chip->mixer_lock, flags);
+ snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV, mixL);
+ snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV + 1, mixR);
+ spin_unlock_irqrestore(&p->chip->mixer_lock, flags);
+@@ -892,6 +894,7 @@ static int snd_sb_csp_stop(struct snd_sb_csp * p)
+ mixR = snd_sbmixer_read(p->chip, SB_DSP4_PCM_DEV + 1);
+ snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV, mixL & 0x7);
+ snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV + 1, mixR & 0x7);
++ spin_unlock_irqrestore(&p->chip->mixer_lock, flags);
+
+ spin_lock(&p->chip->reg_lock);
+ if (p->running & SNDRV_SB_CSP_ST_QSOUND) {
+@@ -906,6 +909,7 @@ static int snd_sb_csp_stop(struct snd_sb_csp * p)
+ spin_unlock(&p->chip->reg_lock);
+
+ /* restore PCM volume */
++ spin_lock_irqsave(&p->chip->mixer_lock, flags);
+ snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV, mixL);
+ snd_sbmixer_write(p->chip, SB_DSP4_PCM_DEV + 1, mixR);
+ spin_unlock_irqrestore(&p->chip->mixer_lock, flags);
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index b5f2b18b8b422..87d3ea9796384 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1553,6 +1553,9 @@ static const struct registration_quirk registration_quirks[] = {
+ REG_QUIRK_ENTRY(0x0951, 0x16d8, 2), /* Kingston HyperX AMP */
+ REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */
+ REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
++ REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */
++ REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */
++ REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */
+ { 0 } /* terminator */
+ };
+
+diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
+index 158469f57461d..7faf24ef3c80b 100644
+--- a/tools/bpf/bpftool/common.c
++++ b/tools/bpf/bpftool/common.c
+@@ -182,6 +182,11 @@ int do_pin_fd(int fd, const char *name)
+ goto out;
+
+ file = malloc(strlen(name) + 1);
++ if (!file) {
++ p_err("mem alloc failed");
++ return -1;
++ }
++
+ strcpy(file, name);
+ dir = dirname(file);
+
+diff --git a/tools/bpf/bpftool/jit_disasm.c b/tools/bpf/bpftool/jit_disasm.c
+index 73d7252729fad..e4cfbecf02189 100644
+--- a/tools/bpf/bpftool/jit_disasm.c
++++ b/tools/bpf/bpftool/jit_disasm.c
+@@ -51,11 +51,13 @@ static int fprintf_json(void *out, const char *fmt, ...)
+ {
+ va_list ap;
+ char *s;
++ int err;
+
+ va_start(ap, fmt);
+- if (vasprintf(&s, fmt, ap) < 0)
+- return -1;
++ err = vasprintf(&s, fmt, ap);
+ va_end(ap);
++ if (err < 0)
++ return -1;
+
+ if (!oper_count) {
+ int i;
+diff --git a/tools/perf/tests/bpf.c b/tools/perf/tests/bpf.c
+index 79b54f8ddebf7..df478f67b6b63 100644
+--- a/tools/perf/tests/bpf.c
++++ b/tools/perf/tests/bpf.c
+@@ -1,5 +1,6 @@
+ #include <errno.h>
+ #include <stdio.h>
++#include <stdlib.h>
+ #include <sys/epoll.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+@@ -277,6 +278,7 @@ static int __test__bpf(int idx)
+ }
+
+ out:
++ free(obj_buf);
+ bpf__clear();
+ return ret;
+ }
+diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
+index 56f86317694d2..1231f31810413 100644
+--- a/tools/perf/util/dso.c
++++ b/tools/perf/util/dso.c
+@@ -1025,8 +1025,10 @@ struct map *dso__new_map(const char *name)
+ struct map *map = NULL;
+ struct dso *dso = dso__new(name);
+
+- if (dso)
++ if (dso) {
+ map = map__new2(0, dso);
++ dso__put(dso);
++ }
+
+ return map;
+ }
+diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c
+index b1dd29a9d915e..6c844110fc250 100644
+--- a/tools/perf/util/lzma.c
++++ b/tools/perf/util/lzma.c
+@@ -68,7 +68,7 @@ int lzma_decompress_to_file(const char *input, int output_fd)
+
+ if (ferror(infile)) {
+ pr_err("lzma: read error: %s\n", strerror(errno));
+- goto err_fclose;
++ goto err_lzma_end;
+ }
+
+ if (feof(infile))
+@@ -82,7 +82,7 @@ int lzma_decompress_to_file(const char *input, int output_fd)
+
+ if (writen(output_fd, buf_out, write_size) != write_size) {
+ pr_err("lzma: write error: %s\n", strerror(errno));
+- goto err_fclose;
++ goto err_lzma_end;
+ }
+
+ strm.next_out = buf_out;
+@@ -94,11 +94,13 @@ int lzma_decompress_to_file(const char *input, int output_fd)
+ break;
+
+ pr_err("lzma: failed %s\n", lzma_strerror(ret));
+- goto err_fclose;
++ goto err_lzma_end;
+ }
+ }
+
+ err = 0;
++err_lzma_end:
++ lzma_end(&strm);
+ err_fclose:
+ fclose(infile);
+ return err;
+diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
+index 769d11575a7b3..603086692290f 100644
+--- a/tools/perf/util/map.c
++++ b/tools/perf/util/map.c
+@@ -209,6 +209,8 @@ struct map *map__new(struct machine *machine, u64 start, u64 len,
+ if (!(prot & PROT_EXEC))
+ dso__set_loaded(dso);
+ }
++
++ nsinfo__put(dso->nsinfo);
+ dso->nsinfo = nsi;
+ dso__put(dso);
+ }
+diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
+index 4ac3c89bfac82..633fa5425fd9d 100644
+--- a/tools/perf/util/probe-event.c
++++ b/tools/perf/util/probe-event.c
+@@ -184,8 +184,10 @@ struct map *get_target_map(const char *target, struct nsinfo *nsi, bool user)
+ struct map *map;
+
+ map = dso__new_map(target);
+- if (map && map->dso)
++ if (map && map->dso) {
++ nsinfo__put(map->dso->nsinfo);
+ map->dso->nsinfo = nsinfo__get(nsi);
++ }
+ return map;
+ } else {
+ return kernel_get_module_map(target);
+diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c
+index 6a6548890d5a1..b67ae3b8d9960 100644
+--- a/tools/perf/util/probe-file.c
++++ b/tools/perf/util/probe-file.c
+@@ -342,11 +342,11 @@ int probe_file__del_events(int fd, struct strfilter *filter)
+
+ ret = probe_file__get_events(fd, filter, namelist);
+ if (ret < 0)
+- return ret;
++ goto out;
+
+ ret = probe_file__del_strlist(fd, namelist);
++out:
+ strlist__delete(namelist);
+-
+ return ret;
+ }
+
+diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c
+index 7b8171e3128a8..16d42b2de424e 100644
+--- a/tools/testing/selftests/vm/userfaultfd.c
++++ b/tools/testing/selftests/vm/userfaultfd.c
+@@ -129,8 +129,10 @@ static int anon_release_pages(char *rel_area)
+
+ static void anon_allocate_area(void **alloc_area)
+ {
+- if (posix_memalign(alloc_area, page_size, nr_pages * page_size)) {
+- fprintf(stderr, "out of memory\n");
++ *alloc_area = mmap(NULL, nr_pages * page_size, PROT_READ | PROT_WRITE,
++ MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
++ if (*alloc_area == MAP_FAILED)
++ fprintf(stderr, "mmap of anonymous memory failed");
+ *alloc_area = NULL;
+ }
+ }
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 1ecb27b3421a7..a3d82113ae1ce 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1489,15 +1489,24 @@ static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault)
+ return true;
+ }
+
++static int kvm_try_get_pfn(kvm_pfn_t pfn)
++{
++ if (kvm_is_reserved_pfn(pfn))
++ return 1;
++ return get_page_unless_zero(pfn_to_page(pfn));
++}
++
+ static int hva_to_pfn_remapped(struct vm_area_struct *vma,
+ unsigned long addr, bool *async,
+ bool write_fault, bool *writable,
+ kvm_pfn_t *p_pfn)
+ {
+- unsigned long pfn;
++ kvm_pfn_t pfn;
++ pte_t *ptep;
++ spinlock_t *ptl;
+ int r;
+
+- r = follow_pfn(vma, addr, &pfn);
++ r = follow_pte_pmd(vma->vm_mm, addr, NULL, NULL, &ptep, NULL, &ptl);
+ if (r) {
+ /*
+ * get_user_pages fails for VM_IO and VM_PFNMAP vmas and does
+@@ -1512,14 +1521,19 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma,
+ if (r)
+ return r;
+
+- r = follow_pfn(vma, addr, &pfn);
++ r = follow_pte_pmd(vma->vm_mm, addr, NULL, NULL, &ptep, NULL, &ptl);
+ if (r)
+ return r;
++ }
+
++ if (write_fault && !pte_write(*ptep)) {
++ pfn = KVM_PFN_ERR_RO_FAULT;
++ goto out;
+ }
+
+ if (writable)
+- *writable = true;
++ *writable = pte_write(*ptep);
++ pfn = pte_pfn(*ptep);
+
+ /*
+ * Get a reference here because callers of *hva_to_pfn* and
+@@ -1531,11 +1545,21 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma,
+ * Whoever called remap_pfn_range is also going to call e.g.
+ * unmap_mapping_range before the underlying pages are freed,
+ * causing a call to our MMU notifier.
++ *
++ * Certain IO or PFNMAP mappings can be backed with valid
++ * struct pages, but be allocated without refcounting e.g.,
++ * tail pages of non-compound higher order allocations, which
++ * would then underflow the refcount when the caller does the
++ * required put_page. Don't allow those pages here.
+ */
+- kvm_get_pfn(pfn);
++ if (!kvm_try_get_pfn(pfn))
++ r = -EFAULT;
+
++out:
++ pte_unmap_unlock(ptep, ptl);
+ *p_pfn = pfn;
+- return 0;
++
++ return r;
+ }
+
+ /*
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-07-31 10:34 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-07-31 10:34 UTC (permalink / raw
To: gentoo-commits
commit: af04b07db818faf519780e2e77f637a6419c5ab6
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Sat Jul 31 10:33:59 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Sat Jul 31 10:34:09 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=af04b07d
Linux patch 4.19.200
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1199_linux-4.19.200.patch | 893 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 897 insertions(+)
diff --git a/0000_README b/0000_README
index f1619e0..58e7859 100644
--- a/0000_README
+++ b/0000_README
@@ -835,6 +835,10 @@ Patch: 1198_linux-4.19.199.patch
From: https://www.kernel.org
Desc: Linux 4.19.199
+Patch: 1199_linux-4.19.200.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.200
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1199_linux-4.19.200.patch b/1199_linux-4.19.200.patch
new file mode 100644
index 0000000..da6c8c4
--- /dev/null
+++ b/1199_linux-4.19.200.patch
@@ -0,0 +1,893 @@
+diff --git a/Makefile b/Makefile
+index f3ad63a089a18..a4ea351c4e5d6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 199
++SUBLEVEL = 200
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/versatile-ab.dts b/arch/arm/boot/dts/versatile-ab.dts
+index 6f4f60ba5429c..990b7ef1800e4 100644
+--- a/arch/arm/boot/dts/versatile-ab.dts
++++ b/arch/arm/boot/dts/versatile-ab.dts
+@@ -192,16 +192,15 @@
+ #size-cells = <1>;
+ ranges;
+
+- vic: intc@10140000 {
++ vic: interrupt-controller@10140000 {
+ compatible = "arm,versatile-vic";
+ interrupt-controller;
+ #interrupt-cells = <1>;
+ reg = <0x10140000 0x1000>;
+- clear-mask = <0xffffffff>;
+ valid-mask = <0xffffffff>;
+ };
+
+- sic: intc@10003000 {
++ sic: interrupt-controller@10003000 {
+ compatible = "arm,versatile-sic";
+ interrupt-controller;
+ #interrupt-cells = <1>;
+diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts
+index 06a0fdf24026c..e7e751a858d81 100644
+--- a/arch/arm/boot/dts/versatile-pb.dts
++++ b/arch/arm/boot/dts/versatile-pb.dts
+@@ -7,7 +7,7 @@
+
+ amba {
+ /* The Versatile PB is using more SIC IRQ lines than the AB */
+- sic: intc@10003000 {
++ sic: interrupt-controller@10003000 {
+ clear-mask = <0xffffffff>;
+ /*
+ * Valid interrupt lines mask according to
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 43fb4e296d8de..9cfc669b4a243 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -416,8 +416,6 @@ static void kvm_multiple_exception(struct kvm_vcpu *vcpu,
+
+ if (!vcpu->arch.exception.pending && !vcpu->arch.exception.injected) {
+ queue:
+- if (has_error && !is_protmode(vcpu))
+- has_error = false;
+ if (reinject) {
+ /*
+ * On vmentry, vcpu->arch.exception.pending is only
+@@ -7114,6 +7112,13 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu)
+ kvm_x86_ops->update_cr8_intercept(vcpu, tpr, max_irr);
+ }
+
++static void kvm_inject_exception(struct kvm_vcpu *vcpu)
++{
++ if (vcpu->arch.exception.error_code && !is_protmode(vcpu))
++ vcpu->arch.exception.error_code = false;
++ kvm_x86_ops->queue_exception(vcpu);
++}
++
+ static int inject_pending_event(struct kvm_vcpu *vcpu)
+ {
+ int r;
+@@ -7121,7 +7126,7 @@ static int inject_pending_event(struct kvm_vcpu *vcpu)
+ /* try to reinject previous events if any */
+
+ if (vcpu->arch.exception.injected)
+- kvm_x86_ops->queue_exception(vcpu);
++ kvm_inject_exception(vcpu);
+ /*
+ * Do not inject an NMI or interrupt if there is a pending
+ * exception. Exceptions and interrupts are recognized at
+@@ -7175,7 +7180,7 @@ static int inject_pending_event(struct kvm_vcpu *vcpu)
+ kvm_update_dr7(vcpu);
+ }
+
+- kvm_x86_ops->queue_exception(vcpu);
++ kvm_inject_exception(vcpu);
+ }
+
+ /* Don't consider new event if we re-injected an event */
+diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
+index effc4c17e0fb9..af5139eb96b5d 100644
+--- a/drivers/firmware/arm_scmi/driver.c
++++ b/drivers/firmware/arm_scmi/driver.c
+@@ -48,7 +48,6 @@ enum scmi_error_codes {
+ SCMI_ERR_GENERIC = -8, /* Generic Error */
+ SCMI_ERR_HARDWARE = -9, /* Hardware Error */
+ SCMI_ERR_PROTOCOL = -10,/* Protocol Error */
+- SCMI_ERR_MAX
+ };
+
+ /* List of all SCMI devices active in system */
+@@ -168,8 +167,10 @@ static const int scmi_linux_errmap[] = {
+
+ static inline int scmi_to_linux_errno(int errno)
+ {
+- if (errno < SCMI_SUCCESS && errno > SCMI_ERR_MAX)
+- return scmi_linux_errmap[-errno];
++ int err_idx = -errno;
++
++ if (err_idx >= SCMI_SUCCESS && err_idx < ARRAY_SIZE(scmi_linux_errmap))
++ return scmi_linux_errmap[err_idx];
+ return -EIO;
+ }
+
+@@ -628,8 +629,9 @@ static int scmi_xfer_info_init(struct scmi_info *sinfo)
+ struct scmi_xfers_info *info = &sinfo->minfo;
+
+ /* Pre-allocated messages, no more than what hdr.seq can support */
+- if (WARN_ON(desc->max_msg >= MSG_TOKEN_MAX)) {
+- dev_err(dev, "Maximum message of %d exceeds supported %ld\n",
++ if (WARN_ON(!desc->max_msg || desc->max_msg > MSG_TOKEN_MAX)) {
++ dev_err(dev,
++ "Invalid maximum messages %d, not in range [1 - %lu]\n",
+ desc->max_msg, MSG_TOKEN_MAX);
+ return -EINVAL;
+ }
+diff --git a/drivers/iio/dac/ds4424.c b/drivers/iio/dac/ds4424.c
+index 714a97f913199..ae9be792693bf 100644
+--- a/drivers/iio/dac/ds4424.c
++++ b/drivers/iio/dac/ds4424.c
+@@ -236,12 +236,6 @@ static int ds4424_probe(struct i2c_client *client,
+ indio_dev->dev.of_node = client->dev.of_node;
+ indio_dev->dev.parent = &client->dev;
+
+- if (!client->dev.of_node) {
+- dev_err(&client->dev,
+- "Not found DT.\n");
+- return -ENODEV;
+- }
+-
+ data->vcc_reg = devm_regulator_get(&client->dev, "vcc");
+ if (IS_ERR(data->vcc_reg)) {
+ dev_err(&client->dev,
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 5a14f518cd979..61955a7c838b4 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -386,8 +386,8 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ p = buf;
+ while (bytes_left >= sizeof(*p)) {
+ info->speed = le64_to_cpu(p->LinkSpeed);
+- info->rdma_capable = le32_to_cpu(p->Capability & RDMA_CAPABLE);
+- info->rss_capable = le32_to_cpu(p->Capability & RSS_CAPABLE);
++ info->rdma_capable = le32_to_cpu(p->Capability & RDMA_CAPABLE) ? 1 : 0;
++ info->rss_capable = le32_to_cpu(p->Capability & RSS_CAPABLE) ? 1 : 0;
+
+ cifs_dbg(FYI, "%s: adding iface %zu\n", __func__, *iface_count);
+ cifs_dbg(FYI, "%s: speed %zu bps\n", __func__, info->speed);
+diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c
+index 4af318fbda774..ef9498a6e88ac 100644
+--- a/fs/hfs/bfind.c
++++ b/fs/hfs/bfind.c
+@@ -25,7 +25,19 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd)
+ fd->key = ptr + tree->max_key_len + 2;
+ hfs_dbg(BNODE_REFS, "find_init: %d (%p)\n",
+ tree->cnid, __builtin_return_address(0));
+- mutex_lock(&tree->tree_lock);
++ switch (tree->cnid) {
++ case HFS_CAT_CNID:
++ mutex_lock_nested(&tree->tree_lock, CATALOG_BTREE_MUTEX);
++ break;
++ case HFS_EXT_CNID:
++ mutex_lock_nested(&tree->tree_lock, EXTENTS_BTREE_MUTEX);
++ break;
++ case HFS_ATTR_CNID:
++ mutex_lock_nested(&tree->tree_lock, ATTR_BTREE_MUTEX);
++ break;
++ default:
++ return -EINVAL;
++ }
+ return 0;
+ }
+
+diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
+index b63a4df7327b6..c0a73a6ffb28b 100644
+--- a/fs/hfs/bnode.c
++++ b/fs/hfs/bnode.c
+@@ -15,16 +15,31 @@
+
+ #include "btree.h"
+
+-void hfs_bnode_read(struct hfs_bnode *node, void *buf,
+- int off, int len)
++void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
+ {
+ struct page *page;
++ int pagenum;
++ int bytes_read;
++ int bytes_to_read;
++ void *vaddr;
+
+ off += node->page_offset;
+- page = node->page[0];
++ pagenum = off >> PAGE_SHIFT;
++ off &= ~PAGE_MASK; /* compute page offset for the first page */
+
+- memcpy(buf, kmap(page) + off, len);
+- kunmap(page);
++ for (bytes_read = 0; bytes_read < len; bytes_read += bytes_to_read) {
++ if (pagenum >= node->tree->pages_per_bnode)
++ break;
++ page = node->page[pagenum];
++ bytes_to_read = min_t(int, len - bytes_read, PAGE_SIZE - off);
++
++ vaddr = kmap_atomic(page);
++ memcpy(buf + bytes_read, vaddr + off, bytes_to_read);
++ kunmap_atomic(vaddr);
++
++ pagenum++;
++ off = 0; /* page offset only applies to the first page */
++ }
+ }
+
+ u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
+diff --git a/fs/hfs/btree.h b/fs/hfs/btree.h
+index dcc2aab1b2c43..25ac9a8bb57a7 100644
+--- a/fs/hfs/btree.h
++++ b/fs/hfs/btree.h
+@@ -13,6 +13,13 @@ typedef int (*btree_keycmp)(const btree_key *, const btree_key *);
+
+ #define NODE_HASH_SIZE 256
+
++/* B-tree mutex nested subclasses */
++enum hfs_btree_mutex_classes {
++ CATALOG_BTREE_MUTEX,
++ EXTENTS_BTREE_MUTEX,
++ ATTR_BTREE_MUTEX,
++};
++
+ /* A HFS BTree held in memory */
+ struct hfs_btree {
+ struct super_block *sb;
+diff --git a/fs/hfs/super.c b/fs/hfs/super.c
+index 173876782f73f..77b6f35a4aa93 100644
+--- a/fs/hfs/super.c
++++ b/fs/hfs/super.c
+@@ -427,14 +427,12 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
+ if (!res) {
+ if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
+ res = -EIO;
+- goto bail;
++ goto bail_hfs_find;
+ }
+ hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
+ }
+- if (res) {
+- hfs_find_exit(&fd);
+- goto bail_no_root;
+- }
++ if (res)
++ goto bail_hfs_find;
+ res = -EINVAL;
+ root_inode = hfs_iget(sb, &fd.search_key->cat, &rec);
+ hfs_find_exit(&fd);
+@@ -450,6 +448,8 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
+ /* everything's okay */
+ return 0;
+
++bail_hfs_find:
++ hfs_find_exit(&fd);
+ bail_no_root:
+ pr_err("get root inode failed\n");
+ bail:
+diff --git a/include/net/af_unix.h b/include/net/af_unix.h
+index a5ba41b3b8673..7ec1cdb66be8d 100644
+--- a/include/net/af_unix.h
++++ b/include/net/af_unix.h
+@@ -10,6 +10,7 @@
+
+ void unix_inflight(struct user_struct *user, struct file *fp);
+ void unix_notinflight(struct user_struct *user, struct file *fp);
++void unix_destruct_scm(struct sk_buff *skb);
+ void unix_gc(void);
+ void wait_for_unix_gc(void);
+ struct sock *unix_get_socket(struct file *filp);
+diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
+index cf8f792743ec2..c76a5e9894dac 100644
+--- a/include/net/busy_poll.h
++++ b/include/net/busy_poll.h
+@@ -48,7 +48,7 @@ static inline bool net_busy_loop_on(void)
+
+ static inline bool sk_can_busy_loop(const struct sock *sk)
+ {
+- return sk->sk_ll_usec && !signal_pending(current);
++ return READ_ONCE(sk->sk_ll_usec) && !signal_pending(current);
+ }
+
+ bool sk_busy_loop_end(void *p, unsigned long start_time);
+diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
+index 48d74674d5e95..bc22e44ffcdf7 100644
+--- a/include/net/sctp/constants.h
++++ b/include/net/sctp/constants.h
+@@ -348,8 +348,7 @@ enum {
+ #define SCTP_SCOPE_POLICY_MAX SCTP_SCOPE_POLICY_LINK
+
+ /* Based on IPv4 scoping <draft-stewart-tsvwg-sctp-ipv4-00.txt>,
+- * SCTP IPv4 unusable addresses: 0.0.0.0/8, 224.0.0.0/4, 198.18.0.0/24,
+- * 192.88.99.0/24.
++ * SCTP IPv4 unusable addresses: 0.0.0.0/8, 224.0.0.0/4, 192.88.99.0/24.
+ * Also, RFC 8.4, non-unicast addresses are not considered valid SCTP
+ * addresses.
+ */
+@@ -357,7 +356,6 @@ enum {
+ ((htonl(INADDR_BROADCAST) == a) || \
+ ipv4_is_multicast(a) || \
+ ipv4_is_zeronet(a) || \
+- ipv4_is_test_198(a) || \
+ ipv4_is_anycast_6to4(a))
+
+ /* Flags used for the bind address copy functions. */
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index f278e2f584fd2..1573d1bf63007 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -3498,15 +3498,21 @@ static void pwq_unbound_release_workfn(struct work_struct *work)
+ unbound_release_work);
+ struct workqueue_struct *wq = pwq->wq;
+ struct worker_pool *pool = pwq->pool;
+- bool is_last;
++ bool is_last = false;
+
+- if (WARN_ON_ONCE(!(wq->flags & WQ_UNBOUND)))
+- return;
++ /*
++ * when @pwq is not linked, it doesn't hold any reference to the
++ * @wq, and @wq is invalid to access.
++ */
++ if (!list_empty(&pwq->pwqs_node)) {
++ if (WARN_ON_ONCE(!(wq->flags & WQ_UNBOUND)))
++ return;
+
+- mutex_lock(&wq->mutex);
+- list_del_rcu(&pwq->pwqs_node);
+- is_last = list_empty(&wq->pwqs);
+- mutex_unlock(&wq->mutex);
++ mutex_lock(&wq->mutex);
++ list_del_rcu(&pwq->pwqs_node);
++ is_last = list_empty(&wq->pwqs);
++ mutex_unlock(&wq->mutex);
++ }
+
+ mutex_lock(&wq_pool_mutex);
+ put_unbound_pool(pool);
+diff --git a/net/802/garp.c b/net/802/garp.c
+index 7f50d47470bd4..8e19f51833d6f 100644
+--- a/net/802/garp.c
++++ b/net/802/garp.c
+@@ -206,6 +206,19 @@ static void garp_attr_destroy(struct garp_applicant *app, struct garp_attr *attr
+ kfree(attr);
+ }
+
++static void garp_attr_destroy_all(struct garp_applicant *app)
++{
++ struct rb_node *node, *next;
++ struct garp_attr *attr;
++
++ for (node = rb_first(&app->gid);
++ next = node ? rb_next(node) : NULL, node != NULL;
++ node = next) {
++ attr = rb_entry(node, struct garp_attr, node);
++ garp_attr_destroy(app, attr);
++ }
++}
++
+ static int garp_pdu_init(struct garp_applicant *app)
+ {
+ struct sk_buff *skb;
+@@ -612,6 +625,7 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl
+
+ spin_lock_bh(&app->lock);
+ garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU);
++ garp_attr_destroy_all(app);
+ garp_pdu_queue(app);
+ spin_unlock_bh(&app->lock);
+
+diff --git a/net/802/mrp.c b/net/802/mrp.c
+index a808dd5bbb27a..32f87d458f054 100644
+--- a/net/802/mrp.c
++++ b/net/802/mrp.c
+@@ -295,6 +295,19 @@ static void mrp_attr_destroy(struct mrp_applicant *app, struct mrp_attr *attr)
+ kfree(attr);
+ }
+
++static void mrp_attr_destroy_all(struct mrp_applicant *app)
++{
++ struct rb_node *node, *next;
++ struct mrp_attr *attr;
++
++ for (node = rb_first(&app->mad);
++ next = node ? rb_next(node) : NULL, node != NULL;
++ node = next) {
++ attr = rb_entry(node, struct mrp_attr, node);
++ mrp_attr_destroy(app, attr);
++ }
++}
++
+ static int mrp_pdu_init(struct mrp_applicant *app)
+ {
+ struct sk_buff *skb;
+@@ -898,6 +911,7 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
+
+ spin_lock_bh(&app->lock);
+ mrp_mad_event(app, MRP_EVENT_TX);
++ mrp_attr_destroy_all(app);
+ mrp_pdu_queue(app);
+ spin_unlock_bh(&app->lock);
+
+diff --git a/net/Makefile b/net/Makefile
+index bdaf53925acd5..449fc0b221f83 100644
+--- a/net/Makefile
++++ b/net/Makefile
+@@ -18,7 +18,7 @@ obj-$(CONFIG_NETFILTER) += netfilter/
+ obj-$(CONFIG_INET) += ipv4/
+ obj-$(CONFIG_TLS) += tls/
+ obj-$(CONFIG_XFRM) += xfrm/
+-obj-$(CONFIG_UNIX) += unix/
++obj-$(CONFIG_UNIX_SCM) += unix/
+ obj-$(CONFIG_NET) += ipv6/
+ obj-$(CONFIG_BPFILTER) += bpfilter/
+ obj-$(CONFIG_PACKET) += packet/
+diff --git a/net/core/sock.c b/net/core/sock.c
+index e6cbe137cb6fc..956af38aa0d6e 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -989,7 +989,7 @@ set_rcvbuf:
+ if (val < 0)
+ ret = -EINVAL;
+ else
+- sk->sk_ll_usec = val;
++ WRITE_ONCE(sk->sk_ll_usec, val);
+ }
+ break;
+ #endif
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index dd51256582556..7207a9769f1a9 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -412,7 +412,8 @@ static enum sctp_scope sctp_v4_scope(union sctp_addr *addr)
+ retval = SCTP_SCOPE_LINK;
+ } else if (ipv4_is_private_10(addr->v4.sin_addr.s_addr) ||
+ ipv4_is_private_172(addr->v4.sin_addr.s_addr) ||
+- ipv4_is_private_192(addr->v4.sin_addr.s_addr)) {
++ ipv4_is_private_192(addr->v4.sin_addr.s_addr) ||
++ ipv4_is_test_198(addr->v4.sin_addr.s_addr)) {
+ retval = SCTP_SCOPE_PRIVATE;
+ } else {
+ retval = SCTP_SCOPE_GLOBAL;
+diff --git a/net/unix/Kconfig b/net/unix/Kconfig
+index 8b31ab85d050f..3b9e450656a4d 100644
+--- a/net/unix/Kconfig
++++ b/net/unix/Kconfig
+@@ -19,6 +19,11 @@ config UNIX
+
+ Say Y unless you know what you are doing.
+
++config UNIX_SCM
++ bool
++ depends on UNIX
++ default y
++
+ config UNIX_DIAG
+ tristate "UNIX: socket monitoring interface"
+ depends on UNIX
+diff --git a/net/unix/Makefile b/net/unix/Makefile
+index ffd0a275c3a79..54e58cc4f9450 100644
+--- a/net/unix/Makefile
++++ b/net/unix/Makefile
+@@ -10,3 +10,5 @@ unix-$(CONFIG_SYSCTL) += sysctl_net_unix.o
+
+ obj-$(CONFIG_UNIX_DIAG) += unix_diag.o
+ unix_diag-y := diag.o
++
++obj-$(CONFIG_UNIX_SCM) += scm.o
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 53fe5ada5a83a..98c253afa0db2 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -119,6 +119,8 @@
+ #include <linux/freezer.h>
+ #include <linux/file.h>
+
++#include "scm.h"
++
+ struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
+ EXPORT_SYMBOL_GPL(unix_socket_table);
+ DEFINE_SPINLOCK(unix_table_lock);
+@@ -1515,65 +1517,51 @@ out:
+ return err;
+ }
+
+-static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+-{
+- int i;
+-
+- scm->fp = UNIXCB(skb).fp;
+- UNIXCB(skb).fp = NULL;
+-
+- for (i = scm->fp->count-1; i >= 0; i--)
+- unix_notinflight(scm->fp->user, scm->fp->fp[i]);
+-}
+-
+-static void unix_destruct_scm(struct sk_buff *skb)
+-{
+- struct scm_cookie scm;
+- memset(&scm, 0, sizeof(scm));
+- scm.pid = UNIXCB(skb).pid;
+- if (UNIXCB(skb).fp)
+- unix_detach_fds(&scm, skb);
+-
+- /* Alas, it calls VFS */
+- /* So fscking what? fput() had been SMP-safe since the last Summer */
+- scm_destroy(&scm);
+- sock_wfree(skb);
+-}
+-
+-/*
+- * The "user->unix_inflight" variable is protected by the garbage
+- * collection lock, and we just read it locklessly here. If you go
+- * over the limit, there might be a tiny race in actually noticing
+- * it across threads. Tough.
+- */
+-static inline bool too_many_unix_fds(struct task_struct *p)
+-{
+- struct user_struct *user = current_user();
+-
+- if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
+- return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
+- return false;
+-}
+-
+-static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
++static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb)
+ {
+- int i;
+-
+- if (too_many_unix_fds(current))
+- return -ETOOMANYREFS;
++ scm->fp = scm_fp_dup(UNIXCB(skb).fp);
+
+ /*
+- * Need to duplicate file references for the sake of garbage
+- * collection. Otherwise a socket in the fps might become a
+- * candidate for GC while the skb is not yet queued.
++ * Garbage collection of unix sockets starts by selecting a set of
++ * candidate sockets which have reference only from being in flight
++ * (total_refs == inflight_refs). This condition is checked once during
++ * the candidate collection phase, and candidates are marked as such, so
++ * that non-candidates can later be ignored. While inflight_refs is
++ * protected by unix_gc_lock, total_refs (file count) is not, hence this
++ * is an instantaneous decision.
++ *
++ * Once a candidate, however, the socket must not be reinstalled into a
++ * file descriptor while the garbage collection is in progress.
++ *
++ * If the above conditions are met, then the directed graph of
++ * candidates (*) does not change while unix_gc_lock is held.
++ *
++ * Any operations that changes the file count through file descriptors
++ * (dup, close, sendmsg) does not change the graph since candidates are
++ * not installed in fds.
++ *
++ * Dequeing a candidate via recvmsg would install it into an fd, but
++ * that takes unix_gc_lock to decrement the inflight count, so it's
++ * serialized with garbage collection.
++ *
++ * MSG_PEEK is special in that it does not change the inflight count,
++ * yet does install the socket into an fd. The following lock/unlock
++ * pair is to ensure serialization with garbage collection. It must be
++ * done between incrementing the file count and installing the file into
++ * an fd.
++ *
++ * If garbage collection starts after the barrier provided by the
++ * lock/unlock, then it will see the elevated refcount and not mark this
++ * as a candidate. If a garbage collection is already in progress
++ * before the file count was incremented, then the lock/unlock pair will
++ * ensure that garbage collection is finished before progressing to
++ * installing the fd.
++ *
++ * (*) A -> B where B is on the queue of A or B is on the queue of C
++ * which is on the queue of listening socket A.
+ */
+- UNIXCB(skb).fp = scm_fp_dup(scm->fp);
+- if (!UNIXCB(skb).fp)
+- return -ENOMEM;
+-
+- for (i = scm->fp->count - 1; i >= 0; i--)
+- unix_inflight(scm->fp->user, scm->fp->fp[i]);
+- return 0;
++ spin_lock(&unix_gc_lock);
++ spin_unlock(&unix_gc_lock);
+ }
+
+ static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
+@@ -2201,7 +2189,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
+ sk_peek_offset_fwd(sk, size);
+
+ if (UNIXCB(skb).fp)
+- scm.fp = scm_fp_dup(UNIXCB(skb).fp);
++ unix_peek_fds(&scm, skb);
+ }
+ err = (flags & MSG_TRUNC) ? skb->len - skip : size;
+
+@@ -2442,7 +2430,7 @@ unlock:
+ /* It is questionable, see note in unix_dgram_recvmsg.
+ */
+ if (UNIXCB(skb).fp)
+- scm.fp = scm_fp_dup(UNIXCB(skb).fp);
++ unix_peek_fds(&scm, skb);
+
+ sk_peek_offset_fwd(sk, chunk);
+
+diff --git a/net/unix/garbage.c b/net/unix/garbage.c
+index c36757e728442..8bbe1b8e4ff7f 100644
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -86,77 +86,13 @@
+ #include <net/scm.h>
+ #include <net/tcp_states.h>
+
++#include "scm.h"
++
+ /* Internal data structures and random procedures: */
+
+-static LIST_HEAD(gc_inflight_list);
+ static LIST_HEAD(gc_candidates);
+-static DEFINE_SPINLOCK(unix_gc_lock);
+ static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
+
+-unsigned int unix_tot_inflight;
+-
+-struct sock *unix_get_socket(struct file *filp)
+-{
+- struct sock *u_sock = NULL;
+- struct inode *inode = file_inode(filp);
+-
+- /* Socket ? */
+- if (S_ISSOCK(inode->i_mode) && !(filp->f_mode & FMODE_PATH)) {
+- struct socket *sock = SOCKET_I(inode);
+- struct sock *s = sock->sk;
+-
+- /* PF_UNIX ? */
+- if (s && sock->ops && sock->ops->family == PF_UNIX)
+- u_sock = s;
+- }
+- return u_sock;
+-}
+-
+-/* Keep the number of times in flight count for the file
+- * descriptor if it is for an AF_UNIX socket.
+- */
+-
+-void unix_inflight(struct user_struct *user, struct file *fp)
+-{
+- struct sock *s = unix_get_socket(fp);
+-
+- spin_lock(&unix_gc_lock);
+-
+- if (s) {
+- struct unix_sock *u = unix_sk(s);
+-
+- if (atomic_long_inc_return(&u->inflight) == 1) {
+- BUG_ON(!list_empty(&u->link));
+- list_add_tail(&u->link, &gc_inflight_list);
+- } else {
+- BUG_ON(list_empty(&u->link));
+- }
+- unix_tot_inflight++;
+- }
+- user->unix_inflight++;
+- spin_unlock(&unix_gc_lock);
+-}
+-
+-void unix_notinflight(struct user_struct *user, struct file *fp)
+-{
+- struct sock *s = unix_get_socket(fp);
+-
+- spin_lock(&unix_gc_lock);
+-
+- if (s) {
+- struct unix_sock *u = unix_sk(s);
+-
+- BUG_ON(!atomic_long_read(&u->inflight));
+- BUG_ON(list_empty(&u->link));
+-
+- if (atomic_long_dec_and_test(&u->inflight))
+- list_del_init(&u->link);
+- unix_tot_inflight--;
+- }
+- user->unix_inflight--;
+- spin_unlock(&unix_gc_lock);
+-}
+-
+ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
+ struct sk_buff_head *hitlist)
+ {
+diff --git a/net/unix/scm.c b/net/unix/scm.c
+new file mode 100644
+index 0000000000000..83413ade79838
+--- /dev/null
++++ b/net/unix/scm.c
+@@ -0,0 +1,148 @@
++// SPDX-License-Identifier: GPL-2.0
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <linux/socket.h>
++#include <linux/net.h>
++#include <linux/fs.h>
++#include <net/af_unix.h>
++#include <net/scm.h>
++#include <linux/init.h>
++
++#include "scm.h"
++
++unsigned int unix_tot_inflight;
++EXPORT_SYMBOL(unix_tot_inflight);
++
++LIST_HEAD(gc_inflight_list);
++EXPORT_SYMBOL(gc_inflight_list);
++
++DEFINE_SPINLOCK(unix_gc_lock);
++EXPORT_SYMBOL(unix_gc_lock);
++
++struct sock *unix_get_socket(struct file *filp)
++{
++ struct sock *u_sock = NULL;
++ struct inode *inode = file_inode(filp);
++
++ /* Socket ? */
++ if (S_ISSOCK(inode->i_mode) && !(filp->f_mode & FMODE_PATH)) {
++ struct socket *sock = SOCKET_I(inode);
++ struct sock *s = sock->sk;
++
++ /* PF_UNIX ? */
++ if (s && sock->ops && sock->ops->family == PF_UNIX)
++ u_sock = s;
++ }
++ return u_sock;
++}
++EXPORT_SYMBOL(unix_get_socket);
++
++/* Keep the number of times in flight count for the file
++ * descriptor if it is for an AF_UNIX socket.
++ */
++void unix_inflight(struct user_struct *user, struct file *fp)
++{
++ struct sock *s = unix_get_socket(fp);
++
++ spin_lock(&unix_gc_lock);
++
++ if (s) {
++ struct unix_sock *u = unix_sk(s);
++
++ if (atomic_long_inc_return(&u->inflight) == 1) {
++ BUG_ON(!list_empty(&u->link));
++ list_add_tail(&u->link, &gc_inflight_list);
++ } else {
++ BUG_ON(list_empty(&u->link));
++ }
++ unix_tot_inflight++;
++ }
++ user->unix_inflight++;
++ spin_unlock(&unix_gc_lock);
++}
++
++void unix_notinflight(struct user_struct *user, struct file *fp)
++{
++ struct sock *s = unix_get_socket(fp);
++
++ spin_lock(&unix_gc_lock);
++
++ if (s) {
++ struct unix_sock *u = unix_sk(s);
++
++ BUG_ON(!atomic_long_read(&u->inflight));
++ BUG_ON(list_empty(&u->link));
++
++ if (atomic_long_dec_and_test(&u->inflight))
++ list_del_init(&u->link);
++ unix_tot_inflight--;
++ }
++ user->unix_inflight--;
++ spin_unlock(&unix_gc_lock);
++}
++
++/*
++ * The "user->unix_inflight" variable is protected by the garbage
++ * collection lock, and we just read it locklessly here. If you go
++ * over the limit, there might be a tiny race in actually noticing
++ * it across threads. Tough.
++ */
++static inline bool too_many_unix_fds(struct task_struct *p)
++{
++ struct user_struct *user = current_user();
++
++ if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
++ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
++ return false;
++}
++
++int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
++{
++ int i;
++
++ if (too_many_unix_fds(current))
++ return -ETOOMANYREFS;
++
++ /*
++ * Need to duplicate file references for the sake of garbage
++ * collection. Otherwise a socket in the fps might become a
++ * candidate for GC while the skb is not yet queued.
++ */
++ UNIXCB(skb).fp = scm_fp_dup(scm->fp);
++ if (!UNIXCB(skb).fp)
++ return -ENOMEM;
++
++ for (i = scm->fp->count - 1; i >= 0; i--)
++ unix_inflight(scm->fp->user, scm->fp->fp[i]);
++ return 0;
++}
++EXPORT_SYMBOL(unix_attach_fds);
++
++void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
++{
++ int i;
++
++ scm->fp = UNIXCB(skb).fp;
++ UNIXCB(skb).fp = NULL;
++
++ for (i = scm->fp->count-1; i >= 0; i--)
++ unix_notinflight(scm->fp->user, scm->fp->fp[i]);
++}
++EXPORT_SYMBOL(unix_detach_fds);
++
++void unix_destruct_scm(struct sk_buff *skb)
++{
++ struct scm_cookie scm;
++
++ memset(&scm, 0, sizeof(scm));
++ scm.pid = UNIXCB(skb).pid;
++ if (UNIXCB(skb).fp)
++ unix_detach_fds(&scm, skb);
++
++ /* Alas, it calls VFS */
++ /* So fscking what? fput() had been SMP-safe since the last Summer */
++ scm_destroy(&scm);
++ sock_wfree(skb);
++}
++EXPORT_SYMBOL(unix_destruct_scm);
+diff --git a/net/unix/scm.h b/net/unix/scm.h
+new file mode 100644
+index 0000000000000..5a255a477f160
+--- /dev/null
++++ b/net/unix/scm.h
+@@ -0,0 +1,10 @@
++#ifndef NET_UNIX_SCM_H
++#define NET_UNIX_SCM_H
++
++extern struct list_head gc_inflight_list;
++extern spinlock_t unix_gc_lock;
++
++int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb);
++void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb);
++
++#endif
+diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c
+index 16d42b2de424e..1963440f67251 100644
+--- a/tools/testing/selftests/vm/userfaultfd.c
++++ b/tools/testing/selftests/vm/userfaultfd.c
+@@ -131,7 +131,7 @@ static void anon_allocate_area(void **alloc_area)
+ {
+ *alloc_area = mmap(NULL, nr_pages * page_size, PROT_READ | PROT_WRITE,
+ MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+- if (*alloc_area == MAP_FAILED)
++ if (*alloc_area == MAP_FAILED) {
+ fprintf(stderr, "mmap of anonymous memory failed");
+ *alloc_area = NULL;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-08-03 12:26 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-08-03 12:26 UTC (permalink / raw
To: gentoo-commits
commit: c2e46fa8be75164d6c285a29736bb9e1d41ae9e9
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 3 12:25:58 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Aug 3 12:25:58 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c2e46fa8
Select SECCOMP options only if supported
Thanks to Matt Turner
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
4567_distro-Gentoo-Kconfig.patch | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index fe71b18..14e46e6 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -138,8 +138,8 @@
+ select NET
+ select NET_NS
+ select PROC_FS
-+ select SECCOMP
-+ select SECCOMP_FILTER
++ select SECCOMP if HAVE_ARCH_SECCOMP
++ select SECCOMP_FILTER if HAVE_ARCH_SECCOMP_FILTER
+ select SIGNALFD
+ select SYSFS
+ select TIMERFD
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-08-04 11:54 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-08-04 11:54 UTC (permalink / raw
To: gentoo-commits
commit: 02478e659ecbaf6339db6ff662f5257e943b9651
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 4 11:53:58 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Aug 4 11:53:58 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=02478e65
Linux patch 4.19.201
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1200_linux-4.19.201.patch | 1133 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1137 insertions(+)
diff --git a/0000_README b/0000_README
index 58e7859..76502c8 100644
--- a/0000_README
+++ b/0000_README
@@ -839,6 +839,10 @@ Patch: 1199_linux-4.19.200.patch
From: https://www.kernel.org
Desc: Linux 4.19.200
+Patch: 1200_linux-4.19.201.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.201
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1200_linux-4.19.201.patch b/1200_linux-4.19.201.patch
new file mode 100644
index 0000000..67d1b0a
--- /dev/null
+++ b/1200_linux-4.19.201.patch
@@ -0,0 +1,1133 @@
+diff --git a/Makefile b/Makefile
+index a4ea351c4e5d6..80954901733dd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 200
++SUBLEVEL = 201
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index 2e0d38cafdd44..885d910bfd9db 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -76,7 +76,7 @@
+ #include "../../../../drivers/pci/pci.h"
+
+ DEFINE_STATIC_KEY_FALSE(shared_processor);
+-EXPORT_SYMBOL_GPL(shared_processor);
++EXPORT_SYMBOL(shared_processor);
+
+ int CMO_PrPSP = -1;
+ int CMO_SecPSP = -1;
+diff --git a/arch/x86/include/asm/proto.h b/arch/x86/include/asm/proto.h
+index 6e81788a30c12..0eaca7a130c9f 100644
+--- a/arch/x86/include/asm/proto.h
++++ b/arch/x86/include/asm/proto.h
+@@ -4,6 +4,8 @@
+
+ #include <asm/ldt.h>
+
++struct task_struct;
++
+ /* misc architecture specific prototypes */
+
+ void syscall_init(void);
+diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
+index bac2ec9b4443b..9944b9c7ceeee 100644
+--- a/arch/x86/kvm/ioapic.c
++++ b/arch/x86/kvm/ioapic.c
+@@ -96,7 +96,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
+ static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic)
+ {
+ ioapic->rtc_status.pending_eoi = 0;
+- bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID);
++ bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID + 1);
+ }
+
+ static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);
+diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h
+index ea1a4e0297dae..283f1f489bcac 100644
+--- a/arch/x86/kvm/ioapic.h
++++ b/arch/x86/kvm/ioapic.h
+@@ -43,13 +43,13 @@ struct kvm_vcpu;
+
+ struct dest_map {
+ /* vcpu bitmap where IRQ has been sent */
+- DECLARE_BITMAP(map, KVM_MAX_VCPU_ID);
++ DECLARE_BITMAP(map, KVM_MAX_VCPU_ID + 1);
+
+ /*
+ * Vector sent to a given vcpu, only valid when
+ * the vcpu's bit in map is set
+ */
+- u8 vectors[KVM_MAX_VCPU_ID];
++ u8 vectors[KVM_MAX_VCPU_ID + 1];
+ };
+
+
+diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
+index ddaf46239e39e..472175e37055e 100644
+--- a/drivers/net/can/spi/hi311x.c
++++ b/drivers/net/can/spi/hi311x.c
+@@ -236,7 +236,7 @@ static int hi3110_spi_trans(struct spi_device *spi, int len)
+ return ret;
+ }
+
+-static u8 hi3110_cmd(struct spi_device *spi, u8 command)
++static int hi3110_cmd(struct spi_device *spi, u8 command)
+ {
+ struct hi3110_priv *priv = spi_get_drvdata(spi);
+
+diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
+index 16b96f978aae7..3957b746107f1 100644
+--- a/drivers/net/can/usb/ems_usb.c
++++ b/drivers/net/can/usb/ems_usb.c
+@@ -267,6 +267,8 @@ struct ems_usb {
+ unsigned int free_slots; /* remember number of available slots */
+
+ struct ems_cpc_msg active_params; /* active controller parameters */
++ void *rxbuf[MAX_RX_URBS];
++ dma_addr_t rxbuf_dma[MAX_RX_URBS];
+ };
+
+ static void ems_usb_read_interrupt_callback(struct urb *urb)
+@@ -599,6 +601,7 @@ static int ems_usb_start(struct ems_usb *dev)
+ for (i = 0; i < MAX_RX_URBS; i++) {
+ struct urb *urb = NULL;
+ u8 *buf = NULL;
++ dma_addr_t buf_dma;
+
+ /* create a URB, and a buffer for it */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+@@ -608,7 +611,7 @@ static int ems_usb_start(struct ems_usb *dev)
+ }
+
+ buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL,
+- &urb->transfer_dma);
++ &buf_dma);
+ if (!buf) {
+ netdev_err(netdev, "No memory left for USB buffer\n");
+ usb_free_urb(urb);
+@@ -616,6 +619,8 @@ static int ems_usb_start(struct ems_usb *dev)
+ break;
+ }
+
++ urb->transfer_dma = buf_dma;
++
+ usb_fill_bulk_urb(urb, dev->udev, usb_rcvbulkpipe(dev->udev, 2),
+ buf, RX_BUFFER_SIZE,
+ ems_usb_read_bulk_callback, dev);
+@@ -631,6 +636,9 @@ static int ems_usb_start(struct ems_usb *dev)
+ break;
+ }
+
++ dev->rxbuf[i] = buf;
++ dev->rxbuf_dma[i] = buf_dma;
++
+ /* Drop reference, USB core will take care of freeing it */
+ usb_free_urb(urb);
+ }
+@@ -696,6 +704,10 @@ static void unlink_all_urbs(struct ems_usb *dev)
+
+ usb_kill_anchored_urbs(&dev->rx_submitted);
+
++ for (i = 0; i < MAX_RX_URBS; ++i)
++ usb_free_coherent(dev->udev, RX_BUFFER_SIZE,
++ dev->rxbuf[i], dev->rxbuf_dma[i]);
++
+ usb_kill_anchored_urbs(&dev->tx_submitted);
+ atomic_set(&dev->active_tx_urbs, 0);
+
+diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
+index 5820fd5b69b5b..e95358269525d 100644
+--- a/drivers/net/can/usb/esd_usb2.c
++++ b/drivers/net/can/usb/esd_usb2.c
+@@ -207,6 +207,8 @@ struct esd_usb2 {
+ int net_count;
+ u32 version;
+ int rxinitdone;
++ void *rxbuf[MAX_RX_URBS];
++ dma_addr_t rxbuf_dma[MAX_RX_URBS];
+ };
+
+ struct esd_usb2_net_priv {
+@@ -556,6 +558,7 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev)
+ for (i = 0; i < MAX_RX_URBS; i++) {
+ struct urb *urb = NULL;
+ u8 *buf = NULL;
++ dma_addr_t buf_dma;
+
+ /* create a URB, and a buffer for it */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+@@ -565,7 +568,7 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev)
+ }
+
+ buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL,
+- &urb->transfer_dma);
++ &buf_dma);
+ if (!buf) {
+ dev_warn(dev->udev->dev.parent,
+ "No memory left for USB buffer\n");
+@@ -573,6 +576,8 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev)
+ goto freeurb;
+ }
+
++ urb->transfer_dma = buf_dma;
++
+ usb_fill_bulk_urb(urb, dev->udev,
+ usb_rcvbulkpipe(dev->udev, 1),
+ buf, RX_BUFFER_SIZE,
+@@ -585,8 +590,12 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev)
+ usb_unanchor_urb(urb);
+ usb_free_coherent(dev->udev, RX_BUFFER_SIZE, buf,
+ urb->transfer_dma);
++ goto freeurb;
+ }
+
++ dev->rxbuf[i] = buf;
++ dev->rxbuf_dma[i] = buf_dma;
++
+ freeurb:
+ /* Drop reference, USB core will take care of freeing it */
+ usb_free_urb(urb);
+@@ -674,6 +683,11 @@ static void unlink_all_urbs(struct esd_usb2 *dev)
+ int i, j;
+
+ usb_kill_anchored_urbs(&dev->rx_submitted);
++
++ for (i = 0; i < MAX_RX_URBS; ++i)
++ usb_free_coherent(dev->udev, RX_BUFFER_SIZE,
++ dev->rxbuf[i], dev->rxbuf_dma[i]);
++
+ for (i = 0; i < dev->net_count; i++) {
+ priv = dev->nets[i];
+ if (priv) {
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
+index 3215ba69a9e75..097d4a673b059 100644
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -664,6 +664,8 @@ static int mcba_usb_start(struct mcba_priv *priv)
+ break;
+ }
+
++ urb->transfer_dma = buf_dma;
++
+ usb_fill_bulk_urb(urb, priv->udev,
+ usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN),
+ buf, MCBA_USB_RX_BUFF_SIZE,
+diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
+index 3e44164736079..df99354ec12aa 100644
+--- a/drivers/net/can/usb/usb_8dev.c
++++ b/drivers/net/can/usb/usb_8dev.c
+@@ -148,7 +148,8 @@ struct usb_8dev_priv {
+ u8 *cmd_msg_buffer;
+
+ struct mutex usb_8dev_cmd_lock;
+-
++ void *rxbuf[MAX_RX_URBS];
++ dma_addr_t rxbuf_dma[MAX_RX_URBS];
+ };
+
+ /* tx frame */
+@@ -744,6 +745,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
+ for (i = 0; i < MAX_RX_URBS; i++) {
+ struct urb *urb = NULL;
+ u8 *buf;
++ dma_addr_t buf_dma;
+
+ /* create a URB, and a buffer for it */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+@@ -753,7 +755,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
+ }
+
+ buf = usb_alloc_coherent(priv->udev, RX_BUFFER_SIZE, GFP_KERNEL,
+- &urb->transfer_dma);
++ &buf_dma);
+ if (!buf) {
+ netdev_err(netdev, "No memory left for USB buffer\n");
+ usb_free_urb(urb);
+@@ -761,6 +763,8 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
+ break;
+ }
+
++ urb->transfer_dma = buf_dma;
++
+ usb_fill_bulk_urb(urb, priv->udev,
+ usb_rcvbulkpipe(priv->udev,
+ USB_8DEV_ENDP_DATA_RX),
+@@ -778,6 +782,9 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
+ break;
+ }
+
++ priv->rxbuf[i] = buf;
++ priv->rxbuf_dma[i] = buf_dma;
++
+ /* Drop reference, USB core will take care of freeing it */
+ usb_free_urb(urb);
+ }
+@@ -847,6 +854,10 @@ static void unlink_all_urbs(struct usb_8dev_priv *priv)
+
+ usb_kill_anchored_urbs(&priv->rx_submitted);
+
++ for (i = 0; i < MAX_RX_URBS; ++i)
++ usb_free_coherent(priv->udev, RX_BUFFER_SIZE,
++ priv->rxbuf[i], priv->rxbuf_dma[i]);
++
+ usb_kill_anchored_urbs(&priv->tx_submitted);
+ atomic_set(&priv->active_tx_urbs, 0);
+
+diff --git a/drivers/net/ethernet/dec/tulip/winbond-840.c b/drivers/net/ethernet/dec/tulip/winbond-840.c
+index 70cb2d689c2cb..79bdd2a79dbd3 100644
+--- a/drivers/net/ethernet/dec/tulip/winbond-840.c
++++ b/drivers/net/ethernet/dec/tulip/winbond-840.c
+@@ -367,7 +367,7 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+ int i, option = find_cnt < MAX_UNITS ? options[find_cnt] : 0;
+ void __iomem *ioaddr;
+
+- i = pci_enable_device(pdev);
++ i = pcim_enable_device(pdev);
+ if (i) return i;
+
+ pci_set_master(pdev);
+@@ -389,7 +389,7 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ ioaddr = pci_iomap(pdev, TULIP_BAR, netdev_res_size);
+ if (!ioaddr)
+- goto err_out_free_res;
++ goto err_out_netdev;
+
+ for (i = 0; i < 3; i++)
+ ((__le16 *)dev->dev_addr)[i] = cpu_to_le16(eeprom_read(ioaddr, i));
+@@ -468,8 +468,6 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ err_out_cleardev:
+ pci_iounmap(pdev, ioaddr);
+-err_out_free_res:
+- pci_release_regions(pdev);
+ err_out_netdev:
+ free_netdev (dev);
+ return -ENODEV;
+@@ -1535,7 +1533,6 @@ static void w840_remove1(struct pci_dev *pdev)
+ if (dev) {
+ struct netdev_private *np = netdev_priv(dev);
+ unregister_netdev(dev);
+- pci_release_regions(pdev);
+ pci_iounmap(pdev, np->base_addr);
+ free_netdev(dev);
+ }
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 4c7c1998f358d..5242d3dfeb22d 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -674,7 +674,7 @@ static void i40e_get_settings_link_up(struct i40e_hw *hw,
+ default:
+ /* if we got here and link is up something bad is afoot */
+ netdev_info(netdev,
+- "WARNING: Link is up but PHY type 0x%x is not recognized.\n",
++ "WARNING: Link is up but PHY type 0x%x is not recognized, or incorrect cable is in use\n",
+ hw_link_info->phy_type);
+ }
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 1b101b526ed35..246734be51775 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -4310,11 +4310,10 @@ int i40e_control_wait_tx_q(int seid, struct i40e_pf *pf, int pf_q,
+ }
+
+ /**
+- * i40e_vsi_control_tx - Start or stop a VSI's rings
++ * i40e_vsi_enable_tx - Start a VSI's rings
+ * @vsi: the VSI being configured
+- * @enable: start or stop the rings
+ **/
+-static int i40e_vsi_control_tx(struct i40e_vsi *vsi, bool enable)
++static int i40e_vsi_enable_tx(struct i40e_vsi *vsi)
+ {
+ struct i40e_pf *pf = vsi->back;
+ int i, pf_q, ret = 0;
+@@ -4323,7 +4322,7 @@ static int i40e_vsi_control_tx(struct i40e_vsi *vsi, bool enable)
+ for (i = 0; i < vsi->num_queue_pairs; i++, pf_q++) {
+ ret = i40e_control_wait_tx_q(vsi->seid, pf,
+ pf_q,
+- false /*is xdp*/, enable);
++ false /*is xdp*/, true);
+ if (ret)
+ break;
+
+@@ -4332,7 +4331,7 @@ static int i40e_vsi_control_tx(struct i40e_vsi *vsi, bool enable)
+
+ ret = i40e_control_wait_tx_q(vsi->seid, pf,
+ pf_q + vsi->alloc_queue_pairs,
+- true /*is xdp*/, enable);
++ true /*is xdp*/, true);
+ if (ret)
+ break;
+ }
+@@ -4430,32 +4429,25 @@ int i40e_control_wait_rx_q(struct i40e_pf *pf, int pf_q, bool enable)
+ }
+
+ /**
+- * i40e_vsi_control_rx - Start or stop a VSI's rings
++ * i40e_vsi_enable_rx - Start a VSI's rings
+ * @vsi: the VSI being configured
+- * @enable: start or stop the rings
+ **/
+-static int i40e_vsi_control_rx(struct i40e_vsi *vsi, bool enable)
++static int i40e_vsi_enable_rx(struct i40e_vsi *vsi)
+ {
+ struct i40e_pf *pf = vsi->back;
+ int i, pf_q, ret = 0;
+
+ pf_q = vsi->base_queue;
+ for (i = 0; i < vsi->num_queue_pairs; i++, pf_q++) {
+- ret = i40e_control_wait_rx_q(pf, pf_q, enable);
++ ret = i40e_control_wait_rx_q(pf, pf_q, true);
+ if (ret) {
+ dev_info(&pf->pdev->dev,
+- "VSI seid %d Rx ring %d %sable timeout\n",
+- vsi->seid, pf_q, (enable ? "en" : "dis"));
++ "VSI seid %d Rx ring %d enable timeout\n",
++ vsi->seid, pf_q);
+ break;
+ }
+ }
+
+- /* Due to HW errata, on Rx disable only, the register can indicate done
+- * before it really is. Needs 50ms to be sure
+- */
+- if (!enable)
+- mdelay(50);
+-
+ return ret;
+ }
+
+@@ -4468,29 +4460,47 @@ int i40e_vsi_start_rings(struct i40e_vsi *vsi)
+ int ret = 0;
+
+ /* do rx first for enable and last for disable */
+- ret = i40e_vsi_control_rx(vsi, true);
++ ret = i40e_vsi_enable_rx(vsi);
+ if (ret)
+ return ret;
+- ret = i40e_vsi_control_tx(vsi, true);
++ ret = i40e_vsi_enable_tx(vsi);
+
+ return ret;
+ }
+
++#define I40E_DISABLE_TX_GAP_MSEC 50
++
+ /**
+ * i40e_vsi_stop_rings - Stop a VSI's rings
+ * @vsi: the VSI being configured
+ **/
+ void i40e_vsi_stop_rings(struct i40e_vsi *vsi)
+ {
++ struct i40e_pf *pf = vsi->back;
++ int pf_q, err, q_end;
++
+ /* When port TX is suspended, don't wait */
+ if (test_bit(__I40E_PORT_SUSPENDED, vsi->back->state))
+ return i40e_vsi_stop_rings_no_wait(vsi);
+
+- /* do rx first for enable and last for disable
+- * Ignore return value, we need to shutdown whatever we can
+- */
+- i40e_vsi_control_tx(vsi, false);
+- i40e_vsi_control_rx(vsi, false);
++ q_end = vsi->base_queue + vsi->num_queue_pairs;
++ for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++)
++ i40e_pre_tx_queue_cfg(&pf->hw, (u32)pf_q, false);
++
++ for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++) {
++ err = i40e_control_wait_rx_q(pf, pf_q, false);
++ if (err)
++ dev_info(&pf->pdev->dev,
++ "VSI seid %d Rx ring %d dissable timeout\n",
++ vsi->seid, pf_q);
++ }
++
++ msleep(I40E_DISABLE_TX_GAP_MSEC);
++ pf_q = vsi->base_queue;
++ for (pf_q = vsi->base_queue; pf_q < q_end; pf_q++)
++ wr32(&pf->hw, I40E_QTX_ENA(pf_q), 0);
++
++ i40e_vsi_wait_queues_disabled(vsi);
+ }
+
+ /**
+@@ -6752,6 +6762,8 @@ static int i40e_validate_mqprio_qopt(struct i40e_vsi *vsi,
+ }
+ if (vsi->num_queue_pairs <
+ (mqprio_qopt->qopt.offset[i] + mqprio_qopt->qopt.count[i])) {
++ dev_err(&vsi->back->pdev->dev,
++ "Failed to create traffic channel, insufficient number of queues.\n");
+ return -EINVAL;
+ }
+ if (sum_max_rate > i40e_get_link_speed(vsi)) {
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index a0affcb090a05..d9707d47f1e7f 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -3515,6 +3515,7 @@ slave_start:
+
+ if (!SRIOV_VALID_STATE(dev->flags)) {
+ mlx4_err(dev, "Invalid SRIOV state\n");
++ err = -EINVAL;
+ goto err_close;
+ }
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index a38a0c86705ab..774f0a619a6da 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -904,17 +904,19 @@ static int connect_fwd_rules(struct mlx5_core_dev *dev,
+ static int connect_flow_table(struct mlx5_core_dev *dev, struct mlx5_flow_table *ft,
+ struct fs_prio *prio)
+ {
+- struct mlx5_flow_table *next_ft;
++ struct mlx5_flow_table *next_ft, *first_ft;
+ int err = 0;
+
+ /* Connect_prev_fts and update_root_ft_create are mutually exclusive */
+
+- if (list_empty(&prio->node.children)) {
++ first_ft = list_first_entry_or_null(&prio->node.children,
++ struct mlx5_flow_table, node.list);
++ if (!first_ft || first_ft->level > ft->level) {
+ err = connect_prev_fts(dev, ft, prio);
+ if (err)
+ return err;
+
+- next_ft = find_next_chained_ft(prio);
++ next_ft = first_ft ? first_ft : find_next_chained_ft(prio);
+ err = connect_fwd_rules(dev, ft, next_ft);
+ if (err)
+ return err;
+@@ -1945,7 +1947,7 @@ static int disconnect_flow_table(struct mlx5_flow_table *ft)
+ node.list) == ft))
+ return 0;
+
+- next_ft = find_next_chained_ft(prio);
++ next_ft = find_next_ft(ft);
+ err = connect_fwd_rules(dev, next_ft, ft);
+ if (err)
+ return err;
+diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c
+index 823873030a218..e1bd9eacee176 100644
+--- a/drivers/net/ethernet/sis/sis900.c
++++ b/drivers/net/ethernet/sis/sis900.c
+@@ -441,7 +441,7 @@ static int sis900_probe(struct pci_dev *pci_dev,
+ #endif
+
+ /* setup various bits in PCI command register */
+- ret = pci_enable_device(pci_dev);
++ ret = pcim_enable_device(pci_dev);
+ if(ret) return ret;
+
+ i = pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32));
+@@ -467,7 +467,7 @@ static int sis900_probe(struct pci_dev *pci_dev,
+ ioaddr = pci_iomap(pci_dev, 0, 0);
+ if (!ioaddr) {
+ ret = -ENOMEM;
+- goto err_out_cleardev;
++ goto err_out;
+ }
+
+ sis_priv = netdev_priv(net_dev);
+@@ -575,8 +575,6 @@ err_unmap_tx:
+ sis_priv->tx_ring_dma);
+ err_out_unmap:
+ pci_iounmap(pci_dev, ioaddr);
+-err_out_cleardev:
+- pci_release_regions(pci_dev);
+ err_out:
+ free_netdev(net_dev);
+ return ret;
+@@ -2421,7 +2419,6 @@ static void sis900_remove(struct pci_dev *pci_dev)
+ sis_priv->tx_ring_dma);
+ pci_iounmap(pci_dev, sis_priv->ioaddr);
+ free_netdev(net_dev);
+- pci_release_regions(pci_dev);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
+index 5894edf79d659..605c4d15b88c1 100644
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -8192,8 +8192,9 @@ static int niu_pci_vpd_fetch(struct niu *np, u32 start)
+ err = niu_pci_vpd_scan_props(np, here, end);
+ if (err < 0)
+ return err;
++ /* ret == 1 is not an error */
+ if (err == 1)
+- return -EINVAL;
++ return 0;
+ }
+ return 0;
+ }
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 5e8b406302861..1a8fe5bacb19a 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -413,9 +413,13 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
+ offset += hdr_padded_len;
+ p += hdr_padded_len;
+
+- copy = len;
+- if (copy > skb_tailroom(skb))
+- copy = skb_tailroom(skb);
++ /* Copy all frame if it fits skb->head, otherwise
++ * we let virtio_net_hdr_to_skb() and GRO pull headers as needed.
++ */
++ if (len <= skb_tailroom(skb))
++ copy = len;
++ else
++ copy = ETH_HLEN + metasize;
+ skb_put_data(skb, p, copy);
+
+ if (metasize) {
+diff --git a/drivers/nfc/nfcsim.c b/drivers/nfc/nfcsim.c
+index 33449820e7542..533e3aa6275cd 100644
+--- a/drivers/nfc/nfcsim.c
++++ b/drivers/nfc/nfcsim.c
+@@ -201,8 +201,7 @@ static void nfcsim_recv_wq(struct work_struct *work)
+
+ if (!IS_ERR(skb))
+ dev_kfree_skb(skb);
+-
+- skb = ERR_PTR(-ENODEV);
++ return;
+ }
+
+ dev->cb(dev->nfc_digital_dev, dev->arg, skb);
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 662711200eeba..5a19f5ee70386 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -995,6 +995,7 @@ again:
+ if (test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state)) {
+ list_del_init(&device->dev_alloc_list);
+ clear_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state);
++ fs_devices->rw_devices--;
+ }
+ list_del_init(&device->dev_list);
+ fs_devices->num_devices--;
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 94df697e26385..6ca4dc57f70ba 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -1537,6 +1537,45 @@ static void ocfs2_truncate_cluster_pages(struct inode *inode, u64 byte_start,
+ }
+ }
+
++/*
++ * zero out partial blocks of one cluster.
++ *
++ * start: file offset where zero starts, will be made upper block aligned.
++ * len: it will be trimmed to the end of current cluster if "start + len"
++ * is bigger than it.
++ */
++static int ocfs2_zeroout_partial_cluster(struct inode *inode,
++ u64 start, u64 len)
++{
++ int ret;
++ u64 start_block, end_block, nr_blocks;
++ u64 p_block, offset;
++ u32 cluster, p_cluster, nr_clusters;
++ struct super_block *sb = inode->i_sb;
++ u64 end = ocfs2_align_bytes_to_clusters(sb, start);
++
++ if (start + len < end)
++ end = start + len;
++
++ start_block = ocfs2_blocks_for_bytes(sb, start);
++ end_block = ocfs2_blocks_for_bytes(sb, end);
++ nr_blocks = end_block - start_block;
++ if (!nr_blocks)
++ return 0;
++
++ cluster = ocfs2_bytes_to_clusters(sb, start);
++ ret = ocfs2_get_clusters(inode, cluster, &p_cluster,
++ &nr_clusters, NULL);
++ if (ret)
++ return ret;
++ if (!p_cluster)
++ return 0;
++
++ offset = start_block - ocfs2_clusters_to_blocks(sb, cluster);
++ p_block = ocfs2_clusters_to_blocks(sb, p_cluster) + offset;
++ return sb_issue_zeroout(sb, p_block, nr_blocks, GFP_NOFS);
++}
++
+ static int ocfs2_zero_partial_clusters(struct inode *inode,
+ u64 start, u64 len)
+ {
+@@ -1546,6 +1585,7 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
+ struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+ unsigned int csize = osb->s_clustersize;
+ handle_t *handle;
++ loff_t isize = i_size_read(inode);
+
+ /*
+ * The "start" and "end" values are NOT necessarily part of
+@@ -1566,6 +1606,26 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
+ if ((start & (csize - 1)) == 0 && (end & (csize - 1)) == 0)
+ goto out;
+
++ /* No page cache for EOF blocks, issue zero out to disk. */
++ if (end > isize) {
++ /*
++ * zeroout eof blocks in last cluster starting from
++ * "isize" even "start" > "isize" because it is
++ * complicated to zeroout just at "start" as "start"
++ * may be not aligned with block size, buffer write
++ * would be required to do that, but out of eof buffer
++ * write is not supported.
++ */
++ ret = ocfs2_zeroout_partial_cluster(inode, isize,
++ end - isize);
++ if (ret) {
++ mlog_errno(ret);
++ goto out;
++ }
++ if (start >= isize)
++ goto out;
++ end = isize;
++ }
+ handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
+ if (IS_ERR(handle)) {
+ ret = PTR_ERR(handle);
+@@ -1863,45 +1923,6 @@ out:
+ return ret;
+ }
+
+-/*
+- * zero out partial blocks of one cluster.
+- *
+- * start: file offset where zero starts, will be made upper block aligned.
+- * len: it will be trimmed to the end of current cluster if "start + len"
+- * is bigger than it.
+- */
+-static int ocfs2_zeroout_partial_cluster(struct inode *inode,
+- u64 start, u64 len)
+-{
+- int ret;
+- u64 start_block, end_block, nr_blocks;
+- u64 p_block, offset;
+- u32 cluster, p_cluster, nr_clusters;
+- struct super_block *sb = inode->i_sb;
+- u64 end = ocfs2_align_bytes_to_clusters(sb, start);
+-
+- if (start + len < end)
+- end = start + len;
+-
+- start_block = ocfs2_blocks_for_bytes(sb, start);
+- end_block = ocfs2_blocks_for_bytes(sb, end);
+- nr_blocks = end_block - start_block;
+- if (!nr_blocks)
+- return 0;
+-
+- cluster = ocfs2_bytes_to_clusters(sb, start);
+- ret = ocfs2_get_clusters(inode, cluster, &p_cluster,
+- &nr_clusters, NULL);
+- if (ret)
+- return ret;
+- if (!p_cluster)
+- return 0;
+-
+- offset = start_block - ocfs2_clusters_to_blocks(sb, cluster);
+- p_block = ocfs2_clusters_to_blocks(sb, p_cluster) + offset;
+- return sb_issue_zeroout(sb, p_block, nr_blocks, GFP_NOFS);
+-}
+-
+ /*
+ * Parts of this function taken from xfs_change_file_space()
+ */
+@@ -1943,7 +1964,6 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
+ goto out_inode_unlock;
+ }
+
+- orig_isize = i_size_read(inode);
+ switch (sr->l_whence) {
+ case 0: /*SEEK_SET*/
+ break;
+@@ -1951,7 +1971,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
+ sr->l_start += f_pos;
+ break;
+ case 2: /*SEEK_END*/
+- sr->l_start += orig_isize;
++ sr->l_start += i_size_read(inode);
+ break;
+ default:
+ ret = -EINVAL;
+@@ -2006,6 +2026,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
+ ret = -EINVAL;
+ }
+
++ orig_isize = i_size_read(inode);
+ /* zeroout eof blocks in the cluster. */
+ if (!ret && change_size && orig_isize < size) {
+ ret = ocfs2_zeroout_partial_cluster(inode, orig_isize,
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 06176ef2a8424..5f2e6451ece54 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -2788,6 +2788,15 @@ static inline void skb_propagate_pfmemalloc(struct page *page,
+ skb->pfmemalloc = true;
+ }
+
++/**
++ * skb_frag_off() - Returns the offset of a skb fragment
++ * @frag: the paged fragment
++ */
++static inline unsigned int skb_frag_off(const skb_frag_t *frag)
++{
++ return frag->page_offset;
++}
++
+ /**
+ * skb_frag_page - retrieve the page referred to by a paged fragment
+ * @frag: the paged fragment
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index a1829139ff4af..8f48264f5dab3 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -65,14 +65,18 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ skb_reset_mac_header(skb);
+
+ if (hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
+- u16 start = __virtio16_to_cpu(little_endian, hdr->csum_start);
+- u16 off = __virtio16_to_cpu(little_endian, hdr->csum_offset);
++ u32 start = __virtio16_to_cpu(little_endian, hdr->csum_start);
++ u32 off = __virtio16_to_cpu(little_endian, hdr->csum_offset);
++ u32 needed = start + max_t(u32, thlen, off + sizeof(__sum16));
++
++ if (!pskb_may_pull(skb, needed))
++ return -EINVAL;
+
+ if (!skb_partial_csum_set(skb, start, off))
+ return -EINVAL;
+
+ p_off = skb_transport_offset(skb) + thlen;
+- if (p_off > skb_headlen(skb))
++ if (!pskb_may_pull(skb, p_off))
+ return -EINVAL;
+ } else {
+ /* gso packets without NEEDS_CSUM do not set transport_offset.
+@@ -102,14 +106,14 @@ retry:
+ }
+
+ p_off = keys.control.thoff + thlen;
+- if (p_off > skb_headlen(skb) ||
++ if (!pskb_may_pull(skb, p_off) ||
+ keys.basic.ip_proto != ip_proto)
+ return -EINVAL;
+
+ skb_set_transport_header(skb, keys.control.thoff);
+ } else if (gso_type) {
+ p_off = thlen;
+- if (p_off > skb_headlen(skb))
++ if (!pskb_may_pull(skb, p_off))
+ return -EINVAL;
+ }
+ }
+diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h
+index c0f0a13ed8183..49aa79c7b278a 100644
+--- a/include/net/llc_pdu.h
++++ b/include/net/llc_pdu.h
+@@ -15,9 +15,11 @@
+ #include <linux/if_ether.h>
+
+ /* Lengths of frame formats */
+-#define LLC_PDU_LEN_I 4 /* header and 2 control bytes */
+-#define LLC_PDU_LEN_S 4
+-#define LLC_PDU_LEN_U 3 /* header and 1 control byte */
++#define LLC_PDU_LEN_I 4 /* header and 2 control bytes */
++#define LLC_PDU_LEN_S 4
++#define LLC_PDU_LEN_U 3 /* header and 1 control byte */
++/* header and 1 control byte and XID info */
++#define LLC_PDU_LEN_U_XID (LLC_PDU_LEN_U + sizeof(struct llc_xid_info))
+ /* Known SAP addresses */
+ #define LLC_GLOBAL_SAP 0xFF
+ #define LLC_NULL_SAP 0x00 /* not network-layer visible */
+@@ -50,9 +52,10 @@
+ #define LLC_PDU_TYPE_U_MASK 0x03 /* 8-bit control field */
+ #define LLC_PDU_TYPE_MASK 0x03
+
+-#define LLC_PDU_TYPE_I 0 /* first bit */
+-#define LLC_PDU_TYPE_S 1 /* first two bits */
+-#define LLC_PDU_TYPE_U 3 /* first two bits */
++#define LLC_PDU_TYPE_I 0 /* first bit */
++#define LLC_PDU_TYPE_S 1 /* first two bits */
++#define LLC_PDU_TYPE_U 3 /* first two bits */
++#define LLC_PDU_TYPE_U_XID 4 /* private type for detecting XID commands */
+
+ #define LLC_PDU_TYPE_IS_I(pdu) \
+ ((!(pdu->ctrl_1 & LLC_PDU_TYPE_I_MASK)) ? 1 : 0)
+@@ -230,9 +233,18 @@ static inline struct llc_pdu_un *llc_pdu_un_hdr(struct sk_buff *skb)
+ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type,
+ u8 ssap, u8 dsap, u8 cr)
+ {
+- const int hlen = type == LLC_PDU_TYPE_U ? 3 : 4;
++ int hlen = 4; /* default value for I and S types */
+ struct llc_pdu_un *pdu;
+
++ switch (type) {
++ case LLC_PDU_TYPE_U:
++ hlen = 3;
++ break;
++ case LLC_PDU_TYPE_U_XID:
++ hlen = 6;
++ break;
++ }
++
+ skb_push(skb, hlen);
+ skb_reset_network_header(skb);
+ pdu = llc_pdu_un_hdr(skb);
+@@ -374,7 +386,10 @@ static inline void llc_pdu_init_as_xid_cmd(struct sk_buff *skb,
+ xid_info->fmt_id = LLC_XID_FMT_ID; /* 0x81 */
+ xid_info->type = svcs_supported;
+ xid_info->rw = rx_window << 1; /* size of receive window */
+- skb_put(skb, sizeof(struct llc_xid_info));
++
++ /* no need to push/put since llc_pdu_header_init() has already
++ * pushed 3 + 3 bytes
++ */
+ }
+
+ /**
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 296a11a922e09..d0fb5a57c66d5 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -549,10 +549,18 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ return -EFAULT;
+ }
+
++ rtnl_lock();
+ lock_sock(sk);
+
+- if (ro->bound && ro->ifindex)
++ if (ro->bound && ro->ifindex) {
+ dev = dev_get_by_index(sock_net(sk), ro->ifindex);
++ if (!dev) {
++ if (count > 1)
++ kfree(filter);
++ err = -ENODEV;
++ goto out_fil;
++ }
++ }
+
+ if (ro->bound) {
+ /* (try to) register the new filters */
+@@ -591,6 +599,7 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ dev_put(dev);
+
+ release_sock(sk);
++ rtnl_unlock();
+
+ break;
+
+@@ -603,10 +612,16 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+
+ err_mask &= CAN_ERR_MASK;
+
++ rtnl_lock();
+ lock_sock(sk);
+
+- if (ro->bound && ro->ifindex)
++ if (ro->bound && ro->ifindex) {
+ dev = dev_get_by_index(sock_net(sk), ro->ifindex);
++ if (!dev) {
++ err = -ENODEV;
++ goto out_err;
++ }
++ }
+
+ /* remove current error mask */
+ if (ro->bound) {
+@@ -630,6 +645,7 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ dev_put(dev);
+
+ release_sock(sk);
++ rtnl_unlock();
+
+ break;
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 722ae0b57f3fd..a6798117bb1a0 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5400,7 +5400,8 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
+
+ if (skb_mac_header(skb) == skb_tail_pointer(skb) &&
+ pinfo->nr_frags &&
+- !PageHighMem(skb_frag_page(frag0))) {
++ !PageHighMem(skb_frag_page(frag0)) &&
++ (!NET_IP_ALIGN || !(skb_frag_off(frag0) & 3))) {
+ NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
+ NAPI_GRO_CB(skb)->frag0_len = min_t(unsigned int,
+ skb_frag_size(frag0),
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index bcba579e292ff..89a3dc7d5d400 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -98,8 +98,16 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
+ {
+ u8 rc = LLC_PDU_LEN_U;
+
+- if (addr->sllc_test || addr->sllc_xid)
++ if (addr->sllc_test)
+ rc = LLC_PDU_LEN_U;
++ else if (addr->sllc_xid)
++ /* We need to expand header to sizeof(struct llc_xid_info)
++ * since llc_pdu_init_as_xid_cmd() sets 4,5,6 bytes of LLC header
++ * as XID PDU. In llc_ui_sendmsg() we reserved header size and then
++ * filled all other space with user data. If we won't reserve this
++ * bytes, llc_pdu_init_as_xid_cmd() will overwrite user data
++ */
++ rc = LLC_PDU_LEN_U_XID;
+ else if (sk->sk_type == SOCK_STREAM)
+ rc = LLC_PDU_LEN_I;
+ return rc;
+diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c
+index 7ae4cc684d3ab..9fa3342c7a829 100644
+--- a/net/llc/llc_s_ac.c
++++ b/net/llc/llc_s_ac.c
+@@ -79,7 +79,7 @@ int llc_sap_action_send_xid_c(struct llc_sap *sap, struct sk_buff *skb)
+ struct llc_sap_state_ev *ev = llc_sap_ev(skb);
+ int rc;
+
+- llc_pdu_header_init(skb, LLC_PDU_TYPE_U, ev->saddr.lsap,
++ llc_pdu_header_init(skb, LLC_PDU_TYPE_U_XID, ev->saddr.lsap,
+ ev->daddr.lsap, LLC_PDU_CMD);
+ llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0);
+ rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 1dceda3c0e759..c5590d36b7750 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -630,8 +630,13 @@ bool nf_ct_delete(struct nf_conn *ct, u32 portid, int report)
+ return false;
+
+ tstamp = nf_conn_tstamp_find(ct);
+- if (tstamp && tstamp->stop == 0)
++ if (tstamp) {
++ s32 timeout = ct->timeout - nfct_time_stamp;
++
+ tstamp->stop = ktime_get_real_ns();
++ if (timeout < 0)
++ tstamp->stop -= jiffies_to_nsecs(-timeout);
++ }
+
+ if (nf_conntrack_event_report(IPCT_DESTROY, ct,
+ portid, report) < 0) {
+diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
+index 3e82a7d0df2a4..2c3d7ff6f58a7 100644
+--- a/net/netfilter/nft_nat.c
++++ b/net/netfilter/nft_nat.c
+@@ -153,7 +153,9 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip6);
+ break;
+ default:
+- return -EAFNOSUPPORT;
++ if (tb[NFTA_NAT_REG_ADDR_MIN])
++ return -EAFNOSUPPORT;
++ break;
+ }
+ priv->family = family;
+
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index 203aaefd8d049..23c4f14bec256 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -1132,7 +1132,7 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
+ if (unlikely(!af))
+ return NULL;
+
+- if (af->from_addr_param(&paddr, param, peer_port, 0))
++ if (!af->from_addr_param(&paddr, param, peer_port, 0))
+ return NULL;
+
+ return __sctp_lookup_association(net, laddr, &paddr, transportp);
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 3c41fb8edc5f1..6aead6deaa6c4 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -2440,7 +2440,7 @@ static int tipc_listen(struct socket *sock, int len)
+ static int tipc_wait_for_accept(struct socket *sock, long timeo)
+ {
+ struct sock *sk = sock->sk;
+- DEFINE_WAIT(wait);
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ int err;
+
+ /* True wake-one mechanism for incoming connections: only
+@@ -2449,12 +2449,12 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
+ * anymore, the common case will execute the loop only once.
+ */
+ for (;;) {
+- prepare_to_wait_exclusive(sk_sleep(sk), &wait,
+- TASK_INTERRUPTIBLE);
+ if (timeo && skb_queue_empty(&sk->sk_receive_queue)) {
++ add_wait_queue(sk_sleep(sk), &wait);
+ release_sock(sk);
+- timeo = schedule_timeout(timeo);
++ timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
+ lock_sock(sk);
++ remove_wait_queue(sk_sleep(sk), &wait);
+ }
+ err = 0;
+ if (!skb_queue_empty(&sk->sk_receive_queue))
+@@ -2466,7 +2466,6 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
+ if (signal_pending(current))
+ break;
+ }
+- finish_wait(sk_sleep(sk), &wait);
+ return err;
+ }
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 67b2747ad9ef8..d871349036a5c 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -1029,16 +1029,14 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,
+ * be grouped with this beacon for updates ...
+ */
+ if (!cfg80211_combine_bsses(rdev, new)) {
+- kfree(new);
++ bss_ref_put(rdev, new);
+ goto drop;
+ }
+ }
+
+ if (rdev->bss_entries >= bss_entries_limit &&
+ !cfg80211_bss_expire_oldest(rdev)) {
+- if (!list_empty(&new->hidden_list))
+- list_del(&new->hidden_list);
+- kfree(new);
++ bss_ref_put(rdev, new);
+ goto drop;
+ }
+
+diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
+index 603086692290f..769d11575a7b3 100644
+--- a/tools/perf/util/map.c
++++ b/tools/perf/util/map.c
+@@ -209,8 +209,6 @@ struct map *map__new(struct machine *machine, u64 start, u64 len,
+ if (!(prot & PROT_EXEC))
+ dso__set_loaded(dso);
+ }
+-
+- nsinfo__put(dso->nsinfo);
+ dso->nsinfo = nsi;
+ dso__put(dso);
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-08-08 13:39 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-08-08 13:39 UTC (permalink / raw
To: gentoo-commits
commit: 3c5c8b25062e5d0d2fd23d8aee1de6d5b138766b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Aug 8 13:38:52 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Aug 8 13:38:52 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3c5c8b25
Linux 4.19.202
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1201_linux-4.19.202.patch | 574 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 578 insertions(+)
diff --git a/0000_README b/0000_README
index 76502c8..d188882 100644
--- a/0000_README
+++ b/0000_README
@@ -843,6 +843,10 @@ Patch: 1200_linux-4.19.201.patch
From: https://www.kernel.org
Desc: Linux 4.19.201
+Patch: 1201_linux-4.19.202.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.202
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1201_linux-4.19.202.patch b/1201_linux-4.19.202.patch
new file mode 100644
index 0000000..737365a
--- /dev/null
+++ b/1201_linux-4.19.202.patch
@@ -0,0 +1,574 @@
+diff --git a/Makefile b/Makefile
+index 80954901733dd..b0f3a4d5a85d3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 201
++SUBLEVEL = 202
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index d984592b0995e..5b3e5483c657c 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -132,6 +132,7 @@
+ #include <linux/ioprio.h>
+ #include <linux/sbitmap.h>
+ #include <linux/delay.h>
++#include <linux/backing-dev.h>
+
+ #include "blk.h"
+ #include "blk-mq.h"
+@@ -4212,8 +4213,9 @@ bfq_set_next_ioprio_data(struct bfq_queue *bfqq, struct bfq_io_cq *bic)
+ ioprio_class = IOPRIO_PRIO_CLASS(bic->ioprio);
+ switch (ioprio_class) {
+ default:
+- dev_err(bfqq->bfqd->queue->backing_dev_info->dev,
+- "bfq: bad prio class %d\n", ioprio_class);
++ pr_err("bdi %s: bfq: bad prio class %d\n",
++ bdi_dev_name(bfqq->bfqd->queue->backing_dev_info),
++ ioprio_class);
+ /* fall through */
+ case IOPRIO_CLASS_NONE:
+ /*
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 85bd46e0a745f..ddde117eb2e0e 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -474,7 +474,7 @@ const char *blkg_dev_name(struct blkcg_gq *blkg)
+ {
+ /* some drivers (floppy) instantiate a queue w/o disk registered */
+ if (blkg->q->backing_dev_info->dev)
+- return dev_name(blkg->q->backing_dev_info->dev);
++ return bdi_dev_name(blkg->q->backing_dev_info);
+ return NULL;
+ }
+ EXPORT_SYMBOL_GPL(blkg_dev_name);
+diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
+index 7a30952b463d5..66d445b14e513 100644
+--- a/drivers/firmware/arm_scmi/bus.c
++++ b/drivers/firmware/arm_scmi/bus.c
+@@ -100,6 +100,9 @@ int scmi_driver_register(struct scmi_driver *driver, struct module *owner,
+ {
+ int retval;
+
++ if (!driver->probe)
++ return -EINVAL;
++
+ driver->driver.bus = &scmi_bus_type;
+ driver->driver.name = driver->name;
+ driver->driver.owner = owner;
+diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
+index 2d1952849d69f..12ade478533f4 100644
+--- a/drivers/gpu/drm/i915/intel_engine_cs.c
++++ b/drivers/gpu/drm/i915/intel_engine_cs.c
+@@ -463,7 +463,7 @@ static void intel_engine_init_execlist(struct intel_engine_cs *engine)
+ struct intel_engine_execlists * const execlists = &engine->execlists;
+
+ execlists->port_mask = 1;
+- BUILD_BUG_ON_NOT_POWER_OF_2(execlists_num_ports(execlists));
++ GEM_BUG_ON(!is_power_of_2(execlists_num_ports(execlists)));
+ GEM_BUG_ON(execlists_num_ports(execlists) > EXECLIST_MAX_PORTS);
+
+ execlists->queue_priority = INT_MIN;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+index 938ace333af10..0d62db3241bed 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -498,14 +498,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
+
+ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+- if (!qed_mcp_has_pending_cmd(p_hwfn))
++ if (!qed_mcp_has_pending_cmd(p_hwfn)) {
++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+ break;
++ }
+
+ rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt);
+- if (!rc)
++ if (!rc) {
++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+ break;
+- else if (rc != -EAGAIN)
++ } else if (rc != -EAGAIN) {
+ goto err;
++ }
+
+ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+@@ -522,6 +526,8 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
+ return -EAGAIN;
+ }
+
++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
++
+ /* Send the mailbox command */
+ qed_mcp_reread_offsets(p_hwfn, p_ptt);
+ seq_num = ++p_hwfn->mcp_info->drv_mb_seq;
+@@ -548,14 +554,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
+
+ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+- if (p_cmd_elem->b_is_completed)
++ if (p_cmd_elem->b_is_completed) {
++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+ break;
++ }
+
+ rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt);
+- if (!rc)
++ if (!rc) {
++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+ break;
+- else if (rc != -EAGAIN)
++ } else if (rc != -EAGAIN) {
+ goto err;
++ }
+
+ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+ } while (++cnt < max_retries);
+@@ -576,6 +586,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
+ return -EAGAIN;
+ }
+
++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+ qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
+ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 726fb5561a0fb..4764e4f54cefe 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -3960,9 +3960,10 @@ static int rtl8152_close(struct net_device *netdev)
+ tp->rtl_ops.down(tp);
+
+ mutex_unlock(&tp->control);
++ }
+
++ if (!res)
+ usb_autopm_put_interface(tp->intf);
+- }
+
+ free_all_mem(tp);
+
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index e2b171057b3b3..690e8ddf5f6b8 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -391,24 +391,15 @@ static int mtk_spi_fifo_transfer(struct spi_master *master,
+ mtk_spi_prepare_transfer(master, xfer);
+ mtk_spi_setup_packet(master);
+
+- cnt = xfer->len / 4;
+- if (xfer->tx_buf)
++ if (xfer->tx_buf) {
++ cnt = xfer->len / 4;
+ iowrite32_rep(mdata->base + SPI_TX_DATA_REG, xfer->tx_buf, cnt);
+-
+- if (xfer->rx_buf)
+- ioread32_rep(mdata->base + SPI_RX_DATA_REG, xfer->rx_buf, cnt);
+-
+- remainder = xfer->len % 4;
+- if (remainder > 0) {
+- reg_val = 0;
+- if (xfer->tx_buf) {
++ remainder = xfer->len % 4;
++ if (remainder > 0) {
++ reg_val = 0;
+ memcpy(®_val, xfer->tx_buf + (cnt * 4), remainder);
+ writel(reg_val, mdata->base + SPI_TX_DATA_REG);
+ }
+- if (xfer->rx_buf) {
+- reg_val = readl(mdata->base + SPI_RX_DATA_REG);
+- memcpy(xfer->rx_buf + (cnt * 4), ®_val, remainder);
+- }
+ }
+
+ mtk_spi_enable_transfer(master);
+diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
+index 059c9eddb5468..347f0389b0899 100644
+--- a/drivers/watchdog/iTCO_wdt.c
++++ b/drivers/watchdog/iTCO_wdt.c
+@@ -75,8 +75,6 @@
+ #define TCOBASE(p) ((p)->tco_res->start)
+ /* SMI Control and Enable Register */
+ #define SMI_EN(p) ((p)->smi_res->start)
+-#define TCO_EN (1 << 13)
+-#define GBL_SMI_EN (1 << 0)
+
+ #define TCO_RLD(p) (TCOBASE(p) + 0x00) /* TCO Timer Reload/Curr. Value */
+ #define TCOv1_TMR(p) (TCOBASE(p) + 0x01) /* TCOv1 Timer Initial Value*/
+@@ -332,12 +330,8 @@ static int iTCO_wdt_set_timeout(struct watchdog_device *wd_dev, unsigned int t)
+
+ tmrval = seconds_to_ticks(p, t);
+
+- /*
+- * If TCO SMIs are off, the timer counts down twice before rebooting.
+- * Otherwise, the BIOS generally reboots when the SMI triggers.
+- */
+- if (p->smi_res &&
+- (SMI_EN(p) & (TCO_EN | GBL_SMI_EN)) != (TCO_EN | GBL_SMI_EN))
++ /* For TCO v1 the timer counts down twice before rebooting */
++ if (p->iTCO_version == 1)
+ tmrval /= 2;
+
+ /* from the specs: */
+@@ -499,7 +493,7 @@ static int iTCO_wdt_probe(struct platform_device *pdev)
+ * Disables TCO logic generating an SMI#
+ */
+ val32 = inl(SMI_EN(p));
+- val32 &= ~TCO_EN; /* Turn off SMI clearing watchdog */
++ val32 &= 0xffffdfff; /* Turn off SMI clearing watchdog */
+ outl(val32, SMI_EN(p));
+ }
+
+diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
+index c71e534ca7ef6..919c033b9e316 100644
+--- a/fs/btrfs/compression.c
++++ b/fs/btrfs/compression.c
+@@ -270,8 +270,7 @@ static void end_compressed_bio_write(struct bio *bio)
+ cb->start,
+ cb->start + cb->len - 1,
+ NULL,
+- bio->bi_status ?
+- BLK_STS_OK : BLK_STS_NOTSUPP);
++ !cb->errors);
+ cb->compressed_pages[0]->mapping = NULL;
+
+ end_compressed_writeback(inode, cb);
+diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c
+index abdf98deeec40..e6b7d43b50776 100644
+--- a/fs/ceph/debugfs.c
++++ b/fs/ceph/debugfs.c
+@@ -251,7 +251,7 @@ int ceph_fs_debugfs_init(struct ceph_fs_client *fsc)
+ goto out;
+
+ snprintf(name, sizeof(name), "../../bdi/%s",
+- dev_name(fsc->sb->s_bdi->dev));
++ bdi_dev_name(fsc->sb->s_bdi));
+ fsc->debugfs_bdi =
+ debugfs_create_symlink("bdi",
+ fsc->client->debugfs_dir,
+diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
+index 07e02d6df5ad9..65d47522413c1 100644
+--- a/include/linux/backing-dev-defs.h
++++ b/include/linux/backing-dev-defs.h
+@@ -197,6 +197,7 @@ struct backing_dev_info {
+ wait_queue_head_t wb_waitq;
+
+ struct device *dev;
++ char dev_name[64];
+ struct device *owner;
+
+ struct timer_list laptop_mode_wb_timer;
+diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
+index 1ef4aca7b953f..d28d57eefe9fd 100644
+--- a/include/linux/backing-dev.h
++++ b/include/linux/backing-dev.h
+@@ -499,13 +499,6 @@ static inline int bdi_rw_congested(struct backing_dev_info *bdi)
+ (1 << WB_async_congested));
+ }
+
+-extern const char *bdi_unknown_name;
+-
+-static inline const char *bdi_dev_name(struct backing_dev_info *bdi)
+-{
+- if (!bdi || !bdi->dev)
+- return bdi_unknown_name;
+- return dev_name(bdi->dev);
+-}
++const char *bdi_dev_name(struct backing_dev_info *bdi);
+
+ #endif /* _LINUX_BACKING_DEV_H */
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index 3d323c6c85260..b51da879d7be0 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -59,6 +59,7 @@ enum cpuhp_state {
+ CPUHP_IOMMU_INTEL_DEAD,
+ CPUHP_LUSTRE_CFS_DEAD,
+ CPUHP_AP_ARM_CACHE_B15_RAC_DEAD,
++ CPUHP_PADATA_DEAD,
+ CPUHP_WORKQUEUE_PREP,
+ CPUHP_POWER_NUMA_PREPARE,
+ CPUHP_HRTIMERS_PREPARE,
+diff --git a/include/linux/mfd/rt5033-private.h b/include/linux/mfd/rt5033-private.h
+index 1b63fc2f42d1c..52d53d134f72c 100644
+--- a/include/linux/mfd/rt5033-private.h
++++ b/include/linux/mfd/rt5033-private.h
+@@ -203,13 +203,13 @@ enum rt5033_reg {
+ #define RT5033_REGULATOR_BUCK_VOLTAGE_MIN 1000000U
+ #define RT5033_REGULATOR_BUCK_VOLTAGE_MAX 3000000U
+ #define RT5033_REGULATOR_BUCK_VOLTAGE_STEP 100000U
+-#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 32
++#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 21
+
+ /* RT5033 regulator LDO output voltage uV */
+ #define RT5033_REGULATOR_LDO_VOLTAGE_MIN 1200000U
+ #define RT5033_REGULATOR_LDO_VOLTAGE_MAX 3000000U
+ #define RT5033_REGULATOR_LDO_VOLTAGE_STEP 100000U
+-#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 32
++#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 19
+
+ /* RT5033 regulator SAFE LDO output voltage uV */
+ #define RT5033_REGULATOR_SAFE_LDO_VOLTAGE 4900000U
+diff --git a/include/linux/padata.h b/include/linux/padata.h
+index d803397a28f70..8c9827cc63747 100644
+--- a/include/linux/padata.h
++++ b/include/linux/padata.h
+@@ -138,7 +138,8 @@ struct parallel_data {
+ /**
+ * struct padata_instance - The overall control structure.
+ *
+- * @cpu_notifier: cpu hotplug notifier.
++ * @cpu_online_node: Linkage for CPU online callback.
++ * @cpu_dead_node: Linkage for CPU offline callback.
+ * @wq: The workqueue in use.
+ * @pd: The internal control structure.
+ * @cpumask: User supplied cpumasks for parallel and serial works.
+@@ -150,7 +151,8 @@ struct parallel_data {
+ * @flags: padata flags.
+ */
+ struct padata_instance {
+- struct hlist_node node;
++ struct hlist_node cpu_online_node;
++ struct hlist_node cpu_dead_node;
+ struct workqueue_struct *wq;
+ struct parallel_data *pd;
+ struct padata_cpumask cpumask;
+diff --git a/include/trace/events/wbt.h b/include/trace/events/wbt.h
+index 37342a13c9cb9..9996420d7ec46 100644
+--- a/include/trace/events/wbt.h
++++ b/include/trace/events/wbt.h
+@@ -33,7 +33,7 @@ TRACE_EVENT(wbt_stat,
+ ),
+
+ TP_fast_assign(
+- strlcpy(__entry->name, dev_name(bdi->dev),
++ strlcpy(__entry->name, bdi_dev_name(bdi),
+ ARRAY_SIZE(__entry->name));
+ __entry->rmean = stat[0].mean;
+ __entry->rmin = stat[0].min;
+@@ -68,7 +68,7 @@ TRACE_EVENT(wbt_lat,
+ ),
+
+ TP_fast_assign(
+- strlcpy(__entry->name, dev_name(bdi->dev),
++ strlcpy(__entry->name, bdi_dev_name(bdi),
+ ARRAY_SIZE(__entry->name));
+ __entry->lat = div_u64(lat, 1000);
+ ),
+@@ -105,7 +105,7 @@ TRACE_EVENT(wbt_step,
+ ),
+
+ TP_fast_assign(
+- strlcpy(__entry->name, dev_name(bdi->dev),
++ strlcpy(__entry->name, bdi_dev_name(bdi),
+ ARRAY_SIZE(__entry->name));
+ __entry->msg = msg;
+ __entry->step = step;
+@@ -141,7 +141,7 @@ TRACE_EVENT(wbt_timer,
+ ),
+
+ TP_fast_assign(
+- strlcpy(__entry->name, dev_name(bdi->dev),
++ strlcpy(__entry->name, bdi_dev_name(bdi),
+ ARRAY_SIZE(__entry->name));
+ __entry->status = status;
+ __entry->step = step;
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 93e4fb2d9f2ee..7f2b6d369fd47 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -682,7 +682,7 @@ static int __padata_remove_cpu(struct padata_instance *pinst, int cpu)
+ {
+ struct parallel_data *pd = NULL;
+
+- if (cpumask_test_cpu(cpu, cpu_online_mask)) {
++ if (!cpumask_test_cpu(cpu, cpu_online_mask)) {
+
+ if (!padata_validate_cpumask(pinst, pinst->cpumask.pcpu) ||
+ !padata_validate_cpumask(pinst, pinst->cpumask.cbcpu))
+@@ -748,7 +748,7 @@ static int padata_cpu_online(unsigned int cpu, struct hlist_node *node)
+ struct padata_instance *pinst;
+ int ret;
+
+- pinst = hlist_entry_safe(node, struct padata_instance, node);
++ pinst = hlist_entry_safe(node, struct padata_instance, cpu_online_node);
+ if (!pinst_has_cpu(pinst, cpu))
+ return 0;
+
+@@ -758,12 +758,12 @@ static int padata_cpu_online(unsigned int cpu, struct hlist_node *node)
+ return ret;
+ }
+
+-static int padata_cpu_prep_down(unsigned int cpu, struct hlist_node *node)
++static int padata_cpu_dead(unsigned int cpu, struct hlist_node *node)
+ {
+ struct padata_instance *pinst;
+ int ret;
+
+- pinst = hlist_entry_safe(node, struct padata_instance, node);
++ pinst = hlist_entry_safe(node, struct padata_instance, cpu_dead_node);
+ if (!pinst_has_cpu(pinst, cpu))
+ return 0;
+
+@@ -779,7 +779,9 @@ static enum cpuhp_state hp_online;
+ static void __padata_free(struct padata_instance *pinst)
+ {
+ #ifdef CONFIG_HOTPLUG_CPU
+- cpuhp_state_remove_instance_nocalls(hp_online, &pinst->node);
++ cpuhp_state_remove_instance_nocalls(CPUHP_PADATA_DEAD,
++ &pinst->cpu_dead_node);
++ cpuhp_state_remove_instance_nocalls(hp_online, &pinst->cpu_online_node);
+ #endif
+
+ padata_stop(pinst);
+@@ -963,7 +965,10 @@ static struct padata_instance *padata_alloc(struct workqueue_struct *wq,
+ mutex_init(&pinst->lock);
+
+ #ifdef CONFIG_HOTPLUG_CPU
+- cpuhp_state_add_instance_nocalls_cpuslocked(hp_online, &pinst->node);
++ cpuhp_state_add_instance_nocalls_cpuslocked(hp_online,
++ &pinst->cpu_online_node);
++ cpuhp_state_add_instance_nocalls_cpuslocked(CPUHP_PADATA_DEAD,
++ &pinst->cpu_dead_node);
+ #endif
+ return pinst;
+
+@@ -1010,17 +1015,24 @@ static __init int padata_driver_init(void)
+ int ret;
+
+ ret = cpuhp_setup_state_multi(CPUHP_AP_ONLINE_DYN, "padata:online",
+- padata_cpu_online,
+- padata_cpu_prep_down);
++ padata_cpu_online, NULL);
+ if (ret < 0)
+ return ret;
+ hp_online = ret;
++
++ ret = cpuhp_setup_state_multi(CPUHP_PADATA_DEAD, "padata:dead",
++ NULL, padata_cpu_dead);
++ if (ret < 0) {
++ cpuhp_remove_multi_state(hp_online);
++ return ret;
++ }
+ return 0;
+ }
+ module_init(padata_driver_init);
+
+ static __exit void padata_driver_exit(void)
+ {
++ cpuhp_remove_multi_state(CPUHP_PADATA_DEAD);
+ cpuhp_remove_multi_state(hp_online);
+ }
+ module_exit(padata_driver_exit);
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index 2152e85891d1f..1d37c80d023a2 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -19,7 +19,7 @@ struct backing_dev_info noop_backing_dev_info = {
+ EXPORT_SYMBOL_GPL(noop_backing_dev_info);
+
+ static struct class *bdi_class;
+-const char *bdi_unknown_name = "(unknown)";
++static const char *bdi_unknown_name = "(unknown)";
+
+ /*
+ * bdi_lock protects updates to bdi_list. bdi_list has RCU reader side
+@@ -880,7 +880,8 @@ int bdi_register_va(struct backing_dev_info *bdi, const char *fmt, va_list args)
+ if (bdi->dev) /* The driver needs to use separate queues per device */
+ return 0;
+
+- dev = device_create_vargs(bdi_class, NULL, MKDEV(0, 0), bdi, fmt, args);
++ vsnprintf(bdi->dev_name, sizeof(bdi->dev_name), fmt, args);
++ dev = device_create(bdi_class, NULL, MKDEV(0, 0), bdi, bdi->dev_name);
+ if (IS_ERR(dev))
+ return PTR_ERR(dev);
+
+@@ -976,6 +977,14 @@ void bdi_put(struct backing_dev_info *bdi)
+ }
+ EXPORT_SYMBOL(bdi_put);
+
++const char *bdi_dev_name(struct backing_dev_info *bdi)
++{
++ if (!bdi || !bdi->dev)
++ return bdi_unknown_name;
++ return bdi->dev_name;
++}
++EXPORT_SYMBOL_GPL(bdi_dev_name);
++
+ static wait_queue_head_t congestion_wqh[2] = {
+ __WAIT_QUEUE_HEAD_INITIALIZER(congestion_wqh[0]),
+ __WAIT_QUEUE_HEAD_INITIALIZER(congestion_wqh[1])
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index e9902bf0f137e..219cdbb476fb7 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1609,6 +1609,14 @@ int hci_dev_do_close(struct hci_dev *hdev)
+
+ BT_DBG("%s %p", hdev->name, hdev);
+
++ if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
++ !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
++ test_bit(HCI_UP, &hdev->flags)) {
++ /* Execute vendor specific shutdown routine */
++ if (hdev->shutdown)
++ hdev->shutdown(hdev);
++ }
++
+ cancel_delayed_work(&hdev->power_off);
+
+ hci_request_cancel_all(hdev);
+@@ -1682,14 +1690,6 @@ int hci_dev_do_close(struct hci_dev *hdev)
+ clear_bit(HCI_INIT, &hdev->flags);
+ }
+
+- if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
+- !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
+- test_bit(HCI_UP, &hdev->flags)) {
+- /* Execute vendor specific shutdown routine */
+- if (hdev->shutdown)
+- hdev->shutdown(hdev);
+- }
+-
+ /* flush cmd work */
+ flush_work(&hdev->cmd_work);
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index ea9684bcc2e8d..e1daab49b0eb0 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2705,8 +2705,11 @@ skb_zerocopy_headlen(const struct sk_buff *from)
+
+ if (!from->head_frag ||
+ skb_headlen(from) < L1_CACHE_BYTES ||
+- skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS)
++ skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) {
+ hlen = skb_headlen(from);
++ if (!hlen)
++ hlen = from->len;
++ }
+
+ if (skb_has_frag_list(from))
+ hlen = from->len;
+diff --git a/sound/soc/codecs/tlv320aic31xx.h b/sound/soc/codecs/tlv320aic31xx.h
+index 0b587585b38bb..6071de5fca57f 100644
+--- a/sound/soc/codecs/tlv320aic31xx.h
++++ b/sound/soc/codecs/tlv320aic31xx.h
+@@ -147,8 +147,8 @@ struct aic31xx_pdata {
+ #define AIC31XX_WORD_LEN_24BITS 0x02
+ #define AIC31XX_WORD_LEN_32BITS 0x03
+ #define AIC31XX_IFACE1_MASTER_MASK GENMASK(3, 2)
+-#define AIC31XX_BCLK_MASTER BIT(2)
+-#define AIC31XX_WCLK_MASTER BIT(3)
++#define AIC31XX_BCLK_MASTER BIT(3)
++#define AIC31XX_WCLK_MASTER BIT(2)
+
+ /* AIC31XX_DATA_OFFSET */
+ #define AIC31XX_DATA_OFFSET_MASK GENMASK(7, 0)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-08-12 11:51 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-08-12 11:51 UTC (permalink / raw
To: gentoo-commits
commit: e9b6c85e7fce52eee5421adcdab412041f3d8535
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 12 11:51:11 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Aug 12 11:51:11 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e9b6c85e
Linux patch 4.19.203
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1202_linux-4.19.203.patch | 1744 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1748 insertions(+)
diff --git a/0000_README b/0000_README
index d188882..d01fd15 100644
--- a/0000_README
+++ b/0000_README
@@ -847,6 +847,10 @@ Patch: 1201_linux-4.19.202.patch
From: https://www.kernel.org
Desc: Linux 4.19.202
+Patch: 1202_linux-4.19.203.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.203
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1202_linux-4.19.203.patch b/1202_linux-4.19.203.patch
new file mode 100644
index 0000000..9e3c569
--- /dev/null
+++ b/1202_linux-4.19.203.patch
@@ -0,0 +1,1744 @@
+diff --git a/Documentation/trace/histogram.rst b/Documentation/trace/histogram.rst
+index 5ac724baea7d9..c14dab13a47e8 100644
+--- a/Documentation/trace/histogram.rst
++++ b/Documentation/trace/histogram.rst
+@@ -191,7 +191,7 @@ Documentation written by Tom Zanussi
+ with the event, in nanoseconds. May be
+ modified by .usecs to have timestamps
+ interpreted as microseconds.
+- cpu int the cpu on which the event occurred.
++ common_cpu int the cpu on which the event occurred.
+ ====================== ==== =======================================
+
+ Extended error information
+diff --git a/Makefile b/Makefile
+index b0f3a4d5a85d3..6d2670300d470 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 202
++SUBLEVEL = 203
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
+index d0dccae53ba9f..8a89b9adb4fe4 100644
+--- a/arch/alpha/kernel/smp.c
++++ b/arch/alpha/kernel/smp.c
+@@ -585,7 +585,7 @@ void
+ smp_send_stop(void)
+ {
+ cpumask_t to_whom;
+- cpumask_copy(&to_whom, cpu_possible_mask);
++ cpumask_copy(&to_whom, cpu_online_mask);
+ cpumask_clear_cpu(smp_processor_id(), &to_whom);
+ #ifdef DEBUG_IPI_MSG
+ if (hard_smp_processor_id() != boot_cpu_id)
+diff --git a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
+index 038d8c90f6dfe..621396884c318 100644
+--- a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
++++ b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
+@@ -43,6 +43,7 @@
+ assigned-clock-rates = <0>, <198000000>;
+ cap-power-off-card;
+ keep-power-in-suspend;
++ max-frequency = <25000000>;
+ mmc-pwrseq = <&wifi_pwrseq>;
+ no-1-8-v;
+ non-removable;
+diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi
+index 61a06f6add3ca..d1cb9ba080b25 100644
+--- a/arch/arm/boot/dts/omap5-board-common.dtsi
++++ b/arch/arm/boot/dts/omap5-board-common.dtsi
+@@ -33,14 +33,6 @@
+ regulator-max-microvolt = <5000000>;
+ };
+
+- vdds_1v8_main: fixedregulator-vdds_1v8_main {
+- compatible = "regulator-fixed";
+- regulator-name = "vdds_1v8_main";
+- vin-supply = <&smps7_reg>;
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
+- };
+-
+ vmmcsd_fixed: fixedregulator-mmcsd {
+ compatible = "regulator-fixed";
+ regulator-name = "vmmcsd_fixed";
+@@ -490,6 +482,7 @@
+ regulator-boot-on;
+ };
+
++ vdds_1v8_main:
+ smps7_reg: smps7 {
+ /* VDDS_1v8_OMAP over VDDS_1v8_MAIN */
+ regulator-name = "smps7";
+diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
+index 04b3bf71de94b..ae0a61c61a6e1 100644
+--- a/arch/arm/mach-imx/mmdc.c
++++ b/arch/arm/mach-imx/mmdc.c
+@@ -11,6 +11,7 @@
+ * http://www.gnu.org/copyleft/gpl.html
+ */
+
++#include <linux/clk.h>
+ #include <linux/hrtimer.h>
+ #include <linux/init.h>
+ #include <linux/interrupt.h>
+@@ -472,6 +473,7 @@ static int imx_mmdc_remove(struct platform_device *pdev)
+
+ cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
+ perf_pmu_unregister(&pmu_mmdc->pmu);
++ iounmap(pmu_mmdc->mmdc_base);
+ kfree(pmu_mmdc);
+ return 0;
+ }
+@@ -546,7 +548,20 @@ static int imx_mmdc_probe(struct platform_device *pdev)
+ {
+ struct device_node *np = pdev->dev.of_node;
+ void __iomem *mmdc_base, *reg;
++ struct clk *mmdc_ipg_clk;
+ u32 val;
++ int err;
++
++ /* the ipg clock is optional */
++ mmdc_ipg_clk = devm_clk_get(&pdev->dev, NULL);
++ if (IS_ERR(mmdc_ipg_clk))
++ mmdc_ipg_clk = NULL;
++
++ err = clk_prepare_enable(mmdc_ipg_clk);
++ if (err) {
++ dev_err(&pdev->dev, "Unable to enable mmdc ipg clock.\n");
++ return err;
++ }
+
+ mmdc_base = of_iomap(np, 0);
+ WARN_ON(!mmdc_base);
+@@ -564,7 +579,11 @@ static int imx_mmdc_probe(struct platform_device *pdev)
+ val &= ~(1 << BP_MMDC_MAPSR_PSD);
+ writel_relaxed(val, reg);
+
+- return imx_mmdc_perf_init(pdev, mmdc_base);
++ err = imx_mmdc_perf_init(pdev, mmdc_base);
++ if (err)
++ iounmap(mmdc_base);
++
++ return err;
+ }
+
+ int imx_mmdc_get_ddr_type(void)
+diff --git a/arch/mips/Makefile b/arch/mips/Makefile
+index 63e2ad43bd6ad..8f4e169cde114 100644
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -325,7 +325,7 @@ KBUILD_LDFLAGS += -m $(ld-emul)
+
+ ifdef CONFIG_MIPS
+ CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \
+- egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \
++ egrep -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \
+ sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g')
+ endif
+
+diff --git a/arch/mips/mti-malta/malta-platform.c b/arch/mips/mti-malta/malta-platform.c
+index 11e9527c6e441..62ffac500eb52 100644
+--- a/arch/mips/mti-malta/malta-platform.c
++++ b/arch/mips/mti-malta/malta-platform.c
+@@ -47,7 +47,8 @@ static struct plat_serial8250_port uart8250_data[] = {
+ .mapbase = 0x1f000900, /* The CBUS UART */
+ .irq = MIPS_CPU_IRQ_BASE + MIPSCPU_INT_MB2,
+ .uartclk = 3686400, /* Twice the usual clk! */
+- .iotype = UPIO_MEM32,
++ .iotype = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN) ?
++ UPIO_MEM32BE : UPIO_MEM32,
+ .flags = CBUS_UART_FLAGS,
+ .regshift = 3,
+ },
+diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
+index 05659c7b43d4c..d2e87dbc55c58 100644
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -799,9 +799,10 @@ void x86_pmu_stop(struct perf_event *event, int flags);
+
+ static inline void x86_pmu_disable_event(struct perf_event *event)
+ {
++ u64 disable_mask = __this_cpu_read(cpu_hw_events.perf_ctr_virt_mask);
+ struct hw_perf_event *hwc = &event->hw;
+
+- wrmsrl(hwc->config_base, hwc->config);
++ wrmsrl(hwc->config_base, hwc->config & ~disable_mask);
+ }
+
+ void x86_pmu_enable_event(struct perf_event *event);
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 5faa49a95ac97..762baba4ecd51 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -2042,7 +2042,7 @@ static int is_empty_shadow_page(u64 *spt)
+ * aggregate version in order to make the slab shrinker
+ * faster
+ */
+-static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, unsigned long nr)
++static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, long nr)
+ {
+ kvm->arch.n_used_mmu_pages += nr;
+ percpu_counter_add(&kvm_total_used_mmu_pages, nr);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 9cfc669b4a243..f913127e942a1 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3366,8 +3366,17 @@ static int kvm_cpu_accept_dm_intr(struct kvm_vcpu *vcpu)
+
+ static int kvm_vcpu_ready_for_interrupt_injection(struct kvm_vcpu *vcpu)
+ {
+- return kvm_arch_interrupt_allowed(vcpu) &&
+- kvm_cpu_accept_dm_intr(vcpu);
++ /*
++ * Do not cause an interrupt window exit if an exception
++ * is pending or an event needs reinjection; userspace
++ * might want to inject the interrupt manually using KVM_SET_REGS
++ * or KVM_SET_SREGS. For that to work, we must be at an
++ * instruction boundary and with no events half-injected.
++ */
++ return (kvm_arch_interrupt_allowed(vcpu) &&
++ kvm_cpu_accept_dm_intr(vcpu) &&
++ !kvm_event_needs_reinjection(vcpu) &&
++ !vcpu->arch.exception.pending);
+ }
+
+ static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
+diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
+index 0529e94a20f7f..019cf002eceec 100644
+--- a/block/blk-iolatency.c
++++ b/block/blk-iolatency.c
+@@ -800,7 +800,11 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf,
+
+ enable = iolatency_set_min_lat_nsec(blkg, lat_val);
+ if (enable) {
+- WARN_ON_ONCE(!blk_get_queue(blkg->q));
++ if (!blk_get_queue(blkg->q)) {
++ ret = -ENODEV;
++ goto out;
++ }
++
+ blkg_get(blkg);
+ }
+
+diff --git a/drivers/acpi/acpica/nsrepair2.c b/drivers/acpi/acpica/nsrepair2.c
+index 4c8ce483805d8..a3bd6280882c3 100644
+--- a/drivers/acpi/acpica/nsrepair2.c
++++ b/drivers/acpi/acpica/nsrepair2.c
+@@ -375,13 +375,6 @@ acpi_ns_repair_CID(struct acpi_evaluate_info *info,
+
+ (*element_ptr)->common.reference_count =
+ original_ref_count;
+-
+- /*
+- * The original_element holds a reference from the package object
+- * that represents _HID. Since a new element was created by _HID,
+- * remove the reference from the _CID package.
+- */
+- acpi_ut_remove_reference(original_element);
+ }
+
+ element_ptr++;
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index 7484ffdabd543..ec62d26c32a9d 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -657,6 +657,20 @@ unsigned int ata_sff_data_xfer32(struct ata_queued_cmd *qc, unsigned char *buf,
+ }
+ EXPORT_SYMBOL_GPL(ata_sff_data_xfer32);
+
++static void ata_pio_xfer(struct ata_queued_cmd *qc, struct page *page,
++ unsigned int offset, size_t xfer_size)
++{
++ bool do_write = (qc->tf.flags & ATA_TFLAG_WRITE);
++ unsigned char *buf;
++
++ buf = kmap_atomic(page);
++ qc->ap->ops->sff_data_xfer(qc, buf + offset, xfer_size, do_write);
++ kunmap_atomic(buf);
++
++ if (!do_write && !PageSlab(page))
++ flush_dcache_page(page);
++}
++
+ /**
+ * ata_pio_sector - Transfer a sector of data.
+ * @qc: Command on going
+@@ -668,11 +682,9 @@ EXPORT_SYMBOL_GPL(ata_sff_data_xfer32);
+ */
+ static void ata_pio_sector(struct ata_queued_cmd *qc)
+ {
+- int do_write = (qc->tf.flags & ATA_TFLAG_WRITE);
+ struct ata_port *ap = qc->ap;
+ struct page *page;
+ unsigned int offset;
+- unsigned char *buf;
+
+ if (!qc->cursg) {
+ qc->curbytes = qc->nbytes;
+@@ -690,13 +702,20 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
+
+ DPRINTK("data %s\n", qc->tf.flags & ATA_TFLAG_WRITE ? "write" : "read");
+
+- /* do the actual data transfer */
+- buf = kmap_atomic(page);
+- ap->ops->sff_data_xfer(qc, buf + offset, qc->sect_size, do_write);
+- kunmap_atomic(buf);
++ /*
++ * Split the transfer when it splits a page boundary. Note that the
++ * split still has to be dword aligned like all ATA data transfers.
++ */
++ WARN_ON_ONCE(offset % 4);
++ if (offset + qc->sect_size > PAGE_SIZE) {
++ unsigned int split_len = PAGE_SIZE - offset;
+
+- if (!do_write && !PageSlab(page))
+- flush_dcache_page(page);
++ ata_pio_xfer(qc, page, offset, split_len);
++ ata_pio_xfer(qc, nth_page(page, 1), 0,
++ qc->sect_size - split_len);
++ } else {
++ ata_pio_xfer(qc, page, offset, qc->sect_size);
++ }
+
+ qc->curbytes += qc->sect_size;
+ qc->cursg_ofs += qc->sect_size;
+diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
+index 3b7b748c4d4f2..821e27bda4ca2 100644
+--- a/drivers/base/firmware_loader/fallback.c
++++ b/drivers/base/firmware_loader/fallback.c
+@@ -86,12 +86,11 @@ static void __fw_load_abort(struct fw_priv *fw_priv)
+ {
+ /*
+ * There is a small window in which user can write to 'loading'
+- * between loading done and disappearance of 'loading'
++ * between loading done/aborted and disappearance of 'loading'
+ */
+- if (fw_sysfs_done(fw_priv))
++ if (fw_state_is_aborted(fw_priv) || fw_sysfs_done(fw_priv))
+ return;
+
+- list_del_init(&fw_priv->pending_list);
+ fw_state_aborted(fw_priv);
+ }
+
+@@ -297,7 +296,6 @@ static ssize_t firmware_loading_store(struct device *dev,
+ * Same logic as fw_load_abort, only the DONE bit
+ * is ignored and we set ABORT only on failure.
+ */
+- list_del_init(&fw_priv->pending_list);
+ if (rc) {
+ fw_state_aborted(fw_priv);
+ written = rc;
+@@ -559,6 +557,11 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs,
+ }
+
+ mutex_lock(&fw_lock);
++ if (fw_state_is_aborted(fw_priv)) {
++ mutex_unlock(&fw_lock);
++ retval = -EINTR;
++ goto out;
++ }
+ list_add(&fw_priv->pending_list, &pending_fw_head);
+ mutex_unlock(&fw_lock);
+
+@@ -581,11 +584,10 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs,
+ if (fw_state_is_aborted(fw_priv)) {
+ if (retval == -ERESTARTSYS)
+ retval = -EINTR;
+- else
+- retval = -EAGAIN;
+ } else if (fw_priv->is_paged_buf && !fw_priv->data)
+ retval = -ENOMEM;
+
++out:
+ device_del(f_dev);
+ err_put_dev:
+ put_device(f_dev);
+diff --git a/drivers/base/firmware_loader/firmware.h b/drivers/base/firmware_loader/firmware.h
+index 4c1395f8e7ed2..e2000b4ad09b3 100644
+--- a/drivers/base/firmware_loader/firmware.h
++++ b/drivers/base/firmware_loader/firmware.h
+@@ -106,8 +106,16 @@ static inline void __fw_state_set(struct fw_priv *fw_priv,
+
+ WRITE_ONCE(fw_st->status, status);
+
+- if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
++ if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED) {
++#ifdef CONFIG_FW_LOADER_USER_HELPER
++ /*
++ * Doing this here ensures that the fw_priv is deleted from
++ * the pending list in all abort/done paths.
++ */
++ list_del_init(&fw_priv->pending_list);
++#endif
+ complete_all(&fw_st->completion);
++ }
+ }
+
+ static inline void fw_state_aborted(struct fw_priv *fw_priv)
+diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
+index 8e9213b36e313..24410a0d6df07 100644
+--- a/drivers/base/firmware_loader/main.c
++++ b/drivers/base/firmware_loader/main.c
+@@ -558,8 +558,10 @@ static void fw_abort_batch_reqs(struct firmware *fw)
+ return;
+
+ fw_priv = fw->priv;
++ mutex_lock(&fw_lock);
+ if (!fw_state_is_aborted(fw_priv))
+ fw_state_aborted(fw_priv);
++ mutex_unlock(&fw_lock);
+ }
+
+ /* called from request_firmware() and request_firmware_work_func() */
+diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c
+index 294850bdc195d..61de486dec416 100644
+--- a/drivers/clk/clk-stm32f4.c
++++ b/drivers/clk/clk-stm32f4.c
+@@ -454,7 +454,7 @@ struct stm32f4_pll {
+
+ struct stm32f4_pll_post_div_data {
+ int idx;
+- u8 pll_num;
++ int pll_idx;
+ const char *name;
+ const char *parent;
+ u8 flag;
+@@ -485,13 +485,13 @@ static const struct clk_div_table post_divr_table[] = {
+
+ #define MAX_POST_DIV 3
+ static const struct stm32f4_pll_post_div_data post_div_data[MAX_POST_DIV] = {
+- { CLK_I2SQ_PDIV, PLL_I2S, "plli2s-q-div", "plli2s-q",
++ { CLK_I2SQ_PDIV, PLL_VCO_I2S, "plli2s-q-div", "plli2s-q",
+ CLK_SET_RATE_PARENT, STM32F4_RCC_DCKCFGR, 0, 5, 0, NULL},
+
+- { CLK_SAIQ_PDIV, PLL_SAI, "pllsai-q-div", "pllsai-q",
++ { CLK_SAIQ_PDIV, PLL_VCO_SAI, "pllsai-q-div", "pllsai-q",
+ CLK_SET_RATE_PARENT, STM32F4_RCC_DCKCFGR, 8, 5, 0, NULL },
+
+- { NO_IDX, PLL_SAI, "pllsai-r-div", "pllsai-r", CLK_SET_RATE_PARENT,
++ { NO_IDX, PLL_VCO_SAI, "pllsai-r-div", "pllsai-r", CLK_SET_RATE_PARENT,
+ STM32F4_RCC_DCKCFGR, 16, 2, 0, post_divr_table },
+ };
+
+@@ -1499,7 +1499,7 @@ static void __init stm32f4_rcc_init(struct device_node *np)
+ post_div->width,
+ post_div->flag_div,
+ post_div->div_table,
+- clks[post_div->pll_num],
++ clks[post_div->pll_idx],
+ &stm32f4_clk_lock);
+
+ if (post_div->idx != NO_IDX)
+diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
+index 93d250db0b6f0..50015a2ea5ce0 100644
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -1391,6 +1391,7 @@ static int vb2_start_streaming(struct vb2_queue *q)
+ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb)
+ {
+ struct vb2_buffer *vb;
++ enum vb2_buffer_state orig_state;
+ int ret;
+
+ if (q->error) {
+@@ -1420,6 +1421,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb)
+ * Add to the queued buffers list, a buffer will stay on it until
+ * dequeued in dqbuf.
+ */
++ orig_state = vb->state;
+ list_add_tail(&vb->queued_entry, &q->queued_list);
+ q->queued_count++;
+ q->waiting_for_buffers = false;
+@@ -1450,8 +1452,17 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb)
+ if (q->streaming && !q->start_streaming_called &&
+ q->queued_count >= q->min_buffers_needed) {
+ ret = vb2_start_streaming(q);
+- if (ret)
++ if (ret) {
++ /*
++ * Since vb2_core_qbuf will return with an error,
++ * we should return it to state DEQUEUED since
++ * the error indicates that the buffer wasn't queued.
++ */
++ list_del(&vb->queued_entry);
++ q->queued_count--;
++ vb->state = orig_state;
+ return ret;
++ }
+ }
+
+ dprintk(2, "qbuf of buffer %d succeeded\n", vb->index);
+diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+index a970224a94bdd..857ef9edbc123 100644
+--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
++++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+@@ -50,7 +50,16 @@ static int rtl28xxu_ctrl_msg(struct dvb_usb_device *d, struct rtl28xxu_req *req)
+ } else {
+ /* read */
+ requesttype = (USB_TYPE_VENDOR | USB_DIR_IN);
+- pipe = usb_rcvctrlpipe(d->udev, 0);
++
++ /*
++ * Zero-length transfers must use usb_sndctrlpipe() and
++ * rtl28xxu_identify_state() uses a zero-length i2c read
++ * command to determine the chip type.
++ */
++ if (req->size)
++ pipe = usb_rcvctrlpipe(d->udev, 0);
++ else
++ pipe = usb_sndctrlpipe(d->udev, 0);
+ }
+
+ ret = usb_control_msg(d->udev, pipe, 0, requesttype, req->value,
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index cf01e73d1bcc8..2610acf9ac36c 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -2668,7 +2668,8 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
+ }
+
+ /* Allocated memory for FW statistics */
+- if (bnx2x_alloc_fw_stats_mem(bp))
++ rc = bnx2x_alloc_fw_stats_mem(bp);
++ if (rc)
+ LOAD_ERROR_EXIT(bp, load_error0);
+
+ /* request pf to initialize status blocks */
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 6b9eada1feb21..3fc823e9cdc9d 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3733,13 +3733,13 @@ fec_drv_remove(struct platform_device *pdev)
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(fep->phy_node);
+- free_netdev(ndev);
+
+ clk_disable_unprepare(fep->clk_ahb);
+ clk_disable_unprepare(fep->clk_ipg);
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+
++ free_netdev(ndev);
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c
+index b9a1a9f999ea6..039d5dd98dfe9 100644
+--- a/drivers/net/ethernet/natsemi/natsemi.c
++++ b/drivers/net/ethernet/natsemi/natsemi.c
+@@ -819,7 +819,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+ printk(version);
+ #endif
+
+- i = pci_enable_device(pdev);
++ i = pcim_enable_device(pdev);
+ if (i) return i;
+
+ /* natsemi has a non-standard PM control register
+@@ -852,7 +852,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+ ioaddr = ioremap(iostart, iosize);
+ if (!ioaddr) {
+ i = -ENOMEM;
+- goto err_ioremap;
++ goto err_pci_request_regions;
+ }
+
+ /* Work around the dropped serial bit. */
+@@ -974,9 +974,6 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent)
+ err_register_netdev:
+ iounmap(ioaddr);
+
+- err_ioremap:
+- pci_release_regions(pdev);
+-
+ err_pci_request_regions:
+ free_netdev(dev);
+ return i;
+@@ -3242,7 +3239,6 @@ static void natsemi_remove1(struct pci_dev *pdev)
+
+ NATSEMI_REMOVE_FILE(pdev, dspcfg_workaround);
+ unregister_netdev (dev);
+- pci_release_regions (pdev);
+ iounmap(ioaddr);
+ free_netdev (dev);
+ }
+diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c
+index 5ae3fa82909f8..0766288e2f38a 100644
+--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c
++++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c
+@@ -3529,13 +3529,13 @@ static void vxge_device_unregister(struct __vxge_hw_device *hldev)
+
+ kfree(vdev->vpaths);
+
+- /* we are safe to free it now */
+- free_netdev(dev);
+-
+ vxge_debug_init(vdev->level_trace, "%s: ethernet device unregistered",
+ buf);
+ vxge_debug_entryexit(vdev->level_trace, "%s: %s:%d Exiting...", buf,
+ __func__, __LINE__);
++
++ /* we are safe to free it now */
++ free_netdev(dev);
+ }
+
+ /*
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index 9043d2cadd5de..2e75d0af4a585 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -292,6 +292,8 @@ nfp_net_get_link_ksettings(struct net_device *netdev,
+
+ /* Init to unknowns */
+ ethtool_link_ksettings_add_link_mode(cmd, supported, FIBRE);
++ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
++ ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause);
+ cmd->base.port = PORT_OTHER;
+ cmd->base.speed = SPEED_UNKNOWN;
+ cmd->base.duplex = DUPLEX_UNKNOWN;
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
+index 2d71646640ac5..f98e2f417c2ea 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -155,7 +155,7 @@ static int ql_wait_for_drvr_lock(struct ql3_adapter *qdev)
+ "driver lock acquired\n");
+ return 1;
+ }
+- ssleep(1);
++ mdelay(1000);
+ } while (++i < 10);
+
+ netdev_err(qdev->ndev, "Timed out waiting for driver lock...\n");
+@@ -3292,7 +3292,7 @@ static int ql_adapter_reset(struct ql3_adapter *qdev)
+ if ((value & ISP_CONTROL_SR) == 0)
+ break;
+
+- ssleep(1);
++ mdelay(1000);
+ } while ((--max_wait_time));
+
+ /*
+@@ -3328,7 +3328,7 @@ static int ql_adapter_reset(struct ql3_adapter *qdev)
+ ispControlStatus);
+ if ((value & ISP_CONTROL_FSR) == 0)
+ break;
+- ssleep(1);
++ mdelay(1000);
+ } while ((--max_wait_time));
+ }
+ if (max_wait_time == 0)
+diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
+index b7a0df95d4b0f..9f1777e56d7db 100644
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -750,12 +750,16 @@ static inline void disable_net_traffic(pegasus_t *pegasus)
+ set_registers(pegasus, EthCtrl0, sizeof(tmp), &tmp);
+ }
+
+-static inline void get_interrupt_interval(pegasus_t *pegasus)
++static inline int get_interrupt_interval(pegasus_t *pegasus)
+ {
+ u16 data;
+ u8 interval;
++ int ret;
++
++ ret = read_eprom_word(pegasus, 4, &data);
++ if (ret < 0)
++ return ret;
+
+- read_eprom_word(pegasus, 4, &data);
+ interval = data >> 8;
+ if (pegasus->usb->speed != USB_SPEED_HIGH) {
+ if (interval < 0x80) {
+@@ -770,6 +774,8 @@ static inline void get_interrupt_interval(pegasus_t *pegasus)
+ }
+ }
+ pegasus->intr_interval = interval;
++
++ return 0;
+ }
+
+ static void set_carrier(struct net_device *net)
+@@ -1188,7 +1194,9 @@ static int pegasus_probe(struct usb_interface *intf,
+ | NETIF_MSG_PROBE | NETIF_MSG_LINK);
+
+ pegasus->features = usb_dev_id[dev_index].private;
+- get_interrupt_interval(pegasus);
++ res = get_interrupt_interval(pegasus);
++ if (res)
++ goto out2;
+ if (reset_mac(pegasus)) {
+ dev_err(&intf->dev, "can't reset MAC\n");
+ res = -EIO;
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index d08e1de26030e..54b37a30df18b 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -22,6 +22,7 @@
+ #include <linux/usb/cdc.h>
+ #include <linux/usb/usbnet.h>
+ #include <linux/usb/cdc-wdm.h>
++#include <linux/u64_stats_sync.h>
+
+ /* This driver supports wwan (3G/LTE/?) devices using a vendor
+ * specific management protocol called Qualcomm MSM Interface (QMI) -
+@@ -74,6 +75,7 @@ struct qmimux_hdr {
+ struct qmimux_priv {
+ struct net_device *real_dev;
+ u8 mux_id;
++ struct pcpu_sw_netstats __percpu *stats64;
+ };
+
+ static int qmimux_open(struct net_device *dev)
+@@ -100,19 +102,65 @@ static netdev_tx_t qmimux_start_xmit(struct sk_buff *skb, struct net_device *dev
+ struct qmimux_priv *priv = netdev_priv(dev);
+ unsigned int len = skb->len;
+ struct qmimux_hdr *hdr;
++ netdev_tx_t ret;
+
+ hdr = skb_push(skb, sizeof(struct qmimux_hdr));
+ hdr->pad = 0;
+ hdr->mux_id = priv->mux_id;
+ hdr->pkt_len = cpu_to_be16(len);
+ skb->dev = priv->real_dev;
+- return dev_queue_xmit(skb);
++ ret = dev_queue_xmit(skb);
++
++ if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
++ struct pcpu_sw_netstats *stats64 = this_cpu_ptr(priv->stats64);
++
++ u64_stats_update_begin(&stats64->syncp);
++ stats64->tx_packets++;
++ stats64->tx_bytes += len;
++ u64_stats_update_end(&stats64->syncp);
++ } else {
++ dev->stats.tx_dropped++;
++ }
++
++ return ret;
++}
++
++static void qmimux_get_stats64(struct net_device *net,
++ struct rtnl_link_stats64 *stats)
++{
++ struct qmimux_priv *priv = netdev_priv(net);
++ unsigned int start;
++ int cpu;
++
++ netdev_stats_to_stats64(stats, &net->stats);
++
++ for_each_possible_cpu(cpu) {
++ struct pcpu_sw_netstats *stats64;
++ u64 rx_packets, rx_bytes;
++ u64 tx_packets, tx_bytes;
++
++ stats64 = per_cpu_ptr(priv->stats64, cpu);
++
++ do {
++ start = u64_stats_fetch_begin_irq(&stats64->syncp);
++ rx_packets = stats64->rx_packets;
++ rx_bytes = stats64->rx_bytes;
++ tx_packets = stats64->tx_packets;
++ tx_bytes = stats64->tx_bytes;
++ } while (u64_stats_fetch_retry_irq(&stats64->syncp, start));
++
++ stats->rx_packets += rx_packets;
++ stats->rx_bytes += rx_bytes;
++ stats->tx_packets += tx_packets;
++ stats->tx_bytes += tx_bytes;
++ }
+ }
+
+ static const struct net_device_ops qmimux_netdev_ops = {
+- .ndo_open = qmimux_open,
+- .ndo_stop = qmimux_stop,
+- .ndo_start_xmit = qmimux_start_xmit,
++ .ndo_open = qmimux_open,
++ .ndo_stop = qmimux_stop,
++ .ndo_start_xmit = qmimux_start_xmit,
++ .ndo_get_stats64 = qmimux_get_stats64,
+ };
+
+ static void qmimux_setup(struct net_device *dev)
+@@ -197,8 +245,19 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ }
+
+ skb_put_data(skbn, skb->data + offset + qmimux_hdr_sz, pkt_len);
+- if (netif_rx(skbn) != NET_RX_SUCCESS)
++ if (netif_rx(skbn) != NET_RX_SUCCESS) {
++ net->stats.rx_errors++;
+ return 0;
++ } else {
++ struct pcpu_sw_netstats *stats64;
++ struct qmimux_priv *priv = netdev_priv(net);
++
++ stats64 = this_cpu_ptr(priv->stats64);
++ u64_stats_update_begin(&stats64->syncp);
++ stats64->rx_packets++;
++ stats64->rx_bytes += pkt_len;
++ u64_stats_update_end(&stats64->syncp);
++ }
+
+ skip:
+ offset += len + qmimux_hdr_sz;
+@@ -222,6 +281,12 @@ static int qmimux_register_device(struct net_device *real_dev, u8 mux_id)
+ priv->mux_id = mux_id;
+ priv->real_dev = real_dev;
+
++ priv->stats64 = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
++ if (!priv->stats64) {
++ err = -ENOBUFS;
++ goto out_free_newdev;
++ }
++
+ err = register_netdevice(new_dev);
+ if (err < 0)
+ goto out_free_newdev;
+@@ -252,6 +317,7 @@ static void qmimux_unregister_device(struct net_device *dev,
+ struct qmimux_priv *priv = netdev_priv(dev);
+ struct net_device *real_dev = priv->real_dev;
+
++ free_percpu(priv->stats64);
+ netdev_upper_dev_unlink(real_dev, dev);
+ unregister_netdevice_queue(dev, head);
+
+diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c
+index aae7e6df99cd3..ba13e3c3d6b87 100644
+--- a/drivers/pcmcia/i82092.c
++++ b/drivers/pcmcia/i82092.c
+@@ -105,6 +105,7 @@ static int i82092aa_pci_probe(struct pci_dev *dev, const struct pci_device_id *i
+ for (i = 0;i<socket_count;i++) {
+ sockets[i].card_state = 1; /* 1 = present but empty */
+ sockets[i].io_base = pci_resource_start(dev, 0);
++ sockets[i].dev = dev;
+ sockets[i].socket.features |= SS_CAP_PCCARD;
+ sockets[i].socket.map_size = 0x1000;
+ sockets[i].socket.irq_mask = 0;
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index acf0c244141f4..84dd776d36c33 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -217,7 +217,7 @@ static unsigned int sr_get_events(struct scsi_device *sdev)
+ else if (med->media_event_code == 2)
+ return DISK_EVENT_MEDIA_CHANGE;
+ else if (med->media_event_code == 3)
+- return DISK_EVENT_EJECT_REQUEST;
++ return DISK_EVENT_MEDIA_CHANGE;
+ return 0;
+ }
+
+diff --git a/drivers/spi/spi-meson-spicc.c b/drivers/spi/spi-meson-spicc.c
+index 7fe4488ace579..419756ebf2c05 100644
+--- a/drivers/spi/spi-meson-spicc.c
++++ b/drivers/spi/spi-meson-spicc.c
+@@ -599,6 +599,8 @@ static int meson_spicc_remove(struct platform_device *pdev)
+
+ clk_disable_unprepare(spicc->core);
+
++ spi_master_put(spicc->master);
++
+ return 0;
+ }
+
+diff --git a/drivers/staging/rtl8723bs/hal/sdio_ops.c b/drivers/staging/rtl8723bs/hal/sdio_ops.c
+index d6b93e1f78d8a..8aac87598e620 100644
+--- a/drivers/staging/rtl8723bs/hal/sdio_ops.c
++++ b/drivers/staging/rtl8723bs/hal/sdio_ops.c
+@@ -1077,6 +1077,8 @@ void sd_int_dpc(struct adapter *adapter)
+ } else {
+ rtw_c2h_wk_cmd(adapter, (u8 *)c2h_evt);
+ }
++ } else {
++ kfree(c2h_evt);
+ }
+ } else {
+ /* Error handling for malloc fail */
+diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
+index 7cb7efe62b011..4f4a7e2b122bf 100644
+--- a/drivers/tee/optee/call.c
++++ b/drivers/tee/optee/call.c
+@@ -413,11 +413,13 @@ void optee_enable_shm_cache(struct optee *optee)
+ }
+
+ /**
+- * optee_disable_shm_cache() - Disables caching of some shared memory allocation
+- * in OP-TEE
++ * __optee_disable_shm_cache() - Disables caching of some shared memory
++ * allocation in OP-TEE
+ * @optee: main service struct
++ * @is_mapped: true if the cached shared memory addresses were mapped by this
++ * kernel, are safe to dereference, and should be freed
+ */
+-void optee_disable_shm_cache(struct optee *optee)
++static void __optee_disable_shm_cache(struct optee *optee, bool is_mapped)
+ {
+ struct optee_call_waiter w;
+
+@@ -436,6 +438,13 @@ void optee_disable_shm_cache(struct optee *optee)
+ if (res.result.status == OPTEE_SMC_RETURN_OK) {
+ struct tee_shm *shm;
+
++ /*
++ * Shared memory references that were not mapped by
++ * this kernel must be ignored to prevent a crash.
++ */
++ if (!is_mapped)
++ continue;
++
+ shm = reg_pair_to_ptr(res.result.shm_upper32,
+ res.result.shm_lower32);
+ tee_shm_free(shm);
+@@ -446,6 +455,27 @@ void optee_disable_shm_cache(struct optee *optee)
+ optee_cq_wait_final(&optee->call_queue, &w);
+ }
+
++/**
++ * optee_disable_shm_cache() - Disables caching of mapped shared memory
++ * allocations in OP-TEE
++ * @optee: main service struct
++ */
++void optee_disable_shm_cache(struct optee *optee)
++{
++ return __optee_disable_shm_cache(optee, true);
++}
++
++/**
++ * optee_disable_unmapped_shm_cache() - Disables caching of shared memory
++ * allocations in OP-TEE which are not
++ * currently mapped
++ * @optee: main service struct
++ */
++void optee_disable_unmapped_shm_cache(struct optee *optee)
++{
++ return __optee_disable_shm_cache(optee, false);
++}
++
+ #define PAGELIST_ENTRIES_PER_PAGE \
+ ((OPTEE_MSG_NONCONTIG_PAGE_SIZE / sizeof(u64)) - 1)
+
+diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
+index 1d71fcb13dba6..473981e3ad70b 100644
+--- a/drivers/tee/optee/core.c
++++ b/drivers/tee/optee/core.c
+@@ -619,6 +619,15 @@ static struct optee *optee_probe(struct device_node *np)
+ optee->memremaped_shm = memremaped_shm;
+ optee->pool = pool;
+
++ /*
++ * Ensure that there are no pre-existing shm objects before enabling
++ * the shm cache so that there's no chance of receiving an invalid
++ * address during shutdown. This could occur, for example, if we're
++ * kexec booting from an older kernel that did not properly cleanup the
++ * shm cache.
++ */
++ optee_disable_unmapped_shm_cache(optee);
++
+ optee_enable_shm_cache(optee);
+
+ pr_info("initialized driver\n");
+diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h
+index 35e79386c556b..489039acb16ca 100644
+--- a/drivers/tee/optee/optee_private.h
++++ b/drivers/tee/optee/optee_private.h
+@@ -160,6 +160,7 @@ int optee_cancel_req(struct tee_context *ctx, u32 cancel_id, u32 session);
+
+ void optee_enable_shm_cache(struct optee *optee);
+ void optee_disable_shm_cache(struct optee *optee);
++void optee_disable_unmapped_shm_cache(struct optee *optee);
+
+ int optee_shm_register(struct tee_context *ctx, struct tee_shm *shm,
+ struct page **pages, size_t num_pages,
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 56693dfe0f5b7..68f71298c11b5 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -313,7 +313,11 @@ static const struct serial8250_config uart_config[] = {
+ /* Uart divisor latch read */
+ static int default_serial_dl_read(struct uart_8250_port *up)
+ {
+- return serial_in(up, UART_DLL) | serial_in(up, UART_DLM) << 8;
++ /* Assign these in pieces to truncate any bits above 7. */
++ unsigned char dll = serial_in(up, UART_DLL);
++ unsigned char dlm = serial_in(up, UART_DLM);
++
++ return dll | dlm << 8;
+ }
+
+ /* Uart divisor latch write */
+@@ -1301,9 +1305,11 @@ static void autoconfig(struct uart_8250_port *up)
+ serial_out(up, UART_LCR, 0);
+
+ serial_out(up, UART_FCR, UART_FCR_ENABLE_FIFO);
+- scratch = serial_in(up, UART_IIR) >> 6;
+
+- switch (scratch) {
++ /* Assign this as it is to truncate any bits above 7. */
++ scratch = serial_in(up, UART_IIR);
++
++ switch (scratch >> 6) {
+ case 0:
+ autoconfig_8250(up);
+ break;
+diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
+index e6a7c86b70f25..5c98f561272dd 100644
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -1537,17 +1537,10 @@ static void usbtmc_interrupt(struct urb *urb)
+ dev_err(dev, "overflow with length %d, actual length is %d\n",
+ data->iin_wMaxPacketSize, urb->actual_length);
+ /* fall through */
+- case -ECONNRESET:
+- case -ENOENT:
+- case -ESHUTDOWN:
+- case -EILSEQ:
+- case -ETIME:
+- case -EPIPE:
++ default:
+ /* urb terminated, clean up */
+ dev_dbg(dev, "urb terminated, status: %d\n", status);
+ return;
+- default:
+- dev_err(dev, "unknown status received: %d\n", status);
+ }
+ exit:
+ rv = usb_submit_urb(urb, GFP_ATOMIC);
+diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c
+index 3740cf95560e9..0697fde51d00f 100644
+--- a/drivers/usb/common/usb-otg-fsm.c
++++ b/drivers/usb/common/usb-otg-fsm.c
+@@ -193,7 +193,11 @@ static void otg_start_hnp_polling(struct otg_fsm *fsm)
+ if (!fsm->host_req_flag)
+ return;
+
+- INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work);
++ if (!fsm->hnp_work_inited) {
++ INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work);
++ fsm->hnp_work_inited = true;
++ }
++
+ schedule_delayed_work(&fsm->hnp_polling_work,
+ msecs_to_jiffies(T_HOST_REQ_POLL));
+ }
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index fa8a8e04008ae..1d10d29c115bc 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -41,6 +41,7 @@ struct f_hidg {
+ unsigned char bInterfaceSubClass;
+ unsigned char bInterfaceProtocol;
+ unsigned char protocol;
++ unsigned char idle;
+ unsigned short report_desc_length;
+ char *report_desc;
+ unsigned short report_length;
+@@ -344,6 +345,11 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
+
+ spin_lock_irqsave(&hidg->write_spinlock, flags);
+
++ if (!hidg->req) {
++ spin_unlock_irqrestore(&hidg->write_spinlock, flags);
++ return -ESHUTDOWN;
++ }
++
+ #define WRITE_COND (!hidg->write_pending)
+ try_again:
+ /* write queue */
+@@ -364,8 +370,14 @@ try_again:
+ count = min_t(unsigned, count, hidg->report_length);
+
+ spin_unlock_irqrestore(&hidg->write_spinlock, flags);
+- status = copy_from_user(req->buf, buffer, count);
+
++ if (!req) {
++ ERROR(hidg->func.config->cdev, "hidg->req is NULL\n");
++ status = -ESHUTDOWN;
++ goto release_write_pending;
++ }
++
++ status = copy_from_user(req->buf, buffer, count);
+ if (status != 0) {
+ ERROR(hidg->func.config->cdev,
+ "copy_from_user error\n");
+@@ -393,14 +405,17 @@ try_again:
+
+ spin_unlock_irqrestore(&hidg->write_spinlock, flags);
+
++ if (!hidg->in_ep->enabled) {
++ ERROR(hidg->func.config->cdev, "in_ep is disabled\n");
++ status = -ESHUTDOWN;
++ goto release_write_pending;
++ }
++
+ status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
+- if (status < 0) {
+- ERROR(hidg->func.config->cdev,
+- "usb_ep_queue error on int endpoint %zd\n", status);
++ if (status < 0)
+ goto release_write_pending;
+- } else {
++ else
+ status = count;
+- }
+
+ return status;
+ release_write_pending:
+@@ -529,6 +544,14 @@ static int hidg_setup(struct usb_function *f,
+ goto respond;
+ break;
+
++ case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
++ | HID_REQ_GET_IDLE):
++ VDBG(cdev, "get_idle\n");
++ length = min_t(unsigned int, length, 1);
++ ((u8 *) req->buf)[0] = hidg->idle;
++ goto respond;
++ break;
++
+ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
+ | HID_REQ_SET_REPORT):
+ VDBG(cdev, "set_report | wLength=%d\n", ctrl->wLength);
+@@ -552,6 +575,14 @@ static int hidg_setup(struct usb_function *f,
+ goto stall;
+ break;
+
++ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
++ | HID_REQ_SET_IDLE):
++ VDBG(cdev, "set_idle\n");
++ length = 0;
++ hidg->idle = value >> 8;
++ goto respond;
++ break;
++
+ case ((USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_INTERFACE) << 8
+ | USB_REQ_GET_DESCRIPTOR):
+ switch (value >> 8) {
+@@ -779,6 +810,7 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
+ hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass;
+ hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol;
+ hidg->protocol = HID_REPORT_PROTOCOL;
++ hidg->idle = 1;
+ hidg_ss_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length);
+ hidg_ss_in_comp_desc.wBytesPerInterval =
+ cpu_to_le16(hidg->report_length);
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index c87cb25e70ec5..e6dce35ca1aa9 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -625,6 +625,7 @@ static struct usb_serial_driver ch341_device = {
+ .owner = THIS_MODULE,
+ .name = "ch341-uart",
+ },
++ .bulk_in_size = 512,
+ .id_table = id_table,
+ .num_ports = 1,
+ .open = ch341_open,
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 8242bf6863035..784d281eb8479 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -209,6 +209,7 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_R2000KU_TRUE_RNG) },
+ { USB_DEVICE(FTDI_VID, FTDI_VARDAAN_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_AUTO_M3_OP_COM_V2_PID) },
+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0100_PID) },
+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0101_PID) },
+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0102_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index add602bebd820..755858ca20bac 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -159,6 +159,9 @@
+ /* Vardaan Enterprises Serial Interface VEUSB422R3 */
+ #define FTDI_VARDAAN_PID 0xF070
+
++/* Auto-M3 Ltd. - OP-COM USB V2 - OBD interface Adapter */
++#define FTDI_AUTO_M3_OP_COM_V2_PID 0x4f50
++
+ /*
+ * Xsens Technologies BV products (http://www.xsens.com).
+ */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 9370c6fa7bc80..e6103a27e4403 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1203,6 +1203,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(2) | RSVD(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */
+ .driver_info = NCTRL(0) | RSVD(1) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */
++ .driver_info = NCTRL(2) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 358f6378882f4..797fe41d071f0 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2317,7 +2317,7 @@ again:
+ goto journal_error;
+ err = ext4_handle_dirty_dx_node(handle, dir,
+ frame->bh);
+- if (err)
++ if (restart || err)
+ goto journal_error;
+ } else {
+ struct dx_root *dxroot;
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 2a297bce381f5..1489257a6c95f 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -29,6 +29,21 @@
+
+ #include "internal.h"
+
++/*
++ * New pipe buffers will be restricted to this size while the user is exceeding
++ * their pipe buffer quota. The general pipe use case needs at least two
++ * buffers: one for data yet to be read, and one for new data. If this is less
++ * than two, then a write to a non-empty pipe may block even if the pipe is not
++ * full. This can occur with GNU make jobserver or similar uses of pipes as
++ * semaphores: multiple processes may be waiting to write tokens back to the
++ * pipe before reading tokens: https://lore.kernel.org/lkml/1628086770.5rn8p04n6j.none@localhost/.
++ *
++ * Users can reduce their pipe buffers with F_SETPIPE_SZ below this at their
++ * own risk, namely: pipe writes to non-full pipes may block until the pipe is
++ * emptied.
++ */
++#define PIPE_MIN_DEF_BUFFERS 2
++
+ /*
+ * The max size that a non-root user is allowed to grow the pipe. Can
+ * be set by root in /proc/sys/fs/pipe-max-size
+@@ -654,8 +669,8 @@ struct pipe_inode_info *alloc_pipe_info(void)
+ user_bufs = account_pipe_buffers(user, 0, pipe_bufs);
+
+ if (too_many_pipe_buffers_soft(user_bufs) && is_unprivileged_user()) {
+- user_bufs = account_pipe_buffers(user, pipe_bufs, 1);
+- pipe_bufs = 1;
++ user_bufs = account_pipe_buffers(user, pipe_bufs, PIPE_MIN_DEF_BUFFERS);
++ pipe_bufs = PIPE_MIN_DEF_BUFFERS;
+ }
+
+ if (too_many_pipe_buffers_hard(user_bufs) && is_unprivileged_user())
+diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
+index 5229038852ca1..4ebad6781b0e3 100644
+--- a/fs/reiserfs/stree.c
++++ b/fs/reiserfs/stree.c
+@@ -387,6 +387,24 @@ void pathrelse(struct treepath *search_path)
+ search_path->path_length = ILLEGAL_PATH_ELEMENT_OFFSET;
+ }
+
++static int has_valid_deh_location(struct buffer_head *bh, struct item_head *ih)
++{
++ struct reiserfs_de_head *deh;
++ int i;
++
++ deh = B_I_DEH(bh, ih);
++ for (i = 0; i < ih_entry_count(ih); i++) {
++ if (deh_location(&deh[i]) > ih_item_len(ih)) {
++ reiserfs_warning(NULL, "reiserfs-5094",
++ "directory entry location seems wrong %h",
++ &deh[i]);
++ return 0;
++ }
++ }
++
++ return 1;
++}
++
+ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh)
+ {
+ struct block_head *blkh;
+@@ -454,11 +472,14 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh)
+ "(second one): %h", ih);
+ return 0;
+ }
+- if (is_direntry_le_ih(ih) && (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE))) {
+- reiserfs_warning(NULL, "reiserfs-5093",
+- "item entry count seems wrong %h",
+- ih);
+- return 0;
++ if (is_direntry_le_ih(ih)) {
++ if (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE)) {
++ reiserfs_warning(NULL, "reiserfs-5093",
++ "item entry count seems wrong %h",
++ ih);
++ return 0;
++ }
++ return has_valid_deh_location(bh, ih);
+ }
+ prev_location = ih_location(ih);
+ }
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index ec5716dd58c23..831a542c22c66 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -2085,6 +2085,14 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
+ unlock_new_inode(root_inode);
+ }
+
++ if (!S_ISDIR(root_inode->i_mode) || !inode_get_bytes(root_inode) ||
++ !root_inode->i_size) {
++ SWARN(silent, s, "", "corrupt root inode, run fsck");
++ iput(root_inode);
++ errval = -EUCLEAN;
++ goto error;
++ }
++
+ s->s_root = d_make_root(root_inode);
+ if (!s->s_root)
+ goto error;
+diff --git a/include/linux/usb/otg-fsm.h b/include/linux/usb/otg-fsm.h
+index e78eb577d0fa1..8ef7d148c1493 100644
+--- a/include/linux/usb/otg-fsm.h
++++ b/include/linux/usb/otg-fsm.h
+@@ -196,6 +196,7 @@ struct otg_fsm {
+ struct mutex lock;
+ u8 *host_req_flag;
+ struct delayed_work hnp_polling_work;
++ bool hnp_work_inited;
+ bool state_changed;
+ };
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 6a61faf0cc79a..75d892dc77969 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1042,6 +1042,7 @@ struct hci_dev *hci_alloc_dev(void);
+ void hci_free_dev(struct hci_dev *hdev);
+ int hci_register_dev(struct hci_dev *hdev);
+ void hci_unregister_dev(struct hci_dev *hdev);
++void hci_cleanup_dev(struct hci_dev *hdev);
+ int hci_suspend_dev(struct hci_dev *hdev);
+ int hci_resume_dev(struct hci_dev *hdev);
+ int hci_reset_dev(struct hci_dev *hdev);
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index a8f5410ae0d4b..f237573a26513 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -243,7 +243,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+
+ static inline unsigned int ip6_skb_dst_mtu(struct sk_buff *skb)
+ {
+- int mtu;
++ unsigned int mtu;
+
+ struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
+ inet6_sk(skb->sk) : NULL;
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 895026ccfea27..8168403427a67 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4727,6 +4727,10 @@ static const char readme_msg[] =
+ "\t [:pause][:continue][:clear]\n"
+ "\t [:name=histname1]\n"
+ "\t [if <filter>]\n\n"
++ "\t Note, special fields can be used as well:\n"
++ "\t common_timestamp - to record current timestamp\n"
++ "\t common_cpu - to record the CPU the event happened on\n"
++ "\n"
+ "\t When a matching event is hit, an entry is added to a hash\n"
+ "\t table using the key(s) and value(s) named, and the value of a\n"
+ "\t sum called 'hitcount' is incremented. Keys and values\n"
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 28e4ff45cb4c5..6d2a69652c391 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -1773,7 +1773,7 @@ static const char *hist_field_name(struct hist_field *field,
+ field->flags & HIST_FIELD_FL_ALIAS)
+ field_name = hist_field_name(field->operands[0], ++level);
+ else if (field->flags & HIST_FIELD_FL_CPU)
+- field_name = "cpu";
++ field_name = "common_cpu";
+ else if (field->flags & HIST_FIELD_FL_EXPR ||
+ field->flags & HIST_FIELD_FL_VAR_REF) {
+ if (field->system) {
+@@ -2627,14 +2627,23 @@ parse_field(struct hist_trigger_data *hist_data, struct trace_event_file *file,
+ hist_data->enable_timestamps = true;
+ if (*flags & HIST_FIELD_FL_TIMESTAMP_USECS)
+ hist_data->attrs->ts_in_usecs = true;
+- } else if (strcmp(field_name, "cpu") == 0)
++ } else if (strcmp(field_name, "common_cpu") == 0)
+ *flags |= HIST_FIELD_FL_CPU;
+ else {
+ field = trace_find_event_field(file->event_call, field_name);
+ if (!field || !field->size) {
+- hist_err("Couldn't find field: ", field_name);
+- field = ERR_PTR(-EINVAL);
+- goto out;
++ /*
++ * For backward compatibility, if field_name
++ * was "cpu", then we treat this the same as
++ * common_cpu.
++ */
++ if (strcmp(field_name, "cpu") == 0) {
++ *flags |= HIST_FIELD_FL_CPU;
++ } else {
++ hist_err("Couldn't find field: ", field_name);
++ field = ERR_PTR(-EINVAL);
++ goto out;
++ }
+ }
+ }
+ out:
+@@ -2911,6 +2920,10 @@ static struct hist_field *parse_expr(struct hist_trigger_data *hist_data,
+
+ expr->operands[0] = operand1;
+ expr->operands[1] = operand2;
++
++ /* The operand sizes should be the same, so just pick one */
++ expr->size = operand1->size;
++
+ expr->operator = field_op;
+ expr->name = expr_str(expr, 0);
+ expr->type = kstrdup(operand1->type, GFP_KERNEL);
+@@ -5048,7 +5061,7 @@ static void hist_field_print(struct seq_file *m, struct hist_field *hist_field)
+ seq_printf(m, "%s=", hist_field->var.name);
+
+ if (hist_field->flags & HIST_FIELD_FL_CPU)
+- seq_puts(m, "cpu");
++ seq_puts(m, "common_cpu");
+ else if (field_name) {
+ if (hist_field->flags & HIST_FIELD_FL_VAR_REF ||
+ hist_field->flags & HIST_FIELD_FL_ALIAS)
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 219cdbb476fb7..7a85f215da45c 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3261,14 +3261,10 @@ EXPORT_SYMBOL(hci_register_dev);
+ /* Unregister HCI device */
+ void hci_unregister_dev(struct hci_dev *hdev)
+ {
+- int id;
+-
+ BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
+
+ hci_dev_set_flag(hdev, HCI_UNREGISTER);
+
+- id = hdev->id;
+-
+ write_lock(&hci_dev_list_lock);
+ list_del(&hdev->list);
+ write_unlock(&hci_dev_list_lock);
+@@ -3297,7 +3293,14 @@ void hci_unregister_dev(struct hci_dev *hdev)
+ }
+
+ device_del(&hdev->dev);
++ /* Actual cleanup is deferred until hci_cleanup_dev(). */
++ hci_dev_put(hdev);
++}
++EXPORT_SYMBOL(hci_unregister_dev);
+
++/* Cleanup HCI device */
++void hci_cleanup_dev(struct hci_dev *hdev)
++{
+ debugfs_remove_recursive(hdev->debugfs);
+ kfree_const(hdev->hw_info);
+ kfree_const(hdev->fw_info);
+@@ -3320,11 +3323,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
+ hci_discovery_filter_clear(hdev);
+ hci_dev_unlock(hdev);
+
+- hci_dev_put(hdev);
+-
+- ida_simple_remove(&hci_index_ida, id);
++ ida_simple_remove(&hci_index_ida, hdev->id);
+ }
+-EXPORT_SYMBOL(hci_unregister_dev);
+
+ /* Suspend HCI device */
+ int hci_suspend_dev(struct hci_dev *hdev)
+diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
+index 06156de24c50b..3ba0c6df73ce9 100644
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -59,6 +59,17 @@ struct hci_pinfo {
+ char comm[TASK_COMM_LEN];
+ };
+
++static struct hci_dev *hci_hdev_from_sock(struct sock *sk)
++{
++ struct hci_dev *hdev = hci_pi(sk)->hdev;
++
++ if (!hdev)
++ return ERR_PTR(-EBADFD);
++ if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
++ return ERR_PTR(-EPIPE);
++ return hdev;
++}
++
+ void hci_sock_set_flag(struct sock *sk, int nr)
+ {
+ set_bit(nr, &hci_pi(sk)->flags);
+@@ -752,19 +763,13 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event)
+ if (event == HCI_DEV_UNREG) {
+ struct sock *sk;
+
+- /* Detach sockets from device */
++ /* Wake up sockets using this dead device */
+ read_lock(&hci_sk_list.lock);
+ sk_for_each(sk, &hci_sk_list.head) {
+- lock_sock(sk);
+ if (hci_pi(sk)->hdev == hdev) {
+- hci_pi(sk)->hdev = NULL;
+ sk->sk_err = EPIPE;
+- sk->sk_state = BT_OPEN;
+ sk->sk_state_change(sk);
+-
+- hci_dev_put(hdev);
+ }
+- release_sock(sk);
+ }
+ read_unlock(&hci_sk_list.lock);
+ }
+@@ -923,10 +928,10 @@ static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
+ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
+ unsigned long arg)
+ {
+- struct hci_dev *hdev = hci_pi(sk)->hdev;
++ struct hci_dev *hdev = hci_hdev_from_sock(sk);
+
+- if (!hdev)
+- return -EBADFD;
++ if (IS_ERR(hdev))
++ return PTR_ERR(hdev);
+
+ if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
+ return -EBUSY;
+@@ -1080,6 +1085,18 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
+
+ lock_sock(sk);
+
++ /* Allow detaching from dead device and attaching to alive device, if
++ * the caller wants to re-bind (instead of close) this socket in
++ * response to hci_sock_dev_event(HCI_DEV_UNREG) notification.
++ */
++ hdev = hci_pi(sk)->hdev;
++ if (hdev && hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
++ hci_pi(sk)->hdev = NULL;
++ sk->sk_state = BT_OPEN;
++ hci_dev_put(hdev);
++ }
++ hdev = NULL;
++
+ if (sk->sk_state == BT_BOUND) {
+ err = -EALREADY;
+ goto done;
+@@ -1356,9 +1373,9 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
+
+ lock_sock(sk);
+
+- hdev = hci_pi(sk)->hdev;
+- if (!hdev) {
+- err = -EBADFD;
++ hdev = hci_hdev_from_sock(sk);
++ if (IS_ERR(hdev)) {
++ err = PTR_ERR(hdev);
+ goto done;
+ }
+
+@@ -1718,9 +1735,9 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
+ goto done;
+ }
+
+- hdev = hci_pi(sk)->hdev;
+- if (!hdev) {
+- err = -EBADFD;
++ hdev = hci_hdev_from_sock(sk);
++ if (IS_ERR(hdev)) {
++ err = PTR_ERR(hdev);
+ goto done;
+ }
+
+diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
+index 9874844a95a98..b69d88b88d2e4 100644
+--- a/net/bluetooth/hci_sysfs.c
++++ b/net/bluetooth/hci_sysfs.c
+@@ -83,6 +83,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
+ static void bt_host_release(struct device *dev)
+ {
+ struct hci_dev *hdev = to_hci_dev(dev);
++
++ if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
++ hci_cleanup_dev(hdev);
+ kfree(hdev);
+ module_put(THIS_MODULE);
+ }
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index b2ca66c4a21d2..9e0c98df20daf 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -880,14 +880,18 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,
+ memcpy(key->data, &auth_key->sca_key[0], auth_key->sca_keylength);
+ cur_key->key = key;
+
+- if (replace) {
+- list_del_init(&shkey->key_list);
+- sctp_auth_shkey_release(shkey);
+- if (asoc && asoc->active_key_id == auth_key->sca_keynumber)
+- sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL);
++ if (!replace) {
++ list_add(&cur_key->key_list, sh_keys);
++ return 0;
+ }
++
++ list_del_init(&shkey->key_list);
++ sctp_auth_shkey_release(shkey);
+ list_add(&cur_key->key_list, sh_keys);
+
++ if (asoc && asoc->active_key_id == auth_key->sca_keynumber)
++ sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL);
++
+ return 0;
+ }
+
+diff --git a/scripts/tracing/draw_functrace.py b/scripts/tracing/draw_functrace.py
+index 9b6dd4f36335b..5706b42be3d27 100755
+--- a/scripts/tracing/draw_functrace.py
++++ b/scripts/tracing/draw_functrace.py
+@@ -17,7 +17,7 @@ Usage:
+ $ cat /sys/kernel/debug/tracing/trace_pipe > ~/raw_trace_func
+ Wait some times but not too much, the script is a bit slow.
+ Break the pipe (Ctrl + Z)
+- $ scripts/draw_functrace.py < raw_trace_func > draw_functrace
++ $ scripts/tracing/draw_functrace.py < ~/raw_trace_func > draw_functrace
+ Then you have your drawn trace in draw_functrace
+ """
+
+@@ -103,10 +103,10 @@ def parseLine(line):
+ line = line.strip()
+ if line.startswith("#"):
+ raise CommentLineException
+- m = re.match("[^]]+?\\] +([0-9.]+): (\\w+) <-(\\w+)", line)
++ m = re.match("[^]]+?\\] +([a-z.]+) +([0-9.]+): (\\w+) <-(\\w+)", line)
+ if m is None:
+ raise BrokenLineException
+- return (m.group(1), m.group(2), m.group(3))
++ return (m.group(2), m.group(3), m.group(4))
+
+
+ def main():
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index 16289aefb443a..efecb8b8e7b16 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -532,10 +532,11 @@ static int check_and_subscribe_port(struct snd_seq_client *client,
+ return err;
+ }
+
+-static void delete_and_unsubscribe_port(struct snd_seq_client *client,
+- struct snd_seq_client_port *port,
+- struct snd_seq_subscribers *subs,
+- bool is_src, bool ack)
++/* called with grp->list_mutex held */
++static void __delete_and_unsubscribe_port(struct snd_seq_client *client,
++ struct snd_seq_client_port *port,
++ struct snd_seq_subscribers *subs,
++ bool is_src, bool ack)
+ {
+ struct snd_seq_port_subs_info *grp;
+ struct list_head *list;
+@@ -543,7 +544,6 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
+
+ grp = is_src ? &port->c_src : &port->c_dest;
+ list = is_src ? &subs->src_list : &subs->dest_list;
+- down_write(&grp->list_mutex);
+ write_lock_irq(&grp->list_lock);
+ empty = list_empty(list);
+ if (!empty)
+@@ -553,6 +553,18 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
+
+ if (!empty)
+ unsubscribe_port(client, port, grp, &subs->info, ack);
++}
++
++static void delete_and_unsubscribe_port(struct snd_seq_client *client,
++ struct snd_seq_client_port *port,
++ struct snd_seq_subscribers *subs,
++ bool is_src, bool ack)
++{
++ struct snd_seq_port_subs_info *grp;
++
++ grp = is_src ? &port->c_src : &port->c_dest;
++ down_write(&grp->list_mutex);
++ __delete_and_unsubscribe_port(client, port, subs, is_src, ack);
+ up_write(&grp->list_mutex);
+ }
+
+@@ -608,27 +620,30 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector,
+ struct snd_seq_client_port *dest_port,
+ struct snd_seq_port_subscribe *info)
+ {
+- struct snd_seq_port_subs_info *src = &src_port->c_src;
++ struct snd_seq_port_subs_info *dest = &dest_port->c_dest;
+ struct snd_seq_subscribers *subs;
+ int err = -ENOENT;
+
+- down_write(&src->list_mutex);
++ /* always start from deleting the dest port for avoiding concurrent
++ * deletions
++ */
++ down_write(&dest->list_mutex);
+ /* look for the connection */
+- list_for_each_entry(subs, &src->list_head, src_list) {
++ list_for_each_entry(subs, &dest->list_head, dest_list) {
+ if (match_subs_info(info, &subs->info)) {
+- atomic_dec(&subs->ref_count); /* mark as not ready */
++ __delete_and_unsubscribe_port(dest_client, dest_port,
++ subs, false,
++ connector->number != dest_client->number);
+ err = 0;
+ break;
+ }
+ }
+- up_write(&src->list_mutex);
++ up_write(&dest->list_mutex);
+ if (err < 0)
+ return err;
+
+ delete_and_unsubscribe_port(src_client, src_port, subs, true,
+ connector->number != src_client->number);
+- delete_and_unsubscribe_port(dest_client, dest_port, subs, false,
+- connector->number != dest_client->number);
+ kfree(subs);
+ return 0;
+ }
+diff --git a/sound/usb/clock.c b/sound/usb/clock.c
+index 863ac42076e55..d1455fb2c6fca 100644
+--- a/sound/usb/clock.c
++++ b/sound/usb/clock.c
+@@ -296,6 +296,12 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip,
+ selector->baCSourceID[ret - 1],
+ visited, validate);
+ if (ret > 0) {
++ /*
++ * For Samsung USBC Headset (AKG), setting clock selector again
++ * will result in incorrect default clock setting problems
++ */
++ if (chip->usb_id == USB_ID(0x04e8, 0xa051))
++ return ret;
+ err = uac_clock_selector_set_val(chip, entity_id, cur);
+ if (err < 0)
+ return err;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 87d3ea9796384..4114594e57a30 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1555,6 +1555,7 @@ static const struct registration_quirk registration_quirks[] = {
+ REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
+ REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */
++ REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */
+ { 0 } /* terminator */
+ };
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-08-15 20:07 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-08-15 20:07 UTC (permalink / raw
To: gentoo-commits
commit: b8fb76f331e61bb279309ae39b860435aa6748c1
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Aug 15 20:07:18 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Aug 15 20:07:18 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b8fb76f3
Linux patch 4.19.204
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1203_linux-4.19.204.patch | 434 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 438 insertions(+)
diff --git a/0000_README b/0000_README
index d01fd15..398311f 100644
--- a/0000_README
+++ b/0000_README
@@ -851,6 +851,10 @@ Patch: 1202_linux-4.19.203.patch
From: https://www.kernel.org
Desc: Linux 4.19.203
+Patch: 1203_linux-4.19.204.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.204
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1203_linux-4.19.204.patch b/1203_linux-4.19.204.patch
new file mode 100644
index 0000000..94c62e8
--- /dev/null
+++ b/1203_linux-4.19.204.patch
@@ -0,0 +1,434 @@
+diff --git a/Documentation/virtual/kvm/mmu.txt b/Documentation/virtual/kvm/mmu.txt
+index e507a9e0421ed..851a8abcadce4 100644
+--- a/Documentation/virtual/kvm/mmu.txt
++++ b/Documentation/virtual/kvm/mmu.txt
+@@ -152,8 +152,8 @@ Shadow pages contain the following information:
+ shadow pages) so role.quadrant takes values in the range 0..3. Each
+ quadrant maps 1GB virtual address space.
+ role.access:
+- Inherited guest access permissions in the form uwx. Note execute
+- permission is positive, not negative.
++ Inherited guest access permissions from the parent ptes in the form uwx.
++ Note execute permission is positive, not negative.
+ role.invalid:
+ The page is invalid and should not be used. It is a root page that is
+ currently pinned (by a cpu hardware register pointing to it); once it is
+diff --git a/Makefile b/Makefile
+index 6d2670300d470..d4ffcafb8efad 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 203
++SUBLEVEL = 204
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index 8220190b06050..9e15818de9737 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -93,8 +93,8 @@ struct guest_walker {
+ gpa_t pte_gpa[PT_MAX_FULL_LEVELS];
+ pt_element_t __user *ptep_user[PT_MAX_FULL_LEVELS];
+ bool pte_writable[PT_MAX_FULL_LEVELS];
+- unsigned pt_access;
+- unsigned pte_access;
++ unsigned int pt_access[PT_MAX_FULL_LEVELS];
++ unsigned int pte_access;
+ gfn_t gfn;
+ struct x86_exception fault;
+ };
+@@ -388,13 +388,15 @@ retry_walk:
+ }
+
+ walker->ptes[walker->level - 1] = pte;
++
++ /* Convert to ACC_*_MASK flags for struct guest_walker. */
++ walker->pt_access[walker->level - 1] = FNAME(gpte_access)(pt_access ^ walk_nx_mask);
+ } while (!is_last_gpte(mmu, walker->level, pte));
+
+ pte_pkey = FNAME(gpte_pkeys)(vcpu, pte);
+ accessed_dirty = have_ad ? pte_access & PT_GUEST_ACCESSED_MASK : 0;
+
+ /* Convert to ACC_*_MASK flags for struct guest_walker. */
+- walker->pt_access = FNAME(gpte_access)(pt_access ^ walk_nx_mask);
+ walker->pte_access = FNAME(gpte_access)(pte_access ^ walk_nx_mask);
+ errcode = permission_fault(vcpu, mmu, walker->pte_access, pte_pkey, access);
+ if (unlikely(errcode))
+@@ -433,7 +435,8 @@ retry_walk:
+ }
+
+ pgprintk("%s: pte %llx pte_access %x pt_access %x\n",
+- __func__, (u64)pte, walker->pte_access, walker->pt_access);
++ __func__, (u64)pte, walker->pte_access,
++ walker->pt_access[walker->level - 1]);
+ return 1;
+
+ error:
+@@ -602,7 +605,7 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gpa_t addr,
+ {
+ struct kvm_mmu_page *sp = NULL;
+ struct kvm_shadow_walk_iterator it;
+- unsigned direct_access, access = gw->pt_access;
++ unsigned int direct_access, access;
+ int top_level, ret;
+ gfn_t gfn, base_gfn;
+
+@@ -634,6 +637,7 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gpa_t addr,
+ sp = NULL;
+ if (!is_shadow_present_pte(*it.sptep)) {
+ table_gfn = gw->table_gfn[it.level - 2];
++ access = gw->pt_access[it.level - 2];
+ sp = kvm_mmu_get_page(vcpu, table_gfn, addr, it.level-1,
+ false, access);
+ }
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index bd463d6842370..72d729f34437d 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1780,7 +1780,7 @@ static void __sev_asid_free(int asid)
+
+ for_each_possible_cpu(cpu) {
+ sd = per_cpu(svm_data, cpu);
+- sd->sev_vmcbs[pos] = NULL;
++ sd->sev_vmcbs[asid] = NULL;
+ }
+ }
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+index c77c81eb7ab3b..edb2215f99930 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+@@ -1177,9 +1177,8 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
+ }
+
+ dev_info(dev,
+- "Xilinx EmacLite at 0x%08X mapped to 0x%08X, irq=%d\n",
+- (unsigned int __force)ndev->mem_start,
+- (unsigned int __force)lp->base_addr, ndev->irq);
++ "Xilinx EmacLite at 0x%08X mapped to 0x%p, irq=%d\n",
++ (unsigned int __force)ndev->mem_start, lp->base_addr, ndev->irq);
+ return 0;
+
+ error:
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 3e014ecffef8e..1af47aaa7ba57 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -287,7 +287,7 @@ static struct channel *ppp_find_channel(struct ppp_net *pn, int unit);
+ static int ppp_connect_channel(struct channel *pch, int unit);
+ static int ppp_disconnect_channel(struct channel *pch);
+ static void ppp_destroy_channel(struct channel *pch);
+-static int unit_get(struct idr *p, void *ptr);
++static int unit_get(struct idr *p, void *ptr, int min);
+ static int unit_set(struct idr *p, void *ptr, int n);
+ static void unit_put(struct idr *p, int n);
+ static void *unit_find(struct idr *p, int n);
+@@ -963,9 +963,20 @@ static int ppp_unit_register(struct ppp *ppp, int unit, bool ifname_is_set)
+ mutex_lock(&pn->all_ppp_mutex);
+
+ if (unit < 0) {
+- ret = unit_get(&pn->units_idr, ppp);
++ ret = unit_get(&pn->units_idr, ppp, 0);
+ if (ret < 0)
+ goto err;
++ if (!ifname_is_set) {
++ while (1) {
++ snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ret);
++ if (!__dev_get_by_name(ppp->ppp_net, ppp->dev->name))
++ break;
++ unit_put(&pn->units_idr, ret);
++ ret = unit_get(&pn->units_idr, ppp, ret + 1);
++ if (ret < 0)
++ goto err;
++ }
++ }
+ } else {
+ /* Caller asked for a specific unit number. Fail with -EEXIST
+ * if unavailable. For backward compatibility, return -EEXIST
+@@ -3252,9 +3263,9 @@ static int unit_set(struct idr *p, void *ptr, int n)
+ }
+
+ /* get new free unit number and associate pointer with it */
+-static int unit_get(struct idr *p, void *ptr)
++static int unit_get(struct idr *p, void *ptr, int min)
+ {
+- return idr_alloc(p, ptr, 0, 0, GFP_KERNEL);
++ return idr_alloc(p, ptr, min, 0, GFP_KERNEL);
+ }
+
+ /* put unit number back to a pool */
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index fcfad5c298a9f..56e6fd0f04829 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -298,6 +298,9 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
+ if (pdev->vendor == PCI_VENDOR_ID_STMICRO
+ && pdev->device == PCI_DEVICE_ID_STMICRO_USB_HOST)
+ ; /* ConneXT has no sbrn register */
++ else if (pdev->vendor == PCI_VENDOR_ID_HUAWEI
++ && pdev->device == 0xa239)
++ ; /* HUAWEI Kunpeng920 USB EHCI has no sbrn register */
+ else
+ pci_read_config_byte(pdev, 0x60, &ehci->sbrn);
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 741f40cd955ef..edd397fa29913 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1799,6 +1799,20 @@ void drop_collected_mounts(struct vfsmount *mnt)
+ namespace_unlock();
+ }
+
++static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
++{
++ struct mount *child;
++
++ list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
++ if (!is_subdir(child->mnt_mountpoint, dentry))
++ continue;
++
++ if (child->mnt.mnt_flags & MNT_LOCKED)
++ return true;
++ }
++ return false;
++}
++
+ /**
+ * clone_private_mount - create a private clone of a path
+ *
+@@ -1813,14 +1827,27 @@ struct vfsmount *clone_private_mount(const struct path *path)
+ struct mount *old_mnt = real_mount(path->mnt);
+ struct mount *new_mnt;
+
++ down_read(&namespace_sem);
+ if (IS_MNT_UNBINDABLE(old_mnt))
+- return ERR_PTR(-EINVAL);
++ goto invalid;
++
++ if (!check_mnt(old_mnt))
++ goto invalid;
++
++ if (has_locked_children(old_mnt, path->dentry))
++ goto invalid;
+
+ new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
++ up_read(&namespace_sem);
++
+ if (IS_ERR(new_mnt))
+ return ERR_CAST(new_mnt);
+
+ return &new_mnt->mnt;
++
++invalid:
++ up_read(&namespace_sem);
++ return ERR_PTR(-EINVAL);
+ }
+ EXPORT_SYMBOL_GPL(clone_private_mount);
+
+@@ -2136,19 +2163,6 @@ static int do_change_type(struct path *path, int ms_flags)
+ return err;
+ }
+
+-static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
+-{
+- struct mount *child;
+- list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
+- if (!is_subdir(child->mnt_mountpoint, dentry))
+- continue;
+-
+- if (child->mnt.mnt_flags & MNT_LOCKED)
+- return true;
+- }
+- return false;
+-}
+-
+ /*
+ * do loopback mount.
+ */
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 4ce032c4acd03..2bf83305e5aba 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -2812,6 +2812,27 @@ struct bpf_sanitize_info {
+ bool mask_to_left;
+ };
+
++static struct bpf_verifier_state *
++sanitize_speculative_path(struct bpf_verifier_env *env,
++ const struct bpf_insn *insn,
++ u32 next_idx, u32 curr_idx)
++{
++ struct bpf_verifier_state *branch;
++ struct bpf_reg_state *regs;
++
++ branch = push_stack(env, next_idx, curr_idx, true);
++ if (branch && insn) {
++ regs = branch->frame[branch->curframe]->regs;
++ if (BPF_SRC(insn->code) == BPF_K) {
++ mark_reg_unknown(env, regs, insn->dst_reg);
++ } else if (BPF_SRC(insn->code) == BPF_X) {
++ mark_reg_unknown(env, regs, insn->dst_reg);
++ mark_reg_unknown(env, regs, insn->src_reg);
++ }
++ }
++ return branch;
++}
++
+ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
+ struct bpf_insn *insn,
+ const struct bpf_reg_state *ptr_reg,
+@@ -2895,12 +2916,26 @@ do_sim:
+ tmp = *dst_reg;
+ *dst_reg = *ptr_reg;
+ }
+- ret = push_stack(env, env->insn_idx + 1, env->insn_idx, true);
++ ret = sanitize_speculative_path(env, NULL, env->insn_idx + 1,
++ env->insn_idx);
+ if (!ptr_is_dst_reg && ret)
+ *dst_reg = tmp;
+ return !ret ? REASON_STACK : 0;
+ }
+
++static void sanitize_mark_insn_seen(struct bpf_verifier_env *env)
++{
++ struct bpf_verifier_state *vstate = env->cur_state;
++
++ /* If we simulate paths under speculation, we don't update the
++ * insn as 'seen' such that when we verify unreachable paths in
++ * the non-speculative domain, sanitize_dead_code() can still
++ * rewrite/sanitize them.
++ */
++ if (!vstate->speculative)
++ env->insn_aux_data[env->insn_idx].seen = true;
++}
++
+ static int sanitize_err(struct bpf_verifier_env *env,
+ const struct bpf_insn *insn, int reason,
+ const struct bpf_reg_state *off_reg,
+@@ -4275,14 +4310,28 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,
+ tnum_is_const(src_reg->var_off))
+ pred = is_branch_taken(dst_reg, src_reg->var_off.value,
+ opcode);
++
+ if (pred == 1) {
+- /* only follow the goto, ignore fall-through */
++ /* Only follow the goto, ignore fall-through. If needed, push
++ * the fall-through branch for simulation under speculative
++ * execution.
++ */
++ if (!env->allow_ptr_leaks &&
++ !sanitize_speculative_path(env, insn, *insn_idx + 1,
++ *insn_idx))
++ return -EFAULT;
+ *insn_idx += insn->off;
+ return 0;
+ } else if (pred == 0) {
+- /* only follow fall-through branch, since
+- * that's where the program will go
++ /* Only follow the fall-through branch, since that's where the
++ * program will go. If needed, push the goto branch for
++ * simulation under speculative execution.
+ */
++ if (!env->allow_ptr_leaks &&
++ !sanitize_speculative_path(env, insn,
++ *insn_idx + insn->off + 1,
++ *insn_idx))
++ return -EFAULT;
+ return 0;
+ }
+
+@@ -5254,7 +5303,7 @@ static int do_check(struct bpf_verifier_env *env)
+ }
+
+ regs = cur_regs(env);
+- env->insn_aux_data[env->insn_idx].seen = true;
++ sanitize_mark_insn_seen(env);
+
+ if (class == BPF_ALU || class == BPF_ALU64) {
+ err = check_alu_op(env, insn);
+@@ -5472,7 +5521,7 @@ process_bpf_exit:
+ return err;
+
+ env->insn_idx++;
+- env->insn_aux_data[env->insn_idx].seen = true;
++ sanitize_mark_insn_seen(env);
+ } else {
+ verbose(env, "invalid BPF_LD mode\n");
+ return -EINVAL;
+@@ -5690,6 +5739,7 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env, u32 prog_len,
+ u32 off, u32 cnt)
+ {
+ struct bpf_insn_aux_data *new_data, *old_data = env->insn_aux_data;
++ bool old_seen = old_data[off].seen;
+ int i;
+
+ if (cnt == 1)
+@@ -5701,8 +5751,10 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env, u32 prog_len,
+ memcpy(new_data, old_data, sizeof(struct bpf_insn_aux_data) * off);
+ memcpy(new_data + off + cnt - 1, old_data + off,
+ sizeof(struct bpf_insn_aux_data) * (prog_len - off - cnt + 1));
+- for (i = off; i < off + cnt - 1; i++)
+- new_data[i].seen = true;
++ for (i = off; i < off + cnt - 1; i++) {
++ /* Expand insni[off]'s seen count to the patched range. */
++ new_data[i].seen = old_seen;
++ }
+ env->insn_aux_data = new_data;
+ vfree(old_data);
+ return 0;
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 6d2a69652c391..bbde8d3d6c8ae 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -2790,6 +2790,12 @@ static struct hist_field *parse_unary(struct hist_trigger_data *hist_data,
+ ret = PTR_ERR(operand1);
+ goto free;
+ }
++ if (operand1->flags & HIST_FIELD_FL_STRING) {
++ /* String type can not be the operand of unary operator. */
++ destroy_hist_field(operand1, 0);
++ ret = -EINVAL;
++ goto free;
++ }
+
+ expr->flags |= operand1->flags &
+ (HIST_FIELD_FL_TIMESTAMP | HIST_FIELD_FL_TIMESTAMP_USECS);
+@@ -2890,6 +2896,10 @@ static struct hist_field *parse_expr(struct hist_trigger_data *hist_data,
+ operand1 = NULL;
+ goto free;
+ }
++ if (operand1->flags & HIST_FIELD_FL_STRING) {
++ ret = -EINVAL;
++ goto free;
++ }
+
+ /* rest of string could be another expression e.g. b+c in a+b+c */
+ operand_flags = 0;
+@@ -2899,6 +2909,10 @@ static struct hist_field *parse_expr(struct hist_trigger_data *hist_data,
+ operand2 = NULL;
+ goto free;
+ }
++ if (operand2->flags & HIST_FIELD_FL_STRING) {
++ ret = -EINVAL;
++ goto free;
++ }
+
+ ret = check_expr_operands(operand1, operand2);
+ if (ret)
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index b44324530948d..c7d17781dbfee 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -2792,6 +2792,8 @@ static struct bpf_test tests[] = {
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
+ BPF_EXIT_INSN(),
+ },
++ .errstr_unpriv = "R7 invalid mem access 'inv'",
++ .result_unpriv = REJECT,
+ .result = ACCEPT,
+ .retval = 0,
+ },
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-08-25 20:41 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-08-25 20:41 UTC (permalink / raw
To: gentoo-commits
commit: 369383f08d147fd98553defeff5423912d34e177
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 25 20:40:44 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Aug 25 20:40:44 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=369383f0
Print firmware info (Reqs CONFIG_GENTOO_PRINT_FIRMWARE_INFO).
Thanks to Georgy Yakovlev
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 ++++
3000_Support-printing-firmware-info.patch | 13 +++++++++++++
4567_distro-Gentoo-Kconfig.patch | 20 +++++++++++++++++---
3 files changed, 34 insertions(+), 3 deletions(-)
diff --git a/0000_README b/0000_README
index 398311f..10bff84 100644
--- a/0000_README
+++ b/0000_README
@@ -871,6 +871,10 @@ Patch: 2600_enable-key-swapping-for-apple-mac.patch
From: https://github.com/free5lot/hid-apple-patched
Desc: This hid-apple patch enables swapping of the FN and left Control keys and some additional on some apple keyboards. See bug #622902
+Patch: 3000_Support-printing-firmware-info.patch
+From: https://bugs.gentoo.org/732852
+Desc: Print firmware info (Reqs CONFIG_GENTOO_PRINT_FIRMWARE_INFO). Thanks to Georgy Yakovlev
+
Patch: 4400_alpha-sysctl-uac.patch
From: Tobias Klausmann (klausman@gentoo.org) and http://bugs.gentoo.org/show_bug.cgi?id=217323
Desc: Enable control of the unaligned access control policy from sysctl
diff --git a/3000_Support-printing-firmware-info.patch b/3000_Support-printing-firmware-info.patch
new file mode 100644
index 0000000..a47a3b7
--- /dev/null
+++ b/3000_Support-printing-firmware-info.patch
@@ -0,0 +1,13 @@
+--- a/drivers/base/firmware_loader/main.c 2021-08-25 12:48:18.443728827 -0400
++++ b/drivers/base/firmware_loader/main.c 2021-08-25 12:53:28.296489959 -0400
+@@ -581,6 +581,10 @@ _request_firmware(const struct firmware
+ goto out;
+ }
+
++#ifdef CONFIG_GENTOO_PRINT_FIRMWARE_INFO
++ printk(KERN_NOTICE "Loading firmware: %s\n", name);
++#endif
++
+ ret = _request_firmware_prepare(&fw, name, device, buf, size,
+ opt_flags);
+ if (ret <= 0) /* error or already assigned */
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index 14e46e6..bc6e473 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -6,9 +6,9 @@
source "lib/Kconfig.debug"
+
+source "distro/Kconfig"
---- /dev/null 2020-09-24 03:06:47.590000000 -0400
-+++ b/distro/Kconfig 2020-09-24 11:31:29.403150624 -0400
-@@ -0,0 +1,158 @@
+--- /dev/null 2021-08-25 07:42:42.777310415 -0400
++++ b/distro/Kconfig 2021-08-25 15:56:53.767690797 -0400
+@@ -0,0 +1,172 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -167,3 +167,17 @@
+endmenu
+
+endmenu
++
++config GENTOO_PRINT_FIRMWARE_INFO
++ bool "Print firmware information that the kernel attempts to load"
++
++ depends on GENTOO_LINUX
++ default y
++
++ help
++ In order to boot Gentoo Linux a minimal set of config settings needs to
++ be enabled in the kernel; to avoid the users from having to enable them
++ manually as part of a Gentoo Linux installation or a new clean config,
++ we enable these config settings by default for convenience.
++
++ See the settings that become available for more details and fine-tuning.
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-08-25 22:45 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-08-25 22:45 UTC (permalink / raw
To: gentoo-commits
commit: e983d27f771d115181f7049264c080e6b47e14a3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 25 22:45:27 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Aug 25 22:45:27 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e983d27f
Fix Gentoo distro menu
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
4567_distro-Gentoo-Kconfig.patch | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index bc6e473..394d45b 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -6,8 +6,8 @@
source "lib/Kconfig.debug"
+
+source "distro/Kconfig"
---- /dev/null 2021-08-25 07:42:42.777310415 -0400
-+++ b/distro/Kconfig 2021-08-25 15:56:53.767690797 -0400
+--- /dev/null 2021-08-25 09:18:08.950320773 -0400
++++ b/distro/Kconfig 2021-08-25 18:42:58.671125104 -0400
@@ -0,0 +1,172 @@
+menu "Gentoo Linux"
+
@@ -166,8 +166,6 @@
+
+endmenu
+
-+endmenu
-+
+config GENTOO_PRINT_FIRMWARE_INFO
+ bool "Print firmware information that the kernel attempts to load"
+
@@ -181,3 +179,5 @@
+ we enable these config settings by default for convenience.
+
+ See the settings that become available for more details and fine-tuning.
++
++endmenu
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-08-26 14:06 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-08-26 14:06 UTC (permalink / raw
To: gentoo-commits
commit: 7090d0e6645701aa3bd95b4acb47f303469349ec
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 26 14:05:50 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Aug 26 14:05:50 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7090d0e6
Linux patch 4.19.205
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1204_linux-4.19.205.patch | 2728 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2732 insertions(+)
diff --git a/0000_README b/0000_README
index 10bff84..6a39170 100644
--- a/0000_README
+++ b/0000_README
@@ -855,6 +855,10 @@ Patch: 1203_linux-4.19.204.patch
From: https://www.kernel.org
Desc: Linux 4.19.204
+Patch: 1204_linux-4.19.205.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.205
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1204_linux-4.19.205.patch b/1204_linux-4.19.205.patch
new file mode 100644
index 0000000..fe40dfc
--- /dev/null
+++ b/1204_linux-4.19.205.patch
@@ -0,0 +1,2728 @@
+diff --git a/Documentation/filesystems/mandatory-locking.txt b/Documentation/filesystems/mandatory-locking.txt
+index 0979d1d2ca8bb..a251ca33164ae 100644
+--- a/Documentation/filesystems/mandatory-locking.txt
++++ b/Documentation/filesystems/mandatory-locking.txt
+@@ -169,3 +169,13 @@ havoc if they lock crucial files. The way around it is to change the file
+ permissions (remove the setgid bit) before trying to read or write to it.
+ Of course, that might be a bit tricky if the system is hung :-(
+
++7. The "mand" mount option
++--------------------------
++Mandatory locking is disabled on all filesystems by default, and must be
++administratively enabled by mounting with "-o mand". That mount option
++is only allowed if the mounting task has the CAP_SYS_ADMIN capability.
++
++Since kernel v4.5, it is possible to disable mandatory locking
++altogether by setting CONFIG_MANDATORY_FILE_LOCKING to "n". A kernel
++with this disabled will reject attempts to mount filesystems with the
++"mand" mount option with the error status EPERM.
+diff --git a/Makefile b/Makefile
+index d4ffcafb8efad..abc35829f47ba 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 204
++SUBLEVEL = 205
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
+index 02bbdfb3f2582..0cc3ac6566c62 100644
+--- a/arch/arm/boot/dts/am43x-epos-evm.dts
++++ b/arch/arm/boot/dts/am43x-epos-evm.dts
+@@ -590,7 +590,7 @@
+ status = "okay";
+ pinctrl-names = "default";
+ pinctrl-0 = <&i2c0_pins>;
+- clock-frequency = <400000>;
++ clock-frequency = <100000>;
+
+ tps65218: tps65218@24 {
+ reg = <0x24>;
+diff --git a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
+index fca76a696d9d7..9ba4d1630ca31 100644
+--- a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
++++ b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
+@@ -755,14 +755,14 @@
+ status = "disabled";
+ };
+
+- vica: intc@10140000 {
++ vica: interrupt-controller@10140000 {
+ compatible = "arm,versatile-vic";
+ interrupt-controller;
+ #interrupt-cells = <1>;
+ reg = <0x10140000 0x20>;
+ };
+
+- vicb: intc@10140020 {
++ vicb: interrupt-controller@10140020 {
+ compatible = "arm,versatile-vic";
+ interrupt-controller;
+ #interrupt-cells = <1>;
+diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
+index 53a39661eb13b..ccf16bccc2bc9 100644
+--- a/arch/powerpc/kernel/kprobes.c
++++ b/arch/powerpc/kernel/kprobes.c
+@@ -277,7 +277,8 @@ int kprobe_handler(struct pt_regs *regs)
+ if (user_mode(regs))
+ return 0;
+
+- if (!(regs->msr & MSR_IR) || !(regs->msr & MSR_DR))
++ if (!IS_ENABLED(CONFIG_BOOKE) &&
++ (!(regs->msr & MSR_IR) || !(regs->msr & MSR_DR)))
+ return 0;
+
+ /*
+diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
+index b8c935033d210..4f274d8519865 100644
+--- a/arch/x86/include/asm/fpu/internal.h
++++ b/arch/x86/include/asm/fpu/internal.h
+@@ -215,6 +215,14 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
+ }
+ }
+
++static inline void fxsave(struct fxregs_state *fx)
++{
++ if (IS_ENABLED(CONFIG_X86_32))
++ asm volatile( "fxsave %[fx]" : [fx] "=m" (*fx));
++ else
++ asm volatile("fxsaveq %[fx]" : [fx] "=m" (*fx));
++}
++
+ /* These macros all use (%edi)/(%rdi) as the single memory argument. */
+ #define XSAVE ".byte " REX_PREFIX "0x0f,0xae,0x27"
+ #define XSAVEOPT ".byte " REX_PREFIX "0x0f,0xae,0x37"
+@@ -283,28 +291,6 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
+ : "D" (st), "m" (*st), "a" (lmask), "d" (hmask) \
+ : "memory")
+
+-/*
+- * This function is called only during boot time when x86 caps are not set
+- * up and alternative can not be used yet.
+- */
+-static inline void copy_xregs_to_kernel_booting(struct xregs_state *xstate)
+-{
+- u64 mask = -1;
+- u32 lmask = mask;
+- u32 hmask = mask >> 32;
+- int err;
+-
+- WARN_ON(system_state != SYSTEM_BOOTING);
+-
+- if (static_cpu_has(X86_FEATURE_XSAVES))
+- XSTATE_OP(XSAVES, xstate, lmask, hmask, err);
+- else
+- XSTATE_OP(XSAVE, xstate, lmask, hmask, err);
+-
+- /* We should never fault when copying to a kernel buffer: */
+- WARN_ON_FPU(err);
+-}
+-
+ /*
+ * This function is called only during boot time when x86 caps are not set
+ * up and alternative can not be used yet.
+diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h
+index 93b462e480671..b6dedf6c835c9 100644
+--- a/arch/x86/include/asm/svm.h
++++ b/arch/x86/include/asm/svm.h
+@@ -118,6 +118,8 @@ struct __attribute__ ((__packed__)) vmcb_control_area {
+ #define V_IGN_TPR_SHIFT 20
+ #define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT)
+
++#define V_IRQ_INJECTION_BITS_MASK (V_IRQ_MASK | V_INTR_PRIO_MASK | V_IGN_TPR_MASK)
++
+ #define V_INTR_MASKING_SHIFT 24
+ #define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT)
+
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index a89dac380243a..677508baf95a0 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -1958,7 +1958,8 @@ static struct irq_chip ioapic_chip __read_mostly = {
+ .irq_set_affinity = ioapic_set_affinity,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
+ .irq_get_irqchip_state = ioapic_irq_get_chip_state,
+- .flags = IRQCHIP_SKIP_SET_WAKE,
++ .flags = IRQCHIP_SKIP_SET_WAKE |
++ IRQCHIP_AFFINITY_PRE_STARTUP,
+ };
+
+ static struct irq_chip ioapic_ir_chip __read_mostly = {
+@@ -1971,7 +1972,8 @@ static struct irq_chip ioapic_ir_chip __read_mostly = {
+ .irq_set_affinity = ioapic_set_affinity,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
+ .irq_get_irqchip_state = ioapic_irq_get_chip_state,
+- .flags = IRQCHIP_SKIP_SET_WAKE,
++ .flags = IRQCHIP_SKIP_SET_WAKE |
++ IRQCHIP_AFFINITY_PRE_STARTUP,
+ };
+
+ static inline void init_IO_APIC_traps(void)
+diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c
+index fb26c956c4421..ca17a38488346 100644
+--- a/arch/x86/kernel/apic/msi.c
++++ b/arch/x86/kernel/apic/msi.c
+@@ -89,11 +89,13 @@ msi_set_affinity(struct irq_data *irqd, const struct cpumask *mask, bool force)
+ * The quirk bit is not set in this case.
+ * - The new vector is the same as the old vector
+ * - The old vector is MANAGED_IRQ_SHUTDOWN_VECTOR (interrupt starts up)
++ * - The interrupt is not yet started up
+ * - The new destination CPU is the same as the old destination CPU
+ */
+ if (!irqd_msi_nomask_quirk(irqd) ||
+ cfg->vector == old_cfg.vector ||
+ old_cfg.vector == MANAGED_IRQ_SHUTDOWN_VECTOR ||
++ !irqd_is_started(irqd) ||
+ cfg->dest_apicid == old_cfg.dest_apicid) {
+ irq_msi_update_msg(irqd, cfg);
+ return ret;
+@@ -181,7 +183,8 @@ static struct irq_chip pci_msi_controller = {
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
+ .irq_compose_msi_msg = irq_msi_compose_msg,
+ .irq_set_affinity = msi_set_affinity,
+- .flags = IRQCHIP_SKIP_SET_WAKE,
++ .flags = IRQCHIP_SKIP_SET_WAKE |
++ IRQCHIP_AFFINITY_PRE_STARTUP,
+ };
+
+ int native_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
+@@ -282,7 +285,8 @@ static struct irq_chip pci_msi_ir_controller = {
+ .irq_ack = irq_chip_ack_parent,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
+ .irq_set_vcpu_affinity = irq_chip_set_vcpu_affinity_parent,
+- .flags = IRQCHIP_SKIP_SET_WAKE,
++ .flags = IRQCHIP_SKIP_SET_WAKE |
++ IRQCHIP_AFFINITY_PRE_STARTUP,
+ };
+
+ static struct msi_domain_info pci_msi_ir_domain_info = {
+@@ -325,7 +329,8 @@ static struct irq_chip dmar_msi_controller = {
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
+ .irq_compose_msi_msg = irq_msi_compose_msg,
+ .irq_write_msi_msg = dmar_msi_write_msg,
+- .flags = IRQCHIP_SKIP_SET_WAKE,
++ .flags = IRQCHIP_SKIP_SET_WAKE |
++ IRQCHIP_AFFINITY_PRE_STARTUP,
+ };
+
+ static irq_hw_number_t dmar_msi_get_hwirq(struct msi_domain_info *info,
+@@ -423,7 +428,7 @@ static struct irq_chip hpet_msi_controller __ro_after_init = {
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
+ .irq_compose_msi_msg = irq_msi_compose_msg,
+ .irq_write_msi_msg = hpet_msi_write_msg,
+- .flags = IRQCHIP_SKIP_SET_WAKE,
++ .flags = IRQCHIP_SKIP_SET_WAKE | IRQCHIP_AFFINITY_PRE_STARTUP,
+ };
+
+ static irq_hw_number_t hpet_msi_get_hwirq(struct msi_domain_info *info,
+diff --git a/arch/x86/kernel/cpu/intel_rdt_monitor.c b/arch/x86/kernel/cpu/intel_rdt_monitor.c
+index 5dfa5ab9a5ae2..6eeb17dfde48e 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_monitor.c
++++ b/arch/x86/kernel/cpu/intel_rdt_monitor.c
+@@ -233,15 +233,14 @@ static u64 mbm_overflow_count(u64 prev_msr, u64 cur_msr)
+ return chunks >>= shift;
+ }
+
+-static int __mon_event_count(u32 rmid, struct rmid_read *rr)
++static u64 __mon_event_count(u32 rmid, struct rmid_read *rr)
+ {
+ struct mbm_state *m;
+ u64 chunks, tval;
+
+ tval = __rmid_read(rmid, rr->evtid);
+ if (tval & (RMID_VAL_ERROR | RMID_VAL_UNAVAIL)) {
+- rr->val = tval;
+- return -EINVAL;
++ return tval;
+ }
+ switch (rr->evtid) {
+ case QOS_L3_OCCUP_EVENT_ID:
+@@ -253,12 +252,6 @@ static int __mon_event_count(u32 rmid, struct rmid_read *rr)
+ case QOS_L3_MBM_LOCAL_EVENT_ID:
+ m = &rr->d->mbm_local[rmid];
+ break;
+- default:
+- /*
+- * Code would never reach here because
+- * an invalid event id would fail the __rmid_read.
+- */
+- return -EINVAL;
+ }
+
+ if (rr->first) {
+@@ -308,23 +301,29 @@ void mon_event_count(void *info)
+ struct rdtgroup *rdtgrp, *entry;
+ struct rmid_read *rr = info;
+ struct list_head *head;
++ u64 ret_val;
+
+ rdtgrp = rr->rgrp;
+
+- if (__mon_event_count(rdtgrp->mon.rmid, rr))
+- return;
++ ret_val = __mon_event_count(rdtgrp->mon.rmid, rr);
+
+ /*
+- * For Ctrl groups read data from child monitor groups.
++ * For Ctrl groups read data from child monitor groups and
++ * add them together. Count events which are read successfully.
++ * Discard the rmid_read's reporting errors.
+ */
+ head = &rdtgrp->mon.crdtgrp_list;
+
+ if (rdtgrp->type == RDTCTRL_GROUP) {
+ list_for_each_entry(entry, head, mon.crdtgrp_list) {
+- if (__mon_event_count(entry->mon.rmid, rr))
+- return;
++ if (__mon_event_count(entry->mon.rmid, rr) == 0)
++ ret_val = 0;
+ }
+ }
++
++ /* Report error if none of rmid_reads are successful */
++ if (ret_val)
++ rr->val = ret_val;
+ }
+
+ /*
+diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
+index 601a5da1d196a..7d372db8bee11 100644
+--- a/arch/x86/kernel/fpu/xstate.c
++++ b/arch/x86/kernel/fpu/xstate.c
+@@ -404,6 +404,24 @@ static void __init print_xstate_offset_size(void)
+ }
+ }
+
++/*
++ * All supported features have either init state all zeros or are
++ * handled in setup_init_fpu() individually. This is an explicit
++ * feature list and does not use XFEATURE_MASK*SUPPORTED to catch
++ * newly added supported features at build time and make people
++ * actually look at the init state for the new feature.
++ */
++#define XFEATURES_INIT_FPSTATE_HANDLED \
++ (XFEATURE_MASK_FP | \
++ XFEATURE_MASK_SSE | \
++ XFEATURE_MASK_YMM | \
++ XFEATURE_MASK_OPMASK | \
++ XFEATURE_MASK_ZMM_Hi256 | \
++ XFEATURE_MASK_Hi16_ZMM | \
++ XFEATURE_MASK_PKRU | \
++ XFEATURE_MASK_BNDREGS | \
++ XFEATURE_MASK_BNDCSR)
++
+ /*
+ * setup the xstate image representing the init state
+ */
+@@ -411,6 +429,8 @@ static void __init setup_init_fpu_buf(void)
+ {
+ static int on_boot_cpu __initdata = 1;
+
++ BUILD_BUG_ON(XCNTXT_MASK != XFEATURES_INIT_FPSTATE_HANDLED);
++
+ WARN_ON_FPU(!on_boot_cpu);
+ on_boot_cpu = 0;
+
+@@ -429,10 +449,22 @@ static void __init setup_init_fpu_buf(void)
+ copy_kernel_to_xregs_booting(&init_fpstate.xsave);
+
+ /*
+- * Dump the init state again. This is to identify the init state
+- * of any feature which is not represented by all zero's.
++ * All components are now in init state. Read the state back so
++ * that init_fpstate contains all non-zero init state. This only
++ * works with XSAVE, but not with XSAVEOPT and XSAVES because
++ * those use the init optimization which skips writing data for
++ * components in init state.
++ *
++ * XSAVE could be used, but that would require to reshuffle the
++ * data when XSAVES is available because XSAVES uses xstate
++ * compaction. But doing so is a pointless exercise because most
++ * components have an all zeros init state except for the legacy
++ * ones (FP and SSE). Those can be saved with FXSAVE into the
++ * legacy area. Adding new features requires to ensure that init
++ * state is all zeroes or if not to add the necessary handling
++ * here.
+ */
+- copy_xregs_to_kernel_booting(&init_fpstate.xsave);
++ fxsave(&init_fpstate.fxsave);
+ }
+
+ static int xfeature_uncompacted_offset(int xfeature_nr)
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 72d729f34437d..85181457413e7 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -513,6 +513,9 @@ static void recalc_intercepts(struct vcpu_svm *svm)
+ c->intercept_dr = h->intercept_dr | g->intercept_dr;
+ c->intercept_exceptions = h->intercept_exceptions | g->intercept_exceptions;
+ c->intercept = h->intercept | g->intercept;
++
++ c->intercept |= (1ULL << INTERCEPT_VMLOAD);
++ c->intercept |= (1ULL << INTERCEPT_VMSAVE);
+ }
+
+ static inline struct vmcb *get_host_vmcb(struct vcpu_svm *svm)
+@@ -1441,12 +1444,7 @@ static __init int svm_hardware_setup(void)
+ }
+ }
+
+- if (vgif) {
+- if (!boot_cpu_has(X86_FEATURE_VGIF))
+- vgif = false;
+- else
+- pr_info("Virtual GIF supported\n");
+- }
++ vgif = false; /* Disabled for CVE-2021-3653 */
+
+ return 0;
+
+@@ -3590,7 +3588,13 @@ static void enter_svm_guest_mode(struct vcpu_svm *svm, u64 vmcb_gpa,
+ svm->nested.intercept = nested_vmcb->control.intercept;
+
+ svm_flush_tlb(&svm->vcpu, true);
+- svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl | V_INTR_MASKING_MASK;
++
++ svm->vmcb->control.int_ctl &=
++ V_INTR_MASKING_MASK | V_GIF_ENABLE_MASK | V_GIF_MASK;
++
++ svm->vmcb->control.int_ctl |= nested_vmcb->control.int_ctl &
++ (V_TPR_MASK | V_IRQ_INJECTION_BITS_MASK);
++
+ if (nested_vmcb->control.int_ctl & V_INTR_MASKING_MASK)
+ svm->vcpu.arch.hflags |= HF_VINTR_MASK;
+ else
+diff --git a/arch/x86/tools/chkobjdump.awk b/arch/x86/tools/chkobjdump.awk
+index fd1ab80be0dec..a4cf678cf5c80 100644
+--- a/arch/x86/tools/chkobjdump.awk
++++ b/arch/x86/tools/chkobjdump.awk
+@@ -10,6 +10,7 @@ BEGIN {
+
+ /^GNU objdump/ {
+ verstr = ""
++ gsub(/\(.*\)/, "");
+ for (i = 3; i <= NF; i++)
+ if (match($(i), "^[0-9]")) {
+ verstr = $(i);
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index cb88f3b43a940..58a756ca14d85 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2834,6 +2834,9 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
+ struct acpi_nfit_memory_map *memdev = nfit_memdev->memdev;
+ struct nd_mapping_desc *mapping;
+
++ /* range index 0 == unmapped in SPA or invalid-SPA */
++ if (memdev->range_index == 0 || spa->range_index == 0)
++ continue;
+ if (memdev->range_index != spa->range_index)
+ continue;
+ if (count >= ND_MAX_MAPPINGS) {
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index f7f601858f10d..6e380ad9d08ad 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1682,6 +1682,7 @@ void device_initialize(struct device *dev)
+ device_pm_init(dev);
+ set_dev_node(dev, -1);
+ #ifdef CONFIG_GENERIC_MSI_IRQ
++ raw_spin_lock_init(&dev->msi_lock);
+ INIT_LIST_HEAD(&dev->msi_list);
+ #endif
+ INIT_LIST_HEAD(&dev->links.consumers);
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index a36452bd9612d..31b5655419b42 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -102,7 +102,11 @@ struct armada_37xx_dvfs {
+ };
+
+ static struct armada_37xx_dvfs armada_37xx_dvfs[] = {
+- {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} },
++ /*
++ * The cpufreq scaling for 1.2 GHz variant of the SOC is currently
++ * unstable because we do not know how to configure it properly.
++ */
++ /* {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, */
+ {.cpu_freq_max = 1000*1000*1000, .divider = {1, 2, 4, 5} },
+ {.cpu_freq_max = 800*1000*1000, .divider = {1, 2, 3, 4} },
+ {.cpu_freq_max = 600*1000*1000, .divider = {2, 4, 5, 6} },
+diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c
+index 8344a60c2131b..a9d3ab94749b1 100644
+--- a/drivers/dma/of-dma.c
++++ b/drivers/dma/of-dma.c
+@@ -68,8 +68,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec,
+ return NULL;
+
+ ofdma_target = of_dma_find_controller(&dma_spec_target);
+- if (!ofdma_target)
+- return NULL;
++ if (!ofdma_target) {
++ ofdma->dma_router->route_free(ofdma->dma_router->dev,
++ route_data);
++ chan = ERR_PTR(-EPROBE_DEFER);
++ goto err;
++ }
+
+ chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target);
+ if (IS_ERR_OR_NULL(chan)) {
+@@ -80,6 +84,7 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec,
+ chan->route_data = route_data;
+ }
+
++err:
+ /*
+ * Need to put the node back since the ofdma->of_dma_route_allocate
+ * has taken it for generating the new, translated dma_spec
+diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
+index 6c94ed7500494..d77bf325f0384 100644
+--- a/drivers/dma/sh/usb-dmac.c
++++ b/drivers/dma/sh/usb-dmac.c
+@@ -860,8 +860,8 @@ static int usb_dmac_probe(struct platform_device *pdev)
+
+ error:
+ of_dma_controller_free(pdev->dev.of_node);
+- pm_runtime_put(&pdev->dev);
+ error_pm:
++ pm_runtime_put(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ return ret;
+ }
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index 0c5668e897fe7..d891ec05bc48b 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -332,6 +332,7 @@ struct xilinx_dma_tx_descriptor {
+ * @genlock: Support genlock mode
+ * @err: Channel has errors
+ * @idle: Check for channel idle
++ * @terminating: Check for channel being synchronized by user
+ * @tasklet: Cleanup work after irq
+ * @config: Device configuration info
+ * @flush_on_fsync: Flush on Frame sync
+@@ -369,6 +370,7 @@ struct xilinx_dma_chan {
+ bool genlock;
+ bool err;
+ bool idle;
++ bool terminating;
+ struct tasklet_struct tasklet;
+ struct xilinx_vdma_config config;
+ bool flush_on_fsync;
+@@ -843,6 +845,13 @@ static void xilinx_dma_chan_desc_cleanup(struct xilinx_dma_chan *chan)
+ /* Run any dependencies, then free the descriptor */
+ dma_run_dependencies(&desc->async_tx);
+ xilinx_dma_free_tx_descriptor(chan, desc);
++
++ /*
++ * While we ran a callback the user called a terminate function,
++ * which takes care of cleaning up any remaining descriptors
++ */
++ if (chan->terminating)
++ break;
+ }
+
+ spin_unlock_irqrestore(&chan->lock, flags);
+@@ -1612,6 +1621,8 @@ static dma_cookie_t xilinx_dma_tx_submit(struct dma_async_tx_descriptor *tx)
+ if (desc->cyclic)
+ chan->cyclic = true;
+
++ chan->terminating = false;
++
+ spin_unlock_irqrestore(&chan->lock, flags);
+
+ return cookie;
+@@ -2068,6 +2079,7 @@ static int xilinx_dma_terminate_all(struct dma_chan *dchan)
+ }
+
+ /* Remove and free all of the descriptors in the lists */
++ chan->terminating = true;
+ xilinx_dma_free_descriptors(chan);
+ chan->idle = true;
+
+diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
+index 1d10ee86299d8..57aece8098416 100644
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -149,7 +149,7 @@ static ssize_t i2cdev_read(struct file *file, char __user *buf, size_t count,
+ if (count > 8192)
+ count = 8192;
+
+- tmp = kmalloc(count, GFP_KERNEL);
++ tmp = kzalloc(count, GFP_KERNEL);
+ if (tmp == NULL)
+ return -ENOMEM;
+
+@@ -158,7 +158,8 @@ static ssize_t i2cdev_read(struct file *file, char __user *buf, size_t count,
+
+ ret = i2c_master_recv(client, tmp, count);
+ if (ret >= 0)
+- ret = copy_to_user(buf, tmp, count) ? -EFAULT : ret;
++ if (copy_to_user(buf, tmp, ret))
++ ret = -EFAULT;
+ kfree(tmp);
+ return ret;
+ }
+diff --git a/drivers/iio/adc/palmas_gpadc.c b/drivers/iio/adc/palmas_gpadc.c
+index 69b9affeef1e6..7dcd4213d38a0 100644
+--- a/drivers/iio/adc/palmas_gpadc.c
++++ b/drivers/iio/adc/palmas_gpadc.c
+@@ -659,8 +659,8 @@ static int palmas_adc_wakeup_configure(struct palmas_gpadc *adc)
+
+ adc_period = adc->auto_conversion_period;
+ for (i = 0; i < 16; ++i) {
+- if (((1000 * (1 << i)) / 32) < adc_period)
+- continue;
++ if (((1000 * (1 << i)) / 32) >= adc_period)
++ break;
+ }
+ if (i > 0)
+ i--;
+diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c
+index 0fcaa2c0b2f43..51ad5a9ed0851 100644
+--- a/drivers/iio/humidity/hdc100x.c
++++ b/drivers/iio/humidity/hdc100x.c
+@@ -24,6 +24,8 @@
+ #include <linux/iio/trigger_consumer.h>
+ #include <linux/iio/triggered_buffer.h>
+
++#include <linux/time.h>
++
+ #define HDC100X_REG_TEMP 0x00
+ #define HDC100X_REG_HUMIDITY 0x01
+
+@@ -165,7 +167,7 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
+ struct iio_chan_spec const *chan)
+ {
+ struct i2c_client *client = data->client;
+- int delay = data->adc_int_us[chan->address];
++ int delay = data->adc_int_us[chan->address] + 1*USEC_PER_MSEC;
+ int ret;
+ __be16 val;
+
+@@ -322,7 +324,7 @@ static irqreturn_t hdc100x_trigger_handler(int irq, void *p)
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct hdc100x_data *data = iio_priv(indio_dev);
+ struct i2c_client *client = data->client;
+- int delay = data->adc_int_us[0] + data->adc_int_us[1];
++ int delay = data->adc_int_us[0] + data->adc_int_us[1] + 2*USEC_PER_MSEC;
+ int ret;
+
+ /* dual read starts at temp register */
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index d2166dfc8b3f8..dcb865d193090 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1928,7 +1928,7 @@ static inline int guestwidth_to_adjustwidth(int gaw)
+ static int domain_init(struct dmar_domain *domain, struct intel_iommu *iommu,
+ int guest_width)
+ {
+- int adjust_width, agaw;
++ int adjust_width, agaw, cap_width;
+ unsigned long sagaw;
+ int err;
+
+@@ -1942,8 +1942,9 @@ static int domain_init(struct dmar_domain *domain, struct intel_iommu *iommu,
+ domain_reserve_special_ranges(domain);
+
+ /* calculate AGAW */
+- if (guest_width > cap_mgaw(iommu->cap))
+- guest_width = cap_mgaw(iommu->cap);
++ cap_width = min_t(int, cap_mgaw(iommu->cap), agaw_to_width(iommu->agaw));
++ if (guest_width > cap_width)
++ guest_width = cap_width;
+ domain->gaw = guest_width;
+ adjust_width = guestwidth_to_adjustwidth(guest_width);
+ agaw = width_to_agaw(adjust_width);
+diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c
+index 7895320e50c1e..4c8da6af25168 100644
+--- a/drivers/ipack/carriers/tpci200.c
++++ b/drivers/ipack/carriers/tpci200.c
+@@ -94,16 +94,13 @@ static void tpci200_unregister(struct tpci200_board *tpci200)
+ free_irq(tpci200->info->pdev->irq, (void *) tpci200);
+
+ pci_iounmap(tpci200->info->pdev, tpci200->info->interface_regs);
+- pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs);
+
+ pci_release_region(tpci200->info->pdev, TPCI200_IP_INTERFACE_BAR);
+ pci_release_region(tpci200->info->pdev, TPCI200_IO_ID_INT_SPACES_BAR);
+ pci_release_region(tpci200->info->pdev, TPCI200_MEM16_SPACE_BAR);
+ pci_release_region(tpci200->info->pdev, TPCI200_MEM8_SPACE_BAR);
+- pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR);
+
+ pci_disable_device(tpci200->info->pdev);
+- pci_dev_put(tpci200->info->pdev);
+ }
+
+ static void tpci200_enable_irq(struct tpci200_board *tpci200,
+@@ -262,7 +259,7 @@ static int tpci200_register(struct tpci200_board *tpci200)
+ "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 2 !",
+ tpci200->info->pdev->bus->number,
+ tpci200->info->pdev->devfn);
+- goto out_disable_pci;
++ goto err_disable_device;
+ }
+
+ /* Request IO ID INT space (Bar 3) */
+@@ -274,7 +271,7 @@ static int tpci200_register(struct tpci200_board *tpci200)
+ "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 3 !",
+ tpci200->info->pdev->bus->number,
+ tpci200->info->pdev->devfn);
+- goto out_release_ip_space;
++ goto err_ip_interface_bar;
+ }
+
+ /* Request MEM8 space (Bar 5) */
+@@ -285,7 +282,7 @@ static int tpci200_register(struct tpci200_board *tpci200)
+ "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 5!",
+ tpci200->info->pdev->bus->number,
+ tpci200->info->pdev->devfn);
+- goto out_release_ioid_int_space;
++ goto err_io_id_int_spaces_bar;
+ }
+
+ /* Request MEM16 space (Bar 4) */
+@@ -296,7 +293,7 @@ static int tpci200_register(struct tpci200_board *tpci200)
+ "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 4!",
+ tpci200->info->pdev->bus->number,
+ tpci200->info->pdev->devfn);
+- goto out_release_mem8_space;
++ goto err_mem8_space_bar;
+ }
+
+ /* Map internal tpci200 driver user space */
+@@ -310,7 +307,7 @@ static int tpci200_register(struct tpci200_board *tpci200)
+ tpci200->info->pdev->bus->number,
+ tpci200->info->pdev->devfn);
+ res = -ENOMEM;
+- goto out_release_mem8_space;
++ goto err_mem16_space_bar;
+ }
+
+ /* Initialize lock that protects interface_regs */
+@@ -349,18 +346,22 @@ static int tpci200_register(struct tpci200_board *tpci200)
+ "(bn 0x%X, sn 0x%X) unable to register IRQ !",
+ tpci200->info->pdev->bus->number,
+ tpci200->info->pdev->devfn);
+- goto out_release_ioid_int_space;
++ goto err_interface_regs;
+ }
+
+ return 0;
+
+-out_release_mem8_space:
++err_interface_regs:
++ pci_iounmap(tpci200->info->pdev, tpci200->info->interface_regs);
++err_mem16_space_bar:
++ pci_release_region(tpci200->info->pdev, TPCI200_MEM16_SPACE_BAR);
++err_mem8_space_bar:
+ pci_release_region(tpci200->info->pdev, TPCI200_MEM8_SPACE_BAR);
+-out_release_ioid_int_space:
++err_io_id_int_spaces_bar:
+ pci_release_region(tpci200->info->pdev, TPCI200_IO_ID_INT_SPACES_BAR);
+-out_release_ip_space:
++err_ip_interface_bar:
+ pci_release_region(tpci200->info->pdev, TPCI200_IP_INTERFACE_BAR);
+-out_disable_pci:
++err_disable_device:
+ pci_disable_device(tpci200->info->pdev);
+ return res;
+ }
+@@ -532,7 +533,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
+ tpci200->info = kzalloc(sizeof(struct tpci200_infos), GFP_KERNEL);
+ if (!tpci200->info) {
+ ret = -ENOMEM;
+- goto out_err_info;
++ goto err_tpci200;
+ }
+
+ pci_dev_get(pdev);
+@@ -543,7 +544,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to allocate PCI Configuration Memory");
+ ret = -EBUSY;
+- goto out_err_pci_request;
++ goto err_tpci200_info;
+ }
+ tpci200->info->cfg_regs = ioremap_nocache(
+ pci_resource_start(pdev, TPCI200_CFG_MEM_BAR),
+@@ -551,7 +552,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
+ if (!tpci200->info->cfg_regs) {
+ dev_err(&pdev->dev, "Failed to map PCI Configuration Memory");
+ ret = -EFAULT;
+- goto out_err_ioremap;
++ goto err_request_region;
+ }
+
+ /* Disable byte swapping for 16 bit IP module access. This will ensure
+@@ -574,7 +575,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
+ if (ret) {
+ dev_err(&pdev->dev, "error during tpci200 install\n");
+ ret = -ENODEV;
+- goto out_err_install;
++ goto err_cfg_regs;
+ }
+
+ /* Register the carrier in the industry pack bus driver */
+@@ -586,7 +587,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
+ dev_err(&pdev->dev,
+ "error registering the carrier on ipack driver\n");
+ ret = -EFAULT;
+- goto out_err_bus_register;
++ goto err_tpci200_install;
+ }
+
+ /* save the bus number given by ipack to logging purpose */
+@@ -597,19 +598,16 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
+ tpci200_create_device(tpci200, i);
+ return 0;
+
+-out_err_bus_register:
++err_tpci200_install:
+ tpci200_uninstall(tpci200);
+- /* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */
+- tpci200->info->cfg_regs = NULL;
+-out_err_install:
+- if (tpci200->info->cfg_regs)
+- iounmap(tpci200->info->cfg_regs);
+-out_err_ioremap:
++err_cfg_regs:
++ pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs);
++err_request_region:
+ pci_release_region(pdev, TPCI200_CFG_MEM_BAR);
+-out_err_pci_request:
+- pci_dev_put(pdev);
++err_tpci200_info:
+ kfree(tpci200->info);
+-out_err_info:
++ pci_dev_put(pdev);
++err_tpci200:
+ kfree(tpci200);
+ return ret;
+ }
+@@ -619,6 +617,12 @@ static void __tpci200_pci_remove(struct tpci200_board *tpci200)
+ ipack_bus_unregister(tpci200->info->ipack_bus);
+ tpci200_uninstall(tpci200);
+
++ pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs);
++
++ pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR);
++
++ pci_dev_put(tpci200->info->pdev);
++
+ kfree(tpci200->info);
+ kfree(tpci200);
+ }
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index 22c454c7aaca6..8e09586f880f1 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -2043,8 +2043,8 @@ static void dw_mci_tasklet_func(unsigned long priv)
+ continue;
+ }
+
+- dw_mci_stop_dma(host);
+ send_stop_abort(host, data);
++ dw_mci_stop_dma(host);
+ state = STATE_SENDING_STOP;
+ break;
+ }
+@@ -2068,10 +2068,10 @@ static void dw_mci_tasklet_func(unsigned long priv)
+ */
+ if (test_and_clear_bit(EVENT_DATA_ERROR,
+ &host->pending_events)) {
+- dw_mci_stop_dma(host);
+ if (!(host->data_status & (SDMMC_INT_DRTO |
+ SDMMC_INT_EBE)))
+ send_stop_abort(host, data);
++ dw_mci_stop_dma(host);
+ state = STATE_DATA_ERROR;
+ break;
+ }
+@@ -2104,10 +2104,10 @@ static void dw_mci_tasklet_func(unsigned long priv)
+ */
+ if (test_and_clear_bit(EVENT_DATA_ERROR,
+ &host->pending_events)) {
+- dw_mci_stop_dma(host);
+ if (!(host->data_status & (SDMMC_INT_DRTO |
+ SDMMC_INT_EBE)))
+ send_stop_abort(host, data);
++ dw_mci_stop_dma(host);
+ state = STATE_DATA_ERROR;
+ break;
+ }
+diff --git a/drivers/net/dsa/lan9303-core.c b/drivers/net/dsa/lan9303-core.c
+index b4f6e1a67dd9a..b89c474e6b6bf 100644
+--- a/drivers/net/dsa/lan9303-core.c
++++ b/drivers/net/dsa/lan9303-core.c
+@@ -566,12 +566,12 @@ static int lan9303_alr_make_entry_raw(struct lan9303 *chip, u32 dat0, u32 dat1)
+ return 0;
+ }
+
+-typedef void alr_loop_cb_t(struct lan9303 *chip, u32 dat0, u32 dat1,
+- int portmap, void *ctx);
++typedef int alr_loop_cb_t(struct lan9303 *chip, u32 dat0, u32 dat1,
++ int portmap, void *ctx);
+
+-static void lan9303_alr_loop(struct lan9303 *chip, alr_loop_cb_t *cb, void *ctx)
++static int lan9303_alr_loop(struct lan9303 *chip, alr_loop_cb_t *cb, void *ctx)
+ {
+- int i;
++ int ret = 0, i;
+
+ mutex_lock(&chip->alr_mutex);
+ lan9303_write_switch_reg(chip, LAN9303_SWE_ALR_CMD,
+@@ -591,13 +591,17 @@ static void lan9303_alr_loop(struct lan9303 *chip, alr_loop_cb_t *cb, void *ctx)
+ LAN9303_ALR_DAT1_PORT_BITOFFS;
+ portmap = alrport_2_portmap[alrport];
+
+- cb(chip, dat0, dat1, portmap, ctx);
++ ret = cb(chip, dat0, dat1, portmap, ctx);
++ if (ret)
++ break;
+
+ lan9303_write_switch_reg(chip, LAN9303_SWE_ALR_CMD,
+ LAN9303_ALR_CMD_GET_NEXT);
+ lan9303_write_switch_reg(chip, LAN9303_SWE_ALR_CMD, 0);
+ }
+ mutex_unlock(&chip->alr_mutex);
++
++ return ret;
+ }
+
+ static void alr_reg_to_mac(u32 dat0, u32 dat1, u8 mac[6])
+@@ -615,18 +619,20 @@ struct del_port_learned_ctx {
+ };
+
+ /* Clear learned (non-static) entry on given port */
+-static void alr_loop_cb_del_port_learned(struct lan9303 *chip, u32 dat0,
+- u32 dat1, int portmap, void *ctx)
++static int alr_loop_cb_del_port_learned(struct lan9303 *chip, u32 dat0,
++ u32 dat1, int portmap, void *ctx)
+ {
+ struct del_port_learned_ctx *del_ctx = ctx;
+ int port = del_ctx->port;
+
+ if (((BIT(port) & portmap) == 0) || (dat1 & LAN9303_ALR_DAT1_STATIC))
+- return;
++ return 0;
+
+ /* learned entries has only one port, we can just delete */
+ dat1 &= ~LAN9303_ALR_DAT1_VALID; /* delete entry */
+ lan9303_alr_make_entry_raw(chip, dat0, dat1);
++
++ return 0;
+ }
+
+ struct port_fdb_dump_ctx {
+@@ -635,19 +641,19 @@ struct port_fdb_dump_ctx {
+ dsa_fdb_dump_cb_t *cb;
+ };
+
+-static void alr_loop_cb_fdb_port_dump(struct lan9303 *chip, u32 dat0,
+- u32 dat1, int portmap, void *ctx)
++static int alr_loop_cb_fdb_port_dump(struct lan9303 *chip, u32 dat0,
++ u32 dat1, int portmap, void *ctx)
+ {
+ struct port_fdb_dump_ctx *dump_ctx = ctx;
+ u8 mac[ETH_ALEN];
+ bool is_static;
+
+ if ((BIT(dump_ctx->port) & portmap) == 0)
+- return;
++ return 0;
+
+ alr_reg_to_mac(dat0, dat1, mac);
+ is_static = !!(dat1 & LAN9303_ALR_DAT1_STATIC);
+- dump_ctx->cb(mac, 0, is_static, dump_ctx->data);
++ return dump_ctx->cb(mac, 0, is_static, dump_ctx->data);
+ }
+
+ /* Set a static ALR entry. Delete entry if port_map is zero */
+@@ -1214,9 +1220,7 @@ static int lan9303_port_fdb_dump(struct dsa_switch *ds, int port,
+ };
+
+ dev_dbg(chip->dev, "%s(%d)\n", __func__, port);
+- lan9303_alr_loop(chip, alr_loop_cb_fdb_port_dump, &dump_ctx);
+-
+- return 0;
++ return lan9303_alr_loop(chip, alr_loop_cb_fdb_port_dump, &dump_ctx);
+ }
+
+ static int lan9303_port_mdb_prepare(struct dsa_switch *ds, int port,
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 6335c4ea09577..2ff6a0be97de6 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -54,6 +54,7 @@ static const struct mt7530_mib_desc mt7530_mib[] = {
+ MIB_DESC(2, 0x48, "TxBytes"),
+ MIB_DESC(1, 0x60, "RxDrop"),
+ MIB_DESC(1, 0x64, "RxFiltering"),
++ MIB_DESC(1, 0x68, "RxUnicast"),
+ MIB_DESC(1, 0x6c, "RxMulticast"),
+ MIB_DESC(1, 0x70, "RxBroadcast"),
+ MIB_DESC(1, 0x74, "RxAlignErr"),
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index ebcf4ea66385a..55827ac65a154 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -282,6 +282,26 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb)
+ return md_dst->u.port_info.port_id;
+ }
+
++static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp,
++ struct bnxt_tx_ring_info *txr,
++ struct netdev_queue *txq)
++{
++ netif_tx_stop_queue(txq);
++
++ /* netif_tx_stop_queue() must be done before checking
++ * tx index in bnxt_tx_avail() below, because in
++ * bnxt_tx_int(), we update tx index before checking for
++ * netif_tx_queue_stopped().
++ */
++ smp_mb();
++ if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) {
++ netif_tx_wake_queue(txq);
++ return false;
++ }
++
++ return true;
++}
++
+ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bnxt *bp = netdev_priv(dev);
+@@ -309,8 +329,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ free_size = bnxt_tx_avail(bp, txr);
+ if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) {
+- netif_tx_stop_queue(txq);
+- return NETDEV_TX_BUSY;
++ if (bnxt_txr_netif_try_stop_queue(bp, txr, txq))
++ return NETDEV_TX_BUSY;
+ }
+
+ length = skb->len;
+@@ -521,16 +541,7 @@ tx_done:
+ if (skb->xmit_more && !tx_buf->is_push)
+ bnxt_db_write(bp, txr->tx_doorbell, DB_KEY_TX | prod);
+
+- netif_tx_stop_queue(txq);
+-
+- /* netif_tx_stop_queue() must be done before checking
+- * tx index in bnxt_tx_avail() below, because in
+- * bnxt_tx_int(), we update tx index before checking for
+- * netif_tx_queue_stopped().
+- */
+- smp_mb();
+- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)
+- netif_tx_wake_queue(txq);
++ bnxt_txr_netif_try_stop_queue(bp, txr, txq);
+ }
+ return NETDEV_TX_OK;
+
+@@ -614,14 +625,9 @@ next_tx_int:
+ smp_mb();
+
+ if (unlikely(netif_tx_queue_stopped(txq)) &&
+- (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)) {
+- __netif_tx_lock(txq, smp_processor_id());
+- if (netif_tx_queue_stopped(txq) &&
+- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh &&
+- txr->dev_state != BNXT_DEV_STATE_CLOSING)
+- netif_tx_wake_queue(txq);
+- __netif_tx_unlock(txq);
+- }
++ bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh &&
++ READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING)
++ netif_tx_wake_queue(txq);
+ }
+
+ static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping,
+@@ -6263,10 +6269,9 @@ static void bnxt_disable_napi(struct bnxt *bp)
+ for (i = 0; i < bp->cp_nr_rings; i++) {
+ struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring;
+
++ napi_disable(&bp->bnapi[i]->napi);
+ if (bp->bnapi[i]->rx_ring)
+ cancel_work_sync(&cpr->dim.work);
+-
+- napi_disable(&bp->bnapi[i]->napi);
+ }
+ }
+
+@@ -6294,9 +6299,11 @@ void bnxt_tx_disable(struct bnxt *bp)
+ if (bp->tx_ring) {
+ for (i = 0; i < bp->tx_nr_rings; i++) {
+ txr = &bp->tx_ring[i];
+- txr->dev_state = BNXT_DEV_STATE_CLOSING;
++ WRITE_ONCE(txr->dev_state, BNXT_DEV_STATE_CLOSING);
+ }
+ }
++ /* Make sure napi polls see @dev_state change */
++ synchronize_net();
+ /* Drop carrier first to prevent TX timeout */
+ netif_carrier_off(bp->dev);
+ /* Stop all TX queues */
+@@ -6310,8 +6317,10 @@ void bnxt_tx_enable(struct bnxt *bp)
+
+ for (i = 0; i < bp->tx_nr_rings; i++) {
+ txr = &bp->tx_ring[i];
+- txr->dev_state = 0;
++ WRITE_ONCE(txr->dev_state, 0);
+ }
++ /* Make sure napi polls see @dev_state change */
++ synchronize_net();
+ netif_tx_wake_all_queues(bp->dev);
+ if (bp->link_info.link_up)
+ netif_carrier_on(bp->dev);
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+index 6ed8294f7df8b..a15845e511b2c 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+@@ -3158,8 +3158,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr,
+
+ indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr);
+ ret = QLCRD32(adapter, indirect_addr, &err);
+- if (err == -EIO)
++ if (err == -EIO) {
++ qlcnic_83xx_unlock_flash(adapter);
+ return err;
++ }
+
+ word = ret;
+ *(u32 *)p_data = word;
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 8c636c4932274..1001e9a2edd4f 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -859,6 +859,12 @@ static void decode_data(struct sixpack *sp, unsigned char inbyte)
+ return;
+ }
+
++ if (sp->rx_count_cooked + 2 >= sizeof(sp->cooked_buf)) {
++ pr_err("6pack: cooked buffer overrun, data loss\n");
++ sp->rx_count = 0;
++ return;
++ }
++
+ buf = sp->raw_buf;
+ sp->cooked_buf[sp->rx_count_cooked++] =
+ buf[0] | ((buf[1] << 2) & 0xc0);
+diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
+index 06aadebc2d5ba..ed60e691cc2b4 100644
+--- a/drivers/net/ieee802154/mac802154_hwsim.c
++++ b/drivers/net/ieee802154/mac802154_hwsim.c
+@@ -432,7 +432,7 @@ static int hwsim_new_edge_nl(struct sk_buff *msg, struct genl_info *info)
+ struct hwsim_edge *e;
+ u32 v0, v1;
+
+- if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] &&
++ if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] ||
+ !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE])
+ return -EINVAL;
+
+@@ -546,7 +546,7 @@ static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info)
+ u32 v0, v1;
+ u8 lqi;
+
+- if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] &&
++ if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] ||
+ !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE])
+ return -EINVAL;
+
+@@ -555,7 +555,7 @@ static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info)
+ hwsim_edge_policy, NULL))
+ return -EINVAL;
+
+- if (!edge_attrs[MAC802154_HWSIM_EDGE_ATTR_ENDPOINT_ID] &&
++ if (!edge_attrs[MAC802154_HWSIM_EDGE_ATTR_ENDPOINT_ID] ||
+ !edge_attrs[MAC802154_HWSIM_EDGE_ATTR_LQI])
+ return -EINVAL;
+
+diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
+index 0a86f1e4c02f5..c16f875ed9ead 100644
+--- a/drivers/net/phy/mdio-mux.c
++++ b/drivers/net/phy/mdio-mux.c
+@@ -85,6 +85,17 @@ out:
+
+ static int parent_count;
+
++static void mdio_mux_uninit_children(struct mdio_mux_parent_bus *pb)
++{
++ struct mdio_mux_child_bus *cb = pb->children;
++
++ while (cb) {
++ mdiobus_unregister(cb->mii_bus);
++ mdiobus_free(cb->mii_bus);
++ cb = cb->next;
++ }
++}
++
+ int mdio_mux_init(struct device *dev,
+ struct device_node *mux_node,
+ int (*switch_fn)(int cur, int desired, void *data),
+@@ -147,7 +158,7 @@ int mdio_mux_init(struct device *dev,
+ cb = devm_kzalloc(dev, sizeof(*cb), GFP_KERNEL);
+ if (!cb) {
+ ret_val = -ENOMEM;
+- continue;
++ goto err_loop;
+ }
+ cb->bus_number = v;
+ cb->parent = pb;
+@@ -155,8 +166,7 @@ int mdio_mux_init(struct device *dev,
+ cb->mii_bus = mdiobus_alloc();
+ if (!cb->mii_bus) {
+ ret_val = -ENOMEM;
+- devm_kfree(dev, cb);
+- continue;
++ goto err_loop;
+ }
+ cb->mii_bus->priv = cb;
+
+@@ -168,11 +178,15 @@ int mdio_mux_init(struct device *dev,
+ cb->mii_bus->write = mdio_mux_write;
+ r = of_mdiobus_register(cb->mii_bus, child_bus_node);
+ if (r) {
++ mdiobus_free(cb->mii_bus);
++ if (r == -EPROBE_DEFER) {
++ ret_val = r;
++ goto err_loop;
++ }
++ devm_kfree(dev, cb);
+ dev_err(dev,
+ "Error: Failed to register MDIO bus for child %pOF\n",
+ child_bus_node);
+- mdiobus_free(cb->mii_bus);
+- devm_kfree(dev, cb);
+ } else {
+ cb->next = pb->children;
+ pb->children = cb;
+@@ -185,6 +199,10 @@ int mdio_mux_init(struct device *dev,
+
+ dev_err(dev, "Error: No acceptable child buses found\n");
+ devm_kfree(dev, pb);
++
++err_loop:
++ mdio_mux_uninit_children(pb);
++ of_node_put(child_bus_node);
+ err_pb_kz:
+ put_device(&parent_bus->dev);
+ err_parent_bus:
+@@ -196,14 +214,8 @@ EXPORT_SYMBOL_GPL(mdio_mux_init);
+ void mdio_mux_uninit(void *mux_handle)
+ {
+ struct mdio_mux_parent_bus *pb = mux_handle;
+- struct mdio_mux_child_bus *cb = pb->children;
+-
+- while (cb) {
+- mdiobus_unregister(cb->mii_bus);
+- mdiobus_free(cb->mii_bus);
+- cb = cb->next;
+- }
+
++ mdio_mux_uninit_children(pb);
+ put_device(&pb->mii_bus->dev);
+ }
+ EXPORT_SYMBOL_GPL(mdio_mux_uninit);
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 1af47aaa7ba57..dc9de8731c564 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -1125,7 +1125,7 @@ static int ppp_nl_newlink(struct net *src_net, struct net_device *dev,
+ * the PPP unit identifer as suffix (i.e. ppp<unit_id>). This allows
+ * userspace to infer the device name using to the PPPIOCGUNIT ioctl.
+ */
+- if (!tb[IFLA_IFNAME])
++ if (!tb[IFLA_IFNAME] || !nla_len(tb[IFLA_IFNAME]) || !*(char *)nla_data(tb[IFLA_IFNAME]))
+ conf.ifname_is_set = false;
+
+ err = ppp_dev_configure(src_net, dev, &conf);
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 5bd07cdb3e6e2..ac5f72077b267 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1172,7 +1172,7 @@ static int lan78xx_link_reset(struct lan78xx_net *dev)
+ {
+ struct phy_device *phydev = dev->net->phydev;
+ struct ethtool_link_ksettings ecmd;
+- int ladv, radv, ret;
++ int ladv, radv, ret, link;
+ u32 buf;
+
+ /* clear LAN78xx interrupt status */
+@@ -1180,9 +1180,12 @@ static int lan78xx_link_reset(struct lan78xx_net *dev)
+ if (unlikely(ret < 0))
+ return -EIO;
+
++ mutex_lock(&phydev->lock);
+ phy_read_status(phydev);
++ link = phydev->link;
++ mutex_unlock(&phydev->lock);
+
+- if (!phydev->link && dev->link_on) {
++ if (!link && dev->link_on) {
+ dev->link_on = false;
+
+ /* reset MAC */
+@@ -1195,7 +1198,7 @@ static int lan78xx_link_reset(struct lan78xx_net *dev)
+ return -EIO;
+
+ del_timer(&dev->stat_monitor);
+- } else if (phydev->link && !dev->link_on) {
++ } else if (link && !dev->link_on) {
+ dev->link_on = true;
+
+ phy_ethtool_ksettings_get(phydev, &ecmd);
+@@ -1485,9 +1488,14 @@ static int lan78xx_set_eee(struct net_device *net, struct ethtool_eee *edata)
+
+ static u32 lan78xx_get_link(struct net_device *net)
+ {
++ u32 link;
++
++ mutex_lock(&net->phydev->lock);
+ phy_read_status(net->phydev);
++ link = net->phydev->link;
++ mutex_unlock(&net->phydev->lock);
+
+- return net->phydev->link;
++ return link;
+ }
+
+ static void lan78xx_get_drvinfo(struct net_device *net,
+diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
+index 7a364eca46d64..f083fb9038c36 100644
+--- a/drivers/net/wireless/ath/ath.h
++++ b/drivers/net/wireless/ath/ath.h
+@@ -197,12 +197,13 @@ struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
+ bool ath_is_mybeacon(struct ath_common *common, struct ieee80211_hdr *hdr);
+
+ void ath_hw_setbssidmask(struct ath_common *common);
+-void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key);
++void ath_key_delete(struct ath_common *common, u8 hw_key_idx);
+ int ath_key_config(struct ath_common *common,
+ struct ieee80211_vif *vif,
+ struct ieee80211_sta *sta,
+ struct ieee80211_key_conf *key);
+ bool ath_hw_keyreset(struct ath_common *common, u16 entry);
++bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac);
+ void ath_hw_cycle_counters_update(struct ath_common *common);
+ int32_t ath_hw_get_listen_time(struct ath_common *common);
+
+diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+index 16e052d02c940..0f4836fc3b7c1 100644
+--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
++++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+@@ -522,7 +522,7 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ }
+ break;
+ case DISABLE_KEY:
+- ath_key_delete(common, key);
++ ath_key_delete(common, key->hw_key_idx);
+ break;
+ default:
+ ret = -EINVAL;
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+index a82ad739ab806..16a7bae62b7d3 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+@@ -1460,7 +1460,7 @@ static int ath9k_htc_set_key(struct ieee80211_hw *hw,
+ }
+ break;
+ case DISABLE_KEY:
+- ath_key_delete(common, key);
++ ath_key_delete(common, key->hw_key_idx);
+ break;
+ default:
+ ret = -EINVAL;
+diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
+index 68956cdc8c9ae..4b5687b6c0c9a 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -818,6 +818,7 @@ struct ath_hw {
+ struct ath9k_pacal_info pacal_info;
+ struct ar5416Stats stats;
+ struct ath9k_tx_queue_info txq[ATH9K_NUM_TX_QUEUES];
++ DECLARE_BITMAP(pending_del_keymap, ATH_KEYMAX);
+
+ enum ath9k_int imask;
+ u32 imrs2_reg;
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index e929020d7c9cb..a0097bebcba3b 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -823,12 +823,80 @@ exit:
+ ieee80211_free_txskb(hw, skb);
+ }
+
++static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix)
++{
++ struct ath_buf *bf;
++ struct ieee80211_tx_info *txinfo;
++ struct ath_frame_info *fi;
++
++ list_for_each_entry(bf, txq_list, list) {
++ if (bf->bf_state.stale || !bf->bf_mpdu)
++ continue;
++
++ txinfo = IEEE80211_SKB_CB(bf->bf_mpdu);
++ fi = (struct ath_frame_info *)&txinfo->rate_driver_data[0];
++ if (fi->keyix == keyix)
++ return true;
++ }
++
++ return false;
++}
++
++static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix)
++{
++ struct ath_hw *ah = sc->sc_ah;
++ int i;
++ struct ath_txq *txq;
++ bool key_in_use = false;
++
++ for (i = 0; !key_in_use && i < ATH9K_NUM_TX_QUEUES; i++) {
++ if (!ATH_TXQ_SETUP(sc, i))
++ continue;
++ txq = &sc->tx.txq[i];
++ if (!txq->axq_depth)
++ continue;
++ if (!ath9k_hw_numtxpending(ah, txq->axq_qnum))
++ continue;
++
++ ath_txq_lock(sc, txq);
++ key_in_use = ath9k_txq_list_has_key(&txq->axq_q, keyix);
++ if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
++ int idx = txq->txq_tailidx;
++
++ while (!key_in_use &&
++ !list_empty(&txq->txq_fifo[idx])) {
++ key_in_use = ath9k_txq_list_has_key(
++ &txq->txq_fifo[idx], keyix);
++ INCR(idx, ATH_TXFIFO_DEPTH);
++ }
++ }
++ ath_txq_unlock(sc, txq);
++ }
++
++ return key_in_use;
++}
++
++static void ath9k_pending_key_del(struct ath_softc *sc, u8 keyix)
++{
++ struct ath_hw *ah = sc->sc_ah;
++ struct ath_common *common = ath9k_hw_common(ah);
++
++ if (!test_bit(keyix, ah->pending_del_keymap) ||
++ ath9k_txq_has_key(sc, keyix))
++ return;
++
++ /* No more TXQ frames point to this key cache entry, so delete it. */
++ clear_bit(keyix, ah->pending_del_keymap);
++ ath_key_delete(common, keyix);
++}
++
+ static void ath9k_stop(struct ieee80211_hw *hw)
+ {
+ struct ath_softc *sc = hw->priv;
+ struct ath_hw *ah = sc->sc_ah;
+ struct ath_common *common = ath9k_hw_common(ah);
+ bool prev_idle;
++ int i;
+
+ ath9k_deinit_channel_context(sc);
+
+@@ -896,6 +964,14 @@ static void ath9k_stop(struct ieee80211_hw *hw)
+
+ spin_unlock_bh(&sc->sc_pcu_lock);
+
++ for (i = 0; i < ATH_KEYMAX; i++)
++ ath9k_pending_key_del(sc, i);
++
++ /* Clear key cache entries explicitly to get rid of any potentially
++ * remaining keys.
++ */
++ ath9k_cmn_init_crypto(sc->sc_ah);
++
+ ath9k_ps_restore(sc);
+
+ sc->ps_idle = prev_idle;
+@@ -1541,12 +1617,11 @@ static void ath9k_del_ps_key(struct ath_softc *sc,
+ {
+ struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+ struct ath_node *an = (struct ath_node *) sta->drv_priv;
+- struct ieee80211_key_conf ps_key = { .hw_key_idx = an->ps_key };
+
+ if (!an->ps_key)
+ return;
+
+- ath_key_delete(common, &ps_key);
++ ath_key_delete(common, an->ps_key);
+ an->ps_key = 0;
+ an->key_idx[0] = 0;
+ }
+@@ -1708,6 +1783,12 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
+ if (sta)
+ an = (struct ath_node *)sta->drv_priv;
+
++ /* Delete pending key cache entries if no more frames are pointing to
++ * them in TXQs.
++ */
++ for (i = 0; i < ATH_KEYMAX; i++)
++ ath9k_pending_key_del(sc, i);
++
+ switch (cmd) {
+ case SET_KEY:
+ if (sta)
+@@ -1737,7 +1818,15 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
+ }
+ break;
+ case DISABLE_KEY:
+- ath_key_delete(common, key);
++ if (ath9k_txq_has_key(sc, key->hw_key_idx)) {
++ /* Delay key cache entry deletion until there are no
++ * remaining TXQ frames pointing to this entry.
++ */
++ set_bit(key->hw_key_idx, sc->sc_ah->pending_del_keymap);
++ ath_hw_keysetmac(common, key->hw_key_idx, NULL);
++ } else {
++ ath_key_delete(common, key->hw_key_idx);
++ }
+ if (an) {
+ for (i = 0; i < ARRAY_SIZE(an->key_idx); i++) {
+ if (an->key_idx[i] != key->hw_key_idx)
+diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c
+index 1816b4e7dc264..61b59a804e308 100644
+--- a/drivers/net/wireless/ath/key.c
++++ b/drivers/net/wireless/ath/key.c
+@@ -84,8 +84,7 @@ bool ath_hw_keyreset(struct ath_common *common, u16 entry)
+ }
+ EXPORT_SYMBOL(ath_hw_keyreset);
+
+-static bool ath_hw_keysetmac(struct ath_common *common,
+- u16 entry, const u8 *mac)
++bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac)
+ {
+ u32 macHi, macLo;
+ u32 unicast_flag = AR_KEYTABLE_VALID;
+@@ -125,6 +124,7 @@ static bool ath_hw_keysetmac(struct ath_common *common,
+
+ return true;
+ }
++EXPORT_SYMBOL(ath_hw_keysetmac);
+
+ static bool ath_hw_set_keycache_entry(struct ath_common *common, u16 entry,
+ const struct ath_keyval *k,
+@@ -581,29 +581,38 @@ EXPORT_SYMBOL(ath_key_config);
+ /*
+ * Delete Key.
+ */
+-void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key)
++void ath_key_delete(struct ath_common *common, u8 hw_key_idx)
+ {
+- ath_hw_keyreset(common, key->hw_key_idx);
+- if (key->hw_key_idx < IEEE80211_WEP_NKID)
++ /* Leave CCMP and TKIP (main key) configured to avoid disabling
++ * encryption for potentially pending frames already in a TXQ with the
++ * keyix pointing to this key entry. Instead, only clear the MAC address
++ * to prevent RX processing from using this key cache entry.
++ */
++ if (test_bit(hw_key_idx, common->ccmp_keymap) ||
++ test_bit(hw_key_idx, common->tkip_keymap))
++ ath_hw_keysetmac(common, hw_key_idx, NULL);
++ else
++ ath_hw_keyreset(common, hw_key_idx);
++ if (hw_key_idx < IEEE80211_WEP_NKID)
+ return;
+
+- clear_bit(key->hw_key_idx, common->keymap);
+- clear_bit(key->hw_key_idx, common->ccmp_keymap);
+- if (key->cipher != WLAN_CIPHER_SUITE_TKIP)
++ clear_bit(hw_key_idx, common->keymap);
++ clear_bit(hw_key_idx, common->ccmp_keymap);
++ if (!test_bit(hw_key_idx, common->tkip_keymap))
+ return;
+
+- clear_bit(key->hw_key_idx + 64, common->keymap);
++ clear_bit(hw_key_idx + 64, common->keymap);
+
+- clear_bit(key->hw_key_idx, common->tkip_keymap);
+- clear_bit(key->hw_key_idx + 64, common->tkip_keymap);
++ clear_bit(hw_key_idx, common->tkip_keymap);
++ clear_bit(hw_key_idx + 64, common->tkip_keymap);
+
+ if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) {
+- ath_hw_keyreset(common, key->hw_key_idx + 32);
+- clear_bit(key->hw_key_idx + 32, common->keymap);
+- clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
++ ath_hw_keyreset(common, hw_key_idx + 32);
++ clear_bit(hw_key_idx + 32, common->keymap);
++ clear_bit(hw_key_idx + 64 + 32, common->keymap);
+
+- clear_bit(key->hw_key_idx + 32, common->tkip_keymap);
+- clear_bit(key->hw_key_idx + 64 + 32, common->tkip_keymap);
++ clear_bit(hw_key_idx + 32, common->tkip_keymap);
++ clear_bit(hw_key_idx + 64 + 32, common->tkip_keymap);
+ }
+ }
+ EXPORT_SYMBOL(ath_key_delete);
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index 23a363fd4c59c..bc80b0f0ea1ba 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -170,24 +170,25 @@ static inline __attribute_const__ u32 msi_mask(unsigned x)
+ * reliably as devices without an INTx disable bit will then generate a
+ * level IRQ which will never be cleared.
+ */
+-u32 __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag)
++void __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag)
+ {
+- u32 mask_bits = desc->masked;
++ raw_spinlock_t *lock = &desc->dev->msi_lock;
++ unsigned long flags;
+
+ if (pci_msi_ignore_mask || !desc->msi_attrib.maskbit)
+- return 0;
++ return;
+
+- mask_bits &= ~mask;
+- mask_bits |= flag;
++ raw_spin_lock_irqsave(lock, flags);
++ desc->masked &= ~mask;
++ desc->masked |= flag;
+ pci_write_config_dword(msi_desc_to_pci_dev(desc), desc->mask_pos,
+- mask_bits);
+-
+- return mask_bits;
++ desc->masked);
++ raw_spin_unlock_irqrestore(lock, flags);
+ }
+
+ static void msi_mask_irq(struct msi_desc *desc, u32 mask, u32 flag)
+ {
+- desc->masked = __pci_msi_desc_mask_irq(desc, mask, flag);
++ __pci_msi_desc_mask_irq(desc, mask, flag);
+ }
+
+ static void __iomem *pci_msix_desc_addr(struct msi_desc *desc)
+@@ -302,10 +303,28 @@ void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
+ /* Don't touch the hardware now */
+ } else if (entry->msi_attrib.is_msix) {
+ void __iomem *base = pci_msix_desc_addr(entry);
++ bool unmasked = !(entry->masked & PCI_MSIX_ENTRY_CTRL_MASKBIT);
++
++ /*
++ * The specification mandates that the entry is masked
++ * when the message is modified:
++ *
++ * "If software changes the Address or Data value of an
++ * entry while the entry is unmasked, the result is
++ * undefined."
++ */
++ if (unmasked)
++ __pci_msix_desc_mask_irq(entry, PCI_MSIX_ENTRY_CTRL_MASKBIT);
+
+ writel(msg->address_lo, base + PCI_MSIX_ENTRY_LOWER_ADDR);
+ writel(msg->address_hi, base + PCI_MSIX_ENTRY_UPPER_ADDR);
+ writel(msg->data, base + PCI_MSIX_ENTRY_DATA);
++
++ if (unmasked)
++ __pci_msix_desc_mask_irq(entry, 0);
++
++ /* Ensure that the writes are visible in the device */
++ readl(base + PCI_MSIX_ENTRY_DATA);
+ } else {
+ int pos = dev->msi_cap;
+ u16 msgctl;
+@@ -326,6 +345,8 @@ void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
+ pci_write_config_word(dev, pos + PCI_MSI_DATA_32,
+ msg->data);
+ }
++ /* Ensure that the writes are visible in the device */
++ pci_read_config_word(dev, pos + PCI_MSI_FLAGS, &msgctl);
+ }
+ entry->msg = *msg;
+ }
+@@ -619,21 +640,21 @@ static int msi_capability_init(struct pci_dev *dev, int nvec,
+ /* Configure MSI capability structure */
+ ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI);
+ if (ret) {
+- msi_mask_irq(entry, mask, ~mask);
++ msi_mask_irq(entry, mask, 0);
+ free_msi_irqs(dev);
+ return ret;
+ }
+
+ ret = msi_verify_entries(dev);
+ if (ret) {
+- msi_mask_irq(entry, mask, ~mask);
++ msi_mask_irq(entry, mask, 0);
+ free_msi_irqs(dev);
+ return ret;
+ }
+
+ ret = populate_msi_sysfs(dev);
+ if (ret) {
+- msi_mask_irq(entry, mask, ~mask);
++ msi_mask_irq(entry, mask, 0);
+ free_msi_irqs(dev);
+ return ret;
+ }
+@@ -674,6 +695,7 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
+ {
+ struct cpumask *curmsk, *masks = NULL;
+ struct msi_desc *entry;
++ void __iomem *addr;
+ int ret, i;
+
+ if (affd)
+@@ -693,6 +715,7 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
+
+ entry->msi_attrib.is_msix = 1;
+ entry->msi_attrib.is_64 = 1;
++
+ if (entries)
+ entry->msi_attrib.entry_nr = entries[i].entry;
+ else
+@@ -700,6 +723,10 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
+ entry->msi_attrib.default_irq = dev->irq;
+ entry->mask_base = base;
+
++ addr = pci_msix_desc_addr(entry);
++ if (addr)
++ entry->masked = readl(addr + PCI_MSIX_ENTRY_VECTOR_CTRL);
++
+ list_add_tail(&entry->list, dev_to_msi_list(&dev->dev));
+ if (masks)
+ curmsk++;
+@@ -710,21 +737,27 @@ out:
+ return ret;
+ }
+
+-static void msix_program_entries(struct pci_dev *dev,
+- struct msix_entry *entries)
++static void msix_update_entries(struct pci_dev *dev, struct msix_entry *entries)
+ {
+ struct msi_desc *entry;
+- int i = 0;
+
+ for_each_pci_msi_entry(entry, dev) {
+- if (entries)
+- entries[i++].vector = entry->irq;
+- entry->masked = readl(pci_msix_desc_addr(entry) +
+- PCI_MSIX_ENTRY_VECTOR_CTRL);
+- msix_mask_irq(entry, 1);
++ if (entries) {
++ entries->vector = entry->irq;
++ entries++;
++ }
+ }
+ }
+
++static void msix_mask_all(void __iomem *base, int tsize)
++{
++ u32 ctrl = PCI_MSIX_ENTRY_CTRL_MASKBIT;
++ int i;
++
++ for (i = 0; i < tsize; i++, base += PCI_MSIX_ENTRY_SIZE)
++ writel(ctrl, base + PCI_MSIX_ENTRY_VECTOR_CTRL);
++}
++
+ /**
+ * msix_capability_init - configure device's MSI-X capability
+ * @dev: pointer to the pci_dev data structure of MSI-X device function
+@@ -739,22 +772,33 @@ static void msix_program_entries(struct pci_dev *dev,
+ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ int nvec, const struct irq_affinity *affd)
+ {
+- int ret;
+- u16 control;
+ void __iomem *base;
++ int ret, tsize;
++ u16 control;
+
+- /* Ensure MSI-X is disabled while it is set up */
+- pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0);
++ /*
++ * Some devices require MSI-X to be enabled before the MSI-X
++ * registers can be accessed. Mask all the vectors to prevent
++ * interrupts coming in before they're fully set up.
++ */
++ pci_msix_clear_and_set_ctrl(dev, 0, PCI_MSIX_FLAGS_MASKALL |
++ PCI_MSIX_FLAGS_ENABLE);
+
+ pci_read_config_word(dev, dev->msix_cap + PCI_MSIX_FLAGS, &control);
+ /* Request & Map MSI-X table region */
+- base = msix_map_region(dev, msix_table_size(control));
+- if (!base)
+- return -ENOMEM;
++ tsize = msix_table_size(control);
++ base = msix_map_region(dev, tsize);
++ if (!base) {
++ ret = -ENOMEM;
++ goto out_disable;
++ }
++
++ /* Ensure that all table entries are masked. */
++ msix_mask_all(base, tsize);
+
+ ret = msix_setup_entries(dev, base, entries, nvec, affd);
+ if (ret)
+- return ret;
++ goto out_disable;
+
+ ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSIX);
+ if (ret)
+@@ -765,15 +809,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ if (ret)
+ goto out_free;
+
+- /*
+- * Some devices require MSI-X to be enabled before we can touch the
+- * MSI-X registers. We need to mask all the vectors to prevent
+- * interrupts coming in before they're fully set up.
+- */
+- pci_msix_clear_and_set_ctrl(dev, 0,
+- PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE);
+-
+- msix_program_entries(dev, entries);
++ msix_update_entries(dev, entries);
+
+ ret = populate_msi_sysfs(dev);
+ if (ret)
+@@ -807,6 +843,9 @@ out_avail:
+ out_free:
+ free_msi_irqs(dev);
+
++out_disable:
++ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0);
++
+ return ret;
+ }
+
+@@ -894,8 +933,7 @@ static void pci_msi_shutdown(struct pci_dev *dev)
+
+ /* Return the device with MSI unmasked as initial states */
+ mask = msi_mask(desc->msi_attrib.multi_cap);
+- /* Keep cached state to be restored */
+- __pci_msi_desc_mask_irq(desc, mask, ~mask);
++ msi_mask_irq(desc, mask, 0);
+
+ /* Restore dev->irq to its default pin-assertion irq */
+ dev->irq = desc->msi_attrib.default_irq;
+@@ -980,10 +1018,8 @@ static void pci_msix_shutdown(struct pci_dev *dev)
+ }
+
+ /* Return the device with MSI-X masked as initial states */
+- for_each_pci_msi_entry(entry, dev) {
+- /* Keep cached states to be restored */
++ for_each_pci_msi_entry(entry, dev)
+ __pci_msix_desc_mask_irq(entry, 1);
+- }
+
+ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0);
+ pci_intx_for_msi(dev, 1);
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index f287a9f919da1..7e873b6b7d558 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1882,6 +1882,7 @@ static void quirk_ryzen_xhci_d3hot(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e0, quirk_ryzen_xhci_d3hot);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e1, quirk_ryzen_xhci_d3hot);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1639, quirk_ryzen_xhci_d3hot);
+
+ #ifdef CONFIG_X86_IO_APIC
+ static int dmi_disable_ioapicreroute(const struct dmi_system_id *d)
+diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig
+index d137c480db46b..dd04aedd76e0b 100644
+--- a/drivers/ptp/Kconfig
++++ b/drivers/ptp/Kconfig
+@@ -91,7 +91,8 @@ config DP83640_PHY
+ config PTP_1588_CLOCK_PCH
+ tristate "Intel PCH EG20T as PTP clock"
+ depends on X86_32 || COMPILE_TEST
+- depends on HAS_IOMEM && NET
++ depends on HAS_IOMEM && PCI
++ depends on NET
+ imply PTP_1588_CLOCK
+ help
+ This driver adds support for using the PCH EG20T as a PTP
+diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
+index 6c629ef1bc4e3..b3c23edd4b6cb 100644
+--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
++++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
+@@ -453,8 +453,8 @@ static int initialize_controller(struct scsi_device *sdev,
+ if (!h->ctlr)
+ err = SCSI_DH_RES_TEMP_UNAVAIL;
+ else {
+- list_add_rcu(&h->node, &h->ctlr->dh_list);
+ h->sdev = sdev;
++ list_add_rcu(&h->node, &h->ctlr->dh_list);
+ }
+ spin_unlock(&list_lock);
+ err = SCSI_DH_OK;
+@@ -779,11 +779,11 @@ static void rdac_bus_detach( struct scsi_device *sdev )
+ spin_lock(&list_lock);
+ if (h->ctlr) {
+ list_del_rcu(&h->node);
+- h->sdev = NULL;
+ kref_put(&h->ctlr->kref, release_controller);
+ }
+ spin_unlock(&list_lock);
+ sdev->handler_data = NULL;
++ synchronize_rcu();
+ kfree(h);
+ }
+
+diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c
+index 8428247015db6..81df2c94b7473 100644
+--- a/drivers/scsi/megaraid/megaraid_mm.c
++++ b/drivers/scsi/megaraid/megaraid_mm.c
+@@ -250,7 +250,7 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval)
+ mimd_t mimd;
+ uint32_t adapno;
+ int iterator;
+-
++ bool is_found;
+
+ if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) {
+ *rval = -EFAULT;
+@@ -266,12 +266,16 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval)
+
+ adapter = NULL;
+ iterator = 0;
++ is_found = false;
+
+ list_for_each_entry(adapter, &adapters_list_g, list) {
+- if (iterator++ == adapno) break;
++ if (iterator++ == adapno) {
++ is_found = true;
++ break;
++ }
+ }
+
+- if (!adapter) {
++ if (!is_found) {
+ *rval = -ENODEV;
+ return NULL;
+ }
+@@ -737,6 +741,7 @@ ioctl_done(uioc_t *kioc)
+ uint32_t adapno;
+ int iterator;
+ mraid_mmadp_t* adapter;
++ bool is_found;
+
+ /*
+ * When the kioc returns from driver, make sure it still doesn't
+@@ -759,19 +764,23 @@ ioctl_done(uioc_t *kioc)
+ iterator = 0;
+ adapter = NULL;
+ adapno = kioc->adapno;
++ is_found = false;
+
+ con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed "
+ "ioctl that was timedout before\n"));
+
+ list_for_each_entry(adapter, &adapters_list_g, list) {
+- if (iterator++ == adapno) break;
++ if (iterator++ == adapno) {
++ is_found = true;
++ break;
++ }
+ }
+
+ kioc->timedout = 0;
+
+- if (adapter) {
++ if (is_found)
+ mraid_mm_dealloc_kioc( adapter, kioc );
+- }
++
+ }
+ else {
+ wake_up(&wait_q);
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 009a5b2aa3d02..149465de35b2d 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -462,7 +462,8 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
+ error = shost->hostt->target_alloc(starget);
+
+ if(error) {
+- dev_printk(KERN_ERR, dev, "target allocation failed, error %d\n", error);
++ if (error != -ENXIO)
++ dev_err(dev, "target allocation failed, error %d\n", error);
+ /* don't want scsi_target_reap to do the final
+ * put because it will be under the host lock */
+ scsi_target_destroy(starget);
+diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
+index d5879142dbef1..ddf0371ad52b2 100644
+--- a/drivers/slimbus/messaging.c
++++ b/drivers/slimbus/messaging.c
+@@ -66,7 +66,7 @@ int slim_alloc_txn_tid(struct slim_controller *ctrl, struct slim_msg_txn *txn)
+ int ret = 0;
+
+ spin_lock_irqsave(&ctrl->txn_lock, flags);
+- ret = idr_alloc_cyclic(&ctrl->tid_idr, txn, 0,
++ ret = idr_alloc_cyclic(&ctrl->tid_idr, txn, 1,
+ SLIM_MAX_TIDS, GFP_ATOMIC);
+ if (ret < 0) {
+ spin_unlock_irqrestore(&ctrl->txn_lock, flags);
+@@ -131,7 +131,8 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn)
+ goto slim_xfer_err;
+ }
+ }
+-
++ /* Initialize tid to invalid value */
++ txn->tid = 0;
+ need_tid = slim_tid_txn(txn->mt, txn->mc);
+
+ if (need_tid) {
+@@ -163,7 +164,7 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn)
+ txn->mt, txn->mc, txn->la, ret);
+
+ slim_xfer_err:
+- if (!clk_pause_msg && (!need_tid || ret == -ETIMEDOUT)) {
++ if (!clk_pause_msg && (txn->tid == 0 || ret == -ETIMEDOUT)) {
+ /*
+ * remove runtime-pm vote if this was TX only, or
+ * if there was error during this transaction
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 44021620d1013..1a5311fb45a5f 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1060,7 +1060,8 @@ static void qcom_slim_ngd_setup(struct qcom_slim_ngd_ctrl *ctrl)
+ {
+ u32 cfg = readl_relaxed(ctrl->ngd->base);
+
+- if (ctrl->state == QCOM_SLIM_NGD_CTRL_DOWN)
++ if (ctrl->state == QCOM_SLIM_NGD_CTRL_DOWN ||
++ ctrl->state == QCOM_SLIM_NGD_CTRL_ASLEEP)
+ qcom_slim_ngd_init_dma(ctrl);
+
+ /* By default enable message queues */
+@@ -1111,6 +1112,7 @@ static int qcom_slim_ngd_power_up(struct qcom_slim_ngd_ctrl *ctrl)
+ dev_info(ctrl->dev, "Subsys restart: ADSP active framer\n");
+ return 0;
+ }
++ qcom_slim_ngd_setup(ctrl);
+ return 0;
+ }
+
+@@ -1496,6 +1498,7 @@ static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev)
+ struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
+ int ret = 0;
+
++ qcom_slim_ngd_exit_dma(ctrl);
+ if (!ctrl->qmi.handle)
+ return 0;
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 732327756ee11..7a58f629155d2 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -678,10 +678,16 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz)
+ (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8);
+ }
+
++/* Make sure 64 bit math will not overflow. */
+ static bool vhost_overflow(u64 uaddr, u64 size)
+ {
+- /* Make sure 64 bit math will not overflow. */
+- return uaddr > ULONG_MAX || size > ULONG_MAX || uaddr > ULONG_MAX - size;
++ if (uaddr > ULONG_MAX || size > ULONG_MAX)
++ return true;
++
++ if (!size)
++ return false;
++
++ return uaddr > ULONG_MAX - size + 1;
+ }
+
+ /* Caller should have vq mutex and device mutex. */
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index a2f8130e18fec..d138027034fd6 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -133,12 +133,12 @@ static void disable_dynirq(struct irq_data *data);
+
+ static DEFINE_PER_CPU(unsigned int, irq_epoch);
+
+-static void clear_evtchn_to_irq_row(unsigned row)
++static void clear_evtchn_to_irq_row(int *evtchn_row)
+ {
+ unsigned col;
+
+ for (col = 0; col < EVTCHN_PER_ROW; col++)
+- WRITE_ONCE(evtchn_to_irq[row][col], -1);
++ WRITE_ONCE(evtchn_row[col], -1);
+ }
+
+ static void clear_evtchn_to_irq_all(void)
+@@ -148,7 +148,7 @@ static void clear_evtchn_to_irq_all(void)
+ for (row = 0; row < EVTCHN_ROW(xen_evtchn_max_channels()); row++) {
+ if (evtchn_to_irq[row] == NULL)
+ continue;
+- clear_evtchn_to_irq_row(row);
++ clear_evtchn_to_irq_row(evtchn_to_irq[row]);
+ }
+ }
+
+@@ -156,6 +156,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq)
+ {
+ unsigned row;
+ unsigned col;
++ int *evtchn_row;
+
+ if (evtchn >= xen_evtchn_max_channels())
+ return -EINVAL;
+@@ -168,11 +169,18 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq)
+ if (irq == -1)
+ return 0;
+
+- evtchn_to_irq[row] = (int *)get_zeroed_page(GFP_KERNEL);
+- if (evtchn_to_irq[row] == NULL)
++ evtchn_row = (int *) __get_free_pages(GFP_KERNEL, 0);
++ if (evtchn_row == NULL)
+ return -ENOMEM;
+
+- clear_evtchn_to_irq_row(row);
++ clear_evtchn_to_irq_row(evtchn_row);
++
++ /*
++ * We've prepared an empty row for the mapping. If a different
++ * thread was faster inserting it, we can drop ours.
++ */
++ if (cmpxchg(&evtchn_to_irq[row], NULL, evtchn_row) != NULL)
++ free_page((unsigned long) evtchn_row);
+ }
+
+ WRITE_ONCE(evtchn_to_irq[row][col], irq);
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index d29f4cf125d27..6f02a3f77fa83 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -9556,8 +9556,14 @@ static int btrfs_rename_exchange(struct inode *old_dir,
+ bool sync_log_dest = false;
+ bool commit_transaction = false;
+
+- /* we only allow rename subvolume link between subvolumes */
+- if (old_ino != BTRFS_FIRST_FREE_OBJECTID && root != dest)
++ /*
++ * For non-subvolumes allow exchange only within one subvolume, in the
++ * same inode namespace. Two subvolumes (represented as directory) can
++ * be exchanged as they're a logical link and have a fixed inode number.
++ */
++ if (root != dest &&
++ (old_ino != BTRFS_FIRST_FREE_OBJECTID ||
++ new_ino != BTRFS_FIRST_FREE_OBJECTID))
+ return -EXDEV;
+
+ btrfs_init_log_ctx(&ctx_root, old_inode);
+diff --git a/fs/namespace.c b/fs/namespace.c
+index edd397fa29913..2f3c6a0350a8d 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1610,13 +1610,22 @@ static inline bool may_mount(void)
+ return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
+ }
+
++#ifdef CONFIG_MANDATORY_FILE_LOCKING
++static bool may_mandlock(void)
++{
++ pr_warn_once("======================================================\n"
++ "WARNING: the mand mount option is being deprecated and\n"
++ " will be removed in v5.15!\n"
++ "======================================================\n");
++ return capable(CAP_SYS_ADMIN);
++}
++#else
+ static inline bool may_mandlock(void)
+ {
+-#ifndef CONFIG_MANDATORY_FILE_LOCKING
++ pr_warn("VFS: \"mand\" mount option not supported");
+ return false;
+-#endif
+- return capable(CAP_SYS_ADMIN);
+ }
++#endif
+
+ /*
+ * Now umount can handle mount points as well as block devices.
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index ad8766e1635e4..a26e6f5034a63 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -508,6 +508,7 @@
+ NOINSTR_TEXT \
+ *(.text..refcount) \
+ *(.ref.text) \
++ *(.text.asan.* .text.tsan.*) \
+ MEM_KEEP(init.text*) \
+ MEM_KEEP(exit.text*) \
+
+diff --git a/include/linux/device.h b/include/linux/device.h
+index b1c8150e9ea57..37e359d81a86f 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -998,6 +998,7 @@ struct device {
+ struct dev_pin_info *pins;
+ #endif
+ #ifdef CONFIG_GENERIC_MSI_IRQ
++ raw_spinlock_t msi_lock;
+ struct list_head msi_list;
+ #endif
+
+diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
+index a64f21a97369a..131f93f8d5872 100644
+--- a/include/linux/inetdevice.h
++++ b/include/linux/inetdevice.h
+@@ -41,7 +41,7 @@ struct in_device {
+ unsigned long mr_qri; /* Query Response Interval */
+ unsigned char mr_qrv; /* Query Robustness Variable */
+ unsigned char mr_gq_running;
+- unsigned char mr_ifc_count;
++ u32 mr_ifc_count;
+ struct timer_list mr_gq_timer; /* general query timer */
+ struct timer_list mr_ifc_timer; /* interface change timer */
+
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index a042faefb9b73..9504267414a45 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -535,6 +535,7 @@ struct irq_chip {
+ * IRQCHIP_ONESHOT_SAFE: One shot does not require mask/unmask
+ * IRQCHIP_EOI_THREADED: Chip requires eoi() on unmask in threaded mode
+ * IRQCHIP_SUPPORTS_LEVEL_MSI Chip can provide two doorbells for Level MSIs
++ * IRQCHIP_AFFINITY_PRE_STARTUP: Default affinity update before startup
+ */
+ enum {
+ IRQCHIP_SET_TYPE_MASKED = (1 << 0),
+@@ -545,6 +546,7 @@ enum {
+ IRQCHIP_ONESHOT_SAFE = (1 << 5),
+ IRQCHIP_EOI_THREADED = (1 << 6),
+ IRQCHIP_SUPPORTS_LEVEL_MSI = (1 << 7),
++ IRQCHIP_AFFINITY_PRE_STARTUP = (1 << 10),
+ };
+
+ #include <linux/irqdesc.h>
+diff --git a/include/linux/msi.h b/include/linux/msi.h
+index 5dd171849a27e..62982e6afddfd 100644
+--- a/include/linux/msi.h
++++ b/include/linux/msi.h
+@@ -150,7 +150,7 @@ void __pci_read_msi_msg(struct msi_desc *entry, struct msi_msg *msg);
+ void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg);
+
+ u32 __pci_msix_desc_mask_irq(struct msi_desc *desc, u32 flag);
+-u32 __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag);
++void __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag);
+ void pci_msi_mask_irq(struct irq_data *data);
+ void pci_msi_unmask_irq(struct irq_data *data);
+
+diff --git a/include/net/psample.h b/include/net/psample.h
+index 94cb37a7bf756..796f01e5635d7 100644
+--- a/include/net/psample.h
++++ b/include/net/psample.h
+@@ -18,6 +18,8 @@ struct psample_group {
+ struct psample_group *psample_group_get(struct net *net, u32 group_num);
+ void psample_group_put(struct psample_group *group);
+
++struct sk_buff;
++
+ #if IS_ENABLED(CONFIG_PSAMPLE)
+
+ void psample_sample_packet(struct psample_group *group, struct sk_buff *skb,
+diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
+index 09d914e486a2d..9afbd89b6096e 100644
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -265,8 +265,11 @@ int irq_startup(struct irq_desc *desc, bool resend, bool force)
+ } else {
+ switch (__irq_startup_managed(desc, aff, force)) {
+ case IRQ_STARTUP_NORMAL:
++ if (d->chip->flags & IRQCHIP_AFFINITY_PRE_STARTUP)
++ irq_setup_affinity(desc);
+ ret = __irq_startup(desc);
+- irq_setup_affinity(desc);
++ if (!(d->chip->flags & IRQCHIP_AFFINITY_PRE_STARTUP))
++ irq_setup_affinity(desc);
+ break;
+ case IRQ_STARTUP_MANAGED:
+ irq_do_set_affinity(d, aff, false);
+diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
+index 604974f2afb19..88269dd5a8cad 100644
+--- a/kernel/irq/msi.c
++++ b/kernel/irq/msi.c
+@@ -477,11 +477,6 @@ skip_activate:
+ return 0;
+
+ cleanup:
+- for_each_msi_vector(desc, i, dev) {
+- irq_data = irq_domain_get_irq_data(domain, i);
+- if (irqd_is_activated(irq_data))
+- irq_domain_deactivate_irq(irq_data);
+- }
+ msi_domain_free_irqs(domain, dev);
+ return ret;
+ }
+@@ -494,7 +489,15 @@ cleanup:
+ */
+ void msi_domain_free_irqs(struct irq_domain *domain, struct device *dev)
+ {
++ struct irq_data *irq_data;
+ struct msi_desc *desc;
++ int i;
++
++ for_each_msi_vector(desc, i, dev) {
++ irq_data = irq_domain_get_irq_data(domain, i);
++ if (irqd_is_activated(irq_data))
++ irq_domain_deactivate_irq(irq_data);
++ }
+
+ for_each_msi_entry(desc, dev) {
+ /*
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index bbde8d3d6c8ae..44d1340634f61 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -3786,6 +3786,8 @@ onmatch_create_field_var(struct hist_trigger_data *hist_data,
+ event = data->onmatch.match_event;
+ }
+
++ if (!event)
++ goto free;
+ /*
+ * At this point, we're looking at a field on another
+ * event. Because we can't modify a hist trigger on
+diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
+index 253975cce943e..0cbd0bca971ff 100644
+--- a/net/bluetooth/hidp/core.c
++++ b/net/bluetooth/hidp/core.c
+@@ -1282,7 +1282,7 @@ static int hidp_session_thread(void *arg)
+
+ /* cleanup runtime environment */
+ remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
+- remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait);
++ remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait);
+ wake_up_interruptible(&session->report_queue);
+ hidp_del_timer(session);
+
+diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
+index 5aa508a08a691..b5fb2b682e191 100644
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -604,6 +604,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev,
+
+ err = dev_set_allmulti(dev, 1);
+ if (err) {
++ br_multicast_del_port(p);
+ kfree(p); /* kobject not yet init'd, manually free */
+ goto err1;
+ }
+@@ -708,6 +709,7 @@ err4:
+ err3:
+ sysfs_remove_link(br->ifobj, p->dev->name);
+ err2:
++ br_multicast_del_port(p);
+ kobject_put(&p->kobj);
+ dev_set_allmulti(dev, -1);
+ err1:
+diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
+index f91e3816806ba..aec3c724665f8 100644
+--- a/net/dccp/dccp.h
++++ b/net/dccp/dccp.h
+@@ -44,9 +44,9 @@ extern bool dccp_debug;
+ #define dccp_pr_debug_cat(format, a...) DCCP_PRINTK(dccp_debug, format, ##a)
+ #define dccp_debug(fmt, a...) dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
+ #else
+-#define dccp_pr_debug(format, a...)
+-#define dccp_pr_debug_cat(format, a...)
+-#define dccp_debug(format, a...)
++#define dccp_pr_debug(format, a...) do {} while (0)
++#define dccp_pr_debug_cat(format, a...) do {} while (0)
++#define dccp_debug(format, a...) do {} while (0)
+ #endif
+
+ extern struct inet_hashinfo dccp_hashinfo;
+diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
+index 89819745e482c..14c6fac039f9e 100644
+--- a/net/ieee802154/socket.c
++++ b/net/ieee802154/socket.c
+@@ -1002,6 +1002,11 @@ static const struct proto_ops ieee802154_dgram_ops = {
+ #endif
+ };
+
++static void ieee802154_sock_destruct(struct sock *sk)
++{
++ skb_queue_purge(&sk->sk_receive_queue);
++}
++
+ /* Create a socket. Initialise the socket, blank the addresses
+ * set the state.
+ */
+@@ -1042,7 +1047,7 @@ static int ieee802154_create(struct net *net, struct socket *sock,
+ sock->ops = ops;
+
+ sock_init_data(sock, sk);
+- /* FIXME: sk->sk_destruct */
++ sk->sk_destruct = ieee802154_sock_destruct;
+ sk->sk_family = PF_IEEE802154;
+
+ /* Checksums on by default */
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index ffa847fc96194..dca7fe0ae24ad 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -807,10 +807,17 @@ static void igmp_gq_timer_expire(struct timer_list *t)
+ static void igmp_ifc_timer_expire(struct timer_list *t)
+ {
+ struct in_device *in_dev = from_timer(in_dev, t, mr_ifc_timer);
++ u32 mr_ifc_count;
+
+ igmpv3_send_cr(in_dev);
+- if (in_dev->mr_ifc_count) {
+- in_dev->mr_ifc_count--;
++restart:
++ mr_ifc_count = READ_ONCE(in_dev->mr_ifc_count);
++
++ if (mr_ifc_count) {
++ if (cmpxchg(&in_dev->mr_ifc_count,
++ mr_ifc_count,
++ mr_ifc_count - 1) != mr_ifc_count)
++ goto restart;
+ igmp_ifc_start_timer(in_dev,
+ unsolicited_report_interval(in_dev));
+ }
+@@ -822,7 +829,7 @@ static void igmp_ifc_event(struct in_device *in_dev)
+ struct net *net = dev_net(in_dev->dev);
+ if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
+ return;
+- in_dev->mr_ifc_count = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
++ WRITE_ONCE(in_dev->mr_ifc_count, in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv);
+ igmp_ifc_start_timer(in_dev, 1);
+ }
+
+@@ -961,7 +968,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ in_dev->mr_qri;
+ }
+ /* cancel the interface change timer */
+- in_dev->mr_ifc_count = 0;
++ WRITE_ONCE(in_dev->mr_ifc_count, 0);
+ if (del_timer(&in_dev->mr_ifc_timer))
+ __in_dev_put(in_dev);
+ /* clear deleted report items */
+@@ -1739,7 +1746,7 @@ void ip_mc_down(struct in_device *in_dev)
+ igmp_group_dropped(pmc);
+
+ #ifdef CONFIG_IP_MULTICAST
+- in_dev->mr_ifc_count = 0;
++ WRITE_ONCE(in_dev->mr_ifc_count, 0);
+ if (del_timer(&in_dev->mr_ifc_timer))
+ __in_dev_put(in_dev);
+ in_dev->mr_gq_running = 0;
+@@ -1956,7 +1963,7 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
+ pmc->sfmode = MCAST_INCLUDE;
+ #ifdef CONFIG_IP_MULTICAST
+ pmc->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
+- in_dev->mr_ifc_count = pmc->crcount;
++ WRITE_ONCE(in_dev->mr_ifc_count, pmc->crcount);
+ for (psf = pmc->sources; psf; psf = psf->sf_next)
+ psf->sf_crcount = 0;
+ igmp_ifc_event(pmc->interface);
+@@ -2135,7 +2142,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
+ /* else no filters; keep old mode for reports */
+
+ pmc->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
+- in_dev->mr_ifc_count = pmc->crcount;
++ WRITE_ONCE(in_dev->mr_ifc_count, pmc->crcount);
+ for (psf = pmc->sources; psf; psf = psf->sf_next)
+ psf->sf_crcount = 0;
+ igmp_ifc_event(in_dev);
+diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
+index b70c9365e1313..1740de0530726 100644
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -985,7 +985,7 @@ static void bbr_init(struct sock *sk)
+ bbr->prior_cwnd = 0;
+ tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+ bbr->rtt_cnt = 0;
+- bbr->next_rtt_delivered = 0;
++ bbr->next_rtt_delivered = tp->delivered;
+ bbr->prev_ca_state = TCP_CA_Open;
+ bbr->packet_conservation = 0;
+
+diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
+index 4105081dc1df0..6f390c2e4c8ea 100644
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -80,6 +80,7 @@ static const char * const sta_flag_names[] = {
+ FLAG(MPSP_OWNER),
+ FLAG(MPSP_RECIPIENT),
+ FLAG(PS_DELIVER),
++ FLAG(USES_ENCRYPTION),
+ #undef FLAG
+ };
+
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index 6775d6cb7d3d4..7fc55177db847 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -341,6 +341,7 @@ static void ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
+ if (sta) {
+ if (pairwise) {
+ rcu_assign_pointer(sta->ptk[idx], new);
++ set_sta_flag(sta, WLAN_STA_USES_ENCRYPTION);
+ sta->ptk_idx = idx;
+ ieee80211_check_fast_xmit(sta);
+ } else {
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index c33bc5fc0f2d8..75d982ff7f3d0 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -102,6 +102,7 @@ enum ieee80211_sta_info_flags {
+ WLAN_STA_MPSP_OWNER,
+ WLAN_STA_MPSP_RECIPIENT,
+ WLAN_STA_PS_DELIVER,
++ WLAN_STA_USES_ENCRYPTION,
+
+ NUM_WLAN_STA_FLAGS,
+ };
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 98d048630ad2f..3530d1a5fc98e 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -593,10 +593,13 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+
+- if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
++ if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) {
+ tx->key = NULL;
+- else if (tx->sta &&
+- (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
++ return TX_CONTINUE;
++ }
++
++ if (tx->sta &&
++ (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
+ tx->key = key;
+ else if (ieee80211_is_group_privacy_action(tx->skb) &&
+ (key = rcu_dereference(tx->sdata->default_multicast_key)))
+@@ -657,6 +660,9 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
+ if (!skip_hw && tx->key &&
+ tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
+ info->control.hw_key = &tx->key->conf;
++ } else if (!ieee80211_is_mgmt(hdr->frame_control) && tx->sta &&
++ test_sta_flag(tx->sta, WLAN_STA_USES_ENCRYPTION)) {
++ return TX_DROP;
+ }
+
+ return TX_CONTINUE;
+diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
+index 64e69d6683cab..93fee41060192 100644
+--- a/net/netfilter/nft_exthdr.c
++++ b/net/netfilter/nft_exthdr.c
+@@ -137,7 +137,6 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
+ unsigned int i, optl, tcphdr_len, offset;
+ struct tcphdr *tcph;
+ u8 *opt;
+- u32 src;
+
+ tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len);
+ if (!tcph)
+@@ -146,7 +145,6 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
+ opt = (u8 *)tcph;
+ for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
+ union {
+- u8 octet;
+ __be16 v16;
+ __be32 v32;
+ } old, new;
+@@ -167,13 +165,13 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
+ if (!tcph)
+ return;
+
+- src = regs->data[priv->sreg];
+ offset = i + priv->offset;
+
+ switch (priv->len) {
+ case 2:
+ old.v16 = get_unaligned((u16 *)(opt + offset));
+- new.v16 = src;
++ new.v16 = (__force __be16)nft_reg_load16(
++ ®s->data[priv->sreg]);
+
+ switch (priv->type) {
+ case TCPOPT_MSS:
+@@ -191,7 +189,7 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr,
+ old.v16, new.v16, false);
+ break;
+ case 4:
+- new.v32 = src;
++ new.v32 = regs->data[priv->sreg];
+ old.v32 = get_unaligned((u32 *)(opt + offset));
+
+ if (old.v32 == new.v32)
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index cc70d651d13e0..e34979fcefd22 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -373,11 +373,14 @@ static void virtio_vsock_event_fill(struct virtio_vsock *vsock)
+
+ static void virtio_vsock_reset_sock(struct sock *sk)
+ {
+- lock_sock(sk);
++ /* vmci_transport.c doesn't take sk_lock here either. At least we're
++ * under vsock_table_lock so the sock cannot disappear while we're
++ * executing.
++ */
++
+ sk->sk_state = TCP_CLOSE;
+ sk->sk_err = ECONNRESET;
+ sk->sk_error_report(sk);
+- release_sock(sk);
+ }
+
+ static void virtio_vsock_update_guest_cid(struct virtio_vsock *vsock)
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 6099a9f1cb3d6..ff263ad19230a 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -3470,7 +3470,7 @@ static int cap_put_caller(struct snd_kcontrol *kcontrol,
+ struct hda_gen_spec *spec = codec->spec;
+ const struct hda_input_mux *imux;
+ struct nid_path *path;
+- int i, adc_idx, err = 0;
++ int i, adc_idx, ret, err = 0;
+
+ imux = &spec->input_mux;
+ adc_idx = kcontrol->id.index;
+@@ -3480,9 +3480,13 @@ static int cap_put_caller(struct snd_kcontrol *kcontrol,
+ if (!path || !path->ctls[type])
+ continue;
+ kcontrol->private_value = path->ctls[type];
+- err = func(kcontrol, ucontrol);
+- if (err < 0)
++ ret = func(kcontrol, ucontrol);
++ if (ret < 0) {
++ err = ret;
+ break;
++ }
++ if (ret > 0)
++ err = 1;
+ }
+ mutex_unlock(&codec->control_mutex);
+ if (err >= 0 && spec->cap_sync_hook)
+diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
+index fddfd227a9c0e..4cb3e11c66af7 100644
+--- a/sound/soc/codecs/cs42l42.c
++++ b/sound/soc/codecs/cs42l42.c
+@@ -404,7 +404,7 @@ static const struct regmap_config cs42l42_regmap = {
+ .cache_type = REGCACHE_RBTREE,
+ };
+
+-static DECLARE_TLV_DB_SCALE(adc_tlv, -9600, 100, false);
++static DECLARE_TLV_DB_SCALE(adc_tlv, -9700, 100, true);
+ static DECLARE_TLV_DB_SCALE(mixer_tlv, -6300, 100, true);
+
+ static const char * const cs42l42_hpf_freq_text[] = {
+@@ -424,34 +424,23 @@ static SOC_ENUM_SINGLE_DECL(cs42l42_wnf3_freq_enum, CS42L42_ADC_WNF_HPF_CTL,
+ CS42L42_ADC_WNF_CF_SHIFT,
+ cs42l42_wnf3_freq_text);
+
+-static const char * const cs42l42_wnf05_freq_text[] = {
+- "280Hz", "315Hz", "350Hz", "385Hz",
+- "420Hz", "455Hz", "490Hz", "525Hz"
+-};
+-
+-static SOC_ENUM_SINGLE_DECL(cs42l42_wnf05_freq_enum, CS42L42_ADC_WNF_HPF_CTL,
+- CS42L42_ADC_WNF_CF_SHIFT,
+- cs42l42_wnf05_freq_text);
+-
+ static const struct snd_kcontrol_new cs42l42_snd_controls[] = {
+ /* ADC Volume and Filter Controls */
+ SOC_SINGLE("ADC Notch Switch", CS42L42_ADC_CTL,
+- CS42L42_ADC_NOTCH_DIS_SHIFT, true, false),
++ CS42L42_ADC_NOTCH_DIS_SHIFT, true, true),
+ SOC_SINGLE("ADC Weak Force Switch", CS42L42_ADC_CTL,
+ CS42L42_ADC_FORCE_WEAK_VCM_SHIFT, true, false),
+ SOC_SINGLE("ADC Invert Switch", CS42L42_ADC_CTL,
+ CS42L42_ADC_INV_SHIFT, true, false),
+ SOC_SINGLE("ADC Boost Switch", CS42L42_ADC_CTL,
+ CS42L42_ADC_DIG_BOOST_SHIFT, true, false),
+- SOC_SINGLE_SX_TLV("ADC Volume", CS42L42_ADC_VOLUME,
+- CS42L42_ADC_VOL_SHIFT, 0xA0, 0x6C, adc_tlv),
++ SOC_SINGLE_S8_TLV("ADC Volume", CS42L42_ADC_VOLUME, -97, 12, adc_tlv),
+ SOC_SINGLE("ADC WNF Switch", CS42L42_ADC_WNF_HPF_CTL,
+ CS42L42_ADC_WNF_EN_SHIFT, true, false),
+ SOC_SINGLE("ADC HPF Switch", CS42L42_ADC_WNF_HPF_CTL,
+ CS42L42_ADC_HPF_EN_SHIFT, true, false),
+ SOC_ENUM("HPF Corner Freq", cs42l42_hpf_freq_enum),
+ SOC_ENUM("WNF 3dB Freq", cs42l42_wnf3_freq_enum),
+- SOC_ENUM("WNF 05dB Freq", cs42l42_wnf05_freq_enum),
+
+ /* DAC Volume and Filter Controls */
+ SOC_SINGLE("DACA Invert Switch", CS42L42_DAC_CTL1,
+@@ -670,15 +659,6 @@ static int cs42l42_pll_config(struct snd_soc_component *component)
+ CS42L42_FSYNC_PULSE_WIDTH_MASK,
+ CS42L42_FRAC1_VAL(fsync - 1) <<
+ CS42L42_FSYNC_PULSE_WIDTH_SHIFT);
+- snd_soc_component_update_bits(component,
+- CS42L42_ASP_FRM_CFG,
+- CS42L42_ASP_5050_MASK,
+- CS42L42_ASP_5050_MASK);
+- /* Set the frame delay to 1.0 SCLK clocks */
+- snd_soc_component_update_bits(component, CS42L42_ASP_FRM_CFG,
+- CS42L42_ASP_FSD_MASK,
+- CS42L42_ASP_FSD_1_0 <<
+- CS42L42_ASP_FSD_SHIFT);
+ /* Set the sample rates (96k or lower) */
+ snd_soc_component_update_bits(component, CS42L42_FS_RATE_EN,
+ CS42L42_FS_EN_MASK,
+@@ -774,7 +754,18 @@ static int cs42l42_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
+ /* interface format */
+ switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+ case SND_SOC_DAIFMT_I2S:
+- case SND_SOC_DAIFMT_LEFT_J:
++ /*
++ * 5050 mode, frame starts on falling edge of LRCLK,
++ * frame delayed by 1.0 SCLKs
++ */
++ snd_soc_component_update_bits(component,
++ CS42L42_ASP_FRM_CFG,
++ CS42L42_ASP_STP_MASK |
++ CS42L42_ASP_5050_MASK |
++ CS42L42_ASP_FSD_MASK,
++ CS42L42_ASP_5050_MASK |
++ (CS42L42_ASP_FSD_1_0 <<
++ CS42L42_ASP_FSD_SHIFT));
+ break;
+ default:
+ return -EINVAL;
+diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+index be773101d8760..682ee41ec75c9 100644
+--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+@@ -135,7 +135,7 @@ static void sst_fill_alloc_params(struct snd_pcm_substream *substream,
+ snd_pcm_uframes_t period_size;
+ ssize_t periodbytes;
+ ssize_t buffer_bytes = snd_pcm_lib_buffer_bytes(substream);
+- u32 buffer_addr = virt_to_phys(substream->dma_buffer.area);
++ u32 buffer_addr = virt_to_phys(substream->runtime->dma_area);
+
+ channels = substream->runtime->channels;
+ period_size = substream->runtime->period_size;
+@@ -241,7 +241,6 @@ static int sst_platform_alloc_stream(struct snd_pcm_substream *substream,
+ /* set codec params and inform SST driver the same */
+ sst_fill_pcm_params(substream, ¶m);
+ sst_fill_alloc_params(substream, &alloc_params);
+- substream->runtime->dma_area = substream->dma_buffer.area;
+ str_params.sparams = param;
+ str_params.aparams = alloc_params;
+ str_params.codec = SST_CODEC_TYPE_PCM;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-09-03 10:08 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-09-03 10:08 UTC (permalink / raw
To: gentoo-commits
commit: 6da40c3954cb038dd4c7f7eee0a10f735a26460e
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Fri Sep 3 10:07:24 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Fri Sep 3 10:08:03 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6da40c39
Bump 20210818 from commit f1d0af2c9d807b137909e98c11caf7504f4e2066
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
5010_enable-cpu-optimizations-universal.patch | 79 +++++++++++++--------------
1 file changed, 38 insertions(+), 41 deletions(-)
diff --git a/5010_enable-cpu-optimizations-universal.patch b/5010_enable-cpu-optimizations-universal.patch
index 2cc90b0..5b7cb95 100644
--- a/5010_enable-cpu-optimizations-universal.patch
+++ b/5010_enable-cpu-optimizations-universal.patch
@@ -1,24 +1,18 @@
-From cda27318e4b73d20f0edb497dd86ed4c1d051ad6 Mon Sep 17 00:00:00 2001
+From 9abcc823066eabbe75ef07c9ce977757b538bf4f Mon Sep 17 00:00:00 2001
From: graysky <graysky@archlinux.us>
-Date: Mon, 12 Apr 2021 07:14:01 -0400
+Date: Sun, 6 Jun 2021 09:28:29 -0400
Subject: [PATCH] more uarches for kernel 4.19-5.4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
-WARNING
-This patch works with all gcc versions 9.0+ and with kernel version 4.19-5.4
-and should NOT be applied when compiling on older versions of gcc due to key
-name changes of the march flags introduced with the version 4.9 release of
-gcc.[1]
-
FEATURES
This patch adds additional CPU options to the Linux kernel accessible under:
Processor type and features --->
Processor family --->
-With the release of gcc 11.0, several generic 64-bit levels are offered which
-are good for supported Intel or AMD CPUs:
+With the release of gcc 11.1 and clang 12.0, several generic 64-bit levels are
+offered which are good for supported Intel or AMD CPUs:
• x86-64-v2
• x86-64-v3
• x86-64-v4
@@ -27,7 +21,7 @@ Users of glibc 2.33 and above can see which level is supported by current
hardware by running:
/lib/ld-linux-x86-64.so.2 --help | grep supported
-Alternatively, compare the flags from /proc/cpuinfo to this list.[2]
+Alternatively, compare the flags from /proc/cpuinfo to this list.[1]
CPU-specific microarchitectures include:
• AMD Improved K8-family
@@ -63,13 +57,15 @@ CPU-specific microarchitectures include:
• Intel 12th Gen i3/i5/i7/i9-family (Alder Lake)‡
Notes: If not otherwise noted, gcc >=9.1 is required for support.
- *Requires gcc >=10.1 †Required gcc >=10.3 ‡Required gcc >=11.0
+ *Requires gcc >=10.1 or clang >=10.0
+ †Required gcc >=10.3 or clang >=12.0
+ ‡Required gcc >=11.1 or clang >=12.0
It also offers to compile passing the 'native' option which, "selects the CPU
to generate code for at compilation time by determining the processor type of
the compiling machine. Using -march=native enables all instruction subsets
supported by the local machine and will produce code optimized for the local
-machine under the constraints of the selected instruction set."[3]
+machine under the constraints of the selected instruction set."[2]
Users of Intel CPUs should select the 'Intel-Native' option and users of AMD
CPUs should select the 'AMD-Native' option.
@@ -77,9 +73,9 @@ CPUs should select the 'AMD-Native' option.
MINOR NOTES RELATING TO INTEL ATOM PROCESSORS
This patch also changes -march=atom to -march=bonnell in accordance with the
gcc v4.9 changes. Upstream is using the deprecated -match=atom flags when I
-believe it should use the newer -march=bonnell flag for atom processors.[4]
+believe it should use the newer -march=bonnell flag for atom processors.[3]
-It is not recommended to compile on Atom-CPUs with the 'native' option.[5] The
+It is not recommended to compile on Atom-CPUs with the 'native' option.[4] The
recommendation is to use the 'atom' option instead.
BENEFITS
@@ -91,18 +87,19 @@ https://github.com/graysky2/kernel_gcc_patch
REQUIREMENTS
linux version 4.19-5.4
-gcc version >=9.0
+gcc version >=9.0 or clang version >=9.0
ACKNOWLEDGMENTS
-This patch builds on the seminal work by Jeroen.[6]
+This patch builds on the seminal work by Jeroen.[5]
REFERENCES
-1. https://gcc.gnu.org/gcc-4.9/changes.html
-2. https://gitlab.com/x86-psABIs/x86-64-ABI/-/commit/77566eb03bc6a326811cb7e9
-3. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html#index-x86-Options
-4. https://bugzilla.kernel.org/show_bug.cgi?id=77461
-5. https://github.com/graysky2/kernel_gcc_patch/issues/15
-6. http://www.linuxforge.net/docs/linux/linux-gcc.php
+1. https://gitlab.com/x86-psABIs/x86-64-ABI/-/commit/77566eb03bc6a326811cb7e9
+2. https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html#index-x86-Options
+3. https://bugzilla.kernel.org/show_bug.cgi?id=77461
+4. https://github.com/graysky2/kernel_gcc_patch/issues/15
+5. http://www.linuxforge.net/docs/linux/linux-gcc.php
+
+Signed-off-by: graysky <graysky@archlinux.us>
---
arch/x86/Kconfig.cpu | 333 ++++++++++++++++++++++++++++++++--
arch/x86/Makefile | 47 ++++-
@@ -110,7 +107,7 @@ REFERENCES
3 files changed, 428 insertions(+), 18 deletions(-)
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
-index 8e29c991ba3e..bc76256532bb 100644
+index 8e29c991ba3e..c74f92492a2e 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -148,9 +148,8 @@ config MPENTIUM4
@@ -224,7 +221,7 @@ index 8e29c991ba3e..bc76256532bb 100644
+
+config MZEN3
+ bool "AMD Zen 3"
-+ depends on GCC_VERSION > 100300
++ depends on (CC_IS_GCC && GCC_VERSION >= 100300) || (CC_IS_CLANG && CLANG_VERSION >= 120000)
+ ---help---
+ Select this for AMD Family 19h Zen 3 processors.
+
@@ -383,7 +380,7 @@ index 8e29c991ba3e..bc76256532bb 100644
+
+config MCOOPERLAKE
+ bool "Intel Cooper Lake"
-+ depends on GCC_VERSION > 100100
++ depends on (CC_IS_GCC && GCC_VERSION > 100100) || (CC_IS_CLANG && CLANG_VERSION >= 100000)
+ select X86_P6_NOP
+ ---help---
+
@@ -393,7 +390,7 @@ index 8e29c991ba3e..bc76256532bb 100644
+
+config MTIGERLAKE
+ bool "Intel Tiger Lake"
-+ depends on GCC_VERSION > 100100
++ depends on (CC_IS_GCC && GCC_VERSION > 100100) || (CC_IS_CLANG && CLANG_VERSION >= 100000)
+ select X86_P6_NOP
+ ---help---
+
@@ -403,7 +400,7 @@ index 8e29c991ba3e..bc76256532bb 100644
+
+config MSAPPHIRERAPIDS
+ bool "Intel Sapphire Rapids"
-+ depends on GCC_VERSION > 110000
++ depends on (CC_IS_GCC && GCC_VERSION > 110000) || (CC_IS_CLANG && CLANG_VERSION >= 120000)
+ select X86_P6_NOP
+ ---help---
+
@@ -413,7 +410,7 @@ index 8e29c991ba3e..bc76256532bb 100644
+
+config MROCKETLAKE
+ bool "Intel Rocket Lake"
-+ depends on GCC_VERSION > 110000
++ depends on (CC_IS_GCC && GCC_VERSION > 110000) || (CC_IS_CLANG && CLANG_VERSION >= 120000)
+ select X86_P6_NOP
+ ---help---
+
@@ -423,7 +420,7 @@ index 8e29c991ba3e..bc76256532bb 100644
+
+config MALDERLAKE
+ bool "Intel Alder Lake"
-+ depends on GCC_VERSION > 110000
++ depends on (CC_IS_GCC && GCC_VERSION > 110000) || (CC_IS_CLANG && CLANG_VERSION >= 120000)
+ select X86_P6_NOP
+ ---help---
+
@@ -440,7 +437,7 @@ index 8e29c991ba3e..bc76256532bb 100644
+config GENERIC_CPU2
+ bool "Generic-x86-64-v2"
-+ depends on GCC_VERSION > 110000
++ depends on (CC_IS_GCC && GCC_VERSION > 110000) || (CC_IS_CLANG && CLANG_VERSION >= 120000)
+ depends on X86_64
+ ---help---
+ Generic x86-64 CPU.
@@ -448,7 +445,7 @@ index 8e29c991ba3e..bc76256532bb 100644
+
+config GENERIC_CPU3
+ bool "Generic-x86-64-v3"
-+ depends on GCC_VERSION > 110000
++ depends on (CC_IS_GCC && GCC_VERSION > 110000) || (CC_IS_CLANG && CLANG_VERSION >= 120000)
+ depends on X86_64
+ ---help---
+ Generic x86-64-v3 CPU with v3 instructions.
@@ -456,18 +453,18 @@ index 8e29c991ba3e..bc76256532bb 100644
+
+config GENERIC_CPU4
+ bool "Generic-x86-64-v4"
-+ depends on GCC_VERSION > 110000
++ depends on (CC_IS_GCC && GCC_VERSION > 110000) || (CC_IS_CLANG && CLANG_VERSION >= 120000)
+ depends on X86_64
+ ---help---
+ Generic x86-64 CPU with v4 instructions.
+ Run equally well on all x86-64 CPUs with min support of x86-64-v4.
+
+config MNATIVE_INTEL
-+ bool "Intel-Native optimizations autodetected by GCC"
++ bool "Intel-Native optimizations autodetected by the compiler"
+ ---help---
+
-+ GCC 4.2 and above support -march=native, which automatically detects
-+ the optimum settings to use based on your processor. Do NOT use this
++ Clang 3.8 and GCC 4.2 and above support -march=native, which automatically
++ detects the optimum settings to use based on your processor. Do NOT use this
+ for AMD CPUs. Intel Only!
+
+ Enables -march=native
@@ -476,9 +473,9 @@ index 8e29c991ba3e..bc76256532bb 100644
+ bool "AMD-Native optimizations autodetected by GCC"
+ ---help---
+
-+ GCC 4.2 and above support -march=native, which automatically detects
-+ the optimum settings to use based on your processor. Do NOT use this
-+ for AMD CPUs. AMD Only!
++ Clang 3.8 and GCC 4.2 and above support -march=native, which automatically
++ detects the optimum settings to use based on your processor. Do NOT use this
++ for Intel CPUs. AMD Only!
+
+ Enables -march=native
+
@@ -541,10 +538,10 @@ index 8e29c991ba3e..bc76256532bb 100644
default "4"
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
-index 94df0868804b..09b1905de4cb 100644
+index 69f0cb01c666..3d9e20a11f1b 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
-@@ -121,11 +121,48 @@ else
+@@ -125,11 +125,48 @@ else
# FIXME - should be integrated in Makefile.cpu (Makefile_32.cpu)
cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-09-03 11:22 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-09-03 11:22 UTC (permalink / raw
To: gentoo-commits
commit: 29db724ec2272a5fad946e2373331f638b5eca4f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Sep 3 11:21:48 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Sep 3 11:21:48 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=29db724e
Linux patch 4.19.206
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1205_linux-4.19.206.patch | 1086 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1090 insertions(+)
diff --git a/0000_README b/0000_README
index 6a39170..1c6d7ee 100644
--- a/0000_README
+++ b/0000_README
@@ -859,6 +859,10 @@ Patch: 1204_linux-4.19.205.patch
From: https://www.kernel.org
Desc: Linux 4.19.205
+Patch: 1205_linux-4.19.206.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.206
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1205_linux-4.19.206.patch b/1205_linux-4.19.206.patch
new file mode 100644
index 0000000..8997401
--- /dev/null
+++ b/1205_linux-4.19.206.patch
@@ -0,0 +1,1086 @@
+diff --git a/Makefile b/Makefile
+index abc35829f47ba..3a3eea3ab10a5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 205
++SUBLEVEL = 206
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S
+index f35ed578e007e..4d823d3f65bb3 100644
+--- a/arch/arc/kernel/vmlinux.lds.S
++++ b/arch/arc/kernel/vmlinux.lds.S
+@@ -92,6 +92,8 @@ SECTIONS
+ CPUIDLE_TEXT
+ LOCK_TEXT
+ KPROBES_TEXT
++ IRQENTRY_TEXT
++ SOFTIRQENTRY_TEXT
+ *(.fixup)
+ *(.gnu.warning)
+ }
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 762baba4ecd51..0cb82172c06cf 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -4557,7 +4557,16 @@ static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu,
+ void
+ reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
+ {
+- bool uses_nx = context->nx || context->base_role.smep_andnot_wp;
++ /*
++ * KVM uses NX when TDP is disabled to handle a variety of scenarios,
++ * notably for huge SPTEs if iTLB multi-hit mitigation is enabled and
++ * to generate correct permissions for CR0.WP=0/CR4.SMEP=1/EFER.NX=0.
++ * The iTLB multi-hit workaround can be toggled at any time, so assume
++ * NX can be used by any non-nested shadow MMU to avoid having to reset
++ * MMU contexts. Note, KVM forces EFER.NX=1 when TDP is disabled.
++ */
++ bool uses_nx = context->nx || !tdp_enabled ||
++ context->base_role.smep_andnot_wp;
+ struct rsvd_bits_validate *shadow_zero_check;
+ int i;
+
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 04383f14c74a9..8f444b375761c 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -4074,22 +4074,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+ if (UFDCS->rawcmd == 1)
+ UFDCS->rawcmd = 2;
+
+- if (mode & (FMODE_READ|FMODE_WRITE)) {
+- UDRS->last_checked = 0;
+- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+- check_disk_change(bdev);
+- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+- goto out;
+- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
++ if (!(mode & FMODE_NDELAY)) {
++ if (mode & (FMODE_READ|FMODE_WRITE)) {
++ UDRS->last_checked = 0;
++ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
++ check_disk_change(bdev);
++ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
++ goto out;
++ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
++ goto out;
++ }
++ res = -EROFS;
++ if ((mode & FMODE_WRITE) &&
++ !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
+ goto out;
+ }
+-
+- res = -EROFS;
+-
+- if ((mode & FMODE_WRITE) &&
+- !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
+- goto out;
+-
+ mutex_unlock(&open_lock);
+ mutex_unlock(&floppy_mutex);
+ return 0;
+diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
+index ab8847c7dd964..87e13bcd7a670 100644
+--- a/drivers/gpu/drm/drm_ioc32.c
++++ b/drivers/gpu/drm/drm_ioc32.c
+@@ -855,8 +855,6 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
+ req.request.sequence = req32.request.sequence;
+ req.request.signal = req32.request.signal;
+ err = drm_ioctl_kernel(file, drm_wait_vblank_ioctl, &req, DRM_UNLOCKED);
+- if (err)
+- return err;
+
+ req32.reply.type = req.reply.type;
+ req32.reply.sequence = req.reply.sequence;
+@@ -865,7 +863,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
+ if (copy_to_user(argp, &req32, sizeof(req32)))
+ return -EFAULT;
+
+- return 0;
++ return err;
+ }
+
+ #if defined(CONFIG_X86)
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+index 818d21bd28d31..1d2837c5a8f29 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+@@ -419,7 +419,7 @@ nvkm_dp_train(struct nvkm_dp *dp, u32 dataKBps)
+ return ret;
+ }
+
+-static void
++void
+ nvkm_dp_disable(struct nvkm_outp *outp, struct nvkm_ior *ior)
+ {
+ struct nvkm_dp *dp = nvkm_dp(outp);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h
+index 495f665a0ee68..12d6ff4cfa95d 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h
+@@ -32,6 +32,7 @@ struct nvkm_dp {
+
+ int nvkm_dp_new(struct nvkm_disp *, int index, struct dcb_output *,
+ struct nvkm_outp **);
++void nvkm_dp_disable(struct nvkm_outp *, struct nvkm_ior *);
+
+ /* DPCD Receiver Capabilities */
+ #define DPCD_RC00_DPCD_REV 0x00000
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+index c62030c96fba0..4b1c72fd8f039 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+@@ -22,6 +22,7 @@
+ * Authors: Ben Skeggs
+ */
+ #include "outp.h"
++#include "dp.h"
+ #include "ior.h"
+
+ #include <subdev/bios.h>
+@@ -216,6 +217,14 @@ nvkm_outp_init_route(struct nvkm_outp *outp)
+ if (!ior->arm.head || ior->arm.proto != proto) {
+ OUTP_DBG(outp, "no heads (%x %d %d)", ior->arm.head,
+ ior->arm.proto, proto);
++
++ /* The EFI GOP driver on Ampere can leave unused DP links routed,
++ * which we don't expect. The DisableLT IED script *should* get
++ * us back to where we need to be.
++ */
++ if (ior->func->route.get && !ior->arm.head && outp->info.type == DCB_OUTPUT_DP)
++ nvkm_dp_disable(outp, ior);
++
+ return;
+ }
+
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index 291c12f588b58..38258de75a94c 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -3055,6 +3055,7 @@ static void __sdma_process_event(struct sdma_engine *sde,
+ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ {
+ int i;
++ struct sdma_desc *descp;
+
+ /* Handle last descriptor */
+ if (unlikely((tx->num_desc == (MAX_DESC - 1)))) {
+@@ -3075,12 +3076,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ if (unlikely(tx->num_desc == MAX_DESC))
+ goto enomem;
+
+- tx->descp = kmalloc_array(
+- MAX_DESC,
+- sizeof(struct sdma_desc),
+- GFP_ATOMIC);
+- if (!tx->descp)
++ descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC);
++ if (!descp)
+ goto enomem;
++ tx->descp = descp;
+
+ /* reserve last descriptor for coalescing */
+ tx->desc_limit = MAX_DESC - 1;
+diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
+index e95358269525d..d4e6b40f0ed4e 100644
+--- a/drivers/net/can/usb/esd_usb2.c
++++ b/drivers/net/can/usb/esd_usb2.c
+@@ -236,8 +236,8 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,
+ if (id == ESD_EV_CAN_ERROR_EXT) {
+ u8 state = msg->msg.rx.data[0];
+ u8 ecc = msg->msg.rx.data[1];
+- u8 txerr = msg->msg.rx.data[2];
+- u8 rxerr = msg->msg.rx.data[3];
++ u8 rxerr = msg->msg.rx.data[2];
++ u8 txerr = msg->msg.rx.data[3];
+
+ skb = alloc_can_err_skb(priv->netdev, &cf);
+ if (skb == NULL) {
+diff --git a/drivers/net/ethernet/apm/xgene-v2/main.c b/drivers/net/ethernet/apm/xgene-v2/main.c
+index 0f2ad50f3bd78..7f37e7cb687ef 100644
+--- a/drivers/net/ethernet/apm/xgene-v2/main.c
++++ b/drivers/net/ethernet/apm/xgene-v2/main.c
+@@ -691,11 +691,13 @@ static int xge_probe(struct platform_device *pdev)
+ ret = register_netdev(ndev);
+ if (ret) {
+ netdev_err(ndev, "Failed to register netdev\n");
+- goto err;
++ goto err_mdio_remove;
+ }
+
+ return 0;
+
++err_mdio_remove:
++ xge_mdio_remove(ndev);
+ err:
+ free_netdev(ndev);
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index a75d7c826fc2b..dd935cd1fb44f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -204,21 +204,12 @@ static int hclge_ieee_getpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)
+ u64 requests[HNAE3_MAX_TC], indications[HNAE3_MAX_TC];
+ struct hclge_vport *vport = hclge_get_vport(h);
+ struct hclge_dev *hdev = vport->back;
+- u8 i, j, pfc_map, *prio_tc;
+ int ret;
++ u8 i;
+
+ memset(pfc, 0, sizeof(*pfc));
+ pfc->pfc_cap = hdev->pfc_max;
+- prio_tc = hdev->tm_info.prio_tc;
+- pfc_map = hdev->tm_info.hw_pfc_map;
+-
+- /* Pfc setting is based on TC */
+- for (i = 0; i < hdev->tm_info.num_tc; i++) {
+- for (j = 0; j < HNAE3_MAX_USER_PRIO; j++) {
+- if ((prio_tc[j] == i) && (pfc_map & BIT(i)))
+- pfc->pfc_en |= BIT(j);
+- }
+- }
++ pfc->pfc_en = hdev->tm_info.pfc_en;
+
+ ret = hclge_pfc_tx_stats_get(hdev, requests);
+ if (ret)
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index 7998a73b6a0fa..fbad77450725a 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -995,6 +995,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
+ {
+ u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) |
+ link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND;
++ u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */
++ u16 lat_enc_d = 0; /* latency decoded */
+ u16 lat_enc = 0; /* latency encoded */
+
+ if (link) {
+@@ -1048,7 +1050,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
+ E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop);
+ max_ltr_enc = max_t(u16, max_snoop, max_nosnoop);
+
+- if (lat_enc > max_ltr_enc)
++ lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) *
++ (1U << (E1000_LTRV_SCALE_FACTOR *
++ ((lat_enc & E1000_LTRV_SCALE_MASK)
++ >> E1000_LTRV_SCALE_SHIFT)));
++
++ max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) *
++ (1U << (E1000_LTRV_SCALE_FACTOR *
++ ((max_ltr_enc & E1000_LTRV_SCALE_MASK)
++ >> E1000_LTRV_SCALE_SHIFT)));
++
++ if (lat_enc_d > max_ltr_enc_d)
+ lat_enc = max_ltr_enc;
+ }
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+index 1502895eb45dd..e757896287eba 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+@@ -274,8 +274,11 @@
+
+ /* Latency Tolerance Reporting */
+ #define E1000_LTRV 0x000F8
++#define E1000_LTRV_VALUE_MASK 0x000003FF
+ #define E1000_LTRV_SCALE_MAX 5
+ #define E1000_LTRV_SCALE_FACTOR 5
++#define E1000_LTRV_SCALE_SHIFT 10
++#define E1000_LTRV_SCALE_MASK 0x00001C00
+ #define E1000_LTRV_REQ_SHIFT 15
+ #define E1000_LTRV_NOSNOOP_SHIFT 16
+ #define E1000_LTRV_SEND (1 << 30)
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index fda5dd8c71ebd..382d010e1294e 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -100,7 +100,7 @@
+ #define MVNETA_DESC_SWAP BIT(6)
+ #define MVNETA_TX_BRST_SZ_MASK(burst) ((burst) << 22)
+ #define MVNETA_PORT_STATUS 0x2444
+-#define MVNETA_TX_IN_PRGRS BIT(1)
++#define MVNETA_TX_IN_PRGRS BIT(0)
+ #define MVNETA_TX_FIFO_EMPTY BIT(8)
+ #define MVNETA_RX_MIN_FRAME_SIZE 0x247c
+ #define MVNETA_SERDES_CFG 0x24A0
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index 2847509a183d0..cb3569ac85f77 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -354,6 +354,9 @@ static int qed_ll2_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
+ unsigned long flags;
+ int rc = -EINVAL;
+
++ if (!p_ll2_conn)
++ return rc;
++
+ spin_lock_irqsave(&p_tx->lock, flags);
+ if (p_tx->b_completing_packet) {
+ rc = -EBUSY;
+@@ -527,7 +530,16 @@ static int qed_ll2_rxq_completion(struct qed_hwfn *p_hwfn, void *cookie)
+ unsigned long flags = 0;
+ int rc = 0;
+
++ if (!p_ll2_conn)
++ return rc;
++
+ spin_lock_irqsave(&p_rx->lock, flags);
++
++ if (!QED_LL2_RX_REGISTERED(p_ll2_conn)) {
++ spin_unlock_irqrestore(&p_rx->lock, flags);
++ return 0;
++ }
++
+ cq_new_idx = le16_to_cpu(*p_rx->p_fw_cons);
+ cq_old_idx = qed_chain_get_cons_idx(&p_rx->rcq_chain);
+
+@@ -848,6 +860,9 @@ static int qed_ll2_lb_rxq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
+ struct qed_ll2_info *p_ll2_conn = (struct qed_ll2_info *)p_cookie;
+ int rc;
+
++ if (!p_ll2_conn)
++ return 0;
++
+ if (!QED_LL2_RX_REGISTERED(p_ll2_conn))
+ return 0;
+
+@@ -871,6 +886,9 @@ static int qed_ll2_lb_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
+ u16 new_idx = 0, num_bds = 0;
+ int rc;
+
++ if (!p_ll2_conn)
++ return 0;
++
+ if (!QED_LL2_TX_REGISTERED(p_ll2_conn))
+ return 0;
+
+@@ -1628,6 +1646,8 @@ int qed_ll2_post_rx_buffer(void *cxt,
+ if (!p_ll2_conn)
+ return -EINVAL;
+ p_rx = &p_ll2_conn->rx_queue;
++ if (!p_rx->set_prod_addr)
++ return -EIO;
+
+ spin_lock_irqsave(&p_rx->lock, flags);
+ if (!list_empty(&p_rx->free_descq))
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index 909422d939033..3392982ff3743 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -1244,8 +1244,7 @@ qed_rdma_create_qp(void *rdma_cxt,
+
+ if (!rdma_cxt || !in_params || !out_params ||
+ !p_hwfn->p_rdma_info->active) {
+- DP_ERR(p_hwfn->cdev,
+- "qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n",
++ pr_err("qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n",
+ rdma_cxt, in_params, out_params);
+ return NULL;
+ }
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index d64a13d7881b9..a53123356697f 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -423,8 +423,9 @@ static int _of_add_opp_table_v2(struct device *dev, struct device_node *opp_np)
+ }
+ }
+
+- /* There should be one of more OPP defined */
+- if (WARN_ON(!count)) {
++ /* There should be one or more OPPs defined */
++ if (!count) {
++ dev_err(dev, "%s: no supported OPPs", __func__);
+ ret = -ENOENT;
+ goto put_opp_table;
+ }
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index ce6c7dd7bc126..076b8a3f8e7a5 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -484,16 +484,19 @@ int vt_ioctl(struct tty_struct *tty,
+ ret = -EINVAL;
+ goto out;
+ }
+- /* FIXME: this needs the console lock extending */
+- if (vc->vc_mode == (unsigned char) arg)
++ console_lock();
++ if (vc->vc_mode == (unsigned char) arg) {
++ console_unlock();
+ break;
++ }
+ vc->vc_mode = (unsigned char) arg;
+- if (console != fg_console)
++ if (console != fg_console) {
++ console_unlock();
+ break;
++ }
+ /*
+ * explicitly blank/unblank the screen if switching modes
+ */
+- console_lock();
+ if (arg == KD_TEXT)
+ do_unblank_screen(1);
+ else
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index c93bed41d988a..d61b7aa5d8e5d 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -894,19 +894,19 @@ static struct dwc3_trb *dwc3_ep_prev_trb(struct dwc3_ep *dep, u8 index)
+
+ static u32 dwc3_calc_trbs_left(struct dwc3_ep *dep)
+ {
+- struct dwc3_trb *tmp;
+ u8 trbs_left;
+
+ /*
+- * If enqueue & dequeue are equal than it is either full or empty.
+- *
+- * One way to know for sure is if the TRB right before us has HWO bit
+- * set or not. If it has, then we're definitely full and can't fit any
+- * more transfers in our ring.
++ * If the enqueue & dequeue are equal then the TRB ring is either full
++ * or empty. It's considered full when there are DWC3_TRB_NUM-1 of TRBs
++ * pending to be processed by the driver.
+ */
+ if (dep->trb_enqueue == dep->trb_dequeue) {
+- tmp = dwc3_ep_prev_trb(dep, dep->trb_enqueue);
+- if (tmp->ctrl & DWC3_TRB_CTRL_HWO)
++ /*
++ * If there is any request remained in the started_list at
++ * this point, that means there is no TRB available.
++ */
++ if (!list_empty(&dep->started_list))
+ return 0;
+
+ return DWC3_TRB_NUM - 1;
+@@ -1805,10 +1805,8 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+
+ ret = wait_for_completion_timeout(&dwc->ep0_in_setup,
+ msecs_to_jiffies(DWC3_PULL_UP_TIMEOUT));
+- if (ret == 0) {
+- dev_err(dwc->dev, "timed out waiting for SETUP phase\n");
+- return -ETIMEDOUT;
+- }
++ if (ret == 0)
++ dev_warn(dwc->dev, "timed out waiting for SETUP phase\n");
+ }
+
+ spin_lock_irqsave(&dwc->lock, flags);
+@@ -1946,6 +1944,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc)
+ /* begin to receive SETUP packets */
+ dwc->ep0state = EP0_SETUP_PHASE;
+ dwc->link_state = DWC3_LINK_STATE_SS_DIS;
++ dwc->delayed_status = false;
+ dwc3_ep0_out_start(dwc);
+
+ dwc3_gadget_enable_irq(dwc);
+diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
+index 0cb0c638fd131..168303f21bf45 100644
+--- a/drivers/usb/gadget/function/u_audio.c
++++ b/drivers/usb/gadget/function/u_audio.c
+@@ -349,8 +349,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
+ if (!prm->ep_enabled)
+ return;
+
+- prm->ep_enabled = false;
+-
+ audio_dev = uac->audio_dev;
+ params = &audio_dev->params;
+
+@@ -368,11 +366,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
+ }
+ }
+
++ prm->ep_enabled = false;
++
+ if (usb_ep_disable(ep))
+ dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__);
+ }
+
+-
+ int u_audio_start_capture(struct g_audio *audio_dev)
+ {
+ struct snd_uac_chip *uac = audio_dev->uac;
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index e6dce35ca1aa9..c87cb25e70ec5 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -625,7 +625,6 @@ static struct usb_serial_driver ch341_device = {
+ .owner = THIS_MODULE,
+ .name = "ch341-uart",
+ },
+- .bulk_in_size = 512,
+ .id_table = id_table,
+ .num_ports = 1,
+ .open = ch341_open,
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index e6103a27e4403..d08b799c91fc6 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2074,6 +2074,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(4) | RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */
+ .driver_info = RSVD(6) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
+ { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 59c61744dcc16..97aa9b87e5722 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -330,7 +330,7 @@ __vringh_iov(struct vringh *vrh, u16 i,
+ iov = wiov;
+ else {
+ iov = riov;
+- if (unlikely(wiov && wiov->i)) {
++ if (unlikely(wiov && wiov->used)) {
+ vringh_bad("Readable desc %p after writable",
+ &descs[i]);
+ err = -EINVAL;
+diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
+index 84845275dbef0..de04c097d67c7 100644
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -991,6 +991,10 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
+ goto done;
+ }
+
++ /* bitfill_aligned() assumes that it's at least 8x8 */
++ if (var->xres < 8 || var->yres < 8)
++ return -EINVAL;
++
+ ret = info->fbops->fb_check_var(var, info);
+
+ if (ret)
+diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
+index 45b04bc91f248..b7cc63f556eea 100644
+--- a/drivers/virtio/virtio_pci_common.c
++++ b/drivers/virtio/virtio_pci_common.c
+@@ -579,6 +579,13 @@ static void virtio_pci_remove(struct pci_dev *pci_dev)
+ struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev);
+ struct device *dev = get_device(&vp_dev->vdev.dev);
+
++ /*
++ * Device is marked broken on surprise removal so that virtio upper
++ * layers can abort any ongoing operation.
++ */
++ if (!pci_device_is_present(pci_dev))
++ virtio_break_device(&vp_dev->vdev);
++
+ pci_disable_sriov(pci_dev);
+
+ unregister_virtio_device(&vp_dev->vdev);
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index df7980aef927a..0cc0cfd3a3cb7 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -1197,7 +1197,7 @@ bool virtqueue_is_broken(struct virtqueue *_vq)
+ {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+
+- return vq->broken;
++ return READ_ONCE(vq->broken);
+ }
+ EXPORT_SYMBOL_GPL(virtqueue_is_broken);
+
+@@ -1211,7 +1211,9 @@ void virtio_break_device(struct virtio_device *dev)
+
+ list_for_each_entry(_vq, &dev->vqs, list) {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+- vq->broken = true;
++
++ /* Pairs with READ_ONCE() in virtqueue_is_broken(). */
++ WRITE_ONCE(vq->broken, true);
+ }
+ }
+ EXPORT_SYMBOL_GPL(virtio_break_device);
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 117f9380069a8..7c84762cb59e5 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -77,6 +77,14 @@ struct sock_reuseport;
+
+ /* ALU ops on registers, bpf_add|sub|...: dst_reg += src_reg */
+
++#define BPF_ALU_REG(CLASS, OP, DST, SRC) \
++ ((struct bpf_insn) { \
++ .code = CLASS | BPF_OP(OP) | BPF_X, \
++ .dst_reg = DST, \
++ .src_reg = SRC, \
++ .off = 0, \
++ .imm = 0 })
++
+ #define BPF_ALU64_REG(OP, DST, SRC) \
+ ((struct bpf_insn) { \
+ .code = BPF_ALU64 | BPF_OP(OP) | BPF_X, \
+@@ -123,6 +131,14 @@ struct sock_reuseport;
+
+ /* Short form of mov, dst_reg = src_reg */
+
++#define BPF_MOV_REG(CLASS, DST, SRC) \
++ ((struct bpf_insn) { \
++ .code = CLASS | BPF_MOV | BPF_X, \
++ .dst_reg = DST, \
++ .src_reg = SRC, \
++ .off = 0, \
++ .imm = 0 })
++
+ #define BPF_MOV64_REG(DST, SRC) \
+ ((struct bpf_insn) { \
+ .code = BPF_ALU64 | BPF_MOV | BPF_X, \
+@@ -157,6 +173,14 @@ struct sock_reuseport;
+ .off = 0, \
+ .imm = IMM })
+
++#define BPF_RAW_REG(insn, DST, SRC) \
++ ((struct bpf_insn) { \
++ .code = (insn).code, \
++ .dst_reg = DST, \
++ .src_reg = SRC, \
++ .off = (insn).off, \
++ .imm = (insn).imm })
++
+ /* BPF_LD_IMM64 macro encodes single 'load 64-bit immediate' insn */
+ #define BPF_LD_IMM64(DST, IMM) \
+ BPF_LD_IMM64_RAW(DST, 0, IMM)
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index ca5f053c6b66a..fbd689c15974e 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3594,6 +3594,10 @@ int netdev_rx_handler_register(struct net_device *dev,
+ void netdev_rx_handler_unregister(struct net_device *dev);
+
+ bool dev_valid_name(const char *name);
++static inline bool is_socket_ioctl_cmd(unsigned int cmd)
++{
++ return _IOC_TYPE(cmd) == SOCK_IOC_TYPE;
++}
+ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr,
+ bool *need_copyout);
+ int dev_ifconf(struct net *net, struct ifconf *, int);
+diff --git a/include/linux/once.h b/include/linux/once.h
+index 9225ee6d96c75..ae6f4eb41cbe7 100644
+--- a/include/linux/once.h
++++ b/include/linux/once.h
+@@ -7,7 +7,7 @@
+
+ bool __do_once_start(bool *done, unsigned long *flags);
+ void __do_once_done(bool *done, struct static_key_true *once_key,
+- unsigned long *flags);
++ unsigned long *flags, struct module *mod);
+
+ /* Call a function exactly once. The idea of DO_ONCE() is to perform
+ * a function call such as initialization of random seeds, etc, only
+@@ -46,7 +46,7 @@ void __do_once_done(bool *done, struct static_key_true *once_key,
+ if (unlikely(___ret)) { \
+ func(__VA_ARGS__); \
+ __do_once_done(&___done, &___once_key, \
+- &___flags); \
++ &___flags, THIS_MODULE); \
+ } \
+ } \
+ ___ret; \
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 36be400c3e657..d2b6d2459aad4 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -705,9 +705,6 @@ static int bpf_jit_blind_insn(const struct bpf_insn *from,
+ * below.
+ *
+ * Constant blinding is only used by JITs, not in the interpreter.
+- * The interpreter uses AX in some occasions as a local temporary
+- * register e.g. in DIV or MOD instructions.
+- *
+ * In restricted circumstances, the verifier can also use the AX
+ * register for rewrites as long as they do not interfere with
+ * the above cases!
+@@ -1057,6 +1054,7 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack)
+ #undef BPF_INSN_3_LBL
+ #undef BPF_INSN_2_LBL
+ u32 tail_call_cnt = 0;
++ u64 tmp;
+
+ #define CONT ({ insn++; goto select_insn; })
+ #define CONT_JMP ({ insn++; goto select_insn; })
+@@ -1117,36 +1115,36 @@ select_insn:
+ (*(s64 *) &DST) >>= IMM;
+ CONT;
+ ALU64_MOD_X:
+- div64_u64_rem(DST, SRC, &AX);
+- DST = AX;
++ div64_u64_rem(DST, SRC, &tmp);
++ DST = tmp;
+ CONT;
+ ALU_MOD_X:
+- AX = (u32) DST;
+- DST = do_div(AX, (u32) SRC);
++ tmp = (u32) DST;
++ DST = do_div(tmp, (u32) SRC);
+ CONT;
+ ALU64_MOD_K:
+- div64_u64_rem(DST, IMM, &AX);
+- DST = AX;
++ div64_u64_rem(DST, IMM, &tmp);
++ DST = tmp;
+ CONT;
+ ALU_MOD_K:
+- AX = (u32) DST;
+- DST = do_div(AX, (u32) IMM);
++ tmp = (u32) DST;
++ DST = do_div(tmp, (u32) IMM);
+ CONT;
+ ALU64_DIV_X:
+ DST = div64_u64(DST, SRC);
+ CONT;
+ ALU_DIV_X:
+- AX = (u32) DST;
+- do_div(AX, (u32) SRC);
+- DST = (u32) AX;
++ tmp = (u32) DST;
++ do_div(tmp, (u32) SRC);
++ DST = (u32) tmp;
+ CONT;
+ ALU64_DIV_K:
+ DST = div64_u64(DST, IMM);
+ CONT;
+ ALU_DIV_K:
+- AX = (u32) DST;
+- do_div(AX, (u32) IMM);
+- DST = (u32) AX;
++ tmp = (u32) DST;
++ do_div(tmp, (u32) IMM);
++ DST = (u32) tmp;
+ CONT;
+ ALU_END_TO_BE:
+ switch (IMM) {
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 2bf83305e5aba..abdc9eca463c5 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -6177,28 +6177,29 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
+ insn->code == (BPF_ALU | BPF_DIV | BPF_X)) {
+ bool is64 = BPF_CLASS(insn->code) == BPF_ALU64;
+ struct bpf_insn mask_and_div[] = {
+- BPF_MOV32_REG(insn->src_reg, insn->src_reg),
+- /* Rx div 0 -> 0 */
+- BPF_JMP_IMM(BPF_JNE, insn->src_reg, 0, 2),
+- BPF_ALU32_REG(BPF_XOR, insn->dst_reg, insn->dst_reg),
++ BPF_MOV_REG(BPF_CLASS(insn->code), BPF_REG_AX, insn->src_reg),
++ /* [R,W]x div 0 -> 0 */
++ BPF_JMP_IMM(BPF_JEQ, BPF_REG_AX, 0, 2),
++ BPF_RAW_REG(*insn, insn->dst_reg, BPF_REG_AX),
+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+- *insn,
++ BPF_ALU_REG(BPF_CLASS(insn->code), BPF_XOR, insn->dst_reg, insn->dst_reg),
+ };
+ struct bpf_insn mask_and_mod[] = {
+- BPF_MOV32_REG(insn->src_reg, insn->src_reg),
+- /* Rx mod 0 -> Rx */
+- BPF_JMP_IMM(BPF_JEQ, insn->src_reg, 0, 1),
+- *insn,
++ BPF_MOV_REG(BPF_CLASS(insn->code), BPF_REG_AX, insn->src_reg),
++ BPF_JMP_IMM(BPF_JEQ, BPF_REG_AX, 0, 1 + (is64 ? 0 : 1)),
++ BPF_RAW_REG(*insn, insn->dst_reg, BPF_REG_AX),
++ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
++ BPF_MOV32_REG(insn->dst_reg, insn->dst_reg),
+ };
+ struct bpf_insn *patchlet;
+
+ if (insn->code == (BPF_ALU64 | BPF_DIV | BPF_X) ||
+ insn->code == (BPF_ALU | BPF_DIV | BPF_X)) {
+- patchlet = mask_and_div + (is64 ? 1 : 0);
+- cnt = ARRAY_SIZE(mask_and_div) - (is64 ? 1 : 0);
++ patchlet = mask_and_div;
++ cnt = ARRAY_SIZE(mask_and_div);
+ } else {
+- patchlet = mask_and_mod + (is64 ? 1 : 0);
+- cnt = ARRAY_SIZE(mask_and_mod) - (is64 ? 1 : 0);
++ patchlet = mask_and_mod;
++ cnt = ARRAY_SIZE(mask_and_mod) - (is64 ? 2 : 0);
+ }
+
+ new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt);
+diff --git a/lib/once.c b/lib/once.c
+index 8b7d6235217ee..59149bf3bfb4a 100644
+--- a/lib/once.c
++++ b/lib/once.c
+@@ -3,10 +3,12 @@
+ #include <linux/spinlock.h>
+ #include <linux/once.h>
+ #include <linux/random.h>
++#include <linux/module.h>
+
+ struct once_work {
+ struct work_struct work;
+ struct static_key_true *key;
++ struct module *module;
+ };
+
+ static void once_deferred(struct work_struct *w)
+@@ -16,10 +18,11 @@ static void once_deferred(struct work_struct *w)
+ work = container_of(w, struct once_work, work);
+ BUG_ON(!static_key_enabled(work->key));
+ static_branch_disable(work->key);
++ module_put(work->module);
+ kfree(work);
+ }
+
+-static void once_disable_jump(struct static_key_true *key)
++static void once_disable_jump(struct static_key_true *key, struct module *mod)
+ {
+ struct once_work *w;
+
+@@ -29,6 +32,8 @@ static void once_disable_jump(struct static_key_true *key)
+
+ INIT_WORK(&w->work, once_deferred);
+ w->key = key;
++ w->module = mod;
++ __module_get(mod);
+ schedule_work(&w->work);
+ }
+
+@@ -53,11 +58,11 @@ bool __do_once_start(bool *done, unsigned long *flags)
+ EXPORT_SYMBOL(__do_once_start);
+
+ void __do_once_done(bool *done, struct static_key_true *once_key,
+- unsigned long *flags)
++ unsigned long *flags, struct module *mod)
+ __releases(once_lock)
+ {
+ *done = true;
+ spin_unlock_irqrestore(&once_lock, *flags);
+- once_disable_jump(once_key);
++ once_disable_jump(once_key, mod);
+ }
+ EXPORT_SYMBOL(__do_once_done);
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index de6f89511a216..a8a37d1128201 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -449,6 +449,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
+
+ static int gre_handle_offloads(struct sk_buff *skb, bool csum)
+ {
++ if (csum && skb_checksum_start(skb) < skb->data)
++ return -EINVAL;
+ return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
+ }
+
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index c5590d36b7750..a38caf317dbb4 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -70,10 +70,9 @@ EXPORT_SYMBOL_GPL(nf_conntrack_hash);
+
+ struct conntrack_gc_work {
+ struct delayed_work dwork;
+- u32 last_bucket;
++ u32 next_bucket;
+ bool exiting;
+ bool early_drop;
+- long next_gc_run;
+ };
+
+ static __read_mostly struct kmem_cache *nf_conntrack_cachep;
+@@ -81,12 +80,8 @@ static __read_mostly spinlock_t nf_conntrack_locks_all_lock;
+ static __read_mostly DEFINE_SPINLOCK(nf_conntrack_locks_all_lock);
+ static __read_mostly bool nf_conntrack_locks_all;
+
+-/* every gc cycle scans at most 1/GC_MAX_BUCKETS_DIV part of table */
+-#define GC_MAX_BUCKETS_DIV 128u
+-/* upper bound of full table scan */
+-#define GC_MAX_SCAN_JIFFIES (16u * HZ)
+-/* desired ratio of entries found to be expired */
+-#define GC_EVICT_RATIO 50u
++#define GC_SCAN_INTERVAL (120u * HZ)
++#define GC_SCAN_MAX_DURATION msecs_to_jiffies(10)
+
+ static struct conntrack_gc_work conntrack_gc_work;
+
+@@ -1198,17 +1193,13 @@ static void nf_ct_offload_timeout(struct nf_conn *ct)
+
+ static void gc_worker(struct work_struct *work)
+ {
+- unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u);
+- unsigned int i, goal, buckets = 0, expired_count = 0;
+- unsigned int nf_conntrack_max95 = 0;
++ unsigned long end_time = jiffies + GC_SCAN_MAX_DURATION;
++ unsigned int i, hashsz, nf_conntrack_max95 = 0;
++ unsigned long next_run = GC_SCAN_INTERVAL;
+ struct conntrack_gc_work *gc_work;
+- unsigned int ratio, scanned = 0;
+- unsigned long next_run;
+-
+ gc_work = container_of(work, struct conntrack_gc_work, dwork.work);
+
+- goal = nf_conntrack_htable_size / GC_MAX_BUCKETS_DIV;
+- i = gc_work->last_bucket;
++ i = gc_work->next_bucket;
+ if (gc_work->early_drop)
+ nf_conntrack_max95 = nf_conntrack_max / 100u * 95u;
+
+@@ -1216,22 +1207,21 @@ static void gc_worker(struct work_struct *work)
+ struct nf_conntrack_tuple_hash *h;
+ struct hlist_nulls_head *ct_hash;
+ struct hlist_nulls_node *n;
+- unsigned int hashsz;
+ struct nf_conn *tmp;
+
+- i++;
+ rcu_read_lock();
+
+ nf_conntrack_get_ht(&ct_hash, &hashsz);
+- if (i >= hashsz)
+- i = 0;
++ if (i >= hashsz) {
++ rcu_read_unlock();
++ break;
++ }
+
+ hlist_nulls_for_each_entry_rcu(h, n, &ct_hash[i], hnnode) {
+ struct net *net;
+
+ tmp = nf_ct_tuplehash_to_ctrack(h);
+
+- scanned++;
+ if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) {
+ nf_ct_offload_timeout(tmp);
+ continue;
+@@ -1239,7 +1229,6 @@ static void gc_worker(struct work_struct *work)
+
+ if (nf_ct_is_expired(tmp)) {
+ nf_ct_gc_expired(tmp);
+- expired_count++;
+ continue;
+ }
+
+@@ -1271,7 +1260,14 @@ static void gc_worker(struct work_struct *work)
+ */
+ rcu_read_unlock();
+ cond_resched();
+- } while (++buckets < goal);
++ i++;
++
++ if (time_after(jiffies, end_time) && i < hashsz) {
++ gc_work->next_bucket = i;
++ next_run = 0;
++ break;
++ }
++ } while (i < hashsz);
+
+ if (gc_work->exiting)
+ return;
+@@ -1282,40 +1278,17 @@ static void gc_worker(struct work_struct *work)
+ *
+ * This worker is only here to reap expired entries when system went
+ * idle after a busy period.
+- *
+- * The heuristics below are supposed to balance conflicting goals:
+- *
+- * 1. Minimize time until we notice a stale entry
+- * 2. Maximize scan intervals to not waste cycles
+- *
+- * Normally, expire ratio will be close to 0.
+- *
+- * As soon as a sizeable fraction of the entries have expired
+- * increase scan frequency.
+ */
+- ratio = scanned ? expired_count * 100 / scanned : 0;
+- if (ratio > GC_EVICT_RATIO) {
+- gc_work->next_gc_run = min_interval;
+- } else {
+- unsigned int max = GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV;
+-
+- BUILD_BUG_ON((GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV) == 0);
+-
+- gc_work->next_gc_run += min_interval;
+- if (gc_work->next_gc_run > max)
+- gc_work->next_gc_run = max;
++ if (next_run) {
++ gc_work->early_drop = false;
++ gc_work->next_bucket = 0;
+ }
+-
+- next_run = gc_work->next_gc_run;
+- gc_work->last_bucket = i;
+- gc_work->early_drop = false;
+ queue_delayed_work(system_power_efficient_wq, &gc_work->dwork, next_run);
+ }
+
+ static void conntrack_gc_work_init(struct conntrack_gc_work *gc_work)
+ {
+ INIT_DEFERRABLE_WORK(&gc_work->dwork, gc_worker);
+- gc_work->next_gc_run = HZ;
+ gc_work->exiting = false;
+ }
+
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 1e2772913957d..128d0a48478d1 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -321,7 +321,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
+ goto err;
+ }
+
+- if (len != ALIGN(size, 4) + hdrlen)
++ if (!size || len != ALIGN(size, 4) + hdrlen)
+ goto err;
+
+ if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA)
+diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
+index 6431a023ac895..46988c009a3e2 100644
+--- a/net/rds/ib_frmr.c
++++ b/net/rds/ib_frmr.c
+@@ -111,9 +111,9 @@ static int rds_ib_post_reg_frmr(struct rds_ib_mr *ibmr)
+ cpu_relax();
+ }
+
+- ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_len,
++ ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_dma_len,
+ &off, PAGE_SIZE);
+- if (unlikely(ret != ibmr->sg_len))
++ if (unlikely(ret != ibmr->sg_dma_len))
+ return ret < 0 ? ret : -EINVAL;
+
+ /* Perform a WR for the fast_reg_mr. Each individual page
+diff --git a/net/socket.c b/net/socket.c
+index f14bca00ff010..e5cc9f2b981ed 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1030,7 +1030,7 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,
+ rtnl_unlock();
+ if (!err && copy_to_user(argp, &ifc, sizeof(struct ifconf)))
+ err = -EFAULT;
+- } else {
++ } else if (is_socket_ioctl_cmd(cmd)) {
+ struct ifreq ifr;
+ bool need_copyout;
+ if (copy_from_user(&ifr, argp, sizeof(struct ifreq)))
+@@ -1039,6 +1039,8 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,
+ if (!err && need_copyout)
+ if (copy_to_user(argp, &ifr, sizeof(struct ifreq)))
+ return -EFAULT;
++ } else {
++ err = -ENOTTY;
+ }
+ return err;
+ }
+@@ -3064,6 +3066,8 @@ static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
+ struct ifreq ifreq;
+ u32 data32;
+
++ if (!is_socket_ioctl_cmd(cmd))
++ return -ENOTTY;
+ if (copy_from_user(ifreq.ifr_name, u_ifreq32->ifr_name, IFNAMSIZ))
+ return -EFAULT;
+ if (get_user(data32, &u_ifreq32->ifr_data))
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-09-20 22:05 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-09-20 22:05 UTC (permalink / raw
To: gentoo-commits
commit: 5bfe0bddb7c64556439354637cc89f5771509d36
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Sep 20 22:04:48 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Sep 20 22:04:48 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5bfe0bdd
Move USER_NS to GENTOO_LINUX_PORTAGE
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
4567_distro-Gentoo-Kconfig.patch | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index 394d45b..9b84f32 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -65,6 +65,7 @@
+ select NET_NS
+ select PID_NS
+ select SYSVIPC
++ select USER_NS
+ select UTS_NS
+
+ help
@@ -145,7 +146,6 @@
+ select TIMERFD
+ select TMPFS_POSIX_ACL
+ select TMPFS_XATTR
-+ select USER_NS
+
+ select ANON_INODES
+ select BLOCK
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-09-22 11:40 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-09-22 11:40 UTC (permalink / raw
To: gentoo-commits
commit: 9008f39a3d63e3006ef77c698aa32930cc2aebae
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 22 11:40:29 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Sep 22 11:40:29 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9008f39a
Linux patch 4.19.207
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1206_linux-4.19.207.patch | 9342 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 9346 insertions(+)
diff --git a/0000_README b/0000_README
index 1c6d7ee..6a76482 100644
--- a/0000_README
+++ b/0000_README
@@ -863,6 +863,10 @@ Patch: 1205_linux-4.19.206.patch
From: https://www.kernel.org
Desc: Linux 4.19.206
+Patch: 1206_linux-4.19.207.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.207
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1206_linux-4.19.207.patch b/1206_linux-4.19.207.patch
new file mode 100644
index 0000000..7309df1
--- /dev/null
+++ b/1206_linux-4.19.207.patch
@@ -0,0 +1,9342 @@
+diff --git a/Documentation/admin-guide/devices.txt b/Documentation/admin-guide/devices.txt
+index 1649117e6087d..9cd7926c87814 100644
+--- a/Documentation/admin-guide/devices.txt
++++ b/Documentation/admin-guide/devices.txt
+@@ -2993,10 +2993,10 @@
+ 65 = /dev/infiniband/issm1 Second InfiniBand IsSM device
+ ...
+ 127 = /dev/infiniband/issm63 63rd InfiniBand IsSM device
+- 128 = /dev/infiniband/uverbs0 First InfiniBand verbs device
+- 129 = /dev/infiniband/uverbs1 Second InfiniBand verbs device
++ 192 = /dev/infiniband/uverbs0 First InfiniBand verbs device
++ 193 = /dev/infiniband/uverbs1 Second InfiniBand verbs device
+ ...
+- 159 = /dev/infiniband/uverbs31 31st InfiniBand verbs device
++ 223 = /dev/infiniband/uverbs31 31st InfiniBand verbs device
+
+ 232 char Biometric Devices
+ 0 = /dev/biometric/sensor0/fingerprint first fingerprint sensor on first device
+diff --git a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
+index c059ab74ed886..a4a75fa795249 100644
+--- a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
++++ b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
+@@ -122,7 +122,7 @@ on various other factors also like;
+ so the device should have enough free bytes available its OOB/Spare
+ area to accommodate ECC for entire page. In general following expression
+ helps in determining if given device can accommodate ECC syndrome:
+- "2 + (PAGESIZE / 512) * ECC_BYTES" >= OOBSIZE"
++ "2 + (PAGESIZE / 512) * ECC_BYTES" <= OOBSIZE"
+ where
+ OOBSIZE number of bytes in OOB/spare area
+ PAGESIZE number of bytes in main-area of device page
+diff --git a/Makefile b/Makefile
+index 3a3eea3ab10a5..77dd62aa0bbe5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 206
++SUBLEVEL = 207
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
+index cf9619d4efb4f..c5254c5967ed6 100644
+--- a/arch/arc/mm/cache.c
++++ b/arch/arc/mm/cache.c
+@@ -1112,7 +1112,7 @@ void clear_user_page(void *to, unsigned long u_vaddr, struct page *page)
+ clear_page(to);
+ clear_bit(PG_dc_clean, &page->flags);
+ }
+-
++EXPORT_SYMBOL(clear_user_page);
+
+ /**********************************************************************
+ * Explicit Cache flush request from user space via syscall
+diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
+index ec2327a3796d5..1b3a4144646b0 100644
+--- a/arch/arm/boot/compressed/Makefile
++++ b/arch/arm/boot/compressed/Makefile
+@@ -90,6 +90,8 @@ $(addprefix $(obj)/,$(libfdt_objs) atags_to_fdt.o): \
+ $(addprefix $(obj)/,$(libfdt_hdrs))
+
+ ifeq ($(CONFIG_ARM_ATAG_DTB_COMPAT),y)
++CFLAGS_REMOVE_atags_to_fdt.o += -Wframe-larger-than=${CONFIG_FRAME_WARN}
++CFLAGS_atags_to_fdt.o += -Wframe-larger-than=1280
+ OBJS += $(libfdt_objs) atags_to_fdt.o
+ endif
+
+diff --git a/arch/arm/boot/dts/imx53-ppd.dts b/arch/arm/boot/dts/imx53-ppd.dts
+index f202396e3f2a8..f346673d34ead 100644
+--- a/arch/arm/boot/dts/imx53-ppd.dts
++++ b/arch/arm/boot/dts/imx53-ppd.dts
+@@ -70,6 +70,12 @@
+ clock-frequency = <11289600>;
+ };
+
++ achc_24M: achc-clock {
++ compatible = "fixed-clock";
++ #clock-cells = <0>;
++ clock-frequency = <24000000>;
++ };
++
+ sgtlsound: sound {
+ compatible = "fsl,imx53-cpuvo-sgtl5000",
+ "fsl,imx-audio-sgtl5000";
+@@ -287,16 +293,13 @@
+ &gpio4 12 GPIO_ACTIVE_LOW>;
+ status = "okay";
+
+- spidev0: spi@0 {
+- compatible = "ge,achc";
+- reg = <0>;
+- spi-max-frequency = <1000000>;
+- };
+-
+- spidev1: spi@1 {
+- compatible = "ge,achc";
+- reg = <1>;
+- spi-max-frequency = <1000000>;
++ spidev0: spi@1 {
++ compatible = "ge,achc", "nxp,kinetis-k20";
++ reg = <1>, <0>;
++ vdd-supply = <®_3v3>;
++ vdda-supply = <®_3v3>;
++ clocks = <&achc_24M>;
++ reset-gpios = <&gpio3 6 GPIO_ACTIVE_LOW>;
+ };
+
+ gpioxra0: gpio@2 {
+diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
+index 4a99c92551049..d0153bbbdbeb8 100644
+--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
+@@ -1296,9 +1296,9 @@
+ <&mmcc DSI1_BYTE_CLK>,
+ <&mmcc DSI_PIXEL_CLK>,
+ <&mmcc DSI1_ESC_CLK>;
+- clock-names = "iface_clk", "bus_clk", "core_mmss_clk",
+- "src_clk", "byte_clk", "pixel_clk",
+- "core_clk";
++ clock-names = "iface", "bus", "core_mmss",
++ "src", "byte", "pixel",
++ "core";
+
+ assigned-clocks = <&mmcc DSI1_BYTE_SRC>,
+ <&mmcc DSI1_ESC_SRC>,
+diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+index 20137fc578b1b..394a6b4dc69d5 100644
+--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi
++++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+@@ -185,8 +185,9 @@
+ nvidia,pins = "ata", "atb", "atc", "atd", "ate",
+ "cdev1", "cdev2", "dap1", "dtb", "gma",
+ "gmb", "gmc", "gmd", "gme", "gpu7",
+- "gpv", "i2cp", "pta", "rm", "slxa",
+- "slxk", "spia", "spib", "uac";
++ "gpv", "i2cp", "irrx", "irtx", "pta",
++ "rm", "slxa", "slxk", "spia", "spib",
++ "uac";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ };
+@@ -211,7 +212,7 @@
+ conf_ddc {
+ nvidia,pins = "ddc", "dta", "dtd", "kbca",
+ "kbcb", "kbcc", "kbcd", "kbce", "kbcf",
+- "sdc";
++ "sdc", "uad", "uca";
+ nvidia,pull = <TEGRA_PIN_PULL_UP>;
+ nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ };
+@@ -221,10 +222,9 @@
+ "lvp0", "owc", "sdb";
+ nvidia,tristate = <TEGRA_PIN_ENABLE>;
+ };
+- conf_irrx {
+- nvidia,pins = "irrx", "irtx", "sdd", "spic",
+- "spie", "spih", "uaa", "uab", "uad",
+- "uca", "ucb";
++ conf_sdd {
++ nvidia,pins = "sdd", "spic", "spie", "spih",
++ "uaa", "uab", "ucb";
+ nvidia,pull = <TEGRA_PIN_PULL_UP>;
+ nvidia,tristate = <TEGRA_PIN_ENABLE>;
+ };
+diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
+index 8cad59465af39..8b679e2ca3c3d 100644
+--- a/arch/arm/kernel/Makefile
++++ b/arch/arm/kernel/Makefile
+@@ -17,10 +17,14 @@ CFLAGS_REMOVE_return_address.o = -pg
+ # Object file lists.
+
+ obj-y := elf.o entry-common.o irq.o opcodes.o \
+- process.o ptrace.o reboot.o return_address.o \
++ process.o ptrace.o reboot.o \
+ setup.o signal.o sigreturn_codes.o \
+ stacktrace.o sys_arm.o time.o traps.o
+
++ifneq ($(CONFIG_ARM_UNWIND),y)
++obj-$(CONFIG_FRAME_POINTER) += return_address.o
++endif
++
+ obj-$(CONFIG_ATAGS) += atags_parse.o
+ obj-$(CONFIG_ATAGS_PROC) += atags_proc.o
+ obj-$(CONFIG_DEPRECATED_PARAM_STRUCT) += atags_compat.o
+diff --git a/arch/arm/kernel/return_address.c b/arch/arm/kernel/return_address.c
+index 36ed35073289b..f945742dea449 100644
+--- a/arch/arm/kernel/return_address.c
++++ b/arch/arm/kernel/return_address.c
+@@ -10,8 +10,6 @@
+ */
+ #include <linux/export.h>
+ #include <linux/ftrace.h>
+-
+-#if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND)
+ #include <linux/sched.h>
+
+ #include <asm/stacktrace.h>
+@@ -56,6 +54,4 @@ void *return_address(unsigned int level)
+ return NULL;
+ }
+
+-#endif /* if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) */
+-
+ EXPORT_SYMBOL_GPL(return_address);
+diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
+index ae0a61c61a6e1..14be73ca107a5 100644
+--- a/arch/arm/mach-imx/mmdc.c
++++ b/arch/arm/mach-imx/mmdc.c
+@@ -109,6 +109,7 @@ struct mmdc_pmu {
+ struct perf_event *mmdc_events[MMDC_NUM_COUNTERS];
+ struct hlist_node node;
+ struct fsl_mmdc_devtype_data *devtype_data;
++ struct clk *mmdc_ipg_clk;
+ };
+
+ /*
+@@ -474,11 +475,13 @@ static int imx_mmdc_remove(struct platform_device *pdev)
+ cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
+ perf_pmu_unregister(&pmu_mmdc->pmu);
+ iounmap(pmu_mmdc->mmdc_base);
++ clk_disable_unprepare(pmu_mmdc->mmdc_ipg_clk);
+ kfree(pmu_mmdc);
+ return 0;
+ }
+
+-static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base)
++static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base,
++ struct clk *mmdc_ipg_clk)
+ {
+ struct mmdc_pmu *pmu_mmdc;
+ char *name;
+@@ -506,6 +509,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
+ }
+
+ mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev);
++ pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;
+ if (mmdc_num == 0)
+ name = "mmdc";
+ else
+@@ -541,7 +545,7 @@ pmu_free:
+
+ #else
+ #define imx_mmdc_remove NULL
+-#define imx_mmdc_perf_init(pdev, mmdc_base) 0
++#define imx_mmdc_perf_init(pdev, mmdc_base, mmdc_ipg_clk) 0
+ #endif
+
+ static int imx_mmdc_probe(struct platform_device *pdev)
+@@ -579,9 +583,11 @@ static int imx_mmdc_probe(struct platform_device *pdev)
+ val &= ~(1 << BP_MMDC_MAPSR_PSD);
+ writel_relaxed(val, reg);
+
+- err = imx_mmdc_perf_init(pdev, mmdc_base);
+- if (err)
++ err = imx_mmdc_perf_init(pdev, mmdc_base, mmdc_ipg_clk);
++ if (err) {
+ iounmap(mmdc_base);
++ clk_disable_unprepare(mmdc_ipg_clk);
++ }
+
+ return err;
+ }
+diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
+index 328ced7bfaf26..79b12e7445373 100644
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -1578,6 +1578,9 @@ exit:
+ rn = arm_bpf_get_reg32(src_lo, tmp2[1], ctx);
+ emit_ldx_r(dst, rn, off, ctx, BPF_SIZE(code));
+ break;
++ /* speculation barrier */
++ case BPF_ST | BPF_NOSPEC:
++ break;
+ /* ST: *(size *)(dst + off) = imm */
+ case BPF_ST | BPF_MEM | BPF_W:
+ case BPF_ST | BPF_MEM | BPF_H:
+diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+index 5c5e57026c275..c607297922fdb 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+@@ -91,7 +91,7 @@
+ #address-cells = <0>;
+ interrupt-controller;
+ reg = <0x11001000 0x1000>,
+- <0x11002000 0x1000>,
++ <0x11002000 0x2000>,
+ <0x11004000 0x2000>,
+ <0x11006000 0x2000>;
+ };
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts b/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
+index c13ddee8262b9..58acf21d8d333 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
++++ b/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
+@@ -28,7 +28,7 @@
+ stdout-path = "serial0";
+ };
+
+- memory {
++ memory@40000000 {
+ device_type = "memory";
+ reg = <0x0 0x40000000 0x0 0x20000000>;
+ };
+diff --git a/arch/arm64/include/asm/kernel-pgtable.h b/arch/arm64/include/asm/kernel-pgtable.h
+index a780f6714b445..74ab40b76ad53 100644
+--- a/arch/arm64/include/asm/kernel-pgtable.h
++++ b/arch/arm64/include/asm/kernel-pgtable.h
+@@ -76,8 +76,8 @@
+ #define EARLY_KASLR (0)
+ #endif
+
+-#define EARLY_ENTRIES(vstart, vend, shift) (((vend) >> (shift)) \
+- - ((vstart) >> (shift)) + 1 + EARLY_KASLR)
++#define EARLY_ENTRIES(vstart, vend, shift) \
++ ((((vend) - 1) >> (shift)) - ((vstart) >> (shift)) + 1 + EARLY_KASLR)
+
+ #define EARLY_PGDS(vstart, vend) (EARLY_ENTRIES(vstart, vend, PGDIR_SHIFT))
+
+diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
+index 19c87b52c001f..89ab68cb35bbd 100644
+--- a/arch/arm64/kernel/fpsimd.c
++++ b/arch/arm64/kernel/fpsimd.c
+@@ -434,7 +434,7 @@ size_t sve_state_size(struct task_struct const *task)
+ void sve_alloc(struct task_struct *task)
+ {
+ if (task->thread.sve_state) {
+- memset(task->thread.sve_state, 0, sve_state_size(current));
++ memset(task->thread.sve_state, 0, sve_state_size(task));
+ return;
+ }
+
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index c85ea70b92936..ea7f059dbcb6c 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -202,7 +202,7 @@ ENDPROC(preserve_boot_args)
+ * to be composed of multiple pages. (This effectively scales the end index).
+ *
+ * vstart: virtual address of start of range
+- * vend: virtual address of end of range
++ * vend: virtual address of end of range - we map [vstart, vend]
+ * shift: shift used to transform virtual address into index
+ * ptrs: number of entries in page table
+ * istart: index in table corresponding to vstart
+@@ -239,17 +239,18 @@ ENDPROC(preserve_boot_args)
+ *
+ * tbl: location of page table
+ * rtbl: address to be used for first level page table entry (typically tbl + PAGE_SIZE)
+- * vstart: start address to map
+- * vend: end address to map - we map [vstart, vend]
++ * vstart: virtual address of start of range
++ * vend: virtual address of end of range - we map [vstart, vend - 1]
+ * flags: flags to use to map last level entries
+ * phys: physical address corresponding to vstart - physical memory is contiguous
+ * pgds: the number of pgd entries
+ *
+ * Temporaries: istart, iend, tmp, count, sv - these need to be different registers
+- * Preserves: vstart, vend, flags
+- * Corrupts: tbl, rtbl, istart, iend, tmp, count, sv
++ * Preserves: vstart, flags
++ * Corrupts: tbl, rtbl, vend, istart, iend, tmp, count, sv
+ */
+ .macro map_memory, tbl, rtbl, vstart, vend, flags, phys, pgds, istart, iend, tmp, count, sv
++ sub \vend, \vend, #1
+ add \rtbl, \tbl, #PAGE_SIZE
+ mov \sv, \rtbl
+ mov \count, #0
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 7f0258ed1f5fe..6876e8205042a 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -685,6 +685,19 @@ emit_cond_jmp:
+ }
+ break;
+
++ /* speculation barrier */
++ case BPF_ST | BPF_NOSPEC:
++ /*
++ * Nothing required here.
++ *
++ * In case of arm64, we rely on the firmware mitigation of
++ * Speculative Store Bypass as controlled via the ssbd kernel
++ * parameter. Whenever the mitigation is enabled, it works
++ * for all of the kernel code with no need to provide any
++ * additional instructions.
++ */
++ break;
++
+ /* ST: *(size *)(dst + off) = imm */
+ case BPF_ST | BPF_MEM | BPF_W:
+ case BPF_ST | BPF_MEM | BPF_H:
+diff --git a/arch/m68k/emu/nfeth.c b/arch/m68k/emu/nfeth.c
+index e45ce4243aaa3..76262dc40e791 100644
+--- a/arch/m68k/emu/nfeth.c
++++ b/arch/m68k/emu/nfeth.c
+@@ -258,8 +258,8 @@ static void __exit nfeth_cleanup(void)
+
+ for (i = 0; i < MAX_UNIT; i++) {
+ if (nfeth_dev[i]) {
+- unregister_netdev(nfeth_dev[0]);
+- free_netdev(nfeth_dev[0]);
++ unregister_netdev(nfeth_dev[i]);
++ free_netdev(nfeth_dev[i]);
+ }
+ }
+ free_irq(nfEtherIRQ, nfeth_interrupt);
+diff --git a/arch/mips/mti-malta/malta-dtshim.c b/arch/mips/mti-malta/malta-dtshim.c
+index 7859b6e498634..5b5d78a7882a4 100644
+--- a/arch/mips/mti-malta/malta-dtshim.c
++++ b/arch/mips/mti-malta/malta-dtshim.c
+@@ -26,7 +26,7 @@
+ #define ROCIT_CONFIG_GEN1_MEMMAP_SHIFT 8
+ #define ROCIT_CONFIG_GEN1_MEMMAP_MASK (0xf << 8)
+
+-static unsigned char fdt_buf[16 << 10] __initdata;
++static unsigned char fdt_buf[16 << 10] __initdata __aligned(8);
+
+ /* determined physical memory size, not overridden by command line args */
+ extern unsigned long physical_memsize;
+diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
+index 3832c46286082..947a7172c814e 100644
+--- a/arch/mips/net/ebpf_jit.c
++++ b/arch/mips/net/ebpf_jit.c
+@@ -1282,6 +1282,9 @@ jeq_common:
+ }
+ break;
+
++ case BPF_ST | BPF_NOSPEC: /* speculation barrier */
++ break;
++
+ case BPF_ST | BPF_B | BPF_MEM:
+ case BPF_ST | BPF_H | BPF_MEM:
+ case BPF_ST | BPF_W | BPF_MEM:
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index 01b59d2ce1747..c2c3ce8a0f84e 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -551,6 +551,7 @@ EXCEPTION_ENTRY(_external_irq_handler)
+ l.bnf 1f // ext irq enabled, all ok.
+ l.nop
+
++#ifdef CONFIG_PRINTK
+ l.addi r1,r1,-0x8
+ l.movhi r3,hi(42f)
+ l.ori r3,r3,lo(42f)
+@@ -564,6 +565,7 @@ EXCEPTION_ENTRY(_external_irq_handler)
+ .string "\n\rESR interrupt bug: in _external_irq_handler (ESR %x)\n\r"
+ .align 4
+ .previous
++#endif
+
+ l.ori r4,r4,SPR_SR_IEE // fix the bug
+ // l.sw PT_SR(r1),r4
+diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
+index 342073f44d3f1..79b05eac2b33c 100644
+--- a/arch/parisc/kernel/signal.c
++++ b/arch/parisc/kernel/signal.c
+@@ -239,6 +239,12 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs,
+ #endif
+
+ usp = (regs->gr[30] & ~(0x01UL));
++#ifdef CONFIG_64BIT
++ if (is_compat_task()) {
++ /* The gcc alloca implementation leaves garbage in the upper 32 bits of sp */
++ usp = (compat_uint_t)usp;
++ }
++#endif
+ /*FIXME: frame_size parameter is unused, remove it. */
+ frame = get_sigframe(&ksig->ka, usp, sizeof(*frame));
+
+diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
+index 9b9d17437373b..0247b8e6cb1b7 100644
+--- a/arch/powerpc/boot/crt0.S
++++ b/arch/powerpc/boot/crt0.S
+@@ -49,9 +49,6 @@ p_end: .long _end
+ p_pstack: .long _platform_stack_top
+ #endif
+
+- .globl _zimage_start
+- /* Clang appears to require the .weak directive to be after the symbol
+- * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */
+ .weak _zimage_start
+ _zimage_start:
+ .globl _zimage_start_lib
+diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
+index 8661eea78503f..4bf81a111179f 100644
+--- a/arch/powerpc/kernel/module_64.c
++++ b/arch/powerpc/kernel/module_64.c
+@@ -719,7 +719,7 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
+ /*
+ * If found, replace it with:
+ * addis r2, r12, (.TOC.-func)@ha
+- * addi r2, r12, (.TOC.-func)@l
++ * addi r2, r2, (.TOC.-func)@l
+ */
+ ((uint32_t *)location)[0] = 0x3c4c0000 + PPC_HA(value);
+ ((uint32_t *)location)[1] = 0x38420000 + PPC_LO(value);
+diff --git a/arch/powerpc/kernel/stacktrace.c b/arch/powerpc/kernel/stacktrace.c
+index 23b5f755e419b..dadcc8bab336a 100644
+--- a/arch/powerpc/kernel/stacktrace.c
++++ b/arch/powerpc/kernel/stacktrace.c
+@@ -8,6 +8,7 @@
+ * Copyright 2018 Nick Piggin, Michael Ellerman, IBM Corp.
+ */
+
++#include <linux/delay.h>
+ #include <linux/export.h>
+ #include <linux/kallsyms.h>
+ #include <linux/module.h>
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index 7e3ab477f67fe..e7d56ddba43aa 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -596,6 +596,12 @@ emit_clear:
+ }
+ break;
+
++ /*
++ * BPF_ST NOSPEC (speculation barrier)
++ */
++ case BPF_ST | BPF_NOSPEC:
++ break;
++
+ /*
+ * BPF_ST(X)
+ */
+diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c
+index 43fabb3cae0fa..160b86d9d8199 100644
+--- a/arch/powerpc/perf/hv-gpci.c
++++ b/arch/powerpc/perf/hv-gpci.c
+@@ -168,7 +168,7 @@ static unsigned long single_gpci_request(u32 req, u32 starting_index,
+ */
+ count = 0;
+ for (i = offset; i < offset + length; i++)
+- count |= arg->bytes[i] << (i - offset);
++ count |= (u64)(arg->bytes[i]) << ((length - 1 - (i - offset)) * 8);
+
+ *value = count;
+ out:
+diff --git a/arch/s390/kernel/jump_label.c b/arch/s390/kernel/jump_label.c
+index 68f415e334a59..10009a0cdb37c 100644
+--- a/arch/s390/kernel/jump_label.c
++++ b/arch/s390/kernel/jump_label.c
+@@ -41,7 +41,7 @@ static void jump_label_bug(struct jump_entry *entry, struct insn *expected,
+ unsigned char *ipe = (unsigned char *)expected;
+ unsigned char *ipn = (unsigned char *)new;
+
+- pr_emerg("Jump label code mismatch at %pS [%p]\n", ipc, ipc);
++ pr_emerg("Jump label code mismatch at %pS [%px]\n", ipc, ipc);
+ pr_emerg("Found: %6ph\n", ipc);
+ pr_emerg("Expected: %6ph\n", ipe);
+ pr_emerg("New: %6ph\n", ipn);
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index 3515f2b55eb9e..dc5ecaea30d71 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -318,13 +318,13 @@ static unsigned long deliverable_irqs(struct kvm_vcpu *vcpu)
+ static void __set_cpu_idle(struct kvm_vcpu *vcpu)
+ {
+ kvm_s390_set_cpuflags(vcpu, CPUSTAT_WAIT);
+- set_bit(vcpu->vcpu_id, vcpu->kvm->arch.float_int.idle_mask);
++ set_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.float_int.idle_mask);
+ }
+
+ static void __unset_cpu_idle(struct kvm_vcpu *vcpu)
+ {
+ kvm_s390_clear_cpuflags(vcpu, CPUSTAT_WAIT);
+- clear_bit(vcpu->vcpu_id, vcpu->kvm->arch.float_int.idle_mask);
++ clear_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.float_int.idle_mask);
+ }
+
+ static void __reset_intercept_indicators(struct kvm_vcpu *vcpu)
+diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h
+index 981e3ba974616..0a2ffd5378be2 100644
+--- a/arch/s390/kvm/kvm-s390.h
++++ b/arch/s390/kvm/kvm-s390.h
+@@ -67,7 +67,7 @@ static inline int is_vcpu_stopped(struct kvm_vcpu *vcpu)
+
+ static inline int is_vcpu_idle(struct kvm_vcpu *vcpu)
+ {
+- return test_bit(vcpu->vcpu_id, vcpu->kvm->arch.float_int.idle_mask);
++ return test_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.float_int.idle_mask);
+ }
+
+ static inline int kvm_is_ucontrol(struct kvm *kvm)
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index e42354b15e0bc..8508c2c0e2a3a 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -595,8 +595,13 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ case BPF_ALU64 | BPF_SUB | BPF_K: /* dst = dst - imm */
+ if (!imm)
+ break;
+- /* agfi %dst,-imm */
+- EMIT6_IMM(0xc2080000, dst_reg, -imm);
++ if (imm == -0x80000000) {
++ /* algfi %dst,0x80000000 */
++ EMIT6_IMM(0xc20a0000, dst_reg, 0x80000000);
++ } else {
++ /* agfi %dst,-imm */
++ EMIT6_IMM(0xc2080000, dst_reg, -imm);
++ }
+ break;
+ /*
+ * BPF_MUL
+@@ -883,6 +888,11 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ break;
+ }
+ break;
++ /*
++ * BPF_NOSPEC (speculation barrier)
++ */
++ case BPF_ST | BPF_NOSPEC:
++ break;
+ /*
+ * BPF_ST(X)
+ */
+diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c
+index ec4da4dc98f12..1bb1e64d4377d 100644
+--- a/arch/sparc/net/bpf_jit_comp_64.c
++++ b/arch/sparc/net/bpf_jit_comp_64.c
+@@ -1261,6 +1261,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ emit(opcode | RS1(src) | rs2 | RD(dst), ctx);
+ break;
+ }
++ /* speculation barrier */
++ case BPF_ST | BPF_NOSPEC:
++ break;
+ /* ST: *(size *)(dst + off) = imm */
+ case BPF_ST | BPF_MEM | BPF_W:
+ case BPF_ST | BPF_MEM | BPF_H:
+diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
+index 2410bd4bb48f3..2d9e1372b070c 100644
+--- a/arch/x86/events/amd/ibs.c
++++ b/arch/x86/events/amd/ibs.c
+@@ -90,6 +90,7 @@ struct perf_ibs {
+ unsigned long offset_mask[1];
+ int offset_max;
+ unsigned int fetch_count_reset_broken : 1;
++ unsigned int fetch_ignore_if_zero_rip : 1;
+ struct cpu_perf_ibs __percpu *pcpu;
+
+ struct attribute **format_attrs;
+@@ -674,6 +675,10 @@ fail:
+ if (check_rip && (ibs_data.regs[2] & IBS_RIP_INVALID)) {
+ regs.flags &= ~PERF_EFLAGS_EXACT;
+ } else {
++ /* Workaround for erratum #1197 */
++ if (perf_ibs->fetch_ignore_if_zero_rip && !(ibs_data.regs[1]))
++ goto out;
++
+ set_linear_ip(®s, ibs_data.regs[1]);
+ regs.flags |= PERF_EFLAGS_EXACT;
+ }
+@@ -767,6 +772,9 @@ static __init void perf_event_ibs_init(void)
+ if (boot_cpu_data.x86 >= 0x16 && boot_cpu_data.x86 <= 0x18)
+ perf_ibs_fetch.fetch_count_reset_broken = 1;
+
++ if (boot_cpu_data.x86 == 0x19 && boot_cpu_data.x86_model < 0x10)
++ perf_ibs_fetch.fetch_ignore_if_zero_rip = 1;
++
+ perf_ibs_pmu_init(&perf_ibs_fetch, "ibs_fetch");
+
+ if (ibs_caps & IBS_CAPS_OPCNT) {
+diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
+index f03100bc5fd12..849f0ba53a9b9 100644
+--- a/arch/x86/events/intel/pt.c
++++ b/arch/x86/events/intel/pt.c
+@@ -69,7 +69,7 @@ static struct pt_cap_desc {
+ PT_CAP(topa_multiple_entries, 0, CPUID_ECX, BIT(1)),
+ PT_CAP(single_range_output, 0, CPUID_ECX, BIT(2)),
+ PT_CAP(payloads_lip, 0, CPUID_ECX, BIT(31)),
+- PT_CAP(num_address_ranges, 1, CPUID_EAX, 0x3),
++ PT_CAP(num_address_ranges, 1, CPUID_EAX, 0x7),
+ PT_CAP(mtc_periods, 1, CPUID_EAX, 0xffff0000),
+ PT_CAP(cycle_thresholds, 1, CPUID_EBX, 0xffff),
+ PT_CAP(psb_periods, 1, CPUID_EBX, 0xffff0000),
+diff --git a/arch/x86/kernel/cpu/intel_rdt_monitor.c b/arch/x86/kernel/cpu/intel_rdt_monitor.c
+index 6eeb17dfde48e..5fee674fe59d9 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_monitor.c
++++ b/arch/x86/kernel/cpu/intel_rdt_monitor.c
+@@ -252,6 +252,12 @@ static u64 __mon_event_count(u32 rmid, struct rmid_read *rr)
+ case QOS_L3_MBM_LOCAL_EVENT_ID:
+ m = &rr->d->mbm_local[rmid];
+ break;
++ default:
++ /*
++ * Code would never reach here because an invalid
++ * event id would fail the __rmid_read.
++ */
++ return RMID_VAL_ERROR;
+ }
+
+ if (rr->first) {
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 6489cc19ed069..b0f3a996df15f 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -388,10 +388,11 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = {
+ },
+ { /* Handle problems with rebooting on the OptiPlex 990. */
+ .callback = set_pci_reboot,
+- .ident = "Dell OptiPlex 990",
++ .ident = "Dell OptiPlex 990 BIOS A0x",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"),
++ DMI_MATCH(DMI_BIOS_VERSION, "A0"),
+ },
+ },
+ { /* Handle problems with rebooting on Dell 300's */
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index f913127e942a1..417abc9ba1ad4 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2511,6 +2511,10 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ if (!msr_info->host_initiated) {
+ s64 adj = data - vcpu->arch.ia32_tsc_adjust_msr;
+ adjust_tsc_offset_guest(vcpu, adj);
++ /* Before back to guest, tsc_timestamp must be adjusted
++ * as well, otherwise guest's percpu pvclock time could jump.
++ */
++ kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
+ }
+ vcpu->arch.ia32_tsc_adjust_msr = data;
+ }
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index 81e85a8dd3005..4b25a1ad18ffd 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -1289,18 +1289,18 @@ int kern_addr_valid(unsigned long addr)
+ return 0;
+
+ p4d = p4d_offset(pgd, addr);
+- if (p4d_none(*p4d))
++ if (!p4d_present(*p4d))
+ return 0;
+
+ pud = pud_offset(p4d, addr);
+- if (pud_none(*pud))
++ if (!pud_present(*pud))
+ return 0;
+
+ if (pud_large(*pud))
+ return pfn_valid(pud_pfn(*pud));
+
+ pmd = pmd_offset(pud, addr);
+- if (pmd_none(*pmd))
++ if (!pmd_present(*pmd))
+ return 0;
+
+ if (pmd_large(*pmd))
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 924ca27a6139b..81c3d4b4c7e2c 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -731,6 +731,13 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ }
+ break;
+
++ /* speculation barrier */
++ case BPF_ST | BPF_NOSPEC:
++ if (boot_cpu_has(X86_FEATURE_XMM2))
++ /* Emit 'lfence' */
++ EMIT3(0x0F, 0xAE, 0xE8);
++ break;
++
+ /* ST: *(u8*)(dst_reg + off) = imm */
+ case BPF_ST | BPF_MEM | BPF_B:
+ if (is_ereg(dst_reg))
+diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
+index adee990abab14..f48300988bc2a 100644
+--- a/arch/x86/net/bpf_jit_comp32.c
++++ b/arch/x86/net/bpf_jit_comp32.c
+@@ -1683,6 +1683,12 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ i++;
+ break;
+ }
++ /* speculation barrier */
++ case BPF_ST | BPF_NOSPEC:
++ if (boot_cpu_has(X86_FEATURE_XMM2))
++ /* Emit 'lfence' */
++ EMIT3(0x0F, 0xAE, 0xE8);
++ break;
+ /* ST: *(u8*)(dst_reg + off) = imm */
+ case BPF_ST | BPF_MEM | BPF_H:
+ case BPF_ST | BPF_MEM | BPF_B:
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 1c3e9185934c4..7966136352b56 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -1187,6 +1187,11 @@ static void __init xen_dom0_set_legacy_features(void)
+ x86_platform.legacy.rtc = 1;
+ }
+
++static void __init xen_domu_set_legacy_features(void)
++{
++ x86_platform.legacy.rtc = 0;
++}
++
+ /* First C function to be called on Xen boot */
+ asmlinkage __visible void __init xen_start_kernel(void)
+ {
+@@ -1354,6 +1359,8 @@ asmlinkage __visible void __init xen_start_kernel(void)
+ add_preferred_console("xenboot", 0, NULL);
+ if (pci_xen)
+ x86_init.pci.arch_init = pci_xen_init;
++ x86_platform.set_legacy_features =
++ xen_domu_set_legacy_features;
+ } else {
+ const struct dom0_vga_console_info *info =
+ (void *)((char *)xen_start_info +
+diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
+index 82577eec6d0a7..f9b31eb6846c4 100644
+--- a/arch/x86/xen/p2m.c
++++ b/arch/x86/xen/p2m.c
+@@ -613,8 +613,8 @@ int xen_alloc_p2m_entry(unsigned long pfn)
+ }
+
+ /* Expanded the p2m? */
+- if (pfn > xen_p2m_last_pfn) {
+- xen_p2m_last_pfn = pfn;
++ if (pfn >= xen_p2m_last_pfn) {
++ xen_p2m_last_pfn = ALIGN(pfn + 1, P2M_PER_PAGE);
+ HYPERVISOR_shared_info->arch.max_pfn = xen_p2m_last_pfn;
+ }
+
+diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
+index b9ad83a0ee5db..d9b0709d6c9ce 100644
+--- a/arch/xtensa/Kconfig
++++ b/arch/xtensa/Kconfig
+@@ -25,7 +25,7 @@ config XTENSA
+ select HAVE_DMA_CONTIGUOUS
+ select HAVE_EXIT_THREAD
+ select HAVE_FUNCTION_TRACER
+- select HAVE_FUTEX_CMPXCHG if !MMU
++ select HAVE_FUTEX_CMPXCHG if !MMU && FUTEX
+ select HAVE_HW_BREAKPOINT if PERF_EVENTS
+ select HAVE_IRQ_TIME_ACCOUNTING
+ select HAVE_MEMBLOCK
+diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c
+index af81a62faba64..e7faea3d73d3b 100644
+--- a/arch/xtensa/platforms/iss/console.c
++++ b/arch/xtensa/platforms/iss/console.c
+@@ -168,9 +168,13 @@ static const struct tty_operations serial_ops = {
+
+ int __init rs_init(void)
+ {
+- tty_port_init(&serial_port);
++ int ret;
+
+ serial_driver = alloc_tty_driver(SERIAL_MAX_NUM_LINES);
++ if (!serial_driver)
++ return -ENOMEM;
++
++ tty_port_init(&serial_port);
+
+ pr_info("%s %s\n", serial_name, serial_version);
+
+@@ -190,8 +194,15 @@ int __init rs_init(void)
+ tty_set_operations(serial_driver, &serial_ops);
+ tty_port_link_device(&serial_port, serial_driver, 0);
+
+- if (tty_register_driver(serial_driver))
+- panic("Couldn't register serial driver\n");
++ ret = tty_register_driver(serial_driver);
++ if (ret) {
++ pr_err("Couldn't register serial driver\n");
++ tty_driver_kref_put(serial_driver);
++ tty_port_destroy(&serial_port);
++
++ return ret;
++ }
++
+ return 0;
+ }
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 5b3e5483c657c..c8c94e8e0f721 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2137,6 +2137,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
+ * are likely to increase the throughput.
+ */
+ bfqq->new_bfqq = new_bfqq;
++ /*
++ * The above assignment schedules the following redirections:
++ * each time some I/O for bfqq arrives, the process that
++ * generated that I/O is disassociated from bfqq and
++ * associated with new_bfqq. Here we increases new_bfqq->ref
++ * in advance, adding the number of processes that are
++ * expected to be associated with new_bfqq as they happen to
++ * issue I/O.
++ */
+ new_bfqq->ref += process_refs;
+ return new_bfqq;
+ }
+@@ -2196,6 +2205,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ {
+ struct bfq_queue *in_service_bfqq, *new_bfqq;
+
++ /* if a merge has already been setup, then proceed with that first */
++ if (bfqq->new_bfqq)
++ return bfqq->new_bfqq;
++
+ /*
+ * Prevent bfqq from being merged if it has been created too
+ * long ago. The idea is that true cooperating processes, and
+@@ -2210,9 +2223,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ if (bfq_too_late_for_merging(bfqq))
+ return NULL;
+
+- if (bfqq->new_bfqq)
+- return bfqq->new_bfqq;
+-
+ if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
+ return NULL;
+
+@@ -4241,7 +4251,7 @@ bfq_set_next_ioprio_data(struct bfq_queue *bfqq, struct bfq_io_cq *bic)
+ if (bfqq->new_ioprio >= IOPRIO_BE_NR) {
+ pr_crit("bfq_set_next_ioprio_data: new_ioprio %d\n",
+ bfqq->new_ioprio);
+- bfqq->new_ioprio = IOPRIO_BE_NR;
++ bfqq->new_ioprio = IOPRIO_BE_NR - 1;
+ }
+
+ bfqq->entity.new_weight = bfq_ioprio_to_weight(bfqq->new_ioprio);
+diff --git a/block/blk-zoned.c b/block/blk-zoned.c
+index c461cf63f1f40..d33e89d28dbeb 100644
+--- a/block/blk-zoned.c
++++ b/block/blk-zoned.c
+@@ -319,9 +319,6 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, fmode_t mode,
+ if (!blk_queue_is_zoned(q))
+ return -ENOTTY;
+
+- if (!capable(CAP_SYS_ADMIN))
+- return -EACCES;
+-
+ if (copy_from_user(&rep, argp, sizeof(struct blk_zone_report)))
+ return -EFAULT;
+
+@@ -380,9 +377,6 @@ int blkdev_reset_zones_ioctl(struct block_device *bdev, fmode_t mode,
+ if (!blk_queue_is_zoned(q))
+ return -ENOTTY;
+
+- if (!capable(CAP_SYS_ADMIN))
+- return -EACCES;
+-
+ if (!(mode & FMODE_WRITE))
+ return -EBADF;
+
+diff --git a/certs/Makefile b/certs/Makefile
+index 5d0999b9e21b1..ca3c71e3a3d9f 100644
+--- a/certs/Makefile
++++ b/certs/Makefile
+@@ -46,11 +46,19 @@ endif
+ redirect_openssl = 2>&1
+ quiet_redirect_openssl = 2>&1
+ silent_redirect_openssl = 2>/dev/null
++openssl_available = $(shell openssl help 2>/dev/null && echo yes)
+
+ # We do it this way rather than having a boolean option for enabling an
+ # external private key, because 'make randconfig' might enable such a
+ # boolean option and we unfortunately can't make it depend on !RANDCONFIG.
+ ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
++
++ifeq ($(openssl_available),yes)
++X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null)
++
++$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))
++endif
++
+ $(obj)/signing_key.pem: $(obj)/x509.genkey
+ @$(kecho) "###"
+ @$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index db1d86af21b4d..b95a4194a68db 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4574,6 +4574,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "Samsung SSD 860*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "Samsung SSD 870*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+
+@@ -6412,7 +6416,7 @@ int ata_host_start(struct ata_host *host)
+ have_stop = 1;
+ }
+
+- if (host->ops->host_stop)
++ if (host->ops && host->ops->host_stop)
+ have_stop = 1;
+
+ if (have_stop) {
+diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
+index 6f142aa54f5f9..8487048c5ec9b 100644
+--- a/drivers/ata/sata_dwc_460ex.c
++++ b/drivers/ata/sata_dwc_460ex.c
+@@ -1253,24 +1253,20 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ irq = irq_of_parse_and_map(np, 0);
+ if (irq == NO_IRQ) {
+ dev_err(&ofdev->dev, "no SATA DMA irq\n");
+- err = -ENODEV;
+- goto error_out;
++ return -ENODEV;
+ }
+
+ #ifdef CONFIG_SATA_DWC_OLD_DMA
+ if (!of_find_property(np, "dmas", NULL)) {
+ err = sata_dwc_dma_init_old(ofdev, hsdev);
+ if (err)
+- goto error_out;
++ return err;
+ }
+ #endif
+
+ hsdev->phy = devm_phy_optional_get(hsdev->dev, "sata-phy");
+- if (IS_ERR(hsdev->phy)) {
+- err = PTR_ERR(hsdev->phy);
+- hsdev->phy = NULL;
+- goto error_out;
+- }
++ if (IS_ERR(hsdev->phy))
++ return PTR_ERR(hsdev->phy);
+
+ err = phy_init(hsdev->phy);
+ if (err)
+diff --git a/drivers/base/power/trace.c b/drivers/base/power/trace.c
+index 1cda505d6a852..9664cce49109b 100644
+--- a/drivers/base/power/trace.c
++++ b/drivers/base/power/trace.c
+@@ -11,6 +11,7 @@
+ #include <linux/export.h>
+ #include <linux/rtc.h>
+ #include <linux/suspend.h>
++#include <linux/init.h>
+
+ #include <linux/mc146818rtc.h>
+
+@@ -165,6 +166,9 @@ void generate_pm_trace(const void *tracedata, unsigned int user)
+ const char *file = *(const char **)(tracedata + 2);
+ unsigned int user_hash_value, file_hash_value;
+
++ if (!x86_platform.legacy.rtc)
++ return;
++
+ user_hash_value = user % USERHASH;
+ file_hash_value = hash_string(lineno, file, FILEHASH);
+ set_magic_time(user_hash_value, file_hash_value, dev_hash_value);
+@@ -267,6 +271,9 @@ static struct notifier_block pm_trace_nb = {
+
+ static int early_resume_init(void)
+ {
++ if (!x86_platform.legacy.rtc)
++ return 0;
++
+ hash_value_early_read = read_magic_time();
+ register_pm_notifier(&pm_trace_nb);
+ return 0;
+@@ -277,6 +284,9 @@ static int late_resume_init(void)
+ unsigned int val = hash_value_early_read;
+ unsigned int user, file, dev;
+
++ if (!x86_platform.legacy.rtc)
++ return 0;
++
+ user = val % USERHASH;
+ val = val / USERHASH;
+ file = val % FILEHASH;
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index e8b3353c18eb8..330ab9c85d1b8 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1479,7 +1479,7 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg,
+ if (ret) {
+ dev_err(map->dev,
+ "Error in caching of register: %x ret: %d\n",
+- reg + i, ret);
++ reg + regmap_get_offset(map, i), ret);
+ return ret;
+ }
+ }
+diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
+index fc1f4acdd189e..c0f203deaf0b5 100644
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -236,6 +236,7 @@ EXPORT_SYMBOL(bcma_core_irq);
+
+ void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core)
+ {
++ device_initialize(&core->dev);
+ core->dev.release = bcma_release_core_dev;
+ core->dev.bus = &bcma_bus_type;
+ dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index);
+@@ -299,11 +300,10 @@ static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core)
+ {
+ int err;
+
+- err = device_register(&core->dev);
++ err = device_add(&core->dev);
+ if (err) {
+ bcma_err(bus, "Could not register dev for core 0x%03X\n",
+ core->id.id);
+- put_device(&core->dev);
+ return;
+ }
+ core->dev_registered = true;
+@@ -394,7 +394,7 @@ void bcma_unregister_cores(struct bcma_bus *bus)
+ /* Now noone uses internally-handled cores, we can free them */
+ list_for_each_entry_safe(core, tmp, &bus->cores, list) {
+ list_del(&core->list);
+- kfree(core);
++ put_device(&core->dev);
+ }
+ }
+
+diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
+index e101f286ac353..60662771bd465 100644
+--- a/drivers/block/Kconfig
++++ b/drivers/block/Kconfig
+@@ -242,7 +242,7 @@ config BLK_DEV_LOOP_MIN_COUNT
+ dynamically allocated with the /dev/loop-control interface.
+
+ config BLK_DEV_CRYPTOLOOP
+- tristate "Cryptoloop Support"
++ tristate "Cryptoloop Support (DEPRECATED)"
+ select CRYPTO
+ select CRYPTO_CBC
+ depends on BLK_DEV_LOOP
+@@ -254,7 +254,7 @@ config BLK_DEV_CRYPTOLOOP
+ WARNING: This device is not safe for journaled file systems like
+ ext3 or Reiserfs. Please use the Device Mapper crypto module
+ instead, which can be configured to be on-disk compatible with the
+- cryptoloop device.
++ cryptoloop device. cryptoloop support will be removed in Linux 5.16.
+
+ source "drivers/block/drbd/Kconfig"
+
+diff --git a/drivers/block/cryptoloop.c b/drivers/block/cryptoloop.c
+index 7033a4beda669..1b84105dfe62d 100644
+--- a/drivers/block/cryptoloop.c
++++ b/drivers/block/cryptoloop.c
+@@ -201,6 +201,8 @@ init_cryptoloop(void)
+
+ if (rc)
+ printk(KERN_ERR "cryptoloop: loop_register_transfer failed\n");
++ else
++ pr_warn("the cryptoloop driver has been deprecated and will be removed in in Linux 5.16\n");
+ return rc;
+ }
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 3806fd8fef0b1..a9490c8e82a70 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -46,11 +46,6 @@ static struct hlist_head *all_lists[] = {
+ NULL,
+ };
+
+-static struct hlist_head *orphan_list[] = {
+- &clk_orphan_list,
+- NULL,
+-};
+-
+ /*** private data structures ***/
+
+ struct clk_core {
+@@ -2629,6 +2624,11 @@ static int inited = 0;
+ static DEFINE_MUTEX(clk_debug_lock);
+ static HLIST_HEAD(clk_debug_list);
+
++static struct hlist_head *orphan_list[] = {
++ &clk_orphan_list,
++ NULL,
++};
++
+ static void clk_summary_show_one(struct seq_file *s, struct clk_core *c,
+ int level)
+ {
+diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
+index 890ebf623261b..38612cd9092eb 100644
+--- a/drivers/clk/mvebu/kirkwood.c
++++ b/drivers/clk/mvebu/kirkwood.c
+@@ -254,6 +254,7 @@ static const char *powersave_parents[] = {
+ static const struct clk_muxing_soc_desc kirkwood_mux_desc[] __initconst = {
+ { "powersave", powersave_parents, ARRAY_SIZE(powersave_parents),
+ 11, 1, 0 },
++ { }
+ };
+
+ static struct clk *clk_muxing_get_src(
+diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
+index cec90a4c79b34..7a6d4c4c0feba 100644
+--- a/drivers/clocksource/sh_cmt.c
++++ b/drivers/clocksource/sh_cmt.c
+@@ -576,7 +576,8 @@ static int sh_cmt_start(struct sh_cmt_channel *ch, unsigned long flag)
+ ch->flags |= flag;
+
+ /* setup timeout if no clockevent */
+- if ((flag == FLAG_CLOCKSOURCE) && (!(ch->flags & FLAG_CLOCKEVENT)))
++ if (ch->cmt->num_channels == 1 &&
++ flag == FLAG_CLOCKSOURCE && (!(ch->flags & FLAG_CLOCKEVENT)))
+ __sh_cmt_set_next(ch, ch->max_match_value);
+ out:
+ raw_spin_unlock_irqrestore(&ch->lock, flags);
+@@ -612,20 +613,25 @@ static struct sh_cmt_channel *cs_to_sh_cmt(struct clocksource *cs)
+ static u64 sh_cmt_clocksource_read(struct clocksource *cs)
+ {
+ struct sh_cmt_channel *ch = cs_to_sh_cmt(cs);
+- unsigned long flags;
+ u32 has_wrapped;
+- u64 value;
+- u32 raw;
+
+- raw_spin_lock_irqsave(&ch->lock, flags);
+- value = ch->total_cycles;
+- raw = sh_cmt_get_counter(ch, &has_wrapped);
++ if (ch->cmt->num_channels == 1) {
++ unsigned long flags;
++ u64 value;
++ u32 raw;
+
+- if (unlikely(has_wrapped))
+- raw += ch->match_value + 1;
+- raw_spin_unlock_irqrestore(&ch->lock, flags);
++ raw_spin_lock_irqsave(&ch->lock, flags);
++ value = ch->total_cycles;
++ raw = sh_cmt_get_counter(ch, &has_wrapped);
++
++ if (unlikely(has_wrapped))
++ raw += ch->match_value + 1;
++ raw_spin_unlock_irqrestore(&ch->lock, flags);
++
++ return value + raw;
++ }
+
+- return value + raw;
++ return sh_cmt_get_counter(ch, &has_wrapped);
+ }
+
+ static int sh_cmt_clocksource_enable(struct clocksource *cs)
+@@ -688,7 +694,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_channel *ch,
+ cs->disable = sh_cmt_clocksource_disable;
+ cs->suspend = sh_cmt_clocksource_suspend;
+ cs->resume = sh_cmt_clocksource_resume;
+- cs->mask = CLOCKSOURCE_MASK(sizeof(u64) * 8);
++ cs->mask = CLOCKSOURCE_MASK(ch->cmt->info->width);
+ cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
+
+ dev_info(&ch->cmt->pdev->dev, "ch%u: used as clock source\n",
+diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
+index 5da985604692f..3ebadabf54110 100644
+--- a/drivers/cpufreq/powernv-cpufreq.c
++++ b/drivers/cpufreq/powernv-cpufreq.c
+@@ -46,6 +46,7 @@
+ #define MAX_PSTATE_SHIFT 32
+ #define LPSTATE_SHIFT 48
+ #define GPSTATE_SHIFT 56
++#define MAX_NR_CHIPS 32
+
+ #define MAX_RAMP_DOWN_TIME 5120
+ /*
+@@ -1051,12 +1052,20 @@ static int init_chip_info(void)
+ unsigned int *chip;
+ unsigned int cpu, i;
+ unsigned int prev_chip_id = UINT_MAX;
++ cpumask_t *chip_cpu_mask;
+ int ret = 0;
+
+ chip = kcalloc(num_possible_cpus(), sizeof(*chip), GFP_KERNEL);
+ if (!chip)
+ return -ENOMEM;
+
++ /* Allocate a chip cpu mask large enough to fit mask for all chips */
++ chip_cpu_mask = kcalloc(MAX_NR_CHIPS, sizeof(cpumask_t), GFP_KERNEL);
++ if (!chip_cpu_mask) {
++ ret = -ENOMEM;
++ goto free_and_return;
++ }
++
+ for_each_possible_cpu(cpu) {
+ unsigned int id = cpu_to_chip_id(cpu);
+
+@@ -1064,22 +1073,25 @@ static int init_chip_info(void)
+ prev_chip_id = id;
+ chip[nr_chips++] = id;
+ }
++ cpumask_set_cpu(cpu, &chip_cpu_mask[nr_chips-1]);
+ }
+
+ chips = kcalloc(nr_chips, sizeof(struct chip), GFP_KERNEL);
+ if (!chips) {
+ ret = -ENOMEM;
+- goto free_and_return;
++ goto out_free_chip_cpu_mask;
+ }
+
+ for (i = 0; i < nr_chips; i++) {
+ chips[i].id = chip[i];
+- cpumask_copy(&chips[i].mask, cpumask_of_node(chip[i]));
++ cpumask_copy(&chips[i].mask, &chip_cpu_mask[i]);
+ INIT_WORK(&chips[i].throttle, powernv_cpufreq_work_fn);
+ for_each_cpu(cpu, &chips[i].mask)
+ per_cpu(chip_info, cpu) = &chips[i];
+ }
+
++out_free_chip_cpu_mask:
++ kfree(chip_cpu_mask);
+ free_and_return:
+ kfree(chip);
+ return ret;
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index b0c592073a4a3..da834ae3586b6 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -167,15 +167,19 @@ static struct dcp *global_sdcp;
+
+ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx)
+ {
++ int dma_err;
+ struct dcp *sdcp = global_sdcp;
+ const int chan = actx->chan;
+ uint32_t stat;
+ unsigned long ret;
+ struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];
+-
+ dma_addr_t desc_phys = dma_map_single(sdcp->dev, desc, sizeof(*desc),
+ DMA_TO_DEVICE);
+
++ dma_err = dma_mapping_error(sdcp->dev, desc_phys);
++ if (dma_err)
++ return dma_err;
++
+ reinit_completion(&sdcp->completion[chan]);
+
+ /* Clear status register. */
+@@ -213,18 +217,29 @@ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx)
+ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
+ struct ablkcipher_request *req, int init)
+ {
++ dma_addr_t key_phys, src_phys, dst_phys;
+ struct dcp *sdcp = global_sdcp;
+ struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];
+ struct dcp_aes_req_ctx *rctx = ablkcipher_request_ctx(req);
+ int ret;
+
+- dma_addr_t key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key,
+- 2 * AES_KEYSIZE_128,
+- DMA_TO_DEVICE);
+- dma_addr_t src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf,
+- DCP_BUF_SZ, DMA_TO_DEVICE);
+- dma_addr_t dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf,
+- DCP_BUF_SZ, DMA_FROM_DEVICE);
++ key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key,
++ 2 * AES_KEYSIZE_128, DMA_TO_DEVICE);
++ ret = dma_mapping_error(sdcp->dev, key_phys);
++ if (ret)
++ return ret;
++
++ src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf,
++ DCP_BUF_SZ, DMA_TO_DEVICE);
++ ret = dma_mapping_error(sdcp->dev, src_phys);
++ if (ret)
++ goto err_src;
++
++ dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf,
++ DCP_BUF_SZ, DMA_FROM_DEVICE);
++ ret = dma_mapping_error(sdcp->dev, dst_phys);
++ if (ret)
++ goto err_dst;
+
+ if (actx->fill % AES_BLOCK_SIZE) {
+ dev_err(sdcp->dev, "Invalid block size!\n");
+@@ -262,10 +277,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
+ ret = mxs_dcp_start_dma(actx);
+
+ aes_done_run:
++ dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE);
++err_dst:
++ dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
++err_src:
+ dma_unmap_single(sdcp->dev, key_phys, 2 * AES_KEYSIZE_128,
+ DMA_TO_DEVICE);
+- dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
+- dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE);
+
+ return ret;
+ }
+@@ -280,21 +297,20 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+
+ struct scatterlist *dst = req->dst;
+ struct scatterlist *src = req->src;
+- const int nents = sg_nents(req->src);
++ int dst_nents = sg_nents(dst);
+
+ const int out_off = DCP_BUF_SZ;
+ uint8_t *in_buf = sdcp->coh->aes_in_buf;
+ uint8_t *out_buf = sdcp->coh->aes_out_buf;
+
+- uint8_t *out_tmp, *src_buf, *dst_buf = NULL;
+ uint32_t dst_off = 0;
++ uint8_t *src_buf = NULL;
+ uint32_t last_out_len = 0;
+
+ uint8_t *key = sdcp->coh->aes_key;
+
+ int ret = 0;
+- int split = 0;
+- unsigned int i, len, clen, rem = 0, tlen = 0;
++ unsigned int i, len, clen, tlen = 0;
+ int init = 0;
+ bool limit_hit = false;
+
+@@ -312,7 +328,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128);
+ }
+
+- for_each_sg(req->src, src, nents, i) {
++ for_each_sg(req->src, src, sg_nents(src), i) {
+ src_buf = sg_virt(src);
+ len = sg_dma_len(src);
+ tlen += len;
+@@ -337,34 +353,17 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ * submit the buffer.
+ */
+ if (actx->fill == out_off || sg_is_last(src) ||
+- limit_hit) {
++ limit_hit) {
+ ret = mxs_dcp_run_aes(actx, req, init);
+ if (ret)
+ return ret;
+ init = 0;
+
+- out_tmp = out_buf;
++ sg_pcopy_from_buffer(dst, dst_nents, out_buf,
++ actx->fill, dst_off);
++ dst_off += actx->fill;
+ last_out_len = actx->fill;
+- while (dst && actx->fill) {
+- if (!split) {
+- dst_buf = sg_virt(dst);
+- dst_off = 0;
+- }
+- rem = min(sg_dma_len(dst) - dst_off,
+- actx->fill);
+-
+- memcpy(dst_buf + dst_off, out_tmp, rem);
+- out_tmp += rem;
+- dst_off += rem;
+- actx->fill -= rem;
+-
+- if (dst_off == sg_dma_len(dst)) {
+- dst = sg_next(dst);
+- split = 0;
+- } else {
+- split = 1;
+- }
+- }
++ actx->fill = 0;
+ }
+ } while (len);
+
+@@ -565,6 +564,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
+ dma_addr_t buf_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_in_buf,
+ DCP_BUF_SZ, DMA_TO_DEVICE);
+
++ ret = dma_mapping_error(sdcp->dev, buf_phys);
++ if (ret)
++ return ret;
++
+ /* Fill in the DMA descriptor. */
+ desc->control0 = MXS_DCP_CONTROL0_DECR_SEMAPHORE |
+ MXS_DCP_CONTROL0_INTERRUPT |
+@@ -597,6 +600,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
+ if (rctx->fini) {
+ digest_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_out_buf,
+ DCP_SHA_PAY_SZ, DMA_FROM_DEVICE);
++ ret = dma_mapping_error(sdcp->dev, digest_phys);
++ if (ret)
++ goto done_run;
++
+ desc->control0 |= MXS_DCP_CONTROL0_HASH_TERM;
+ desc->payload = digest_phys;
+ }
+diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
+index 4d31ef4724366..180f2f61b8fbc 100644
+--- a/drivers/crypto/omap-sham.c
++++ b/drivers/crypto/omap-sham.c
+@@ -1739,7 +1739,7 @@ static void omap_sham_done_task(unsigned long data)
+ if (test_and_clear_bit(FLAGS_OUTPUT_READY, &dd->flags))
+ goto finish;
+ } else if (test_bit(FLAGS_DMA_READY, &dd->flags)) {
+- if (test_and_clear_bit(FLAGS_DMA_ACTIVE, &dd->flags)) {
++ if (test_bit(FLAGS_DMA_ACTIVE, &dd->flags)) {
+ omap_sham_update_dma_stop(dd);
+ if (dd->err) {
+ err = dd->err;
+diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
+index d2d0ae445fd89..7c7d49a8a4034 100644
+--- a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
+@@ -123,10 +123,10 @@ void adf_init_hw_data_c3xxxiov(struct adf_hw_device_data *hw_data)
+ hw_data->enable_error_correction = adf_vf_void_noop;
+ hw_data->init_admin_comms = adf_vf_int_noop;
+ hw_data->exit_admin_comms = adf_vf_void_noop;
+- hw_data->send_admin_init = adf_vf2pf_init;
++ hw_data->send_admin_init = adf_vf2pf_notify_init;
+ hw_data->init_arb = adf_vf_int_noop;
+ hw_data->exit_arb = adf_vf_void_noop;
+- hw_data->disable_iov = adf_vf2pf_shutdown;
++ hw_data->disable_iov = adf_vf2pf_notify_shutdown;
+ hw_data->get_accel_mask = get_accel_mask;
+ hw_data->get_ae_mask = get_ae_mask;
+ hw_data->get_num_accels = get_num_accels;
+diff --git a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
+index 38e4bc04f407b..90e8a7564756b 100644
+--- a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
++++ b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
+@@ -123,10 +123,10 @@ void adf_init_hw_data_c62xiov(struct adf_hw_device_data *hw_data)
+ hw_data->enable_error_correction = adf_vf_void_noop;
+ hw_data->init_admin_comms = adf_vf_int_noop;
+ hw_data->exit_admin_comms = adf_vf_void_noop;
+- hw_data->send_admin_init = adf_vf2pf_init;
++ hw_data->send_admin_init = adf_vf2pf_notify_init;
+ hw_data->init_arb = adf_vf_int_noop;
+ hw_data->exit_arb = adf_vf_void_noop;
+- hw_data->disable_iov = adf_vf2pf_shutdown;
++ hw_data->disable_iov = adf_vf2pf_notify_shutdown;
+ hw_data->get_accel_mask = get_accel_mask;
+ hw_data->get_ae_mask = get_ae_mask;
+ hw_data->get_num_accels = get_num_accels;
+diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h
+index d78f8d5c89c3f..289dd7e48d4a4 100644
+--- a/drivers/crypto/qat/qat_common/adf_common_drv.h
++++ b/drivers/crypto/qat/qat_common/adf_common_drv.h
+@@ -239,8 +239,8 @@ void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev,
+ void adf_enable_pf2vf_interrupts(struct adf_accel_dev *accel_dev);
+ void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev);
+
+-int adf_vf2pf_init(struct adf_accel_dev *accel_dev);
+-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev);
++int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev);
++void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev);
+ int adf_init_pf_wq(void);
+ void adf_exit_pf_wq(void);
+ int adf_init_vf_wq(void);
+@@ -263,12 +263,12 @@ static inline void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev)
+ {
+ }
+
+-static inline int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
++static inline int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev)
+ {
+ return 0;
+ }
+
+-static inline void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
++static inline void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev)
+ {
+ }
+
+diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c
+index 26556c7130497..7a7d43c475342 100644
+--- a/drivers/crypto/qat/qat_common/adf_init.c
++++ b/drivers/crypto/qat/qat_common/adf_init.c
+@@ -105,6 +105,7 @@ int adf_dev_init(struct adf_accel_dev *accel_dev)
+ struct service_hndl *service;
+ struct list_head *list_itr;
+ struct adf_hw_device_data *hw_data = accel_dev->hw_device;
++ int ret;
+
+ if (!hw_data) {
+ dev_err(&GET_DEV(accel_dev),
+@@ -171,9 +172,9 @@ int adf_dev_init(struct adf_accel_dev *accel_dev)
+ }
+
+ hw_data->enable_error_correction(accel_dev);
+- hw_data->enable_vf2pf_comms(accel_dev);
++ ret = hw_data->enable_vf2pf_comms(accel_dev);
+
+- return 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(adf_dev_init);
+
+diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c
+index 4898ef41fd9fd..7d319c5c071c4 100644
+--- a/drivers/crypto/qat/qat_common/adf_isr.c
++++ b/drivers/crypto/qat/qat_common/adf_isr.c
+@@ -59,6 +59,8 @@
+ #include "adf_transport_access_macros.h"
+ #include "adf_transport_internal.h"
+
++#define ADF_MAX_NUM_VFS 32
++
+ static int adf_enable_msix(struct adf_accel_dev *accel_dev)
+ {
+ struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev;
+@@ -111,7 +113,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)
+ struct adf_bar *pmisc =
+ &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)];
+ void __iomem *pmisc_bar_addr = pmisc->virt_addr;
+- u32 vf_mask;
++ unsigned long vf_mask;
+
+ /* Get the interrupt sources triggered by VFs */
+ vf_mask = ((ADF_CSR_RD(pmisc_bar_addr, ADF_ERRSOU5) &
+@@ -132,8 +134,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)
+ * unless the VF is malicious and is attempting to
+ * flood the host OS with VF2PF interrupts.
+ */
+- for_each_set_bit(i, (const unsigned long *)&vf_mask,
+- (sizeof(vf_mask) * BITS_PER_BYTE)) {
++ for_each_set_bit(i, &vf_mask, ADF_MAX_NUM_VFS) {
+ vf_info = accel_dev->pf.vf_info + i;
+
+ if (!__ratelimit(&vf_info->vf2pf_ratelimit)) {
+diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+index b3875fdf6cd72..c64481160b711 100644
+--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
++++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+@@ -231,7 +231,6 @@ int adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
+
+ return ret;
+ }
+-EXPORT_SYMBOL_GPL(adf_iov_putmsg);
+
+ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)
+ {
+@@ -361,6 +360,8 @@ static int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev)
+ msg |= ADF_PFVF_COMPATIBILITY_VERSION << ADF_VF2PF_COMPAT_VER_REQ_SHIFT;
+ BUILD_BUG_ON(ADF_PFVF_COMPATIBILITY_VERSION > 255);
+
++ reinit_completion(&accel_dev->vf.iov_msg_completion);
++
+ /* Send request from VF to PF */
+ ret = adf_iov_putmsg(accel_dev, msg, 0);
+ if (ret) {
+diff --git a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
+index cd5f37dffe8a6..1830194567e84 100644
+--- a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
++++ b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
+@@ -49,14 +49,14 @@
+ #include "adf_pf2vf_msg.h"
+
+ /**
+- * adf_vf2pf_init() - send init msg to PF
++ * adf_vf2pf_notify_init() - send init msg to PF
+ * @accel_dev: Pointer to acceleration VF device.
+ *
+ * Function sends an init messge from the VF to a PF
+ *
+ * Return: 0 on success, error code otherwise.
+ */
+-int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
++int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev)
+ {
+ u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM |
+ (ADF_VF2PF_MSGTYPE_INIT << ADF_VF2PF_MSGTYPE_SHIFT));
+@@ -69,17 +69,17 @@ int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
+ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(adf_vf2pf_init);
++EXPORT_SYMBOL_GPL(adf_vf2pf_notify_init);
+
+ /**
+- * adf_vf2pf_shutdown() - send shutdown msg to PF
++ * adf_vf2pf_notify_shutdown() - send shutdown msg to PF
+ * @accel_dev: Pointer to acceleration VF device.
+ *
+ * Function sends a shutdown messge from the VF to a PF
+ *
+ * Return: void
+ */
+-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
++void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev)
+ {
+ u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM |
+ (ADF_VF2PF_MSGTYPE_SHUTDOWN << ADF_VF2PF_MSGTYPE_SHIFT));
+@@ -89,4 +89,4 @@ void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
+ dev_err(&GET_DEV(accel_dev),
+ "Failed to send Shutdown event to PF\n");
+ }
+-EXPORT_SYMBOL_GPL(adf_vf2pf_shutdown);
++EXPORT_SYMBOL_GPL(adf_vf2pf_notify_shutdown);
+diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+index df9a1f35b8320..ef90902c8200d 100644
+--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
++++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+@@ -203,6 +203,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)
+ struct adf_bar *pmisc =
+ &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)];
+ void __iomem *pmisc_bar_addr = pmisc->virt_addr;
++ bool handled = false;
+ u32 v_int;
+
+ /* Read VF INT source CSR to determine the source of VF interrupt */
+@@ -215,7 +216,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)
+
+ /* Schedule tasklet to handle interrupt BH */
+ tasklet_hi_schedule(&accel_dev->vf.pf2vf_bh_tasklet);
+- return IRQ_HANDLED;
++ handled = true;
+ }
+
+ /* Check bundle interrupt */
+@@ -227,10 +228,10 @@ static irqreturn_t adf_isr(int irq, void *privdata)
+ WRITE_CSR_INT_FLAG_AND_COL(bank->csr_addr, bank->bank_number,
+ 0);
+ tasklet_hi_schedule(&bank->resp_handler);
+- return IRQ_HANDLED;
++ handled = true;
+ }
+
+- return IRQ_NONE;
++ return handled ? IRQ_HANDLED : IRQ_NONE;
+ }
+
+ static int adf_request_msi_irq(struct adf_accel_dev *accel_dev)
+diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
+index a3b4dd8099a7b..3a8361c83f0b1 100644
+--- a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
+@@ -123,10 +123,10 @@ void adf_init_hw_data_dh895xcciov(struct adf_hw_device_data *hw_data)
+ hw_data->enable_error_correction = adf_vf_void_noop;
+ hw_data->init_admin_comms = adf_vf_int_noop;
+ hw_data->exit_admin_comms = adf_vf_void_noop;
+- hw_data->send_admin_init = adf_vf2pf_init;
++ hw_data->send_admin_init = adf_vf2pf_notify_init;
+ hw_data->init_arb = adf_vf_int_noop;
+ hw_data->exit_arb = adf_vf_void_noop;
+- hw_data->disable_iov = adf_vf2pf_shutdown;
++ hw_data->disable_iov = adf_vf2pf_notify_shutdown;
+ hw_data->get_accel_mask = get_accel_mask;
+ hw_data->get_ae_mask = get_ae_mask;
+ hw_data->get_num_accels = get_num_accels;
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 7a55baa861e58..07e1a286ee431 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -853,7 +853,11 @@ static void talitos_unregister_rng(struct device *dev)
+ * HMAC_SNOOP_NO_AFEA (HSNA) instead of type IPSEC_ESP
+ */
+ #define TALITOS_CRA_PRIORITY_AEAD_HSNA (TALITOS_CRA_PRIORITY - 1)
++#ifdef CONFIG_CRYPTO_DEV_TALITOS_SEC2
+ #define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA512_BLOCK_SIZE)
++#else
++#define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA256_BLOCK_SIZE)
++#endif
+ #define TALITOS_MAX_IV_LENGTH 16 /* max of AES_BLOCK_SIZE, DES3_EDE_BLOCK_SIZE */
+
+ struct talitos_ctx {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
+index f2739995c335a..199eccee0b0bb 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
+@@ -338,7 +338,7 @@ static void amdgpu_i2c_put_byte(struct amdgpu_i2c_chan *i2c_bus,
+ void
+ amdgpu_i2c_router_select_ddc_port(const struct amdgpu_connector *amdgpu_connector)
+ {
+- u8 val;
++ u8 val = 0;
+
+ if (!amdgpu_connector->router.ddc_valid)
+ return;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+index b14ce112703f0..e25952d516e22 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+@@ -216,7 +216,7 @@ void amdgpu_bo_placement_from_domain(struct amdgpu_bo *abo, u32 domain)
+ c++;
+ }
+
+- BUG_ON(c >= AMDGPU_BO_MAX_PLACEMENTS);
++ BUG_ON(c > AMDGPU_BO_MAX_PLACEMENTS);
+
+ placement->num_placement = c;
+ placement->placement = places;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+index 0d9e410ca01e2..dbfe5623997d4 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+@@ -92,29 +92,29 @@ static ssize_t dp_link_settings_read(struct file *f, char __user *buf,
+
+ rd_buf_ptr = rd_buf;
+
+- str_len = strlen("Current: %d %d %d ");
+- snprintf(rd_buf_ptr, str_len, "Current: %d %d %d ",
++ str_len = strlen("Current: %d 0x%x %d ");
++ snprintf(rd_buf_ptr, str_len, "Current: %d 0x%x %d ",
+ link->cur_link_settings.lane_count,
+ link->cur_link_settings.link_rate,
+ link->cur_link_settings.link_spread);
+ rd_buf_ptr += str_len;
+
+- str_len = strlen("Verified: %d %d %d ");
+- snprintf(rd_buf_ptr, str_len, "Verified: %d %d %d ",
++ str_len = strlen("Verified: %d 0x%x %d ");
++ snprintf(rd_buf_ptr, str_len, "Verified: %d 0x%x %d ",
+ link->verified_link_cap.lane_count,
+ link->verified_link_cap.link_rate,
+ link->verified_link_cap.link_spread);
+ rd_buf_ptr += str_len;
+
+- str_len = strlen("Reported: %d %d %d ");
+- snprintf(rd_buf_ptr, str_len, "Reported: %d %d %d ",
++ str_len = strlen("Reported: %d 0x%x %d ");
++ snprintf(rd_buf_ptr, str_len, "Reported: %d 0x%x %d ",
+ link->reported_link_cap.lane_count,
+ link->reported_link_cap.link_rate,
+ link->reported_link_cap.link_spread);
+ rd_buf_ptr += str_len;
+
+- str_len = strlen("Preferred: %d %d %d ");
+- snprintf(rd_buf_ptr, str_len, "Preferred: %d %d %d\n",
++ str_len = strlen("Preferred: %d 0x%x %d ");
++ snprintf(rd_buf_ptr, str_len, "Preferred: %d 0x%x %d\n",
+ link->preferred_link_setting.lane_count,
+ link->preferred_link_setting.link_rate,
+ link->preferred_link_setting.link_spread);
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+index 79bafea663542..a40ea5c685728 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+@@ -296,10 +296,12 @@ static void dpu_hw_ctl_clear_all_blendstages(struct dpu_hw_ctl *ctx)
+ int i;
+
+ for (i = 0; i < ctx->mixer_count; i++) {
+- DPU_REG_WRITE(c, CTL_LAYER(LM_0 + i), 0);
+- DPU_REG_WRITE(c, CTL_LAYER_EXT(LM_0 + i), 0);
+- DPU_REG_WRITE(c, CTL_LAYER_EXT2(LM_0 + i), 0);
+- DPU_REG_WRITE(c, CTL_LAYER_EXT3(LM_0 + i), 0);
++ enum dpu_lm mixer_id = ctx->mixer_hw_caps[i].id;
++
++ DPU_REG_WRITE(c, CTL_LAYER(mixer_id), 0);
++ DPU_REG_WRITE(c, CTL_LAYER_EXT(mixer_id), 0);
++ DPU_REG_WRITE(c, CTL_LAYER_EXT2(mixer_id), 0);
++ DPU_REG_WRITE(c, CTL_LAYER_EXT3(mixer_id), 0);
+ }
+ }
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c
+index ff8164cc6738d..822cef472a7e9 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi.c
++++ b/drivers/gpu/drm/msm/dsi/dsi.c
+@@ -34,8 +34,10 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi)
+ }
+
+ phy_pdev = of_find_device_by_node(phy_node);
+- if (phy_pdev)
++ if (phy_pdev) {
+ msm_dsi->phy = platform_get_drvdata(phy_pdev);
++ msm_dsi->phy_dev = &phy_pdev->dev;
++ }
+
+ of_node_put(phy_node);
+
+@@ -44,8 +46,6 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi)
+ return -EPROBE_DEFER;
+ }
+
+- msm_dsi->phy_dev = get_device(&phy_pdev->dev);
+-
+ return 0;
+ }
+
+diff --git a/drivers/gpu/ipu-v3/ipu-cpmem.c b/drivers/gpu/ipu-v3/ipu-cpmem.c
+index a9d2501500a19..170371770dd41 100644
+--- a/drivers/gpu/ipu-v3/ipu-cpmem.c
++++ b/drivers/gpu/ipu-v3/ipu-cpmem.c
+@@ -545,21 +545,21 @@ static const struct ipu_rgb def_bgra_16 = {
+ .bits_per_pixel = 16,
+ };
+
+-#define Y_OFFSET(pix, x, y) ((x) + pix->width * (y))
+-#define U_OFFSET(pix, x, y) ((pix->width * pix->height) + \
+- (pix->width * ((y) / 2) / 2) + (x) / 2)
+-#define V_OFFSET(pix, x, y) ((pix->width * pix->height) + \
+- (pix->width * pix->height / 4) + \
+- (pix->width * ((y) / 2) / 2) + (x) / 2)
+-#define U2_OFFSET(pix, x, y) ((pix->width * pix->height) + \
+- (pix->width * (y) / 2) + (x) / 2)
+-#define V2_OFFSET(pix, x, y) ((pix->width * pix->height) + \
+- (pix->width * pix->height / 2) + \
+- (pix->width * (y) / 2) + (x) / 2)
+-#define UV_OFFSET(pix, x, y) ((pix->width * pix->height) + \
+- (pix->width * ((y) / 2)) + (x))
+-#define UV2_OFFSET(pix, x, y) ((pix->width * pix->height) + \
+- (pix->width * y) + (x))
++#define Y_OFFSET(pix, x, y) ((x) + pix->bytesperline * (y))
++#define U_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
++ (pix->bytesperline * ((y) / 2) / 2) + (x) / 2)
++#define V_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
++ (pix->bytesperline * pix->height / 4) + \
++ (pix->bytesperline * ((y) / 2) / 2) + (x) / 2)
++#define U2_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
++ (pix->bytesperline * (y) / 2) + (x) / 2)
++#define V2_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
++ (pix->bytesperline * pix->height / 2) + \
++ (pix->bytesperline * (y) / 2) + (x) / 2)
++#define UV_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
++ (pix->bytesperline * ((y) / 2)) + (x))
++#define UV2_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \
++ (pix->bytesperline * y) + (x))
+
+ #define NUM_ALPHA_CHANNELS 7
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 4dd151b2924e2..d56ef395eb693 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -427,8 +427,6 @@ static int hidinput_get_battery_property(struct power_supply *psy,
+
+ if (dev->battery_status == HID_BATTERY_UNKNOWN)
+ val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
+- else if (dev->battery_capacity == 100)
+- val->intval = POWER_SUPPLY_STATUS_FULL;
+ else
+ val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
+ break;
+diff --git a/drivers/i2c/busses/i2c-highlander.c b/drivers/i2c/busses/i2c-highlander.c
+index ff340d7ae2e52..6a880c2623808 100644
+--- a/drivers/i2c/busses/i2c-highlander.c
++++ b/drivers/i2c/busses/i2c-highlander.c
+@@ -379,7 +379,7 @@ static int highlander_i2c_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, dev);
+
+ dev->irq = platform_get_irq(pdev, 0);
+- if (iic_force_poll)
++ if (dev->irq < 0 || iic_force_poll)
+ dev->irq = 0;
+
+ if (dev->irq) {
+diff --git a/drivers/i2c/busses/i2c-iop3xx.c b/drivers/i2c/busses/i2c-iop3xx.c
+index 85cbe4b555786..d4fe7ccccb226 100644
+--- a/drivers/i2c/busses/i2c-iop3xx.c
++++ b/drivers/i2c/busses/i2c-iop3xx.c
+@@ -456,16 +456,14 @@ iop3xx_i2c_probe(struct platform_device *pdev)
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0) {
+- ret = -ENXIO;
++ ret = irq;
+ goto unmap;
+ }
+ ret = request_irq(irq, iop3xx_i2c_irq_handler, 0,
+ pdev->name, adapter_data);
+
+- if (ret) {
+- ret = -EIO;
++ if (ret)
+ goto unmap;
+- }
+
+ memcpy(new_adapter->name, pdev->name, strlen(pdev->name));
+ new_adapter->owner = THIS_MODULE;
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index 2bb4d20ead32b..e09b065a6aff0 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -804,7 +804,7 @@ static int mtk_i2c_probe(struct platform_device *pdev)
+ return PTR_ERR(i2c->pdmabase);
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq <= 0)
++ if (irq < 0)
+ return irq;
+
+ init_completion(&i2c->msg_complete);
+diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
+index d3603e261a847..4c60369203882 100644
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -1179,7 +1179,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
+ */
+ if (!(i2c->quirks & QUIRK_POLL)) {
+ i2c->irq = ret = platform_get_irq(pdev, 0);
+- if (ret <= 0) {
++ if (ret < 0) {
+ dev_err(&pdev->dev, "cannot find IRQ\n");
+ clk_unprepare(i2c->clk);
+ return ret;
+diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
+index 13fdb4dfe3562..cc3a24c43e574 100644
+--- a/drivers/iio/dac/ad5624r_spi.c
++++ b/drivers/iio/dac/ad5624r_spi.c
+@@ -230,7 +230,7 @@ static int ad5624r_probe(struct spi_device *spi)
+ if (!indio_dev)
+ return -ENOMEM;
+ st = iio_priv(indio_dev);
+- st->reg = devm_regulator_get(&spi->dev, "vcc");
++ st->reg = devm_regulator_get_optional(&spi->dev, "vref");
+ if (!IS_ERR(st->reg)) {
+ ret = regulator_enable(st->reg);
+ if (ret)
+@@ -241,6 +241,22 @@ static int ad5624r_probe(struct spi_device *spi)
+ goto error_disable_reg;
+
+ voltage_uv = ret;
++ } else {
++ if (PTR_ERR(st->reg) != -ENODEV)
++ return PTR_ERR(st->reg);
++ /* Backwards compatibility. This naming is not correct */
++ st->reg = devm_regulator_get_optional(&spi->dev, "vcc");
++ if (!IS_ERR(st->reg)) {
++ ret = regulator_enable(st->reg);
++ if (ret)
++ return ret;
++
++ ret = regulator_get_voltage(st->reg);
++ if (ret < 0)
++ goto error_disable_reg;
++
++ voltage_uv = ret;
++ }
+ }
+
+ spi_set_drvdata(spi, indio_dev);
+diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
+index 99dd8452724de..57aec656ab7fb 100644
+--- a/drivers/infiniband/core/iwcm.c
++++ b/drivers/infiniband/core/iwcm.c
+@@ -1173,29 +1173,34 @@ static int __init iw_cm_init(void)
+
+ ret = iwpm_init(RDMA_NL_IWCM);
+ if (ret)
+- pr_err("iw_cm: couldn't init iwpm\n");
+- else
+- rdma_nl_register(RDMA_NL_IWCM, iwcm_nl_cb_table);
++ return ret;
++
+ iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", 0);
+ if (!iwcm_wq)
+- return -ENOMEM;
++ goto err_alloc;
+
+ iwcm_ctl_table_hdr = register_net_sysctl(&init_net, "net/iw_cm",
+ iwcm_ctl_table);
+ if (!iwcm_ctl_table_hdr) {
+ pr_err("iw_cm: couldn't register sysctl paths\n");
+- destroy_workqueue(iwcm_wq);
+- return -ENOMEM;
++ goto err_sysctl;
+ }
+
++ rdma_nl_register(RDMA_NL_IWCM, iwcm_nl_cb_table);
+ return 0;
++
++err_sysctl:
++ destroy_workqueue(iwcm_wq);
++err_alloc:
++ iwpm_exit(RDMA_NL_IWCM);
++ return -ENOMEM;
+ }
+
+ static void __exit iw_cm_cleanup(void)
+ {
++ rdma_nl_unregister(RDMA_NL_IWCM);
+ unregister_net_sysctl_table(iwcm_ctl_table_hdr);
+ destroy_workqueue(iwcm_wq);
+- rdma_nl_unregister(RDMA_NL_IWCM);
+ iwpm_exit(RDMA_NL_IWCM);
+ }
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 7787ec42f81e1..2df75db52e917 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -824,20 +824,20 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size,
+ n = BITS_TO_LONGS(d->nr_stripes) * sizeof(unsigned long);
+ d->full_dirty_stripes = kvzalloc(n, GFP_KERNEL);
+ if (!d->full_dirty_stripes)
+- return -ENOMEM;
++ goto out_free_stripe_sectors_dirty;
+
+ idx = ida_simple_get(&bcache_device_idx, 0,
+ BCACHE_DEVICE_IDX_MAX, GFP_KERNEL);
+ if (idx < 0)
+- return idx;
++ goto out_free_full_dirty_stripes;
+
+ if (bioset_init(&d->bio_split, 4, offsetof(struct bbio, bio),
+ BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER))
+- goto err;
++ goto out_ida_remove;
+
+ d->disk = alloc_disk(BCACHE_MINORS);
+ if (!d->disk)
+- goto err;
++ goto out_bioset_exit;
+
+ set_capacity(d->disk, sectors);
+ snprintf(d->disk->disk_name, DISK_NAME_LEN, "bcache%i", idx);
+@@ -872,8 +872,14 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size,
+
+ return 0;
+
+-err:
++out_bioset_exit:
++ bioset_exit(&d->bio_split);
++out_ida_remove:
+ ida_simple_remove(&bcache_device_idx, idx);
++out_free_full_dirty_stripes:
++ kvfree(d->full_dirty_stripes);
++out_free_stripe_sectors_dirty:
++ kvfree(d->stripe_sectors_dirty);
+ return -ENOMEM;
+
+ }
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 85559f772d0d6..a6a26f8e4d8e1 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -2181,7 +2181,12 @@ static void *crypt_page_alloc(gfp_t gfp_mask, void *pool_data)
+ struct crypt_config *cc = pool_data;
+ struct page *page;
+
+- if (unlikely(percpu_counter_compare(&cc->n_allocated_pages, dm_crypt_pages_per_client) >= 0) &&
++ /*
++ * Note, percpu_counter_read_positive() may over (and under) estimate
++ * the current usage by at most (batch - 1) * num_online_cpus() pages,
++ * but avoids potential spinlock contention of an exact result.
++ */
++ if (unlikely(percpu_counter_read_positive(&cc->n_allocated_pages) >= dm_crypt_pages_per_client) &&
+ likely(gfp_mask & __GFP_NORETRY))
+ return NULL;
+
+diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
+index 85077f4d257a7..a6a5cee6b9430 100644
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -901,7 +901,7 @@ int dm_pool_metadata_close(struct dm_pool_metadata *pmd)
+ return -EBUSY;
+ }
+
+- if (!dm_bm_is_read_only(pmd->bm) && !pmd->fail_io) {
++ if (!pmd->fail_io && !dm_bm_is_read_only(pmd->bm)) {
+ r = __commit_transaction(pmd);
+ if (r < 0)
+ DMWARN("%s: __commit_transaction() failed, error = %d",
+diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c
+index 492a3f8ac1199..0401daa0f7fbd 100644
+--- a/drivers/md/persistent-data/dm-block-manager.c
++++ b/drivers/md/persistent-data/dm-block-manager.c
+@@ -494,7 +494,7 @@ int dm_bm_write_lock(struct dm_block_manager *bm,
+ void *p;
+ int r;
+
+- if (bm->read_only)
++ if (dm_bm_is_read_only(bm))
+ return -EPERM;
+
+ p = dm_bufio_read(bm->bufio, b, (struct dm_buffer **) result);
+@@ -563,7 +563,7 @@ int dm_bm_write_lock_zero(struct dm_block_manager *bm,
+ struct buffer_aux *aux;
+ void *p;
+
+- if (bm->read_only)
++ if (dm_bm_is_read_only(bm))
+ return -EPERM;
+
+ p = dm_bufio_new(bm->bufio, b, (struct dm_buffer **) result);
+@@ -603,7 +603,7 @@ EXPORT_SYMBOL_GPL(dm_bm_unlock);
+
+ int dm_bm_flush(struct dm_block_manager *bm)
+ {
+- if (bm->read_only)
++ if (dm_bm_is_read_only(bm))
+ return -EPERM;
+
+ return dm_bufio_write_dirty_buffers(bm->bufio);
+@@ -617,19 +617,21 @@ void dm_bm_prefetch(struct dm_block_manager *bm, dm_block_t b)
+
+ bool dm_bm_is_read_only(struct dm_block_manager *bm)
+ {
+- return bm->read_only;
++ return (bm ? bm->read_only : true);
+ }
+ EXPORT_SYMBOL_GPL(dm_bm_is_read_only);
+
+ void dm_bm_set_read_only(struct dm_block_manager *bm)
+ {
+- bm->read_only = true;
++ if (bm)
++ bm->read_only = true;
+ }
+ EXPORT_SYMBOL_GPL(dm_bm_set_read_only);
+
+ void dm_bm_set_read_write(struct dm_block_manager *bm)
+ {
+- bm->read_only = false;
++ if (bm)
++ bm->read_only = false;
+ }
+ EXPORT_SYMBOL_GPL(dm_bm_set_read_write);
+
+diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c
+index 3c3f8cb148451..5fa787e023c7e 100644
+--- a/drivers/media/dvb-frontends/dib8000.c
++++ b/drivers/media/dvb-frontends/dib8000.c
+@@ -2110,32 +2110,55 @@ static void dib8000_load_ana_fe_coefs(struct dib8000_state *state, const s16 *an
+ dib8000_write_word(state, 117 + mode, ana_fe[mode]);
+ }
+
+-static const u16 lut_prbs_2k[14] = {
+- 0, 0x423, 0x009, 0x5C7, 0x7A6, 0x3D8, 0x527, 0x7FF, 0x79B, 0x3D6, 0x3A2, 0x53B, 0x2F4, 0x213
++static const u16 lut_prbs_2k[13] = {
++ 0x423, 0x009, 0x5C7,
++ 0x7A6, 0x3D8, 0x527,
++ 0x7FF, 0x79B, 0x3D6,
++ 0x3A2, 0x53B, 0x2F4,
++ 0x213
+ };
+-static const u16 lut_prbs_4k[14] = {
+- 0, 0x208, 0x0C3, 0x7B9, 0x423, 0x5C7, 0x3D8, 0x7FF, 0x3D6, 0x53B, 0x213, 0x029, 0x0D0, 0x48E
++
++static const u16 lut_prbs_4k[13] = {
++ 0x208, 0x0C3, 0x7B9,
++ 0x423, 0x5C7, 0x3D8,
++ 0x7FF, 0x3D6, 0x53B,
++ 0x213, 0x029, 0x0D0,
++ 0x48E
+ };
+-static const u16 lut_prbs_8k[14] = {
+- 0, 0x740, 0x069, 0x7DD, 0x208, 0x7B9, 0x5C7, 0x7FF, 0x53B, 0x029, 0x48E, 0x4C4, 0x367, 0x684
++
++static const u16 lut_prbs_8k[13] = {
++ 0x740, 0x069, 0x7DD,
++ 0x208, 0x7B9, 0x5C7,
++ 0x7FF, 0x53B, 0x029,
++ 0x48E, 0x4C4, 0x367,
++ 0x684
+ };
+
+ static u16 dib8000_get_init_prbs(struct dib8000_state *state, u16 subchannel)
+ {
+ int sub_channel_prbs_group = 0;
++ int prbs_group;
+
+- sub_channel_prbs_group = (subchannel / 3) + 1;
+- dprintk("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n", sub_channel_prbs_group, subchannel, lut_prbs_8k[sub_channel_prbs_group]);
++ sub_channel_prbs_group = subchannel / 3;
++ if (sub_channel_prbs_group >= ARRAY_SIZE(lut_prbs_2k))
++ return 0;
+
+ switch (state->fe[0]->dtv_property_cache.transmission_mode) {
+ case TRANSMISSION_MODE_2K:
+- return lut_prbs_2k[sub_channel_prbs_group];
++ prbs_group = lut_prbs_2k[sub_channel_prbs_group];
++ break;
+ case TRANSMISSION_MODE_4K:
+- return lut_prbs_4k[sub_channel_prbs_group];
++ prbs_group = lut_prbs_4k[sub_channel_prbs_group];
++ break;
+ default:
+ case TRANSMISSION_MODE_8K:
+- return lut_prbs_8k[sub_channel_prbs_group];
++ prbs_group = lut_prbs_8k[sub_channel_prbs_group];
+ }
++
++ dprintk("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n",
++ sub_channel_prbs_group, subchannel, prbs_group);
++
++ return prbs_group;
+ }
+
+ static void dib8000_set_13seg_channel(struct dib8000_state *state)
+@@ -2412,10 +2435,8 @@ static void dib8000_set_isdbt_common_channel(struct dib8000_state *state, u8 seq
+ /* TSB or ISDBT ? apply it now */
+ if (c->isdbt_sb_mode) {
+ dib8000_set_sb_channel(state);
+- if (c->isdbt_sb_subchannel < 14)
+- init_prbs = dib8000_get_init_prbs(state, c->isdbt_sb_subchannel);
+- else
+- init_prbs = 0;
++ init_prbs = dib8000_get_init_prbs(state,
++ c->isdbt_sb_subchannel);
+ } else {
+ dib8000_set_13seg_channel(state);
+ init_prbs = 0xfff;
+@@ -3007,6 +3028,7 @@ static int dib8000_tune(struct dvb_frontend *fe)
+
+ unsigned long *timeout = &state->timeout;
+ unsigned long now = jiffies;
++ u16 init_prbs;
+ #ifdef DIB8000_AGC_FREEZE
+ u16 agc1, agc2;
+ #endif
+@@ -3305,8 +3327,10 @@ static int dib8000_tune(struct dvb_frontend *fe)
+ break;
+
+ case CT_DEMOD_STEP_11: /* 41 : init prbs autosearch */
+- if (state->subchannel <= 41) {
+- dib8000_set_subchannel_prbs(state, dib8000_get_init_prbs(state, state->subchannel));
++ init_prbs = dib8000_get_init_prbs(state, state->subchannel);
++
++ if (init_prbs) {
++ dib8000_set_subchannel_prbs(state, init_prbs);
+ *tune_state = CT_DEMOD_STEP_9;
+ } else {
+ *tune_state = CT_DEMOD_STOP;
+diff --git a/drivers/media/i2c/imx258.c b/drivers/media/i2c/imx258.c
+index 31a1e2294843a..85395813c0f2e 100644
+--- a/drivers/media/i2c/imx258.c
++++ b/drivers/media/i2c/imx258.c
+@@ -22,7 +22,7 @@
+ #define IMX258_CHIP_ID 0x0258
+
+ /* V_TIMING internal */
+-#define IMX258_VTS_30FPS 0x0c98
++#define IMX258_VTS_30FPS 0x0c50
+ #define IMX258_VTS_30FPS_2K 0x0638
+ #define IMX258_VTS_30FPS_VGA 0x034c
+ #define IMX258_VTS_MAX 0xffff
+@@ -46,7 +46,7 @@
+ /* Analog gain control */
+ #define IMX258_REG_ANALOG_GAIN 0x0204
+ #define IMX258_ANA_GAIN_MIN 0
+-#define IMX258_ANA_GAIN_MAX 0x1fff
++#define IMX258_ANA_GAIN_MAX 480
+ #define IMX258_ANA_GAIN_STEP 1
+ #define IMX258_ANA_GAIN_DEFAULT 0x0
+
+diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
+index d114ac5243eca..4f8dc3f56785a 100644
+--- a/drivers/media/i2c/tda1997x.c
++++ b/drivers/media/i2c/tda1997x.c
+@@ -1695,14 +1695,15 @@ static int tda1997x_query_dv_timings(struct v4l2_subdev *sd,
+ struct v4l2_dv_timings *timings)
+ {
+ struct tda1997x_state *state = to_state(sd);
++ int ret;
+
+ v4l_dbg(1, debug, state->client, "%s\n", __func__);
+ memset(timings, 0, sizeof(struct v4l2_dv_timings));
+ mutex_lock(&state->lock);
+- tda1997x_detect_std(state, timings);
++ ret = tda1997x_detect_std(state, timings);
+ mutex_unlock(&state->lock);
+
+- return 0;
++ return ret;
+ }
+
+ static const struct v4l2_subdev_video_ops tda1997x_video_ops = {
+@@ -2229,6 +2230,7 @@ static int tda1997x_core_init(struct v4l2_subdev *sd)
+ /* get initial HDMI status */
+ state->hdmi_status = io_read(sd, REG_HDMI_FLAGS);
+
++ io_write(sd, REG_EDID_ENABLE, EDID_ENABLE_A_EN | EDID_ENABLE_B_EN);
+ return 0;
+ }
+
+diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
+index 420897241248c..4197b311cff46 100644
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -316,6 +316,8 @@ venc_try_fmt_common(struct venus_inst *inst, struct v4l2_format *f)
+ else
+ return NULL;
+ fmt = find_format(inst, pixmp->pixelformat, f->type);
++ if (!fmt)
++ return NULL;
+ }
+
+ pixmp->width = clamp(pixmp->width, frame_width_min(inst),
+diff --git a/drivers/media/platform/tegra-cec/tegra_cec.c b/drivers/media/platform/tegra-cec/tegra_cec.c
+index aba488cd0e645..a2c20ca799c44 100644
+--- a/drivers/media/platform/tegra-cec/tegra_cec.c
++++ b/drivers/media/platform/tegra-cec/tegra_cec.c
+@@ -383,7 +383,11 @@ static int tegra_cec_probe(struct platform_device *pdev)
+ return -ENOENT;
+ }
+
+- clk_prepare_enable(cec->clk);
++ ret = clk_prepare_enable(cec->clk);
++ if (ret) {
++ dev_err(&pdev->dev, "Unable to prepare clock for CEC\n");
++ return ret;
++ }
+
+ /* set context info. */
+ cec->dev = &pdev->dev;
+@@ -462,9 +466,7 @@ static int tegra_cec_resume(struct platform_device *pdev)
+
+ dev_notice(&pdev->dev, "Resuming\n");
+
+- clk_prepare_enable(cec->clk);
+-
+- return 0;
++ return clk_prepare_enable(cec->clk);
+ }
+ #endif
+
+diff --git a/drivers/media/rc/rc-loopback.c b/drivers/media/rc/rc-loopback.c
+index 3822d9ebcb46c..5abbde7e5d5b3 100644
+--- a/drivers/media/rc/rc-loopback.c
++++ b/drivers/media/rc/rc-loopback.c
+@@ -52,7 +52,7 @@ static int loop_set_tx_mask(struct rc_dev *dev, u32 mask)
+
+ if ((mask & (RXMASK_REGULAR | RXMASK_LEARNING)) != mask) {
+ dprintk("invalid tx mask: %u\n", mask);
+- return -EINVAL;
++ return 2;
+ }
+
+ dprintk("setting tx mask: %u\n", mask);
+diff --git a/drivers/media/usb/dvb-usb/nova-t-usb2.c b/drivers/media/usb/dvb-usb/nova-t-usb2.c
+index 43e0e0fd715b9..705c2901a89e8 100644
+--- a/drivers/media/usb/dvb-usb/nova-t-usb2.c
++++ b/drivers/media/usb/dvb-usb/nova-t-usb2.c
+@@ -133,7 +133,7 @@ ret:
+
+ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])
+ {
+- int i;
++ int i, ret;
+ u8 b;
+
+ mac[0] = 0x00;
+@@ -142,7 +142,9 @@ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])
+
+ /* this is a complete guess, but works for my box */
+ for (i = 136; i < 139; i++) {
+- dibusb_read_eeprom_byte(d,i, &b);
++ ret = dibusb_read_eeprom_byte(d, i, &b);
++ if (ret)
++ return ret;
+
+ mac[5 - (i - 136)] = b;
+ }
+diff --git a/drivers/media/usb/dvb-usb/vp702x.c b/drivers/media/usb/dvb-usb/vp702x.c
+index c3529ea59da95..fcd66757b34dc 100644
+--- a/drivers/media/usb/dvb-usb/vp702x.c
++++ b/drivers/media/usb/dvb-usb/vp702x.c
+@@ -294,16 +294,22 @@ static int vp702x_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
+ static int vp702x_read_mac_addr(struct dvb_usb_device *d,u8 mac[6])
+ {
+ u8 i, *buf;
++ int ret;
+ struct vp702x_device_state *st = d->priv;
+
+ mutex_lock(&st->buf_mutex);
+ buf = st->buf;
+- for (i = 6; i < 12; i++)
+- vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, &buf[i - 6], 1);
++ for (i = 6; i < 12; i++) {
++ ret = vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1,
++ &buf[i - 6], 1);
++ if (ret < 0)
++ goto err;
++ }
+
+ memcpy(mac, buf, 6);
++err:
+ mutex_unlock(&st->buf_mutex);
+- return 0;
++ return ret;
+ }
+
+ static int vp702x_frontend_attach(struct dvb_usb_adapter *adap)
+diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
+index 3612f0d730ddd..92007a225d8ea 100644
+--- a/drivers/media/usb/em28xx/em28xx-input.c
++++ b/drivers/media/usb/em28xx/em28xx-input.c
+@@ -865,7 +865,6 @@ error:
+ kfree(ir);
+ ref_put:
+ em28xx_shutdown_buttons(dev);
+- kref_put(&dev->ref, em28xx_free_device);
+ return err;
+ }
+
+diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c
+index 62aeebcdd7f71..c7b5a3321cd74 100644
+--- a/drivers/media/usb/go7007/go7007-driver.c
++++ b/drivers/media/usb/go7007/go7007-driver.c
+@@ -699,49 +699,23 @@ struct go7007 *go7007_alloc(const struct go7007_board_info *board,
+ struct device *dev)
+ {
+ struct go7007 *go;
+- int i;
+
+ go = kzalloc(sizeof(struct go7007), GFP_KERNEL);
+ if (go == NULL)
+ return NULL;
+ go->dev = dev;
+ go->board_info = board;
+- go->board_id = 0;
+ go->tuner_type = -1;
+- go->channel_number = 0;
+- go->name[0] = 0;
+ mutex_init(&go->hw_lock);
+ init_waitqueue_head(&go->frame_waitq);
+ spin_lock_init(&go->spinlock);
+ go->status = STATUS_INIT;
+- memset(&go->i2c_adapter, 0, sizeof(go->i2c_adapter));
+- go->i2c_adapter_online = 0;
+- go->interrupt_available = 0;
+ init_waitqueue_head(&go->interrupt_waitq);
+- go->input = 0;
+ go7007_update_board(go);
+- go->encoder_h_halve = 0;
+- go->encoder_v_halve = 0;
+- go->encoder_subsample = 0;
+ go->format = V4L2_PIX_FMT_MJPEG;
+ go->bitrate = 1500000;
+ go->fps_scale = 1;
+- go->pali = 0;
+ go->aspect_ratio = GO7007_RATIO_1_1;
+- go->gop_size = 0;
+- go->ipb = 0;
+- go->closed_gop = 0;
+- go->repeat_seqhead = 0;
+- go->seq_header_enable = 0;
+- go->gop_header_enable = 0;
+- go->dvd_mode = 0;
+- go->interlace_coding = 0;
+- for (i = 0; i < 4; ++i)
+- go->modet[i].enable = 0;
+- for (i = 0; i < 1624; ++i)
+- go->modet_map[i] = 0;
+- go->audio_deliver = NULL;
+- go->audio_enabled = 0;
+
+ return go;
+ }
+diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
+index e33fa78ef98dd..f46db1b6a27c4 100644
+--- a/drivers/media/usb/stkwebcam/stk-webcam.c
++++ b/drivers/media/usb/stkwebcam/stk-webcam.c
+@@ -1355,7 +1355,7 @@ static int stk_camera_probe(struct usb_interface *interface,
+ if (!dev->isoc_ep) {
+ pr_err("Could not find isoc-in endpoint\n");
+ err = -ENODEV;
+- goto error;
++ goto error_put;
+ }
+ dev->vsettings.palette = V4L2_PIX_FMT_RGB565;
+ dev->vsettings.mode = MODE_VGA;
+@@ -1368,10 +1368,12 @@ static int stk_camera_probe(struct usb_interface *interface,
+
+ err = stk_register_video_device(dev);
+ if (err)
+- goto error;
++ goto error_put;
+
+ return 0;
+
++error_put:
++ usb_put_intf(interface);
+ error:
+ v4l2_ctrl_handler_free(hdl);
+ v4l2_device_unregister(&dev->v4l2_dev);
+diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
+index 06167c51af128..2ca1e8ce6159d 100644
+--- a/drivers/media/usb/uvc/uvc_v4l2.c
++++ b/drivers/media/usb/uvc/uvc_v4l2.c
+@@ -900,8 +900,8 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
+ {
+ struct uvc_fh *handle = fh;
+ struct uvc_video_chain *chain = handle->chain;
++ u8 *buf;
+ int ret;
+- u8 i;
+
+ if (chain->selector == NULL ||
+ (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
+@@ -909,22 +909,27 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
+ return 0;
+ }
+
++ buf = kmalloc(1, GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
++
+ ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id,
+ chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
+- &i, 1);
+- if (ret < 0)
+- return ret;
++ buf, 1);
++ if (!ret)
++ *input = *buf - 1;
+
+- *input = i - 1;
+- return 0;
++ kfree(buf);
++
++ return ret;
+ }
+
+ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
+ {
+ struct uvc_fh *handle = fh;
+ struct uvc_video_chain *chain = handle->chain;
++ u8 *buf;
+ int ret;
+- u32 i;
+
+ ret = uvc_acquire_privileges(handle);
+ if (ret < 0)
+@@ -940,10 +945,17 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
+ if (input >= chain->selector->bNrInPins)
+ return -EINVAL;
+
+- i = input + 1;
+- return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
+- chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
+- &i, 1);
++ buf = kmalloc(1, GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
++
++ *buf = input + 1;
++ ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
++ chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
++ buf, 1);
++ kfree(buf);
++
++ return ret;
+ }
+
+ static int uvc_ioctl_queryctrl(struct file *file, void *fh,
+diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
+index a24b40dfec97a..af38c989ff336 100644
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -196,7 +196,7 @@ bool v4l2_find_dv_timings_cap(struct v4l2_dv_timings *t,
+ if (!v4l2_valid_dv_timings(t, cap, fnc, fnc_handle))
+ return false;
+
+- for (i = 0; i < v4l2_dv_timings_presets[i].bt.width; i++) {
++ for (i = 0; v4l2_dv_timings_presets[i].bt.width; i++) {
+ if (v4l2_valid_dv_timings(v4l2_dv_timings_presets + i, cap,
+ fnc, fnc_handle) &&
+ v4l2_match_dv_timings(t, v4l2_dv_timings_presets + i,
+@@ -218,7 +218,7 @@ bool v4l2_find_dv_timings_cea861_vic(struct v4l2_dv_timings *t, u8 vic)
+ {
+ unsigned int i;
+
+- for (i = 0; i < v4l2_dv_timings_presets[i].bt.width; i++) {
++ for (i = 0; v4l2_dv_timings_presets[i].bt.width; i++) {
+ const struct v4l2_bt_timings *bt =
+ &v4l2_dv_timings_presets[i].bt;
+
+diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
+index 11ab17f64c649..f0527e7698677 100644
+--- a/drivers/mfd/ab8500-core.c
++++ b/drivers/mfd/ab8500-core.c
+@@ -493,7 +493,7 @@ static int ab8500_handle_hierarchical_line(struct ab8500 *ab8500,
+ if (line == AB8540_INT_GPIO43F || line == AB8540_INT_GPIO44F)
+ line += 1;
+
+- handle_nested_irq(irq_create_mapping(ab8500->domain, line));
++ handle_nested_irq(irq_find_mapping(ab8500->domain, line));
+ }
+
+ return 0;
+diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
+index aa65931142ba7..dcb341d627582 100644
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -127,12 +127,13 @@ static const struct regmap_range axp288_writeable_ranges[] = {
+
+ static const struct regmap_range axp288_volatile_ranges[] = {
+ regmap_reg_range(AXP20X_PWR_INPUT_STATUS, AXP288_POWER_REASON),
++ regmap_reg_range(AXP22X_PWR_OUT_CTRL1, AXP22X_ALDO3_V_OUT),
+ regmap_reg_range(AXP288_BC_GLOBAL, AXP288_BC_GLOBAL),
+ regmap_reg_range(AXP288_BC_DET_STAT, AXP20X_VBUS_IPSOUT_MGMT),
+ regmap_reg_range(AXP20X_CHRG_BAK_CTRL, AXP20X_CHRG_BAK_CTRL),
+ regmap_reg_range(AXP20X_IRQ1_EN, AXP20X_IPSOUT_V_HIGH_L),
+ regmap_reg_range(AXP20X_TIMER_CTRL, AXP20X_TIMER_CTRL),
+- regmap_reg_range(AXP22X_GPIO_STATE, AXP22X_GPIO_STATE),
++ regmap_reg_range(AXP20X_GPIO1_CTRL, AXP22X_GPIO_STATE),
+ regmap_reg_range(AXP288_RT_BATT_V_H, AXP288_RT_BATT_V_L),
+ regmap_reg_range(AXP20X_FG_RES, AXP288_FG_CC_CAP_REG),
+ };
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 566caca4efd8e..722ad2c368a56 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1035,7 +1035,7 @@ static irqreturn_t stmpe_irq(int irq, void *data)
+
+ if (variant->id_val == STMPE801_ID ||
+ variant->id_val == STMPE1600_ID) {
+- int base = irq_create_mapping(stmpe->domain, 0);
++ int base = irq_find_mapping(stmpe->domain, 0);
+
+ handle_nested_irq(base);
+ return IRQ_HANDLED;
+@@ -1063,7 +1063,7 @@ static irqreturn_t stmpe_irq(int irq, void *data)
+ while (status) {
+ int bit = __ffs(status);
+ int line = bank * 8 + bit;
+- int nestedirq = irq_create_mapping(stmpe->domain, line);
++ int nestedirq = irq_find_mapping(stmpe->domain, line);
+
+ handle_nested_irq(nestedirq);
+ status &= ~(1 << bit);
+diff --git a/drivers/mfd/tc3589x.c b/drivers/mfd/tc3589x.c
+index cc9e563f23aa6..7062baf606858 100644
+--- a/drivers/mfd/tc3589x.c
++++ b/drivers/mfd/tc3589x.c
+@@ -187,7 +187,7 @@ again:
+
+ while (status) {
+ int bit = __ffs(status);
+- int virq = irq_create_mapping(tc3589x->domain, bit);
++ int virq = irq_find_mapping(tc3589x->domain, bit);
+
+ handle_nested_irq(virq);
+ status &= ~(1 << bit);
+diff --git a/drivers/mfd/wm8994-irq.c b/drivers/mfd/wm8994-irq.c
+index 18710f3b5c534..2c58d9b99a394 100644
+--- a/drivers/mfd/wm8994-irq.c
++++ b/drivers/mfd/wm8994-irq.c
+@@ -159,7 +159,7 @@ static irqreturn_t wm8994_edge_irq(int irq, void *data)
+ struct wm8994 *wm8994 = data;
+
+ while (gpio_get_value_cansleep(wm8994->pdata.irq_gpio))
+- handle_nested_irq(irq_create_mapping(wm8994->edge_irq, 0));
++ handle_nested_irq(irq_find_mapping(wm8994->edge_irq, 0));
+
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/misc/aspeed-lpc-ctrl.c b/drivers/misc/aspeed-lpc-ctrl.c
+index a024f8042259a..870ab0dfcde06 100644
+--- a/drivers/misc/aspeed-lpc-ctrl.c
++++ b/drivers/misc/aspeed-lpc-ctrl.c
+@@ -50,7 +50,7 @@ static int aspeed_lpc_ctrl_mmap(struct file *file, struct vm_area_struct *vma)
+ unsigned long vsize = vma->vm_end - vma->vm_start;
+ pgprot_t prot = vma->vm_page_prot;
+
+- if (vma->vm_pgoff + vsize > lpc_ctrl->mem_base + lpc_ctrl->mem_size)
++ if (vma->vm_pgoff + vma_pages(vma) > lpc_ctrl->mem_size >> PAGE_SHIFT)
+ return -EINVAL;
+
+ /* ast2400/2500 AHB accesses are not cache coherent */
+diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+index 9bc97d6a651db..db433d285effa 100644
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -2249,7 +2249,8 @@ int vmci_qp_broker_map(struct vmci_handle handle,
+
+ result = VMCI_SUCCESS;
+
+- if (context_id != VMCI_HOST_CONTEXT_ID) {
++ if (context_id != VMCI_HOST_CONTEXT_ID &&
++ !QPBROKERSTATE_HAS_MEM(entry)) {
+ struct vmci_qp_page_store page_store;
+
+ page_store.pages = guest_mem;
+@@ -2356,7 +2357,8 @@ int vmci_qp_broker_unmap(struct vmci_handle handle,
+ goto out;
+ }
+
+- if (context_id != VMCI_HOST_CONTEXT_ID) {
++ if (context_id != VMCI_HOST_CONTEXT_ID &&
++ QPBROKERSTATE_HAS_MEM(entry)) {
+ qp_acquire_queue_mutex(entry->produce_q);
+ result = qp_save_headers(entry);
+ if (result < VMCI_SUCCESS)
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 7b2bb32e35554..d1cc0fdbc51c8 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -592,6 +592,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ }
+
+ mmc_wait_for_req(card->host, &mrq);
++ memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp));
+
+ if (cmd.error) {
+ dev_err(mmc_dev(card->host), "%s: cmd error %d\n",
+@@ -641,8 +642,6 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+ if (idata->ic.postsleep_min_us)
+ usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us);
+
+- memcpy(&(idata->ic.response), cmd.resp, sizeof(cmd.resp));
+-
+ if (idata->rpmb || (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) {
+ /*
+ * Ensure RPMB/R1B command has completed by polling CMD13
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index 8e09586f880f1..e3991df078efb 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -808,6 +808,7 @@ static int dw_mci_edmac_start_dma(struct dw_mci *host,
+ int ret = 0;
+
+ /* Set external dma config: burst size, burst width */
++ memset(&cfg, 0, sizeof(cfg));
+ cfg.dst_addr = host->phy_regs + fifo_offset;
+ cfg.src_addr = cfg.dst_addr;
+ cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
+index a0670e9cd0127..5553a5643f405 100644
+--- a/drivers/mmc/host/moxart-mmc.c
++++ b/drivers/mmc/host/moxart-mmc.c
+@@ -631,6 +631,7 @@ static int moxart_probe(struct platform_device *pdev)
+ host->dma_chan_tx, host->dma_chan_rx);
+ host->have_dma = true;
+
++ memset(&cfg, 0, sizeof(cfg));
+ cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+
+diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
+index 02de6a5701d6c..c1de8fa50fe8f 100644
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -551,9 +551,22 @@ static int sd_write_long_data(struct realtek_pci_sdmmc *host,
+ return 0;
+ }
+
++static inline void sd_enable_initial_mode(struct realtek_pci_sdmmc *host)
++{
++ rtsx_pci_write_register(host->pcr, SD_CFG1,
++ SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_128);
++}
++
++static inline void sd_disable_initial_mode(struct realtek_pci_sdmmc *host)
++{
++ rtsx_pci_write_register(host->pcr, SD_CFG1,
++ SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_0);
++}
++
+ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
+ {
+ struct mmc_data *data = mrq->data;
++ int err;
+
+ if (host->sg_count < 0) {
+ data->error = host->sg_count;
+@@ -562,22 +575,19 @@ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
+ return data->error;
+ }
+
+- if (data->flags & MMC_DATA_READ)
+- return sd_read_long_data(host, mrq);
++ if (data->flags & MMC_DATA_READ) {
++ if (host->initial_mode)
++ sd_disable_initial_mode(host);
+
+- return sd_write_long_data(host, mrq);
+-}
++ err = sd_read_long_data(host, mrq);
+
+-static inline void sd_enable_initial_mode(struct realtek_pci_sdmmc *host)
+-{
+- rtsx_pci_write_register(host->pcr, SD_CFG1,
+- SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_128);
+-}
++ if (host->initial_mode)
++ sd_enable_initial_mode(host);
+
+-static inline void sd_disable_initial_mode(struct realtek_pci_sdmmc *host)
+-{
+- rtsx_pci_write_register(host->pcr, SD_CFG1,
+- SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_0);
++ return err;
++ }
++
++ return sd_write_long_data(host, mrq);
+ }
+
+ static void sd_normal_rw(struct realtek_pci_sdmmc *host,
+diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
+index 9c77bfe4334f3..d1a2418b0c5e5 100644
+--- a/drivers/mmc/host/sdhci-of-arasan.c
++++ b/drivers/mmc/host/sdhci-of-arasan.c
+@@ -185,7 +185,12 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock)
+ * through low speeds without power cycling.
+ */
+ sdhci_set_clock(host, host->max_clk);
+- phy_power_on(sdhci_arasan->phy);
++ if (phy_power_on(sdhci_arasan->phy)) {
++ pr_err("%s: Cannot power on phy.\n",
++ mmc_hostname(host->mmc));
++ return;
++ }
++
+ sdhci_arasan->is_phy_on = true;
+
+ /*
+@@ -221,7 +226,12 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock)
+ msleep(20);
+
+ if (ctrl_phy) {
+- phy_power_on(sdhci_arasan->phy);
++ if (phy_power_on(sdhci_arasan->phy)) {
++ pr_err("%s: Cannot power on phy.\n",
++ mmc_hostname(host->mmc));
++ return;
++ }
++
+ sdhci_arasan->is_phy_on = true;
+ }
+ }
+@@ -395,7 +405,9 @@ static int sdhci_arasan_suspend(struct device *dev)
+ ret = phy_power_off(sdhci_arasan->phy);
+ if (ret) {
+ dev_err(dev, "Cannot power off phy.\n");
+- sdhci_resume_host(host);
++ if (sdhci_resume_host(host))
++ dev_err(dev, "Cannot resume host.\n");
++
+ return ret;
+ }
+ sdhci_arasan->is_phy_on = false;
+diff --git a/drivers/mtd/nand/raw/cafe_nand.c b/drivers/mtd/nand/raw/cafe_nand.c
+index 3304594177c6d..1fee298d5680c 100644
+--- a/drivers/mtd/nand/raw/cafe_nand.c
++++ b/drivers/mtd/nand/raw/cafe_nand.c
+@@ -758,7 +758,7 @@ static int cafe_nand_probe(struct pci_dev *pdev,
+ "CAFE NAND", mtd);
+ if (err) {
+ dev_warn(&pdev->dev, "Could not register IRQ %d\n", pdev->irq);
+- goto out_ior;
++ goto out_free_rs;
+ }
+
+ /* Disable master reset, enable NAND clock */
+@@ -802,6 +802,8 @@ static int cafe_nand_probe(struct pci_dev *pdev,
+ /* Disable NAND IRQ in global IRQ mask register */
+ cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK);
+ free_irq(pdev->irq, mtd);
++ out_free_rs:
++ free_rs(cafe->rs);
+ out_ior:
+ pci_iounmap(pdev, cafe->mmio);
+ out_free_mtd:
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index c814b266af794..d6c5f41b17f7e 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1912,7 +1912,6 @@ static int __bond_release_one(struct net_device *bond_dev,
+ /* recompute stats just before removing the slave */
+ bond_get_stats(bond->dev, &bond->bond_stats);
+
+- bond_upper_dev_unlink(bond, slave);
+ /* unregister rx_handler early so bond_handle_frame wouldn't be called
+ * for this slave anymore.
+ */
+@@ -1921,6 +1920,8 @@ static int __bond_release_one(struct net_device *bond_dev,
+ if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ bond_3ad_unbind_slave(slave);
+
++ bond_upper_dev_unlink(bond, slave);
++
+ if (bond_mode_can_use_xmit_hash(bond))
+ bond_update_slave_arr(bond, slave);
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 7eaeab65d39f5..451121f47c89a 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -2135,9 +2135,8 @@ static int b53_switch_init(struct b53_device *dev)
+ dev->cpu_port = 5;
+ }
+
+- /* cpu port is always last */
+- dev->num_ports = dev->cpu_port + 1;
+ dev->enabled_ports |= BIT(dev->cpu_port);
++ dev->num_ports = fls(dev->enabled_ports);
+
+ /* Include non standard CPU port built-in PHYs to be probed */
+ if (is539x(dev) || is531x5(dev)) {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+index 77005f6366eb1..b3ff8d13c31af 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+@@ -1245,7 +1245,7 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param,
+
+ /* SR-IOV capability was enabled but there are no VFs*/
+ if (iov->total == 0) {
+- err = -EINVAL;
++ err = 0;
+ goto failed;
+ }
+
+diff --git a/drivers/net/ethernet/cadence/macb_ptp.c b/drivers/net/ethernet/cadence/macb_ptp.c
+index 8f912de44defc..ecb0fb1ddde7c 100644
+--- a/drivers/net/ethernet/cadence/macb_ptp.c
++++ b/drivers/net/ethernet/cadence/macb_ptp.c
+@@ -286,6 +286,12 @@ void gem_ptp_rxstamp(struct macb *bp, struct sk_buff *skb,
+
+ if (GEM_BFEXT(DMA_RXVALID, desc->addr)) {
+ desc_ptp = macb_ptp_desc(bp, desc);
++ /* Unlikely but check */
++ if (!desc_ptp) {
++ dev_warn_ratelimited(&bp->pdev->dev,
++ "Timestamp not supported in BD\n");
++ return;
++ }
+ gem_hw_timestamp(bp, desc_ptp->ts_1, desc_ptp->ts_2, &ts);
+ memset(shhwtstamps, 0, sizeof(struct skb_shared_hwtstamps));
+ shhwtstamps->hwtstamp = ktime_set(ts.tv_sec, ts.tv_nsec);
+@@ -318,8 +324,11 @@ int gem_ptp_txstamp(struct macb_queue *queue, struct sk_buff *skb,
+ if (CIRC_SPACE(head, tail, PTP_TS_BUFFER_SIZE) == 0)
+ return -ENOMEM;
+
+- skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+ desc_ptp = macb_ptp_desc(queue->bp, desc);
++ /* Unlikely but check */
++ if (!desc_ptp)
++ return -EINVAL;
++ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+ tx_timestamp = &queue->tx_timestamps[head];
+ tx_timestamp->skb = skb;
+ /* ensure ts_1/ts_2 is loaded after ctrl (TX_USED check) */
+diff --git a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
+index 0ccdde366ae17..540d99f59226e 100644
+--- a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
++++ b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
+@@ -1153,6 +1153,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (!adapter->registered_device_map) {
+ pr_err("%s: could not register any net devices\n",
+ pci_name(pdev));
++ err = -EINVAL;
+ goto out_release_adapter_res;
+ }
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 19165a3548bfd..4fb80ed897f22 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -29,6 +29,8 @@ static const char hns3_driver_string[] =
+ static const char hns3_copyright[] = "Copyright (c) 2017 Huawei Corporation.";
+ static struct hnae3_client client;
+
++#define HNS3_MIN_TUN_PKT_LEN 65U
++
+ /* hns3_pci_tbl - PCI Device ID Table
+ *
+ * Last entry must be all 0s
+@@ -792,8 +794,11 @@ static int hns3_set_l3l4_type_csum(struct sk_buff *skb, u8 ol4_proto,
+ HNS3_L4T_TCP);
+ break;
+ case IPPROTO_UDP:
+- if (hns3_tunnel_csum_bug(skb))
+- return skb_checksum_help(skb);
++ if (hns3_tunnel_csum_bug(skb)) {
++ int ret = skb_put_padto(skb, HNS3_MIN_TUN_PKT_LEN);
++
++ return ret ? ret : skb_checksum_help(skb);
++ }
+
+ hnae3_set_bit(*type_cs_vlan_tso, HNS3_TXD_L4CS_B, 1);
+ hnae3_set_field(*type_cs_vlan_tso,
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 4008007c2e340..d97641b9928bb 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -4038,6 +4038,14 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
+ return 0;
+ }
+
++ if (adapter->failover_pending) {
++ adapter->init_done_rc = -EAGAIN;
++ netdev_dbg(netdev, "Failover pending, ignoring login response\n");
++ complete(&adapter->init_done);
++ /* login response buffer will be released on reset */
++ return 0;
++ }
++
+ netdev->mtu = adapter->req_mtu - ETH_HLEN;
+
+ netdev_dbg(adapter->netdev, "Login Response Buffer:\n");
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 774f0a619a6da..f0aa7f0e54803 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -1558,9 +1558,9 @@ static int build_match_list(struct match_list_head *match_head,
+
+ curr_match = kmalloc(sizeof(*curr_match), GFP_ATOMIC);
+ if (!curr_match) {
++ rcu_read_unlock();
+ free_match_list(match_head);
+- err = -ENOMEM;
+- goto out;
++ return -ENOMEM;
+ }
+ if (!tree_get_node(&g->node)) {
+ kfree(curr_match);
+@@ -1569,7 +1569,6 @@ static int build_match_list(struct match_list_head *match_head,
+ curr_match->g = g;
+ list_add_tail(&curr_match->list, &match_head->list);
+ }
+-out:
+ rcu_read_unlock();
+ return err;
+ }
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
+index 049a83b40e469..9d77f318d11ed 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -439,7 +439,12 @@ static int qed_enable_msix(struct qed_dev *cdev,
+ rc = cnt;
+ }
+
+- if (rc > 0) {
++ /* For VFs, we should return with an error in case we didn't get the
++ * exact number of msix vectors as we requested.
++ * Not doing that will lead to a crash when starting queues for
++ * this VF.
++ */
++ if ((IS_PF(cdev) && rc > 0) || (IS_VF(cdev) && rc == cnt)) {
+ /* MSI-x configuration was achieved */
+ int_params->out.int_mode = QED_INT_MODE_MSIX;
+ int_params->out.num_vectors = rc;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+index 0d62db3241bed..d16cadca2f7ef 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -2841,6 +2841,7 @@ qed_mcp_get_nvm_image_att(struct qed_hwfn *p_hwfn,
+ struct qed_nvm_image_att *p_image_att)
+ {
+ enum nvm_image_type type;
++ int rc;
+ u32 i;
+
+ /* Translate image_id into MFW definitions */
+@@ -2866,7 +2867,10 @@ qed_mcp_get_nvm_image_att(struct qed_hwfn *p_hwfn,
+ return -EINVAL;
+ }
+
+- qed_mcp_nvm_info_populate(p_hwfn);
++ rc = qed_mcp_nvm_info_populate(p_hwfn);
++ if (rc)
++ return rc;
++
+ for (i = 0; i < p_hwfn->nvm_info.num_images; i++)
+ if (type == p_hwfn->nvm_info.image_att[i].image_type)
+ break;
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
+index 1aabb2e7a38b5..756c5943f5e01 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
+@@ -1676,6 +1676,7 @@ static void qede_sync_free_irqs(struct qede_dev *edev)
+ }
+
+ edev->int_info.used_cnt = 0;
++ edev->int_info.msix_cnt = 0;
+ }
+
+ static int qede_req_msix_irqs(struct qede_dev *edev)
+@@ -2193,7 +2194,6 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode,
+ goto out;
+ err4:
+ qede_sync_free_irqs(edev);
+- memset(&edev->int_info.msix_cnt, 0, sizeof(struct qed_int_info));
+ err3:
+ qede_napi_disable_remove(edev);
+ err2:
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+index c48a0e2d4d7ef..6a009d51ec510 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+@@ -440,7 +440,6 @@ int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter)
+ QLCWR32(adapter, QLCNIC_CRB_PEG_NET_4 + 0x3c, 1);
+ msleep(20);
+
+- qlcnic_rom_unlock(adapter);
+ /* big hammer don't reset CAM block on reset */
+ QLCWR32(adapter, QLCNIC_ROMUSB_GLB_SW_RESET, 0xfeffffff);
+
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 9d188931bc09e..afd49c7fd87fe 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -413,7 +413,7 @@ qcaspi_receive(struct qcaspi *qca)
+ skb_put(qca->rx_skb, retcode);
+ qca->rx_skb->protocol = eth_type_trans(
+ qca->rx_skb, qca->rx_skb->dev);
+- qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
++ skb_checksum_none_assert(qca->rx_skb);
+ netif_rx_ni(qca->rx_skb);
+ qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
+ net_dev->mtu + VLAN_ETH_HLEN);
+diff --git a/drivers/net/ethernet/qualcomm/qca_uart.c b/drivers/net/ethernet/qualcomm/qca_uart.c
+index db6068cd7a1f2..466e9d07697a1 100644
+--- a/drivers/net/ethernet/qualcomm/qca_uart.c
++++ b/drivers/net/ethernet/qualcomm/qca_uart.c
+@@ -107,7 +107,7 @@ qca_tty_receive(struct serdev_device *serdev, const unsigned char *data,
+ skb_put(qca->rx_skb, retcode);
+ qca->rx_skb->protocol = eth_type_trans(
+ qca->rx_skb, qca->rx_skb->dev);
+- qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
++ skb_checksum_none_assert(qca->rx_skb);
+ netif_rx_ni(qca->rx_skb);
+ qca->rx_skb = netdev_alloc_skb_ip_align(netdev,
+ netdev->mtu +
+diff --git a/drivers/net/ethernet/rdc/r6040.c b/drivers/net/ethernet/rdc/r6040.c
+index aa11b70b9ca48..2199bd08f4d6a 100644
+--- a/drivers/net/ethernet/rdc/r6040.c
++++ b/drivers/net/ethernet/rdc/r6040.c
+@@ -133,6 +133,8 @@
+ #define PHY_ST 0x8A /* PHY status register */
+ #define MAC_SM 0xAC /* MAC status machine */
+ #define MAC_SM_RST 0x0002 /* MAC status machine reset */
++#define MD_CSC 0xb6 /* MDC speed control register */
++#define MD_CSC_DEFAULT 0x0030
+ #define MAC_ID 0xBE /* Identifier register */
+
+ #define TX_DCNT 0x80 /* TX descriptor count */
+@@ -368,8 +370,9 @@ static void r6040_reset_mac(struct r6040_private *lp)
+ {
+ void __iomem *ioaddr = lp->base;
+ int limit = MAC_DEF_TIMEOUT;
+- u16 cmd;
++ u16 cmd, md_csc;
+
++ md_csc = ioread16(ioaddr + MD_CSC);
+ iowrite16(MAC_RST, ioaddr + MCR1);
+ while (limit--) {
+ cmd = ioread16(ioaddr + MCR1);
+@@ -381,6 +384,10 @@ static void r6040_reset_mac(struct r6040_private *lp)
+ iowrite16(MAC_SM_RST, ioaddr + MAC_SM);
+ iowrite16(0, ioaddr + MAC_SM);
+ mdelay(5);
++
++ /* Restore MDIO clock frequency */
++ if (md_csc != MD_CSC_DEFAULT)
++ iowrite16(md_csc, ioaddr + MD_CSC);
+ }
+
+ static void r6040_init_mac_regs(struct net_device *dev)
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 394ab9cdfe2c7..c44aea47c1208 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2547,6 +2547,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ else
+ txdesc->status |= cpu_to_le32(TD_TACT);
+
++ wmb(); /* cur_tx must be incremented after TACT bit was set */
+ mdp->cur_tx++;
+
+ if (!(sh_eth_read(ndev, EDTRR) & mdp->cd->edtrr_trns))
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+index 0f56f8e336917..03b11f191c262 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -288,10 +288,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
+ val &= ~NSS_COMMON_GMAC_CTL_PHY_IFACE_SEL;
+ break;
+ default:
+- dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
+- phy_modes(gmac->phy_mode));
+- err = -EINVAL;
+- goto err_remove_config_dt;
++ goto err_unsupported_phy;
+ }
+ regmap_write(gmac->nss_common, NSS_COMMON_GMAC_CTL(gmac->id), val);
+
+@@ -308,10 +305,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
+ NSS_COMMON_CLK_SRC_CTRL_OFFSET(gmac->id);
+ break;
+ default:
+- dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
+- phy_modes(gmac->phy_mode));
+- err = -EINVAL;
+- goto err_remove_config_dt;
++ goto err_unsupported_phy;
+ }
+ regmap_write(gmac->nss_common, NSS_COMMON_CLK_SRC_CTRL, val);
+
+@@ -328,8 +322,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
+ NSS_COMMON_CLK_GATE_GMII_TX_EN(gmac->id);
+ break;
+ default:
+- /* We don't get here; the switch above will have errored out */
+- unreachable();
++ goto err_unsupported_phy;
+ }
+ regmap_write(gmac->nss_common, NSS_COMMON_CLK_GATE, val);
+
+@@ -360,6 +353,11 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
+
+ return 0;
+
++err_unsupported_phy:
++ dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
++ phy_modes(gmac->phy_mode));
++ err = -EINVAL;
++
+ err_remove_config_dt:
+ stmmac_remove_config_dt(pdev, plat_dat);
+
+diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
+index d8ba512f166ad..41040756307a1 100644
+--- a/drivers/net/ethernet/wiznet/w5100.c
++++ b/drivers/net/ethernet/wiznet/w5100.c
+@@ -1059,6 +1059,8 @@ static int w5100_mmio_probe(struct platform_device *pdev)
+ mac_addr = data->mac_addr;
+
+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!mem)
++ return -EINVAL;
+ if (resource_size(mem) < W5100_BUS_DIRECT_SIZE)
+ ops = &w5100_mmio_indirect_ops;
+ else
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index 939de185bc6b8..178234e94cd16 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -736,10 +736,8 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ /* Kick off the transfer */
+ lp->dma_out(lp, TX_TAILDESC_PTR, tail_p); /* DMA start */
+
+- if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) {
+- netdev_info(ndev, "%s -> netif_stop_queue\n", __func__);
++ if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1))
+ netif_stop_queue(ndev);
+- }
+
+ return NETDEV_TX_OK;
+ }
+diff --git a/drivers/net/phy/dp83640_reg.h b/drivers/net/phy/dp83640_reg.h
+index 21aa24c741b96..daae7fa58fb82 100644
+--- a/drivers/net/phy/dp83640_reg.h
++++ b/drivers/net/phy/dp83640_reg.h
+@@ -5,7 +5,7 @@
+ #ifndef HAVE_DP83640_REGISTERS
+ #define HAVE_DP83640_REGISTERS
+
+-#define PAGE0 0x0000
++/* #define PAGE0 0x0000 */
+ #define PHYCR2 0x001c /* PHY Control Register 2 */
+
+ #define PAGE4 0x0004
+diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
+index 0362acd5cdcaa..cdd1b193fd4fe 100644
+--- a/drivers/net/usb/cdc_mbim.c
++++ b/drivers/net/usb/cdc_mbim.c
+@@ -655,6 +655,11 @@ static const struct usb_device_id mbim_devs[] = {
+ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
+ },
+
++ /* Telit LN920 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1061, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
++ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
++ },
++
+ /* default entry */
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+ .driver_info = (unsigned long)&cdc_mbim_info_zlp,
+diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
+index 987ebae8ea0e1..afa7a82ffd5d3 100644
+--- a/drivers/net/wireless/ath/ath6kl/wmi.c
++++ b/drivers/net/wireless/ath/ath6kl/wmi.c
+@@ -2513,8 +2513,10 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx)
+ goto free_data_skb;
+
+ for (index = 0; index < num_pri_streams; index++) {
+- if (WARN_ON(!data_sync_bufs[index].skb))
++ if (WARN_ON(!data_sync_bufs[index].skb)) {
++ ret = -ENOMEM;
+ goto free_data_skb;
++ }
+
+ ep_id = ath6kl_ac2_endpoint_id(wmi->parent_dev,
+ data_sync_bufs[index].
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+index 983e1abbd9e43..4d45d5a8ad2ed 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -3351,7 +3351,8 @@ found:
+ "Found block at %x: code=%d ref=%d length=%d major=%d minor=%d\n",
+ cptr, code, reference, length, major, minor);
+ if ((!AR_SREV_9485(ah) && length >= 1024) ||
+- (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485)) {
++ (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485) ||
++ (length > cptr)) {
+ ath_dbg(common, EEPROM, "Skipping bad header\n");
+ cptr -= COMP_HDR_LEN;
+ continue;
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 9f438d8e59f2f..daad9e7b17cf5 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1622,7 +1622,6 @@ static void ath9k_hw_apply_gpio_override(struct ath_hw *ah)
+ ath9k_hw_gpio_request_out(ah, i, NULL,
+ AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+ ath9k_hw_set_gpio(ah, i, !!(ah->gpio_val & BIT(i)));
+- ath9k_hw_gpio_free(ah, i);
+ }
+ }
+
+@@ -2729,14 +2728,17 @@ static void ath9k_hw_gpio_cfg_output_mux(struct ath_hw *ah, u32 gpio, u32 type)
+ static void ath9k_hw_gpio_cfg_soc(struct ath_hw *ah, u32 gpio, bool out,
+ const char *label)
+ {
++ int err;
++
+ if (ah->caps.gpio_requested & BIT(gpio))
+ return;
+
+- /* may be requested by BSP, free anyway */
+- gpio_free(gpio);
+-
+- if (gpio_request_one(gpio, out ? GPIOF_OUT_INIT_LOW : GPIOF_IN, label))
++ err = gpio_request_one(gpio, out ? GPIOF_OUT_INIT_LOW : GPIOF_IN, label);
++ if (err) {
++ ath_err(ath9k_hw_common(ah), "request GPIO%d failed:%d\n",
++ gpio, err);
+ return;
++ }
+
+ ah->caps.gpio_requested |= BIT(gpio);
+ }
+diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
+index ad5d3919435c9..87a41d0ededc1 100644
+--- a/drivers/ntb/test/ntb_perf.c
++++ b/drivers/ntb/test/ntb_perf.c
+@@ -600,6 +600,7 @@ static int perf_setup_inbuf(struct perf_peer *peer)
+ return -ENOMEM;
+ }
+ if (!IS_ALIGNED(peer->inbuf_xlat, xlat_align)) {
++ ret = -EINVAL;
+ dev_err(&perf->ntb->dev, "Unaligned inbuf allocated\n");
+ goto err_free_inbuf;
+ }
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 8798274dc3ba7..ffd6a7204509a 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -643,13 +643,13 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)
+ if (ret)
+ return ret;
+
+- ctrl->ctrl.queue_count = nr_io_queues + 1;
+- if (ctrl->ctrl.queue_count < 2) {
++ if (nr_io_queues == 0) {
+ dev_err(ctrl->ctrl.device,
+ "unable to set any I/O queues\n");
+ return -ENOMEM;
+ }
+
++ ctrl->ctrl.queue_count = nr_io_queues + 1;
+ dev_info(ctrl->ctrl.device,
+ "creating %d I/O queues.\n", nr_io_queues);
+
+diff --git a/drivers/of/kobj.c b/drivers/of/kobj.c
+index a32e60b024b8d..6675b5e56960c 100644
+--- a/drivers/of/kobj.c
++++ b/drivers/of/kobj.c
+@@ -119,7 +119,7 @@ int __of_attach_node_sysfs(struct device_node *np)
+ struct property *pp;
+ int rc;
+
+- if (!of_kset)
++ if (!IS_ENABLED(CONFIG_SYSFS) || !of_kset)
+ return 0;
+
+ np->kobj.kset = of_kset;
+diff --git a/drivers/parport/ieee1284_ops.c b/drivers/parport/ieee1284_ops.c
+index 5d41dda6da4e7..75daa16f38b7f 100644
+--- a/drivers/parport/ieee1284_ops.c
++++ b/drivers/parport/ieee1284_ops.c
+@@ -535,7 +535,7 @@ size_t parport_ieee1284_ecp_read_data (struct parport *port,
+ goto out;
+
+ /* Yield the port for a while. */
+- if (count && dev->port->irq != PARPORT_IRQ_NONE) {
++ if (dev->port->irq != PARPORT_IRQ_NONE) {
+ parport_release (dev);
+ schedule_timeout_interruptible(msecs_to_jiffies(40));
+ parport_claim_or_block (dev);
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index 74aa9da85aa26..a9669b28c2a6d 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -166,7 +166,7 @@
+ (PCIE_CONF_BUS(bus) | PCIE_CONF_DEV(PCI_SLOT(devfn)) | \
+ PCIE_CONF_FUNC(PCI_FUNC(devfn)) | PCIE_CONF_REG(where))
+
+-#define PIO_RETRY_CNT 500
++#define PIO_RETRY_CNT 750000 /* 1.5 s */
+ #define PIO_RETRY_DELAY 2 /* 2 us*/
+
+ #define LINK_WAIT_MAX_RETRIES 10
+@@ -181,6 +181,7 @@ struct advk_pcie {
+ struct list_head resources;
+ struct irq_domain *irq_domain;
+ struct irq_chip irq_chip;
++ raw_spinlock_t irq_lock;
+ struct irq_domain *msi_domain;
+ struct irq_domain *msi_inner_domain;
+ struct irq_chip msi_bottom_irq_chip;
+@@ -603,22 +604,28 @@ static void advk_pcie_irq_mask(struct irq_data *d)
+ {
+ struct advk_pcie *pcie = d->domain->host_data;
+ irq_hw_number_t hwirq = irqd_to_hwirq(d);
++ unsigned long flags;
+ u32 mask;
+
++ raw_spin_lock_irqsave(&pcie->irq_lock, flags);
+ mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
+ mask |= PCIE_ISR1_INTX_ASSERT(hwirq);
+ advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
++ raw_spin_unlock_irqrestore(&pcie->irq_lock, flags);
+ }
+
+ static void advk_pcie_irq_unmask(struct irq_data *d)
+ {
+ struct advk_pcie *pcie = d->domain->host_data;
+ irq_hw_number_t hwirq = irqd_to_hwirq(d);
++ unsigned long flags;
+ u32 mask;
+
++ raw_spin_lock_irqsave(&pcie->irq_lock, flags);
+ mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
+ mask &= ~PCIE_ISR1_INTX_ASSERT(hwirq);
+ advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
++ raw_spin_unlock_irqrestore(&pcie->irq_lock, flags);
+ }
+
+ static int advk_pcie_irq_map(struct irq_domain *h,
+@@ -701,6 +708,8 @@ static int advk_pcie_init_irq_domain(struct advk_pcie *pcie)
+ struct device_node *pcie_intc_node;
+ struct irq_chip *irq_chip;
+
++ raw_spin_lock_init(&pcie->irq_lock);
++
+ pcie_intc_node = of_get_next_child(node, NULL);
+ if (!pcie_intc_node) {
+ dev_err(dev, "No PCIe Intc node found\n");
+diff --git a/drivers/pci/controller/pcie-xilinx-nwl.c b/drivers/pci/controller/pcie-xilinx-nwl.c
+index 4850a1b8eec12..a86bd9660dae9 100644
+--- a/drivers/pci/controller/pcie-xilinx-nwl.c
++++ b/drivers/pci/controller/pcie-xilinx-nwl.c
+@@ -6,6 +6,7 @@
+ * (C) Copyright 2014 - 2015, Xilinx, Inc.
+ */
+
++#include <linux/clk.h>
+ #include <linux/delay.h>
+ #include <linux/interrupt.h>
+ #include <linux/irq.h>
+@@ -169,6 +170,7 @@ struct nwl_pcie {
+ u8 root_busno;
+ struct nwl_msi msi;
+ struct irq_domain *legacy_irq_domain;
++ struct clk *clk;
+ raw_spinlock_t leg_mask_lock;
+ };
+
+@@ -849,6 +851,16 @@ static int nwl_pcie_probe(struct platform_device *pdev)
+ return err;
+ }
+
++ pcie->clk = devm_clk_get(dev, NULL);
++ if (IS_ERR(pcie->clk))
++ return PTR_ERR(pcie->clk);
++
++ err = clk_prepare_enable(pcie->clk);
++ if (err) {
++ dev_err(dev, "can't enable PCIe ref clock\n");
++ return err;
++ }
++
+ err = nwl_pcie_bridge_init(pcie);
+ if (err) {
+ dev_err(dev, "HW Initialization failed\n");
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index bc80b0f0ea1ba..f65800d63856b 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -754,6 +754,9 @@ static void msix_mask_all(void __iomem *base, int tsize)
+ u32 ctrl = PCI_MSIX_ENTRY_CTRL_MASKBIT;
+ int i;
+
++ if (pci_msi_ignore_mask)
++ return;
++
+ for (i = 0; i < tsize; i++, base += PCI_MSIX_ENTRY_SIZE)
+ writel(ctrl, base + PCI_MSIX_ENTRY_VECTOR_CTRL);
+ }
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 9ebf32de85757..97d69b9be1d49 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -224,7 +224,7 @@ static int pci_dev_str_match_path(struct pci_dev *dev, const char *path,
+
+ *endptr = strchrnul(path, ';');
+
+- wpath = kmemdup_nul(path, *endptr - path, GFP_KERNEL);
++ wpath = kmemdup_nul(path, *endptr - path, GFP_ATOMIC);
+ if (!wpath)
+ return -ENOMEM;
+
+@@ -1591,11 +1591,7 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags)
+ * so that things like MSI message writing will behave as expected
+ * (e.g. if the device really is in D0 at enable time).
+ */
+- if (dev->pm_cap) {
+- u16 pmcsr;
+- pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
+- dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK);
+- }
++ pci_update_current_state(dev, dev->current_state);
+
+ if (atomic_inc_return(&dev->enable_cnt) > 1)
+ return 0; /* already enabled */
+@@ -2170,7 +2166,14 @@ static int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable
+ if (enable) {
+ int error;
+
+- if (pci_pme_capable(dev, state))
++ /*
++ * Enable PME signaling if the device can signal PME from
++ * D3cold regardless of whether or not it can signal PME from
++ * the current target state, because that will allow it to
++ * signal PME when the hierarchy above it goes into D3cold and
++ * the device itself ends up in D3cold as a result of that.
++ */
++ if (pci_pme_capable(dev, state) || pci_pme_capable(dev, PCI_D3cold))
+ pci_pme_active(dev, true);
+ else
+ ret = 1;
+@@ -2274,16 +2277,20 @@ static pci_power_t pci_target_state(struct pci_dev *dev, bool wakeup)
+ if (dev->current_state == PCI_D3cold)
+ target_state = PCI_D3cold;
+
+- if (wakeup) {
++ if (wakeup && dev->pme_support) {
++ pci_power_t state = target_state;
++
+ /*
+ * Find the deepest state from which the device can generate
+ * PME#.
+ */
+- if (dev->pme_support) {
+- while (target_state
+- && !(dev->pme_support & (1 << target_state)))
+- target_state--;
+- }
++ while (state && !(dev->pme_support & (1 << state)))
++ state--;
++
++ if (state)
++ return state;
++ else if (dev->pme_support & 1)
++ return PCI_D0;
+ }
+
+ return target_state;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 7e873b6b7d558..4eb8900b9a5cd 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3152,12 +3152,13 @@ static void fixup_mpss_256(struct pci_dev *dev)
+ {
+ dev->pcie_mpss = 1; /* 256 bytes */
+ }
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE,
+- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE,
+- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE,
+- PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
++ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
++ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
++ PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_ASMEDIA, 0x0612, fixup_mpss_256);
+
+ /*
+ * Intel 5000 and 5100 Memory controllers have an erratum with read completion
+@@ -4777,6 +4778,10 @@ static const struct pci_dev_acs_enabled {
+ { 0x10df, 0x720, pci_quirk_mf_endpoint_acs }, /* Emulex Skyhawk-R */
+ /* Cavium ThunderX */
+ { PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs },
++ /* Cavium multi-function devices */
++ { PCI_VENDOR_ID_CAVIUM, 0xA026, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_CAVIUM, 0xA059, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_CAVIUM, 0xA060, pci_quirk_mf_endpoint_acs },
+ /* APM X-Gene */
+ { PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs },
+ /* Ampere Computing */
+@@ -5253,7 +5258,7 @@ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
+ PCI_CLASS_MULTIMEDIA_HD_AUDIO, 8, quirk_gpu_hda);
+
+ /*
+- * Create device link for NVIDIA GPU with integrated USB xHCI Host
++ * Create device link for GPUs with integrated USB xHCI Host
+ * controller to VGA.
+ */
+ static void quirk_gpu_usb(struct pci_dev *usb)
+@@ -5262,9 +5267,11 @@ static void quirk_gpu_usb(struct pci_dev *usb)
+ }
+ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
+ PCI_CLASS_SERIAL_USB, 8, quirk_gpu_usb);
++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_ATI, PCI_ANY_ID,
++ PCI_CLASS_SERIAL_USB, 8, quirk_gpu_usb);
+
+ /*
+- * Create device link for NVIDIA GPU with integrated Type-C UCSI controller
++ * Create device link for GPUs with integrated Type-C UCSI controller
+ * to VGA. Currently there is no class code defined for UCSI device over PCI
+ * so using UNKNOWN class for now and it will be updated when UCSI
+ * over PCI gets a class code.
+@@ -5277,6 +5284,9 @@ static void quirk_gpu_usb_typec_ucsi(struct pci_dev *ucsi)
+ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
+ PCI_CLASS_SERIAL_UNKNOWN, 8,
+ quirk_gpu_usb_typec_ucsi);
++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_ATI, PCI_ANY_ID,
++ PCI_CLASS_SERIAL_UNKNOWN, 8,
++ quirk_gpu_usb_typec_ucsi);
+
+ /*
+ * Enable the NVIDIA GPU integrated HDA controller if the BIOS left it
+diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
+index a7bdd10fccf33..68ac8a0f5c72e 100644
+--- a/drivers/pci/syscall.c
++++ b/drivers/pci/syscall.c
+@@ -21,8 +21,10 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
+ long err;
+ int cfg_ret;
+
++ err = -EPERM;
++ dev = NULL;
+ if (!capable(CAP_SYS_ADMIN))
+- return -EPERM;
++ goto error;
+
+ err = -ENODEV;
+ dev = pci_get_domain_bus_and_slot(0, bus, dfn);
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 04a4e761e9a9c..c2f807bf34899 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -1201,6 +1201,7 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs,
+
+ if (PCS_HAS_PINCONF) {
+ dev_err(pcs->dev, "pinconf not supported\n");
++ res = -ENOTSUPP;
+ goto free_pingroups;
+ }
+
+diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
+index c05217edcb0e0..82407e4a16427 100644
+--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
+@@ -918,7 +918,7 @@ static int samsung_pinctrl_register(struct platform_device *pdev,
+ pin_bank->grange.pin_base = drvdata->pin_base
+ + pin_bank->pin_base;
+ pin_bank->grange.base = pin_bank->grange.pin_base;
+- pin_bank->grange.npins = pin_bank->gpio_chip.ngpio;
++ pin_bank->grange.npins = pin_bank->nr_pins;
+ pin_bank->grange.gc = &pin_bank->gpio_chip;
+ pinctrl_add_gpio_range(drvdata->pctl_dev, &pin_bank->grange);
+ }
+diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
+index ac784ac66ac34..2b807c8aa869c 100644
+--- a/drivers/platform/chrome/cros_ec_proto.c
++++ b/drivers/platform/chrome/cros_ec_proto.c
+@@ -219,6 +219,15 @@ static int cros_ec_host_command_proto_query(struct cros_ec_device *ec_dev,
+ msg->insize = sizeof(struct ec_response_get_protocol_info);
+
+ ret = send_command(ec_dev, msg);
++ /*
++ * Send command once again when timeout occurred.
++ * Fingerprint MCU (FPMCU) is restarted during system boot which
++ * introduces small window in which FPMCU won't respond for any
++ * messages sent by kernel. There is no need to wait before next
++ * attempt because we waited at least EC_MSG_DEADLINE_MS.
++ */
++ if (ret == -ETIMEDOUT)
++ ret = send_command(ec_dev, msg);
+
+ if (ret < 0) {
+ dev_dbg(ec_dev->dev,
+diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c
+index ccccce9b67efe..0ebcf412f6ca0 100644
+--- a/drivers/platform/x86/dell-smbios-wmi.c
++++ b/drivers/platform/x86/dell-smbios-wmi.c
+@@ -72,6 +72,7 @@ static int run_smbios_call(struct wmi_device *wdev)
+ if (obj->type == ACPI_TYPE_INTEGER)
+ dev_dbg(&wdev->dev, "SMBIOS call failed: %llu\n",
+ obj->integer.value);
++ kfree(output.pointer);
+ return -EIO;
+ }
+ memcpy(&priv->buf->std, obj->buffer.pointer, obj->buffer.length);
+diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c
+index 157cf5ec6b023..1641868c345c2 100644
+--- a/drivers/power/supply/axp288_fuel_gauge.c
++++ b/drivers/power/supply/axp288_fuel_gauge.c
+@@ -158,7 +158,7 @@ static int fuel_gauge_reg_readb(struct axp288_fg_info *info, int reg)
+ }
+
+ if (ret < 0) {
+- dev_err(&info->pdev->dev, "axp288 reg read err:%d\n", ret);
++ dev_err(&info->pdev->dev, "Error reading reg 0x%02x err: %d\n", reg, ret);
+ return ret;
+ }
+
+@@ -172,7 +172,7 @@ static int fuel_gauge_reg_writeb(struct axp288_fg_info *info, int reg, u8 val)
+ ret = regmap_write(info->regmap, reg, (unsigned int)val);
+
+ if (ret < 0)
+- dev_err(&info->pdev->dev, "axp288 reg write err:%d\n", ret);
++ dev_err(&info->pdev->dev, "Error writing reg 0x%02x err: %d\n", reg, ret);
+
+ return ret;
+ }
+diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
+index 00a3a581e0795..a1518eb6f6c0d 100644
+--- a/drivers/power/supply/max17042_battery.c
++++ b/drivers/power/supply/max17042_battery.c
+@@ -740,7 +740,7 @@ static inline void max17042_override_por_values(struct max17042_chip *chip)
+ struct max17042_config_data *config = chip->pdata->config_data;
+
+ max17042_override_por(map, MAX17042_TGAIN, config->tgain);
+- max17042_override_por(map, MAx17042_TOFF, config->toff);
++ max17042_override_por(map, MAX17042_TOFF, config->toff);
+ max17042_override_por(map, MAX17042_CGAIN, config->cgain);
+ max17042_override_por(map, MAX17042_COFF, config->coff);
+
+@@ -856,8 +856,12 @@ static irqreturn_t max17042_thread_handler(int id, void *dev)
+ {
+ struct max17042_chip *chip = dev;
+ u32 val;
++ int ret;
++
++ ret = regmap_read(chip->regmap, MAX17042_STATUS, &val);
++ if (ret)
++ return IRQ_HANDLED;
+
+- regmap_read(chip->regmap, MAX17042_STATUS, &val);
+ if ((val & STATUS_INTR_SOCMIN_BIT) ||
+ (val & STATUS_INTR_SOCMAX_BIT)) {
+ dev_info(&chip->client->dev, "SOC threshold INTR\n");
+diff --git a/drivers/rtc/rtc-tps65910.c b/drivers/rtc/rtc-tps65910.c
+index a9bbd022aeefe..9f10af7ac6efd 100644
+--- a/drivers/rtc/rtc-tps65910.c
++++ b/drivers/rtc/rtc-tps65910.c
+@@ -470,6 +470,6 @@ static struct platform_driver tps65910_rtc_driver = {
+ };
+
+ module_platform_driver(tps65910_rtc_driver);
+-MODULE_ALIAS("platform:rtc-tps65910");
++MODULE_ALIAS("platform:tps65910-rtc");
+ MODULE_AUTHOR("Venu Byravarasu <vbyravarasu@nvidia.com>");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
+index 825a8f2703b4f..6efe50d70c4bf 100644
+--- a/drivers/s390/cio/css.c
++++ b/drivers/s390/cio/css.c
+@@ -364,9 +364,26 @@ static ssize_t pimpampom_show(struct device *dev,
+ }
+ static DEVICE_ATTR_RO(pimpampom);
+
++static ssize_t dev_busid_show(struct device *dev,
++ struct device_attribute *attr,
++ char *buf)
++{
++ struct subchannel *sch = to_subchannel(dev);
++ struct pmcw *pmcw = &sch->schib.pmcw;
++
++ if ((pmcw->st == SUBCHANNEL_TYPE_IO ||
++ pmcw->st == SUBCHANNEL_TYPE_MSG) && pmcw->dnv)
++ return sysfs_emit(buf, "0.%x.%04x\n", sch->schid.ssid,
++ pmcw->dev);
++ else
++ return sysfs_emit(buf, "none\n");
++}
++static DEVICE_ATTR_RO(dev_busid);
++
+ static struct attribute *io_subchannel_type_attrs[] = {
+ &dev_attr_chpids.attr,
+ &dev_attr_pimpampom.attr,
++ &dev_attr_dev_busid.attr,
+ NULL,
+ };
+ ATTRIBUTE_GROUPS(io_subchannel_type);
+diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
+index 79b5c5457cc22..b8dd9986809b4 100644
+--- a/drivers/scsi/BusLogic.c
++++ b/drivers/scsi/BusLogic.c
+@@ -3605,7 +3605,7 @@ static void blogic_msg(enum blogic_msglevel msglevel, char *fmt,
+ if (buf[0] != '\n' || len > 1)
+ printk("%sscsi%d: %s", blogic_msglevelmap[msglevel], adapter->host_no, buf);
+ } else
+- printk("%s", buf);
++ pr_cont("%s", buf);
+ } else {
+ if (begin) {
+ if (adapter != NULL && adapter->adapter_initd)
+@@ -3613,7 +3613,7 @@ static void blogic_msg(enum blogic_msglevel msglevel, char *fmt,
+ else
+ printk("%s%s", blogic_msglevelmap[msglevel], buf);
+ } else
+- printk("%s", buf);
++ pr_cont("%s", buf);
+ }
+ begin = (buf[len - 1] == '\n');
+ }
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index 7665fd641886e..ab66e1f0fdfa3 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -1507,7 +1507,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
+ {
+ u32 *list;
+ int i;
+- int status = 0, rc;
++ int status;
+ u32 *pbl;
+ dma_addr_t page;
+ int num_pages;
+@@ -1518,14 +1518,14 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
+ */
+ if (!qedi->num_queues) {
+ QEDI_ERR(&qedi->dbg_ctx, "No MSI-X vectors available!\n");
+- return 1;
++ return -ENOMEM;
+ }
+
+ /* Make sure we allocated the PBL that will contain the physical
+ * addresses of our queues
+ */
+ if (!qedi->p_cpuq) {
+- status = 1;
++ status = -EINVAL;
+ goto mem_alloc_failure;
+ }
+
+@@ -1540,13 +1540,13 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
+ "qedi->global_queues=%p.\n", qedi->global_queues);
+
+ /* Allocate DMA coherent buffers for BDQ */
+- rc = qedi_alloc_bdq(qedi);
+- if (rc)
++ status = qedi_alloc_bdq(qedi);
++ if (status)
+ goto mem_alloc_failure;
+
+ /* Allocate DMA coherent buffers for NVM_ISCSI_CFG */
+- rc = qedi_alloc_nvm_iscsi_cfg(qedi);
+- if (rc)
++ status = qedi_alloc_nvm_iscsi_cfg(qedi);
++ if (status)
+ goto mem_alloc_failure;
+
+ /* Allocate a CQ and an associated PBL for each MSI-X
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 7821c1695e824..dcd0f058f23e0 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -88,8 +88,9 @@ static int qla_nvme_alloc_queue(struct nvme_fc_local_port *lport,
+ struct qla_hw_data *ha;
+ struct qla_qpair *qpair;
+
+- if (!qidx)
+- qidx++;
++ /* Map admin queue and 1st IO queue to index 0 */
++ if (qidx)
++ qidx--;
+
+ vha = (struct scsi_qla_host *)lport->private;
+ ha = vha->hw;
+diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c
+index 50214b620865e..2b49d2c212dab 100644
+--- a/drivers/soc/qcom/smsm.c
++++ b/drivers/soc/qcom/smsm.c
+@@ -117,7 +117,7 @@ struct smsm_entry {
+ DECLARE_BITMAP(irq_enabled, 32);
+ DECLARE_BITMAP(irq_rising, 32);
+ DECLARE_BITMAP(irq_falling, 32);
+- u32 last_value;
++ unsigned long last_value;
+
+ u32 *remote_state;
+ u32 *subscription;
+@@ -212,8 +212,7 @@ static irqreturn_t smsm_intr(int irq, void *data)
+ u32 val;
+
+ val = readl(entry->remote_state);
+- changed = val ^ entry->last_value;
+- entry->last_value = val;
++ changed = val ^ xchg(&entry->last_value, val);
+
+ for_each_set_bit(i, entry->irq_enabled, 32) {
+ if (!(changed & BIT(i)))
+@@ -274,6 +273,12 @@ static void smsm_unmask_irq(struct irq_data *irqd)
+ struct qcom_smsm *smsm = entry->smsm;
+ u32 val;
+
++ /* Make sure our last cached state is up-to-date */
++ if (readl(entry->remote_state) & BIT(irq))
++ set_bit(irq, &entry->last_value);
++ else
++ clear_bit(irq, &entry->last_value);
++
+ set_bit(irq, entry->irq_enabled);
+
+ if (entry->subscription) {
+diff --git a/drivers/soc/rockchip/Kconfig b/drivers/soc/rockchip/Kconfig
+index 20da55d9cbb1e..d483b0e29b81f 100644
+--- a/drivers/soc/rockchip/Kconfig
++++ b/drivers/soc/rockchip/Kconfig
+@@ -5,8 +5,8 @@ if ARCH_ROCKCHIP || COMPILE_TEST
+ #
+
+ config ROCKCHIP_GRF
+- bool
+- default y
++ bool "Rockchip General Register Files support" if COMPILE_TEST
++ default y if ARCH_ROCKCHIP
+ help
+ The General Register Files are a central component providing
+ special additional settings registers for a lot of soc-components.
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 25486ee8379b6..cfbf1ffb61bff 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -430,6 +430,7 @@ static int dspi_request_dma(struct fsl_dspi *dspi, phys_addr_t phy_addr)
+ goto err_rx_dma_buf;
+ }
+
++ memset(&cfg, 0, sizeof(cfg));
+ cfg.src_addr = phy_addr + SPI_POPR;
+ cfg.dst_addr = phy_addr + SPI_PUSHR;
+ cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c
+index 661a40c653e90..d8cdb13ce3e4a 100644
+--- a/drivers/spi/spi-pic32.c
++++ b/drivers/spi/spi-pic32.c
+@@ -369,6 +369,7 @@ static int pic32_spi_dma_config(struct pic32_spi *pic32s, u32 dma_width)
+ struct dma_slave_config cfg;
+ int ret;
+
++ memset(&cfg, 0, sizeof(cfg));
+ cfg.device_fc = true;
+ cfg.src_addr = pic32s->dma_base + buf_offset;
+ cfg.dst_addr = pic32s->dma_base + buf_offset;
+diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
+index e41976010dc48..97f44458ee7b7 100644
+--- a/drivers/spi/spi-sprd-adi.c
++++ b/drivers/spi/spi-sprd-adi.c
+@@ -99,7 +99,7 @@
+ #define HWRST_STATUS_SPRDISK 0xc0
+
+ /* Use default timeout 50 ms that converts to watchdog values */
+-#define WDG_LOAD_VAL ((50 * 1000) / 32768)
++#define WDG_LOAD_VAL ((50 * 32768) / 1000)
+ #define WDG_LOAD_MASK GENMASK(15, 0)
+ #define WDG_UNLOCK_KEY 0xe551
+
+diff --git a/drivers/staging/board/board.c b/drivers/staging/board/board.c
+index cb6feb34dd401..f980af0373452 100644
+--- a/drivers/staging/board/board.c
++++ b/drivers/staging/board/board.c
+@@ -136,6 +136,7 @@ int __init board_staging_register_clock(const struct board_staging_clk *bsc)
+ static int board_staging_add_dev_domain(struct platform_device *pdev,
+ const char *domain)
+ {
++ struct device *dev = &pdev->dev;
+ struct of_phandle_args pd_args;
+ struct device_node *np;
+
+@@ -148,7 +149,11 @@ static int board_staging_add_dev_domain(struct platform_device *pdev,
+ pd_args.np = np;
+ pd_args.args_count = 0;
+
+- return of_genpd_add_device(&pd_args, &pdev->dev);
++ /* Initialization similar to device_pm_init_common() */
++ spin_lock_init(&dev->power.lock);
++ dev->power.early_init = true;
++
++ return of_genpd_add_device(&pd_args, dev);
+ }
+ #else
+ static inline int board_staging_add_dev_domain(struct platform_device *pdev,
+diff --git a/drivers/staging/ks7010/ks7010_sdio.c b/drivers/staging/ks7010/ks7010_sdio.c
+index 74551eb717fc7..79d0513bd2828 100644
+--- a/drivers/staging/ks7010/ks7010_sdio.c
++++ b/drivers/staging/ks7010/ks7010_sdio.c
+@@ -938,9 +938,9 @@ static void ks7010_private_init(struct ks_wlan_private *priv,
+ memset(&priv->wstats, 0, sizeof(priv->wstats));
+
+ /* sleep mode */
++ atomic_set(&priv->sleepstatus.status, 0);
+ atomic_set(&priv->sleepstatus.doze_request, 0);
+ atomic_set(&priv->sleepstatus.wakeup_request, 0);
+- atomic_set(&priv->sleepstatus.wakeup_request, 0);
+
+ trx_device_init(priv);
+ hostif_init(priv);
+diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c
+index c9a6d97938f63..68889d082c3c7 100644
+--- a/drivers/staging/rts5208/rtsx_scsi.c
++++ b/drivers/staging/rts5208/rtsx_scsi.c
+@@ -2841,10 +2841,10 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip)
+ }
+
+ if (dev_info_id == 0x15) {
+- buf_len = 0x3A;
++ buf_len = 0x3C;
+ data_len = 0x3A;
+ } else {
+- buf_len = 0x6A;
++ buf_len = 0x6C;
+ data_len = 0x6A;
+ }
+
+@@ -2895,11 +2895,7 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip)
+ }
+
+ rtsx_stor_set_xfer_buf(buf, buf_len, srb);
+-
+- if (dev_info_id == 0x15)
+- scsi_set_resid(srb, scsi_bufflen(srb) - 0x3C);
+- else
+- scsi_set_resid(srb, scsi_bufflen(srb) - 0x6C);
++ scsi_set_resid(srb, scsi_bufflen(srb) - buf_len);
+
+ kfree(buf);
+ return STATUS_SUCCESS;
+diff --git a/drivers/tty/hvc/hvsi.c b/drivers/tty/hvc/hvsi.c
+index 66f95f758be05..73226337f5610 100644
+--- a/drivers/tty/hvc/hvsi.c
++++ b/drivers/tty/hvc/hvsi.c
+@@ -1038,7 +1038,7 @@ static const struct tty_operations hvsi_ops = {
+
+ static int __init hvsi_init(void)
+ {
+- int i;
++ int i, ret;
+
+ hvsi_driver = alloc_tty_driver(hvsi_count);
+ if (!hvsi_driver)
+@@ -1069,12 +1069,25 @@ static int __init hvsi_init(void)
+ }
+ hvsi_wait = wait_for_state; /* irqs active now */
+
+- if (tty_register_driver(hvsi_driver))
+- panic("Couldn't register hvsi console driver\n");
++ ret = tty_register_driver(hvsi_driver);
++ if (ret) {
++ pr_err("Couldn't register hvsi console driver\n");
++ goto err_free_irq;
++ }
+
+ printk(KERN_DEBUG "HVSI: registered %i devices\n", hvsi_count);
+
+ return 0;
++err_free_irq:
++ hvsi_wait = poll_for_state;
++ for (i = 0; i < hvsi_count; i++) {
++ struct hvsi_struct *hp = &hvsi_ports[i];
++
++ free_irq(hp->virq, hp);
++ }
++ tty_driver_kref_put(hvsi_driver);
++
++ return ret;
+ }
+ device_initcall(hvsi_init);
+
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 725e5842b8acc..f54c18e4ae909 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -70,7 +70,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
+
+ static int
+ setup_port(struct serial_private *priv, struct uart_8250_port *port,
+- int bar, int offset, int regshift)
++ u8 bar, unsigned int offset, int regshift)
+ {
+ struct pci_dev *dev = priv->dev;
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 68f71298c11b5..39e821d6e5376 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -132,7 +132,8 @@ static const struct serial8250_config uart_config[] = {
+ .name = "16C950/954",
+ .fifo_size = 128,
+ .tx_loadsz = 128,
+- .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
++ .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_01,
++ .rxtrig_bytes = {16, 32, 112, 120},
+ /* UART_CAP_EFR breaks billionon CF bluetooth card. */
+ .flags = UART_CAP_FIFO | UART_CAP_SLEEP,
+ },
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index deb9d4fa9cb09..b757fd1bdbfa5 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -2164,7 +2164,7 @@ static int lpuart_probe(struct platform_device *pdev)
+ return PTR_ERR(sport->port.membase);
+
+ sport->port.membase += sdata->reg_off;
+- sport->port.mapbase = res->start;
++ sport->port.mapbase = res->start + sdata->reg_off;
+ sport->port.dev = &pdev->dev;
+ sport->port.type = PORT_LPUART;
+ ret = platform_get_irq(pdev, 0);
+diff --git a/drivers/tty/serial/jsm/jsm_neo.c b/drivers/tty/serial/jsm/jsm_neo.c
+index bf0e2a4cb0cef..c6f927a76c3be 100644
+--- a/drivers/tty/serial/jsm/jsm_neo.c
++++ b/drivers/tty/serial/jsm/jsm_neo.c
+@@ -815,7 +815,9 @@ static void neo_parse_isr(struct jsm_board *brd, u32 port)
+ /* Parse any modem signal changes */
+ jsm_dbg(INTR, &ch->ch_bd->pci_dev,
+ "MOD_STAT: sending to parse_modem_sigs\n");
++ spin_lock_irqsave(&ch->uart_port.lock, lock_flags);
+ neo_parse_modem(ch, readb(&ch->ch_neo_uart->msr));
++ spin_unlock_irqrestore(&ch->uart_port.lock, lock_flags);
+ }
+ }
+
+diff --git a/drivers/tty/serial/jsm/jsm_tty.c b/drivers/tty/serial/jsm/jsm_tty.c
+index 689774c073ca4..8438454ca653f 100644
+--- a/drivers/tty/serial/jsm/jsm_tty.c
++++ b/drivers/tty/serial/jsm/jsm_tty.c
+@@ -187,6 +187,7 @@ static void jsm_tty_break(struct uart_port *port, int break_state)
+
+ static int jsm_tty_open(struct uart_port *port)
+ {
++ unsigned long lock_flags;
+ struct jsm_board *brd;
+ struct jsm_channel *channel =
+ container_of(port, struct jsm_channel, uart_port);
+@@ -240,6 +241,7 @@ static int jsm_tty_open(struct uart_port *port)
+ channel->ch_cached_lsr = 0;
+ channel->ch_stops_sent = 0;
+
++ spin_lock_irqsave(&port->lock, lock_flags);
+ termios = &port->state->port.tty->termios;
+ channel->ch_c_cflag = termios->c_cflag;
+ channel->ch_c_iflag = termios->c_iflag;
+@@ -259,6 +261,7 @@ static int jsm_tty_open(struct uart_port *port)
+ jsm_carrier(channel);
+
+ channel->ch_open_count++;
++ spin_unlock_irqrestore(&port->lock, lock_flags);
+
+ jsm_dbg(OPEN, &channel->ch_bd->pci_dev, "finish\n");
+ return 0;
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index db5b11879910c..6f44c5f0ef3aa 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1750,6 +1750,10 @@ static irqreturn_t sci_br_interrupt(int irq, void *ptr)
+
+ /* Handle BREAKs */
+ sci_handle_breaks(port);
++
++ /* drop invalid character received before break was detected */
++ serial_port_in(port, SCxRDR);
++
+ sci_clear_SCxSR(port, SCxSR_BREAK_CLEAR(port));
+
+ return IRQ_HANDLED;
+@@ -1829,7 +1833,8 @@ static irqreturn_t sci_mpxed_interrupt(int irq, void *ptr)
+ ret = sci_er_interrupt(irq, ptr);
+
+ /* Break Interrupt */
+- if ((ssr_status & SCxSR_BRK(port)) && err_enabled)
++ if (s->irqs[SCIx_ERI_IRQ] != s->irqs[SCIx_BRI_IRQ] &&
++ (ssr_status & SCxSR_BRK(port)) && err_enabled)
+ ret = sci_br_interrupt(irq, ptr);
+
+ /* Overrun Interrupt */
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 9e9343adc2b46..b6f42d0ee6269 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2173,8 +2173,6 @@ static int tty_fasync(int fd, struct file *filp, int on)
+ * Locking:
+ * Called functions take tty_ldiscs_lock
+ * current->signal->tty check is safe without locks
+- *
+- * FIXME: may race normal receive processing
+ */
+
+ static int tiocsti(struct tty_struct *tty, char __user *p)
+@@ -2190,8 +2188,10 @@ static int tiocsti(struct tty_struct *tty, char __user *p)
+ ld = tty_ldisc_ref_wait(tty);
+ if (!ld)
+ return -EIO;
++ tty_buffer_lock_exclusive(tty->port);
+ if (ld->ops->receive_buf)
+ ld->ops->receive_buf(tty, &ch, &mbz, 1);
++ tty_buffer_unlock_exclusive(tty->port);
+ tty_ldisc_deref(ld);
+ return 0;
+ }
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index d85bb3ba8263f..a76ed4acb5700 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -481,7 +481,7 @@ static u8 encode_bMaxPower(enum usb_device_speed speed,
+ {
+ unsigned val;
+
+- if (c->MaxPower)
++ if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER))
+ val = c->MaxPower;
+ else
+ val = CONFIG_USB_GADGET_VBUS_DRAW;
+@@ -891,7 +891,11 @@ static int set_config(struct usb_composite_dev *cdev,
+ }
+
+ /* when we return, be sure our power usage is valid */
+- power = c->MaxPower ? c->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW;
++ if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER))
++ power = c->MaxPower;
++ else
++ power = CONFIG_USB_GADGET_VBUS_DRAW;
++
+ if (gadget->speed < USB_SPEED_SUPER)
+ power = min(power, 500U);
+ else
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 156651df6b4da..d7a12161e5531 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -491,8 +491,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
+ }
+ spin_unlock_irqrestore(&dev->lock, flags);
+
+- if (skb && !in) {
+- dev_kfree_skb_any(skb);
++ if (!in) {
++ if (skb)
++ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+ }
+
+diff --git a/drivers/usb/gadget/udc/at91_udc.c b/drivers/usb/gadget/udc/at91_udc.c
+index 03959dc86cfd8..dd5cdcdfa4030 100644
+--- a/drivers/usb/gadget/udc/at91_udc.c
++++ b/drivers/usb/gadget/udc/at91_udc.c
+@@ -1879,7 +1879,9 @@ static int at91udc_probe(struct platform_device *pdev)
+ clk_disable(udc->iclk);
+
+ /* request UDC and maybe VBUS irqs */
+- udc->udp_irq = platform_get_irq(pdev, 0);
++ udc->udp_irq = retval = platform_get_irq(pdev, 0);
++ if (retval < 0)
++ goto err_unprepare_iclk;
+ retval = devm_request_irq(dev, udc->udp_irq, at91_udc_irq, 0,
+ driver_name, udc);
+ if (retval) {
+diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c
+index e174b1b889da5..d04de117bf639 100644
+--- a/drivers/usb/gadget/udc/bdc/bdc_core.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c
+@@ -568,7 +568,8 @@ static int bdc_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(dev,
+ "No suitable DMA config available, abort\n");
+- return -ENOTSUPP;
++ ret = -ENOTSUPP;
++ goto phycleanup;
+ }
+ dev_dbg(dev, "Using 32-bit address\n");
+ }
+diff --git a/drivers/usb/gadget/udc/mv_u3d_core.c b/drivers/usb/gadget/udc/mv_u3d_core.c
+index 35e02a8d0091a..bdba3f48c0527 100644
+--- a/drivers/usb/gadget/udc/mv_u3d_core.c
++++ b/drivers/usb/gadget/udc/mv_u3d_core.c
+@@ -1922,14 +1922,6 @@ static int mv_u3d_probe(struct platform_device *dev)
+ goto err_get_irq;
+ }
+ u3d->irq = r->start;
+- if (request_irq(u3d->irq, mv_u3d_irq,
+- IRQF_SHARED, driver_name, u3d)) {
+- u3d->irq = 0;
+- dev_err(&dev->dev, "Request irq %d for u3d failed\n",
+- u3d->irq);
+- retval = -ENODEV;
+- goto err_request_irq;
+- }
+
+ /* initialize gadget structure */
+ u3d->gadget.ops = &mv_u3d_ops; /* usb_gadget_ops */
+@@ -1942,6 +1934,15 @@ static int mv_u3d_probe(struct platform_device *dev)
+
+ mv_u3d_eps_init(u3d);
+
++ if (request_irq(u3d->irq, mv_u3d_irq,
++ IRQF_SHARED, driver_name, u3d)) {
++ u3d->irq = 0;
++ dev_err(&dev->dev, "Request irq %d for u3d failed\n",
++ u3d->irq);
++ retval = -ENODEV;
++ goto err_request_irq;
++ }
++
+ /* external vbus detection */
+ if (u3d->vbus) {
+ u3d->clock_gating = 1;
+@@ -1965,8 +1966,8 @@ static int mv_u3d_probe(struct platform_device *dev)
+
+ err_unregister:
+ free_irq(u3d->irq, u3d);
+-err_request_irq:
+ err_get_irq:
++err_request_irq:
+ kfree(u3d->status_req);
+ err_alloc_status_req:
+ kfree(u3d->eps);
+diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c
+index 1ad72647a0691..da0f36af0b380 100644
+--- a/drivers/usb/host/ehci-orion.c
++++ b/drivers/usb/host/ehci-orion.c
+@@ -250,8 +250,11 @@ static int ehci_orion_drv_probe(struct platform_device *pdev)
+ * the clock does not exists.
+ */
+ priv->clk = devm_clk_get(&pdev->dev, NULL);
+- if (!IS_ERR(priv->clk))
+- clk_prepare_enable(priv->clk);
++ if (!IS_ERR(priv->clk)) {
++ err = clk_prepare_enable(priv->clk);
++ if (err)
++ goto err_put_hcd;
++ }
+
+ priv->phy = devm_phy_optional_get(&pdev->dev, "usb");
+ if (IS_ERR(priv->phy)) {
+@@ -312,6 +315,7 @@ err_phy_init:
+ err_phy_get:
+ if (!IS_ERR(priv->clk))
+ clk_disable_unprepare(priv->clk);
++err_put_hcd:
+ usb_put_hcd(hcd);
+ err:
+ dev_err(&pdev->dev, "init %s fail, %d\n",
+diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
+index 226b38274a6ef..1577424319613 100644
+--- a/drivers/usb/host/fotg210-hcd.c
++++ b/drivers/usb/host/fotg210-hcd.c
+@@ -2509,11 +2509,6 @@ retry_xacterr:
+ return count;
+ }
+
+-/* high bandwidth multiplier, as encoded in highspeed endpoint descriptors */
+-#define hb_mult(wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03))
+-/* ... and packet size, for any kind of endpoint descriptor */
+-#define max_packet(wMaxPacketSize) ((wMaxPacketSize) & 0x07ff)
+-
+ /* reverse of qh_urb_transaction: free a list of TDs.
+ * used for cleanup after errors, before HC sees an URB's TDs.
+ */
+@@ -2599,7 +2594,7 @@ static struct list_head *qh_urb_transaction(struct fotg210_hcd *fotg210,
+ token |= (1 /* "in" */ << 8);
+ /* else it's already initted to "out" pid (0 << 8) */
+
+- maxpacket = max_packet(usb_maxpacket(urb->dev, urb->pipe, !is_input));
++ maxpacket = usb_maxpacket(urb->dev, urb->pipe, !is_input);
+
+ /*
+ * buffer gets wrapped in one or more qtds;
+@@ -2713,9 +2708,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
+ gfp_t flags)
+ {
+ struct fotg210_qh *qh = fotg210_qh_alloc(fotg210, flags);
++ struct usb_host_endpoint *ep;
+ u32 info1 = 0, info2 = 0;
+ int is_input, type;
+ int maxp = 0;
++ int mult;
+ struct usb_tt *tt = urb->dev->tt;
+ struct fotg210_qh_hw *hw;
+
+@@ -2730,14 +2727,15 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
+
+ is_input = usb_pipein(urb->pipe);
+ type = usb_pipetype(urb->pipe);
+- maxp = usb_maxpacket(urb->dev, urb->pipe, !is_input);
++ ep = usb_pipe_endpoint(urb->dev, urb->pipe);
++ maxp = usb_endpoint_maxp(&ep->desc);
++ mult = usb_endpoint_maxp_mult(&ep->desc);
+
+ /* 1024 byte maxpacket is a hardware ceiling. High bandwidth
+ * acts like up to 3KB, but is built from smaller packets.
+ */
+- if (max_packet(maxp) > 1024) {
+- fotg210_dbg(fotg210, "bogus qh maxpacket %d\n",
+- max_packet(maxp));
++ if (maxp > 1024) {
++ fotg210_dbg(fotg210, "bogus qh maxpacket %d\n", maxp);
+ goto done;
+ }
+
+@@ -2751,8 +2749,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
+ */
+ if (type == PIPE_INTERRUPT) {
+ qh->usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH,
+- is_input, 0,
+- hb_mult(maxp) * max_packet(maxp)));
++ is_input, 0, mult * maxp));
+ qh->start = NO_FRAME;
+
+ if (urb->dev->speed == USB_SPEED_HIGH) {
+@@ -2789,7 +2786,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
+ think_time = tt ? tt->think_time : 0;
+ qh->tt_usecs = NS_TO_US(think_time +
+ usb_calc_bus_time(urb->dev->speed,
+- is_input, 0, max_packet(maxp)));
++ is_input, 0, maxp));
+ qh->period = urb->interval;
+ if (qh->period > fotg210->periodic_size) {
+ qh->period = fotg210->periodic_size;
+@@ -2852,11 +2849,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
+ * to help them do so. So now people expect to use
+ * such nonconformant devices with Linux too; sigh.
+ */
+- info1 |= max_packet(maxp) << 16;
++ info1 |= maxp << 16;
+ info2 |= (FOTG210_TUNE_MULT_HS << 30);
+ } else { /* PIPE_INTERRUPT */
+- info1 |= max_packet(maxp) << 16;
+- info2 |= hb_mult(maxp) << 30;
++ info1 |= maxp << 16;
++ info2 |= mult << 30;
+ }
+ break;
+ default:
+@@ -3926,6 +3923,7 @@ static void iso_stream_init(struct fotg210_hcd *fotg210,
+ int is_input;
+ long bandwidth;
+ unsigned multi;
++ struct usb_host_endpoint *ep;
+
+ /*
+ * this might be a "high bandwidth" highspeed endpoint,
+@@ -3933,14 +3931,14 @@ static void iso_stream_init(struct fotg210_hcd *fotg210,
+ */
+ epnum = usb_pipeendpoint(pipe);
+ is_input = usb_pipein(pipe) ? USB_DIR_IN : 0;
+- maxp = usb_maxpacket(dev, pipe, !is_input);
++ ep = usb_pipe_endpoint(dev, pipe);
++ maxp = usb_endpoint_maxp(&ep->desc);
+ if (is_input)
+ buf1 = (1 << 11);
+ else
+ buf1 = 0;
+
+- maxp = max_packet(maxp);
+- multi = hb_mult(maxp);
++ multi = usb_endpoint_maxp_mult(&ep->desc);
+ buf1 |= maxp;
+ maxp *= multi;
+
+@@ -4461,13 +4459,12 @@ static bool itd_complete(struct fotg210_hcd *fotg210, struct fotg210_itd *itd)
+
+ /* HC need not update length with this error */
+ if (!(t & FOTG210_ISOC_BABBLE)) {
+- desc->actual_length =
+- fotg210_itdlen(urb, desc, t);
++ desc->actual_length = FOTG210_ITD_LENGTH(t);
+ urb->actual_length += desc->actual_length;
+ }
+ } else if (likely((t & FOTG210_ISOC_ACTIVE) == 0)) {
+ desc->status = 0;
+- desc->actual_length = fotg210_itdlen(urb, desc, t);
++ desc->actual_length = FOTG210_ITD_LENGTH(t);
+ urb->actual_length += desc->actual_length;
+ } else {
+ /* URB was too late */
+diff --git a/drivers/usb/host/fotg210.h b/drivers/usb/host/fotg210.h
+index 7fcd785c7bc85..0f1da9503bc67 100644
+--- a/drivers/usb/host/fotg210.h
++++ b/drivers/usb/host/fotg210.h
+@@ -683,11 +683,6 @@ static inline unsigned fotg210_read_frame_index(struct fotg210_hcd *fotg210)
+ return fotg210_readl(fotg210, &fotg210->regs->frame_index);
+ }
+
+-#define fotg210_itdlen(urb, desc, t) ({ \
+- usb_pipein((urb)->pipe) ? \
+- (desc)->length - FOTG210_ITD_LENGTH(t) : \
+- FOTG210_ITD_LENGTH(t); \
+-})
+ /*-------------------------------------------------------------------------*/
+
+ #endif /* __LINUX_FOTG210_H */
+diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c
+index a631dbb369d76..983a00e2988dc 100644
+--- a/drivers/usb/host/ohci-tmio.c
++++ b/drivers/usb/host/ohci-tmio.c
+@@ -199,6 +199,9 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev)
+ if (!cell)
+ return -EINVAL;
+
++ if (irq < 0)
++ return irq;
++
+ hcd = usb_create_hcd(&ohci_tmio_hc_driver, &dev->dev, dev_name(&dev->dev));
+ if (!hcd) {
+ ret = -ENOMEM;
+diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
+index 2b0ccd150209f..4ebbe2c232926 100644
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -143,6 +143,13 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd)
+ const struct soc_device_attribute *attr;
+ const char *firmware_name;
+
++ /*
++ * According to the datasheet, "Upon the completion of FW Download,
++ * there is no need to write or reload FW".
++ */
++ if (readl(regs + RCAR_USB3_DL_CTRL) & RCAR_USB3_DL_CTRL_FW_SUCCESS)
++ return 0;
++
+ attr = soc_device_match(rcar_quirks_match);
+ if (attr)
+ quirks = (uintptr_t)attr->data;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index c4e3760abd5b4..bebab0ec29786 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4580,19 +4580,19 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci,
+ {
+ unsigned long long timeout_ns;
+
+- if (xhci->quirks & XHCI_INTEL_HOST)
+- timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
+- else
+- timeout_ns = udev->u1_params.sel;
+-
+ /* Prevent U1 if service interval is shorter than U1 exit latency */
+ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
+- if (xhci_service_interval_to_ns(desc) <= timeout_ns) {
++ if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) {
+ dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n");
+ return USB3_LPM_DISABLED;
+ }
+ }
+
++ if (xhci->quirks & XHCI_INTEL_HOST)
++ timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
++ else
++ timeout_ns = udev->u1_params.sel;
++
+ /* The U1 timeout is encoded in 1us intervals.
+ * Don't return a timeout of zero, because that's USB3_LPM_DISABLED.
+ */
+@@ -4644,19 +4644,19 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci,
+ {
+ unsigned long long timeout_ns;
+
+- if (xhci->quirks & XHCI_INTEL_HOST)
+- timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
+- else
+- timeout_ns = udev->u2_params.sel;
+-
+ /* Prevent U2 if service interval is shorter than U2 exit latency */
+ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
+- if (xhci_service_interval_to_ns(desc) <= timeout_ns) {
++ if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) {
+ dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n");
+ return USB3_LPM_DISABLED;
+ }
+ }
+
++ if (xhci->quirks & XHCI_INTEL_HOST)
++ timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
++ else
++ timeout_ns = udev->u2_params.sel;
++
+ /* The U2 timeout is encoded in 256us intervals */
+ timeout_ns = DIV_ROUND_UP_ULL(timeout_ns, 256 * 1000);
+ /* If the necessary timeout value is bigger than what we can set in the
+diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
+index 3828ed6d38a21..270721cf229f7 100644
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -69,14 +69,12 @@ static int mtu3_ep_enable(struct mtu3_ep *mep)
+ u32 interval = 0;
+ u32 mult = 0;
+ u32 burst = 0;
+- int max_packet;
+ int ret;
+
+ desc = mep->desc;
+ comp_desc = mep->comp_desc;
+ mep->type = usb_endpoint_type(desc);
+- max_packet = usb_endpoint_maxp(desc);
+- mep->maxp = max_packet & GENMASK(10, 0);
++ mep->maxp = usb_endpoint_maxp(desc);
+
+ switch (mtu->g.speed) {
+ case USB_SPEED_SUPER:
+@@ -97,7 +95,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep)
+ usb_endpoint_xfer_int(desc)) {
+ interval = desc->bInterval;
+ interval = clamp_val(interval, 1, 16) - 1;
+- burst = (max_packet & GENMASK(12, 11)) >> 11;
++ mult = usb_endpoint_maxp_mult(desc) - 1;
+ }
+ break;
+ default:
+diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
+index 403eb97915f8a..2f6708b8b5c2f 100644
+--- a/drivers/usb/musb/musb_dsps.c
++++ b/drivers/usb/musb/musb_dsps.c
+@@ -892,23 +892,22 @@ static int dsps_probe(struct platform_device *pdev)
+ if (!glue->usbss_base)
+ return -ENXIO;
+
+- if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) {
+- ret = dsps_setup_optional_vbus_irq(pdev, glue);
+- if (ret)
+- goto err_iounmap;
+- }
+-
+ platform_set_drvdata(pdev, glue);
+ pm_runtime_enable(&pdev->dev);
+ ret = dsps_create_musb_pdev(glue, pdev);
+ if (ret)
+ goto err;
+
++ if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) {
++ ret = dsps_setup_optional_vbus_irq(pdev, glue);
++ if (ret)
++ goto err;
++ }
++
+ return 0;
+
+ err:
+ pm_runtime_disable(&pdev->dev);
+-err_iounmap:
+ iounmap(glue->usbss_base);
+ return ret;
+ }
+diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c
+index f7c96d209eda7..981db219234e4 100644
+--- a/drivers/usb/phy/phy-fsl-usb.c
++++ b/drivers/usb/phy/phy-fsl-usb.c
+@@ -873,6 +873,8 @@ int usb_otg_start(struct platform_device *pdev)
+
+ /* request irq */
+ p_otg->irq = platform_get_irq(pdev, 0);
++ if (p_otg->irq < 0)
++ return p_otg->irq;
+ status = request_irq(p_otg->irq, fsl_otg_isr,
+ IRQF_SHARED, driver_name, p_otg);
+ if (status) {
+diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c
+index 0981abc3d1adc..60d390e28289f 100644
+--- a/drivers/usb/phy/phy-tahvo.c
++++ b/drivers/usb/phy/phy-tahvo.c
+@@ -396,7 +396,9 @@ static int tahvo_usb_probe(struct platform_device *pdev)
+
+ dev_set_drvdata(&pdev->dev, tu);
+
+- tu->irq = platform_get_irq(pdev, 0);
++ tu->irq = ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ return ret;
+ ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt,
+ IRQF_ONESHOT,
+ "tahvo-vbus", tu);
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index dade34d704198..859af6113b450 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -342,6 +342,11 @@ static int twl6030_usb_probe(struct platform_device *pdev)
+ twl->irq2 = platform_get_irq(pdev, 1);
+ twl->linkstat = MUSB_UNKNOWN;
+
++ if (twl->irq1 < 0)
++ return twl->irq1;
++ if (twl->irq2 < 0)
++ return twl->irq2;
++
+ twl->comparator.set_vbus = twl6030_set_vbus;
+ twl->comparator.start_srp = twl6030_start_srp;
+
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index 1e3ee2bfbcd03..d0c8d3800254d 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -226,8 +226,10 @@ static int read_mos_reg(struct usb_serial *serial, unsigned int serial_portnum,
+ int status;
+
+ buf = kmalloc(1, GFP_KERNEL);
+- if (!buf)
++ if (!buf) {
++ *data = 0;
+ return -ENOMEM;
++ }
+
+ status = usb_control_msg(usbdev, pipe, request, requesttype, value,
+ index, buf, 1, MOS_WDR_TIMEOUT);
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index b13ed5a7618d8..202dc76f7beb9 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -455,8 +455,14 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ vhci_hcd->port_status[rhport] &= ~(1 << USB_PORT_FEAT_RESET);
+ vhci_hcd->re_timeout = 0;
+
++ /*
++ * A few drivers do usb reset during probe when
++ * the device could be in VDEV_ST_USED state
++ */
+ if (vhci_hcd->vdev[rhport].ud.status ==
+- VDEV_ST_NOTASSIGNED) {
++ VDEV_ST_NOTASSIGNED ||
++ vhci_hcd->vdev[rhport].ud.status ==
++ VDEV_ST_USED) {
+ usbip_dbg_vhci_rh(
+ " enable rhport %d (status %u)\n",
+ rhport,
+@@ -957,8 +963,32 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
+ spin_lock(&vdev->priv_lock);
+
+ list_for_each_entry_safe(unlink, tmp, &vdev->unlink_tx, list) {
++ struct urb *urb;
++
++ /* give back urb of unsent unlink request */
+ pr_info("unlink cleanup tx %lu\n", unlink->unlink_seqnum);
++
++ urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum);
++ if (!urb) {
++ list_del(&unlink->list);
++ kfree(unlink);
++ continue;
++ }
++
++ urb->status = -ENODEV;
++
++ usb_hcd_unlink_urb_from_ep(hcd, urb);
++
+ list_del(&unlink->list);
++
++ spin_unlock(&vdev->priv_lock);
++ spin_unlock_irqrestore(&vhci->lock, flags);
++
++ usb_hcd_giveback_urb(hcd, urb, urb->status);
++
++ spin_lock_irqsave(&vhci->lock, flags);
++ spin_lock(&vdev->priv_lock);
++
+ kfree(unlink);
+ }
+
+diff --git a/drivers/vfio/Kconfig b/drivers/vfio/Kconfig
+index c84333eb5eb59..b7765271d0fb6 100644
+--- a/drivers/vfio/Kconfig
++++ b/drivers/vfio/Kconfig
+@@ -29,7 +29,7 @@ menuconfig VFIO
+
+ If you don't know what to do here, say N.
+
+-menuconfig VFIO_NOIOMMU
++config VFIO_NOIOMMU
+ bool "VFIO No-IOMMU support"
+ depends on VFIO
+ help
+diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
+index 3a3098d4873be..6a8dd2f16b780 100644
+--- a/drivers/video/backlight/pwm_bl.c
++++ b/drivers/video/backlight/pwm_bl.c
+@@ -400,6 +400,33 @@ int pwm_backlight_brightness_default(struct device *dev,
+ static int pwm_backlight_initial_power_state(const struct pwm_bl_data *pb)
+ {
+ struct device_node *node = pb->dev->of_node;
++ bool active = true;
++
++ /*
++ * If the enable GPIO is present, observable (either as input
++ * or output) and off then the backlight is not currently active.
++ * */
++ if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0)
++ active = false;
++
++ if (!regulator_is_enabled(pb->power_supply))
++ active = false;
++
++ if (!pwm_is_enabled(pb->pwm))
++ active = false;
++
++ /*
++ * Synchronize the enable_gpio with the observed state of the
++ * hardware.
++ */
++ if (pb->enable_gpio)
++ gpiod_direction_output(pb->enable_gpio, active);
++
++ /*
++ * Do not change pb->enabled here! pb->enabled essentially
++ * tells us if we own one of the regulator's use counts and
++ * right now we do not.
++ */
+
+ /* Not booted with device tree or no phandle link to the node */
+ if (!node || !node->phandle)
+@@ -411,20 +438,7 @@ static int pwm_backlight_initial_power_state(const struct pwm_bl_data *pb)
+ * assume that another driver will enable the backlight at the
+ * appropriate time. Therefore, if it is disabled, keep it so.
+ */
+-
+- /* if the enable GPIO is disabled, do not enable the backlight */
+- if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0)
+- return FB_BLANK_POWERDOWN;
+-
+- /* The regulator is disabled, do not enable the backlight */
+- if (!regulator_is_enabled(pb->power_supply))
+- return FB_BLANK_POWERDOWN;
+-
+- /* The PWM is disabled, keep it like this */
+- if (!pwm_is_enabled(pb->pwm))
+- return FB_BLANK_POWERDOWN;
+-
+- return FB_BLANK_UNBLANK;
++ return active ? FB_BLANK_UNBLANK: FB_BLANK_POWERDOWN;
+ }
+
+ static int pwm_backlight_probe(struct platform_device *pdev)
+@@ -494,18 +508,6 @@ static int pwm_backlight_probe(struct platform_device *pdev)
+ pb->enable_gpio = gpio_to_desc(data->enable_gpio);
+ }
+
+- /*
+- * If the GPIO is not known to be already configured as output, that
+- * is, if gpiod_get_direction returns either 1 or -EINVAL, change the
+- * direction to output and set the GPIO as active.
+- * Do not force the GPIO to active when it was already output as it
+- * could cause backlight flickering or we would enable the backlight too
+- * early. Leave the decision of the initial backlight state for later.
+- */
+- if (pb->enable_gpio &&
+- gpiod_get_direction(pb->enable_gpio) != 0)
+- gpiod_direction_output(pb->enable_gpio, 1);
+-
+ pb->power_supply = devm_regulator_get(&pdev->dev, "power");
+ if (IS_ERR(pb->power_supply)) {
+ ret = PTR_ERR(pb->power_supply);
+diff --git a/drivers/video/fbdev/asiliantfb.c b/drivers/video/fbdev/asiliantfb.c
+index ea31054a28ca8..c1d6e63362259 100644
+--- a/drivers/video/fbdev/asiliantfb.c
++++ b/drivers/video/fbdev/asiliantfb.c
+@@ -227,6 +227,9 @@ static int asiliantfb_check_var(struct fb_var_screeninfo *var,
+ {
+ unsigned long Ftarget, ratio, remainder;
+
++ if (!var->pixclock)
++ return -EINVAL;
++
+ ratio = 1000000 / var->pixclock;
+ remainder = 1000000 % var->pixclock;
+ Ftarget = 1000000 * ratio + (1000000 * remainder) / var->pixclock;
+diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
+index de04c097d67c7..2297dfb494d6a 100644
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -971,6 +971,7 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
+ if ((var->activate & FB_ACTIVATE_FORCE) ||
+ memcmp(&info->var, var, sizeof(struct fb_var_screeninfo))) {
+ u32 activate = var->activate;
++ u32 unused;
+
+ /* When using FOURCC mode, make sure the red, green, blue and
+ * transp fields are set to 0.
+@@ -995,6 +996,11 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
+ if (var->xres < 8 || var->yres < 8)
+ return -EINVAL;
+
++ /* Too huge resolution causes multiplication overflow. */
++ if (check_mul_overflow(var->xres, var->yres, &unused) ||
++ check_mul_overflow(var->xres_virtual, var->yres_virtual, &unused))
++ return -EINVAL;
++
+ ret = info->fbops->fb_check_var(var, info);
+
+ if (ret)
+diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
+index a7bd9f25911b5..74bf26b527b91 100644
+--- a/drivers/video/fbdev/kyro/fbdev.c
++++ b/drivers/video/fbdev/kyro/fbdev.c
+@@ -372,6 +372,11 @@ static int kyro_dev_overlay_viewport_set(u32 x, u32 y, u32 ulWidth, u32 ulHeight
+ /* probably haven't called CreateOverlay yet */
+ return -EINVAL;
+
++ if (ulWidth == 0 || ulWidth == 0xffffffff ||
++ ulHeight == 0 || ulHeight == 0xffffffff ||
++ (x < 2 && ulWidth + 2 == 0))
++ return -EINVAL;
++
+ /* Stop Ramdac Output */
+ DisableRamdacOutput(deviceInfo.pSTGReg);
+
+@@ -394,6 +399,9 @@ static int kyrofb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ {
+ struct kyrofb_info *par = info->par;
+
++ if (!var->pixclock)
++ return -EINVAL;
++
+ if (var->bits_per_pixel != 16 && var->bits_per_pixel != 32) {
+ printk(KERN_WARNING "kyrofb: depth not supported: %u\n", var->bits_per_pixel);
+ return -EINVAL;
+diff --git a/drivers/video/fbdev/riva/fbdev.c b/drivers/video/fbdev/riva/fbdev.c
+index cc242ba057d3e..dfa81b641f9fe 100644
+--- a/drivers/video/fbdev/riva/fbdev.c
++++ b/drivers/video/fbdev/riva/fbdev.c
+@@ -1088,6 +1088,9 @@ static int rivafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ int mode_valid = 0;
+
+ NVTRACE_ENTER();
++ if (!var->pixclock)
++ return -EINVAL;
++
+ switch (var->bits_per_pixel) {
+ case 1 ... 8:
+ var->red.offset = var->green.offset = var->blue.offset = 0;
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 6f02a3f77fa83..f314b2c2d1487 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -530,7 +530,7 @@ again:
+ * inode has not been flagged as nocompress. This flag can
+ * change at any time if we discover bad compression ratios.
+ */
+- if (nr_pages > 1 && inode_need_compress(inode, start, end)) {
++ if (inode_need_compress(inode, start, end)) {
+ WARN_ON(pages);
+ pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS);
+ if (!pages) {
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 5a19f5ee70386..6cb4896256106 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -1048,6 +1048,9 @@ static void btrfs_close_one_device(struct btrfs_device *device)
+ fs_devices->rw_devices--;
+ }
+
++ if (device->devid == BTRFS_DEV_REPLACE_DEVID)
++ clear_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state);
++
+ if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
+ fs_devices->missing_devices--;
+
+diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
+index 9986817532b10..7932e20555d2b 100644
+--- a/fs/cifs/cifs_unicode.c
++++ b/fs/cifs/cifs_unicode.c
+@@ -371,14 +371,9 @@ cifs_strndup_from_utf16(const char *src, const int maxlen,
+ if (!dst)
+ return NULL;
+ cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage,
+- NO_MAP_UNI_RSVD);
++ NO_MAP_UNI_RSVD);
+ } else {
+- len = strnlen(src, maxlen);
+- len++;
+- dst = kmalloc(len, GFP_KERNEL);
+- if (!dst)
+- return NULL;
+- strlcpy(dst, src, len);
++ dst = kstrndup(src, maxlen, GFP_KERNEL);
+ }
+
+ return dst;
+diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
+index aa23c00367ec4..0113dba28eb09 100644
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -602,7 +602,7 @@ sess_alloc_buffer(struct sess_data *sess_data, int wct)
+ return 0;
+
+ out_free_smb_buf:
+- kfree(smb_buf);
++ cifs_small_buf_release(smb_buf);
+ sess_data->iov[0].iov_base = NULL;
+ sess_data->iov[0].iov_len = 0;
+ sess_data->buf0_type = CIFS_NO_BUFFER;
+diff --git a/fs/crypto/hooks.c b/fs/crypto/hooks.c
+index aa86cb2db8236..ae7a413c0bdde 100644
+--- a/fs/crypto/hooks.c
++++ b/fs/crypto/hooks.c
+@@ -279,3 +279,47 @@ err_kfree:
+ return ERR_PTR(err);
+ }
+ EXPORT_SYMBOL_GPL(fscrypt_get_symlink);
++
++/**
++ * fscrypt_symlink_getattr() - set the correct st_size for encrypted symlinks
++ * @path: the path for the encrypted symlink being queried
++ * @stat: the struct being filled with the symlink's attributes
++ *
++ * Override st_size of encrypted symlinks to be the length of the decrypted
++ * symlink target (or the no-key encoded symlink target, if the key is
++ * unavailable) rather than the length of the encrypted symlink target. This is
++ * necessary for st_size to match the symlink target that userspace actually
++ * sees. POSIX requires this, and some userspace programs depend on it.
++ *
++ * This requires reading the symlink target from disk if needed, setting up the
++ * inode's encryption key if possible, and then decrypting or encoding the
++ * symlink target. This makes lstat() more heavyweight than is normally the
++ * case. However, decrypted symlink targets will be cached in ->i_link, so
++ * usually the symlink won't have to be read and decrypted again later if/when
++ * it is actually followed, readlink() is called, or lstat() is called again.
++ *
++ * Return: 0 on success, -errno on failure
++ */
++int fscrypt_symlink_getattr(const struct path *path, struct kstat *stat)
++{
++ struct dentry *dentry = path->dentry;
++ struct inode *inode = d_inode(dentry);
++ const char *link;
++ DEFINE_DELAYED_CALL(done);
++
++ /*
++ * To get the symlink target that userspace will see (whether it's the
++ * decrypted target or the no-key encoded target), we can just get it in
++ * the same way the VFS does during path resolution and readlink().
++ */
++ link = READ_ONCE(inode->i_link);
++ if (!link) {
++ link = inode->i_op->get_link(dentry, inode, &done);
++ if (IS_ERR(link))
++ return PTR_ERR(link);
++ }
++ stat->size = strlen(link);
++ do_delayed_call(&done);
++ return 0;
++}
++EXPORT_SYMBOL_GPL(fscrypt_symlink_getattr);
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index c952461876595..c64e4a1be2f29 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -750,6 +750,12 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
+ ext4_write_lock_xattr(inode, &no_expand);
+ BUG_ON(!ext4_has_inline_data(inode));
+
++ /*
++ * ei->i_inline_off may have changed since ext4_write_begin()
++ * called ext4_try_to_write_inline_data()
++ */
++ (void) ext4_find_inline_data_nolock(inode);
++
+ kaddr = kmap_atomic(page);
+ ext4_write_inline_data(inode, &iloc, kaddr, pos, len);
+ kunmap_atomic(kaddr);
+diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c
+index dd05af983092d..a9457fed351ed 100644
+--- a/fs/ext4/symlink.c
++++ b/fs/ext4/symlink.c
+@@ -52,10 +52,19 @@ static const char *ext4_encrypted_get_link(struct dentry *dentry,
+ return paddr;
+ }
+
++static int ext4_encrypted_symlink_getattr(const struct path *path,
++ struct kstat *stat, u32 request_mask,
++ unsigned int query_flags)
++{
++ ext4_getattr(path, stat, request_mask, query_flags);
++
++ return fscrypt_symlink_getattr(path, stat);
++}
++
+ const struct inode_operations ext4_encrypted_symlink_inode_operations = {
+ .get_link = ext4_encrypted_get_link,
+ .setattr = ext4_setattr,
+- .getattr = ext4_getattr,
++ .getattr = ext4_encrypted_symlink_getattr,
+ .listxattr = ext4_listxattr,
+ };
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 95330dfdbb1af..2a7249496c57e 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -957,7 +957,6 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len)
+ }
+
+ if (pg_start < pg_end) {
+- struct address_space *mapping = inode->i_mapping;
+ loff_t blk_start, blk_end;
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+
+@@ -969,8 +968,7 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len)
+ down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ down_write(&F2FS_I(inode)->i_mmap_sem);
+
+- truncate_inode_pages_range(mapping, blk_start,
+- blk_end - 1);
++ truncate_pagecache_range(inode, blk_start, blk_end - 1);
+
+ f2fs_lock_op(sbi);
+ ret = f2fs_truncate_hole(inode, pg_start, pg_end);
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 700c39ec99f5a..38299ccfdf6ef 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -998,8 +998,10 @@ next_step:
+ bool locked = false;
+
+ if (S_ISREG(inode->i_mode)) {
+- if (!down_write_trylock(&fi->i_gc_rwsem[READ]))
++ if (!down_write_trylock(&fi->i_gc_rwsem[READ])) {
++ sbi->skipped_gc_rwsem++;
+ continue;
++ }
+ if (!down_write_trylock(
+ &fi->i_gc_rwsem[WRITE])) {
+ sbi->skipped_gc_rwsem++;
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index e20a0f9e68455..edc80855974ac 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -1219,9 +1219,18 @@ static const char *f2fs_encrypted_get_link(struct dentry *dentry,
+ return target;
+ }
+
++static int f2fs_encrypted_symlink_getattr(const struct path *path,
++ struct kstat *stat, u32 request_mask,
++ unsigned int query_flags)
++{
++ f2fs_getattr(path, stat, request_mask, query_flags);
++
++ return fscrypt_symlink_getattr(path, stat);
++}
++
+ const struct inode_operations f2fs_encrypted_symlink_inode_operations = {
+ .get_link = f2fs_encrypted_get_link,
+- .getattr = f2fs_getattr,
++ .getattr = f2fs_encrypted_symlink_getattr,
+ .setattr = f2fs_setattr,
+ #ifdef CONFIG_F2FS_FS_XATTR
+ .listxattr = f2fs_listxattr,
+diff --git a/fs/fcntl.c b/fs/fcntl.c
+index e039af1872ab2..dffb5245ae728 100644
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -993,13 +993,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
+ {
+ while (fa) {
+ struct fown_struct *fown;
++ unsigned long flags;
+
+ if (fa->magic != FASYNC_MAGIC) {
+ printk(KERN_ERR "kill_fasync: bad magic number in "
+ "fasync_struct!\n");
+ return;
+ }
+- read_lock(&fa->fa_lock);
++ read_lock_irqsave(&fa->fa_lock, flags);
+ if (fa->fa_file) {
+ fown = &fa->fa_file->f_owner;
+ /* Don't send SIGURG to processes which have not set a
+@@ -1008,7 +1009,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
+ if (!(sig == SIGURG && fown->signum == 0))
+ send_sigio(fown, fa->fa_fd, band);
+ }
+- read_unlock(&fa->fa_lock);
++ read_unlock_irqrestore(&fa->fa_lock, flags);
+ fa = rcu_dereference(fa->fa_next);
+ }
+ }
+diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
+index c550512ce3350..2ff05adfc22a4 100644
+--- a/fs/fscache/cookie.c
++++ b/fs/fscache/cookie.c
+@@ -78,10 +78,8 @@ void fscache_free_cookie(struct fscache_cookie *cookie)
+ static int fscache_set_key(struct fscache_cookie *cookie,
+ const void *index_key, size_t index_key_len)
+ {
+- unsigned long long h;
+ u32 *buf;
+ int bufs;
+- int i;
+
+ bufs = DIV_ROUND_UP(index_key_len, sizeof(*buf));
+
+@@ -95,17 +93,7 @@ static int fscache_set_key(struct fscache_cookie *cookie,
+ }
+
+ memcpy(buf, index_key, index_key_len);
+-
+- /* Calculate a hash and combine this with the length in the first word
+- * or first half word
+- */
+- h = (unsigned long)cookie->parent;
+- h += index_key_len + cookie->type;
+-
+- for (i = 0; i < bufs; i++)
+- h += buf[i];
+-
+- cookie->key_hash = h ^ (h >> 32);
++ cookie->key_hash = fscache_hash(0, buf, bufs);
+ return 0;
+ }
+
+diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
+index d6209022e9658..cc87288a5448c 100644
+--- a/fs/fscache/internal.h
++++ b/fs/fscache/internal.h
+@@ -101,6 +101,8 @@ extern struct workqueue_struct *fscache_object_wq;
+ extern struct workqueue_struct *fscache_op_wq;
+ DECLARE_PER_CPU(wait_queue_head_t, fscache_object_cong_wait);
+
++extern unsigned int fscache_hash(unsigned int salt, unsigned int *data, unsigned int n);
++
+ static inline bool fscache_object_congested(void)
+ {
+ return workqueue_congested(WORK_CPU_UNBOUND, fscache_object_wq);
+diff --git a/fs/fscache/main.c b/fs/fscache/main.c
+index 30ad89db1efcc..aa49234e9520a 100644
+--- a/fs/fscache/main.c
++++ b/fs/fscache/main.c
+@@ -98,6 +98,45 @@ static struct ctl_table fscache_sysctls_root[] = {
+ };
+ #endif
+
++/*
++ * Mixing scores (in bits) for (7,20):
++ * Input delta: 1-bit 2-bit
++ * 1 round: 330.3 9201.6
++ * 2 rounds: 1246.4 25475.4
++ * 3 rounds: 1907.1 31295.1
++ * 4 rounds: 2042.3 31718.6
++ * Perfect: 2048 31744
++ * (32*64) (32*31/2 * 64)
++ */
++#define HASH_MIX(x, y, a) \
++ ( x ^= (a), \
++ y ^= x, x = rol32(x, 7),\
++ x += y, y = rol32(y,20),\
++ y *= 9 )
++
++static inline unsigned int fold_hash(unsigned long x, unsigned long y)
++{
++ /* Use arch-optimized multiply if one exists */
++ return __hash_32(y ^ __hash_32(x));
++}
++
++/*
++ * Generate a hash. This is derived from full_name_hash(), but we want to be
++ * sure it is arch independent and that it doesn't change as bits of the
++ * computed hash value might appear on disk. The caller also guarantees that
++ * the hashed data will be a series of aligned 32-bit words.
++ */
++unsigned int fscache_hash(unsigned int salt, unsigned int *data, unsigned int n)
++{
++ unsigned int a, x = 0, y = salt;
++
++ for (; n; n--) {
++ a = *data++;
++ HASH_MIX(x, y, a);
++ }
++ return fold_hash(x, y);
++}
++
+ /*
+ * initialise the fs caching module
+ */
+diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
+index 56dddc1f8dddc..9e90e42c495ed 100644
+--- a/fs/gfs2/lock_dlm.c
++++ b/fs/gfs2/lock_dlm.c
+@@ -295,6 +295,11 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
+ gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
+ gfs2_update_request_times(gl);
+
++ /* don't want to call dlm if we've unmounted the lock protocol */
++ if (test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) {
++ gfs2_glock_free(gl);
++ return;
++ }
+ /* don't want to skip dlm_unlock writing the lvb when lock has one */
+
+ if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index 488a9e7f8f660..2355ad62b81fa 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -157,7 +157,6 @@ struct iso9660_options{
+ unsigned int overriderockperm:1;
+ unsigned int uid_set:1;
+ unsigned int gid_set:1;
+- unsigned int utf8:1;
+ unsigned char map;
+ unsigned char check;
+ unsigned int blocksize;
+@@ -357,7 +356,6 @@ static int parse_options(char *options, struct iso9660_options *popt)
+ popt->gid = GLOBAL_ROOT_GID;
+ popt->uid = GLOBAL_ROOT_UID;
+ popt->iocharset = NULL;
+- popt->utf8 = 0;
+ popt->overriderockperm = 0;
+ popt->session=-1;
+ popt->sbsector=-1;
+@@ -390,10 +388,13 @@ static int parse_options(char *options, struct iso9660_options *popt)
+ case Opt_cruft:
+ popt->cruft = 1;
+ break;
++#ifdef CONFIG_JOLIET
+ case Opt_utf8:
+- popt->utf8 = 1;
++ kfree(popt->iocharset);
++ popt->iocharset = kstrdup("utf8", GFP_KERNEL);
++ if (!popt->iocharset)
++ return 0;
+ break;
+-#ifdef CONFIG_JOLIET
+ case Opt_iocharset:
+ kfree(popt->iocharset);
+ popt->iocharset = match_strdup(&args[0]);
+@@ -496,7 +497,6 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)
+ if (sbi->s_nocompress) seq_puts(m, ",nocompress");
+ if (sbi->s_overriderockperm) seq_puts(m, ",overriderockperm");
+ if (sbi->s_showassoc) seq_puts(m, ",showassoc");
+- if (sbi->s_utf8) seq_puts(m, ",utf8");
+
+ if (sbi->s_check) seq_printf(m, ",check=%c", sbi->s_check);
+ if (sbi->s_mapping) seq_printf(m, ",map=%c", sbi->s_mapping);
+@@ -519,9 +519,10 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)
+ seq_printf(m, ",fmode=%o", sbi->s_fmode);
+
+ #ifdef CONFIG_JOLIET
+- if (sbi->s_nls_iocharset &&
+- strcmp(sbi->s_nls_iocharset->charset, CONFIG_NLS_DEFAULT) != 0)
++ if (sbi->s_nls_iocharset)
+ seq_printf(m, ",iocharset=%s", sbi->s_nls_iocharset->charset);
++ else
++ seq_puts(m, ",iocharset=utf8");
+ #endif
+ return 0;
+ }
+@@ -865,14 +866,13 @@ root_found:
+ sbi->s_nls_iocharset = NULL;
+
+ #ifdef CONFIG_JOLIET
+- if (joliet_level && opt.utf8 == 0) {
++ if (joliet_level) {
+ char *p = opt.iocharset ? opt.iocharset : CONFIG_NLS_DEFAULT;
+- sbi->s_nls_iocharset = load_nls(p);
+- if (! sbi->s_nls_iocharset) {
+- /* Fail only if explicit charset specified */
+- if (opt.iocharset)
++ if (strcmp(p, "utf8") != 0) {
++ sbi->s_nls_iocharset = opt.iocharset ?
++ load_nls(opt.iocharset) : load_nls_default();
++ if (!sbi->s_nls_iocharset)
+ goto out_freesbi;
+- sbi->s_nls_iocharset = load_nls_default();
+ }
+ }
+ #endif
+@@ -888,7 +888,6 @@ root_found:
+ sbi->s_gid = opt.gid;
+ sbi->s_uid_set = opt.uid_set;
+ sbi->s_gid_set = opt.gid_set;
+- sbi->s_utf8 = opt.utf8;
+ sbi->s_nocompress = opt.nocompress;
+ sbi->s_overriderockperm = opt.overriderockperm;
+ /*
+diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
+index 055ec6c586f7f..dcdc191ed1834 100644
+--- a/fs/isofs/isofs.h
++++ b/fs/isofs/isofs.h
+@@ -44,7 +44,6 @@ struct isofs_sb_info {
+ unsigned char s_session;
+ unsigned int s_high_sierra:1;
+ unsigned int s_rock:2;
+- unsigned int s_utf8:1;
+ unsigned int s_cruft:1; /* Broken disks with high byte of length
+ * containing junk */
+ unsigned int s_nocompress:1;
+diff --git a/fs/isofs/joliet.c b/fs/isofs/joliet.c
+index be8b6a9d0b926..c0f04a1e7f695 100644
+--- a/fs/isofs/joliet.c
++++ b/fs/isofs/joliet.c
+@@ -41,14 +41,12 @@ uni16_to_x8(unsigned char *ascii, __be16 *uni, int len, struct nls_table *nls)
+ int
+ get_joliet_filename(struct iso_directory_record * de, unsigned char *outname, struct inode * inode)
+ {
+- unsigned char utf8;
+ struct nls_table *nls;
+ unsigned char len = 0;
+
+- utf8 = ISOFS_SB(inode->i_sb)->s_utf8;
+ nls = ISOFS_SB(inode->i_sb)->s_nls_iocharset;
+
+- if (utf8) {
++ if (!nls) {
+ len = utf16s_to_utf8s((const wchar_t *) de->name,
+ de->name_len[0] >> 1, UTF16_BIG_ENDIAN,
+ outname, PAGE_SIZE);
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index a87a562734077..57558a8d92e9b 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -991,7 +991,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp)
+
+ out_invalidcred:
+ pr_warn_ratelimited("NFS: NFSv4 callback contains invalid cred\n");
+- return rpc_autherr_badcred;
++ return svc_return_autherr(rqstp, rpc_autherr_badcred);
+ }
+
+ /*
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 25be2ab6ff6cc..0b4ee1ab25df0 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -517,8 +517,10 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
+ goto out_cleanup;
+ }
+ err = ovl_instantiate(dentry, inode, newdentry, hardlink);
+- if (err)
+- goto out_cleanup;
++ if (err) {
++ ovl_cleanup(udir, newdentry);
++ dput(newdentry);
++ }
+ out_dput:
+ dput(upper);
+ out_unlock:
+diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
+index d7d2fdda4bbd0..3dbb5ac630e42 100644
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -1642,6 +1642,16 @@ static const char *ubifs_get_link(struct dentry *dentry,
+ return fscrypt_get_symlink(inode, ui->data, ui->data_len, done);
+ }
+
++static int ubifs_symlink_getattr(const struct path *path, struct kstat *stat,
++ u32 request_mask, unsigned int query_flags)
++{
++ ubifs_getattr(path, stat, request_mask, query_flags);
++
++ if (IS_ENCRYPTED(d_inode(path->dentry)))
++ return fscrypt_symlink_getattr(path, stat);
++ return 0;
++}
++
+ const struct address_space_operations ubifs_file_address_operations = {
+ .readpage = ubifs_readpage,
+ .writepage = ubifs_writepage,
+@@ -1669,7 +1679,7 @@ const struct inode_operations ubifs_file_inode_operations = {
+ const struct inode_operations ubifs_symlink_inode_operations = {
+ .get_link = ubifs_get_link,
+ .setattr = ubifs_setattr,
+- .getattr = ubifs_getattr,
++ .getattr = ubifs_symlink_getattr,
+ #ifdef CONFIG_UBIFS_FS_XATTR
+ .listxattr = ubifs_listxattr,
+ #endif
+diff --git a/fs/udf/misc.c b/fs/udf/misc.c
+index 401e64cde1be0..853bcff51043f 100644
+--- a/fs/udf/misc.c
++++ b/fs/udf/misc.c
+@@ -173,13 +173,22 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type,
+ else
+ offset = le32_to_cpu(eahd->appAttrLocation);
+
+- while (offset < iinfo->i_lenEAttr) {
++ while (offset + sizeof(*gaf) < iinfo->i_lenEAttr) {
++ uint32_t attrLength;
++
+ gaf = (struct genericFormat *)&ea[offset];
++ attrLength = le32_to_cpu(gaf->attrLength);
++
++ /* Detect undersized elements and buffer overflows */
++ if ((attrLength < sizeof(*gaf)) ||
++ (attrLength > (iinfo->i_lenEAttr - offset)))
++ break;
++
+ if (le32_to_cpu(gaf->attrType) == type &&
+ gaf->attrSubtype == subtype)
+ return gaf;
+ else
+- offset += le32_to_cpu(gaf->attrLength);
++ offset += attrLength;
+ }
+ }
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index c7f6243f318bb..9c71246e6d602 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -112,16 +112,10 @@ struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb)
+ return NULL;
+ lvid = (struct logicalVolIntegrityDesc *)UDF_SB(sb)->s_lvid_bh->b_data;
+ partnum = le32_to_cpu(lvid->numOfPartitions);
+- if ((sb->s_blocksize - sizeof(struct logicalVolIntegrityDescImpUse) -
+- offsetof(struct logicalVolIntegrityDesc, impUse)) /
+- (2 * sizeof(uint32_t)) < partnum) {
+- udf_err(sb, "Logical volume integrity descriptor corrupted "
+- "(numOfPartitions = %u)!\n", partnum);
+- return NULL;
+- }
+ /* The offset is to skip freeSpaceTable and sizeTable arrays */
+ offset = partnum * 2 * sizeof(uint32_t);
+- return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]);
++ return (struct logicalVolIntegrityDescImpUse *)
++ (((uint8_t *)(lvid + 1)) + offset);
+ }
+
+ /* UDF filesystem type */
+@@ -1529,6 +1523,7 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
+ struct udf_sb_info *sbi = UDF_SB(sb);
+ struct logicalVolIntegrityDesc *lvid;
+ int indirections = 0;
++ u32 parts, impuselen;
+
+ while (++indirections <= UDF_MAX_LVID_NESTING) {
+ final_bh = NULL;
+@@ -1555,15 +1550,27 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
+
+ lvid = (struct logicalVolIntegrityDesc *)final_bh->b_data;
+ if (lvid->nextIntegrityExt.extLength == 0)
+- return;
++ goto check;
+
+ loc = leea_to_cpu(lvid->nextIntegrityExt);
+ }
+
+ udf_warn(sb, "Too many LVID indirections (max %u), ignoring.\n",
+ UDF_MAX_LVID_NESTING);
++out_err:
+ brelse(sbi->s_lvid_bh);
+ sbi->s_lvid_bh = NULL;
++ return;
++check:
++ parts = le32_to_cpu(lvid->numOfPartitions);
++ impuselen = le32_to_cpu(lvid->lengthOfImpUse);
++ if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize ||
++ sizeof(struct logicalVolIntegrityDesc) + impuselen +
++ 2 * parts * sizeof(u32) > sb->s_blocksize) {
++ udf_warn(sb, "Corrupted LVID (parts=%u, impuselen=%u), "
++ "ignoring.\n", parts, impuselen);
++ goto out_err;
++ }
+ }
+
+ /*
+diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
+index d269d1139f7ff..23c8efc967af2 100644
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -32,11 +32,6 @@
+
+ static struct kmem_cache *userfaultfd_ctx_cachep __read_mostly;
+
+-enum userfaultfd_state {
+- UFFD_STATE_WAIT_API,
+- UFFD_STATE_RUNNING,
+-};
+-
+ /*
+ * Start with fault_pending_wqh and fault_wqh so they're more likely
+ * to be in the same cacheline.
+@@ -68,8 +63,6 @@ struct userfaultfd_ctx {
+ unsigned int flags;
+ /* features requested from the userspace */
+ unsigned int features;
+- /* state machine */
+- enum userfaultfd_state state;
+ /* released */
+ bool released;
+ /* memory mappings are changing because of non-cooperative event */
+@@ -103,6 +96,14 @@ struct userfaultfd_wake_range {
+ unsigned long len;
+ };
+
++/* internal indication that UFFD_API ioctl was successfully executed */
++#define UFFD_FEATURE_INITIALIZED (1u << 31)
++
++static bool userfaultfd_is_initialized(struct userfaultfd_ctx *ctx)
++{
++ return ctx->features & UFFD_FEATURE_INITIALIZED;
++}
++
+ static int userfaultfd_wake_function(wait_queue_entry_t *wq, unsigned mode,
+ int wake_flags, void *key)
+ {
+@@ -700,7 +701,6 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs)
+
+ atomic_set(&ctx->refcount, 1);
+ ctx->flags = octx->flags;
+- ctx->state = UFFD_STATE_RUNNING;
+ ctx->features = octx->features;
+ ctx->released = false;
+ ctx->mmap_changing = false;
+@@ -981,38 +981,33 @@ static __poll_t userfaultfd_poll(struct file *file, poll_table *wait)
+
+ poll_wait(file, &ctx->fd_wqh, wait);
+
+- switch (ctx->state) {
+- case UFFD_STATE_WAIT_API:
++ if (!userfaultfd_is_initialized(ctx))
+ return EPOLLERR;
+- case UFFD_STATE_RUNNING:
+- /*
+- * poll() never guarantees that read won't block.
+- * userfaults can be waken before they're read().
+- */
+- if (unlikely(!(file->f_flags & O_NONBLOCK)))
+- return EPOLLERR;
+- /*
+- * lockless access to see if there are pending faults
+- * __pollwait last action is the add_wait_queue but
+- * the spin_unlock would allow the waitqueue_active to
+- * pass above the actual list_add inside
+- * add_wait_queue critical section. So use a full
+- * memory barrier to serialize the list_add write of
+- * add_wait_queue() with the waitqueue_active read
+- * below.
+- */
+- ret = 0;
+- smp_mb();
+- if (waitqueue_active(&ctx->fault_pending_wqh))
+- ret = EPOLLIN;
+- else if (waitqueue_active(&ctx->event_wqh))
+- ret = EPOLLIN;
+-
+- return ret;
+- default:
+- WARN_ON_ONCE(1);
++
++ /*
++ * poll() never guarantees that read won't block.
++ * userfaults can be waken before they're read().
++ */
++ if (unlikely(!(file->f_flags & O_NONBLOCK)))
+ return EPOLLERR;
+- }
++ /*
++ * lockless access to see if there are pending faults
++ * __pollwait last action is the add_wait_queue but
++ * the spin_unlock would allow the waitqueue_active to
++ * pass above the actual list_add inside
++ * add_wait_queue critical section. So use a full
++ * memory barrier to serialize the list_add write of
++ * add_wait_queue() with the waitqueue_active read
++ * below.
++ */
++ ret = 0;
++ smp_mb();
++ if (waitqueue_active(&ctx->fault_pending_wqh))
++ ret = EPOLLIN;
++ else if (waitqueue_active(&ctx->event_wqh))
++ ret = EPOLLIN;
++
++ return ret;
+ }
+
+ static const struct file_operations userfaultfd_fops;
+@@ -1206,7 +1201,7 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf,
+ struct uffd_msg msg;
+ int no_wait = file->f_flags & O_NONBLOCK;
+
+- if (ctx->state == UFFD_STATE_WAIT_API)
++ if (!userfaultfd_is_initialized(ctx))
+ return -EINVAL;
+
+ for (;;) {
+@@ -1808,9 +1803,10 @@ out:
+ static inline unsigned int uffd_ctx_features(__u64 user_features)
+ {
+ /*
+- * For the current set of features the bits just coincide
++ * For the current set of features the bits just coincide. Set
++ * UFFD_FEATURE_INITIALIZED to mark the features as enabled.
+ */
+- return (unsigned int)user_features;
++ return (unsigned int)user_features | UFFD_FEATURE_INITIALIZED;
+ }
+
+ /*
+@@ -1823,12 +1819,10 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
+ {
+ struct uffdio_api uffdio_api;
+ void __user *buf = (void __user *)arg;
++ unsigned int ctx_features;
+ int ret;
+ __u64 features;
+
+- ret = -EINVAL;
+- if (ctx->state != UFFD_STATE_WAIT_API)
+- goto out;
+ ret = -EFAULT;
+ if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api)))
+ goto out;
+@@ -1845,9 +1839,13 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
+ ret = -EFAULT;
+ if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
+ goto out;
+- ctx->state = UFFD_STATE_RUNNING;
++
+ /* only enable the requested features for this uffd context */
+- ctx->features = uffd_ctx_features(features);
++ ctx_features = uffd_ctx_features(features);
++ ret = -EINVAL;
++ if (cmpxchg(&ctx->features, 0, ctx_features) != 0)
++ goto err_out;
++
+ ret = 0;
+ out:
+ return ret;
+@@ -1864,7 +1862,7 @@ static long userfaultfd_ioctl(struct file *file, unsigned cmd,
+ int ret = -EINVAL;
+ struct userfaultfd_ctx *ctx = file->private_data;
+
+- if (cmd != UFFDIO_API && ctx->state == UFFD_STATE_WAIT_API)
++ if (cmd != UFFDIO_API && !userfaultfd_is_initialized(ctx))
+ return -EINVAL;
+
+ switch(cmd) {
+@@ -1962,7 +1960,6 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
+ atomic_set(&ctx->refcount, 1);
+ ctx->flags = flags;
+ ctx->features = 0;
+- ctx->state = UFFD_STATE_WAIT_API;
+ ctx->released = false;
+ ctx->mmap_changing = false;
+ ctx->mm = current->mm;
+diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
+index e0b681a717bac..052e26fda2e6c 100644
+--- a/include/crypto/public_key.h
++++ b/include/crypto/public_key.h
+@@ -35,9 +35,9 @@ extern void public_key_free(struct public_key *key);
+ struct public_key_signature {
+ struct asymmetric_key_id *auth_ids[2];
+ u8 *s; /* Signature */
+- u32 s_size; /* Number of bytes in signature */
+ u8 *digest;
+- u8 digest_size; /* Number of bytes in digest */
++ u32 s_size; /* Number of bytes in signature */
++ u32 digest_size; /* Number of bytes in digest */
+ const char *pkey_algo;
+ const char *hash_algo;
+ };
+diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
+index 1c8517320ea64..4acd06cca703d 100644
+--- a/include/linux/bpf_verifier.h
++++ b/include/linux/bpf_verifier.h
+@@ -41,6 +41,7 @@ enum bpf_reg_liveness {
+ };
+
+ struct bpf_reg_state {
++ /* Ordering of fields matters. See states_equal() */
+ enum bpf_reg_type type;
+ union {
+ /* valid when type == PTR_TO_PACKET */
+@@ -62,7 +63,6 @@ struct bpf_reg_state {
+ * came from, when one is tested for != NULL.
+ */
+ u32 id;
+- /* Ordering of fields matters. See states_equal() */
+ /* For scalar types (SCALAR_VALUE), this represents our knowledge of
+ * the actual value.
+ * For pointer types, this represents the variable part of the offset
+@@ -79,15 +79,15 @@ struct bpf_reg_state {
+ s64 smax_value; /* maximum possible (s64)value */
+ u64 umin_value; /* minimum possible (u64)value */
+ u64 umax_value; /* maximum possible (u64)value */
++ /* parentage chain for liveness checking */
++ struct bpf_reg_state *parent;
+ /* Inside the callee two registers can be both PTR_TO_STACK like
+ * R1=fp-8 and R2=fp-8, but one of them points to this function stack
+ * while another to the caller's stack. To differentiate them 'frameno'
+ * is used which is an index in bpf_verifier_state->frame[] array
+ * pointing to bpf_func_state.
+- * This field must be second to last, for states_equal() reasons.
+ */
+ u32 frameno;
+- /* This field must be last, for states_equal() reasons. */
+ enum bpf_reg_liveness live;
+ };
+
+@@ -110,7 +110,6 @@ struct bpf_stack_state {
+ */
+ struct bpf_func_state {
+ struct bpf_reg_state regs[MAX_BPF_REG];
+- struct bpf_verifier_state *parent;
+ /* index of call instruction that called into this func */
+ int callsite;
+ /* stack frame number of this function state from pov of
+@@ -128,11 +127,17 @@ struct bpf_func_state {
+ struct bpf_stack_state *stack;
+ };
+
++struct bpf_id_pair {
++ u32 old;
++ u32 cur;
++};
++
++/* Maximum number of register states that can exist at once */
++#define BPF_ID_MAP_SIZE (MAX_BPF_REG + MAX_BPF_STACK / BPF_REG_SIZE)
+ #define MAX_CALL_FRAMES 8
+ struct bpf_verifier_state {
+ /* call stack tracking */
+ struct bpf_func_state *frame[MAX_CALL_FRAMES];
+- struct bpf_verifier_state *parent;
+ u32 curframe;
+ bool speculative;
+ };
+@@ -160,8 +165,8 @@ struct bpf_insn_aux_data {
+ u32 alu_limit; /* limit for add/sub register with pointer */
+ };
+ int ctx_field_size; /* the ctx field size for load insn, maybe 0 */
+- int sanitize_stack_off; /* stack slot to be cleared */
+ bool seen; /* this insn was processed by the verifier */
++ bool sanitize_stack_spill; /* subject to Spectre v4 sanitation */
+ u8 alu_state; /* used in combination with alu_limit */
+ };
+
+@@ -210,11 +215,13 @@ struct bpf_verifier_env {
+ struct bpf_map *used_maps[MAX_USED_MAPS]; /* array of map's used by eBPF program */
+ u32 used_map_cnt; /* number of used maps */
+ u32 id_gen; /* used to generate unique reg IDs */
++ bool explore_alu_limits;
+ bool allow_ptr_leaks;
+ bool seen_direct_write;
+ struct bpf_insn_aux_data *insn_aux_data; /* array of per-insn state */
+ struct bpf_verifier_log log;
+ struct bpf_subprog_info subprog_info[BPF_MAX_SUBPROGS + 1];
++ struct bpf_id_pair idmap_scratch[BPF_ID_MAP_SIZE];
+ u32 subprog_cnt;
+ };
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 7c84762cb59e5..e981bd92a4e3a 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -64,6 +64,11 @@ struct sock_reuseport;
+ /* unused opcode to mark call to interpreter with arguments */
+ #define BPF_CALL_ARGS 0xe0
+
++/* unused opcode to mark speculation barrier for mitigating
++ * Speculative Store Bypass
++ */
++#define BPF_NOSPEC 0xc0
++
+ /* As per nm, we expose JITed images as text (code) section for
+ * kallsyms. That way, tools like perf can find it to match
+ * addresses.
+@@ -354,6 +359,16 @@ struct sock_reuseport;
+ .off = 0, \
+ .imm = 0 })
+
++/* Speculation barrier */
++
++#define BPF_ST_NOSPEC() \
++ ((struct bpf_insn) { \
++ .code = BPF_ST | BPF_NOSPEC, \
++ .dst_reg = 0, \
++ .src_reg = 0, \
++ .off = 0, \
++ .imm = 0 })
++
+ /* Internal classic blocks for direct assignment */
+
+ #define __BPF_STMT(CODE, K) \
+diff --git a/include/linux/fscrypt_notsupp.h b/include/linux/fscrypt_notsupp.h
+index 93304cfeb6016..6e95c5a9b7fa1 100644
+--- a/include/linux/fscrypt_notsupp.h
++++ b/include/linux/fscrypt_notsupp.h
+@@ -234,4 +234,10 @@ static inline const char *fscrypt_get_symlink(struct inode *inode,
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+
++static inline int fscrypt_symlink_getattr(const struct path *path,
++ struct kstat *stat)
++{
++ return -EOPNOTSUPP;
++}
++
+ #endif /* _LINUX_FSCRYPT_NOTSUPP_H */
+diff --git a/include/linux/fscrypt_supp.h b/include/linux/fscrypt_supp.h
+index 0409c14ae1de4..f4cb4871a987f 100644
+--- a/include/linux/fscrypt_supp.h
++++ b/include/linux/fscrypt_supp.h
+@@ -231,5 +231,6 @@ extern int __fscrypt_encrypt_symlink(struct inode *inode, const char *target,
+ extern const char *fscrypt_get_symlink(struct inode *inode, const void *caddr,
+ unsigned int max_size,
+ struct delayed_call *done);
++int fscrypt_symlink_getattr(const struct path *path, struct kstat *stat);
+
+ #endif /* _LINUX_FSCRYPT_SUPP_H */
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 2df83a6598182..cb7dc38e9c779 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -513,6 +513,11 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
+
+ void hugetlb_report_usage(struct seq_file *m, struct mm_struct *mm);
+
++static inline void hugetlb_count_init(struct mm_struct *mm)
++{
++ atomic_long_set(&mm->hugetlb_usage, 0);
++}
++
+ static inline void hugetlb_count_add(long l, struct mm_struct *mm)
+ {
+ atomic_long_add(l, &mm->hugetlb_usage);
+@@ -593,6 +598,10 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
+ return &mm->page_table_lock;
+ }
+
++static inline void hugetlb_count_init(struct mm_struct *mm)
++{
++}
++
+ static inline void hugetlb_report_usage(struct seq_file *f, struct mm_struct *m)
+ {
+ }
+diff --git a/include/linux/list.h b/include/linux/list.h
+index de04cc5ed5367..d2c12ef7a4e32 100644
+--- a/include/linux/list.h
++++ b/include/linux/list.h
+@@ -484,6 +484,15 @@ static inline void list_splice_tail_init(struct list_head *list,
+ pos != (head); \
+ pos = n, n = pos->prev)
+
++/**
++ * list_entry_is_head - test if the entry points to the head of the list
++ * @pos: the type * to cursor
++ * @head: the head for your list.
++ * @member: the name of the list_head within the struct.
++ */
++#define list_entry_is_head(pos, head, member) \
++ (&pos->member == (head))
++
+ /**
+ * list_for_each_entry - iterate over list of given type
+ * @pos: the type * to use as a loop cursor.
+@@ -492,7 +501,7 @@ static inline void list_splice_tail_init(struct list_head *list,
+ */
+ #define list_for_each_entry(pos, head, member) \
+ for (pos = list_first_entry(head, typeof(*pos), member); \
+- &pos->member != (head); \
++ !list_entry_is_head(pos, head, member); \
+ pos = list_next_entry(pos, member))
+
+ /**
+@@ -503,7 +512,7 @@ static inline void list_splice_tail_init(struct list_head *list,
+ */
+ #define list_for_each_entry_reverse(pos, head, member) \
+ for (pos = list_last_entry(head, typeof(*pos), member); \
+- &pos->member != (head); \
++ !list_entry_is_head(pos, head, member); \
+ pos = list_prev_entry(pos, member))
+
+ /**
+@@ -528,7 +537,7 @@ static inline void list_splice_tail_init(struct list_head *list,
+ */
+ #define list_for_each_entry_continue(pos, head, member) \
+ for (pos = list_next_entry(pos, member); \
+- &pos->member != (head); \
++ !list_entry_is_head(pos, head, member); \
+ pos = list_next_entry(pos, member))
+
+ /**
+@@ -542,7 +551,7 @@ static inline void list_splice_tail_init(struct list_head *list,
+ */
+ #define list_for_each_entry_continue_reverse(pos, head, member) \
+ for (pos = list_prev_entry(pos, member); \
+- &pos->member != (head); \
++ !list_entry_is_head(pos, head, member); \
+ pos = list_prev_entry(pos, member))
+
+ /**
+@@ -554,7 +563,7 @@ static inline void list_splice_tail_init(struct list_head *list,
+ * Iterate over list of given type, continuing from current position.
+ */
+ #define list_for_each_entry_from(pos, head, member) \
+- for (; &pos->member != (head); \
++ for (; !list_entry_is_head(pos, head, member); \
+ pos = list_next_entry(pos, member))
+
+ /**
+@@ -567,7 +576,7 @@ static inline void list_splice_tail_init(struct list_head *list,
+ * Iterate backwards over list of given type, continuing from current position.
+ */
+ #define list_for_each_entry_from_reverse(pos, head, member) \
+- for (; &pos->member != (head); \
++ for (; !list_entry_is_head(pos, head, member); \
+ pos = list_prev_entry(pos, member))
+
+ /**
+@@ -580,7 +589,7 @@ static inline void list_splice_tail_init(struct list_head *list,
+ #define list_for_each_entry_safe(pos, n, head, member) \
+ for (pos = list_first_entry(head, typeof(*pos), member), \
+ n = list_next_entry(pos, member); \
+- &pos->member != (head); \
++ !list_entry_is_head(pos, head, member); \
+ pos = n, n = list_next_entry(n, member))
+
+ /**
+@@ -596,7 +605,7 @@ static inline void list_splice_tail_init(struct list_head *list,
+ #define list_for_each_entry_safe_continue(pos, n, head, member) \
+ for (pos = list_next_entry(pos, member), \
+ n = list_next_entry(pos, member); \
+- &pos->member != (head); \
++ !list_entry_is_head(pos, head, member); \
+ pos = n, n = list_next_entry(n, member))
+
+ /**
+@@ -611,7 +620,7 @@ static inline void list_splice_tail_init(struct list_head *list,
+ */
+ #define list_for_each_entry_safe_from(pos, n, head, member) \
+ for (n = list_next_entry(pos, member); \
+- &pos->member != (head); \
++ !list_entry_is_head(pos, head, member); \
+ pos = n, n = list_next_entry(n, member))
+
+ /**
+@@ -627,7 +636,7 @@ static inline void list_splice_tail_init(struct list_head *list,
+ #define list_for_each_entry_safe_reverse(pos, n, head, member) \
+ for (pos = list_last_entry(head, typeof(*pos), member), \
+ n = list_prev_entry(pos, member); \
+- &pos->member != (head); \
++ !list_entry_is_head(pos, head, member); \
+ pos = n, n = list_prev_entry(n, member))
+
+ /**
+diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
+index d17d45c41a0b0..5653178768227 100644
+--- a/include/linux/memory_hotplug.h
++++ b/include/linux/memory_hotplug.h
+@@ -344,6 +344,6 @@ extern struct page *sparse_decode_mem_map(unsigned long coded_mem_map,
+ unsigned long pnum);
+ extern bool allow_online_pfn_range(int nid, unsigned long pfn, unsigned long nr_pages,
+ int online_type);
+-extern struct zone *zone_for_pfn_range(int online_type, int nid, unsigned start_pfn,
+- unsigned long nr_pages);
++extern struct zone *zone_for_pfn_range(int online_type, int nid,
++ unsigned long start_pfn, unsigned long nr_pages);
+ #endif /* __LINUX_MEMORY_HOTPLUG_H */
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 2fda9893962d1..6f9ca2f278b32 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1644,8 +1644,9 @@ static inline int pci_enable_device(struct pci_dev *dev) { return -EIO; }
+ static inline void pci_disable_device(struct pci_dev *dev) { }
+ static inline int pci_assign_resource(struct pci_dev *dev, int i)
+ { return -EBUSY; }
+-static inline int __pci_register_driver(struct pci_driver *drv,
+- struct module *owner)
++static inline int __must_check __pci_register_driver(struct pci_driver *drv,
++ struct module *owner,
++ const char *mod_name)
+ { return 0; }
+ static inline int pci_register_driver(struct pci_driver *drv)
+ { return 0; }
+diff --git a/include/linux/power/max17042_battery.h b/include/linux/power/max17042_battery.h
+index a7ed29baf44a6..86e5ad8aeee4e 100644
+--- a/include/linux/power/max17042_battery.h
++++ b/include/linux/power/max17042_battery.h
+@@ -82,7 +82,7 @@ enum max17042_register {
+ MAX17042_RelaxCFG = 0x2A,
+ MAX17042_MiscCFG = 0x2B,
+ MAX17042_TGAIN = 0x2C,
+- MAx17042_TOFF = 0x2D,
++ MAX17042_TOFF = 0x2D,
+ MAX17042_CGAIN = 0x2E,
+ MAX17042_COFF = 0x2F,
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 5f2e6451ece54..f97734f34746a 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1761,7 +1761,7 @@ static inline void __skb_insert(struct sk_buff *newsk,
+ WRITE_ONCE(newsk->prev, prev);
+ WRITE_ONCE(next->prev, newsk);
+ WRITE_ONCE(prev->next, newsk);
+- list->qlen++;
++ WRITE_ONCE(list->qlen, list->qlen + 1);
+ }
+
+ static inline void __skb_queue_splice(const struct sk_buff_head *list,
+diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
+index fdb6b317d9747..c46abf35c9bb6 100644
+--- a/include/linux/sunrpc/svc.h
++++ b/include/linux/sunrpc/svc.h
+@@ -271,6 +271,7 @@ struct svc_rqst {
+ #define RQ_VICTIM (5) /* about to be shut down */
+ #define RQ_BUSY (6) /* request is busy */
+ #define RQ_DATA (7) /* request has data */
++#define RQ_AUTHERR (8) /* Request status is auth error */
+ unsigned long rq_flags; /* flags field */
+ ktime_t rq_qtime; /* enqueue time */
+
+@@ -504,6 +505,7 @@ unsigned int svc_fill_write_vector(struct svc_rqst *rqstp,
+ char *svc_fill_symlink_pathname(struct svc_rqst *rqstp,
+ struct kvec *first, void *p,
+ size_t total);
++__be32 svc_return_autherr(struct svc_rqst *rqstp, __be32 auth_err);
+
+ #define RPC_MAX_ADDRBUFLEN (63U)
+
+diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h
+index 8975fd1a1421f..24ce2aab89469 100644
+--- a/include/uapi/linux/pkt_sched.h
++++ b/include/uapi/linux/pkt_sched.h
+@@ -779,6 +779,8 @@ struct tc_codel_xstats {
+
+ /* FQ_CODEL */
+
++#define FQ_CODEL_QUANTUM_MAX (1 << 20)
++
+ enum {
+ TCA_FQ_CODEL_UNSPEC,
+ TCA_FQ_CODEL_TARGET,
+diff --git a/include/uapi/linux/serial_reg.h b/include/uapi/linux/serial_reg.h
+index be07b5470f4bb..f51bc8f368134 100644
+--- a/include/uapi/linux/serial_reg.h
++++ b/include/uapi/linux/serial_reg.h
+@@ -62,6 +62,7 @@
+ * ST16C654: 8 16 56 60 8 16 32 56 PORT_16654
+ * TI16C750: 1 16 32 56 xx xx xx xx PORT_16750
+ * TI16C752: 8 16 56 60 8 16 32 56
++ * OX16C950: 16 32 112 120 16 32 64 112 PORT_16C950
+ * Tegra: 1 4 8 14 16 8 4 1 PORT_TEGRA
+ */
+ #define UART_FCR_R_TRIG_00 0x00
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index d2b6d2459aad4..341402bc1202d 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -33,6 +33,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/perf_event.h>
+
++#include <asm/barrier.h>
+ #include <asm/unaligned.h>
+
+ /* Registers */
+@@ -1050,6 +1051,7 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack)
+ /* Non-UAPI available opcodes. */
+ [BPF_JMP | BPF_CALL_ARGS] = &&JMP_CALL_ARGS,
+ [BPF_JMP | BPF_TAIL_CALL] = &&JMP_TAIL_CALL,
++ [BPF_ST | BPF_NOSPEC] = &&ST_NOSPEC,
+ };
+ #undef BPF_INSN_3_LBL
+ #undef BPF_INSN_2_LBL
+@@ -1356,7 +1358,21 @@ out:
+ JMP_EXIT:
+ return BPF_R0;
+
+- /* STX and ST and LDX*/
++ /* ST, STX and LDX*/
++ ST_NOSPEC:
++ /* Speculation barrier for mitigating Speculative Store Bypass.
++ * In case of arm64, we rely on the firmware mitigation as
++ * controlled via the ssbd kernel parameter. Whenever the
++ * mitigation is enabled, it works for all of the kernel code
++ * with no need to provide any additional instructions here.
++ * In case of x86, we use 'lfence' insn for mitigation. We
++ * reuse preexisting logic from Spectre v1 mitigation that
++ * happens to produce the required code on x86 for v4 as well.
++ */
++#ifdef CONFIG_X86
++ barrier_nospec();
++#endif
++ CONT;
+ #define LDST(SIZEOP, SIZE) \
+ STX_MEM_##SIZEOP: \
+ *(SIZE *)(unsigned long) (DST + insn->off) = SRC; \
+diff --git a/kernel/bpf/disasm.c b/kernel/bpf/disasm.c
+index d6b76377cb6ee..cbd75dd5992ef 100644
+--- a/kernel/bpf/disasm.c
++++ b/kernel/bpf/disasm.c
+@@ -171,15 +171,17 @@ void print_bpf_insn(const struct bpf_insn_cbs *cbs,
+ else
+ verbose(cbs->private_data, "BUG_%02x\n", insn->code);
+ } else if (class == BPF_ST) {
+- if (BPF_MODE(insn->code) != BPF_MEM) {
++ if (BPF_MODE(insn->code) == BPF_MEM) {
++ verbose(cbs->private_data, "(%02x) *(%s *)(r%d %+d) = %d\n",
++ insn->code,
++ bpf_ldst_string[BPF_SIZE(insn->code) >> 3],
++ insn->dst_reg,
++ insn->off, insn->imm);
++ } else if (BPF_MODE(insn->code) == 0xc0 /* BPF_NOSPEC, no UAPI */) {
++ verbose(cbs->private_data, "(%02x) nospec\n", insn->code);
++ } else {
+ verbose(cbs->private_data, "BUG_st_%02x\n", insn->code);
+- return;
+ }
+- verbose(cbs->private_data, "(%02x) *(%s *)(r%d %+d) = %d\n",
+- insn->code,
+- bpf_ldst_string[BPF_SIZE(insn->code) >> 3],
+- insn->dst_reg,
+- insn->off, insn->imm);
+ } else if (class == BPF_LDX) {
+ if (BPF_MODE(insn->code) != BPF_MEM) {
+ verbose(cbs->private_data, "BUG_ldx_%02x\n", insn->code);
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index abdc9eca463c5..9a671f604ebfe 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -380,9 +380,9 @@ static int copy_stack_state(struct bpf_func_state *dst,
+ /* do_check() starts with zero-sized stack in struct bpf_verifier_state to
+ * make it consume minimal amount of memory. check_stack_write() access from
+ * the program calls into realloc_func_state() to grow the stack size.
+- * Note there is a non-zero 'parent' pointer inside bpf_verifier_state
+- * which this function copies over. It points to previous bpf_verifier_state
+- * which is never reallocated
++ * Note there is a non-zero parent pointer inside each reg of bpf_verifier_state
++ * which this function copies over. It points to corresponding reg in previous
++ * bpf_verifier_state which is never reallocated
+ */
+ static int realloc_func_state(struct bpf_func_state *state, int size,
+ bool copy_old)
+@@ -467,7 +467,6 @@ static int copy_verifier_state(struct bpf_verifier_state *dst_state,
+ }
+ dst_state->speculative = src->speculative;
+ dst_state->curframe = src->curframe;
+- dst_state->parent = src->parent;
+ for (i = 0; i <= src->curframe; i++) {
+ dst = dst_state->frame[i];
+ if (!dst) {
+@@ -739,6 +738,7 @@ static void init_reg_state(struct bpf_verifier_env *env,
+ for (i = 0; i < MAX_BPF_REG; i++) {
+ mark_reg_not_init(env, regs, i);
+ regs[i].live = REG_LIVE_NONE;
++ regs[i].parent = NULL;
+ }
+
+ /* frame pointer */
+@@ -883,74 +883,21 @@ next:
+ return 0;
+ }
+
+-static
+-struct bpf_verifier_state *skip_callee(struct bpf_verifier_env *env,
+- const struct bpf_verifier_state *state,
+- struct bpf_verifier_state *parent,
+- u32 regno)
+-{
+- struct bpf_verifier_state *tmp = NULL;
+-
+- /* 'parent' could be a state of caller and
+- * 'state' could be a state of callee. In such case
+- * parent->curframe < state->curframe
+- * and it's ok for r1 - r5 registers
+- *
+- * 'parent' could be a callee's state after it bpf_exit-ed.
+- * In such case parent->curframe > state->curframe
+- * and it's ok for r0 only
+- */
+- if (parent->curframe == state->curframe ||
+- (parent->curframe < state->curframe &&
+- regno >= BPF_REG_1 && regno <= BPF_REG_5) ||
+- (parent->curframe > state->curframe &&
+- regno == BPF_REG_0))
+- return parent;
+-
+- if (parent->curframe > state->curframe &&
+- regno >= BPF_REG_6) {
+- /* for callee saved regs we have to skip the whole chain
+- * of states that belong to callee and mark as LIVE_READ
+- * the registers before the call
+- */
+- tmp = parent;
+- while (tmp && tmp->curframe != state->curframe) {
+- tmp = tmp->parent;
+- }
+- if (!tmp)
+- goto bug;
+- parent = tmp;
+- } else {
+- goto bug;
+- }
+- return parent;
+-bug:
+- verbose(env, "verifier bug regno %d tmp %p\n", regno, tmp);
+- verbose(env, "regno %d parent frame %d current frame %d\n",
+- regno, parent->curframe, state->curframe);
+- return NULL;
+-}
+-
++/* Parentage chain of this register (or stack slot) should take care of all
++ * issues like callee-saved registers, stack slot allocation time, etc.
++ */
+ static int mark_reg_read(struct bpf_verifier_env *env,
+- const struct bpf_verifier_state *state,
+- struct bpf_verifier_state *parent,
+- u32 regno)
++ const struct bpf_reg_state *state,
++ struct bpf_reg_state *parent)
+ {
+ bool writes = parent == state->parent; /* Observe write marks */
+
+- if (regno == BPF_REG_FP)
+- /* We don't need to worry about FP liveness because it's read-only */
+- return 0;
+-
+ while (parent) {
+ /* if read wasn't screened by an earlier write ... */
+- if (writes && state->frame[state->curframe]->regs[regno].live & REG_LIVE_WRITTEN)
++ if (writes && state->live & REG_LIVE_WRITTEN)
+ break;
+- parent = skip_callee(env, state, parent, regno);
+- if (!parent)
+- return -EFAULT;
+ /* ... then we depend on parent's value */
+- parent->frame[parent->curframe]->regs[regno].live |= REG_LIVE_READ;
++ parent->live |= REG_LIVE_READ;
+ state = parent;
+ parent = state->parent;
+ writes = true;
+@@ -976,7 +923,10 @@ static int check_reg_arg(struct bpf_verifier_env *env, u32 regno,
+ verbose(env, "R%d !read_ok\n", regno);
+ return -EACCES;
+ }
+- return mark_reg_read(env, vstate, vstate->parent, regno);
++ /* We don't need to worry about FP liveness because it's read-only */
++ if (regno != BPF_REG_FP)
++ return mark_reg_read(env, ®s[regno],
++ regs[regno].parent);
+ } else {
+ /* check whether register used as dest operand can be written to */
+ if (regno == BPF_REG_FP) {
+@@ -1013,6 +963,23 @@ static bool register_is_null(struct bpf_reg_state *reg)
+ return reg->type == SCALAR_VALUE && tnum_equals_const(reg->var_off, 0);
+ }
+
++static bool register_is_const(struct bpf_reg_state *reg)
++{
++ return reg->type == SCALAR_VALUE && tnum_is_const(reg->var_off);
++}
++
++static void save_register_state(struct bpf_func_state *state,
++ int spi, struct bpf_reg_state *reg)
++{
++ int i;
++
++ state->stack[spi].spilled_ptr = *reg;
++ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN;
++
++ for (i = 0; i < BPF_REG_SIZE; i++)
++ state->stack[spi].slot_type[i] = STACK_SPILL;
++}
++
+ /* check_stack_read/write functions track spill/fill of registers,
+ * stack boundary and alignment are checked in check_mem_access()
+ */
+@@ -1022,7 +989,7 @@ static int check_stack_write(struct bpf_verifier_env *env,
+ {
+ struct bpf_func_state *cur; /* state of the current function */
+ int i, slot = -off - 1, spi = slot / BPF_REG_SIZE, err;
+- enum bpf_reg_type type;
++ struct bpf_reg_state *reg = NULL;
+
+ err = realloc_func_state(state, round_up(slot + 1, BPF_REG_SIZE),
+ true);
+@@ -1039,56 +1006,45 @@ static int check_stack_write(struct bpf_verifier_env *env,
+ }
+
+ cur = env->cur_state->frame[env->cur_state->curframe];
+- if (value_regno >= 0 &&
+- is_spillable_regtype((type = cur->regs[value_regno].type))) {
++ if (value_regno >= 0)
++ reg = &cur->regs[value_regno];
++ if (!env->allow_ptr_leaks) {
++ bool sanitize = reg && is_spillable_regtype(reg->type);
+
++ for (i = 0; i < size; i++) {
++ if (state->stack[spi].slot_type[i] == STACK_INVALID) {
++ sanitize = true;
++ break;
++ }
++ }
++
++ if (sanitize)
++ env->insn_aux_data[insn_idx].sanitize_stack_spill = true;
++ }
++
++ if (reg && size == BPF_REG_SIZE && register_is_const(reg) &&
++ !register_is_null(reg) && env->allow_ptr_leaks) {
++ save_register_state(state, spi, reg);
++ } else if (reg && is_spillable_regtype(reg->type)) {
+ /* register containing pointer is being spilled into stack */
+ if (size != BPF_REG_SIZE) {
+ verbose(env, "invalid size of register spill\n");
+ return -EACCES;
+ }
+-
+- if (state != cur && type == PTR_TO_STACK) {
++ if (state != cur && reg->type == PTR_TO_STACK) {
+ verbose(env, "cannot spill pointers to stack into stack frame of the caller\n");
+ return -EINVAL;
+ }
+-
+- /* save register state */
+- state->stack[spi].spilled_ptr = cur->regs[value_regno];
+- state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN;
+-
+- for (i = 0; i < BPF_REG_SIZE; i++) {
+- if (state->stack[spi].slot_type[i] == STACK_MISC &&
+- !env->allow_ptr_leaks) {
+- int *poff = &env->insn_aux_data[insn_idx].sanitize_stack_off;
+- int soff = (-spi - 1) * BPF_REG_SIZE;
+-
+- /* detected reuse of integer stack slot with a pointer
+- * which means either llvm is reusing stack slot or
+- * an attacker is trying to exploit CVE-2018-3639
+- * (speculative store bypass)
+- * Have to sanitize that slot with preemptive
+- * store of zero.
+- */
+- if (*poff && *poff != soff) {
+- /* disallow programs where single insn stores
+- * into two different stack slots, since verifier
+- * cannot sanitize them
+- */
+- verbose(env,
+- "insn %d cannot access two stack slots fp%d and fp%d",
+- insn_idx, *poff, soff);
+- return -EINVAL;
+- }
+- *poff = soff;
+- }
+- state->stack[spi].slot_type[i] = STACK_SPILL;
+- }
++ save_register_state(state, spi, reg);
+ } else {
+ u8 type = STACK_MISC;
+
+- /* regular write of data into stack */
+- state->stack[spi].spilled_ptr = (struct bpf_reg_state) {};
++ /* regular write of data into stack destroys any spilled ptr */
++ state->stack[spi].spilled_ptr.type = NOT_INIT;
++ /* Mark slots as STACK_MISC if they belonged to spilled ptr. */
++ if (state->stack[spi].slot_type[0] == STACK_SPILL)
++ for (i = 0; i < BPF_REG_SIZE; i++)
++ state->stack[spi].slot_type[i] = STACK_MISC;
+
+ /* only mark the slot as written if all 8 bytes were written
+ * otherwise read propagation may incorrectly stop too soon
+@@ -1102,10 +1058,10 @@ static int check_stack_write(struct bpf_verifier_env *env,
+ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN;
+
+ /* when we zero initialize stack slots mark them as such */
+- if (value_regno >= 0 &&
+- register_is_null(&cur->regs[value_regno]))
++ if (reg && register_is_null(reg))
+ type = STACK_ZERO;
+
++ /* Mark slots affected by this stack write. */
+ for (i = 0; i < size; i++)
+ state->stack[spi].slot_type[(slot - i) % BPF_REG_SIZE] =
+ type;
+@@ -1113,61 +1069,6 @@ static int check_stack_write(struct bpf_verifier_env *env,
+ return 0;
+ }
+
+-/* registers of every function are unique and mark_reg_read() propagates
+- * the liveness in the following cases:
+- * - from callee into caller for R1 - R5 that were used as arguments
+- * - from caller into callee for R0 that used as result of the call
+- * - from caller to the same caller skipping states of the callee for R6 - R9,
+- * since R6 - R9 are callee saved by implicit function prologue and
+- * caller's R6 != callee's R6, so when we propagate liveness up to
+- * parent states we need to skip callee states for R6 - R9.
+- *
+- * stack slot marking is different, since stacks of caller and callee are
+- * accessible in both (since caller can pass a pointer to caller's stack to
+- * callee which can pass it to another function), hence mark_stack_slot_read()
+- * has to propagate the stack liveness to all parent states at given frame number.
+- * Consider code:
+- * f1() {
+- * ptr = fp - 8;
+- * *ptr = ctx;
+- * call f2 {
+- * .. = *ptr;
+- * }
+- * .. = *ptr;
+- * }
+- * First *ptr is reading from f1's stack and mark_stack_slot_read() has
+- * to mark liveness at the f1's frame and not f2's frame.
+- * Second *ptr is also reading from f1's stack and mark_stack_slot_read() has
+- * to propagate liveness to f2 states at f1's frame level and further into
+- * f1 states at f1's frame level until write into that stack slot
+- */
+-static void mark_stack_slot_read(struct bpf_verifier_env *env,
+- const struct bpf_verifier_state *state,
+- struct bpf_verifier_state *parent,
+- int slot, int frameno)
+-{
+- bool writes = parent == state->parent; /* Observe write marks */
+-
+- while (parent) {
+- if (parent->frame[frameno]->allocated_stack <= slot * BPF_REG_SIZE)
+- /* since LIVE_WRITTEN mark is only done for full 8-byte
+- * write the read marks are conservative and parent
+- * state may not even have the stack allocated. In such case
+- * end the propagation, since the loop reached beginning
+- * of the function
+- */
+- break;
+- /* if read wasn't screened by an earlier write ... */
+- if (writes && state->frame[frameno]->stack[slot].spilled_ptr.live & REG_LIVE_WRITTEN)
+- break;
+- /* ... then we depend on parent's value */
+- parent->frame[frameno]->stack[slot].spilled_ptr.live |= REG_LIVE_READ;
+- state = parent;
+- parent = state->parent;
+- writes = true;
+- }
+-}
+-
+ static int check_stack_read(struct bpf_verifier_env *env,
+ struct bpf_func_state *reg_state /* func where register points to */,
+ int off, int size, int value_regno)
+@@ -1175,6 +1076,7 @@ static int check_stack_read(struct bpf_verifier_env *env,
+ struct bpf_verifier_state *vstate = env->cur_state;
+ struct bpf_func_state *state = vstate->frame[vstate->curframe];
+ int i, slot = -off - 1, spi = slot / BPF_REG_SIZE;
++ struct bpf_reg_state *reg;
+ u8 *stype;
+
+ if (reg_state->allocated_stack <= slot) {
+@@ -1183,11 +1085,20 @@ static int check_stack_read(struct bpf_verifier_env *env,
+ return -EACCES;
+ }
+ stype = reg_state->stack[spi].slot_type;
++ reg = ®_state->stack[spi].spilled_ptr;
+
+ if (stype[0] == STACK_SPILL) {
+ if (size != BPF_REG_SIZE) {
+- verbose(env, "invalid size of register spill\n");
+- return -EACCES;
++ if (reg->type != SCALAR_VALUE) {
++ verbose(env, "invalid size of register fill\n");
++ return -EACCES;
++ }
++ if (value_regno >= 0) {
++ mark_reg_unknown(env, state->regs, value_regno);
++ state->regs[value_regno].live |= REG_LIVE_WRITTEN;
++ }
++ mark_reg_read(env, reg, reg->parent);
++ return 0;
+ }
+ for (i = 1; i < BPF_REG_SIZE; i++) {
+ if (stype[(slot - i) % BPF_REG_SIZE] != STACK_SPILL) {
+@@ -1198,16 +1109,14 @@ static int check_stack_read(struct bpf_verifier_env *env,
+
+ if (value_regno >= 0) {
+ /* restore register state from stack */
+- state->regs[value_regno] = reg_state->stack[spi].spilled_ptr;
++ state->regs[value_regno] = *reg;
+ /* mark reg as written since spilled pointer state likely
+ * has its liveness marks cleared by is_state_visited()
+ * which resets stack/reg liveness for state transitions
+ */
+ state->regs[value_regno].live |= REG_LIVE_WRITTEN;
+ }
+- mark_stack_slot_read(env, vstate, vstate->parent, spi,
+- reg_state->frameno);
+- return 0;
++ mark_reg_read(env, reg, reg->parent);
+ } else {
+ int zeros = 0;
+
+@@ -1222,8 +1131,7 @@ static int check_stack_read(struct bpf_verifier_env *env,
+ off, i, size);
+ return -EACCES;
+ }
+- mark_stack_slot_read(env, vstate, vstate->parent, spi,
+- reg_state->frameno);
++ mark_reg_read(env, reg, reg->parent);
+ if (value_regno >= 0) {
+ if (zeros == size) {
+ /* any size read into register is zero extended,
+@@ -1236,8 +1144,8 @@ static int check_stack_read(struct bpf_verifier_env *env,
+ }
+ state->regs[value_regno].live |= REG_LIVE_WRITTEN;
+ }
+- return 0;
+ }
++ return 0;
+ }
+
+ static int check_stack_access(struct bpf_verifier_env *env,
+@@ -1855,6 +1763,29 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins
+ BPF_SIZE(insn->code), BPF_WRITE, -1, true);
+ }
+
++static int __check_stack_boundary(struct bpf_verifier_env *env, u32 regno,
++ int off, int access_size,
++ bool zero_size_allowed)
++{
++ struct bpf_reg_state *reg = cur_regs(env) + regno;
++
++ if (off >= 0 || off < -MAX_BPF_STACK || off + access_size > 0 ||
++ access_size < 0 || (access_size == 0 && !zero_size_allowed)) {
++ if (tnum_is_const(reg->var_off)) {
++ verbose(env, "invalid stack type R%d off=%d access_size=%d\n",
++ regno, off, access_size);
++ } else {
++ char tn_buf[48];
++
++ tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
++ verbose(env, "invalid stack type R%d var_off=%s access_size=%d\n",
++ regno, tn_buf, access_size);
++ }
++ return -EACCES;
++ }
++ return 0;
++}
++
+ /* when register 'regno' is passed into function that will read 'access_size'
+ * bytes from that pointer, make sure that it's within stack boundary
+ * and all elements of stack are initialized.
+@@ -1867,7 +1798,7 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
+ {
+ struct bpf_reg_state *reg = cur_regs(env) + regno;
+ struct bpf_func_state *state = func(env, reg);
+- int off, i, slot, spi;
++ int err, min_off, max_off, i, j, slot, spi;
+
+ if (reg->type != PTR_TO_STACK) {
+ /* Allow zero-byte read from NULL, regardless of pointer type */
+@@ -1881,21 +1812,57 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
+ return -EACCES;
+ }
+
+- /* Only allow fixed-offset stack reads */
+- if (!tnum_is_const(reg->var_off)) {
+- char tn_buf[48];
++ if (tnum_is_const(reg->var_off)) {
++ min_off = max_off = reg->var_off.value + reg->off;
++ err = __check_stack_boundary(env, regno, min_off, access_size,
++ zero_size_allowed);
++ if (err)
++ return err;
++ } else {
++ /* Variable offset is prohibited for unprivileged mode for
++ * simplicity since it requires corresponding support in
++ * Spectre masking for stack ALU.
++ * See also retrieve_ptr_limit().
++ */
++ if (!env->allow_ptr_leaks) {
++ char tn_buf[48];
+
+- tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
+- verbose(env, "invalid variable stack read R%d var_off=%s\n",
+- regno, tn_buf);
+- return -EACCES;
+- }
+- off = reg->off + reg->var_off.value;
+- if (off >= 0 || off < -MAX_BPF_STACK || off + access_size > 0 ||
+- access_size < 0 || (access_size == 0 && !zero_size_allowed)) {
+- verbose(env, "invalid stack type R%d off=%d access_size=%d\n",
+- regno, off, access_size);
+- return -EACCES;
++ tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
++ verbose(env, "R%d indirect variable offset stack access prohibited for !root, var_off=%s\n",
++ regno, tn_buf);
++ return -EACCES;
++ }
++ /* Only initialized buffer on stack is allowed to be accessed
++ * with variable offset. With uninitialized buffer it's hard to
++ * guarantee that whole memory is marked as initialized on
++ * helper return since specific bounds are unknown what may
++ * cause uninitialized stack leaking.
++ */
++ if (meta && meta->raw_mode)
++ meta = NULL;
++
++ if (reg->smax_value >= BPF_MAX_VAR_OFF ||
++ reg->smax_value <= -BPF_MAX_VAR_OFF) {
++ verbose(env, "R%d unbounded indirect variable offset stack access\n",
++ regno);
++ return -EACCES;
++ }
++ min_off = reg->smin_value + reg->off;
++ max_off = reg->smax_value + reg->off;
++ err = __check_stack_boundary(env, regno, min_off, access_size,
++ zero_size_allowed);
++ if (err) {
++ verbose(env, "R%d min value is outside of stack bound\n",
++ regno);
++ return err;
++ }
++ err = __check_stack_boundary(env, regno, max_off, access_size,
++ zero_size_allowed);
++ if (err) {
++ verbose(env, "R%d max value is outside of stack bound\n",
++ regno);
++ return err;
++ }
+ }
+
+ if (meta && meta->raw_mode) {
+@@ -1904,10 +1871,10 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
+ return 0;
+ }
+
+- for (i = 0; i < access_size; i++) {
++ for (i = min_off; i < max_off + access_size; i++) {
+ u8 *stype;
+
+- slot = -(off + i) - 1;
++ slot = -i - 1;
+ spi = slot / BPF_REG_SIZE;
+ if (state->allocated_stack <= slot)
+ goto err;
+@@ -1919,18 +1886,34 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
+ *stype = STACK_MISC;
+ goto mark;
+ }
++ if (state->stack[spi].slot_type[0] == STACK_SPILL &&
++ state->stack[spi].spilled_ptr.type == SCALAR_VALUE) {
++ __mark_reg_unknown(&state->stack[spi].spilled_ptr);
++ for (j = 0; j < BPF_REG_SIZE; j++)
++ state->stack[spi].slot_type[j] = STACK_MISC;
++ goto mark;
++ }
++
+ err:
+- verbose(env, "invalid indirect read from stack off %d+%d size %d\n",
+- off, i, access_size);
++ if (tnum_is_const(reg->var_off)) {
++ verbose(env, "invalid indirect read from stack off %d+%d size %d\n",
++ min_off, i - min_off, access_size);
++ } else {
++ char tn_buf[48];
++
++ tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
++ verbose(env, "invalid indirect read from stack var_off %s+%d size %d\n",
++ tn_buf, i - min_off, access_size);
++ }
+ return -EACCES;
+ mark:
+ /* reading any byte out of 8-byte 'spill_slot' will cause
+ * the whole slot to be marked as 'read'
+ */
+- mark_stack_slot_read(env, env->cur_state, env->cur_state->parent,
+- spi, state->frameno);
++ mark_reg_read(env, &state->stack[spi].spilled_ptr,
++ state->stack[spi].spilled_ptr.parent);
+ }
+- return update_stack_depth(env, state, off);
++ return update_stack_depth(env, state, min_off);
+ }
+
+ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
+@@ -2384,11 +2367,13 @@ static int check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+ state->curframe + 1 /* frameno within this callchain */,
+ subprog /* subprog number within this prog */);
+
+- /* copy r1 - r5 args that callee can access */
++ /* copy r1 - r5 args that callee can access. The copy includes parent
++ * pointers, which connects us up to the liveness chain
++ */
+ for (i = BPF_REG_1; i <= BPF_REG_5; i++)
+ callee->regs[i] = caller->regs[i];
+
+- /* after the call regsiters r0 - r5 were scratched */
++ /* after the call registers r0 - r5 were scratched */
+ for (i = 0; i < CALLER_SAVED_REGS; i++) {
+ mark_reg_not_init(env, caller->regs, caller_saved[i]);
+ check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK);
+@@ -2886,6 +2871,12 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
+ alu_state |= off_is_imm ? BPF_ALU_IMMEDIATE : 0;
+ alu_state |= ptr_is_dst_reg ?
+ BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST;
++
++ /* Limit pruning on unknown scalars to enable deep search for
++ * potential masking differences from other program paths.
++ */
++ if (!off_is_imm)
++ env->explore_alu_limits = true;
+ }
+
+ err = update_alu_sanitation_state(aux, alu_state, alu_limit);
+@@ -4798,13 +4789,6 @@ static bool range_within(struct bpf_reg_state *old,
+ old->smax_value >= cur->smax_value;
+ }
+
+-/* Maximum number of register states that can exist at once */
+-#define ID_MAP_SIZE (MAX_BPF_REG + MAX_BPF_STACK / BPF_REG_SIZE)
+-struct idpair {
+- u32 old;
+- u32 cur;
+-};
+-
+ /* If in the old state two registers had the same id, then they need to have
+ * the same id in the new state as well. But that id could be different from
+ * the old state, so we need to track the mapping from old to new ids.
+@@ -4815,11 +4799,11 @@ struct idpair {
+ * So we look through our idmap to see if this old id has been seen before. If
+ * so, we require the new id to match; otherwise, we add the id pair to the map.
+ */
+-static bool check_ids(u32 old_id, u32 cur_id, struct idpair *idmap)
++static bool check_ids(u32 old_id, u32 cur_id, struct bpf_id_pair *idmap)
+ {
+ unsigned int i;
+
+- for (i = 0; i < ID_MAP_SIZE; i++) {
++ for (i = 0; i < BPF_ID_MAP_SIZE; i++) {
+ if (!idmap[i].old) {
+ /* Reached an empty slot; haven't seen this id before */
+ idmap[i].old = old_id;
+@@ -4835,8 +4819,8 @@ static bool check_ids(u32 old_id, u32 cur_id, struct idpair *idmap)
+ }
+
+ /* Returns true if (rold safe implies rcur safe) */
+-static bool regsafe(struct bpf_reg_state *rold, struct bpf_reg_state *rcur,
+- struct idpair *idmap)
++static bool regsafe(struct bpf_verifier_env *env, struct bpf_reg_state *rold,
++ struct bpf_reg_state *rcur, struct bpf_id_pair *idmap)
+ {
+ bool equal;
+
+@@ -4844,7 +4828,7 @@ static bool regsafe(struct bpf_reg_state *rold, struct bpf_reg_state *rcur,
+ /* explored state didn't use this */
+ return true;
+
+- equal = memcmp(rold, rcur, offsetof(struct bpf_reg_state, frameno)) == 0;
++ equal = memcmp(rold, rcur, offsetof(struct bpf_reg_state, parent)) == 0;
+
+ if (rold->type == PTR_TO_STACK)
+ /* two stack pointers are equal only if they're pointing to
+@@ -4862,6 +4846,8 @@ static bool regsafe(struct bpf_reg_state *rold, struct bpf_reg_state *rcur,
+ return false;
+ switch (rold->type) {
+ case SCALAR_VALUE:
++ if (env->explore_alu_limits)
++ return false;
+ if (rcur->type == SCALAR_VALUE) {
+ /* new val must satisfy old val knowledge */
+ return range_within(rold, rcur) &&
+@@ -4938,9 +4924,8 @@ static bool regsafe(struct bpf_reg_state *rold, struct bpf_reg_state *rcur,
+ return false;
+ }
+
+-static bool stacksafe(struct bpf_func_state *old,
+- struct bpf_func_state *cur,
+- struct idpair *idmap)
++static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old,
++ struct bpf_func_state *cur, struct bpf_id_pair *idmap)
+ {
+ int i, spi;
+
+@@ -4982,9 +4967,8 @@ static bool stacksafe(struct bpf_func_state *old,
+ continue;
+ if (old->stack[spi].slot_type[0] != STACK_SPILL)
+ continue;
+- if (!regsafe(&old->stack[spi].spilled_ptr,
+- &cur->stack[spi].spilled_ptr,
+- idmap))
++ if (!regsafe(env, &old->stack[spi].spilled_ptr,
++ &cur->stack[spi].spilled_ptr, idmap))
+ /* when explored and current stack slot are both storing
+ * spilled registers, check that stored pointers types
+ * are the same as well.
+@@ -5026,29 +5010,21 @@ static bool stacksafe(struct bpf_func_state *old,
+ * whereas register type in current state is meaningful, it means that
+ * the current state will reach 'bpf_exit' instruction safely
+ */
+-static bool func_states_equal(struct bpf_func_state *old,
++static bool func_states_equal(struct bpf_verifier_env *env, struct bpf_func_state *old,
+ struct bpf_func_state *cur)
+ {
+- struct idpair *idmap;
+- bool ret = false;
+ int i;
+
+- idmap = kcalloc(ID_MAP_SIZE, sizeof(struct idpair), GFP_KERNEL);
+- /* If we failed to allocate the idmap, just say it's not safe */
+- if (!idmap)
+- return false;
++ memset(env->idmap_scratch, 0, sizeof(env->idmap_scratch));
++ for (i = 0; i < MAX_BPF_REG; i++)
++ if (!regsafe(env, &old->regs[i], &cur->regs[i],
++ env->idmap_scratch))
++ return false;
+
+- for (i = 0; i < MAX_BPF_REG; i++) {
+- if (!regsafe(&old->regs[i], &cur->regs[i], idmap))
+- goto out_free;
+- }
++ if (!stacksafe(env, old, cur, env->idmap_scratch))
++ return false;
+
+- if (!stacksafe(old, cur, idmap))
+- goto out_free;
+- ret = true;
+-out_free:
+- kfree(idmap);
+- return ret;
++ return true;
+ }
+
+ static bool states_equal(struct bpf_verifier_env *env,
+@@ -5072,7 +5048,7 @@ static bool states_equal(struct bpf_verifier_env *env,
+ for (i = 0; i <= old->curframe; i++) {
+ if (old->frame[i]->callsite != cur->frame[i]->callsite)
+ return false;
+- if (!func_states_equal(old->frame[i], cur->frame[i]))
++ if (!func_states_equal(env, old->frame[i], cur->frame[i]))
+ return false;
+ }
+ return true;
+@@ -5083,7 +5059,7 @@ static bool states_equal(struct bpf_verifier_env *env,
+ * equivalent state (jump target or such) we didn't arrive by the straight-line
+ * code, so read marks in the state must propagate to the parent regardless
+ * of the state's write marks. That's what 'parent == state->parent' comparison
+- * in mark_reg_read() and mark_stack_slot_read() is for.
++ * in mark_reg_read() is for.
+ */
+ static int propagate_liveness(struct bpf_verifier_env *env,
+ const struct bpf_verifier_state *vstate,
+@@ -5104,7 +5080,8 @@ static int propagate_liveness(struct bpf_verifier_env *env,
+ if (vparent->frame[vparent->curframe]->regs[i].live & REG_LIVE_READ)
+ continue;
+ if (vstate->frame[vstate->curframe]->regs[i].live & REG_LIVE_READ) {
+- err = mark_reg_read(env, vstate, vparent, i);
++ err = mark_reg_read(env, &vstate->frame[vstate->curframe]->regs[i],
++ &vparent->frame[vstate->curframe]->regs[i]);
+ if (err)
+ return err;
+ }
+@@ -5119,7 +5096,8 @@ static int propagate_liveness(struct bpf_verifier_env *env,
+ if (parent->stack[i].spilled_ptr.live & REG_LIVE_READ)
+ continue;
+ if (state->stack[i].spilled_ptr.live & REG_LIVE_READ)
+- mark_stack_slot_read(env, vstate, vparent, i, frame);
++ mark_reg_read(env, &state->stack[i].spilled_ptr,
++ &parent->stack[i].spilled_ptr);
+ }
+ }
+ return err;
+@@ -5129,7 +5107,7 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
+ {
+ struct bpf_verifier_state_list *new_sl;
+ struct bpf_verifier_state_list *sl;
+- struct bpf_verifier_state *cur = env->cur_state;
++ struct bpf_verifier_state *cur = env->cur_state, *new;
+ int i, j, err, states_cnt = 0;
+
+ sl = env->explored_states[insn_idx];
+@@ -5175,16 +5153,18 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
+ return -ENOMEM;
+
+ /* add new state to the head of linked list */
+- err = copy_verifier_state(&new_sl->state, cur);
++ new = &new_sl->state;
++ err = copy_verifier_state(new, cur);
+ if (err) {
+- free_verifier_state(&new_sl->state, false);
++ free_verifier_state(new, false);
+ kfree(new_sl);
+ return err;
+ }
+ new_sl->next = env->explored_states[insn_idx];
+ env->explored_states[insn_idx] = new_sl;
+ /* connect new state to parentage chain */
+- cur->parent = &new_sl->state;
++ for (i = 0; i < BPF_REG_FP; i++)
++ cur_regs(env)[i].parent = &new->frame[new->curframe]->regs[i];
+ /* clear write marks in current state: the writes we did are not writes
+ * our child did, so they don't screen off its reads from us.
+ * (There are no read marks in current state, because reads always mark
+@@ -5197,9 +5177,13 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
+ /* all stack frames are accessible from callee, clear them all */
+ for (j = 0; j <= cur->curframe; j++) {
+ struct bpf_func_state *frame = cur->frame[j];
++ struct bpf_func_state *newframe = new->frame[j];
+
+- for (i = 0; i < frame->allocated_stack / BPF_REG_SIZE; i++)
++ for (i = 0; i < frame->allocated_stack / BPF_REG_SIZE; i++) {
+ frame->stack[i].spilled_ptr.live = REG_LIVE_NONE;
++ frame->stack[i].spilled_ptr.parent =
++ &newframe->stack[i].spilled_ptr;
++ }
+ }
+ return 0;
+ }
+@@ -5850,34 +5834,33 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
+ insn = env->prog->insnsi + delta;
+
+ for (i = 0; i < insn_cnt; i++, insn++) {
++ bool ctx_access;
++
+ if (insn->code == (BPF_LDX | BPF_MEM | BPF_B) ||
+ insn->code == (BPF_LDX | BPF_MEM | BPF_H) ||
+ insn->code == (BPF_LDX | BPF_MEM | BPF_W) ||
+- insn->code == (BPF_LDX | BPF_MEM | BPF_DW))
++ insn->code == (BPF_LDX | BPF_MEM | BPF_DW)) {
+ type = BPF_READ;
+- else if (insn->code == (BPF_STX | BPF_MEM | BPF_B) ||
+- insn->code == (BPF_STX | BPF_MEM | BPF_H) ||
+- insn->code == (BPF_STX | BPF_MEM | BPF_W) ||
+- insn->code == (BPF_STX | BPF_MEM | BPF_DW))
++ ctx_access = true;
++ } else if (insn->code == (BPF_STX | BPF_MEM | BPF_B) ||
++ insn->code == (BPF_STX | BPF_MEM | BPF_H) ||
++ insn->code == (BPF_STX | BPF_MEM | BPF_W) ||
++ insn->code == (BPF_STX | BPF_MEM | BPF_DW) ||
++ insn->code == (BPF_ST | BPF_MEM | BPF_B) ||
++ insn->code == (BPF_ST | BPF_MEM | BPF_H) ||
++ insn->code == (BPF_ST | BPF_MEM | BPF_W) ||
++ insn->code == (BPF_ST | BPF_MEM | BPF_DW)) {
+ type = BPF_WRITE;
+- else
++ ctx_access = BPF_CLASS(insn->code) == BPF_STX;
++ } else {
+ continue;
++ }
+
+ if (type == BPF_WRITE &&
+- env->insn_aux_data[i + delta].sanitize_stack_off) {
++ env->insn_aux_data[i + delta].sanitize_stack_spill) {
+ struct bpf_insn patch[] = {
+- /* Sanitize suspicious stack slot with zero.
+- * There are no memory dependencies for this store,
+- * since it's only using frame pointer and immediate
+- * constant of zero
+- */
+- BPF_ST_MEM(BPF_DW, BPF_REG_FP,
+- env->insn_aux_data[i + delta].sanitize_stack_off,
+- 0),
+- /* the original STX instruction will immediately
+- * overwrite the same stack slot with appropriate value
+- */
+ *insn,
++ BPF_ST_NOSPEC(),
+ };
+
+ cnt = ARRAY_SIZE(patch);
+@@ -5891,6 +5874,9 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
+ continue;
+ }
+
++ if (!ctx_access)
++ continue;
++
+ if (env->insn_aux_data[i + delta].ptr_type != PTR_TO_CTX)
+ continue;
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index dd740f91de478..4a8c3f5313f96 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -8914,7 +8914,7 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
+ return;
+
+ if (ifh->nr_file_filters) {
+- mm = get_task_mm(event->ctx->task);
++ mm = get_task_mm(task);
+ if (!mm)
+ goto restart;
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index cf535b9d5db75..b658716005077 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -964,6 +964,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
+ mm->pmd_huge_pte = NULL;
+ #endif
+ mm_init_uprobes_state(mm);
++ hugetlb_count_init(mm);
+
+ if (current->mm) {
+ mm->flags = current->mm->flags & MMF_INIT_MASK;
+diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
+index 354151fef06ae..fbc62d360419d 100644
+--- a/kernel/locking/mutex.c
++++ b/kernel/locking/mutex.c
+@@ -911,7 +911,6 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
+ {
+ struct mutex_waiter waiter;
+- bool first = false;
+ struct ww_mutex *ww;
+ int ret;
+
+@@ -986,6 +985,8 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+
+ set_current_state(state);
+ for (;;) {
++ bool first;
++
+ /*
+ * Once we hold wait_lock, we're serialized against
+ * mutex_unlock() handing the lock off to us, do a trylock
+@@ -1014,15 +1015,9 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ spin_unlock(&lock->wait_lock);
+ schedule_preempt_disabled();
+
+- /*
+- * ww_mutex needs to always recheck its position since its waiter
+- * list is not FIFO ordered.
+- */
+- if (ww_ctx || !first) {
+- first = __mutex_waiter_is_first(lock, &waiter);
+- if (first)
+- __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
+- }
++ first = __mutex_waiter_is_first(lock, &waiter);
++ if (first)
++ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
+
+ set_current_state(state);
+ /*
+diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
+index 95271f180687e..33de14435c1f6 100644
+--- a/kernel/pid_namespace.c
++++ b/kernel/pid_namespace.c
+@@ -52,7 +52,8 @@ static struct kmem_cache *create_pid_cachep(unsigned int level)
+ mutex_lock(&pid_caches_mutex);
+ /* Name collision forces to do allocation under mutex. */
+ if (!*pkc)
+- *pkc = kmem_cache_create(name, len, 0, SLAB_HWCACHE_ALIGN, 0);
++ *pkc = kmem_cache_create(name, len, 0,
++ SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, 0);
+ mutex_unlock(&pid_caches_mutex);
+ /* current can fail, but someone else can succeed. */
+ return READ_ONCE(*pkc);
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index aa592dc3cb401..beec5081a55af 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -1654,6 +1654,7 @@ static void migrate_task_rq_dl(struct task_struct *p, int new_cpu __maybe_unused
+ */
+ raw_spin_lock(&rq->lock);
+ if (p->dl.dl_non_contending) {
++ update_rq_clock(rq);
+ sub_running_bw(&p->dl, &rq->dl);
+ p->dl.dl_non_contending = 0;
+ /*
+@@ -2615,7 +2616,7 @@ void __setparam_dl(struct task_struct *p, const struct sched_attr *attr)
+ dl_se->dl_runtime = attr->sched_runtime;
+ dl_se->dl_deadline = attr->sched_deadline;
+ dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline;
+- dl_se->flags = attr->sched_flags;
++ dl_se->flags = attr->sched_flags & SCHED_DL_FLAGS;
+ dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime);
+ dl_se->dl_density = to_ratio(dl_se->dl_deadline, dl_se->dl_runtime);
+ }
+@@ -2628,7 +2629,8 @@ void __getparam_dl(struct task_struct *p, struct sched_attr *attr)
+ attr->sched_runtime = dl_se->dl_runtime;
+ attr->sched_deadline = dl_se->dl_deadline;
+ attr->sched_period = dl_se->dl_period;
+- attr->sched_flags = dl_se->flags;
++ attr->sched_flags &= ~SCHED_DL_FLAGS;
++ attr->sched_flags |= dl_se->flags;
+ }
+
+ /*
+@@ -2703,7 +2705,7 @@ bool dl_param_changed(struct task_struct *p, const struct sched_attr *attr)
+ if (dl_se->dl_runtime != attr->sched_runtime ||
+ dl_se->dl_deadline != attr->sched_deadline ||
+ dl_se->dl_period != attr->sched_period ||
+- dl_se->flags != attr->sched_flags)
++ dl_se->flags != (attr->sched_flags & SCHED_DL_FLAGS))
+ return true;
+
+ return false;
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 7b7ba91e319bb..55e695080fc6b 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -209,6 +209,8 @@ static inline int task_has_dl_policy(struct task_struct *p)
+ */
+ #define SCHED_FLAG_SUGOV 0x10000000
+
++#define SCHED_DL_FLAGS (SCHED_FLAG_RECLAIM | SCHED_FLAG_DL_OVERRUN | SCHED_FLAG_SUGOV)
++
+ static inline bool dl_entity_is_special(struct sched_dl_entity *dl_se)
+ {
+ #ifdef CONFIG_CPU_FREQ_GOV_SCHEDUTIL
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index 0e04b24cec818..32ee24f5142ab 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -1020,12 +1020,13 @@ static void __remove_hrtimer(struct hrtimer *timer,
+ * remove hrtimer, called with base lock held
+ */
+ static inline int
+-remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart)
++remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base,
++ bool restart, bool keep_local)
+ {
+ u8 state = timer->state;
+
+ if (state & HRTIMER_STATE_ENQUEUED) {
+- int reprogram;
++ bool reprogram;
+
+ /*
+ * Remove the timer and force reprogramming when high
+@@ -1038,8 +1039,16 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool rest
+ debug_deactivate(timer);
+ reprogram = base->cpu_base == this_cpu_ptr(&hrtimer_bases);
+
++ /*
++ * If the timer is not restarted then reprogramming is
++ * required if the timer is local. If it is local and about
++ * to be restarted, avoid programming it twice (on removal
++ * and a moment later when it's requeued).
++ */
+ if (!restart)
+ state = HRTIMER_STATE_INACTIVE;
++ else
++ reprogram &= !keep_local;
+
+ __remove_hrtimer(timer, base, state, reprogram);
+ return 1;
+@@ -1093,9 +1102,31 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
+ struct hrtimer_clock_base *base)
+ {
+ struct hrtimer_clock_base *new_base;
++ bool force_local, first;
+
+- /* Remove an active timer from the queue: */
+- remove_hrtimer(timer, base, true);
++ /*
++ * If the timer is on the local cpu base and is the first expiring
++ * timer then this might end up reprogramming the hardware twice
++ * (on removal and on enqueue). To avoid that by prevent the
++ * reprogram on removal, keep the timer local to the current CPU
++ * and enforce reprogramming after it is queued no matter whether
++ * it is the new first expiring timer again or not.
++ */
++ force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases);
++ force_local &= base->cpu_base->next_timer == timer;
++
++ /*
++ * Remove an active timer from the queue. In case it is not queued
++ * on the current CPU, make sure that remove_hrtimer() updates the
++ * remote data correctly.
++ *
++ * If it's on the current CPU and the first expiring timer, then
++ * skip reprogramming, keep the timer local and enforce
++ * reprogramming later if it was the first expiring timer. This
++ * avoids programming the underlying clock event twice (once at
++ * removal and once after enqueue).
++ */
++ remove_hrtimer(timer, base, true, force_local);
+
+ if (mode & HRTIMER_MODE_REL)
+ tim = ktime_add_safe(tim, base->get_time());
+@@ -1105,9 +1136,24 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
+ hrtimer_set_expires_range_ns(timer, tim, delta_ns);
+
+ /* Switch the timer base, if necessary: */
+- new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
++ if (!force_local) {
++ new_base = switch_hrtimer_base(timer, base,
++ mode & HRTIMER_MODE_PINNED);
++ } else {
++ new_base = base;
++ }
++
++ first = enqueue_hrtimer(timer, new_base, mode);
++ if (!force_local)
++ return first;
+
+- return enqueue_hrtimer(timer, new_base, mode);
++ /*
++ * Timer was forced to stay on the current CPU to avoid
++ * reprogramming on removal and enqueue. Force reprogram the
++ * hardware by evaluating the new first expiring timer.
++ */
++ hrtimer_force_reprogram(new_base->cpu_base, 1);
++ return 0;
+ }
+
+ /**
+@@ -1168,7 +1214,7 @@ int hrtimer_try_to_cancel(struct hrtimer *timer)
+ base = lock_hrtimer_base(timer, &flags);
+
+ if (!hrtimer_callback_running(timer))
+- ret = remove_hrtimer(timer, base, false);
++ ret = remove_hrtimer(timer, base, false, false);
+
+ unlock_hrtimer_base(timer, &flags);
+
+diff --git a/lib/mpi/mpiutil.c b/lib/mpi/mpiutil.c
+index 20ed0f7667871..00825028cc847 100644
+--- a/lib/mpi/mpiutil.c
++++ b/lib/mpi/mpiutil.c
+@@ -91,7 +91,7 @@ int mpi_resize(MPI a, unsigned nlimbs)
+ return 0; /* no need to do it */
+
+ if (a->d) {
+- p = kmalloc_array(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL);
++ p = kcalloc(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL);
+ if (!p)
+ return -ENOMEM;
+ memcpy(p, a->d, a->alloced * sizeof(mpi_limb_t));
+diff --git a/lib/test_bpf.c b/lib/test_bpf.c
+index 08d3d59dca173..49d79079e8b3e 100644
+--- a/lib/test_bpf.c
++++ b/lib/test_bpf.c
+@@ -4293,8 +4293,8 @@ static struct bpf_test tests[] = {
+ .u.insns_int = {
+ BPF_LD_IMM64(R0, 0),
+ BPF_LD_IMM64(R1, 0xffffffffffffffffLL),
+- BPF_STX_MEM(BPF_W, R10, R1, -40),
+- BPF_LDX_MEM(BPF_W, R0, R10, -40),
++ BPF_STX_MEM(BPF_DW, R10, R1, -40),
++ BPF_LDX_MEM(BPF_DW, R0, R10, -40),
+ BPF_EXIT_INSN(),
+ },
+ INTERNAL,
+@@ -6687,7 +6687,14 @@ static int run_one(const struct bpf_prog *fp, struct bpf_test *test)
+ u64 duration;
+ u32 ret;
+
+- if (test->test[i].data_size == 0 &&
++ /*
++ * NOTE: Several sub-tests may be present, in which case
++ * a zero {data_size, result} tuple indicates the end of
++ * the sub-test array. The first test is always run,
++ * even if both data_size and result happen to be zero.
++ */
++ if (i > 0 &&
++ test->test[i].data_size == 0 &&
+ test->test[i].result == 0)
+ break;
+
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index e60e28131f679..20f079c81b335 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -783,8 +783,8 @@ static inline struct zone *default_zone_for_pfn(int nid, unsigned long start_pfn
+ return movable_node_enabled ? movable_zone : kernel_zone;
+ }
+
+-struct zone * zone_for_pfn_range(int online_type, int nid, unsigned start_pfn,
+- unsigned long nr_pages)
++struct zone *zone_for_pfn_range(int online_type, int nid,
++ unsigned long start_pfn, unsigned long nr_pages)
+ {
+ if (online_type == MMOP_ONLINE_KERNEL)
+ return default_kernel_zone_for_pfn(nid, start_pfn, nr_pages);
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 4446a523e684e..afcaa657a0229 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -807,7 +807,7 @@ static inline void __free_one_page(struct page *page,
+ struct page *buddy;
+ unsigned int max_order;
+
+- max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1);
++ max_order = min_t(unsigned int, MAX_ORDER - 1, pageblock_order);
+
+ VM_BUG_ON(!zone_is_initialized(zone));
+ VM_BUG_ON_PAGE(page->flags & PAGE_FLAGS_CHECK_AT_PREP, page);
+@@ -820,7 +820,7 @@ static inline void __free_one_page(struct page *page,
+ VM_BUG_ON_PAGE(bad_range(zone, page), page);
+
+ continue_merging:
+- while (order < max_order - 1) {
++ while (order < max_order) {
+ buddy_pfn = __find_buddy_pfn(pfn, order);
+ buddy = page + (buddy_pfn - pfn);
+
+@@ -844,7 +844,7 @@ continue_merging:
+ pfn = combined_pfn;
+ order++;
+ }
+- if (max_order < MAX_ORDER) {
++ if (order < MAX_ORDER - 1) {
+ /* If we are here, it means order is >= pageblock_order.
+ * We want to prevent merge between freepages on isolate
+ * pageblock and normal pageblock. Without this, pageblock
+@@ -865,7 +865,7 @@ continue_merging:
+ is_migrate_isolate(buddy_mt)))
+ goto done_merging;
+ }
+- max_order++;
++ max_order = order + 1;
+ goto continue_merging;
+ }
+
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index 9daab0dd833b3..21132bf3d8503 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -138,7 +138,7 @@ static bool p9_xen_write_todo(struct xen_9pfs_dataring *ring, RING_IDX size)
+
+ static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
+ {
+- struct xen_9pfs_front_priv *priv = NULL;
++ struct xen_9pfs_front_priv *priv;
+ RING_IDX cons, prod, masked_cons, masked_prod;
+ unsigned long flags;
+ u32 size = p9_req->tc.size;
+@@ -151,7 +151,7 @@ static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
+ break;
+ }
+ read_unlock(&xen_9pfs_lock);
+- if (!priv || priv->client != client)
++ if (list_entry_is_head(priv, &xen_9pfs_devs, list))
+ return -EINVAL;
+
+ num = p9_req->tc.tag % priv->num_rings;
+diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h
+index c32638dddbf94..f6b9dc4e408f2 100644
+--- a/net/bluetooth/cmtp/cmtp.h
++++ b/net/bluetooth/cmtp/cmtp.h
+@@ -26,7 +26,7 @@
+ #include <linux/types.h>
+ #include <net/bluetooth/bluetooth.h>
+
+-#define BTNAMSIZ 18
++#define BTNAMSIZ 21
+
+ /* CMTP ioctl defines */
+ #define CMTPCONNADD _IOW('C', 200, int)
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 7a85f215da45c..26acacb2fa95f 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1296,6 +1296,12 @@ int hci_inquiry(void __user *arg)
+ goto done;
+ }
+
++ /* Restrict maximum inquiry length to 60 seconds */
++ if (ir.length > 60) {
++ err = -EINVAL;
++ goto done;
++ }
++
+ hci_dev_lock(hdev);
+ if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
+ inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
+@@ -1622,6 +1628,14 @@ int hci_dev_do_close(struct hci_dev *hdev)
+ hci_request_cancel_all(hdev);
+ hci_req_sync_lock(hdev);
+
++ if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
++ !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
++ test_bit(HCI_UP, &hdev->flags)) {
++ /* Execute vendor specific shutdown routine */
++ if (hdev->shutdown)
++ hdev->shutdown(hdev);
++ }
++
+ if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
+ cancel_delayed_work_sync(&hdev->cmd_timer);
+ hci_req_sync_unlock(hdev);
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 45cc864cf2b38..937cada5595ee 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -4083,6 +4083,21 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
+
+ switch (ev->status) {
+ case 0x00:
++ /* The synchronous connection complete event should only be
++ * sent once per new connection. Receiving a successful
++ * complete event when the connection status is already
++ * BT_CONNECTED means that the device is misbehaving and sent
++ * multiple complete event packets for the same new connection.
++ *
++ * Registering the device more than once can corrupt kernel
++ * memory, hence upon detecting this invalid event, we report
++ * an error and ignore the packet.
++ */
++ if (conn->state == BT_CONNECTED) {
++ bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
++ goto unlock;
++ }
++
+ conn->handle = __le16_to_cpu(ev->handle);
+ conn->state = BT_CONNECTED;
+ conn->type = ev->link_type;
+@@ -4786,9 +4801,64 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
+ }
+ #endif
+
++static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
++ u8 bdaddr_type, bdaddr_t *local_rpa)
++{
++ if (conn->out) {
++ conn->dst_type = bdaddr_type;
++ conn->resp_addr_type = bdaddr_type;
++ bacpy(&conn->resp_addr, bdaddr);
++
++ /* Check if the controller has set a Local RPA then it must be
++ * used instead or hdev->rpa.
++ */
++ if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
++ conn->init_addr_type = ADDR_LE_DEV_RANDOM;
++ bacpy(&conn->init_addr, local_rpa);
++ } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
++ conn->init_addr_type = ADDR_LE_DEV_RANDOM;
++ bacpy(&conn->init_addr, &conn->hdev->rpa);
++ } else {
++ hci_copy_identity_address(conn->hdev, &conn->init_addr,
++ &conn->init_addr_type);
++ }
++ } else {
++ conn->resp_addr_type = conn->hdev->adv_addr_type;
++ /* Check if the controller has set a Local RPA then it must be
++ * used instead or hdev->rpa.
++ */
++ if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
++ conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
++ bacpy(&conn->resp_addr, local_rpa);
++ } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
++ /* In case of ext adv, resp_addr will be updated in
++ * Adv Terminated event.
++ */
++ if (!ext_adv_capable(conn->hdev))
++ bacpy(&conn->resp_addr,
++ &conn->hdev->random_addr);
++ } else {
++ bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
++ }
++
++ conn->init_addr_type = bdaddr_type;
++ bacpy(&conn->init_addr, bdaddr);
++
++ /* For incoming connections, set the default minimum
++ * and maximum connection interval. They will be used
++ * to check if the parameters are in range and if not
++ * trigger the connection update procedure.
++ */
++ conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
++ conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
++ }
++}
++
+ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
+- bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
+- u16 interval, u16 latency, u16 supervision_timeout)
++ bdaddr_t *bdaddr, u8 bdaddr_type,
++ bdaddr_t *local_rpa, u8 role, u16 handle,
++ u16 interval, u16 latency,
++ u16 supervision_timeout)
+ {
+ struct hci_conn_params *params;
+ struct hci_conn *conn;
+@@ -4836,32 +4906,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
+ cancel_delayed_work(&conn->le_conn_timeout);
+ }
+
+- if (!conn->out) {
+- /* Set the responder (our side) address type based on
+- * the advertising address type.
+- */
+- conn->resp_addr_type = hdev->adv_addr_type;
+- if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
+- /* In case of ext adv, resp_addr will be updated in
+- * Adv Terminated event.
+- */
+- if (!ext_adv_capable(hdev))
+- bacpy(&conn->resp_addr, &hdev->random_addr);
+- } else {
+- bacpy(&conn->resp_addr, &hdev->bdaddr);
+- }
+-
+- conn->init_addr_type = bdaddr_type;
+- bacpy(&conn->init_addr, bdaddr);
+-
+- /* For incoming connections, set the default minimum
+- * and maximum connection interval. They will be used
+- * to check if the parameters are in range and if not
+- * trigger the connection update procedure.
+- */
+- conn->le_conn_min_interval = hdev->le_conn_min_interval;
+- conn->le_conn_max_interval = hdev->le_conn_max_interval;
+- }
++ le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
+
+ /* Lookup the identity address from the stored connection
+ * address and address type.
+@@ -4959,7 +5004,7 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
+
+ le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
+- ev->role, le16_to_cpu(ev->handle),
++ NULL, ev->role, le16_to_cpu(ev->handle),
+ le16_to_cpu(ev->interval),
+ le16_to_cpu(ev->latency),
+ le16_to_cpu(ev->supervision_timeout));
+@@ -4973,7 +5018,7 @@ static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
+ BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
+
+ le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
+- ev->role, le16_to_cpu(ev->handle),
++ &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
+ le16_to_cpu(ev->interval),
+ le16_to_cpu(ev->latency),
+ le16_to_cpu(ev->supervision_timeout));
+@@ -5004,7 +5049,8 @@ static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ if (conn) {
+ struct adv_info *adv_instance;
+
+- if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
++ if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
++ bacmp(&conn->resp_addr, BDADDR_ANY))
+ return;
+
+ if (!hdev->cur_adv_instance) {
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index a4ca55df73908..007a01b08dbe9 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -48,6 +48,8 @@ struct sco_conn {
+ spinlock_t lock;
+ struct sock *sk;
+
++ struct delayed_work timeout_work;
++
+ unsigned int mtu;
+ };
+
+@@ -73,9 +75,20 @@ struct sco_pinfo {
+ #define SCO_CONN_TIMEOUT (HZ * 40)
+ #define SCO_DISCONN_TIMEOUT (HZ * 2)
+
+-static void sco_sock_timeout(struct timer_list *t)
++static void sco_sock_timeout(struct work_struct *work)
+ {
+- struct sock *sk = from_timer(sk, t, sk_timer);
++ struct sco_conn *conn = container_of(work, struct sco_conn,
++ timeout_work.work);
++ struct sock *sk;
++
++ sco_conn_lock(conn);
++ sk = conn->sk;
++ if (sk)
++ sock_hold(sk);
++ sco_conn_unlock(conn);
++
++ if (!sk)
++ return;
+
+ BT_DBG("sock %p state %d", sk, sk->sk_state);
+
+@@ -84,20 +97,26 @@ static void sco_sock_timeout(struct timer_list *t)
+ sk->sk_state_change(sk);
+ bh_unlock_sock(sk);
+
+- sco_sock_kill(sk);
+ sock_put(sk);
+ }
+
+ static void sco_sock_set_timer(struct sock *sk, long timeout)
+ {
++ if (!sco_pi(sk)->conn)
++ return;
++
+ BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
+- sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
++ cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
++ schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout);
+ }
+
+ static void sco_sock_clear_timer(struct sock *sk)
+ {
++ if (!sco_pi(sk)->conn)
++ return;
++
+ BT_DBG("sock %p state %d", sk, sk->sk_state);
+- sk_stop_timer(sk, &sk->sk_timer);
++ cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
+ }
+
+ /* ---- SCO connections ---- */
+@@ -176,8 +195,10 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
+ sco_sock_clear_timer(sk);
+ sco_chan_del(sk, err);
+ bh_unlock_sock(sk);
+- sco_sock_kill(sk);
+ sock_put(sk);
++
++ /* Ensure no more work items will run before freeing conn. */
++ cancel_delayed_work_sync(&conn->timeout_work);
+ }
+
+ hcon->sco_data = NULL;
+@@ -192,6 +213,8 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
+ sco_pi(sk)->conn = conn;
+ conn->sk = sk;
+
++ INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
++
+ if (parent)
+ bt_accept_enqueue(parent, sk, true);
+ }
+@@ -211,44 +234,32 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
+ return err;
+ }
+
+-static int sco_connect(struct sock *sk)
++static int sco_connect(struct hci_dev *hdev, struct sock *sk)
+ {
+ struct sco_conn *conn;
+ struct hci_conn *hcon;
+- struct hci_dev *hdev;
+ int err, type;
+
+ BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
+
+- hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
+- if (!hdev)
+- return -EHOSTUNREACH;
+-
+- hci_dev_lock(hdev);
+-
+ if (lmp_esco_capable(hdev) && !disable_esco)
+ type = ESCO_LINK;
+ else
+ type = SCO_LINK;
+
+ if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
+- (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
+- err = -EOPNOTSUPP;
+- goto done;
+- }
++ (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)))
++ return -EOPNOTSUPP;
+
+ hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst,
+ sco_pi(sk)->setting);
+- if (IS_ERR(hcon)) {
+- err = PTR_ERR(hcon);
+- goto done;
+- }
++ if (IS_ERR(hcon))
++ return PTR_ERR(hcon);
+
+ conn = sco_conn_add(hcon);
+ if (!conn) {
+ hci_conn_drop(hcon);
+- err = -ENOMEM;
+- goto done;
++ return -ENOMEM;
+ }
+
+ /* Update source addr of the socket */
+@@ -256,7 +267,7 @@ static int sco_connect(struct sock *sk)
+
+ err = sco_chan_add(conn, sk, NULL);
+ if (err)
+- goto done;
++ return err;
+
+ if (hcon->state == BT_CONNECTED) {
+ sco_sock_clear_timer(sk);
+@@ -266,9 +277,6 @@ static int sco_connect(struct sock *sk)
+ sco_sock_set_timer(sk, sk->sk_sndtimeo);
+ }
+
+-done:
+- hci_dev_unlock(hdev);
+- hci_dev_put(hdev);
+ return err;
+ }
+
+@@ -393,8 +401,7 @@ static void sco_sock_cleanup_listen(struct sock *parent)
+ */
+ static void sco_sock_kill(struct sock *sk)
+ {
+- if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket ||
+- sock_flag(sk, SOCK_DEAD))
++ if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
+ return;
+
+ BT_DBG("sk %p state %d", sk, sk->sk_state);
+@@ -446,7 +453,6 @@ static void sco_sock_close(struct sock *sk)
+ lock_sock(sk);
+ __sco_sock_close(sk);
+ release_sock(sk);
+- sco_sock_kill(sk);
+ }
+
+ static void sco_sock_init(struct sock *sk, struct sock *parent)
+@@ -488,8 +494,6 @@ static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,
+
+ sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
+
+- timer_setup(&sk->sk_timer, sco_sock_timeout, 0);
+-
+ bt_sock_link(&sco_sk_list, sk);
+ return sk;
+ }
+@@ -554,6 +558,7 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
+ {
+ struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
+ struct sock *sk = sock->sk;
++ struct hci_dev *hdev;
+ int err;
+
+ BT_DBG("sk %p", sk);
+@@ -568,12 +573,19 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
+ if (sk->sk_type != SOCK_SEQPACKET)
+ return -EINVAL;
+
++ hdev = hci_get_route(&sa->sco_bdaddr, &sco_pi(sk)->src, BDADDR_BREDR);
++ if (!hdev)
++ return -EHOSTUNREACH;
++ hci_dev_lock(hdev);
++
+ lock_sock(sk);
+
+ /* Set destination address and psm */
+ bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
+
+- err = sco_connect(sk);
++ err = sco_connect(hdev, sk);
++ hci_dev_unlock(hdev);
++ hci_dev_put(hdev);
+ if (err)
+ goto done;
+
+@@ -761,6 +773,11 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
+ cp.max_latency = cpu_to_le16(0xffff);
+ cp.retrans_effort = 0xff;
+ break;
++ default:
++ /* use CVSD settings as fallback */
++ cp.max_latency = cpu_to_le16(0xffff);
++ cp.retrans_effort = 0xff;
++ break;
+ }
+
+ hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
+diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
+index 13e2ae6be620c..8aeece7aa9e97 100644
+--- a/net/caif/chnl_net.c
++++ b/net/caif/chnl_net.c
+@@ -53,20 +53,6 @@ struct chnl_net {
+ enum caif_states state;
+ };
+
+-static void robust_list_del(struct list_head *delete_node)
+-{
+- struct list_head *list_node;
+- struct list_head *n;
+- ASSERT_RTNL();
+- list_for_each_safe(list_node, n, &chnl_net_list) {
+- if (list_node == delete_node) {
+- list_del(list_node);
+- return;
+- }
+- }
+- WARN_ON(1);
+-}
+-
+ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
+ {
+ struct sk_buff *skb;
+@@ -368,6 +354,7 @@ static int chnl_net_init(struct net_device *dev)
+ ASSERT_RTNL();
+ priv = netdev_priv(dev);
+ strncpy(priv->name, dev->name, sizeof(priv->name));
++ INIT_LIST_HEAD(&priv->list_field);
+ return 0;
+ }
+
+@@ -376,7 +363,7 @@ static void chnl_net_uninit(struct net_device *dev)
+ struct chnl_net *priv;
+ ASSERT_RTNL();
+ priv = netdev_priv(dev);
+- robust_list_del(&priv->list_field);
++ list_del_init(&priv->list_field);
+ }
+
+ static const struct net_device_ops netdev_ops = {
+@@ -541,7 +528,7 @@ static void __exit chnl_exit_module(void)
+ rtnl_lock();
+ list_for_each_safe(list_node, _tmp, &chnl_net_list) {
+ dev = list_entry(list_node, struct chnl_net, list_field);
+- list_del(list_node);
++ list_del_init(list_node);
+ delete_device(dev);
+ }
+ rtnl_unlock();
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index 994dd1520f07a..949694c70cbc6 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -694,8 +694,10 @@ proto_again:
+ FLOW_DISSECTOR_KEY_IPV4_ADDRS,
+ target_container);
+
+- memcpy(&key_addrs->v4addrs, &iph->saddr,
+- sizeof(key_addrs->v4addrs));
++ memcpy(&key_addrs->v4addrs.src, &iph->saddr,
++ sizeof(key_addrs->v4addrs.src));
++ memcpy(&key_addrs->v4addrs.dst, &iph->daddr,
++ sizeof(key_addrs->v4addrs.dst));
+ key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
+ }
+
+@@ -744,8 +746,10 @@ proto_again:
+ FLOW_DISSECTOR_KEY_IPV6_ADDRS,
+ target_container);
+
+- memcpy(&key_addrs->v6addrs, &iph->saddr,
+- sizeof(key_addrs->v6addrs));
++ memcpy(&key_addrs->v6addrs.src, &iph->saddr,
++ sizeof(key_addrs->v6addrs.src));
++ memcpy(&key_addrs->v6addrs.dst, &iph->daddr,
++ sizeof(key_addrs->v6addrs.dst));
+ key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
+ }
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 939d8a31eb82a..26d70c00b0545 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -192,9 +192,9 @@ static int net_eq_idr(int id, void *net, void *peer)
+ return 0;
+ }
+
+-/* Should be called with nsid_lock held. If a new id is assigned, the bool alloc
+- * is set to true, thus the caller knows that the new id must be notified via
+- * rtnl.
++/* Must be called from RCU-critical section or with nsid_lock held. If
++ * a new id is assigned, the bool alloc is set to true, thus the
++ * caller knows that the new id must be notified via rtnl.
+ */
+ static int __peernet2id_alloc(struct net *net, struct net *peer, bool *alloc)
+ {
+@@ -218,7 +218,7 @@ static int __peernet2id_alloc(struct net *net, struct net *peer, bool *alloc)
+ return NETNSA_NSID_NOT_ASSIGNED;
+ }
+
+-/* should be called with nsid_lock held */
++/* Must be called from RCU-critical section or with nsid_lock held */
+ static int __peernet2id(struct net *net, struct net *peer)
+ {
+ bool no = false;
+@@ -261,9 +261,10 @@ int peernet2id(struct net *net, struct net *peer)
+ {
+ int id;
+
+- spin_lock_bh(&net->nsid_lock);
++ rcu_read_lock();
+ id = __peernet2id(net, peer);
+- spin_unlock_bh(&net->nsid_lock);
++ rcu_read_unlock();
++
+ return id;
+ }
+ EXPORT_SYMBOL(peernet2id);
+@@ -837,6 +838,7 @@ struct rtnl_net_dump_cb {
+ int s_idx;
+ };
+
++/* Runs in RCU-critical section. */
+ static int rtnl_net_dumpid_one(int id, void *peer, void *data)
+ {
+ struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data;
+@@ -867,9 +869,9 @@ static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
+ .s_idx = cb->args[0],
+ };
+
+- spin_lock_bh(&net->nsid_lock);
++ rcu_read_lock();
+ idr_for_each(&net->netns_ids, rtnl_net_dumpid_one, &net_cb);
+- spin_unlock_bh(&net->nsid_lock);
++ rcu_read_unlock();
+
+ cb->args[0] = net_cb.idx;
+ return skb->len;
+diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
+index ba6fc3c1186b9..e91838a7b8497 100644
+--- a/net/dccp/minisocks.c
++++ b/net/dccp/minisocks.c
+@@ -98,6 +98,8 @@ struct sock *dccp_create_openreq_child(const struct sock *sk,
+ newdp->dccps_role = DCCP_ROLE_SERVER;
+ newdp->dccps_hc_rx_ackvec = NULL;
+ newdp->dccps_service_list = NULL;
++ newdp->dccps_hc_rx_ccid = NULL;
++ newdp->dccps_hc_tx_ccid = NULL;
+ newdp->dccps_service = dreq->dreq_service;
+ newdp->dccps_timestamp_echo = dreq->dreq_timestamp_echo;
+ newdp->dccps_timestamp_time = dreq->dreq_timestamp_time;
+diff --git a/net/dsa/slave.c b/net/dsa/slave.c
+index b887d9edb9c38..f7c122357a966 100644
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -1226,13 +1226,11 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev)
+ * use the switch internal MDIO bus instead
+ */
+ ret = dsa_slave_phy_connect(slave_dev, dp->index);
+- if (ret) {
+- netdev_err(slave_dev,
+- "failed to connect to port %d: %d\n",
+- dp->index, ret);
+- phylink_destroy(dp->pl);
+- return ret;
+- }
++ }
++ if (ret) {
++ netdev_err(slave_dev, "failed to connect to PHY: %pe\n",
++ ERR_PTR(ret));
++ phylink_destroy(dp->pl);
+ }
+
+ return ret;
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index dde6cf82e9f0a..fe10a565b7d85 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -465,6 +465,23 @@ out_bh_enable:
+ local_bh_enable();
+ }
+
++/*
++ * The device used for looking up which routing table to use for sending an ICMP
++ * error is preferably the source whenever it is set, which should ensure the
++ * icmp error can be sent to the source host, else lookup using the routing
++ * table of the destination device, else use the main routing table (index 0).
++ */
++static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb)
++{
++ struct net_device *route_lookup_dev = NULL;
++
++ if (skb->dev)
++ route_lookup_dev = skb->dev;
++ else if (skb_dst(skb))
++ route_lookup_dev = skb_dst(skb)->dev;
++ return route_lookup_dev;
++}
++
+ static struct rtable *icmp_route_lookup(struct net *net,
+ struct flowi4 *fl4,
+ struct sk_buff *skb_in,
+@@ -473,6 +490,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
+ int type, int code,
+ struct icmp_bxm *param)
+ {
++ struct net_device *route_lookup_dev;
+ struct rtable *rt, *rt2;
+ struct flowi4 fl4_dec;
+ int err;
+@@ -487,7 +505,8 @@ static struct rtable *icmp_route_lookup(struct net *net,
+ fl4->flowi4_proto = IPPROTO_ICMP;
+ fl4->fl4_icmp_type = type;
+ fl4->fl4_icmp_code = code;
+- fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev);
++ route_lookup_dev = icmp_get_route_lookup_dev(skb_in);
++ fl4->flowi4_oif = l3mdev_master_ifindex(route_lookup_dev);
+
+ security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
+ rt = ip_route_output_key_hash(net, fl4, skb_in);
+@@ -511,7 +530,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
+ if (err)
+ goto relookup_failed;
+
+- if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev,
++ if (inet_addr_type_dev_table(net, route_lookup_dev,
+ fl4_dec.saddr) == RTN_LOCAL) {
+ rt2 = __ip_route_output_key(net, &fl4_dec);
+ if (IS_ERR(rt2))
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index dca7fe0ae24ad..15804cfc19a8c 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -2743,6 +2743,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u
+ rv = 1;
+ } else if (im) {
+ if (src_addr) {
++ spin_lock_bh(&im->lock);
+ for (psf = im->sources; psf; psf = psf->sf_next) {
+ if (psf->sf_inaddr == src_addr)
+ break;
+@@ -2753,6 +2754,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u
+ im->sfcount[MCAST_EXCLUDE];
+ else
+ rv = im->sfcount[MCAST_EXCLUDE] != 0;
++ spin_unlock_bh(&im->lock);
+ } else
+ rv = 1; /* unspecified source; tentatively allow */
+ }
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index a8a37d1128201..0c431fd4b1200 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -449,8 +449,6 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
+
+ static int gre_handle_offloads(struct sk_buff *skb, bool csum)
+ {
+- if (csum && skb_checksum_start(skb) < skb->data)
+- return -EINVAL;
+ return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
+ }
+
+@@ -682,15 +680,20 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
+ }
+
+ if (dev->header_ops) {
++ const int pull_len = tunnel->hlen + sizeof(struct iphdr);
++
+ if (skb_cow_head(skb, 0))
+ goto free_skb;
+
+ tnl_params = (const struct iphdr *)skb->data;
+
++ if (pull_len > skb_transport_offset(skb))
++ goto free_skb;
++
+ /* Pull skb since ip_tunnel_xmit() needs skb->data pointing
+ * to gre header.
+ */
+- skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
++ skb_pull(skb, pull_len);
+ skb_reset_mac_header(skb);
+ } else {
+ if (skb_cow_head(skb, dev->needed_headroom))
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index e63905f7f6f95..25beecee89494 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -419,8 +419,9 @@ static void ip_copy_addrs(struct iphdr *iph, const struct flowi4 *fl4)
+ {
+ BUILD_BUG_ON(offsetof(typeof(*fl4), daddr) !=
+ offsetof(typeof(*fl4), saddr) + sizeof(fl4->saddr));
+- memcpy(&iph->saddr, &fl4->saddr,
+- sizeof(fl4->saddr) + sizeof(fl4->daddr));
++
++ iph->saddr = fl4->saddr;
++ iph->daddr = fl4->daddr;
+ }
+
+ /* Note: skb->sk can be different from sk, in case of tunnels */
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 1491d239385e5..730a15fc497ca 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -604,18 +604,25 @@ static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
+ }
+ }
+
+-static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
++static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash)
+ {
+- struct fib_nh_exception *fnhe, *oldest;
++ struct fib_nh_exception __rcu **fnhe_p, **oldest_p;
++ struct fib_nh_exception *fnhe, *oldest = NULL;
+
+- oldest = rcu_dereference(hash->chain);
+- for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe;
+- fnhe = rcu_dereference(fnhe->fnhe_next)) {
+- if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp))
++ for (fnhe_p = &hash->chain; ; fnhe_p = &fnhe->fnhe_next) {
++ fnhe = rcu_dereference_protected(*fnhe_p,
++ lockdep_is_held(&fnhe_lock));
++ if (!fnhe)
++ break;
++ if (!oldest ||
++ time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp)) {
+ oldest = fnhe;
++ oldest_p = fnhe_p;
++ }
+ }
+ fnhe_flush_routes(oldest);
+- return oldest;
++ *oldest_p = oldest->fnhe_next;
++ kfree_rcu(oldest, rcu);
+ }
+
+ static inline u32 fnhe_hashfun(__be32 daddr)
+@@ -692,16 +699,21 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
+ if (rt)
+ fill_route_from_fnhe(rt, fnhe);
+ } else {
+- if (depth > FNHE_RECLAIM_DEPTH)
+- fnhe = fnhe_oldest(hash);
+- else {
+- fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
+- if (!fnhe)
+- goto out_unlock;
+-
+- fnhe->fnhe_next = hash->chain;
+- rcu_assign_pointer(hash->chain, fnhe);
++ /* Randomize max depth to avoid some side channels attacks. */
++ int max_depth = FNHE_RECLAIM_DEPTH +
++ prandom_u32_max(FNHE_RECLAIM_DEPTH);
++
++ while (depth > max_depth) {
++ fnhe_remove_oldest(hash);
++ depth--;
+ }
++
++ fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
++ if (!fnhe)
++ goto out_unlock;
++
++ fnhe->fnhe_next = hash->chain;
++
+ fnhe->fnhe_genid = genid;
+ fnhe->fnhe_daddr = daddr;
+ fnhe->fnhe_gw = gw;
+@@ -709,6 +721,8 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
+ fnhe->fnhe_mtu_locked = lock;
+ fnhe->fnhe_expires = max(1UL, expires);
+
++ rcu_assign_pointer(hash->chain, fnhe);
++
+ /* Exception created; mark the cached routes for the nexthop
+ * stale, so anyone caching it rechecks if this exception
+ * applies to them.
+@@ -2801,7 +2815,7 @@ static struct sk_buff *inet_rtm_getroute_build_skb(__be32 src, __be32 dst,
+ udph = skb_put_zero(skb, sizeof(struct udphdr));
+ udph->source = sport;
+ udph->dest = dport;
+- udph->len = sizeof(struct udphdr);
++ udph->len = htons(sizeof(struct udphdr));
+ udph->check = 0;
+ break;
+ }
+diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
+index 2ab371f555250..119d2c2f3b047 100644
+--- a/net/ipv4/tcp_fastopen.c
++++ b/net/ipv4/tcp_fastopen.c
+@@ -342,8 +342,7 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
+ return NULL;
+ }
+
+- if (syn_data &&
+- tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD))
++ if (tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD))
+ goto fastopen;
+
+ if (foc->len >= 0 && /* Client presents or requests a cookie */
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 36bff9291530b..5117e0aeea1af 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -1195,7 +1195,7 @@ static u8 tcp_sacktag_one(struct sock *sk,
+ if (dup_sack && (sacked & TCPCB_RETRANS)) {
+ if (tp->undo_marker && tp->undo_retrans > 0 &&
+ after(end_seq, tp->undo_marker))
+- tp->undo_retrans--;
++ tp->undo_retrans = max_t(int, 0, tp->undo_retrans - pcount);
+ if ((sacked & TCPCB_SACKED_ACKED) &&
+ before(start_seq, state->reord))
+ state->reord = start_seq;
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 71236aa7388d7..de4edfbc9e466 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -2177,6 +2177,7 @@ static void *tcp_get_idx(struct seq_file *seq, loff_t pos)
+ static void *tcp_seek_last_pos(struct seq_file *seq)
+ {
+ struct tcp_iter_state *st = seq->private;
++ int bucket = st->bucket;
+ int offset = st->offset;
+ int orig_num = st->num;
+ void *rc = NULL;
+@@ -2187,7 +2188,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq)
+ break;
+ st->state = TCP_SEQ_STATE_LISTENING;
+ rc = listening_get_next(seq, NULL);
+- while (offset-- && rc)
++ while (offset-- && rc && bucket == st->bucket)
+ rc = listening_get_next(seq, rc);
+ if (rc)
+ break;
+@@ -2198,7 +2199,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq)
+ if (st->bucket > tcp_hashinfo.ehash_mask)
+ break;
+ rc = established_get_first(seq);
+- while (offset-- && rc)
++ while (offset-- && rc && bucket == st->bucket)
+ rc = established_get_next(seq, rc);
+ }
+
+diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c
+index f14de4b6d639d..58e839e2ce1d3 100644
+--- a/net/ipv6/netfilter/nf_socket_ipv6.c
++++ b/net/ipv6/netfilter/nf_socket_ipv6.c
+@@ -104,7 +104,7 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,
+ {
+ __be16 uninitialized_var(dport), uninitialized_var(sport);
+ const struct in6_addr *daddr = NULL, *saddr = NULL;
+- struct ipv6hdr *iph = ipv6_hdr(skb);
++ struct ipv6hdr *iph = ipv6_hdr(skb), ipv6_var;
+ struct sk_buff *data_skb = NULL;
+ int doff = 0;
+ int thoff = 0, tproto;
+@@ -134,8 +134,6 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,
+ thoff + sizeof(*hp);
+
+ } else if (tproto == IPPROTO_ICMPV6) {
+- struct ipv6hdr ipv6_var;
+-
+ if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
+ &sport, &dport, &ipv6_var))
+ return NULL;
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 9abdc0a04d993..bf2a53d455a18 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -889,8 +889,10 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
+ }
+
+ if (tunnel->version == L2TP_HDR_VER_3 &&
+- l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
++ l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) {
++ l2tp_session_dec_refcount(session);
+ goto error;
++ }
+
+ l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);
+ l2tp_session_dec_refcount(session);
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 3530d1a5fc98e..5c5908127fcb5 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3142,7 +3142,9 @@ static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
+ if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
+ return true;
+
+- if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr)))
++ if (!ieee80211_amsdu_realloc_pad(local, skb,
++ sizeof(*amsdu_hdr) +
++ local->hw.extra_tx_headroom))
+ return false;
+
+ data = skb_push(skb, sizeof(*amsdu_hdr));
+diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
+index 3e3494c8d42f8..e252f62bb8c20 100644
+--- a/net/netlabel/netlabel_cipso_v4.c
++++ b/net/netlabel/netlabel_cipso_v4.c
+@@ -156,8 +156,8 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
+ return -ENOMEM;
+ doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
+ if (doi_def->map.std == NULL) {
+- ret_val = -ENOMEM;
+- goto add_std_failure;
++ kfree(doi_def);
++ return -ENOMEM;
+ }
+ doi_def->type = CIPSO_V4_MAP_TRANS;
+
+@@ -198,14 +198,14 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
+ }
+ doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
+ sizeof(u32),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (doi_def->map.std->lvl.local == NULL) {
+ ret_val = -ENOMEM;
+ goto add_std_failure;
+ }
+ doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
+ sizeof(u32),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (doi_def->map.std->lvl.cipso == NULL) {
+ ret_val = -ENOMEM;
+ goto add_std_failure;
+@@ -273,7 +273,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
+ doi_def->map.std->cat.local = kcalloc(
+ doi_def->map.std->cat.local_size,
+ sizeof(u32),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (doi_def->map.std->cat.local == NULL) {
+ ret_val = -ENOMEM;
+ goto add_std_failure;
+@@ -281,7 +281,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
+ doi_def->map.std->cat.cipso = kcalloc(
+ doi_def->map.std->cat.cipso_size,
+ sizeof(u32),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (doi_def->map.std->cat.cipso == NULL) {
+ ret_val = -ENOMEM;
+ goto add_std_failure;
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index ac3fe507bc1c4..b0fd268ed65e5 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -2498,13 +2498,15 @@ int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
+ /* errors reported via destination sk->sk_err, but propagate
+ * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
+ err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
++ if (err == -ESRCH)
++ err = 0;
+ }
+
+ if (report) {
+ int err2;
+
+ err2 = nlmsg_unicast(sk, skb, portid);
+- if (!err || err == -ESRCH)
++ if (!err)
+ err = err2;
+ }
+
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index ebc3c8c7e6661..bc62e1b246539 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -1616,7 +1616,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
+ err = tcf_block_get(&cl->block, &cl->filter_list, sch, extack);
+ if (err) {
+ kfree(cl);
+- return err;
++ goto failure;
+ }
+
+ if (tca[TCA_RATE]) {
+diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
+index a862d9990be74..e4f69c779b8cf 100644
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -382,6 +382,7 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,
+ {
+ struct fq_codel_sched_data *q = qdisc_priv(sch);
+ struct nlattr *tb[TCA_FQ_CODEL_MAX + 1];
++ u32 quantum = 0;
+ int err;
+
+ if (!opt)
+@@ -399,6 +400,13 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,
+ q->flows_cnt > 65536)
+ return -EINVAL;
+ }
++ if (tb[TCA_FQ_CODEL_QUANTUM]) {
++ quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));
++ if (quantum > FQ_CODEL_QUANTUM_MAX) {
++ NL_SET_ERR_MSG(extack, "Invalid quantum");
++ return -EINVAL;
++ }
++ }
+ sch_tree_lock(sch);
+
+ if (tb[TCA_FQ_CODEL_TARGET]) {
+@@ -425,8 +433,8 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,
+ if (tb[TCA_FQ_CODEL_ECN])
+ q->cparams.ecn = !!nla_get_u32(tb[TCA_FQ_CODEL_ECN]);
+
+- if (tb[TCA_FQ_CODEL_QUANTUM])
+- q->quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));
++ if (quantum)
++ q->quantum = quantum;
+
+ if (tb[TCA_FQ_CODEL_DROP_BATCH_SIZE])
+ q->drop_batch_size = max(1U, nla_get_u32(tb[TCA_FQ_CODEL_DROP_BATCH_SIZE]));
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index a85d78d2bdb73..d9d03881e4de5 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -1914,7 +1914,7 @@ gss_svc_init_net(struct net *net)
+ goto out2;
+ return 0;
+ out2:
+- destroy_use_gss_proxy_proc_entry(net);
++ rsi_cache_destroy_net(net);
+ out1:
+ rsc_cache_destroy_net(net);
+ return rv;
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index 11d393c047728..6a606af8de819 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -1146,6 +1146,22 @@ static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ..
+
+ extern void svc_tcp_prep_reply_hdr(struct svc_rqst *);
+
++__be32
++svc_return_autherr(struct svc_rqst *rqstp, __be32 auth_err)
++{
++ set_bit(RQ_AUTHERR, &rqstp->rq_flags);
++ return auth_err;
++}
++EXPORT_SYMBOL_GPL(svc_return_autherr);
++
++static __be32
++svc_get_autherr(struct svc_rqst *rqstp, __be32 *statp)
++{
++ if (test_and_clear_bit(RQ_AUTHERR, &rqstp->rq_flags))
++ return *statp;
++ return rpc_auth_ok;
++}
++
+ /*
+ * Common routine for processing the RPC request.
+ */
+@@ -1296,11 +1312,9 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
+ procp->pc_release(rqstp);
+ goto dropit;
+ }
+- if (*statp == rpc_autherr_badcred) {
+- if (procp->pc_release)
+- procp->pc_release(rqstp);
+- goto err_bad_auth;
+- }
++ auth_stat = svc_get_autherr(rqstp, statp);
++ if (auth_stat != rpc_auth_ok)
++ goto err_release_bad_auth;
+ if (*statp == rpc_success && procp->pc_encode &&
+ !procp->pc_encode(rqstp, resv->iov_base + resv->iov_len)) {
+ dprintk("svc: failed to encode reply\n");
+@@ -1359,6 +1373,9 @@ err_bad_rpc:
+ svc_putnl(resv, 2);
+ goto sendit;
+
++err_release_bad_auth:
++ if (procp->pc_release)
++ procp->pc_release(rqstp);
+ err_bad_auth:
+ dprintk("svc: authentication failed (%d)\n", ntohl(auth_stat));
+ serv->sv_stats->rpcbadauth++;
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 6aead6deaa6c4..848ae6dcbd822 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -1716,6 +1716,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
+ bool connected = !tipc_sk_type_connectionless(sk);
+ struct tipc_sock *tsk = tipc_sk(sk);
+ int rc, err, hlen, dlen, copy;
++ struct tipc_skb_cb *skb_cb;
+ struct sk_buff_head xmitq;
+ struct tipc_msg *hdr;
+ struct sk_buff *skb;
+@@ -1739,6 +1740,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
+ if (unlikely(rc))
+ goto exit;
+ skb = skb_peek(&sk->sk_receive_queue);
++ skb_cb = TIPC_SKB_CB(skb);
+ hdr = buf_msg(skb);
+ dlen = msg_data_sz(hdr);
+ hlen = msg_hdr_sz(hdr);
+@@ -1758,18 +1760,33 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
+
+ /* Capture data if non-error msg, otherwise just set return value */
+ if (likely(!err)) {
+- copy = min_t(int, dlen, buflen);
+- if (unlikely(copy != dlen))
+- m->msg_flags |= MSG_TRUNC;
+- rc = skb_copy_datagram_msg(skb, hlen, m, copy);
++ int offset = skb_cb->bytes_read;
++
++ copy = min_t(int, dlen - offset, buflen);
++ rc = skb_copy_datagram_msg(skb, hlen + offset, m, copy);
++ if (unlikely(rc))
++ goto exit;
++ if (unlikely(offset + copy < dlen)) {
++ if (flags & MSG_EOR) {
++ if (!(flags & MSG_PEEK))
++ skb_cb->bytes_read = offset + copy;
++ } else {
++ m->msg_flags |= MSG_TRUNC;
++ skb_cb->bytes_read = 0;
++ }
++ } else {
++ if (flags & MSG_EOR)
++ m->msg_flags |= MSG_EOR;
++ skb_cb->bytes_read = 0;
++ }
+ } else {
+ copy = 0;
+ rc = 0;
+- if (err != TIPC_CONN_SHUTDOWN && connected && !m->msg_control)
++ if (err != TIPC_CONN_SHUTDOWN && connected && !m->msg_control) {
+ rc = -ECONNRESET;
++ goto exit;
++ }
+ }
+- if (unlikely(rc))
+- goto exit;
+
+ /* Mark message as group event if applicable */
+ if (unlikely(grp_evt)) {
+@@ -1792,6 +1809,9 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
+ tipc_node_distr_xmit(sock_net(sk), &xmitq);
+ }
+
++ if (skb_cb->bytes_read)
++ goto exit;
++
+ tsk_advance_rx_queue(sk);
+
+ if (likely(!connected))
+@@ -2203,7 +2223,7 @@ static int tipc_sk_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
+ u32 dport, struct sk_buff_head *xmitq)
+ {
+- unsigned long time_limit = jiffies + 2;
++ unsigned long time_limit = jiffies + usecs_to_jiffies(20000);
+ struct sk_buff *skb;
+ unsigned int lim;
+ atomic_t *dcnt;
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 98c253afa0db2..c293a558b0d4f 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -2739,7 +2739,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
+
+ other = unix_peer(sk);
+ if (other && unix_peer(other) != sk &&
+- unix_recvq_full(other) &&
++ unix_recvq_full_lockless(other) &&
+ unix_dgram_peer_wake_me(sk, other))
+ writable = 0;
+
+diff --git a/samples/bpf/test_override_return.sh b/samples/bpf/test_override_return.sh
+index e68b9ee6814b8..35db26f736b9d 100755
+--- a/samples/bpf/test_override_return.sh
++++ b/samples/bpf/test_override_return.sh
+@@ -1,5 +1,6 @@
+ #!/bin/bash
+
++rm -r tmpmnt
+ rm -f testfile.img
+ dd if=/dev/zero of=testfile.img bs=1M seek=1000 count=1
+ DEVICE=$(losetup --show -f testfile.img)
+diff --git a/samples/bpf/tracex7_user.c b/samples/bpf/tracex7_user.c
+index ea6dae78f0dff..2ed13e9f3fcb0 100644
+--- a/samples/bpf/tracex7_user.c
++++ b/samples/bpf/tracex7_user.c
+@@ -13,6 +13,11 @@ int main(int argc, char **argv)
+ char command[256];
+ int ret;
+
++ if (!argv[1]) {
++ fprintf(stderr, "ERROR: Run with the btrfs device argument!\n");
++ return 0;
++ }
++
+ snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
+
+ if (load_bpf_file(filename)) {
+diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
+index 13b446328dda0..5095b2e8fceeb 100644
+--- a/security/integrity/ima/Kconfig
++++ b/security/integrity/ima/Kconfig
+@@ -5,7 +5,6 @@ config IMA
+ select SECURITYFS
+ select CRYPTO
+ select CRYPTO_HMAC
+- select CRYPTO_MD5
+ select CRYPTO_SHA1
+ select CRYPTO_HASH_INFO
+ select TCG_TPM if HAS_IOMEM && !UML
+diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c
+index 3e7a1523663b8..daad75ee74d9f 100644
+--- a/security/integrity/ima/ima_mok.c
++++ b/security/integrity/ima/ima_mok.c
+@@ -26,7 +26,7 @@ struct key *ima_blacklist_keyring;
+ /*
+ * Allocate the IMA blacklist keyring
+ */
+-__init int ima_mok_init(void)
++static __init int ima_mok_init(void)
+ {
+ struct key_restriction *restriction;
+
+diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
+index a7855c61c05cd..07d23b4f76f3b 100644
+--- a/security/smack/smack_access.c
++++ b/security/smack/smack_access.c
+@@ -85,23 +85,22 @@ int log_policy = SMACK_AUDIT_DENIED;
+ int smk_access_entry(char *subject_label, char *object_label,
+ struct list_head *rule_list)
+ {
+- int may = -ENOENT;
+ struct smack_rule *srp;
+
+ list_for_each_entry_rcu(srp, rule_list, list) {
+ if (srp->smk_object->smk_known == object_label &&
+ srp->smk_subject->smk_known == subject_label) {
+- may = srp->smk_access;
+- break;
++ int may = srp->smk_access;
++ /*
++ * MAY_WRITE implies MAY_LOCK.
++ */
++ if ((may & MAY_WRITE) == MAY_WRITE)
++ may |= MAY_LOCK;
++ return may;
+ }
+ }
+
+- /*
+- * MAY_WRITE implies MAY_LOCK.
+- */
+- if ((may & MAY_WRITE) == MAY_WRITE)
+- may |= MAY_LOCK;
+- return may;
++ return -ENOENT;
+ }
+
+ /**
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 56295936387c3..da454eeee5c91 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1751,7 +1751,7 @@ static int snd_pcm_lib_ioctl_fifo_size(struct snd_pcm_substream *substream,
+ channels = params_channels(params);
+ frame_size = snd_pcm_format_size(format, channels);
+ if (frame_size > 0)
+- params->fifo_size /= (unsigned)frame_size;
++ params->fifo_size /= frame_size;
+ }
+ return 0;
+ }
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 186c0ee059da7..c4d19b88d17dc 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -293,9 +293,6 @@ static const struct snd_soc_dapm_widget byt_rt5640_widgets[] = {
+ static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = {
+ {"Headphone", NULL, "Platform Clock"},
+ {"Headset Mic", NULL, "Platform Clock"},
+- {"Internal Mic", NULL, "Platform Clock"},
+- {"Speaker", NULL, "Platform Clock"},
+-
+ {"Headset Mic", NULL, "MICBIAS1"},
+ {"IN2P", NULL, "Headset Mic"},
+ {"Headphone", NULL, "HPOL"},
+@@ -303,19 +300,23 @@ static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = {
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic1_map[] = {
++ {"Internal Mic", NULL, "Platform Clock"},
+ {"DMIC1", NULL, "Internal Mic"},
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic2_map[] = {
++ {"Internal Mic", NULL, "Platform Clock"},
+ {"DMIC2", NULL, "Internal Mic"},
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_intmic_in1_map[] = {
++ {"Internal Mic", NULL, "Platform Clock"},
+ {"Internal Mic", NULL, "MICBIAS1"},
+ {"IN1P", NULL, "Internal Mic"},
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_intmic_in3_map[] = {
++ {"Internal Mic", NULL, "Platform Clock"},
+ {"Internal Mic", NULL, "MICBIAS1"},
+ {"IN3P", NULL, "Internal Mic"},
+ };
+@@ -357,6 +358,7 @@ static const struct snd_soc_dapm_route byt_rt5640_ssp0_aif2_map[] = {
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = {
++ {"Speaker", NULL, "Platform Clock"},
+ {"Speaker", NULL, "SPOLP"},
+ {"Speaker", NULL, "SPOLN"},
+ {"Speaker", NULL, "SPORP"},
+@@ -364,6 +366,7 @@ static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = {
+ };
+
+ static const struct snd_soc_dapm_route byt_rt5640_mono_spk_map[] = {
++ {"Speaker", NULL, "Platform Clock"},
+ {"Speaker", NULL, "SPOLP"},
+ {"Speaker", NULL, "SPOLN"},
+ };
+diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
+index b86f76c3598cd..c6d11a59310fc 100644
+--- a/sound/soc/rockchip/rockchip_i2s.c
++++ b/sound/soc/rockchip/rockchip_i2s.c
+@@ -189,7 +189,9 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ {
+ struct rk_i2s_dev *i2s = to_info(cpu_dai);
+ unsigned int mask = 0, val = 0;
++ int ret = 0;
+
++ pm_runtime_get_sync(cpu_dai->dev);
+ mask = I2S_CKR_MSS_MASK;
+ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+ case SND_SOC_DAIFMT_CBS_CFS:
+@@ -202,7 +204,8 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ i2s->is_master_mode = false;
+ break;
+ default:
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_pm_put;
+ }
+
+ regmap_update_bits(i2s->regmap, I2S_CKR, mask, val);
+@@ -216,7 +219,8 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ val = I2S_CKR_CKP_POS;
+ break;
+ default:
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_pm_put;
+ }
+
+ regmap_update_bits(i2s->regmap, I2S_CKR, mask, val);
+@@ -232,14 +236,15 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ case SND_SOC_DAIFMT_I2S:
+ val = I2S_TXCR_IBM_NORMAL;
+ break;
+- case SND_SOC_DAIFMT_DSP_A: /* PCM no delay mode */
+- val = I2S_TXCR_TFS_PCM;
+- break;
+- case SND_SOC_DAIFMT_DSP_B: /* PCM delay 1 mode */
++ case SND_SOC_DAIFMT_DSP_A: /* PCM delay 1 bit mode */
+ val = I2S_TXCR_TFS_PCM | I2S_TXCR_PBM_MODE(1);
+ break;
++ case SND_SOC_DAIFMT_DSP_B: /* PCM no delay mode */
++ val = I2S_TXCR_TFS_PCM;
++ break;
+ default:
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_pm_put;
+ }
+
+ regmap_update_bits(i2s->regmap, I2S_TXCR, mask, val);
+@@ -255,19 +260,23 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ case SND_SOC_DAIFMT_I2S:
+ val = I2S_RXCR_IBM_NORMAL;
+ break;
+- case SND_SOC_DAIFMT_DSP_A: /* PCM no delay mode */
+- val = I2S_RXCR_TFS_PCM;
+- break;
+- case SND_SOC_DAIFMT_DSP_B: /* PCM delay 1 mode */
++ case SND_SOC_DAIFMT_DSP_A: /* PCM delay 1 bit mode */
+ val = I2S_RXCR_TFS_PCM | I2S_RXCR_PBM_MODE(1);
+ break;
++ case SND_SOC_DAIFMT_DSP_B: /* PCM no delay mode */
++ val = I2S_RXCR_TFS_PCM;
++ break;
+ default:
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_pm_put;
+ }
+
+ regmap_update_bits(i2s->regmap, I2S_RXCR, mask, val);
+
+- return 0;
++err_pm_put:
++ pm_runtime_put(cpu_dai->dev);
++
++ return ret;
+ }
+
+ static int rockchip_i2s_hw_params(struct snd_pcm_substream *substream,
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 4114594e57a30..f4bdcff82f5cc 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1554,6 +1554,7 @@ static const struct registration_quirk registration_quirks[] = {
+ REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */
+ REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
+ REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */
++ REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index ab208400ea140..4ada233b37ed1 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -1893,6 +1893,7 @@ static int add_callchain_ip(struct thread *thread,
+
+ al.filtered = 0;
+ al.sym = NULL;
++ al.srcline = NULL;
+ if (!cpumode) {
+ thread__find_cpumode_addr_location(thread, ip, &al);
+ } else {
+diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
+index 4e202217fae10..87ba89df98022 100644
+--- a/tools/testing/selftests/bpf/test_maps.c
++++ b/tools/testing/selftests/bpf/test_maps.c
+@@ -796,7 +796,7 @@ static void test_sockmap(int tasks, void *data)
+
+ FD_ZERO(&w);
+ FD_SET(sfd[3], &w);
+- to.tv_sec = 1;
++ to.tv_sec = 30;
+ to.tv_usec = 0;
+ s = select(sfd[3] + 1, &w, NULL, NULL, &to);
+ if (s == -1) {
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index c7d17781dbfee..858e551432339 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -956,15 +956,45 @@ static struct bpf_test tests[] = {
+ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+ /* mess up with R1 pointer on stack */
+ BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
+- /* fill back into R0 should fail */
++ /* fill back into R0 is fine for priv.
++ * R0 now becomes SCALAR_VALUE.
++ */
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
++ /* Load from R0 should fail. */
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 8),
+ BPF_EXIT_INSN(),
+ },
+ .errstr_unpriv = "attempt to corrupt spilled",
+- .errstr = "corrupted spill",
++ .errstr = "R0 invalid mem access 'inv",
+ .result = REJECT,
+ .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+ },
++ {
++ "check corrupted spill/fill, LSB",
++ .insns = {
++ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
++ BPF_ST_MEM(BPF_H, BPF_REG_10, -8, 0xcafe),
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
++ BPF_EXIT_INSN(),
++ },
++ .errstr_unpriv = "attempt to corrupt spilled",
++ .result_unpriv = REJECT,
++ .result = ACCEPT,
++ .retval = POINTER_VALUE,
++ },
++ {
++ "check corrupted spill/fill, MSB",
++ .insns = {
++ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
++ BPF_ST_MEM(BPF_W, BPF_REG_10, -4, 0x12345678),
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
++ BPF_EXIT_INSN(),
++ },
++ .errstr_unpriv = "attempt to corrupt spilled",
++ .result_unpriv = REJECT,
++ .result = ACCEPT,
++ .retval = POINTER_VALUE,
++ },
+ {
+ "invalid src register in STX",
+ .insns = {
+@@ -3858,7 +3888,8 @@ static struct bpf_test tests[] = {
+ offsetof(struct __sk_buff, data)),
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+ offsetof(struct __sk_buff, data_end)),
+- BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
++ BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
++ offsetof(struct __sk_buff, mark)),
+ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+ BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
+@@ -6530,9 +6561,9 @@ static struct bpf_test tests[] = {
+ {
+ "helper access to variable memory: stack, bitwise AND, zero included",
+ .insns = {
++ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+- BPF_MOV64_IMM(BPF_REG_2, 16),
+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+ BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
+@@ -6547,9 +6578,9 @@ static struct bpf_test tests[] = {
+ {
+ "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
+ .insns = {
++ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+- BPF_MOV64_IMM(BPF_REG_2, 16),
+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+ BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
+@@ -6623,9 +6654,9 @@ static struct bpf_test tests[] = {
+ {
+ "helper access to variable memory: stack, JMP, bounds + offset",
+ .insns = {
++ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+- BPF_MOV64_IMM(BPF_REG_2, 16),
+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+ BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
+@@ -6644,9 +6675,9 @@ static struct bpf_test tests[] = {
+ {
+ "helper access to variable memory: stack, JMP, wrong max",
+ .insns = {
++ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+- BPF_MOV64_IMM(BPF_REG_2, 16),
+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+ BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
+@@ -6664,9 +6695,9 @@ static struct bpf_test tests[] = {
+ {
+ "helper access to variable memory: stack, JMP, no max check",
+ .insns = {
++ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+- BPF_MOV64_IMM(BPF_REG_2, 16),
+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+ BPF_MOV64_IMM(BPF_REG_4, 0),
+@@ -6684,9 +6715,9 @@ static struct bpf_test tests[] = {
+ {
+ "helper access to variable memory: stack, JMP, no min check",
+ .insns = {
++ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+- BPF_MOV64_IMM(BPF_REG_2, 16),
+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+ BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
+@@ -6702,9 +6733,9 @@ static struct bpf_test tests[] = {
+ {
+ "helper access to variable memory: stack, JMP (signed), no min check",
+ .insns = {
++ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+- BPF_MOV64_IMM(BPF_REG_2, 16),
+ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+ BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
+@@ -6746,6 +6777,7 @@ static struct bpf_test tests[] = {
+ {
+ "helper access to variable memory: map, JMP, wrong max",
+ .insns = {
++ BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+ BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+@@ -6753,7 +6785,7 @@ static struct bpf_test tests[] = {
+ BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+- BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
++ BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),
+ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
+ BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
+@@ -6765,7 +6797,7 @@ static struct bpf_test tests[] = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
+- .fixup_map2 = { 3 },
++ .fixup_map2 = { 4 },
+ .errstr = "invalid access to map value, value_size=48 off=0 size=49",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+@@ -6800,6 +6832,7 @@ static struct bpf_test tests[] = {
+ {
+ "helper access to variable memory: map adjusted, JMP, wrong max",
+ .insns = {
++ BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 8),
+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+ BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+@@ -6808,7 +6841,7 @@ static struct bpf_test tests[] = {
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
+- BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
++ BPF_MOV64_REG(BPF_REG_2, BPF_REG_6),
+ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
+ BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
+@@ -6820,7 +6853,7 @@ static struct bpf_test tests[] = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
+- .fixup_map2 = { 3 },
++ .fixup_map2 = { 4 },
+ .errstr = "R1 min value is outside of the array range",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+@@ -6842,8 +6875,8 @@ static struct bpf_test tests[] = {
+ {
+ "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
+ .insns = {
++ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
+ BPF_MOV64_IMM(BPF_REG_1, 0),
+- BPF_MOV64_IMM(BPF_REG_2, 1),
+ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
+ BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
+@@ -7070,6 +7103,7 @@ static struct bpf_test tests[] = {
+ {
+ "helper access to variable memory: 8 bytes leak",
+ .insns = {
++ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, 8),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+@@ -7080,7 +7114,6 @@ static struct bpf_test tests[] = {
+ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
+ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
+ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+- BPF_MOV64_IMM(BPF_REG_2, 1),
+ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
+ BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
+@@ -8465,7 +8498,7 @@ static struct bpf_test tests[] = {
+ .prog_type = BPF_PROG_TYPE_LWT_IN,
+ },
+ {
+- "indirect variable-offset stack access",
++ "indirect variable-offset stack access, out of bound",
+ .insns = {
+ /* Fill the top 8 bytes of the stack */
+ BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+@@ -8486,10 +8519,85 @@ static struct bpf_test tests[] = {
+ BPF_EXIT_INSN(),
+ },
+ .fixup_map1 = { 5 },
+- .errstr = "variable stack read R2",
++ .errstr = "invalid stack type R2 var_off",
++ .result = REJECT,
++ .prog_type = BPF_PROG_TYPE_LWT_IN,
++ },
++ {
++ "indirect variable-offset stack access, max_off+size > max_initialized",
++ .insns = {
++ /* Fill only the second from top 8 bytes of the stack. */
++ BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
++ /* Get an unknown value. */
++ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
++ /* Make it small and 4-byte aligned. */
++ BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
++ BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 16),
++ /* Add it to fp. We now have either fp-12 or fp-16, but we don't know
++ * which. fp-12 size 8 is partially uninitialized stack.
++ */
++ BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
++ /* Dereference it indirectly. */
++ BPF_LD_MAP_FD(BPF_REG_1, 0),
++ BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_EXIT_INSN(),
++ },
++ .fixup_map1 = { 5 },
++ .errstr = "invalid indirect read from stack var_off",
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_LWT_IN,
+ },
++ {
++ "indirect variable-offset stack access, min_off < min_initialized",
++ .insns = {
++ /* Fill only the top 8 bytes of the stack. */
++ BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
++ /* Get an unknown value */
++ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
++ /* Make it small and 4-byte aligned. */
++ BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
++ BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 16),
++ /* Add it to fp. We now have either fp-12 or fp-16, but we don't know
++ * which. fp-16 size 8 is partially uninitialized stack.
++ */
++ BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
++ /* Dereference it indirectly. */
++ BPF_LD_MAP_FD(BPF_REG_1, 0),
++ BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_EXIT_INSN(),
++ },
++ .fixup_map1 = { 5 },
++ .errstr = "invalid indirect read from stack var_off",
++ .result = REJECT,
++ .prog_type = BPF_PROG_TYPE_LWT_IN,
++ },
++ {
++ "indirect variable-offset stack access, ok",
++ .insns = {
++ /* Fill the top 16 bytes of the stack. */
++ BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
++ BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
++ /* Get an unknown value. */
++ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
++ /* Make it small and 4-byte aligned. */
++ BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
++ BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 16),
++ /* Add it to fp. We now have either fp-12 or fp-16, we don't know
++ * which, but either way it points to initialized stack.
++ */
++ BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
++ /* Dereference it indirectly. */
++ BPF_LD_MAP_FD(BPF_REG_1, 0),
++ BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_EXIT_INSN(),
++ },
++ .fixup_map1 = { 6 },
++ .result = ACCEPT,
++ .prog_type = BPF_PROG_TYPE_LWT_IN,
++ },
+ {
+ "direct stack access with 32-bit wraparound. test1",
+ .insns = {
+diff --git a/tools/thermal/tmon/Makefile b/tools/thermal/tmon/Makefile
+index 735a510230c3f..45751648aacda 100644
+--- a/tools/thermal/tmon/Makefile
++++ b/tools/thermal/tmon/Makefile
+@@ -10,7 +10,7 @@ CFLAGS+= -O1 ${WARNFLAGS}
+ # Add "-fstack-protector" only if toolchain supports it.
+ CFLAGS+= $(call cc-option,-fstack-protector)
+ CC?= $(CROSS_COMPILE)gcc
+-PKG_CONFIG?= pkg-config
++PKG_CONFIG?= $(CROSS_COMPILE)pkg-config
+
+ CFLAGS+=-D VERSION=\"$(VERSION)\"
+ LDFLAGS+=
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index 39706799ecdf8..b943ec5345cbd 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -1137,6 +1137,14 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
+ if (copy_from_user(®, argp, sizeof(reg)))
+ break;
+
++ /*
++ * We could owe a reset due to PSCI. Handle the pending reset
++ * here to ensure userspace register accesses are ordered after
++ * the reset.
++ */
++ if (kvm_check_request(KVM_REQ_VCPU_RESET, vcpu))
++ kvm_reset_vcpu(vcpu);
++
+ if (ioctl == KVM_SET_ONE_REG)
+ r = kvm_arm_set_reg(vcpu, ®);
+ else
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-09-26 14:13 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-09-26 14:13 UTC (permalink / raw
To: gentoo-commits
commit: 639a49e4ef9f0716154d7524de784a0c0e055f41
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 26 14:13:46 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Sep 26 14:13:46 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=639a49e4
Linux patch 4.19.208
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1207_linux-4.19.208.patch | 855 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 859 insertions(+)
diff --git a/0000_README b/0000_README
index 6a76482..e4a501b 100644
--- a/0000_README
+++ b/0000_README
@@ -867,6 +867,10 @@ Patch: 1206_linux-4.19.207.patch
From: https://www.kernel.org
Desc: Linux 4.19.207
+Patch: 1207_linux-4.19.208.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.208
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1207_linux-4.19.208.patch b/1207_linux-4.19.208.patch
new file mode 100644
index 0000000..fa55a73
--- /dev/null
+++ b/1207_linux-4.19.208.patch
@@ -0,0 +1,855 @@
+diff --git a/Makefile b/Makefile
+index 77dd62aa0bbe5..a4c2526409831 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 207
++SUBLEVEL = 208
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c
+index 0bf0a835122f8..d17414cbb89a8 100644
+--- a/arch/arm64/kernel/cacheinfo.c
++++ b/arch/arm64/kernel/cacheinfo.c
+@@ -45,7 +45,7 @@ static void ci_leaf_init(struct cacheinfo *this_leaf,
+ this_leaf->type = type;
+ }
+
+-static int __init_cache_level(unsigned int cpu)
++int init_cache_level(unsigned int cpu)
+ {
+ unsigned int ctype, level, leaves, fw_level;
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+@@ -80,7 +80,7 @@ static int __init_cache_level(unsigned int cpu)
+ return 0;
+ }
+
+-static int __populate_cache_leaves(unsigned int cpu)
++int populate_cache_leaves(unsigned int cpu)
+ {
+ unsigned int level, idx;
+ enum cache_type type;
+@@ -99,6 +99,3 @@ static int __populate_cache_leaves(unsigned int cpu)
+ }
+ return 0;
+ }
+-
+-DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level)
+-DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves)
+diff --git a/arch/mips/kernel/cacheinfo.c b/arch/mips/kernel/cacheinfo.c
+index 3ea95568ece49..1c19a06983089 100644
+--- a/arch/mips/kernel/cacheinfo.c
++++ b/arch/mips/kernel/cacheinfo.c
+@@ -28,7 +28,7 @@ do { \
+ leaf++; \
+ } while (0)
+
+-static int __init_cache_level(unsigned int cpu)
++int init_cache_level(unsigned int cpu)
+ {
+ struct cpuinfo_mips *c = ¤t_cpu_data;
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+@@ -80,7 +80,7 @@ static void fill_cpumask_cluster(int cpu, cpumask_t *cpu_map)
+ cpumask_set_cpu(cpu1, cpu_map);
+ }
+
+-static int __populate_cache_leaves(unsigned int cpu)
++int populate_cache_leaves(unsigned int cpu)
+ {
+ struct cpuinfo_mips *c = ¤t_cpu_data;
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+@@ -109,6 +109,3 @@ static int __populate_cache_leaves(unsigned int cpu)
+
+ return 0;
+ }
+-
+-DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level)
+-DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves)
+diff --git a/arch/riscv/kernel/cacheinfo.c b/arch/riscv/kernel/cacheinfo.c
+index 0bc86e5f8f3fb..9d46c8575a61a 100644
+--- a/arch/riscv/kernel/cacheinfo.c
++++ b/arch/riscv/kernel/cacheinfo.c
+@@ -31,7 +31,7 @@ static void ci_leaf_init(struct cacheinfo *this_leaf,
+ | CACHE_WRITE_ALLOCATE;
+ }
+
+-static int __init_cache_level(unsigned int cpu)
++int init_cache_level(unsigned int cpu)
+ {
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+ struct device_node *np = of_cpu_device_node_get(cpu);
+@@ -67,7 +67,7 @@ static int __init_cache_level(unsigned int cpu)
+ return 0;
+ }
+
+-static int __populate_cache_leaves(unsigned int cpu)
++int populate_cache_leaves(unsigned int cpu)
+ {
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+ struct cacheinfo *this_leaf = this_cpu_ci->info_list;
+@@ -99,6 +99,3 @@ static int __populate_cache_leaves(unsigned int cpu)
+
+ return 0;
+ }
+-
+-DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level)
+-DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves)
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 8508c2c0e2a3a..bdc33d0e3ffcb 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -561,10 +561,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ EMIT4(0xb9080000, dst_reg, src_reg);
+ break;
+ case BPF_ALU | BPF_ADD | BPF_K: /* dst = (u32) dst + (u32) imm */
+- if (!imm)
+- break;
+- /* alfi %dst,imm */
+- EMIT6_IMM(0xc20b0000, dst_reg, imm);
++ if (imm != 0) {
++ /* alfi %dst,imm */
++ EMIT6_IMM(0xc20b0000, dst_reg, imm);
++ }
+ EMIT_ZERO(dst_reg);
+ break;
+ case BPF_ALU64 | BPF_ADD | BPF_K: /* dst = dst + imm */
+@@ -586,10 +586,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ EMIT4(0xb9090000, dst_reg, src_reg);
+ break;
+ case BPF_ALU | BPF_SUB | BPF_K: /* dst = (u32) dst - (u32) imm */
+- if (!imm)
+- break;
+- /* alfi %dst,-imm */
+- EMIT6_IMM(0xc20b0000, dst_reg, -imm);
++ if (imm != 0) {
++ /* alfi %dst,-imm */
++ EMIT6_IMM(0xc20b0000, dst_reg, -imm);
++ }
+ EMIT_ZERO(dst_reg);
+ break;
+ case BPF_ALU64 | BPF_SUB | BPF_K: /* dst = dst - imm */
+@@ -616,10 +616,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ EMIT4(0xb90c0000, dst_reg, src_reg);
+ break;
+ case BPF_ALU | BPF_MUL | BPF_K: /* dst = (u32) dst * (u32) imm */
+- if (imm == 1)
+- break;
+- /* msfi %r5,imm */
+- EMIT6_IMM(0xc2010000, dst_reg, imm);
++ if (imm != 1) {
++ /* msfi %r5,imm */
++ EMIT6_IMM(0xc2010000, dst_reg, imm);
++ }
+ EMIT_ZERO(dst_reg);
+ break;
+ case BPF_ALU64 | BPF_MUL | BPF_K: /* dst = dst * imm */
+@@ -670,6 +670,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ if (BPF_OP(insn->code) == BPF_MOD)
+ /* lhgi %dst,0 */
+ EMIT4_IMM(0xa7090000, dst_reg, 0);
++ else
++ EMIT_ZERO(dst_reg);
+ break;
+ }
+ /* lhi %w0,0 */
+@@ -762,10 +764,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ EMIT4(0xb9820000, dst_reg, src_reg);
+ break;
+ case BPF_ALU | BPF_XOR | BPF_K: /* dst = (u32) dst ^ (u32) imm */
+- if (!imm)
+- break;
+- /* xilf %dst,imm */
+- EMIT6_IMM(0xc0070000, dst_reg, imm);
++ if (imm != 0) {
++ /* xilf %dst,imm */
++ EMIT6_IMM(0xc0070000, dst_reg, imm);
++ }
+ EMIT_ZERO(dst_reg);
+ break;
+ case BPF_ALU64 | BPF_XOR | BPF_K: /* dst = dst ^ imm */
+@@ -786,10 +788,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ EMIT6_DISP_LH(0xeb000000, 0x000d, dst_reg, dst_reg, src_reg, 0);
+ break;
+ case BPF_ALU | BPF_LSH | BPF_K: /* dst = (u32) dst << (u32) imm */
+- if (imm == 0)
+- break;
+- /* sll %dst,imm(%r0) */
+- EMIT4_DISP(0x89000000, dst_reg, REG_0, imm);
++ if (imm != 0) {
++ /* sll %dst,imm(%r0) */
++ EMIT4_DISP(0x89000000, dst_reg, REG_0, imm);
++ }
+ EMIT_ZERO(dst_reg);
+ break;
+ case BPF_ALU64 | BPF_LSH | BPF_K: /* dst = dst << imm */
+@@ -811,10 +813,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
+ EMIT6_DISP_LH(0xeb000000, 0x000c, dst_reg, dst_reg, src_reg, 0);
+ break;
+ case BPF_ALU | BPF_RSH | BPF_K: /* dst = (u32) dst >> (u32) imm */
+- if (imm == 0)
+- break;
+- /* srl %dst,imm(%r0) */
+- EMIT4_DISP(0x88000000, dst_reg, REG_0, imm);
++ if (imm != 0) {
++ /* srl %dst,imm(%r0) */
++ EMIT4_DISP(0x88000000, dst_reg, REG_0, imm);
++ }
+ EMIT_ZERO(dst_reg);
+ break;
+ case BPF_ALU64 | BPF_RSH | BPF_K: /* dst = dst >> imm */
+diff --git a/arch/x86/kernel/cpu/cacheinfo.c b/arch/x86/kernel/cpu/cacheinfo.c
+index 9d863e8f9b3f2..4a393023f5ac3 100644
+--- a/arch/x86/kernel/cpu/cacheinfo.c
++++ b/arch/x86/kernel/cpu/cacheinfo.c
+@@ -956,7 +956,7 @@ static void ci_leaf_init(struct cacheinfo *this_leaf,
+ this_leaf->priv = base->nb;
+ }
+
+-static int __init_cache_level(unsigned int cpu)
++int init_cache_level(unsigned int cpu)
+ {
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+
+@@ -985,7 +985,7 @@ static void get_cache_id(int cpu, struct _cpuid4_info_regs *id4_regs)
+ id4_regs->id = c->apicid >> index_msb;
+ }
+
+-static int __populate_cache_leaves(unsigned int cpu)
++int populate_cache_leaves(unsigned int cpu)
+ {
+ unsigned int idx, ret;
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+@@ -1004,6 +1004,3 @@ static int __populate_cache_leaves(unsigned int cpu)
+
+ return 0;
+ }
+-
+-DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level)
+-DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves)
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index caee658609d73..853b1770df367 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -2437,6 +2437,7 @@ int blk_throtl_init(struct request_queue *q)
+ void blk_throtl_exit(struct request_queue *q)
+ {
+ BUG_ON(!q->td);
++ del_timer_sync(&q->td->service_queue.pending_timer);
+ throtl_shutdown_wq(q);
+ blkcg_deactivate_policy(q, &blkcg_policy_throtl);
+ free_percpu(q->td->latency_buckets[READ]);
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 07e1a286ee431..78b4f0f172ae5 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -853,7 +853,7 @@ static void talitos_unregister_rng(struct device *dev)
+ * HMAC_SNOOP_NO_AFEA (HSNA) instead of type IPSEC_ESP
+ */
+ #define TALITOS_CRA_PRIORITY_AEAD_HSNA (TALITOS_CRA_PRIORITY - 1)
+-#ifdef CONFIG_CRYPTO_DEV_TALITOS_SEC2
++#ifdef CONFIG_CRYPTO_DEV_TALITOS2
+ #define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA512_BLOCK_SIZE)
+ #else
+ #define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA256_BLOCK_SIZE)
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
+index 52dd4bd7c2098..e5f31af65aabf 100644
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -266,7 +266,7 @@ config INTEL_IDMA64
+
+ config INTEL_IOATDMA
+ tristate "Intel I/OAT DMA support"
+- depends on PCI && X86_64
++ depends on PCI && X86_64 && !UML
+ select DMA_ENGINE
+ select DMA_ENGINE_RAID
+ select DCA
+diff --git a/drivers/dma/acpi-dma.c b/drivers/dma/acpi-dma.c
+index 8d99c84361cbb..22ec10c71d813 100644
+--- a/drivers/dma/acpi-dma.c
++++ b/drivers/dma/acpi-dma.c
+@@ -72,10 +72,14 @@ static int acpi_dma_parse_resource_group(const struct acpi_csrt_group *grp,
+
+ si = (const struct acpi_csrt_shared_info *)&grp[1];
+
+- /* Match device by MMIO and IRQ */
++ /* Match device by MMIO */
+ if (si->mmio_base_low != lower_32_bits(mem) ||
+- si->mmio_base_high != upper_32_bits(mem) ||
+- si->gsi_interrupt != irq)
++ si->mmio_base_high != upper_32_bits(mem))
++ return 0;
++
++ /* Match device by Linux vIRQ */
++ ret = acpi_register_gsi(NULL, si->gsi_interrupt, si->interrupt_mode, si->interrupt_polarity);
++ if (ret != irq)
+ return 0;
+
+ dev_dbg(&adev->dev, "matches with %.4s%04X (rev %u)\n",
+diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
+index 9e8ce56a83d8a..0fadf6a084943 100644
+--- a/drivers/dma/sprd-dma.c
++++ b/drivers/dma/sprd-dma.c
+@@ -1016,6 +1016,7 @@ static const struct of_device_id sprd_dma_match[] = {
+ { .compatible = "sprd,sc9860-dma", },
+ {},
+ };
++MODULE_DEVICE_TABLE(of, sprd_dma_match);
+
+ static int __maybe_unused sprd_dma_runtime_suspend(struct device *dev)
+ {
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index d891ec05bc48b..3f38df6b51f2a 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -2674,7 +2674,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+ xdev->ext_addr = false;
+
+ /* Set the dma mask bits */
+- dma_set_mask(xdev->dev, DMA_BIT_MASK(addr_width));
++ dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width));
+
+ /* Initialize the DMA engine */
+ xdev->common.dev = &pdev->dev;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c
+index b0ece71aefdee..ce774579c89d1 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c
+@@ -57,7 +57,7 @@ nvkm_control_mthd_pstate_info(struct nvkm_control *ctrl, void *data, u32 size)
+ args->v0.count = 0;
+ args->v0.ustate_ac = NVIF_CONTROL_PSTATE_INFO_V0_USTATE_DISABLE;
+ args->v0.ustate_dc = NVIF_CONTROL_PSTATE_INFO_V0_USTATE_DISABLE;
+- args->v0.pwrsrc = -ENOSYS;
++ args->v0.pwrsrc = -ENODEV;
+ args->v0.pstate = NVIF_CONTROL_PSTATE_INFO_V0_PSTATE_UNKNOWN;
+ }
+
+diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
+index 29df6ab29e95c..2b60535a9c7bf 100644
+--- a/drivers/parisc/dino.c
++++ b/drivers/parisc/dino.c
+@@ -160,15 +160,6 @@ struct dino_device
+ (struct dino_device *)__pdata; })
+
+
+-/* Check if PCI device is behind a Card-mode Dino. */
+-static int pci_dev_is_behind_card_dino(struct pci_dev *dev)
+-{
+- struct dino_device *dino_dev;
+-
+- dino_dev = DINO_DEV(parisc_walk_tree(dev->bus->bridge));
+- return is_card_dino(&dino_dev->hba.dev->id);
+-}
+-
+ /*
+ * Dino Configuration Space Accessor Functions
+ */
+@@ -452,6 +443,15 @@ static void quirk_cirrus_cardbus(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_6832, quirk_cirrus_cardbus );
+
+ #ifdef CONFIG_TULIP
++/* Check if PCI device is behind a Card-mode Dino. */
++static int pci_dev_is_behind_card_dino(struct pci_dev *dev)
++{
++ struct dino_device *dino_dev;
++
++ dino_dev = DINO_DEV(parisc_walk_tree(dev->bus->bridge));
++ return is_card_dino(&dino_dev->hba.dev->id);
++}
++
+ static void pci_fixup_tulip(struct pci_dev *dev)
+ {
+ if (!pci_dev_is_behind_card_dino(dev))
+diff --git a/drivers/pwm/pwm-img.c b/drivers/pwm/pwm-img.c
+index 3b0a097ce2abd..6111e8848b076 100644
+--- a/drivers/pwm/pwm-img.c
++++ b/drivers/pwm/pwm-img.c
+@@ -332,23 +332,7 @@ err_pm_disable:
+ static int img_pwm_remove(struct platform_device *pdev)
+ {
+ struct img_pwm_chip *pwm_chip = platform_get_drvdata(pdev);
+- u32 val;
+- unsigned int i;
+- int ret;
+-
+- ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0) {
+- pm_runtime_put(&pdev->dev);
+- return ret;
+- }
+-
+- for (i = 0; i < pwm_chip->chip.npwm; i++) {
+- val = img_pwm_readl(pwm_chip, PWM_CTRL_CFG);
+- val &= ~BIT(i);
+- img_pwm_writel(pwm_chip, PWM_CTRL_CFG, val);
+- }
+
+- pm_runtime_put(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ if (!pm_runtime_status_suspended(&pdev->dev))
+ img_pwm_runtime_suspend(&pdev->dev);
+diff --git a/drivers/pwm/pwm-lpc32xx.c b/drivers/pwm/pwm-lpc32xx.c
+index a9b3cff96aaca..ed8e9406b4af2 100644
+--- a/drivers/pwm/pwm-lpc32xx.c
++++ b/drivers/pwm/pwm-lpc32xx.c
+@@ -124,17 +124,17 @@ static int lpc32xx_pwm_probe(struct platform_device *pdev)
+ lpc32xx->chip.npwm = 1;
+ lpc32xx->chip.base = -1;
+
++ /* If PWM is disabled, configure the output to the default value */
++ val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
++ val &= ~PWM_PIN_LEVEL;
++ writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
++
+ ret = pwmchip_add(&lpc32xx->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to add PWM chip, error %d\n", ret);
+ return ret;
+ }
+
+- /* When PWM is disable, configure the output to the default value */
+- val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
+- val &= ~PWM_PIN_LEVEL;
+- writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
+-
+ platform_set_drvdata(pdev, lpc32xx);
+
+ return 0;
+diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
+index 48bcc853d57a7..cf34fb00c0547 100644
+--- a/drivers/pwm/pwm-rockchip.c
++++ b/drivers/pwm/pwm-rockchip.c
+@@ -392,20 +392,6 @@ static int rockchip_pwm_remove(struct platform_device *pdev)
+ {
+ struct rockchip_pwm_chip *pc = platform_get_drvdata(pdev);
+
+- /*
+- * Disable the PWM clk before unpreparing it if the PWM device is still
+- * running. This should only happen when the last PWM user left it
+- * enabled, or when nobody requested a PWM that was previously enabled
+- * by the bootloader.
+- *
+- * FIXME: Maybe the core should disable all PWM devices in
+- * pwmchip_remove(). In this case we'd only have to call
+- * clk_unprepare() after pwmchip_remove().
+- *
+- */
+- if (pwm_is_enabled(pc->chip.pwms))
+- clk_disable(pc->clk);
+-
+ clk_unprepare(pc->pclk);
+ clk_unprepare(pc->clk);
+
+diff --git a/drivers/pwm/pwm-stm32-lp.c b/drivers/pwm/pwm-stm32-lp.c
+index 28e1f64134763..e92a140074221 100644
+--- a/drivers/pwm/pwm-stm32-lp.c
++++ b/drivers/pwm/pwm-stm32-lp.c
+@@ -224,8 +224,6 @@ static int stm32_pwm_lp_remove(struct platform_device *pdev)
+ {
+ struct stm32_pwm_lp *priv = platform_get_drvdata(pdev);
+
+- pwm_disable(&priv->chip.pwms[0]);
+-
+ return pwmchip_remove(&priv->chip);
+ }
+
+diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
+index fc9399d9c0820..3376be6863cd8 100644
+--- a/drivers/thermal/samsung/exynos_tmu.c
++++ b/drivers/thermal/samsung/exynos_tmu.c
+@@ -1084,6 +1084,7 @@ static int exynos_tmu_probe(struct platform_device *pdev)
+ data->sclk = devm_clk_get(&pdev->dev, "tmu_sclk");
+ if (IS_ERR(data->sclk)) {
+ dev_err(&pdev->dev, "Failed to get sclk\n");
++ ret = PTR_ERR(data->sclk);
+ goto err_clk;
+ } else {
+ ret = clk_prepare_enable(data->sclk);
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 918781c51f0ba..6443ba1e60eb4 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1774,6 +1774,8 @@ static int __mark_caps_flushing(struct inode *inode,
+ * try to invalidate mapping pages without blocking.
+ */
+ static int try_nonblocking_invalidate(struct inode *inode)
++ __releases(ci->i_ceph_lock)
++ __acquires(ci->i_ceph_lock)
+ {
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ u32 invalidating_gen = ci->i_rdcache_gen;
+diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
+index c6c8a33c81d5e..28a2db3b1787f 100644
+--- a/fs/nilfs2/sysfs.c
++++ b/fs/nilfs2/sysfs.c
+@@ -64,11 +64,9 @@ static const struct sysfs_ops nilfs_##name##_attr_ops = { \
+ #define NILFS_DEV_INT_GROUP_TYPE(name, parent_name) \
+ static void nilfs_##name##_attr_release(struct kobject *kobj) \
+ { \
+- struct nilfs_sysfs_##parent_name##_subgroups *subgroups; \
+- struct the_nilfs *nilfs = container_of(kobj->parent, \
+- struct the_nilfs, \
+- ns_##parent_name##_kobj); \
+- subgroups = nilfs->ns_##parent_name##_subgroups; \
++ struct nilfs_sysfs_##parent_name##_subgroups *subgroups = container_of(kobj, \
++ struct nilfs_sysfs_##parent_name##_subgroups, \
++ sg_##name##_kobj); \
+ complete(&subgroups->sg_##name##_kobj_unregister); \
+ } \
+ static struct kobj_type nilfs_##name##_ktype = { \
+@@ -94,12 +92,12 @@ static int nilfs_sysfs_create_##name##_group(struct the_nilfs *nilfs) \
+ err = kobject_init_and_add(kobj, &nilfs_##name##_ktype, parent, \
+ #name); \
+ if (err) \
+- return err; \
+- return 0; \
++ kobject_put(kobj); \
++ return err; \
+ } \
+ static void nilfs_sysfs_delete_##name##_group(struct the_nilfs *nilfs) \
+ { \
+- kobject_del(&nilfs->ns_##parent_name##_subgroups->sg_##name##_kobj); \
++ kobject_put(&nilfs->ns_##parent_name##_subgroups->sg_##name##_kobj); \
+ }
+
+ /************************************************************************
+@@ -210,14 +208,14 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root)
+ }
+
+ if (err)
+- return err;
++ kobject_put(&root->snapshot_kobj);
+
+- return 0;
++ return err;
+ }
+
+ void nilfs_sysfs_delete_snapshot_group(struct nilfs_root *root)
+ {
+- kobject_del(&root->snapshot_kobj);
++ kobject_put(&root->snapshot_kobj);
+ }
+
+ /************************************************************************
+@@ -1000,7 +998,7 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
+ err = kobject_init_and_add(&nilfs->ns_dev_kobj, &nilfs_dev_ktype, NULL,
+ "%s", sb->s_id);
+ if (err)
+- goto free_dev_subgroups;
++ goto cleanup_dev_kobject;
+
+ err = nilfs_sysfs_create_mounted_snapshots_group(nilfs);
+ if (err)
+@@ -1037,9 +1035,7 @@ delete_mounted_snapshots_group:
+ nilfs_sysfs_delete_mounted_snapshots_group(nilfs);
+
+ cleanup_dev_kobject:
+- kobject_del(&nilfs->ns_dev_kobj);
+-
+-free_dev_subgroups:
++ kobject_put(&nilfs->ns_dev_kobj);
+ kfree(nilfs->ns_dev_subgroups);
+
+ failed_create_device_group:
+diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
+index 484785cdf96e2..931870768556c 100644
+--- a/fs/nilfs2/the_nilfs.c
++++ b/fs/nilfs2/the_nilfs.c
+@@ -797,14 +797,13 @@ nilfs_find_or_create_root(struct the_nilfs *nilfs, __u64 cno)
+
+ void nilfs_put_root(struct nilfs_root *root)
+ {
+- if (refcount_dec_and_test(&root->count)) {
+- struct the_nilfs *nilfs = root->nilfs;
++ struct the_nilfs *nilfs = root->nilfs;
+
+- nilfs_sysfs_delete_snapshot_group(root);
+-
+- spin_lock(&nilfs->ns_cptree_lock);
++ if (refcount_dec_and_lock(&root->count, &nilfs->ns_cptree_lock)) {
+ rb_erase(&root->rb_node, &nilfs->ns_cptree);
+ spin_unlock(&nilfs->ns_cptree_lock);
++
++ nilfs_sysfs_delete_snapshot_group(root);
+ iput(root->ifile);
+
+ kfree(root);
+diff --git a/include/linux/cacheinfo.h b/include/linux/cacheinfo.h
+index 70e19bc6cc9fc..66654e6f96054 100644
+--- a/include/linux/cacheinfo.h
++++ b/include/linux/cacheinfo.h
+@@ -76,24 +76,6 @@ struct cpu_cacheinfo {
+ bool cpu_map_populated;
+ };
+
+-/*
+- * Helpers to make sure "func" is executed on the cpu whose cache
+- * attributes are being detected
+- */
+-#define DEFINE_SMP_CALL_CACHE_FUNCTION(func) \
+-static inline void _##func(void *ret) \
+-{ \
+- int cpu = smp_processor_id(); \
+- *(int *)ret = __##func(cpu); \
+-} \
+- \
+-int func(unsigned int cpu) \
+-{ \
+- int ret; \
+- smp_call_function_single(cpu, _##func, &ret, true); \
+- return ret; \
+-}
+-
+ struct cpu_cacheinfo *get_cpu_cacheinfo(unsigned int cpu);
+ int init_cache_level(unsigned int cpu);
+ int populate_cache_leaves(unsigned int cpu);
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 8dd4ebb58e973..827f70ce0b497 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -248,7 +248,8 @@ struct kvm_vcpu {
+ struct preempt_notifier preempt_notifier;
+ #endif
+ int cpu;
+- int vcpu_id;
++ int vcpu_id; /* id given by userspace at creation */
++ int vcpu_idx; /* index in kvm->vcpus array */
+ int srcu_idx;
+ int mode;
+ u64 requests;
+@@ -551,13 +552,7 @@ static inline struct kvm_vcpu *kvm_get_vcpu_by_id(struct kvm *kvm, int id)
+
+ static inline int kvm_vcpu_get_idx(struct kvm_vcpu *vcpu)
+ {
+- struct kvm_vcpu *tmp;
+- int idx;
+-
+- kvm_for_each_vcpu(idx, tmp, vcpu->kvm)
+- if (tmp == vcpu)
+- return idx;
+- BUG();
++ return vcpu->vcpu_idx;
+ }
+
+ #define kvm_for_each_memslot(memslot, slots) \
+diff --git a/kernel/profile.c b/kernel/profile.c
+index 9aa2a4445b0d2..efa58f63dc1bf 100644
+--- a/kernel/profile.c
++++ b/kernel/profile.c
+@@ -40,7 +40,8 @@ struct profile_hit {
+ #define NR_PROFILE_GRP (NR_PROFILE_HIT/PROFILE_GRPSZ)
+
+ static atomic_t *prof_buffer;
+-static unsigned long prof_len, prof_shift;
++static unsigned long prof_len;
++static unsigned short int prof_shift;
+
+ int prof_on __read_mostly;
+ EXPORT_SYMBOL_GPL(prof_on);
+@@ -66,8 +67,8 @@ int profile_setup(char *str)
+ if (str[strlen(sleepstr)] == ',')
+ str += strlen(sleepstr) + 1;
+ if (get_option(&str, &par))
+- prof_shift = par;
+- pr_info("kernel sleep profiling enabled (shift: %ld)\n",
++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
++ pr_info("kernel sleep profiling enabled (shift: %u)\n",
+ prof_shift);
+ #else
+ pr_warn("kernel sleep profiling requires CONFIG_SCHEDSTATS\n");
+@@ -77,21 +78,21 @@ int profile_setup(char *str)
+ if (str[strlen(schedstr)] == ',')
+ str += strlen(schedstr) + 1;
+ if (get_option(&str, &par))
+- prof_shift = par;
+- pr_info("kernel schedule profiling enabled (shift: %ld)\n",
++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
++ pr_info("kernel schedule profiling enabled (shift: %u)\n",
+ prof_shift);
+ } else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
+ prof_on = KVM_PROFILING;
+ if (str[strlen(kvmstr)] == ',')
+ str += strlen(kvmstr) + 1;
+ if (get_option(&str, &par))
+- prof_shift = par;
+- pr_info("kernel KVM profiling enabled (shift: %ld)\n",
++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
++ pr_info("kernel KVM profiling enabled (shift: %u)\n",
+ prof_shift);
+ } else if (get_option(&str, &par)) {
+- prof_shift = par;
++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
+ prof_on = CPU_PROFILING;
+- pr_info("kernel profiling enabled (shift: %ld)\n",
++ pr_info("kernel profiling enabled (shift: %u)\n",
+ prof_shift);
+ }
+ return 1;
+@@ -467,7 +468,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+ unsigned long p = *ppos;
+ ssize_t read;
+ char *pnt;
+- unsigned int sample_step = 1 << prof_shift;
++ unsigned long sample_step = 1UL << prof_shift;
+
+ profile_flip_buffers();
+ if (p >= (prof_len+1)*sizeof(unsigned int))
+diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
+index 0b2c2ad69629c..72770a551c24d 100644
+--- a/kernel/rcu/tree_exp.h
++++ b/kernel/rcu/tree_exp.h
+@@ -613,7 +613,7 @@ static void rcu_exp_wait_wake(struct rcu_state *rsp, unsigned long s)
+ spin_unlock(&rnp->exp_lock);
+ }
+ smp_mb(); /* All above changes before wakeup. */
+- wake_up_all(&rnp->exp_wq[rcu_seq_ctr(rsp->expedited_sequence) & 0x3]);
++ wake_up_all(&rnp->exp_wq[rcu_seq_ctr(s) & 0x3]);
+ }
+ trace_rcu_exp_grace_period(rsp->name, s, TPS("endwake"));
+ mutex_unlock(&rsp->exp_wake_mutex);
+diff --git a/kernel/sys.c b/kernel/sys.c
+index baf60a3aa34b7..d0663f8e6fb80 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1931,13 +1931,6 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map)
+
+ error = -EINVAL;
+
+- /*
+- * @brk should be after @end_data in traditional maps.
+- */
+- if (prctl_map->start_brk <= prctl_map->end_data ||
+- prctl_map->brk <= prctl_map->end_data)
+- goto out;
+-
+ /*
+ * Neither we should allow to override limits if they set.
+ */
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index 61eff45653f57..36dfea29d5fa0 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -836,8 +836,9 @@ static int create_trace_kprobe(int argc, char **argv)
+ pr_info("Failed to parse either an address or a symbol.\n");
+ return ret;
+ }
++ /* Defer the ENOENT case until register kprobe */
+ if (offset && is_return &&
+- !kprobe_on_func_entry(NULL, symbol, offset)) {
++ kprobe_on_func_entry(NULL, symbol, offset) == -EINVAL) {
+ pr_info("Given offset is not valid for return probe.\n");
+ return -EINVAL;
+ }
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 46a910acce3f0..6970759f296c5 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -853,7 +853,6 @@ config HARDLOCKUP_DETECTOR
+ depends on HAVE_HARDLOCKUP_DETECTOR_PERF || HAVE_HARDLOCKUP_DETECTOR_ARCH
+ select LOCKUP_DETECTOR
+ select HARDLOCKUP_DETECTOR_PERF if HAVE_HARDLOCKUP_DETECTOR_PERF
+- select HARDLOCKUP_DETECTOR_ARCH if HAVE_HARDLOCKUP_DETECTOR_ARCH
+ help
+ Say Y here to enable the kernel to act as a watchdog to detect
+ hard lockups.
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index 849336211c79b..f7cd8e018bde0 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -620,7 +620,7 @@ static int p9_virtio_probe(struct virtio_device *vdev)
+ chan->vc_wq = kmalloc(sizeof(wait_queue_head_t), GFP_KERNEL);
+ if (!chan->vc_wq) {
+ err = -ENOMEM;
+- goto out_free_tag;
++ goto out_remove_file;
+ }
+ init_waitqueue_head(chan->vc_wq);
+ chan->ring_bufs_avail = 1;
+@@ -638,6 +638,8 @@ static int p9_virtio_probe(struct virtio_device *vdev)
+
+ return 0;
+
++out_remove_file:
++ sysfs_remove_file(&vdev->dev.kobj, &dev_attr_mount_tag.attr);
+ out_free_tag:
+ kfree(tag);
+ out_free_vq:
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index 23c4f14bec256..8b7c07fc66d4b 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -1125,6 +1125,9 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
+ union sctp_addr_param *param;
+ union sctp_addr paddr;
+
++ if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr))
++ return NULL;
++
+ /* Skip over the ADDIP header and find the Address parameter */
+ param = (union sctp_addr_param *)(asconf + 1);
+
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index a1ca070e36b0a..0789109c2d093 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -2172,9 +2172,16 @@ static enum sctp_ierror sctp_verify_param(struct net *net,
+ break;
+
+ case SCTP_PARAM_SET_PRIMARY:
+- if (net->sctp.addip_enable)
+- break;
+- goto fallthrough;
++ if (!net->sctp.addip_enable)
++ goto fallthrough;
++
++ if (ntohs(param.p->length) < sizeof(struct sctp_addip_param) +
++ sizeof(struct sctp_paramhdr)) {
++ sctp_process_inv_paramlength(asoc, param.p,
++ chunk, err_chunk);
++ retval = SCTP_IERROR_ABORT;
++ }
++ break;
+
+ case SCTP_PARAM_HOST_NAME_ADDRESS:
+ /* Tell the peer, we won't support this param. */
+diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
+index 1ec1e928cc09c..900c865b9e5ff 100644
+--- a/security/apparmor/apparmorfs.c
++++ b/security/apparmor/apparmorfs.c
+@@ -1960,9 +1960,6 @@ fail2:
+ return error;
+ }
+
+-
+-#define list_entry_is_head(pos, head, member) (&pos->member == (head))
+-
+ /**
+ * __next_ns - find the next namespace to list
+ * @root: root namespace to stop search at (NOT NULL)
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index a3d82113ae1ce..86ef740763b50 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2751,7 +2751,8 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
+ goto unlock_vcpu_destroy;
+ }
+
+- BUG_ON(kvm->vcpus[atomic_read(&kvm->online_vcpus)]);
++ vcpu->vcpu_idx = atomic_read(&kvm->online_vcpus);
++ BUG_ON(kvm->vcpus[vcpu->vcpu_idx]);
+
+ /* Now it's all set up, let userspace reach it */
+ kvm_get_kvm(kvm);
+@@ -2761,7 +2762,7 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
+ goto unlock_vcpu_destroy;
+ }
+
+- kvm->vcpus[atomic_read(&kvm->online_vcpus)] = vcpu;
++ kvm->vcpus[vcpu->vcpu_idx] = vcpu;
+
+ /*
+ * Pairs with smp_rmb() in kvm_get_vcpu. Write kvm->vcpus
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-10-06 14:06 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-10-06 14:06 UTC (permalink / raw
To: gentoo-commits
commit: 7d0d034aaa54dcff040633c7c1aa872df68b784f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 6 14:05:30 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Oct 6 14:05:30 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7d0d034a
Linux patch 4.19.209
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1208_linux-4.19.209.patch | 3383 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3387 insertions(+)
diff --git a/0000_README b/0000_README
index e4a501b..fbfd59f 100644
--- a/0000_README
+++ b/0000_README
@@ -871,6 +871,10 @@ Patch: 1207_linux-4.19.208.patch
From: https://www.kernel.org
Desc: Linux 4.19.208
+Patch: 1208_linux-4.19.209.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.209
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1208_linux-4.19.209.patch b/1208_linux-4.19.209.patch
new file mode 100644
index 0000000..21387e2
--- /dev/null
+++ b/1208_linux-4.19.209.patch
@@ -0,0 +1,3383 @@
+diff --git a/Makefile b/Makefile
+index a4c2526409831..a144a7117a1bd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 208
++SUBLEVEL = 209
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h
+index 0bba9e991189d..d4eab4f20249f 100644
+--- a/arch/alpha/include/asm/io.h
++++ b/arch/alpha/include/asm/io.h
+@@ -61,7 +61,7 @@ extern inline void set_hae(unsigned long new_hae)
+ * Change virtual addresses to physical addresses and vv.
+ */
+ #ifdef USE_48_BIT_KSEG
+-static inline unsigned long virt_to_phys(void *address)
++static inline unsigned long virt_to_phys(volatile void *address)
+ {
+ return (unsigned long)address - IDENT_ADDR;
+ }
+@@ -71,7 +71,7 @@ static inline void * phys_to_virt(unsigned long address)
+ return (void *) (address + IDENT_ADDR);
+ }
+ #else
+-static inline unsigned long virt_to_phys(void *address)
++static inline unsigned long virt_to_phys(volatile void *address)
+ {
+ unsigned long phys = (unsigned long)address;
+
+@@ -112,7 +112,7 @@ static inline dma_addr_t __deprecated isa_page_to_bus(struct page *page)
+ extern unsigned long __direct_map_base;
+ extern unsigned long __direct_map_size;
+
+-static inline unsigned long __deprecated virt_to_bus(void *address)
++static inline unsigned long __deprecated virt_to_bus(volatile void *address)
+ {
+ unsigned long phys = virt_to_phys(address);
+ unsigned long bus = phys + __direct_map_base;
+diff --git a/arch/arm/include/asm/ftrace.h b/arch/arm/include/asm/ftrace.h
+index 9e842ff41768c..faeb6b1c00897 100644
+--- a/arch/arm/include/asm/ftrace.h
++++ b/arch/arm/include/asm/ftrace.h
+@@ -19,6 +19,9 @@ struct dyn_arch_ftrace {
+ #ifdef CONFIG_OLD_MCOUNT
+ bool old_mcount;
+ #endif
++#ifdef CONFIG_ARM_MODULE_PLTS
++ struct module *mod;
++#endif
+ };
+
+ static inline unsigned long ftrace_call_adjust(unsigned long addr)
+diff --git a/arch/arm/include/asm/insn.h b/arch/arm/include/asm/insn.h
+index f20e08ac85aeb..5475cbf9fb6b4 100644
+--- a/arch/arm/include/asm/insn.h
++++ b/arch/arm/include/asm/insn.h
+@@ -13,18 +13,18 @@ arm_gen_nop(void)
+ }
+
+ unsigned long
+-__arm_gen_branch(unsigned long pc, unsigned long addr, bool link);
++__arm_gen_branch(unsigned long pc, unsigned long addr, bool link, bool warn);
+
+ static inline unsigned long
+ arm_gen_branch(unsigned long pc, unsigned long addr)
+ {
+- return __arm_gen_branch(pc, addr, false);
++ return __arm_gen_branch(pc, addr, false, true);
+ }
+
+ static inline unsigned long
+-arm_gen_branch_link(unsigned long pc, unsigned long addr)
++arm_gen_branch_link(unsigned long pc, unsigned long addr, bool warn)
+ {
+- return __arm_gen_branch(pc, addr, true);
++ return __arm_gen_branch(pc, addr, true, warn);
+ }
+
+ #endif
+diff --git a/arch/arm/include/asm/module.h b/arch/arm/include/asm/module.h
+index 9e81b7c498d8b..6b36656eed830 100644
+--- a/arch/arm/include/asm/module.h
++++ b/arch/arm/include/asm/module.h
+@@ -19,8 +19,18 @@ enum {
+ };
+ #endif
+
++#define PLT_ENT_STRIDE L1_CACHE_BYTES
++#define PLT_ENT_COUNT (PLT_ENT_STRIDE / sizeof(u32))
++#define PLT_ENT_SIZE (sizeof(struct plt_entries) / PLT_ENT_COUNT)
++
++struct plt_entries {
++ u32 ldr[PLT_ENT_COUNT];
++ u32 lit[PLT_ENT_COUNT];
++};
++
+ struct mod_plt_sec {
+ struct elf32_shdr *plt;
++ struct plt_entries *plt_ent;
+ int plt_count;
+ };
+
+diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c
+index ee673c09aa6c0..51839250e49a3 100644
+--- a/arch/arm/kernel/ftrace.c
++++ b/arch/arm/kernel/ftrace.c
+@@ -96,9 +96,10 @@ int ftrace_arch_code_modify_post_process(void)
+ return 0;
+ }
+
+-static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr)
++static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr,
++ bool warn)
+ {
+- return arm_gen_branch_link(pc, addr);
++ return arm_gen_branch_link(pc, addr, warn);
+ }
+
+ static int ftrace_modify_code(unsigned long pc, unsigned long old,
+@@ -137,14 +138,14 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
+ int ret;
+
+ pc = (unsigned long)&ftrace_call;
+- new = ftrace_call_replace(pc, (unsigned long)func);
++ new = ftrace_call_replace(pc, (unsigned long)func, true);
+
+ ret = ftrace_modify_code(pc, 0, new, false);
+
+ #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
+ if (!ret) {
+ pc = (unsigned long)&ftrace_regs_call;
+- new = ftrace_call_replace(pc, (unsigned long)func);
++ new = ftrace_call_replace(pc, (unsigned long)func, true);
+
+ ret = ftrace_modify_code(pc, 0, new, false);
+ }
+@@ -153,7 +154,7 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
+ #ifdef CONFIG_OLD_MCOUNT
+ if (!ret) {
+ pc = (unsigned long)&ftrace_call_old;
+- new = ftrace_call_replace(pc, (unsigned long)func);
++ new = ftrace_call_replace(pc, (unsigned long)func, true);
+
+ ret = ftrace_modify_code(pc, 0, new, false);
+ }
+@@ -166,10 +167,22 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+ {
+ unsigned long new, old;
+ unsigned long ip = rec->ip;
++ unsigned long aaddr = adjust_address(rec, addr);
++ struct module *mod = NULL;
++
++#ifdef CONFIG_ARM_MODULE_PLTS
++ mod = rec->arch.mod;
++#endif
+
+ old = ftrace_nop_replace(rec);
+
+- new = ftrace_call_replace(ip, adjust_address(rec, addr));
++ new = ftrace_call_replace(ip, aaddr, !mod);
++#ifdef CONFIG_ARM_MODULE_PLTS
++ if (!new && mod) {
++ aaddr = get_module_plt(mod, ip, aaddr);
++ new = ftrace_call_replace(ip, aaddr, true);
++ }
++#endif
+
+ return ftrace_modify_code(rec->ip, old, new, true);
+ }
+@@ -182,9 +195,9 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
+ unsigned long new, old;
+ unsigned long ip = rec->ip;
+
+- old = ftrace_call_replace(ip, adjust_address(rec, old_addr));
++ old = ftrace_call_replace(ip, adjust_address(rec, old_addr), true);
+
+- new = ftrace_call_replace(ip, adjust_address(rec, addr));
++ new = ftrace_call_replace(ip, adjust_address(rec, addr), true);
+
+ return ftrace_modify_code(rec->ip, old, new, true);
+ }
+@@ -194,12 +207,29 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
+ int ftrace_make_nop(struct module *mod,
+ struct dyn_ftrace *rec, unsigned long addr)
+ {
++ unsigned long aaddr = adjust_address(rec, addr);
+ unsigned long ip = rec->ip;
+ unsigned long old;
+ unsigned long new;
+ int ret;
+
+- old = ftrace_call_replace(ip, adjust_address(rec, addr));
++#ifdef CONFIG_ARM_MODULE_PLTS
++ /* mod is only supplied during module loading */
++ if (!mod)
++ mod = rec->arch.mod;
++ else
++ rec->arch.mod = mod;
++#endif
++
++ old = ftrace_call_replace(ip, aaddr,
++ !IS_ENABLED(CONFIG_ARM_MODULE_PLTS) || !mod);
++#ifdef CONFIG_ARM_MODULE_PLTS
++ if (!old && mod) {
++ aaddr = get_module_plt(mod, ip, aaddr);
++ old = ftrace_call_replace(ip, aaddr, true);
++ }
++#endif
++
+ new = ftrace_nop_replace(rec);
+ ret = ftrace_modify_code(ip, old, new, true);
+
+@@ -207,7 +237,7 @@ int ftrace_make_nop(struct module *mod,
+ if (ret == -EINVAL && addr == MCOUNT_ADDR) {
+ rec->arch.old_mcount = true;
+
+- old = ftrace_call_replace(ip, adjust_address(rec, addr));
++ old = ftrace_call_replace(ip, adjust_address(rec, addr), true);
+ new = ftrace_nop_replace(rec);
+ ret = ftrace_modify_code(ip, old, new, true);
+ }
+diff --git a/arch/arm/kernel/insn.c b/arch/arm/kernel/insn.c
+index 2e844b70386b3..db0acbb7d7a02 100644
+--- a/arch/arm/kernel/insn.c
++++ b/arch/arm/kernel/insn.c
+@@ -3,8 +3,9 @@
+ #include <linux/kernel.h>
+ #include <asm/opcodes.h>
+
+-static unsigned long
+-__arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link)
++static unsigned long __arm_gen_branch_thumb2(unsigned long pc,
++ unsigned long addr, bool link,
++ bool warn)
+ {
+ unsigned long s, j1, j2, i1, i2, imm10, imm11;
+ unsigned long first, second;
+@@ -12,7 +13,7 @@ __arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link)
+
+ offset = (long)addr - (long)(pc + 4);
+ if (offset < -16777216 || offset > 16777214) {
+- WARN_ON_ONCE(1);
++ WARN_ON_ONCE(warn);
+ return 0;
+ }
+
+@@ -33,8 +34,8 @@ __arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link)
+ return __opcode_thumb32_compose(first, second);
+ }
+
+-static unsigned long
+-__arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link)
++static unsigned long __arm_gen_branch_arm(unsigned long pc, unsigned long addr,
++ bool link, bool warn)
+ {
+ unsigned long opcode = 0xea000000;
+ long offset;
+@@ -44,7 +45,7 @@ __arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link)
+
+ offset = (long)addr - (long)(pc + 8);
+ if (unlikely(offset < -33554432 || offset > 33554428)) {
+- WARN_ON_ONCE(1);
++ WARN_ON_ONCE(warn);
+ return 0;
+ }
+
+@@ -54,10 +55,10 @@ __arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link)
+ }
+
+ unsigned long
+-__arm_gen_branch(unsigned long pc, unsigned long addr, bool link)
++__arm_gen_branch(unsigned long pc, unsigned long addr, bool link, bool warn)
+ {
+ if (IS_ENABLED(CONFIG_THUMB2_KERNEL))
+- return __arm_gen_branch_thumb2(pc, addr, link);
++ return __arm_gen_branch_thumb2(pc, addr, link, warn);
+ else
+- return __arm_gen_branch_arm(pc, addr, link);
++ return __arm_gen_branch_arm(pc, addr, link, warn);
+ }
+diff --git a/arch/arm/kernel/module-plts.c b/arch/arm/kernel/module-plts.c
+index 3d0c2e4dda1d2..ed0e09cc735f0 100644
+--- a/arch/arm/kernel/module-plts.c
++++ b/arch/arm/kernel/module-plts.c
+@@ -7,6 +7,7 @@
+ */
+
+ #include <linux/elf.h>
++#include <linux/ftrace.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/sort.h>
+@@ -14,10 +15,6 @@
+ #include <asm/cache.h>
+ #include <asm/opcodes.h>
+
+-#define PLT_ENT_STRIDE L1_CACHE_BYTES
+-#define PLT_ENT_COUNT (PLT_ENT_STRIDE / sizeof(u32))
+-#define PLT_ENT_SIZE (sizeof(struct plt_entries) / PLT_ENT_COUNT)
+-
+ #ifdef CONFIG_THUMB2_KERNEL
+ #define PLT_ENT_LDR __opcode_to_mem_thumb32(0xf8dff000 | \
+ (PLT_ENT_STRIDE - 4))
+@@ -26,9 +23,11 @@
+ (PLT_ENT_STRIDE - 8))
+ #endif
+
+-struct plt_entries {
+- u32 ldr[PLT_ENT_COUNT];
+- u32 lit[PLT_ENT_COUNT];
++static const u32 fixed_plts[] = {
++#ifdef CONFIG_DYNAMIC_FTRACE
++ FTRACE_ADDR,
++ MCOUNT_ADDR,
++#endif
+ };
+
+ static bool in_init(const struct module *mod, unsigned long loc)
+@@ -36,14 +35,40 @@ static bool in_init(const struct module *mod, unsigned long loc)
+ return loc - (u32)mod->init_layout.base < mod->init_layout.size;
+ }
+
++static void prealloc_fixed(struct mod_plt_sec *pltsec, struct plt_entries *plt)
++{
++ int i;
++
++ if (!ARRAY_SIZE(fixed_plts) || pltsec->plt_count)
++ return;
++ pltsec->plt_count = ARRAY_SIZE(fixed_plts);
++
++ for (i = 0; i < ARRAY_SIZE(plt->ldr); ++i)
++ plt->ldr[i] = PLT_ENT_LDR;
++
++ BUILD_BUG_ON(sizeof(fixed_plts) > sizeof(plt->lit));
++ memcpy(plt->lit, fixed_plts, sizeof(fixed_plts));
++}
++
+ u32 get_module_plt(struct module *mod, unsigned long loc, Elf32_Addr val)
+ {
+ struct mod_plt_sec *pltsec = !in_init(mod, loc) ? &mod->arch.core :
+ &mod->arch.init;
++ struct plt_entries *plt;
++ int idx;
++
++ /* cache the address, ELF header is available only during module load */
++ if (!pltsec->plt_ent)
++ pltsec->plt_ent = (struct plt_entries *)pltsec->plt->sh_addr;
++ plt = pltsec->plt_ent;
+
+- struct plt_entries *plt = (struct plt_entries *)pltsec->plt->sh_addr;
+- int idx = 0;
++ prealloc_fixed(pltsec, plt);
++
++ for (idx = 0; idx < ARRAY_SIZE(fixed_plts); ++idx)
++ if (plt->lit[idx] == val)
++ return (u32)&plt->ldr[idx];
+
++ idx = 0;
+ /*
+ * Look for an existing entry pointing to 'val'. Given that the
+ * relocations are sorted, this will be the last entry we allocated.
+@@ -191,8 +216,8 @@ static unsigned int count_plts(const Elf32_Sym *syms, Elf32_Addr base,
+ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
+ char *secstrings, struct module *mod)
+ {
+- unsigned long core_plts = 0;
+- unsigned long init_plts = 0;
++ unsigned long core_plts = ARRAY_SIZE(fixed_plts);
++ unsigned long init_plts = ARRAY_SIZE(fixed_plts);
+ Elf32_Shdr *s, *sechdrs_end = sechdrs + ehdr->e_shnum;
+ Elf32_Sym *syms = NULL;
+
+@@ -247,6 +272,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
+ mod->arch.core.plt->sh_size = round_up(core_plts * PLT_ENT_SIZE,
+ sizeof(struct plt_entries));
+ mod->arch.core.plt_count = 0;
++ mod->arch.core.plt_ent = NULL;
+
+ mod->arch.init.plt->sh_type = SHT_NOBITS;
+ mod->arch.init.plt->sh_flags = SHF_EXECINSTR | SHF_ALLOC;
+@@ -254,6 +280,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
+ mod->arch.init.plt->sh_size = round_up(init_plts * PLT_ENT_SIZE,
+ sizeof(struct plt_entries));
+ mod->arch.init.plt_count = 0;
++ mod->arch.init.plt_ent = NULL;
+
+ pr_debug("%s: plt=%x, init.plt=%x\n", __func__,
+ mod->arch.core.plt->sh_size, mod->arch.init.plt->sh_size);
+diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+index 1844fb8605f03..fca78eb334b19 100644
+--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+@@ -376,8 +376,15 @@
+ #interrupt-cells = <1>;
+ msi-parent = <&pcie0>;
+ msi-controller;
+- ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x1000000 /* Port 0 MEM */
+- 0x81000000 0 0xe9000000 0 0xe9000000 0 0x10000>; /* Port 0 IO*/
++ /*
++ * The 128 MiB address range [0xe8000000-0xf0000000] is
++ * dedicated for PCIe and can be assigned to 8 windows
++ * with size a power of two. Use one 64 KiB window for
++ * IO at the end and the remaining seven windows
++ * (totaling 127 MiB) for MEM.
++ */
++ ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x07f00000 /* Port 0 MEM */
++ 0x81000000 0 0xefff0000 0 0xefff0000 0 0x00010000>; /* Port 0 IO */
+ interrupt-map-mask = <0 0 0 7>;
+ interrupt-map = <0 0 0 1 &pcie_intc 0>,
+ <0 0 0 2 &pcie_intc 1>,
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
+index d6a49bb07a5f5..1945b8096a06a 100644
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -61,7 +61,7 @@
+
+ #ifdef CONFIG_STACKPROTECTOR
+ #include <linux/stackprotector.h>
+-unsigned long __stack_chk_guard __read_mostly;
++unsigned long __stack_chk_guard __ro_after_init;
+ EXPORT_SYMBOL(__stack_chk_guard);
+ #endif
+
+diff --git a/arch/m68k/include/asm/raw_io.h b/arch/m68k/include/asm/raw_io.h
+index 85761255dde5a..6a03aef53980b 100644
+--- a/arch/m68k/include/asm/raw_io.h
++++ b/arch/m68k/include/asm/raw_io.h
+@@ -17,21 +17,21 @@
+ * two accesses to memory, which may be undesirable for some devices.
+ */
+ #define in_8(addr) \
+- ({ u8 __v = (*(__force volatile u8 *) (addr)); __v; })
++ ({ u8 __v = (*(__force volatile u8 *) (unsigned long)(addr)); __v; })
+ #define in_be16(addr) \
+- ({ u16 __v = (*(__force volatile u16 *) (addr)); __v; })
++ ({ u16 __v = (*(__force volatile u16 *) (unsigned long)(addr)); __v; })
+ #define in_be32(addr) \
+- ({ u32 __v = (*(__force volatile u32 *) (addr)); __v; })
++ ({ u32 __v = (*(__force volatile u32 *) (unsigned long)(addr)); __v; })
+ #define in_le16(addr) \
+- ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (addr)); __v; })
++ ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (unsigned long)(addr)); __v; })
+ #define in_le32(addr) \
+- ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (addr)); __v; })
++ ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (unsigned long)(addr)); __v; })
+
+-#define out_8(addr,b) (void)((*(__force volatile u8 *) (addr)) = (b))
+-#define out_be16(addr,w) (void)((*(__force volatile u16 *) (addr)) = (w))
+-#define out_be32(addr,l) (void)((*(__force volatile u32 *) (addr)) = (l))
+-#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (addr)) = cpu_to_le16(w))
+-#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (addr)) = cpu_to_le32(l))
++#define out_8(addr,b) (void)((*(__force volatile u8 *) (unsigned long)(addr)) = (b))
++#define out_be16(addr,w) (void)((*(__force volatile u16 *) (unsigned long)(addr)) = (w))
++#define out_be32(addr,l) (void)((*(__force volatile u32 *) (unsigned long)(addr)) = (l))
++#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (unsigned long)(addr)) = cpu_to_le16(w))
++#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (unsigned long)(addr)) = cpu_to_le32(l))
+
+ #define raw_inb in_8
+ #define raw_inw in_be16
+diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
+index af00fe9bf8465..c631a8fd856a3 100644
+--- a/arch/parisc/include/asm/page.h
++++ b/arch/parisc/include/asm/page.h
+@@ -179,7 +179,7 @@ extern int npmem_ranges;
+ #include <asm-generic/getorder.h>
+ #include <asm/pdc.h>
+
+-#define PAGE0 ((struct zeropage *)__PAGE_OFFSET)
++#define PAGE0 ((struct zeropage *)absolute_pointer(__PAGE_OFFSET))
+
+ /* DEFINITION OF THE ZERO-PAGE (PAG0) */
+ /* based on work by Jason Eckhardt (jason@equator.com) */
+diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c
+index 51028abe5e903..ecec6a616e0d7 100644
+--- a/arch/sparc/kernel/mdesc.c
++++ b/arch/sparc/kernel/mdesc.c
+@@ -40,6 +40,7 @@ struct mdesc_hdr {
+ u32 node_sz; /* node block size */
+ u32 name_sz; /* name block size */
+ u32 data_sz; /* data block size */
++ char data[];
+ } __attribute__((aligned(16)));
+
+ struct mdesc_elem {
+@@ -613,7 +614,7 @@ EXPORT_SYMBOL(mdesc_get_node_info);
+
+ static struct mdesc_elem *node_block(struct mdesc_hdr *mdesc)
+ {
+- return (struct mdesc_elem *) (mdesc + 1);
++ return (struct mdesc_elem *) mdesc->data;
+ }
+
+ static void *name_block(struct mdesc_hdr *mdesc)
+diff --git a/arch/x86/include/asm/kvmclock.h b/arch/x86/include/asm/kvmclock.h
+index eceea92990974..6c57651921028 100644
+--- a/arch/x86/include/asm/kvmclock.h
++++ b/arch/x86/include/asm/kvmclock.h
+@@ -2,6 +2,20 @@
+ #ifndef _ASM_X86_KVM_CLOCK_H
+ #define _ASM_X86_KVM_CLOCK_H
+
++#include <linux/percpu.h>
++
+ extern struct clocksource kvm_clock;
+
++DECLARE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
++
++static inline struct pvclock_vcpu_time_info *this_cpu_pvti(void)
++{
++ return &this_cpu_read(hv_clock_per_cpu)->pvti;
++}
++
++static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock(void)
++{
++ return this_cpu_read(hv_clock_per_cpu);
++}
++
+ #endif /* _ASM_X86_KVM_CLOCK_H */
+diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
+index 2ec202cb9dfd4..6752d3768d778 100644
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -64,18 +64,9 @@ early_param("no-kvmclock-vsyscall", parse_no_kvmclock_vsyscall);
+ static struct pvclock_vsyscall_time_info
+ hv_clock_boot[HVC_BOOT_ARRAY_SIZE] __bss_decrypted __aligned(PAGE_SIZE);
+ static struct pvclock_wall_clock wall_clock __bss_decrypted;
+-static DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
+ static struct pvclock_vsyscall_time_info *hvclock_mem;
+-
+-static inline struct pvclock_vcpu_time_info *this_cpu_pvti(void)
+-{
+- return &this_cpu_read(hv_clock_per_cpu)->pvti;
+-}
+-
+-static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock(void)
+-{
+- return this_cpu_read(hv_clock_per_cpu);
+-}
++DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
++EXPORT_PER_CPU_SYMBOL_GPL(hv_clock_per_cpu);
+
+ /*
+ * The wallclock is the time of day when we booted. Since then, some time may
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 7966136352b56..8f1ff8dad2cec 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -720,8 +720,8 @@ static void xen_write_idt_entry(gate_desc *dt, int entrynum, const gate_desc *g)
+ preempt_enable();
+ }
+
+-static void xen_convert_trap_info(const struct desc_ptr *desc,
+- struct trap_info *traps)
++static unsigned xen_convert_trap_info(const struct desc_ptr *desc,
++ struct trap_info *traps, bool full)
+ {
+ unsigned in, out, count;
+
+@@ -731,17 +731,18 @@ static void xen_convert_trap_info(const struct desc_ptr *desc,
+ for (in = out = 0; in < count; in++) {
+ gate_desc *entry = (gate_desc *)(desc->address) + in;
+
+- if (cvt_gate_to_trap(in, entry, &traps[out]))
++ if (cvt_gate_to_trap(in, entry, &traps[out]) || full)
+ out++;
+ }
+- traps[out].address = 0;
++
++ return out;
+ }
+
+ void xen_copy_trap_info(struct trap_info *traps)
+ {
+ const struct desc_ptr *desc = this_cpu_ptr(&idt_desc);
+
+- xen_convert_trap_info(desc, traps);
++ xen_convert_trap_info(desc, traps, true);
+ }
+
+ /* Load a new IDT into Xen. In principle this can be per-CPU, so we
+@@ -751,6 +752,7 @@ static void xen_load_idt(const struct desc_ptr *desc)
+ {
+ static DEFINE_SPINLOCK(lock);
+ static struct trap_info traps[257];
++ unsigned out;
+
+ trace_xen_cpu_load_idt(desc);
+
+@@ -758,7 +760,8 @@ static void xen_load_idt(const struct desc_ptr *desc)
+
+ memcpy(this_cpu_ptr(&idt_desc), desc, sizeof(idt_desc));
+
+- xen_convert_trap_info(desc, traps);
++ out = xen_convert_trap_info(desc, traps, false);
++ memset(&traps[out], 0, sizeof(traps[0]));
+
+ xen_mc_flush();
+ if (HYPERVISOR_set_trap_table(traps))
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index c8c94e8e0f721..b2bad345c523f 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2137,15 +2137,6 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
+ * are likely to increase the throughput.
+ */
+ bfqq->new_bfqq = new_bfqq;
+- /*
+- * The above assignment schedules the following redirections:
+- * each time some I/O for bfqq arrives, the process that
+- * generated that I/O is disassociated from bfqq and
+- * associated with new_bfqq. Here we increases new_bfqq->ref
+- * in advance, adding the number of processes that are
+- * expected to be associated with new_bfqq as they happen to
+- * issue I/O.
+- */
+ new_bfqq->ref += process_refs;
+ return new_bfqq;
+ }
+@@ -2205,10 +2196,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ {
+ struct bfq_queue *in_service_bfqq, *new_bfqq;
+
+- /* if a merge has already been setup, then proceed with that first */
+- if (bfqq->new_bfqq)
+- return bfqq->new_bfqq;
+-
+ /*
+ * Prevent bfqq from being merged if it has been created too
+ * long ago. The idea is that true cooperating processes, and
+@@ -2223,6 +2210,9 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ if (bfq_too_late_for_merging(bfqq))
+ return NULL;
+
++ if (bfqq->new_bfqq)
++ return bfqq->new_bfqq;
++
+ if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
+ return NULL;
+
+diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c
+index 52841f807a7eb..45fdf30cade39 100644
+--- a/drivers/cpufreq/cpufreq_governor_attr_set.c
++++ b/drivers/cpufreq/cpufreq_governor_attr_set.c
+@@ -77,8 +77,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l
+ if (count)
+ return count;
+
+- kobject_put(&attr_set->kobj);
+ mutex_destroy(&attr_set->update_lock);
++ kobject_put(&attr_set->kobj);
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(gov_attr_set_put);
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 20ca9c9e109e0..453d27d2a4ffa 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -783,7 +783,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ in_place ? DMA_BIDIRECTIONAL
+ : DMA_TO_DEVICE);
+ if (ret)
+- goto e_ctx;
++ goto e_aad;
+
+ if (in_place) {
+ dst = src;
+@@ -868,7 +868,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ op.u.aes.size = 0;
+ ret = cmd_q->ccp->vdata->perform->aes(&op);
+ if (ret)
+- goto e_dst;
++ goto e_final_wa;
+
+ if (aes->action == CCP_AES_ACTION_ENCRYPT) {
+ /* Put the ciphered tag after the ciphertext. */
+@@ -878,17 +878,19 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ ret = ccp_init_dm_workarea(&tag, cmd_q, authsize,
+ DMA_BIDIRECTIONAL);
+ if (ret)
+- goto e_tag;
++ goto e_final_wa;
+ ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize);
+- if (ret)
+- goto e_tag;
++ if (ret) {
++ ccp_dm_free(&tag);
++ goto e_final_wa;
++ }
+
+ ret = crypto_memneq(tag.address, final_wa.address,
+ authsize) ? -EBADMSG : 0;
+ ccp_dm_free(&tag);
+ }
+
+-e_tag:
++e_final_wa:
+ ccp_dm_free(&final_wa);
+
+ e_dst:
+diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c
+index 0c9c59e2b5a3f..ba9de54a701e2 100644
+--- a/drivers/edac/synopsys_edac.c
++++ b/drivers/edac/synopsys_edac.c
+@@ -371,7 +371,7 @@ static int synps_edac_init_csrows(struct mem_ctl_info *mci)
+
+ for (j = 0; j < csi->nr_channels; j++) {
+ dimm = csi->channels[j]->dimm;
+- dimm->edac_mode = EDAC_FLAG_SECDED;
++ dimm->edac_mode = EDAC_SECDED;
+ dimm->mtype = synps_edac_get_mtype(priv->baseaddr);
+ dimm->nr_pages = (size >> PAGE_SHIFT) / csi->nr_channels;
+ dimm->grain = SYNPS_EDAC_ERR_GRAIN;
+diff --git a/drivers/fpga/machxo2-spi.c b/drivers/fpga/machxo2-spi.c
+index a582e0000c97a..fa76239f979be 100644
+--- a/drivers/fpga/machxo2-spi.c
++++ b/drivers/fpga/machxo2-spi.c
+@@ -223,8 +223,10 @@ static int machxo2_write_init(struct fpga_manager *mgr,
+ goto fail;
+
+ get_status(spi, &status);
+- if (test_bit(FAIL, &status))
++ if (test_bit(FAIL, &status)) {
++ ret = -EINVAL;
+ goto fail;
++ }
+ dump_status_reg(&status);
+
+ spi_message_init(&msg);
+@@ -310,6 +312,7 @@ static int machxo2_write_complete(struct fpga_manager *mgr,
+ dump_status_reg(&status);
+ if (!test_bit(DONE, &status)) {
+ machxo2_cleanup(mgr);
++ ret = -EINVAL;
+ goto fail;
+ }
+
+@@ -331,6 +334,7 @@ static int machxo2_write_complete(struct fpga_manager *mgr,
+ break;
+ if (++refreshloop == MACHXO2_MAX_REFRESH_LOOP) {
+ machxo2_cleanup(mgr);
++ ret = -EINVAL;
+ goto fail;
+ }
+ } while (1);
+diff --git a/drivers/gpio/gpio-uniphier.c b/drivers/gpio/gpio-uniphier.c
+index 7fdac90609798..c72ec3ddf90b7 100644
+--- a/drivers/gpio/gpio-uniphier.c
++++ b/drivers/gpio/gpio-uniphier.c
+@@ -197,7 +197,7 @@ static void uniphier_gpio_irq_mask(struct irq_data *data)
+
+ uniphier_gpio_reg_update(priv, UNIPHIER_GPIO_IRQ_EN, mask, 0);
+
+- return irq_chip_mask_parent(data);
++ irq_chip_mask_parent(data);
+ }
+
+ static void uniphier_gpio_irq_unmask(struct irq_data *data)
+@@ -207,7 +207,7 @@ static void uniphier_gpio_irq_unmask(struct irq_data *data)
+
+ uniphier_gpio_reg_update(priv, UNIPHIER_GPIO_IRQ_EN, mask, mask);
+
+- return irq_chip_unmask_parent(data);
++ irq_chip_unmask_parent(data);
+ }
+
+ static int uniphier_gpio_irq_set_type(struct irq_data *data, unsigned int type)
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 62a2f0491117d..ed02bb6b2cd07 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -412,6 +412,7 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
+
+ init_data.asic_id.pci_revision_id = adev->rev_id;
+ init_data.asic_id.hw_internal_rev = adev->external_rev_id;
++ init_data.asic_id.chip_id = adev->pdev->device;
+
+ init_data.asic_id.vram_width = adev->gmc.vram_width;
+ /* TODO: initialize init_data.asic_id.vram_type here!!!! */
+diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c
+index 69cfc8dc6af1e..9b60efe6ec441 100644
+--- a/drivers/hid/hid-betopff.c
++++ b/drivers/hid/hid-betopff.c
+@@ -59,15 +59,22 @@ static int betopff_init(struct hid_device *hid)
+ {
+ struct betopff_device *betopff;
+ struct hid_report *report;
+- struct hid_input *hidinput =
+- list_first_entry(&hid->inputs, struct hid_input, list);
++ struct hid_input *hidinput;
+ struct list_head *report_list =
+ &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+- struct input_dev *dev = hidinput->input;
++ struct input_dev *dev;
+ int field_count = 0;
+ int error;
+ int i, j;
+
++ if (list_empty(&hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
++
++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
++ dev = hidinput->input;
++
+ if (list_empty(report_list)) {
+ hid_err(hid, "no output reports found\n");
+ return -ENODEV;
+diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
+index 6b6db57b49d69..e28227040c64c 100644
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -506,7 +506,7 @@ static void hid_ctrl(struct urb *urb)
+
+ if (unplug) {
+ usbhid->ctrltail = usbhid->ctrlhead;
+- } else {
++ } else if (usbhid->ctrlhead != usbhid->ctrltail) {
+ usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);
+
+ if (usbhid->ctrlhead != usbhid->ctrltail &&
+@@ -1224,9 +1224,20 @@ static void usbhid_stop(struct hid_device *hid)
+ mutex_lock(&usbhid->mutex);
+
+ clear_bit(HID_STARTED, &usbhid->iofl);
++
+ spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */
+ set_bit(HID_DISCONNECTED, &usbhid->iofl);
++ while (usbhid->ctrltail != usbhid->ctrlhead) {
++ if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) {
++ kfree(usbhid->ctrl[usbhid->ctrltail].raw_report);
++ usbhid->ctrl[usbhid->ctrltail].raw_report = NULL;
++ }
++
++ usbhid->ctrltail = (usbhid->ctrltail + 1) &
++ (HID_CONTROL_FIFO_SIZE - 1);
++ }
+ spin_unlock_irq(&usbhid->lock);
++
+ usb_kill_urb(usbhid->urbin);
+ usb_kill_urb(usbhid->urbout);
+ usb_kill_urb(usbhid->urbctrl);
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index d8fa4bea4bc84..e57b0c5119ce4 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -307,8 +307,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ {
+ struct mlxreg_fan *fan = cdev->devdata;
+ unsigned long cur_state;
++ int i, config = 0;
+ u32 regval;
+- int i;
+ int err;
+
+ /*
+@@ -321,6 +321,12 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ * overwritten.
+ */
+ if (state >= MLXREG_FAN_SPEED_MIN && state <= MLXREG_FAN_SPEED_MAX) {
++ /*
++ * This is configuration change, which is only supported through sysfs.
++ * For configuration non-zero value is to be returned to avoid thermal
++ * statistics update.
++ */
++ config = 1;
+ state -= MLXREG_FAN_MAX_STATE;
+ for (i = 0; i < state; i++)
+ fan->cooling_levels[i] = state;
+@@ -335,7 +341,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+
+ cur_state = MLXREG_FAN_PWM_DUTY2STATE(regval);
+ if (state < cur_state)
+- return 0;
++ return config;
+
+ state = cur_state;
+ }
+@@ -351,7 +357,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ dev_err(fan->dev, "Failed to write PWM duty\n");
+ return err;
+ }
+- return 0;
++ return config;
+ }
+
+ static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
+diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
+index ceb3db6f3fdda..cdd01a8483011 100644
+--- a/drivers/hwmon/tmp421.c
++++ b/drivers/hwmon/tmp421.c
+@@ -109,23 +109,17 @@ struct tmp421_data {
+ s16 temp[4];
+ };
+
+-static int temp_from_s16(s16 reg)
++static int temp_from_raw(u16 reg, bool extended)
+ {
+ /* Mask out status bits */
+ int temp = reg & ~0xf;
+
+- return (temp * 1000 + 128) / 256;
+-}
+-
+-static int temp_from_u16(u16 reg)
+-{
+- /* Mask out status bits */
+- int temp = reg & ~0xf;
+-
+- /* Add offset for extended temperature range. */
+- temp -= 64 * 256;
++ if (extended)
++ temp = temp - 64 * 256;
++ else
++ temp = (s16)temp;
+
+- return (temp * 1000 + 128) / 256;
++ return DIV_ROUND_CLOSEST(temp * 1000, 256);
+ }
+
+ static struct tmp421_data *tmp421_update_device(struct device *dev)
+@@ -162,17 +156,15 @@ static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,
+
+ switch (attr) {
+ case hwmon_temp_input:
+- if (tmp421->config & TMP421_CONFIG_RANGE)
+- *val = temp_from_u16(tmp421->temp[channel]);
+- else
+- *val = temp_from_s16(tmp421->temp[channel]);
++ *val = temp_from_raw(tmp421->temp[channel],
++ tmp421->config & TMP421_CONFIG_RANGE);
+ return 0;
+ case hwmon_temp_fault:
+ /*
+- * The OPEN bit signals a fault. This is bit 0 of the temperature
+- * register (low byte).
++ * Any of OPEN or /PVLD bits indicate a hardware mulfunction
++ * and the conversion result may be incorrect
+ */
+- *val = tmp421->temp[channel] & 0x01;
++ *val = !!(tmp421->temp[channel] & 0x03);
+ return 0;
+ default:
+ return -EOPNOTSUPP;
+@@ -185,11 +177,8 @@ static umode_t tmp421_is_visible(const void *data, enum hwmon_sensor_types type,
+ {
+ switch (attr) {
+ case hwmon_temp_fault:
+- if (channel == 0)
+- return 0;
+- return S_IRUGO;
+ case hwmon_temp_input:
+- return S_IRUGO;
++ return 0444;
+ default:
+ return 0;
+ }
+diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c
+index 75dd15d66df6f..f558aeb8f8884 100644
+--- a/drivers/ipack/devices/ipoctal.c
++++ b/drivers/ipack/devices/ipoctal.c
+@@ -38,6 +38,7 @@ struct ipoctal_channel {
+ unsigned int pointer_read;
+ unsigned int pointer_write;
+ struct tty_port tty_port;
++ bool tty_registered;
+ union scc2698_channel __iomem *regs;
+ union scc2698_block __iomem *block_regs;
+ unsigned int board_id;
+@@ -86,22 +87,34 @@ static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty)
+ return 0;
+ }
+
+-static int ipoctal_open(struct tty_struct *tty, struct file *file)
++static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty)
+ {
+ struct ipoctal_channel *channel = dev_get_drvdata(tty->dev);
+ struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index);
+- int err;
+-
+- tty->driver_data = channel;
++ int res;
+
+ if (!ipack_get_carrier(ipoctal->dev))
+ return -EBUSY;
+
+- err = tty_port_open(&channel->tty_port, tty, file);
+- if (err)
+- ipack_put_carrier(ipoctal->dev);
++ res = tty_standard_install(driver, tty);
++ if (res)
++ goto err_put_carrier;
++
++ tty->driver_data = channel;
++
++ return 0;
++
++err_put_carrier:
++ ipack_put_carrier(ipoctal->dev);
++
++ return res;
++}
++
++static int ipoctal_open(struct tty_struct *tty, struct file *file)
++{
++ struct ipoctal_channel *channel = tty->driver_data;
+
+- return err;
++ return tty_port_open(&channel->tty_port, tty, file);
+ }
+
+ static void ipoctal_reset_stats(struct ipoctal_stats *stats)
+@@ -269,7 +282,6 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
+ int res;
+ int i;
+ struct tty_driver *tty;
+- char name[20];
+ struct ipoctal_channel *channel;
+ struct ipack_region *region;
+ void __iomem *addr;
+@@ -360,8 +372,11 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
+ /* Fill struct tty_driver with ipoctal data */
+ tty->owner = THIS_MODULE;
+ tty->driver_name = KBUILD_MODNAME;
+- sprintf(name, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
+- tty->name = name;
++ tty->name = kasprintf(GFP_KERNEL, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
++ if (!tty->name) {
++ res = -ENOMEM;
++ goto err_put_driver;
++ }
+ tty->major = 0;
+
+ tty->minor_start = 0;
+@@ -377,8 +392,7 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
+ res = tty_register_driver(tty);
+ if (res) {
+ dev_err(&ipoctal->dev->dev, "Can't register tty driver.\n");
+- put_tty_driver(tty);
+- return res;
++ goto err_free_name;
+ }
+
+ /* Save struct tty_driver for use it when uninstalling the device */
+@@ -389,7 +403,9 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
+
+ channel = &ipoctal->channel[i];
+ tty_port_init(&channel->tty_port);
+- tty_port_alloc_xmit_buf(&channel->tty_port);
++ res = tty_port_alloc_xmit_buf(&channel->tty_port);
++ if (res)
++ continue;
+ channel->tty_port.ops = &ipoctal_tty_port_ops;
+
+ ipoctal_reset_stats(&channel->stats);
+@@ -397,13 +413,15 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
+ spin_lock_init(&channel->lock);
+ channel->pointer_read = 0;
+ channel->pointer_write = 0;
+- tty_dev = tty_port_register_device(&channel->tty_port, tty, i, NULL);
++ tty_dev = tty_port_register_device_attr(&channel->tty_port, tty,
++ i, NULL, channel, NULL);
+ if (IS_ERR(tty_dev)) {
+ dev_err(&ipoctal->dev->dev, "Failed to register tty device.\n");
++ tty_port_free_xmit_buf(&channel->tty_port);
+ tty_port_destroy(&channel->tty_port);
+ continue;
+ }
+- dev_set_drvdata(tty_dev, channel);
++ channel->tty_registered = true;
+ }
+
+ /*
+@@ -415,6 +433,13 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
+ ipoctal_irq_handler, ipoctal);
+
+ return 0;
++
++err_free_name:
++ kfree(tty->name);
++err_put_driver:
++ put_tty_driver(tty);
++
++ return res;
+ }
+
+ static inline int ipoctal_copy_write_buffer(struct ipoctal_channel *channel,
+@@ -655,6 +680,7 @@ static void ipoctal_cleanup(struct tty_struct *tty)
+
+ static const struct tty_operations ipoctal_fops = {
+ .ioctl = NULL,
++ .install = ipoctal_install,
+ .open = ipoctal_open,
+ .close = ipoctal_close,
+ .write = ipoctal_write_tty,
+@@ -697,12 +723,17 @@ static void __ipoctal_remove(struct ipoctal *ipoctal)
+
+ for (i = 0; i < NR_CHANNELS; i++) {
+ struct ipoctal_channel *channel = &ipoctal->channel[i];
++
++ if (!channel->tty_registered)
++ continue;
++
+ tty_unregister_device(ipoctal->tty_drv, i);
+ tty_port_free_xmit_buf(&channel->tty_port);
+ tty_port_destroy(&channel->tty_port);
+ }
+
+ tty_unregister_driver(ipoctal->tty_drv);
++ kfree(ipoctal->tty_drv->name);
+ put_tty_driver(ipoctal->tty_drv);
+ kfree(ipoctal);
+ }
+diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
+index 8cb6800dbdfb7..9d3812cd668eb 100644
+--- a/drivers/irqchip/Kconfig
++++ b/drivers/irqchip/Kconfig
+@@ -357,6 +357,7 @@ config MESON_IRQ_GPIO
+ config GOLDFISH_PIC
+ bool "Goldfish programmable interrupt controller"
+ depends on MIPS && (GOLDFISH || COMPILE_TEST)
++ select GENERIC_IRQ_CHIP
+ select IRQ_DOMAIN
+ help
+ Say yes here to enable Goldfish interrupt controller driver used
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index cd58c123f547e..b55dff1aa50b3 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2996,7 +2996,7 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq
+
+ if (err) {
+ if (i > 0)
+- its_vpe_irq_domain_free(domain, virq, i - 1);
++ its_vpe_irq_domain_free(domain, virq, i);
+
+ its_lpi_free(bitmap, base, nr_ids);
+ its_free_prop_table(vprop_page);
+diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
+index bb5c5692dedc5..118d27ee31c2f 100644
+--- a/drivers/mcb/mcb-core.c
++++ b/drivers/mcb/mcb-core.c
+@@ -280,8 +280,8 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier)
+
+ bus_nr = ida_simple_get(&mcb_ida, 0, 0, GFP_KERNEL);
+ if (bus_nr < 0) {
+- rc = bus_nr;
+- goto err_free;
++ kfree(bus);
++ return ERR_PTR(bus_nr);
+ }
+
+ bus->bus_nr = bus_nr;
+@@ -296,12 +296,12 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier)
+ dev_set_name(&bus->dev, "mcb:%d", bus_nr);
+ rc = device_add(&bus->dev);
+ if (rc)
+- goto err_free;
++ goto err_put;
+
+ return bus;
+-err_free:
+- put_device(carrier);
+- kfree(bus);
++
++err_put:
++ put_device(&bus->dev);
+ return ERR_PTR(rc);
+ }
+ EXPORT_SYMBOL_GPL(mcb_alloc_bus);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index fae6a983ceee1..7e0477e883c7b 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5401,10 +5401,6 @@ static int md_alloc(dev_t dev, char *name)
+ */
+ disk->flags |= GENHD_FL_EXT_DEVT;
+ mddev->gendisk = disk;
+- /* As soon as we call add_disk(), another thread could get
+- * through to md_open, so make sure it doesn't get too far
+- */
+- mutex_lock(&mddev->open_mutex);
+ add_disk(disk);
+
+ error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
+@@ -5419,7 +5415,6 @@ static int md_alloc(dev_t dev, char *name)
+ if (mddev->kobj.sd &&
+ sysfs_create_group(&mddev->kobj, &md_bitmap_group))
+ pr_debug("pointless warning\n");
+- mutex_unlock(&mddev->open_mutex);
+ abort:
+ mutex_unlock(&disks_mutex);
+ if (!error && mddev->kobj.sd) {
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 55827ac65a154..5e30299bcf646 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -294,7 +294,7 @@ static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp,
+ * netif_tx_queue_stopped().
+ */
+ smp_mb();
+- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) {
++ if (bnxt_tx_avail(bp, txr) >= bp->tx_wake_thresh) {
+ netif_tx_wake_queue(txq);
+ return false;
+ }
+@@ -625,7 +625,7 @@ next_tx_int:
+ smp_mb();
+
+ if (unlikely(netif_tx_queue_stopped(txq)) &&
+- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh &&
++ bnxt_tx_avail(bp, txr) >= bp->tx_wake_thresh &&
+ READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING)
+ netif_tx_wake_queue(txq);
+ }
+@@ -1909,7 +1909,7 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget)
+ if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) {
+ tx_pkts++;
+ /* return full budget so NAPI will complete. */
+- if (unlikely(tx_pkts > bp->tx_wake_thresh)) {
++ if (unlikely(tx_pkts >= bp->tx_wake_thresh)) {
+ rx_pkts = budget;
+ raw_cons = NEXT_RAW_CMP(raw_cons);
+ break;
+@@ -2712,7 +2712,7 @@ static int bnxt_init_tx_rings(struct bnxt *bp)
+ u16 i;
+
+ bp->tx_wake_thresh = max_t(int, bp->tx_ring_size / 2,
+- MAX_SKB_FRAGS + 1);
++ BNXT_MIN_TX_DESC_CNT);
+
+ for (i = 0; i < bp->tx_nr_rings; i++) {
+ struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index f3f5484c43e4a..5c1c3a0ed9285 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -484,6 +484,11 @@ struct rx_tpa_end_cmp_ext {
+ #define BNXT_MAX_RX_JUM_DESC_CNT (RX_DESC_CNT * MAX_RX_AGG_PAGES - 1)
+ #define BNXT_MAX_TX_DESC_CNT (TX_DESC_CNT * MAX_TX_PAGES - 1)
+
++/* Minimum TX BDs for a TX packet with MAX_SKB_FRAGS + 1. We need one extra
++ * BD because the first TX BD is always a long BD.
++ */
++#define BNXT_MIN_TX_DESC_CNT (MAX_SKB_FRAGS + 2)
++
+ #define RX_RING(x) (((x) & ~(RX_DESC_CNT - 1)) >> (BNXT_PAGE_SHIFT - 4))
+ #define RX_IDX(x) ((x) & (RX_DESC_CNT - 1))
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 511240e8246f0..e75a47a9f5119 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -446,7 +446,7 @@ static int bnxt_set_ringparam(struct net_device *dev,
+
+ if ((ering->rx_pending > BNXT_MAX_RX_DESC_CNT) ||
+ (ering->tx_pending > BNXT_MAX_TX_DESC_CNT) ||
+- (ering->tx_pending <= MAX_SKB_FRAGS))
++ (ering->tx_pending < BNXT_MIN_TX_DESC_CNT))
+ return -EINVAL;
+
+ if (netif_running(dev))
+diff --git a/drivers/net/ethernet/cadence/macb_pci.c b/drivers/net/ethernet/cadence/macb_pci.c
+index 248a8fc450691..f06fddf9919bf 100644
+--- a/drivers/net/ethernet/cadence/macb_pci.c
++++ b/drivers/net/ethernet/cadence/macb_pci.c
+@@ -123,9 +123,9 @@ static void macb_remove(struct pci_dev *pdev)
+ struct platform_device *plat_dev = pci_get_drvdata(pdev);
+ struct macb_platform_data *plat_data = dev_get_platdata(&plat_dev->dev);
+
+- platform_device_unregister(plat_dev);
+ clk_unregister(plat_data->pclk);
+ clk_unregister(plat_data->hclk);
++ platform_device_unregister(plat_dev);
+ }
+
+ static const struct pci_device_id dev_id_table[] = {
+diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c
+index d719668a6684a..8efcec305fc54 100644
+--- a/drivers/net/ethernet/i825xx/82596.c
++++ b/drivers/net/ethernet/i825xx/82596.c
+@@ -1155,7 +1155,7 @@ struct net_device * __init i82596_probe(int unit)
+ err = -ENODEV;
+ goto out;
+ }
+- memcpy(eth_addr, (void *) 0xfffc1f2c, ETH_ALEN); /* YUCK! Get addr from NOVRAM */
++ memcpy(eth_addr, absolute_pointer(0xfffc1f2c), ETH_ALEN); /* YUCK! Get addr from NOVRAM */
+ dev->base_addr = MVME_I596_BASE;
+ dev->irq = (unsigned) MVME16x_IRQ_I596;
+ goto found;
+diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
+index bf64fab383851..ba5b515c86e25 100644
+--- a/drivers/net/ethernet/intel/e100.c
++++ b/drivers/net/ethernet/intel/e100.c
+@@ -2433,11 +2433,15 @@ static void e100_get_drvinfo(struct net_device *netdev,
+ sizeof(info->bus_info));
+ }
+
+-#define E100_PHY_REGS 0x1C
++#define E100_PHY_REGS 0x1D
+ static int e100_get_regs_len(struct net_device *netdev)
+ {
+ struct nic *nic = netdev_priv(netdev);
+- return 1 + E100_PHY_REGS + sizeof(nic->mem->dump_buf);
++
++ /* We know the number of registers, and the size of the dump buffer.
++ * Calculate the total size in bytes.
++ */
++ return (1 + E100_PHY_REGS) * sizeof(u32) + sizeof(nic->mem->dump_buf);
+ }
+
+ static void e100_get_regs(struct net_device *netdev,
+@@ -2451,14 +2455,18 @@ static void e100_get_regs(struct net_device *netdev,
+ buff[0] = ioread8(&nic->csr->scb.cmd_hi) << 24 |
+ ioread8(&nic->csr->scb.cmd_lo) << 16 |
+ ioread16(&nic->csr->scb.status);
+- for (i = E100_PHY_REGS; i >= 0; i--)
+- buff[1 + E100_PHY_REGS - i] =
+- mdio_read(netdev, nic->mii.phy_id, i);
++ for (i = 0; i < E100_PHY_REGS; i++)
++ /* Note that we read the registers in reverse order. This
++ * ordering is the ABI apparently used by ethtool and other
++ * applications.
++ */
++ buff[1 + i] = mdio_read(netdev, nic->mii.phy_id,
++ E100_PHY_REGS - 1 - i);
+ memset(nic->mem->dump_buf, 0, sizeof(nic->mem->dump_buf));
+ e100_exec_cb(nic, NULL, e100_dump);
+ msleep(10);
+- memcpy(&buff[2 + E100_PHY_REGS], nic->mem->dump_buf,
+- sizeof(nic->mem->dump_buf));
++ memcpy(&buff[1 + E100_PHY_REGS], nic->mem->dump_buf,
++ sizeof(nic->mem->dump_buf));
+ }
+
+ static void e100_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index f3a0617733d8f..943bd189e895e 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -372,6 +372,9 @@ mlx4_en_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
+ int nhoff = skb_network_offset(skb);
+ int ret = 0;
+
++ if (skb->encapsulation)
++ return -EPROTONOSUPPORT;
++
+ if (skb->protocol != htons(ETH_P_IP))
+ return -EPROTONOSUPPORT;
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index af59761ddfa07..064e13bd2c8b5 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -227,7 +227,7 @@ static void stmmac_clk_csr_set(struct stmmac_priv *priv)
+ priv->clk_csr = STMMAC_CSR_100_150M;
+ else if ((clk_rate >= CSR_F_150M) && (clk_rate < CSR_F_250M))
+ priv->clk_csr = STMMAC_CSR_150_250M;
+- else if ((clk_rate >= CSR_F_250M) && (clk_rate < CSR_F_300M))
++ else if ((clk_rate >= CSR_F_250M) && (clk_rate <= CSR_F_300M))
+ priv->clk_csr = STMMAC_CSR_250_300M;
+ }
+
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 1001e9a2edd4f..af776d7be7806 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -68,9 +68,9 @@
+ #define SIXP_DAMA_OFF 0
+
+ /* default level 2 parameters */
+-#define SIXP_TXDELAY (HZ/4) /* in 1 s */
++#define SIXP_TXDELAY 25 /* 250 ms */
+ #define SIXP_PERSIST 50 /* in 256ths */
+-#define SIXP_SLOTTIME (HZ/10) /* in 1 s */
++#define SIXP_SLOTTIME 10 /* 100 ms */
+ #define SIXP_INIT_RESYNC_TIMEOUT (3*HZ/2) /* in 1 s */
+ #define SIXP_RESYNC_TIMEOUT 5*HZ /* in 1 s */
+
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index a66077f514572..77a7a7ddb6310 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -2511,7 +2511,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
+ hso_net_init);
+ if (!net) {
+ dev_err(&interface->dev, "Unable to create ethernet device\n");
+- goto exit;
++ goto err_hso_dev;
+ }
+
+ hso_net = netdev_priv(net);
+@@ -2524,13 +2524,13 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
+ USB_DIR_IN);
+ if (!hso_net->in_endp) {
+ dev_err(&interface->dev, "Can't find BULK IN endpoint\n");
+- goto exit;
++ goto err_net;
+ }
+ hso_net->out_endp = hso_get_ep(interface, USB_ENDPOINT_XFER_BULK,
+ USB_DIR_OUT);
+ if (!hso_net->out_endp) {
+ dev_err(&interface->dev, "Can't find BULK OUT endpoint\n");
+- goto exit;
++ goto err_net;
+ }
+ SET_NETDEV_DEV(net, &interface->dev);
+ SET_NETDEV_DEVTYPE(net, &hso_type);
+@@ -2539,18 +2539,18 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
+ for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
+ hso_net->mux_bulk_rx_urb_pool[i] = usb_alloc_urb(0, GFP_KERNEL);
+ if (!hso_net->mux_bulk_rx_urb_pool[i])
+- goto exit;
++ goto err_mux_bulk_rx;
+ hso_net->mux_bulk_rx_buf_pool[i] = kzalloc(MUX_BULK_RX_BUF_SIZE,
+ GFP_KERNEL);
+ if (!hso_net->mux_bulk_rx_buf_pool[i])
+- goto exit;
++ goto err_mux_bulk_rx;
+ }
+ hso_net->mux_bulk_tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!hso_net->mux_bulk_tx_urb)
+- goto exit;
++ goto err_mux_bulk_rx;
+ hso_net->mux_bulk_tx_buf = kzalloc(MUX_BULK_TX_BUF_SIZE, GFP_KERNEL);
+ if (!hso_net->mux_bulk_tx_buf)
+- goto exit;
++ goto err_free_tx_urb;
+
+ add_net_device(hso_dev);
+
+@@ -2558,7 +2558,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
+ result = register_netdev(net);
+ if (result) {
+ dev_err(&interface->dev, "Failed to register device\n");
+- goto exit;
++ goto err_free_tx_buf;
+ }
+
+ hso_log_port(hso_dev);
+@@ -2566,8 +2566,21 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
+ hso_create_rfkill(hso_dev, interface);
+
+ return hso_dev;
+-exit:
+- hso_free_net_device(hso_dev);
++
++err_free_tx_buf:
++ remove_net_device(hso_dev);
++ kfree(hso_net->mux_bulk_tx_buf);
++err_free_tx_urb:
++ usb_free_urb(hso_net->mux_bulk_tx_urb);
++err_mux_bulk_rx:
++ for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
++ usb_free_urb(hso_net->mux_bulk_rx_urb_pool[i]);
++ kfree(hso_net->mux_bulk_rx_buf_pool[i]);
++ }
++err_net:
++ free_netdev(net);
++err_hso_dev:
++ kfree(hso_dev);
+ return NULL;
+ }
+
+@@ -2714,14 +2727,14 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface,
+
+ serial = kzalloc(sizeof(*serial), GFP_KERNEL);
+ if (!serial)
+- goto exit;
++ goto err_free_dev;
+
+ hso_dev->port_data.dev_serial = serial;
+ serial->parent = hso_dev;
+
+ if (hso_serial_common_create
+ (serial, 1, CTRL_URB_RX_SIZE, CTRL_URB_TX_SIZE))
+- goto exit;
++ goto err_free_serial;
+
+ serial->tx_data_length--;
+ serial->write_data = hso_mux_serial_write_data;
+@@ -2737,11 +2750,9 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface,
+ /* done, return it */
+ return hso_dev;
+
+-exit:
+- if (serial) {
+- tty_unregister_device(tty_drv, serial->minor);
+- kfree(serial);
+- }
++err_free_serial:
++ kfree(serial);
++err_free_dev:
+ kfree(hso_dev);
+ return NULL;
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 64f699a1afd72..022e03643dace 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -398,14 +398,17 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
+
+ down_read(&ctrl->namespaces_rwsem);
+ list_for_each_entry(ns, &ctrl->namespaces, list) {
+- unsigned nsid = le32_to_cpu(desc->nsids[n]);
+-
++ unsigned nsid;
++again:
++ nsid = le32_to_cpu(desc->nsids[n]);
+ if (ns->head->ns_id < nsid)
+ continue;
+ if (ns->head->ns_id == nsid)
+ nvme_update_ns_ana_state(desc, ns);
+ if (++n == nr_nsids)
+ break;
++ if (ns->head->ns_id > nsid)
++ goto again;
+ }
+ up_read(&ctrl->namespaces_rwsem);
+ return 0;
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index a9669b28c2a6d..68afd4fa7ec9e 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -55,6 +55,7 @@
+ #define PIO_COMPLETION_STATUS_CRS 2
+ #define PIO_COMPLETION_STATUS_CA 4
+ #define PIO_NON_POSTED_REQ BIT(10)
++#define PIO_ERR_STATUS BIT(11)
+ #define PIO_ADDR_LS (PIO_BASE_ADDR + 0x8)
+ #define PIO_ADDR_MS (PIO_BASE_ADDR + 0xc)
+ #define PIO_WR_DATA (PIO_BASE_ADDR + 0x10)
+@@ -330,7 +331,7 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
+ advk_writel(pcie, reg, PCIE_CORE_CMD_STATUS_REG);
+ }
+
+-static void advk_pcie_check_pio_status(struct advk_pcie *pcie)
++static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val)
+ {
+ struct device *dev = &pcie->pdev->dev;
+ u32 reg;
+@@ -341,14 +342,49 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie)
+ status = (reg & PIO_COMPLETION_STATUS_MASK) >>
+ PIO_COMPLETION_STATUS_SHIFT;
+
+- if (!status)
+- return;
+-
++ /*
++ * According to HW spec, the PIO status check sequence as below:
++ * 1) even if COMPLETION_STATUS(bit9:7) indicates successful,
++ * it still needs to check Error Status(bit11), only when this bit
++ * indicates no error happen, the operation is successful.
++ * 2) value Unsupported Request(1) of COMPLETION_STATUS(bit9:7) only
++ * means a PIO write error, and for PIO read it is successful with
++ * a read value of 0xFFFFFFFF.
++ * 3) value Completion Retry Status(CRS) of COMPLETION_STATUS(bit9:7)
++ * only means a PIO write error, and for PIO read it is successful
++ * with a read value of 0xFFFF0001.
++ * 4) value Completer Abort (CA) of COMPLETION_STATUS(bit9:7) means
++ * error for both PIO read and PIO write operation.
++ * 5) other errors are indicated as 'unknown'.
++ */
+ switch (status) {
++ case PIO_COMPLETION_STATUS_OK:
++ if (reg & PIO_ERR_STATUS) {
++ strcomp_status = "COMP_ERR";
++ break;
++ }
++ /* Get the read result */
++ if (val)
++ *val = advk_readl(pcie, PIO_RD_DATA);
++ /* No error */
++ strcomp_status = NULL;
++ break;
+ case PIO_COMPLETION_STATUS_UR:
+ strcomp_status = "UR";
+ break;
+ case PIO_COMPLETION_STATUS_CRS:
++ /* PCIe r4.0, sec 2.3.2, says:
++ * If CRS Software Visibility is not enabled, the Root Complex
++ * must re-issue the Configuration Request as a new Request.
++ * A Root Complex implementation may choose to limit the number
++ * of Configuration Request/CRS Completion Status loops before
++ * determining that something is wrong with the target of the
++ * Request and taking appropriate action, e.g., complete the
++ * Request to the host as a failed transaction.
++ *
++ * To simplify implementation do not re-issue the Configuration
++ * Request and complete the Request as a failed transaction.
++ */
+ strcomp_status = "CRS";
+ break;
+ case PIO_COMPLETION_STATUS_CA:
+@@ -359,6 +395,9 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie)
+ break;
+ }
+
++ if (!strcomp_status)
++ return 0;
++
+ if (reg & PIO_NON_POSTED_REQ)
+ str_posted = "Non-posted";
+ else
+@@ -366,6 +405,8 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie)
+
+ dev_err(dev, "%s PIO Response Status: %s, %#x @ %#x\n",
+ str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS));
++
++ return -EFAULT;
+ }
+
+ static int advk_pcie_wait_pio(struct advk_pcie *pcie)
+@@ -467,10 +508,13 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
+ if (ret < 0)
+ return PCIBIOS_SET_FAILED;
+
+- advk_pcie_check_pio_status(pcie);
++ /* Check PIO status and get the read result */
++ ret = advk_pcie_check_pio_status(pcie, val);
++ if (ret < 0) {
++ *val = 0xffffffff;
++ return PCIBIOS_SET_FAILED;
++ }
+
+- /* Get the read result */
+- *val = advk_readl(pcie, PIO_RD_DATA);
+ if (size == 1)
+ *val = (*val >> (8 * (where & 3))) & 0xff;
+ else if (size == 2)
+@@ -530,7 +574,9 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
+ if (ret < 0)
+ return PCIBIOS_SET_FAILED;
+
+- advk_pcie_check_pio_status(pcie);
++ ret = advk_pcie_check_pio_status(pcie, NULL);
++ if (ret < 0)
++ return PCIBIOS_SET_FAILED;
+
+ return PCIBIOS_SUCCESSFUL;
+ }
+diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
+index 1793981337dd9..b59bcd2553d15 100644
+--- a/drivers/scsi/csiostor/csio_init.c
++++ b/drivers/scsi/csiostor/csio_init.c
+@@ -1263,3 +1263,4 @@ MODULE_DEVICE_TABLE(pci, csio_pci_tbl);
+ MODULE_VERSION(CSIO_DRV_VERSION);
+ MODULE_FIRMWARE(FW_FNAME_T5);
+ MODULE_FIRMWARE(FW_FNAME_T6);
++MODULE_SOFTDEP("pre: cxgb4");
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 20e69052161e6..c06e648a415b5 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -429,9 +429,7 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
+ struct iscsi_transport *t = iface->transport;
+ int param = -1;
+
+- if (attr == &dev_attr_iface_enabled.attr)
+- param = ISCSI_NET_PARAM_IFACE_ENABLE;
+- else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr)
++ if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr)
+ param = ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO;
+ else if (attr == &dev_attr_iface_header_digest.attr)
+ param = ISCSI_IFACE_PARAM_HDRDGST_EN;
+@@ -471,7 +469,9 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
+ if (param != -1)
+ return t->attr_is_visible(ISCSI_IFACE_PARAM, param);
+
+- if (attr == &dev_attr_iface_vlan_id.attr)
++ if (attr == &dev_attr_iface_enabled.attr)
++ param = ISCSI_NET_PARAM_IFACE_ENABLE;
++ else if (attr == &dev_attr_iface_vlan_id.attr)
+ param = ISCSI_NET_PARAM_VLAN_ID;
+ else if (attr == &dev_attr_iface_vlan_priority.attr)
+ param = ISCSI_NET_PARAM_VLAN_PRIORITY;
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index c6b80a60951b1..bc3097e5cc261 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -1210,7 +1210,7 @@ static int tegra_slink_resume(struct device *dev)
+ }
+ #endif
+
+-static int tegra_slink_runtime_suspend(struct device *dev)
++static int __maybe_unused tegra_slink_runtime_suspend(struct device *dev)
+ {
+ struct spi_master *master = dev_get_drvdata(dev);
+ struct tegra_slink_data *tspi = spi_master_get_devdata(master);
+@@ -1222,7 +1222,7 @@ static int tegra_slink_runtime_suspend(struct device *dev)
+ return 0;
+ }
+
+-static int tegra_slink_runtime_resume(struct device *dev)
++static int __maybe_unused tegra_slink_runtime_resume(struct device *dev)
+ {
+ struct spi_master *master = dev_get_drvdata(dev);
+ struct tegra_slink_data *tspi = spi_master_get_devdata(master);
+diff --git a/drivers/staging/erofs/include/trace/events/erofs.h b/drivers/staging/erofs/include/trace/events/erofs.h
+index 5aead93a762f1..852c94176d1bd 100644
+--- a/drivers/staging/erofs/include/trace/events/erofs.h
++++ b/drivers/staging/erofs/include/trace/events/erofs.h
+@@ -32,20 +32,20 @@ TRACE_EVENT(erofs_lookup,
+ TP_STRUCT__entry(
+ __field(dev_t, dev )
+ __field(erofs_nid_t, nid )
+- __field(const char *, name )
++ __string(name, dentry->d_name.name )
+ __field(unsigned int, flags )
+ ),
+
+ TP_fast_assign(
+ __entry->dev = dir->i_sb->s_dev;
+ __entry->nid = EROFS_V(dir)->nid;
+- __entry->name = dentry->d_name.name;
++ __assign_str(name, dentry->d_name.name);
+ __entry->flags = flags;
+ ),
+
+ TP_printk("dev = (%d,%d), pnid = %llu, name:%s, flags:%x",
+ show_dev_nid(__entry),
+- __entry->name,
++ __get_str(name),
+ __entry->flags)
+ );
+
+diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c
+index 2343914f7548a..2e9006a49587a 100644
+--- a/drivers/staging/greybus/uart.c
++++ b/drivers/staging/greybus/uart.c
+@@ -799,6 +799,17 @@ out:
+ gbphy_runtime_put_autosuspend(gb_tty->gbphy_dev);
+ }
+
++static void gb_tty_port_destruct(struct tty_port *port)
++{
++ struct gb_tty *gb_tty = container_of(port, struct gb_tty, port);
++
++ if (gb_tty->minor != GB_NUM_MINORS)
++ release_minor(gb_tty);
++ kfifo_free(&gb_tty->write_fifo);
++ kfree(gb_tty->buffer);
++ kfree(gb_tty);
++}
++
+ static const struct tty_operations gb_ops = {
+ .install = gb_tty_install,
+ .open = gb_tty_open,
+@@ -822,6 +833,7 @@ static const struct tty_port_operations gb_port_ops = {
+ .dtr_rts = gb_tty_dtr_rts,
+ .activate = gb_tty_port_activate,
+ .shutdown = gb_tty_port_shutdown,
++ .destruct = gb_tty_port_destruct,
+ };
+
+ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
+@@ -834,17 +846,11 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
+ int retval;
+ int minor;
+
+- gb_tty = kzalloc(sizeof(*gb_tty), GFP_KERNEL);
+- if (!gb_tty)
+- return -ENOMEM;
+-
+ connection = gb_connection_create(gbphy_dev->bundle,
+ le16_to_cpu(gbphy_dev->cport_desc->id),
+ gb_uart_request_handler);
+- if (IS_ERR(connection)) {
+- retval = PTR_ERR(connection);
+- goto exit_tty_free;
+- }
++ if (IS_ERR(connection))
++ return PTR_ERR(connection);
+
+ max_payload = gb_operation_get_payload_size_max(connection);
+ if (max_payload < sizeof(struct gb_uart_send_data_request)) {
+@@ -852,13 +858,23 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
+ goto exit_connection_destroy;
+ }
+
++ gb_tty = kzalloc(sizeof(*gb_tty), GFP_KERNEL);
++ if (!gb_tty) {
++ retval = -ENOMEM;
++ goto exit_connection_destroy;
++ }
++
++ tty_port_init(&gb_tty->port);
++ gb_tty->port.ops = &gb_port_ops;
++ gb_tty->minor = GB_NUM_MINORS;
++
+ gb_tty->buffer_payload_max = max_payload -
+ sizeof(struct gb_uart_send_data_request);
+
+ gb_tty->buffer = kzalloc(gb_tty->buffer_payload_max, GFP_KERNEL);
+ if (!gb_tty->buffer) {
+ retval = -ENOMEM;
+- goto exit_connection_destroy;
++ goto exit_put_port;
+ }
+
+ INIT_WORK(&gb_tty->tx_work, gb_uart_tx_write_work);
+@@ -866,7 +882,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
+ retval = kfifo_alloc(&gb_tty->write_fifo, GB_UART_WRITE_FIFO_SIZE,
+ GFP_KERNEL);
+ if (retval)
+- goto exit_buf_free;
++ goto exit_put_port;
+
+ gb_tty->credits = GB_UART_FIRMWARE_CREDITS;
+ init_completion(&gb_tty->credits_complete);
+@@ -880,7 +896,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
+ } else {
+ retval = minor;
+ }
+- goto exit_kfifo_free;
++ goto exit_put_port;
+ }
+
+ gb_tty->minor = minor;
+@@ -889,9 +905,6 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
+ init_waitqueue_head(&gb_tty->wioctl);
+ mutex_init(&gb_tty->mutex);
+
+- tty_port_init(&gb_tty->port);
+- gb_tty->port.ops = &gb_port_ops;
+-
+ gb_tty->connection = connection;
+ gb_tty->gbphy_dev = gbphy_dev;
+ gb_connection_set_data(connection, gb_tty);
+@@ -899,7 +912,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
+
+ retval = gb_connection_enable_tx(connection);
+ if (retval)
+- goto exit_release_minor;
++ goto exit_put_port;
+
+ send_control(gb_tty, gb_tty->ctrlout);
+
+@@ -926,16 +939,10 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
+
+ exit_connection_disable:
+ gb_connection_disable(connection);
+-exit_release_minor:
+- release_minor(gb_tty);
+-exit_kfifo_free:
+- kfifo_free(&gb_tty->write_fifo);
+-exit_buf_free:
+- kfree(gb_tty->buffer);
++exit_put_port:
++ tty_port_put(&gb_tty->port);
+ exit_connection_destroy:
+ gb_connection_destroy(connection);
+-exit_tty_free:
+- kfree(gb_tty);
+
+ return retval;
+ }
+@@ -966,15 +973,10 @@ static void gb_uart_remove(struct gbphy_device *gbphy_dev)
+ gb_connection_disable_rx(connection);
+ tty_unregister_device(gb_tty_driver, gb_tty->minor);
+
+- /* FIXME - free transmit / receive buffers */
+-
+ gb_connection_disable(connection);
+- tty_port_destroy(&gb_tty->port);
+ gb_connection_destroy(connection);
+- release_minor(gb_tty);
+- kfifo_free(&gb_tty->write_fifo);
+- kfree(gb_tty->buffer);
+- kfree(gb_tty);
++
++ tty_port_put(&gb_tty->port);
+ }
+
+ static int gb_tty_init(void)
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index a24296d68f3ed..ae60599c462b9 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -228,15 +228,14 @@ int thermal_build_list_of_policies(char *buf)
+ {
+ struct thermal_governor *pos;
+ ssize_t count = 0;
+- ssize_t size = PAGE_SIZE;
+
+ mutex_lock(&thermal_governor_lock);
+
+ list_for_each_entry(pos, &thermal_governor_list, governor_list) {
+- size = PAGE_SIZE - count;
+- count += scnprintf(buf + count, size, "%s ", pos->name);
++ count += scnprintf(buf + count, PAGE_SIZE - count, "%s ",
++ pos->name);
+ }
+- count += scnprintf(buf + count, size, "\n");
++ count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
+
+ mutex_unlock(&thermal_governor_lock);
+
+diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
+index f0107d5df99e9..77f3f3728a79e 100644
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -163,7 +163,7 @@ static unsigned int mvebu_uart_tx_empty(struct uart_port *port)
+ st = readl(port->membase + UART_STAT);
+ spin_unlock_irqrestore(&port->lock, flags);
+
+- return (st & STAT_TX_FIFO_EMP) ? TIOCSER_TEMT : 0;
++ return (st & STAT_TX_EMP) ? TIOCSER_TEMT : 0;
+ }
+
+ static unsigned int mvebu_uart_get_mctrl(struct uart_port *port)
+diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
+index e9779b03ee565..afe34beec7203 100644
+--- a/drivers/tty/synclink_gt.c
++++ b/drivers/tty/synclink_gt.c
+@@ -137,37 +137,14 @@ MODULE_PARM_DESC(maxframe, "Maximum frame size used by device (4096 to 65535)");
+ */
+ static struct tty_driver *serial_driver;
+
+-static int open(struct tty_struct *tty, struct file * filp);
+-static void close(struct tty_struct *tty, struct file * filp);
+-static void hangup(struct tty_struct *tty);
+-static void set_termios(struct tty_struct *tty, struct ktermios *old_termios);
+-
+-static int write(struct tty_struct *tty, const unsigned char *buf, int count);
+-static int put_char(struct tty_struct *tty, unsigned char ch);
+-static void send_xchar(struct tty_struct *tty, char ch);
+ static void wait_until_sent(struct tty_struct *tty, int timeout);
+-static int write_room(struct tty_struct *tty);
+-static void flush_chars(struct tty_struct *tty);
+ static void flush_buffer(struct tty_struct *tty);
+-static void tx_hold(struct tty_struct *tty);
+ static void tx_release(struct tty_struct *tty);
+
+-static int ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg);
+-static int chars_in_buffer(struct tty_struct *tty);
+-static void throttle(struct tty_struct * tty);
+-static void unthrottle(struct tty_struct * tty);
+-static int set_break(struct tty_struct *tty, int break_state);
+-
+ /*
+- * generic HDLC support and callbacks
++ * generic HDLC support
+ */
+-#if SYNCLINK_GENERIC_HDLC
+ #define dev_to_port(D) (dev_to_hdlc(D)->priv)
+-static void hdlcdev_tx_done(struct slgt_info *info);
+-static void hdlcdev_rx(struct slgt_info *info, char *buf, int size);
+-static int hdlcdev_init(struct slgt_info *info);
+-static void hdlcdev_exit(struct slgt_info *info);
+-#endif
+
+
+ /*
+@@ -186,9 +163,6 @@ struct cond_wait {
+ wait_queue_entry_t wait;
+ unsigned int data;
+ };
+-static void init_cond_wait(struct cond_wait *w, unsigned int data);
+-static void add_cond_wait(struct cond_wait **head, struct cond_wait *w);
+-static void remove_cond_wait(struct cond_wait **head, struct cond_wait *w);
+ static void flush_cond_wait(struct cond_wait **head);
+
+ /*
+@@ -443,12 +417,8 @@ static void shutdown(struct slgt_info *info);
+ static void program_hw(struct slgt_info *info);
+ static void change_params(struct slgt_info *info);
+
+-static int register_test(struct slgt_info *info);
+-static int irq_test(struct slgt_info *info);
+-static int loopback_test(struct slgt_info *info);
+ static int adapter_test(struct slgt_info *info);
+
+-static void reset_adapter(struct slgt_info *info);
+ static void reset_port(struct slgt_info *info);
+ static void async_mode(struct slgt_info *info);
+ static void sync_mode(struct slgt_info *info);
+@@ -457,41 +427,23 @@ static void rx_stop(struct slgt_info *info);
+ static void rx_start(struct slgt_info *info);
+ static void reset_rbufs(struct slgt_info *info);
+ static void free_rbufs(struct slgt_info *info, unsigned int first, unsigned int last);
+-static void rdma_reset(struct slgt_info *info);
+ static bool rx_get_frame(struct slgt_info *info);
+ static bool rx_get_buf(struct slgt_info *info);
+
+ static void tx_start(struct slgt_info *info);
+ static void tx_stop(struct slgt_info *info);
+ static void tx_set_idle(struct slgt_info *info);
+-static unsigned int free_tbuf_count(struct slgt_info *info);
+ static unsigned int tbuf_bytes(struct slgt_info *info);
+ static void reset_tbufs(struct slgt_info *info);
+ static void tdma_reset(struct slgt_info *info);
+ static bool tx_load(struct slgt_info *info, const char *buf, unsigned int count);
+
+-static void get_signals(struct slgt_info *info);
+-static void set_signals(struct slgt_info *info);
+-static void enable_loopback(struct slgt_info *info);
++static void get_gtsignals(struct slgt_info *info);
++static void set_gtsignals(struct slgt_info *info);
+ static void set_rate(struct slgt_info *info, u32 data_rate);
+
+-static int bh_action(struct slgt_info *info);
+-static void bh_handler(struct work_struct *work);
+ static void bh_transmit(struct slgt_info *info);
+-static void isr_serial(struct slgt_info *info);
+-static void isr_rdma(struct slgt_info *info);
+ static void isr_txeom(struct slgt_info *info, unsigned short status);
+-static void isr_tdma(struct slgt_info *info);
+-
+-static int alloc_dma_bufs(struct slgt_info *info);
+-static void free_dma_bufs(struct slgt_info *info);
+-static int alloc_desc(struct slgt_info *info);
+-static void free_desc(struct slgt_info *info);
+-static int alloc_bufs(struct slgt_info *info, struct slgt_desc *bufs, int count);
+-static void free_bufs(struct slgt_info *info, struct slgt_desc *bufs, int count);
+-
+-static int alloc_tmp_rbuf(struct slgt_info *info);
+-static void free_tmp_rbuf(struct slgt_info *info);
+
+ static void tx_timeout(struct timer_list *t);
+ static void rx_timeout(struct timer_list *t);
+@@ -509,10 +461,6 @@ static int tx_abort(struct slgt_info *info);
+ static int rx_enable(struct slgt_info *info, int enable);
+ static int modem_input_wait(struct slgt_info *info,int arg);
+ static int wait_mgsl_event(struct slgt_info *info, int __user *mask_ptr);
+-static int tiocmget(struct tty_struct *tty);
+-static int tiocmset(struct tty_struct *tty,
+- unsigned int set, unsigned int clear);
+-static int set_break(struct tty_struct *tty, int break_state);
+ static int get_interface(struct slgt_info *info, int __user *if_mode);
+ static int set_interface(struct slgt_info *info, int if_mode);
+ static int set_gpio(struct slgt_info *info, struct gpio_desc __user *gpio);
+@@ -526,9 +474,6 @@ static int set_xctrl(struct slgt_info *info, int if_mode);
+ /*
+ * driver functions
+ */
+-static void add_device(struct slgt_info *info);
+-static void device_init(int adapter_num, struct pci_dev *pdev);
+-static int claim_resources(struct slgt_info *info);
+ static void release_resources(struct slgt_info *info);
+
+ /*
+@@ -776,7 +721,7 @@ static void set_termios(struct tty_struct *tty, struct ktermios *old_termios)
+ if ((old_termios->c_cflag & CBAUD) && !C_BAUD(tty)) {
+ info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+ spin_lock_irqsave(&info->lock,flags);
+- set_signals(info);
++ set_gtsignals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+
+@@ -786,7 +731,7 @@ static void set_termios(struct tty_struct *tty, struct ktermios *old_termios)
+ if (!C_CRTSCTS(tty) || !tty_throttled(tty))
+ info->signals |= SerialSignal_RTS;
+ spin_lock_irqsave(&info->lock,flags);
+- set_signals(info);
++ set_gtsignals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+
+@@ -1238,7 +1183,7 @@ static inline void line_info(struct seq_file *m, struct slgt_info *info)
+
+ /* output current serial signal states */
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_gtsignals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+
+ stat_buf[0] = 0;
+@@ -1338,7 +1283,7 @@ static void throttle(struct tty_struct * tty)
+ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->signals &= ~SerialSignal_RTS;
+- set_signals(info);
++ set_gtsignals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -1363,7 +1308,7 @@ static void unthrottle(struct tty_struct * tty)
+ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->signals |= SerialSignal_RTS;
+- set_signals(info);
++ set_gtsignals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -1535,7 +1480,7 @@ static int hdlcdev_open(struct net_device *dev)
+
+ /* inform generic HDLC layer of current DCD status */
+ spin_lock_irqsave(&info->lock, flags);
+- get_signals(info);
++ get_gtsignals(info);
+ spin_unlock_irqrestore(&info->lock, flags);
+ if (info->signals & SerialSignal_DCD)
+ netif_carrier_on(dev);
+@@ -2291,7 +2236,7 @@ static void isr_txeom(struct slgt_info *info, unsigned short status)
+ if (info->params.mode != MGSL_MODE_ASYNC && info->drop_rts_on_tx_done) {
+ info->signals &= ~SerialSignal_RTS;
+ info->drop_rts_on_tx_done = false;
+- set_signals(info);
++ set_gtsignals(info);
+ }
+
+ #if SYNCLINK_GENERIC_HDLC
+@@ -2456,7 +2401,7 @@ static void shutdown(struct slgt_info *info)
+
+ if (!info->port.tty || info->port.tty->termios.c_cflag & HUPCL) {
+ info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+- set_signals(info);
++ set_gtsignals(info);
+ }
+
+ flush_cond_wait(&info->gpio_wait_q);
+@@ -2484,7 +2429,7 @@ static void program_hw(struct slgt_info *info)
+ else
+ async_mode(info);
+
+- set_signals(info);
++ set_gtsignals(info);
+
+ info->dcd_chkcount = 0;
+ info->cts_chkcount = 0;
+@@ -2492,7 +2437,7 @@ static void program_hw(struct slgt_info *info)
+ info->dsr_chkcount = 0;
+
+ slgt_irq_on(info, IRQ_DCD | IRQ_CTS | IRQ_DSR | IRQ_RI);
+- get_signals(info);
++ get_gtsignals(info);
+
+ if (info->netcount ||
+ (info->port.tty && info->port.tty->termios.c_cflag & CREAD))
+@@ -2736,7 +2681,7 @@ static int wait_mgsl_event(struct slgt_info *info, int __user *mask_ptr)
+ spin_lock_irqsave(&info->lock,flags);
+
+ /* return immediately if state matches requested events */
+- get_signals(info);
++ get_gtsignals(info);
+ s = info->signals;
+
+ events = mask &
+@@ -3154,7 +3099,7 @@ static int tiocmget(struct tty_struct *tty)
+ unsigned long flags;
+
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_gtsignals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+
+ result = ((info->signals & SerialSignal_RTS) ? TIOCM_RTS:0) +
+@@ -3193,7 +3138,7 @@ static int tiocmset(struct tty_struct *tty,
+ info->signals &= ~SerialSignal_DTR;
+
+ spin_lock_irqsave(&info->lock,flags);
+- set_signals(info);
++ set_gtsignals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ return 0;
+ }
+@@ -3204,7 +3149,7 @@ static int carrier_raised(struct tty_port *port)
+ struct slgt_info *info = container_of(port, struct slgt_info, port);
+
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_gtsignals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ return (info->signals & SerialSignal_DCD) ? 1 : 0;
+ }
+@@ -3219,7 +3164,7 @@ static void dtr_rts(struct tty_port *port, int on)
+ info->signals |= SerialSignal_RTS | SerialSignal_DTR;
+ else
+ info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+- set_signals(info);
++ set_gtsignals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+
+@@ -4018,10 +3963,10 @@ static void tx_start(struct slgt_info *info)
+
+ if (info->params.mode != MGSL_MODE_ASYNC) {
+ if (info->params.flags & HDLC_FLAG_AUTO_RTS) {
+- get_signals(info);
++ get_gtsignals(info);
+ if (!(info->signals & SerialSignal_RTS)) {
+ info->signals |= SerialSignal_RTS;
+- set_signals(info);
++ set_gtsignals(info);
+ info->drop_rts_on_tx_done = true;
+ }
+ }
+@@ -4075,7 +4020,7 @@ static void reset_port(struct slgt_info *info)
+ rx_stop(info);
+
+ info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+- set_signals(info);
++ set_gtsignals(info);
+
+ slgt_irq_off(info, IRQ_ALL | IRQ_MASTER);
+ }
+@@ -4497,7 +4442,7 @@ static void tx_set_idle(struct slgt_info *info)
+ /*
+ * get state of V24 status (input) signals
+ */
+-static void get_signals(struct slgt_info *info)
++static void get_gtsignals(struct slgt_info *info)
+ {
+ unsigned short status = rd_reg16(info, SSR);
+
+@@ -4559,7 +4504,7 @@ static void msc_set_vcr(struct slgt_info *info)
+ /*
+ * set state of V24 control (output) signals
+ */
+-static void set_signals(struct slgt_info *info)
++static void set_gtsignals(struct slgt_info *info)
+ {
+ unsigned char val = rd_reg8(info, VCR);
+ if (info->signals & SerialSignal_DTR)
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index b2b5f19fb2fb9..72e3989dffa60 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1218,8 +1218,25 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
+ new_row_size = new_cols << 1;
+ new_screen_size = new_row_size * new_rows;
+
+- if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
+- return 0;
++ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) {
++ /*
++ * This function is being called here to cover the case
++ * where the userspace calls the FBIOPUT_VSCREENINFO twice,
++ * passing the same fb_var_screeninfo containing the fields
++ * yres/xres equal to a number non-multiple of vc_font.height
++ * and yres_virtual/xres_virtual equal to number lesser than the
++ * vc_font.height and yres/xres.
++ * In the second call, the struct fb_var_screeninfo isn't
++ * being modified by the underlying driver because of the
++ * if above, and this causes the fbcon_display->vrows to become
++ * negative and it eventually leads to out-of-bound
++ * access by the imageblit function.
++ * To give the correct values to the struct and to not have
++ * to deal with possible errors from the code below, we call
++ * the resize_screen here as well.
++ */
++ return resize_screen(vc, new_cols, new_rows, user);
++ }
+
+ if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size)
+ return -EINVAL;
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 371aae41ed655..6959231d63b3e 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -734,7 +734,8 @@ static void acm_port_destruct(struct tty_port *port)
+ {
+ struct acm *acm = container_of(port, struct acm, port);
+
+- acm_release_minor(acm);
++ if (acm->minor != ACM_MINOR_INVALID)
++ acm_release_minor(acm);
+ usb_put_intf(acm->control);
+ kfree(acm->country_codes);
+ kfree(acm);
+@@ -1396,8 +1397,10 @@ made_compressed_probe:
+ usb_get_intf(acm->control); /* undone in destruct() */
+
+ minor = acm_alloc_minor(acm);
+- if (minor < 0)
++ if (minor < 0) {
++ acm->minor = ACM_MINOR_INVALID;
+ goto alloc_fail1;
++ }
+
+ acm->minor = minor;
+ acm->dev = usb_dev;
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index d8f8651425c46..02e2ad61742db 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -22,6 +22,8 @@
+ #define ACM_TTY_MAJOR 166
+ #define ACM_TTY_MINORS 256
+
++#define ACM_MINOR_INVALID ACM_TTY_MINORS
++
+ /*
+ * Requests.
+ */
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 7fff96dff0a03..b405c8ac8984b 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -2919,9 +2919,7 @@ static void dwc2_hsotg_epint(struct dwc2_hsotg *hsotg, unsigned int idx,
+
+ /* In DDMA handle isochronous requests separately */
+ if (using_desc_dma(hsotg) && hs_ep->isochronous) {
+- /* XferCompl set along with BNA */
+- if (!(ints & DXEPINT_BNAINTR))
+- dwc2_gadget_complete_isoc_request_ddma(hs_ep);
++ dwc2_gadget_complete_isoc_request_ddma(hs_ep);
+ } else if (dir_in) {
+ /*
+ * We get OutDone from the FIFO, so we only
+diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
+index a766476fd742e..ca0aebb5bd0cc 100644
+--- a/drivers/usb/gadget/udc/r8a66597-udc.c
++++ b/drivers/usb/gadget/udc/r8a66597-udc.c
+@@ -1250,7 +1250,7 @@ static void set_feature(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
+ do {
+ tmp = r8a66597_read(r8a66597, INTSTS0) & CTSQ;
+ udelay(1);
+- } while (tmp != CS_IDST || timeout-- > 0);
++ } while (tmp != CS_IDST && timeout-- > 0);
+
+ if (tmp == CS_IDST)
+ r8a66597_bset(r8a66597,
+diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
+index 39453287b5c36..4ecfbf6bb1fa8 100644
+--- a/drivers/usb/musb/tusb6010.c
++++ b/drivers/usb/musb/tusb6010.c
+@@ -190,6 +190,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len)
+ }
+ if (len > 0) {
+ /* Write the rest 1 - 3 bytes to FIFO */
++ val = 0;
+ memcpy(&val, buf, len);
+ musb_writel(fifo, 0, val);
+ }
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index eaf9155663027..894572a5e5c5c 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -234,6 +234,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
+ { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
+ { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
++ { USB_DEVICE(0x2184, 0x0030) }, /* GW Instek GDM-834x Digital Multimeter */
+ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
+ { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
+ { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index c78dfb7fd3948..3e624b648aa68 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -113,7 +113,6 @@
+ #define BANDB_DEVICE_ID_USOPTL4_2P 0xBC02
+ #define BANDB_DEVICE_ID_USOPTL4_4 0xAC44
+ #define BANDB_DEVICE_ID_USOPTL4_4P 0xBC03
+-#define BANDB_DEVICE_ID_USOPTL2_4 0xAC24
+
+ /* This driver also supports
+ * ATEN UC2324 device using Moschip MCS7840
+@@ -194,7 +193,6 @@ static const struct usb_device_id id_table[] = {
+ {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2P)},
+ {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
+ {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4P)},
+- {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4)},
+ {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)},
+ {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)},
+ {USB_DEVICE(USB_VENDOR_ID_MOXA, MOXA_DEVICE_ID_2210)},
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index d08b799c91fc6..524b3c6e96e2a 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1205,6 +1205,14 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */
+ .driver_info = NCTRL(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN920 (rmnet) */
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN920 (MBIM) */
++ .driver_info = NCTRL(0) | RSVD(1) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1062, 0xff), /* Telit LN920 (RNDIS) */
++ .driver_info = NCTRL(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff), /* Telit LN920 (ECM) */
++ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+@@ -1650,7 +1658,6 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff),
+@@ -2068,6 +2075,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+ { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */
+ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */
++ .driver_info = RSVD(3) },
+ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */
+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+ { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 861153d294b67..7442793fe0502 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -416,9 +416,16 @@ UNUSUAL_DEV( 0x04cb, 0x0100, 0x0000, 0x2210,
+ USB_SC_UFI, USB_PR_DEVICE, NULL, US_FL_FIX_INQUIRY | US_FL_SINGLE_LUN),
+
+ /*
+- * Reported by Ondrej Zary <linux@rainbow-software.org>
++ * Reported by Ondrej Zary <linux@zary.sk>
+ * The device reports one sector more and breaks when that sector is accessed
++ * Firmwares older than 2.6c (the latest one and the only that claims Linux
++ * support) have also broken tag handling
+ */
++UNUSUAL_DEV( 0x04ce, 0x0002, 0x0000, 0x026b,
++ "ScanLogic",
++ "SL11R-IDE",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_FIX_CAPACITY | US_FL_BULK_IGNORE_TAG),
+ UNUSUAL_DEV( 0x04ce, 0x0002, 0x026c, 0x026c,
+ "ScanLogic",
+ "SL11R-IDE",
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index c7db6c943ba51..2f72753c3e225 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -50,7 +50,7 @@ UNUSUAL_DEV(0x059f, 0x1061, 0x0000, 0x9999,
+ "LaCie",
+ "Rugged USB3-FW",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+- US_FL_IGNORE_UAS),
++ US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME),
+
+ /*
+ * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index b23edf64c2b21..2459e2afd65ec 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -43,6 +43,8 @@
+ #include <linux/sched.h>
+ #include <linux/cred.h>
+ #include <linux/errno.h>
++#include <linux/freezer.h>
++#include <linux/kthread.h>
+ #include <linux/mm.h>
+ #include <linux/bootmem.h>
+ #include <linux/pagemap.h>
+@@ -120,7 +122,7 @@ static struct ctl_table xen_root[] = {
+ #define EXTENT_ORDER (fls(XEN_PFN_PER_PAGE) - 1)
+
+ /*
+- * balloon_process() state:
++ * balloon_thread() state:
+ *
+ * BP_DONE: done or nothing to do,
+ * BP_WAIT: wait to be rescheduled,
+@@ -135,6 +137,8 @@ enum bp_state {
+ BP_ECANCELED
+ };
+
++/* Main waiting point for xen-balloon thread. */
++static DECLARE_WAIT_QUEUE_HEAD(balloon_thread_wq);
+
+ static DEFINE_MUTEX(balloon_mutex);
+
+@@ -149,10 +153,6 @@ static xen_pfn_t frame_list[PAGE_SIZE / sizeof(xen_pfn_t)];
+ static LIST_HEAD(ballooned_pages);
+ static DECLARE_WAIT_QUEUE_HEAD(balloon_wq);
+
+-/* Main work function, always executed in process context. */
+-static void balloon_process(struct work_struct *work);
+-static DECLARE_DELAYED_WORK(balloon_worker, balloon_process);
+-
+ /* When ballooning out (allocating memory to return to Xen) we don't really
+ want the kernel to try too hard since that can trigger the oom killer. */
+ #define GFP_BALLOON \
+@@ -383,7 +383,7 @@ static void xen_online_page(struct page *page)
+ static int xen_memory_notifier(struct notifier_block *nb, unsigned long val, void *v)
+ {
+ if (val == MEM_ONLINE)
+- schedule_delayed_work(&balloon_worker, 0);
++ wake_up(&balloon_thread_wq);
+
+ return NOTIFY_OK;
+ }
+@@ -508,18 +508,43 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
+ }
+
+ /*
+- * As this is a work item it is guaranteed to run as a single instance only.
++ * Stop waiting if either state is not BP_EAGAIN and ballooning action is
++ * needed, or if the credit has changed while state is BP_EAGAIN.
++ */
++static bool balloon_thread_cond(enum bp_state state, long credit)
++{
++ if (state != BP_EAGAIN)
++ credit = 0;
++
++ return current_credit() != credit || kthread_should_stop();
++}
++
++/*
++ * As this is a kthread it is guaranteed to run as a single instance only.
+ * We may of course race updates of the target counts (which are protected
+ * by the balloon lock), or with changes to the Xen hard limit, but we will
+ * recover from these in time.
+ */
+-static void balloon_process(struct work_struct *work)
++static int balloon_thread(void *unused)
+ {
+ enum bp_state state = BP_DONE;
+ long credit;
++ unsigned long timeout;
++
++ set_freezable();
++ for (;;) {
++ if (state == BP_EAGAIN)
++ timeout = balloon_stats.schedule_delay * HZ;
++ else
++ timeout = 3600 * HZ;
++ credit = current_credit();
+
++ wait_event_freezable_timeout(balloon_thread_wq,
++ balloon_thread_cond(state, credit), timeout);
++
++ if (kthread_should_stop())
++ return 0;
+
+- do {
+ mutex_lock(&balloon_mutex);
+
+ credit = current_credit();
+@@ -546,12 +571,7 @@ static void balloon_process(struct work_struct *work)
+ mutex_unlock(&balloon_mutex);
+
+ cond_resched();
+-
+- } while (credit && state == BP_DONE);
+-
+- /* Schedule more work if there is some still to be done. */
+- if (state == BP_EAGAIN)
+- schedule_delayed_work(&balloon_worker, balloon_stats.schedule_delay * HZ);
++ }
+ }
+
+ /* Resets the Xen limit, sets new target, and kicks off processing. */
+@@ -559,7 +579,7 @@ void balloon_set_new_target(unsigned long target)
+ {
+ /* No need for lock. Not read-modify-write updates. */
+ balloon_stats.target_pages = target;
+- schedule_delayed_work(&balloon_worker, 0);
++ wake_up(&balloon_thread_wq);
+ }
+ EXPORT_SYMBOL_GPL(balloon_set_new_target);
+
+@@ -664,7 +684,7 @@ void free_xenballooned_pages(int nr_pages, struct page **pages)
+
+ /* The balloon may be too large now. Shrink it if needed. */
+ if (current_credit())
+- schedule_delayed_work(&balloon_worker, 0);
++ wake_up(&balloon_thread_wq);
+
+ mutex_unlock(&balloon_mutex);
+ }
+@@ -698,6 +718,8 @@ static void __init balloon_add_region(unsigned long start_pfn,
+
+ static int __init balloon_init(void)
+ {
++ struct task_struct *task;
++
+ if (!xen_domain())
+ return -ENODEV;
+
+@@ -741,6 +763,12 @@ static int __init balloon_init(void)
+ }
+ #endif
+
++ task = kthread_run(balloon_thread, NULL, "xen-balloon");
++ if (IS_ERR(task)) {
++ pr_err("xen-balloon thread could not be started, ballooning will not work!\n");
++ return PTR_ERR(task);
++ }
++
+ /* Init the xen-balloon driver. */
+ xen_balloon_init();
+
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 975dd0dbc2527..c41c568ad1b8a 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -580,7 +580,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
+ elf_prot |= PROT_EXEC;
+ vaddr = eppnt->p_vaddr;
+ if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
+- elf_type |= MAP_FIXED_NOREPLACE;
++ elf_type |= MAP_FIXED;
+ else if (no_base && interp_elf_ex->e_type == ET_DYN)
+ load_addr = -vaddr;
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 6285085195c15..b5aba1c895cb5 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3374,9 +3374,10 @@ cifs_match_super(struct super_block *sb, void *data)
+ spin_lock(&cifs_tcp_ses_lock);
+ cifs_sb = CIFS_SB(sb);
+ tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
+- if (IS_ERR(tlink)) {
++ if (tlink == NULL) {
++ /* can not match superblock if tlink were ever null */
+ spin_unlock(&cifs_tcp_ses_lock);
+- return rc;
++ return 0;
+ }
+ tcon = tlink_tcon(tlink);
+ ses = tcon->ses;
+diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
+index ae520a7263395..aed33af7551ee 100644
+--- a/fs/ext4/dir.c
++++ b/fs/ext4/dir.c
+@@ -535,7 +535,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
+ struct dir_private_info *info = file->private_data;
+ struct inode *inode = file_inode(file);
+ struct fname *fname;
+- int ret;
++ int ret = 0;
+
+ if (!info) {
+ info = ext4_htree_create_dir_info(file, ctx->pos);
+@@ -583,7 +583,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
+ info->curr_minor_hash,
+ &info->next_hash);
+ if (ret < 0)
+- return ret;
++ goto finished;
+ if (ret == 0) {
+ ctx->pos = ext4_get_htree_eof(file);
+ break;
+@@ -614,7 +614,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
+ }
+ finished:
+ info->last_pos = ctx->pos;
+- return 0;
++ return ret < 0 ? ret : 0;
+ }
+
+ static int ext4_dir_open(struct inode * inode, struct file * filp)
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index 8149fb6f1f0d2..a906f47ce1ba7 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -3907,7 +3907,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres,
+ oi = OCFS2_I(inode);
+ oi->ip_dir_lock_gen++;
+ mlog(0, "generation: %u\n", oi->ip_dir_lock_gen);
+- goto out;
++ goto out_forget;
+ }
+
+ if (!S_ISREG(inode->i_mode))
+@@ -3938,6 +3938,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres,
+ filemap_fdatawait(mapping);
+ }
+
++out_forget:
+ forget_all_cached_acls(inode);
+
+ out:
+diff --git a/fs/qnx4/dir.c b/fs/qnx4/dir.c
+index a6ee23aadd283..66645a5a35f30 100644
+--- a/fs/qnx4/dir.c
++++ b/fs/qnx4/dir.c
+@@ -15,13 +15,48 @@
+ #include <linux/buffer_head.h>
+ #include "qnx4.h"
+
++/*
++ * A qnx4 directory entry is an inode entry or link info
++ * depending on the status field in the last byte. The
++ * first byte is where the name start either way, and a
++ * zero means it's empty.
++ *
++ * Also, due to a bug in gcc, we don't want to use the
++ * real (differently sized) name arrays in the inode and
++ * link entries, but always the 'de_name[]' one in the
++ * fake struct entry.
++ *
++ * See
++ *
++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578#c6
++ *
++ * for details, but basically gcc will take the size of the
++ * 'name' array from one of the used union entries randomly.
++ *
++ * This use of 'de_name[]' (48 bytes) avoids the false positive
++ * warnings that would happen if gcc decides to use 'inode.di_name'
++ * (16 bytes) even when the pointer and size were to come from
++ * 'link.dl_name' (48 bytes).
++ *
++ * In all cases the actual name pointer itself is the same, it's
++ * only the gcc internal 'what is the size of this field' logic
++ * that can get confused.
++ */
++union qnx4_directory_entry {
++ struct {
++ const char de_name[48];
++ u8 de_pad[15];
++ u8 de_status;
++ };
++ struct qnx4_inode_entry inode;
++ struct qnx4_link_info link;
++};
++
+ static int qnx4_readdir(struct file *file, struct dir_context *ctx)
+ {
+ struct inode *inode = file_inode(file);
+ unsigned int offset;
+ struct buffer_head *bh;
+- struct qnx4_inode_entry *de;
+- struct qnx4_link_info *le;
+ unsigned long blknum;
+ int ix, ino;
+ int size;
+@@ -38,27 +73,27 @@ static int qnx4_readdir(struct file *file, struct dir_context *ctx)
+ }
+ ix = (ctx->pos >> QNX4_DIR_ENTRY_SIZE_BITS) % QNX4_INODES_PER_BLOCK;
+ for (; ix < QNX4_INODES_PER_BLOCK; ix++, ctx->pos += QNX4_DIR_ENTRY_SIZE) {
++ union qnx4_directory_entry *de;
++
+ offset = ix * QNX4_DIR_ENTRY_SIZE;
+- de = (struct qnx4_inode_entry *) (bh->b_data + offset);
+- if (!de->di_fname[0])
++ de = (union qnx4_directory_entry *) (bh->b_data + offset);
++
++ if (!de->de_name[0])
+ continue;
+- if (!(de->di_status & (QNX4_FILE_USED|QNX4_FILE_LINK)))
++ if (!(de->de_status & (QNX4_FILE_USED|QNX4_FILE_LINK)))
+ continue;
+- if (!(de->di_status & QNX4_FILE_LINK))
+- size = QNX4_SHORT_NAME_MAX;
+- else
+- size = QNX4_NAME_MAX;
+- size = strnlen(de->di_fname, size);
+- QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, de->di_fname));
+- if (!(de->di_status & QNX4_FILE_LINK))
++ if (!(de->de_status & QNX4_FILE_LINK)) {
++ size = sizeof(de->inode.di_fname);
+ ino = blknum * QNX4_INODES_PER_BLOCK + ix - 1;
+- else {
+- le = (struct qnx4_link_info*)de;
+- ino = ( le32_to_cpu(le->dl_inode_blk) - 1 ) *
++ } else {
++ size = sizeof(de->link.dl_fname);
++ ino = ( le32_to_cpu(de->link.dl_inode_blk) - 1 ) *
+ QNX4_INODES_PER_BLOCK +
+- le->dl_inode_ndx;
++ de->link.dl_inode_ndx;
+ }
+- if (!dir_emit(ctx, de->di_fname, size, ino, DT_UNKNOWN)) {
++ size = strnlen(de->de_name, size);
++ QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, name));
++ if (!dir_emit(ctx, de->de_name, size, ino, DT_UNKNOWN)) {
+ brelse(bh);
+ return 0;
+ }
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 6a53300cbd1ed..ab9dfb14f4862 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -228,6 +228,8 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ (typeof(ptr)) (__ptr + (off)); })
+ #endif
+
++#define absolute_pointer(val) RELOC_HIDE((void *)(val), 0)
++
+ #ifndef OPTIMIZER_HIDE_VAR
+ /* Make the optimizer believe the variable can be manipulated arbitrarily. */
+ #define OPTIMIZER_HIDE_VAR(var) \
+diff --git a/include/linux/cred.h b/include/linux/cred.h
+index 1dc351d8548bf..4b081e4911c84 100644
+--- a/include/linux/cred.h
++++ b/include/linux/cred.h
+@@ -240,7 +240,7 @@ static inline struct cred *get_new_cred(struct cred *cred)
+ * @cred: The credentials to reference
+ *
+ * Get a reference on the specified set of credentials. The caller must
+- * release the reference.
++ * release the reference. If %NULL is passed, it is returned with no action.
+ *
+ * This is used to deal with a committed set of credentials. Although the
+ * pointer is const, this will temporarily discard the const and increment the
+@@ -251,6 +251,8 @@ static inline struct cred *get_new_cred(struct cred *cred)
+ static inline const struct cred *get_cred(const struct cred *cred)
+ {
+ struct cred *nonconst_cred = (struct cred *) cred;
++ if (!cred)
++ return cred;
+ validate_creds(cred);
+ nonconst_cred->non_rcu = 0;
+ return get_new_cred(nonconst_cred);
+@@ -261,7 +263,7 @@ static inline const struct cred *get_cred(const struct cred *cred)
+ * @cred: The credentials to release
+ *
+ * Release a reference to a set of credentials, deleting them when the last ref
+- * is released.
++ * is released. If %NULL is passed, nothing is done.
+ *
+ * This takes a const pointer to a set of credentials because the credentials
+ * on task_struct are attached by const pointers to prevent accidental
+@@ -271,9 +273,11 @@ static inline void put_cred(const struct cred *_cred)
+ {
+ struct cred *cred = (struct cred *) _cred;
+
+- validate_creds(cred);
+- if (atomic_dec_and_test(&(cred)->usage))
+- __put_cred(cred);
++ if (cred) {
++ validate_creds(cred);
++ if (atomic_dec_and_test(&(cred)->usage))
++ __put_cred(cred);
++ }
+ }
+
+ /**
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 351749c694ce6..75677050c82ed 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -471,8 +471,10 @@ struct sock {
+ u32 sk_ack_backlog;
+ u32 sk_max_ack_backlog;
+ kuid_t sk_uid;
++ spinlock_t sk_peer_lock;
+ struct pid *sk_peer_pid;
+ const struct cred *sk_peer_cred;
++
+ long sk_rcvtimeo;
+ ktime_t sk_stamp;
+ #if BITS_PER_LONG==32
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index 1b7ec822dc757..60f0e0e048f0e 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -591,9 +591,17 @@ static struct attribute *sugov_attributes[] = {
+ NULL
+ };
+
++static void sugov_tunables_free(struct kobject *kobj)
++{
++ struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj);
++
++ kfree(to_sugov_tunables(attr_set));
++}
++
+ static struct kobj_type sugov_tunables_ktype = {
+ .default_attrs = sugov_attributes,
+ .sysfs_ops = &governor_sysfs_ops,
++ .release = &sugov_tunables_free,
+ };
+
+ /********************** cpufreq governor interface *********************/
+@@ -693,12 +701,10 @@ static struct sugov_tunables *sugov_tunables_alloc(struct sugov_policy *sg_polic
+ return tunables;
+ }
+
+-static void sugov_tunables_free(struct sugov_tunables *tunables)
++static void sugov_clear_global_tunables(void)
+ {
+ if (!have_governor_per_policy())
+ global_tunables = NULL;
+-
+- kfree(tunables);
+ }
+
+ static int sugov_init(struct cpufreq_policy *policy)
+@@ -761,7 +767,7 @@ out:
+ fail:
+ kobject_put(&tunables->attr_set.kobj);
+ policy->governor_data = NULL;
+- sugov_tunables_free(tunables);
++ sugov_clear_global_tunables();
+
+ stop_kthread:
+ sugov_kthread_stop(sg_policy);
+@@ -788,7 +794,7 @@ static void sugov_exit(struct cpufreq_policy *policy)
+ count = gov_attr_set_put(&tunables->attr_set, &sg_policy->tunables_hook);
+ policy->governor_data = NULL;
+ if (!count)
+- sugov_tunables_free(tunables);
++ sugov_clear_global_tunables();
+
+ mutex_unlock(&global_tunables_lock);
+
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 645048bb1e869..75ea1a5be31a8 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -1661,6 +1661,14 @@ static int blk_trace_remove_queue(struct request_queue *q)
+ if (bt == NULL)
+ return -EINVAL;
+
++ if (bt->trace_state == Blktrace_running) {
++ bt->trace_state = Blktrace_stopped;
++ spin_lock_irq(&running_trace_lock);
++ list_del_init(&bt->running_list);
++ spin_unlock_irq(&running_trace_lock);
++ relay_flush(bt->rchan);
++ }
++
+ put_probe_ref();
+ synchronize_rcu();
+ blk_trace_free(bt);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 956af38aa0d6e..41a77027a549b 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1057,6 +1057,16 @@ set_rcvbuf:
+ }
+ EXPORT_SYMBOL(sock_setsockopt);
+
++static const struct cred *sk_get_peer_cred(struct sock *sk)
++{
++ const struct cred *cred;
++
++ spin_lock(&sk->sk_peer_lock);
++ cred = get_cred(sk->sk_peer_cred);
++ spin_unlock(&sk->sk_peer_lock);
++
++ return cred;
++}
+
+ static void cred_to_ucred(struct pid *pid, const struct cred *cred,
+ struct ucred *ucred)
+@@ -1231,7 +1241,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+ struct ucred peercred;
+ if (len > sizeof(peercred))
+ len = sizeof(peercred);
++
++ spin_lock(&sk->sk_peer_lock);
+ cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
++ spin_unlock(&sk->sk_peer_lock);
++
+ if (copy_to_user(optval, &peercred, len))
+ return -EFAULT;
+ goto lenout;
+@@ -1239,20 +1253,23 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+
+ case SO_PEERGROUPS:
+ {
++ const struct cred *cred;
+ int ret, n;
+
+- if (!sk->sk_peer_cred)
++ cred = sk_get_peer_cred(sk);
++ if (!cred)
+ return -ENODATA;
+
+- n = sk->sk_peer_cred->group_info->ngroups;
++ n = cred->group_info->ngroups;
+ if (len < n * sizeof(gid_t)) {
+ len = n * sizeof(gid_t);
++ put_cred(cred);
+ return put_user(len, optlen) ? -EFAULT : -ERANGE;
+ }
+ len = n * sizeof(gid_t);
+
+- ret = groups_to_user((gid_t __user *)optval,
+- sk->sk_peer_cred->group_info);
++ ret = groups_to_user((gid_t __user *)optval, cred->group_info);
++ put_cred(cred);
+ if (ret)
+ return ret;
+ goto lenout;
+@@ -1576,9 +1593,10 @@ static void __sk_destruct(struct rcu_head *head)
+ sk->sk_frag.page = NULL;
+ }
+
+- if (sk->sk_peer_cred)
+- put_cred(sk->sk_peer_cred);
++ /* We do not need to acquire sk->sk_peer_lock, we are the last user. */
++ put_cred(sk->sk_peer_cred);
+ put_pid(sk->sk_peer_pid);
++
+ if (likely(sk->sk_net_refcnt))
+ put_net(sock_net(sk));
+ sk_prot_free(sk->sk_prot_creator, sk);
+@@ -2826,6 +2844,8 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+
+ sk->sk_peer_pid = NULL;
+ sk->sk_peer_cred = NULL;
++ spin_lock_init(&sk->sk_peer_lock);
++
+ sk->sk_write_pending = 0;
+ sk->sk_rcvlowat = 1;
+ sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 5117e0aeea1af..757e1f60e00db 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -581,10 +581,12 @@ static inline void tcp_rcv_rtt_measure_ts(struct sock *sk,
+ u32 delta = tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr;
+ u32 delta_us;
+
+- if (!delta)
+- delta = 1;
+- delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
+- tcp_rcv_rtt_update(tp, delta_us, 0);
++ if (likely(delta < INT_MAX / (USEC_PER_SEC / TCP_TS_HZ))) {
++ if (!delta)
++ delta = 1;
++ delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
++ tcp_rcv_rtt_update(tp, delta_us, 0);
++ }
+ }
+ }
+
+@@ -2931,9 +2933,11 @@ static bool tcp_ack_update_rtt(struct sock *sk, const int flag,
+ if (seq_rtt_us < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
+ flag & FLAG_ACKED) {
+ u32 delta = tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr;
+- u32 delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
+
+- seq_rtt_us = ca_rtt_us = delta_us;
++ if (likely(delta < INT_MAX / (USEC_PER_SEC / TCP_TS_HZ))) {
++ seq_rtt_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
++ ca_rtt_us = seq_rtt_us;
++ }
+ }
+ rs->rtt_us = ca_rtt_us; /* RTT of last (S)ACKed packet (or -1) */
+ if (seq_rtt_us < 0)
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index d55ee43cd1b8f..941c655cad917 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2958,13 +2958,12 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
+ #endif
+ TCP_SKB_CB(skb)->sacked |= TCPCB_RETRANS;
+ tp->retrans_out += tcp_skb_pcount(skb);
+-
+- /* Save stamp of the first retransmit. */
+- if (!tp->retrans_stamp)
+- tp->retrans_stamp = tcp_skb_timestamp(skb);
+-
+ }
+
++ /* Save stamp of the first (attempted) retransmit. */
++ if (!tp->retrans_stamp)
++ tp->retrans_stamp = tcp_skb_timestamp(skb);
++
+ if (tp->undo_retrans < 0)
+ tp->undo_retrans = 0;
+ tp->undo_retrans += tcp_skb_pcount(skb);
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 681882a409686..d071ed6b8b9a0 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -22,33 +22,21 @@
+ #include <linux/gfp.h>
+ #include <net/tcp.h>
+
+-static u32 tcp_retransmit_stamp(const struct sock *sk)
+-{
+- u32 start_ts = tcp_sk(sk)->retrans_stamp;
+-
+- if (unlikely(!start_ts)) {
+- struct sk_buff *head = tcp_rtx_queue_head(sk);
+-
+- if (!head)
+- return 0;
+- start_ts = tcp_skb_timestamp(head);
+- }
+- return start_ts;
+-}
+-
+ static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk)
+ {
+ struct inet_connection_sock *icsk = inet_csk(sk);
+ u32 elapsed, start_ts;
++ s32 remaining;
+
+- start_ts = tcp_retransmit_stamp(sk);
+- if (!icsk->icsk_user_timeout || !start_ts)
++ start_ts = tcp_sk(sk)->retrans_stamp;
++ if (!icsk->icsk_user_timeout)
+ return icsk->icsk_rto;
+ elapsed = tcp_time_stamp(tcp_sk(sk)) - start_ts;
+- if (elapsed >= icsk->icsk_user_timeout)
++ remaining = icsk->icsk_user_timeout - elapsed;
++ if (remaining <= 0)
+ return 1; /* user timeout has passed; fire ASAP */
+- else
+- return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(icsk->icsk_user_timeout - elapsed));
++
++ return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(remaining));
+ }
+
+ /**
+@@ -172,7 +160,20 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
+ tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
+ }
+
++static unsigned int tcp_model_timeout(struct sock *sk,
++ unsigned int boundary,
++ unsigned int rto_base)
++{
++ unsigned int linear_backoff_thresh, timeout;
+
++ linear_backoff_thresh = ilog2(TCP_RTO_MAX / rto_base);
++ if (boundary <= linear_backoff_thresh)
++ timeout = ((2 << boundary) - 1) * rto_base;
++ else
++ timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
++ (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
++ return jiffies_to_msecs(timeout);
++}
+ /**
+ * retransmits_timed_out() - returns true if this connection has timed out
+ * @sk: The current socket
+@@ -190,27 +191,21 @@ static bool retransmits_timed_out(struct sock *sk,
+ unsigned int boundary,
+ unsigned int timeout)
+ {
+- const unsigned int rto_base = TCP_RTO_MIN;
+- unsigned int linear_backoff_thresh, start_ts;
++ unsigned int start_ts;
+
+ if (!inet_csk(sk)->icsk_retransmits)
+ return false;
+
+- start_ts = tcp_retransmit_stamp(sk);
+- if (!start_ts)
+- return false;
+-
++ start_ts = tcp_sk(sk)->retrans_stamp;
+ if (likely(timeout == 0)) {
+- linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
+-
+- if (boundary <= linear_backoff_thresh)
+- timeout = ((2 << boundary) - 1) * rto_base;
+- else
+- timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
+- (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
+- timeout = jiffies_to_msecs(timeout);
++ unsigned int rto_base = TCP_RTO_MIN;
++
++ if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))
++ rto_base = tcp_timeout_init(sk);
++ timeout = tcp_model_timeout(sk, boundary, rto_base);
+ }
+- return (tcp_time_stamp(tcp_sk(sk)) - start_ts) >= timeout;
++
++ return (s32)(tcp_time_stamp(tcp_sk(sk)) - start_ts - timeout) >= 0;
+ }
+
+ /* A write timeout has occurred. Process the after effects. */
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 32f0d1bb3b6d5..e62de979ee30c 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -935,7 +935,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ __be16 dport;
+ u8 tos;
+ int err, is_udplite = IS_UDPLITE(sk);
+- int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
++ int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE;
+ int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
+ struct sk_buff *skb;
+ struct ip_options_data opt_copy;
+@@ -1243,7 +1243,7 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset,
+ }
+
+ up->len += size;
+- if (!(up->corkflag || (flags&MSG_MORE)))
++ if (!(READ_ONCE(up->corkflag) || (flags&MSG_MORE)))
+ ret = udp_push_pending_frames(sk);
+ if (!ret)
+ ret = size;
+@@ -2468,9 +2468,9 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
+ switch (optname) {
+ case UDP_CORK:
+ if (val != 0) {
+- up->corkflag = 1;
++ WRITE_ONCE(up->corkflag, 1);
+ } else {
+- up->corkflag = 0;
++ WRITE_ONCE(up->corkflag, 0);
+ lock_sock(sk);
+ push_pending_frames(sk);
+ release_sock(sk);
+@@ -2583,7 +2583,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
+
+ switch (optname) {
+ case UDP_CORK:
+- val = up->corkflag;
++ val = READ_ONCE(up->corkflag);
+ break;
+
+ case UDP_ENCAP:
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 042ab5428a4ff..0198910c2bf27 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1169,7 +1169,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ int addr_len = msg->msg_namelen;
+ bool connected = false;
+ int ulen = len;
+- int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
++ int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE;
+ int err;
+ int is_udplite = IS_UDPLITE(sk);
+ int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 5c5908127fcb5..74045e927e044 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -2126,7 +2126,11 @@ static bool ieee80211_parse_tx_radiotap(struct ieee80211_local *local,
+ }
+
+ vht_mcs = iterator.this_arg[4] >> 4;
++ if (vht_mcs > 11)
++ vht_mcs = 0;
+ vht_nss = iterator.this_arg[4] & 0xF;
++ if (!vht_nss || vht_nss > 8)
++ vht_nss = 1;
+ break;
+
+ /*
+@@ -3264,6 +3268,14 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
+ if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
+ goto out;
+
++ /* If n == 2, the "while (*frag_tail)" loop above didn't execute
++ * and frag_tail should be &skb_shinfo(head)->frag_list.
++ * However, ieee80211_amsdu_prepare_head() can reallocate it.
++ * Reload frag_tail to have it pointing to the correct place.
++ */
++ if (n == 2)
++ frag_tail = &skb_shinfo(head)->frag_list;
++
+ /*
+ * Pad out the previous subframe to a multiple of 4 by adding the
+ * padding to the next one, that's being added. Note that head->len
+diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
+index dbeccccf0fdf3..b1d2e2b54f85a 100644
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -523,6 +523,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
+ return RX_DROP_UNUSABLE;
+ }
+
++ /* reload hdr - skb might have been reallocated */
++ hdr = (void *)rx->skb->data;
++
+ data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
+ if (!rx->sta || data_len < 0)
+ return RX_DROP_UNUSABLE;
+@@ -752,6 +755,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
+ return RX_DROP_UNUSABLE;
+ }
+
++ /* reload hdr - skb might have been reallocated */
++ hdr = (void *)rx->skb->data;
++
+ data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
+ if (!rx->sta || data_len < 0)
+ return RX_DROP_UNUSABLE;
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index 154b40f2f2a8c..b4b4745563398 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -104,11 +104,11 @@ htable_size(u8 hbits)
+ {
+ size_t hsize;
+
+- /* We must fit both into u32 in jhash and size_t */
++ /* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */
+ if (hbits > 31)
+ return 0;
+ hsize = jhash_size(hbits);
+- if ((((size_t)-1) - sizeof(struct htable)) / sizeof(struct hbucket *)
++ if ((INT_MAX - sizeof(struct htable)) / sizeof(struct hbucket *)
+ < hsize)
+ return 0;
+
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index 5b2b17867cb1b..2780a847701e6 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -1399,6 +1399,10 @@ int __init ip_vs_conn_init(void)
+ int idx;
+
+ /* Compute size and mask */
++ if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 20) {
++ pr_info("conn_tab_bits not in [8, 20]. Using default value\n");
++ ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS;
++ }
+ ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
+ ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1;
+
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index 8b7c07fc66d4b..64dc2923a21b0 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -687,7 +687,7 @@ static int sctp_rcv_ootb(struct sk_buff *skb)
+ ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch);
+
+ /* Break out if chunk length is less then minimal. */
+- if (ntohs(ch->length) < sizeof(_ch))
++ if (!ch || ntohs(ch->length) < sizeof(_ch))
+ break;
+
+ ch_end = offset + SCTP_PAD4(ntohs(ch->length));
+diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
+index aa9a17ac1f7b3..063acfbdcd893 100644
+--- a/net/smc/smc_clc.c
++++ b/net/smc/smc_clc.c
+@@ -162,7 +162,8 @@ static int smc_clc_prfx_set(struct socket *clcsock,
+ goto out_rel;
+ }
+ /* get address to which the internal TCP socket is bound */
+- kernel_getsockname(clcsock, (struct sockaddr *)&addrs);
++ if (kernel_getsockname(clcsock, (struct sockaddr *)&addrs) < 0)
++ goto out_rel;
+ /* analyze IP specific data of net_device belonging to TCP socket */
+ addr6 = (struct sockaddr_in6 *)&addrs;
+ rcu_read_lock();
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index c293a558b0d4f..82279dbd2f627 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -600,20 +600,42 @@ static void unix_release_sock(struct sock *sk, int embrion)
+
+ static void init_peercred(struct sock *sk)
+ {
+- put_pid(sk->sk_peer_pid);
+- if (sk->sk_peer_cred)
+- put_cred(sk->sk_peer_cred);
++ const struct cred *old_cred;
++ struct pid *old_pid;
++
++ spin_lock(&sk->sk_peer_lock);
++ old_pid = sk->sk_peer_pid;
++ old_cred = sk->sk_peer_cred;
+ sk->sk_peer_pid = get_pid(task_tgid(current));
+ sk->sk_peer_cred = get_current_cred();
++ spin_unlock(&sk->sk_peer_lock);
++
++ put_pid(old_pid);
++ put_cred(old_cred);
+ }
+
+ static void copy_peercred(struct sock *sk, struct sock *peersk)
+ {
+- put_pid(sk->sk_peer_pid);
+- if (sk->sk_peer_cred)
+- put_cred(sk->sk_peer_cred);
++ const struct cred *old_cred;
++ struct pid *old_pid;
++
++ if (sk < peersk) {
++ spin_lock(&sk->sk_peer_lock);
++ spin_lock_nested(&peersk->sk_peer_lock, SINGLE_DEPTH_NESTING);
++ } else {
++ spin_lock(&peersk->sk_peer_lock);
++ spin_lock_nested(&sk->sk_peer_lock, SINGLE_DEPTH_NESTING);
++ }
++ old_pid = sk->sk_peer_pid;
++ old_cred = sk->sk_peer_cred;
+ sk->sk_peer_pid = get_pid(peersk->sk_peer_pid);
+ sk->sk_peer_cred = get_cred(peersk->sk_peer_cred);
++
++ spin_unlock(&sk->sk_peer_lock);
++ spin_unlock(&peersk->sk_peer_lock);
++
++ put_pid(old_pid);
++ put_cred(old_cred);
+ }
+
+ static int unix_listen(struct socket *sock, int backlog)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-10-09 21:33 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-10-09 21:33 UTC (permalink / raw
To: gentoo-commits
commit: e0ed91d875b7041d075a0d368cbda8da8b62e4a6
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 9 21:33:08 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Oct 9 21:33:08 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e0ed91d8
Linux patch 4.19.210
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1209_linux-4.19.210.patch | 437 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 441 insertions(+)
diff --git a/0000_README b/0000_README
index fbfd59f..c0c1a0a 100644
--- a/0000_README
+++ b/0000_README
@@ -875,6 +875,10 @@ Patch: 1208_linux-4.19.209.patch
From: https://www.kernel.org
Desc: Linux 4.19.209
+Patch: 1209_linux-4.19.210.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.210
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1209_linux-4.19.210.patch b/1209_linux-4.19.210.patch
new file mode 100644
index 0000000..db4285b
--- /dev/null
+++ b/1209_linux-4.19.210.patch
@@ -0,0 +1,437 @@
+diff --git a/Makefile b/Makefile
+index a144a7117a1bd..d9c39b3c05d56 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 209
++SUBLEVEL = 210
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/sparc/lib/iomap.c b/arch/sparc/lib/iomap.c
+index c9da9f139694d..f3a8cd491ce0d 100644
+--- a/arch/sparc/lib/iomap.c
++++ b/arch/sparc/lib/iomap.c
+@@ -19,8 +19,10 @@ void ioport_unmap(void __iomem *addr)
+ EXPORT_SYMBOL(ioport_map);
+ EXPORT_SYMBOL(ioport_unmap);
+
++#ifdef CONFIG_PCI
+ void pci_iounmap(struct pci_dev *dev, void __iomem * addr)
+ {
+ /* nothing to do */
+ }
+ EXPORT_SYMBOL(pci_iounmap);
++#endif
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index b95a4194a68db..897360a56fddd 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2268,6 +2268,25 @@ static void ata_dev_config_ncq_prio(struct ata_device *dev)
+
+ }
+
++static bool ata_dev_check_adapter(struct ata_device *dev,
++ unsigned short vendor_id)
++{
++ struct pci_dev *pcidev = NULL;
++ struct device *parent_dev = NULL;
++
++ for (parent_dev = dev->tdev.parent; parent_dev != NULL;
++ parent_dev = parent_dev->parent) {
++ if (dev_is_pci(parent_dev)) {
++ pcidev = to_pci_dev(parent_dev);
++ if (pcidev->vendor == vendor_id)
++ return true;
++ break;
++ }
++ }
++
++ return false;
++}
++
+ static int ata_dev_config_ncq(struct ata_device *dev,
+ char *desc, size_t desc_sz)
+ {
+@@ -2284,6 +2303,13 @@ static int ata_dev_config_ncq(struct ata_device *dev,
+ snprintf(desc, desc_sz, "NCQ (not used)");
+ return 0;
+ }
++
++ if (dev->horkage & ATA_HORKAGE_NO_NCQ_ON_ATI &&
++ ata_dev_check_adapter(dev, PCI_VENDOR_ID_ATI)) {
++ snprintf(desc, desc_sz, "NCQ (not used)");
++ return 0;
++ }
++
+ if (ap->flags & ATA_FLAG_NCQ) {
+ hdepth = min(ap->scsi_host->can_queue, ATA_MAX_QUEUE);
+ dev->flags |= ATA_DFLAG_NCQ;
+@@ -4575,9 +4601,11 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Samsung SSD 860*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+- ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ ATA_HORKAGE_ZERO_AFTER_TRIM |
++ ATA_HORKAGE_NO_NCQ_ON_ATI, },
+ { "Samsung SSD 870*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+- ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ ATA_HORKAGE_ZERO_AFTER_TRIM |
++ ATA_HORKAGE_NO_NCQ_ON_ATI, },
+ { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+
+@@ -6934,6 +6962,8 @@ static int __init ata_parse_force_one(char **cur,
+ { "ncq", .horkage_off = ATA_HORKAGE_NONCQ },
+ { "noncqtrim", .horkage_on = ATA_HORKAGE_NO_NCQ_TRIM },
+ { "ncqtrim", .horkage_off = ATA_HORKAGE_NO_NCQ_TRIM },
++ { "noncqati", .horkage_on = ATA_HORKAGE_NO_NCQ_ON_ATI },
++ { "ncqati", .horkage_off = ATA_HORKAGE_NO_NCQ_ON_ATI },
+ { "dump_id", .horkage_on = ATA_HORKAGE_DUMP_ID },
+ { "pio0", .xfer_mask = 1 << (ATA_SHIFT_PIO + 0) },
+ { "pio1", .xfer_mask = 1 << (ATA_SHIFT_PIO + 1) },
+diff --git a/drivers/net/phy/mdio_device.c b/drivers/net/phy/mdio_device.c
+index c924700cf37b5..922f0f8973b65 100644
+--- a/drivers/net/phy/mdio_device.c
++++ b/drivers/net/phy/mdio_device.c
+@@ -176,6 +176,16 @@ static int mdio_remove(struct device *dev)
+ return 0;
+ }
+
++static void mdio_shutdown(struct device *dev)
++{
++ struct mdio_device *mdiodev = to_mdio_device(dev);
++ struct device_driver *drv = mdiodev->dev.driver;
++ struct mdio_driver *mdiodrv = to_mdio_driver(drv);
++
++ if (mdiodrv->shutdown)
++ mdiodrv->shutdown(mdiodev);
++}
++
+ /**
+ * mdio_driver_register - register an mdio_driver with the MDIO layer
+ * @new_driver: new mdio_driver to register
+@@ -190,6 +200,7 @@ int mdio_driver_register(struct mdio_driver *drv)
+ mdiodrv->driver.bus = &mdio_bus_type;
+ mdiodrv->driver.probe = mdio_probe;
+ mdiodrv->driver.remove = mdio_remove;
++ mdiodrv->driver.shutdown = mdio_shutdown;
+
+ retval = driver_register(&mdiodrv->driver);
+ if (retval) {
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 41bdfb684d468..4d0d5501ca56f 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -492,7 +492,7 @@ check_frags:
+ * the header's copy failed, and they are
+ * sharing a slot, send an error
+ */
+- if (i == 0 && sharedslot)
++ if (i == 0 && !first_shinfo && sharedslot)
+ xenvif_idx_release(queue, pending_idx,
+ XEN_NETIF_RSP_ERROR);
+ else
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 342352d8e7bf9..ed3702dadd30a 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3444,15 +3444,16 @@ static int sd_probe(struct device *dev)
+ }
+
+ device_initialize(&sdkp->dev);
+- sdkp->dev.parent = dev;
++ sdkp->dev.parent = get_device(dev);
+ sdkp->dev.class = &sd_disk_class;
+ dev_set_name(&sdkp->dev, "%s", dev_name(dev));
+
+ error = device_add(&sdkp->dev);
+- if (error)
+- goto out_free_index;
++ if (error) {
++ put_device(&sdkp->dev);
++ goto out;
++ }
+
+- get_device(dev);
+ dev_set_drvdata(dev, sdkp);
+
+ get_device(&sdkp->dev); /* prevent release before async_schedule */
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index 0fc39224ce1e4..caf35ca577ce3 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -103,9 +103,16 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
+ 0
+ };
+ unsigned char recv_page_code;
++ unsigned int retries = SES_RETRIES;
++ struct scsi_sense_hdr sshdr;
++
++ do {
++ ret = scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
++ &sshdr, SES_TIMEOUT, 1, NULL);
++ } while (ret > 0 && --retries && scsi_sense_valid(&sshdr) &&
++ (sshdr.sense_key == NOT_READY ||
++ (sshdr.sense_key == UNIT_ATTENTION && sshdr.asc == 0x29)));
+
+- ret = scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
+- NULL, SES_TIMEOUT, SES_RETRIES, NULL);
+ if (unlikely(ret))
+ return ret;
+
+@@ -137,9 +144,16 @@ static int ses_send_diag(struct scsi_device *sdev, int page_code,
+ bufflen & 0xff,
+ 0
+ };
++ struct scsi_sense_hdr sshdr;
++ unsigned int retries = SES_RETRIES;
++
++ do {
++ result = scsi_execute_req(sdev, cmd, DMA_TO_DEVICE, buf, bufflen,
++ &sshdr, SES_TIMEOUT, 1, NULL);
++ } while (result > 0 && --retries && scsi_sense_valid(&sshdr) &&
++ (sshdr.sense_key == NOT_READY ||
++ (sshdr.sense_key == UNIT_ATTENTION && sshdr.asc == 0x29)));
+
+- result = scsi_execute_req(sdev, cmd, DMA_TO_DEVICE, buf, bufflen,
+- NULL, SES_TIMEOUT, SES_RETRIES, NULL);
+ if (result)
+ sdev_printk(KERN_ERR, sdev, "SEND DIAGNOSTIC result: %8x\n",
+ result);
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 58e53e3d905be..22c4d554865ee 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -5234,6 +5234,10 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
+ hcd->has_tt = 1;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res) {
++ retval = -EINVAL;
++ goto error1;
++ }
+ hcd->rsrc_start = res->start;
+ hcd->rsrc_len = resource_size(res);
+
+diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
+index 33db13365c5eb..fc59e0557e506 100644
+--- a/fs/ext2/balloc.c
++++ b/fs/ext2/balloc.c
+@@ -48,10 +48,9 @@ struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb,
+ struct ext2_sb_info *sbi = EXT2_SB(sb);
+
+ if (block_group >= sbi->s_groups_count) {
+- ext2_error (sb, "ext2_get_group_desc",
+- "block_group >= groups_count - "
+- "block_group = %d, groups_count = %lu",
+- block_group, sbi->s_groups_count);
++ WARN(1, "block_group >= groups_count - "
++ "block_group = %d, groups_count = %lu",
++ block_group, sbi->s_groups_count);
+
+ return NULL;
+ }
+@@ -59,10 +58,9 @@ struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb,
+ group_desc = block_group >> EXT2_DESC_PER_BLOCK_BITS(sb);
+ offset = block_group & (EXT2_DESC_PER_BLOCK(sb) - 1);
+ if (!sbi->s_group_desc[group_desc]) {
+- ext2_error (sb, "ext2_get_group_desc",
+- "Group descriptor not loaded - "
+- "block_group = %d, group_desc = %lu, desc = %lu",
+- block_group, group_desc, offset);
++ WARN(1, "Group descriptor not loaded - "
++ "block_group = %d, group_desc = %lu, desc = %lu",
++ block_group, group_desc, offset);
+ return NULL;
+ }
+
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 3d076aca7ac2a..6d9194fb38dfc 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -440,6 +440,7 @@ enum {
+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
+ ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */
+ ATA_HORKAGE_MAX_TRIM_128M = (1 << 26), /* Limit max trim size to 128M */
++ ATA_HORKAGE_NO_NCQ_ON_ATI = (1 << 27), /* Disable NCQ on ATI chipset */
+
+ /* DMA mask for user DMA control: User visible values; DO NOT
+ renumber */
+diff --git a/include/linux/mdio.h b/include/linux/mdio.h
+index bfa7114167d71..85325e110a796 100644
+--- a/include/linux/mdio.h
++++ b/include/linux/mdio.h
+@@ -66,6 +66,9 @@ struct mdio_driver {
+
+ /* Clears up any memory if needed */
+ void (*remove)(struct mdio_device *mdiodev);
++
++ /* Quiesces the device on system shutdown, turns off interrupts etc */
++ void (*shutdown)(struct mdio_device *mdiodev);
+ };
+ #define to_mdio_driver(d) \
+ container_of(to_mdio_common_driver(d), struct mdio_driver, mdiodrv)
+diff --git a/include/linux/timerqueue.h b/include/linux/timerqueue.h
+index 78b8cc73f12fc..aff122f1062a8 100644
+--- a/include/linux/timerqueue.h
++++ b/include/linux/timerqueue.h
+@@ -12,8 +12,7 @@ struct timerqueue_node {
+ };
+
+ struct timerqueue_head {
+- struct rb_root head;
+- struct timerqueue_node *next;
++ struct rb_root_cached rb_root;
+ };
+
+
+@@ -29,13 +28,14 @@ extern struct timerqueue_node *timerqueue_iterate_next(
+ *
+ * @head: head of timerqueue
+ *
+- * Returns a pointer to the timer node that has the
+- * earliest expiration time.
++ * Returns a pointer to the timer node that has the earliest expiration time.
+ */
+ static inline
+ struct timerqueue_node *timerqueue_getnext(struct timerqueue_head *head)
+ {
+- return head->next;
++ struct rb_node *leftmost = rb_first_cached(&head->rb_root);
++
++ return rb_entry(leftmost, struct timerqueue_node, node);
+ }
+
+ static inline void timerqueue_init(struct timerqueue_node *node)
+@@ -45,7 +45,6 @@ static inline void timerqueue_init(struct timerqueue_node *node)
+
+ static inline void timerqueue_init_head(struct timerqueue_head *head)
+ {
+- head->head = RB_ROOT;
+- head->next = NULL;
++ head->rb_root = RB_ROOT_CACHED;
+ }
+ #endif /* _LINUX_TIMERQUEUE_H */
+diff --git a/lib/timerqueue.c b/lib/timerqueue.c
+index 0d54bcbc8170c..7a8ae3d5fd405 100644
+--- a/lib/timerqueue.c
++++ b/lib/timerqueue.c
+@@ -39,9 +39,10 @@
+ */
+ bool timerqueue_add(struct timerqueue_head *head, struct timerqueue_node *node)
+ {
+- struct rb_node **p = &head->head.rb_node;
++ struct rb_node **p = &head->rb_root.rb_root.rb_node;
+ struct rb_node *parent = NULL;
+- struct timerqueue_node *ptr;
++ struct timerqueue_node *ptr;
++ bool leftmost = true;
+
+ /* Make sure we don't add nodes that are already added */
+ WARN_ON_ONCE(!RB_EMPTY_NODE(&node->node));
+@@ -49,19 +50,17 @@ bool timerqueue_add(struct timerqueue_head *head, struct timerqueue_node *node)
+ while (*p) {
+ parent = *p;
+ ptr = rb_entry(parent, struct timerqueue_node, node);
+- if (node->expires < ptr->expires)
++ if (node->expires < ptr->expires) {
+ p = &(*p)->rb_left;
+- else
++ } else {
+ p = &(*p)->rb_right;
++ leftmost = false;
++ }
+ }
+ rb_link_node(&node->node, parent, p);
+- rb_insert_color(&node->node, &head->head);
++ rb_insert_color_cached(&node->node, &head->rb_root, leftmost);
+
+- if (!head->next || node->expires < head->next->expires) {
+- head->next = node;
+- return true;
+- }
+- return false;
++ return leftmost;
+ }
+ EXPORT_SYMBOL_GPL(timerqueue_add);
+
+@@ -78,15 +77,10 @@ bool timerqueue_del(struct timerqueue_head *head, struct timerqueue_node *node)
+ {
+ WARN_ON_ONCE(RB_EMPTY_NODE(&node->node));
+
+- /* update next pointer */
+- if (head->next == node) {
+- struct rb_node *rbn = rb_next(&node->node);
+-
+- head->next = rb_entry_safe(rbn, struct timerqueue_node, node);
+- }
+- rb_erase(&node->node, &head->head);
++ rb_erase_cached(&node->node, &head->rb_root);
+ RB_CLEAR_NODE(&node->node);
+- return head->next != NULL;
++
++ return !RB_EMPTY_ROOT(&head->rb_root.rb_root);
+ }
+ EXPORT_SYMBOL_GPL(timerqueue_del);
+
+diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
+index a5d40653a9211..9700281bee4c3 100644
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -26,6 +26,7 @@ include $(top_srcdir)/scripts/subarch.include
+ ARCH ?= $(SUBARCH)
+
+ .PHONY: khdr
++.NOTPARALLEL:
+ khdr:
+ make ARCH=$(ARCH) -C $(top_srcdir) headers_install
+
+diff --git a/tools/usb/testusb.c b/tools/usb/testusb.c
+index 2d89b5f686b14..791aadef2d597 100644
+--- a/tools/usb/testusb.c
++++ b/tools/usb/testusb.c
+@@ -278,12 +278,6 @@ nomem:
+ }
+
+ entry->ifnum = ifnum;
+-
+- /* FIXME update USBDEVFS_CONNECTINFO so it tells about high speed etc */
+-
+- fprintf(stderr, "%s speed\t%s\t%u\n",
+- speed(entry->speed), entry->name, entry->ifnum);
+-
+ entry->next = testdevs;
+ testdevs = entry;
+ return 0;
+@@ -312,6 +306,14 @@ static void *handle_testdev (void *arg)
+ return 0;
+ }
+
++ status = ioctl(fd, USBDEVFS_GET_SPEED, NULL);
++ if (status < 0)
++ fprintf(stderr, "USBDEVFS_GET_SPEED failed %d\n", status);
++ else
++ dev->speed = status;
++ fprintf(stderr, "%s speed\t%s\t%u\n",
++ speed(dev->speed), dev->name, dev->ifnum);
++
+ restart:
+ for (i = 0; i < TEST_CASES; i++) {
+ if (dev->test != -1 && dev->test != i)
+diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
+index 1ff3a6c0367b0..89063b967b6b9 100644
+--- a/tools/vm/page-types.c
++++ b/tools/vm/page-types.c
+@@ -1341,7 +1341,7 @@ int main(int argc, char *argv[])
+ if (opt_list && opt_list_mapcnt)
+ kpagecount_fd = checked_open(PROC_KPAGECOUNT, O_RDONLY);
+
+- if (opt_mark_idle && opt_file)
++ if (opt_mark_idle)
+ page_idle_fd = checked_open(SYS_KERNEL_MM_PAGE_IDLE, O_RDWR);
+
+ if (opt_list && opt_pid)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-10-13 15:00 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2021-10-13 15:00 UTC (permalink / raw
To: gentoo-commits
commit: a564b9e2d597e3b892211ac546222ac3794b10aa
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 13 15:00:14 2021 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Oct 13 15:00:18 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a564b9e2
Linux patch 4.19.211
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1210_linux-4.19.211.patch | 663 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 667 insertions(+)
diff --git a/0000_README b/0000_README
index c0c1a0a..ac7acb4 100644
--- a/0000_README
+++ b/0000_README
@@ -879,6 +879,10 @@ Patch: 1209_linux-4.19.210.patch
From: https://www.kernel.org
Desc: Linux 4.19.210
+Patch: 1210_linux-4.19.211.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.211
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1210_linux-4.19.211.patch b/1210_linux-4.19.211.patch
new file mode 100644
index 0000000..eea7bdb
--- /dev/null
+++ b/1210_linux-4.19.211.patch
@@ -0,0 +1,663 @@
+diff --git a/Makefile b/Makefile
+index d9c39b3c05d56..d4e6f5d326b06 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 210
++SUBLEVEL = 211
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/omap3430-sdp.dts b/arch/arm/boot/dts/omap3430-sdp.dts
+index d652708f6bef5..56e3db08e9690 100644
+--- a/arch/arm/boot/dts/omap3430-sdp.dts
++++ b/arch/arm/boot/dts/omap3430-sdp.dts
+@@ -104,7 +104,7 @@
+
+ nand@1,0 {
+ compatible = "ti,omap2-nand";
+- reg = <0 0 4>; /* CS0, offset 0, IO size 4 */
++ reg = <1 0 4>; /* CS1, offset 0, IO size 4 */
+ interrupt-parent = <&gpmc>;
+ interrupts = <0 IRQ_TYPE_NONE>, /* fifoevent */
+ <1 IRQ_TYPE_NONE>; /* termcount */
+diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
+index d0153bbbdbeb8..00daa844bf8c6 100644
+--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
+@@ -1182,7 +1182,7 @@
+ };
+
+ gpu: adreno-3xx@4300000 {
+- compatible = "qcom,adreno-3xx";
++ compatible = "qcom,adreno-320.2", "qcom,adreno";
+ reg = <0x04300000 0x20000>;
+ reg-names = "kgsl_3d0_reg_memory";
+ interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
+@@ -1197,7 +1197,6 @@
+ <&mmcc GFX3D_AHB_CLK>,
+ <&mmcc GFX3D_AXI_CLK>,
+ <&mmcc MMSS_IMEM_AHB_CLK>;
+- qcom,chipid = <0x03020002>;
+
+ iommus = <&gfx3d 0
+ &gfx3d 1
+diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
+index 4bfefbec971a6..c3ca6e2cf7ffb 100644
+--- a/arch/arm/mach-imx/pm-imx6.c
++++ b/arch/arm/mach-imx/pm-imx6.c
+@@ -15,6 +15,7 @@
+ #include <linux/io.h>
+ #include <linux/irq.h>
+ #include <linux/genalloc.h>
++#include <linux/irqchip/arm-gic.h>
+ #include <linux/mfd/syscon.h>
+ #include <linux/mfd/syscon/imx6q-iomuxc-gpr.h>
+ #include <linux/of.h>
+@@ -622,6 +623,7 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata
+
+ static void imx6_pm_stby_poweroff(void)
+ {
++ gic_cpu_if_down(0);
+ imx6_set_lpm(STOP_POWER_OFF);
+ imx6q_suspend_finish(0);
+
+diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
+index 79b12e7445373..dade3a3ba6662 100644
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -39,6 +39,10 @@
+ * +-----+
+ * |RSVD | JIT scratchpad
+ * current ARM_SP => +-----+ <= (BPF_FP - STACK_SIZE + SCRATCH_SIZE)
++ * | ... | caller-saved registers
++ * +-----+
++ * | ... | arguments passed on stack
++ * ARM_SP during call => +-----|
+ * | |
+ * | ... | Function call stack
+ * | |
+@@ -66,6 +70,12 @@
+ *
+ * When popping registers off the stack at the end of a BPF function, we
+ * reference them via the current ARM_FP register.
++ *
++ * Some eBPF operations are implemented via a call to a helper function.
++ * Such calls are "invisible" in the eBPF code, so it is up to the calling
++ * program to preserve any caller-saved ARM registers during the call. The
++ * JIT emits code to push and pop those registers onto the stack, immediately
++ * above the callee stack frame.
+ */
+ #define CALLEE_MASK (1 << ARM_R4 | 1 << ARM_R5 | 1 << ARM_R6 | \
+ 1 << ARM_R7 | 1 << ARM_R8 | 1 << ARM_R9 | \
+@@ -73,6 +83,8 @@
+ #define CALLEE_PUSH_MASK (CALLEE_MASK | 1 << ARM_LR)
+ #define CALLEE_POP_MASK (CALLEE_MASK | 1 << ARM_PC)
+
++#define CALLER_MASK (1 << ARM_R0 | 1 << ARM_R1 | 1 << ARM_R2 | 1 << ARM_R3)
++
+ enum {
+ /* Stack layout - these are offsets from (top of stack - 4) */
+ BPF_R2_HI,
+@@ -467,6 +479,7 @@ static inline int epilogue_offset(const struct jit_ctx *ctx)
+
+ static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op)
+ {
++ const int exclude_mask = BIT(ARM_R0) | BIT(ARM_R1);
+ const s8 *tmp = bpf2a32[TMP_REG_1];
+
+ #if __LINUX_ARM_ARCH__ == 7
+@@ -498,11 +511,17 @@ static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op)
+ emit(ARM_MOV_R(ARM_R0, rm), ctx);
+ }
+
++ /* Push caller-saved registers on stack */
++ emit(ARM_PUSH(CALLER_MASK & ~exclude_mask), ctx);
++
+ /* Call appropriate function */
+ emit_mov_i(ARM_IP, op == BPF_DIV ?
+ (u32)jit_udiv32 : (u32)jit_mod32, ctx);
+ emit_blx_r(ARM_IP, ctx);
+
++ /* Restore caller-saved registers from stack */
++ emit(ARM_POP(CALLER_MASK & ~exclude_mask), ctx);
++
+ /* Save return value */
+ if (rd != ARM_R0)
+ emit(ARM_MOV_R(rd, ARM_R0), ctx);
+diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
+index 4d8cb9bb8365d..43e6597c720c2 100644
+--- a/arch/mips/net/bpf_jit.c
++++ b/arch/mips/net/bpf_jit.c
+@@ -662,6 +662,11 @@ static void build_epilogue(struct jit_ctx *ctx)
+ ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative : func) : \
+ func##_positive)
+
++static bool is_bad_offset(int b_off)
++{
++ return b_off > 0x1ffff || b_off < -0x20000;
++}
++
+ static int build_body(struct jit_ctx *ctx)
+ {
+ const struct bpf_prog *prog = ctx->skf;
+@@ -728,7 +733,10 @@ load_common:
+ /* Load return register on DS for failures */
+ emit_reg_move(r_ret, r_zero, ctx);
+ /* Return with error */
+- emit_b(b_imm(prog->len, ctx), ctx);
++ b_off = b_imm(prog->len, ctx);
++ if (is_bad_offset(b_off))
++ return -E2BIG;
++ emit_b(b_off, ctx);
+ emit_nop(ctx);
+ break;
+ case BPF_LD | BPF_W | BPF_IND:
+@@ -775,8 +783,10 @@ load_ind:
+ emit_jalr(MIPS_R_RA, r_s0, ctx);
+ emit_reg_move(MIPS_R_A0, r_skb, ctx); /* delay slot */
+ /* Check the error value */
+- emit_bcond(MIPS_COND_NE, r_ret, 0,
+- b_imm(prog->len, ctx), ctx);
++ b_off = b_imm(prog->len, ctx);
++ if (is_bad_offset(b_off))
++ return -E2BIG;
++ emit_bcond(MIPS_COND_NE, r_ret, 0, b_off, ctx);
+ emit_reg_move(r_ret, r_zero, ctx);
+ /* We are good */
+ /* X <- P[1:K] & 0xf */
+@@ -855,8 +865,10 @@ load_ind:
+ /* A /= X */
+ ctx->flags |= SEEN_X | SEEN_A;
+ /* Check if r_X is zero */
+- emit_bcond(MIPS_COND_EQ, r_X, r_zero,
+- b_imm(prog->len, ctx), ctx);
++ b_off = b_imm(prog->len, ctx);
++ if (is_bad_offset(b_off))
++ return -E2BIG;
++ emit_bcond(MIPS_COND_EQ, r_X, r_zero, b_off, ctx);
+ emit_load_imm(r_ret, 0, ctx); /* delay slot */
+ emit_div(r_A, r_X, ctx);
+ break;
+@@ -864,8 +876,10 @@ load_ind:
+ /* A %= X */
+ ctx->flags |= SEEN_X | SEEN_A;
+ /* Check if r_X is zero */
+- emit_bcond(MIPS_COND_EQ, r_X, r_zero,
+- b_imm(prog->len, ctx), ctx);
++ b_off = b_imm(prog->len, ctx);
++ if (is_bad_offset(b_off))
++ return -E2BIG;
++ emit_bcond(MIPS_COND_EQ, r_X, r_zero, b_off, ctx);
+ emit_load_imm(r_ret, 0, ctx); /* delay slot */
+ emit_mod(r_A, r_X, ctx);
+ break;
+@@ -926,7 +940,10 @@ load_ind:
+ break;
+ case BPF_JMP | BPF_JA:
+ /* pc += K */
+- emit_b(b_imm(i + k + 1, ctx), ctx);
++ b_off = b_imm(i + k + 1, ctx);
++ if (is_bad_offset(b_off))
++ return -E2BIG;
++ emit_b(b_off, ctx);
+ emit_nop(ctx);
+ break;
+ case BPF_JMP | BPF_JEQ | BPF_K:
+@@ -1056,12 +1073,16 @@ jmp_cmp:
+ break;
+ case BPF_RET | BPF_A:
+ ctx->flags |= SEEN_A;
+- if (i != prog->len - 1)
++ if (i != prog->len - 1) {
+ /*
+ * If this is not the last instruction
+ * then jump to the epilogue
+ */
+- emit_b(b_imm(prog->len, ctx), ctx);
++ b_off = b_imm(prog->len, ctx);
++ if (is_bad_offset(b_off))
++ return -E2BIG;
++ emit_b(b_off, ctx);
++ }
+ emit_reg_move(r_ret, r_A, ctx); /* delay slot */
+ break;
+ case BPF_RET | BPF_K:
+@@ -1075,7 +1096,10 @@ jmp_cmp:
+ * If this is not the last instruction
+ * then jump to the epilogue
+ */
+- emit_b(b_imm(prog->len, ctx), ctx);
++ b_off = b_imm(prog->len, ctx);
++ if (is_bad_offset(b_off))
++ return -E2BIG;
++ emit_b(b_off, ctx);
+ emit_nop(ctx);
+ }
+ break;
+@@ -1133,8 +1157,10 @@ jmp_cmp:
+ /* Load *dev pointer */
+ emit_load_ptr(r_s0, r_skb, off, ctx);
+ /* error (0) in the delay slot */
+- emit_bcond(MIPS_COND_EQ, r_s0, r_zero,
+- b_imm(prog->len, ctx), ctx);
++ b_off = b_imm(prog->len, ctx);
++ if (is_bad_offset(b_off))
++ return -E2BIG;
++ emit_bcond(MIPS_COND_EQ, r_s0, r_zero, b_off, ctx);
+ emit_reg_move(r_ret, r_zero, ctx);
+ if (code == (BPF_ANC | SKF_AD_IFINDEX)) {
+ BUILD_BUG_ON(FIELD_SIZEOF(struct net_device, ifindex) != 4);
+@@ -1244,7 +1270,10 @@ void bpf_jit_compile(struct bpf_prog *fp)
+
+ /* Generate the actual JIT code */
+ build_prologue(&ctx);
+- build_body(&ctx);
++ if (build_body(&ctx)) {
++ module_memfree(ctx.target);
++ goto out;
++ }
+ build_epilogue(&ctx);
+
+ /* Update the icache */
+diff --git a/arch/powerpc/boot/dts/fsl/t1023rdb.dts b/arch/powerpc/boot/dts/fsl/t1023rdb.dts
+index 5ba6fbfca2742..f82f85c65964c 100644
+--- a/arch/powerpc/boot/dts/fsl/t1023rdb.dts
++++ b/arch/powerpc/boot/dts/fsl/t1023rdb.dts
+@@ -154,7 +154,7 @@
+
+ fm1mac3: ethernet@e4000 {
+ phy-handle = <&sgmii_aqr_phy3>;
+- phy-connection-type = "sgmii-2500";
++ phy-connection-type = "2500base-x";
+ sleep = <&rcpm 0x20000000>;
+ };
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index d994501d9179f..3dd2949b2b356 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -1387,7 +1387,7 @@ config HIGHMEM4G
+
+ config HIGHMEM64G
+ bool "64GB"
+- depends on !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !WINCHIP3D && !MK6
++ depends on !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !MWINCHIP3D && !MK6
+ select X86_PAE
+ ---help---
+ Select this if you have a 32-bit processor and more than 4
+diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c
+index a48bf2d10ac2d..80cc9770a8d2d 100644
+--- a/arch/xtensa/kernel/irq.c
++++ b/arch/xtensa/kernel/irq.c
+@@ -145,7 +145,7 @@ unsigned xtensa_get_ext_irq_no(unsigned irq)
+
+ void __init init_IRQ(void)
+ {
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+ irqchip_init();
+ #else
+ #ifdef CONFIG_HAVE_SMP
+diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+index 4561a786fab07..cce4833a60832 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c
++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+@@ -185,6 +185,7 @@ static const struct file_operations nouveau_pstate_fops = {
+ .open = nouveau_debugfs_pstate_open,
+ .read = seq_read,
+ .write = nouveau_debugfs_pstate_set,
++ .release = single_release,
+ };
+
+ static struct drm_info_list nouveau_debugfs_list[] = {
+diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
+index 8ba4122fb3404..8288cfb44cb2c 100644
+--- a/drivers/i2c/i2c-core-acpi.c
++++ b/drivers/i2c/i2c-core-acpi.c
+@@ -395,6 +395,7 @@ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value,
+ break;
+
+ i2c_acpi_register_device(adapter, adev, &info);
++ put_device(&adapter->dev);
+ break;
+ case ACPI_RECONFIG_DEVICE_REMOVE:
+ if (!acpi_device_enumerated(adev))
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 246734be51775..062b942517822 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -4724,7 +4724,8 @@ static void i40e_clear_interrupt_scheme(struct i40e_pf *pf)
+ {
+ int i;
+
+- i40e_free_misc_vector(pf);
++ if (test_bit(__I40E_MISC_IRQ_REQUESTED, pf->state))
++ i40e_free_misc_vector(pf);
+
+ i40e_put_lump(pf->irq_pile, pf->iwarp_base_vector,
+ I40E_IWARP_IRQ_PILE_ID);
+@@ -9068,7 +9069,7 @@ static int i40e_get_capabilities(struct i40e_pf *pf,
+ if (pf->hw.aq.asq_last_status == I40E_AQ_RC_ENOMEM) {
+ /* retry with a larger buffer */
+ buf_len = data_size;
+- } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK) {
++ } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK || err) {
+ dev_info(&pf->pdev->dev,
+ "capability discovery failed, err %s aq_err %s\n",
+ i40e_stat_str(&pf->hw, err),
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index 08c81d4cfca86..3207da2224f67 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -378,6 +378,13 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
+ bus->dev.groups = NULL;
+ dev_set_name(&bus->dev, "%s", bus->id);
+
++ /* We need to set state to MDIOBUS_UNREGISTERED to correctly release
++ * the device in mdiobus_free()
++ *
++ * State will be updated later in this function in case of success
++ */
++ bus->state = MDIOBUS_UNREGISTERED;
++
+ err = device_register(&bus->dev);
+ if (err) {
+ pr_err("mii_bus %s failed to register\n", bus->id);
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 47d518e6d5d4f..71bafc8f5ed02 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -113,7 +113,7 @@ static const char * const sm_state_strings[] = {
+ [SFP_S_LINK_UP] = "link_up",
+ [SFP_S_TX_FAULT] = "tx_fault",
+ [SFP_S_REINIT] = "reinit",
+- [SFP_S_TX_DISABLE] = "rx_disable",
++ [SFP_S_TX_DISABLE] = "tx_disable",
+ };
+
+ static const char *sm_state_to_str(unsigned short sm_state)
+diff --git a/drivers/ptp/ptp_pch.c b/drivers/ptp/ptp_pch.c
+index 78ccf936d3560..84feaa140f1b3 100644
+--- a/drivers/ptp/ptp_pch.c
++++ b/drivers/ptp/ptp_pch.c
+@@ -695,6 +695,7 @@ static const struct pci_device_id pch_ieee1588_pcidev_id[] = {
+ },
+ {0}
+ };
++MODULE_DEVICE_TABLE(pci, pch_ieee1588_pcidev_id);
+
+ static struct pci_driver pch_driver = {
+ .name = KBUILD_MODNAME,
+diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
+index 70e6c956c23ce..a9f12a52f7265 100644
+--- a/drivers/usb/Kconfig
++++ b/drivers/usb/Kconfig
+@@ -175,8 +175,7 @@ source "drivers/usb/roles/Kconfig"
+
+ config USB_LED_TRIG
+ bool "USB LED Triggers"
+- depends on LEDS_CLASS && LEDS_TRIGGERS
+- select USB_COMMON
++ depends on LEDS_CLASS && USB_COMMON && LEDS_TRIGGERS
+ help
+ This option adds LED triggers for USB host and/or gadget activity.
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 6959231d63b3e..0522bd2d9d3cc 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -339,6 +339,9 @@ static void acm_process_notification(struct acm *acm, unsigned char *buf)
+ acm->iocount.overrun++;
+ spin_unlock_irqrestore(&acm->read_lock, flags);
+
++ if (newctrl & ACM_CTRL_BRK)
++ tty_flip_buffer_push(&acm->port);
++
+ if (difference)
+ wake_up_all(&acm->wioctl);
+
+@@ -474,11 +477,16 @@ static int acm_submit_read_urbs(struct acm *acm, gfp_t mem_flags)
+
+ static void acm_process_read_urb(struct acm *acm, struct urb *urb)
+ {
++ unsigned long flags;
++
+ if (!urb->actual_length)
+ return;
+
++ spin_lock_irqsave(&acm->read_lock, flags);
+ tty_insert_flip_string(&acm->port, urb->transfer_buffer,
+ urb->actual_length);
++ spin_unlock_irqrestore(&acm->read_lock, flags);
++
+ tty_flip_buffer_push(&acm->port);
+ }
+
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index 2459e2afd65ec..19906020eb145 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -508,12 +508,12 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
+ }
+
+ /*
+- * Stop waiting if either state is not BP_EAGAIN and ballooning action is
+- * needed, or if the credit has changed while state is BP_EAGAIN.
++ * Stop waiting if either state is BP_DONE and ballooning action is
++ * needed, or if the credit has changed while state is not BP_DONE.
+ */
+ static bool balloon_thread_cond(enum bp_state state, long credit)
+ {
+- if (state != BP_EAGAIN)
++ if (state == BP_DONE)
+ credit = 0;
+
+ return current_credit() != credit || kthread_should_stop();
+@@ -533,10 +533,19 @@ static int balloon_thread(void *unused)
+
+ set_freezable();
+ for (;;) {
+- if (state == BP_EAGAIN)
+- timeout = balloon_stats.schedule_delay * HZ;
+- else
++ switch (state) {
++ case BP_DONE:
++ case BP_ECANCELED:
+ timeout = 3600 * HZ;
++ break;
++ case BP_EAGAIN:
++ timeout = balloon_stats.schedule_delay * HZ;
++ break;
++ case BP_WAIT:
++ timeout = HZ;
++ break;
++ }
++
+ credit = current_credit();
+
+ wait_event_freezable_timeout(balloon_thread_wq,
+diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
+index a8486432be05a..74ff28fda64dc 100644
+--- a/drivers/xen/privcmd.c
++++ b/drivers/xen/privcmd.c
+@@ -835,11 +835,12 @@ static long privcmd_ioctl_mmap_resource(struct file *file,
+ unsigned int domid =
+ (xdata.flags & XENMEM_rsrc_acq_caller_owned) ?
+ DOMID_SELF : kdata.dom;
+- int num;
++ int num, *errs = (int *)pfns;
+
++ BUILD_BUG_ON(sizeof(*errs) > sizeof(*pfns));
+ num = xen_remap_domain_mfn_array(vma,
+ kdata.addr & PAGE_MASK,
+- pfns, kdata.num, (int *)pfns,
++ pfns, kdata.num, errs,
+ vma->vm_page_prot,
+ domid,
+ vma->vm_private_data);
+@@ -849,7 +850,7 @@ static long privcmd_ioctl_mmap_resource(struct file *file,
+ unsigned int i;
+
+ for (i = 0; i < num; i++) {
+- rc = pfns[i];
++ rc = errs[i];
+ if (rc < 0)
+ break;
+ }
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index db0beefe65ec2..f67c5de1aeb8d 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -3124,15 +3124,18 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
+ goto fail;
+ cd->rd_maxcount -= entry_bytes;
+ /*
+- * RFC 3530 14.2.24 describes rd_dircount as only a "hint", so
+- * let's always let through the first entry, at least:
++ * RFC 3530 14.2.24 describes rd_dircount as only a "hint", and
++ * notes that it could be zero. If it is zero, then the server
++ * should enforce only the rd_maxcount value.
+ */
+- if (!cd->rd_dircount)
+- goto fail;
+- name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8;
+- if (name_and_cookie > cd->rd_dircount && cd->cookie_offset)
+- goto fail;
+- cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie);
++ if (cd->rd_dircount) {
++ name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8;
++ if (name_and_cookie > cd->rd_dircount && cd->cookie_offset)
++ goto fail;
++ cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie);
++ if (!cd->rd_dircount)
++ cd->rd_maxcount = 0;
++ }
+
+ cd->cookie_offset = cookie_offset;
+ skip_entry:
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 0b4ee1ab25df0..0578c15e1a676 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -1166,9 +1166,13 @@ static int ovl_rename(struct inode *olddir, struct dentry *old,
+ goto out_dput;
+ }
+ } else {
+- if (!d_is_negative(newdentry) &&
+- (!new_opaque || !ovl_is_whiteout(newdentry)))
+- goto out_dput;
++ if (!d_is_negative(newdentry)) {
++ if (!new_opaque || !ovl_is_whiteout(newdentry))
++ goto out_dput;
++ } else {
++ if (flags & RENAME_EXCHANGE)
++ goto out_dput;
++ }
+ }
+
+ if (olddentry == trap)
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index a47d623f59fe7..92310b07cb98e 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -63,7 +63,8 @@ static inline int stack_map_data_size(struct bpf_map *map)
+
+ static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
+ {
+- u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size;
++ u64 elem_size = sizeof(struct stack_map_bucket) +
++ (u64)smap->map.value_size;
+ int err;
+
+ smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries,
+diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
+index ec2b58a09f763..c00cb376263a0 100644
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -1511,7 +1511,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr)
+ }
+
+ return numvls * nla_total_size(sizeof(struct bridge_vlan_xstats)) +
+- nla_total_size(sizeof(struct br_mcast_stats)) +
++ nla_total_size_64bit(sizeof(struct br_mcast_stats)) +
+ nla_total_size(0);
+ }
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 055fd09ac1114..83de32e34bb55 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -4512,7 +4512,7 @@ nla_put_failure:
+ static size_t if_nlmsg_stats_size(const struct net_device *dev,
+ u32 filter_mask)
+ {
+- size_t size = 0;
++ size_t size = NLMSG_ALIGN(sizeof(struct if_stats_msg));
+
+ if (stats_attr_valid(filter_mask, IFLA_STATS_LINK_64, 0))
+ size += nla_total_size_64bit(sizeof(struct rtnl_link_stats64));
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index b0fd268ed65e5..dd4e4289d0d2a 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -599,7 +599,10 @@ static int netlink_insert(struct sock *sk, u32 portid)
+
+ /* We need to ensure that the socket is hashed and visible. */
+ smp_wmb();
+- nlk_sk(sk)->bound = portid;
++ /* Paired with lockless reads from netlink_bind(),
++ * netlink_connect() and netlink_sendmsg().
++ */
++ WRITE_ONCE(nlk_sk(sk)->bound, portid);
+
+ err:
+ release_sock(sk);
+@@ -1018,7 +1021,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
+ else if (nlk->ngroups < 8*sizeof(groups))
+ groups &= (1UL << nlk->ngroups) - 1;
+
+- bound = nlk->bound;
++ /* Paired with WRITE_ONCE() in netlink_insert() */
++ bound = READ_ONCE(nlk->bound);
+ if (bound) {
+ /* Ensure nlk->portid is up-to-date. */
+ smp_rmb();
+@@ -1104,8 +1108,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
+
+ /* No need for barriers here as we return to user-space without
+ * using any of the bound attributes.
++ * Paired with WRITE_ONCE() in netlink_insert().
+ */
+- if (!nlk->bound)
++ if (!READ_ONCE(nlk->bound))
+ err = netlink_autobind(sock);
+
+ if (err == 0) {
+@@ -1870,7 +1875,8 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ dst_group = nlk->dst_group;
+ }
+
+- if (!nlk->bound) {
++ /* Paired with WRITE_ONCE() in netlink_insert() */
++ if (!READ_ONCE(nlk->bound)) {
+ err = netlink_autobind(sock);
+ if (err)
+ goto out;
+diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
+index 24893d3b5d229..bcd3ca97caea1 100644
+--- a/net/sched/sch_fifo.c
++++ b/net/sched/sch_fifo.c
+@@ -152,6 +152,9 @@ int fifo_set_limit(struct Qdisc *q, unsigned int limit)
+ if (strncmp(q->ops->id + 1, "fifo", 4) != 0)
+ return 0;
+
++ if (!q->ops->change)
++ return 0;
++
+ nla = kmalloc(nla_attr_size(sizeof(struct tc_fifo_qopt)), GFP_KERNEL);
+ if (nla) {
+ nla->nla_type = RTM_NEWQDISC;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-10-17 13:12 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-10-17 13:12 UTC (permalink / raw
To: gentoo-commits
commit: f46dbd68b6a1a3e65d847aae6abf4f5ddb375360
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Oct 17 13:12:45 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Oct 17 13:12:45 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f46dbd68
Linux patch 4.19.212
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1211_linux-4.19.212.patch | 498 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 502 insertions(+)
diff --git a/0000_README b/0000_README
index ac7acb4..45a3155 100644
--- a/0000_README
+++ b/0000_README
@@ -883,6 +883,10 @@ Patch: 1210_linux-4.19.211.patch
From: https://www.kernel.org
Desc: Linux 4.19.211
+Patch: 1211_linux-4.19.212.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.212
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1211_linux-4.19.212.patch b/1211_linux-4.19.212.patch
new file mode 100644
index 0000000..7b8a2b5
--- /dev/null
+++ b/1211_linux-4.19.212.patch
@@ -0,0 +1,498 @@
+diff --git a/Makefile b/Makefile
+index d4e6f5d326b06..484b0665e5721 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 211
++SUBLEVEL = 212
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/m68k/kernel/signal.c b/arch/m68k/kernel/signal.c
+index 72850b85ecf85..c67a68b6b69d1 100644
+--- a/arch/m68k/kernel/signal.c
++++ b/arch/m68k/kernel/signal.c
+@@ -448,7 +448,7 @@ static inline void save_fpu_state(struct sigcontext *sc, struct pt_regs *regs)
+
+ if (CPU_IS_060 ? sc->sc_fpstate[2] : sc->sc_fpstate[0]) {
+ fpu_version = sc->sc_fpstate[0];
+- if (CPU_IS_020_OR_030 &&
++ if (CPU_IS_020_OR_030 && !regs->stkadj &&
+ regs->vector >= (VEC_FPBRUC * 4) &&
+ regs->vector <= (VEC_FPNAN * 4)) {
+ /* Clear pending exception in 68882 idle frame */
+@@ -511,7 +511,7 @@ static inline int rt_save_fpu_state(struct ucontext __user *uc, struct pt_regs *
+ if (!(CPU_IS_060 || CPU_IS_COLDFIRE))
+ context_size = fpstate[1];
+ fpu_version = fpstate[0];
+- if (CPU_IS_020_OR_030 &&
++ if (CPU_IS_020_OR_030 && !regs->stkadj &&
+ regs->vector >= (VEC_FPBRUC * 4) &&
+ regs->vector <= (VEC_FPNAN * 4)) {
+ /* Clear pending exception in 68882 idle frame */
+@@ -828,18 +828,24 @@ badframe:
+ return 0;
+ }
+
++static inline struct pt_regs *rte_regs(struct pt_regs *regs)
++{
++ return (void *)regs + regs->stkadj;
++}
++
+ static void setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs,
+ unsigned long mask)
+ {
++ struct pt_regs *tregs = rte_regs(regs);
+ sc->sc_mask = mask;
+ sc->sc_usp = rdusp();
+ sc->sc_d0 = regs->d0;
+ sc->sc_d1 = regs->d1;
+ sc->sc_a0 = regs->a0;
+ sc->sc_a1 = regs->a1;
+- sc->sc_sr = regs->sr;
+- sc->sc_pc = regs->pc;
+- sc->sc_formatvec = regs->format << 12 | regs->vector;
++ sc->sc_sr = tregs->sr;
++ sc->sc_pc = tregs->pc;
++ sc->sc_formatvec = tregs->format << 12 | tregs->vector;
+ save_a5_state(sc, regs);
+ save_fpu_state(sc, regs);
+ }
+@@ -847,6 +853,7 @@ static void setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs,
+ static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs *regs)
+ {
+ struct switch_stack *sw = (struct switch_stack *)regs - 1;
++ struct pt_regs *tregs = rte_regs(regs);
+ greg_t __user *gregs = uc->uc_mcontext.gregs;
+ int err = 0;
+
+@@ -867,9 +874,9 @@ static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs *
+ err |= __put_user(sw->a5, &gregs[13]);
+ err |= __put_user(sw->a6, &gregs[14]);
+ err |= __put_user(rdusp(), &gregs[15]);
+- err |= __put_user(regs->pc, &gregs[16]);
+- err |= __put_user(regs->sr, &gregs[17]);
+- err |= __put_user((regs->format << 12) | regs->vector, &uc->uc_formatvec);
++ err |= __put_user(tregs->pc, &gregs[16]);
++ err |= __put_user(tregs->sr, &gregs[17]);
++ err |= __put_user((tregs->format << 12) | tregs->vector, &uc->uc_formatvec);
+ err |= rt_save_fpu_state(uc, regs);
+ return err;
+ }
+@@ -886,13 +893,14 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set,
+ struct pt_regs *regs)
+ {
+ struct sigframe __user *frame;
+- int fsize = frame_extra_sizes(regs->format);
++ struct pt_regs *tregs = rte_regs(regs);
++ int fsize = frame_extra_sizes(tregs->format);
+ struct sigcontext context;
+ int err = 0, sig = ksig->sig;
+
+ if (fsize < 0) {
+ pr_debug("setup_frame: Unknown frame format %#x\n",
+- regs->format);
++ tregs->format);
+ return -EFAULT;
+ }
+
+@@ -903,7 +911,7 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set,
+
+ err |= __put_user(sig, &frame->sig);
+
+- err |= __put_user(regs->vector, &frame->code);
++ err |= __put_user(tregs->vector, &frame->code);
+ err |= __put_user(&frame->sc, &frame->psc);
+
+ if (_NSIG_WORDS > 1)
+@@ -928,34 +936,28 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set,
+
+ push_cache ((unsigned long) &frame->retcode);
+
+- /*
+- * Set up registers for signal handler. All the state we are about
+- * to destroy is successfully copied to sigframe.
+- */
+- wrusp ((unsigned long) frame);
+- regs->pc = (unsigned long) ksig->ka.sa.sa_handler;
+- adjustformat(regs);
+-
+ /*
+ * This is subtle; if we build more than one sigframe, all but the
+ * first one will see frame format 0 and have fsize == 0, so we won't
+ * screw stkadj.
+ */
+- if (fsize)
++ if (fsize) {
+ regs->stkadj = fsize;
+-
+- /* Prepare to skip over the extra stuff in the exception frame. */
+- if (regs->stkadj) {
+- struct pt_regs *tregs =
+- (struct pt_regs *)((ulong)regs + regs->stkadj);
++ tregs = rte_regs(regs);
+ pr_debug("Performing stackadjust=%04lx\n", regs->stkadj);
+- /* This must be copied with decreasing addresses to
+- handle overlaps. */
+ tregs->vector = 0;
+ tregs->format = 0;
+- tregs->pc = regs->pc;
+ tregs->sr = regs->sr;
+ }
++
++ /*
++ * Set up registers for signal handler. All the state we are about
++ * to destroy is successfully copied to sigframe.
++ */
++ wrusp ((unsigned long) frame);
++ tregs->pc = (unsigned long) ksig->ka.sa.sa_handler;
++ adjustformat(regs);
++
+ return 0;
+ }
+
+@@ -963,7 +965,8 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
+ struct pt_regs *regs)
+ {
+ struct rt_sigframe __user *frame;
+- int fsize = frame_extra_sizes(regs->format);
++ struct pt_regs *tregs = rte_regs(regs);
++ int fsize = frame_extra_sizes(tregs->format);
+ int err = 0, sig = ksig->sig;
+
+ if (fsize < 0) {
+@@ -1012,34 +1015,27 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
+
+ push_cache ((unsigned long) &frame->retcode);
+
+- /*
+- * Set up registers for signal handler. All the state we are about
+- * to destroy is successfully copied to sigframe.
+- */
+- wrusp ((unsigned long) frame);
+- regs->pc = (unsigned long) ksig->ka.sa.sa_handler;
+- adjustformat(regs);
+-
+ /*
+ * This is subtle; if we build more than one sigframe, all but the
+ * first one will see frame format 0 and have fsize == 0, so we won't
+ * screw stkadj.
+ */
+- if (fsize)
++ if (fsize) {
+ regs->stkadj = fsize;
+-
+- /* Prepare to skip over the extra stuff in the exception frame. */
+- if (regs->stkadj) {
+- struct pt_regs *tregs =
+- (struct pt_regs *)((ulong)regs + regs->stkadj);
++ tregs = rte_regs(regs);
+ pr_debug("Performing stackadjust=%04lx\n", regs->stkadj);
+- /* This must be copied with decreasing addresses to
+- handle overlaps. */
+ tregs->vector = 0;
+ tregs->format = 0;
+- tregs->pc = regs->pc;
+ tregs->sr = regs->sr;
+ }
++
++ /*
++ * Set up registers for signal handler. All the state we are about
++ * to destroy is successfully copied to sigframe.
++ */
++ wrusp ((unsigned long) frame);
++ tregs->pc = (unsigned long) ksig->ka.sa.sa_handler;
++ adjustformat(regs);
+ return 0;
+ }
+
+diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
+index 429389489eed2..f612eb1cc8188 100644
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -2096,6 +2096,7 @@ static int x86_pmu_event_init(struct perf_event *event)
+ if (err) {
+ if (event->destroy)
+ event->destroy(event);
++ event->destroy = NULL;
+ }
+
+ if (READ_ONCE(x86_pmu.attr_rdpmc) &&
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index b58ab769aa7b3..4e3dd3f55a963 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -304,12 +304,19 @@ static int apple_event(struct hid_device *hdev, struct hid_field *field,
+
+ /*
+ * MacBook JIS keyboard has wrong logical maximum
++ * Magic Keyboard JIS has wrong logical maximum
+ */
+ static __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+ struct apple_sc *asc = hid_get_drvdata(hdev);
+
++ if(*rsize >=71 && rdesc[70] == 0x65 && rdesc[64] == 0x65) {
++ hid_info(hdev,
++ "fixing up Magic Keyboard JIS report descriptor\n");
++ rdesc[64] = rdesc[70] = 0xe7;
++ }
++
+ if ((asc->quirks & APPLE_RDESC_JIS) && *rsize >= 60 &&
+ rdesc[53] == 0x65 && rdesc[59] == 0x65) {
+ hid_info(hdev,
+diff --git a/drivers/net/ethernet/sun/Kconfig b/drivers/net/ethernet/sun/Kconfig
+index 7b982e02ea3a4..1080a2a3e13a2 100644
+--- a/drivers/net/ethernet/sun/Kconfig
++++ b/drivers/net/ethernet/sun/Kconfig
+@@ -73,6 +73,7 @@ config CASSINI
+ config SUNVNET_COMMON
+ tristate "Common routines to support Sun Virtual Networking"
+ depends on SUN_LDOMS
++ depends on INET
+ default m
+
+ config SUNVNET
+diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c
+index acaf072bb4b0f..35dc4ca696d33 100644
+--- a/drivers/net/phy/bcm7xxx.c
++++ b/drivers/net/phy/bcm7xxx.c
+@@ -30,7 +30,12 @@
+ #define MII_BCM7XXX_SHD_2_ADDR_CTRL 0xe
+ #define MII_BCM7XXX_SHD_2_CTRL_STAT 0xf
+ #define MII_BCM7XXX_SHD_2_BIAS_TRIM 0x1a
++#define MII_BCM7XXX_SHD_3_PCS_CTRL 0x0
++#define MII_BCM7XXX_SHD_3_PCS_STATUS 0x1
++#define MII_BCM7XXX_SHD_3_EEE_CAP 0x2
+ #define MII_BCM7XXX_SHD_3_AN_EEE_ADV 0x3
++#define MII_BCM7XXX_SHD_3_EEE_LP 0x4
++#define MII_BCM7XXX_SHD_3_EEE_WK_ERR 0x5
+ #define MII_BCM7XXX_SHD_3_PCS_CTRL_2 0x6
+ #define MII_BCM7XXX_PCS_CTRL_2_DEF 0x4400
+ #define MII_BCM7XXX_SHD_3_AN_STAT 0xb
+@@ -463,6 +468,93 @@ static int bcm7xxx_28nm_ephy_config_init(struct phy_device *phydev)
+ return bcm7xxx_28nm_ephy_apd_enable(phydev);
+ }
+
++#define MII_BCM7XXX_REG_INVALID 0xff
++
++static u8 bcm7xxx_28nm_ephy_regnum_to_shd(u16 regnum)
++{
++ switch (regnum) {
++ case MDIO_CTRL1:
++ return MII_BCM7XXX_SHD_3_PCS_CTRL;
++ case MDIO_STAT1:
++ return MII_BCM7XXX_SHD_3_PCS_STATUS;
++ case MDIO_PCS_EEE_ABLE:
++ return MII_BCM7XXX_SHD_3_EEE_CAP;
++ case MDIO_AN_EEE_ADV:
++ return MII_BCM7XXX_SHD_3_AN_EEE_ADV;
++ case MDIO_AN_EEE_LPABLE:
++ return MII_BCM7XXX_SHD_3_EEE_LP;
++ case MDIO_PCS_EEE_WK_ERR:
++ return MII_BCM7XXX_SHD_3_EEE_WK_ERR;
++ default:
++ return MII_BCM7XXX_REG_INVALID;
++ }
++}
++
++static bool bcm7xxx_28nm_ephy_dev_valid(int devnum)
++{
++ return devnum == MDIO_MMD_AN || devnum == MDIO_MMD_PCS;
++}
++
++static int bcm7xxx_28nm_ephy_read_mmd(struct phy_device *phydev,
++ int devnum, u16 regnum)
++{
++ u8 shd = bcm7xxx_28nm_ephy_regnum_to_shd(regnum);
++ int ret;
++
++ if (!bcm7xxx_28nm_ephy_dev_valid(devnum) ||
++ shd == MII_BCM7XXX_REG_INVALID)
++ return -EOPNOTSUPP;
++
++ /* set shadow mode 2 */
++ ret = phy_set_clr_bits(phydev, MII_BCM7XXX_TEST,
++ MII_BCM7XXX_SHD_MODE_2, 0);
++ if (ret < 0)
++ return ret;
++
++ /* Access the desired shadow register address */
++ ret = phy_write(phydev, MII_BCM7XXX_SHD_2_ADDR_CTRL, shd);
++ if (ret < 0)
++ goto reset_shadow_mode;
++
++ ret = phy_read(phydev, MII_BCM7XXX_SHD_2_CTRL_STAT);
++
++reset_shadow_mode:
++ /* reset shadow mode 2 */
++ phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, 0,
++ MII_BCM7XXX_SHD_MODE_2);
++ return ret;
++}
++
++static int bcm7xxx_28nm_ephy_write_mmd(struct phy_device *phydev,
++ int devnum, u16 regnum, u16 val)
++{
++ u8 shd = bcm7xxx_28nm_ephy_regnum_to_shd(regnum);
++ int ret;
++
++ if (!bcm7xxx_28nm_ephy_dev_valid(devnum) ||
++ shd == MII_BCM7XXX_REG_INVALID)
++ return -EOPNOTSUPP;
++
++ /* set shadow mode 2 */
++ ret = phy_set_clr_bits(phydev, MII_BCM7XXX_TEST,
++ MII_BCM7XXX_SHD_MODE_2, 0);
++ if (ret < 0)
++ return ret;
++
++ /* Access the desired shadow register address */
++ ret = phy_write(phydev, MII_BCM7XXX_SHD_2_ADDR_CTRL, shd);
++ if (ret < 0)
++ goto reset_shadow_mode;
++
++ /* Write the desired value in the shadow register */
++ phy_write(phydev, MII_BCM7XXX_SHD_2_CTRL_STAT, val);
++
++reset_shadow_mode:
++ /* reset shadow mode 2 */
++ return phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, 0,
++ MII_BCM7XXX_SHD_MODE_2);
++}
++
+ static int bcm7xxx_28nm_ephy_resume(struct phy_device *phydev)
+ {
+ int ret;
+@@ -634,6 +726,8 @@ static int bcm7xxx_28nm_probe(struct phy_device *phydev)
+ .get_strings = bcm_phy_get_strings, \
+ .get_stats = bcm7xxx_28nm_get_phy_stats, \
+ .probe = bcm7xxx_28nm_probe, \
++ .read_mmd = bcm7xxx_28nm_ephy_read_mmd, \
++ .write_mmd = bcm7xxx_28nm_ephy_write_mmd, \
+ }
+
+ #define BCM7XXX_40NM_EPHY(_oui, _name) \
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index caf35ca577ce3..e79d9f60a5282 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -134,7 +134,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
+ static int ses_send_diag(struct scsi_device *sdev, int page_code,
+ void *buf, int bufflen)
+ {
+- u32 result;
++ int result;
+
+ unsigned char cmd[] = {
+ SEND_DIAGNOSTIC,
+diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
+index 3d331a864b2fc..50e87823baab4 100644
+--- a/drivers/scsi/virtio_scsi.c
++++ b/drivers/scsi/virtio_scsi.c
+@@ -336,7 +336,7 @@ static void virtscsi_handle_transport_reset(struct virtio_scsi *vscsi,
+ }
+ break;
+ default:
+- pr_info("Unsupport virtio scsi event reason %x\n", event->reason);
++ pr_info("Unsupported virtio scsi event reason %x\n", event->reason);
+ }
+ }
+
+@@ -389,7 +389,7 @@ static void virtscsi_handle_event(struct work_struct *work)
+ virtscsi_handle_param_change(vscsi, event);
+ break;
+ default:
+- pr_err("Unsupport virtio scsi event %x\n", event->event);
++ pr_err("Unsupported virtio scsi event %x\n", event->event);
+ }
+ virtscsi_kick_event(vscsi, event_node);
+ }
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 5524cd5c6abe6..761d0f85c4a50 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1433,7 +1433,7 @@ extern struct pid *cad_pid;
+ #define tsk_used_math(p) ((p)->flags & PF_USED_MATH)
+ #define used_math() tsk_used_math(current)
+
+-static inline bool is_percpu_thread(void)
++static __always_inline bool is_percpu_thread(void)
+ {
+ #ifdef CONFIG_SMP
+ return (current->flags & PF_NO_SETAFFINITY) &&
+diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
+index 5e99771a5dcc2..edca90ef3bdc4 100644
+--- a/include/net/pkt_sched.h
++++ b/include/net/pkt_sched.h
+@@ -11,6 +11,7 @@
+ #include <uapi/linux/pkt_sched.h>
+
+ #define DEFAULT_TX_QUEUE_LEN 1000
++#define STAB_SIZE_LOG_MAX 30
+
+ struct qdisc_walker {
+ int stop;
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index dd0c1073dc8ee..d93490ac82759 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -276,6 +276,7 @@ ip6t_do_table(struct sk_buff *skb,
+ * things we don't know, ie. tcp syn flag or ports). If the
+ * rule is also a fragment-specific rule, non-fragments won't
+ * match it. */
++ acpar.fragoff = 0;
+ acpar.hotdrop = false;
+ acpar.state = state;
+
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index 6dc5f93b1e4d1..06b44c3c831ad 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -63,7 +63,10 @@ static struct mesh_table *mesh_table_alloc(void)
+ atomic_set(&newtbl->entries, 0);
+ spin_lock_init(&newtbl->gates_lock);
+ spin_lock_init(&newtbl->walk_lock);
+- rhashtable_init(&newtbl->rhead, &mesh_rht_params);
++ if (rhashtable_init(&newtbl->rhead, &mesh_rht_params)) {
++ kfree(newtbl);
++ return NULL;
++ }
+
+ return newtbl;
+ }
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 012697efafc35..e0baa563a4dea 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3875,7 +3875,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
+ if (!bssid)
+ return false;
+ if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
+- ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
++ ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||
++ !is_valid_ether_addr(hdr->addr2))
+ return false;
+ if (ieee80211_is_beacon(hdr->frame_control))
+ return true;
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 1f12be9f02070..0bb4f7a94a3c8 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -498,6 +498,12 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt,
+ return stab;
+ }
+
++ if (s->size_log > STAB_SIZE_LOG_MAX ||
++ s->cell_log > STAB_SIZE_LOG_MAX) {
++ NL_SET_ERR_MSG(extack, "Invalid logarithmic size of size table");
++ return ERR_PTR(-EINVAL);
++ }
++
+ stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL);
+ if (!stab)
+ return ERR_PTR(-ENOMEM);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-10-20 13:26 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-10-20 13:26 UTC (permalink / raw
To: gentoo-commits
commit: c6e05b2793c19bd3b40abc6f94a2338d992d9ce8
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 20 13:25:55 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Oct 20 13:25:55 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c6e05b27
Linuxpatch 4.19.213
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1212_linux-4.19.213.patch | 953 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 957 insertions(+)
diff --git a/0000_README b/0000_README
index 45a3155..8b39e90 100644
--- a/0000_README
+++ b/0000_README
@@ -887,6 +887,10 @@ Patch: 1211_linux-4.19.212.patch
From: https://www.kernel.org
Desc: Linux 4.19.212
+Patch: 1212_linux-4.19.213.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.213
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1212_linux-4.19.213.patch b/1212_linux-4.19.213.patch
new file mode 100644
index 0000000..0c739c9
--- /dev/null
+++ b/1212_linux-4.19.213.patch
@@ -0,0 +1,953 @@
+diff --git a/Makefile b/Makefile
+index 484b0665e5721..ac86ad939880e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 212
++SUBLEVEL = 213
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/s390/lib/string.c b/arch/s390/lib/string.c
+index a10e11f7a5f79..c1832eba50ea7 100644
+--- a/arch/s390/lib/string.c
++++ b/arch/s390/lib/string.c
+@@ -227,14 +227,13 @@ EXPORT_SYMBOL(strcmp);
+ */
+ char *strrchr(const char *s, int c)
+ {
+- size_t len = __strend(s) - s;
+-
+- if (len)
+- do {
+- if (s[len] == (char) c)
+- return (char *) s + len;
+- } while (--len > 0);
+- return NULL;
++ ssize_t len = __strend(s) - s;
++
++ do {
++ if (s[len] == (char)c)
++ return (char *)s + len;
++ } while (--len >= 0);
++ return NULL;
+ }
+ EXPORT_SYMBOL(strrchr);
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 3dd2949b2b356..6348b0964e9cb 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -1496,7 +1496,6 @@ config AMD_MEM_ENCRYPT
+
+ config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
+ bool "Activate AMD Secure Memory Encryption (SME) by default"
+- default y
+ depends on AMD_MEM_ENCRYPT
+ ---help---
+ Say yes to have system memory encrypted by default if running on
+diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
+index b32fa6bcf811f..d4993d42b7411 100644
+--- a/arch/x86/kernel/cpu/intel_rdt.c
++++ b/arch/x86/kernel/cpu/intel_rdt.c
+@@ -563,6 +563,8 @@ static void domain_add_cpu(int cpu, struct rdt_resource *r)
+ }
+
+ if (r->mon_capable && domain_setup_mon_state(r, d)) {
++ kfree(d->ctrl_val);
++ kfree(d->mbps_val);
+ kfree(d);
+ return;
+ }
+diff --git a/drivers/acpi/arm64/gtdt.c b/drivers/acpi/arm64/gtdt.c
+index c39b36c558d6f..7a181a8a9bf04 100644
+--- a/drivers/acpi/arm64/gtdt.c
++++ b/drivers/acpi/arm64/gtdt.c
+@@ -39,7 +39,7 @@ struct acpi_gtdt_descriptor {
+
+ static struct acpi_gtdt_descriptor acpi_gtdt_desc __initdata;
+
+-static inline void *next_platform_timer(void *platform_timer)
++static inline __init void *next_platform_timer(void *platform_timer)
+ {
+ struct acpi_gtdt_header *gh = platform_timer;
+
+diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
+index 8ea4b8431fc82..52cea1b3ea706 100644
+--- a/drivers/ata/pata_legacy.c
++++ b/drivers/ata/pata_legacy.c
+@@ -329,7 +329,8 @@ static unsigned int pdc_data_xfer_vlb(struct ata_queued_cmd *qc,
+ iowrite32_rep(ap->ioaddr.data_addr, buf, buflen >> 2);
+
+ if (unlikely(slop)) {
+- __le32 pad;
++ __le32 pad = 0;
++
+ if (rw == READ) {
+ pad = cpu_to_le32(ioread32(ap->ioaddr.data_addr));
+ memcpy(buf + buflen - slop, &pad, slop);
+@@ -719,7 +720,8 @@ static unsigned int vlb32_data_xfer(struct ata_queued_cmd *qc,
+ ioread32_rep(ap->ioaddr.data_addr, buf, buflen >> 2);
+
+ if (unlikely(slop)) {
+- __le32 pad;
++ __le32 pad = 0;
++
+ if (rw == WRITE) {
+ memcpy(&pad, buf + buflen - slop, slop);
+ iowrite32(le32_to_cpu(pad), ap->ioaddr.data_addr);
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 97da083afd324..aa4abf1a94a13 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -37,8 +37,6 @@
+ #include <acpi/ghes.h>
+ #include <ras/ras_event.h>
+
+-static char rcd_decode_str[CPER_REC_LEN];
+-
+ /*
+ * CPER record ID need to be unique even after reboot, because record
+ * ID is used as index for ERST storage, while CPER records from
+@@ -311,6 +309,7 @@ const char *cper_mem_err_unpack(struct trace_seq *p,
+ struct cper_mem_err_compact *cmem)
+ {
+ const char *ret = trace_seq_buffer_ptr(p);
++ char rcd_decode_str[CPER_REC_LEN];
+
+ if (cper_mem_err_location(cmem, rcd_decode_str))
+ trace_seq_printf(p, "%s", rcd_decode_str);
+@@ -325,6 +324,7 @@ static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem,
+ int len)
+ {
+ struct cper_mem_err_compact cmem;
++ char rcd_decode_str[CPER_REC_LEN];
+
+ /* Don't trust UEFI 2.1/2.2 structure with bad validation bits */
+ if (len == sizeof(struct cper_sec_mem_err_old) &&
+diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
+index b31e3d3729a6d..0a4309fe01b6b 100644
+--- a/drivers/firmware/efi/runtime-wrappers.c
++++ b/drivers/firmware/efi/runtime-wrappers.c
+@@ -395,7 +395,7 @@ static void virt_efi_reset_system(int reset_type,
+ unsigned long data_size,
+ efi_char16_t *data)
+ {
+- if (down_interruptible(&efi_runtime_lock)) {
++ if (down_trylock(&efi_runtime_lock)) {
+ pr_warn("failed to invoke the reset_system() runtime service:\n"
+ "could not get exclusive access to the firmware\n");
+ return;
+diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c
+index 822cef472a7e9..5cf6eac9c1d3b 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi.c
++++ b/drivers/gpu/drm/msm/dsi/dsi.c
+@@ -208,8 +208,10 @@ int msm_dsi_modeset_init(struct msm_dsi *msm_dsi, struct drm_device *dev,
+ goto fail;
+ }
+
+- if (!msm_dsi_manager_validate_current_config(msm_dsi->id))
++ if (!msm_dsi_manager_validate_current_config(msm_dsi->id)) {
++ ret = -EINVAL;
+ goto fail;
++ }
+
+ msm_dsi->encoder = encoder;
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 3b78bca0bb4d4..77dae147caf90 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -468,7 +468,7 @@ static int dsi_bus_clk_enable(struct msm_dsi_host *msm_host)
+
+ return 0;
+ err:
+- for (; i > 0; i--)
++ while (--i >= 0)
+ clk_disable_unprepare(msm_host->bus_clks[i]);
+
+ return ret;
+diff --git a/drivers/gpu/drm/msm/edp/edp_ctrl.c b/drivers/gpu/drm/msm/edp/edp_ctrl.c
+index 7c72264101ff4..2589b23c41318 100644
+--- a/drivers/gpu/drm/msm/edp/edp_ctrl.c
++++ b/drivers/gpu/drm/msm/edp/edp_ctrl.c
+@@ -1090,7 +1090,7 @@ void msm_edp_ctrl_power(struct edp_ctrl *ctrl, bool on)
+ int msm_edp_ctrl_init(struct msm_edp *edp)
+ {
+ struct edp_ctrl *ctrl = NULL;
+- struct device *dev = &edp->pdev->dev;
++ struct device *dev;
+ int ret;
+
+ if (!edp) {
+@@ -1098,6 +1098,7 @@ int msm_edp_ctrl_init(struct msm_edp *edp)
+ return -EINVAL;
+ }
+
++ dev = &edp->pdev->dev;
+ ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
+ if (!ctrl)
+ return -ENOMEM;
+diff --git a/drivers/iio/adc/aspeed_adc.c b/drivers/iio/adc/aspeed_adc.c
+index 9515ca165dfdb..a8e6046d39483 100644
+--- a/drivers/iio/adc/aspeed_adc.c
++++ b/drivers/iio/adc/aspeed_adc.c
+@@ -188,6 +188,7 @@ static int aspeed_adc_probe(struct platform_device *pdev)
+
+ data = iio_priv(indio_dev);
+ data->dev = &pdev->dev;
++ platform_set_drvdata(pdev, indio_dev);
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ data->base = devm_ioremap_resource(&pdev->dev, res);
+diff --git a/drivers/iio/adc/ti-adc128s052.c b/drivers/iio/adc/ti-adc128s052.c
+index 7cf39b3e2416d..9986fc81b7371 100644
+--- a/drivers/iio/adc/ti-adc128s052.c
++++ b/drivers/iio/adc/ti-adc128s052.c
+@@ -168,7 +168,13 @@ static int adc128_probe(struct spi_device *spi)
+ mutex_init(&adc->lock);
+
+ ret = iio_device_register(indio_dev);
++ if (ret)
++ goto err_disable_regulator;
+
++ return 0;
++
++err_disable_regulator:
++ regulator_disable(adc->reg);
+ return ret;
+ }
+
+diff --git a/drivers/iio/common/ssp_sensors/ssp_spi.c b/drivers/iio/common/ssp_sensors/ssp_spi.c
+index 2ab106bb3e032..3d11cfa03a31b 100644
+--- a/drivers/iio/common/ssp_sensors/ssp_spi.c
++++ b/drivers/iio/common/ssp_sensors/ssp_spi.c
+@@ -147,7 +147,7 @@ static int ssp_print_mcu_debug(char *data_frame, int *data_index,
+ if (length > received_len - *data_index || length <= 0) {
+ ssp_dbg("[SSP]: MSG From MCU-invalid debug length(%d/%d)\n",
+ length, received_len);
+- return length ? length : -EPROTO;
++ return -EPROTO;
+ }
+
+ ssp_dbg("[SSP]: MSG From MCU - %s\n", &data_frame[*data_index]);
+@@ -283,6 +283,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
+ for (idx = 0; idx < len;) {
+ switch (dataframe[idx++]) {
+ case SSP_MSG2AP_INST_BYPASS_DATA:
++ if (idx >= len)
++ return -EPROTO;
+ sd = dataframe[idx++];
+ if (sd < 0 || sd >= SSP_SENSOR_MAX) {
+ dev_err(SSP_DEV,
+@@ -292,10 +294,13 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
+
+ if (indio_devs[sd]) {
+ spd = iio_priv(indio_devs[sd]);
+- if (spd->process_data)
++ if (spd->process_data) {
++ if (idx >= len)
++ return -EPROTO;
+ spd->process_data(indio_devs[sd],
+ &dataframe[idx],
+ data->timestamp);
++ }
+ } else {
+ dev_err(SSP_DEV, "no client for frame\n");
+ }
+@@ -303,6 +308,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
+ idx += ssp_offset_map[sd];
+ break;
+ case SSP_MSG2AP_INST_DEBUG_DATA:
++ if (idx >= len)
++ return -EPROTO;
+ sd = ssp_print_mcu_debug(dataframe, &idx, len);
+ if (sd) {
+ dev_err(SSP_DEV,
+diff --git a/drivers/iio/dac/ti-dac5571.c b/drivers/iio/dac/ti-dac5571.c
+index e39d1e901353b..2ed927b582f4d 100644
+--- a/drivers/iio/dac/ti-dac5571.c
++++ b/drivers/iio/dac/ti-dac5571.c
+@@ -355,6 +355,7 @@ static int dac5571_probe(struct i2c_client *client,
+ data->dac5571_pwrdwn = dac5571_pwrdwn_quad;
+ break;
+ default:
++ ret = -EINVAL;
+ goto err;
+ }
+
+diff --git a/drivers/iio/light/opt3001.c b/drivers/iio/light/opt3001.c
+index f9d13e4ec1083..162eff78c6739 100644
+--- a/drivers/iio/light/opt3001.c
++++ b/drivers/iio/light/opt3001.c
+@@ -283,6 +283,8 @@ static int opt3001_get_lux(struct opt3001 *opt, int *val, int *val2)
+ ret = wait_event_timeout(opt->result_ready_queue,
+ opt->result_ready,
+ msecs_to_jiffies(OPT3001_RESULT_READY_LONG));
++ if (ret == 0)
++ return -ETIMEDOUT;
+ } else {
+ /* Sleep for result ready time */
+ timeout = (opt->int_time == OPT3001_INT_TIME_SHORT) ?
+@@ -319,9 +321,7 @@ err:
+ /* Disallow IRQ to access the device while lock is active */
+ opt->ok_to_ignore_lock = false;
+
+- if (ret == 0)
+- return -ETIMEDOUT;
+- else if (ret < 0)
++ if (ret < 0)
+ return ret;
+
+ if (opt->use_irq) {
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index eacb8af8b4fc0..4423db71eda73 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -345,6 +345,7 @@ static const struct xpad_device {
+ { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
++ { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 },
+ { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
+ { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
+ { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN }
+@@ -461,6 +462,7 @@ static const struct usb_device_id xpad_table[] = {
+ XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA Controllers */
+ XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Duke X-Box One pad */
+ XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */
++ XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */
+ { }
+ };
+
+diff --git a/drivers/misc/cb710/sgbuf2.c b/drivers/misc/cb710/sgbuf2.c
+index 2a40d0efdff5d..4d2a72a537d42 100644
+--- a/drivers/misc/cb710/sgbuf2.c
++++ b/drivers/misc/cb710/sgbuf2.c
+@@ -50,7 +50,7 @@ static inline bool needs_unaligned_copy(const void *ptr)
+ #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ return false;
+ #else
+- return ((ptr - NULL) & 3) != 0;
++ return ((uintptr_t)ptr & 3) != 0;
+ #endif
+ }
+
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index 2ac1dc5104b7a..6bbc78698b77b 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -150,6 +150,7 @@
+ #define MEI_DEV_ID_CDF 0x18D3 /* Cedar Fork */
+
+ #define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
++#define MEI_DEV_ID_ICP_N 0x38E0 /* Ice Lake Point N */
+
+ #define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */
+
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index b4bf12f27caf5..35086f67d2096 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -112,6 +112,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_H_3, MEI_ME_PCH8_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_N, MEI_ME_PCH12_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH12_CFG)},
+
+diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
+index 6fde68aa13a40..02644283377a8 100644
+--- a/drivers/net/ethernet/Kconfig
++++ b/drivers/net/ethernet/Kconfig
+@@ -98,6 +98,7 @@ config JME
+ config KORINA
+ tristate "Korina (IDT RC32434) Ethernet support"
+ depends on MIKROTIK_RB532
++ select CRC32
+ ---help---
+ If you have a Mikrotik RouterBoard 500 or IDT RC32434
+ based system say Y. Otherwise say N.
+diff --git a/drivers/net/ethernet/arc/Kconfig b/drivers/net/ethernet/arc/Kconfig
+index 5d0ab8e74b680..55622d41f1baf 100644
+--- a/drivers/net/ethernet/arc/Kconfig
++++ b/drivers/net/ethernet/arc/Kconfig
+@@ -20,6 +20,7 @@ config ARC_EMAC_CORE
+ depends on ARC || ARCH_ROCKCHIP || COMPILE_TEST
+ select MII
+ select PHYLIB
++ select CRC32
+
+ config ARC_EMAC
+ tristate "ARC EMAC support"
+diff --git a/drivers/net/ethernet/microchip/encx24j600-regmap.c b/drivers/net/ethernet/microchip/encx24j600-regmap.c
+index 44bb04d4d21b5..46181559d1f1b 100644
+--- a/drivers/net/ethernet/microchip/encx24j600-regmap.c
++++ b/drivers/net/ethernet/microchip/encx24j600-regmap.c
+@@ -505,13 +505,19 @@ static struct regmap_bus phymap_encx24j600 = {
+ .reg_read = regmap_encx24j600_phy_reg_read,
+ };
+
+-void devm_regmap_init_encx24j600(struct device *dev,
+- struct encx24j600_context *ctx)
++int devm_regmap_init_encx24j600(struct device *dev,
++ struct encx24j600_context *ctx)
+ {
+ mutex_init(&ctx->mutex);
+ regcfg.lock_arg = ctx;
+ ctx->regmap = devm_regmap_init(dev, ®map_encx24j600, ctx, ®cfg);
++ if (IS_ERR(ctx->regmap))
++ return PTR_ERR(ctx->regmap);
+ ctx->phymap = devm_regmap_init(dev, &phymap_encx24j600, ctx, &phycfg);
++ if (IS_ERR(ctx->phymap))
++ return PTR_ERR(ctx->phymap);
++
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(devm_regmap_init_encx24j600);
+
+diff --git a/drivers/net/ethernet/microchip/encx24j600.c b/drivers/net/ethernet/microchip/encx24j600.c
+index 84b6ad76f5bca..ff45326eb696b 100644
+--- a/drivers/net/ethernet/microchip/encx24j600.c
++++ b/drivers/net/ethernet/microchip/encx24j600.c
+@@ -1032,10 +1032,13 @@ static int encx24j600_spi_probe(struct spi_device *spi)
+ priv->speed = SPEED_100;
+
+ priv->ctx.spi = spi;
+- devm_regmap_init_encx24j600(&spi->dev, &priv->ctx);
+ ndev->irq = spi->irq;
+ ndev->netdev_ops = &encx24j600_netdev_ops;
+
++ ret = devm_regmap_init_encx24j600(&spi->dev, &priv->ctx);
++ if (ret)
++ goto out_free;
++
+ mutex_init(&priv->lock);
+
+ /* Reset device and check if it is connected */
+diff --git a/drivers/net/ethernet/microchip/encx24j600_hw.h b/drivers/net/ethernet/microchip/encx24j600_hw.h
+index f604a260ede79..711147a159aa9 100644
+--- a/drivers/net/ethernet/microchip/encx24j600_hw.h
++++ b/drivers/net/ethernet/microchip/encx24j600_hw.h
+@@ -15,8 +15,8 @@ struct encx24j600_context {
+ int bank;
+ };
+
+-void devm_regmap_init_encx24j600(struct device *dev,
+- struct encx24j600_context *ctx);
++int devm_regmap_init_encx24j600(struct device *dev,
++ struct encx24j600_context *ctx);
+
+ /* Single-byte instructions */
+ #define BANK_SELECT(bank) (0xC0 | ((bank & (BANK_MASK >> BANK_SHIFT)) << 1))
+diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c
+index b8983e73265a0..85a54215616c5 100644
+--- a/drivers/net/ethernet/neterion/s2io.c
++++ b/drivers/net/ethernet/neterion/s2io.c
+@@ -8569,7 +8569,7 @@ static void s2io_io_resume(struct pci_dev *pdev)
+ return;
+ }
+
+- if (s2io_set_mac_addr(netdev, netdev->dev_addr) == FAILURE) {
++ if (do_s2io_prog_unicast(netdev, netdev->dev_addr) == FAILURE) {
+ s2io_card_down(sp);
+ pr_err("Can't restore mac addr after reset.\n");
+ return;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
+index 9d77f318d11ed..43c85e584b6fe 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -1067,6 +1067,7 @@ static int qed_slowpath_start(struct qed_dev *cdev,
+ } else {
+ DP_NOTICE(cdev,
+ "Failed to acquire PTT for aRFS\n");
++ rc = -EINVAL;
+ goto err;
+ }
+ }
+diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
+index 418b0904cecb9..cc2fd19577656 100644
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -98,6 +98,10 @@ config USB_RTL8150
+ config USB_RTL8152
+ tristate "Realtek RTL8152/RTL8153 Based USB Ethernet Adapters"
+ select MII
++ select CRC32
++ select CRYPTO
++ select CRYPTO_HASH
++ select CRYPTO_SHA256
+ help
+ This option adds support for Realtek RTL8152 based USB 2.0
+ 10/100 Ethernet adapters and RTL8153 based USB 3.0 10/100/1000
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index 30c040786fde2..2e77d49c2657e 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -1061,7 +1061,8 @@ static void nvmem_shift_read_buffer_in_place(struct nvmem_cell *cell, void *buf)
+ *p-- = 0;
+
+ /* clear msb bits if any leftover in the last byte */
+- *p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0);
++ if (cell->nbits % BITS_PER_BYTE)
++ *p &= GENMASK((cell->nbits % BITS_PER_BYTE) - 1, 0);
+ }
+
+ static int __nvmem_cell_read(struct nvmem_device *nvmem,
+diff --git a/drivers/platform/mellanox/mlxreg-io.c b/drivers/platform/mellanox/mlxreg-io.c
+index acfaf64ffde68..1c3760c13f832 100644
+--- a/drivers/platform/mellanox/mlxreg-io.c
++++ b/drivers/platform/mellanox/mlxreg-io.c
+@@ -123,7 +123,7 @@ mlxreg_io_attr_store(struct device *dev, struct device_attribute *attr,
+ return -EINVAL;
+
+ /* Convert buffer to input value. */
+- ret = kstrtou32(buf, len, &input_val);
++ ret = kstrtou32(buf, 0, &input_val);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 19485c076ba30..d707993ac9215 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -28,6 +28,7 @@
+ #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009 0x1009
++#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 0x1100
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400 0x1400
+
+ #define PCI_VENDOR_ID_ETRON 0x1b6f
+@@ -89,6 +90,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ /* Look for vendor-specific quirks */
+ if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
+ (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK ||
++ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 ||
+ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1400)) {
+ if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK &&
+ pdev->revision == 0x0) {
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 7c981ad34251d..04c04328d075f 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -339,16 +339,22 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci,
+ /* Must be called with xhci->lock held, releases and aquires lock back */
+ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci, unsigned long flags)
+ {
+- u64 temp_64;
++ u32 temp_32;
+ int ret;
+
+ xhci_dbg(xhci, "Abort command ring\n");
+
+ reinit_completion(&xhci->cmd_ring_stop_completion);
+
+- temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
+- xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
+- &xhci->op_regs->cmd_ring);
++ /*
++ * The control bits like command stop, abort are located in lower
++ * dword of the command ring control register. Limit the write
++ * to the lower dword to avoid corrupting the command ring pointer
++ * in case if the command ring is stopped by the time upper dword
++ * is written.
++ */
++ temp_32 = readl(&xhci->op_regs->cmd_ring);
++ writel(temp_32 | CMD_RING_ABORT, &xhci->op_regs->cmd_ring);
+
+ /* Section 4.6.1.2 of xHCI 1.0 spec says software should also time the
+ * completion of the Command Abort operation. If CRR is not negated in 5
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index bebab0ec29786..c6eec712cc47a 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3093,10 +3093,13 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
+ ep = &vdev->eps[ep_index];
+
+ /* Bail out if toggle is already being cleared by a endpoint reset */
++ spin_lock_irqsave(&xhci->lock, flags);
+ if (ep->ep_state & EP_HARD_CLEAR_TOGGLE) {
+ ep->ep_state &= ~EP_HARD_CLEAR_TOGGLE;
++ spin_unlock_irqrestore(&xhci->lock, flags);
+ return;
+ }
++ spin_unlock_irqrestore(&xhci->lock, flags);
+ /* Only interrupt and bulk ep's use data toggle, USB2 spec 5.5.4-> */
+ if (usb_endpoint_xfer_control(&host_ep->desc) ||
+ usb_endpoint_xfer_isoc(&host_ep->desc))
+@@ -3182,8 +3185,10 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
+ xhci_free_command(xhci, cfg_cmd);
+ cleanup:
+ xhci_free_command(xhci, stop_cmd);
++ spin_lock_irqsave(&xhci->lock, flags);
+ if (ep->ep_state & EP_SOFT_CLEAR_TOGGLE)
+ ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE;
++ spin_unlock_irqrestore(&xhci->lock, flags);
+ }
+
+ static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
+diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
+index 2f6708b8b5c2f..892d745078900 100644
+--- a/drivers/usb/musb/musb_dsps.c
++++ b/drivers/usb/musb/musb_dsps.c
+@@ -901,11 +901,13 @@ static int dsps_probe(struct platform_device *pdev)
+ if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) {
+ ret = dsps_setup_optional_vbus_irq(pdev, glue);
+ if (ret)
+- goto err;
++ goto unregister_pdev;
+ }
+
+ return 0;
+
++unregister_pdev:
++ platform_device_unregister(glue->musb);
+ err:
+ pm_runtime_disable(&pdev->dev);
+ iounmap(glue->usbss_base);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 524b3c6e96e2a..eaf118ee2a865 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -246,11 +246,13 @@ static void option_instat_callback(struct urb *urb);
+ /* These Quectel products use Quectel's vendor ID */
+ #define QUECTEL_PRODUCT_EC21 0x0121
+ #define QUECTEL_PRODUCT_EC25 0x0125
++#define QUECTEL_PRODUCT_EG91 0x0191
+ #define QUECTEL_PRODUCT_EG95 0x0195
+ #define QUECTEL_PRODUCT_BG96 0x0296
+ #define QUECTEL_PRODUCT_EP06 0x0306
+ #define QUECTEL_PRODUCT_EM12 0x0512
+ #define QUECTEL_PRODUCT_RM500Q 0x0800
++#define QUECTEL_PRODUCT_EC200S_CN 0x6002
+ #define QUECTEL_PRODUCT_EC200T 0x6026
+
+ #define CMOTECH_VENDOR_ID 0x16d8
+@@ -1111,6 +1113,9 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25, 0xff, 0xff, 0xff),
+ .driver_info = NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG91, 0xff, 0xff, 0xff),
++ .driver_info = NUMEP2 },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG91, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0xff, 0xff),
+ .driver_info = NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0, 0) },
+@@ -1128,6 +1133,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
+ .driver_info = ZLP },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
+
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+@@ -1227,6 +1233,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff), /* Telit LE910Cx (RNDIS) */
+ .driver_info = NCTRL(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1204, 0xff), /* Telit LE910Cx (MBIM) */
++ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index 0f60363c1bbc8..b1b9923162a04 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -165,6 +165,7 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x1199, 0x907b)}, /* Sierra Wireless EM74xx */
+ {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */
+ {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */
++ {DEVICE_SWI(0x1199, 0x90d2)}, /* Sierra Wireless EM9191 QDL */
+ {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
+diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
+index 59e36ef4920f6..74f43ef2fb0f6 100644
+--- a/drivers/virtio/virtio.c
++++ b/drivers/virtio/virtio.c
+@@ -222,6 +222,17 @@ static int virtio_dev_probe(struct device *_d)
+ driver_features_legacy = driver_features;
+ }
+
++ /*
++ * Some devices detect legacy solely via F_VERSION_1. Write
++ * F_VERSION_1 to force LE config space accesses before FEATURES_OK for
++ * these when needed.
++ */
++ if (drv->validate && !virtio_legacy_is_little_endian()
++ && device_features & BIT_ULL(VIRTIO_F_VERSION_1)) {
++ dev->features = BIT_ULL(VIRTIO_F_VERSION_1);
++ dev->config->finalize_features(dev);
++ }
++
+ if (device_features & (1ULL << VIRTIO_F_VERSION_1))
+ dev->features = driver_features & device_features;
+ else
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 3a7b7e9cb8896..e0fc8c0948461 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1141,7 +1141,10 @@ next:
+ /* look for a conflicting sequence number */
+ di = btrfs_lookup_dir_index_item(trans, root, path, btrfs_ino(dir),
+ ref_index, name, namelen, 0);
+- if (di && !IS_ERR(di)) {
++ if (IS_ERR(di)) {
++ if (PTR_ERR(di) != -ENOENT)
++ return PTR_ERR(di);
++ } else if (di) {
+ ret = drop_one_dir_item(trans, root, path, dir, di);
+ if (ret)
+ return ret;
+@@ -1151,7 +1154,9 @@ next:
+ /* look for a conflicing name */
+ di = btrfs_lookup_dir_item(trans, root, path, btrfs_ino(dir),
+ name, namelen, 0);
+- if (di && !IS_ERR(di)) {
++ if (IS_ERR(di)) {
++ return PTR_ERR(di);
++ } else if (di) {
+ ret = drop_one_dir_item(trans, root, path, dir, di);
+ if (ret)
+ return ret;
+@@ -1866,8 +1871,8 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
+ struct btrfs_key log_key;
+ struct inode *dir;
+ u8 log_type;
+- int exists;
+- int ret = 0;
++ bool exists;
++ int ret;
+ bool update_size = (key->type == BTRFS_DIR_INDEX_KEY);
+ bool name_added = false;
+
+@@ -1887,12 +1892,12 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
+ name_len);
+
+ btrfs_dir_item_key_to_cpu(eb, di, &log_key);
+- exists = btrfs_lookup_inode(trans, root, path, &log_key, 0);
+- if (exists == 0)
+- exists = 1;
+- else
+- exists = 0;
++ ret = btrfs_lookup_inode(trans, root, path, &log_key, 0);
+ btrfs_release_path(path);
++ if (ret < 0)
++ goto out;
++ exists = (ret == 0);
++ ret = 0;
+
+ if (key->type == BTRFS_DIR_ITEM_KEY) {
+ dst_di = btrfs_lookup_dir_item(trans, root, path, key->objectid,
+@@ -1907,7 +1912,14 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
+ ret = -EINVAL;
+ goto out;
+ }
+- if (IS_ERR_OR_NULL(dst_di)) {
++
++ if (dst_di == ERR_PTR(-ENOENT))
++ dst_di = NULL;
++
++ if (IS_ERR(dst_di)) {
++ ret = PTR_ERR(dst_di);
++ goto out;
++ } else if (!dst_di) {
+ /* we need a sequence number to insert, so we only
+ * do inserts for the BTRFS_DIR_INDEX_KEY types
+ */
+diff --git a/net/nfc/af_nfc.c b/net/nfc/af_nfc.c
+index d3e594eb36d0a..adf16ff007cc2 100644
+--- a/net/nfc/af_nfc.c
++++ b/net/nfc/af_nfc.c
+@@ -72,6 +72,9 @@ int nfc_proto_register(const struct nfc_protocol *nfc_proto)
+ proto_tab[nfc_proto->id] = nfc_proto;
+ write_unlock(&proto_tab_lock);
+
++ if (rc)
++ proto_unregister(nfc_proto->proto);
++
+ return rc;
+ }
+ EXPORT_SYMBOL(nfc_proto_register);
+diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c
+index ec0a8998e52dc..d6258638a07a1 100644
+--- a/net/nfc/digital_core.c
++++ b/net/nfc/digital_core.c
+@@ -286,6 +286,7 @@ int digital_tg_configure_hw(struct nfc_digital_dev *ddev, int type, int param)
+ static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech)
+ {
+ struct digital_tg_mdaa_params *params;
++ int rc;
+
+ params = kzalloc(sizeof(*params), GFP_KERNEL);
+ if (!params)
+@@ -300,8 +301,12 @@ static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech)
+ get_random_bytes(params->nfcid2 + 2, NFC_NFCID2_MAXSIZE - 2);
+ params->sc = DIGITAL_SENSF_FELICA_SC;
+
+- return digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params,
+- 500, digital_tg_recv_atr_req, NULL);
++ rc = digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params,
++ 500, digital_tg_recv_atr_req, NULL);
++ if (rc)
++ kfree(params);
++
++ return rc;
+ }
+
+ static int digital_tg_listen_md(struct nfc_digital_dev *ddev, u8 rf_tech)
+diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c
+index 2021d1d58a75e..c092b02fde8ab 100644
+--- a/net/nfc/digital_technology.c
++++ b/net/nfc/digital_technology.c
+@@ -474,8 +474,12 @@ static int digital_in_send_sdd_req(struct nfc_digital_dev *ddev,
+ skb_put_u8(skb, sel_cmd);
+ skb_put_u8(skb, DIGITAL_SDD_REQ_SEL_PAR);
+
+- return digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res,
+- target);
++ rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res,
++ target);
++ if (rc)
++ kfree_skb(skb);
++
++ return rc;
+ }
+
+ static void digital_in_recv_sens_res(struct nfc_digital_dev *ddev, void *arg,
+diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
+index 008db8d59acef..fcfe41a954733 100644
+--- a/net/sched/sch_mqprio.c
++++ b/net/sched/sch_mqprio.c
+@@ -531,22 +531,28 @@ static int mqprio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
+ for (i = tc.offset; i < tc.offset + tc.count; i++) {
+ struct netdev_queue *q = netdev_get_tx_queue(dev, i);
+ struct Qdisc *qdisc = rtnl_dereference(q->qdisc);
+- struct gnet_stats_basic_cpu __percpu *cpu_bstats = NULL;
+- struct gnet_stats_queue __percpu *cpu_qstats = NULL;
+
+ spin_lock_bh(qdisc_lock(qdisc));
++
+ if (qdisc_is_percpu_stats(qdisc)) {
+- cpu_bstats = qdisc->cpu_bstats;
+- cpu_qstats = qdisc->cpu_qstats;
++ qlen = qdisc_qlen_sum(qdisc);
++
++ __gnet_stats_copy_basic(NULL, &bstats,
++ qdisc->cpu_bstats,
++ &qdisc->bstats);
++ __gnet_stats_copy_queue(&qstats,
++ qdisc->cpu_qstats,
++ &qdisc->qstats,
++ qlen);
++ } else {
++ qlen += qdisc->q.qlen;
++ bstats.bytes += qdisc->bstats.bytes;
++ bstats.packets += qdisc->bstats.packets;
++ qstats.backlog += qdisc->qstats.backlog;
++ qstats.drops += qdisc->qstats.drops;
++ qstats.requeues += qdisc->qstats.requeues;
++ qstats.overlimits += qdisc->qstats.overlimits;
+ }
+-
+- qlen = qdisc_qlen_sum(qdisc);
+- __gnet_stats_copy_basic(NULL, &sch->bstats,
+- cpu_bstats, &qdisc->bstats);
+- __gnet_stats_copy_queue(&sch->qstats,
+- cpu_qstats,
+- &qdisc->qstats,
+- qlen);
+ spin_unlock_bh(qdisc_lock(qdisc));
+ }
+
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index 0789109c2d093..35e1fb708f4a7 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -3673,7 +3673,7 @@ struct sctp_chunk *sctp_make_strreset_req(
+ outlen = (sizeof(outreq) + stream_len) * out;
+ inlen = (sizeof(inreq) + stream_len) * in;
+
+- retval = sctp_make_reconf(asoc, outlen + inlen);
++ retval = sctp_make_reconf(asoc, SCTP_PAD4(outlen) + SCTP_PAD4(inlen));
+ if (!retval)
+ return NULL;
+
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index 657e69125a462..321c41562b972 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -222,7 +222,7 @@ if ($arch =~ /(x86(_64)?)|(i386)/) {
+ $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\S+)";
+ $weak_regex = "^[0-9a-fA-F]+\\s+([wW])\\s+(\\S+)";
+ $section_regex = "Disassembly of section\\s+(\\S+):";
+-$function_regex = "^([0-9a-fA-F]+)\\s+<(.*?)>:";
++$function_regex = "^([0-9a-fA-F]+)\\s+<([^^]*?)>:";
+ $mcount_regex = "^\\s*([0-9a-fA-F]+):.*\\s(mcount|__fentry__)\$";
+ $section_type = '@progbits';
+ $mcount_adjust = 0;
+diff --git a/sound/core/seq_device.c b/sound/core/seq_device.c
+index e40a2cba5002a..5d16b20791195 100644
+--- a/sound/core/seq_device.c
++++ b/sound/core/seq_device.c
+@@ -162,6 +162,8 @@ static int snd_seq_device_dev_free(struct snd_device *device)
+ struct snd_seq_device *dev = device->device_data;
+
+ cancel_autoload_drivers();
++ if (dev->private_free)
++ dev->private_free(dev);
+ put_device(&dev->dev);
+ return 0;
+ }
+@@ -189,11 +191,7 @@ static int snd_seq_device_dev_disconnect(struct snd_device *device)
+
+ static void snd_seq_dev_release(struct device *dev)
+ {
+- struct snd_seq_device *sdev = to_seq_dev(dev);
+-
+- if (sdev->private_free)
+- sdev->private_free(sdev);
+- kfree(sdev);
++ kfree(to_seq_dev(dev));
+ }
+
+ /*
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 42c30fba699fb..650439286208a 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -519,6 +519,8 @@ static void alc_shutup_pins(struct hda_codec *codec)
+ struct alc_spec *spec = codec->spec;
+
+ switch (codec->core.vendor_id) {
++ case 0x10ec0236:
++ case 0x10ec0256:
+ case 0x10ec0283:
+ case 0x10ec0286:
+ case 0x10ec0288:
+@@ -2523,7 +2525,8 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x7715, "Clevo X170KM-G", ALC1220_FIXUP_CLEVO_PB51ED),
+ SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x9506, "Clevo P955HQ", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x950a, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950),
+@@ -3364,7 +3367,8 @@ static void alc256_shutup(struct hda_codec *codec)
+ /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
+ * when booting with headset plugged. So skip setting it for the codec alc257
+ */
+- if (codec->core.vendor_id != 0x10ec0257)
++ if (spec->codec_variant != ALC269_TYPE_ALC257 &&
++ spec->codec_variant != ALC269_TYPE_ALC256)
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+ if (!spec->no_shutup_pins)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-10-27 11:59 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-10-27 11:59 UTC (permalink / raw
To: gentoo-commits
commit: abc5cf76c2dd63885f6c7c557910452fc8cb3311
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 27 11:59:02 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Oct 27 11:59:02 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=abc5cf76
Linux patch 4.19.214
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1213_linux-4.19.214.patch | 1133 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1137 insertions(+)
diff --git a/0000_README b/0000_README
index 8b39e90..f4d1543 100644
--- a/0000_README
+++ b/0000_README
@@ -891,6 +891,10 @@ Patch: 1212_linux-4.19.213.patch
From: https://www.kernel.org
Desc: Linux 4.19.213
+Patch: 1213_linux-4.19.214.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.214
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1213_linux-4.19.214.patch b/1213_linux-4.19.214.patch
new file mode 100644
index 0000000..efb0339
--- /dev/null
+++ b/1213_linux-4.19.214.patch
@@ -0,0 +1,1133 @@
+diff --git a/Makefile b/Makefile
+index ac86ad939880e..358b07946bd12 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 213
++SUBLEVEL = 214
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 1877da816f650..d89d013f586cb 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -70,6 +70,7 @@ config ARM
+ select HAVE_FTRACE_MCOUNT_RECORD if (!XIP_KERNEL)
+ select HAVE_FUNCTION_GRAPH_TRACER if (!THUMB2_KERNEL)
+ select HAVE_FUNCTION_TRACER if (!XIP_KERNEL)
++ select HAVE_FUTEX_CMPXCHG if FUTEX
+ select HAVE_GCC_PLUGINS
+ select HAVE_GENERIC_DMA_COHERENT
+ select HAVE_HW_BREAKPOINT if (PERF_EVENTS && (CPU_V6 || CPU_V6K || CPU_V7))
+diff --git a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
+index e86e0c00eb6b1..f37af915a37e6 100644
+--- a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
++++ b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
+@@ -106,7 +106,6 @@
+ isc: isc@f0008000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_isc_base &pinctrl_isc_data_8bit &pinctrl_isc_data_9_10 &pinctrl_isc_data_11_12>;
+- status = "okay";
+ };
+
+ spi0: spi@f8000000 {
+diff --git a/arch/arm/boot/dts/spear3xx.dtsi b/arch/arm/boot/dts/spear3xx.dtsi
+index 118135d758990..4e4166d96b264 100644
+--- a/arch/arm/boot/dts/spear3xx.dtsi
++++ b/arch/arm/boot/dts/spear3xx.dtsi
+@@ -53,7 +53,7 @@
+ };
+
+ gmac: eth@e0800000 {
+- compatible = "st,spear600-gmac";
++ compatible = "snps,dwmac-3.40a";
+ reg = <0xe0800000 0x8000>;
+ interrupts = <23 22>;
+ interrupt-names = "macirq", "eth_wake_irq";
+diff --git a/arch/nios2/include/asm/irqflags.h b/arch/nios2/include/asm/irqflags.h
+index 75ab92e639f85..0338fcb88203c 100644
+--- a/arch/nios2/include/asm/irqflags.h
++++ b/arch/nios2/include/asm/irqflags.h
+@@ -22,7 +22,7 @@
+
+ static inline unsigned long arch_local_save_flags(void)
+ {
+- return RDCTL(CTL_STATUS);
++ return RDCTL(CTL_FSTATUS);
+ }
+
+ /*
+@@ -31,7 +31,7 @@ static inline unsigned long arch_local_save_flags(void)
+ */
+ static inline void arch_local_irq_restore(unsigned long flags)
+ {
+- WRCTL(CTL_STATUS, flags);
++ WRCTL(CTL_FSTATUS, flags);
+ }
+
+ static inline void arch_local_irq_disable(void)
+diff --git a/arch/nios2/include/asm/registers.h b/arch/nios2/include/asm/registers.h
+index 615bce19b546e..33824f2ad1ab7 100644
+--- a/arch/nios2/include/asm/registers.h
++++ b/arch/nios2/include/asm/registers.h
+@@ -24,7 +24,7 @@
+ #endif
+
+ /* control register numbers */
+-#define CTL_STATUS 0
++#define CTL_FSTATUS 0
+ #define CTL_ESTATUS 1
+ #define CTL_BSTATUS 2
+ #define CTL_IENABLE 3
+diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
+index 42285f35d3135..db5122765f166 100644
+--- a/arch/xtensa/platforms/xtfpga/setup.c
++++ b/arch/xtensa/platforms/xtfpga/setup.c
+@@ -54,8 +54,12 @@ void platform_power_off(void)
+
+ void platform_restart(void)
+ {
+- /* Flush and reset the mmu, simulate a processor reset, and
+- * jump to the reset vector. */
++ /* Try software reset first. */
++ WRITE_ONCE(*(u32 *)XTFPGA_SWRST_VADDR, 0xdead);
++
++ /* If software reset did not work, flush and reset the mmu,
++ * simulate a processor reset, and jump to the reset vector.
++ */
+ cpu_reset();
+ /* control never gets here */
+ }
+@@ -85,7 +89,7 @@ void __init platform_calibrate_ccount(void)
+
+ #endif
+
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+
+ static void __init xtfpga_clk_setup(struct device_node *np)
+ {
+@@ -303,4 +307,4 @@ static int __init xtavnet_init(void)
+ */
+ arch_initcall(xtavnet_init);
+
+-#endif /* CONFIG_OF */
++#endif /* CONFIG_USE_OF */
+diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
+index 18de41a266ebe..aa625b7ddcce2 100644
+--- a/drivers/isdn/capi/kcapi.c
++++ b/drivers/isdn/capi/kcapi.c
+@@ -565,6 +565,11 @@ int detach_capi_ctr(struct capi_ctr *ctr)
+
+ ctr_down(ctr, CAPI_CTR_DETACHED);
+
++ if (ctr->cnr < 1 || ctr->cnr - 1 >= CAPI_MAXCONTR) {
++ err = -EINVAL;
++ goto unlock_out;
++ }
++
+ if (capi_controller[ctr->cnr - 1] != ctr) {
+ err = -EINVAL;
+ goto unlock_out;
+diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
+index 448370da2c3f2..4a342daac98dc 100644
+--- a/drivers/isdn/hardware/mISDN/netjet.c
++++ b/drivers/isdn/hardware/mISDN/netjet.c
+@@ -963,8 +963,8 @@ nj_release(struct tiger_hw *card)
+ nj_disable_hwirq(card);
+ mode_tiger(&card->bc[0], ISDN_P_NONE);
+ mode_tiger(&card->bc[1], ISDN_P_NONE);
+- card->isac.release(&card->isac);
+ spin_unlock_irqrestore(&card->lock, flags);
++ card->isac.release(&card->isac);
+ release_region(card->base, card->base_s);
+ card->base_s = 0;
+ }
+diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
+index 771a460837397..963da8eda1687 100644
+--- a/drivers/net/can/rcar/rcar_can.c
++++ b/drivers/net/can/rcar/rcar_can.c
+@@ -857,10 +857,12 @@ static int __maybe_unused rcar_can_suspend(struct device *dev)
+ struct rcar_can_priv *priv = netdev_priv(ndev);
+ u16 ctlr;
+
+- if (netif_running(ndev)) {
+- netif_stop_queue(ndev);
+- netif_device_detach(ndev);
+- }
++ if (!netif_running(ndev))
++ return 0;
++
++ netif_stop_queue(ndev);
++ netif_device_detach(ndev);
++
+ ctlr = readw(&priv->regs->ctlr);
+ ctlr |= RCAR_CAN_CTLR_CANM_HALT;
+ writew(ctlr, &priv->regs->ctlr);
+@@ -879,6 +881,9 @@ static int __maybe_unused rcar_can_resume(struct device *dev)
+ u16 ctlr;
+ int err;
+
++ if (!netif_running(ndev))
++ return 0;
++
+ err = clk_enable(priv->clk);
+ if (err) {
+ netdev_err(ndev, "clk_enable() failed, error %d\n", err);
+@@ -892,10 +897,9 @@ static int __maybe_unused rcar_can_resume(struct device *dev)
+ writew(ctlr, &priv->regs->ctlr);
+ priv->can.state = CAN_STATE_ERROR_ACTIVE;
+
+- if (netif_running(ndev)) {
+- netif_device_attach(ndev);
+- netif_start_queue(ndev);
+- }
++ netif_device_attach(ndev);
++ netif_start_queue(ndev);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
+index a97b81d1d0da9..e989841b411fa 100644
+--- a/drivers/net/can/sja1000/peak_pci.c
++++ b/drivers/net/can/sja1000/peak_pci.c
+@@ -739,16 +739,15 @@ static void peak_pci_remove(struct pci_dev *pdev)
+ struct net_device *prev_dev = chan->prev_dev;
+
+ dev_info(&pdev->dev, "removing device %s\n", dev->name);
++ /* do that only for first channel */
++ if (!prev_dev && chan->pciec_card)
++ peak_pciec_remove(chan->pciec_card);
+ unregister_sja1000dev(dev);
+ free_sja1000dev(dev);
+ dev = prev_dev;
+
+- if (!dev) {
+- /* do that only for first channel */
+- if (chan->pciec_card)
+- peak_pciec_remove(chan->pciec_card);
++ if (!dev)
+ break;
+- }
+ priv = netdev_priv(dev);
+ chan = priv->priv;
+ }
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+index 40ac37fe9dcde..d27141b9eda0c 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+@@ -559,11 +559,10 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if,
+ } else if (sm->channel_p_w_b & PUCAN_BUS_WARNING) {
+ new_state = CAN_STATE_ERROR_WARNING;
+ } else {
+- /* no error bit (so, no error skb, back to active state) */
+- dev->can.state = CAN_STATE_ERROR_ACTIVE;
++ /* back to (or still in) ERROR_ACTIVE state */
++ new_state = CAN_STATE_ERROR_ACTIVE;
+ pdev->bec.txerr = 0;
+ pdev->bec.rxerr = 0;
+- return 0;
+ }
+
+ /* state hasn't changed */
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+index f9259e568fa05..b250d0fe9ac50 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+@@ -10,6 +10,27 @@ static LIST_HEAD(hnae3_ae_algo_list);
+ static LIST_HEAD(hnae3_client_list);
+ static LIST_HEAD(hnae3_ae_dev_list);
+
++void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo)
++{
++ const struct pci_device_id *pci_id;
++ struct hnae3_ae_dev *ae_dev;
++
++ if (!ae_algo)
++ return;
++
++ list_for_each_entry(ae_dev, &hnae3_ae_dev_list, node) {
++ if (!hnae3_get_bit(ae_dev->flag, HNAE3_DEV_INITED_B))
++ continue;
++
++ pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev);
++ if (!pci_id)
++ continue;
++ if (IS_ENABLED(CONFIG_PCI_IOV))
++ pci_disable_sriov(ae_dev->pdev);
++ }
++}
++EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare);
++
+ /* we are keeping things simple and using single lock for all the
+ * list. This is a non-critical code so other updations, if happen
+ * in parallel, can wait.
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index 5e1a7ab06c63b..866e9f293b4c4 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -516,6 +516,7 @@ struct hnae3_handle {
+ int hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev);
+ void hnae3_unregister_ae_dev(struct hnae3_ae_dev *ae_dev);
+
++void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo);
+ void hnae3_unregister_ae_algo(struct hnae3_ae_algo *ae_algo);
+ void hnae3_register_ae_algo(struct hnae3_ae_algo *ae_algo);
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index dd935cd1fb44f..865d27aea7d77 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -96,6 +96,15 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
+ *changed = true;
+ break;
+ case IEEE_8021QAZ_TSA_ETS:
++ /* The hardware will switch to sp mode if bandwidth is
++ * 0, so limit ets bandwidth must be greater than 0.
++ */
++ if (!ets->tc_tx_bw[i]) {
++ dev_err(&hdev->pdev->dev,
++ "tc%u ets bw cannot be 0\n", i);
++ return -EINVAL;
++ }
++
+ if (hdev->tm_info.tc_info[i].tc_sch_mode !=
+ HCLGE_SCH_MODE_DWRR)
+ *changed = true;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 16ab000454f91..2c334b56fd42c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -6387,6 +6387,7 @@ static int hclge_init(void)
+
+ static void hclge_exit(void)
+ {
++ hnae3_unregister_ae_algo_prepare(&ae_algo);
+ hnae3_unregister_ae_algo(&ae_algo);
+ }
+ module_init(hclge_init);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
+index fad503820e040..b3365b34cac7c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
+@@ -71,6 +71,7 @@ err_remove_config_dt:
+
+ static const struct of_device_id dwmac_generic_match[] = {
+ { .compatible = "st,spear600-gmac"},
++ { .compatible = "snps,dwmac-3.40a"},
+ { .compatible = "snps,dwmac-3.50a"},
+ { .compatible = "snps,dwmac-3.610"},
+ { .compatible = "snps,dwmac-3.70a"},
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+index 2b800ce1d5bf4..05f5084158bf5 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -469,6 +469,14 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
+ plat->pmt = 1;
+ }
+
++ if (of_device_is_compatible(np, "snps,dwmac-3.40a")) {
++ plat->has_gmac = 1;
++ plat->enh_desc = 1;
++ plat->tx_coe = 1;
++ plat->bugged_jumbo = 1;
++ plat->pmt = 1;
++ }
++
+ if (of_device_is_compatible(np, "snps,dwmac-4.00") ||
+ of_device_is_compatible(np, "snps,dwmac-4.10a") ||
+ of_device_is_compatible(np, "snps,dwmac-4.20a")) {
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index 3207da2224f67..f31a822bf4cca 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -388,6 +388,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
+ err = device_register(&bus->dev);
+ if (err) {
+ pr_err("mii_bus %s failed to register\n", bus->id);
++ put_device(&bus->dev);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
+index cc2fd19577656..23fa0e2a75ff2 100644
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -116,6 +116,7 @@ config USB_LAN78XX
+ select PHYLIB
+ select MICROCHIP_PHY
+ select FIXED_PHY
++ select CRC32
+ help
+ This option adds support for Microchip LAN78XX based USB 2
+ & USB 3 10/100/1000 Ethernet adapters.
+diff --git a/drivers/platform/x86/intel_scu_ipc.c b/drivers/platform/x86/intel_scu_ipc.c
+index 54f131bec192c..0d28576756ac1 100644
+--- a/drivers/platform/x86/intel_scu_ipc.c
++++ b/drivers/platform/x86/intel_scu_ipc.c
+@@ -183,7 +183,7 @@ static inline int busy_loop(struct intel_scu_ipc_dev *scu)
+ return 0;
+ }
+
+-/* Wait till ipc ioc interrupt is received or timeout in 3 HZ */
++/* Wait till ipc ioc interrupt is received or timeout in 10 HZ */
+ static inline int ipc_wait_for_interrupt(struct intel_scu_ipc_dev *scu)
+ {
+ int status;
+diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
+index f3194d634f7f2..b3d6ea92b4f7c 100644
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -218,7 +218,8 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
+ goto fail;
+ }
+
+- shost->cmd_per_lun = min_t(short, shost->cmd_per_lun,
++ /* Use min_t(int, ...) in case shost->can_queue exceeds SHRT_MAX */
++ shost->cmd_per_lun = min_t(int, shost->cmd_per_lun,
+ shost->can_queue);
+
+ error = scsi_init_sense_cache(shost);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index e0fc8c0948461..c856c32cc926c 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -881,9 +881,11 @@ out:
+ }
+
+ /*
+- * helper function to see if a given name and sequence number found
+- * in an inode back reference are already in a directory and correctly
+- * point to this inode
++ * See if a given name and sequence number found in an inode back reference are
++ * already in a directory and correctly point to this inode.
++ *
++ * Returns: < 0 on error, 0 if the directory entry does not exists and 1 if it
++ * exists.
+ */
+ static noinline int inode_in_dir(struct btrfs_root *root,
+ struct btrfs_path *path,
+@@ -892,29 +894,35 @@ static noinline int inode_in_dir(struct btrfs_root *root,
+ {
+ struct btrfs_dir_item *di;
+ struct btrfs_key location;
+- int match = 0;
++ int ret = 0;
+
+ di = btrfs_lookup_dir_index_item(NULL, root, path, dirid,
+ index, name, name_len, 0);
+- if (di && !IS_ERR(di)) {
++ if (IS_ERR(di)) {
++ if (PTR_ERR(di) != -ENOENT)
++ ret = PTR_ERR(di);
++ goto out;
++ } else if (di) {
+ btrfs_dir_item_key_to_cpu(path->nodes[0], di, &location);
+ if (location.objectid != objectid)
+ goto out;
+- } else
++ } else {
+ goto out;
+- btrfs_release_path(path);
++ }
+
++ btrfs_release_path(path);
+ di = btrfs_lookup_dir_item(NULL, root, path, dirid, name, name_len, 0);
+- if (di && !IS_ERR(di)) {
+- btrfs_dir_item_key_to_cpu(path->nodes[0], di, &location);
+- if (location.objectid != objectid)
+- goto out;
+- } else
++ if (IS_ERR(di)) {
++ ret = PTR_ERR(di);
+ goto out;
+- match = 1;
++ } else if (di) {
++ btrfs_dir_item_key_to_cpu(path->nodes[0], di, &location);
++ if (location.objectid == objectid)
++ ret = 1;
++ }
+ out:
+ btrfs_release_path(path);
+- return match;
++ return ret;
+ }
+
+ /*
+@@ -1421,10 +1429,12 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
+ if (ret)
+ goto out;
+
+- /* if we already have a perfect match, we're done */
+- if (!inode_in_dir(root, path, btrfs_ino(BTRFS_I(dir)),
+- btrfs_ino(BTRFS_I(inode)), ref_index,
+- name, namelen)) {
++ ret = inode_in_dir(root, path, btrfs_ino(BTRFS_I(dir)),
++ btrfs_ino(BTRFS_I(inode)), ref_index,
++ name, namelen);
++ if (ret < 0) {
++ goto out;
++ } else if (ret == 0) {
+ /*
+ * look for a conflicting back reference in the
+ * metadata. if we find one we have to unlink that name
+@@ -1483,6 +1493,7 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
+
+ btrfs_update_inode(trans, root, inode);
+ }
++ /* Else, ret == 1, we already have a perfect match, we're done. */
+
+ ref_ptr = (unsigned long)(ref_ptr + ref_struct_size) + namelen;
+ kfree(name);
+diff --git a/fs/exec.c b/fs/exec.c
+index 6eea921a7e72f..e87e3c020c61e 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -984,7 +984,7 @@ int kernel_read_file_from_fd(int fd, void **buf, loff_t *size, loff_t max_size,
+ struct fd f = fdget(fd);
+ int ret = -EBADF;
+
+- if (!f.file)
++ if (!f.file || !(f.file->f_mode & FMODE_READ))
+ goto out;
+
+ ret = kernel_read_file(f.file, buf, size, max_size, id);
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index cb69660d07797..ff9899cc9913f 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -788,7 +788,10 @@ out_close:
+ svc_xprt_put(xprt);
+ }
+ out_err:
+- nfsd_destroy(net);
++ if (!list_empty(&nn->nfsd_serv->sv_permsocks))
++ nn->nfsd_serv->sv_nrthreads--;
++ else
++ nfsd_destroy(net);
+ return err;
+ }
+
+diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
+index ff0e083ce2a1a..046f5e3c9622d 100644
+--- a/fs/ocfs2/alloc.c
++++ b/fs/ocfs2/alloc.c
+@@ -7048,7 +7048,7 @@ void ocfs2_set_inode_data_inline(struct inode *inode, struct ocfs2_dinode *di)
+ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
+ struct buffer_head *di_bh)
+ {
+- int ret, i, has_data, num_pages = 0;
++ int ret, has_data, num_pages = 0;
+ int need_free = 0;
+ u32 bit_off, num;
+ handle_t *handle;
+@@ -7057,26 +7057,17 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
+ struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+ struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
+ struct ocfs2_alloc_context *data_ac = NULL;
+- struct page **pages = NULL;
+- loff_t end = osb->s_clustersize;
++ struct page *page = NULL;
+ struct ocfs2_extent_tree et;
+ int did_quota = 0;
+
+ has_data = i_size_read(inode) ? 1 : 0;
+
+ if (has_data) {
+- pages = kcalloc(ocfs2_pages_per_cluster(osb->sb),
+- sizeof(struct page *), GFP_NOFS);
+- if (pages == NULL) {
+- ret = -ENOMEM;
+- mlog_errno(ret);
+- return ret;
+- }
+-
+ ret = ocfs2_reserve_clusters(osb, 1, &data_ac);
+ if (ret) {
+ mlog_errno(ret);
+- goto free_pages;
++ goto out;
+ }
+ }
+
+@@ -7096,7 +7087,8 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
+ }
+
+ if (has_data) {
+- unsigned int page_end;
++ unsigned int page_end = min_t(unsigned, PAGE_SIZE,
++ osb->s_clustersize);
+ u64 phys;
+
+ ret = dquot_alloc_space_nodirty(inode,
+@@ -7120,15 +7112,8 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
+ */
+ block = phys = ocfs2_clusters_to_blocks(inode->i_sb, bit_off);
+
+- /*
+- * Non sparse file systems zero on extend, so no need
+- * to do that now.
+- */
+- if (!ocfs2_sparse_alloc(osb) &&
+- PAGE_SIZE < osb->s_clustersize)
+- end = PAGE_SIZE;
+-
+- ret = ocfs2_grab_eof_pages(inode, 0, end, pages, &num_pages);
++ ret = ocfs2_grab_eof_pages(inode, 0, page_end, &page,
++ &num_pages);
+ if (ret) {
+ mlog_errno(ret);
+ need_free = 1;
+@@ -7139,20 +7124,15 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
+ * This should populate the 1st page for us and mark
+ * it up to date.
+ */
+- ret = ocfs2_read_inline_data(inode, pages[0], di_bh);
++ ret = ocfs2_read_inline_data(inode, page, di_bh);
+ if (ret) {
+ mlog_errno(ret);
+ need_free = 1;
+ goto out_unlock;
+ }
+
+- page_end = PAGE_SIZE;
+- if (PAGE_SIZE > osb->s_clustersize)
+- page_end = osb->s_clustersize;
+-
+- for (i = 0; i < num_pages; i++)
+- ocfs2_map_and_dirty_page(inode, handle, 0, page_end,
+- pages[i], i > 0, &phys);
++ ocfs2_map_and_dirty_page(inode, handle, 0, page_end, page, 0,
++ &phys);
+ }
+
+ spin_lock(&oi->ip_lock);
+@@ -7183,8 +7163,8 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
+ }
+
+ out_unlock:
+- if (pages)
+- ocfs2_unlock_and_free_pages(pages, num_pages);
++ if (page)
++ ocfs2_unlock_and_free_pages(&page, num_pages);
+
+ out_commit:
+ if (ret < 0 && did_quota)
+@@ -7208,8 +7188,6 @@ out_commit:
+ out:
+ if (data_ac)
+ ocfs2_free_alloc_context(data_ac);
+-free_pages:
+- kfree(pages);
+ return ret;
+ }
+
+diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
+index 09bc2cf5f61cd..b5aa60430a6a7 100644
+--- a/fs/ocfs2/super.c
++++ b/fs/ocfs2/super.c
+@@ -2205,11 +2205,17 @@ static int ocfs2_initialize_super(struct super_block *sb,
+ }
+
+ if (ocfs2_clusterinfo_valid(osb)) {
++ /*
++ * ci_stack and ci_cluster in ocfs2_cluster_info may not be null
++ * terminated, so make sure no overflow happens here by using
++ * memcpy. Destination strings will always be null terminated
++ * because osb is allocated using kzalloc.
++ */
+ osb->osb_stackflags =
+ OCFS2_RAW_SB(di)->s_cluster_info.ci_stackflags;
+- strlcpy(osb->osb_cluster_stack,
++ memcpy(osb->osb_cluster_stack,
+ OCFS2_RAW_SB(di)->s_cluster_info.ci_stack,
+- OCFS2_STACK_LABEL_LEN + 1);
++ OCFS2_STACK_LABEL_LEN);
+ if (strlen(osb->osb_cluster_stack) != OCFS2_STACK_LABEL_LEN) {
+ mlog(ML_ERROR,
+ "couldn't mount because of an invalid "
+@@ -2218,9 +2224,9 @@ static int ocfs2_initialize_super(struct super_block *sb,
+ status = -EINVAL;
+ goto bail;
+ }
+- strlcpy(osb->osb_cluster_name,
++ memcpy(osb->osb_cluster_name,
+ OCFS2_RAW_SB(di)->s_cluster_info.ci_cluster,
+- OCFS2_CLUSTER_NAME_LEN + 1);
++ OCFS2_CLUSTER_NAME_LEN);
+ } else {
+ /* The empty string is identical with classic tools that
+ * don't know about s_cluster_info. */
+diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h
+index b81f9e1d74b0a..9d249dfbab726 100644
+--- a/include/linux/elfcore.h
++++ b/include/linux/elfcore.h
+@@ -58,7 +58,7 @@ static inline int elf_core_copy_task_xfpregs(struct task_struct *t, elf_fpxregse
+ }
+ #endif
+
+-#if defined(CONFIG_UM) || defined(CONFIG_IA64)
++#if (defined(CONFIG_UML) && defined(CONFIG_X86_32)) || defined(CONFIG_IA64)
+ /*
+ * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out
+ * extra segments containing the gate DSO contents. Dumping its
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index 3a2397444076e..1c82b0d25498f 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -1422,6 +1422,12 @@ void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
+ if (unlikely(dma_debug_disabled()))
+ return;
+
++ for_each_sg(sg, s, nents, i) {
++ check_for_stack(dev, sg_page(s), s->offset);
++ if (!PageHighMem(sg_page(s)))
++ check_for_illegal_area(dev, sg_virt(s), s->length);
++ }
++
+ for_each_sg(sg, s, mapped_ents, i) {
+ entry = dma_entry_alloc();
+ if (!entry)
+@@ -1437,12 +1443,6 @@ void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
+ entry->sg_call_ents = nents;
+ entry->sg_mapped_ents = mapped_ents;
+
+- check_for_stack(dev, sg_page(s), s->offset);
+-
+- if (!PageHighMem(sg_page(s))) {
+- check_for_illegal_area(dev, sg_virt(s), sg_dma_len(s));
+- }
+-
+ check_sg_segment(dev, s);
+
+ add_dma_entry(entry);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index c5c8aafa29cfc..998d141488a95 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -6327,7 +6327,7 @@ __ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
+ struct ftrace_ops *op;
+ int bit;
+
+- bit = trace_test_and_set_recursion(TRACE_LIST_START, TRACE_LIST_MAX);
++ bit = trace_test_and_set_recursion(TRACE_LIST_START);
+ if (bit < 0)
+ return;
+
+@@ -6399,7 +6399,7 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip,
+ {
+ int bit;
+
+- bit = trace_test_and_set_recursion(TRACE_LIST_START, TRACE_LIST_MAX);
++ bit = trace_test_and_set_recursion(TRACE_LIST_START);
+ if (bit < 0)
+ return;
+
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index afaeef6c15b30..2c4068d8776ea 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -467,23 +467,8 @@ struct tracer {
+ * When function tracing occurs, the following steps are made:
+ * If arch does not support a ftrace feature:
+ * call internal function (uses INTERNAL bits) which calls...
+- * If callback is registered to the "global" list, the list
+- * function is called and recursion checks the GLOBAL bits.
+- * then this function calls...
+ * The function callback, which can use the FTRACE bits to
+ * check for recursion.
+- *
+- * Now if the arch does not suppport a feature, and it calls
+- * the global list function which calls the ftrace callback
+- * all three of these steps will do a recursion protection.
+- * There's no reason to do one if the previous caller already
+- * did. The recursion that we are protecting against will
+- * go through the same steps again.
+- *
+- * To prevent the multiple recursion checks, if a recursion
+- * bit is set that is higher than the MAX bit of the current
+- * check, then we know that the check was made by the previous
+- * caller, and we can skip the current check.
+ */
+ enum {
+ TRACE_BUFFER_BIT,
+@@ -496,12 +481,14 @@ enum {
+ TRACE_FTRACE_NMI_BIT,
+ TRACE_FTRACE_IRQ_BIT,
+ TRACE_FTRACE_SIRQ_BIT,
++ TRACE_FTRACE_TRANSITION_BIT,
+
+- /* INTERNAL_BITs must be greater than FTRACE_BITs */
++ /* Internal use recursion bits */
+ TRACE_INTERNAL_BIT,
+ TRACE_INTERNAL_NMI_BIT,
+ TRACE_INTERNAL_IRQ_BIT,
+ TRACE_INTERNAL_SIRQ_BIT,
++ TRACE_INTERNAL_TRANSITION_BIT,
+
+ TRACE_BRANCH_BIT,
+ /*
+@@ -534,12 +521,6 @@ enum {
+
+ TRACE_GRAPH_DEPTH_START_BIT,
+ TRACE_GRAPH_DEPTH_END_BIT,
+-
+- /*
+- * When transitioning between context, the preempt_count() may
+- * not be correct. Allow for a single recursion to cover this case.
+- */
+- TRACE_TRANSITION_BIT,
+ };
+
+ #define trace_recursion_set(bit) do { (current)->trace_recursion |= (1<<(bit)); } while (0)
+@@ -559,12 +540,18 @@ enum {
+ #define TRACE_CONTEXT_BITS 4
+
+ #define TRACE_FTRACE_START TRACE_FTRACE_BIT
+-#define TRACE_FTRACE_MAX ((1 << (TRACE_FTRACE_START + TRACE_CONTEXT_BITS)) - 1)
+
+ #define TRACE_LIST_START TRACE_INTERNAL_BIT
+-#define TRACE_LIST_MAX ((1 << (TRACE_LIST_START + TRACE_CONTEXT_BITS)) - 1)
+
+-#define TRACE_CONTEXT_MASK TRACE_LIST_MAX
++#define TRACE_CONTEXT_MASK ((1 << (TRACE_LIST_START + TRACE_CONTEXT_BITS)) - 1)
++
++enum {
++ TRACE_CTX_NMI,
++ TRACE_CTX_IRQ,
++ TRACE_CTX_SOFTIRQ,
++ TRACE_CTX_NORMAL,
++ TRACE_CTX_TRANSITION,
++};
+
+ static __always_inline int trace_get_context_bit(void)
+ {
+@@ -572,59 +559,48 @@ static __always_inline int trace_get_context_bit(void)
+
+ if (in_interrupt()) {
+ if (in_nmi())
+- bit = 0;
++ bit = TRACE_CTX_NMI;
+
+ else if (in_irq())
+- bit = 1;
++ bit = TRACE_CTX_IRQ;
+ else
+- bit = 2;
++ bit = TRACE_CTX_SOFTIRQ;
+ } else
+- bit = 3;
++ bit = TRACE_CTX_NORMAL;
+
+ return bit;
+ }
+
+-static __always_inline int trace_test_and_set_recursion(int start, int max)
++static __always_inline int trace_test_and_set_recursion(int start)
+ {
+ unsigned int val = current->trace_recursion;
+ int bit;
+
+- /* A previous recursion check was made */
+- if ((val & TRACE_CONTEXT_MASK) > max)
+- return 0;
+-
+ bit = trace_get_context_bit() + start;
+ if (unlikely(val & (1 << bit))) {
+ /*
+ * It could be that preempt_count has not been updated during
+ * a switch between contexts. Allow for a single recursion.
+ */
+- bit = TRACE_TRANSITION_BIT;
++ bit = start + TRACE_CTX_TRANSITION;
+ if (trace_recursion_test(bit))
+ return -1;
+ trace_recursion_set(bit);
+ barrier();
+- return bit + 1;
++ return bit;
+ }
+
+- /* Normal check passed, clear the transition to allow it again */
+- trace_recursion_clear(TRACE_TRANSITION_BIT);
+-
+ val |= 1 << bit;
+ current->trace_recursion = val;
+ barrier();
+
+- return bit + 1;
++ return bit;
+ }
+
+ static __always_inline void trace_clear_recursion(int bit)
+ {
+ unsigned int val = current->trace_recursion;
+
+- if (!bit)
+- return;
+-
+- bit--;
+ bit = 1 << bit;
+ val &= ~bit;
+
+diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c
+index b611cd36e22db..4e8acfe3437fd 100644
+--- a/kernel/trace/trace_functions.c
++++ b/kernel/trace/trace_functions.c
+@@ -138,7 +138,7 @@ function_trace_call(unsigned long ip, unsigned long parent_ip,
+ pc = preempt_count();
+ preempt_disable_notrace();
+
+- bit = trace_test_and_set_recursion(TRACE_FTRACE_START, TRACE_FTRACE_MAX);
++ bit = trace_test_and_set_recursion(TRACE_FTRACE_START);
+ if (bit < 0)
+ goto out;
+
+diff --git a/mm/slub.c b/mm/slub.c
+index b6c5c8fd265d2..499fb073d1ffd 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1392,7 +1392,8 @@ static __always_inline bool slab_free_hook(struct kmem_cache *s, void *x)
+ }
+
+ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
+- void **head, void **tail)
++ void **head, void **tail,
++ int *cnt)
+ {
+ /*
+ * Compiler cannot detect this function can be removed if slab_free_hook()
+@@ -1421,6 +1422,12 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
+ *head = object;
+ if (!*tail)
+ *tail = object;
++ } else {
++ /*
++ * Adjust the reconstructed freelist depth
++ * accordingly if object's reuse is delayed.
++ */
++ --(*cnt);
+ }
+ } while (object != old_tail);
+
+@@ -2988,7 +2995,7 @@ static __always_inline void slab_free(struct kmem_cache *s, struct page *page,
+ * With KASAN enabled slab_free_freelist_hook modifies the freelist
+ * to remove objects, whose reuse must be delayed.
+ */
+- if (slab_free_freelist_hook(s, &head, &tail))
++ if (slab_free_freelist_hook(s, &head, &tail, &cnt))
+ do_slab_free(s, page, head, tail, cnt, addr);
+ }
+
+diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
+index e0fb56d67d42f..56cddadb65d0c 100644
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -93,7 +93,7 @@ config NF_CONNTRACK_MARK
+ config NF_CONNTRACK_SECMARK
+ bool 'Connection tracking security mark support'
+ depends on NETWORK_SECMARK
+- default m if NETFILTER_ADVANCED=n
++ default y if NETFILTER_ADVANCED=n
+ help
+ This option enables security markings to be applied to
+ connections. Typically they are copied to connections from
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 6208fa09fe713..3bf8d7f3cdc32 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -3955,6 +3955,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
+ tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
+ tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
+ tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
++#ifdef CONFIG_IP_VS_DEBUG
++ /* Global sysctls must be ro in non-init netns */
++ if (!net_eq(net, &init_net))
++ tbl[idx++].mode = 0444;
++#endif
+
+ ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
+ if (ipvs->sysctl_hdr == NULL) {
+diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c
+index e3bbf1937d0e9..7681f89dc312b 100644
+--- a/net/nfc/nci/rsp.c
++++ b/net/nfc/nci/rsp.c
+@@ -289,6 +289,8 @@ static void nci_core_conn_close_rsp_packet(struct nci_dev *ndev,
+ ndev->cur_conn_id);
+ if (conn_info) {
+ list_del(&conn_info->list);
++ if (conn_info == ndev->rf_conn_info)
++ ndev->rf_conn_info = NULL;
+ devm_kfree(&ndev->nfc_dev->dev, conn_info);
+ }
+ }
+diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
+index 0a482f3415767..93ca13e4f8f95 100644
+--- a/scripts/Makefile.gcc-plugins
++++ b/scripts/Makefile.gcc-plugins
+@@ -17,6 +17,10 @@ gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE) \
+ += -fplugin-arg-structleak_plugin-verbose
+ gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL) \
+ += -fplugin-arg-structleak_plugin-byref-all
++ifdef CONFIG_GCC_PLUGIN_STRUCTLEAK
++ DISABLE_STRUCTLEAK_PLUGIN += -fplugin-arg-structleak_plugin-disable
++endif
++export DISABLE_STRUCTLEAK_PLUGIN
+ gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_STRUCTLEAK) \
+ += -DSTRUCTLEAK_PLUGIN
+
+diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
+index 74244d8e29090..a65e8c0c630d2 100644
+--- a/sound/hda/hdac_controller.c
++++ b/sound/hda/hdac_controller.c
+@@ -390,8 +390,9 @@ int snd_hdac_bus_reset_link(struct hdac_bus *bus, bool full_reset)
+ if (!full_reset)
+ goto skip_reset;
+
+- /* clear STATESTS */
+- snd_hdac_chip_writew(bus, STATESTS, STATESTS_INT_MASK);
++ /* clear STATESTS if not in reset */
++ if (snd_hdac_chip_readb(bus, GCTL) & AZX_GCTL_RESET)
++ snd_hdac_chip_writew(bus, STATESTS, STATESTS_INT_MASK);
+
+ /* reset controller */
+ snd_hdac_bus_enter_link_reset(bus);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 650439286208a..2161c57d26c5d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2521,6 +2521,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x65d2, "Clevo PB51R[CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 88e869d16714b..abd5c12764f0c 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -755,9 +755,16 @@ static int wm8960_configure_clocking(struct snd_soc_component *component)
+ int i, j, k;
+ int ret;
+
+- if (!(iface1 & (1<<6))) {
+- dev_dbg(component->dev,
+- "Codec is slave mode, no need to configure clock\n");
++ /*
++ * For Slave mode clocking should still be configured,
++ * so this if statement should be removed, but some platform
++ * may not work if the sysclk is not configured, to avoid such
++ * compatible issue, just add '!wm8960->sysclk' condition in
++ * this if statement.
++ */
++ if (!(iface1 & (1 << 6)) && !wm8960->sysclk) {
++ dev_warn(component->dev,
++ "slave mode, but proceeding with no clock configuration\n");
+ return 0;
+ }
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 4e99d9986f112..0f3489359d34c 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2515,6 +2515,7 @@ static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm,
+ const char *pin, int status)
+ {
+ struct snd_soc_dapm_widget *w = dapm_find_widget(dapm, pin, true);
++ int ret = 0;
+
+ dapm_assert_locked(dapm);
+
+@@ -2527,13 +2528,14 @@ static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm,
+ dapm_mark_dirty(w, "pin configuration");
+ dapm_widget_invalidate_input_paths(w);
+ dapm_widget_invalidate_output_paths(w);
++ ret = 1;
+ }
+
+ w->connected = status;
+ if (status == 0)
+ w->force = 0;
+
+- return 0;
++ return ret;
+ }
+
+ /**
+@@ -3461,14 +3463,15 @@ int snd_soc_dapm_put_pin_switch(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+ const char *pin = (const char *)kcontrol->private_value;
++ int ret;
+
+ if (ucontrol->value.integer.value[0])
+- snd_soc_dapm_enable_pin(&card->dapm, pin);
++ ret = snd_soc_dapm_enable_pin(&card->dapm, pin);
+ else
+- snd_soc_dapm_disable_pin(&card->dapm, pin);
++ ret = snd_soc_dapm_disable_pin(&card->dapm, pin);
+
+ snd_soc_dapm_sync(&card->dapm);
+- return 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(snd_soc_dapm_put_pin_switch);
+
+@@ -3858,7 +3861,7 @@ static int snd_soc_dapm_dai_link_put(struct snd_kcontrol *kcontrol,
+
+ w->params_select = ucontrol->value.enumerated.item[0];
+
+- return 0;
++ return 1;
+ }
+
+ static void
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 81304c2c11244..1e0d946036928 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3583,5 +3583,37 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */
+ }
+ }
+ },
++{
++ /*
++ * Sennheiser GSP670
++ * Change order of interfaces loaded
++ */
++ USB_DEVICE(0x1395, 0x0300),
++ .bInterfaceClass = USB_CLASS_PER_INTERFACE,
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = &(const struct snd_usb_audio_quirk[]) {
++ // Communication
++ {
++ .ifnum = 3,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ // Recording
++ {
++ .ifnum = 4,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ // Main
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
+
+ #undef USB_DEVICE_VENDOR_SPEC
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-11-02 19:32 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-11-02 19:32 UTC (permalink / raw
To: gentoo-commits
commit: ab6aa841e3f8bf607b6bd982102e4bab4b69e9e3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 2 19:32:17 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 2 19:32:17 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ab6aa841
Linux patch 4.19.215
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1214_linux-4.19.215.patch | 1028 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1032 insertions(+)
diff --git a/0000_README b/0000_README
index f4d1543..c6c5d27 100644
--- a/0000_README
+++ b/0000_README
@@ -895,6 +895,10 @@ Patch: 1213_linux-4.19.214.patch
From: https://www.kernel.org
Desc: Linux 4.19.214
+Patch: 1214_linux-4.19.215.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.215
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1214_linux-4.19.215.patch b/1214_linux-4.19.215.patch
new file mode 100644
index 0000000..e5aef56
--- /dev/null
+++ b/1214_linux-4.19.215.patch
@@ -0,0 +1,1028 @@
+diff --git a/Makefile b/Makefile
+index 358b07946bd12..40657b8e92f1c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 214
++SUBLEVEL = 215
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/Makefile b/arch/arm/Makefile
+index d1516f85f25d3..658896a7d30d6 100644
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -10,7 +10,7 @@
+ #
+ # Copyright (C) 1995-2001 by Russell King
+
+-LDFLAGS_vmlinux :=-p --no-undefined -X --pic-veneer
++LDFLAGS_vmlinux := --no-undefined -X --pic-veneer
+ ifeq ($(CONFIG_CPU_ENDIAN_BE8),y)
+ LDFLAGS_vmlinux += --be8
+ KBUILD_LDFLAGS_MODULE += --be8
+diff --git a/arch/arm/boot/bootp/Makefile b/arch/arm/boot/bootp/Makefile
+index 83e1a076a5d64..981a8d03f064c 100644
+--- a/arch/arm/boot/bootp/Makefile
++++ b/arch/arm/boot/bootp/Makefile
+@@ -8,7 +8,7 @@
+
+ GCOV_PROFILE := n
+
+-LDFLAGS_bootp :=-p --no-undefined -X \
++LDFLAGS_bootp := --no-undefined -X \
+ --defsym initrd_phys=$(INITRD_PHYS) \
+ --defsym params_phys=$(PARAMS_PHYS) -T
+ AFLAGS_initrd.o :=-DINITRD=\"$(INITRD)\"
+diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
+index 1b3a4144646b0..7f19143981c9c 100644
+--- a/arch/arm/boot/compressed/Makefile
++++ b/arch/arm/boot/compressed/Makefile
+@@ -133,8 +133,6 @@ endif
+ ifeq ($(CONFIG_CPU_ENDIAN_BE8),y)
+ LDFLAGS_vmlinux += --be8
+ endif
+-# ?
+-LDFLAGS_vmlinux += -p
+ # Report unresolved symbol references
+ LDFLAGS_vmlinux += --no-undefined
+ # Delete all temporary local symbols
+diff --git a/arch/arm/boot/compressed/decompress.c b/arch/arm/boot/compressed/decompress.c
+index c16c1829a5e4f..c10e10f26c096 100644
+--- a/arch/arm/boot/compressed/decompress.c
++++ b/arch/arm/boot/compressed/decompress.c
+@@ -46,7 +46,10 @@ extern int memcmp(const void *cs, const void *ct, size_t count);
+ #endif
+
+ #ifdef CONFIG_KERNEL_XZ
++/* Prevent KASAN override of string helpers in decompressor */
++#undef memmove
+ #define memmove memmove
++#undef memcpy
+ #define memcpy memcpy
+ #include "../../../../lib/decompress_unxz.c"
+ #endif
+diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
+index 3593d5c1acd23..93267800ccffe 100644
+--- a/arch/arm/kernel/vmlinux-xip.lds.S
++++ b/arch/arm/kernel/vmlinux-xip.lds.S
+@@ -181,7 +181,7 @@ ASSERT(__hyp_idmap_text_end - (__hyp_idmap_text_start & PAGE_MASK) <= PAGE_SIZE,
+ ASSERT((_end - __bss_start) >= 12288, ".bss too small for CONFIG_XIP_DEFLATED_DATA")
+ #endif
+
+-#ifdef CONFIG_ARM_MPU
++#if defined(CONFIG_ARM_MPU) && !defined(CONFIG_COMPILE_TEST)
+ /*
+ * Due to PMSAv7 restriction on base address and size we have to
+ * enforce minimal alignment restrictions. It was seen that weaker
+diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
+index 60ac7c5999a98..86e54447dc916 100644
+--- a/arch/arm/mm/proc-macros.S
++++ b/arch/arm/mm/proc-macros.S
+@@ -342,6 +342,7 @@ ENTRY(\name\()_cache_fns)
+
+ .macro define_tlb_functions name:req, flags_up:req, flags_smp
+ .type \name\()_tlb_fns, #object
++ .align 2
+ ENTRY(\name\()_tlb_fns)
+ .long \name\()_flush_user_tlb_range
+ .long \name\()_flush_kern_tlb_range
+diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c
+index f8bd523d64d15..62da8e2211e4b 100644
+--- a/arch/arm/probes/kprobes/core.c
++++ b/arch/arm/probes/kprobes/core.c
+@@ -542,7 +542,7 @@ static struct undef_hook kprobes_arm_break_hook = {
+
+ #endif /* !CONFIG_THUMB2_KERNEL */
+
+-int __init arch_init_kprobes()
++int __init arch_init_kprobes(void)
+ {
+ arm_probes_decode_init();
+ #ifdef CONFIG_THUMB2_KERNEL
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
+index cc268a69786c5..cac9231e2e29c 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
+@@ -114,7 +114,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
+index 96b22c0fa3432..7cd6eeaa216cf 100644
+--- a/arch/arm64/lib/copy_from_user.S
++++ b/arch/arm64/lib/copy_from_user.S
+@@ -39,7 +39,7 @@
+ .endm
+
+ .macro ldrh1 ptr, regB, val
+- uao_user_alternative 9998f, ldrh, ldtrh, \ptr, \regB, \val
++ uao_user_alternative 9997f, ldrh, ldtrh, \ptr, \regB, \val
+ .endm
+
+ .macro strh1 ptr, regB, val
+@@ -47,7 +47,7 @@
+ .endm
+
+ .macro ldr1 ptr, regB, val
+- uao_user_alternative 9998f, ldr, ldtr, \ptr, \regB, \val
++ uao_user_alternative 9997f, ldr, ldtr, \ptr, \regB, \val
+ .endm
+
+ .macro str1 ptr, regB, val
+@@ -55,7 +55,7 @@
+ .endm
+
+ .macro ldp1 ptr, regB, regC, val
+- uao_ldp 9998f, \ptr, \regB, \regC, \val
++ uao_ldp 9997f, \ptr, \regB, \regC, \val
+ .endm
+
+ .macro stp1 ptr, regB, regC, val
+@@ -63,9 +63,11 @@
+ .endm
+
+ end .req x5
++srcin .req x15
+ ENTRY(__arch_copy_from_user)
+ uaccess_enable_not_uao x3, x4, x5
+ add end, x0, x2
++ mov srcin, x1
+ #include "copy_template.S"
+ uaccess_disable_not_uao x3, x4
+ mov x0, #0 // Nothing to copy
+@@ -74,6 +76,11 @@ ENDPROC(__arch_copy_from_user)
+
+ .section .fixup,"ax"
+ .align 2
++9997: cmp dst, dstin
++ b.ne 9998f
++ // Before being absolutely sure we couldn't copy anything, try harder
++USER(9998f, ldtrb tmp1w, [srcin])
++ strb tmp1w, [dst], #1
+ 9998: sub x0, end, dst // bytes not copied
+ uaccess_disable_not_uao x3, x4
+ ret
+diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
+index e56c705f1f236..b20d3a0b32374 100644
+--- a/arch/arm64/lib/copy_in_user.S
++++ b/arch/arm64/lib/copy_in_user.S
+@@ -40,34 +40,36 @@
+ .endm
+
+ .macro ldrh1 ptr, regB, val
+- uao_user_alternative 9998f, ldrh, ldtrh, \ptr, \regB, \val
++ uao_user_alternative 9997f, ldrh, ldtrh, \ptr, \regB, \val
+ .endm
+
+ .macro strh1 ptr, regB, val
+- uao_user_alternative 9998f, strh, sttrh, \ptr, \regB, \val
++ uao_user_alternative 9997f, strh, sttrh, \ptr, \regB, \val
+ .endm
+
+ .macro ldr1 ptr, regB, val
+- uao_user_alternative 9998f, ldr, ldtr, \ptr, \regB, \val
++ uao_user_alternative 9997f, ldr, ldtr, \ptr, \regB, \val
+ .endm
+
+ .macro str1 ptr, regB, val
+- uao_user_alternative 9998f, str, sttr, \ptr, \regB, \val
++ uao_user_alternative 9997f, str, sttr, \ptr, \regB, \val
+ .endm
+
+ .macro ldp1 ptr, regB, regC, val
+- uao_ldp 9998f, \ptr, \regB, \regC, \val
++ uao_ldp 9997f, \ptr, \regB, \regC, \val
+ .endm
+
+ .macro stp1 ptr, regB, regC, val
+- uao_stp 9998f, \ptr, \regB, \regC, \val
++ uao_stp 9997f, \ptr, \regB, \regC, \val
+ .endm
+
+ end .req x5
++srcin .req x15
+
+ ENTRY(__arch_copy_in_user)
+ uaccess_enable_not_uao x3, x4, x5
+ add end, x0, x2
++ mov srcin, x1
+ #include "copy_template.S"
+ uaccess_disable_not_uao x3, x4
+ mov x0, #0
+@@ -76,6 +78,12 @@ ENDPROC(__arch_copy_in_user)
+
+ .section .fixup,"ax"
+ .align 2
++9997: cmp dst, dstin
++ b.ne 9998f
++ // Before being absolutely sure we couldn't copy anything, try harder
++USER(9998f, ldtrb tmp1w, [srcin])
++USER(9998f, sttrb tmp1w, [dst])
++ add dst, dst, #1
+ 9998: sub x0, end, dst // bytes not copied
+ uaccess_disable_not_uao x3, x4
+ ret
+diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
+index 6b99b939c50f2..cfdbb1fe8d511 100644
+--- a/arch/arm64/lib/copy_to_user.S
++++ b/arch/arm64/lib/copy_to_user.S
+@@ -42,7 +42,7 @@
+ .endm
+
+ .macro strh1 ptr, regB, val
+- uao_user_alternative 9998f, strh, sttrh, \ptr, \regB, \val
++ uao_user_alternative 9997f, strh, sttrh, \ptr, \regB, \val
+ .endm
+
+ .macro ldr1 ptr, regB, val
+@@ -50,7 +50,7 @@
+ .endm
+
+ .macro str1 ptr, regB, val
+- uao_user_alternative 9998f, str, sttr, \ptr, \regB, \val
++ uao_user_alternative 9997f, str, sttr, \ptr, \regB, \val
+ .endm
+
+ .macro ldp1 ptr, regB, regC, val
+@@ -58,13 +58,15 @@
+ .endm
+
+ .macro stp1 ptr, regB, regC, val
+- uao_stp 9998f, \ptr, \regB, \regC, \val
++ uao_stp 9997f, \ptr, \regB, \regC, \val
+ .endm
+
+ end .req x5
++srcin .req x15
+ ENTRY(__arch_copy_to_user)
+ uaccess_enable_not_uao x3, x4, x5
+ add end, x0, x2
++ mov srcin, x1
+ #include "copy_template.S"
+ uaccess_disable_not_uao x3, x4
+ mov x0, #0
+@@ -73,6 +75,12 @@ ENDPROC(__arch_copy_to_user)
+
+ .section .fixup,"ax"
+ .align 2
++9997: cmp dst, dstin
++ b.ne 9998f
++ // Before being absolutely sure we couldn't copy anything, try harder
++ ldrb tmp1w, [srcin]
++USER(9998f, sttrb tmp1w, [dst])
++ add dst, dst, #1
+ 9998: sub x0, end, dst // bytes not copied
+ uaccess_disable_not_uao x3, x4
+ ret
+diff --git a/arch/nios2/platform/Kconfig.platform b/arch/nios2/platform/Kconfig.platform
+index 74c1aaf588b8b..54f6dfb3b7974 100644
+--- a/arch/nios2/platform/Kconfig.platform
++++ b/arch/nios2/platform/Kconfig.platform
+@@ -37,6 +37,7 @@ config NIOS2_DTB_PHYS_ADDR
+
+ config NIOS2_DTB_SOURCE_BOOL
+ bool "Compile and link device tree into kernel image"
++ depends on !COMPILE_TEST
+ default n
+ help
+ This allows you to specify a dts (device tree source) file
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index e7d56ddba43aa..87213a1bb14ca 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -385,8 +385,14 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
+ case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */
+ if (imm == 0)
+ return -EINVAL;
+- else if (imm == 1)
+- goto bpf_alu32_trunc;
++ if (imm == 1) {
++ if (BPF_OP(code) == BPF_DIV) {
++ goto bpf_alu32_trunc;
++ } else {
++ PPC_LI(dst_reg, 0);
++ break;
++ }
++ }
+
+ PPC_LI32(b2p[TMP_REG_1], imm);
+ switch (BPF_CLASS(code)) {
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index 57ef11ecbb9be..84ea284502d53 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -3905,8 +3905,8 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
+ break;
+
+ default:
+- dev_err(host->dev, "BUG: invalid board index %u\n", board_idx);
+- return 1;
++ dev_alert(host->dev, "BUG: invalid board index %u\n", board_idx);
++ return -EINVAL;
+ }
+
+ hpriv->hp_flags = hp_flags;
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index b1e9aae9a5d0b..e9b7ce8c272c6 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -295,14 +295,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+ if (!blk)
+ return -ENOMEM;
+
++ rbnode->block = blk;
++
+ if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
+ present = krealloc(rbnode->cache_present,
+ BITS_TO_LONGS(blklen) * sizeof(*present),
+ GFP_KERNEL);
+- if (!present) {
+- kfree(blk);
++ if (!present)
+ return -ENOMEM;
+- }
+
+ memset(present + BITS_TO_LONGS(rbnode->blklen), 0,
+ (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
+@@ -319,7 +319,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+ }
+
+ /* update the rbnode block, its size and the base register */
+- rbnode->block = blk;
+ rbnode->blklen = blklen;
+ rbnode->base_reg = base_reg;
+ rbnode->cache_present = present;
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 10f6ae4f8f3ff..361b1b8597820 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3387,6 +3387,8 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ MLX5_SET(dctc, dctc, mtu, attr->path_mtu);
+ MLX5_SET(dctc, dctc, my_addr_index, attr->ah_attr.grh.sgid_index);
+ MLX5_SET(dctc, dctc, hop_limit, attr->ah_attr.grh.hop_limit);
++ if (attr->ah_attr.type == RDMA_AH_ATTR_TYPE_ROCE)
++ MLX5_SET(dctc, dctc, eth_prio, attr->ah_attr.sl & 0x7);
+
+ err = mlx5_core_create_dct(dev->mdev, &qp->dct.mdct, qp->dct.in,
+ MLX5_ST_SZ_BYTES(create_dct_in));
+diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
+index 2c5a6e7aadc01..495a09b5a8e78 100644
+--- a/drivers/mmc/host/cqhci.c
++++ b/drivers/mmc/host/cqhci.c
+@@ -281,6 +281,9 @@ static void __cqhci_enable(struct cqhci_host *cq_host)
+
+ cqhci_writel(cq_host, cqcfg, CQHCI_CFG);
+
++ if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT)
++ cqhci_writel(cq_host, 0, CQHCI_CTL);
++
+ mmc->cqe_on = true;
+
+ if (cq_host->ops->enable)
+diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
+index ab47b018716a2..d7915e511ed28 100644
+--- a/drivers/mmc/host/dw_mmc-exynos.c
++++ b/drivers/mmc/host/dw_mmc-exynos.c
+@@ -455,6 +455,18 @@ static s8 dw_mci_exynos_get_best_clksmpl(u8 candiates)
+ }
+ }
+
++ /*
++ * If there is no cadiates value, then it needs to return -EIO.
++ * If there are candiates values and don't find bset clk sample value,
++ * then use a first candiates clock sample value.
++ */
++ for (i = 0; i < iter; i++) {
++ __c = ror8(candiates, i);
++ if ((__c & 0x1) == 0x1) {
++ loc = i;
++ goto out;
++ }
++ }
+ out:
+ return loc;
+ }
+@@ -485,6 +497,8 @@ static int dw_mci_exynos_execute_tuning(struct dw_mci_slot *slot, u32 opcode)
+ priv->tuned_sample = found;
+ } else {
+ ret = -EIO;
++ dev_warn(&mmc->class_dev,
++ "There is no candiates value about clksmpl!\n");
+ }
+
+ return ret;
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index 5099353e6f137..f8a4791e64f8a 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -25,6 +25,7 @@
+ #include <linux/pinctrl/consumer.h>
+ #include <linux/platform_data/mmc-esdhc-imx.h>
+ #include <linux/pm_runtime.h>
++#include <linux/iopoll.h>
+ #include "sdhci-pltfm.h"
+ #include "sdhci-esdhc.h"
+
+@@ -947,6 +948,7 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
+ u32 ctrl;
++ int ret;
+
+ /* Reset the tuning circuit */
+ if (esdhc_is_usdhc(imx_data)) {
+@@ -959,7 +961,22 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
+ } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
+ ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL;
++ ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE;
+ writel(ctrl, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
++ /* Make sure ESDHC_MIX_CTRL_EXE_TUNE cleared */
++ ret = readl_poll_timeout(host->ioaddr + SDHCI_AUTO_CMD_STATUS,
++ ctrl, !(ctrl & ESDHC_MIX_CTRL_EXE_TUNE), 1, 50);
++ if (ret == -ETIMEDOUT)
++ dev_warn(mmc_dev(host->mmc),
++ "Warning! clear execute tuning bit failed\n");
++ /*
++ * SDHCI_INT_DATA_AVAIL is W1C bit, set this bit will clear the
++ * usdhc IP internal logic flag execute_tuning_with_clr_buf, which
++ * will finally make sure the normal data transfer logic correct.
++ */
++ ctrl = readl(host->ioaddr + SDHCI_INT_STATUS);
++ ctrl |= SDHCI_INT_DATA_AVAIL;
++ writel(ctrl, host->ioaddr + SDHCI_INT_STATUS);
+ }
+ }
+ }
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 5cb7c2cc501af..8ff37f06e6917 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1578,6 +1578,12 @@ void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode,
+ break;
+ case MMC_VDD_32_33:
+ case MMC_VDD_33_34:
++ /*
++ * 3.4 ~ 3.6V are valid only for those platforms where it's
++ * known that the voltage range is supported by hardware.
++ */
++ case MMC_VDD_34_35:
++ case MMC_VDD_35_36:
+ pwr = SDHCI_POWER_330;
+ break;
+ default:
+diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
+index a004f2ee15b1e..aa8905753be33 100644
+--- a/drivers/mmc/host/vub300.c
++++ b/drivers/mmc/host/vub300.c
+@@ -579,7 +579,7 @@ static void check_vub300_port_status(struct vub300_mmc_host *vub300)
+ GET_SYSTEM_PORT_STATUS,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 0x0000, 0x0000, &vub300->system_port_status,
+- sizeof(vub300->system_port_status), HZ);
++ sizeof(vub300->system_port_status), 1000);
+ if (sizeof(vub300->system_port_status) == retval)
+ new_system_port_status(vub300);
+ }
+@@ -1244,7 +1244,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
+ SET_INTERRUPT_PSEUDOCODE,
+ USB_DIR_OUT | USB_TYPE_VENDOR |
+ USB_RECIP_DEVICE, 0x0000, 0x0000,
+- xfer_buffer, xfer_length, HZ);
++ xfer_buffer, xfer_length, 1000);
+ kfree(xfer_buffer);
+ if (retval < 0)
+ goto copy_error_message;
+@@ -1287,7 +1287,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
+ SET_TRANSFER_PSEUDOCODE,
+ USB_DIR_OUT | USB_TYPE_VENDOR |
+ USB_RECIP_DEVICE, 0x0000, 0x0000,
+- xfer_buffer, xfer_length, HZ);
++ xfer_buffer, xfer_length, 1000);
+ kfree(xfer_buffer);
+ if (retval < 0)
+ goto copy_error_message;
+@@ -1994,7 +1994,7 @@ static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8],
+ usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
+ SET_CLOCK_SPEED,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0x00, 0x00, buf, buf_array_size, HZ);
++ 0x00, 0x00, buf, buf_array_size, 1000);
+ if (retval != 8) {
+ dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
+ " %dkHz failed with retval=%d\n", kHzClock, retval);
+@@ -2016,14 +2016,14 @@ static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
+ SET_SD_POWER,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0x0000, 0x0000, NULL, 0, HZ);
++ 0x0000, 0x0000, NULL, 0, 1000);
+ /* must wait for the VUB300 u-proc to boot up */
+ msleep(600);
+ } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
+ usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
+ SET_SD_POWER,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0x0001, 0x0000, NULL, 0, HZ);
++ 0x0001, 0x0000, NULL, 0, 1000);
+ msleep(600);
+ vub300->card_powered = 1;
+ } else if (ios->power_mode == MMC_POWER_ON) {
+@@ -2285,14 +2285,14 @@ static int vub300_probe(struct usb_interface *interface,
+ GET_HC_INF0,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 0x0000, 0x0000, &vub300->hc_info,
+- sizeof(vub300->hc_info), HZ);
++ sizeof(vub300->hc_info), 1000);
+ if (retval < 0)
+ goto error5;
+ retval =
+ usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
+ SET_ROM_WAIT_STATES,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- firmware_rom_wait_states, 0x0000, NULL, 0, HZ);
++ firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
+ if (retval < 0)
+ goto error5;
+ dev_info(&vub300->udev->dev,
+@@ -2307,7 +2307,7 @@ static int vub300_probe(struct usb_interface *interface,
+ GET_SYSTEM_PORT_STATUS,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 0x0000, 0x0000, &vub300->system_port_status,
+- sizeof(vub300->system_port_status), HZ);
++ sizeof(vub300->system_port_status), 1000);
+ if (retval < 0) {
+ goto error4;
+ } else if (sizeof(vub300->system_port_status) == retval) {
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index 0d681714878b1..e734bc5e3ceb4 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -1710,6 +1710,16 @@ static int lan743x_tx_ring_init(struct lan743x_tx *tx)
+ ret = -EINVAL;
+ goto cleanup;
+ }
++ if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev,
++ DMA_BIT_MASK(64))) {
++ if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev,
++ DMA_BIT_MASK(32))) {
++ dev_warn(&tx->adapter->pdev->dev,
++ "lan743x_: No suitable DMA available\n");
++ ret = -ENOMEM;
++ goto cleanup;
++ }
++ }
+ ring_allocation_size = ALIGN(tx->ring_size *
+ sizeof(struct lan743x_tx_descriptor),
+ PAGE_SIZE);
+@@ -2258,6 +2268,16 @@ static int lan743x_rx_ring_init(struct lan743x_rx *rx)
+ ret = -EINVAL;
+ goto cleanup;
+ }
++ if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev,
++ DMA_BIT_MASK(64))) {
++ if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev,
++ DMA_BIT_MASK(32))) {
++ dev_warn(&rx->adapter->pdev->dev,
++ "lan743x_: No suitable DMA available\n");
++ ret = -ENOMEM;
++ goto cleanup;
++ }
++ }
+ ring_allocation_size = ALIGN(rx->ring_size *
+ sizeof(struct lan743x_rx_descriptor),
+ PAGE_SIZE);
+@@ -3003,6 +3023,8 @@ static int lan743x_pm_resume(struct device *dev)
+ if (ret) {
+ netif_err(adapter, probe, adapter->netdev,
+ "lan743x_hardware_init returned %d\n", ret);
++ lan743x_pci_cleanup(adapter);
++ return ret;
+ }
+
+ /* open netdev when netdev is at running state while resume.
+diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
+index 6bd6c261f2ba9..415ac33341c58 100644
+--- a/drivers/net/ethernet/nxp/lpc_eth.c
++++ b/drivers/net/ethernet/nxp/lpc_eth.c
+@@ -1037,9 +1037,6 @@ static int lpc_eth_close(struct net_device *ndev)
+ napi_disable(&pldat->napi);
+ netif_stop_queue(ndev);
+
+- if (ndev->phydev)
+- phy_stop(ndev->phydev);
+-
+ spin_lock_irqsave(&pldat->lock, flags);
+ __lpc_eth_reset(pldat);
+ netif_carrier_off(ndev);
+@@ -1047,6 +1044,8 @@ static int lpc_eth_close(struct net_device *ndev)
+ writel(0, LPC_ENET_MAC2(pldat->net_base));
+ spin_unlock_irqrestore(&pldat->lock, flags);
+
++ if (ndev->phydev)
++ phy_stop(ndev->phydev);
+ clk_disable_unprepare(pldat->clk);
+
+ return 0;
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index f31a822bf4cca..3207da2224f67 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -388,7 +388,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
+ err = device_register(&bus->dev);
+ if (err) {
+ pr_err("mii_bus %s failed to register\n", bus->id);
+- put_device(&bus->dev);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index ac5f72077b267..75984c799afc7 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -3772,6 +3772,12 @@ static int lan78xx_probe(struct usb_interface *intf,
+
+ dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1);
+
++ /* Reject broken descriptors. */
++ if (dev->maxpacket == 0) {
++ ret = -ENODEV;
++ goto out4;
++ }
++
+ /* driver requires remote-wakeup capability during autosuspend. */
+ intf->needs_remote_wakeup = 1;
+
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 84b354f76dea8..867cadb1e5ccd 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1784,6 +1784,11 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
+ if (!dev->rx_urb_size)
+ dev->rx_urb_size = dev->hard_mtu;
+ dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
++ if (dev->maxpacket == 0) {
++ /* that is a broken device */
++ status = -ENODEV;
++ goto out4;
++ }
+
+ /* let userspace know we have a random address */
+ if (ether_addr_equal(net->dev_addr, node_id))
+diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
+index 06bb226c62ef4..0f37acec98ab4 100644
+--- a/drivers/nfc/port100.c
++++ b/drivers/nfc/port100.c
+@@ -1012,11 +1012,11 @@ static u64 port100_get_command_type_mask(struct port100 *dev)
+
+ skb = port100_alloc_skb(dev, 0);
+ if (!skb)
+- return -ENOMEM;
++ return 0;
+
+ resp = port100_send_cmd_sync(dev, PORT100_CMD_GET_COMMAND_TYPE, skb);
+ if (IS_ERR(resp))
+- return PTR_ERR(resp);
++ return 0;
+
+ if (resp->len < 8)
+ mask = 0;
+diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
+index 1401031f4bb4a..b9e61fc3928aa 100644
+--- a/net/batman-adv/bridge_loop_avoidance.c
++++ b/net/batman-adv/bridge_loop_avoidance.c
+@@ -1574,10 +1574,14 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
+ return 0;
+
+ bat_priv->bla.claim_hash = batadv_hash_new(128);
+- bat_priv->bla.backbone_hash = batadv_hash_new(32);
++ if (!bat_priv->bla.claim_hash)
++ return -ENOMEM;
+
+- if (!bat_priv->bla.claim_hash || !bat_priv->bla.backbone_hash)
++ bat_priv->bla.backbone_hash = batadv_hash_new(32);
++ if (!bat_priv->bla.backbone_hash) {
++ batadv_hash_destroy(bat_priv->bla.claim_hash);
+ return -ENOMEM;
++ }
+
+ batadv_hash_set_lock_class(bat_priv->bla.claim_hash,
+ &batadv_claim_hash_lock_class_key);
+diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
+index 79b8a2d8793e8..bba64b9b3668a 100644
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -187,29 +187,41 @@ int batadv_mesh_init(struct net_device *soft_iface)
+ INIT_HLIST_HEAD(&bat_priv->softif_vlan_list);
+ INIT_HLIST_HEAD(&bat_priv->tp_list);
+
+- ret = batadv_v_mesh_init(bat_priv);
+- if (ret < 0)
+- goto err;
+-
+ ret = batadv_originator_init(bat_priv);
+- if (ret < 0)
+- goto err;
++ if (ret < 0) {
++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
++ goto err_orig;
++ }
+
+ ret = batadv_tt_init(bat_priv);
+- if (ret < 0)
+- goto err;
++ if (ret < 0) {
++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
++ goto err_tt;
++ }
++
++ ret = batadv_v_mesh_init(bat_priv);
++ if (ret < 0) {
++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
++ goto err_v;
++ }
+
+ ret = batadv_bla_init(bat_priv);
+- if (ret < 0)
+- goto err;
++ if (ret < 0) {
++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
++ goto err_bla;
++ }
+
+ ret = batadv_dat_init(bat_priv);
+- if (ret < 0)
+- goto err;
++ if (ret < 0) {
++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
++ goto err_dat;
++ }
+
+ ret = batadv_nc_mesh_init(bat_priv);
+- if (ret < 0)
+- goto err;
++ if (ret < 0) {
++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
++ goto err_nc;
++ }
+
+ batadv_gw_init(bat_priv);
+ batadv_mcast_init(bat_priv);
+@@ -219,8 +231,20 @@ int batadv_mesh_init(struct net_device *soft_iface)
+
+ return 0;
+
+-err:
+- batadv_mesh_free(soft_iface);
++err_nc:
++ batadv_dat_free(bat_priv);
++err_dat:
++ batadv_bla_free(bat_priv);
++err_bla:
++ batadv_v_mesh_free(bat_priv);
++err_v:
++ batadv_tt_free(bat_priv);
++err_tt:
++ batadv_originator_free(bat_priv);
++err_orig:
++ batadv_purge_outstanding_packets(bat_priv, NULL);
++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
++
+ return ret;
+ }
+
+diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
+index 7f1be5a287575..d6749fc222366 100644
+--- a/net/batman-adv/network-coding.c
++++ b/net/batman-adv/network-coding.c
+@@ -167,8 +167,10 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
+ &batadv_nc_coding_hash_lock_class_key);
+
+ bat_priv->nc.decoding_hash = batadv_hash_new(128);
+- if (!bat_priv->nc.decoding_hash)
++ if (!bat_priv->nc.decoding_hash) {
++ batadv_hash_destroy(bat_priv->nc.coding_hash);
+ goto err;
++ }
+
+ batadv_hash_set_lock_class(bat_priv->nc.decoding_hash,
+ &batadv_nc_decoding_hash_lock_class_key);
+diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
+index cc350ab4de0a9..6bdb70c93e3fb 100644
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -4413,8 +4413,10 @@ int batadv_tt_init(struct batadv_priv *bat_priv)
+ return ret;
+
+ ret = batadv_tt_global_init(bat_priv);
+- if (ret < 0)
++ if (ret < 0) {
++ batadv_tt_local_table_free(bat_priv);
+ return ret;
++ }
+
+ batadv_tvlv_handler_register(bat_priv, batadv_tt_tvlv_ogm_handler_v1,
+ batadv_tt_tvlv_unicast_handler_v1,
+diff --git a/net/core/dev.c b/net/core/dev.c
+index a6798117bb1a0..397bc2f50de08 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2846,6 +2846,12 @@ static u16 skb_tx_hash(const struct net_device *dev,
+
+ qoffset = sb_dev->tc_to_txq[tc].offset;
+ qcount = sb_dev->tc_to_txq[tc].count;
++ if (unlikely(!qcount)) {
++ net_warn_ratelimited("%s: invalid qcount, qoffset %u for tc %u\n",
++ sb_dev->name, qoffset, tc);
++ qoffset = 0;
++ qcount = dev->real_num_tx_queues;
++ }
+ }
+
+ if (skb_rx_queue_recorded(skb)) {
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 730a15fc497ca..b41d4acc57e69 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -625,14 +625,14 @@ static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash)
+ kfree_rcu(oldest, rcu);
+ }
+
+-static inline u32 fnhe_hashfun(__be32 daddr)
++static u32 fnhe_hashfun(__be32 daddr)
+ {
+- static u32 fnhe_hashrnd __read_mostly;
+- u32 hval;
++ static siphash_key_t fnhe_hash_key __read_mostly;
++ u64 hval;
+
+- net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd));
+- hval = jhash_1word((__force u32) daddr, fnhe_hashrnd);
+- return hash_32(hval, FNHE_HASH_SHIFT);
++ net_get_random_once(&fnhe_hash_key, sizeof(fnhe_hash_key));
++ hval = siphash_1u32((__force u32)daddr, &fnhe_hash_key);
++ return hash_64(hval, FNHE_HASH_SHIFT);
+ }
+
+ static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index f884739a0c1c7..d04f3951c5fbc 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -45,6 +45,7 @@
+ #include <linux/nsproxy.h>
+ #include <linux/slab.h>
+ #include <linux/jhash.h>
++#include <linux/siphash.h>
+ #include <net/net_namespace.h>
+ #include <net/snmp.h>
+ #include <net/ipv6.h>
+@@ -1337,17 +1338,24 @@ static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket)
+ static u32 rt6_exception_hash(const struct in6_addr *dst,
+ const struct in6_addr *src)
+ {
+- static u32 seed __read_mostly;
+- u32 val;
++ static siphash_key_t rt6_exception_key __read_mostly;
++ struct {
++ struct in6_addr dst;
++ struct in6_addr src;
++ } __aligned(SIPHASH_ALIGNMENT) combined = {
++ .dst = *dst,
++ };
++ u64 val;
+
+- net_get_random_once(&seed, sizeof(seed));
+- val = jhash(dst, sizeof(*dst), seed);
++ net_get_random_once(&rt6_exception_key, sizeof(rt6_exception_key));
+
+ #ifdef CONFIG_IPV6_SUBTREES
+ if (src)
+- val = jhash(src, sizeof(*src), val);
++ combined.src = *src;
+ #endif
+- return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
++ val = siphash(&combined, sizeof(combined), &rt6_exception_key);
++
++ return hash_64(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
+ }
+
+ /* Helper function to find the cached rt in the hash table
+@@ -1446,6 +1454,7 @@ static int rt6_insert_exception(struct rt6_info *nrt,
+ struct rt6_exception_bucket *bucket;
+ struct in6_addr *src_key = NULL;
+ struct rt6_exception *rt6_ex;
++ int max_depth;
+ int err = 0;
+
+ spin_lock_bh(&rt6_exception_lock);
+@@ -1507,7 +1516,9 @@ static int rt6_insert_exception(struct rt6_info *nrt,
+ bucket->depth++;
+ net->ipv6.rt6_stats->fib_rt_cache++;
+
+- if (bucket->depth > FIB6_MAX_DEPTH)
++ /* Randomize max depth to avoid some side channels attacks. */
++ max_depth = FIB6_MAX_DEPTH + prandom_u32_max(FIB6_MAX_DEPTH);
++ while (bucket->depth > max_depth)
+ rt6_exception_remove_oldest(bucket);
+
+ out:
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index be5ea5e8b19e7..ebca069064dfd 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -712,6 +712,9 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
+ struct sock *sk;
+ int error = 0;
+
++ if (asoc && !sctp_vtag_verify(chunk, asoc))
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
+ /* If the packet is an OOTB packet which is temporarily on the
+ * control endpoint, respond with an ABORT.
+ */
+@@ -726,7 +729,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
+ * in sctp_unpack_cookie().
+ */
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
+- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
++ commands);
+
+ /* If the endpoint is not listening or if the number of associations
+ * on the TCP-style socket exceed the max backlog, respond with an
+@@ -2156,9 +2160,11 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
+ * enough for the chunk header. Cookie length verification is
+ * done later.
+ */
+- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
+- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+- commands);
++ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) {
++ if (!sctp_vtag_verify(chunk, asoc))
++ asoc = NULL;
++ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands);
++ }
+
+ /* "Decode" the chunk. We have no optional parameters so we
+ * are in good shape.
+@@ -3577,6 +3583,9 @@ enum sctp_disposition sctp_sf_ootb(struct net *net,
+
+ SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
+
++ if (asoc && !sctp_vtag_verify(chunk, asoc))
++ asoc = NULL;
++
+ ch = (struct sctp_chunkhdr *)chunk->chunk_hdr;
+ do {
+ /* Report violation if the chunk is less then minimal */
+@@ -3692,12 +3701,6 @@ static enum sctp_disposition sctp_sf_shut_8_4_5(
+
+ SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
+
+- /* If the chunk length is invalid, we don't want to process
+- * the reset of the packet.
+- */
+- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
+- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+-
+ /* We need to discard the rest of the packet to prevent
+ * potential bomming attacks from additional bundled chunks.
+ * This is documented in SCTP Threats ID.
+@@ -3725,6 +3728,9 @@ enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net,
+ {
+ struct sctp_chunk *chunk = arg;
+
++ if (!sctp_vtag_verify(chunk, asoc))
++ asoc = NULL;
++
+ /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
+ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+@@ -4555,6 +4561,9 @@ enum sctp_disposition sctp_sf_violation(struct net *net,
+ {
+ struct sctp_chunk *chunk = arg;
+
++ if (!sctp_vtag_verify(chunk, asoc))
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
+ /* Make sure that the chunk has a valid length. */
+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
+ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+@@ -6261,6 +6270,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(
+ * yet.
+ */
+ switch (chunk->chunk_hdr->type) {
++ case SCTP_CID_INIT:
+ case SCTP_CID_INIT_ACK:
+ {
+ struct sctp_initack_chunk *initack;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-11-06 13:26 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-11-06 13:26 UTC (permalink / raw
To: gentoo-commits
commit: e37bad027ea4267ee727638e5e9ddf24c395dd9e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Nov 6 13:26:34 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Nov 6 13:26:34 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e37bad02
Linux patch 4.19.216
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1215_linux-4.19.216.patch | 369 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 373 insertions(+)
diff --git a/0000_README b/0000_README
index c6c5d27..df19013 100644
--- a/0000_README
+++ b/0000_README
@@ -899,6 +899,10 @@ Patch: 1214_linux-4.19.215.patch
From: https://www.kernel.org
Desc: Linux 4.19.215
+Patch: 1215_linux-4.19.216.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.216
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1215_linux-4.19.216.patch b/1215_linux-4.19.216.patch
new file mode 100644
index 0000000..9a59f5e
--- /dev/null
+++ b/1215_linux-4.19.216.patch
@@ -0,0 +1,369 @@
+diff --git a/Makefile b/Makefile
+index 40657b8e92f1c..f8255c787f7e8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 215
++SUBLEVEL = 216
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
+index cf4be70d58925..f231963b40116 100644
+--- a/arch/arc/include/asm/pgtable.h
++++ b/arch/arc/include/asm/pgtable.h
+@@ -138,8 +138,10 @@
+
+ #ifdef CONFIG_ARC_HAS_PAE40
+ #define PTE_BITS_NON_RWX_IN_PD1 (0xff00000000 | PAGE_MASK | _PAGE_CACHEABLE)
++#define MAX_POSSIBLE_PHYSMEM_BITS 40
+ #else
+ #define PTE_BITS_NON_RWX_IN_PD1 (PAGE_MASK | _PAGE_CACHEABLE)
++#define MAX_POSSIBLE_PHYSMEM_BITS 32
+ #endif
+
+ /**************************************************************************
+diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
+index 12659ce5c1f38..90bf19d993782 100644
+--- a/arch/arm/include/asm/pgtable-2level.h
++++ b/arch/arm/include/asm/pgtable-2level.h
+@@ -78,6 +78,8 @@
+ #define PTE_HWTABLE_OFF (PTE_HWTABLE_PTRS * sizeof(pte_t))
+ #define PTE_HWTABLE_SIZE (PTRS_PER_PTE * sizeof(u32))
+
++#define MAX_POSSIBLE_PHYSMEM_BITS 32
++
+ /*
+ * PMD_SHIFT determines the size of the area a second-level page table can map
+ * PGDIR_SHIFT determines what a third-level page table entry can map
+diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
+index 6d50a11d77934..7ba08dd650e32 100644
+--- a/arch/arm/include/asm/pgtable-3level.h
++++ b/arch/arm/include/asm/pgtable-3level.h
+@@ -37,6 +37,8 @@
+ #define PTE_HWTABLE_OFF (0)
+ #define PTE_HWTABLE_SIZE (PTRS_PER_PTE * sizeof(u64))
+
++#define MAX_POSSIBLE_PHYSMEM_BITS 40
++
+ /*
+ * PGDIR_SHIFT determines the size a top-level page table entry can map.
+ */
+diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h
+index 74afe8c76bdd0..215fb48f644b9 100644
+--- a/arch/mips/include/asm/pgtable-32.h
++++ b/arch/mips/include/asm/pgtable-32.h
+@@ -111,6 +111,7 @@ static inline void pmd_clear(pmd_t *pmdp)
+
+ #if defined(CONFIG_XPA)
+
++#define MAX_POSSIBLE_PHYSMEM_BITS 40
+ #define pte_pfn(x) (((unsigned long)((x).pte_high >> _PFN_SHIFT)) | (unsigned long)((x).pte_low << _PAGE_PRESENT_SHIFT))
+ static inline pte_t
+ pfn_pte(unsigned long pfn, pgprot_t prot)
+@@ -126,6 +127,7 @@ pfn_pte(unsigned long pfn, pgprot_t prot)
+
+ #elif defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
+
++#define MAX_POSSIBLE_PHYSMEM_BITS 36
+ #define pte_pfn(x) ((unsigned long)((x).pte_high >> 6))
+
+ static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot)
+@@ -140,6 +142,7 @@ static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot)
+
+ #else
+
++#define MAX_POSSIBLE_PHYSMEM_BITS 32
+ #ifdef CONFIG_CPU_VR41XX
+ #define pte_pfn(x) ((unsigned long)((x).pte >> (PAGE_SHIFT + 2)))
+ #define pfn_pte(pfn, prot) __pte(((pfn) << (PAGE_SHIFT + 2)) | pgprot_val(prot))
+diff --git a/arch/powerpc/include/asm/pte-common.h b/arch/powerpc/include/asm/pte-common.h
+index bef56141a549e..f740f67ebf980 100644
+--- a/arch/powerpc/include/asm/pte-common.h
++++ b/arch/powerpc/include/asm/pte-common.h
+@@ -110,8 +110,10 @@ static inline bool pte_user(pte_t pte)
+ */
+ #if defined(CONFIG_PPC32) && defined(CONFIG_PTE_64BIT)
+ #define PTE_RPN_MASK (~((1ULL<<PTE_RPN_SHIFT)-1))
++#define MAX_POSSIBLE_PHYSMEM_BITS 36
+ #else
+ #define PTE_RPN_MASK (~((1UL<<PTE_RPN_SHIFT)-1))
++#define MAX_POSSIBLE_PHYSMEM_BITS 32
+ #endif
+
+ /* _PAGE_CHG_MASK masks of bits that are to be preserved across
+diff --git a/arch/riscv/include/asm/pgtable-32.h b/arch/riscv/include/asm/pgtable-32.h
+index d61974b741820..5cfe5a1318679 100644
+--- a/arch/riscv/include/asm/pgtable-32.h
++++ b/arch/riscv/include/asm/pgtable-32.h
+@@ -22,4 +22,6 @@
+ #define PGDIR_SIZE (_AC(1, UL) << PGDIR_SHIFT)
+ #define PGDIR_MASK (~(PGDIR_SIZE - 1))
+
++#define MAX_POSSIBLE_PHYSMEM_BITS 34
++
+ #endif /* _ASM_RISCV_PGTABLE_32_H */
+diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
+index 2380ebd9b7fda..e1992f361c9a6 100644
+--- a/drivers/amba/bus.c
++++ b/drivers/amba/bus.c
+@@ -360,9 +360,6 @@ static int amba_device_try_add(struct amba_device *dev, struct resource *parent)
+ void __iomem *tmp;
+ int i, ret;
+
+- WARN_ON(dev->irq[0] == (unsigned int)-1);
+- WARN_ON(dev->irq[1] == (unsigned int)-1);
+-
+ ret = request_resource(parent, &dev->res);
+ if (ret)
+ goto err_out;
+diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
+index 926f3c8eba69f..47ed3ab25dc95 100644
+--- a/drivers/infiniband/hw/qib/qib_user_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
+@@ -606,7 +606,7 @@ done:
+ /*
+ * How many pages in this iovec element?
+ */
+-static int qib_user_sdma_num_pages(const struct iovec *iov)
++static size_t qib_user_sdma_num_pages(const struct iovec *iov)
+ {
+ const unsigned long addr = (unsigned long) iov->iov_base;
+ const unsigned long len = iov->iov_len;
+@@ -662,7 +662,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev,
+ static int qib_user_sdma_pin_pages(const struct qib_devdata *dd,
+ struct qib_user_sdma_queue *pq,
+ struct qib_user_sdma_pkt *pkt,
+- unsigned long addr, int tlen, int npages)
++ unsigned long addr, int tlen, size_t npages)
+ {
+ struct page *pages[8];
+ int i, j;
+@@ -726,7 +726,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd,
+ unsigned long idx;
+
+ for (idx = 0; idx < niov; idx++) {
+- const int npages = qib_user_sdma_num_pages(iov + idx);
++ const size_t npages = qib_user_sdma_num_pages(iov + idx);
+ const unsigned long addr = (unsigned long) iov[idx].iov_base;
+
+ ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr,
+@@ -828,8 +828,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
+ unsigned pktnw;
+ unsigned pktnwc;
+ int nfrags = 0;
+- int npages = 0;
+- int bytes_togo = 0;
++ size_t npages = 0;
++ size_t bytes_togo = 0;
+ int tiddma = 0;
+ int cfur;
+
+@@ -889,7 +889,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
+
+ npages += qib_user_sdma_num_pages(&iov[idx]);
+
+- bytes_togo += slen;
++ if (check_add_overflow(bytes_togo, slen, &bytes_togo) ||
++ bytes_togo > type_max(typeof(pkt->bytes_togo))) {
++ ret = -EINVAL;
++ goto free_pbc;
++ }
+ pktnwc += slen >> 2;
+ idx++;
+ nfrags++;
+@@ -908,10 +912,10 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
+ }
+
+ if (frag_size) {
+- int pktsize, tidsmsize, n;
++ size_t tidsmsize, n, pktsize, sz, addrlimit;
+
+ n = npages*((2*PAGE_SIZE/frag_size)+1);
+- pktsize = sizeof(*pkt) + sizeof(pkt->addr[0])*n;
++ pktsize = struct_size(pkt, addr, n);
+
+ /*
+ * Determine if this is tid-sdma or just sdma.
+@@ -926,14 +930,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
+ else
+ tidsmsize = 0;
+
+- pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL);
++ if (check_add_overflow(pktsize, tidsmsize, &sz)) {
++ ret = -EINVAL;
++ goto free_pbc;
++ }
++ pkt = kmalloc(sz, GFP_KERNEL);
+ if (!pkt) {
+ ret = -ENOMEM;
+ goto free_pbc;
+ }
+ pkt->largepkt = 1;
+ pkt->frag_size = frag_size;
+- pkt->addrlimit = n + ARRAY_SIZE(pkt->addr);
++ if (check_add_overflow(n, ARRAY_SIZE(pkt->addr),
++ &addrlimit) ||
++ addrlimit > type_max(typeof(pkt->addrlimit))) {
++ ret = -EINVAL;
++ goto free_pbc;
++ }
++ pkt->addrlimit = addrlimit;
+
+ if (tiddma) {
+ char *tidsm = (char *)pkt + pktsize;
+diff --git a/drivers/media/firewire/firedtv-avc.c b/drivers/media/firewire/firedtv-avc.c
+index 3ef5df1648d77..8c31cf90c5907 100644
+--- a/drivers/media/firewire/firedtv-avc.c
++++ b/drivers/media/firewire/firedtv-avc.c
+@@ -1169,7 +1169,11 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
+ read_pos += program_info_length;
+ write_pos += program_info_length;
+ }
+- while (read_pos < length) {
++ while (read_pos + 4 < length) {
++ if (write_pos + 4 >= sizeof(c->operand) - 4) {
++ ret = -EINVAL;
++ goto out;
++ }
+ c->operand[write_pos++] = msg[read_pos++];
+ c->operand[write_pos++] = msg[read_pos++];
+ c->operand[write_pos++] = msg[read_pos++];
+@@ -1181,13 +1185,17 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
+ c->operand[write_pos++] = es_info_length >> 8;
+ c->operand[write_pos++] = es_info_length & 0xff;
+ if (es_info_length > 0) {
++ if (read_pos >= length) {
++ ret = -EINVAL;
++ goto out;
++ }
+ pmt_cmd_id = msg[read_pos++];
+ if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
+ dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n",
+ pmt_cmd_id);
+
+- if (es_info_length > sizeof(c->operand) - 4 -
+- write_pos) {
++ if (es_info_length > sizeof(c->operand) - 4 - write_pos ||
++ es_info_length > length - read_pos) {
+ ret = -EINVAL;
+ goto out;
+ }
+diff --git a/drivers/media/firewire/firedtv-ci.c b/drivers/media/firewire/firedtv-ci.c
+index 8dc5a7495abee..14f779812d250 100644
+--- a/drivers/media/firewire/firedtv-ci.c
++++ b/drivers/media/firewire/firedtv-ci.c
+@@ -138,6 +138,8 @@ static int fdtv_ca_pmt(struct firedtv *fdtv, void *arg)
+ } else {
+ data_length = msg->msg[3];
+ }
++ if (data_length > sizeof(msg->msg) - data_pos)
++ return -EINVAL;
+
+ return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length);
+ }
+diff --git a/drivers/net/ethernet/sfc/ethtool.c b/drivers/net/ethernet/sfc/ethtool.c
+index 3143588ffd777..82b32c742d69e 100644
+--- a/drivers/net/ethernet/sfc/ethtool.c
++++ b/drivers/net/ethernet/sfc/ethtool.c
+@@ -131,20 +131,14 @@ efx_ethtool_get_link_ksettings(struct net_device *net_dev,
+ {
+ struct efx_nic *efx = netdev_priv(net_dev);
+ struct efx_link_state *link_state = &efx->link_state;
+- u32 supported;
+
+ mutex_lock(&efx->mac_lock);
+ efx->phy_op->get_link_ksettings(efx, cmd);
+ mutex_unlock(&efx->mac_lock);
+
+ /* Both MACs support pause frames (bidirectional and respond-only) */
+- ethtool_convert_link_mode_to_legacy_u32(&supported,
+- cmd->link_modes.supported);
+-
+- supported |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+-
+- ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.supported,
+- supported);
++ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
++ ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause);
+
+ if (LOOPBACK_INTERNAL(efx)) {
+ cmd->base.speed = link_state->speed;
+diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
+index fc1356d101b0a..febe29a9b8b06 100644
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -575,8 +575,10 @@ EXPORT_SYMBOL(scsi_device_get);
+ */
+ void scsi_device_put(struct scsi_device *sdev)
+ {
+- module_put(sdev->host->hostt->module);
++ struct module *mod = sdev->host->hostt->module;
++
+ put_device(&sdev->sdev_gendev);
++ module_put(mod);
+ }
+ EXPORT_SYMBOL(scsi_device_put);
+
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 186f779fa60c4..d4be13892b26e 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -431,9 +431,12 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
+ struct list_head *this, *tmp;
+ struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
+ unsigned long flags;
++ struct module *mod;
+
+ sdev = container_of(work, struct scsi_device, ew.work);
+
++ mod = sdev->host->hostt->module;
++
+ scsi_dh_release_device(sdev);
+
+ parent = sdev->sdev_gendev.parent;
+@@ -474,11 +477,17 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
+
+ if (parent)
+ put_device(parent);
++ module_put(mod);
+ }
+
+ static void scsi_device_dev_release(struct device *dev)
+ {
+ struct scsi_device *sdp = to_scsi_device(dev);
++
++ /* Set module pointer as NULL in case of module unloading */
++ if (!try_module_get(sdp->host->hostt->module))
++ sdp->host->hostt->module = NULL;
++
+ execute_in_process_context(scsi_device_dev_release_usercontext,
+ &sdp->ew);
+ }
+diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
+index 5901b00059294..1544331bec27f 100644
+--- a/include/asm-generic/pgtable.h
++++ b/include/asm-generic/pgtable.h
+@@ -1115,6 +1115,19 @@ static inline bool arch_has_pfn_modify_check(void)
+
+ #endif /* !__ASSEMBLY__ */
+
++#if !defined(MAX_POSSIBLE_PHYSMEM_BITS) && !defined(CONFIG_64BIT)
++#ifdef CONFIG_PHYS_ADDR_T_64BIT
++/*
++ * ZSMALLOC needs to know the highest PFN on 32-bit architectures
++ * with physical address space extension, but falls back to
++ * BITS_PER_LONG otherwise.
++ */
++#error Missing MAX_POSSIBLE_PHYSMEM_BITS definition
++#else
++#define MAX_POSSIBLE_PHYSMEM_BITS 32
++#endif
++#endif
++
+ #ifndef has_transparent_hugepage
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ #define has_transparent_hugepage() 1
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-11-12 14:16 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-11-12 14:16 UTC (permalink / raw
To: gentoo-commits
commit: 71b2b96620b061c48b9834ce7c8a12c24cd4d8c3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Nov 12 14:15:23 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Nov 12 14:15:23 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=71b2b966
Linux patch 4.19.217
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1216_linux-4.19.217.patch | 579 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 583 insertions(+)
diff --git a/0000_README b/0000_README
index df190137..a2b32ddc 100644
--- a/0000_README
+++ b/0000_README
@@ -903,6 +903,10 @@ Patch: 1215_linux-4.19.216.patch
From: https://www.kernel.org
Desc: Linux 4.19.216
+Patch: 1216_linux-4.19.217.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.217
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1216_linux-4.19.217.patch b/1216_linux-4.19.217.patch
new file mode 100644
index 00000000..aef542f8
--- /dev/null
+++ b/1216_linux-4.19.217.patch
@@ -0,0 +1,579 @@
+diff --git a/Makefile b/Makefile
+index f8255c787f7e8..6f983a62d1fd6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 216
++SUBLEVEL = 217
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
+index 9944b9c7ceeee..bac2ec9b4443b 100644
+--- a/arch/x86/kvm/ioapic.c
++++ b/arch/x86/kvm/ioapic.c
+@@ -96,7 +96,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
+ static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic)
+ {
+ ioapic->rtc_status.pending_eoi = 0;
+- bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID + 1);
++ bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID);
+ }
+
+ static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);
+diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h
+index 283f1f489bcac..ea1a4e0297dae 100644
+--- a/arch/x86/kvm/ioapic.h
++++ b/arch/x86/kvm/ioapic.h
+@@ -43,13 +43,13 @@ struct kvm_vcpu;
+
+ struct dest_map {
+ /* vcpu bitmap where IRQ has been sent */
+- DECLARE_BITMAP(map, KVM_MAX_VCPU_ID + 1);
++ DECLARE_BITMAP(map, KVM_MAX_VCPU_ID);
+
+ /*
+ * Vector sent to a given vcpu, only valid when
+ * the vcpu's bit in map is set
+ */
+- u8 vectors[KVM_MAX_VCPU_ID + 1];
++ u8 vectors[KVM_MAX_VCPU_ID];
+ };
+
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index 54106646445a9..17e50eba780d8 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -61,7 +61,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter,
+ (void *)seg,
+ (int)len,
+ &transfer,
+- HZ * 5);
++ USB_CTRL_SET_TIMEOUT);
+
+ if (status < 0) {
+ rsi_dbg(ERR_ZONE,
+diff --git a/drivers/staging/comedi/drivers/dt9812.c b/drivers/staging/comedi/drivers/dt9812.c
+index 75cc9e8e5b94b..ee0402bf6e675 100644
+--- a/drivers/staging/comedi/drivers/dt9812.c
++++ b/drivers/staging/comedi/drivers/dt9812.c
+@@ -32,6 +32,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/errno.h>
++#include <linux/slab.h>
+ #include <linux/uaccess.h>
+
+ #include "../comedi_usb.h"
+@@ -237,22 +238,42 @@ static int dt9812_read_info(struct comedi_device *dev,
+ {
+ struct usb_device *usb = comedi_to_usb_dev(dev);
+ struct dt9812_private *devpriv = dev->private;
+- struct dt9812_usb_cmd cmd;
++ struct dt9812_usb_cmd *cmd;
++ size_t tbuf_size;
+ int count, ret;
++ void *tbuf;
+
+- cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
+- cmd.u.flash_data_info.address =
++ tbuf_size = max(sizeof(*cmd), buf_size);
++
++ tbuf = kzalloc(tbuf_size, GFP_KERNEL);
++ if (!tbuf)
++ return -ENOMEM;
++
++ cmd = tbuf;
++
++ cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
++ cmd->u.flash_data_info.address =
+ cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset);
+- cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size);
++ cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size);
+
+ /* DT9812 only responds to 32 byte writes!! */
+ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
+- &cmd, 32, &count, DT9812_USB_TIMEOUT);
++ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
+ if (ret)
+- return ret;
++ goto out;
++
++ ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
++ tbuf, buf_size, &count, DT9812_USB_TIMEOUT);
++ if (!ret) {
++ if (count == buf_size)
++ memcpy(buf, tbuf, buf_size);
++ else
++ ret = -EREMOTEIO;
++ }
++out:
++ kfree(tbuf);
+
+- return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
+- buf, buf_size, &count, DT9812_USB_TIMEOUT);
++ return ret;
+ }
+
+ static int dt9812_read_multiple_registers(struct comedi_device *dev,
+@@ -261,22 +282,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev,
+ {
+ struct usb_device *usb = comedi_to_usb_dev(dev);
+ struct dt9812_private *devpriv = dev->private;
+- struct dt9812_usb_cmd cmd;
++ struct dt9812_usb_cmd *cmd;
+ int i, count, ret;
++ size_t buf_size;
++ void *buf;
+
+- cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
+- cmd.u.read_multi_info.count = reg_count;
++ buf_size = max_t(size_t, sizeof(*cmd), reg_count);
++
++ buf = kzalloc(buf_size, GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
++
++ cmd = buf;
++
++ cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
++ cmd->u.read_multi_info.count = reg_count;
+ for (i = 0; i < reg_count; i++)
+- cmd.u.read_multi_info.address[i] = address[i];
++ cmd->u.read_multi_info.address[i] = address[i];
+
+ /* DT9812 only responds to 32 byte writes!! */
+ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
+- &cmd, 32, &count, DT9812_USB_TIMEOUT);
++ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
+ if (ret)
+- return ret;
++ goto out;
++
++ ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
++ buf, reg_count, &count, DT9812_USB_TIMEOUT);
++ if (!ret) {
++ if (count == reg_count)
++ memcpy(value, buf, reg_count);
++ else
++ ret = -EREMOTEIO;
++ }
++out:
++ kfree(buf);
+
+- return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
+- value, reg_count, &count, DT9812_USB_TIMEOUT);
++ return ret;
+ }
+
+ static int dt9812_write_multiple_registers(struct comedi_device *dev,
+@@ -285,19 +326,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev,
+ {
+ struct usb_device *usb = comedi_to_usb_dev(dev);
+ struct dt9812_private *devpriv = dev->private;
+- struct dt9812_usb_cmd cmd;
++ struct dt9812_usb_cmd *cmd;
+ int i, count;
++ int ret;
++
++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
++ if (!cmd)
++ return -ENOMEM;
+
+- cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
+- cmd.u.read_multi_info.count = reg_count;
++ cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
++ cmd->u.read_multi_info.count = reg_count;
+ for (i = 0; i < reg_count; i++) {
+- cmd.u.write_multi_info.write[i].address = address[i];
+- cmd.u.write_multi_info.write[i].value = value[i];
++ cmd->u.write_multi_info.write[i].address = address[i];
++ cmd->u.write_multi_info.write[i].value = value[i];
+ }
+
+ /* DT9812 only responds to 32 byte writes!! */
+- return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
+- &cmd, 32, &count, DT9812_USB_TIMEOUT);
++ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
++ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
++ kfree(cmd);
++
++ return ret;
+ }
+
+ static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
+@@ -306,17 +355,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
+ {
+ struct usb_device *usb = comedi_to_usb_dev(dev);
+ struct dt9812_private *devpriv = dev->private;
+- struct dt9812_usb_cmd cmd;
++ struct dt9812_usb_cmd *cmd;
+ int i, count;
++ int ret;
++
++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
++ if (!cmd)
++ return -ENOMEM;
+
+- cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
+- cmd.u.rmw_multi_info.count = reg_count;
++ cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
++ cmd->u.rmw_multi_info.count = reg_count;
+ for (i = 0; i < reg_count; i++)
+- cmd.u.rmw_multi_info.rmw[i] = rmw[i];
++ cmd->u.rmw_multi_info.rmw[i] = rmw[i];
+
+ /* DT9812 only responds to 32 byte writes!! */
+- return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
+- &cmd, 32, &count, DT9812_USB_TIMEOUT);
++ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
++ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
++ kfree(cmd);
++
++ return ret;
+ }
+
+ static int dt9812_digital_in(struct comedi_device *dev, u8 *bits)
+diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c
+index 1bb1cb6513491..75e5b57ae0d7f 100644
+--- a/drivers/staging/comedi/drivers/ni_usb6501.c
++++ b/drivers/staging/comedi/drivers/ni_usb6501.c
+@@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10,
+ 0x00, 0x00, 0x00, 0x02,
+ 0x00, 0x00, 0x00, 0x00};
+
++/* Largest supported packets */
++static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST);
++static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE);
++
+ enum commands {
+ READ_PORT,
+ WRITE_PORT,
+@@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev)
+ if (!devpriv->ep_rx || !devpriv->ep_tx)
+ return -ENODEV;
+
++ if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE)
++ return -ENODEV;
++
++ if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE)
++ return -ENODEV;
++
+ return 0;
+ }
+
+diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
+index 7956abcbae22b..7769eadfaf61d 100644
+--- a/drivers/staging/comedi/drivers/vmk80xx.c
++++ b/drivers/staging/comedi/drivers/vmk80xx.c
+@@ -90,6 +90,9 @@ enum {
+ #define IC3_VERSION BIT(0)
+ #define IC6_VERSION BIT(1)
+
++#define MIN_BUF_SIZE 64
++#define PACKET_TIMEOUT 10000 /* ms */
++
+ enum vmk80xx_model {
+ VMK8055_MODEL,
+ VMK8061_MODEL
+@@ -157,22 +160,21 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
+ __u8 rx_addr;
+ unsigned int tx_pipe;
+ unsigned int rx_pipe;
+- size_t size;
++ size_t tx_size;
++ size_t rx_size;
+
+ tx_addr = devpriv->ep_tx->bEndpointAddress;
+ rx_addr = devpriv->ep_rx->bEndpointAddress;
+ tx_pipe = usb_sndbulkpipe(usb, tx_addr);
+ rx_pipe = usb_rcvbulkpipe(usb, rx_addr);
++ tx_size = usb_endpoint_maxp(devpriv->ep_tx);
++ rx_size = usb_endpoint_maxp(devpriv->ep_rx);
+
+- /*
+- * The max packet size attributes of the K8061
+- * input/output endpoints are identical
+- */
+- size = usb_endpoint_maxp(devpriv->ep_tx);
++ usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL,
++ PACKET_TIMEOUT);
+
+- usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf,
+- size, NULL, devpriv->ep_tx->bInterval);
+- usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10);
++ usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL,
++ PACKET_TIMEOUT);
+ }
+
+ static int vmk80xx_read_packet(struct comedi_device *dev)
+@@ -191,7 +193,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev)
+ pipe = usb_rcvintpipe(usb, ep->bEndpointAddress);
+ return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf,
+ usb_endpoint_maxp(ep), NULL,
+- HZ * 10);
++ PACKET_TIMEOUT);
+ }
+
+ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
+@@ -212,7 +214,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
+ pipe = usb_sndintpipe(usb, ep->bEndpointAddress);
+ return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf,
+ usb_endpoint_maxp(ep), NULL,
+- HZ * 10);
++ PACKET_TIMEOUT);
+ }
+
+ static int vmk80xx_reset_device(struct comedi_device *dev)
+@@ -678,12 +680,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
+ struct vmk80xx_private *devpriv = dev->private;
+ size_t size;
+
+- size = usb_endpoint_maxp(devpriv->ep_rx);
++ size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
+ devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL);
+ if (!devpriv->usb_rx_buf)
+ return -ENOMEM;
+
+- size = usb_endpoint_maxp(devpriv->ep_tx);
++ size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
+ devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
+ if (!devpriv->usb_tx_buf)
+ return -ENOMEM;
+diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
+index cc12e6c36fed9..becf444e590c2 100644
+--- a/drivers/staging/rtl8192u/r8192U_core.c
++++ b/drivers/staging/rtl8192u/r8192U_core.c
+@@ -266,7 +266,7 @@ int write_nic_byte_E(struct net_device *dev, int indx, u8 data)
+
+ status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
+- indx | 0xfe00, 0, usbdata, 1, HZ / 2);
++ indx | 0xfe00, 0, usbdata, 1, 500);
+ kfree(usbdata);
+
+ if (status < 0) {
+@@ -288,7 +288,7 @@ int read_nic_byte_E(struct net_device *dev, int indx, u8 *data)
+
+ status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+ RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
+- indx | 0xfe00, 0, usbdata, 1, HZ / 2);
++ indx | 0xfe00, 0, usbdata, 1, 500);
+ *data = *usbdata;
+ kfree(usbdata);
+
+@@ -316,7 +316,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data)
+ status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
+ (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
+- usbdata, 1, HZ / 2);
++ usbdata, 1, 500);
+ kfree(usbdata);
+
+ if (status < 0) {
+@@ -343,7 +343,7 @@ int write_nic_word(struct net_device *dev, int indx, u16 data)
+ status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
+ (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
+- usbdata, 2, HZ / 2);
++ usbdata, 2, 500);
+ kfree(usbdata);
+
+ if (status < 0) {
+@@ -370,7 +370,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data)
+ status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+ RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
+ (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
+- usbdata, 4, HZ / 2);
++ usbdata, 4, 500);
+ kfree(usbdata);
+
+
+@@ -397,7 +397,7 @@ int read_nic_byte(struct net_device *dev, int indx, u8 *data)
+ status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+ RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
+ (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
+- usbdata, 1, HZ / 2);
++ usbdata, 1, 500);
+ *data = *usbdata;
+ kfree(usbdata);
+
+@@ -424,7 +424,7 @@ int read_nic_word(struct net_device *dev, int indx, u16 *data)
+ status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+ RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
+ (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
+- usbdata, 2, HZ / 2);
++ usbdata, 2, 500);
+ *data = *usbdata;
+ kfree(usbdata);
+
+@@ -448,7 +448,7 @@ static int read_nic_word_E(struct net_device *dev, int indx, u16 *data)
+
+ status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+ RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
+- indx | 0xfe00, 0, usbdata, 2, HZ / 2);
++ indx | 0xfe00, 0, usbdata, 2, 500);
+ *data = *usbdata;
+ kfree(usbdata);
+
+@@ -474,7 +474,7 @@ int read_nic_dword(struct net_device *dev, int indx, u32 *data)
+ status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+ RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
+ (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
+- usbdata, 4, HZ / 2);
++ usbdata, 4, 500);
+ *data = *usbdata;
+ kfree(usbdata);
+
+diff --git a/drivers/staging/rtl8712/usb_ops_linux.c b/drivers/staging/rtl8712/usb_ops_linux.c
+index 6d12a96fa65f2..dd1311b62b056 100644
+--- a/drivers/staging/rtl8712/usb_ops_linux.c
++++ b/drivers/staging/rtl8712/usb_ops_linux.c
+@@ -505,7 +505,7 @@ int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value,
+ memcpy(pIo_buf, pdata, len);
+ }
+ status = usb_control_msg(udev, pipe, request, reqtype, value, index,
+- pIo_buf, len, HZ / 2);
++ pIo_buf, len, 500);
+ if (status > 0) { /* Success this control transfer. */
+ if (requesttype == 0x01) {
+ /* For Control read transfer, we have to copy the read
+diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
+index 0a16cbd4e528e..d83d93c6ef9e2 100644
+--- a/drivers/usb/gadget/udc/Kconfig
++++ b/drivers/usb/gadget/udc/Kconfig
+@@ -328,6 +328,7 @@ config USB_AMD5536UDC
+ config USB_FSL_QE
+ tristate "Freescale QE/CPM USB Device Controller"
+ depends on FSL_SOC && (QUICC_ENGINE || CPM)
++ depends on !64BIT || BROKEN
+ help
+ Some of Freescale PowerPC processors have a Full Speed
+ QE/CPM2 USB controller, which support device mode with 4
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index d9282ca7ae8c5..f2be5501430b3 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -634,7 +634,16 @@ static int ehci_run (struct usb_hcd *hcd)
+ /* Wait until HC become operational */
+ ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
+ msleep(5);
+- rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000);
++
++ /* For Aspeed, STS_HALT also depends on ASS/PSS status.
++ * Check CMD_RUN instead.
++ */
++ if (ehci->is_aspeed)
++ rc = ehci_handshake(ehci, &ehci->regs->command, CMD_RUN,
++ 1, 100 * 1000);
++ else
++ rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT,
++ 0, 100 * 1000);
+
+ up_write(&ehci_cf_port_reset_rwsem);
+
+diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
+index 8a45362155c5a..ed96353764e8e 100644
+--- a/drivers/usb/host/ehci-platform.c
++++ b/drivers/usb/host/ehci-platform.c
+@@ -288,6 +288,12 @@ static int ehci_platform_probe(struct platform_device *dev)
+ "has-transaction-translator"))
+ hcd->has_tt = 1;
+
++ if (of_device_is_compatible(dev->dev.of_node,
++ "aspeed,ast2500-ehci") ||
++ of_device_is_compatible(dev->dev.of_node,
++ "aspeed,ast2600-ehci"))
++ ehci->is_aspeed = 1;
++
+ if (soc_device_match(quirk_poll_match))
+ priv->quirk_poll = true;
+
+diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
+index c8e9a48e1d517..f3b2f3375a21f 100644
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -218,6 +218,7 @@ struct ehci_hcd { /* one per controller */
+ unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */
+ unsigned need_oc_pp_cycle:1; /* MPC834X port power */
+ unsigned imx28_write_fix:1; /* For Freescale i.MX28 */
++ unsigned is_aspeed:1;
+
+ /* required for usb32 quirk */
+ #define OHCI_CTRL_HCFS (3 << 6)
+diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
+index ffe462a657b15..4622400ba4ddb 100644
+--- a/drivers/usb/musb/musb_gadget.c
++++ b/drivers/usb/musb/musb_gadget.c
+@@ -1248,9 +1248,11 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
+ status = musb_queue_resume_work(musb,
+ musb_ep_restart_resume_work,
+ request);
+- if (status < 0)
++ if (status < 0) {
+ dev_err(musb->controller, "%s resume work: %i\n",
+ __func__, status);
++ list_del(&request->list);
++ }
+ }
+
+ unlock:
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 7442793fe0502..3ba4e060fd051 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -406,6 +406,16 @@ UNUSUAL_DEV( 0x04b8, 0x0602, 0x0110, 0x0110,
+ "785EPX Storage",
+ USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN),
+
++/*
++ * Reported by James Buren <braewoods+lkml@braewoods.net>
++ * Virtual ISOs cannot be remounted if ejected while the device is locked
++ * Disable locking to mimic Windows behavior that bypasses the issue
++ */
++UNUSUAL_DEV( 0x04c5, 0x2028, 0x0001, 0x0001,
++ "iODD",
++ "2531/2541",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE),
++
+ /*
+ * Not sure who reported this originally but
+ * Pavel Machek <pavel@ucw.cz> reported that the extra US_FL_SINGLE_LUN
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index 2355ad62b81fa..6e4e2cfd40b9e 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -1326,6 +1326,8 @@ static int isofs_read_inode(struct inode *inode, int relocated)
+
+ de = (struct iso_directory_record *) (bh->b_data + offset);
+ de_len = *(unsigned char *) de;
++ if (de_len < sizeof(struct iso_directory_record))
++ goto fail;
+
+ if (offset + de_len > bufsize) {
+ int frag1 = bufsize - offset;
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index cf272aba362be..57742e193214e 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2148,8 +2148,15 @@ static int __init console_setup(char *str)
+ char *s, *options, *brl_options = NULL;
+ int idx;
+
+- if (str[0] == 0)
++ /*
++ * console="" or console=null have been suggested as a way to
++ * disable console output. Use ttynull that has been created
++ * for exacly this purpose.
++ */
++ if (str[0] == 0 || strcmp(str, "null") == 0) {
++ __add_preferred_console("ttynull", 0, NULL, NULL);
+ return 1;
++ }
+
+ if (_braille_console_setup(&str, &brl_options))
+ return 1;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-11-26 11:59 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-11-26 11:59 UTC (permalink / raw
To: gentoo-commits
commit: d1cdbb041be22b6cd0b293d813bb4ef0c2a5c631
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Nov 26 11:59:39 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Nov 26 11:59:39 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d1cdbb04
Linux patch 4.19.218
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1217_linux-4.19.218.patch | 10087 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 10091 insertions(+)
diff --git a/0000_README b/0000_README
index a2b32ddc..2c528d2c 100644
--- a/0000_README
+++ b/0000_README
@@ -907,6 +907,10 @@ Patch: 1216_linux-4.19.217.patch
From: https://www.kernel.org
Desc: Linux 4.19.217
+Patch: 1217_linux-4.19.218.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.218
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1217_linux-4.19.218.patch b/1217_linux-4.19.218.patch
new file mode 100644
index 00000000..0021dd3c
--- /dev/null
+++ b/1217_linux-4.19.218.patch
@@ -0,0 +1,10087 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 6795e9d187d05..f179e20eb8a0b 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -5284,6 +5284,13 @@
+ with /sys/devices/system/xen_memory/xen_memory0/scrub_pages.
+ Default value controlled with CONFIG_XEN_SCRUB_PAGES_DEFAULT.
+
++ xen.balloon_boot_timeout= [XEN]
++ The time (in seconds) to wait before giving up to boot
++ in case initial ballooning fails to free enough memory.
++ Applies only when running as HVM or PVH guest and
++ started with less memory configured than allowed at
++ max. Default is 180.
++
+ xen.event_eoi_delay= [XEN]
+ How long to delay EOI handling in case of event
+ storms (jiffies). Default is 10.
+diff --git a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
+index 093edda0c8dfc..6cd83d920155f 100644
+--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
++++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
+@@ -13,6 +13,14 @@ common regulator binding documented in:
+
+
+ Required properties of the main device node (the parent!):
++ - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used
++ for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines.
++
++ [1] If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional
++ property is specified, then all the eight voltage values for the
++ 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified.
++
++Optional properties of the main device node (the parent!):
+ - s5m8767,pmic-buck2-dvs-voltage: A set of 8 voltage values in micro-volt (uV)
+ units for buck2 when changing voltage using gpio dvs. Refer to [1] below
+ for additional information.
+@@ -25,26 +33,13 @@ Required properties of the main device node (the parent!):
+ units for buck4 when changing voltage using gpio dvs. Refer to [1] below
+ for additional information.
+
+- - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used
+- for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines.
+-
+- [1] If none of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional
+- property is specified, the 's5m8767,pmic-buck[2/3/4]-dvs-voltage'
+- property should specify atleast one voltage level (which would be a
+- safe operating voltage).
+-
+- If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional
+- property is specified, then all the eight voltage values for the
+- 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified.
+-
+-Optional properties of the main device node (the parent!):
+ - s5m8767,pmic-buck2-uses-gpio-dvs: 'buck2' can be controlled by gpio dvs.
+ - s5m8767,pmic-buck3-uses-gpio-dvs: 'buck3' can be controlled by gpio dvs.
+ - s5m8767,pmic-buck4-uses-gpio-dvs: 'buck4' can be controlled by gpio dvs.
+
+ Additional properties required if either of the optional properties are used:
+
+- - s5m8767,pmic-buck234-default-dvs-idx: Default voltage setting selected from
++ - s5m8767,pmic-buck-default-dvs-idx: Default voltage setting selected from
+ the possible 8 options selectable by the dvs gpios. The value of this
+ property should be between 0 and 7. If not specified or if out of range, the
+ default value of this property is set to 0.
+diff --git a/Makefile b/Makefile
+index 6f983a62d1fd6..455ba411998f9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 217
++SUBLEVEL = 218
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/Makefile b/arch/arm/Makefile
+index 658896a7d30d6..ae1c85a81b1fb 100644
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -63,15 +63,15 @@ KBUILD_CFLAGS += $(call cc-option,-fno-ipa-sra)
+ # Note that GCC does not numerically define an architecture version
+ # macro, but instead defines a whole series of macros which makes
+ # testing for a specific architecture or later rather impossible.
+-arch-$(CONFIG_CPU_32v7M) =-D__LINUX_ARM_ARCH__=7 -march=armv7-m -Wa,-march=armv7-m
+-arch-$(CONFIG_CPU_32v7) =-D__LINUX_ARM_ARCH__=7 $(call cc-option,-march=armv7-a,-march=armv5t -Wa$(comma)-march=armv7-a)
+-arch-$(CONFIG_CPU_32v6) =-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6,-march=armv5t -Wa$(comma)-march=armv6)
++arch-$(CONFIG_CPU_32v7M) =-D__LINUX_ARM_ARCH__=7 -march=armv7-m
++arch-$(CONFIG_CPU_32v7) =-D__LINUX_ARM_ARCH__=7 -march=armv7-a
++arch-$(CONFIG_CPU_32v6) =-D__LINUX_ARM_ARCH__=6 -march=armv6
+ # Only override the compiler option if ARMv6. The ARMv6K extensions are
+ # always available in ARMv7
+ ifeq ($(CONFIG_CPU_32v6),y)
+-arch-$(CONFIG_CPU_32v6K) =-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6k,-march=armv5t -Wa$(comma)-march=armv6k)
++arch-$(CONFIG_CPU_32v6K) =-D__LINUX_ARM_ARCH__=6 -march=armv6k
+ endif
+-arch-$(CONFIG_CPU_32v5) =-D__LINUX_ARM_ARCH__=5 $(call cc-option,-march=armv5te,-march=armv4t)
++arch-$(CONFIG_CPU_32v5) =-D__LINUX_ARM_ARCH__=5 -march=armv5te
+ arch-$(CONFIG_CPU_32v4T) =-D__LINUX_ARM_ARCH__=4 -march=armv4t
+ arch-$(CONFIG_CPU_32v4) =-D__LINUX_ARM_ARCH__=4 -march=armv4
+ arch-$(CONFIG_CPU_32v3) =-D__LINUX_ARM_ARCH__=3 -march=armv3
+@@ -85,7 +85,7 @@ tune-$(CONFIG_CPU_ARM720T) =-mtune=arm7tdmi
+ tune-$(CONFIG_CPU_ARM740T) =-mtune=arm7tdmi
+ tune-$(CONFIG_CPU_ARM9TDMI) =-mtune=arm9tdmi
+ tune-$(CONFIG_CPU_ARM940T) =-mtune=arm9tdmi
+-tune-$(CONFIG_CPU_ARM946E) =$(call cc-option,-mtune=arm9e,-mtune=arm9tdmi)
++tune-$(CONFIG_CPU_ARM946E) =-mtune=arm9e
+ tune-$(CONFIG_CPU_ARM920T) =-mtune=arm9tdmi
+ tune-$(CONFIG_CPU_ARM922T) =-mtune=arm9tdmi
+ tune-$(CONFIG_CPU_ARM925T) =-mtune=arm9tdmi
+@@ -93,11 +93,11 @@ tune-$(CONFIG_CPU_ARM926T) =-mtune=arm9tdmi
+ tune-$(CONFIG_CPU_FA526) =-mtune=arm9tdmi
+ tune-$(CONFIG_CPU_SA110) =-mtune=strongarm110
+ tune-$(CONFIG_CPU_SA1100) =-mtune=strongarm1100
+-tune-$(CONFIG_CPU_XSCALE) =$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale
+-tune-$(CONFIG_CPU_XSC3) =$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale
+-tune-$(CONFIG_CPU_FEROCEON) =$(call cc-option,-mtune=marvell-f,-mtune=xscale)
+-tune-$(CONFIG_CPU_V6) =$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm)
+-tune-$(CONFIG_CPU_V6K) =$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm)
++tune-$(CONFIG_CPU_XSCALE) =-mtune=xscale
++tune-$(CONFIG_CPU_XSC3) =-mtune=xscale
++tune-$(CONFIG_CPU_FEROCEON) =-mtune=xscale
++tune-$(CONFIG_CPU_V6) =-mtune=arm1136j-s
++tune-$(CONFIG_CPU_V6K) =-mtune=arm1136j-s
+
+ # Evaluate tune cc-option calls now
+ tune-y := $(tune-y)
+diff --git a/arch/arm/boot/dts/at91-tse850-3.dts b/arch/arm/boot/dts/at91-tse850-3.dts
+index 2fbec69d9cd68..6b2be520066e2 100644
+--- a/arch/arm/boot/dts/at91-tse850-3.dts
++++ b/arch/arm/boot/dts/at91-tse850-3.dts
+@@ -269,7 +269,7 @@
+ &macb1 {
+ status = "okay";
+
+- phy-mode = "rgmii";
++ phy-mode = "rmii";
+
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi
+index 7f6aefd134514..e7534fe9c53cf 100644
+--- a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi
++++ b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi
+@@ -29,7 +29,7 @@
+ compatible = "smsc,lan9221","smsc,lan9115";
+ bank-width = <2>;
+
+- gpmc,mux-add-data;
++ gpmc,mux-add-data = <0>;
+ gpmc,cs-on-ns = <0>;
+ gpmc,cs-rd-off-ns = <42>;
+ gpmc,cs-wr-off-ns = <36>;
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 0c39a2340030b..a5aed92ab54b1 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -364,7 +364,7 @@
+ compatible = "bosch,bma180";
+ reg = <0x41>;
+ pinctrl-names = "default";
+- pintcrl-0 = <&bma180_pins>;
++ pinctrl-0 = <&bma180_pins>;
+ interrupt-parent = <&gpio4>;
+ interrupts = <19 IRQ_TYPE_LEVEL_HIGH>; /* GPIO_115 */
+ };
+diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
+index 82e98ee3023ad..3dbeb7a6c569c 100644
+--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
+@@ -25,7 +25,7 @@
+ compatible = "smsc,lan9221","smsc,lan9115";
+ bank-width = <2>;
+
+- gpmc,mux-add-data;
++ gpmc,mux-add-data = <0>;
+ gpmc,cs-on-ns = <0>;
+ gpmc,cs-rd-off-ns = <42>;
+ gpmc,cs-wr-off-ns = <36>;
+diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
+index d23ab9ec130a3..a452b859f485f 100644
+--- a/arch/arm/kernel/stacktrace.c
++++ b/arch/arm/kernel/stacktrace.c
+@@ -53,8 +53,7 @@ int notrace unwind_frame(struct stackframe *frame)
+
+ frame->sp = frame->fp;
+ frame->fp = *(unsigned long *)(fp);
+- frame->pc = frame->lr;
+- frame->lr = *(unsigned long *)(fp + 4);
++ frame->pc = *(unsigned long *)(fp + 4);
+ #else
+ /* check current frame pointer is within bounds */
+ if (fp < low + 12 || fp > high - 4)
+diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
+index b169e580bf829..9738c1f9737c9 100644
+--- a/arch/arm/mm/Kconfig
++++ b/arch/arm/mm/Kconfig
+@@ -751,7 +751,7 @@ config CPU_BIG_ENDIAN
+ config CPU_ENDIAN_BE8
+ bool
+ depends on CPU_BIG_ENDIAN
+- default CPU_V6 || CPU_V6K || CPU_V7
++ default CPU_V6 || CPU_V6K || CPU_V7 || CPU_V7M
+ help
+ Support for the BE-8 (big-endian) mode on ARMv6 and ARMv7 processors.
+
+diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
+index d8cbe772f6901..4c417f3cbfd52 100644
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -416,9 +416,9 @@ void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot)
+ FIXADDR_END);
+ BUG_ON(idx >= __end_of_fixed_addresses);
+
+- /* we only support device mappings until pgprot_kernel has been set */
++ /* We support only device mappings before pgprot_kernel is set. */
+ if (WARN_ON(pgprot_val(prot) != pgprot_val(FIXMAP_PAGE_IO) &&
+- pgprot_val(pgprot_kernel) == 0))
++ pgprot_val(prot) && pgprot_val(pgprot_kernel) == 0))
+ return;
+
+ if (pgprot_val(prot))
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi
+index a07f612ab56b7..b3b87c4c738e6 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi
+@@ -584,56 +584,56 @@
+ };
+
+ cluster1_core0_watchdog: wdt@c000000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc000000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster1_core1_watchdog: wdt@c010000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc010000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster1_core2_watchdog: wdt@c020000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc020000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster1_core3_watchdog: wdt@c030000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc030000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster2_core0_watchdog: wdt@c100000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc100000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster2_core1_watchdog: wdt@c110000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc110000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster2_core2_watchdog: wdt@c120000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc120000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster2_core3_watchdog: wdt@c130000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc130000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
+index 8c22ce904e655..73a60fd516e06 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
+@@ -222,56 +222,56 @@
+ };
+
+ cluster1_core0_watchdog: wdt@c000000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc000000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster1_core1_watchdog: wdt@c010000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc010000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster2_core0_watchdog: wdt@c100000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc100000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster2_core1_watchdog: wdt@c110000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc110000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster3_core0_watchdog: wdt@c200000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc200000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster3_core1_watchdog: wdt@c210000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc210000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster4_core0_watchdog: wdt@c300000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc300000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+ };
+
+ cluster4_core1_watchdog: wdt@c310000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xc310000 0x0 0x1000>;
+ clocks = <&clockgen 4 3>, <&clockgen 4 3>;
+ clock-names = "apb_pclk", "wdog_clk";
+diff --git a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi
+index f432b0a88c65d..6d4dee3cac16b 100644
+--- a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi
++++ b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi
+@@ -1062,7 +1062,7 @@
+ };
+
+ watchdog0: watchdog@e8a06000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xe8a06000 0x0 0x1000>;
+ interrupts = <GIC_SPI 44 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&crg_ctrl HI3660_OSC32K>;
+@@ -1070,7 +1070,7 @@
+ };
+
+ watchdog1: watchdog@e8a07000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xe8a07000 0x0 0x1000>;
+ interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&crg_ctrl HI3660_OSC32K>;
+diff --git a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
+index 247024df714fc..5e9ae262caf3e 100644
+--- a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
++++ b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
+@@ -830,7 +830,7 @@
+ };
+
+ watchdog0: watchdog@f8005000 {
+- compatible = "arm,sp805-wdt", "arm,primecell";
++ compatible = "arm,sp805", "arm,primecell";
+ reg = <0x0 0xf8005000 0x0 0x1000>;
+ interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&ao_ctrl HI6220_WDT0_PCLK>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index 05fa0dcb4c690..f6931f8d36f6d 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -536,7 +536,7 @@
+
+ gpu: gpu@ff300000 {
+ compatible = "rockchip,rk3328-mali", "arm,mali-450";
+- reg = <0x0 0xff300000 0x0 0x40000>;
++ reg = <0x0 0xff300000 0x0 0x30000>;
+ interrupts = <GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 93 IRQ_TYPE_LEVEL_HIGH>,
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts
+index 11cc67184fa9f..f1edd7fcef764 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts
+@@ -130,7 +130,7 @@
+ reg = <0>;
+
+ partition@0 {
+- label = "data";
++ label = "spi0-data";
+ reg = <0x0 0x100000>;
+ };
+ };
+@@ -148,7 +148,7 @@
+ reg = <0>;
+
+ partition@0 {
+- label = "data";
++ label = "spi1-data";
+ reg = <0x0 0x84000>;
+ };
+ };
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index 8a885ae647b7e..6478bca018197 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -574,7 +574,7 @@
+ };
+
+ uart0: serial@ff000000 {
+- compatible = "cdns,uart-r1p12", "xlnx,xuartps";
++ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12";
+ status = "disabled";
+ interrupt-parent = <&gic>;
+ interrupts = <0 21 4>;
+@@ -583,7 +583,7 @@
+ };
+
+ uart1: serial@ff010000 {
+- compatible = "cdns,uart-r1p12", "xlnx,xuartps";
++ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12";
+ status = "disabled";
+ interrupt-parent = <&gic>;
+ interrupts = <0 22 4>;
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index f43519b710610..71a73ca1e2b05 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -64,9 +64,15 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ * page table entry, taking care of 52-bit addresses.
+ */
+ #ifdef CONFIG_ARM64_PA_BITS_52
+-#define __pte_to_phys(pte) \
+- ((pte_val(pte) & PTE_ADDR_LOW) | ((pte_val(pte) & PTE_ADDR_HIGH) << 36))
+-#define __phys_to_pte_val(phys) (((phys) | ((phys) >> 36)) & PTE_ADDR_MASK)
++static inline phys_addr_t __pte_to_phys(pte_t pte)
++{
++ return (pte_val(pte) & PTE_ADDR_LOW) |
++ ((pte_val(pte) & PTE_ADDR_HIGH) << 36);
++}
++static inline pteval_t __phys_to_pte_val(phys_addr_t phys)
++{
++ return (phys | (phys >> 36)) & PTE_ADDR_MASK;
++}
+ #else
+ #define __pte_to_phys(pte) (pte_val(pte) & PTE_ADDR_MASK)
+ #define __phys_to_pte_val(phys) (phys)
+diff --git a/arch/hexagon/lib/io.c b/arch/hexagon/lib/io.c
+index 885c9626d5e08..e5dfed1cf151b 100644
+--- a/arch/hexagon/lib/io.c
++++ b/arch/hexagon/lib/io.c
+@@ -40,6 +40,7 @@ void __raw_readsw(const void __iomem *addr, void *data, int len)
+ *dst++ = *src;
+
+ }
++EXPORT_SYMBOL(__raw_readsw);
+
+ /*
+ * __raw_writesw - read words a short at a time
+@@ -60,6 +61,7 @@ void __raw_writesw(void __iomem *addr, const void *data, int len)
+
+
+ }
++EXPORT_SYMBOL(__raw_writesw);
+
+ /* Pretty sure len is pre-adjusted for the length of the access already */
+ void __raw_readsl(const void __iomem *addr, void *data, int len)
+@@ -75,6 +77,7 @@ void __raw_readsl(const void __iomem *addr, void *data, int len)
+
+
+ }
++EXPORT_SYMBOL(__raw_readsl);
+
+ void __raw_writesl(void __iomem *addr, const void *data, int len)
+ {
+@@ -89,3 +92,4 @@ void __raw_writesl(void __iomem *addr, const void *data, int len)
+
+
+ }
++EXPORT_SYMBOL(__raw_writesl);
+diff --git a/arch/ia64/Kconfig.debug b/arch/ia64/Kconfig.debug
+index 1371efc9b0055..637ac79c29b6d 100644
+--- a/arch/ia64/Kconfig.debug
++++ b/arch/ia64/Kconfig.debug
+@@ -39,7 +39,7 @@ config DISABLE_VHPT
+
+ config IA64_DEBUG_CMPXCHG
+ bool "Turn on compare-and-exchange bug checking (slow!)"
+- depends on DEBUG_KERNEL
++ depends on DEBUG_KERNEL && PRINTK
+ help
+ Selecting this option turns on bug checking for the IA-64
+ compare-and-exchange instructions. This is slow! Itaniums
+diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c
+index 8207b897b49dd..9cfd3ac027b71 100644
+--- a/arch/ia64/kernel/kprobes.c
++++ b/arch/ia64/kernel/kprobes.c
+@@ -411,7 +411,8 @@ static void kretprobe_trampoline(void)
+
+ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
+ {
+- regs->cr_iip = __kretprobe_trampoline_handler(regs, kretprobe_trampoline, NULL);
++ regs->cr_iip = __kretprobe_trampoline_handler(regs,
++ dereference_function_descriptor(kretprobe_trampoline), NULL);
+ /*
+ * By returning a non-zero value, we are telling
+ * kprobe_handler() that we don't want the post_handler
+@@ -427,7 +428,7 @@ void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
+ ri->fp = NULL;
+
+ /* Replace the return addr with trampoline addr */
+- regs->b0 = ((struct fnptr *)kretprobe_trampoline)->ip;
++ regs->b0 = (unsigned long)dereference_function_descriptor(kretprobe_trampoline);
+ }
+
+ /* Check the instruction in the slot is break */
+@@ -957,14 +958,14 @@ static struct kprobe trampoline_p = {
+ int __init arch_init_kprobes(void)
+ {
+ trampoline_p.addr =
+- (kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip;
++ dereference_function_descriptor(kretprobe_trampoline);
+ return register_kprobe(&trampoline_p);
+ }
+
+ int __kprobes arch_trampoline_kprobe(struct kprobe *p)
+ {
+ if (p->addr ==
+- (kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip)
++ dereference_function_descriptor(kretprobe_trampoline))
+ return 1;
+
+ return 0;
+diff --git a/arch/m68k/Kconfig.machine b/arch/m68k/Kconfig.machine
+index 64a6414677360..0c451081432ab 100644
+--- a/arch/m68k/Kconfig.machine
++++ b/arch/m68k/Kconfig.machine
+@@ -185,6 +185,7 @@ config INIT_LCD
+ config MEMORY_RESERVE
+ int "Memory reservation (MiB)"
+ depends on (UCSIMM || UCDIMM)
++ default 0
+ help
+ Reserve certain memory regions on 68x328 based boards.
+
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index cc8c8d22afaf5..e513528be3ad7 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -285,6 +285,9 @@ config BCM63XX
+ select SYS_SUPPORTS_32BIT_KERNEL
+ select SYS_SUPPORTS_BIG_ENDIAN
+ select SYS_HAS_EARLY_PRINTK
++ select SYS_HAS_CPU_BMIPS32_3300
++ select SYS_HAS_CPU_BMIPS4350
++ select SYS_HAS_CPU_BMIPS4380
+ select SWAP_IO_SPACE
+ select GPIOLIB
+ select HAVE_CLK
+@@ -1375,6 +1378,7 @@ config CPU_LOONGSON3
+ select WEAK_REORDERING_BEYOND_LLSC
+ select MIPS_PGD_C0_CONTEXT
+ select MIPS_L1_CACHE_SHIFT_6
++ select MIPS_FP_SUPPORT
+ select GPIOLIB
+ select SWIOTLB
+ help
+diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c
+index 164115944a7fd..aba6e2d6a736c 100644
+--- a/arch/mips/bcm63xx/clk.c
++++ b/arch/mips/bcm63xx/clk.c
+@@ -381,6 +381,12 @@ void clk_disable(struct clk *clk)
+
+ EXPORT_SYMBOL(clk_disable);
+
++struct clk *clk_get_parent(struct clk *clk)
++{
++ return NULL;
++}
++EXPORT_SYMBOL(clk_get_parent);
++
+ unsigned long clk_get_rate(struct clk *clk)
+ {
+ if (!clk)
+diff --git a/arch/mips/generic/yamon-dt.c b/arch/mips/generic/yamon-dt.c
+index 7ba4ad5cc1d66..7b7ba0f76c60e 100644
+--- a/arch/mips/generic/yamon-dt.c
++++ b/arch/mips/generic/yamon-dt.c
+@@ -79,7 +79,7 @@ static unsigned int __init gen_fdt_mem_array(
+ __init int yamon_dt_append_memory(void *fdt,
+ const struct yamon_mem_region *regions)
+ {
+- unsigned long phys_memsize, memsize;
++ unsigned long phys_memsize = 0, memsize;
+ __be32 mem_array[2 * MAX_MEM_ARRAY_ENTRIES];
+ unsigned int mem_entries;
+ int i, err, mem_off;
+diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h
+index 8bc5df49b0e1d..890e51b159e06 100644
+--- a/arch/mips/include/asm/mips-cm.h
++++ b/arch/mips/include/asm/mips-cm.h
+@@ -15,6 +15,7 @@
+ #ifndef __MIPS_ASM_MIPS_CM_H__
+ #define __MIPS_ASM_MIPS_CM_H__
+
++#include <linux/bitfield.h>
+ #include <linux/bitops.h>
+ #include <linux/errno.h>
+
+@@ -157,8 +158,8 @@ GCR_ACCESSOR_RO(32, 0x030, rev)
+ #define CM_GCR_REV_MINOR GENMASK(7, 0)
+
+ #define CM_ENCODE_REV(major, minor) \
+- (((major) << __ffs(CM_GCR_REV_MAJOR)) | \
+- ((minor) << __ffs(CM_GCR_REV_MINOR)))
++ (FIELD_PREP(CM_GCR_REV_MAJOR, major) | \
++ FIELD_PREP(CM_GCR_REV_MINOR, minor))
+
+ #define CM_REV_CM2 CM_ENCODE_REV(6, 0)
+ #define CM_REV_CM2_5 CM_ENCODE_REV(7, 0)
+@@ -366,10 +367,10 @@ static inline int mips_cm_revision(void)
+ static inline unsigned int mips_cm_max_vp_width(void)
+ {
+ extern int smp_num_siblings;
+- uint32_t cfg;
+
+ if (mips_cm_revision() >= CM_REV_CM3)
+- return read_gcr_sys_config2() & CM_GCR_SYS_CONFIG2_MAXVPW;
++ return FIELD_GET(CM_GCR_SYS_CONFIG2_MAXVPW,
++ read_gcr_sys_config2());
+
+ if (mips_cm_present()) {
+ /*
+@@ -377,8 +378,7 @@ static inline unsigned int mips_cm_max_vp_width(void)
+ * number of VP(E)s, and if that ever changes then this will
+ * need revisiting.
+ */
+- cfg = read_gcr_cl_config() & CM_GCR_Cx_CONFIG_PVPE;
+- return (cfg >> __ffs(CM_GCR_Cx_CONFIG_PVPE)) + 1;
++ return FIELD_GET(CM_GCR_Cx_CONFIG_PVPE, read_gcr_cl_config()) + 1;
+ }
+
+ if (IS_ENABLED(CONFIG_SMP))
+diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
+index 50d3d74001cbe..51cfcb44e6703 100644
+--- a/arch/mips/kernel/mips-cm.c
++++ b/arch/mips/kernel/mips-cm.c
+@@ -183,8 +183,7 @@ static void mips_cm_probe_l2sync(void)
+ phys_addr_t addr;
+
+ /* L2-only sync was introduced with CM major revision 6 */
+- major_rev = (read_gcr_rev() & CM_GCR_REV_MAJOR) >>
+- __ffs(CM_GCR_REV_MAJOR);
++ major_rev = FIELD_GET(CM_GCR_REV_MAJOR, read_gcr_rev());
+ if (major_rev < 6)
+ return;
+
+@@ -267,13 +266,13 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core,
+ preempt_disable();
+
+ if (cm_rev >= CM_REV_CM3) {
+- val = core << __ffs(CM3_GCR_Cx_OTHER_CORE);
+- val |= vp << __ffs(CM3_GCR_Cx_OTHER_VP);
++ val = FIELD_PREP(CM3_GCR_Cx_OTHER_CORE, core) |
++ FIELD_PREP(CM3_GCR_Cx_OTHER_VP, vp);
+
+ if (cm_rev >= CM_REV_CM3_5) {
+ val |= CM_GCR_Cx_OTHER_CLUSTER_EN;
+- val |= cluster << __ffs(CM_GCR_Cx_OTHER_CLUSTER);
+- val |= block << __ffs(CM_GCR_Cx_OTHER_BLOCK);
++ val |= FIELD_PREP(CM_GCR_Cx_OTHER_CLUSTER, cluster);
++ val |= FIELD_PREP(CM_GCR_Cx_OTHER_BLOCK, block);
+ } else {
+ WARN_ON(cluster != 0);
+ WARN_ON(block != CM_GCR_Cx_OTHER_BLOCK_LOCAL);
+@@ -303,7 +302,7 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core,
+ spin_lock_irqsave(&per_cpu(cm_core_lock, curr_core),
+ per_cpu(cm_core_lock_flags, curr_core));
+
+- val = core << __ffs(CM_GCR_Cx_OTHER_CORENUM);
++ val = FIELD_PREP(CM_GCR_Cx_OTHER_CORENUM, core);
+ }
+
+ write_gcr_cl_other(val);
+@@ -347,8 +346,8 @@ void mips_cm_error_report(void)
+ cm_other = read_gcr_error_mult();
+
+ if (revision < CM_REV_CM3) { /* CM2 */
+- cause = cm_error >> __ffs(CM_GCR_ERROR_CAUSE_ERRTYPE);
+- ocause = cm_other >> __ffs(CM_GCR_ERROR_MULT_ERR2ND);
++ cause = FIELD_GET(CM_GCR_ERROR_CAUSE_ERRTYPE, cm_error);
++ ocause = FIELD_GET(CM_GCR_ERROR_MULT_ERR2ND, cm_other);
+
+ if (!cause)
+ return;
+@@ -390,8 +389,8 @@ void mips_cm_error_report(void)
+ ulong core_id_bits, vp_id_bits, cmd_bits, cmd_group_bits;
+ ulong cm3_cca_bits, mcp_bits, cm3_tr_bits, sched_bit;
+
+- cause = cm_error >> __ffs64(CM3_GCR_ERROR_CAUSE_ERRTYPE);
+- ocause = cm_other >> __ffs(CM_GCR_ERROR_MULT_ERR2ND);
++ cause = FIELD_GET(CM3_GCR_ERROR_CAUSE_ERRTYPE, cm_error);
++ ocause = FIELD_GET(CM_GCR_ERROR_MULT_ERR2ND, cm_other);
+
+ if (!cause)
+ return;
+diff --git a/arch/mips/kernel/r2300_fpu.S b/arch/mips/kernel/r2300_fpu.S
+index 3062ba66c5635..f7ce7b3971a4b 100644
+--- a/arch/mips/kernel/r2300_fpu.S
++++ b/arch/mips/kernel/r2300_fpu.S
+@@ -29,8 +29,8 @@
+ #define EX2(a,b) \
+ 9: a,##b; \
+ .section __ex_table,"a"; \
+- PTR 9b,bad_stack; \
+- PTR 9b+4,bad_stack; \
++ PTR 9b,fault; \
++ PTR 9b+4,fault; \
+ .previous
+
+ .set mips1
+diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
+index 69c17b549fd3c..721e652bebc6d 100644
+--- a/arch/mips/kernel/syscall.c
++++ b/arch/mips/kernel/syscall.c
+@@ -235,12 +235,3 @@ SYSCALL_DEFINE3(cachectl, char *, addr, int, nbytes, int, op)
+ {
+ return -ENOSYS;
+ }
+-
+-/*
+- * If we ever come here the user sp is bad. Zap the process right away.
+- * Due to the bad stack signaling wouldn't work.
+- */
+-asmlinkage void bad_stack(void)
+-{
+- do_exit(SIGSEGV);
+-}
+diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c
+index a263d1b751ffe..a8e309dcd38d7 100644
+--- a/arch/mips/lantiq/clk.c
++++ b/arch/mips/lantiq/clk.c
+@@ -160,6 +160,12 @@ void clk_deactivate(struct clk *clk)
+ }
+ EXPORT_SYMBOL(clk_deactivate);
+
++struct clk *clk_get_parent(struct clk *clk)
++{
++ return NULL;
++}
++EXPORT_SYMBOL(clk_get_parent);
++
+ static inline u32 get_counter_resolution(void)
+ {
+ u32 res;
+diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c
+index 664f2f7f55c1c..efee1c538a518 100644
+--- a/arch/mips/lantiq/xway/dma.c
++++ b/arch/mips/lantiq/xway/dma.c
+@@ -22,6 +22,7 @@
+ #include <linux/export.h>
+ #include <linux/spinlock.h>
+ #include <linux/clk.h>
++#include <linux/delay.h>
+ #include <linux/err.h>
+
+ #include <lantiq_soc.h>
+@@ -40,6 +41,7 @@
+ #define LTQ_DMA_PCTRL 0x44
+ #define LTQ_DMA_IRNEN 0xf4
+
++#define DMA_ID_CHNR GENMASK(26, 20) /* channel number */
+ #define DMA_DESCPT BIT(3) /* descriptor complete irq */
+ #define DMA_TX BIT(8) /* TX channel direction */
+ #define DMA_CHAN_ON BIT(0) /* channel on / off bit */
+@@ -50,7 +52,6 @@
+ #define DMA_POLL BIT(31) /* turn on channel polling */
+ #define DMA_CLK_DIV4 BIT(6) /* polling clock divider */
+ #define DMA_2W_BURST BIT(1) /* 2 word burst length */
+-#define DMA_MAX_CHANNEL 20 /* the soc has 20 channels */
+ #define DMA_ETOP_ENDIANNESS (0xf << 8) /* endianness swap etop channels */
+ #define DMA_WEIGHT (BIT(17) | BIT(16)) /* default channel wheight */
+
+@@ -217,7 +218,7 @@ ltq_dma_init(struct platform_device *pdev)
+ {
+ struct clk *clk;
+ struct resource *res;
+- unsigned id;
++ unsigned int id, nchannels;
+ int i;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+@@ -233,21 +234,24 @@ ltq_dma_init(struct platform_device *pdev)
+ clk_enable(clk);
+ ltq_dma_w32_mask(0, DMA_RESET, LTQ_DMA_CTRL);
+
++ usleep_range(1, 10);
++
+ /* disable all interrupts */
+ ltq_dma_w32(0, LTQ_DMA_IRNEN);
+
+ /* reset/configure each channel */
+- for (i = 0; i < DMA_MAX_CHANNEL; i++) {
++ id = ltq_dma_r32(LTQ_DMA_ID);
++ nchannels = ((id & DMA_ID_CHNR) >> 20);
++ for (i = 0; i < nchannels; i++) {
+ ltq_dma_w32(i, LTQ_DMA_CS);
+ ltq_dma_w32(DMA_CHAN_RST, LTQ_DMA_CCTRL);
+ ltq_dma_w32(DMA_POLL | DMA_CLK_DIV4, LTQ_DMA_CPOLL);
+ ltq_dma_w32_mask(DMA_CHAN_ON, 0, LTQ_DMA_CCTRL);
+ }
+
+- id = ltq_dma_r32(LTQ_DMA_ID);
+ dev_info(&pdev->dev,
+ "Init done - hw rev: %X, ports: %d, channels: %d\n",
+- id & 0x1f, (id >> 16) & 0xf, id >> 20);
++ id & 0x1f, (id >> 16) & 0xf, nchannels);
+
+ return 0;
+ }
+diff --git a/arch/mips/sni/time.c b/arch/mips/sni/time.c
+index dbace1f3e1a97..745ceb945fc50 100644
+--- a/arch/mips/sni/time.c
++++ b/arch/mips/sni/time.c
+@@ -18,14 +18,14 @@ static int a20r_set_periodic(struct clock_event_device *evt)
+ {
+ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0x34;
+ wmb();
+- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV;
++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV & 0xff;
+ wmb();
+ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV >> 8;
+ wmb();
+
+ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0xb4;
+ wmb();
+- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV;
++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV & 0xff;
+ wmb();
+ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV >> 8;
+ wmb();
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index d2f92273fe376..e8b503cd54f57 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -1851,8 +1851,8 @@ syscall_restore:
+ LDREG TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1
+
+ /* Are we being ptraced? */
+- ldw TASK_FLAGS(%r1),%r19
+- ldi _TIF_SYSCALL_TRACE_MASK,%r2
++ LDREG TI_FLAGS-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r19
++ ldi _TIF_SINGLESTEP|_TIF_BLOCKSTEP,%r2
+ and,COND(=) %r19,%r2,%r0
+ b,n syscall_restore_rfi
+
+diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c
+index 5e26dbede5fc2..ae4fc8769c38b 100644
+--- a/arch/parisc/kernel/smp.c
++++ b/arch/parisc/kernel/smp.c
+@@ -32,6 +32,7 @@
+ #include <linux/bitops.h>
+ #include <linux/ftrace.h>
+ #include <linux/cpu.h>
++#include <linux/kgdb.h>
+
+ #include <linux/atomic.h>
+ #include <asm/current.h>
+@@ -74,7 +75,10 @@ enum ipi_message_type {
+ IPI_CALL_FUNC,
+ IPI_CPU_START,
+ IPI_CPU_STOP,
+- IPI_CPU_TEST
++ IPI_CPU_TEST,
++#ifdef CONFIG_KGDB
++ IPI_ENTER_KGDB,
++#endif
+ };
+
+
+@@ -170,7 +174,12 @@ ipi_interrupt(int irq, void *dev_id)
+ case IPI_CPU_TEST:
+ smp_debug(100, KERN_DEBUG "CPU%d is alive!\n", this_cpu);
+ break;
+-
++#ifdef CONFIG_KGDB
++ case IPI_ENTER_KGDB:
++ smp_debug(100, KERN_DEBUG "CPU%d ENTER_KGDB\n", this_cpu);
++ kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs());
++ break;
++#endif
+ default:
+ printk(KERN_CRIT "Unknown IPI num on CPU%d: %lu\n",
+ this_cpu, which);
+@@ -226,6 +235,12 @@ send_IPI_allbutself(enum ipi_message_type op)
+ }
+ }
+
++#ifdef CONFIG_KGDB
++void kgdb_roundup_cpus(void)
++{
++ send_IPI_allbutself(IPI_ENTER_KGDB);
++}
++#endif
+
+ inline void
+ smp_send_stop(void) { send_IPI_allbutself(IPI_CPU_STOP); }
+diff --git a/arch/parisc/kernel/unwind.c b/arch/parisc/kernel/unwind.c
+index 2d14f17838d23..fa52c939e8a3b 100644
+--- a/arch/parisc/kernel/unwind.c
++++ b/arch/parisc/kernel/unwind.c
+@@ -21,6 +21,8 @@
+ #include <asm/ptrace.h>
+
+ #include <asm/unwind.h>
++#include <asm/switch_to.h>
++#include <asm/sections.h>
+
+ /* #define DEBUG 1 */
+ #ifdef DEBUG
+@@ -203,6 +205,11 @@ int __init unwind_init(void)
+ return 0;
+ }
+
++static bool pc_is_kernel_fn(unsigned long pc, void *fn)
++{
++ return (unsigned long)dereference_kernel_function_descriptor(fn) == pc;
++}
++
+ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int frame_size)
+ {
+ /*
+@@ -221,7 +228,7 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int
+ extern void * const _call_on_stack;
+ #endif /* CONFIG_IRQSTACKS */
+
+- if (pc == (unsigned long) &handle_interruption) {
++ if (pc_is_kernel_fn(pc, handle_interruption)) {
+ struct pt_regs *regs = (struct pt_regs *)(info->sp - frame_size - PT_SZ_ALGN);
+ dbg("Unwinding through handle_interruption()\n");
+ info->prev_sp = regs->gr[30];
+@@ -229,13 +236,13 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int
+ return 1;
+ }
+
+- if (pc == (unsigned long) &ret_from_kernel_thread ||
+- pc == (unsigned long) &syscall_exit) {
++ if (pc_is_kernel_fn(pc, ret_from_kernel_thread) ||
++ pc_is_kernel_fn(pc, syscall_exit)) {
+ info->prev_sp = info->prev_ip = 0;
+ return 1;
+ }
+
+- if (pc == (unsigned long) &intr_return) {
++ if (pc_is_kernel_fn(pc, intr_return)) {
+ struct pt_regs *regs;
+
+ dbg("Found intr_return()\n");
+@@ -246,20 +253,20 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int
+ return 1;
+ }
+
+- if (pc == (unsigned long) &_switch_to_ret) {
++ if (pc_is_kernel_fn(pc, _switch_to) ||
++ pc_is_kernel_fn(pc, _switch_to_ret)) {
+ info->prev_sp = info->sp - CALLEE_SAVE_FRAME_SIZE;
+ info->prev_ip = *(unsigned long *)(info->prev_sp - RP_OFFSET);
+ return 1;
+ }
+
+ #ifdef CONFIG_IRQSTACKS
+- if (pc == (unsigned long) &_call_on_stack) {
++ if (pc_is_kernel_fn(pc, _call_on_stack)) {
+ info->prev_sp = *(unsigned long *)(info->sp - FRAME_SIZE - REG_SZ);
+ info->prev_ip = *(unsigned long *)(info->sp - FRAME_SIZE - RP_OFFSET);
+ return 1;
+ }
+ #endif
+-
+ return 0;
+ }
+
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index 10a52664e29f0..038fcb6c76dc1 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -895,9 +895,9 @@ void flush_tlb_all(void)
+ {
+ int do_recycle;
+
+- __inc_irq_stat(irq_tlb_count);
+ do_recycle = 0;
+ spin_lock(&sid_lock);
++ __inc_irq_stat(irq_tlb_count);
+ if (dirty_space_ids > RECYCLE_THRESHOLD) {
+ BUG_ON(recycle_inuse); /* FIXME: Use a semaphore/wait queue here */
+ get_dirty_sids(&recycle_ndirty,recycle_dirty_array);
+@@ -916,8 +916,8 @@ void flush_tlb_all(void)
+ #else
+ void flush_tlb_all(void)
+ {
+- __inc_irq_stat(irq_tlb_count);
+ spin_lock(&sid_lock);
++ __inc_irq_stat(irq_tlb_count);
+ flush_tlb_all_local(NULL);
+ recycle_sids();
+ spin_unlock(&sid_lock);
+diff --git a/arch/powerpc/boot/dts/charon.dts b/arch/powerpc/boot/dts/charon.dts
+index 0e00e508eaa6a..1c8fe20752e6a 100644
+--- a/arch/powerpc/boot/dts/charon.dts
++++ b/arch/powerpc/boot/dts/charon.dts
+@@ -39,7 +39,7 @@
+ };
+ };
+
+- memory {
++ memory@0 {
+ device_type = "memory";
+ reg = <0x00000000 0x08000000>; // 128MB
+ };
+diff --git a/arch/powerpc/boot/dts/digsy_mtc.dts b/arch/powerpc/boot/dts/digsy_mtc.dts
+index c3922fc03e0b1..1a002cc487d57 100644
+--- a/arch/powerpc/boot/dts/digsy_mtc.dts
++++ b/arch/powerpc/boot/dts/digsy_mtc.dts
+@@ -20,7 +20,7 @@
+ model = "intercontrol,digsy-mtc";
+ compatible = "intercontrol,digsy-mtc";
+
+- memory {
++ memory@0 {
+ reg = <0x00000000 0x02000000>; // 32MB
+ };
+
+diff --git a/arch/powerpc/boot/dts/lite5200.dts b/arch/powerpc/boot/dts/lite5200.dts
+index 179a1785d6454..18d137a3393f0 100644
+--- a/arch/powerpc/boot/dts/lite5200.dts
++++ b/arch/powerpc/boot/dts/lite5200.dts
+@@ -36,7 +36,7 @@
+ };
+ };
+
+- memory {
++ memory@0 {
+ device_type = "memory";
+ reg = <0x00000000 0x04000000>; // 64MB
+ };
+diff --git a/arch/powerpc/boot/dts/lite5200b.dts b/arch/powerpc/boot/dts/lite5200b.dts
+index 5abb46c5cc951..29419cf81e044 100644
+--- a/arch/powerpc/boot/dts/lite5200b.dts
++++ b/arch/powerpc/boot/dts/lite5200b.dts
+@@ -35,7 +35,7 @@
+ led4 { gpios = <&gpio_simple 2 1>; };
+ };
+
+- memory {
++ memory@0 {
+ reg = <0x00000000 0x10000000>; // 256MB
+ };
+
+diff --git a/arch/powerpc/boot/dts/media5200.dts b/arch/powerpc/boot/dts/media5200.dts
+index 843f156a49c46..3ae4432165f75 100644
+--- a/arch/powerpc/boot/dts/media5200.dts
++++ b/arch/powerpc/boot/dts/media5200.dts
+@@ -36,7 +36,7 @@
+ };
+ };
+
+- memory {
++ memory@0 {
+ reg = <0x00000000 0x08000000>; // 128MB RAM
+ };
+
+diff --git a/arch/powerpc/boot/dts/mpc5200b.dtsi b/arch/powerpc/boot/dts/mpc5200b.dtsi
+index 969b2200b2f97..ecfba675b5611 100644
+--- a/arch/powerpc/boot/dts/mpc5200b.dtsi
++++ b/arch/powerpc/boot/dts/mpc5200b.dtsi
+@@ -37,7 +37,7 @@
+ };
+ };
+
+- memory: memory {
++ memory: memory@0 {
+ device_type = "memory";
+ reg = <0x00000000 0x04000000>; // 64MB
+ };
+diff --git a/arch/powerpc/boot/dts/o2d.dts b/arch/powerpc/boot/dts/o2d.dts
+index 9f6dd4d889b32..5a676e8141caf 100644
+--- a/arch/powerpc/boot/dts/o2d.dts
++++ b/arch/powerpc/boot/dts/o2d.dts
+@@ -16,7 +16,7 @@
+ model = "ifm,o2d";
+ compatible = "ifm,o2d";
+
+- memory {
++ memory@0 {
+ reg = <0x00000000 0x08000000>; // 128MB
+ };
+
+diff --git a/arch/powerpc/boot/dts/o2d.dtsi b/arch/powerpc/boot/dts/o2d.dtsi
+index cf073e693f24d..1b4df5f64b580 100644
+--- a/arch/powerpc/boot/dts/o2d.dtsi
++++ b/arch/powerpc/boot/dts/o2d.dtsi
+@@ -23,7 +23,7 @@
+ model = "ifm,o2d";
+ compatible = "ifm,o2d";
+
+- memory {
++ memory@0 {
+ reg = <0x00000000 0x04000000>; // 64MB
+ };
+
+diff --git a/arch/powerpc/boot/dts/o2dnt2.dts b/arch/powerpc/boot/dts/o2dnt2.dts
+index a0f5b97a4f06e..5184c461a205f 100644
+--- a/arch/powerpc/boot/dts/o2dnt2.dts
++++ b/arch/powerpc/boot/dts/o2dnt2.dts
+@@ -16,7 +16,7 @@
+ model = "ifm,o2dnt2";
+ compatible = "ifm,o2d";
+
+- memory {
++ memory@0 {
+ reg = <0x00000000 0x08000000>; // 128MB
+ };
+
+diff --git a/arch/powerpc/boot/dts/o3dnt.dts b/arch/powerpc/boot/dts/o3dnt.dts
+index acce49326491b..045b901719245 100644
+--- a/arch/powerpc/boot/dts/o3dnt.dts
++++ b/arch/powerpc/boot/dts/o3dnt.dts
+@@ -16,7 +16,7 @@
+ model = "ifm,o3dnt";
+ compatible = "ifm,o2d";
+
+- memory {
++ memory@0 {
+ reg = <0x00000000 0x04000000>; // 64MB
+ };
+
+diff --git a/arch/powerpc/boot/dts/pcm032.dts b/arch/powerpc/boot/dts/pcm032.dts
+index 576249bf2fb91..637e14286dde5 100644
+--- a/arch/powerpc/boot/dts/pcm032.dts
++++ b/arch/powerpc/boot/dts/pcm032.dts
+@@ -26,7 +26,7 @@
+ model = "phytec,pcm032";
+ compatible = "phytec,pcm032";
+
+- memory {
++ memory@0 {
+ reg = <0x00000000 0x08000000>; // 128MB
+ };
+
+diff --git a/arch/powerpc/boot/dts/tqm5200.dts b/arch/powerpc/boot/dts/tqm5200.dts
+index 1db07f6cf133c..68b9e8240fb5b 100644
+--- a/arch/powerpc/boot/dts/tqm5200.dts
++++ b/arch/powerpc/boot/dts/tqm5200.dts
+@@ -36,7 +36,7 @@
+ };
+ };
+
+- memory {
++ memory@0 {
+ device_type = "memory";
+ reg = <0x00000000 0x04000000>; // 64MB
+ };
+diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h
+index 4cd6e19ee90f4..537d94fabbd05 100644
+--- a/arch/powerpc/include/asm/code-patching.h
++++ b/arch/powerpc/include/asm/code-patching.h
+@@ -26,6 +26,7 @@
+ #define BRANCH_ABSOLUTE 0x2
+
+ bool is_offset_in_branch_range(long offset);
++bool is_offset_in_cond_branch_range(long offset);
+ unsigned int create_branch(const unsigned int *addr,
+ unsigned long target, int flags);
+ unsigned int create_cond_branch(const unsigned int *addr,
+diff --git a/arch/powerpc/include/asm/security_features.h b/arch/powerpc/include/asm/security_features.h
+index 3b45a64e491e5..a673416da3889 100644
+--- a/arch/powerpc/include/asm/security_features.h
++++ b/arch/powerpc/include/asm/security_features.h
+@@ -39,6 +39,11 @@ static inline bool security_ftr_enabled(unsigned long feature)
+ return !!(powerpc_security_features & feature);
+ }
+
++#ifdef CONFIG_PPC_BOOK3S_64
++enum stf_barrier_type stf_barrier_type_get(void);
++#else
++static inline enum stf_barrier_type stf_barrier_type_get(void) { return STF_BARRIER_NONE; }
++#endif
+
+ // Features indicating support for Spectre/Meltdown mitigations
+
+diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
+index 6a3dde9587ccb..48985a1fd34db 100644
+--- a/arch/powerpc/kernel/security.c
++++ b/arch/powerpc/kernel/security.c
+@@ -248,6 +248,11 @@ static int __init handle_no_stf_barrier(char *p)
+
+ early_param("no_stf_barrier", handle_no_stf_barrier);
+
++enum stf_barrier_type stf_barrier_type_get(void)
++{
++ return stf_enabled_flush_types;
++}
++
+ /* This is the generic flag used by other architectures */
+ static int __init handle_ssbd(char *p)
+ {
+diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c
+index 5ffee298745fe..bb245dbf6c57b 100644
+--- a/arch/powerpc/lib/code-patching.c
++++ b/arch/powerpc/lib/code-patching.c
+@@ -243,6 +243,11 @@ bool is_offset_in_branch_range(long offset)
+ return (offset >= -0x2000000 && offset <= 0x1fffffc && !(offset & 0x3));
+ }
+
++bool is_offset_in_cond_branch_range(long offset)
++{
++ return offset >= -0x8000 && offset <= 0x7fff && !(offset & 0x3);
++}
++
+ /*
+ * Helper to check if a given instruction is a conditional branch
+ * Derived from the conditional checks in analyse_instr()
+@@ -296,7 +301,7 @@ unsigned int create_cond_branch(const unsigned int *addr,
+ offset = offset - (unsigned long)addr;
+
+ /* Check we can represent the target in the instruction format */
+- if (offset < -0x8000 || offset > 0x7FFF || offset & 0x3)
++ if (!is_offset_in_cond_branch_range(offset))
+ return 0;
+
+ /* Mask out the flags and target, so they don't step on each other. */
+diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
+index e5c1d30ee968b..5a0af7d8d2242 100644
+--- a/arch/powerpc/net/bpf_jit.h
++++ b/arch/powerpc/net/bpf_jit.h
+@@ -15,6 +15,7 @@
+ #ifndef __ASSEMBLY__
+
+ #include <asm/types.h>
++#include <asm/code-patching.h>
+
+ #ifdef PPC64_ELF_ABI_v1
+ #define FUNCTION_DESCR_SIZE 24
+@@ -176,13 +177,26 @@
+ #define PPC_NEG(d, a) EMIT(PPC_INST_NEG | ___PPC_RT(d) | ___PPC_RA(a))
+
+ /* Long jump; (unconditional 'branch') */
+-#define PPC_JMP(dest) EMIT(PPC_INST_BRANCH | \
+- (((dest) - (ctx->idx * 4)) & 0x03fffffc))
++#define PPC_JMP(dest) \
++ do { \
++ long offset = (long)(dest) - (ctx->idx * 4); \
++ if (!is_offset_in_branch_range(offset)) { \
++ pr_err_ratelimited("Branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \
++ return -ERANGE; \
++ } \
++ EMIT(PPC_INST_BRANCH | (offset & 0x03fffffc)); \
++ } while (0)
+ /* "cond" here covers BO:BI fields. */
+-#define PPC_BCC_SHORT(cond, dest) EMIT(PPC_INST_BRANCH_COND | \
+- (((cond) & 0x3ff) << 16) | \
+- (((dest) - (ctx->idx * 4)) & \
+- 0xfffc))
++#define PPC_BCC_SHORT(cond, dest) \
++ do { \
++ long offset = (long)(dest) - (ctx->idx * 4); \
++ if (!is_offset_in_cond_branch_range(offset)) { \
++ pr_err_ratelimited("Conditional branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \
++ return -ERANGE; \
++ } \
++ EMIT(PPC_INST_BRANCH_COND | (((cond) & 0x3ff) << 16) | (offset & 0xfffc)); \
++ } while (0)
++
+ /* Sign-extended 32-bit immediate load */
+ #define PPC_LI32(d, i) do { \
+ if ((int)(uintptr_t)(i) >= -32768 && \
+@@ -221,11 +235,6 @@
+ #define PPC_FUNC_ADDR(d,i) do { PPC_LI32(d, i); } while(0)
+ #endif
+
+-static inline bool is_nearbranch(int offset)
+-{
+- return (offset < 32768) && (offset >= -32768);
+-}
+-
+ /*
+ * The fly in the ointment of code size changing from pass to pass is
+ * avoided by padding the short branch case with a NOP. If code size differs
+@@ -234,7 +243,7 @@ static inline bool is_nearbranch(int offset)
+ * state.
+ */
+ #define PPC_BCC(cond, dest) do { \
+- if (is_nearbranch((dest) - (ctx->idx * 4))) { \
++ if (is_offset_in_cond_branch_range((long)(dest) - (ctx->idx * 4))) { \
+ PPC_BCC_SHORT(cond, dest); \
+ PPC_NOP(); \
+ } else { \
+diff --git a/arch/powerpc/net/bpf_jit64.h b/arch/powerpc/net/bpf_jit64.h
+index 47f441f351a62..61ed9a4b283cf 100644
+--- a/arch/powerpc/net/bpf_jit64.h
++++ b/arch/powerpc/net/bpf_jit64.h
+@@ -20,18 +20,18 @@
+ * with our redzone usage.
+ *
+ * [ prev sp ] <-------------
+- * [ nv gpr save area ] 6*8 |
++ * [ nv gpr save area ] 5*8 |
+ * [ tail_call_cnt ] 8 |
+- * [ local_tmp_var ] 8 |
++ * [ local_tmp_var ] 16 |
+ * fp (r31) --> [ ebpf stack space ] upto 512 |
+ * [ frame header ] 32/112 |
+ * sp (r1) ---> [ stack pointer ] --------------
+ */
+
+ /* for gpr non volatile registers BPG_REG_6 to 10 */
+-#define BPF_PPC_STACK_SAVE (6*8)
++#define BPF_PPC_STACK_SAVE (5*8)
+ /* for bpf JIT code internal usage */
+-#define BPF_PPC_STACK_LOCALS 16
++#define BPF_PPC_STACK_LOCALS 24
+ /* stack frame excluding BPF stack, ensure this is quadword aligned */
+ #define BPF_PPC_STACKFRAME (STACK_FRAME_MIN_SIZE + \
+ BPF_PPC_STACK_LOCALS + BPF_PPC_STACK_SAVE)
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index 87213a1bb14ca..7b1fdcd4d96b8 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -19,6 +19,7 @@
+ #include <linux/if_vlan.h>
+ #include <asm/kprobes.h>
+ #include <linux/bpf.h>
++#include <asm/security_features.h>
+
+ #include "bpf_jit64.h"
+
+@@ -60,9 +61,9 @@ static inline bool bpf_has_stack_frame(struct codegen_context *ctx)
+ * [ prev sp ] <-------------
+ * [ ... ] |
+ * sp (r1) ---> [ stack pointer ] --------------
+- * [ nv gpr save area ] 6*8
++ * [ nv gpr save area ] 5*8
+ * [ tail_call_cnt ] 8
+- * [ local_tmp_var ] 8
++ * [ local_tmp_var ] 16
+ * [ unused red zone ] 208 bytes protected
+ */
+ static int bpf_jit_stack_local(struct codegen_context *ctx)
+@@ -70,12 +71,12 @@ static int bpf_jit_stack_local(struct codegen_context *ctx)
+ if (bpf_has_stack_frame(ctx))
+ return STACK_FRAME_MIN_SIZE + ctx->stack_size;
+ else
+- return -(BPF_PPC_STACK_SAVE + 16);
++ return -(BPF_PPC_STACK_SAVE + 24);
+ }
+
+ static int bpf_jit_stack_tailcallcnt(struct codegen_context *ctx)
+ {
+- return bpf_jit_stack_local(ctx) + 8;
++ return bpf_jit_stack_local(ctx) + 16;
+ }
+
+ static int bpf_jit_stack_offsetof(struct codegen_context *ctx, int reg)
+@@ -202,7 +203,7 @@ static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64
+ PPC_BLRL();
+ }
+
+-static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)
++static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)
+ {
+ /*
+ * By now, the eBPF program has already setup parameters in r3, r4 and r5
+@@ -263,17 +264,42 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32
+ bpf_jit_emit_common_epilogue(image, ctx);
+
+ PPC_BCTR();
++
+ /* out: */
++ return 0;
+ }
+
++/*
++ * We spill into the redzone always, even if the bpf program has its own stackframe.
++ * Offsets hardcoded based on BPF_PPC_STACK_SAVE -- see bpf_jit_stack_local()
++ */
++void bpf_stf_barrier(void);
++
++asm (
++" .global bpf_stf_barrier ;"
++" bpf_stf_barrier: ;"
++" std 21,-64(1) ;"
++" std 22,-56(1) ;"
++" sync ;"
++" ld 21,-64(1) ;"
++" ld 22,-56(1) ;"
++" ori 31,31,0 ;"
++" .rept 14 ;"
++" b 1f ;"
++" 1: ;"
++" .endr ;"
++" blr ;"
++);
++
+ /* Assemble the body code between the prologue & epilogue */
+ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
+ struct codegen_context *ctx,
+ u32 *addrs, bool extra_pass)
+ {
++ enum stf_barrier_type stf_barrier = stf_barrier_type_get();
+ const struct bpf_insn *insn = fp->insnsi;
+ int flen = fp->len;
+- int i;
++ int i, ret;
+
+ /* Start of epilogue code - will only be valid 2nd pass onwards */
+ u32 exit_addr = addrs[flen];
+@@ -324,18 +350,25 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
+ PPC_SUB(dst_reg, dst_reg, src_reg);
+ goto bpf_alu32_trunc;
+ case BPF_ALU | BPF_ADD | BPF_K: /* (u32) dst += (u32) imm */
+- case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */
+ case BPF_ALU64 | BPF_ADD | BPF_K: /* dst += imm */
++ if (!imm) {
++ goto bpf_alu32_trunc;
++ } else if (imm >= -32768 && imm < 32768) {
++ PPC_ADDI(dst_reg, dst_reg, IMM_L(imm));
++ } else {
++ PPC_LI32(b2p[TMP_REG_1], imm);
++ PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]);
++ }
++ goto bpf_alu32_trunc;
++ case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */
+ case BPF_ALU64 | BPF_SUB | BPF_K: /* dst -= imm */
+- if (BPF_OP(code) == BPF_SUB)
+- imm = -imm;
+- if (imm) {
+- if (imm >= -32768 && imm < 32768)
+- PPC_ADDI(dst_reg, dst_reg, IMM_L(imm));
+- else {
+- PPC_LI32(b2p[TMP_REG_1], imm);
+- PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]);
+- }
++ if (!imm) {
++ goto bpf_alu32_trunc;
++ } else if (imm > -32768 && imm <= 32768) {
++ PPC_ADDI(dst_reg, dst_reg, IMM_L(-imm));
++ } else {
++ PPC_LI32(b2p[TMP_REG_1], imm);
++ PPC_SUB(dst_reg, dst_reg, b2p[TMP_REG_1]);
+ }
+ goto bpf_alu32_trunc;
+ case BPF_ALU | BPF_MUL | BPF_X: /* (u32) dst *= (u32) src */
+@@ -606,6 +639,30 @@ emit_clear:
+ * BPF_ST NOSPEC (speculation barrier)
+ */
+ case BPF_ST | BPF_NOSPEC:
++ if (!security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) ||
++ (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR) &&
++ (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) || !cpu_has_feature(CPU_FTR_HVMODE))))
++ break;
++
++ switch (stf_barrier) {
++ case STF_BARRIER_EIEIO:
++ EMIT(0x7c0006ac | 0x02000000);
++ break;
++ case STF_BARRIER_SYNC_ORI:
++ EMIT(PPC_INST_SYNC);
++ PPC_LD(b2p[TMP_REG_1], 13, 0);
++ PPC_ORI(31, 31, 0);
++ break;
++ case STF_BARRIER_FALLBACK:
++ EMIT(PPC_INST_MFLR | ___PPC_RT(b2p[TMP_REG_1]));
++ PPC_LI64(12, dereference_kernel_function_descriptor(bpf_stf_barrier));
++ PPC_MTCTR(12);
++ EMIT(PPC_INST_BCTR | 0x1);
++ PPC_MTLR(b2p[TMP_REG_1]);
++ break;
++ case STF_BARRIER_NONE:
++ break;
++ }
+ break;
+
+ /*
+@@ -863,7 +920,9 @@ cond_branch:
+ */
+ case BPF_JMP | BPF_TAIL_CALL:
+ ctx->seen |= SEEN_TAILCALL;
+- bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);
++ ret = bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);
++ if (ret < 0)
++ return ret;
+ break;
+
+ default:
+diff --git a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
+index f05325f0cc03b..ddd2953965aa1 100644
+--- a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
++++ b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
+@@ -98,9 +98,8 @@ int __init mpc85xx_setup_pmc(void)
+ pr_err("Could not map guts node address\n");
+ return -ENOMEM;
+ }
++ qoriq_pm_ops = &mpc85xx_pm_ops;
+ }
+
+- qoriq_pm_ops = &mpc85xx_pm_ops;
+-
+ return 0;
+ }
+diff --git a/arch/powerpc/sysdev/dcr-low.S b/arch/powerpc/sysdev/dcr-low.S
+index e687bb2003ff0..5589fbe48bbdc 100644
+--- a/arch/powerpc/sysdev/dcr-low.S
++++ b/arch/powerpc/sysdev/dcr-low.S
+@@ -15,7 +15,7 @@
+ #include <asm/export.h>
+
+ #define DCR_ACCESS_PROLOG(table) \
+- cmpli cr0,r3,1024; \
++ cmplwi cr0,r3,1024; \
+ rlwinm r3,r3,4,18,27; \
+ lis r5,table@h; \
+ ori r5,r5,table@l; \
+diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
+index 8679bd74d337a..9abdfb8b1a1ea 100644
+--- a/arch/s390/kvm/priv.c
++++ b/arch/s390/kvm/priv.c
+@@ -397,6 +397,8 @@ static int handle_sske(struct kvm_vcpu *vcpu)
+ up_read(¤t->mm->mmap_sem);
+ if (rc == -EFAULT)
+ return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
++ if (rc == -EAGAIN)
++ continue;
+ if (rc < 0)
+ return rc;
+ start += PAGE_SIZE;
+diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
+index 7cde0f2f52e14..65ccb9d797270 100644
+--- a/arch/s390/mm/gmap.c
++++ b/arch/s390/mm/gmap.c
+@@ -684,9 +684,10 @@ void __gmap_zap(struct gmap *gmap, unsigned long gaddr)
+ vmaddr |= gaddr & ~PMD_MASK;
+ /* Get pointer to the page table entry */
+ ptep = get_locked_pte(gmap->mm, vmaddr, &ptl);
+- if (likely(ptep))
++ if (likely(ptep)) {
+ ptep_zap_unused(gmap->mm, vmaddr, ptep, 0);
+- pte_unmap_unlock(ptep, ptl);
++ pte_unmap_unlock(ptep, ptl);
++ }
+ }
+ }
+ EXPORT_SYMBOL_GPL(__gmap_zap);
+diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug
+index 010b6c33bbba2..71acd3d9b9e83 100644
+--- a/arch/sh/Kconfig.debug
++++ b/arch/sh/Kconfig.debug
+@@ -58,6 +58,7 @@ config DUMP_CODE
+
+ config DWARF_UNWINDER
+ bool "Enable the DWARF unwinder for stacktraces"
++ depends on DEBUG_KERNEL
+ select FRAME_POINTER
+ depends on SUPERH32
+ default n
+diff --git a/arch/sh/include/asm/sfp-machine.h b/arch/sh/include/asm/sfp-machine.h
+index d3c548443f2a6..dd195c6f3b9d8 100644
+--- a/arch/sh/include/asm/sfp-machine.h
++++ b/arch/sh/include/asm/sfp-machine.h
+@@ -25,6 +25,14 @@
+ #ifndef _SFP_MACHINE_H
+ #define _SFP_MACHINE_H
+
++#ifdef __BIG_ENDIAN__
++#define __BYTE_ORDER __BIG_ENDIAN
++#define __LITTLE_ENDIAN 0
++#else
++#define __BYTE_ORDER __LITTLE_ENDIAN
++#define __BIG_ENDIAN 0
++#endif
++
+ #define _FP_W_TYPE_SIZE 32
+ #define _FP_W_TYPE unsigned long
+ #define _FP_WS_TYPE signed long
+diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c
+index 0d3637c494bfe..c1f66c35e0c12 100644
+--- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c
++++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c
+@@ -76,8 +76,9 @@ static void shx3_prepare_cpus(unsigned int max_cpus)
+ BUILD_BUG_ON(SMP_MSG_NR >= 8);
+
+ for (i = 0; i < SMP_MSG_NR; i++)
+- request_irq(104 + i, ipi_interrupt_handler,
+- IRQF_PERCPU, "IPI", (void *)(long)i);
++ if (request_irq(104 + i, ipi_interrupt_handler,
++ IRQF_PERCPU, "IPI", (void *)(long)i))
++ pr_err("Failed to request irq %d\n", i);
+
+ for (i = 0; i < max_cpus; i++)
+ set_cpu_present(i, true);
+diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
+index c06074b847fa6..2bf1170f7afdb 100644
+--- a/arch/x86/events/intel/uncore_snbep.c
++++ b/arch/x86/events/intel/uncore_snbep.c
+@@ -3416,6 +3416,9 @@ static int skx_cha_hw_config(struct intel_uncore_box *box, struct perf_event *ev
+ struct hw_perf_event_extra *reg1 = &event->hw.extra_reg;
+ struct extra_reg *er;
+ int idx = 0;
++ /* Any of the CHA events may be filtered by Thread/Core-ID.*/
++ if (event->hw.config & SNBEP_CBO_PMON_CTL_TID_EN)
++ idx = SKX_CHA_MSR_PMON_BOX_FILTER_TID;
+
+ for (er = skx_uncore_cha_extra_regs; er->msr; er++) {
+ if (er->event != (event->hw.config & er->config_mask))
+@@ -3483,6 +3486,7 @@ static struct event_constraint skx_uncore_iio_constraints[] = {
+ UNCORE_EVENT_CONSTRAINT(0xc0, 0xc),
+ UNCORE_EVENT_CONSTRAINT(0xc5, 0xc),
+ UNCORE_EVENT_CONSTRAINT(0xd4, 0xc),
++ UNCORE_EVENT_CONSTRAINT(0xd5, 0xc),
+ EVENT_CONSTRAINT_END
+ };
+
+diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
+index 1663ad84778ba..38c31e164694e 100644
+--- a/arch/x86/hyperv/hv_init.c
++++ b/arch/x86/hyperv/hv_init.c
+@@ -192,7 +192,6 @@ void set_hv_tscchange_cb(void (*cb)(void))
+ struct hv_reenlightenment_control re_ctrl = {
+ .vector = HYPERV_REENLIGHTENMENT_VECTOR,
+ .enabled = 1,
+- .target_vp = hv_vp_index[smp_processor_id()]
+ };
+ struct hv_tsc_emulation_control emu_ctrl = {.enabled = 1};
+
+@@ -201,13 +200,20 @@ void set_hv_tscchange_cb(void (*cb)(void))
+ return;
+ }
+
++ if (!hv_vp_index)
++ return;
++
+ hv_reenlightenment_cb = cb;
+
+ /* Make sure callback is registered before we write to MSRs */
+ wmb();
+
++ re_ctrl.target_vp = hv_vp_index[get_cpu()];
++
+ wrmsrl(HV_X64_MSR_REENLIGHTENMENT_CONTROL, *((u64 *)&re_ctrl));
+ wrmsrl(HV_X64_MSR_TSC_EMULATION_CONTROL, *((u64 *)&emu_ctrl));
++
++ put_cpu();
+ }
+ EXPORT_SYMBOL_GPL(set_hv_tscchange_cb);
+
+diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
+index 0b6352aabbd3d..b16fb3e185134 100644
+--- a/arch/x86/include/asm/page_64_types.h
++++ b/arch/x86/include/asm/page_64_types.h
+@@ -20,7 +20,7 @@
+ #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER)
+ #define CURRENT_MASK (~(THREAD_SIZE - 1))
+
+-#define EXCEPTION_STACK_ORDER (0 + KASAN_STACK_ORDER)
++#define EXCEPTION_STACK_ORDER (1 + KASAN_STACK_ORDER)
+ #define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER)
+
+ #define DEBUG_STACK_ORDER (EXCEPTION_STACK_ORDER + 1)
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index de69090ca1424..98c23126f7512 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -993,6 +993,8 @@ static void init_amd(struct cpuinfo_x86 *c)
+ if (cpu_has(c, X86_FEATURE_IRPERF) &&
+ !cpu_has_amd_erratum(c, amd_erratum_1054))
+ msr_set_bit(MSR_K7_HWCR, MSR_K7_HWCR_IRPERF_EN_BIT);
++
++ check_null_seg_clears_base(c);
+ }
+
+ #ifdef CONFIG_X86_32
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 2058e8c0e61db..7e7400af77978 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1254,9 +1254,8 @@ void __init early_cpu_init(void)
+ early_identify_cpu(&boot_cpu_data);
+ }
+
+-static void detect_null_seg_behavior(struct cpuinfo_x86 *c)
++static bool detect_null_seg_behavior(void)
+ {
+-#ifdef CONFIG_X86_64
+ /*
+ * Empirically, writing zero to a segment selector on AMD does
+ * not clear the base, whereas writing zero to a segment
+@@ -1277,10 +1276,43 @@ static void detect_null_seg_behavior(struct cpuinfo_x86 *c)
+ wrmsrl(MSR_FS_BASE, 1);
+ loadsegment(fs, 0);
+ rdmsrl(MSR_FS_BASE, tmp);
+- if (tmp != 0)
+- set_cpu_bug(c, X86_BUG_NULL_SEG);
+ wrmsrl(MSR_FS_BASE, old_base);
+-#endif
++ return tmp == 0;
++}
++
++void check_null_seg_clears_base(struct cpuinfo_x86 *c)
++{
++ /* BUG_NULL_SEG is only relevant with 64bit userspace */
++ if (!IS_ENABLED(CONFIG_X86_64))
++ return;
++
++ /* Zen3 CPUs advertise Null Selector Clears Base in CPUID. */
++ if (c->extended_cpuid_level >= 0x80000021 &&
++ cpuid_eax(0x80000021) & BIT(6))
++ return;
++
++ /*
++ * CPUID bit above wasn't set. If this kernel is still running
++ * as a HV guest, then the HV has decided not to advertize
++ * that CPUID bit for whatever reason. For example, one
++ * member of the migration pool might be vulnerable. Which
++ * means, the bug is present: set the BUG flag and return.
++ */
++ if (cpu_has(c, X86_FEATURE_HYPERVISOR)) {
++ set_cpu_bug(c, X86_BUG_NULL_SEG);
++ return;
++ }
++
++ /*
++ * Zen2 CPUs also have this behaviour, but no CPUID bit.
++ * 0x18 is the respective family for Hygon.
++ */
++ if ((c->x86 == 0x17 || c->x86 == 0x18) &&
++ detect_null_seg_behavior())
++ return;
++
++ /* All the remaining ones are affected */
++ set_cpu_bug(c, X86_BUG_NULL_SEG);
+ }
+
+ static void generic_identify(struct cpuinfo_x86 *c)
+@@ -1316,8 +1348,6 @@ static void generic_identify(struct cpuinfo_x86 *c)
+
+ get_model_name(c); /* Default name */
+
+- detect_null_seg_behavior(c);
+-
+ /*
+ * ESPFIX is a strange bug. All real CPUs have it. Paravirt
+ * systems that run Linux at CPL > 0 may or may not have the
+diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
+index e89602d2aff54..4eb9bf68b1227 100644
+--- a/arch/x86/kernel/cpu/cpu.h
++++ b/arch/x86/kernel/cpu/cpu.h
+@@ -76,6 +76,7 @@ extern int detect_extended_topology_early(struct cpuinfo_x86 *c);
+ extern int detect_extended_topology(struct cpuinfo_x86 *c);
+ extern int detect_ht_early(struct cpuinfo_x86 *c);
+ extern void detect_ht(struct cpuinfo_x86 *c);
++extern void check_null_seg_clears_base(struct cpuinfo_x86 *c);
+
+ unsigned int aperfmperf_get_khz(int cpu);
+
+diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
+index a975246074b5c..ef3317c6d6d16 100644
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -290,8 +290,10 @@ void kvm_set_posted_intr_wakeup_handler(void (*handler)(void))
+ {
+ if (handler)
+ kvm_posted_intr_wakeup_handler = handler;
+- else
++ else {
+ kvm_posted_intr_wakeup_handler = dummy_handler;
++ synchronize_rcu();
++ }
+ }
+ EXPORT_SYMBOL_GPL(kvm_set_posted_intr_wakeup_handler);
+
+diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
+index 1f25201de0afb..650d5a6cafc70 100644
+--- a/arch/x86/mm/mem_encrypt_identity.c
++++ b/arch/x86/mm/mem_encrypt_identity.c
+@@ -29,6 +29,15 @@
+ #undef CONFIG_PARAVIRT
+ #undef CONFIG_PARAVIRT_SPINLOCKS
+
++/*
++ * This code runs before CPU feature bits are set. By default, the
++ * pgtable_l5_enabled() function uses bit X86_FEATURE_LA57 to determine if
++ * 5-level paging is active, so that won't work here. USE_EARLY_PGTABLE_L5
++ * is provided to handle this situation and, instead, use a variable that
++ * has been set by the early boot code.
++ */
++#define USE_EARLY_PGTABLE_L5
++
+ #include <linux/kernel.h>
+ #include <linux/mm.h>
+ #include <linux/mem_encrypt.h>
+diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
+index 85082574c5154..62e11835f220e 100644
+--- a/crypto/pcrypt.c
++++ b/crypto/pcrypt.c
+@@ -138,12 +138,14 @@ static void pcrypt_aead_enc(struct padata_priv *padata)
+ {
+ struct pcrypt_request *preq = pcrypt_padata_request(padata);
+ struct aead_request *req = pcrypt_request_ctx(preq);
++ int ret;
+
+- padata->info = crypto_aead_encrypt(req);
++ ret = crypto_aead_encrypt(req);
+
+- if (padata->info == -EINPROGRESS)
++ if (ret == -EINPROGRESS)
+ return;
+
++ padata->info = ret;
+ padata_do_serial(padata);
+ }
+
+@@ -180,12 +182,14 @@ static void pcrypt_aead_dec(struct padata_priv *padata)
+ {
+ struct pcrypt_request *preq = pcrypt_padata_request(padata);
+ struct aead_request *req = pcrypt_request_ctx(preq);
++ int ret;
+
+- padata->info = crypto_aead_decrypt(req);
++ ret = crypto_aead_decrypt(req);
+
+- if (padata->info == -EINPROGRESS)
++ if (ret == -EINPROGRESS)
+ return;
+
++ padata->info = ret;
+ padata_do_serial(padata);
+ }
+
+diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h
+index 1e6204518496c..38712fa4dd9d2 100644
+--- a/drivers/acpi/acpica/acglobal.h
++++ b/drivers/acpi/acpica/acglobal.h
+@@ -224,6 +224,8 @@ extern struct acpi_bit_register_info
+ acpi_gbl_bit_register_info[ACPI_NUM_BITREG];
+ ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a);
+ ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b);
++ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a_s0);
++ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b_s0);
+
+ /*****************************************************************************
+ *
+diff --git a/drivers/acpi/acpica/hwesleep.c b/drivers/acpi/acpica/hwesleep.c
+index e0ad3f11142e4..9516966124ae3 100644
+--- a/drivers/acpi/acpica/hwesleep.c
++++ b/drivers/acpi/acpica/hwesleep.c
+@@ -147,17 +147,13 @@ acpi_status acpi_hw_extended_sleep(u8 sleep_state)
+
+ acpi_status acpi_hw_extended_wake_prep(u8 sleep_state)
+ {
+- acpi_status status;
+ u8 sleep_type_value;
+
+ ACPI_FUNCTION_TRACE(hw_extended_wake_prep);
+
+- status = acpi_get_sleep_type_data(ACPI_STATE_S0,
+- &acpi_gbl_sleep_type_a,
+- &acpi_gbl_sleep_type_b);
+- if (ACPI_SUCCESS(status)) {
++ if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) {
+ sleep_type_value =
+- ((acpi_gbl_sleep_type_a << ACPI_X_SLEEP_TYPE_POSITION) &
++ ((acpi_gbl_sleep_type_a_s0 << ACPI_X_SLEEP_TYPE_POSITION) &
+ ACPI_X_SLEEP_TYPE_MASK);
+
+ (void)acpi_write((u64)(sleep_type_value | ACPI_X_SLEEP_ENABLE),
+diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c
+index d8b8fc2ff5633..f4282370947c8 100644
+--- a/drivers/acpi/acpica/hwsleep.c
++++ b/drivers/acpi/acpica/hwsleep.c
+@@ -179,7 +179,7 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state)
+
+ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state)
+ {
+- acpi_status status;
++ acpi_status status = AE_OK;
+ struct acpi_bit_register_info *sleep_type_reg_info;
+ struct acpi_bit_register_info *sleep_enable_reg_info;
+ u32 pm1a_control;
+@@ -192,10 +192,7 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state)
+ * This is unclear from the ACPI Spec, but it is required
+ * by some machines.
+ */
+- status = acpi_get_sleep_type_data(ACPI_STATE_S0,
+- &acpi_gbl_sleep_type_a,
+- &acpi_gbl_sleep_type_b);
+- if (ACPI_SUCCESS(status)) {
++ if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) {
+ sleep_type_reg_info =
+ acpi_hw_get_bit_register_info(ACPI_BITREG_SLEEP_TYPE);
+ sleep_enable_reg_info =
+@@ -216,9 +213,9 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state)
+
+ /* Insert the SLP_TYP bits */
+
+- pm1a_control |= (acpi_gbl_sleep_type_a <<
++ pm1a_control |= (acpi_gbl_sleep_type_a_s0 <<
+ sleep_type_reg_info->bit_position);
+- pm1b_control |= (acpi_gbl_sleep_type_b <<
++ pm1b_control |= (acpi_gbl_sleep_type_b_s0 <<
+ sleep_type_reg_info->bit_position);
+
+ /* Write the control registers and ignore any errors */
+diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c
+index 3f22f7dd4556d..dc1e44ccaae20 100644
+--- a/drivers/acpi/acpica/hwxfsleep.c
++++ b/drivers/acpi/acpica/hwxfsleep.c
+@@ -288,6 +288,13 @@ acpi_status acpi_enter_sleep_state_prep(u8 sleep_state)
+ return_ACPI_STATUS(status);
+ }
+
++ status = acpi_get_sleep_type_data(ACPI_STATE_S0,
++ &acpi_gbl_sleep_type_a_s0,
++ &acpi_gbl_sleep_type_b_s0);
++ if (ACPI_FAILURE(status)) {
++ acpi_gbl_sleep_type_a_s0 = ACPI_SLEEP_TYPE_INVALID;
++ }
++
+ /* Execute the _PTS method (Prepare To Sleep) */
+
+ arg_list.count = 1;
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 674a0e92b798f..0bbf8b453ebf2 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -198,7 +198,7 @@ static int acpi_battery_is_charged(struct acpi_battery *battery)
+ return 1;
+
+ /* fallback to using design values for broken batteries */
+- if (battery->design_capacity == battery->capacity_now)
++ if (battery->design_capacity <= battery->capacity_now)
+ return 1;
+
+ /* we don't do any sort of metric based on percentages */
+diff --git a/drivers/acpi/pmic/intel_pmic.c b/drivers/acpi/pmic/intel_pmic.c
+index ca18e0d23df97..db63d3463617a 100644
+--- a/drivers/acpi/pmic/intel_pmic.c
++++ b/drivers/acpi/pmic/intel_pmic.c
+@@ -216,31 +216,36 @@ static acpi_status intel_pmic_regs_handler(u32 function,
+ void *handler_context, void *region_context)
+ {
+ struct intel_pmic_opregion *opregion = region_context;
+- int result = 0;
++ int result = -EINVAL;
++
++ if (function == ACPI_WRITE) {
++ switch (address) {
++ case 0:
++ return AE_OK;
++ case 1:
++ opregion->ctx.addr |= (*value64 & 0xff) << 8;
++ return AE_OK;
++ case 2:
++ opregion->ctx.addr |= *value64 & 0xff;
++ return AE_OK;
++ case 3:
++ opregion->ctx.val = *value64 & 0xff;
++ return AE_OK;
++ case 4:
++ if (*value64) {
++ result = regmap_write(opregion->regmap, opregion->ctx.addr,
++ opregion->ctx.val);
++ } else {
++ result = regmap_read(opregion->regmap, opregion->ctx.addr,
++ &opregion->ctx.val);
++ }
++ opregion->ctx.addr = 0;
++ }
++ }
+
+- switch (address) {
+- case 0:
+- return AE_OK;
+- case 1:
+- opregion->ctx.addr |= (*value64 & 0xff) << 8;
++ if (function == ACPI_READ && address == 3) {
++ *value64 = opregion->ctx.val;
+ return AE_OK;
+- case 2:
+- opregion->ctx.addr |= *value64 & 0xff;
+- return AE_OK;
+- case 3:
+- opregion->ctx.val = *value64 & 0xff;
+- return AE_OK;
+- case 4:
+- if (*value64) {
+- result = regmap_write(opregion->regmap, opregion->ctx.addr,
+- opregion->ctx.val);
+- } else {
+- result = regmap_read(opregion->regmap, opregion->ctx.addr,
+- &opregion->ctx.val);
+- if (result == 0)
+- *value64 = opregion->ctx.val;
+- }
+- memset(&opregion->ctx, 0x00, sizeof(opregion->ctx));
+ }
+
+ if (result < 0) {
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index cda4f7eb58ead..83be89c8627b9 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -483,6 +483,9 @@ enum binder_deferred_state {
+ * @files files_struct for process
+ * (protected by @files_lock)
+ * @files_lock mutex to protect @files
++ * @cred struct cred associated with the `struct file`
++ * in binder_open()
++ * (invariant after initialized)
+ * @deferred_work_node: element for binder_deferred_list
+ * (protected by binder_deferred_lock)
+ * @deferred_work: bitmap of deferred work to perform
+@@ -529,6 +532,7 @@ struct binder_proc {
+ struct task_struct *tsk;
+ struct files_struct *files;
+ struct mutex files_lock;
++ const struct cred *cred;
+ struct hlist_node deferred_work_node;
+ int deferred_work;
+ bool is_dead;
+@@ -2333,7 +2337,7 @@ static int binder_translate_binder(struct flat_binder_object *fp,
+ ret = -EINVAL;
+ goto done;
+ }
+- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
++ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) {
+ ret = -EPERM;
+ goto done;
+ }
+@@ -2379,7 +2383,7 @@ static int binder_translate_handle(struct flat_binder_object *fp,
+ proc->pid, thread->pid, fp->handle);
+ return -EINVAL;
+ }
+- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
++ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) {
+ ret = -EPERM;
+ goto done;
+ }
+@@ -2463,7 +2467,7 @@ static int binder_translate_fd(int fd,
+ ret = -EBADF;
+ goto err_fget;
+ }
+- ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file);
++ ret = security_binder_transfer_file(proc->cred, target_proc->cred, file);
+ if (ret < 0) {
+ ret = -EPERM;
+ goto err_security;
+@@ -2847,8 +2851,8 @@ static void binder_transaction(struct binder_proc *proc,
+ return_error_line = __LINE__;
+ goto err_invalid_target_handle;
+ }
+- if (security_binder_transaction(proc->tsk,
+- target_proc->tsk) < 0) {
++ if (security_binder_transaction(proc->cred,
++ target_proc->cred) < 0) {
+ return_error = BR_FAILED_REPLY;
+ return_error_param = -EPERM;
+ return_error_line = __LINE__;
+@@ -2962,7 +2966,7 @@ static void binder_transaction(struct binder_proc *proc,
+ t->from = thread;
+ else
+ t->from = NULL;
+- t->sender_euid = task_euid(proc->tsk);
++ t->sender_euid = proc->cred->euid;
+ t->to_proc = target_proc;
+ t->to_thread = target_thread;
+ t->code = tr->code;
+@@ -4341,6 +4345,7 @@ static void binder_free_proc(struct binder_proc *proc)
+ BUG_ON(!list_empty(&proc->delivered_death));
+ binder_alloc_deferred_release(&proc->alloc);
+ put_task_struct(proc->tsk);
++ put_cred(proc->cred);
+ binder_stats_deleted(BINDER_STAT_PROC);
+ kfree(proc);
+ }
+@@ -4544,7 +4549,7 @@ static int binder_ioctl_set_ctx_mgr(struct file *filp)
+ ret = -EBUSY;
+ goto out;
+ }
+- ret = security_binder_set_context_mgr(proc->tsk);
++ ret = security_binder_set_context_mgr(proc->cred);
+ if (ret < 0)
+ goto out;
+ if (uid_valid(context->binder_context_mgr_uid)) {
+@@ -4799,6 +4804,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
+ get_task_struct(current->group_leader);
+ proc->tsk = current->group_leader;
+ mutex_init(&proc->files_lock);
++ proc->cred = get_cred(filp->f_cred);
+ INIT_LIST_HEAD(&proc->todo);
+ proc->default_priority = task_nice(current);
+ binder_dev = container_of(filp->private_data, struct binder_device,
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 897360a56fddd..766ebab2f0116 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2073,7 +2073,7 @@ unsigned int ata_read_log_page(struct ata_device *dev, u8 log,
+
+ retry:
+ ata_tf_init(dev, &tf);
+- if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) &&
++ if (ata_dma_enabled(dev) && ata_id_has_read_log_dma_ext(dev->id) &&
+ !(dev->horkage & ATA_HORKAGE_NO_DMA_LOG)) {
+ tf.command = ATA_CMD_READ_LOG_DMA_EXT;
+ tf.protocol = ATA_PROT_DMA;
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index ccc80ff57eb20..096f29a2f710a 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -114,6 +114,12 @@ static const unsigned long ata_eh_identify_timeouts[] = {
+ ULONG_MAX,
+ };
+
++static const unsigned long ata_eh_revalidate_timeouts[] = {
++ 15000, /* Some drives are slow to read log pages when waking-up */
++ 15000, /* combined time till here is enough even for media access */
++ ULONG_MAX,
++};
++
+ static const unsigned long ata_eh_flush_timeouts[] = {
+ 15000, /* be generous with flush */
+ 15000, /* ditto */
+@@ -150,6 +156,8 @@ static const struct ata_eh_cmd_timeout_ent
+ ata_eh_cmd_timeout_table[ATA_EH_CMD_TIMEOUT_TABLE_SIZE] = {
+ { .commands = CMDS(ATA_CMD_ID_ATA, ATA_CMD_ID_ATAPI),
+ .timeouts = ata_eh_identify_timeouts, },
++ { .commands = CMDS(ATA_CMD_READ_LOG_EXT, ATA_CMD_READ_LOG_DMA_EXT),
++ .timeouts = ata_eh_revalidate_timeouts, },
+ { .commands = CMDS(ATA_CMD_READ_NATIVE_MAX, ATA_CMD_READ_NATIVE_MAX_EXT),
+ .timeouts = ata_eh_other_timeouts, },
+ { .commands = CMDS(ATA_CMD_SET_MAX, ATA_CMD_SET_MAX_EXT),
+diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
+index 194370ae37dd0..03a87dd1f625e 100644
+--- a/drivers/auxdisplay/ht16k33.c
++++ b/drivers/auxdisplay/ht16k33.c
+@@ -219,6 +219,15 @@ static const struct backlight_ops ht16k33_bl_ops = {
+ .check_fb = ht16k33_bl_check_fb,
+ };
+
++/*
++ * Blank events will be passed to the actual device handling the backlight when
++ * we return zero here.
++ */
++static int ht16k33_blank(int blank, struct fb_info *info)
++{
++ return 0;
++}
++
+ static int ht16k33_mmap(struct fb_info *info, struct vm_area_struct *vma)
+ {
+ struct ht16k33_priv *priv = info->par;
+@@ -231,6 +240,7 @@ static struct fb_ops ht16k33_fb_ops = {
+ .owner = THIS_MODULE,
+ .fb_read = fb_sys_read,
+ .fb_write = fb_sys_write,
++ .fb_blank = ht16k33_blank,
+ .fb_fillrect = sys_fillrect,
+ .fb_copyarea = sys_copyarea,
+ .fb_imageblit = sys_imageblit,
+@@ -418,6 +428,33 @@ static int ht16k33_probe(struct i2c_client *client,
+ if (err)
+ return err;
+
++ /* Backlight */
++ memset(&bl_props, 0, sizeof(struct backlight_properties));
++ bl_props.type = BACKLIGHT_RAW;
++ bl_props.max_brightness = MAX_BRIGHTNESS;
++
++ bl = devm_backlight_device_register(&client->dev, DRIVER_NAME"-bl",
++ &client->dev, priv,
++ &ht16k33_bl_ops, &bl_props);
++ if (IS_ERR(bl)) {
++ dev_err(&client->dev, "failed to register backlight\n");
++ return PTR_ERR(bl);
++ }
++
++ err = of_property_read_u32(node, "default-brightness-level",
++ &dft_brightness);
++ if (err) {
++ dft_brightness = MAX_BRIGHTNESS;
++ } else if (dft_brightness > MAX_BRIGHTNESS) {
++ dev_warn(&client->dev,
++ "invalid default brightness level: %u, using %u\n",
++ dft_brightness, MAX_BRIGHTNESS);
++ dft_brightness = MAX_BRIGHTNESS;
++ }
++
++ bl->props.brightness = dft_brightness;
++ ht16k33_bl_update_status(bl);
++
+ /* Framebuffer (2 bytes per column) */
+ BUILD_BUG_ON(PAGE_SIZE < HT16K33_FB_SIZE);
+ fbdev->buffer = (unsigned char *) get_zeroed_page(GFP_KERNEL);
+@@ -450,6 +487,7 @@ static int ht16k33_probe(struct i2c_client *client,
+ fbdev->info->screen_size = HT16K33_FB_SIZE;
+ fbdev->info->fix = ht16k33_fb_fix;
+ fbdev->info->var = ht16k33_fb_var;
++ fbdev->info->bl_dev = bl;
+ fbdev->info->pseudo_palette = NULL;
+ fbdev->info->flags = FBINFO_FLAG_DEFAULT;
+ fbdev->info->par = priv;
+@@ -462,34 +500,6 @@ static int ht16k33_probe(struct i2c_client *client,
+ if (err)
+ goto err_fbdev_unregister;
+
+- /* Backlight */
+- memset(&bl_props, 0, sizeof(struct backlight_properties));
+- bl_props.type = BACKLIGHT_RAW;
+- bl_props.max_brightness = MAX_BRIGHTNESS;
+-
+- bl = devm_backlight_device_register(&client->dev, DRIVER_NAME"-bl",
+- &client->dev, priv,
+- &ht16k33_bl_ops, &bl_props);
+- if (IS_ERR(bl)) {
+- dev_err(&client->dev, "failed to register backlight\n");
+- err = PTR_ERR(bl);
+- goto err_fbdev_unregister;
+- }
+-
+- err = of_property_read_u32(node, "default-brightness-level",
+- &dft_brightness);
+- if (err) {
+- dft_brightness = MAX_BRIGHTNESS;
+- } else if (dft_brightness > MAX_BRIGHTNESS) {
+- dev_warn(&client->dev,
+- "invalid default brightness level: %u, using %u\n",
+- dft_brightness, MAX_BRIGHTNESS);
+- dft_brightness = MAX_BRIGHTNESS;
+- }
+-
+- bl->props.brightness = dft_brightness;
+- ht16k33_bl_update_status(bl);
+-
+ ht16k33_fb_queue(priv);
+ return 0;
+
+diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
+index 834509506ef64..c4bc6723acfa5 100644
+--- a/drivers/auxdisplay/img-ascii-lcd.c
++++ b/drivers/auxdisplay/img-ascii-lcd.c
+@@ -284,6 +284,16 @@ static int img_ascii_lcd_display(struct img_ascii_lcd_ctx *ctx,
+ if (msg[count - 1] == '\n')
+ count--;
+
++ if (!count) {
++ /* clear the LCD */
++ devm_kfree(&ctx->pdev->dev, ctx->message);
++ ctx->message = NULL;
++ ctx->message_len = 0;
++ memset(ctx->curr, ' ', ctx->cfg->num_chars);
++ ctx->cfg->update(ctx);
++ return 0;
++ }
++
+ new_msg = devm_kmalloc(&ctx->pdev->dev, count + 1, GFP_KERNEL);
+ if (!new_msg)
+ return -ENOMEM;
+diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
+index 24410a0d6df07..cfa5e598a0dc8 100644
+--- a/drivers/base/firmware_loader/main.c
++++ b/drivers/base/firmware_loader/main.c
+@@ -97,12 +97,15 @@ static struct firmware_cache fw_cache;
+ extern struct builtin_fw __start_builtin_fw[];
+ extern struct builtin_fw __end_builtin_fw[];
+
+-static void fw_copy_to_prealloc_buf(struct firmware *fw,
++static bool fw_copy_to_prealloc_buf(struct firmware *fw,
+ void *buf, size_t size)
+ {
+- if (!buf || size < fw->size)
+- return;
++ if (!buf)
++ return true;
++ if (size < fw->size)
++ return false;
+ memcpy(buf, fw->data, fw->size);
++ return true;
+ }
+
+ static bool fw_get_builtin_firmware(struct firmware *fw, const char *name,
+@@ -114,9 +117,7 @@ static bool fw_get_builtin_firmware(struct firmware *fw, const char *name,
+ if (strcmp(name, b_fw->name) == 0) {
+ fw->size = b_fw->size;
+ fw->data = b_fw->data;
+- fw_copy_to_prealloc_buf(fw, buf, size);
+-
+- return true;
++ return fw_copy_to_prealloc_buf(fw, buf, size);
+ }
+ }
+
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 104206a795015..5e05bfcecd7b7 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -699,7 +699,7 @@ static ssize_t read_block_state(struct file *file, char __user *buf,
+ zram_test_flag(zram, index, ZRAM_WB) ? 'w' : '.',
+ zram_test_flag(zram, index, ZRAM_HUGE) ? 'h' : '.');
+
+- if (count < copied) {
++ if (count <= copied) {
+ zram_slot_unlock(zram, index);
+ break;
+ }
+diff --git a/drivers/char/hw_random/mtk-rng.c b/drivers/char/hw_random/mtk-rng.c
+index 7f99cd52b40ef..8dc256c761137 100644
+--- a/drivers/char/hw_random/mtk-rng.c
++++ b/drivers/char/hw_random/mtk-rng.c
+@@ -182,8 +182,13 @@ static int mtk_rng_runtime_resume(struct device *dev)
+ return mtk_rng_init(&priv->rng);
+ }
+
+-static UNIVERSAL_DEV_PM_OPS(mtk_rng_pm_ops, mtk_rng_runtime_suspend,
+- mtk_rng_runtime_resume, NULL);
++static const struct dev_pm_ops mtk_rng_pm_ops = {
++ SET_RUNTIME_PM_OPS(mtk_rng_runtime_suspend,
++ mtk_rng_runtime_resume, NULL)
++ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
++ pm_runtime_force_resume)
++};
++
+ #define MTK_RNG_PM_OPS (&mtk_rng_pm_ops)
+ #else /* CONFIG_PM */
+ #define MTK_RNG_PM_OPS NULL
+diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
+index 9f4e22dcde270..205d930d7ea60 100644
+--- a/drivers/char/tpm/tpm2-space.c
++++ b/drivers/char/tpm/tpm2-space.c
+@@ -419,6 +419,9 @@ static int tpm2_map_response_body(struct tpm_chip *chip, u32 cc, u8 *rsp,
+ if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES)
+ return 0;
+
++ if (be32_to_cpu(data->count) > (UINT_MAX - TPM_HEADER_SIZE - 9) / 4)
++ return -EFAULT;
++
+ if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count))
+ return -EFAULT;
+
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index 4d37f018d846c..06504384c3765 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -23,6 +23,7 @@ config I8253_LOCK
+
+ config OMAP_DM_TIMER
+ bool
++ select TIMER_OF
+
+ config CLKBLD_I8253
+ def_bool y if CLKSRC_I8253 || CLKEVT_I8253 || I8253_LOCK
+diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
+index 66979dc336807..d9b917529abaf 100644
+--- a/drivers/cpuidle/sysfs.c
++++ b/drivers/cpuidle/sysfs.c
+@@ -468,6 +468,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device)
+ &kdev->kobj, "state%d", i);
+ if (ret) {
+ kobject_put(&kobj->kobj);
++ kfree(kobj);
+ goto error_state;
+ }
+ cpuidle_add_s2idle_attr_group(kobj);
+@@ -599,6 +600,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev)
+ &kdev->kobj, "driver");
+ if (ret) {
+ kobject_put(&kdrv->kobj);
++ kfree(kdrv);
+ return ret;
+ }
+
+@@ -685,7 +687,6 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
+ if (!kdev)
+ return -ENOMEM;
+ kdev->dev = dev;
+- dev->kobj_dev = kdev;
+
+ init_completion(&kdev->kobj_unregister);
+
+@@ -693,9 +694,11 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
+ "cpuidle");
+ if (error) {
+ kobject_put(&kdev->kobj);
++ kfree(kdev);
+ return error;
+ }
+
++ dev->kobj_dev = kdev;
+ kobject_uevent(&kdev->kobj, KOBJ_ADD);
+
+ return 0;
+diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+index c64481160b711..180016e157771 100644
+--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
++++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+@@ -195,6 +195,13 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
+ val = ADF_CSR_RD(pmisc_bar_addr, pf2vf_offset);
+ } while ((val & int_bit) && (count++ < ADF_IOV_MSG_ACK_MAX_RETRY));
+
++ if (val != msg) {
++ dev_dbg(&GET_DEV(accel_dev),
++ "Collision - PFVF CSR overwritten by remote function\n");
++ ret = -EIO;
++ goto out;
++ }
++
+ if (val & int_bit) {
+ dev_dbg(&GET_DEV(accel_dev), "ACK not received from remote\n");
+ val &= ~int_bit;
+@@ -243,6 +250,11 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)
+
+ /* Read message from the VF */
+ msg = ADF_CSR_RD(pmisc_addr, hw_data->get_pf2vf_offset(vf_nr));
++ if (!(msg & ADF_VF2PF_INT)) {
++ dev_info(&GET_DEV(accel_dev),
++ "Spurious VF2PF interrupt, msg %X. Ignored\n", msg);
++ goto out;
++ }
+
+ /* To ACK, clear the VF2PFINT bit */
+ msg &= ~ADF_VF2PF_INT;
+@@ -326,6 +338,7 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)
+ if (resp && adf_iov_putmsg(accel_dev, resp, vf_nr))
+ dev_err(&GET_DEV(accel_dev), "Failed to send response to VF\n");
+
++out:
+ /* re-enable interrupt on PF from this VF */
+ adf_enable_vf2pf_interrupts(accel_dev, (1 << vf_nr));
+ return;
+diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+index ef90902c8200d..86274e3c6781d 100644
+--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
++++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+@@ -123,6 +123,11 @@ static void adf_pf2vf_bh_handler(void *data)
+
+ /* Read the message from PF */
+ msg = ADF_CSR_RD(pmisc_bar_addr, hw_data->get_pf2vf_offset(0));
++ if (!(msg & ADF_PF2VF_INT)) {
++ dev_info(&GET_DEV(accel_dev),
++ "Spurious PF2VF interrupt, msg %X. Ignored\n", msg);
++ goto out;
++ }
+
+ if (!(msg & ADF_PF2VF_MSGORIGIN_SYSTEM))
+ /* Ignore legacy non-system (non-kernel) PF2VF messages */
+@@ -171,6 +176,7 @@ static void adf_pf2vf_bh_handler(void *data)
+ msg &= ~ADF_PF2VF_INT;
+ ADF_CSR_WR(pmisc_bar_addr, hw_data->get_pf2vf_offset(0), msg);
+
++out:
+ /* Re-enable PF2VF interrupts */
+ adf_enable_pf2vf_interrupts(accel_dev);
+ return;
+diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
+index b7216935236f0..078f904b68cda 100644
+--- a/drivers/crypto/s5p-sss.c
++++ b/drivers/crypto/s5p-sss.c
+@@ -2166,6 +2166,8 @@ static int s5p_aes_probe(struct platform_device *pdev)
+
+ variant = find_s5p_sss_version(pdev);
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res)
++ return -EINVAL;
+
+ /*
+ * Note: HASH and PRNG uses the same registers in secss, avoid
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index 7db66f974041e..1624eee76f96a 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -156,7 +156,7 @@
+ #define AT_XDMAC_CC_WRIP (0x1 << 23) /* Write in Progress (read only) */
+ #define AT_XDMAC_CC_WRIP_DONE (0x0 << 23)
+ #define AT_XDMAC_CC_WRIP_IN_PROGRESS (0x1 << 23)
+-#define AT_XDMAC_CC_PERID(i) (0x7f & (i) << 24) /* Channel Peripheral Identifier */
++#define AT_XDMAC_CC_PERID(i) ((0x7f & (i)) << 24) /* Channel Peripheral Identifier */
+ #define AT_XDMAC_CDS_MSP 0x2C /* Channel Data Stride Memory Set Pattern */
+ #define AT_XDMAC_CSUS 0x30 /* Channel Source Microblock Stride */
+ #define AT_XDMAC_CDUS 0x34 /* Channel Destination Microblock Stride */
+diff --git a/drivers/dma/dmaengine.h b/drivers/dma/dmaengine.h
+index 501c0b063f852..302f13efd35d9 100644
+--- a/drivers/dma/dmaengine.h
++++ b/drivers/dma/dmaengine.h
+@@ -168,7 +168,7 @@ dmaengine_desc_get_callback_invoke(struct dma_async_tx_descriptor *tx,
+ static inline bool
+ dmaengine_desc_callback_valid(struct dmaengine_desc_callback *cb)
+ {
+- return (cb->callback) ? true : false;
++ return cb->callback || cb->callback_result;
+ }
+
+ #endif
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 53074ad361e58..f90feb0c496cc 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -1021,7 +1021,7 @@ static u64 haswell_get_tohm(struct sbridge_pvt *pvt)
+ pci_read_config_dword(pvt->info.pci_vtd, HASWELL_TOHM_1, ®);
+ rc = ((reg << 6) | rc) << 26;
+
+- return rc | 0x1ffffff;
++ return rc | 0x3ffffff;
+ }
+
+ static u64 knl_get_tolm(struct sbridge_pvt *pvt)
+diff --git a/drivers/firmware/psci_checker.c b/drivers/firmware/psci_checker.c
+index 9f1a913933d53..49b6a7be3a82b 100644
+--- a/drivers/firmware/psci_checker.c
++++ b/drivers/firmware/psci_checker.c
+@@ -162,7 +162,7 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups)
+ if (!alloc_cpumask_var(&tmp, GFP_KERNEL))
+ return -ENOMEM;
+
+- cpu_groups = kcalloc(nb_available_cpus, sizeof(cpu_groups),
++ cpu_groups = kcalloc(nb_available_cpus, sizeof(*cpu_groups),
+ GFP_KERNEL);
+ if (!cpu_groups) {
+ free_cpumask_var(tmp);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+index ce7f18c5ccb26..fda8d68a87fd6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+@@ -57,7 +57,7 @@ static void amdgpu_bo_list_free(struct kref *ref)
+
+ int amdgpu_bo_list_create(struct amdgpu_device *adev, struct drm_file *filp,
+ struct drm_amdgpu_bo_list_entry *info,
+- unsigned num_entries, struct amdgpu_bo_list **result)
++ size_t num_entries, struct amdgpu_bo_list **result)
+ {
+ unsigned last_entry = 0, first_userptr = num_entries;
+ struct amdgpu_bo_list_entry *array;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h
+index 61b089768e1ce..64c8195426ac8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h
+@@ -61,7 +61,7 @@ int amdgpu_bo_create_list_entry_array(struct drm_amdgpu_bo_list_in *in,
+ int amdgpu_bo_list_create(struct amdgpu_device *adev,
+ struct drm_file *filp,
+ struct drm_amdgpu_bo_list_entry *info,
+- unsigned num_entries,
++ size_t num_entries,
+ struct amdgpu_bo_list **list);
+
+ static inline struct amdgpu_bo_list_entry *
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+index c15286858f0bf..e1be3fd4d7a45 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -828,6 +828,7 @@ static int amdgpu_connector_vga_get_modes(struct drm_connector *connector)
+
+ amdgpu_connector_get_edid(connector);
+ ret = amdgpu_connector_ddc_get_modes(connector);
++ amdgpu_get_native_mode(connector);
+
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 652de972c3aea..3b70a338e5b47 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -113,6 +113,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"),
+ },
+ .driver_data = (void *)&lcd800x1280_rightside_up,
++ }, { /* AYA NEO 2021 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYA NEO 2021"),
++ },
++ .driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* GPD MicroPC (generic strings, also match on bios date) */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
+@@ -164,6 +170,13 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "TW891"),
+ },
+ .driver_data = (void *)&itworks_tw891,
++ }, { /* KD Kurio Smart C15200 2-in-1 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "KD Interactive"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Kurio Smart"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "KDM960BCP"),
++ },
++ .driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /*
+ * Lenovo Ideapad Miix 310 laptop, only some production batches
+ * have a portrait screen, the resolution checks makes the quirk
+diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c
+index 621f17643bb07..1f3362ce47ae2 100644
+--- a/drivers/gpu/drm/drm_plane_helper.c
++++ b/drivers/gpu/drm/drm_plane_helper.c
+@@ -150,7 +150,6 @@ int drm_plane_helper_check_update(struct drm_plane *plane,
+ .crtc_w = drm_rect_width(dst),
+ .crtc_h = drm_rect_height(dst),
+ .rotation = rotation,
+- .visible = *visible,
+ };
+ struct drm_crtc_state crtc_state = {
+ .crtc = crtc,
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c
+index c25b52a6b2198..7db24e9df4b9b 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c
+@@ -146,11 +146,13 @@ static inline int _sspp_subblk_offset(struct dpu_hw_pipe *ctx,
+ u32 *idx)
+ {
+ int rc = 0;
+- const struct dpu_sspp_sub_blks *sblk = ctx->cap->sblk;
++ const struct dpu_sspp_sub_blks *sblk;
+
+- if (!ctx)
++ if (!ctx || !ctx->cap || !ctx->cap->sblk)
+ return -EINVAL;
+
++ sblk = ctx->cap->sblk;
++
+ switch (s_id) {
+ case DPU_SSPP_SRC:
+ *idx = sblk->src_blk.base;
+@@ -413,7 +415,7 @@ static void _dpu_hw_sspp_setup_scaler3(struct dpu_hw_pipe *ctx,
+
+ (void)pe;
+ if (_sspp_subblk_offset(ctx, DPU_SSPP_SCALER_QSEED3, &idx) || !sspp
+- || !scaler3_cfg || !ctx || !ctx->cap || !ctx->cap->sblk)
++ || !scaler3_cfg)
+ return;
+
+ dpu_hw_setup_scaler3(&ctx->hw, scaler3_cfg, idx,
+diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
+index 7c0b30c955c39..c551d84444976 100644
+--- a/drivers/gpu/drm/msm/msm_gem.c
++++ b/drivers/gpu/drm/msm/msm_gem.c
+@@ -965,7 +965,7 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,
+
+ ret = msm_gem_new_impl(dev, size, flags, NULL, &obj, struct_mutex_locked);
+ if (ret)
+- goto fail;
++ return ERR_PTR(ret);
+
+ if (use_vram) {
+ struct msm_gem_vma *vma;
+@@ -1035,7 +1035,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
+
+ ret = msm_gem_new_impl(dev, size, MSM_BO_WC, dmabuf->resv, &obj, false);
+ if (ret)
+- goto fail;
++ return ERR_PTR(ret);
+
+ drm_gem_private_object_init(dev, obj, size);
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c
+index 6e3c450eaacef..3ff49344abc77 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c
+@@ -62,7 +62,6 @@ gv100_hdmi_ctrl(struct nvkm_ior *ior, int head, bool enable, u8 max_ac_packet,
+ nvkm_wr32(device, 0x6f0108 + hdmi, vendor_infoframe.header);
+ nvkm_wr32(device, 0x6f010c + hdmi, vendor_infoframe.subpack0_low);
+ nvkm_wr32(device, 0x6f0110 + hdmi, vendor_infoframe.subpack0_high);
+- nvkm_wr32(device, 0x6f0110 + hdmi, 0x00000000);
+ nvkm_wr32(device, 0x6f0114 + hdmi, 0x00000000);
+ nvkm_wr32(device, 0x6f0118 + hdmi, 0x00000000);
+ nvkm_wr32(device, 0x6f011c + hdmi, 0x00000000);
+diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
+index 68e88bed77ca7..869bddad5f916 100644
+--- a/drivers/gpu/drm/udl/udl_connector.c
++++ b/drivers/gpu/drm/udl/udl_connector.c
+@@ -32,7 +32,7 @@ static bool udl_get_edid_block(struct udl_device *udl, int block_idx,
+ ret = usb_control_msg(udl->udev,
+ usb_rcvctrlpipe(udl->udev, 0),
+ (0x02), (0x80 | (0x02 << 5)), bval,
+- 0xA1, read_buff, 2, HZ);
++ 0xA1, read_buff, 2, 1000);
+ if (ret < 1) {
+ DRM_ERROR("Read EDID byte %d failed err %x\n", i, ret);
+ kfree(read_buff);
+diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
+index 87d3d7da78f87..7e7c8debbd285 100644
+--- a/drivers/hv/hyperv_vmbus.h
++++ b/drivers/hv/hyperv_vmbus.h
+@@ -26,6 +26,7 @@
+ #define _HYPERV_VMBUS_H
+
+ #include <linux/list.h>
++#include <linux/bitops.h>
+ #include <asm/sync_bitops.h>
+ #include <asm/hyperv-tlfs.h>
+ #include <linux/atomic.h>
+diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
+index d34de21d43adb..c4051a3e63c29 100644
+--- a/drivers/hwmon/hwmon.c
++++ b/drivers/hwmon/hwmon.c
+@@ -631,8 +631,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
+ dev_set_drvdata(hdev, drvdata);
+ dev_set_name(hdev, HWMON_ID_FORMAT, id);
+ err = device_register(hdev);
+- if (err)
+- goto free_hwmon;
++ if (err) {
++ put_device(hdev);
++ goto ida_remove;
++ }
+
+ if (dev && dev->of_node && chip && chip->ops->read &&
+ chip->info[0]->type == hwmon_chip &&
+diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c
+index 53db78753a0d1..e25b801490862 100644
+--- a/drivers/hwmon/pmbus/lm25066.c
++++ b/drivers/hwmon/pmbus/lm25066.c
+@@ -60,26 +60,31 @@ struct __coeff {
+ #define PSC_CURRENT_IN_L (PSC_NUM_CLASSES)
+ #define PSC_POWER_L (PSC_NUM_CLASSES + 1)
+
+-static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = {
++static struct __coeff lm25066_coeff[][PSC_NUM_CLASSES + 2] = {
+ [lm25056] = {
+ [PSC_VOLTAGE_IN] = {
+ .m = 16296,
++ .b = 1343,
+ .R = -2,
+ },
+ [PSC_CURRENT_IN] = {
+ .m = 13797,
++ .b = -1833,
+ .R = -2,
+ },
+ [PSC_CURRENT_IN_L] = {
+ .m = 6726,
++ .b = -537,
+ .R = -2,
+ },
+ [PSC_POWER] = {
+ .m = 5501,
++ .b = -2908,
+ .R = -3,
+ },
+ [PSC_POWER_L] = {
+ .m = 26882,
++ .b = -5646,
+ .R = -4,
+ },
+ [PSC_TEMPERATURE] = {
+@@ -91,26 +96,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = {
+ [lm25066] = {
+ [PSC_VOLTAGE_IN] = {
+ .m = 22070,
++ .b = -1800,
+ .R = -2,
+ },
+ [PSC_VOLTAGE_OUT] = {
+ .m = 22070,
++ .b = -1800,
+ .R = -2,
+ },
+ [PSC_CURRENT_IN] = {
+ .m = 13661,
++ .b = -5200,
+ .R = -2,
+ },
+ [PSC_CURRENT_IN_L] = {
+ .m = 6852,
++ .b = -3100,
+ .R = -2,
+ },
+ [PSC_POWER] = {
+ .m = 736,
++ .b = -3300,
+ .R = -2,
+ },
+ [PSC_POWER_L] = {
+ .m = 369,
++ .b = -1900,
+ .R = -2,
+ },
+ [PSC_TEMPERATURE] = {
+@@ -120,26 +131,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = {
+ [lm5064] = {
+ [PSC_VOLTAGE_IN] = {
+ .m = 4611,
++ .b = -642,
+ .R = -2,
+ },
+ [PSC_VOLTAGE_OUT] = {
+ .m = 4621,
++ .b = 423,
+ .R = -2,
+ },
+ [PSC_CURRENT_IN] = {
+ .m = 10742,
++ .b = 1552,
+ .R = -2,
+ },
+ [PSC_CURRENT_IN_L] = {
+ .m = 5456,
++ .b = 2118,
+ .R = -2,
+ },
+ [PSC_POWER] = {
+ .m = 1204,
++ .b = 8524,
+ .R = -3,
+ },
+ [PSC_POWER_L] = {
+ .m = 612,
++ .b = 11202,
+ .R = -3,
+ },
+ [PSC_TEMPERATURE] = {
+@@ -149,26 +166,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = {
+ [lm5066] = {
+ [PSC_VOLTAGE_IN] = {
+ .m = 4587,
++ .b = -1200,
+ .R = -2,
+ },
+ [PSC_VOLTAGE_OUT] = {
+ .m = 4587,
++ .b = -2400,
+ .R = -2,
+ },
+ [PSC_CURRENT_IN] = {
+ .m = 10753,
++ .b = -1200,
+ .R = -2,
+ },
+ [PSC_CURRENT_IN_L] = {
+ .m = 5405,
++ .b = -600,
+ .R = -2,
+ },
+ [PSC_POWER] = {
+ .m = 1204,
++ .b = -6000,
+ .R = -3,
+ },
+ [PSC_POWER_L] = {
+ .m = 605,
++ .b = -8000,
+ .R = -3,
+ },
+ [PSC_TEMPERATURE] = {
+diff --git a/drivers/i2c/busses/i2c-xlr.c b/drivers/i2c/busses/i2c-xlr.c
+index 34cd4b3085402..dda6cb848405b 100644
+--- a/drivers/i2c/busses/i2c-xlr.c
++++ b/drivers/i2c/busses/i2c-xlr.c
+@@ -433,11 +433,15 @@ static int xlr_i2c_probe(struct platform_device *pdev)
+ i2c_set_adapdata(&priv->adap, priv);
+ ret = i2c_add_numbered_adapter(&priv->adap);
+ if (ret < 0)
+- return ret;
++ goto err_unprepare_clk;
+
+ platform_set_drvdata(pdev, priv);
+ dev_info(&priv->adap.dev, "Added I2C Bus.\n");
+ return 0;
++
++err_unprepare_clk:
++ clk_unprepare(clk);
++ return ret;
+ }
+
+ static int xlr_i2c_remove(struct platform_device *pdev)
+diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c
+index d3ce5def4f659..f540c0f11c132 100644
+--- a/drivers/iio/dac/ad5446.c
++++ b/drivers/iio/dac/ad5446.c
+@@ -528,8 +528,15 @@ static int ad5622_write(struct ad5446_state *st, unsigned val)
+ {
+ struct i2c_client *client = to_i2c_client(st->dev);
+ __be16 data = cpu_to_be16(val);
++ int ret;
++
++ ret = i2c_master_send(client, (char *)&data, sizeof(data));
++ if (ret < 0)
++ return ret;
++ if (ret != sizeof(data))
++ return -EIO;
+
+- return i2c_master_send(client, (char *)&data, sizeof(data));
++ return 0;
+ }
+
+ /**
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index 60f2fb7e7dbfe..d52ae7259e62d 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -637,12 +637,13 @@ int bnxt_qplib_query_srq(struct bnxt_qplib_res *res,
+ int rc = 0;
+
+ RCFW_CMD_PREP(req, QUERY_SRQ, cmd_flags);
+- req.srq_cid = cpu_to_le32(srq->id);
+
+ /* Configure the request */
+ sbuf = bnxt_qplib_rcfw_alloc_sbuf(rcfw, sizeof(*sb));
+ if (!sbuf)
+ return -ENOMEM;
++ req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
++ req.srq_cid = cpu_to_le32(srq->id);
+ sb = sbuf->sb;
+ rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+ (void *)sbuf, 0);
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index 73bd35d34a257..7209b8a9b0dd2 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -1057,8 +1057,10 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
+ if (dev->steering_support ==
+ MLX4_STEERING_MODE_DEVICE_MANAGED)
+ qp->flags |= MLX4_IB_QP_NETIF;
+- else
++ else {
++ err = -EINVAL;
+ goto err;
++ }
+ }
+
+ err = set_kernel_sq_size(dev, &init_attr->cap, qp_type, qp);
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index f847f0a9f204d..7dd6ca11f7062 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -2500,15 +2500,18 @@ int qedr_query_qp(struct ib_qp *ibqp,
+ int rc = 0;
+
+ memset(¶ms, 0, sizeof(params));
+-
+- rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms);
+- if (rc)
+- goto err;
+-
+ memset(qp_attr, 0, sizeof(*qp_attr));
+ memset(qp_init_attr, 0, sizeof(*qp_init_attr));
+
+- qp_attr->qp_state = qedr_get_ibqp_state(params.state);
++ if (qp->qp_type != IB_QPT_GSI) {
++ rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms);
++ if (rc)
++ goto err;
++ qp_attr->qp_state = qedr_get_ibqp_state(params.state);
++ } else {
++ qp_attr->qp_state = qedr_get_ibqp_state(QED_ROCE_QP_STATE_RTS);
++ }
++
+ qp_attr->cur_qp_state = qedr_get_ibqp_state(params.state);
+ qp_attr->path_mtu = ib_mtu_int_to_enum(params.mtu);
+ qp_attr->path_mig_state = IB_MIG_MIGRATED;
+diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h
+index 4555510d86c42..154c92c0e0cd7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_param.h
++++ b/drivers/infiniband/sw/rxe/rxe_param.h
+@@ -143,7 +143,7 @@ enum rxe_port_param {
+ RXE_PORT_MAX_MTU = IB_MTU_4096,
+ RXE_PORT_ACTIVE_MTU = IB_MTU_256,
+ RXE_PORT_GID_TBL_LEN = 1024,
+- RXE_PORT_PORT_CAP_FLAGS = RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP,
++ RXE_PORT_PORT_CAP_FLAGS = IB_PORT_CM_SUP,
+ RXE_PORT_MAX_MSG_SZ = 0x800000,
+ RXE_PORT_BAD_PKEY_CNTR = 0,
+ RXE_PORT_QKEY_VIOL_CNTR = 0,
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 530142b5a1154..a18d17f7ef386 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -433,6 +433,19 @@ static void elantech_report_trackpoint(struct psmouse *psmouse,
+ case 0x16008020U:
+ case 0x26800010U:
+ case 0x36808000U:
++
++ /*
++ * This firmware misreport coordinates for trackpoint
++ * occasionally. Discard packets outside of [-127, 127] range
++ * to prevent cursor jumps.
++ */
++ if (packet[4] == 0x80 || packet[5] == 0x80 ||
++ packet[1] >> 7 == packet[4] >> 7 ||
++ packet[2] >> 7 == packet[5] >> 7) {
++ elantech_debug("discarding packet [%6ph]\n", packet);
++ break;
++
++ }
+ x = packet[4] - (int)((packet[1]^0x80) << 1);
+ y = (int)((packet[2]^0x80) << 1) - packet[5];
+
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index f20e54f41dde9..c218e107c0c8f 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -276,6 +276,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S6230"),
+ },
+ },
++ {
++ /* Fujitsu Lifebook T725 laptop */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"),
++ },
++ },
+ {
+ /* Fujitsu Lifebook U745 */
+ .matches = {
+@@ -844,6 +851,13 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"),
+ },
+ },
++ {
++ /* Fujitsu Lifebook T725 laptop */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"),
++ },
++ },
+ {
+ /* Fujitsu U574 laptop */
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
+diff --git a/drivers/irqchip/irq-bcm6345-l1.c b/drivers/irqchip/irq-bcm6345-l1.c
+index 43f8abe40878a..31ea6332ecb83 100644
+--- a/drivers/irqchip/irq-bcm6345-l1.c
++++ b/drivers/irqchip/irq-bcm6345-l1.c
+@@ -143,7 +143,7 @@ static void bcm6345_l1_irq_handle(struct irq_desc *desc)
+ for_each_set_bit(hwirq, &pending, IRQS_PER_WORD) {
+ irq = irq_linear_revmap(intc->domain, base + hwirq);
+ if (irq)
+- do_IRQ(irq);
++ generic_handle_irq(irq);
+ else
+ spurious_interrupt();
+ }
+diff --git a/drivers/irqchip/irq-s3c24xx.c b/drivers/irqchip/irq-s3c24xx.c
+index c19766fe8a1ae..c11fbd8f1225d 100644
+--- a/drivers/irqchip/irq-s3c24xx.c
++++ b/drivers/irqchip/irq-s3c24xx.c
+@@ -368,11 +368,25 @@ static inline int s3c24xx_handle_intc(struct s3c_irq_intc *intc,
+ asmlinkage void __exception_irq_entry s3c24xx_handle_irq(struct pt_regs *regs)
+ {
+ do {
+- if (likely(s3c_intc[0]))
+- if (s3c24xx_handle_intc(s3c_intc[0], regs, 0))
+- continue;
++ /*
++ * For platform based machines, neither ERR nor NULL can happen here.
++ * The s3c24xx_handle_irq() will be set as IRQ handler iff this succeeds:
++ *
++ * s3c_intc[0] = s3c24xx_init_intc()
++ *
++ * If this fails, the next calls to s3c24xx_init_intc() won't be executed.
++ *
++ * For DT machine, s3c_init_intc_of() could set the IRQ handler without
++ * setting s3c_intc[0] only if it was called with num_ctrl=0. There is no
++ * such code path, so again the s3c_intc[0] will have a valid pointer if
++ * set_handle_irq() is called.
++ *
++ * Therefore in s3c24xx_handle_irq(), the s3c_intc[0] is always something.
++ */
++ if (s3c24xx_handle_intc(s3c_intc[0], regs, 0))
++ continue;
+
+- if (s3c_intc[2])
++ if (!IS_ERR_OR_NULL(s3c_intc[2]))
+ if (s3c24xx_handle_intc(s3c_intc[2], regs, 64))
+ continue;
+
+diff --git a/drivers/media/dvb-frontends/mn88443x.c b/drivers/media/dvb-frontends/mn88443x.c
+index 9ec1aeef03d5a..53981ff9422e0 100644
+--- a/drivers/media/dvb-frontends/mn88443x.c
++++ b/drivers/media/dvb-frontends/mn88443x.c
+@@ -204,11 +204,18 @@ struct mn88443x_priv {
+ struct regmap *regmap_t;
+ };
+
+-static void mn88443x_cmn_power_on(struct mn88443x_priv *chip)
++static int mn88443x_cmn_power_on(struct mn88443x_priv *chip)
+ {
++ struct device *dev = &chip->client_s->dev;
+ struct regmap *r_t = chip->regmap_t;
++ int ret;
+
+- clk_prepare_enable(chip->mclk);
++ ret = clk_prepare_enable(chip->mclk);
++ if (ret) {
++ dev_err(dev, "Failed to prepare and enable mclk: %d\n",
++ ret);
++ return ret;
++ }
+
+ gpiod_set_value_cansleep(chip->reset_gpio, 1);
+ usleep_range(100, 1000);
+@@ -222,6 +229,8 @@ static void mn88443x_cmn_power_on(struct mn88443x_priv *chip)
+ } else {
+ regmap_write(r_t, HIZSET3, 0x8f);
+ }
++
++ return 0;
+ }
+
+ static void mn88443x_cmn_power_off(struct mn88443x_priv *chip)
+@@ -738,7 +747,10 @@ static int mn88443x_probe(struct i2c_client *client,
+ chip->fe.demodulator_priv = chip;
+ i2c_set_clientdata(client, chip);
+
+- mn88443x_cmn_power_on(chip);
++ ret = mn88443x_cmn_power_on(chip);
++ if (ret)
++ goto err_i2c_t;
++
+ mn88443x_s_sleep(chip);
+ mn88443x_t_sleep(chip);
+
+diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
+index 19ff9cb08e884..933ddfcc50a16 100644
+--- a/drivers/media/i2c/ir-kbd-i2c.c
++++ b/drivers/media/i2c/ir-kbd-i2c.c
+@@ -801,6 +801,7 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ rc_proto = RC_PROTO_BIT_RC5 | RC_PROTO_BIT_RC6_MCE |
+ RC_PROTO_BIT_RC6_6A_32;
+ ir_codes = RC_MAP_HAUPPAUGE;
++ ir->polling_interval = 125;
+ probe_tx = true;
+ break;
+ }
+diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
+index 715be3632b01a..eb08acf43e3a2 100644
+--- a/drivers/media/i2c/mt9p031.c
++++ b/drivers/media/i2c/mt9p031.c
+@@ -81,7 +81,9 @@
+ #define MT9P031_PIXEL_CLOCK_INVERT (1 << 15)
+ #define MT9P031_PIXEL_CLOCK_SHIFT(n) ((n) << 8)
+ #define MT9P031_PIXEL_CLOCK_DIVIDE(n) ((n) << 0)
+-#define MT9P031_FRAME_RESTART 0x0b
++#define MT9P031_RESTART 0x0b
++#define MT9P031_FRAME_PAUSE_RESTART (1 << 1)
++#define MT9P031_FRAME_RESTART (1 << 0)
+ #define MT9P031_SHUTTER_DELAY 0x0c
+ #define MT9P031_RST 0x0d
+ #define MT9P031_RST_ENABLE 1
+@@ -448,9 +450,23 @@ static int mt9p031_set_params(struct mt9p031 *mt9p031)
+ static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable)
+ {
+ struct mt9p031 *mt9p031 = to_mt9p031(subdev);
++ struct i2c_client *client = v4l2_get_subdevdata(subdev);
++ int val;
+ int ret;
+
+ if (!enable) {
++ /* enable pause restart */
++ val = MT9P031_FRAME_PAUSE_RESTART;
++ ret = mt9p031_write(client, MT9P031_RESTART, val);
++ if (ret < 0)
++ return ret;
++
++ /* enable restart + keep pause restart set */
++ val |= MT9P031_FRAME_RESTART;
++ ret = mt9p031_write(client, MT9P031_RESTART, val);
++ if (ret < 0)
++ return ret;
++
+ /* Stop sensor readout */
+ ret = mt9p031_set_output_control(mt9p031,
+ MT9P031_OUTPUT_CONTROL_CEN, 0);
+@@ -470,6 +486,16 @@ static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable)
+ if (ret < 0)
+ return ret;
+
++ /*
++ * - clear pause restart
++ * - don't clear restart as clearing restart manually can cause
++ * undefined behavior
++ */
++ val = MT9P031_FRAME_RESTART;
++ ret = mt9p031_write(client, MT9P031_RESTART, val);
++ if (ret < 0)
++ return ret;
++
+ return mt9p031_pll_enable(mt9p031);
+ }
+
+diff --git a/drivers/media/pci/cx23885/cx23885-alsa.c b/drivers/media/pci/cx23885/cx23885-alsa.c
+index db1e8ff35474a..150106eb36052 100644
+--- a/drivers/media/pci/cx23885/cx23885-alsa.c
++++ b/drivers/media/pci/cx23885/cx23885-alsa.c
+@@ -559,7 +559,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev)
+ SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1,
+ THIS_MODULE, sizeof(struct cx23885_audio_dev), &card);
+ if (err < 0)
+- goto error;
++ goto error_msg;
+
+ chip = (struct cx23885_audio_dev *) card->private_data;
+ chip->dev = dev;
+@@ -585,6 +585,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev)
+
+ error:
+ snd_card_free(card);
++error_msg:
+ pr_err("%s(): Failed to register analog audio adapter\n",
+ __func__);
+
+diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+index ead59fabd15ff..de3fc62810e6c 100644
+--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
++++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+@@ -267,19 +267,24 @@ static irqreturn_t netup_unidvb_isr(int irq, void *dev_id)
+ if ((reg40 & AVL_IRQ_ASSERTED) != 0) {
+ /* IRQ is being signaled */
+ reg_isr = readw(ndev->bmmio0 + REG_ISR);
+- if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) {
+- iret = netup_i2c_interrupt(&ndev->i2c[0]);
+- } else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) {
+- iret = netup_i2c_interrupt(&ndev->i2c[1]);
+- } else if (reg_isr & NETUP_UNIDVB_IRQ_SPI) {
++ if (reg_isr & NETUP_UNIDVB_IRQ_SPI)
+ iret = netup_spi_interrupt(ndev->spi);
+- } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) {
+- iret = netup_dma_interrupt(&ndev->dma[0]);
+- } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) {
+- iret = netup_dma_interrupt(&ndev->dma[1]);
+- } else if (reg_isr & NETUP_UNIDVB_IRQ_CI) {
+- iret = netup_ci_interrupt(ndev);
++ else if (!ndev->old_fw) {
++ if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) {
++ iret = netup_i2c_interrupt(&ndev->i2c[0]);
++ } else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) {
++ iret = netup_i2c_interrupt(&ndev->i2c[1]);
++ } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) {
++ iret = netup_dma_interrupt(&ndev->dma[0]);
++ } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) {
++ iret = netup_dma_interrupt(&ndev->dma[1]);
++ } else if (reg_isr & NETUP_UNIDVB_IRQ_CI) {
++ iret = netup_ci_interrupt(ndev);
++ } else {
++ goto err;
++ }
+ } else {
++err:
+ dev_err(&pci_dev->dev,
+ "%s(): unknown interrupt 0x%x\n",
+ __func__, reg_isr);
+diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c
+index f8d35e3ac1dcc..9b57fb2857285 100644
+--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c
++++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c
+@@ -818,7 +818,8 @@ static int mtk_vpu_probe(struct platform_device *pdev)
+ vpu->wdt.wq = create_singlethread_workqueue("vpu_wdt");
+ if (!vpu->wdt.wq) {
+ dev_err(dev, "initialize wdt workqueue failed\n");
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto clk_unprepare;
+ }
+ INIT_WORK(&vpu->wdt.ws, vpu_wdt_reset_func);
+ mutex_init(&vpu->vpu_mutex);
+@@ -917,6 +918,8 @@ disable_vpu_clk:
+ vpu_clock_disable(vpu);
+ workqueue_destroy:
+ destroy_workqueue(vpu->wdt.wq);
++clk_unprepare:
++ clk_unprepare(vpu->clk);
+
+ return ret;
+ }
+diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c
+index dc5ae8025832a..23f55514b002a 100644
+--- a/drivers/media/platform/rcar-vin/rcar-csi2.c
++++ b/drivers/media/platform/rcar-vin/rcar-csi2.c
+@@ -474,6 +474,8 @@ static int rcsi2_start(struct rcar_csi2 *priv)
+
+ /* Code is validated in set_fmt. */
+ format = rcsi2_code_to_fmt(priv->mf.code);
++ if (!format)
++ return -EINVAL;
+
+ /*
+ * Enable all Virtual Channels.
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+index 4b8516c35bc20..0fc101bc58d67 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+@@ -1276,11 +1276,15 @@ static int s5p_mfc_probe(struct platform_device *pdev)
+ spin_lock_init(&dev->condlock);
+ dev->plat_dev = pdev;
+ if (!dev->plat_dev) {
+- dev_err(&pdev->dev, "No platform data specified\n");
++ mfc_err("No platform data specified\n");
+ return -ENODEV;
+ }
+
+ dev->variant = of_device_get_match_data(&pdev->dev);
++ if (!dev->variant) {
++ dev_err(&pdev->dev, "Failed to get device MFC hardware variant information\n");
++ return -ENOENT;
++ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ dev->regs_base = devm_ioremap_resource(&pdev->dev, res);
+diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
+index aa12fd2663895..cc68bdac0c367 100644
+--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
+@@ -20,7 +20,7 @@
+
+ /* driver definitions */
+ #define DRIVER_AUTHOR "Joonyoung Shim <jy0922.shim@samsung.com>";
+-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver"
++#define DRIVER_CARD "Silicon Labs Si470x FM Radio"
+ #define DRIVER_DESC "I2C radio driver for Si470x FM Radio Receivers"
+ #define DRIVER_VERSION "1.0.2"
+
+diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c
+index 19e381dd58089..ba43a727c0b95 100644
+--- a/drivers/media/radio/si470x/radio-si470x-usb.c
++++ b/drivers/media/radio/si470x/radio-si470x-usb.c
+@@ -25,7 +25,7 @@
+
+ /* driver definitions */
+ #define DRIVER_AUTHOR "Tobias Lorenz <tobias.lorenz@gmx.net>"
+-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver"
++#define DRIVER_CARD "Silicon Labs Si470x FM Radio"
+ #define DRIVER_DESC "USB radio driver for Si470x FM Radio Receivers"
+ #define DRIVER_VERSION "1.0.10"
+
+diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
+index 18f3718315a83..679dd78382d78 100644
+--- a/drivers/media/rc/ite-cir.c
++++ b/drivers/media/rc/ite-cir.c
+@@ -292,7 +292,7 @@ static irqreturn_t ite_cir_isr(int irq, void *data)
+ }
+
+ /* check for the receive interrupt */
+- if (iflags & ITE_IRQ_RX_FIFO) {
++ if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) {
+ /* read the FIFO bytes */
+ rx_bytes =
+ dev->params.get_rx_bytes(dev, rx_buf,
+diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
+index 845583e2af4d5..cf4bcf7c62f2e 100644
+--- a/drivers/media/rc/mceusb.c
++++ b/drivers/media/rc/mceusb.c
+@@ -1323,6 +1323,7 @@ static void mceusb_dev_recv(struct urb *urb)
+ case -ECONNRESET:
+ case -ENOENT:
+ case -EILSEQ:
++ case -EPROTO:
+ case -ESHUTDOWN:
+ usb_unlink_urb(urb);
+ return;
+diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c
+index 6321b8e302612..990719727dc37 100644
+--- a/drivers/media/usb/dvb-usb/az6027.c
++++ b/drivers/media/usb/dvb-usb/az6027.c
+@@ -394,6 +394,7 @@ static struct rc_map_table rc_map_az6027_table[] = {
+ /* remote control stuff (does not work with my box) */
+ static int az6027_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
+ {
++ *state = REMOTE_NO_KEY_PRESSED;
+ return 0;
+ }
+
+diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c
+index fb1b4f2d5f9de..85b7838b3ede3 100644
+--- a/drivers/media/usb/dvb-usb/dibusb-common.c
++++ b/drivers/media/usb/dvb-usb/dibusb-common.c
+@@ -226,7 +226,7 @@ int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val)
+ u8 *buf;
+ int rc;
+
+- buf = kmalloc(2, GFP_KERNEL);
++ buf = kzalloc(2, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index 3f59a98dbf9a1..ec608f60d2c75 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -4030,8 +4030,11 @@ static void em28xx_usb_disconnect(struct usb_interface *intf)
+
+ em28xx_close_extension(dev);
+
+- if (dev->dev_next)
++ if (dev->dev_next) {
++ em28xx_close_extension(dev->dev_next);
+ em28xx_release_resources(dev->dev_next);
++ }
++
+ em28xx_release_resources(dev);
+
+ if (dev->dev_next) {
+diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
+index d0f95a5cb4d23..437651307056f 100644
+--- a/drivers/media/usb/em28xx/em28xx-core.c
++++ b/drivers/media/usb/em28xx/em28xx-core.c
+@@ -1151,8 +1151,9 @@ int em28xx_suspend_extension(struct em28xx *dev)
+ dev_info(&dev->intf->dev, "Suspending extensions\n");
+ mutex_lock(&em28xx_devlist_mutex);
+ list_for_each_entry(ops, &em28xx_extension_devlist, next) {
+- if (ops->suspend)
+- ops->suspend(dev);
++ if (!ops->suspend)
++ continue;
++ ops->suspend(dev);
+ if (dev->dev_next)
+ ops->suspend(dev->dev_next);
+ }
+diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
+index 2ca1e8ce6159d..e858f4f189ed9 100644
+--- a/drivers/media/usb/uvc/uvc_v4l2.c
++++ b/drivers/media/usb/uvc/uvc_v4l2.c
+@@ -474,10 +474,13 @@ static int uvc_v4l2_set_streamparm(struct uvc_streaming *stream,
+ uvc_simplify_fraction(&timeperframe.numerator,
+ &timeperframe.denominator, 8, 333);
+
+- if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
++ if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
+ parm->parm.capture.timeperframe = timeperframe;
+- else
++ parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME;
++ } else {
+ parm->parm.output.timeperframe = timeperframe;
++ parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
+index 56b058d60a0dc..9c26e586bb01d 100644
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -117,6 +117,11 @@ int uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit,
+ case 5: /* Invalid unit */
+ case 6: /* Invalid control */
+ case 7: /* Invalid Request */
++ /*
++ * The firmware has not properly implemented
++ * the control or there has been a HW error.
++ */
++ return -EIO;
+ case 8: /* Invalid value within range */
+ return -EINVAL;
+ default: /* reserved or unknown */
+diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
+index 38b945eb410f3..9c0e70b047c39 100644
+--- a/drivers/memory/fsl_ifc.c
++++ b/drivers/memory/fsl_ifc.c
+@@ -276,7 +276,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
+
+ ret = fsl_ifc_ctrl_init(fsl_ifc_ctrl_dev);
+ if (ret < 0)
+- goto err;
++ goto err_unmap_nandirq;
+
+ init_waitqueue_head(&fsl_ifc_ctrl_dev->nand_wait);
+
+@@ -285,7 +285,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
+ if (ret != 0) {
+ dev_err(&dev->dev, "failed to install irq (%d)\n",
+ fsl_ifc_ctrl_dev->irq);
+- goto err_irq;
++ goto err_unmap_nandirq;
+ }
+
+ if (fsl_ifc_ctrl_dev->nand_irq) {
+@@ -294,17 +294,16 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
+ if (ret != 0) {
+ dev_err(&dev->dev, "failed to install irq (%d)\n",
+ fsl_ifc_ctrl_dev->nand_irq);
+- goto err_nandirq;
++ goto err_free_irq;
+ }
+ }
+
+ return 0;
+
+-err_nandirq:
+- free_irq(fsl_ifc_ctrl_dev->nand_irq, fsl_ifc_ctrl_dev);
+- irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq);
+-err_irq:
++err_free_irq:
+ free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev);
++err_unmap_nandirq:
++ irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq);
+ irq_dispose_mapping(fsl_ifc_ctrl_dev->irq);
+ err:
+ iounmap(fsl_ifc_ctrl_dev->gregs);
+diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
+index 8a02f11076f9a..7aab26128f6d9 100644
+--- a/drivers/memstick/core/ms_block.c
++++ b/drivers/memstick/core/ms_block.c
+@@ -1731,7 +1731,7 @@ static int msb_init_card(struct memstick_dev *card)
+ msb->pages_in_block = boot_block->attr.block_size * 2;
+ msb->block_size = msb->page_size * msb->pages_in_block;
+
+- if (msb->page_size > PAGE_SIZE) {
++ if ((size_t)msb->page_size > PAGE_SIZE) {
+ /* this isn't supported by linux at all, anyway*/
+ dbg("device page %d size isn't supported", msb->page_size);
+ return -EINVAL;
+diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c
+index 29f5021d21ea6..0610d3c9f1318 100644
+--- a/drivers/memstick/host/jmb38x_ms.c
++++ b/drivers/memstick/host/jmb38x_ms.c
+@@ -907,7 +907,7 @@ static struct memstick_host *jmb38x_ms_alloc_host(struct jmb38x_ms *jm, int cnt)
+
+ iounmap(host->addr);
+ err_out_free:
+- kfree(msh);
++ memstick_free_host(msh);
+ return NULL;
+ }
+
+diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
+index 4559593ecd5a9..4728a42d54b88 100644
+--- a/drivers/memstick/host/r592.c
++++ b/drivers/memstick/host/r592.c
+@@ -840,15 +840,15 @@ static void r592_remove(struct pci_dev *pdev)
+ }
+ memstick_remove_host(dev->host);
+
++ if (dev->dummy_dma_page)
++ dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page,
++ dev->dummy_dma_page_physical_address);
++
+ free_irq(dev->irq, dev);
+ iounmap(dev->mmio);
+ pci_release_regions(pdev);
+ pci_disable_device(pdev);
+ memstick_free_host(dev->host);
+-
+- if (dev->dummy_dma_page)
+- dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page,
+- dev->dummy_dma_page_physical_address);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index b7f809aa40c2c..2c11944686cf9 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -421,7 +421,7 @@ config MMC_OMAP_HS
+
+ config MMC_WBSD
+ tristate "Winbond W83L51xD SD/MMC Card Interface support"
+- depends on ISA_DMA_API
++ depends on ISA_DMA_API && !M68K
+ help
+ This selects the Winbond(R) W83L51xD Secure digital and
+ Multimedia card Interface.
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index e3991df078efb..8570068c2be47 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -2039,7 +2039,8 @@ static void dw_mci_tasklet_func(unsigned long priv)
+ * delayed. Allowing the transfer to take place
+ * avoids races and keeps things simple.
+ */
+- if (err != -ETIMEDOUT) {
++ if (err != -ETIMEDOUT &&
++ host->dir_status == DW_MCI_RECV_STATUS) {
+ state = STATE_SENDING_DATA;
+ continue;
+ }
+diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
+index 7125687faf76a..d7601dc5e85dc 100644
+--- a/drivers/mmc/host/mxs-mmc.c
++++ b/drivers/mmc/host/mxs-mmc.c
+@@ -579,6 +579,11 @@ static const struct of_device_id mxs_mmc_dt_ids[] = {
+ };
+ MODULE_DEVICE_TABLE(of, mxs_mmc_dt_ids);
+
++static void mxs_mmc_regulator_disable(void *regulator)
++{
++ regulator_disable(regulator);
++}
++
+ static int mxs_mmc_probe(struct platform_device *pdev)
+ {
+ const struct of_device_id *of_id =
+@@ -622,6 +627,11 @@ static int mxs_mmc_probe(struct platform_device *pdev)
+ "Failed to enable vmmc regulator: %d\n", ret);
+ goto out_mmc_free;
+ }
++
++ ret = devm_add_action_or_reset(&pdev->dev, mxs_mmc_regulator_disable,
++ reg_vmmc);
++ if (ret)
++ goto out_mmc_free;
+ }
+
+ ssp->clk = devm_clk_get(&pdev->dev, NULL);
+diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
+index 05ade7a2dd243..f5bff9e710fb2 100644
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -690,7 +690,8 @@ static void sdhci_omap_set_power(struct sdhci_host *host, unsigned char mode,
+ {
+ struct mmc_host *mmc = host->mmc;
+
+- mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
++ if (!IS_ERR(mmc->supply.vmmc))
++ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+ }
+
+ static int sdhci_omap_enable_dma(struct sdhci_host *host)
+diff --git a/drivers/mtd/spi-nor/hisi-sfc.c b/drivers/mtd/spi-nor/hisi-sfc.c
+index 184ba5069ac51..36d2eb0918d9f 100644
+--- a/drivers/mtd/spi-nor/hisi-sfc.c
++++ b/drivers/mtd/spi-nor/hisi-sfc.c
+@@ -485,7 +485,6 @@ static int hisi_spi_nor_remove(struct platform_device *pdev)
+
+ hisi_spi_nor_unregister_all(host);
+ mutex_destroy(&host->lock);
+- clk_disable_unprepare(host->clk);
+ return 0;
+ }
+
+diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
+index 9ec0498d7d54e..1bc20de8e57be 100644
+--- a/drivers/net/bonding/bond_sysfs_slave.c
++++ b/drivers/net/bonding/bond_sysfs_slave.c
+@@ -112,15 +112,15 @@ static ssize_t ad_partner_oper_port_state_show(struct slave *slave, char *buf)
+ }
+ static SLAVE_ATTR_RO(ad_partner_oper_port_state);
+
+-static const struct slave_attribute *slave_attrs[] = {
+- &slave_attr_state,
+- &slave_attr_mii_status,
+- &slave_attr_link_failure_count,
+- &slave_attr_perm_hwaddr,
+- &slave_attr_queue_id,
+- &slave_attr_ad_aggregator_id,
+- &slave_attr_ad_actor_oper_port_state,
+- &slave_attr_ad_partner_oper_port_state,
++static const struct attribute *slave_attrs[] = {
++ &slave_attr_state.attr,
++ &slave_attr_mii_status.attr,
++ &slave_attr_link_failure_count.attr,
++ &slave_attr_perm_hwaddr.attr,
++ &slave_attr_queue_id.attr,
++ &slave_attr_ad_aggregator_id.attr,
++ &slave_attr_ad_actor_oper_port_state.attr,
++ &slave_attr_ad_partner_oper_port_state.attr,
+ NULL
+ };
+
+@@ -141,24 +141,10 @@ const struct sysfs_ops slave_sysfs_ops = {
+
+ int bond_sysfs_slave_add(struct slave *slave)
+ {
+- const struct slave_attribute **a;
+- int err;
+-
+- for (a = slave_attrs; *a; ++a) {
+- err = sysfs_create_file(&slave->kobj, &((*a)->attr));
+- if (err) {
+- kobject_put(&slave->kobj);
+- return err;
+- }
+- }
+-
+- return 0;
++ return sysfs_create_files(&slave->kobj, slave_attrs);
+ }
+
+ void bond_sysfs_slave_del(struct slave *slave)
+ {
+- const struct slave_attribute **a;
+-
+- for (a = slave_attrs; *a; ++a)
+- sysfs_remove_file(&slave->kobj, &((*a)->attr));
++ sysfs_remove_files(&slave->kobj, slave_attrs);
+ }
+diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c
+index 5aefd7a4696a5..87832e36c3d5a 100644
+--- a/drivers/net/dsa/rtl8366rb.c
++++ b/drivers/net/dsa/rtl8366rb.c
+@@ -1265,7 +1265,7 @@ static int rtl8366rb_set_mc_index(struct realtek_smi *smi, int port, int index)
+
+ static bool rtl8366rb_is_vlan_valid(struct realtek_smi *smi, unsigned int vlan)
+ {
+- unsigned int max = RTL8366RB_NUM_VLANS;
++ unsigned int max = RTL8366RB_NUM_VLANS - 1;
+
+ if (smi->vlan4k_enabled)
+ max = RTL8366RB_NUM_VIDS - 1;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+index b2cd3bdba9f89..533b8519ec352 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+@@ -1331,6 +1331,10 @@
+ #define MDIO_VEND2_PMA_CDR_CONTROL 0x8056
+ #endif
+
++#ifndef MDIO_VEND2_PMA_MISC_CTRL0
++#define MDIO_VEND2_PMA_MISC_CTRL0 0x8090
++#endif
++
+ #ifndef MDIO_CTRL1_SPEED1G
+ #define MDIO_CTRL1_SPEED1G (MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100)
+ #endif
+@@ -1389,6 +1393,10 @@
+ #define XGBE_PMA_RX_RST_0_RESET_ON 0x10
+ #define XGBE_PMA_RX_RST_0_RESET_OFF 0x00
+
++#define XGBE_PMA_PLL_CTRL_MASK BIT(15)
++#define XGBE_PMA_PLL_CTRL_ENABLE BIT(15)
++#define XGBE_PMA_PLL_CTRL_DISABLE 0x0000
++
+ /* Bit setting and getting macros
+ * The get macro will extract the current bit field value from within
+ * the variable
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index 54753c8a6a9d7..714aead72c579 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -1966,12 +1966,26 @@ static void xgbe_phy_rx_reset(struct xgbe_prv_data *pdata)
+ }
+ }
+
++static void xgbe_phy_pll_ctrl(struct xgbe_prv_data *pdata, bool enable)
++{
++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_MISC_CTRL0,
++ XGBE_PMA_PLL_CTRL_MASK,
++ enable ? XGBE_PMA_PLL_CTRL_ENABLE
++ : XGBE_PMA_PLL_CTRL_DISABLE);
++
++ /* Wait for command to complete */
++ usleep_range(100, 200);
++}
++
+ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+ unsigned int cmd, unsigned int sub_cmd)
+ {
+ unsigned int s0 = 0;
+ unsigned int wait;
+
++ /* Disable PLL re-initialization during FW command processing */
++ xgbe_phy_pll_ctrl(pdata, false);
++
+ /* Log if a previous command did not complete */
+ if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) {
+ netif_dbg(pdata, link, pdata->netdev,
+@@ -1992,7 +2006,7 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+ wait = XGBE_RATECHANGE_COUNT;
+ while (wait--) {
+ if (!XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS))
+- return;
++ goto reenable_pll;
+
+ usleep_range(1000, 2000);
+ }
+@@ -2002,6 +2016,10 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+
+ /* Reset on error */
+ xgbe_phy_rx_reset(pdata);
++
++reenable_pll:
++ /* Enable PLL re-initialization */
++ xgbe_phy_pll_ctrl(pdata, true);
+ }
+
+ static void xgbe_phy_rrc(struct xgbe_prv_data *pdata)
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h
+index 1835d2e451c01..fc7fce642666c 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h
+@@ -635,11 +635,13 @@ static int bnx2x_ilt_client_mem_op(struct bnx2x *bp, int cli_num,
+ {
+ int i, rc;
+ struct bnx2x_ilt *ilt = BP_ILT(bp);
+- struct ilt_client_info *ilt_cli = &ilt->clients[cli_num];
++ struct ilt_client_info *ilt_cli;
+
+ if (!ilt || !ilt->lines)
+ return -1;
+
++ ilt_cli = &ilt->clients[cli_num];
++
+ if (ilt_cli->flags & (ILT_CLIENT_SKIP_INIT | ILT_CLIENT_SKIP_MEM))
+ return 0;
+
+diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
+index 90497a27df184..7c0a67f1f43f7 100644
+--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
+@@ -1175,7 +1175,7 @@ static int nic_register_interrupts(struct nicpf *nic)
+ dev_err(&nic->pdev->dev,
+ "Request for #%d msix vectors failed, returned %d\n",
+ nic->num_vec, ret);
+- return 1;
++ return ret;
+ }
+
+ /* Register mailbox interrupt handler */
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+index 99eea9e6a8ea6..0fbb0dee2dcfd 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -1223,7 +1223,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
+ if (ret < 0) {
+ netdev_err(nic->netdev,
+ "Req for #%d msix vectors failed\n", nic->num_vec);
+- return 1;
++ return ret;
+ }
+
+ sprintf(nic->irq_name[irq], "%s Mbox", "NICVF");
+@@ -1242,7 +1242,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
+ if (!nicvf_check_pf_ready(nic)) {
+ nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0);
+ nicvf_unregister_interrupts(nic);
+- return 1;
++ return -EIO;
+ }
+
+ return 0;
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
+index d07230c892a54..db0248ab7fe4a 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
+@@ -1304,12 +1304,15 @@ static int cxgb4_get_module_info(struct net_device *dev,
+ if (ret)
+ return ret;
+
+- if (!sff8472_comp || (sff_diag_type & 4)) {
++ if (!sff8472_comp || (sff_diag_type & SFP_DIAG_ADDRMODE)) {
+ modinfo->type = ETH_MODULE_SFF_8079;
+ modinfo->eeprom_len = ETH_MODULE_SFF_8079_LEN;
+ } else {
+ modinfo->type = ETH_MODULE_SFF_8472;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
++ if (sff_diag_type & SFP_DIAG_IMPLEMENTED)
++ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
++ else
++ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN / 2;
+ }
+ break;
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h
+index 361d5032c2884..91603639ac428 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h
+@@ -292,6 +292,8 @@ enum {
+ #define I2C_PAGE_SIZE 0x100
+ #define SFP_DIAG_TYPE_ADDR 0x5c
+ #define SFP_DIAG_TYPE_LEN 0x1
++#define SFP_DIAG_ADDRMODE BIT(2)
++#define SFP_DIAG_IMPLEMENTED BIT(6)
+ #define SFF_8472_COMP_ADDR 0x5e
+ #define SFF_8472_COMP_LEN 0x1
+ #define SFF_REV_ADDR 0x1
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index d97641b9928bb..c52c26fc44e59 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -4603,6 +4603,9 @@ static int init_crq_queue(struct ibmvnic_adapter *adapter)
+ crq->cur = 0;
+ spin_lock_init(&crq->lock);
+
++ /* process any CRQs that were queued before we enabled interrupts */
++ tasklet_schedule(&adapter->tasklet);
++
+ return retrc;
+
+ req_irq_failed:
+diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
+index 3c921dfc20564..519b595944235 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -166,6 +166,7 @@ enum i40e_vsi_state_t {
+ __I40E_VSI_OVERFLOW_PROMISC,
+ __I40E_VSI_REINIT_REQUESTED,
+ __I40E_VSI_DOWN_REQUESTED,
++ __I40E_VSI_RELEASING,
+ /* This must be last as it determines the size of the BITMAP */
+ __I40E_VSI_STATE_SIZE__,
+ };
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 062b942517822..51edc7fdc9b9e 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -1765,6 +1765,7 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi,
+ bool is_add)
+ {
+ struct i40e_pf *pf = vsi->back;
++ u16 num_tc_qps = 0;
+ u16 sections = 0;
+ u8 netdev_tc = 0;
+ u16 numtc = 1;
+@@ -1772,13 +1773,29 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi,
+ u8 offset;
+ u16 qmap;
+ int i;
+- u16 num_tc_qps = 0;
+
+ sections = I40E_AQ_VSI_PROP_QUEUE_MAP_VALID;
+ offset = 0;
+
++ if (vsi->type == I40E_VSI_MAIN) {
++ /* This code helps add more queue to the VSI if we have
++ * more cores than RSS can support, the higher cores will
++ * be served by ATR or other filters. Furthermore, the
++ * non-zero req_queue_pairs says that user requested a new
++ * queue count via ethtool's set_channels, so use this
++ * value for queues distribution across traffic classes
++ */
++ if (vsi->req_queue_pairs > 0)
++ vsi->num_queue_pairs = vsi->req_queue_pairs;
++ else if (pf->flags & I40E_FLAG_MSIX_ENABLED)
++ vsi->num_queue_pairs = pf->num_lan_msix;
++ }
++
+ /* Number of queues per enabled TC */
+- num_tc_qps = vsi->alloc_queue_pairs;
++ if (vsi->type == I40E_VSI_MAIN)
++ num_tc_qps = vsi->num_queue_pairs;
++ else
++ num_tc_qps = vsi->alloc_queue_pairs;
+ if (enabled_tc && (vsi->back->flags & I40E_FLAG_DCB_ENABLED)) {
+ /* Find numtc from enabled TC bitmap */
+ for (i = 0, numtc = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) {
+@@ -1856,16 +1873,10 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi,
+ }
+ ctxt->info.tc_mapping[i] = cpu_to_le16(qmap);
+ }
+-
+- /* Set actual Tx/Rx queue pairs */
+- vsi->num_queue_pairs = offset;
+- if ((vsi->type == I40E_VSI_MAIN) && (numtc == 1)) {
+- if (vsi->req_queue_pairs > 0)
+- vsi->num_queue_pairs = vsi->req_queue_pairs;
+- else if (pf->flags & I40E_FLAG_MSIX_ENABLED)
+- vsi->num_queue_pairs = pf->num_lan_msix;
+- }
+-
++ /* Do not change previously set num_queue_pairs for PFs */
++ if ((vsi->type == I40E_VSI_MAIN && numtc != 1) ||
++ vsi->type != I40E_VSI_MAIN)
++ vsi->num_queue_pairs = offset;
+ /* Scheduler section valid can only be set for ADD VSI */
+ if (is_add) {
+ sections |= I40E_AQ_VSI_PROP_SCHED_VALID;
+@@ -2584,7 +2595,8 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
+
+ for (v = 0; v < pf->num_alloc_vsi; v++) {
+ if (pf->vsi[v] &&
+- (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED)) {
++ (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED) &&
++ !test_bit(__I40E_VSI_RELEASING, pf->vsi[v]->state)) {
+ int ret = i40e_sync_vsi_filters(pf->vsi[v]);
+
+ if (ret) {
+@@ -7505,9 +7517,8 @@ static int i40e_configure_clsflower(struct i40e_vsi *vsi,
+ err = i40e_add_del_cloud_filter(vsi, filter, true);
+
+ if (err) {
+- dev_err(&pf->pdev->dev,
+- "Failed to add cloud filter, err %s\n",
+- i40e_stat_str(&pf->hw, err));
++ dev_err(&pf->pdev->dev, "Failed to add cloud filter, err %d\n",
++ err);
+ goto err;
+ }
+
+@@ -12444,7 +12455,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi)
+ dev_info(&pf->pdev->dev, "Can't remove PF VSI\n");
+ return -ENODEV;
+ }
+-
++ set_bit(__I40E_VSI_RELEASING, vsi->state);
+ uplink_seid = vsi->uplink_seid;
+ if (vsi->type != I40E_VSI_SRIOV) {
+ if (vsi->netdev_registered) {
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 3c1533c627fd0..02d245970d7fa 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -621,14 +621,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id,
+ u16 vsi_queue_id,
+ struct virtchnl_rxq_info *info)
+ {
++ u16 pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id);
+ struct i40e_pf *pf = vf->pf;
++ struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx];
+ struct i40e_hw *hw = &pf->hw;
+ struct i40e_hmc_obj_rxq rx_ctx;
+- u16 pf_queue_id;
+ int ret = 0;
+
+- pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id);
+-
+ /* clear the context structure first */
+ memset(&rx_ctx, 0, sizeof(struct i40e_hmc_obj_rxq));
+
+@@ -666,6 +665,10 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id,
+ }
+ rx_ctx.rxmax = info->max_pkt_size;
+
++ /* if port VLAN is configured increase the max packet size */
++ if (vsi->info.pvid)
++ rx_ctx.rxmax += VLAN_HLEN;
++
+ /* enable 32bytes desc always */
+ rx_ctx.dsize = 1;
+
+@@ -3927,34 +3930,6 @@ error_param:
+ return ret;
+ }
+
+-/**
+- * i40e_vsi_has_vlans - True if VSI has configured VLANs
+- * @vsi: pointer to the vsi
+- *
+- * Check if a VSI has configured any VLANs. False if we have a port VLAN or if
+- * we have no configured VLANs. Do not call while holding the
+- * mac_filter_hash_lock.
+- */
+-static bool i40e_vsi_has_vlans(struct i40e_vsi *vsi)
+-{
+- bool have_vlans;
+-
+- /* If we have a port VLAN, then the VSI cannot have any VLANs
+- * configured, as all MAC/VLAN filters will be assigned to the PVID.
+- */
+- if (vsi->info.pvid)
+- return false;
+-
+- /* Since we don't have a PVID, we know that if the device is in VLAN
+- * mode it must be because of a VLAN filter configured on this VSI.
+- */
+- spin_lock_bh(&vsi->mac_filter_hash_lock);
+- have_vlans = i40e_is_vsi_in_vlan(vsi);
+- spin_unlock_bh(&vsi->mac_filter_hash_lock);
+-
+- return have_vlans;
+-}
+-
+ /**
+ * i40e_ndo_set_vf_port_vlan
+ * @netdev: network interface device structure
+@@ -4007,19 +3982,9 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id,
+ /* duplicate request, so just return success */
+ goto error_pvid;
+
+- if (i40e_vsi_has_vlans(vsi)) {
+- dev_err(&pf->pdev->dev,
+- "VF %d has already configured VLAN filters and the administrator is requesting a port VLAN override.\nPlease unload and reload the VF driver for this change to take effect.\n",
+- vf_id);
+- /* Administrator Error - knock the VF offline until he does
+- * the right thing by reconfiguring his network correctly
+- * and then reloading the VF driver.
+- */
+- i40e_vc_disable_vf(vf);
+- /* During reset the VF got a new VSI, so refresh the pointer. */
+- vsi = pf->vsi[vf->lan_vsi_idx];
+- }
+-
++ i40e_vc_disable_vf(vf);
++ /* During reset the VF got a new VSI, so refresh a pointer. */
++ vsi = pf->vsi[vf->lan_vsi_idx];
+ /* Locked once because multiple functions below iterate list */
+ spin_lock_bh(&vsi->mac_filter_hash_lock);
+
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+index ac5709624c7ad..5a6e579e9e653 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+@@ -2058,7 +2058,7 @@ static void i40evf_adminq_task(struct work_struct *work)
+
+ /* check for error indications */
+ val = rd32(hw, hw->aq.arq.len);
+- if (val == 0xdeadbeef) /* indicates device in reset */
++ if (val == 0xdeadbeef || val == 0xffffffff) /* device in reset */
+ goto freedom;
+ oldval = val;
+ if (val & I40E_VF_ARQLEN1_ARQVFE_MASK) {
+@@ -3185,7 +3185,8 @@ static netdev_features_t i40evf_fix_features(struct net_device *netdev,
+ {
+ struct i40evf_adapter *adapter = netdev_priv(netdev);
+
+- if (!(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN))
++ if (adapter->vf_res &&
++ !(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN))
+ features &= ~(NETIF_F_HW_VLAN_CTAG_TX |
+ NETIF_F_HW_VLAN_CTAG_RX |
+ NETIF_F_HW_VLAN_CTAG_FILTER);
+diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
+index d47151dbe804d..c0a810f740341 100644
+--- a/drivers/net/ethernet/sfc/ptp.c
++++ b/drivers/net/ethernet/sfc/ptp.c
+@@ -651,7 +651,7 @@ static int efx_ptp_get_attributes(struct efx_nic *efx)
+ } else if (rc == -EINVAL) {
+ fmt = MC_CMD_PTP_OUT_GET_ATTRIBUTES_SECONDS_NANOSECONDS;
+ } else if (rc == -EPERM) {
+- netif_info(efx, probe, efx->net_dev, "no PTP support\n");
++ pci_info(efx->pci_dev, "no PTP support\n");
+ return rc;
+ } else {
+ efx_mcdi_display_error(efx, MC_CMD_PTP, sizeof(inbuf),
+@@ -827,7 +827,7 @@ static int efx_ptp_disable(struct efx_nic *efx)
+ * should only have been called during probe.
+ */
+ if (rc == -ENOSYS || rc == -EPERM)
+- netif_info(efx, probe, efx->net_dev, "no PTP support\n");
++ pci_info(efx->pci_dev, "no PTP support\n");
+ else if (rc)
+ efx_mcdi_display_error(efx, MC_CMD_PTP,
+ MC_CMD_PTP_IN_DISABLE_LEN,
+diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c
+index da7b94f346049..30d58f72725df 100644
+--- a/drivers/net/ethernet/sfc/siena_sriov.c
++++ b/drivers/net/ethernet/sfc/siena_sriov.c
+@@ -1059,7 +1059,7 @@ void efx_siena_sriov_probe(struct efx_nic *efx)
+ return;
+
+ if (efx_siena_sriov_cmd(efx, false, &efx->vi_scale, &count)) {
+- netif_info(efx, probe, efx->net_dev, "no SR-IOV VFs probed\n");
++ pci_info(efx->pci_dev, "no SR-IOV VFs probed\n");
+ return;
+ }
+ if (count > 0 && count > max_vfs)
+diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
+index 56130cf293f37..566da1e3cfbcc 100644
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -426,8 +426,20 @@ static int emac_set_coalesce(struct net_device *ndev,
+ u32 int_ctrl, num_interrupts = 0;
+ u32 prescale = 0, addnl_dvdr = 1, coal_intvl = 0;
+
+- if (!coal->rx_coalesce_usecs)
+- return -EINVAL;
++ if (!coal->rx_coalesce_usecs) {
++ priv->coal_intvl = 0;
++
++ switch (priv->version) {
++ case EMAC_VERSION_2:
++ emac_ctrl_write(EMAC_DM646X_CMINTCTRL, 0);
++ break;
++ default:
++ emac_ctrl_write(EMAC_CTRL_EWINTTCNT, 0);
++ break;
++ }
++
++ return 0;
++ }
+
+ coal_intvl = coal->rx_coalesce_usecs;
+
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 55caaaf969da5..0135903300595 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -880,8 +880,9 @@ static struct phy_driver ksphy_driver[] = {
+ .get_sset_count = kszphy_get_sset_count,
+ .get_strings = kszphy_get_strings,
+ .get_stats = kszphy_get_stats,
+- .suspend = genphy_suspend,
+- .resume = genphy_resume,
++ /* No suspend/resume callbacks because of errata DS80000700A,
++ * receiver error following software power down.
++ */
+ }, {
+ .phy_id = PHY_ID_KSZ8041RNLI,
+ .phy_id_mask = MICREL_PHY_ID_MASK,
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 723611ac91027..e808efd762122 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -1259,7 +1259,7 @@ int phylink_ethtool_set_pauseparam(struct phylink *pl,
+ return -EOPNOTSUPP;
+
+ if (!phylink_test(pl->supported, Asym_Pause) &&
+- !pause->autoneg && pause->rx_pause != pause->tx_pause)
++ pause->rx_pause != pause->tx_pause)
+ return -EINVAL;
+
+ config->pause &= ~(MLO_PAUSE_AN | MLO_PAUSE_TXRX_MASK);
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 8ee2c519c9bf0..d5bb972cbc9a6 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1085,6 +1085,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct tun_struct *tun = netdev_priv(dev);
+ int txq = skb->queue_mapping;
++ struct netdev_queue *queue;
+ struct tun_file *tfile;
+ int len = skb->len;
+
+@@ -1131,6 +1132,10 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (ptr_ring_produce(&tfile->tx_ring, skb))
+ goto drop;
+
++ /* NETIF_F_LLTX requires to do our own update of trans_start */
++ queue = netdev_get_tx_queue(dev, txq);
++ queue->trans_start = jiffies;
++
+ /* Notify and wake up reader process */
+ if (tfile->flags & TUN_FASYNC)
+ kill_fasync(&tfile->fasync, SIGIO, POLL_IN);
+diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
+index e454dfc9ad8f2..c004819bebe35 100644
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -3634,7 +3634,6 @@ vmxnet3_suspend(struct device *device)
+ vmxnet3_free_intr_resources(adapter);
+
+ netif_device_detach(netdev);
+- netif_tx_stop_all_queues(netdev);
+
+ /* Create wake-up filters. */
+ pmConf = adapter->pm_conf;
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 8102d684be594..6e4096fd66334 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -1003,7 +1003,7 @@ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
+ arg.channel.min_power = 0;
+ arg.channel.max_power = channel->max_power * 2;
+ arg.channel.max_reg_power = channel->max_reg_power * 2;
+- arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
++ arg.channel.max_antenna_gain = channel->max_antenna_gain;
+
+ reinit_completion(&ar->vdev_setup_done);
+
+@@ -1445,7 +1445,7 @@ static int ath10k_vdev_start_restart(struct ath10k_vif *arvif,
+ arg.channel.min_power = 0;
+ arg.channel.max_power = chandef->chan->max_power * 2;
+ arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
+- arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2;
++ arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain;
+
+ if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
+ arg.ssid = arvif->u.ap.ssid;
+@@ -3104,7 +3104,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
+ ch->min_power = 0;
+ ch->max_power = channel->max_power * 2;
+ ch->max_reg_power = channel->max_reg_power * 2;
+- ch->max_antenna_gain = channel->max_antenna_gain * 2;
++ ch->max_antenna_gain = channel->max_antenna_gain;
+ ch->reg_class_id = 0; /* FIXME */
+
+ /* FIXME: why use only legacy modes, why not any
+diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
+index 16d5fe6d1e2e4..0a76991d0c6cd 100644
+--- a/drivers/net/wireless/ath/ath10k/usb.c
++++ b/drivers/net/wireless/ath/ath10k/usb.c
+@@ -536,7 +536,7 @@ static int ath10k_usb_submit_ctrl_in(struct ath10k *ar,
+ req,
+ USB_DIR_IN | USB_TYPE_VENDOR |
+ USB_RECIP_DEVICE, value, index, buf,
+- size, 2 * HZ);
++ size, 2000);
+
+ if (ret < 0) {
+ ath10k_warn(ar, "Failed to read usb control message: %d\n",
+@@ -875,6 +875,11 @@ static int ath10k_usb_setup_pipe_resources(struct ath10k *ar,
+ le16_to_cpu(endpoint->wMaxPacketSize),
+ endpoint->bInterval);
+ }
++
++ /* Ignore broken descriptors. */
++ if (usb_endpoint_maxp(endpoint) == 0)
++ continue;
++
+ urbcount = 0;
+
+ pipe_num =
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
+index 6bd63d1cd0395..1292f3235e32c 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -1988,7 +1988,9 @@ struct wmi_channel {
+ union {
+ __le32 reginfo1;
+ struct {
++ /* note: power unit is 1 dBm */
+ u8 antenna_max;
++ /* note: power unit is 0.5 dBm */
+ u8 max_tx_power;
+ } __packed;
+ } __packed;
+@@ -2008,6 +2010,7 @@ struct wmi_channel_arg {
+ u32 min_power;
+ u32 max_power;
+ u32 max_reg_power;
++ /* note: power unit is 1 dBm */
+ u32 max_antenna_gain;
+ u32 reg_class_id;
+ enum wmi_phy_mode mode;
+diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
+index 53b66e9434c99..8b24964304b1f 100644
+--- a/drivers/net/wireless/ath/ath6kl/usb.c
++++ b/drivers/net/wireless/ath/ath6kl/usb.c
+@@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resources(struct ath6kl_usb *ar_usb)
+ le16_to_cpu(endpoint->wMaxPacketSize),
+ endpoint->bInterval);
+ }
++
++ /* Ignore broken descriptors. */
++ if (usb_endpoint_maxp(endpoint) == 0)
++ continue;
++
+ urbcount = 0;
+
+ pipe_num =
+@@ -907,7 +912,7 @@ static int ath6kl_usb_submit_ctrl_in(struct ath6kl_usb *ar_usb,
+ req,
+ USB_DIR_IN | USB_TYPE_VENDOR |
+ USB_RECIP_DEVICE, value, index, buf,
+- size, 2 * HZ);
++ size, 2000);
+
+ if (ret < 0) {
+ ath6kl_warn("Failed to read usb control message: %d\n", ret);
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index a0097bebcba3b..ee1b9c39bad7a 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -530,8 +530,10 @@ irqreturn_t ath_isr(int irq, void *dev)
+ ath9k_debug_sync_cause(sc, sync_cause);
+ status &= ah->imask; /* discard unasked-for bits */
+
+- if (test_bit(ATH_OP_HW_RESET, &common->op_flags))
++ if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) {
++ ath9k_hw_kill_interrupts(sc->sc_ah);
+ return IRQ_HANDLED;
++ }
+
+ /*
+ * If there are no status bits set, then this interrupt was not
+diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
+index a274eb0d19688..a0ad6e48a35b4 100644
+--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
++++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
+@@ -182,10 +182,12 @@ static void channel_detector_exit(struct dfs_pattern_detector *dpd,
+ if (cd == NULL)
+ return;
+ list_del(&cd->head);
+- for (i = 0; i < dpd->num_radar_types; i++) {
+- struct pri_detector *de = cd->detectors[i];
+- if (de != NULL)
+- de->exit(de);
++ if (cd->detectors) {
++ for (i = 0; i < dpd->num_radar_types; i++) {
++ struct pri_detector *de = cd->detectors[i];
++ if (de != NULL)
++ de->exit(de);
++ }
+ }
+ kfree(cd->detectors);
+ kfree(cd);
+diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
+index 06cfe8d311f39..657525988d1ee 100644
+--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
++++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
+@@ -565,6 +565,10 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
+ dxe = ctl->desc;
+
+ while (!(READ_ONCE(dxe->ctrl) & WCN36xx_DXE_CTRL_VLD)) {
++ /* do not read until we own DMA descriptor */
++ dma_rmb();
++
++ /* read/modify DMA descriptor */
+ skb = ctl->skb;
+ dma_addr = dxe->dst_addr_l;
+ ret = wcn36xx_dxe_fill_skb(wcn->dev, ctl, GFP_ATOMIC);
+@@ -575,9 +579,15 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
+ dma_unmap_single(wcn->dev, dma_addr, WCN36XX_PKT_SIZE,
+ DMA_FROM_DEVICE);
+ wcn36xx_rx_skb(wcn, skb);
+- } /* else keep old skb not submitted and use it for rx DMA */
++ }
++ /* else keep old skb not submitted and reuse it for rx DMA
++ * (dropping the packet that it contained)
++ */
+
++ /* flush descriptor changes before re-marking as valid */
++ dma_wmb();
+ dxe->ctrl = ctrl;
++
+ ctl = ctl->next;
+ dxe = ctl->desc;
+ }
+diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
+index 556ba3c6c5d8e..eb5d08bf25032 100644
+--- a/drivers/net/wireless/ath/wcn36xx/main.c
++++ b/drivers/net/wireless/ath/wcn36xx/main.c
+@@ -134,7 +134,9 @@ static struct ieee80211_supported_band wcn_band_2ghz = {
+ .cap = IEEE80211_HT_CAP_GRN_FLD |
+ IEEE80211_HT_CAP_SGI_20 |
+ IEEE80211_HT_CAP_DSSSCCK40 |
+- IEEE80211_HT_CAP_LSIG_TXOP_PROT,
++ IEEE80211_HT_CAP_LSIG_TXOP_PROT |
++ IEEE80211_HT_CAP_SGI_40 |
++ IEEE80211_HT_CAP_SUP_WIDTH_20_40,
+ .ht_supported = true,
+ .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
+ .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
+index 6cd113b3b3e49..e75c1cfd85e63 100644
+--- a/drivers/net/wireless/ath/wcn36xx/smd.c
++++ b/drivers/net/wireless/ath/wcn36xx/smd.c
+@@ -2340,30 +2340,52 @@ static int wcn36xx_smd_delete_sta_context_ind(struct wcn36xx *wcn,
+ size_t len)
+ {
+ struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf;
+- struct wcn36xx_vif *tmp;
++ struct wcn36xx_vif *vif_priv;
++ struct ieee80211_vif *vif;
++ struct ieee80211_bss_conf *bss_conf;
+ struct ieee80211_sta *sta;
++ bool found = false;
+
+ if (len != sizeof(*rsp)) {
+ wcn36xx_warn("Corrupted delete sta indication\n");
+ return -EIO;
+ }
+
+- wcn36xx_dbg(WCN36XX_DBG_HAL, "delete station indication %pM index %d\n",
+- rsp->addr2, rsp->sta_id);
++ wcn36xx_dbg(WCN36XX_DBG_HAL,
++ "delete station indication %pM index %d reason %d\n",
++ rsp->addr2, rsp->sta_id, rsp->reason_code);
+
+- list_for_each_entry(tmp, &wcn->vif_list, list) {
++ list_for_each_entry(vif_priv, &wcn->vif_list, list) {
+ rcu_read_lock();
+- sta = ieee80211_find_sta(wcn36xx_priv_to_vif(tmp), rsp->addr2);
+- if (sta)
+- ieee80211_report_low_ack(sta, 0);
++ vif = wcn36xx_priv_to_vif(vif_priv);
++
++ if (vif->type == NL80211_IFTYPE_STATION) {
++ /* We could call ieee80211_find_sta too, but checking
++ * bss_conf is clearer.
++ */
++ bss_conf = &vif->bss_conf;
++ if (vif_priv->sta_assoc &&
++ !memcmp(bss_conf->bssid, rsp->addr2, ETH_ALEN)) {
++ found = true;
++ wcn36xx_dbg(WCN36XX_DBG_HAL,
++ "connection loss bss_index %d\n",
++ vif_priv->bss_index);
++ ieee80211_connection_loss(vif);
++ }
++ } else {
++ sta = ieee80211_find_sta(vif, rsp->addr2);
++ if (sta) {
++ found = true;
++ ieee80211_report_low_ack(sta, 0);
++ }
++ }
++
+ rcu_read_unlock();
+- if (sta)
++ if (found)
+ return 0;
+ }
+
+- wcn36xx_warn("STA with addr %pM and index %d not found\n",
+- rsp->addr2,
+- rsp->sta_id);
++ wcn36xx_warn("BSS or STA with addr %pM not found\n", rsp->addr2);
+ return -ENOENT;
+ }
+
+diff --git a/drivers/net/wireless/broadcom/b43/phy_g.c b/drivers/net/wireless/broadcom/b43/phy_g.c
+index f59c021664626..40e10d0b7cd73 100644
+--- a/drivers/net/wireless/broadcom/b43/phy_g.c
++++ b/drivers/net/wireless/broadcom/b43/phy_g.c
+@@ -2310,7 +2310,7 @@ static u8 b43_gphy_aci_scan(struct b43_wldev *dev)
+ b43_phy_mask(dev, B43_PHY_G_CRS, 0x7FFF);
+ b43_set_all_gains(dev, 3, 8, 1);
+
+- start = (channel - 5 > 0) ? channel - 5 : 1;
++ start = (channel > 5) ? channel - 5 : 1;
+ end = (channel + 5 < 14) ? channel + 5 : 13;
+
+ for (i = start; i <= end; i++) {
+diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c
+index eab1c93878468..8f845db23766b 100644
+--- a/drivers/net/wireless/broadcom/b43legacy/radio.c
++++ b/drivers/net/wireless/broadcom/b43legacy/radio.c
+@@ -299,7 +299,7 @@ u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev)
+ & 0x7FFF);
+ b43legacy_set_all_gains(dev, 3, 8, 1);
+
+- start = (channel - 5 > 0) ? channel - 5 : 1;
++ start = (channel > 5) ? channel - 5 : 1;
+ end = (channel + 5 < 14) ? channel + 5 : 13;
+
+ for (i = start; i <= end; i++) {
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+index 00712205c05f2..bc3f67e0bf334 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+@@ -1018,6 +1018,9 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
+
+ lockdep_assert_held(&mvm->mutex);
+
++ if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
++ return false;
++
+ if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1)
+ return false;
+
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index 9e82ec12564bb..f29a154d995c8 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -288,6 +288,7 @@ err_add_card:
+ if_usb_reset_device(cardp);
+ dealloc:
+ if_usb_free(cardp);
++ kfree(cardp);
+
+ error:
+ return r;
+@@ -312,6 +313,7 @@ static void if_usb_disconnect(struct usb_interface *intf)
+
+ /* Unlink and free urb */
+ if_usb_free(cardp);
++ kfree(cardp);
+
+ usb_set_intfdata(intf, NULL);
+ usb_put_dev(interface_to_usbdev(intf));
+diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+index 6ede6168bd85a..60941c319b421 100644
+--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+@@ -234,6 +234,7 @@ static int if_usb_probe(struct usb_interface *intf,
+
+ dealloc:
+ if_usb_free(cardp);
++ kfree(cardp);
+ error:
+ lbtf_deb_leave(LBTF_DEB_MAIN);
+ return -ENOMEM;
+@@ -258,6 +259,7 @@ static void if_usb_disconnect(struct usb_interface *intf)
+
+ /* Unlink and free urb */
+ if_usb_free(cardp);
++ kfree(cardp);
+
+ usb_set_intfdata(intf, NULL);
+ usb_put_dev(interface_to_usbdev(intf));
+diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c
+index 5d75c971004b4..5dcc305cc8127 100644
+--- a/drivers/net/wireless/marvell/mwifiex/11n.c
++++ b/drivers/net/wireless/marvell/mwifiex/11n.c
+@@ -664,14 +664,15 @@ int mwifiex_send_delba(struct mwifiex_private *priv, int tid, u8 *peer_mac,
+ uint16_t del_ba_param_set;
+
+ memset(&delba, 0, sizeof(delba));
+- delba.del_ba_param_set = cpu_to_le16(tid << DELBA_TID_POS);
+
+- del_ba_param_set = le16_to_cpu(delba.del_ba_param_set);
++ del_ba_param_set = tid << DELBA_TID_POS;
++
+ if (initiator)
+ del_ba_param_set |= IEEE80211_DELBA_PARAM_INITIATOR_MASK;
+ else
+ del_ba_param_set &= ~IEEE80211_DELBA_PARAM_INITIATOR_MASK;
+
++ delba.del_ba_param_set = cpu_to_le16(del_ba_param_set);
+ memcpy(&delba.peer_mac_addr, peer_mac, ETH_ALEN);
+
+ /* We don't wait for the response of this command */
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 650191db25cbe..892247145f428 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -912,16 +912,20 @@ mwifiex_init_new_priv_params(struct mwifiex_private *priv,
+ switch (type) {
+ case NL80211_IFTYPE_STATION:
+ case NL80211_IFTYPE_ADHOC:
+- priv->bss_role = MWIFIEX_BSS_ROLE_STA;
++ priv->bss_role = MWIFIEX_BSS_ROLE_STA;
++ priv->bss_type = MWIFIEX_BSS_TYPE_STA;
+ break;
+ case NL80211_IFTYPE_P2P_CLIENT:
+- priv->bss_role = MWIFIEX_BSS_ROLE_STA;
++ priv->bss_role = MWIFIEX_BSS_ROLE_STA;
++ priv->bss_type = MWIFIEX_BSS_TYPE_P2P;
+ break;
+ case NL80211_IFTYPE_P2P_GO:
+- priv->bss_role = MWIFIEX_BSS_ROLE_UAP;
++ priv->bss_role = MWIFIEX_BSS_ROLE_UAP;
++ priv->bss_type = MWIFIEX_BSS_TYPE_P2P;
+ break;
+ case NL80211_IFTYPE_AP:
+ priv->bss_role = MWIFIEX_BSS_ROLE_UAP;
++ priv->bss_type = MWIFIEX_BSS_TYPE_UAP;
+ break;
+ default:
+ mwifiex_dbg(adapter, ERROR,
+@@ -1233,29 +1237,15 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
+ break;
+ case NL80211_IFTYPE_P2P_CLIENT:
+ case NL80211_IFTYPE_P2P_GO:
++ if (mwifiex_cfg80211_deinit_p2p(priv))
++ return -EFAULT;
++
+ switch (type) {
+- case NL80211_IFTYPE_STATION:
+- if (mwifiex_cfg80211_deinit_p2p(priv))
+- return -EFAULT;
+- priv->adapter->curr_iface_comb.p2p_intf--;
+- priv->adapter->curr_iface_comb.sta_intf++;
+- dev->ieee80211_ptr->iftype = type;
+- if (mwifiex_deinit_priv_params(priv))
+- return -1;
+- if (mwifiex_init_new_priv_params(priv, dev, type))
+- return -1;
+- if (mwifiex_sta_init_cmd(priv, false, false))
+- return -1;
+- break;
+ case NL80211_IFTYPE_ADHOC:
+- if (mwifiex_cfg80211_deinit_p2p(priv))
+- return -EFAULT;
++ case NL80211_IFTYPE_STATION:
+ return mwifiex_change_vif_to_sta_adhoc(dev, curr_iftype,
+ type, params);
+- break;
+ case NL80211_IFTYPE_AP:
+- if (mwifiex_cfg80211_deinit_p2p(priv))
+- return -EFAULT;
+ return mwifiex_change_vif_to_ap(dev, curr_iftype, type,
+ params);
+ case NL80211_IFTYPE_UNSPECIFIED:
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
+index 2f0141c964e25..aea79fd54c311 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -1330,6 +1330,14 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
+ ret = -1;
+ goto done_unmap;
+ }
++
++ /* The firmware (latest version 15.68.19.p21) of the 88W8897 PCIe+USB card
++ * seems to crash randomly after setting the TX ring write pointer when
++ * ASPM powersaving is enabled. A workaround seems to be keeping the bus
++ * busy by reading a random register afterwards.
++ */
++ mwifiex_read_reg(adapter, PCI_VENDOR_ID, &rx_val);
++
+ if ((mwifiex_pcie_txbd_not_full(card)) &&
+ tx_param->next_pkt_len) {
+ /* have more packets and TxBD still can hold more */
+diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
+index 2a8d40ce463d5..e6234b53a5ca2 100644
+--- a/drivers/net/wireless/marvell/mwifiex/usb.c
++++ b/drivers/net/wireless/marvell/mwifiex/usb.c
+@@ -505,6 +505,22 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
+ }
+ }
+
++ switch (card->usb_boot_state) {
++ case USB8XXX_FW_DNLD:
++ /* Reject broken descriptors. */
++ if (!card->rx_cmd_ep || !card->tx_cmd_ep)
++ return -ENODEV;
++ if (card->bulk_out_maxpktsize == 0)
++ return -ENODEV;
++ break;
++ case USB8XXX_FW_READY:
++ /* Assume the driver can handle missing endpoints for now. */
++ break;
++ default:
++ WARN_ON(1);
++ return -ENODEV;
++ }
++
+ usb_set_intfdata(intf, card);
+
+ ret = mwifiex_add_card(card, &card->fw_done, &usb_ops,
+diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
+index 6769b0c5a5cde..ee842797570b7 100644
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -5793,8 +5793,8 @@ static void mwl8k_fw_state_machine(const struct firmware *fw, void *context)
+ fail:
+ priv->fw_state = FW_STATE_ERROR;
+ complete(&priv->firmware_loading_complete);
+- device_release_driver(&priv->pdev->dev);
+ mwl8k_release_firmware(priv);
++ device_release_driver(&priv->pdev->dev);
+ }
+
+ #define MAX_RESTART_ATTEMPTS 1
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c
+index ff0971f1e2c8b..8ef6c2f97027d 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c
+@@ -31,7 +31,7 @@ u8 rtl818x_ioread8_idx(struct rtl8187_priv *priv,
+ usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
+ RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
+ (unsigned long)addr, idx & 0x03,
+- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
++ &priv->io_dmabuf->bits8, sizeof(val), 500);
+
+ val = priv->io_dmabuf->bits8;
+ mutex_unlock(&priv->io_mutex);
+@@ -48,7 +48,7 @@ u16 rtl818x_ioread16_idx(struct rtl8187_priv *priv,
+ usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
+ RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
+ (unsigned long)addr, idx & 0x03,
+- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
++ &priv->io_dmabuf->bits16, sizeof(val), 500);
+
+ val = priv->io_dmabuf->bits16;
+ mutex_unlock(&priv->io_mutex);
+@@ -65,7 +65,7 @@ u32 rtl818x_ioread32_idx(struct rtl8187_priv *priv,
+ usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
+ RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
+ (unsigned long)addr, idx & 0x03,
+- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
++ &priv->io_dmabuf->bits32, sizeof(val), 500);
+
+ val = priv->io_dmabuf->bits32;
+ mutex_unlock(&priv->io_mutex);
+@@ -82,7 +82,7 @@ void rtl818x_iowrite8_idx(struct rtl8187_priv *priv,
+ usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
+ RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
+ (unsigned long)addr, idx & 0x03,
+- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
++ &priv->io_dmabuf->bits8, sizeof(val), 500);
+
+ mutex_unlock(&priv->io_mutex);
+ }
+@@ -96,7 +96,7 @@ void rtl818x_iowrite16_idx(struct rtl8187_priv *priv,
+ usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
+ RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
+ (unsigned long)addr, idx & 0x03,
+- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
++ &priv->io_dmabuf->bits16, sizeof(val), 500);
+
+ mutex_unlock(&priv->io_mutex);
+ }
+@@ -110,7 +110,7 @@ void rtl818x_iowrite32_idx(struct rtl8187_priv *priv,
+ usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
+ RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
+ (unsigned long)addr, idx & 0x03,
+- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
++ &priv->io_dmabuf->bits32, sizeof(val), 500);
+
+ mutex_unlock(&priv->io_mutex);
+ }
+@@ -186,7 +186,7 @@ static void rtl8225_write_8051(struct ieee80211_hw *dev, u8 addr, __le16 data)
+ usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
+ RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
+ addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data),
+- HZ / 2);
++ 500);
+
+ mutex_unlock(&priv->io_mutex);
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_core.c b/drivers/net/wireless/rsi/rsi_91x_core.c
+index 3644d7d994638..c6c29034b2ead 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_core.c
++++ b/drivers/net/wireless/rsi/rsi_91x_core.c
+@@ -400,6 +400,8 @@ void rsi_core_xmit(struct rsi_common *common, struct sk_buff *skb)
+
+ info = IEEE80211_SKB_CB(skb);
+ tx_params = (struct skb_info *)info->driver_data;
++ /* info->driver_data and info->control part of union so make copy */
++ tx_params->have_key = !!info->control.hw_key;
+ wh = (struct ieee80211_hdr *)&skb->data[0];
+ tx_params->sta_id = 0;
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
+index c0301cd10209c..2cb7cca4ec2d9 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
+@@ -193,7 +193,7 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb)
+ wh->frame_control |= cpu_to_le16(RSI_SET_PS_ENABLE);
+
+ if ((!(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) &&
+- info->control.hw_key) {
++ tx_params->have_key) {
+ if (rsi_is_cipher_wep(common))
+ ieee80211_size += 4;
+ else
+@@ -204,15 +204,17 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb)
+ RSI_WIFI_DATA_Q);
+ data_desc->header_len = ieee80211_size;
+
+- if (common->min_rate != RSI_RATE_AUTO) {
++ if (common->rate_config[common->band].fixed_enabled) {
+ /* Send fixed rate */
++ u16 fixed_rate = common->rate_config[common->band].fixed_hw_rate;
++
+ data_desc->frame_info = cpu_to_le16(RATE_INFO_ENABLE);
+- data_desc->rate_info = cpu_to_le16(common->min_rate);
++ data_desc->rate_info = cpu_to_le16(fixed_rate);
+
+ if (conf_is_ht40(&common->priv->hw->conf))
+ data_desc->bbp_info = cpu_to_le16(FULL40M_ENABLE);
+
+- if ((common->vif_info[0].sgi) && (common->min_rate & 0x100)) {
++ if (common->vif_info[0].sgi && (fixed_rate & 0x100)) {
+ /* Only MCS rates */
+ data_desc->rate_info |=
+ cpu_to_le16(ENABLE_SHORTGI_RATE);
+diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+index bf52091b79182..69cd2c2c30ef9 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -443,7 +443,6 @@ static int rsi_mac80211_add_interface(struct ieee80211_hw *hw,
+ if ((vif->type == NL80211_IFTYPE_AP) ||
+ (vif->type == NL80211_IFTYPE_P2P_GO)) {
+ rsi_send_rx_filter_frame(common, DISALLOW_BEACONS);
+- common->min_rate = RSI_RATE_AUTO;
+ for (i = 0; i < common->max_stations; i++)
+ common->stations[i].sta = NULL;
+ }
+@@ -1143,20 +1142,32 @@ static int rsi_mac80211_set_rate_mask(struct ieee80211_hw *hw,
+ struct ieee80211_vif *vif,
+ const struct cfg80211_bitrate_mask *mask)
+ {
++ const unsigned int mcs_offset = ARRAY_SIZE(rsi_rates);
+ struct rsi_hw *adapter = hw->priv;
+ struct rsi_common *common = adapter->priv;
+- enum nl80211_band band = hw->conf.chandef.chan->band;
++ int i;
+
+ mutex_lock(&common->mutex);
+- common->fixedrate_mask[band] = 0;
+
+- if (mask->control[band].legacy == 0xfff) {
+- common->fixedrate_mask[band] =
+- (mask->control[band].ht_mcs[0] << 12);
+- } else {
+- common->fixedrate_mask[band] =
+- mask->control[band].legacy;
++ for (i = 0; i < ARRAY_SIZE(common->rate_config); i++) {
++ struct rsi_rate_config *cfg = &common->rate_config[i];
++ u32 bm;
++
++ bm = mask->control[i].legacy | (mask->control[i].ht_mcs[0] << mcs_offset);
++ if (hweight32(bm) == 1) { /* single rate */
++ int rate_index = ffs(bm) - 1;
++
++ if (rate_index < mcs_offset)
++ cfg->fixed_hw_rate = rsi_rates[rate_index].hw_value;
++ else
++ cfg->fixed_hw_rate = rsi_mcsrates[rate_index - mcs_offset];
++ cfg->fixed_enabled = true;
++ } else {
++ cfg->configured_mask = bm;
++ cfg->fixed_enabled = false;
++ }
+ }
++
+ mutex_unlock(&common->mutex);
+
+ return 0;
+@@ -1292,46 +1303,6 @@ void rsi_indicate_pkt_to_os(struct rsi_common *common,
+ ieee80211_rx_irqsafe(hw, skb);
+ }
+
+-static void rsi_set_min_rate(struct ieee80211_hw *hw,
+- struct ieee80211_sta *sta,
+- struct rsi_common *common)
+-{
+- u8 band = hw->conf.chandef.chan->band;
+- u8 ii;
+- u32 rate_bitmap;
+- bool matched = false;
+-
+- common->bitrate_mask[band] = sta->supp_rates[band];
+-
+- rate_bitmap = (common->fixedrate_mask[band] & sta->supp_rates[band]);
+-
+- if (rate_bitmap & 0xfff) {
+- /* Find out the min rate */
+- for (ii = 0; ii < ARRAY_SIZE(rsi_rates); ii++) {
+- if (rate_bitmap & BIT(ii)) {
+- common->min_rate = rsi_rates[ii].hw_value;
+- matched = true;
+- break;
+- }
+- }
+- }
+-
+- common->vif_info[0].is_ht = sta->ht_cap.ht_supported;
+-
+- if ((common->vif_info[0].is_ht) && (rate_bitmap >> 12)) {
+- for (ii = 0; ii < ARRAY_SIZE(rsi_mcsrates); ii++) {
+- if ((rate_bitmap >> 12) & BIT(ii)) {
+- common->min_rate = rsi_mcsrates[ii];
+- matched = true;
+- break;
+- }
+- }
+- }
+-
+- if (!matched)
+- common->min_rate = 0xffff;
+-}
+-
+ /**
+ * rsi_mac80211_sta_add() - This function notifies driver about a peer getting
+ * connected.
+@@ -1430,9 +1401,9 @@ static int rsi_mac80211_sta_add(struct ieee80211_hw *hw,
+
+ if ((vif->type == NL80211_IFTYPE_STATION) ||
+ (vif->type == NL80211_IFTYPE_P2P_CLIENT)) {
+- rsi_set_min_rate(hw, sta, common);
++ common->bitrate_mask[common->band] = sta->supp_rates[common->band];
++ common->vif_info[0].is_ht = sta->ht_cap.ht_supported;
+ if (sta->ht_cap.ht_supported) {
+- common->vif_info[0].is_ht = true;
+ common->bitrate_mask[NL80211_BAND_2GHZ] =
+ sta->supp_rates[NL80211_BAND_2GHZ];
+ if ((sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ||
+@@ -1506,7 +1477,6 @@ static int rsi_mac80211_sta_remove(struct ieee80211_hw *hw,
+ bss->qos = sta->wme;
+ common->bitrate_mask[NL80211_BAND_2GHZ] = 0;
+ common->bitrate_mask[NL80211_BAND_5GHZ] = 0;
+- common->min_rate = 0xffff;
+ common->vif_info[0].is_ht = false;
+ common->vif_info[0].sgi = false;
+ common->vif_info[0].seq_start = 0;
+diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c
+index 01d99ed985eef..d90d8ab56fa28 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_main.c
++++ b/drivers/net/wireless/rsi/rsi_91x_main.c
+@@ -216,9 +216,10 @@ int rsi_read_pkt(struct rsi_common *common, u8 *rx_pkt, s32 rcv_pkt_len)
+ bt_pkt_type = frame_desc[offset + BT_RX_PKT_TYPE_OFST];
+ if (bt_pkt_type == BT_CARD_READY_IND) {
+ rsi_dbg(INFO_ZONE, "BT Card ready recvd\n");
+- if (rsi_bt_ops.attach(common, &g_proto_ops))
+- rsi_dbg(ERR_ZONE,
+- "Failed to attach BT module\n");
++ if (common->fsm_state == FSM_MAC_INIT_DONE)
++ rsi_attach_bt(common);
++ else
++ common->bt_defer_attach = true;
+ } else {
+ if (common->bt_adapter)
+ rsi_bt_ops.recv_pkt(common->bt_adapter,
+@@ -283,6 +284,15 @@ void rsi_set_bt_context(void *priv, void *bt_context)
+ }
+ #endif
+
++void rsi_attach_bt(struct rsi_common *common)
++{
++#ifdef CONFIG_RSI_COEX
++ if (rsi_bt_ops.attach(common, &g_proto_ops))
++ rsi_dbg(ERR_ZONE,
++ "Failed to attach BT module\n");
++#endif
++}
++
+ /**
+ * rsi_91x_init() - This function initializes os interface operations.
+ * @void: Void.
+@@ -363,6 +373,7 @@ struct rsi_hw *rsi_91x_init(u16 oper_mode)
+ if (common->coex_mode > 1) {
+ if (rsi_coex_attach(common)) {
+ rsi_dbg(ERR_ZONE, "Failed to init coex module\n");
++ rsi_kill_thread(&common->tx_thread);
+ goto err;
+ }
+ }
+diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+index 934550a66732c..4e6acffe1f12b 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+@@ -222,7 +222,7 @@ static void rsi_set_default_parameters(struct rsi_common *common)
+ common->channel_width = BW_20MHZ;
+ common->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
+ common->channel = 1;
+- common->min_rate = 0xffff;
++ memset(&common->rate_config, 0, sizeof(common->rate_config));
+ common->fsm_state = FSM_CARD_NOT_READY;
+ common->iface_down = true;
+ common->endpoint = EP_2GHZ_20MHZ;
+@@ -1172,7 +1172,7 @@ static int rsi_send_auto_rate_request(struct rsi_common *common,
+ u8 band = hw->conf.chandef.chan->band;
+ u8 num_supported_rates = 0;
+ u8 rate_table_offset, rate_offset = 0;
+- u32 rate_bitmap;
++ u32 rate_bitmap, configured_rates;
+ u16 *selected_rates, min_rate;
+ bool is_ht = false, is_sgi = false;
+ u16 frame_len = sizeof(struct rsi_auto_rate);
+@@ -1222,6 +1222,10 @@ static int rsi_send_auto_rate_request(struct rsi_common *common,
+ is_sgi = true;
+ }
+
++ /* Limit to any rates administratively configured by cfg80211 */
++ configured_rates = common->rate_config[band].configured_mask ?: 0xffffffff;
++ rate_bitmap &= configured_rates;
++
+ if (band == NL80211_BAND_2GHZ) {
+ if ((rate_bitmap == 0) && (is_ht))
+ min_rate = RSI_RATE_MCS0;
+@@ -1247,10 +1251,13 @@ static int rsi_send_auto_rate_request(struct rsi_common *common,
+ num_supported_rates = jj;
+
+ if (is_ht) {
+- for (ii = 0; ii < ARRAY_SIZE(mcs); ii++)
+- selected_rates[jj++] = mcs[ii];
+- num_supported_rates += ARRAY_SIZE(mcs);
+- rate_offset += ARRAY_SIZE(mcs);
++ for (ii = 0; ii < ARRAY_SIZE(mcs); ii++) {
++ if (configured_rates & BIT(ii + ARRAY_SIZE(rsi_rates))) {
++ selected_rates[jj++] = mcs[ii];
++ num_supported_rates++;
++ rate_offset++;
++ }
++ }
+ }
+
+ sort(selected_rates, jj, sizeof(u16), &rsi_compare, NULL);
+@@ -1335,7 +1342,7 @@ void rsi_inform_bss_status(struct rsi_common *common,
+ qos_enable,
+ aid, sta_id,
+ vif);
+- if (common->min_rate == 0xffff)
++ if (!common->rate_config[common->band].fixed_enabled)
+ rsi_send_auto_rate_request(common, sta, sta_id, vif);
+ if (opmode == RSI_OPMODE_STA &&
+ !(assoc_cap & WLAN_CAPABILITY_PRIVACY) &&
+@@ -1761,6 +1768,9 @@ static int rsi_handle_ta_confirm_type(struct rsi_common *common,
+ if (common->reinit_hw) {
+ complete(&common->wlan_init_completion);
+ } else {
++ if (common->bt_defer_attach)
++ rsi_attach_bt(common);
++
+ return rsi_mac80211_attach(common);
+ }
+ }
+diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+index 609cd07eeafca..48efe83c58d89 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -24,10 +24,7 @@
+ /* Default operating mode is wlan STA + BT */
+ static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL;
+ module_param(dev_oper_mode, ushort, 0444);
+-MODULE_PARM_DESC(dev_oper_mode,
+- "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n"
+- "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n"
+- "6[AP + BT classic], 14[AP + BT classic + BT LE]");
++MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC);
+
+ /**
+ * rsi_sdio_set_cmd52_arg() - This function prepares cmd 52 read/write arg.
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index 17e50eba780d8..984f99ad40960 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -25,10 +25,7 @@
+ /* Default operating mode is wlan STA + BT */
+ static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL;
+ module_param(dev_oper_mode, ushort, 0444);
+-MODULE_PARM_DESC(dev_oper_mode,
+- "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n"
+- "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n"
+- "6[AP + BT classic], 14[AP + BT classic + BT LE]");
++MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC);
+
+ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num, gfp_t flags);
+
+diff --git a/drivers/net/wireless/rsi/rsi_hal.h b/drivers/net/wireless/rsi/rsi_hal.h
+index 327638cdd30b1..5f52ba8458be1 100644
+--- a/drivers/net/wireless/rsi/rsi_hal.h
++++ b/drivers/net/wireless/rsi/rsi_hal.h
+@@ -28,6 +28,17 @@
+ #define DEV_OPMODE_AP_BT 6
+ #define DEV_OPMODE_AP_BT_DUAL 14
+
++#define DEV_OPMODE_PARAM_DESC \
++ __stringify(DEV_OPMODE_WIFI_ALONE) "[Wi-Fi alone], " \
++ __stringify(DEV_OPMODE_BT_ALONE) "[BT classic alone], " \
++ __stringify(DEV_OPMODE_BT_LE_ALONE) "[BT LE alone], " \
++ __stringify(DEV_OPMODE_BT_DUAL) "[BT classic + BT LE alone], " \
++ __stringify(DEV_OPMODE_STA_BT) "[Wi-Fi STA + BT classic], " \
++ __stringify(DEV_OPMODE_STA_BT_LE) "[Wi-Fi STA + BT LE], " \
++ __stringify(DEV_OPMODE_STA_BT_DUAL) "[Wi-Fi STA + BT classic + BT LE], " \
++ __stringify(DEV_OPMODE_AP_BT) "[Wi-Fi AP + BT classic], " \
++ __stringify(DEV_OPMODE_AP_BT_DUAL) "[Wi-Fi AP + BT classic + BT LE]"
++
+ #define FLASH_WRITE_CHUNK_SIZE (4 * 1024)
+ #define FLASH_SECTOR_SIZE (4 * 1024)
+
+diff --git a/drivers/net/wireless/rsi/rsi_main.h b/drivers/net/wireless/rsi/rsi_main.h
+index a245559abe7c8..88523940da114 100644
+--- a/drivers/net/wireless/rsi/rsi_main.h
++++ b/drivers/net/wireless/rsi/rsi_main.h
+@@ -61,6 +61,7 @@ enum RSI_FSM_STATES {
+ extern u32 rsi_zone_enabled;
+ extern __printf(2, 3) void rsi_dbg(u32 zone, const char *fmt, ...);
+
++#define RSI_MAX_BANDS 2
+ #define RSI_MAX_VIFS 3
+ #define NUM_EDCA_QUEUES 4
+ #define IEEE80211_ADDR_LEN 6
+@@ -135,6 +136,7 @@ struct skb_info {
+ u8 internal_hdr_size;
+ struct ieee80211_vif *vif;
+ u8 vap_id;
++ bool have_key;
+ };
+
+ enum edca_queue {
+@@ -196,6 +198,12 @@ enum rsi_dfs_regions {
+ RSI_REGION_WORLD
+ };
+
++struct rsi_rate_config {
++ u32 configured_mask; /* configured by mac80211 bits 0-11=legacy 12+ mcs */
++ u16 fixed_hw_rate;
++ bool fixed_enabled;
++};
++
+ struct rsi_common {
+ struct rsi_hw *priv;
+ struct vif_priv vif_info[RSI_MAX_VIFS];
+@@ -221,8 +229,8 @@ struct rsi_common {
+ u8 channel_width;
+
+ u16 rts_threshold;
+- u16 bitrate_mask[2];
+- u32 fixedrate_mask[2];
++ u32 bitrate_mask[RSI_MAX_BANDS];
++ struct rsi_rate_config rate_config[RSI_MAX_BANDS];
+
+ u8 rf_reset;
+ struct transmit_q_stats tx_stats;
+@@ -243,7 +251,6 @@ struct rsi_common {
+ u8 mac_id;
+ u8 radio_id;
+ u16 rate_pwr[20];
+- u16 min_rate;
+
+ /* WMM algo related */
+ u8 selected_qnum;
+@@ -287,6 +294,7 @@ struct rsi_common {
+ struct ieee80211_vif *roc_vif;
+
+ bool eapol4_confirm;
++ bool bt_defer_attach;
+ void *bt_adapter;
+ };
+
+@@ -361,5 +369,6 @@ struct rsi_host_intf_ops {
+
+ enum rsi_host_intf rsi_get_host_intf(void *priv);
+ void rsi_set_bt_context(void *priv, void *bt_context);
++void rsi_attach_bt(struct rsi_common *common);
+
+ #endif
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index c8e84276e6397..a1c828ffac8b7 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1442,6 +1442,10 @@ static int netfront_resume(struct xenbus_device *dev)
+
+ dev_dbg(&dev->dev, "%s\n", dev->nodename);
+
++ netif_tx_lock_bh(info->netdev);
++ netif_device_detach(info->netdev);
++ netif_tx_unlock_bh(info->netdev);
++
+ xennet_disconnect_backend(info);
+ return 0;
+ }
+@@ -1990,6 +1994,10 @@ static int xennet_connect(struct net_device *dev)
+ * domain a kick because we've probably just requeued some
+ * packets.
+ */
++ netif_tx_lock_bh(np->netdev);
++ netif_device_attach(np->netdev);
++ netif_tx_unlock_bh(np->netdev);
++
+ netif_carrier_on(np->netdev);
+ for (j = 0; j < num_queues; ++j) {
+ queue = &np->queues[j];
+diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
+index 01da9331f4cb6..79bf8e1bd39c2 100644
+--- a/drivers/nfc/pn533/pn533.c
++++ b/drivers/nfc/pn533/pn533.c
+@@ -2084,7 +2084,7 @@ static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
+ frag = pn533_alloc_skb(dev, frag_size);
+ if (!frag) {
+ skb_queue_purge(&dev->fragment_skb);
+- break;
++ return -ENOMEM;
+ }
+
+ if (!dev->tgt_mode) {
+@@ -2154,7 +2154,7 @@ static int pn533_transceive(struct nfc_dev *nfc_dev,
+ /* jumbo frame ? */
+ if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
+ rc = pn533_fill_fragment_skbs(dev, skb);
+- if (rc <= 0)
++ if (rc < 0)
+ goto error;
+
+ skb = skb_dequeue(&dev->fragment_skb);
+@@ -2226,7 +2226,7 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
+ /* let's split in multiple chunks if size's too big */
+ if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
+ rc = pn533_fill_fragment_skbs(dev, skb);
+- if (rc <= 0)
++ if (rc < 0)
+ goto error;
+
+ /* get the first skb */
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index ffd6a7204509a..1f41cf80f827c 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -967,11 +967,13 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new)
+ return ret;
+
+ if (ctrl->ctrl.icdoff) {
++ ret = -EOPNOTSUPP;
+ dev_err(ctrl->ctrl.device, "icdoff is not supported!\n");
+ goto destroy_admin;
+ }
+
+ if (!(ctrl->ctrl.sgls & (1 << 2))) {
++ ret = -EOPNOTSUPP;
+ dev_err(ctrl->ctrl.device,
+ "Mandatory keyed sgls are not supported!\n");
+ goto destroy_admin;
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index 68afd4fa7ec9e..98fb3c1f45e4d 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -99,18 +99,19 @@
+ #define PCIE_ISR0_MSI_INT_PENDING BIT(24)
+ #define PCIE_ISR0_INTX_ASSERT(val) BIT(16 + (val))
+ #define PCIE_ISR0_INTX_DEASSERT(val) BIT(20 + (val))
+-#define PCIE_ISR0_ALL_MASK GENMASK(26, 0)
++#define PCIE_ISR0_ALL_MASK GENMASK(31, 0)
+ #define PCIE_ISR1_REG (CONTROL_BASE_ADDR + 0x48)
+ #define PCIE_ISR1_MASK_REG (CONTROL_BASE_ADDR + 0x4C)
+ #define PCIE_ISR1_POWER_STATE_CHANGE BIT(4)
+ #define PCIE_ISR1_FLUSH BIT(5)
+ #define PCIE_ISR1_INTX_ASSERT(val) BIT(8 + (val))
+-#define PCIE_ISR1_ALL_MASK GENMASK(11, 4)
++#define PCIE_ISR1_ALL_MASK GENMASK(31, 0)
+ #define PCIE_MSI_ADDR_LOW_REG (CONTROL_BASE_ADDR + 0x50)
+ #define PCIE_MSI_ADDR_HIGH_REG (CONTROL_BASE_ADDR + 0x54)
+ #define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58)
+ #define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C)
+ #define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C)
++#define PCIE_MSI_DATA_MASK GENMASK(15, 0)
+
+ /* LMI registers base address and register offsets */
+ #define LMI_BASE_ADDR 0x6000
+@@ -150,7 +151,7 @@
+ #define PCIE_IRQ_MSI_INT2_DET BIT(21)
+ #define PCIE_IRQ_RC_DBELL_DET BIT(22)
+ #define PCIE_IRQ_EP_STATUS BIT(23)
+-#define PCIE_IRQ_ALL_MASK 0xfff0fb
++#define PCIE_IRQ_ALL_MASK GENMASK(31, 0)
+ #define PCIE_IRQ_ENABLE_INTS_MASK PCIE_IRQ_CORE_INT
+
+ /* Transaction types */
+@@ -403,7 +404,7 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val)
+ else
+ str_posted = "Posted";
+
+- dev_err(dev, "%s PIO Response Status: %s, %#x @ %#x\n",
++ dev_dbg(dev, "%s PIO Response Status: %s, %#x @ %#x\n",
+ str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS));
+
+ return -EFAULT;
+@@ -627,7 +628,7 @@ static int advk_msi_irq_domain_alloc(struct irq_domain *domain,
+ domain->host_data, handle_simple_irq,
+ NULL, NULL);
+
+- return hwirq;
++ return 0;
+ }
+
+ static void advk_msi_irq_domain_free(struct irq_domain *domain,
+@@ -805,8 +806,12 @@ static void advk_pcie_handle_msi(struct advk_pcie *pcie)
+ if (!(BIT(msi_idx) & msi_status))
+ continue;
+
++ /*
++ * msi_idx contains bits [4:0] of the msi_data and msi_data
++ * contains 16bit MSI interrupt number
++ */
+ advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG);
+- msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & 0xFF;
++ msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK;
+ generic_handle_irq(msi_data);
+ }
+
+@@ -828,12 +833,6 @@ static void advk_pcie_handle_int(struct advk_pcie *pcie)
+ isr1_mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
+ isr1_status = isr1_val & ((~isr1_mask) & PCIE_ISR1_ALL_MASK);
+
+- if (!isr0_status && !isr1_status) {
+- advk_writel(pcie, isr0_val, PCIE_ISR0_REG);
+- advk_writel(pcie, isr1_val, PCIE_ISR1_REG);
+- return;
+- }
+-
+ /* Process MSI interrupts */
+ if (isr0_status & PCIE_ISR0_MSI_INT_PENDING)
+ advk_pcie_handle_msi(pcie);
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index f65800d63856b..d42c84a2d2eba 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -372,18 +372,6 @@ static void free_msi_irqs(struct pci_dev *dev)
+ for (i = 0; i < entry->nvec_used; i++)
+ BUG_ON(irq_has_action(entry->irq + i));
+
+- pci_msi_teardown_msi_irqs(dev);
+-
+- list_for_each_entry_safe(entry, tmp, msi_list, list) {
+- if (entry->msi_attrib.is_msix) {
+- if (list_is_last(&entry->list, msi_list))
+- iounmap(entry->mask_base);
+- }
+-
+- list_del(&entry->list);
+- free_msi_entry(entry);
+- }
+-
+ if (dev->msi_irq_groups) {
+ sysfs_remove_groups(&dev->dev.kobj, dev->msi_irq_groups);
+ msi_attrs = dev->msi_irq_groups[0]->attrs;
+@@ -399,6 +387,18 @@ static void free_msi_irqs(struct pci_dev *dev)
+ kfree(dev->msi_irq_groups);
+ dev->msi_irq_groups = NULL;
+ }
++
++ pci_msi_teardown_msi_irqs(dev);
++
++ list_for_each_entry_safe(entry, tmp, msi_list, list) {
++ if (entry->msi_attrib.is_msix) {
++ if (list_is_last(&entry->list, msi_list))
++ iounmap(entry->mask_base);
++ }
++
++ list_del(&entry->list);
++ free_msi_entry(entry);
++ }
+ }
+
+ static void pci_intx_for_msi(struct pci_dev *dev, int enable)
+@@ -569,6 +569,9 @@ msi_setup_entry(struct pci_dev *dev, int nvec, const struct irq_affinity *affd)
+ goto out;
+
+ pci_read_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, &control);
++ /* Lies, damned lies, and MSIs */
++ if (dev->dev_flags & PCI_DEV_FLAGS_HAS_MSI_MASKING)
++ control |= PCI_MSI_FLAGS_MASKBIT;
+
+ entry->msi_attrib.is_msix = 0;
+ entry->msi_attrib.is_64 = !!(control & PCI_MSI_FLAGS_64BIT);
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 4eb8900b9a5cd..315e96ba651a2 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3490,6 +3490,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003e, quirk_no_bus_reset);
+
+ /*
+ * Root port on some Cavium CN8xxx chips do not successfully complete a bus
+@@ -5578,3 +5579,9 @@ static void apex_pci_fixup_class(struct pci_dev *pdev)
+ }
+ DECLARE_PCI_FIXUP_CLASS_HEADER(0x1ac1, 0x089a,
+ PCI_CLASS_NOT_DEFINED, 8, apex_pci_fixup_class);
++
++static void nvidia_ion_ahci_fixup(struct pci_dev *pdev)
++{
++ pdev->dev_flags |= PCI_DEV_FLAGS_HAS_MSI_MASKING;
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0ab8, nvidia_ion_ahci_fixup);
+diff --git a/drivers/phy/qualcomm/phy-qcom-qusb2.c b/drivers/phy/qualcomm/phy-qcom-qusb2.c
+index 9b7ae93e9df1e..901f525c86e2b 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qusb2.c
++++ b/drivers/phy/qualcomm/phy-qcom-qusb2.c
+@@ -395,7 +395,7 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
+ {
+ struct device *dev = &qphy->phy->dev;
+ const struct qusb2_phy_cfg *cfg = qphy->cfg;
+- u8 *val;
++ u8 *val, hstx_trim;
+
+ /* efuse register is optional */
+ if (!qphy->cell)
+@@ -409,7 +409,13 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
+ * set while configuring the phy.
+ */
+ val = nvmem_cell_read(qphy->cell, NULL);
+- if (IS_ERR(val) || !val[0]) {
++ if (IS_ERR(val)) {
++ dev_dbg(dev, "failed to read a valid hs-tx trim value\n");
++ return;
++ }
++ hstx_trim = val[0];
++ kfree(val);
++ if (!hstx_trim) {
+ dev_dbg(dev, "failed to read a valid hs-tx trim value\n");
+ return;
+ }
+@@ -417,12 +423,10 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
+ /* Fused TUNE1/2 value is the higher nibble only */
+ if (cfg->update_tune1_with_efuse)
+ qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE1],
+- val[0] << HSTX_TRIM_SHIFT,
+- HSTX_TRIM_MASK);
++ hstx_trim << HSTX_TRIM_SHIFT, HSTX_TRIM_MASK);
+ else
+ qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE2],
+- val[0] << HSTX_TRIM_SHIFT,
+- HSTX_TRIM_MASK);
++ hstx_trim << HSTX_TRIM_SHIFT, HSTX_TRIM_MASK);
+ }
+
+ static int qusb2_phy_set_mode(struct phy *phy, enum phy_mode mode)
+diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
+index 76638dee65d94..a8148460f99f1 100644
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -2038,6 +2038,8 @@ int pinctrl_enable(struct pinctrl_dev *pctldev)
+ if (error) {
+ dev_err(pctldev->dev, "could not claim hogs: %i\n",
+ error);
++ pinctrl_free_pindescs(pctldev, pctldev->desc->pins,
++ pctldev->desc->npins);
+ mutex_destroy(&pctldev->mutex);
+ kfree(pctldev);
+
+diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
+index 9c3c83ef445bf..075332c6890d0 100644
+--- a/drivers/platform/x86/hp_accel.c
++++ b/drivers/platform/x86/hp_accel.c
+@@ -383,9 +383,11 @@ static int lis3lv02d_add(struct acpi_device *device)
+ INIT_WORK(&hpled_led.work, delayed_set_status_worker);
+ ret = led_classdev_register(NULL, &hpled_led.led_classdev);
+ if (ret) {
++ i8042_remove_filter(hp_accel_i8042_filter);
+ lis3lv02d_joystick_disable(&lis3_dev);
+ lis3lv02d_poweroff(&lis3_dev);
+ flush_work(&hpled_led.work);
++ lis3lv02d_remove_fs(&lis3_dev);
+ return ret;
+ }
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 35c7d3185fea3..fa8bcbe3d2762 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -9124,7 +9124,7 @@ static int fan_write_cmd_level(const char *cmd, int *rc)
+
+ if (strlencmp(cmd, "level auto") == 0)
+ level = TP_EC_FAN_AUTO;
+- else if ((strlencmp(cmd, "level disengaged") == 0) |
++ else if ((strlencmp(cmd, "level disengaged") == 0) ||
+ (strlencmp(cmd, "level full-speed") == 0))
+ level = TP_EC_FAN_FULLSPEED;
+ else if (sscanf(cmd, "level %d", &level) != 1)
+diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
+index 35cdc3998eb59..387358af685c5 100644
+--- a/drivers/platform/x86/wmi.c
++++ b/drivers/platform/x86/wmi.c
+@@ -350,7 +350,14 @@ static acpi_status __query_block(struct wmi_block *wblock, u8 instance,
+ * the WQxx method failed - we should disable collection anyway.
+ */
+ if ((block->flags & ACPI_WMI_EXPENSIVE) && ACPI_SUCCESS(wc_status)) {
+- status = acpi_execute_simple_method(handle, wc_method, 0);
++ /*
++ * Ignore whether this WCxx call succeeds or not since
++ * the previously executed WQxx method call might have
++ * succeeded, and returning the failing status code
++ * of this call would throw away the result of the WQxx
++ * call, potentially leaking memory.
++ */
++ acpi_execute_simple_method(handle, wc_method, 0);
+ }
+
+ return status;
+diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c
+index 40069128ad44f..06dd5077104cc 100644
+--- a/drivers/power/supply/bq27xxx_battery_i2c.c
++++ b/drivers/power/supply/bq27xxx_battery_i2c.c
+@@ -195,7 +195,8 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client,
+ dev_err(&client->dev,
+ "Unable to register IRQ %d error %d\n",
+ client->irq, ret);
+- return ret;
++ bq27xxx_battery_teardown(di);
++ goto err_failed;
+ }
+ }
+
+diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
+index a1518eb6f6c0d..33fbb0fc952b4 100644
+--- a/drivers/power/supply/max17042_battery.c
++++ b/drivers/power/supply/max17042_battery.c
+@@ -326,7 +326,10 @@ static int max17042_get_property(struct power_supply *psy,
+ val->intval = data * 625 / 8;
+ break;
+ case POWER_SUPPLY_PROP_CAPACITY:
+- ret = regmap_read(map, MAX17042_RepSOC, &data);
++ if (chip->pdata->enable_current_sense)
++ ret = regmap_read(map, MAX17042_RepSOC, &data);
++ else
++ ret = regmap_read(map, MAX17042_VFSOC, &data);
+ if (ret < 0)
+ return ret;
+
+@@ -848,7 +851,8 @@ static void max17042_set_soc_threshold(struct max17042_chip *chip, u16 off)
+ regmap_read(map, MAX17042_RepSOC, &soc);
+ soc >>= 8;
+ soc_tr = (soc + off) << 8;
+- soc_tr |= (soc - off);
++ if (off < soc)
++ soc_tr |= soc - off;
+ regmap_write(map, MAX17042_SALRT_Th, soc_tr);
+ }
+
+diff --git a/drivers/power/supply/rt5033_battery.c b/drivers/power/supply/rt5033_battery.c
+index 9310b85f3405e..7eec7014086d8 100644
+--- a/drivers/power/supply/rt5033_battery.c
++++ b/drivers/power/supply/rt5033_battery.c
+@@ -63,7 +63,7 @@ static int rt5033_battery_get_watt_prop(struct i2c_client *client,
+ regmap_read(battery->regmap, regh, &msb);
+ regmap_read(battery->regmap, regl, &lsb);
+
+- ret = ((msb << 4) + (lsb >> 4)) * 1250 / 1000;
++ ret = ((msb << 4) + (lsb >> 4)) * 1250;
+
+ return ret;
+ }
+diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
+index 7ff94695eee72..4818df3f8ec91 100644
+--- a/drivers/regulator/s5m8767.c
++++ b/drivers/regulator/s5m8767.c
+@@ -849,18 +849,15 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
+ /* DS4 GPIO */
+ gpio_direction_output(pdata->buck_ds[2], 0x0);
+
+- if (pdata->buck2_gpiodvs || pdata->buck3_gpiodvs ||
+- pdata->buck4_gpiodvs) {
+- regmap_update_bits(s5m8767->iodev->regmap_pmic,
+- S5M8767_REG_BUCK2CTRL, 1 << 1,
+- (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1));
+- regmap_update_bits(s5m8767->iodev->regmap_pmic,
+- S5M8767_REG_BUCK3CTRL, 1 << 1,
+- (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1));
+- regmap_update_bits(s5m8767->iodev->regmap_pmic,
+- S5M8767_REG_BUCK4CTRL, 1 << 1,
+- (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1));
+- }
++ regmap_update_bits(s5m8767->iodev->regmap_pmic,
++ S5M8767_REG_BUCK2CTRL, 1 << 1,
++ (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1));
++ regmap_update_bits(s5m8767->iodev->regmap_pmic,
++ S5M8767_REG_BUCK3CTRL, 1 << 1,
++ (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1));
++ regmap_update_bits(s5m8767->iodev->regmap_pmic,
++ S5M8767_REG_BUCK4CTRL, 1 << 1,
++ (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1));
+
+ /* Initialize GPIO DVS registers */
+ for (i = 0; i < 8; i++) {
+diff --git a/drivers/s390/char/tape_std.c b/drivers/s390/char/tape_std.c
+index 1f5fab617b679..f7e75d9fedf61 100644
+--- a/drivers/s390/char/tape_std.c
++++ b/drivers/s390/char/tape_std.c
+@@ -53,7 +53,6 @@ int
+ tape_std_assign(struct tape_device *device)
+ {
+ int rc;
+- struct timer_list timeout;
+ struct tape_request *request;
+
+ request = tape_alloc_request(2, 11);
+@@ -70,7 +69,7 @@ tape_std_assign(struct tape_device *device)
+ * So we set up a timeout for this call.
+ */
+ timer_setup(&request->timer, tape_std_assign_timeout, 0);
+- mod_timer(&timeout, jiffies + 2 * HZ);
++ mod_timer(&request->timer, jiffies + msecs_to_jiffies(2000));
+
+ rc = tape_do_io_interruptible(device, request);
+
+diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
+index 6efe50d70c4bf..10e8b3b156f05 100644
+--- a/drivers/s390/cio/css.c
++++ b/drivers/s390/cio/css.c
+@@ -371,8 +371,8 @@ static ssize_t dev_busid_show(struct device *dev,
+ struct subchannel *sch = to_subchannel(dev);
+ struct pmcw *pmcw = &sch->schib.pmcw;
+
+- if ((pmcw->st == SUBCHANNEL_TYPE_IO ||
+- pmcw->st == SUBCHANNEL_TYPE_MSG) && pmcw->dnv)
++ if ((pmcw->st == SUBCHANNEL_TYPE_IO && pmcw->dnv) ||
++ (pmcw->st == SUBCHANNEL_TYPE_MSG && pmcw->w))
+ return sysfs_emit(buf, "0.%x.%04x\n", sch->schid.ssid,
+ pmcw->dev);
+ else
+diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
+index 713f69033f201..2856b0ce7ab9a 100644
+--- a/drivers/scsi/advansys.c
++++ b/drivers/scsi/advansys.c
+@@ -3370,8 +3370,8 @@ static void asc_prt_adv_board_info(struct seq_file *m, struct Scsi_Host *shost)
+ shost->host_no);
+
+ seq_printf(m,
+- " iop_base 0x%lx, cable_detect: %X, err_code %u\n",
+- (unsigned long)v->iop_base,
++ " iop_base 0x%p, cable_detect: %X, err_code %u\n",
++ v->iop_base,
+ AdvReadWordRegister(iop_base,IOPW_SCSI_CFG1) & CABLE_DETECT,
+ v->err_code);
+
+diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c
+index a8e29e3d35726..98944fb3f0b85 100644
+--- a/drivers/scsi/csiostor/csio_lnode.c
++++ b/drivers/scsi/csiostor/csio_lnode.c
+@@ -619,7 +619,7 @@ csio_ln_vnp_read_cbfn(struct csio_hw *hw, struct csio_mb *mbp)
+ struct fc_els_csp *csp;
+ struct fc_els_cssp *clsp;
+ enum fw_retval retval;
+- __be32 nport_id;
++ __be32 nport_id = 0;
+
+ retval = FW_CMD_RETVAL_G(ntohl(rsp->alloc_to_len16));
+ if (retval != FW_SUCCESS) {
+diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
+index 3943347ec3c7c..16b9dc2fff6bd 100644
+--- a/drivers/scsi/dc395x.c
++++ b/drivers/scsi/dc395x.c
+@@ -4805,6 +4805,7 @@ static int dc395x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+ /* initialise the adapter and everything we need */
+ if (adapter_init(acb, io_port_base, io_port_len, irq)) {
+ dprintkl(KERN_INFO, "adapter init failed\n");
++ acb = NULL;
+ goto fail;
+ }
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 40d6537e64dd6..e72fc88aeb40e 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -19171,6 +19171,7 @@ lpfc_drain_txq(struct lpfc_hba *phba)
+ fail_msg,
+ piocbq->iotag, piocbq->sli4_xritag);
+ list_add_tail(&piocbq->list, &completions);
++ fail_msg = NULL;
+ }
+ spin_unlock_irqrestore(&pring->ring_lock, iflags);
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
+index b8e4abe804d5d..5b98a00bfc178 100644
+--- a/drivers/scsi/qla2xxx/qla_gbl.h
++++ b/drivers/scsi/qla2xxx/qla_gbl.h
+@@ -144,7 +144,6 @@ extern int ql2xasynctmfenable;
+ extern int ql2xgffidenable;
+ extern int ql2xenabledif;
+ extern int ql2xenablehba_err_chk;
+-extern int ql2xtargetreset;
+ extern int ql2xdontresethba;
+ extern uint64_t ql2xmaxlun;
+ extern int ql2xmdcapmask;
+@@ -754,7 +753,6 @@ extern void qlafx00_abort_iocb(srb_t *, struct abort_iocb_entry_fx00 *);
+ extern void qlafx00_fxdisc_iocb(srb_t *, struct fxdisc_entry_fx00 *);
+ extern void qlafx00_timer_routine(scsi_qla_host_t *);
+ extern int qlafx00_rescan_isp(scsi_qla_host_t *);
+-extern int qlafx00_loop_reset(scsi_qla_host_t *vha);
+
+ /* qla82xx related functions */
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 2ebf4e4e02344..613e5467b4bc2 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -797,8 +797,6 @@ qla24xx_async_gnl_sp_done(void *s, int res)
+ sp->name, res, sp->u.iocb_cmd.u.mbx.in_mb[1],
+ sp->u.iocb_cmd.u.mbx.in_mb[2]);
+
+- if (res == QLA_FUNCTION_TIMEOUT)
+- return;
+
+ sp->fcport->flags &= ~(FCF_ASYNC_SENT|FCF_ASYNC_ACTIVE);
+ memset(&ea, 0, sizeof(ea));
+@@ -837,8 +835,8 @@ qla24xx_async_gnl_sp_done(void *s, int res)
+ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+
+ list_for_each_entry_safe(fcport, tf, &h, gnl_entry) {
+- list_del_init(&fcport->gnl_entry);
+ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
++ list_del_init(&fcport->gnl_entry);
+ fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
+ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+ ea.fcport = fcport;
+diff --git a/drivers/scsi/qla2xxx/qla_mr.c b/drivers/scsi/qla2xxx/qla_mr.c
+index 521a513705549..0c00aaea9768b 100644
+--- a/drivers/scsi/qla2xxx/qla_mr.c
++++ b/drivers/scsi/qla2xxx/qla_mr.c
+@@ -739,29 +739,6 @@ qlafx00_lun_reset(fc_port_t *fcport, uint64_t l, int tag)
+ return qla2x00_async_tm_cmd(fcport, TCF_LUN_RESET, l, tag);
+ }
+
+-int
+-qlafx00_loop_reset(scsi_qla_host_t *vha)
+-{
+- int ret;
+- struct fc_port *fcport;
+- struct qla_hw_data *ha = vha->hw;
+-
+- if (ql2xtargetreset) {
+- list_for_each_entry(fcport, &vha->vp_fcports, list) {
+- if (fcport->port_type != FCT_TARGET)
+- continue;
+-
+- ret = ha->isp_ops->target_reset(fcport, 0, 0);
+- if (ret != QLA_SUCCESS) {
+- ql_dbg(ql_dbg_taskm, vha, 0x803d,
+- "Bus Reset failed: Reset=%d "
+- "d_id=%x.\n", ret, fcport->d_id.b24);
+- }
+- }
+- }
+- return QLA_SUCCESS;
+-}
+-
+ int
+ qlafx00_iospace_config(struct qla_hw_data *ha)
+ {
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 7cbdd32a238d4..207af1d5ed292 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -188,12 +188,6 @@ MODULE_PARM_DESC(ql2xdbwr,
+ " 0 -- Regular doorbell.\n"
+ " 1 -- CAMRAM doorbell (faster).\n");
+
+-int ql2xtargetreset = 1;
+-module_param(ql2xtargetreset, int, S_IRUGO);
+-MODULE_PARM_DESC(ql2xtargetreset,
+- "Enable target reset."
+- "Default is 1 - use hw defaults.");
+-
+ int ql2xgffidenable;
+ module_param(ql2xgffidenable, int, S_IRUGO);
+ MODULE_PARM_DESC(ql2xgffidenable,
+@@ -1662,27 +1656,10 @@ int
+ qla2x00_loop_reset(scsi_qla_host_t *vha)
+ {
+ int ret;
+- struct fc_port *fcport;
+ struct qla_hw_data *ha = vha->hw;
+
+- if (IS_QLAFX00(ha)) {
+- return qlafx00_loop_reset(vha);
+- }
+-
+- if (ql2xtargetreset == 1 && ha->flags.enable_target_reset) {
+- list_for_each_entry(fcport, &vha->vp_fcports, list) {
+- if (fcport->port_type != FCT_TARGET)
+- continue;
+-
+- ret = ha->isp_ops->target_reset(fcport, 0, 0);
+- if (ret != QLA_SUCCESS) {
+- ql_dbg(ql_dbg_taskm, vha, 0x802c,
+- "Bus Reset failed: Reset=%d "
+- "d_id=%x.\n", ret, fcport->d_id.b24);
+- }
+- }
+- }
+-
++ if (IS_QLAFX00(ha))
++ return QLA_SUCCESS;
+
+ if (ha->flags.enable_lip_full_login && !IS_CNA_CAPABLE(ha)) {
+ atomic_set(&vha->loop_state, LOOP_DOWN);
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index ec54c8f34bc84..5fbac85d7adfb 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -3216,8 +3216,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n",
+ vha->flags.online, qla2x00_reset_active(vha),
+ cmd->reset_count, qpair->chip_reset);
+- spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+- return 0;
++ goto out_unmap_unlock;
+ }
+
+ /* Does F/W have an IOCBs for this request */
+@@ -3339,10 +3338,6 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
+ prm.sg = NULL;
+ prm.req_cnt = 1;
+
+- /* Calculate number of entries and segments required */
+- if (qlt_pci_map_calc_cnt(&prm) != 0)
+- return -EAGAIN;
+-
+ if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) ||
+ (cmd->sess && cmd->sess->deleted)) {
+ /*
+@@ -3358,6 +3353,10 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
+ return 0;
+ }
+
++ /* Calculate number of entries and segments required */
++ if (qlt_pci_map_calc_cnt(&prm) != 0)
++ return -EAGAIN;
++
+ spin_lock_irqsave(qpair->qp_lock_ptr, flags);
+ /* Does F/W have an IOCBs for this request */
+ res = qlt_check_reserve_free_req(qpair, prm.req_cnt);
+@@ -3785,9 +3784,6 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd)
+
+ BUG_ON(cmd->cmd_in_wq);
+
+- if (cmd->sg_mapped)
+- qlt_unmap_sg(cmd->vha, cmd);
+-
+ if (!cmd->q_full)
+ qlt_decr_num_pend_cmds(cmd->vha);
+
+diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c
+index e5d7fb81ad665..44a931d41a132 100644
+--- a/drivers/sh/maple/maple.c
++++ b/drivers/sh/maple/maple.c
+@@ -835,8 +835,10 @@ static int __init maple_bus_init(void)
+
+ maple_queue_cache = KMEM_CACHE(maple_buffer, SLAB_HWCACHE_ALIGN);
+
+- if (!maple_queue_cache)
++ if (!maple_queue_cache) {
++ retval = -ENOMEM;
+ goto cleanup_bothirqs;
++ }
+
+ INIT_LIST_HEAD(&maple_waitq);
+ INIT_LIST_HEAD(&maple_sentq);
+@@ -849,6 +851,7 @@ static int __init maple_bus_init(void)
+ if (!mdev[i]) {
+ while (i-- > 0)
+ maple_free_dev(mdev[i]);
++ retval = -ENOMEM;
+ goto cleanup_cache;
+ }
+ baseunits[i] = mdev[i];
+diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
+index f17a678154047..c1880f88a22b5 100644
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -396,7 +396,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg,
+
+ err = tegra_powergate_enable_clocks(pg);
+ if (err)
+- goto disable_clks;
++ goto powergate_off;
+
+ usleep_range(10, 20);
+
+@@ -408,7 +408,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg,
+
+ err = reset_control_deassert(pg->reset);
+ if (err)
+- goto powergate_off;
++ goto disable_clks;
+
+ usleep_range(10, 20);
+
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 4ee92f7ca20bd..b2fd7a3691964 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -1305,7 +1305,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ &qspi->dev_ids[val]);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "IRQ %s not found\n", name);
+- goto qspi_probe_err;
++ goto qspi_unprepare_err;
+ }
+
+ qspi->dev_ids[val].dev = qspi;
+@@ -1320,7 +1320,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ if (!num_ints) {
+ dev_err(&pdev->dev, "no IRQs registered, cannot init driver\n");
+ ret = -EINVAL;
+- goto qspi_probe_err;
++ goto qspi_unprepare_err;
+ }
+
+ /*
+@@ -1371,6 +1371,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
+
+ qspi_reg_err:
+ bcm_qspi_hw_uninit(qspi);
++qspi_unprepare_err:
+ clk_disable_unprepare(qspi->clk);
+ qspi_probe_err:
+ kfree(qspi->dev_ids);
+diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
+index 1af8c96b940e2..aa04ff6e01b9d 100644
+--- a/drivers/spi/spi-pl022.c
++++ b/drivers/spi/spi-pl022.c
+@@ -1703,12 +1703,13 @@ static int verify_controller_parameters(struct pl022 *pl022,
+ return -EINVAL;
+ }
+ } else {
+- if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX)
++ if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) {
+ dev_err(&pl022->adev->dev,
+ "Microwire half duplex mode requested,"
+ " but this is only available in the"
+ " ST version of PL022\n");
+- return -EINVAL;
++ return -EINVAL;
++ }
+ }
+ }
+ return 0;
+diff --git a/drivers/staging/erofs/unzip_pagevec.h b/drivers/staging/erofs/unzip_pagevec.h
+index 23856ba2742d8..efbf541e11bb8 100644
+--- a/drivers/staging/erofs/unzip_pagevec.h
++++ b/drivers/staging/erofs/unzip_pagevec.h
+@@ -118,12 +118,17 @@ static inline bool
+ z_erofs_pagevec_ctor_enqueue(struct z_erofs_pagevec_ctor *ctor,
+ struct page *page,
+ enum z_erofs_page_type type,
+- bool *occupied)
++ bool pvec_safereuse)
+ {
+- *occupied = false;
+- if (unlikely(ctor->next == NULL && type))
+- if (ctor->index + 1 == ctor->nr)
++ if (!ctor->next) {
++ /* some pages cannot be reused as pvec safely without I/O */
++ if (type == Z_EROFS_PAGE_TYPE_EXCLUSIVE && !pvec_safereuse)
++ type = Z_EROFS_VLE_PAGE_TYPE_TAIL_SHARED;
++
++ if (type != Z_EROFS_PAGE_TYPE_EXCLUSIVE &&
++ ctor->index + 1 == ctor->nr)
+ return false;
++ }
+
+ if (unlikely(ctor->index >= ctor->nr))
+ z_erofs_pagevec_ctor_pagedown(ctor, false);
+@@ -135,7 +140,6 @@ z_erofs_pagevec_ctor_enqueue(struct z_erofs_pagevec_ctor *ctor,
+ /* should remind that collector->next never equal to 1, 2 */
+ if (type == (uintptr_t)ctor->next) {
+ ctor->next = page;
+- *occupied = true;
+ }
+
+ ctor->pages[ctor->index++] =
+diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c
+index 0f1558c6747ef..83e4d9384bd2d 100644
+--- a/drivers/staging/erofs/unzip_vle.c
++++ b/drivers/staging/erofs/unzip_vle.c
+@@ -228,13 +228,12 @@ static inline bool try_to_reuse_as_compressed_page(
+ }
+
+ /* callers must be with work->lock held */
+-static int z_erofs_vle_work_add_page(
+- struct z_erofs_vle_work_builder *builder,
+- struct page *page,
+- enum z_erofs_page_type type)
++static int z_erofs_vle_work_add_page(struct z_erofs_vle_work_builder *builder,
++ struct page *page,
++ enum z_erofs_page_type type,
++ bool pvec_safereuse)
+ {
+ int ret;
+- bool occupied;
+
+ /* give priority for the compressed data storage */
+ if (builder->role >= Z_EROFS_VLE_WORK_PRIMARY &&
+@@ -242,10 +241,9 @@ static int z_erofs_vle_work_add_page(
+ try_to_reuse_as_compressed_page(builder, page))
+ return 0;
+
+- ret = z_erofs_pagevec_ctor_enqueue(&builder->vector,
+- page, type, &occupied);
++ ret = z_erofs_pagevec_ctor_enqueue(&builder->vector, page, type,
++ pvec_safereuse);
+ builder->work->vcnt += (unsigned)ret;
+-
+ return ret ? 0 : -EAGAIN;
+ }
+
+@@ -690,14 +688,15 @@ hitted:
+ tight &= builder_is_followed(builder);
+
+ retry:
+- err = z_erofs_vle_work_add_page(builder, page, page_type);
++ err = z_erofs_vle_work_add_page(builder, page, page_type,
++ builder_is_followed(builder));
+ /* should allocate an additional staging page for pagevec */
+ if (err == -EAGAIN) {
+ struct page *const newpage =
+ __stagingpage_alloc(page_pool, GFP_NOFS);
+
+ err = z_erofs_vle_work_add_page(builder,
+- newpage, Z_EROFS_PAGE_TYPE_EXCLUSIVE);
++ newpage, Z_EROFS_PAGE_TYPE_EXCLUSIVE, true);
+ if (likely(!err))
+ goto retry;
+ }
+diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
+index e46ca968009c0..804956c712a5a 100644
+--- a/drivers/target/target_core_alua.c
++++ b/drivers/target/target_core_alua.c
+@@ -1716,7 +1716,6 @@ int core_alua_set_tg_pt_gp_id(
+ pr_err("Maximum ALUA alua_tg_pt_gps_count:"
+ " 0x0000ffff reached\n");
+ spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
+- kmem_cache_free(t10_alua_tg_pt_gp_cache, tg_pt_gp);
+ return -ENOSPC;
+ }
+ again:
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index 22e97a93728db..1b381519c1649 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -790,6 +790,8 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
+ INIT_LIST_HEAD(&dev->t10_alua.lba_map_list);
+ spin_lock_init(&dev->t10_alua.lba_map_lock);
+
++ INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work);
++
+ dev->t10_wwn.t10_dev = dev;
+ dev->t10_alua.t10_dev = dev;
+
+diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
+index 0c66355879301..c7e1fadcc5cc5 100644
+--- a/drivers/target/target_core_internal.h
++++ b/drivers/target/target_core_internal.h
+@@ -151,6 +151,7 @@ void transport_clear_lun_ref(struct se_lun *);
+ void transport_send_task_abort(struct se_cmd *);
+ sense_reason_t target_cmd_size_check(struct se_cmd *cmd, unsigned int size);
+ void target_qf_do_work(struct work_struct *work);
++void target_do_delayed_work(struct work_struct *work);
+ bool target_check_wce(struct se_device *dev);
+ bool target_check_fua(struct se_device *dev);
+ void __target_execute_cmd(struct se_cmd *, bool);
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 9c60a090cfd17..64481a3a34d44 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1990,32 +1990,35 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
+ */
+ switch (cmd->sam_task_attr) {
+ case TCM_HEAD_TAG:
++ atomic_inc_mb(&dev->non_ordered);
+ pr_debug("Added HEAD_OF_QUEUE for CDB: 0x%02x\n",
+ cmd->t_task_cdb[0]);
+ return false;
+ case TCM_ORDERED_TAG:
+- atomic_inc_mb(&dev->dev_ordered_sync);
++ atomic_inc_mb(&dev->delayed_cmd_count);
+
+ pr_debug("Added ORDERED for CDB: 0x%02x to ordered list\n",
+ cmd->t_task_cdb[0]);
+-
+- /*
+- * Execute an ORDERED command if no other older commands
+- * exist that need to be completed first.
+- */
+- if (!atomic_read(&dev->simple_cmds))
+- return false;
+ break;
+ default:
+ /*
+ * For SIMPLE and UNTAGGED Task Attribute commands
+ */
+- atomic_inc_mb(&dev->simple_cmds);
++ atomic_inc_mb(&dev->non_ordered);
++
++ if (atomic_read(&dev->delayed_cmd_count) == 0)
++ return false;
+ break;
+ }
+
+- if (atomic_read(&dev->dev_ordered_sync) == 0)
+- return false;
++ if (cmd->sam_task_attr != TCM_ORDERED_TAG) {
++ atomic_inc_mb(&dev->delayed_cmd_count);
++ /*
++ * We will account for this when we dequeue from the delayed
++ * list.
++ */
++ atomic_dec_mb(&dev->non_ordered);
++ }
+
+ spin_lock(&dev->delayed_cmd_lock);
+ list_add_tail(&cmd->se_delayed_node, &dev->delayed_cmd_list);
+@@ -2023,6 +2026,12 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
+
+ pr_debug("Added CDB: 0x%02x Task Attr: 0x%02x to delayed CMD listn",
+ cmd->t_task_cdb[0], cmd->sam_task_attr);
++ /*
++ * We may have no non ordered cmds when this function started or we
++ * could have raced with the last simple/head cmd completing, so kick
++ * the delayed handler here.
++ */
++ schedule_work(&dev->delayed_cmd_work);
+ return true;
+ }
+
+@@ -2073,29 +2082,48 @@ EXPORT_SYMBOL(target_execute_cmd);
+ * Process all commands up to the last received ORDERED task attribute which
+ * requires another blocking boundary
+ */
+-static void target_restart_delayed_cmds(struct se_device *dev)
++void target_do_delayed_work(struct work_struct *work)
+ {
+- for (;;) {
++ struct se_device *dev = container_of(work, struct se_device,
++ delayed_cmd_work);
++
++ spin_lock(&dev->delayed_cmd_lock);
++ while (!dev->ordered_sync_in_progress) {
+ struct se_cmd *cmd;
+
+- spin_lock(&dev->delayed_cmd_lock);
+- if (list_empty(&dev->delayed_cmd_list)) {
+- spin_unlock(&dev->delayed_cmd_lock);
++ if (list_empty(&dev->delayed_cmd_list))
+ break;
+- }
+
+ cmd = list_entry(dev->delayed_cmd_list.next,
+ struct se_cmd, se_delayed_node);
++
++ if (cmd->sam_task_attr == TCM_ORDERED_TAG) {
++ /*
++ * Check if we started with:
++ * [ordered] [simple] [ordered]
++ * and we are now at the last ordered so we have to wait
++ * for the simple cmd.
++ */
++ if (atomic_read(&dev->non_ordered) > 0)
++ break;
++
++ dev->ordered_sync_in_progress = true;
++ }
++
+ list_del(&cmd->se_delayed_node);
++ atomic_dec_mb(&dev->delayed_cmd_count);
+ spin_unlock(&dev->delayed_cmd_lock);
+
++ if (cmd->sam_task_attr != TCM_ORDERED_TAG)
++ atomic_inc_mb(&dev->non_ordered);
++
+ cmd->transport_state |= CMD_T_SENT;
+
+ __target_execute_cmd(cmd, true);
+
+- if (cmd->sam_task_attr == TCM_ORDERED_TAG)
+- break;
++ spin_lock(&dev->delayed_cmd_lock);
+ }
++ spin_unlock(&dev->delayed_cmd_lock);
+ }
+
+ /*
+@@ -2113,14 +2141,17 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
+ goto restart;
+
+ if (cmd->sam_task_attr == TCM_SIMPLE_TAG) {
+- atomic_dec_mb(&dev->simple_cmds);
++ atomic_dec_mb(&dev->non_ordered);
+ dev->dev_cur_ordered_id++;
+ } else if (cmd->sam_task_attr == TCM_HEAD_TAG) {
++ atomic_dec_mb(&dev->non_ordered);
+ dev->dev_cur_ordered_id++;
+ pr_debug("Incremented dev_cur_ordered_id: %u for HEAD_OF_QUEUE\n",
+ dev->dev_cur_ordered_id);
+ } else if (cmd->sam_task_attr == TCM_ORDERED_TAG) {
+- atomic_dec_mb(&dev->dev_ordered_sync);
++ spin_lock(&dev->delayed_cmd_lock);
++ dev->ordered_sync_in_progress = false;
++ spin_unlock(&dev->delayed_cmd_lock);
+
+ dev->dev_cur_ordered_id++;
+ pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n",
+@@ -2129,7 +2160,8 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
+ cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET;
+
+ restart:
+- target_restart_delayed_cmds(dev);
++ if (atomic_read(&dev->delayed_cmd_count) > 0)
++ schedule_work(&dev->delayed_cmd_work);
+ }
+
+ static void transport_complete_qf(struct se_cmd *cmd)
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index 284e8d052fc3c..c73d0eddd9b8d 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -769,7 +769,7 @@ static struct platform_driver dw8250_platform_driver = {
+ .name = "dw-apb-uart",
+ .pm = &dw8250_pm_ops,
+ .of_match_table = dw8250_of_match,
+- .acpi_match_table = ACPI_PTR(dw8250_acpi_match),
++ .acpi_match_table = dw8250_acpi_match,
+ },
+ .probe = dw8250_probe,
+ .remove = dw8250_remove,
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 80fa06b16d9d7..5ed1327d284f9 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -219,7 +219,11 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state,
+ if (retval == 0) {
+ if (uart_console(uport) && uport->cons->cflag) {
+ tty->termios.c_cflag = uport->cons->cflag;
++ tty->termios.c_ispeed = uport->cons->ispeed;
++ tty->termios.c_ospeed = uport->cons->ospeed;
+ uport->cons->cflag = 0;
++ uport->cons->ispeed = 0;
++ uport->cons->ospeed = 0;
+ }
+ /*
+ * Initialise the hardware port settings.
+@@ -287,8 +291,11 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
+ /*
+ * Turn off DTR and RTS early.
+ */
+- if (uport && uart_console(uport) && tty)
++ if (uport && uart_console(uport) && tty) {
+ uport->cons->cflag = tty->termios.c_cflag;
++ uport->cons->ispeed = tty->termios.c_ispeed;
++ uport->cons->ospeed = tty->termios.c_ospeed;
++ }
+
+ if (!tty || C_HUPCL(tty))
+ uart_port_dtr_rts(uport, 0);
+@@ -2062,8 +2069,11 @@ uart_set_options(struct uart_port *port, struct console *co,
+ * Allow the setting of the UART parameters with a NULL console
+ * too:
+ */
+- if (co)
++ if (co) {
+ co->cflag = termios.c_cflag;
++ co->ispeed = termios.c_ispeed;
++ co->ospeed = termios.c_ospeed;
++ }
+
+ return 0;
+ }
+@@ -2197,6 +2207,8 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
+ */
+ memset(&termios, 0, sizeof(struct ktermios));
+ termios.c_cflag = uport->cons->cflag;
++ termios.c_ispeed = uport->cons->ispeed;
++ termios.c_ospeed = uport->cons->ospeed;
+
+ /*
+ * If that's unset, use the tty termios setting.
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index 23f9b0cdff086..c22bd40fc6f0b 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -591,9 +591,10 @@ static void cdns_uart_start_tx(struct uart_port *port)
+ if (uart_circ_empty(&port->state->xmit))
+ return;
+
++ writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR);
++
+ cdns_uart_handle_tx(port);
+
+- writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR);
+ /* Enable the TX Empty interrupt */
+ writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_IER);
+ }
+diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
+index ee3aa57bc0e7b..6b0cb633679d9 100644
+--- a/drivers/tty/tty_buffer.c
++++ b/drivers/tty/tty_buffer.c
+@@ -529,6 +529,9 @@ static void flush_to_ldisc(struct work_struct *work)
+ if (!count)
+ break;
+ head->read += count;
++
++ if (need_resched())
++ cond_resched();
+ }
+
+ mutex_unlock(&buf->lock);
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index befd9235bcad8..c13f9a153a5c6 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -532,7 +532,7 @@ int hw_device_reset(struct ci_hdrc *ci)
+ return 0;
+ }
+
+-static irqreturn_t ci_irq(int irq, void *data)
++static irqreturn_t ci_irq_handler(int irq, void *data)
+ {
+ struct ci_hdrc *ci = data;
+ irqreturn_t ret = IRQ_NONE;
+@@ -585,6 +585,15 @@ static irqreturn_t ci_irq(int irq, void *data)
+ return ret;
+ }
+
++static void ci_irq(struct ci_hdrc *ci)
++{
++ unsigned long flags;
++
++ local_irq_save(flags);
++ ci_irq_handler(ci->irq, ci);
++ local_irq_restore(flags);
++}
++
+ static int ci_cable_notifier(struct notifier_block *nb, unsigned long event,
+ void *ptr)
+ {
+@@ -594,7 +603,7 @@ static int ci_cable_notifier(struct notifier_block *nb, unsigned long event,
+ cbl->connected = event;
+ cbl->changed = true;
+
+- ci_irq(ci->irq, ci);
++ ci_irq(ci);
+ return NOTIFY_DONE;
+ }
+
+@@ -1048,7 +1057,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+ }
+ }
+
+- ret = devm_request_irq(dev, ci->irq, ci_irq, IRQF_SHARED,
++ ret = devm_request_irq(dev, ci->irq, ci_irq_handler, IRQF_SHARED,
+ ci->platdata->name, ci);
+ if (ret)
+ goto stop;
+@@ -1170,11 +1179,11 @@ static void ci_extcon_wakeup_int(struct ci_hdrc *ci)
+
+ if (!IS_ERR(cable_id->edev) && ci->is_otg &&
+ (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS))
+- ci_irq(ci->irq, ci);
++ ci_irq(ci);
+
+ if (!IS_ERR(cable_vbus->edev) && ci->is_otg &&
+ (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS))
+- ci_irq(ci->irq, ci);
++ ci_irq(ci);
+ }
+
+ static int ci_controller_resume(struct device *dev)
+diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c
+index 5b27d289443fe..3912cc805f3af 100644
+--- a/drivers/usb/gadget/legacy/hid.c
++++ b/drivers/usb/gadget/legacy/hid.c
+@@ -99,8 +99,10 @@ static int do_config(struct usb_configuration *c)
+
+ list_for_each_entry(e, &hidg_func_list, node) {
+ e->f = usb_get_function(e->fi);
+- if (IS_ERR(e->f))
++ if (IS_ERR(e->f)) {
++ status = PTR_ERR(e->f);
+ goto put;
++ }
+ status = usb_add_function(c, e->f);
+ if (status < 0) {
+ usb_put_function(e->f);
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index 16efe37b7558c..507ef3acbf0c1 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -125,8 +125,6 @@ struct max3421_hcd {
+
+ struct task_struct *spi_thread;
+
+- struct max3421_hcd *next;
+-
+ enum max3421_rh_state rh_state;
+ /* lower 16 bits contain port status, upper 16 bits the change mask: */
+ u32 port_status;
+@@ -174,8 +172,6 @@ struct max3421_ep {
+ u8 retransmit; /* packet needs retransmission */
+ };
+
+-static struct max3421_hcd *max3421_hcd_list;
+-
+ #define MAX3421_FIFO_SIZE 64
+
+ #define MAX3421_SPI_DIR_RD 0 /* read register from MAX3421 */
+@@ -1899,9 +1895,8 @@ max3421_probe(struct spi_device *spi)
+ }
+ set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ max3421_hcd = hcd_to_max3421(hcd);
+- max3421_hcd->next = max3421_hcd_list;
+- max3421_hcd_list = max3421_hcd;
+ INIT_LIST_HEAD(&max3421_hcd->ep_list);
++ spi_set_drvdata(spi, max3421_hcd);
+
+ max3421_hcd->tx = kmalloc(sizeof(*max3421_hcd->tx), GFP_KERNEL);
+ if (!max3421_hcd->tx)
+@@ -1951,28 +1946,18 @@ error:
+ static int
+ max3421_remove(struct spi_device *spi)
+ {
+- struct max3421_hcd *max3421_hcd = NULL, **prev;
+- struct usb_hcd *hcd = NULL;
++ struct max3421_hcd *max3421_hcd;
++ struct usb_hcd *hcd;
+ unsigned long flags;
+
+- for (prev = &max3421_hcd_list; *prev; prev = &(*prev)->next) {
+- max3421_hcd = *prev;
+- hcd = max3421_to_hcd(max3421_hcd);
+- if (hcd->self.controller == &spi->dev)
+- break;
+- }
+- if (!max3421_hcd) {
+- dev_err(&spi->dev, "no MAX3421 HCD found for SPI device %p\n",
+- spi);
+- return -ENODEV;
+- }
++ max3421_hcd = spi_get_drvdata(spi);
++ hcd = max3421_to_hcd(max3421_hcd);
+
+ usb_remove_hcd(hcd);
+
+ spin_lock_irqsave(&max3421_hcd->lock, flags);
+
+ kthread_stop(max3421_hcd->spi_thread);
+- *prev = max3421_hcd->next;
+
+ spin_unlock_irqrestore(&max3421_hcd->lock, flags);
+
+diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c
+index 983a00e2988dc..702d78e0d903a 100644
+--- a/drivers/usb/host/ohci-tmio.c
++++ b/drivers/usb/host/ohci-tmio.c
+@@ -196,7 +196,7 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev)
+ if (usb_disabled())
+ return -ENODEV;
+
+- if (!cell)
++ if (!cell || !regs || !config || !sram)
+ return -EINVAL;
+
+ if (irq < 0)
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 9143e74b70512..224d0bdda82ff 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -171,7 +171,6 @@ static void xhci_common_hub_descriptor(struct xhci_hcd *xhci,
+ {
+ u16 temp;
+
+- desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.9 says 20ms max */
+ desc->bHubContrCurrent = 0;
+
+ desc->bNbrPorts = ports;
+@@ -206,6 +205,7 @@ static void xhci_usb2_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci,
+ desc->bDescriptorType = USB_DT_HUB;
+ temp = 1 + (ports / 8);
+ desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * temp;
++ desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.8 says 20ms */
+
+ /* The Device Removable bits are reported on a byte granularity.
+ * If the port doesn't exist within that byte, the bit is set to 0.
+@@ -258,6 +258,7 @@ static void xhci_usb3_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci,
+ xhci_common_hub_descriptor(xhci, desc, ports);
+ desc->bDescriptorType = USB_DT_SS_HUB;
+ desc->bDescLength = USB_DT_SS_HUB_SIZE;
++ desc->bPwrOn2PwrGood = 50; /* usb 3.1 may fail if less than 100ms */
+
+ /* header decode latency should be zero for roothubs,
+ * see section 4.23.5.2.
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index 9c1ca20d4139d..07d6bc63be969 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -103,10 +103,6 @@ struct iowarrior {
+ /* globals */
+ /*--------------*/
+
+-/*
+- * USB spec identifies 5 second timeouts.
+- */
+-#define GET_TIMEOUT 5
+ #define USB_REQ_GET_REPORT 0x01
+ //#if 0
+ static int usb_get_report(struct usb_device *dev,
+@@ -118,7 +114,7 @@ static int usb_get_report(struct usb_device *dev,
+ USB_DIR_IN | USB_TYPE_CLASS |
+ USB_RECIP_INTERFACE, (type << 8) + id,
+ inter->desc.bInterfaceNumber, buf, size,
+- GET_TIMEOUT*HZ);
++ USB_CTRL_GET_TIMEOUT);
+ }
+ //#endif
+
+@@ -133,7 +129,7 @@ static int usb_set_report(struct usb_interface *intf, unsigned char type,
+ USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+ (type << 8) + id,
+ intf->cur_altsetting->desc.bInterfaceNumber, buf,
+- size, HZ);
++ size, 1000);
+ }
+
+ /*---------------------*/
+diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
+index 4ecfbf6bb1fa8..902507da8aa85 100644
+--- a/drivers/usb/musb/tusb6010.c
++++ b/drivers/usb/musb/tusb6010.c
+@@ -1103,6 +1103,11 @@ static int tusb_musb_init(struct musb *musb)
+
+ /* dma address for async dma */
+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!mem) {
++ pr_debug("no async dma resource?\n");
++ ret = -ENODEV;
++ goto done;
++ }
+ musb->async = mem->start;
+
+ /* dma address for sync dma */
+diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
+index aa3dbce22cfbe..451759f38b573 100644
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -2910,22 +2910,22 @@ static int keyspan_port_probe(struct usb_serial_port *port)
+ for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) {
+ p_priv->in_buffer[i] = kzalloc(IN_BUFLEN, GFP_KERNEL);
+ if (!p_priv->in_buffer[i])
+- goto err_in_buffer;
++ goto err_free_in_buffer;
+ }
+
+ for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) {
+ p_priv->out_buffer[i] = kzalloc(OUT_BUFLEN, GFP_KERNEL);
+ if (!p_priv->out_buffer[i])
+- goto err_out_buffer;
++ goto err_free_out_buffer;
+ }
+
+ p_priv->inack_buffer = kzalloc(INACK_BUFLEN, GFP_KERNEL);
+ if (!p_priv->inack_buffer)
+- goto err_inack_buffer;
++ goto err_free_out_buffer;
+
+ p_priv->outcont_buffer = kzalloc(OUTCONT_BUFLEN, GFP_KERNEL);
+ if (!p_priv->outcont_buffer)
+- goto err_outcont_buffer;
++ goto err_free_inack_buffer;
+
+ p_priv->device_details = d_details;
+
+@@ -2971,15 +2971,14 @@ static int keyspan_port_probe(struct usb_serial_port *port)
+
+ return 0;
+
+-err_outcont_buffer:
++err_free_inack_buffer:
+ kfree(p_priv->inack_buffer);
+-err_inack_buffer:
++err_free_out_buffer:
+ for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i)
+ kfree(p_priv->out_buffer[i]);
+-err_out_buffer:
++err_free_in_buffer:
+ for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i)
+ kfree(p_priv->in_buffer[i]);
+-err_in_buffer:
+ kfree(p_priv);
+
+ return -ENOMEM;
+diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c
+index 987b8fcfb2aae..a4dd23a8f1954 100644
+--- a/drivers/usb/typec/tps6598x.c
++++ b/drivers/usb/typec/tps6598x.c
+@@ -93,7 +93,7 @@ tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len)
+ u8 data[TPS_MAX_LEN + 1];
+ int ret;
+
+- if (WARN_ON(len + 1 > sizeof(data)))
++ if (len + 1 > sizeof(data))
+ return -EINVAL;
+
+ if (!tps->i2c_protocol)
+diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
+index deb824bef6e21..e2caea41c6278 100644
+--- a/drivers/video/backlight/backlight.c
++++ b/drivers/video/backlight/backlight.c
+@@ -610,12 +610,6 @@ struct backlight_device *of_find_backlight(struct device *dev)
+ of_node_put(np);
+ if (!bd)
+ return ERR_PTR(-EPROBE_DEFER);
+- /*
+- * Note: gpio_backlight uses brightness as
+- * power state during probe
+- */
+- if (!bd->props.brightness)
+- bd->props.brightness = bd->props.max_brightness;
+ }
+ }
+
+diff --git a/drivers/video/backlight/gpio_backlight.c b/drivers/video/backlight/gpio_backlight.c
+index e470da95d806f..51c49f03ed835 100644
+--- a/drivers/video/backlight/gpio_backlight.c
++++ b/drivers/video/backlight/gpio_backlight.c
+@@ -62,13 +62,11 @@ static int gpio_backlight_probe_dt(struct platform_device *pdev,
+ {
+ struct device *dev = &pdev->dev;
+ struct device_node *np = dev->of_node;
+- enum gpiod_flags flags;
+ int ret;
+
+ gbl->def_value = of_property_read_bool(np, "default-on");
+- flags = gbl->def_value ? GPIOD_OUT_HIGH : GPIOD_OUT_LOW;
+
+- gbl->gpiod = devm_gpiod_get(dev, NULL, flags);
++ gbl->gpiod = devm_gpiod_get(dev, NULL, GPIOD_ASIS);
+ if (IS_ERR(gbl->gpiod)) {
+ ret = PTR_ERR(gbl->gpiod);
+
+@@ -82,6 +80,22 @@ static int gpio_backlight_probe_dt(struct platform_device *pdev,
+ return 0;
+ }
+
++static int gpio_backlight_initial_power_state(struct gpio_backlight *gbl)
++{
++ struct device_node *node = gbl->dev->of_node;
++
++ /* Not booted with device tree or no phandle link to the node */
++ if (!node || !node->phandle)
++ return gbl->def_value ? FB_BLANK_UNBLANK : FB_BLANK_POWERDOWN;
++
++ /* if the enable GPIO is disabled, do not enable the backlight */
++ if (gpiod_get_value_cansleep(gbl->gpiod) == 0)
++ return FB_BLANK_POWERDOWN;
++
++ return FB_BLANK_UNBLANK;
++}
++
++
+ static int gpio_backlight_probe(struct platform_device *pdev)
+ {
+ struct gpio_backlight_platform_data *pdata =
+@@ -142,7 +156,9 @@ static int gpio_backlight_probe(struct platform_device *pdev)
+ return PTR_ERR(bl);
+ }
+
+- bl->props.brightness = gbl->def_value;
++ bl->props.power = gpio_backlight_initial_power_state(gbl);
++ bl->props.brightness = 1;
++
+ backlight_update_status(bl);
+
+ platform_set_drvdata(pdev, bl);
+diff --git a/drivers/video/console/sticon.c b/drivers/video/console/sticon.c
+index 79c9bd8d30254..559a7305cadaa 100644
+--- a/drivers/video/console/sticon.c
++++ b/drivers/video/console/sticon.c
+@@ -291,13 +291,13 @@ static unsigned long sticon_getxy(struct vc_data *conp, unsigned long pos,
+ static u8 sticon_build_attr(struct vc_data *conp, u8 color, u8 intens,
+ u8 blink, u8 underline, u8 reverse, u8 italic)
+ {
+- u8 attr = ((color & 0x70) >> 1) | ((color & 7));
++ u8 fg = color & 7;
++ u8 bg = (color & 0x70) >> 4;
+
+- if (reverse) {
+- color = ((color >> 3) & 0x7) | ((color & 0x7) << 3);
+- }
+-
+- return attr;
++ if (reverse)
++ return (fg << 3) | bg;
++ else
++ return (bg << 3) | fg;
+ }
+
+ static void sticon_invert_region(struct vc_data *conp, u16 *p, int count)
+diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
+index f9b366d175875..413b465e69d8e 100644
+--- a/drivers/video/fbdev/chipsfb.c
++++ b/drivers/video/fbdev/chipsfb.c
+@@ -332,7 +332,7 @@ static const struct fb_var_screeninfo chipsfb_var = {
+
+ static void init_chips(struct fb_info *p, unsigned long addr)
+ {
+- memset(p->screen_base, 0, 0x100000);
++ fb_memset(p->screen_base, 0, 0x100000);
+
+ p->fix = chipsfb_fix;
+ p->fix.smem_start = addr;
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index fa7f4c61524d9..92fdc7dc2ede5 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -1524,7 +1524,7 @@ config SIBYTE_WDOG
+
+ config AR7_WDT
+ tristate "TI AR7 Watchdog Timer"
+- depends on AR7 || (MIPS && COMPILE_TEST)
++ depends on AR7 || (MIPS && 32BIT && COMPILE_TEST)
+ help
+ Hardware driver for the TI AR7 Watchdog Timer.
+
+diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
+index 5d0ea419070dc..6b751d1aab084 100644
+--- a/drivers/watchdog/f71808e_wdt.c
++++ b/drivers/watchdog/f71808e_wdt.c
+@@ -237,15 +237,17 @@ static int watchdog_set_timeout(int timeout)
+
+ mutex_lock(&watchdog.lock);
+
+- watchdog.timeout = timeout;
+ if (timeout > 0xff) {
+ watchdog.timer_val = DIV_ROUND_UP(timeout, 60);
+ watchdog.minutes_mode = true;
++ timeout = watchdog.timer_val * 60;
+ } else {
+ watchdog.timer_val = timeout;
+ watchdog.minutes_mode = false;
+ }
+
++ watchdog.timeout = timeout;
++
+ mutex_unlock(&watchdog.lock);
+
+ return 0;
+diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
+index cbd752f9ac563..7376ba56cdf2e 100644
+--- a/drivers/watchdog/omap_wdt.c
++++ b/drivers/watchdog/omap_wdt.c
+@@ -272,8 +272,12 @@ static int omap_wdt_probe(struct platform_device *pdev)
+ wdev->wdog.bootstatus = WDIOF_CARDRESET;
+ }
+
+- if (!early_enable)
++ if (early_enable) {
++ omap_wdt_start(&wdev->wdog);
++ set_bit(WDOG_HW_RUNNING, &wdev->wdog.status);
++ } else {
+ omap_wdt_disable(wdev);
++ }
+
+ ret = watchdog_register_device(&wdev->wdog);
+ if (ret) {
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index 19906020eb145..4f4a47ae72b11 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -58,6 +58,7 @@
+ #include <linux/percpu-defs.h>
+ #include <linux/slab.h>
+ #include <linux/sysctl.h>
++#include <linux/moduleparam.h>
+
+ #include <asm/page.h>
+ #include <asm/pgalloc.h>
+@@ -75,6 +76,12 @@
+ #include <xen/page.h>
+ #include <xen/mem-reservation.h>
+
++#undef MODULE_PARAM_PREFIX
++#define MODULE_PARAM_PREFIX "xen."
++
++static uint __read_mostly balloon_boot_timeout = 180;
++module_param(balloon_boot_timeout, uint, 0444);
++
+ static int xen_hotplug_unpopulated;
+
+ #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+@@ -130,12 +137,12 @@ static struct ctl_table xen_root[] = {
+ * BP_ECANCELED: error, balloon operation canceled.
+ */
+
+-enum bp_state {
++static enum bp_state {
+ BP_DONE,
+ BP_WAIT,
+ BP_EAGAIN,
+ BP_ECANCELED
+-};
++} balloon_state = BP_DONE;
+
+ /* Main waiting point for xen-balloon thread. */
+ static DECLARE_WAIT_QUEUE_HEAD(balloon_thread_wq);
+@@ -206,18 +213,15 @@ static struct page *balloon_next_page(struct page *page)
+ return list_entry(next, struct page, lru);
+ }
+
+-static enum bp_state update_schedule(enum bp_state state)
++static void update_schedule(void)
+ {
+- if (state == BP_WAIT)
+- return BP_WAIT;
+-
+- if (state == BP_ECANCELED)
+- return BP_ECANCELED;
++ if (balloon_state == BP_WAIT || balloon_state == BP_ECANCELED)
++ return;
+
+- if (state == BP_DONE) {
++ if (balloon_state == BP_DONE) {
+ balloon_stats.schedule_delay = 1;
+ balloon_stats.retry_count = 1;
+- return BP_DONE;
++ return;
+ }
+
+ ++balloon_stats.retry_count;
+@@ -226,7 +230,8 @@ static enum bp_state update_schedule(enum bp_state state)
+ balloon_stats.retry_count > balloon_stats.max_retry_count) {
+ balloon_stats.schedule_delay = 1;
+ balloon_stats.retry_count = 1;
+- return BP_ECANCELED;
++ balloon_state = BP_ECANCELED;
++ return;
+ }
+
+ balloon_stats.schedule_delay <<= 1;
+@@ -234,7 +239,7 @@ static enum bp_state update_schedule(enum bp_state state)
+ if (balloon_stats.schedule_delay > balloon_stats.max_schedule_delay)
+ balloon_stats.schedule_delay = balloon_stats.max_schedule_delay;
+
+- return BP_EAGAIN;
++ balloon_state = BP_EAGAIN;
+ }
+
+ #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+@@ -511,9 +516,9 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
+ * Stop waiting if either state is BP_DONE and ballooning action is
+ * needed, or if the credit has changed while state is not BP_DONE.
+ */
+-static bool balloon_thread_cond(enum bp_state state, long credit)
++static bool balloon_thread_cond(long credit)
+ {
+- if (state == BP_DONE)
++ if (balloon_state == BP_DONE)
+ credit = 0;
+
+ return current_credit() != credit || kthread_should_stop();
+@@ -527,13 +532,12 @@ static bool balloon_thread_cond(enum bp_state state, long credit)
+ */
+ static int balloon_thread(void *unused)
+ {
+- enum bp_state state = BP_DONE;
+ long credit;
+ unsigned long timeout;
+
+ set_freezable();
+ for (;;) {
+- switch (state) {
++ switch (balloon_state) {
+ case BP_DONE:
+ case BP_ECANCELED:
+ timeout = 3600 * HZ;
+@@ -549,7 +553,7 @@ static int balloon_thread(void *unused)
+ credit = current_credit();
+
+ wait_event_freezable_timeout(balloon_thread_wq,
+- balloon_thread_cond(state, credit), timeout);
++ balloon_thread_cond(credit), timeout);
+
+ if (kthread_should_stop())
+ return 0;
+@@ -560,22 +564,23 @@ static int balloon_thread(void *unused)
+
+ if (credit > 0) {
+ if (balloon_is_inflated())
+- state = increase_reservation(credit);
++ balloon_state = increase_reservation(credit);
+ else
+- state = reserve_additional_memory();
++ balloon_state = reserve_additional_memory();
+ }
+
+ if (credit < 0) {
+ long n_pages;
+
+ n_pages = min(-credit, si_mem_available());
+- state = decrease_reservation(n_pages, GFP_BALLOON);
+- if (state == BP_DONE && n_pages != -credit &&
++ balloon_state = decrease_reservation(n_pages,
++ GFP_BALLOON);
++ if (balloon_state == BP_DONE && n_pages != -credit &&
+ n_pages < totalreserve_pages)
+- state = BP_EAGAIN;
++ balloon_state = BP_EAGAIN;
+ }
+
+- state = update_schedule(state);
++ update_schedule();
+
+ mutex_unlock(&balloon_mutex);
+
+@@ -784,3 +789,38 @@ static int __init balloon_init(void)
+ return 0;
+ }
+ subsys_initcall(balloon_init);
++
++static int __init balloon_wait_finish(void)
++{
++ long credit, last_credit = 0;
++ unsigned long last_changed = 0;
++
++ if (!xen_domain())
++ return -ENODEV;
++
++ /* PV guests don't need to wait. */
++ if (xen_pv_domain() || !current_credit())
++ return 0;
++
++ pr_notice("Waiting for initial ballooning down having finished.\n");
++
++ while ((credit = current_credit()) < 0) {
++ if (credit != last_credit) {
++ last_changed = jiffies;
++ last_credit = credit;
++ }
++ if (balloon_state == BP_ECANCELED) {
++ pr_warn_once("Initial ballooning failed, %ld pages need to be freed.\n",
++ -credit);
++ if (jiffies - last_changed >= HZ * balloon_boot_timeout)
++ panic("Initial ballooning failed!\n");
++ }
++
++ schedule_timeout_interruptible(HZ / 10);
++ }
++
++ pr_notice("Initial ballooning down finished.\n");
++
++ return 0;
++}
++late_initcall_sync(balloon_wait_finish);
+diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c
+index e5694133ebe57..42f0f64fcba47 100644
+--- a/drivers/xen/xen-pciback/conf_space_capability.c
++++ b/drivers/xen/xen-pciback/conf_space_capability.c
+@@ -160,7 +160,7 @@ static void *pm_ctrl_init(struct pci_dev *dev, int offset)
+ }
+
+ out:
+- return ERR_PTR(err);
++ return err ? ERR_PTR(err) : NULL;
+ }
+
+ static const struct config_field caplist_pm[] = {
+diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
+index f79c0cb7697ac..21f8f475c894e 100644
+--- a/fs/btrfs/async-thread.c
++++ b/fs/btrfs/async-thread.c
+@@ -270,6 +270,13 @@ static void run_ordered_work(struct __btrfs_workqueue *wq,
+ ordered_list);
+ if (!test_bit(WORK_DONE_BIT, &work->flags))
+ break;
++ /*
++ * Orders all subsequent loads after reading WORK_DONE_BIT,
++ * paired with the smp_mb__before_atomic in btrfs_work_helper
++ * this guarantees that the ordered function will see all
++ * updates from ordinary work function.
++ */
++ smp_rmb();
+
+ /*
+ * we are going to call the ordered done function, but
+@@ -355,6 +362,13 @@ static void normal_work_helper(struct btrfs_work *work)
+ thresh_exec_hook(wq);
+ work->func(work);
+ if (need_order) {
++ /*
++ * Ensures all memory accesses done in the work function are
++ * ordered before setting the WORK_DONE_BIT. Ensuring the thread
++ * which is going to executed the ordered work sees them.
++ * Pairs with the smp_rmb in run_ordered_work.
++ */
++ smp_mb__before_atomic();
+ set_bit(WORK_DONE_BIT, &work->flags);
+ run_ordered_work(wq, work);
+ }
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index cb21ffd3bba7c..c326535d5a80a 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -3095,7 +3095,8 @@ retry_root_backup:
+ goto fail_sysfs;
+ }
+
+- if (!sb_rdonly(sb) && !btrfs_check_rw_degradable(fs_info, NULL)) {
++ if (!sb_rdonly(sb) && fs_info->fs_devices->missing_devices &&
++ !btrfs_check_rw_degradable(fs_info, NULL)) {
+ btrfs_warn(fs_info,
+ "writeable mount is not allowed due to too many missing devices");
+ goto fail_sysfs;
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index c856c32cc926c..1f5facdd19dca 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -2412,7 +2412,9 @@ again:
+ else {
+ ret = find_dir_range(log, path, dirid, key_type,
+ &range_start, &range_end);
+- if (ret != 0)
++ if (ret < 0)
++ goto out;
++ else if (ret > 0)
+ break;
+ }
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 6cb4896256106..8f05e6a472c32 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -1051,8 +1051,10 @@ static void btrfs_close_one_device(struct btrfs_device *device)
+ if (device->devid == BTRFS_DEV_REPLACE_DEVID)
+ clear_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state);
+
+- if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
++ if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) {
++ clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state);
+ fs_devices->missing_devices--;
++ }
+
+ btrfs_close_bdev(device);
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 9ae3b6dd72fe8..fab2092856a27 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3026,8 +3026,8 @@ static int ext4_run_li_request(struct ext4_li_request *elr)
+ struct ext4_group_desc *gdp = NULL;
+ ext4_group_t group, ngroups;
+ struct super_block *sb;
+- unsigned long timeout = 0;
+ int ret = 0;
++ u64 start_time;
+
+ sb = elr->lr_super;
+ ngroups = EXT4_SB(sb)->s_groups_count;
+@@ -3047,13 +3047,12 @@ static int ext4_run_li_request(struct ext4_li_request *elr)
+ ret = 1;
+
+ if (!ret) {
+- timeout = jiffies;
++ start_time = ktime_get_real_ns();
+ ret = ext4_init_inode_table(sb, group,
+ elr->lr_timeout ? 0 : 1);
+ if (elr->lr_timeout == 0) {
+- timeout = (jiffies - timeout) *
+- elr->lr_sbi->s_li_wait_mult;
+- elr->lr_timeout = timeout;
++ elr->lr_timeout = nsecs_to_jiffies((ktime_get_real_ns() - start_time) *
++ elr->lr_sbi->s_li_wait_mult);
+ }
+ elr->lr_next_sched = jiffies + elr->lr_timeout;
+ elr->lr_next_group = group + 1;
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index a01be7d8db867..15ff5d9b8c056 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -454,7 +454,7 @@ make_now:
+ inode->i_op = &f2fs_dir_inode_operations;
+ inode->i_fop = &f2fs_dir_operations;
+ inode->i_mapping->a_ops = &f2fs_dblock_aops;
+- inode_nohighmem(inode);
++ mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
+ } else if (S_ISLNK(inode->i_mode)) {
+ if (f2fs_encrypted_inode(inode))
+ inode->i_op = &f2fs_encrypted_symlink_inode_operations;
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index edc80855974ac..9e4c38481830d 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -656,7 +656,7 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+ inode->i_op = &f2fs_dir_inode_operations;
+ inode->i_fop = &f2fs_dir_operations;
+ inode->i_mapping->a_ops = &f2fs_dblock_aops;
+- inode_nohighmem(inode);
++ mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
+
+ set_inode_flag(inode, FI_INC_LINK);
+ f2fs_lock_op(sbi);
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 6a3d89672ff71..13371a40f7a15 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -178,12 +178,11 @@ void fuse_finish_open(struct inode *inode, struct file *file)
+
+ if (ff->open_flags & FOPEN_DIRECT_IO)
+ file->f_op = &fuse_direct_io_file_operations;
+- if (!(ff->open_flags & FOPEN_KEEP_CACHE))
+- invalidate_inode_pages2(inode->i_mapping);
+ if (ff->open_flags & FOPEN_STREAM)
+ stream_open(inode, file);
+ else if (ff->open_flags & FOPEN_NONSEEKABLE)
+ nonseekable_open(inode, file);
++
+ if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) {
+ struct fuse_inode *fi = get_fuse_inode(inode);
+
+@@ -191,10 +190,14 @@ void fuse_finish_open(struct inode *inode, struct file *file)
+ fi->attr_version = ++fc->attr_version;
+ i_size_write(inode, 0);
+ spin_unlock(&fc->lock);
++ truncate_pagecache(inode, 0);
+ fuse_invalidate_attr(inode);
+ if (fc->writeback_cache)
+ file_update_time(file);
++ } else if (!(ff->open_flags & FOPEN_KEEP_CACHE)) {
++ invalidate_inode_pages2(inode->i_mapping);
+ }
++
+ if ((file->f_mode & FMODE_WRITE) && fc->writeback_cache)
+ fuse_link_write_file(file);
+ }
+diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
+index b5214c9ac47ac..f1a705d159043 100644
+--- a/fs/jfs/jfs_mount.c
++++ b/fs/jfs/jfs_mount.c
+@@ -93,14 +93,14 @@ int jfs_mount(struct super_block *sb)
+ * (initialize mount inode from the superblock)
+ */
+ if ((rc = chkSuper(sb))) {
+- goto errout20;
++ goto out;
+ }
+
+ ipaimap = diReadSpecial(sb, AGGREGATE_I, 0);
+ if (ipaimap == NULL) {
+ jfs_err("jfs_mount: Failed to read AGGREGATE_I");
+ rc = -EIO;
+- goto errout20;
++ goto out;
+ }
+ sbi->ipaimap = ipaimap;
+
+@@ -111,7 +111,7 @@ int jfs_mount(struct super_block *sb)
+ */
+ if ((rc = diMount(ipaimap))) {
+ jfs_err("jfs_mount: diMount(ipaimap) failed w/rc = %d", rc);
+- goto errout21;
++ goto err_ipaimap;
+ }
+
+ /*
+@@ -120,7 +120,7 @@ int jfs_mount(struct super_block *sb)
+ ipbmap = diReadSpecial(sb, BMAP_I, 0);
+ if (ipbmap == NULL) {
+ rc = -EIO;
+- goto errout22;
++ goto err_umount_ipaimap;
+ }
+
+ jfs_info("jfs_mount: ipbmap:0x%p", ipbmap);
+@@ -132,7 +132,7 @@ int jfs_mount(struct super_block *sb)
+ */
+ if ((rc = dbMount(ipbmap))) {
+ jfs_err("jfs_mount: dbMount failed w/rc = %d", rc);
+- goto errout22;
++ goto err_ipbmap;
+ }
+
+ /*
+@@ -151,7 +151,7 @@ int jfs_mount(struct super_block *sb)
+ if (!ipaimap2) {
+ jfs_err("jfs_mount: Failed to read AGGREGATE_I");
+ rc = -EIO;
+- goto errout35;
++ goto err_umount_ipbmap;
+ }
+ sbi->ipaimap2 = ipaimap2;
+
+@@ -163,7 +163,7 @@ int jfs_mount(struct super_block *sb)
+ if ((rc = diMount(ipaimap2))) {
+ jfs_err("jfs_mount: diMount(ipaimap2) failed, rc = %d",
+ rc);
+- goto errout35;
++ goto err_ipaimap2;
+ }
+ } else
+ /* Secondary aggregate inode table is not valid */
+@@ -180,7 +180,7 @@ int jfs_mount(struct super_block *sb)
+ jfs_err("jfs_mount: Failed to read FILESYSTEM_I");
+ /* open fileset secondary inode allocation map */
+ rc = -EIO;
+- goto errout40;
++ goto err_umount_ipaimap2;
+ }
+ jfs_info("jfs_mount: ipimap:0x%p", ipimap);
+
+@@ -190,41 +190,34 @@ int jfs_mount(struct super_block *sb)
+ /* initialize fileset inode allocation map */
+ if ((rc = diMount(ipimap))) {
+ jfs_err("jfs_mount: diMount failed w/rc = %d", rc);
+- goto errout41;
++ goto err_ipimap;
+ }
+
+- goto out;
++ return rc;
+
+ /*
+ * unwind on error
+ */
+- errout41: /* close fileset inode allocation map inode */
++err_ipimap:
++ /* close fileset inode allocation map inode */
+ diFreeSpecial(ipimap);
+-
+- errout40: /* fileset closed */
+-
++err_umount_ipaimap2:
+ /* close secondary aggregate inode allocation map */
+- if (ipaimap2) {
++ if (ipaimap2)
+ diUnmount(ipaimap2, 1);
++err_ipaimap2:
++ /* close aggregate inodes */
++ if (ipaimap2)
+ diFreeSpecial(ipaimap2);
+- }
+-
+- errout35:
+-
+- /* close aggregate block allocation map */
++err_umount_ipbmap: /* close aggregate block allocation map */
+ dbUnmount(ipbmap, 1);
++err_ipbmap: /* close aggregate inodes */
+ diFreeSpecial(ipbmap);
+-
+- errout22: /* close aggregate inode allocation map */
+-
++err_umount_ipaimap: /* close aggregate inode allocation map */
+ diUnmount(ipaimap, 1);
+-
+- errout21: /* close aggregate inodes */
++err_ipaimap: /* close aggregate inodes */
+ diFreeSpecial(ipaimap);
+- errout20: /* aggregate closed */
+-
+- out:
+-
++out:
+ if (rc)
+ jfs_err("Mount JFS Failure: %d", rc);
+
+diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+index 8da239b6cc16f..f1f0519f1ecef 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+@@ -429,10 +429,10 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
+ goto out_fail;
+
+ ds = mirror->mirror_ds->ds;
++ if (READ_ONCE(ds->ds_clp))
++ goto out;
+ /* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */
+ smp_rmb();
+- if (ds->ds_clp)
+- goto out;
+
+ /* FIXME: For now we assume the server sent only one version of NFS
+ * to use for the DS.
+diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
+index 3f0c2436254ac..bd6190d794c49 100644
+--- a/fs/nfs/pnfs_nfs.c
++++ b/fs/nfs/pnfs_nfs.c
+@@ -635,7 +635,7 @@ static int _nfs4_pnfs_v3_ds_connect(struct nfs_server *mds_srv,
+ }
+
+ smp_wmb();
+- ds->ds_clp = clp;
++ WRITE_ONCE(ds->ds_clp, clp);
+ dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr);
+ out:
+ return status;
+@@ -708,7 +708,7 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv,
+ }
+
+ smp_wmb();
+- ds->ds_clp = clp;
++ WRITE_ONCE(ds->ds_clp, clp);
+ dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr);
+ out:
+ return status;
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index d419d89b91f7c..ec0fd6b3d185a 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1045,25 +1045,11 @@ nfs_scan_commit_list(struct list_head *src, struct list_head *dst,
+ struct nfs_page *req, *tmp;
+ int ret = 0;
+
+-restart:
+ list_for_each_entry_safe(req, tmp, src, wb_list) {
+ kref_get(&req->wb_kref);
+ if (!nfs_lock_request(req)) {
+- int status;
+-
+- /* Prevent deadlock with nfs_lock_and_join_requests */
+- if (!list_empty(dst)) {
+- nfs_release_request(req);
+- continue;
+- }
+- /* Ensure we make progress to prevent livelock */
+- mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
+- status = nfs_wait_on_request(req);
+ nfs_release_request(req);
+- mutex_lock(&NFS_I(cinfo->inode)->commit_mutex);
+- if (status < 0)
+- break;
+- goto restart;
++ continue;
+ }
+ nfs_request_remove_commit_list(req, cinfo);
+ clear_bit(PG_COMMIT_TO_DS, &req->wb_flags);
+@@ -1911,6 +1897,7 @@ static int __nfs_commit_inode(struct inode *inode, int how,
+ int may_wait = how & FLUSH_SYNC;
+ int ret, nscan;
+
++ how &= ~FLUSH_SYNC;
+ nfs_init_cinfo_from_inode(&cinfo, inode);
+ nfs_commit_begin(cinfo.mds);
+ for (;;) {
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 6ca4dc57f70ba..0141298bb2e5f 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -492,10 +492,11 @@ int ocfs2_truncate_file(struct inode *inode,
+ * greater than page size, so we have to truncate them
+ * anyway.
+ */
+- unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1);
+- truncate_inode_pages(inode->i_mapping, new_i_size);
+
+ if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
++ unmap_mapping_range(inode->i_mapping,
++ new_i_size + PAGE_SIZE - 1, 0, 1);
++ truncate_inode_pages(inode->i_mapping, new_i_size);
+ status = ocfs2_truncate_inline(inode, di_bh, new_i_size,
+ i_size_read(inode), 1);
+ if (status)
+@@ -514,6 +515,9 @@ int ocfs2_truncate_file(struct inode *inode,
+ goto bail_unlock_sem;
+ }
+
++ unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1);
++ truncate_inode_pages(inode->i_mapping, new_i_size);
++
+ status = ocfs2_commit_truncate(osb, inode, di_bh);
+ if (status < 0) {
+ mlog_errno(status);
+diff --git a/fs/orangefs/dcache.c b/fs/orangefs/dcache.c
+index fe484cf93e5cd..8bbe9486e3a62 100644
+--- a/fs/orangefs/dcache.c
++++ b/fs/orangefs/dcache.c
+@@ -26,8 +26,10 @@ static int orangefs_revalidate_lookup(struct dentry *dentry)
+ gossip_debug(GOSSIP_DCACHE_DEBUG, "%s: attempting lookup.\n", __func__);
+
+ new_op = op_alloc(ORANGEFS_VFS_OP_LOOKUP);
+- if (!new_op)
++ if (!new_op) {
++ ret = -ENOMEM;
+ goto out_put_parent;
++ }
+
+ new_op->upcall.req.lookup.sym_follow = ORANGEFS_LOOKUP_LINK_NO_FOLLOW;
+ new_op->upcall.req.lookup.parent_refn = parent->refn;
+diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c
+index 656f9ff63edda..833cd3e3758bf 100644
+--- a/fs/quota/quota_tree.c
++++ b/fs/quota/quota_tree.c
+@@ -422,6 +422,7 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot,
+ quota_error(dquot->dq_sb, "Quota structure has offset to "
+ "other block (%u) than it should (%u)", blk,
+ (uint)(dquot->dq_off >> info->dqi_blocksize_bits));
++ ret = -EIO;
+ goto out_buf;
+ }
+ ret = read_blk(info, blk, buf);
+@@ -487,6 +488,13 @@ static int remove_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot,
+ goto out_buf;
+ }
+ newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]);
++ if (newblk < QT_TREEOFF || newblk >= info->dqi_blocks) {
++ quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)",
++ newblk, info->dqi_blocks);
++ ret = -EUCLEAN;
++ goto out_buf;
++ }
++
+ if (depth == info->dqi_qtree_depth - 1) {
+ ret = free_dqentry(info, dquot, newblk);
+ newblk = 0;
+@@ -586,6 +594,13 @@ static loff_t find_tree_dqentry(struct qtree_mem_dqinfo *info,
+ blk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]);
+ if (!blk) /* No reference? */
+ goto out_buf;
++ if (blk < QT_TREEOFF || blk >= info->dqi_blocks) {
++ quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)",
++ blk, info->dqi_blocks);
++ ret = -EUCLEAN;
++ goto out_buf;
++ }
++
+ if (depth < info->dqi_qtree_depth - 1)
+ ret = find_tree_dqentry(info, dquot, blk, depth+1);
+ else
+diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
+index 7098c49f36934..990f794b1dd0a 100644
+--- a/fs/tracefs/inode.c
++++ b/fs/tracefs/inode.c
+@@ -427,7 +427,8 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent,
+ if (unlikely(!inode))
+ return failed_creating(dentry);
+
+- inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
++ /* Do not set bits for OTH */
++ inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP;
+ inode->i_op = ops;
+ inode->i_fop = &simple_dir_operations;
+
+diff --git a/fs/udf/dir.c b/fs/udf/dir.c
+index c19dba45aa209..d0f92a52e3bab 100644
+--- a/fs/udf/dir.c
++++ b/fs/udf/dir.c
+@@ -31,6 +31,7 @@
+ #include <linux/mm.h>
+ #include <linux/slab.h>
+ #include <linux/bio.h>
++#include <linux/iversion.h>
+
+ #include "udf_i.h"
+ #include "udf_sb.h"
+@@ -44,7 +45,7 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
+ struct fileIdentDesc *fi = NULL;
+ struct fileIdentDesc cfi;
+ udf_pblk_t block, iblock;
+- loff_t nf_pos;
++ loff_t nf_pos, emit_pos = 0;
+ int flen;
+ unsigned char *fname = NULL, *copy_name = NULL;
+ unsigned char *nameptr;
+@@ -58,6 +59,7 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
+ int i, num, ret = 0;
+ struct extent_position epos = { NULL, 0, {0, 0} };
+ struct super_block *sb = dir->i_sb;
++ bool pos_valid = false;
+
+ if (ctx->pos == 0) {
+ if (!dir_emit_dot(file, ctx))
+@@ -68,6 +70,21 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
+ if (nf_pos >= size)
+ goto out;
+
++ /*
++ * Something changed since last readdir (either lseek was called or dir
++ * changed)? We need to verify the position correctly points at the
++ * beginning of some dir entry so that the directory parsing code does
++ * not get confused. Since UDF does not have any reliable way of
++ * identifying beginning of dir entry (names are under user control),
++ * we need to scan the directory from the beginning.
++ */
++ if (!inode_eq_iversion(dir, file->f_version)) {
++ emit_pos = nf_pos;
++ nf_pos = 0;
++ } else {
++ pos_valid = true;
++ }
++
+ fname = kmalloc(UDF_NAME_LEN, GFP_NOFS);
+ if (!fname) {
+ ret = -ENOMEM;
+@@ -123,13 +140,21 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
+
+ while (nf_pos < size) {
+ struct kernel_lb_addr tloc;
++ loff_t cur_pos = nf_pos;
+
+- ctx->pos = (nf_pos >> 2) + 1;
++ /* Update file position only if we got past the current one */
++ if (nf_pos >= emit_pos) {
++ ctx->pos = (nf_pos >> 2) + 1;
++ pos_valid = true;
++ }
+
+ fi = udf_fileident_read(dir, &nf_pos, &fibh, &cfi, &epos, &eloc,
+ &elen, &offset);
+ if (!fi)
+ goto out;
++ /* Still not at offset where user asked us to read from? */
++ if (cur_pos < emit_pos)
++ continue;
+
+ liu = le16_to_cpu(cfi.lengthOfImpUse);
+ lfi = cfi.lengthFileIdent;
+@@ -187,8 +212,11 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
+ } /* end while */
+
+ ctx->pos = (nf_pos >> 2) + 1;
++ pos_valid = true;
+
+ out:
++ if (pos_valid)
++ file->f_version = inode_query_iversion(dir);
+ if (fibh.sbh != fibh.ebh)
+ brelse(fibh.ebh);
+ brelse(fibh.sbh);
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index 9cfb555db1add..1dfb9c36e6da0 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -30,6 +30,7 @@
+ #include <linux/sched.h>
+ #include <linux/crc-itu-t.h>
+ #include <linux/exportfs.h>
++#include <linux/iversion.h>
+
+ static inline int udf_match(int len1, const unsigned char *name1, int len2,
+ const unsigned char *name2)
+@@ -135,6 +136,8 @@ int udf_write_fi(struct inode *inode, struct fileIdentDesc *cfi,
+ mark_buffer_dirty_inode(fibh->ebh, inode);
+ mark_buffer_dirty_inode(fibh->sbh, inode);
+ }
++ inode_inc_iversion(inode);
++
+ return 0;
+ }
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 9c71246e6d602..b7fb7cd35d89a 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -57,6 +57,7 @@
+ #include <linux/crc-itu-t.h>
+ #include <linux/log2.h>
+ #include <asm/byteorder.h>
++#include <linux/iversion.h>
+
+ #include "udf_sb.h"
+ #include "udf_i.h"
+@@ -151,6 +152,7 @@ static struct inode *udf_alloc_inode(struct super_block *sb)
+ init_rwsem(&ei->i_data_sem);
+ ei->cached_extent.lstart = -1;
+ spin_lock_init(&ei->i_extent_cache_lock);
++ inode_set_iversion(&ei->vfs_inode, 1);
+
+ return &ei->vfs_inode;
+ }
+diff --git a/include/linux/console.h b/include/linux/console.h
+index ec9bdb3d7bab6..35e3cc4fb4a68 100644
+--- a/include/linux/console.h
++++ b/include/linux/console.h
+@@ -153,6 +153,8 @@ struct console {
+ short flags;
+ short index;
+ int cflag;
++ uint ispeed;
++ uint ospeed;
+ void *data;
+ struct console *next;
+ };
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index e981bd92a4e3a..89a6ef659b4ca 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -877,6 +877,7 @@ extern int bpf_jit_enable;
+ extern int bpf_jit_harden;
+ extern int bpf_jit_kallsyms;
+ extern long bpf_jit_limit;
++extern long bpf_jit_limit_max;
+
+ typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
+
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 6d9194fb38dfc..73cd0182452c4 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -408,7 +408,7 @@ enum {
+ /* This should match the actual table size of
+ * ata_eh_cmd_timeout_table in libata-eh.c.
+ */
+- ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 6,
++ ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 7,
+
+ /* Horkage types. May be set by libata or controller on drives
+ (some horkage may be drive/controller pair dependent */
+diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
+index 3833c871fd45c..e65dace667d36 100644
+--- a/include/linux/lsm_hooks.h
++++ b/include/linux/lsm_hooks.h
+@@ -1211,22 +1211,22 @@
+ *
+ * @binder_set_context_mgr:
+ * Check whether @mgr is allowed to be the binder context manager.
+- * @mgr contains the task_struct for the task being registered.
++ * @mgr contains the struct cred for the current binder process.
+ * Return 0 if permission is granted.
+ * @binder_transaction:
+ * Check whether @from is allowed to invoke a binder transaction call
+ * to @to.
+- * @from contains the task_struct for the sending task.
+- * @to contains the task_struct for the receiving task.
++ * @from contains the struct cred for the sending process.
++ * @to contains the struct cred for the receiving process.
+ * @binder_transfer_binder:
+ * Check whether @from is allowed to transfer a binder reference to @to.
+- * @from contains the task_struct for the sending task.
+- * @to contains the task_struct for the receiving task.
++ * @from contains the struct cred for the sending process.
++ * @to contains the struct cred for the receiving process.
+ * @binder_transfer_file:
+ * Check whether @from is allowed to transfer @file to @to.
+- * @from contains the task_struct for the sending task.
++ * @from contains the struct cred for the sending process.
+ * @file contains the struct file being transferred.
+- * @to contains the task_struct for the receiving task.
++ * @to contains the struct cred for the receiving process.
+ *
+ * @ptrace_access_check:
+ * Check permission before allowing the current process to trace the
+@@ -1428,13 +1428,13 @@
+ *
+ */
+ union security_list_options {
+- int (*binder_set_context_mgr)(struct task_struct *mgr);
+- int (*binder_transaction)(struct task_struct *from,
+- struct task_struct *to);
+- int (*binder_transfer_binder)(struct task_struct *from,
+- struct task_struct *to);
+- int (*binder_transfer_file)(struct task_struct *from,
+- struct task_struct *to,
++ int (*binder_set_context_mgr)(const struct cred *mgr);
++ int (*binder_transaction)(const struct cred *from,
++ const struct cred *to);
++ int (*binder_transfer_binder)(const struct cred *from,
++ const struct cred *to);
++ int (*binder_transfer_file)(const struct cred *from,
++ const struct cred *to,
+ struct file *file);
+
+ int (*ptrace_access_check)(struct task_struct *child,
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 6f9ca2f278b32..a4bbce871e08e 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -205,6 +205,8 @@ enum pci_dev_flags {
+ PCI_DEV_FLAGS_NO_FLR_RESET = (__force pci_dev_flags_t) (1 << 10),
+ /* Don't use Relaxed Ordering for TLPs directed at this device */
+ PCI_DEV_FLAGS_NO_RELAXED_ORDERING = (__force pci_dev_flags_t) (1 << 11),
++ /* Device does honor MSI masking despite saying otherwise */
++ PCI_DEV_FLAGS_HAS_MSI_MASKING = (__force pci_dev_flags_t) (1 << 12),
+ };
+
+ enum pci_irq_reroute_variant {
+diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h
+index 9fe156d1c018e..a68972b097b72 100644
+--- a/include/linux/rpmsg.h
++++ b/include/linux/rpmsg.h
+@@ -177,7 +177,7 @@ static inline struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *rpdev
+ /* This shouldn't be possible */
+ WARN_ON(1);
+
+- return ERR_PTR(-ENXIO);
++ return NULL;
+ }
+
+ static inline int rpmsg_send(struct rpmsg_endpoint *ept, void *data, int len)
+diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h
+index 6a841929073f9..4f099d3fed3a9 100644
+--- a/include/linux/sched/task_stack.h
++++ b/include/linux/sched/task_stack.h
+@@ -25,7 +25,11 @@ static inline void *task_stack_page(const struct task_struct *task)
+
+ static inline unsigned long *end_of_stack(const struct task_struct *task)
+ {
++#ifdef CONFIG_STACK_GROWSUP
++ return (unsigned long *)((unsigned long)task->stack + THREAD_SIZE) - 1;
++#else
+ return task->stack;
++#endif
+ }
+
+ #elif !defined(__HAVE_THREAD_FUNCTIONS)
+diff --git a/include/linux/security.h b/include/linux/security.h
+index 454cc963d1457..273877cf47bfd 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -219,13 +219,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
+ extern int security_init(void);
+
+ /* Security operations */
+-int security_binder_set_context_mgr(struct task_struct *mgr);
+-int security_binder_transaction(struct task_struct *from,
+- struct task_struct *to);
+-int security_binder_transfer_binder(struct task_struct *from,
+- struct task_struct *to);
+-int security_binder_transfer_file(struct task_struct *from,
+- struct task_struct *to, struct file *file);
++int security_binder_set_context_mgr(const struct cred *mgr);
++int security_binder_transaction(const struct cred *from,
++ const struct cred *to);
++int security_binder_transfer_binder(const struct cred *from,
++ const struct cred *to);
++int security_binder_transfer_file(const struct cred *from,
++ const struct cred *to, struct file *file);
+ int security_ptrace_access_check(struct task_struct *child, unsigned int mode);
+ int security_ptrace_traceme(struct task_struct *parent);
+ int security_capget(struct task_struct *target,
+@@ -442,25 +442,25 @@ static inline int security_init(void)
+ return 0;
+ }
+
+-static inline int security_binder_set_context_mgr(struct task_struct *mgr)
++static inline int security_binder_set_context_mgr(const struct cred *mgr)
+ {
+ return 0;
+ }
+
+-static inline int security_binder_transaction(struct task_struct *from,
+- struct task_struct *to)
++static inline int security_binder_transaction(const struct cred *from,
++ const struct cred *to)
+ {
+ return 0;
+ }
+
+-static inline int security_binder_transfer_binder(struct task_struct *from,
+- struct task_struct *to)
++static inline int security_binder_transfer_binder(const struct cred *from,
++ const struct cred *to)
+ {
+ return 0;
+ }
+
+-static inline int security_binder_transfer_file(struct task_struct *from,
+- struct task_struct *to,
++static inline int security_binder_transfer_file(const struct cred *from,
++ const struct cred *to,
+ struct file *file)
+ {
+ return 0;
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index 8f48264f5dab3..e7330a9a7d7dc 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -120,10 +120,15 @@ retry:
+
+ if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+ u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size);
++ unsigned int nh_off = p_off;
+ struct skb_shared_info *shinfo = skb_shinfo(skb);
+
++ /* UFO may not include transport header in gso_size. */
++ if (gso_type & SKB_GSO_UDP)
++ nh_off -= thlen;
++
+ /* Too small packets are not really GSO ones. */
+- if (skb->len - p_off > gso_size) {
++ if (skb->len - nh_off > gso_size) {
+ shinfo->gso_size = gso_size;
+ shinfo->gso_type = gso_type;
+
+diff --git a/include/net/llc.h b/include/net/llc.h
+index df282d9b40170..9c10b121b49b0 100644
+--- a/include/net/llc.h
++++ b/include/net/llc.h
+@@ -72,7 +72,9 @@ struct llc_sap {
+ static inline
+ struct hlist_head *llc_sk_dev_hash(struct llc_sap *sap, int ifindex)
+ {
+- return &sap->sk_dev_hash[ifindex % LLC_SK_DEV_HASH_ENTRIES];
++ u32 bucket = hash_32(ifindex, LLC_SK_DEV_HASH_BITS);
++
++ return &sap->sk_dev_hash[bucket];
+ }
+
+ static inline
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index d737a6a2600be..286bc674a6e79 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -216,6 +216,8 @@ struct Qdisc_ops {
+ struct netlink_ext_ack *extack);
+ void (*attach)(struct Qdisc *sch);
+ int (*change_tx_queue_len)(struct Qdisc *, unsigned int);
++ void (*change_real_num_tx)(struct Qdisc *sch,
++ unsigned int new_real_tx);
+
+ int (*dump)(struct Qdisc *, struct sk_buff *);
+ int (*dump_stats)(struct Qdisc *, struct gnet_dump *);
+@@ -547,6 +549,8 @@ void qdisc_class_hash_grow(struct Qdisc *, struct Qdisc_class_hash *);
+ void qdisc_class_hash_destroy(struct Qdisc_class_hash *);
+
+ int dev_qdisc_change_tx_queue_len(struct net_device *dev);
++void dev_qdisc_change_real_num_tx(struct net_device *dev,
++ unsigned int new_real_tx);
+ void dev_init_scheduler(struct net_device *dev);
+ void dev_shutdown(struct net_device *dev);
+ void dev_activate(struct net_device *dev);
+diff --git a/include/rdma/rdma_netlink.h b/include/rdma/rdma_netlink.h
+index c369703fcd69c..36cdc17de6909 100644
+--- a/include/rdma/rdma_netlink.h
++++ b/include/rdma/rdma_netlink.h
+@@ -24,7 +24,7 @@ enum rdma_nl_flags {
+ * constant as well and the compiler checks they are the same.
+ */
+ #define MODULE_ALIAS_RDMA_NETLINK(_index, _val) \
+- static inline void __chk_##_index(void) \
++ static inline void __maybe_unused __chk_##_index(void) \
+ { \
+ BUILD_BUG_ON(_index != _val); \
+ } \
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 2cfd3b4573b06..ac59a03d0d00e 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -774,8 +774,9 @@ struct se_device {
+ atomic_long_t read_bytes;
+ atomic_long_t write_bytes;
+ /* Active commands on this virtual SE device */
+- atomic_t simple_cmds;
+- atomic_t dev_ordered_sync;
++ atomic_t non_ordered;
++ bool ordered_sync_in_progress;
++ atomic_t delayed_cmd_count;
+ atomic_t dev_qf_count;
+ u32 export_count;
+ spinlock_t delayed_cmd_lock;
+@@ -798,6 +799,7 @@ struct se_device {
+ struct list_head dev_tmr_list;
+ struct workqueue_struct *tmr_wq;
+ struct work_struct qf_work_queue;
++ struct work_struct delayed_cmd_work;
+ struct list_head delayed_cmd_list;
+ struct list_head state_list;
+ struct list_head qf_cmd_list;
+diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h
+index 795698925d206..52e6456bdb922 100644
+--- a/include/trace/events/f2fs.h
++++ b/include/trace/events/f2fs.h
+@@ -751,20 +751,20 @@ TRACE_EVENT(f2fs_lookup_start,
+ TP_STRUCT__entry(
+ __field(dev_t, dev)
+ __field(ino_t, ino)
+- __field(const char *, name)
++ __string(name, dentry->d_name.name)
+ __field(unsigned int, flags)
+ ),
+
+ TP_fast_assign(
+ __entry->dev = dir->i_sb->s_dev;
+ __entry->ino = dir->i_ino;
+- __entry->name = dentry->d_name.name;
++ __assign_str(name, dentry->d_name.name);
+ __entry->flags = flags;
+ ),
+
+ TP_printk("dev = (%d,%d), pino = %lu, name:%s, flags:%u",
+ show_dev_ino(__entry),
+- __entry->name,
++ __get_str(name),
+ __entry->flags)
+ );
+
+@@ -778,7 +778,7 @@ TRACE_EVENT(f2fs_lookup_end,
+ TP_STRUCT__entry(
+ __field(dev_t, dev)
+ __field(ino_t, ino)
+- __field(const char *, name)
++ __string(name, dentry->d_name.name)
+ __field(nid_t, cino)
+ __field(int, err)
+ ),
+@@ -786,14 +786,14 @@ TRACE_EVENT(f2fs_lookup_end,
+ TP_fast_assign(
+ __entry->dev = dir->i_sb->s_dev;
+ __entry->ino = dir->i_ino;
+- __entry->name = dentry->d_name.name;
++ __assign_str(name, dentry->d_name.name);
+ __entry->cino = ino;
+ __entry->err = err;
+ ),
+
+ TP_printk("dev = (%d,%d), pino = %lu, name:%s, ino:%u, err:%d",
+ show_dev_ino(__entry),
+- __entry->name,
++ __get_str(name),
+ __entry->cino,
+ __entry->err)
+ );
+diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
+index ee556ccc93f48..8d2767140798b 100644
+--- a/include/uapi/linux/pci_regs.h
++++ b/include/uapi/linux/pci_regs.h
+@@ -497,6 +497,12 @@
+ #define PCI_EXP_DEVCTL_URRE 0x0008 /* Unsupported Request Reporting En. */
+ #define PCI_EXP_DEVCTL_RELAX_EN 0x0010 /* Enable relaxed ordering */
+ #define PCI_EXP_DEVCTL_PAYLOAD 0x00e0 /* Max_Payload_Size */
++#define PCI_EXP_DEVCTL_PAYLOAD_128B 0x0000 /* 128 Bytes */
++#define PCI_EXP_DEVCTL_PAYLOAD_256B 0x0020 /* 256 Bytes */
++#define PCI_EXP_DEVCTL_PAYLOAD_512B 0x0040 /* 512 Bytes */
++#define PCI_EXP_DEVCTL_PAYLOAD_1024B 0x0060 /* 1024 Bytes */
++#define PCI_EXP_DEVCTL_PAYLOAD_2048B 0x0080 /* 2048 Bytes */
++#define PCI_EXP_DEVCTL_PAYLOAD_4096B 0x00a0 /* 4096 Bytes */
+ #define PCI_EXP_DEVCTL_EXT_TAG 0x0100 /* Extended Tag Field Enable */
+ #define PCI_EXP_DEVCTL_PHANTOM 0x0200 /* Phantom Functions Enable */
+ #define PCI_EXP_DEVCTL_AUX_PME 0x0400 /* Auxiliary Power PM Enable */
+diff --git a/ipc/util.c b/ipc/util.c
+index af1b572effb14..8f848378efda9 100644
+--- a/ipc/util.c
++++ b/ipc/util.c
+@@ -417,8 +417,8 @@ static int ipcget_public(struct ipc_namespace *ns, struct ipc_ids *ids,
+ static void ipc_kht_remove(struct ipc_ids *ids, struct kern_ipc_perm *ipcp)
+ {
+ if (ipcp->key != IPC_PRIVATE)
+- rhashtable_remove_fast(&ids->key_ht, &ipcp->khtnode,
+- ipc_kht_params);
++ WARN_ON_ONCE(rhashtable_remove_fast(&ids->key_ht, &ipcp->khtnode,
++ ipc_kht_params));
+ }
+
+ /**
+@@ -433,7 +433,7 @@ void ipc_rmid(struct ipc_ids *ids, struct kern_ipc_perm *ipcp)
+ {
+ int idx = ipcid_to_idx(ipcp->id);
+
+- idr_remove(&ids->ipcs_idr, idx);
++ WARN_ON_ONCE(idr_remove(&ids->ipcs_idr, idx) != ipcp);
+ ipc_kht_remove(ids, ipcp);
+ ids->in_use--;
+ ipcp->deleted = true;
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 341402bc1202d..4e5b5ae05406e 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -372,6 +372,7 @@ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON);
+ int bpf_jit_harden __read_mostly;
+ int bpf_jit_kallsyms __read_mostly;
+ long bpf_jit_limit __read_mostly;
++long bpf_jit_limit_max __read_mostly;
+
+ static __always_inline void
+ bpf_get_prog_addr_region(const struct bpf_prog *prog,
+@@ -598,7 +599,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void)
+ static int __init bpf_jit_charge_init(void)
+ {
+ /* Only used as heuristic here to derive limit. */
+- bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2,
++ bpf_jit_limit_max = bpf_jit_alloc_exec_limit();
++ bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2,
+ PAGE_SIZE), LONG_MAX);
+ return 0;
+ }
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index a74549693e7f5..63eff85f251f3 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -1650,6 +1650,7 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
+ struct cgroup *dcgrp = &dst_root->cgrp;
+ struct cgroup_subsys *ss;
+ int ssid, i, ret;
++ u16 dfl_disable_ss_mask = 0;
+
+ lockdep_assert_held(&cgroup_mutex);
+
+@@ -1666,8 +1667,28 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
+ /* can't move between two non-dummy roots either */
+ if (ss->root != &cgrp_dfl_root && dst_root != &cgrp_dfl_root)
+ return -EBUSY;
++
++ /*
++ * Collect ssid's that need to be disabled from default
++ * hierarchy.
++ */
++ if (ss->root == &cgrp_dfl_root)
++ dfl_disable_ss_mask |= 1 << ssid;
++
+ } while_each_subsys_mask();
+
++ if (dfl_disable_ss_mask) {
++ struct cgroup *scgrp = &cgrp_dfl_root.cgrp;
++
++ /*
++ * Controllers from default hierarchy that need to be rebound
++ * are all disabled together in one go.
++ */
++ cgrp_dfl_root.subsys_mask &= ~dfl_disable_ss_mask;
++ WARN_ON(cgroup_apply_control(scgrp));
++ cgroup_finalize_control(scgrp, 0);
++ }
++
+ do_each_subsys_mask(ss, ssid, ss_mask) {
+ struct cgroup_root *src_root = ss->root;
+ struct cgroup *scgrp = &src_root->cgrp;
+@@ -1676,10 +1697,12 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
+
+ WARN_ON(!css || cgroup_css(dcgrp, ss));
+
+- /* disable from the source */
+- src_root->subsys_mask &= ~(1 << ssid);
+- WARN_ON(cgroup_apply_control(scgrp));
+- cgroup_finalize_control(scgrp, 0);
++ if (src_root != &cgrp_dfl_root) {
++ /* disable from the source */
++ src_root->subsys_mask &= ~(1 << ssid);
++ WARN_ON(cgroup_apply_control(scgrp));
++ cgroup_finalize_control(scgrp, 0);
++ }
+
+ /* rebind */
+ RCU_INIT_POINTER(scgrp->subsys[ssid], NULL);
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 4a8c3f5313f96..e6e11b5984386 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -6424,7 +6424,6 @@ void perf_output_sample(struct perf_output_handle *handle,
+ static u64 perf_virt_to_phys(u64 virt)
+ {
+ u64 phys_addr = 0;
+- struct page *p = NULL;
+
+ if (!virt)
+ return 0;
+@@ -6443,14 +6442,15 @@ static u64 perf_virt_to_phys(u64 virt)
+ * If failed, leave phys_addr as 0.
+ */
+ if (current->mm != NULL) {
++ struct page *p;
++
+ pagefault_disable();
+- if (__get_user_pages_fast(virt, 1, 0, &p) == 1)
++ if (__get_user_pages_fast(virt, 1, 0, &p) == 1) {
+ phys_addr = page_to_phys(p) + virt % PAGE_SIZE;
++ put_page(p);
++ }
+ pagefault_enable();
+ }
+-
+- if (p)
+- put_page(p);
+ }
+
+ return phys_addr;
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 126c6d524a0f2..4dc79f57af827 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -689,7 +689,7 @@ look_up_lock_class(const struct lockdep_map *lock, unsigned int subclass)
+ if (DEBUG_LOCKS_WARN_ON(!irqs_disabled()))
+ return NULL;
+
+- hlist_for_each_entry_rcu(class, hash_head, hash_entry) {
++ hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
+ if (class->key == key) {
+ /*
+ * Huh! same key, different name? Did someone trample
+diff --git a/kernel/power/swap.c b/kernel/power/swap.c
+index e9494c29f1ca4..9db7f2f93fae3 100644
+--- a/kernel/power/swap.c
++++ b/kernel/power/swap.c
+@@ -294,7 +294,7 @@ static int hib_submit_io(int op, int op_flags, pgoff_t page_off, void *addr,
+ return error;
+ }
+
+-static blk_status_t hib_wait_io(struct hib_bio_batch *hb)
++static int hib_wait_io(struct hib_bio_batch *hb)
+ {
+ wait_event(hb->wait, atomic_read(&hb->count) == 0);
+ return blk_status_to_errno(hb->error);
+@@ -1512,9 +1512,10 @@ end:
+ int swsusp_check(void)
+ {
+ int error;
++ void *holder;
+
+ hib_resume_bdev = blkdev_get_by_dev(swsusp_resume_device,
+- FMODE_READ, NULL);
++ FMODE_READ | FMODE_EXCL, &holder);
+ if (!IS_ERR(hib_resume_bdev)) {
+ set_blocksize(hib_resume_bdev, PAGE_SIZE);
+ clear_page(swsusp_header);
+@@ -1536,7 +1537,7 @@ int swsusp_check(void)
+
+ put:
+ if (error)
+- blkdev_put(hib_resume_bdev, FMODE_READ);
++ blkdev_put(hib_resume_bdev, FMODE_READ | FMODE_EXCL);
+ else
+ pr_debug("Image signature found, resuming\n");
+ } else {
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 013b1c6cb4ed9..32af895bd86b3 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1821,6 +1821,9 @@ out:
+
+ bool cpus_share_cache(int this_cpu, int that_cpu)
+ {
++ if (this_cpu == that_cpu)
++ return true;
++
+ return per_cpu(sd_llc_id, this_cpu) == per_cpu(sd_llc_id, that_cpu);
+ }
+ #endif /* CONFIG_SMP */
+diff --git a/kernel/signal.c b/kernel/signal.c
+index a02a25acf2056..4cc3f3ba13a95 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -2003,15 +2003,6 @@ static inline bool may_ptrace_stop(void)
+ return true;
+ }
+
+-/*
+- * Return non-zero if there is a SIGKILL that should be waking us up.
+- * Called with the siglock held.
+- */
+-static bool sigkill_pending(struct task_struct *tsk)
+-{
+- return sigismember(&tsk->pending.signal, SIGKILL) ||
+- sigismember(&tsk->signal->shared_pending.signal, SIGKILL);
+-}
+
+ /*
+ * This must be called with current->sighand->siglock held.
+@@ -2038,17 +2029,16 @@ static void ptrace_stop(int exit_code, int why, int clear_code, siginfo_t *info)
+ * calling arch_ptrace_stop, so we must release it now.
+ * To preserve proper semantics, we must do this before
+ * any signal bookkeeping like checking group_stop_count.
+- * Meanwhile, a SIGKILL could come in before we retake the
+- * siglock. That must prevent us from sleeping in TASK_TRACED.
+- * So after regaining the lock, we must check for SIGKILL.
+ */
+ spin_unlock_irq(¤t->sighand->siglock);
+ arch_ptrace_stop(exit_code, info);
+ spin_lock_irq(¤t->sighand->siglock);
+- if (sigkill_pending(current))
+- return;
+ }
+
++ /*
++ * schedule() will not sleep if there is a pending signal that
++ * can awaken the task.
++ */
+ set_special_state(TASK_TRACED);
+
+ /*
+diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
+index 9e31bfc818ff8..10657b8dc2c2d 100644
+--- a/kernel/trace/tracing_map.c
++++ b/kernel/trace/tracing_map.c
+@@ -834,29 +834,35 @@ int tracing_map_init(struct tracing_map *map)
+ return err;
+ }
+
+-static int cmp_entries_dup(const struct tracing_map_sort_entry **a,
+- const struct tracing_map_sort_entry **b)
++static int cmp_entries_dup(const void *A, const void *B)
+ {
++ const struct tracing_map_sort_entry *a, *b;
+ int ret = 0;
+
+- if (memcmp((*a)->key, (*b)->key, (*a)->elt->map->key_size))
++ a = *(const struct tracing_map_sort_entry **)A;
++ b = *(const struct tracing_map_sort_entry **)B;
++
++ if (memcmp(a->key, b->key, a->elt->map->key_size))
+ ret = 1;
+
+ return ret;
+ }
+
+-static int cmp_entries_sum(const struct tracing_map_sort_entry **a,
+- const struct tracing_map_sort_entry **b)
++static int cmp_entries_sum(const void *A, const void *B)
+ {
+ const struct tracing_map_elt *elt_a, *elt_b;
++ const struct tracing_map_sort_entry *a, *b;
+ struct tracing_map_sort_key *sort_key;
+ struct tracing_map_field *field;
+ tracing_map_cmp_fn_t cmp_fn;
+ void *val_a, *val_b;
+ int ret = 0;
+
+- elt_a = (*a)->elt;
+- elt_b = (*b)->elt;
++ a = *(const struct tracing_map_sort_entry **)A;
++ b = *(const struct tracing_map_sort_entry **)B;
++
++ elt_a = a->elt;
++ elt_b = b->elt;
+
+ sort_key = &elt_a->map->sort_key;
+
+@@ -873,18 +879,21 @@ static int cmp_entries_sum(const struct tracing_map_sort_entry **a,
+ return ret;
+ }
+
+-static int cmp_entries_key(const struct tracing_map_sort_entry **a,
+- const struct tracing_map_sort_entry **b)
++static int cmp_entries_key(const void *A, const void *B)
+ {
+ const struct tracing_map_elt *elt_a, *elt_b;
++ const struct tracing_map_sort_entry *a, *b;
+ struct tracing_map_sort_key *sort_key;
+ struct tracing_map_field *field;
+ tracing_map_cmp_fn_t cmp_fn;
+ void *val_a, *val_b;
+ int ret = 0;
+
+- elt_a = (*a)->elt;
+- elt_b = (*b)->elt;
++ a = *(const struct tracing_map_sort_entry **)A;
++ b = *(const struct tracing_map_sort_entry **)B;
++
++ elt_a = a->elt;
++ elt_b = b->elt;
+
+ sort_key = &elt_a->map->sort_key;
+
+@@ -989,10 +998,8 @@ static void sort_secondary(struct tracing_map *map,
+ struct tracing_map_sort_key *primary_key,
+ struct tracing_map_sort_key *secondary_key)
+ {
+- int (*primary_fn)(const struct tracing_map_sort_entry **,
+- const struct tracing_map_sort_entry **);
+- int (*secondary_fn)(const struct tracing_map_sort_entry **,
+- const struct tracing_map_sort_entry **);
++ int (*primary_fn)(const void *, const void *);
++ int (*secondary_fn)(const void *, const void *);
+ unsigned i, start = 0, n_sub = 1;
+
+ if (is_key(map, primary_key->field_idx))
+@@ -1061,8 +1068,7 @@ int tracing_map_sort_entries(struct tracing_map *map,
+ unsigned int n_sort_keys,
+ struct tracing_map_sort_entry ***sort_entries)
+ {
+- int (*cmp_entries_fn)(const struct tracing_map_sort_entry **,
+- const struct tracing_map_sort_entry **);
++ int (*cmp_entries_fn)(const void *, const void *);
+ struct tracing_map_sort_entry *sort_entry, **entries;
+ int i, n_entries, ret;
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 1573d1bf63007..b1bb6cb5802ec 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -5125,9 +5125,6 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
+ int ret = -EINVAL;
+ cpumask_var_t saved_cpumask;
+
+- if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL))
+- return -ENOMEM;
+-
+ /*
+ * Not excluding isolated cpus on purpose.
+ * If the user wishes to include them, we allow that.
+@@ -5135,6 +5132,15 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
+ cpumask_and(cpumask, cpumask, cpu_possible_mask);
+ if (!cpumask_empty(cpumask)) {
+ apply_wqattrs_lock();
++ if (cpumask_equal(cpumask, wq_unbound_cpumask)) {
++ ret = 0;
++ goto out_unlock;
++ }
++
++ if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL)) {
++ ret = -ENOMEM;
++ goto out_unlock;
++ }
+
+ /* save the old wq_unbound_cpumask. */
+ cpumask_copy(saved_cpumask, wq_unbound_cpumask);
+@@ -5147,10 +5153,11 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
+ if (ret < 0)
+ cpumask_copy(wq_unbound_cpumask, saved_cpumask);
+
++ free_cpumask_var(saved_cpumask);
++out_unlock:
+ apply_wqattrs_unlock();
+ }
+
+- free_cpumask_var(saved_cpumask);
+ return ret;
+ }
+
+diff --git a/lib/decompress_unxz.c b/lib/decompress_unxz.c
+index 25d59a95bd668..abea25310ac73 100644
+--- a/lib/decompress_unxz.c
++++ b/lib/decompress_unxz.c
+@@ -167,7 +167,7 @@
+ * memeq and memzero are not used much and any remotely sane implementation
+ * is fast enough. memcpy/memmove speed matters in multi-call mode, but
+ * the kernel image is decompressed in single-call mode, in which only
+- * memcpy speed can matter and only if there is a lot of uncompressible data
++ * memmove speed can matter and only if there is a lot of uncompressible data
+ * (LZMA2 stores uncompressible chunks in uncompressed form). Thus, the
+ * functions below should just be kept small; it's probably not worth
+ * optimizing for speed.
+diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c
+index 08c3c80499983..2c5197d6b944d 100644
+--- a/lib/xz/xz_dec_lzma2.c
++++ b/lib/xz/xz_dec_lzma2.c
+@@ -387,7 +387,14 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b,
+
+ *left -= copy_size;
+
+- memcpy(dict->buf + dict->pos, b->in + b->in_pos, copy_size);
++ /*
++ * If doing in-place decompression in single-call mode and the
++ * uncompressed size of the file is larger than the caller
++ * thought (i.e. it is invalid input!), the buffers below may
++ * overlap and cause undefined behavior with memcpy().
++ * With valid inputs memcpy() would be fine here.
++ */
++ memmove(dict->buf + dict->pos, b->in + b->in_pos, copy_size);
+ dict->pos += copy_size;
+
+ if (dict->full < dict->pos)
+@@ -397,7 +404,11 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b,
+ if (dict->pos == dict->end)
+ dict->pos = 0;
+
+- memcpy(b->out + b->out_pos, b->in + b->in_pos,
++ /*
++ * Like above but for multi-call mode: use memmove()
++ * to avoid undefined behavior with invalid input.
++ */
++ memmove(b->out + b->out_pos, b->in + b->in_pos,
+ copy_size);
+ }
+
+@@ -421,6 +432,12 @@ static uint32_t dict_flush(struct dictionary *dict, struct xz_buf *b)
+ if (dict->pos == dict->end)
+ dict->pos = 0;
+
++ /*
++ * These buffers cannot overlap even if doing in-place
++ * decompression because in multi-call mode dict->buf
++ * has been allocated by us in this file; it's not
++ * provided by the caller like in single-call mode.
++ */
+ memcpy(b->out + b->out_pos, dict->buf + dict->start,
+ copy_size);
+ }
+diff --git a/lib/xz/xz_dec_stream.c b/lib/xz/xz_dec_stream.c
+index bd1d182419d7e..0b161f90d8d80 100644
+--- a/lib/xz/xz_dec_stream.c
++++ b/lib/xz/xz_dec_stream.c
+@@ -402,12 +402,12 @@ static enum xz_ret dec_stream_header(struct xz_dec *s)
+ * we will accept other check types too, but then the check won't
+ * be verified and a warning (XZ_UNSUPPORTED_CHECK) will be given.
+ */
++ if (s->temp.buf[HEADER_MAGIC_SIZE + 1] > XZ_CHECK_MAX)
++ return XZ_OPTIONS_ERROR;
++
+ s->check_type = s->temp.buf[HEADER_MAGIC_SIZE + 1];
+
+ #ifdef XZ_DEC_ANY_CHECK
+- if (s->check_type > XZ_CHECK_MAX)
+- return XZ_OPTIONS_ERROR;
+-
+ if (s->check_type > XZ_CHECK_CRC32)
+ return XZ_UNSUPPORTED_CHECK;
+ #else
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index 928b3b5e24e6b..3f5a60a5a5e6a 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -1135,25 +1135,22 @@ bool out_of_memory(struct oom_control *oc)
+ }
+
+ /*
+- * The pagefault handler calls here because it is out of memory, so kill a
+- * memory-hogging task. If oom_lock is held by somebody else, a parallel oom
+- * killing is already in progress so do nothing.
++ * The pagefault handler calls here because some allocation has failed. We have
++ * to take care of the memcg OOM here because this is the only safe context without
++ * any locks held but let the oom killer triggered from the allocation context care
++ * about the global OOM.
+ */
+ void pagefault_out_of_memory(void)
+ {
+- struct oom_control oc = {
+- .zonelist = NULL,
+- .nodemask = NULL,
+- .memcg = NULL,
+- .gfp_mask = 0,
+- .order = 0,
+- };
++ static DEFINE_RATELIMIT_STATE(pfoom_rs, DEFAULT_RATELIMIT_INTERVAL,
++ DEFAULT_RATELIMIT_BURST);
+
+ if (mem_cgroup_oom_synchronize(true))
+ return;
+
+- if (!mutex_trylock(&oom_lock))
++ if (fatal_signal_pending(current))
+ return;
+- out_of_memory(&oc);
+- mutex_unlock(&oom_lock);
++
++ if (__ratelimit(&pfoom_rs))
++ pr_warn("Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF\n");
+ }
+diff --git a/mm/slab.h b/mm/slab.h
+index 9632772e14beb..0ed7a463f476c 100644
+--- a/mm/slab.h
++++ b/mm/slab.h
+@@ -148,7 +148,7 @@ static inline slab_flags_t kmem_cache_flags(unsigned int object_size,
+ #define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE | SLAB_RECLAIM_ACCOUNT | \
+ SLAB_TEMPORARY | SLAB_ACCOUNT)
+ #else
+-#define SLAB_CACHE_FLAGS (0)
++#define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE)
+ #endif
+
+ /* Common flags available with current configuration */
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index d52c005a060f1..11e81b3ff0cf3 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -1904,10 +1904,11 @@ static inline void zs_pool_dec_isolated(struct zs_pool *pool)
+ VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
+ atomic_long_dec(&pool->isolated_pages);
+ /*
+- * There's no possibility of racing, since wait_for_isolated_drain()
+- * checks the isolated count under &class->lock after enqueuing
+- * on migration_wait.
++ * Checking pool->destroying must happen after atomic_long_dec()
++ * for pool->isolated_pages above. Paired with the smp_mb() in
++ * zs_unregister_migration().
+ */
++ smp_mb__after_atomic();
+ if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
+ wake_up_all(&pool->migration_wait);
+ }
+diff --git a/net/9p/client.c b/net/9p/client.c
+index d62f83f93d7bb..bb0a43b8a6b0f 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -553,6 +553,8 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
+ kfree(ename);
+ } else {
+ err = p9pdu_readf(&req->rc, c->proto_version, "d", &ecode);
++ if (err)
++ goto out_err;
+ err = -ecode;
+
+ p9_debug(P9_DEBUG_9P, "<<< RLERROR (%d)\n", -ecode);
+diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
+index 5b71a289d04fc..cc062b69fc8d8 100644
+--- a/net/batman-adv/fragmentation.c
++++ b/net/batman-adv/fragmentation.c
+@@ -403,6 +403,7 @@ out:
+
+ /**
+ * batadv_frag_create() - create a fragment from skb
++ * @net_dev: outgoing device for fragment
+ * @skb: skb to create fragment from
+ * @frag_head: header to use in new fragment
+ * @fragment_size: size of new fragment
+@@ -413,22 +414,25 @@ out:
+ *
+ * Return: the new fragment, NULL on error.
+ */
+-static struct sk_buff *batadv_frag_create(struct sk_buff *skb,
++static struct sk_buff *batadv_frag_create(struct net_device *net_dev,
++ struct sk_buff *skb,
+ struct batadv_frag_packet *frag_head,
+ unsigned int fragment_size)
+ {
++ unsigned int ll_reserved = LL_RESERVED_SPACE(net_dev);
++ unsigned int tailroom = net_dev->needed_tailroom;
+ struct sk_buff *skb_fragment;
+ unsigned int header_size = sizeof(*frag_head);
+ unsigned int mtu = fragment_size + header_size;
+
+- skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN);
++ skb_fragment = dev_alloc_skb(ll_reserved + mtu + tailroom);
+ if (!skb_fragment)
+ goto err;
+
+ skb_fragment->priority = skb->priority;
+
+ /* Eat the last mtu-bytes of the skb */
+- skb_reserve(skb_fragment, header_size + ETH_HLEN);
++ skb_reserve(skb_fragment, ll_reserved + header_size);
+ skb_split(skb, skb_fragment, skb->len - fragment_size);
+
+ /* Add the header */
+@@ -451,11 +455,12 @@ int batadv_frag_send_packet(struct sk_buff *skb,
+ struct batadv_orig_node *orig_node,
+ struct batadv_neigh_node *neigh_node)
+ {
++ struct net_device *net_dev = neigh_node->if_incoming->net_dev;
+ struct batadv_priv *bat_priv;
+ struct batadv_hard_iface *primary_if = NULL;
+ struct batadv_frag_packet frag_header;
+ struct sk_buff *skb_fragment;
+- unsigned int mtu = neigh_node->if_incoming->net_dev->mtu;
++ unsigned int mtu = net_dev->mtu;
+ unsigned int header_size = sizeof(frag_header);
+ unsigned int max_fragment_size, num_fragments;
+ int ret;
+@@ -515,7 +520,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
+ goto put_primary_if;
+ }
+
+- skb_fragment = batadv_frag_create(skb, &frag_header,
++ skb_fragment = batadv_frag_create(net_dev, skb, &frag_header,
+ max_fragment_size);
+ if (!skb_fragment) {
+ ret = -ENOMEM;
+@@ -534,13 +539,14 @@ int batadv_frag_send_packet(struct sk_buff *skb,
+ frag_header.no++;
+ }
+
+- /* Make room for the fragment header. */
+- if (batadv_skb_head_push(skb, header_size) < 0 ||
+- pskb_expand_head(skb, header_size + ETH_HLEN, 0, GFP_ATOMIC) < 0) {
+- ret = -ENOMEM;
++ /* make sure that there is at least enough head for the fragmentation
++ * and ethernet headers
++ */
++ ret = skb_cow_head(skb, ETH_HLEN + header_size);
++ if (ret < 0)
+ goto put_primary_if;
+- }
+
++ skb_push(skb, header_size);
+ memcpy(skb->data, &frag_header, header_size);
+
+ /* Send the last fragment */
+diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
+index c4e0435c952db..fc732b78daf77 100644
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -565,6 +565,9 @@ static void batadv_hardif_recalc_extra_skbroom(struct net_device *soft_iface)
+ needed_headroom = lower_headroom + (lower_header_len - ETH_HLEN);
+ needed_headroom += batadv_max_header_len();
+
++ /* fragmentation headers don't strip the unicast/... header */
++ needed_headroom += sizeof(struct batadv_frag_packet);
++
+ soft_iface->needed_headroom = needed_headroom;
+ soft_iface->needed_tailroom = lower_tailroom;
+ }
+diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
+index b90fe25d6b0b1..9b3311dae2e4f 100644
+--- a/net/batman-adv/multicast.c
++++ b/net/batman-adv/multicast.c
+@@ -62,10 +62,12 @@
+ #include <uapi/linux/batadv_packet.h>
+ #include <uapi/linux/batman_adv.h>
+
++#include "bridge_loop_avoidance.h"
+ #include "hard-interface.h"
+ #include "hash.h"
+ #include "log.h"
+ #include "netlink.h"
++#include "send.h"
+ #include "soft-interface.h"
+ #include "translation-table.h"
+ #include "tvlv.h"
+@@ -1024,6 +1026,35 @@ batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb,
+ }
+ }
+
++/**
++ * batadv_mcast_forw_send_orig() - send a multicast packet to an originator
++ * @bat_priv: the bat priv with all the soft interface information
++ * @skb: the multicast packet to send
++ * @vid: the vlan identifier
++ * @orig_node: the originator to send the packet to
++ *
++ * Return: NET_XMIT_DROP in case of error or NET_XMIT_SUCCESS otherwise.
++ */
++int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv,
++ struct sk_buff *skb,
++ unsigned short vid,
++ struct batadv_orig_node *orig_node)
++{
++ /* Avoid sending multicast-in-unicast packets to other BLA
++ * gateways - they already got the frame from the LAN side
++ * we share with them.
++ * TODO: Refactor to take BLA into account earlier, to avoid
++ * reducing the mcast_fanout count.
++ */
++ if (batadv_bla_is_backbone_gw_orig(bat_priv, orig_node->orig, vid)) {
++ dev_kfree_skb(skb);
++ return NET_XMIT_SUCCESS;
++ }
++
++ return batadv_send_skb_unicast(bat_priv, skb, BATADV_UNICAST, 0,
++ orig_node, vid);
++}
++
+ /**
+ * batadv_mcast_want_unsnoop_update() - update unsnoop counter and list
+ * @bat_priv: the bat priv with all the soft interface information
+diff --git a/net/batman-adv/multicast.h b/net/batman-adv/multicast.h
+index 3b04ab13f0eb1..6f9f3813fc59a 100644
+--- a/net/batman-adv/multicast.h
++++ b/net/batman-adv/multicast.h
+@@ -51,6 +51,11 @@ enum batadv_forw_mode
+ batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb,
+ struct batadv_orig_node **mcast_single_orig);
+
++int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv,
++ struct sk_buff *skb,
++ unsigned short vid,
++ struct batadv_orig_node *orig_node);
++
+ void batadv_mcast_init(struct batadv_priv *bat_priv);
+
+ int batadv_mcast_flags_seq_print_text(struct seq_file *seq, void *offset);
+@@ -78,6 +83,16 @@ static inline int batadv_mcast_init(struct batadv_priv *bat_priv)
+ return 0;
+ }
+
++static inline int
++batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv,
++ struct sk_buff *skb,
++ unsigned short vid,
++ struct batadv_orig_node *orig_node)
++{
++ kfree_skb(skb);
++ return NET_XMIT_DROP;
++}
++
+ static inline int
+ batadv_mcast_mesh_info_put(struct sk_buff *msg, struct batadv_priv *bat_priv)
+ {
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 6ff78080ec7fb..1003abb8cc35e 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -367,9 +367,8 @@ send:
+ goto dropped;
+ ret = batadv_send_skb_via_gw(bat_priv, skb, vid);
+ } else if (mcast_single_orig) {
+- ret = batadv_send_skb_unicast(bat_priv, skb,
+- BATADV_UNICAST, 0,
+- mcast_single_orig, vid);
++ ret = batadv_mcast_forw_send_orig(bat_priv, skb, vid,
++ mcast_single_orig);
+ } else {
+ if (batadv_dat_snoop_outgoing_arp_request(bat_priv,
+ skb))
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index 967a9bb144157..d938311c58a8d 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1328,6 +1328,9 @@ static void l2cap_sock_close_cb(struct l2cap_chan *chan)
+ {
+ struct sock *sk = chan->data;
+
++ if (!sk)
++ return;
++
+ l2cap_sock_kill(sk);
+ }
+
+@@ -1336,6 +1339,9 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
+ struct sock *sk = chan->data;
+ struct sock *parent;
+
++ if (!sk)
++ return;
++
+ BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
+
+ /* This callback can be called both for server (BT_LISTEN)
+@@ -1519,8 +1525,10 @@ static void l2cap_sock_destruct(struct sock *sk)
+ {
+ BT_DBG("sk %p", sk);
+
+- if (l2cap_pi(sk)->chan)
++ if (l2cap_pi(sk)->chan) {
++ l2cap_pi(sk)->chan->data = NULL;
+ l2cap_chan_put(l2cap_pi(sk)->chan);
++ }
+
+ if (l2cap_pi(sk)->rx_busy_skb) {
+ kfree_skb(l2cap_pi(sk)->rx_busy_skb);
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 007a01b08dbe9..1e0a1c0a56b57 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -133,6 +133,7 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
+ return NULL;
+
+ spin_lock_init(&conn->lock);
++ INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
+
+ hcon->sco_data = conn;
+ conn->hcon = hcon;
+@@ -196,11 +197,11 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
+ sco_chan_del(sk, err);
+ bh_unlock_sock(sk);
+ sock_put(sk);
+-
+- /* Ensure no more work items will run before freeing conn. */
+- cancel_delayed_work_sync(&conn->timeout_work);
+ }
+
++ /* Ensure no more work items will run before freeing conn. */
++ cancel_delayed_work_sync(&conn->timeout_work);
++
+ hcon->sco_data = NULL;
+ kfree(conn);
+ }
+@@ -213,8 +214,6 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
+ sco_pi(sk)->conn = conn;
+ conn->sk = sk;
+
+- INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
+-
+ if (parent)
+ bt_accept_enqueue(parent, sk, true);
+ }
+@@ -280,7 +279,8 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk)
+ return err;
+ }
+
+-static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
++static int sco_send_frame(struct sock *sk, void *buf, int len,
++ unsigned int msg_flags)
+ {
+ struct sco_conn *conn = sco_pi(sk)->conn;
+ struct sk_buff *skb;
+@@ -292,15 +292,11 @@ static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
+
+ BT_DBG("sk %p len %d", sk, len);
+
+- skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
++ skb = bt_skb_send_alloc(sk, len, msg_flags & MSG_DONTWAIT, &err);
+ if (!skb)
+ return err;
+
+- if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
+- kfree_skb(skb);
+- return -EFAULT;
+- }
+-
++ memcpy(skb_put(skb, len), buf, len);
+ hci_send_sco(conn->hcon, skb);
+
+ return len;
+@@ -714,6 +710,7 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
+ size_t len)
+ {
+ struct sock *sk = sock->sk;
++ void *buf;
+ int err;
+
+ BT_DBG("sock %p, sk %p", sock, sk);
+@@ -725,14 +722,24 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
+ if (msg->msg_flags & MSG_OOB)
+ return -EOPNOTSUPP;
+
++ buf = kmalloc(len, GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
++
++ if (memcpy_from_msg(buf, msg, len)) {
++ kfree(buf);
++ return -EFAULT;
++ }
++
+ lock_sock(sk);
+
+ if (sk->sk_state == BT_CONNECTED)
+- err = sco_send_frame(sk, msg, len);
++ err = sco_send_frame(sk, buf, len, msg->msg_flags);
+ else
+ err = -ENOTCONN;
+
+ release_sock(sk);
++ kfree(buf);
+ return err;
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 397bc2f50de08..2519a90a14827 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2648,6 +2648,8 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
+ if (dev->num_tc)
+ netif_setup_tc(dev, txq);
+
++ dev_qdisc_change_real_num_tx(dev, txq);
++
+ dev->real_num_tx_queues = txq;
+
+ if (disabling) {
+diff --git a/net/core/stream.c b/net/core/stream.c
+index 7f5eaa95a6756..3d98774cf1285 100644
+--- a/net/core/stream.c
++++ b/net/core/stream.c
+@@ -195,9 +195,6 @@ void sk_stream_kill_queues(struct sock *sk)
+ /* First the read buffer. */
+ __skb_queue_purge(&sk->sk_receive_queue);
+
+- /* Next, the error queue. */
+- __skb_queue_purge(&sk->sk_error_queue);
+-
+ /* Next, the write queue. */
+ WARN_ON(!skb_queue_empty(&sk->sk_write_queue));
+
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index 2597449ae9b48..0a0bf80623658 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -417,7 +417,7 @@ static struct ctl_table net_core_table[] = {
+ .mode = 0600,
+ .proc_handler = proc_dolongvec_minmax_bpf_restricted,
+ .extra1 = &long_one,
+- .extra2 = &long_max,
++ .extra2 = &bpf_jit_limit_max,
+ },
+ #endif
+ {
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 769e1f683471a..4dce1b418acc2 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -952,7 +952,7 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags)
+ */
+ static void tcp_remove_empty_skb(struct sock *sk, struct sk_buff *skb)
+ {
+- if (skb && !skb->len) {
++ if (skb && TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) {
+ tcp_unlink_write_queue(skb, sk);
+ if (tcp_write_queue_empty(sk))
+ tcp_chrono_stop(sk, TCP_CHRONO_BUSY);
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 76c097552ea74..9d8b791f63efc 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -3054,6 +3054,9 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
+ memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4);
+
+ if (idev->dev->flags&IFF_POINTOPOINT) {
++ if (idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_NONE)
++ return;
++
+ addr.s6_addr32[0] = htonl(0xfe800000);
+ scope = IFA_LINK;
+ plen = 64;
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index f81a3ce0fe48e..eb5a052d3b252 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -566,7 +566,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
+ goto nla_put_failure;
+
+ if (indev && entskb->dev &&
+- entskb->mac_header != entskb->network_header) {
++ skb_mac_header_was_set(entskb)) {
+ struct nfqnl_msg_packet_hw phw;
+ int len;
+
+diff --git a/net/nfc/core.c b/net/nfc/core.c
+index 947a470f929d6..ff646d1758d16 100644
+--- a/net/nfc/core.c
++++ b/net/nfc/core.c
+@@ -106,13 +106,13 @@ int nfc_dev_up(struct nfc_dev *dev)
+
+ device_lock(&dev->dev);
+
+- if (dev->rfkill && rfkill_blocked(dev->rfkill)) {
+- rc = -ERFKILL;
++ if (!device_is_registered(&dev->dev)) {
++ rc = -ENODEV;
+ goto error;
+ }
+
+- if (!device_is_registered(&dev->dev)) {
+- rc = -ENODEV;
++ if (dev->rfkill && rfkill_blocked(dev->rfkill)) {
++ rc = -ERFKILL;
+ goto error;
+ }
+
+@@ -1130,11 +1130,7 @@ int nfc_register_device(struct nfc_dev *dev)
+ if (rc)
+ pr_err("Could not register llcp device\n");
+
+- rc = nfc_genl_device_added(dev);
+- if (rc)
+- pr_debug("The userspace won't be notified that the device %s was added\n",
+- dev_name(&dev->dev));
+-
++ device_lock(&dev->dev);
+ dev->rfkill = rfkill_alloc(dev_name(&dev->dev), &dev->dev,
+ RFKILL_TYPE_NFC, &nfc_rfkill_ops, dev);
+ if (dev->rfkill) {
+@@ -1143,6 +1139,12 @@ int nfc_register_device(struct nfc_dev *dev)
+ dev->rfkill = NULL;
+ }
+ }
++ device_unlock(&dev->dev);
++
++ rc = nfc_genl_device_added(dev);
++ if (rc)
++ pr_debug("The userspace won't be notified that the device %s was added\n",
++ dev_name(&dev->dev));
+
+ return 0;
+ }
+@@ -1159,10 +1161,17 @@ void nfc_unregister_device(struct nfc_dev *dev)
+
+ pr_debug("dev_name=%s\n", dev_name(&dev->dev));
+
++ rc = nfc_genl_device_removed(dev);
++ if (rc)
++ pr_debug("The userspace won't be notified that the device %s "
++ "was removed\n", dev_name(&dev->dev));
++
++ device_lock(&dev->dev);
+ if (dev->rfkill) {
+ rfkill_unregister(dev->rfkill);
+ rfkill_destroy(dev->rfkill);
+ }
++ device_unlock(&dev->dev);
+
+ if (dev->ops->check_presence) {
+ device_lock(&dev->dev);
+@@ -1172,11 +1181,6 @@ void nfc_unregister_device(struct nfc_dev *dev)
+ cancel_work_sync(&dev->check_pres_work);
+ }
+
+- rc = nfc_genl_device_removed(dev);
+- if (rc)
+- pr_debug("The userspace won't be notified that the device %s "
+- "was removed\n", dev_name(&dev->dev));
+-
+ nfc_llcp_unregister_device(dev);
+
+ mutex_lock(&nfc_devlist_mutex);
+diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
+index 33c23af6709d4..1008bbbb3af9c 100644
+--- a/net/nfc/nci/core.c
++++ b/net/nfc/nci/core.c
+@@ -156,12 +156,15 @@ inline int nci_request(struct nci_dev *ndev,
+ {
+ int rc;
+
+- if (!test_bit(NCI_UP, &ndev->flags))
+- return -ENETDOWN;
+-
+ /* Serialize all requests */
+ mutex_lock(&ndev->req_lock);
+- rc = __nci_request(ndev, req, opt, timeout);
++ /* check the state after obtaing the lock against any races
++ * from nci_close_device when the device gets removed.
++ */
++ if (test_bit(NCI_UP, &ndev->flags))
++ rc = __nci_request(ndev, req, opt, timeout);
++ else
++ rc = -ENETDOWN;
+ mutex_unlock(&ndev->req_lock);
+
+ return rc;
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 4e15913e7519e..2128b77d5cb33 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -1256,6 +1256,15 @@ static int qdisc_change_tx_queue_len(struct net_device *dev,
+ return 0;
+ }
+
++void dev_qdisc_change_real_num_tx(struct net_device *dev,
++ unsigned int new_real_tx)
++{
++ struct Qdisc *qdisc = dev->qdisc;
++
++ if (qdisc->ops->change_real_num_tx)
++ qdisc->ops->change_real_num_tx(qdisc, new_real_tx);
++}
++
+ int dev_qdisc_change_tx_queue_len(struct net_device *dev)
+ {
+ bool up = dev->flags & IFF_UP;
+diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
+index c008a316e9436..699b6bb444cea 100644
+--- a/net/sched/sch_mq.c
++++ b/net/sched/sch_mq.c
+@@ -130,6 +130,29 @@ static void mq_attach(struct Qdisc *sch)
+ priv->qdiscs = NULL;
+ }
+
++static void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx)
++{
++#ifdef CONFIG_NET_SCHED
++ struct net_device *dev = qdisc_dev(sch);
++ struct Qdisc *qdisc;
++ unsigned int i;
++
++ for (i = new_real_tx; i < dev->real_num_tx_queues; i++) {
++ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
++ /* Only update the default qdiscs we created,
++ * qdiscs with handles are always hashed.
++ */
++ if (qdisc != &noop_qdisc && !qdisc->handle)
++ qdisc_hash_del(qdisc);
++ }
++ for (i = dev->real_num_tx_queues; i < new_real_tx; i++) {
++ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
++ if (qdisc != &noop_qdisc && !qdisc->handle)
++ qdisc_hash_add(qdisc, false);
++ }
++#endif
++}
++
+ static int mq_dump(struct Qdisc *sch, struct sk_buff *skb)
+ {
+ struct net_device *dev = qdisc_dev(sch);
+@@ -285,6 +308,7 @@ struct Qdisc_ops mq_qdisc_ops __read_mostly = {
+ .init = mq_init,
+ .destroy = mq_destroy,
+ .attach = mq_attach,
++ .change_real_num_tx = mq_change_real_num_tx,
+ .dump = mq_dump,
+ .owner = THIS_MODULE,
+ };
+diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
+index fcfe41a954733..3fd0e5dd7ae3e 100644
+--- a/net/sched/sch_mqprio.c
++++ b/net/sched/sch_mqprio.c
+@@ -308,6 +308,28 @@ static void mqprio_attach(struct Qdisc *sch)
+ priv->qdiscs = NULL;
+ }
+
++static void mqprio_change_real_num_tx(struct Qdisc *sch,
++ unsigned int new_real_tx)
++{
++ struct net_device *dev = qdisc_dev(sch);
++ struct Qdisc *qdisc;
++ unsigned int i;
++
++ for (i = new_real_tx; i < dev->real_num_tx_queues; i++) {
++ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
++ /* Only update the default qdiscs we created,
++ * qdiscs with handles are always hashed.
++ */
++ if (qdisc != &noop_qdisc && !qdisc->handle)
++ qdisc_hash_del(qdisc);
++ }
++ for (i = dev->real_num_tx_queues; i < new_real_tx; i++) {
++ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
++ if (qdisc != &noop_qdisc && !qdisc->handle)
++ qdisc_hash_add(qdisc, false);
++ }
++}
++
+ static struct netdev_queue *mqprio_queue_get(struct Qdisc *sch,
+ unsigned long cl)
+ {
+@@ -632,6 +654,7 @@ static struct Qdisc_ops mqprio_qdisc_ops __read_mostly = {
+ .init = mqprio_init,
+ .destroy = mqprio_destroy,
+ .attach = mqprio_attach,
++ .change_real_num_tx = mqprio_change_real_num_tx,
+ .dump = mqprio_dump,
+ .owner = THIS_MODULE,
+ };
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 2d31fce5c2185..37329e11dc3cc 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1159,6 +1159,8 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
+ * non-blocking call.
+ */
+ err = -EALREADY;
++ if (flags & O_NONBLOCK)
++ goto out;
+ break;
+ default:
+ if ((sk->sk_state == TCP_LISTEN) ||
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index e7be500b64525..82bf1339c28e8 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -950,6 +950,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
+
+ switch (otype) {
+ case NL80211_IFTYPE_AP:
++ case NL80211_IFTYPE_P2P_GO:
+ cfg80211_stop_ap(rdev, dev, true);
+ break;
+ case NL80211_IFTYPE_ADHOC:
+diff --git a/samples/kprobes/kretprobe_example.c b/samples/kprobes/kretprobe_example.c
+index 7f9060f435cde..da6de5e78e1dd 100644
+--- a/samples/kprobes/kretprobe_example.c
++++ b/samples/kprobes/kretprobe_example.c
+@@ -83,7 +83,7 @@ static int __init kretprobe_init(void)
+ ret = register_kretprobe(&my_kretprobe);
+ if (ret < 0) {
+ pr_err("register_kretprobe failed, returned %d\n", ret);
+- return -1;
++ return ret;
+ }
+ pr_info("Planted return probe at %s: %p\n",
+ my_kretprobe.kp.symbol_name, my_kretprobe.kp.addr);
+diff --git a/scripts/leaking_addresses.pl b/scripts/leaking_addresses.pl
+index 6a897788f5a7e..6e4b0f7ae38cf 100755
+--- a/scripts/leaking_addresses.pl
++++ b/scripts/leaking_addresses.pl
+@@ -456,8 +456,9 @@ sub parse_file
+
+ open my $fh, "<", $file or return;
+ while ( <$fh> ) {
++ chomp;
+ if (may_leak_address($_)) {
+- print $file . ': ' . $_;
++ printf("$file: $_\n");
+ }
+ }
+ close $fh;
+diff --git a/security/Kconfig b/security/Kconfig
+index d9aa521b52063..27e73c3b43923 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -191,6 +191,9 @@ config HARDENED_USERCOPY_PAGESPAN
+ config FORTIFY_SOURCE
+ bool "Harden common str/mem functions against buffer overflows"
+ depends on ARCH_HAS_FORTIFY_SOURCE
++ # https://bugs.llvm.org/show_bug.cgi?id=50322
++ # https://bugs.llvm.org/show_bug.cgi?id=41459
++ depends on !CC_IS_CLANG
+ help
+ Detect overflows of buffers in common string and memory functions
+ where the compiler can determine and validate the buffer sizes.
+diff --git a/security/apparmor/label.c b/security/apparmor/label.c
+index 6727e6fb69df2..5a80a16a7f751 100644
+--- a/security/apparmor/label.c
++++ b/security/apparmor/label.c
+@@ -1463,7 +1463,7 @@ bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
+ if (label->hname || labels_ns(label) != ns)
+ return res;
+
+- if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1)
++ if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0)
+ return res;
+
+ ls = labels_set(label);
+@@ -1713,7 +1713,7 @@ int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
+
+ /**
+ * aa_label_acntsxprint - allocate a __counted string buffer and print label
+- * @strp: buffer to write to. (MAY BE NULL if @size == 0)
++ * @strp: buffer to write to.
+ * @ns: namespace profile is being viewed from
+ * @label: label to view (NOT NULL)
+ * @flags: flags controlling what label info is printed
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index d11a61f7b2009..6d1efe1359f17 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -59,7 +59,7 @@ static struct xattr_list evm_config_default_xattrnames[] = {
+
+ LIST_HEAD(evm_config_xattrnames);
+
+-static int evm_fixmode;
++static int evm_fixmode __ro_after_init;
+ static int __init evm_set_fixmode(char *str)
+ {
+ if (strncmp(str, "fix", 3) == 0)
+diff --git a/security/security.c b/security/security.c
+index 9478444bf93f7..fc1410550b79f 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -232,25 +232,25 @@ EXPORT_SYMBOL(unregister_lsm_notifier);
+
+ /* Security operations */
+
+-int security_binder_set_context_mgr(struct task_struct *mgr)
++int security_binder_set_context_mgr(const struct cred *mgr)
+ {
+ return call_int_hook(binder_set_context_mgr, 0, mgr);
+ }
+
+-int security_binder_transaction(struct task_struct *from,
+- struct task_struct *to)
++int security_binder_transaction(const struct cred *from,
++ const struct cred *to)
+ {
+ return call_int_hook(binder_transaction, 0, from, to);
+ }
+
+-int security_binder_transfer_binder(struct task_struct *from,
+- struct task_struct *to)
++int security_binder_transfer_binder(const struct cred *from,
++ const struct cred *to)
+ {
+ return call_int_hook(binder_transfer_binder, 0, from, to);
+ }
+
+-int security_binder_transfer_file(struct task_struct *from,
+- struct task_struct *to, struct file *file)
++int security_binder_transfer_file(const struct cred *from,
++ const struct cred *to, struct file *file)
+ {
+ return call_int_hook(binder_transfer_file, 0, from, to, file);
+ }
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 08833bbb97aab..89dfdbb131291 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -2218,22 +2218,19 @@ static inline u32 open_file_to_av(struct file *file)
+
+ /* Hook functions begin here. */
+
+-static int selinux_binder_set_context_mgr(struct task_struct *mgr)
++static int selinux_binder_set_context_mgr(const struct cred *mgr)
+ {
+- u32 mysid = current_sid();
+- u32 mgrsid = task_sid(mgr);
+-
+ return avc_has_perm(&selinux_state,
+- mysid, mgrsid, SECCLASS_BINDER,
++ current_sid(), cred_sid(mgr), SECCLASS_BINDER,
+ BINDER__SET_CONTEXT_MGR, NULL);
+ }
+
+-static int selinux_binder_transaction(struct task_struct *from,
+- struct task_struct *to)
++static int selinux_binder_transaction(const struct cred *from,
++ const struct cred *to)
+ {
+ u32 mysid = current_sid();
+- u32 fromsid = task_sid(from);
+- u32 tosid = task_sid(to);
++ u32 fromsid = cred_sid(from);
++ u32 tosid = cred_sid(to);
+ int rc;
+
+ if (mysid != fromsid) {
+@@ -2244,27 +2241,24 @@ static int selinux_binder_transaction(struct task_struct *from,
+ return rc;
+ }
+
+- return avc_has_perm(&selinux_state,
+- fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
+- NULL);
++ return avc_has_perm(&selinux_state, fromsid, tosid,
++ SECCLASS_BINDER, BINDER__CALL, NULL);
+ }
+
+-static int selinux_binder_transfer_binder(struct task_struct *from,
+- struct task_struct *to)
++static int selinux_binder_transfer_binder(const struct cred *from,
++ const struct cred *to)
+ {
+- u32 fromsid = task_sid(from);
+- u32 tosid = task_sid(to);
+-
+ return avc_has_perm(&selinux_state,
+- fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
++ cred_sid(from), cred_sid(to),
++ SECCLASS_BINDER, BINDER__TRANSFER,
+ NULL);
+ }
+
+-static int selinux_binder_transfer_file(struct task_struct *from,
+- struct task_struct *to,
++static int selinux_binder_transfer_file(const struct cred *from,
++ const struct cred *to,
+ struct file *file)
+ {
+- u32 sid = task_sid(to);
++ u32 sid = cred_sid(to);
+ struct file_security_struct *fsec = file->f_security;
+ struct dentry *dentry = file->f_path.dentry;
+ struct inode_security_struct *isec;
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index 009e83ee2d002..a9c516362170a 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -721,9 +721,7 @@ static void smk_cipso_doi(void)
+ printk(KERN_WARNING "%s:%d remove rc = %d\n",
+ __func__, __LINE__, rc);
+
+- doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
+- if (doip == NULL)
+- panic("smack: Failed to initialize cipso DOI.\n");
++ doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL | __GFP_NOFAIL);
+ doip->map.std = NULL;
+ doip->doi = smk_cipso_doi_value;
+ doip->type = CIPSO_V4_MAP_PASS;
+@@ -742,7 +740,7 @@ static void smk_cipso_doi(void)
+ if (rc != 0) {
+ printk(KERN_WARNING "%s:%d map add rc = %d\n",
+ __func__, __LINE__, rc);
+- kfree(doip);
++ netlbl_cfg_cipsov4_del(doip->doi, &nai);
+ return;
+ }
+ }
+@@ -859,6 +857,7 @@ static int smk_open_cipso(struct inode *inode, struct file *file)
+ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
+ size_t count, loff_t *ppos, int format)
+ {
++ struct netlbl_lsm_catmap *old_cat;
+ struct smack_known *skp;
+ struct netlbl_lsm_secattr ncats;
+ char mapcatset[SMK_CIPSOLEN];
+@@ -948,9 +947,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
+
+ rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
+ if (rc >= 0) {
+- netlbl_catmap_free(skp->smk_netlabel.attr.mls.cat);
++ old_cat = skp->smk_netlabel.attr.mls.cat;
+ skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
+ skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
++ synchronize_rcu();
++ netlbl_catmap_free(old_cat);
+ rc = count;
+ }
+
+diff --git a/sound/core/Makefile b/sound/core/Makefile
+index ee4a4a6b99ba7..d123587c0fd8f 100644
+--- a/sound/core/Makefile
++++ b/sound/core/Makefile
+@@ -9,7 +9,9 @@ ifneq ($(CONFIG_SND_PROC_FS),)
+ snd-y += info.o
+ snd-$(CONFIG_SND_OSSEMUL) += info_oss.o
+ endif
++ifneq ($(CONFIG_M68K),y)
+ snd-$(CONFIG_ISA_DMA_API) += isadma.o
++endif
+ snd-$(CONFIG_SND_OSSEMUL) += sound_oss.o
+ snd-$(CONFIG_SND_VMASTER) += vmaster.o
+ snd-$(CONFIG_SND_JACK) += ctljack.o jack.o
+diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
+index 64d904bee8bb3..cb27bbe75e614 100644
+--- a/sound/core/oss/mixer_oss.c
++++ b/sound/core/oss/mixer_oss.c
+@@ -145,11 +145,13 @@ static int snd_mixer_oss_devmask(struct snd_mixer_oss_file *fmixer)
+
+ if (mixer == NULL)
+ return -EIO;
++ mutex_lock(&mixer->reg_mutex);
+ for (chn = 0; chn < 31; chn++) {
+ pslot = &mixer->slots[chn];
+ if (pslot->put_volume || pslot->put_recsrc)
+ result |= 1 << chn;
+ }
++ mutex_unlock(&mixer->reg_mutex);
+ return result;
+ }
+
+@@ -161,11 +163,13 @@ static int snd_mixer_oss_stereodevs(struct snd_mixer_oss_file *fmixer)
+
+ if (mixer == NULL)
+ return -EIO;
++ mutex_lock(&mixer->reg_mutex);
+ for (chn = 0; chn < 31; chn++) {
+ pslot = &mixer->slots[chn];
+ if (pslot->put_volume && pslot->stereo)
+ result |= 1 << chn;
+ }
++ mutex_unlock(&mixer->reg_mutex);
+ return result;
+ }
+
+@@ -176,6 +180,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer)
+
+ if (mixer == NULL)
+ return -EIO;
++ mutex_lock(&mixer->reg_mutex);
+ if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */
+ result = mixer->mask_recsrc;
+ } else {
+@@ -187,6 +192,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer)
+ result |= 1 << chn;
+ }
+ }
++ mutex_unlock(&mixer->reg_mutex);
+ return result;
+ }
+
+@@ -197,11 +203,12 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer)
+
+ if (mixer == NULL)
+ return -EIO;
++ mutex_lock(&mixer->reg_mutex);
+ if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */
+- int err;
+ unsigned int index;
+- if ((err = mixer->get_recsrc(fmixer, &index)) < 0)
+- return err;
++ result = mixer->get_recsrc(fmixer, &index);
++ if (result < 0)
++ goto unlock;
+ result = 1 << index;
+ } else {
+ struct snd_mixer_oss_slot *pslot;
+@@ -216,7 +223,10 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer)
+ }
+ }
+ }
+- return mixer->oss_recsrc = result;
++ mixer->oss_recsrc = result;
++ unlock:
++ mutex_unlock(&mixer->reg_mutex);
++ return result;
+ }
+
+ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsrc)
+@@ -229,6 +239,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr
+
+ if (mixer == NULL)
+ return -EIO;
++ mutex_lock(&mixer->reg_mutex);
+ if (mixer->get_recsrc && mixer->put_recsrc) { /* exclusive input */
+ if (recsrc & ~mixer->oss_recsrc)
+ recsrc &= ~mixer->oss_recsrc;
+@@ -254,6 +265,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr
+ }
+ }
+ }
++ mutex_unlock(&mixer->reg_mutex);
+ return result;
+ }
+
+@@ -265,6 +277,7 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot)
+
+ if (mixer == NULL || slot > 30)
+ return -EIO;
++ mutex_lock(&mixer->reg_mutex);
+ pslot = &mixer->slots[slot];
+ left = pslot->volume[0];
+ right = pslot->volume[1];
+@@ -272,15 +285,21 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot)
+ result = pslot->get_volume(fmixer, pslot, &left, &right);
+ if (!pslot->stereo)
+ right = left;
+- if (snd_BUG_ON(left < 0 || left > 100))
+- return -EIO;
+- if (snd_BUG_ON(right < 0 || right > 100))
+- return -EIO;
++ if (snd_BUG_ON(left < 0 || left > 100)) {
++ result = -EIO;
++ goto unlock;
++ }
++ if (snd_BUG_ON(right < 0 || right > 100)) {
++ result = -EIO;
++ goto unlock;
++ }
+ if (result >= 0) {
+ pslot->volume[0] = left;
+ pslot->volume[1] = right;
+ result = (left & 0xff) | ((right & 0xff) << 8);
+ }
++ unlock:
++ mutex_unlock(&mixer->reg_mutex);
+ return result;
+ }
+
+@@ -293,6 +312,7 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer,
+
+ if (mixer == NULL || slot > 30)
+ return -EIO;
++ mutex_lock(&mixer->reg_mutex);
+ pslot = &mixer->slots[slot];
+ if (left > 100)
+ left = 100;
+@@ -303,10 +323,13 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer,
+ if (pslot->put_volume)
+ result = pslot->put_volume(fmixer, pslot, left, right);
+ if (result < 0)
+- return result;
++ goto unlock;
+ pslot->volume[0] = left;
+ pslot->volume[1] = right;
+- return (left & 0xff) | ((right & 0xff) << 8);
++ result = (left & 0xff) | ((right & 0xff) << 8);
++ unlock:
++ mutex_unlock(&mixer->reg_mutex);
++ return result;
+ }
+
+ static int snd_mixer_oss_ioctl1(struct snd_mixer_oss_file *fmixer, unsigned int cmd, unsigned long arg)
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index b4fe1324b56c2..4920ec4f45948 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -593,13 +593,13 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
+ if (!timer)
+ return -EINVAL;
+ spin_lock_irqsave(&timer->lock, flags);
++ list_del_init(&timeri->ack_list);
++ list_del_init(&timeri->active_list);
+ if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
+ SNDRV_TIMER_IFLG_START))) {
+ result = -EBUSY;
+ goto unlock;
+ }
+- list_del_init(&timeri->ack_list);
+- list_del_init(&timeri->active_list);
+ if (timer->card && timer->card->shutdown)
+ goto unlock;
+ if (stop) {
+@@ -634,23 +634,22 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
+ static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop)
+ {
+ unsigned long flags;
++ bool running;
+
+ spin_lock_irqsave(&slave_active_lock, flags);
+- if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) {
+- spin_unlock_irqrestore(&slave_active_lock, flags);
+- return -EBUSY;
+- }
++ running = timeri->flags & SNDRV_TIMER_IFLG_RUNNING;
+ timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
+ if (timeri->timer) {
+ spin_lock(&timeri->timer->lock);
+ list_del_init(&timeri->ack_list);
+ list_del_init(&timeri->active_list);
+- snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
+- SNDRV_TIMER_EVENT_PAUSE);
++ if (running)
++ snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
++ SNDRV_TIMER_EVENT_PAUSE);
+ spin_unlock(&timeri->timer->lock);
+ }
+ spin_unlock_irqrestore(&slave_active_lock, flags);
+- return 0;
++ return running ? 0 : -EBUSY;
+ }
+
+ /*
+diff --git a/sound/isa/Kconfig b/sound/isa/Kconfig
+index d7db1eeebc844..f8f3433925bb4 100644
+--- a/sound/isa/Kconfig
++++ b/sound/isa/Kconfig
+@@ -21,7 +21,7 @@ config SND_SB16_DSP
+ menuconfig SND_ISA
+ bool "ISA sound devices"
+ depends on ISA || COMPILE_TEST
+- depends on ISA_DMA_API
++ depends on ISA_DMA_API && !M68K
+ default y
+ help
+ Support for sound devices connected via the ISA bus.
+diff --git a/sound/isa/gus/gus_dma.c b/sound/isa/gus/gus_dma.c
+index 7f95f452f1064..48e76b8fede41 100644
+--- a/sound/isa/gus/gus_dma.c
++++ b/sound/isa/gus/gus_dma.c
+@@ -141,6 +141,8 @@ static void snd_gf1_dma_interrupt(struct snd_gus_card * gus)
+ }
+ block = snd_gf1_dma_next_block(gus);
+ spin_unlock(&gus->dma_lock);
++ if (!block)
++ return;
+ snd_gf1_dma_program(gus, block->addr, block->buf_addr, block->count, (unsigned short) block->cmd);
+ kfree(block);
+ #if 0
+diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
+index 4105d9f653d90..bbaf46dc3f804 100644
+--- a/sound/pci/Kconfig
++++ b/sound/pci/Kconfig
+@@ -278,6 +278,7 @@ config SND_CS46XX_NEW_DSP
+ config SND_CS5530
+ tristate "CS5530 Audio"
+ depends on ISA_DMA_API && (X86_32 || COMPILE_TEST)
++ depends on !M68K
+ select SND_SB16_DSP
+ help
+ Say Y here to include support for audio on Cyrix/NatSemi CS5530 chips.
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 2cd8bfd5293b9..7d4b6c31dfe70 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -743,13 +743,17 @@ static int azx_intel_link_power(struct azx *chip, bool enable)
+ * the update-IRQ timing. The IRQ is issued before actually the
+ * data is processed. So, we need to process it afterwords in a
+ * workqueue.
++ *
++ * Returns 1 if OK to proceed, 0 for delay handling, -1 for skipping update
+ */
+ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
+ {
+ struct snd_pcm_substream *substream = azx_dev->core.substream;
++ struct snd_pcm_runtime *runtime = substream->runtime;
+ int stream = substream->stream;
+ u32 wallclk;
+ unsigned int pos;
++ snd_pcm_uframes_t hwptr, target;
+
+ wallclk = azx_readl(chip, WALLCLK) - azx_dev->core.start_wallclk;
+ if (wallclk < (azx_dev->core.period_wallclk * 2) / 3)
+@@ -786,6 +790,24 @@ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
+ /* NG - it's below the first next period boundary */
+ return chip->bdl_pos_adj ? 0 : -1;
+ azx_dev->core.start_wallclk += wallclk;
++
++ if (azx_dev->core.no_period_wakeup)
++ return 1; /* OK, no need to check period boundary */
++
++ if (runtime->hw_ptr_base != runtime->hw_ptr_interrupt)
++ return 1; /* OK, already in hwptr updating process */
++
++ /* check whether the period gets really elapsed */
++ pos = bytes_to_frames(runtime, pos);
++ hwptr = runtime->hw_ptr_base + pos;
++ if (hwptr < runtime->status->hw_ptr)
++ hwptr += runtime->buffer_size;
++ target = runtime->hw_ptr_interrupt + runtime->period_size;
++ if (hwptr < target) {
++ /* too early wakeup, process it later */
++ return chip->bdl_pos_adj ? 0 : -1;
++ }
++
+ return 1; /* OK, it's fine */
+ }
+
+@@ -983,11 +1005,7 @@ static unsigned int azx_get_pos_skl(struct azx *chip, struct azx_dev *azx_dev)
+ if (azx_dev->core.substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+ return azx_skl_get_dpib_pos(chip, azx_dev);
+
+- /* For capture, we need to read posbuf, but it requires a delay
+- * for the possible boundary overlap; the read of DPIB fetches the
+- * actual posbuf
+- */
+- udelay(20);
++ /* read of DPIB fetches the actual posbuf */
+ azx_skl_get_dpib_pos(chip, azx_dev);
+ return azx_get_pos_posbuf(chip, azx_dev);
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2161c57d26c5d..56d87e53346f1 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2525,6 +2525,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x67f1, "Clevo PC70H[PRS]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x7715, "Clevo X170KM-G", ALC1220_FIXUP_CLEVO_PB51ED),
+diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
+index 4cb3e11c66af7..9471ba17e371b 100644
+--- a/sound/soc/codecs/cs42l42.c
++++ b/sound/soc/codecs/cs42l42.c
+@@ -95,7 +95,7 @@ static const struct reg_default cs42l42_reg_defaults[] = {
+ { CS42L42_ASP_RX_INT_MASK, 0x1F },
+ { CS42L42_ASP_TX_INT_MASK, 0x0F },
+ { CS42L42_CODEC_INT_MASK, 0x03 },
+- { CS42L42_SRCPL_INT_MASK, 0xFF },
++ { CS42L42_SRCPL_INT_MASK, 0x7F },
+ { CS42L42_VPMON_INT_MASK, 0x01 },
+ { CS42L42_PLL_LOCK_INT_MASK, 0x01 },
+ { CS42L42_TSRS_PLUG_INT_MASK, 0x0F },
+@@ -132,7 +132,7 @@ static const struct reg_default cs42l42_reg_defaults[] = {
+ { CS42L42_MIXER_CHA_VOL, 0x3F },
+ { CS42L42_MIXER_ADC_VOL, 0x3F },
+ { CS42L42_MIXER_CHB_VOL, 0x3F },
+- { CS42L42_EQ_COEF_IN0, 0x22 },
++ { CS42L42_EQ_COEF_IN0, 0x00 },
+ { CS42L42_EQ_COEF_IN1, 0x00 },
+ { CS42L42_EQ_COEF_IN2, 0x00 },
+ { CS42L42_EQ_COEF_IN3, 0x00 },
+@@ -1799,8 +1799,9 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,
+ NULL, cs42l42_irq_thread,
+ IRQF_ONESHOT | IRQF_TRIGGER_LOW,
+ "cs42l42", cs42l42);
+-
+- if (ret != 0)
++ if (ret == -EPROBE_DEFER)
++ goto err_disable;
++ else if (ret != 0)
+ dev_err(&i2c_client->dev,
+ "Failed to request IRQ: %d\n", ret);
+
+diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
+index 663a208c2f784..4af87340b1655 100644
+--- a/sound/soc/codecs/nau8824.c
++++ b/sound/soc/codecs/nau8824.c
+@@ -11,6 +11,7 @@
+
+ #include <linux/module.h>
+ #include <linux/delay.h>
++#include <linux/dmi.h>
+ #include <linux/init.h>
+ #include <linux/i2c.h>
+ #include <linux/regmap.h>
+@@ -30,6 +31,12 @@
+
+ #include "nau8824.h"
+
++#define NAU8824_JD_ACTIVE_HIGH BIT(0)
++
++static int nau8824_quirk;
++static int quirk_override = -1;
++module_param_named(quirk, quirk_override, uint, 0444);
++MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static int nau8824_config_sysclk(struct nau8824 *nau8824,
+ int clk_id, unsigned int freq);
+@@ -1878,6 +1885,34 @@ static int nau8824_read_device_properties(struct device *dev,
+ return 0;
+ }
+
++/* Please keep this list alphabetically sorted */
++static const struct dmi_system_id nau8824_quirk_table[] = {
++ {
++ /* Cyberbook T116 rugged tablet */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "20170531"),
++ },
++ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH),
++ },
++ {}
++};
++
++static void nau8824_check_quirks(void)
++{
++ const struct dmi_system_id *dmi_id;
++
++ if (quirk_override != -1) {
++ nau8824_quirk = quirk_override;
++ return;
++ }
++
++ dmi_id = dmi_first_match(nau8824_quirk_table);
++ if (dmi_id)
++ nau8824_quirk = (unsigned long)dmi_id->driver_data;
++}
++
+ static int nau8824_i2c_probe(struct i2c_client *i2c,
+ const struct i2c_device_id *id)
+ {
+@@ -1902,6 +1937,11 @@ static int nau8824_i2c_probe(struct i2c_client *i2c,
+ nau8824->irq = i2c->irq;
+ sema_init(&nau8824->jd_sem, 1);
+
++ nau8824_check_quirks();
++
++ if (nau8824_quirk & NAU8824_JD_ACTIVE_HIGH)
++ nau8824->jkdet_polarity = 0;
++
+ nau8824_print_device_properties(nau8824);
+
+ ret = regmap_read(nau8824->regmap, NAU8824_REG_I2C_DEVICE_ID, &value);
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 0f3489359d34c..e04c48c67458a 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2511,8 +2511,13 @@ static struct snd_soc_dapm_widget *dapm_find_widget(
+ return NULL;
+ }
+
+-static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm,
+- const char *pin, int status)
++/*
++ * set the DAPM pin status:
++ * returns 1 when the value has been updated, 0 when unchanged, or a negative
++ * error code; called from kcontrol put callback
++ */
++static int __snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm,
++ const char *pin, int status)
+ {
+ struct snd_soc_dapm_widget *w = dapm_find_widget(dapm, pin, true);
+ int ret = 0;
+@@ -2538,6 +2543,18 @@ static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm,
+ return ret;
+ }
+
++/*
++ * similar as __snd_soc_dapm_set_pin(), but returns 0 when successful;
++ * called from several API functions below
++ */
++static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm,
++ const char *pin, int status)
++{
++ int ret = __snd_soc_dapm_set_pin(dapm, pin, status);
++
++ return ret < 0 ? ret : 0;
++}
++
+ /**
+ * snd_soc_dapm_sync_unlocked - scan and power dapm paths
+ * @dapm: DAPM context
+@@ -3465,10 +3482,10 @@ int snd_soc_dapm_put_pin_switch(struct snd_kcontrol *kcontrol,
+ const char *pin = (const char *)kcontrol->private_value;
+ int ret;
+
+- if (ucontrol->value.integer.value[0])
+- ret = snd_soc_dapm_enable_pin(&card->dapm, pin);
+- else
+- ret = snd_soc_dapm_disable_pin(&card->dapm, pin);
++ mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
++ ret = __snd_soc_dapm_set_pin(&card->dapm, pin,
++ !!ucontrol->value.integer.value[0]);
++ mutex_unlock(&card->dapm_mutex);
+
+ snd_soc_dapm_sync(&card->dapm);
+ return ret;
+diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c
+index 64f3141a3e1b4..d8140ad98d5f0 100644
+--- a/sound/synth/emux/emux.c
++++ b/sound/synth/emux/emux.c
+@@ -101,7 +101,7 @@ int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, ch
+ emu->name = kstrdup(name, GFP_KERNEL);
+ emu->voices = kcalloc(emu->max_voices, sizeof(struct snd_emux_voice),
+ GFP_KERNEL);
+- if (emu->voices == NULL)
++ if (emu->name == NULL || emu->voices == NULL)
+ return -ENOMEM;
+
+ /* create soundfont list */
+diff --git a/sound/usb/6fire/comm.c b/sound/usb/6fire/comm.c
+index 161215d78d952..f29c115b9d564 100644
+--- a/sound/usb/6fire/comm.c
++++ b/sound/usb/6fire/comm.c
+@@ -99,7 +99,7 @@ static int usb6fire_comm_send_buffer(u8 *buffer, struct usb_device *dev)
+ int actual_len;
+
+ ret = usb_interrupt_msg(dev, usb_sndintpipe(dev, COMM_EP),
+- buffer, buffer[1] + 2, &actual_len, HZ);
++ buffer, buffer[1] + 2, &actual_len, 1000);
+ if (ret < 0)
+ return ret;
+ else if (actual_len != buffer[1] + 2)
+diff --git a/sound/usb/6fire/firmware.c b/sound/usb/6fire/firmware.c
+index 9520b4cd70385..7a89111041edc 100644
+--- a/sound/usb/6fire/firmware.c
++++ b/sound/usb/6fire/firmware.c
+@@ -166,7 +166,7 @@ static int usb6fire_fw_ezusb_write(struct usb_device *device,
+
+ ret = usb_control_msg(device, usb_sndctrlpipe(device, 0), type,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- value, 0, data, len, HZ);
++ value, 0, data, len, 1000);
+ if (ret < 0)
+ return ret;
+ else if (ret != len)
+@@ -179,7 +179,7 @@ static int usb6fire_fw_ezusb_read(struct usb_device *device,
+ {
+ int ret = usb_control_msg(device, usb_rcvctrlpipe(device, 0), type,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, value,
+- 0, data, len, HZ);
++ 0, data, len, 1000);
+ if (ret < 0)
+ return ret;
+ else if (ret != len)
+@@ -194,7 +194,7 @@ static int usb6fire_fw_fpga_write(struct usb_device *device,
+ int ret;
+
+ ret = usb_bulk_msg(device, usb_sndbulkpipe(device, FPGA_EP), data, len,
+- &actual_len, HZ);
++ &actual_len, 1000);
+ if (ret < 0)
+ return ret;
+ else if (actual_len != len)
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index 2163fd6dce664..67d74218d861b 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -117,12 +117,12 @@ static int line6_send_raw_message(struct usb_line6 *line6, const char *buffer,
+ retval = usb_interrupt_msg(line6->usbdev,
+ usb_sndintpipe(line6->usbdev, properties->ep_ctrl_w),
+ (char *)frag_buf, frag_size,
+- &partial, LINE6_TIMEOUT * HZ);
++ &partial, LINE6_TIMEOUT);
+ } else {
+ retval = usb_bulk_msg(line6->usbdev,
+ usb_sndbulkpipe(line6->usbdev, properties->ep_ctrl_w),
+ (char *)frag_buf, frag_size,
+- &partial, LINE6_TIMEOUT * HZ);
++ &partial, LINE6_TIMEOUT);
+ }
+
+ if (retval) {
+@@ -365,7 +365,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
+ ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+ (datalen << 8) | 0x21, address,
+- NULL, 0, LINE6_TIMEOUT * HZ);
++ NULL, 0, LINE6_TIMEOUT);
+
+ if (ret < 0) {
+ dev_err(line6->ifcdev, "read request failed (error %d)\n", ret);
+@@ -380,7 +380,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE |
+ USB_DIR_IN,
+ 0x0012, 0x0000, len, 1,
+- LINE6_TIMEOUT * HZ);
++ LINE6_TIMEOUT);
+ if (ret < 0) {
+ dev_err(line6->ifcdev,
+ "receive length failed (error %d)\n", ret);
+@@ -408,7 +408,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
+ ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+ 0x0013, 0x0000, data, datalen,
+- LINE6_TIMEOUT * HZ);
++ LINE6_TIMEOUT);
+
+ if (ret < 0)
+ dev_err(line6->ifcdev, "read failed (error %d)\n", ret);
+@@ -440,7 +440,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
+ ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+ 0x0022, address, data, datalen,
+- LINE6_TIMEOUT * HZ);
++ LINE6_TIMEOUT);
+
+ if (ret < 0) {
+ dev_err(line6->ifcdev,
+@@ -456,7 +456,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE |
+ USB_DIR_IN,
+ 0x0012, 0x0000,
+- status, 1, LINE6_TIMEOUT * HZ);
++ status, 1, LINE6_TIMEOUT);
+
+ if (ret < 0) {
+ dev_err(line6->ifcdev,
+diff --git a/sound/usb/line6/driver.h b/sound/usb/line6/driver.h
+index 650d909c9c4ff..d2d786eadfde1 100644
+--- a/sound/usb/line6/driver.h
++++ b/sound/usb/line6/driver.h
+@@ -31,7 +31,7 @@
+ #define LINE6_FALLBACK_INTERVAL 10
+ #define LINE6_FALLBACK_MAXPACKETSIZE 16
+
+-#define LINE6_TIMEOUT 1
++#define LINE6_TIMEOUT 1000
+ #define LINE6_BUFSIZE_LISTEN 64
+ #define LINE6_MIDI_MESSAGE_MAXLEN 256
+
+diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
+index da627b015b32b..2806808d81087 100644
+--- a/sound/usb/line6/podhd.c
++++ b/sound/usb/line6/podhd.c
+@@ -236,7 +236,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod)
+ ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0),
+ 0x67, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+ 0x11, 0,
+- NULL, 0, LINE6_TIMEOUT * HZ);
++ NULL, 0, LINE6_TIMEOUT);
+ if (ret < 0) {
+ dev_err(pod->line6.ifcdev, "read request failed (error %d)\n", ret);
+ goto exit;
+@@ -246,7 +246,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod)
+ ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+ 0x11, 0x0,
+- init_bytes, 3, LINE6_TIMEOUT * HZ);
++ init_bytes, 3, LINE6_TIMEOUT);
+ if (ret < 0) {
+ dev_err(pod->line6.ifcdev,
+ "receive length failed (error %d)\n", ret);
+@@ -266,7 +266,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod)
+ USB_REQ_SET_FEATURE,
+ USB_TYPE_STANDARD | USB_RECIP_DEVICE | USB_DIR_OUT,
+ 1, 0,
+- NULL, 0, LINE6_TIMEOUT * HZ);
++ NULL, 0, LINE6_TIMEOUT);
+ exit:
+ kfree(init_bytes);
+ return ret;
+diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c
+index 7e39083f8f76a..cbb2e66be32f2 100644
+--- a/sound/usb/line6/toneport.c
++++ b/sound/usb/line6/toneport.c
+@@ -130,7 +130,7 @@ static int toneport_send_cmd(struct usb_device *usbdev, int cmd1, int cmd2)
+
+ ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+- cmd1, cmd2, NULL, 0, LINE6_TIMEOUT * HZ);
++ cmd1, cmd2, NULL, 0, LINE6_TIMEOUT);
+
+ if (ret < 0) {
+ dev_err(&usbdev->dev, "send failed (error %d)\n", ret);
+diff --git a/sound/usb/misc/ua101.c b/sound/usb/misc/ua101.c
+index a0b6d039017f3..5e94b6b4b905f 100644
+--- a/sound/usb/misc/ua101.c
++++ b/sound/usb/misc/ua101.c
+@@ -1030,7 +1030,7 @@ static int detect_usb_format(struct ua101 *ua)
+ fmt_playback->bSubframeSize * ua->playback.channels;
+
+ epd = &ua->intf[INTF_CAPTURE]->altsetting[1].endpoint[0].desc;
+- if (!usb_endpoint_is_isoc_in(epd)) {
++ if (!usb_endpoint_is_isoc_in(epd) || usb_endpoint_maxp(epd) == 0) {
+ dev_err(&ua->dev->dev, "invalid capture endpoint\n");
+ return -ENXIO;
+ }
+@@ -1038,7 +1038,7 @@ static int detect_usb_format(struct ua101 *ua)
+ ua->capture.max_packet_bytes = usb_endpoint_maxp(epd);
+
+ epd = &ua->intf[INTF_PLAYBACK]->altsetting[1].endpoint[0].desc;
+- if (!usb_endpoint_is_isoc_out(epd)) {
++ if (!usb_endpoint_is_isoc_out(epd) || usb_endpoint_maxp(epd) == 0) {
+ dev_err(&ua->dev->dev, "invalid playback endpoint\n");
+ return -ENXIO;
+ }
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index f4bdcff82f5cc..b1bd63a9fc6d7 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1555,6 +1555,7 @@ static const struct registration_quirk registration_quirks[] = {
+ REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
+ REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */
++ REG_QUIRK_ENTRY(0x0ecb, 0x1f4c, 2), /* JBL Quantum 400 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index bad3505d66e05..0fcd38ffcc24c 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -1112,7 +1112,7 @@ static int extract_build_id(char *build_id, size_t size)
+
+ if (getline(&line, &len, fp) == -1)
+ goto err;
+- fclose(fp);
++ pclose(fp);
+
+ if (len > size)
+ len = size;
+@@ -1121,7 +1121,7 @@ static int extract_build_id(char *build_id, size_t size)
+ free(line);
+ return 0;
+ err:
+- fclose(fp);
++ pclose(fp);
+ return -1;
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-12-01 12:51 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-12-01 12:51 UTC (permalink / raw
To: gentoo-commits
commit: 4e25534a85d84d184b0dc1e699be423fd9d9b85b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 1 12:50:44 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 1 12:50:44 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4e25534a
Linux patch 4.19.219
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1218_linux-4.19.219.patch | 3456 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3460 insertions(+)
diff --git a/0000_README b/0000_README
index 2c528d2c..c2e992ef 100644
--- a/0000_README
+++ b/0000_README
@@ -911,6 +911,10 @@ Patch: 1217_linux-4.19.218.patch
From: https://www.kernel.org
Desc: Linux 4.19.218
+Patch: 1218_linux-4.19.219.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.219
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1218_linux-4.19.219.patch b/1218_linux-4.19.219.patch
new file mode 100644
index 00000000..a394c820
--- /dev/null
+++ b/1218_linux-4.19.219.patch
@@ -0,0 +1,3456 @@
+diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt
+index c7c088d2dd503..fb8ec9b0f8c70 100644
+--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt
++++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt
+@@ -43,26 +43,26 @@ group emmc_nb
+
+ group pwm0
+ - pin 11 (GPIO1-11)
+- - functions pwm, gpio
++ - functions pwm, led, gpio
+
+ group pwm1
+ - pin 12
+- - functions pwm, gpio
++ - functions pwm, led, gpio
+
+ group pwm2
+ - pin 13
+- - functions pwm, gpio
++ - functions pwm, led, gpio
+
+ group pwm3
+ - pin 14
+- - functions pwm, gpio
++ - functions pwm, led, gpio
+
+ group pmic1
+- - pin 17
++ - pin 7
+ - functions pmic, gpio
+
+ group pmic0
+- - pin 16
++ - pin 6
+ - functions pmic, gpio
+
+ group i2c2
+@@ -112,17 +112,25 @@ group usb2_drvvbus1
+ - functions drvbus, gpio
+
+ group sdio_sb
+- - pins 60-64
++ - pins 60-65
+ - functions sdio, gpio
+
+ group rgmii
+- - pins 42-55
++ - pins 42-53
+ - functions mii, gpio
+
+ group pcie1
+- - pins 39-40
++ - pins 39
++ - functions pcie, gpio
++
++group pcie1_clkreq
++ - pins 40
+ - functions pcie, gpio
+
++group smi
++ - pins 54-55
++ - functions smi, gpio
++
+ group ptp
+ - pins 56-58
+ - functions ptp, gpio
+diff --git a/Documentation/networking/ipvs-sysctl.txt b/Documentation/networking/ipvs-sysctl.txt
+index 056898685d408..fc531c29a2e83 100644
+--- a/Documentation/networking/ipvs-sysctl.txt
++++ b/Documentation/networking/ipvs-sysctl.txt
+@@ -30,8 +30,7 @@ conn_reuse_mode - INTEGER
+
+ 0: disable any special handling on port reuse. The new
+ connection will be delivered to the same real server that was
+- servicing the previous connection. This will effectively
+- disable expire_nodest_conn.
++ servicing the previous connection.
+
+ bit 1: enable rescheduling of new connections when it is safe.
+ That is, whenever expire_nodest_conn and for TCP sockets, when
+diff --git a/Makefile b/Makefile
+index 455ba411998f9..310cc8508b9e8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 218
++SUBLEVEL = 219
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index fa3422c4caec1..6edc4bd1e7eaf 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -239,6 +239,8 @@
+
+ gpio-controller;
+ #gpio-cells = <2>;
++ interrupt-controller;
++ #interrupt-cells = <2>;
+ };
+
+ pcie0: pcie@12000 {
+@@ -384,7 +386,7 @@
+ i2c0: i2c@18009000 {
+ compatible = "brcm,iproc-i2c";
+ reg = <0x18009000 0x50>;
+- interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+ clock-frequency = <100000>;
+diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
+index f854148c8d7c2..00baa13c158d7 100644
+--- a/arch/arm/include/asm/tlb.h
++++ b/arch/arm/include/asm/tlb.h
+@@ -280,6 +280,14 @@ tlb_remove_pmd_tlb_entry(struct mmu_gather *tlb, pmd_t *pmdp, unsigned long addr
+ tlb_add_flush(tlb, addr);
+ }
+
++static inline void
++tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
++ unsigned long size)
++{
++ tlb_add_flush(tlb, address);
++ tlb_add_flush(tlb, address + size - PMD_SIZE);
++}
++
+ #define pte_free_tlb(tlb, ptep, addr) __pte_free_tlb(tlb, ptep, addr)
+ #define pmd_free_tlb(tlb, pmdp, addr) __pmd_free_tlb(tlb, pmdp, addr)
+ #define pud_free_tlb(tlb, pudp, addr) pud_free((tlb)->mm, pudp)
+diff --git a/arch/arm/mach-socfpga/core.h b/arch/arm/mach-socfpga/core.h
+index 65e1817d8afe6..692a287a8712d 100644
+--- a/arch/arm/mach-socfpga/core.h
++++ b/arch/arm/mach-socfpga/core.h
+@@ -48,7 +48,7 @@ extern void __iomem *sdr_ctl_base_addr;
+ u32 socfpga_sdram_self_refresh(u32 sdr_base);
+ extern unsigned int socfpga_sdram_self_refresh_sz;
+
+-extern char secondary_trampoline, secondary_trampoline_end;
++extern char secondary_trampoline[], secondary_trampoline_end[];
+
+ extern unsigned long socfpga_cpu1start_addr;
+
+diff --git a/arch/arm/mach-socfpga/platsmp.c b/arch/arm/mach-socfpga/platsmp.c
+index 0ee76772b5074..a272999ce04b9 100644
+--- a/arch/arm/mach-socfpga/platsmp.c
++++ b/arch/arm/mach-socfpga/platsmp.c
+@@ -31,14 +31,14 @@
+
+ static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle)
+ {
+- int trampoline_size = &secondary_trampoline_end - &secondary_trampoline;
++ int trampoline_size = secondary_trampoline_end - secondary_trampoline;
+
+ if (socfpga_cpu1start_addr) {
+ /* This will put CPU #1 into reset. */
+ writel(RSTMGR_MPUMODRST_CPU1,
+ rst_manager_base_addr + SOCFPGA_RSTMGR_MODMPURST);
+
+- memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size);
++ memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size);
+
+ writel(__pa_symbol(secondary_startup),
+ sys_manager_base_addr + (socfpga_cpu1start_addr & 0x000000ff));
+@@ -56,12 +56,12 @@ static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle)
+
+ static int socfpga_a10_boot_secondary(unsigned int cpu, struct task_struct *idle)
+ {
+- int trampoline_size = &secondary_trampoline_end - &secondary_trampoline;
++ int trampoline_size = secondary_trampoline_end - secondary_trampoline;
+
+ if (socfpga_cpu1start_addr) {
+ writel(RSTMGR_MPUMODRST_CPU1, rst_manager_base_addr +
+ SOCFPGA_A10_RSTMGR_MODMPURST);
+- memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size);
++ memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size);
+
+ writel(__pa_symbol(secondary_startup),
+ sys_manager_base_addr + (socfpga_cpu1start_addr & 0x00000fff));
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-db.dts b/arch/arm64/boot/dts/marvell/armada-3720-db.dts
+index f2cc00594d64a..3e5789f372069 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-db.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-db.dts
+@@ -128,6 +128,9 @@
+
+ /* CON15(V2.0)/CON17(V1.4) : PCIe / CON15(V2.0)/CON12(V1.4) :mini-PCIe */
+ &pcie0 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&pcie_reset_pins &pcie_clkreq_pins>;
++ reset-gpios = <&gpiosb 3 GPIO_ACTIVE_LOW>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+index 1a3e6e3b04eba..f360891982434 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+@@ -55,6 +55,9 @@
+
+ /* J9 */
+ &pcie0 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&pcie_reset_pins &pcie_clkreq_pins>;
++ reset-gpios = <&gpiosb 3 GPIO_ACTIVE_LOW>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+index fca78eb334b19..7500be1a11a3c 100644
+--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+@@ -254,6 +254,15 @@
+ function = "mii";
+ };
+
++ pcie_reset_pins: pcie-reset-pins {
++ groups = "pcie1";
++ function = "gpio";
++ };
++
++ pcie_clkreq_pins: pcie-clkreq-pins {
++ groups = "pcie1_clkreq";
++ function = "pcie";
++ };
+ };
+
+ eth0: ethernet@30000 {
+diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
+index 516355a774bfe..5d032d97c254e 100644
+--- a/arch/ia64/include/asm/tlb.h
++++ b/arch/ia64/include/asm/tlb.h
+@@ -268,6 +268,16 @@ __tlb_remove_tlb_entry (struct mmu_gather *tlb, pte_t *ptep, unsigned long addre
+ tlb->end_addr = address + PAGE_SIZE;
+ }
+
++static inline void
++tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
++ unsigned long size)
++{
++ if (tlb->start_addr > address)
++ tlb->start_addr = address;
++ if (tlb->end_addr < address + size)
++ tlb->end_addr = address + size;
++}
++
+ #define tlb_migrate_finish(mm) platform_tlb_migrate_finish(mm)
+
+ #define tlb_start_vma(tlb, vma) do { } while (0)
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index e513528be3ad7..8a227a80f6bd5 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -2991,7 +2991,7 @@ config HAVE_LATENCYTOP_SUPPORT
+ config PGTABLE_LEVELS
+ int
+ default 4 if PAGE_SIZE_4KB && MIPS_VA_BITS_48
+- default 3 if 64BIT && !PAGE_SIZE_64KB
++ default 3 if 64BIT && (!PAGE_SIZE_64KB || MIPS_VA_BITS_48)
+ default 2
+
+ config MIPS_AUTO_PFN_OFFSET
+diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
+index b31c779cf5817..1df28a8e2f19e 100644
+--- a/arch/s390/include/asm/tlb.h
++++ b/arch/s390/include/asm/tlb.h
+@@ -116,6 +116,20 @@ static inline void tlb_remove_page_size(struct mmu_gather *tlb,
+ return tlb_remove_page(tlb, page);
+ }
+
++static inline void tlb_flush_pmd_range(struct mmu_gather *tlb,
++ unsigned long address, unsigned long size)
++{
++ /*
++ * the range might exceed the original range that was provided to
++ * tlb_gather_mmu(), so we need to update it despite the fact it is
++ * usually not updated.
++ */
++ if (tlb->start > address)
++ tlb->start = address;
++ if (tlb->end < address + size)
++ tlb->end = address + size;
++}
++
+ /*
+ * pte_free_tlb frees a pte table and clears the CRSTE for the
+ * page table from the tlb.
+@@ -177,6 +191,8 @@ static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
+ #define tlb_remove_tlb_entry(tlb, ptep, addr) do { } while (0)
+ #define tlb_remove_pmd_tlb_entry(tlb, pmdp, addr) do { } while (0)
+ #define tlb_migrate_finish(mm) do { } while (0)
++#define tlb_flush_pmd_range(tlb, addr, sz) do { } while (0)
++
+ #define tlb_remove_huge_tlb_entry(h, tlb, ptep, address) \
+ tlb_remove_tlb_entry(tlb, ptep, address)
+
+diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
+index ae894ac83fd61..4354ac6077503 100644
+--- a/arch/s390/mm/pgtable.c
++++ b/arch/s390/mm/pgtable.c
+@@ -970,6 +970,7 @@ EXPORT_SYMBOL(get_guest_storage_key);
+ int pgste_perform_essa(struct mm_struct *mm, unsigned long hva, int orc,
+ unsigned long *oldpte, unsigned long *oldpgste)
+ {
++ struct vm_area_struct *vma;
+ unsigned long pgstev;
+ spinlock_t *ptl;
+ pgste_t pgste;
+@@ -979,6 +980,10 @@ int pgste_perform_essa(struct mm_struct *mm, unsigned long hva, int orc,
+ WARN_ON_ONCE(orc > ESSA_MAX);
+ if (unlikely(orc > ESSA_MAX))
+ return -EINVAL;
++
++ vma = find_vma(mm, hva);
++ if (!vma || hva < vma->vm_start || is_vm_hugetlb_page(vma))
++ return -EFAULT;
+ ptep = get_locked_pte(mm, hva, &ptl);
+ if (unlikely(!ptep))
+ return -EFAULT;
+@@ -1071,10 +1076,14 @@ EXPORT_SYMBOL(pgste_perform_essa);
+ int set_pgste_bits(struct mm_struct *mm, unsigned long hva,
+ unsigned long bits, unsigned long value)
+ {
++ struct vm_area_struct *vma;
+ spinlock_t *ptl;
+ pgste_t new;
+ pte_t *ptep;
+
++ vma = find_vma(mm, hva);
++ if (!vma || hva < vma->vm_start || is_vm_hugetlb_page(vma))
++ return -EFAULT;
+ ptep = get_locked_pte(mm, hva, &ptl);
+ if (unlikely(!ptep))
+ return -EFAULT;
+@@ -1099,9 +1108,13 @@ EXPORT_SYMBOL(set_pgste_bits);
+ */
+ int get_pgste(struct mm_struct *mm, unsigned long hva, unsigned long *pgstep)
+ {
++ struct vm_area_struct *vma;
+ spinlock_t *ptl;
+ pte_t *ptep;
+
++ vma = find_vma(mm, hva);
++ if (!vma || hva < vma->vm_start || is_vm_hugetlb_page(vma))
++ return -EFAULT;
+ ptep = get_locked_pte(mm, hva, &ptl);
+ if (unlikely(!ptep))
+ return -EFAULT;
+diff --git a/arch/sh/include/asm/tlb.h b/arch/sh/include/asm/tlb.h
+index 77abe192fb43d..adcb0bfe238e3 100644
+--- a/arch/sh/include/asm/tlb.h
++++ b/arch/sh/include/asm/tlb.h
+@@ -127,6 +127,16 @@ static inline void tlb_remove_page_size(struct mmu_gather *tlb,
+ return tlb_remove_page(tlb, page);
+ }
+
++static inline void
++tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
++ unsigned long size)
++{
++ if (tlb->start > address)
++ tlb->start = address;
++ if (tlb->end < address + size)
++ tlb->end = address + size;
++}
++
+ #define tlb_remove_check_page_size_change tlb_remove_check_page_size_change
+ static inline void tlb_remove_check_page_size_change(struct mmu_gather *tlb,
+ unsigned int page_size)
+diff --git a/arch/um/include/asm/tlb.h b/arch/um/include/asm/tlb.h
+index dce6db147f245..02e61f6abfcab 100644
+--- a/arch/um/include/asm/tlb.h
++++ b/arch/um/include/asm/tlb.h
+@@ -130,6 +130,18 @@ static inline void tlb_remove_page_size(struct mmu_gather *tlb,
+ return tlb_remove_page(tlb, page);
+ }
+
++static inline void
++tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
++ unsigned long size)
++{
++ tlb->need_flush = 1;
++
++ if (tlb->start > address)
++ tlb->start = address;
++ if (tlb->end < address + size)
++ tlb->end = address + size;
++}
++
+ /**
+ * tlb_remove_tlb_entry - remember a pte unmapping for later tlb invalidation.
+ *
+diff --git a/arch/xtensa/include/asm/vectors.h b/arch/xtensa/include/asm/vectors.h
+index 7111280c88422..2d3e0cca9ba0f 100644
+--- a/arch/xtensa/include/asm/vectors.h
++++ b/arch/xtensa/include/asm/vectors.h
+@@ -31,7 +31,7 @@
+ #endif
+ #define XCHAL_KIO_SIZE 0x10000000
+
+-#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_OF)
++#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_USE_OF)
+ #define XCHAL_KIO_PADDR xtensa_get_kio_paddr()
+ #ifndef __ASSEMBLY__
+ extern unsigned long xtensa_kio_paddr;
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index 6a0167ac803c6..901990b8296c1 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -65,7 +65,7 @@ int initrd_is_mapped = 0;
+ extern int initrd_below_start_ok;
+ #endif
+
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+ void *dtb_start = __dtb_start;
+ #endif
+
+@@ -127,7 +127,7 @@ __tagtable(BP_TAG_INITRD, parse_tag_initrd);
+
+ #endif /* CONFIG_BLK_DEV_INITRD */
+
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+
+ static int __init parse_tag_fdt(const bp_tag_t *tag)
+ {
+@@ -137,7 +137,7 @@ static int __init parse_tag_fdt(const bp_tag_t *tag)
+
+ __tagtable(BP_TAG_FDT, parse_tag_fdt);
+
+-#endif /* CONFIG_OF */
++#endif /* CONFIG_USE_OF */
+
+ static int __init parse_tag_cmdline(const bp_tag_t* tag)
+ {
+@@ -185,7 +185,7 @@ static int __init parse_bootparam(const bp_tag_t *tag)
+ }
+ #endif
+
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+
+ #if !XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY
+ unsigned long xtensa_kio_paddr = XCHAL_KIO_DEFAULT_PADDR;
+@@ -234,7 +234,7 @@ void __init early_init_devtree(void *params)
+ strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
+ }
+
+-#endif /* CONFIG_OF */
++#endif /* CONFIG_USE_OF */
+
+ /*
+ * Initialize architecture. (Early stage)
+@@ -255,7 +255,7 @@ void __init init_arch(bp_tag_t *bp_start)
+ if (bp_start)
+ parse_bootparam(bp_start);
+
+-#ifdef CONFIG_OF
++#ifdef CONFIG_USE_OF
+ early_init_devtree(dtb_start);
+ #endif
+
+diff --git a/arch/xtensa/mm/mmu.c b/arch/xtensa/mm/mmu.c
+index 9d1ecfc536708..470843188f2fc 100644
+--- a/arch/xtensa/mm/mmu.c
++++ b/arch/xtensa/mm/mmu.c
+@@ -98,7 +98,7 @@ void init_mmu(void)
+
+ void init_kio(void)
+ {
+-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF)
++#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_USE_OF)
+ /*
+ * Update the IO area mapping in case xtensa_kio_paddr has changed
+ */
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 83be89c8627b9..9229c5c9ad473 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -2966,7 +2966,7 @@ static void binder_transaction(struct binder_proc *proc,
+ t->from = thread;
+ else
+ t->from = NULL;
+- t->sender_euid = proc->cred->euid;
++ t->sender_euid = task_euid(proc->tsk);
+ t->to_proc = target_proc;
+ t->to_thread = target_thread;
+ t->code = tr->code;
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 1b06c8e46ffa4..bd756b294d307 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -80,6 +80,7 @@ enum blkif_state {
+ BLKIF_STATE_DISCONNECTED,
+ BLKIF_STATE_CONNECTED,
+ BLKIF_STATE_SUSPENDED,
++ BLKIF_STATE_ERROR,
+ };
+
+ struct grant {
+@@ -89,6 +90,7 @@ struct grant {
+ };
+
+ enum blk_req_status {
++ REQ_PROCESSING,
+ REQ_WAITING,
+ REQ_DONE,
+ REQ_ERROR,
+@@ -533,10 +535,10 @@ static unsigned long blkif_ring_get_request(struct blkfront_ring_info *rinfo,
+
+ id = get_id_from_freelist(rinfo);
+ rinfo->shadow[id].request = req;
+- rinfo->shadow[id].status = REQ_WAITING;
++ rinfo->shadow[id].status = REQ_PROCESSING;
+ rinfo->shadow[id].associated_id = NO_ASSOCIATED_ID;
+
+- (*ring_req)->u.rw.id = id;
++ rinfo->shadow[id].req.u.rw.id = id;
+
+ return id;
+ }
+@@ -544,11 +546,12 @@ static unsigned long blkif_ring_get_request(struct blkfront_ring_info *rinfo,
+ static int blkif_queue_discard_req(struct request *req, struct blkfront_ring_info *rinfo)
+ {
+ struct blkfront_info *info = rinfo->dev_info;
+- struct blkif_request *ring_req;
++ struct blkif_request *ring_req, *final_ring_req;
+ unsigned long id;
+
+ /* Fill out a communications ring structure. */
+- id = blkif_ring_get_request(rinfo, req, &ring_req);
++ id = blkif_ring_get_request(rinfo, req, &final_ring_req);
++ ring_req = &rinfo->shadow[id].req;
+
+ ring_req->operation = BLKIF_OP_DISCARD;
+ ring_req->u.discard.nr_sectors = blk_rq_sectors(req);
+@@ -559,8 +562,9 @@ static int blkif_queue_discard_req(struct request *req, struct blkfront_ring_inf
+ else
+ ring_req->u.discard.flag = 0;
+
+- /* Keep a private copy so we can reissue requests when recovering. */
+- rinfo->shadow[id].req = *ring_req;
++ /* Copy the request to the ring page. */
++ *final_ring_req = *ring_req;
++ rinfo->shadow[id].status = REQ_WAITING;
+
+ return 0;
+ }
+@@ -693,6 +697,7 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri
+ {
+ struct blkfront_info *info = rinfo->dev_info;
+ struct blkif_request *ring_req, *extra_ring_req = NULL;
++ struct blkif_request *final_ring_req, *final_extra_ring_req = NULL;
+ unsigned long id, extra_id = NO_ASSOCIATED_ID;
+ bool require_extra_req = false;
+ int i;
+@@ -737,7 +742,8 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri
+ }
+
+ /* Fill out a communications ring structure. */
+- id = blkif_ring_get_request(rinfo, req, &ring_req);
++ id = blkif_ring_get_request(rinfo, req, &final_ring_req);
++ ring_req = &rinfo->shadow[id].req;
+
+ num_sg = blk_rq_map_sg(req->q, req, rinfo->shadow[id].sg);
+ num_grant = 0;
+@@ -788,7 +794,9 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri
+ ring_req->u.rw.nr_segments = num_grant;
+ if (unlikely(require_extra_req)) {
+ extra_id = blkif_ring_get_request(rinfo, req,
+- &extra_ring_req);
++ &final_extra_ring_req);
++ extra_ring_req = &rinfo->shadow[extra_id].req;
++
+ /*
+ * Only the first request contains the scatter-gather
+ * list.
+@@ -830,10 +838,13 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri
+ if (setup.segments)
+ kunmap_atomic(setup.segments);
+
+- /* Keep a private copy so we can reissue requests when recovering. */
+- rinfo->shadow[id].req = *ring_req;
+- if (unlikely(require_extra_req))
+- rinfo->shadow[extra_id].req = *extra_ring_req;
++ /* Copy request(s) to the ring page. */
++ *final_ring_req = *ring_req;
++ rinfo->shadow[id].status = REQ_WAITING;
++ if (unlikely(require_extra_req)) {
++ *final_extra_ring_req = *extra_ring_req;
++ rinfo->shadow[extra_id].status = REQ_WAITING;
++ }
+
+ if (new_persistent_gnts)
+ gnttab_free_grant_references(setup.gref_head);
+@@ -1407,8 +1418,8 @@ static enum blk_req_status blkif_rsp_to_req_status(int rsp)
+ static int blkif_get_final_status(enum blk_req_status s1,
+ enum blk_req_status s2)
+ {
+- BUG_ON(s1 == REQ_WAITING);
+- BUG_ON(s2 == REQ_WAITING);
++ BUG_ON(s1 < REQ_DONE);
++ BUG_ON(s2 < REQ_DONE);
+
+ if (s1 == REQ_ERROR || s2 == REQ_ERROR)
+ return BLKIF_RSP_ERROR;
+@@ -1441,7 +1452,7 @@ static bool blkif_completion(unsigned long *id,
+ s->status = blkif_rsp_to_req_status(bret->status);
+
+ /* Wait the second response if not yet here. */
+- if (s2->status == REQ_WAITING)
++ if (s2->status < REQ_DONE)
+ return false;
+
+ bret->status = blkif_get_final_status(s->status,
+@@ -1549,7 +1560,7 @@ static bool blkif_completion(unsigned long *id,
+ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+ {
+ struct request *req;
+- struct blkif_response *bret;
++ struct blkif_response bret;
+ RING_IDX i, rp;
+ unsigned long flags;
+ struct blkfront_ring_info *rinfo = (struct blkfront_ring_info *)dev_id;
+@@ -1560,54 +1571,76 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+
+ spin_lock_irqsave(&rinfo->ring_lock, flags);
+ again:
+- rp = rinfo->ring.sring->rsp_prod;
+- rmb(); /* Ensure we see queued responses up to 'rp'. */
++ rp = READ_ONCE(rinfo->ring.sring->rsp_prod);
++ virt_rmb(); /* Ensure we see queued responses up to 'rp'. */
++ if (RING_RESPONSE_PROD_OVERFLOW(&rinfo->ring, rp)) {
++ pr_alert("%s: illegal number of responses %u\n",
++ info->gd->disk_name, rp - rinfo->ring.rsp_cons);
++ goto err;
++ }
+
+ for (i = rinfo->ring.rsp_cons; i != rp; i++) {
+ unsigned long id;
++ unsigned int op;
++
++ RING_COPY_RESPONSE(&rinfo->ring, i, &bret);
++ id = bret.id;
+
+- bret = RING_GET_RESPONSE(&rinfo->ring, i);
+- id = bret->id;
+ /*
+ * The backend has messed up and given us an id that we would
+ * never have given to it (we stamp it up to BLK_RING_SIZE -
+ * look in get_id_from_freelist.
+ */
+ if (id >= BLK_RING_SIZE(info)) {
+- WARN(1, "%s: response to %s has incorrect id (%ld)\n",
+- info->gd->disk_name, op_name(bret->operation), id);
+- /* We can't safely get the 'struct request' as
+- * the id is busted. */
+- continue;
++ pr_alert("%s: response has incorrect id (%ld)\n",
++ info->gd->disk_name, id);
++ goto err;
+ }
++ if (rinfo->shadow[id].status != REQ_WAITING) {
++ pr_alert("%s: response references no pending request\n",
++ info->gd->disk_name);
++ goto err;
++ }
++
++ rinfo->shadow[id].status = REQ_PROCESSING;
+ req = rinfo->shadow[id].request;
+
+- if (bret->operation != BLKIF_OP_DISCARD) {
++ op = rinfo->shadow[id].req.operation;
++ if (op == BLKIF_OP_INDIRECT)
++ op = rinfo->shadow[id].req.u.indirect.indirect_op;
++ if (bret.operation != op) {
++ pr_alert("%s: response has wrong operation (%u instead of %u)\n",
++ info->gd->disk_name, bret.operation, op);
++ goto err;
++ }
++
++ if (bret.operation != BLKIF_OP_DISCARD) {
+ /*
+ * We may need to wait for an extra response if the
+ * I/O request is split in 2
+ */
+- if (!blkif_completion(&id, rinfo, bret))
++ if (!blkif_completion(&id, rinfo, &bret))
+ continue;
+ }
+
+ if (add_id_to_freelist(rinfo, id)) {
+ WARN(1, "%s: response to %s (id %ld) couldn't be recycled!\n",
+- info->gd->disk_name, op_name(bret->operation), id);
++ info->gd->disk_name, op_name(bret.operation), id);
+ continue;
+ }
+
+- if (bret->status == BLKIF_RSP_OKAY)
++ if (bret.status == BLKIF_RSP_OKAY)
+ blkif_req(req)->error = BLK_STS_OK;
+ else
+ blkif_req(req)->error = BLK_STS_IOERR;
+
+- switch (bret->operation) {
++ switch (bret.operation) {
+ case BLKIF_OP_DISCARD:
+- if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) {
++ if (unlikely(bret.status == BLKIF_RSP_EOPNOTSUPP)) {
+ struct request_queue *rq = info->rq;
+- printk(KERN_WARNING "blkfront: %s: %s op failed\n",
+- info->gd->disk_name, op_name(bret->operation));
++
++ pr_warn_ratelimited("blkfront: %s: %s op failed\n",
++ info->gd->disk_name, op_name(bret.operation));
+ blkif_req(req)->error = BLK_STS_NOTSUPP;
+ info->feature_discard = 0;
+ info->feature_secdiscard = 0;
+@@ -1617,15 +1650,15 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+ break;
+ case BLKIF_OP_FLUSH_DISKCACHE:
+ case BLKIF_OP_WRITE_BARRIER:
+- if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) {
+- printk(KERN_WARNING "blkfront: %s: %s op failed\n",
+- info->gd->disk_name, op_name(bret->operation));
++ if (unlikely(bret.status == BLKIF_RSP_EOPNOTSUPP)) {
++ pr_warn_ratelimited("blkfront: %s: %s op failed\n",
++ info->gd->disk_name, op_name(bret.operation));
+ blkif_req(req)->error = BLK_STS_NOTSUPP;
+ }
+- if (unlikely(bret->status == BLKIF_RSP_ERROR &&
++ if (unlikely(bret.status == BLKIF_RSP_ERROR &&
+ rinfo->shadow[id].req.u.rw.nr_segments == 0)) {
+- printk(KERN_WARNING "blkfront: %s: empty %s op failed\n",
+- info->gd->disk_name, op_name(bret->operation));
++ pr_warn_ratelimited("blkfront: %s: empty %s op failed\n",
++ info->gd->disk_name, op_name(bret.operation));
+ blkif_req(req)->error = BLK_STS_NOTSUPP;
+ }
+ if (unlikely(blkif_req(req)->error)) {
+@@ -1638,9 +1671,10 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+ /* fall through */
+ case BLKIF_OP_READ:
+ case BLKIF_OP_WRITE:
+- if (unlikely(bret->status != BLKIF_RSP_OKAY))
+- dev_dbg(&info->xbdev->dev, "Bad return from blkdev data "
+- "request: %x\n", bret->status);
++ if (unlikely(bret.status != BLKIF_RSP_OKAY))
++ dev_dbg_ratelimited(&info->xbdev->dev,
++ "Bad return from blkdev data request: %#x\n",
++ bret.status);
+
+ break;
+ default:
+@@ -1665,6 +1699,14 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+ spin_unlock_irqrestore(&rinfo->ring_lock, flags);
+
+ return IRQ_HANDLED;
++
++ err:
++ info->connected = BLKIF_STATE_ERROR;
++
++ spin_unlock_irqrestore(&rinfo->ring_lock, flags);
++
++ pr_alert("%s disabled for further use\n", info->gd->disk_name);
++ return IRQ_HANDLED;
+ }
+
+
+diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+index 041f8152272bf..177874adccf0d 100644
+--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c
++++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+@@ -106,9 +106,7 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev)
+ scmi_pd_data->domains = domains;
+ scmi_pd_data->num_domains = num_domains;
+
+- of_genpd_add_provider_onecell(np, scmi_pd_data);
+-
+- return 0;
++ return of_genpd_add_provider_onecell(np, scmi_pd_data);
+ }
+
+ static const struct scmi_device_id scmi_id_table[] = {
+diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
+index 8dcce7182bb7c..1e28ff9815997 100644
+--- a/drivers/gpu/drm/vc4/vc4_bo.c
++++ b/drivers/gpu/drm/vc4/vc4_bo.c
+@@ -417,7 +417,7 @@ struct drm_gem_object *vc4_create_object(struct drm_device *dev, size_t size)
+
+ bo = kzalloc(sizeof(*bo), GFP_KERNEL);
+ if (!bo)
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+
+ bo->madv = VC4_MADV_WILLNEED;
+ refcount_set(&bo->usecnt, 0);
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 10524c93f8b62..f22f59df02601 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2538,6 +2538,9 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
+ struct wacom_features *features = &wacom->wacom_wac.features;
+
+ switch (equivalent_usage) {
++ case HID_DG_CONFIDENCE:
++ wacom_wac->hid_data.confidence = value;
++ break;
+ case HID_GD_X:
+ wacom_wac->hid_data.x = value;
+ break;
+@@ -2568,7 +2571,8 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
+
+
+ if (usage->usage_index + 1 == field->report_count) {
+- if (equivalent_usage == wacom_wac->hid_data.last_slot_field)
++ if (equivalent_usage == wacom_wac->hid_data.last_slot_field &&
++ wacom_wac->hid_data.confidence)
+ wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
+ }
+ }
+@@ -2581,6 +2585,8 @@ static void wacom_wac_finger_pre_report(struct hid_device *hdev,
+ struct hid_data* hid_data = &wacom_wac->hid_data;
+ int i;
+
++ hid_data->confidence = true;
++
+ for (i = 0; i < report->maxfield; i++) {
+ struct hid_field *field = report->field[i];
+ int j;
+diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
+index 0abed1e5b5260..48ce2b0a4549e 100644
+--- a/drivers/hid/wacom_wac.h
++++ b/drivers/hid/wacom_wac.h
+@@ -302,6 +302,7 @@ struct hid_data {
+ bool tipswitch;
+ bool barrelswitch;
+ bool barrelswitch2;
++ bool confidence;
+ int x;
+ int y;
+ int pressure;
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index 60b20ae02b055..5eeadab15a5f5 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -1146,6 +1146,7 @@ void cec_received_msg_ts(struct cec_adapter *adap,
+ if (abort)
+ dst->rx_status |= CEC_RX_STATUS_FEATURE_ABORT;
+ msg->flags = dst->flags;
++ msg->sequence = dst->sequence;
+ /* Remove it from the wait_queue */
+ list_del_init(&data->list);
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index fd5375b5991bb..a257bf635bc24 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -451,9 +451,9 @@ static int hclgevf_set_rss_tc_mode(struct hclgevf_dev *hdev, u16 rss_size)
+ roundup_size = ilog2(roundup_size);
+
+ for (i = 0; i < HCLGEVF_MAX_TC_NUM; i++) {
+- tc_valid[i] = !!(hdev->hw_tc_map & BIT(i));
++ tc_valid[i] = 1;
+ tc_size[i] = roundup_size;
+- tc_offset[i] = rss_size * i;
++ tc_offset[i] = (hdev->hw_tc_map & BIT(i)) ? rss_size * i : 0;
+ }
+
+ hclgevf_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_RSS_TC_MODE, false);
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index a1c828ffac8b7..434a009c52d90 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -121,21 +121,17 @@ struct netfront_queue {
+
+ /*
+ * {tx,rx}_skbs store outstanding skbuffs. Free tx_skb entries
+- * are linked from tx_skb_freelist through skb_entry.link.
+- *
+- * NB. Freelist index entries are always going to be less than
+- * PAGE_OFFSET, whereas pointers to skbs will always be equal or
+- * greater than PAGE_OFFSET: we use this property to distinguish
+- * them.
++ * are linked from tx_skb_freelist through tx_link.
+ */
+- union skb_entry {
+- struct sk_buff *skb;
+- unsigned long link;
+- } tx_skbs[NET_TX_RING_SIZE];
++ struct sk_buff *tx_skbs[NET_TX_RING_SIZE];
++ unsigned short tx_link[NET_TX_RING_SIZE];
++#define TX_LINK_NONE 0xffff
++#define TX_PENDING 0xfffe
+ grant_ref_t gref_tx_head;
+ grant_ref_t grant_tx_ref[NET_TX_RING_SIZE];
+ struct page *grant_tx_page[NET_TX_RING_SIZE];
+ unsigned tx_skb_freelist;
++ unsigned int tx_pend_queue;
+
+ spinlock_t rx_lock ____cacheline_aligned_in_smp;
+ struct xen_netif_rx_front_ring rx;
+@@ -161,6 +157,9 @@ struct netfront_info {
+ struct netfront_stats __percpu *rx_stats;
+ struct netfront_stats __percpu *tx_stats;
+
++ /* Is device behaving sane? */
++ bool broken;
++
+ atomic_t rx_gso_checksum_fixup;
+ };
+
+@@ -169,33 +168,25 @@ struct netfront_rx_info {
+ struct xen_netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX - 1];
+ };
+
+-static void skb_entry_set_link(union skb_entry *list, unsigned short id)
+-{
+- list->link = id;
+-}
+-
+-static int skb_entry_is_link(const union skb_entry *list)
+-{
+- BUILD_BUG_ON(sizeof(list->skb) != sizeof(list->link));
+- return (unsigned long)list->skb < PAGE_OFFSET;
+-}
+-
+ /*
+ * Access macros for acquiring freeing slots in tx_skbs[].
+ */
+
+-static void add_id_to_freelist(unsigned *head, union skb_entry *list,
+- unsigned short id)
++static void add_id_to_list(unsigned *head, unsigned short *list,
++ unsigned short id)
+ {
+- skb_entry_set_link(&list[id], *head);
++ list[id] = *head;
+ *head = id;
+ }
+
+-static unsigned short get_id_from_freelist(unsigned *head,
+- union skb_entry *list)
++static unsigned short get_id_from_list(unsigned *head, unsigned short *list)
+ {
+ unsigned int id = *head;
+- *head = list[id].link;
++
++ if (id != TX_LINK_NONE) {
++ *head = list[id];
++ list[id] = TX_LINK_NONE;
++ }
+ return id;
+ }
+
+@@ -353,7 +344,7 @@ static int xennet_open(struct net_device *dev)
+ unsigned int i = 0;
+ struct netfront_queue *queue = NULL;
+
+- if (!np->queues)
++ if (!np->queues || np->broken)
+ return -ENODEV;
+
+ for (i = 0; i < num_queues; ++i) {
+@@ -381,27 +372,47 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue)
+ unsigned short id;
+ struct sk_buff *skb;
+ bool more_to_do;
++ const struct device *dev = &queue->info->netdev->dev;
+
+ BUG_ON(!netif_carrier_ok(queue->info->netdev));
+
+ do {
+ prod = queue->tx.sring->rsp_prod;
++ if (RING_RESPONSE_PROD_OVERFLOW(&queue->tx, prod)) {
++ dev_alert(dev, "Illegal number of responses %u\n",
++ prod - queue->tx.rsp_cons);
++ goto err;
++ }
+ rmb(); /* Ensure we see responses up to 'rp'. */
+
+ for (cons = queue->tx.rsp_cons; cons != prod; cons++) {
+- struct xen_netif_tx_response *txrsp;
++ struct xen_netif_tx_response txrsp;
+
+- txrsp = RING_GET_RESPONSE(&queue->tx, cons);
+- if (txrsp->status == XEN_NETIF_RSP_NULL)
++ RING_COPY_RESPONSE(&queue->tx, cons, &txrsp);
++ if (txrsp.status == XEN_NETIF_RSP_NULL)
+ continue;
+
+- id = txrsp->id;
+- skb = queue->tx_skbs[id].skb;
++ id = txrsp.id;
++ if (id >= RING_SIZE(&queue->tx)) {
++ dev_alert(dev,
++ "Response has incorrect id (%u)\n",
++ id);
++ goto err;
++ }
++ if (queue->tx_link[id] != TX_PENDING) {
++ dev_alert(dev,
++ "Response for inactive request\n");
++ goto err;
++ }
++
++ queue->tx_link[id] = TX_LINK_NONE;
++ skb = queue->tx_skbs[id];
++ queue->tx_skbs[id] = NULL;
+ if (unlikely(gnttab_query_foreign_access(
+ queue->grant_tx_ref[id]) != 0)) {
+- pr_alert("%s: warning -- grant still in use by backend domain\n",
+- __func__);
+- BUG();
++ dev_alert(dev,
++ "Grant still in use by backend domain\n");
++ goto err;
+ }
+ gnttab_end_foreign_access_ref(
+ queue->grant_tx_ref[id], GNTMAP_readonly);
+@@ -409,7 +420,7 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue)
+ &queue->gref_tx_head, queue->grant_tx_ref[id]);
+ queue->grant_tx_ref[id] = GRANT_INVALID_REF;
+ queue->grant_tx_page[id] = NULL;
+- add_id_to_freelist(&queue->tx_skb_freelist, queue->tx_skbs, id);
++ add_id_to_list(&queue->tx_skb_freelist, queue->tx_link, id);
+ dev_kfree_skb_irq(skb);
+ }
+
+@@ -419,13 +430,20 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue)
+ } while (more_to_do);
+
+ xennet_maybe_wake_tx(queue);
++
++ return;
++
++ err:
++ queue->info->broken = true;
++ dev_alert(dev, "Disabled for further use\n");
+ }
+
+ struct xennet_gnttab_make_txreq {
+ struct netfront_queue *queue;
+ struct sk_buff *skb;
+ struct page *page;
+- struct xen_netif_tx_request *tx; /* Last request */
++ struct xen_netif_tx_request *tx; /* Last request on ring page */
++ struct xen_netif_tx_request tx_local; /* Last request local copy*/
+ unsigned int size;
+ };
+
+@@ -441,7 +459,7 @@ static void xennet_tx_setup_grant(unsigned long gfn, unsigned int offset,
+ struct netfront_queue *queue = info->queue;
+ struct sk_buff *skb = info->skb;
+
+- id = get_id_from_freelist(&queue->tx_skb_freelist, queue->tx_skbs);
++ id = get_id_from_list(&queue->tx_skb_freelist, queue->tx_link);
+ tx = RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++);
+ ref = gnttab_claim_grant_reference(&queue->gref_tx_head);
+ WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));
+@@ -449,34 +467,37 @@ static void xennet_tx_setup_grant(unsigned long gfn, unsigned int offset,
+ gnttab_grant_foreign_access_ref(ref, queue->info->xbdev->otherend_id,
+ gfn, GNTMAP_readonly);
+
+- queue->tx_skbs[id].skb = skb;
++ queue->tx_skbs[id] = skb;
+ queue->grant_tx_page[id] = page;
+ queue->grant_tx_ref[id] = ref;
+
+- tx->id = id;
+- tx->gref = ref;
+- tx->offset = offset;
+- tx->size = len;
+- tx->flags = 0;
++ info->tx_local.id = id;
++ info->tx_local.gref = ref;
++ info->tx_local.offset = offset;
++ info->tx_local.size = len;
++ info->tx_local.flags = 0;
++
++ *tx = info->tx_local;
++
++ /*
++ * Put the request in the pending queue, it will be set to be pending
++ * when the producer index is about to be raised.
++ */
++ add_id_to_list(&queue->tx_pend_queue, queue->tx_link, id);
+
+ info->tx = tx;
+- info->size += tx->size;
++ info->size += info->tx_local.size;
+ }
+
+ static struct xen_netif_tx_request *xennet_make_first_txreq(
+- struct netfront_queue *queue, struct sk_buff *skb,
+- struct page *page, unsigned int offset, unsigned int len)
++ struct xennet_gnttab_make_txreq *info,
++ unsigned int offset, unsigned int len)
+ {
+- struct xennet_gnttab_make_txreq info = {
+- .queue = queue,
+- .skb = skb,
+- .page = page,
+- .size = 0,
+- };
++ info->size = 0;
+
+- gnttab_for_one_grant(page, offset, len, xennet_tx_setup_grant, &info);
++ gnttab_for_one_grant(info->page, offset, len, xennet_tx_setup_grant, info);
+
+- return info.tx;
++ return info->tx;
+ }
+
+ static void xennet_make_one_txreq(unsigned long gfn, unsigned int offset,
+@@ -489,35 +510,27 @@ static void xennet_make_one_txreq(unsigned long gfn, unsigned int offset,
+ xennet_tx_setup_grant(gfn, offset, len, data);
+ }
+
+-static struct xen_netif_tx_request *xennet_make_txreqs(
+- struct netfront_queue *queue, struct xen_netif_tx_request *tx,
+- struct sk_buff *skb, struct page *page,
++static void xennet_make_txreqs(
++ struct xennet_gnttab_make_txreq *info,
++ struct page *page,
+ unsigned int offset, unsigned int len)
+ {
+- struct xennet_gnttab_make_txreq info = {
+- .queue = queue,
+- .skb = skb,
+- .tx = tx,
+- };
+-
+ /* Skip unused frames from start of page */
+ page += offset >> PAGE_SHIFT;
+ offset &= ~PAGE_MASK;
+
+ while (len) {
+- info.page = page;
+- info.size = 0;
++ info->page = page;
++ info->size = 0;
+
+ gnttab_foreach_grant_in_range(page, offset, len,
+ xennet_make_one_txreq,
+- &info);
++ info);
+
+ page++;
+ offset = 0;
+- len -= info.size;
++ len -= info->size;
+ }
+-
+- return info.tx;
+ }
+
+ /*
+@@ -565,13 +578,22 @@ static u16 xennet_select_queue(struct net_device *dev, struct sk_buff *skb,
+ return queue_idx;
+ }
+
++static void xennet_mark_tx_pending(struct netfront_queue *queue)
++{
++ unsigned int i;
++
++ while ((i = get_id_from_list(&queue->tx_pend_queue, queue->tx_link)) !=
++ TX_LINK_NONE)
++ queue->tx_link[i] = TX_PENDING;
++}
++
+ #define MAX_XEN_SKB_FRAGS (65536 / XEN_PAGE_SIZE + 1)
+
+ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct netfront_info *np = netdev_priv(dev);
+ struct netfront_stats *tx_stats = this_cpu_ptr(np->tx_stats);
+- struct xen_netif_tx_request *tx, *first_tx;
++ struct xen_netif_tx_request *first_tx;
+ unsigned int i;
+ int notify;
+ int slots;
+@@ -580,6 +602,7 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev
+ unsigned int len;
+ unsigned long flags;
+ struct netfront_queue *queue = NULL;
++ struct xennet_gnttab_make_txreq info = { };
+ unsigned int num_queues = dev->real_num_tx_queues;
+ u16 queue_index;
+ struct sk_buff *nskb;
+@@ -587,6 +610,8 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev
+ /* Drop the packet if no queues are set up */
+ if (num_queues < 1)
+ goto drop;
++ if (unlikely(np->broken))
++ goto drop;
+ /* Determine which queue to transmit this SKB on */
+ queue_index = skb_get_queue_mapping(skb);
+ queue = &np->queues[queue_index];
+@@ -637,21 +662,24 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev
+ }
+
+ /* First request for the linear area. */
+- first_tx = tx = xennet_make_first_txreq(queue, skb,
+- page, offset, len);
+- offset += tx->size;
++ info.queue = queue;
++ info.skb = skb;
++ info.page = page;
++ first_tx = xennet_make_first_txreq(&info, offset, len);
++ offset += info.tx_local.size;
+ if (offset == PAGE_SIZE) {
+ page++;
+ offset = 0;
+ }
+- len -= tx->size;
++ len -= info.tx_local.size;
+
+ if (skb->ip_summed == CHECKSUM_PARTIAL)
+ /* local packet? */
+- tx->flags |= XEN_NETTXF_csum_blank | XEN_NETTXF_data_validated;
++ first_tx->flags |= XEN_NETTXF_csum_blank |
++ XEN_NETTXF_data_validated;
+ else if (skb->ip_summed == CHECKSUM_UNNECESSARY)
+ /* remote but checksummed. */
+- tx->flags |= XEN_NETTXF_data_validated;
++ first_tx->flags |= XEN_NETTXF_data_validated;
+
+ /* Optional extra info after the first request. */
+ if (skb_shinfo(skb)->gso_size) {
+@@ -660,7 +688,7 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev
+ gso = (struct xen_netif_extra_info *)
+ RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++);
+
+- tx->flags |= XEN_NETTXF_extra_info;
++ first_tx->flags |= XEN_NETTXF_extra_info;
+
+ gso->u.gso.size = skb_shinfo(skb)->gso_size;
+ gso->u.gso.type = (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) ?
+@@ -674,19 +702,21 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev
+ }
+
+ /* Requests for the rest of the linear area. */
+- tx = xennet_make_txreqs(queue, tx, skb, page, offset, len);
++ xennet_make_txreqs(&info, page, offset, len);
+
+ /* Requests for all the frags. */
+ for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+ skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+- tx = xennet_make_txreqs(queue, tx, skb,
+- skb_frag_page(frag), frag->page_offset,
++ xennet_make_txreqs(&info, skb_frag_page(frag),
++ frag->page_offset,
+ skb_frag_size(frag));
+ }
+
+ /* First request has the packet length. */
+ first_tx->size = skb->len;
+
++ xennet_mark_tx_pending(queue);
++
+ RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&queue->tx, notify);
+ if (notify)
+ notify_remote_via_irq(queue->tx_irq);
+@@ -744,7 +774,7 @@ static int xennet_get_extras(struct netfront_queue *queue,
+ RING_IDX rp)
+
+ {
+- struct xen_netif_extra_info *extra;
++ struct xen_netif_extra_info extra;
+ struct device *dev = &queue->info->netdev->dev;
+ RING_IDX cons = queue->rx.rsp_cons;
+ int err = 0;
+@@ -760,24 +790,22 @@ static int xennet_get_extras(struct netfront_queue *queue,
+ break;
+ }
+
+- extra = (struct xen_netif_extra_info *)
+- RING_GET_RESPONSE(&queue->rx, ++cons);
++ RING_COPY_RESPONSE(&queue->rx, ++cons, &extra);
+
+- if (unlikely(!extra->type ||
+- extra->type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
++ if (unlikely(!extra.type ||
++ extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
+ if (net_ratelimit())
+ dev_warn(dev, "Invalid extra type: %d\n",
+- extra->type);
++ extra.type);
+ err = -EINVAL;
+ } else {
+- memcpy(&extras[extra->type - 1], extra,
+- sizeof(*extra));
++ extras[extra.type - 1] = extra;
+ }
+
+ skb = xennet_get_rx_skb(queue, cons);
+ ref = xennet_get_rx_ref(queue, cons);
+ xennet_move_rx_slot(queue, skb, ref);
+- } while (extra->flags & XEN_NETIF_EXTRA_FLAG_MORE);
++ } while (extra.flags & XEN_NETIF_EXTRA_FLAG_MORE);
+
+ queue->rx.rsp_cons = cons;
+ return err;
+@@ -787,7 +815,7 @@ static int xennet_get_responses(struct netfront_queue *queue,
+ struct netfront_rx_info *rinfo, RING_IDX rp,
+ struct sk_buff_head *list)
+ {
+- struct xen_netif_rx_response *rx = &rinfo->rx;
++ struct xen_netif_rx_response *rx = &rinfo->rx, rx_local;
+ struct xen_netif_extra_info *extras = rinfo->extras;
+ struct device *dev = &queue->info->netdev->dev;
+ RING_IDX cons = queue->rx.rsp_cons;
+@@ -845,7 +873,8 @@ next:
+ break;
+ }
+
+- rx = RING_GET_RESPONSE(&queue->rx, cons + slots);
++ RING_COPY_RESPONSE(&queue->rx, cons + slots, &rx_local);
++ rx = &rx_local;
+ skb = xennet_get_rx_skb(queue, cons + slots);
+ ref = xennet_get_rx_ref(queue, cons + slots);
+ slots++;
+@@ -900,10 +929,11 @@ static int xennet_fill_frags(struct netfront_queue *queue,
+ struct sk_buff *nskb;
+
+ while ((nskb = __skb_dequeue(list))) {
+- struct xen_netif_rx_response *rx =
+- RING_GET_RESPONSE(&queue->rx, ++cons);
++ struct xen_netif_rx_response rx;
+ skb_frag_t *nfrag = &skb_shinfo(nskb)->frags[0];
+
++ RING_COPY_RESPONSE(&queue->rx, ++cons, &rx);
++
+ if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) {
+ unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
+
+@@ -918,7 +948,7 @@ static int xennet_fill_frags(struct netfront_queue *queue,
+
+ skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+ skb_frag_page(nfrag),
+- rx->offset, rx->status, PAGE_SIZE);
++ rx.offset, rx.status, PAGE_SIZE);
+
+ skb_shinfo(nskb)->nr_frags = 0;
+ kfree_skb(nskb);
+@@ -1011,12 +1041,19 @@ static int xennet_poll(struct napi_struct *napi, int budget)
+ skb_queue_head_init(&tmpq);
+
+ rp = queue->rx.sring->rsp_prod;
++ if (RING_RESPONSE_PROD_OVERFLOW(&queue->rx, rp)) {
++ dev_alert(&dev->dev, "Illegal number of responses %u\n",
++ rp - queue->rx.rsp_cons);
++ queue->info->broken = true;
++ spin_unlock(&queue->rx_lock);
++ return 0;
++ }
+ rmb(); /* Ensure we see queued responses up to 'rp'. */
+
+ i = queue->rx.rsp_cons;
+ work_done = 0;
+ while ((i != rp) && (work_done < budget)) {
+- memcpy(rx, RING_GET_RESPONSE(&queue->rx, i), sizeof(*rx));
++ RING_COPY_RESPONSE(&queue->rx, i, rx);
+ memset(extras, 0, sizeof(rinfo.extras));
+
+ err = xennet_get_responses(queue, &rinfo, rp, &tmpq);
+@@ -1138,17 +1175,18 @@ static void xennet_release_tx_bufs(struct netfront_queue *queue)
+
+ for (i = 0; i < NET_TX_RING_SIZE; i++) {
+ /* Skip over entries which are actually freelist references */
+- if (skb_entry_is_link(&queue->tx_skbs[i]))
++ if (!queue->tx_skbs[i])
+ continue;
+
+- skb = queue->tx_skbs[i].skb;
++ skb = queue->tx_skbs[i];
++ queue->tx_skbs[i] = NULL;
+ get_page(queue->grant_tx_page[i]);
+ gnttab_end_foreign_access(queue->grant_tx_ref[i],
+ GNTMAP_readonly,
+ (unsigned long)page_address(queue->grant_tx_page[i]));
+ queue->grant_tx_page[i] = NULL;
+ queue->grant_tx_ref[i] = GRANT_INVALID_REF;
+- add_id_to_freelist(&queue->tx_skb_freelist, queue->tx_skbs, i);
++ add_id_to_list(&queue->tx_skb_freelist, queue->tx_link, i);
+ dev_kfree_skb_irq(skb);
+ }
+ }
+@@ -1228,6 +1266,9 @@ static irqreturn_t xennet_tx_interrupt(int irq, void *dev_id)
+ struct netfront_queue *queue = dev_id;
+ unsigned long flags;
+
++ if (queue->info->broken)
++ return IRQ_HANDLED;
++
+ spin_lock_irqsave(&queue->tx_lock, flags);
+ xennet_tx_buf_gc(queue);
+ spin_unlock_irqrestore(&queue->tx_lock, flags);
+@@ -1240,6 +1281,9 @@ static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id)
+ struct netfront_queue *queue = dev_id;
+ struct net_device *dev = queue->info->netdev;
+
++ if (queue->info->broken)
++ return IRQ_HANDLED;
++
+ if (likely(netif_carrier_ok(dev) &&
+ RING_HAS_UNCONSUMED_RESPONSES(&queue->rx)))
+ napi_schedule(&queue->napi);
+@@ -1261,6 +1305,10 @@ static void xennet_poll_controller(struct net_device *dev)
+ struct netfront_info *info = netdev_priv(dev);
+ unsigned int num_queues = dev->real_num_tx_queues;
+ unsigned int i;
++
++ if (info->broken)
++ return;
++
+ for (i = 0; i < num_queues; ++i)
+ xennet_interrupt(0, &info->queues[i]);
+ }
+@@ -1630,13 +1678,15 @@ static int xennet_init_queue(struct netfront_queue *queue)
+ snprintf(queue->name, sizeof(queue->name), "vif%s-q%u",
+ devid, queue->id);
+
+- /* Initialise tx_skbs as a free chain containing every entry. */
++ /* Initialise tx_skb_freelist as a free chain containing every entry. */
+ queue->tx_skb_freelist = 0;
++ queue->tx_pend_queue = TX_LINK_NONE;
+ for (i = 0; i < NET_TX_RING_SIZE; i++) {
+- skb_entry_set_link(&queue->tx_skbs[i], i+1);
++ queue->tx_link[i] = i + 1;
+ queue->grant_tx_ref[i] = GRANT_INVALID_REF;
+ queue->grant_tx_page[i] = NULL;
+ }
++ queue->tx_link[NET_TX_RING_SIZE - 1] = TX_LINK_NONE;
+
+ /* Clear out rx_skbs */
+ for (i = 0; i < NET_RX_RING_SIZE; i++) {
+@@ -1841,6 +1891,9 @@ static int talk_to_netback(struct xenbus_device *dev,
+ if (info->queues)
+ xennet_destroy_queues(info);
+
++ /* For the case of a reconnect reset the "broken" indicator. */
++ info->broken = false;
++
+ err = xennet_create_queues(info, &num_queues);
+ if (err < 0) {
+ xenbus_dev_fatal(dev, err, "creating queues");
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index 98fb3c1f45e4d..e6d60fa2217da 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -9,6 +9,7 @@
+ */
+
+ #include <linux/delay.h>
++#include <linux/gpio/consumer.h>
+ #include <linux/interrupt.h>
+ #include <linux/irq.h>
+ #include <linux/irqdomain.h>
+@@ -17,6 +18,7 @@
+ #include <linux/init.h>
+ #include <linux/platform_device.h>
+ #include <linux/of_address.h>
++#include <linux/of_gpio.h>
+ #include <linux/of_pci.h>
+
+ #include "../pci.h"
+@@ -26,16 +28,7 @@
+ #define PCIE_CORE_CMD_IO_ACCESS_EN BIT(0)
+ #define PCIE_CORE_CMD_MEM_ACCESS_EN BIT(1)
+ #define PCIE_CORE_CMD_MEM_IO_REQ_EN BIT(2)
+-#define PCIE_CORE_DEV_CTRL_STATS_REG 0xc8
+-#define PCIE_CORE_DEV_CTRL_STATS_RELAX_ORDER_DISABLE (0 << 4)
+-#define PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT 5
+-#define PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE (0 << 11)
+-#define PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT 12
+-#define PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ 0x2
+-#define PCIE_CORE_LINK_CTRL_STAT_REG 0xd0
+-#define PCIE_CORE_LINK_L0S_ENTRY BIT(0)
+-#define PCIE_CORE_LINK_TRAINING BIT(5)
+-#define PCIE_CORE_LINK_WIDTH_SHIFT 20
++#define PCIE_CORE_PCIEXP_CAP 0xc0
+ #define PCIE_CORE_ERR_CAPCTL_REG 0x118
+ #define PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX BIT(5)
+ #define PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX_EN BIT(6)
+@@ -113,14 +106,95 @@
+ #define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C)
+ #define PCIE_MSI_DATA_MASK GENMASK(15, 0)
+
++/* PCIe window configuration */
++#define OB_WIN_BASE_ADDR 0x4c00
++#define OB_WIN_BLOCK_SIZE 0x20
++#define OB_WIN_COUNT 8
++#define OB_WIN_REG_ADDR(win, offset) (OB_WIN_BASE_ADDR + \
++ OB_WIN_BLOCK_SIZE * (win) + \
++ (offset))
++#define OB_WIN_MATCH_LS(win) OB_WIN_REG_ADDR(win, 0x00)
++#define OB_WIN_ENABLE BIT(0)
++#define OB_WIN_MATCH_MS(win) OB_WIN_REG_ADDR(win, 0x04)
++#define OB_WIN_REMAP_LS(win) OB_WIN_REG_ADDR(win, 0x08)
++#define OB_WIN_REMAP_MS(win) OB_WIN_REG_ADDR(win, 0x0c)
++#define OB_WIN_MASK_LS(win) OB_WIN_REG_ADDR(win, 0x10)
++#define OB_WIN_MASK_MS(win) OB_WIN_REG_ADDR(win, 0x14)
++#define OB_WIN_ACTIONS(win) OB_WIN_REG_ADDR(win, 0x18)
++#define OB_WIN_DEFAULT_ACTIONS (OB_WIN_ACTIONS(OB_WIN_COUNT-1) + 0x4)
++#define OB_WIN_FUNC_NUM_MASK GENMASK(31, 24)
++#define OB_WIN_FUNC_NUM_SHIFT 24
++#define OB_WIN_FUNC_NUM_ENABLE BIT(23)
++#define OB_WIN_BUS_NUM_BITS_MASK GENMASK(22, 20)
++#define OB_WIN_BUS_NUM_BITS_SHIFT 20
++#define OB_WIN_MSG_CODE_ENABLE BIT(22)
++#define OB_WIN_MSG_CODE_MASK GENMASK(21, 14)
++#define OB_WIN_MSG_CODE_SHIFT 14
++#define OB_WIN_MSG_PAYLOAD_LEN BIT(12)
++#define OB_WIN_ATTR_ENABLE BIT(11)
++#define OB_WIN_ATTR_TC_MASK GENMASK(10, 8)
++#define OB_WIN_ATTR_TC_SHIFT 8
++#define OB_WIN_ATTR_RELAXED BIT(7)
++#define OB_WIN_ATTR_NOSNOOP BIT(6)
++#define OB_WIN_ATTR_POISON BIT(5)
++#define OB_WIN_ATTR_IDO BIT(4)
++#define OB_WIN_TYPE_MASK GENMASK(3, 0)
++#define OB_WIN_TYPE_SHIFT 0
++#define OB_WIN_TYPE_MEM 0x0
++#define OB_WIN_TYPE_IO 0x4
++#define OB_WIN_TYPE_CONFIG_TYPE0 0x8
++#define OB_WIN_TYPE_CONFIG_TYPE1 0x9
++#define OB_WIN_TYPE_MSG 0xc
++
+ /* LMI registers base address and register offsets */
+ #define LMI_BASE_ADDR 0x6000
+ #define CFG_REG (LMI_BASE_ADDR + 0x0)
+ #define LTSSM_SHIFT 24
+ #define LTSSM_MASK 0x3f
+-#define LTSSM_L0 0x10
+ #define RC_BAR_CONFIG 0x300
+
++/* LTSSM values in CFG_REG */
++enum {
++ LTSSM_DETECT_QUIET = 0x0,
++ LTSSM_DETECT_ACTIVE = 0x1,
++ LTSSM_POLLING_ACTIVE = 0x2,
++ LTSSM_POLLING_COMPLIANCE = 0x3,
++ LTSSM_POLLING_CONFIGURATION = 0x4,
++ LTSSM_CONFIG_LINKWIDTH_START = 0x5,
++ LTSSM_CONFIG_LINKWIDTH_ACCEPT = 0x6,
++ LTSSM_CONFIG_LANENUM_ACCEPT = 0x7,
++ LTSSM_CONFIG_LANENUM_WAIT = 0x8,
++ LTSSM_CONFIG_COMPLETE = 0x9,
++ LTSSM_CONFIG_IDLE = 0xa,
++ LTSSM_RECOVERY_RCVR_LOCK = 0xb,
++ LTSSM_RECOVERY_SPEED = 0xc,
++ LTSSM_RECOVERY_RCVR_CFG = 0xd,
++ LTSSM_RECOVERY_IDLE = 0xe,
++ LTSSM_L0 = 0x10,
++ LTSSM_RX_L0S_ENTRY = 0x11,
++ LTSSM_RX_L0S_IDLE = 0x12,
++ LTSSM_RX_L0S_FTS = 0x13,
++ LTSSM_TX_L0S_ENTRY = 0x14,
++ LTSSM_TX_L0S_IDLE = 0x15,
++ LTSSM_TX_L0S_FTS = 0x16,
++ LTSSM_L1_ENTRY = 0x17,
++ LTSSM_L1_IDLE = 0x18,
++ LTSSM_L2_IDLE = 0x19,
++ LTSSM_L2_TRANSMIT_WAKE = 0x1a,
++ LTSSM_DISABLED = 0x20,
++ LTSSM_LOOPBACK_ENTRY_MASTER = 0x21,
++ LTSSM_LOOPBACK_ACTIVE_MASTER = 0x22,
++ LTSSM_LOOPBACK_EXIT_MASTER = 0x23,
++ LTSSM_LOOPBACK_ENTRY_SLAVE = 0x24,
++ LTSSM_LOOPBACK_ACTIVE_SLAVE = 0x25,
++ LTSSM_LOOPBACK_EXIT_SLAVE = 0x26,
++ LTSSM_HOT_RESET = 0x27,
++ LTSSM_RECOVERY_EQUALIZATION_PHASE0 = 0x28,
++ LTSSM_RECOVERY_EQUALIZATION_PHASE1 = 0x29,
++ LTSSM_RECOVERY_EQUALIZATION_PHASE2 = 0x2a,
++ LTSSM_RECOVERY_EQUALIZATION_PHASE3 = 0x2b,
++};
++
+ /* PCIe core controller registers */
+ #define CTRL_CORE_BASE_ADDR 0x18000
+ #define CTRL_CONFIG_REG (CTRL_CORE_BASE_ADDR + 0x0)
+@@ -181,6 +255,13 @@ struct advk_pcie {
+ struct platform_device *pdev;
+ void __iomem *base;
+ struct list_head resources;
++ struct {
++ phys_addr_t match;
++ phys_addr_t remap;
++ phys_addr_t mask;
++ u32 actions;
++ } wins[OB_WIN_COUNT];
++ u8 wins_count;
+ struct irq_domain *irq_domain;
+ struct irq_chip irq_chip;
+ raw_spinlock_t irq_lock;
+@@ -193,6 +274,8 @@ struct advk_pcie {
+ struct mutex msi_used_lock;
+ u16 msi_msg;
+ int root_bus_nr;
++ int link_gen;
++ struct gpio_desc *reset_gpio;
+ };
+
+ static inline void advk_writel(struct advk_pcie *pcie, u32 val, u64 reg)
+@@ -205,37 +288,161 @@ static inline u32 advk_readl(struct advk_pcie *pcie, u64 reg)
+ return readl(pcie->base + reg);
+ }
+
+-static int advk_pcie_link_up(struct advk_pcie *pcie)
++static u8 advk_pcie_ltssm_state(struct advk_pcie *pcie)
+ {
+- u32 val, ltssm_state;
++ u32 val;
++ u8 ltssm_state;
+
+ val = advk_readl(pcie, CFG_REG);
+ ltssm_state = (val >> LTSSM_SHIFT) & LTSSM_MASK;
+- return ltssm_state >= LTSSM_L0;
++ return ltssm_state;
++}
++
++static inline bool advk_pcie_link_up(struct advk_pcie *pcie)
++{
++ /* check if LTSSM is in normal operation - some L* state */
++ u8 ltssm_state = advk_pcie_ltssm_state(pcie);
++ return ltssm_state >= LTSSM_L0 && ltssm_state < LTSSM_DISABLED;
++}
++
++static inline bool advk_pcie_link_training(struct advk_pcie *pcie)
++{
++ /*
++ * According to PCIe Base specification 3.0, Table 4-14: Link
++ * Status Mapped to the LTSSM is Link Training mapped to LTSSM
++ * Configuration and Recovery states.
++ */
++ u8 ltssm_state = advk_pcie_ltssm_state(pcie);
++ return ((ltssm_state >= LTSSM_CONFIG_LINKWIDTH_START &&
++ ltssm_state < LTSSM_L0) ||
++ (ltssm_state >= LTSSM_RECOVERY_EQUALIZATION_PHASE0 &&
++ ltssm_state <= LTSSM_RECOVERY_EQUALIZATION_PHASE3));
+ }
+
+ static int advk_pcie_wait_for_link(struct advk_pcie *pcie)
+ {
+- struct device *dev = &pcie->pdev->dev;
+ int retries;
+
+ /* check if the link is up or not */
+ for (retries = 0; retries < LINK_WAIT_MAX_RETRIES; retries++) {
+- if (advk_pcie_link_up(pcie)) {
+- dev_info(dev, "link up\n");
++ if (advk_pcie_link_up(pcie))
+ return 0;
+- }
+
+ usleep_range(LINK_WAIT_USLEEP_MIN, LINK_WAIT_USLEEP_MAX);
+ }
+
+- dev_err(dev, "link never came up\n");
+ return -ETIMEDOUT;
+ }
+
++static void advk_pcie_issue_perst(struct advk_pcie *pcie)
++{
++ if (!pcie->reset_gpio)
++ return;
++
++ /* 10ms delay is needed for some cards */
++ dev_info(&pcie->pdev->dev, "issuing PERST via reset GPIO for 10ms\n");
++ gpiod_set_value_cansleep(pcie->reset_gpio, 1);
++ usleep_range(10000, 11000);
++ gpiod_set_value_cansleep(pcie->reset_gpio, 0);
++}
++
++static void advk_pcie_train_link(struct advk_pcie *pcie)
++{
++ struct device *dev = &pcie->pdev->dev;
++ u32 reg;
++ int ret;
++
++ /*
++ * Setup PCIe rev / gen compliance based on device tree property
++ * 'max-link-speed' which also forces maximal link speed.
++ */
++ reg = advk_readl(pcie, PCIE_CORE_CTRL0_REG);
++ reg &= ~PCIE_GEN_SEL_MSK;
++ if (pcie->link_gen == 3)
++ reg |= SPEED_GEN_3;
++ else if (pcie->link_gen == 2)
++ reg |= SPEED_GEN_2;
++ else
++ reg |= SPEED_GEN_1;
++ advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG);
++
++ /*
++ * Set maximal link speed value also into PCIe Link Control 2 register.
++ * Armada 3700 Functional Specification says that default value is based
++ * on SPEED_GEN but tests showed that default value is always 8.0 GT/s.
++ */
++ reg = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + PCI_EXP_LNKCTL2);
++ reg &= ~PCI_EXP_LNKCTL2_TLS;
++ if (pcie->link_gen == 3)
++ reg |= PCI_EXP_LNKCTL2_TLS_8_0GT;
++ else if (pcie->link_gen == 2)
++ reg |= PCI_EXP_LNKCTL2_TLS_5_0GT;
++ else
++ reg |= PCI_EXP_LNKCTL2_TLS_2_5GT;
++ advk_writel(pcie, reg, PCIE_CORE_PCIEXP_CAP + PCI_EXP_LNKCTL2);
++
++ /* Enable link training after selecting PCIe generation */
++ reg = advk_readl(pcie, PCIE_CORE_CTRL0_REG);
++ reg |= LINK_TRAINING_EN;
++ advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG);
++
++ /*
++ * Reset PCIe card via PERST# signal. Some cards are not detected
++ * during link training when they are in some non-initial state.
++ */
++ advk_pcie_issue_perst(pcie);
++
++ /*
++ * PERST# signal could have been asserted by pinctrl subsystem before
++ * probe() callback has been called or issued explicitly by reset gpio
++ * function advk_pcie_issue_perst(), making the endpoint going into
++ * fundamental reset. As required by PCI Express spec (PCI Express
++ * Base Specification, REV. 4.0 PCI Express, February 19 2014, 6.6.1
++ * Conventional Reset) a delay for at least 100ms after such a reset
++ * before sending a Configuration Request to the device is needed.
++ * So wait until PCIe link is up. Function advk_pcie_wait_for_link()
++ * waits for link at least 900ms.
++ */
++ ret = advk_pcie_wait_for_link(pcie);
++ if (ret < 0)
++ dev_err(dev, "link never came up\n");
++ else
++ dev_info(dev, "link up\n");
++}
++
++/*
++ * Set PCIe address window register which could be used for memory
++ * mapping.
++ */
++static void advk_pcie_set_ob_win(struct advk_pcie *pcie, u8 win_num,
++ phys_addr_t match, phys_addr_t remap,
++ phys_addr_t mask, u32 actions)
++{
++ advk_writel(pcie, OB_WIN_ENABLE |
++ lower_32_bits(match), OB_WIN_MATCH_LS(win_num));
++ advk_writel(pcie, upper_32_bits(match), OB_WIN_MATCH_MS(win_num));
++ advk_writel(pcie, lower_32_bits(remap), OB_WIN_REMAP_LS(win_num));
++ advk_writel(pcie, upper_32_bits(remap), OB_WIN_REMAP_MS(win_num));
++ advk_writel(pcie, lower_32_bits(mask), OB_WIN_MASK_LS(win_num));
++ advk_writel(pcie, upper_32_bits(mask), OB_WIN_MASK_MS(win_num));
++ advk_writel(pcie, actions, OB_WIN_ACTIONS(win_num));
++}
++
++static void advk_pcie_disable_ob_win(struct advk_pcie *pcie, u8 win_num)
++{
++ advk_writel(pcie, 0, OB_WIN_MATCH_LS(win_num));
++ advk_writel(pcie, 0, OB_WIN_MATCH_MS(win_num));
++ advk_writel(pcie, 0, OB_WIN_REMAP_LS(win_num));
++ advk_writel(pcie, 0, OB_WIN_REMAP_MS(win_num));
++ advk_writel(pcie, 0, OB_WIN_MASK_LS(win_num));
++ advk_writel(pcie, 0, OB_WIN_MASK_MS(win_num));
++ advk_writel(pcie, 0, OB_WIN_ACTIONS(win_num));
++}
++
+ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
+ {
+ u32 reg;
++ int i;
+
+ /* Set to Direct mode */
+ reg = advk_readl(pcie, CTRL_CONFIG_REG);
+@@ -255,36 +462,27 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
+ PCIE_CORE_ERR_CAPCTL_ECRC_CHCK_RCV;
+ advk_writel(pcie, reg, PCIE_CORE_ERR_CAPCTL_REG);
+
+- /* Set PCIe Device Control and Status 1 PF0 register */
+- reg = PCIE_CORE_DEV_CTRL_STATS_RELAX_ORDER_DISABLE |
+- (7 << PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT) |
+- PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE |
+- (PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ <<
+- PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT);
+- advk_writel(pcie, reg, PCIE_CORE_DEV_CTRL_STATS_REG);
++ /* Set PCIe Device Control register */
++ reg = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + PCI_EXP_DEVCTL);
++ reg &= ~PCI_EXP_DEVCTL_RELAX_EN;
++ reg &= ~PCI_EXP_DEVCTL_NOSNOOP_EN;
++ reg &= ~PCI_EXP_DEVCTL_PAYLOAD;
++ reg &= ~PCI_EXP_DEVCTL_READRQ;
++ reg |= PCI_EXP_DEVCTL_PAYLOAD_512B;
++ reg |= PCI_EXP_DEVCTL_READRQ_512B;
++ advk_writel(pcie, reg, PCIE_CORE_PCIEXP_CAP + PCI_EXP_DEVCTL);
+
+ /* Program PCIe Control 2 to disable strict ordering */
+ reg = PCIE_CORE_CTRL2_RESERVED |
+ PCIE_CORE_CTRL2_TD_ENABLE;
+ advk_writel(pcie, reg, PCIE_CORE_CTRL2_REG);
+
+- /* Set GEN2 */
+- reg = advk_readl(pcie, PCIE_CORE_CTRL0_REG);
+- reg &= ~PCIE_GEN_SEL_MSK;
+- reg |= SPEED_GEN_2;
+- advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG);
+-
+ /* Set lane X1 */
+ reg = advk_readl(pcie, PCIE_CORE_CTRL0_REG);
+ reg &= ~LANE_CNT_MSK;
+ reg |= LANE_COUNT_1;
+ advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG);
+
+- /* Enable link training */
+- reg = advk_readl(pcie, PCIE_CORE_CTRL0_REG);
+- reg |= LINK_TRAINING_EN;
+- advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG);
+-
+ /* Enable MSI */
+ reg = advk_readl(pcie, PCIE_CORE_CTRL2_REG);
+ reg |= PCIE_CORE_CTRL2_MSI_ENABLE;
+@@ -309,21 +507,52 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
+ reg = PCIE_IRQ_ALL_MASK & (~PCIE_IRQ_ENABLE_INTS_MASK);
+ advk_writel(pcie, reg, HOST_CTRL_INT_MASK_REG);
+
++ /*
++ * Enable AXI address window location generation:
++ * When it is enabled, the default outbound window
++ * configurations (Default User Field: 0xD0074CFC)
++ * are used to transparent address translation for
++ * the outbound transactions. Thus, PCIe address
++ * windows are not required for transparent memory
++ * access when default outbound window configuration
++ * is set for memory access.
++ */
+ reg = advk_readl(pcie, PCIE_CORE_CTRL2_REG);
+ reg |= PCIE_CORE_CTRL2_OB_WIN_ENABLE;
+ advk_writel(pcie, reg, PCIE_CORE_CTRL2_REG);
+
+- /* Bypass the address window mapping for PIO */
++ /*
++ * Set memory access in Default User Field so it
++ * is not required to configure PCIe address for
++ * transparent memory access.
++ */
++ advk_writel(pcie, OB_WIN_TYPE_MEM, OB_WIN_DEFAULT_ACTIONS);
++
++ /*
++ * Bypass the address window mapping for PIO:
++ * Since PIO access already contains all required
++ * info over AXI interface by PIO registers, the
++ * address window is not required.
++ */
+ reg = advk_readl(pcie, PIO_CTRL);
+ reg |= PIO_CTRL_ADDR_WIN_DISABLE;
+ advk_writel(pcie, reg, PIO_CTRL);
+
+- /* Start link training */
+- reg = advk_readl(pcie, PCIE_CORE_LINK_CTRL_STAT_REG);
+- reg |= PCIE_CORE_LINK_TRAINING;
+- advk_writel(pcie, reg, PCIE_CORE_LINK_CTRL_STAT_REG);
++ /*
++ * Configure PCIe address windows for non-memory or
++ * non-transparent access as by default PCIe uses
++ * transparent memory access.
++ */
++ for (i = 0; i < pcie->wins_count; i++)
++ advk_pcie_set_ob_win(pcie, i,
++ pcie->wins[i].match, pcie->wins[i].remap,
++ pcie->wins[i].mask, pcie->wins[i].actions);
+
+- advk_pcie_wait_for_link(pcie);
++ /* Disable remaining PCIe outbound windows */
++ for (i = pcie->wins_count; i < OB_WIN_COUNT; i++)
++ advk_pcie_disable_ob_win(pcie, i);
++
++ advk_pcie_train_link(pcie);
+
+ reg = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG);
+ reg |= PCIE_CORE_CMD_MEM_ACCESS_EN |
+@@ -435,6 +664,13 @@ static bool advk_pcie_valid_device(struct advk_pcie *pcie, struct pci_bus *bus,
+ if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0)
+ return false;
+
++ /*
++ * If the link goes down after we check for link-up, nothing bad
++ * happens but the config access times out.
++ */
++ if (bus->number != pcie->root_bus_nr && !advk_pcie_link_up(pcie))
++ return false;
++
+ return true;
+ }
+
+@@ -506,8 +742,10 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
+ advk_writel(pcie, 1, PIO_START);
+
+ ret = advk_pcie_wait_pio(pcie);
+- if (ret < 0)
++ if (ret < 0) {
++ *val = 0xffffffff;
+ return PCIBIOS_SET_FAILED;
++ }
+
+ /* Check PIO status and get the read result */
+ ret = advk_pcie_check_pio_status(pcie, val);
+@@ -754,6 +992,7 @@ static int advk_pcie_init_irq_domain(struct advk_pcie *pcie)
+ struct device_node *node = dev->of_node;
+ struct device_node *pcie_intc_node;
+ struct irq_chip *irq_chip;
++ int ret = 0;
+
+ raw_spin_lock_init(&pcie->irq_lock);
+
+@@ -768,8 +1007,8 @@ static int advk_pcie_init_irq_domain(struct advk_pcie *pcie)
+ irq_chip->name = devm_kasprintf(dev, GFP_KERNEL, "%s-irq",
+ dev_name(dev));
+ if (!irq_chip->name) {
+- of_node_put(pcie_intc_node);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto out_put_node;
+ }
+
+ irq_chip->irq_mask = advk_pcie_irq_mask;
+@@ -781,11 +1020,13 @@ static int advk_pcie_init_irq_domain(struct advk_pcie *pcie)
+ &advk_pcie_irq_domain_ops, pcie);
+ if (!pcie->irq_domain) {
+ dev_err(dev, "Failed to get a INTx IRQ domain\n");
+- of_node_put(pcie_intc_node);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto out_put_node;
+ }
+
+- return 0;
++out_put_node:
++ of_node_put(pcie_intc_node);
++ return ret;
+ }
+
+ static void advk_pcie_remove_irq_domain(struct advk_pcie *pcie)
+@@ -925,6 +1166,7 @@ static int advk_pcie_probe(struct platform_device *pdev)
+ struct advk_pcie *pcie;
+ struct resource *res;
+ struct pci_host_bridge *bridge;
++ struct resource_entry *entry;
+ int ret, irq;
+
+ bridge = devm_pci_alloc_host_bridge(dev, sizeof(struct advk_pcie));
+@@ -954,6 +1196,102 @@ static int advk_pcie_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++ resource_list_for_each_entry(entry, &pcie->resources) {
++ resource_size_t start = entry->res->start;
++ resource_size_t size = resource_size(entry->res);
++ unsigned long type = resource_type(entry->res);
++ u64 win_size;
++
++ /*
++ * Aardvark hardware allows to configure also PCIe window
++ * for config type 0 and type 1 mapping, but driver uses
++ * only PIO for issuing configuration transfers which does
++ * not use PCIe window configuration.
++ */
++ if (type != IORESOURCE_MEM && type != IORESOURCE_MEM_64 &&
++ type != IORESOURCE_IO)
++ continue;
++
++ /*
++ * Skip transparent memory resources. Default outbound access
++ * configuration is set to transparent memory access so it
++ * does not need window configuration.
++ */
++ if ((type == IORESOURCE_MEM || type == IORESOURCE_MEM_64) &&
++ entry->offset == 0)
++ continue;
++
++ /*
++ * The n-th PCIe window is configured by tuple (match, remap, mask)
++ * and an access to address A uses this window if A matches the
++ * match with given mask.
++ * So every PCIe window size must be a power of two and every start
++ * address must be aligned to window size. Minimal size is 64 KiB
++ * because lower 16 bits of mask must be zero. Remapped address
++ * may have set only bits from the mask.
++ */
++ while (pcie->wins_count < OB_WIN_COUNT && size > 0) {
++ /* Calculate the largest aligned window size */
++ win_size = (1ULL << (fls64(size)-1)) |
++ (start ? (1ULL << __ffs64(start)) : 0);
++ win_size = 1ULL << __ffs64(win_size);
++ if (win_size < 0x10000)
++ break;
++
++ dev_dbg(dev,
++ "Configuring PCIe window %d: [0x%llx-0x%llx] as %lu\n",
++ pcie->wins_count, (unsigned long long)start,
++ (unsigned long long)start + win_size, type);
++
++ if (type == IORESOURCE_IO) {
++ pcie->wins[pcie->wins_count].actions = OB_WIN_TYPE_IO;
++ pcie->wins[pcie->wins_count].match = pci_pio_to_address(start);
++ } else {
++ pcie->wins[pcie->wins_count].actions = OB_WIN_TYPE_MEM;
++ pcie->wins[pcie->wins_count].match = start;
++ }
++ pcie->wins[pcie->wins_count].remap = start - entry->offset;
++ pcie->wins[pcie->wins_count].mask = ~(win_size - 1);
++
++ if (pcie->wins[pcie->wins_count].remap & (win_size - 1))
++ break;
++
++ start += win_size;
++ size -= win_size;
++ pcie->wins_count++;
++ }
++
++ if (size > 0) {
++ dev_err(&pcie->pdev->dev,
++ "Invalid PCIe region [0x%llx-0x%llx]\n",
++ (unsigned long long)entry->res->start,
++ (unsigned long long)entry->res->end + 1);
++ return -EINVAL;
++ }
++ }
++
++ pcie->reset_gpio = devm_gpiod_get_from_of_node(dev, dev->of_node,
++ "reset-gpios", 0,
++ GPIOD_OUT_LOW,
++ "pcie1-reset");
++ ret = PTR_ERR_OR_ZERO(pcie->reset_gpio);
++ if (ret) {
++ if (ret == -ENOENT) {
++ pcie->reset_gpio = NULL;
++ } else {
++ if (ret != -EPROBE_DEFER)
++ dev_err(dev, "Failed to get reset-gpio: %i\n",
++ ret);
++ return ret;
++ }
++ }
++
++ ret = of_pci_get_max_link_speed(dev->of_node);
++ if (ret <= 0 || ret > 3)
++ pcie->link_gen = 3;
++ else
++ pcie->link_gen = ret;
++
+ advk_pcie_setup_hw(pcie);
+
+ ret = advk_pcie_init_irq_domain(pcie);
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index d76ac6b4b40df..e69b84d9538a0 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -166,12 +166,16 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {
+ PIN_GRP_GPIO("jtag", 20, 5, BIT(0), "jtag"),
+ PIN_GRP_GPIO("sdio0", 8, 3, BIT(1), "sdio"),
+ PIN_GRP_GPIO("emmc_nb", 27, 9, BIT(2), "emmc"),
+- PIN_GRP_GPIO("pwm0", 11, 1, BIT(3), "pwm"),
+- PIN_GRP_GPIO("pwm1", 12, 1, BIT(4), "pwm"),
+- PIN_GRP_GPIO("pwm2", 13, 1, BIT(5), "pwm"),
+- PIN_GRP_GPIO("pwm3", 14, 1, BIT(6), "pwm"),
+- PIN_GRP_GPIO("pmic1", 17, 1, BIT(7), "pmic"),
+- PIN_GRP_GPIO("pmic0", 16, 1, BIT(8), "pmic"),
++ PIN_GRP_GPIO_3("pwm0", 11, 1, BIT(3) | BIT(20), 0, BIT(20), BIT(3),
++ "pwm", "led"),
++ PIN_GRP_GPIO_3("pwm1", 12, 1, BIT(4) | BIT(21), 0, BIT(21), BIT(4),
++ "pwm", "led"),
++ PIN_GRP_GPIO_3("pwm2", 13, 1, BIT(5) | BIT(22), 0, BIT(22), BIT(5),
++ "pwm", "led"),
++ PIN_GRP_GPIO_3("pwm3", 14, 1, BIT(6) | BIT(23), 0, BIT(23), BIT(6),
++ "pwm", "led"),
++ PIN_GRP_GPIO("pmic1", 7, 1, BIT(7), "pmic"),
++ PIN_GRP_GPIO("pmic0", 6, 1, BIT(8), "pmic"),
+ PIN_GRP_GPIO("i2c2", 2, 2, BIT(9), "i2c"),
+ PIN_GRP_GPIO("i2c1", 0, 2, BIT(10), "i2c"),
+ PIN_GRP_GPIO("spi_cs1", 17, 1, BIT(12), "spi"),
+@@ -183,11 +187,6 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {
+ PIN_GRP_EXTRA("uart2", 9, 2, BIT(1) | BIT(13) | BIT(14) | BIT(19),
+ BIT(1) | BIT(13) | BIT(14), BIT(1) | BIT(19),
+ 18, 2, "gpio", "uart"),
+- PIN_GRP_GPIO_2("led0_od", 11, 1, BIT(20), BIT(20), 0, "led"),
+- PIN_GRP_GPIO_2("led1_od", 12, 1, BIT(21), BIT(21), 0, "led"),
+- PIN_GRP_GPIO_2("led2_od", 13, 1, BIT(22), BIT(22), 0, "led"),
+- PIN_GRP_GPIO_2("led3_od", 14, 1, BIT(23), BIT(23), 0, "led"),
+-
+ };
+
+ static struct armada_37xx_pin_group armada_37xx_sb_groups[] = {
+@@ -195,8 +194,11 @@ static struct armada_37xx_pin_group armada_37xx_sb_groups[] = {
+ PIN_GRP_GPIO("usb2_drvvbus1", 1, 1, BIT(1), "drvbus"),
+ PIN_GRP_GPIO("sdio_sb", 24, 6, BIT(2), "sdio"),
+ PIN_GRP_GPIO("rgmii", 6, 12, BIT(3), "mii"),
+- PIN_GRP_GPIO("pcie1", 3, 2, BIT(4), "pcie"),
+- PIN_GRP_GPIO("ptp", 20, 3, BIT(5), "ptp"),
++ PIN_GRP_GPIO("smi", 18, 2, BIT(4), "smi"),
++ PIN_GRP_GPIO("pcie1", 3, 1, BIT(5), "pcie"),
++ PIN_GRP_GPIO("pcie1_clkreq", 4, 1, BIT(9), "pcie"),
++ PIN_GRP_GPIO("pcie1_wakeup", 5, 1, BIT(10), "pcie"),
++ PIN_GRP_GPIO("ptp", 20, 3, BIT(11) | BIT(12) | BIT(13), "ptp"),
+ PIN_GRP("ptp_clk", 21, 1, BIT(6), "ptp", "mii"),
+ PIN_GRP("ptp_trig", 22, 1, BIT(7), "ptp", "mii"),
+ PIN_GRP_GPIO_3("mii_col", 23, 1, BIT(8) | BIT(14), 0, BIT(8), BIT(14),
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index add699b01836f..d899f216245e5 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -3364,7 +3364,7 @@ _scsih_ublock_io_device(struct MPT3SAS_ADAPTER *ioc, u64 sas_address)
+
+ shost_for_each_device(sdev, ioc->shost) {
+ sas_device_priv_data = sdev->hostdata;
+- if (!sas_device_priv_data)
++ if (!sas_device_priv_data || !sas_device_priv_data->sas_target)
+ continue;
+ if (sas_device_priv_data->sas_target->sas_address
+ != sas_address)
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+index 7cdced0b0581e..da73998bc5f70 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+@@ -2579,13 +2579,14 @@ static void _rtl92e_pci_disconnect(struct pci_dev *pdev)
+ free_irq(dev->irq, dev);
+ priv->irq = 0;
+ }
+- free_rtllib(dev);
+
+ if (dev->mem_start != 0) {
+ iounmap((void __iomem *)dev->mem_start);
+ release_mem_region(pci_resource_start(pdev, 1),
+ pci_resource_len(pdev, 1));
+ }
++
++ free_rtllib(dev);
+ } else {
+ priv = rtllib_priv(dev);
+ }
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index dc43fa96c3de7..7874aaf30ef48 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -86,7 +86,11 @@ static int __write_console(struct xencons_info *xencons,
+ cons = intf->out_cons;
+ prod = intf->out_prod;
+ mb(); /* update queue values before going on */
+- BUG_ON((prod - cons) > sizeof(intf->out));
++
++ if ((prod - cons) > sizeof(intf->out)) {
++ pr_err_once("xencons: Illegal ring page indices");
++ return -EINVAL;
++ }
+
+ while ((sent < len) && ((prod - cons) < sizeof(intf->out)))
+ intf->out[MASK_XENCONS_IDX(prod++, intf->out)] = data[sent++];
+@@ -114,7 +118,10 @@ static int domU_write_console(uint32_t vtermno, const char *data, int len)
+ */
+ while (len) {
+ int sent = __write_console(cons, data, len);
+-
++
++ if (sent < 0)
++ return sent;
++
+ data += sent;
+ len -= sent;
+
+@@ -138,7 +145,11 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len)
+ cons = intf->in_cons;
+ prod = intf->in_prod;
+ mb(); /* get pointers before reading ring */
+- BUG_ON((prod - cons) > sizeof(intf->in));
++
++ if ((prod - cons) > sizeof(intf->in)) {
++ pr_err_once("xencons: Illegal ring page indices");
++ return -EINVAL;
++ }
+
+ while (cons != prod && recv < len)
+ buf[recv++] = intf->in[MASK_XENCONS_IDX(cons++, intf->in)];
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index f1a11032a0a01..73ad4af487039 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -4575,8 +4575,6 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
+ if (oldspeed == USB_SPEED_LOW)
+ delay = HUB_LONG_RESET_TIME;
+
+- mutex_lock(hcd->address0_mutex);
+-
+ /* Reset the device; full speed may morph to high speed */
+ /* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */
+ retval = hub_port_reset(hub, port1, udev, delay, false);
+@@ -4891,7 +4889,6 @@ fail:
+ hub_port_disable(hub, port1, 0);
+ update_devnum(udev, devnum); /* for disconnect processing */
+ }
+- mutex_unlock(hcd->address0_mutex);
+ return retval;
+ }
+
+@@ -4981,6 +4978,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+ struct usb_port *port_dev = hub->ports[port1 - 1];
+ struct usb_device *udev = port_dev->child;
+ static int unreliable_port = -1;
++ bool retry_locked;
+
+ /* Disconnect any existing devices under this port */
+ if (udev) {
+@@ -5036,7 +5034,11 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+ unit_load = 100;
+
+ status = 0;
++
+ for (i = 0; i < SET_CONFIG_TRIES; i++) {
++ usb_lock_port(port_dev);
++ mutex_lock(hcd->address0_mutex);
++ retry_locked = true;
+
+ /* reallocate for each attempt, since references
+ * to the previous one can escape in various ways
+@@ -5045,6 +5047,8 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+ if (!udev) {
+ dev_err(&port_dev->dev,
+ "couldn't allocate usb_device\n");
++ mutex_unlock(hcd->address0_mutex);
++ usb_unlock_port(port_dev);
+ goto done;
+ }
+
+@@ -5066,12 +5070,14 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+ }
+
+ /* reset (non-USB 3.0 devices) and get descriptor */
+- usb_lock_port(port_dev);
+ status = hub_port_init(hub, udev, port1, i);
+- usb_unlock_port(port_dev);
+ if (status < 0)
+ goto loop;
+
++ mutex_unlock(hcd->address0_mutex);
++ usb_unlock_port(port_dev);
++ retry_locked = false;
++
+ if (udev->quirks & USB_QUIRK_DELAY_INIT)
+ msleep(2000);
+
+@@ -5164,6 +5170,10 @@ loop:
+ usb_ep0_reinit(udev);
+ release_devnum(udev);
+ hub_free_dev(udev);
++ if (retry_locked) {
++ mutex_unlock(hcd->address0_mutex);
++ usb_unlock_port(port_dev);
++ }
+ usb_put_dev(udev);
+ if ((status == -ENOTCONN) || (status == -ENOTSUPP))
+ break;
+@@ -5722,6 +5732,8 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+ bos = udev->bos;
+ udev->bos = NULL;
+
++ mutex_lock(hcd->address0_mutex);
++
+ for (i = 0; i < SET_CONFIG_TRIES; ++i) {
+
+ /* ep0 maxpacket size may change; let the HCD know about it.
+@@ -5731,6 +5743,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+ if (ret >= 0 || ret == -ENOTCONN || ret == -ENODEV)
+ break;
+ }
++ mutex_unlock(hcd->address0_mutex);
+
+ if (ret < 0)
+ goto re_enumerate;
+diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c
+index 68bbac64b7536..94af71e9856f2 100644
+--- a/drivers/usb/dwc2/hcd_queue.c
++++ b/drivers/usb/dwc2/hcd_queue.c
+@@ -59,7 +59,7 @@
+ #define DWC2_UNRESERVE_DELAY (msecs_to_jiffies(5))
+
+ /* If we get a NAK, wait this long before retrying */
+-#define DWC2_RETRY_WAIT_DELAY 1*1E6L
++#define DWC2_RETRY_WAIT_DELAY (1 * NSEC_PER_MSEC)
+
+ /**
+ * dwc2_periodic_channel_available() - Checks that a channel is available for a
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index eaf118ee2a865..818097e86cb58 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1267,6 +1267,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */
+ .driver_info = NCTRL(0) | ZLP },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */
++ .driver_info = NCTRL(0) | ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) },
+@@ -2094,6 +2096,9 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */
++ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 6ee320259e4f7..d61abf569dc1d 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -490,7 +490,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
+ virtio_transport_free_pkt(pkt);
+
+ len += sizeof(pkt->hdr);
+- vhost_add_used(vq, head, len);
++ vhost_add_used(vq, head, 0);
+ total_len += len;
+ added = true;
+ } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len)));
+diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
+index 652894d619677..b911a91bce6b7 100644
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -846,7 +846,7 @@ static struct notifier_block xenbus_resume_nb = {
+
+ static int __init xenbus_init(void)
+ {
+- int err = 0;
++ int err;
+ uint64_t v = 0;
+ xen_store_domain_type = XS_UNKNOWN;
+
+@@ -886,6 +886,29 @@ static int __init xenbus_init(void)
+ err = hvm_get_parameter(HVM_PARAM_STORE_PFN, &v);
+ if (err)
+ goto out_error;
++ /*
++ * Uninitialized hvm_params are zero and return no error.
++ * Although it is theoretically possible to have
++ * HVM_PARAM_STORE_PFN set to zero on purpose, in reality it is
++ * not zero when valid. If zero, it means that Xenstore hasn't
++ * been properly initialized. Instead of attempting to map a
++ * wrong guest physical address return error.
++ *
++ * Also recognize all bits set as an invalid value.
++ */
++ if (!v || !~v) {
++ err = -ENOENT;
++ goto out_error;
++ }
++ /* Avoid truncation on 32-bit. */
++#if BITS_PER_LONG == 32
++ if (v > ULONG_MAX) {
++ pr_err("%s: cannot handle HVM_PARAM_STORE_PFN=%llx > ULONG_MAX\n",
++ __func__, v);
++ err = -EINVAL;
++ goto out_error;
++ }
++#endif
+ xen_store_gfn = (unsigned long)v;
+ xen_store_interface =
+ xen_remap(xen_store_gfn << XEN_PAGE_SHIFT,
+@@ -920,8 +943,10 @@ static int __init xenbus_init(void)
+ */
+ proc_create_mount_point("xen");
+ #endif
++ return 0;
+
+ out_error:
++ xen_store_domain_type = XS_UNKNOWN;
+ return err;
+ }
+
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 8b22f8705dd48..d1dc545302528 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -910,6 +910,12 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
+ if (!(buf->flags & PIPE_BUF_FLAG_LRU))
+ lru_cache_add_file(newpage);
+
++ /*
++ * Release while we have extra ref on stolen page. Otherwise
++ * anon_pipe_buf_release() might think the page can be reused.
++ */
++ pipe_buf_release(cs->pipe, buf);
++
+ err = 0;
+ spin_lock(&cs->req->waitq.lock);
+ if (test_bit(FR_ABORTED, &cs->req->flags))
+@@ -2054,8 +2060,12 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
+
+ pipe_lock(pipe);
+ out_free:
+- for (idx = 0; idx < nbuf; idx++)
+- pipe_buf_release(pipe, &bufs[idx]);
++ for (idx = 0; idx < nbuf; idx++) {
++ struct pipe_buffer *buf = &bufs[idx];
++
++ if (buf->ops)
++ pipe_buf_release(pipe, buf);
++ }
+ pipe_unlock(pipe);
+
+ kvfree(bufs);
+diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c
+index ec9803088f6b8..eee011de3f58b 100644
+--- a/fs/nfs/nfs42xdr.c
++++ b/fs/nfs/nfs42xdr.c
+@@ -707,8 +707,7 @@ static int nfs4_xdr_dec_clone(struct rpc_rqst *rqstp,
+ status = decode_clone(xdr);
+ if (status)
+ goto out;
+- status = decode_getfattr(xdr, res->dst_fattr, res->server);
+-
++ decode_getfattr(xdr, res->dst_fattr, res->server);
+ out:
+ res->rpc_status = status;
+ return status;
+diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
+index c4147e50af98a..f5dfedc015520 100644
+--- a/fs/proc/vmcore.c
++++ b/fs/proc/vmcore.c
+@@ -117,14 +117,19 @@ static ssize_t read_from_oldmem(char *buf, size_t count,
+ nr_bytes = count;
+
+ /* If pfn is not ram, return zeros for sparse dump files */
+- if (pfn_is_ram(pfn) == 0)
+- memset(buf, 0, nr_bytes);
+- else {
++ if (pfn_is_ram(pfn) == 0) {
++ tmp = 0;
++ if (!userbuf)
++ memset(buf, 0, nr_bytes);
++ else if (clear_user(buf, nr_bytes))
++ tmp = -EFAULT;
++ } else {
+ tmp = copy_oldmem_page(pfn, buf, nr_bytes,
+ offset, userbuf);
+- if (tmp < 0)
+- return tmp;
+ }
++ if (tmp < 0)
++ return tmp;
++
+ *ppos += nr_bytes;
+ count -= nr_bytes;
+ buf += nr_bytes;
+diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
+index b3353e21f3b3e..db72ad39853b9 100644
+--- a/include/asm-generic/tlb.h
++++ b/include/asm-generic/tlb.h
+@@ -118,6 +118,8 @@ void arch_tlb_gather_mmu(struct mmu_gather *tlb,
+ void tlb_flush_mmu(struct mmu_gather *tlb);
+ void arch_tlb_finish_mmu(struct mmu_gather *tlb,
+ unsigned long start, unsigned long end, bool force);
++void tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
++ unsigned long size);
+ extern bool __tlb_remove_page_size(struct mmu_gather *tlb, struct page *page,
+ int page_size);
+
+diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
+index e67564af6f934..1560ce548add5 100644
+--- a/include/net/nfc/nci_core.h
++++ b/include/net/nfc/nci_core.h
+@@ -42,6 +42,7 @@ enum nci_flag {
+ NCI_UP,
+ NCI_DATA_EXCHANGE,
+ NCI_DATA_EXCHANGE_TO,
++ NCI_UNREG,
+ };
+
+ /* NCI device states */
+diff --git a/include/net/nl802154.h b/include/net/nl802154.h
+index ddcee128f5d9a..145acb8f25095 100644
+--- a/include/net/nl802154.h
++++ b/include/net/nl802154.h
+@@ -19,6 +19,8 @@
+ *
+ */
+
++#include <linux/types.h>
++
+ #define NL802154_GENL_NAME "nl802154"
+
+ enum nl802154_commands {
+@@ -150,10 +152,9 @@ enum nl802154_attrs {
+ };
+
+ enum nl802154_iftype {
+- /* for backwards compatibility TODO */
+- NL802154_IFTYPE_UNSPEC = -1,
++ NL802154_IFTYPE_UNSPEC = (~(__u32)0),
+
+- NL802154_IFTYPE_NODE,
++ NL802154_IFTYPE_NODE = 0,
+ NL802154_IFTYPE_MONITOR,
+ NL802154_IFTYPE_COORD,
+
+diff --git a/include/xen/interface/io/ring.h b/include/xen/interface/io/ring.h
+index 3f40501fc60b1..b39cdbc522ec7 100644
+--- a/include/xen/interface/io/ring.h
++++ b/include/xen/interface/io/ring.h
+@@ -1,21 +1,53 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+ /******************************************************************************
+ * ring.h
+ *
+ * Shared producer-consumer ring macros.
+ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to
++ * deal in the Software without restriction, including without limitation the
++ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
++ * sell copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
++ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
++ * DEALINGS IN THE SOFTWARE.
++ *
+ * Tim Deegan and Andrew Warfield November 2004.
+ */
+
+ #ifndef __XEN_PUBLIC_IO_RING_H__
+ #define __XEN_PUBLIC_IO_RING_H__
+
++/*
++ * When #include'ing this header, you need to provide the following
++ * declaration upfront:
++ * - standard integers types (uint8_t, uint16_t, etc)
++ * They are provided by stdint.h of the standard headers.
++ *
++ * In addition, if you intend to use the FLEX macros, you also need to
++ * provide the following, before invoking the FLEX macros:
++ * - size_t
++ * - memcpy
++ * - grant_ref_t
++ * These declarations are provided by string.h of the standard headers,
++ * and grant_table.h from the Xen public headers.
++ */
++
+ #include <xen/interface/grant_table.h>
+
+ typedef unsigned int RING_IDX;
+
+ /* Round a 32-bit unsigned constant down to the nearest power of two. */
+-#define __RD2(_x) (((_x) & 0x00000002) ? 0x2 : ((_x) & 0x1))
++#define __RD2(_x) (((_x) & 0x00000002) ? 0x2 : ((_x) & 0x1))
+ #define __RD4(_x) (((_x) & 0x0000000c) ? __RD2((_x)>>2)<<2 : __RD2(_x))
+ #define __RD8(_x) (((_x) & 0x000000f0) ? __RD4((_x)>>4)<<4 : __RD4(_x))
+ #define __RD16(_x) (((_x) & 0x0000ff00) ? __RD8((_x)>>8)<<8 : __RD8(_x))
+@@ -27,82 +59,79 @@ typedef unsigned int RING_IDX;
+ * A ring contains as many entries as will fit, rounded down to the nearest
+ * power of two (so we can mask with (size-1) to loop around).
+ */
+-#define __CONST_RING_SIZE(_s, _sz) \
+- (__RD32(((_sz) - offsetof(struct _s##_sring, ring)) / \
+- sizeof(((struct _s##_sring *)0)->ring[0])))
+-
++#define __CONST_RING_SIZE(_s, _sz) \
++ (__RD32(((_sz) - offsetof(struct _s##_sring, ring)) / \
++ sizeof(((struct _s##_sring *)0)->ring[0])))
+ /*
+ * The same for passing in an actual pointer instead of a name tag.
+ */
+-#define __RING_SIZE(_s, _sz) \
+- (__RD32(((_sz) - (long)&(_s)->ring + (long)(_s)) / sizeof((_s)->ring[0])))
++#define __RING_SIZE(_s, _sz) \
++ (__RD32(((_sz) - (long)(_s)->ring + (long)(_s)) / sizeof((_s)->ring[0])))
+
+ /*
+ * Macros to make the correct C datatypes for a new kind of ring.
+ *
+ * To make a new ring datatype, you need to have two message structures,
+- * let's say struct request, and struct response already defined.
++ * let's say request_t, and response_t already defined.
+ *
+ * In a header where you want the ring datatype declared, you then do:
+ *
+- * DEFINE_RING_TYPES(mytag, struct request, struct response);
++ * DEFINE_RING_TYPES(mytag, request_t, response_t);
+ *
+ * These expand out to give you a set of types, as you can see below.
+ * The most important of these are:
+ *
+- * struct mytag_sring - The shared ring.
+- * struct mytag_front_ring - The 'front' half of the ring.
+- * struct mytag_back_ring - The 'back' half of the ring.
++ * mytag_sring_t - The shared ring.
++ * mytag_front_ring_t - The 'front' half of the ring.
++ * mytag_back_ring_t - The 'back' half of the ring.
+ *
+ * To initialize a ring in your code you need to know the location and size
+ * of the shared memory area (PAGE_SIZE, for instance). To initialise
+ * the front half:
+ *
+- * struct mytag_front_ring front_ring;
+- * SHARED_RING_INIT((struct mytag_sring *)shared_page);
+- * FRONT_RING_INIT(&front_ring, (struct mytag_sring *)shared_page,
+- * PAGE_SIZE);
++ * mytag_front_ring_t front_ring;
++ * SHARED_RING_INIT((mytag_sring_t *)shared_page);
++ * FRONT_RING_INIT(&front_ring, (mytag_sring_t *)shared_page, PAGE_SIZE);
+ *
+ * Initializing the back follows similarly (note that only the front
+ * initializes the shared ring):
+ *
+- * struct mytag_back_ring back_ring;
+- * BACK_RING_INIT(&back_ring, (struct mytag_sring *)shared_page,
+- * PAGE_SIZE);
++ * mytag_back_ring_t back_ring;
++ * BACK_RING_INIT(&back_ring, (mytag_sring_t *)shared_page, PAGE_SIZE);
+ */
+
+-#define DEFINE_RING_TYPES(__name, __req_t, __rsp_t) \
+- \
+-/* Shared ring entry */ \
+-union __name##_sring_entry { \
+- __req_t req; \
+- __rsp_t rsp; \
+-}; \
+- \
+-/* Shared ring page */ \
+-struct __name##_sring { \
+- RING_IDX req_prod, req_event; \
+- RING_IDX rsp_prod, rsp_event; \
+- uint8_t pad[48]; \
+- union __name##_sring_entry ring[1]; /* variable-length */ \
+-}; \
+- \
+-/* "Front" end's private variables */ \
+-struct __name##_front_ring { \
+- RING_IDX req_prod_pvt; \
+- RING_IDX rsp_cons; \
+- unsigned int nr_ents; \
+- struct __name##_sring *sring; \
+-}; \
+- \
+-/* "Back" end's private variables */ \
+-struct __name##_back_ring { \
+- RING_IDX rsp_prod_pvt; \
+- RING_IDX req_cons; \
+- unsigned int nr_ents; \
+- struct __name##_sring *sring; \
+-};
+-
++#define DEFINE_RING_TYPES(__name, __req_t, __rsp_t) \
++ \
++/* Shared ring entry */ \
++union __name##_sring_entry { \
++ __req_t req; \
++ __rsp_t rsp; \
++}; \
++ \
++/* Shared ring page */ \
++struct __name##_sring { \
++ RING_IDX req_prod, req_event; \
++ RING_IDX rsp_prod, rsp_event; \
++ uint8_t __pad[48]; \
++ union __name##_sring_entry ring[1]; /* variable-length */ \
++}; \
++ \
++/* "Front" end's private variables */ \
++struct __name##_front_ring { \
++ RING_IDX req_prod_pvt; \
++ RING_IDX rsp_cons; \
++ unsigned int nr_ents; \
++ struct __name##_sring *sring; \
++}; \
++ \
++/* "Back" end's private variables */ \
++struct __name##_back_ring { \
++ RING_IDX rsp_prod_pvt; \
++ RING_IDX req_cons; \
++ unsigned int nr_ents; \
++ struct __name##_sring *sring; \
++}; \
++ \
+ /*
+ * Macros for manipulating rings.
+ *
+@@ -119,105 +148,99 @@ struct __name##_back_ring { \
+ */
+
+ /* Initialising empty rings */
+-#define SHARED_RING_INIT(_s) do { \
+- (_s)->req_prod = (_s)->rsp_prod = 0; \
+- (_s)->req_event = (_s)->rsp_event = 1; \
+- memset((_s)->pad, 0, sizeof((_s)->pad)); \
++#define SHARED_RING_INIT(_s) do { \
++ (_s)->req_prod = (_s)->rsp_prod = 0; \
++ (_s)->req_event = (_s)->rsp_event = 1; \
++ (void)memset((_s)->__pad, 0, sizeof((_s)->__pad)); \
+ } while(0)
+
+-#define FRONT_RING_INIT(_r, _s, __size) do { \
+- (_r)->req_prod_pvt = 0; \
+- (_r)->rsp_cons = 0; \
+- (_r)->nr_ents = __RING_SIZE(_s, __size); \
+- (_r)->sring = (_s); \
++#define FRONT_RING_ATTACH(_r, _s, _i, __size) do { \
++ (_r)->req_prod_pvt = (_i); \
++ (_r)->rsp_cons = (_i); \
++ (_r)->nr_ents = __RING_SIZE(_s, __size); \
++ (_r)->sring = (_s); \
+ } while (0)
+
+-#define BACK_RING_INIT(_r, _s, __size) do { \
+- (_r)->rsp_prod_pvt = 0; \
+- (_r)->req_cons = 0; \
+- (_r)->nr_ents = __RING_SIZE(_s, __size); \
+- (_r)->sring = (_s); \
+-} while (0)
++#define FRONT_RING_INIT(_r, _s, __size) FRONT_RING_ATTACH(_r, _s, 0, __size)
+
+-/* Initialize to existing shared indexes -- for recovery */
+-#define FRONT_RING_ATTACH(_r, _s, __size) do { \
+- (_r)->sring = (_s); \
+- (_r)->req_prod_pvt = (_s)->req_prod; \
+- (_r)->rsp_cons = (_s)->rsp_prod; \
+- (_r)->nr_ents = __RING_SIZE(_s, __size); \
++#define BACK_RING_ATTACH(_r, _s, _i, __size) do { \
++ (_r)->rsp_prod_pvt = (_i); \
++ (_r)->req_cons = (_i); \
++ (_r)->nr_ents = __RING_SIZE(_s, __size); \
++ (_r)->sring = (_s); \
+ } while (0)
+
+-#define BACK_RING_ATTACH(_r, _s, __size) do { \
+- (_r)->sring = (_s); \
+- (_r)->rsp_prod_pvt = (_s)->rsp_prod; \
+- (_r)->req_cons = (_s)->req_prod; \
+- (_r)->nr_ents = __RING_SIZE(_s, __size); \
+-} while (0)
++#define BACK_RING_INIT(_r, _s, __size) BACK_RING_ATTACH(_r, _s, 0, __size)
+
+ /* How big is this ring? */
+-#define RING_SIZE(_r) \
++#define RING_SIZE(_r) \
+ ((_r)->nr_ents)
+
+ /* Number of free requests (for use on front side only). */
+-#define RING_FREE_REQUESTS(_r) \
++#define RING_FREE_REQUESTS(_r) \
+ (RING_SIZE(_r) - ((_r)->req_prod_pvt - (_r)->rsp_cons))
+
+ /* Test if there is an empty slot available on the front ring.
+ * (This is only meaningful from the front. )
+ */
+-#define RING_FULL(_r) \
++#define RING_FULL(_r) \
+ (RING_FREE_REQUESTS(_r) == 0)
+
+ /* Test if there are outstanding messages to be processed on a ring. */
+-#define RING_HAS_UNCONSUMED_RESPONSES(_r) \
++#define RING_HAS_UNCONSUMED_RESPONSES(_r) \
+ ((_r)->sring->rsp_prod - (_r)->rsp_cons)
+
+-#define RING_HAS_UNCONSUMED_REQUESTS(_r) \
+- ({ \
+- unsigned int req = (_r)->sring->req_prod - (_r)->req_cons; \
+- unsigned int rsp = RING_SIZE(_r) - \
+- ((_r)->req_cons - (_r)->rsp_prod_pvt); \
+- req < rsp ? req : rsp; \
+- })
++#define RING_HAS_UNCONSUMED_REQUESTS(_r) ({ \
++ unsigned int req = (_r)->sring->req_prod - (_r)->req_cons; \
++ unsigned int rsp = RING_SIZE(_r) - \
++ ((_r)->req_cons - (_r)->rsp_prod_pvt); \
++ req < rsp ? req : rsp; \
++})
+
+ /* Direct access to individual ring elements, by index. */
+-#define RING_GET_REQUEST(_r, _idx) \
++#define RING_GET_REQUEST(_r, _idx) \
+ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].req))
+
++#define RING_GET_RESPONSE(_r, _idx) \
++ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp))
++
+ /*
+- * Get a local copy of a request.
++ * Get a local copy of a request/response.
+ *
+- * Use this in preference to RING_GET_REQUEST() so all processing is
++ * Use this in preference to RING_GET_{REQUEST,RESPONSE}() so all processing is
+ * done on a local copy that cannot be modified by the other end.
+ *
+ * Note that https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 may cause this
+- * to be ineffective where _req is a struct which consists of only bitfields.
++ * to be ineffective where dest is a struct which consists of only bitfields.
+ */
+-#define RING_COPY_REQUEST(_r, _idx, _req) do { \
+- /* Use volatile to force the copy into _req. */ \
+- *(_req) = *(volatile typeof(_req))RING_GET_REQUEST(_r, _idx); \
++#define RING_COPY_(type, r, idx, dest) do { \
++ /* Use volatile to force the copy into dest. */ \
++ *(dest) = *(volatile typeof(dest))RING_GET_##type(r, idx); \
+ } while (0)
+
+-#define RING_GET_RESPONSE(_r, _idx) \
+- (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp))
++#define RING_COPY_REQUEST(r, idx, req) RING_COPY_(REQUEST, r, idx, req)
++#define RING_COPY_RESPONSE(r, idx, rsp) RING_COPY_(RESPONSE, r, idx, rsp)
+
+ /* Loop termination condition: Would the specified index overflow the ring? */
+-#define RING_REQUEST_CONS_OVERFLOW(_r, _cons) \
++#define RING_REQUEST_CONS_OVERFLOW(_r, _cons) \
+ (((_cons) - (_r)->rsp_prod_pvt) >= RING_SIZE(_r))
+
+ /* Ill-behaved frontend determination: Can there be this many requests? */
+-#define RING_REQUEST_PROD_OVERFLOW(_r, _prod) \
++#define RING_REQUEST_PROD_OVERFLOW(_r, _prod) \
+ (((_prod) - (_r)->rsp_prod_pvt) > RING_SIZE(_r))
+
++/* Ill-behaved backend determination: Can there be this many responses? */
++#define RING_RESPONSE_PROD_OVERFLOW(_r, _prod) \
++ (((_prod) - (_r)->rsp_cons) > RING_SIZE(_r))
+
+-#define RING_PUSH_REQUESTS(_r) do { \
+- virt_wmb(); /* back sees requests /before/ updated producer index */ \
+- (_r)->sring->req_prod = (_r)->req_prod_pvt; \
++#define RING_PUSH_REQUESTS(_r) do { \
++ virt_wmb(); /* back sees requests /before/ updated producer index */\
++ (_r)->sring->req_prod = (_r)->req_prod_pvt; \
+ } while (0)
+
+-#define RING_PUSH_RESPONSES(_r) do { \
+- virt_wmb(); /* front sees responses /before/ updated producer index */ \
+- (_r)->sring->rsp_prod = (_r)->rsp_prod_pvt; \
++#define RING_PUSH_RESPONSES(_r) do { \
++ virt_wmb(); /* front sees resps /before/ updated producer index */ \
++ (_r)->sring->rsp_prod = (_r)->rsp_prod_pvt; \
+ } while (0)
+
+ /*
+@@ -250,40 +273,40 @@ struct __name##_back_ring { \
+ * field appropriately.
+ */
+
+-#define RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(_r, _notify) do { \
+- RING_IDX __old = (_r)->sring->req_prod; \
+- RING_IDX __new = (_r)->req_prod_pvt; \
+- virt_wmb(); /* back sees requests /before/ updated producer index */ \
+- (_r)->sring->req_prod = __new; \
+- virt_mb(); /* back sees new requests /before/ we check req_event */ \
+- (_notify) = ((RING_IDX)(__new - (_r)->sring->req_event) < \
+- (RING_IDX)(__new - __old)); \
++#define RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(_r, _notify) do { \
++ RING_IDX __old = (_r)->sring->req_prod; \
++ RING_IDX __new = (_r)->req_prod_pvt; \
++ virt_wmb(); /* back sees requests /before/ updated producer index */\
++ (_r)->sring->req_prod = __new; \
++ virt_mb(); /* back sees new requests /before/ we check req_event */ \
++ (_notify) = ((RING_IDX)(__new - (_r)->sring->req_event) < \
++ (RING_IDX)(__new - __old)); \
+ } while (0)
+
+-#define RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(_r, _notify) do { \
+- RING_IDX __old = (_r)->sring->rsp_prod; \
+- RING_IDX __new = (_r)->rsp_prod_pvt; \
+- virt_wmb(); /* front sees responses /before/ updated producer index */ \
+- (_r)->sring->rsp_prod = __new; \
+- virt_mb(); /* front sees new responses /before/ we check rsp_event */ \
+- (_notify) = ((RING_IDX)(__new - (_r)->sring->rsp_event) < \
+- (RING_IDX)(__new - __old)); \
++#define RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(_r, _notify) do { \
++ RING_IDX __old = (_r)->sring->rsp_prod; \
++ RING_IDX __new = (_r)->rsp_prod_pvt; \
++ virt_wmb(); /* front sees resps /before/ updated producer index */ \
++ (_r)->sring->rsp_prod = __new; \
++ virt_mb(); /* front sees new resps /before/ we check rsp_event */ \
++ (_notify) = ((RING_IDX)(__new - (_r)->sring->rsp_event) < \
++ (RING_IDX)(__new - __old)); \
+ } while (0)
+
+-#define RING_FINAL_CHECK_FOR_REQUESTS(_r, _work_to_do) do { \
+- (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \
+- if (_work_to_do) break; \
+- (_r)->sring->req_event = (_r)->req_cons + 1; \
+- virt_mb(); \
+- (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \
++#define RING_FINAL_CHECK_FOR_REQUESTS(_r, _work_to_do) do { \
++ (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \
++ if (_work_to_do) break; \
++ (_r)->sring->req_event = (_r)->req_cons + 1; \
++ virt_mb(); \
++ (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \
+ } while (0)
+
+-#define RING_FINAL_CHECK_FOR_RESPONSES(_r, _work_to_do) do { \
+- (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \
+- if (_work_to_do) break; \
+- (_r)->sring->rsp_event = (_r)->rsp_cons + 1; \
+- virt_mb(); \
+- (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \
++#define RING_FINAL_CHECK_FOR_RESPONSES(_r, _work_to_do) do { \
++ (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \
++ if (_work_to_do) break; \
++ (_r)->sring->rsp_event = (_r)->rsp_cons + 1; \
++ virt_mb(); \
++ (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \
+ } while (0)
+
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index 28db51274ed0e..6670a44ec5d45 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -677,7 +677,7 @@ static int load_image_and_restore(void)
+ goto Unlock;
+
+ error = swsusp_read(&flags);
+- swsusp_close(FMODE_READ);
++ swsusp_close(FMODE_READ | FMODE_EXCL);
+ if (!error)
+ hibernation_restore(flags & SF_PLATFORM_MODE);
+
+@@ -874,7 +874,7 @@ static int software_resume(void)
+ /* The snapshot device should not be opened while we're running */
+ if (!atomic_add_unless(&snapshot_device_available, -1, 0)) {
+ error = -EBUSY;
+- swsusp_close(FMODE_READ);
++ swsusp_close(FMODE_READ | FMODE_EXCL);
+ goto Unlock;
+ }
+
+@@ -910,7 +910,7 @@ static int software_resume(void)
+ pm_pr_dbg("Hibernation image not present or could not be loaded.\n");
+ return error;
+ Close_Finish:
+- swsusp_close(FMODE_READ);
++ swsusp_close(FMODE_READ | FMODE_EXCL);
+ goto Finish;
+ }
+
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 2c4068d8776ea..74185fb040f33 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -1365,14 +1365,26 @@ __event_trigger_test_discard(struct trace_event_file *file,
+ if (eflags & EVENT_FILE_FL_TRIGGER_COND)
+ *tt = event_triggers_call(file, entry, event);
+
+- if (test_bit(EVENT_FILE_FL_SOFT_DISABLED_BIT, &file->flags) ||
+- (unlikely(file->flags & EVENT_FILE_FL_FILTERED) &&
+- !filter_match_preds(file->filter, entry))) {
+- __trace_event_discard_commit(buffer, event);
+- return true;
+- }
++ if (likely(!(file->flags & (EVENT_FILE_FL_SOFT_DISABLED |
++ EVENT_FILE_FL_FILTERED |
++ EVENT_FILE_FL_PID_FILTER))))
++ return false;
++
++ if (file->flags & EVENT_FILE_FL_SOFT_DISABLED)
++ goto discard;
++
++ if (file->flags & EVENT_FILE_FL_FILTERED &&
++ !filter_match_preds(file->filter, entry))
++ goto discard;
++
++ if ((file->flags & EVENT_FILE_FL_PID_FILTER) &&
++ trace_event_ignore_this_pid(file))
++ goto discard;
+
+ return false;
++ discard:
++ __trace_event_discard_commit(buffer, event);
++ return true;
+ }
+
+ /**
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index ea43be6b9cc3c..1ca64a9296d0d 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -2255,12 +2255,19 @@ static struct trace_event_file *
+ trace_create_new_event(struct trace_event_call *call,
+ struct trace_array *tr)
+ {
++ struct trace_pid_list *pid_list;
+ struct trace_event_file *file;
+
+ file = kmem_cache_alloc(file_cachep, GFP_TRACE);
+ if (!file)
+ return NULL;
+
++ pid_list = rcu_dereference_protected(tr->filtered_pids,
++ lockdep_is_held(&event_mutex));
++
++ if (pid_list)
++ file->flags |= EVENT_FILE_FL_PID_FILTER;
++
+ file->event_call = call;
+ file->tr = tr;
+ atomic_set(&file->sm_ref, 0);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index ebcf26bc4cd4b..0c5a2b4e003d5 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3425,6 +3425,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
+ unsigned long sz = huge_page_size(h);
+ unsigned long mmun_start = start; /* For mmu_notifiers */
+ unsigned long mmun_end = end; /* For mmu_notifiers */
++ bool force_flush = false;
+
+ WARN_ON(!is_vm_hugetlb_page(vma));
+ BUG_ON(start & ~huge_page_mask(h));
+@@ -3451,10 +3452,8 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
+ ptl = huge_pte_lock(h, mm, ptep);
+ if (huge_pmd_unshare(mm, &address, ptep)) {
+ spin_unlock(ptl);
+- /*
+- * We just unmapped a page of PMDs by clearing a PUD.
+- * The caller's TLB flush range should cover this area.
+- */
++ tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE);
++ force_flush = true;
+ continue;
+ }
+
+@@ -3511,6 +3510,22 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
+ }
+ mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
+ tlb_end_vma(tlb, vma);
++
++ /*
++ * If we unshared PMDs, the TLB flush was not recorded in mmu_gather. We
++ * could defer the flush until now, since by holding i_mmap_rwsem we
++ * guaranteed that the last refernece would not be dropped. But we must
++ * do the flushing before we return, as otherwise i_mmap_rwsem will be
++ * dropped and the last reference to the shared PMDs page might be
++ * dropped as well.
++ *
++ * In theory we could defer the freeing of the PMD pages as well, but
++ * huge_pmd_unshare() relies on the exact page_count for the PMD page to
++ * detect sharing, so we cannot defer the release of the page either.
++ * Instead, do flush now.
++ */
++ if (force_flush)
++ tlb_flush_mmu_tlbonly(tlb);
+ }
+
+ void __unmap_hugepage_range_final(struct mmu_gather *tlb,
+diff --git a/mm/memory.c b/mm/memory.c
+index 49b546cdce0d2..1d03085fde02b 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -324,6 +324,16 @@ bool __tlb_remove_page_size(struct mmu_gather *tlb, struct page *page, int page_
+ return false;
+ }
+
++void tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
++ unsigned long size)
++{
++ if (tlb->page_size != 0 && tlb->page_size != PMD_SIZE)
++ tlb_flush_mmu(tlb);
++
++ tlb->page_size = PMD_SIZE;
++ tlb->start = min(tlb->start, address);
++ tlb->end = max(tlb->end, address + size);
++}
+ #endif /* HAVE_GENERIC_MMU_GATHER */
+
+ #ifdef CONFIG_HAVE_RCU_TABLE_FREE
+diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
+index 8b5ba0a5cd386..93530bd332470 100644
+--- a/net/ipv4/tcp_cubic.c
++++ b/net/ipv4/tcp_cubic.c
+@@ -340,8 +340,6 @@ static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
+ return;
+
+ if (tcp_in_slow_start(tp)) {
+- if (hystart && after(ack, ca->end_seq))
+- bictcp_hystart_reset(sk);
+ acked = tcp_slow_start(tp, acked);
+ if (!acked)
+ return;
+@@ -383,6 +381,9 @@ static void hystart_update(struct sock *sk, u32 delay)
+ if (ca->found & hystart_detect)
+ return;
+
++ if (after(tp->snd_una, ca->end_seq))
++ bictcp_hystart_reset(sk);
++
+ if (hystart_detect & HYSTART_ACK_TRAIN) {
+ u32 now = bictcp_clock();
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index fc36f3b0dceb3..251ec12517e93 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -175,7 +175,7 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s
+ #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
+ /* Policy lookup after SNAT yielded a new policy */
+ if (skb_dst(skb)->xfrm) {
+- IPCB(skb)->flags |= IPSKB_REROUTED;
++ IP6CB(skb)->flags |= IP6SKB_REROUTED;
+ return dst_output(net, sk, skb);
+ }
+ #endif
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index acaeeaf814415..f20b08db9fe91 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1850,7 +1850,6 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
+ struct ip_vs_proto_data *pd;
+ struct ip_vs_conn *cp;
+ int ret, pkts;
+- int conn_reuse_mode;
+ struct sock *sk;
+
+ /* Already marked as IPVS request or reply? */
+@@ -1926,15 +1925,16 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
+ */
+ cp = pp->conn_in_get(ipvs, af, skb, &iph);
+
+- conn_reuse_mode = sysctl_conn_reuse_mode(ipvs);
+- if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) {
++ if (!iph.fragoffs && is_new_conn(skb, &iph) && cp) {
++ int conn_reuse_mode = sysctl_conn_reuse_mode(ipvs);
+ bool old_ct = false, resched = false;
+
+ if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest &&
+ unlikely(!atomic_read(&cp->dest->weight))) {
+ resched = true;
+ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
+- } else if (is_new_conn_expected(cp, conn_reuse_mode)) {
++ } else if (conn_reuse_mode &&
++ is_new_conn_expected(cp, conn_reuse_mode)) {
+ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
+ if (!atomic_read(&cp->n_control)) {
+ resched = true;
+diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
+index 1008bbbb3af9c..0e0dff72a9e4f 100644
+--- a/net/nfc/nci/core.c
++++ b/net/nfc/nci/core.c
+@@ -485,6 +485,11 @@ static int nci_open_device(struct nci_dev *ndev)
+
+ mutex_lock(&ndev->req_lock);
+
++ if (test_bit(NCI_UNREG, &ndev->flags)) {
++ rc = -ENODEV;
++ goto done;
++ }
++
+ if (test_bit(NCI_UP, &ndev->flags)) {
+ rc = -EALREADY;
+ goto done;
+@@ -548,6 +553,10 @@ done:
+ static int nci_close_device(struct nci_dev *ndev)
+ {
+ nci_req_cancel(ndev, ENODEV);
++
++ /* This mutex needs to be held as a barrier for
++ * caller nci_unregister_device
++ */
+ mutex_lock(&ndev->req_lock);
+
+ if (!test_and_clear_bit(NCI_UP, &ndev->flags)) {
+@@ -585,8 +594,8 @@ static int nci_close_device(struct nci_dev *ndev)
+ /* Flush cmd wq */
+ flush_workqueue(ndev->cmd_wq);
+
+- /* Clear flags */
+- ndev->flags = 0;
++ /* Clear flags except NCI_UNREG */
++ ndev->flags &= BIT(NCI_UNREG);
+
+ mutex_unlock(&ndev->req_lock);
+
+@@ -1268,6 +1277,12 @@ void nci_unregister_device(struct nci_dev *ndev)
+ {
+ struct nci_conn_info *conn_info, *n;
+
++ /* This set_bit is not protected with specialized barrier,
++ * However, it is fine because the mutex_lock(&ndev->req_lock);
++ * in nci_close_device() will help to emit one.
++ */
++ set_bit(NCI_UNREG, &ndev->flags);
++
+ nci_close_device(ndev);
+
+ destroy_workqueue(ndev->cmd_wq);
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 9aab4ab8161bd..4c904ab29e0e6 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1589,8 +1589,10 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
+ static int smc_shutdown(struct socket *sock, int how)
+ {
+ struct sock *sk = sock->sk;
++ bool do_shutdown = true;
+ struct smc_sock *smc;
+ int rc = -EINVAL;
++ int old_state;
+ int rc1 = 0;
+
+ smc = smc_sk(sk);
+@@ -1617,7 +1619,11 @@ static int smc_shutdown(struct socket *sock, int how)
+ }
+ switch (how) {
+ case SHUT_RDWR: /* shutdown in both directions */
++ old_state = sk->sk_state;
+ rc = smc_close_active(smc);
++ if (old_state == SMC_ACTIVE &&
++ sk->sk_state == SMC_PEERCLOSEWAIT1)
++ do_shutdown = false;
+ break;
+ case SHUT_WR:
+ rc = smc_close_shutdown_write(smc);
+@@ -1627,7 +1633,7 @@ static int smc_shutdown(struct socket *sock, int how)
+ /* nothing more to do because peer is not involved */
+ break;
+ }
+- if (smc->clcsock)
++ if (do_shutdown && smc->clcsock)
+ rc1 = kernel_sock_shutdown(smc->clcsock, how);
+ /* map sock_shutdown_cmd constants to sk_shutdown value range */
+ sk->sk_shutdown |= how + 1;
+diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
+index ea2b87f294696..e25c023582f9e 100644
+--- a/net/smc/smc_close.c
++++ b/net/smc/smc_close.c
+@@ -202,6 +202,12 @@ again:
+ if (rc)
+ break;
+ sk->sk_state = SMC_PEERCLOSEWAIT1;
++
++ /* actively shutdown clcsock before peer close it,
++ * prevent peer from entering TIME_WAIT state.
++ */
++ if (smc->clcsock && smc->clcsock->sk)
++ rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);
+ } else {
+ /* peer event has changed the state */
+ goto again;
+diff --git a/sound/pci/ctxfi/ctamixer.c b/sound/pci/ctxfi/ctamixer.c
+index 5fcbb065d8702..d32685ce6c059 100644
+--- a/sound/pci/ctxfi/ctamixer.c
++++ b/sound/pci/ctxfi/ctamixer.c
+@@ -27,16 +27,15 @@
+
+ #define BLANK_SLOT 4094
+
+-static int amixer_master(struct rsc *rsc)
++static void amixer_master(struct rsc *rsc)
+ {
+ rsc->conj = 0;
+- return rsc->idx = container_of(rsc, struct amixer, rsc)->idx[0];
++ rsc->idx = container_of(rsc, struct amixer, rsc)->idx[0];
+ }
+
+-static int amixer_next_conj(struct rsc *rsc)
++static void amixer_next_conj(struct rsc *rsc)
+ {
+ rsc->conj++;
+- return container_of(rsc, struct amixer, rsc)->idx[rsc->conj];
+ }
+
+ static int amixer_index(const struct rsc *rsc)
+@@ -335,16 +334,15 @@ int amixer_mgr_destroy(struct amixer_mgr *amixer_mgr)
+
+ /* SUM resource management */
+
+-static int sum_master(struct rsc *rsc)
++static void sum_master(struct rsc *rsc)
+ {
+ rsc->conj = 0;
+- return rsc->idx = container_of(rsc, struct sum, rsc)->idx[0];
++ rsc->idx = container_of(rsc, struct sum, rsc)->idx[0];
+ }
+
+-static int sum_next_conj(struct rsc *rsc)
++static void sum_next_conj(struct rsc *rsc)
+ {
+ rsc->conj++;
+- return container_of(rsc, struct sum, rsc)->idx[rsc->conj];
+ }
+
+ static int sum_index(const struct rsc *rsc)
+diff --git a/sound/pci/ctxfi/ctdaio.c b/sound/pci/ctxfi/ctdaio.c
+index f35a7341e4463..ed6e15d1f10f4 100644
+--- a/sound/pci/ctxfi/ctdaio.c
++++ b/sound/pci/ctxfi/ctdaio.c
+@@ -55,12 +55,12 @@ static struct daio_rsc_idx idx_20k2[NUM_DAIOTYP] = {
+ [SPDIFIO] = {.left = 0x05, .right = 0x85},
+ };
+
+-static int daio_master(struct rsc *rsc)
++static void daio_master(struct rsc *rsc)
+ {
+ /* Actually, this is not the resource index of DAIO.
+ * For DAO, it is the input mapper index. And, for DAI,
+ * it is the output time-slot index. */
+- return rsc->conj = rsc->idx;
++ rsc->conj = rsc->idx;
+ }
+
+ static int daio_index(const struct rsc *rsc)
+@@ -68,19 +68,19 @@ static int daio_index(const struct rsc *rsc)
+ return rsc->conj;
+ }
+
+-static int daio_out_next_conj(struct rsc *rsc)
++static void daio_out_next_conj(struct rsc *rsc)
+ {
+- return rsc->conj += 2;
++ rsc->conj += 2;
+ }
+
+-static int daio_in_next_conj_20k1(struct rsc *rsc)
++static void daio_in_next_conj_20k1(struct rsc *rsc)
+ {
+- return rsc->conj += 0x200;
++ rsc->conj += 0x200;
+ }
+
+-static int daio_in_next_conj_20k2(struct rsc *rsc)
++static void daio_in_next_conj_20k2(struct rsc *rsc)
+ {
+- return rsc->conj += 0x100;
++ rsc->conj += 0x100;
+ }
+
+ static const struct rsc_ops daio_out_rsc_ops = {
+diff --git a/sound/pci/ctxfi/ctresource.c b/sound/pci/ctxfi/ctresource.c
+index 80c4d84f9667f..f05a09ed42b8d 100644
+--- a/sound/pci/ctxfi/ctresource.c
++++ b/sound/pci/ctxfi/ctresource.c
+@@ -113,18 +113,17 @@ static int audio_ring_slot(const struct rsc *rsc)
+ return (rsc->conj << 4) + offset_in_audio_slot_block[rsc->type];
+ }
+
+-static int rsc_next_conj(struct rsc *rsc)
++static void rsc_next_conj(struct rsc *rsc)
+ {
+ unsigned int i;
+ for (i = 0; (i < 8) && (!(rsc->msr & (0x1 << i))); )
+ i++;
+ rsc->conj += (AUDIO_SLOT_BLOCK_NUM >> i);
+- return rsc->conj;
+ }
+
+-static int rsc_master(struct rsc *rsc)
++static void rsc_master(struct rsc *rsc)
+ {
+- return rsc->conj = rsc->idx;
++ rsc->conj = rsc->idx;
+ }
+
+ static const struct rsc_ops rsc_generic_ops = {
+diff --git a/sound/pci/ctxfi/ctresource.h b/sound/pci/ctxfi/ctresource.h
+index 736d9f7e9e165..29b6fe6de659c 100644
+--- a/sound/pci/ctxfi/ctresource.h
++++ b/sound/pci/ctxfi/ctresource.h
+@@ -43,8 +43,8 @@ struct rsc {
+ };
+
+ struct rsc_ops {
+- int (*master)(struct rsc *rsc); /* Move to master resource */
+- int (*next_conj)(struct rsc *rsc); /* Move to next conjugate resource */
++ void (*master)(struct rsc *rsc); /* Move to master resource */
++ void (*next_conj)(struct rsc *rsc); /* Move to next conjugate resource */
+ int (*index)(const struct rsc *rsc); /* Return the index of resource */
+ /* Return the output slot number */
+ int (*output_slot)(const struct rsc *rsc);
+diff --git a/sound/pci/ctxfi/ctsrc.c b/sound/pci/ctxfi/ctsrc.c
+index a4fc10723fc6b..660ca0272e395 100644
+--- a/sound/pci/ctxfi/ctsrc.c
++++ b/sound/pci/ctxfi/ctsrc.c
+@@ -594,16 +594,15 @@ int src_mgr_destroy(struct src_mgr *src_mgr)
+
+ /* SRCIMP resource manager operations */
+
+-static int srcimp_master(struct rsc *rsc)
++static void srcimp_master(struct rsc *rsc)
+ {
+ rsc->conj = 0;
+- return rsc->idx = container_of(rsc, struct srcimp, rsc)->idx[0];
++ rsc->idx = container_of(rsc, struct srcimp, rsc)->idx[0];
+ }
+
+-static int srcimp_next_conj(struct rsc *rsc)
++static void srcimp_next_conj(struct rsc *rsc)
+ {
+ rsc->conj++;
+- return container_of(rsc, struct srcimp, rsc)->idx[rsc->conj];
+ }
+
+ static int srcimp_index(const struct rsc *rsc)
+diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
+index 44eee18c658ae..7d2c5de380317 100644
+--- a/sound/soc/qcom/qdsp6/q6routing.c
++++ b/sound/soc/qcom/qdsp6/q6routing.c
+@@ -443,7 +443,11 @@ static int msm_routing_put_audio_mixer(struct snd_kcontrol *kcontrol,
+ session->port_id = be_id;
+ snd_soc_dapm_mixer_update_power(dapm, kcontrol, 1, update);
+ } else {
+- session->port_id = -1;
++ if (session->port_id == be_id) {
++ session->port_id = -1;
++ return 0;
++ }
++
+ snd_soc_dapm_mixer_update_power(dapm, kcontrol, 0, update);
+ }
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 2c6598e07dde3..ccf6dd9411975 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -2565,6 +2565,7 @@ EXPORT_SYMBOL_GPL(snd_soc_tplg_widget_remove_all);
+ /* remove dynamic controls from the component driver */
+ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index)
+ {
++ struct snd_card *card = comp->card->snd_card;
+ struct snd_soc_dobj *dobj, *next_dobj;
+ int pass = SOC_TPLG_PASS_END;
+
+@@ -2572,6 +2573,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index)
+ while (pass >= SOC_TPLG_PASS_START) {
+
+ /* remove mixer controls */
++ down_write(&card->controls_rwsem);
+ list_for_each_entry_safe(dobj, next_dobj, &comp->dobj_list,
+ list) {
+
+@@ -2605,6 +2607,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index)
+ break;
+ }
+ }
++ up_write(&card->controls_rwsem);
+ pass--;
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-12-08 12:55 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-12-08 12:55 UTC (permalink / raw
To: gentoo-commits
commit: d1e7752942b93dc59f20bbe08a33a697ad6567e0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 8 12:55:17 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 8 12:55:17 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d1e77529
Linux patch 4.19.220
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1219_linux-4.19.220.patch | 1748 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1752 insertions(+)
diff --git a/0000_README b/0000_README
index c2e992ef..ec86fab5 100644
--- a/0000_README
+++ b/0000_README
@@ -915,6 +915,10 @@ Patch: 1218_linux-4.19.219.patch
From: https://www.kernel.org
Desc: Linux 4.19.219
+Patch: 1219_linux-4.19.220.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.220
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1219_linux-4.19.220.patch b/1219_linux-4.19.220.patch
new file mode 100644
index 00000000..eb91993c
--- /dev/null
+++ b/1219_linux-4.19.220.patch
@@ -0,0 +1,1748 @@
+diff --git a/Makefile b/Makefile
+index 310cc8508b9e8..f243688468d53 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 219
++SUBLEVEL = 220
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
+index 253d7ca714724..55e6e60f984b2 100644
+--- a/arch/parisc/Makefile
++++ b/arch/parisc/Makefile
+@@ -17,7 +17,12 @@
+ # Mike Shaver, Helge Deller and Martin K. Petersen
+ #
+
++ifdef CONFIG_PARISC_SELF_EXTRACT
++boot := arch/parisc/boot
++KBUILD_IMAGE := $(boot)/bzImage
++else
+ KBUILD_IMAGE := vmlinuz
++endif
+
+ KBUILD_DEFCONFIG := default_defconfig
+
+diff --git a/arch/parisc/install.sh b/arch/parisc/install.sh
+index 6f68784fea25f..a8c49815f58c8 100644
+--- a/arch/parisc/install.sh
++++ b/arch/parisc/install.sh
+@@ -39,6 +39,7 @@ verify "$3"
+ if [ -n "${INSTALLKERNEL}" ]; then
+ if [ -x ~/bin/${INSTALLKERNEL} ]; then exec ~/bin/${INSTALLKERNEL} "$@"; fi
+ if [ -x /sbin/${INSTALLKERNEL} ]; then exec /sbin/${INSTALLKERNEL} "$@"; fi
++ if [ -x /usr/sbin/${INSTALLKERNEL} ]; then exec /usr/sbin/${INSTALLKERNEL} "$@"; fi
+ fi
+
+ # Default install
+diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
+index a1e772f909cbf..a923414d3745a 100644
+--- a/arch/parisc/kernel/time.c
++++ b/arch/parisc/kernel/time.c
+@@ -245,27 +245,13 @@ void __init time_init(void)
+ static int __init init_cr16_clocksource(void)
+ {
+ /*
+- * The cr16 interval timers are not syncronized across CPUs on
+- * different sockets, so mark them unstable and lower rating on
+- * multi-socket SMP systems.
++ * The cr16 interval timers are not syncronized across CPUs, even if
++ * they share the same socket.
+ */
+ if (num_online_cpus() > 1 && !running_on_qemu) {
+- int cpu;
+- unsigned long cpu0_loc;
+- cpu0_loc = per_cpu(cpu_data, 0).cpu_loc;
+-
+- for_each_online_cpu(cpu) {
+- if (cpu == 0)
+- continue;
+- if ((cpu0_loc != 0) &&
+- (cpu0_loc == per_cpu(cpu_data, cpu).cpu_loc))
+- continue;
+-
+- clocksource_cr16.name = "cr16_unstable";
+- clocksource_cr16.flags = CLOCK_SOURCE_UNSTABLE;
+- clocksource_cr16.rating = 0;
+- break;
+- }
++ clocksource_cr16.name = "cr16_unstable";
++ clocksource_cr16.flags = CLOCK_SOURCE_UNSTABLE;
++ clocksource_cr16.rating = 0;
+ }
+
+ /* XXX: We may want to mark sched_clock stable here if cr16 clocks are
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index e8bfd29bb1f9f..098794fc5dc81 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -703,9 +703,6 @@ static void __init setup_memory(void)
+ storage_key_init_range(reg->base, reg->base + reg->size);
+ }
+ psw_set_key(PAGE_DEFAULT_KEY);
+-
+- /* Only cosmetics */
+- memblock_enforce_memory_limit(memblock_end_of_DRAM());
+ }
+
+ /*
+diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c
+index 47d0979468727..7bfb9af57e4c2 100644
+--- a/arch/x86/realmode/init.c
++++ b/arch/x86/realmode/init.c
+@@ -55,6 +55,7 @@ static void __init setup_real_mode(void)
+ #ifdef CONFIG_X86_64
+ u64 *trampoline_pgd;
+ u64 efer;
++ int i;
+ #endif
+
+ base = (unsigned char *)real_mode_header;
+@@ -113,8 +114,17 @@ static void __init setup_real_mode(void)
+ trampoline_header->flags |= TH_FLAGS_SME_ACTIVE;
+
+ trampoline_pgd = (u64 *) __va(real_mode_header->trampoline_pgd);
++
++ /* Map the real mode stub as virtual == physical */
+ trampoline_pgd[0] = trampoline_pgd_entry.pgd;
+- trampoline_pgd[511] = init_top_pgt[511].pgd;
++
++ /*
++ * Include the entirety of the kernel mapping into the trampoline
++ * PGD. This way, all mappings present in the normal kernel page
++ * tables are usable while running on trampoline_pgd.
++ */
++ for (i = pgd_index(__PAGE_OFFSET); i < PTRS_PER_PGD; i++)
++ trampoline_pgd[i] = init_top_pgt[i].pgd;
+ #endif
+ }
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 8df0ec85cc7b9..505920d4530f8 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -436,6 +436,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ /* AMD */
+ { PCI_VDEVICE(AMD, 0x7800), board_ahci }, /* AMD Hudson-2 */
+ { PCI_VDEVICE(AMD, 0x7900), board_ahci }, /* AMD CZ */
++ { PCI_VDEVICE(AMD, 0x7901), board_ahci_mobile }, /* AMD Green Sardine */
+ /* AMD is using RAID class only for ahci controllers */
+ { PCI_VENDOR_ID_AMD, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+ PCI_CLASS_STORAGE_RAID << 8, 0xffffff, board_ahci },
+diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
+index 8b3be0ff91cb4..0dce18838296d 100644
+--- a/drivers/ata/sata_fsl.c
++++ b/drivers/ata/sata_fsl.c
+@@ -1399,6 +1399,14 @@ static int sata_fsl_init_controller(struct ata_host *host)
+ return 0;
+ }
+
++static void sata_fsl_host_stop(struct ata_host *host)
++{
++ struct sata_fsl_host_priv *host_priv = host->private_data;
++
++ iounmap(host_priv->hcr_base);
++ kfree(host_priv);
++}
++
+ /*
+ * scsi mid-layer and libata interface structures
+ */
+@@ -1431,6 +1439,8 @@ static struct ata_port_operations sata_fsl_ops = {
+ .port_start = sata_fsl_port_start,
+ .port_stop = sata_fsl_port_stop,
+
++ .host_stop = sata_fsl_host_stop,
++
+ .pmp_attach = sata_fsl_pmp_attach,
+ .pmp_detach = sata_fsl_pmp_detach,
+ };
+@@ -1485,9 +1495,9 @@ static int sata_fsl_probe(struct platform_device *ofdev)
+ host_priv->ssr_base = ssr_base;
+ host_priv->csr_base = csr_base;
+
+- irq = irq_of_parse_and_map(ofdev->dev.of_node, 0);
+- if (!irq) {
+- dev_err(&ofdev->dev, "invalid irq from platform\n");
++ irq = platform_get_irq(ofdev, 0);
++ if (irq < 0) {
++ retval = irq;
+ goto error_exit_with_cleanup;
+ }
+ host_priv->irq = irq;
+@@ -1562,10 +1572,6 @@ static int sata_fsl_remove(struct platform_device *ofdev)
+
+ ata_host_detach(host);
+
+- irq_dispose_mapping(host_priv->irq);
+- iounmap(host_priv->hcr_base);
+- kfree(host_priv);
+-
+ return 0;
+ }
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index cb85516e1eb3c..48929df7673b1 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -219,6 +219,8 @@ struct ipmi_user {
+ struct work_struct remove_work;
+ };
+
++static struct workqueue_struct *remove_work_wq;
++
+ static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user, int *index)
+ __acquires(user->release_barrier)
+ {
+@@ -1207,7 +1209,7 @@ static void free_user(struct kref *ref)
+ struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
+
+ /* SRCU cleanup must happen in task context. */
+- schedule_work(&user->remove_work);
++ queue_work(remove_work_wq, &user->remove_work);
+ }
+
+ static void _ipmi_destroy_user(struct ipmi_user *user)
+@@ -5090,6 +5092,13 @@ static int ipmi_init_msghandler(void)
+
+ atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
+
++ remove_work_wq = create_singlethread_workqueue("ipmi-msghandler-remove-wq");
++ if (!remove_work_wq) {
++ pr_err("unable to create ipmi-msghandler-remove-wq workqueue");
++ rv = -ENOMEM;
++ goto out;
++ }
++
+ initialized = true;
+
+ out:
+@@ -5115,6 +5124,8 @@ static void __exit cleanup_ipmi(void)
+ int count;
+
+ if (initialized) {
++ destroy_workqueue(remove_work_wq);
++
+ atomic_notifier_chain_unregister(&panic_notifier_list,
+ &panic_block);
+
+diff --git a/drivers/gpu/drm/msm/msm_debugfs.c b/drivers/gpu/drm/msm/msm_debugfs.c
+index 989465e5f9d91..a3666267d5f6d 100644
+--- a/drivers/gpu/drm/msm/msm_debugfs.c
++++ b/drivers/gpu/drm/msm/msm_debugfs.c
+@@ -83,6 +83,7 @@ static int msm_gpu_open(struct inode *inode, struct file *file)
+ goto free_priv;
+
+ pm_runtime_get_sync(&gpu->pdev->dev);
++ msm_gpu_hw_init(gpu);
+ show_priv->state = gpu->funcs->gpu_state_get(gpu);
+ pm_runtime_put_sync(&gpu->pdev->dev);
+
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index 6feafebf85feb..e352c16087bb3 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -1379,6 +1379,7 @@ static irqreturn_t stm32f7_i2c_isr_event(int irq, void *data)
+ {
+ struct stm32f7_i2c_dev *i2c_dev = data;
+ struct stm32f7_i2c_msg *f7_msg = &i2c_dev->f7_msg;
++ struct stm32_i2c_dma *dma = i2c_dev->dma;
+ void __iomem *base = i2c_dev->base;
+ u32 status, mask;
+ int ret = IRQ_HANDLED;
+@@ -1403,6 +1404,10 @@ static irqreturn_t stm32f7_i2c_isr_event(int irq, void *data)
+ if (status & STM32F7_I2C_ISR_NACKF) {
+ dev_dbg(i2c_dev->dev, "<%s>: Receive NACK\n", __func__);
+ writel_relaxed(STM32F7_I2C_ICR_NACKCF, base + STM32F7_I2C_ICR);
++ if (i2c_dev->use_dma) {
++ stm32f7_i2c_disable_dma_req(i2c_dev);
++ dmaengine_terminate_all(dma->chan_using);
++ }
+ f7_msg->result = -ENXIO;
+ }
+
+@@ -1418,7 +1423,7 @@ static irqreturn_t stm32f7_i2c_isr_event(int irq, void *data)
+ /* Clear STOP flag */
+ writel_relaxed(STM32F7_I2C_ICR_STOPCF, base + STM32F7_I2C_ICR);
+
+- if (i2c_dev->use_dma) {
++ if (i2c_dev->use_dma && !f7_msg->result) {
+ ret = IRQ_WAKE_THREAD;
+ } else {
+ i2c_dev->master_mode = false;
+@@ -1431,7 +1436,7 @@ static irqreturn_t stm32f7_i2c_isr_event(int irq, void *data)
+ if (f7_msg->stop) {
+ mask = STM32F7_I2C_CR2_STOP;
+ stm32f7_i2c_set_bits(base + STM32F7_I2C_CR2, mask);
+- } else if (i2c_dev->use_dma) {
++ } else if (i2c_dev->use_dma && !f7_msg->result) {
+ ret = IRQ_WAKE_THREAD;
+ } else if (f7_msg->smbus) {
+ stm32f7_i2c_smbus_rep_start(i2c_dev);
+@@ -1579,6 +1584,7 @@ static int stm32f7_i2c_xfer(struct i2c_adapter *i2c_adap,
+ i2c_dev->msg->addr);
+ if (i2c_dev->use_dma)
+ dmaengine_terminate_all(dma->chan_using);
++ stm32f7_i2c_wait_free_bus(i2c_dev);
+ ret = -ETIMEDOUT;
+ }
+
+@@ -1629,6 +1635,7 @@ static int stm32f7_i2c_smbus_xfer(struct i2c_adapter *adapter, u16 addr,
+ dev_dbg(dev, "Access to slave 0x%x timed out\n", f7_msg->addr);
+ if (i2c_dev->use_dma)
+ dmaengine_terminate_all(dma->chan_using);
++ stm32f7_i2c_wait_free_bus(i2c_dev);
+ ret = -ETIMEDOUT;
+ goto clk_free;
+ }
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+index 096ec18e8f15a..49c80bac9ce28 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+@@ -459,6 +459,11 @@ int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self,
+ goto err_exit;
+
+ if (fw.len == 0xFFFFU) {
++ if (sw.len > sizeof(self->rpc)) {
++ printk(KERN_INFO "Invalid sw len: %x\n", sw.len);
++ err = -EINVAL;
++ goto err_exit;
++ }
+ err = hw_atl_utils_fw_rpc_call(self, sw.len);
+ if (err < 0)
+ goto err_exit;
+@@ -469,6 +474,11 @@ int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self,
+
+ if (rpc) {
+ if (fw.len) {
++ if (fw.len > sizeof(self->rpc)) {
++ printk(KERN_INFO "Invalid fw len: %x\n", fw.len);
++ err = -EINVAL;
++ goto err_exit;
++ }
+ err =
+ hw_atl_utils_fw_downld_dwords(self,
+ self->rpc_addr,
+diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
+index c813e6f2b371e..c97fc0e384ca6 100644
+--- a/drivers/net/ethernet/dec/tulip/de4x5.c
++++ b/drivers/net/ethernet/dec/tulip/de4x5.c
+@@ -4708,6 +4708,10 @@ type3_infoblock(struct net_device *dev, u_char count, u_char *p)
+ lp->ibn = 3;
+ lp->active = *p++;
+ if (MOTO_SROM_BUG) lp->active = 0;
++ /* if (MOTO_SROM_BUG) statement indicates lp->active could
++ * be 8 (i.e. the size of array lp->phy) */
++ if (WARN_ON(lp->active >= ARRAY_SIZE(lp->phy)))
++ return -EINVAL;
+ lp->phy[lp->active].gep = (*p ? p : NULL); p += (2 * (*p) + 1);
+ lp->phy[lp->active].rst = (*p ? p : NULL); p += (2 * (*p) + 1);
+ lp->phy[lp->active].mc = get_unaligned_le16(p); p += 2;
+@@ -4999,19 +5003,23 @@ mii_get_phy(struct net_device *dev)
+ }
+ if ((j == limit) && (i < DE4X5_MAX_MII)) {
+ for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
+- lp->phy[k].addr = i;
+- lp->phy[k].id = id;
+- lp->phy[k].spd.reg = GENERIC_REG; /* ANLPA register */
+- lp->phy[k].spd.mask = GENERIC_MASK; /* 100Mb/s technologies */
+- lp->phy[k].spd.value = GENERIC_VALUE; /* TX & T4, H/F Duplex */
+- lp->mii_cnt++;
+- lp->active++;
+- printk("%s: Using generic MII device control. If the board doesn't operate,\nplease mail the following dump to the author:\n", dev->name);
+- j = de4x5_debug;
+- de4x5_debug |= DEBUG_MII;
+- de4x5_dbg_mii(dev, k);
+- de4x5_debug = j;
+- printk("\n");
++ if (k < DE4X5_MAX_PHY) {
++ lp->phy[k].addr = i;
++ lp->phy[k].id = id;
++ lp->phy[k].spd.reg = GENERIC_REG; /* ANLPA register */
++ lp->phy[k].spd.mask = GENERIC_MASK; /* 100Mb/s technologies */
++ lp->phy[k].spd.value = GENERIC_VALUE; /* TX & T4, H/F Duplex */
++ lp->mii_cnt++;
++ lp->active++;
++ printk("%s: Using generic MII device control. If the board doesn't operate,\nplease mail the following dump to the author:\n", dev->name);
++ j = de4x5_debug;
++ de4x5_debug |= DEBUG_MII;
++ de4x5_dbg_mii(dev, k);
++ de4x5_debug = j;
++ printk("\n");
++ } else {
++ goto purgatory;
++ }
+ }
+ }
+ purgatory:
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
+index 16294cd3c9545..4ceacb1c154dc 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
+@@ -402,6 +402,10 @@ static void hns_dsaf_ge_srst_by_port(struct dsaf_device *dsaf_dev, u32 port,
+ return;
+
+ if (!HNS_DSAF_IS_DEBUG(dsaf_dev)) {
++ /* DSAF_MAX_PORT_NUM is 6, but DSAF_GE_NUM is 8.
++ We need check to prevent array overflow */
++ if (port >= DSAF_MAX_PORT_NUM)
++ return;
+ reg_val_1 = 0x1 << port;
+ port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off;
+ /* there is difference between V1 and V2 in register.*/
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 943bd189e895e..14d46afd21cb5 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -2282,9 +2282,14 @@ int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv,
+ bool carry_xdp_prog)
+ {
+ struct bpf_prog *xdp_prog;
+- int i, t;
++ int i, t, ret;
+
+- mlx4_en_copy_priv(tmp, priv, prof);
++ ret = mlx4_en_copy_priv(tmp, priv, prof);
++ if (ret) {
++ en_warn(priv, "%s: mlx4_en_copy_priv() failed, return\n",
++ __func__);
++ return ret;
++ }
+
+ if (mlx4_en_alloc_resources(tmp)) {
+ en_warn(priv,
+diff --git a/drivers/net/ethernet/natsemi/xtsonic.c b/drivers/net/ethernet/natsemi/xtsonic.c
+index 44171d7bb434c..5117864738a7e 100644
+--- a/drivers/net/ethernet/natsemi/xtsonic.c
++++ b/drivers/net/ethernet/natsemi/xtsonic.c
+@@ -120,7 +120,7 @@ static const struct net_device_ops xtsonic_netdev_ops = {
+ .ndo_set_mac_address = eth_mac_addr,
+ };
+
+-static int __init sonic_probe1(struct net_device *dev)
++static int sonic_probe1(struct net_device *dev)
+ {
+ unsigned int silicon_revision;
+ struct sonic_local *lp = netdev_priv(dev);
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+index a15845e511b2c..d857d44547a53 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+@@ -1079,8 +1079,14 @@ static int qlcnic_83xx_add_rings(struct qlcnic_adapter *adapter)
+ sds_mbx_size = sizeof(struct qlcnic_sds_mbx);
+ context_id = recv_ctx->context_id;
+ num_sds = adapter->drv_sds_rings - QLCNIC_MAX_SDS_RINGS;
+- ahw->hw_ops->alloc_mbx_args(&cmd, adapter,
+- QLCNIC_CMD_ADD_RCV_RINGS);
++ err = ahw->hw_ops->alloc_mbx_args(&cmd, adapter,
++ QLCNIC_CMD_ADD_RCV_RINGS);
++ if (err) {
++ dev_err(&adapter->pdev->dev,
++ "Failed to alloc mbx args %d\n", err);
++ return err;
++ }
++
+ cmd.req.arg[1] = 0 | (num_sds << 8) | (context_id << 16);
+
+ /* set up status rings, mbx 2-81 */
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 75984c799afc7..b328207c04555 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2152,7 +2152,7 @@ static int lan78xx_phy_init(struct lan78xx_net *dev)
+ if (dev->domain_data.phyirq > 0)
+ phydev->irq = dev->domain_data.phyirq;
+ else
+- phydev->irq = 0;
++ phydev->irq = PHY_POLL;
+ netdev_dbg(dev->net, "phydev->irq = %d\n", phydev->irq);
+
+ /* set to AUTOMDIX */
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index 93899a7be9c57..857b6f80a58d8 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -210,6 +210,7 @@ static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
+ /* strip the ethernet header added for pass through VRF device */
+ __skb_pull(skb, skb_network_offset(skb));
+
++ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ ret = vrf_ip6_local_out(net, skb->sk, skb);
+ if (unlikely(net_xmit_eval(ret)))
+ dev->stats.tx_errors++;
+@@ -291,6 +292,7 @@ static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
+ RT_SCOPE_LINK);
+ }
+
++ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ ret = vrf_ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb);
+ if (unlikely(net_xmit_eval(ret)))
+ vrf_dev->stats.tx_errors++;
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index fa8bcbe3d2762..912ce5cb2f084 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -1198,15 +1198,6 @@ static int tpacpi_rfk_update_swstate(const struct tpacpi_rfk *tp_rfk)
+ return status;
+ }
+
+-/* Query FW and update rfkill sw state for all rfkill switches */
+-static void tpacpi_rfk_update_swstate_all(void)
+-{
+- unsigned int i;
+-
+- for (i = 0; i < TPACPI_RFK_SW_MAX; i++)
+- tpacpi_rfk_update_swstate(tpacpi_rfkill_switches[i]);
+-}
+-
+ /*
+ * Sync the HW-blocking state of all rfkill switches,
+ * do notice it causes the rfkill core to schedule uevents
+@@ -3145,9 +3136,6 @@ static void tpacpi_send_radiosw_update(void)
+ if (wlsw == TPACPI_RFK_RADIO_OFF)
+ tpacpi_rfk_update_hwblock_state(true);
+
+- /* Sync sw blocking state */
+- tpacpi_rfk_update_swstate_all();
+-
+ /* Sync hw blocking state last if it is hw-unblocked */
+ if (wlsw == TPACPI_RFK_RADIO_ON)
+ tpacpi_rfk_update_hwblock_state(false);
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index c06e648a415b5..79581771e6f61 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -1892,12 +1892,12 @@ static void session_recovery_timedout(struct work_struct *work)
+ }
+ spin_unlock_irqrestore(&session->lock, flags);
+
+- if (session->transport->session_recovery_timedout)
+- session->transport->session_recovery_timedout(session);
+-
+ ISCSI_DBG_TRANS_SESSION(session, "Unblocking SCSI target\n");
+ scsi_target_unblock(&session->dev, SDEV_TRANSPORT_OFFLINE);
+ ISCSI_DBG_TRANS_SESSION(session, "Completed unblocking SCSI target\n");
++
++ if (session->transport->session_recovery_timedout)
++ session->transport->session_recovery_timedout(session);
+ }
+
+ static void __iscsi_unblock_session(struct work_struct *work)
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index ae60599c462b9..6c7825c581b5f 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -454,6 +454,8 @@ static void thermal_zone_device_init(struct thermal_zone_device *tz)
+ {
+ struct thermal_instance *pos;
+ tz->temperature = THERMAL_TEMP_INVALID;
++ tz->prev_low_trip = -INT_MAX;
++ tz->prev_high_trip = INT_MAX;
+ list_for_each_entry(pos, &tz->thermal_instances, tz_node)
+ pos->initialized = false;
+ }
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index 1306ce5c5d9bf..3d63e9a71c376 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -2773,6 +2773,7 @@ MODULE_DEVICE_TABLE(of, sbsa_uart_of_match);
+
+ static const struct acpi_device_id sbsa_uart_acpi_match[] = {
+ { "ARMH0011", 0 },
++ { "ARMHB000", 0 },
+ {},
+ };
+ MODULE_DEVICE_TABLE(acpi, sbsa_uart_acpi_match);
+diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
+index 4caeca67fd143..a40827956bd15 100644
+--- a/drivers/tty/serial/msm_serial.c
++++ b/drivers/tty/serial/msm_serial.c
+@@ -603,6 +603,9 @@ static void msm_start_rx_dma(struct msm_port *msm_port)
+ u32 val;
+ int ret;
+
++ if (IS_ENABLED(CONFIG_CONSOLE_POLL))
++ return;
++
+ if (!dma->chan)
+ return;
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 5ed1327d284f9..63aefe7e91be1 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1527,6 +1527,7 @@ static void uart_tty_port_shutdown(struct tty_port *port)
+ {
+ struct uart_state *state = container_of(port, struct uart_state, port);
+ struct uart_port *uport = uart_port_check(state);
++ char *buf;
+
+ /*
+ * At this point, we stop accepting input. To do this, we
+@@ -1548,8 +1549,18 @@ static void uart_tty_port_shutdown(struct tty_port *port)
+ */
+ tty_port_set_suspended(port, 0);
+
+- uart_change_pm(state, UART_PM_STATE_OFF);
++ /*
++ * Free the transmit buffer.
++ */
++ spin_lock_irq(&uport->lock);
++ buf = state->xmit.buf;
++ state->xmit.buf = NULL;
++ spin_unlock_irq(&uport->lock);
+
++ if (buf)
++ free_page((unsigned long)buf);
++
++ uart_change_pm(state, UART_PM_STATE_OFF);
+ }
+
+ static void uart_wait_until_sent(struct tty_struct *tty, int timeout)
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index d97544fd339b1..e170c5b4d6f0c 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -435,6 +435,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1532, 0x0116), .driver_info =
+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
++ /* Lenovo Powered USB-C Travel Hub (4X90S92381, RTL8153 GigE) */
++ { USB_DEVICE(0x17ef, 0x721e), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* Lenovo ThinkCenter A630Z TI024Gen3 usb-audio */
+ { USB_DEVICE(0x17ef, 0xa012), .driver_info =
+ USB_QUIRK_DISCONNECT_SUSPEND },
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 04c04328d075f..15e3bf8c9e830 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -339,7 +339,9 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci,
+ /* Must be called with xhci->lock held, releases and aquires lock back */
+ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci, unsigned long flags)
+ {
+- u32 temp_32;
++ struct xhci_segment *new_seg = xhci->cmd_ring->deq_seg;
++ union xhci_trb *new_deq = xhci->cmd_ring->dequeue;
++ u64 crcr;
+ int ret;
+
+ xhci_dbg(xhci, "Abort command ring\n");
+@@ -348,13 +350,18 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci, unsigned long flags)
+
+ /*
+ * The control bits like command stop, abort are located in lower
+- * dword of the command ring control register. Limit the write
+- * to the lower dword to avoid corrupting the command ring pointer
+- * in case if the command ring is stopped by the time upper dword
+- * is written.
++ * dword of the command ring control register.
++ * Some controllers require all 64 bits to be written to abort the ring.
++ * Make sure the upper dword is valid, pointing to the next command,
++ * avoiding corrupting the command ring pointer in case the command ring
++ * is stopped by the time the upper dword is written.
+ */
+- temp_32 = readl(&xhci->op_regs->cmd_ring);
+- writel(temp_32 | CMD_RING_ABORT, &xhci->op_regs->cmd_ring);
++ next_trb(xhci, NULL, &new_seg, &new_deq);
++ if (trb_is_link(new_deq))
++ next_trb(xhci, NULL, &new_seg, &new_deq);
++
++ crcr = xhci_trb_virt_to_dma(new_seg, new_deq);
++ xhci_write_64(xhci, crcr | CMD_RING_ABORT, &xhci->op_regs->cmd_ring);
+
+ /* Section 4.6.1.2 of xHCI 1.0 spec says software should also time the
+ * completion of the Command Abort operation. If CRR is not negated in 5
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index af41d4dce3adb..228d88c7bdb26 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -3098,11 +3098,7 @@ static void run_state_machine(struct tcpm_port *port)
+ tcpm_try_src(port) ? SRC_TRY
+ : SNK_ATTACHED,
+ 0);
+- else
+- /* Wait for VBUS, but not forever */
+- tcpm_set_state(port, PORT_RESET, PD_T_PS_SOURCE_ON);
+ break;
+-
+ case SRC_TRY:
+ port->try_src_count++;
+ tcpm_set_cc(port, tcpm_rp_cc(port));
+diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
+index a992d922b3a71..23f15f42e5cb6 100644
+--- a/drivers/video/console/vgacon.c
++++ b/drivers/video/console/vgacon.c
+@@ -370,11 +370,17 @@ static void vgacon_init(struct vc_data *c, int init)
+ struct uni_pagedir *p;
+
+ /*
+- * We cannot be loaded as a module, therefore init is always 1,
+- * but vgacon_init can be called more than once, and init will
+- * not be 1.
++ * We cannot be loaded as a module, therefore init will be 1
++ * if we are the default console, however if we are a fallback
++ * console, for example if fbcon has failed registration, then
++ * init will be 0, so we need to make sure our boot parameters
++ * have been copied to the console structure for vgacon_resize
++ * ultimately called by vc_resize. Any subsequent calls to
++ * vgacon_init init will have init set to 0 too.
+ */
+ c->vc_can_do_color = vga_can_do_color;
++ c->vc_scan_lines = vga_scan_lines;
++ c->vc_font.height = c->vc_cell_height = vga_video_font_height;
+
+ /* set dimensions manually if init != 0 since vc_resize() will fail */
+ if (init) {
+@@ -383,8 +389,6 @@ static void vgacon_init(struct vc_data *c, int init)
+ } else
+ vc_resize(c, vga_video_num_columns, vga_video_num_lines);
+
+- c->vc_scan_lines = vga_scan_lines;
+- c->vc_font.height = c->vc_cell_height = vga_video_font_height;
+ c->vc_complement_mask = 0x7700;
+ if (vga_512_chars)
+ c->vc_hi_font_mask = 0x0800;
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index c326535d5a80a..2ac920bdf4df5 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -3579,11 +3579,23 @@ static void btrfs_end_empty_barrier(struct bio *bio)
+ */
+ static void write_dev_flush(struct btrfs_device *device)
+ {
+- struct request_queue *q = bdev_get_queue(device->bdev);
+ struct bio *bio = device->flush_bio;
+
++#ifndef CONFIG_BTRFS_FS_CHECK_INTEGRITY
++ /*
++ * When a disk has write caching disabled, we skip submission of a bio
++ * with flush and sync requests before writing the superblock, since
++ * it's not needed. However when the integrity checker is enabled, this
++ * results in reports that there are metadata blocks referred by a
++ * superblock that were not properly flushed. So don't skip the bio
++ * submission only when the integrity checker is enabled for the sake
++ * of simplicity, since this is a debug tool and not meant for use in
++ * non-debug builds.
++ */
++ struct request_queue *q = bdev_get_queue(device->bdev);
+ if (!test_bit(QUEUE_FLAG_WC, &q->queue_flags))
+ return;
++#endif
+
+ bio_reset(bio);
+ bio->bi_end_io = btrfs_end_empty_barrier;
+diff --git a/fs/file.c b/fs/file.c
+index 3762a3f136fda..9a6a3bba53af1 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -677,7 +677,7 @@ void do_close_on_exec(struct files_struct *files)
+ spin_unlock(&files->file_lock);
+ }
+
+-static struct file *__fget(unsigned int fd, fmode_t mask)
++static struct file *__fget(unsigned int fd, fmode_t mask, unsigned int refs)
+ {
+ struct files_struct *files = current->files;
+ struct file *file;
+@@ -692,23 +692,32 @@ loop:
+ */
+ if (file->f_mode & mask)
+ file = NULL;
+- else if (!get_file_rcu(file))
++ else if (!get_file_rcu_many(file, refs))
+ goto loop;
++ else if (__fcheck_files(files, fd) != file) {
++ fput_many(file, refs);
++ goto loop;
++ }
+ }
+ rcu_read_unlock();
+
+ return file;
+ }
+
++struct file *fget_many(unsigned int fd, unsigned int refs)
++{
++ return __fget(fd, FMODE_PATH, refs);
++}
++
+ struct file *fget(unsigned int fd)
+ {
+- return __fget(fd, FMODE_PATH);
++ return __fget(fd, FMODE_PATH, 1);
+ }
+ EXPORT_SYMBOL(fget);
+
+ struct file *fget_raw(unsigned int fd)
+ {
+- return __fget(fd, 0);
++ return __fget(fd, 0, 1);
+ }
+ EXPORT_SYMBOL(fget_raw);
+
+@@ -739,7 +748,7 @@ static unsigned long __fget_light(unsigned int fd, fmode_t mask)
+ return 0;
+ return (unsigned long)file;
+ } else {
+- file = __fget(fd, mask);
++ file = __fget(fd, mask, 1);
+ if (!file)
+ return 0;
+ return FDPUT_FPUT | (unsigned long)file;
+diff --git a/fs/file_table.c b/fs/file_table.c
+index e49af4caf15d9..6a715639728da 100644
+--- a/fs/file_table.c
++++ b/fs/file_table.c
+@@ -326,9 +326,9 @@ void flush_delayed_fput(void)
+
+ static DECLARE_DELAYED_WORK(delayed_fput_work, delayed_fput);
+
+-void fput(struct file *file)
++void fput_many(struct file *file, unsigned int refs)
+ {
+- if (atomic_long_dec_and_test(&file->f_count)) {
++ if (atomic_long_sub_and_test(refs, &file->f_count)) {
+ struct task_struct *task = current;
+
+ if (likely(!in_interrupt() && !(task->flags & PF_KTHREAD))) {
+@@ -347,6 +347,11 @@ void fput(struct file *file)
+ }
+ }
+
++void fput(struct file *file)
++{
++ fput_many(file, 1);
++}
++
+ /*
+ * synchronous analog of fput(); for kernel threads that might be needed
+ * in some umount() (and thus can't use flush_delayed_fput() without
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 43f53020553b5..53ba5019ad063 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -943,7 +943,7 @@ do_alloc:
+ else if (height == ip->i_height)
+ ret = gfs2_hole_size(inode, lblock, len, mp, iomap);
+ else
+- iomap->length = size - pos;
++ iomap->length = size - iomap->offset;
+ } else if (flags & IOMAP_WRITE) {
+ u64 alloc_size;
+
+diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
+index be252795a6f70..5b1d452e640bc 100644
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -295,8 +295,9 @@ static ssize_t _nfs42_proc_copy(struct file *src,
+ goto out;
+ }
+
+- truncate_pagecache_range(dst_inode, pos_dst,
+- pos_dst + res->write_res.count);
++ WARN_ON_ONCE(invalidate_inode_pages2_range(dst_inode->i_mapping,
++ pos_dst >> PAGE_SHIFT,
++ (pos_dst + res->write_res.count - 1) >> PAGE_SHIFT));
+
+ status = res->write_res.count;
+ out:
+diff --git a/include/linux/file.h b/include/linux/file.h
+index 6b2fb032416ca..3fcddff56bc4b 100644
+--- a/include/linux/file.h
++++ b/include/linux/file.h
+@@ -13,6 +13,7 @@
+ struct file;
+
+ extern void fput(struct file *);
++extern void fput_many(struct file *, unsigned int);
+
+ struct file_operations;
+ struct vfsmount;
+@@ -44,6 +45,7 @@ static inline void fdput(struct fd fd)
+ }
+
+ extern struct file *fget(unsigned int fd);
++extern struct file *fget_many(unsigned int fd, unsigned int refs);
+ extern struct file *fget_raw(unsigned int fd);
+ extern unsigned long __fdget(unsigned int fd);
+ extern unsigned long __fdget_raw(unsigned int fd);
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index b6a955ba6173a..86f884e78b6b9 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -942,7 +942,9 @@ static inline struct file *get_file(struct file *f)
+ atomic_long_inc(&f->f_count);
+ return f;
+ }
+-#define get_file_rcu(x) atomic_long_inc_not_zero(&(x)->f_count)
++#define get_file_rcu_many(x, cnt) \
++ atomic_long_add_unless(&(x)->f_count, (cnt), 0)
++#define get_file_rcu(x) get_file_rcu_many((x), 1)
+ #define fput_atomic(x) atomic_long_add_unless(&(x)->f_count, -1, 1)
+ #define file_count(x) atomic_long_read(&(x)->f_count)
+
+diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
+index 6ab8c1bada3fc..36ffbe330abea 100644
+--- a/include/linux/ipc_namespace.h
++++ b/include/linux/ipc_namespace.h
+@@ -129,6 +129,16 @@ static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns)
+ return ns;
+ }
+
++static inline struct ipc_namespace *get_ipc_ns_not_zero(struct ipc_namespace *ns)
++{
++ if (ns) {
++ if (refcount_inc_not_zero(&ns->count))
++ return ns;
++ }
++
++ return NULL;
++}
++
+ extern void put_ipc_ns(struct ipc_namespace *ns);
+ #else
+ static inline struct ipc_namespace *copy_ipcs(unsigned long flags,
+@@ -145,6 +155,11 @@ static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns)
+ return ns;
+ }
+
++static inline struct ipc_namespace *get_ipc_ns_not_zero(struct ipc_namespace *ns)
++{
++ return ns;
++}
++
+ static inline void put_ipc_ns(struct ipc_namespace *ns)
+ {
+ }
+diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
+index c28204e22b544..304e7a0f6b165 100644
+--- a/include/linux/kprobes.h
++++ b/include/linux/kprobes.h
+@@ -168,6 +168,8 @@ struct kretprobe {
+ raw_spinlock_t lock;
+ };
+
++#define KRETPROBE_MAX_DATA_SIZE 4096
++
+ struct kretprobe_instance {
+ struct hlist_node hlist;
+ struct kretprobe *rp;
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index fbd689c15974e..50ab7c8fd3090 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3840,7 +3840,8 @@ static inline u32 netif_msg_init(int debug_value, int default_msg_enable_bits)
+ static inline void __netif_tx_lock(struct netdev_queue *txq, int cpu)
+ {
+ spin_lock(&txq->_xmit_lock);
+- txq->xmit_lock_owner = cpu;
++ /* Pairs with READ_ONCE() in __dev_queue_xmit() */
++ WRITE_ONCE(txq->xmit_lock_owner, cpu);
+ }
+
+ static inline bool __netif_tx_acquire(struct netdev_queue *txq)
+@@ -3857,26 +3858,32 @@ static inline void __netif_tx_release(struct netdev_queue *txq)
+ static inline void __netif_tx_lock_bh(struct netdev_queue *txq)
+ {
+ spin_lock_bh(&txq->_xmit_lock);
+- txq->xmit_lock_owner = smp_processor_id();
++ /* Pairs with READ_ONCE() in __dev_queue_xmit() */
++ WRITE_ONCE(txq->xmit_lock_owner, smp_processor_id());
+ }
+
+ static inline bool __netif_tx_trylock(struct netdev_queue *txq)
+ {
+ bool ok = spin_trylock(&txq->_xmit_lock);
+- if (likely(ok))
+- txq->xmit_lock_owner = smp_processor_id();
++
++ if (likely(ok)) {
++ /* Pairs with READ_ONCE() in __dev_queue_xmit() */
++ WRITE_ONCE(txq->xmit_lock_owner, smp_processor_id());
++ }
+ return ok;
+ }
+
+ static inline void __netif_tx_unlock(struct netdev_queue *txq)
+ {
+- txq->xmit_lock_owner = -1;
++ /* Pairs with READ_ONCE() in __dev_queue_xmit() */
++ WRITE_ONCE(txq->xmit_lock_owner, -1);
+ spin_unlock(&txq->_xmit_lock);
+ }
+
+ static inline void __netif_tx_unlock_bh(struct netdev_queue *txq)
+ {
+- txq->xmit_lock_owner = -1;
++ /* Pairs with READ_ONCE() in __dev_queue_xmit() */
++ WRITE_ONCE(txq->xmit_lock_owner, -1);
+ spin_unlock_bh(&txq->_xmit_lock);
+ }
+
+diff --git a/include/linux/of_clk.h b/include/linux/of_clk.h
+index b27da9f164cbd..c86fcad23fc21 100644
+--- a/include/linux/of_clk.h
++++ b/include/linux/of_clk.h
+@@ -6,6 +6,9 @@
+ #ifndef __LINUX_OF_CLK_H
+ #define __LINUX_OF_CLK_H
+
++struct device_node;
++struct of_device_id;
++
+ #if defined(CONFIG_COMMON_CLK) && defined(CONFIG_OF)
+
+ unsigned int of_clk_get_parent_count(struct device_node *np);
+diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
+index 44c6f15800ff5..91401309b1aa2 100644
+--- a/include/linux/sched/task.h
++++ b/include/linux/sched/task.h
+@@ -136,7 +136,7 @@ static inline struct vm_struct *task_stack_vm_area(const struct task_struct *t)
+ * Protects ->fs, ->files, ->mm, ->group_info, ->comm, keyring
+ * subscriptions and synchronises with wait4(). Also used in procfs. Also
+ * pins the final release of task.io_context. Also protects ->cpuset and
+- * ->cgroup.subsys[]. And ->vfork_done.
++ * ->cgroup.subsys[]. And ->vfork_done. And ->sysvshm.shm_clist.
+ *
+ * Nests both inside and outside of read_lock(&tasklist_lock).
+ * It must not be nested with write_lock_irq(&tasklist_lock),
+diff --git a/include/linux/siphash.h b/include/linux/siphash.h
+index bf21591a9e5e6..0cda61855d907 100644
+--- a/include/linux/siphash.h
++++ b/include/linux/siphash.h
+@@ -27,9 +27,7 @@ static inline bool siphash_key_is_zero(const siphash_key_t *key)
+ }
+
+ u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key);
+-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key);
+-#endif
+
+ u64 siphash_1u64(const u64 a, const siphash_key_t *key);
+ u64 siphash_2u64(const u64 a, const u64 b, const siphash_key_t *key);
+@@ -82,10 +80,9 @@ static inline u64 ___siphash_aligned(const __le64 *data, size_t len,
+ static inline u64 siphash(const void *data, size_t len,
+ const siphash_key_t *key)
+ {
+-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+- if (!IS_ALIGNED((unsigned long)data, SIPHASH_ALIGNMENT))
++ if (IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) ||
++ !IS_ALIGNED((unsigned long)data, SIPHASH_ALIGNMENT))
+ return __siphash_unaligned(data, len, key);
+-#endif
+ return ___siphash_aligned(data, len, key);
+ }
+
+@@ -96,10 +93,8 @@ typedef struct {
+
+ u32 __hsiphash_aligned(const void *data, size_t len,
+ const hsiphash_key_t *key);
+-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ u32 __hsiphash_unaligned(const void *data, size_t len,
+ const hsiphash_key_t *key);
+-#endif
+
+ u32 hsiphash_1u32(const u32 a, const hsiphash_key_t *key);
+ u32 hsiphash_2u32(const u32 a, const u32 b, const hsiphash_key_t *key);
+@@ -135,10 +130,9 @@ static inline u32 ___hsiphash_aligned(const __le32 *data, size_t len,
+ static inline u32 hsiphash(const void *data, size_t len,
+ const hsiphash_key_t *key)
+ {
+-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+- if (!IS_ALIGNED((unsigned long)data, HSIPHASH_ALIGNMENT))
++ if (IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) ||
++ !IS_ALIGNED((unsigned long)data, HSIPHASH_ALIGNMENT))
+ return __hsiphash_unaligned(data, len, key);
+-#endif
+ return ___hsiphash_aligned(data, len, key);
+ }
+
+diff --git a/ipc/shm.c b/ipc/shm.c
+index 1c65fb357395e..ba99f48c6e2bc 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -62,9 +62,18 @@ struct shmid_kernel /* private to the kernel */
+ struct pid *shm_lprid;
+ struct user_struct *mlock_user;
+
+- /* The task created the shm object. NULL if the task is dead. */
++ /*
++ * The task created the shm object, for
++ * task_lock(shp->shm_creator)
++ */
+ struct task_struct *shm_creator;
+- struct list_head shm_clist; /* list by creator */
++
++ /*
++ * List by creator. task_lock(->shm_creator) required for read/write.
++ * If list_empty(), then the creator is dead already.
++ */
++ struct list_head shm_clist;
++ struct ipc_namespace *ns;
+ } __randomize_layout;
+
+ /* shm_mode upper byte flags */
+@@ -115,6 +124,7 @@ static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
+ struct shmid_kernel *shp;
+
+ shp = container_of(ipcp, struct shmid_kernel, shm_perm);
++ WARN_ON(ns != shp->ns);
+
+ if (shp->shm_nattch) {
+ shp->shm_perm.mode |= SHM_DEST;
+@@ -225,10 +235,43 @@ static void shm_rcu_free(struct rcu_head *head)
+ kvfree(shp);
+ }
+
+-static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s)
++/*
++ * It has to be called with shp locked.
++ * It must be called before ipc_rmid()
++ */
++static inline void shm_clist_rm(struct shmid_kernel *shp)
+ {
+- list_del(&s->shm_clist);
+- ipc_rmid(&shm_ids(ns), &s->shm_perm);
++ struct task_struct *creator;
++
++ /* ensure that shm_creator does not disappear */
++ rcu_read_lock();
++
++ /*
++ * A concurrent exit_shm may do a list_del_init() as well.
++ * Just do nothing if exit_shm already did the work
++ */
++ if (!list_empty(&shp->shm_clist)) {
++ /*
++ * shp->shm_creator is guaranteed to be valid *only*
++ * if shp->shm_clist is not empty.
++ */
++ creator = shp->shm_creator;
++
++ task_lock(creator);
++ /*
++ * list_del_init() is a nop if the entry was already removed
++ * from the list.
++ */
++ list_del_init(&shp->shm_clist);
++ task_unlock(creator);
++ }
++ rcu_read_unlock();
++}
++
++static inline void shm_rmid(struct shmid_kernel *s)
++{
++ shm_clist_rm(s);
++ ipc_rmid(&shm_ids(s->ns), &s->shm_perm);
+ }
+
+
+@@ -283,7 +326,7 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
+ shm_file = shp->shm_file;
+ shp->shm_file = NULL;
+ ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
+- shm_rmid(ns, shp);
++ shm_rmid(shp);
+ shm_unlock(shp);
+ if (!is_file_hugepages(shm_file))
+ shmem_lock(shm_file, 0, shp->mlock_user);
+@@ -306,10 +349,10 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
+ *
+ * 2) sysctl kernel.shm_rmid_forced is set to 1.
+ */
+-static bool shm_may_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
++static bool shm_may_destroy(struct shmid_kernel *shp)
+ {
+ return (shp->shm_nattch == 0) &&
+- (ns->shm_rmid_forced ||
++ (shp->ns->shm_rmid_forced ||
+ (shp->shm_perm.mode & SHM_DEST));
+ }
+
+@@ -340,7 +383,7 @@ static void shm_close(struct vm_area_struct *vma)
+ ipc_update_pid(&shp->shm_lprid, task_tgid(current));
+ shp->shm_dtim = ktime_get_real_seconds();
+ shp->shm_nattch--;
+- if (shm_may_destroy(ns, shp))
++ if (shm_may_destroy(shp))
+ shm_destroy(ns, shp);
+ else
+ shm_unlock(shp);
+@@ -361,10 +404,10 @@ static int shm_try_destroy_orphaned(int id, void *p, void *data)
+ *
+ * As shp->* are changed under rwsem, it's safe to skip shp locking.
+ */
+- if (shp->shm_creator != NULL)
++ if (!list_empty(&shp->shm_clist))
+ return 0;
+
+- if (shm_may_destroy(ns, shp)) {
++ if (shm_may_destroy(shp)) {
+ shm_lock_by_ptr(shp);
+ shm_destroy(ns, shp);
+ }
+@@ -382,48 +425,97 @@ void shm_destroy_orphaned(struct ipc_namespace *ns)
+ /* Locking assumes this will only be called with task == current */
+ void exit_shm(struct task_struct *task)
+ {
+- struct ipc_namespace *ns = task->nsproxy->ipc_ns;
+- struct shmid_kernel *shp, *n;
++ for (;;) {
++ struct shmid_kernel *shp;
++ struct ipc_namespace *ns;
+
+- if (list_empty(&task->sysvshm.shm_clist))
+- return;
++ task_lock(task);
++
++ if (list_empty(&task->sysvshm.shm_clist)) {
++ task_unlock(task);
++ break;
++ }
++
++ shp = list_first_entry(&task->sysvshm.shm_clist, struct shmid_kernel,
++ shm_clist);
+
+- /*
+- * If kernel.shm_rmid_forced is not set then only keep track of
+- * which shmids are orphaned, so that a later set of the sysctl
+- * can clean them up.
+- */
+- if (!ns->shm_rmid_forced) {
+- down_read(&shm_ids(ns).rwsem);
+- list_for_each_entry(shp, &task->sysvshm.shm_clist, shm_clist)
+- shp->shm_creator = NULL;
+ /*
+- * Only under read lock but we are only called on current
+- * so no entry on the list will be shared.
++ * 1) Get pointer to the ipc namespace. It is worth to say
++ * that this pointer is guaranteed to be valid because
++ * shp lifetime is always shorter than namespace lifetime
++ * in which shp lives.
++ * We taken task_lock it means that shp won't be freed.
+ */
+- list_del(&task->sysvshm.shm_clist);
+- up_read(&shm_ids(ns).rwsem);
+- return;
+- }
++ ns = shp->ns;
+
+- /*
+- * Destroy all already created segments, that were not yet mapped,
+- * and mark any mapped as orphan to cover the sysctl toggling.
+- * Destroy is skipped if shm_may_destroy() returns false.
+- */
+- down_write(&shm_ids(ns).rwsem);
+- list_for_each_entry_safe(shp, n, &task->sysvshm.shm_clist, shm_clist) {
+- shp->shm_creator = NULL;
++ /*
++ * 2) If kernel.shm_rmid_forced is not set then only keep track of
++ * which shmids are orphaned, so that a later set of the sysctl
++ * can clean them up.
++ */
++ if (!ns->shm_rmid_forced)
++ goto unlink_continue;
+
+- if (shm_may_destroy(ns, shp)) {
+- shm_lock_by_ptr(shp);
+- shm_destroy(ns, shp);
++ /*
++ * 3) get a reference to the namespace.
++ * The refcount could be already 0. If it is 0, then
++ * the shm objects will be free by free_ipc_work().
++ */
++ ns = get_ipc_ns_not_zero(ns);
++ if (!ns) {
++unlink_continue:
++ list_del_init(&shp->shm_clist);
++ task_unlock(task);
++ continue;
+ }
+- }
+
+- /* Remove the list head from any segments still attached. */
+- list_del(&task->sysvshm.shm_clist);
+- up_write(&shm_ids(ns).rwsem);
++ /*
++ * 4) get a reference to shp.
++ * This cannot fail: shm_clist_rm() is called before
++ * ipc_rmid(), thus the refcount cannot be 0.
++ */
++ WARN_ON(!ipc_rcu_getref(&shp->shm_perm));
++
++ /*
++ * 5) unlink the shm segment from the list of segments
++ * created by current.
++ * This must be done last. After unlinking,
++ * only the refcounts obtained above prevent IPC_RMID
++ * from destroying the segment or the namespace.
++ */
++ list_del_init(&shp->shm_clist);
++
++ task_unlock(task);
++
++ /*
++ * 6) we have all references
++ * Thus lock & if needed destroy shp.
++ */
++ down_write(&shm_ids(ns).rwsem);
++ shm_lock_by_ptr(shp);
++ /*
++ * rcu_read_lock was implicitly taken in shm_lock_by_ptr, it's
++ * safe to call ipc_rcu_putref here
++ */
++ ipc_rcu_putref(&shp->shm_perm, shm_rcu_free);
++
++ if (ipc_valid_object(&shp->shm_perm)) {
++ if (shm_may_destroy(shp))
++ shm_destroy(ns, shp);
++ else
++ shm_unlock(shp);
++ } else {
++ /*
++ * Someone else deleted the shp from namespace
++ * idr/kht while we have waited.
++ * Just unlock and continue.
++ */
++ shm_unlock(shp);
++ }
++
++ up_write(&shm_ids(ns).rwsem);
++ put_ipc_ns(ns); /* paired with get_ipc_ns_not_zero */
++ }
+ }
+
+ static vm_fault_t shm_fault(struct vm_fault *vmf)
+@@ -680,7 +772,11 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+ if (error < 0)
+ goto no_id;
+
++ shp->ns = ns;
++
++ task_lock(current);
+ list_add(&shp->shm_clist, ¤t->sysvshm.shm_clist);
++ task_unlock(current);
+
+ /*
+ * shmid gets reported as "inode#" in /proc/pid/maps.
+@@ -1549,7 +1645,8 @@ out_nattch:
+ down_write(&shm_ids(ns).rwsem);
+ shp = shm_lock(ns, shmid);
+ shp->shm_nattch--;
+- if (shm_may_destroy(ns, shp))
++
++ if (shm_may_destroy(shp))
+ shm_destroy(ns, shp);
+ else
+ shm_unlock(shp);
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index d4435fd6fc8bc..993b84cc1db5a 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1976,6 +1976,9 @@ int register_kretprobe(struct kretprobe *rp)
+ }
+ }
+
++ if (rp->data_size > KRETPROBE_MAX_DATA_SIZE)
++ return -E2BIG;
++
+ rp->kp.pre_handler = pre_handler_kretprobe;
+ rp->kp.post_handler = NULL;
+ rp->kp.fault_handler = NULL;
+diff --git a/lib/siphash.c b/lib/siphash.c
+index 3ae58b4edad61..e632ee40aac1a 100644
+--- a/lib/siphash.c
++++ b/lib/siphash.c
+@@ -49,6 +49,7 @@
+ SIPROUND; \
+ return (v0 ^ v1) ^ (v2 ^ v3);
+
++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key)
+ {
+ const u8 *end = data + len - (len % sizeof(u64));
+@@ -80,8 +81,8 @@ u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key)
+ POSTAMBLE
+ }
+ EXPORT_SYMBOL(__siphash_aligned);
++#endif
+
+-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key)
+ {
+ const u8 *end = data + len - (len % sizeof(u64));
+@@ -113,7 +114,6 @@ u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key)
+ POSTAMBLE
+ }
+ EXPORT_SYMBOL(__siphash_unaligned);
+-#endif
+
+ /**
+ * siphash_1u64 - compute 64-bit siphash PRF value of a u64
+@@ -250,6 +250,7 @@ EXPORT_SYMBOL(siphash_3u32);
+ HSIPROUND; \
+ return (v0 ^ v1) ^ (v2 ^ v3);
+
++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key)
+ {
+ const u8 *end = data + len - (len % sizeof(u64));
+@@ -280,8 +281,8 @@ u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key)
+ HPOSTAMBLE
+ }
+ EXPORT_SYMBOL(__hsiphash_aligned);
++#endif
+
+-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ u32 __hsiphash_unaligned(const void *data, size_t len,
+ const hsiphash_key_t *key)
+ {
+@@ -313,7 +314,6 @@ u32 __hsiphash_unaligned(const void *data, size_t len,
+ HPOSTAMBLE
+ }
+ EXPORT_SYMBOL(__hsiphash_unaligned);
+-#endif
+
+ /**
+ * hsiphash_1u32 - compute 64-bit hsiphash PRF value of a u32
+@@ -418,6 +418,7 @@ EXPORT_SYMBOL(hsiphash_4u32);
+ HSIPROUND; \
+ return v1 ^ v3;
+
++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key)
+ {
+ const u8 *end = data + len - (len % sizeof(u32));
+@@ -438,8 +439,8 @@ u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key)
+ HPOSTAMBLE
+ }
+ EXPORT_SYMBOL(__hsiphash_aligned);
++#endif
+
+-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+ u32 __hsiphash_unaligned(const void *data, size_t len,
+ const hsiphash_key_t *key)
+ {
+@@ -461,7 +462,6 @@ u32 __hsiphash_unaligned(const void *data, size_t len,
+ HPOSTAMBLE
+ }
+ EXPORT_SYMBOL(__hsiphash_unaligned);
+-#endif
+
+ /**
+ * hsiphash_1u32 - compute 32-bit hsiphash PRF value of a u32
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 2519a90a14827..42f6ff8b9703c 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3831,7 +3831,10 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev)
+ if (dev->flags & IFF_UP) {
+ int cpu = smp_processor_id(); /* ok because BHs are off */
+
+- if (txq->xmit_lock_owner != cpu) {
++ /* Other cpus might concurrently change txq->xmit_lock_owner
++ * to -1 or to their cpu id, but not to our id.
++ */
++ if (READ_ONCE(txq->xmit_lock_owner) != cpu) {
+ if (dev_xmit_recursion())
+ goto recursion_alert;
+
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index 12a2cea9d606a..e2ab8cdb71347 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -2354,7 +2354,7 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name,
+ free:
+ kfree(t);
+ out:
+- return -ENOBUFS;
++ return -ENOMEM;
+ }
+
+ static void __devinet_sysctl_unregister(struct net *net,
+diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
+index 7623d9aec6364..ea1745cb93edb 100644
+--- a/net/mpls/af_mpls.c
++++ b/net/mpls/af_mpls.c
+@@ -1438,22 +1438,52 @@ static void mpls_dev_destroy_rcu(struct rcu_head *head)
+ kfree(mdev);
+ }
+
+-static void mpls_ifdown(struct net_device *dev, int event)
++static int mpls_ifdown(struct net_device *dev, int event)
+ {
+ struct mpls_route __rcu **platform_label;
+ struct net *net = dev_net(dev);
+- u8 alive, deleted;
+ unsigned index;
+
+ platform_label = rtnl_dereference(net->mpls.platform_label);
+ for (index = 0; index < net->mpls.platform_labels; index++) {
+ struct mpls_route *rt = rtnl_dereference(platform_label[index]);
++ bool nh_del = false;
++ u8 alive = 0;
+
+ if (!rt)
+ continue;
+
+- alive = 0;
+- deleted = 0;
++ if (event == NETDEV_UNREGISTER) {
++ u8 deleted = 0;
++
++ for_nexthops(rt) {
++ struct net_device *nh_dev =
++ rtnl_dereference(nh->nh_dev);
++
++ if (!nh_dev || nh_dev == dev)
++ deleted++;
++ if (nh_dev == dev)
++ nh_del = true;
++ } endfor_nexthops(rt);
++
++ /* if there are no more nexthops, delete the route */
++ if (deleted == rt->rt_nhn) {
++ mpls_route_update(net, index, NULL, NULL);
++ continue;
++ }
++
++ if (nh_del) {
++ size_t size = sizeof(*rt) + rt->rt_nhn *
++ rt->rt_nh_size;
++ struct mpls_route *orig = rt;
++
++ rt = kmalloc(size, GFP_KERNEL);
++ if (!rt)
++ return -ENOMEM;
++ memcpy(rt, orig, size);
++ }
++ }
++
+ change_nexthops(rt) {
+ unsigned int nh_flags = nh->nh_flags;
+
+@@ -1477,16 +1507,15 @@ static void mpls_ifdown(struct net_device *dev, int event)
+ next:
+ if (!(nh_flags & (RTNH_F_DEAD | RTNH_F_LINKDOWN)))
+ alive++;
+- if (!rtnl_dereference(nh->nh_dev))
+- deleted++;
+ } endfor_nexthops(rt);
+
+ WRITE_ONCE(rt->rt_nhn_alive, alive);
+
+- /* if there are no more nexthops, delete the route */
+- if (event == NETDEV_UNREGISTER && deleted == rt->rt_nhn)
+- mpls_route_update(net, index, NULL, NULL);
++ if (nh_del)
++ mpls_route_update(net, index, rt, NULL);
+ }
++
++ return 0;
+ }
+
+ static void mpls_ifup(struct net_device *dev, unsigned int flags)
+@@ -1554,8 +1583,12 @@ static int mpls_dev_notify(struct notifier_block *this, unsigned long event,
+ return NOTIFY_OK;
+
+ switch (event) {
++ int err;
++
+ case NETDEV_DOWN:
+- mpls_ifdown(dev, event);
++ err = mpls_ifdown(dev, event);
++ if (err)
++ return notifier_from_errno(err);
+ break;
+ case NETDEV_UP:
+ flags = dev_get_flags(dev);
+@@ -1566,13 +1599,18 @@ static int mpls_dev_notify(struct notifier_block *this, unsigned long event,
+ break;
+ case NETDEV_CHANGE:
+ flags = dev_get_flags(dev);
+- if (flags & (IFF_RUNNING | IFF_LOWER_UP))
++ if (flags & (IFF_RUNNING | IFF_LOWER_UP)) {
+ mpls_ifup(dev, RTNH_F_DEAD | RTNH_F_LINKDOWN);
+- else
+- mpls_ifdown(dev, event);
++ } else {
++ err = mpls_ifdown(dev, event);
++ if (err)
++ return notifier_from_errno(err);
++ }
+ break;
+ case NETDEV_UNREGISTER:
+- mpls_ifdown(dev, event);
++ err = mpls_ifdown(dev, event);
++ if (err)
++ return notifier_from_errno(err);
+ mdev = mpls_dev_get(dev);
+ if (mdev) {
+ mpls_dev_sysctl_unregister(dev, mdev);
+@@ -1583,8 +1621,6 @@ static int mpls_dev_notify(struct notifier_block *this, unsigned long event,
+ case NETDEV_CHANGENAME:
+ mdev = mpls_dev_get(dev);
+ if (mdev) {
+- int err;
+-
+ mpls_dev_sysctl_unregister(dev, mdev);
+ err = mpls_dev_sysctl_register(dev, mdev);
+ if (err)
+diff --git a/net/rds/tcp.c b/net/rds/tcp.c
+index d0bce439198fc..d4e6466d3989a 100644
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -502,7 +502,7 @@ void rds_tcp_tune(struct socket *sock)
+ sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
+ }
+ if (rtn->rcvbuf_size > 0) {
+- sk->sk_sndbuf = rtn->rcvbuf_size;
++ sk->sk_rcvbuf = rtn->rcvbuf_size;
+ sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
+ }
+ release_sock(sk);
+diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
+index b91b090217cdb..d0a1ebecc6fbb 100644
+--- a/net/rxrpc/peer_object.c
++++ b/net/rxrpc/peer_object.c
+@@ -299,6 +299,12 @@ static struct rxrpc_peer *rxrpc_create_peer(struct rxrpc_sock *rx,
+ return peer;
+ }
+
++static void rxrpc_free_peer(struct rxrpc_peer *peer)
++{
++ rxrpc_put_local(peer->local);
++ kfree_rcu(peer, rcu);
++}
++
+ /*
+ * Set up a new incoming peer. There shouldn't be any other matching peers
+ * since we've already done a search in the list from the non-reentrant context
+@@ -365,7 +371,7 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_sock *rx,
+ spin_unlock_bh(&rxnet->peer_hash_lock);
+
+ if (peer)
+- kfree(candidate);
++ rxrpc_free_peer(candidate);
+ else
+ peer = candidate;
+ }
+@@ -420,8 +426,7 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer)
+ list_del_init(&peer->keepalive_link);
+ spin_unlock_bh(&rxnet->peer_hash_lock);
+
+- rxrpc_put_local(peer->local);
+- kfree_rcu(peer, rcu);
++ rxrpc_free_peer(peer);
+ }
+
+ /*
+@@ -457,8 +462,7 @@ void rxrpc_put_peer_locked(struct rxrpc_peer *peer)
+ if (n == 0) {
+ hash_del_rcu(&peer->hash_link);
+ list_del_init(&peer->keepalive_link);
+- rxrpc_put_local(peer->local);
+- kfree_rcu(peer, rcu);
++ rxrpc_free_peer(peer);
+ }
+ }
+
+diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
+index e25c023582f9e..092696d738c00 100644
+--- a/net/smc/smc_close.c
++++ b/net/smc/smc_close.c
+@@ -167,6 +167,7 @@ int smc_close_active(struct smc_sock *smc)
+ int old_state;
+ long timeout;
+ int rc = 0;
++ int rc1 = 0;
+
+ timeout = current->flags & PF_EXITING ?
+ 0 : sock_flag(sk, SOCK_LINGER) ?
+@@ -206,8 +207,11 @@ again:
+ /* actively shutdown clcsock before peer close it,
+ * prevent peer from entering TIME_WAIT state.
+ */
+- if (smc->clcsock && smc->clcsock->sk)
+- rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);
++ if (smc->clcsock && smc->clcsock->sk) {
++ rc1 = kernel_sock_shutdown(smc->clcsock,
++ SHUT_RDWR);
++ rc = rc ? rc : rc1;
++ }
+ } else {
+ /* peer event has changed the state */
+ goto again;
+diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
+index fe3dfaa64a916..4afb63cea41b9 100644
+--- a/tools/perf/ui/hist.c
++++ b/tools/perf/ui/hist.c
+@@ -468,6 +468,18 @@ struct perf_hpp_list perf_hpp_list = {
+ #undef __HPP_SORT_ACC_FN
+ #undef __HPP_SORT_RAW_FN
+
++static void fmt_free(struct perf_hpp_fmt *fmt)
++{
++ /*
++ * At this point fmt should be completely
++ * unhooked, if not it's a bug.
++ */
++ BUG_ON(!list_empty(&fmt->list));
++ BUG_ON(!list_empty(&fmt->sort_list));
++
++ if (fmt->free)
++ fmt->free(fmt);
++}
+
+ void perf_hpp__init(void)
+ {
+@@ -531,9 +543,10 @@ void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
+ list_add(&format->sort_list, &list->sorts);
+ }
+
+-void perf_hpp__column_unregister(struct perf_hpp_fmt *format)
++static void perf_hpp__column_unregister(struct perf_hpp_fmt *format)
+ {
+ list_del_init(&format->list);
++ fmt_free(format);
+ }
+
+ void perf_hpp__cancel_cumulate(void)
+@@ -605,19 +618,6 @@ next:
+ }
+
+
+-static void fmt_free(struct perf_hpp_fmt *fmt)
+-{
+- /*
+- * At this point fmt should be completely
+- * unhooked, if not it's a bug.
+- */
+- BUG_ON(!list_empty(&fmt->list));
+- BUG_ON(!list_empty(&fmt->sort_list));
+-
+- if (fmt->free)
+- fmt->free(fmt);
+-}
+-
+ void perf_hpp__reset_output_field(struct perf_hpp_list *list)
+ {
+ struct perf_hpp_fmt *fmt, *tmp;
+diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
+index 7173e1f410930..899c1ca5e7dce 100644
+--- a/tools/perf/util/hist.h
++++ b/tools/perf/util/hist.h
+@@ -346,7 +346,6 @@ enum {
+ };
+
+ void perf_hpp__init(void);
+-void perf_hpp__column_unregister(struct perf_hpp_fmt *format);
+ void perf_hpp__cancel_cumulate(void);
+ void perf_hpp__setup_output_field(struct perf_hpp_list *list);
+ void perf_hpp__reset_output_field(struct perf_hpp_list *list);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-12-14 10:36 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-12-14 10:36 UTC (permalink / raw
To: gentoo-commits
commit: b0eae022788b5cde032c830a0ca7bbbc96f45e2f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 14 10:35:49 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Dec 14 10:35:49 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b0eae022
Linux patch 4.19.221
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1220_linux-4.19.221.patch | 3285 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3289 insertions(+)
diff --git a/0000_README b/0000_README
index ec86fab5..03cf027a 100644
--- a/0000_README
+++ b/0000_README
@@ -919,6 +919,10 @@ Patch: 1219_linux-4.19.220.patch
From: https://www.kernel.org
Desc: Linux 4.19.220
+Patch: 1220_linux-4.19.221.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.221
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1220_linux-4.19.221.patch b/1220_linux-4.19.221.patch
new file mode 100644
index 00000000..545200ee
--- /dev/null
+++ b/1220_linux-4.19.221.patch
@@ -0,0 +1,3285 @@
+diff --git a/Makefile b/Makefile
+index f243688468d53..c0676abcf60ff 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 220
++SUBLEVEL = 221
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/block/ioprio.c b/block/ioprio.c
+index f9821080c92cc..f0ee9cc33d17b 100644
+--- a/block/ioprio.c
++++ b/block/ioprio.c
+@@ -206,6 +206,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
+ pgrp = task_pgrp(current);
+ else
+ pgrp = find_vpid(who);
++ read_lock(&tasklist_lock);
+ do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
+ tmpio = get_task_ioprio(p);
+ if (tmpio < 0)
+@@ -215,6 +216,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who)
+ else
+ ret = ioprio_best(ret, tmpio);
+ } while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
++ read_unlock(&tasklist_lock);
++
+ break;
+ case IOPRIO_WHO_USER:
+ uid = make_kuid(current_user_ns(), who);
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 9229c5c9ad473..35c13be4adc60 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -4416,23 +4416,20 @@ static int binder_thread_release(struct binder_proc *proc,
+ }
+
+ /*
+- * If this thread used poll, make sure we remove the waitqueue
+- * from any epoll data structures holding it with POLLFREE.
+- * waitqueue_active() is safe to use here because we're holding
+- * the inner lock.
++ * If this thread used poll, make sure we remove the waitqueue from any
++ * poll data structures holding it.
+ */
+- if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&
+- waitqueue_active(&thread->wait)) {
+- wake_up_poll(&thread->wait, EPOLLHUP | POLLFREE);
+- }
++ if (thread->looper & BINDER_LOOPER_STATE_POLL)
++ wake_up_pollfree(&thread->wait);
+
+ binder_inner_proc_unlock(thread->proc);
+
+ /*
+- * This is needed to avoid races between wake_up_poll() above and
+- * and ep_remove_waitqueue() called for other reasons (eg the epoll file
+- * descriptor being closed); ep_remove_waitqueue() holds an RCU read
+- * lock, so we can be sure it's done after calling synchronize_rcu().
++ * This is needed to avoid races between wake_up_pollfree() above and
++ * someone else removing the last entry from the queue for other reasons
++ * (e.g. ep_remove_wait_queue() being called due to an epoll file
++ * descriptor being closed). Such other users hold an RCU read lock, so
++ * we can be sure they're done after we call synchronize_rcu().
+ */
+ if (thread->looper & BINDER_LOOPER_STATE_POLL)
+ synchronize_rcu();
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 766ebab2f0116..46eacba2613b8 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4453,6 +4453,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "VRFDFC22048UCHC-TE*", NULL, ATA_HORKAGE_NODMA },
+ /* Odd clown on sil3726/4726 PMPs */
+ { "Config Disk", NULL, ATA_HORKAGE_DISABLE },
++ /* Similar story with ASMedia 1092 */
++ { "ASMT109x- Config", NULL, ATA_HORKAGE_DISABLE },
+
+ /* Weird ATAPI devices */
+ { "TORiSAN DVD-ROM DRD-N216", NULL, ATA_HORKAGE_MAX_SEC_128 },
+diff --git a/drivers/clk/qcom/clk-regmap-mux.c b/drivers/clk/qcom/clk-regmap-mux.c
+index 0f3a1bda3e91a..6ce0a11565e5d 100644
+--- a/drivers/clk/qcom/clk-regmap-mux.c
++++ b/drivers/clk/qcom/clk-regmap-mux.c
+@@ -36,7 +36,7 @@ static u8 mux_get_parent(struct clk_hw *hw)
+ val &= mask;
+
+ if (mux->parent_map)
+- return qcom_find_src_index(hw, mux->parent_map, val);
++ return qcom_find_cfg_index(hw, mux->parent_map, val);
+
+ return val;
+ }
+diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c
+index bfb6d6065a90c..e7550e02e4d81 100644
+--- a/drivers/clk/qcom/common.c
++++ b/drivers/clk/qcom/common.c
+@@ -69,6 +69,18 @@ int qcom_find_src_index(struct clk_hw *hw, const struct parent_map *map, u8 src)
+ }
+ EXPORT_SYMBOL_GPL(qcom_find_src_index);
+
++int qcom_find_cfg_index(struct clk_hw *hw, const struct parent_map *map, u8 cfg)
++{
++ int i, num_parents = clk_hw_get_num_parents(hw);
++
++ for (i = 0; i < num_parents; i++)
++ if (cfg == map[i].cfg)
++ return i;
++
++ return -ENOENT;
++}
++EXPORT_SYMBOL_GPL(qcom_find_cfg_index);
++
+ struct regmap *
+ qcom_cc_map(struct platform_device *pdev, const struct qcom_cc_desc *desc)
+ {
+diff --git a/drivers/clk/qcom/common.h b/drivers/clk/qcom/common.h
+index 4aa33ee70bae1..32c916be3ab19 100644
+--- a/drivers/clk/qcom/common.h
++++ b/drivers/clk/qcom/common.h
+@@ -47,6 +47,8 @@ extern void
+ qcom_pll_set_fsm_mode(struct regmap *m, u32 reg, u8 bias_count, u8 lock_count);
+ extern int qcom_find_src_index(struct clk_hw *hw, const struct parent_map *map,
+ u8 src);
++extern int qcom_find_cfg_index(struct clk_hw *hw, const struct parent_map *map,
++ u8 cfg);
+
+ extern int qcom_cc_register_board_clk(struct device *dev, const char *path,
+ const char *name, unsigned long rate);
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 61e1953ff9219..98e91e14cefd3 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -191,14 +191,14 @@ config HID_CHERRY
+
+ config HID_CHICONY
+ tristate "Chicony devices"
+- depends on HID
++ depends on USB_HID
+ default !EXPERT
+ ---help---
+ Support for Chicony Tactical pad and special keys on Chicony keyboards.
+
+ config HID_CORSAIR
+ tristate "Corsair devices"
+- depends on HID && USB && LEDS_CLASS
++ depends on USB_HID && LEDS_CLASS
+ ---help---
+ Support for Corsair devices that are not fully compliant with the
+ HID standard.
+@@ -219,7 +219,7 @@ config HID_COUGAR
+
+ config HID_PRODIKEYS
+ tristate "Prodikeys PC-MIDI Keyboard support"
+- depends on HID && SND
++ depends on USB_HID && SND
+ select SND_RAWMIDI
+ ---help---
+ Support for Prodikeys PC-MIDI Keyboard device support.
+@@ -484,7 +484,7 @@ config HID_LENOVO
+
+ config HID_LOGITECH
+ tristate "Logitech devices"
+- depends on HID
++ depends on USB_HID
+ default !EXPERT
+ ---help---
+ Support for Logitech devices that are not fully compliant with HID standard.
+@@ -822,7 +822,7 @@ config HID_SAITEK
+
+ config HID_SAMSUNG
+ tristate "Samsung InfraRed remote control or keyboards"
+- depends on HID
++ depends on USB_HID
+ ---help---
+ Support for Samsung InfraRed remote control or keyboards.
+
+diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
+index 88a5672f42cd8..800b2364e29ea 100644
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -622,7 +622,7 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ if (drvdata->quirks & QUIRK_IS_MULTITOUCH)
+ drvdata->tp = &asus_i2c_tp;
+
+- if (drvdata->quirks & QUIRK_T100_KEYBOARD) {
++ if ((drvdata->quirks & QUIRK_T100_KEYBOARD) && hid_is_usb(hdev)) {
+ struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+
+ if (intf->altsetting->desc.bInterfaceNumber == T100_TPAD_INTF) {
+diff --git a/drivers/hid/hid-chicony.c b/drivers/hid/hid-chicony.c
+index 397a789a41be9..218f0e090f638 100644
+--- a/drivers/hid/hid-chicony.c
++++ b/drivers/hid/hid-chicony.c
+@@ -61,8 +61,12 @@ static int ch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ static __u8 *ch_switch12_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+-
++ struct usb_interface *intf;
++
++ if (!hid_is_usb(hdev))
++ return rdesc;
++
++ intf = to_usb_interface(hdev->dev.parent);
+ if (intf->cur_altsetting->desc.bInterfaceNumber == 1) {
+ /* Change usage maximum and logical maximum from 0x7fff to
+ * 0x2fff, so they don't exceed HID_MAX_USAGES */
+diff --git a/drivers/hid/hid-corsair.c b/drivers/hid/hid-corsair.c
+index ec9e060ec46cc..6ede03c9550d3 100644
+--- a/drivers/hid/hid-corsair.c
++++ b/drivers/hid/hid-corsair.c
+@@ -556,7 +556,12 @@ static int corsair_probe(struct hid_device *dev, const struct hid_device_id *id)
+ int ret;
+ unsigned long quirks = id->driver_data;
+ struct corsair_drvdata *drvdata;
+- struct usb_interface *usbif = to_usb_interface(dev->dev.parent);
++ struct usb_interface *usbif;
++
++ if (!hid_is_usb(dev))
++ return -EINVAL;
++
++ usbif = to_usb_interface(dev->dev.parent);
+
+ drvdata = devm_kzalloc(&dev->dev, sizeof(struct corsair_drvdata),
+ GFP_KERNEL);
+diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c
+index 6346282e0ff05..7139227edb287 100644
+--- a/drivers/hid/hid-elan.c
++++ b/drivers/hid/hid-elan.c
+@@ -54,7 +54,7 @@ struct elan_drvdata {
+
+ static int is_not_elan_touchpad(struct hid_device *hdev)
+ {
+- if (hdev->bus == BUS_USB) {
++ if (hid_is_usb(hdev)) {
+ struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+
+ return (intf->altsetting->desc.bInterfaceNumber !=
+diff --git a/drivers/hid/hid-elo.c b/drivers/hid/hid-elo.c
+index 5eea6fe0d7bd8..c3ecac13e6203 100644
+--- a/drivers/hid/hid-elo.c
++++ b/drivers/hid/hid-elo.c
+@@ -230,6 +230,9 @@ static int elo_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ struct elo_priv *priv;
+ int ret;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c
+index 3e58d4c3cf2c0..51a827470157b 100644
+--- a/drivers/hid/hid-google-hammer.c
++++ b/drivers/hid/hid-google-hammer.c
+@@ -120,6 +120,8 @@ static int hammer_input_configured(struct hid_device *hdev,
+ static const struct hid_device_id hammer_devices[] = {
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_DON) },
++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_EEL) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_HAMMER) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c
+index ab9da597106fa..2f8eb66397444 100644
+--- a/drivers/hid/hid-holtek-kbd.c
++++ b/drivers/hid/hid-holtek-kbd.c
+@@ -143,12 +143,17 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
+ static int holtek_kbd_probe(struct hid_device *hdev,
+ const struct hid_device_id *id)
+ {
+- struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+- int ret = hid_parse(hdev);
++ struct usb_interface *intf;
++ int ret;
++
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
+
++ ret = hid_parse(hdev);
+ if (!ret)
+ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
+
++ intf = to_usb_interface(hdev->dev.parent);
+ if (!ret && intf->cur_altsetting->desc.bInterfaceNumber == 1) {
+ struct hid_input *hidinput;
+ list_for_each_entry(hidinput, &hdev->inputs, list) {
+diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c
+index 78b3a0c767751..27c08ddab0e1a 100644
+--- a/drivers/hid/hid-holtek-mouse.c
++++ b/drivers/hid/hid-holtek-mouse.c
+@@ -65,6 +65,14 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ return rdesc;
+ }
+
++static int holtek_mouse_probe(struct hid_device *hdev,
++ const struct hid_device_id *id)
++{
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++ return 0;
++}
++
+ static const struct hid_device_id holtek_mouse_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
+ USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) },
+@@ -86,6 +94,7 @@ static struct hid_driver holtek_mouse_driver = {
+ .name = "holtek_mouse",
+ .id_table = holtek_mouse_devices,
+ .report_fixup = holtek_mouse_report_fixup,
++ .probe = holtek_mouse_probe,
+ };
+
+ module_hid_driver(holtek_mouse_driver);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index ee5dce862a215..8d4153c73f5cf 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -479,6 +479,7 @@
+ #define USB_DEVICE_ID_GOOGLE_MAGNEMITE 0x503d
+ #define USB_DEVICE_ID_GOOGLE_MOONBALL 0x5044
+ #define USB_DEVICE_ID_GOOGLE_DON 0x5050
++#define USB_DEVICE_ID_GOOGLE_EEL 0x5057
+
+ #define USB_VENDOR_ID_GOTOP 0x08f2
+ #define USB_DEVICE_ID_SUPER_Q2 0x007f
+diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
+index 17d6123f7930f..ea4e10070851a 100644
+--- a/drivers/hid/hid-lg.c
++++ b/drivers/hid/hid-lg.c
+@@ -714,12 +714,18 @@ static int lg_raw_event(struct hid_device *hdev, struct hid_report *report,
+
+ static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ {
+- struct usb_interface *iface = to_usb_interface(hdev->dev.parent);
+- __u8 iface_num = iface->cur_altsetting->desc.bInterfaceNumber;
++ struct usb_interface *iface;
++ __u8 iface_num;
+ unsigned int connect_mask = HID_CONNECT_DEFAULT;
+ struct lg_drv_data *drv_data;
+ int ret;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
++ iface = to_usb_interface(hdev->dev.parent);
++ iface_num = iface->cur_altsetting->desc.bInterfaceNumber;
++
+ /* G29 only work with the 1st interface */
+ if ((hdev->product == USB_DEVICE_ID_LOGITECH_G29_WHEEL) &&
+ (iface_num != 0)) {
+diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c
+index d3773251b3745..efc995543aa11 100644
+--- a/drivers/hid/hid-prodikeys.c
++++ b/drivers/hid/hid-prodikeys.c
+@@ -802,12 +802,18 @@ static int pk_raw_event(struct hid_device *hdev, struct hid_report *report,
+ static int pk_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ {
+ int ret;
+- struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+- unsigned short ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
++ struct usb_interface *intf;
++ unsigned short ifnum;
+ unsigned long quirks = id->driver_data;
+ struct pk_device *pk;
+ struct pcmidi_snd *pm = NULL;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
++ intf = to_usb_interface(hdev->dev.parent);
++ ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
++
+ pk = kzalloc(sizeof(*pk), GFP_KERNEL);
+ if (pk == NULL) {
+ hid_err(hdev, "can't alloc descriptor\n");
+diff --git a/drivers/hid/hid-roccat-arvo.c b/drivers/hid/hid-roccat-arvo.c
+index 329c5d1270f94..fb545a11214f0 100644
+--- a/drivers/hid/hid-roccat-arvo.c
++++ b/drivers/hid/hid-roccat-arvo.c
+@@ -347,6 +347,9 @@ static int arvo_probe(struct hid_device *hdev,
+ {
+ int retval;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ retval = hid_parse(hdev);
+ if (retval) {
+ hid_err(hdev, "parse failed\n");
+diff --git a/drivers/hid/hid-roccat-isku.c b/drivers/hid/hid-roccat-isku.c
+index 02db537f8f3ea..c07a7ea8a6873 100644
+--- a/drivers/hid/hid-roccat-isku.c
++++ b/drivers/hid/hid-roccat-isku.c
+@@ -327,6 +327,9 @@ static int isku_probe(struct hid_device *hdev,
+ {
+ int retval;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ retval = hid_parse(hdev);
+ if (retval) {
+ hid_err(hdev, "parse failed\n");
+diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
+index 9be8c31f613fd..ef978586ff2f5 100644
+--- a/drivers/hid/hid-roccat-kone.c
++++ b/drivers/hid/hid-roccat-kone.c
+@@ -752,6 +752,9 @@ static int kone_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ {
+ int retval;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ retval = hid_parse(hdev);
+ if (retval) {
+ hid_err(hdev, "parse failed\n");
+diff --git a/drivers/hid/hid-roccat-koneplus.c b/drivers/hid/hid-roccat-koneplus.c
+index 09e8fc72aa1d4..b63de4c5b5dd3 100644
+--- a/drivers/hid/hid-roccat-koneplus.c
++++ b/drivers/hid/hid-roccat-koneplus.c
+@@ -434,6 +434,9 @@ static int koneplus_probe(struct hid_device *hdev,
+ {
+ int retval;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ retval = hid_parse(hdev);
+ if (retval) {
+ hid_err(hdev, "parse failed\n");
+diff --git a/drivers/hid/hid-roccat-konepure.c b/drivers/hid/hid-roccat-konepure.c
+index 07de2f9014c67..ef9508822e5f0 100644
+--- a/drivers/hid/hid-roccat-konepure.c
++++ b/drivers/hid/hid-roccat-konepure.c
+@@ -136,6 +136,9 @@ static int konepure_probe(struct hid_device *hdev,
+ {
+ int retval;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ retval = hid_parse(hdev);
+ if (retval) {
+ hid_err(hdev, "parse failed\n");
+diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
+index 317c9c2c0a7ce..6256c211398a1 100644
+--- a/drivers/hid/hid-roccat-kovaplus.c
++++ b/drivers/hid/hid-roccat-kovaplus.c
+@@ -504,6 +504,9 @@ static int kovaplus_probe(struct hid_device *hdev,
+ {
+ int retval;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ retval = hid_parse(hdev);
+ if (retval) {
+ hid_err(hdev, "parse failed\n");
+diff --git a/drivers/hid/hid-roccat-lua.c b/drivers/hid/hid-roccat-lua.c
+index ac1a7313e2596..13ae2a7d176d3 100644
+--- a/drivers/hid/hid-roccat-lua.c
++++ b/drivers/hid/hid-roccat-lua.c
+@@ -163,6 +163,9 @@ static int lua_probe(struct hid_device *hdev,
+ {
+ int retval;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ retval = hid_parse(hdev);
+ if (retval) {
+ hid_err(hdev, "parse failed\n");
+diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
+index b30aa7b82bf87..027aa9d0ec1f2 100644
+--- a/drivers/hid/hid-roccat-pyra.c
++++ b/drivers/hid/hid-roccat-pyra.c
+@@ -452,6 +452,9 @@ static int pyra_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ {
+ int retval;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ retval = hid_parse(hdev);
+ if (retval) {
+ hid_err(hdev, "parse failed\n");
+diff --git a/drivers/hid/hid-roccat-ryos.c b/drivers/hid/hid-roccat-ryos.c
+index 47cc8f30ff6d4..fda4a396a12e8 100644
+--- a/drivers/hid/hid-roccat-ryos.c
++++ b/drivers/hid/hid-roccat-ryos.c
+@@ -144,6 +144,9 @@ static int ryos_probe(struct hid_device *hdev,
+ {
+ int retval;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ retval = hid_parse(hdev);
+ if (retval) {
+ hid_err(hdev, "parse failed\n");
+diff --git a/drivers/hid/hid-roccat-savu.c b/drivers/hid/hid-roccat-savu.c
+index 6dbf6e04dce75..0230fb54f08a5 100644
+--- a/drivers/hid/hid-roccat-savu.c
++++ b/drivers/hid/hid-roccat-savu.c
+@@ -116,6 +116,9 @@ static int savu_probe(struct hid_device *hdev,
+ {
+ int retval;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ retval = hid_parse(hdev);
+ if (retval) {
+ hid_err(hdev, "parse failed\n");
+diff --git a/drivers/hid/hid-samsung.c b/drivers/hid/hid-samsung.c
+index 7cbb067d4a9e3..89bb2260367f3 100644
+--- a/drivers/hid/hid-samsung.c
++++ b/drivers/hid/hid-samsung.c
+@@ -157,6 +157,9 @@ static int samsung_probe(struct hid_device *hdev,
+ int ret;
+ unsigned int cmask = HID_CONNECT_DEFAULT;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ ret = hid_parse(hdev);
+ if (ret) {
+ hid_err(hdev, "parse failed\n");
+diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c
+index 56b196d600411..e0bc31ee15769 100644
+--- a/drivers/hid/hid-uclogic.c
++++ b/drivers/hid/hid-uclogic.c
+@@ -791,6 +791,9 @@ static int uclogic_tablet_enable(struct hid_device *hdev)
+ __u8 *p;
+ s32 v;
+
++ if (!hid_is_usb(hdev))
++ return -EINVAL;
++
+ /*
+ * Read string descriptor containing tablet parameters. The specific
+ * string descriptor and data were discovered by sniffing the Windows
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 8006732b8f424..152570b49f3b2 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -697,7 +697,7 @@ static void wacom_retrieve_hid_descriptor(struct hid_device *hdev,
+ * Skip the query for this type and modify defaults based on
+ * interface number.
+ */
+- if (features->type == WIRELESS) {
++ if (features->type == WIRELESS && intf) {
+ if (intf->cur_altsetting->desc.bInterfaceNumber == 0)
+ features->device_type = WACOM_DEVICETYPE_WL_MONITOR;
+ else
+@@ -2188,7 +2188,7 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix)
+ if ((features->type == HID_GENERIC) && !strcmp("Wacom HID", features->name)) {
+ char *product_name = wacom->hdev->name;
+
+- if (hid_is_using_ll_driver(wacom->hdev, &usb_hid_driver)) {
++ if (hid_is_usb(wacom->hdev)) {
+ struct usb_interface *intf = to_usb_interface(wacom->hdev->dev.parent);
+ struct usb_device *dev = interface_to_usbdev(intf);
+ product_name = dev->product;
+@@ -2419,6 +2419,9 @@ static void wacom_wireless_work(struct work_struct *work)
+
+ wacom_destroy_battery(wacom);
+
++ if (!usbdev)
++ return;
++
+ /* Stylus interface */
+ hdev1 = usb_get_intfdata(usbdev->config->interface[1]);
+ wacom1 = hid_get_drvdata(hdev1);
+@@ -2698,8 +2701,6 @@ static void wacom_mode_change_work(struct work_struct *work)
+ static int wacom_probe(struct hid_device *hdev,
+ const struct hid_device_id *id)
+ {
+- struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+- struct usb_device *dev = interface_to_usbdev(intf);
+ struct wacom *wacom;
+ struct wacom_wac *wacom_wac;
+ struct wacom_features *features;
+@@ -2736,8 +2737,14 @@ static int wacom_probe(struct hid_device *hdev,
+ wacom_wac->hid_data.inputmode = -1;
+ wacom_wac->mode_report = -1;
+
+- wacom->usbdev = dev;
+- wacom->intf = intf;
++ if (hid_is_usb(hdev)) {
++ struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
++ struct usb_device *dev = interface_to_usbdev(intf);
++
++ wacom->usbdev = dev;
++ wacom->intf = intf;
++ }
++
+ mutex_init(&wacom->lock);
+ INIT_DELAYED_WORK(&wacom->init_work, wacom_init_work);
+ INIT_WORK(&wacom->wireless_work, wacom_wireless_work);
+diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
+index 0ca6f9de51923..52947561e446a 100644
+--- a/drivers/iio/accel/kxcjk-1013.c
++++ b/drivers/iio/accel/kxcjk-1013.c
+@@ -1423,8 +1423,7 @@ static int kxcjk1013_probe(struct i2c_client *client,
+ return 0;
+
+ err_buffer_cleanup:
+- if (data->dready_trig)
+- iio_triggered_buffer_cleanup(indio_dev);
++ iio_triggered_buffer_cleanup(indio_dev);
+ err_trigger_unregister:
+ if (data->dready_trig)
+ iio_trigger_unregister(data->dready_trig);
+@@ -1447,8 +1446,8 @@ static int kxcjk1013_remove(struct i2c_client *client)
+ pm_runtime_set_suspended(&client->dev);
+ pm_runtime_put_noidle(&client->dev);
+
++ iio_triggered_buffer_cleanup(indio_dev);
+ if (data->dready_trig) {
+- iio_triggered_buffer_cleanup(indio_dev);
+ iio_trigger_unregister(data->dready_trig);
+ iio_trigger_unregister(data->motion_trig);
+ }
+diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
+index f74cb2e082a67..6798800d4b165 100644
+--- a/drivers/iio/accel/kxsd9.c
++++ b/drivers/iio/accel/kxsd9.c
+@@ -227,14 +227,14 @@ static irqreturn_t kxsd9_trigger_handler(int irq, void *p)
+ hw_values.chan,
+ sizeof(hw_values.chan));
+ if (ret) {
+- dev_err(st->dev,
+- "error reading data\n");
+- return ret;
++ dev_err(st->dev, "error reading data: %d\n", ret);
++ goto out;
+ }
+
+ iio_push_to_buffers_with_timestamp(indio_dev,
+ &hw_values,
+ iio_get_time_ns(indio_dev));
++out:
+ iio_trigger_notify_done(indio_dev->trig);
+
+ return IRQ_HANDLED;
+diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
+index 15c254b4745cc..1ef75c94987bd 100644
+--- a/drivers/iio/accel/mma8452.c
++++ b/drivers/iio/accel/mma8452.c
+@@ -1470,7 +1470,7 @@ static int mma8452_trigger_setup(struct iio_dev *indio_dev)
+ if (ret)
+ return ret;
+
+- indio_dev->trig = trig;
++ indio_dev->trig = iio_trigger_get(trig);
+
+ return 0;
+ }
+diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
+index c485ff6f408bf..129c3adad4c05 100644
+--- a/drivers/iio/adc/at91-sama5d2_adc.c
++++ b/drivers/iio/adc/at91-sama5d2_adc.c
+@@ -1375,7 +1375,8 @@ static int at91_adc_read_info_raw(struct iio_dev *indio_dev,
+ *val = st->conversion_value;
+ ret = at91_adc_adjust_val_osr(st, val);
+ if (chan->scan_type.sign == 's')
+- *val = sign_extend32(*val, 11);
++ *val = sign_extend32(*val,
++ chan->scan_type.realbits - 1);
+ st->conversion_done = false;
+ }
+
+diff --git a/drivers/iio/adc/axp20x_adc.c b/drivers/iio/adc/axp20x_adc.c
+index 5be7892693536..5532a055f134f 100644
+--- a/drivers/iio/adc/axp20x_adc.c
++++ b/drivers/iio/adc/axp20x_adc.c
+@@ -254,19 +254,8 @@ static int axp22x_adc_raw(struct iio_dev *indio_dev,
+ struct iio_chan_spec const *chan, int *val)
+ {
+ struct axp20x_adc_iio *info = iio_priv(indio_dev);
+- int size;
+
+- /*
+- * N.B.: Unlike the Chinese datasheets tell, the charging current is
+- * stored on 12 bits, not 13 bits. Only discharging current is on 13
+- * bits.
+- */
+- if (chan->type == IIO_CURRENT && chan->channel == AXP22X_BATT_DISCHRG_I)
+- size = 13;
+- else
+- size = 12;
+-
+- *val = axp20x_read_variable_width(info->regmap, chan->address, size);
++ *val = axp20x_read_variable_width(info->regmap, chan->address, 12);
+ if (*val < 0)
+ return *val;
+
+@@ -389,9 +378,8 @@ static int axp22x_adc_scale(struct iio_chan_spec const *chan, int *val,
+ return IIO_VAL_INT_PLUS_MICRO;
+
+ case IIO_CURRENT:
+- *val = 0;
+- *val2 = 500000;
+- return IIO_VAL_INT_PLUS_MICRO;
++ *val = 1;
++ return IIO_VAL_INT;
+
+ case IIO_TEMP:
+ *val = 100;
+diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c
+index 4ab052d76d9f5..d8cfeec3945b0 100644
+--- a/drivers/iio/adc/dln2-adc.c
++++ b/drivers/iio/adc/dln2-adc.c
+@@ -251,7 +251,6 @@ static int dln2_adc_set_chan_period(struct dln2_adc *dln2,
+ static int dln2_adc_read(struct dln2_adc *dln2, unsigned int channel)
+ {
+ int ret, i;
+- struct iio_dev *indio_dev = platform_get_drvdata(dln2->pdev);
+ u16 conflict;
+ __le16 value;
+ int olen = sizeof(value);
+@@ -260,13 +259,9 @@ static int dln2_adc_read(struct dln2_adc *dln2, unsigned int channel)
+ .chan = channel,
+ };
+
+- ret = iio_device_claim_direct_mode(indio_dev);
+- if (ret < 0)
+- return ret;
+-
+ ret = dln2_adc_set_chan_enabled(dln2, channel, true);
+ if (ret < 0)
+- goto release_direct;
++ return ret;
+
+ ret = dln2_adc_set_port_enabled(dln2, true, &conflict);
+ if (ret < 0) {
+@@ -303,8 +298,6 @@ disable_port:
+ dln2_adc_set_port_enabled(dln2, false, NULL);
+ disable_chan:
+ dln2_adc_set_chan_enabled(dln2, channel, false);
+-release_direct:
+- iio_device_release_direct_mode(indio_dev);
+
+ return ret;
+ }
+@@ -340,10 +333,16 @@ static int dln2_adc_read_raw(struct iio_dev *indio_dev,
+
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
++ ret = iio_device_claim_direct_mode(indio_dev);
++ if (ret < 0)
++ return ret;
++
+ mutex_lock(&dln2->mutex);
+ ret = dln2_adc_read(dln2, chan->channel);
+ mutex_unlock(&dln2->mutex);
+
++ iio_device_release_direct_mode(indio_dev);
++
+ if (ret < 0)
+ return ret;
+
+@@ -669,7 +668,11 @@ static int dln2_adc_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+ iio_trigger_set_drvdata(dln2->trig, dln2);
+- devm_iio_trigger_register(dev, dln2->trig);
++ ret = devm_iio_trigger_register(dev, dln2->trig);
++ if (ret) {
++ dev_err(dev, "failed to register trigger: %d\n", ret);
++ return ret;
++ }
+ iio_trigger_set_immutable(indio_dev, dln2->trig);
+
+ ret = devm_iio_triggered_buffer_setup(dev, indio_dev, NULL,
+diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c
+index b080362a87669..56aac0a9b500b 100644
+--- a/drivers/iio/gyro/itg3200_buffer.c
++++ b/drivers/iio/gyro/itg3200_buffer.c
+@@ -64,9 +64,9 @@ static irqreturn_t itg3200_trigger_handler(int irq, void *p)
+
+ iio_push_to_buffers_with_timestamp(indio_dev, &scan, pf->timestamp);
+
++error_ret:
+ iio_trigger_notify_done(indio_dev->trig);
+
+-error_ret:
+ return IRQ_HANDLED;
+ }
+
+diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
+index ce66699c7fccb..49d76fa7f9076 100644
+--- a/drivers/iio/industrialio-trigger.c
++++ b/drivers/iio/industrialio-trigger.c
+@@ -549,7 +549,6 @@ static struct iio_trigger *viio_trigger_alloc(const char *fmt, va_list vargs)
+ irq_modify_status(trig->subirq_base + i,
+ IRQ_NOREQUEST | IRQ_NOAUTOEN, IRQ_NOPROBE);
+ }
+- get_device(&trig->dev);
+
+ return trig;
+
+diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
+index f3fb79c231be6..e9bc23d0afb49 100644
+--- a/drivers/iio/light/ltr501.c
++++ b/drivers/iio/light/ltr501.c
+@@ -1275,7 +1275,7 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p)
+ ret = regmap_bulk_read(data->regmap, LTR501_ALS_DATA1,
+ (u8 *)als_buf, sizeof(als_buf));
+ if (ret < 0)
+- return ret;
++ goto done;
+ if (test_bit(0, indio_dev->active_scan_mask))
+ scan.channels[j++] = le16_to_cpu(als_buf[1]);
+ if (test_bit(1, indio_dev->active_scan_mask))
+diff --git a/drivers/iio/light/stk3310.c b/drivers/iio/light/stk3310.c
+index 6e2a169da9508..4cfa0101b3f84 100644
+--- a/drivers/iio/light/stk3310.c
++++ b/drivers/iio/light/stk3310.c
+@@ -545,9 +545,8 @@ static irqreturn_t stk3310_irq_event_handler(int irq, void *private)
+ mutex_lock(&data->lock);
+ ret = regmap_field_read(data->reg_flag_nf, &dir);
+ if (ret < 0) {
+- dev_err(&data->client->dev, "register read failed\n");
+- mutex_unlock(&data->lock);
+- return ret;
++ dev_err(&data->client->dev, "register read failed: %d\n", ret);
++ goto out;
+ }
+ event = IIO_UNMOD_EVENT_CODE(IIO_PROXIMITY, 1,
+ IIO_EV_TYPE_THRESH,
+@@ -559,6 +558,7 @@ static irqreturn_t stk3310_irq_event_handler(int irq, void *private)
+ ret = regmap_field_write(data->reg_flag_psint, 0);
+ if (ret < 0)
+ dev_err(&data->client->dev, "failed to reset interrupts\n");
++out:
+ mutex_unlock(&data->lock);
+
+ return IRQ_HANDLED;
+diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c
+index 7722745e101f5..e7acb9421e53a 100644
+--- a/drivers/iio/trigger/stm32-timer-trigger.c
++++ b/drivers/iio/trigger/stm32-timer-trigger.c
+@@ -884,6 +884,6 @@ static struct platform_driver stm32_timer_trigger_driver = {
+ };
+ module_platform_driver(stm32_timer_trigger_driver);
+
+-MODULE_ALIAS("platform: stm32-timer-trigger");
++MODULE_ALIAS("platform:stm32-timer-trigger");
+ MODULE_DESCRIPTION("STMicroelectronics STM32 Timer Trigger driver");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
+index 368f4f08b6866..d9890ca1d70a9 100644
+--- a/drivers/infiniband/hw/hfi1/init.c
++++ b/drivers/infiniband/hw/hfi1/init.c
+@@ -1146,7 +1146,7 @@ void hfi1_free_ctxtdata(struct hfi1_devdata *dd, struct hfi1_ctxtdata *rcd)
+ rcd->egrbufs.rcvtids = NULL;
+
+ for (e = 0; e < rcd->egrbufs.alloced; e++) {
+- if (rcd->egrbufs.buffers[e].dma)
++ if (rcd->egrbufs.buffers[e].addr)
+ dma_free_coherent(&dd->pcidev->dev,
+ rcd->egrbufs.buffers[e].len,
+ rcd->egrbufs.buffers[e].addr,
+diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
+index c9bdc5221b82f..5849ac5a2ad3b 100644
+--- a/drivers/irqchip/irq-armada-370-xp.c
++++ b/drivers/irqchip/irq-armada-370-xp.c
+@@ -232,16 +232,12 @@ static int armada_370_xp_msi_alloc(struct irq_domain *domain, unsigned int virq,
+ int hwirq, i;
+
+ mutex_lock(&msi_used_lock);
++ hwirq = bitmap_find_free_region(msi_used, PCI_MSI_DOORBELL_NR,
++ order_base_2(nr_irqs));
++ mutex_unlock(&msi_used_lock);
+
+- hwirq = bitmap_find_next_zero_area(msi_used, PCI_MSI_DOORBELL_NR,
+- 0, nr_irqs, 0);
+- if (hwirq >= PCI_MSI_DOORBELL_NR) {
+- mutex_unlock(&msi_used_lock);
++ if (hwirq < 0)
+ return -ENOSPC;
+- }
+-
+- bitmap_set(msi_used, hwirq, nr_irqs);
+- mutex_unlock(&msi_used_lock);
+
+ for (i = 0; i < nr_irqs; i++) {
+ irq_domain_set_info(domain, virq + i, hwirq + i,
+@@ -250,7 +246,7 @@ static int armada_370_xp_msi_alloc(struct irq_domain *domain, unsigned int virq,
+ NULL, NULL);
+ }
+
+- return hwirq;
++ return 0;
+ }
+
+ static void armada_370_xp_msi_free(struct irq_domain *domain,
+@@ -259,7 +255,7 @@ static void armada_370_xp_msi_free(struct irq_domain *domain,
+ struct irq_data *d = irq_domain_get_irq_data(domain, virq);
+
+ mutex_lock(&msi_used_lock);
+- bitmap_clear(msi_used, d->hwirq, nr_irqs);
++ bitmap_release_region(msi_used, d->hwirq, order_base_2(nr_irqs));
+ mutex_unlock(&msi_used_lock);
+ }
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index b55dff1aa50b3..86334aef4bd05 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -581,7 +581,7 @@ static struct its_collection *its_build_invall_cmd(struct its_node *its,
+
+ its_fixup_cmd(cmd);
+
+- return NULL;
++ return desc->its_invall_cmd.col;
+ }
+
+ static struct its_vpe *its_build_vinvall_cmd(struct its_node *its,
+diff --git a/drivers/irqchip/irq-nvic.c b/drivers/irqchip/irq-nvic.c
+index b1777104fd9fe..9694529b709de 100644
+--- a/drivers/irqchip/irq-nvic.c
++++ b/drivers/irqchip/irq-nvic.c
+@@ -29,7 +29,7 @@
+
+ #define NVIC_ISER 0x000
+ #define NVIC_ICER 0x080
+-#define NVIC_IPR 0x300
++#define NVIC_IPR 0x400
+
+ #define NVIC_MAX_BANKS 16
+ /*
+diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c
+index a31bb1da44ec9..9692a71f53565 100644
+--- a/drivers/mtd/nand/raw/fsmc_nand.c
++++ b/drivers/mtd/nand/raw/fsmc_nand.c
+@@ -18,6 +18,7 @@
+
+ #include <linux/clk.h>
+ #include <linux/completion.h>
++#include <linux/delay.h>
+ #include <linux/dmaengine.h>
+ #include <linux/dma-direction.h>
+ #include <linux/dma-mapping.h>
+@@ -700,6 +701,9 @@ static int fsmc_exec_op(struct nand_chip *chip, const struct nand_operation *op,
+ instr->ctx.waitrdy.timeout_ms);
+ break;
+ }
++
++ if (instr->delay_ns)
++ ndelay(instr->delay_ns);
+ }
+
+ return ret;
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index 2ee046c813893..61ae622125c43 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -1530,14 +1530,14 @@ void bond_alb_monitor(struct work_struct *work)
+ struct slave *slave;
+
+ if (!bond_has_slaves(bond)) {
+- bond_info->tx_rebalance_counter = 0;
++ atomic_set(&bond_info->tx_rebalance_counter, 0);
+ bond_info->lp_counter = 0;
+ goto re_arm;
+ }
+
+ rcu_read_lock();
+
+- bond_info->tx_rebalance_counter++;
++ atomic_inc(&bond_info->tx_rebalance_counter);
+ bond_info->lp_counter++;
+
+ /* send learning packets */
+@@ -1559,7 +1559,7 @@ void bond_alb_monitor(struct work_struct *work)
+ }
+
+ /* rebalance tx traffic */
+- if (bond_info->tx_rebalance_counter >= BOND_TLB_REBALANCE_TICKS) {
++ if (atomic_read(&bond_info->tx_rebalance_counter) >= BOND_TLB_REBALANCE_TICKS) {
+ bond_for_each_slave_rcu(bond, slave, iter) {
+ tlb_clear_slave(bond, slave, 1);
+ if (slave == rcu_access_pointer(bond->curr_active_slave)) {
+@@ -1569,7 +1569,7 @@ void bond_alb_monitor(struct work_struct *work)
+ bond_info->unbalanced_load = 0;
+ }
+ }
+- bond_info->tx_rebalance_counter = 0;
++ atomic_set(&bond_info->tx_rebalance_counter, 0);
+ }
+
+ if (bond_info->rlb_enabled) {
+@@ -1639,7 +1639,8 @@ int bond_alb_init_slave(struct bonding *bond, struct slave *slave)
+ tlb_init_slave(slave);
+
+ /* order a rebalance ASAP */
+- bond->alb_info.tx_rebalance_counter = BOND_TLB_REBALANCE_TICKS;
++ atomic_set(&bond->alb_info.tx_rebalance_counter,
++ BOND_TLB_REBALANCE_TICKS);
+
+ if (bond->alb_info.rlb_enabled)
+ bond->alb_info.rlb_rebalance = 1;
+@@ -1676,7 +1677,8 @@ void bond_alb_handle_link_change(struct bonding *bond, struct slave *slave, char
+ rlb_clear_slave(bond, slave);
+ } else if (link == BOND_LINK_UP) {
+ /* order a rebalance ASAP */
+- bond_info->tx_rebalance_counter = BOND_TLB_REBALANCE_TICKS;
++ atomic_set(&bond_info->tx_rebalance_counter,
++ BOND_TLB_REBALANCE_TICKS);
+ if (bond->alb_info.rlb_enabled) {
+ bond->alb_info.rlb_rebalance = 1;
+ /* If the updelay module parameter is smaller than the
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index e87c3bb820817..f5f1367d40d5c 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -233,15 +233,15 @@ enum m_can_mram_cfg {
+
+ /* Interrupts for version 3.0.x */
+ #define IR_ERR_LEC_30X (IR_STE | IR_FOE | IR_ACKE | IR_BE | IR_CRCE)
+-#define IR_ERR_BUS_30X (IR_ERR_LEC_30X | IR_WDI | IR_ELO | IR_BEU | \
+- IR_BEC | IR_TOO | IR_MRAF | IR_TSW | IR_TEFL | \
+- IR_RF1L | IR_RF0L)
++#define IR_ERR_BUS_30X (IR_ERR_LEC_30X | IR_WDI | IR_BEU | IR_BEC | \
++ IR_TOO | IR_MRAF | IR_TSW | IR_TEFL | IR_RF1L | \
++ IR_RF0L)
+ #define IR_ERR_ALL_30X (IR_ERR_STATE | IR_ERR_BUS_30X)
+ /* Interrupts for version >= 3.1.x */
+ #define IR_ERR_LEC_31X (IR_PED | IR_PEA)
+-#define IR_ERR_BUS_31X (IR_ERR_LEC_31X | IR_WDI | IR_ELO | IR_BEU | \
+- IR_BEC | IR_TOO | IR_MRAF | IR_TSW | IR_TEFL | \
+- IR_RF1L | IR_RF0L)
++#define IR_ERR_BUS_31X (IR_ERR_LEC_31X | IR_WDI | IR_BEU | IR_BEC | \
++ IR_TOO | IR_MRAF | IR_TSW | IR_TEFL | IR_RF1L | \
++ IR_RF0L)
+ #define IR_ERR_ALL_31X (IR_ERR_STATE | IR_ERR_BUS_31X)
+
+ /* Interrupt Line Select (ILS) */
+@@ -769,8 +769,6 @@ static void m_can_handle_other_err(struct net_device *dev, u32 irqstatus)
+ {
+ if (irqstatus & IR_WDI)
+ netdev_err(dev, "Message RAM Watchdog event due to missing READY\n");
+- if (irqstatus & IR_ELO)
+- netdev_err(dev, "Error Logging Overflow\n");
+ if (irqstatus & IR_BEU)
+ netdev_err(dev, "Bit Error Uncorrected\n");
+ if (irqstatus & IR_BEC)
+diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c
+index c1317889d3d8d..ced11ea892698 100644
+--- a/drivers/net/can/pch_can.c
++++ b/drivers/net/can/pch_can.c
+@@ -703,11 +703,11 @@ static int pch_can_rx_normal(struct net_device *ndev, u32 obj_num, int quota)
+ cf->data[i + 1] = data_reg >> 8;
+ }
+
+- netif_receive_skb(skb);
+ rcv_pkts++;
+ stats->rx_packets++;
+ quota--;
+ stats->rx_bytes += cf->can_dlc;
++ netif_receive_skb(skb);
+
+ pch_fifo_thresh(priv, obj_num);
+ obj_num++;
+diff --git a/drivers/net/can/sja1000/ems_pcmcia.c b/drivers/net/can/sja1000/ems_pcmcia.c
+index 381de998d2f16..fef5c59c0f4ca 100644
+--- a/drivers/net/can/sja1000/ems_pcmcia.c
++++ b/drivers/net/can/sja1000/ems_pcmcia.c
+@@ -243,7 +243,12 @@ static int ems_pcmcia_add_card(struct pcmcia_device *pdev, unsigned long base)
+ free_sja1000dev(dev);
+ }
+
+- err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
++ if (!card->channels) {
++ err = -ENODEV;
++ goto failure_cleanup;
++ }
++
++ err = request_irq(pdev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
+ DRV_NAME, card);
+ if (!err)
+ return 0;
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+index 1b9957f12459a..8b5d1add899a6 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -28,10 +28,6 @@
+
+ #include "kvaser_usb.h"
+
+-/* Forward declaration */
+-static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_dev_cfg;
+-
+-#define CAN_USB_CLOCK 8000000
+ #define MAX_USBCAN_NET_DEVICES 2
+
+ /* Command header size */
+@@ -80,6 +76,12 @@ static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_dev_cfg;
+
+ #define CMD_LEAF_LOG_MESSAGE 106
+
++/* Leaf frequency options */
++#define KVASER_USB_LEAF_SWOPTION_FREQ_MASK 0x60
++#define KVASER_USB_LEAF_SWOPTION_FREQ_16_MHZ_CLK 0
++#define KVASER_USB_LEAF_SWOPTION_FREQ_32_MHZ_CLK BIT(5)
++#define KVASER_USB_LEAF_SWOPTION_FREQ_24_MHZ_CLK BIT(6)
++
+ /* error factors */
+ #define M16C_EF_ACKE BIT(0)
+ #define M16C_EF_CRCE BIT(1)
+@@ -340,6 +342,50 @@ struct kvaser_usb_err_summary {
+ };
+ };
+
++static const struct can_bittiming_const kvaser_usb_leaf_bittiming_const = {
++ .name = "kvaser_usb",
++ .tseg1_min = KVASER_USB_TSEG1_MIN,
++ .tseg1_max = KVASER_USB_TSEG1_MAX,
++ .tseg2_min = KVASER_USB_TSEG2_MIN,
++ .tseg2_max = KVASER_USB_TSEG2_MAX,
++ .sjw_max = KVASER_USB_SJW_MAX,
++ .brp_min = KVASER_USB_BRP_MIN,
++ .brp_max = KVASER_USB_BRP_MAX,
++ .brp_inc = KVASER_USB_BRP_INC,
++};
++
++static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_dev_cfg_8mhz = {
++ .clock = {
++ .freq = 8000000,
++ },
++ .timestamp_freq = 1,
++ .bittiming_const = &kvaser_usb_leaf_bittiming_const,
++};
++
++static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_dev_cfg_16mhz = {
++ .clock = {
++ .freq = 16000000,
++ },
++ .timestamp_freq = 1,
++ .bittiming_const = &kvaser_usb_leaf_bittiming_const,
++};
++
++static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_dev_cfg_24mhz = {
++ .clock = {
++ .freq = 24000000,
++ },
++ .timestamp_freq = 1,
++ .bittiming_const = &kvaser_usb_leaf_bittiming_const,
++};
++
++static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_dev_cfg_32mhz = {
++ .clock = {
++ .freq = 32000000,
++ },
++ .timestamp_freq = 1,
++ .bittiming_const = &kvaser_usb_leaf_bittiming_const,
++};
++
+ static void *
+ kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv,
+ const struct sk_buff *skb, int *frame_len,
+@@ -471,6 +517,27 @@ static int kvaser_usb_leaf_send_simple_cmd(const struct kvaser_usb *dev,
+ return rc;
+ }
+
++static void kvaser_usb_leaf_get_software_info_leaf(struct kvaser_usb *dev,
++ const struct leaf_cmd_softinfo *softinfo)
++{
++ u32 sw_options = le32_to_cpu(softinfo->sw_options);
++
++ dev->fw_version = le32_to_cpu(softinfo->fw_version);
++ dev->max_tx_urbs = le16_to_cpu(softinfo->max_outstanding_tx);
++
++ switch (sw_options & KVASER_USB_LEAF_SWOPTION_FREQ_MASK) {
++ case KVASER_USB_LEAF_SWOPTION_FREQ_16_MHZ_CLK:
++ dev->cfg = &kvaser_usb_leaf_dev_cfg_16mhz;
++ break;
++ case KVASER_USB_LEAF_SWOPTION_FREQ_24_MHZ_CLK:
++ dev->cfg = &kvaser_usb_leaf_dev_cfg_24mhz;
++ break;
++ case KVASER_USB_LEAF_SWOPTION_FREQ_32_MHZ_CLK:
++ dev->cfg = &kvaser_usb_leaf_dev_cfg_32mhz;
++ break;
++ }
++}
++
+ static int kvaser_usb_leaf_get_software_info_inner(struct kvaser_usb *dev)
+ {
+ struct kvaser_cmd cmd;
+@@ -486,14 +553,13 @@ static int kvaser_usb_leaf_get_software_info_inner(struct kvaser_usb *dev)
+
+ switch (dev->card_data.leaf.family) {
+ case KVASER_LEAF:
+- dev->fw_version = le32_to_cpu(cmd.u.leaf.softinfo.fw_version);
+- dev->max_tx_urbs =
+- le16_to_cpu(cmd.u.leaf.softinfo.max_outstanding_tx);
++ kvaser_usb_leaf_get_software_info_leaf(dev, &cmd.u.leaf.softinfo);
+ break;
+ case KVASER_USBCAN:
+ dev->fw_version = le32_to_cpu(cmd.u.usbcan.softinfo.fw_version);
+ dev->max_tx_urbs =
+ le16_to_cpu(cmd.u.usbcan.softinfo.max_outstanding_tx);
++ dev->cfg = &kvaser_usb_leaf_dev_cfg_8mhz;
+ break;
+ }
+
+@@ -1225,24 +1291,11 @@ static int kvaser_usb_leaf_init_card(struct kvaser_usb *dev)
+ {
+ struct kvaser_usb_dev_card_data *card_data = &dev->card_data;
+
+- dev->cfg = &kvaser_usb_leaf_dev_cfg;
+ card_data->ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
+
+ return 0;
+ }
+
+-static const struct can_bittiming_const kvaser_usb_leaf_bittiming_const = {
+- .name = "kvaser_usb",
+- .tseg1_min = KVASER_USB_TSEG1_MIN,
+- .tseg1_max = KVASER_USB_TSEG1_MAX,
+- .tseg2_min = KVASER_USB_TSEG2_MIN,
+- .tseg2_max = KVASER_USB_TSEG2_MAX,
+- .sjw_max = KVASER_USB_SJW_MAX,
+- .brp_min = KVASER_USB_BRP_MIN,
+- .brp_max = KVASER_USB_BRP_MAX,
+- .brp_inc = KVASER_USB_BRP_INC,
+-};
+-
+ static int kvaser_usb_leaf_set_bittiming(struct net_device *netdev)
+ {
+ struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
+@@ -1348,11 +1401,3 @@ const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops = {
+ .dev_read_bulk_callback = kvaser_usb_leaf_read_bulk_callback,
+ .dev_frame_to_cmd = kvaser_usb_leaf_frame_to_cmd,
+ };
+-
+-static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_dev_cfg = {
+- .clock = {
+- .freq = CAN_USB_CLOCK,
+- },
+- .timestamp_freq = 1,
+- .bittiming_const = &kvaser_usb_leaf_bittiming_const,
+-};
+diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
+index c3c1195021a2b..1b4dfd357383b 100644
+--- a/drivers/net/ethernet/altera/altera_tse_main.c
++++ b/drivers/net/ethernet/altera/altera_tse_main.c
+@@ -1445,16 +1445,19 @@ static int altera_tse_probe(struct platform_device *pdev)
+ priv->rxdescmem_busaddr = dma_res->start;
+
+ } else {
++ ret = -ENODEV;
+ goto err_free_netdev;
+ }
+
+- if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask)))
++ if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask))) {
+ dma_set_coherent_mask(priv->device,
+ DMA_BIT_MASK(priv->dmaops->dmamask));
+- else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32)))
++ } else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32))) {
+ dma_set_coherent_mask(priv->device, DMA_BIT_MASK(32));
+- else
++ } else {
++ ret = -EIO;
+ goto err_free_netdev;
++ }
+
+ /* MAC address space */
+ ret = request_and_map(pdev, "control_port", &control_port,
+diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
+index d06a89e99872d..fcb4f4cd349a4 100644
+--- a/drivers/net/ethernet/freescale/fec.h
++++ b/drivers/net/ethernet/freescale/fec.h
+@@ -373,6 +373,9 @@ struct bufdesc_ex {
+ #define FEC_ENET_WAKEUP ((uint)0x00020000) /* Wakeup request */
+ #define FEC_ENET_TXF (FEC_ENET_TXF_0 | FEC_ENET_TXF_1 | FEC_ENET_TXF_2)
+ #define FEC_ENET_RXF (FEC_ENET_RXF_0 | FEC_ENET_RXF_1 | FEC_ENET_RXF_2)
++#define FEC_ENET_RXF_GET(X) (((X) == 0) ? FEC_ENET_RXF_0 : \
++ (((X) == 1) ? FEC_ENET_RXF_1 : \
++ FEC_ENET_RXF_2))
+ #define FEC_ENET_TS_AVAIL ((uint)0x00010000)
+ #define FEC_ENET_TS_TIMER ((uint)0x00008000)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 3fc823e9cdc9d..fcd5d845e99ae 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -1441,7 +1441,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
+ break;
+ pkt_received++;
+
+- writel(FEC_ENET_RXF, fep->hwp + FEC_IEVENT);
++ writel(FEC_ENET_RXF_GET(queue_id), fep->hwp + FEC_IEVENT);
+
+ /* Check for errors. */
+ status ^= BD_ENET_RX_LAST;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 02d245970d7fa..55710028c99f3 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -3580,11 +3580,6 @@ static int i40e_vc_add_qch_msg(struct i40e_vf *vf, u8 *msg)
+
+ /* set this flag only after making sure all inputs are sane */
+ vf->adq_enabled = true;
+- /* num_req_queues is set when user changes number of queues via ethtool
+- * and this causes issue for default VSI(which depends on this variable)
+- * when ADq is enabled, hence reset it.
+- */
+- vf->num_req_queues = 0;
+
+ /* reset the VF in order to allocate resources */
+ i40e_vc_notify_vf_reset(vf);
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 00c833cd2b3ae..e513c46bd0f64 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -4404,6 +4404,9 @@ static int ice_up_complete(struct ice_vsi *vsi)
+ netif_carrier_on(vsi->netdev);
+ }
+
++ /* clear this now, and the first stats read will be used as baseline */
++ vsi->stat_offsets_loaded = false;
++
+ ice_service_task_schedule(pf);
+
+ return err;
+diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c
+index 73de57a09800d..4e417f839c3f0 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c
++++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c
+@@ -803,8 +803,10 @@ int nfp_cpp_area_cache_add(struct nfp_cpp *cpp, size_t size)
+ return -ENOMEM;
+
+ cache = kzalloc(sizeof(*cache), GFP_KERNEL);
+- if (!cache)
++ if (!cache) {
++ nfp_cpp_area_free(area);
+ return -ENOMEM;
++ }
+
+ cache->id = 0;
+ cache->addr = 0;
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+index 1976279800cd8..9d5c2e31dfe9b 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+@@ -1606,6 +1606,13 @@ netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ data_split = true;
+ }
+ } else {
++ if (unlikely(skb->len > ETH_TX_MAX_NON_LSO_PKT_LEN)) {
++ DP_ERR(edev, "Unexpected non LSO skb length = 0x%x\n", skb->len);
++ qede_free_failed_tx_pkt(txq, first_bd, 0, false);
++ qede_update_tx_producer(txq);
++ return NETDEV_TX_OK;
++ }
++
+ val |= ((skb->len & ETH_TX_DATA_1ST_BD_PKT_LEN_MASK) <<
+ ETH_TX_DATA_1ST_BD_PKT_LEN_SHIFT);
+ }
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
+index f98e2f417c2ea..f38dda1d92e2b 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -3496,20 +3496,19 @@ static int ql_adapter_up(struct ql3_adapter *qdev)
+
+ spin_lock_irqsave(&qdev->hw_lock, hw_flags);
+
+- err = ql_wait_for_drvr_lock(qdev);
+- if (err) {
+- err = ql_adapter_initialize(qdev);
+- if (err) {
+- netdev_err(ndev, "Unable to initialize adapter\n");
+- goto err_init;
+- }
+- netdev_err(ndev, "Releasing driver lock\n");
+- ql_sem_unlock(qdev, QL_DRVR_SEM_MASK);
+- } else {
++ if (!ql_wait_for_drvr_lock(qdev)) {
+ netdev_err(ndev, "Could not acquire driver lock\n");
++ err = -ENODEV;
+ goto err_lock;
+ }
+
++ err = ql_adapter_initialize(qdev);
++ if (err) {
++ netdev_err(ndev, "Unable to initialize adapter\n");
++ goto err_init;
++ }
++ ql_sem_unlock(qdev, QL_DRVR_SEM_MASK);
++
+ spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
+
+ set_bit(QL_ADAPTER_UP, &qdev->flags);
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index f3f78ccdb274c..0e1306ded31ea 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -177,6 +177,8 @@ static u32 cdc_ncm_check_tx_max(struct usbnet *dev, u32 new_tx)
+ /* clamp new_tx to sane values */
+ min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth16);
+ max = min_t(u32, CDC_NCM_NTB_MAX_SIZE_TX, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize));
++ if (max == 0)
++ max = CDC_NCM_NTB_MAX_SIZE_TX; /* dwNtbOutMaxSize not set */
+
+ /* some devices set dwNtbOutMaxSize too low for the above default */
+ min = min(min, max);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 2025261e97a1c..0410f05ccc26a 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -409,7 +409,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
+ * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0
+ * (see the end of section 5.6.3), so don't warn about them.
+ */
+- maxp = usb_endpoint_maxp(&endpoint->desc);
++ maxp = le16_to_cpu(endpoint->desc.wMaxPacketSize);
+ if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) {
+ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n",
+ cfgno, inum, asnum, d->bEndpointAddress);
+@@ -425,9 +425,9 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
+ maxpacket_maxes = full_speed_maxpacket_maxes;
+ break;
+ case USB_SPEED_HIGH:
+- /* Bits 12..11 are allowed only for HS periodic endpoints */
++ /* Multiple-transactions bits are allowed only for HS periodic endpoints */
+ if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
+- i = maxp & (BIT(12) | BIT(11));
++ i = maxp & USB_EP_MAXP_MULT_MASK;
+ maxp &= ~i;
+ }
+ /* fallthrough */
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index a76ed4acb5700..99550c9eb33ed 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1634,6 +1634,18 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+ struct usb_function *f = NULL;
+ u8 endp;
+
++ if (w_length > USB_COMP_EP0_BUFSIZ) {
++ if (ctrl->bRequestType == USB_DIR_OUT) {
++ goto done;
++ } else {
++ /* Cast away the const, we are going to overwrite on purpose. */
++ __le16 *temp = (__le16 *)&ctrl->wLength;
++
++ *temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ);
++ w_length = USB_COMP_EP0_BUFSIZ;
++ }
++ }
++
+ /* partial re-init of the response message; the function or the
+ * gadget might need to intercept e.g. a control-OUT completion
+ * when we delegate to it.
+@@ -2147,7 +2159,7 @@ int composite_dev_prepare(struct usb_composite_driver *composite,
+ if (!cdev->req)
+ return -ENOMEM;
+
+- cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL);
++ cdev->req->buf = kzalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL);
+ if (!cdev->req->buf)
+ goto fail;
+
+diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c
+index e1d566c9918ae..355bc7dab9d5f 100644
+--- a/drivers/usb/gadget/legacy/dbgp.c
++++ b/drivers/usb/gadget/legacy/dbgp.c
+@@ -137,7 +137,7 @@ static int dbgp_enable_ep_req(struct usb_ep *ep)
+ goto fail_1;
+ }
+
+- req->buf = kmalloc(DBGP_REQ_LEN, GFP_KERNEL);
++ req->buf = kzalloc(DBGP_REQ_LEN, GFP_KERNEL);
+ if (!req->buf) {
+ err = -ENOMEM;
+ stp = 2;
+@@ -345,6 +345,19 @@ static int dbgp_setup(struct usb_gadget *gadget,
+ void *data = NULL;
+ u16 len = 0;
+
++ if (length > DBGP_REQ_LEN) {
++ if (ctrl->bRequestType == USB_DIR_OUT) {
++ return err;
++ } else {
++ /* Cast away the const, we are going to overwrite on purpose. */
++ __le16 *temp = (__le16 *)&ctrl->wLength;
++
++ *temp = cpu_to_le16(DBGP_REQ_LEN);
++ length = DBGP_REQ_LEN;
++ }
++ }
++
++
+ if (request == USB_REQ_GET_DESCRIPTOR) {
+ switch (value>>8) {
+ case USB_DT_DEVICE:
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index 09ed5f02c24f4..848562222015d 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -109,6 +109,8 @@ enum ep0_state {
+ /* enough for the whole queue: most events invalidate others */
+ #define N_EVENT 5
+
++#define RBUF_SIZE 256
++
+ struct dev_data {
+ spinlock_t lock;
+ refcount_t count;
+@@ -143,7 +145,7 @@ struct dev_data {
+ struct dentry *dentry;
+
+ /* except this scratch i/o buffer for ep0 */
+- u8 rbuf [256];
++ u8 rbuf[RBUF_SIZE];
+ };
+
+ static inline void get_dev (struct dev_data *data)
+@@ -1332,6 +1334,18 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+ u16 w_value = le16_to_cpu(ctrl->wValue);
+ u16 w_length = le16_to_cpu(ctrl->wLength);
+
++ if (w_length > RBUF_SIZE) {
++ if (ctrl->bRequestType == USB_DIR_OUT) {
++ return value;
++ } else {
++ /* Cast away the const, we are going to overwrite on purpose. */
++ __le16 *temp = (__le16 *)&ctrl->wLength;
++
++ *temp = cpu_to_le16(RBUF_SIZE);
++ w_length = RBUF_SIZE;
++ }
++ }
++
+ spin_lock (&dev->lock);
+ dev->setup_abort = 0;
+ if (dev->state == STATE_DEV_UNCONNECTED) {
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 224d0bdda82ff..cf5af8592f3d8 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -625,6 +625,7 @@ static int xhci_enter_test_mode(struct xhci_hcd *xhci,
+ continue;
+
+ retval = xhci_disable_slot(xhci, i);
++ xhci_free_virt_device(xhci, i);
+ if (retval)
+ xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n",
+ i, retval);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 15e3bf8c9e830..f5bd91752f2d2 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1236,7 +1236,6 @@ static void xhci_handle_cmd_disable_slot(struct xhci_hcd *xhci, int slot_id)
+ if (xhci->quirks & XHCI_EP_LIMIT_QUIRK)
+ /* Delete default control endpoint resources */
+ xhci_free_device_endpoint_resources(xhci, virt_dev, true);
+- xhci_free_virt_device(xhci, slot_id);
+ }
+
+ static void xhci_handle_cmd_config_ep(struct xhci_hcd *xhci, int slot_id,
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index c6eec712cc47a..0c2b726b7797c 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3810,7 +3810,6 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ struct xhci_slot_ctx *slot_ctx;
+ int i, ret;
+
+-#ifndef CONFIG_USB_DEFAULT_PERSIST
+ /*
+ * We called pm_runtime_get_noresume when the device was attached.
+ * Decrement the counter here to allow controller to runtime suspend
+@@ -3818,7 +3817,6 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ */
+ if (xhci->quirks & XHCI_RESET_ON_RESUME)
+ pm_runtime_put_noidle(hcd->self.controller);
+-#endif
+
+ ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
+ /* If the host is halted due to driver unload, we still need to free the
+@@ -3838,9 +3836,8 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ }
+ xhci_debugfs_remove_slot(xhci, udev->slot_id);
+ virt_dev->udev = NULL;
+- ret = xhci_disable_slot(xhci, udev->slot_id);
+- if (ret)
+- xhci_free_virt_device(xhci, udev->slot_id);
++ xhci_disable_slot(xhci, udev->slot_id);
++ xhci_free_virt_device(xhci, udev->slot_id);
+ }
+
+ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
+@@ -3850,7 +3847,7 @@ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
+ u32 state;
+ int ret = 0;
+
+- command = xhci_alloc_command(xhci, false, GFP_KERNEL);
++ command = xhci_alloc_command(xhci, true, GFP_KERNEL);
+ if (!command)
+ return -ENOMEM;
+
+@@ -3873,6 +3870,15 @@ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
+ }
+ xhci_ring_cmd_db(xhci);
+ spin_unlock_irqrestore(&xhci->lock, flags);
++
++ wait_for_completion(command->completion);
++
++ if (command->status != COMP_SUCCESS)
++ xhci_warn(xhci, "Unsuccessful disable slot %u command, status %d\n",
++ slot_id, command->status);
++
++ xhci_free_command(xhci, command);
++
+ return ret;
+ }
+
+@@ -3969,23 +3975,20 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+
+ xhci_debugfs_create_slot(xhci, slot_id);
+
+-#ifndef CONFIG_USB_DEFAULT_PERSIST
+ /*
+ * If resetting upon resume, we can't put the controller into runtime
+ * suspend if there is a device attached.
+ */
+ if (xhci->quirks & XHCI_RESET_ON_RESUME)
+ pm_runtime_get_noresume(hcd->self.controller);
+-#endif
+
+ /* Is this a LS or FS device under a HS hub? */
+ /* Hub or peripherial? */
+ return 1;
+
+ disable_slot:
+- ret = xhci_disable_slot(xhci, udev->slot_id);
+- if (ret)
+- xhci_free_virt_device(xhci, udev->slot_id);
++ xhci_disable_slot(xhci, udev->slot_id);
++ xhci_free_virt_device(xhci, udev->slot_id);
+
+ return 0;
+ }
+@@ -4114,6 +4117,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
+
+ mutex_unlock(&xhci->mutex);
+ ret = xhci_disable_slot(xhci, udev->slot_id);
++ xhci_free_virt_device(xhci, udev->slot_id);
+ if (!ret)
+ xhci_alloc_dev(hcd, udev);
+ kfree(command->completion);
+diff --git a/fs/aio.c b/fs/aio.c
+index 413ec289bfa14..9635c29b83da1 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -176,8 +176,9 @@ struct poll_iocb {
+ struct file *file;
+ struct wait_queue_head *head;
+ __poll_t events;
+- bool done;
+ bool cancelled;
++ bool work_scheduled;
++ bool work_need_resched;
+ struct wait_queue_entry wait;
+ struct work_struct work;
+ };
+@@ -1616,6 +1617,51 @@ static void aio_poll_put_work(struct work_struct *work)
+ iocb_put(iocb);
+ }
+
++/*
++ * Safely lock the waitqueue which the request is on, synchronizing with the
++ * case where the ->poll() provider decides to free its waitqueue early.
++ *
++ * Returns true on success, meaning that req->head->lock was locked, req->wait
++ * is on req->head, and an RCU read lock was taken. Returns false if the
++ * request was already removed from its waitqueue (which might no longer exist).
++ */
++static bool poll_iocb_lock_wq(struct poll_iocb *req)
++{
++ wait_queue_head_t *head;
++
++ /*
++ * While we hold the waitqueue lock and the waitqueue is nonempty,
++ * wake_up_pollfree() will wait for us. However, taking the waitqueue
++ * lock in the first place can race with the waitqueue being freed.
++ *
++ * We solve this as eventpoll does: by taking advantage of the fact that
++ * all users of wake_up_pollfree() will RCU-delay the actual free. If
++ * we enter rcu_read_lock() and see that the pointer to the queue is
++ * non-NULL, we can then lock it without the memory being freed out from
++ * under us, then check whether the request is still on the queue.
++ *
++ * Keep holding rcu_read_lock() as long as we hold the queue lock, in
++ * case the caller deletes the entry from the queue, leaving it empty.
++ * In that case, only RCU prevents the queue memory from being freed.
++ */
++ rcu_read_lock();
++ head = smp_load_acquire(&req->head);
++ if (head) {
++ spin_lock(&head->lock);
++ if (!list_empty(&req->wait.entry))
++ return true;
++ spin_unlock(&head->lock);
++ }
++ rcu_read_unlock();
++ return false;
++}
++
++static void poll_iocb_unlock_wq(struct poll_iocb *req)
++{
++ spin_unlock(&req->head->lock);
++ rcu_read_unlock();
++}
++
+ static void aio_poll_complete_work(struct work_struct *work)
+ {
+ struct poll_iocb *req = container_of(work, struct poll_iocb, work);
+@@ -1635,14 +1681,27 @@ static void aio_poll_complete_work(struct work_struct *work)
+ * avoid further branches in the fast path.
+ */
+ spin_lock_irq(&ctx->ctx_lock);
+- if (!mask && !READ_ONCE(req->cancelled)) {
+- add_wait_queue(req->head, &req->wait);
+- spin_unlock_irq(&ctx->ctx_lock);
+- return;
+- }
++ if (poll_iocb_lock_wq(req)) {
++ if (!mask && !READ_ONCE(req->cancelled)) {
++ /*
++ * The request isn't actually ready to be completed yet.
++ * Reschedule completion if another wakeup came in.
++ */
++ if (req->work_need_resched) {
++ schedule_work(&req->work);
++ req->work_need_resched = false;
++ } else {
++ req->work_scheduled = false;
++ }
++ poll_iocb_unlock_wq(req);
++ spin_unlock_irq(&ctx->ctx_lock);
++ return;
++ }
++ list_del_init(&req->wait.entry);
++ poll_iocb_unlock_wq(req);
++ } /* else, POLLFREE has freed the waitqueue, so we must complete */
+ list_del_init(&iocb->ki_list);
+ iocb->ki_res.res = mangle_poll(mask);
+- req->done = true;
+ spin_unlock_irq(&ctx->ctx_lock);
+
+ iocb_put(iocb);
+@@ -1654,13 +1713,14 @@ static int aio_poll_cancel(struct kiocb *iocb)
+ struct aio_kiocb *aiocb = container_of(iocb, struct aio_kiocb, rw);
+ struct poll_iocb *req = &aiocb->poll;
+
+- spin_lock(&req->head->lock);
+- WRITE_ONCE(req->cancelled, true);
+- if (!list_empty(&req->wait.entry)) {
+- list_del_init(&req->wait.entry);
+- schedule_work(&aiocb->poll.work);
+- }
+- spin_unlock(&req->head->lock);
++ if (poll_iocb_lock_wq(req)) {
++ WRITE_ONCE(req->cancelled, true);
++ if (!req->work_scheduled) {
++ schedule_work(&aiocb->poll.work);
++ req->work_scheduled = true;
++ }
++ poll_iocb_unlock_wq(req);
++ } /* else, the request was force-cancelled by POLLFREE already */
+
+ return 0;
+ }
+@@ -1677,20 +1737,26 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
+ if (mask && !(mask & req->events))
+ return 0;
+
+- list_del_init(&req->wait.entry);
+-
+- if (mask && spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) {
++ /*
++ * Complete the request inline if possible. This requires that three
++ * conditions be met:
++ * 1. An event mask must have been passed. If a plain wakeup was done
++ * instead, then mask == 0 and we have to call vfs_poll() to get
++ * the events, so inline completion isn't possible.
++ * 2. The completion work must not have already been scheduled.
++ * 3. ctx_lock must not be busy. We have to use trylock because we
++ * already hold the waitqueue lock, so this inverts the normal
++ * locking order. Use irqsave/irqrestore because not all
++ * filesystems (e.g. fuse) call this function with IRQs disabled,
++ * yet IRQs have to be disabled before ctx_lock is obtained.
++ */
++ if (mask && !req->work_scheduled &&
++ spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) {
+ struct kioctx *ctx = iocb->ki_ctx;
+
+- /*
+- * Try to complete the iocb inline if we can. Use
+- * irqsave/irqrestore because not all filesystems (e.g. fuse)
+- * call this function with IRQs disabled and because IRQs
+- * have to be disabled before ctx_lock is obtained.
+- */
++ list_del_init(&req->wait.entry);
+ list_del(&iocb->ki_list);
+ iocb->ki_res.res = mangle_poll(mask);
+- req->done = true;
+ if (iocb->ki_eventfd && eventfd_signal_count()) {
+ iocb = NULL;
+ INIT_WORK(&req->work, aio_poll_put_work);
+@@ -1700,7 +1766,43 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
+ if (iocb)
+ iocb_put(iocb);
+ } else {
+- schedule_work(&req->work);
++ /*
++ * Schedule the completion work if needed. If it was already
++ * scheduled, record that another wakeup came in.
++ *
++ * Don't remove the request from the waitqueue here, as it might
++ * not actually be complete yet (we won't know until vfs_poll()
++ * is called), and we must not miss any wakeups. POLLFREE is an
++ * exception to this; see below.
++ */
++ if (req->work_scheduled) {
++ req->work_need_resched = true;
++ } else {
++ schedule_work(&req->work);
++ req->work_scheduled = true;
++ }
++
++ /*
++ * If the waitqueue is being freed early but we can't complete
++ * the request inline, we have to tear down the request as best
++ * we can. That means immediately removing the request from its
++ * waitqueue and preventing all further accesses to the
++ * waitqueue via the request. We also need to schedule the
++ * completion work (done above). Also mark the request as
++ * cancelled, to potentially skip an unneeded call to ->poll().
++ */
++ if (mask & POLLFREE) {
++ WRITE_ONCE(req->cancelled, true);
++ list_del_init(&req->wait.entry);
++
++ /*
++ * Careful: this *must* be the last step, since as soon
++ * as req->head is NULL'ed out, the request can be
++ * completed and freed, since aio_poll_complete_work()
++ * will no longer need to take the waitqueue lock.
++ */
++ smp_store_release(&req->head, NULL);
++ }
+ }
+ return 1;
+ }
+@@ -1708,6 +1810,7 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
+ struct aio_poll_table {
+ struct poll_table_struct pt;
+ struct aio_kiocb *iocb;
++ bool queued;
+ int error;
+ };
+
+@@ -1718,11 +1821,12 @@ aio_poll_queue_proc(struct file *file, struct wait_queue_head *head,
+ struct aio_poll_table *pt = container_of(p, struct aio_poll_table, pt);
+
+ /* multiple wait queues per file are not supported */
+- if (unlikely(pt->iocb->poll.head)) {
++ if (unlikely(pt->queued)) {
+ pt->error = -EINVAL;
+ return;
+ }
+
++ pt->queued = true;
+ pt->error = 0;
+ pt->iocb->poll.head = head;
+ add_wait_queue(head, &pt->iocb->poll.wait);
+@@ -1747,12 +1851,14 @@ static ssize_t aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb)
+ req->events = demangle_poll(iocb->aio_buf) | EPOLLERR | EPOLLHUP;
+
+ req->head = NULL;
+- req->done = false;
+ req->cancelled = false;
++ req->work_scheduled = false;
++ req->work_need_resched = false;
+
+ apt.pt._qproc = aio_poll_queue_proc;
+ apt.pt._key = req->events;
+ apt.iocb = aiocb;
++ apt.queued = false;
+ apt.error = -EINVAL; /* same as no support for IOCB_CMD_POLL */
+
+ /* initialized the list so that we can do list_empty checks */
+@@ -1761,23 +1867,35 @@ static ssize_t aio_poll(struct aio_kiocb *aiocb, const struct iocb *iocb)
+
+ mask = vfs_poll(req->file, &apt.pt) & req->events;
+ spin_lock_irq(&ctx->ctx_lock);
+- if (likely(req->head)) {
+- spin_lock(&req->head->lock);
+- if (unlikely(list_empty(&req->wait.entry))) {
+- if (apt.error)
++ if (likely(apt.queued)) {
++ bool on_queue = poll_iocb_lock_wq(req);
++
++ if (!on_queue || req->work_scheduled) {
++ /*
++ * aio_poll_wake() already either scheduled the async
++ * completion work, or completed the request inline.
++ */
++ if (apt.error) /* unsupported case: multiple queues */
+ cancel = true;
+ apt.error = 0;
+ mask = 0;
+ }
+ if (mask || apt.error) {
++ /* Steal to complete synchronously. */
+ list_del_init(&req->wait.entry);
+ } else if (cancel) {
++ /* Cancel if possible (may be too late though). */
+ WRITE_ONCE(req->cancelled, true);
+- } else if (!req->done) { /* actually waiting for an event */
++ } else if (on_queue) {
++ /*
++ * Actually waiting for an event, so add the request to
++ * active_reqs so that it can be cancelled if needed.
++ */
+ list_add_tail(&aiocb->ki_list, &ctx->active_reqs);
+ aiocb->ki_cancel = aio_poll_cancel;
+ }
+- spin_unlock(&req->head->lock);
++ if (on_queue)
++ poll_iocb_unlock_wq(req);
+ }
+ if (mask) { /* no async, we'd stolen it */
+ aiocb->ki_res.res = mangle_poll(mask);
+diff --git a/fs/signalfd.c b/fs/signalfd.c
+index 3c40a3bf772ce..94e0ae01db5c8 100644
+--- a/fs/signalfd.c
++++ b/fs/signalfd.c
+@@ -35,17 +35,7 @@
+
+ void signalfd_cleanup(struct sighand_struct *sighand)
+ {
+- wait_queue_head_t *wqh = &sighand->signalfd_wqh;
+- /*
+- * The lockless check can race with remove_wait_queue() in progress,
+- * but in this case its caller should run under rcu_read_lock() and
+- * sighand_cachep is SLAB_TYPESAFE_BY_RCU, we can safely return.
+- */
+- if (likely(!waitqueue_active(wqh)))
+- return;
+-
+- /* wait_queue_entry_t->func(POLLFREE) should do remove_wait_queue() */
+- wake_up_poll(wqh, EPOLLHUP | POLLFREE);
++ wake_up_pollfree(&sighand->signalfd_wqh);
+ }
+
+ struct signalfd_ctx {
+diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
+index 990f794b1dd0a..8834819c0791b 100644
+--- a/fs/tracefs/inode.c
++++ b/fs/tracefs/inode.c
+@@ -162,6 +162,77 @@ struct tracefs_fs_info {
+ struct tracefs_mount_opts mount_opts;
+ };
+
++static void change_gid(struct dentry *dentry, kgid_t gid)
++{
++ if (!dentry->d_inode)
++ return;
++ dentry->d_inode->i_gid = gid;
++}
++
++/*
++ * Taken from d_walk, but without he need for handling renames.
++ * Nothing can be renamed while walking the list, as tracefs
++ * does not support renames. This is only called when mounting
++ * or remounting the file system, to set all the files to
++ * the given gid.
++ */
++static void set_gid(struct dentry *parent, kgid_t gid)
++{
++ struct dentry *this_parent;
++ struct list_head *next;
++
++ this_parent = parent;
++ spin_lock(&this_parent->d_lock);
++
++ change_gid(this_parent, gid);
++repeat:
++ next = this_parent->d_subdirs.next;
++resume:
++ while (next != &this_parent->d_subdirs) {
++ struct list_head *tmp = next;
++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
++ next = tmp->next;
++
++ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
++
++ change_gid(dentry, gid);
++
++ if (!list_empty(&dentry->d_subdirs)) {
++ spin_unlock(&this_parent->d_lock);
++ spin_release(&dentry->d_lock.dep_map, 1, _RET_IP_);
++ this_parent = dentry;
++ spin_acquire(&this_parent->d_lock.dep_map, 0, 1, _RET_IP_);
++ goto repeat;
++ }
++ spin_unlock(&dentry->d_lock);
++ }
++ /*
++ * All done at this level ... ascend and resume the search.
++ */
++ rcu_read_lock();
++ascend:
++ if (this_parent != parent) {
++ struct dentry *child = this_parent;
++ this_parent = child->d_parent;
++
++ spin_unlock(&child->d_lock);
++ spin_lock(&this_parent->d_lock);
++
++ /* go into the first sibling still alive */
++ do {
++ next = child->d_child.next;
++ if (next == &this_parent->d_subdirs)
++ goto ascend;
++ child = list_entry(next, struct dentry, d_child);
++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
++ rcu_read_unlock();
++ goto resume;
++ }
++ rcu_read_unlock();
++ spin_unlock(&this_parent->d_lock);
++ return;
++}
++
+ static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts)
+ {
+ substring_t args[MAX_OPT_ARGS];
+@@ -194,6 +265,7 @@ static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts)
+ if (!gid_valid(gid))
+ return -EINVAL;
+ opts->gid = gid;
++ set_gid(tracefs_mount->mnt_root, gid);
+ break;
+ case Opt_mode:
+ if (match_octal(&args[0], &option))
+@@ -409,6 +481,8 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode,
+ inode->i_mode = mode;
+ inode->i_fop = fops ? fops : &tracefs_file_operations;
+ inode->i_private = data;
++ inode->i_uid = d_inode(dentry->d_parent)->i_uid;
++ inode->i_gid = d_inode(dentry->d_parent)->i_gid;
+ d_instantiate(dentry, inode);
+ fsnotify_create(dentry->d_parent->d_inode, dentry);
+ return end_creating(dentry);
+@@ -431,6 +505,8 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent,
+ inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP;
+ inode->i_op = ops;
+ inode->i_fop = &simple_dir_operations;
++ inode->i_uid = d_inode(dentry->d_parent)->i_uid;
++ inode->i_gid = d_inode(dentry->d_parent)->i_gid;
+
+ /* directory inodes start off with i_nlink == 2 (for "." entry) */
+ inc_nlink(inode);
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index c833948aade05..da824ba9fb9a2 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -834,6 +834,11 @@ static inline bool hid_is_using_ll_driver(struct hid_device *hdev,
+ return hdev->ll_driver == driver;
+ }
+
++static inline bool hid_is_usb(struct hid_device *hdev)
++{
++ return hid_is_using_ll_driver(hdev, &usb_hid_driver);
++}
++
+ #define PM_HINT_FULLON 1<<5
+ #define PM_HINT_NORMAL 1<<1
+
+diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
+index 5225832bd6ff1..bb9cb84114c15 100644
+--- a/include/linux/rtnetlink.h
++++ b/include/linux/rtnetlink.h
+@@ -6,6 +6,7 @@
+ #include <linux/mutex.h>
+ #include <linux/netdevice.h>
+ #include <linux/wait.h>
++#include <linux/refcount.h>
+ #include <uapi/linux/rtnetlink.h>
+
+ extern int rtnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, u32 group, int echo);
+@@ -34,6 +35,7 @@ extern void rtnl_unlock(void);
+ extern int rtnl_trylock(void);
+ extern int rtnl_is_locked(void);
+ extern int rtnl_lock_killable(void);
++extern bool refcount_dec_and_rtnl_lock(refcount_t *r);
+
+ extern wait_queue_head_t netdev_unregistering_wq;
+ extern struct rw_semaphore pernet_ops_rwsem;
+@@ -83,6 +85,11 @@ static inline struct netdev_queue *dev_ingress_queue(struct net_device *dev)
+ return rtnl_dereference(dev->ingress_queue);
+ }
+
++static inline struct netdev_queue *dev_ingress_queue_rcu(struct net_device *dev)
++{
++ return rcu_dereference(dev->ingress_queue);
++}
++
+ struct netdev_queue *dev_ingress_queue_create(struct net_device *dev);
+
+ #ifdef CONFIG_NET_INGRESS
+diff --git a/include/linux/wait.h b/include/linux/wait.h
+index ed7c122cb31f4..1d726d79063c5 100644
+--- a/include/linux/wait.h
++++ b/include/linux/wait.h
+@@ -191,6 +191,7 @@ void __wake_up_locked_key_bookmark(struct wait_queue_head *wq_head,
+ void __wake_up_sync_key(struct wait_queue_head *wq_head, unsigned int mode, int nr, void *key);
+ void __wake_up_locked(struct wait_queue_head *wq_head, unsigned int mode, int nr);
+ void __wake_up_sync(struct wait_queue_head *wq_head, unsigned int mode, int nr);
++void __wake_up_pollfree(struct wait_queue_head *wq_head);
+
+ #define wake_up(x) __wake_up(x, TASK_NORMAL, 1, NULL)
+ #define wake_up_nr(x, nr) __wake_up(x, TASK_NORMAL, nr, NULL)
+@@ -217,6 +218,31 @@ void __wake_up_sync(struct wait_queue_head *wq_head, unsigned int mode, int nr);
+ #define wake_up_interruptible_sync_poll(x, m) \
+ __wake_up_sync_key((x), TASK_INTERRUPTIBLE, 1, poll_to_key(m))
+
++/**
++ * wake_up_pollfree - signal that a polled waitqueue is going away
++ * @wq_head: the wait queue head
++ *
++ * In the very rare cases where a ->poll() implementation uses a waitqueue whose
++ * lifetime is tied to a task rather than to the 'struct file' being polled,
++ * this function must be called before the waitqueue is freed so that
++ * non-blocking polls (e.g. epoll) are notified that the queue is going away.
++ *
++ * The caller must also RCU-delay the freeing of the wait_queue_head, e.g. via
++ * an explicit synchronize_rcu() or call_rcu(), or via SLAB_TYPESAFE_BY_RCU.
++ */
++static inline void wake_up_pollfree(struct wait_queue_head *wq_head)
++{
++ /*
++ * For performance reasons, we don't always take the queue lock here.
++ * Therefore, we might race with someone removing the last entry from
++ * the queue, and proceed while they still hold the queue lock.
++ * However, rcu_read_lock() is required to be held in such cases, so we
++ * can safely proceed with an RCU-delayed free.
++ */
++ if (waitqueue_active(wq_head))
++ __wake_up_pollfree(wq_head);
++}
++
+ #define ___wait_cond_timeout(condition) \
+ ({ \
+ bool __cond = (condition); \
+diff --git a/include/net/bond_alb.h b/include/net/bond_alb.h
+index 313a8d3b30696..3a6c932b6dcaf 100644
+--- a/include/net/bond_alb.h
++++ b/include/net/bond_alb.h
+@@ -142,7 +142,7 @@ struct tlb_slave_info {
+ struct alb_bond_info {
+ struct tlb_client_info *tx_hashtbl; /* Dynamically allocated */
+ u32 unbalanced_load;
+- int tx_rebalance_counter;
++ atomic_t tx_rebalance_counter;
+ int lp_counter;
+ /* -------- rlb parameters -------- */
+ int rlb_enabled;
+diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
+index edca90ef3bdc4..1a6ac924266db 100644
+--- a/include/net/pkt_sched.h
++++ b/include/net/pkt_sched.h
+@@ -103,6 +103,7 @@ int qdisc_set_default(const char *id);
+ void qdisc_hash_add(struct Qdisc *q, bool invisible);
+ void qdisc_hash_del(struct Qdisc *q);
+ struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle);
++struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle);
+ struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r,
+ struct nlattr *tab,
+ struct netlink_ext_ack *extack);
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index 286bc674a6e79..c0147888b1555 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -108,6 +108,7 @@ struct Qdisc {
+
+ spinlock_t busylock ____cacheline_aligned_in_smp;
+ spinlock_t seqlock;
++ struct rcu_head rcu;
+ };
+
+ static inline void qdisc_refcount_inc(struct Qdisc *qdisc)
+@@ -117,6 +118,19 @@ static inline void qdisc_refcount_inc(struct Qdisc *qdisc)
+ refcount_inc(&qdisc->refcnt);
+ }
+
++/* Intended to be used by unlocked users, when concurrent qdisc release is
++ * possible.
++ */
++
++static inline struct Qdisc *qdisc_refcount_inc_nz(struct Qdisc *qdisc)
++{
++ if (qdisc->flags & TCQ_F_BUILTIN)
++ return qdisc;
++ if (refcount_inc_not_zero(&qdisc->refcnt))
++ return qdisc;
++ return NULL;
++}
++
+ static inline bool qdisc_is_running(struct Qdisc *qdisc)
+ {
+ if (qdisc->flags & TCQ_F_NOLOCK)
+@@ -559,7 +573,8 @@ void dev_deactivate_many(struct list_head *head);
+ struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
+ struct Qdisc *qdisc);
+ void qdisc_reset(struct Qdisc *qdisc);
+-void qdisc_destroy(struct Qdisc *qdisc);
++void qdisc_put(struct Qdisc *qdisc);
++void qdisc_put_unlocked(struct Qdisc *qdisc);
+ void qdisc_tree_reduce_backlog(struct Qdisc *qdisc, unsigned int n,
+ unsigned int len);
+ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
+diff --git a/include/uapi/asm-generic/poll.h b/include/uapi/asm-generic/poll.h
+index 41b509f410bf9..f9c520ce4bf4e 100644
+--- a/include/uapi/asm-generic/poll.h
++++ b/include/uapi/asm-generic/poll.h
+@@ -29,7 +29,7 @@
+ #define POLLRDHUP 0x2000
+ #endif
+
+-#define POLLFREE (__force __poll_t)0x4000 /* currently only for epoll */
++#define POLLFREE (__force __poll_t)0x4000
+
+ #define POLL_BUSY_LOOP (__force __poll_t)0x8000
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 9a671f604ebfe..30ac8ee8294c3 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -3761,7 +3761,7 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *vstate,
+
+ new_range = dst_reg->off;
+ if (range_right_open)
+- new_range--;
++ new_range++;
+
+ /* Examples for register markings:
+ *
+diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
+index 5dd47f1103d18..a44a57fb95402 100644
+--- a/kernel/sched/wait.c
++++ b/kernel/sched/wait.c
+@@ -209,6 +209,13 @@ void __wake_up_sync(struct wait_queue_head *wq_head, unsigned int mode, int nr_e
+ }
+ EXPORT_SYMBOL_GPL(__wake_up_sync); /* For internal use only */
+
++void __wake_up_pollfree(struct wait_queue_head *wq_head)
++{
++ __wake_up(wq_head, TASK_NORMAL, 0, poll_to_key(EPOLLHUP | POLLFREE));
++ /* POLLFREE must have cleared the queue. */
++ WARN_ON_ONCE(waitqueue_active(wq_head));
++}
++
+ /*
+ * Note: we use "set_current_state()" _after_ the wait-queue add,
+ * because we need a memory barrier there on SMP, so that any
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index 1d37c80d023a2..67431d02ad9d0 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -946,6 +946,13 @@ void bdi_unregister(struct backing_dev_info *bdi)
+ wb_shutdown(&bdi->wb);
+ cgwb_bdi_unregister(bdi);
+
++ /*
++ * If this BDI's min ratio has been set, use bdi_set_min_ratio() to
++ * update the global bdi_min_ratio.
++ */
++ if (bdi->min_ratio)
++ bdi_set_min_ratio(bdi, 0);
++
+ if (bdi->dev) {
+ bdi_debug_unregister(bdi);
+ device_unregister(bdi->dev);
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index e471c32e448f6..6233e9856016e 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -635,7 +635,7 @@ struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
+
+ ASSERT_RTNL();
+
+- n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
++ n = kzalloc(sizeof(*n) + key_len, GFP_KERNEL);
+ if (!n)
+ goto out;
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 83de32e34bb55..907dd0c7e8a66 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -130,6 +130,12 @@ int rtnl_is_locked(void)
+ }
+ EXPORT_SYMBOL(rtnl_is_locked);
+
++bool refcount_dec_and_rtnl_lock(refcount_t *r)
++{
++ return refcount_dec_and_mutex_lock(r, &rtnl_mutex);
++}
++EXPORT_SYMBOL(refcount_dec_and_rtnl_lock);
++
+ #ifdef CONFIG_PROVE_LOCKING
+ bool lockdep_rtnl_is_held(void)
+ {
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index e62de979ee30c..fce32f3e42b54 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -798,7 +798,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
+ kfree_skb(skb);
+ return -EINVAL;
+ }
+- if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {
++ if (datalen > cork->gso_size * UDP_MAX_SEGMENTS) {
+ kfree_skb(skb);
+ return -EINVAL;
+ }
+diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
+index ee5403cbe655e..26882fd9323a2 100644
+--- a/net/ipv6/seg6_iptunnel.c
++++ b/net/ipv6/seg6_iptunnel.c
+@@ -148,6 +148,14 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
+ hdr->hop_limit = ip6_dst_hoplimit(skb_dst(skb));
+
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
++
++ /* the control block has been erased, so we have to set the
++ * iif once again.
++ * We read the receiving interface index directly from the
++ * skb->skb_iif as it is done in the IPv4 receiving path (i.e.:
++ * ip_rcv_core(...)).
++ */
++ IP6CB(skb)->iif = skb->skb_iif;
+ }
+
+ hdr->nexthdr = NEXTHDR_ROUTING;
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index 4884e1987562a..b6313504faed1 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -1410,8 +1410,10 @@ static int nfc_genl_dump_ses_done(struct netlink_callback *cb)
+ {
+ struct class_dev_iter *iter = (struct class_dev_iter *) cb->args[0];
+
+- nfc_device_iter_exit(iter);
+- kfree(iter);
++ if (iter) {
++ nfc_device_iter_exit(iter);
++ kfree(iter);
++ }
+
+ return 0;
+ }
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 4413aa8d4e829..435911dc9f16a 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -539,6 +539,7 @@ static struct tcf_block *tcf_block_find(struct net *net, struct Qdisc **q,
+ struct netlink_ext_ack *extack)
+ {
+ struct tcf_block *block;
++ int err = 0;
+
+ if (ifindex == TCM_IFINDEX_MAGIC_BLOCK) {
+ block = tcf_block_lookup(net, block_index);
+@@ -550,55 +551,95 @@ static struct tcf_block *tcf_block_find(struct net *net, struct Qdisc **q,
+ const struct Qdisc_class_ops *cops;
+ struct net_device *dev;
+
++ rcu_read_lock();
++
+ /* Find link */
+- dev = __dev_get_by_index(net, ifindex);
+- if (!dev)
++ dev = dev_get_by_index_rcu(net, ifindex);
++ if (!dev) {
++ rcu_read_unlock();
+ return ERR_PTR(-ENODEV);
++ }
+
+ /* Find qdisc */
+ if (!*parent) {
+ *q = dev->qdisc;
+ *parent = (*q)->handle;
+ } else {
+- *q = qdisc_lookup(dev, TC_H_MAJ(*parent));
++ *q = qdisc_lookup_rcu(dev, TC_H_MAJ(*parent));
+ if (!*q) {
+ NL_SET_ERR_MSG(extack, "Parent Qdisc doesn't exists");
+- return ERR_PTR(-EINVAL);
++ err = -EINVAL;
++ goto errout_rcu;
+ }
+ }
+
++ *q = qdisc_refcount_inc_nz(*q);
++ if (!*q) {
++ NL_SET_ERR_MSG(extack, "Parent Qdisc doesn't exists");
++ err = -EINVAL;
++ goto errout_rcu;
++ }
++
+ /* Is it classful? */
+ cops = (*q)->ops->cl_ops;
+ if (!cops) {
+ NL_SET_ERR_MSG(extack, "Qdisc not classful");
+- return ERR_PTR(-EINVAL);
++ err = -EINVAL;
++ goto errout_rcu;
+ }
+
+ if (!cops->tcf_block) {
+ NL_SET_ERR_MSG(extack, "Class doesn't support blocks");
+- return ERR_PTR(-EOPNOTSUPP);
++ err = -EOPNOTSUPP;
++ goto errout_rcu;
+ }
+
++ /* At this point we know that qdisc is not noop_qdisc,
++ * which means that qdisc holds a reference to net_device
++ * and we hold a reference to qdisc, so it is safe to release
++ * rcu read lock.
++ */
++ rcu_read_unlock();
++
+ /* Do we search for filter, attached to class? */
+ if (TC_H_MIN(*parent)) {
+ *cl = cops->find(*q, *parent);
+ if (*cl == 0) {
+ NL_SET_ERR_MSG(extack, "Specified class doesn't exist");
+- return ERR_PTR(-ENOENT);
++ err = -ENOENT;
++ goto errout_qdisc;
+ }
+ }
+
+ /* And the last stroke */
+ block = cops->tcf_block(*q, *cl, extack);
+- if (!block)
+- return ERR_PTR(-EINVAL);
++ if (!block) {
++ err = -EINVAL;
++ goto errout_qdisc;
++ }
+ if (tcf_block_shared(block)) {
+ NL_SET_ERR_MSG(extack, "This filter block is shared. Please use the block index to manipulate the filters");
+- return ERR_PTR(-EOPNOTSUPP);
++ err = -EOPNOTSUPP;
++ goto errout_qdisc;
+ }
+ }
+
+ return block;
++
++errout_rcu:
++ rcu_read_unlock();
++errout_qdisc:
++ if (*q) {
++ qdisc_put(*q);
++ *q = NULL;
++ }
++ return ERR_PTR(err);
++}
++
++static void tcf_block_release(struct Qdisc *q, struct tcf_block *block)
++{
++ if (q)
++ qdisc_put(q);
+ }
+
+ struct tcf_block_owner_item {
+@@ -1336,6 +1377,7 @@ replay:
+ errout:
+ if (chain)
+ tcf_chain_put(chain);
++ tcf_block_release(q, block);
+ if (err == -EAGAIN)
+ /* Replay the request. */
+ goto replay;
+@@ -1457,6 +1499,7 @@ static int tc_del_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
+ errout:
+ if (chain)
+ tcf_chain_put(chain);
++ tcf_block_release(q, block);
+ return err;
+ }
+
+@@ -1542,6 +1585,7 @@ static int tc_get_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
+ errout:
+ if (chain)
+ tcf_chain_put(chain);
++ tcf_block_release(q, block);
+ return err;
+ }
+
+@@ -1858,7 +1902,8 @@ replay:
+ chain_index = tca[TCA_CHAIN] ? nla_get_u32(tca[TCA_CHAIN]) : 0;
+ if (chain_index > TC_ACT_EXT_VAL_MASK) {
+ NL_SET_ERR_MSG(extack, "Specified chain index exceeds upper limit");
+- return -EINVAL;
++ err = -EINVAL;
++ goto errout_block;
+ }
+ chain = tcf_chain_lookup(block, chain_index);
+ if (n->nlmsg_type == RTM_NEWCHAIN) {
+@@ -1870,23 +1915,27 @@ replay:
+ tcf_chain_hold(chain);
+ } else {
+ NL_SET_ERR_MSG(extack, "Filter chain already exists");
+- return -EEXIST;
++ err = -EEXIST;
++ goto errout_block;
+ }
+ } else {
+ if (!(n->nlmsg_flags & NLM_F_CREATE)) {
+ NL_SET_ERR_MSG(extack, "Need both RTM_NEWCHAIN and NLM_F_CREATE to create a new chain");
+- return -ENOENT;
++ err = -ENOENT;
++ goto errout_block;
+ }
+ chain = tcf_chain_create(block, chain_index);
+ if (!chain) {
+ NL_SET_ERR_MSG(extack, "Failed to create filter chain");
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto errout_block;
+ }
+ }
+ } else {
+ if (!chain || tcf_chain_held_by_acts_only(chain)) {
+ NL_SET_ERR_MSG(extack, "Cannot find specified filter chain");
+- return -EINVAL;
++ err = -EINVAL;
++ goto errout_block;
+ }
+ tcf_chain_hold(chain);
+ }
+@@ -1930,6 +1979,8 @@ replay:
+
+ errout:
+ tcf_chain_put(chain);
++errout_block:
++ tcf_block_release(q, block);
+ if (err == -EAGAIN)
+ /* Replay the request. */
+ goto replay;
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 0bb4f7a94a3c8..af035431bec60 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -315,6 +315,24 @@ out:
+ return q;
+ }
+
++struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle)
++{
++ struct netdev_queue *nq;
++ struct Qdisc *q;
++
++ if (!handle)
++ return NULL;
++ q = qdisc_match_from_root(dev->qdisc, handle);
++ if (q)
++ goto out;
++
++ nq = dev_ingress_queue_rcu(dev);
++ if (nq)
++ q = qdisc_match_from_root(nq->qdisc_sleeping, handle);
++out:
++ return q;
++}
++
+ static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid)
+ {
+ unsigned long cl;
+@@ -928,7 +946,7 @@ static void notify_and_destroy(struct net *net, struct sk_buff *skb,
+ qdisc_notify(net, skb, n, clid, old, new);
+
+ if (old)
+- qdisc_destroy(old);
++ qdisc_put(old);
+ }
+
+ /* Graft qdisc "new" to class "classid" of qdisc "parent" or
+@@ -981,7 +999,7 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
+ qdisc_refcount_inc(new);
+
+ if (!ingress)
+- qdisc_destroy(old);
++ qdisc_put(old);
+ }
+
+ skip:
+@@ -1589,7 +1607,7 @@ graft:
+ err = qdisc_graft(dev, p, skb, n, clid, q, NULL, extack);
+ if (err) {
+ if (q)
+- qdisc_destroy(q);
++ qdisc_put(q);
+ return err;
+ }
+
+diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
+index 91bd5c8393036..9a1bfa13a6cd6 100644
+--- a/net/sched/sch_atm.c
++++ b/net/sched/sch_atm.c
+@@ -150,7 +150,7 @@ static void atm_tc_put(struct Qdisc *sch, unsigned long cl)
+ pr_debug("atm_tc_put: destroying\n");
+ list_del_init(&flow->list);
+ pr_debug("atm_tc_put: qdisc %p\n", flow->q);
+- qdisc_destroy(flow->q);
++ qdisc_put(flow->q);
+ tcf_block_put(flow->block);
+ if (flow->sock) {
+ pr_debug("atm_tc_put: f_count %ld\n",
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index bc62e1b246539..0a76ad05e5ae5 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -1439,7 +1439,7 @@ static void cbq_destroy_class(struct Qdisc *sch, struct cbq_class *cl)
+ WARN_ON(cl->filters);
+
+ tcf_block_put(cl->block);
+- qdisc_destroy(cl->q);
++ qdisc_put(cl->q);
+ qdisc_put_rtab(cl->R_tab);
+ gen_kill_estimator(&cl->rate_est);
+ if (cl != &q->link)
+diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
+index d5e22452d5976..f95dc899e989a 100644
+--- a/net/sched/sch_cbs.c
++++ b/net/sched/sch_cbs.c
+@@ -452,7 +452,7 @@ static void cbs_destroy(struct Qdisc *sch)
+ cbs_disable_offload(dev, q);
+
+ if (q->qdisc)
+- qdisc_destroy(q->qdisc);
++ qdisc_put(q->qdisc);
+ }
+
+ static int cbs_dump(struct Qdisc *sch, struct sk_buff *skb)
+diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
+index e0b0cf8a99393..cdebaed0f8cfd 100644
+--- a/net/sched/sch_drr.c
++++ b/net/sched/sch_drr.c
+@@ -134,7 +134,7 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
+ tca[TCA_RATE]);
+ if (err) {
+ NL_SET_ERR_MSG(extack, "Failed to replace estimator");
+- qdisc_destroy(cl->qdisc);
++ qdisc_put(cl->qdisc);
+ kfree(cl);
+ return err;
+ }
+@@ -153,7 +153,7 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
+ static void drr_destroy_class(struct Qdisc *sch, struct drr_class *cl)
+ {
+ gen_kill_estimator(&cl->rate_est);
+- qdisc_destroy(cl->qdisc);
++ qdisc_put(cl->qdisc);
+ kfree(cl);
+ }
+
+diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
+index fe030af9272c4..47a61689dadbc 100644
+--- a/net/sched/sch_dsmark.c
++++ b/net/sched/sch_dsmark.c
+@@ -415,7 +415,7 @@ static void dsmark_destroy(struct Qdisc *sch)
+ pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
+
+ tcf_block_put(p->block);
+- qdisc_destroy(p->q);
++ qdisc_put(p->q);
+ if (p->mv != p->embedded)
+ kfree(p->mv);
+ }
+diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
+index bcd3ca97caea1..3697cd7997678 100644
+--- a/net/sched/sch_fifo.c
++++ b/net/sched/sch_fifo.c
+@@ -180,7 +180,7 @@ struct Qdisc *fifo_create_dflt(struct Qdisc *sch, struct Qdisc_ops *ops,
+ if (q) {
+ err = fifo_set_limit(q, limit);
+ if (err < 0) {
+- qdisc_destroy(q);
++ qdisc_put(q);
+ q = NULL;
+ }
+ }
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 2128b77d5cb33..b3ff610d35045 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -918,7 +918,7 @@ struct Qdisc *qdisc_create_dflt(struct netdev_queue *dev_queue,
+ if (!ops->init || ops->init(sch, NULL, extack) == 0)
+ return sch;
+
+- qdisc_destroy(sch);
++ qdisc_put(sch);
+ return NULL;
+ }
+ EXPORT_SYMBOL(qdisc_create_dflt);
+@@ -958,7 +958,14 @@ void qdisc_free(struct Qdisc *qdisc)
+ kfree((char *) qdisc - qdisc->padded);
+ }
+
+-void qdisc_destroy(struct Qdisc *qdisc)
++static void qdisc_free_cb(struct rcu_head *head)
++{
++ struct Qdisc *q = container_of(head, struct Qdisc, rcu);
++
++ qdisc_free(q);
++}
++
++static void qdisc_destroy(struct Qdisc *qdisc)
+ {
+ const struct Qdisc_ops *ops;
+ struct sk_buff *skb, *tmp;
+@@ -967,10 +974,6 @@ void qdisc_destroy(struct Qdisc *qdisc)
+ return;
+ ops = qdisc->ops;
+
+- if (qdisc->flags & TCQ_F_BUILTIN ||
+- !refcount_dec_and_test(&qdisc->refcnt))
+- return;
+-
+ #ifdef CONFIG_NET_SCHED
+ qdisc_hash_del(qdisc);
+
+@@ -995,9 +998,34 @@ void qdisc_destroy(struct Qdisc *qdisc)
+ kfree_skb_list(skb);
+ }
+
+- qdisc_free(qdisc);
++ call_rcu(&qdisc->rcu, qdisc_free_cb);
++}
++
++void qdisc_put(struct Qdisc *qdisc)
++{
++ if (qdisc->flags & TCQ_F_BUILTIN ||
++ !refcount_dec_and_test(&qdisc->refcnt))
++ return;
++
++ qdisc_destroy(qdisc);
++}
++EXPORT_SYMBOL(qdisc_put);
++
++/* Version of qdisc_put() that is called with rtnl mutex unlocked.
++ * Intended to be used as optimization, this function only takes rtnl lock if
++ * qdisc reference counter reached zero.
++ */
++
++void qdisc_put_unlocked(struct Qdisc *qdisc)
++{
++ if (qdisc->flags & TCQ_F_BUILTIN ||
++ !refcount_dec_and_rtnl_lock(&qdisc->refcnt))
++ return;
++
++ qdisc_destroy(qdisc);
++ rtnl_unlock();
+ }
+-EXPORT_SYMBOL(qdisc_destroy);
++EXPORT_SYMBOL(qdisc_put_unlocked);
+
+ /* Attach toplevel qdisc to device queue. */
+ struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
+@@ -1318,7 +1346,7 @@ static void shutdown_scheduler_queue(struct net_device *dev,
+ rcu_assign_pointer(dev_queue->qdisc, qdisc_default);
+ dev_queue->qdisc_sleeping = qdisc_default;
+
+- qdisc_destroy(qdisc);
++ qdisc_put(qdisc);
+ }
+ }
+
+@@ -1327,7 +1355,7 @@ void dev_shutdown(struct net_device *dev)
+ netdev_for_each_tx_queue(dev, shutdown_scheduler_queue, &noop_qdisc);
+ if (dev_ingress_queue(dev))
+ shutdown_scheduler_queue(dev, dev_ingress_queue(dev), &noop_qdisc);
+- qdisc_destroy(dev->qdisc);
++ qdisc_put(dev->qdisc);
+ dev->qdisc = &noop_qdisc;
+
+ WARN_ON(timer_pending(&dev->watchdog_timer));
+diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
+index 3278a76f68615..b18ec1f6de60c 100644
+--- a/net/sched/sch_hfsc.c
++++ b/net/sched/sch_hfsc.c
+@@ -1092,7 +1092,7 @@ hfsc_destroy_class(struct Qdisc *sch, struct hfsc_class *cl)
+ struct hfsc_sched *q = qdisc_priv(sch);
+
+ tcf_block_put(cl->block);
+- qdisc_destroy(cl->qdisc);
++ qdisc_put(cl->qdisc);
+ gen_kill_estimator(&cl->rate_est);
+ if (cl != &q->root)
+ kfree(cl);
+diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
+index 43c4bfe625a91..862a33b9e2e0f 100644
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -1224,7 +1224,7 @@ static void htb_destroy_class(struct Qdisc *sch, struct htb_class *cl)
+ {
+ if (!cl->level) {
+ WARN_ON(!cl->un.leaf.q);
+- qdisc_destroy(cl->un.leaf.q);
++ qdisc_put(cl->un.leaf.q);
+ }
+ gen_kill_estimator(&cl->rate_est);
+ tcf_block_put(cl->block);
+@@ -1425,7 +1425,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
+ /* turn parent into inner node */
+ qdisc_reset(parent->un.leaf.q);
+ qdisc_tree_reduce_backlog(parent->un.leaf.q, qlen, backlog);
+- qdisc_destroy(parent->un.leaf.q);
++ qdisc_put(parent->un.leaf.q);
+ if (parent->prio_activity)
+ htb_deactivate(q, parent);
+
+diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
+index 699b6bb444cea..0ab13a495af95 100644
+--- a/net/sched/sch_mq.c
++++ b/net/sched/sch_mq.c
+@@ -65,7 +65,7 @@ static void mq_destroy(struct Qdisc *sch)
+ if (!priv->qdiscs)
+ return;
+ for (ntx = 0; ntx < dev->num_tx_queues && priv->qdiscs[ntx]; ntx++)
+- qdisc_destroy(priv->qdiscs[ntx]);
++ qdisc_put(priv->qdiscs[ntx]);
+ kfree(priv->qdiscs);
+ }
+
+@@ -119,7 +119,7 @@ static void mq_attach(struct Qdisc *sch)
+ qdisc = priv->qdiscs[ntx];
+ old = dev_graft_qdisc(qdisc->dev_queue, qdisc);
+ if (old)
+- qdisc_destroy(old);
++ qdisc_put(old);
+ #ifdef CONFIG_NET_SCHED
+ if (ntx < dev->real_num_tx_queues)
+ qdisc_hash_add(qdisc, false);
+diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
+index 3fd0e5dd7ae3e..64d7f876d7de2 100644
+--- a/net/sched/sch_mqprio.c
++++ b/net/sched/sch_mqprio.c
+@@ -40,7 +40,7 @@ static void mqprio_destroy(struct Qdisc *sch)
+ for (ntx = 0;
+ ntx < dev->num_tx_queues && priv->qdiscs[ntx];
+ ntx++)
+- qdisc_destroy(priv->qdiscs[ntx]);
++ qdisc_put(priv->qdiscs[ntx]);
+ kfree(priv->qdiscs);
+ }
+
+@@ -300,7 +300,7 @@ static void mqprio_attach(struct Qdisc *sch)
+ qdisc = priv->qdiscs[ntx];
+ old = dev_graft_qdisc(qdisc->dev_queue, qdisc);
+ if (old)
+- qdisc_destroy(old);
++ qdisc_put(old);
+ if (ntx < dev->real_num_tx_queues)
+ qdisc_hash_add(qdisc, false);
+ }
+diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
+index 1df78e361ef94..1c2f9a3ab1ca7 100644
+--- a/net/sched/sch_multiq.c
++++ b/net/sched/sch_multiq.c
+@@ -175,7 +175,7 @@ multiq_destroy(struct Qdisc *sch)
+
+ tcf_block_put(q->block);
+ for (band = 0; band < q->bands; band++)
+- qdisc_destroy(q->queues[band]);
++ qdisc_put(q->queues[band]);
+
+ kfree(q->queues);
+ }
+@@ -204,7 +204,7 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt,
+ q->queues[i] = &noop_qdisc;
+ qdisc_tree_reduce_backlog(child, child->q.qlen,
+ child->qstats.backlog);
+- qdisc_destroy(child);
++ qdisc_put(child);
+ }
+ }
+
+@@ -228,7 +228,7 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt,
+ qdisc_tree_reduce_backlog(old,
+ old->q.qlen,
+ old->qstats.backlog);
+- qdisc_destroy(old);
++ qdisc_put(old);
+ }
+ sch_tree_unlock(sch);
+ }
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 02d8d3fd84a5c..ad400f4f9a2d6 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -1054,7 +1054,7 @@ static void netem_destroy(struct Qdisc *sch)
+
+ qdisc_watchdog_cancel(&q->watchdog);
+ if (q->qdisc)
+- qdisc_destroy(q->qdisc);
++ qdisc_put(q->qdisc);
+ dist_free(q->delay_dist);
+ dist_free(q->slot_dist);
+ }
+diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
+index 1cbbd8c31405b..0e6f34bd9a683 100644
+--- a/net/sched/sch_prio.c
++++ b/net/sched/sch_prio.c
+@@ -175,7 +175,7 @@ prio_destroy(struct Qdisc *sch)
+ tcf_block_put(q->block);
+ prio_offload(sch, NULL);
+ for (prio = 0; prio < q->bands; prio++)
+- qdisc_destroy(q->queues[prio]);
++ qdisc_put(q->queues[prio]);
+ }
+
+ static int prio_tune(struct Qdisc *sch, struct nlattr *opt,
+@@ -205,7 +205,7 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt,
+ extack);
+ if (!queues[i]) {
+ while (i > oldbands)
+- qdisc_destroy(queues[--i]);
++ qdisc_put(queues[--i]);
+ return -ENOMEM;
+ }
+ }
+@@ -220,7 +220,7 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt,
+
+ qdisc_tree_reduce_backlog(child, child->q.qlen,
+ child->qstats.backlog);
+- qdisc_destroy(child);
++ qdisc_put(child);
+ }
+
+ for (i = oldbands; i < q->bands; i++) {
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index a93402fe1a9f8..fa6ad95fb6fb4 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -524,7 +524,7 @@ set_change_agg:
+ return 0;
+
+ destroy_class:
+- qdisc_destroy(cl->qdisc);
++ qdisc_put(cl->qdisc);
+ kfree(cl);
+ return err;
+ }
+@@ -535,7 +535,7 @@ static void qfq_destroy_class(struct Qdisc *sch, struct qfq_class *cl)
+
+ qfq_rm_from_agg(q, cl);
+ gen_kill_estimator(&cl->rate_est);
+- qdisc_destroy(cl->qdisc);
++ qdisc_put(cl->qdisc);
+ kfree(cl);
+ }
+
+diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
+index e42f890fa1478..0424aa747c341 100644
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -181,7 +181,7 @@ static void red_destroy(struct Qdisc *sch)
+
+ del_timer_sync(&q->adapt_timer);
+ red_offload(sch, false);
+- qdisc_destroy(q->qdisc);
++ qdisc_put(q->qdisc);
+ }
+
+ static const struct nla_policy red_policy[TCA_RED_MAX + 1] = {
+@@ -236,7 +236,7 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt,
+ if (child) {
+ qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
+ q->qdisc->qstats.backlog);
+- qdisc_destroy(q->qdisc);
++ qdisc_put(q->qdisc);
+ q->qdisc = child;
+ }
+
+diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
+index 1aa95e761671e..81d205acb1b6a 100644
+--- a/net/sched/sch_sfb.c
++++ b/net/sched/sch_sfb.c
+@@ -470,7 +470,7 @@ static void sfb_destroy(struct Qdisc *sch)
+ struct sfb_sched_data *q = qdisc_priv(sch);
+
+ tcf_block_put(q->block);
+- qdisc_destroy(q->qdisc);
++ qdisc_put(q->qdisc);
+ }
+
+ static const struct nla_policy sfb_policy[TCA_SFB_MAX + 1] = {
+@@ -524,7 +524,7 @@ static int sfb_change(struct Qdisc *sch, struct nlattr *opt,
+
+ qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
+ q->qdisc->qstats.backlog);
+- qdisc_destroy(q->qdisc);
++ qdisc_put(q->qdisc);
+ q->qdisc = child;
+
+ q->rehash_interval = msecs_to_jiffies(ctl->rehash_interval);
+diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
+index 6f74a426f159e..dd29de1418b76 100644
+--- a/net/sched/sch_tbf.c
++++ b/net/sched/sch_tbf.c
+@@ -392,7 +392,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt,
+ if (child) {
+ qdisc_tree_reduce_backlog(q->qdisc, q->qdisc->q.qlen,
+ q->qdisc->qstats.backlog);
+- qdisc_destroy(q->qdisc);
++ qdisc_put(q->qdisc);
+ q->qdisc = child;
+ }
+ q->limit = qopt->limit;
+@@ -438,7 +438,7 @@ static void tbf_destroy(struct Qdisc *sch)
+ struct tbf_sched_data *q = qdisc_priv(sch);
+
+ qdisc_watchdog_cancel(&q->watchdog);
+- qdisc_destroy(q->qdisc);
++ qdisc_put(q->qdisc);
+ }
+
+ static int tbf_dump(struct Qdisc *sch, struct sk_buff *skb)
+diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
+index 507fd5210c1cd..3fc216644e0e8 100644
+--- a/sound/core/control_compat.c
++++ b/sound/core/control_compat.c
+@@ -279,6 +279,7 @@ static int copy_ctl_value_to_user(void __user *userdata,
+ struct snd_ctl_elem_value *data,
+ int type, int count)
+ {
++ struct snd_ctl_elem_value32 __user *data32 = userdata;
+ int i, size;
+
+ if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN ||
+@@ -295,6 +296,8 @@ static int copy_ctl_value_to_user(void __user *userdata,
+ if (copy_to_user(valuep, data->value.bytes.data, size))
+ return -EFAULT;
+ }
++ if (copy_to_user(&data32->id, &data->id, sizeof(data32->id)))
++ return -EFAULT;
+ return 0;
+ }
+
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index 2a286167460f6..2b3bd6f31e4c1 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -162,7 +162,7 @@ snd_pcm_hw_param_value_min(const struct snd_pcm_hw_params *params,
+ *
+ * Return the maximum value for field PAR.
+ */
+-static unsigned int
++static int
+ snd_pcm_hw_param_value_max(const struct snd_pcm_hw_params *params,
+ snd_pcm_hw_param_t var, int *dir)
+ {
+@@ -697,18 +697,24 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream,
+ struct snd_pcm_hw_params *oss_params,
+ struct snd_pcm_hw_params *slave_params)
+ {
+- size_t s;
+- size_t oss_buffer_size, oss_period_size, oss_periods;
+- size_t min_period_size, max_period_size;
++ ssize_t s;
++ ssize_t oss_buffer_size;
++ ssize_t oss_period_size, oss_periods;
++ ssize_t min_period_size, max_period_size;
+ struct snd_pcm_runtime *runtime = substream->runtime;
+ size_t oss_frame_size;
+
+ oss_frame_size = snd_pcm_format_physical_width(params_format(oss_params)) *
+ params_channels(oss_params) / 8;
+
++ oss_buffer_size = snd_pcm_hw_param_value_max(slave_params,
++ SNDRV_PCM_HW_PARAM_BUFFER_SIZE,
++ NULL);
++ if (oss_buffer_size <= 0)
++ return -EINVAL;
+ oss_buffer_size = snd_pcm_plug_client_size(substream,
+- snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_BUFFER_SIZE, NULL)) * oss_frame_size;
+- if (!oss_buffer_size)
++ oss_buffer_size * oss_frame_size);
++ if (oss_buffer_size <= 0)
+ return -EINVAL;
+ oss_buffer_size = rounddown_pow_of_two(oss_buffer_size);
+ if (atomic_read(&substream->mmap_count)) {
+@@ -745,7 +751,7 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream,
+
+ min_period_size = snd_pcm_plug_client_size(substream,
+ snd_pcm_hw_param_value_min(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
+- if (min_period_size) {
++ if (min_period_size > 0) {
+ min_period_size *= oss_frame_size;
+ min_period_size = roundup_pow_of_two(min_period_size);
+ if (oss_period_size < min_period_size)
+@@ -754,7 +760,7 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream,
+
+ max_period_size = snd_pcm_plug_client_size(substream,
+ snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL));
+- if (max_period_size) {
++ if (max_period_size > 0) {
+ max_period_size *= oss_frame_size;
+ max_period_size = rounddown_pow_of_two(max_period_size);
+ if (oss_period_size > max_period_size)
+@@ -767,7 +773,7 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream,
+ oss_periods = substream->oss.setup.periods;
+
+ s = snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIODS, NULL);
+- if (runtime->oss.maxfrags && s > runtime->oss.maxfrags)
++ if (s > 0 && runtime->oss.maxfrags && s > runtime->oss.maxfrags)
+ s = runtime->oss.maxfrags;
+ if (oss_periods > s)
+ oss_periods = s;
+@@ -893,8 +899,15 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
+ err = -EINVAL;
+ goto failure;
+ }
+- choose_rate(substream, sparams, runtime->oss.rate);
+- snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_CHANNELS, runtime->oss.channels, NULL);
++
++ err = choose_rate(substream, sparams, runtime->oss.rate);
++ if (err < 0)
++ goto failure;
++ err = snd_pcm_hw_param_near(substream, sparams,
++ SNDRV_PCM_HW_PARAM_CHANNELS,
++ runtime->oss.channels, NULL);
++ if (err < 0)
++ goto failure;
+
+ format = snd_pcm_oss_format_from(runtime->oss.format);
+
+@@ -1961,7 +1974,7 @@ static int snd_pcm_oss_set_fragment1(struct snd_pcm_substream *substream, unsign
+ if (runtime->oss.subdivision || runtime->oss.fragshift)
+ return -EINVAL;
+ fragshift = val & 0xffff;
+- if (fragshift >= 31)
++ if (fragshift >= 25) /* should be large enough */
+ return -EINVAL;
+ runtime->oss.fragshift = fragshift;
+ runtime->oss.maxfrags = (val >> 16) & 0xffff;
+diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
+index 7d2c5de380317..33ec1a744ab9b 100644
+--- a/sound/soc/qcom/qdsp6/q6routing.c
++++ b/sound/soc/qcom/qdsp6/q6routing.c
+@@ -440,14 +440,16 @@ static int msm_routing_put_audio_mixer(struct snd_kcontrol *kcontrol,
+ struct session_data *session = &data->sessions[session_id];
+
+ if (ucontrol->value.integer.value[0]) {
++ if (session->port_id == be_id)
++ return 0;
++
+ session->port_id = be_id;
+ snd_soc_dapm_mixer_update_power(dapm, kcontrol, 1, update);
+ } else {
+- if (session->port_id == be_id) {
+- session->port_id = -1;
++ if (session->port_id == -1 || session->port_id != be_id)
+ return 0;
+- }
+
++ session->port_id = -1;
+ snd_soc_dapm_mixer_update_power(dapm, kcontrol, 0, update);
+ }
+
+diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
+index 7f91b6013ddc7..bbc9efa20dfaa 100644
+--- a/tools/build/Makefile.feature
++++ b/tools/build/Makefile.feature
+@@ -50,7 +50,6 @@ FEATURE_TESTS_BASIC := \
+ numa_num_possible_cpus \
+ libperl \
+ libpython \
+- libpython-version \
+ libslang \
+ libcrypto \
+ libunwind \
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index 6df574750bc9c..6696a4b79614a 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -29,7 +29,6 @@ FILES= \
+ test-numa_num_possible_cpus.bin \
+ test-libperl.bin \
+ test-libpython.bin \
+- test-libpython-version.bin \
+ test-libslang.bin \
+ test-libcrypto.bin \
+ test-libunwind.bin \
+@@ -203,9 +202,6 @@ $(OUTPUT)test-libperl.bin:
+ $(OUTPUT)test-libpython.bin:
+ $(BUILD) $(FLAGS_PYTHON_EMBED)
+
+-$(OUTPUT)test-libpython-version.bin:
+- $(BUILD)
+-
+ $(OUTPUT)test-libbfd.bin:
+ $(BUILD) -DPACKAGE='"perf"' -lbfd -ldl
+
+diff --git a/tools/build/feature/test-all.c b/tools/build/feature/test-all.c
+index 8282bbe547c4e..1004a8cd7ac3c 100644
+--- a/tools/build/feature/test-all.c
++++ b/tools/build/feature/test-all.c
+@@ -14,10 +14,6 @@
+ # include "test-libpython.c"
+ #undef main
+
+-#define main main_test_libpython_version
+-# include "test-libpython-version.c"
+-#undef main
+-
+ #define main main_test_libperl
+ # include "test-libperl.c"
+ #undef main
+@@ -181,7 +177,6 @@
+ int main(int argc, char *argv[])
+ {
+ main_test_libpython();
+- main_test_libpython_version();
+ main_test_libperl();
+ main_test_hello();
+ main_test_libelf();
+diff --git a/tools/build/feature/test-libpython-version.c b/tools/build/feature/test-libpython-version.c
+deleted file mode 100644
+index 47714b942d4d3..0000000000000
+--- a/tools/build/feature/test-libpython-version.c
++++ /dev/null
+@@ -1,11 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-#include <Python.h>
+-
+-#if PY_VERSION_HEX >= 0x03000000
+- #error
+-#endif
+-
+-int main(void)
+-{
+- return 0;
+-}
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index a328beb9f505c..8e59b42119176 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -224,8 +224,6 @@ endif
+
+ FEATURE_CHECK_CFLAGS-libpython := $(PYTHON_EMBED_CCOPTS)
+ FEATURE_CHECK_LDFLAGS-libpython := $(PYTHON_EMBED_LDOPTS)
+-FEATURE_CHECK_CFLAGS-libpython-version := $(PYTHON_EMBED_CCOPTS)
+-FEATURE_CHECK_LDFLAGS-libpython-version := $(PYTHON_EMBED_LDOPTS)
+
+ CFLAGS += -fno-omit-frame-pointer
+ CFLAGS += -ggdb3
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-12-22 14:07 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-12-22 14:07 UTC (permalink / raw
To: gentoo-commits
commit: 3e2fc91a7740493d363b499e66775cf6fa896fa3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 22 14:06:49 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 22 14:06:49 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3e2fc91a
Linux 4.19.222
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1221_linux-4.19.222.patch | 2422 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2426 insertions(+)
diff --git a/0000_README b/0000_README
index 03cf027a..7dda2480 100644
--- a/0000_README
+++ b/0000_README
@@ -923,6 +923,10 @@ Patch: 1220_linux-4.19.221.patch
From: https://www.kernel.org
Desc: Linux 4.19.221
+Patch: 1221_linux-4.19.222.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.222
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1221_linux-4.19.222.patch b/1221_linux-4.19.222.patch
new file mode 100644
index 00000000..1a273590
--- /dev/null
+++ b/1221_linux-4.19.222.patch
@@ -0,0 +1,2422 @@
+diff --git a/Makefile b/Makefile
+index c0676abcf60ff..aa6cdaebe18b2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 221
++SUBLEVEL = 222
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -1158,7 +1158,7 @@ endef
+
+ define filechk_version.h
+ (echo \#define LINUX_VERSION_CODE $(shell \
+- expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 0$(SUBLEVEL)); \
++ expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 255); \
+ echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))';)
+ endef
+
+diff --git a/arch/Kconfig b/arch/Kconfig
+index e3a030f7a7226..dd71b34fe4f5f 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -870,6 +870,9 @@ config HAVE_ARCH_PREL32_RELOCATIONS
+ architectures, and don't require runtime relocation on relocatable
+ kernels.
+
++config ARCH_USE_MEMREMAP_PROT
++ bool
++
+ source "kernel/gcov/Kconfig"
+
+ source "scripts/gcc-plugins/Kconfig"
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index bee0ba1d1cfb7..01c760929c9e4 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -45,30 +45,42 @@ config DEBUG_WX
+
+ If in doubt, say "Y".
+
+-# RMK wants arm kernels compiled with frame pointers or stack unwinding.
+-# If you know what you are doing and are willing to live without stack
+-# traces, you can get a slightly smaller kernel by setting this option to
+-# n, but then RMK will have to kill you ;).
+-config FRAME_POINTER
+- bool
+- depends on !THUMB2_KERNEL
+- default y if !ARM_UNWIND || FUNCTION_GRAPH_TRACER
++choice
++ prompt "Choose kernel unwinder"
++ default UNWINDER_ARM if AEABI && !FUNCTION_GRAPH_TRACER
++ default UNWINDER_FRAME_POINTER if !AEABI || FUNCTION_GRAPH_TRACER
++ help
++ This determines which method will be used for unwinding kernel stack
++ traces for panics, oopses, bugs, warnings, perf, /proc/<pid>/stack,
++ livepatch, lockdep, and more.
++
++config UNWINDER_FRAME_POINTER
++ bool "Frame pointer unwinder"
++ depends on !THUMB2_KERNEL && !CC_IS_CLANG
++ select ARCH_WANT_FRAME_POINTERS
++ select FRAME_POINTER
+ help
+- If you say N here, the resulting kernel will be slightly smaller and
+- faster. However, if neither FRAME_POINTER nor ARM_UNWIND are enabled,
+- when a problem occurs with the kernel, the information that is
+- reported is severely limited.
++ This option enables the frame pointer unwinder for unwinding
++ kernel stack traces.
+
+-config ARM_UNWIND
+- bool "Enable stack unwinding support (EXPERIMENTAL)"
++config UNWINDER_ARM
++ bool "ARM EABI stack unwinder"
+ depends on AEABI
+- default y
++ select ARM_UNWIND
+ help
+ This option enables stack unwinding support in the kernel
+ using the information automatically generated by the
+ compiler. The resulting kernel image is slightly bigger but
+ the performance is not affected. Currently, this feature
+- only works with EABI compilers. If unsure say Y.
++ only works with EABI compilers.
++
++endchoice
++
++config ARM_UNWIND
++ bool
++
++config FRAME_POINTER
++ bool
+
+ config OLD_MCOUNT
+ bool
+diff --git a/arch/arm/boot/dts/imx6ull-pinfunc.h b/arch/arm/boot/dts/imx6ull-pinfunc.h
+index 3c12a6fb0b618..1aea67f8ac236 100644
+--- a/arch/arm/boot/dts/imx6ull-pinfunc.h
++++ b/arch/arm/boot/dts/imx6ull-pinfunc.h
+@@ -68,6 +68,6 @@
+ #define MX6ULL_PAD_CSI_DATA04__ESAI_TX_FS 0x01F4 0x0480 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA05__ESAI_TX_CLK 0x01F8 0x0484 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA06__ESAI_TX5_RX0 0x01FC 0x0488 0x0000 0x9 0x0
+-#define MX6ULL_PAD_CSI_DATA07__ESAI_T0 0x0200 0x048C 0x0000 0x9 0x0
++#define MX6ULL_PAD_CSI_DATA07__ESAI_TX0 0x0200 0x048C 0x0000 0x9 0x0
+
+ #endif /* __DTS_IMX6ULL_PINFUNC_H */
+diff --git a/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts b/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts
+index beb2fc6b9eb63..adfdc43ac052f 100644
+--- a/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts
++++ b/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts
+@@ -23,7 +23,7 @@
+ flash0: n25q00@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "n25q00aa";
++ compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <100000000>;
+
+diff --git a/arch/arm/boot/dts/socfpga_arria5_socdk.dts b/arch/arm/boot/dts/socfpga_arria5_socdk.dts
+index aac4feea86f38..09ffa79240c84 100644
+--- a/arch/arm/boot/dts/socfpga_arria5_socdk.dts
++++ b/arch/arm/boot/dts/socfpga_arria5_socdk.dts
+@@ -131,7 +131,7 @@
+ flash: flash@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "n25q256a";
++ compatible = "micron,n25q256a", "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <100000000>;
+
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts b/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts
+index 155829f9eba16..907d8aa6d9fc8 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts
+@@ -136,7 +136,7 @@
+ flash0: n25q00@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "n25q00";
++ compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ reg = <0>; /* chip select */
+ spi-max-frequency = <100000000>;
+
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
+index a4a555c19d943..fe5fe4559969d 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
+@@ -181,7 +181,7 @@
+ flash: flash@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "n25q00";
++ compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <100000000>;
+
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts b/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts
+index 53bf99eef66de..0992cae3e60ef 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts
+@@ -87,7 +87,7 @@
+ flash: flash@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "n25q256a";
++ compatible = "micron,n25q256a", "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <100000000>;
+ m25p,fast-read;
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts b/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts
+index 8860dd2e242c4..22bfef024913a 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts
+@@ -128,7 +128,7 @@
+ flash0: n25q512a@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "n25q512a";
++ compatible = "micron,n25q512a", "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <100000000>;
+
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts b/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts
+index f50b19447de69..3412eb17a1587 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts
+@@ -249,7 +249,7 @@
+ n25q128@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "n25q128";
++ compatible = "micron,n25q128", "jedec,spi-nor";
+ reg = <0>; /* chip select */
+ spi-max-frequency = <100000000>;
+ m25p,fast-read;
+@@ -266,7 +266,7 @@
+ n25q00@1 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "n25q00";
++ compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ reg = <1>; /* chip select */
+ spi-max-frequency = <100000000>;
+ m25p,fast-read;
+diff --git a/arch/arm/mm/copypage-fa.c b/arch/arm/mm/copypage-fa.c
+index d130a5ece5d55..bf24690ec83af 100644
+--- a/arch/arm/mm/copypage-fa.c
++++ b/arch/arm/mm/copypage-fa.c
+@@ -17,26 +17,25 @@
+ /*
+ * Faraday optimised copy_user_page
+ */
+-static void __naked
+-fa_copy_user_page(void *kto, const void *kfrom)
++static void fa_copy_user_page(void *kto, const void *kfrom)
+ {
+- asm("\
+- stmfd sp!, {r4, lr} @ 2\n\
+- mov r2, %0 @ 1\n\
+-1: ldmia r1!, {r3, r4, ip, lr} @ 4\n\
+- stmia r0, {r3, r4, ip, lr} @ 4\n\
+- mcr p15, 0, r0, c7, c14, 1 @ 1 clean and invalidate D line\n\
+- add r0, r0, #16 @ 1\n\
+- ldmia r1!, {r3, r4, ip, lr} @ 4\n\
+- stmia r0, {r3, r4, ip, lr} @ 4\n\
+- mcr p15, 0, r0, c7, c14, 1 @ 1 clean and invalidate D line\n\
+- add r0, r0, #16 @ 1\n\
+- subs r2, r2, #1 @ 1\n\
++ int tmp;
++
++ asm volatile ("\
++1: ldmia %1!, {r3, r4, ip, lr} @ 4\n\
++ stmia %0, {r3, r4, ip, lr} @ 4\n\
++ mcr p15, 0, %0, c7, c14, 1 @ 1 clean and invalidate D line\n\
++ add %0, %0, #16 @ 1\n\
++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\
++ stmia %0, {r3, r4, ip, lr} @ 4\n\
++ mcr p15, 0, %0, c7, c14, 1 @ 1 clean and invalidate D line\n\
++ add %0, %0, #16 @ 1\n\
++ subs %2, %2, #1 @ 1\n\
+ bne 1b @ 1\n\
+- mcr p15, 0, r2, c7, c10, 4 @ 1 drain WB\n\
+- ldmfd sp!, {r4, pc} @ 3"
+- :
+- : "I" (PAGE_SIZE / 32));
++ mcr p15, 0, %2, c7, c10, 4 @ 1 drain WB"
++ : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp)
++ : "2" (PAGE_SIZE / 32)
++ : "r3", "r4", "ip", "lr");
+ }
+
+ void fa_copy_user_highpage(struct page *to, struct page *from,
+diff --git a/arch/arm/mm/copypage-feroceon.c b/arch/arm/mm/copypage-feroceon.c
+index 49ee0c1a72097..cc819732d9b82 100644
+--- a/arch/arm/mm/copypage-feroceon.c
++++ b/arch/arm/mm/copypage-feroceon.c
+@@ -13,58 +13,56 @@
+ #include <linux/init.h>
+ #include <linux/highmem.h>
+
+-static void __naked
+-feroceon_copy_user_page(void *kto, const void *kfrom)
++static void feroceon_copy_user_page(void *kto, const void *kfrom)
+ {
+- asm("\
+- stmfd sp!, {r4-r9, lr} \n\
+- mov ip, %2 \n\
+-1: mov lr, r1 \n\
+- ldmia r1!, {r2 - r9} \n\
+- pld [lr, #32] \n\
+- pld [lr, #64] \n\
+- pld [lr, #96] \n\
+- pld [lr, #128] \n\
+- pld [lr, #160] \n\
+- pld [lr, #192] \n\
+- pld [lr, #224] \n\
+- stmia r0, {r2 - r9} \n\
+- ldmia r1!, {r2 - r9} \n\
+- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\
+- add r0, r0, #32 \n\
+- stmia r0, {r2 - r9} \n\
+- ldmia r1!, {r2 - r9} \n\
+- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\
+- add r0, r0, #32 \n\
+- stmia r0, {r2 - r9} \n\
+- ldmia r1!, {r2 - r9} \n\
+- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\
+- add r0, r0, #32 \n\
+- stmia r0, {r2 - r9} \n\
+- ldmia r1!, {r2 - r9} \n\
+- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\
+- add r0, r0, #32 \n\
+- stmia r0, {r2 - r9} \n\
+- ldmia r1!, {r2 - r9} \n\
+- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\
+- add r0, r0, #32 \n\
+- stmia r0, {r2 - r9} \n\
+- ldmia r1!, {r2 - r9} \n\
+- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\
+- add r0, r0, #32 \n\
+- stmia r0, {r2 - r9} \n\
+- ldmia r1!, {r2 - r9} \n\
+- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\
+- add r0, r0, #32 \n\
+- stmia r0, {r2 - r9} \n\
+- subs ip, ip, #(32 * 8) \n\
+- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\
+- add r0, r0, #32 \n\
++ int tmp;
++
++ asm volatile ("\
++1: ldmia %1!, {r2 - r7, ip, lr} \n\
++ pld [%1, #0] \n\
++ pld [%1, #32] \n\
++ pld [%1, #64] \n\
++ pld [%1, #96] \n\
++ pld [%1, #128] \n\
++ pld [%1, #160] \n\
++ pld [%1, #192] \n\
++ stmia %0, {r2 - r7, ip, lr} \n\
++ ldmia %1!, {r2 - r7, ip, lr} \n\
++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\
++ add %0, %0, #32 \n\
++ stmia %0, {r2 - r7, ip, lr} \n\
++ ldmia %1!, {r2 - r7, ip, lr} \n\
++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\
++ add %0, %0, #32 \n\
++ stmia %0, {r2 - r7, ip, lr} \n\
++ ldmia %1!, {r2 - r7, ip, lr} \n\
++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\
++ add %0, %0, #32 \n\
++ stmia %0, {r2 - r7, ip, lr} \n\
++ ldmia %1!, {r2 - r7, ip, lr} \n\
++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\
++ add %0, %0, #32 \n\
++ stmia %0, {r2 - r7, ip, lr} \n\
++ ldmia %1!, {r2 - r7, ip, lr} \n\
++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\
++ add %0, %0, #32 \n\
++ stmia %0, {r2 - r7, ip, lr} \n\
++ ldmia %1!, {r2 - r7, ip, lr} \n\
++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\
++ add %0, %0, #32 \n\
++ stmia %0, {r2 - r7, ip, lr} \n\
++ ldmia %1!, {r2 - r7, ip, lr} \n\
++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\
++ add %0, %0, #32 \n\
++ stmia %0, {r2 - r7, ip, lr} \n\
++ subs %2, %2, #(32 * 8) \n\
++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\
++ add %0, %0, #32 \n\
+ bne 1b \n\
+- mcr p15, 0, ip, c7, c10, 4 @ drain WB\n\
+- ldmfd sp!, {r4-r9, pc}"
+- :
+- : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE));
++ mcr p15, 0, %2, c7, c10, 4 @ drain WB"
++ : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp)
++ : "2" (PAGE_SIZE)
++ : "r2", "r3", "r4", "r5", "r6", "r7", "ip", "lr");
+ }
+
+ void feroceon_copy_user_highpage(struct page *to, struct page *from,
+diff --git a/arch/arm/mm/copypage-v4mc.c b/arch/arm/mm/copypage-v4mc.c
+index 0224416cba3c8..b03202cddddb2 100644
+--- a/arch/arm/mm/copypage-v4mc.c
++++ b/arch/arm/mm/copypage-v4mc.c
+@@ -40,12 +40,11 @@ static DEFINE_RAW_SPINLOCK(minicache_lock);
+ * instruction. If your processor does not supply this, you have to write your
+ * own copy_user_highpage that does the right thing.
+ */
+-static void __naked
+-mc_copy_user_page(void *from, void *to)
++static void mc_copy_user_page(void *from, void *to)
+ {
+- asm volatile(
+- "stmfd sp!, {r4, lr} @ 2\n\
+- mov r4, %2 @ 1\n\
++ int tmp;
++
++ asm volatile ("\
+ ldmia %0!, {r2, r3, ip, lr} @ 4\n\
+ 1: mcr p15, 0, %1, c7, c6, 1 @ 1 invalidate D line\n\
+ stmia %1!, {r2, r3, ip, lr} @ 4\n\
+@@ -55,13 +54,13 @@ mc_copy_user_page(void *from, void *to)
+ mcr p15, 0, %1, c7, c6, 1 @ 1 invalidate D line\n\
+ stmia %1!, {r2, r3, ip, lr} @ 4\n\
+ ldmia %0!, {r2, r3, ip, lr} @ 4\n\
+- subs r4, r4, #1 @ 1\n\
++ subs %2, %2, #1 @ 1\n\
+ stmia %1!, {r2, r3, ip, lr} @ 4\n\
+ ldmneia %0!, {r2, r3, ip, lr} @ 4\n\
+- bne 1b @ 1\n\
+- ldmfd sp!, {r4, pc} @ 3"
+- :
+- : "r" (from), "r" (to), "I" (PAGE_SIZE / 64));
++ bne 1b @ "
++ : "+&r" (from), "+&r" (to), "=&r" (tmp)
++ : "2" (PAGE_SIZE / 64)
++ : "r2", "r3", "ip", "lr");
+ }
+
+ void v4_mc_copy_user_highpage(struct page *to, struct page *from,
+diff --git a/arch/arm/mm/copypage-v4wb.c b/arch/arm/mm/copypage-v4wb.c
+index 067d0fdd630c1..cd3e165afeede 100644
+--- a/arch/arm/mm/copypage-v4wb.c
++++ b/arch/arm/mm/copypage-v4wb.c
+@@ -22,29 +22,28 @@
+ * instruction. If your processor does not supply this, you have to write your
+ * own copy_user_highpage that does the right thing.
+ */
+-static void __naked
+-v4wb_copy_user_page(void *kto, const void *kfrom)
++static void v4wb_copy_user_page(void *kto, const void *kfrom)
+ {
+- asm("\
+- stmfd sp!, {r4, lr} @ 2\n\
+- mov r2, %2 @ 1\n\
+- ldmia r1!, {r3, r4, ip, lr} @ 4\n\
+-1: mcr p15, 0, r0, c7, c6, 1 @ 1 invalidate D line\n\
+- stmia r0!, {r3, r4, ip, lr} @ 4\n\
+- ldmia r1!, {r3, r4, ip, lr} @ 4+1\n\
+- stmia r0!, {r3, r4, ip, lr} @ 4\n\
+- ldmia r1!, {r3, r4, ip, lr} @ 4\n\
+- mcr p15, 0, r0, c7, c6, 1 @ 1 invalidate D line\n\
+- stmia r0!, {r3, r4, ip, lr} @ 4\n\
+- ldmia r1!, {r3, r4, ip, lr} @ 4\n\
+- subs r2, r2, #1 @ 1\n\
+- stmia r0!, {r3, r4, ip, lr} @ 4\n\
+- ldmneia r1!, {r3, r4, ip, lr} @ 4\n\
++ int tmp;
++
++ asm volatile ("\
++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\
++1: mcr p15, 0, %0, c7, c6, 1 @ 1 invalidate D line\n\
++ stmia %0!, {r3, r4, ip, lr} @ 4\n\
++ ldmia %1!, {r3, r4, ip, lr} @ 4+1\n\
++ stmia %0!, {r3, r4, ip, lr} @ 4\n\
++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\
++ mcr p15, 0, %0, c7, c6, 1 @ 1 invalidate D line\n\
++ stmia %0!, {r3, r4, ip, lr} @ 4\n\
++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\
++ subs %2, %2, #1 @ 1\n\
++ stmia %0!, {r3, r4, ip, lr} @ 4\n\
++ ldmneia %1!, {r3, r4, ip, lr} @ 4\n\
+ bne 1b @ 1\n\
+- mcr p15, 0, r1, c7, c10, 4 @ 1 drain WB\n\
+- ldmfd sp!, {r4, pc} @ 3"
+- :
+- : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64));
++ mcr p15, 0, %1, c7, c10, 4 @ 1 drain WB"
++ : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp)
++ : "2" (PAGE_SIZE / 64)
++ : "r3", "r4", "ip", "lr");
+ }
+
+ void v4wb_copy_user_highpage(struct page *to, struct page *from,
+diff --git a/arch/arm/mm/copypage-v4wt.c b/arch/arm/mm/copypage-v4wt.c
+index b85c5da2e510e..8614572e1296b 100644
+--- a/arch/arm/mm/copypage-v4wt.c
++++ b/arch/arm/mm/copypage-v4wt.c
+@@ -20,27 +20,26 @@
+ * dirty data in the cache. However, we do have to ensure that
+ * subsequent reads are up to date.
+ */
+-static void __naked
+-v4wt_copy_user_page(void *kto, const void *kfrom)
++static void v4wt_copy_user_page(void *kto, const void *kfrom)
+ {
+- asm("\
+- stmfd sp!, {r4, lr} @ 2\n\
+- mov r2, %2 @ 1\n\
+- ldmia r1!, {r3, r4, ip, lr} @ 4\n\
+-1: stmia r0!, {r3, r4, ip, lr} @ 4\n\
+- ldmia r1!, {r3, r4, ip, lr} @ 4+1\n\
+- stmia r0!, {r3, r4, ip, lr} @ 4\n\
+- ldmia r1!, {r3, r4, ip, lr} @ 4\n\
+- stmia r0!, {r3, r4, ip, lr} @ 4\n\
+- ldmia r1!, {r3, r4, ip, lr} @ 4\n\
+- subs r2, r2, #1 @ 1\n\
+- stmia r0!, {r3, r4, ip, lr} @ 4\n\
+- ldmneia r1!, {r3, r4, ip, lr} @ 4\n\
++ int tmp;
++
++ asm volatile ("\
++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\
++1: stmia %0!, {r3, r4, ip, lr} @ 4\n\
++ ldmia %1!, {r3, r4, ip, lr} @ 4+1\n\
++ stmia %0!, {r3, r4, ip, lr} @ 4\n\
++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\
++ stmia %0!, {r3, r4, ip, lr} @ 4\n\
++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\
++ subs %2, %2, #1 @ 1\n\
++ stmia %0!, {r3, r4, ip, lr} @ 4\n\
++ ldmneia %1!, {r3, r4, ip, lr} @ 4\n\
+ bne 1b @ 1\n\
+- mcr p15, 0, r2, c7, c7, 0 @ flush ID cache\n\
+- ldmfd sp!, {r4, pc} @ 3"
+- :
+- : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64));
++ mcr p15, 0, %2, c7, c7, 0 @ flush ID cache"
++ : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp)
++ : "2" (PAGE_SIZE / 64)
++ : "r3", "r4", "ip", "lr");
+ }
+
+ void v4wt_copy_user_highpage(struct page *to, struct page *from,
+diff --git a/arch/arm/mm/copypage-xsc3.c b/arch/arm/mm/copypage-xsc3.c
+index 03a2042aced5f..55cbc3a89d858 100644
+--- a/arch/arm/mm/copypage-xsc3.c
++++ b/arch/arm/mm/copypage-xsc3.c
+@@ -21,53 +21,46 @@
+
+ /*
+ * XSC3 optimised copy_user_highpage
+- * r0 = destination
+- * r1 = source
+ *
+ * The source page may have some clean entries in the cache already, but we
+ * can safely ignore them - break_cow() will flush them out of the cache
+ * if we eventually end up using our copied page.
+ *
+ */
+-static void __naked
+-xsc3_mc_copy_user_page(void *kto, const void *kfrom)
++static void xsc3_mc_copy_user_page(void *kto, const void *kfrom)
+ {
+- asm("\
+- stmfd sp!, {r4, r5, lr} \n\
+- mov lr, %2 \n\
+- \n\
+- pld [r1, #0] \n\
+- pld [r1, #32] \n\
+-1: pld [r1, #64] \n\
+- pld [r1, #96] \n\
++ int tmp;
++
++ asm volatile ("\
++ pld [%1, #0] \n\
++ pld [%1, #32] \n\
++1: pld [%1, #64] \n\
++ pld [%1, #96] \n\
+ \n\
+-2: ldrd r2, [r1], #8 \n\
+- mov ip, r0 \n\
+- ldrd r4, [r1], #8 \n\
+- mcr p15, 0, ip, c7, c6, 1 @ invalidate\n\
+- strd r2, [r0], #8 \n\
+- ldrd r2, [r1], #8 \n\
+- strd r4, [r0], #8 \n\
+- ldrd r4, [r1], #8 \n\
+- strd r2, [r0], #8 \n\
+- strd r4, [r0], #8 \n\
+- ldrd r2, [r1], #8 \n\
+- mov ip, r0 \n\
+- ldrd r4, [r1], #8 \n\
+- mcr p15, 0, ip, c7, c6, 1 @ invalidate\n\
+- strd r2, [r0], #8 \n\
+- ldrd r2, [r1], #8 \n\
+- subs lr, lr, #1 \n\
+- strd r4, [r0], #8 \n\
+- ldrd r4, [r1], #8 \n\
+- strd r2, [r0], #8 \n\
+- strd r4, [r0], #8 \n\
++2: ldrd r2, [%1], #8 \n\
++ ldrd r4, [%1], #8 \n\
++ mcr p15, 0, %0, c7, c6, 1 @ invalidate\n\
++ strd r2, [%0], #8 \n\
++ ldrd r2, [%1], #8 \n\
++ strd r4, [%0], #8 \n\
++ ldrd r4, [%1], #8 \n\
++ strd r2, [%0], #8 \n\
++ strd r4, [%0], #8 \n\
++ ldrd r2, [%1], #8 \n\
++ ldrd r4, [%1], #8 \n\
++ mcr p15, 0, %0, c7, c6, 1 @ invalidate\n\
++ strd r2, [%0], #8 \n\
++ ldrd r2, [%1], #8 \n\
++ subs %2, %2, #1 \n\
++ strd r4, [%0], #8 \n\
++ ldrd r4, [%1], #8 \n\
++ strd r2, [%0], #8 \n\
++ strd r4, [%0], #8 \n\
+ bgt 1b \n\
+- beq 2b \n\
+- \n\
+- ldmfd sp!, {r4, r5, pc}"
+- :
+- : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64 - 1));
++ beq 2b "
++ : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp)
++ : "2" (PAGE_SIZE / 64 - 1)
++ : "r2", "r3", "r4", "r5");
+ }
+
+ void xsc3_mc_copy_user_highpage(struct page *to, struct page *from,
+@@ -85,8 +78,6 @@ void xsc3_mc_copy_user_highpage(struct page *to, struct page *from,
+
+ /*
+ * XScale optimised clear_user_page
+- * r0 = destination
+- * r1 = virtual user address of ultimate destination page
+ */
+ void xsc3_mc_clear_user_highpage(struct page *page, unsigned long vaddr)
+ {
+diff --git a/arch/arm/mm/copypage-xscale.c b/arch/arm/mm/copypage-xscale.c
+index 97972379f4d6a..b0ae8c7acb488 100644
+--- a/arch/arm/mm/copypage-xscale.c
++++ b/arch/arm/mm/copypage-xscale.c
+@@ -36,52 +36,51 @@ static DEFINE_RAW_SPINLOCK(minicache_lock);
+ * Dcache aliasing issue. The writes will be forwarded to the write buffer,
+ * and merged as appropriate.
+ */
+-static void __naked
+-mc_copy_user_page(void *from, void *to)
++static void mc_copy_user_page(void *from, void *to)
+ {
++ int tmp;
++
+ /*
+ * Strangely enough, best performance is achieved
+ * when prefetching destination as well. (NP)
+ */
+- asm volatile(
+- "stmfd sp!, {r4, r5, lr} \n\
+- mov lr, %2 \n\
+- pld [r0, #0] \n\
+- pld [r0, #32] \n\
+- pld [r1, #0] \n\
+- pld [r1, #32] \n\
+-1: pld [r0, #64] \n\
+- pld [r0, #96] \n\
+- pld [r1, #64] \n\
+- pld [r1, #96] \n\
+-2: ldrd r2, [r0], #8 \n\
+- ldrd r4, [r0], #8 \n\
+- mov ip, r1 \n\
+- strd r2, [r1], #8 \n\
+- ldrd r2, [r0], #8 \n\
+- strd r4, [r1], #8 \n\
+- ldrd r4, [r0], #8 \n\
+- strd r2, [r1], #8 \n\
+- strd r4, [r1], #8 \n\
++ asm volatile ("\
++ pld [%0, #0] \n\
++ pld [%0, #32] \n\
++ pld [%1, #0] \n\
++ pld [%1, #32] \n\
++1: pld [%0, #64] \n\
++ pld [%0, #96] \n\
++ pld [%1, #64] \n\
++ pld [%1, #96] \n\
++2: ldrd r2, [%0], #8 \n\
++ ldrd r4, [%0], #8 \n\
++ mov ip, %1 \n\
++ strd r2, [%1], #8 \n\
++ ldrd r2, [%0], #8 \n\
++ strd r4, [%1], #8 \n\
++ ldrd r4, [%0], #8 \n\
++ strd r2, [%1], #8 \n\
++ strd r4, [%1], #8 \n\
+ mcr p15, 0, ip, c7, c10, 1 @ clean D line\n\
+- ldrd r2, [r0], #8 \n\
++ ldrd r2, [%0], #8 \n\
+ mcr p15, 0, ip, c7, c6, 1 @ invalidate D line\n\
+- ldrd r4, [r0], #8 \n\
+- mov ip, r1 \n\
+- strd r2, [r1], #8 \n\
+- ldrd r2, [r0], #8 \n\
+- strd r4, [r1], #8 \n\
+- ldrd r4, [r0], #8 \n\
+- strd r2, [r1], #8 \n\
+- strd r4, [r1], #8 \n\
++ ldrd r4, [%0], #8 \n\
++ mov ip, %1 \n\
++ strd r2, [%1], #8 \n\
++ ldrd r2, [%0], #8 \n\
++ strd r4, [%1], #8 \n\
++ ldrd r4, [%0], #8 \n\
++ strd r2, [%1], #8 \n\
++ strd r4, [%1], #8 \n\
+ mcr p15, 0, ip, c7, c10, 1 @ clean D line\n\
+- subs lr, lr, #1 \n\
++ subs %2, %2, #1 \n\
+ mcr p15, 0, ip, c7, c6, 1 @ invalidate D line\n\
+ bgt 1b \n\
+- beq 2b \n\
+- ldmfd sp!, {r4, r5, pc} "
+- :
+- : "r" (from), "r" (to), "I" (PAGE_SIZE / 64 - 1));
++ beq 2b "
++ : "+&r" (from), "+&r" (to), "=&r" (tmp)
++ : "2" (PAGE_SIZE / 64 - 1)
++ : "r2", "r3", "r4", "r5", "ip");
+ }
+
+ void xscale_mc_copy_user_highpage(struct page *to, struct page *from,
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 6348b0964e9cb..be4403a8e1b41 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -1489,6 +1489,7 @@ config AMD_MEM_ENCRYPT
+ bool "AMD Secure Memory Encryption (SME) support"
+ depends on X86_64 && CPU_SUP_AMD
+ select DYNAMIC_PHYSICAL_MASK
++ select ARCH_USE_MEMREMAP_PROT
+ ---help---
+ Say yes to enable support for the encryption of system memory.
+ This requires an AMD processor that supports Secure Memory
+@@ -1507,10 +1508,6 @@ config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
+ If set to N, then the encryption of system memory can be
+ activated with the mem_encrypt=on command line option.
+
+-config ARCH_USE_MEMREMAP_PROT
+- def_bool y
+- depends on AMD_MEM_ENCRYPT
+-
+ # Common NUMA Features
+ config NUMA
+ bool "Numa Memory Allocation and Scheduler Support"
+@@ -1953,6 +1950,7 @@ config EFI
+ depends on ACPI
+ select UCS2_STRING
+ select EFI_RUNTIME_WRAPPERS
++ select ARCH_USE_MEMREMAP_PROT
+ ---help---
+ This enables the kernel to use EFI runtime services that are
+ available (such as the EFI variable services).
+diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
+index c63a545ec1995..adc77904fc3ed 100644
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -697,7 +697,7 @@ bool phys_mem_access_encrypted(unsigned long phys_addr, unsigned long size)
+ return arch_memremap_can_ram_remap(phys_addr, size, 0);
+ }
+
+-#ifdef CONFIG_ARCH_USE_MEMREMAP_PROT
++#ifdef CONFIG_AMD_MEM_ENCRYPT
+ /* Remap memory with encryption */
+ void __init *early_memremap_encrypted(resource_size_t phys_addr,
+ unsigned long size)
+@@ -739,7 +739,7 @@ void __init *early_memremap_decrypted_wp(resource_size_t phys_addr,
+
+ return early_memremap_prot(phys_addr, size, __PAGE_KERNEL_NOENC_WP);
+ }
+-#endif /* CONFIG_ARCH_USE_MEMREMAP_PROT */
++#endif /* CONFIG_AMD_MEM_ENCRYPT */
+
+ static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
+
+diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
+index c9873c9168ad9..006eb09e95879 100644
+--- a/arch/x86/platform/efi/quirks.c
++++ b/arch/x86/platform/efi/quirks.c
+@@ -278,7 +278,8 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size)
+ return;
+ }
+
+- new = early_memremap(new_phys, new_size);
++ new = early_memremap_prot(new_phys, new_size,
++ pgprot_val(pgprot_encrypted(FIXMAP_PAGE_NORMAL)));
+ if (!new) {
+ pr_err("Failed to map new boot services memmap\n");
+ return;
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index e7af41d95490d..0950d6fda89cf 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -3181,8 +3181,19 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
+ goto invalid_fld;
+ }
+
+- if (ata_is_ncq(tf->protocol) && (cdb[2 + cdb_offset] & 0x3) == 0)
+- tf->protocol = ATA_PROT_NCQ_NODATA;
++ if ((cdb[2 + cdb_offset] & 0x3) == 0) {
++ /*
++ * When T_LENGTH is zero (No data is transferred), dir should
++ * be DMA_NONE.
++ */
++ if (scmd->sc_data_direction != DMA_NONE) {
++ fp = 2 + cdb_offset;
++ goto invalid_fld;
++ }
++
++ if (ata_is_ncq(tf->protocol))
++ tf->protocol = ATA_PROT_NCQ_NODATA;
++ }
+
+ /* enable LBA */
+ tf->flags |= ATA_TFLAG_LBA;
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index bd756b294d307..a9e07d09b230d 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1565,9 +1565,12 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+ unsigned long flags;
+ struct blkfront_ring_info *rinfo = (struct blkfront_ring_info *)dev_id;
+ struct blkfront_info *info = rinfo->dev_info;
++ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS;
+
+- if (unlikely(info->connected != BLKIF_STATE_CONNECTED))
++ if (unlikely(info->connected != BLKIF_STATE_CONNECTED)) {
++ xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
+ return IRQ_HANDLED;
++ }
+
+ spin_lock_irqsave(&rinfo->ring_lock, flags);
+ again:
+@@ -1583,6 +1586,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+ unsigned long id;
+ unsigned int op;
+
++ eoiflag = 0;
++
+ RING_COPY_RESPONSE(&rinfo->ring, i, &bret);
+ id = bret.id;
+
+@@ -1698,6 +1703,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+
+ spin_unlock_irqrestore(&rinfo->ring_lock, flags);
+
++ xen_irq_lateeoi(irq, eoiflag);
++
+ return IRQ_HANDLED;
+
+ err:
+@@ -1705,6 +1712,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+
+ spin_unlock_irqrestore(&rinfo->ring_lock, flags);
+
++ /* No EOI in order to avoid further interrupts. */
++
+ pr_alert("%s disabled for further use\n", info->gd->disk_name);
+ return IRQ_HANDLED;
+ }
+@@ -1744,8 +1753,8 @@ static int setup_blkring(struct xenbus_device *dev,
+ if (err)
+ goto fail;
+
+- err = bind_evtchn_to_irqhandler(rinfo->evtchn, blkif_interrupt, 0,
+- "blkif", rinfo);
++ err = bind_evtchn_to_irqhandler_lateeoi(rinfo->evtchn, blkif_interrupt,
++ 0, "blkif", rinfo);
+ if (err <= 0) {
+ xenbus_dev_fatal(dev, err,
+ "bind_evtchn_to_irqhandler failed");
+diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
+index 15f2e7025b78e..1d5510cb6db4e 100644
+--- a/drivers/char/agp/parisc-agp.c
++++ b/drivers/char/agp/parisc-agp.c
+@@ -285,7 +285,7 @@ agp_ioc_init(void __iomem *ioc_regs)
+ return 0;
+ }
+
+-static int
++static int __init
+ lba_find_capability(int cap)
+ {
+ struct _parisc_agp_info *info = &parisc_agp_info;
+@@ -370,7 +370,7 @@ fail:
+ return error;
+ }
+
+-static int
++static int __init
+ find_quicksilver(struct device *dev, void *data)
+ {
+ struct parisc_device **lba = data;
+@@ -382,7 +382,7 @@ find_quicksilver(struct device *dev, void *data)
+ return 0;
+ }
+
+-static int
++static int __init
+ parisc_agp_init(void)
+ {
+ extern struct sba_device *sba_list;
+diff --git a/drivers/dma/st_fdma.c b/drivers/dma/st_fdma.c
+index bfb79bd0c6de5..087d22ba8a2f6 100644
+--- a/drivers/dma/st_fdma.c
++++ b/drivers/dma/st_fdma.c
+@@ -886,4 +886,4 @@ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("STMicroelectronics FDMA engine driver");
+ MODULE_AUTHOR("Ludovic.barre <Ludovic.barre@st.com>");
+ MODULE_AUTHOR("Peter Griffin <peter.griffin@linaro.org>");
+-MODULE_ALIAS("platform: " DRIVER_NAME);
++MODULE_ALIAS("platform:" DRIVER_NAME);
+diff --git a/drivers/firmware/scpi_pm_domain.c b/drivers/firmware/scpi_pm_domain.c
+index f395dec271131..a6e62a793fbe6 100644
+--- a/drivers/firmware/scpi_pm_domain.c
++++ b/drivers/firmware/scpi_pm_domain.c
+@@ -27,7 +27,6 @@ struct scpi_pm_domain {
+ struct generic_pm_domain genpd;
+ struct scpi_ops *ops;
+ u32 domain;
+- char name[30];
+ };
+
+ /*
+@@ -121,8 +120,13 @@ static int scpi_pm_domain_probe(struct platform_device *pdev)
+
+ scpi_pd->domain = i;
+ scpi_pd->ops = scpi_ops;
+- sprintf(scpi_pd->name, "%s.%d", np->name, i);
+- scpi_pd->genpd.name = scpi_pd->name;
++ scpi_pd->genpd.name = devm_kasprintf(dev, GFP_KERNEL,
++ "%s.%d", np->name, i);
++ if (!scpi_pd->genpd.name) {
++ dev_err(dev, "Failed to allocate genpd name:%s.%d\n",
++ np->name, i);
++ continue;
++ }
+ scpi_pd->genpd.power_off = scpi_pd_power_off;
+ scpi_pd->genpd.power_on = scpi_pd_power_on;
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 28794b1b15c10..d8ae6a23e6133 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -2198,8 +2198,8 @@ static void gfx_v9_0_init_pg(struct amdgpu_device *adev)
+ AMD_PG_SUPPORT_CP |
+ AMD_PG_SUPPORT_GDS |
+ AMD_PG_SUPPORT_RLC_SMU_HS)) {
+- WREG32(mmRLC_JUMP_TABLE_RESTORE,
+- adev->gfx.rlc.cp_table_gpu_addr >> 8);
++ WREG32_SOC15(GC, 0, mmRLC_JUMP_TABLE_RESTORE,
++ adev->gfx.rlc.cp_table_gpu_addr >> 8);
+ gfx_v9_0_init_gfx_power_gating(adev);
+ }
+ }
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 77dae147caf90..9abfb19ea7ede 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -1677,6 +1677,8 @@ static int dsi_host_parse_lane_data(struct msm_dsi_host *msm_host,
+ if (!prop) {
+ dev_dbg(dev,
+ "failed to find data lane mapping, using default\n");
++ /* Set the number of date lanes to 4 by default. */
++ msm_host->num_data_lanes = 4;
+ return 0;
+ }
+
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index 9d3ef879dc51e..f4d0b4986affd 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -591,15 +591,18 @@ static const struct file_operations i8k_fops = {
+ .unlocked_ioctl = i8k_ioctl,
+ };
+
++static struct proc_dir_entry *entry;
++
+ static void __init i8k_init_procfs(void)
+ {
+ /* Register the proc entry */
+- proc_create("i8k", 0, NULL, &i8k_fops);
++ entry = proc_create("i8k", 0, NULL, &i8k_fops);
+ }
+
+ static void __exit i8k_exit_procfs(void)
+ {
+- remove_proc_entry("i8k", NULL);
++ if (entry)
++ remove_proc_entry("i8k", NULL);
+ }
+
+ #else
+diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
+index b8a2728dd4b69..e76ad020a5420 100644
+--- a/drivers/i2c/busses/i2c-rk3x.c
++++ b/drivers/i2c/busses/i2c-rk3x.c
+@@ -425,8 +425,8 @@ static void rk3x_i2c_handle_read(struct rk3x_i2c *i2c, unsigned int ipd)
+ if (!(ipd & REG_INT_MBRF))
+ return;
+
+- /* ack interrupt */
+- i2c_writel(i2c, REG_INT_MBRF, REG_IPD);
++ /* ack interrupt (read also produces a spurious START flag, clear it too) */
++ i2c_writel(i2c, REG_INT_MBRF | REG_INT_START, REG_IPD);
+
+ /* Can only handle a maximum of 32 bytes at a time */
+ if (len > 32)
+diff --git a/drivers/input/touchscreen/of_touchscreen.c b/drivers/input/touchscreen/of_touchscreen.c
+index 9642f103b7268..b9baad7d34a75 100644
+--- a/drivers/input/touchscreen/of_touchscreen.c
++++ b/drivers/input/touchscreen/of_touchscreen.c
+@@ -80,8 +80,8 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch,
+ data_present = touchscreen_get_prop_u32(dev, "touchscreen-size-x",
+ input_abs_get_max(input,
+ axis) + 1,
+- &maximum) |
+- touchscreen_get_prop_u32(dev, "touchscreen-fuzz-x",
++ &maximum);
++ data_present |= touchscreen_get_prop_u32(dev, "touchscreen-fuzz-x",
+ input_abs_get_fuzz(input, axis),
+ &fuzz);
+ if (data_present)
+@@ -91,8 +91,8 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch,
+ data_present = touchscreen_get_prop_u32(dev, "touchscreen-size-y",
+ input_abs_get_max(input,
+ axis) + 1,
+- &maximum) |
+- touchscreen_get_prop_u32(dev, "touchscreen-fuzz-y",
++ &maximum);
++ data_present |= touchscreen_get_prop_u32(dev, "touchscreen-fuzz-y",
+ input_abs_get_fuzz(input, axis),
+ &fuzz);
+ if (data_present)
+@@ -102,11 +102,11 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch,
+ data_present = touchscreen_get_prop_u32(dev,
+ "touchscreen-max-pressure",
+ input_abs_get_max(input, axis),
+- &maximum) |
+- touchscreen_get_prop_u32(dev,
+- "touchscreen-fuzz-pressure",
+- input_abs_get_fuzz(input, axis),
+- &fuzz);
++ &maximum);
++ data_present |= touchscreen_get_prop_u32(dev,
++ "touchscreen-fuzz-pressure",
++ input_abs_get_fuzz(input, axis),
++ &fuzz);
+ if (data_present)
+ touchscreen_set_params(input, axis, maximum, fuzz);
+
+diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
+index 9e4d1212f4c16..63f2baed3c8a6 100644
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -423,9 +423,9 @@ static int rebalance_children(struct shadow_spine *s,
+
+ memcpy(n, dm_block_data(child),
+ dm_bm_block_size(dm_tm_get_bm(info->tm)));
+- dm_tm_unlock(info->tm, child);
+
+ dm_tm_dec(info->tm, dm_block_location(child));
++ dm_tm_unlock(info->tm, child);
+ return 0;
+ }
+
+diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+index 4713ba65e1c22..da2f282b1b3c3 100644
+--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
++++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+@@ -932,8 +932,6 @@ static int mxl111sf_init(struct dvb_usb_device *d)
+ .len = sizeof(eeprom), .buf = eeprom },
+ };
+
+- mutex_init(&state->msg_lock);
+-
+ ret = get_chip_info(state);
+ if (mxl_fail(ret))
+ pr_err("failed to get chip info during probe");
+@@ -1075,6 +1073,14 @@ static int mxl111sf_get_stream_config_dvbt(struct dvb_frontend *fe,
+ return 0;
+ }
+
++static int mxl111sf_probe(struct dvb_usb_device *dev)
++{
++ struct mxl111sf_state *state = d_to_priv(dev);
++
++ mutex_init(&state->msg_lock);
++ return 0;
++}
++
+ static struct dvb_usb_device_properties mxl111sf_props_dvbt = {
+ .driver_name = KBUILD_MODNAME,
+ .owner = THIS_MODULE,
+@@ -1084,6 +1090,7 @@ static struct dvb_usb_device_properties mxl111sf_props_dvbt = {
+ .generic_bulk_ctrl_endpoint = 0x02,
+ .generic_bulk_ctrl_endpoint_response = 0x81,
+
++ .probe = mxl111sf_probe,
+ .i2c_algo = &mxl111sf_i2c_algo,
+ .frontend_attach = mxl111sf_frontend_attach_dvbt,
+ .tuner_attach = mxl111sf_attach_tuner,
+@@ -1125,6 +1132,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc = {
+ .generic_bulk_ctrl_endpoint = 0x02,
+ .generic_bulk_ctrl_endpoint_response = 0x81,
+
++ .probe = mxl111sf_probe,
+ .i2c_algo = &mxl111sf_i2c_algo,
+ .frontend_attach = mxl111sf_frontend_attach_atsc,
+ .tuner_attach = mxl111sf_attach_tuner,
+@@ -1166,6 +1174,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mh = {
+ .generic_bulk_ctrl_endpoint = 0x02,
+ .generic_bulk_ctrl_endpoint_response = 0x81,
+
++ .probe = mxl111sf_probe,
+ .i2c_algo = &mxl111sf_i2c_algo,
+ .frontend_attach = mxl111sf_frontend_attach_mh,
+ .tuner_attach = mxl111sf_attach_tuner,
+@@ -1234,6 +1243,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc_mh = {
+ .generic_bulk_ctrl_endpoint = 0x02,
+ .generic_bulk_ctrl_endpoint_response = 0x81,
+
++ .probe = mxl111sf_probe,
+ .i2c_algo = &mxl111sf_i2c_algo,
+ .frontend_attach = mxl111sf_frontend_attach_atsc_mh,
+ .tuner_attach = mxl111sf_attach_tuner,
+@@ -1312,6 +1322,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury = {
+ .generic_bulk_ctrl_endpoint = 0x02,
+ .generic_bulk_ctrl_endpoint_response = 0x81,
+
++ .probe = mxl111sf_probe,
+ .i2c_algo = &mxl111sf_i2c_algo,
+ .frontend_attach = mxl111sf_frontend_attach_mercury,
+ .tuner_attach = mxl111sf_attach_tuner,
+@@ -1382,6 +1393,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury_mh = {
+ .generic_bulk_ctrl_endpoint = 0x02,
+ .generic_bulk_ctrl_endpoint_response = 0x81,
+
++ .probe = mxl111sf_probe,
+ .i2c_algo = &mxl111sf_i2c_algo,
+ .frontend_attach = mxl111sf_frontend_attach_mercury_mh,
+ .tuner_attach = mxl111sf_attach_tuner,
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 0c69becc3c177..b3fc8745b5807 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -120,9 +120,13 @@ static inline void tdma_port_write_desc_addr(struct bcm_sysport_priv *priv,
+ struct dma_desc *desc,
+ unsigned int port)
+ {
++ unsigned long desc_flags;
++
+ /* Ports are latched, so write upper address first */
++ spin_lock_irqsave(&priv->desc_lock, desc_flags);
+ tdma_writel(priv, desc->addr_status_len, TDMA_WRITE_PORT_HI(port));
+ tdma_writel(priv, desc->addr_lo, TDMA_WRITE_PORT_LO(port));
++ spin_unlock_irqrestore(&priv->desc_lock, desc_flags);
+ }
+
+ /* Ethtool operations */
+@@ -2003,6 +2007,7 @@ static int bcm_sysport_open(struct net_device *dev)
+ }
+
+ /* Initialize both hardware and software ring */
++ spin_lock_init(&priv->desc_lock);
+ for (i = 0; i < dev->num_tx_queues; i++) {
+ ret = bcm_sysport_init_tx_ring(priv, i);
+ if (ret) {
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
+index 36e0adf5c9b8e..f438b818136ae 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.h
++++ b/drivers/net/ethernet/broadcom/bcmsysport.h
+@@ -751,6 +751,7 @@ struct bcm_sysport_priv {
+ int wol_irq;
+
+ /* Transmit rings */
++ spinlock_t desc_lock;
+ struct bcm_sysport_tx_ring *tx_rings;
+
+ /* Receive queue */
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 6221dafc76b95..74b50f17832d1 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -7406,6 +7406,20 @@ static int igb_set_vf_mac_filter(struct igb_adapter *adapter, const int vf,
+ struct vf_mac_filter *entry = NULL;
+ int ret = 0;
+
++ if ((vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) &&
++ !vf_data->trusted) {
++ dev_warn(&pdev->dev,
++ "VF %d requested MAC filter but is administratively denied\n",
++ vf);
++ return -EINVAL;
++ }
++ if (!is_valid_ether_addr(addr)) {
++ dev_warn(&pdev->dev,
++ "VF %d attempted to set invalid MAC filter\n",
++ vf);
++ return -EINVAL;
++ }
++
+ switch (info) {
+ case E1000_VF_MAC_FILTER_CLR:
+ /* remove all unicast MAC filters related to the current VF */
+@@ -7419,20 +7433,6 @@ static int igb_set_vf_mac_filter(struct igb_adapter *adapter, const int vf,
+ }
+ break;
+ case E1000_VF_MAC_FILTER_ADD:
+- if ((vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) &&
+- !vf_data->trusted) {
+- dev_warn(&pdev->dev,
+- "VF %d requested MAC filter but is administratively denied\n",
+- vf);
+- return -EINVAL;
+- }
+- if (!is_valid_ether_addr(addr)) {
+- dev_warn(&pdev->dev,
+- "VF %d attempted to set invalid MAC filter\n",
+- vf);
+- return -EINVAL;
+- }
+-
+ /* try to find empty slot in the list */
+ list_for_each(pos, &adapter->vf_macs.l) {
+ entry = list_entry(pos, struct vf_mac_filter, l);
+diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
+index e0c989ffb2b3e..df827c2541628 100644
+--- a/drivers/net/ethernet/intel/igbvf/netdev.c
++++ b/drivers/net/ethernet/intel/igbvf/netdev.c
+@@ -2888,6 +2888,7 @@ static int igbvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ return 0;
+
+ err_hw_init:
++ netif_napi_del(&adapter->rx_ring->napi);
+ kfree(adapter->tx_ring);
+ kfree(adapter->rx_ring);
+ err_sw_init:
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+index 9772016222c30..9277d57c4a70b 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+@@ -3391,6 +3391,9 @@ static s32 ixgbe_reset_hw_X550em(struct ixgbe_hw *hw)
+ /* flush pending Tx transactions */
+ ixgbe_clear_tx_pending(hw);
+
++ /* set MDIO speed before talking to the PHY in case it's the 1st time */
++ ixgbe_set_mdio_speed(hw);
++
+ /* PHY ops must be identified and initialized prior to reset */
+ status = hw->phy.ops.init(hw);
+ if (status == IXGBE_ERR_SFP_NOT_SUPPORTED ||
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+index 6a005014d46af..f652cfd8127bf 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -663,7 +663,7 @@ void __init mlx4_en_init_ptys2ethtool_map(void)
+ MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_1000BASE_T, SPEED_1000,
+ ETHTOOL_LINK_MODE_1000baseT_Full_BIT);
+ MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_1000BASE_CX_SGMII, SPEED_1000,
+- ETHTOOL_LINK_MODE_1000baseKX_Full_BIT);
++ ETHTOOL_LINK_MODE_1000baseX_Full_BIT);
+ MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_1000BASE_KX, SPEED_1000,
+ ETHTOOL_LINK_MODE_1000baseKX_Full_BIT);
+ MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_T, SPEED_10000,
+@@ -675,9 +675,9 @@ void __init mlx4_en_init_ptys2ethtool_map(void)
+ MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_KR, SPEED_10000,
+ ETHTOOL_LINK_MODE_10000baseKR_Full_BIT);
+ MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_CR, SPEED_10000,
+- ETHTOOL_LINK_MODE_10000baseKR_Full_BIT);
++ ETHTOOL_LINK_MODE_10000baseCR_Full_BIT);
+ MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_SR, SPEED_10000,
+- ETHTOOL_LINK_MODE_10000baseKR_Full_BIT);
++ ETHTOOL_LINK_MODE_10000baseSR_Full_BIT);
+ MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_20GBASE_KR2, SPEED_20000,
+ ETHTOOL_LINK_MODE_20000baseMLD2_Full_BIT,
+ ETHTOOL_LINK_MODE_20000baseKR2_Full_BIT);
+diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
+index 81444208b2162..12f100392ed11 100644
+--- a/drivers/net/netdevsim/bpf.c
++++ b/drivers/net/netdevsim/bpf.c
+@@ -493,6 +493,7 @@ nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap)
+ goto err_free;
+ key = nmap->entry[i].key;
+ *key = i;
++ memset(nmap->entry[i].value, 0, offmap->map.value_size);
+ }
+ }
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index b328207c04555..f438be83d2594 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -945,11 +945,9 @@ static int lan78xx_read_otp(struct lan78xx_net *dev, u32 offset,
+ ret = lan78xx_read_raw_otp(dev, 0, 1, &sig);
+
+ if (ret == 0) {
+- if (sig == OTP_INDICATOR_1)
+- offset = offset;
+- else if (sig == OTP_INDICATOR_2)
++ if (sig == OTP_INDICATOR_2)
+ offset += 0x100;
+- else
++ else if (sig != OTP_INDICATOR_1)
+ ret = -EINVAL;
+ if (!ret)
+ ret = lan78xx_read_raw_otp(dev, offset, length, data);
+diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
+index 60db2b969e20d..b7ced103b8143 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c
++++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
+@@ -324,9 +324,9 @@ static int mwifiex_dnld_sleep_confirm_cmd(struct mwifiex_adapter *adapter)
+
+ adapter->seq_num++;
+ sleep_cfm_buf->seq_num =
+- cpu_to_le16((HostCmd_SET_SEQ_NO_BSS_INFO
++ cpu_to_le16(HostCmd_SET_SEQ_NO_BSS_INFO
+ (adapter->seq_num, priv->bss_num,
+- priv->bss_type)));
++ priv->bss_type));
+
+ mwifiex_dbg(adapter, CMD,
+ "cmd: DNLD_CMD: %#x, act %#x, len %d, seqno %#x\n",
+diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
+index 8b9d0809daf62..076ea1c4b921d 100644
+--- a/drivers/net/wireless/marvell/mwifiex/fw.h
++++ b/drivers/net/wireless/marvell/mwifiex/fw.h
+@@ -512,10 +512,10 @@ enum mwifiex_channel_flags {
+
+ #define RF_ANTENNA_AUTO 0xFFFF
+
+-#define HostCmd_SET_SEQ_NO_BSS_INFO(seq, num, type) { \
+- (((seq) & 0x00ff) | \
+- (((num) & 0x000f) << 8)) | \
+- (((type) & 0x000f) << 12); }
++#define HostCmd_SET_SEQ_NO_BSS_INFO(seq, num, type) \
++ ((((seq) & 0x00ff) | \
++ (((num) & 0x000f) << 8)) | \
++ (((type) & 0x000f) << 12))
+
+ #define HostCmd_GET_SEQ_NO(seq) \
+ ((seq) & HostCmd_SEQ_NUM_MASK)
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 86d23d0f563c4..751254dcee3b5 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -203,6 +203,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */
+ unsigned int rx_queue_max;
+ unsigned int rx_queue_len;
+ unsigned long last_rx_time;
++ unsigned int rx_slots_needed;
+ bool stalled;
+
+ struct xenvif_copy_state rx_copy;
+diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c
+index 48e2006f96ce6..7f68067c01745 100644
+--- a/drivers/net/xen-netback/rx.c
++++ b/drivers/net/xen-netback/rx.c
+@@ -33,28 +33,36 @@
+ #include <xen/xen.h>
+ #include <xen/events.h>
+
+-static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
++/*
++ * Update the needed ring page slots for the first SKB queued.
++ * Note that any call sequence outside the RX thread calling this function
++ * needs to wake up the RX thread via a call of xenvif_kick_thread()
++ * afterwards in order to avoid a race with putting the thread to sleep.
++ */
++static void xenvif_update_needed_slots(struct xenvif_queue *queue,
++ const struct sk_buff *skb)
+ {
+- RING_IDX prod, cons;
+- struct sk_buff *skb;
+- int needed;
+- unsigned long flags;
+-
+- spin_lock_irqsave(&queue->rx_queue.lock, flags);
++ unsigned int needed = 0;
+
+- skb = skb_peek(&queue->rx_queue);
+- if (!skb) {
+- spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
+- return false;
++ if (skb) {
++ needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE);
++ if (skb_is_gso(skb))
++ needed++;
++ if (skb->sw_hash)
++ needed++;
+ }
+
+- needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE);
+- if (skb_is_gso(skb))
+- needed++;
+- if (skb->sw_hash)
+- needed++;
++ WRITE_ONCE(queue->rx_slots_needed, needed);
++}
+
+- spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
++static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
++{
++ RING_IDX prod, cons;
++ unsigned int needed;
++
++ needed = READ_ONCE(queue->rx_slots_needed);
++ if (!needed)
++ return false;
+
+ do {
+ prod = queue->rx.sring->req_prod;
+@@ -80,13 +88,19 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
+
+ spin_lock_irqsave(&queue->rx_queue.lock, flags);
+
+- __skb_queue_tail(&queue->rx_queue, skb);
+-
+- queue->rx_queue_len += skb->len;
+- if (queue->rx_queue_len > queue->rx_queue_max) {
++ if (queue->rx_queue_len >= queue->rx_queue_max) {
+ struct net_device *dev = queue->vif->dev;
+
+ netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id));
++ kfree_skb(skb);
++ queue->vif->dev->stats.rx_dropped++;
++ } else {
++ if (skb_queue_empty(&queue->rx_queue))
++ xenvif_update_needed_slots(queue, skb);
++
++ __skb_queue_tail(&queue->rx_queue, skb);
++
++ queue->rx_queue_len += skb->len;
+ }
+
+ spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
+@@ -100,6 +114,8 @@ static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue)
+
+ skb = __skb_dequeue(&queue->rx_queue);
+ if (skb) {
++ xenvif_update_needed_slots(queue, skb_peek(&queue->rx_queue));
++
+ queue->rx_queue_len -= skb->len;
+ if (queue->rx_queue_len < queue->rx_queue_max) {
+ struct netdev_queue *txq;
+@@ -134,6 +150,7 @@ static void xenvif_rx_queue_drop_expired(struct xenvif_queue *queue)
+ break;
+ xenvif_rx_dequeue(queue);
+ kfree_skb(skb);
++ queue->vif->dev->stats.rx_dropped++;
+ }
+ }
+
+@@ -474,27 +491,31 @@ void xenvif_rx_action(struct xenvif_queue *queue)
+ xenvif_rx_copy_flush(queue);
+ }
+
+-static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue)
++static RING_IDX xenvif_rx_queue_slots(const struct xenvif_queue *queue)
+ {
+ RING_IDX prod, cons;
+
+ prod = queue->rx.sring->req_prod;
+ cons = queue->rx.req_cons;
+
++ return prod - cons;
++}
++
++static bool xenvif_rx_queue_stalled(const struct xenvif_queue *queue)
++{
++ unsigned int needed = READ_ONCE(queue->rx_slots_needed);
++
+ return !queue->stalled &&
+- prod - cons < 1 &&
++ xenvif_rx_queue_slots(queue) < needed &&
+ time_after(jiffies,
+ queue->last_rx_time + queue->vif->stall_timeout);
+ }
+
+ static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
+ {
+- RING_IDX prod, cons;
+-
+- prod = queue->rx.sring->req_prod;
+- cons = queue->rx.req_cons;
++ unsigned int needed = READ_ONCE(queue->rx_slots_needed);
+
+- return queue->stalled && prod - cons >= 1;
++ return queue->stalled && xenvif_rx_queue_slots(queue) >= needed;
+ }
+
+ bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread)
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 434a009c52d90..0e357a022388a 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -142,6 +142,9 @@ struct netfront_queue {
+ struct sk_buff *rx_skbs[NET_RX_RING_SIZE];
+ grant_ref_t gref_rx_head;
+ grant_ref_t grant_rx_ref[NET_RX_RING_SIZE];
++
++ unsigned int rx_rsp_unconsumed;
++ spinlock_t rx_cons_lock;
+ };
+
+ struct netfront_info {
+@@ -366,12 +369,13 @@ static int xennet_open(struct net_device *dev)
+ return 0;
+ }
+
+-static void xennet_tx_buf_gc(struct netfront_queue *queue)
++static bool xennet_tx_buf_gc(struct netfront_queue *queue)
+ {
+ RING_IDX cons, prod;
+ unsigned short id;
+ struct sk_buff *skb;
+ bool more_to_do;
++ bool work_done = false;
+ const struct device *dev = &queue->info->netdev->dev;
+
+ BUG_ON(!netif_carrier_ok(queue->info->netdev));
+@@ -388,6 +392,8 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue)
+ for (cons = queue->tx.rsp_cons; cons != prod; cons++) {
+ struct xen_netif_tx_response txrsp;
+
++ work_done = true;
++
+ RING_COPY_RESPONSE(&queue->tx, cons, &txrsp);
+ if (txrsp.status == XEN_NETIF_RSP_NULL)
+ continue;
+@@ -431,11 +437,13 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue)
+
+ xennet_maybe_wake_tx(queue);
+
+- return;
++ return work_done;
+
+ err:
+ queue->info->broken = true;
+ dev_alert(dev, "Disabled for further use\n");
++
++ return work_done;
+ }
+
+ struct xennet_gnttab_make_txreq {
+@@ -756,6 +764,16 @@ static int xennet_close(struct net_device *dev)
+ return 0;
+ }
+
++static void xennet_set_rx_rsp_cons(struct netfront_queue *queue, RING_IDX val)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&queue->rx_cons_lock, flags);
++ queue->rx.rsp_cons = val;
++ queue->rx_rsp_unconsumed = RING_HAS_UNCONSUMED_RESPONSES(&queue->rx);
++ spin_unlock_irqrestore(&queue->rx_cons_lock, flags);
++}
++
+ static void xennet_move_rx_slot(struct netfront_queue *queue, struct sk_buff *skb,
+ grant_ref_t ref)
+ {
+@@ -807,7 +825,7 @@ static int xennet_get_extras(struct netfront_queue *queue,
+ xennet_move_rx_slot(queue, skb, ref);
+ } while (extra.flags & XEN_NETIF_EXTRA_FLAG_MORE);
+
+- queue->rx.rsp_cons = cons;
++ xennet_set_rx_rsp_cons(queue, cons);
+ return err;
+ }
+
+@@ -887,7 +905,7 @@ next:
+ }
+
+ if (unlikely(err))
+- queue->rx.rsp_cons = cons + slots;
++ xennet_set_rx_rsp_cons(queue, cons + slots);
+
+ return err;
+ }
+@@ -941,7 +959,8 @@ static int xennet_fill_frags(struct netfront_queue *queue,
+ __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
+ }
+ if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+- queue->rx.rsp_cons = ++cons + skb_queue_len(list);
++ xennet_set_rx_rsp_cons(queue,
++ ++cons + skb_queue_len(list));
+ kfree_skb(nskb);
+ return -ENOENT;
+ }
+@@ -954,7 +973,7 @@ static int xennet_fill_frags(struct netfront_queue *queue,
+ kfree_skb(nskb);
+ }
+
+- queue->rx.rsp_cons = cons;
++ xennet_set_rx_rsp_cons(queue, cons);
+
+ return 0;
+ }
+@@ -1075,7 +1094,9 @@ err:
+
+ if (unlikely(xennet_set_skb_gso(skb, gso))) {
+ __skb_queue_head(&tmpq, skb);
+- queue->rx.rsp_cons += skb_queue_len(&tmpq);
++ xennet_set_rx_rsp_cons(queue,
++ queue->rx.rsp_cons +
++ skb_queue_len(&tmpq));
+ goto err;
+ }
+ }
+@@ -1099,7 +1120,8 @@ err:
+
+ __skb_queue_tail(&rxq, skb);
+
+- i = ++queue->rx.rsp_cons;
++ i = queue->rx.rsp_cons + 1;
++ xennet_set_rx_rsp_cons(queue, i);
+ work_done++;
+ }
+
+@@ -1261,40 +1283,79 @@ static int xennet_set_features(struct net_device *dev,
+ return 0;
+ }
+
+-static irqreturn_t xennet_tx_interrupt(int irq, void *dev_id)
++static bool xennet_handle_tx(struct netfront_queue *queue, unsigned int *eoi)
+ {
+- struct netfront_queue *queue = dev_id;
+ unsigned long flags;
+
+- if (queue->info->broken)
+- return IRQ_HANDLED;
++ if (unlikely(queue->info->broken))
++ return false;
+
+ spin_lock_irqsave(&queue->tx_lock, flags);
+- xennet_tx_buf_gc(queue);
++ if (xennet_tx_buf_gc(queue))
++ *eoi = 0;
+ spin_unlock_irqrestore(&queue->tx_lock, flags);
+
++ return true;
++}
++
++static irqreturn_t xennet_tx_interrupt(int irq, void *dev_id)
++{
++ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS;
++
++ if (likely(xennet_handle_tx(dev_id, &eoiflag)))
++ xen_irq_lateeoi(irq, eoiflag);
++
+ return IRQ_HANDLED;
+ }
+
+-static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id)
++static bool xennet_handle_rx(struct netfront_queue *queue, unsigned int *eoi)
+ {
+- struct netfront_queue *queue = dev_id;
+- struct net_device *dev = queue->info->netdev;
++ unsigned int work_queued;
++ unsigned long flags;
+
+- if (queue->info->broken)
+- return IRQ_HANDLED;
++ if (unlikely(queue->info->broken))
++ return false;
++
++ spin_lock_irqsave(&queue->rx_cons_lock, flags);
++ work_queued = RING_HAS_UNCONSUMED_RESPONSES(&queue->rx);
++ if (work_queued > queue->rx_rsp_unconsumed) {
++ queue->rx_rsp_unconsumed = work_queued;
++ *eoi = 0;
++ } else if (unlikely(work_queued < queue->rx_rsp_unconsumed)) {
++ const struct device *dev = &queue->info->netdev->dev;
++
++ spin_unlock_irqrestore(&queue->rx_cons_lock, flags);
++ dev_alert(dev, "RX producer index going backwards\n");
++ dev_alert(dev, "Disabled for further use\n");
++ queue->info->broken = true;
++ return false;
++ }
++ spin_unlock_irqrestore(&queue->rx_cons_lock, flags);
+
+- if (likely(netif_carrier_ok(dev) &&
+- RING_HAS_UNCONSUMED_RESPONSES(&queue->rx)))
++ if (likely(netif_carrier_ok(queue->info->netdev) && work_queued))
+ napi_schedule(&queue->napi);
+
++ return true;
++}
++
++static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id)
++{
++ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS;
++
++ if (likely(xennet_handle_rx(dev_id, &eoiflag)))
++ xen_irq_lateeoi(irq, eoiflag);
++
+ return IRQ_HANDLED;
+ }
+
+ static irqreturn_t xennet_interrupt(int irq, void *dev_id)
+ {
+- xennet_tx_interrupt(irq, dev_id);
+- xennet_rx_interrupt(irq, dev_id);
++ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS;
++
++ if (xennet_handle_tx(dev_id, &eoiflag) &&
++ xennet_handle_rx(dev_id, &eoiflag))
++ xen_irq_lateeoi(irq, eoiflag);
++
+ return IRQ_HANDLED;
+ }
+
+@@ -1528,9 +1589,10 @@ static int setup_netfront_single(struct netfront_queue *queue)
+ if (err < 0)
+ goto fail;
+
+- err = bind_evtchn_to_irqhandler(queue->tx_evtchn,
+- xennet_interrupt,
+- 0, queue->info->netdev->name, queue);
++ err = bind_evtchn_to_irqhandler_lateeoi(queue->tx_evtchn,
++ xennet_interrupt, 0,
++ queue->info->netdev->name,
++ queue);
+ if (err < 0)
+ goto bind_fail;
+ queue->rx_evtchn = queue->tx_evtchn;
+@@ -1558,18 +1620,18 @@ static int setup_netfront_split(struct netfront_queue *queue)
+
+ snprintf(queue->tx_irq_name, sizeof(queue->tx_irq_name),
+ "%s-tx", queue->name);
+- err = bind_evtchn_to_irqhandler(queue->tx_evtchn,
+- xennet_tx_interrupt,
+- 0, queue->tx_irq_name, queue);
++ err = bind_evtchn_to_irqhandler_lateeoi(queue->tx_evtchn,
++ xennet_tx_interrupt, 0,
++ queue->tx_irq_name, queue);
+ if (err < 0)
+ goto bind_tx_fail;
+ queue->tx_irq = err;
+
+ snprintf(queue->rx_irq_name, sizeof(queue->rx_irq_name),
+ "%s-rx", queue->name);
+- err = bind_evtchn_to_irqhandler(queue->rx_evtchn,
+- xennet_rx_interrupt,
+- 0, queue->rx_irq_name, queue);
++ err = bind_evtchn_to_irqhandler_lateeoi(queue->rx_evtchn,
++ xennet_rx_interrupt, 0,
++ queue->rx_irq_name, queue);
+ if (err < 0)
+ goto bind_rx_fail;
+ queue->rx_irq = err;
+@@ -1671,6 +1733,7 @@ static int xennet_init_queue(struct netfront_queue *queue)
+
+ spin_lock_init(&queue->tx_lock);
+ spin_lock_init(&queue->rx_lock);
++ spin_lock_init(&queue->rx_cons_lock);
+
+ timer_setup(&queue->rx_refill_timer, rx_refill_timeout, 0);
+
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index d42c84a2d2eba..c585ae3278de5 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -799,9 +799,6 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ goto out_disable;
+ }
+
+- /* Ensure that all table entries are masked. */
+- msix_mask_all(base, tsize);
+-
+ ret = msix_setup_entries(dev, base, entries, nvec, affd);
+ if (ret)
+ goto out_disable;
+@@ -824,6 +821,16 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ /* Set MSI-X enabled bits and unmask the function */
+ pci_intx_for_msi(dev, 0);
+ dev->msix_enabled = 1;
++
++ /*
++ * Ensure that all table entries are masked to prevent
++ * stale entries from firing in a crash kernel.
++ *
++ * Done late to deal with a broken Marvell NVME device
++ * which takes the MSI-X mask bits into account even
++ * when MSI-X is disabled, which prevents MSI delivery.
++ */
++ msix_mask_all(base, tsize);
+ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL, 0);
+
+ pcibios_free_irq(dev);
+@@ -850,7 +857,7 @@ out_free:
+ free_msi_irqs(dev);
+
+ out_disable:
+- pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0);
++ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0);
+
+ return ret;
+ }
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index d2b045eb72742..4d73a7f67dea9 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -2300,11 +2300,11 @@ static int resp_mode_select(struct scsi_cmnd *scp,
+ __func__, param_len, res);
+ md_len = mselect6 ? (arr[0] + 1) : (get_unaligned_be16(arr + 0) + 2);
+ bd_len = mselect6 ? arr[3] : get_unaligned_be16(arr + 6);
+- if (md_len > 2) {
++ off = bd_len + (mselect6 ? 4 : 8);
++ if (md_len > 2 || off >= res) {
+ mk_sense_invalid_fld(scp, SDEB_IN_DATA, 0, -1);
+ return check_condition_result;
+ }
+- off = bd_len + (mselect6 ? 4 : 8);
+ mpage = arr[off] & 0x3f;
+ ps = !!(arr[off] & 0x80);
+ if (ps) {
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c b/drivers/soc/tegra/fuse/fuse-tegra.c
+index 51625703399e4..52130ec8c9049 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra.c
+@@ -182,7 +182,7 @@ static struct platform_driver tegra_fuse_driver = {
+ };
+ builtin_platform_driver(tegra_fuse_driver);
+
+-bool __init tegra_fuse_read_spare(unsigned int spare)
++u32 __init tegra_fuse_read_spare(unsigned int spare)
+ {
+ unsigned int offset = fuse->soc->info->spare + spare * 4;
+
+diff --git a/drivers/soc/tegra/fuse/fuse.h b/drivers/soc/tegra/fuse/fuse.h
+index f355b9d549151..bf489d50e6687 100644
+--- a/drivers/soc/tegra/fuse/fuse.h
++++ b/drivers/soc/tegra/fuse/fuse.h
+@@ -62,7 +62,7 @@ struct tegra_fuse {
+ void tegra_init_revision(void);
+ void tegra_init_apbmisc(void);
+
+-bool __init tegra_fuse_read_spare(unsigned int spare);
++u32 __init tegra_fuse_read_spare(unsigned int spare);
+ u32 __init tegra_fuse_read_early(unsigned int offset);
+
+ #ifdef CONFIG_ARCH_TEGRA_2x_SOC
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index 7874aaf30ef48..080adf7bcae43 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -37,6 +37,8 @@ struct xencons_info {
+ struct xenbus_device *xbdev;
+ struct xencons_interface *intf;
+ unsigned int evtchn;
++ XENCONS_RING_IDX out_cons;
++ unsigned int out_cons_same;
+ struct hvc_struct *hvc;
+ int irq;
+ int vtermno;
+@@ -138,6 +140,8 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len)
+ XENCONS_RING_IDX cons, prod;
+ int recv = 0;
+ struct xencons_info *xencons = vtermno_to_xencons(vtermno);
++ unsigned int eoiflag = 0;
++
+ if (xencons == NULL)
+ return -EINVAL;
+ intf = xencons->intf;
+@@ -157,7 +161,27 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len)
+ mb(); /* read ring before consuming */
+ intf->in_cons = cons;
+
+- notify_daemon(xencons);
++ /*
++ * When to mark interrupt having been spurious:
++ * - there was no new data to be read, and
++ * - the backend did not consume some output bytes, and
++ * - the previous round with no read data didn't see consumed bytes
++ * (we might have a race with an interrupt being in flight while
++ * updating xencons->out_cons, so account for that by allowing one
++ * round without any visible reason)
++ */
++ if (intf->out_cons != xencons->out_cons) {
++ xencons->out_cons = intf->out_cons;
++ xencons->out_cons_same = 0;
++ }
++ if (recv) {
++ notify_daemon(xencons);
++ } else if (xencons->out_cons_same++ > 1) {
++ eoiflag = XEN_EOI_FLAG_SPURIOUS;
++ }
++
++ xen_irq_lateeoi(xencons->irq, eoiflag);
++
+ return recv;
+ }
+
+@@ -386,7 +410,7 @@ static int xencons_connect_backend(struct xenbus_device *dev,
+ if (ret)
+ return ret;
+ info->evtchn = evtchn;
+- irq = bind_evtchn_to_irq(evtchn);
++ irq = bind_interdomain_evtchn_to_irq_lateeoi(dev->otherend_id, evtchn);
+ if (irq < 0)
+ return irq;
+ info->irq = irq;
+@@ -550,7 +574,7 @@ static int __init xen_hvc_init(void)
+ return r;
+
+ info = vtermno_to_xencons(HVC_COOKIE);
+- info->irq = bind_evtchn_to_irq(info->evtchn);
++ info->irq = bind_evtchn_to_irq_lateeoi(info->evtchn);
+ }
+ if (info->irq < 0)
+ info->irq = 0; /* NO_IRQ */
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index e170c5b4d6f0c..a118c44c70e1e 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -435,6 +435,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1532, 0x0116), .driver_info =
+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
++ /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */
++ { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* Lenovo Powered USB-C Travel Hub (4X90S92381, RTL8153 GigE) */
+ { USB_DEVICE(0x17ef, 0x721e), .driver_info = USB_QUIRK_NO_LPM },
+
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 99550c9eb33ed..748f8fede5c23 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1635,14 +1635,14 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+ u8 endp;
+
+ if (w_length > USB_COMP_EP0_BUFSIZ) {
+- if (ctrl->bRequestType == USB_DIR_OUT) {
+- goto done;
+- } else {
++ if (ctrl->bRequestType & USB_DIR_IN) {
+ /* Cast away the const, we are going to overwrite on purpose. */
+ __le16 *temp = (__le16 *)&ctrl->wLength;
+
+ *temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ);
+ w_length = USB_COMP_EP0_BUFSIZ;
++ } else {
++ goto done;
+ }
+ }
+
+diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c
+index 355bc7dab9d5f..6bcbad3825802 100644
+--- a/drivers/usb/gadget/legacy/dbgp.c
++++ b/drivers/usb/gadget/legacy/dbgp.c
+@@ -346,14 +346,14 @@ static int dbgp_setup(struct usb_gadget *gadget,
+ u16 len = 0;
+
+ if (length > DBGP_REQ_LEN) {
+- if (ctrl->bRequestType == USB_DIR_OUT) {
+- return err;
+- } else {
++ if (ctrl->bRequestType & USB_DIR_IN) {
+ /* Cast away the const, we are going to overwrite on purpose. */
+ __le16 *temp = (__le16 *)&ctrl->wLength;
+
+ *temp = cpu_to_le16(DBGP_REQ_LEN);
+ length = DBGP_REQ_LEN;
++ } else {
++ return err;
+ }
+ }
+
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index 848562222015d..a456267b6b784 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -1335,14 +1335,14 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+ u16 w_length = le16_to_cpu(ctrl->wLength);
+
+ if (w_length > RBUF_SIZE) {
+- if (ctrl->bRequestType == USB_DIR_OUT) {
+- return value;
+- } else {
++ if (ctrl->bRequestType & USB_DIR_IN) {
+ /* Cast away the const, we are going to overwrite on purpose. */
+ __le16 *temp = (__le16 *)&ctrl->wLength;
+
+ *temp = cpu_to_le16(RBUF_SIZE);
+ w_length = RBUF_SIZE;
++ } else {
++ return value;
+ }
+ }
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 894572a5e5c5c..cf1083639103b 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -1535,6 +1535,8 @@ static int cp2105_gpioconf_init(struct usb_serial *serial)
+
+ /* 2 banks of GPIO - One for the pins taken from each serial port */
+ if (intf_num == 0) {
++ priv->gc.ngpio = 2;
++
+ if (mode.eci == CP210X_PIN_MODE_MODEM) {
+ /* mark all GPIOs of this interface as reserved */
+ priv->gpio_altfunc = 0xff;
+@@ -1545,8 +1547,9 @@ static int cp2105_gpioconf_init(struct usb_serial *serial)
+ priv->gpio_pushpull = (u8)((le16_to_cpu(config.gpio_mode) &
+ CP210X_ECI_GPIO_MODE_MASK) >>
+ CP210X_ECI_GPIO_MODE_OFFSET);
+- priv->gc.ngpio = 2;
+ } else if (intf_num == 1) {
++ priv->gc.ngpio = 3;
++
+ if (mode.sci == CP210X_PIN_MODE_MODEM) {
+ /* mark all GPIOs of this interface as reserved */
+ priv->gpio_altfunc = 0xff;
+@@ -1557,7 +1560,6 @@ static int cp2105_gpioconf_init(struct usb_serial *serial)
+ priv->gpio_pushpull = (u8)((le16_to_cpu(config.gpio_mode) &
+ CP210X_SCI_GPIO_MODE_MASK) >>
+ CP210X_SCI_GPIO_MODE_OFFSET);
+- priv->gc.ngpio = 3;
+ } else {
+ return -ENODEV;
+ }
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 818097e86cb58..6166ef71c1842 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1219,6 +1219,14 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(2) | RSVD(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff), /* Telit LN920 (ECM) */
+ .driver_info = NCTRL(0) | RSVD(1) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff), /* Telit FN990 (rmnet) */
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff), /* Telit FN990 (MBIM) */
++ .driver_info = NCTRL(0) | RSVD(1) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff), /* Telit FN990 (RNDIS) */
++ .driver_info = NCTRL(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990 (ECM) */
++ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 6244345a5745b..f01ecc197a45b 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -984,7 +984,7 @@ int fuse_reverse_inval_entry(struct super_block *sb, u64 parent_nodeid,
+ if (!parent)
+ return -ENOENT;
+
+- inode_lock(parent);
++ inode_lock_nested(parent, I_MUTEX_PARENT);
+ if (!S_ISDIR(parent->i_mode))
+ goto unlock;
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 655079ae1dd1f..dfb2a790efc13 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -975,6 +975,11 @@ hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp)
+ return 0;
+ }
+
++static bool delegation_hashed(struct nfs4_delegation *dp)
++{
++ return !(list_empty(&dp->dl_perfile));
++}
++
+ static bool
+ unhash_delegation_locked(struct nfs4_delegation *dp)
+ {
+@@ -982,7 +987,7 @@ unhash_delegation_locked(struct nfs4_delegation *dp)
+
+ lockdep_assert_held(&state_lock);
+
+- if (list_empty(&dp->dl_perfile))
++ if (!delegation_hashed(dp))
+ return false;
+
+ dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID;
+@@ -3912,7 +3917,7 @@ static void nfsd4_cb_recall_prepare(struct nfsd4_callback *cb)
+ * queued for a lease break. Don't queue it again.
+ */
+ spin_lock(&state_lock);
+- if (dp->dl_time == 0) {
++ if (delegation_hashed(dp) && dp->dl_time == 0) {
+ dp->dl_time = get_seconds();
+ list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
+ }
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 0578c15e1a676..06dc649629c74 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -116,8 +116,7 @@ kill_whiteout:
+ goto out;
+ }
+
+-static int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry,
+- umode_t mode)
++int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry, umode_t mode)
+ {
+ int err;
+ struct dentry *d, *dentry = *newdentry;
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index 265bf9cfde089..8dcede7df2ca0 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -402,6 +402,7 @@ struct ovl_cattr {
+
+ #define OVL_CATTR(m) (&(struct ovl_cattr) { .mode = (m) })
+
++int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry, umode_t mode);
+ struct dentry *ovl_create_real(struct inode *dir, struct dentry *newdentry,
+ struct ovl_cattr *attr);
+ int ovl_cleanup(struct inode *dir, struct dentry *dentry);
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index c97d8d251eb95..1a7a1e2988855 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -654,10 +654,14 @@ retry:
+ goto retry;
+ }
+
+- work = ovl_create_real(dir, work, OVL_CATTR(attr.ia_mode));
+- err = PTR_ERR(work);
+- if (IS_ERR(work))
+- goto out_err;
++ err = ovl_mkdir_real(dir, &work, attr.ia_mode);
++ if (err)
++ goto out_dput;
++
++ /* Weird filesystem returning with hashed negative (kernfs)? */
++ err = -EINVAL;
++ if (d_really_is_negative(work))
++ goto out_dput;
+
+ /*
+ * Try to remove POSIX ACL xattrs from workdir. We are good if:
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 45741c3c48a47..968921d376b98 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -726,7 +726,7 @@ static int kauditd_send_queue(struct sock *sk, u32 portid,
+ {
+ int rc = 0;
+ struct sk_buff *skb;
+- static unsigned int failed = 0;
++ unsigned int failed = 0;
+
+ /* NOTE: kauditd_thread takes care of all our locking, we just use
+ * the netlink info passed to us (e.g. sk and portid) */
+@@ -743,32 +743,30 @@ static int kauditd_send_queue(struct sock *sk, u32 portid,
+ continue;
+ }
+
++retry:
+ /* grab an extra skb reference in case of error */
+ skb_get(skb);
+ rc = netlink_unicast(sk, skb, portid, 0);
+ if (rc < 0) {
+- /* fatal failure for our queue flush attempt? */
++ /* send failed - try a few times unless fatal error */
+ if (++failed >= retry_limit ||
+ rc == -ECONNREFUSED || rc == -EPERM) {
+- /* yes - error processing for the queue */
+ sk = NULL;
+ if (err_hook)
+ (*err_hook)(skb);
+- if (!skb_hook)
+- goto out;
+- /* keep processing with the skb_hook */
++ if (rc == -EAGAIN)
++ rc = 0;
++ /* continue to drain the queue */
+ continue;
+ } else
+- /* no - requeue to preserve ordering */
+- skb_queue_head(queue, skb);
++ goto retry;
+ } else {
+- /* it worked - drop the extra reference and continue */
++ /* skb sent - drop the extra reference and continue */
+ consume_skb(skb);
+ failed = 0;
+ }
+ }
+
+-out:
+ return (rc >= 0 ? 0 : rc);
+ }
+
+@@ -1557,7 +1555,8 @@ static int __net_init audit_net_init(struct net *net)
+ audit_panic("cannot initialize netlink socket in namespace");
+ return -ENOMEM;
+ }
+- aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
++ /* limit the timeout in case auditd is blocked/stopped */
++ aunet->sk->sk_sndtimeo = HZ / 10;
+
+ return 0;
+ }
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index c66fd11d94bc4..f246818e35dbc 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1235,8 +1235,7 @@ int do_settimeofday64(const struct timespec64 *ts)
+ timekeeping_forward_now(tk);
+
+ xt = tk_xtime(tk);
+- ts_delta.tv_sec = ts->tv_sec - xt.tv_sec;
+- ts_delta.tv_nsec = ts->tv_nsec - xt.tv_nsec;
++ ts_delta = timespec64_sub(*ts, xt);
+
+ if (timespec64_compare(&tk->wall_to_monotonic, &ts_delta) > 0) {
+ ret = -EINVAL;
+diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
+index 10657b8dc2c2d..83c2a0598c648 100644
+--- a/kernel/trace/tracing_map.c
++++ b/kernel/trace/tracing_map.c
+@@ -15,6 +15,7 @@
+ #include <linux/jhash.h>
+ #include <linux/slab.h>
+ #include <linux/sort.h>
++#include <linux/kmemleak.h>
+
+ #include "tracing_map.h"
+ #include "trace.h"
+@@ -307,6 +308,7 @@ void tracing_map_array_free(struct tracing_map_array *a)
+ for (i = 0; i < a->n_pages; i++) {
+ if (!a->pages[i])
+ break;
++ kmemleak_free(a->pages[i]);
+ free_page((unsigned long)a->pages[i]);
+ }
+
+@@ -342,6 +344,7 @@ struct tracing_map_array *tracing_map_array_alloc(unsigned int n_elts,
+ a->pages[i] = (void *)get_zeroed_page(GFP_KERNEL);
+ if (!a->pages[i])
+ goto free;
++ kmemleak_alloc(a->pages[i], PAGE_SIZE, 1, GFP_KERNEL);
+ }
+ out:
+ return a;
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 6970759f296c5..621859a453f82 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -1178,7 +1178,7 @@ config LOCKDEP
+ bool
+ depends on DEBUG_KERNEL && LOCK_DEBUGGING_SUPPORT
+ select STACKTRACE
+- select FRAME_POINTER if !MIPS && !PPC && !ARM_UNWIND && !S390 && !MICROBLAZE && !ARC && !X86
++ select FRAME_POINTER if !MIPS && !PPC && !ARM && !S390 && !MICROBLAZE && !ARC && !X86
+ select KALLSYMS
+ select KALLSYMS_ALL
+
+@@ -1589,7 +1589,7 @@ config FAULT_INJECTION_STACKTRACE_FILTER
+ depends on FAULT_INJECTION_DEBUG_FS && STACKTRACE_SUPPORT
+ depends on !X86_64
+ select STACKTRACE
+- select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND && !ARC && !X86
++ select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM && !ARC && !X86
+ help
+ Provide stacktrace filter for fault-injection capabilities
+
+@@ -1598,7 +1598,7 @@ config LATENCYTOP
+ depends on DEBUG_KERNEL
+ depends on STACKTRACE_SUPPORT
+ depends on PROC_FS
+- select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND && !ARC && !X86
++ select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM && !ARC && !X86
+ select KALLSYMS
+ select KALLSYMS_ALL
+ select STACKTRACE
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 4a49200d0d11c..55c999cbe6e96 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1875,7 +1875,6 @@ static int __net_init sit_init_net(struct net *net)
+ return 0;
+
+ err_reg_dev:
+- ipip6_dev_free(sitn->fb_tunnel_dev);
+ free_netdev(sitn->fb_tunnel_dev);
+ err_alloc_dev:
+ return err;
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+index 54821fb1a960d..79138225e8808 100644
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -109,7 +109,7 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
+ mgmt->u.action.u.addba_req.start_seq_num =
+ cpu_to_le16(start_seq_num << 4);
+
+- ieee80211_tx_skb(sdata, skb);
++ ieee80211_tx_skb_tid(sdata, skb, tid);
+ }
+
+ void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index cbcb60face2c5..e5c4a72f8e571 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2351,11 +2351,18 @@ static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
+ u16 tx_time)
+ {
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+- u16 tid = ieee80211_get_tid(hdr);
+- int ac = ieee80211_ac_from_tid(tid);
+- struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
++ u16 tid;
++ int ac;
++ struct ieee80211_sta_tx_tspec *tx_tspec;
+ unsigned long now = jiffies;
+
++ if (!ieee80211_is_data_qos(hdr->frame_control))
++ return;
++
++ tid = ieee80211_get_tid(hdr);
++ ac = ieee80211_ac_from_tid(tid);
++ tx_tspec = &ifmgd->tx_tspec[ac];
++
+ if (likely(!tx_tspec->admitted_time))
+ return;
+
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 7fa9871b1db9f..9c1a20ca63445 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1102,6 +1102,8 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+ elems->max_idle_period_ie = (void *)pos;
+ break;
+ case WLAN_EID_EXTENSION:
++ if (!elen)
++ break;
+ if (pos[0] == WLAN_EID_EXT_HE_MU_EDCA &&
+ elen >= (sizeof(*elems->mu_edca_param_set) + 1)) {
+ elems->mu_edca_param_set = (void *)&pos[1];
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index dd4e4289d0d2a..a7497361e4d78 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1853,6 +1853,11 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ if (msg->msg_flags&MSG_OOB)
+ return -EOPNOTSUPP;
+
++ if (len == 0) {
++ pr_warn_once("Zero length message leads to an empty skb\n");
++ return -ENODATA;
++ }
++
+ err = scm_send(sock, msg, &scm, true);
+ if (err < 0)
+ return err;
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index b6313504faed1..0a3120117c13d 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -655,8 +655,10 @@ static int nfc_genl_dump_devices_done(struct netlink_callback *cb)
+ {
+ struct class_dev_iter *iter = (struct class_dev_iter *) cb->args[0];
+
+- nfc_device_iter_exit(iter);
+- kfree(iter);
++ if (iter) {
++ nfc_device_iter_exit(iter);
++ kfree(iter);
++ }
+
+ return 0;
+ }
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 8d9005019ef78..1309161032d50 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4439,9 +4439,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ }
+
+ out_free_pg_vec:
+- bitmap_free(rx_owner_map);
+- if (pg_vec)
++ if (pg_vec) {
++ bitmap_free(rx_owner_map);
+ free_pg_vec(pg_vec, order, req->tp_block_nr);
++ }
+ out:
+ return err;
+ }
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index ac3300b204a6f..af9f7d1840037 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -250,6 +250,7 @@ static struct rds_connection *__rds_conn_create(struct net *net,
+ * should end up here, but if it
+ * does, reset/destroy the connection.
+ */
++ kfree(conn->c_path);
+ kmem_cache_free(rds_conn_slab, conn);
+ conn = ERR_PTR(-EOPNOTSUPP);
+ goto out;
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index 2025f0f559deb..18c207b85d513 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -2675,7 +2675,7 @@ static int cake_init(struct Qdisc *sch, struct nlattr *opt,
+ q->tins = kvcalloc(CAKE_MAX_TINS, sizeof(struct cake_tin_data),
+ GFP_KERNEL);
+ if (!q->tins)
+- goto nomem;
++ return -ENOMEM;
+
+ for (i = 0; i < CAKE_MAX_TINS; i++) {
+ struct cake_tin_data *b = q->tins + i;
+@@ -2705,10 +2705,6 @@ static int cake_init(struct Qdisc *sch, struct nlattr *opt,
+ q->min_netlen = ~0;
+ q->min_adjlen = ~0;
+ return 0;
+-
+-nomem:
+- cake_destroy(sch);
+- return -ENOMEM;
+ }
+
+ static int cake_dump(struct Qdisc *sch, struct sk_buff *skb)
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index 321c41562b972..d8cbbedef3161 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -252,7 +252,7 @@ if ($arch eq "x86_64") {
+
+ } elsif ($arch eq "s390" && $bits == 64) {
+ if ($cc =~ /-DCC_USING_HOTPATCH/) {
+- $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*brcl\\s*0,[0-9a-f]+ <([^\+]*)>\$";
++ $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(bcrl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$";
+ $mcount_adjust = 0;
+ } else {
+ $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_390_(PC|PLT)32DBL\\s+_mcount\\+0x2\$";
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2021-12-29 13:11 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2021-12-29 13:11 UTC (permalink / raw
To: gentoo-commits
commit: dc6725ef86a129d4df053dc29b953e560f5db220
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 29 13:10:58 2021 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 29 13:10:58 2021 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dc6725ef
Linux patch 4.19.223
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1222_linux-4.19.223.patch | 1396 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1400 insertions(+)
diff --git a/0000_README b/0000_README
index 7dda2480..ed044b8e 100644
--- a/0000_README
+++ b/0000_README
@@ -927,6 +927,10 @@ Patch: 1221_linux-4.19.222.patch
From: https://www.kernel.org
Desc: Linux 4.19.222
+Patch: 1222_linux-4.19.223.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.223
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1222_linux-4.19.223.patch b/1222_linux-4.19.223.patch
new file mode 100644
index 00000000..f6334a18
--- /dev/null
+++ b/1222_linux-4.19.223.patch
@@ -0,0 +1,1396 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index f179e20eb8a0b..607db9519cfbd 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2019,8 +2019,12 @@
+ Default is 1 (enabled)
+
+ kvm-intel.emulate_invalid_guest_state=
+- [KVM,Intel] Enable emulation of invalid guest states
+- Default is 0 (disabled)
++ [KVM,Intel] Disable emulation of invalid guest state.
++ Ignored if kvm-intel.enable_unrestricted_guest=1, as
++ guest state is never invalid for unrestricted guests.
++ This param doesn't apply to nested guests (L2), as KVM
++ never emulates invalid L2 guest state.
++ Default is 1 (enabled)
+
+ kvm-intel.flexpriority=
+ [KVM,Intel] Disable FlexPriority feature (TPR shadow).
+diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
+index d3e5dd26db12d..4035a495c0606 100644
+--- a/Documentation/networking/bonding.txt
++++ b/Documentation/networking/bonding.txt
+@@ -191,11 +191,12 @@ ad_actor_sys_prio
+ ad_actor_system
+
+ In an AD system, this specifies the mac-address for the actor in
+- protocol packet exchanges (LACPDUs). The value cannot be NULL or
+- multicast. It is preferred to have the local-admin bit set for this
+- mac but driver does not enforce it. If the value is not given then
+- system defaults to using the masters' mac address as actors' system
+- address.
++ protocol packet exchanges (LACPDUs). The value cannot be a multicast
++ address. If the all-zeroes MAC is specified, bonding will internally
++ use the MAC of the bond itself. It is preferred to have the
++ local-admin bit set for this mac but driver does not enforce it. If
++ the value is not given then system defaults to using the masters'
++ mac address as actors' system address.
+
+ This parameter has effect only in 802.3ad mode and is available through
+ SysFs interface.
+diff --git a/Makefile b/Makefile
+index aa6cdaebe18b2..6637882cb5e54 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 222
++SUBLEVEL = 223
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index 89e551eebff1e..cde22c04ad2b8 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -620,11 +620,9 @@ call_fpe:
+ tstne r0, #0x04000000 @ bit 26 set on both ARM and Thumb-2
+ reteq lr
+ and r8, r0, #0x00000f00 @ mask out CP number
+- THUMB( lsr r8, r8, #8 )
+ mov r7, #1
+- add r6, r10, #TI_USED_CP
+- ARM( strb r7, [r6, r8, lsr #8] ) @ set appropriate used_cp[]
+- THUMB( strb r7, [r6, r8] ) @ set appropriate used_cp[]
++ add r6, r10, r8, lsr #8 @ add used_cp[] array offset first
++ strb r7, [r6, #TI_USED_CP] @ set appropriate used_cp[]
+ #ifdef CONFIG_IWMMXT
+ @ Test if we need to give access to iWMMXt coprocessors
+ ldr r5, [r10, #TI_FLAGS]
+@@ -633,7 +631,7 @@ call_fpe:
+ bcs iwmmxt_task_enable
+ #endif
+ ARM( add pc, pc, r8, lsr #6 )
+- THUMB( lsl r8, r8, #2 )
++ THUMB( lsr r8, r8, #6 )
+ THUMB( add pc, r8 )
+ nop
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
+index 1238de25a9691..9b1789504f7a0 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
+@@ -72,7 +72,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index 61a647a55c695..1ae007ec65c51 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -478,7 +478,7 @@ lws_start:
+ extrd,u %r1,PSW_W_BIT,1,%r1
+ /* sp must be aligned on 4, so deposit the W bit setting into
+ * the bottom of sp temporarily */
+- or,ev %r1,%r30,%r30
++ or,od %r1,%r30,%r30
+
+ /* Clip LWS number to a 32-bit value for 32-bit processes */
+ depdi 0, 31, 32, %r20
+diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
+index 2a9c12ffb5cbc..7de459cf36b54 100644
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -1356,8 +1356,8 @@ static inline pmd_t pmd_swp_clear_soft_dirty(pmd_t pmd)
+ #endif
+ #endif
+
+-#define PKRU_AD_BIT 0x1
+-#define PKRU_WD_BIT 0x2
++#define PKRU_AD_BIT 0x1u
++#define PKRU_WD_BIT 0x2u
+ #define PKRU_BITS_PER_PKEY 2
+
+ static inline bool __pkru_allows_read(u32 pkru, u16 pkey)
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index b2bad345c523f..c2529dfda3e53 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -625,12 +625,13 @@ void bfq_pos_tree_add_move(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+ }
+
+ /*
+- * Tell whether there are active queues or groups with differentiated weights.
++ * Tell whether there are active queues with different weights or
++ * active groups.
+ */
+-static bool bfq_differentiated_weights(struct bfq_data *bfqd)
++static bool bfq_varied_queue_weights_or_active_groups(struct bfq_data *bfqd)
+ {
+ /*
+- * For weights to differ, at least one of the trees must contain
++ * For queue weights to differ, queue_weights_tree must contain
+ * at least two nodes.
+ */
+ return (!RB_EMPTY_ROOT(&bfqd->queue_weights_tree) &&
+@@ -638,9 +639,7 @@ static bool bfq_differentiated_weights(struct bfq_data *bfqd)
+ bfqd->queue_weights_tree.rb_node->rb_right)
+ #ifdef CONFIG_BFQ_GROUP_IOSCHED
+ ) ||
+- (!RB_EMPTY_ROOT(&bfqd->group_weights_tree) &&
+- (bfqd->group_weights_tree.rb_node->rb_left ||
+- bfqd->group_weights_tree.rb_node->rb_right)
++ (bfqd->num_groups_with_pending_reqs > 0
+ #endif
+ );
+ }
+@@ -658,26 +657,25 @@ static bool bfq_differentiated_weights(struct bfq_data *bfqd)
+ * 3) all active groups at the same level in the groups tree have the same
+ * number of children.
+ *
+- * Unfortunately, keeping the necessary state for evaluating exactly the
+- * above symmetry conditions would be quite complex and time-consuming.
+- * Therefore this function evaluates, instead, the following stronger
+- * sub-conditions, for which it is much easier to maintain the needed
+- * state:
++ * Unfortunately, keeping the necessary state for evaluating exactly
++ * the last two symmetry sub-conditions above would be quite complex
++ * and time consuming. Therefore this function evaluates, instead,
++ * only the following stronger two sub-conditions, for which it is
++ * much easier to maintain the needed state:
+ * 1) all active queues have the same weight,
+- * 2) all active groups have the same weight,
+- * 3) all active groups have at most one active child each.
+- * In particular, the last two conditions are always true if hierarchical
+- * support and the cgroups interface are not enabled, thus no state needs
+- * to be maintained in this case.
++ * 2) there are no active groups.
++ * In particular, the last condition is always true if hierarchical
++ * support or the cgroups interface are not enabled, thus no state
++ * needs to be maintained in this case.
+ */
+ static bool bfq_symmetric_scenario(struct bfq_data *bfqd)
+ {
+- return !bfq_differentiated_weights(bfqd);
++ return !bfq_varied_queue_weights_or_active_groups(bfqd);
+ }
+
+ /*
+ * If the weight-counter tree passed as input contains no counter for
+- * the weight of the input entity, then add that counter; otherwise just
++ * the weight of the input queue, then add that counter; otherwise just
+ * increment the existing counter.
+ *
+ * Note that weight-counter trees contain few nodes in mostly symmetric
+@@ -688,25 +686,25 @@ static bool bfq_symmetric_scenario(struct bfq_data *bfqd)
+ * In most scenarios, the rate at which nodes are created/destroyed
+ * should be low too.
+ */
+-void bfq_weights_tree_add(struct bfq_data *bfqd, struct bfq_entity *entity,
++void bfq_weights_tree_add(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ struct rb_root *root)
+ {
++ struct bfq_entity *entity = &bfqq->entity;
+ struct rb_node **new = &(root->rb_node), *parent = NULL;
+
+ /*
+- * Do not insert if the entity is already associated with a
++ * Do not insert if the queue is already associated with a
+ * counter, which happens if:
+- * 1) the entity is associated with a queue,
+- * 2) a request arrival has caused the queue to become both
++ * 1) a request arrival has caused the queue to become both
+ * non-weight-raised, and hence change its weight, and
+ * backlogged; in this respect, each of the two events
+ * causes an invocation of this function,
+- * 3) this is the invocation of this function caused by the
++ * 2) this is the invocation of this function caused by the
+ * second event. This second invocation is actually useless,
+ * and we handle this fact by exiting immediately. More
+ * efficient or clearer solutions might possibly be adopted.
+ */
+- if (entity->weight_counter)
++ if (bfqq->weight_counter)
+ return;
+
+ while (*new) {
+@@ -716,7 +714,7 @@ void bfq_weights_tree_add(struct bfq_data *bfqd, struct bfq_entity *entity,
+ parent = *new;
+
+ if (entity->weight == __counter->weight) {
+- entity->weight_counter = __counter;
++ bfqq->weight_counter = __counter;
+ goto inc_counter;
+ }
+ if (entity->weight < __counter->weight)
+@@ -725,68 +723,68 @@ void bfq_weights_tree_add(struct bfq_data *bfqd, struct bfq_entity *entity,
+ new = &((*new)->rb_right);
+ }
+
+- entity->weight_counter = kzalloc(sizeof(struct bfq_weight_counter),
+- GFP_ATOMIC);
++ bfqq->weight_counter = kzalloc(sizeof(struct bfq_weight_counter),
++ GFP_ATOMIC);
+
+ /*
+ * In the unlucky event of an allocation failure, we just
+- * exit. This will cause the weight of entity to not be
+- * considered in bfq_differentiated_weights, which, in its
+- * turn, causes the scenario to be deemed wrongly symmetric in
+- * case entity's weight would have been the only weight making
+- * the scenario asymmetric. On the bright side, no unbalance
+- * will however occur when entity becomes inactive again (the
+- * invocation of this function is triggered by an activation
+- * of entity). In fact, bfq_weights_tree_remove does nothing
+- * if !entity->weight_counter.
++ * exit. This will cause the weight of queue to not be
++ * considered in bfq_varied_queue_weights_or_active_groups,
++ * which, in its turn, causes the scenario to be deemed
++ * wrongly symmetric in case bfqq's weight would have been
++ * the only weight making the scenario asymmetric. On the
++ * bright side, no unbalance will however occur when bfqq
++ * becomes inactive again (the invocation of this function
++ * is triggered by an activation of queue). In fact,
++ * bfq_weights_tree_remove does nothing if
++ * !bfqq->weight_counter.
+ */
+- if (unlikely(!entity->weight_counter))
++ if (unlikely(!bfqq->weight_counter))
+ return;
+
+- entity->weight_counter->weight = entity->weight;
+- rb_link_node(&entity->weight_counter->weights_node, parent, new);
+- rb_insert_color(&entity->weight_counter->weights_node, root);
++ bfqq->weight_counter->weight = entity->weight;
++ rb_link_node(&bfqq->weight_counter->weights_node, parent, new);
++ rb_insert_color(&bfqq->weight_counter->weights_node, root);
+
+ inc_counter:
+- entity->weight_counter->num_active++;
++ bfqq->weight_counter->num_active++;
++ bfqq->ref++;
+ }
+
+ /*
+- * Decrement the weight counter associated with the entity, and, if the
++ * Decrement the weight counter associated with the queue, and, if the
+ * counter reaches 0, remove the counter from the tree.
+ * See the comments to the function bfq_weights_tree_add() for considerations
+ * about overhead.
+ */
+ void __bfq_weights_tree_remove(struct bfq_data *bfqd,
+- struct bfq_entity *entity,
++ struct bfq_queue *bfqq,
+ struct rb_root *root)
+ {
+- if (!entity->weight_counter)
++ if (!bfqq->weight_counter)
+ return;
+
+- entity->weight_counter->num_active--;
+- if (entity->weight_counter->num_active > 0)
++ bfqq->weight_counter->num_active--;
++ if (bfqq->weight_counter->num_active > 0)
+ goto reset_entity_pointer;
+
+- rb_erase(&entity->weight_counter->weights_node, root);
+- kfree(entity->weight_counter);
++ rb_erase(&bfqq->weight_counter->weights_node, root);
++ kfree(bfqq->weight_counter);
+
+ reset_entity_pointer:
+- entity->weight_counter = NULL;
++ bfqq->weight_counter = NULL;
++ bfq_put_queue(bfqq);
+ }
+
+ /*
+- * Invoke __bfq_weights_tree_remove on bfqq and all its inactive
+- * parent entities.
++ * Invoke __bfq_weights_tree_remove on bfqq and decrement the number
++ * of active groups for each queue's inactive parent entity.
+ */
+ void bfq_weights_tree_remove(struct bfq_data *bfqd,
+ struct bfq_queue *bfqq)
+ {
+ struct bfq_entity *entity = bfqq->entity.parent;
+
+- __bfq_weights_tree_remove(bfqd, &bfqq->entity,
+- &bfqd->queue_weights_tree);
+-
+ for_each_entity(entity) {
+ struct bfq_sched_data *sd = entity->my_sched_data;
+
+@@ -798,18 +796,37 @@ void bfq_weights_tree_remove(struct bfq_data *bfqd,
+ * next_in_service for details on why
+ * in_service_entity must be checked too).
+ *
+- * As a consequence, the weight of entity is
+- * not to be removed. In addition, if entity
+- * is active, then its parent entities are
+- * active as well, and thus their weights are
+- * not to be removed either. In the end, this
+- * loop must stop here.
++ * As a consequence, its parent entities are
++ * active as well, and thus this loop must
++ * stop here.
+ */
+ break;
+ }
+- __bfq_weights_tree_remove(bfqd, entity,
+- &bfqd->group_weights_tree);
++
++ /*
++ * The decrement of num_groups_with_pending_reqs is
++ * not performed immediately upon the deactivation of
++ * entity, but it is delayed to when it also happens
++ * that the first leaf descendant bfqq of entity gets
++ * all its pending requests completed. The following
++ * instructions perform this delayed decrement, if
++ * needed. See the comments on
++ * num_groups_with_pending_reqs for details.
++ */
++ if (entity->in_groups_with_pending_reqs) {
++ entity->in_groups_with_pending_reqs = false;
++ bfqd->num_groups_with_pending_reqs--;
++ }
+ }
++
++ /*
++ * Next function is invoked last, because it causes bfqq to be
++ * freed if the following holds: bfqq is not in service and
++ * has no dispatched request. DO NOT use bfqq after the next
++ * function invocation.
++ */
++ __bfq_weights_tree_remove(bfqd, bfqq,
++ &bfqd->queue_weights_tree);
+ }
+
+ /*
+@@ -1003,7 +1020,8 @@ bfq_bfqq_resume_state(struct bfq_queue *bfqq, struct bfq_data *bfqd,
+
+ static int bfqq_process_refs(struct bfq_queue *bfqq)
+ {
+- return bfqq->ref - bfqq->allocated - bfqq->entity.on_st;
++ return bfqq->ref - bfqq->allocated - bfqq->entity.on_st -
++ (bfqq->weight_counter != NULL);
+ }
+
+ /* Empty burst list and add just bfqq (see comments on bfq_handle_burst) */
+@@ -2798,7 +2816,7 @@ static void bfq_dispatch_remove(struct request_queue *q, struct request *rq)
+ bfq_remove_request(q, rq);
+ }
+
+-static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
++static bool __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+ {
+ /*
+ * If this bfqq is shared between multiple processes, check
+@@ -2831,9 +2849,11 @@ static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+ /*
+ * All in-service entities must have been properly deactivated
+ * or requeued before executing the next function, which
+- * resets all in-service entites as no more in service.
++ * resets all in-service entities as no more in service. This
++ * may cause bfqq to be freed. If this happens, the next
++ * function returns true.
+ */
+- __bfq_bfqd_reset_in_service(bfqd);
++ return __bfq_bfqd_reset_in_service(bfqd);
+ }
+
+ /**
+@@ -3238,7 +3258,6 @@ void bfq_bfqq_expire(struct bfq_data *bfqd,
+ bool slow;
+ unsigned long delta = 0;
+ struct bfq_entity *entity = &bfqq->entity;
+- int ref;
+
+ /*
+ * Check whether the process is slow (see bfq_bfqq_is_slow).
+@@ -3307,10 +3326,8 @@ void bfq_bfqq_expire(struct bfq_data *bfqd,
+ * reason.
+ */
+ __bfq_bfqq_recalc_budget(bfqd, bfqq, reason);
+- ref = bfqq->ref;
+- __bfq_bfqq_expire(bfqd, bfqq);
+-
+- if (ref == 1) /* bfqq is gone, no more actions on it */
++ if (__bfq_bfqq_expire(bfqd, bfqq))
++ /* bfqq is gone, no more actions on it */
+ return;
+
+ bfqq->injected_service = 0;
+@@ -3521,9 +3538,11 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
+ * symmetric scenario where:
+ * (i) each of these processes must get the same throughput as
+ * the others;
+- * (ii) all these processes have the same I/O pattern
+- (either sequential or random).
+- * In fact, in such a scenario, the drive will tend to treat
++ * (ii) the I/O of each process has the same properties, in
++ * terms of locality (sequential or random), direction
++ * (reads or writes), request sizes, greediness
++ * (from I/O-bound to sporadic), and so on.
++ * In fact, in such a scenario, the drive tends to treat
+ * the requests of each of these processes in about the same
+ * way as the requests of the others, and thus to provide
+ * each of these processes with about the same throughput
+@@ -3532,18 +3551,67 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
+ * certainly needed to guarantee that bfqq receives its
+ * assigned fraction of the device throughput (see [1] for
+ * details).
++ * The problem is that idling may significantly reduce
++ * throughput with certain combinations of types of I/O and
++ * devices. An important example is sync random I/O, on flash
++ * storage with command queueing. So, unless bfqq falls in the
++ * above cases where idling also boosts throughput, it would
++ * be important to check conditions (i) and (ii) accurately,
++ * so as to avoid idling when not strictly needed for service
++ * guarantees.
++ *
++ * Unfortunately, it is extremely difficult to thoroughly
++ * check condition (ii). And, in case there are active groups,
++ * it becomes very difficult to check condition (i) too. In
++ * fact, if there are active groups, then, for condition (i)
++ * to become false, it is enough that an active group contains
++ * more active processes or sub-groups than some other active
++ * group. More precisely, for condition (i) to hold because of
++ * such a group, it is not even necessary that the group is
++ * (still) active: it is sufficient that, even if the group
++ * has become inactive, some of its descendant processes still
++ * have some request already dispatched but still waiting for
++ * completion. In fact, requests have still to be guaranteed
++ * their share of the throughput even after being
++ * dispatched. In this respect, it is easy to show that, if a
++ * group frequently becomes inactive while still having
++ * in-flight requests, and if, when this happens, the group is
++ * not considered in the calculation of whether the scenario
++ * is asymmetric, then the group may fail to be guaranteed its
++ * fair share of the throughput (basically because idling may
++ * not be performed for the descendant processes of the group,
++ * but it had to be). We address this issue with the
++ * following bi-modal behavior, implemented in the function
++ * bfq_symmetric_scenario().
++ *
++ * If there are groups with requests waiting for completion
++ * (as commented above, some of these groups may even be
++ * already inactive), then the scenario is tagged as
++ * asymmetric, conservatively, without checking any of the
++ * conditions (i) and (ii). So the device is idled for bfqq.
++ * This behavior matches also the fact that groups are created
++ * exactly if controlling I/O is a primary concern (to
++ * preserve bandwidth and latency guarantees).
++ *
++ * On the opposite end, if there are no groups with requests
++ * waiting for completion, then only condition (i) is actually
++ * controlled, i.e., provided that condition (i) holds, idling
++ * is not performed, regardless of whether condition (ii)
++ * holds. In other words, only if condition (i) does not hold,
++ * then idling is allowed, and the device tends to be
++ * prevented from queueing many requests, possibly of several
++ * processes. Since there are no groups with requests waiting
++ * for completion, then, to control condition (i) it is enough
++ * to check just whether all the queues with requests waiting
++ * for completion also have the same weight.
+ *
+- * We address this issue by controlling, actually, only the
+- * symmetry sub-condition (i), i.e., provided that
+- * sub-condition (i) holds, idling is not performed,
+- * regardless of whether sub-condition (ii) holds. In other
+- * words, only if sub-condition (i) holds, then idling is
+- * allowed, and the device tends to be prevented from queueing
+- * many requests, possibly of several processes. The reason
+- * for not controlling also sub-condition (ii) is that we
+- * exploit preemption to preserve guarantees in case of
+- * symmetric scenarios, even if (ii) does not hold, as
+- * explained in the next two paragraphs.
++ * Not checking condition (ii) evidently exposes bfqq to the
++ * risk of getting less throughput than its fair share.
++ * However, for queues with the same weight, a further
++ * mechanism, preemption, mitigates or even eliminates this
++ * problem. And it does so without consequences on overall
++ * throughput. This mechanism and its benefits are explained
++ * in the next three paragraphs.
+ *
+ * Even if a queue, say Q, is expired when it remains idle, Q
+ * can still preempt the new in-service queue if the next
+@@ -3557,11 +3625,7 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
+ * idling allows the internal queues of the device to contain
+ * many requests, and thus to reorder requests, we can rather
+ * safely assume that the internal scheduler still preserves a
+- * minimum of mid-term fairness. The motivation for using
+- * preemption instead of idling is that, by not idling,
+- * service guarantees are preserved without minimally
+- * sacrificing throughput. In other words, both a high
+- * throughput and its desired distribution are obtained.
++ * minimum of mid-term fairness.
+ *
+ * More precisely, this preemption-based, idleless approach
+ * provides fairness in terms of IOPS, and not sectors per
+@@ -3580,27 +3644,28 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
+ * 1024/8 times as high as the service received by the other
+ * queue.
+ *
+- * On the other hand, device idling is performed, and thus
+- * pure sector-domain guarantees are provided, for the
+- * following queues, which are likely to need stronger
+- * throughput guarantees: weight-raised queues, and queues
+- * with a higher weight than other queues. When such queues
+- * are active, sub-condition (i) is false, which triggers
+- * device idling.
++ * The motivation for using preemption instead of idling (for
++ * queues with the same weight) is that, by not idling,
++ * service guarantees are preserved (completely or at least in
++ * part) without minimally sacrificing throughput. And, if
++ * there is no active group, then the primary expectation for
++ * this device is probably a high throughput.
+ *
+- * According to the above considerations, the next variable is
+- * true (only) if sub-condition (i) holds. To compute the
+- * value of this variable, we not only use the return value of
+- * the function bfq_symmetric_scenario(), but also check
+- * whether bfqq is being weight-raised, because
+- * bfq_symmetric_scenario() does not take into account also
+- * weight-raised queues (see comments on
+- * bfq_weights_tree_add()). In particular, if bfqq is being
+- * weight-raised, it is important to idle only if there are
+- * other, non-weight-raised queues that may steal throughput
+- * to bfqq. Actually, we should be even more precise, and
+- * differentiate between interactive weight raising and
+- * soft real-time weight raising.
++ * We are now left only with explaining the additional
++ * compound condition that is checked below for deciding
++ * whether the scenario is asymmetric. To explain this
++ * compound condition, we need to add that the function
++ * bfq_symmetric_scenario checks the weights of only
++ * non-weight-raised queues, for efficiency reasons (see
++ * comments on bfq_weights_tree_add()). Then the fact that
++ * bfqq is weight-raised is checked explicitly here. More
++ * precisely, the compound condition below takes into account
++ * also the fact that, even if bfqq is being weight-raised,
++ * the scenario is still symmetric if all queues with requests
++ * waiting for completion happen to be
++ * weight-raised. Actually, we should be even more precise
++ * here, and differentiate between interactive weight raising
++ * and soft real-time weight raising.
+ *
+ * As a side note, it is worth considering that the above
+ * device-idling countermeasures may however fail in the
+@@ -5422,7 +5487,7 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_type *e)
+ bfqd->idle_slice_timer.function = bfq_idle_slice_timer;
+
+ bfqd->queue_weights_tree = RB_ROOT;
+- bfqd->group_weights_tree = RB_ROOT;
++ bfqd->num_groups_with_pending_reqs = 0;
+
+ INIT_LIST_HEAD(&bfqd->active_list);
+ INIT_LIST_HEAD(&bfqd->idle_list);
+diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
+index a41e9884f2dd2..ca98c98a8179b 100644
+--- a/block/bfq-iosched.h
++++ b/block/bfq-iosched.h
+@@ -108,15 +108,14 @@ struct bfq_sched_data {
+ };
+
+ /**
+- * struct bfq_weight_counter - counter of the number of all active entities
++ * struct bfq_weight_counter - counter of the number of all active queues
+ * with a given weight.
+ */
+ struct bfq_weight_counter {
+- unsigned int weight; /* weight of the entities this counter refers to */
+- unsigned int num_active; /* nr of active entities with this weight */
++ unsigned int weight; /* weight of the queues this counter refers to */
++ unsigned int num_active; /* nr of active queues with this weight */
+ /*
+- * Weights tree member (see bfq_data's @queue_weights_tree and
+- * @group_weights_tree)
++ * Weights tree member (see bfq_data's @queue_weights_tree)
+ */
+ struct rb_node weights_node;
+ };
+@@ -151,8 +150,6 @@ struct bfq_weight_counter {
+ struct bfq_entity {
+ /* service_tree member */
+ struct rb_node rb_node;
+- /* pointer to the weight counter associated with this entity */
+- struct bfq_weight_counter *weight_counter;
+
+ /*
+ * Flag, true if the entity is on a tree (either the active or
+@@ -199,6 +196,9 @@ struct bfq_entity {
+
+ /* flag, set to request a weight, ioprio or ioprio_class change */
+ int prio_changed;
++
++ /* flag, set if the entity is counted in groups_with_pending_reqs */
++ bool in_groups_with_pending_reqs;
+ };
+
+ struct bfq_group;
+@@ -266,6 +266,9 @@ struct bfq_queue {
+ /* entity representing this queue in the scheduler */
+ struct bfq_entity entity;
+
++ /* pointer to the weight counter associated with this entity */
++ struct bfq_weight_counter *weight_counter;
++
+ /* maximum budget allowed from the feedback mechanism */
+ int max_budget;
+ /* budget expiration (in jiffies) */
+@@ -448,15 +451,54 @@ struct bfq_data {
+ * bfq_weights_tree_[add|remove] for further details).
+ */
+ struct rb_root queue_weights_tree;
++
+ /*
+- * rbtree of non-queue @bfq_entity weight counters, sorted by
+- * weight. Used to keep track of whether all @bfq_groups have
+- * the same weight. The tree contains one counter for each
+- * distinct weight associated to some active @bfq_group (see
+- * the comments to the functions bfq_weights_tree_[add|remove]
+- * for further details).
++ * Number of groups with at least one descendant process that
++ * has at least one request waiting for completion. Note that
++ * this accounts for also requests already dispatched, but not
++ * yet completed. Therefore this number of groups may differ
++ * (be larger) than the number of active groups, as a group is
++ * considered active only if its corresponding entity has
++ * descendant queues with at least one request queued. This
++ * number is used to decide whether a scenario is symmetric.
++ * For a detailed explanation see comments on the computation
++ * of the variable asymmetric_scenario in the function
++ * bfq_better_to_idle().
++ *
++ * However, it is hard to compute this number exactly, for
++ * groups with multiple descendant processes. Consider a group
++ * that is inactive, i.e., that has no descendant process with
++ * pending I/O inside BFQ queues. Then suppose that
++ * num_groups_with_pending_reqs is still accounting for this
++ * group, because the group has descendant processes with some
++ * I/O request still in flight. num_groups_with_pending_reqs
++ * should be decremented when the in-flight request of the
++ * last descendant process is finally completed (assuming that
++ * nothing else has changed for the group in the meantime, in
++ * terms of composition of the group and active/inactive state of child
++ * groups and processes). To accomplish this, an additional
++ * pending-request counter must be added to entities, and must
++ * be updated correctly. To avoid this additional field and operations,
++ * we resort to the following tradeoff between simplicity and
++ * accuracy: for an inactive group that is still counted in
++ * num_groups_with_pending_reqs, we decrement
++ * num_groups_with_pending_reqs when the first descendant
++ * process of the group remains with no request waiting for
++ * completion.
++ *
++ * Even this simpler decrement strategy requires a little
++ * carefulness: to avoid multiple decrements, we flag a group,
++ * more precisely an entity representing a group, as still
++ * counted in num_groups_with_pending_reqs when it becomes
++ * inactive. Then, when the first descendant queue of the
++ * entity remains with no request waiting for completion,
++ * num_groups_with_pending_reqs is decremented, and this flag
++ * is reset. After this flag is reset for the entity,
++ * num_groups_with_pending_reqs won't be decremented any
++ * longer in case a new descendant queue of the entity remains
++ * with no request waiting for completion.
+ */
+- struct rb_root group_weights_tree;
++ unsigned int num_groups_with_pending_reqs;
+
+ /*
+ * Number of bfq_queues containing requests (including the
+@@ -854,10 +896,10 @@ struct bfq_queue *bic_to_bfqq(struct bfq_io_cq *bic, bool is_sync);
+ void bic_set_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq, bool is_sync);
+ struct bfq_data *bic_to_bfqd(struct bfq_io_cq *bic);
+ void bfq_pos_tree_add_move(struct bfq_data *bfqd, struct bfq_queue *bfqq);
+-void bfq_weights_tree_add(struct bfq_data *bfqd, struct bfq_entity *entity,
++void bfq_weights_tree_add(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ struct rb_root *root);
+ void __bfq_weights_tree_remove(struct bfq_data *bfqd,
+- struct bfq_entity *entity,
++ struct bfq_queue *bfqq,
+ struct rb_root *root);
+ void bfq_weights_tree_remove(struct bfq_data *bfqd,
+ struct bfq_queue *bfqq);
+@@ -951,7 +993,7 @@ bool __bfq_deactivate_entity(struct bfq_entity *entity,
+ bool ins_into_idle_tree);
+ bool next_queue_may_preempt(struct bfq_data *bfqd);
+ struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd);
+-void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd);
++bool __bfq_bfqd_reset_in_service(struct bfq_data *bfqd);
+ void bfq_deactivate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ bool ins_into_idle_tree, bool expiration);
+ void bfq_activate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq);
+diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
+index ff7c2d470bb82..11ff5ceae02b4 100644
+--- a/block/bfq-wf2q.c
++++ b/block/bfq-wf2q.c
+@@ -788,25 +788,23 @@ __bfq_entity_update_weight_prio(struct bfq_service_tree *old_st,
+ new_weight = entity->orig_weight *
+ (bfqq ? bfqq->wr_coeff : 1);
+ /*
+- * If the weight of the entity changes, remove the entity
+- * from its old weight counter (if there is a counter
+- * associated with the entity), and add it to the counter
+- * associated with its new weight.
++ * If the weight of the entity changes, and the entity is a
++ * queue, remove the entity from its old weight counter (if
++ * there is a counter associated with the entity).
+ */
+- if (prev_weight != new_weight) {
+- root = bfqq ? &bfqd->queue_weights_tree :
+- &bfqd->group_weights_tree;
+- __bfq_weights_tree_remove(bfqd, entity, root);
++ if (prev_weight != new_weight && bfqq) {
++ root = &bfqd->queue_weights_tree;
++ __bfq_weights_tree_remove(bfqd, bfqq, root);
+ }
+ entity->weight = new_weight;
+ /*
+- * Add the entity to its weights tree only if it is
+- * not associated with a weight-raised queue.
++ * Add the entity, if it is not a weight-raised queue,
++ * to the counter associated with its new weight.
+ */
+- if (prev_weight != new_weight &&
+- (bfqq ? bfqq->wr_coeff == 1 : 1))
++ if (prev_weight != new_weight && bfqq && bfqq->wr_coeff == 1) {
+ /* If we get here, root has been initialized. */
+- bfq_weights_tree_add(bfqd, entity, root);
++ bfq_weights_tree_add(bfqd, bfqq, root);
++ }
+
+ new_st->wsum += entity->weight;
+
+@@ -1012,9 +1010,12 @@ static void __bfq_activate_entity(struct bfq_entity *entity,
+ if (!bfq_entity_to_bfqq(entity)) { /* bfq_group */
+ struct bfq_group *bfqg =
+ container_of(entity, struct bfq_group, entity);
++ struct bfq_data *bfqd = bfqg->bfqd;
+
+- bfq_weights_tree_add(bfqg->bfqd, entity,
+- &bfqd->group_weights_tree);
++ if (!entity->in_groups_with_pending_reqs) {
++ entity->in_groups_with_pending_reqs = true;
++ bfqd->num_groups_with_pending_reqs++;
++ }
+ }
+ #endif
+
+@@ -1599,7 +1600,8 @@ struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
+ return bfqq;
+ }
+
+-void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd)
++/* returns true if the in-service queue gets freed */
++bool __bfq_bfqd_reset_in_service(struct bfq_data *bfqd)
+ {
+ struct bfq_queue *in_serv_bfqq = bfqd->in_service_queue;
+ struct bfq_entity *in_serv_entity = &in_serv_bfqq->entity;
+@@ -1623,8 +1625,20 @@ void __bfq_bfqd_reset_in_service(struct bfq_data *bfqd)
+ * service tree either, then release the service reference to
+ * the queue it represents (taken with bfq_get_entity).
+ */
+- if (!in_serv_entity->on_st)
++ if (!in_serv_entity->on_st) {
++ /*
++ * If no process is referencing in_serv_bfqq any
++ * longer, then the service reference may be the only
++ * reference to the queue. If this is the case, then
++ * bfqq gets freed here.
++ */
++ int ref = in_serv_bfqq->ref;
+ bfq_put_queue(in_serv_bfqq);
++ if (ref == 1)
++ return true;
++ }
++
++ return false;
+ }
+
+ void bfq_deactivate_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+@@ -1667,15 +1681,15 @@ void bfq_del_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+
+ bfqd->busy_queues--;
+
+- if (!bfqq->dispatched)
+- bfq_weights_tree_remove(bfqd, bfqq);
+-
+ if (bfqq->wr_coeff > 1)
+ bfqd->wr_busy_queues--;
+
+ bfqg_stats_update_dequeue(bfqq_group(bfqq));
+
+ bfq_deactivate_bfqq(bfqd, bfqq, true, expiration);
++
++ if (!bfqq->dispatched)
++ bfq_weights_tree_remove(bfqd, bfqq);
+ }
+
+ /*
+@@ -1692,7 +1706,7 @@ void bfq_add_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+
+ if (!bfqq->dispatched)
+ if (bfqq->wr_coeff == 1)
+- bfq_weights_tree_add(bfqd, &bfqq->entity,
++ bfq_weights_tree_add(bfqd, bfqq,
+ &bfqd->queue_weights_tree);
+
+ if (bfqq->wr_coeff > 1)
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 48929df7673b1..4cf3ef4ddec35 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -2863,7 +2863,7 @@ cleanup_bmc_device(struct kref *ref)
+ * with removing the device attributes while reading a device
+ * attribute.
+ */
+- schedule_work(&bmc->remove_work);
++ queue_work(remove_work_wq, &bmc->remove_work);
+ }
+
+ /*
+@@ -5085,22 +5085,27 @@ static int ipmi_init_msghandler(void)
+ if (initialized)
+ goto out;
+
+- init_srcu_struct(&ipmi_interfaces_srcu);
+-
+- timer_setup(&ipmi_timer, ipmi_timeout, 0);
+- mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
+-
+- atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
++ rv = init_srcu_struct(&ipmi_interfaces_srcu);
++ if (rv)
++ goto out;
+
+ remove_work_wq = create_singlethread_workqueue("ipmi-msghandler-remove-wq");
+ if (!remove_work_wq) {
+ pr_err("unable to create ipmi-msghandler-remove-wq workqueue");
+ rv = -ENOMEM;
+- goto out;
++ goto out_wq;
+ }
+
++ timer_setup(&ipmi_timer, ipmi_timeout, 0);
++ mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
++
++ atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
++
+ initialized = true;
+
++out_wq:
++ if (rv)
++ cleanup_srcu_struct(&ipmi_interfaces_srcu);
+ out:
+ mutex_unlock(&ipmi_interfaces_mutex);
+ return rv;
+diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c
+index 27c08ddab0e1a..96db7e96fcea9 100644
+--- a/drivers/hid/hid-holtek-mouse.c
++++ b/drivers/hid/hid-holtek-mouse.c
+@@ -68,8 +68,23 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ static int holtek_mouse_probe(struct hid_device *hdev,
+ const struct hid_device_id *id)
+ {
++ int ret;
++
+ if (!hid_is_usb(hdev))
+ return -EINVAL;
++
++ ret = hid_parse(hdev);
++ if (ret) {
++ hid_err(hdev, "hid parse failed: %d\n", ret);
++ return ret;
++ }
++
++ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
++ if (ret) {
++ hid_err(hdev, "hw start failed: %d\n", ret);
++ return ret;
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index c187e557678ef..30a7f7fde6511 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -197,6 +197,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
+ #define LM90_STATUS_RHIGH (1 << 4) /* remote high temp limit tripped */
+ #define LM90_STATUS_LLOW (1 << 5) /* local low temp limit tripped */
+ #define LM90_STATUS_LHIGH (1 << 6) /* local high temp limit tripped */
++#define LM90_STATUS_BUSY (1 << 7) /* conversion is ongoing */
+
+ #define MAX6696_STATUS2_R2THRM (1 << 1) /* remote2 THERM limit tripped */
+ #define MAX6696_STATUS2_R2OPEN (1 << 2) /* remote2 is an open circuit */
+@@ -786,7 +787,7 @@ static int lm90_update_device(struct device *dev)
+ val = lm90_read_reg(client, LM90_REG_R_STATUS);
+ if (val < 0)
+ return val;
+- data->alarms = val; /* lower 8 bit of alarms */
++ data->alarms = val & ~LM90_STATUS_BUSY;
+
+ if (data->kind == max6696) {
+ val = lm90_select_remote_channel(client, data, 1);
+@@ -1439,12 +1440,11 @@ static int lm90_detect(struct i2c_client *client,
+ if (man_id < 0 || chip_id < 0 || config1 < 0 || convrate < 0)
+ return -ENODEV;
+
+- if (man_id == 0x01 || man_id == 0x5C || man_id == 0x41) {
++ if (man_id == 0x01 || man_id == 0x5C || man_id == 0xA1) {
+ config2 = i2c_smbus_read_byte_data(client, LM90_REG_R_CONFIG2);
+ if (config2 < 0)
+ return -ENODEV;
+- } else
+- config2 = 0; /* Make compiler happy */
++ }
+
+ if ((address == 0x4C || address == 0x4D)
+ && man_id == 0x01) { /* National Semiconductor */
+diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
+index 47ed3ab25dc95..6e6730f036b03 100644
+--- a/drivers/infiniband/hw/qib/qib_user_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
+@@ -945,7 +945,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
+ &addrlimit) ||
+ addrlimit > type_max(typeof(pkt->addrlimit))) {
+ ret = -EINVAL;
+- goto free_pbc;
++ goto free_pkt;
+ }
+ pkt->addrlimit = addrlimit;
+
+diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
+index e8f98de60df3a..a2e10cae654f0 100644
+--- a/drivers/input/touchscreen/atmel_mxt_ts.c
++++ b/drivers/input/touchscreen/atmel_mxt_ts.c
+@@ -1809,7 +1809,7 @@ static int mxt_read_info_block(struct mxt_data *data)
+ if (error) {
+ dev_err(&client->dev, "Error %d parsing object table\n", error);
+ mxt_free_object_table(data);
+- goto err_free_mem;
++ return error;
+ }
+
+ data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
+diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
+index 80867bd8f44c3..c9aa28eee191d 100644
+--- a/drivers/net/bonding/bond_options.c
++++ b/drivers/net/bonding/bond_options.c
+@@ -1439,7 +1439,7 @@ static int bond_option_ad_actor_system_set(struct bonding *bond,
+ mac = (u8 *)&newval->value;
+ }
+
+- if (!is_valid_ether_addr(mac))
++ if (is_multicast_ether_addr(mac))
+ goto err;
+
+ netdev_dbg(bond->dev, "Setting ad_actor_system to %pM\n", mac);
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
+index 5f327659efa7a..85b688f60b876 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
+@@ -202,7 +202,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapter *,
+ struct qlcnic_info *, u16);
+ int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *, u16, u8);
+ void qlcnic_sriov_free_vlans(struct qlcnic_adapter *);
+-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);
++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);
+ bool qlcnic_sriov_check_any_vlan(struct qlcnic_vf_info *);
+ void qlcnic_sriov_del_vlan_id(struct qlcnic_sriov *,
+ struct qlcnic_vf_info *, u16);
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+index 77e386ebff09c..98275f18a87b0 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+@@ -433,7 +433,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
+ struct qlcnic_cmd_args *cmd)
+ {
+ struct qlcnic_sriov *sriov = adapter->ahw->sriov;
+- int i, num_vlans;
++ int i, num_vlans, ret;
+ u16 *vlans;
+
+ if (sriov->allowed_vlans)
+@@ -444,7 +444,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
+ dev_info(&adapter->pdev->dev, "Number of allowed Guest VLANs = %d\n",
+ sriov->num_allowed_vlans);
+
+- qlcnic_sriov_alloc_vlans(adapter);
++ ret = qlcnic_sriov_alloc_vlans(adapter);
++ if (ret)
++ return ret;
+
+ if (!sriov->any_vlan)
+ return 0;
+@@ -2164,7 +2166,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapter *adapter)
+ return err;
+ }
+
+-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
+ {
+ struct qlcnic_sriov *sriov = adapter->ahw->sriov;
+ struct qlcnic_vf_info *vf;
+@@ -2174,7 +2176,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
+ vf = &sriov->vf_info[i];
+ vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans,
+ sizeof(*vf->sriov_vlans), GFP_KERNEL);
++ if (!vf->sriov_vlans)
++ return -ENOMEM;
+ }
++
++ return 0;
+ }
+
+ void qlcnic_sriov_free_vlans(struct qlcnic_adapter *adapter)
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+index 50eaafa3eaba3..c9f2cd2462230 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+@@ -598,7 +598,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter,
+ if (err)
+ goto del_flr_queue;
+
+- qlcnic_sriov_alloc_vlans(adapter);
++ err = qlcnic_sriov_alloc_vlans(adapter);
++ if (err)
++ goto del_flr_queue;
+
+ return err;
+
+diff --git a/drivers/net/ethernet/sfc/falcon/rx.c b/drivers/net/ethernet/sfc/falcon/rx.c
+index 02456ed13a7d4..5b93a3af4575d 100644
+--- a/drivers/net/ethernet/sfc/falcon/rx.c
++++ b/drivers/net/ethernet/sfc/falcon/rx.c
+@@ -732,7 +732,10 @@ static void ef4_init_rx_recycle_ring(struct ef4_nic *efx,
+ efx->rx_bufs_per_page);
+ rx_queue->page_ring = kcalloc(page_ring_size,
+ sizeof(*rx_queue->page_ring), GFP_KERNEL);
+- rx_queue->page_ptr_mask = page_ring_size - 1;
++ if (!rx_queue->page_ring)
++ rx_queue->page_ptr_mask = 0;
++ else
++ rx_queue->page_ptr_mask = page_ring_size - 1;
+ }
+
+ void ef4_init_rx_queue(struct ef4_rx_queue *rx_queue)
+diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
+index f97b35430c840..ac1ad00e2fc55 100644
+--- a/drivers/net/ethernet/smsc/smc911x.c
++++ b/drivers/net/ethernet/smsc/smc911x.c
+@@ -2080,6 +2080,11 @@ static int smc911x_drv_probe(struct platform_device *pdev)
+
+ ndev->dma = (unsigned char)-1;
+ ndev->irq = platform_get_irq(pdev, 0);
++ if (ndev->irq < 0) {
++ ret = ndev->irq;
++ goto release_both;
++ }
++
+ lp = netdev_priv(ndev);
+ lp->netdev = ndev;
+ #ifdef SMC_DYNAMIC_BUS_CONFIG
+diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
+index 778d3729f460a..89b3bc389f469 100644
+--- a/drivers/net/fjes/fjes_main.c
++++ b/drivers/net/fjes/fjes_main.c
+@@ -1284,6 +1284,11 @@ static int fjes_probe(struct platform_device *plat_dev)
+ hw->hw_res.start = res->start;
+ hw->hw_res.size = resource_size(res);
+ hw->hw_res.irq = platform_get_irq(plat_dev, 0);
++ if (hw->hw_res.irq < 0) {
++ err = hw->hw_res.irq;
++ goto err_free_control_wq;
++ }
++
+ err = fjes_hw_init(&adapter->hw);
+ if (err)
+ goto err_free_control_wq;
+diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
+index 940aa7a19f50b..ba0ca85e3d766 100644
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -803,13 +803,14 @@ static void mkiss_close(struct tty_struct *tty)
+ */
+ netif_stop_queue(ax->dev);
+
+- /* Free all AX25 frame buffers. */
++ unregister_netdev(ax->dev);
++
++ /* Free all AX25 frame buffers after unreg. */
+ kfree(ax->rbuff);
+ kfree(ax->xbuff);
+
+ ax->tty = NULL;
+
+- unregister_netdev(ax->dev);
+ free_netdev(ax->dev);
+ }
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index f438be83d2594..a44968d5cac48 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -75,6 +75,8 @@
+ #define LAN7801_USB_PRODUCT_ID (0x7801)
+ #define LAN78XX_EEPROM_MAGIC (0x78A5)
+ #define LAN78XX_OTP_MAGIC (0x78F3)
++#define AT29M2AF_USB_VENDOR_ID (0x07C9)
++#define AT29M2AF_USB_PRODUCT_ID (0x0012)
+
+ #define MII_READ 1
+ #define MII_WRITE 0
+@@ -4170,6 +4172,10 @@ static const struct usb_device_id products[] = {
+ /* LAN7801 USB Gigabit Ethernet Device */
+ USB_DEVICE(LAN78XX_USB_VENDOR_ID, LAN7801_USB_PRODUCT_ID),
+ },
++ {
++ /* ATM2-AF USB Gigabit Ethernet Device */
++ USB_DEVICE(AT29M2AF_USB_VENDOR_ID, AT29M2AF_USB_PRODUCT_ID),
++ },
+ {},
+ };
+ MODULE_DEVICE_TABLE(usb, products);
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index 4e17728f29375..08f1688dfeb28 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -1011,10 +1011,10 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl,
+ bank_nr = args.args[1] / STM32_GPIO_PINS_PER_BANK;
+ bank->gpio_chip.base = args.args[1];
+
+- npins = args.args[2];
+- while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3,
+- ++i, &args))
+- npins += args.args[2];
++ /* get the last defined gpio line (offset + nb of pins) */
++ npins = args.args[0] + args.args[2];
++ while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, ++i, &args))
++ npins = max(npins, (int)(args.args[0] + args.args[2]));
+ } else {
+ bank_nr = pctl->nbanks;
+ bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK;
+diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c
+index 7dcb14d303eb4..d8715954f4e08 100644
+--- a/drivers/spi/spi-armada-3700.c
++++ b/drivers/spi/spi-armada-3700.c
+@@ -912,7 +912,7 @@ static int a3700_spi_probe(struct platform_device *pdev)
+ return 0;
+
+ error_clk:
+- clk_disable_unprepare(spi->clk);
++ clk_unprepare(spi->clk);
+ error:
+ spi_master_put(master);
+ out:
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index d7a12161e5531..1b3e674e6330d 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -860,19 +860,23 @@ int gether_register_netdev(struct net_device *net)
+ {
+ struct eth_dev *dev;
+ struct usb_gadget *g;
+- struct sockaddr sa;
+ int status;
+
+ if (!net->dev.parent)
+ return -EINVAL;
+ dev = netdev_priv(net);
+ g = dev->gadget;
++
++ memcpy(net->dev_addr, dev->dev_mac, ETH_ALEN);
++ net->addr_assign_type = NET_ADDR_RANDOM;
++
+ status = register_netdev(net);
+ if (status < 0) {
+ dev_dbg(&g->dev, "register_netdev failed, %d\n", status);
+ return status;
+ } else {
+ INFO(dev, "HOST MAC %pM\n", dev->host_mac);
++ INFO(dev, "MAC %pM\n", dev->dev_mac);
+
+ /* two kinds of host-initiated state changes:
+ * - iff DATA transfer is active, carrier is "on"
+@@ -880,15 +884,6 @@ int gether_register_netdev(struct net_device *net)
+ */
+ netif_carrier_off(net);
+ }
+- sa.sa_family = net->type;
+- memcpy(sa.sa_data, dev->dev_mac, ETH_ALEN);
+- rtnl_lock();
+- status = dev_set_mac_address(net, &sa);
+- rtnl_unlock();
+- if (status)
+- pr_warn("cannot set self ethernet address: %d\n", status);
+- else
+- INFO(dev, "MAC %pM\n", dev->dev_mac);
+
+ return status;
+ }
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index 201e9da1692a4..64352d2833e2e 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -658,8 +658,15 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ }
+
+ last = here;
+- while (!IS_XATTR_LAST_ENTRY(last))
++ while (!IS_XATTR_LAST_ENTRY(last)) {
++ if ((void *)(last) + sizeof(__u32) > last_base_addr ||
++ (void *)XATTR_NEXT_ENTRY(last) > last_base_addr) {
++ set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
++ error = -EFSCORRUPTED;
++ goto exit;
++ }
+ last = XATTR_NEXT_ENTRY(last);
++ }
+
+ newsize = XATTR_ALIGN(sizeof(struct f2fs_xattr_entry) + len + size);
+
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index e7330a9a7d7dc..faee73c084d49 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -7,9 +7,27 @@
+ #include <uapi/linux/udp.h>
+ #include <uapi/linux/virtio_net.h>
+
++static inline bool virtio_net_hdr_match_proto(__be16 protocol, __u8 gso_type)
++{
++ switch (gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
++ case VIRTIO_NET_HDR_GSO_TCPV4:
++ return protocol == cpu_to_be16(ETH_P_IP);
++ case VIRTIO_NET_HDR_GSO_TCPV6:
++ return protocol == cpu_to_be16(ETH_P_IPV6);
++ case VIRTIO_NET_HDR_GSO_UDP:
++ return protocol == cpu_to_be16(ETH_P_IP) ||
++ protocol == cpu_to_be16(ETH_P_IPV6);
++ default:
++ return false;
++ }
++}
++
+ static inline int virtio_net_hdr_set_proto(struct sk_buff *skb,
+ const struct virtio_net_hdr *hdr)
+ {
++ if (skb->protocol)
++ return 0;
++
+ switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
+ case VIRTIO_NET_HDR_GSO_TCPV4:
+ case VIRTIO_NET_HDR_GSO_UDP:
+@@ -88,9 +106,12 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ if (!skb->protocol) {
+ __be16 protocol = dev_parse_header_protocol(skb);
+
+- virtio_net_hdr_set_proto(skb, hdr);
+- if (protocol && protocol != skb->protocol)
++ if (!protocol)
++ virtio_net_hdr_set_proto(skb, hdr);
++ else if (!virtio_net_hdr_match_proto(protocol, hdr->gso_type))
+ return -EINVAL;
++ else
++ skb->protocol = protocol;
+ }
+ retry:
+ if (!skb_flow_dissect_flow_keys_basic(skb, &keys,
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index a45db78eaf00a..567fdfd9678d5 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -88,8 +88,10 @@ static void ax25_kill_by_device(struct net_device *dev)
+ again:
+ ax25_for_each(s, &ax25_list) {
+ if (s->ax25_dev == ax25_dev) {
+- s->ax25_dev = NULL;
+ spin_unlock_bh(&ax25_list_lock);
++ lock_sock(s->sk);
++ s->ax25_dev = NULL;
++ release_sock(s->sk);
+ ax25_disconnect(s, ENETUNREACH);
+ spin_lock_bh(&ax25_list_lock);
+
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index 25298b3eb8546..17ca9a681d47b 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -509,7 +509,8 @@ __build_packet_message(struct nfnl_log_net *log,
+ goto nla_put_failure;
+
+ if (indev && skb->dev &&
+- skb->mac_header != skb->network_header) {
++ skb_mac_header_was_set(skb) &&
++ skb_mac_header_len(skb) != 0) {
+ struct nfulnl_msg_packet_hw phw;
+ int len;
+
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index eb5a052d3b252..8955431f2ab26 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -566,7 +566,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
+ goto nla_put_failure;
+
+ if (indev && entskb->dev &&
+- skb_mac_header_was_set(entskb)) {
++ skb_mac_header_was_set(entskb) &&
++ skb_mac_header_len(entskb) != 0) {
+ struct nfqnl_msg_packet_hw phw;
+ int len;
+
+diff --git a/net/phonet/pep.c b/net/phonet/pep.c
+index db34735403035..c0b4cc1e108b3 100644
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -959,6 +959,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
+ ret = -EBUSY;
+ else if (sk->sk_state == TCP_ESTABLISHED)
+ ret = -EISCONN;
++ else if (!pn->pn_sk.sobject)
++ ret = -EADDRNOTAVAIL;
+ else
+ ret = pep_sock_enable(sk, NULL, 0);
+ release_sock(sk);
+diff --git a/sound/core/jack.c b/sound/core/jack.c
+index 84c2a17c56ee3..847a8f3fd06ea 100644
+--- a/sound/core/jack.c
++++ b/sound/core/jack.c
+@@ -234,6 +234,10 @@ int snd_jack_new(struct snd_card *card, const char *id, int type,
+ return -ENOMEM;
+
+ jack->id = kstrdup(id, GFP_KERNEL);
++ if (jack->id == NULL) {
++ kfree(jack);
++ return -ENOMEM;
++ }
+
+ /* don't creat input device for phantom jack */
+ if (!phantom_jack) {
+diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c
+index a33cb744e96c8..4e77b1dcacc8b 100644
+--- a/sound/drivers/opl3/opl3_midi.c
++++ b/sound/drivers/opl3/opl3_midi.c
+@@ -412,7 +412,7 @@ void snd_opl3_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
+ }
+ if (instr_4op) {
+ vp2 = &opl3->voices[voice + 3];
+- if (vp->state > 0) {
++ if (vp2->state > 0) {
+ opl3_reg = reg_side | (OPL3_REG_KEYON_BLOCK +
+ voice_offset + 3);
+ reg_val = vp->keyon_reg & ~OPL3_KEYON_BIT;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-01-05 12:55 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-01-05 12:55 UTC (permalink / raw
To: gentoo-commits
commit: 4f588a1e14e02fad34135c810254cf54ecce1690
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 5 12:55:12 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jan 5 12:55:12 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4f588a1e
Linux patch 4.19.224
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1223_linux-4.19.224.patch | 1307 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1311 insertions(+)
diff --git a/0000_README b/0000_README
index ed044b8e..f8c41458 100644
--- a/0000_README
+++ b/0000_README
@@ -931,6 +931,10 @@ Patch: 1222_linux-4.19.223.patch
From: https://www.kernel.org
Desc: Linux 4.19.223
+Patch: 1223_linux-4.19.224.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.224
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1223_linux-4.19.224.patch b/1223_linux-4.19.224.patch
new file mode 100644
index 00000000..3027aed9
--- /dev/null
+++ b/1223_linux-4.19.224.patch
@@ -0,0 +1,1307 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 607db9519cfbd..0ee49b4929be2 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1439,6 +1439,8 @@
+ architectures force reset to be always executed
+ i8042.unlock [HW] Unlock (ignore) the keylock
+ i8042.kbdreset [HW] Reset device connected to KBD port
++ i8042.probe_defer
++ [HW] Allow deferred probing upon i8042 probe errors
+
+ i810= [HW,DRM]
+
+diff --git a/Makefile b/Makefile
+index 6637882cb5e54..cfcecc33b4c1f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 223
++SUBLEVEL = 224
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 3371b986e3b40..cd845afc48809 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -630,7 +630,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
+ BUG_ON(buffer->data > alloc->buffer + alloc->buffer_size);
+
+ if (buffer->async_transaction) {
+- alloc->free_async_space += size + sizeof(struct binder_buffer);
++ alloc->free_async_space += buffer_size + sizeof(struct binder_buffer);
+
+ binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
+ "%d: binder_free_buf size %zd async free %zd\n",
+diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
+index 98e91e14cefd3..88bb59ba58cd2 100644
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -148,6 +148,7 @@ config HID_APPLEIR
+
+ config HID_ASUS
+ tristate "Asus"
++ depends on USB_HID
+ depends on LEDS_CLASS
+ ---help---
+ Support for Asus notebook built-in keyboard and touchpad via i2c, and
+diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
+index 57aece8098416..140dd074fdee5 100644
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -544,6 +544,9 @@ static long compat_i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned lo
+ sizeof(rdwr_arg)))
+ return -EFAULT;
+
++ if (!rdwr_arg.msgs || rdwr_arg.nmsgs == 0)
++ return -EINVAL;
++
+ if (rdwr_arg.nmsgs > I2C_RDWR_IOCTL_MAX_MSGS)
+ return -EINVAL;
+
+diff --git a/drivers/input/joystick/spaceball.c b/drivers/input/joystick/spaceball.c
+index ffb9c1f495b6c..197e0b5d5a80a 100644
+--- a/drivers/input/joystick/spaceball.c
++++ b/drivers/input/joystick/spaceball.c
+@@ -31,6 +31,7 @@
+ #include <linux/module.h>
+ #include <linux/input.h>
+ #include <linux/serio.h>
++#include <asm/unaligned.h>
+
+ #define DRIVER_DESC "SpaceTec SpaceBall 2003/3003/4000 FLX driver"
+
+@@ -87,9 +88,15 @@ static void spaceball_process_packet(struct spaceball* spaceball)
+
+ case 'D': /* Ball data */
+ if (spaceball->idx != 15) return;
+- for (i = 0; i < 6; i++)
++ /*
++ * Skip first three bytes; read six axes worth of data.
++ * Axis values are signed 16-bit big-endian.
++ */
++ data += 3;
++ for (i = 0; i < ARRAY_SIZE(spaceball_axes); i++) {
+ input_report_abs(dev, spaceball_axes[i],
+- (__s16)((data[2 * i + 3] << 8) | data[2 * i + 2]));
++ (__s16)get_unaligned_be16(&data[i * 2]));
++ }
+ break;
+
+ case 'K': /* Button data */
+diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c
+index f1e66e257cff7..e305a4f2b0f04 100644
+--- a/drivers/input/mouse/appletouch.c
++++ b/drivers/input/mouse/appletouch.c
+@@ -930,6 +930,8 @@ static int atp_probe(struct usb_interface *iface,
+ set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit);
+ set_bit(BTN_LEFT, input_dev->keybit);
+
++ INIT_WORK(&dev->work, atp_reinit);
++
+ error = input_register_device(dev->input);
+ if (error)
+ goto err_free_buffer;
+@@ -937,8 +939,6 @@ static int atp_probe(struct usb_interface *iface,
+ /* save our data pointer in this interface device */
+ usb_set_intfdata(iface, dev);
+
+- INIT_WORK(&dev->work, atp_reinit);
+-
+ return 0;
+
+ err_free_buffer:
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index c218e107c0c8f..ee0b0a7237ad8 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -999,6 +999,24 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
+ { }
+ };
+
++static const struct dmi_system_id i8042_dmi_probe_defer_table[] __initconst = {
++ {
++ /* ASUS ZenBook UX425UA */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX425UA"),
++ },
++ },
++ {
++ /* ASUS ZenBook UM325UA */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"),
++ },
++ },
++ { }
++};
++
+ #endif /* CONFIG_X86 */
+
+ #ifdef CONFIG_PNP
+@@ -1318,6 +1336,9 @@ static int __init i8042_platform_init(void)
+ if (dmi_check_system(i8042_dmi_kbdreset_table))
+ i8042_kbdreset = true;
+
++ if (dmi_check_system(i8042_dmi_probe_defer_table))
++ i8042_probe_defer = true;
++
+ /*
+ * A20 was already enabled during early kernel init. But some buggy
+ * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index c60593c8d2be5..082afbf088d67 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -48,6 +48,10 @@ static bool i8042_unlock;
+ module_param_named(unlock, i8042_unlock, bool, 0);
+ MODULE_PARM_DESC(unlock, "Ignore keyboard lock.");
+
++static bool i8042_probe_defer;
++module_param_named(probe_defer, i8042_probe_defer, bool, 0);
++MODULE_PARM_DESC(probe_defer, "Allow deferred probing.");
++
+ enum i8042_controller_reset_mode {
+ I8042_RESET_NEVER,
+ I8042_RESET_ALWAYS,
+@@ -702,7 +706,7 @@ static int i8042_set_mux_mode(bool multiplex, unsigned char *mux_version)
+ * LCS/Telegraphics.
+ */
+
+-static int __init i8042_check_mux(void)
++static int i8042_check_mux(void)
+ {
+ unsigned char mux_version;
+
+@@ -731,10 +735,10 @@ static int __init i8042_check_mux(void)
+ /*
+ * The following is used to test AUX IRQ delivery.
+ */
+-static struct completion i8042_aux_irq_delivered __initdata;
+-static bool i8042_irq_being_tested __initdata;
++static struct completion i8042_aux_irq_delivered;
++static bool i8042_irq_being_tested;
+
+-static irqreturn_t __init i8042_aux_test_irq(int irq, void *dev_id)
++static irqreturn_t i8042_aux_test_irq(int irq, void *dev_id)
+ {
+ unsigned long flags;
+ unsigned char str, data;
+@@ -761,7 +765,7 @@ static irqreturn_t __init i8042_aux_test_irq(int irq, void *dev_id)
+ * verifies success by readinng CTR. Used when testing for presence of AUX
+ * port.
+ */
+-static int __init i8042_toggle_aux(bool on)
++static int i8042_toggle_aux(bool on)
+ {
+ unsigned char param;
+ int i;
+@@ -789,7 +793,7 @@ static int __init i8042_toggle_aux(bool on)
+ * the presence of an AUX interface.
+ */
+
+-static int __init i8042_check_aux(void)
++static int i8042_check_aux(void)
+ {
+ int retval = -1;
+ bool irq_registered = false;
+@@ -996,7 +1000,7 @@ static int i8042_controller_init(void)
+
+ if (i8042_command(&ctr[n++ % 2], I8042_CMD_CTL_RCTR)) {
+ pr_err("Can't read CTR while initializing i8042\n");
+- return -EIO;
++ return i8042_probe_defer ? -EPROBE_DEFER : -EIO;
+ }
+
+ } while (n < 2 || ctr[0] != ctr[1]);
+@@ -1311,7 +1315,7 @@ static void i8042_shutdown(struct platform_device *dev)
+ i8042_controller_reset(false);
+ }
+
+-static int __init i8042_create_kbd_port(void)
++static int i8042_create_kbd_port(void)
+ {
+ struct serio *serio;
+ struct i8042_port *port = &i8042_ports[I8042_KBD_PORT_NO];
+@@ -1339,7 +1343,7 @@ static int __init i8042_create_kbd_port(void)
+ return 0;
+ }
+
+-static int __init i8042_create_aux_port(int idx)
++static int i8042_create_aux_port(int idx)
+ {
+ struct serio *serio;
+ int port_no = idx < 0 ? I8042_AUX_PORT_NO : I8042_MUX_PORT_NO + idx;
+@@ -1376,13 +1380,13 @@ static int __init i8042_create_aux_port(int idx)
+ return 0;
+ }
+
+-static void __init i8042_free_kbd_port(void)
++static void i8042_free_kbd_port(void)
+ {
+ kfree(i8042_ports[I8042_KBD_PORT_NO].serio);
+ i8042_ports[I8042_KBD_PORT_NO].serio = NULL;
+ }
+
+-static void __init i8042_free_aux_ports(void)
++static void i8042_free_aux_ports(void)
+ {
+ int i;
+
+@@ -1392,7 +1396,7 @@ static void __init i8042_free_aux_ports(void)
+ }
+ }
+
+-static void __init i8042_register_ports(void)
++static void i8042_register_ports(void)
+ {
+ int i;
+
+@@ -1444,7 +1448,7 @@ static void i8042_free_irqs(void)
+ i8042_aux_irq_registered = i8042_kbd_irq_registered = false;
+ }
+
+-static int __init i8042_setup_aux(void)
++static int i8042_setup_aux(void)
+ {
+ int (*aux_enable)(void);
+ int error;
+@@ -1486,7 +1490,7 @@ static int __init i8042_setup_aux(void)
+ return error;
+ }
+
+-static int __init i8042_setup_kbd(void)
++static int i8042_setup_kbd(void)
+ {
+ int error;
+
+@@ -1536,7 +1540,7 @@ static int i8042_kbd_bind_notifier(struct notifier_block *nb,
+ return 0;
+ }
+
+-static int __init i8042_probe(struct platform_device *dev)
++static int i8042_probe(struct platform_device *dev)
+ {
+ int error;
+
+@@ -1601,6 +1605,7 @@ static struct platform_driver i8042_driver = {
+ .pm = &i8042_pm_ops,
+ #endif
+ },
++ .probe = i8042_probe,
+ .remove = i8042_remove,
+ .shutdown = i8042_shutdown,
+ };
+@@ -1611,7 +1616,6 @@ static struct notifier_block i8042_kbd_bind_notifier_block = {
+
+ static int __init i8042_init(void)
+ {
+- struct platform_device *pdev;
+ int err;
+
+ dbg_init();
+@@ -1627,17 +1631,29 @@ static int __init i8042_init(void)
+ /* Set this before creating the dev to allow i8042_command to work right away */
+ i8042_present = true;
+
+- pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0);
+- if (IS_ERR(pdev)) {
+- err = PTR_ERR(pdev);
++ err = platform_driver_register(&i8042_driver);
++ if (err)
+ goto err_platform_exit;
++
++ i8042_platform_device = platform_device_alloc("i8042", -1);
++ if (!i8042_platform_device) {
++ err = -ENOMEM;
++ goto err_unregister_driver;
+ }
+
++ err = platform_device_add(i8042_platform_device);
++ if (err)
++ goto err_free_device;
++
+ bus_register_notifier(&serio_bus, &i8042_kbd_bind_notifier_block);
+ panic_blink = i8042_panic_blink;
+
+ return 0;
+
++err_free_device:
++ platform_device_put(i8042_platform_device);
++err_unregister_driver:
++ platform_driver_unregister(&i8042_driver);
+ err_platform_exit:
+ i8042_platform_exit();
+ return err;
+diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c
+index 47f6fee1f3964..1812434cda847 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_port.c
++++ b/drivers/net/ethernet/freescale/fman/fman_port.c
+@@ -1791,7 +1791,7 @@ static int fman_port_probe(struct platform_device *of_dev)
+ fman = dev_get_drvdata(&fm_pdev->dev);
+ if (!fman) {
+ err = -EINVAL;
+- goto return_err;
++ goto put_device;
+ }
+
+ err = of_property_read_u32(port_node, "cell-index", &val);
+@@ -1799,7 +1799,7 @@ static int fman_port_probe(struct platform_device *of_dev)
+ dev_err(port->dev, "%s: reading cell-index for %pOF failed\n",
+ __func__, port_node);
+ err = -EINVAL;
+- goto return_err;
++ goto put_device;
+ }
+ port_id = (u8)val;
+ port->dts_params.id = port_id;
+@@ -1833,7 +1833,7 @@ static int fman_port_probe(struct platform_device *of_dev)
+ } else {
+ dev_err(port->dev, "%s: Illegal port type\n", __func__);
+ err = -EINVAL;
+- goto return_err;
++ goto put_device;
+ }
+
+ port->dts_params.type = port_type;
+@@ -1847,7 +1847,7 @@ static int fman_port_probe(struct platform_device *of_dev)
+ dev_err(port->dev, "%s: incorrect qman-channel-id\n",
+ __func__);
+ err = -EINVAL;
+- goto return_err;
++ goto put_device;
+ }
+ port->dts_params.qman_channel_id = qman_channel_id;
+ }
+@@ -1857,7 +1857,7 @@ static int fman_port_probe(struct platform_device *of_dev)
+ dev_err(port->dev, "%s: of_address_to_resource() failed\n",
+ __func__);
+ err = -ENOMEM;
+- goto return_err;
++ goto put_device;
+ }
+
+ port->dts_params.fman = fman;
+@@ -1882,6 +1882,8 @@ static int fman_port_probe(struct platform_device *of_dev)
+
+ return 0;
+
++put_device:
++ put_device(&fm_pdev->dev);
+ return_err:
+ of_node_put(port_node);
+ free_port:
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 9003702892cda..5979fcf124bb4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3666,12 +3666,11 @@ static int set_feature_arfs(struct net_device *netdev, bool enable)
+
+ static int mlx5e_handle_feature(struct net_device *netdev,
+ netdev_features_t *features,
+- netdev_features_t wanted_features,
+ netdev_features_t feature,
+ mlx5e_feature_handler feature_handler)
+ {
+- netdev_features_t changes = wanted_features ^ netdev->features;
+- bool enable = !!(wanted_features & feature);
++ netdev_features_t changes = *features ^ netdev->features;
++ bool enable = !!(*features & feature);
+ int err;
+
+ if (!(changes & feature))
+@@ -3679,23 +3678,23 @@ static int mlx5e_handle_feature(struct net_device *netdev,
+
+ err = feature_handler(netdev, enable);
+ if (err) {
++ MLX5E_SET_FEATURE(features, feature, !enable);
+ netdev_err(netdev, "%s feature %pNF failed, err %d\n",
+ enable ? "Enable" : "Disable", &feature, err);
+ return err;
+ }
+
+- MLX5E_SET_FEATURE(features, feature, enable);
+ return 0;
+ }
+
+ static int mlx5e_set_features(struct net_device *netdev,
+ netdev_features_t features)
+ {
+- netdev_features_t oper_features = netdev->features;
++ netdev_features_t oper_features = features;
+ int err = 0;
+
+ #define MLX5E_HANDLE_FEATURE(feature, handler) \
+- mlx5e_handle_feature(netdev, &oper_features, features, feature, handler)
++ mlx5e_handle_feature(netdev, &oper_features, feature, handler)
+
+ err |= MLX5E_HANDLE_FEATURE(NETIF_F_LRO, set_feature_lro);
+ err |= MLX5E_HANDLE_FEATURE(NETIF_F_HW_VLAN_CTAG_FILTER,
+diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
+index 9f1777e56d7db..881468ff02bfa 100644
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -498,11 +498,11 @@ static void read_bulk_callback(struct urb *urb)
+ goto goon;
+
+ rx_status = buf[count - 2];
+- if (rx_status & 0x1e) {
++ if (rx_status & 0x1c) {
+ netif_dbg(pegasus, rx_err, net,
+ "RX packet error %x\n", rx_status);
+ net->stats.rx_errors++;
+- if (rx_status & 0x06) /* long or runt */
++ if (rx_status & 0x04) /* runt */
+ net->stats.rx_length_errors++;
+ if (rx_status & 0x08)
+ net->stats.rx_crc_errors++;
+diff --git a/drivers/nfc/st21nfca/i2c.c b/drivers/nfc/st21nfca/i2c.c
+index 1b347096422ff..ebea3b4dd8e1b 100644
+--- a/drivers/nfc/st21nfca/i2c.c
++++ b/drivers/nfc/st21nfca/i2c.c
+@@ -544,7 +544,8 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client,
+ phy->gpiod_ena = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
+ if (IS_ERR(phy->gpiod_ena)) {
+ nfc_err(dev, "Unable to get ENABLE GPIO\n");
+- return PTR_ERR(phy->gpiod_ena);
++ r = PTR_ERR(phy->gpiod_ena);
++ goto out_free;
+ }
+
+ phy->se_status.is_ese_present =
+@@ -555,7 +556,7 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client,
+ r = st21nfca_hci_platform_init(phy);
+ if (r < 0) {
+ nfc_err(&client->dev, "Unable to reboot st21nfca\n");
+- return r;
++ goto out_free;
+ }
+
+ r = devm_request_threaded_irq(&client->dev, client->irq, NULL,
+@@ -564,15 +565,23 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client,
+ ST21NFCA_HCI_DRIVER_NAME, phy);
+ if (r < 0) {
+ nfc_err(&client->dev, "Unable to register IRQ handler\n");
+- return r;
++ goto out_free;
+ }
+
+- return st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
+- ST21NFCA_FRAME_HEADROOM,
+- ST21NFCA_FRAME_TAILROOM,
+- ST21NFCA_HCI_LLC_MAX_PAYLOAD,
+- &phy->hdev,
+- &phy->se_status);
++ r = st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
++ ST21NFCA_FRAME_HEADROOM,
++ ST21NFCA_FRAME_TAILROOM,
++ ST21NFCA_HCI_LLC_MAX_PAYLOAD,
++ &phy->hdev,
++ &phy->se_status);
++ if (r)
++ goto out_free;
++
++ return 0;
++
++out_free:
++ kfree_skb(phy->pending_skb);
++ return r;
+ }
+
+ static int st21nfca_hci_i2c_remove(struct i2c_client *client)
+@@ -585,6 +594,8 @@ static int st21nfca_hci_i2c_remove(struct i2c_client *client)
+
+ if (phy->powered)
+ st21nfca_hci_i2c_disable(phy);
++ if (phy->pending_skb)
++ kfree_skb(phy->pending_skb);
+
+ return 0;
+ }
+diff --git a/drivers/platform/x86/apple-gmux.c b/drivers/platform/x86/apple-gmux.c
+index fd2ffebc868fc..caa03565c139b 100644
+--- a/drivers/platform/x86/apple-gmux.c
++++ b/drivers/platform/x86/apple-gmux.c
+@@ -628,7 +628,7 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
+ }
+
+ gmux_data->iostart = res->start;
+- gmux_data->iolen = res->end - res->start;
++ gmux_data->iolen = resource_size(res);
+
+ if (gmux_data->iolen < GMUX_MIN_IO_LEN) {
+ pr_err("gmux I/O region too small (%lu < %u)\n",
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index 2c70e311943ac..0a908d1cc494a 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -2267,8 +2267,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf,
+ char mybuf[64];
+ char *pbuf;
+
+- if (nbytes > 64)
+- nbytes = 64;
++ if (nbytes > 63)
++ nbytes = 63;
+
+ memset(mybuf, 0, sizeof(mybuf));
+
+diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
+index 2c707b5c7b0b7..68b5177bf09d6 100644
+--- a/drivers/scsi/vmw_pvscsi.c
++++ b/drivers/scsi/vmw_pvscsi.c
+@@ -578,9 +578,12 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
+ * Commands like INQUIRY may transfer less data than
+ * requested by the initiator via bufflen. Set residual
+ * count to make upper layer aware of the actual amount
+- * of data returned.
++ * of data returned. There are cases when controller
++ * returns zero dataLen with non zero data - do not set
++ * residual count in that case.
+ */
+- scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen);
++ if (e->dataLen && (e->dataLen < scsi_bufflen(cmd)))
++ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen);
+ cmd->result = (DID_OK << 16);
+ break;
+
+diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
+index 0b9ab1d0dd45d..5fd5aa5f0a1d1 100644
+--- a/drivers/tee/tee_shm.c
++++ b/drivers/tee/tee_shm.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2015-2016, Linaro Limited
++ * Copyright (c) 2015-2017, 2019-2021 Linaro Limited
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+@@ -11,25 +11,17 @@
+ * GNU General Public License for more details.
+ *
+ */
++#include <linux/anon_inodes.h>
+ #include <linux/device.h>
+-#include <linux/dma-buf.h>
+-#include <linux/fdtable.h>
+ #include <linux/idr.h>
++#include <linux/mm.h>
+ #include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/tee_drv.h>
+ #include "tee_private.h"
+
+-static void tee_shm_release(struct tee_shm *shm)
++static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm)
+ {
+- struct tee_device *teedev = shm->teedev;
+-
+- mutex_lock(&teedev->mutex);
+- idr_remove(&teedev->idr, shm->id);
+- if (shm->ctx)
+- list_del(&shm->link);
+- mutex_unlock(&teedev->mutex);
+-
+ if (shm->flags & TEE_SHM_POOL) {
+ struct tee_shm_pool_mgr *poolm;
+
+@@ -61,51 +53,6 @@ static void tee_shm_release(struct tee_shm *shm)
+ tee_device_put(teedev);
+ }
+
+-static struct sg_table *tee_shm_op_map_dma_buf(struct dma_buf_attachment
+- *attach, enum dma_data_direction dir)
+-{
+- return NULL;
+-}
+-
+-static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment *attach,
+- struct sg_table *table,
+- enum dma_data_direction dir)
+-{
+-}
+-
+-static void tee_shm_op_release(struct dma_buf *dmabuf)
+-{
+- struct tee_shm *shm = dmabuf->priv;
+-
+- tee_shm_release(shm);
+-}
+-
+-static void *tee_shm_op_map(struct dma_buf *dmabuf, unsigned long pgnum)
+-{
+- return NULL;
+-}
+-
+-static int tee_shm_op_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
+-{
+- struct tee_shm *shm = dmabuf->priv;
+- size_t size = vma->vm_end - vma->vm_start;
+-
+- /* Refuse sharing shared memory provided by application */
+- if (shm->flags & TEE_SHM_REGISTER)
+- return -EINVAL;
+-
+- return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
+- size, vma->vm_page_prot);
+-}
+-
+-static const struct dma_buf_ops tee_shm_dma_buf_ops = {
+- .map_dma_buf = tee_shm_op_map_dma_buf,
+- .unmap_dma_buf = tee_shm_op_unmap_dma_buf,
+- .release = tee_shm_op_release,
+- .map = tee_shm_op_map,
+- .mmap = tee_shm_op_mmap,
+-};
+-
+ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
+ struct tee_device *teedev,
+ size_t size, u32 flags)
+@@ -146,6 +93,7 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
+ goto err_dev_put;
+ }
+
++ refcount_set(&shm->refcount, 1);
+ shm->flags = flags | TEE_SHM_POOL;
+ shm->teedev = teedev;
+ shm->ctx = ctx;
+@@ -168,21 +116,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
+ goto err_pool_free;
+ }
+
+- if (flags & TEE_SHM_DMA_BUF) {
+- DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+-
+- exp_info.ops = &tee_shm_dma_buf_ops;
+- exp_info.size = shm->size;
+- exp_info.flags = O_RDWR;
+- exp_info.priv = shm;
+-
+- shm->dmabuf = dma_buf_export(&exp_info);
+- if (IS_ERR(shm->dmabuf)) {
+- ret = ERR_CAST(shm->dmabuf);
+- goto err_rem;
+- }
+- }
+-
+ if (ctx) {
+ teedev_ctx_get(ctx);
+ mutex_lock(&teedev->mutex);
+@@ -191,10 +124,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
+ }
+
+ return shm;
+-err_rem:
+- mutex_lock(&teedev->mutex);
+- idr_remove(&teedev->idr, shm->id);
+- mutex_unlock(&teedev->mutex);
+ err_pool_free:
+ poolm->ops->free(poolm, shm);
+ err_kfree:
+@@ -259,6 +188,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
+ goto err;
+ }
+
++ refcount_set(&shm->refcount, 1);
+ shm->flags = flags | TEE_SHM_REGISTER;
+ shm->teedev = teedev;
+ shm->ctx = ctx;
+@@ -299,22 +229,6 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
+ goto err;
+ }
+
+- if (flags & TEE_SHM_DMA_BUF) {
+- DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+-
+- exp_info.ops = &tee_shm_dma_buf_ops;
+- exp_info.size = shm->size;
+- exp_info.flags = O_RDWR;
+- exp_info.priv = shm;
+-
+- shm->dmabuf = dma_buf_export(&exp_info);
+- if (IS_ERR(shm->dmabuf)) {
+- ret = ERR_CAST(shm->dmabuf);
+- teedev->desc->ops->shm_unregister(ctx, shm);
+- goto err;
+- }
+- }
+-
+ mutex_lock(&teedev->mutex);
+ list_add_tail(&shm->link, &ctx->list_shm);
+ mutex_unlock(&teedev->mutex);
+@@ -342,6 +256,35 @@ err:
+ }
+ EXPORT_SYMBOL_GPL(tee_shm_register);
+
++static int tee_shm_fop_release(struct inode *inode, struct file *filp)
++{
++ tee_shm_put(filp->private_data);
++ return 0;
++}
++
++static int tee_shm_fop_mmap(struct file *filp, struct vm_area_struct *vma)
++{
++ struct tee_shm *shm = filp->private_data;
++ size_t size = vma->vm_end - vma->vm_start;
++
++ /* Refuse sharing shared memory provided by application */
++ if (shm->flags & TEE_SHM_USER_MAPPED)
++ return -EINVAL;
++
++ /* check for overflowing the buffer's size */
++ if (vma->vm_pgoff + vma_pages(vma) > shm->size >> PAGE_SHIFT)
++ return -EINVAL;
++
++ return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
++ size, vma->vm_page_prot);
++}
++
++static const struct file_operations tee_shm_fops = {
++ .owner = THIS_MODULE,
++ .release = tee_shm_fop_release,
++ .mmap = tee_shm_fop_mmap,
++};
++
+ /**
+ * tee_shm_get_fd() - Increase reference count and return file descriptor
+ * @shm: Shared memory handle
+@@ -354,10 +297,11 @@ int tee_shm_get_fd(struct tee_shm *shm)
+ if (!(shm->flags & TEE_SHM_DMA_BUF))
+ return -EINVAL;
+
+- get_dma_buf(shm->dmabuf);
+- fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
++ /* matched by tee_shm_put() in tee_shm_op_release() */
++ refcount_inc(&shm->refcount);
++ fd = anon_inode_getfd("tee_shm", &tee_shm_fops, shm, O_RDWR);
+ if (fd < 0)
+- dma_buf_put(shm->dmabuf);
++ tee_shm_put(shm);
+ return fd;
+ }
+
+@@ -367,17 +311,7 @@ int tee_shm_get_fd(struct tee_shm *shm)
+ */
+ void tee_shm_free(struct tee_shm *shm)
+ {
+- /*
+- * dma_buf_put() decreases the dmabuf reference counter and will
+- * call tee_shm_release() when the last reference is gone.
+- *
+- * In the case of driver private memory we call tee_shm_release
+- * directly instead as it doesn't have a reference counter.
+- */
+- if (shm->flags & TEE_SHM_DMA_BUF)
+- dma_buf_put(shm->dmabuf);
+- else
+- tee_shm_release(shm);
++ tee_shm_put(shm);
+ }
+ EXPORT_SYMBOL_GPL(tee_shm_free);
+
+@@ -484,10 +418,15 @@ struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id)
+ teedev = ctx->teedev;
+ mutex_lock(&teedev->mutex);
+ shm = idr_find(&teedev->idr, id);
++ /*
++ * If the tee_shm was found in the IDR it must have a refcount
++ * larger than 0 due to the guarantee in tee_shm_put() below. So
++ * it's safe to use refcount_inc().
++ */
+ if (!shm || shm->ctx != ctx)
+ shm = ERR_PTR(-EINVAL);
+- else if (shm->flags & TEE_SHM_DMA_BUF)
+- get_dma_buf(shm->dmabuf);
++ else
++ refcount_inc(&shm->refcount);
+ mutex_unlock(&teedev->mutex);
+ return shm;
+ }
+@@ -499,7 +438,25 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id);
+ */
+ void tee_shm_put(struct tee_shm *shm)
+ {
+- if (shm->flags & TEE_SHM_DMA_BUF)
+- dma_buf_put(shm->dmabuf);
++ struct tee_device *teedev = shm->teedev;
++ bool do_release = false;
++
++ mutex_lock(&teedev->mutex);
++ if (refcount_dec_and_test(&shm->refcount)) {
++ /*
++ * refcount has reached 0, we must now remove it from the
++ * IDR before releasing the mutex. This will guarantee that
++ * the refcount_inc() in tee_shm_get_from_id() never starts
++ * from 0.
++ */
++ idr_remove(&teedev->idr, shm->id);
++ if (shm->ctx)
++ list_del(&shm->link);
++ do_release = true;
++ }
++ mutex_unlock(&teedev->mutex);
++
++ if (do_release)
++ tee_shm_release(teedev, shm);
+ }
+ EXPORT_SYMBOL_GPL(tee_shm_put);
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index e6805492409f6..f070082124742 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1698,11 +1698,15 @@ static void ffs_data_clear(struct ffs_data *ffs)
+
+ BUG_ON(ffs->gadget);
+
+- if (ffs->epfiles)
++ if (ffs->epfiles) {
+ ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count);
++ ffs->epfiles = NULL;
++ }
+
+- if (ffs->ffs_eventfd)
++ if (ffs->ffs_eventfd) {
+ eventfd_ctx_put(ffs->ffs_eventfd);
++ ffs->ffs_eventfd = NULL;
++ }
+
+ kfree(ffs->raw_descs_data);
+ kfree(ffs->raw_strings);
+@@ -1715,7 +1719,6 @@ static void ffs_data_reset(struct ffs_data *ffs)
+
+ ffs_data_clear(ffs);
+
+- ffs->epfiles = NULL;
+ ffs->raw_descs_data = NULL;
+ ffs->raw_descs = NULL;
+ ffs->raw_strings = NULL;
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index d707993ac9215..e6bbb91955546 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -90,7 +90,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ /* Look for vendor-specific quirks */
+ if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
+ (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK ||
+- pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 ||
+ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1400)) {
+ if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK &&
+ pdev->revision == 0x0) {
+@@ -125,6 +124,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009)
+ xhci->quirks |= XHCI_BROKEN_STREAMS;
+
++ if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
++ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100)
++ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
++
+ if (pdev->vendor == PCI_VENDOR_ID_NEC)
+ xhci->quirks |= XHCI_NEC_HOST;
+
+diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
+index 270721cf229f7..07a6ee8db6123 100644
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -97,6 +97,13 @@ static int mtu3_ep_enable(struct mtu3_ep *mep)
+ interval = clamp_val(interval, 1, 16) - 1;
+ mult = usb_endpoint_maxp_mult(desc) - 1;
+ }
++ break;
++ case USB_SPEED_FULL:
++ if (usb_endpoint_xfer_isoc(desc))
++ interval = clamp_val(desc->bInterval, 1, 16);
++ else if (usb_endpoint_xfer_int(desc))
++ interval = clamp_val(desc->bInterval, 1, 255);
++
+ break;
+ default:
+ break; /*others are ignored */
+diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h
+index a2b3dfcee0b55..535f2ecf3c160 100644
+--- a/include/linux/tee_drv.h
++++ b/include/linux/tee_drv.h
+@@ -177,7 +177,7 @@ void tee_device_unregister(struct tee_device *teedev);
+ * @offset: offset of buffer in user space
+ * @pages: locked pages from userspace
+ * @num_pages: number of locked pages
+- * @dmabuf: dmabuf used to for exporting to user space
++ * @refcount: reference counter
+ * @flags: defined by TEE_SHM_* in tee_drv.h
+ * @id: unique id of a shared memory object on this device
+ *
+@@ -194,7 +194,7 @@ struct tee_shm {
+ unsigned int offset;
+ struct page **pages;
+ size_t num_pages;
+- struct dma_buf *dmabuf;
++ refcount_t refcount;
+ u32 flags;
+ int id;
+ };
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 2c6570e6fcfec..903b2ddde1b43 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -118,6 +118,7 @@ extern struct percpu_counter sctp_sockets_allocated;
+ int sctp_asconf_mgmt(struct sctp_sock *, struct sctp_sockaddr_entry *);
+ struct sk_buff *sctp_skb_recv_datagram(struct sock *, int, int, int *);
+
++typedef int (*sctp_callback_t)(struct sctp_endpoint *, struct sctp_transport *, void *);
+ void sctp_transport_walk_start(struct rhashtable_iter *iter);
+ void sctp_transport_walk_stop(struct rhashtable_iter *iter);
+ struct sctp_transport *sctp_transport_get_next(struct net *net,
+@@ -128,9 +129,8 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *),
+ struct net *net,
+ const union sctp_addr *laddr,
+ const union sctp_addr *paddr, void *p);
+-int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *),
+- int (*cb_done)(struct sctp_transport *, void *),
+- struct net *net, int *pos, void *p);
++int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done,
++ struct net *net, int *pos, void *p);
+ int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), void *p);
+ int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
+ struct sctp_info *info);
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index 2882bc7a5b4b8..18f9924aa2507 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -1348,6 +1348,7 @@ struct sctp_endpoint {
+
+ u32 secid;
+ u32 peer_secid;
++ struct rcu_head rcu;
+ };
+
+ /* Recover the outter endpoint structure. */
+@@ -1363,7 +1364,7 @@ static inline struct sctp_endpoint *sctp_ep(struct sctp_ep_common *base)
+ struct sctp_endpoint *sctp_endpoint_new(struct sock *, gfp_t);
+ void sctp_endpoint_free(struct sctp_endpoint *);
+ void sctp_endpoint_put(struct sctp_endpoint *);
+-void sctp_endpoint_hold(struct sctp_endpoint *);
++int sctp_endpoint_hold(struct sctp_endpoint *ep);
+ void sctp_endpoint_add_asoc(struct sctp_endpoint *, struct sctp_association *);
+ struct sctp_association *sctp_endpoint_lookup_assoc(
+ const struct sctp_endpoint *ep,
+diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
+index f6e3c8c9c7449..4fa4e979e948a 100644
+--- a/include/uapi/linux/nfc.h
++++ b/include/uapi/linux/nfc.h
+@@ -263,7 +263,7 @@ enum nfc_sdp_attr {
+ #define NFC_SE_ENABLED 0x1
+
+ struct sockaddr_nfc {
+- sa_family_t sa_family;
++ __kernel_sa_family_t sa_family;
+ __u32 dev_idx;
+ __u32 target_idx;
+ __u32 nfc_protocol;
+@@ -271,14 +271,14 @@ struct sockaddr_nfc {
+
+ #define NFC_LLCP_MAX_SERVICE_NAME 63
+ struct sockaddr_nfc_llcp {
+- sa_family_t sa_family;
++ __kernel_sa_family_t sa_family;
+ __u32 dev_idx;
+ __u32 target_idx;
+ __u32 nfc_protocol;
+ __u8 dsap; /* Destination SAP, if known */
+ __u8 ssap; /* Source SAP to be bound to */
+ char service_name[NFC_LLCP_MAX_SERVICE_NAME]; /* Service name URI */;
+- size_t service_name_len;
++ __kernel_size_t service_name_len;
+ };
+
+ /* NFC socket protocols */
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index bbf3b3daa9994..713eea9affaad 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1955,6 +1955,10 @@ static int __init inet_init(void)
+
+ ip_init();
+
++ /* Initialise per-cpu ipv4 mibs */
++ if (init_ipv4_mibs())
++ panic("%s: Cannot init ipv4 mibs\n", __func__);
++
+ /* Setup TCP slab cache for open requests. */
+ tcp_init();
+
+@@ -1983,12 +1987,6 @@ static int __init inet_init(void)
+
+ if (init_inet_pernet_ops())
+ pr_crit("%s: Cannot init ipv4 inet pernet ops\n", __func__);
+- /*
+- * Initialise per-cpu ipv4 mibs
+- */
+-
+- if (init_ipv4_mibs())
+- pr_crit("%s: Cannot init ipv4 mibs\n", __func__);
+
+ ipv4_proc_init();
+
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 0198910c2bf27..7d3caafdf2059 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1069,7 +1069,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
+ kfree_skb(skb);
+ return -EINVAL;
+ }
+- if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {
++ if (datalen > cork->gso_size * UDP_MAX_SEGMENTS) {
+ kfree_skb(skb);
+ return -EINVAL;
+ }
+diff --git a/net/sctp/diag.c b/net/sctp/diag.c
+index 8767405de9fa4..0a9db0a7f4234 100644
+--- a/net/sctp/diag.c
++++ b/net/sctp/diag.c
+@@ -307,9 +307,8 @@ out:
+ return err;
+ }
+
+-static int sctp_sock_dump(struct sctp_transport *tsp, void *p)
++static int sctp_sock_dump(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p)
+ {
+- struct sctp_endpoint *ep = tsp->asoc->ep;
+ struct sctp_comm_param *commp = p;
+ struct sock *sk = ep->base.sk;
+ struct sk_buff *skb = commp->skb;
+@@ -319,6 +318,8 @@ static int sctp_sock_dump(struct sctp_transport *tsp, void *p)
+ int err = 0;
+
+ lock_sock(sk);
++ if (ep != tsp->asoc->ep)
++ goto release;
+ list_for_each_entry(assoc, &ep->asocs, asocs) {
+ if (cb->args[4] < cb->args[1])
+ goto next;
+@@ -361,9 +362,8 @@ release:
+ return err;
+ }
+
+-static int sctp_sock_filter(struct sctp_transport *tsp, void *p)
++static int sctp_sock_filter(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p)
+ {
+- struct sctp_endpoint *ep = tsp->asoc->ep;
+ struct sctp_comm_param *commp = p;
+ struct sock *sk = ep->base.sk;
+ const struct inet_diag_req_v2 *r = commp->r;
+@@ -521,8 +521,8 @@ skip:
+ if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)))
+ goto done;
+
+- sctp_for_each_transport(sctp_sock_filter, sctp_sock_dump,
+- net, &pos, &commp);
++ sctp_transport_traverse_process(sctp_sock_filter, sctp_sock_dump,
++ net, &pos, &commp);
+ cb->args[2] = pos;
+
+ done:
+diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
+index 8640dedcf64f1..c4068451b9c76 100644
+--- a/net/sctp/endpointola.c
++++ b/net/sctp/endpointola.c
+@@ -242,6 +242,18 @@ void sctp_endpoint_free(struct sctp_endpoint *ep)
+ }
+
+ /* Final destructor for endpoint. */
++static void sctp_endpoint_destroy_rcu(struct rcu_head *head)
++{
++ struct sctp_endpoint *ep = container_of(head, struct sctp_endpoint, rcu);
++ struct sock *sk = ep->base.sk;
++
++ sctp_sk(sk)->ep = NULL;
++ sock_put(sk);
++
++ kfree(ep);
++ SCTP_DBG_OBJCNT_DEC(ep);
++}
++
+ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
+ {
+ struct sock *sk;
+@@ -275,18 +287,13 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
+ if (sctp_sk(sk)->bind_hash)
+ sctp_put_port(sk);
+
+- sctp_sk(sk)->ep = NULL;
+- /* Give up our hold on the sock */
+- sock_put(sk);
+-
+- kfree(ep);
+- SCTP_DBG_OBJCNT_DEC(ep);
++ call_rcu(&ep->rcu, sctp_endpoint_destroy_rcu);
+ }
+
+ /* Hold a reference to an endpoint. */
+-void sctp_endpoint_hold(struct sctp_endpoint *ep)
++int sctp_endpoint_hold(struct sctp_endpoint *ep)
+ {
+- refcount_inc(&ep->base.refcnt);
++ return refcount_inc_not_zero(&ep->base.refcnt);
+ }
+
+ /* Release a reference to an endpoint and clean up if there are
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 1148f66917079..d429d59228041 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -5056,11 +5056,12 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *),
+ }
+ EXPORT_SYMBOL_GPL(sctp_transport_lookup_process);
+
+-int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *),
+- int (*cb_done)(struct sctp_transport *, void *),
+- struct net *net, int *pos, void *p) {
++int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done,
++ struct net *net, int *pos, void *p)
++{
+ struct rhashtable_iter hti;
+ struct sctp_transport *tsp;
++ struct sctp_endpoint *ep;
+ int ret;
+
+ again:
+@@ -5069,26 +5070,32 @@ again:
+
+ tsp = sctp_transport_get_idx(net, &hti, *pos + 1);
+ for (; !IS_ERR_OR_NULL(tsp); tsp = sctp_transport_get_next(net, &hti)) {
+- ret = cb(tsp, p);
+- if (ret)
+- break;
++ ep = tsp->asoc->ep;
++ if (sctp_endpoint_hold(ep)) { /* asoc can be peeled off */
++ ret = cb(ep, tsp, p);
++ if (ret)
++ break;
++ sctp_endpoint_put(ep);
++ }
+ (*pos)++;
+ sctp_transport_put(tsp);
+ }
+ sctp_transport_walk_stop(&hti);
+
+ if (ret) {
+- if (cb_done && !cb_done(tsp, p)) {
++ if (cb_done && !cb_done(ep, tsp, p)) {
+ (*pos)++;
++ sctp_endpoint_put(ep);
+ sctp_transport_put(tsp);
+ goto again;
+ }
++ sctp_endpoint_put(ep);
+ sctp_transport_put(tsp);
+ }
+
+ return ret;
+ }
+-EXPORT_SYMBOL_GPL(sctp_for_each_transport);
++EXPORT_SYMBOL_GPL(sctp_transport_traverse_process);
+
+ /* 7.2.1 Association Status (SCTP_STATUS)
+
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index d8cbbedef3161..ac2f9e511fc3a 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -252,7 +252,7 @@ if ($arch eq "x86_64") {
+
+ } elsif ($arch eq "s390" && $bits == 64) {
+ if ($cc =~ /-DCC_USING_HOTPATCH/) {
+- $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(bcrl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$";
++ $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(brcl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$";
+ $mcount_adjust = 0;
+ } else {
+ $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_390_(PC|PLT)32DBL\\s+_mcount\\+0x2\$";
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 89dfdbb131291..41e24df986eb4 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -5808,7 +5808,7 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
+ struct common_audit_data ad;
+ struct lsm_network_audit net = {0,};
+ char *addrp;
+- u8 proto;
++ u8 proto = 0;
+
+ if (sk == NULL)
+ return NF_ACCEPT;
+diff --git a/tools/testing/selftests/net/udpgso.c b/tools/testing/selftests/net/udpgso.c
+index 270c17ab071e4..23177b6436067 100644
+--- a/tools/testing/selftests/net/udpgso.c
++++ b/tools/testing/selftests/net/udpgso.c
+@@ -157,13 +157,13 @@ struct testcase testcases_v4[] = {
+ },
+ {
+ /* send max number of min sized segments */
+- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4,
++ .tlen = UDP_MAX_SEGMENTS,
+ .gso_len = 1,
+- .r_num_mss = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4,
++ .r_num_mss = UDP_MAX_SEGMENTS,
+ },
+ {
+ /* send max number + 1 of min sized segments: fail */
+- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V4 + 1,
++ .tlen = UDP_MAX_SEGMENTS + 1,
+ .gso_len = 1,
+ .tfail = true,
+ },
+@@ -260,13 +260,13 @@ struct testcase testcases_v6[] = {
+ },
+ {
+ /* send max number of min sized segments */
+- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6,
++ .tlen = UDP_MAX_SEGMENTS,
+ .gso_len = 1,
+- .r_num_mss = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6,
++ .r_num_mss = UDP_MAX_SEGMENTS,
+ },
+ {
+ /* send max number + 1 of min sized segments: fail */
+- .tlen = UDP_MAX_SEGMENTS - CONST_HDRLEN_V6 + 1,
++ .tlen = UDP_MAX_SEGMENTS + 1,
+ .gso_len = 1,
+ .tfail = true,
+ },
+diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c
+index e821564053cfb..463a2cbd0261a 100644
+--- a/tools/testing/selftests/net/udpgso_bench_tx.c
++++ b/tools/testing/selftests/net/udpgso_bench_tx.c
+@@ -247,6 +247,7 @@ static void usage(const char *filepath)
+
+ static void parse_opts(int argc, char **argv)
+ {
++ const char *bind_addr = NULL;
+ int max_len, hdrlen;
+ int c;
+
+@@ -271,7 +272,7 @@ static void parse_opts(int argc, char **argv)
+ cfg_cpu = strtol(optarg, NULL, 0);
+ break;
+ case 'D':
+- setup_sockaddr(cfg_family, optarg, &cfg_dst_addr);
++ bind_addr = optarg;
+ break;
+ case 'l':
+ cfg_runtime_ms = strtoul(optarg, NULL, 10) * 1000;
+@@ -300,6 +301,11 @@ static void parse_opts(int argc, char **argv)
+ }
+ }
+
++ if (!bind_addr)
++ bind_addr = cfg_family == PF_INET6 ? "::" : "0.0.0.0";
++
++ setup_sockaddr(cfg_family, bind_addr, &cfg_dst_addr);
++
+ if (optind != argc)
+ usage(argv[0]);
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-01-11 13:14 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-01-11 13:14 UTC (permalink / raw
To: gentoo-commits
commit: 3e7a7b5fe117c843fb29b27c99c1403dd633d66e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jan 11 13:14:05 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jan 11 13:14:05 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3e7a7b5f
Linux patch 4.19.225
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1224_linux-4.19.225.patch | 488 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 492 insertions(+)
diff --git a/0000_README b/0000_README
index f8c41458..2d48f74d 100644
--- a/0000_README
+++ b/0000_README
@@ -935,6 +935,10 @@ Patch: 1223_linux-4.19.224.patch
From: https://www.kernel.org
Desc: Linux 4.19.224
+Patch: 1224_linux-4.19.225.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.225
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1224_linux-4.19.225.patch b/1224_linux-4.19.225.patch
new file mode 100644
index 00000000..33d056f1
--- /dev/null
+++ b/1224_linux-4.19.225.patch
@@ -0,0 +1,488 @@
+diff --git a/Makefile b/Makefile
+index cfcecc33b4c1f..891dcd4eadc5b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 224
++SUBLEVEL = 225
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c
+index b8d715c68ca44..11a0806469162 100644
+--- a/drivers/infiniband/core/uverbs_marshall.c
++++ b/drivers/infiniband/core/uverbs_marshall.c
+@@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_device *device,
+ struct rdma_ah_attr *src = ah_attr;
+ struct rdma_ah_attr conv_ah;
+
+- memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
++ memset(&dst->grh, 0, sizeof(dst->grh));
+
+ if ((ah_attr->type == RDMA_AH_ATTR_TYPE_OPA) &&
+ (rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) &&
+diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c
+index faf505462a4f5..f5a06a6fb297f 100644
+--- a/drivers/isdn/mISDN/core.c
++++ b/drivers/isdn/mISDN/core.c
+@@ -390,7 +390,7 @@ mISDNInit(void)
+ err = mISDN_inittimer(&debug);
+ if (err)
+ goto error2;
+- err = l1_init(&debug);
++ err = Isdnl1_Init(&debug);
+ if (err)
+ goto error3;
+ err = Isdnl2_Init(&debug);
+@@ -404,7 +404,7 @@ mISDNInit(void)
+ error5:
+ Isdnl2_cleanup();
+ error4:
+- l1_cleanup();
++ Isdnl1_cleanup();
+ error3:
+ mISDN_timer_cleanup();
+ error2:
+@@ -417,7 +417,7 @@ static void mISDN_cleanup(void)
+ {
+ misdn_sock_cleanup();
+ Isdnl2_cleanup();
+- l1_cleanup();
++ Isdnl1_cleanup();
+ mISDN_timer_cleanup();
+ class_unregister(&mISDN_class);
+
+diff --git a/drivers/isdn/mISDN/core.h b/drivers/isdn/mISDN/core.h
+index 52695bb81ee7a..3c039b6ade2e1 100644
+--- a/drivers/isdn/mISDN/core.h
++++ b/drivers/isdn/mISDN/core.h
+@@ -69,8 +69,8 @@ struct Bprotocol *get_Bprotocol4id(u_int);
+ extern int mISDN_inittimer(u_int *);
+ extern void mISDN_timer_cleanup(void);
+
+-extern int l1_init(u_int *);
+-extern void l1_cleanup(void);
++extern int Isdnl1_Init(u_int *);
++extern void Isdnl1_cleanup(void);
+ extern int Isdnl2_Init(u_int *);
+ extern void Isdnl2_cleanup(void);
+
+diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c
+index 3192b0eb39445..284d3a9c7df7d 100644
+--- a/drivers/isdn/mISDN/layer1.c
++++ b/drivers/isdn/mISDN/layer1.c
+@@ -407,7 +407,7 @@ create_l1(struct dchannel *dch, dchannel_l1callback *dcb) {
+ EXPORT_SYMBOL(create_l1);
+
+ int
+-l1_init(u_int *deb)
++Isdnl1_Init(u_int *deb)
+ {
+ debug = deb;
+ l1fsm_s.state_count = L1S_STATE_COUNT;
+@@ -418,7 +418,7 @@ l1_init(u_int *deb)
+ }
+
+ void
+-l1_cleanup(void)
++Isdnl1_cleanup(void)
+ {
+ mISDN_FsmFree(&l1fsm_s);
+ }
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 51edc7fdc9b9e..1fadc4991c48e 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -96,6 +96,24 @@ MODULE_VERSION(DRV_VERSION);
+
+ static struct workqueue_struct *i40e_wq;
+
++static void netdev_hw_addr_refcnt(struct i40e_mac_filter *f,
++ struct net_device *netdev, int delta)
++{
++ struct netdev_hw_addr *ha;
++
++ if (!f || !netdev)
++ return;
++
++ netdev_for_each_mc_addr(ha, netdev) {
++ if (ether_addr_equal(ha->addr, f->macaddr)) {
++ ha->refcount += delta;
++ if (ha->refcount <= 0)
++ ha->refcount = 1;
++ break;
++ }
++ }
++}
++
+ /**
+ * i40e_allocate_dma_mem_d - OS specific memory alloc for shared code
+ * @hw: pointer to the HW structure
+@@ -2005,6 +2023,7 @@ static void i40e_undo_add_filter_entries(struct i40e_vsi *vsi,
+ hlist_for_each_entry_safe(new, h, from, hlist) {
+ /* We can simply free the wrapper structure */
+ hlist_del(&new->hlist);
++ netdev_hw_addr_refcnt(new->f, vsi->netdev, -1);
+ kfree(new);
+ }
+ }
+@@ -2341,6 +2360,10 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
+ &tmp_add_list,
+ &tmp_del_list,
+ vlan_filters);
++
++ hlist_for_each_entry(new, &tmp_add_list, hlist)
++ netdev_hw_addr_refcnt(new->f, vsi->netdev, 1);
++
+ if (retval)
+ goto err_no_memory_locked;
+
+@@ -2473,6 +2496,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
+ if (new->f->state == I40E_FILTER_NEW)
+ new->f->state = new->state;
+ hlist_del(&new->hlist);
++ netdev_hw_addr_refcnt(new->f, vsi->netdev, -1);
+ kfree(new);
+ }
+ spin_unlock_bh(&vsi->mac_filter_hash_lock);
+@@ -7716,6 +7740,27 @@ int i40e_open(struct net_device *netdev)
+ return 0;
+ }
+
++/**
++ * i40e_netif_set_realnum_tx_rx_queues - Update number of tx/rx queues
++ * @vsi: vsi structure
++ *
++ * This updates netdev's number of tx/rx queues
++ *
++ * Returns status of setting tx/rx queues
++ **/
++static int i40e_netif_set_realnum_tx_rx_queues(struct i40e_vsi *vsi)
++{
++ int ret;
++
++ ret = netif_set_real_num_rx_queues(vsi->netdev,
++ vsi->num_queue_pairs);
++ if (ret)
++ return ret;
++
++ return netif_set_real_num_tx_queues(vsi->netdev,
++ vsi->num_queue_pairs);
++}
++
+ /**
+ * i40e_vsi_open -
+ * @vsi: the VSI to open
+@@ -7752,13 +7797,7 @@ int i40e_vsi_open(struct i40e_vsi *vsi)
+ goto err_setup_rx;
+
+ /* Notify the stack of the actual queue counts. */
+- err = netif_set_real_num_tx_queues(vsi->netdev,
+- vsi->num_queue_pairs);
+- if (err)
+- goto err_set_queues;
+-
+- err = netif_set_real_num_rx_queues(vsi->netdev,
+- vsi->num_queue_pairs);
++ err = i40e_netif_set_realnum_tx_rx_queues(vsi);
+ if (err)
+ goto err_set_queues;
+
+@@ -12785,6 +12824,9 @@ struct i40e_vsi *i40e_vsi_setup(struct i40e_pf *pf, u8 type,
+ case I40E_VSI_MAIN:
+ case I40E_VSI_VMDQ2:
+ ret = i40e_config_netdev(vsi);
++ if (ret)
++ goto err_netdev;
++ ret = i40e_netif_set_realnum_tx_rx_queues(vsi);
+ if (ret)
+ goto err_netdev;
+ ret = register_netdev(vsi->netdev);
+diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
+index a2b876abb03b2..7abbf569ee7d7 100644
+--- a/drivers/net/ieee802154/atusb.c
++++ b/drivers/net/ieee802154/atusb.c
+@@ -96,7 +96,9 @@ static int atusb_control_msg(struct atusb *atusb, unsigned int pipe,
+
+ ret = usb_control_msg(usb_dev, pipe, request, requesttype,
+ value, index, data, size, timeout);
+- if (ret < 0) {
++ if (ret < size) {
++ ret = ret < 0 ? ret : -ENODATA;
++
+ atusb->err = ret;
+ dev_err(&usb_dev->dev,
+ "%s: req 0x%02x val 0x%x idx 0x%x, error %d\n",
+@@ -864,9 +866,9 @@ static int atusb_get_and_show_build(struct atusb *atusb)
+ if (!build)
+ return -ENOMEM;
+
+- ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0),
+- ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0,
+- build, ATUSB_BUILD_SIZE, 1000);
++ /* We cannot call atusb_control_msg() here, since this request may read various length data */
++ ret = usb_control_msg(atusb->usb_dev, usb_rcvctrlpipe(usb_dev, 0), ATUSB_BUILD,
++ ATUSB_REQ_FROM_DEV, 0, 0, build, ATUSB_BUILD_SIZE, 1000);
+ if (ret >= 0) {
+ build[ret] = 0;
+ dev_info(&usb_dev->dev, "Firmware: build %s\n", build);
+diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
+index d3f79a4067e22..ab41a63aa4aaa 100644
+--- a/drivers/net/usb/rndis_host.c
++++ b/drivers/net/usb/rndis_host.c
+@@ -620,6 +620,11 @@ static const struct usb_device_id products [] = {
+ USB_DEVICE_AND_INTERFACE_INFO(0x1630, 0x0042,
+ USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
+ .driver_info = (unsigned long) &rndis_poll_status_info,
++}, {
++ /* Hytera Communications DMR radios' "Radio to PC Network" */
++ USB_VENDOR_AND_INTERFACE_INFO(0x238b,
++ USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
++ .driver_info = (unsigned long)&rndis_info,
+ }, {
+ /* RNDIS is MSFT's un-official variant of CDC ACM */
+ USB_INTERFACE_INFO(USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
+diff --git a/drivers/power/reset/ltc2952-poweroff.c b/drivers/power/reset/ltc2952-poweroff.c
+index c484584745bc9..8a76ef84119ba 100644
+--- a/drivers/power/reset/ltc2952-poweroff.c
++++ b/drivers/power/reset/ltc2952-poweroff.c
+@@ -170,8 +170,8 @@ static void ltc2952_poweroff_kill(void)
+
+ static void ltc2952_poweroff_default(struct ltc2952_poweroff *data)
+ {
+- data->wde_interval = 300L * 1E6L;
+- data->trigger_delay = ktime_set(2, 500L*1E6L);
++ data->wde_interval = 300L * NSEC_PER_MSEC;
++ data->trigger_delay = ktime_set(2, 500L * NSEC_PER_MSEC);
+
+ hrtimer_init(&data->timer_trigger, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ data->timer_trigger.function = ltc2952_poweroff_timer_trigger;
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 5607fe8541c3a..cb314e3a0fc7a 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -2986,6 +2986,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
+ {
+ struct iscsi_conn *conn = cls_conn->dd_data;
+ struct iscsi_session *session = conn->session;
++ char *tmp_persistent_address = conn->persistent_address;
++ char *tmp_local_ipaddr = conn->local_ipaddr;
+
+ del_timer_sync(&conn->transport_timer);
+
+@@ -3007,8 +3009,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
+ spin_lock_bh(&session->frwd_lock);
+ free_pages((unsigned long) conn->data,
+ get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
+- kfree(conn->persistent_address);
+- kfree(conn->local_ipaddr);
+ /* regular RX path uses back_lock */
+ spin_lock_bh(&session->back_lock);
+ kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
+@@ -3020,6 +3020,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
+ mutex_unlock(&session->eh_mutex);
+
+ iscsi_destroy_conn(cls_conn);
++ kfree(tmp_persistent_address);
++ kfree(tmp_local_ipaddr);
+ }
+ EXPORT_SYMBOL_GPL(iscsi_conn_teardown);
+
+diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
+index 07a6ee8db6123..9f0c949820bf7 100644
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -82,7 +82,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep)
+ if (usb_endpoint_xfer_int(desc) ||
+ usb_endpoint_xfer_isoc(desc)) {
+ interval = desc->bInterval;
+- interval = clamp_val(interval, 1, 16) - 1;
++ interval = clamp_val(interval, 1, 16);
+ if (usb_endpoint_xfer_isoc(desc) && comp_desc)
+ mult = comp_desc->bmAttributes;
+ }
+@@ -94,7 +94,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep)
+ if (usb_endpoint_xfer_isoc(desc) ||
+ usb_endpoint_xfer_int(desc)) {
+ interval = desc->bInterval;
+- interval = clamp_val(interval, 1, 16) - 1;
++ interval = clamp_val(interval, 1, 16);
+ mult = usb_endpoint_maxp_mult(desc) - 1;
+ }
+ break;
+diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
+index 6ffb53edf1b4a..f123089816089 100644
+--- a/fs/xfs/xfs_ioctl.c
++++ b/fs/xfs/xfs_ioctl.c
+@@ -701,7 +701,8 @@ xfs_ioc_space(
+ flags |= XFS_PREALLOC_CLEAR;
+ if (bf->l_start > XFS_ISIZE(ip)) {
+ error = xfs_alloc_file_space(ip, XFS_ISIZE(ip),
+- bf->l_start - XFS_ISIZE(ip), 0);
++ bf->l_start - XFS_ISIZE(ip),
++ XFS_BMAPI_PREALLOC);
+ if (error)
+ goto out_unlock;
+ }
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 8168403427a67..17e337a22c239 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2812,7 +2812,7 @@ struct trace_buffer_struct {
+ char buffer[4][TRACE_BUF_SIZE];
+ };
+
+-static struct trace_buffer_struct *trace_percpu_buffer;
++static struct trace_buffer_struct __percpu *trace_percpu_buffer;
+
+ /*
+ * Thise allows for lockless recording. If we're nested too deeply, then
+@@ -2822,7 +2822,7 @@ static char *get_trace_buf(void)
+ {
+ struct trace_buffer_struct *buffer = this_cpu_ptr(trace_percpu_buffer);
+
+- if (!buffer || buffer->nesting >= 4)
++ if (!trace_percpu_buffer || buffer->nesting >= 4)
+ return NULL;
+
+ buffer->nesting++;
+@@ -2841,7 +2841,7 @@ static void put_trace_buf(void)
+
+ static int alloc_percpu_trace_buffer(void)
+ {
+- struct trace_buffer_struct *buffers;
++ struct trace_buffer_struct __percpu *buffers;
+
+ buffers = alloc_percpu(struct trace_buffer_struct);
+ if (WARN(!buffers, "Could not allocate percpu trace_printk buffer"))
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index fce32f3e42b54..b7acb6afdbce6 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2845,7 +2845,7 @@ int udp4_seq_show(struct seq_file *seq, void *v)
+ {
+ seq_setwidth(seq, 127);
+ if (v == SEQ_START_TOKEN)
+- seq_puts(seq, " sl local_address rem_address st tx_queue "
++ seq_puts(seq, " sl local_address rem_address st tx_queue "
+ "rx_queue tr tm->when retrnsmt uid timeout "
+ "inode ref pointer drops");
+ else {
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 290badfe70e06..866ce815625e5 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -799,6 +799,8 @@ vti6_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ struct net *net = dev_net(dev);
+ struct vti6_net *ip6n = net_generic(net, vti6_net_id);
+
++ memset(&p1, 0, sizeof(p1));
++
+ switch (cmd) {
+ case SIOCGETTUNNEL:
+ if (dev == ip6n->fb_tnl_dev) {
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index d04f3951c5fbc..7e3ab23fc995c 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -4413,6 +4413,19 @@ static void ip6_route_mpath_notify(struct fib6_info *rt,
+ inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags);
+ }
+
++static int fib6_gw_from_attr(struct in6_addr *gw, struct nlattr *nla,
++ struct netlink_ext_ack *extack)
++{
++ if (nla_len(nla) < sizeof(*gw)) {
++ NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_GATEWAY");
++ return -EINVAL;
++ }
++
++ *gw = nla_get_in6_addr(nla);
++
++ return 0;
++}
++
+ static int ip6_route_multipath_add(struct fib6_config *cfg,
+ struct netlink_ext_ack *extack)
+ {
+@@ -4453,7 +4466,11 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
+
+ nla = nla_find(attrs, attrlen, RTA_GATEWAY);
+ if (nla) {
+- r_cfg.fc_gateway = nla_get_in6_addr(nla);
++ err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,
++ extack);
++ if (err)
++ goto cleanup;
++
+ r_cfg.fc_flags |= RTF_GATEWAY;
+ }
+ r_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP);
+@@ -4587,7 +4604,13 @@ static int ip6_route_multipath_del(struct fib6_config *cfg,
+
+ nla = nla_find(attrs, attrlen, RTA_GATEWAY);
+ if (nla) {
+- nla_memcpy(&r_cfg.fc_gateway, nla, 16);
++ err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,
++ extack);
++ if (err) {
++ last_err = err;
++ goto next_rtnh;
++ }
++
+ r_cfg.fc_flags |= RTF_GATEWAY;
+ }
+ }
+@@ -4595,6 +4618,7 @@ static int ip6_route_multipath_del(struct fib6_config *cfg,
+ if (err)
+ last_err = err;
+
++next_rtnh:
+ rtnh = rtnh_next(rtnh, &remaining);
+ }
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index e5c4a72f8e571..8603168b70e40 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -4788,7 +4788,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
+ */
+ if (new_sta) {
+ u32 rates = 0, basic_rates = 0;
+- bool have_higher_than_11mbit;
++ bool have_higher_than_11mbit = false;
+ int min_rate = INT_MAX, min_rate_index = -1;
+ const struct cfg80211_bss_ies *ies;
+ int shift = ieee80211_vif_get_shift(&sdata->vif);
+diff --git a/net/phonet/pep.c b/net/phonet/pep.c
+index c0b4cc1e108b3..fe01cc788448a 100644
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -881,6 +881,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp,
+
+ err = pep_accept_conn(newsk, skb);
+ if (err) {
++ __sock_put(sk);
+ sock_put(newsk);
+ newsk = NULL;
+ goto drop;
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index fa6ad95fb6fb4..20dc1851d4ffe 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -1430,10 +1430,8 @@ static int qfq_init_qdisc(struct Qdisc *sch, struct nlattr *opt,
+ if (err < 0)
+ return err;
+
+- if (qdisc_dev(sch)->tx_queue_len + 1 > QFQ_MAX_AGG_CLASSES)
+- max_classes = QFQ_MAX_AGG_CLASSES;
+- else
+- max_classes = qdisc_dev(sch)->tx_queue_len + 1;
++ max_classes = min_t(u64, (u64)qdisc_dev(sch)->tx_queue_len + 1,
++ QFQ_MAX_AGG_CLASSES);
+ /* max_cl_shift = floor(log_2(max_classes)) */
+ max_cl_shift = __fls(max_classes);
+ q->max_agg_classes = 1<<max_cl_shift;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-01-27 11:39 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-01-27 11:39 UTC (permalink / raw
To: gentoo-commits
commit: fc5d873f0679105e1f87129504df3ac472b55a05
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jan 27 11:39:36 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jan 27 11:39:36 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=fc5d873f
Linux patch 4.19.226
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1225_linux-4.19.226.patch | 7434 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 7438 insertions(+)
diff --git a/0000_README b/0000_README
index 2d48f74d..263aac7b 100644
--- a/0000_README
+++ b/0000_README
@@ -939,6 +939,10 @@ Patch: 1224_linux-4.19.225.patch
From: https://www.kernel.org
Desc: Linux 4.19.225
+Patch: 1225_linux-4.19.226.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.226
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1225_linux-4.19.226.patch b/1225_linux-4.19.226.patch
new file mode 100644
index 00000000..b3670843
--- /dev/null
+++ b/1225_linux-4.19.226.patch
@@ -0,0 +1,7434 @@
+diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
+index e05e581af5cfe..985181dba0bac 100644
+--- a/Documentation/admin-guide/hw-vuln/spectre.rst
++++ b/Documentation/admin-guide/hw-vuln/spectre.rst
+@@ -468,7 +468,7 @@ Spectre variant 2
+ before invoking any firmware code to prevent Spectre variant 2 exploits
+ using the firmware.
+
+- Using kernel address space randomization (CONFIG_RANDOMIZE_SLAB=y
++ Using kernel address space randomization (CONFIG_RANDOMIZE_BASE=y
+ and CONFIG_SLAB_FREELIST_RANDOM=y in the kernel configuration) makes
+ attacks on the kernel generally more difficult.
+
+diff --git a/Makefile b/Makefile
+index 891dcd4eadc5b..72399555ce886 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 225
++SUBLEVEL = 226
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -972,7 +972,7 @@ HOST_LIBELF_LIBS = $(shell pkg-config libelf --libs 2>/dev/null || echo -lelf)
+
+ ifdef CONFIG_STACK_VALIDATION
+ has_libelf := $(call try-run,\
+- echo "int main() {}" | $(HOSTCC) -xc -o /dev/null $(HOST_LIBELF_LIBS) -,1,0)
++ echo "int main() {}" | $(HOSTCC) $(KBUILD_HOSTLDFLAGS) -xc -o /dev/null $(HOST_LIBELF_LIBS) -,1,0)
+ ifeq ($(has_libelf),1)
+ objtool_target := tools/objtool FORCE
+ else
+diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
+index 929459c427605..6f32f12332824 100644
+--- a/arch/arm/boot/dts/armada-38x.dtsi
++++ b/arch/arm/boot/dts/armada-38x.dtsi
+@@ -163,7 +163,7 @@
+ };
+
+ uart0: serial@12000 {
+- compatible = "marvell,armada-38x-uart";
++ compatible = "marvell,armada-38x-uart", "ns16550a";
+ reg = <0x12000 0x100>;
+ reg-shift = <2>;
+ interrupts = <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>;
+@@ -173,7 +173,7 @@
+ };
+
+ uart1: serial@12100 {
+- compatible = "marvell,armada-38x-uart";
++ compatible = "marvell,armada-38x-uart", "ns16550a";
+ reg = <0x12100 0x100>;
+ reg-shift = <2>;
+ interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
+index 75de8134b1d1f..e479bfe681bd9 100644
+--- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
++++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
+@@ -165,12 +165,12 @@
+ regulator-enable-ramp-delay = <1000>;
+ };
+
+- /* Used by DSS */
++ /* Used by DSS and is the "zerov_regulator" trigger for SoC off mode */
+ vcsi: VCSI {
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-enable-ramp-delay = <1000>;
+- regulator-boot-on;
++ regulator-always-on;
+ };
+
+ vdac: VDAC {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+index 70325b273bd2b..c7f06692d6c2a 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi
+@@ -6,6 +6,7 @@
+ */
+
+ #include "meson-gxbb.dtsi"
++#include <dt-bindings/gpio/gpio.h>
+
+ / {
+ aliases {
+diff --git a/arch/arm64/boot/dts/nvidia/tegra186.dtsi b/arch/arm64/boot/dts/nvidia/tegra186.dtsi
+index b762227f6aa18..fc5d047ca50bc 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra186.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra186.dtsi
+@@ -372,7 +372,7 @@
+
+ ccplex@e000000 {
+ compatible = "nvidia,tegra186-ccplex-cluster";
+- reg = <0x0 0x0e000000 0x0 0x3fffff>;
++ reg = <0x0 0x0e000000 0x0 0x400000>;
+
+ nvidia,bpmp = <&bpmp>;
+ };
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index ba42c62399226..078ae020a77b8 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -27,8 +27,8 @@
+ #size-cells = <2>;
+
+ aliases {
+- sdhc1 = &sdhc_1; /* SDC1 eMMC slot */
+- sdhc2 = &sdhc_2; /* SDC2 SD card slot */
++ mmc0 = &sdhc_1; /* SDC1 eMMC slot */
++ mmc1 = &sdhc_2; /* SDC2 SD card slot */
+ };
+
+ chosen { };
+diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c
+index aba6e2d6a736c..dcfa0ea912fe1 100644
+--- a/arch/mips/bcm63xx/clk.c
++++ b/arch/mips/bcm63xx/clk.c
+@@ -387,6 +387,12 @@ struct clk *clk_get_parent(struct clk *clk)
+ }
+ EXPORT_SYMBOL(clk_get_parent);
+
++int clk_set_parent(struct clk *clk, struct clk *parent)
++{
++ return 0;
++}
++EXPORT_SYMBOL(clk_set_parent);
++
+ unsigned long clk_get_rate(struct clk *clk)
+ {
+ if (!clk)
+diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
+index 5ba181e87d2c1..4d83f5bc7211c 100644
+--- a/arch/mips/cavium-octeon/octeon-platform.c
++++ b/arch/mips/cavium-octeon/octeon-platform.c
+@@ -328,6 +328,7 @@ static int __init octeon_ehci_device_init(void)
+
+ pd->dev.platform_data = &octeon_ehci_pdata;
+ octeon_ehci_hw_start(&pd->dev);
++ put_device(&pd->dev);
+
+ return ret;
+ }
+@@ -391,6 +392,7 @@ static int __init octeon_ohci_device_init(void)
+
+ pd->dev.platform_data = &octeon_ohci_pdata;
+ octeon_ohci_hw_start(&pd->dev);
++ put_device(&pd->dev);
+
+ return ret;
+ }
+diff --git a/arch/mips/cavium-octeon/octeon-usb.c b/arch/mips/cavium-octeon/octeon-usb.c
+index 75189ff2f3c78..3465452e28195 100644
+--- a/arch/mips/cavium-octeon/octeon-usb.c
++++ b/arch/mips/cavium-octeon/octeon-usb.c
+@@ -543,6 +543,7 @@ static int __init dwc3_octeon_device_init(void)
+ devm_iounmap(&pdev->dev, base);
+ devm_release_mem_region(&pdev->dev, res->start,
+ resource_size(res));
++ put_device(&pdev->dev);
+ }
+ } while (node != NULL);
+
+diff --git a/arch/mips/include/asm/octeon/cvmx-bootinfo.h b/arch/mips/include/asm/octeon/cvmx-bootinfo.h
+index 62787765575ef..ce6e5fddce0bf 100644
+--- a/arch/mips/include/asm/octeon/cvmx-bootinfo.h
++++ b/arch/mips/include/asm/octeon/cvmx-bootinfo.h
+@@ -315,7 +315,7 @@ enum cvmx_chip_types_enum {
+
+ /* Functions to return string based on type */
+ #define ENUM_BRD_TYPE_CASE(x) \
+- case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */
++ case x: return (&#x[16]); /* Skip CVMX_BOARD_TYPE_ */
+ static inline const char *cvmx_board_type_to_string(enum
+ cvmx_board_types_enum type)
+ {
+@@ -404,7 +404,7 @@ static inline const char *cvmx_board_type_to_string(enum
+ }
+
+ #define ENUM_CHIP_TYPE_CASE(x) \
+- case x: return(#x + 15); /* Skip CVMX_CHIP_TYPE */
++ case x: return (&#x[15]); /* Skip CVMX_CHIP_TYPE */
+ static inline const char *cvmx_chip_type_to_string(enum
+ cvmx_chip_types_enum type)
+ {
+diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c
+index a8e309dcd38d7..f5fab99d1751c 100644
+--- a/arch/mips/lantiq/clk.c
++++ b/arch/mips/lantiq/clk.c
+@@ -166,6 +166,12 @@ struct clk *clk_get_parent(struct clk *clk)
+ }
+ EXPORT_SYMBOL(clk_get_parent);
+
++int clk_set_parent(struct clk *clk, struct clk *parent)
++{
++ return 0;
++}
++EXPORT_SYMBOL(clk_set_parent);
++
+ static inline u32 get_counter_resolution(void)
+ {
+ u32 res;
+diff --git a/arch/mips/mm/gup.c b/arch/mips/mm/gup.c
+index 5a4875cac1ec9..2e7a0d201c09e 100644
+--- a/arch/mips/mm/gup.c
++++ b/arch/mips/mm/gup.c
+@@ -274,7 +274,14 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ next = pgd_addr_end(addr, end);
+ if (pgd_none(pgd))
+ goto slow;
+- if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
++ /*
++ * The FAST_GUP case requires FOLL_WRITE even for pure reads,
++ * because get_user_pages() may need to cause an early COW in
++ * order to avoid confusing the normal COW routines. So only
++ * targets that are already writable are safe to do by just
++ * looking at the page tables.
++ */
++ if (!gup_pud_range(pgd, addr, next, 1, pages, &nr))
+ goto slow;
+ } while (pgdp++, addr = next, addr != end);
+ local_irq_enable();
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index abeb5321a83fc..d7a66d8525091 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -750,7 +750,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
+ * unless pagefault_disable() was called before.
+ */
+
+- if (fault_space == 0 && !faulthandler_disabled())
++ if (faulthandler_disabled() || fault_space == 0)
+ {
+ /* Clean up and return if in exception table. */
+ if (fixup_exception(regs))
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi
+index c90702b04a530..48e5cd61599c6 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi
+@@ -79,6 +79,7 @@ fman0: fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xfc000 0x1000>;
++ fsl,erratum-a009885;
+ };
+
+ xmdio0: mdio@fd000 {
+@@ -86,6 +87,7 @@ fman0: fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xfd000 0x1000>;
++ fsl,erratum-a009885;
+ };
+ };
+
+diff --git a/arch/powerpc/kernel/btext.c b/arch/powerpc/kernel/btext.c
+index b2072d5bbf2bb..a046504d8bfaf 100644
+--- a/arch/powerpc/kernel/btext.c
++++ b/arch/powerpc/kernel/btext.c
+@@ -258,8 +258,10 @@ int __init btext_find_display(int allow_nonstdout)
+ rc = btext_initialize(np);
+ printk("result: %d\n", rc);
+ }
+- if (rc == 0)
++ if (rc == 0) {
++ of_node_put(np);
+ break;
++ }
+ }
+ return rc;
+ }
+diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
+index af1e38febe496..29a8087a49010 100644
+--- a/arch/powerpc/kernel/prom_init.c
++++ b/arch/powerpc/kernel/prom_init.c
+@@ -2805,7 +2805,7 @@ static void __init fixup_device_tree_efika_add_phy(void)
+
+ /* Check if the phy-handle property exists - bail if it does */
+ rv = prom_getprop(node, "phy-handle", prop, sizeof(prop));
+- if (!rv)
++ if (rv <= 0)
+ return;
+
+ /*
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index 14adfeacfa46e..60fc3c71aa7b0 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -564,6 +564,36 @@ void crash_send_ipi(void (*crash_ipi_callback)(struct pt_regs *))
+ }
+ #endif
+
++#ifdef CONFIG_NMI_IPI
++static void crash_stop_this_cpu(struct pt_regs *regs)
++#else
++static void crash_stop_this_cpu(void *dummy)
++#endif
++{
++ /*
++ * Just busy wait here and avoid marking CPU as offline to ensure
++ * register data is captured appropriately.
++ */
++ while (1)
++ cpu_relax();
++}
++
++void crash_smp_send_stop(void)
++{
++ static bool stopped = false;
++
++ if (stopped)
++ return;
++
++ stopped = true;
++
++#ifdef CONFIG_NMI_IPI
++ smp_send_nmi_ipi(NMI_IPI_ALL_OTHERS, crash_stop_this_cpu, 1000000);
++#else
++ smp_call_function(crash_stop_this_cpu, NULL, 0);
++#endif /* CONFIG_NMI_IPI */
++}
++
+ #ifdef CONFIG_NMI_IPI
+ static void nmi_stop_this_cpu(struct pt_regs *regs)
+ {
+@@ -1070,10 +1100,12 @@ void start_secondary(void *unused)
+ BUG();
+ }
+
++#ifdef CONFIG_PROFILING
+ int setup_profiling_timer(unsigned int multiplier)
+ {
+ return 0;
+ }
++#endif
+
+ #ifdef CONFIG_SCHED_SMT
+ /* cpumask of CPUs with asymetric SMT dependancy */
+diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c
+index af3c15a1d41eb..75b2a6c4db5a5 100644
+--- a/arch/powerpc/kernel/watchdog.c
++++ b/arch/powerpc/kernel/watchdog.c
+@@ -132,6 +132,10 @@ static void set_cpumask_stuck(const struct cpumask *cpumask, u64 tb)
+ {
+ cpumask_or(&wd_smp_cpus_stuck, &wd_smp_cpus_stuck, cpumask);
+ cpumask_andnot(&wd_smp_cpus_pending, &wd_smp_cpus_pending, cpumask);
++ /*
++ * See wd_smp_clear_cpu_pending()
++ */
++ smp_mb();
+ if (cpumask_empty(&wd_smp_cpus_pending)) {
+ wd_smp_last_reset_tb = tb;
+ cpumask_andnot(&wd_smp_cpus_pending,
+@@ -217,13 +221,44 @@ static void wd_smp_clear_cpu_pending(int cpu, u64 tb)
+
+ cpumask_clear_cpu(cpu, &wd_smp_cpus_stuck);
+ wd_smp_unlock(&flags);
++ } else {
++ /*
++ * The last CPU to clear pending should have reset the
++ * watchdog so we generally should not find it empty
++ * here if our CPU was clear. However it could happen
++ * due to a rare race with another CPU taking the
++ * last CPU out of the mask concurrently.
++ *
++ * We can't add a warning for it. But just in case
++ * there is a problem with the watchdog that is causing
++ * the mask to not be reset, try to kick it along here.
++ */
++ if (unlikely(cpumask_empty(&wd_smp_cpus_pending)))
++ goto none_pending;
+ }
+ return;
+ }
++
+ cpumask_clear_cpu(cpu, &wd_smp_cpus_pending);
++
++ /*
++ * Order the store to clear pending with the load(s) to check all
++ * words in the pending mask to check they are all empty. This orders
++ * with the same barrier on another CPU. This prevents two CPUs
++ * clearing the last 2 pending bits, but neither seeing the other's
++ * store when checking if the mask is empty, and missing an empty
++ * mask, which ends with a false positive.
++ */
++ smp_mb();
+ if (cpumask_empty(&wd_smp_cpus_pending)) {
+ unsigned long flags;
+
++none_pending:
++ /*
++ * Double check under lock because more than one CPU could see
++ * a clear mask with the lockless check after clearing their
++ * pending bits.
++ */
+ wd_smp_lock(&flags);
+ if (cpumask_empty(&wd_smp_cpus_pending)) {
+ wd_smp_last_reset_tb = tb;
+@@ -314,8 +349,12 @@ void arch_touch_nmi_watchdog(void)
+ {
+ unsigned long ticks = tb_ticks_per_usec * wd_timer_period_ms * 1000;
+ int cpu = smp_processor_id();
+- u64 tb = get_tb();
++ u64 tb;
+
++ if (!cpumask_test_cpu(cpu, &watchdog_cpumask))
++ return;
++
++ tb = get_tb();
+ if (tb - per_cpu(wd_timer_tb, cpu) >= ticks) {
+ per_cpu(wd_timer_tb, cpu) = tb;
+ wd_smp_clear_cpu_pending(cpu, tb);
+diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/cell/iommu.c
+index 12352a58072ab..d9c2c4cc60be1 100644
+--- a/arch/powerpc/platforms/cell/iommu.c
++++ b/arch/powerpc/platforms/cell/iommu.c
+@@ -1088,6 +1088,7 @@ static int __init cell_iommu_fixed_mapping_init(void)
+ if (hbase < dbase || (hend > (dbase + dsize))) {
+ pr_debug("iommu: hash window doesn't fit in"
+ "real DMA window\n");
++ of_node_put(np);
+ return -1;
+ }
+ }
+diff --git a/arch/powerpc/platforms/cell/pervasive.c b/arch/powerpc/platforms/cell/pervasive.c
+index a88944db9fc39..97ac2622ee4e3 100644
+--- a/arch/powerpc/platforms/cell/pervasive.c
++++ b/arch/powerpc/platforms/cell/pervasive.c
+@@ -90,6 +90,7 @@ static int cbe_system_reset_exception(struct pt_regs *regs)
+ switch (regs->msr & SRR1_WAKEMASK) {
+ case SRR1_WAKEDEC:
+ set_dec(1);
++ break;
+ case SRR1_WAKEEE:
+ /*
+ * Handle these when interrupts get re-enabled and we take
+diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+index 8112b39879d67..7b4edf1cb2c8d 100644
+--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+@@ -220,6 +220,7 @@ void hlwd_pic_probe(void)
+ irq_set_chained_handler(cascade_virq,
+ hlwd_pic_irq_cascade);
+ hlwd_irq_host = host;
++ of_node_put(np);
+ break;
+ }
+ }
+diff --git a/arch/powerpc/platforms/powernv/opal-lpc.c b/arch/powerpc/platforms/powernv/opal-lpc.c
+index 6c7ad1d8b32ed..21f0edcfb84ad 100644
+--- a/arch/powerpc/platforms/powernv/opal-lpc.c
++++ b/arch/powerpc/platforms/powernv/opal-lpc.c
+@@ -400,6 +400,7 @@ void __init opal_lpc_init(void)
+ if (!of_get_property(np, "primary", NULL))
+ continue;
+ opal_lpc_chip_id = of_get_ibm_chip_id(np);
++ of_node_put(np);
+ break;
+ }
+ if (opal_lpc_chip_id < 0)
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index dc5ecaea30d71..3dcfe98f70f52 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -1900,6 +1900,13 @@ int kvm_s390_is_stop_irq_pending(struct kvm_vcpu *vcpu)
+ return test_bit(IRQ_PEND_SIGP_STOP, &li->pending_irqs);
+ }
+
++int kvm_s390_is_restart_irq_pending(struct kvm_vcpu *vcpu)
++{
++ struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
++
++ return test_bit(IRQ_PEND_RESTART, &li->pending_irqs);
++}
++
+ void kvm_s390_clear_stop_irq(struct kvm_vcpu *vcpu)
+ {
+ struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 71c67a1d2849a..3aade928c18dd 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -3844,10 +3844,15 @@ void kvm_s390_vcpu_stop(struct kvm_vcpu *vcpu)
+ spin_lock(&vcpu->kvm->arch.start_stop_lock);
+ online_vcpus = atomic_read(&vcpu->kvm->online_vcpus);
+
+- /* SIGP STOP and SIGP STOP AND STORE STATUS has been fully processed */
++ /*
++ * Set the VCPU to STOPPED and THEN clear the interrupt flag,
++ * now that the SIGP STOP and SIGP STOP AND STORE STATUS orders
++ * have been fully processed. This will ensure that the VCPU
++ * is kept BUSY if another VCPU is inquiring with SIGP SENSE.
++ */
++ kvm_s390_set_cpuflags(vcpu, CPUSTAT_STOPPED);
+ kvm_s390_clear_stop_irq(vcpu);
+
+- kvm_s390_set_cpuflags(vcpu, CPUSTAT_STOPPED);
+ __disable_ibs_on_vcpu(vcpu);
+
+ for (i = 0; i < online_vcpus; i++) {
+diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h
+index 0a2ffd5378be2..a7264c1136e14 100644
+--- a/arch/s390/kvm/kvm-s390.h
++++ b/arch/s390/kvm/kvm-s390.h
+@@ -372,6 +372,7 @@ void kvm_s390_destroy_adapters(struct kvm *kvm);
+ int kvm_s390_ext_call_pending(struct kvm_vcpu *vcpu);
+ extern struct kvm_device_ops kvm_flic_ops;
+ int kvm_s390_is_stop_irq_pending(struct kvm_vcpu *vcpu);
++int kvm_s390_is_restart_irq_pending(struct kvm_vcpu *vcpu);
+ void kvm_s390_clear_stop_irq(struct kvm_vcpu *vcpu);
+ int kvm_s390_set_irq_state(struct kvm_vcpu *vcpu,
+ void __user *buf, int len);
+diff --git a/arch/s390/kvm/sigp.c b/arch/s390/kvm/sigp.c
+index 683036c1c92a8..3dc921e853b6e 100644
+--- a/arch/s390/kvm/sigp.c
++++ b/arch/s390/kvm/sigp.c
+@@ -288,6 +288,34 @@ static int handle_sigp_dst(struct kvm_vcpu *vcpu, u8 order_code,
+ if (!dst_vcpu)
+ return SIGP_CC_NOT_OPERATIONAL;
+
++ /*
++ * SIGP RESTART, SIGP STOP, and SIGP STOP AND STORE STATUS orders
++ * are processed asynchronously. Until the affected VCPU finishes
++ * its work and calls back into KVM to clear the (RESTART or STOP)
++ * interrupt, we need to return any new non-reset orders "busy".
++ *
++ * This is important because a single VCPU could issue:
++ * 1) SIGP STOP $DESTINATION
++ * 2) SIGP SENSE $DESTINATION
++ *
++ * If the SIGP SENSE would not be rejected as "busy", it could
++ * return an incorrect answer as to whether the VCPU is STOPPED
++ * or OPERATING.
++ */
++ if (order_code != SIGP_INITIAL_CPU_RESET &&
++ order_code != SIGP_CPU_RESET) {
++ /*
++ * Lockless check. Both SIGP STOP and SIGP (RE)START
++ * properly synchronize everything while processing
++ * their orders, while the guest cannot observe a
++ * difference when issuing other orders from two
++ * different VCPUs.
++ */
++ if (kvm_s390_is_stop_irq_pending(dst_vcpu) ||
++ kvm_s390_is_restart_irq_pending(dst_vcpu))
++ return SIGP_CC_BUSY;
++ }
++
+ switch (order_code) {
+ case SIGP_SENSE:
+ vcpu->stat.instruction_sigp_sense++;
+diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c
+index 9b5b866d8adf1..5389bf5bc8283 100644
+--- a/arch/s390/mm/gup.c
++++ b/arch/s390/mm/gup.c
+@@ -287,7 +287,14 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+
+ might_sleep();
+ start &= PAGE_MASK;
+- nr = __get_user_pages_fast(start, nr_pages, write, pages);
++ /*
++ * The FAST_GUP case requires FOLL_WRITE even for pure reads,
++ * because get_user_pages() may need to cause an early COW in
++ * order to avoid confusing the normal COW routines. So only
++ * targets that are already writable are safe to do by just
++ * looking at the page tables.
++ */
++ nr = __get_user_pages_fast(start, nr_pages, 1, pages);
+ if (nr == nr_pages)
+ return nr;
+
+diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
+index f3bc9c9305da6..3f3c13a4dd0b6 100644
+--- a/arch/s390/mm/pgalloc.c
++++ b/arch/s390/mm/pgalloc.c
+@@ -256,13 +256,15 @@ void page_table_free(struct mm_struct *mm, unsigned long *table)
+ /* Free 2K page table fragment of a 4K page */
+ bit = (__pa(table) & ~PAGE_MASK)/(PTRS_PER_PTE*sizeof(pte_t));
+ spin_lock_bh(&mm->context.lock);
+- mask = atomic_xor_bits(&page->_refcount, 1U << (bit + 24));
++ mask = atomic_xor_bits(&page->_refcount, 0x11U << (bit + 24));
+ mask >>= 24;
+ if (mask & 3)
+ list_add(&page->lru, &mm->context.pgtable_list);
+ else
+ list_del(&page->lru);
+ spin_unlock_bh(&mm->context.lock);
++ mask = atomic_xor_bits(&page->_refcount, 0x10U << (bit + 24));
++ mask >>= 24;
+ if (mask != 0)
+ return;
+ } else {
+diff --git a/arch/sh/mm/gup.c b/arch/sh/mm/gup.c
+index 56c86ca98ecfe..23fa2fc8aabc4 100644
+--- a/arch/sh/mm/gup.c
++++ b/arch/sh/mm/gup.c
+@@ -242,7 +242,14 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ next = pgd_addr_end(addr, end);
+ if (pgd_none(pgd))
+ goto slow;
+- if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
++ /*
++ * The FAST_GUP case requires FOLL_WRITE even for pure reads,
++ * because get_user_pages() may need to cause an early COW in
++ * order to avoid confusing the normal COW routines. So only
++ * targets that are already writable are safe to do by just
++ * looking at the page tables.
++ */
++ if (!gup_pud_range(pgd, addr, next, 1, pages, &nr))
+ goto slow;
+ } while (pgdp++, addr = next, addr != end);
+ local_irq_enable();
+diff --git a/arch/sparc/mm/gup.c b/arch/sparc/mm/gup.c
+index aee6dba83d0ec..f291d34a1cd5e 100644
+--- a/arch/sparc/mm/gup.c
++++ b/arch/sparc/mm/gup.c
+@@ -303,7 +303,14 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ next = pgd_addr_end(addr, end);
+ if (pgd_none(pgd))
+ goto slow;
+- if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
++ /*
++ * The FAST_GUP case requires FOLL_WRITE even for pure reads,
++ * because get_user_pages() may need to cause an early COW in
++ * order to avoid confusing the normal COW routines. So only
++ * targets that are already writable are safe to do by just
++ * looking at the page tables.
++ */
++ if (!gup_pud_range(pgd, addr, next, 1, pages, &nr))
+ goto slow;
+ } while (pgdp++, addr = next, addr != end);
+
+diff --git a/arch/um/include/shared/registers.h b/arch/um/include/shared/registers.h
+index a74449b5b0e31..12ad7c435e97f 100644
+--- a/arch/um/include/shared/registers.h
++++ b/arch/um/include/shared/registers.h
+@@ -16,8 +16,8 @@ extern int restore_fp_registers(int pid, unsigned long *fp_regs);
+ extern int save_fpx_registers(int pid, unsigned long *fp_regs);
+ extern int restore_fpx_registers(int pid, unsigned long *fp_regs);
+ extern int save_registers(int pid, struct uml_pt_regs *regs);
+-extern int restore_registers(int pid, struct uml_pt_regs *regs);
+-extern int init_registers(int pid);
++extern int restore_pid_registers(int pid, struct uml_pt_regs *regs);
++extern int init_pid_registers(int pid);
+ extern void get_safe_registers(unsigned long *regs, unsigned long *fp_regs);
+ extern unsigned long get_thread_reg(int reg, jmp_buf *buf);
+ extern int get_fp_registers(int pid, unsigned long *regs);
+diff --git a/arch/um/os-Linux/registers.c b/arch/um/os-Linux/registers.c
+index 2ff8d4fe83c4f..34a5963bd7efd 100644
+--- a/arch/um/os-Linux/registers.c
++++ b/arch/um/os-Linux/registers.c
+@@ -21,7 +21,7 @@ int save_registers(int pid, struct uml_pt_regs *regs)
+ return 0;
+ }
+
+-int restore_registers(int pid, struct uml_pt_regs *regs)
++int restore_pid_registers(int pid, struct uml_pt_regs *regs)
+ {
+ int err;
+
+@@ -36,7 +36,7 @@ int restore_registers(int pid, struct uml_pt_regs *regs)
+ static unsigned long exec_regs[MAX_REG_NR];
+ static unsigned long exec_fp_regs[FP_SIZE];
+
+-int init_registers(int pid)
++int init_pid_registers(int pid)
+ {
+ int err;
+
+diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c
+index 82bf5f8442ba4..2c75f2d638681 100644
+--- a/arch/um/os-Linux/start_up.c
++++ b/arch/um/os-Linux/start_up.c
+@@ -336,7 +336,7 @@ void __init os_early_checks(void)
+ check_tmpexec();
+
+ pid = start_ptraced_child();
+- if (init_registers(pid))
++ if (init_pid_registers(pid))
+ fatal("Failed to initialize default registers");
+ stop_ptraced_child(pid, 1, 1);
+ }
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+index 9cc524be3c949..14dc3c1f7fb43 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+@@ -354,7 +354,7 @@ static ssize_t flags_write(struct file *filp, const char __user *ubuf,
+ char buf[MAX_FLAG_OPT_SIZE], *__buf;
+ int err;
+
+- if (cnt > MAX_FLAG_OPT_SIZE)
++ if (!cnt || cnt > MAX_FLAG_OPT_SIZE)
+ return -EINVAL;
+
+ if (copy_from_user(&buf, ubuf, cnt))
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 2a13468f87739..8f36ccf26ceca 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -295,11 +295,17 @@ static void wait_for_panic(void)
+ panic("Panicing machine check CPU died");
+ }
+
+-static void mce_panic(const char *msg, struct mce *final, char *exp)
++static noinstr void mce_panic(const char *msg, struct mce *final, char *exp)
+ {
+- int apei_err = 0;
+ struct llist_node *pending;
+ struct mce_evt_llist *l;
++ int apei_err = 0;
++
++ /*
++ * Allow instrumentation around external facilities usage. Not that it
++ * matters a whole lot since the machine is going to panic anyway.
++ */
++ instrumentation_begin();
+
+ if (!fake_panic) {
+ /*
+@@ -314,7 +320,7 @@ static void mce_panic(const char *msg, struct mce *final, char *exp)
+ } else {
+ /* Don't log too much for fake panic */
+ if (atomic_inc_return(&mce_fake_panicked) > 1)
+- return;
++ goto out;
+ }
+ pending = mce_gen_pool_prepare_records();
+ /* First print corrected ones that are still unlogged */
+@@ -352,6 +358,9 @@ static void mce_panic(const char *msg, struct mce *final, char *exp)
+ panic(msg);
+ } else
+ pr_emerg(HW_ERR "Fake kernel panic: %s\n", msg);
++
++out:
++ instrumentation_end();
+ }
+
+ /* Support code for software error injection */
+@@ -642,7 +651,7 @@ static struct notifier_block mce_default_nb = {
+ /*
+ * Read ADDR and MISC registers.
+ */
+-static void mce_read_aux(struct mce *m, int i)
++static noinstr void mce_read_aux(struct mce *m, int i)
+ {
+ if (m->status & MCI_STATUS_MISCV)
+ m->misc = mce_rdmsrl(msr_ops.misc(i));
+@@ -1021,10 +1030,13 @@ static int mce_start(int *no_way_out)
+ * Synchronize between CPUs after main scanning loop.
+ * This invokes the bulk of the Monarch processing.
+ */
+-static int mce_end(int order)
++static noinstr int mce_end(int order)
+ {
+- int ret = -1;
+ u64 timeout = (u64)mca_cfg.monarch_timeout * NSEC_PER_USEC;
++ int ret = -1;
++
++ /* Allow instrumentation around external facilities. */
++ instrumentation_begin();
+
+ if (!timeout)
+ goto reset;
+@@ -1068,7 +1080,8 @@ static int mce_end(int order)
+ /*
+ * Don't reset anything. That's done by the Monarch.
+ */
+- return 0;
++ ret = 0;
++ goto out;
+ }
+
+ /*
+@@ -1083,6 +1096,10 @@ reset:
+ * Let others run again.
+ */
+ atomic_set(&mce_executing, 0);
++
++out:
++ instrumentation_end();
++
+ return ret;
+ }
+
+diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
+index 50d5848bf22ef..d5352b0ae0914 100644
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -515,6 +515,7 @@ static const struct intel_early_ops gen11_early_ops __initconst = {
+ .stolen_size = gen9_stolen_size,
+ };
+
++/* Intel integrated GPUs for which we need to reserve "stolen memory" */
+ static const struct pci_device_id intel_early_ids[] __initconst = {
+ INTEL_I830_IDS(&i830_early_ops),
+ INTEL_I845G_IDS(&i845_early_ops),
+@@ -584,6 +585,13 @@ static void __init intel_graphics_quirks(int num, int slot, int func)
+ u16 device;
+ int i;
+
++ /*
++ * Reserve "stolen memory" for an integrated GPU. If we've already
++ * found one, there's nothing to do for other (discrete) GPUs.
++ */
++ if (resource_size(&intel_graphics_stolen_res))
++ return;
++
+ device = read_pci_config_16(num, slot, func, PCI_DEVICE_ID);
+
+ for (i = 0; i < ARRAY_SIZE(intel_early_ids); i++) {
+@@ -696,7 +704,7 @@ static struct chipset early_qrk[] __initdata = {
+ { PCI_VENDOR_ID_INTEL, 0x3406, PCI_CLASS_BRIDGE_HOST,
+ PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
+ { PCI_VENDOR_ID_INTEL, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA, PCI_ANY_ID,
+- QFLAG_APPLY_ONCE, intel_graphics_quirks },
++ 0, intel_graphics_quirks },
+ /*
+ * HPET on the current version of the Baytrail platform has accuracy
+ * problems: it will halt in deep idle state - so we disable it.
+diff --git a/arch/x86/um/syscalls_64.c b/arch/x86/um/syscalls_64.c
+index 58f51667e2e4b..8249685b40960 100644
+--- a/arch/x86/um/syscalls_64.c
++++ b/arch/x86/um/syscalls_64.c
+@@ -11,6 +11,7 @@
+ #include <linux/uaccess.h>
+ #include <asm/prctl.h> /* XXX This should get the constants from libc */
+ #include <os.h>
++#include <registers.h>
+
+ long arch_prctl(struct task_struct *task, int option,
+ unsigned long __user *arg2)
+@@ -35,7 +36,7 @@ long arch_prctl(struct task_struct *task, int option,
+ switch (option) {
+ case ARCH_SET_FS:
+ case ARCH_SET_GS:
+- ret = restore_registers(pid, ¤t->thread.regs.regs);
++ ret = restore_pid_registers(pid, ¤t->thread.regs.regs);
+ if (ret)
+ return ret;
+ break;
+diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c
+index ba9fbae0cf91f..319f4bc6a8394 100644
+--- a/drivers/acpi/acpica/exoparg1.c
++++ b/drivers/acpi/acpica/exoparg1.c
+@@ -1007,7 +1007,8 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
+ (walk_state, return_desc,
+ &temp_desc);
+ if (ACPI_FAILURE(status)) {
+- goto cleanup;
++ return_ACPI_STATUS
++ (status);
+ }
+
+ return_desc = temp_desc;
+diff --git a/drivers/acpi/acpica/hwesleep.c b/drivers/acpi/acpica/hwesleep.c
+index 9516966124ae3..9380a5e214da4 100644
+--- a/drivers/acpi/acpica/hwesleep.c
++++ b/drivers/acpi/acpica/hwesleep.c
+@@ -104,7 +104,9 @@ acpi_status acpi_hw_extended_sleep(u8 sleep_state)
+
+ /* Flush caches, as per ACPI specification */
+
+- ACPI_FLUSH_CPU_CACHE();
++ if (sleep_state < ACPI_STATE_S4) {
++ ACPI_FLUSH_CPU_CACHE();
++ }
+
+ status = acpi_os_enter_sleep(sleep_state, sleep_control, 0);
+ if (status == AE_CTRL_TERMINATE) {
+diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c
+index f4282370947c8..6368ff544af1a 100644
+--- a/drivers/acpi/acpica/hwsleep.c
++++ b/drivers/acpi/acpica/hwsleep.c
+@@ -110,7 +110,9 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state)
+
+ /* Flush caches, as per ACPI specification */
+
+- ACPI_FLUSH_CPU_CACHE();
++ if (sleep_state < ACPI_STATE_S4) {
++ ACPI_FLUSH_CPU_CACHE();
++ }
+
+ status = acpi_os_enter_sleep(sleep_state, pm1a_control, pm1b_control);
+ if (status == AE_CTRL_TERMINATE) {
+diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c
+index dc1e44ccaae20..d0dca7dae080c 100644
+--- a/drivers/acpi/acpica/hwxfsleep.c
++++ b/drivers/acpi/acpica/hwxfsleep.c
+@@ -189,8 +189,6 @@ acpi_status acpi_enter_sleep_state_s4bios(void)
+ return_ACPI_STATUS(status);
+ }
+
+- ACPI_FLUSH_CPU_CACHE();
+-
+ status = acpi_hw_write_port(acpi_gbl_FADT.smi_command,
+ (u32)acpi_gbl_FADT.s4_bios_request, 8);
+
+diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c
+index 0dc8dea815823..db79a826e6b8d 100644
+--- a/drivers/acpi/acpica/utdelete.c
++++ b/drivers/acpi/acpica/utdelete.c
+@@ -410,6 +410,7 @@ acpi_ut_update_ref_count(union acpi_operand_object *object, u32 action)
+ ACPI_WARNING((AE_INFO,
+ "Obj %p, Reference Count is already zero, cannot decrement\n",
+ object));
++ return;
+ }
+
+ ACPI_DEBUG_PRINT_RAW((ACPI_DB_ALLOCATIONS,
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 0bbf8b453ebf2..d4e42a578e186 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -78,6 +78,7 @@ static int battery_bix_broken_package;
+ static int battery_notification_delay_ms;
+ static int battery_ac_is_broken;
+ static int battery_check_pmic = 1;
++static int battery_quirk_notcharging;
+ static unsigned int cache_time = 1000;
+ module_param(cache_time, uint, 0644);
+ MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
+@@ -246,6 +247,8 @@ static int acpi_battery_get_property(struct power_supply *psy,
+ val->intval = POWER_SUPPLY_STATUS_CHARGING;
+ else if (acpi_battery_is_charged(battery))
+ val->intval = POWER_SUPPLY_STATUS_FULL;
++ else if (battery_quirk_notcharging)
++ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
+ else
+ val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
+ break;
+@@ -1350,6 +1353,12 @@ battery_do_not_check_pmic_quirk(const struct dmi_system_id *d)
+ return 0;
+ }
+
++static int __init battery_quirk_not_charging(const struct dmi_system_id *d)
++{
++ battery_quirk_notcharging = 1;
++ return 0;
++}
++
+ static const struct dmi_system_id bat_dmi_table[] __initconst = {
+ {
+ /* NEC LZ750/LS */
+@@ -1394,6 +1403,19 @@ static const struct dmi_system_id bat_dmi_table[] __initconst = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 320-10ICR"),
+ },
+ },
++ {
++ /*
++ * On Lenovo ThinkPads the BIOS specification defines
++ * a state when the bits for charging and discharging
++ * are both set to 0. That state is "Not Charging".
++ */
++ .callback = battery_quirk_not_charging,
++ .ident = "Lenovo ThinkPad",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad"),
++ },
++ },
+ {},
+ };
+
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 8f444b375761c..e6e95e67c40ee 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -1002,7 +1002,7 @@ static DECLARE_DELAYED_WORK(fd_timer, fd_timer_workfn);
+ static void cancel_activity(void)
+ {
+ do_floppy = NULL;
+- cancel_delayed_work_sync(&fd_timer);
++ cancel_delayed_work(&fd_timer);
+ cancel_work_sync(&floppy_work);
+ }
+
+@@ -3123,6 +3123,8 @@ static void raw_cmd_free(struct floppy_raw_cmd **ptr)
+ }
+ }
+
++#define MAX_LEN (1UL << MAX_ORDER << PAGE_SHIFT)
++
+ static int raw_cmd_copyin(int cmd, void __user *param,
+ struct floppy_raw_cmd **rcmd)
+ {
+@@ -3160,7 +3162,7 @@ loop:
+ ptr->resultcode = 0;
+
+ if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) {
+- if (ptr->length <= 0)
++ if (ptr->length <= 0 || ptr->length >= MAX_LEN)
+ return -EINVAL;
+ ptr->kernel_data = (char *)fd_dma_mem_alloc(ptr->length);
+ fallback_on_nodma_alloc(&ptr->kernel_data, ptr->length);
+diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
+index 0588639b899aa..ef7ed471b6418 100644
+--- a/drivers/bluetooth/bfusb.c
++++ b/drivers/bluetooth/bfusb.c
+@@ -644,6 +644,9 @@ static int bfusb_probe(struct usb_interface *intf, const struct usb_device_id *i
+ data->bulk_out_ep = bulk_out_ep->desc.bEndpointAddress;
+ data->bulk_pkt_size = le16_to_cpu(bulk_out_ep->desc.wMaxPacketSize);
+
++ if (!data->bulk_pkt_size)
++ goto done;
++
+ rwlock_init(&data->lock);
+
+ data->reassembly = NULL;
+diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
+index 3e386f68faa02..1a298f13bcc87 100644
+--- a/drivers/bluetooth/hci_bcm.c
++++ b/drivers/bluetooth/hci_bcm.c
+@@ -1052,7 +1052,12 @@ static int bcm_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ dev->dev = &pdev->dev;
+- dev->irq = platform_get_irq(pdev, 0);
++
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ return ret;
++
++ dev->irq = ret;
+
+ if (has_acpi_companion(&pdev->dev)) {
+ ret = bcm_acpi_probe(dev);
+diff --git a/drivers/char/mwave/3780i.h b/drivers/char/mwave/3780i.h
+index 9ccb6b270b071..95164246afd1a 100644
+--- a/drivers/char/mwave/3780i.h
++++ b/drivers/char/mwave/3780i.h
+@@ -68,7 +68,7 @@ typedef struct {
+ unsigned char ClockControl:1; /* RW: Clock control: 0=normal, 1=stop 3780i clocks */
+ unsigned char SoftReset:1; /* RW: Soft reset 0=normal, 1=soft reset active */
+ unsigned char ConfigMode:1; /* RW: Configuration mode, 0=normal, 1=config mode */
+- unsigned char Reserved:5; /* 0: Reserved */
++ unsigned short Reserved:13; /* 0: Reserved */
+ } DSP_ISA_SLAVE_CONTROL;
+
+
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 297a716f5a560..1127343781465 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -831,8 +831,8 @@ static void do_numa_crng_init(struct work_struct *work)
+ crng_initialize(crng);
+ pool[i] = crng;
+ }
+- mb();
+- if (cmpxchg(&crng_node_pool, NULL, pool)) {
++ /* pairs with READ_ONCE() in select_crng() */
++ if (cmpxchg_release(&crng_node_pool, NULL, pool) != NULL) {
+ for_each_node(i)
+ kfree(pool[i]);
+ kfree(pool);
+@@ -845,8 +845,26 @@ static void numa_crng_init(void)
+ {
+ schedule_work(&numa_crng_init_work);
+ }
++
++static struct crng_state *select_crng(void)
++{
++ struct crng_state **pool;
++ int nid = numa_node_id();
++
++ /* pairs with cmpxchg_release() in do_numa_crng_init() */
++ pool = READ_ONCE(crng_node_pool);
++ if (pool && pool[nid])
++ return pool[nid];
++
++ return &primary_crng;
++}
+ #else
+ static void numa_crng_init(void) {}
++
++static struct crng_state *select_crng(void)
++{
++ return &primary_crng;
++}
+ #endif
+
+ /*
+@@ -951,7 +969,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
+ crng->state[i+4] ^= buf.key[i] ^ rv;
+ }
+ memzero_explicit(&buf, sizeof(buf));
+- crng->init_time = jiffies;
++ WRITE_ONCE(crng->init_time, jiffies);
+ spin_unlock_irqrestore(&crng->lock, flags);
+ if (crng == &primary_crng && crng_init < 2) {
+ invalidate_batched_entropy();
+@@ -978,12 +996,15 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
+ static void _extract_crng(struct crng_state *crng,
+ __u8 out[CHACHA20_BLOCK_SIZE])
+ {
+- unsigned long v, flags;
+-
+- if (crng_ready() &&
+- (time_after(crng_global_init_time, crng->init_time) ||
+- time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL)))
+- crng_reseed(crng, crng == &primary_crng ? &input_pool : NULL);
++ unsigned long v, flags, init_time;
++
++ if (crng_ready()) {
++ init_time = READ_ONCE(crng->init_time);
++ if (time_after(READ_ONCE(crng_global_init_time), init_time) ||
++ time_after(jiffies, init_time + CRNG_RESEED_INTERVAL))
++ crng_reseed(crng, crng == &primary_crng ?
++ &input_pool : NULL);
++ }
+ spin_lock_irqsave(&crng->lock, flags);
+ if (arch_get_random_long(&v))
+ crng->state[14] ^= v;
+@@ -995,15 +1016,7 @@ static void _extract_crng(struct crng_state *crng,
+
+ static void extract_crng(__u8 out[CHACHA20_BLOCK_SIZE])
+ {
+- struct crng_state *crng = NULL;
+-
+-#ifdef CONFIG_NUMA
+- if (crng_node_pool)
+- crng = crng_node_pool[numa_node_id()];
+- if (crng == NULL)
+-#endif
+- crng = &primary_crng;
+- _extract_crng(crng, out);
++ _extract_crng(select_crng(), out);
+ }
+
+ /*
+@@ -1032,15 +1045,7 @@ static void _crng_backtrack_protect(struct crng_state *crng,
+
+ static void crng_backtrack_protect(__u8 tmp[CHACHA20_BLOCK_SIZE], int used)
+ {
+- struct crng_state *crng = NULL;
+-
+-#ifdef CONFIG_NUMA
+- if (crng_node_pool)
+- crng = crng_node_pool[numa_node_id()];
+- if (crng == NULL)
+-#endif
+- crng = &primary_crng;
+- _crng_backtrack_protect(crng, tmp, used);
++ _crng_backtrack_protect(select_crng(), tmp, used);
+ }
+
+ static ssize_t extract_crng_user(void __user *buf, size_t nbytes)
+@@ -2072,7 +2077,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+ if (crng_init < 2)
+ return -ENODATA;
+ crng_reseed(&primary_crng, &input_pool);
+- crng_global_init_time = jiffies - 1;
++ WRITE_ONCE(crng_global_init_time, jiffies - 1);
+ return 0;
+ default:
+ return -EINVAL;
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index c9a5f34097df5..c95ce9323d77a 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -874,7 +874,15 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
+ intmask |= TPM_INTF_CMD_READY_INT | TPM_INTF_LOCALITY_CHANGE_INT |
+ TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT;
+ intmask &= ~TPM_GLOBAL_INT_ENABLE;
++
++ rc = request_locality(chip, 0);
++ if (rc < 0) {
++ rc = -ENODEV;
++ goto out_err;
++ }
++
+ tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask);
++ release_locality(chip, 0);
+
+ rc = tpm2_probe(chip);
+ if (rc)
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index e4fee233849d2..fd78dd5356ed7 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -915,8 +915,7 @@ static int bcm2835_clock_is_on(struct clk_hw *hw)
+
+ static u32 bcm2835_clock_choose_div(struct clk_hw *hw,
+ unsigned long rate,
+- unsigned long parent_rate,
+- bool round_up)
++ unsigned long parent_rate)
+ {
+ struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
+ const struct bcm2835_clock_data *data = clock->data;
+@@ -928,10 +927,6 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw,
+
+ rem = do_div(temp, rate);
+ div = temp;
+-
+- /* Round up and mask off the unused bits */
+- if (round_up && ((div & unused_frac_mask) != 0 || rem != 0))
+- div += unused_frac_mask + 1;
+ div &= ~unused_frac_mask;
+
+ /* different clamping limits apply for a mash clock */
+@@ -1062,7 +1057,7 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw,
+ struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
+ struct bcm2835_cprman *cprman = clock->cprman;
+ const struct bcm2835_clock_data *data = clock->data;
+- u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate, false);
++ u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate);
+ u32 ctl;
+
+ spin_lock(&cprman->regs_lock);
+@@ -1113,7 +1108,7 @@ static unsigned long bcm2835_clock_choose_div_and_prate(struct clk_hw *hw,
+
+ if (!(BIT(parent_idx) & data->set_rate_parent)) {
+ *prate = clk_hw_get_rate(parent);
+- *div = bcm2835_clock_choose_div(hw, rate, *prate, true);
++ *div = bcm2835_clock_choose_div(hw, rate, *prate);
+
+ *avgrate = bcm2835_clock_rate_from_divisor(clock, *prate, *div);
+
+@@ -1199,7 +1194,7 @@ static int bcm2835_clock_determine_rate(struct clk_hw *hw,
+ rate = bcm2835_clock_choose_div_and_prate(hw, i, req->rate,
+ &div, &prate,
+ &avgrate);
+- if (rate > best_rate && rate <= req->rate) {
++ if (abs(req->rate - rate) < abs(req->rate - best_rate)) {
+ best_parent = parent;
+ best_prate = prate;
+ best_rate = rate;
+diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c
+index d8a5db11b7ea1..bffd4d15145d9 100644
+--- a/drivers/crypto/qce/sha.c
++++ b/drivers/crypto/qce/sha.c
+@@ -521,8 +521,8 @@ static int qce_ahash_register_one(const struct qce_ahash_def *def,
+
+ ret = crypto_register_ahash(alg);
+ if (ret) {
+- kfree(tmpl);
+ dev_err(qce->dev, "%s registration failed\n", base->cra_name);
++ kfree(tmpl);
+ return ret;
+ }
+
+diff --git a/drivers/crypto/stm32/stm32-cryp.c b/drivers/crypto/stm32/stm32-cryp.c
+index 23b0b7bd64c7f..b3b49dce11369 100644
+--- a/drivers/crypto/stm32/stm32-cryp.c
++++ b/drivers/crypto/stm32/stm32-cryp.c
+@@ -2036,8 +2036,6 @@ err_engine1:
+ list_del(&cryp->list);
+ spin_unlock(&cryp_list.lock);
+
+- pm_runtime_disable(dev);
+- pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+ pm_runtime_put_noidle(dev);
+
+diff --git a/drivers/crypto/stm32/stm32_crc32.c b/drivers/crypto/stm32/stm32_crc32.c
+index 47d31335c2d42..6848f34a9e66a 100644
+--- a/drivers/crypto/stm32/stm32_crc32.c
++++ b/drivers/crypto/stm32/stm32_crc32.c
+@@ -230,7 +230,7 @@ static struct shash_alg algs[] = {
+ .digestsize = CHKSUM_DIGEST_SIZE,
+ .base = {
+ .cra_name = "crc32",
+- .cra_driver_name = DRIVER_NAME,
++ .cra_driver_name = "stm32-crc32-crc32",
+ .cra_priority = 200,
+ .cra_flags = CRYPTO_ALG_OPTIONAL_KEY,
+ .cra_blocksize = CHKSUM_BLOCK_SIZE,
+@@ -252,7 +252,7 @@ static struct shash_alg algs[] = {
+ .digestsize = CHKSUM_DIGEST_SIZE,
+ .base = {
+ .cra_name = "crc32c",
+- .cra_driver_name = DRIVER_NAME,
++ .cra_driver_name = "stm32-crc32-crc32c",
+ .cra_priority = 200,
+ .cra_flags = CRYPTO_ALG_OPTIONAL_KEY,
+ .cra_blocksize = CHKSUM_BLOCK_SIZE,
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index 1624eee76f96a..04704c6376baf 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -100,6 +100,7 @@
+ #define AT_XDMAC_CNDC_NDE (0x1 << 0) /* Channel x Next Descriptor Enable */
+ #define AT_XDMAC_CNDC_NDSUP (0x1 << 1) /* Channel x Next Descriptor Source Update */
+ #define AT_XDMAC_CNDC_NDDUP (0x1 << 2) /* Channel x Next Descriptor Destination Update */
++#define AT_XDMAC_CNDC_NDVIEW_MASK GENMASK(28, 27)
+ #define AT_XDMAC_CNDC_NDVIEW_NDV0 (0x0 << 3) /* Channel x Next Descriptor View 0 */
+ #define AT_XDMAC_CNDC_NDVIEW_NDV1 (0x1 << 3) /* Channel x Next Descriptor View 1 */
+ #define AT_XDMAC_CNDC_NDVIEW_NDV2 (0x2 << 3) /* Channel x Next Descriptor View 2 */
+@@ -231,15 +232,15 @@ struct at_xdmac {
+
+ /* Linked List Descriptor */
+ struct at_xdmac_lld {
+- dma_addr_t mbr_nda; /* Next Descriptor Member */
+- u32 mbr_ubc; /* Microblock Control Member */
+- dma_addr_t mbr_sa; /* Source Address Member */
+- dma_addr_t mbr_da; /* Destination Address Member */
+- u32 mbr_cfg; /* Configuration Register */
+- u32 mbr_bc; /* Block Control Register */
+- u32 mbr_ds; /* Data Stride Register */
+- u32 mbr_sus; /* Source Microblock Stride Register */
+- u32 mbr_dus; /* Destination Microblock Stride Register */
++ u32 mbr_nda; /* Next Descriptor Member */
++ u32 mbr_ubc; /* Microblock Control Member */
++ u32 mbr_sa; /* Source Address Member */
++ u32 mbr_da; /* Destination Address Member */
++ u32 mbr_cfg; /* Configuration Register */
++ u32 mbr_bc; /* Block Control Register */
++ u32 mbr_ds; /* Data Stride Register */
++ u32 mbr_sus; /* Source Microblock Stride Register */
++ u32 mbr_dus; /* Destination Microblock Stride Register */
+ };
+
+ /* 64-bit alignment needed to update CNDA and CUBC registers in an atomic way. */
+@@ -344,9 +345,6 @@ static void at_xdmac_start_xfer(struct at_xdmac_chan *atchan,
+
+ dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, first);
+
+- if (at_xdmac_chan_is_enabled(atchan))
+- return;
+-
+ /* Set transfer as active to not try to start it again. */
+ first->active_xfer = true;
+
+@@ -362,7 +360,8 @@ static void at_xdmac_start_xfer(struct at_xdmac_chan *atchan,
+ */
+ if (at_xdmac_chan_is_cyclic(atchan))
+ reg = AT_XDMAC_CNDC_NDVIEW_NDV1;
+- else if (first->lld.mbr_ubc & AT_XDMAC_MBR_UBC_NDV3)
++ else if ((first->lld.mbr_ubc &
++ AT_XDMAC_CNDC_NDVIEW_MASK) == AT_XDMAC_MBR_UBC_NDV3)
+ reg = AT_XDMAC_CNDC_NDVIEW_NDV3;
+ else
+ reg = AT_XDMAC_CNDC_NDVIEW_NDV2;
+@@ -427,13 +426,12 @@ static dma_cookie_t at_xdmac_tx_submit(struct dma_async_tx_descriptor *tx)
+ spin_lock_irqsave(&atchan->lock, irqflags);
+ cookie = dma_cookie_assign(tx);
+
++ list_add_tail(&desc->xfer_node, &atchan->xfers_list);
++ spin_unlock_irqrestore(&atchan->lock, irqflags);
++
+ dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_list\n",
+ __func__, atchan, desc);
+- list_add_tail(&desc->xfer_node, &atchan->xfers_list);
+- if (list_is_singular(&atchan->xfers_list))
+- at_xdmac_start_xfer(atchan, desc);
+
+- spin_unlock_irqrestore(&atchan->lock, irqflags);
+ return cookie;
+ }
+
+diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c
+index eb3a1f42ab065..e8b2d3e31de80 100644
+--- a/drivers/dma/mmp_pdma.c
++++ b/drivers/dma/mmp_pdma.c
+@@ -722,12 +722,6 @@ static int mmp_pdma_config(struct dma_chan *dchan,
+
+ chan->dir = cfg->direction;
+ chan->dev_addr = addr;
+- /* FIXME: drivers should be ported over to use the filter
+- * function. Once that's done, the following two lines can
+- * be removed.
+- */
+- if (cfg->slave_id)
+- chan->drcmr = cfg->slave_id;
+
+ return 0;
+ }
+diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c
+index b31c28b67ad3e..c54986902b9d2 100644
+--- a/drivers/dma/pxa_dma.c
++++ b/drivers/dma/pxa_dma.c
+@@ -960,13 +960,6 @@ static void pxad_get_config(struct pxad_chan *chan,
+ *dcmd |= PXA_DCMD_BURST16;
+ else if (maxburst == 32)
+ *dcmd |= PXA_DCMD_BURST32;
+-
+- /* FIXME: drivers should be ported over to use the filter
+- * function. Once that's done, the following two lines can
+- * be removed.
+- */
+- if (chan->cfg.slave_id)
+- chan->drcmr = chan->cfg.slave_id;
+ }
+
+ static struct dma_async_tx_descriptor *
+diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
+index 9c6867916e890..8585fed84e836 100644
+--- a/drivers/dma/stm32-mdma.c
++++ b/drivers/dma/stm32-mdma.c
+@@ -194,7 +194,7 @@
+ #define STM32_MDMA_CTBR(x) (0x68 + 0x40 * (x))
+ #define STM32_MDMA_CTBR_DBUS BIT(17)
+ #define STM32_MDMA_CTBR_SBUS BIT(16)
+-#define STM32_MDMA_CTBR_TSEL_MASK GENMASK(7, 0)
++#define STM32_MDMA_CTBR_TSEL_MASK GENMASK(5, 0)
+ #define STM32_MDMA_CTBR_TSEL(n) STM32_MDMA_SET(n, \
+ STM32_MDMA_CTBR_TSEL_MASK)
+
+diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig
+index a456a000048b9..5a2e2d2a0fff6 100644
+--- a/drivers/firmware/google/Kconfig
++++ b/drivers/firmware/google/Kconfig
+@@ -2,9 +2,9 @@ menuconfig GOOGLE_FIRMWARE
+ bool "Google Firmware Drivers"
+ default n
+ help
+- These firmware drivers are used by Google's servers. They are
+- only useful if you are working directly on one of their
+- proprietary servers. If in doubt, say "N".
++ These firmware drivers are used by Google servers,
++ Chromebooks and other devices using coreboot firmware.
++ If in doubt, say "N".
+
+ if GOOGLE_FIRMWARE
+
+diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
+index 59db70fb45614..314b9bb78e437 100644
+--- a/drivers/firmware/qemu_fw_cfg.c
++++ b/drivers/firmware/qemu_fw_cfg.c
+@@ -385,9 +385,7 @@ static void fw_cfg_sysfs_cache_cleanup(void)
+ struct fw_cfg_sysfs_entry *entry, *next;
+
+ list_for_each_entry_safe(entry, next, &fw_cfg_entry_cache, list) {
+- /* will end up invoking fw_cfg_sysfs_cache_delist()
+- * via each object's release() method (i.e. destructor)
+- */
++ fw_cfg_sysfs_cache_delist(entry);
+ kobject_put(&entry->kobj);
+ }
+ }
+@@ -445,7 +443,6 @@ static void fw_cfg_sysfs_release_entry(struct kobject *kobj)
+ {
+ struct fw_cfg_sysfs_entry *entry = to_entry(kobj);
+
+- fw_cfg_sysfs_cache_delist(entry);
+ kfree(entry);
+ }
+
+@@ -598,20 +595,18 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
+ /* set file entry information */
+ entry->size = be32_to_cpu(f->size);
+ entry->select = be16_to_cpu(f->select);
+- memcpy(entry->name, f->name, FW_CFG_MAX_FILE_PATH);
++ strscpy(entry->name, f->name, FW_CFG_MAX_FILE_PATH);
+
+ /* register entry under "/sys/firmware/qemu_fw_cfg/by_key/" */
+ err = kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype,
+ fw_cfg_sel_ko, "%d", entry->select);
+- if (err) {
+- kobject_put(&entry->kobj);
+- return err;
+- }
++ if (err)
++ goto err_put_entry;
+
+ /* add raw binary content access */
+ err = sysfs_create_bin_file(&entry->kobj, &fw_cfg_sysfs_attr_raw);
+ if (err)
+- goto err_add_raw;
++ goto err_del_entry;
+
+ /* try adding "/sys/firmware/qemu_fw_cfg/by_name/" symlink */
+ fw_cfg_build_symlink(fw_cfg_fname_kset, &entry->kobj, entry->name);
+@@ -620,9 +615,10 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
+ fw_cfg_sysfs_cache_enlist(entry);
+ return 0;
+
+-err_add_raw:
++err_del_entry:
+ kobject_del(&entry->kobj);
+- kfree(entry);
++err_put_entry:
++ kobject_put(&entry->kobj);
+ return err;
+ }
+
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index b018909a4e46c..47cdc1f89e3fb 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -904,10 +904,17 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index)
+ irq_flags = acpi_dev_get_irq_type(info.triggering,
+ info.polarity);
+
+- /* Set type if specified and different than the current one */
+- if (irq_flags != IRQ_TYPE_NONE &&
+- irq_flags != irq_get_trigger_type(irq))
+- irq_set_irq_type(irq, irq_flags);
++ /*
++ * If the IRQ is not already in use then set type
++ * if specified and different than the current one.
++ */
++ if (can_request_irq(irq, irq_flags)) {
++ if (irq_flags != IRQ_TYPE_NONE &&
++ irq_flags != irq_get_trigger_type(irq))
++ irq_set_irq_type(irq, irq_flags);
++ } else {
++ dev_dbg(&adev->dev, "IRQ %d already in use\n", irq);
++ }
+
+ return irq;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+index e1be3fd4d7a45..3e4305c3c9831 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -388,6 +388,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *encoder)
+ native_mode->vdisplay != 0 &&
+ native_mode->clock != 0) {
+ mode = drm_mode_duplicate(dev, native_mode);
++ if (!mode)
++ return NULL;
++
+ mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
+ drm_mode_set_name(mode);
+
+@@ -402,6 +405,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *encoder)
+ * simpler.
+ */
+ mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false);
++ if (!mode)
++ return NULL;
++
+ mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
+ DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name);
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+index 1a744f964b301..358004a4650b6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+@@ -520,10 +520,10 @@ static void gmc_v8_0_mc_program(struct amdgpu_device *adev)
+ static int gmc_v8_0_mc_init(struct amdgpu_device *adev)
+ {
+ int r;
++ u32 tmp;
+
+ adev->gmc.vram_width = amdgpu_atombios_get_vram_width(adev);
+ if (!adev->gmc.vram_width) {
+- u32 tmp;
+ int chansize, numchan;
+
+ /* Get VRAM informations */
+@@ -567,8 +567,15 @@ static int gmc_v8_0_mc_init(struct amdgpu_device *adev)
+ adev->gmc.vram_width = numchan * chansize;
+ }
+ /* size in MB on si */
+- adev->gmc.mc_vram_size = RREG32(mmCONFIG_MEMSIZE) * 1024ULL * 1024ULL;
+- adev->gmc.real_vram_size = RREG32(mmCONFIG_MEMSIZE) * 1024ULL * 1024ULL;
++ tmp = RREG32(mmCONFIG_MEMSIZE);
++ /* some boards may have garbage in the upper 16 bits */
++ if (tmp & 0xffff0000) {
++ DRM_INFO("Probable bad vram size: 0x%08x\n", tmp);
++ if (tmp & 0xffff)
++ tmp &= 0xffff;
++ }
++ adev->gmc.mc_vram_size = tmp * 1024ULL * 1024ULL;
++ adev->gmc.real_vram_size = adev->gmc.mc_vram_size;
+
+ if (!(adev->flags & AMD_IS_APU)) {
+ r = amdgpu_device_resize_fb_bar(adev);
+diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
+index dcf091f9d843f..a8d776edccc15 100644
+--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
++++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
+@@ -302,19 +302,10 @@ out:
+ mutex_unlock(&ge_b850v3_lvds_dev_mutex);
+ }
+
+-static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c,
+- const struct i2c_device_id *id)
++static int ge_b850v3_register(void)
+ {
++ struct i2c_client *stdp4028_i2c = ge_b850v3_lvds_ptr->stdp4028_i2c;
+ struct device *dev = &stdp4028_i2c->dev;
+- int ret;
+-
+- ret = ge_b850v3_lvds_init(dev);
+-
+- if (ret)
+- return ret;
+-
+- ge_b850v3_lvds_ptr->stdp4028_i2c = stdp4028_i2c;
+- i2c_set_clientdata(stdp4028_i2c, ge_b850v3_lvds_ptr);
+
+ /* drm bridge initialization */
+ ge_b850v3_lvds_ptr->bridge.funcs = &ge_b850v3_lvds_funcs;
+@@ -336,6 +327,27 @@ static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c,
+ "ge-b850v3-lvds-dp", ge_b850v3_lvds_ptr);
+ }
+
++static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c,
++ const struct i2c_device_id *id)
++{
++ struct device *dev = &stdp4028_i2c->dev;
++ int ret;
++
++ ret = ge_b850v3_lvds_init(dev);
++
++ if (ret)
++ return ret;
++
++ ge_b850v3_lvds_ptr->stdp4028_i2c = stdp4028_i2c;
++ i2c_set_clientdata(stdp4028_i2c, ge_b850v3_lvds_ptr);
++
++ /* Only register after both bridges are probed */
++ if (!ge_b850v3_lvds_ptr->stdp2690_i2c)
++ return 0;
++
++ return ge_b850v3_register();
++}
++
+ static int stdp4028_ge_b850v3_fw_remove(struct i2c_client *stdp4028_i2c)
+ {
+ ge_b850v3_lvds_remove();
+@@ -379,7 +391,11 @@ static int stdp2690_ge_b850v3_fw_probe(struct i2c_client *stdp2690_i2c,
+ ge_b850v3_lvds_ptr->stdp2690_i2c = stdp2690_i2c;
+ i2c_set_clientdata(stdp2690_i2c, ge_b850v3_lvds_ptr);
+
+- return 0;
++ /* Only register after both bridges are probed */
++ if (!ge_b850v3_lvds_ptr->stdp4028_i2c)
++ return 0;
++
++ return ge_b850v3_register();
+ }
+
+ static int stdp2690_ge_b850v3_fw_remove(struct i2c_client *stdp2690_i2c)
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+index 983e67f19e450..2b57a581b29e2 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+@@ -444,6 +444,12 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data,
+ return -EINVAL;
+ }
+
++ if (args->stream_size > SZ_64K || args->nr_relocs > SZ_64K ||
++ args->nr_bos > SZ_64K || args->nr_pmrs > 128) {
++ DRM_ERROR("submit arguments out of size limits\n");
++ return -EINVAL;
++ }
++
+ /*
+ * Copy the command submission and bo array to kernel space in
+ * one go, and do this outside of any locks.
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index aa8d2aca0f02f..1847faa45d370 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -3002,9 +3002,9 @@ static void snb_wm_latency_quirk(struct drm_i915_private *dev_priv)
+ * The BIOS provided WM memory latency values are often
+ * inadequate for high resolution displays. Adjust them.
+ */
+- changed = ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 12) |
+- ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, 12) |
+- ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, 12);
++ changed = ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 12);
++ changed |= ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, 12);
++ changed |= ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, 12);
+
+ if (!changed)
+ return;
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+index 2d9b7b5fb49c8..52474dcd25738 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+@@ -97,8 +97,8 @@ static int _dpu_danger_signal_status(struct seq_file *s,
+ &status);
+ } else {
+ seq_puts(s, "\nSafe signal status:\n");
+- if (kms->hw_mdp->ops.get_danger_status)
+- kms->hw_mdp->ops.get_danger_status(kms->hw_mdp,
++ if (kms->hw_mdp->ops.get_safe_status)
++ kms->hw_mdp->ops.get_safe_status(kms->hw_mdp,
+ &status);
+ }
+ pm_runtime_put_sync(&kms->pdev->dev);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c
+index ce70a193caa7f..8cf3d1b4662de 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c
+@@ -70,20 +70,13 @@ nvkm_pmu_fini(struct nvkm_subdev *subdev, bool suspend)
+ return 0;
+ }
+
+-static int
++static void
+ nvkm_pmu_reset(struct nvkm_pmu *pmu)
+ {
+ struct nvkm_device *device = pmu->subdev.device;
+
+ if (!pmu->func->enabled(pmu))
+- return 0;
+-
+- /* Inhibit interrupts, and wait for idle. */
+- nvkm_wr32(device, 0x10a014, 0x0000ffff);
+- nvkm_msec(device, 2000,
+- if (!nvkm_rd32(device, 0x10a04c))
+- break;
+- );
++ return;
+
+ /* Reset. */
+ if (pmu->func->reset)
+@@ -94,25 +87,37 @@ nvkm_pmu_reset(struct nvkm_pmu *pmu)
+ if (!(nvkm_rd32(device, 0x10a10c) & 0x00000006))
+ break;
+ );
+-
+- return 0;
+ }
+
+ static int
+ nvkm_pmu_preinit(struct nvkm_subdev *subdev)
+ {
+ struct nvkm_pmu *pmu = nvkm_pmu(subdev);
+- return nvkm_pmu_reset(pmu);
++ nvkm_pmu_reset(pmu);
++ return 0;
+ }
+
+ static int
+ nvkm_pmu_init(struct nvkm_subdev *subdev)
+ {
+ struct nvkm_pmu *pmu = nvkm_pmu(subdev);
+- int ret = nvkm_pmu_reset(pmu);
+- if (ret == 0 && pmu->func->init)
+- ret = pmu->func->init(pmu);
+- return ret;
++ struct nvkm_device *device = pmu->subdev.device;
++
++ if (!pmu->func->init)
++ return 0;
++
++ if (pmu->func->enabled(pmu)) {
++ /* Inhibit interrupts, and wait for idle. */
++ nvkm_wr32(device, 0x10a014, 0x0000ffff);
++ nvkm_msec(device, 2000,
++ if (!nvkm_rd32(device, 0x10a04c))
++ break;
++ );
++
++ nvkm_pmu_reset(pmu);
++ }
++
++ return pmu->func->init(pmu);
+ }
+
+ static int
+diff --git a/drivers/gpu/drm/panel/panel-innolux-p079zca.c b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
+index 88c7d035ace66..362ff5555d2e7 100644
+--- a/drivers/gpu/drm/panel/panel-innolux-p079zca.c
++++ b/drivers/gpu/drm/panel/panel-innolux-p079zca.c
+@@ -512,6 +512,7 @@ static void innolux_panel_del(struct innolux_panel *innolux)
+ static int innolux_panel_probe(struct mipi_dsi_device *dsi)
+ {
+ const struct panel_desc *desc;
++ struct innolux_panel *innolux;
+ int err;
+
+ desc = of_device_get_match_data(&dsi->dev);
+@@ -523,7 +524,14 @@ static int innolux_panel_probe(struct mipi_dsi_device *dsi)
+ if (err < 0)
+ return err;
+
+- return mipi_dsi_attach(dsi);
++ err = mipi_dsi_attach(dsi);
++ if (err < 0) {
++ innolux = mipi_dsi_get_drvdata(dsi);
++ innolux_panel_del(innolux);
++ return err;
++ }
++
++ return 0;
+ }
+
+ static int innolux_panel_remove(struct mipi_dsi_device *dsi)
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index 3f75b4be7fa4a..36c7d0d26e884 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -623,6 +623,8 @@ void radeon_driver_lastclose_kms(struct drm_device *dev)
+ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
+ {
+ struct radeon_device *rdev = dev->dev_private;
++ struct radeon_fpriv *fpriv;
++ struct radeon_vm *vm;
+ int r;
+
+ file_priv->driver_priv = NULL;
+@@ -635,48 +637,52 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
+
+ /* new gpu have virtual address space support */
+ if (rdev->family >= CHIP_CAYMAN) {
+- struct radeon_fpriv *fpriv;
+- struct radeon_vm *vm;
+
+ fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
+ if (unlikely(!fpriv)) {
+ r = -ENOMEM;
+- goto out_suspend;
++ goto err_suspend;
+ }
+
+ if (rdev->accel_working) {
+ vm = &fpriv->vm;
+ r = radeon_vm_init(rdev, vm);
+- if (r) {
+- kfree(fpriv);
+- goto out_suspend;
+- }
++ if (r)
++ goto err_fpriv;
+
+ r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+- if (r) {
+- radeon_vm_fini(rdev, vm);
+- kfree(fpriv);
+- goto out_suspend;
+- }
++ if (r)
++ goto err_vm_fini;
+
+ /* map the ib pool buffer read only into
+ * virtual address space */
+ vm->ib_bo_va = radeon_vm_bo_add(rdev, vm,
+ rdev->ring_tmp_bo.bo);
++ if (!vm->ib_bo_va) {
++ r = -ENOMEM;
++ goto err_vm_fini;
++ }
++
+ r = radeon_vm_bo_set_addr(rdev, vm->ib_bo_va,
+ RADEON_VA_IB_OFFSET,
+ RADEON_VM_PAGE_READABLE |
+ RADEON_VM_PAGE_SNOOPED);
+- if (r) {
+- radeon_vm_fini(rdev, vm);
+- kfree(fpriv);
+- goto out_suspend;
+- }
++ if (r)
++ goto err_vm_fini;
+ }
+ file_priv->driver_priv = fpriv;
+ }
+
+-out_suspend:
++ pm_runtime_mark_last_busy(dev->dev);
++ pm_runtime_put_autosuspend(dev->dev);
++ return 0;
++
++err_vm_fini:
++ radeon_vm_fini(rdev, vm);
++err_fpriv:
++ kfree(fpriv);
++
++err_suspend:
+ pm_runtime_mark_last_busy(dev->dev);
+ pm_runtime_put_autosuspend(dev->dev);
+ return r;
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 4e3dd3f55a963..80ecbf14d3c82 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -392,7 +392,7 @@ static int apple_input_configured(struct hid_device *hdev,
+
+ if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) {
+ hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n");
+- asc->quirks = 0;
++ asc->quirks &= ~APPLE_HAS_FN;
+ }
+
+ return 0;
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index d56ef395eb693..dd3f4aa052980 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -1246,6 +1246,12 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
+
+ input = field->hidinput->input;
+
++ if (usage->type == EV_ABS &&
++ (((*quirks & HID_QUIRK_X_INVERT) && usage->code == ABS_X) ||
++ ((*quirks & HID_QUIRK_Y_INVERT) && usage->code == ABS_Y))) {
++ value = field->logical_maximum - value;
++ }
++
+ if (usage->hat_min < usage->hat_max || usage->hat_dir) {
+ int hat_dir = usage->hat_dir;
+ if (!hat_dir)
+diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
+index 29e63330c1b53..e128b9ce156df 100644
+--- a/drivers/hid/uhid.c
++++ b/drivers/hid/uhid.c
+@@ -31,11 +31,22 @@
+
+ struct uhid_device {
+ struct mutex devlock;
++
++ /* This flag tracks whether the HID device is usable for commands from
++ * userspace. The flag is already set before hid_add_device(), which
++ * runs in workqueue context, to allow hid_add_device() to communicate
++ * with userspace.
++ * However, if hid_add_device() fails, the flag is cleared without
++ * holding devlock.
++ * We guarantee that if @running changes from true to false while you're
++ * holding @devlock, it's still fine to access @hid.
++ */
+ bool running;
+
+ __u8 *rd_data;
+ uint rd_size;
+
++ /* When this is NULL, userspace may use UHID_CREATE/UHID_CREATE2. */
+ struct hid_device *hid;
+ struct uhid_event input_buf;
+
+@@ -66,9 +77,18 @@ static void uhid_device_add_worker(struct work_struct *work)
+ if (ret) {
+ hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret);
+
+- hid_destroy_device(uhid->hid);
+- uhid->hid = NULL;
++ /* We used to call hid_destroy_device() here, but that's really
++ * messy to get right because we have to coordinate with
++ * concurrent writes from userspace that might be in the middle
++ * of using uhid->hid.
++ * Just leave uhid->hid as-is for now, and clean it up when
++ * userspace tries to close or reinitialize the uhid instance.
++ *
++ * However, we do have to clear the ->running flag and do a
++ * wakeup to make sure userspace knows that the device is gone.
++ */
+ uhid->running = false;
++ wake_up_interruptible(&uhid->report_wait);
+ }
+ }
+
+@@ -477,7 +497,7 @@ static int uhid_dev_create2(struct uhid_device *uhid,
+ void *rd_data;
+ int ret;
+
+- if (uhid->running)
++ if (uhid->hid)
+ return -EALREADY;
+
+ rd_size = ev->u.create2.rd_size;
+@@ -559,7 +579,7 @@ static int uhid_dev_create(struct uhid_device *uhid,
+
+ static int uhid_dev_destroy(struct uhid_device *uhid)
+ {
+- if (!uhid->running)
++ if (!uhid->hid)
+ return -EINVAL;
+
+ uhid->running = false;
+@@ -568,6 +588,7 @@ static int uhid_dev_destroy(struct uhid_device *uhid)
+ cancel_work_sync(&uhid->worker);
+
+ hid_destroy_device(uhid->hid);
++ uhid->hid = NULL;
+ kfree(uhid->rd_data);
+
+ return 0;
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index f22f59df02601..254afea67cf37 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2529,6 +2529,24 @@ static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac,
+ }
+ }
+
++static bool wacom_wac_slot_is_active(struct input_dev *dev, int key)
++{
++ struct input_mt *mt = dev->mt;
++ struct input_mt_slot *s;
++
++ if (!mt)
++ return false;
++
++ for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
++ if (s->key == key &&
++ input_mt_get_value(s, ABS_MT_TRACKING_ID) >= 0) {
++ return true;
++ }
++ }
++
++ return false;
++}
++
+ static void wacom_wac_finger_event(struct hid_device *hdev,
+ struct hid_field *field, struct hid_usage *usage, __s32 value)
+ {
+@@ -2571,9 +2589,14 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
+
+
+ if (usage->usage_index + 1 == field->report_count) {
+- if (equivalent_usage == wacom_wac->hid_data.last_slot_field &&
+- wacom_wac->hid_data.confidence)
+- wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
++ if (equivalent_usage == wacom_wac->hid_data.last_slot_field) {
++ bool touch_removed = wacom_wac_slot_is_active(wacom_wac->touch_input,
++ wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch;
++
++ if (wacom_wac->hid_data.confidence || touch_removed) {
++ wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
++ }
++ }
+ }
+ }
+
+@@ -2587,6 +2610,10 @@ static void wacom_wac_finger_pre_report(struct hid_device *hdev,
+
+ hid_data->confidence = true;
+
++ hid_data->cc_report = 0;
++ hid_data->cc_index = -1;
++ hid_data->cc_value_index = -1;
++
+ for (i = 0; i < report->maxfield; i++) {
+ struct hid_field *field = report->field[i];
+ int j;
+@@ -2620,11 +2647,14 @@ static void wacom_wac_finger_pre_report(struct hid_device *hdev,
+ hid_data->cc_index >= 0) {
+ struct hid_field *field = report->field[hid_data->cc_index];
+ int value = field->value[hid_data->cc_value_index];
+- if (value)
++ if (value) {
+ hid_data->num_expected = value;
++ hid_data->num_received = 0;
++ }
+ }
+ else {
+ hid_data->num_expected = wacom_wac->features.touch_max;
++ hid_data->num_received = 0;
+ }
+ }
+
+@@ -2648,6 +2678,7 @@ static void wacom_wac_finger_report(struct hid_device *hdev,
+
+ input_sync(input);
+ wacom_wac->hid_data.num_received = 0;
++ wacom_wac->hid_data.num_expected = 0;
+
+ /* keep touch state for pen event */
+ wacom_wac->shared->touch_down = wacom_wac_finger_count_touches(wacom_wac);
+diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c
+index 71895da63810b..daf2de837a30a 100644
+--- a/drivers/hsi/hsi_core.c
++++ b/drivers/hsi/hsi_core.c
+@@ -115,6 +115,7 @@ struct hsi_client *hsi_new_client(struct hsi_port *port,
+ if (device_register(&cl->device) < 0) {
+ pr_err("hsi: failed to register client: %s\n", info->name);
+ put_device(&cl->device);
++ goto err;
+ }
+
+ return cl;
+diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c
+index d50f804872149..4e6b3fb01c7a6 100644
+--- a/drivers/i2c/busses/i2c-designware-pcidrv.c
++++ b/drivers/i2c/busses/i2c-designware-pcidrv.c
+@@ -36,10 +36,10 @@ enum dw_pci_ctl_id_t {
+ };
+
+ struct dw_scl_sda_cfg {
+- u32 ss_hcnt;
+- u32 fs_hcnt;
+- u32 ss_lcnt;
+- u32 fs_lcnt;
++ u16 ss_hcnt;
++ u16 fs_hcnt;
++ u16 ss_lcnt;
++ u16 fs_lcnt;
+ u32 sda_hold;
+ };
+
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index efafd028c5d16..fb0ddaad87d2e 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -774,6 +774,11 @@ static int i801_block_transaction(struct i801_priv *priv,
+ int result = 0;
+ unsigned char hostc;
+
++ if (read_write == I2C_SMBUS_READ && command == I2C_SMBUS_BLOCK_DATA)
++ data->block[0] = I2C_SMBUS_BLOCK_MAX;
++ else if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX)
++ return -EPROTO;
++
+ if (command == I2C_SMBUS_I2C_BLOCK_DATA) {
+ if (read_write == I2C_SMBUS_WRITE) {
+ /* set I2C_EN bit in configuration register */
+@@ -787,16 +792,6 @@ static int i801_block_transaction(struct i801_priv *priv,
+ }
+ }
+
+- if (read_write == I2C_SMBUS_WRITE
+- || command == I2C_SMBUS_I2C_BLOCK_DATA) {
+- if (data->block[0] < 1)
+- data->block[0] = 1;
+- if (data->block[0] > I2C_SMBUS_BLOCK_MAX)
+- data->block[0] = I2C_SMBUS_BLOCK_MAX;
+- } else {
+- data->block[0] = 32; /* max for SMBus block reads */
+- }
+-
+ /* Experience has shown that the block buffer can only be used for
+ SMBus (not I2C) block transactions, even though the datasheet
+ doesn't mention this limitation. */
+diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
+index af349661fd769..8de8296d25831 100644
+--- a/drivers/i2c/busses/i2c-mpc.c
++++ b/drivers/i2c/busses/i2c-mpc.c
+@@ -105,23 +105,30 @@ static irqreturn_t mpc_i2c_isr(int irq, void *dev_id)
+ /* Sometimes 9th clock pulse isn't generated, and slave doesn't release
+ * the bus, because it wants to send ACK.
+ * Following sequence of enabling/disabling and sending start/stop generates
+- * the 9 pulses, so it's all OK.
++ * the 9 pulses, each with a START then ending with STOP, so it's all OK.
+ */
+ static void mpc_i2c_fixup(struct mpc_i2c *i2c)
+ {
+ int k;
+- u32 delay_val = 1000000 / i2c->real_clk + 1;
+-
+- if (delay_val < 2)
+- delay_val = 2;
++ unsigned long flags;
+
+ for (k = 9; k; k--) {
+ writeccr(i2c, 0);
+- writeccr(i2c, CCR_MSTA | CCR_MTX | CCR_MEN);
++ writeb(0, i2c->base + MPC_I2C_SR); /* clear any status bits */
++ writeccr(i2c, CCR_MEN | CCR_MSTA); /* START */
++ readb(i2c->base + MPC_I2C_DR); /* init xfer */
++ udelay(15); /* let it hit the bus */
++ local_irq_save(flags); /* should not be delayed further */
++ writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSTA); /* delay SDA */
+ readb(i2c->base + MPC_I2C_DR);
+- writeccr(i2c, CCR_MEN);
+- udelay(delay_val << 1);
++ if (k != 1)
++ udelay(5);
++ local_irq_restore(flags);
+ }
++ writeccr(i2c, CCR_MEN); /* Initiate STOP */
++ readb(i2c->base + MPC_I2C_DR);
++ udelay(15); /* Let STOP propagate */
++ writeccr(i2c, 0);
+ }
+
+ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 6a585c3e21923..ffd0f43e2129f 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -1039,7 +1039,8 @@ int ib_find_gid(struct ib_device *device, union ib_gid *gid,
+ for (i = 0; i < device->port_immutable[port].gid_tbl_len; ++i) {
+ ret = rdma_query_gid(device, port, i, &tmp_gid);
+ if (ret)
+- return ret;
++ continue;
++
+ if (!memcmp(&tmp_gid, gid, sizeof *gid)) {
+ *port_num = port;
+ if (index)
+diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
+index 20e3128f59b14..aa48627fc0bfa 100644
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -2483,6 +2483,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ memset(attr, 0, sizeof *attr);
+ memset(init_attr, 0, sizeof *init_attr);
+ attr->qp_state = to_ib_qp_state(qhp->attr.state);
++ attr->cur_qp_state = to_ib_qp_state(qhp->attr.state);
+ init_attr->cap.max_send_wr = qhp->attr.sq_num_entries;
+ init_attr->cap.max_recv_wr = qhp->attr.rq_num_entries;
+ init_attr->cap.max_send_sge = qhp->attr.sq_max_sges;
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index c5cae9a38c044..456c622d7c5c9 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -295,6 +295,9 @@ static enum rdma_link_layer hns_roce_get_link_layer(struct ib_device *device,
+ static int hns_roce_query_pkey(struct ib_device *ib_dev, u8 port, u16 index,
+ u16 *pkey)
+ {
++ if (index > 0)
++ return -EINVAL;
++
+ *pkey = PKEY_ID;
+
+ return 0;
+@@ -429,7 +432,7 @@ static int hns_roce_mmap(struct ib_ucontext *context,
+ return -EINVAL;
+
+ if (vma->vm_pgoff == 0) {
+- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
++ vma->vm_page_prot = pgprot_device(vma->vm_page_prot);
+ if (io_remap_pfn_range(vma, vma->vm_start,
+ to_hr_ucontext(context)->uar.pfn,
+ PAGE_SIZE, vma->vm_page_prot))
+diff --git a/drivers/infiniband/sw/rxe/rxe_opcode.c b/drivers/infiniband/sw/rxe/rxe_opcode.c
+index 4cf11063e0b59..0f166d6d0ccb0 100644
+--- a/drivers/infiniband/sw/rxe/rxe_opcode.c
++++ b/drivers/infiniband/sw/rxe/rxe_opcode.c
+@@ -137,7 +137,7 @@ struct rxe_opcode_info rxe_opcode[RXE_NUM_OPCODE] = {
+ }
+ },
+ [IB_OPCODE_RC_SEND_MIDDLE] = {
+- .name = "IB_OPCODE_RC_SEND_MIDDLE]",
++ .name = "IB_OPCODE_RC_SEND_MIDDLE",
+ .mask = RXE_PAYLOAD_MASK | RXE_REQ_MASK | RXE_SEND_MASK
+ | RXE_MIDDLE_MASK,
+ .length = RXE_BTH_BYTES,
+diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
+index 2f79efd16a052..4bd2dd70acaec 100644
+--- a/drivers/iommu/io-pgtable-arm.c
++++ b/drivers/iommu/io-pgtable-arm.c
+@@ -346,11 +346,12 @@ static int arm_lpae_init_pte(struct arm_lpae_io_pgtable *data,
+ static arm_lpae_iopte arm_lpae_install_table(arm_lpae_iopte *table,
+ arm_lpae_iopte *ptep,
+ arm_lpae_iopte curr,
+- struct io_pgtable_cfg *cfg)
++ struct arm_lpae_io_pgtable *data)
+ {
+ arm_lpae_iopte old, new;
++ struct io_pgtable_cfg *cfg = &data->iop.cfg;
+
+- new = __pa(table) | ARM_LPAE_PTE_TYPE_TABLE;
++ new = paddr_to_iopte(__pa(table), data) | ARM_LPAE_PTE_TYPE_TABLE;
+ if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS)
+ new |= ARM_LPAE_PTE_NSTABLE;
+
+@@ -402,7 +403,7 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova,
+ if (!cptep)
+ return -ENOMEM;
+
+- pte = arm_lpae_install_table(cptep, ptep, 0, cfg);
++ pte = arm_lpae_install_table(cptep, ptep, 0, data);
+ if (pte)
+ __arm_lpae_free_pages(cptep, tblsz, cfg);
+ } else if (!(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA) &&
+@@ -562,7 +563,7 @@ static size_t arm_lpae_split_blk_unmap(struct arm_lpae_io_pgtable *data,
+ __arm_lpae_init_pte(data, blk_paddr, pte, lvl, &tablep[i]);
+ }
+
+- pte = arm_lpae_install_table(tablep, ptep, blk_pte, cfg);
++ pte = arm_lpae_install_table(tablep, ptep, blk_pte, data);
+ if (pte != blk_pte) {
+ __arm_lpae_free_pages(tablep, tablesz, cfg);
+ /*
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index ce5cd05253db9..fdd68d8e8adc6 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -75,8 +75,7 @@ static void free_iova_flush_queue(struct iova_domain *iovad)
+ if (!has_iova_flush_queue(iovad))
+ return;
+
+- if (timer_pending(&iovad->fq_timer))
+- del_timer(&iovad->fq_timer);
++ del_timer_sync(&iovad->fq_timer);
+
+ fq_destroy_all_entries(iovad);
+
+diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
+index 8aae0624a2971..6383afb88f319 100644
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -83,14 +83,16 @@ void inc_children(struct dm_transaction_manager *tm, struct btree_node *n,
+ }
+
+ static int insert_at(size_t value_size, struct btree_node *node, unsigned index,
+- uint64_t key, void *value)
+- __dm_written_to_disk(value)
++ uint64_t key, void *value)
++ __dm_written_to_disk(value)
+ {
+ uint32_t nr_entries = le32_to_cpu(node->header.nr_entries);
++ uint32_t max_entries = le32_to_cpu(node->header.max_entries);
+ __le64 key_le = cpu_to_le64(key);
+
+ if (index > nr_entries ||
+- index >= le32_to_cpu(node->header.max_entries)) {
++ index >= max_entries ||
++ nr_entries >= max_entries) {
+ DMERR("too many entries in btree node for insert");
+ __dm_unbless_for_disk(value);
+ return -ENOMEM;
+diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c
+index a284762e548e1..5115a27196038 100644
+--- a/drivers/md/persistent-data/dm-space-map-common.c
++++ b/drivers/md/persistent-data/dm-space-map-common.c
+@@ -279,6 +279,11 @@ int sm_ll_lookup_bitmap(struct ll_disk *ll, dm_block_t b, uint32_t *result)
+ struct disk_index_entry ie_disk;
+ struct dm_block *blk;
+
++ if (b >= ll->nr_blocks) {
++ DMERR_LIMIT("metadata block out of bounds");
++ return -EINVAL;
++ }
++
+ b = do_div(index, ll->entries_per_block);
+ r = ll->load_ie(ll, index, &ie_disk);
+ if (r < 0)
+diff --git a/drivers/media/common/saa7146/saa7146_fops.c b/drivers/media/common/saa7146/saa7146_fops.c
+index d4987fd05d05f..d91bd32bd1f04 100644
+--- a/drivers/media/common/saa7146/saa7146_fops.c
++++ b/drivers/media/common/saa7146/saa7146_fops.c
+@@ -524,7 +524,7 @@ int saa7146_vv_init(struct saa7146_dev* dev, struct saa7146_ext_vv *ext_vv)
+ ERR("out of memory. aborting.\n");
+ kfree(vv);
+ v4l2_ctrl_handler_free(hdl);
+- return -1;
++ return -ENOMEM;
+ }
+
+ saa7146_video_uops.init(dev,vv);
+diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/drivers/media/common/videobuf2/videobuf2-dma-contig.c
+index aff0ab7bf83d5..bbd5716d4c9cb 100644
+--- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c
++++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c
+@@ -154,7 +154,7 @@ static void *vb2_dc_alloc(struct device *dev, unsigned long attrs,
+ buf->cookie = dma_alloc_attrs(dev, size, &buf->dma_addr,
+ GFP_KERNEL | gfp_flags, buf->attrs);
+ if (!buf->cookie) {
+- dev_err(dev, "dma_alloc_coherent of size %ld failed\n", size);
++ dev_err(dev, "dma_alloc_coherent of size %lu failed\n", size);
+ kfree(buf);
+ return ERR_PTR(-ENOMEM);
+ }
+@@ -206,9 +206,9 @@ static int vb2_dc_mmap(void *buf_priv, struct vm_area_struct *vma)
+
+ vma->vm_ops->open(vma);
+
+- pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %ld\n",
+- __func__, (unsigned long)buf->dma_addr, vma->vm_start,
+- buf->size);
++ pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %lu\n",
++ __func__, (unsigned long)buf->dma_addr, vma->vm_start,
++ buf->size);
+
+ return 0;
+ }
+diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
+index d548f98c7a67d..9e0ef3934fa3d 100644
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -1412,7 +1412,7 @@ static const struct dvb_device dvbdev_dvr = {
+ };
+ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter)
+ {
+- int i;
++ int i, ret;
+
+ if (dmxdev->demux->open(dmxdev->demux) < 0)
+ return -EUSERS;
+@@ -1431,14 +1431,26 @@ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter)
+ DMXDEV_STATE_FREE);
+ }
+
+- dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev,
++ ret = dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev,
+ DVB_DEVICE_DEMUX, dmxdev->filternum);
+- dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr,
++ if (ret < 0)
++ goto err_register_dvbdev;
++
++ ret = dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr,
+ dmxdev, DVB_DEVICE_DVR, dmxdev->filternum);
++ if (ret < 0)
++ goto err_register_dvr_dvbdev;
+
+ dvb_ringbuffer_init(&dmxdev->dvr_buffer, NULL, 8192);
+
+ return 0;
++
++err_register_dvr_dvbdev:
++ dvb_unregister_device(dmxdev->dvbdev);
++err_register_dvbdev:
++ vfree(dmxdev->filter);
++ dmxdev->filter = NULL;
++ return ret;
+ }
+
+ EXPORT_SYMBOL(dvb_dmxdev_init);
+diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c
+index 5fa787e023c7e..4b9e4afa4c61f 100644
+--- a/drivers/media/dvb-frontends/dib8000.c
++++ b/drivers/media/dvb-frontends/dib8000.c
+@@ -4476,8 +4476,10 @@ static struct dvb_frontend *dib8000_init(struct i2c_adapter *i2c_adap, u8 i2c_ad
+
+ state->timf_default = cfg->pll->timf;
+
+- if (dib8000_identify(&state->i2c) == 0)
++ if (dib8000_identify(&state->i2c) == 0) {
++ kfree(fe);
+ goto error;
++ }
+
+ dibx000_init_i2c_master(&state->i2c_master, DIB8000, state->i2c.adap, state->i2c.addr);
+
+diff --git a/drivers/media/pci/b2c2/flexcop-pci.c b/drivers/media/pci/b2c2/flexcop-pci.c
+index cc6527e355373..b7d8e34ffd5da 100644
+--- a/drivers/media/pci/b2c2/flexcop-pci.c
++++ b/drivers/media/pci/b2c2/flexcop-pci.c
+@@ -184,6 +184,8 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_id)
+ dma_addr_t cur_addr =
+ fc->read_ibi_reg(fc,dma1_008).dma_0x8.dma_cur_addr << 2;
+ u32 cur_pos = cur_addr - fc_pci->dma[0].dma_addr0;
++ if (cur_pos > fc_pci->dma[0].size * 2)
++ goto error;
+
+ deb_irq("%u irq: %08x cur_addr: %llx: cur_pos: %08x, last_cur_pos: %08x ",
+ jiffies_to_usecs(jiffies - fc_pci->last_irq),
+@@ -224,6 +226,7 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_id)
+ ret = IRQ_NONE;
+ }
+
++error:
+ spin_unlock_irqrestore(&fc_pci->irq_lock, flags);
+ return ret;
+ }
+diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c
+index 8c56d4c37a525..3513b1a6fcee9 100644
+--- a/drivers/media/pci/saa7146/hexium_gemini.c
++++ b/drivers/media/pci/saa7146/hexium_gemini.c
+@@ -296,7 +296,12 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d
+ hexium_set_input(hexium, 0);
+ hexium->cur_input = 0;
+
+- saa7146_vv_init(dev, &vv_data);
++ ret = saa7146_vv_init(dev, &vv_data);
++ if (ret) {
++ i2c_del_adapter(&hexium->i2c_adapter);
++ kfree(hexium);
++ return ret;
++ }
+
+ vv_data.vid_ops.vidioc_enum_input = vidioc_enum_input;
+ vv_data.vid_ops.vidioc_g_input = vidioc_g_input;
+diff --git a/drivers/media/pci/saa7146/hexium_orion.c b/drivers/media/pci/saa7146/hexium_orion.c
+index a794f9e5f9908..b88aa1feb7df2 100644
+--- a/drivers/media/pci/saa7146/hexium_orion.c
++++ b/drivers/media/pci/saa7146/hexium_orion.c
+@@ -367,10 +367,16 @@ static struct saa7146_ext_vv vv_data;
+ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data *info)
+ {
+ struct hexium *hexium = (struct hexium *) dev->ext_priv;
++ int ret;
+
+ DEB_EE("\n");
+
+- saa7146_vv_init(dev, &vv_data);
++ ret = saa7146_vv_init(dev, &vv_data);
++ if (ret) {
++ pr_err("Error in saa7146_vv_init()\n");
++ return ret;
++ }
++
+ vv_data.vid_ops.vidioc_enum_input = vidioc_enum_input;
+ vv_data.vid_ops.vidioc_g_input = vidioc_g_input;
+ vv_data.vid_ops.vidioc_s_input = vidioc_s_input;
+diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c
+index 6e25654da2567..bfa7a7d15dbf6 100644
+--- a/drivers/media/pci/saa7146/mxb.c
++++ b/drivers/media/pci/saa7146/mxb.c
+@@ -695,10 +695,16 @@ static struct saa7146_ext_vv vv_data;
+ static int mxb_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data *info)
+ {
+ struct mxb *mxb;
++ int ret;
+
+ DEB_EE("dev:%p\n", dev);
+
+- saa7146_vv_init(dev, &vv_data);
++ ret = saa7146_vv_init(dev, &vv_data);
++ if (ret) {
++ ERR("Error in saa7146_vv_init()");
++ return ret;
++ }
++
+ if (mxb_probe(dev)) {
+ saa7146_vv_release(dev);
+ return -1;
+diff --git a/drivers/media/platform/coda/imx-vdoa.c b/drivers/media/platform/coda/imx-vdoa.c
+index 96ab4b61669a3..36d50c3f9b08a 100644
+--- a/drivers/media/platform/coda/imx-vdoa.c
++++ b/drivers/media/platform/coda/imx-vdoa.c
+@@ -295,7 +295,11 @@ static int vdoa_probe(struct platform_device *pdev)
+ struct resource *res;
+ int ret;
+
+- dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
++ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
++ if (ret) {
++ dev_err(&pdev->dev, "DMA enable failed\n");
++ return ret;
++ }
+
+ vdoa = devm_kzalloc(&pdev->dev, sizeof(*vdoa), GFP_KERNEL);
+ if (!vdoa)
+diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
+index 83f859e8509c9..b95006a864c26 100644
+--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
+@@ -217,11 +217,11 @@ static int fops_vcodec_release(struct file *file)
+ mtk_v4l2_debug(1, "[%d] encoder", ctx->id);
+ mutex_lock(&dev->dev_mutex);
+
++ v4l2_m2m_ctx_release(ctx->m2m_ctx);
+ mtk_vcodec_enc_release(ctx);
+ v4l2_fh_del(&ctx->fh);
+ v4l2_fh_exit(&ctx->fh);
+ v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
+- v4l2_m2m_ctx_release(ctx->m2m_ctx);
+
+ list_del_init(&ctx->list);
+ kfree(ctx);
+diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c
+index 23f55514b002a..127658c28a09e 100644
+--- a/drivers/media/platform/rcar-vin/rcar-csi2.c
++++ b/drivers/media/platform/rcar-vin/rcar-csi2.c
+@@ -416,16 +416,23 @@ static int rcsi2_wait_phy_start(struct rcar_csi2 *priv)
+ static int rcsi2_set_phypll(struct rcar_csi2 *priv, unsigned int mbps)
+ {
+ const struct rcsi2_mbps_reg *hsfreq;
++ const struct rcsi2_mbps_reg *hsfreq_prev = NULL;
+
+- for (hsfreq = priv->info->hsfreqrange; hsfreq->mbps != 0; hsfreq++)
++ for (hsfreq = priv->info->hsfreqrange; hsfreq->mbps != 0; hsfreq++) {
+ if (hsfreq->mbps >= mbps)
+ break;
++ hsfreq_prev = hsfreq;
++ }
+
+ if (!hsfreq->mbps) {
+ dev_err(priv->dev, "Unsupported PHY speed (%u Mbps)", mbps);
+ return -ERANGE;
+ }
+
++ if (hsfreq_prev &&
++ ((mbps - hsfreq_prev->mbps) <= (hsfreq->mbps - mbps)))
++ hsfreq = hsfreq_prev;
++
+ rcsi2_write(priv, PHYPLL_REG, PHYPLL_HSFREQRANGE(hsfreq->reg));
+
+ return 0;
+@@ -836,10 +843,17 @@ static int rcsi2_phtw_write_mbps(struct rcar_csi2 *priv, unsigned int mbps,
+ const struct rcsi2_mbps_reg *values, u16 code)
+ {
+ const struct rcsi2_mbps_reg *value;
++ const struct rcsi2_mbps_reg *prev_value = NULL;
+
+- for (value = values; value->mbps; value++)
++ for (value = values; value->mbps; value++) {
+ if (value->mbps >= mbps)
+ break;
++ prev_value = value;
++ }
++
++ if (prev_value &&
++ ((mbps - prev_value->mbps) <= (value->mbps - mbps)))
++ value = prev_value;
+
+ if (!value->mbps) {
+ dev_err(priv->dev, "Unsupported PHY speed (%u Mbps)", mbps);
+diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
+index cc68bdac0c367..7c49eaee67f36 100644
+--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
+@@ -381,7 +381,7 @@ static int si470x_i2c_probe(struct i2c_client *client,
+ if (radio->hdl.error) {
+ retval = radio->hdl.error;
+ dev_err(&client->dev, "couldn't register control\n");
+- goto err_dev;
++ goto err_all;
+ }
+
+ /* video device initialization */
+@@ -465,7 +465,6 @@ err_rds:
+ kfree(radio->buffer);
+ err_ctrl:
+ v4l2_ctrl_handler_free(&radio->hdl);
+-err_dev:
+ v4l2_device_unregister(&radio->v4l2_dev);
+ err_radio:
+ kfree(radio);
+diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
+index f563ddd7f7392..98a13532a5968 100644
+--- a/drivers/media/rc/igorplugusb.c
++++ b/drivers/media/rc/igorplugusb.c
+@@ -73,9 +73,11 @@ static void igorplugusb_irdata(struct igorplugusb *ir, unsigned len)
+ if (start >= len) {
+ dev_err(ir->dev, "receive overflow invalid: %u", overflow);
+ } else {
+- if (overflow > 0)
++ if (overflow > 0) {
+ dev_warn(ir->dev, "receive overflow, at least %u lost",
+ overflow);
++ ir_raw_event_reset(ir->rc);
++ }
+
+ do {
+ rawir.duration = ir->buf_in[i] * 85333;
+diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
+index cf4bcf7c62f2e..0b619a2c146eb 100644
+--- a/drivers/media/rc/mceusb.c
++++ b/drivers/media/rc/mceusb.c
+@@ -1367,7 +1367,7 @@ static void mceusb_gen1_init(struct mceusb_dev *ir)
+ */
+ ret = usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0),
+ USB_REQ_SET_ADDRESS, USB_TYPE_VENDOR, 0, 0,
+- data, USB_CTRL_MSG_SZ, HZ * 3);
++ data, USB_CTRL_MSG_SZ, 3000);
+ dev_dbg(dev, "set address - ret = %d", ret);
+ dev_dbg(dev, "set address - data[0] = %d, data[1] = %d",
+ data[0], data[1]);
+@@ -1375,20 +1375,20 @@ static void mceusb_gen1_init(struct mceusb_dev *ir)
+ /* set feature: bit rate 38400 bps */
+ ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
+ USB_REQ_SET_FEATURE, USB_TYPE_VENDOR,
+- 0xc04e, 0x0000, NULL, 0, HZ * 3);
++ 0xc04e, 0x0000, NULL, 0, 3000);
+
+ dev_dbg(dev, "set feature - ret = %d", ret);
+
+ /* bRequest 4: set char length to 8 bits */
+ ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
+ 4, USB_TYPE_VENDOR,
+- 0x0808, 0x0000, NULL, 0, HZ * 3);
++ 0x0808, 0x0000, NULL, 0, 3000);
+ dev_dbg(dev, "set char length - retB = %d", ret);
+
+ /* bRequest 2: set handshaking to use DTR/DSR */
+ ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
+ 2, USB_TYPE_VENDOR,
+- 0x0000, 0x0100, NULL, 0, HZ * 3);
++ 0x0000, 0x0100, NULL, 0, 3000);
+ dev_dbg(dev, "set handshake - retC = %d", ret);
+
+ /* device resume */
+diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
+index 6bfc24885b5c4..14be14b0b0b0e 100644
+--- a/drivers/media/rc/redrat3.c
++++ b/drivers/media/rc/redrat3.c
+@@ -415,7 +415,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)
+ udev = rr3->udev;
+ res = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), cmd,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+- 0x0000, 0x0000, data, sizeof(u8), HZ * 10);
++ 0x0000, 0x0000, data, sizeof(u8), 10000);
+
+ if (res < 0) {
+ dev_err(rr3->dev, "%s: Error sending rr3 cmd res %d, data %d",
+@@ -491,7 +491,7 @@ static u32 redrat3_get_timeout(struct redrat3_dev *rr3)
+ pipe = usb_rcvctrlpipe(rr3->udev, 0);
+ ret = usb_control_msg(rr3->udev, pipe, RR3_GET_IR_PARAM,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+- RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, HZ * 5);
++ RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, 5000);
+ if (ret != len)
+ dev_warn(rr3->dev, "Failed to read timeout from hardware\n");
+ else {
+@@ -521,7 +521,7 @@ static int redrat3_set_timeout(struct rc_dev *rc_dev, unsigned int timeoutns)
+ ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), RR3_SET_IR_PARAM,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+ RR3_IR_IO_SIG_TIMEOUT, 0, timeout, sizeof(*timeout),
+- HZ * 25);
++ 25000);
+ dev_dbg(dev, "set ir parm timeout %d ret 0x%02x\n",
+ be32_to_cpu(*timeout), ret);
+
+@@ -553,32 +553,32 @@ static void redrat3_reset(struct redrat3_dev *rr3)
+ *val = 0x01;
+ rc = usb_control_msg(udev, rxpipe, RR3_RESET,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+- RR3_CPUCS_REG_ADDR, 0, val, len, HZ * 25);
++ RR3_CPUCS_REG_ADDR, 0, val, len, 25000);
+ dev_dbg(dev, "reset returned 0x%02x\n", rc);
+
+ *val = length_fuzz;
+ rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+- RR3_IR_IO_LENGTH_FUZZ, 0, val, len, HZ * 25);
++ RR3_IR_IO_LENGTH_FUZZ, 0, val, len, 25000);
+ dev_dbg(dev, "set ir parm len fuzz %d rc 0x%02x\n", *val, rc);
+
+ *val = (65536 - (minimum_pause * 2000)) / 256;
+ rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+- RR3_IR_IO_MIN_PAUSE, 0, val, len, HZ * 25);
++ RR3_IR_IO_MIN_PAUSE, 0, val, len, 25000);
+ dev_dbg(dev, "set ir parm min pause %d rc 0x%02x\n", *val, rc);
+
+ *val = periods_measure_carrier;
+ rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+- RR3_IR_IO_PERIODS_MF, 0, val, len, HZ * 25);
++ RR3_IR_IO_PERIODS_MF, 0, val, len, 25000);
+ dev_dbg(dev, "set ir parm periods measure carrier %d rc 0x%02x", *val,
+ rc);
+
+ *val = RR3_DRIVER_MAXLENS;
+ rc = usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+- RR3_IR_IO_MAX_LENGTHS, 0, val, len, HZ * 25);
++ RR3_IR_IO_MAX_LENGTHS, 0, val, len, 25000);
+ dev_dbg(dev, "set ir parm max lens %d rc 0x%02x\n", *val, rc);
+
+ kfree(val);
+@@ -596,7 +596,7 @@ static void redrat3_get_firmware_rev(struct redrat3_dev *rr3)
+ rc = usb_control_msg(rr3->udev, usb_rcvctrlpipe(rr3->udev, 0),
+ RR3_FW_VERSION,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+- 0, 0, buffer, RR3_FW_VERSION_LEN, HZ * 5);
++ 0, 0, buffer, RR3_FW_VERSION_LEN, 5000);
+
+ if (rc >= 0)
+ dev_info(rr3->dev, "Firmware rev: %s", buffer);
+@@ -836,14 +836,14 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf,
+
+ pipe = usb_sndbulkpipe(rr3->udev, rr3->ep_out->bEndpointAddress);
+ ret = usb_bulk_msg(rr3->udev, pipe, irdata,
+- sendbuf_len, &ret_len, 10 * HZ);
++ sendbuf_len, &ret_len, 10000);
+ dev_dbg(dev, "sent %d bytes, (ret %d)\n", ret_len, ret);
+
+ /* now tell the hardware to transmit what we sent it */
+ pipe = usb_rcvctrlpipe(rr3->udev, 0);
+ ret = usb_control_msg(rr3->udev, pipe, RR3_TX_SEND_SIGNAL,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+- 0, 0, irdata, 2, HZ * 10);
++ 0, 0, irdata, 2, 10000);
+
+ if (ret < 0)
+ dev_err(dev, "Error: control msg send failed, rc %d\n", ret);
+diff --git a/drivers/media/tuners/msi001.c b/drivers/media/tuners/msi001.c
+index 5de6ed7287085..13ffe196b7a42 100644
+--- a/drivers/media/tuners/msi001.c
++++ b/drivers/media/tuners/msi001.c
+@@ -451,6 +451,13 @@ static int msi001_probe(struct spi_device *spi)
+ V4L2_CID_RF_TUNER_BANDWIDTH_AUTO, 0, 1, 1, 1);
+ dev->bandwidth = v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops,
+ V4L2_CID_RF_TUNER_BANDWIDTH, 200000, 8000000, 1, 200000);
++ if (dev->hdl.error) {
++ ret = dev->hdl.error;
++ dev_err(&spi->dev, "Could not initialize controls\n");
++ /* control init failed, free handler */
++ goto err_ctrl_handler_free;
++ }
++
+ v4l2_ctrl_auto_cluster(2, &dev->bandwidth_auto, 0, false);
+ dev->lna_gain = v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops,
+ V4L2_CID_RF_TUNER_LNA_GAIN, 0, 1, 1, 1);
+diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c
+index 13770b038048e..a4bba669f234d 100644
+--- a/drivers/media/tuners/si2157.c
++++ b/drivers/media/tuners/si2157.c
+@@ -89,7 +89,7 @@ static int si2157_init(struct dvb_frontend *fe)
+ dev_dbg(&client->dev, "\n");
+
+ /* Try to get Xtal trim property, to verify tuner still running */
+- memcpy(cmd.args, "\x15\x00\x04\x02", 4);
++ memcpy(cmd.args, "\x15\x00\x02\x04", 4);
+ cmd.wlen = 4;
+ cmd.rlen = 4;
+ ret = si2157_cmd_execute(client, &cmd);
+diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
+index 5104678f29b76..9dd6e30749fd2 100644
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -86,7 +86,7 @@ static int flexcop_usb_readwrite_dw(struct flexcop_device *fc, u16 wRegOffsPCI,
+ 0,
+ fc_usb->data,
+ sizeof(u32),
+- B2C2_WAIT_FOR_OPERATION_RDW * HZ);
++ B2C2_WAIT_FOR_OPERATION_RDW);
+
+ if (ret != sizeof(u32)) {
+ err("error while %s dword from %d (%d).", read ? "reading" :
+@@ -154,7 +154,7 @@ static int flexcop_usb_v8_memory_req(struct flexcop_usb *fc_usb,
+ wIndex,
+ fc_usb->data,
+ buflen,
+- nWaitTime * HZ);
++ nWaitTime);
+ if (ret != buflen)
+ ret = -EIO;
+
+@@ -248,13 +248,13 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c,
+ /* DKT 020208 - add this to support special case of DiSEqC */
+ case USB_FUNC_I2C_CHECKWRITE:
+ pipe = B2C2_USB_CTRL_PIPE_OUT;
+- nWaitTime = 2;
++ nWaitTime = 2000;
+ request_type |= USB_DIR_OUT;
+ break;
+ case USB_FUNC_I2C_READ:
+ case USB_FUNC_I2C_REPEATREAD:
+ pipe = B2C2_USB_CTRL_PIPE_IN;
+- nWaitTime = 2;
++ nWaitTime = 2000;
+ request_type |= USB_DIR_IN;
+ break;
+ default:
+@@ -281,7 +281,7 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c,
+ wIndex,
+ fc_usb->data,
+ buflen,
+- nWaitTime * HZ);
++ nWaitTime);
+
+ if (ret != buflen)
+ ret = -EIO;
+diff --git a/drivers/media/usb/b2c2/flexcop-usb.h b/drivers/media/usb/b2c2/flexcop-usb.h
+index e86faa0e06ca6..3dfd25fa4750f 100644
+--- a/drivers/media/usb/b2c2/flexcop-usb.h
++++ b/drivers/media/usb/b2c2/flexcop-usb.h
+@@ -91,13 +91,13 @@ typedef enum {
+ UTILITY_SRAM_TESTVERIFY = 0x16,
+ } flexcop_usb_utility_function_t;
+
+-#define B2C2_WAIT_FOR_OPERATION_RW (1*HZ)
+-#define B2C2_WAIT_FOR_OPERATION_RDW (3*HZ)
+-#define B2C2_WAIT_FOR_OPERATION_WDW (1*HZ)
++#define B2C2_WAIT_FOR_OPERATION_RW 1000
++#define B2C2_WAIT_FOR_OPERATION_RDW 3000
++#define B2C2_WAIT_FOR_OPERATION_WDW 1000
+
+-#define B2C2_WAIT_FOR_OPERATION_V8READ (3*HZ)
+-#define B2C2_WAIT_FOR_OPERATION_V8WRITE (3*HZ)
+-#define B2C2_WAIT_FOR_OPERATION_V8FLASH (3*HZ)
++#define B2C2_WAIT_FOR_OPERATION_V8READ 3000
++#define B2C2_WAIT_FOR_OPERATION_V8WRITE 3000
++#define B2C2_WAIT_FOR_OPERATION_V8FLASH 3000
+
+ typedef enum {
+ V8_MEMORY_PAGE_DVB_CI = 0x20,
+diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
+index 8392175740695..d9cac7064bb47 100644
+--- a/drivers/media/usb/cpia2/cpia2_usb.c
++++ b/drivers/media/usb/cpia2/cpia2_usb.c
+@@ -559,7 +559,7 @@ static int write_packet(struct usb_device *udev,
+ 0, /* index */
+ buf, /* buffer */
+ size,
+- HZ);
++ 1000);
+
+ kfree(buf);
+ return ret;
+@@ -591,7 +591,7 @@ static int read_packet(struct usb_device *udev,
+ 0, /* index */
+ buf, /* buffer */
+ size,
+- HZ);
++ 1000);
+
+ if (ret >= 0)
+ memcpy(registers, buf, size);
+diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
+index 6a53ff93c4d8b..c4c4119cb306b 100644
+--- a/drivers/media/usb/dvb-usb/dib0700_core.c
++++ b/drivers/media/usb/dvb-usb/dib0700_core.c
+@@ -619,8 +619,6 @@ int dib0700_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
+ deb_info("the endpoint number (%i) is not correct, use the adapter id instead", adap->fe_adap[0].stream.props.endpoint);
+ if (onoff)
+ st->channel_state |= 1 << (adap->id);
+- else
+- st->channel_state |= 1 << ~(adap->id);
+ } else {
+ if (onoff)
+ st->channel_state |= 1 << (adap->fe_adap[0].stream.props.endpoint-2);
+diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
+index 9ce8b4d79d1fa..ebb0c982a6f21 100644
+--- a/drivers/media/usb/dvb-usb/dw2102.c
++++ b/drivers/media/usb/dvb-usb/dw2102.c
+@@ -2101,46 +2101,153 @@ static struct dvb_usb_device_properties s6x0_properties = {
+ }
+ };
+
+-static const struct dvb_usb_device_description d1100 = {
+- "Prof 1100 USB ",
+- {&dw2102_table[PROF_1100], NULL},
+- {NULL},
+-};
++static struct dvb_usb_device_properties p1100_properties = {
++ .caps = DVB_USB_IS_AN_I2C_ADAPTER,
++ .usb_ctrl = DEVICE_SPECIFIC,
++ .size_of_priv = sizeof(struct dw2102_state),
++ .firmware = P1100_FIRMWARE,
++ .no_reconnect = 1,
+
+-static const struct dvb_usb_device_description d660 = {
+- "TeVii S660 USB",
+- {&dw2102_table[TEVII_S660], NULL},
+- {NULL},
+-};
++ .i2c_algo = &s6x0_i2c_algo,
++ .rc.core = {
++ .rc_interval = 150,
++ .rc_codes = RC_MAP_TBS_NEC,
++ .module_name = "dw2102",
++ .allowed_protos = RC_PROTO_BIT_NEC,
++ .rc_query = prof_rc_query,
++ },
+
+-static const struct dvb_usb_device_description d480_1 = {
+- "TeVii S480.1 USB",
+- {&dw2102_table[TEVII_S480_1], NULL},
+- {NULL},
++ .generic_bulk_ctrl_endpoint = 0x81,
++ .num_adapters = 1,
++ .download_firmware = dw2102_load_firmware,
++ .read_mac_address = s6x0_read_mac_address,
++ .adapter = {
++ {
++ .num_frontends = 1,
++ .fe = {{
++ .frontend_attach = stv0288_frontend_attach,
++ .stream = {
++ .type = USB_BULK,
++ .count = 8,
++ .endpoint = 0x82,
++ .u = {
++ .bulk = {
++ .buffersize = 4096,
++ }
++ }
++ },
++ } },
++ }
++ },
++ .num_device_descs = 1,
++ .devices = {
++ {"Prof 1100 USB ",
++ {&dw2102_table[PROF_1100], NULL},
++ {NULL},
++ },
++ }
+ };
+
+-static const struct dvb_usb_device_description d480_2 = {
+- "TeVii S480.2 USB",
+- {&dw2102_table[TEVII_S480_2], NULL},
+- {NULL},
+-};
++static struct dvb_usb_device_properties s660_properties = {
++ .caps = DVB_USB_IS_AN_I2C_ADAPTER,
++ .usb_ctrl = DEVICE_SPECIFIC,
++ .size_of_priv = sizeof(struct dw2102_state),
++ .firmware = S660_FIRMWARE,
++ .no_reconnect = 1,
+
+-static const struct dvb_usb_device_description d7500 = {
+- "Prof 7500 USB DVB-S2",
+- {&dw2102_table[PROF_7500], NULL},
+- {NULL},
+-};
++ .i2c_algo = &s6x0_i2c_algo,
++ .rc.core = {
++ .rc_interval = 150,
++ .rc_codes = RC_MAP_TEVII_NEC,
++ .module_name = "dw2102",
++ .allowed_protos = RC_PROTO_BIT_NEC,
++ .rc_query = dw2102_rc_query,
++ },
+
+-static const struct dvb_usb_device_description d421 = {
+- "TeVii S421 PCI",
+- {&dw2102_table[TEVII_S421], NULL},
+- {NULL},
++ .generic_bulk_ctrl_endpoint = 0x81,
++ .num_adapters = 1,
++ .download_firmware = dw2102_load_firmware,
++ .read_mac_address = s6x0_read_mac_address,
++ .adapter = {
++ {
++ .num_frontends = 1,
++ .fe = {{
++ .frontend_attach = ds3000_frontend_attach,
++ .stream = {
++ .type = USB_BULK,
++ .count = 8,
++ .endpoint = 0x82,
++ .u = {
++ .bulk = {
++ .buffersize = 4096,
++ }
++ }
++ },
++ } },
++ }
++ },
++ .num_device_descs = 3,
++ .devices = {
++ {"TeVii S660 USB",
++ {&dw2102_table[TEVII_S660], NULL},
++ {NULL},
++ },
++ {"TeVii S480.1 USB",
++ {&dw2102_table[TEVII_S480_1], NULL},
++ {NULL},
++ },
++ {"TeVii S480.2 USB",
++ {&dw2102_table[TEVII_S480_2], NULL},
++ {NULL},
++ },
++ }
+ };
+
+-static const struct dvb_usb_device_description d632 = {
+- "TeVii S632 USB",
+- {&dw2102_table[TEVII_S632], NULL},
+- {NULL},
++static struct dvb_usb_device_properties p7500_properties = {
++ .caps = DVB_USB_IS_AN_I2C_ADAPTER,
++ .usb_ctrl = DEVICE_SPECIFIC,
++ .size_of_priv = sizeof(struct dw2102_state),
++ .firmware = P7500_FIRMWARE,
++ .no_reconnect = 1,
++
++ .i2c_algo = &s6x0_i2c_algo,
++ .rc.core = {
++ .rc_interval = 150,
++ .rc_codes = RC_MAP_TBS_NEC,
++ .module_name = "dw2102",
++ .allowed_protos = RC_PROTO_BIT_NEC,
++ .rc_query = prof_rc_query,
++ },
++
++ .generic_bulk_ctrl_endpoint = 0x81,
++ .num_adapters = 1,
++ .download_firmware = dw2102_load_firmware,
++ .read_mac_address = s6x0_read_mac_address,
++ .adapter = {
++ {
++ .num_frontends = 1,
++ .fe = {{
++ .frontend_attach = prof_7500_frontend_attach,
++ .stream = {
++ .type = USB_BULK,
++ .count = 8,
++ .endpoint = 0x82,
++ .u = {
++ .bulk = {
++ .buffersize = 4096,
++ }
++ }
++ },
++ } },
++ }
++ },
++ .num_device_descs = 1,
++ .devices = {
++ {"Prof 7500 USB DVB-S2",
++ {&dw2102_table[PROF_7500], NULL},
++ {NULL},
++ },
++ }
+ };
+
+ static struct dvb_usb_device_properties su3000_properties = {
+@@ -2212,6 +2319,59 @@ static struct dvb_usb_device_properties su3000_properties = {
+ }
+ };
+
++static struct dvb_usb_device_properties s421_properties = {
++ .caps = DVB_USB_IS_AN_I2C_ADAPTER,
++ .usb_ctrl = DEVICE_SPECIFIC,
++ .size_of_priv = sizeof(struct dw2102_state),
++ .power_ctrl = su3000_power_ctrl,
++ .num_adapters = 1,
++ .identify_state = su3000_identify_state,
++ .i2c_algo = &su3000_i2c_algo,
++
++ .rc.core = {
++ .rc_interval = 150,
++ .rc_codes = RC_MAP_SU3000,
++ .module_name = "dw2102",
++ .allowed_protos = RC_PROTO_BIT_RC5,
++ .rc_query = su3000_rc_query,
++ },
++
++ .read_mac_address = su3000_read_mac_address,
++
++ .generic_bulk_ctrl_endpoint = 0x01,
++
++ .adapter = {
++ {
++ .num_frontends = 1,
++ .fe = {{
++ .streaming_ctrl = su3000_streaming_ctrl,
++ .frontend_attach = m88rs2000_frontend_attach,
++ .stream = {
++ .type = USB_BULK,
++ .count = 8,
++ .endpoint = 0x82,
++ .u = {
++ .bulk = {
++ .buffersize = 4096,
++ }
++ }
++ }
++ } },
++ }
++ },
++ .num_device_descs = 2,
++ .devices = {
++ { "TeVii S421 PCI",
++ { &dw2102_table[TEVII_S421], NULL },
++ { NULL },
++ },
++ { "TeVii S632 USB",
++ { &dw2102_table[TEVII_S632], NULL },
++ { NULL },
++ },
++ }
++};
++
+ static struct dvb_usb_device_properties t220_properties = {
+ .caps = DVB_USB_IS_AN_I2C_ADAPTER,
+ .usb_ctrl = DEVICE_SPECIFIC,
+@@ -2329,101 +2489,33 @@ static struct dvb_usb_device_properties tt_s2_4600_properties = {
+ static int dw2102_probe(struct usb_interface *intf,
+ const struct usb_device_id *id)
+ {
+- int retval = -ENOMEM;
+- struct dvb_usb_device_properties *p1100;
+- struct dvb_usb_device_properties *s660;
+- struct dvb_usb_device_properties *p7500;
+- struct dvb_usb_device_properties *s421;
+-
+- p1100 = kmemdup(&s6x0_properties,
+- sizeof(struct dvb_usb_device_properties), GFP_KERNEL);
+- if (!p1100)
+- goto err0;
+-
+- /* copy default structure */
+- /* fill only different fields */
+- p1100->firmware = P1100_FIRMWARE;
+- p1100->devices[0] = d1100;
+- p1100->rc.core.rc_query = prof_rc_query;
+- p1100->rc.core.rc_codes = RC_MAP_TBS_NEC;
+- p1100->adapter->fe[0].frontend_attach = stv0288_frontend_attach;
+-
+- s660 = kmemdup(&s6x0_properties,
+- sizeof(struct dvb_usb_device_properties), GFP_KERNEL);
+- if (!s660)
+- goto err1;
+-
+- s660->firmware = S660_FIRMWARE;
+- s660->num_device_descs = 3;
+- s660->devices[0] = d660;
+- s660->devices[1] = d480_1;
+- s660->devices[2] = d480_2;
+- s660->adapter->fe[0].frontend_attach = ds3000_frontend_attach;
+-
+- p7500 = kmemdup(&s6x0_properties,
+- sizeof(struct dvb_usb_device_properties), GFP_KERNEL);
+- if (!p7500)
+- goto err2;
+-
+- p7500->firmware = P7500_FIRMWARE;
+- p7500->devices[0] = d7500;
+- p7500->rc.core.rc_query = prof_rc_query;
+- p7500->rc.core.rc_codes = RC_MAP_TBS_NEC;
+- p7500->adapter->fe[0].frontend_attach = prof_7500_frontend_attach;
+-
+-
+- s421 = kmemdup(&su3000_properties,
+- sizeof(struct dvb_usb_device_properties), GFP_KERNEL);
+- if (!s421)
+- goto err3;
+-
+- s421->num_device_descs = 2;
+- s421->devices[0] = d421;
+- s421->devices[1] = d632;
+- s421->adapter->fe[0].frontend_attach = m88rs2000_frontend_attach;
+-
+- if (0 == dvb_usb_device_init(intf, &dw2102_properties,
+- THIS_MODULE, NULL, adapter_nr) ||
+- 0 == dvb_usb_device_init(intf, &dw2104_properties,
+- THIS_MODULE, NULL, adapter_nr) ||
+- 0 == dvb_usb_device_init(intf, &dw3101_properties,
+- THIS_MODULE, NULL, adapter_nr) ||
+- 0 == dvb_usb_device_init(intf, &s6x0_properties,
+- THIS_MODULE, NULL, adapter_nr) ||
+- 0 == dvb_usb_device_init(intf, p1100,
+- THIS_MODULE, NULL, adapter_nr) ||
+- 0 == dvb_usb_device_init(intf, s660,
+- THIS_MODULE, NULL, adapter_nr) ||
+- 0 == dvb_usb_device_init(intf, p7500,
+- THIS_MODULE, NULL, adapter_nr) ||
+- 0 == dvb_usb_device_init(intf, s421,
+- THIS_MODULE, NULL, adapter_nr) ||
+- 0 == dvb_usb_device_init(intf, &su3000_properties,
+- THIS_MODULE, NULL, adapter_nr) ||
+- 0 == dvb_usb_device_init(intf, &t220_properties,
+- THIS_MODULE, NULL, adapter_nr) ||
+- 0 == dvb_usb_device_init(intf, &tt_s2_4600_properties,
+- THIS_MODULE, NULL, adapter_nr)) {
+-
+- /* clean up copied properties */
+- kfree(s421);
+- kfree(p7500);
+- kfree(s660);
+- kfree(p1100);
++ if (!(dvb_usb_device_init(intf, &dw2102_properties,
++ THIS_MODULE, NULL, adapter_nr) &&
++ dvb_usb_device_init(intf, &dw2104_properties,
++ THIS_MODULE, NULL, adapter_nr) &&
++ dvb_usb_device_init(intf, &dw3101_properties,
++ THIS_MODULE, NULL, adapter_nr) &&
++ dvb_usb_device_init(intf, &s6x0_properties,
++ THIS_MODULE, NULL, adapter_nr) &&
++ dvb_usb_device_init(intf, &p1100_properties,
++ THIS_MODULE, NULL, adapter_nr) &&
++ dvb_usb_device_init(intf, &s660_properties,
++ THIS_MODULE, NULL, adapter_nr) &&
++ dvb_usb_device_init(intf, &p7500_properties,
++ THIS_MODULE, NULL, adapter_nr) &&
++ dvb_usb_device_init(intf, &s421_properties,
++ THIS_MODULE, NULL, adapter_nr) &&
++ dvb_usb_device_init(intf, &su3000_properties,
++ THIS_MODULE, NULL, adapter_nr) &&
++ dvb_usb_device_init(intf, &t220_properties,
++ THIS_MODULE, NULL, adapter_nr) &&
++ dvb_usb_device_init(intf, &tt_s2_4600_properties,
++ THIS_MODULE, NULL, adapter_nr))) {
+
+ return 0;
+ }
+
+- retval = -ENODEV;
+- kfree(s421);
+-err3:
+- kfree(p7500);
+-err2:
+- kfree(s660);
+-err1:
+- kfree(p1100);
+-err0:
+- return retval;
++ return -ENODEV;
+ }
+
+ static void dw2102_disconnect(struct usb_interface *intf)
+diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/m920x.c
+index 22554d9abd432..3b2a0f36fc38e 100644
+--- a/drivers/media/usb/dvb-usb/m920x.c
++++ b/drivers/media/usb/dvb-usb/m920x.c
+@@ -277,6 +277,13 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu
+ /* Should check for ack here, if we knew how. */
+ }
+ if (msg[i].flags & I2C_M_RD) {
++ char *read = kmalloc(1, GFP_KERNEL);
++ if (!read) {
++ ret = -ENOMEM;
++ kfree(read);
++ goto unlock;
++ }
++
+ for (j = 0; j < msg[i].len; j++) {
+ /* Last byte of transaction?
+ * Send STOP, otherwise send ACK. */
+@@ -284,9 +291,12 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu
+
+ if ((ret = m920x_read(d->udev, M9206_I2C, 0x0,
+ 0x20 | stop,
+- &msg[i].buf[j], 1)) != 0)
++ read, 1)) != 0)
+ goto unlock;
++ msg[i].buf[j] = read[0];
+ }
++
++ kfree(read);
+ } else {
+ for (j = 0; j < msg[i].len; j++) {
+ /* Last byte of transaction? Then send STOP. */
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index ec608f60d2c75..06da08f8efdb1 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -3515,8 +3515,10 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
+
+ if (dev->is_audio_only) {
+ retval = em28xx_audio_setup(dev);
+- if (retval)
+- return -ENODEV;
++ if (retval) {
++ retval = -ENODEV;
++ goto err_deinit_media;
++ }
+ em28xx_init_extension(dev);
+
+ return 0;
+@@ -3535,7 +3537,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
+ dev_err(&dev->intf->dev,
+ "%s: em28xx_i2c_register bus 0 - error [%d]!\n",
+ __func__, retval);
+- return retval;
++ goto err_deinit_media;
+ }
+
+ /* register i2c bus 1 */
+@@ -3551,9 +3553,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
+ "%s: em28xx_i2c_register bus 1 - error [%d]!\n",
+ __func__, retval);
+
+- em28xx_i2c_unregister(dev, 0);
+-
+- return retval;
++ goto err_unreg_i2c;
+ }
+ }
+
+@@ -3561,6 +3561,12 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
+ em28xx_card_setup(dev);
+
+ return 0;
++
++err_unreg_i2c:
++ em28xx_i2c_unregister(dev, 0);
++err_deinit_media:
++ em28xx_unregister_media_device(dev);
++ return retval;
+ }
+
+ static int em28xx_duplicate_dev(struct em28xx *dev)
+diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
+index 437651307056f..334a82add53f3 100644
+--- a/drivers/media/usb/em28xx/em28xx-core.c
++++ b/drivers/media/usb/em28xx/em28xx-core.c
+@@ -89,7 +89,7 @@ int em28xx_read_reg_req_len(struct em28xx *dev, u8 req, u16 reg,
+ mutex_lock(&dev->ctrl_urb_lock);
+ ret = usb_control_msg(udev, pipe, req,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0x0000, reg, dev->urb_buf, len, HZ);
++ 0x0000, reg, dev->urb_buf, len, 1000);
+ if (ret < 0) {
+ em28xx_regdbg("(pipe 0x%08x): IN: %02x %02x %02x %02x %02x %02x %02x %02x failed with error %i\n",
+ pipe,
+@@ -158,7 +158,7 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf,
+ memcpy(dev->urb_buf, buf, len);
+ ret = usb_control_msg(udev, pipe, req,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0x0000, reg, dev->urb_buf, len, HZ);
++ 0x0000, reg, dev->urb_buf, len, 1000);
+ mutex_unlock(&dev->ctrl_urb_lock);
+
+ if (ret < 0) {
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index d1bbfe4000ddc..21ccbbd70dcee 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -1476,7 +1476,7 @@ static int pvr2_upload_firmware1(struct pvr2_hdw *hdw)
+ for (address = 0; address < fwsize; address += 0x800) {
+ memcpy(fw_ptr, fw_entry->data + address, 0x800);
+ ret += usb_control_msg(hdw->usb_dev, pipe, 0xa0, 0x40, address,
+- 0, fw_ptr, 0x800, HZ);
++ 0, fw_ptr, 0x800, 1000);
+ }
+
+ trace_firmware("Upload done, releasing device's CPU");
+@@ -1614,7 +1614,7 @@ int pvr2_upload_firmware2(struct pvr2_hdw *hdw)
+ ((u32 *)fw_ptr)[icnt] = swab32(((u32 *)fw_ptr)[icnt]);
+
+ ret |= usb_bulk_msg(hdw->usb_dev, pipe, fw_ptr,bcnt,
+- &actual_length, HZ);
++ &actual_length, 1000);
+ ret |= (actual_length != bcnt);
+ if (ret) break;
+ fw_done += bcnt;
+@@ -3431,7 +3431,7 @@ void pvr2_hdw_cpufw_set_enabled(struct pvr2_hdw *hdw,
+ 0xa0,0xc0,
+ address,0,
+ hdw->fw_buffer+address,
+- 0x800,HZ);
++ 0x800,1000);
+ if (ret < 0) break;
+ }
+
+@@ -3970,7 +3970,7 @@ void pvr2_hdw_cpureset_assert(struct pvr2_hdw *hdw,int val)
+ /* Write the CPUCS register on the 8051. The lsb of the register
+ is the reset bit; a 1 asserts reset while a 0 clears it. */
+ pipe = usb_sndctrlpipe(hdw->usb_dev, 0);
+- ret = usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,HZ);
++ ret = usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,1000);
+ if (ret < 0) {
+ pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+ "cpureset_assert(%d) error=%d",val,ret);
+diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c
+index 82927eb334c48..3e3ecf214762a 100644
+--- a/drivers/media/usb/s2255/s2255drv.c
++++ b/drivers/media/usb/s2255/s2255drv.c
+@@ -1904,7 +1904,7 @@ static long s2255_vendor_req(struct s2255_dev *dev, unsigned char Request,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE |
+ USB_DIR_IN,
+ Value, Index, buf,
+- TransferBufferLength, HZ * 5);
++ TransferBufferLength, USB_CTRL_SET_TIMEOUT);
+
+ if (r >= 0)
+ memcpy(TransferBuffer, buf, TransferBufferLength);
+@@ -1913,7 +1913,7 @@ static long s2255_vendor_req(struct s2255_dev *dev, unsigned char Request,
+ r = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
+ Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ Value, Index, buf,
+- TransferBufferLength, HZ * 5);
++ TransferBufferLength, USB_CTRL_SET_TIMEOUT);
+ }
+ kfree(buf);
+ return r;
+diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c
+index 468f5ccf4ae6c..bb0db4cdc6c75 100644
+--- a/drivers/media/usb/stk1160/stk1160-core.c
++++ b/drivers/media/usb/stk1160/stk1160-core.c
+@@ -75,7 +75,7 @@ int stk1160_read_reg(struct stk1160 *dev, u16 reg, u8 *value)
+ return -ENOMEM;
+ ret = usb_control_msg(dev->udev, pipe, 0x00,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0x00, reg, buf, sizeof(u8), HZ);
++ 0x00, reg, buf, sizeof(u8), 1000);
+ if (ret < 0) {
+ stk1160_err("read failed on reg 0x%x (%d)\n",
+ reg, ret);
+@@ -95,7 +95,7 @@ int stk1160_write_reg(struct stk1160 *dev, u16 reg, u16 value)
+
+ ret = usb_control_msg(dev->udev, pipe, 0x01,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- value, reg, NULL, 0, HZ);
++ value, reg, NULL, 0, 1000);
+ if (ret < 0) {
+ stk1160_err("write failed on reg 0x%x (%d)\n",
+ reg, ret);
+diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
+index 9c26e586bb01d..b431f06d5a1f5 100644
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -1854,6 +1854,10 @@ static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags)
+ if (ep == NULL)
+ return -EIO;
+
++ /* Reject broken descriptors. */
++ if (usb_endpoint_maxp(&ep->desc) == 0)
++ return -EIO;
++
+ ret = uvc_init_video_bulk(stream, ep, gfp_flags);
+ }
+
+diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
+index a738486fd9d64..839ba3cc53119 100644
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -176,7 +176,7 @@
+ /* Maximum status buffer size in bytes of interrupt URB. */
+ #define UVC_MAX_STATUS_SIZE 16
+
+-#define UVC_CTRL_CONTROL_TIMEOUT 500
++#define UVC_CTRL_CONTROL_TIMEOUT 5000
+ #define UVC_CTRL_STREAMING_TIMEOUT 5000
+
+ /* Maximum allowed number of control mappings per device */
+diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c
+index 7911b0a14a6d0..fc44fb7c595bc 100644
+--- a/drivers/mfd/intel-lpss-acpi.c
++++ b/drivers/mfd/intel-lpss-acpi.c
+@@ -80,6 +80,7 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev)
+ {
+ struct intel_lpss_platform_info *info;
+ const struct acpi_device_id *id;
++ int ret;
+
+ id = acpi_match_device(intel_lpss_acpi_ids, &pdev->dev);
+ if (!id)
+@@ -93,10 +94,14 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev)
+ info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ info->irq = platform_get_irq(pdev, 0);
+
++ ret = intel_lpss_probe(&pdev->dev, info);
++ if (ret)
++ return ret;
++
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
+
+- return intel_lpss_probe(&pdev->dev, info);
++ return 0;
+ }
+
+ static int intel_lpss_acpi_remove(struct platform_device *pdev)
+diff --git a/drivers/misc/lattice-ecp3-config.c b/drivers/misc/lattice-ecp3-config.c
+index 626fdcaf25101..645d26536114f 100644
+--- a/drivers/misc/lattice-ecp3-config.c
++++ b/drivers/misc/lattice-ecp3-config.c
+@@ -81,12 +81,12 @@ static void firmware_load(const struct firmware *fw, void *context)
+
+ if (fw == NULL) {
+ dev_err(&spi->dev, "Cannot load firmware, aborting\n");
+- return;
++ goto out;
+ }
+
+ if (fw->size == 0) {
+ dev_err(&spi->dev, "Error: Firmware size is 0!\n");
+- return;
++ goto out;
+ }
+
+ /* Fill dummy data (24 stuffing bits for commands) */
+@@ -108,7 +108,7 @@ static void firmware_load(const struct firmware *fw, void *context)
+ dev_err(&spi->dev,
+ "Error: No supported FPGA detected (JEDEC_ID=%08x)!\n",
+ jedec_id);
+- return;
++ goto out;
+ }
+
+ dev_info(&spi->dev, "FPGA %s detected\n", ecp3_dev[i].name);
+@@ -121,7 +121,7 @@ static void firmware_load(const struct firmware *fw, void *context)
+ buffer = kzalloc(fw->size + 8, GFP_KERNEL);
+ if (!buffer) {
+ dev_err(&spi->dev, "Error: Can't allocate memory!\n");
+- return;
++ goto out;
+ }
+
+ /*
+@@ -160,7 +160,7 @@ static void firmware_load(const struct firmware *fw, void *context)
+ "Error: Timeout waiting for FPGA to clear (status=%08x)!\n",
+ status);
+ kfree(buffer);
+- return;
++ goto out;
+ }
+
+ dev_info(&spi->dev, "Configuring the FPGA...\n");
+@@ -186,7 +186,7 @@ static void firmware_load(const struct firmware *fw, void *context)
+ release_firmware(fw);
+
+ kfree(buffer);
+-
++out:
+ complete(&data->fw_loaded);
+ }
+
+diff --git a/drivers/misc/lkdtm/Makefile b/drivers/misc/lkdtm/Makefile
+index aeb960cb096d6..b7ceb5f22c266 100644
+--- a/drivers/misc/lkdtm/Makefile
++++ b/drivers/misc/lkdtm/Makefile
+@@ -13,7 +13,7 @@ KCOV_INSTRUMENT_rodata.o := n
+
+ OBJCOPYFLAGS :=
+ OBJCOPYFLAGS_rodata_objcopy.o := \
+- --rename-section .noinstr.text=.rodata,alloc,readonly,load
++ --rename-section .noinstr.text=.rodata,alloc,readonly,load,contents
+ targets += rodata.o rodata_objcopy.o
+ $(obj)/rodata_objcopy.o: $(obj)/rodata.o FORCE
+ $(call if_changed,objcopy)
+diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
+index 4e72ad24322f7..5f1ee88aa7615 100644
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -634,6 +634,8 @@ try_again:
+ if (host->ops->init_card)
+ host->ops->init_card(host, card);
+
++ card->ocr = ocr_card;
++
+ /*
+ * If the host and card support UHS-I mode request the card
+ * to switch to 1.8V signaling level. No 1.8v signalling if
+@@ -740,7 +742,7 @@ try_again:
+
+ card = oldcard;
+ }
+- card->ocr = ocr_card;
++
+ mmc_fixup_device(card, sdio_fixup_methods);
+
+ if (card->type == MMC_TYPE_SD_COMBO) {
+diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c
+index 27837a794e7b3..1f7e4352b0677 100644
+--- a/drivers/mmc/host/meson-mx-sdio.c
++++ b/drivers/mmc/host/meson-mx-sdio.c
+@@ -668,6 +668,11 @@ static int meson_mx_mmc_probe(struct platform_device *pdev)
+ }
+
+ irq = platform_get_irq(pdev, 0);
++ if (irq < 0) {
++ ret = irq;
++ goto error_free_mmc;
++ }
++
+ ret = devm_request_threaded_irq(host->controller_dev, irq,
+ meson_mx_mmc_irq,
+ meson_mx_mmc_irq_thread, IRQF_ONESHOT,
+diff --git a/drivers/mtd/nand/bbt.c b/drivers/mtd/nand/bbt.c
+index 044adf9138546..64af6898131d6 100644
+--- a/drivers/mtd/nand/bbt.c
++++ b/drivers/mtd/nand/bbt.c
+@@ -123,7 +123,7 @@ int nanddev_bbt_set_block_status(struct nand_device *nand, unsigned int entry,
+ unsigned int rbits = bits_per_block + offs - BITS_PER_LONG;
+
+ pos[1] &= ~GENMASK(rbits - 1, 0);
+- pos[1] |= val >> rbits;
++ pos[1] |= val >> (bits_per_block - rbits);
+ }
+
+ return 0;
+diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+index 6bd414bac34d1..6370a59a25790 100644
+--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+@@ -612,15 +612,6 @@ static int gpmi_get_clks(struct gpmi_nand_data *this)
+ r->clock[i] = clk;
+ }
+
+- if (GPMI_IS_MX6(this))
+- /*
+- * Set the default value for the gpmi clock.
+- *
+- * If you want to use the ONFI nand which is in the
+- * Synchronous Mode, you should change the clock as you need.
+- */
+- clk_set_rate(r->clock[0], 22000000);
+-
+ return 0;
+
+ err_clock:
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index d6c5f41b17f7e..2d70cdd26f89d 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -782,14 +782,14 @@ static bool bond_should_notify_peers(struct bonding *bond)
+ slave = rcu_dereference(bond->curr_active_slave);
+ rcu_read_unlock();
+
+- netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n",
+- slave ? slave->dev->name : "NULL");
+-
+ if (!slave || !bond->send_peer_notif ||
+ !netif_carrier_ok(bond->dev) ||
+ test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state))
+ return false;
+
++ netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n",
++ slave ? slave->dev->name : "NULL");
++
+ return true;
+ }
+
+diff --git a/drivers/net/can/softing/softing_cs.c b/drivers/net/can/softing/softing_cs.c
+index 4d4492884e0b0..efe7d576afa5c 100644
+--- a/drivers/net/can/softing/softing_cs.c
++++ b/drivers/net/can/softing/softing_cs.c
+@@ -304,7 +304,7 @@ static int softingcs_probe(struct pcmcia_device *pcmcia)
+ return 0;
+
+ platform_failed:
+- kfree(dev);
++ platform_device_put(pdev);
+ mem_failed:
+ pcmcia_bad:
+ pcmcia_failed:
+diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing/softing_fw.c
+index aac58ce6e371a..209eddeb822e5 100644
+--- a/drivers/net/can/softing/softing_fw.c
++++ b/drivers/net/can/softing/softing_fw.c
+@@ -576,18 +576,19 @@ int softing_startstop(struct net_device *dev, int up)
+ if (ret < 0)
+ goto failed;
+ }
+- /* enable_error_frame */
+- /*
++
++ /* enable_error_frame
++ *
+ * Error reporting is switched off at the moment since
+ * the receiving of them is not yet 100% verified
+ * This should be enabled sooner or later
+- *
+- if (error_reporting) {
++ */
++ if (0 && error_reporting) {
+ ret = softing_fct_cmd(card, 51, "enable_error_frame");
+ if (ret < 0)
+ goto failed;
+ }
+- */
++
+ /* initialize interface */
+ iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 2]);
+ iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 4]);
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index 6a57169c27158..8fa5836e54875 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -328,7 +328,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
+
+ /* device reports out of range channel id */
+ if (hf->channel >= GS_MAX_INTF)
+- goto resubmit_urb;
++ goto device_detach;
+
+ dev = usbcan->canch[hf->channel];
+
+@@ -413,6 +413,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
+
+ /* USB failure take down all interfaces */
+ if (rc == -ENODEV) {
++ device_detach:
+ for (rc = 0; rc < GS_MAX_INTF; rc++) {
+ if (usbcan->canch[rc])
+ netif_device_detach(usbcan->canch[rc]->netdev);
+@@ -514,6 +515,8 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
+
+ hf->echo_id = idx;
+ hf->channel = dev->channel;
++ hf->flags = 0;
++ hf->reserved = 0;
+
+ cf = (struct can_frame *)skb->data;
+
+diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
+index b01c6da4dd814..90447a420ec7c 100644
+--- a/drivers/net/can/xilinx_can.c
++++ b/drivers/net/can/xilinx_can.c
+@@ -1536,7 +1536,12 @@ static int xcan_probe(struct platform_device *pdev)
+ spin_lock_init(&priv->tx_lock);
+
+ /* Get IRQ for the device */
+- ndev->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto err_free;
++
++ ndev->irq = ret;
++
+ ndev->flags |= IFF_ECHO; /* We support local echo */
+
+ platform_set_drvdata(pdev, ndev);
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 79e156e2ad6a0..d4be107ea4cdf 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -3516,10 +3516,12 @@ static int bcmgenet_probe(struct platform_device *pdev)
+
+ /* Request the WOL interrupt and advertise suspend if available */
+ priv->wol_irq_disabled = true;
+- err = devm_request_irq(&pdev->dev, priv->wol_irq, bcmgenet_wol_isr, 0,
+- dev->name, priv);
+- if (!err)
+- device_set_wakeup_capable(&pdev->dev, 1);
++ if (priv->wol_irq > 0) {
++ err = devm_request_irq(&pdev->dev, priv->wol_irq,
++ bcmgenet_wol_isr, 0, dev->name, priv);
++ if (!err)
++ device_set_wakeup_capable(&pdev->dev, 1);
++ }
+
+ /* Set the needed headroom to account for any possible
+ * features enabling/disabling at runtime
+diff --git a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c
+index d04a6c1634452..da8d10475a08e 100644
+--- a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c
++++ b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c
+@@ -32,6 +32,7 @@
+
+ #include <linux/tcp.h>
+ #include <linux/ipv6.h>
++#include <net/inet_ecn.h>
+ #include <net/route.h>
+ #include <net/ip6_route.h>
+
+@@ -99,7 +100,7 @@ cxgb_find_route(struct cxgb4_lld_info *lldi,
+
+ rt = ip_route_output_ports(&init_net, &fl4, NULL, peer_ip, local_ip,
+ peer_port, local_port, IPPROTO_TCP,
+- tos, 0);
++ tos & ~INET_ECN_MASK, 0);
+ if (IS_ERR(rt))
+ return NULL;
+ n = dst_neigh_lookup(&rt->dst, &peer_ip);
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index 5242687060b44..f8a3d1fecb0a5 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -304,21 +304,21 @@ static void gmac_speed_set(struct net_device *netdev)
+ switch (phydev->speed) {
+ case 1000:
+ status.bits.speed = GMAC_SPEED_1000;
+- if (phydev->interface == PHY_INTERFACE_MODE_RGMII)
++ if (phy_interface_mode_is_rgmii(phydev->interface))
+ status.bits.mii_rmii = GMAC_PHY_RGMII_1000;
+ netdev_dbg(netdev, "connect %s to RGMII @ 1Gbit\n",
+ phydev_name(phydev));
+ break;
+ case 100:
+ status.bits.speed = GMAC_SPEED_100;
+- if (phydev->interface == PHY_INTERFACE_MODE_RGMII)
++ if (phy_interface_mode_is_rgmii(phydev->interface))
+ status.bits.mii_rmii = GMAC_PHY_RGMII_100_10;
+ netdev_dbg(netdev, "connect %s to RGMII @ 100 Mbit\n",
+ phydev_name(phydev));
+ break;
+ case 10:
+ status.bits.speed = GMAC_SPEED_10;
+- if (phydev->interface == PHY_INTERFACE_MODE_RGMII)
++ if (phy_interface_mode_is_rgmii(phydev->interface))
+ status.bits.mii_rmii = GMAC_PHY_RGMII_100_10;
+ netdev_dbg(netdev, "connect %s to RGMII @ 10 Mbit\n",
+ phydev_name(phydev));
+@@ -389,6 +389,9 @@ static int gmac_setup_phy(struct net_device *netdev)
+ status.bits.mii_rmii = GMAC_PHY_GMII;
+ break;
+ case PHY_INTERFACE_MODE_RGMII:
++ case PHY_INTERFACE_MODE_RGMII_ID:
++ case PHY_INTERFACE_MODE_RGMII_TXID:
++ case PHY_INTERFACE_MODE_RGMII_RXID:
+ netdev_dbg(netdev,
+ "RGMII: set GMAC0 and GMAC1 to MII/RGMII mode\n");
+ status.bits.mii_rmii = GMAC_PHY_RGMII_100_10;
+diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
+index a847b9c3b31a9..713abcd9371fa 100644
+--- a/drivers/net/ethernet/freescale/fman/mac.c
++++ b/drivers/net/ethernet/freescale/fman/mac.c
+@@ -94,14 +94,17 @@ static void mac_exception(void *handle, enum fman_mac_exceptions ex)
+ __func__, ex);
+ }
+
+-static void set_fman_mac_params(struct mac_device *mac_dev,
+- struct fman_mac_params *params)
++static int set_fman_mac_params(struct mac_device *mac_dev,
++ struct fman_mac_params *params)
+ {
+ struct mac_priv_s *priv = mac_dev->priv;
+
+ params->base_addr = (typeof(params->base_addr))
+ devm_ioremap(priv->dev, mac_dev->res->start,
+ resource_size(mac_dev->res));
++ if (!params->base_addr)
++ return -ENOMEM;
++
+ memcpy(¶ms->addr, mac_dev->addr, sizeof(mac_dev->addr));
+ params->max_speed = priv->max_speed;
+ params->phy_if = mac_dev->phy_if;
+@@ -112,6 +115,8 @@ static void set_fman_mac_params(struct mac_device *mac_dev,
+ params->event_cb = mac_exception;
+ params->dev_id = mac_dev;
+ params->internal_phy_node = priv->internal_phy_node;
++
++ return 0;
+ }
+
+ static int tgec_initialization(struct mac_device *mac_dev)
+@@ -123,7 +128,9 @@ static int tgec_initialization(struct mac_device *mac_dev)
+
+ priv = mac_dev->priv;
+
+- set_fman_mac_params(mac_dev, ¶ms);
++ err = set_fman_mac_params(mac_dev, ¶ms);
++ if (err)
++ goto _return;
+
+ mac_dev->fman_mac = tgec_config(¶ms);
+ if (!mac_dev->fman_mac) {
+@@ -169,7 +176,9 @@ static int dtsec_initialization(struct mac_device *mac_dev)
+
+ priv = mac_dev->priv;
+
+- set_fman_mac_params(mac_dev, ¶ms);
++ err = set_fman_mac_params(mac_dev, ¶ms);
++ if (err)
++ goto _return;
+
+ mac_dev->fman_mac = dtsec_config(¶ms);
+ if (!mac_dev->fman_mac) {
+@@ -218,7 +227,9 @@ static int memac_initialization(struct mac_device *mac_dev)
+
+ priv = mac_dev->priv;
+
+- set_fman_mac_params(mac_dev, ¶ms);
++ err = set_fman_mac_params(mac_dev, ¶ms);
++ if (err)
++ goto _return;
+
+ if (priv->max_speed == SPEED_10000)
+ params.phy_if = PHY_INTERFACE_MODE_XGMII;
+diff --git a/drivers/net/ethernet/freescale/xgmac_mdio.c b/drivers/net/ethernet/freescale/xgmac_mdio.c
+index c82c85ef5fb34..c37aea7ba8502 100644
+--- a/drivers/net/ethernet/freescale/xgmac_mdio.c
++++ b/drivers/net/ethernet/freescale/xgmac_mdio.c
+@@ -301,9 +301,10 @@ err_ioremap:
+ static int xgmac_mdio_remove(struct platform_device *pdev)
+ {
+ struct mii_bus *bus = platform_get_drvdata(pdev);
++ struct mdio_fsl_priv *priv = bus->priv;
+
+ mdiobus_unregister(bus);
+- iounmap(bus->priv);
++ iounmap(priv->mdio_base);
+ mdiobus_free(bus);
+
+ return 0;
+diff --git a/drivers/net/ethernet/i825xx/sni_82596.c b/drivers/net/ethernet/i825xx/sni_82596.c
+index 43c1fd18670b0..a990e606ecaa8 100644
+--- a/drivers/net/ethernet/i825xx/sni_82596.c
++++ b/drivers/net/ethernet/i825xx/sni_82596.c
+@@ -122,9 +122,10 @@ static int sni_82596_probe(struct platform_device *dev)
+ netdevice->dev_addr[5] = readb(eth_addr + 0x06);
+ iounmap(eth_addr);
+
+- if (!netdevice->irq) {
++ if (netdevice->irq < 0) {
+ printk(KERN_ERR "%s: IRQ not found for i82596 at 0x%lx\n",
+ __FILE__, netdevice->base_addr);
++ retval = netdevice->irq;
+ goto probe_failed;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+index a903e97793f9a..addd5765576d9 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+@@ -1825,6 +1825,7 @@ int mlxsw_pci_driver_register(struct pci_driver *pci_driver)
+ {
+ pci_driver->probe = mlxsw_pci_probe;
+ pci_driver->remove = mlxsw_pci_remove;
++ pci_driver->shutdown = mlxsw_pci_remove;
+ return pci_register_driver(pci_driver);
+ }
+ EXPORT_SYMBOL(mlxsw_pci_driver_register);
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index b093f14eeec39..5190402f779ec 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -279,6 +279,16 @@ static int axienet_dma_bd_init(struct net_device *ndev)
+ axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET,
+ cr | XAXIDMA_CR_RUNSTOP_MASK);
+
++ /* Wait for PhyRstCmplt bit to be set, indicating the PHY reset has finished */
++ ret = read_poll_timeout(axienet_ior, value,
++ value & XAE_INT_PHYRSTCMPLT_MASK,
++ DELAY_OF_ONE_MILLISEC, 50000, false, lp,
++ XAE_IS_OFFSET);
++ if (ret) {
++ dev_err(lp->dev, "%s: timeout waiting for PhyRstCmplt\n", __func__);
++ return ret;
++ }
++
+ return 0;
+ out:
+ axienet_dma_bd_release(ndev);
+@@ -672,7 +682,7 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ num_frag = skb_shinfo(skb)->nr_frags;
+ cur_p = &lp->tx_bd_v[lp->tx_bd_tail];
+
+- if (axienet_check_tx_bd_space(lp, num_frag)) {
++ if (axienet_check_tx_bd_space(lp, num_frag + 1)) {
+ if (netif_queue_stopped(ndev))
+ return NETDEV_TX_BUSY;
+
+@@ -682,7 +692,7 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ smp_mb();
+
+ /* Space might have just been freed - check again */
+- if (axienet_check_tx_bd_space(lp, num_frag))
++ if (axienet_check_tx_bd_space(lp, num_frag + 1))
+ return NETDEV_TX_BUSY;
+
+ netif_wake_queue(ndev);
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 832a401c5fa56..484f6691b9c9f 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -930,6 +930,12 @@ static int m88e1118_config_init(struct phy_device *phydev)
+ if (err < 0)
+ return err;
+
++ if (phy_interface_is_rgmii(phydev)) {
++ err = m88e1121_config_aneg_rgmii_delays(phydev);
++ if (err < 0)
++ return err;
++ }
++
+ /* Adjust LED Control */
+ if (phydev->dev_flags & MARVELL_PHY_M1118_DNS323_LEDS)
+ err = phy_write(phydev, 0x10, 0x1100);
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index 3207da2224f67..eaa890a6a5d21 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -426,7 +426,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
+ mdiobus_setup_mdiodev_from_board_info(bus, mdiobus_create_device);
+
+ bus->state = MDIOBUS_REGISTERED;
+- pr_info("%s: probed\n", bus->name);
++ dev_dbg(&bus->dev, "probed\n");
+ return 0;
+
+ error:
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index dc9de8731c564..3f335b57d5cde 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -73,6 +73,8 @@
+ #define MPHDRLEN 6 /* multilink protocol header length */
+ #define MPHDRLEN_SSN 4 /* ditto with short sequence numbers */
+
++#define PPP_PROTO_LEN 2
++
+ /*
+ * An instance of /dev/ppp can be associated with either a ppp
+ * interface unit or a ppp channel. In both cases, file->private_data
+@@ -502,6 +504,9 @@ static ssize_t ppp_write(struct file *file, const char __user *buf,
+
+ if (!pf)
+ return -ENXIO;
++ /* All PPP packets should start with the 2-byte protocol */
++ if (count < PPP_PROTO_LEN)
++ return -EINVAL;
+ ret = -ENOMEM;
+ skb = alloc_skb(count + pf->hdrlen, GFP_KERNEL);
+ if (!skb)
+@@ -1550,7 +1555,7 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
+ }
+
+ ++ppp->stats64.tx_packets;
+- ppp->stats64.tx_bytes += skb->len - 2;
++ ppp->stats64.tx_bytes += skb->len - PPP_PROTO_LEN;
+
+ switch (proto) {
+ case PPP_IP:
+diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c
+index 5a47e5510ca82..c0f52a622964f 100644
+--- a/drivers/net/usb/mcs7830.c
++++ b/drivers/net/usb/mcs7830.c
+@@ -121,8 +121,16 @@ static const char driver_name[] = "MOSCHIP usb-ethernet driver";
+
+ static int mcs7830_get_reg(struct usbnet *dev, u16 index, u16 size, void *data)
+ {
+- return usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ,
+- 0x0000, index, data, size);
++ int ret;
++
++ ret = usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ,
++ 0x0000, index, data, size);
++ if (ret < 0)
++ return ret;
++ else if (ret < size)
++ return -ENODATA;
++
++ return ret;
+ }
+
+ static int mcs7830_set_reg(struct usbnet *dev, u16 index, u16 size, const void *data)
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c
+index fd1843fd256bb..5e988f7ec1743 100644
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -197,7 +197,6 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (rxq < rcv->real_num_rx_queues) {
+ rq = &rcv_priv->rq[rxq];
+ rcv_xdp = rcu_access_pointer(rq->xdp_prog);
+- skb_record_rx_queue(skb, rxq);
+ }
+
+ if (likely(veth_forward_skb(rcv, skb, rq, rcv_xdp) == NET_RX_SUCCESS)) {
+diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
+index 4c57e79e5779a..58e189ec672f9 100644
+--- a/drivers/net/wireless/ath/ar5523/ar5523.c
++++ b/drivers/net/wireless/ath/ar5523/ar5523.c
+@@ -153,6 +153,10 @@ static void ar5523_cmd_rx_cb(struct urb *urb)
+ ar5523_err(ar, "Invalid reply to WDCMSG_TARGET_START");
+ return;
+ }
++ if (!cmd->odata) {
++ ar5523_err(ar, "Unexpected WDCMSG_TARGET_START reply");
++ return;
++ }
+ memcpy(cmd->odata, hdr + 1, sizeof(u32));
+ cmd->olen = sizeof(u32);
+ cmd->res = 0;
+diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
+index fd011bdabb963..3718d4dfc6d60 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
+@@ -158,6 +158,9 @@ void ath10k_htt_tx_dec_pending(struct ath10k_htt *htt)
+ htt->num_pending_tx--;
+ if (htt->num_pending_tx == htt->max_num_pending_tx - 1)
+ ath10k_mac_tx_unlock(htt->ar, ATH10K_TX_PAUSE_Q_FULL);
++
++ if (htt->num_pending_tx == 0)
++ wake_up(&htt->empty_tx_wq);
+ }
+
+ int ath10k_htt_tx_inc_pending(struct ath10k_htt *htt)
+diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
+index 6c47e4b6aa6cd..888a8f4aff5d8 100644
+--- a/drivers/net/wireless/ath/ath10k/txrx.c
++++ b/drivers/net/wireless/ath/ath10k/txrx.c
+@@ -91,8 +91,6 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt,
+
+ ath10k_htt_tx_free_msdu_id(htt, tx_done->msdu_id);
+ ath10k_htt_tx_dec_pending(htt);
+- if (htt->num_pending_tx == 0)
+- wake_up(&htt->empty_tx_wq);
+ spin_unlock_bh(&htt->tx_lock);
+
+ dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index 2ed98aaed6fb5..c8c7afe0e343e 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -590,6 +590,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ return;
+ }
+
++ if (pkt_len > 2 * MAX_RX_BUF_SIZE) {
++ dev_err(&hif_dev->udev->dev,
++ "ath9k_htc: invalid pkt_len (%x)\n", pkt_len);
++ RX_STAT_INC(skb_dropped);
++ return;
++ }
++
+ pad_len = 4 - (pkt_len & 0x3);
+ if (pad_len == 4)
+ pad_len = 0;
+diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
+index 657525988d1ee..38eef1579db2d 100644
+--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
++++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
+@@ -954,4 +954,9 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
+
+ wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch);
+ wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch);
++
++ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_l_ch);
++ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_h_ch);
++ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_l_ch);
++ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_h_ch);
+ }
+diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
+index e75c1cfd85e63..741a830d9773b 100644
+--- a/drivers/net/wireless/ath/wcn36xx/smd.c
++++ b/drivers/net/wireless/ath/wcn36xx/smd.c
+@@ -2311,7 +2311,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn,
+ wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
+ tmp->bss_index);
+ vif = wcn36xx_priv_to_vif(tmp);
+- ieee80211_connection_loss(vif);
++ ieee80211_beacon_loss(vif);
+ }
+ return 0;
+ }
+@@ -2326,7 +2326,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn,
+ wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n",
+ rsp->bss_index);
+ vif = wcn36xx_priv_to_vif(tmp);
+- ieee80211_connection_loss(vif);
++ ieee80211_beacon_loss(vif);
+ return 0;
+ }
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+index db6628d390a2a..c44108823f796 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+@@ -183,6 +183,9 @@ static void iwl_dealloc_ucode(struct iwl_drv *drv)
+
+ for (i = 0; i < IWL_UCODE_TYPE_MAX; i++)
+ iwl_free_fw_img(drv, drv->fw.img + i);
++
++ /* clear the data for the aborted load case */
++ memset(&drv->fw, 0, sizeof(drv->fw));
+ }
+
+ static int iwl_alloc_fw_desc(struct iwl_drv *drv, struct fw_desc *desc,
+@@ -1270,6 +1273,7 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
+ int i;
+ bool load_module = false;
+ bool usniffer_images = false;
++ bool failure = true;
+
+ fw->ucode_capa.max_probe_length = IWL_DEFAULT_MAX_PROBE_LENGTH;
+ fw->ucode_capa.standard_phy_calibration_size =
+@@ -1528,15 +1532,9 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
+ * else from proceeding if the module fails to load
+ * or hangs loading.
+ */
+- if (load_module) {
++ if (load_module)
+ request_module("%s", op->name);
+-#ifdef CONFIG_IWLWIFI_OPMODE_MODULAR
+- if (err)
+- IWL_ERR(drv,
+- "failed to load module %s (error %d), is dynamic loading enabled?\n",
+- op->name, err);
+-#endif
+- }
++ failure = false;
+ goto free;
+
+ try_again:
+@@ -1552,6 +1550,9 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
+ complete(&drv->request_firmware_complete);
+ device_release_driver(drv->trans->dev);
+ free:
++ if (failure)
++ iwl_dealloc_ucode(drv);
++
+ if (pieces) {
+ for (i = 0; i < ARRAY_SIZE(pieces->img); i++)
+ kfree(pieces->img[i].sec);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 697a66acba9ce..3f37fb64e71c2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -1623,6 +1623,7 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
+ struct iwl_mvm_mc_iter_data iter_data = {
+ .mvm = mvm,
+ };
++ int ret;
+
+ lockdep_assert_held(&mvm->mutex);
+
+@@ -1632,6 +1633,22 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
+ ieee80211_iterate_active_interfaces_atomic(
+ mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+ iwl_mvm_mc_iface_iterator, &iter_data);
++
++ /*
++ * Send a (synchronous) ech command so that we wait for the
++ * multiple asynchronous MCAST_FILTER_CMD commands sent by
++ * the interface iterator. Otherwise, we might get here over
++ * and over again (by userspace just sending a lot of these)
++ * and the CPU can send them faster than the firmware can
++ * process them.
++ * Note that the CPU is still faster - but with this we'll
++ * actually send fewer commands overall because the CPU will
++ * not schedule the work in mac80211 as frequently if it's
++ * still running when rescheduled (possibly multiple times).
++ */
++ ret = iwl_mvm_send_cmd_pdu(mvm, ECHO_CMD, 0, 0, NULL);
++ if (ret)
++ IWL_ERR(mvm, "Failed to synchronize multicast groups update\n");
+ }
+
+ static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index 77e3694536421..9a4848d69e9e1 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -151,12 +151,39 @@ static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
+ struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
+ unsigned int headlen, fraglen, pad_len = 0;
+ unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
++ u8 mic_crc_len = u8_get_bits(desc->mac_flags1,
++ IWL_RX_MPDU_MFLG1_MIC_CRC_LEN_MASK) << 1;
+
+ if (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_PAD) {
+ len -= 2;
+ pad_len = 2;
+ }
+
++ /*
++ * For non monitor interface strip the bytes the RADA might not have
++ * removed. As monitor interface cannot exist with other interfaces
++ * this removal is safe.
++ */
++ if (mic_crc_len && !ieee80211_hw_check(mvm->hw, RX_INCLUDES_FCS)) {
++ u32 pkt_flags = le32_to_cpu(pkt->len_n_flags);
++
++ /*
++ * If RADA was not enabled then decryption was not performed so
++ * the MIC cannot be removed.
++ */
++ if (!(pkt_flags & FH_RSCSR_RADA_EN)) {
++ if (WARN_ON(crypt_len > mic_crc_len))
++ return -EINVAL;
++
++ mic_crc_len -= crypt_len;
++ }
++
++ if (WARN_ON(mic_crc_len > len))
++ return -EINVAL;
++
++ len -= mic_crc_len;
++ }
++
+ /* If frame is small enough to fit in skb->head, pull it completely.
+ * If not, only pull ieee80211_hdr (including crypto if present, and
+ * an additional 8 bytes for SNAP/ethertype, see below) so that
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+index 11ecdf63b7325..16b614cc16ab5 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+@@ -1555,7 +1555,7 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
+ return -EIO;
+ }
+
+-#define SCAN_TIMEOUT 20000
++#define SCAN_TIMEOUT 30000
+
+ void iwl_mvm_scan_timeout_wk(struct work_struct *work)
+ {
+diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
+index e6234b53a5ca2..90490d2c6d177 100644
+--- a/drivers/net/wireless/marvell/mwifiex/usb.c
++++ b/drivers/net/wireless/marvell/mwifiex/usb.c
+@@ -130,7 +130,8 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
+ default:
+ mwifiex_dbg(adapter, ERROR,
+ "unknown recv_type %#x\n", recv_type);
+- return -1;
++ ret = -1;
++ goto exit_restore_skb;
+ }
+ break;
+ case MWIFIEX_USB_EP_DATA:
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
+index 8c60a84941d55..e823634287629 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
+@@ -1020,6 +1020,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
+ _InitPABias(hw);
+ rtl92c_dm_init(hw);
+ exit:
++ local_irq_disable();
+ local_irq_restore(flags);
+ return err;
+ }
+diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c
+index d90d8ab56fa28..c6f5c46cc88e7 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_main.c
++++ b/drivers/net/wireless/rsi/rsi_91x_main.c
+@@ -23,6 +23,7 @@
+ #include "rsi_common.h"
+ #include "rsi_coex.h"
+ #include "rsi_hal.h"
++#include "rsi_usb.h"
+
+ u32 rsi_zone_enabled = /* INFO_ZONE |
+ INIT_ZONE |
+@@ -173,6 +174,9 @@ int rsi_read_pkt(struct rsi_common *common, u8 *rx_pkt, s32 rcv_pkt_len)
+ frame_desc = &rx_pkt[index];
+ actual_length = *(u16 *)&frame_desc[0];
+ offset = *(u16 *)&frame_desc[2];
++ if (!rcv_pkt_len && offset >
++ RSI_MAX_RX_USB_PKT_SIZE - FRAME_DESC_SZ)
++ goto fail;
+
+ queueno = rsi_get_queueno(frame_desc, offset);
+ length = rsi_get_length(frame_desc, offset);
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index 984f99ad40960..da09e130710e0 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -312,7 +312,6 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num, gfp_t mem_flags)
+ struct sk_buff *skb;
+ u8 dword_align_bytes = 0;
+
+-#define RSI_MAX_RX_USB_PKT_SIZE 3000
+ skb = dev_alloc_skb(RSI_MAX_RX_USB_PKT_SIZE);
+ if (!skb)
+ return -ENOMEM;
+diff --git a/drivers/net/wireless/rsi/rsi_usb.h b/drivers/net/wireless/rsi/rsi_usb.h
+index 5b2eddd1a2ee5..3d3d2643088d0 100644
+--- a/drivers/net/wireless/rsi/rsi_usb.h
++++ b/drivers/net/wireless/rsi/rsi_usb.h
+@@ -43,6 +43,8 @@
+ #define RSI_USB_BUF_SIZE 4096
+ #define RSI_USB_CTRL_BUF_SIZE 0x04
+
++#define RSI_MAX_RX_USB_PKT_SIZE 3000
++
+ struct rx_usb_ctrl_block {
+ u8 *data;
+ struct urb *rx_urb;
+diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
+index b1ff46fe45478..bbc59d329e9df 100644
+--- a/drivers/parisc/pdc_stable.c
++++ b/drivers/parisc/pdc_stable.c
+@@ -992,8 +992,10 @@ pdcs_register_pathentries(void)
+ entry->kobj.kset = paths_kset;
+ err = kobject_init_and_add(&entry->kobj, &ktype_pdcspath, NULL,
+ "%s", entry->name);
+- if (err)
++ if (err) {
++ kobject_put(&entry->kobj);
+ return err;
++ }
+
+ /* kobject is now registered */
+ write_lock(&entry->rw_lock);
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 315e96ba651a2..7cd38c9eaa020 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4040,6 +4040,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9120,
+ quirk_dma_func1_alias);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123,
+ quirk_dma_func1_alias);
++/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c136 */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9125,
++ quirk_dma_func1_alias);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128,
+ quirk_dma_func1_alias);
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
+diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
+index 8c8caec3a72cc..182e5ef4ab83d 100644
+--- a/drivers/pcmcia/cs.c
++++ b/drivers/pcmcia/cs.c
+@@ -669,18 +669,16 @@ static int pccardd(void *__skt)
+ if (events || sysfs_events)
+ continue;
+
++ set_current_state(TASK_INTERRUPTIBLE);
+ if (kthread_should_stop())
+ break;
+
+- set_current_state(TASK_INTERRUPTIBLE);
+-
+ schedule();
+
+- /* make sure we are running */
+- __set_current_state(TASK_RUNNING);
+-
+ try_to_freeze();
+ }
++ /* make sure we are running before we exit */
++ __set_current_state(TASK_RUNNING);
+
+ /* shut down socket, if a device is still present */
+ if (skt->state & SOCKET_PRESENT) {
+diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
+index 49377d502b740..123420cac6b54 100644
+--- a/drivers/pcmcia/rsrc_nonstatic.c
++++ b/drivers/pcmcia/rsrc_nonstatic.c
+@@ -693,6 +693,9 @@ static struct resource *__nonstatic_find_io_region(struct pcmcia_socket *s,
+ unsigned long min = base;
+ int ret;
+
++ if (!res)
++ return NULL;
++
+ data.mask = align - 1;
+ data.offset = base & data.mask;
+ data.map = &s_data->io_db;
+@@ -812,6 +815,9 @@ static struct resource *nonstatic_find_mem_region(u_long base, u_long num,
+ unsigned long min, max;
+ int ret, i, j;
+
++ if (!res)
++ return NULL;
++
+ low = low || !(s->features & SS_CAP_PAGE_REGS);
+
+ data.mask = align - 1;
+diff --git a/drivers/power/supply/bq25890_charger.c b/drivers/power/supply/bq25890_charger.c
+index 8e2c41ded171c..e90253b3f6561 100644
+--- a/drivers/power/supply/bq25890_charger.c
++++ b/drivers/power/supply/bq25890_charger.c
+@@ -521,12 +521,12 @@ static void bq25890_handle_state_change(struct bq25890_device *bq,
+
+ if (!new_state->online) { /* power removed */
+ /* disable ADC */
+- ret = bq25890_field_write(bq, F_CONV_START, 0);
++ ret = bq25890_field_write(bq, F_CONV_RATE, 0);
+ if (ret < 0)
+ goto error;
+ } else if (!old_state.online) { /* power inserted */
+ /* enable ADC, to have control of charge current/voltage */
+- ret = bq25890_field_write(bq, F_CONV_START, 1);
++ ret = bq25890_field_write(bq, F_CONV_RATE, 1);
+ if (ret < 0)
+ goto error;
+ }
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 088ed4ee6d83e..045075cd256ce 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1211,7 +1211,9 @@ static int set_machine_constraints(struct regulator_dev *rdev)
+ rdev_err(rdev, "failed to enable\n");
+ return ret;
+ }
+- rdev->use_count++;
++
++ if (rdev->constraints->always_on)
++ rdev->use_count++;
+ }
+
+ print_constraints(rdev);
+diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
+index fe2fb36803e0b..8d920a3ad40b8 100644
+--- a/drivers/regulator/qcom_smd-regulator.c
++++ b/drivers/regulator/qcom_smd-regulator.c
+@@ -17,6 +17,7 @@
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/regulator/driver.h>
++#include <linux/regulator/of_regulator.h>
+ #include <linux/soc/qcom/smd-rpm.h>
+
+ struct qcom_rpm_reg {
+@@ -673,52 +674,91 @@ static const struct of_device_id rpm_of_match[] = {
+ };
+ MODULE_DEVICE_TABLE(of, rpm_of_match);
+
+-static int rpm_reg_probe(struct platform_device *pdev)
++/**
++ * rpm_regulator_init_vreg() - initialize all attributes of a qcom_smd-regulator
++ * @vreg: Pointer to the individual qcom_smd-regulator resource
++ * @dev: Pointer to the top level qcom_smd-regulator PMIC device
++ * @node: Pointer to the individual qcom_smd-regulator resource
++ * device node
++ * @rpm: Pointer to the rpm bus node
++ * @pmic_rpm_data: Pointer to a null-terminated array of qcom_smd-regulator
++ * resources defined for the top level PMIC device
++ *
++ * Return: 0 on success, errno on failure
++ */
++static int rpm_regulator_init_vreg(struct qcom_rpm_reg *vreg, struct device *dev,
++ struct device_node *node, struct qcom_smd_rpm *rpm,
++ const struct rpm_regulator_data *pmic_rpm_data)
+ {
+- const struct rpm_regulator_data *reg;
+- const struct of_device_id *match;
+- struct regulator_config config = { };
++ struct regulator_config config = {};
++ const struct rpm_regulator_data *rpm_data;
+ struct regulator_dev *rdev;
++ int ret;
++
++ for (rpm_data = pmic_rpm_data; rpm_data->name; rpm_data++)
++ if (of_node_name_eq(node, rpm_data->name))
++ break;
++
++ if (!rpm_data->name) {
++ dev_err(dev, "Unknown regulator %pOFn\n", node);
++ return -EINVAL;
++ }
++
++ vreg->dev = dev;
++ vreg->rpm = rpm;
++ vreg->type = rpm_data->type;
++ vreg->id = rpm_data->id;
++
++ memcpy(&vreg->desc, rpm_data->desc, sizeof(vreg->desc));
++ vreg->desc.name = rpm_data->name;
++ vreg->desc.supply_name = rpm_data->supply;
++ vreg->desc.owner = THIS_MODULE;
++ vreg->desc.type = REGULATOR_VOLTAGE;
++ vreg->desc.of_match = rpm_data->name;
++
++ config.dev = dev;
++ config.of_node = node;
++ config.driver_data = vreg;
++
++ rdev = devm_regulator_register(dev, &vreg->desc, &config);
++ if (IS_ERR(rdev)) {
++ ret = PTR_ERR(rdev);
++ dev_err(dev, "%pOFn: devm_regulator_register() failed, ret=%d\n", node, ret);
++ return ret;
++ }
++
++ return 0;
++}
++
++static int rpm_reg_probe(struct platform_device *pdev)
++{
++ struct device *dev = &pdev->dev;
++ const struct rpm_regulator_data *vreg_data;
++ struct device_node *node;
+ struct qcom_rpm_reg *vreg;
+ struct qcom_smd_rpm *rpm;
++ int ret;
+
+ rpm = dev_get_drvdata(pdev->dev.parent);
+ if (!rpm) {
+- dev_err(&pdev->dev, "unable to retrieve handle to rpm\n");
++ dev_err(&pdev->dev, "Unable to retrieve handle to rpm\n");
+ return -ENODEV;
+ }
+
+- match = of_match_device(rpm_of_match, &pdev->dev);
+- if (!match) {
+- dev_err(&pdev->dev, "failed to match device\n");
++ vreg_data = of_device_get_match_data(dev);
++ if (!vreg_data)
+ return -ENODEV;
+- }
+
+- for (reg = match->data; reg->name; reg++) {
++ for_each_available_child_of_node(dev->of_node, node) {
+ vreg = devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL);
+ if (!vreg)
+ return -ENOMEM;
+
+- vreg->dev = &pdev->dev;
+- vreg->type = reg->type;
+- vreg->id = reg->id;
+- vreg->rpm = rpm;
+-
+- memcpy(&vreg->desc, reg->desc, sizeof(vreg->desc));
+-
+- vreg->desc.id = -1;
+- vreg->desc.owner = THIS_MODULE;
+- vreg->desc.type = REGULATOR_VOLTAGE;
+- vreg->desc.name = reg->name;
+- vreg->desc.supply_name = reg->supply;
+- vreg->desc.of_match = reg->name;
+-
+- config.dev = &pdev->dev;
+- config.driver_data = vreg;
+- rdev = devm_regulator_register(&pdev->dev, &vreg->desc, &config);
+- if (IS_ERR(rdev)) {
+- dev_err(&pdev->dev, "failed to register %s\n", reg->name);
+- return PTR_ERR(rdev);
++ ret = rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data);
++
++ if (ret < 0) {
++ of_node_put(node);
++ return ret;
+ }
+ }
+
+diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
+index 8122807db3809..65834153ba977 100644
+--- a/drivers/rpmsg/rpmsg_core.c
++++ b/drivers/rpmsg/rpmsg_core.c
+@@ -473,13 +473,25 @@ static int rpmsg_dev_probe(struct device *dev)
+ err = rpdrv->probe(rpdev);
+ if (err) {
+ dev_err(dev, "%s: failed: %d\n", __func__, err);
+- if (ept)
+- rpmsg_destroy_ept(ept);
+- goto out;
++ goto destroy_ept;
+ }
+
+- if (ept && rpdev->ops->announce_create)
++ if (ept && rpdev->ops->announce_create) {
+ err = rpdev->ops->announce_create(rpdev);
++ if (err) {
++ dev_err(dev, "failed to announce creation\n");
++ goto remove_rpdev;
++ }
++ }
++
++ return 0;
++
++remove_rpdev:
++ if (rpdrv->remove)
++ rpdrv->remove(rpdev);
++destroy_ept:
++ if (ept)
++ rpmsg_destroy_ept(ept);
+ out:
+ return err;
+ }
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index 0fa94d9e8d44d..8545f0da57fef 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -467,7 +467,10 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t)
+ min = t->time.tm_min;
+ sec = t->time.tm_sec;
+
++ spin_lock_irq(&rtc_lock);
+ rtc_control = CMOS_READ(RTC_CONTROL);
++ spin_unlock_irq(&rtc_lock);
++
+ if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) {
+ /* Writing 0xff means "don't care" or "match all". */
+ mon = (mon <= 12) ? bin2bcd(mon) : 0xff;
+diff --git a/drivers/rtc/rtc-pxa.c b/drivers/rtc/rtc-pxa.c
+index e1887b86fdc74..140c58b160998 100644
+--- a/drivers/rtc/rtc-pxa.c
++++ b/drivers/rtc/rtc-pxa.c
+@@ -349,6 +349,10 @@ static int __init pxa_rtc_probe(struct platform_device *pdev)
+ return -ENXIO;
+ }
+
++ sa1100_rtc->rtc = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(sa1100_rtc->rtc))
++ return PTR_ERR(sa1100_rtc->rtc);
++
+ pxa_rtc->base = devm_ioremap(dev, pxa_rtc->ress->start,
+ resource_size(pxa_rtc->ress));
+ if (!pxa_rtc->base) {
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index 84dd776d36c33..fdbd5c691d333 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -885,7 +885,7 @@ static void get_capabilities(struct scsi_cd *cd)
+
+
+ /* allocate transfer buffer */
+- buffer = kmalloc(512, GFP_KERNEL | GFP_DMA);
++ buffer = kmalloc(512, GFP_KERNEL);
+ if (!buffer) {
+ sr_printk(KERN_ERR, cd, "out of memory.\n");
+ return;
+diff --git a/drivers/scsi/sr_vendor.c b/drivers/scsi/sr_vendor.c
+index b9db2ec6d0361..996bccadd3866 100644
+--- a/drivers/scsi/sr_vendor.c
++++ b/drivers/scsi/sr_vendor.c
+@@ -113,7 +113,7 @@ int sr_set_blocklength(Scsi_CD *cd, int blocklength)
+ if (cd->vendor == VENDOR_TOSHIBA)
+ density = (blocklength > 2048) ? 0x81 : 0x83;
+
+- buffer = kmalloc(512, GFP_KERNEL | GFP_DMA);
++ buffer = kmalloc(512, GFP_KERNEL);
+ if (!buffer)
+ return -ENOMEM;
+
+@@ -161,7 +161,7 @@ int sr_cd_check(struct cdrom_device_info *cdi)
+ if (cd->cdi.mask & CDC_MULTI_SESSION)
+ return 0;
+
+- buffer = kmalloc(512, GFP_KERNEL | GFP_DMA);
++ buffer = kmalloc(512, GFP_KERNEL);
+ if (!buffer)
+ return -ENOMEM;
+
+diff --git a/drivers/scsi/ufs/tc-dwc-g210-pci.c b/drivers/scsi/ufs/tc-dwc-g210-pci.c
+index 2f41722a8c28d..2c6cb7f6b61a6 100644
+--- a/drivers/scsi/ufs/tc-dwc-g210-pci.c
++++ b/drivers/scsi/ufs/tc-dwc-g210-pci.c
+@@ -138,7 +138,6 @@ tc_dwc_g210_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ return err;
+ }
+
+- pci_set_drvdata(pdev, hba);
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_allow(&pdev->dev);
+
+diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
+index 30c22e16b1e34..57985841a879e 100644
+--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
++++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
+@@ -348,8 +348,6 @@ int ufshcd_pltfrm_init(struct platform_device *pdev,
+ goto dealloc_host;
+ }
+
+- platform_set_drvdata(pdev, hba);
+-
+ pm_runtime_set_active(&pdev->dev);
+ pm_runtime_enable(&pdev->dev);
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index b18430efb00fb..fee1989e23f01 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -8046,6 +8046,13 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
+ struct Scsi_Host *host = hba->host;
+ struct device *dev = hba->dev;
+
++ /*
++ * dev_set_drvdata() must be called before any callbacks are registered
++ * that use dev_get_drvdata() (frequency scaling, clock scaling, hwmon,
++ * sysfs).
++ */
++ dev_set_drvdata(dev, hba);
++
+ if (!mmio_base) {
+ dev_err(hba->dev,
+ "Invalid memory reference for mmio_base is NULL\n");
+diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c
+index ef54f1638d207..01fcad7c8fae8 100644
+--- a/drivers/soc/mediatek/mtk-scpsys.c
++++ b/drivers/soc/mediatek/mtk-scpsys.c
+@@ -341,12 +341,17 @@ out:
+ return ret;
+ }
+
+-static void init_clks(struct platform_device *pdev, struct clk **clk)
++static int init_clks(struct platform_device *pdev, struct clk **clk)
+ {
+ int i;
+
+- for (i = CLK_NONE + 1; i < CLK_MAX; i++)
++ for (i = CLK_NONE + 1; i < CLK_MAX; i++) {
+ clk[i] = devm_clk_get(&pdev->dev, clk_names[i]);
++ if (IS_ERR(clk[i]))
++ return PTR_ERR(clk[i]);
++ }
++
++ return 0;
+ }
+
+ static struct scp *init_scp(struct platform_device *pdev,
+@@ -356,7 +361,7 @@ static struct scp *init_scp(struct platform_device *pdev,
+ {
+ struct genpd_onecell_data *pd_data;
+ struct resource *res;
+- int i, j;
++ int i, j, ret;
+ struct scp *scp;
+ struct clk *clk[CLK_MAX];
+
+@@ -411,7 +416,9 @@ static struct scp *init_scp(struct platform_device *pdev,
+
+ pd_data->num_domains = num;
+
+- init_clks(pdev, clk);
++ ret = init_clks(pdev, clk);
++ if (ret)
++ return ERR_PTR(ret);
+
+ for (i = 0; i < num; i++) {
+ struct scp_domain *scpd = &scp->domains[i];
+diff --git a/drivers/spi/spi-meson-spifc.c b/drivers/spi/spi-meson-spifc.c
+index 616566e793c62..28975b6f054fa 100644
+--- a/drivers/spi/spi-meson-spifc.c
++++ b/drivers/spi/spi-meson-spifc.c
+@@ -357,6 +357,7 @@ static int meson_spifc_probe(struct platform_device *pdev)
+ return 0;
+ out_clk:
+ clk_disable_unprepare(spifc->clk);
++ pm_runtime_disable(spifc->dev);
+ out_err:
+ spi_master_put(master);
+ return ret;
+diff --git a/drivers/staging/greybus/audio_topology.c b/drivers/staging/greybus/audio_topology.c
+index 860247d718184..a48e59fe18e81 100644
+--- a/drivers/staging/greybus/audio_topology.c
++++ b/drivers/staging/greybus/audio_topology.c
+@@ -145,6 +145,9 @@ static const char **gb_generate_enum_strings(struct gbaudio_module_info *gb,
+
+ items = le32_to_cpu(gbenum->items);
+ strings = devm_kcalloc(gb->dev, items, sizeof(char *), GFP_KERNEL);
++ if (!strings)
++ return NULL;
++
+ data = gbenum->names;
+
+ for (i = 0; i < items; i++) {
+@@ -662,6 +665,8 @@ static int gbaudio_tplg_create_enum_kctl(struct gbaudio_module_info *gb,
+ /* since count=1, and reg is dummy */
+ gbe->max = le32_to_cpu(gb_enum->items);
+ gbe->texts = gb_generate_enum_strings(gb, gb_enum);
++ if (!gbe->texts)
++ return -ENOMEM;
+
+ /* debug enum info */
+ dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max,
+@@ -871,6 +876,8 @@ static int gbaudio_tplg_create_enum_ctl(struct gbaudio_module_info *gb,
+ /* since count=1, and reg is dummy */
+ gbe->max = le32_to_cpu(gb_enum->items);
+ gbe->texts = gb_generate_enum_strings(gb, gb_enum);
++ if (!gbe->texts)
++ return -ENOMEM;
+
+ /* debug enum info */
+ dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max,
+@@ -1044,6 +1051,10 @@ static int gbaudio_tplg_create_widget(struct gbaudio_module_info *module,
+ csize += le16_to_cpu(gbenum->names_length);
+ control->texts = (const char * const *)
+ gb_generate_enum_strings(module, gbenum);
++ if (!control->texts) {
++ ret = -ENOMEM;
++ goto error;
++ }
+ control->items = le32_to_cpu(gbenum->items);
+ } else {
+ csize = sizeof(struct gb_audio_control);
+@@ -1192,6 +1203,10 @@ static int gbaudio_tplg_process_kcontrols(struct gbaudio_module_info *module,
+ csize += le16_to_cpu(gbenum->names_length);
+ control->texts = (const char * const *)
+ gb_generate_enum_strings(module, gbenum);
++ if (!control->texts) {
++ ret = -ENOMEM;
++ goto error;
++ }
+ control->items = le32_to_cpu(gbenum->items);
+ } else {
+ csize = sizeof(struct gb_audio_control);
+diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
+index 7686805dfe0f2..99f9f71f35ea1 100644
+--- a/drivers/staging/wlan-ng/hfa384x_usb.c
++++ b/drivers/staging/wlan-ng/hfa384x_usb.c
+@@ -3903,18 +3903,18 @@ static void hfa384x_usb_throttlefn(struct timer_list *t)
+
+ spin_lock_irqsave(&hw->ctlxq.lock, flags);
+
+- /*
+- * We need to check BOTH the RX and the TX throttle controls,
+- * so we use the bitwise OR instead of the logical OR.
+- */
+ pr_debug("flags=0x%lx\n", hw->usb_flags);
+- if (!hw->wlandev->hwremoved &&
+- ((test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
+- !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags)) |
+- (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
+- !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags))
+- )) {
+- schedule_work(&hw->usb_work);
++ if (!hw->wlandev->hwremoved) {
++ bool rx_throttle = test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
++ !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags);
++ bool tx_throttle = test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
++ !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags);
++ /*
++ * We need to check BOTH the RX and the TX throttle controls,
++ * so we use the bitwise OR instead of the logical OR.
++ */
++ if (rx_throttle | tx_throttle)
++ schedule_work(&hw->usb_work);
+ }
+
+ spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index dd46b758852aa..d42fc2ae8592e 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -96,8 +96,10 @@ void teedev_ctx_put(struct tee_context *ctx)
+
+ static void teedev_close_context(struct tee_context *ctx)
+ {
+- tee_device_put(ctx->teedev);
++ struct tee_device *teedev = ctx->teedev;
++
+ teedev_ctx_put(ctx);
++ tee_device_put(teedev);
+ }
+
+ static int tee_release(struct inode *inode, struct file *filp)
+diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl010.c
+index 2c37d11726aba..13f882e5e7b76 100644
+--- a/drivers/tty/serial/amba-pl010.c
++++ b/drivers/tty/serial/amba-pl010.c
+@@ -452,14 +452,11 @@ pl010_set_termios(struct uart_port *port, struct ktermios *termios,
+ if ((termios->c_cflag & CREAD) == 0)
+ uap->port.ignore_status_mask |= UART_DUMMY_RSR_RX;
+
+- /* first, disable everything */
+ old_cr = readb(uap->port.membase + UART010_CR) & ~UART010_CR_MSIE;
+
+ if (UART_ENABLE_MS(port, termios->c_cflag))
+ old_cr |= UART010_CR_MSIE;
+
+- writel(0, uap->port.membase + UART010_CR);
+-
+ /* Set baud rate */
+ quot -= 1;
+ writel((quot & 0xf00) >> 8, uap->port.membase + UART010_LCRM);
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index 3d63e9a71c376..5edc3813a9b99 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -2094,32 +2094,13 @@ static const char *pl011_type(struct uart_port *port)
+ return uap->port.type == PORT_AMBA ? uap->type : NULL;
+ }
+
+-/*
+- * Release the memory region(s) being used by 'port'
+- */
+-static void pl011_release_port(struct uart_port *port)
+-{
+- release_mem_region(port->mapbase, SZ_4K);
+-}
+-
+-/*
+- * Request the memory region(s) being used by 'port'
+- */
+-static int pl011_request_port(struct uart_port *port)
+-{
+- return request_mem_region(port->mapbase, SZ_4K, "uart-pl011")
+- != NULL ? 0 : -EBUSY;
+-}
+-
+ /*
+ * Configure/autoconfigure the port.
+ */
+ static void pl011_config_port(struct uart_port *port, int flags)
+ {
+- if (flags & UART_CONFIG_TYPE) {
++ if (flags & UART_CONFIG_TYPE)
+ port->type = PORT_AMBA;
+- pl011_request_port(port);
+- }
+ }
+
+ /*
+@@ -2134,6 +2115,8 @@ static int pl011_verify_port(struct uart_port *port, struct serial_struct *ser)
+ ret = -EINVAL;
+ if (ser->baud_base < 9600)
+ ret = -EINVAL;
++ if (port->mapbase != (unsigned long) ser->iomem_base)
++ ret = -EINVAL;
+ return ret;
+ }
+
+@@ -2151,8 +2134,6 @@ static const struct uart_ops amba_pl011_pops = {
+ .flush_buffer = pl011_dma_flush_buffer,
+ .set_termios = pl011_set_termios,
+ .type = pl011_type,
+- .release_port = pl011_release_port,
+- .request_port = pl011_request_port,
+ .config_port = pl011_config_port,
+ .verify_port = pl011_verify_port,
+ #ifdef CONFIG_CONSOLE_POLL
+@@ -2182,8 +2163,6 @@ static const struct uart_ops sbsa_uart_pops = {
+ .shutdown = sbsa_uart_shutdown,
+ .set_termios = sbsa_uart_set_termios,
+ .type = pl011_type,
+- .release_port = pl011_release_port,
+- .request_port = pl011_request_port,
+ .config_port = pl011_config_port,
+ .verify_port = pl011_verify_port,
+ #ifdef CONFIG_CONSOLE_POLL
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 936d401f20b95..3ba9ed36d6362 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -918,6 +918,13 @@ static void atmel_tx_dma(struct uart_port *port)
+ desc->callback = atmel_complete_tx_dma;
+ desc->callback_param = atmel_port;
+ atmel_port->cookie_tx = dmaengine_submit(desc);
++ if (dma_submit_error(atmel_port->cookie_tx)) {
++ dev_err(port->dev, "dma_submit_error %d\n",
++ atmel_port->cookie_tx);
++ return;
++ }
++
++ dma_async_issue_pending(chan);
+ }
+
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+@@ -1176,6 +1183,13 @@ static int atmel_prepare_rx_dma(struct uart_port *port)
+ desc->callback_param = port;
+ atmel_port->desc_rx = desc;
+ atmel_port->cookie_rx = dmaengine_submit(desc);
++ if (dma_submit_error(atmel_port->cookie_rx)) {
++ dev_err(port->dev, "dma_submit_error %d\n",
++ atmel_port->cookie_rx);
++ goto chan_err;
++ }
++
++ dma_async_issue_pending(atmel_port->chan_rx);
+
+ return 0;
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 63aefe7e91be1..eb1b95522c8f2 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -159,7 +159,7 @@ static void uart_port_dtr_rts(struct uart_port *uport, int raise)
+ int RTS_after_send = !!(uport->rs485.flags & SER_RS485_RTS_AFTER_SEND);
+
+ if (raise) {
+- if (rs485_on && !RTS_after_send) {
++ if (rs485_on && RTS_after_send) {
+ uart_set_mctrl(uport, TIOCM_DTR);
+ uart_clear_mctrl(uport, TIOCM_RTS);
+ } else {
+@@ -168,7 +168,7 @@ static void uart_port_dtr_rts(struct uart_port *uport, int raise)
+ } else {
+ unsigned int clear = TIOCM_DTR;
+
+- clear |= (!rs485_on || !RTS_after_send) ? TIOCM_RTS : 0;
++ clear |= (!rs485_on || RTS_after_send) ? TIOCM_RTS : 0;
+ uart_clear_mctrl(uport, clear);
+ }
+ }
+@@ -2347,7 +2347,8 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state,
+ * We probably don't need a spinlock around this, but
+ */
+ spin_lock_irqsave(&port->lock, flags);
+- port->ops->set_mctrl(port, port->mctrl & TIOCM_DTR);
++ port->mctrl &= TIOCM_DTR;
++ port->ops->set_mctrl(port, port->mctrl);
+ spin_unlock_irqrestore(&port->lock, flags);
+
+ /*
+diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
+index 8df3058226687..5d1b7455e627d 100644
+--- a/drivers/tty/serial/uartlite.c
++++ b/drivers/tty/serial/uartlite.c
+@@ -618,7 +618,7 @@ static struct uart_driver ulite_uart_driver = {
+ *
+ * Returns: 0 on success, <0 otherwise
+ */
+-static int ulite_assign(struct device *dev, int id, u32 base, int irq,
++static int ulite_assign(struct device *dev, int id, phys_addr_t base, int irq,
+ struct uartlite_data *pdata)
+ {
+ struct uart_port *port;
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index b82a7d787add8..11cc189bf1055 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -750,6 +750,7 @@ void usb_hcd_poll_rh_status(struct usb_hcd *hcd)
+ {
+ struct urb *urb;
+ int length;
++ int status;
+ unsigned long flags;
+ char buffer[6]; /* Any root hubs with > 31 ports? */
+
+@@ -767,11 +768,17 @@ void usb_hcd_poll_rh_status(struct usb_hcd *hcd)
+ if (urb) {
+ clear_bit(HCD_FLAG_POLL_PENDING, &hcd->flags);
+ hcd->status_urb = NULL;
++ if (urb->transfer_buffer_length >= length) {
++ status = 0;
++ } else {
++ status = -EOVERFLOW;
++ length = urb->transfer_buffer_length;
++ }
+ urb->actual_length = length;
+ memcpy(urb->transfer_buffer, buffer, length);
+
+ usb_hcd_unlink_urb_from_ep(hcd, urb);
+- usb_hcd_giveback_urb(hcd, urb, 0);
++ usb_hcd_giveback_urb(hcd, urb, status);
+ } else {
+ length = 0;
+ set_bit(HCD_FLAG_POLL_PENDING, &hcd->flags);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 73ad4af487039..29cc2aa5abff5 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1082,7 +1082,10 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ } else {
+ hub_power_on(hub, true);
+ }
+- }
++ /* Give some time on remote wakeup to let links to transit to U0 */
++ } else if (hub_is_superspeed(hub->hdev))
++ msleep(20);
++
+ init2:
+
+ /*
+@@ -1197,7 +1200,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ */
+ if (portchange || (hub_is_superspeed(hub->hdev) &&
+ port_resumed))
+- set_bit(port1, hub->change_bits);
++ set_bit(port1, hub->event_bits);
+
+ } else if (udev->persist_enabled) {
+ #ifdef CONFIG_PM
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index f070082124742..9271a7009a00f 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -607,7 +607,7 @@ static int ffs_ep0_open(struct inode *inode, struct file *file)
+ file->private_data = ffs;
+ ffs_data_opened(ffs);
+
+- return 0;
++ return stream_open(inode, file);
+ }
+
+ static int ffs_ep0_release(struct inode *inode, struct file *file)
+@@ -1071,7 +1071,7 @@ ffs_epfile_open(struct inode *inode, struct file *file)
+ file->private_data = epfile;
+ ffs_data_opened(epfile->ffs);
+
+- return 0;
++ return stream_open(inode, file);
+ }
+
+ static int ffs_aio_cancel(struct kiocb *kiocb)
+diff --git a/drivers/usb/host/uhci-platform.c b/drivers/usb/host/uhci-platform.c
+index 89700e26fb296..813ff3660e9f1 100644
+--- a/drivers/usb/host/uhci-platform.c
++++ b/drivers/usb/host/uhci-platform.c
+@@ -113,7 +113,8 @@ static int uhci_hcd_platform_probe(struct platform_device *pdev)
+ num_ports);
+ }
+ if (of_device_is_compatible(np, "aspeed,ast2400-uhci") ||
+- of_device_is_compatible(np, "aspeed,ast2500-uhci")) {
++ of_device_is_compatible(np, "aspeed,ast2500-uhci") ||
++ of_device_is_compatible(np, "aspeed,ast2600-uhci")) {
+ uhci->is_aspeed = 1;
+ dev_info(&pdev->dev,
+ "Enabled Aspeed implementation workarounds\n");
+diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c
+index 76c718ac8c78d..adc2a380be79f 100644
+--- a/drivers/usb/misc/ftdi-elan.c
++++ b/drivers/usb/misc/ftdi-elan.c
+@@ -202,6 +202,7 @@ static void ftdi_elan_delete(struct kref *kref)
+ mutex_unlock(&ftdi_module_lock);
+ kfree(ftdi->bulk_in_buffer);
+ ftdi->bulk_in_buffer = NULL;
++ kfree(ftdi);
+ }
+
+ static void ftdi_elan_put_kref(struct usb_ftdi *ftdi)
+diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c
+index ec234b846eb3c..e5eb19a34ee2a 100644
+--- a/drivers/w1/slaves/w1_ds28e04.c
++++ b/drivers/w1/slaves/w1_ds28e04.c
+@@ -34,7 +34,7 @@ static int w1_strong_pullup = 1;
+ module_param_named(strong_pullup, w1_strong_pullup, int, 0);
+
+ /* enable/disable CRC checking on DS28E04-100 memory accesses */
+-static char w1_enable_crccheck = 1;
++static bool w1_enable_crccheck = true;
+
+ #define W1_EEPROM_SIZE 512
+ #define W1_PAGE_COUNT 16
+@@ -341,32 +341,18 @@ static BIN_ATTR_RW(pio, 1);
+ static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+- if (put_user(w1_enable_crccheck + 0x30, buf))
+- return -EFAULT;
+-
+- return sizeof(w1_enable_crccheck);
++ return sysfs_emit(buf, "%d\n", w1_enable_crccheck);
+ }
+
+ static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
+- char val;
+-
+- if (count != 1 || !buf)
+- return -EINVAL;
++ int err = kstrtobool(buf, &w1_enable_crccheck);
+
+- if (get_user(val, buf))
+- return -EFAULT;
++ if (err)
++ return err;
+
+- /* convert to decimal */
+- val = val - 0x30;
+- if (val != 0 && val != 1)
+- return -EINVAL;
+-
+- /* set the new value */
+- w1_enable_crccheck = val;
+-
+- return sizeof(w1_enable_crccheck);
++ return count;
+ }
+
+ static DEVICE_ATTR_RW(crccheck);
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 6b8824de2abb2..3fe15d6f40873 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -1160,7 +1160,12 @@ again:
+ ret = btrfs_search_slot(trans, fs_info->extent_root, &key, path, 0, 0);
+ if (ret < 0)
+ goto out;
+- BUG_ON(ret == 0);
++ if (ret == 0) {
++ /* This shouldn't happen, indicates a bug or fs corruption. */
++ ASSERT(ret != 0);
++ ret = -EUCLEAN;
++ goto out;
++ }
+
+ #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+ if (trans && likely(trans->type != __TRANS_DUMMY) &&
+@@ -1308,10 +1313,18 @@ again:
+ goto out;
+ if (!ret && extent_item_pos) {
+ /*
+- * we've recorded that parent, so we must extend
+- * its inode list here
++ * We've recorded that parent, so we must extend
++ * its inode list here.
++ *
++ * However if there was corruption we may not
++ * have found an eie, return an error in this
++ * case.
+ */
+- BUG_ON(!eie);
++ ASSERT(eie);
++ if (!eie) {
++ ret = -EUCLEAN;
++ goto out;
++ }
+ while (eie->next)
+ eie = eie->next;
+ eie->next = ref->inode_list;
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index a928ba008d7d7..26a4847efccca 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -3977,6 +3977,14 @@ static int validate_message(struct dlm_lkb *lkb, struct dlm_message *ms)
+ int from = ms->m_header.h_nodeid;
+ int error = 0;
+
++ /* currently mixing of user/kernel locks are not supported */
++ if (ms->m_flags & DLM_IFL_USER && ~lkb->lkb_flags & DLM_IFL_USER) {
++ log_error(lkb->lkb_resource->res_ls,
++ "got user dlm message for a kernel lock");
++ error = -EINVAL;
++ goto out;
++ }
++
+ switch (ms->m_type) {
+ case DLM_MSG_CONVERT:
+ case DLM_MSG_UNLOCK:
+@@ -4005,6 +4013,7 @@ static int validate_message(struct dlm_lkb *lkb, struct dlm_message *ms)
+ error = -EINVAL;
+ }
+
++out:
+ if (error)
+ log_error(lkb->lkb_resource->res_ls,
+ "ignore invalid message %d from %d %x %x %x %d",
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 21c9ebfe83478..484cb68c34d92 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -1052,8 +1052,6 @@ resizefs_out:
+ sizeof(range)))
+ return -EFAULT;
+
+- range.minlen = max((unsigned int)range.minlen,
+- q->limits.discard_granularity);
+ ret = ext4_trim_fs(sb, &range);
+ if (ret < 0)
+ return ret;
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 447aa17c804e2..db8243627b085 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -5260,6 +5260,7 @@ out:
+ */
+ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)
+ {
++ struct request_queue *q = bdev_get_queue(sb->s_bdev);
+ struct ext4_group_info *grp;
+ ext4_group_t group, first_group, last_group;
+ ext4_grpblk_t cnt = 0, first_cluster, last_cluster;
+@@ -5278,6 +5279,13 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)
+ start >= max_blks ||
+ range->len < sb->s_blocksize)
+ return -EINVAL;
++ /* No point to try to trim less than discard granularity */
++ if (range->minlen < q->limits.discard_granularity) {
++ minlen = EXT4_NUM_B2C(EXT4_SB(sb),
++ q->limits.discard_granularity >> sb->s_blocksize_bits);
++ if (minlen > EXT4_CLUSTERS_PER_GROUP(sb))
++ goto out;
++ }
+ if (end >= max_blks)
+ end = max_blks - 1;
+ if (end <= first_data_blk)
+diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
+index bec4ad787c7d8..9adfe217b39d2 100644
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -455,12 +455,12 @@ int ext4_ext_migrate(struct inode *inode)
+ percpu_down_write(&sbi->s_writepages_rwsem);
+
+ /*
+- * Worst case we can touch the allocation bitmaps, a bgd
+- * block, and a block to link in the orphan list. We do need
+- * need to worry about credits for modifying the quota inode.
++ * Worst case we can touch the allocation bitmaps and a block
++ * group descriptor block. We do need need to worry about
++ * credits for modifying the quota inode.
+ */
+ handle = ext4_journal_start(inode, EXT4_HT_MIGRATE,
+- 4 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb));
++ 3 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb));
+
+ if (IS_ERR(handle)) {
+ retval = PTR_ERR(handle);
+@@ -477,6 +477,13 @@ int ext4_ext_migrate(struct inode *inode)
+ ext4_journal_stop(handle);
+ goto out_unlock;
+ }
++ /*
++ * Use the correct seed for checksum (i.e. the seed from 'inode'). This
++ * is so that the metadata blocks will have the correct checksum after
++ * the migration.
++ */
++ ei = EXT4_I(inode);
++ EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed;
+ i_size_write(tmp_inode, i_size_read(inode));
+ /*
+ * Set the i_nlink to zero so it will be deleted later
+@@ -485,7 +492,6 @@ int ext4_ext_migrate(struct inode *inode)
+ clear_nlink(tmp_inode);
+
+ ext4_ext_tree_init(handle, tmp_inode);
+- ext4_orphan_add(handle, tmp_inode);
+ ext4_journal_stop(handle);
+
+ /*
+@@ -510,17 +516,10 @@ int ext4_ext_migrate(struct inode *inode)
+
+ handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
+ if (IS_ERR(handle)) {
+- /*
+- * It is impossible to update on-disk structures without
+- * a handle, so just rollback in-core changes and live other
+- * work to orphan_list_cleanup()
+- */
+- ext4_orphan_del(NULL, tmp_inode);
+ retval = PTR_ERR(handle);
+ goto out_tmp_inode;
+ }
+
+- ei = EXT4_I(inode);
+ i_data = ei->i_data;
+ memset(&lb, 0, sizeof(lb));
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index fab2092856a27..648eb6a24e3a3 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5797,10 +5797,7 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
+
+ lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA);
+ err = dquot_quota_on(sb, type, format_id, path);
+- if (err) {
+- lockdep_set_quota_inode(path->dentry->d_inode,
+- I_DATA_SEM_NORMAL);
+- } else {
++ if (!err) {
+ struct inode *inode = d_inode(path->dentry);
+ handle_t *handle;
+
+@@ -5820,7 +5817,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
+ ext4_journal_stop(handle);
+ unlock_inode:
+ inode_unlock(inode);
++ if (err)
++ dquot_quota_off(sb, type);
+ }
++ if (err)
++ lockdep_set_quota_inode(path->dentry->d_inode,
++ I_DATA_SEM_NORMAL);
+ return err;
+ }
+
+@@ -5883,8 +5885,19 @@ static int ext4_enable_quotas(struct super_block *sb)
+ "Failed to enable quota tracking "
+ "(type=%d, err=%d). Please run "
+ "e2fsck to fix.", type, err);
+- for (type--; type >= 0; type--)
++ for (type--; type >= 0; type--) {
++ struct inode *inode;
++
++ inode = sb_dqopt(sb)->files[type];
++ if (inode)
++ inode = igrab(inode);
+ dquot_quota_off(sb, type);
++ if (inode) {
++ lockdep_set_quota_inode(inode,
++ I_DATA_SEM_NORMAL);
++ iput(inode);
++ }
++ }
+
+ return err;
+ }
+@@ -5986,7 +5999,7 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type,
+ struct buffer_head *bh;
+ handle_t *handle = journal_current_handle();
+
+- if (EXT4_SB(sb)->s_journal && !handle) {
++ if (!handle) {
+ ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)"
+ " cancelled because transaction is not started",
+ (unsigned long long)off, (unsigned long long)len);
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 38299ccfdf6ef..bd377ff0b403f 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -589,6 +589,9 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ }
+
++ if (f2fs_check_nid_range(sbi, dni->ino))
++ return false;
++
+ *nofs = ofs_of_node(node_page);
+ source_blkaddr = datablock_addr(NULL, node_page, ofs_in_node);
+ f2fs_put_page(node_page, 1);
+diff --git a/fs/fuse/acl.c b/fs/fuse/acl.c
+index 5a48cee6d7d33..f529075a2ce87 100644
+--- a/fs/fuse/acl.c
++++ b/fs/fuse/acl.c
+@@ -19,6 +19,9 @@ struct posix_acl *fuse_get_acl(struct inode *inode, int type)
+ void *value = NULL;
+ struct posix_acl *acl;
+
++ if (fuse_is_bad(inode))
++ return ERR_PTR(-EIO);
++
+ if (!fc->posix_acl || fc->no_getxattr)
+ return NULL;
+
+@@ -53,6 +56,9 @@ int fuse_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+ const char *name;
+ int ret;
+
++ if (fuse_is_bad(inode))
++ return -EIO;
++
+ if (!fc->posix_acl || fc->no_setxattr)
+ return -EOPNOTSUPP;
+
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index f01ecc197a45b..6098e0c7f87b3 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -187,7 +187,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
+ int ret;
+
+ inode = d_inode_rcu(entry);
+- if (inode && is_bad_inode(inode))
++ if (inode && fuse_is_bad(inode))
+ goto invalid;
+ else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) ||
+ (flags & LOOKUP_REVAL)) {
+@@ -364,6 +364,9 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
+ bool outarg_valid = true;
+ bool locked;
+
++ if (fuse_is_bad(dir))
++ return ERR_PTR(-EIO);
++
+ locked = fuse_lock_inode(dir);
+ err = fuse_lookup_name(dir->i_sb, get_node_id(dir), &entry->d_name,
+ &outarg, &inode);
+@@ -504,6 +507,9 @@ static int fuse_atomic_open(struct inode *dir, struct dentry *entry,
+ struct fuse_conn *fc = get_fuse_conn(dir);
+ struct dentry *res = NULL;
+
++ if (fuse_is_bad(dir))
++ return -EIO;
++
+ if (d_in_lookup(entry)) {
+ res = fuse_lookup(dir, entry, 0);
+ if (IS_ERR(res))
+@@ -552,6 +558,9 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_args *args,
+ int err;
+ struct fuse_forget_link *forget;
+
++ if (fuse_is_bad(dir))
++ return -EIO;
++
+ forget = fuse_alloc_forget();
+ if (!forget)
+ return -ENOMEM;
+@@ -679,6 +688,9 @@ static int fuse_unlink(struct inode *dir, struct dentry *entry)
+ struct fuse_conn *fc = get_fuse_conn(dir);
+ FUSE_ARGS(args);
+
++ if (fuse_is_bad(dir))
++ return -EIO;
++
+ args.in.h.opcode = FUSE_UNLINK;
+ args.in.h.nodeid = get_node_id(dir);
+ args.in.numargs = 1;
+@@ -715,6 +727,9 @@ static int fuse_rmdir(struct inode *dir, struct dentry *entry)
+ struct fuse_conn *fc = get_fuse_conn(dir);
+ FUSE_ARGS(args);
+
++ if (fuse_is_bad(dir))
++ return -EIO;
++
+ args.in.h.opcode = FUSE_RMDIR;
+ args.in.h.nodeid = get_node_id(dir);
+ args.in.numargs = 1;
+@@ -793,6 +808,9 @@ static int fuse_rename2(struct inode *olddir, struct dentry *oldent,
+ struct fuse_conn *fc = get_fuse_conn(olddir);
+ int err;
+
++ if (fuse_is_bad(olddir))
++ return -EIO;
++
+ if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE))
+ return -EINVAL;
+
+@@ -928,7 +946,7 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat,
+ if (!err) {
+ if (fuse_invalid_attr(&outarg.attr) ||
+ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
+- make_bad_inode(inode);
++ fuse_make_bad(inode);
+ err = -EIO;
+ } else {
+ fuse_change_attributes(inode, &outarg.attr,
+@@ -1125,6 +1143,9 @@ static int fuse_permission(struct inode *inode, int mask)
+ bool refreshed = false;
+ int err = 0;
+
++ if (fuse_is_bad(inode))
++ return -EIO;
++
+ if (!fuse_allow_current_process(fc))
+ return -EACCES;
+
+@@ -1262,7 +1283,7 @@ retry:
+ dput(dentry);
+ goto retry;
+ }
+- if (is_bad_inode(inode)) {
++ if (fuse_is_bad(inode)) {
+ dput(dentry);
+ return -EIO;
+ }
+@@ -1360,7 +1381,7 @@ static int fuse_readdir(struct file *file, struct dir_context *ctx)
+ u64 attr_version = 0;
+ bool locked;
+
+- if (is_bad_inode(inode))
++ if (fuse_is_bad(inode))
+ return -EIO;
+
+ req = fuse_get_req(fc, 1);
+@@ -1420,6 +1441,9 @@ static const char *fuse_get_link(struct dentry *dentry,
+ if (!dentry)
+ return ERR_PTR(-ECHILD);
+
++ if (fuse_is_bad(inode))
++ return ERR_PTR(-EIO);
++
+ link = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ if (!link)
+ return ERR_PTR(-ENOMEM);
+@@ -1718,7 +1742,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,
+
+ if (fuse_invalid_attr(&outarg.attr) ||
+ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
+- make_bad_inode(inode);
++ fuse_make_bad(inode);
+ err = -EIO;
+ goto error;
+ }
+@@ -1774,6 +1798,9 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
+ struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL;
+ int ret;
+
++ if (fuse_is_bad(inode))
++ return -EIO;
++
+ if (!fuse_allow_current_process(get_fuse_conn(inode)))
+ return -EACCES;
+
+@@ -1832,6 +1859,9 @@ static int fuse_getattr(const struct path *path, struct kstat *stat,
+ struct inode *inode = d_inode(path->dentry);
+ struct fuse_conn *fc = get_fuse_conn(inode);
+
++ if (fuse_is_bad(inode))
++ return -EIO;
++
+ if (!fuse_allow_current_process(fc))
+ return -EACCES;
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 13371a40f7a15..ed9b3ebc0cca4 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -210,6 +210,9 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
+ fc->atomic_o_trunc &&
+ fc->writeback_cache;
+
++ if (fuse_is_bad(inode))
++ return -EIO;
++
+ err = generic_file_open(inode, file);
+ if (err)
+ return err;
+@@ -411,7 +414,7 @@ static int fuse_flush(struct file *file, fl_owner_t id)
+ struct fuse_flush_in inarg;
+ int err;
+
+- if (is_bad_inode(inode))
++ if (fuse_is_bad(inode))
+ return -EIO;
+
+ if (fc->no_flush)
+@@ -459,7 +462,7 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
+ struct fuse_fsync_in inarg;
+ int err;
+
+- if (is_bad_inode(inode))
++ if (fuse_is_bad(inode))
+ return -EIO;
+
+ inode_lock(inode);
+@@ -774,7 +777,7 @@ static int fuse_readpage(struct file *file, struct page *page)
+ int err;
+
+ err = -EIO;
+- if (is_bad_inode(inode))
++ if (fuse_is_bad(inode))
+ goto out;
+
+ err = fuse_do_readpage(file, page);
+@@ -901,7 +904,7 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
+ int nr_alloc = min_t(unsigned, nr_pages, FUSE_MAX_PAGES_PER_REQ);
+
+ err = -EIO;
+- if (is_bad_inode(inode))
++ if (fuse_is_bad(inode))
+ goto out;
+
+ data.file = file;
+@@ -931,6 +934,9 @@ static ssize_t fuse_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ struct inode *inode = iocb->ki_filp->f_mapping->host;
+ struct fuse_conn *fc = get_fuse_conn(inode);
+
++ if (fuse_is_bad(inode))
++ return -EIO;
++
+ /*
+ * In auto invalidate mode, always update attributes on read.
+ * Otherwise, only update if we attempt to read past EOF (to ensure
+@@ -1131,7 +1137,7 @@ static ssize_t fuse_perform_write(struct kiocb *iocb,
+ int err = 0;
+ ssize_t res = 0;
+
+- if (is_bad_inode(inode))
++ if (fuse_is_bad(inode))
+ return -EIO;
+
+ if (inode->i_size < pos + iov_iter_count(ii))
+@@ -1188,6 +1194,9 @@ static ssize_t fuse_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ ssize_t err;
+ loff_t endbyte = 0;
+
++ if (fuse_is_bad(inode))
++ return -EIO;
++
+ if (get_fuse_conn(inode)->writeback_cache) {
+ /* Update size (EOF optimization) and mode (SUID clearing) */
+ err = fuse_update_attributes(mapping->host, file);
+@@ -1424,7 +1433,7 @@ static ssize_t __fuse_direct_read(struct fuse_io_priv *io,
+ ssize_t res;
+ struct inode *inode = file_inode(io->iocb->ki_filp);
+
+- if (is_bad_inode(inode))
++ if (fuse_is_bad(inode))
+ return -EIO;
+
+ res = fuse_direct_io(io, iter, ppos, 0);
+@@ -1446,7 +1455,7 @@ static ssize_t fuse_direct_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(iocb);
+ ssize_t res;
+
+- if (is_bad_inode(inode))
++ if (fuse_is_bad(inode))
+ return -EIO;
+
+ /* Don't allow parallel writes to the same file */
+@@ -1920,7 +1929,7 @@ static int fuse_writepages(struct address_space *mapping,
+ int err;
+
+ err = -EIO;
+- if (is_bad_inode(inode))
++ if (fuse_is_bad(inode))
+ goto out;
+
+ data.inode = inode;
+@@ -2705,7 +2714,7 @@ long fuse_ioctl_common(struct file *file, unsigned int cmd,
+ if (!fuse_allow_current_process(fc))
+ return -EACCES;
+
+- if (is_bad_inode(inode))
++ if (fuse_is_bad(inode))
+ return -EIO;
+
+ return fuse_do_ioctl(file, cmd, arg, flags);
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index dbfc35efbefb6..853d37ec81e0c 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -118,6 +118,8 @@ enum {
+ FUSE_I_INIT_RDPLUS,
+ /** An operation changing file size is in progress */
+ FUSE_I_SIZE_UNSTABLE,
++ /* Bad inode */
++ FUSE_I_BAD,
+ };
+
+ struct fuse_conn;
+@@ -700,6 +702,17 @@ static inline u64 get_node_id(struct inode *inode)
+ return get_fuse_inode(inode)->nodeid;
+ }
+
++static inline void fuse_make_bad(struct inode *inode)
++{
++ remove_inode_hash(inode);
++ set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state);
++}
++
++static inline bool fuse_is_bad(struct inode *inode)
++{
++ return unlikely(test_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state));
++}
++
+ /** Device operations */
+ extern const struct file_operations fuse_dev_operations;
+
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index cb018315ecaf5..821597c618843 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -317,7 +317,7 @@ struct inode *fuse_iget(struct super_block *sb, u64 nodeid,
+ unlock_new_inode(inode);
+ } else if ((inode->i_mode ^ attr->mode) & S_IFMT) {
+ /* Inode has changed type, any I/O on the old should fail */
+- make_bad_inode(inode);
++ fuse_make_bad(inode);
+ iput(inode);
+ goto retry;
+ }
+diff --git a/fs/fuse/xattr.c b/fs/fuse/xattr.c
+index 433717640f78d..a4b65374bced4 100644
+--- a/fs/fuse/xattr.c
++++ b/fs/fuse/xattr.c
+@@ -113,6 +113,9 @@ ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size)
+ struct fuse_getxattr_out outarg;
+ ssize_t ret;
+
++ if (fuse_is_bad(inode))
++ return -EIO;
++
+ if (!fuse_allow_current_process(fc))
+ return -EACCES;
+
+@@ -178,6 +181,9 @@ static int fuse_xattr_get(const struct xattr_handler *handler,
+ struct dentry *dentry, struct inode *inode,
+ const char *name, void *value, size_t size)
+ {
++ if (fuse_is_bad(inode))
++ return -EIO;
++
+ return fuse_getxattr(inode, name, value, size);
+ }
+
+@@ -186,6 +192,9 @@ static int fuse_xattr_set(const struct xattr_handler *handler,
+ const char *name, const void *value, size_t size,
+ int flags)
+ {
++ if (fuse_is_bad(inode))
++ return -EIO;
++
+ if (!value)
+ return fuse_removexattr(inode, name);
+
+diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
+index 7d8654a1472ef..3047872fdac9b 100644
+--- a/fs/jffs2/file.c
++++ b/fs/jffs2/file.c
+@@ -135,20 +135,15 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ struct page *pg;
+ struct inode *inode = mapping->host;
+ struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
++ struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
+ pgoff_t index = pos >> PAGE_SHIFT;
+ uint32_t pageofs = index << PAGE_SHIFT;
+ int ret = 0;
+
+- pg = grab_cache_page_write_begin(mapping, index, flags);
+- if (!pg)
+- return -ENOMEM;
+- *pagep = pg;
+-
+ jffs2_dbg(1, "%s()\n", __func__);
+
+ if (pageofs > inode->i_size) {
+ /* Make new hole frag from old EOF to new page */
+- struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
+ struct jffs2_raw_inode ri;
+ struct jffs2_full_dnode *fn;
+ uint32_t alloc_len;
+@@ -159,7 +154,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len,
+ ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
+ if (ret)
+- goto out_page;
++ goto out_err;
+
+ mutex_lock(&f->sem);
+ memset(&ri, 0, sizeof(ri));
+@@ -189,7 +184,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ ret = PTR_ERR(fn);
+ jffs2_complete_reservation(c);
+ mutex_unlock(&f->sem);
+- goto out_page;
++ goto out_err;
+ }
+ ret = jffs2_add_full_dnode_to_inode(c, f, fn);
+ if (f->metadata) {
+@@ -204,13 +199,26 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ jffs2_free_full_dnode(fn);
+ jffs2_complete_reservation(c);
+ mutex_unlock(&f->sem);
+- goto out_page;
++ goto out_err;
+ }
+ jffs2_complete_reservation(c);
+ inode->i_size = pageofs;
+ mutex_unlock(&f->sem);
+ }
+
++ /*
++ * While getting a page and reading data in, lock c->alloc_sem until
++ * the page is Uptodate. Otherwise GC task may attempt to read the same
++ * page in read_cache_page(), which causes a deadlock.
++ */
++ mutex_lock(&c->alloc_sem);
++ pg = grab_cache_page_write_begin(mapping, index, flags);
++ if (!pg) {
++ ret = -ENOMEM;
++ goto release_sem;
++ }
++ *pagep = pg;
++
+ /*
+ * Read in the page if it wasn't already present. Cannot optimize away
+ * the whole page write case until jffs2_write_end can handle the
+@@ -220,15 +228,17 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ mutex_lock(&f->sem);
+ ret = jffs2_do_readpage_nolock(inode, pg);
+ mutex_unlock(&f->sem);
+- if (ret)
+- goto out_page;
++ if (ret) {
++ unlock_page(pg);
++ put_page(pg);
++ goto release_sem;
++ }
+ }
+ jffs2_dbg(1, "end write_begin(). pg->flags %lx\n", pg->flags);
+- return ret;
+
+-out_page:
+- unlock_page(pg);
+- put_page(pg);
++release_sem:
++ mutex_unlock(&c->alloc_sem);
++out_err:
+ return ret;
+ }
+
+diff --git a/fs/orangefs/orangefs-bufmap.c b/fs/orangefs/orangefs-bufmap.c
+index c4e98c9c16217..6d20b1b3a5815 100644
+--- a/fs/orangefs/orangefs-bufmap.c
++++ b/fs/orangefs/orangefs-bufmap.c
+@@ -179,7 +179,7 @@ orangefs_bufmap_free(struct orangefs_bufmap *bufmap)
+ {
+ kfree(bufmap->page_array);
+ kfree(bufmap->desc_array);
+- kfree(bufmap->buffer_index_array);
++ bitmap_free(bufmap->buffer_index_array);
+ kfree(bufmap);
+ }
+
+@@ -229,8 +229,7 @@ orangefs_bufmap_alloc(struct ORANGEFS_dev_map_desc *user_desc)
+ bufmap->desc_size = user_desc->size;
+ bufmap->desc_shift = ilog2(bufmap->desc_size);
+
+- bufmap->buffer_index_array =
+- kzalloc(DIV_ROUND_UP(bufmap->desc_count, BITS_PER_LONG), GFP_KERNEL);
++ bufmap->buffer_index_array = bitmap_zalloc(bufmap->desc_count, GFP_KERNEL);
+ if (!bufmap->buffer_index_array)
+ goto out_free_bufmap;
+
+@@ -253,7 +252,7 @@ orangefs_bufmap_alloc(struct ORANGEFS_dev_map_desc *user_desc)
+ out_free_desc_array:
+ kfree(bufmap->desc_array);
+ out_free_index_array:
+- kfree(bufmap->buffer_index_array);
++ bitmap_free(bufmap->buffer_index_array);
+ out_free_bufmap:
+ kfree(bufmap);
+ out:
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index fec62e9dfbe6a..f5b663d70826c 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1730,7 +1730,6 @@ out:
+ kthread_stop(c->bgt);
+ c->bgt = NULL;
+ }
+- free_wbufs(c);
+ kfree(c->write_reserve_buf);
+ c->write_reserve_buf = NULL;
+ vfree(c->ileb_buf);
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index 2939a6cd7fecb..9fc1dfc7f4c32 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -532,8 +532,14 @@ typedef u64 acpi_integer;
+ * Can be used with access_width of struct acpi_generic_address and access_size of
+ * struct acpi_resource_generic_register.
+ */
+-#define ACPI_ACCESS_BIT_WIDTH(size) (1 << ((size) + 2))
+-#define ACPI_ACCESS_BYTE_WIDTH(size) (1 << ((size) - 1))
++#define ACPI_ACCESS_BIT_SHIFT 2
++#define ACPI_ACCESS_BYTE_SHIFT -1
++#define ACPI_ACCESS_BIT_MAX (31 - ACPI_ACCESS_BIT_SHIFT)
++#define ACPI_ACCESS_BYTE_MAX (31 - ACPI_ACCESS_BYTE_SHIFT)
++#define ACPI_ACCESS_BIT_DEFAULT (8 - ACPI_ACCESS_BIT_SHIFT)
++#define ACPI_ACCESS_BYTE_DEFAULT (8 - ACPI_ACCESS_BYTE_SHIFT)
++#define ACPI_ACCESS_BIT_WIDTH(size) (1 << ((size) + ACPI_ACCESS_BIT_SHIFT))
++#define ACPI_ACCESS_BYTE_WIDTH(size) (1 << ((size) + ACPI_ACCESS_BYTE_SHIFT))
+
+ /*******************************************************************************
+ *
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index da824ba9fb9a2..c51ebce2197e0 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -353,6 +353,8 @@ struct hid_item {
+ /* BIT(9) reserved for backward compatibility, was NO_INIT_INPUT_REPORTS */
+ #define HID_QUIRK_ALWAYS_POLL BIT(10)
+ #define HID_QUIRK_INPUT_PER_APP BIT(11)
++#define HID_QUIRK_X_INVERT BIT(12)
++#define HID_QUIRK_Y_INVERT BIT(13)
+ #define HID_QUIRK_SKIP_OUTPUT_REPORTS BIT(16)
+ #define HID_QUIRK_SKIP_OUTPUT_REPORT_ID BIT(17)
+ #define HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP BIT(18)
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index c0147888b1555..483303adf3df8 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -1077,6 +1077,7 @@ struct psched_ratecfg {
+ u64 rate_bytes_ps; /* bytes per second */
+ u32 mult;
+ u16 overhead;
++ u16 mpu;
+ u8 linklayer;
+ u8 shift;
+ };
+@@ -1086,6 +1087,9 @@ static inline u64 psched_l2t_ns(const struct psched_ratecfg *r,
+ {
+ len += r->overhead;
+
++ if (len < r->mpu)
++ len = r->mpu;
++
+ if (unlikely(r->linklayer == TC_LINKLAYER_ATM))
+ return ((u64)(DIV_ROUND_UP(len,48)*53) * r->mult) >> r->shift;
+
+@@ -1108,6 +1112,7 @@ static inline void psched_ratecfg_getrate(struct tc_ratespec *res,
+ res->rate = min_t(u64, r->rate_bytes_ps, ~0U);
+
+ res->overhead = r->overhead;
++ res->mpu = r->mpu;
+ res->linklayer = (r->linklayer & TC_LINKLAYER_MASK);
+ }
+
+diff --git a/include/sound/soc.h b/include/sound/soc.h
+index 88aa48e5485f9..7abd8d4746ef2 100644
+--- a/include/sound/soc.h
++++ b/include/sound/soc.h
+@@ -1113,6 +1113,8 @@ struct snd_soc_card {
+ u32 pop_time;
+
+ void *drvdata;
++
++ spinlock_t dpcm_lock;
+ };
+
+ /* SoC machine DAI configuration, glues a codec and cpu DAI together */
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 968921d376b98..c5e034fe14bbb 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -1528,6 +1528,20 @@ static void audit_receive(struct sk_buff *skb)
+ nlh = nlmsg_next(nlh, &len);
+ }
+ audit_ctl_unlock();
++
++ /* can't block with the ctrl lock, so penalize the sender now */
++ if (audit_backlog_limit &&
++ (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
++ DECLARE_WAITQUEUE(wait, current);
++
++ /* wake kauditd to try and flush the queue */
++ wake_up_interruptible(&kauditd_wait);
++
++ add_wait_queue_exclusive(&audit_backlog_wait, &wait);
++ set_current_state(TASK_UNINTERRUPTIBLE);
++ schedule_timeout(audit_backlog_wait_time);
++ remove_wait_queue(&audit_backlog_wait, &wait);
++ }
+ }
+
+ /* Run custom bind function on netlink socket group connect or bind requests. */
+@@ -1772,7 +1786,9 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
+ * task_tgid_vnr() since auditd_pid is set in audit_receive_msg()
+ * using a PID anchored in the caller's namespace
+ * 2. generator holding the audit_cmd_mutex - we don't want to block
+- * while holding the mutex */
++ * while holding the mutex, although we do penalize the sender
++ * later in audit_receive() when it is safe to block
++ */
+ if (!(auditd_test_task(current) || audit_ctl_owner_current())) {
+ long stime = audit_backlog_wait_time;
+
+diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
+index 54eb9457b21d3..532682125ef68 100644
+--- a/kernel/sched/cputime.c
++++ b/kernel/sched/cputime.c
+@@ -146,10 +146,10 @@ void account_guest_time(struct task_struct *p, u64 cputime)
+
+ /* Add guest time to cpustat. */
+ if (task_nice(p) > 0) {
+- cpustat[CPUTIME_NICE] += cputime;
++ task_group_account_field(p, CPUTIME_NICE, cputime);
+ cpustat[CPUTIME_GUEST_NICE] += cputime;
+ } else {
+- cpustat[CPUTIME_USER] += cputime;
++ task_group_account_field(p, CPUTIME_USER, cputime);
+ cpustat[CPUTIME_GUEST] += cputime;
+ }
+ }
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index b980cc96604fa..70e8cd3954745 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -50,11 +50,8 @@ void init_rt_bandwidth(struct rt_bandwidth *rt_b, u64 period, u64 runtime)
+ rt_b->rt_period_timer.function = sched_rt_period_timer;
+ }
+
+-static void start_rt_bandwidth(struct rt_bandwidth *rt_b)
++static inline void do_start_rt_bandwidth(struct rt_bandwidth *rt_b)
+ {
+- if (!rt_bandwidth_enabled() || rt_b->rt_runtime == RUNTIME_INF)
+- return;
+-
+ raw_spin_lock(&rt_b->rt_runtime_lock);
+ if (!rt_b->rt_period_active) {
+ rt_b->rt_period_active = 1;
+@@ -72,6 +69,14 @@ static void start_rt_bandwidth(struct rt_bandwidth *rt_b)
+ raw_spin_unlock(&rt_b->rt_runtime_lock);
+ }
+
++static void start_rt_bandwidth(struct rt_bandwidth *rt_b)
++{
++ if (!rt_bandwidth_enabled() || rt_b->rt_runtime == RUNTIME_INF)
++ return;
++
++ do_start_rt_bandwidth(rt_b);
++}
++
+ void init_rt_rq(struct rt_rq *rt_rq)
+ {
+ struct rt_prio_array *array;
+@@ -980,13 +985,17 @@ static void update_curr_rt(struct rq *rq)
+
+ for_each_sched_rt_entity(rt_se) {
+ struct rt_rq *rt_rq = rt_rq_of_se(rt_se);
++ int exceeded;
+
+ if (sched_rt_runtime(rt_rq) != RUNTIME_INF) {
+ raw_spin_lock(&rt_rq->rt_runtime_lock);
+ rt_rq->rt_time += delta_exec;
+- if (sched_rt_runtime_exceeded(rt_rq))
++ exceeded = sched_rt_runtime_exceeded(rt_rq);
++ if (exceeded)
+ resched_curr(rq);
+ raw_spin_unlock(&rt_rq->rt_runtime_lock);
++ if (exceeded)
++ do_start_rt_bandwidth(sched_rt_bandwidth(rt_rq));
+ }
+ }
+ }
+@@ -2655,8 +2664,12 @@ static int sched_rt_global_validate(void)
+
+ static void sched_rt_do_global(void)
+ {
++ unsigned long flags;
++
++ raw_spin_lock_irqsave(&def_rt_bandwidth.rt_runtime_lock, flags);
+ def_rt_bandwidth.rt_runtime = global_rt_runtime();
+ def_rt_bandwidth.rt_period = ns_to_ktime(global_rt_period());
++ raw_spin_unlock_irqrestore(&def_rt_bandwidth.rt_runtime_lock, flags);
+ }
+
+ int sched_rt_handler(struct ctl_table *table, int write,
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 9fd0e72757cfa..0788616696dc4 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -451,7 +451,7 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo,
+ struct shmem_inode_info *info;
+ struct page *page;
+ unsigned long batch = sc ? sc->nr_to_scan : 128;
+- int removed = 0, split = 0;
++ int split = 0;
+
+ if (list_empty(&sbinfo->shrinklist))
+ return SHRINK_STOP;
+@@ -466,7 +466,6 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo,
+ /* inode is about to be evicted */
+ if (!inode) {
+ list_del_init(&info->shrinklist);
+- removed++;
+ goto next;
+ }
+
+@@ -474,12 +473,12 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo,
+ if (round_up(inode->i_size, PAGE_SIZE) ==
+ round_up(inode->i_size, HPAGE_PMD_SIZE)) {
+ list_move(&info->shrinklist, &to_remove);
+- removed++;
+ goto next;
+ }
+
+ list_move(&info->shrinklist, &list);
+ next:
++ sbinfo->shrinklist_len--;
+ if (!--batch)
+ break;
+ }
+@@ -499,7 +498,7 @@ next:
+ inode = &info->vfs_inode;
+
+ if (nr_to_split && split >= nr_to_split)
+- goto leave;
++ goto move_back;
+
+ page = find_get_page(inode->i_mapping,
+ (inode->i_size & HPAGE_PMD_MASK) >> PAGE_SHIFT);
+@@ -513,38 +512,44 @@ next:
+ }
+
+ /*
+- * Leave the inode on the list if we failed to lock
+- * the page at this time.
++ * Move the inode on the list back to shrinklist if we failed
++ * to lock the page at this time.
+ *
+ * Waiting for the lock may lead to deadlock in the
+ * reclaim path.
+ */
+ if (!trylock_page(page)) {
+ put_page(page);
+- goto leave;
++ goto move_back;
+ }
+
+ ret = split_huge_page(page);
+ unlock_page(page);
+ put_page(page);
+
+- /* If split failed leave the inode on the list */
++ /* If split failed move the inode on the list back to shrinklist */
+ if (ret)
+- goto leave;
++ goto move_back;
+
+ split++;
+ drop:
+ list_del_init(&info->shrinklist);
+- removed++;
+-leave:
++ goto put;
++move_back:
++ /*
++ * Make sure the inode is either on the global list or deleted
++ * from any local list before iput() since it could be deleted
++ * in another thread once we put the inode (then the local list
++ * is corrupted).
++ */
++ spin_lock(&sbinfo->shrinklist_lock);
++ list_move(&info->shrinklist, &sbinfo->shrinklist);
++ sbinfo->shrinklist_len++;
++ spin_unlock(&sbinfo->shrinklist_lock);
++put:
+ iput(inode);
+ }
+
+- spin_lock(&sbinfo->shrinklist_lock);
+- list_splice_tail(&list, &sbinfo->shrinklist);
+- sbinfo->shrinklist_len -= removed;
+- spin_unlock(&sbinfo->shrinklist_lock);
+-
+ return split;
+ }
+
+diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
+index 9873684a9d8ff..4764ed73f33bf 100644
+--- a/net/bluetooth/cmtp/core.c
++++ b/net/bluetooth/cmtp/core.c
+@@ -499,9 +499,7 @@ static int __init cmtp_init(void)
+ {
+ BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION);
+
+- cmtp_init_sockets();
+-
+- return 0;
++ return cmtp_init_sockets();
+ }
+
+ static void __exit cmtp_exit(void)
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 26acacb2fa95f..a5755e0645439 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3263,6 +3263,7 @@ int hci_register_dev(struct hci_dev *hdev)
+ return id;
+
+ err_wqueue:
++ debugfs_remove_recursive(hdev->debugfs);
+ destroy_workqueue(hdev->workqueue);
+ destroy_workqueue(hdev->req_workqueue);
+ err:
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 937cada5595ee..c0dbb8ad00376 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -5391,7 +5391,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ struct hci_ev_le_advertising_info *ev = ptr;
+ s8 rssi;
+
+- if (ev->length <= HCI_MAX_AD_LENGTH) {
++ if (ev->length <= HCI_MAX_AD_LENGTH &&
++ ev->data + ev->length <= skb_tail_pointer(skb)) {
+ rssi = ev->data[ev->length];
+ process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
+ ev->bdaddr_type, NULL, 0, rssi,
+@@ -5401,6 +5402,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ }
+
+ ptr += sizeof(*ev) + ev->length + 1;
++
++ if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) {
++ bt_dev_err(hdev, "Malicious advertising data. Stopping processing");
++ break;
++ }
+ }
+
+ hci_dev_unlock(hdev);
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index c5380c6baf2e7..4b9d1d6bbf6f9 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -727,6 +727,9 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
+ if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
+ mtu = nf_bridge->frag_max_size;
+
++ nf_bridge_update_protocol(skb);
++ nf_bridge_push_encap_header(skb);
++
+ if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
+ nf_bridge_info_free(skb);
+ return br_dev_queue_push_xmit(net, sk, skb);
+@@ -744,8 +747,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
+
+ IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
+
+- nf_bridge_update_protocol(skb);
+-
+ data = this_cpu_ptr(&brnf_frag_data_storage);
+
+ data->vlan_tci = skb->vlan_tci;
+@@ -768,8 +769,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
+
+ IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
+
+- nf_bridge_update_protocol(skb);
+-
+ data = this_cpu_ptr(&brnf_frag_data_storage);
+ data->encap_size = nf_bridge_encap_header_len(skb);
+ data->size = ETH_HLEN + data->encap_size;
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index e75d3fd7da4f9..353098166031b 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -105,7 +105,6 @@ struct bcm_op {
+ unsigned long frames_abs, frames_filtered;
+ struct bcm_timeval ival1, ival2;
+ struct hrtimer timer, thrtimer;
+- struct tasklet_struct tsklet, thrtsklet;
+ ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;
+ int rx_ifindex;
+ int cfsiz;
+@@ -374,25 +373,34 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
+ }
+ }
+
+-static void bcm_tx_start_timer(struct bcm_op *op)
++static bool bcm_tx_set_expiry(struct bcm_op *op, struct hrtimer *hrt)
+ {
++ ktime_t ival;
++
+ if (op->kt_ival1 && op->count)
+- hrtimer_start(&op->timer,
+- ktime_add(ktime_get(), op->kt_ival1),
+- HRTIMER_MODE_ABS);
++ ival = op->kt_ival1;
+ else if (op->kt_ival2)
+- hrtimer_start(&op->timer,
+- ktime_add(ktime_get(), op->kt_ival2),
+- HRTIMER_MODE_ABS);
++ ival = op->kt_ival2;
++ else
++ return false;
++
++ hrtimer_set_expires(hrt, ktime_add(ktime_get(), ival));
++ return true;
+ }
+
+-static void bcm_tx_timeout_tsklet(unsigned long data)
++static void bcm_tx_start_timer(struct bcm_op *op)
+ {
+- struct bcm_op *op = (struct bcm_op *)data;
++ if (bcm_tx_set_expiry(op, &op->timer))
++ hrtimer_start_expires(&op->timer, HRTIMER_MODE_ABS_SOFT);
++}
++
++/* bcm_tx_timeout_handler - performs cyclic CAN frame transmissions */
++static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
++{
++ struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
+ struct bcm_msg_head msg_head;
+
+ if (op->kt_ival1 && (op->count > 0)) {
+-
+ op->count--;
+ if (!op->count && (op->flags & TX_COUNTEVT)) {
+
+@@ -410,22 +418,12 @@ static void bcm_tx_timeout_tsklet(unsigned long data)
+ }
+ bcm_can_tx(op);
+
+- } else if (op->kt_ival2)
++ } else if (op->kt_ival2) {
+ bcm_can_tx(op);
++ }
+
+- bcm_tx_start_timer(op);
+-}
+-
+-/*
+- * bcm_tx_timeout_handler - performs cyclic CAN frame transmissions
+- */
+-static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
+-{
+- struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
+-
+- tasklet_schedule(&op->tsklet);
+-
+- return HRTIMER_NORESTART;
++ return bcm_tx_set_expiry(op, &op->timer) ?
++ HRTIMER_RESTART : HRTIMER_NORESTART;
+ }
+
+ /*
+@@ -492,7 +490,7 @@ static void bcm_rx_update_and_send(struct bcm_op *op,
+ /* do not send the saved data - only start throttle timer */
+ hrtimer_start(&op->thrtimer,
+ ktime_add(op->kt_lastmsg, op->kt_ival2),
+- HRTIMER_MODE_ABS);
++ HRTIMER_MODE_ABS_SOFT);
+ return;
+ }
+
+@@ -551,14 +549,21 @@ static void bcm_rx_starttimer(struct bcm_op *op)
+ return;
+
+ if (op->kt_ival1)
+- hrtimer_start(&op->timer, op->kt_ival1, HRTIMER_MODE_REL);
++ hrtimer_start(&op->timer, op->kt_ival1, HRTIMER_MODE_REL_SOFT);
+ }
+
+-static void bcm_rx_timeout_tsklet(unsigned long data)
++/* bcm_rx_timeout_handler - when the (cyclic) CAN frame reception timed out */
++static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
+ {
+- struct bcm_op *op = (struct bcm_op *)data;
++ struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
+ struct bcm_msg_head msg_head;
+
++ /* if user wants to be informed, when cyclic CAN-Messages come back */
++ if ((op->flags & RX_ANNOUNCE_RESUME) && op->last_frames) {
++ /* clear received CAN frames to indicate 'nothing received' */
++ memset(op->last_frames, 0, op->nframes * op->cfsiz);
++ }
++
+ /* create notification to user */
+ memset(&msg_head, 0, sizeof(msg_head));
+ msg_head.opcode = RX_TIMEOUT;
+@@ -570,25 +575,6 @@ static void bcm_rx_timeout_tsklet(unsigned long data)
+ msg_head.nframes = 0;
+
+ bcm_send_to_user(op, &msg_head, NULL, 0);
+-}
+-
+-/*
+- * bcm_rx_timeout_handler - when the (cyclic) CAN frame reception timed out
+- */
+-static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
+-{
+- struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
+-
+- /* schedule before NET_RX_SOFTIRQ */
+- tasklet_hi_schedule(&op->tsklet);
+-
+- /* no restart of the timer is done here! */
+-
+- /* if user wants to be informed, when cyclic CAN-Messages come back */
+- if ((op->flags & RX_ANNOUNCE_RESUME) && op->last_frames) {
+- /* clear received CAN frames to indicate 'nothing received' */
+- memset(op->last_frames, 0, op->nframes * op->cfsiz);
+- }
+
+ return HRTIMER_NORESTART;
+ }
+@@ -596,14 +582,12 @@ static enum hrtimer_restart bcm_rx_timeout_handler(struct hrtimer *hrtimer)
+ /*
+ * bcm_rx_do_flush - helper for bcm_rx_thr_flush
+ */
+-static inline int bcm_rx_do_flush(struct bcm_op *op, int update,
+- unsigned int index)
++static inline int bcm_rx_do_flush(struct bcm_op *op, unsigned int index)
+ {
+ struct canfd_frame *lcf = op->last_frames + op->cfsiz * index;
+
+ if ((op->last_frames) && (lcf->flags & RX_THR)) {
+- if (update)
+- bcm_rx_changed(op, lcf);
++ bcm_rx_changed(op, lcf);
+ return 1;
+ }
+ return 0;
+@@ -611,11 +595,8 @@ static inline int bcm_rx_do_flush(struct bcm_op *op, int update,
+
+ /*
+ * bcm_rx_thr_flush - Check for throttled data and send it to the userspace
+- *
+- * update == 0 : just check if throttled data is available (any irq context)
+- * update == 1 : check and send throttled data to userspace (soft_irq context)
+ */
+-static int bcm_rx_thr_flush(struct bcm_op *op, int update)
++static int bcm_rx_thr_flush(struct bcm_op *op)
+ {
+ int updated = 0;
+
+@@ -624,24 +605,16 @@ static int bcm_rx_thr_flush(struct bcm_op *op, int update)
+
+ /* for MUX filter we start at index 1 */
+ for (i = 1; i < op->nframes; i++)
+- updated += bcm_rx_do_flush(op, update, i);
++ updated += bcm_rx_do_flush(op, i);
+
+ } else {
+ /* for RX_FILTER_ID and simple filter */
+- updated += bcm_rx_do_flush(op, update, 0);
++ updated += bcm_rx_do_flush(op, 0);
+ }
+
+ return updated;
+ }
+
+-static void bcm_rx_thr_tsklet(unsigned long data)
+-{
+- struct bcm_op *op = (struct bcm_op *)data;
+-
+- /* push the changed data to the userspace */
+- bcm_rx_thr_flush(op, 1);
+-}
+-
+ /*
+ * bcm_rx_thr_handler - the time for blocked content updates is over now:
+ * Check for throttled data and send it to the userspace
+@@ -650,9 +623,7 @@ static enum hrtimer_restart bcm_rx_thr_handler(struct hrtimer *hrtimer)
+ {
+ struct bcm_op *op = container_of(hrtimer, struct bcm_op, thrtimer);
+
+- tasklet_schedule(&op->thrtsklet);
+-
+- if (bcm_rx_thr_flush(op, 0)) {
++ if (bcm_rx_thr_flush(op)) {
+ hrtimer_forward(hrtimer, ktime_get(), op->kt_ival2);
+ return HRTIMER_RESTART;
+ } else {
+@@ -748,23 +719,8 @@ static struct bcm_op *bcm_find_op(struct list_head *ops,
+
+ static void bcm_remove_op(struct bcm_op *op)
+ {
+- if (op->tsklet.func) {
+- while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) ||
+- test_bit(TASKLET_STATE_RUN, &op->tsklet.state) ||
+- hrtimer_active(&op->timer)) {
+- hrtimer_cancel(&op->timer);
+- tasklet_kill(&op->tsklet);
+- }
+- }
+-
+- if (op->thrtsklet.func) {
+- while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) ||
+- test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) ||
+- hrtimer_active(&op->thrtimer)) {
+- hrtimer_cancel(&op->thrtimer);
+- tasklet_kill(&op->thrtsklet);
+- }
+- }
++ hrtimer_cancel(&op->timer);
++ hrtimer_cancel(&op->thrtimer);
+
+ if ((op->frames) && (op->frames != &op->sframe))
+ kfree(op->frames);
+@@ -998,15 +954,13 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ op->ifindex = ifindex;
+
+ /* initialize uninitialized (kzalloc) structure */
+- hrtimer_init(&op->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++ hrtimer_init(&op->timer, CLOCK_MONOTONIC,
++ HRTIMER_MODE_REL_SOFT);
+ op->timer.function = bcm_tx_timeout_handler;
+
+- /* initialize tasklet for tx countevent notification */
+- tasklet_init(&op->tsklet, bcm_tx_timeout_tsklet,
+- (unsigned long) op);
+-
+ /* currently unused in tx_ops */
+- hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++ hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC,
++ HRTIMER_MODE_REL_SOFT);
+
+ /* add this bcm_op to the list of the tx_ops */
+ list_add(&op->list, &bo->tx_ops);
+@@ -1175,20 +1129,14 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ op->rx_ifindex = ifindex;
+
+ /* initialize uninitialized (kzalloc) structure */
+- hrtimer_init(&op->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++ hrtimer_init(&op->timer, CLOCK_MONOTONIC,
++ HRTIMER_MODE_REL_SOFT);
+ op->timer.function = bcm_rx_timeout_handler;
+
+- /* initialize tasklet for rx timeout notification */
+- tasklet_init(&op->tsklet, bcm_rx_timeout_tsklet,
+- (unsigned long) op);
+-
+- hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++ hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC,
++ HRTIMER_MODE_REL_SOFT);
+ op->thrtimer.function = bcm_rx_thr_handler;
+
+- /* initialize tasklet for rx throttle handling */
+- tasklet_init(&op->thrtsklet, bcm_rx_thr_tsklet,
+- (unsigned long) op);
+-
+ /* add this bcm_op to the list of the rx_ops */
+ list_add(&op->list, &bo->rx_ops);
+
+@@ -1234,12 +1182,12 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ */
+ op->kt_lastmsg = 0;
+ hrtimer_cancel(&op->thrtimer);
+- bcm_rx_thr_flush(op, 1);
++ bcm_rx_thr_flush(op);
+ }
+
+ if ((op->flags & STARTTIMER) && op->kt_ival1)
+ hrtimer_start(&op->timer, op->kt_ival1,
+- HRTIMER_MODE_REL);
++ HRTIMER_MODE_REL_SOFT);
+ }
+
+ /* now we can register for can_ids, if we added a new bcm_op */
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 01496c7cb42d7..7d68c98a00aa8 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -5534,9 +5534,9 @@ void bpf_warn_invalid_xdp_action(u32 act)
+ {
+ const u32 act_max = XDP_REDIRECT;
+
+- WARN_ONCE(1, "%s XDP return value %u, expect packet loss!\n",
+- act > act_max ? "Illegal" : "Driver unsupported",
+- act);
++ pr_warn_once("%s XDP return value %u, expect packet loss!\n",
++ act > act_max ? "Illegal" : "Driver unsupported",
++ act);
+ }
+ EXPORT_SYMBOL_GPL(bpf_warn_invalid_xdp_action);
+
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index fe0d255d66c8b..e5dc04cb55992 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1616,6 +1616,9 @@ static void remove_queue_kobjects(struct net_device *dev)
+
+ net_rx_queue_update_kobjects(dev, real_rx, 0);
+ netdev_queue_update_kobjects(dev, real_tx, 0);
++
++ dev->real_num_rx_queues = 0;
++ dev->real_num_tx_queues = 0;
+ #ifdef CONFIG_SYSFS
+ kset_unregister(dev->queues_kset);
+ #endif
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 26d70c00b0545..3368624be5ecd 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -149,8 +149,10 @@ static void ops_exit_list(const struct pernet_operations *ops,
+ {
+ struct net *net;
+ if (ops->exit) {
+- list_for_each_entry(net, net_exit_list, exit_list)
++ list_for_each_entry(net, net_exit_list, exit_list) {
+ ops->exit(net);
++ cond_resched();
++ }
+ }
+ if (ops->exit_batch)
+ ops->exit_batch(net_exit_list);
+diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+index 2fa1963259880..954c96f4ddd0f 100644
+--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+@@ -509,8 +509,11 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
+ if (IS_ERR(config))
+ return PTR_ERR(config);
+ }
+- } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN))
++ } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN)) {
++ clusterip_config_entry_put(config);
++ clusterip_config_put(config);
+ return -EINVAL;
++ }
+
+ ret = nf_ct_netns_get(par->net, par->family);
+ if (ret < 0) {
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index e0baa563a4dea..c42cc79895202 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4620,7 +4620,7 @@ void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
+ goto drop;
+ break;
+ case RX_ENC_VHT:
+- if (WARN_ONCE(status->rate_idx > 9 ||
++ if (WARN_ONCE(status->rate_idx > 11 ||
+ !status->nss ||
+ status->nss > 8,
+ "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index 23f7116d122a2..605d7448c3de1 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -796,6 +796,11 @@ static int llcp_sock_sendmsg(struct socket *sock, struct msghdr *msg,
+
+ lock_sock(sk);
+
++ if (!llcp_sock->local) {
++ release_sock(sk);
++ return -ENODEV;
++ }
++
+ if (sk->sk_type == SOCK_DGRAM) {
+ DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr,
+ msg->msg_name);
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index b3ff610d35045..7c1b1eff84f4c 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -1367,6 +1367,7 @@ void psched_ratecfg_precompute(struct psched_ratecfg *r,
+ {
+ memset(r, 0, sizeof(*r));
+ r->overhead = conf->overhead;
++ r->mpu = conf->mpu;
+ r->rate_bytes_ps = max_t(u64, conf->rate, rate64);
+ r->linklayer = (conf->linklayer & TC_LINKLAYER_MASK);
+ r->mult = 1;
+diff --git a/net/unix/garbage.c b/net/unix/garbage.c
+index 8bbe1b8e4ff7f..4d283e26d8162 100644
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -197,8 +197,11 @@ void wait_for_unix_gc(void)
+ {
+ /* If number of inflight sockets is insane,
+ * force a garbage collect right now.
++ * Paired with the WRITE_ONCE() in unix_inflight(),
++ * unix_notinflight() and gc_in_progress().
+ */
+- if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
++ if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC &&
++ !READ_ONCE(gc_in_progress))
+ unix_gc();
+ wait_event(unix_gc_wait, gc_in_progress == false);
+ }
+@@ -218,7 +221,9 @@ void unix_gc(void)
+ if (gc_in_progress)
+ goto out;
+
+- gc_in_progress = true;
++ /* Paired with READ_ONCE() in wait_for_unix_gc(). */
++ WRITE_ONCE(gc_in_progress, true);
++
+ /* First, select candidates for garbage collection. Only
+ * in-flight sockets are considered, and from those only ones
+ * which don't have any external reference.
+@@ -304,7 +309,10 @@ void unix_gc(void)
+
+ /* All candidates should have been detached by now. */
+ BUG_ON(!list_empty(&gc_candidates));
+- gc_in_progress = false;
++
++ /* Paired with READ_ONCE() in wait_for_unix_gc(). */
++ WRITE_ONCE(gc_in_progress, false);
++
+ wake_up(&unix_gc_wait);
+
+ out:
+diff --git a/net/unix/scm.c b/net/unix/scm.c
+index 83413ade79838..a07b2efbf8b5e 100644
+--- a/net/unix/scm.c
++++ b/net/unix/scm.c
+@@ -56,7 +56,8 @@ void unix_inflight(struct user_struct *user, struct file *fp)
+ } else {
+ BUG_ON(list_empty(&u->link));
+ }
+- unix_tot_inflight++;
++ /* Paired with READ_ONCE() in wait_for_unix_gc() */
++ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1);
+ }
+ user->unix_inflight++;
+ spin_unlock(&unix_gc_lock);
+@@ -76,7 +77,8 @@ void unix_notinflight(struct user_struct *user, struct file *fp)
+
+ if (atomic_long_dec_and_test(&u->inflight))
+ list_del_init(&u->link);
+- unix_tot_inflight--;
++ /* Paired with READ_ONCE() in wait_for_unix_gc() */
++ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1);
+ }
+ user->unix_inflight--;
+ spin_unlock(&unix_gc_lock);
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 35a020a709852..054897358d904 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -662,11 +662,16 @@ static int xfrmi_newlink(struct net *src_net, struct net_device *dev,
+ struct netlink_ext_ack *extack)
+ {
+ struct net *net = dev_net(dev);
+- struct xfrm_if_parms p;
++ struct xfrm_if_parms p = {};
+ struct xfrm_if *xi;
+ int err;
+
+ xfrmi_netlink_parms(data, &p);
++ if (!p.if_id) {
++ NL_SET_ERR_MSG(extack, "if_id must be non zero");
++ return -EINVAL;
++ }
++
+ xi = xfrmi_locate(net, &p);
+ if (xi)
+ return -EEXIST;
+@@ -691,7 +696,12 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[],
+ {
+ struct xfrm_if *xi = netdev_priv(dev);
+ struct net *net = xi->net;
+- struct xfrm_if_parms p;
++ struct xfrm_if_parms p = {};
++
++ if (!p.if_id) {
++ NL_SET_ERR_MSG(extack, "if_id must be non zero");
++ return -EINVAL;
++ }
+
+ xfrmi_netlink_parms(data, &p);
+ xi = xfrmi_locate(net, &p);
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index f94abe1fdd58f..8d8f9e778cd4f 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -620,8 +620,13 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
+
+ xfrm_smark_init(attrs, &x->props.smark);
+
+- if (attrs[XFRMA_IF_ID])
++ if (attrs[XFRMA_IF_ID]) {
+ x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
++ if (!x->if_id) {
++ err = -EINVAL;
++ goto error;
++ }
++ }
+
+ err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV]);
+ if (err)
+@@ -1327,8 +1332,13 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
+
+ mark = xfrm_mark_get(attrs, &m);
+
+- if (attrs[XFRMA_IF_ID])
++ if (attrs[XFRMA_IF_ID]) {
+ if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
++ if (!if_id) {
++ err = -EINVAL;
++ goto out_noput;
++ }
++ }
+
+ if (p->info.seq) {
+ x = xfrm_find_acq_byseq(net, mark, p->info.seq);
+@@ -1630,8 +1640,13 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_us
+
+ xfrm_mark_get(attrs, &xp->mark);
+
+- if (attrs[XFRMA_IF_ID])
++ if (attrs[XFRMA_IF_ID]) {
+ xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
++ if (!xp->if_id) {
++ err = -EINVAL;
++ goto error;
++ }
++ }
+
+ return xp;
+ error:
+@@ -2813,7 +2828,7 @@ static inline unsigned int xfrm_sa_len(struct xfrm_state *x)
+ if (x->props.extra_flags)
+ l += nla_total_size(sizeof(x->props.extra_flags));
+ if (x->xso.dev)
+- l += nla_total_size(sizeof(x->xso));
++ l += nla_total_size(sizeof(struct xfrm_user_offload));
+ if (x->props.smark.v | x->props.smark.m) {
+ l += nla_total_size(sizeof(x->props.smark.v));
+ l += nla_total_size(sizeof(x->props.smark.m));
+diff --git a/scripts/dtc/dtx_diff b/scripts/dtc/dtx_diff
+index 8c4fbad2055e5..1046bdc0719d2 100755
+--- a/scripts/dtc/dtx_diff
++++ b/scripts/dtc/dtx_diff
+@@ -56,12 +56,8 @@ Otherwise DTx is treated as a dts source file (aka .dts).
+ or '/include/' to be processed.
+
+ If DTx_1 and DTx_2 are in different architectures, then this script
+- may not work since \${ARCH} is part of the include path. Two possible
+- workarounds:
+-
+- `basename $0` \\
+- <(ARCH=arch_of_dtx_1 `basename $0` DTx_1) \\
+- <(ARCH=arch_of_dtx_2 `basename $0` DTx_2)
++ may not work since \${ARCH} is part of the include path. The following
++ workaround can be used:
+
+ `basename $0` ARCH=arch_of_dtx_1 DTx_1 >tmp_dtx_1.dts
+ `basename $0` ARCH=arch_of_dtx_2 DTx_2 >tmp_dtx_2.dts
+diff --git a/sound/core/jack.c b/sound/core/jack.c
+index 847a8f3fd06ea..acb531749efb0 100644
+--- a/sound/core/jack.c
++++ b/sound/core/jack.c
+@@ -68,10 +68,13 @@ static int snd_jack_dev_free(struct snd_device *device)
+ struct snd_card *card = device->card;
+ struct snd_jack_kctl *jack_kctl, *tmp_jack_kctl;
+
++ down_write(&card->controls_rwsem);
+ list_for_each_entry_safe(jack_kctl, tmp_jack_kctl, &jack->kctl_list, list) {
+ list_del_init(&jack_kctl->list);
+ snd_ctl_remove(card, jack_kctl->kctl);
+ }
++ up_write(&card->controls_rwsem);
++
+ if (jack->private_free)
+ jack->private_free(jack);
+
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index 2b3bd6f31e4c1..cd68a0ae82d31 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -2070,7 +2070,7 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss_file *pcm_oss_file, int tr
+ int err, cmd;
+
+ #ifdef OSS_DEBUG
+- pcm_dbg(substream->pcm, "pcm_oss: trigger = 0x%x\n", trigger);
++ pr_debug("pcm_oss: trigger = 0x%x\n", trigger);
+ #endif
+
+ psubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
+diff --git a/sound/core/pcm.c b/sound/core/pcm.c
+index 01b9d62eef14d..b6ed38dec4357 100644
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -874,7 +874,11 @@ EXPORT_SYMBOL(snd_pcm_new_internal);
+ static void free_chmap(struct snd_pcm_str *pstr)
+ {
+ if (pstr->chmap_kctl) {
+- snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl);
++ struct snd_card *card = pstr->pcm->card;
++
++ down_write(&card->controls_rwsem);
++ snd_ctl_remove(card, pstr->chmap_kctl);
++ up_write(&card->controls_rwsem);
+ pstr->chmap_kctl = NULL;
+ }
+ }
+diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
+index 28b4dd45b8d1d..a23ba648db845 100644
+--- a/sound/core/seq/seq_queue.c
++++ b/sound/core/seq/seq_queue.c
+@@ -247,12 +247,15 @@ struct snd_seq_queue *snd_seq_queue_find_name(char *name)
+
+ /* -------------------------------------------------------- */
+
++#define MAX_CELL_PROCESSES_IN_QUEUE 1000
++
+ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop)
+ {
+ unsigned long flags;
+ struct snd_seq_event_cell *cell;
+ snd_seq_tick_time_t cur_tick;
+ snd_seq_real_time_t cur_time;
++ int processed = 0;
+
+ if (q == NULL)
+ return;
+@@ -275,6 +278,8 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop)
+ if (!cell)
+ break;
+ snd_seq_dispatch_event(cell, atomic, hop);
++ if (++processed >= MAX_CELL_PROCESSES_IN_QUEUE)
++ goto out; /* the rest processed at the next batch */
+ }
+
+ /* Process time queue... */
+@@ -284,14 +289,19 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop)
+ if (!cell)
+ break;
+ snd_seq_dispatch_event(cell, atomic, hop);
++ if (++processed >= MAX_CELL_PROCESSES_IN_QUEUE)
++ goto out; /* the rest processed at the next batch */
+ }
+
++ out:
+ /* free lock */
+ spin_lock_irqsave(&q->check_lock, flags);
+ if (q->check_again) {
+ q->check_again = 0;
+- spin_unlock_irqrestore(&q->check_lock, flags);
+- goto __again;
++ if (processed < MAX_CELL_PROCESSES_IN_QUEUE) {
++ spin_unlock_irqrestore(&q->check_lock, flags);
++ goto __again;
++ }
+ }
+ q->check_blocked = 0;
+ spin_unlock_irqrestore(&q->check_lock, flags);
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 7f1e763ccca88..b43558ffd78ab 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -1705,8 +1705,11 @@ void snd_hda_ctls_clear(struct hda_codec *codec)
+ {
+ int i;
+ struct hda_nid_item *items = codec->mixers.list;
++
++ down_write(&codec->card->controls_rwsem);
+ for (i = 0; i < codec->mixers.used; i++)
+ snd_ctl_remove(codec->card, items[i].kctl);
++ up_write(&codec->card->controls_rwsem);
+ snd_array_free(&codec->mixers);
+ snd_array_free(&codec->nids);
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 56d87e53346f1..c23993b9c6238 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1910,6 +1910,7 @@ enum {
+ ALC887_FIXUP_ASUS_BASS,
+ ALC887_FIXUP_BASS_CHMAP,
+ ALC1220_FIXUP_GB_DUAL_CODECS,
++ ALC1220_FIXUP_GB_X570,
+ ALC1220_FIXUP_CLEVO_P950,
+ ALC1220_FIXUP_CLEVO_PB51ED,
+ ALC1220_FIXUP_CLEVO_PB51ED_PINS,
+@@ -2099,6 +2100,29 @@ static void alc1220_fixup_gb_dual_codecs(struct hda_codec *codec,
+ }
+ }
+
++static void alc1220_fixup_gb_x570(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ static const hda_nid_t conn1[] = { 0x0c };
++ static const struct coef_fw gb_x570_coefs[] = {
++ WRITE_COEF(0x1a, 0x01c1),
++ WRITE_COEF(0x1b, 0x0202),
++ WRITE_COEF(0x43, 0x3005),
++ {}
++ };
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ snd_hda_override_conn_list(codec, 0x14, ARRAY_SIZE(conn1), conn1);
++ snd_hda_override_conn_list(codec, 0x1b, ARRAY_SIZE(conn1), conn1);
++ break;
++ case HDA_FIXUP_ACT_INIT:
++ alc_process_coef_fw(codec, gb_x570_coefs);
++ break;
++ }
++}
++
+ static void alc1220_fixup_clevo_p950(struct hda_codec *codec,
+ const struct hda_fixup *fix,
+ int action)
+@@ -2401,6 +2425,10 @@ static const struct hda_fixup alc882_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc1220_fixup_gb_dual_codecs,
+ },
++ [ALC1220_FIXUP_GB_X570] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc1220_fixup_gb_x570,
++ },
+ [ALC1220_FIXUP_CLEVO_P950] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc1220_fixup_clevo_p950,
+@@ -2503,7 +2531,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x13fe, 0x1009, "Advantech MIT-W101", ALC886_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+- SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_GB_X570),
+ SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x11f7, "MSI-GE63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950),
+diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c
+index 9bd24ad422407..dd77f131ce6c5 100644
+--- a/sound/soc/codecs/rt5663.c
++++ b/sound/soc/codecs/rt5663.c
+@@ -3446,6 +3446,7 @@ static void rt5663_calibrate(struct rt5663_priv *rt5663)
+ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev)
+ {
+ int table_size;
++ int ret;
+
+ device_property_read_u32(dev, "realtek,dc_offset_l_manual",
+ &rt5663->pdata.dc_offset_l_manual);
+@@ -3462,9 +3463,11 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev)
+ table_size = sizeof(struct impedance_mapping_table) *
+ rt5663->pdata.impedance_sensing_num;
+ rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL);
+- device_property_read_u32_array(dev,
++ ret = device_property_read_u32_array(dev,
+ "realtek,impedance_sensing_table",
+ (u32 *)rt5663->imp_table, table_size);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+@@ -3489,8 +3492,11 @@ static int rt5663_i2c_probe(struct i2c_client *i2c,
+
+ if (pdata)
+ rt5663->pdata = *pdata;
+- else
+- rt5663_parse_dp(rt5663, &i2c->dev);
++ else {
++ ret = rt5663_parse_dp(rt5663, &i2c->dev);
++ if (ret)
++ return ret;
++ }
+
+ regmap = devm_regmap_init_i2c(i2c, &temp_regmap);
+ if (IS_ERR(regmap)) {
+diff --git a/sound/soc/mediatek/mt8173/mt8173-max98090.c b/sound/soc/mediatek/mt8173/mt8173-max98090.c
+index 902d111016d6f..431ba3db17594 100644
+--- a/sound/soc/mediatek/mt8173/mt8173-max98090.c
++++ b/sound/soc/mediatek/mt8173/mt8173-max98090.c
+@@ -169,6 +169,9 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev)
+ if (ret)
+ dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+ __func__, ret);
++
++ of_node_put(codec_node);
++ of_node_put(platform_node);
+ return ret;
+ }
+
+diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
+index 582174d98c6c9..cdb3940710379 100644
+--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
+@@ -217,6 +217,8 @@ static int mt8173_rt5650_rt5514_dev_probe(struct platform_device *pdev)
+ if (ret)
+ dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+ __func__, ret);
++
++ of_node_put(platform_node);
+ return ret;
+ }
+
+diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
+index b3670c8a5b8de..242f99716c619 100644
+--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
+@@ -274,6 +274,8 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev)
+ if (ret)
+ dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+ __func__, ret);
++
++ of_node_put(platform_node);
+ return ret;
+ }
+
+diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
+index 7a89b4aad182f..14011a70bcc41 100644
+--- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c
++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
+@@ -301,6 +301,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev)
+ if (ret)
+ dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+ __func__, ret);
++
++ of_node_put(platform_node);
+ return ret;
+ }
+
+diff --git a/sound/soc/samsung/idma.c b/sound/soc/samsung/idma.c
+index b1f09b942410d..e397f5e10e33e 100644
+--- a/sound/soc/samsung/idma.c
++++ b/sound/soc/samsung/idma.c
+@@ -369,6 +369,8 @@ static int preallocate_idma_buffer(struct snd_pcm *pcm, int stream)
+ buf->addr = idma.lp_tx_addr;
+ buf->bytes = idma_hardware.buffer_bytes_max;
+ buf->area = (unsigned char * __force)ioremap(buf->addr, buf->bytes);
++ if (!buf->area)
++ return -ENOMEM;
+
+ return 0;
+ }
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 8531b490f6f66..273898b358c4b 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -2752,6 +2752,7 @@ int snd_soc_register_card(struct snd_soc_card *card)
+ card->instantiated = 0;
+ mutex_init(&card->mutex);
+ mutex_init(&card->dapm_mutex);
++ spin_lock_init(&card->dpcm_lock);
+
+ ret = snd_soc_instantiate_card(card);
+ if (ret != 0)
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index af14304645ce8..c03b653bf6ff3 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1221,6 +1221,7 @@ static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe,
+ struct snd_soc_pcm_runtime *be, int stream)
+ {
+ struct snd_soc_dpcm *dpcm;
++ unsigned long flags;
+
+ /* only add new dpcms */
+ list_for_each_entry(dpcm, &fe->dpcm[stream].be_clients, list_be) {
+@@ -1236,8 +1237,10 @@ static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe,
+ dpcm->fe = fe;
+ be->dpcm[stream].runtime = fe->dpcm[stream].runtime;
+ dpcm->state = SND_SOC_DPCM_LINK_STATE_NEW;
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
+ list_add(&dpcm->list_be, &fe->dpcm[stream].be_clients);
+ list_add(&dpcm->list_fe, &be->dpcm[stream].fe_clients);
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+
+ dev_dbg(fe->dev, "connected new DPCM %s path %s %s %s\n",
+ stream ? "capture" : "playback", fe->dai_link->name,
+@@ -1283,6 +1286,7 @@ static void dpcm_be_reparent(struct snd_soc_pcm_runtime *fe,
+ void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream)
+ {
+ struct snd_soc_dpcm *dpcm, *d;
++ unsigned long flags;
+
+ list_for_each_entry_safe(dpcm, d, &fe->dpcm[stream].be_clients, list_be) {
+ dev_dbg(fe->dev, "ASoC: BE %s disconnect check for %s\n",
+@@ -1302,8 +1306,10 @@ void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream)
+ #ifdef CONFIG_DEBUG_FS
+ debugfs_remove(dpcm->debugfs_state);
+ #endif
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
+ list_del(&dpcm->list_be);
+ list_del(&dpcm->list_fe);
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ kfree(dpcm);
+ }
+ }
+@@ -1557,10 +1563,13 @@ int dpcm_process_paths(struct snd_soc_pcm_runtime *fe,
+ void dpcm_clear_pending_state(struct snd_soc_pcm_runtime *fe, int stream)
+ {
+ struct snd_soc_dpcm *dpcm;
++ unsigned long flags;
+
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
+ list_for_each_entry(dpcm, &fe->dpcm[stream].be_clients, list_be)
+ dpcm->be->dpcm[stream].runtime_update =
+ SND_SOC_DPCM_UPDATE_NO;
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ }
+
+ static void dpcm_be_dai_startup_unwind(struct snd_soc_pcm_runtime *fe,
+@@ -2626,6 +2635,7 @@ static int dpcm_run_update_startup(struct snd_soc_pcm_runtime *fe, int stream)
+ struct snd_soc_dpcm *dpcm;
+ enum snd_soc_dpcm_trigger trigger = fe->dai_link->trigger[stream];
+ int ret;
++ unsigned long flags;
+
+ dev_dbg(fe->dev, "ASoC: runtime %s open on FE %s\n",
+ stream ? "capture" : "playback", fe->dai_link->name);
+@@ -2695,11 +2705,13 @@ close:
+ dpcm_be_dai_shutdown(fe, stream);
+ disconnect:
+ /* disconnect any non started BEs */
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
+ list_for_each_entry(dpcm, &fe->dpcm[stream].be_clients, list_be) {
+ struct snd_soc_pcm_runtime *be = dpcm->be;
+ if (be->dpcm[stream].state != SND_SOC_DPCM_STATE_START)
+ dpcm->state = SND_SOC_DPCM_LINK_STATE_FREE;
+ }
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+
+ return ret;
+ }
+@@ -3278,7 +3290,10 @@ int snd_soc_dpcm_can_be_free_stop(struct snd_soc_pcm_runtime *fe,
+ {
+ struct snd_soc_dpcm *dpcm;
+ int state;
++ int ret = 1;
++ unsigned long flags;
+
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
+ list_for_each_entry(dpcm, &be->dpcm[stream].fe_clients, list_fe) {
+
+ if (dpcm->fe == fe)
+@@ -3287,12 +3302,15 @@ int snd_soc_dpcm_can_be_free_stop(struct snd_soc_pcm_runtime *fe,
+ state = dpcm->fe->dpcm[stream].state;
+ if (state == SND_SOC_DPCM_STATE_START ||
+ state == SND_SOC_DPCM_STATE_PAUSED ||
+- state == SND_SOC_DPCM_STATE_SUSPEND)
+- return 0;
++ state == SND_SOC_DPCM_STATE_SUSPEND) {
++ ret = 0;
++ break;
++ }
+ }
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+
+ /* it's safe to free/stop this BE DAI */
+- return 1;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(snd_soc_dpcm_can_be_free_stop);
+
+@@ -3305,7 +3323,10 @@ int snd_soc_dpcm_can_be_params(struct snd_soc_pcm_runtime *fe,
+ {
+ struct snd_soc_dpcm *dpcm;
+ int state;
++ int ret = 1;
++ unsigned long flags;
+
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
+ list_for_each_entry(dpcm, &be->dpcm[stream].fe_clients, list_fe) {
+
+ if (dpcm->fe == fe)
+@@ -3315,12 +3336,15 @@ int snd_soc_dpcm_can_be_params(struct snd_soc_pcm_runtime *fe,
+ if (state == SND_SOC_DPCM_STATE_START ||
+ state == SND_SOC_DPCM_STATE_PAUSED ||
+ state == SND_SOC_DPCM_STATE_SUSPEND ||
+- state == SND_SOC_DPCM_STATE_PREPARE)
+- return 0;
++ state == SND_SOC_DPCM_STATE_PREPARE) {
++ ret = 0;
++ break;
++ }
+ }
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+
+ /* it's safe to change hw_params */
+- return 1;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(snd_soc_dpcm_can_be_params);
+
+@@ -3359,6 +3383,7 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
+ struct snd_pcm_hw_params *params = &fe->dpcm[stream].hw_params;
+ struct snd_soc_dpcm *dpcm;
+ ssize_t offset = 0;
++ unsigned long flags;
+
+ /* FE state */
+ offset += scnprintf(buf + offset, size - offset,
+@@ -3386,6 +3411,7 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
+ goto out;
+ }
+
++ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
+ list_for_each_entry(dpcm, &fe->dpcm[stream].be_clients, list_be) {
+ struct snd_soc_pcm_runtime *be = dpcm->be;
+ params = &dpcm->hw_params;
+@@ -3406,7 +3432,7 @@ static ssize_t dpcm_show_state(struct snd_soc_pcm_runtime *fe,
+ params_channels(params),
+ params_rate(params));
+ }
+-
++ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+ out:
+ return offset;
+ }
+diff --git a/sound/soc/uniphier/Kconfig b/sound/soc/uniphier/Kconfig
+index aa3592ee1358b..ddfa6424c656b 100644
+--- a/sound/soc/uniphier/Kconfig
++++ b/sound/soc/uniphier/Kconfig
+@@ -23,7 +23,6 @@ config SND_SOC_UNIPHIER_LD11
+ tristate "UniPhier LD11/LD20 Device Driver"
+ depends on SND_SOC_UNIPHIER
+ select SND_SOC_UNIPHIER_AIO
+- select SND_SOC_UNIPHIER_AIO_DMA
+ help
+ This adds ASoC driver for Socionext UniPhier LD11/LD20
+ input and output that can be used with other codecs.
+@@ -34,7 +33,6 @@ config SND_SOC_UNIPHIER_PXS2
+ tristate "UniPhier PXs2 Device Driver"
+ depends on SND_SOC_UNIPHIER
+ select SND_SOC_UNIPHIER_AIO
+- select SND_SOC_UNIPHIER_AIO_DMA
+ help
+ This adds ASoC driver for Socionext UniPhier PXs2
+ input and output that can be used with other codecs.
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-01-29 17:45 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-01-29 17:45 UTC (permalink / raw
To: gentoo-commits
commit: 932ad64931d0eea03c4ec9117dc4e6cecf5aaaea
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Jan 29 17:44:55 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Jan 29 17:44:55 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=932ad649
Linux patch 4.19.227
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1226_linux-4.19.227.patch | 416 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 420 insertions(+)
diff --git a/0000_README b/0000_README
index 263aac7b..cc68b74d 100644
--- a/0000_README
+++ b/0000_README
@@ -943,6 +943,10 @@ Patch: 1225_linux-4.19.226.patch
From: https://www.kernel.org
Desc: Linux 4.19.226
+Patch: 1226_linux-4.19.227.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.227
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1226_linux-4.19.227.patch b/1226_linux-4.19.227.patch
new file mode 100644
index 00000000..5775a2ef
--- /dev/null
+++ b/1226_linux-4.19.227.patch
@@ -0,0 +1,416 @@
+diff --git a/Makefile b/Makefile
+index 72399555ce886..1e9652cb9c1fc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 226
++SUBLEVEL = 227
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 37c80cfecd097..c25ee6a02d65e 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1595,6 +1595,8 @@ struct drm_i915_private {
+
+ struct intel_uncore uncore;
+
++ struct mutex tlb_invalidate_lock;
++
+ struct i915_virtual_gpu vgpu;
+
+ struct intel_gvt *gvt;
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index c7d05ac7af3cb..5b0d6d8b3ab8e 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2446,6 +2446,78 @@ static void __i915_gem_object_reset_page_iter(struct drm_i915_gem_object *obj)
+ rcu_read_unlock();
+ }
+
++struct reg_and_bit {
++ i915_reg_t reg;
++ u32 bit;
++};
++
++static struct reg_and_bit
++get_reg_and_bit(const struct intel_engine_cs *engine,
++ const i915_reg_t *regs, const unsigned int num)
++{
++ const unsigned int class = engine->class;
++ struct reg_and_bit rb = { .bit = 1 };
++
++ if (WARN_ON_ONCE(class >= num || !regs[class].reg))
++ return rb;
++
++ rb.reg = regs[class];
++ if (class == VIDEO_DECODE_CLASS)
++ rb.reg.reg += 4 * engine->instance; /* GEN8_M2TCR */
++
++ return rb;
++}
++
++static void invalidate_tlbs(struct drm_i915_private *dev_priv)
++{
++ static const i915_reg_t gen8_regs[] = {
++ [RENDER_CLASS] = GEN8_RTCR,
++ [VIDEO_DECODE_CLASS] = GEN8_M1TCR, /* , GEN8_M2TCR */
++ [VIDEO_ENHANCEMENT_CLASS] = GEN8_VTCR,
++ [COPY_ENGINE_CLASS] = GEN8_BTCR,
++ };
++ const unsigned int num = ARRAY_SIZE(gen8_regs);
++ const i915_reg_t *regs = gen8_regs;
++ struct intel_engine_cs *engine;
++ enum intel_engine_id id;
++
++ if (INTEL_GEN(dev_priv) < 8)
++ return;
++
++ GEM_TRACE("\n");
++
++ assert_rpm_wakelock_held(dev_priv);
++
++ mutex_lock(&dev_priv->tlb_invalidate_lock);
++ intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
++
++ for_each_engine(engine, dev_priv, id) {
++ /*
++ * HW architecture suggest typical invalidation time at 40us,
++ * with pessimistic cases up to 100us and a recommendation to
++ * cap at 1ms. We go a bit higher just in case.
++ */
++ const unsigned int timeout_us = 100;
++ const unsigned int timeout_ms = 4;
++ struct reg_and_bit rb;
++
++ rb = get_reg_and_bit(engine, regs, num);
++ if (!i915_mmio_reg_offset(rb.reg))
++ continue;
++
++ I915_WRITE_FW(rb.reg, rb.bit);
++ if (__intel_wait_for_register_fw(dev_priv,
++ rb.reg, rb.bit, 0,
++ timeout_us, timeout_ms,
++ NULL))
++ DRM_ERROR_RATELIMITED("%s TLB invalidation did not complete in %ums!\n",
++ engine->name, timeout_ms);
++ }
++
++ intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
++ mutex_unlock(&dev_priv->tlb_invalidate_lock);
++}
++
+ static struct sg_table *
+ __i915_gem_object_unset_pages(struct drm_i915_gem_object *obj)
+ {
+@@ -2475,6 +2547,15 @@ __i915_gem_object_unset_pages(struct drm_i915_gem_object *obj)
+ __i915_gem_object_reset_page_iter(obj);
+ obj->mm.page_sizes.phys = obj->mm.page_sizes.sg = 0;
+
++ if (test_and_clear_bit(I915_BO_WAS_BOUND_BIT, &obj->flags)) {
++ struct drm_i915_private *i915 = to_i915(obj->base.dev);
++
++ if (intel_runtime_pm_get_if_in_use(i915)) {
++ invalidate_tlbs(i915);
++ intel_runtime_pm_put(i915);
++ }
++ }
++
+ return pages;
+ }
+
+@@ -5792,6 +5873,8 @@ int i915_gem_init_early(struct drm_i915_private *dev_priv)
+
+ spin_lock_init(&dev_priv->fb_tracking.lock);
+
++ mutex_init(&dev_priv->tlb_invalidate_lock);
++
+ err = i915_gemfs_init(dev_priv);
+ if (err)
+ DRM_NOTE("Unable to create a private tmpfs mount, hugepage support will be disabled(%d).\n", err);
+diff --git a/drivers/gpu/drm/i915/i915_gem_object.h b/drivers/gpu/drm/i915/i915_gem_object.h
+index 83e5e01fa9eaa..2e3a713e9bcd8 100644
+--- a/drivers/gpu/drm/i915/i915_gem_object.h
++++ b/drivers/gpu/drm/i915/i915_gem_object.h
+@@ -136,6 +136,7 @@ struct drm_i915_gem_object {
+ * activity?
+ */
+ #define I915_BO_ACTIVE_REF 0
++#define I915_BO_WAS_BOUND_BIT 1
+
+ /*
+ * Is the object to be mapped as read-only to the GPU
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index a6f4f32dd71ce..830049985e56d 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -2431,6 +2431,12 @@ enum i915_power_well_id {
+ #define GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING (1 << 28)
+ #define GAMT_CHKN_DISABLE_I2M_CYCLE_ON_WR_PORT (1 << 24)
+
++#define GEN8_RTCR _MMIO(0x4260)
++#define GEN8_M1TCR _MMIO(0x4264)
++#define GEN8_M2TCR _MMIO(0x4268)
++#define GEN8_BTCR _MMIO(0x426c)
++#define GEN8_VTCR _MMIO(0x4270)
++
+ #if 0
+ #define PRB0_TAIL _MMIO(0x2030)
+ #define PRB0_HEAD _MMIO(0x2034)
+diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
+index 98358b4b36dea..9aceacc43f4b7 100644
+--- a/drivers/gpu/drm/i915/i915_vma.c
++++ b/drivers/gpu/drm/i915/i915_vma.c
+@@ -335,6 +335,10 @@ int i915_vma_bind(struct i915_vma *vma, enum i915_cache_level cache_level,
+ return ret;
+
+ vma->flags |= bind_flags;
++
++ if (vma->obj)
++ set_bit(I915_BO_WAS_BOUND_BIT, &vma->obj->flags);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+index 1abe21758b0d7..bca0b8980c0e7 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+@@ -855,15 +855,14 @@ extern int vmw_execbuf_fence_commands(struct drm_file *file_priv,
+ struct vmw_private *dev_priv,
+ struct vmw_fence_obj **p_fence,
+ uint32_t *p_handle);
+-extern void vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,
++extern int vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,
+ struct vmw_fpriv *vmw_fp,
+ int ret,
+ struct drm_vmw_fence_rep __user
+ *user_fence_rep,
+ struct vmw_fence_obj *fence,
+ uint32_t fence_handle,
+- int32_t out_fence_fd,
+- struct sync_file *sync_file);
++ int32_t out_fence_fd);
+ extern int vmw_validate_single_buffer(struct vmw_private *dev_priv,
+ struct ttm_buffer_object *bo,
+ bool interruptible,
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index 3834aa71c9c4c..e65554f5a89d5 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -3873,20 +3873,19 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv,
+ * object so we wait for it immediately, and then unreference the
+ * user-space reference.
+ */
+-void
++int
+ vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,
+ struct vmw_fpriv *vmw_fp,
+ int ret,
+ struct drm_vmw_fence_rep __user *user_fence_rep,
+ struct vmw_fence_obj *fence,
+ uint32_t fence_handle,
+- int32_t out_fence_fd,
+- struct sync_file *sync_file)
++ int32_t out_fence_fd)
+ {
+ struct drm_vmw_fence_rep fence_rep;
+
+ if (user_fence_rep == NULL)
+- return;
++ return 0;
+
+ memset(&fence_rep, 0, sizeof(fence_rep));
+
+@@ -3914,20 +3913,14 @@ vmw_execbuf_copy_fence_user(struct vmw_private *dev_priv,
+ * and unreference the handle.
+ */
+ if (unlikely(ret != 0) && (fence_rep.error == 0)) {
+- if (sync_file)
+- fput(sync_file->file);
+-
+- if (fence_rep.fd != -1) {
+- put_unused_fd(fence_rep.fd);
+- fence_rep.fd = -1;
+- }
+-
+ ttm_ref_object_base_unref(vmw_fp->tfile,
+ fence_handle, TTM_REF_USAGE);
+ DRM_ERROR("Fence copy error. Syncing.\n");
+ (void) vmw_fence_obj_wait(fence, false, false,
+ VMW_FENCE_WAIT_TIMEOUT);
+ }
++
++ return ret ? -EFAULT : 0;
+ }
+
+ /**
+@@ -4287,16 +4280,23 @@ int vmw_execbuf_process(struct drm_file *file_priv,
+
+ (void) vmw_fence_obj_wait(fence, false, false,
+ VMW_FENCE_WAIT_TIMEOUT);
++ }
++ }
++
++ ret = vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret,
++ user_fence_rep, fence, handle, out_fence_fd);
++
++ if (sync_file) {
++ if (ret) {
++ /* usercopy of fence failed, put the file object */
++ fput(sync_file->file);
++ put_unused_fd(out_fence_fd);
+ } else {
+ /* Link the fence with the FD created earlier */
+ fd_install(out_fence_fd, sync_file->file);
+ }
+ }
+
+- vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv), ret,
+- user_fence_rep, fence, handle,
+- out_fence_fd, sync_file);
+-
+ /* Don't unreference when handing fence out */
+ if (unlikely(out_fence != NULL)) {
+ *out_fence = fence;
+@@ -4315,7 +4315,7 @@ int vmw_execbuf_process(struct drm_file *file_priv,
+ */
+ vmw_resource_list_unreference(sw_context, &resource_list);
+
+- return 0;
++ return ret;
+
+ out_unlock_binding:
+ mutex_unlock(&dev_priv->binding_mutex);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+index 3d546d4093341..72a75316d472b 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+@@ -1169,7 +1169,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
+ }
+
+ vmw_execbuf_copy_fence_user(dev_priv, vmw_fp, 0, user_fence_rep, fence,
+- handle, -1, NULL);
++ handle, -1);
+ vmw_fence_obj_unreference(&fence);
+ return 0;
+ out_no_create:
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index e486b6517ac55..d87bd2a8c75fb 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -2662,7 +2662,7 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv,
+ if (file_priv)
+ vmw_execbuf_copy_fence_user(dev_priv, vmw_fpriv(file_priv),
+ ret, user_fence_rep, fence,
+- handle, -1, NULL);
++ handle, -1);
+ if (out_fence)
+ *out_fence = fence;
+ else
+diff --git a/fs/select.c b/fs/select.c
+index 11a7051075b4f..1c3985d0bcc3e 100644
+--- a/fs/select.c
++++ b/fs/select.c
+@@ -431,9 +431,11 @@ get_max:
+ return max;
+ }
+
+-#define POLLIN_SET (EPOLLRDNORM | EPOLLRDBAND | EPOLLIN | EPOLLHUP | EPOLLERR)
+-#define POLLOUT_SET (EPOLLWRBAND | EPOLLWRNORM | EPOLLOUT | EPOLLERR)
+-#define POLLEX_SET (EPOLLPRI)
++#define POLLIN_SET (EPOLLRDNORM | EPOLLRDBAND | EPOLLIN | EPOLLHUP | EPOLLERR |\
++ EPOLLNVAL)
++#define POLLOUT_SET (EPOLLWRBAND | EPOLLWRNORM | EPOLLOUT | EPOLLERR |\
++ EPOLLNVAL)
++#define POLLEX_SET (EPOLLPRI | EPOLLNVAL)
+
+ static inline void wait_key_set(poll_table *wait, unsigned long in,
+ unsigned long out, unsigned long bit,
+@@ -500,6 +502,7 @@ static int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time)
+ break;
+ if (!(bit & all_bits))
+ continue;
++ mask = EPOLLNVAL;
+ f = fdget(i);
+ if (f.file) {
+ wait_key_set(wait, in, out, bit,
+@@ -507,34 +510,34 @@ static int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time)
+ mask = vfs_poll(f.file, wait);
+
+ fdput(f);
+- if ((mask & POLLIN_SET) && (in & bit)) {
+- res_in |= bit;
+- retval++;
+- wait->_qproc = NULL;
+- }
+- if ((mask & POLLOUT_SET) && (out & bit)) {
+- res_out |= bit;
+- retval++;
+- wait->_qproc = NULL;
+- }
+- if ((mask & POLLEX_SET) && (ex & bit)) {
+- res_ex |= bit;
+- retval++;
+- wait->_qproc = NULL;
+- }
+- /* got something, stop busy polling */
+- if (retval) {
+- can_busy_loop = false;
+- busy_flag = 0;
+-
+- /*
+- * only remember a returned
+- * POLL_BUSY_LOOP if we asked for it
+- */
+- } else if (busy_flag & mask)
+- can_busy_loop = true;
+-
+ }
++ if ((mask & POLLIN_SET) && (in & bit)) {
++ res_in |= bit;
++ retval++;
++ wait->_qproc = NULL;
++ }
++ if ((mask & POLLOUT_SET) && (out & bit)) {
++ res_out |= bit;
++ retval++;
++ wait->_qproc = NULL;
++ }
++ if ((mask & POLLEX_SET) && (ex & bit)) {
++ res_ex |= bit;
++ retval++;
++ wait->_qproc = NULL;
++ }
++ /* got something, stop busy polling */
++ if (retval) {
++ can_busy_loop = false;
++ busy_flag = 0;
++
++ /*
++ * only remember a returned
++ * POLL_BUSY_LOOP if we asked for it
++ */
++ } else if (busy_flag & mask)
++ can_busy_loop = true;
++
+ }
+ if (res_in)
+ *rinp = res_in;
+diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
+index a350c05b7ff5e..7c6b1024dd4b5 100644
+--- a/net/bridge/br_device.c
++++ b/net/bridge/br_device.c
+@@ -42,6 +42,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
+ struct ethhdr *eth;
+ u16 vid = 0;
+
++ memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
++
+ rcu_read_lock();
+ nf_ops = rcu_dereference(nf_br_ops);
+ if (nf_ops && nf_ops->br_dev_xmit_hook(skb)) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-02-08 17:56 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-02-08 17:56 UTC (permalink / raw
To: gentoo-commits
commit: 79b553e704b22f42a793a7452f84bdf53453b509
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Feb 8 17:56:19 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Feb 8 17:56:19 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=79b553e7
Linux patch 4.19.228
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1227_linux-4.19.228.patch | 2831 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2835 insertions(+)
diff --git a/0000_README b/0000_README
index cc68b74d..e1d00b7a 100644
--- a/0000_README
+++ b/0000_README
@@ -947,6 +947,10 @@ Patch: 1226_linux-4.19.227.patch
From: https://www.kernel.org
Desc: Linux 4.19.227
+Patch: 1227_linux-4.19.228.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.228
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1227_linux-4.19.228.patch b/1227_linux-4.19.228.patch
new file mode 100644
index 00000000..8a18f864
--- /dev/null
+++ b/1227_linux-4.19.228.patch
@@ -0,0 +1,2831 @@
+diff --git a/Makefile b/Makefile
+index 1e9652cb9c1fc..1779149108cff 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 227
++SUBLEVEL = 228
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
+index 1e64cfe22a83e..bf19c5514d6c2 100644
+--- a/arch/powerpc/kernel/Makefile
++++ b/arch/powerpc/kernel/Makefile
+@@ -15,6 +15,7 @@ CFLAGS_prom_init.o += -fPIC
+ CFLAGS_btext.o += -fPIC
+ endif
+
++CFLAGS_setup_32.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+ CFLAGS_cputable.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+ CFLAGS_prom_init.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+ CFLAGS_btext.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
+index 6702868089283..36f9130844294 100644
+--- a/arch/powerpc/lib/Makefile
++++ b/arch/powerpc/lib/Makefile
+@@ -10,6 +10,9 @@ ccflags-$(CONFIG_PPC64) := $(NO_MINIMAL_TOC)
+ CFLAGS_REMOVE_code-patching.o = $(CC_FLAGS_FTRACE)
+ CFLAGS_REMOVE_feature-fixups.o = $(CC_FLAGS_FTRACE)
+
++CFLAGS_code-patching.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
++CFLAGS_feature-fixups.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
++
+ obj-y += string.o alloc.o code-patching.o feature-fixups.o
+
+ obj-$(CONFIG_PPC32) += div64.o copy_32.o crtsavres.o strlen_32.o
+diff --git a/arch/s390/hypfs/hypfs_vm.c b/arch/s390/hypfs/hypfs_vm.c
+index c4b7b681e0554..90740be25cf86 100644
+--- a/arch/s390/hypfs/hypfs_vm.c
++++ b/arch/s390/hypfs/hypfs_vm.c
+@@ -20,6 +20,7 @@
+
+ static char local_guest[] = " ";
+ static char all_guests[] = "* ";
++static char *all_groups = all_guests;
+ static char *guest_query;
+
+ struct diag2fc_data {
+@@ -62,10 +63,11 @@ static int diag2fc(int size, char* query, void *addr)
+
+ memcpy(parm_list.userid, query, NAME_LEN);
+ ASCEBC(parm_list.userid, NAME_LEN);
+- parm_list.addr = (unsigned long) addr ;
++ memcpy(parm_list.aci_grp, all_groups, NAME_LEN);
++ ASCEBC(parm_list.aci_grp, NAME_LEN);
++ parm_list.addr = (unsigned long)addr;
+ parm_list.size = size;
+ parm_list.fmt = 0x02;
+- memset(parm_list.aci_grp, 0x40, NAME_LEN);
+ rc = -1;
+
+ diag_stat_inc(DIAG_STAT_X2FC);
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index 0b96220d0efd4..2e22a3f7466a8 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -399,7 +399,7 @@ void bio_integrity_advance(struct bio *bio, unsigned int bytes_done)
+ struct blk_integrity *bi = blk_get_integrity(bio->bi_disk);
+ unsigned bytes = bio_integrity_bytes(bi, bytes_done >> 9);
+
+- bip->bip_iter.bi_sector += bytes_done >> 9;
++ bip->bip_iter.bi_sector += bio_integrity_intervals(bi, bytes_done >> 9);
+ bvec_iter_advance(bip->bip_vec, &bip->bip_iter, bytes);
+ }
+ EXPORT_SYMBOL(bio_integrity_advance);
+diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c
+index 56de378ad13dc..3145d009d541b 100644
+--- a/drivers/edac/altera_edac.c
++++ b/drivers/edac/altera_edac.c
+@@ -366,7 +366,7 @@ static int altr_sdram_probe(struct platform_device *pdev)
+ if (irq < 0) {
+ edac_printk(KERN_ERR, EDAC_MC,
+ "No irq %d in DT\n", irq);
+- return -ENODEV;
++ return irq;
+ }
+
+ /* Arria10 has a 2nd IRQ */
+diff --git a/drivers/edac/xgene_edac.c b/drivers/edac/xgene_edac.c
+index e8b81d7ef61fa..028ddc7903254 100644
+--- a/drivers/edac/xgene_edac.c
++++ b/drivers/edac/xgene_edac.c
+@@ -1934,7 +1934,7 @@ static int xgene_edac_probe(struct platform_device *pdev)
+ irq = platform_get_irq(pdev, i);
+ if (irq < 0) {
+ dev_err(&pdev->dev, "No IRQ resource\n");
+- rc = -EINVAL;
++ rc = irq;
+ goto out_err;
+ }
+ rc = devm_request_irq(&pdev->dev, irq,
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+index 2b57a581b29e2..b60623d1db0ea 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+@@ -444,8 +444,8 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data,
+ return -EINVAL;
+ }
+
+- if (args->stream_size > SZ_64K || args->nr_relocs > SZ_64K ||
+- args->nr_bos > SZ_64K || args->nr_pmrs > 128) {
++ if (args->stream_size > SZ_128K || args->nr_relocs > SZ_128K ||
++ args->nr_bos > SZ_128K || args->nr_pmrs > 128) {
+ DRM_ERROR("submit arguments out of size limits\n");
+ return -EINVAL;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
+index 443dfaefd7a6b..bcfbba14f2171 100644
+--- a/drivers/gpu/drm/i915/intel_overlay.c
++++ b/drivers/gpu/drm/i915/intel_overlay.c
+@@ -929,6 +929,9 @@ static int check_overlay_dst(struct intel_overlay *overlay,
+ const struct intel_crtc_state *pipe_config =
+ overlay->crtc->config;
+
++ if (rec->dst_height == 0 || rec->dst_width == 0)
++ return -EINVAL;
++
+ if (rec->dst_x < pipe_config->pipe_src_w &&
+ rec->dst_x + rec->dst_width <= pipe_config->pipe_src_w &&
+ rec->dst_y < pipe_config->pipe_src_h &&
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+index c630871de7c5b..f01e245cd0eee 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+@@ -667,12 +667,14 @@ void __exit msm_dsi_phy_driver_unregister(void)
+ int msm_dsi_phy_enable(struct msm_dsi_phy *phy, int src_pll_id,
+ struct msm_dsi_phy_clk_request *clk_req)
+ {
+- struct device *dev = &phy->pdev->dev;
++ struct device *dev;
+ int ret;
+
+ if (!phy || !phy->cfg->ops.enable)
+ return -EINVAL;
+
++ dev = &phy->pdev->dev;
++
+ ret = dsi_phy_enable_resource(phy);
+ if (ret) {
+ dev_err(dev, "%s: resource enable failed, %d\n",
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 08ff9d7645d74..11bad11101b9e 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -388,7 +388,7 @@ static int msm_init_vram(struct drm_device *dev)
+ of_node_put(node);
+ if (ret)
+ return ret;
+- size = r.end - r.start;
++ size = r.end - r.start + 1;
+ DRM_INFO("using VRAM carveout: %lx@%pa\n", size, &r.start);
+
+ /* if we have no IOMMU, then we need to use carveout allocator.
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c
+index f3c30b2a788e8..8bff14ae16b0e 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c
+@@ -38,7 +38,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 *addr, u8 size)
+ *addr += bios->imaged_addr;
+ }
+
+- if (unlikely(*addr + size >= bios->size)) {
++ if (unlikely(*addr + size > bios->size)) {
+ nvkm_error(&bios->subdev, "OOB %d %08x %08x\n", size, p, *addr);
+ return false;
+ }
+diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
+index 30a7f7fde6511..033c89f8359d1 100644
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -359,7 +359,7 @@ static const struct lm90_params lm90_params[] = {
+ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
+ | LM90_HAVE_BROKEN_ALERT,
+ .alert_alarms = 0x7c,
+- .max_convrate = 8,
++ .max_convrate = 7,
+ },
+ [lm86] = {
+ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
+diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
+index e64d934f7bac7..10d7aa87beaed 100644
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -3351,7 +3351,7 @@ static void mlx4_ib_event(struct mlx4_dev *dev, void *ibdev_ptr,
+ case MLX4_DEV_EVENT_PORT_MGMT_CHANGE:
+ ew = kmalloc(sizeof *ew, GFP_ATOMIC);
+ if (!ew)
+- break;
++ return;
+
+ INIT_WORK(&ew->work, handle_port_mgmt_change_event);
+ memcpy(&ew->ib_eqe, eqe, sizeof *eqe);
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index c7d0bb3b4a307..76ae6968801e4 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -30,6 +30,7 @@
+ #include <linux/iommu.h>
+ #include <linux/kmemleak.h>
+ #include <linux/mem_encrypt.h>
++#include <linux/iopoll.h>
+ #include <asm/pci-direct.h>
+ #include <asm/iommu.h>
+ #include <asm/gart.h>
+@@ -772,6 +773,7 @@ static int iommu_ga_log_enable(struct amd_iommu *iommu)
+ status = readl(iommu->mmio_base + MMIO_STATUS_OFFSET);
+ if (status & (MMIO_STATUS_GALOG_RUN_MASK))
+ break;
++ udelay(10);
+ }
+
+ if (i >= LOOP_TIMEOUT)
+diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
+index cd2e5b44119ad..17fc262f2ee88 100644
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -543,9 +543,8 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)
+ fn, &intel_ir_domain_ops,
+ iommu);
+ if (!iommu->ir_domain) {
+- irq_domain_free_fwnode(fn);
+ pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id);
+- goto out_free_bitmap;
++ goto out_free_fwnode;
+ }
+ iommu->ir_msi_domain =
+ arch_create_remap_msi_irq_domain(iommu->ir_domain,
+@@ -569,7 +568,7 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)
+
+ if (dmar_enable_qi(iommu)) {
+ pr_err("Failed to enable queued invalidation\n");
+- goto out_free_bitmap;
++ goto out_free_ir_domain;
+ }
+ }
+
+@@ -593,6 +592,14 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu)
+
+ return 0;
+
++out_free_ir_domain:
++ if (iommu->ir_msi_domain)
++ irq_domain_remove(iommu->ir_msi_domain);
++ iommu->ir_msi_domain = NULL;
++ irq_domain_remove(iommu->ir_domain);
++ iommu->ir_domain = NULL;
++out_free_fwnode:
++ irq_domain_free_fwnode(fn);
+ out_free_bitmap:
+ kfree(bitmap);
+ out_free_pages:
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 80cf6af822f72..35659f0dbe74e 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -722,7 +722,9 @@ static void xgbe_stop_timers(struct xgbe_prv_data *pdata)
+ if (!channel->tx_ring)
+ break;
+
++ /* Deactivate the Tx timer */
+ del_timer_sync(&channel->tx_timer);
++ channel->tx_timer_active = 0;
+ }
+ }
+
+@@ -2766,6 +2768,14 @@ read_again:
+ buf2_len = xgbe_rx_buf2_len(rdata, packet, len);
+ len += buf2_len;
+
++ if (buf2_len > rdata->rx.buf.dma_len) {
++ /* Hardware inconsistency within the descriptors
++ * that has resulted in a length underflow.
++ */
++ error = 1;
++ goto skip_data;
++ }
++
+ if (!skb) {
+ skb = xgbe_create_skb(pdata, napi, rdata,
+ buf1_len);
+@@ -2795,8 +2805,10 @@ skip_data:
+ if (!last || context_next)
+ goto read_again;
+
+- if (!skb)
++ if (!skb || error) {
++ dev_kfree_skb(skb);
+ goto next_packet;
++ }
+
+ /* Be sure we don't exceed the configured MTU */
+ max_len = netdev->mtu + ETH_HLEN;
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index c52c26fc44e59..ffea634e03e8a 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -3044,11 +3044,25 @@ static void ibmvnic_send_req_caps(struct ibmvnic_adapter *adapter, int retry)
+ struct device *dev = &adapter->vdev->dev;
+ union ibmvnic_crq crq;
+ int max_entries;
++ int cap_reqs;
++
++ /* We send out 6 or 7 REQUEST_CAPABILITY CRQs below (depending on
++ * the PROMISC flag). Initialize this count upfront. When the tasklet
++ * receives a response to all of these, it will send the next protocol
++ * message (QUERY_IP_OFFLOAD).
++ */
++ if (!(adapter->netdev->flags & IFF_PROMISC) ||
++ adapter->promisc_supported)
++ cap_reqs = 7;
++ else
++ cap_reqs = 6;
+
+ if (!retry) {
+ /* Sub-CRQ entries are 32 byte long */
+ int entries_page = 4 * PAGE_SIZE / (sizeof(u64) * 4);
+
++ atomic_set(&adapter->running_cap_crqs, cap_reqs);
++
+ if (adapter->min_tx_entries_per_subcrq > entries_page ||
+ adapter->min_rx_add_entries_per_subcrq > entries_page) {
+ dev_err(dev, "Fatal, invalid entries per sub-crq\n");
+@@ -3109,44 +3123,45 @@ static void ibmvnic_send_req_caps(struct ibmvnic_adapter *adapter, int retry)
+ adapter->opt_rx_comp_queues;
+
+ adapter->req_rx_add_queues = adapter->max_rx_add_queues;
++ } else {
++ atomic_add(cap_reqs, &adapter->running_cap_crqs);
+ }
+-
+ memset(&crq, 0, sizeof(crq));
+ crq.request_capability.first = IBMVNIC_CRQ_CMD;
+ crq.request_capability.cmd = REQUEST_CAPABILITY;
+
+ crq.request_capability.capability = cpu_to_be16(REQ_TX_QUEUES);
+ crq.request_capability.number = cpu_to_be64(adapter->req_tx_queues);
+- atomic_inc(&adapter->running_cap_crqs);
++ cap_reqs--;
+ ibmvnic_send_crq(adapter, &crq);
+
+ crq.request_capability.capability = cpu_to_be16(REQ_RX_QUEUES);
+ crq.request_capability.number = cpu_to_be64(adapter->req_rx_queues);
+- atomic_inc(&adapter->running_cap_crqs);
++ cap_reqs--;
+ ibmvnic_send_crq(adapter, &crq);
+
+ crq.request_capability.capability = cpu_to_be16(REQ_RX_ADD_QUEUES);
+ crq.request_capability.number = cpu_to_be64(adapter->req_rx_add_queues);
+- atomic_inc(&adapter->running_cap_crqs);
++ cap_reqs--;
+ ibmvnic_send_crq(adapter, &crq);
+
+ crq.request_capability.capability =
+ cpu_to_be16(REQ_TX_ENTRIES_PER_SUBCRQ);
+ crq.request_capability.number =
+ cpu_to_be64(adapter->req_tx_entries_per_subcrq);
+- atomic_inc(&adapter->running_cap_crqs);
++ cap_reqs--;
+ ibmvnic_send_crq(adapter, &crq);
+
+ crq.request_capability.capability =
+ cpu_to_be16(REQ_RX_ADD_ENTRIES_PER_SUBCRQ);
+ crq.request_capability.number =
+ cpu_to_be64(adapter->req_rx_add_entries_per_subcrq);
+- atomic_inc(&adapter->running_cap_crqs);
++ cap_reqs--;
+ ibmvnic_send_crq(adapter, &crq);
+
+ crq.request_capability.capability = cpu_to_be16(REQ_MTU);
+ crq.request_capability.number = cpu_to_be64(adapter->req_mtu);
+- atomic_inc(&adapter->running_cap_crqs);
++ cap_reqs--;
+ ibmvnic_send_crq(adapter, &crq);
+
+ if (adapter->netdev->flags & IFF_PROMISC) {
+@@ -3154,16 +3169,21 @@ static void ibmvnic_send_req_caps(struct ibmvnic_adapter *adapter, int retry)
+ crq.request_capability.capability =
+ cpu_to_be16(PROMISC_REQUESTED);
+ crq.request_capability.number = cpu_to_be64(1);
+- atomic_inc(&adapter->running_cap_crqs);
++ cap_reqs--;
+ ibmvnic_send_crq(adapter, &crq);
+ }
+ } else {
+ crq.request_capability.capability =
+ cpu_to_be16(PROMISC_REQUESTED);
+ crq.request_capability.number = cpu_to_be64(0);
+- atomic_inc(&adapter->running_cap_crqs);
++ cap_reqs--;
+ ibmvnic_send_crq(adapter, &crq);
+ }
++
++ /* Keep at end to catch any discrepancy between expected and actual
++ * CRQs sent.
++ */
++ WARN_ON(cap_reqs != 0);
+ }
+
+ static int pending_scrq(struct ibmvnic_adapter *adapter,
+@@ -3568,118 +3588,132 @@ static void send_map_query(struct ibmvnic_adapter *adapter)
+ static void send_cap_queries(struct ibmvnic_adapter *adapter)
+ {
+ union ibmvnic_crq crq;
++ int cap_reqs;
++
++ /* We send out 25 QUERY_CAPABILITY CRQs below. Initialize this count
++ * upfront. When the tasklet receives a response to all of these, it
++ * can send out the next protocol messaage (REQUEST_CAPABILITY).
++ */
++ cap_reqs = 25;
++
++ atomic_set(&adapter->running_cap_crqs, cap_reqs);
+
+- atomic_set(&adapter->running_cap_crqs, 0);
+ memset(&crq, 0, sizeof(crq));
+ crq.query_capability.first = IBMVNIC_CRQ_CMD;
+ crq.query_capability.cmd = QUERY_CAPABILITY;
+
+ crq.query_capability.capability = cpu_to_be16(MIN_TX_QUEUES);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(MIN_RX_QUEUES);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(MIN_RX_ADD_QUEUES);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(MAX_TX_QUEUES);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(MAX_RX_QUEUES);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(MAX_RX_ADD_QUEUES);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability =
+ cpu_to_be16(MIN_TX_ENTRIES_PER_SUBCRQ);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability =
+ cpu_to_be16(MIN_RX_ADD_ENTRIES_PER_SUBCRQ);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability =
+ cpu_to_be16(MAX_TX_ENTRIES_PER_SUBCRQ);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability =
+ cpu_to_be16(MAX_RX_ADD_ENTRIES_PER_SUBCRQ);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(TCP_IP_OFFLOAD);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(PROMISC_SUPPORTED);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(MIN_MTU);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(MAX_MTU);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(MAX_MULTICAST_FILTERS);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(VLAN_HEADER_INSERTION);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(RX_VLAN_HEADER_INSERTION);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(MAX_TX_SG_ENTRIES);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(RX_SG_SUPPORTED);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(OPT_TX_COMP_SUB_QUEUES);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(OPT_RX_COMP_QUEUES);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability =
+ cpu_to_be16(OPT_RX_BUFADD_Q_PER_RX_COMP_Q);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability =
+ cpu_to_be16(OPT_TX_ENTRIES_PER_SUBCRQ);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability =
+ cpu_to_be16(OPT_RXBA_ENTRIES_PER_SUBCRQ);
+- atomic_inc(&adapter->running_cap_crqs);
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
+
+ crq.query_capability.capability = cpu_to_be16(TX_RX_DESC_REQ);
+- atomic_inc(&adapter->running_cap_crqs);
++
+ ibmvnic_send_crq(adapter, &crq);
++ cap_reqs--;
++
++ /* Keep at end to catch any discrepancy between expected and actual
++ * CRQs sent.
++ */
++ WARN_ON(cap_reqs != 0);
+ }
+
+ static void handle_vpd_size_rsp(union ibmvnic_crq *crq,
+@@ -3923,6 +3957,8 @@ static void handle_request_cap_rsp(union ibmvnic_crq *crq,
+ char *name;
+
+ atomic_dec(&adapter->running_cap_crqs);
++ netdev_dbg(adapter->netdev, "Outstanding request-caps: %d\n",
++ atomic_read(&adapter->running_cap_crqs));
+ switch (be16_to_cpu(crq->request_capability_rsp.capability)) {
+ case REQ_TX_QUEUES:
+ req_value = &adapter->req_tx_queues;
+@@ -4457,12 +4493,6 @@ static void ibmvnic_tasklet(void *data)
+ ibmvnic_handle_crq(crq, adapter);
+ crq->generic.first = 0;
+ }
+-
+- /* remain in tasklet until all
+- * capabilities responses are received
+- */
+- if (!adapter->wait_capability)
+- done = true;
+ }
+ /* if capabilities CRQ's were sent in this tasklet, the following
+ * tasklet must wait until all responses are received
+diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
+index 519b595944235..dc99e296f349e 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -179,7 +179,6 @@ enum i40e_interrupt_policy {
+
+ struct i40e_lump_tracking {
+ u16 num_entries;
+- u16 search_hint;
+ u16 list[0];
+ #define I40E_PILE_VALID_BIT 0x8000
+ #define I40E_IWARP_IRQ_PILE_ID (I40E_PILE_VALID_BIT - 2)
+@@ -709,12 +708,12 @@ struct i40e_vsi {
+ struct rtnl_link_stats64 net_stats_offsets;
+ struct i40e_eth_stats eth_stats;
+ struct i40e_eth_stats eth_stats_offsets;
+- u32 tx_restart;
+- u32 tx_busy;
++ u64 tx_restart;
++ u64 tx_busy;
+ u64 tx_linearize;
+ u64 tx_force_wb;
+- u32 rx_buf_failed;
+- u32 rx_page_failed;
++ u64 rx_buf_failed;
++ u64 rx_page_failed;
+
+ /* These are containers of ring pointers, allocated at run-time */
+ struct i40e_ring **rx_rings;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+index 56b911a5dd8be..a66492b9403c4 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+@@ -236,7 +236,7 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid)
+ (unsigned long int)vsi->net_stats_offsets.rx_compressed,
+ (unsigned long int)vsi->net_stats_offsets.tx_compressed);
+ dev_info(&pf->pdev->dev,
+- " tx_restart = %d, tx_busy = %d, rx_buf_failed = %d, rx_page_failed = %d\n",
++ " tx_restart = %llu, tx_busy = %llu, rx_buf_failed = %llu, rx_page_failed = %llu\n",
+ vsi->tx_restart, vsi->tx_busy,
+ vsi->rx_buf_failed, vsi->rx_page_failed);
+ rcu_read_lock();
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 1fadc4991c48e..21ea0cdea6668 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -193,10 +193,6 @@ int i40e_free_virt_mem_d(struct i40e_hw *hw, struct i40e_virt_mem *mem)
+ * @id: an owner id to stick on the items assigned
+ *
+ * Returns the base item index of the lump, or negative for error
+- *
+- * The search_hint trick and lack of advanced fit-finding only work
+- * because we're highly likely to have all the same size lump requests.
+- * Linear search time and any fragmentation should be minimal.
+ **/
+ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
+ u16 needed, u16 id)
+@@ -211,8 +207,21 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
+ return -EINVAL;
+ }
+
+- /* start the linear search with an imperfect hint */
+- i = pile->search_hint;
++ /* Allocate last queue in the pile for FDIR VSI queue
++ * so it doesn't fragment the qp_pile
++ */
++ if (pile == pf->qp_pile && pf->vsi[id]->type == I40E_VSI_FDIR) {
++ if (pile->list[pile->num_entries - 1] & I40E_PILE_VALID_BIT) {
++ dev_err(&pf->pdev->dev,
++ "Cannot allocate queue %d for I40E_VSI_FDIR\n",
++ pile->num_entries - 1);
++ return -ENOMEM;
++ }
++ pile->list[pile->num_entries - 1] = id | I40E_PILE_VALID_BIT;
++ return pile->num_entries - 1;
++ }
++
++ i = 0;
+ while (i < pile->num_entries) {
+ /* skip already allocated entries */
+ if (pile->list[i] & I40E_PILE_VALID_BIT) {
+@@ -231,7 +240,6 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
+ for (j = 0; j < needed; j++)
+ pile->list[i+j] = id | I40E_PILE_VALID_BIT;
+ ret = i;
+- pile->search_hint = i + j;
+ break;
+ }
+
+@@ -254,7 +262,7 @@ static int i40e_put_lump(struct i40e_lump_tracking *pile, u16 index, u16 id)
+ {
+ int valid_id = (id | I40E_PILE_VALID_BIT);
+ int count = 0;
+- int i;
++ u16 i;
+
+ if (!pile || index >= pile->num_entries)
+ return -EINVAL;
+@@ -266,8 +274,6 @@ static int i40e_put_lump(struct i40e_lump_tracking *pile, u16 index, u16 id)
+ count++;
+ }
+
+- if (count && index < pile->search_hint)
+- pile->search_hint = index;
+
+ return count;
+ }
+@@ -785,9 +791,9 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi)
+ struct rtnl_link_stats64 *ns; /* netdev stats */
+ struct i40e_eth_stats *oes;
+ struct i40e_eth_stats *es; /* device's eth stats */
+- u32 tx_restart, tx_busy;
++ u64 tx_restart, tx_busy;
+ struct i40e_ring *p;
+- u32 rx_page, rx_buf;
++ u64 rx_page, rx_buf;
+ u64 bytes, packets;
+ unsigned int start;
+ u64 tx_linearize;
+@@ -9486,15 +9492,9 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
+ }
+ i40e_get_oem_version(&pf->hw);
+
+- if (test_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state) &&
+- ((hw->aq.fw_maj_ver == 4 && hw->aq.fw_min_ver <= 33) ||
+- hw->aq.fw_maj_ver < 4) && hw->mac.type == I40E_MAC_XL710) {
+- /* The following delay is necessary for 4.33 firmware and older
+- * to recover after EMP reset. 200 ms should suffice but we
+- * put here 300 ms to be sure that FW is ready to operate
+- * after reset.
+- */
+- mdelay(300);
++ if (test_and_clear_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state)) {
++ /* The following delay is necessary for firmware update. */
++ mdelay(1000);
+ }
+
+ /* re-verify the eeprom if we just had an EMP reset */
+@@ -10733,7 +10733,6 @@ static int i40e_init_interrupt_scheme(struct i40e_pf *pf)
+ return -ENOMEM;
+
+ pf->irq_pile->num_entries = vectors;
+- pf->irq_pile->search_hint = 0;
+
+ /* track first vector for misc interrupts, ignore return */
+ (void)i40e_get_lump(pf, pf->irq_pile, 1, I40E_PILE_VALID_BIT - 1);
+@@ -11442,7 +11441,6 @@ static int i40e_sw_init(struct i40e_pf *pf)
+ goto sw_init_done;
+ }
+ pf->qp_pile->num_entries = pf->hw.func_caps.num_tx_qp;
+- pf->qp_pile->search_hint = 0;
+
+ pf->tx_timeout_recovery_level = 1;
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 55710028c99f3..a39a8fe073ca8 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2338,6 +2338,59 @@ error_param:
+ aq_ret);
+ }
+
++/**
++ * i40e_check_enough_queue - find big enough queue number
++ * @vf: pointer to the VF info
++ * @needed: the number of items needed
++ *
++ * Returns the base item index of the queue, or negative for error
++ **/
++static int i40e_check_enough_queue(struct i40e_vf *vf, u16 needed)
++{
++ unsigned int i, cur_queues, more, pool_size;
++ struct i40e_lump_tracking *pile;
++ struct i40e_pf *pf = vf->pf;
++ struct i40e_vsi *vsi;
++
++ vsi = pf->vsi[vf->lan_vsi_idx];
++ cur_queues = vsi->alloc_queue_pairs;
++
++ /* if current allocated queues are enough for need */
++ if (cur_queues >= needed)
++ return vsi->base_queue;
++
++ pile = pf->qp_pile;
++ if (cur_queues > 0) {
++ /* if the allocated queues are not zero
++ * just check if there are enough queues for more
++ * behind the allocated queues.
++ */
++ more = needed - cur_queues;
++ for (i = vsi->base_queue + cur_queues;
++ i < pile->num_entries; i++) {
++ if (pile->list[i] & I40E_PILE_VALID_BIT)
++ break;
++
++ if (more-- == 1)
++ /* there is enough */
++ return vsi->base_queue;
++ }
++ }
++
++ pool_size = 0;
++ for (i = 0; i < pile->num_entries; i++) {
++ if (pile->list[i] & I40E_PILE_VALID_BIT) {
++ pool_size = 0;
++ continue;
++ }
++ if (needed <= ++pool_size)
++ /* there is enough */
++ return i;
++ }
++
++ return -ENOMEM;
++}
++
+ /**
+ * i40e_vc_request_queues_msg
+ * @vf: pointer to the VF info
+@@ -2377,6 +2430,12 @@ static int i40e_vc_request_queues_msg(struct i40e_vf *vf, u8 *msg, int msglen)
+ req_pairs - cur_pairs,
+ pf->queues_left);
+ vfres->num_queue_pairs = pf->queues_left + cur_pairs;
++ } else if (i40e_check_enough_queue(vf, req_pairs) < 0) {
++ dev_warn(&pf->pdev->dev,
++ "VF %d requested %d more queues, but there is not enough for it.\n",
++ vf->vf_id,
++ req_pairs - cur_pairs);
++ vfres->num_queue_pairs = cur_pairs;
+ } else {
+ /* successful request */
+ vf->num_req_queues = req_pairs;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+index e1fbd7c81bfa9..08a058e1bc75c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+@@ -159,15 +159,20 @@ static int adjust_systime(void __iomem *ioaddr, u32 sec, u32 nsec,
+
+ static void get_systime(void __iomem *ioaddr, u64 *systime)
+ {
+- u64 ns;
+-
+- /* Get the TSSS value */
+- ns = readl(ioaddr + PTP_STNSR);
+- /* Get the TSS and convert sec time value to nanosecond */
+- ns += readl(ioaddr + PTP_STSR) * 1000000000ULL;
++ u64 ns, sec0, sec1;
++
++ /* Get the TSS value */
++ sec1 = readl_relaxed(ioaddr + PTP_STSR);
++ do {
++ sec0 = sec1;
++ /* Get the TSSS value */
++ ns = readl_relaxed(ioaddr + PTP_STNSR);
++ /* Get the TSS value */
++ sec1 = readl_relaxed(ioaddr + PTP_STSR);
++ } while (sec0 != sec1);
+
+ if (systime)
+- *systime = ns;
++ *systime = ns + (sec1 * 1000000000ULL);
+ }
+
+ const struct stmmac_hwtimestamp stmmac_ptp = {
+diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
+index fdab498725878..3db86f247bf45 100644
+--- a/drivers/net/hamradio/yam.c
++++ b/drivers/net/hamradio/yam.c
+@@ -966,9 +966,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ sizeof(struct yamdrv_ioctl_mcs));
+ if (IS_ERR(ym))
+ return PTR_ERR(ym);
+- if (ym->cmd != SIOCYAMSMCS)
+- return -EINVAL;
+- if (ym->bitrate > YAM_MAXBITRATE) {
++ if (ym->cmd != SIOCYAMSMCS || ym->bitrate > YAM_MAXBITRATE) {
+ kfree(ym);
+ return -EINVAL;
+ }
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index deace0aadad24..3169c174006ab 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -1769,6 +1769,7 @@ static int ca8210_async_xmit_complete(
+ status
+ );
+ if (status != MAC_TRANSACTION_OVERFLOW) {
++ dev_kfree_skb_any(priv->tx_skb);
+ ieee802154_wake_queue(priv->hw);
+ return 0;
+ }
+diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
+index ed60e691cc2b4..d07e5571e07ae 100644
+--- a/drivers/net/ieee802154/mac802154_hwsim.c
++++ b/drivers/net/ieee802154/mac802154_hwsim.c
+@@ -805,6 +805,7 @@ static int hwsim_add_one(struct genl_info *info, struct device *dev,
+ goto err_pib;
+ }
+
++ pib->channel = 13;
+ rcu_assign_pointer(phy->pib, pib);
+ phy->idx = idx;
+ INIT_LIST_HEAD(&phy->edges);
+diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
+index fe4057fca83d8..7c7ef32f99655 100644
+--- a/drivers/net/ieee802154/mcr20a.c
++++ b/drivers/net/ieee802154/mcr20a.c
+@@ -1005,8 +1005,8 @@ static void mcr20a_hw_setup(struct mcr20a_local *lp)
+ dev_dbg(printdev(lp), "%s\n", __func__);
+
+ phy->symbol_duration = 16;
+- phy->lifs_period = 40;
+- phy->sifs_period = 12;
++ phy->lifs_period = 40 * phy->symbol_duration;
++ phy->sifs_period = 12 * phy->symbol_duration;
+
+ hw->flags = IEEE802154_HW_TX_OMIT_CKSUM |
+ IEEE802154_HW_AFILT |
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 4c5b67a2d63a0..6c0f80bea8161 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -3259,6 +3259,15 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+
+ macsec->real_dev = real_dev;
+
++ /* send_sci must be set to true when transmit sci explicitly is set */
++ if ((data && data[IFLA_MACSEC_SCI]) &&
++ (data && data[IFLA_MACSEC_INC_SCI])) {
++ u8 send_sci = !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]);
++
++ if (!send_sci)
++ return -EINVAL;
++ }
++
+ if (data && data[IFLA_MACSEC_ICV_LEN])
+ icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]);
+ mtu = real_dev->mtu - icv_len - macsec_extra_len(true);
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index b884b681d5c52..a03d0627efb06 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1166,6 +1166,9 @@ void phy_detach(struct phy_device *phydev)
+ phydev->mdio.dev.driver == &genphy_driver.mdiodrv.driver)
+ device_release_driver(&phydev->mdio.dev);
+
++ /* Assert the reset signal */
++ phy_device_reset(phydev, 1);
++
+ /*
+ * The phydev might go away on the put_device() below, so avoid
+ * a use-after-free bug by reading the underlying bus first.
+@@ -1175,9 +1178,6 @@ void phy_detach(struct phy_device *phydev)
+ put_device(&phydev->mdio.dev);
+ if (ndev_owner != bus->owner)
+ module_put(bus->owner);
+-
+- /* Assert the reset signal */
+- phy_device_reset(phydev, 1);
+ }
+ EXPORT_SYMBOL(phy_detach);
+
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index e808efd762122..e0e175c691d45 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -554,6 +554,11 @@ static int phylink_register_sfp(struct phylink *pl,
+ return ret;
+ }
+
++ if (!fwnode_device_is_available(ref.fwnode)) {
++ fwnode_handle_put(ref.fwnode);
++ return 0;
++ }
++
+ pl->sfp_bus = sfp_register_upstream(ref.fwnode, pl->netdev, pl,
+ &sfp_phylink_ops);
+ if (!pl->sfp_bus)
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index 8e2eb20613548..cea005cc7b2ab 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -173,7 +173,7 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
+ if (tx_buf == NULL)
+ goto free_rx_urb;
+
+- rx_buf = usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE,
++ rx_buf = usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN,
+ GFP_KERNEL, &rx_urb->transfer_dma);
+ if (rx_buf == NULL)
+ goto free_tx_buf;
+@@ -198,7 +198,7 @@ error_nomem:
+
+ static void ipheth_free_urbs(struct ipheth_device *iphone)
+ {
+- usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf,
++ usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, iphone->rx_buf,
+ iphone->rx_urb->transfer_dma);
+ usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf,
+ iphone->tx_urb->transfer_dma);
+@@ -371,7 +371,7 @@ static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags)
+
+ usb_fill_bulk_urb(dev->rx_urb, udev,
+ usb_rcvbulkpipe(udev, dev->bulk_in),
+- dev->rx_buf, IPHETH_BUF_SIZE,
++ dev->rx_buf, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN,
+ ipheth_rcvbulk_callback,
+ dev);
+ dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
+index a76b963a7e50f..d153fb1bf65f1 100644
+--- a/drivers/rpmsg/rpmsg_char.c
++++ b/drivers/rpmsg/rpmsg_char.c
+@@ -92,7 +92,7 @@ static int rpmsg_eptdev_destroy(struct device *dev, void *data)
+ /* wake up any blocked readers */
+ wake_up_interruptible(&eptdev->readq);
+
+- device_del(&eptdev->dev);
++ cdev_device_del(&eptdev->cdev, &eptdev->dev);
+ put_device(&eptdev->dev);
+
+ return 0;
+@@ -329,7 +329,6 @@ static void rpmsg_eptdev_release_device(struct device *dev)
+
+ ida_simple_remove(&rpmsg_ept_ida, dev->id);
+ ida_simple_remove(&rpmsg_minor_ida, MINOR(eptdev->dev.devt));
+- cdev_del(&eptdev->cdev);
+ kfree(eptdev);
+ }
+
+@@ -374,19 +373,13 @@ static int rpmsg_eptdev_create(struct rpmsg_ctrldev *ctrldev,
+ dev->id = ret;
+ dev_set_name(dev, "rpmsg%d", ret);
+
+- ret = cdev_add(&eptdev->cdev, dev->devt, 1);
++ ret = cdev_device_add(&eptdev->cdev, &eptdev->dev);
+ if (ret)
+ goto free_ept_ida;
+
+ /* We can now rely on the release function for cleanup */
+ dev->release = rpmsg_eptdev_release_device;
+
+- ret = device_add(dev);
+- if (ret) {
+- dev_err(dev, "device_add failed: %d\n", ret);
+- put_device(dev);
+- }
+-
+ return ret;
+
+ free_ept_ida:
+@@ -455,7 +448,6 @@ static void rpmsg_ctrldev_release_device(struct device *dev)
+
+ ida_simple_remove(&rpmsg_ctrl_ida, dev->id);
+ ida_simple_remove(&rpmsg_minor_ida, MINOR(dev->devt));
+- cdev_del(&ctrldev->cdev);
+ kfree(ctrldev);
+ }
+
+@@ -490,19 +482,13 @@ static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev)
+ dev->id = ret;
+ dev_set_name(&ctrldev->dev, "rpmsg_ctrl%d", ret);
+
+- ret = cdev_add(&ctrldev->cdev, dev->devt, 1);
++ ret = cdev_device_add(&ctrldev->cdev, &ctrldev->dev);
+ if (ret)
+ goto free_ctrl_ida;
+
+ /* We can now rely on the release function for cleanup */
+ dev->release = rpmsg_ctrldev_release_device;
+
+- ret = device_add(dev);
+- if (ret) {
+- dev_err(&rpdev->dev, "device_add failed: %d\n", ret);
+- put_device(dev);
+- }
+-
+ dev_set_drvdata(&rpdev->dev, ctrldev);
+
+ return ret;
+@@ -528,7 +514,7 @@ static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev)
+ if (ret)
+ dev_warn(&rpdev->dev, "failed to nuke endpoints: %d\n", ret);
+
+- device_del(&ctrldev->dev);
++ cdev_device_del(&ctrldev->cdev, &ctrldev->dev);
+ put_device(&ctrldev->dev);
+ }
+
+diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c
+index 18a6f15e313d8..86b8858917b62 100644
+--- a/drivers/rtc/rtc-mc146818-lib.c
++++ b/drivers/rtc/rtc-mc146818-lib.c
+@@ -82,7 +82,7 @@ unsigned int mc146818_get_time(struct rtc_time *time)
+ time->tm_year += real_year - 72;
+ #endif
+
+- if (century > 20)
++ if (century > 19)
+ time->tm_year += (century - 19) * 100;
+
+ /*
+diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
+index 5eb7aabe2d8b2..09ce175bbfcf6 100644
+--- a/drivers/s390/scsi/zfcp_fc.c
++++ b/drivers/s390/scsi/zfcp_fc.c
+@@ -521,6 +521,8 @@ static void zfcp_fc_adisc_handler(void *data)
+ goto out;
+ }
+
++ /* re-init to undo drop from zfcp_fc_adisc() */
++ port->d_id = ntoh24(adisc_resp->adisc_port_id);
+ /* port is good, unblock rport without going through erp */
+ zfcp_scsi_schedule_rport_register(port);
+ out:
+@@ -534,6 +536,7 @@ static int zfcp_fc_adisc(struct zfcp_port *port)
+ struct zfcp_fc_req *fc_req;
+ struct zfcp_adapter *adapter = port->adapter;
+ struct Scsi_Host *shost = adapter->scsi_host;
++ u32 d_id;
+ int ret;
+
+ fc_req = kmem_cache_zalloc(zfcp_fc_req_cache, GFP_ATOMIC);
+@@ -558,7 +561,15 @@ static int zfcp_fc_adisc(struct zfcp_port *port)
+ fc_req->u.adisc.req.adisc_cmd = ELS_ADISC;
+ hton24(fc_req->u.adisc.req.adisc_port_id, fc_host_port_id(shost));
+
+- ret = zfcp_fsf_send_els(adapter, port->d_id, &fc_req->ct_els,
++ d_id = port->d_id; /* remember as destination for send els below */
++ /*
++ * Force fresh GID_PN lookup on next port recovery.
++ * Must happen after request setup and before sending request,
++ * to prevent race with port->d_id re-init in zfcp_fc_adisc_handler().
++ */
++ port->d_id = 0;
++
++ ret = zfcp_fsf_send_els(adapter, d_id, &fc_req->ct_els,
+ ZFCP_FC_CTELS_TMO);
+ if (ret)
+ kmem_cache_free(zfcp_fc_req_cache, fc_req);
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+index 780651c4fc0c4..ea2c601da8e15 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+@@ -80,7 +80,7 @@ static int bnx2fc_bind_pcidev(struct bnx2fc_hba *hba);
+ static void bnx2fc_unbind_pcidev(struct bnx2fc_hba *hba);
+ static struct fc_lport *bnx2fc_if_create(struct bnx2fc_interface *interface,
+ struct device *parent, int npiv);
+-static void bnx2fc_destroy_work(struct work_struct *work);
++static void bnx2fc_port_destroy(struct fcoe_port *port);
+
+ static struct bnx2fc_hba *bnx2fc_hba_lookup(struct net_device *phys_dev);
+ static struct bnx2fc_interface *bnx2fc_interface_lookup(struct net_device
+@@ -515,7 +515,8 @@ static int bnx2fc_l2_rcv_thread(void *arg)
+
+ static void bnx2fc_recv_frame(struct sk_buff *skb)
+ {
+- u32 fr_len;
++ u64 crc_err;
++ u32 fr_len, fr_crc;
+ struct fc_lport *lport;
+ struct fcoe_rcv_info *fr;
+ struct fc_stats *stats;
+@@ -549,6 +550,11 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
+ skb_pull(skb, sizeof(struct fcoe_hdr));
+ fr_len = skb->len - sizeof(struct fcoe_crc_eof);
+
++ stats = per_cpu_ptr(lport->stats, get_cpu());
++ stats->RxFrames++;
++ stats->RxWords += fr_len / FCOE_WORD_TO_BYTE;
++ put_cpu();
++
+ fp = (struct fc_frame *)skb;
+ fc_frame_init(fp);
+ fr_dev(fp) = lport;
+@@ -631,16 +637,15 @@ static void bnx2fc_recv_frame(struct sk_buff *skb)
+ return;
+ }
+
+- stats = per_cpu_ptr(lport->stats, smp_processor_id());
+- stats->RxFrames++;
+- stats->RxWords += fr_len / FCOE_WORD_TO_BYTE;
++ fr_crc = le32_to_cpu(fr_crc(fp));
+
+- if (le32_to_cpu(fr_crc(fp)) !=
+- ~crc32(~0, skb->data, fr_len)) {
+- if (stats->InvalidCRCCount < 5)
++ if (unlikely(fr_crc != ~crc32(~0, skb->data, fr_len))) {
++ stats = per_cpu_ptr(lport->stats, get_cpu());
++ crc_err = (stats->InvalidCRCCount++);
++ put_cpu();
++ if (crc_err < 5)
+ printk(KERN_WARNING PFX "dropping frame with "
+ "CRC error\n");
+- stats->InvalidCRCCount++;
+ kfree_skb(skb);
+ return;
+ }
+@@ -911,9 +916,6 @@ static void bnx2fc_indicate_netevent(void *context, unsigned long event,
+ __bnx2fc_destroy(interface);
+ }
+ mutex_unlock(&bnx2fc_dev_lock);
+-
+- /* Ensure ALL destroy work has been completed before return */
+- flush_workqueue(bnx2fc_wq);
+ return;
+
+ default:
+@@ -1220,8 +1222,8 @@ static int bnx2fc_vport_destroy(struct fc_vport *vport)
+ mutex_unlock(&n_port->lp_mutex);
+ bnx2fc_free_vport(interface->hba, port->lport);
+ bnx2fc_port_shutdown(port->lport);
++ bnx2fc_port_destroy(port);
+ bnx2fc_interface_put(interface);
+- queue_work(bnx2fc_wq, &port->destroy_work);
+ return 0;
+ }
+
+@@ -1530,7 +1532,6 @@ static struct fc_lport *bnx2fc_if_create(struct bnx2fc_interface *interface,
+ port->lport = lport;
+ port->priv = interface;
+ port->get_netdev = bnx2fc_netdev;
+- INIT_WORK(&port->destroy_work, bnx2fc_destroy_work);
+
+ /* Configure fcoe_port */
+ rc = bnx2fc_lport_config(lport);
+@@ -1658,8 +1659,8 @@ static void __bnx2fc_destroy(struct bnx2fc_interface *interface)
+ bnx2fc_interface_cleanup(interface);
+ bnx2fc_stop(interface);
+ list_del(&interface->list);
++ bnx2fc_port_destroy(port);
+ bnx2fc_interface_put(interface);
+- queue_work(bnx2fc_wq, &port->destroy_work);
+ }
+
+ /**
+@@ -1700,15 +1701,12 @@ netdev_err:
+ return rc;
+ }
+
+-static void bnx2fc_destroy_work(struct work_struct *work)
++static void bnx2fc_port_destroy(struct fcoe_port *port)
+ {
+- struct fcoe_port *port;
+ struct fc_lport *lport;
+
+- port = container_of(work, struct fcoe_port, destroy_work);
+ lport = port->lport;
+-
+- BNX2FC_HBA_DBG(lport, "Entered bnx2fc_destroy_work\n");
++ BNX2FC_HBA_DBG(lport, "Entered %s, destroying lport %p\n", __func__, lport);
+
+ bnx2fc_if_destroy(lport);
+ }
+@@ -2562,9 +2560,6 @@ static void bnx2fc_ulp_exit(struct cnic_dev *dev)
+ __bnx2fc_destroy(interface);
+ mutex_unlock(&bnx2fc_dev_lock);
+
+- /* Ensure ALL destroy work has been completed before return */
+- flush_workqueue(bnx2fc_wq);
+-
+ bnx2fc_ulp_stop(hba);
+ /* unregister cnic device */
+ if (test_and_clear_bit(BNX2FC_CNIC_REGISTERED, &hba->reg_with_cnic))
+diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c
+index 01fcad7c8fae8..ef54f1638d207 100644
+--- a/drivers/soc/mediatek/mtk-scpsys.c
++++ b/drivers/soc/mediatek/mtk-scpsys.c
+@@ -341,17 +341,12 @@ out:
+ return ret;
+ }
+
+-static int init_clks(struct platform_device *pdev, struct clk **clk)
++static void init_clks(struct platform_device *pdev, struct clk **clk)
+ {
+ int i;
+
+- for (i = CLK_NONE + 1; i < CLK_MAX; i++) {
++ for (i = CLK_NONE + 1; i < CLK_MAX; i++)
+ clk[i] = devm_clk_get(&pdev->dev, clk_names[i]);
+- if (IS_ERR(clk[i]))
+- return PTR_ERR(clk[i]);
+- }
+-
+- return 0;
+ }
+
+ static struct scp *init_scp(struct platform_device *pdev,
+@@ -361,7 +356,7 @@ static struct scp *init_scp(struct platform_device *pdev,
+ {
+ struct genpd_onecell_data *pd_data;
+ struct resource *res;
+- int i, j, ret;
++ int i, j;
+ struct scp *scp;
+ struct clk *clk[CLK_MAX];
+
+@@ -416,9 +411,7 @@ static struct scp *init_scp(struct platform_device *pdev,
+
+ pd_data->num_domains = num;
+
+- ret = init_clks(pdev, clk);
+- if (ret)
+- return ERR_PTR(ret);
++ init_clks(pdev, clk);
+
+ for (i = 0; i < num; i++) {
+ struct scp_domain *scpd = &scp->domains[i];
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index b2fd7a3691964..82c24c85f45bc 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -520,7 +520,7 @@ static void bcm_qspi_chip_select(struct bcm_qspi *qspi, int cs)
+ u32 rd = 0;
+ u32 wr = 0;
+
+- if (qspi->base[CHIP_SELECT]) {
++ if (cs >= 0 && qspi->base[CHIP_SELECT]) {
+ rd = bcm_qspi_read(qspi, CHIP_SELECT, 0);
+ wr = (rd & ~0xff) | (1 << cs);
+ if (rd == wr)
+diff --git a/drivers/spi/spi-meson-spicc.c b/drivers/spi/spi-meson-spicc.c
+index 419756ebf2c05..24196fb0d78a9 100644
+--- a/drivers/spi/spi-meson-spicc.c
++++ b/drivers/spi/spi-meson-spicc.c
+@@ -529,6 +529,11 @@ static int meson_spicc_probe(struct platform_device *pdev)
+ writel_relaxed(0, spicc->base + SPICC_INTREG);
+
+ irq = platform_get_irq(pdev, 0);
++ if (irq < 0) {
++ ret = irq;
++ goto out_master;
++ }
++
+ ret = devm_request_irq(&pdev->dev, irq, meson_spicc_irq,
+ 0, NULL, spicc);
+ if (ret) {
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index 690e8ddf5f6b8..faca2ab758992 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -498,7 +498,7 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
+ else
+ mdata->state = MTK_SPI_IDLE;
+
+- if (!master->can_dma(master, master->cur_msg->spi, trans)) {
++ if (!master->can_dma(master, NULL, trans)) {
+ if (trans->rx_buf) {
+ cnt = mdata->xfer_len / 4;
+ ioread32_rep(mdata->base + SPI_RX_DATA_REG,
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 5e9457d199279..294182cb71caf 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -313,6 +313,7 @@ static struct tty_driver *gsm_tty_driver;
+ #define GSM1_ESCAPE_BITS 0x20
+ #define XON 0x11
+ #define XOFF 0x13
++#define ISO_IEC_646_MASK 0x7F
+
+ static const struct tty_port_operations gsm_port_ops;
+
+@@ -531,7 +532,8 @@ static int gsm_stuff_frame(const u8 *input, u8 *output, int len)
+ int olen = 0;
+ while (len--) {
+ if (*input == GSM1_SOF || *input == GSM1_ESCAPE
+- || *input == XON || *input == XOFF) {
++ || (*input & ISO_IEC_646_MASK) == XON
++ || (*input & ISO_IEC_646_MASK) == XOFF) {
+ *output++ = GSM1_ESCAPE;
+ *output++ = *input++ ^ GSM1_ESCAPE_BITS;
+ olen++;
+diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c
+index 8fedc075fb1eb..a76533a482459 100644
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -104,8 +104,17 @@ static int of_platform_serial_setup(struct platform_device *ofdev,
+ port->mapsize = resource_size(&resource);
+
+ /* Check for shifted address mapping */
+- if (of_property_read_u32(np, "reg-offset", &prop) == 0)
++ if (of_property_read_u32(np, "reg-offset", &prop) == 0) {
++ if (prop >= port->mapsize) {
++ dev_warn(&ofdev->dev, "reg-offset %u exceeds region size %pa\n",
++ prop, &port->mapsize);
++ ret = -EINVAL;
++ goto err_unprepare;
++ }
++
+ port->mapbase += prop;
++ port->mapsize -= prop;
++ }
+
+ port->iotype = UPIO_MEM;
+ if (of_property_read_u32(np, "reg-io-width", &prop) == 0) {
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index f54c18e4ae909..173885837e77f 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -4797,8 +4797,30 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ { PCI_VENDOR_ID_INTASHIELD, PCI_DEVICE_ID_INTASHIELD_IS400,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, /* 135a.0dc0 */
+ pbn_b2_4_115200 },
++ /* Brainboxes Devices */
+ /*
+- * BrainBoxes UC-260
++ * Brainboxes UC-101
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x0BA1,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_2_115200 },
++ /*
++ * Brainboxes UC-235/246
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x0AA1,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_1_115200 },
++ /*
++ * Brainboxes UC-257
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x0861,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_2_115200 },
++ /*
++ * Brainboxes UC-260/271/701/756
+ */
+ { PCI_VENDOR_ID_INTASHIELD, 0x0D21,
+ PCI_ANY_ID, PCI_ANY_ID,
+@@ -4806,7 +4828,81 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ pbn_b2_4_115200 },
+ { PCI_VENDOR_ID_INTASHIELD, 0x0E34,
+ PCI_ANY_ID, PCI_ANY_ID,
+- PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
++ PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
++ pbn_b2_4_115200 },
++ /*
++ * Brainboxes UC-268
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x0841,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_4_115200 },
++ /*
++ * Brainboxes UC-275/279
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x0881,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_8_115200 },
++ /*
++ * Brainboxes UC-302
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x08E1,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_2_115200 },
++ /*
++ * Brainboxes UC-310
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x08C1,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_2_115200 },
++ /*
++ * Brainboxes UC-313
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x08A3,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_2_115200 },
++ /*
++ * Brainboxes UC-320/324
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x0A61,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_1_115200 },
++ /*
++ * Brainboxes UC-346
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x0B02,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_4_115200 },
++ /*
++ * Brainboxes UC-357
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x0A81,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_2_115200 },
++ { PCI_VENDOR_ID_INTASHIELD, 0x0A83,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_2_115200 },
++ /*
++ * Brainboxes UC-368
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x0C41,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
++ pbn_b2_4_115200 },
++ /*
++ * Brainboxes UC-420/431
++ */
++ { PCI_VENDOR_ID_INTASHIELD, 0x0921,
++ PCI_ANY_ID, PCI_ANY_ID,
++ 0, 0,
+ pbn_b2_4_115200 },
+ /*
+ * Perle PCI-RAS cards
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 50073ead5881b..ccaaf804df06d 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -509,7 +509,7 @@ static void stm32_start_tx(struct uart_port *port)
+ {
+ struct circ_buf *xmit = &port->state->xmit;
+
+- if (uart_circ_empty(xmit))
++ if (uart_circ_empty(xmit) && !port->x_char)
+ return;
+
+ stm32_transmit_chars(port);
+diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
+index 9a2ab6751a23c..5a4d08de546fe 100644
+--- a/drivers/usb/common/ulpi.c
++++ b/drivers/usb/common/ulpi.c
+@@ -39,8 +39,11 @@ static int ulpi_match(struct device *dev, struct device_driver *driver)
+ struct ulpi *ulpi = to_ulpi_dev(dev);
+ const struct ulpi_device_id *id;
+
+- /* Some ULPI devices don't have a vendor id so rely on OF match */
+- if (ulpi->id.vendor == 0)
++ /*
++ * Some ULPI devices don't have a vendor id
++ * or provide an id_table so rely on OF match.
++ */
++ if (ulpi->id.vendor == 0 || !drv->id_table)
+ return of_driver_match_device(dev, driver);
+
+ for (id = drv->id_table; id->vendor; id++)
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 11cc189bf1055..df661460e9f96 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1670,6 +1670,13 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)
+ urb->hcpriv = NULL;
+ INIT_LIST_HEAD(&urb->urb_list);
+ atomic_dec(&urb->use_count);
++ /*
++ * Order the write of urb->use_count above before the read
++ * of urb->reject below. Pairs with the memory barriers in
++ * usb_kill_urb() and usb_poison_urb().
++ */
++ smp_mb__after_atomic();
++
+ atomic_dec(&urb->dev->urbnum);
+ if (atomic_read(&urb->reject))
+ wake_up(&usb_kill_urb_queue);
+@@ -1779,6 +1786,13 @@ static void __usb_hcd_giveback_urb(struct urb *urb)
+
+ usb_anchor_resume_wakeups(anchor);
+ atomic_dec(&urb->use_count);
++ /*
++ * Order the write of urb->use_count above before the read
++ * of urb->reject below. Pairs with the memory barriers in
++ * usb_kill_urb() and usb_poison_urb().
++ */
++ smp_mb__after_atomic();
++
+ if (unlikely(atomic_read(&urb->reject)))
+ wake_up(&usb_kill_urb_queue);
+ usb_put_urb(urb);
+diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
+index 3cd7732c086e0..e88e04a24103f 100644
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -692,6 +692,12 @@ void usb_kill_urb(struct urb *urb)
+ if (!(urb && urb->dev && urb->ep))
+ return;
+ atomic_inc(&urb->reject);
++ /*
++ * Order the write of urb->reject above before the read
++ * of urb->use_count below. Pairs with the barriers in
++ * __usb_hcd_giveback_urb() and usb_hcd_submit_urb().
++ */
++ smp_mb__after_atomic();
+
+ usb_hcd_unlink_urb(urb, -ENOENT);
+ wait_event(usb_kill_urb_queue, atomic_read(&urb->use_count) == 0);
+@@ -733,6 +739,12 @@ void usb_poison_urb(struct urb *urb)
+ if (!urb)
+ return;
+ atomic_inc(&urb->reject);
++ /*
++ * Order the write of urb->reject above before the read
++ * of urb->use_count below. Pairs with the barriers in
++ * __usb_hcd_giveback_urb() and usb_hcd_submit_urb().
++ */
++ smp_mb__after_atomic();
+
+ if (!urb->dev || !urb->ep)
+ return;
+diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
+index 282737e4609ce..2c65a9bb3c81b 100644
+--- a/drivers/usb/gadget/function/f_sourcesink.c
++++ b/drivers/usb/gadget/function/f_sourcesink.c
+@@ -583,6 +583,7 @@ static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in,
+
+ if (is_iso) {
+ switch (speed) {
++ case USB_SPEED_SUPER_PLUS:
+ case USB_SPEED_SUPER:
+ size = ss->isoc_maxpacket *
+ (ss->isoc_mult + 1) *
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 3ba4e060fd051..66e7f5d123c46 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2301,6 +2301,16 @@ UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
+ US_FL_SCM_MULT_TARG ),
+
++/*
++ * Reported by DocMAX <mail@vacharakis.de>
++ * and Thomas Weißschuh <linux@weissschuh.net>
++ */
++UNUSUAL_DEV( 0x2109, 0x0715, 0x9999, 0x9999,
++ "VIA Labs, Inc.",
++ "VL817 SATA Bridge",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_IGNORE_UAS),
++
+ UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001,
+ "ST",
+ "2A",
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index 228d88c7bdb26..e4308f97d9739 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -3865,7 +3865,8 @@ static void _tcpm_pd_vbus_off(struct tcpm_port *port)
+ case SNK_TRYWAIT_DEBOUNCE:
+ break;
+ case SNK_ATTACH_WAIT:
+- tcpm_set_state(port, SNK_UNATTACHED, 0);
++ case SNK_DEBOUNCED:
++ /* Do nothing, as TCPM is still waiting for vbus to reaach VSAFE5V to connect */
+ break;
+
+ case SNK_NEGOTIATE_CAPABILITIES:
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index c64e4a1be2f29..e90b60470344d 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1125,7 +1125,15 @@ static void ext4_restore_inline_data(handle_t *handle, struct inode *inode,
+ struct ext4_iloc *iloc,
+ void *buf, int inline_size)
+ {
+- ext4_create_inline_data(handle, inode, inline_size);
++ int ret;
++
++ ret = ext4_create_inline_data(handle, inode, inline_size);
++ if (ret) {
++ ext4_msg(inode->i_sb, KERN_EMERG,
++ "error restoring inline_data for inode -- potential data loss! (inode %lu, error %d)",
++ inode->i_ino, ret);
++ return;
++ }
+ ext4_write_inline_data(inode, iloc, buf, 0, inline_size);
+ ext4_set_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
+ }
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 733fd9e4f0a15..a968b8b4b982f 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -1626,6 +1626,24 @@ out:
+
+ no_open:
+ res = nfs_lookup(dir, dentry, lookup_flags);
++ if (!res) {
++ inode = d_inode(dentry);
++ if ((lookup_flags & LOOKUP_DIRECTORY) && inode &&
++ !S_ISDIR(inode->i_mode))
++ res = ERR_PTR(-ENOTDIR);
++ else if (inode && S_ISREG(inode->i_mode))
++ res = ERR_PTR(-EOPENSTALE);
++ } else if (!IS_ERR(res)) {
++ inode = d_inode(res);
++ if ((lookup_flags & LOOKUP_DIRECTORY) && inode &&
++ !S_ISDIR(inode->i_mode)) {
++ dput(res);
++ res = ERR_PTR(-ENOTDIR);
++ } else if (inode && S_ISREG(inode->i_mode)) {
++ dput(res);
++ res = ERR_PTR(-EOPENSTALE);
++ }
++ }
+ if (switched) {
+ d_lookup_done(dentry);
+ if (!res)
+@@ -2015,6 +2033,8 @@ nfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry)
+
+ trace_nfs_link_enter(inode, dir, dentry);
+ d_drop(dentry);
++ if (S_ISREG(inode->i_mode))
++ nfs_sync_inode(inode);
+ error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name);
+ if (error == 0) {
+ ihold(inode);
+@@ -2103,6 +2123,8 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ }
+ }
+
++ if (S_ISREG(old_inode->i_mode))
++ nfs_sync_inode(old_inode);
+ task = nfs_async_rename(old_dir, new_dir, old_dentry, new_dentry, NULL);
+ if (IS_ERR(task)) {
+ error = PTR_ERR(task);
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index dfb2a790efc13..ed5429d18595c 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3446,8 +3446,10 @@ nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
+ status = nfserr_clid_inuse;
+ if (client_has_state(old)
+ && !same_creds(&unconf->cl_cred,
+- &old->cl_cred))
++ &old->cl_cred)) {
++ old = NULL;
+ goto out;
++ }
+ status = mark_client_expired_locked(old);
+ if (status) {
+ old = NULL;
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index f5500d2a38797..ec8089a313906 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -251,10 +251,6 @@ int udf_expand_file_adinicb(struct inode *inode)
+ char *kaddr;
+ struct udf_inode_info *iinfo = UDF_I(inode);
+ int err;
+- struct writeback_control udf_wbc = {
+- .sync_mode = WB_SYNC_NONE,
+- .nr_to_write = 1,
+- };
+
+ WARN_ON_ONCE(!inode_is_locked(inode));
+ if (!iinfo->i_lenAlloc) {
+@@ -298,8 +294,10 @@ int udf_expand_file_adinicb(struct inode *inode)
+ iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
+ /* from now on we have normal address_space methods */
+ inode->i_data.a_ops = &udf_aops;
++ set_page_dirty(page);
++ unlock_page(page);
+ up_write(&iinfo->i_data_sem);
+- err = inode->i_data.a_ops->writepage(page, &udf_wbc);
++ err = filemap_fdatawrite(inode->i_mapping);
+ if (err) {
+ /* Restore everything back so that we don't lose data... */
+ lock_page(page);
+@@ -311,6 +309,7 @@ int udf_expand_file_adinicb(struct inode *inode)
+ unlock_page(page);
+ iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB;
+ inode->i_data.a_ops = &udf_adinicb_aops;
++ iinfo->i_lenAlloc = inode->i_size;
+ up_write(&iinfo->i_data_sem);
+ }
+ put_page(page);
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 50ab7c8fd3090..58ee9d2d6a3ca 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2346,6 +2346,7 @@ struct packet_type {
+ struct net_device *);
+ bool (*id_match)(struct packet_type *ptype,
+ struct sock *sk);
++ struct net *af_packet_net;
+ void *af_packet_priv;
+ struct list_head list;
+ };
+diff --git a/include/net/ip.h b/include/net/ip.h
+index e8fa25280cbfd..d1a4efedbc039 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -441,19 +441,18 @@ static inline void ip_select_ident_segs(struct net *net, struct sk_buff *skb,
+ {
+ struct iphdr *iph = ip_hdr(skb);
+
++ /* We had many attacks based on IPID, use the private
++ * generator as much as we can.
++ */
++ if (sk && inet_sk(sk)->inet_daddr) {
++ iph->id = htons(inet_sk(sk)->inet_id);
++ inet_sk(sk)->inet_id += segs;
++ return;
++ }
+ if ((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) {
+- /* This is only to work around buggy Windows95/2000
+- * VJ compression implementations. If the ID field
+- * does not change, they drop every other packet in
+- * a TCP stream using header compression.
+- */
+- if (sk && inet_sk(sk)->inet_daddr) {
+- iph->id = htons(inet_sk(sk)->inet_id);
+- inet_sk(sk)->inet_id += segs;
+- } else {
+- iph->id = 0;
+- }
++ iph->id = 0;
+ } else {
++ /* Unfortunately we need the big hammer to get a suitable IPID */
+ __ip_select_ident(net, iph, segs);
+ }
+ }
+diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
+index 62c936230cc8b..b4fea9dd589d4 100644
+--- a/include/net/ip6_fib.h
++++ b/include/net/ip6_fib.h
+@@ -243,7 +243,7 @@ static inline bool fib6_get_cookie_safe(const struct fib6_info *f6i,
+ fn = rcu_dereference(f6i->fib6_node);
+
+ if (fn) {
+- *cookie = fn->fn_sernum;
++ *cookie = READ_ONCE(fn->fn_sernum);
+ /* pairs with smp_wmb() in fib6_update_sernum_upto_root() */
+ smp_rmb();
+ status = true;
+diff --git a/include/net/netfilter/nf_nat_l4proto.h b/include/net/netfilter/nf_nat_l4proto.h
+index b4d6b29bca62a..7ecac2cd10206 100644
+--- a/include/net/netfilter/nf_nat_l4proto.h
++++ b/include/net/netfilter/nf_nat_l4proto.h
+@@ -74,7 +74,7 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ struct nf_conntrack_tuple *tuple,
+ const struct nf_nat_range2 *range,
+ enum nf_nat_manip_type maniptype,
+- const struct nf_conn *ct, u16 *rover);
++ const struct nf_conn *ct);
+
+ int nf_nat_l4proto_nlattr_to_range(struct nlattr *tb[],
+ struct nf_nat_range2 *range);
+diff --git a/kernel/audit.c b/kernel/audit.c
+index c5e034fe14bbb..7dc14a4d9e3cf 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -549,20 +549,22 @@ static void kauditd_printk_skb(struct sk_buff *skb)
+ /**
+ * kauditd_rehold_skb - Handle a audit record send failure in the hold queue
+ * @skb: audit record
++ * @error: error code (unused)
+ *
+ * Description:
+ * This should only be used by the kauditd_thread when it fails to flush the
+ * hold queue.
+ */
+-static void kauditd_rehold_skb(struct sk_buff *skb)
++static void kauditd_rehold_skb(struct sk_buff *skb, __always_unused int error)
+ {
+- /* put the record back in the queue at the same place */
+- skb_queue_head(&audit_hold_queue, skb);
++ /* put the record back in the queue */
++ skb_queue_tail(&audit_hold_queue, skb);
+ }
+
+ /**
+ * kauditd_hold_skb - Queue an audit record, waiting for auditd
+ * @skb: audit record
++ * @error: error code
+ *
+ * Description:
+ * Queue the audit record, waiting for an instance of auditd. When this
+@@ -572,19 +574,31 @@ static void kauditd_rehold_skb(struct sk_buff *skb)
+ * and queue it, if we have room. If we want to hold on to the record, but we
+ * don't have room, record a record lost message.
+ */
+-static void kauditd_hold_skb(struct sk_buff *skb)
++static void kauditd_hold_skb(struct sk_buff *skb, int error)
+ {
+ /* at this point it is uncertain if we will ever send this to auditd so
+ * try to send the message via printk before we go any further */
+ kauditd_printk_skb(skb);
+
+ /* can we just silently drop the message? */
+- if (!audit_default) {
+- kfree_skb(skb);
+- return;
++ if (!audit_default)
++ goto drop;
++
++ /* the hold queue is only for when the daemon goes away completely,
++ * not -EAGAIN failures; if we are in a -EAGAIN state requeue the
++ * record on the retry queue unless it's full, in which case drop it
++ */
++ if (error == -EAGAIN) {
++ if (!audit_backlog_limit ||
++ skb_queue_len(&audit_retry_queue) < audit_backlog_limit) {
++ skb_queue_tail(&audit_retry_queue, skb);
++ return;
++ }
++ audit_log_lost("kauditd retry queue overflow");
++ goto drop;
+ }
+
+- /* if we have room, queue the message */
++ /* if we have room in the hold queue, queue the message */
+ if (!audit_backlog_limit ||
+ skb_queue_len(&audit_hold_queue) < audit_backlog_limit) {
+ skb_queue_tail(&audit_hold_queue, skb);
+@@ -593,24 +607,32 @@ static void kauditd_hold_skb(struct sk_buff *skb)
+
+ /* we have no other options - drop the message */
+ audit_log_lost("kauditd hold queue overflow");
++drop:
+ kfree_skb(skb);
+ }
+
+ /**
+ * kauditd_retry_skb - Queue an audit record, attempt to send again to auditd
+ * @skb: audit record
++ * @error: error code (unused)
+ *
+ * Description:
+ * Not as serious as kauditd_hold_skb() as we still have a connected auditd,
+ * but for some reason we are having problems sending it audit records so
+ * queue the given record and attempt to resend.
+ */
+-static void kauditd_retry_skb(struct sk_buff *skb)
++static void kauditd_retry_skb(struct sk_buff *skb, __always_unused int error)
+ {
+- /* NOTE: because records should only live in the retry queue for a
+- * short period of time, before either being sent or moved to the hold
+- * queue, we don't currently enforce a limit on this queue */
+- skb_queue_tail(&audit_retry_queue, skb);
++ if (!audit_backlog_limit ||
++ skb_queue_len(&audit_retry_queue) < audit_backlog_limit) {
++ skb_queue_tail(&audit_retry_queue, skb);
++ return;
++ }
++
++ /* we have to drop the record, send it via printk as a last effort */
++ kauditd_printk_skb(skb);
++ audit_log_lost("kauditd retry queue overflow");
++ kfree_skb(skb);
+ }
+
+ /**
+@@ -648,7 +670,7 @@ static void auditd_reset(const struct auditd_connection *ac)
+ /* flush the retry queue to the hold queue, but don't touch the main
+ * queue since we need to process that normally for multicast */
+ while ((skb = skb_dequeue(&audit_retry_queue)))
+- kauditd_hold_skb(skb);
++ kauditd_hold_skb(skb, -ECONNREFUSED);
+ }
+
+ /**
+@@ -722,16 +744,18 @@ static int kauditd_send_queue(struct sock *sk, u32 portid,
+ struct sk_buff_head *queue,
+ unsigned int retry_limit,
+ void (*skb_hook)(struct sk_buff *skb),
+- void (*err_hook)(struct sk_buff *skb))
++ void (*err_hook)(struct sk_buff *skb, int error))
+ {
+ int rc = 0;
+- struct sk_buff *skb;
++ struct sk_buff *skb = NULL;
++ struct sk_buff *skb_tail;
+ unsigned int failed = 0;
+
+ /* NOTE: kauditd_thread takes care of all our locking, we just use
+ * the netlink info passed to us (e.g. sk and portid) */
+
+- while ((skb = skb_dequeue(queue))) {
++ skb_tail = skb_peek_tail(queue);
++ while ((skb != skb_tail) && (skb = skb_dequeue(queue))) {
+ /* call the skb_hook for each skb we touch */
+ if (skb_hook)
+ (*skb_hook)(skb);
+@@ -739,7 +763,7 @@ static int kauditd_send_queue(struct sock *sk, u32 portid,
+ /* can we send to anyone via unicast? */
+ if (!sk) {
+ if (err_hook)
+- (*err_hook)(skb);
++ (*err_hook)(skb, -ECONNREFUSED);
+ continue;
+ }
+
+@@ -753,7 +777,7 @@ retry:
+ rc == -ECONNREFUSED || rc == -EPERM) {
+ sk = NULL;
+ if (err_hook)
+- (*err_hook)(skb);
++ (*err_hook)(skb, rc);
+ if (rc == -EAGAIN)
+ rc = 0;
+ /* continue to drain the queue */
+diff --git a/kernel/power/wakelock.c b/kernel/power/wakelock.c
+index 4210152e56f0f..aad7c8fcb22fe 100644
+--- a/kernel/power/wakelock.c
++++ b/kernel/power/wakelock.c
+@@ -39,23 +39,19 @@ ssize_t pm_show_wakelocks(char *buf, bool show_active)
+ {
+ struct rb_node *node;
+ struct wakelock *wl;
+- char *str = buf;
+- char *end = buf + PAGE_SIZE;
++ int len = 0;
+
+ mutex_lock(&wakelocks_lock);
+
+ for (node = rb_first(&wakelocks_tree); node; node = rb_next(node)) {
+ wl = rb_entry(node, struct wakelock, node);
+ if (wl->ws.active == show_active)
+- str += scnprintf(str, end - str, "%s ", wl->name);
++ len += sysfs_emit_at(buf, len, "%s ", wl->name);
+ }
+- if (str > buf)
+- str--;
+-
+- str += scnprintf(str, end - str, "\n");
++ len += sysfs_emit_at(buf, len, "\n");
+
+ mutex_unlock(&wakelocks_lock);
+- return (str - buf);
++ return len;
+ }
+
+ #if CONFIG_PM_WAKELOCKS_LIMIT > 0
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index c0dbb8ad00376..196d0d8320070 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -5391,6 +5391,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ struct hci_ev_le_advertising_info *ev = ptr;
+ s8 rssi;
+
++ if (ptr > (void *)skb_tail_pointer(skb) - sizeof(*ev)) {
++ bt_dev_err(hdev, "Malicious advertising data.");
++ break;
++ }
++
+ if (ev->length <= HCI_MAX_AD_LENGTH &&
+ ev->data + ev->length <= skb_tail_pointer(skb)) {
+ rssi = ev->data[ev->length];
+@@ -5402,11 +5407,6 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ }
+
+ ptr += sizeof(*ev) + ev->length + 1;
+-
+- if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) {
+- bt_dev_err(hdev, "Malicious advertising data. Stopping processing");
+- break;
+- }
+ }
+
+ hci_dev_unlock(hdev);
+diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c
+index 63881f72ef71c..2808c5f9c1f05 100644
+--- a/net/core/net-procfs.c
++++ b/net/core/net-procfs.c
+@@ -182,12 +182,23 @@ static const struct seq_operations softnet_seq_ops = {
+ .show = softnet_seq_show,
+ };
+
+-static void *ptype_get_idx(loff_t pos)
++static void *ptype_get_idx(struct seq_file *seq, loff_t pos)
+ {
++ struct list_head *ptype_list = NULL;
+ struct packet_type *pt = NULL;
++ struct net_device *dev;
+ loff_t i = 0;
+ int t;
+
++ for_each_netdev_rcu(seq_file_net(seq), dev) {
++ ptype_list = &dev->ptype_all;
++ list_for_each_entry_rcu(pt, ptype_list, list) {
++ if (i == pos)
++ return pt;
++ ++i;
++ }
++ }
++
+ list_for_each_entry_rcu(pt, &ptype_all, list) {
+ if (i == pos)
+ return pt;
+@@ -208,22 +219,40 @@ static void *ptype_seq_start(struct seq_file *seq, loff_t *pos)
+ __acquires(RCU)
+ {
+ rcu_read_lock();
+- return *pos ? ptype_get_idx(*pos - 1) : SEQ_START_TOKEN;
++ return *pos ? ptype_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
+ }
+
+ static void *ptype_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
++ struct net_device *dev;
+ struct packet_type *pt;
+ struct list_head *nxt;
+ int hash;
+
+ ++*pos;
+ if (v == SEQ_START_TOKEN)
+- return ptype_get_idx(0);
++ return ptype_get_idx(seq, 0);
+
+ pt = v;
+ nxt = pt->list.next;
++ if (pt->dev) {
++ if (nxt != &pt->dev->ptype_all)
++ goto found;
++
++ dev = pt->dev;
++ for_each_netdev_continue_rcu(seq_file_net(seq), dev) {
++ if (!list_empty(&dev->ptype_all)) {
++ nxt = dev->ptype_all.next;
++ goto found;
++ }
++ }
++
++ nxt = ptype_all.next;
++ goto ptype_all;
++ }
++
+ if (pt->type == htons(ETH_P_ALL)) {
++ptype_all:
+ if (nxt != &ptype_all)
+ goto found;
+ hash = 0;
+@@ -252,7 +281,8 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
+
+ if (v == SEQ_START_TOKEN)
+ seq_puts(seq, "Type Device Function\n");
+- else if (pt->dev == NULL || dev_net(pt->dev) == seq_file_net(seq)) {
++ else if ((!pt->af_packet_net || net_eq(pt->af_packet_net, seq_file_net(seq))) &&
++ (!pt->dev || net_eq(dev_net(pt->dev), seq_file_net(seq)))) {
+ if (pt->type == htons(ETH_P_ALL))
+ seq_puts(seq, "ALL ");
+ else
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 907dd0c7e8a66..2837cc03f69e2 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2942,9 +2942,9 @@ static int rtnl_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
+ {
+ struct net *net = sock_net(skb->sk);
+ const struct rtnl_link_ops *ops;
+- const struct rtnl_link_ops *m_ops = NULL;
++ const struct rtnl_link_ops *m_ops;
+ struct net_device *dev;
+- struct net_device *master_dev = NULL;
++ struct net_device *master_dev;
+ struct ifinfomsg *ifm;
+ char kind[MODULE_NAME_LEN];
+ char ifname[IFNAMSIZ];
+@@ -2979,6 +2979,8 @@ replay:
+ dev = NULL;
+ }
+
++ master_dev = NULL;
++ m_ops = NULL;
+ if (dev) {
+ master_dev = netdev_master_upper_dev_get(dev);
+ if (master_dev)
+diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
+index 6d4c71a52b6b2..3407ee1159f7b 100644
+--- a/net/ieee802154/nl802154.c
++++ b/net/ieee802154/nl802154.c
+@@ -1459,7 +1459,7 @@ static int nl802154_send_key(struct sk_buff *msg, u32 cmd, u32 portid,
+
+ hdr = nl802154hdr_put(msg, portid, seq, flags, cmd);
+ if (!hdr)
+- return -1;
++ return -ENOBUFS;
+
+ if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex))
+ goto nla_put_failure;
+@@ -1650,7 +1650,7 @@ static int nl802154_send_device(struct sk_buff *msg, u32 cmd, u32 portid,
+
+ hdr = nl802154hdr_put(msg, portid, seq, flags, cmd);
+ if (!hdr)
+- return -1;
++ return -ENOBUFS;
+
+ if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex))
+ goto nla_put_failure;
+@@ -1828,7 +1828,7 @@ static int nl802154_send_devkey(struct sk_buff *msg, u32 cmd, u32 portid,
+
+ hdr = nl802154hdr_put(msg, portid, seq, flags, cmd);
+ if (!hdr)
+- return -1;
++ return -ENOBUFS;
+
+ if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex))
+ goto nla_put_failure;
+@@ -2005,7 +2005,7 @@ static int nl802154_send_seclevel(struct sk_buff *msg, u32 cmd, u32 portid,
+
+ hdr = nl802154hdr_put(msg, portid, seq, flags, cmd);
+ if (!hdr)
+- return -1;
++ return -ENOBUFS;
+
+ if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex))
+ goto nla_put_failure;
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 25beecee89494..06a981676356c 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -160,12 +160,19 @@ int ip_build_and_send_pkt(struct sk_buff *skb, const struct sock *sk,
+ iph->daddr = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
+ iph->saddr = saddr;
+ iph->protocol = sk->sk_protocol;
+- if (ip_dont_fragment(sk, &rt->dst)) {
++ /* Do not bother generating IPID for small packets (eg SYNACK) */
++ if (skb->len <= IPV4_MIN_MTU || ip_dont_fragment(sk, &rt->dst)) {
+ iph->frag_off = htons(IP_DF);
+ iph->id = 0;
+ } else {
+ iph->frag_off = 0;
+- __ip_select_ident(net, iph, 1);
++ /* TCP packets here are SYNACK with fat IPv4/TCP options.
++ * Avoid using the hashed IP ident generator.
++ */
++ if (sk->sk_protocol == IPPROTO_TCP)
++ iph->id = (__force __be16)prandom_u32();
++ else
++ __ip_select_ident(net, iph, 1);
+ }
+
+ if (opt && opt->opt.optlen) {
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 862744c285482..276442443d322 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -225,7 +225,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
+ continue;
+ }
+
+- if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif)
++ if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif &&
++ sk->sk_bound_dev_if != inet_sdif(skb))
+ continue;
+
+ sock_hold(sk);
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index 21800979ed621..8cae691c3c9f4 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -725,6 +725,7 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ int ret = -EINVAL;
+ int chk_addr_ret;
+
++ lock_sock(sk);
+ if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_in))
+ goto out;
+
+@@ -744,7 +745,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+ inet->inet_saddr = 0; /* Use device */
+ sk_dst_reset(sk);
+ ret = 0;
+-out: return ret;
++out:
++ release_sock(sk);
++ return ret;
+ }
+
+ /*
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 941c655cad917..c97c027a8d773 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -968,6 +968,8 @@ enum hrtimer_restart tcp_pace_kick(struct hrtimer *timer)
+
+ static void tcp_internal_pacing(struct sock *sk, const struct sk_buff *skb)
+ {
++ struct tcp_sock *tp = tcp_sk(sk);
++ ktime_t expire, now;
+ u64 len_ns;
+ u32 rate;
+
+@@ -979,12 +981,28 @@ static void tcp_internal_pacing(struct sock *sk, const struct sk_buff *skb)
+
+ len_ns = (u64)skb->len * NSEC_PER_SEC;
+ do_div(len_ns, rate);
+- hrtimer_start(&tcp_sk(sk)->pacing_timer,
+- ktime_add_ns(ktime_get(), len_ns),
++ now = ktime_get();
++ /* If hrtimer is already armed, then our caller has not
++ * used tcp_pacing_check().
++ */
++ if (unlikely(hrtimer_is_queued(&tp->pacing_timer))) {
++ expire = hrtimer_get_softexpires(&tp->pacing_timer);
++ if (ktime_after(expire, now))
++ now = expire;
++ if (hrtimer_try_to_cancel(&tp->pacing_timer) == 1)
++ __sock_put(sk);
++ }
++ hrtimer_start(&tp->pacing_timer, ktime_add_ns(now, len_ns),
+ HRTIMER_MODE_ABS_PINNED_SOFT);
+ sock_hold(sk);
+ }
+
++static bool tcp_pacing_check(const struct sock *sk)
++{
++ return tcp_needs_internal_pacing(sk) &&
++ hrtimer_is_queued(&tcp_sk(sk)->pacing_timer);
++}
++
+ static void tcp_update_skb_after_send(struct tcp_sock *tp, struct sk_buff *skb)
+ {
+ skb->skb_mstamp = tp->tcp_mstamp;
+@@ -2121,6 +2139,9 @@ static int tcp_mtu_probe(struct sock *sk)
+ if (!tcp_can_coalesce_send_queue_head(sk, probe_size))
+ return -1;
+
++ if (tcp_pacing_check(sk))
++ return -1;
++
+ /* We're allowed to probe. Build it now. */
+ nskb = sk_stream_alloc_skb(sk, probe_size, GFP_ATOMIC, false);
+ if (!nskb)
+@@ -2194,12 +2215,6 @@ static int tcp_mtu_probe(struct sock *sk)
+ return -1;
+ }
+
+-static bool tcp_pacing_check(const struct sock *sk)
+-{
+- return tcp_needs_internal_pacing(sk) &&
+- hrtimer_is_queued(&tcp_sk(sk)->pacing_timer);
+-}
+-
+ /* TCP Small Queues :
+ * Control number of packets in qdisc/devices to two packets / or ~1 ms.
+ * (These limits are doubled for retransmits)
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index e0e464b72c1fa..5ff67cb8b6ace 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -112,7 +112,7 @@ void fib6_update_sernum(struct net *net, struct fib6_info *f6i)
+ fn = rcu_dereference_protected(f6i->fib6_node,
+ lockdep_is_held(&f6i->fib6_table->tb6_lock));
+ if (fn)
+- fn->fn_sernum = fib6_new_sernum(net);
++ WRITE_ONCE(fn->fn_sernum, fib6_new_sernum(net));
+ }
+
+ /*
+@@ -544,12 +544,13 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
+ spin_unlock_bh(&table->tb6_lock);
+ if (res > 0) {
+ cb->args[4] = 1;
+- cb->args[5] = w->root->fn_sernum;
++ cb->args[5] = READ_ONCE(w->root->fn_sernum);
+ }
+ } else {
+- if (cb->args[5] != w->root->fn_sernum) {
++ int sernum = READ_ONCE(w->root->fn_sernum);
++ if (cb->args[5] != sernum) {
+ /* Begin at the root if the tree changed */
+- cb->args[5] = w->root->fn_sernum;
++ cb->args[5] = sernum;
+ w->state = FWS_INIT;
+ w->node = w->root;
+ w->skip = w->count;
+@@ -1203,7 +1204,7 @@ static void __fib6_update_sernum_upto_root(struct fib6_info *rt,
+ /* paired with smp_rmb() in rt6_get_cookie_safe() */
+ smp_wmb();
+ while (fn) {
+- fn->fn_sernum = sernum;
++ WRITE_ONCE(fn->fn_sernum, sernum);
+ fn = rcu_dereference_protected(fn->parent,
+ lockdep_is_held(&rt->fib6_table->tb6_lock));
+ }
+@@ -1983,8 +1984,8 @@ static int fib6_clean_node(struct fib6_walker *w)
+ };
+
+ if (c->sernum != FIB6_NO_SERNUM_CHANGE &&
+- w->node->fn_sernum != c->sernum)
+- w->node->fn_sernum = c->sernum;
++ READ_ONCE(w->node->fn_sernum) != c->sernum)
++ WRITE_ONCE(w->node->fn_sernum, c->sernum);
+
+ if (!c->func) {
+ WARN_ON_ONCE(c->sernum == FIB6_NO_SERNUM_CHANGE);
+@@ -2332,7 +2333,7 @@ static void ipv6_route_seq_setup_walk(struct ipv6_route_iter *iter,
+ iter->w.state = FWS_INIT;
+ iter->w.node = iter->w.root;
+ iter->w.args = iter;
+- iter->sernum = iter->w.root->fn_sernum;
++ iter->sernum = READ_ONCE(iter->w.root->fn_sernum);
+ INIT_LIST_HEAD(&iter->w.lh);
+ fib6_walker_link(net, &iter->w);
+ }
+@@ -2360,8 +2361,10 @@ static struct fib6_table *ipv6_route_seq_next_table(struct fib6_table *tbl,
+
+ static void ipv6_route_check_sernum(struct ipv6_route_iter *iter)
+ {
+- if (iter->sernum != iter->w.root->fn_sernum) {
+- iter->sernum = iter->w.root->fn_sernum;
++ int sernum = READ_ONCE(iter->w.root->fn_sernum);
++
++ if (iter->sernum != sernum) {
++ iter->sernum = sernum;
+ iter->w.state = FWS_INIT;
+ iter->w.node = iter->w.root;
+ WARN_ON(iter->w.skip);
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 35c127c3eee78..b647a40376795 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1005,14 +1005,14 @@ int ip6_tnl_xmit_ctl(struct ip6_tnl *t,
+
+ if (unlikely(!ipv6_chk_addr_and_flags(net, laddr, ldev, false,
+ 0, IFA_F_TENTATIVE)))
+- pr_warn("%s xmit: Local address not yet configured!\n",
+- p->name);
++ pr_warn_ratelimited("%s xmit: Local address not yet configured!\n",
++ p->name);
+ else if (!(p->flags & IP6_TNL_F_ALLOW_LOCAL_REMOTE) &&
+ !ipv6_addr_is_multicast(raddr) &&
+ unlikely(ipv6_chk_addr_and_flags(net, raddr, ldev,
+ true, 0, IFA_F_TENTATIVE)))
+- pr_warn("%s xmit: Routing loop! Remote address found on this node!\n",
+- p->name);
++ pr_warn_ratelimited("%s xmit: Routing loop! Remote address found on this node!\n",
++ p->name);
+ else
+ ret = 1;
+ rcu_read_unlock();
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 7e3ab23fc995c..b940285a111eb 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2320,7 +2320,7 @@ static void ip6_link_failure(struct sk_buff *skb)
+ if (from) {
+ fn = rcu_dereference(from->fib6_node);
+ if (fn && (rt->rt6i_flags & RTF_DEFAULT))
+- fn->fn_sernum = -1;
++ WRITE_ONCE(fn->fn_sernum, -1);
+ }
+ }
+ rcu_read_unlock();
+diff --git a/net/netfilter/nf_nat_proto_common.c b/net/netfilter/nf_nat_proto_common.c
+index 5d849d8355617..234f535d350e9 100644
+--- a/net/netfilter/nf_nat_proto_common.c
++++ b/net/netfilter/nf_nat_proto_common.c
+@@ -38,12 +38,12 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ struct nf_conntrack_tuple *tuple,
+ const struct nf_nat_range2 *range,
+ enum nf_nat_manip_type maniptype,
+- const struct nf_conn *ct,
+- u16 *rover)
++ const struct nf_conn *ct)
+ {
+- unsigned int range_size, min, max, i;
++ unsigned int range_size, min, max, i, attempts;
+ __be16 *portptr;
+- u_int16_t off;
++ u16 off;
++ static const unsigned int max_attempts = 128;
+
+ if (maniptype == NF_NAT_MANIP_SRC)
+ portptr = &tuple->src.u.all;
+@@ -86,18 +86,31 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ } else if (range->flags & NF_NAT_RANGE_PROTO_OFFSET) {
+ off = (ntohs(*portptr) - ntohs(range->base_proto.all));
+ } else {
+- off = *rover;
++ off = prandom_u32();
+ }
+
+- for (i = 0; ; ++off) {
++ attempts = range_size;
++ if (attempts > max_attempts)
++ attempts = max_attempts;
++
++ /* We are in softirq; doing a search of the entire range risks
++ * soft lockup when all tuples are already used.
++ *
++ * If we can't find any free port from first offset, pick a new
++ * one and try again, with ever smaller search window.
++ */
++another_round:
++ for (i = 0; i < attempts; i++, off++) {
+ *portptr = htons(min + off % range_size);
+- if (++i != range_size && nf_nat_used_tuple(tuple, ct))
+- continue;
+- if (!(range->flags & (NF_NAT_RANGE_PROTO_RANDOM_ALL|
+- NF_NAT_RANGE_PROTO_OFFSET)))
+- *rover = off;
+- return;
++ if (!nf_nat_used_tuple(tuple, ct))
++ return;
+ }
++
++ if (attempts >= range_size || attempts < 16)
++ return;
++ attempts /= 2;
++ off = prandom_u32();
++ goto another_round;
+ }
+ EXPORT_SYMBOL_GPL(nf_nat_l4proto_unique_tuple);
+
+diff --git a/net/netfilter/nf_nat_proto_dccp.c b/net/netfilter/nf_nat_proto_dccp.c
+index 67ea0d83aa5a8..7d4d2c124990b 100644
+--- a/net/netfilter/nf_nat_proto_dccp.c
++++ b/net/netfilter/nf_nat_proto_dccp.c
+@@ -18,8 +18,6 @@
+ #include <net/netfilter/nf_nat_l3proto.h>
+ #include <net/netfilter/nf_nat_l4proto.h>
+
+-static u_int16_t dccp_port_rover;
+-
+ static void
+ dccp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ struct nf_conntrack_tuple *tuple,
+@@ -27,8 +25,7 @@ dccp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ enum nf_nat_manip_type maniptype,
+ const struct nf_conn *ct)
+ {
+- nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct,
+- &dccp_port_rover);
++ nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct);
+ }
+
+ static bool
+diff --git a/net/netfilter/nf_nat_proto_sctp.c b/net/netfilter/nf_nat_proto_sctp.c
+index 1c5d9b65fbbab..f05ad8fa7b208 100644
+--- a/net/netfilter/nf_nat_proto_sctp.c
++++ b/net/netfilter/nf_nat_proto_sctp.c
+@@ -12,8 +12,6 @@
+
+ #include <net/netfilter/nf_nat_l4proto.h>
+
+-static u_int16_t nf_sctp_port_rover;
+-
+ static void
+ sctp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ struct nf_conntrack_tuple *tuple,
+@@ -21,8 +19,7 @@ sctp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ enum nf_nat_manip_type maniptype,
+ const struct nf_conn *ct)
+ {
+- nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct,
+- &nf_sctp_port_rover);
++ nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct);
+ }
+
+ static bool
+diff --git a/net/netfilter/nf_nat_proto_tcp.c b/net/netfilter/nf_nat_proto_tcp.c
+index f15fcd475f987..c312e6b3e2ea6 100644
+--- a/net/netfilter/nf_nat_proto_tcp.c
++++ b/net/netfilter/nf_nat_proto_tcp.c
+@@ -18,8 +18,6 @@
+ #include <net/netfilter/nf_nat_l4proto.h>
+ #include <net/netfilter/nf_nat_core.h>
+
+-static u16 tcp_port_rover;
+-
+ static void
+ tcp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ struct nf_conntrack_tuple *tuple,
+@@ -27,8 +25,7 @@ tcp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ enum nf_nat_manip_type maniptype,
+ const struct nf_conn *ct)
+ {
+- nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct,
+- &tcp_port_rover);
++ nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct);
+ }
+
+ static bool
+diff --git a/net/netfilter/nf_nat_proto_udp.c b/net/netfilter/nf_nat_proto_udp.c
+index d85c31c2433cf..357539d158497 100644
+--- a/net/netfilter/nf_nat_proto_udp.c
++++ b/net/netfilter/nf_nat_proto_udp.c
+@@ -17,8 +17,6 @@
+ #include <net/netfilter/nf_nat_l3proto.h>
+ #include <net/netfilter/nf_nat_l4proto.h>
+
+-static u16 udp_port_rover;
+-
+ static void
+ udp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ struct nf_conntrack_tuple *tuple,
+@@ -26,8 +24,7 @@ udp_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ enum nf_nat_manip_type maniptype,
+ const struct nf_conn *ct)
+ {
+- nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct,
+- &udp_port_rover);
++ nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct);
+ }
+
+ static void
+@@ -78,8 +75,6 @@ static bool udp_manip_pkt(struct sk_buff *skb,
+ }
+
+ #ifdef CONFIG_NF_NAT_PROTO_UDPLITE
+-static u16 udplite_port_rover;
+-
+ static bool udplite_manip_pkt(struct sk_buff *skb,
+ const struct nf_nat_l3proto *l3proto,
+ unsigned int iphdroff, unsigned int hdroff,
+@@ -103,8 +98,7 @@ udplite_unique_tuple(const struct nf_nat_l3proto *l3proto,
+ enum nf_nat_manip_type maniptype,
+ const struct nf_conn *ct)
+ {
+- nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct,
+- &udplite_port_rover);
++ nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct);
+ }
+
+ const struct nf_nat_l4proto nf_nat_l4proto_udplite = {
+diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
+index b1a9f330a51fe..fd87216bc0a99 100644
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -194,6 +194,9 @@ static int nft_payload_l4csum_offset(const struct nft_pktinfo *pkt,
+ struct sk_buff *skb,
+ unsigned int *l4csum_offset)
+ {
++ if (pkt->xt.fragoff)
++ return -1;
++
+ switch (pkt->tprot) {
+ case IPPROTO_TCP:
+ *l4csum_offset = offsetof(struct tcphdr, check);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 1309161032d50..bd7e8d406c71e 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1716,6 +1716,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
+ match->prot_hook.dev = po->prot_hook.dev;
+ match->prot_hook.func = packet_rcv_fanout;
+ match->prot_hook.af_packet_priv = match;
++ match->prot_hook.af_packet_net = read_pnet(&match->net);
+ match->prot_hook.id_match = match_fanout_group;
+ list_add(&match->list, &fanout_list);
+ }
+@@ -1729,7 +1730,10 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
+ err = -ENOSPC;
+ if (refcount_read(&match->sk_ref) < PACKET_FANOUT_MAX) {
+ __dev_remove_pack(&po->prot_hook);
+- po->fanout = match;
++
++ /* Paired with packet_setsockopt(PACKET_FANOUT_DATA) */
++ WRITE_ONCE(po->fanout, match);
++
+ po->rollover = rollover;
+ rollover = NULL;
+ refcount_set(&match->sk_ref, refcount_read(&match->sk_ref) + 1);
+@@ -3294,6 +3298,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
+ po->prot_hook.func = packet_rcv_spkt;
+
+ po->prot_hook.af_packet_priv = sk;
++ po->prot_hook.af_packet_net = sock_net(sk);
+
+ if (proto) {
+ po->prot_hook.type = proto;
+@@ -3875,7 +3880,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ }
+ case PACKET_FANOUT_DATA:
+ {
+- if (!po->fanout)
++ /* Paired with the WRITE_ONCE() in fanout_add() */
++ if (!READ_ONCE(po->fanout))
+ return -EINVAL;
+
+ return fanout_set_data(po, optval, optlen);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c23993b9c6238..459f629fa0a86 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2106,6 +2106,7 @@ static void alc1220_fixup_gb_x570(struct hda_codec *codec,
+ {
+ static const hda_nid_t conn1[] = { 0x0c };
+ static const struct coef_fw gb_x570_coefs[] = {
++ WRITE_COEF(0x07, 0x03c0),
+ WRITE_COEF(0x1a, 0x01c1),
+ WRITE_COEF(0x1b, 0x0202),
+ WRITE_COEF(0x43, 0x3005),
+@@ -2532,7 +2533,8 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_GB_X570),
+- SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1458, 0xa0ce, "Gigabyte X570 Aorus Xtreme", ALC1220_FIXUP_GB_X570),
++ SND_PCI_QUIRK(0x1458, 0xa0d5, "Gigabyte X570S Aorus Master", ALC1220_FIXUP_GB_X570),
+ SND_PCI_QUIRK(0x1462, 0x11f7, "MSI-GE63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1228, "MSI-GP63", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1229, "MSI-GP73", ALC1220_FIXUP_CLEVO_P950),
+@@ -2607,6 +2609,7 @@ static const struct hda_model_fixup alc882_fixup_models[] = {
+ {.id = ALC882_FIXUP_NO_PRIMARY_HP, .name = "no-primary-hp"},
+ {.id = ALC887_FIXUP_ASUS_BASS, .name = "asus-bass"},
+ {.id = ALC1220_FIXUP_GB_DUAL_CODECS, .name = "dual-codecs"},
++ {.id = ALC1220_FIXUP_GB_X570, .name = "gb-x570"},
+ {.id = ALC1220_FIXUP_CLEVO_P950, .name = "clevo-p950"},
+ {}
+ };
+diff --git a/sound/soc/codecs/cpcap.c b/sound/soc/codecs/cpcap.c
+index 1902689c5ea2c..acd88fe38cd4c 100644
+--- a/sound/soc/codecs/cpcap.c
++++ b/sound/soc/codecs/cpcap.c
+@@ -1541,6 +1541,8 @@ static int cpcap_codec_probe(struct platform_device *pdev)
+ {
+ struct device_node *codec_node =
+ of_get_child_by_name(pdev->dev.parent->of_node, "audio-codec");
++ if (!codec_node)
++ return -ENODEV;
+
+ pdev->dev.of_node = codec_node;
+
+diff --git a/sound/soc/codecs/max9759.c b/sound/soc/codecs/max9759.c
+index ecfb4a80424bc..ec0a482e9000b 100644
+--- a/sound/soc/codecs/max9759.c
++++ b/sound/soc/codecs/max9759.c
+@@ -64,7 +64,8 @@ static int speaker_gain_control_put(struct snd_kcontrol *kcontrol,
+ struct snd_soc_component *c = snd_soc_kcontrol_component(kcontrol);
+ struct max9759 *priv = snd_soc_component_get_drvdata(c);
+
+- if (ucontrol->value.integer.value[0] > 3)
++ if (ucontrol->value.integer.value[0] < 0 ||
++ ucontrol->value.integer.value[0] > 3)
+ return -EINVAL;
+
+ priv->gain = ucontrol->value.integer.value[0];
+diff --git a/sound/soc/fsl/pcm030-audio-fabric.c b/sound/soc/fsl/pcm030-audio-fabric.c
+index ec731223cab3d..72d4548994842 100644
+--- a/sound/soc/fsl/pcm030-audio-fabric.c
++++ b/sound/soc/fsl/pcm030-audio-fabric.c
+@@ -90,16 +90,21 @@ static int pcm030_fabric_probe(struct platform_device *op)
+ dev_err(&op->dev, "platform_device_alloc() failed\n");
+
+ ret = platform_device_add(pdata->codec_device);
+- if (ret)
++ if (ret) {
+ dev_err(&op->dev, "platform_device_add() failed: %d\n", ret);
++ platform_device_put(pdata->codec_device);
++ }
+
+ ret = snd_soc_register_card(card);
+- if (ret)
++ if (ret) {
+ dev_err(&op->dev, "snd_soc_register_card() failed: %d\n", ret);
++ platform_device_del(pdata->codec_device);
++ platform_device_put(pdata->codec_device);
++ }
+
+ platform_set_drvdata(op, pdata);
+-
+ return ret;
++
+ }
+
+ static int pcm030_fabric_remove(struct platform_device *op)
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index 95fc24580f85f..ef8fd331526b0 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -322,13 +322,27 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol,
+ if (sign_bit)
+ mask = BIT(sign_bit + 1) - 1;
+
+- val = ((ucontrol->value.integer.value[0] + min) & mask);
++ val = ucontrol->value.integer.value[0];
++ if (mc->platform_max && val > mc->platform_max)
++ return -EINVAL;
++ if (val > max - min)
++ return -EINVAL;
++ if (val < 0)
++ return -EINVAL;
++ val = (val + min) & mask;
+ if (invert)
+ val = max - val;
+ val_mask = mask << shift;
+ val = val << shift;
+ if (snd_soc_volsw_is_stereo(mc)) {
+- val2 = ((ucontrol->value.integer.value[1] + min) & mask);
++ val2 = ucontrol->value.integer.value[1];
++ if (mc->platform_max && val2 > mc->platform_max)
++ return -EINVAL;
++ if (val2 > max - min)
++ return -EINVAL;
++ if (val2 < 0)
++ return -EINVAL;
++ val2 = (val2 + min) & mask;
+ if (invert)
+ val2 = max - val2;
+ if (reg == reg2) {
+@@ -422,8 +436,15 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol,
+ int err = 0;
+ unsigned int val, val_mask, val2 = 0;
+
++ val = ucontrol->value.integer.value[0];
++ if (mc->platform_max && val > mc->platform_max)
++ return -EINVAL;
++ if (val > max - min)
++ return -EINVAL;
++ if (val < 0)
++ return -EINVAL;
+ val_mask = mask << shift;
+- val = (ucontrol->value.integer.value[0] + min) & mask;
++ val = (val + min) & mask;
+ val = val << shift;
+
+ err = snd_soc_component_update_bits(component, reg, val_mask, val);
+@@ -889,6 +910,8 @@ int snd_soc_put_xr_sx(struct snd_kcontrol *kcontrol,
+ unsigned int i, regval, regmask;
+ int err;
+
++ if (val < mc->min || val > mc->max)
++ return -EINVAL;
+ if (invert)
+ val = max - val;
+ val &= mask;
+diff --git a/tools/testing/selftests/futex/Makefile b/tools/testing/selftests/futex/Makefile
+index 12631f0076a10..11e157d7533b8 100644
+--- a/tools/testing/selftests/futex/Makefile
++++ b/tools/testing/selftests/futex/Makefile
+@@ -11,7 +11,7 @@ all:
+ @for DIR in $(SUBDIRS); do \
+ BUILD_TARGET=$(OUTPUT)/$$DIR; \
+ mkdir $$BUILD_TARGET -p; \
+- make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\
++ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$DIR $@;\
+ if [ -e $$DIR/$(TEST_PROGS) ]; then \
+ rsync -a $$DIR/$(TEST_PROGS) $$BUILD_TARGET/; \
+ fi \
+@@ -32,6 +32,6 @@ override define CLEAN
+ @for DIR in $(SUBDIRS); do \
+ BUILD_TARGET=$(OUTPUT)/$$DIR; \
+ mkdir $$BUILD_TARGET -p; \
+- make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\
++ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$DIR $@;\
+ done
+ endef
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-02-11 12:37 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-02-11 12:37 UTC (permalink / raw
To: gentoo-commits
commit: 67c2e8751c49d2e96eeeda342993dbe62cff4869
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 11 12:36:49 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Feb 11 12:36:49 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=67c2e875
Linux patch 4.19.229
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 ++
1228_linux-4.19.229.patch | 122 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 126 insertions(+)
diff --git a/0000_README b/0000_README
index e1d00b7a..760533fa 100644
--- a/0000_README
+++ b/0000_README
@@ -951,6 +951,10 @@ Patch: 1227_linux-4.19.228.patch
From: https://www.kernel.org
Desc: Linux 4.19.228
+Patch: 1228_linux-4.19.229.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.229
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1228_linux-4.19.229.patch b/1228_linux-4.19.229.patch
new file mode 100644
index 00000000..58d708f7
--- /dev/null
+++ b/1228_linux-4.19.229.patch
@@ -0,0 +1,122 @@
+diff --git a/Makefile b/Makefile
+index 1779149108cff..e8be2ea115da2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 228
++SUBLEVEL = 229
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
+index 5553a5643f405..5c81dc7371db7 100644
+--- a/drivers/mmc/host/moxart-mmc.c
++++ b/drivers/mmc/host/moxart-mmc.c
+@@ -696,12 +696,12 @@ static int moxart_remove(struct platform_device *pdev)
+ if (!IS_ERR(host->dma_chan_rx))
+ dma_release_channel(host->dma_chan_rx);
+ mmc_remove_host(mmc);
+- mmc_free_host(mmc);
+
+ writel(0, host->base + REG_INTERRUPT_MASK);
+ writel(0, host->base + REG_POWER_CONTROL);
+ writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF,
+ host->base + REG_CLOCK_CONTROL);
++ mmc_free_host(mmc);
+ }
+ return 0;
+ }
+diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
+index 5456611874eb5..ced2b3f3547c6 100644
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -577,6 +577,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
+
+ BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
+
++ /*
++ * Release agent gets called with all capabilities,
++ * require capabilities to set release agent.
++ */
++ if ((of->file->f_cred->user_ns != &init_user_ns) ||
++ !capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ cgrp = cgroup_kn_lock_live(of->kn, false);
+ if (!cgrp)
+ return -ENODEV;
+@@ -1048,6 +1056,7 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data)
+ {
+ int ret = 0;
+ struct cgroup_root *root = cgroup_root_from_kf(kf_root);
++ struct cgroup_namespace *ns = current->nsproxy->cgroup_ns;
+ struct cgroup_sb_opts opts;
+ u16 added_mask, removed_mask;
+
+@@ -1061,6 +1070,12 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data)
+ if (opts.subsys_mask != root->subsys_mask || opts.release_agent)
+ pr_warn("option changes via remount are deprecated (pid=%d comm=%s)\n",
+ task_tgid_nr(current), current->comm);
++ /* See cgroup1_mount release_agent handling */
++ if (opts.release_agent &&
++ ((ns->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))) {
++ ret = -EINVAL;
++ goto out_unlock;
++ }
+
+ added_mask = opts.subsys_mask & ~root->subsys_mask;
+ removed_mask = root->subsys_mask & ~opts.subsys_mask;
+@@ -1224,6 +1239,15 @@ struct dentry *cgroup1_mount(struct file_system_type *fs_type, int flags,
+ ret = -EPERM;
+ goto out_unlock;
+ }
++ /*
++ * Release agent gets called with all capabilities,
++ * require capabilities to set release agent.
++ */
++ if (opts.release_agent &&
++ ((ns->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))) {
++ ret = -EINVAL;
++ goto out_unlock;
++ }
+
+ root = kzalloc(sizeof(*root), GFP_KERNEL);
+ if (!root) {
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index bd28ac7f2195a..0d2ee4eb131f5 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1579,13 +1579,16 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
+ u16 peers_tol = msg_link_tolerance(hdr);
+ u16 peers_prio = msg_linkprio(hdr);
+ u16 rcv_nxt = l->rcv_nxt;
+- u16 dlen = msg_data_sz(hdr);
++ u32 dlen = msg_data_sz(hdr);
+ int mtyp = msg_type(hdr);
+ bool reply = msg_probe(hdr);
+ void *data;
+ char *if_name;
+ int rc = 0;
+
++ if (dlen > U16_MAX)
++ goto exit;
++
+ if (tipc_link_is_blocked(l) || !xmitq)
+ goto exit;
+
+diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
+index 23706ee166074..7b6c1c5c30dc8 100644
+--- a/net/tipc/monitor.c
++++ b/net/tipc/monitor.c
+@@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr,
+ state->probing = false;
+
+ /* Sanity check received domain record */
++ if (new_member_cnt > MAX_MON_DOMAIN)
++ return;
+ if (dlen < dom_rec_len(arrv_dom, 0))
+ return;
+ if (dlen != dom_rec_len(arrv_dom, new_member_cnt))
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-02-11 12:45 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-02-11 12:45 UTC (permalink / raw
To: gentoo-commits
commit: 7753442bf7d999e4b14e57f20558ec33ef30bca3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 11 12:37:36 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Feb 11 12:37:36 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7753442b
Linux patch 4.14.266
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 ++
1265_linux-4.14.266.patch | 134 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 138 insertions(+)
diff --git a/0000_README b/0000_README
index 760533fa..30a2e032 100644
--- a/0000_README
+++ b/0000_README
@@ -955,6 +955,10 @@ Patch: 1228_linux-4.19.229.patch
From: https://www.kernel.org
Desc: Linux 4.19.229
+Patch: 1229_linux-4.19.230.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.230
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1265_linux-4.14.266.patch b/1265_linux-4.14.266.patch
new file mode 100644
index 00000000..7722be6a
--- /dev/null
+++ b/1265_linux-4.14.266.patch
@@ -0,0 +1,134 @@
+diff --git a/Makefile b/Makefile
+index bc98aa57a6faf..1fe02d57d6a70 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 265
++SUBLEVEL = 266
+ EXTRAVERSION =
+ NAME = Petit Gorille
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 95c09db1bba21..d8399a6891655 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -589,7 +589,7 @@ static int srao_decode_notifier(struct notifier_block *nb, unsigned long val,
+
+ if (mce_usable_address(mce) && (mce->severity == MCE_AO_SEVERITY)) {
+ pfn = mce->addr >> PAGE_SHIFT;
+- if (memory_failure(pfn, MCE_VECTOR, 0))
++ if (!memory_failure(pfn, MCE_VECTOR, 0))
+ mce_unmap_kpfn(pfn);
+ }
+
+diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
+index 5553a5643f405..5c81dc7371db7 100644
+--- a/drivers/mmc/host/moxart-mmc.c
++++ b/drivers/mmc/host/moxart-mmc.c
+@@ -696,12 +696,12 @@ static int moxart_remove(struct platform_device *pdev)
+ if (!IS_ERR(host->dma_chan_rx))
+ dma_release_channel(host->dma_chan_rx);
+ mmc_remove_host(mmc);
+- mmc_free_host(mmc);
+
+ writel(0, host->base + REG_INTERRUPT_MASK);
+ writel(0, host->base + REG_POWER_CONTROL);
+ writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF,
+ host->base + REG_CLOCK_CONTROL);
++ mmc_free_host(mmc);
+ }
+ return 0;
+ }
+diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
+index 5602bd81caa90..105f5b2f59783 100644
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -577,6 +577,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
+
+ BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
+
++ /*
++ * Release agent gets called with all capabilities,
++ * require capabilities to set release agent.
++ */
++ if ((of->file->f_cred->user_ns != &init_user_ns) ||
++ !capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ cgrp = cgroup_kn_lock_live(of->kn, false);
+ if (!cgrp)
+ return -ENODEV;
+@@ -1060,6 +1068,7 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data)
+ {
+ int ret = 0;
+ struct cgroup_root *root = cgroup_root_from_kf(kf_root);
++ struct cgroup_namespace *ns = current->nsproxy->cgroup_ns;
+ struct cgroup_sb_opts opts;
+ u16 added_mask, removed_mask;
+
+@@ -1073,6 +1082,12 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data)
+ if (opts.subsys_mask != root->subsys_mask || opts.release_agent)
+ pr_warn("option changes via remount are deprecated (pid=%d comm=%s)\n",
+ task_tgid_nr(current), current->comm);
++ /* See cgroup1_mount release_agent handling */
++ if (opts.release_agent &&
++ ((ns->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))) {
++ ret = -EINVAL;
++ goto out_unlock;
++ }
+
+ added_mask = opts.subsys_mask & ~root->subsys_mask;
+ removed_mask = root->subsys_mask & ~opts.subsys_mask;
+@@ -1236,6 +1251,15 @@ struct dentry *cgroup1_mount(struct file_system_type *fs_type, int flags,
+ ret = -EPERM;
+ goto out_unlock;
+ }
++ /*
++ * Release agent gets called with all capabilities,
++ * require capabilities to set release agent.
++ */
++ if (opts.release_agent &&
++ ((ns->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))) {
++ ret = -EINVAL;
++ goto out_unlock;
++ }
+
+ root = kzalloc(sizeof(*root), GFP_KERNEL);
+ if (!root) {
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 0b44427e29ec5..d3017811b67a6 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1462,12 +1462,15 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
+ u16 peers_tol = msg_link_tolerance(hdr);
+ u16 peers_prio = msg_linkprio(hdr);
+ u16 rcv_nxt = l->rcv_nxt;
+- u16 dlen = msg_data_sz(hdr);
++ u32 dlen = msg_data_sz(hdr);
+ int mtyp = msg_type(hdr);
+ void *data;
+ char *if_name;
+ int rc = 0;
+
++ if (dlen > U16_MAX)
++ goto exit;
++
+ if (tipc_link_is_blocked(l) || !xmitq)
+ goto exit;
+
+diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
+index 254ddc2c39146..c6496da9392d7 100644
+--- a/net/tipc/monitor.c
++++ b/net/tipc/monitor.c
+@@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr,
+ state->probing = false;
+
+ /* Sanity check received domain record */
++ if (new_member_cnt > MAX_MON_DOMAIN)
++ return;
+ if (dlen < dom_rec_len(arrv_dom, 0))
+ return;
+ if (dlen != dom_rec_len(arrv_dom, new_member_cnt))
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-02-11 12:46 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-02-11 12:46 UTC (permalink / raw
To: gentoo-commits
commit: 957b45f694a54bba43bfe2b1c5da8bc1f6c20951
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 11 12:46:45 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Feb 11 12:46:45 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=957b45f6
Remove incorrect patch
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
1265_linux-4.14.266.patch | 134 ----------------------------------------------
1 file changed, 134 deletions(-)
diff --git a/1265_linux-4.14.266.patch b/1265_linux-4.14.266.patch
deleted file mode 100644
index 7722be6a..00000000
--- a/1265_linux-4.14.266.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-diff --git a/Makefile b/Makefile
-index bc98aa57a6faf..1fe02d57d6a70 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,7 +1,7 @@
- # SPDX-License-Identifier: GPL-2.0
- VERSION = 4
- PATCHLEVEL = 14
--SUBLEVEL = 265
-+SUBLEVEL = 266
- EXTRAVERSION =
- NAME = Petit Gorille
-
-diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
-index 95c09db1bba21..d8399a6891655 100644
---- a/arch/x86/kernel/cpu/mcheck/mce.c
-+++ b/arch/x86/kernel/cpu/mcheck/mce.c
-@@ -589,7 +589,7 @@ static int srao_decode_notifier(struct notifier_block *nb, unsigned long val,
-
- if (mce_usable_address(mce) && (mce->severity == MCE_AO_SEVERITY)) {
- pfn = mce->addr >> PAGE_SHIFT;
-- if (memory_failure(pfn, MCE_VECTOR, 0))
-+ if (!memory_failure(pfn, MCE_VECTOR, 0))
- mce_unmap_kpfn(pfn);
- }
-
-diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
-index 5553a5643f405..5c81dc7371db7 100644
---- a/drivers/mmc/host/moxart-mmc.c
-+++ b/drivers/mmc/host/moxart-mmc.c
-@@ -696,12 +696,12 @@ static int moxart_remove(struct platform_device *pdev)
- if (!IS_ERR(host->dma_chan_rx))
- dma_release_channel(host->dma_chan_rx);
- mmc_remove_host(mmc);
-- mmc_free_host(mmc);
-
- writel(0, host->base + REG_INTERRUPT_MASK);
- writel(0, host->base + REG_POWER_CONTROL);
- writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF,
- host->base + REG_CLOCK_CONTROL);
-+ mmc_free_host(mmc);
- }
- return 0;
- }
-diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
-index 5602bd81caa90..105f5b2f59783 100644
---- a/kernel/cgroup/cgroup-v1.c
-+++ b/kernel/cgroup/cgroup-v1.c
-@@ -577,6 +577,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
-
- BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
-
-+ /*
-+ * Release agent gets called with all capabilities,
-+ * require capabilities to set release agent.
-+ */
-+ if ((of->file->f_cred->user_ns != &init_user_ns) ||
-+ !capable(CAP_SYS_ADMIN))
-+ return -EPERM;
-+
- cgrp = cgroup_kn_lock_live(of->kn, false);
- if (!cgrp)
- return -ENODEV;
-@@ -1060,6 +1068,7 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data)
- {
- int ret = 0;
- struct cgroup_root *root = cgroup_root_from_kf(kf_root);
-+ struct cgroup_namespace *ns = current->nsproxy->cgroup_ns;
- struct cgroup_sb_opts opts;
- u16 added_mask, removed_mask;
-
-@@ -1073,6 +1082,12 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data)
- if (opts.subsys_mask != root->subsys_mask || opts.release_agent)
- pr_warn("option changes via remount are deprecated (pid=%d comm=%s)\n",
- task_tgid_nr(current), current->comm);
-+ /* See cgroup1_mount release_agent handling */
-+ if (opts.release_agent &&
-+ ((ns->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))) {
-+ ret = -EINVAL;
-+ goto out_unlock;
-+ }
-
- added_mask = opts.subsys_mask & ~root->subsys_mask;
- removed_mask = root->subsys_mask & ~opts.subsys_mask;
-@@ -1236,6 +1251,15 @@ struct dentry *cgroup1_mount(struct file_system_type *fs_type, int flags,
- ret = -EPERM;
- goto out_unlock;
- }
-+ /*
-+ * Release agent gets called with all capabilities,
-+ * require capabilities to set release agent.
-+ */
-+ if (opts.release_agent &&
-+ ((ns->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))) {
-+ ret = -EINVAL;
-+ goto out_unlock;
-+ }
-
- root = kzalloc(sizeof(*root), GFP_KERNEL);
- if (!root) {
-diff --git a/net/tipc/link.c b/net/tipc/link.c
-index 0b44427e29ec5..d3017811b67a6 100644
---- a/net/tipc/link.c
-+++ b/net/tipc/link.c
-@@ -1462,12 +1462,15 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
- u16 peers_tol = msg_link_tolerance(hdr);
- u16 peers_prio = msg_linkprio(hdr);
- u16 rcv_nxt = l->rcv_nxt;
-- u16 dlen = msg_data_sz(hdr);
-+ u32 dlen = msg_data_sz(hdr);
- int mtyp = msg_type(hdr);
- void *data;
- char *if_name;
- int rc = 0;
-
-+ if (dlen > U16_MAX)
-+ goto exit;
-+
- if (tipc_link_is_blocked(l) || !xmitq)
- goto exit;
-
-diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
-index 254ddc2c39146..c6496da9392d7 100644
---- a/net/tipc/monitor.c
-+++ b/net/tipc/monitor.c
-@@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr,
- state->probing = false;
-
- /* Sanity check received domain record */
-+ if (new_member_cnt > MAX_MON_DOMAIN)
-+ return;
- if (dlen < dom_rec_len(arrv_dom, 0))
- return;
- if (dlen != dom_rec_len(arrv_dom, new_member_cnt))
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-02-11 12:53 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-02-11 12:53 UTC (permalink / raw
To: gentoo-commits
commit: 0d30b268dc6aba7ab900933b8e12b28cdf507f13
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 11 12:52:58 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Feb 11 12:52:58 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0d30b268
Update readme
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 ----
1 file changed, 4 deletions(-)
diff --git a/0000_README b/0000_README
index 30a2e032..760533fa 100644
--- a/0000_README
+++ b/0000_README
@@ -955,10 +955,6 @@ Patch: 1228_linux-4.19.229.patch
From: https://www.kernel.org
Desc: Linux 4.19.229
-Patch: 1229_linux-4.19.230.patch
-From: https://www.kernel.org
-Desc: Linux 4.19.230
-
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-02-16 12:47 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-02-16 12:47 UTC (permalink / raw
To: gentoo-commits
commit: 01699d3fc0ecc0f800937307cd9f8739d361bab4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 16 12:47:20 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Feb 16 12:47:20 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=01699d3f
Linux patch 4.19.130
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1229_linux-4.19.230.patch | 1327 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1331 insertions(+)
diff --git a/0000_README b/0000_README
index 760533fa..30a2e032 100644
--- a/0000_README
+++ b/0000_README
@@ -955,6 +955,10 @@ Patch: 1228_linux-4.19.229.patch
From: https://www.kernel.org
Desc: Linux 4.19.229
+Patch: 1229_linux-4.19.230.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.230
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1229_linux-4.19.230.patch b/1229_linux-4.19.230.patch
new file mode 100644
index 00000000..00cb4f96
--- /dev/null
+++ b/1229_linux-4.19.230.patch
@@ -0,0 +1,1327 @@
+diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
+index 37a679501ddc6..8bd3b01539593 100644
+--- a/Documentation/sysctl/kernel.txt
++++ b/Documentation/sysctl/kernel.txt
+@@ -94,6 +94,7 @@ show up in /proc/sys/kernel:
+ - sysctl_writes_strict
+ - tainted
+ - threads-max
++- unprivileged_bpf_disabled
+ - unknown_nmi_panic
+ - watchdog
+ - watchdog_thresh
+@@ -1041,6 +1042,26 @@ available RAM pages threads-max is reduced accordingly.
+
+ ==============================================================
+
++unprivileged_bpf_disabled:
++
++Writing 1 to this entry will disable unprivileged calls to bpf();
++once disabled, calling bpf() without CAP_SYS_ADMIN will return
++-EPERM. Once set to 1, this can't be cleared from the running kernel
++anymore.
++
++Writing 2 to this entry will also disable unprivileged calls to bpf(),
++however, an admin can still change this setting later on, if needed, by
++writing 0 or 1 to this entry.
++
++If BPF_UNPRIV_DEFAULT_OFF is enabled in the kernel config, then this
++entry will default to 2 instead of 0.
++
++ 0 - Unprivileged calls to bpf() are enabled
++ 1 - Unprivileged calls to bpf() are disabled without recovery
++ 2 - Unprivileged calls to bpf() are disabled
++
++==============================================================
++
+ unknown_nmi_panic:
+
+ The value in this file affects behavior of handling NMI. When the
+diff --git a/Makefile b/Makefile
+index e8be2ea115da2..1a19d5d8840ff 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 229
++SUBLEVEL = 230
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/imx23-evk.dts b/arch/arm/boot/dts/imx23-evk.dts
+index aca27aa2d44bd..8ed52ecc965fb 100644
+--- a/arch/arm/boot/dts/imx23-evk.dts
++++ b/arch/arm/boot/dts/imx23-evk.dts
+@@ -79,7 +79,6 @@
+ MX23_PAD_LCD_RESET__GPIO_1_18
+ MX23_PAD_PWM3__GPIO_1_29
+ MX23_PAD_PWM4__GPIO_1_30
+- MX23_PAD_SSP1_DETECT__SSP1_DETECT
+ >;
+ fsl,drive-strength = <MXS_DRIVE_4mA>;
+ fsl,voltage = <MXS_VOLTAGE_HIGH>;
+diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+index 4cc9858f7ff80..ef63ea5873ed5 100644
+--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+@@ -5,6 +5,8 @@
+ * Author: Fabio Estevam <fabio.estevam@freescale.com>
+ */
+
++#include <dt-bindings/gpio/gpio.h>
++
+ / {
+ aliases {
+ backlight = &backlight;
+@@ -210,6 +212,7 @@
+ MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059
+ MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059
+ MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059
++ MX6QDL_PAD_SD3_DAT5__GPIO7_IO00 0x1b0b0
+ >;
+ };
+
+@@ -276,7 +279,7 @@
+ &usdhc3 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usdhc3>;
+- non-removable;
++ cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/meson.dtsi b/arch/arm/boot/dts/meson.dtsi
+index a86b890863347..2486feb5323bc 100644
+--- a/arch/arm/boot/dts/meson.dtsi
++++ b/arch/arm/boot/dts/meson.dtsi
+@@ -91,14 +91,14 @@
+ };
+
+ uart_A: serial@84c0 {
+- compatible = "amlogic,meson6-uart", "amlogic,meson-uart";
++ compatible = "amlogic,meson6-uart";
+ reg = <0x84c0 0x18>;
+ interrupts = <GIC_SPI 26 IRQ_TYPE_EDGE_RISING>;
+ status = "disabled";
+ };
+
+ uart_B: serial@84dc {
+- compatible = "amlogic,meson6-uart", "amlogic,meson-uart";
++ compatible = "amlogic,meson6-uart";
+ reg = <0x84dc 0x18>;
+ interrupts = <GIC_SPI 75 IRQ_TYPE_EDGE_RISING>;
+ status = "disabled";
+@@ -136,7 +136,7 @@
+ };
+
+ uart_C: serial@8700 {
+- compatible = "amlogic,meson6-uart", "amlogic,meson-uart";
++ compatible = "amlogic,meson6-uart";
+ reg = <0x8700 0x18>;
+ interrupts = <GIC_SPI 93 IRQ_TYPE_EDGE_RISING>;
+ status = "disabled";
+@@ -219,7 +219,7 @@
+ };
+
+ uart_AO: serial@4c0 {
+- compatible = "amlogic,meson6-uart", "amlogic,meson-ao-uart", "amlogic,meson-uart";
++ compatible = "amlogic,meson6-uart", "amlogic,meson-ao-uart";
+ reg = <0x4c0 0x18>;
+ interrupts = <GIC_SPI 90 IRQ_TYPE_EDGE_RISING>;
+ status = "disabled";
+diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
+index f4d0b4986affd..a5bca3bbe95d8 100644
+--- a/drivers/hwmon/dell-smm-hwmon.c
++++ b/drivers/hwmon/dell-smm-hwmon.c
+@@ -304,7 +304,7 @@ static int i8k_get_fan_nominal_speed(int fan, int speed)
+ }
+
+ /*
+- * Set the fan speed (off, low, high). Returns the new fan status.
++ * Set the fan speed (off, low, high, ...).
+ */
+ static int i8k_set_fan(int fan, int speed)
+ {
+@@ -316,7 +316,7 @@ static int i8k_set_fan(int fan, int speed)
+ speed = (speed < 0) ? 0 : ((speed > i8k_fan_max) ? i8k_fan_max : speed);
+ regs.ebx = (fan & 0xff) | (speed << 8);
+
+- return i8k_smm(®s) ? : i8k_get_fan_status(fan);
++ return i8k_smm(®s);
+ }
+
+ static int i8k_get_temp_type(int sensor)
+@@ -430,7 +430,7 @@ static int
+ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
+ {
+ int val = 0;
+- int speed;
++ int speed, err;
+ unsigned char buff[16];
+ int __user *argp = (int __user *)arg;
+
+@@ -491,7 +491,11 @@ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
+ if (copy_from_user(&speed, argp + 1, sizeof(int)))
+ return -EFAULT;
+
+- val = i8k_set_fan(val, speed);
++ err = i8k_set_fan(val, speed);
++ if (err < 0)
++ return err;
++
++ val = i8k_get_fan_status(val);
+ break;
+
+ default:
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index 2c9110fee1cc2..d6cb0f9a34880 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -472,12 +472,16 @@ static void esdhc_of_adma_workaround(struct sdhci_host *host, u32 intmask)
+
+ static int esdhc_of_enable_dma(struct sdhci_host *host)
+ {
++ int ret;
+ u32 value;
+ struct device *dev = mmc_dev(host->mmc);
+
+ if (of_device_is_compatible(dev->of_node, "fsl,ls1043a-esdhc") ||
+- of_device_is_compatible(dev->of_node, "fsl,ls1046a-esdhc"))
+- dma_set_mask_and_coherent(dev, DMA_BIT_MASK(40));
++ of_device_is_compatible(dev->of_node, "fsl,ls1046a-esdhc")) {
++ ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(40));
++ if (ret)
++ return ret;
++ }
+
+ value = sdhci_readl(host, ESDHC_DMA_SYSCTL);
+
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index 93dfcef8afc4b..035923876c617 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -1012,8 +1012,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
+ if (port->aggregator &&
+ port->aggregator->is_active &&
+ !__port_is_enabled(port)) {
+-
+ __enable_port(port);
++ *update_slave_arr = true;
+ }
+ }
+ break;
+@@ -1760,6 +1760,7 @@ static void ad_agg_selection_logic(struct aggregator *agg,
+ port = port->next_port_in_aggregator) {
+ __enable_port(port);
+ }
++ *update_slave_arr = true;
+ }
+ }
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+index 7b86240ecd5fe..c4f1fc97987ae 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+@@ -418,6 +418,9 @@ static void xgbe_pci_remove(struct pci_dev *pdev)
+
+ pci_free_irq_vectors(pdata->pcidev);
+
++ /* Disable all interrupts in the hardware */
++ XP_IOWRITE(pdata, XP_INT_EN, 0x0);
++
+ xgbe_free_pdata(pdata);
+ }
+
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 7f94b445595ce..befb906acb205 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -1964,14 +1964,15 @@ static void ixgbevf_set_rx_buffer_len(struct ixgbevf_adapter *adapter,
+ if (adapter->flags & IXGBEVF_FLAGS_LEGACY_RX)
+ return;
+
+- set_ring_build_skb_enabled(rx_ring);
++ if (PAGE_SIZE < 8192)
++ if (max_frame > IXGBEVF_MAX_FRAME_BUILD_SKB)
++ set_ring_uses_large_buffer(rx_ring);
+
+- if (PAGE_SIZE < 8192) {
+- if (max_frame <= IXGBEVF_MAX_FRAME_BUILD_SKB)
+- return;
++ /* 82599 can't rely on RXDCTL.RLPML to restrict the size of the frame */
++ if (adapter->hw.mac.type == ixgbe_mac_82599_vf && !ring_uses_large_buffer(rx_ring))
++ return;
+
+- set_ring_uses_large_buffer(rx_ring);
+- }
++ set_ring_build_skb_enabled(rx_ring);
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index 4382deaeb570d..0137cba2cb54b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -712,7 +712,7 @@ static int sun8i_dwmac_reset(struct stmmac_priv *priv)
+
+ if (err) {
+ dev_err(priv->device, "EMAC reset timeout\n");
+- return -EFAULT;
++ return err;
+ }
+ return 0;
+ }
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 484f6691b9c9f..418b28b4267d3 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -899,16 +899,15 @@ static int m88e1118_config_aneg(struct phy_device *phydev)
+ {
+ int err;
+
+- err = genphy_soft_reset(phydev);
++ err = marvell_set_polarity(phydev, phydev->mdix_ctrl);
+ if (err < 0)
+ return err;
+
+- err = marvell_set_polarity(phydev, phydev->mdix_ctrl);
++ err = genphy_config_aneg(phydev);
+ if (err < 0)
+ return err;
+
+- err = genphy_config_aneg(phydev);
+- return 0;
++ return genphy_soft_reset(phydev);
+ }
+
+ static int m88e1118_config_init(struct phy_device *phydev)
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c
+index 5e988f7ec1743..76e834ca54e79 100644
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -152,9 +152,10 @@ static void __veth_xdp_flush(struct veth_rq *rq)
+ {
+ /* Write ptr_ring before reading rx_notify_masked */
+ smp_mb();
+- if (!rq->rx_notify_masked) {
+- rq->rx_notify_masked = true;
+- napi_schedule(&rq->xdp_napi);
++ if (!READ_ONCE(rq->rx_notify_masked) &&
++ napi_schedule_prep(&rq->xdp_napi)) {
++ WRITE_ONCE(rq->rx_notify_masked, true);
++ __napi_schedule(&rq->xdp_napi);
+ }
+ }
+
+@@ -623,8 +624,10 @@ static int veth_poll(struct napi_struct *napi, int budget)
+ /* Write rx_notify_masked before reading ptr_ring */
+ smp_store_mb(rq->rx_notify_masked, false);
+ if (unlikely(!__ptr_ring_empty(&rq->xdp_ring))) {
+- rq->rx_notify_masked = true;
+- napi_schedule(&rq->xdp_napi);
++ if (napi_schedule_prep(&rq->xdp_napi)) {
++ WRITE_ONCE(rq->rx_notify_masked, true);
++ __napi_schedule(&rq->xdp_napi);
++ }
+ }
+ }
+
+diff --git a/drivers/staging/fbtft/fbtft.h b/drivers/staging/fbtft/fbtft.h
+index 798a8fe98e957..247d0c23bb753 100644
+--- a/drivers/staging/fbtft/fbtft.h
++++ b/drivers/staging/fbtft/fbtft.h
+@@ -332,7 +332,10 @@ static int __init fbtft_driver_module_init(void) \
+ ret = spi_register_driver(&fbtft_driver_spi_driver); \
+ if (ret < 0) \
+ return ret; \
+- return platform_driver_register(&fbtft_driver_platform_driver); \
++ ret = platform_driver_register(&fbtft_driver_platform_driver); \
++ if (ret < 0) \
++ spi_unregister_driver(&fbtft_driver_spi_driver); \
++ return ret; \
+ } \
+ \
+ static void __exit fbtft_driver_module_exit(void) \
+diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
+index 101d62105c932..f3671ffdf1495 100644
+--- a/drivers/target/iscsi/iscsi_target_tpg.c
++++ b/drivers/target/iscsi/iscsi_target_tpg.c
+@@ -451,6 +451,9 @@ static bool iscsit_tpg_check_network_portal(
+ break;
+ }
+ spin_unlock(&tpg->tpg_np_lock);
++
++ if (match)
++ break;
+ }
+ spin_unlock(&tiqn->tiqn_tpg_lock);
+
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 5dc9686697cfa..1b237acbaa5b5 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -1375,7 +1375,7 @@ handle_newline:
+ put_tty_queue(c, ldata);
+ smp_store_release(&ldata->canon_head, ldata->read_head);
+ kill_fasync(&tty->fasync, SIGIO, POLL_IN);
+- wake_up_interruptible_poll(&tty->read_wait, EPOLLIN);
++ wake_up_interruptible_poll(&tty->read_wait, EPOLLIN | EPOLLRDNORM);
+ return 0;
+ }
+ }
+@@ -1656,7 +1656,7 @@ static void __receive_buf(struct tty_struct *tty, const unsigned char *cp,
+
+ if (read_cnt(ldata)) {
+ kill_fasync(&tty->fasync, SIGIO, POLL_IN);
+- wake_up_interruptible_poll(&tty->read_wait, EPOLLIN);
++ wake_up_interruptible_poll(&tty->read_wait, EPOLLIN | EPOLLRDNORM);
+ }
+ }
+
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index 076b8a3f8e7a5..78ae1f0908fd5 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -691,6 +691,7 @@ int vt_ioctl(struct tty_struct *tty,
+ ret = -ENXIO;
+ else {
+ arg--;
++ arg = array_index_nospec(arg, MAX_NR_CONSOLES);
+ console_lock();
+ ret = vc_allocate(arg);
+ console_unlock();
+@@ -715,9 +716,9 @@ int vt_ioctl(struct tty_struct *tty,
+ if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
+ ret = -ENXIO;
+ else {
+- vsa.console = array_index_nospec(vsa.console,
+- MAX_NR_CONSOLES + 1);
+ vsa.console--;
++ vsa.console = array_index_nospec(vsa.console,
++ MAX_NR_CONSOLES);
+ console_lock();
+ ret = vc_allocate(vsa.console);
+ if (ret == 0) {
+diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
+index 5a4d08de546fe..c42c152bbc335 100644
+--- a/drivers/usb/common/ulpi.c
++++ b/drivers/usb/common/ulpi.c
+@@ -132,6 +132,7 @@ static const struct attribute_group *ulpi_dev_attr_groups[] = {
+
+ static void ulpi_dev_release(struct device *dev)
+ {
++ of_node_put(dev->of_node);
+ kfree(to_ulpi_dev(dev));
+ }
+
+@@ -248,12 +249,16 @@ static int ulpi_register(struct device *dev, struct ulpi *ulpi)
+ return ret;
+
+ ret = ulpi_read_id(ulpi);
+- if (ret)
++ if (ret) {
++ of_node_put(ulpi->dev.of_node);
+ return ret;
++ }
+
+ ret = device_register(&ulpi->dev);
+- if (ret)
++ if (ret) {
++ put_device(&ulpi->dev);
+ return ret;
++ }
+
+ dev_dbg(&ulpi->dev, "registered ULPI PHY: vendor %04x, product %04x\n",
+ ulpi->id.vendor, ulpi->id.product);
+@@ -300,7 +305,6 @@ EXPORT_SYMBOL_GPL(ulpi_register_interface);
+ */
+ void ulpi_unregister_interface(struct ulpi *ulpi)
+ {
+- of_node_put(ulpi->dev.of_node);
+ device_unregister(&ulpi->dev);
+ }
+ EXPORT_SYMBOL_GPL(ulpi_unregister_interface);
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index b405c8ac8984b..1e46005929e44 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -4818,7 +4818,7 @@ int dwc2_hsotg_suspend(struct dwc2_hsotg *hsotg)
+ hsotg->gadget.speed = USB_SPEED_UNKNOWN;
+ spin_unlock_irqrestore(&hsotg->lock, flags);
+
+- for (ep = 0; ep < hsotg->num_of_eps; ep++) {
++ for (ep = 1; ep < hsotg->num_of_eps; ep++) {
+ if (hsotg->eps_in[ep])
+ dwc2_hsotg_ep_disable_lock(&hsotg->eps_in[ep]->ep);
+ if (hsotg->eps_out[ep])
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index d61b7aa5d8e5d..e7c753fbfbb04 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1020,6 +1020,19 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
+ if (usb_endpoint_xfer_bulk(dep->endpoint.desc) && dep->stream_capable)
+ trb->ctrl |= DWC3_TRB_CTRL_SID_SOFN(stream_id);
+
++ /*
++ * As per data book 4.2.3.2TRB Control Bit Rules section
++ *
++ * The controller autonomously checks the HWO field of a TRB to determine if the
++ * entire TRB is valid. Therefore, software must ensure that the rest of the TRB
++ * is valid before setting the HWO field to '1'. In most systems, this means that
++ * software must update the fourth DWORD of a TRB last.
++ *
++ * However there is a possibility of CPU re-ordering here which can cause
++ * controller to observe the HWO bit set prematurely.
++ * Add a write memory barrier to prevent CPU re-ordering.
++ */
++ wmb();
+ trb->ctrl |= DWC3_TRB_CTRL_HWO;
+
+ dwc3_ep_inc_enq(dep);
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 748f8fede5c23..42f267ae95984 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1930,6 +1930,9 @@ unknown:
+ if (w_index != 0x5 || (w_value >> 8))
+ break;
+ interface = w_value & 0xFF;
++ if (interface >= MAX_CONFIG_INTERFACES ||
++ !os_desc_cfg->interface[interface])
++ break;
+ buf[6] = w_index;
+ count = count_ext_prop(os_desc_cfg,
+ interface);
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 9271a7009a00f..49eb4e3c760f4 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1636,16 +1636,24 @@ static void ffs_data_put(struct ffs_data *ffs)
+
+ static void ffs_data_closed(struct ffs_data *ffs)
+ {
++ struct ffs_epfile *epfiles;
++ unsigned long flags;
++
+ ENTER();
+
+ if (atomic_dec_and_test(&ffs->opened)) {
+ if (ffs->no_disconnect) {
+ ffs->state = FFS_DEACTIVATED;
+- if (ffs->epfiles) {
+- ffs_epfiles_destroy(ffs->epfiles,
+- ffs->eps_count);
+- ffs->epfiles = NULL;
+- }
++ spin_lock_irqsave(&ffs->eps_lock, flags);
++ epfiles = ffs->epfiles;
++ ffs->epfiles = NULL;
++ spin_unlock_irqrestore(&ffs->eps_lock,
++ flags);
++
++ if (epfiles)
++ ffs_epfiles_destroy(epfiles,
++ ffs->eps_count);
++
+ if (ffs->setup_state == FFS_SETUP_PENDING)
+ __ffs_ep0_stall(ffs);
+ } else {
+@@ -1692,14 +1700,27 @@ static struct ffs_data *ffs_data_new(const char *dev_name)
+
+ static void ffs_data_clear(struct ffs_data *ffs)
+ {
++ struct ffs_epfile *epfiles;
++ unsigned long flags;
++
+ ENTER();
+
+ ffs_closed(ffs);
+
+ BUG_ON(ffs->gadget);
+
+- if (ffs->epfiles) {
+- ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count);
++ spin_lock_irqsave(&ffs->eps_lock, flags);
++ epfiles = ffs->epfiles;
++ ffs->epfiles = NULL;
++ spin_unlock_irqrestore(&ffs->eps_lock, flags);
++
++ /*
++ * potential race possible between ffs_func_eps_disable
++ * & ffs_epfile_release therefore maintaining a local
++ * copy of epfile will save us from use-after-free.
++ */
++ if (epfiles) {
++ ffs_epfiles_destroy(epfiles, ffs->eps_count);
+ ffs->epfiles = NULL;
+ }
+
+@@ -1847,12 +1868,15 @@ static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
+
+ static void ffs_func_eps_disable(struct ffs_function *func)
+ {
+- struct ffs_ep *ep = func->eps;
+- struct ffs_epfile *epfile = func->ffs->epfiles;
+- unsigned count = func->ffs->eps_count;
++ struct ffs_ep *ep;
++ struct ffs_epfile *epfile;
++ unsigned short count;
+ unsigned long flags;
+
+ spin_lock_irqsave(&func->ffs->eps_lock, flags);
++ count = func->ffs->eps_count;
++ epfile = func->ffs->epfiles;
++ ep = func->eps;
+ while (count--) {
+ /* pending requests get nuked */
+ if (likely(ep->ep))
+@@ -1870,14 +1894,18 @@ static void ffs_func_eps_disable(struct ffs_function *func)
+
+ static int ffs_func_eps_enable(struct ffs_function *func)
+ {
+- struct ffs_data *ffs = func->ffs;
+- struct ffs_ep *ep = func->eps;
+- struct ffs_epfile *epfile = ffs->epfiles;
+- unsigned count = ffs->eps_count;
++ struct ffs_data *ffs;
++ struct ffs_ep *ep;
++ struct ffs_epfile *epfile;
++ unsigned short count;
+ unsigned long flags;
+ int ret = 0;
+
+ spin_lock_irqsave(&func->ffs->eps_lock, flags);
++ ffs = func->ffs;
++ ep = func->eps;
++ epfile = ffs->epfiles;
++ count = ffs->eps_count;
+ while(count--) {
+ ep->ep->driver_data = ep;
+
+diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
+index 04c142c130759..ab827c1badc50 100644
+--- a/drivers/usb/gadget/function/rndis.c
++++ b/drivers/usb/gadget/function/rndis.c
+@@ -637,14 +637,17 @@ static int rndis_set_response(struct rndis_params *params,
+ rndis_set_cmplt_type *resp;
+ rndis_resp_t *r;
+
++ BufLength = le32_to_cpu(buf->InformationBufferLength);
++ BufOffset = le32_to_cpu(buf->InformationBufferOffset);
++ if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
++ (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
++ return -EINVAL;
++
+ r = rndis_add_response(params, sizeof(rndis_set_cmplt_type));
+ if (!r)
+ return -ENOMEM;
+ resp = (rndis_set_cmplt_type *)r->buf;
+
+- BufLength = le32_to_cpu(buf->InformationBufferLength);
+- BufOffset = le32_to_cpu(buf->InformationBufferOffset);
+-
+ #ifdef VERBOSE_DEBUG
+ pr_debug("%s: Length: %d\n", __func__, BufLength);
+ pr_debug("%s: Offset: %d\n", __func__, BufOffset);
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index c87cb25e70ec5..c56e4ce2d6516 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -84,6 +84,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1a86, 0x5523) },
+ { USB_DEVICE(0x1a86, 0x7522) },
+ { USB_DEVICE(0x1a86, 0x7523) },
++ { USB_DEVICE(0x2184, 0x0057) },
+ { USB_DEVICE(0x4348, 0x5523) },
+ { USB_DEVICE(0x9986, 0x7523) },
+ { },
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index cf1083639103b..452c508397b7b 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -52,6 +52,7 @@ static int cp210x_port_remove(struct usb_serial_port *);
+ static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
+
+ static const struct usb_device_id id_table[] = {
++ { USB_DEVICE(0x0404, 0x034C) }, /* NCR Retail IO Box */
+ { USB_DEVICE(0x045B, 0x0053) }, /* Renesas RX610 RX-Stick */
+ { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */
+ { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */
+@@ -69,6 +70,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */
+ { USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */
+ { USB_DEVICE(0x0FDE, 0xCA05) }, /* OWL Wireless Electricity Monitor CM-160 */
++ { USB_DEVICE(0x106F, 0x0003) }, /* CPI / Money Controls Bulk Coin Recycler */
+ { USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */
+ { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
+ { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 784d281eb8479..d966836e7df86 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -959,6 +959,7 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_159_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
+@@ -967,12 +968,14 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_235_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_320_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 755858ca20bac..d1a9564697a4b 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1506,6 +1506,9 @@
+ #define BRAINBOXES_VX_023_PID 0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
+ #define BRAINBOXES_VX_034_PID 0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
+ #define BRAINBOXES_US_101_PID 0x1011 /* US-101 1xRS232 */
++#define BRAINBOXES_US_159_PID 0x1021 /* US-159 1xRS232 */
++#define BRAINBOXES_US_235_PID 0x1017 /* US-235 1xRS232 */
++#define BRAINBOXES_US_320_PID 0x1019 /* US-320 1xRS422/485 */
+ #define BRAINBOXES_US_324_PID 0x1013 /* US-324 1xRS422/485 1Mbaud */
+ #define BRAINBOXES_US_606_1_PID 0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
+ #define BRAINBOXES_US_606_2_PID 0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 6166ef71c1842..151d6601f1c18 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1649,6 +1649,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(2) },
+ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0x00, 0x00) }, /* ZTE MF871A */
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1485, 0xff, 0xff, 0xff), /* ZTE MF286D */
++ .driver_info = RSVD(5) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
+diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
+index 8f34daf85f703..5d5227ce4d91e 100644
+--- a/fs/nfs/callback.h
++++ b/fs/nfs/callback.h
+@@ -168,7 +168,7 @@ struct cb_devicenotifyitem {
+ };
+
+ struct cb_devicenotifyargs {
+- int ndevs;
++ uint32_t ndevs;
+ struct cb_devicenotifyitem *devs;
+ };
+
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index bcc51f131a496..868d66ed8bcf6 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -364,7 +364,7 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp,
+ struct cb_process_state *cps)
+ {
+ struct cb_devicenotifyargs *args = argp;
+- int i;
++ uint32_t i;
+ __be32 res = 0;
+ struct nfs_client *clp = cps->clp;
+ struct nfs_server *server = NULL;
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index 57558a8d92e9b..76aa1b456c524 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -268,11 +268,9 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
+ void *argp)
+ {
+ struct cb_devicenotifyargs *args = argp;
++ uint32_t tmp, n, i;
+ __be32 *p;
+ __be32 status = 0;
+- u32 tmp;
+- int n, i;
+- args->ndevs = 0;
+
+ /* Num of device notifications */
+ p = read_buf(xdr, sizeof(uint32_t));
+@@ -281,7 +279,7 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
+ goto out;
+ }
+ n = ntohl(*p++);
+- if (n <= 0)
++ if (n == 0)
+ goto out;
+ if (n > ULONG_MAX / sizeof(*args->devs)) {
+ status = htonl(NFS4ERR_BADXDR);
+@@ -339,19 +337,21 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
+ dev->cbd_immediate = 0;
+ }
+
+- args->ndevs++;
+-
+ dprintk("%s: type %d layout 0x%x immediate %d\n",
+ __func__, dev->cbd_notify_type, dev->cbd_layout_type,
+ dev->cbd_immediate);
+ }
++ args->ndevs = n;
++ dprintk("%s: ndevs %d\n", __func__, args->ndevs);
++ return 0;
++err:
++ kfree(args->devs);
+ out:
++ args->devs = NULL;
++ args->ndevs = 0;
+ dprintk("%s: status %d ndevs %d\n",
+ __func__, ntohl(status), args->ndevs);
+ return status;
+-err:
+- kfree(args->devs);
+- goto out;
+ }
+
+ static __be32 decode_sessionid(struct xdr_stream *xdr,
+diff --git a/fs/nfs/client.c b/fs/nfs/client.c
+index 78b6f8bc9d76b..15049efc6de91 100644
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -180,6 +180,7 @@ struct nfs_client *nfs_alloc_client(const struct nfs_client_initdata *cl_init)
+ INIT_LIST_HEAD(&clp->cl_superblocks);
+ clp->cl_rpcclient = ERR_PTR(-EINVAL);
+
++ clp->cl_flags = cl_init->init_flags;
+ clp->cl_proto = cl_init->proto;
+ clp->cl_net = get_net(cl_init->net);
+
+@@ -427,7 +428,6 @@ struct nfs_client *nfs_get_client(const struct nfs_client_initdata *cl_init)
+ list_add_tail(&new->cl_share_link,
+ &nn->nfs_client_list);
+ spin_unlock(&nn->nfs_client_lock);
+- new->cl_flags = cl_init->init_flags;
+ return rpc_ops->init_client(new, cl_init);
+ }
+
+diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
+index 4dc9bd7ddf073..5ac7bf24c507b 100644
+--- a/fs/nfs/nfs4_fs.h
++++ b/fs/nfs/nfs4_fs.h
+@@ -276,7 +276,8 @@ struct vfsmount *nfs4_submount(struct nfs_server *, struct dentry *,
+ struct nfs_fh *, struct nfs_fattr *);
+ int nfs4_replace_transport(struct nfs_server *server,
+ const struct nfs4_fs_locations *locations);
+-
++size_t nfs_parse_server_name(char *string, size_t len, struct sockaddr *sa,
++ size_t salen, struct net *net);
+ /* nfs4proc.c */
+ extern int nfs4_handle_exception(struct nfs_server *, int, struct nfs4_exception *);
+ extern int nfs4_async_handle_error(struct rpc_task *task,
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 43659326b5191..c97ec2fa0bbcd 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -1273,8 +1273,11 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname,
+ }
+ nfs_put_client(clp);
+
+- if (server->nfs_client->cl_hostname == NULL)
++ if (server->nfs_client->cl_hostname == NULL) {
+ server->nfs_client->cl_hostname = kstrdup(hostname, GFP_KERNEL);
++ if (server->nfs_client->cl_hostname == NULL)
++ return -ENOMEM;
++ }
+ nfs_server_insert_lists(server);
+
+ return nfs_probe_destination(server);
+diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
+index 24f06dcc2b08e..936c412be28ef 100644
+--- a/fs/nfs/nfs4namespace.c
++++ b/fs/nfs/nfs4namespace.c
+@@ -121,8 +121,8 @@ static int nfs4_validate_fspath(struct dentry *dentry,
+ return 0;
+ }
+
+-static size_t nfs_parse_server_name(char *string, size_t len,
+- struct sockaddr *sa, size_t salen, struct net *net)
++size_t nfs_parse_server_name(char *string, size_t len, struct sockaddr *sa,
++ size_t salen, struct net *net)
+ {
+ ssize_t ret;
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index b3086e99420c7..9c98547fcefcc 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2066,6 +2066,9 @@ static int nfs4_try_migration(struct nfs_server *server, struct rpc_cred *cred)
+ }
+
+ result = -NFS4ERR_NXIO;
++ if (!locations->nlocations)
++ goto out;
++
+ if (!(locations->fattr.valid & NFS_ATTR_FATTR_V4_LOCATIONS)) {
+ dprintk("<-- %s: No fs_locations data, migration skipped\n",
+ __func__);
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index 0a5cae8f8aff9..56e48642c43eb 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -3747,8 +3747,6 @@ static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, st
+ if (unlikely(!p))
+ goto out_overflow;
+ n = be32_to_cpup(p);
+- if (n <= 0)
+- goto out_eio;
+ for (res->nlocations = 0; res->nlocations < n; res->nlocations++) {
+ u32 m;
+ struct nfs4_fs_location *loc;
+@@ -4294,10 +4292,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
+ } else
+ printk(KERN_WARNING "%s: label too long (%u)!\n",
+ __func__, len);
++ if (label && label->label)
++ dprintk("%s: label=%.*s, len=%d, PI=%d, LFS=%d\n",
++ __func__, label->len, (char *)label->label,
++ label->len, label->pi, label->lfs);
+ }
+- if (label && label->label)
+- dprintk("%s: label=%s, len=%d, PI=%d, LFS=%d\n", __func__,
+- (char *)label->label, label->len, label->pi, label->lfs);
+ return status;
+
+ out_overflow:
+diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
+index c9cf46e0c0405..335c95a03c01c 100644
+--- a/fs/nfsd/nfs3proc.c
++++ b/fs/nfsd/nfs3proc.c
+@@ -200,6 +200,11 @@ nfsd3_proc_write(struct svc_rqst *rqstp)
+ (unsigned long long) argp->offset,
+ argp->stable? " stable" : "");
+
++ resp->status = nfserr_fbig;
++ if (argp->offset > (u64)OFFSET_MAX ||
++ argp->offset + argp->len > (u64)OFFSET_MAX)
++ return rpc_success;
++
+ fh_copy(&resp->fh, &argp->fh);
+ resp->committed = argp->stable;
+ nvecs = svc_fill_write_vector(rqstp, rqstp->rq_arg.pages,
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index f35aa9f88b5ec..a696a9b907865 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -997,8 +997,9 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ unsigned long cnt;
+ int nvecs;
+
+- if (write->wr_offset >= OFFSET_MAX)
+- return nfserr_inval;
++ if (write->wr_offset > (u64)OFFSET_MAX ||
++ write->wr_offset + write->wr_buflen > (u64)OFFSET_MAX)
++ return nfserr_fbig;
+
+ cnt = write->wr_buflen;
+ trace_nfsd_write_start(rqstp, &cstate->current_fh,
+diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h
+index 80933e4334d84..5b2ef30a8ac06 100644
+--- a/fs/nfsd/trace.h
++++ b/fs/nfsd/trace.h
+@@ -53,14 +53,14 @@ TRACE_EVENT(nfsd_compound_status,
+ DECLARE_EVENT_CLASS(nfsd_io_class,
+ TP_PROTO(struct svc_rqst *rqstp,
+ struct svc_fh *fhp,
+- loff_t offset,
+- unsigned long len),
++ u64 offset,
++ u32 len),
+ TP_ARGS(rqstp, fhp, offset, len),
+ TP_STRUCT__entry(
+ __field(u32, xid)
+ __field(u32, fh_hash)
+- __field(loff_t, offset)
+- __field(unsigned long, len)
++ __field(u64, offset)
++ __field(u32, len)
+ ),
+ TP_fast_assign(
+ __entry->xid = be32_to_cpu(rqstp->rq_xid);
+@@ -68,7 +68,7 @@ DECLARE_EVENT_CLASS(nfsd_io_class,
+ __entry->offset = offset;
+ __entry->len = len;
+ ),
+- TP_printk("xid=0x%08x fh_hash=0x%08x offset=%lld len=%lu",
++ TP_printk("xid=0x%08x fh_hash=0x%08x offset=%llu len=%u",
+ __entry->xid, __entry->fh_hash,
+ __entry->offset, __entry->len)
+ )
+@@ -77,8 +77,8 @@ DECLARE_EVENT_CLASS(nfsd_io_class,
+ DEFINE_EVENT(nfsd_io_class, nfsd_##name, \
+ TP_PROTO(struct svc_rqst *rqstp, \
+ struct svc_fh *fhp, \
+- loff_t offset, \
+- unsigned long len), \
++ u64 offset, \
++ u32 len), \
+ TP_ARGS(rqstp, fhp, offset, len))
+
+ DEFINE_NFSD_IO_EVENT(read_start);
+diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h
+index 14efa0ded75dd..adab27ba1ecbf 100644
+--- a/include/net/dst_metadata.h
++++ b/include/net/dst_metadata.h
+@@ -123,8 +123,20 @@ static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb)
+
+ memcpy(&new_md->u.tun_info, &md_dst->u.tun_info,
+ sizeof(struct ip_tunnel_info) + md_size);
++#ifdef CONFIG_DST_CACHE
++ /* Unclone the dst cache if there is one */
++ if (new_md->u.tun_info.dst_cache.cache) {
++ int ret;
++
++ ret = dst_cache_init(&new_md->u.tun_info.dst_cache, GFP_ATOMIC);
++ if (ret) {
++ metadata_dst_free(new_md);
++ return ERR_PTR(ret);
++ }
++ }
++#endif
++
+ skb_dst_drop(skb);
+- dst_hold(&new_md->dst);
+ skb_dst_set(skb, &new_md->dst);
+ return new_md;
+ }
+diff --git a/init/Kconfig b/init/Kconfig
+index b56a125b5a76d..0fe4f60c974d7 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1474,6 +1474,16 @@ config BPF_JIT_ALWAYS_ON
+ Enables BPF JIT and removes BPF interpreter to avoid
+ speculative execution of BPF instructions by the interpreter
+
++config BPF_UNPRIV_DEFAULT_OFF
++ bool "Disable unprivileged BPF by default"
++ depends on BPF_SYSCALL
++ help
++ Disables unprivileged BPF by default by setting the corresponding
++ /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
++ still reenable it by setting it to 0 later on, or permanently
++ disable it by setting it to 1 (from which no other transition to
++ 0 is possible anymore).
++
+ config USERFAULTFD
+ bool "Enable userfaultfd() system call"
+ select ANON_INODES
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 353a8d672302b..e940c1f65938d 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -48,7 +48,8 @@ static DEFINE_SPINLOCK(prog_idr_lock);
+ static DEFINE_IDR(map_idr);
+ static DEFINE_SPINLOCK(map_idr_lock);
+
+-int sysctl_unprivileged_bpf_disabled __read_mostly;
++int sysctl_unprivileged_bpf_disabled __read_mostly =
++ IS_BUILTIN(CONFIG_BPF_UNPRIV_DEFAULT_OFF) ? 2 : 0;
+
+ static const struct bpf_map_ops * const bpf_map_types[] = {
+ #define BPF_PROG_TYPE(_id, _ops)
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index e6e11b5984386..2adde229d1af4 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -798,7 +798,7 @@ static DEFINE_PER_CPU(struct list_head, cgrp_cpuctx_list);
+ */
+ static void perf_cgroup_switch(struct task_struct *task, int mode)
+ {
+- struct perf_cpu_context *cpuctx;
++ struct perf_cpu_context *cpuctx, *tmp;
+ struct list_head *list;
+ unsigned long flags;
+
+@@ -809,7 +809,7 @@ static void perf_cgroup_switch(struct task_struct *task, int mode)
+ local_irq_save(flags);
+
+ list = this_cpu_ptr(&cgrp_cpuctx_list);
+- list_for_each_entry(cpuctx, list, cgrp_cpuctx_entry) {
++ list_for_each_entry_safe(cpuctx, tmp, list, cgrp_cpuctx_entry) {
+ WARN_ON_ONCE(cpuctx->ctx.nr_cgroups == 0);
+
+ perf_ctx_lock(cpuctx, cpuctx->task_ctx);
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index a9dd2325bdda6..69b4e34e191be 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -28,6 +28,9 @@
+ #include <linux/syscalls.h>
+ #include <linux/sysctl.h>
+
++/* Not exposed in headers: strictly internal use only. */
++#define SECCOMP_MODE_DEAD (SECCOMP_MODE_FILTER + 1)
++
+ #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
+ #include <asm/syscall.h>
+ #endif
+@@ -628,6 +631,7 @@ static void __secure_computing_strict(int this_syscall)
+ #ifdef SECCOMP_DEBUG
+ dump_stack();
+ #endif
++ current->seccomp.mode = SECCOMP_MODE_DEAD;
+ seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
+ do_exit(SIGKILL);
+ }
+@@ -742,6 +746,7 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
+ case SECCOMP_RET_KILL_THREAD:
+ case SECCOMP_RET_KILL_PROCESS:
+ default:
++ current->seccomp.mode = SECCOMP_MODE_DEAD;
+ seccomp_log(this_syscall, SIGSYS, action, true);
+ /* Dump core only if this is the last remaining thread. */
+ if (action == SECCOMP_RET_KILL_PROCESS ||
+@@ -794,6 +799,11 @@ int __secure_computing(const struct seccomp_data *sd)
+ return 0;
+ case SECCOMP_MODE_FILTER:
+ return __seccomp_filter(this_syscall, sd, false);
++ /* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
++ case SECCOMP_MODE_DEAD:
++ WARN_ON_ONCE(1);
++ do_exit(SIGKILL);
++ return -1;
+ default:
+ BUG();
+ }
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index a5d75bc38eea2..03af4a493affd 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -250,6 +250,28 @@ static int sysrq_sysctl_handler(struct ctl_table *table, int write,
+
+ #endif
+
++#ifdef CONFIG_BPF_SYSCALL
++static int bpf_unpriv_handler(struct ctl_table *table, int write,
++ void *buffer, size_t *lenp, loff_t *ppos)
++{
++ int ret, unpriv_enable = *(int *)table->data;
++ bool locked_state = unpriv_enable == 1;
++ struct ctl_table tmp = *table;
++
++ if (write && !capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
++ tmp.data = &unpriv_enable;
++ ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
++ if (write && !ret) {
++ if (locked_state && unpriv_enable != 1)
++ return -EPERM;
++ *(int *)table->data = unpriv_enable;
++ }
++ return ret;
++}
++#endif
++
+ static struct ctl_table kern_table[];
+ static struct ctl_table vm_table[];
+ static struct ctl_table fs_table[];
+@@ -1220,10 +1242,9 @@ static struct ctl_table kern_table[] = {
+ .data = &sysctl_unprivileged_bpf_disabled,
+ .maxlen = sizeof(sysctl_unprivileged_bpf_disabled),
+ .mode = 0644,
+- /* only handle a transition from default "0" to "1" */
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &one,
+- .extra2 = &one,
++ .proc_handler = bpf_unpriv_handler,
++ .extra1 = &zero,
++ .extra2 = &two,
+ },
+ #endif
+ #if defined(CONFIG_TREE_RCU) || defined(CONFIG_PREEMPT_RCU)
+diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
+index 7c6b1024dd4b5..9475e0443ff92 100644
+--- a/net/bridge/br_device.c
++++ b/net/bridge/br_device.c
+@@ -39,7 +39,6 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
+ struct pcpu_sw_netstats *brstats = this_cpu_ptr(br->stats);
+ const struct nf_br_ops *nf_ops;
+ const unsigned char *dest;
+- struct ethhdr *eth;
+ u16 vid = 0;
+
+ memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
+@@ -60,15 +59,14 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
+ BR_INPUT_SKB_CB(skb)->brdev = dev;
+
+ skb_reset_mac_header(skb);
+- eth = eth_hdr(skb);
+ skb_pull(skb, ETH_HLEN);
+
+ if (!br_allowed_ingress(br, br_vlan_group_rcu(br), skb, &vid))
+ goto out;
+
+ if (IS_ENABLED(CONFIG_INET) &&
+- (eth->h_proto == htons(ETH_P_ARP) ||
+- eth->h_proto == htons(ETH_P_RARP)) &&
++ (eth_hdr(skb)->h_proto == htons(ETH_P_ARP) ||
++ eth_hdr(skb)->h_proto == htons(ETH_P_RARP)) &&
+ br->neigh_suppress_enabled) {
+ br_do_proxy_suppress_arp(skb, br, vid, NULL);
+ } else if (IS_ENABLED(CONFIG_IPV6) &&
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index d235478d9ca3c..2085af224a416 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -265,7 +265,9 @@ static int __net_init ipmr_rules_init(struct net *net)
+ return 0;
+
+ err2:
++ rtnl_lock();
+ ipmr_free_table(mrt);
++ rtnl_unlock();
+ err1:
+ fib_rules_unregister(ops);
+ return err;
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 35e7092eceb37..e9eb917342b85 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -245,7 +245,9 @@ static int __net_init ip6mr_rules_init(struct net *net)
+ return 0;
+
+ err2:
++ rtnl_lock();
+ ip6mr_free_table(mrt);
++ rtnl_unlock();
+ err1:
+ fib_rules_unregister(ops);
+ return err;
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index af035431bec60..424e70907b967 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1131,7 +1131,7 @@ static struct Qdisc *qdisc_create(struct net_device *dev,
+
+ err = -ENOENT;
+ if (!ops) {
+- NL_SET_ERR_MSG(extack, "Specified qdisc not found");
++ NL_SET_ERR_MSG(extack, "Specified qdisc kind is unknown");
+ goto err_out;
+ }
+
+diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
+index 836e629e8f4ab..661bc2551a0a2 100644
+--- a/net/tipc/name_distr.c
++++ b/net/tipc/name_distr.c
+@@ -290,7 +290,7 @@ static bool tipc_update_nametbl(struct net *net, struct distr_item *i,
+ pr_warn_ratelimited("Failed to remove binding %u,%u from %x\n",
+ type, lower, node);
+ } else {
+- pr_warn("Unrecognized name table message received\n");
++ pr_warn_ratelimited("Unknown name table message received\n");
+ }
+ return false;
+ }
+diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
+index 604cdac63d845..38bd565b9da9b 100644
+--- a/security/integrity/ima/ima_fs.c
++++ b/security/integrity/ima/ima_fs.c
+@@ -497,12 +497,12 @@ int __init ima_fs_init(void)
+
+ return 0;
+ out:
++ securityfs_remove(ima_policy);
+ securityfs_remove(violations);
+ securityfs_remove(runtime_measurements_count);
+ securityfs_remove(ascii_runtime_measurements);
+ securityfs_remove(binary_runtime_measurements);
+ securityfs_remove(ima_symlink);
+ securityfs_remove(ima_dir);
+- securityfs_remove(ima_policy);
+ return -1;
+ }
+diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c
+index 30db39b238043..4dfdccce497b6 100644
+--- a/security/integrity/ima/ima_template.c
++++ b/security/integrity/ima/ima_template.c
+@@ -31,6 +31,7 @@ static struct ima_template_desc builtin_templates[] = {
+
+ static LIST_HEAD(defined_templates);
+ static DEFINE_SPINLOCK(template_list);
++static int template_setup_done;
+
+ static struct ima_template_field supported_fields[] = {
+ {.field_id = "d", .field_init = ima_eventdigest_init,
+@@ -57,10 +58,11 @@ static int __init ima_template_setup(char *str)
+ struct ima_template_desc *template_desc;
+ int template_len = strlen(str);
+
+- if (ima_template)
++ if (template_setup_done)
+ return 1;
+
+- ima_init_template_list();
++ if (!ima_template)
++ ima_init_template_list();
+
+ /*
+ * Verify that a template with the supplied name exists.
+@@ -84,6 +86,7 @@ static int __init ima_template_setup(char *str)
+ }
+
+ ima_template = template_desc;
++ template_setup_done = 1;
+ return 1;
+ }
+ __setup("ima_template=", ima_template_setup);
+@@ -92,7 +95,7 @@ static int __init ima_template_fmt_setup(char *str)
+ {
+ int num_templates = ARRAY_SIZE(builtin_templates);
+
+- if (ima_template)
++ if (template_setup_done)
+ return 1;
+
+ if (template_desc_init_fields(str, NULL, NULL) < 0) {
+@@ -103,6 +106,7 @@ static int __init ima_template_fmt_setup(char *str)
+
+ builtin_templates[num_templates - 1].fmt = str;
+ ima_template = builtin_templates + num_templates - 1;
++ template_setup_done = 1;
+
+ return 1;
+ }
+diff --git a/security/integrity/integrity_audit.c b/security/integrity/integrity_audit.c
+index 82c98f7d217e8..d03fbdfc972e8 100644
+--- a/security/integrity/integrity_audit.c
++++ b/security/integrity/integrity_audit.c
+@@ -39,6 +39,8 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
+ return;
+
+ ab = audit_log_start(audit_context(), GFP_KERNEL, audit_msgno);
++ if (!ab)
++ return;
+ audit_log_format(ab, "pid=%d uid=%u auid=%u ses=%u",
+ task_pid_nr(current),
+ from_kuid(&init_user_ns, current_cred()->uid),
+diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
+index 633fa5425fd9d..4aeb3e1399010 100644
+--- a/tools/perf/util/probe-event.c
++++ b/tools/perf/util/probe-event.c
+@@ -2919,6 +2919,9 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
+ for (j = 0; j < num_matched_functions; j++) {
+ sym = syms[j];
+
++ if (sym->type != STT_FUNC)
++ continue;
++
+ tev = (*tevs) + ret;
+ tp = &tev->point;
+ if (ret == num_matched_functions) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-02-23 12:39 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-02-23 12:39 UTC (permalink / raw
To: gentoo-commits
commit: cf18885d021c12b4fccd6e06066a5b3d7e3adeef
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 23 12:38:41 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Feb 23 12:38:41 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=cf18885d
Linux patch 4.19.231
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1230_linux-4.19.231.patch | 2055 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2059 insertions(+)
diff --git a/0000_README b/0000_README
index 30a2e032..67a0a028 100644
--- a/0000_README
+++ b/0000_README
@@ -959,6 +959,10 @@ Patch: 1229_linux-4.19.230.patch
From: https://www.kernel.org
Desc: Linux 4.19.230
+Patch: 1230_linux-4.19.231.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.231
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1230_linux-4.19.231.patch b/1230_linux-4.19.231.patch
new file mode 100644
index 00000000..4f497003
--- /dev/null
+++ b/1230_linux-4.19.231.patch
@@ -0,0 +1,2055 @@
+diff --git a/Documentation/ABI/stable/sysfs-bus-vmbus b/Documentation/ABI/stable/sysfs-bus-vmbus
+index 3fed8fdb873d7..c4ffdfc324b41 100644
+--- a/Documentation/ABI/stable/sysfs-bus-vmbus
++++ b/Documentation/ABI/stable/sysfs-bus-vmbus
+@@ -81,7 +81,9 @@ What: /sys/bus/vmbus/devices/<UUID>/channels/<N>/latency
+ Date: September. 2017
+ KernelVersion: 4.14
+ Contact: Stephen Hemminger <sthemmin@microsoft.com>
+-Description: Channel signaling latency
++Description: Channel signaling latency. This file is available only for
++ performance critical channels (storage, network, etc.) that use
++ the monitor page mechanism.
+ Users: Debugging tools
+
+ What: /sys/bus/vmbus/devices/<UUID>/channels/<N>/out_mask
+@@ -95,7 +97,9 @@ What: /sys/bus/vmbus/devices/<UUID>/channels/<N>/pending
+ Date: September. 2017
+ KernelVersion: 4.14
+ Contact: Stephen Hemminger <sthemmin@microsoft.com>
+-Description: Channel interrupt pending state
++Description: Channel interrupt pending state. This file is available only for
++ performance critical channels (storage, network, etc.) that use
++ the monitor page mechanism.
+ Users: Debugging tools
+
+ What: /sys/bus/vmbus/devices/<UUID>/channels/<N>/read_avail
+@@ -137,7 +141,9 @@ What: /sys/bus/vmbus/devices/<UUID>/channels/<N>/monitor_id
+ Date: January. 2018
+ KernelVersion: 4.16
+ Contact: Stephen Hemminger <sthemmin@microsoft.com>
+-Description: Monitor bit associated with channel
++Description: Monitor bit associated with channel. This file is available only
++ for performance critical channels (storage, network, etc.) that
++ use the monitor page mechanism.
+ Users: Debugging tools and userspace drivers
+
+ What: /sys/bus/vmbus/devices/<UUID>/channels/<N>/ring
+diff --git a/Makefile b/Makefile
+index 1a19d5d8840ff..165660cd857e1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 230
++SUBLEVEL = 231
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index a8269f0a87ced..47c55351df033 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -754,8 +754,10 @@ static int __init _init_clkctrl_providers(void)
+
+ for_each_matching_node(np, ti_clkctrl_match_table) {
+ ret = _setup_clkctrl_provider(np);
+- if (ret)
++ if (ret) {
++ of_node_put(np);
+ break;
++ }
+ }
+
+ return ret;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+index b8dc4dbb391b6..4252119bfd901 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+@@ -41,6 +41,12 @@
+ no-map;
+ };
+
++ /* 32 MiB reserved for ARM Trusted Firmware (BL32) */
++ secmon_reserved_bl32: secmon@5300000 {
++ reg = <0x0 0x05300000 0x0 0x2000000>;
++ no-map;
++ };
++
+ linux,cma {
+ compatible = "shared-dma-pool";
+ reusable;
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index d81568f783e5c..e87ae0dabce12 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -2681,12 +2681,14 @@ void emulate_update_regs(struct pt_regs *regs, struct instruction_op *op)
+ case BARRIER_EIEIO:
+ eieio();
+ break;
++#ifdef CONFIG_PPC64
+ case BARRIER_LWSYNC:
+ asm volatile("lwsync" : : : "memory");
+ break;
+ case BARRIER_PTESYNC:
+ asm volatile("ptesync" : : : "memory");
+ break;
++#endif
+ }
+ break;
+
+diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
+index acc8d217f6565..ad3d39c00d7fc 100644
+--- a/arch/x86/kvm/pmu.c
++++ b/arch/x86/kvm/pmu.c
+@@ -171,7 +171,7 @@ void reprogram_gp_counter(struct kvm_pmc *pmc, u64 eventsel)
+ }
+
+ if (type == PERF_TYPE_RAW)
+- config = eventsel & X86_RAW_EVENT_MASK;
++ config = eventsel & AMD64_RAW_EVENT_MASK;
+
+ pmc_reprogram_counter(pmc, type, config,
+ !(eventsel & ARCH_PERFMON_EVENTSEL_USR),
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index c2529dfda3e53..11686e7684016 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -5417,6 +5417,8 @@ static void bfq_exit_queue(struct elevator_queue *e)
+ spin_unlock_irq(&bfqd->lock);
+ #endif
+
++ wbt_enable_default(bfqd->queue);
++
+ kfree(bfqd);
+ }
+
+diff --git a/block/elevator.c b/block/elevator.c
+index 5b51bc5fad9fe..72ce7a4a2632e 100644
+--- a/block/elevator.c
++++ b/block/elevator.c
+@@ -877,8 +877,6 @@ void elv_unregister_queue(struct request_queue *q)
+ kobject_del(&e->kobj);
+
+ e->registered = 0;
+- /* Re-enable throttling in case elevator disabled it */
+- wbt_enable_default(q);
+ }
+ }
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 46eacba2613b8..33d3728f36222 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4613,6 +4613,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+
+ /* devices that don't properly handle TRIM commands */
+ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, },
++ { "M88V29*", NULL, ATA_HORKAGE_NOTRIM, },
+
+ /*
+ * As defined, the DRAT (Deterministic Read After Trim) and RZAT
+diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
+index 80ff95f75199f..29c51762336d7 100644
+--- a/drivers/dma/sh/rcar-dmac.c
++++ b/drivers/dma/sh/rcar-dmac.c
+@@ -1817,7 +1817,9 @@ static int rcar_dmac_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, dmac);
+ dmac->dev->dma_parms = &dmac->parms;
+ dma_set_max_seg_size(dmac->dev, RCAR_DMATCR_MASK);
+- dma_set_mask_and_coherent(dmac->dev, DMA_BIT_MASK(40));
++ ret = dma_set_mask_and_coherent(dmac->dev, DMA_BIT_MASK(40));
++ if (ret)
++ return ret;
+
+ ret = rcar_dmac_parse_of(&pdev->dev, dmac);
+ if (ret < 0)
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index fd440b35d76ed..61d72bd967543 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -265,7 +265,7 @@ void *edac_align_ptr(void **p, unsigned size, int n_elems)
+ else
+ return (char *)ptr;
+
+- r = (unsigned long)p % align;
++ r = (unsigned long)ptr % align;
+
+ if (r == 0)
+ return (char *)ptr;
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index e67ed383e11b1..79aef5c063fae 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -193,7 +193,8 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
+ * so don't register a backlight device
+ */
+ if ((rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE) &&
+- (rdev->pdev->device == 0x6741))
++ (rdev->pdev->device == 0x6741) &&
++ !dmi_match(DMI_PRODUCT_NAME, "iMac12,1"))
+ return;
+
+ if (!radeon_encoder->enc_priv)
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index cdd4392c589d3..a3f6933f94e30 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -350,6 +350,7 @@ static struct vmbus_channel *alloc_channel(void)
+ static void free_channel(struct vmbus_channel *channel)
+ {
+ tasklet_kill(&channel->callback_event);
++ vmbus_remove_channel_attr_group(channel);
+
+ kobject_put(&channel->kobj);
+ }
+diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
+index 7e7c8debbd285..c4ad518890243 100644
+--- a/drivers/hv/hyperv_vmbus.h
++++ b/drivers/hv/hyperv_vmbus.h
+@@ -392,6 +392,8 @@ void vmbus_device_unregister(struct hv_device *device_obj);
+ int vmbus_add_channel_kobj(struct hv_device *device_obj,
+ struct vmbus_channel *channel);
+
++void vmbus_remove_channel_attr_group(struct vmbus_channel *channel);
++
+ struct vmbus_channel *relid2channel(u32 relid);
+
+ void vmbus_free_channels(void);
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 0699c60188895..51fe219c91fc3 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -609,7 +609,36 @@ static struct attribute *vmbus_dev_attrs[] = {
+ &dev_attr_device.attr,
+ NULL,
+ };
+-ATTRIBUTE_GROUPS(vmbus_dev);
++
++/*
++ * Device-level attribute_group callback function. Returns the permission for
++ * each attribute, and returns 0 if an attribute is not visible.
++ */
++static umode_t vmbus_dev_attr_is_visible(struct kobject *kobj,
++ struct attribute *attr, int idx)
++{
++ struct device *dev = kobj_to_dev(kobj);
++ const struct hv_device *hv_dev = device_to_hv_device(dev);
++
++ /* Hide the monitor attributes if the monitor mechanism is not used. */
++ if (!hv_dev->channel->offermsg.monitor_allocated &&
++ (attr == &dev_attr_monitor_id.attr ||
++ attr == &dev_attr_server_monitor_pending.attr ||
++ attr == &dev_attr_client_monitor_pending.attr ||
++ attr == &dev_attr_server_monitor_latency.attr ||
++ attr == &dev_attr_client_monitor_latency.attr ||
++ attr == &dev_attr_server_monitor_conn_id.attr ||
++ attr == &dev_attr_client_monitor_conn_id.attr))
++ return 0;
++
++ return attr->mode;
++}
++
++static const struct attribute_group vmbus_dev_group = {
++ .attrs = vmbus_dev_attrs,
++ .is_visible = vmbus_dev_attr_is_visible
++};
++__ATTRIBUTE_GROUPS(vmbus_dev);
+
+ /*
+ * vmbus_uevent - add uevent for our device
+@@ -1484,10 +1513,34 @@ static struct attribute *vmbus_chan_attrs[] = {
+ NULL
+ };
+
++/*
++ * Channel-level attribute_group callback function. Returns the permission for
++ * each attribute, and returns 0 if an attribute is not visible.
++ */
++static umode_t vmbus_chan_attr_is_visible(struct kobject *kobj,
++ struct attribute *attr, int idx)
++{
++ const struct vmbus_channel *channel =
++ container_of(kobj, struct vmbus_channel, kobj);
++
++ /* Hide the monitor attributes if the monitor mechanism is not used. */
++ if (!channel->offermsg.monitor_allocated &&
++ (attr == &chan_attr_pending.attr ||
++ attr == &chan_attr_latency.attr ||
++ attr == &chan_attr_monitor_id.attr))
++ return 0;
++
++ return attr->mode;
++}
++
++static struct attribute_group vmbus_chan_group = {
++ .attrs = vmbus_chan_attrs,
++ .is_visible = vmbus_chan_attr_is_visible
++};
++
+ static struct kobj_type vmbus_chan_ktype = {
+ .sysfs_ops = &vmbus_chan_sysfs_ops,
+ .release = vmbus_chan_release,
+- .default_attrs = vmbus_chan_attrs,
+ };
+
+ /*
+@@ -1495,6 +1548,7 @@ static struct kobj_type vmbus_chan_ktype = {
+ */
+ int vmbus_add_channel_kobj(struct hv_device *dev, struct vmbus_channel *channel)
+ {
++ const struct device *device = &dev->device;
+ struct kobject *kobj = &channel->kobj;
+ u32 relid = channel->offermsg.child_relid;
+ int ret;
+@@ -1502,14 +1556,36 @@ int vmbus_add_channel_kobj(struct hv_device *dev, struct vmbus_channel *channel)
+ kobj->kset = dev->channels_kset;
+ ret = kobject_init_and_add(kobj, &vmbus_chan_ktype, NULL,
+ "%u", relid);
+- if (ret)
++ if (ret) {
++ kobject_put(kobj);
++ return ret;
++ }
++
++ ret = sysfs_create_group(kobj, &vmbus_chan_group);
++
++ if (ret) {
++ /*
++ * The calling functions' error handling paths will cleanup the
++ * empty channel directory.
++ */
++ kobject_put(kobj);
++ dev_err(device, "Unable to set up channel sysfs files\n");
+ return ret;
++ }
+
+ kobject_uevent(kobj, KOBJ_ADD);
+
+ return 0;
+ }
+
++/*
++ * vmbus_remove_channel_attr_group - remove the channel's attribute group
++ */
++void vmbus_remove_channel_attr_group(struct vmbus_channel *channel)
++{
++ sysfs_remove_group(&channel->kobj, &vmbus_chan_group);
++}
++
+ /*
+ * vmbus_device_create - Creates and registers a new child device
+ * on the vmbus.
+diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
+index 2086a96307bf9..1e8890601ca3b 100644
+--- a/drivers/i2c/busses/i2c-brcmstb.c
++++ b/drivers/i2c/busses/i2c-brcmstb.c
+@@ -645,7 +645,7 @@ static int brcmstb_i2c_probe(struct platform_device *pdev)
+
+ /* set the data in/out register size for compatible SoCs */
+ if (of_device_is_compatible(dev->device->of_node,
+- "brcmstb,brcmper-i2c"))
++ "brcm,brcmper-i2c"))
+ dev->data_regsz = sizeof(u8);
+ else
+ dev->data_regsz = sizeof(u32);
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index 532e9d68c7042..767cdd3f773bb 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -258,3 +258,4 @@ out_iounmap:
+
+ IRQCHIP_DECLARE(sifive_plic, "sifive,plic-1.0.0", plic_init);
+ IRQCHIP_DECLARE(riscv_plic0, "riscv,plic0", plic_init); /* for legacy systems */
++IRQCHIP_DECLARE(thead_c900_plic, "thead,c900-plic", plic_init); /* for firmware driver */
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index d1cc0fdbc51c8..630f3bcba56dd 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1678,31 +1678,31 @@ static void mmc_blk_read_single(struct mmc_queue *mq, struct request *req)
+ struct mmc_card *card = mq->card;
+ struct mmc_host *host = card->host;
+ blk_status_t error = BLK_STS_OK;
+- int retries = 0;
+
+ do {
+ u32 status;
+ int err;
++ int retries = 0;
+
+- mmc_blk_rw_rq_prep(mqrq, card, 1, mq);
++ while (retries++ <= MMC_READ_SINGLE_RETRIES) {
++ mmc_blk_rw_rq_prep(mqrq, card, 1, mq);
+
+- mmc_wait_for_req(host, mrq);
++ mmc_wait_for_req(host, mrq);
+
+- err = mmc_send_status(card, &status);
+- if (err)
+- goto error_exit;
+-
+- if (!mmc_host_is_spi(host) &&
+- !mmc_blk_in_tran_state(status)) {
+- err = mmc_blk_fix_state(card, req);
++ err = mmc_send_status(card, &status);
+ if (err)
+ goto error_exit;
+- }
+
+- if (mrq->cmd->error && retries++ < MMC_READ_SINGLE_RETRIES)
+- continue;
++ if (!mmc_host_is_spi(host) &&
++ !mmc_blk_in_tran_state(status)) {
++ err = mmc_blk_fix_state(card, req);
++ if (err)
++ goto error_exit;
++ }
+
+- retries = 0;
++ if (!mrq->cmd->error)
++ break;
++ }
+
+ if (mrq->cmd->error ||
+ mrq->data->error ||
+diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+index 774ffa9e23f38..27bafb8fc35af 100644
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -589,6 +589,54 @@ static inline void brcmnand_write_fc(struct brcmnand_controller *ctrl,
+ __raw_writel(val, ctrl->nand_fc + word * 4);
+ }
+
++static void brcmnand_clear_ecc_addr(struct brcmnand_controller *ctrl)
++{
++
++ /* Clear error addresses */
++ brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_ADDR, 0);
++ brcmnand_write_reg(ctrl, BRCMNAND_CORR_ADDR, 0);
++ brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_EXT_ADDR, 0);
++ brcmnand_write_reg(ctrl, BRCMNAND_CORR_EXT_ADDR, 0);
++}
++
++static u64 brcmnand_get_uncorrecc_addr(struct brcmnand_controller *ctrl)
++{
++ u64 err_addr;
++
++ err_addr = brcmnand_read_reg(ctrl, BRCMNAND_UNCORR_ADDR);
++ err_addr |= ((u64)(brcmnand_read_reg(ctrl,
++ BRCMNAND_UNCORR_EXT_ADDR)
++ & 0xffff) << 32);
++
++ return err_addr;
++}
++
++static u64 brcmnand_get_correcc_addr(struct brcmnand_controller *ctrl)
++{
++ u64 err_addr;
++
++ err_addr = brcmnand_read_reg(ctrl, BRCMNAND_CORR_ADDR);
++ err_addr |= ((u64)(brcmnand_read_reg(ctrl,
++ BRCMNAND_CORR_EXT_ADDR)
++ & 0xffff) << 32);
++
++ return err_addr;
++}
++
++static void brcmnand_set_cmd_addr(struct mtd_info *mtd, u64 addr)
++{
++ struct nand_chip *chip = mtd_to_nand(mtd);
++ struct brcmnand_host *host = nand_get_controller_data(chip);
++ struct brcmnand_controller *ctrl = host->ctrl;
++
++ brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
++ (host->cs << 16) | ((addr >> 32) & 0xffff));
++ (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
++ brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
++ lower_32_bits(addr));
++ (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
++}
++
+ static inline u16 brcmnand_cs_offset(struct brcmnand_controller *ctrl, int cs,
+ enum brcmnand_cs_reg reg)
+ {
+@@ -1217,9 +1265,12 @@ static void brcmnand_send_cmd(struct brcmnand_host *host, int cmd)
+ {
+ struct brcmnand_controller *ctrl = host->ctrl;
+ int ret;
++ u64 cmd_addr;
++
++ cmd_addr = brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
++
++ dev_dbg(ctrl->dev, "send native cmd %d addr 0x%llx\n", cmd, cmd_addr);
+
+- dev_dbg(ctrl->dev, "send native cmd %d addr_lo 0x%x\n", cmd,
+- brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS));
+ BUG_ON(ctrl->cmd_pending != 0);
+ ctrl->cmd_pending = cmd;
+
+@@ -1380,12 +1431,7 @@ static void brcmnand_cmdfunc(struct mtd_info *mtd, unsigned command,
+ if (!native_cmd)
+ return;
+
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
+- (host->cs << 16) | ((addr >> 32) & 0xffff));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS, lower_32_bits(addr));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
+-
++ brcmnand_set_cmd_addr(mtd, addr);
+ brcmnand_send_cmd(host, native_cmd);
+ brcmnand_waitfunc(mtd, chip);
+
+@@ -1605,20 +1651,10 @@ static int brcmnand_read_by_pio(struct mtd_info *mtd, struct nand_chip *chip,
+ struct brcmnand_controller *ctrl = host->ctrl;
+ int i, j, ret = 0;
+
+- /* Clear error addresses */
+- brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_ADDR, 0);
+- brcmnand_write_reg(ctrl, BRCMNAND_CORR_ADDR, 0);
+- brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_EXT_ADDR, 0);
+- brcmnand_write_reg(ctrl, BRCMNAND_CORR_EXT_ADDR, 0);
+-
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
+- (host->cs << 16) | ((addr >> 32) & 0xffff));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
++ brcmnand_clear_ecc_addr(ctrl);
+
+ for (i = 0; i < trans; i++, addr += FC_BYTES) {
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
+- lower_32_bits(addr));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
++ brcmnand_set_cmd_addr(mtd, addr);
+ /* SPARE_AREA_READ does not use ECC, so just use PAGE_READ */
+ brcmnand_send_cmd(host, CMD_PAGE_READ);
+ brcmnand_waitfunc(mtd, chip);
+@@ -1637,22 +1673,16 @@ static int brcmnand_read_by_pio(struct mtd_info *mtd, struct nand_chip *chip,
+ mtd->oobsize / trans,
+ host->hwcfg.sector_size_1k);
+
+- if (!ret) {
+- *err_addr = brcmnand_read_reg(ctrl,
+- BRCMNAND_UNCORR_ADDR) |
+- ((u64)(brcmnand_read_reg(ctrl,
+- BRCMNAND_UNCORR_EXT_ADDR)
+- & 0xffff) << 32);
++ if (ret != -EBADMSG) {
++ *err_addr = brcmnand_get_uncorrecc_addr(ctrl);
++
+ if (*err_addr)
+ ret = -EBADMSG;
+ }
+
+ if (!ret) {
+- *err_addr = brcmnand_read_reg(ctrl,
+- BRCMNAND_CORR_ADDR) |
+- ((u64)(brcmnand_read_reg(ctrl,
+- BRCMNAND_CORR_EXT_ADDR)
+- & 0xffff) << 32);
++ *err_addr = brcmnand_get_correcc_addr(ctrl);
++
+ if (*err_addr)
+ ret = -EUCLEAN;
+ }
+@@ -1722,7 +1752,7 @@ static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip,
+ dev_dbg(ctrl->dev, "read %llx -> %p\n", (unsigned long long)addr, buf);
+
+ try_dmaread:
+- brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_COUNT, 0);
++ brcmnand_clear_ecc_addr(ctrl);
+
+ if (has_flash_dma(ctrl) && !oob && flash_dma_buf_ok(buf)) {
+ err = brcmnand_dma_trans(host, addr, buf, trans * FC_BYTES,
+@@ -1866,15 +1896,9 @@ static int brcmnand_write(struct mtd_info *mtd, struct nand_chip *chip,
+ goto out;
+ }
+
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
+- (host->cs << 16) | ((addr >> 32) & 0xffff));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
+-
+ for (i = 0; i < trans; i++, addr += FC_BYTES) {
+ /* full address MUST be set before populating FC */
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
+- lower_32_bits(addr));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
++ brcmnand_set_cmd_addr(mtd, addr);
+
+ if (buf) {
+ brcmnand_soc_data_bus_prepare(ctrl->soc, false);
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index 148c7a16f3188..c64b408f080a9 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -10,7 +10,6 @@
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+-
+ #include <linux/clk.h>
+ #include <linux/slab.h>
+ #include <linux/bitops.h>
+@@ -2959,10 +2958,6 @@ static int qcom_nandc_probe(struct platform_device *pdev)
+ if (!nandc->base_dma)
+ return -ENXIO;
+
+- ret = qcom_nandc_alloc(nandc);
+- if (ret)
+- goto err_nandc_alloc;
+-
+ ret = clk_prepare_enable(nandc->core_clk);
+ if (ret)
+ goto err_core_clk;
+@@ -2971,6 +2966,10 @@ static int qcom_nandc_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_aon_clk;
+
++ ret = qcom_nandc_alloc(nandc);
++ if (ret)
++ goto err_nandc_alloc;
++
+ ret = qcom_nandc_setup(nandc);
+ if (ret)
+ goto err_setup;
+@@ -2982,15 +2981,14 @@ static int qcom_nandc_probe(struct platform_device *pdev)
+ return 0;
+
+ err_setup:
++ qcom_nandc_unalloc(nandc);
++err_nandc_alloc:
+ clk_disable_unprepare(nandc->aon_clk);
+ err_aon_clk:
+ clk_disable_unprepare(nandc->core_clk);
+ err_core_clk:
+- qcom_nandc_unalloc(nandc);
+-err_nandc_alloc:
+ dma_unmap_resource(dev, res->start, resource_size(res),
+ DMA_BIDIRECTIONAL, 0);
+-
+ return ret;
+ }
+
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index 035923876c617..e3f814e83d9c8 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -249,7 +249,7 @@ static inline int __check_agg_selection_timer(struct port *port)
+ if (bond == NULL)
+ return 0;
+
+- return BOND_AD_INFO(bond).agg_select_timer ? 1 : 0;
++ return atomic_read(&BOND_AD_INFO(bond).agg_select_timer) ? 1 : 0;
+ }
+
+ /**
+@@ -1965,7 +1965,7 @@ static void ad_marker_response_received(struct bond_marker *marker,
+ */
+ void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout)
+ {
+- BOND_AD_INFO(bond).agg_select_timer = timeout;
++ atomic_set(&BOND_AD_INFO(bond).agg_select_timer, timeout);
+ }
+
+ /**
+@@ -2249,6 +2249,28 @@ void bond_3ad_update_ad_actor_settings(struct bonding *bond)
+ spin_unlock_bh(&bond->mode_lock);
+ }
+
++/**
++ * bond_agg_timer_advance - advance agg_select_timer
++ * @bond: bonding structure
++ *
++ * Return true when agg_select_timer reaches 0.
++ */
++static bool bond_agg_timer_advance(struct bonding *bond)
++{
++ int val, nval;
++
++ while (1) {
++ val = atomic_read(&BOND_AD_INFO(bond).agg_select_timer);
++ if (!val)
++ return false;
++ nval = val - 1;
++ if (atomic_cmpxchg(&BOND_AD_INFO(bond).agg_select_timer,
++ val, nval) == val)
++ break;
++ }
++ return nval == 0;
++}
++
+ /**
+ * bond_3ad_state_machine_handler - handle state machines timeout
+ * @bond: bonding struct to work on
+@@ -2284,9 +2306,7 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
+ if (!bond_has_slaves(bond))
+ goto re_arm;
+
+- /* check if agg_select_timer timer after initialize is timed out */
+- if (BOND_AD_INFO(bond).agg_select_timer &&
+- !(--BOND_AD_INFO(bond).agg_select_timer)) {
++ if (bond_agg_timer_advance(bond)) {
+ slave = bond_first_slave_rcu(bond);
+ port = slave ? &(SLAVE_AD_INFO(slave)->port) : NULL;
+
+diff --git a/drivers/net/dsa/lan9303-core.c b/drivers/net/dsa/lan9303-core.c
+index b89c474e6b6bf..70ce37cd94af5 100644
+--- a/drivers/net/dsa/lan9303-core.c
++++ b/drivers/net/dsa/lan9303-core.c
+@@ -1307,7 +1307,7 @@ static int lan9303_probe_reset_gpio(struct lan9303 *chip,
+ struct device_node *np)
+ {
+ chip->reset_gpio = devm_gpiod_get_optional(chip->dev, "reset",
+- GPIOD_OUT_LOW);
++ GPIOD_OUT_HIGH);
+ if (IS_ERR(chip->reset_gpio))
+ return PTR_ERR(chip->reset_gpio);
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index d110aa616a957..f162ac7d74e59 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -4073,7 +4073,7 @@ static int macb_probe(struct platform_device *pdev)
+
+ #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+ if (GEM_BFEXT(DAW64, gem_readl(bp, DCFG6))) {
+- dma_set_mask(&pdev->dev, DMA_BIT_MASK(44));
++ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44));
+ bp->hw_dma_cap |= HW_DMA_CAP_64B;
+ }
+ #endif
+diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
+index 3d9e915798668..1bc09b6c308f8 100644
+--- a/drivers/net/ieee802154/at86rf230.c
++++ b/drivers/net/ieee802154/at86rf230.c
+@@ -108,6 +108,7 @@ struct at86rf230_local {
+ unsigned long cal_timeout;
+ bool is_tx;
+ bool is_tx_from_off;
++ bool was_tx;
+ u8 tx_retry;
+ struct sk_buff *tx_skb;
+ struct at86rf230_state_change tx;
+@@ -351,7 +352,11 @@ at86rf230_async_error_recover_complete(void *context)
+ if (ctx->free)
+ kfree(ctx);
+
+- ieee802154_wake_queue(lp->hw);
++ if (lp->was_tx) {
++ lp->was_tx = 0;
++ dev_kfree_skb_any(lp->tx_skb);
++ ieee802154_wake_queue(lp->hw);
++ }
+ }
+
+ static void
+@@ -360,7 +365,11 @@ at86rf230_async_error_recover(void *context)
+ struct at86rf230_state_change *ctx = context;
+ struct at86rf230_local *lp = ctx->lp;
+
+- lp->is_tx = 0;
++ if (lp->is_tx) {
++ lp->was_tx = 1;
++ lp->is_tx = 0;
++ }
++
+ at86rf230_async_state_change(lp, ctx, STATE_RX_AACK_ON,
+ at86rf230_async_error_recover_complete);
+ }
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index 3169c174006ab..7c5db4f73cce6 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -2975,8 +2975,8 @@ static void ca8210_hw_setup(struct ieee802154_hw *ca8210_hw)
+ ca8210_hw->phy->cca.opt = NL802154_CCA_OPT_ENERGY_CARRIER_AND;
+ ca8210_hw->phy->cca_ed_level = -9800;
+ ca8210_hw->phy->symbol_duration = 16;
+- ca8210_hw->phy->lifs_period = 40;
+- ca8210_hw->phy->sifs_period = 12;
++ ca8210_hw->phy->lifs_period = 40 * ca8210_hw->phy->symbol_duration;
++ ca8210_hw->phy->sifs_period = 12 * ca8210_hw->phy->symbol_duration;
+ ca8210_hw->flags =
+ IEEE802154_HW_AFILT |
+ IEEE802154_HW_OMIT_CKSUM |
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index b2434b4798468..684eec0aa0d63 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1373,59 +1373,69 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ u16 hdr_off;
+ u32 *pkt_hdr;
+
+- /* This check is no longer done by usbnet */
+- if (skb->len < dev->net->hard_header_len)
++ /* At the end of the SKB, there's a header telling us how many packets
++ * are bundled into this buffer and where we can find an array of
++ * per-packet metadata (which contains elements encoded into u16).
++ */
++ if (skb->len < 4)
+ return 0;
+-
+ skb_trim(skb, skb->len - 4);
+ memcpy(&rx_hdr, skb_tail_pointer(skb), 4);
+ le32_to_cpus(&rx_hdr);
+-
+ pkt_cnt = (u16)rx_hdr;
+ hdr_off = (u16)(rx_hdr >> 16);
++
++ if (pkt_cnt == 0)
++ return 0;
++
++ /* Make sure that the bounds of the metadata array are inside the SKB
++ * (and in front of the counter at the end).
++ */
++ if (pkt_cnt * 2 + hdr_off > skb->len)
++ return 0;
+ pkt_hdr = (u32 *)(skb->data + hdr_off);
+
+- while (pkt_cnt--) {
++ /* Packets must not overlap the metadata array */
++ skb_trim(skb, hdr_off);
++
++ for (; ; pkt_cnt--, pkt_hdr++) {
+ u16 pkt_len;
+
+ le32_to_cpus(pkt_hdr);
+ pkt_len = (*pkt_hdr >> 16) & 0x1fff;
+
+- /* Check CRC or runt packet */
+- if ((*pkt_hdr & AX_RXHDR_CRC_ERR) ||
+- (*pkt_hdr & AX_RXHDR_DROP_ERR)) {
+- skb_pull(skb, (pkt_len + 7) & 0xFFF8);
+- pkt_hdr++;
+- continue;
+- }
+-
+- if (pkt_cnt == 0) {
+- skb->len = pkt_len;
+- /* Skip IP alignment pseudo header */
+- skb_pull(skb, 2);
+- skb_set_tail_pointer(skb, skb->len);
+- skb->truesize = pkt_len + sizeof(struct sk_buff);
+- ax88179_rx_checksum(skb, pkt_hdr);
+- return 1;
+- }
++ if (pkt_len > skb->len)
++ return 0;
+
+- ax_skb = skb_clone(skb, GFP_ATOMIC);
+- if (ax_skb) {
++ /* Check CRC or runt packet */
++ if (((*pkt_hdr & (AX_RXHDR_CRC_ERR | AX_RXHDR_DROP_ERR)) == 0) &&
++ pkt_len >= 2 + ETH_HLEN) {
++ bool last = (pkt_cnt == 0);
++
++ if (last) {
++ ax_skb = skb;
++ } else {
++ ax_skb = skb_clone(skb, GFP_ATOMIC);
++ if (!ax_skb)
++ return 0;
++ }
+ ax_skb->len = pkt_len;
+ /* Skip IP alignment pseudo header */
+ skb_pull(ax_skb, 2);
+ skb_set_tail_pointer(ax_skb, ax_skb->len);
+ ax_skb->truesize = pkt_len + sizeof(struct sk_buff);
+ ax88179_rx_checksum(ax_skb, pkt_hdr);
++
++ if (last)
++ return 1;
++
+ usbnet_skb_return(dev, ax_skb);
+- } else {
+- return 0;
+ }
+
+- skb_pull(skb, (pkt_len + 7) & 0xFFF8);
+- pkt_hdr++;
++ /* Trim this packet away from the SKB */
++ if (!skb_pull(skb, (pkt_len + 7) & 0xFFF8))
++ return 0;
+ }
+- return 1;
+ }
+
+ static struct sk_buff *
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 54b37a30df18b..c2e872f926f1c 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1358,6 +1358,8 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x413c, 0x81d7, 0)}, /* Dell Wireless 5821e */
+ {QMI_FIXED_INTF(0x413c, 0x81d7, 1)}, /* Dell Wireless 5821e preproduction config */
+ {QMI_FIXED_INTF(0x413c, 0x81e0, 0)}, /* Dell Wireless 5821e with eSIM support*/
++ {QMI_FIXED_INTF(0x413c, 0x81e4, 0)}, /* Dell Wireless 5829e with eSIM support*/
++ {QMI_FIXED_INTF(0x413c, 0x81e6, 0)}, /* Dell Wireless 5829e */
+ {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
+ {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */
+ {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+index c44108823f796..a43333512edc9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+@@ -1549,6 +1549,8 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
+ out_unbind:
+ complete(&drv->request_firmware_complete);
+ device_release_driver(drv->trans->dev);
++ /* drv has just been freed by the release */
++ failure = false;
+ free:
+ if (failure)
+ iwl_dealloc_ucode(drv);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+index 31e72e1ff1e26..80ae33bba6a86 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+@@ -310,8 +310,7 @@ int iwl_trans_pcie_gen2_start_fw(struct iwl_trans *trans,
+ /* This may fail if AMT took ownership of the device */
+ if (iwl_pcie_prepare_card_hw(trans)) {
+ IWL_WARN(trans, "Exit HW not ready\n");
+- ret = -EIO;
+- goto out;
++ return -EIO;
+ }
+
+ iwl_enable_rfkill_int(trans);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index fcda33482887b..2d2afc1758304 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1363,8 +1363,7 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
+ /* This may fail if AMT took ownership of the device */
+ if (iwl_pcie_prepare_card_hw(trans)) {
+ IWL_WARN(trans, "Exit HW not ready\n");
+- ret = -EIO;
+- goto out;
++ return -EIO;
+ }
+
+ iwl_enable_rfkill_int(trans);
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index e64310f2296f8..a0a805a5ab6b2 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3463,7 +3463,14 @@ static void nvme_async_event_work(struct work_struct *work)
+ container_of(work, struct nvme_ctrl, async_event_work);
+
+ nvme_aen_uevent(ctrl);
+- ctrl->ops->submit_async_event(ctrl);
++
++ /*
++ * The transport drivers must guarantee AER submission here is safe by
++ * flushing ctrl async_event_work after changing the controller state
++ * from LIVE and before freeing the admin queue.
++ */
++ if (ctrl->state == NVME_CTRL_LIVE)
++ ctrl->ops->submit_async_event(ctrl);
+ }
+
+ static bool nvme_ctrl_pp_status(struct nvme_ctrl *ctrl)
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 1f41cf80f827c..55f4999525037 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -1050,6 +1050,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
+ struct nvme_rdma_ctrl, err_work);
+
+ nvme_stop_keep_alive(&ctrl->ctrl);
++ flush_work(&ctrl->ctrl.async_event_work);
+ nvme_rdma_teardown_io_queues(ctrl, false);
+ nvme_start_queues(&ctrl->ctrl);
+ nvme_rdma_teardown_admin_queue(ctrl, false);
+diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
+index b7b2e811d5471..6efab7a06c5fc 100644
+--- a/drivers/parisc/ccio-dma.c
++++ b/drivers/parisc/ccio-dma.c
+@@ -1010,7 +1010,7 @@ ccio_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents,
+ ioc->usg_calls++;
+ #endif
+
+- while(sg_dma_len(sglist) && nents--) {
++ while (nents && sg_dma_len(sglist)) {
+
+ #ifdef CCIO_COLLECT_STATS
+ ioc->usg_pages += sg_dma_len(sglist) >> PAGE_SHIFT;
+@@ -1018,6 +1018,7 @@ ccio_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents,
+ ccio_unmap_page(dev, sg_dma_address(sglist),
+ sg_dma_len(sglist), direction, 0);
+ ++sglist;
++ nents--;
+ }
+
+ DBG_RUN_SG("%s() DONE (nents %d)\n", __func__, nents);
+diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
+index 0f19cc75cc0cf..f675dfe045118 100644
+--- a/drivers/parisc/sba_iommu.c
++++ b/drivers/parisc/sba_iommu.c
+@@ -1063,7 +1063,7 @@ sba_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents,
+ spin_unlock_irqrestore(&ioc->res_lock, flags);
+ #endif
+
+- while (sg_dma_len(sglist) && nents--) {
++ while (nents && sg_dma_len(sglist)) {
+
+ sba_unmap_page(dev, sg_dma_address(sglist), sg_dma_len(sglist),
+ direction, 0);
+@@ -1072,6 +1072,7 @@ sba_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents,
+ ioc->usingle_calls--; /* kluge since call is unmap_sg() */
+ #endif
+ ++sglist;
++ nents--;
+ }
+
+ DBG_RUN_SG("%s() DONE (nents %d)\n", __func__, nents);
+diff --git a/drivers/tty/serial/8250/8250_gsc.c b/drivers/tty/serial/8250/8250_gsc.c
+index 0809ae2aa9b14..51cc985216ff3 100644
+--- a/drivers/tty/serial/8250/8250_gsc.c
++++ b/drivers/tty/serial/8250/8250_gsc.c
+@@ -26,7 +26,7 @@ static int __init serial_init_chip(struct parisc_device *dev)
+ unsigned long address;
+ int err;
+
+-#ifdef CONFIG_64BIT
++#if defined(CONFIG_64BIT) && defined(CONFIG_IOSAPIC)
+ if (!dev->irq && (dev->id.sversion == 0xad))
+ dev->irq = iosapic_serial_irq(dev);
+ #endif
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 1967d5fa681ad..eb2f8e84ffc9e 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -4956,6 +4956,10 @@ static ssize_t fill_read_buf(struct send_ctx *sctx, u64 offset, u32 len)
+ lock_page(page);
+ if (!PageUptodate(page)) {
+ unlock_page(page);
++ btrfs_err(fs_info,
++ "send: IO error at offset %llu for inode %llu root %llu",
++ page_offset(page), sctx->cur_ino,
++ sctx->send_root->root_key.objectid);
+ put_page(page);
+ ret = -EIO;
+ break;
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 2a45e0d3e593c..6c492fca60c41 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -390,9 +390,12 @@ static int ext4_valid_extent_idx(struct inode *inode,
+
+ static int ext4_valid_extent_entries(struct inode *inode,
+ struct ext4_extent_header *eh,
+- int depth)
++ ext4_fsblk_t *pblk, int depth)
+ {
+ unsigned short entries;
++ ext4_lblk_t lblock = 0;
++ ext4_lblk_t prev = 0;
++
+ if (eh->eh_entries == 0)
+ return 1;
+
+@@ -403,32 +406,36 @@ static int ext4_valid_extent_entries(struct inode *inode,
+ struct ext4_extent *ext = EXT_FIRST_EXTENT(eh);
+ struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
+ ext4_fsblk_t pblock = 0;
+- ext4_lblk_t lblock = 0;
+- ext4_lblk_t prev = 0;
+- int len = 0;
+ while (entries) {
+ if (!ext4_valid_extent(inode, ext))
+ return 0;
+
+ /* Check for overlapping extents */
+ lblock = le32_to_cpu(ext->ee_block);
+- len = ext4_ext_get_actual_len(ext);
+ if ((lblock <= prev) && prev) {
+ pblock = ext4_ext_pblock(ext);
+ es->s_last_error_block = cpu_to_le64(pblock);
+ return 0;
+ }
++ prev = lblock + ext4_ext_get_actual_len(ext) - 1;
+ ext++;
+ entries--;
+- prev = lblock + len - 1;
+ }
+ } else {
+ struct ext4_extent_idx *ext_idx = EXT_FIRST_INDEX(eh);
+ while (entries) {
+ if (!ext4_valid_extent_idx(inode, ext_idx))
+ return 0;
++
++ /* Check for overlapping index extents */
++ lblock = le32_to_cpu(ext_idx->ei_block);
++ if ((lblock <= prev) && prev) {
++ *pblk = ext4_idx_pblock(ext_idx);
++ return 0;
++ }
+ ext_idx++;
+ entries--;
++ prev = lblock;
+ }
+ }
+ return 1;
+@@ -462,7 +469,7 @@ static int __ext4_ext_check(const char *function, unsigned int line,
+ error_msg = "invalid eh_entries";
+ goto corrupted;
+ }
+- if (!ext4_valid_extent_entries(inode, eh, depth)) {
++ if (!ext4_valid_extent_entries(inode, eh, &pblk, depth)) {
+ error_msg = "invalid extent entries";
+ goto corrupted;
+ }
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index a968b8b4b982f..10bc04af28824 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -1629,14 +1629,14 @@ no_open:
+ if (!res) {
+ inode = d_inode(dentry);
+ if ((lookup_flags & LOOKUP_DIRECTORY) && inode &&
+- !S_ISDIR(inode->i_mode))
++ !(S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)))
+ res = ERR_PTR(-ENOTDIR);
+ else if (inode && S_ISREG(inode->i_mode))
+ res = ERR_PTR(-EOPENSTALE);
+ } else if (!IS_ERR(res)) {
+ inode = d_inode(res);
+ if ((lookup_flags & LOOKUP_DIRECTORY) && inode &&
+- !S_ISDIR(inode->i_mode)) {
++ !(S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode))) {
+ dput(res);
+ res = ERR_PTR(-ENOTDIR);
+ } else if (inode && S_ISREG(inode->i_mode)) {
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index 2cdd8883b7c5d..592b95ab378bd 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -787,12 +787,9 @@ int nfs_getattr(const struct path *path, struct kstat *stat,
+ goto out_no_update;
+
+ /* Flush out writes to the server in order to update c/mtime. */
+- if ((request_mask & (STATX_CTIME|STATX_MTIME)) &&
+- S_ISREG(inode->i_mode)) {
+- err = filemap_write_and_wait(inode->i_mapping);
+- if (err)
+- goto out;
+- }
++ if ((request_mask & (STATX_CTIME | STATX_MTIME)) &&
++ S_ISREG(inode->i_mode))
++ filemap_write_and_wait(inode->i_mapping);
+
+ /*
+ * We may force a getattr if the user cares about atime.
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 1d1d393f4208d..ddb379abd919d 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -687,9 +687,14 @@ int dquot_quota_sync(struct super_block *sb, int type)
+ /* This is not very clever (and fast) but currently I don't know about
+ * any other simple way of getting quota data to disk and we must get
+ * them there for userspace to be visible... */
+- if (sb->s_op->sync_fs)
+- sb->s_op->sync_fs(sb, 1);
+- sync_blockdev(sb->s_bdev);
++ if (sb->s_op->sync_fs) {
++ ret = sb->s_op->sync_fs(sb, 1);
++ if (ret)
++ return ret;
++ }
++ ret = sync_blockdev(sb->s_bdev);
++ if (ret)
++ return ret;
+
+ /*
+ * Now when everything is written we can discard the pagecache so
+diff --git a/fs/super.c b/fs/super.c
+index 9fb4553c46e63..8dc26e23f1a35 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -1404,11 +1404,9 @@ static void lockdep_sb_freeze_acquire(struct super_block *sb)
+ percpu_rwsem_acquire(sb->s_writers.rw_sem + level, 0, _THIS_IP_);
+ }
+
+-static void sb_freeze_unlock(struct super_block *sb)
++static void sb_freeze_unlock(struct super_block *sb, int level)
+ {
+- int level;
+-
+- for (level = SB_FREEZE_LEVELS - 1; level >= 0; level--)
++ for (level--; level >= 0; level--)
+ percpu_up_write(sb->s_writers.rw_sem + level);
+ }
+
+@@ -1479,7 +1477,14 @@ int freeze_super(struct super_block *sb)
+ sb_wait_write(sb, SB_FREEZE_PAGEFAULT);
+
+ /* All writers are done so after syncing there won't be dirty data */
+- sync_filesystem(sb);
++ ret = sync_filesystem(sb);
++ if (ret) {
++ sb->s_writers.frozen = SB_UNFROZEN;
++ sb_freeze_unlock(sb, SB_FREEZE_PAGEFAULT);
++ wake_up(&sb->s_writers.wait_unfrozen);
++ deactivate_locked_super(sb);
++ return ret;
++ }
+
+ /* Now wait for internal filesystem counter */
+ sb->s_writers.frozen = SB_FREEZE_FS;
+@@ -1491,7 +1496,7 @@ int freeze_super(struct super_block *sb)
+ printk(KERN_ERR
+ "VFS:Filesystem freeze failed\n");
+ sb->s_writers.frozen = SB_UNFROZEN;
+- sb_freeze_unlock(sb);
++ sb_freeze_unlock(sb, SB_FREEZE_FS);
+ wake_up(&sb->s_writers.wait_unfrozen);
+ deactivate_locked_super(sb);
+ return ret;
+@@ -1542,7 +1547,7 @@ static int thaw_super_locked(struct super_block *sb)
+ }
+
+ sb->s_writers.frozen = SB_UNFROZEN;
+- sb_freeze_unlock(sb);
++ sb_freeze_unlock(sb, SB_FREEZE_FS);
+ out:
+ wake_up(&sb->s_writers.wait_unfrozen);
+ deactivate_locked_super(sb);
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 761d0f85c4a50..f92d5ae6d04e7 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1389,7 +1389,6 @@ extern struct pid *cad_pid;
+ #define PF_MEMALLOC 0x00000800 /* Allocating memory */
+ #define PF_NPROC_EXCEEDED 0x00001000 /* set_user() noticed that RLIMIT_NPROC was exceeded */
+ #define PF_USED_MATH 0x00002000 /* If unset the fpu must be initialized before use */
+-#define PF_USED_ASYNC 0x00004000 /* Used async_schedule*(), used by module init */
+ #define PF_NOFREEZE 0x00008000 /* This thread should not be frozen */
+ #define PF_FROZEN 0x00010000 /* Frozen for system suspend */
+ #define PF_KSWAPD 0x00020000 /* I am kswapd */
+diff --git a/include/net/bond_3ad.h b/include/net/bond_3ad.h
+index fc3111515f5cb..732bc3b4606bf 100644
+--- a/include/net/bond_3ad.h
++++ b/include/net/bond_3ad.h
+@@ -265,7 +265,7 @@ struct ad_system {
+
+ struct ad_bond_info {
+ struct ad_system system; /* 802.3ad system structure */
+- u32 agg_select_timer; /* Timer to select aggregator after all adapter's hand shakes */
++ atomic_t agg_select_timer; /* Timer to select aggregator after all adapter's hand shakes */
+ u16 aggregator_identifier;
+ };
+
+diff --git a/kernel/async.c b/kernel/async.c
+index a893d6170944f..4bf1b00a28d86 100644
+--- a/kernel/async.c
++++ b/kernel/async.c
+@@ -191,9 +191,6 @@ static async_cookie_t __async_schedule(async_func_t func, void *data, struct asy
+ atomic_inc(&entry_count);
+ spin_unlock_irqrestore(&async_lock, flags);
+
+- /* mark that this task has queued an async job, used by module init */
+- current->flags |= PF_USED_ASYNC;
+-
+ /* schedule for execution */
+ queue_work(system_unbound_wq, &entry->work);
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 68637e661d75c..42a604401c4dd 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -3526,12 +3526,6 @@ static noinline int do_init_module(struct module *mod)
+ }
+ freeinit->module_init = mod->init_layout.base;
+
+- /*
+- * We want to find out whether @mod uses async during init. Clear
+- * PF_USED_ASYNC. async_schedule*() will set it.
+- */
+- current->flags &= ~PF_USED_ASYNC;
+-
+ do_mod_ctors(mod);
+ /* Start the module */
+ if (mod->init != NULL)
+@@ -3557,22 +3551,13 @@ static noinline int do_init_module(struct module *mod)
+
+ /*
+ * We need to finish all async code before the module init sequence
+- * is done. This has potential to deadlock. For example, a newly
+- * detected block device can trigger request_module() of the
+- * default iosched from async probing task. Once userland helper
+- * reaches here, async_synchronize_full() will wait on the async
+- * task waiting on request_module() and deadlock.
+- *
+- * This deadlock is avoided by perfomring async_synchronize_full()
+- * iff module init queued any async jobs. This isn't a full
+- * solution as it will deadlock the same if module loading from
+- * async jobs nests more than once; however, due to the various
+- * constraints, this hack seems to be the best option for now.
+- * Please refer to the following thread for details.
++ * is done. This has potential to deadlock if synchronous module
++ * loading is requested from async (which is not allowed!).
+ *
+- * http://thread.gmane.org/gmane.linux.kernel/1420814
++ * See commit 0fdff3ec6d87 ("async, kmod: warn on synchronous
++ * request_module() from async workers") for more details.
+ */
+- if (!mod->async_probe_requested && (current->flags & PF_USED_ASYNC))
++ if (!mod->async_probe_requested)
+ async_synchronize_full();
+
+ ftrace_free_mem(mod, mod->init_layout.base, mod->init_layout.base +
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 17e337a22c239..19a6b088f1e72 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -232,6 +232,10 @@ __setup("trace_clock=", set_trace_boot_clock);
+
+ static int __init set_tracepoint_printk(char *str)
+ {
++ /* Ignore the "tp_printk_stop_on_boot" param */
++ if (*str == '_')
++ return 0;
++
+ if ((strcmp(str, "=0") != 0 && strcmp(str, "=off") != 0))
+ tracepoint_printk = 1;
+ return 1;
+diff --git a/kernel/tsacct.c b/kernel/tsacct.c
+index 370724b453918..8d7c6d3f1daa7 100644
+--- a/kernel/tsacct.c
++++ b/kernel/tsacct.c
+@@ -46,11 +46,10 @@ void bacct_add_tsk(struct user_namespace *user_ns,
+ /* Convert to seconds for btime */
+ do_div(delta, USEC_PER_SEC);
+ stats->ac_btime = get_seconds() - delta;
+- if (thread_group_leader(tsk)) {
++ if (tsk->flags & PF_EXITING)
+ stats->ac_exitcode = tsk->exit_code;
+- if (tsk->flags & PF_FORKNOEXEC)
+- stats->ac_flag |= AFORK;
+- }
++ if (thread_group_leader(tsk) && (tsk->flags & PF_FORKNOEXEC))
++ stats->ac_flag |= AFORK;
+ if (tsk->flags & PF_SUPERPRIV)
+ stats->ac_flag |= ASU;
+ if (tsk->flags & PF_DUMPCORE)
+diff --git a/lib/iov_iter.c b/lib/iov_iter.c
+index 39e6e978029c1..4391962230319 100644
+--- a/lib/iov_iter.c
++++ b/lib/iov_iter.c
+@@ -393,6 +393,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by
+ return 0;
+ pipe->nrbufs++;
+ buf->ops = &page_cache_pipe_buf_ops;
++ buf->flags = 0;
+ get_page(buf->page = page);
+ buf->offset = offset;
+ buf->len = bytes;
+@@ -517,6 +518,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size,
+ break;
+ pipe->nrbufs++;
+ pipe->bufs[idx].ops = &default_pipe_buf_ops;
++ pipe->bufs[idx].flags = 0;
+ pipe->bufs[idx].page = page;
+ pipe->bufs[idx].offset = 0;
+ if (left <= PAGE_SIZE) {
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index 567fdfd9678d5..a2bf5e4e9fbee 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -80,6 +80,7 @@ static void ax25_kill_by_device(struct net_device *dev)
+ {
+ ax25_dev *ax25_dev;
+ ax25_cb *s;
++ struct sock *sk;
+
+ if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
+ return;
+@@ -88,13 +89,15 @@ static void ax25_kill_by_device(struct net_device *dev)
+ again:
+ ax25_for_each(s, &ax25_list) {
+ if (s->ax25_dev == ax25_dev) {
++ sk = s->sk;
++ sock_hold(sk);
+ spin_unlock_bh(&ax25_list_lock);
+- lock_sock(s->sk);
++ lock_sock(sk);
+ s->ax25_dev = NULL;
+- release_sock(s->sk);
++ release_sock(sk);
+ ax25_disconnect(s, ENETUNREACH);
+ spin_lock_bh(&ax25_list_lock);
+-
++ sock_put(sk);
+ /* The entry could have been deleted from the
+ * list meanwhile and thus the next pointer is
+ * no longer valid. Play it safe and restart
+diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
+index 3978a5e8d261c..2ed6000126408 100644
+--- a/net/core/drop_monitor.c
++++ b/net/core/drop_monitor.c
+@@ -219,13 +219,17 @@ static void trace_napi_poll_hit(void *ignore, struct napi_struct *napi,
+
+ rcu_read_lock();
+ list_for_each_entry_rcu(new_stat, &hw_stats_list, list) {
++ struct net_device *dev;
++
+ /*
+ * only add a note to our monitor buffer if:
+ * 1) this is the dev we received on
+ * 2) its after the last_rx delta
+ * 3) our rx_dropped count has gone up
+ */
+- if ((new_stat->dev == napi->dev) &&
++ /* Paired with WRITE_ONCE() in dropmon_net_event() */
++ dev = READ_ONCE(new_stat->dev);
++ if ((dev == napi->dev) &&
+ (time_after(jiffies, new_stat->last_rx + dm_hw_check_delta)) &&
+ (napi->dev->stats.rx_dropped != new_stat->last_drop_val)) {
+ trace_drop_common(NULL, NULL);
+@@ -340,7 +344,10 @@ static int dropmon_net_event(struct notifier_block *ev_block,
+ mutex_lock(&trace_state_mutex);
+ list_for_each_entry_safe(new_stat, tmp, &hw_stats_list, list) {
+ if (new_stat->dev == dev) {
+- new_stat->dev = NULL;
++
++ /* Paired with READ_ONCE() in trace_napi_poll_hit() */
++ WRITE_ONCE(new_stat->dev, NULL);
++
+ if (trace_state == TRACE_OFF) {
+ list_del_rcu(&new_stat->list);
+ kfree_rcu(new_stat, rcu);
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 276442443d322..28d171e6e10b9 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -177,16 +177,23 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
+ struct sock *sk = NULL;
+ struct inet_sock *isk;
+ struct hlist_nulls_node *hnode;
+- int dif = skb->dev->ifindex;
++ int dif, sdif;
+
+ if (skb->protocol == htons(ETH_P_IP)) {
++ dif = inet_iif(skb);
++ sdif = inet_sdif(skb);
+ pr_debug("try to find: num = %d, daddr = %pI4, dif = %d\n",
+ (int)ident, &ip_hdr(skb)->daddr, dif);
+ #if IS_ENABLED(CONFIG_IPV6)
+ } else if (skb->protocol == htons(ETH_P_IPV6)) {
++ dif = inet6_iif(skb);
++ sdif = inet6_sdif(skb);
+ pr_debug("try to find: num = %d, daddr = %pI6c, dif = %d\n",
+ (int)ident, &ipv6_hdr(skb)->daddr, dif);
+ #endif
++ } else {
++ pr_err("ping: protocol(%x) is not supported\n", ntohs(skb->protocol));
++ return NULL;
+ }
+
+ read_lock_bh(&ping_table.lock);
+@@ -226,7 +233,7 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
+ }
+
+ if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif &&
+- sk->sk_bound_dev_if != inet_sdif(skb))
++ sk->sk_bound_dev_if != sdif)
+ continue;
+
+ sock_hold(sk);
+diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
+index 1e5e2e4be0b27..e85b5f57d3e92 100644
+--- a/net/ipv4/xfrm4_policy.c
++++ b/net/ipv4/xfrm4_policy.c
+@@ -17,6 +17,7 @@
+ #include <net/xfrm.h>
+ #include <net/ip.h>
+ #include <net/l3mdev.h>
++#include <net/inet_ecn.h>
+
+ static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,
+ int tos, int oif,
+@@ -126,7 +127,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
+ fl4->flowi4_proto = iph->protocol;
+ fl4->daddr = reverse ? iph->saddr : iph->daddr;
+ fl4->saddr = reverse ? iph->daddr : iph->saddr;
+- fl4->flowi4_tos = iph->tos;
++ fl4->flowi4_tos = iph->tos & ~INET_ECN_MASK;
+
+ if (!ip_is_fragment(iph)) {
+ switch (iph->protocol) {
+diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
+index a937d4f75613f..8cb62805fd684 100644
+--- a/net/netfilter/nf_conntrack_proto_sctp.c
++++ b/net/netfilter/nf_conntrack_proto_sctp.c
+@@ -394,6 +394,15 @@ static int sctp_packet(struct nf_conn *ct,
+ pr_debug("Setting vtag %x for dir %d\n",
+ ih->init_tag, !dir);
+ ct->proto.sctp.vtag[!dir] = ih->init_tag;
++
++ /* don't renew timeout on init retransmit so
++ * port reuse by client or NAT middlebox cannot
++ * keep entry alive indefinitely (incl. nat info).
++ */
++ if (new_state == SCTP_CONNTRACK_CLOSED &&
++ old_state == SCTP_CONNTRACK_CLOSED &&
++ nf_ct_is_confirmed(ct))
++ ignore = true;
+ }
+
+ ct->proto.sctp.state = new_state;
+diff --git a/net/sched/act_api.c b/net/sched/act_api.c
+index 26710b297dcbb..ad0773b20d831 100644
+--- a/net/sched/act_api.c
++++ b/net/sched/act_api.c
+@@ -609,15 +609,24 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions,
+ restart_act_graph:
+ for (i = 0; i < nr_actions; i++) {
+ const struct tc_action *a = actions[i];
++ int repeat_ttl;
+
+ if (jmp_prgcnt > 0) {
+ jmp_prgcnt -= 1;
+ continue;
+ }
++
++ repeat_ttl = 32;
+ repeat:
+ ret = a->ops->act(skb, a, res);
+- if (ret == TC_ACT_REPEAT)
+- goto repeat; /* we need a ttl - JHS */
++
++ if (unlikely(ret == TC_ACT_REPEAT)) {
++ if (--repeat_ttl != 0)
++ goto repeat;
++ /* suspicious opcode, stop pipeline */
++ net_warn_ratelimited("TC_ACT_REPEAT abuse ?\n");
++ return TC_ACT_OK;
++ }
+
+ if (TC_ACT_EXT_CMP(ret, TC_ACT_JUMP)) {
+ jmp_prgcnt = ret & TCA_ACT_MAX_PRIO_MASK;
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 37329e11dc3cc..22931a5f62bc6 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1230,6 +1230,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
+ sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE;
+ sock->state = SS_UNCONNECTED;
+ vsock_transport_cancel_pkt(vsk);
++ vsock_remove_connected(vsk);
+ goto out_wait;
+ } else if (timeout == 0) {
+ err = -ETIMEDOUT;
+diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
+index 486e135d3e30a..65df6141397fe 100644
+--- a/scripts/Makefile.extrawarn
++++ b/scripts/Makefile.extrawarn
+@@ -73,5 +73,6 @@ KBUILD_CFLAGS += $(call cc-disable-warning, sign-compare)
+ KBUILD_CFLAGS += $(call cc-disable-warning, format-zero-length)
+ KBUILD_CFLAGS += $(call cc-disable-warning, uninitialized)
+ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast)
++KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access)
+ endif
+ endif
+diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
+index 389814b02d06b..8c7e51a6273cc 100644
+--- a/scripts/kconfig/preprocess.c
++++ b/scripts/kconfig/preprocess.c
+@@ -138,7 +138,7 @@ static char *do_lineno(int argc, char *argv[])
+ static char *do_shell(int argc, char *argv[])
+ {
+ FILE *p;
+- char buf[256];
++ char buf[4096];
+ char *cmd;
+ size_t nread;
+ int i;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 7d4b6c31dfe70..686f0fed6f6e4 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1674,6 +1674,7 @@ static struct snd_pci_quirk probe_mask_list[] = {
+ /* forced codec slots */
+ SND_PCI_QUIRK(0x1043, 0x1262, "ASUS W5Fm", 0x103),
+ SND_PCI_QUIRK(0x1046, 0x1262, "ASUS W5F", 0x103),
++ SND_PCI_QUIRK(0x1558, 0x0351, "Schenker Dock 15", 0x105),
+ /* WinFast VP200 H (Teradici) user reported broken communication */
+ SND_PCI_QUIRK(0x3a21, 0x040d, "WinFast VP200 H", 0x101),
+ {}
+@@ -1859,8 +1860,6 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
+
+ assign_position_fix(chip, check_position_fix(chip, position_fix[dev]));
+
+- check_probe_mask(chip, dev);
+-
+ if (single_cmd < 0) /* allow fallback to single_cmd at errors */
+ chip->fallback_to_single_cmd = 1;
+ else /* explicitly set to single_cmd or not */
+@@ -1889,6 +1888,8 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
+ chip->bus.needs_damn_long_delay = 1;
+ }
+
++ check_probe_mask(chip, dev);
++
+ err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops);
+ if (err < 0) {
+ dev_err(card->dev, "Error creating device [card]!\n");
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index ef8fd331526b0..f5dcd625e4355 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -314,7 +314,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol,
+ unsigned int sign_bit = mc->sign_bit;
+ unsigned int mask = (1 << fls(max)) - 1;
+ unsigned int invert = mc->invert;
+- int err;
++ int err, ret;
+ bool type_2r = false;
+ unsigned int val2 = 0;
+ unsigned int val, val_mask;
+@@ -356,12 +356,18 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol,
+ err = snd_soc_component_update_bits(component, reg, val_mask, val);
+ if (err < 0)
+ return err;
++ ret = err;
+
+- if (type_2r)
++ if (type_2r) {
+ err = snd_soc_component_update_bits(component, reg2, val_mask,
+- val2);
++ val2);
++ /* Don't discard any error code or drop change flag */
++ if (ret == 0 || err < 0) {
++ ret = err;
++ }
++ }
+
+- return err;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(snd_soc_put_volsw);
+
+@@ -517,7 +523,7 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
+ unsigned int mask = (1 << fls(max)) - 1;
+ unsigned int invert = mc->invert;
+ unsigned int val, val_mask;
+- int ret;
++ int err, ret;
+
+ if (invert)
+ val = (max - ucontrol->value.integer.value[0]) & mask;
+@@ -526,9 +532,10 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
+ val_mask = mask << shift;
+ val = val << shift;
+
+- ret = snd_soc_component_update_bits(component, reg, val_mask, val);
+- if (ret < 0)
+- return ret;
++ err = snd_soc_component_update_bits(component, reg, val_mask, val);
++ if (err < 0)
++ return err;
++ ret = err;
+
+ if (snd_soc_volsw_is_stereo(mc)) {
+ if (invert)
+@@ -538,8 +545,12 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
+ val_mask = mask << shift;
+ val = val << shift;
+
+- ret = snd_soc_component_update_bits(component, rreg, val_mask,
++ err = snd_soc_component_update_bits(component, rreg, val_mask,
+ val);
++ /* Don't discard any error code or drop change flag */
++ if (ret == 0 || err < 0) {
++ ret = err;
++ }
+ }
+
+ return ret;
+diff --git a/tools/lib/subcmd/subcmd-util.h b/tools/lib/subcmd/subcmd-util.h
+index 794a375dad360..b2aec04fce8f6 100644
+--- a/tools/lib/subcmd/subcmd-util.h
++++ b/tools/lib/subcmd/subcmd-util.h
+@@ -50,15 +50,8 @@ static NORETURN inline void die(const char *err, ...)
+ static inline void *xrealloc(void *ptr, size_t size)
+ {
+ void *ret = realloc(ptr, size);
+- if (!ret && !size)
+- ret = realloc(ptr, 1);
+- if (!ret) {
+- ret = realloc(ptr, size);
+- if (!ret && !size)
+- ret = realloc(ptr, 1);
+- if (!ret)
+- die("Out of memory, realloc failed");
+- }
++ if (!ret)
++ die("Out of memory, realloc failed");
+ return ret;
+ }
+
+diff --git a/tools/testing/selftests/zram/zram.sh b/tools/testing/selftests/zram/zram.sh
+index 232e958ec4547..b0b91d9b0dc21 100755
+--- a/tools/testing/selftests/zram/zram.sh
++++ b/tools/testing/selftests/zram/zram.sh
+@@ -2,9 +2,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ TCID="zram.sh"
+
+-# Kselftest framework requirement - SKIP code is 4.
+-ksft_skip=4
+-
+ . ./zram_lib.sh
+
+ run_zram () {
+@@ -18,14 +15,4 @@ echo ""
+
+ check_prereqs
+
+-# check zram module exists
+-MODULE_PATH=/lib/modules/`uname -r`/kernel/drivers/block/zram/zram.ko
+-if [ -f $MODULE_PATH ]; then
+- run_zram
+-elif [ -b /dev/zram0 ]; then
+- run_zram
+-else
+- echo "$TCID : No zram.ko module or /dev/zram0 device file not found"
+- echo "$TCID : CONFIG_ZRAM is not set"
+- exit $ksft_skip
+-fi
++run_zram
+diff --git a/tools/testing/selftests/zram/zram01.sh b/tools/testing/selftests/zram/zram01.sh
+index b9566a6478a9c..8abc9965089d1 100755
+--- a/tools/testing/selftests/zram/zram01.sh
++++ b/tools/testing/selftests/zram/zram01.sh
+@@ -42,9 +42,7 @@ zram_algs="lzo"
+
+ zram_fill_fs()
+ {
+- local mem_free0=$(free -m | awk 'NR==2 {print $4}')
+-
+- for i in $(seq 0 $(($dev_num - 1))); do
++ for i in $(seq $dev_start $dev_end); do
+ echo "fill zram$i..."
+ local b=0
+ while [ true ]; do
+@@ -54,29 +52,17 @@ zram_fill_fs()
+ b=$(($b + 1))
+ done
+ echo "zram$i can be filled with '$b' KB"
+- done
+
+- local mem_free1=$(free -m | awk 'NR==2 {print $4}')
+- local used_mem=$(($mem_free0 - $mem_free1))
++ local mem_used_total=`awk '{print $3}' "/sys/block/zram$i/mm_stat"`
++ local v=$((100 * 1024 * $b / $mem_used_total))
++ if [ "$v" -lt 100 ]; then
++ echo "FAIL compression ratio: 0.$v:1"
++ ERR_CODE=-1
++ return
++ fi
+
+- local total_size=0
+- for sm in $zram_sizes; do
+- local s=$(echo $sm | sed 's/M//')
+- total_size=$(($total_size + $s))
++ echo "zram compression ratio: $(echo "scale=2; $v / 100 " | bc):1: OK"
+ done
+-
+- echo "zram used ${used_mem}M, zram disk sizes ${total_size}M"
+-
+- local v=$((100 * $total_size / $used_mem))
+-
+- if [ "$v" -lt 100 ]; then
+- echo "FAIL compression ratio: 0.$v:1"
+- ERR_CODE=-1
+- zram_cleanup
+- return
+- fi
+-
+- echo "zram compression ratio: $(echo "scale=2; $v / 100 " | bc):1: OK"
+ }
+
+ check_prereqs
+@@ -90,7 +76,6 @@ zram_mount
+
+ zram_fill_fs
+ zram_cleanup
+-zram_unload
+
+ if [ $ERR_CODE -ne 0 ]; then
+ echo "$TCID : [FAIL]"
+diff --git a/tools/testing/selftests/zram/zram02.sh b/tools/testing/selftests/zram/zram02.sh
+index 74569b883737f..3768cfd2e5f83 100755
+--- a/tools/testing/selftests/zram/zram02.sh
++++ b/tools/testing/selftests/zram/zram02.sh
+@@ -45,7 +45,6 @@ zram_set_memlimit
+ zram_makeswap
+ zram_swapoff
+ zram_cleanup
+-zram_unload
+
+ if [ $ERR_CODE -ne 0 ]; then
+ echo "$TCID : [FAIL]"
+diff --git a/tools/testing/selftests/zram/zram_lib.sh b/tools/testing/selftests/zram/zram_lib.sh
+index 9e73a4fb9b0aa..130d193cbd727 100755
+--- a/tools/testing/selftests/zram/zram_lib.sh
++++ b/tools/testing/selftests/zram/zram_lib.sh
+@@ -14,12 +14,17 @@
+ # Author: Alexey Kodanev <alexey.kodanev@oracle.com>
+ # Modified: Naresh Kamboju <naresh.kamboju@linaro.org>
+
+-MODULE=0
+ dev_makeswap=-1
+ dev_mounted=-1
+-
++dev_start=0
++dev_end=-1
++module_load=-1
++sys_control=-1
+ # Kselftest framework requirement - SKIP code is 4.
+ ksft_skip=4
++kernel_version=`uname -r | cut -d'.' -f1,2`
++kernel_major=${kernel_version%.*}
++kernel_minor=${kernel_version#*.}
+
+ trap INT
+
+@@ -34,68 +39,104 @@ check_prereqs()
+ fi
+ }
+
++kernel_gte()
++{
++ major=${1%.*}
++ minor=${1#*.}
++
++ if [ $kernel_major -gt $major ]; then
++ return 0
++ elif [[ $kernel_major -eq $major && $kernel_minor -ge $minor ]]; then
++ return 0
++ fi
++
++ return 1
++}
++
+ zram_cleanup()
+ {
+ echo "zram cleanup"
+ local i=
+- for i in $(seq 0 $dev_makeswap); do
++ for i in $(seq $dev_start $dev_makeswap); do
+ swapoff /dev/zram$i
+ done
+
+- for i in $(seq 0 $dev_mounted); do
++ for i in $(seq $dev_start $dev_mounted); do
+ umount /dev/zram$i
+ done
+
+- for i in $(seq 0 $(($dev_num - 1))); do
++ for i in $(seq $dev_start $dev_end); do
+ echo 1 > /sys/block/zram${i}/reset
+ rm -rf zram$i
+ done
+
+-}
++ if [ $sys_control -eq 1 ]; then
++ for i in $(seq $dev_start $dev_end); do
++ echo $i > /sys/class/zram-control/hot_remove
++ done
++ fi
+
+-zram_unload()
+-{
+- if [ $MODULE -ne 0 ] ; then
+- echo "zram rmmod zram"
++ if [ $module_load -eq 1 ]; then
+ rmmod zram > /dev/null 2>&1
+ fi
+ }
+
+ zram_load()
+ {
+- # check zram module exists
+- MODULE_PATH=/lib/modules/`uname -r`/kernel/drivers/block/zram/zram.ko
+- if [ -f $MODULE_PATH ]; then
+- MODULE=1
+- echo "create '$dev_num' zram device(s)"
+- modprobe zram num_devices=$dev_num
+- if [ $? -ne 0 ]; then
+- echo "failed to insert zram module"
+- exit 1
+- fi
+-
+- dev_num_created=$(ls /dev/zram* | wc -w)
++ echo "create '$dev_num' zram device(s)"
++
++ # zram module loaded, new kernel
++ if [ -d "/sys/class/zram-control" ]; then
++ echo "zram modules already loaded, kernel supports" \
++ "zram-control interface"
++ dev_start=$(ls /dev/zram* | wc -w)
++ dev_end=$(($dev_start + $dev_num - 1))
++ sys_control=1
++
++ for i in $(seq $dev_start $dev_end); do
++ cat /sys/class/zram-control/hot_add > /dev/null
++ done
++
++ echo "all zram devices (/dev/zram$dev_start~$dev_end" \
++ "successfully created"
++ return 0
++ fi
+
+- if [ "$dev_num_created" -ne "$dev_num" ]; then
+- echo "unexpected num of devices: $dev_num_created"
+- ERR_CODE=-1
++ # detect old kernel or built-in
++ modprobe zram num_devices=$dev_num
++ if [ ! -d "/sys/class/zram-control" ]; then
++ if grep -q '^zram' /proc/modules; then
++ rmmod zram > /dev/null 2>&1
++ if [ $? -ne 0 ]; then
++ echo "zram module is being used on old kernel" \
++ "without zram-control interface"
++ exit $ksft_skip
++ fi
+ else
+- echo "zram load module successful"
++ echo "test needs CONFIG_ZRAM=m on old kernel without" \
++ "zram-control interface"
++ exit $ksft_skip
+ fi
+- elif [ -b /dev/zram0 ]; then
+- echo "/dev/zram0 device file found: OK"
+- else
+- echo "ERROR: No zram.ko module or no /dev/zram0 device found"
+- echo "$TCID : CONFIG_ZRAM is not set"
+- exit 1
++ modprobe zram num_devices=$dev_num
+ fi
++
++ module_load=1
++ dev_end=$(($dev_num - 1))
++ echo "all zram devices (/dev/zram0~$dev_end) successfully created"
+ }
+
+ zram_max_streams()
+ {
+ echo "set max_comp_streams to zram device(s)"
+
+- local i=0
++ kernel_gte 4.7
++ if [ $? -eq 0 ]; then
++ echo "The device attribute max_comp_streams was"\
++ "deprecated in 4.7"
++ return 0
++ fi
++
++ local i=$dev_start
+ for max_s in $zram_max_streams; do
+ local sys_path="/sys/block/zram${i}/max_comp_streams"
+ echo $max_s > $sys_path || \
+@@ -107,7 +148,7 @@ zram_max_streams()
+ echo "FAIL can't set max_streams '$max_s', get $max_stream"
+
+ i=$(($i + 1))
+- echo "$sys_path = '$max_streams' ($i/$dev_num)"
++ echo "$sys_path = '$max_streams'"
+ done
+
+ echo "zram max streams: OK"
+@@ -117,15 +158,16 @@ zram_compress_alg()
+ {
+ echo "test that we can set compression algorithm"
+
+- local algs=$(cat /sys/block/zram0/comp_algorithm)
++ local i=$dev_start
++ local algs=$(cat /sys/block/zram${i}/comp_algorithm)
+ echo "supported algs: $algs"
+- local i=0
++
+ for alg in $zram_algs; do
+ local sys_path="/sys/block/zram${i}/comp_algorithm"
+ echo "$alg" > $sys_path || \
+ echo "FAIL can't set '$alg' to $sys_path"
+ i=$(($i + 1))
+- echo "$sys_path = '$alg' ($i/$dev_num)"
++ echo "$sys_path = '$alg'"
+ done
+
+ echo "zram set compression algorithm: OK"
+@@ -134,14 +176,14 @@ zram_compress_alg()
+ zram_set_disksizes()
+ {
+ echo "set disk size to zram device(s)"
+- local i=0
++ local i=$dev_start
+ for ds in $zram_sizes; do
+ local sys_path="/sys/block/zram${i}/disksize"
+ echo "$ds" > $sys_path || \
+ echo "FAIL can't set '$ds' to $sys_path"
+
+ i=$(($i + 1))
+- echo "$sys_path = '$ds' ($i/$dev_num)"
++ echo "$sys_path = '$ds'"
+ done
+
+ echo "zram set disksizes: OK"
+@@ -151,14 +193,14 @@ zram_set_memlimit()
+ {
+ echo "set memory limit to zram device(s)"
+
+- local i=0
++ local i=$dev_start
+ for ds in $zram_mem_limits; do
+ local sys_path="/sys/block/zram${i}/mem_limit"
+ echo "$ds" > $sys_path || \
+ echo "FAIL can't set '$ds' to $sys_path"
+
+ i=$(($i + 1))
+- echo "$sys_path = '$ds' ($i/$dev_num)"
++ echo "$sys_path = '$ds'"
+ done
+
+ echo "zram set memory limit: OK"
+@@ -167,8 +209,8 @@ zram_set_memlimit()
+ zram_makeswap()
+ {
+ echo "make swap with zram device(s)"
+- local i=0
+- for i in $(seq 0 $(($dev_num - 1))); do
++ local i=$dev_start
++ for i in $(seq $dev_start $dev_end); do
+ mkswap /dev/zram$i > err.log 2>&1
+ if [ $? -ne 0 ]; then
+ cat err.log
+@@ -191,7 +233,7 @@ zram_makeswap()
+ zram_swapoff()
+ {
+ local i=
+- for i in $(seq 0 $dev_makeswap); do
++ for i in $(seq $dev_start $dev_end); do
+ swapoff /dev/zram$i > err.log 2>&1
+ if [ $? -ne 0 ]; then
+ cat err.log
+@@ -205,7 +247,7 @@ zram_swapoff()
+
+ zram_makefs()
+ {
+- local i=0
++ local i=$dev_start
+ for fs in $zram_filesystems; do
+ # if requested fs not supported default it to ext2
+ which mkfs.$fs > /dev/null 2>&1 || fs=ext2
+@@ -224,7 +266,7 @@ zram_makefs()
+ zram_mount()
+ {
+ local i=0
+- for i in $(seq 0 $(($dev_num - 1))); do
++ for i in $(seq $dev_start $dev_end); do
+ echo "mount /dev/zram$i"
+ mkdir zram$i
+ mount /dev/zram$i zram$i > /dev/null || \
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-02-26 21:14 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-02-26 21:14 UTC (permalink / raw
To: gentoo-commits
commit: c302ea5aa9719421d98665b783543b5d48f09a99
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 26 21:14:17 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Feb 26 21:14:17 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c302ea5a
Update default security restrictions
Bug: https://bugs.gentoo.org/834085
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
...able-link-security-restrictions-by-default.patch | 21 +++++++++------------
1 file changed, 9 insertions(+), 12 deletions(-)
diff --git a/1510_fs-enable-link-security-restrictions-by-default.patch b/1510_fs-enable-link-security-restrictions-by-default.patch
index f0ed144f..1b3e590d 100644
--- a/1510_fs-enable-link-security-restrictions-by-default.patch
+++ b/1510_fs-enable-link-security-restrictions-by-default.patch
@@ -1,20 +1,17 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Subject: fs: Enable link security restrictions by default
-Date: Fri, 02 Nov 2012 05:32:06 +0000
-Bug-Debian: https://bugs.debian.org/609455
-Forwarded: not-needed
-This reverts commit 561ec64ae67ef25cac8d72bb9c4bfc955edfd415
-('VFS: don't do protected {sym,hard}links by default').
---- a/fs/namei.c 2018-09-28 07:56:07.770005006 -0400
-+++ b/fs/namei.c 2018-09-28 07:56:43.370349204 -0400
-@@ -885,8 +885,8 @@ static inline void put_link(struct namei
+--- a/fs/namei.c 2022-01-09 17:55:34.000000000 -0500
++++ b/fs/namei.c 2022-02-26 11:32:31.832844465 -0500
+@@ -1020,10 +1020,10 @@ static inline void put_link(struct namei
path_put(&last->link);
}
-int sysctl_protected_symlinks __read_mostly = 0;
-int sysctl_protected_hardlinks __read_mostly = 0;
+-int sysctl_protected_fifos __read_mostly;
+-int sysctl_protected_regular __read_mostly;
+int sysctl_protected_symlinks __read_mostly = 1;
+int sysctl_protected_hardlinks __read_mostly = 1;
- int sysctl_protected_fifos __read_mostly;
- int sysctl_protected_regular __read_mostly;
++int sysctl_protected_fifos __read_mostly = 1;
++int sysctl_protected_regular __read_mostly = 1;
+ /**
+ * may_follow_link - Check symlink following for unsafe situations
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-03-02 13:08 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-03-02 13:08 UTC (permalink / raw
To: gentoo-commits
commit: 2bce271e6a928666d935d281a6dec9eb9f0f0f43
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 2 13:07:50 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 2 13:07:50 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2bce271e
Linux patch 4.19.232
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1231_linux-4.19.232.patch | 1182 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1186 insertions(+)
diff --git a/0000_README b/0000_README
index 67a0a028..a1760f41 100644
--- a/0000_README
+++ b/0000_README
@@ -963,6 +963,10 @@ Patch: 1230_linux-4.19.231.patch
From: https://www.kernel.org
Desc: Linux 4.19.231
+Patch: 1231_linux-4.19.232.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.232
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1231_linux-4.19.232.patch b/1231_linux-4.19.232.patch
new file mode 100644
index 00000000..a5731480
--- /dev/null
+++ b/1231_linux-4.19.232.patch
@@ -0,0 +1,1182 @@
+diff --git a/Makefile b/Makefile
+index 165660cd857e1..77a389ab3538c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 231
++SUBLEVEL = 232
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/parisc/kernel/unaligned.c b/arch/parisc/kernel/unaligned.c
+index 932bfc0b7cd87..c16af267362e4 100644
+--- a/arch/parisc/kernel/unaligned.c
++++ b/arch/parisc/kernel/unaligned.c
+@@ -354,7 +354,7 @@ static int emulate_stw(struct pt_regs *regs, int frreg, int flop)
+ : "r" (val), "r" (regs->ior), "r" (regs->isr)
+ : "r19", "r20", "r21", "r22", "r1", FIXUP_BRANCH_CLOBBER );
+
+- return 0;
++ return ret;
+ }
+ static int emulate_std(struct pt_regs *regs, int frreg, int flop)
+ {
+@@ -411,7 +411,7 @@ static int emulate_std(struct pt_regs *regs, int frreg, int flop)
+ __asm__ __volatile__ (
+ " mtsp %4, %%sr1\n"
+ " zdep %2, 29, 2, %%r19\n"
+-" dep %%r0, 31, 2, %2\n"
++" dep %%r0, 31, 2, %3\n"
+ " mtsar %%r19\n"
+ " zvdepi -2, 32, %%r19\n"
+ "1: ldw 0(%%sr1,%3),%%r20\n"
+@@ -423,7 +423,7 @@ static int emulate_std(struct pt_regs *regs, int frreg, int flop)
+ " andcm %%r21, %%r19, %%r21\n"
+ " or %1, %%r20, %1\n"
+ " or %2, %%r21, %2\n"
+-"3: stw %1,0(%%sr1,%1)\n"
++"3: stw %1,0(%%sr1,%3)\n"
+ "4: stw %%r1,4(%%sr1,%3)\n"
+ "5: stw %2,8(%%sr1,%3)\n"
+ " copy %%r0, %0\n"
+@@ -610,7 +610,6 @@ void handle_unaligned(struct pt_regs *regs)
+ ret = ERR_NOTHANDLED; /* "undefined", but lets kill them. */
+ break;
+ }
+-#ifdef CONFIG_PA20
+ switch (regs->iir & OPCODE2_MASK)
+ {
+ case OPCODE_FLDD_L:
+@@ -621,22 +620,23 @@ void handle_unaligned(struct pt_regs *regs)
+ flop=1;
+ ret = emulate_std(regs, R2(regs->iir),1);
+ break;
++#ifdef CONFIG_PA20
+ case OPCODE_LDD_L:
+ ret = emulate_ldd(regs, R2(regs->iir),0);
+ break;
+ case OPCODE_STD_L:
+ ret = emulate_std(regs, R2(regs->iir),0);
+ break;
+- }
+ #endif
++ }
+ switch (regs->iir & OPCODE3_MASK)
+ {
+ case OPCODE_FLDW_L:
+ flop=1;
+- ret = emulate_ldw(regs, R2(regs->iir),0);
++ ret = emulate_ldw(regs, R2(regs->iir), 1);
+ break;
+ case OPCODE_LDW_M:
+- ret = emulate_ldw(regs, R2(regs->iir),1);
++ ret = emulate_ldw(regs, R2(regs->iir), 0);
+ break;
+
+ case OPCODE_FSTW_L:
+diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
+index ef8aaeb0c575a..f44136a3a1635 100644
+--- a/drivers/ata/pata_hpt37x.c
++++ b/drivers/ata/pata_hpt37x.c
+@@ -916,6 +916,20 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+ irqmask &= ~0x10;
+ pci_write_config_byte(dev, 0x5a, irqmask);
+
++ /*
++ * HPT371 chips physically have only one channel, the secondary one,
++ * but the primary channel registers do exist! Go figure...
++ * So, we manually disable the non-existing channel here
++ * (if the BIOS hasn't done this already).
++ */
++ if (dev->device == PCI_DEVICE_ID_TTI_HPT371) {
++ u8 mcr1;
++
++ pci_read_config_byte(dev, 0x50, &mcr1);
++ mcr1 &= ~0x04;
++ pci_write_config_byte(dev, 0x50, mcr1);
++ }
++
+ /*
+ * default to pci clock. make sure MA15/16 are set to output
+ * to prevent drives having problems with 40-pin cables. Needed
+diff --git a/drivers/gpio/gpio-tegra186.c b/drivers/gpio/gpio-tegra186.c
+index 9d0292c8a1999..4c9e7a201d899 100644
+--- a/drivers/gpio/gpio-tegra186.c
++++ b/drivers/gpio/gpio-tegra186.c
+@@ -237,9 +237,12 @@ static int tegra186_gpio_of_xlate(struct gpio_chip *chip,
+ return offset + pin;
+ }
+
++#define to_tegra_gpio(x) container_of((x), struct tegra_gpio, gpio)
++
+ static void tegra186_irq_ack(struct irq_data *data)
+ {
+- struct tegra_gpio *gpio = irq_data_get_irq_chip_data(data);
++ struct gpio_chip *gc = irq_data_get_irq_chip_data(data);
++ struct tegra_gpio *gpio = to_tegra_gpio(gc);
+ void __iomem *base;
+
+ base = tegra186_gpio_get_base(gpio, data->hwirq);
+@@ -251,7 +254,8 @@ static void tegra186_irq_ack(struct irq_data *data)
+
+ static void tegra186_irq_mask(struct irq_data *data)
+ {
+- struct tegra_gpio *gpio = irq_data_get_irq_chip_data(data);
++ struct gpio_chip *gc = irq_data_get_irq_chip_data(data);
++ struct tegra_gpio *gpio = to_tegra_gpio(gc);
+ void __iomem *base;
+ u32 value;
+
+@@ -266,7 +270,8 @@ static void tegra186_irq_mask(struct irq_data *data)
+
+ static void tegra186_irq_unmask(struct irq_data *data)
+ {
+- struct tegra_gpio *gpio = irq_data_get_irq_chip_data(data);
++ struct gpio_chip *gc = irq_data_get_irq_chip_data(data);
++ struct tegra_gpio *gpio = to_tegra_gpio(gc);
+ void __iomem *base;
+ u32 value;
+
+@@ -281,7 +286,8 @@ static void tegra186_irq_unmask(struct irq_data *data)
+
+ static int tegra186_irq_set_type(struct irq_data *data, unsigned int flow)
+ {
+- struct tegra_gpio *gpio = irq_data_get_irq_chip_data(data);
++ struct gpio_chip *gc = irq_data_get_irq_chip_data(data);
++ struct tegra_gpio *gpio = to_tegra_gpio(gc);
+ void __iomem *base;
+ u32 value;
+
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 108f542176b86..5c049483de23c 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -4622,6 +4622,7 @@ u32 drm_add_display_info(struct drm_connector *connector, const struct edid *edi
+ if (!(edid->input & DRM_EDID_INPUT_DIGITAL))
+ return quirks;
+
++ info->color_formats |= DRM_COLOR_FORMAT_RGB444;
+ drm_parse_cea_ext(connector, edid);
+
+ /*
+@@ -4670,7 +4671,6 @@ u32 drm_add_display_info(struct drm_connector *connector, const struct edid *edi
+ DRM_DEBUG("%s: Assigning EDID-1.4 digital sink color depth as %d bpc.\n",
+ connector->name, info->bpc);
+
+- info->color_formats |= DRM_COLOR_FORMAT_RGB444;
+ if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB444)
+ info->color_formats |= DRM_COLOR_FORMAT_YCRCB444;
+ if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB422)
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c
+index 8cf3d1b4662de..ce70a193caa7f 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c
+@@ -70,13 +70,20 @@ nvkm_pmu_fini(struct nvkm_subdev *subdev, bool suspend)
+ return 0;
+ }
+
+-static void
++static int
+ nvkm_pmu_reset(struct nvkm_pmu *pmu)
+ {
+ struct nvkm_device *device = pmu->subdev.device;
+
+ if (!pmu->func->enabled(pmu))
+- return;
++ return 0;
++
++ /* Inhibit interrupts, and wait for idle. */
++ nvkm_wr32(device, 0x10a014, 0x0000ffff);
++ nvkm_msec(device, 2000,
++ if (!nvkm_rd32(device, 0x10a04c))
++ break;
++ );
+
+ /* Reset. */
+ if (pmu->func->reset)
+@@ -87,37 +94,25 @@ nvkm_pmu_reset(struct nvkm_pmu *pmu)
+ if (!(nvkm_rd32(device, 0x10a10c) & 0x00000006))
+ break;
+ );
++
++ return 0;
+ }
+
+ static int
+ nvkm_pmu_preinit(struct nvkm_subdev *subdev)
+ {
+ struct nvkm_pmu *pmu = nvkm_pmu(subdev);
+- nvkm_pmu_reset(pmu);
+- return 0;
++ return nvkm_pmu_reset(pmu);
+ }
+
+ static int
+ nvkm_pmu_init(struct nvkm_subdev *subdev)
+ {
+ struct nvkm_pmu *pmu = nvkm_pmu(subdev);
+- struct nvkm_device *device = pmu->subdev.device;
+-
+- if (!pmu->func->init)
+- return 0;
+-
+- if (pmu->func->enabled(pmu)) {
+- /* Inhibit interrupts, and wait for idle. */
+- nvkm_wr32(device, 0x10a014, 0x0000ffff);
+- nvkm_msec(device, 2000,
+- if (!nvkm_rd32(device, 0x10a04c))
+- break;
+- );
+-
+- nvkm_pmu_reset(pmu);
+- }
+-
+- return pmu->func->init(pmu);
++ int ret = nvkm_pmu_reset(pmu);
++ if (ret == 0 && pmu->func->init)
++ ret = pmu->func->init(pmu);
++ return ret;
+ }
+
+ static int
+diff --git a/drivers/iio/adc/men_z188_adc.c b/drivers/iio/adc/men_z188_adc.c
+index c80261748d8fd..49827bb648971 100644
+--- a/drivers/iio/adc/men_z188_adc.c
++++ b/drivers/iio/adc/men_z188_adc.c
+@@ -106,6 +106,7 @@ static int men_z188_probe(struct mcb_device *dev,
+ struct z188_adc *adc;
+ struct iio_dev *indio_dev;
+ struct resource *mem;
++ int ret;
+
+ indio_dev = devm_iio_device_alloc(&dev->dev, sizeof(struct z188_adc));
+ if (!indio_dev)
+@@ -132,8 +133,14 @@ static int men_z188_probe(struct mcb_device *dev,
+ adc->mem = mem;
+ mcb_set_drvdata(dev, indio_dev);
+
+- return iio_device_register(indio_dev);
++ ret = iio_device_register(indio_dev);
++ if (ret)
++ goto err_unmap;
++
++ return 0;
+
++err_unmap:
++ iounmap(adc->base);
+ err:
+ mcb_release_mem(mem);
+ return -ENXIO;
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 03ee53adaacd2..6dcdc42ed0819 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -4154,9 +4154,11 @@ static void srp_remove_one(struct ib_device *device, void *client_data)
+ spin_unlock(&host->target_lock);
+
+ /*
+- * Wait for tl_err and target port removal tasks.
++ * srp_queue_remove_work() queues a call to
++ * srp_remove_target(). The latter function cancels
++ * target->tl_err_work so waiting for the remove works to
++ * finish is sufficient.
+ */
+- flush_workqueue(system_long_wq);
+ flush_workqueue(srp_remove_wq);
+
+ kfree(host);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 3d824c20d2a46..a5c4e4f0f5b6a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1357,7 +1357,7 @@ static int mlx5e_get_module_eeprom(struct net_device *netdev,
+ if (size_read < 0) {
+ netdev_err(priv->netdev, "%s: mlx5_query_eeprom failed:0x%x\n",
+ __func__, size_read);
+- return 0;
++ return size_read;
+ }
+
+ i += size_read;
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 529c8fac15314..778bd9aaba9f1 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -584,6 +584,11 @@ static const struct usb_device_id products[] = {
+ .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET, \
+ .bInterfaceProtocol = USB_CDC_PROTO_NONE
+
++#define ZAURUS_FAKE_INTERFACE \
++ .bInterfaceClass = USB_CLASS_COMM, \
++ .bInterfaceSubClass = USB_CDC_SUBCLASS_MDLM, \
++ .bInterfaceProtocol = USB_CDC_PROTO_NONE
++
+ /* SA-1100 based Sharp Zaurus ("collie"), or compatible;
+ * wire-incompatible with true CDC Ethernet implementations.
+ * (And, it seems, needlessly so...)
+@@ -637,6 +642,13 @@ static const struct usb_device_id products[] = {
+ .idProduct = 0x9032, /* SL-6000 */
+ ZAURUS_MASTER_INTERFACE,
+ .driver_info = 0,
++}, {
++ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
++ | USB_DEVICE_ID_MATCH_DEVICE,
++ .idVendor = 0x04DD,
++ .idProduct = 0x9032, /* SL-6000 */
++ ZAURUS_FAKE_INTERFACE,
++ .driver_info = 0,
+ }, {
+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
+ | USB_DEVICE_ID_MATCH_DEVICE,
+diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
+index 6ac232e52bf7c..83640628c47dd 100644
+--- a/drivers/net/usb/sr9700.c
++++ b/drivers/net/usb/sr9700.c
+@@ -410,7 +410,7 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ /* ignore the CRC length */
+ len = (skb->data[1] | (skb->data[2] << 8)) - 4;
+
+- if (len > ETH_FRAME_LEN)
++ if (len > ETH_FRAME_LEN || len > skb->len)
+ return 0;
+
+ /* the last packet of current skb */
+diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
+index 9c2196c3fd113..1f19fc5e6117e 100644
+--- a/drivers/net/usb/zaurus.c
++++ b/drivers/net/usb/zaurus.c
+@@ -268,6 +268,11 @@ static const struct usb_device_id products [] = {
+ .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET, \
+ .bInterfaceProtocol = USB_CDC_PROTO_NONE
+
++#define ZAURUS_FAKE_INTERFACE \
++ .bInterfaceClass = USB_CLASS_COMM, \
++ .bInterfaceSubClass = USB_CDC_SUBCLASS_MDLM, \
++ .bInterfaceProtocol = USB_CDC_PROTO_NONE
++
+ /* SA-1100 based Sharp Zaurus ("collie"), or compatible. */
+ {
+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
+@@ -325,6 +330,13 @@ static const struct usb_device_id products [] = {
+ .idProduct = 0x9032, /* SL-6000 */
+ ZAURUS_MASTER_INTERFACE,
+ .driver_info = ZAURUS_PXA_INFO,
++}, {
++ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
++ | USB_DEVICE_ID_MATCH_DEVICE,
++ .idVendor = 0x04DD,
++ .idProduct = 0x9032, /* SL-6000 */
++ ZAURUS_FAKE_INTERFACE,
++ .driver_info = (unsigned long)&bogus_mdlm_info,
+ }, {
+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
+ | USB_DEVICE_ID_MATCH_DEVICE,
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 294182cb71caf..4d581140b7a47 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -428,7 +428,7 @@ static u8 gsm_encode_modem(const struct gsm_dlci *dlci)
+ modembits |= MDM_RTR;
+ if (dlci->modem_tx & TIOCM_RI)
+ modembits |= MDM_IC;
+- if (dlci->modem_tx & TIOCM_CD)
++ if (dlci->modem_tx & TIOCM_CD || dlci->gsm->initiator)
+ modembits |= MDM_DV;
+ return modembits;
+ }
+@@ -1490,7 +1490,7 @@ static void gsm_dlci_t1(struct timer_list *t)
+ dlci->mode = DLCI_MODE_ADM;
+ gsm_dlci_open(dlci);
+ } else {
+- gsm_dlci_close(dlci);
++ gsm_dlci_begin_close(dlci); /* prevent half open link */
+ }
+
+ break;
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index bf40a2f36e976..ad2cb08b440fb 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -76,8 +76,8 @@ static const struct acpi_gpio_mapping acpi_dwc3_byt_gpios[] = {
+ static struct gpiod_lookup_table platform_bytcr_gpios = {
+ .dev_id = "0000:00:16.0",
+ .table = {
+- GPIO_LOOKUP("INT33FC:00", 54, "reset", GPIO_ACTIVE_HIGH),
+- GPIO_LOOKUP("INT33FC:02", 14, "cs", GPIO_ACTIVE_HIGH),
++ GPIO_LOOKUP("INT33FC:00", 54, "cs", GPIO_ACTIVE_HIGH),
++ GPIO_LOOKUP("INT33FC:02", 14, "reset", GPIO_ACTIVE_HIGH),
+ {}
+ },
+ };
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index e7c753fbfbb04..8620ac8e33296 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3181,9 +3181,11 @@ static irqreturn_t dwc3_thread_interrupt(int irq, void *_evt)
+ unsigned long flags;
+ irqreturn_t ret = IRQ_NONE;
+
++ local_bh_disable();
+ spin_lock_irqsave(&dwc->lock, flags);
+ ret = dwc3_process_event_buf(evt);
+ spin_unlock_irqrestore(&dwc->lock, flags);
++ local_bh_enable();
+
+ return ret;
+ }
+diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
+index ab827c1badc50..970ed1514f0bc 100644
+--- a/drivers/usb/gadget/function/rndis.c
++++ b/drivers/usb/gadget/function/rndis.c
+@@ -922,6 +922,7 @@ struct rndis_params *rndis_register(void (*resp_avail)(void *v), void *v)
+ params->resp_avail = resp_avail;
+ params->v = v;
+ INIT_LIST_HEAD(¶ms->resp_queue);
++ spin_lock_init(¶ms->resp_lock);
+ pr_debug("%s: configNr = %d\n", __func__, i);
+
+ return params;
+@@ -1015,12 +1016,14 @@ void rndis_free_response(struct rndis_params *params, u8 *buf)
+ {
+ rndis_resp_t *r, *n;
+
++ spin_lock(¶ms->resp_lock);
+ list_for_each_entry_safe(r, n, ¶ms->resp_queue, list) {
+ if (r->buf == buf) {
+ list_del(&r->list);
+ kfree(r);
+ }
+ }
++ spin_unlock(¶ms->resp_lock);
+ }
+ EXPORT_SYMBOL_GPL(rndis_free_response);
+
+@@ -1030,14 +1033,17 @@ u8 *rndis_get_next_response(struct rndis_params *params, u32 *length)
+
+ if (!length) return NULL;
+
++ spin_lock(¶ms->resp_lock);
+ list_for_each_entry_safe(r, n, ¶ms->resp_queue, list) {
+ if (!r->send) {
+ r->send = 1;
+ *length = r->length;
++ spin_unlock(¶ms->resp_lock);
+ return r->buf;
+ }
+ }
+
++ spin_unlock(¶ms->resp_lock);
+ return NULL;
+ }
+ EXPORT_SYMBOL_GPL(rndis_get_next_response);
+@@ -1054,7 +1060,9 @@ static rndis_resp_t *rndis_add_response(struct rndis_params *params, u32 length)
+ r->length = length;
+ r->send = 0;
+
++ spin_lock(¶ms->resp_lock);
+ list_add_tail(&r->list, ¶ms->resp_queue);
++ spin_unlock(¶ms->resp_lock);
+ return r;
+ }
+
+diff --git a/drivers/usb/gadget/function/rndis.h b/drivers/usb/gadget/function/rndis.h
+index c7e3a70ce6c1f..c996ba28bcb77 100644
+--- a/drivers/usb/gadget/function/rndis.h
++++ b/drivers/usb/gadget/function/rndis.h
+@@ -174,6 +174,7 @@ typedef struct rndis_params {
+ void (*resp_avail)(void *v);
+ void *v;
+ struct list_head resp_queue;
++ spinlock_t resp_lock;
+ } rndis_params;
+
+ /* RNDIS Message parser and other useless functions */
+diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c
+index 6407e433bc78d..72f1bc6a680e3 100644
+--- a/drivers/usb/gadget/udc/udc-xilinx.c
++++ b/drivers/usb/gadget/udc/udc-xilinx.c
+@@ -1613,6 +1613,8 @@ static void xudc_getstatus(struct xusb_udc *udc)
+ break;
+ case USB_RECIP_ENDPOINT:
+ epnum = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;
++ if (epnum >= XUSB_MAX_ENDPOINTS)
++ goto stall;
+ target_ep = &udc->ep[epnum];
+ epcfgreg = udc->read_fn(udc->addr + target_ep->offset);
+ halt = epcfgreg & XUSB_EP_CFG_STALL_MASK;
+@@ -1680,6 +1682,10 @@ static void xudc_set_clear_feature(struct xusb_udc *udc)
+ case USB_RECIP_ENDPOINT:
+ if (!udc->setup.wValue) {
+ endpoint = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;
++ if (endpoint >= XUSB_MAX_ENDPOINTS) {
++ xudc_ep0_stall(udc);
++ return;
++ }
+ target_ep = &udc->ep[endpoint];
+ outinbit = udc->setup.wIndex & USB_ENDPOINT_DIR_MASK;
+ outinbit = outinbit >> 7;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 0c2b726b7797c..353a57f515223 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1083,6 +1083,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ int retval = 0;
+ bool comp_timer_running = false;
+ bool pending_portevent = false;
++ bool reinit_xhc = false;
+
+ if (!hcd->state)
+ return 0;
+@@ -1099,10 +1100,11 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
+
+ spin_lock_irq(&xhci->lock);
+- if ((xhci->quirks & XHCI_RESET_ON_RESUME) || xhci->broken_suspend)
+- hibernated = true;
+
+- if (!hibernated) {
++ if (hibernated || xhci->quirks & XHCI_RESET_ON_RESUME || xhci->broken_suspend)
++ reinit_xhc = true;
++
++ if (!reinit_xhc) {
+ /*
+ * Some controllers might lose power during suspend, so wait
+ * for controller not ready bit to clear, just as in xHC init.
+@@ -1135,12 +1137,17 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ spin_unlock_irq(&xhci->lock);
+ return -ETIMEDOUT;
+ }
+- temp = readl(&xhci->op_regs->status);
+ }
+
+- /* If restore operation fails, re-initialize the HC during resume */
+- if ((temp & STS_SRE) || hibernated) {
++ temp = readl(&xhci->op_regs->status);
+
++ /* re-initialize the HC on Restore Error, or Host Controller Error */
++ if (temp & (STS_SRE | STS_HCE)) {
++ reinit_xhc = true;
++ xhci_warn(xhci, "xHC error in resume, USBSTS 0x%x, Reinit\n", temp);
++ }
++
++ if (reinit_xhc) {
+ if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+ !(xhci_all_ports_seen_u0(xhci))) {
+ del_timer_sync(&xhci->comp_mode_recovery_timer);
+@@ -1457,9 +1464,12 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ struct urb_priv *urb_priv;
+ int num_tds;
+
+- if (!urb || xhci_check_args(hcd, urb->dev, urb->ep,
+- true, true, __func__) <= 0)
++ if (!urb)
+ return -EINVAL;
++ ret = xhci_check_args(hcd, urb->dev, urb->ep,
++ true, true, __func__);
++ if (ret <= 0)
++ return ret ? ret : -EINVAL;
+
+ slot_id = urb->dev->slot_id;
+ ep_index = xhci_get_endpoint_index(&urb->ep->desc);
+@@ -3203,7 +3213,7 @@ static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
+ return -EINVAL;
+ ret = xhci_check_args(xhci_to_hcd(xhci), udev, ep, 1, true, __func__);
+ if (ret <= 0)
+- return -EINVAL;
++ return ret ? ret : -EINVAL;
+ if (usb_ss_max_streams(&ep->ss_ep_comp) == 0) {
+ xhci_warn(xhci, "WARN: SuperSpeed Endpoint Companion"
+ " descriptor for ep 0x%x does not support streams\n",
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index c56e4ce2d6516..f789b60ed8c17 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -80,7 +80,6 @@
+ #define CH341_LCR_CS5 0x00
+
+ static const struct usb_device_id id_table[] = {
+- { USB_DEVICE(0x1a86, 0x5512) },
+ { USB_DEVICE(0x1a86, 0x5523) },
+ { USB_DEVICE(0x1a86, 0x7522) },
+ { USB_DEVICE(0x1a86, 0x7523) },
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 151d6601f1c18..37d3bc24c5cff 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -198,6 +198,8 @@ static void option_instat_callback(struct urb *urb);
+
+ #define DELL_PRODUCT_5821E 0x81d7
+ #define DELL_PRODUCT_5821E_ESIM 0x81e0
++#define DELL_PRODUCT_5829E_ESIM 0x81e4
++#define DELL_PRODUCT_5829E 0x81e6
+
+ #define KYOCERA_VENDOR_ID 0x0c88
+ #define KYOCERA_PRODUCT_KPC650 0x17da
+@@ -1063,6 +1065,10 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E_ESIM),
+ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
++ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E),
++ .driver_info = RSVD(0) | RSVD(6) },
++ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E_ESIM),
++ .driver_info = RSVD(0) | RSVD(6) },
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
+ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
+@@ -1273,10 +1279,16 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(2) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */
+ .driver_info = NCTRL(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701a, 0xff), /* Telit LE910R1 (RNDIS) */
++ .driver_info = NCTRL(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff), /* Telit LE910R1 (ECM) */
++ .driver_info = NCTRL(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */
+ .driver_info = NCTRL(0) | ZLP },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */
+ .driver_info = NCTRL(0) | ZLP },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9201), /* Telit LE910R1 flashing device */
++ .driver_info = NCTRL(0) | ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) },
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index d61abf569dc1d..9f67717eaf453 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -569,16 +569,18 @@ err:
+ return ret;
+ }
+
+-static int vhost_vsock_stop(struct vhost_vsock *vsock)
++static int vhost_vsock_stop(struct vhost_vsock *vsock, bool check_owner)
+ {
+ size_t i;
+- int ret;
++ int ret = 0;
+
+ mutex_lock(&vsock->dev.mutex);
+
+- ret = vhost_dev_check_owner(&vsock->dev);
+- if (ret)
+- goto err;
++ if (check_owner) {
++ ret = vhost_dev_check_owner(&vsock->dev);
++ if (ret)
++ goto err;
++ }
+
+ for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) {
+ struct vhost_virtqueue *vq = &vsock->vqs[i];
+@@ -693,7 +695,12 @@ static int vhost_vsock_dev_release(struct inode *inode, struct file *file)
+ * inefficient. Room for improvement here. */
+ vsock_for_each_connected_socket(vhost_vsock_reset_orphans);
+
+- vhost_vsock_stop(vsock);
++ /* Don't check the owner, because we are in the release path, so we
++ * need to stop the vsock device in any case.
++ * vhost_vsock_stop() can not fail in this case, so we don't need to
++ * check the return code.
++ */
++ vhost_vsock_stop(vsock, false);
+ vhost_vsock_flush(vsock);
+ vhost_dev_stop(&vsock->dev);
+
+@@ -791,7 +798,7 @@ static long vhost_vsock_dev_ioctl(struct file *f, unsigned int ioctl,
+ if (start)
+ return vhost_vsock_start(vsock);
+ else
+- return vhost_vsock_stop(vsock);
++ return vhost_vsock_stop(vsock, true);
+ case VHOST_GET_FEATURES:
+ features = VHOST_VSOCK_FEATURES;
+ if (copy_to_user(argp, &features, sizeof(features)))
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index f9628fc20fec0..796a6cd5f302f 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -50,6 +50,14 @@ DECLARE_RWSEM(configfs_rename_sem);
+ */
+ DEFINE_SPINLOCK(configfs_dirent_lock);
+
++/*
++ * All of link_obj/unlink_obj/link_group/unlink_group require that
++ * subsys->su_mutex is held.
++ * But parent configfs_subsystem is NULL when config_item is root.
++ * Use this mutex when config_item is root.
++ */
++static DEFINE_MUTEX(configfs_subsystem_mutex);
++
+ static void configfs_d_iput(struct dentry * dentry,
+ struct inode * inode)
+ {
+@@ -1937,7 +1945,9 @@ int configfs_register_subsystem(struct configfs_subsystem *subsys)
+ group->cg_item.ci_name = group->cg_item.ci_namebuf;
+
+ sd = root->d_fsdata;
++ mutex_lock(&configfs_subsystem_mutex);
+ link_group(to_config_group(sd->s_element), group);
++ mutex_unlock(&configfs_subsystem_mutex);
+
+ inode_lock_nested(d_inode(root), I_MUTEX_PARENT);
+
+@@ -1962,7 +1972,9 @@ int configfs_register_subsystem(struct configfs_subsystem *subsys)
+ inode_unlock(d_inode(root));
+
+ if (err) {
++ mutex_lock(&configfs_subsystem_mutex);
+ unlink_group(group);
++ mutex_unlock(&configfs_subsystem_mutex);
+ configfs_release_fs();
+ }
+ put_fragment(frag);
+@@ -2008,7 +2020,9 @@ void configfs_unregister_subsystem(struct configfs_subsystem *subsys)
+
+ dput(dentry);
+
++ mutex_lock(&configfs_subsystem_mutex);
+ unlink_group(group);
++ mutex_unlock(&configfs_subsystem_mutex);
+ configfs_release_fs();
+ }
+
+diff --git a/fs/file.c b/fs/file.c
+index 9a6a3bba53af1..d6ca500a10536 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -677,28 +677,69 @@ void do_close_on_exec(struct files_struct *files)
+ spin_unlock(&files->file_lock);
+ }
+
+-static struct file *__fget(unsigned int fd, fmode_t mask, unsigned int refs)
++static inline struct file *__fget_files_rcu(struct files_struct *files,
++ unsigned int fd, fmode_t mask, unsigned int refs)
+ {
+- struct files_struct *files = current->files;
+- struct file *file;
++ for (;;) {
++ struct file *file;
++ struct fdtable *fdt = rcu_dereference_raw(files->fdt);
++ struct file __rcu **fdentry;
+
+- rcu_read_lock();
+-loop:
+- file = fcheck_files(files, fd);
+- if (file) {
+- /* File object ref couldn't be taken.
+- * dup2() atomicity guarantee is the reason
+- * we loop to catch the new file (or NULL pointer)
++ if (unlikely(fd >= fdt->max_fds))
++ return NULL;
++
++ fdentry = fdt->fd + array_index_nospec(fd, fdt->max_fds);
++ file = rcu_dereference_raw(*fdentry);
++ if (unlikely(!file))
++ return NULL;
++
++ if (unlikely(file->f_mode & mask))
++ return NULL;
++
++ /*
++ * Ok, we have a file pointer. However, because we do
++ * this all locklessly under RCU, we may be racing with
++ * that file being closed.
++ *
++ * Such a race can take two forms:
++ *
++ * (a) the file ref already went down to zero,
++ * and get_file_rcu_many() fails. Just try
++ * again:
++ */
++ if (unlikely(!get_file_rcu_many(file, refs)))
++ continue;
++
++ /*
++ * (b) the file table entry has changed under us.
++ * Note that we don't need to re-check the 'fdt->fd'
++ * pointer having changed, because it always goes
++ * hand-in-hand with 'fdt'.
++ *
++ * If so, we need to put our refs and try again.
+ */
+- if (file->f_mode & mask)
+- file = NULL;
+- else if (!get_file_rcu_many(file, refs))
+- goto loop;
+- else if (__fcheck_files(files, fd) != file) {
++ if (unlikely(rcu_dereference_raw(files->fdt) != fdt) ||
++ unlikely(rcu_dereference_raw(*fdentry) != file)) {
+ fput_many(file, refs);
+- goto loop;
++ continue;
+ }
++
++ /*
++ * Ok, we have a ref to the file, and checked that it
++ * still exists.
++ */
++ return file;
+ }
++}
++
++
++static struct file *__fget(unsigned int fd, fmode_t mask, unsigned int refs)
++{
++ struct files_struct *files = current->files;
++ struct file *file;
++
++ rcu_read_lock();
++ file = __fget_files_rcu(files, fd, mask, refs);
+ rcu_read_unlock();
+
+ return file;
+diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
+index 8834819c0791b..01b0eec4140d4 100644
+--- a/fs/tracefs/inode.c
++++ b/fs/tracefs/inode.c
+@@ -265,7 +265,6 @@ static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts)
+ if (!gid_valid(gid))
+ return -EINVAL;
+ opts->gid = gid;
+- set_gid(tracefs_mount->mnt_root, gid);
+ break;
+ case Opt_mode:
+ if (match_octal(&args[0], &option))
+@@ -292,7 +291,9 @@ static int tracefs_apply_options(struct super_block *sb)
+ inode->i_mode |= opts->mode;
+
+ inode->i_uid = opts->uid;
+- inode->i_gid = opts->gid;
++
++ /* Set all the group ids to the mount option */
++ set_gid(sb->s_root, opts->gid);
+
+ return 0;
+ }
+diff --git a/include/net/checksum.h b/include/net/checksum.h
+index aef2b2bb6603f..051307cc877f3 100644
+--- a/include/net/checksum.h
++++ b/include/net/checksum.h
+@@ -143,6 +143,11 @@ static inline void csum_replace2(__sum16 *sum, __be16 old, __be16 new)
+ *sum = ~csum16_add(csum16_sub(~(*sum), old), new);
+ }
+
++static inline void csum_replace(__wsum *csum, __wsum old, __wsum new)
++{
++ *csum = csum_add(csum_sub(*csum, old), new);
++}
++
+ struct sk_buff;
+ void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
+ __be32 from, __be32 to, bool pseudohdr);
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index ff956ccbb6dfb..d43d25acc95ad 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -1528,6 +1528,7 @@ static void cpuset_attach(struct cgroup_taskset *tset)
+ cgroup_taskset_first(tset, &css);
+ cs = css_cs(css);
+
++ cpus_read_lock();
+ mutex_lock(&cpuset_mutex);
+
+ /* prepare for attach */
+@@ -1583,6 +1584,7 @@ static void cpuset_attach(struct cgroup_taskset *tset)
+ wake_up(&cpuset_attach_wq);
+
+ mutex_unlock(&cpuset_mutex);
++ cpus_read_unlock();
+ }
+
+ /* The various types of files and directories in a cpuset file system */
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index 0c3b1551cfca2..32e573c42a68c 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -933,6 +933,16 @@ static void
+ traceon_trigger(struct event_trigger_data *data, void *rec,
+ struct ring_buffer_event *event)
+ {
++ struct trace_event_file *file = data->private_data;
++
++ if (file) {
++ if (tracer_tracing_is_on(file->tr))
++ return;
++
++ tracer_tracing_on(file->tr);
++ return;
++ }
++
+ if (tracing_is_on())
+ return;
+
+@@ -943,8 +953,15 @@ static void
+ traceon_count_trigger(struct event_trigger_data *data, void *rec,
+ struct ring_buffer_event *event)
+ {
+- if (tracing_is_on())
+- return;
++ struct trace_event_file *file = data->private_data;
++
++ if (file) {
++ if (tracer_tracing_is_on(file->tr))
++ return;
++ } else {
++ if (tracing_is_on())
++ return;
++ }
+
+ if (!data->count)
+ return;
+@@ -952,13 +969,26 @@ traceon_count_trigger(struct event_trigger_data *data, void *rec,
+ if (data->count != -1)
+ (data->count)--;
+
+- tracing_on();
++ if (file)
++ tracer_tracing_on(file->tr);
++ else
++ tracing_on();
+ }
+
+ static void
+ traceoff_trigger(struct event_trigger_data *data, void *rec,
+ struct ring_buffer_event *event)
+ {
++ struct trace_event_file *file = data->private_data;
++
++ if (file) {
++ if (!tracer_tracing_is_on(file->tr))
++ return;
++
++ tracer_tracing_off(file->tr);
++ return;
++ }
++
+ if (!tracing_is_on())
+ return;
+
+@@ -969,8 +999,15 @@ static void
+ traceoff_count_trigger(struct event_trigger_data *data, void *rec,
+ struct ring_buffer_event *event)
+ {
+- if (!tracing_is_on())
+- return;
++ struct trace_event_file *file = data->private_data;
++
++ if (file) {
++ if (!tracer_tracing_is_on(file->tr))
++ return;
++ } else {
++ if (!tracing_is_on())
++ return;
++ }
+
+ if (!data->count)
+ return;
+@@ -978,7 +1015,10 @@ traceoff_count_trigger(struct event_trigger_data *data, void *rec,
+ if (data->count != -1)
+ (data->count)--;
+
+- tracing_off();
++ if (file)
++ tracer_tracing_off(file->tr);
++ else
++ tracing_off();
+ }
+
+ static int
+diff --git a/mm/memblock.c b/mm/memblock.c
+index 4f7c5c3c442c3..4d471da3cc479 100644
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -322,14 +322,20 @@ void __init memblock_discard(void)
+ addr = __pa(memblock.reserved.regions);
+ size = PAGE_ALIGN(sizeof(struct memblock_region) *
+ memblock.reserved.max);
+- __memblock_free_late(addr, size);
++ if (memblock_reserved_in_slab)
++ kfree(memblock.reserved.regions);
++ else
++ __memblock_free_late(addr, size);
+ }
+
+ if (memblock.memory.regions != memblock_memory_init_regions) {
+ addr = __pa(memblock.memory.regions);
+ size = PAGE_ALIGN(sizeof(struct memblock_region) *
+ memblock.memory.max);
+- __memblock_free_late(addr, size);
++ if (memblock_memory_in_slab)
++ kfree(memblock.memory.regions);
++ else
++ __memblock_free_late(addr, size);
+ }
+ }
+ #endif
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index e1daab49b0eb0..c623c129d0ab6 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -1977,7 +1977,7 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta)
+ /* Free pulled out fragments. */
+ while ((list = skb_shinfo(skb)->frag_list) != insp) {
+ skb_shinfo(skb)->frag_list = list->next;
+- kfree_skb(list);
++ consume_skb(list);
+ }
+ /* And insert new clone at head. */
+ if (clone) {
+@@ -5482,7 +5482,7 @@ static int pskb_carve_frag_list(struct sk_buff *skb,
+ /* Free pulled out fragments. */
+ while ((list = shinfo->frag_list) != insp) {
+ shinfo->frag_list = list->next;
+- kfree_skb(list);
++ consume_skb(list);
+ }
+ /* And insert new clone at head. */
+ if (clone) {
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 713eea9affaad..d8c22246629a6 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1338,8 +1338,11 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
+ }
+
+ ops = rcu_dereference(inet_offloads[proto]);
+- if (likely(ops && ops->callbacks.gso_segment))
++ if (likely(ops && ops->callbacks.gso_segment)) {
+ segs = ops->callbacks.gso_segment(skb, features);
++ if (!segs)
++ skb->network_header = skb_mac_header(skb) + nhoff - skb->head;
++ }
+
+ if (IS_ERR_OR_NULL(segs))
+ goto out;
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 28d171e6e10b9..b068eb01fe993 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -192,7 +192,6 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
+ (int)ident, &ipv6_hdr(skb)->daddr, dif);
+ #endif
+ } else {
+- pr_err("ping: protocol(%x) is not supported\n", ntohs(skb->protocol));
+ return NULL;
+ }
+
+diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
+index c7e495f120110..6c47cd0ef2401 100644
+--- a/net/ipv6/ip6_offload.c
++++ b/net/ipv6/ip6_offload.c
+@@ -98,6 +98,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
+ if (likely(ops && ops->callbacks.gso_segment)) {
+ skb_reset_transport_header(skb);
+ segs = ops->callbacks.gso_segment(skb, features);
++ if (!segs)
++ skb->network_header = skb_mac_header(skb) + nhoff - skb->head;
+ }
+
+ if (IS_ERR_OR_NULL(segs))
+diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
+index 849fcf973c74b..100cc09c100d9 100644
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -493,12 +493,43 @@ static void set_ipv6_addr(struct sk_buff *skb, u8 l4_proto,
+ memcpy(addr, new_addr, sizeof(__be32[4]));
+ }
+
+-static void set_ipv6_fl(struct ipv6hdr *nh, u32 fl, u32 mask)
++static void set_ipv6_dsfield(struct sk_buff *skb, struct ipv6hdr *nh, u8 ipv6_tclass, u8 mask)
+ {
++ u8 old_ipv6_tclass = ipv6_get_dsfield(nh);
++
++ ipv6_tclass = OVS_MASKED(old_ipv6_tclass, ipv6_tclass, mask);
++
++ if (skb->ip_summed == CHECKSUM_COMPLETE)
++ csum_replace(&skb->csum, (__force __wsum)(old_ipv6_tclass << 12),
++ (__force __wsum)(ipv6_tclass << 12));
++
++ ipv6_change_dsfield(nh, ~mask, ipv6_tclass);
++}
++
++static void set_ipv6_fl(struct sk_buff *skb, struct ipv6hdr *nh, u32 fl, u32 mask)
++{
++ u32 ofl;
++
++ ofl = nh->flow_lbl[0] << 16 | nh->flow_lbl[1] << 8 | nh->flow_lbl[2];
++ fl = OVS_MASKED(ofl, fl, mask);
++
+ /* Bits 21-24 are always unmasked, so this retains their values. */
+- OVS_SET_MASKED(nh->flow_lbl[0], (u8)(fl >> 16), (u8)(mask >> 16));
+- OVS_SET_MASKED(nh->flow_lbl[1], (u8)(fl >> 8), (u8)(mask >> 8));
+- OVS_SET_MASKED(nh->flow_lbl[2], (u8)fl, (u8)mask);
++ nh->flow_lbl[0] = (u8)(fl >> 16);
++ nh->flow_lbl[1] = (u8)(fl >> 8);
++ nh->flow_lbl[2] = (u8)fl;
++
++ if (skb->ip_summed == CHECKSUM_COMPLETE)
++ csum_replace(&skb->csum, (__force __wsum)htonl(ofl), (__force __wsum)htonl(fl));
++}
++
++static void set_ipv6_ttl(struct sk_buff *skb, struct ipv6hdr *nh, u8 new_ttl, u8 mask)
++{
++ new_ttl = OVS_MASKED(nh->hop_limit, new_ttl, mask);
++
++ if (skb->ip_summed == CHECKSUM_COMPLETE)
++ csum_replace(&skb->csum, (__force __wsum)(nh->hop_limit << 8),
++ (__force __wsum)(new_ttl << 8));
++ nh->hop_limit = new_ttl;
+ }
+
+ static void set_ip_ttl(struct sk_buff *skb, struct iphdr *nh, u8 new_ttl,
+@@ -616,18 +647,17 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ }
+ }
+ if (mask->ipv6_tclass) {
+- ipv6_change_dsfield(nh, ~mask->ipv6_tclass, key->ipv6_tclass);
++ set_ipv6_dsfield(skb, nh, key->ipv6_tclass, mask->ipv6_tclass);
+ flow_key->ip.tos = ipv6_get_dsfield(nh);
+ }
+ if (mask->ipv6_label) {
+- set_ipv6_fl(nh, ntohl(key->ipv6_label),
++ set_ipv6_fl(skb, nh, ntohl(key->ipv6_label),
+ ntohl(mask->ipv6_label));
+ flow_key->ipv6.label =
+ *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL);
+ }
+ if (mask->ipv6_hlimit) {
+- OVS_SET_MASKED(nh->hop_limit, key->ipv6_hlimit,
+- mask->ipv6_hlimit);
++ set_ipv6_ttl(skb, nh, key->ipv6_hlimit, mask->ipv6_hlimit);
+ flow_key->ip.ttl = nh->hop_limit;
+ }
+ return 0;
+diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
+index 89993afe0fbd3..059ffb8b466a2 100644
+--- a/net/tipc/name_table.c
++++ b/net/tipc/name_table.c
+@@ -812,7 +812,7 @@ static int __tipc_nl_add_nametable_publ(struct tipc_nl_msg *msg,
+ list_for_each_entry(p, &sr->all_publ, all_publ)
+ if (p->key == *last_key)
+ break;
+- if (p->key != *last_key)
++ if (list_entry_is_head(p, &sr->all_publ, all_publ))
+ return -EPIPE;
+ } else {
+ p = list_first_entry(&sr->all_publ,
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 848ae6dcbd822..6c18b4565ab51 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -3487,7 +3487,7 @@ static int __tipc_nl_list_sk_publ(struct sk_buff *skb,
+ if (p->key == *last_publ)
+ break;
+ }
+- if (p->key != *last_publ) {
++ if (list_entry_is_head(p, &tsk->publications, binding_sock)) {
+ /* We never set seq or call nl_dump_check_consistent()
+ * this means that setting prev_seq here will cause the
+ * consistence check to fail in the netlink callback
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-03-08 18:30 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-03-08 18:30 UTC (permalink / raw
To: gentoo-commits
commit: cf41917205b59d283a0c79b5753fd1fa6a18b294
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 8 18:29:25 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Mar 8 18:29:25 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=cf419172
Linux patch 4.19.233
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1232_linux-4.19.233.patch | 1383 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1387 insertions(+)
diff --git a/0000_README b/0000_README
index a1760f41..4f185404 100644
--- a/0000_README
+++ b/0000_README
@@ -967,6 +967,10 @@ Patch: 1231_linux-4.19.232.patch
From: https://www.kernel.org
Desc: Linux 4.19.232
+Patch: 1232_linux-4.19.233.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.233
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1232_linux-4.19.233.patch b/1232_linux-4.19.233.patch
new file mode 100644
index 00000000..43350a55
--- /dev/null
+++ b/1232_linux-4.19.233.patch
@@ -0,0 +1,1383 @@
+diff --git a/Makefile b/Makefile
+index 77a389ab3538c..c93bacac07957 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 232
++SUBLEVEL = 233
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
+index 4c417f3cbfd52..8073e7823c252 100644
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -230,12 +230,14 @@ early_param("ecc", early_ecc);
+ static int __init early_cachepolicy(char *p)
+ {
+ pr_warn("cachepolicy kernel parameter not supported without cp15\n");
++ return 0;
+ }
+ early_param("cachepolicy", early_cachepolicy);
+
+ static int __init noalign_setup(char *__unused)
+ {
+ pr_warn("noalign kernel parameter not supported without cp15\n");
++ return 1;
+ }
+ __setup("noalign", noalign_setup);
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
+index ca07f60322003..873e54f3ed61e 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi
+@@ -287,7 +287,7 @@
+
+ sound: sound {
+ compatible = "rockchip,rk3399-gru-sound";
+- rockchip,cpu = <&i2s0 &i2s2>;
++ rockchip,cpu = <&i2s0 &spdif>;
+ };
+ };
+
+@@ -438,10 +438,6 @@ ap_i2c_audio: &i2c8 {
+ status = "okay";
+ };
+
+-&i2s2 {
+- status = "okay";
+-};
+-
+ &io_domains {
+ status = "okay";
+
+@@ -538,6 +534,17 @@ ap_i2c_audio: &i2c8 {
+ vqmmc-supply = <&ppvar_sd_card_io>;
+ };
+
++&spdif {
++ status = "okay";
++
++ /*
++ * SPDIF is routed internally to DP; we either don't use these pins, or
++ * mux them to something else.
++ */
++ /delete-property/ pinctrl-0;
++ /delete-property/ pinctrl-names;
++};
++
+ &spi1 {
+ status = "okay";
+
+diff --git a/block/blk-flush.c b/block/blk-flush.c
+index 256fa1ccc2bd6..dc71da0e6b0e1 100644
+--- a/block/blk-flush.c
++++ b/block/blk-flush.c
+@@ -239,8 +239,10 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error)
+ return;
+ }
+
+- if (fq->rq_status != BLK_STS_OK)
++ if (fq->rq_status != BLK_STS_OK) {
+ error = fq->rq_status;
++ fq->rq_status = BLK_STS_OK;
++ }
+
+ hctx = blk_mq_map_queue(q, flush_rq->mq_ctx->cpu);
+ if (!q->elevator) {
+diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
+index f44136a3a1635..c2ee0ba2fbc67 100644
+--- a/drivers/ata/pata_hpt37x.c
++++ b/drivers/ata/pata_hpt37x.c
+@@ -961,14 +961,14 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+
+ if ((freq >> 12) != 0xABCDE) {
+ int i;
+- u8 sr;
++ u16 sr;
+ u32 total = 0;
+
+ pr_warn("BIOS has not set timing clocks\n");
+
+ /* This is the process the HPT371 BIOS is reported to use */
+ for (i = 0; i < 128; i++) {
+- pci_read_config_byte(dev, 0x78, &sr);
++ pci_read_config_word(dev, 0x78, &sr);
+ total += sr & 0x1FF;
+ udelay(15);
+ }
+diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
+index 6b5626e299b22..419c841aef34d 100644
+--- a/drivers/dma/sh/shdma-base.c
++++ b/drivers/dma/sh/shdma-base.c
+@@ -118,8 +118,10 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
+ ret = pm_runtime_get(schan->dev);
+
+ spin_unlock_irq(&schan->chan_lock);
+- if (ret < 0)
++ if (ret < 0) {
+ dev_err(schan->dev, "%s(): GET = %d\n", __func__, ret);
++ pm_runtime_put(schan->dev);
++ }
+
+ pm_runtime_barrier(schan->dev);
+
+diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
+index af5139eb96b5d..e8cd66705ad7a 100644
+--- a/drivers/firmware/arm_scmi/driver.c
++++ b/drivers/firmware/arm_scmi/driver.c
+@@ -873,7 +873,7 @@ static struct platform_driver scmi_driver = {
+
+ module_platform_driver(scmi_driver);
+
+-MODULE_ALIAS("platform: arm-scmi");
++MODULE_ALIAS("platform:arm-scmi");
+ MODULE_AUTHOR("Sudeep Holla <sudeep.holla@arm.com>");
+ MODULE_DESCRIPTION("ARM SCMI protocol driver");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
+index fceaafd67ec61..e619ced030d52 100644
+--- a/drivers/firmware/efi/vars.c
++++ b/drivers/firmware/efi/vars.c
+@@ -763,6 +763,7 @@ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes,
+ {
+ const struct efivar_operations *ops;
+ efi_status_t status;
++ unsigned long varsize;
+
+ if (!__efivars)
+ return -EINVAL;
+@@ -785,15 +786,17 @@ int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes,
+ return efivar_entry_set_nonblocking(name, vendor, attributes,
+ size, data);
+
++ varsize = size + ucs2_strsize(name, 1024);
+ if (!block) {
+ if (down_trylock(&efivars_lock))
+ return -EBUSY;
++ status = check_var_size_nonblocking(attributes, varsize);
+ } else {
+ if (down_interruptible(&efivars_lock))
+ return -EINTR;
++ status = check_var_size(attributes, varsize);
+ }
+
+- status = check_var_size(attributes, size + ucs2_strsize(name, 1024));
+ if (status != EFI_SUCCESS) {
+ up(&efivars_lock);
+ return -ENOSPC;
+diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
+index a353a011fbdff..2abd30a4ff75d 100644
+--- a/drivers/hid/hid-debug.c
++++ b/drivers/hid/hid-debug.c
+@@ -835,7 +835,9 @@ static const char *keys[KEY_MAX + 1] = {
+ [KEY_F22] = "F22", [KEY_F23] = "F23",
+ [KEY_F24] = "F24", [KEY_PLAYCD] = "PlayCD",
+ [KEY_PAUSECD] = "PauseCD", [KEY_PROG3] = "Prog3",
+- [KEY_PROG4] = "Prog4", [KEY_SUSPEND] = "Suspend",
++ [KEY_PROG4] = "Prog4",
++ [KEY_ALL_APPLICATIONS] = "AllApplications",
++ [KEY_SUSPEND] = "Suspend",
+ [KEY_CLOSE] = "Close", [KEY_PLAY] = "Play",
+ [KEY_FASTFORWARD] = "FastForward", [KEY_BASSBOOST] = "BassBoost",
+ [KEY_PRINT] = "Print", [KEY_HP] = "HP",
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index dd3f4aa052980..145eda161b208 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -1037,6 +1037,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ case 0x28b: map_key_clear(KEY_FORWARDMAIL); break;
+ case 0x28c: map_key_clear(KEY_SEND); break;
+
++ case 0x2a2: map_key_clear(KEY_ALL_APPLICATIONS); break;
++
+ case 0x2c7: map_key_clear(KEY_KBDINPUTASSIST_PREV); break;
+ case 0x2c8: map_key_clear(KEY_KBDINPUTASSIST_NEXT); break;
+ case 0x2c9: map_key_clear(KEY_KBDINPUTASSIST_PREVGROUP); break;
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index 017aec34a238d..165c112bc5b9a 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -445,7 +445,7 @@ config I2C_BRCMSTB
+
+ config I2C_CADENCE
+ tristate "Cadence I2C Controller"
+- depends on ARCH_ZYNQ || ARM64 || XTENSA
++ depends on ARCH_ZYNQ || ARM64 || XTENSA || COMPILE_TEST
+ help
+ Say yes here to select Cadence I2C Host Controller. This controller is
+ e.g. used by Xilinx Zynq.
+@@ -849,7 +849,7 @@ config I2C_QCOM_GENI
+
+ config I2C_QUP
+ tristate "Qualcomm QUP based I2C controller"
+- depends on ARCH_QCOM
++ depends on ARCH_QCOM || COMPILE_TEST
+ help
+ If you say yes to this option, support will be included for the
+ built-in I2C interface on the Qualcomm SoCs.
+diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
+index 4d19254f78c8a..db1ab9ccc30e7 100644
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -28,6 +28,11 @@
+ #define BCM2835_I2C_FIFO 0x10
+ #define BCM2835_I2C_DIV 0x14
+ #define BCM2835_I2C_DEL 0x18
++/*
++ * 16-bit field for the number of SCL cycles to wait after rising SCL
++ * before deciding the slave is not responding. 0 disables the
++ * timeout detection.
++ */
+ #define BCM2835_I2C_CLKT 0x1c
+
+ #define BCM2835_I2C_C_READ BIT(0)
+@@ -398,6 +403,12 @@ static int bcm2835_i2c_probe(struct platform_device *pdev)
+ adap->dev.of_node = pdev->dev.of_node;
+ adap->quirks = &bcm2835_i2c_quirks;
+
++ /*
++ * Disable the hardware clock stretching timeout. SMBUS
++ * specifies a limit for how long the device can stretch the
++ * clock, but core I2C doesn't.
++ */
++ bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_CLKT, 0);
+ bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, 0);
+
+ ret = i2c_add_adapter(adap);
+diff --git a/drivers/input/input.c b/drivers/input/input.c
+index a0d90022fcf73..b031174c8d7f7 100644
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -2118,6 +2118,12 @@ int input_register_device(struct input_dev *dev)
+ /* KEY_RESERVED is not supposed to be transmitted to userspace. */
+ __clear_bit(KEY_RESERVED, dev->keybit);
+
++ /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */
++ if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) {
++ __clear_bit(BTN_RIGHT, dev->keybit);
++ __clear_bit(BTN_MIDDLE, dev->keybit);
++ }
++
+ /* Make sure that bitmasks not mentioned in dev->evbit are clean. */
+ input_cleanse_bitmasks(dev);
+
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index ae012639ae1d5..cb0314acdfbd0 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -140,55 +140,21 @@ static int elan_get_fwinfo(u16 ic_type, u16 *validpage_count,
+ return 0;
+ }
+
+-static int elan_enable_power(struct elan_tp_data *data)
++static int elan_set_power(struct elan_tp_data *data, bool on)
+ {
+ int repeat = ETP_RETRY_COUNT;
+ int error;
+
+- error = regulator_enable(data->vcc);
+- if (error) {
+- dev_err(&data->client->dev,
+- "failed to enable regulator: %d\n", error);
+- return error;
+- }
+-
+ do {
+- error = data->ops->power_control(data->client, true);
++ error = data->ops->power_control(data->client, on);
+ if (error >= 0)
+ return 0;
+
+ msleep(30);
+ } while (--repeat > 0);
+
+- dev_err(&data->client->dev, "failed to enable power: %d\n", error);
+- return error;
+-}
+-
+-static int elan_disable_power(struct elan_tp_data *data)
+-{
+- int repeat = ETP_RETRY_COUNT;
+- int error;
+-
+- do {
+- error = data->ops->power_control(data->client, false);
+- if (!error) {
+- error = regulator_disable(data->vcc);
+- if (error) {
+- dev_err(&data->client->dev,
+- "failed to disable regulator: %d\n",
+- error);
+- /* Attempt to power the chip back up */
+- data->ops->power_control(data->client, true);
+- break;
+- }
+-
+- return 0;
+- }
+-
+- msleep(30);
+- } while (--repeat > 0);
+-
+- dev_err(&data->client->dev, "failed to disable power: %d\n", error);
++ dev_err(&data->client->dev, "failed to set power %s: %d\n",
++ on ? "on" : "off", error);
+ return error;
+ }
+
+@@ -1291,9 +1257,19 @@ static int __maybe_unused elan_suspend(struct device *dev)
+ /* Enable wake from IRQ */
+ data->irq_wake = (enable_irq_wake(client->irq) == 0);
+ } else {
+- ret = elan_disable_power(data);
++ ret = elan_set_power(data, false);
++ if (ret)
++ goto err;
++
++ ret = regulator_disable(data->vcc);
++ if (ret) {
++ dev_err(dev, "error %d disabling regulator\n", ret);
++ /* Attempt to power the chip back up */
++ elan_set_power(data, true);
++ }
+ }
+
++err:
+ mutex_unlock(&data->sysfs_mutex);
+ return ret;
+ }
+@@ -1304,12 +1280,18 @@ static int __maybe_unused elan_resume(struct device *dev)
+ struct elan_tp_data *data = i2c_get_clientdata(client);
+ int error;
+
+- if (device_may_wakeup(dev) && data->irq_wake) {
++ if (!device_may_wakeup(dev)) {
++ error = regulator_enable(data->vcc);
++ if (error) {
++ dev_err(dev, "error %d enabling regulator\n", error);
++ goto err;
++ }
++ } else if (data->irq_wake) {
+ disable_irq_wake(client->irq);
+ data->irq_wake = false;
+ }
+
+- error = elan_enable_power(data);
++ error = elan_set_power(data, true);
+ if (error) {
+ dev_err(dev, "power up when resuming failed: %d\n", error);
+ goto err;
+diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
+index eb7f76753c9c0..9f44e2e458df1 100644
+--- a/drivers/net/arcnet/com20020-pci.c
++++ b/drivers/net/arcnet/com20020-pci.c
+@@ -136,6 +136,9 @@ static int com20020pci_probe(struct pci_dev *pdev,
+ return -ENOMEM;
+
+ ci = (struct com20020_pci_card_info *)id->driver_data;
++ if (!ci)
++ return -EINVAL;
++
+ priv->ci = ci;
+ mm = &ci->misc_map;
+
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index 8fa5836e54875..b2a187bf6c5e4 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -198,8 +198,8 @@ struct gs_can {
+ struct gs_usb {
+ struct gs_can *canch[GS_MAX_INTF];
+ struct usb_anchor rx_submitted;
+- atomic_t active_channels;
+ struct usb_device *udev;
++ u8 active_channels;
+ };
+
+ /* 'allocate' a tx context.
+@@ -596,7 +596,7 @@ static int gs_can_open(struct net_device *netdev)
+ if (rc)
+ return rc;
+
+- if (atomic_add_return(1, &parent->active_channels) == 1) {
++ if (!parent->active_channels) {
+ for (i = 0; i < GS_MAX_RX_URBS; i++) {
+ struct urb *urb;
+ u8 *buf;
+@@ -697,6 +697,7 @@ static int gs_can_open(struct net_device *netdev)
+
+ dev->can.state = CAN_STATE_ERROR_ACTIVE;
+
++ parent->active_channels++;
+ if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY))
+ netif_start_queue(netdev);
+
+@@ -712,7 +713,8 @@ static int gs_can_close(struct net_device *netdev)
+ netif_stop_queue(netdev);
+
+ /* Stop polling */
+- if (atomic_dec_and_test(&parent->active_channels))
++ parent->active_channels--;
++ if (!parent->active_channels)
+ usb_kill_anchored_urbs(&parent->rx_submitted);
+
+ /* Stop sending URBs */
+@@ -991,8 +993,6 @@ static int gs_usb_probe(struct usb_interface *intf,
+
+ init_usb_anchor(&dev->rx_submitted);
+
+- atomic_set(&dev->active_channels, 0);
+-
+ usb_set_intfdata(intf, dev);
+ dev->udev = interface_to_usbdev(intf);
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
+index 080918af773cd..cf563cdd0cb87 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
+@@ -3677,6 +3677,8 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
+ MAC_STATS_ACCUM_SECS : (MAC_STATS_ACCUM_SECS * 10);
+ adapter->params.pci.vpd_cap_addr =
+ pci_find_capability(adapter->pdev, PCI_CAP_ID_VPD);
++ if (!adapter->params.pci.vpd_cap_addr)
++ return -ENODEV;
+ ret = get_vpd_params(adapter, &adapter->params.vpd);
+ if (ret < 0)
+ return ret;
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index ffea634e03e8a..ae3eea4a4213e 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2100,8 +2100,10 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ * flush reset queue and process this reset
+ */
+ if (adapter->force_reset_recovery && !list_empty(&adapter->rwi_list)) {
+- list_for_each_safe(entry, tmp_entry, &adapter->rwi_list)
++ list_for_each_safe(entry, tmp_entry, &adapter->rwi_list) {
+ list_del(entry);
++ kfree(list_entry(entry, struct ibmvnic_rwi, list));
++ }
+ }
+ rwi->reset_reason = reason;
+ list_add_tail(&rwi->list, &adapter->rwi_list);
+diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+index 30cd087aa67c1..6eeddf6897704 100644
+--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
++++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+@@ -2280,18 +2280,18 @@ static int __init sxgbe_cmdline_opt(char *str)
+ char *opt;
+
+ if (!str || !*str)
+- return -EINVAL;
++ return 1;
+ while ((opt = strsep(&str, ",")) != NULL) {
+ if (!strncmp(opt, "eee_timer:", 10)) {
+ if (kstrtoint(opt + 10, 0, &eee_timer))
+ goto err;
+ }
+ }
+- return 0;
++ return 1;
+
+ err:
+ pr_err("%s: ERROR broken module parameter conversion\n", __func__);
+- return -EINVAL;
++ return 1;
+ }
+
+ __setup("sxgbeeth=", sxgbe_cmdline_opt);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 064e13bd2c8b5..0a4d093adfc93 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4628,7 +4628,7 @@ static int __init stmmac_cmdline_opt(char *str)
+ char *opt;
+
+ if (!str || !*str)
+- return -EINVAL;
++ return 1;
+ while ((opt = strsep(&str, ",")) != NULL) {
+ if (!strncmp(opt, "debug:", 6)) {
+ if (kstrtoint(opt + 6, 0, &debug))
+@@ -4659,11 +4659,11 @@ static int __init stmmac_cmdline_opt(char *str)
+ goto err;
+ }
+ }
+- return 0;
++ return 1;
+
+ err:
+ pr_err("%s: ERROR broken module parameter conversion", __func__);
+- return -EINVAL;
++ return 1;
+ }
+
+ __setup("stmmaceth=", stmmac_cmdline_opt);
+diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
+index ba0ca85e3d766..29a83fb769d82 100644
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -41,6 +41,8 @@
+
+ #define AX_MTU 236
+
++/* some arch define END as assembly function ending, just undef it */
++#undef END
+ /* SLIP/KISS protocol characters. */
+ #define END 0300 /* indicates end of frame */
+ #define ESC 0333 /* indicates byte stuffing */
+diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
+index cdd1b193fd4fe..41bac861ca99d 100644
+--- a/drivers/net/usb/cdc_mbim.c
++++ b/drivers/net/usb/cdc_mbim.c
+@@ -660,6 +660,11 @@ static const struct usb_device_id mbim_devs[] = {
+ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
+ },
+
++ /* Telit FN990 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1071, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
++ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
++ },
++
+ /* default entry */
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+ .driver_info = (unsigned long)&cdc_mbim_info_zlp,
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 3564f5869b444..c84ee5ba53812 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -2082,6 +2082,15 @@ static void hw_scan_work(struct work_struct *work)
+ if (req->ie_len)
+ skb_put_data(probe, req->ie, req->ie_len);
+
++ if (!ieee80211_tx_prepare_skb(hwsim->hw,
++ hwsim->hw_scan_vif,
++ probe,
++ hwsim->tmp_chan->band,
++ NULL)) {
++ kfree_skb(probe);
++ continue;
++ }
++
+ local_bh_disable();
+ mac80211_hwsim_tx_frame(hwsim->hw, probe,
+ hwsim->tmp_chan);
+@@ -3176,6 +3185,10 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
+ }
+ txi->flags |= IEEE80211_TX_STAT_ACK;
+ }
++
++ if (hwsim_flags & HWSIM_TX_CTL_NO_ACK)
++ txi->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
++
+ ieee80211_tx_status_irqsafe(data2->hw, skb);
+ return 0;
+ out:
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 0e357a022388a..7fb7c10ff9eb8 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -764,6 +764,28 @@ static int xennet_close(struct net_device *dev)
+ return 0;
+ }
+
++static void xennet_destroy_queues(struct netfront_info *info)
++{
++ unsigned int i;
++
++ for (i = 0; i < info->netdev->real_num_tx_queues; i++) {
++ struct netfront_queue *queue = &info->queues[i];
++
++ if (netif_running(info->netdev))
++ napi_disable(&queue->napi);
++ netif_napi_del(&queue->napi);
++ }
++
++ kfree(info->queues);
++ info->queues = NULL;
++}
++
++static void xennet_uninit(struct net_device *dev)
++{
++ struct netfront_info *np = netdev_priv(dev);
++ xennet_destroy_queues(np);
++}
++
+ static void xennet_set_rx_rsp_cons(struct netfront_queue *queue, RING_IDX val)
+ {
+ unsigned long flags;
+@@ -1376,6 +1398,7 @@ static void xennet_poll_controller(struct net_device *dev)
+ #endif
+
+ static const struct net_device_ops xennet_netdev_ops = {
++ .ndo_uninit = xennet_uninit,
+ .ndo_open = xennet_open,
+ .ndo_stop = xennet_close,
+ .ndo_start_xmit = xennet_start_xmit,
+@@ -1863,22 +1886,6 @@ error:
+ return err;
+ }
+
+-static void xennet_destroy_queues(struct netfront_info *info)
+-{
+- unsigned int i;
+-
+- for (i = 0; i < info->netdev->real_num_tx_queues; i++) {
+- struct netfront_queue *queue = &info->queues[i];
+-
+- if (netif_running(info->netdev))
+- napi_disable(&queue->napi);
+- netif_napi_del(&queue->napi);
+- }
+-
+- kfree(info->queues);
+- info->queues = NULL;
+-}
+-
+ static int xennet_create_queues(struct netfront_info *info,
+ unsigned int *num_queues)
+ {
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 005817e40ad39..53227232243f1 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -576,6 +576,8 @@ read_status:
+ */
+ if (ctrl->power_fault_detected)
+ status &= ~PCI_EXP_SLTSTA_PFD;
++ else if (status & PCI_EXP_SLTSTA_PFD)
++ ctrl->power_fault_detected = true;
+
+ events |= status;
+ if (!events) {
+@@ -585,7 +587,7 @@ read_status:
+ }
+
+ if (status) {
+- pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, events);
++ pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, status);
+
+ /*
+ * In MSI mode, all event bits must be zero before the port
+@@ -660,8 +662,7 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
+ }
+
+ /* Check Power Fault Detected */
+- if ((events & PCI_EXP_SLTSTA_PFD) && !ctrl->power_fault_detected) {
+- ctrl->power_fault_detected = 1;
++ if (events & PCI_EXP_SLTSTA_PFD) {
+ ctrl_err(ctrl, "Slot(%s): Power fault\n", slot_name(slot));
+ pciehp_set_attention_status(slot, 1);
+ pciehp_green_led_off(slot);
+diff --git a/drivers/soc/fsl/qe/qe_io.c b/drivers/soc/fsl/qe/qe_io.c
+index 7ae59abc78637..127a4a836e675 100644
+--- a/drivers/soc/fsl/qe/qe_io.c
++++ b/drivers/soc/fsl/qe/qe_io.c
+@@ -41,6 +41,8 @@ int par_io_init(struct device_node *np)
+ if (ret)
+ return ret;
+ par_io = ioremap(res.start, resource_size(&res));
++ if (!par_io)
++ return -ENOMEM;
+
+ num_ports = of_get_property(np, "num-ports", NULL);
+ if (num_ports)
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index a456267b6b784..3ebcbd199a791 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -1828,8 +1828,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+ spin_lock_irq (&dev->lock);
+ value = -EINVAL;
+ if (dev->buf) {
++ spin_unlock_irq(&dev->lock);
+ kfree(kbuf);
+- goto fail;
++ return value;
+ }
+ dev->buf = kbuf;
+
+@@ -1876,8 +1877,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+
+ value = usb_gadget_probe_driver(&gadgetfs_driver);
+ if (value != 0) {
+- kfree (dev->buf);
+- dev->buf = NULL;
++ spin_lock_irq(&dev->lock);
++ goto fail;
+ } else {
+ /* at this point "good" hardware has for the first time
+ * let the USB the host see us. alternatively, if users
+@@ -1894,6 +1895,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+ return value;
+
+ fail:
++ dev->config = NULL;
++ dev->hs_config = NULL;
++ dev->dev = NULL;
+ spin_unlock_irq (&dev->lock);
+ pr_debug ("%s: %s fail %zd, %p\n", shortname, __func__, value, dev);
+ kfree (dev->buf);
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 1f5facdd19dca..dba14bd8ce799 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1289,6 +1289,15 @@ again:
+ inode, name, namelen);
+ kfree(name);
+ iput(dir);
++ /*
++ * Whenever we need to check if a name exists or not, we
++ * check the subvolume tree. So after an unlink we must
++ * run delayed items, so that future checks for a name
++ * during log replay see that the name does not exists
++ * anymore.
++ */
++ if (!ret)
++ ret = btrfs_run_delayed_items(trans);
+ if (ret)
+ goto out;
+ goto again;
+@@ -1480,6 +1489,15 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
+ */
+ if (!ret && inode->i_nlink == 0)
+ inc_nlink(inode);
++ /*
++ * Whenever we need to check if a name exists or
++ * not, we check the subvolume tree. So after an
++ * unlink we must run delayed items, so that future
++ * checks for a name during log replay see that the
++ * name does not exists anymore.
++ */
++ if (!ret)
++ ret = btrfs_run_delayed_items(trans);
+ }
+ if (ret < 0)
+ goto out;
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index bc906fcf3f6db..baa1713d66958 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -779,6 +779,7 @@ cifs_smb3_do_mount(struct file_system_type *fs_type,
+
+ out_super:
+ deactivate_locked_super(sb);
++ return root;
+ out:
+ cifs_cleanup_volume_info(volume_info);
+ return root;
+diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
+index a50a69f5334c8..861414a62ce15 100644
+--- a/include/net/netfilter/nf_queue.h
++++ b/include/net/netfilter/nf_queue.h
+@@ -32,7 +32,7 @@ void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *q
+ void nf_unregister_queue_handler(struct net *net);
+ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);
+
+-void nf_queue_entry_get_refs(struct nf_queue_entry *entry);
++bool nf_queue_entry_get_refs(struct nf_queue_entry *entry);
+ void nf_queue_entry_release_refs(struct nf_queue_entry *entry);
+
+ static inline void init_hashrandom(u32 *jhash_initval)
+diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
+index c3e84f7c8261a..1c011379a9967 100644
+--- a/include/uapi/linux/input-event-codes.h
++++ b/include/uapi/linux/input-event-codes.h
+@@ -278,7 +278,8 @@
+ #define KEY_PAUSECD 201
+ #define KEY_PROG3 202
+ #define KEY_PROG4 203
+-#define KEY_DASHBOARD 204 /* AL Dashboard */
++#define KEY_ALL_APPLICATIONS 204 /* AC Desktop Show All Applications */
++#define KEY_DASHBOARD KEY_ALL_APPLICATIONS
+ #define KEY_SUSPEND 205
+ #define KEY_CLOSE 206 /* AC Close */
+ #define KEY_PLAY 207
+diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
+index ff7cfdc6cb44d..90a8f968af2f9 100644
+--- a/include/uapi/linux/xfrm.h
++++ b/include/uapi/linux/xfrm.h
+@@ -504,6 +504,12 @@ struct xfrm_user_offload {
+ int ifindex;
+ __u8 flags;
+ };
++/* This flag was exposed without any kernel code that supporting it.
++ * Unfortunately, strongswan has the code that uses sets this flag,
++ * which makes impossible to reuse this bit.
++ *
++ * So leave it here to make sure that it won't be reused by mistake.
++ */
+ #define XFRM_OFFLOAD_IPV6 1
+ #define XFRM_OFFLOAD_INBOUND 2
+
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 44d1340634f61..9741344cc0a45 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -2635,9 +2635,9 @@ parse_field(struct hist_trigger_data *hist_data, struct trace_event_file *file,
+ /*
+ * For backward compatibility, if field_name
+ * was "cpu", then we treat this the same as
+- * common_cpu.
++ * common_cpu. This also works for "CPU".
+ */
+- if (strcmp(field_name, "cpu") == 0) {
++ if (field && field->filter_type == FILTER_CPU) {
+ *flags |= HIST_FIELD_FL_CPU;
+ } else {
+ hist_err("Couldn't find field: ", field_name);
+@@ -4642,7 +4642,7 @@ static int create_tracing_map_fields(struct hist_trigger_data *hist_data)
+
+ if (hist_field->flags & HIST_FIELD_FL_STACKTRACE)
+ cmp_fn = tracing_map_cmp_none;
+- else if (!field)
++ else if (!field || hist_field->flags & HIST_FIELD_FL_CPU)
+ cmp_fn = tracing_map_cmp_num(hist_field->size,
+ hist_field->is_signed);
+ else if (is_string_field(field))
+diff --git a/mm/memfd.c b/mm/memfd.c
+index 9e68a4320a0e4..2d19288a093ea 100644
+--- a/mm/memfd.c
++++ b/mm/memfd.c
+@@ -34,26 +34,35 @@ static void memfd_tag_pins(struct address_space *mapping)
+ void __rcu **slot;
+ pgoff_t start;
+ struct page *page;
+- unsigned int tagged = 0;
++ int latency = 0;
++ int cache_count;
+
+ lru_add_drain();
+ start = 0;
+
+ xa_lock_irq(&mapping->i_pages);
+ radix_tree_for_each_slot(slot, &mapping->i_pages, &iter, start) {
++ cache_count = 1;
+ page = radix_tree_deref_slot_protected(slot, &mapping->i_pages.xa_lock);
+- if (!page || radix_tree_exception(page)) {
++ if (!page || radix_tree_exception(page) || PageTail(page)) {
+ if (radix_tree_deref_retry(page)) {
+ slot = radix_tree_iter_retry(&iter);
+ continue;
+ }
+- } else if (page_count(page) - page_mapcount(page) > 1) {
+- radix_tree_tag_set(&mapping->i_pages, iter.index,
+- MEMFD_TAG_PINNED);
++ } else {
++ if (PageTransHuge(page) && !PageHuge(page))
++ cache_count = HPAGE_PMD_NR;
++ if (cache_count !=
++ page_count(page) - total_mapcount(page)) {
++ radix_tree_tag_set(&mapping->i_pages,
++ iter.index, MEMFD_TAG_PINNED);
++ }
+ }
+
+- if (++tagged % 1024)
++ latency += cache_count;
++ if (latency < 1024)
+ continue;
++ latency = 0;
+
+ slot = radix_tree_iter_resume(slot, &iter);
+ xa_unlock_irq(&mapping->i_pages);
+@@ -79,6 +88,7 @@ static int memfd_wait_for_pins(struct address_space *mapping)
+ pgoff_t start;
+ struct page *page;
+ int error, scan;
++ int cache_count;
+
+ memfd_tag_pins(mapping);
+
+@@ -107,8 +117,12 @@ static int memfd_wait_for_pins(struct address_space *mapping)
+ page = NULL;
+ }
+
+- if (page &&
+- page_count(page) - page_mapcount(page) != 1) {
++ cache_count = 1;
++ if (page && PageTransHuge(page) && !PageHuge(page))
++ cache_count = HPAGE_PMD_NR;
++
++ if (page && cache_count !=
++ page_count(page) - total_mapcount(page)) {
+ if (scan < LAST_SCAN)
+ goto continue_resched;
+
+diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
+index fc732b78daf77..6d68cdb9dd773 100644
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -162,22 +162,25 @@ static bool batadv_is_on_batman_iface(const struct net_device *net_dev)
+ struct net *net = dev_net(net_dev);
+ struct net_device *parent_dev;
+ struct net *parent_net;
++ int iflink;
+ bool ret;
+
+ /* check if this is a batman-adv mesh interface */
+ if (batadv_softif_is_valid(net_dev))
+ return true;
+
+- /* no more parents..stop recursion */
+- if (dev_get_iflink(net_dev) == 0 ||
+- dev_get_iflink(net_dev) == net_dev->ifindex)
++ iflink = dev_get_iflink(net_dev);
++ if (iflink == 0)
+ return false;
+
+ parent_net = batadv_getlink_net(net_dev, net);
+
++ /* iflink to itself, most likely physical device */
++ if (net == parent_net && iflink == net_dev->ifindex)
++ return false;
++
+ /* recurse over the parent device */
+- parent_dev = __dev_get_by_index((struct net *)parent_net,
+- dev_get_iflink(net_dev));
++ parent_dev = __dev_get_by_index((struct net *)parent_net, iflink);
+ /* if we got a NULL parent_dev there is something broken.. */
+ if (!parent_dev) {
+ pr_err("Cannot find parent device\n");
+@@ -227,14 +230,15 @@ static struct net_device *batadv_get_real_netdevice(struct net_device *netdev)
+ struct net_device *real_netdev = NULL;
+ struct net *real_net;
+ struct net *net;
+- int ifindex;
++ int iflink;
+
+ ASSERT_RTNL();
+
+ if (!netdev)
+ return NULL;
+
+- if (netdev->ifindex == dev_get_iflink(netdev)) {
++ iflink = dev_get_iflink(netdev);
++ if (iflink == 0) {
+ dev_hold(netdev);
+ return netdev;
+ }
+@@ -244,9 +248,16 @@ static struct net_device *batadv_get_real_netdevice(struct net_device *netdev)
+ goto out;
+
+ net = dev_net(hard_iface->soft_iface);
+- ifindex = dev_get_iflink(netdev);
+ real_net = batadv_getlink_net(netdev, net);
+- real_netdev = dev_get_by_index(real_net, ifindex);
++
++ /* iflink to itself, most likely physical device */
++ if (net == real_net && netdev->ifindex == iflink) {
++ real_netdev = netdev;
++ dev_hold(real_netdev);
++ goto out;
++ }
++
++ real_netdev = dev_get_by_index(real_net, iflink);
+
+ out:
+ if (hard_iface)
+diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
+index 33684f1818a82..1ceeba2429f7d 100644
+--- a/net/dcb/dcbnl.c
++++ b/net/dcb/dcbnl.c
+@@ -2054,10 +2054,54 @@ u8 dcb_ieee_getapp_default_prio_mask(const struct net_device *dev)
+ }
+ EXPORT_SYMBOL(dcb_ieee_getapp_default_prio_mask);
+
++static void dcbnl_flush_dev(struct net_device *dev)
++{
++ struct dcb_app_type *itr, *tmp;
++
++ spin_lock_bh(&dcb_lock);
++
++ list_for_each_entry_safe(itr, tmp, &dcb_app_list, list) {
++ if (itr->ifindex == dev->ifindex) {
++ list_del(&itr->list);
++ kfree(itr);
++ }
++ }
++
++ spin_unlock_bh(&dcb_lock);
++}
++
++static int dcbnl_netdevice_event(struct notifier_block *nb,
++ unsigned long event, void *ptr)
++{
++ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++
++ switch (event) {
++ case NETDEV_UNREGISTER:
++ if (!dev->dcbnl_ops)
++ return NOTIFY_DONE;
++
++ dcbnl_flush_dev(dev);
++
++ return NOTIFY_OK;
++ default:
++ return NOTIFY_DONE;
++ }
++}
++
++static struct notifier_block dcbnl_nb __read_mostly = {
++ .notifier_call = dcbnl_netdevice_event,
++};
++
+ static int __init dcbnl_init(void)
+ {
++ int err;
++
+ INIT_LIST_HEAD(&dcb_app_list);
+
++ err = register_netdevice_notifier(&dcbnl_nb);
++ if (err)
++ return err;
++
+ rtnl_register(PF_UNSPEC, RTM_GETDCB, dcb_doit, NULL, 0);
+ rtnl_register(PF_UNSPEC, RTM_SETDCB, dcb_doit, NULL, 0);
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 251ec12517e93..fd496bda7ec78 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1259,8 +1259,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
+ if (np->frag_size)
+ mtu = np->frag_size;
+ }
+- if (mtu < IPV6_MIN_MTU)
+- return -EINVAL;
+ cork->base.fragsize = mtu;
+ cork->base.gso_size = ipc6->gso_size;
+ cork->base.tx_flags = 0;
+@@ -1320,8 +1318,6 @@ static int __ip6_append_data(struct sock *sk,
+
+ fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
+ (opt ? opt->opt_nflen : 0);
+- maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
+- sizeof(struct frag_hdr);
+
+ headersize = sizeof(struct ipv6hdr) +
+ (opt ? opt->opt_flen + opt->opt_nflen : 0) +
+@@ -1329,6 +1325,13 @@ static int __ip6_append_data(struct sock *sk,
+ sizeof(struct frag_hdr) : 0) +
+ rt->rt6i_nfheader_len;
+
++ if (mtu < fragheaderlen ||
++ ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr))
++ goto emsgsize;
++
++ maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
++ sizeof(struct frag_hdr);
++
+ /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit
+ * the first fragment
+ */
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index c42cc79895202..f30b732af61d7 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2774,13 +2774,13 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ ether_addr_equal(sdata->vif.addr, hdr->addr3))
+ return RX_CONTINUE;
+
+- ac = ieee80211_select_queue_80211(sdata, skb, hdr);
++ ac = ieee802_1d_to_ac[skb->priority];
+ q = sdata->vif.hw_queue[ac];
+ if (ieee80211_queue_stopped(&local->hw, q)) {
+ IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
+ return RX_DROP_MONITOR;
+ }
+- skb_set_queue_mapping(skb, q);
++ skb_set_queue_mapping(skb, ac);
+
+ if (!--mesh_hdr->ttl) {
+ if (!is_multicast_ether_addr(hdr->addr1))
+diff --git a/net/netfilter/core.c b/net/netfilter/core.c
+index 93aaec3a54ecd..722d1b057f616 100644
+--- a/net/netfilter/core.c
++++ b/net/netfilter/core.c
+@@ -335,14 +335,15 @@ static int __nf_register_net_hook(struct net *net, int pf,
+ p = nf_entry_dereference(*pp);
+ new_hooks = nf_hook_entries_grow(p, reg);
+
+- if (!IS_ERR(new_hooks))
++ if (!IS_ERR(new_hooks)) {
++ hooks_validate(new_hooks);
+ rcu_assign_pointer(*pp, new_hooks);
++ }
+
+ mutex_unlock(&nf_hook_mutex);
+ if (IS_ERR(new_hooks))
+ return PTR_ERR(new_hooks);
+
+- hooks_validate(new_hooks);
+ #ifdef CONFIG_NETFILTER_INGRESS
+ if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
+ net_inc_ingress_queue();
+diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
+index ee6d98355081e..84c59de278822 100644
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -46,6 +46,15 @@ void nf_unregister_queue_handler(struct net *net)
+ }
+ EXPORT_SYMBOL(nf_unregister_queue_handler);
+
++static void nf_queue_sock_put(struct sock *sk)
++{
++#ifdef CONFIG_INET
++ sock_gen_put(sk);
++#else
++ sock_put(sk);
++#endif
++}
++
+ void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
+ {
+ struct nf_hook_state *state = &entry->state;
+@@ -56,7 +65,7 @@ void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
+ if (state->out)
+ dev_put(state->out);
+ if (state->sk)
+- sock_put(state->sk);
++ nf_queue_sock_put(state->sk);
+ #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
+ if (entry->skb->nf_bridge) {
+ struct net_device *physdev;
+@@ -73,10 +82,13 @@ void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
+ EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs);
+
+ /* Bump dev refs so they don't vanish while packet is out */
+-void nf_queue_entry_get_refs(struct nf_queue_entry *entry)
++bool nf_queue_entry_get_refs(struct nf_queue_entry *entry)
+ {
+ struct nf_hook_state *state = &entry->state;
+
++ if (state->sk && !refcount_inc_not_zero(&state->sk->sk_refcnt))
++ return false;
++
+ if (state->in)
+ dev_hold(state->in);
+ if (state->out)
+@@ -95,6 +107,7 @@ void nf_queue_entry_get_refs(struct nf_queue_entry *entry)
+ dev_hold(physdev);
+ }
+ #endif
++ return true;
+ }
+ EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs);
+
+@@ -186,7 +199,10 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
+ .size = sizeof(*entry) + route_key_size,
+ };
+
+- nf_queue_entry_get_refs(entry);
++ if (!nf_queue_entry_get_refs(entry)) {
++ kfree(entry);
++ return -ENOTCONN;
++ }
+
+ switch (entry->state.pf) {
+ case AF_INET:
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index 8955431f2ab26..a5aff2834bd6c 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -716,9 +716,15 @@ static struct nf_queue_entry *
+ nf_queue_entry_dup(struct nf_queue_entry *e)
+ {
+ struct nf_queue_entry *entry = kmemdup(e, e->size, GFP_ATOMIC);
+- if (entry)
+- nf_queue_entry_get_refs(entry);
+- return entry;
++
++ if (!entry)
++ return NULL;
++
++ if (nf_queue_entry_get_refs(entry))
++ return entry;
++
++ kfree(entry);
++ return NULL;
+ }
+
+ #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index e7a6c8dcf6b8e..6add3094ea9e7 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -321,8 +321,8 @@ void smc_conn_free(struct smc_connection *conn)
+ } else {
+ smc_cdc_tx_dismiss_slots(conn);
+ }
+- smc_lgr_unregister_conn(conn); /* unsets conn->lgr */
+ smc_buf_unuse(conn, lgr); /* allow buffer reuse */
++ smc_lgr_unregister_conn(conn); /* unsets conn->lgr */
+
+ if (!lgr->conns_num)
+ smc_lgr_schedule_free_work(lgr);
+@@ -609,7 +609,8 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
+ !lgr->sync_err &&
+ lgr->vlan_id == vlan_id &&
+ (role == SMC_CLNT ||
+- lgr->conns_num < SMC_RMBS_PER_LGR_MAX)) {
++ (lgr->conns_num < SMC_RMBS_PER_LGR_MAX &&
++ !bitmap_full(lgr->rtokens_used_mask, SMC_RMBS_PER_LGR_MAX)))) {
+ /* link group found */
+ local_contact = SMC_REUSE_CONTACT;
+ conn->lgr = lgr;
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 04c4fd376e1d5..c5806f46f6c95 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -11791,6 +11791,9 @@ static int handle_nan_filter(struct nlattr *attr_filter,
+ i = 0;
+ nla_for_each_nested(attr, attr_filter, rem) {
+ filter[i].filter = nla_memdup(attr, GFP_KERNEL);
++ if (!filter[i].filter)
++ goto err;
++
+ filter[i].len = nla_len(attr);
+ i++;
+ }
+@@ -11803,6 +11806,15 @@ static int handle_nan_filter(struct nlattr *attr_filter,
+ }
+
+ return 0;
++
++err:
++ i = 0;
++ nla_for_each_nested(attr, attr_filter, rem) {
++ kfree(filter[i].filter);
++ i++;
++ }
++ kfree(filter);
++ return -ENOMEM;
+ }
+
+ static int nl80211_nan_add_func(struct sk_buff *skb,
+diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
+index e7a0ce98479f3..8a9f02997067e 100644
+--- a/net/xfrm/xfrm_device.c
++++ b/net/xfrm/xfrm_device.c
+@@ -153,6 +153,9 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
+ if (x->encap || x->tfcpad)
+ return -EINVAL;
+
++ if (xuo->flags & ~(XFRM_OFFLOAD_IPV6 | XFRM_OFFLOAD_INBOUND))
++ return -EINVAL;
++
+ dev = dev_get_by_index(net, xuo->ifindex);
+ if (!dev) {
+ if (!(xuo->flags & XFRM_OFFLOAD_INBOUND)) {
+@@ -190,7 +193,8 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
+
+ xso->dev = dev;
+ xso->num_exthdrs = 1;
+- xso->flags = xuo->flags;
++ /* Don't forward bit that is not implemented */
++ xso->flags = xuo->flags & ~XFRM_OFFLOAD_IPV6;
+
+ err = dev->xfrmdev_ops->xdo_dev_state_add(x);
+ if (err) {
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 054897358d904..1ae8caca28a06 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -698,12 +698,12 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[],
+ struct net *net = xi->net;
+ struct xfrm_if_parms p = {};
+
++ xfrmi_netlink_parms(data, &p);
+ if (!p.if_id) {
+ NL_SET_ERR_MSG(extack, "if_id must be non zero");
+ return -EINVAL;
+ }
+
+- xfrmi_netlink_parms(data, &p);
+ xi = xfrmi_locate(net, &p);
+ if (!xi) {
+ xi = netdev_priv(dev);
+diff --git a/sound/soc/codecs/rt5668.c b/sound/soc/codecs/rt5668.c
+index 3c19d03f2446b..a78503f24aa8a 100644
+--- a/sound/soc/codecs/rt5668.c
++++ b/sound/soc/codecs/rt5668.c
+@@ -1025,11 +1025,13 @@ static void rt5668_jack_detect_handler(struct work_struct *work)
+ container_of(work, struct rt5668_priv, jack_detect_work.work);
+ int val, btn_type;
+
+- while (!rt5668->component)
+- usleep_range(10000, 15000);
+-
+- while (!rt5668->component->card->instantiated)
+- usleep_range(10000, 15000);
++ if (!rt5668->component || !rt5668->component->card ||
++ !rt5668->component->card->instantiated) {
++ /* card not yet ready, try later */
++ mod_delayed_work(system_power_efficient_wq,
++ &rt5668->jack_detect_work, msecs_to_jiffies(15));
++ return;
++ }
+
+ mutex_lock(&rt5668->calibrate_mutex);
+
+diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
+index 7a78bb00f874d..5979165ac37cf 100644
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -1039,11 +1039,13 @@ static void rt5682_jack_detect_handler(struct work_struct *work)
+ container_of(work, struct rt5682_priv, jack_detect_work.work);
+ int val, btn_type;
+
+- while (!rt5682->component)
+- usleep_range(10000, 15000);
+-
+- while (!rt5682->component->card->instantiated)
+- usleep_range(10000, 15000);
++ if (!rt5682->component || !rt5682->component->card ||
++ !rt5682->component->card->instantiated) {
++ /* card not yet ready, try later */
++ mod_delayed_work(system_power_efficient_wq,
++ &rt5682->jack_detect_work, msecs_to_jiffies(15));
++ return;
++ }
+
+ mutex_lock(&rt5682->calibrate_mutex);
+
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index f5dcd625e4355..c88bc6bb41cfe 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -323,7 +323,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol,
+ mask = BIT(sign_bit + 1) - 1;
+
+ val = ucontrol->value.integer.value[0];
+- if (mc->platform_max && val > mc->platform_max)
++ if (mc->platform_max && ((int)val + min) > mc->platform_max)
+ return -EINVAL;
+ if (val > max - min)
+ return -EINVAL;
+@@ -336,7 +336,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol,
+ val = val << shift;
+ if (snd_soc_volsw_is_stereo(mc)) {
+ val2 = ucontrol->value.integer.value[1];
+- if (mc->platform_max && val2 > mc->platform_max)
++ if (mc->platform_max && ((int)val2 + min) > mc->platform_max)
+ return -EINVAL;
+ if (val2 > max - min)
+ return -EINVAL;
+diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c
+index ec50d1d0b5fef..3841336dc9cd8 100644
+--- a/sound/x86/intel_hdmi_audio.c
++++ b/sound/x86/intel_hdmi_audio.c
+@@ -1310,7 +1310,7 @@ static int had_pcm_mmap(struct snd_pcm_substream *substream,
+ {
+ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ return remap_pfn_range(vma, vma->vm_start,
+- substream->dma_buffer.addr >> PAGE_SHIFT,
++ substream->runtime->dma_addr >> PAGE_SHIFT,
+ vma->vm_end - vma->vm_start, vma->vm_page_prot);
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-03-11 10:56 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-03-11 10:56 UTC (permalink / raw
To: gentoo-commits
commit: c2f5231af873e5592804fc09cd3cf767c08bed16
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 11 10:56:05 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Mar 11 10:56:05 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c2f5231a
Linux patch 4.19.234
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1233_linux-4.19.234.patch | 2185 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2189 insertions(+)
diff --git a/0000_README b/0000_README
index 4f185404..41e3b530 100644
--- a/0000_README
+++ b/0000_README
@@ -971,6 +971,10 @@ Patch: 1232_linux-4.19.233.patch
From: https://www.kernel.org
Desc: Linux 4.19.233
+Patch: 1233_linux-4.19.234.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.234
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1233_linux-4.19.234.patch b/1233_linux-4.19.234.patch
new file mode 100644
index 00000000..d3060de9
--- /dev/null
+++ b/1233_linux-4.19.234.patch
@@ -0,0 +1,2185 @@
+diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
+index 985181dba0bac..6bd97cd50d625 100644
+--- a/Documentation/admin-guide/hw-vuln/spectre.rst
++++ b/Documentation/admin-guide/hw-vuln/spectre.rst
+@@ -60,8 +60,8 @@ privileged data touched during the speculative execution.
+ Spectre variant 1 attacks take advantage of speculative execution of
+ conditional branches, while Spectre variant 2 attacks use speculative
+ execution of indirect branches to leak privileged memory.
+-See :ref:`[1] <spec_ref1>` :ref:`[5] <spec_ref5>` :ref:`[7] <spec_ref7>`
+-:ref:`[10] <spec_ref10>` :ref:`[11] <spec_ref11>`.
++See :ref:`[1] <spec_ref1>` :ref:`[5] <spec_ref5>` :ref:`[6] <spec_ref6>`
++:ref:`[7] <spec_ref7>` :ref:`[10] <spec_ref10>` :ref:`[11] <spec_ref11>`.
+
+ Spectre variant 1 (Bounds Check Bypass)
+ ---------------------------------------
+@@ -131,6 +131,19 @@ steer its indirect branch speculations to gadget code, and measure the
+ speculative execution's side effects left in level 1 cache to infer the
+ victim's data.
+
++Yet another variant 2 attack vector is for the attacker to poison the
++Branch History Buffer (BHB) to speculatively steer an indirect branch
++to a specific Branch Target Buffer (BTB) entry, even if the entry isn't
++associated with the source address of the indirect branch. Specifically,
++the BHB might be shared across privilege levels even in the presence of
++Enhanced IBRS.
++
++Currently the only known real-world BHB attack vector is via
++unprivileged eBPF. Therefore, it's highly recommended to not enable
++unprivileged eBPF, especially when eIBRS is used (without retpolines).
++For a full mitigation against BHB attacks, it's recommended to use
++retpolines (or eIBRS combined with retpolines).
++
+ Attack scenarios
+ ----------------
+
+@@ -364,13 +377,15 @@ The possible values in this file are:
+
+ - Kernel status:
+
+- ==================================== =================================
+- 'Not affected' The processor is not vulnerable
+- 'Vulnerable' Vulnerable, no mitigation
+- 'Mitigation: Full generic retpoline' Software-focused mitigation
+- 'Mitigation: Full AMD retpoline' AMD-specific software mitigation
+- 'Mitigation: Enhanced IBRS' Hardware-focused mitigation
+- ==================================== =================================
++ ======================================== =================================
++ 'Not affected' The processor is not vulnerable
++ 'Mitigation: None' Vulnerable, no mitigation
++ 'Mitigation: Retpolines' Use Retpoline thunks
++ 'Mitigation: LFENCE' Use LFENCE instructions
++ 'Mitigation: Enhanced IBRS' Hardware-focused mitigation
++ 'Mitigation: Enhanced IBRS + Retpolines' Hardware-focused + Retpolines
++ 'Mitigation: Enhanced IBRS + LFENCE' Hardware-focused + LFENCE
++ ======================================== =================================
+
+ - Firmware status: Show if Indirect Branch Restricted Speculation (IBRS) is
+ used to protect against Spectre variant 2 attacks when calling firmware (x86 only).
+@@ -584,12 +599,13 @@ kernel command line.
+
+ Specific mitigations can also be selected manually:
+
+- retpoline
+- replace indirect branches
+- retpoline,generic
+- google's original retpoline
+- retpoline,amd
+- AMD-specific minimal thunk
++ retpoline auto pick between generic,lfence
++ retpoline,generic Retpolines
++ retpoline,lfence LFENCE; indirect branch
++ retpoline,amd alias for retpoline,lfence
++ eibrs enhanced IBRS
++ eibrs,retpoline enhanced IBRS + Retpolines
++ eibrs,lfence enhanced IBRS + LFENCE
+
+ Not specifying this option is equivalent to
+ spectre_v2=auto.
+@@ -730,7 +746,7 @@ AMD white papers:
+
+ .. _spec_ref6:
+
+-[6] `Software techniques for managing speculation on AMD processors <https://developer.amd.com/wp-content/resources/90343-B_SoftwareTechniquesforManagingSpeculation_WP_7-18Update_FNL.pdf>`_.
++[6] `Software techniques for managing speculation on AMD processors <https://developer.amd.com/wp-content/resources/Managing-Speculation-on-AMD-Processors.pdf>`_.
+
+ ARM white papers:
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 0ee49b4929be2..5754585d72650 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -4329,8 +4329,12 @@
+ Specific mitigations can also be selected manually:
+
+ retpoline - replace indirect branches
+- retpoline,generic - google's original retpoline
+- retpoline,amd - AMD-specific minimal thunk
++ retpoline,generic - Retpolines
++ retpoline,lfence - LFENCE; indirect branch
++ retpoline,amd - alias for retpoline,lfence
++ eibrs - enhanced IBRS
++ eibrs,retpoline - enhanced IBRS + Retpolines
++ eibrs,lfence - enhanced IBRS + LFENCE
+
+ Not specifying this option is equivalent to
+ spectre_v2=auto.
+diff --git a/Makefile b/Makefile
+index c93bacac07957..f3f1a59ec25b5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 233
++SUBLEVEL = 234
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index 1935b580f0e8b..c7fa0c0ff4474 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -110,6 +110,16 @@
+ .endm
+ #endif
+
++#if __LINUX_ARM_ARCH__ < 7
++ .macro dsb, args
++ mcr p15, 0, r0, c7, c10, 4
++ .endm
++
++ .macro isb, args
++ mcr p15, 0, r0, c7, c5, 4
++ .endm
++#endif
++
+ .macro asm_trace_hardirqs_off, save=1
+ #if defined(CONFIG_TRACE_IRQFLAGS)
+ .if \save
+diff --git a/arch/arm/include/asm/spectre.h b/arch/arm/include/asm/spectre.h
+new file mode 100644
+index 0000000000000..d1fa5607d3aa3
+--- /dev/null
++++ b/arch/arm/include/asm/spectre.h
+@@ -0,0 +1,32 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#ifndef __ASM_SPECTRE_H
++#define __ASM_SPECTRE_H
++
++enum {
++ SPECTRE_UNAFFECTED,
++ SPECTRE_MITIGATED,
++ SPECTRE_VULNERABLE,
++};
++
++enum {
++ __SPECTRE_V2_METHOD_BPIALL,
++ __SPECTRE_V2_METHOD_ICIALLU,
++ __SPECTRE_V2_METHOD_SMC,
++ __SPECTRE_V2_METHOD_HVC,
++ __SPECTRE_V2_METHOD_LOOP8,
++};
++
++enum {
++ SPECTRE_V2_METHOD_BPIALL = BIT(__SPECTRE_V2_METHOD_BPIALL),
++ SPECTRE_V2_METHOD_ICIALLU = BIT(__SPECTRE_V2_METHOD_ICIALLU),
++ SPECTRE_V2_METHOD_SMC = BIT(__SPECTRE_V2_METHOD_SMC),
++ SPECTRE_V2_METHOD_HVC = BIT(__SPECTRE_V2_METHOD_HVC),
++ SPECTRE_V2_METHOD_LOOP8 = BIT(__SPECTRE_V2_METHOD_LOOP8),
++};
++
++void spectre_v2_update_state(unsigned int state, unsigned int methods);
++
++int spectre_bhb_update_vectors(unsigned int method);
++
++#endif
+diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
+index 8b679e2ca3c3d..dc31426cae6d8 100644
+--- a/arch/arm/kernel/Makefile
++++ b/arch/arm/kernel/Makefile
+@@ -106,4 +106,6 @@ endif
+
+ obj-$(CONFIG_HAVE_ARM_SMCCC) += smccc-call.o
+
++obj-$(CONFIG_GENERIC_CPU_VULNERABILITIES) += spectre.o
++
+ extra-y := $(head-y) vmlinux.lds
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index cde22c04ad2b8..3ed860c8cd738 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -1029,12 +1029,11 @@ vector_\name:
+ sub lr, lr, #\correction
+ .endif
+
+- @
+- @ Save r0, lr_<exception> (parent PC) and spsr_<exception>
+- @ (parent CPSR)
+- @
++ @ Save r0, lr_<exception> (parent PC)
+ stmia sp, {r0, lr} @ save r0, lr
+- mrs lr, spsr
++
++ @ Save spsr_<exception> (parent CPSR)
++2: mrs lr, spsr
+ str lr, [sp, #8] @ save spsr
+
+ @
+@@ -1055,6 +1054,44 @@ vector_\name:
+ movs pc, lr @ branch to handler in SVC mode
+ ENDPROC(vector_\name)
+
++#ifdef CONFIG_HARDEN_BRANCH_HISTORY
++ .subsection 1
++ .align 5
++vector_bhb_loop8_\name:
++ .if \correction
++ sub lr, lr, #\correction
++ .endif
++
++ @ Save r0, lr_<exception> (parent PC)
++ stmia sp, {r0, lr}
++
++ @ bhb workaround
++ mov r0, #8
++1: b . + 4
++ subs r0, r0, #1
++ bne 1b
++ dsb
++ isb
++ b 2b
++ENDPROC(vector_bhb_loop8_\name)
++
++vector_bhb_bpiall_\name:
++ .if \correction
++ sub lr, lr, #\correction
++ .endif
++
++ @ Save r0, lr_<exception> (parent PC)
++ stmia sp, {r0, lr}
++
++ @ bhb workaround
++ mcr p15, 0, r0, c7, c5, 6 @ BPIALL
++ @ isb not needed due to "movs pc, lr" in the vector stub
++ @ which gives a "context synchronisation".
++ b 2b
++ENDPROC(vector_bhb_bpiall_\name)
++ .previous
++#endif
++
+ .align 2
+ @ handler addresses follow this label
+ 1:
+@@ -1063,6 +1100,10 @@ ENDPROC(vector_\name)
+ .section .stubs, "ax", %progbits
+ @ This must be the first word
+ .word vector_swi
++#ifdef CONFIG_HARDEN_BRANCH_HISTORY
++ .word vector_bhb_loop8_swi
++ .word vector_bhb_bpiall_swi
++#endif
+
+ vector_rst:
+ ARM( swi SYS_ERROR0 )
+@@ -1177,8 +1218,10 @@ vector_addrexcptn:
+ * FIQ "NMI" handler
+ *-----------------------------------------------------------------------------
+ * Handle a FIQ using the SVC stack allowing FIQ act like NMI on x86
+- * systems.
++ * systems. This must be the last vector stub, so lets place it in its own
++ * subsection.
+ */
++ .subsection 2
+ vector_stub fiq, FIQ_MODE, 4
+
+ .long __fiq_usr @ 0 (USR_26 / USR_32)
+@@ -1211,6 +1254,30 @@ vector_addrexcptn:
+ W(b) vector_irq
+ W(b) vector_fiq
+
++#ifdef CONFIG_HARDEN_BRANCH_HISTORY
++ .section .vectors.bhb.loop8, "ax", %progbits
++.L__vectors_bhb_loop8_start:
++ W(b) vector_rst
++ W(b) vector_bhb_loop8_und
++ W(ldr) pc, .L__vectors_bhb_loop8_start + 0x1004
++ W(b) vector_bhb_loop8_pabt
++ W(b) vector_bhb_loop8_dabt
++ W(b) vector_addrexcptn
++ W(b) vector_bhb_loop8_irq
++ W(b) vector_bhb_loop8_fiq
++
++ .section .vectors.bhb.bpiall, "ax", %progbits
++.L__vectors_bhb_bpiall_start:
++ W(b) vector_rst
++ W(b) vector_bhb_bpiall_und
++ W(ldr) pc, .L__vectors_bhb_bpiall_start + 0x1008
++ W(b) vector_bhb_bpiall_pabt
++ W(b) vector_bhb_bpiall_dabt
++ W(b) vector_addrexcptn
++ W(b) vector_bhb_bpiall_irq
++ W(b) vector_bhb_bpiall_fiq
++#endif
++
+ .data
+ .align 2
+
+diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
+index 0465d65d23de5..e27fc2df52316 100644
+--- a/arch/arm/kernel/entry-common.S
++++ b/arch/arm/kernel/entry-common.S
+@@ -165,6 +165,29 @@ ENDPROC(ret_from_fork)
+ *-----------------------------------------------------------------------------
+ */
+
++ .align 5
++#ifdef CONFIG_HARDEN_BRANCH_HISTORY
++ENTRY(vector_bhb_loop8_swi)
++ sub sp, sp, #PT_REGS_SIZE
++ stmia sp, {r0 - r12}
++ mov r8, #8
++1: b 2f
++2: subs r8, r8, #1
++ bne 1b
++ dsb
++ isb
++ b 3f
++ENDPROC(vector_bhb_loop8_swi)
++
++ .align 5
++ENTRY(vector_bhb_bpiall_swi)
++ sub sp, sp, #PT_REGS_SIZE
++ stmia sp, {r0 - r12}
++ mcr p15, 0, r8, c7, c5, 6 @ BPIALL
++ isb
++ b 3f
++ENDPROC(vector_bhb_bpiall_swi)
++#endif
+ .align 5
+ ENTRY(vector_swi)
+ #ifdef CONFIG_CPU_V7M
+@@ -172,6 +195,7 @@ ENTRY(vector_swi)
+ #else
+ sub sp, sp, #PT_REGS_SIZE
+ stmia sp, {r0 - r12} @ Calling r0 - r12
++3:
+ ARM( add r8, sp, #S_PC )
+ ARM( stmdb r8, {sp, lr}^ ) @ Calling sp, lr
+ THUMB( mov r8, sp )
+diff --git a/arch/arm/kernel/spectre.c b/arch/arm/kernel/spectre.c
+new file mode 100644
+index 0000000000000..0dcefc36fb7a0
+--- /dev/null
++++ b/arch/arm/kernel/spectre.c
+@@ -0,0 +1,71 @@
++// SPDX-License-Identifier: GPL-2.0-only
++#include <linux/bpf.h>
++#include <linux/cpu.h>
++#include <linux/device.h>
++
++#include <asm/spectre.h>
++
++static bool _unprivileged_ebpf_enabled(void)
++{
++#ifdef CONFIG_BPF_SYSCALL
++ return !sysctl_unprivileged_bpf_disabled;
++#else
++ return false;
++#endif
++}
++
++ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr,
++ char *buf)
++{
++ return sprintf(buf, "Mitigation: __user pointer sanitization\n");
++}
++
++static unsigned int spectre_v2_state;
++static unsigned int spectre_v2_methods;
++
++void spectre_v2_update_state(unsigned int state, unsigned int method)
++{
++ if (state > spectre_v2_state)
++ spectre_v2_state = state;
++ spectre_v2_methods |= method;
++}
++
++ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr,
++ char *buf)
++{
++ const char *method;
++
++ if (spectre_v2_state == SPECTRE_UNAFFECTED)
++ return sprintf(buf, "%s\n", "Not affected");
++
++ if (spectre_v2_state != SPECTRE_MITIGATED)
++ return sprintf(buf, "%s\n", "Vulnerable");
++
++ if (_unprivileged_ebpf_enabled())
++ return sprintf(buf, "Vulnerable: Unprivileged eBPF enabled\n");
++
++ switch (spectre_v2_methods) {
++ case SPECTRE_V2_METHOD_BPIALL:
++ method = "Branch predictor hardening";
++ break;
++
++ case SPECTRE_V2_METHOD_ICIALLU:
++ method = "I-cache invalidation";
++ break;
++
++ case SPECTRE_V2_METHOD_SMC:
++ case SPECTRE_V2_METHOD_HVC:
++ method = "Firmware call";
++ break;
++
++ case SPECTRE_V2_METHOD_LOOP8:
++ method = "History overwrite";
++ break;
++
++ default:
++ method = "Multiple mitigations";
++ break;
++ }
++
++ return sprintf(buf, "Mitigation: %s\n", method);
++}
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index aec533168f046..d49fafd2b865f 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -33,6 +33,7 @@
+ #include <linux/atomic.h>
+ #include <asm/cacheflush.h>
+ #include <asm/exception.h>
++#include <asm/spectre.h>
+ #include <asm/unistd.h>
+ #include <asm/traps.h>
+ #include <asm/ptrace.h>
+@@ -830,10 +831,59 @@ static inline void __init kuser_init(void *vectors)
+ }
+ #endif
+
++#ifndef CONFIG_CPU_V7M
++static void copy_from_lma(void *vma, void *lma_start, void *lma_end)
++{
++ memcpy(vma, lma_start, lma_end - lma_start);
++}
++
++static void flush_vectors(void *vma, size_t offset, size_t size)
++{
++ unsigned long start = (unsigned long)vma + offset;
++ unsigned long end = start + size;
++
++ flush_icache_range(start, end);
++}
++
++#ifdef CONFIG_HARDEN_BRANCH_HISTORY
++int spectre_bhb_update_vectors(unsigned int method)
++{
++ extern char __vectors_bhb_bpiall_start[], __vectors_bhb_bpiall_end[];
++ extern char __vectors_bhb_loop8_start[], __vectors_bhb_loop8_end[];
++ void *vec_start, *vec_end;
++
++ if (system_state > SYSTEM_SCHEDULING) {
++ pr_err("CPU%u: Spectre BHB workaround too late - system vulnerable\n",
++ smp_processor_id());
++ return SPECTRE_VULNERABLE;
++ }
++
++ switch (method) {
++ case SPECTRE_V2_METHOD_LOOP8:
++ vec_start = __vectors_bhb_loop8_start;
++ vec_end = __vectors_bhb_loop8_end;
++ break;
++
++ case SPECTRE_V2_METHOD_BPIALL:
++ vec_start = __vectors_bhb_bpiall_start;
++ vec_end = __vectors_bhb_bpiall_end;
++ break;
++
++ default:
++ pr_err("CPU%u: unknown Spectre BHB state %d\n",
++ smp_processor_id(), method);
++ return SPECTRE_VULNERABLE;
++ }
++
++ copy_from_lma(vectors_page, vec_start, vec_end);
++ flush_vectors(vectors_page, 0, vec_end - vec_start);
++
++ return SPECTRE_MITIGATED;
++}
++#endif
++
+ void __init early_trap_init(void *vectors_base)
+ {
+-#ifndef CONFIG_CPU_V7M
+- unsigned long vectors = (unsigned long)vectors_base;
+ extern char __stubs_start[], __stubs_end[];
+ extern char __vectors_start[], __vectors_end[];
+ unsigned i;
+@@ -854,17 +904,20 @@ void __init early_trap_init(void *vectors_base)
+ * into the vector page, mapped at 0xffff0000, and ensure these
+ * are visible to the instruction stream.
+ */
+- memcpy((void *)vectors, __vectors_start, __vectors_end - __vectors_start);
+- memcpy((void *)vectors + 0x1000, __stubs_start, __stubs_end - __stubs_start);
++ copy_from_lma(vectors_base, __vectors_start, __vectors_end);
++ copy_from_lma(vectors_base + 0x1000, __stubs_start, __stubs_end);
+
+ kuser_init(vectors_base);
+
+- flush_icache_range(vectors, vectors + PAGE_SIZE * 2);
++ flush_vectors(vectors_base, 0, PAGE_SIZE * 2);
++}
+ #else /* ifndef CONFIG_CPU_V7M */
++void __init early_trap_init(void *vectors_base)
++{
+ /*
+ * on V7-M there is no need to copy the vector table to a dedicated
+ * memory area. The address is configurable and so a table in the kernel
+ * image can be used.
+ */
+-#endif
+ }
++#endif
+diff --git a/arch/arm/kernel/vmlinux.lds.h b/arch/arm/kernel/vmlinux.lds.h
+index 8247bc15addc4..78d156e4f0088 100644
+--- a/arch/arm/kernel/vmlinux.lds.h
++++ b/arch/arm/kernel/vmlinux.lds.h
+@@ -25,6 +25,19 @@
+ #define ARM_MMU_DISCARD(x) x
+ #endif
+
++/*
++ * ld.lld does not support NOCROSSREFS:
++ * https://github.com/ClangBuiltLinux/linux/issues/1609
++ */
++#ifdef CONFIG_LD_IS_LLD
++#define NOCROSSREFS
++#endif
++
++/* Set start/end symbol names to the LMA for the section */
++#define ARM_LMA(sym, section) \
++ sym##_start = LOADADDR(section); \
++ sym##_end = LOADADDR(section) + SIZEOF(section)
++
+ #define PROC_INFO \
+ . = ALIGN(4); \
+ __proc_info_begin = .; \
+@@ -100,19 +113,31 @@
+ * only thing that matters is their relative offsets
+ */
+ #define ARM_VECTORS \
+- __vectors_start = .; \
+- .vectors 0xffff0000 : AT(__vectors_start) { \
+- *(.vectors) \
++ __vectors_lma = .; \
++ OVERLAY 0xffff0000 : NOCROSSREFS AT(__vectors_lma) { \
++ .vectors { \
++ *(.vectors) \
++ } \
++ .vectors.bhb.loop8 { \
++ *(.vectors.bhb.loop8) \
++ } \
++ .vectors.bhb.bpiall { \
++ *(.vectors.bhb.bpiall) \
++ } \
+ } \
+- . = __vectors_start + SIZEOF(.vectors); \
+- __vectors_end = .; \
++ ARM_LMA(__vectors, .vectors); \
++ ARM_LMA(__vectors_bhb_loop8, .vectors.bhb.loop8); \
++ ARM_LMA(__vectors_bhb_bpiall, .vectors.bhb.bpiall); \
++ . = __vectors_lma + SIZEOF(.vectors) + \
++ SIZEOF(.vectors.bhb.loop8) + \
++ SIZEOF(.vectors.bhb.bpiall); \
+ \
+- __stubs_start = .; \
+- .stubs ADDR(.vectors) + 0x1000 : AT(__stubs_start) { \
++ __stubs_lma = .; \
++ .stubs ADDR(.vectors) + 0x1000 : AT(__stubs_lma) { \
+ *(.stubs) \
+ } \
+- . = __stubs_start + SIZEOF(.stubs); \
+- __stubs_end = .; \
++ ARM_LMA(__stubs, .stubs); \
++ . = __stubs_lma + SIZEOF(.stubs); \
+ \
+ PROVIDE(vector_fiq_offset = vector_fiq - ADDR(.vectors));
+
+diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
+index 9738c1f9737c9..7f11e44cf7ccd 100644
+--- a/arch/arm/mm/Kconfig
++++ b/arch/arm/mm/Kconfig
+@@ -823,6 +823,7 @@ config CPU_BPREDICT_DISABLE
+
+ config CPU_SPECTRE
+ bool
++ select GENERIC_CPU_VULNERABILITIES
+
+ config HARDEN_BRANCH_PREDICTOR
+ bool "Harden the branch predictor against aliasing attacks" if EXPERT
+@@ -843,6 +844,16 @@ config HARDEN_BRANCH_PREDICTOR
+
+ If unsure, say Y.
+
++config HARDEN_BRANCH_HISTORY
++ bool "Harden Spectre style attacks against branch history" if EXPERT
++ depends on CPU_SPECTRE
++ default y
++ help
++ Speculation attacks against some high-performance processors can
++ make use of branch history to influence future speculation. When
++ taking an exception, a sequence of branches overwrites the branch
++ history, or branch history is invalidated.
++
+ config TLS_REG_EMUL
+ bool
+ select NEED_KUSER_HELPERS
+diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c
+index a6554fdb56c54..8394307272d6f 100644
+--- a/arch/arm/mm/proc-v7-bugs.c
++++ b/arch/arm/mm/proc-v7-bugs.c
+@@ -7,8 +7,36 @@
+ #include <asm/cp15.h>
+ #include <asm/cputype.h>
+ #include <asm/proc-fns.h>
++#include <asm/spectre.h>
+ #include <asm/system_misc.h>
+
++#ifdef CONFIG_ARM_PSCI
++#define SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED 1
++static int __maybe_unused spectre_v2_get_cpu_fw_mitigation_state(void)
++{
++ struct arm_smccc_res res;
++
++ arm_smccc_1_1_invoke(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
++ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
++
++ switch ((int)res.a0) {
++ case SMCCC_RET_SUCCESS:
++ return SPECTRE_MITIGATED;
++
++ case SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED:
++ return SPECTRE_UNAFFECTED;
++
++ default:
++ return SPECTRE_VULNERABLE;
++ }
++}
++#else
++static int __maybe_unused spectre_v2_get_cpu_fw_mitigation_state(void)
++{
++ return SPECTRE_VULNERABLE;
++}
++#endif
++
+ #ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+ DEFINE_PER_CPU(harden_branch_predictor_fn_t, harden_branch_predictor_fn);
+
+@@ -37,13 +65,61 @@ static void __maybe_unused call_hvc_arch_workaround_1(void)
+ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_1, NULL);
+ }
+
+-static void cpu_v7_spectre_init(void)
++static unsigned int spectre_v2_install_workaround(unsigned int method)
+ {
+ const char *spectre_v2_method = NULL;
+ int cpu = smp_processor_id();
+
+ if (per_cpu(harden_branch_predictor_fn, cpu))
+- return;
++ return SPECTRE_MITIGATED;
++
++ switch (method) {
++ case SPECTRE_V2_METHOD_BPIALL:
++ per_cpu(harden_branch_predictor_fn, cpu) =
++ harden_branch_predictor_bpiall;
++ spectre_v2_method = "BPIALL";
++ break;
++
++ case SPECTRE_V2_METHOD_ICIALLU:
++ per_cpu(harden_branch_predictor_fn, cpu) =
++ harden_branch_predictor_iciallu;
++ spectre_v2_method = "ICIALLU";
++ break;
++
++ case SPECTRE_V2_METHOD_HVC:
++ per_cpu(harden_branch_predictor_fn, cpu) =
++ call_hvc_arch_workaround_1;
++ cpu_do_switch_mm = cpu_v7_hvc_switch_mm;
++ spectre_v2_method = "hypervisor";
++ break;
++
++ case SPECTRE_V2_METHOD_SMC:
++ per_cpu(harden_branch_predictor_fn, cpu) =
++ call_smc_arch_workaround_1;
++ cpu_do_switch_mm = cpu_v7_smc_switch_mm;
++ spectre_v2_method = "firmware";
++ break;
++ }
++
++ if (spectre_v2_method)
++ pr_info("CPU%u: Spectre v2: using %s workaround\n",
++ smp_processor_id(), spectre_v2_method);
++
++ return SPECTRE_MITIGATED;
++}
++#else
++static unsigned int spectre_v2_install_workaround(unsigned int method)
++{
++ pr_info("CPU%u: Spectre V2: workarounds disabled by configuration\n",
++ smp_processor_id());
++
++ return SPECTRE_VULNERABLE;
++}
++#endif
++
++static void cpu_v7_spectre_v2_init(void)
++{
++ unsigned int state, method = 0;
+
+ switch (read_cpuid_part()) {
+ case ARM_CPU_PART_CORTEX_A8:
+@@ -52,32 +128,37 @@ static void cpu_v7_spectre_init(void)
+ case ARM_CPU_PART_CORTEX_A17:
+ case ARM_CPU_PART_CORTEX_A73:
+ case ARM_CPU_PART_CORTEX_A75:
+- per_cpu(harden_branch_predictor_fn, cpu) =
+- harden_branch_predictor_bpiall;
+- spectre_v2_method = "BPIALL";
++ state = SPECTRE_MITIGATED;
++ method = SPECTRE_V2_METHOD_BPIALL;
+ break;
+
+ case ARM_CPU_PART_CORTEX_A15:
+ case ARM_CPU_PART_BRAHMA_B15:
+- per_cpu(harden_branch_predictor_fn, cpu) =
+- harden_branch_predictor_iciallu;
+- spectre_v2_method = "ICIALLU";
++ state = SPECTRE_MITIGATED;
++ method = SPECTRE_V2_METHOD_ICIALLU;
+ break;
+
+-#ifdef CONFIG_ARM_PSCI
+ case ARM_CPU_PART_BRAHMA_B53:
+ /* Requires no workaround */
++ state = SPECTRE_UNAFFECTED;
+ break;
++
+ default:
+ /* Other ARM CPUs require no workaround */
+- if (read_cpuid_implementor() == ARM_CPU_IMP_ARM)
++ if (read_cpuid_implementor() == ARM_CPU_IMP_ARM) {
++ state = SPECTRE_UNAFFECTED;
+ break;
++ }
+ /* fallthrough */
+- /* Cortex A57/A72 require firmware workaround */
++ /* Cortex A57/A72 require firmware workaround */
+ case ARM_CPU_PART_CORTEX_A57:
+ case ARM_CPU_PART_CORTEX_A72: {
+ struct arm_smccc_res res;
+
++ state = spectre_v2_get_cpu_fw_mitigation_state();
++ if (state != SPECTRE_MITIGATED)
++ break;
++
+ if (psci_ops.smccc_version == SMCCC_VERSION_1_0)
+ break;
+
+@@ -87,10 +168,7 @@ static void cpu_v7_spectre_init(void)
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+ if ((int)res.a0 != 0)
+ break;
+- per_cpu(harden_branch_predictor_fn, cpu) =
+- call_hvc_arch_workaround_1;
+- cpu_do_switch_mm = cpu_v7_hvc_switch_mm;
+- spectre_v2_method = "hypervisor";
++ method = SPECTRE_V2_METHOD_HVC;
+ break;
+
+ case PSCI_CONDUIT_SMC:
+@@ -98,29 +176,97 @@ static void cpu_v7_spectre_init(void)
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+ if ((int)res.a0 != 0)
+ break;
+- per_cpu(harden_branch_predictor_fn, cpu) =
+- call_smc_arch_workaround_1;
+- cpu_do_switch_mm = cpu_v7_smc_switch_mm;
+- spectre_v2_method = "firmware";
++ method = SPECTRE_V2_METHOD_SMC;
+ break;
+
+ default:
++ state = SPECTRE_VULNERABLE;
+ break;
+ }
+ }
+-#endif
+ }
+
+- if (spectre_v2_method)
+- pr_info("CPU%u: Spectre v2: using %s workaround\n",
+- smp_processor_id(), spectre_v2_method);
++ if (state == SPECTRE_MITIGATED)
++ state = spectre_v2_install_workaround(method);
++
++ spectre_v2_update_state(state, method);
++}
++
++#ifdef CONFIG_HARDEN_BRANCH_HISTORY
++static int spectre_bhb_method;
++
++static const char *spectre_bhb_method_name(int method)
++{
++ switch (method) {
++ case SPECTRE_V2_METHOD_LOOP8:
++ return "loop";
++
++ case SPECTRE_V2_METHOD_BPIALL:
++ return "BPIALL";
++
++ default:
++ return "unknown";
++ }
++}
++
++static int spectre_bhb_install_workaround(int method)
++{
++ if (spectre_bhb_method != method) {
++ if (spectre_bhb_method) {
++ pr_err("CPU%u: Spectre BHB: method disagreement, system vulnerable\n",
++ smp_processor_id());
++
++ return SPECTRE_VULNERABLE;
++ }
++
++ if (spectre_bhb_update_vectors(method) == SPECTRE_VULNERABLE)
++ return SPECTRE_VULNERABLE;
++
++ spectre_bhb_method = method;
++ }
++
++ pr_info("CPU%u: Spectre BHB: using %s workaround\n",
++ smp_processor_id(), spectre_bhb_method_name(method));
++
++ return SPECTRE_MITIGATED;
+ }
+ #else
+-static void cpu_v7_spectre_init(void)
++static int spectre_bhb_install_workaround(int method)
+ {
++ return SPECTRE_VULNERABLE;
+ }
+ #endif
+
++static void cpu_v7_spectre_bhb_init(void)
++{
++ unsigned int state, method = 0;
++
++ switch (read_cpuid_part()) {
++ case ARM_CPU_PART_CORTEX_A15:
++ case ARM_CPU_PART_BRAHMA_B15:
++ case ARM_CPU_PART_CORTEX_A57:
++ case ARM_CPU_PART_CORTEX_A72:
++ state = SPECTRE_MITIGATED;
++ method = SPECTRE_V2_METHOD_LOOP8;
++ break;
++
++ case ARM_CPU_PART_CORTEX_A73:
++ case ARM_CPU_PART_CORTEX_A75:
++ state = SPECTRE_MITIGATED;
++ method = SPECTRE_V2_METHOD_BPIALL;
++ break;
++
++ default:
++ state = SPECTRE_UNAFFECTED;
++ break;
++ }
++
++ if (state == SPECTRE_MITIGATED)
++ state = spectre_bhb_install_workaround(method);
++
++ spectre_v2_update_state(state, method);
++}
++
+ static __maybe_unused bool cpu_v7_check_auxcr_set(bool *warned,
+ u32 mask, const char *msg)
+ {
+@@ -149,16 +295,17 @@ static bool check_spectre_auxcr(bool *warned, u32 bit)
+ void cpu_v7_ca8_ibe(void)
+ {
+ if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(6)))
+- cpu_v7_spectre_init();
++ cpu_v7_spectre_v2_init();
+ }
+
+ void cpu_v7_ca15_ibe(void)
+ {
+ if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0)))
+- cpu_v7_spectre_init();
++ cpu_v7_spectre_v2_init();
+ }
+
+ void cpu_v7_bugs_init(void)
+ {
+- cpu_v7_spectre_init();
++ cpu_v7_spectre_v2_init();
++ cpu_v7_spectre_bhb_init();
+ }
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index f7f9604b10ccc..8910dde943d13 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -203,7 +203,7 @@
+ #define X86_FEATURE_SME ( 7*32+10) /* AMD Secure Memory Encryption */
+ #define X86_FEATURE_PTI ( 7*32+11) /* Kernel Page Table Isolation enabled */
+ #define X86_FEATURE_RETPOLINE ( 7*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */
+-#define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* "" AMD Retpoline mitigation for Spectre variant 2 */
++#define X86_FEATURE_RETPOLINE_LFENCE ( 7*32+13) /* "" Use LFENCE for Spectre variant 2 */
+ #define X86_FEATURE_INTEL_PPIN ( 7*32+14) /* Intel Processor Inventory Number */
+ #define X86_FEATURE_CDP_L2 ( 7*32+15) /* Code and Data Prioritization L2 */
+ #define X86_FEATURE_MSR_SPEC_CTRL ( 7*32+16) /* "" MSR SPEC_CTRL is implemented */
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 62f9903544b59..812976a6d8642 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -119,7 +119,7 @@
+ ANNOTATE_NOSPEC_ALTERNATIVE
+ ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; jmp *\reg), \
+ __stringify(RETPOLINE_JMP \reg), X86_FEATURE_RETPOLINE, \
+- __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; jmp *\reg), X86_FEATURE_RETPOLINE_AMD
++ __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; jmp *\reg), X86_FEATURE_RETPOLINE_LFENCE
+ #else
+ jmp *\reg
+ #endif
+@@ -130,7 +130,7 @@
+ ANNOTATE_NOSPEC_ALTERNATIVE
+ ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; call *\reg), \
+ __stringify(RETPOLINE_CALL \reg), X86_FEATURE_RETPOLINE,\
+- __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; call *\reg), X86_FEATURE_RETPOLINE_AMD
++ __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; call *\reg), X86_FEATURE_RETPOLINE_LFENCE
+ #else
+ call *\reg
+ #endif
+@@ -181,7 +181,7 @@
+ "lfence;\n" \
+ ANNOTATE_RETPOLINE_SAFE \
+ "call *%[thunk_target]\n", \
+- X86_FEATURE_RETPOLINE_AMD)
++ X86_FEATURE_RETPOLINE_LFENCE)
+ # define THUNK_TARGET(addr) [thunk_target] "r" (addr)
+
+ #else /* CONFIG_X86_32 */
+@@ -211,7 +211,7 @@
+ "lfence;\n" \
+ ANNOTATE_RETPOLINE_SAFE \
+ "call *%[thunk_target]\n", \
+- X86_FEATURE_RETPOLINE_AMD)
++ X86_FEATURE_RETPOLINE_LFENCE)
+
+ # define THUNK_TARGET(addr) [thunk_target] "rm" (addr)
+ #endif
+@@ -223,9 +223,11 @@
+ /* The Spectre V2 mitigation variants */
+ enum spectre_v2_mitigation {
+ SPECTRE_V2_NONE,
+- SPECTRE_V2_RETPOLINE_GENERIC,
+- SPECTRE_V2_RETPOLINE_AMD,
+- SPECTRE_V2_IBRS_ENHANCED,
++ SPECTRE_V2_RETPOLINE,
++ SPECTRE_V2_LFENCE,
++ SPECTRE_V2_EIBRS,
++ SPECTRE_V2_EIBRS_RETPOLINE,
++ SPECTRE_V2_EIBRS_LFENCE,
+ };
+
+ /* The indirect branch speculation control variants */
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index c524fa1f4c0e6..f7b5f16455075 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -31,6 +31,7 @@
+ #include <asm/intel-family.h>
+ #include <asm/e820/api.h>
+ #include <asm/hypervisor.h>
++#include <linux/bpf.h>
+
+ #include "cpu.h"
+
+@@ -607,6 +608,32 @@ static inline const char *spectre_v2_module_string(void)
+ static inline const char *spectre_v2_module_string(void) { return ""; }
+ #endif
+
++#define SPECTRE_V2_LFENCE_MSG "WARNING: LFENCE mitigation is not recommended for this CPU, data leaks possible!\n"
++#define SPECTRE_V2_EIBRS_EBPF_MSG "WARNING: Unprivileged eBPF is enabled with eIBRS on, data leaks possible via Spectre v2 BHB attacks!\n"
++#define SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG "WARNING: Unprivileged eBPF is enabled with eIBRS+LFENCE mitigation and SMT, data leaks possible via Spectre v2 BHB attacks!\n"
++
++#ifdef CONFIG_BPF_SYSCALL
++void unpriv_ebpf_notify(int new_state)
++{
++ if (new_state)
++ return;
++
++ /* Unprivileged eBPF is enabled */
++
++ switch (spectre_v2_enabled) {
++ case SPECTRE_V2_EIBRS:
++ pr_err(SPECTRE_V2_EIBRS_EBPF_MSG);
++ break;
++ case SPECTRE_V2_EIBRS_LFENCE:
++ if (sched_smt_active())
++ pr_err(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG);
++ break;
++ default:
++ break;
++ }
++}
++#endif
++
+ static inline bool match_option(const char *arg, int arglen, const char *opt)
+ {
+ int len = strlen(opt);
+@@ -621,7 +648,10 @@ enum spectre_v2_mitigation_cmd {
+ SPECTRE_V2_CMD_FORCE,
+ SPECTRE_V2_CMD_RETPOLINE,
+ SPECTRE_V2_CMD_RETPOLINE_GENERIC,
+- SPECTRE_V2_CMD_RETPOLINE_AMD,
++ SPECTRE_V2_CMD_RETPOLINE_LFENCE,
++ SPECTRE_V2_CMD_EIBRS,
++ SPECTRE_V2_CMD_EIBRS_RETPOLINE,
++ SPECTRE_V2_CMD_EIBRS_LFENCE,
+ };
+
+ enum spectre_v2_user_cmd {
+@@ -694,6 +724,13 @@ spectre_v2_parse_user_cmdline(enum spectre_v2_mitigation_cmd v2_cmd)
+ return SPECTRE_V2_USER_CMD_AUTO;
+ }
+
++static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode)
++{
++ return (mode == SPECTRE_V2_EIBRS ||
++ mode == SPECTRE_V2_EIBRS_RETPOLINE ||
++ mode == SPECTRE_V2_EIBRS_LFENCE);
++}
++
+ static void __init
+ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ {
+@@ -756,10 +793,12 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ }
+
+ /*
+- * If enhanced IBRS is enabled or SMT impossible, STIBP is not
++ * If no STIBP, enhanced IBRS is enabled or SMT impossible, STIBP is not
+ * required.
+ */
+- if (!smt_possible || spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
++ if (!boot_cpu_has(X86_FEATURE_STIBP) ||
++ !smt_possible ||
++ spectre_v2_in_eibrs_mode(spectre_v2_enabled))
+ return;
+
+ /*
+@@ -771,12 +810,6 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ boot_cpu_has(X86_FEATURE_AMD_STIBP_ALWAYS_ON))
+ mode = SPECTRE_V2_USER_STRICT_PREFERRED;
+
+- /*
+- * If STIBP is not available, clear the STIBP mode.
+- */
+- if (!boot_cpu_has(X86_FEATURE_STIBP))
+- mode = SPECTRE_V2_USER_NONE;
+-
+ spectre_v2_user_stibp = mode;
+
+ set_mode:
+@@ -785,9 +818,11 @@ set_mode:
+
+ static const char * const spectre_v2_strings[] = {
+ [SPECTRE_V2_NONE] = "Vulnerable",
+- [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline",
+- [SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline",
+- [SPECTRE_V2_IBRS_ENHANCED] = "Mitigation: Enhanced IBRS",
++ [SPECTRE_V2_RETPOLINE] = "Mitigation: Retpolines",
++ [SPECTRE_V2_LFENCE] = "Mitigation: LFENCE",
++ [SPECTRE_V2_EIBRS] = "Mitigation: Enhanced IBRS",
++ [SPECTRE_V2_EIBRS_LFENCE] = "Mitigation: Enhanced IBRS + LFENCE",
++ [SPECTRE_V2_EIBRS_RETPOLINE] = "Mitigation: Enhanced IBRS + Retpolines",
+ };
+
+ static const struct {
+@@ -798,8 +833,12 @@ static const struct {
+ { "off", SPECTRE_V2_CMD_NONE, false },
+ { "on", SPECTRE_V2_CMD_FORCE, true },
+ { "retpoline", SPECTRE_V2_CMD_RETPOLINE, false },
+- { "retpoline,amd", SPECTRE_V2_CMD_RETPOLINE_AMD, false },
++ { "retpoline,amd", SPECTRE_V2_CMD_RETPOLINE_LFENCE, false },
++ { "retpoline,lfence", SPECTRE_V2_CMD_RETPOLINE_LFENCE, false },
+ { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
++ { "eibrs", SPECTRE_V2_CMD_EIBRS, false },
++ { "eibrs,lfence", SPECTRE_V2_CMD_EIBRS_LFENCE, false },
++ { "eibrs,retpoline", SPECTRE_V2_CMD_EIBRS_RETPOLINE, false },
+ { "auto", SPECTRE_V2_CMD_AUTO, false },
+ };
+
+@@ -836,16 +875,30 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ }
+
+ if ((cmd == SPECTRE_V2_CMD_RETPOLINE ||
+- cmd == SPECTRE_V2_CMD_RETPOLINE_AMD ||
+- cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC) &&
++ cmd == SPECTRE_V2_CMD_RETPOLINE_LFENCE ||
++ cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC ||
++ cmd == SPECTRE_V2_CMD_EIBRS_LFENCE ||
++ cmd == SPECTRE_V2_CMD_EIBRS_RETPOLINE) &&
+ !IS_ENABLED(CONFIG_RETPOLINE)) {
+- pr_err("%s selected but not compiled in. Switching to AUTO select\n", mitigation_options[i].option);
++ pr_err("%s selected but not compiled in. Switching to AUTO select\n",
++ mitigation_options[i].option);
++ return SPECTRE_V2_CMD_AUTO;
++ }
++
++ if ((cmd == SPECTRE_V2_CMD_EIBRS ||
++ cmd == SPECTRE_V2_CMD_EIBRS_LFENCE ||
++ cmd == SPECTRE_V2_CMD_EIBRS_RETPOLINE) &&
++ !boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
++ pr_err("%s selected but CPU doesn't have eIBRS. Switching to AUTO select\n",
++ mitigation_options[i].option);
+ return SPECTRE_V2_CMD_AUTO;
+ }
+
+- if (cmd == SPECTRE_V2_CMD_RETPOLINE_AMD &&
+- boot_cpu_data.x86_vendor != X86_VENDOR_AMD) {
+- pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n");
++ if ((cmd == SPECTRE_V2_CMD_RETPOLINE_LFENCE ||
++ cmd == SPECTRE_V2_CMD_EIBRS_LFENCE) &&
++ !boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
++ pr_err("%s selected, but CPU doesn't have a serializing LFENCE. Switching to AUTO select\n",
++ mitigation_options[i].option);
+ return SPECTRE_V2_CMD_AUTO;
+ }
+
+@@ -854,6 +907,16 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ return cmd;
+ }
+
++static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void)
++{
++ if (!IS_ENABLED(CONFIG_RETPOLINE)) {
++ pr_err("Kernel not compiled with retpoline; no mitigation available!");
++ return SPECTRE_V2_NONE;
++ }
++
++ return SPECTRE_V2_RETPOLINE;
++}
++
+ static void __init spectre_v2_select_mitigation(void)
+ {
+ enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
+@@ -874,48 +937,64 @@ static void __init spectre_v2_select_mitigation(void)
+ case SPECTRE_V2_CMD_FORCE:
+ case SPECTRE_V2_CMD_AUTO:
+ if (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
+- mode = SPECTRE_V2_IBRS_ENHANCED;
+- /* Force it so VMEXIT will restore correctly */
+- x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
+- wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+- goto specv2_set_mode;
++ mode = SPECTRE_V2_EIBRS;
++ break;
+ }
+- if (IS_ENABLED(CONFIG_RETPOLINE))
+- goto retpoline_auto;
++
++ mode = spectre_v2_select_retpoline();
+ break;
+- case SPECTRE_V2_CMD_RETPOLINE_AMD:
+- if (IS_ENABLED(CONFIG_RETPOLINE))
+- goto retpoline_amd;
++
++ case SPECTRE_V2_CMD_RETPOLINE_LFENCE:
++ pr_err(SPECTRE_V2_LFENCE_MSG);
++ mode = SPECTRE_V2_LFENCE;
+ break;
++
+ case SPECTRE_V2_CMD_RETPOLINE_GENERIC:
+- if (IS_ENABLED(CONFIG_RETPOLINE))
+- goto retpoline_generic;
++ mode = SPECTRE_V2_RETPOLINE;
+ break;
++
+ case SPECTRE_V2_CMD_RETPOLINE:
+- if (IS_ENABLED(CONFIG_RETPOLINE))
+- goto retpoline_auto;
++ mode = spectre_v2_select_retpoline();
++ break;
++
++ case SPECTRE_V2_CMD_EIBRS:
++ mode = SPECTRE_V2_EIBRS;
++ break;
++
++ case SPECTRE_V2_CMD_EIBRS_LFENCE:
++ mode = SPECTRE_V2_EIBRS_LFENCE;
++ break;
++
++ case SPECTRE_V2_CMD_EIBRS_RETPOLINE:
++ mode = SPECTRE_V2_EIBRS_RETPOLINE;
+ break;
+ }
+- pr_err("Spectre mitigation: kernel not compiled with retpoline; no mitigation available!");
+- return;
+
+-retpoline_auto:
+- if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) {
+- retpoline_amd:
+- if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
+- pr_err("Spectre mitigation: LFENCE not serializing, switching to generic retpoline\n");
+- goto retpoline_generic;
+- }
+- mode = SPECTRE_V2_RETPOLINE_AMD;
+- setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD);
+- setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
+- } else {
+- retpoline_generic:
+- mode = SPECTRE_V2_RETPOLINE_GENERIC;
++ if (mode == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
++ pr_err(SPECTRE_V2_EIBRS_EBPF_MSG);
++
++ if (spectre_v2_in_eibrs_mode(mode)) {
++ /* Force it so VMEXIT will restore correctly */
++ x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++ }
++
++ switch (mode) {
++ case SPECTRE_V2_NONE:
++ case SPECTRE_V2_EIBRS:
++ break;
++
++ case SPECTRE_V2_LFENCE:
++ case SPECTRE_V2_EIBRS_LFENCE:
++ setup_force_cpu_cap(X86_FEATURE_RETPOLINE_LFENCE);
++ /* fallthrough */
++
++ case SPECTRE_V2_RETPOLINE:
++ case SPECTRE_V2_EIBRS_RETPOLINE:
+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
++ break;
+ }
+
+-specv2_set_mode:
+ spectre_v2_enabled = mode;
+ pr_info("%s\n", spectre_v2_strings[mode]);
+
+@@ -941,7 +1020,7 @@ specv2_set_mode:
+ * the CPU supports Enhanced IBRS, kernel might un-intentionally not
+ * enable IBRS around firmware calls.
+ */
+- if (boot_cpu_has(X86_FEATURE_IBRS) && mode != SPECTRE_V2_IBRS_ENHANCED) {
++ if (boot_cpu_has(X86_FEATURE_IBRS) && !spectre_v2_in_eibrs_mode(mode)) {
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+ pr_info("Enabling Restricted Speculation for firmware calls\n");
+ }
+@@ -1011,6 +1090,10 @@ void arch_smt_update(void)
+ {
+ mutex_lock(&spec_ctrl_mutex);
+
++ if (sched_smt_active() && unprivileged_ebpf_enabled() &&
++ spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)
++ pr_warn_once(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG);
++
+ switch (spectre_v2_user_stibp) {
+ case SPECTRE_V2_USER_NONE:
+ break;
+@@ -1255,7 +1338,6 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
+ if (spectre_v2_user_ibpb == SPECTRE_V2_USER_NONE &&
+ spectre_v2_user_stibp == SPECTRE_V2_USER_NONE)
+ return 0;
+-
+ /*
+ * With strict mode for both IBPB and STIBP, the instruction
+ * code paths avoid checking this task flag and instead,
+@@ -1600,7 +1682,7 @@ static ssize_t tsx_async_abort_show_state(char *buf)
+
+ static char *stibp_state(void)
+ {
+- if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
++ if (spectre_v2_in_eibrs_mode(spectre_v2_enabled))
+ return "";
+
+ switch (spectre_v2_user_stibp) {
+@@ -1630,6 +1712,27 @@ static char *ibpb_state(void)
+ return "";
+ }
+
++static ssize_t spectre_v2_show_state(char *buf)
++{
++ if (spectre_v2_enabled == SPECTRE_V2_LFENCE)
++ return sprintf(buf, "Vulnerable: LFENCE\n");
++
++ if (spectre_v2_enabled == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
++ return sprintf(buf, "Vulnerable: eIBRS with unprivileged eBPF\n");
++
++ if (sched_smt_active() && unprivileged_ebpf_enabled() &&
++ spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)
++ return sprintf(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n");
++
++ return sprintf(buf, "%s%s%s%s%s%s\n",
++ spectre_v2_strings[spectre_v2_enabled],
++ ibpb_state(),
++ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
++ stibp_state(),
++ boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
++ spectre_v2_module_string());
++}
++
+ static ssize_t srbds_show_state(char *buf)
+ {
+ return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]);
+@@ -1655,12 +1758,7 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ return sprintf(buf, "%s\n", spectre_v1_strings[spectre_v1_mitigation]);
+
+ case X86_BUG_SPECTRE_V2:
+- return sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+- ibpb_state(),
+- boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
+- stibp_state(),
+- boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
+- spectre_v2_module_string());
++ return spectre_v2_show_state(buf);
+
+ case X86_BUG_SPEC_STORE_BYPASS:
+ return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index a9e07d09b230d..482d2e37e20c7 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1344,7 +1344,8 @@ free_shadow:
+ rinfo->ring_ref[i] = GRANT_INVALID_REF;
+ }
+ }
+- free_pages((unsigned long)rinfo->ring.sring, get_order(info->nr_ring_pages * XEN_PAGE_SIZE));
++ free_pages_exact(rinfo->ring.sring,
++ info->nr_ring_pages * XEN_PAGE_SIZE);
+ rinfo->ring.sring = NULL;
+
+ if (rinfo->irq)
+@@ -1428,9 +1429,15 @@ static int blkif_get_final_status(enum blk_req_status s1,
+ return BLKIF_RSP_OKAY;
+ }
+
+-static bool blkif_completion(unsigned long *id,
+- struct blkfront_ring_info *rinfo,
+- struct blkif_response *bret)
++/*
++ * Return values:
++ * 1 response processed.
++ * 0 missing further responses.
++ * -1 error while processing.
++ */
++static int blkif_completion(unsigned long *id,
++ struct blkfront_ring_info *rinfo,
++ struct blkif_response *bret)
+ {
+ int i = 0;
+ struct scatterlist *sg;
+@@ -1453,7 +1460,7 @@ static bool blkif_completion(unsigned long *id,
+
+ /* Wait the second response if not yet here. */
+ if (s2->status < REQ_DONE)
+- return false;
++ return 0;
+
+ bret->status = blkif_get_final_status(s->status,
+ s2->status);
+@@ -1504,42 +1511,43 @@ static bool blkif_completion(unsigned long *id,
+ }
+ /* Add the persistent grant into the list of free grants */
+ for (i = 0; i < num_grant; i++) {
+- if (gnttab_query_foreign_access(s->grants_used[i]->gref)) {
++ if (!gnttab_try_end_foreign_access(s->grants_used[i]->gref)) {
+ /*
+ * If the grant is still mapped by the backend (the
+ * backend has chosen to make this grant persistent)
+ * we add it at the head of the list, so it will be
+ * reused first.
+ */
+- if (!info->feature_persistent)
+- pr_alert_ratelimited("backed has not unmapped grant: %u\n",
+- s->grants_used[i]->gref);
++ if (!info->feature_persistent) {
++ pr_alert("backed has not unmapped grant: %u\n",
++ s->grants_used[i]->gref);
++ return -1;
++ }
+ list_add(&s->grants_used[i]->node, &rinfo->grants);
+ rinfo->persistent_gnts_c++;
+ } else {
+ /*
+- * If the grant is not mapped by the backend we end the
+- * foreign access and add it to the tail of the list,
+- * so it will not be picked again unless we run out of
+- * persistent grants.
++ * If the grant is not mapped by the backend we add it
++ * to the tail of the list, so it will not be picked
++ * again unless we run out of persistent grants.
+ */
+- gnttab_end_foreign_access(s->grants_used[i]->gref, 0, 0UL);
+ s->grants_used[i]->gref = GRANT_INVALID_REF;
+ list_add_tail(&s->grants_used[i]->node, &rinfo->grants);
+ }
+ }
+ if (s->req.operation == BLKIF_OP_INDIRECT) {
+ for (i = 0; i < INDIRECT_GREFS(num_grant); i++) {
+- if (gnttab_query_foreign_access(s->indirect_grants[i]->gref)) {
+- if (!info->feature_persistent)
+- pr_alert_ratelimited("backed has not unmapped grant: %u\n",
+- s->indirect_grants[i]->gref);
++ if (!gnttab_try_end_foreign_access(s->indirect_grants[i]->gref)) {
++ if (!info->feature_persistent) {
++ pr_alert("backed has not unmapped grant: %u\n",
++ s->indirect_grants[i]->gref);
++ return -1;
++ }
+ list_add(&s->indirect_grants[i]->node, &rinfo->grants);
+ rinfo->persistent_gnts_c++;
+ } else {
+ struct page *indirect_page;
+
+- gnttab_end_foreign_access(s->indirect_grants[i]->gref, 0, 0UL);
+ /*
+ * Add the used indirect page back to the list of
+ * available pages for indirect grefs.
+@@ -1554,7 +1562,7 @@ static bool blkif_completion(unsigned long *id,
+ }
+ }
+
+- return true;
++ return 1;
+ }
+
+ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+@@ -1620,12 +1628,17 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+ }
+
+ if (bret.operation != BLKIF_OP_DISCARD) {
++ int ret;
++
+ /*
+ * We may need to wait for an extra response if the
+ * I/O request is split in 2
+ */
+- if (!blkif_completion(&id, rinfo, &bret))
++ ret = blkif_completion(&id, rinfo, &bret);
++ if (!ret)
+ continue;
++ if (unlikely(ret < 0))
++ goto err;
+ }
+
+ if (add_id_to_freelist(rinfo, id)) {
+@@ -1731,8 +1744,7 @@ static int setup_blkring(struct xenbus_device *dev,
+ for (i = 0; i < info->nr_ring_pages; i++)
+ rinfo->ring_ref[i] = GRANT_INVALID_REF;
+
+- sring = (struct blkif_sring *)__get_free_pages(GFP_NOIO | __GFP_HIGH,
+- get_order(ring_size));
++ sring = alloc_pages_exact(ring_size, GFP_NOIO);
+ if (!sring) {
+ xenbus_dev_fatal(dev, -ENOMEM, "allocating shared ring");
+ return -ENOMEM;
+@@ -1742,7 +1754,7 @@ static int setup_blkring(struct xenbus_device *dev,
+
+ err = xenbus_grant_ring(dev, rinfo->ring.sring, info->nr_ring_pages, gref);
+ if (err < 0) {
+- free_pages((unsigned long)sring, get_order(ring_size));
++ free_pages_exact(sring, ring_size);
+ rinfo->ring.sring = NULL;
+ goto fail;
+ }
+@@ -2720,11 +2732,10 @@ static void purge_persistent_grants(struct blkfront_info *info)
+ list_for_each_entry_safe(gnt_list_entry, tmp, &rinfo->grants,
+ node) {
+ if (gnt_list_entry->gref == GRANT_INVALID_REF ||
+- gnttab_query_foreign_access(gnt_list_entry->gref))
++ !gnttab_try_end_foreign_access(gnt_list_entry->gref))
+ continue;
+
+ list_del(&gnt_list_entry->node);
+- gnttab_end_foreign_access(gnt_list_entry->gref, 0, 0UL);
+ rinfo->persistent_gnts_c--;
+ gnt_list_entry->gref = GRANT_INVALID_REF;
+ list_add_tail(&gnt_list_entry->node, &rinfo->grants);
+diff --git a/drivers/firmware/psci.c b/drivers/firmware/psci.c
+index c80ec1d032744..d855c20de663c 100644
+--- a/drivers/firmware/psci.c
++++ b/drivers/firmware/psci.c
+@@ -64,6 +64,21 @@ struct psci_operations psci_ops = {
+ .smccc_version = SMCCC_VERSION_1_0,
+ };
+
++enum arm_smccc_conduit arm_smccc_1_1_get_conduit(void)
++{
++ if (psci_ops.smccc_version < SMCCC_VERSION_1_1)
++ return SMCCC_CONDUIT_NONE;
++
++ switch (psci_ops.conduit) {
++ case PSCI_CONDUIT_SMC:
++ return SMCCC_CONDUIT_SMC;
++ case PSCI_CONDUIT_HVC:
++ return SMCCC_CONDUIT_HVC;
++ default:
++ return SMCCC_CONDUIT_NONE;
++ }
++}
++
+ typedef unsigned long (psci_fn)(unsigned long, unsigned long,
+ unsigned long, unsigned long);
+ static psci_fn *invoke_psci_fn;
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 7fb7c10ff9eb8..70af7830eed86 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -414,14 +414,12 @@ static bool xennet_tx_buf_gc(struct netfront_queue *queue)
+ queue->tx_link[id] = TX_LINK_NONE;
+ skb = queue->tx_skbs[id];
+ queue->tx_skbs[id] = NULL;
+- if (unlikely(gnttab_query_foreign_access(
+- queue->grant_tx_ref[id]) != 0)) {
++ if (unlikely(!gnttab_end_foreign_access_ref(
++ queue->grant_tx_ref[id], GNTMAP_readonly))) {
+ dev_alert(dev,
+ "Grant still in use by backend domain\n");
+ goto err;
+ }
+- gnttab_end_foreign_access_ref(
+- queue->grant_tx_ref[id], GNTMAP_readonly);
+ gnttab_release_grant_reference(
+ &queue->gref_tx_head, queue->grant_tx_ref[id]);
+ queue->grant_tx_ref[id] = GRANT_INVALID_REF;
+@@ -864,7 +862,6 @@ static int xennet_get_responses(struct netfront_queue *queue,
+ int max = XEN_NETIF_NR_SLOTS_MIN + (rx->status <= RX_COPY_THRESHOLD);
+ int slots = 1;
+ int err = 0;
+- unsigned long ret;
+
+ if (rx->flags & XEN_NETRXF_extra_info) {
+ err = xennet_get_extras(queue, extras, rp);
+@@ -895,8 +892,13 @@ static int xennet_get_responses(struct netfront_queue *queue,
+ goto next;
+ }
+
+- ret = gnttab_end_foreign_access_ref(ref, 0);
+- BUG_ON(!ret);
++ if (!gnttab_end_foreign_access_ref(ref, 0)) {
++ dev_alert(dev,
++ "Grant still in use by backend domain\n");
++ queue->info->broken = true;
++ dev_alert(dev, "Disabled for further use\n");
++ return -EINVAL;
++ }
+
+ gnttab_release_grant_reference(&queue->gref_rx_head, ref);
+
+@@ -1100,6 +1102,10 @@ static int xennet_poll(struct napi_struct *napi, int budget)
+ err = xennet_get_responses(queue, &rinfo, rp, &tmpq);
+
+ if (unlikely(err)) {
++ if (queue->info->broken) {
++ spin_unlock(&queue->rx_lock);
++ return 0;
++ }
+ err:
+ while ((skb = __skb_dequeue(&tmpq)))
+ __skb_queue_tail(&errq, skb);
+@@ -1678,7 +1684,7 @@ static int setup_netfront(struct xenbus_device *dev,
+ struct netfront_queue *queue, unsigned int feature_split_evtchn)
+ {
+ struct xen_netif_tx_sring *txs;
+- struct xen_netif_rx_sring *rxs;
++ struct xen_netif_rx_sring *rxs = NULL;
+ grant_ref_t gref;
+ int err;
+
+@@ -1698,21 +1704,21 @@ static int setup_netfront(struct xenbus_device *dev,
+
+ err = xenbus_grant_ring(dev, txs, 1, &gref);
+ if (err < 0)
+- goto grant_tx_ring_fail;
++ goto fail;
+ queue->tx_ring_ref = gref;
+
+ rxs = (struct xen_netif_rx_sring *)get_zeroed_page(GFP_NOIO | __GFP_HIGH);
+ if (!rxs) {
+ err = -ENOMEM;
+ xenbus_dev_fatal(dev, err, "allocating rx ring page");
+- goto alloc_rx_ring_fail;
++ goto fail;
+ }
+ SHARED_RING_INIT(rxs);
+ FRONT_RING_INIT(&queue->rx, rxs, XEN_PAGE_SIZE);
+
+ err = xenbus_grant_ring(dev, rxs, 1, &gref);
+ if (err < 0)
+- goto grant_rx_ring_fail;
++ goto fail;
+ queue->rx_ring_ref = gref;
+
+ if (feature_split_evtchn)
+@@ -1725,22 +1731,28 @@ static int setup_netfront(struct xenbus_device *dev,
+ err = setup_netfront_single(queue);
+
+ if (err)
+- goto alloc_evtchn_fail;
++ goto fail;
+
+ return 0;
+
+ /* If we fail to setup netfront, it is safe to just revoke access to
+ * granted pages because backend is not accessing it at this point.
+ */
+-alloc_evtchn_fail:
+- gnttab_end_foreign_access_ref(queue->rx_ring_ref, 0);
+-grant_rx_ring_fail:
+- free_page((unsigned long)rxs);
+-alloc_rx_ring_fail:
+- gnttab_end_foreign_access_ref(queue->tx_ring_ref, 0);
+-grant_tx_ring_fail:
+- free_page((unsigned long)txs);
+-fail:
++ fail:
++ if (queue->rx_ring_ref != GRANT_INVALID_REF) {
++ gnttab_end_foreign_access(queue->rx_ring_ref, 0,
++ (unsigned long)rxs);
++ queue->rx_ring_ref = GRANT_INVALID_REF;
++ } else {
++ free_page((unsigned long)rxs);
++ }
++ if (queue->tx_ring_ref != GRANT_INVALID_REF) {
++ gnttab_end_foreign_access(queue->tx_ring_ref, 0,
++ (unsigned long)txs);
++ queue->tx_ring_ref = GRANT_INVALID_REF;
++ } else {
++ free_page((unsigned long)txs);
++ }
+ return err;
+ }
+
+diff --git a/drivers/scsi/xen-scsifront.c b/drivers/scsi/xen-scsifront.c
+index 61389bdc79266..a1d822ae9fcaa 100644
+--- a/drivers/scsi/xen-scsifront.c
++++ b/drivers/scsi/xen-scsifront.c
+@@ -233,12 +233,11 @@ static void scsifront_gnttab_done(struct vscsifrnt_info *info,
+ return;
+
+ for (i = 0; i < shadow->nr_grants; i++) {
+- if (unlikely(gnttab_query_foreign_access(shadow->gref[i]))) {
++ if (unlikely(!gnttab_try_end_foreign_access(shadow->gref[i]))) {
+ shost_printk(KERN_ALERT, info->host, KBUILD_MODNAME
+ "grant still in use by backend\n");
+ BUG();
+ }
+- gnttab_end_foreign_access(shadow->gref[i], 0, 0UL);
+ }
+
+ kfree(shadow->sg);
+diff --git a/drivers/xen/gntalloc.c b/drivers/xen/gntalloc.c
+index 3fa40c723e8e9..edb0acd0b8323 100644
+--- a/drivers/xen/gntalloc.c
++++ b/drivers/xen/gntalloc.c
+@@ -169,20 +169,14 @@ undo:
+ __del_gref(gref);
+ }
+
+- /* It's possible for the target domain to map the just-allocated grant
+- * references by blindly guessing their IDs; if this is done, then
+- * __del_gref will leave them in the queue_gref list. They need to be
+- * added to the global list so that we can free them when they are no
+- * longer referenced.
+- */
+- if (unlikely(!list_empty(&queue_gref)))
+- list_splice_tail(&queue_gref, &gref_list);
+ mutex_unlock(&gref_mutex);
+ return rc;
+ }
+
+ static void __del_gref(struct gntalloc_gref *gref)
+ {
++ unsigned long addr;
++
+ if (gref->notify.flags & UNMAP_NOTIFY_CLEAR_BYTE) {
+ uint8_t *tmp = kmap(gref->page);
+ tmp[gref->notify.pgoff] = 0;
+@@ -196,21 +190,16 @@ static void __del_gref(struct gntalloc_gref *gref)
+ gref->notify.flags = 0;
+
+ if (gref->gref_id) {
+- if (gnttab_query_foreign_access(gref->gref_id))
+- return;
+-
+- if (!gnttab_end_foreign_access_ref(gref->gref_id, 0))
+- return;
+-
+- gnttab_free_grant_reference(gref->gref_id);
++ if (gref->page) {
++ addr = (unsigned long)page_to_virt(gref->page);
++ gnttab_end_foreign_access(gref->gref_id, 0, addr);
++ } else
++ gnttab_free_grant_reference(gref->gref_id);
+ }
+
+ gref_size--;
+ list_del(&gref->next_gref);
+
+- if (gref->page)
+- __free_page(gref->page);
+-
+ kfree(gref);
+ }
+
+diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
+index 97341fa75458e..e434a583ee7e2 100644
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -135,12 +135,9 @@ struct gnttab_ops {
+ */
+ unsigned long (*end_foreign_transfer_ref)(grant_ref_t ref);
+ /*
+- * Query the status of a grant entry. Ref parameter is reference of
+- * queried grant entry, return value is the status of queried entry.
+- * Detailed status(writing/reading) can be gotten from the return value
+- * by bit operations.
++ * Read the frame number related to a given grant reference.
+ */
+- int (*query_foreign_access)(grant_ref_t ref);
++ unsigned long (*read_frame)(grant_ref_t ref);
+ };
+
+ struct unmap_refs_callback_data {
+@@ -285,22 +282,6 @@ int gnttab_grant_foreign_access(domid_t domid, unsigned long frame,
+ }
+ EXPORT_SYMBOL_GPL(gnttab_grant_foreign_access);
+
+-static int gnttab_query_foreign_access_v1(grant_ref_t ref)
+-{
+- return gnttab_shared.v1[ref].flags & (GTF_reading|GTF_writing);
+-}
+-
+-static int gnttab_query_foreign_access_v2(grant_ref_t ref)
+-{
+- return grstatus[ref] & (GTF_reading|GTF_writing);
+-}
+-
+-int gnttab_query_foreign_access(grant_ref_t ref)
+-{
+- return gnttab_interface->query_foreign_access(ref);
+-}
+-EXPORT_SYMBOL_GPL(gnttab_query_foreign_access);
+-
+ static int gnttab_end_foreign_access_ref_v1(grant_ref_t ref, int readonly)
+ {
+ u16 flags, nflags;
+@@ -354,6 +335,16 @@ int gnttab_end_foreign_access_ref(grant_ref_t ref, int readonly)
+ }
+ EXPORT_SYMBOL_GPL(gnttab_end_foreign_access_ref);
+
++static unsigned long gnttab_read_frame_v1(grant_ref_t ref)
++{
++ return gnttab_shared.v1[ref].frame;
++}
++
++static unsigned long gnttab_read_frame_v2(grant_ref_t ref)
++{
++ return gnttab_shared.v2[ref].full_page.frame;
++}
++
+ struct deferred_entry {
+ struct list_head list;
+ grant_ref_t ref;
+@@ -383,12 +374,9 @@ static void gnttab_handle_deferred(struct timer_list *unused)
+ spin_unlock_irqrestore(&gnttab_list_lock, flags);
+ if (_gnttab_end_foreign_access_ref(entry->ref, entry->ro)) {
+ put_free_entry(entry->ref);
+- if (entry->page) {
+- pr_debug("freeing g.e. %#x (pfn %#lx)\n",
+- entry->ref, page_to_pfn(entry->page));
+- put_page(entry->page);
+- } else
+- pr_info("freeing g.e. %#x\n", entry->ref);
++ pr_debug("freeing g.e. %#x (pfn %#lx)\n",
++ entry->ref, page_to_pfn(entry->page));
++ put_page(entry->page);
+ kfree(entry);
+ entry = NULL;
+ } else {
+@@ -413,9 +401,18 @@ static void gnttab_handle_deferred(struct timer_list *unused)
+ static void gnttab_add_deferred(grant_ref_t ref, bool readonly,
+ struct page *page)
+ {
+- struct deferred_entry *entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
++ struct deferred_entry *entry;
++ gfp_t gfp = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
+ const char *what = KERN_WARNING "leaking";
+
++ entry = kmalloc(sizeof(*entry), gfp);
++ if (!page) {
++ unsigned long gfn = gnttab_interface->read_frame(ref);
++
++ page = pfn_to_page(gfn_to_pfn(gfn));
++ get_page(page);
++ }
++
+ if (entry) {
+ unsigned long flags;
+
+@@ -436,11 +433,21 @@ static void gnttab_add_deferred(grant_ref_t ref, bool readonly,
+ what, ref, page ? page_to_pfn(page) : -1);
+ }
+
++int gnttab_try_end_foreign_access(grant_ref_t ref)
++{
++ int ret = _gnttab_end_foreign_access_ref(ref, 0);
++
++ if (ret)
++ put_free_entry(ref);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(gnttab_try_end_foreign_access);
++
+ void gnttab_end_foreign_access(grant_ref_t ref, int readonly,
+ unsigned long page)
+ {
+- if (gnttab_end_foreign_access_ref(ref, readonly)) {
+- put_free_entry(ref);
++ if (gnttab_try_end_foreign_access(ref)) {
+ if (page != 0)
+ put_page(virt_to_page(page));
+ } else
+@@ -1297,7 +1304,7 @@ static const struct gnttab_ops gnttab_v1_ops = {
+ .update_entry = gnttab_update_entry_v1,
+ .end_foreign_access_ref = gnttab_end_foreign_access_ref_v1,
+ .end_foreign_transfer_ref = gnttab_end_foreign_transfer_ref_v1,
+- .query_foreign_access = gnttab_query_foreign_access_v1,
++ .read_frame = gnttab_read_frame_v1,
+ };
+
+ static const struct gnttab_ops gnttab_v2_ops = {
+@@ -1309,7 +1316,7 @@ static const struct gnttab_ops gnttab_v2_ops = {
+ .update_entry = gnttab_update_entry_v2,
+ .end_foreign_access_ref = gnttab_end_foreign_access_ref_v2,
+ .end_foreign_transfer_ref = gnttab_end_foreign_transfer_ref_v2,
+- .query_foreign_access = gnttab_query_foreign_access_v2,
++ .read_frame = gnttab_read_frame_v2,
+ };
+
+ static bool gnttab_need_v2(void)
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index d7438fdc57061..285bb8390a97b 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -346,8 +346,8 @@ static void free_active_ring(struct sock_mapping *map)
+ if (!map->active.ring)
+ return;
+
+- free_pages((unsigned long)map->active.data.in,
+- map->active.ring->ring_order);
++ free_pages_exact(map->active.data.in,
++ PAGE_SIZE << map->active.ring->ring_order);
+ free_page((unsigned long)map->active.ring);
+ }
+
+@@ -361,8 +361,8 @@ static int alloc_active_ring(struct sock_mapping *map)
+ goto out;
+
+ map->active.ring->ring_order = PVCALLS_RING_ORDER;
+- bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+- PVCALLS_RING_ORDER);
++ bytes = alloc_pages_exact(PAGE_SIZE << PVCALLS_RING_ORDER,
++ GFP_KERNEL | __GFP_ZERO);
+ if (!bytes)
+ goto out;
+
+diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
+index e35bb6b874491..6dde323dabd46 100644
+--- a/drivers/xen/xenbus/xenbus_client.c
++++ b/drivers/xen/xenbus/xenbus_client.c
+@@ -368,7 +368,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void *vaddr,
+ unsigned int nr_pages, grant_ref_t *grefs)
+ {
+ int err;
+- int i, j;
++ unsigned int i;
++ grant_ref_t gref_head;
++
++ err = gnttab_alloc_grant_references(nr_pages, &gref_head);
++ if (err) {
++ xenbus_dev_fatal(dev, err, "granting access to ring page");
++ return err;
++ }
+
+ for (i = 0; i < nr_pages; i++) {
+ unsigned long gfn;
+@@ -378,23 +385,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void *vaddr,
+ else
+ gfn = virt_to_gfn(vaddr);
+
+- err = gnttab_grant_foreign_access(dev->otherend_id, gfn, 0);
+- if (err < 0) {
+- xenbus_dev_fatal(dev, err,
+- "granting access to ring page");
+- goto fail;
+- }
+- grefs[i] = err;
++ grefs[i] = gnttab_claim_grant_reference(&gref_head);
++ gnttab_grant_foreign_access_ref(grefs[i], dev->otherend_id,
++ gfn, 0);
+
+ vaddr = vaddr + XEN_PAGE_SIZE;
+ }
+
+ return 0;
+-
+-fail:
+- for (j = 0; j < i; j++)
+- gnttab_end_foreign_access_ref(grefs[j], 0);
+- return err;
+ }
+ EXPORT_SYMBOL_GPL(xenbus_grant_ring);
+
+diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h
+index 18863d56273cc..6366b04c7d5f4 100644
+--- a/include/linux/arm-smccc.h
++++ b/include/linux/arm-smccc.h
+@@ -89,6 +89,22 @@
+
+ #include <linux/linkage.h>
+ #include <linux/types.h>
++
++enum arm_smccc_conduit {
++ SMCCC_CONDUIT_NONE,
++ SMCCC_CONDUIT_SMC,
++ SMCCC_CONDUIT_HVC,
++};
++
++/**
++ * arm_smccc_1_1_get_conduit()
++ *
++ * Returns the conduit to be used for SMCCCv1.1 or later.
++ *
++ * When SMCCCv1.1 is not present, returns SMCCC_CONDUIT_NONE.
++ */
++enum arm_smccc_conduit arm_smccc_1_1_get_conduit(void);
++
+ /**
+ * struct arm_smccc_res - Result from SMC/HVC call
+ * @a0-a3 result values from registers 0 to 3
+@@ -311,5 +327,63 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1,
+ #define SMCCC_RET_NOT_SUPPORTED -1
+ #define SMCCC_RET_NOT_REQUIRED -2
+
++/*
++ * Like arm_smccc_1_1* but always returns SMCCC_RET_NOT_SUPPORTED.
++ * Used when the SMCCC conduit is not defined. The empty asm statement
++ * avoids compiler warnings about unused variables.
++ */
++#define __fail_smccc_1_1(...) \
++ do { \
++ __declare_args(__count_args(__VA_ARGS__), __VA_ARGS__); \
++ asm ("" __constraints(__count_args(__VA_ARGS__))); \
++ if (___res) \
++ ___res->a0 = SMCCC_RET_NOT_SUPPORTED; \
++ } while (0)
++
++/*
++ * arm_smccc_1_1_invoke() - make an SMCCC v1.1 compliant call
++ *
++ * This is a variadic macro taking one to eight source arguments, and
++ * an optional return structure.
++ *
++ * @a0-a7: arguments passed in registers 0 to 7
++ * @res: result values from registers 0 to 3
++ *
++ * This macro will make either an HVC call or an SMC call depending on the
++ * current SMCCC conduit. If no valid conduit is available then -1
++ * (SMCCC_RET_NOT_SUPPORTED) is returned in @res.a0 (if supplied).
++ *
++ * The return value also provides the conduit that was used.
++ */
++#define arm_smccc_1_1_invoke(...) ({ \
++ int method = arm_smccc_1_1_get_conduit(); \
++ switch (method) { \
++ case SMCCC_CONDUIT_HVC: \
++ arm_smccc_1_1_hvc(__VA_ARGS__); \
++ break; \
++ case SMCCC_CONDUIT_SMC: \
++ arm_smccc_1_1_smc(__VA_ARGS__); \
++ break; \
++ default: \
++ __fail_smccc_1_1(__VA_ARGS__); \
++ method = SMCCC_CONDUIT_NONE; \
++ break; \
++ } \
++ method; \
++ })
++
++/* Paravirtualised time calls (defined by ARM DEN0057A) */
++#define ARM_SMCCC_HV_PV_TIME_FEATURES \
++ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
++ ARM_SMCCC_SMC_64, \
++ ARM_SMCCC_OWNER_STANDARD_HYP, \
++ 0x20)
++
++#define ARM_SMCCC_HV_PV_TIME_ST \
++ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
++ ARM_SMCCC_SMC_64, \
++ ARM_SMCCC_OWNER_STANDARD_HYP, \
++ 0x21)
++
+ #endif /*__ASSEMBLY__*/
+ #endif /*__LINUX_ARM_SMCCC_H*/
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 3b3337333cfd6..48e6d68ec5eec 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -533,6 +533,11 @@ static inline int bpf_map_attr_numa_node(const union bpf_attr *attr)
+ struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type type);
+ int array_map_alloc_check(union bpf_attr *attr);
+
++static inline bool unprivileged_ebpf_enabled(void)
++{
++ return !sysctl_unprivileged_bpf_disabled;
++}
++
+ #else /* !CONFIG_BPF_SYSCALL */
+ static inline struct bpf_prog *bpf_prog_get(u32 ufd)
+ {
+@@ -644,6 +649,12 @@ static inline struct bpf_prog *bpf_prog_get_type_path(const char *name,
+ {
+ return ERR_PTR(-EOPNOTSUPP);
+ }
++
++static inline bool unprivileged_ebpf_enabled(void)
++{
++ return false;
++}
++
+ #endif /* CONFIG_BPF_SYSCALL */
+
+ static inline struct bpf_prog *bpf_prog_get_type(u32 ufd,
+diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
+index a9978350b45b0..a58a89cc0e97d 100644
+--- a/include/xen/grant_table.h
++++ b/include/xen/grant_table.h
+@@ -97,17 +97,32 @@ int gnttab_end_foreign_access_ref(grant_ref_t ref, int readonly);
+ * access has been ended, free the given page too. Access will be ended
+ * immediately iff the grant entry is not in use, otherwise it will happen
+ * some time later. page may be 0, in which case no freeing will occur.
++ * Note that the granted page might still be accessed (read or write) by the
++ * other side after gnttab_end_foreign_access() returns, so even if page was
++ * specified as 0 it is not allowed to just reuse the page for other
++ * purposes immediately. gnttab_end_foreign_access() will take an additional
++ * reference to the granted page in this case, which is dropped only after
++ * the grant is no longer in use.
++ * This requires that multi page allocations for areas subject to
++ * gnttab_end_foreign_access() are done via alloc_pages_exact() (and freeing
++ * via free_pages_exact()) in order to avoid high order pages.
+ */
+ void gnttab_end_foreign_access(grant_ref_t ref, int readonly,
+ unsigned long page);
+
++/*
++ * End access through the given grant reference, iff the grant entry is
++ * no longer in use. In case of success ending foreign access, the
++ * grant reference is deallocated.
++ * Return 1 if the grant entry was freed, 0 if it is still in use.
++ */
++int gnttab_try_end_foreign_access(grant_ref_t ref);
++
+ int gnttab_grant_foreign_transfer(domid_t domid, unsigned long pfn);
+
+ unsigned long gnttab_end_foreign_transfer_ref(grant_ref_t ref);
+ unsigned long gnttab_end_foreign_transfer(grant_ref_t ref);
+
+-int gnttab_query_foreign_access(grant_ref_t ref);
+-
+ /*
+ * operations on reserved batches of grant references
+ */
+diff --git a/init/Kconfig b/init/Kconfig
+index 0fe4f60c974d7..15c02e15d3fd4 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -19,6 +19,9 @@ config GCC_VERSION
+ config CC_IS_CLANG
+ def_bool $(success,$(CC) --version | head -n 1 | grep -q clang)
+
++config LD_IS_LLD
++ def_bool $(success,$(LD) -v | head -n 1 | grep -q LLD)
++
+ config CLANG_VERSION
+ int
+ default $(shell,$(srctree)/scripts/clang-version.sh $(CC))
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 03af4a493affd..93a7bd4185d07 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -251,6 +251,11 @@ static int sysrq_sysctl_handler(struct ctl_table *table, int write,
+ #endif
+
+ #ifdef CONFIG_BPF_SYSCALL
++
++void __weak unpriv_ebpf_notify(int new_state)
++{
++}
++
+ static int bpf_unpriv_handler(struct ctl_table *table, int write,
+ void *buffer, size_t *lenp, loff_t *ppos)
+ {
+@@ -268,6 +273,9 @@ static int bpf_unpriv_handler(struct ctl_table *table, int write,
+ return -EPERM;
+ *(int *)table->data = unpriv_enable;
+ }
++
++ unpriv_ebpf_notify(unpriv_enable);
++
+ return ret;
+ }
+ #endif
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index 21132bf3d8503..ac60ddfcd88b6 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -301,9 +301,9 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
+ ref = priv->rings[i].intf->ref[j];
+ gnttab_end_foreign_access(ref, 0, 0);
+ }
+- free_pages((unsigned long)priv->rings[i].data.in,
+- XEN_9PFS_RING_ORDER -
+- (PAGE_SHIFT - XEN_PAGE_SHIFT));
++ free_pages_exact(priv->rings[i].data.in,
++ 1UL << (XEN_9PFS_RING_ORDER +
++ XEN_PAGE_SHIFT));
+ }
+ gnttab_end_foreign_access(priv->rings[i].ref, 0, 0);
+ free_page((unsigned long)priv->rings[i].intf);
+@@ -341,8 +341,8 @@ static int xen_9pfs_front_alloc_dataring(struct xenbus_device *dev,
+ if (ret < 0)
+ goto out;
+ ring->ref = ret;
+- bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+- XEN_9PFS_RING_ORDER - (PAGE_SHIFT - XEN_PAGE_SHIFT));
++ bytes = alloc_pages_exact(1UL << (XEN_9PFS_RING_ORDER + XEN_PAGE_SHIFT),
++ GFP_KERNEL | __GFP_ZERO);
+ if (!bytes) {
+ ret = -ENOMEM;
+ goto out;
+@@ -373,9 +373,7 @@ out:
+ if (bytes) {
+ for (i--; i >= 0; i--)
+ gnttab_end_foreign_access(ring->intf->ref[i], 0, 0);
+- free_pages((unsigned long)bytes,
+- XEN_9PFS_RING_ORDER -
+- (PAGE_SHIFT - XEN_PAGE_SHIFT));
++ free_pages_exact(bytes, 1UL << (XEN_9PFS_RING_ORDER + XEN_PAGE_SHIFT));
+ }
+ gnttab_end_foreign_access(ring->ref, 0, 0);
+ free_page((unsigned long)ring->intf);
+diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
+index 89a048c2faec7..beab4d4e4a354 100644
+--- a/tools/arch/x86/include/asm/cpufeatures.h
++++ b/tools/arch/x86/include/asm/cpufeatures.h
+@@ -203,7 +203,7 @@
+ #define X86_FEATURE_SME ( 7*32+10) /* AMD Secure Memory Encryption */
+ #define X86_FEATURE_PTI ( 7*32+11) /* Kernel Page Table Isolation enabled */
+ #define X86_FEATURE_RETPOLINE ( 7*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */
+-#define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* "" AMD Retpoline mitigation for Spectre variant 2 */
++#define X86_FEATURE_RETPOLINE_LFENCE ( 7*32+13) /* "" Use LFENCEs for Spectre variant 2 */
+ #define X86_FEATURE_INTEL_PPIN ( 7*32+14) /* Intel Processor Inventory Number */
+ #define X86_FEATURE_CDP_L2 ( 7*32+15) /* Code and Data Prioritization L2 */
+ #define X86_FEATURE_MSR_SPEC_CTRL ( 7*32+16) /* "" MSR SPEC_CTRL is implemented */
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-03-16 13:27 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-03-16 13:27 UTC (permalink / raw
To: gentoo-commits
commit: 2a8b8c076f80ab44d43ddeb20c80ddcfc9f5902a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 16 13:26:50 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 16 13:26:50 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2a8b8c07
Linux patch 4.19.235
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1234_linux-4.19.235.patch | 687 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 691 insertions(+)
diff --git a/0000_README b/0000_README
index 41e3b530..97b02019 100644
--- a/0000_README
+++ b/0000_README
@@ -975,6 +975,10 @@ Patch: 1233_linux-4.19.234.patch
From: https://www.kernel.org
Desc: Linux 4.19.234
+Patch: 1234_linux-4.19.235.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.235
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1234_linux-4.19.235.patch b/1234_linux-4.19.235.patch
new file mode 100644
index 00000000..e292bafc
--- /dev/null
+++ b/1234_linux-4.19.235.patch
@@ -0,0 +1,687 @@
+diff --git a/Makefile b/Makefile
+index f3f1a59ec25b5..6bfb0a18ee8ae 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 234
++SUBLEVEL = 235
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/include/asm/spectre.h b/arch/arm/include/asm/spectre.h
+index d1fa5607d3aa3..85f9e538fb325 100644
+--- a/arch/arm/include/asm/spectre.h
++++ b/arch/arm/include/asm/spectre.h
+@@ -25,7 +25,13 @@ enum {
+ SPECTRE_V2_METHOD_LOOP8 = BIT(__SPECTRE_V2_METHOD_LOOP8),
+ };
+
++#ifdef CONFIG_GENERIC_CPU_VULNERABILITIES
+ void spectre_v2_update_state(unsigned int state, unsigned int methods);
++#else
++static inline void spectre_v2_update_state(unsigned int state,
++ unsigned int methods)
++{}
++#endif
+
+ int spectre_bhb_update_vectors(unsigned int method);
+
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index 3ed860c8cd738..a929b6acb149e 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -1067,9 +1067,9 @@ vector_bhb_loop8_\name:
+
+ @ bhb workaround
+ mov r0, #8
+-1: b . + 4
++3: b . + 4
+ subs r0, r0, #1
+- bne 1b
++ bne 3b
+ dsb
+ isb
+ b 2b
+diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
+index 7c012ad1d7ede..4d29ceb26940e 100644
+--- a/arch/riscv/kernel/module.c
++++ b/arch/riscv/kernel/module.c
+@@ -21,6 +21,19 @@
+ #include <asm/pgtable.h>
+ #include <asm/sections.h>
+
++/*
++ * The auipc+jalr instruction pair can reach any PC-relative offset
++ * in the range [-2^31 - 2^11, 2^31 - 2^11)
++ */
++static bool riscv_insn_valid_32bit_offset(ptrdiff_t val)
++{
++#ifdef CONFIG_32BIT
++ return true;
++#else
++ return (-(1L << 31) - (1L << 11)) <= val && val < ((1L << 31) - (1L << 11));
++#endif
++}
++
+ static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v)
+ {
+ if (v != (u32)v) {
+@@ -103,7 +116,7 @@ static int apply_r_riscv_pcrel_hi20_rela(struct module *me, u32 *location,
+ ptrdiff_t offset = (void *)v - (void *)location;
+ s32 hi20;
+
+- if (offset != (s32)offset) {
++ if (!riscv_insn_valid_32bit_offset(offset)) {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+ me->name, (long long)v, location);
+@@ -205,10 +218,9 @@ static int apply_r_riscv_call_plt_rela(struct module *me, u32 *location,
+ Elf_Addr v)
+ {
+ ptrdiff_t offset = (void *)v - (void *)location;
+- s32 fill_v = offset;
+ u32 hi20, lo12;
+
+- if (offset != fill_v) {
++ if (!riscv_insn_valid_32bit_offset(offset)) {
+ /* Only emit the plt entry if offset over 32-bit range */
+ if (IS_ENABLED(CONFIG_MODULE_SECTIONS)) {
+ offset = module_emit_plt_entry(me, v);
+@@ -232,10 +244,9 @@ static int apply_r_riscv_call_rela(struct module *me, u32 *location,
+ Elf_Addr v)
+ {
+ ptrdiff_t offset = (void *)v - (void *)location;
+- s32 fill_v = offset;
+ u32 hi20, lo12;
+
+- if (offset != fill_v) {
++ if (!riscv_insn_valid_32bit_offset(offset)) {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+ me->name, (long long)v, location);
+diff --git a/drivers/gpio/gpio-ts4900.c b/drivers/gpio/gpio-ts4900.c
+index 1da8d05863295..410452306bf7b 100644
+--- a/drivers/gpio/gpio-ts4900.c
++++ b/drivers/gpio/gpio-ts4900.c
+@@ -1,7 +1,7 @@
+ /*
+ * Digital I/O driver for Technologic Systems I2C FPGA Core
+ *
+- * Copyright (C) 2015 Technologic Systems
++ * Copyright (C) 2015, 2018 Technologic Systems
+ * Copyright (C) 2016 Savoir-Faire Linux
+ *
+ * This program is free software; you can redistribute it and/or
+@@ -52,19 +52,33 @@ static int ts4900_gpio_direction_input(struct gpio_chip *chip,
+ {
+ struct ts4900_gpio_priv *priv = gpiochip_get_data(chip);
+
+- /*
+- * This will clear the output enable bit, the other bits are
+- * dontcare when this is cleared
++ /* Only clear the OE bit here, requires a RMW. Prevents potential issue
++ * with OE and data getting to the physical pin at different times.
+ */
+- return regmap_write(priv->regmap, offset, 0);
++ return regmap_update_bits(priv->regmap, offset, TS4900_GPIO_OE, 0);
+ }
+
+ static int ts4900_gpio_direction_output(struct gpio_chip *chip,
+ unsigned int offset, int value)
+ {
+ struct ts4900_gpio_priv *priv = gpiochip_get_data(chip);
++ unsigned int reg;
+ int ret;
+
++ /* If changing from an input to an output, we need to first set the
++ * proper data bit to what is requested and then set OE bit. This
++ * prevents a glitch that can occur on the IO line
++ */
++ regmap_read(priv->regmap, offset, ®);
++ if (!(reg & TS4900_GPIO_OE)) {
++ if (value)
++ reg = TS4900_GPIO_OUT;
++ else
++ reg &= ~TS4900_GPIO_OUT;
++
++ regmap_write(priv->regmap, offset, reg);
++ }
++
+ if (value)
+ ret = regmap_write(priv->regmap, offset, TS4900_GPIO_OE |
+ TS4900_GPIO_OUT);
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index f162ac7d74e59..460bb81acf2bf 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1269,7 +1269,14 @@ static int macb_poll(struct napi_struct *napi, int budget)
+ if (work_done < budget) {
+ napi_complete_done(napi, work_done);
+
+- /* Packets received while interrupts were disabled */
++ /* RSR bits only seem to propagate to raise interrupts when
++ * interrupts are enabled at the time, so if bits are already
++ * set due to packets received while interrupts were disabled,
++ * they will not cause another interrupt to be generated when
++ * interrupts are re-enabled.
++ * Check for this case here. This has been seen to happen
++ * around 30% of the time under heavy network load.
++ */
+ status = macb_readl(bp, RSR);
+ if (status) {
+ if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+@@ -1277,6 +1284,22 @@ static int macb_poll(struct napi_struct *napi, int budget)
+ napi_reschedule(napi);
+ } else {
+ queue_writel(queue, IER, bp->rx_intr_mask);
++
++ /* In rare cases, packets could have been received in
++ * the window between the check above and re-enabling
++ * interrupts. Therefore, a double-check is required
++ * to avoid losing a wakeup. This can potentially race
++ * with the interrupt handler doing the same actions
++ * if an interrupt is raised just after enabling them,
++ * but this should be harmless.
++ */
++ status = macb_readl(bp, RSR);
++ if (unlikely(status)) {
++ queue_writel(queue, IDR, bp->rx_intr_mask);
++ if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
++ queue_writel(queue, ISR, MACB_BIT(RCOMP));
++ napi_schedule(napi);
++ }
+ }
+ }
+
+diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c
+index 395a5266ea30a..0cddaaaf48aab 100644
+--- a/drivers/net/ethernet/freescale/gianfar_ethtool.c
++++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c
+@@ -1528,6 +1528,7 @@ static int gfar_get_ts_info(struct net_device *dev,
+ ptp_node = of_find_compatible_node(NULL, NULL, "fsl,etsec-ptp");
+ if (ptp_node) {
+ ptp_dev = of_find_device_by_node(ptp_node);
++ of_node_put(ptp_node);
+ if (ptp_dev)
+ ptp = platform_get_drvdata(ptp_dev);
+ }
+diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
+index 415ac33341c58..27c22f0e9d25b 100644
+--- a/drivers/net/ethernet/nxp/lpc_eth.c
++++ b/drivers/net/ethernet/nxp/lpc_eth.c
+@@ -1512,6 +1512,7 @@ static int lpc_eth_drv_resume(struct platform_device *pdev)
+ {
+ struct net_device *ndev = platform_get_drvdata(pdev);
+ struct netdata_local *pldat;
++ int ret;
+
+ if (device_may_wakeup(&pdev->dev))
+ disable_irq_wake(ndev->irq);
+@@ -1521,7 +1522,9 @@ static int lpc_eth_drv_resume(struct platform_device *pdev)
+ pldat = netdev_priv(ndev);
+
+ /* Enable interface clock */
+- clk_enable(pldat->clk);
++ ret = clk_enable(pldat->clk);
++ if (ret)
++ return ret;
+
+ /* Reset and initialize */
+ __lpc_eth_reset(pldat);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+index 886c7aae662fa..285231bc318bb 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+@@ -3800,11 +3800,11 @@ bool qed_iov_mark_vf_flr(struct qed_hwfn *p_hwfn, u32 *p_disabled_vfs)
+ return found;
+ }
+
+-static void qed_iov_get_link(struct qed_hwfn *p_hwfn,
+- u16 vfid,
+- struct qed_mcp_link_params *p_params,
+- struct qed_mcp_link_state *p_link,
+- struct qed_mcp_link_capabilities *p_caps)
++static int qed_iov_get_link(struct qed_hwfn *p_hwfn,
++ u16 vfid,
++ struct qed_mcp_link_params *p_params,
++ struct qed_mcp_link_state *p_link,
++ struct qed_mcp_link_capabilities *p_caps)
+ {
+ struct qed_vf_info *p_vf = qed_iov_get_vf_info(p_hwfn,
+ vfid,
+@@ -3812,7 +3812,7 @@ static void qed_iov_get_link(struct qed_hwfn *p_hwfn,
+ struct qed_bulletin_content *p_bulletin;
+
+ if (!p_vf)
+- return;
++ return -EINVAL;
+
+ p_bulletin = p_vf->bulletin.p_virt;
+
+@@ -3822,6 +3822,7 @@ static void qed_iov_get_link(struct qed_hwfn *p_hwfn,
+ __qed_vf_get_link_state(p_hwfn, p_link, p_bulletin);
+ if (p_caps)
+ __qed_vf_get_link_caps(p_hwfn, p_caps, p_bulletin);
++ return 0;
+ }
+
+ static int
+@@ -4676,6 +4677,7 @@ static int qed_get_vf_config(struct qed_dev *cdev,
+ struct qed_public_vf_info *vf_info;
+ struct qed_mcp_link_state link;
+ u32 tx_rate;
++ int ret;
+
+ /* Sanitize request */
+ if (IS_VF(cdev))
+@@ -4689,7 +4691,9 @@ static int qed_get_vf_config(struct qed_dev *cdev,
+
+ vf_info = qed_iov_get_public_vf_info(hwfn, vf_id, true);
+
+- qed_iov_get_link(hwfn, vf_id, NULL, &link, NULL);
++ ret = qed_iov_get_link(hwfn, vf_id, NULL, &link, NULL);
++ if (ret)
++ return ret;
+
+ /* Fill information about VF */
+ ivi->vf = vf_id;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+index 93a0fbf6a132b..e12338abaf0a8 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+@@ -539,6 +539,9 @@ int qed_vf_hw_prepare(struct qed_hwfn *p_hwfn)
+ p_iov->bulletin.size,
+ &p_iov->bulletin.phys,
+ GFP_KERNEL);
++ if (!p_iov->bulletin.p_virt)
++ goto free_pf2vf_reply;
++
+ DP_VERBOSE(p_hwfn, QED_MSG_IOV,
+ "VF's bulletin Board [%p virt 0x%llx phys 0x%08x bytes]\n",
+ p_iov->bulletin.p_virt,
+@@ -578,6 +581,10 @@ int qed_vf_hw_prepare(struct qed_hwfn *p_hwfn)
+
+ return rc;
+
++free_pf2vf_reply:
++ dma_free_coherent(&p_hwfn->cdev->pdev->dev,
++ sizeof(union pfvf_tlvs),
++ p_iov->pf2vf_reply, p_iov->pf2vf_reply_phys);
+ free_vf2pf_request:
+ dma_free_coherent(&p_hwfn->cdev->pdev->dev,
+ sizeof(union vfpf_tlvs),
+diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
+index 10b301e790864..01cc92f6a1f87 100644
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -445,7 +445,9 @@ int cpts_register(struct cpts *cpts)
+ for (i = 0; i < CPTS_MAX_EVENTS; i++)
+ list_add(&cpts->pool_data[i].list, &cpts->pool);
+
+- clk_enable(cpts->refclk);
++ err = clk_enable(cpts->refclk);
++ if (err)
++ return err;
+
+ cpts_write32(cpts, CPTS_EN, control);
+ cpts_write32(cpts, TS_PEND_EN, int_enable);
+diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+index edb2215f99930..23a4f9061072b 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+@@ -1173,7 +1173,7 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
+ if (rc) {
+ dev_err(dev,
+ "Cannot register network device, aborting\n");
+- goto error;
++ goto put_node;
+ }
+
+ dev_info(dev,
+@@ -1181,6 +1181,8 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
+ (unsigned int __force)ndev->mem_start, lp->base_addr, ndev->irq);
+ return 0;
+
++put_node:
++ of_node_put(lp->phy_node);
+ error:
+ free_netdev(ndev);
+ return rc;
+diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c
+index 6e8a2a4f3a6eb..9e2ed98f7df2b 100644
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -244,7 +244,7 @@ static int dp83822_config_intr(struct phy_device *phydev)
+ if (err < 0)
+ return err;
+
+- err = phy_write(phydev, MII_DP83822_MISR1, 0);
++ err = phy_write(phydev, MII_DP83822_MISR2, 0);
+ if (err < 0)
+ return err;
+
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index 78c56149559ce..6d7fb0a956452 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -499,6 +499,7 @@ static void backend_disconnect(struct backend_info *be)
+ unsigned int queue_index;
+
+ xen_unregister_watchers(vif);
++ xenbus_rm(XBT_NIL, be->dev->nodename, "hotplug-status");
+ #ifdef CONFIG_DEBUG_FS
+ xenvif_debugfs_delif(vif);
+ #endif /* CONFIG_DEBUG_FS */
+@@ -1043,15 +1044,11 @@ static void connect(struct backend_info *be)
+ xenvif_carrier_on(be->vif);
+
+ unregister_hotplug_status_watch(be);
+- if (xenbus_exists(XBT_NIL, dev->nodename, "hotplug-status")) {
+- err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
+- NULL, hotplug_status_changed,
+- "%s/%s", dev->nodename,
+- "hotplug-status");
+- if (err)
+- goto err;
++ err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch, NULL,
++ hotplug_status_changed,
++ "%s/%s", dev->nodename, "hotplug-status");
++ if (!err)
+ be->have_hotplug_status_watch = 1;
+- }
+
+ netif_tx_wake_all_queues(be->vif->dev);
+
+diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
+index 0f37acec98ab4..bc680b8be133b 100644
+--- a/drivers/nfc/port100.c
++++ b/drivers/nfc/port100.c
+@@ -1618,7 +1618,9 @@ free_nfc_dev:
+ nfc_digital_free_device(dev->nfc_digital_dev);
+
+ error:
++ usb_kill_urb(dev->in_urb);
+ usb_free_urb(dev->in_urb);
++ usb_kill_urb(dev->out_urb);
+ usb_free_urb(dev->out_urb);
+ usb_put_dev(dev->udev);
+
+diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c
+index 3c537807f4d14..eb6046087a916 100644
+--- a/drivers/staging/gdm724x/gdm_lte.c
++++ b/drivers/staging/gdm724x/gdm_lte.c
+@@ -76,14 +76,15 @@ static void tx_complete(void *arg)
+
+ static int gdm_lte_rx(struct sk_buff *skb, struct nic *nic, int nic_type)
+ {
+- int ret;
++ int ret, len;
+
++ len = skb->len + ETH_HLEN;
+ ret = netif_rx_ni(skb);
+ if (ret == NET_RX_DROP) {
+ nic->stats.rx_dropped++;
+ } else {
+ nic->stats.rx_packets++;
+- nic->stats.rx_bytes += skb->len + ETH_HLEN;
++ nic->stats.rx_bytes += len;
+ }
+
+ return 0;
+diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
+index 74f43ef2fb0f6..89935105df49e 100644
+--- a/drivers/virtio/virtio.c
++++ b/drivers/virtio/virtio.c
+@@ -165,14 +165,11 @@ void virtio_add_status(struct virtio_device *dev, unsigned int status)
+ }
+ EXPORT_SYMBOL_GPL(virtio_add_status);
+
+-int virtio_finalize_features(struct virtio_device *dev)
++/* Do some validation, then set FEATURES_OK */
++static int virtio_features_ok(struct virtio_device *dev)
+ {
+- int ret = dev->config->finalize_features(dev);
+ unsigned status;
+
+- if (ret)
+- return ret;
+-
+ if (!virtio_has_feature(dev, VIRTIO_F_VERSION_1))
+ return 0;
+
+@@ -185,7 +182,6 @@ int virtio_finalize_features(struct virtio_device *dev)
+ }
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(virtio_finalize_features);
+
+ static int virtio_dev_probe(struct device *_d)
+ {
+@@ -222,17 +218,6 @@ static int virtio_dev_probe(struct device *_d)
+ driver_features_legacy = driver_features;
+ }
+
+- /*
+- * Some devices detect legacy solely via F_VERSION_1. Write
+- * F_VERSION_1 to force LE config space accesses before FEATURES_OK for
+- * these when needed.
+- */
+- if (drv->validate && !virtio_legacy_is_little_endian()
+- && device_features & BIT_ULL(VIRTIO_F_VERSION_1)) {
+- dev->features = BIT_ULL(VIRTIO_F_VERSION_1);
+- dev->config->finalize_features(dev);
+- }
+-
+ if (device_features & (1ULL << VIRTIO_F_VERSION_1))
+ dev->features = driver_features & device_features;
+ else
+@@ -243,13 +228,26 @@ static int virtio_dev_probe(struct device *_d)
+ if (device_features & (1ULL << i))
+ __virtio_set_bit(dev, i);
+
++ err = dev->config->finalize_features(dev);
++ if (err)
++ goto err;
++
+ if (drv->validate) {
++ u64 features = dev->features;
++
+ err = drv->validate(dev);
+ if (err)
+ goto err;
++
++ /* Did validation change any features? Then write them again. */
++ if (features != dev->features) {
++ err = dev->config->finalize_features(dev);
++ if (err)
++ goto err;
++ }
+ }
+
+- err = virtio_finalize_features(dev);
++ err = virtio_features_ok(dev);
+ if (err)
+ goto err;
+
+@@ -413,7 +411,11 @@ int virtio_device_restore(struct virtio_device *dev)
+ /* We have a driver! */
+ virtio_add_status(dev, VIRTIO_CONFIG_S_DRIVER);
+
+- ret = virtio_finalize_features(dev);
++ ret = dev->config->finalize_features(dev);
++ if (ret)
++ goto err;
++
++ ret = virtio_features_ok(dev);
+ if (ret)
+ goto err;
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index bf46ed74eae67..d71f800e8bf60 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -8327,6 +8327,7 @@ struct extent_buffer *btrfs_alloc_tree_block(struct btrfs_trans_handle *trans,
+ out_free_delayed:
+ btrfs_free_delayed_extent_op(extent_op);
+ out_free_buf:
++ btrfs_tree_unlock(buf);
+ free_extent_buffer(buf);
+ out_free_reserved:
+ btrfs_free_reserved_extent(fs_info, ins.objectid, ins.offset, 0);
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 8098255c2801a..5f954620efbf2 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -74,6 +74,11 @@ int ext4_resize_begin(struct super_block *sb)
+ return -EPERM;
+ }
+
++ if (ext4_has_feature_sparse_super2(sb)) {
++ ext4_msg(sb, KERN_ERR, "Online resizing not supported with sparse_super2");
++ return -EOPNOTSUPP;
++ }
++
+ if (test_and_set_bit_lock(EXT4_FLAGS_RESIZING,
+ &EXT4_SB(sb)->s_ext4_flags))
+ ret = -EBUSY;
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index 5f711b2983db6..af040fcd2c5a9 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -8287,8 +8287,8 @@ struct mlx5_ifc_bufferx_reg_bits {
+ u8 reserved_at_0[0x6];
+ u8 lossy[0x1];
+ u8 epsb[0x1];
+- u8 reserved_at_8[0xc];
+- u8 size[0xc];
++ u8 reserved_at_8[0x8];
++ u8 size[0x10];
+
+ u8 xoff_threshold[0x10];
+ u8 xon_threshold[0x10];
+diff --git a/include/linux/virtio.h b/include/linux/virtio.h
+index fa1b5da2804e6..14f6cf650ecfe 100644
+--- a/include/linux/virtio.h
++++ b/include/linux/virtio.h
+@@ -151,7 +151,6 @@ void virtio_break_device(struct virtio_device *dev);
+ void virtio_config_changed(struct virtio_device *dev);
+ void virtio_config_disable(struct virtio_device *dev);
+ void virtio_config_enable(struct virtio_device *dev);
+-int virtio_finalize_features(struct virtio_device *dev);
+ #ifdef CONFIG_PM_SLEEP
+ int virtio_device_freeze(struct virtio_device *dev);
+ int virtio_device_restore(struct virtio_device *dev);
+diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
+index 32baf8e26735d..599e60f2e2a09 100644
+--- a/include/linux/virtio_config.h
++++ b/include/linux/virtio_config.h
+@@ -51,8 +51,9 @@ struct irq_affinity;
+ * Returns the first 32 feature bits (all we currently need).
+ * @finalize_features: confirm what device features we'll be using.
+ * vdev: the virtio_device
+- * This gives the final feature bits for the device: it can change
++ * This sends the driver feature bits to the device: it can change
+ * the dev->feature bits if it wants.
++ * Note: despite the name this can be called any number of times.
+ * Returns 0 on success or error status
+ * @bus_name: return the bus name associated with the device
+ * vdev: the virtio_device
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 19a6b088f1e72..063b434c89d26 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1118,10 +1118,12 @@ static int __init set_buf_size(char *str)
+ if (!str)
+ return 0;
+ buf_size = memparse(str, &str);
+- /* nr_entries can not be zero */
+- if (buf_size == 0)
+- return 0;
+- trace_buf_size = buf_size;
++ /*
++ * nr_entries can not be zero and the startup
++ * tests require some buffer space. Therefore
++ * ensure we have at least 4096 bytes of buffer.
++ */
++ trace_buf_size = max(4096UL, buf_size);
+ return 1;
+ }
+ __setup("trace_buf_size=", set_buf_size);
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index a2bf5e4e9fbee..3170b43b9f894 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -90,6 +90,13 @@ again:
+ ax25_for_each(s, &ax25_list) {
+ if (s->ax25_dev == ax25_dev) {
+ sk = s->sk;
++ if (!sk) {
++ spin_unlock_bh(&ax25_list_lock);
++ s->ax25_dev = NULL;
++ ax25_disconnect(s, ENETUNREACH);
++ spin_lock_bh(&ax25_list_lock);
++ goto again;
++ }
+ sock_hold(sk);
+ spin_unlock_bh(&ax25_list_lock);
+ lock_sock(sk);
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index e5dc04cb55992..7a11b2d90975d 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -203,7 +203,7 @@ static ssize_t speed_show(struct device *dev,
+ if (!rtnl_trylock())
+ return restart_syscall();
+
+- if (netif_running(netdev)) {
++ if (netif_running(netdev) && netif_device_present(netdev)) {
+ struct ethtool_link_ksettings cmd;
+
+ if (!__ethtool_get_link_ksettings(netdev, &cmd))
+diff --git a/net/sctp/diag.c b/net/sctp/diag.c
+index 0a9db0a7f4234..5f10984bf0f5d 100644
+--- a/net/sctp/diag.c
++++ b/net/sctp/diag.c
+@@ -76,10 +76,6 @@ static void inet_diag_msg_sctpasoc_fill(struct inet_diag_msg *r,
+ r->idiag_timer = SCTP_EVENT_TIMEOUT_T3_RTX;
+ r->idiag_retrans = asoc->rtx_data_chunks;
+ r->idiag_expires = jiffies_to_msecs(t3_rtx->expires - jiffies);
+- } else {
+- r->idiag_timer = 0;
+- r->idiag_retrans = 0;
+- r->idiag_expires = 0;
+ }
+ }
+
+@@ -159,13 +155,14 @@ static int inet_sctp_diag_fill(struct sock *sk, struct sctp_association *asoc,
+ r = nlmsg_data(nlh);
+ BUG_ON(!sk_fullsock(sk));
+
++ r->idiag_timer = 0;
++ r->idiag_retrans = 0;
++ r->idiag_expires = 0;
+ if (asoc) {
+ inet_diag_msg_sctpasoc_fill(r, sk, asoc);
+ } else {
+ inet_diag_msg_common_fill(r, sk);
+ r->idiag_state = sk->sk_state;
+- r->idiag_timer = 0;
+- r->idiag_retrans = 0;
+ }
+
+ if (inet_diag_msg_attrs_fill(sk, skb, r, ext, user_ns, net_admin))
+diff --git a/tools/testing/selftests/memfd/memfd_test.c b/tools/testing/selftests/memfd/memfd_test.c
+index 10baa1652fc2a..a4e520b94e431 100644
+--- a/tools/testing/selftests/memfd/memfd_test.c
++++ b/tools/testing/selftests/memfd/memfd_test.c
+@@ -386,6 +386,7 @@ static void mfd_fail_write(int fd)
+ printf("mmap()+mprotect() didn't fail as expected\n");
+ abort();
+ }
++ munmap(p, mfd_def_size);
+ }
+
+ /* verify PUNCH_HOLE fails */
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-03-23 11:57 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-03-23 11:57 UTC (permalink / raw
To: gentoo-commits
commit: 9a00dcdc364ac5b848d781e0c072bdef6dd84956
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 23 11:57:36 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Mar 23 11:57:36 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9a00dcdc
Linux patch 4.19.236
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1235_linux-4.19.236.patch | 2743 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2747 insertions(+)
diff --git a/0000_README b/0000_README
index 97b02019..0e8f7f4a 100644
--- a/0000_README
+++ b/0000_README
@@ -979,6 +979,10 @@ Patch: 1234_linux-4.19.235.patch
From: https://www.kernel.org
Desc: Linux 4.19.235
+Patch: 1235_linux-4.19.236.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.236
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1235_linux-4.19.236.patch b/1235_linux-4.19.236.patch
new file mode 100644
index 00000000..ab82a60a
--- /dev/null
+++ b/1235_linux-4.19.236.patch
@@ -0,0 +1,2743 @@
+diff --git a/Makefile b/Makefile
+index 6bfb0a18ee8ae..d83513c135206 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 235
++SUBLEVEL = 236
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
+index 2ff81f3736c85..e442bf7427ae1 100644
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -957,7 +957,7 @@
+ status = "disabled";
+ };
+
+- crypto: cypto-controller@ff8a0000 {
++ crypto: crypto@ff8a0000 {
+ compatible = "rockchip,rk3288-crypto";
+ reg = <0x0 0xff8a0000 0x0 0x4000>;
+ interrupts = <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
+index ae073fceb3f05..db20534912cdd 100644
+--- a/arch/arm/include/asm/kvm_host.h
++++ b/arch/arm/include/asm/kvm_host.h
+@@ -26,6 +26,7 @@
+ #include <asm/kvm_asm.h>
+ #include <asm/kvm_mmio.h>
+ #include <asm/fpstate.h>
++#include <asm/spectre.h>
+ #include <kvm/arm_arch_timer.h>
+
+ #define __KVM_HAVE_ARCH_INTC_INITIALIZED
+@@ -367,4 +368,10 @@ void kvm_arch_free_vm(struct kvm *kvm);
+
+ #define kvm_arm_vcpu_loaded(vcpu) (false)
+
++static inline int kvm_arm_get_spectre_bhb_state(void)
++{
++ /* 32bit guests don't need firmware for this */
++ return SPECTRE_VULNERABLE; /* aka SMCCC_RET_NOT_SUPPORTED */
++}
++
+ #endif /* __ARM_KVM_HOST_H__ */
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 1daefa57e2742..a101f5d2fbed4 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -979,6 +979,15 @@ config ARM64_SSBD
+
+ If unsure, say Y.
+
++config MITIGATE_SPECTRE_BRANCH_HISTORY
++ bool "Mitigate Spectre style attacks against branch history" if EXPERT
++ default y
++ help
++ Speculation attacks against some high-performance processors can
++ make use of branch history to influence future speculation.
++ When taking an exception from user-space, a sequence of branches
++ or a firmware call overwrites the branch history.
++
+ menuconfig ARMV8_DEPRECATED
+ bool "Emulate deprecated/obsolete ARMv8 instructions"
+ depends on COMPAT
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+index b155f657292bd..ce1320e4c1060 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+@@ -468,6 +468,12 @@
+ };
+
+ &sdhci {
++ /*
++ * Signal integrity isn't great at 200MHz but 100MHz has proven stable
++ * enough.
++ */
++ max-frequency = <100000000>;
++
+ bus-width = <8>;
+ mmc-hs400-1_8v;
+ mmc-hs400-enhanced-strobe;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index f70c053326865..5a60faa8e9998 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -1686,10 +1686,10 @@
+ interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH 0>;
+ clocks = <&cru PCLK_HDMI_CTRL>,
+ <&cru SCLK_HDMI_SFR>,
+- <&cru PLL_VPLL>,
++ <&cru SCLK_HDMI_CEC>,
+ <&cru PCLK_VIO_GRF>,
+- <&cru SCLK_HDMI_CEC>;
+- clock-names = "iahb", "isfr", "vpll", "grf", "cec";
++ <&cru PLL_VPLL>;
++ clock-names = "iahb", "isfr", "cec", "grf", "vpll";
+ power-domains = <&power RK3399_PD_HDCP>;
+ reg-io-width = <4>;
+ rockchip,grf = <&grf>;
+diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
+index 5a97ac8531682..fc3d26c954a40 100644
+--- a/arch/arm64/include/asm/assembler.h
++++ b/arch/arm64/include/asm/assembler.h
+@@ -126,6 +126,13 @@
+ hint #20
+ .endm
+
++/*
++ * Clear Branch History instruction
++ */
++ .macro clearbhb
++ hint #22
++ .endm
++
+ /*
+ * Sanitise a 64-bit bounded index wrt speculation, returning zero if out
+ * of bounds.
+@@ -711,4 +718,31 @@ USER(\label, ic ivau, \tmp2) // invalidate I line PoU
+ .Lyield_out_\@ :
+ .endm
+
++ .macro __mitigate_spectre_bhb_loop tmp
++#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY
++alternative_cb spectre_bhb_patch_loop_iter
++ mov \tmp, #32 // Patched to correct the immediate
++alternative_cb_end
++.Lspectre_bhb_loop\@:
++ b . + 4
++ subs \tmp, \tmp, #1
++ b.ne .Lspectre_bhb_loop\@
++ dsb nsh
++ isb
++#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */
++ .endm
++
++ /* Save/restores x0-x3 to the stack */
++ .macro __mitigate_spectre_bhb_fw
++#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY
++ stp x0, x1, [sp, #-16]!
++ stp x2, x3, [sp, #-16]!
++ mov w0, #ARM_SMCCC_ARCH_WORKAROUND_3
++alternative_cb arm64_update_smccc_conduit
++ nop // Patched to SMC/HVC #0
++alternative_cb_end
++ ldp x2, x3, [sp], #16
++ ldp x0, x1, [sp], #16
++#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */
++ .endm
+ #endif /* __ASM_ASSEMBLER_H */
+diff --git a/arch/arm64/include/asm/cpu.h b/arch/arm64/include/asm/cpu.h
+index 88392272250e8..3a9908a012190 100644
+--- a/arch/arm64/include/asm/cpu.h
++++ b/arch/arm64/include/asm/cpu.h
+@@ -36,6 +36,7 @@ struct cpuinfo_arm64 {
+ u64 reg_id_aa64dfr1;
+ u64 reg_id_aa64isar0;
+ u64 reg_id_aa64isar1;
++ u64 reg_id_aa64isar2;
+ u64 reg_id_aa64mmfr0;
+ u64 reg_id_aa64mmfr1;
+ u64 reg_id_aa64mmfr2;
+diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h
+index df8fe8ecc37e1..64ae14371cae9 100644
+--- a/arch/arm64/include/asm/cpucaps.h
++++ b/arch/arm64/include/asm/cpucaps.h
+@@ -54,7 +54,8 @@
+ #define ARM64_WORKAROUND_1463225 33
+ #define ARM64_SSBS 34
+ #define ARM64_WORKAROUND_1542419 35
++#define ARM64_SPECTRE_BHB 36
+
+-#define ARM64_NCAPS 36
++#define ARM64_NCAPS 37
+
+ #endif /* __ASM_CPUCAPS_H */
+diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
+index dda6e50568107..05f41d8f7db31 100644
+--- a/arch/arm64/include/asm/cpufeature.h
++++ b/arch/arm64/include/asm/cpufeature.h
+@@ -482,6 +482,34 @@ static inline bool cpu_supports_mixed_endian_el0(void)
+ return id_aa64mmfr0_mixed_endian_el0(read_cpuid(ID_AA64MMFR0_EL1));
+ }
+
++static inline bool supports_csv2p3(int scope)
++{
++ u64 pfr0;
++ u8 csv2_val;
++
++ if (scope == SCOPE_LOCAL_CPU)
++ pfr0 = read_sysreg_s(SYS_ID_AA64PFR0_EL1);
++ else
++ pfr0 = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1);
++
++ csv2_val = cpuid_feature_extract_unsigned_field(pfr0,
++ ID_AA64PFR0_CSV2_SHIFT);
++ return csv2_val == 3;
++}
++
++static inline bool supports_clearbhb(int scope)
++{
++ u64 isar2;
++
++ if (scope == SCOPE_LOCAL_CPU)
++ isar2 = read_sysreg_s(SYS_ID_AA64ISAR2_EL1);
++ else
++ isar2 = read_sanitised_ftr_reg(SYS_ID_AA64ISAR2_EL1);
++
++ return cpuid_feature_extract_unsigned_field(isar2,
++ ID_AA64ISAR2_CLEARBHB_SHIFT);
++}
++
+ static inline bool system_supports_32bit_el0(void)
+ {
+ return cpus_have_const_cap(ARM64_HAS_32BIT_EL0);
+@@ -527,6 +555,17 @@ static inline int arm64_get_ssbd_state(void)
+
+ void arm64_set_ssbd_mitigation(bool state);
+
++/* Watch out, ordering is important here. */
++enum mitigation_state {
++ SPECTRE_UNAFFECTED,
++ SPECTRE_MITIGATED,
++ SPECTRE_VULNERABLE,
++};
++
++enum mitigation_state arm64_get_spectre_bhb_state(void);
++bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, int scope);
++u8 spectre_bhb_loop_affected(int scope);
++void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *__unused);
+ #endif /* __ASSEMBLY__ */
+
+ #endif
+diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
+index 3cd936b1c79c1..50368f9622139 100644
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -81,6 +81,14 @@
+ #define ARM_CPU_PART_CORTEX_A55 0xD05
+ #define ARM_CPU_PART_CORTEX_A76 0xD0B
+ #define ARM_CPU_PART_NEOVERSE_N1 0xD0C
++#define ARM_CPU_PART_CORTEX_A77 0xD0D
++#define ARM_CPU_PART_NEOVERSE_V1 0xD40
++#define ARM_CPU_PART_CORTEX_A78 0xD41
++#define ARM_CPU_PART_CORTEX_X1 0xD44
++#define ARM_CPU_PART_CORTEX_A710 0xD47
++#define ARM_CPU_PART_CORTEX_X2 0xD48
++#define ARM_CPU_PART_NEOVERSE_N2 0xD49
++#define ARM_CPU_PART_CORTEX_A78C 0xD4B
+
+ #define APM_CPU_PART_POTENZA 0x000
+
+@@ -109,6 +117,14 @@
+ #define MIDR_CORTEX_A55 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A55)
+ #define MIDR_CORTEX_A76 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76)
+ #define MIDR_NEOVERSE_N1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N1)
++#define MIDR_CORTEX_A77 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A77)
++#define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1)
++#define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78)
++#define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1)
++#define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710)
++#define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2)
++#define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2)
++#define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C)
+ #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
+ #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
+ #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
+diff --git a/arch/arm64/include/asm/fixmap.h b/arch/arm64/include/asm/fixmap.h
+index ec1e6d6fa14cc..3c962ef081f84 100644
+--- a/arch/arm64/include/asm/fixmap.h
++++ b/arch/arm64/include/asm/fixmap.h
+@@ -59,9 +59,11 @@ enum fixed_addresses {
+ #endif /* CONFIG_ACPI_APEI_GHES */
+
+ #ifdef CONFIG_UNMAP_KERNEL_AT_EL0
++ FIX_ENTRY_TRAMP_TEXT3,
++ FIX_ENTRY_TRAMP_TEXT2,
++ FIX_ENTRY_TRAMP_TEXT1,
+ FIX_ENTRY_TRAMP_DATA,
+- FIX_ENTRY_TRAMP_TEXT,
+-#define TRAMP_VALIAS (__fix_to_virt(FIX_ENTRY_TRAMP_TEXT))
++#define TRAMP_VALIAS (__fix_to_virt(FIX_ENTRY_TRAMP_TEXT1))
+ #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */
+ __end_of_permanent_fixed_addresses,
+
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index 07472c138ced9..7e1b19ea07ea6 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -542,4 +542,9 @@ void kvm_arch_free_vm(struct kvm *kvm);
+
+ #define kvm_arm_vcpu_loaded(vcpu) ((vcpu)->arch.sysregs_loaded_on_cpu)
+
++static inline enum mitigation_state kvm_arm_get_spectre_bhb_state(void)
++{
++ return arm64_get_spectre_bhb_state();
++}
++
+ #endif /* __ARM64_KVM_HOST_H__ */
+diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
+index b2558447c67d7..44d3fdbcdf629 100644
+--- a/arch/arm64/include/asm/kvm_mmu.h
++++ b/arch/arm64/include/asm/kvm_mmu.h
+@@ -438,7 +438,8 @@ static inline void *kvm_get_hyp_vector(void)
+ void *vect = kern_hyp_va(kvm_ksym_ref(__kvm_hyp_vector));
+ int slot = -1;
+
+- if (cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) && data->fn) {
++ if ((cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) ||
++ cpus_have_const_cap(ARM64_SPECTRE_BHB)) && data->template_start) {
+ vect = kern_hyp_va(kvm_ksym_ref(__bp_harden_hyp_vecs_start));
+ slot = data->hyp_vectors_slot;
+ }
+@@ -467,7 +468,8 @@ static inline int kvm_map_vectors(void)
+ * !HBP + HEL2 -> allocate one vector slot and use exec mapping
+ * HBP + HEL2 -> use hardened vertors and use exec mapping
+ */
+- if (cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR)) {
++ if (cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) ||
++ cpus_have_const_cap(ARM64_SPECTRE_BHB)) {
+ __kvm_bp_vect_base = kvm_ksym_ref(__bp_harden_hyp_vecs_start);
+ __kvm_bp_vect_base = kern_hyp_va(__kvm_bp_vect_base);
+ }
+diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h
+index dd320df0d0269..b37d185e0e841 100644
+--- a/arch/arm64/include/asm/mmu.h
++++ b/arch/arm64/include/asm/mmu.h
+@@ -38,7 +38,7 @@ typedef struct {
+ */
+ #define ASID(mm) ((mm)->context.id.counter & 0xffff)
+
+-static inline bool arm64_kernel_unmapped_at_el0(void)
++static __always_inline bool arm64_kernel_unmapped_at_el0(void)
+ {
+ return IS_ENABLED(CONFIG_UNMAP_KERNEL_AT_EL0) &&
+ cpus_have_const_cap(ARM64_UNMAP_KERNEL_AT_EL0);
+@@ -49,6 +49,12 @@ typedef void (*bp_hardening_cb_t)(void);
+ struct bp_hardening_data {
+ int hyp_vectors_slot;
+ bp_hardening_cb_t fn;
++
++ /*
++ * template_start is only used by the BHB mitigation to identify the
++ * hyp_vectors_slot sequence.
++ */
++ const char *template_start;
+ };
+
+ #if (defined(CONFIG_HARDEN_BRANCH_PREDICTOR) || \
+diff --git a/arch/arm64/include/asm/sections.h b/arch/arm64/include/asm/sections.h
+index caab039d63055..8d3f1eab58e04 100644
+--- a/arch/arm64/include/asm/sections.h
++++ b/arch/arm64/include/asm/sections.h
+@@ -30,4 +30,9 @@ extern char __irqentry_text_start[], __irqentry_text_end[];
+ extern char __mmuoff_data_start[], __mmuoff_data_end[];
+ extern char __entry_tramp_text_start[], __entry_tramp_text_end[];
+
++static inline size_t entry_tramp_text_size(void)
++{
++ return __entry_tramp_text_end - __entry_tramp_text_start;
++}
++
+ #endif /* __ASM_SECTIONS_H */
+diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
+index ed99d941c4623..e90cf51b87eca 100644
+--- a/arch/arm64/include/asm/sysreg.h
++++ b/arch/arm64/include/asm/sysreg.h
+@@ -161,6 +161,7 @@
+
+ #define SYS_ID_AA64ISAR0_EL1 sys_reg(3, 0, 0, 6, 0)
+ #define SYS_ID_AA64ISAR1_EL1 sys_reg(3, 0, 0, 6, 1)
++#define SYS_ID_AA64ISAR2_EL1 sys_reg(3, 0, 0, 6, 2)
+
+ #define SYS_ID_AA64MMFR0_EL1 sys_reg(3, 0, 0, 7, 0)
+ #define SYS_ID_AA64MMFR1_EL1 sys_reg(3, 0, 0, 7, 1)
+@@ -526,6 +527,9 @@
+ #define ID_AA64ISAR1_JSCVT_SHIFT 12
+ #define ID_AA64ISAR1_DPB_SHIFT 0
+
++/* id_aa64isar2 */
++#define ID_AA64ISAR2_CLEARBHB_SHIFT 28
++
+ /* id_aa64pfr0 */
+ #define ID_AA64PFR0_CSV3_SHIFT 60
+ #define ID_AA64PFR0_CSV2_SHIFT 56
+@@ -583,6 +587,7 @@
+ #endif
+
+ /* id_aa64mmfr1 */
++#define ID_AA64MMFR1_ECBHB_SHIFT 60
+ #define ID_AA64MMFR1_PAN_SHIFT 20
+ #define ID_AA64MMFR1_LOR_SHIFT 16
+ #define ID_AA64MMFR1_HPD_SHIFT 12
+diff --git a/arch/arm64/include/asm/vectors.h b/arch/arm64/include/asm/vectors.h
+new file mode 100644
+index 0000000000000..695583b9a145b
+--- /dev/null
++++ b/arch/arm64/include/asm/vectors.h
+@@ -0,0 +1,74 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++/*
++ * Copyright (C) 2022 ARM Ltd.
++ */
++#ifndef __ASM_VECTORS_H
++#define __ASM_VECTORS_H
++
++#include <linux/bug.h>
++#include <linux/percpu.h>
++
++#include <asm/fixmap.h>
++#include <asm/mmu.h>
++
++extern char vectors[];
++extern char tramp_vectors[];
++extern char __bp_harden_el1_vectors[];
++
++/*
++ * Note: the order of this enum corresponds to two arrays in entry.S:
++ * tramp_vecs and __bp_harden_el1_vectors. By default the canonical
++ * 'full fat' vectors are used directly.
++ */
++enum arm64_bp_harden_el1_vectors {
++#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY
++ /*
++ * Perform the BHB loop mitigation, before branching to the canonical
++ * vectors.
++ */
++ EL1_VECTOR_BHB_LOOP,
++
++ /*
++ * Make the SMC call for firmware mitigation, before branching to the
++ * canonical vectors.
++ */
++ EL1_VECTOR_BHB_FW,
++
++ /*
++ * Use the ClearBHB instruction, before branching to the canonical
++ * vectors.
++ */
++ EL1_VECTOR_BHB_CLEAR_INSN,
++#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */
++
++ /*
++ * Remap the kernel before branching to the canonical vectors.
++ */
++ EL1_VECTOR_KPTI,
++};
++
++#ifndef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY
++#define EL1_VECTOR_BHB_LOOP -1
++#define EL1_VECTOR_BHB_FW -1
++#define EL1_VECTOR_BHB_CLEAR_INSN -1
++#endif /* !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */
++
++/* The vectors to use on return from EL0. e.g. to remap the kernel */
++DECLARE_PER_CPU_READ_MOSTLY(const char *, this_cpu_vector);
++
++#ifndef CONFIG_UNMAP_KERNEL_AT_EL0
++#define TRAMP_VALIAS 0
++#endif
++
++static inline const char *
++arm64_get_bp_hardening_vector(enum arm64_bp_harden_el1_vectors slot)
++{
++ if (arm64_kernel_unmapped_at_el0())
++ return (char *)TRAMP_VALIAS + SZ_2K * slot;
++
++ WARN_ON_ONCE(slot == EL1_VECTOR_KPTI);
++
++ return __bp_harden_el1_vectors + SZ_2K * slot;
++}
++
++#endif /* __ASM_VECTORS_H */
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index d191ce8410dba..d0b7dd60861bc 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -24,6 +24,7 @@
+ #include <asm/cputype.h>
+ #include <asm/cpufeature.h>
+ #include <asm/smp_plat.h>
++#include <asm/vectors.h>
+
+ static bool __maybe_unused
+ is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope)
+@@ -97,6 +98,16 @@ DEFINE_PER_CPU_READ_MOSTLY(struct bp_hardening_data, bp_hardening_data);
+ #ifdef CONFIG_KVM_INDIRECT_VECTORS
+ extern char __smccc_workaround_1_smc_start[];
+ extern char __smccc_workaround_1_smc_end[];
++extern char __smccc_workaround_3_smc_start[];
++extern char __smccc_workaround_3_smc_end[];
++extern char __spectre_bhb_loop_k8_start[];
++extern char __spectre_bhb_loop_k8_end[];
++extern char __spectre_bhb_loop_k24_start[];
++extern char __spectre_bhb_loop_k24_end[];
++extern char __spectre_bhb_loop_k32_start[];
++extern char __spectre_bhb_loop_k32_end[];
++extern char __spectre_bhb_clearbhb_start[];
++extern char __spectre_bhb_clearbhb_end[];
+
+ static void __copy_hyp_vect_bpi(int slot, const char *hyp_vecs_start,
+ const char *hyp_vecs_end)
+@@ -110,11 +121,11 @@ static void __copy_hyp_vect_bpi(int slot, const char *hyp_vecs_start,
+ __flush_icache_range((uintptr_t)dst, (uintptr_t)dst + SZ_2K);
+ }
+
++static DEFINE_SPINLOCK(bp_lock);
+ static void install_bp_hardening_cb(bp_hardening_cb_t fn,
+ const char *hyp_vecs_start,
+ const char *hyp_vecs_end)
+ {
+- static DEFINE_SPINLOCK(bp_lock);
+ int cpu, slot = -1;
+
+ spin_lock(&bp_lock);
+@@ -133,6 +144,7 @@ static void install_bp_hardening_cb(bp_hardening_cb_t fn,
+
+ __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
+ __this_cpu_write(bp_hardening_data.fn, fn);
++ __this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start);
+ spin_unlock(&bp_lock);
+ }
+ #else
+@@ -839,6 +851,13 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ .matches = has_ssbd_mitigation,
+ .midr_range_list = arm64_ssb_cpus,
+ },
++ {
++ .desc = "Spectre-BHB",
++ .capability = ARM64_SPECTRE_BHB,
++ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
++ .matches = is_spectre_bhb_affected,
++ .cpu_enable = spectre_bhb_enable_mitigation,
++ },
+ #ifdef CONFIG_ARM64_ERRATUM_1463225
+ {
+ .desc = "ARM erratum 1463225",
+@@ -875,14 +894,39 @@ ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr,
+ return sprintf(buf, "Mitigation: __user pointer sanitization\n");
+ }
+
++static const char *get_bhb_affected_string(enum mitigation_state bhb_state)
++{
++ switch (bhb_state) {
++ case SPECTRE_UNAFFECTED:
++ return "";
++ default:
++ case SPECTRE_VULNERABLE:
++ return ", but not BHB";
++ case SPECTRE_MITIGATED:
++ return ", BHB";
++ }
++}
++
+ ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+- if (__spectrev2_safe)
+- return sprintf(buf, "Not affected\n");
++ enum mitigation_state bhb_state = arm64_get_spectre_bhb_state();
++ const char *bhb_str = get_bhb_affected_string(bhb_state);
++ const char *v2_str = "Branch predictor hardening";
++
++ if (__spectrev2_safe) {
++ if (bhb_state == SPECTRE_UNAFFECTED)
++ return sprintf(buf, "Not affected\n");
++
++ /*
++ * Platforms affected by Spectre-BHB can't report
++ * "Not affected" for Spectre-v2.
++ */
++ v2_str = "CSV2";
++ }
+
+ if (__hardenbp_enab)
+- return sprintf(buf, "Mitigation: Branch predictor hardening\n");
++ return sprintf(buf, "Mitigation: %s%s\n", v2_str, bhb_str);
+
+ return sprintf(buf, "Vulnerable\n");
+ }
+@@ -903,3 +947,332 @@ ssize_t cpu_show_spec_store_bypass(struct device *dev,
+
+ return sprintf(buf, "Vulnerable\n");
+ }
++
++/*
++ * We try to ensure that the mitigation state can never change as the result of
++ * onlining a late CPU.
++ */
++static void update_mitigation_state(enum mitigation_state *oldp,
++ enum mitigation_state new)
++{
++ enum mitigation_state state;
++
++ do {
++ state = READ_ONCE(*oldp);
++ if (new <= state)
++ break;
++ } while (cmpxchg_relaxed(oldp, state, new) != state);
++}
++
++/*
++ * Spectre BHB.
++ *
++ * A CPU is either:
++ * - Mitigated by a branchy loop a CPU specific number of times, and listed
++ * in our "loop mitigated list".
++ * - Mitigated in software by the firmware Spectre v2 call.
++ * - Has the ClearBHB instruction to perform the mitigation.
++ * - Has the 'Exception Clears Branch History Buffer' (ECBHB) feature, so no
++ * software mitigation in the vectors is needed.
++ * - Has CSV2.3, so is unaffected.
++ */
++static enum mitigation_state spectre_bhb_state;
++
++enum mitigation_state arm64_get_spectre_bhb_state(void)
++{
++ return spectre_bhb_state;
++}
++
++/*
++ * This must be called with SCOPE_LOCAL_CPU for each type of CPU, before any
++ * SCOPE_SYSTEM call will give the right answer.
++ */
++u8 spectre_bhb_loop_affected(int scope)
++{
++ u8 k = 0;
++ static u8 max_bhb_k;
++
++ if (scope == SCOPE_LOCAL_CPU) {
++ static const struct midr_range spectre_bhb_k32_list[] = {
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ {},
++ };
++ static const struct midr_range spectre_bhb_k24_list[] = {
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A77),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
++ {},
++ };
++ static const struct midr_range spectre_bhb_k8_list[] = {
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A72),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A57),
++ {},
++ };
++
++ if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k32_list))
++ k = 32;
++ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k24_list))
++ k = 24;
++ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k8_list))
++ k = 8;
++
++ max_bhb_k = max(max_bhb_k, k);
++ } else {
++ k = max_bhb_k;
++ }
++
++ return k;
++}
++
++static enum mitigation_state spectre_bhb_get_cpu_fw_mitigation_state(void)
++{
++ int ret;
++ struct arm_smccc_res res;
++
++ if (psci_ops.smccc_version == SMCCC_VERSION_1_0)
++ return SPECTRE_VULNERABLE;
++
++ switch (psci_ops.conduit) {
++ case PSCI_CONDUIT_HVC:
++ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
++ ARM_SMCCC_ARCH_WORKAROUND_3, &res);
++ break;
++
++ case PSCI_CONDUIT_SMC:
++ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
++ ARM_SMCCC_ARCH_WORKAROUND_3, &res);
++ break;
++
++ default:
++ return SPECTRE_VULNERABLE;
++ }
++
++ ret = res.a0;
++ switch (ret) {
++ case SMCCC_RET_SUCCESS:
++ return SPECTRE_MITIGATED;
++ case SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED:
++ return SPECTRE_UNAFFECTED;
++ default:
++ case SMCCC_RET_NOT_SUPPORTED:
++ return SPECTRE_VULNERABLE;
++ }
++}
++
++static bool is_spectre_bhb_fw_affected(int scope)
++{
++ static bool system_affected;
++ enum mitigation_state fw_state;
++ bool has_smccc = (psci_ops.smccc_version >= SMCCC_VERSION_1_1);
++ static const struct midr_range spectre_bhb_firmware_mitigated_list[] = {
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A75),
++ {},
++ };
++ bool cpu_in_list = is_midr_in_range_list(read_cpuid_id(),
++ spectre_bhb_firmware_mitigated_list);
++
++ if (scope != SCOPE_LOCAL_CPU)
++ return system_affected;
++
++ fw_state = spectre_bhb_get_cpu_fw_mitigation_state();
++ if (cpu_in_list || (has_smccc && fw_state == SPECTRE_MITIGATED)) {
++ system_affected = true;
++ return true;
++ }
++
++ return false;
++}
++
++static bool supports_ecbhb(int scope)
++{
++ u64 mmfr1;
++
++ if (scope == SCOPE_LOCAL_CPU)
++ mmfr1 = read_sysreg_s(SYS_ID_AA64MMFR1_EL1);
++ else
++ mmfr1 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR1_EL1);
++
++ return cpuid_feature_extract_unsigned_field(mmfr1,
++ ID_AA64MMFR1_ECBHB_SHIFT);
++}
++
++bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry,
++ int scope)
++{
++ WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible());
++
++ if (supports_csv2p3(scope))
++ return false;
++
++ if (supports_clearbhb(scope))
++ return true;
++
++ if (spectre_bhb_loop_affected(scope))
++ return true;
++
++ if (is_spectre_bhb_fw_affected(scope))
++ return true;
++
++ return false;
++}
++
++static void this_cpu_set_vectors(enum arm64_bp_harden_el1_vectors slot)
++{
++ const char *v = arm64_get_bp_hardening_vector(slot);
++
++ if (slot < 0)
++ return;
++
++ __this_cpu_write(this_cpu_vector, v);
++
++ /*
++ * When KPTI is in use, the vectors are switched when exiting to
++ * user-space.
++ */
++ if (arm64_kernel_unmapped_at_el0())
++ return;
++
++ write_sysreg(v, vbar_el1);
++ isb();
++}
++
++#ifdef CONFIG_KVM_INDIRECT_VECTORS
++static const char *kvm_bhb_get_vecs_end(const char *start)
++{
++ if (start == __smccc_workaround_3_smc_start)
++ return __smccc_workaround_3_smc_end;
++ else if (start == __spectre_bhb_loop_k8_start)
++ return __spectre_bhb_loop_k8_end;
++ else if (start == __spectre_bhb_loop_k24_start)
++ return __spectre_bhb_loop_k24_end;
++ else if (start == __spectre_bhb_loop_k32_start)
++ return __spectre_bhb_loop_k32_end;
++ else if (start == __spectre_bhb_clearbhb_start)
++ return __spectre_bhb_clearbhb_end;
++
++ return NULL;
++}
++
++static void kvm_setup_bhb_slot(const char *hyp_vecs_start)
++{
++ int cpu, slot = -1;
++ const char *hyp_vecs_end;
++
++ if (!IS_ENABLED(CONFIG_KVM) || !is_hyp_mode_available())
++ return;
++
++ hyp_vecs_end = kvm_bhb_get_vecs_end(hyp_vecs_start);
++ if (WARN_ON_ONCE(!hyp_vecs_start || !hyp_vecs_end))
++ return;
++
++ spin_lock(&bp_lock);
++ for_each_possible_cpu(cpu) {
++ if (per_cpu(bp_hardening_data.template_start, cpu) == hyp_vecs_start) {
++ slot = per_cpu(bp_hardening_data.hyp_vectors_slot, cpu);
++ break;
++ }
++ }
++
++ if (slot == -1) {
++ slot = atomic_inc_return(&arm64_el2_vector_last_slot);
++ BUG_ON(slot >= BP_HARDEN_EL2_SLOTS);
++ __copy_hyp_vect_bpi(slot, hyp_vecs_start, hyp_vecs_end);
++ }
++
++ __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
++ __this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start);
++ spin_unlock(&bp_lock);
++}
++#else
++#define __smccc_workaround_3_smc_start NULL
++#define __spectre_bhb_loop_k8_start NULL
++#define __spectre_bhb_loop_k24_start NULL
++#define __spectre_bhb_loop_k32_start NULL
++#define __spectre_bhb_clearbhb_start NULL
++
++static void kvm_setup_bhb_slot(const char *hyp_vecs_start) { };
++#endif
++
++void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry)
++{
++ enum mitigation_state fw_state, state = SPECTRE_VULNERABLE;
++
++ if (!is_spectre_bhb_affected(entry, SCOPE_LOCAL_CPU))
++ return;
++
++ if (!__spectrev2_safe && !__hardenbp_enab) {
++ /* No point mitigating Spectre-BHB alone. */
++ } else if (!IS_ENABLED(CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY)) {
++ pr_info_once("spectre-bhb mitigation disabled by compile time option\n");
++ } else if (cpu_mitigations_off()) {
++ pr_info_once("spectre-bhb mitigation disabled by command line option\n");
++ } else if (supports_ecbhb(SCOPE_LOCAL_CPU)) {
++ state = SPECTRE_MITIGATED;
++ } else if (supports_clearbhb(SCOPE_LOCAL_CPU)) {
++ kvm_setup_bhb_slot(__spectre_bhb_clearbhb_start);
++ this_cpu_set_vectors(EL1_VECTOR_BHB_CLEAR_INSN);
++
++ state = SPECTRE_MITIGATED;
++ } else if (spectre_bhb_loop_affected(SCOPE_LOCAL_CPU)) {
++ switch (spectre_bhb_loop_affected(SCOPE_SYSTEM)) {
++ case 8:
++ kvm_setup_bhb_slot(__spectre_bhb_loop_k8_start);
++ break;
++ case 24:
++ kvm_setup_bhb_slot(__spectre_bhb_loop_k24_start);
++ break;
++ case 32:
++ kvm_setup_bhb_slot(__spectre_bhb_loop_k32_start);
++ break;
++ default:
++ WARN_ON_ONCE(1);
++ }
++ this_cpu_set_vectors(EL1_VECTOR_BHB_LOOP);
++
++ state = SPECTRE_MITIGATED;
++ } else if (is_spectre_bhb_fw_affected(SCOPE_LOCAL_CPU)) {
++ fw_state = spectre_bhb_get_cpu_fw_mitigation_state();
++ if (fw_state == SPECTRE_MITIGATED) {
++ kvm_setup_bhb_slot(__smccc_workaround_3_smc_start);
++ this_cpu_set_vectors(EL1_VECTOR_BHB_FW);
++
++ /*
++ * With WA3 in the vectors, the WA1 calls can be
++ * removed.
++ */
++ __this_cpu_write(bp_hardening_data.fn, NULL);
++
++ state = SPECTRE_MITIGATED;
++ }
++ }
++
++ update_mitigation_state(&spectre_bhb_state, state);
++}
++
++/* Patched to correct the immediate */
++void __init spectre_bhb_patch_loop_iter(struct alt_instr *alt,
++ __le32 *origptr, __le32 *updptr, int nr_inst)
++{
++ u8 rd;
++ u32 insn;
++ u16 loop_count = spectre_bhb_loop_affected(SCOPE_SYSTEM);
++
++ BUG_ON(nr_inst != 1); /* MOV -> MOV */
++
++ if (!IS_ENABLED(CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY))
++ return;
++
++ insn = le32_to_cpu(*origptr);
++ rd = aarch64_insn_decode_register(AARCH64_INSN_REGTYPE_RD, insn);
++ insn = aarch64_insn_gen_movewide(rd, loop_count, 0,
++ AARCH64_INSN_VARIANT_64BIT,
++ AARCH64_INSN_MOVEWIDE_ZERO);
++ *updptr++ = cpu_to_le32(insn);
++}
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index 122d5e843ab6d..03b0fdccaf052 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -20,11 +20,13 @@
+
+ #include <linux/bsearch.h>
+ #include <linux/cpumask.h>
++#include <linux/percpu.h>
+ #include <linux/sort.h>
+ #include <linux/stop_machine.h>
+ #include <linux/types.h>
+ #include <linux/mm.h>
+ #include <linux/cpu.h>
++
+ #include <asm/cpu.h>
+ #include <asm/cpufeature.h>
+ #include <asm/cpu_ops.h>
+@@ -33,6 +35,7 @@
+ #include <asm/processor.h>
+ #include <asm/sysreg.h>
+ #include <asm/traps.h>
++#include <asm/vectors.h>
+ #include <asm/virt.h>
+
+ unsigned long elf_hwcap __read_mostly;
+@@ -51,6 +54,8 @@ unsigned int compat_elf_hwcap2 __read_mostly;
+ DECLARE_BITMAP(cpu_hwcaps, ARM64_NCAPS);
+ EXPORT_SYMBOL(cpu_hwcaps);
+
++DEFINE_PER_CPU_READ_MOSTLY(const char *, this_cpu_vector) = vectors;
++
+ /*
+ * Flag to indicate if we have computed the system wide
+ * capabilities based on the boot time active CPUs. This
+@@ -145,6 +150,11 @@ static const struct arm64_ftr_bits ftr_id_aa64isar1[] = {
+ ARM64_FTR_END,
+ };
+
++static const struct arm64_ftr_bits ftr_id_aa64isar2[] = {
++ ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_HIGHER_SAFE, ID_AA64ISAR2_CLEARBHB_SHIFT, 4, 0),
++ ARM64_FTR_END,
++};
++
+ static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = {
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_CSV3_SHIFT, 4, 0),
+ ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_CSV2_SHIFT, 4, 0),
+@@ -391,6 +401,7 @@ static const struct __ftr_reg_entry {
+ /* Op1 = 0, CRn = 0, CRm = 6 */
+ ARM64_FTR_REG(SYS_ID_AA64ISAR0_EL1, ftr_id_aa64isar0),
+ ARM64_FTR_REG(SYS_ID_AA64ISAR1_EL1, ftr_id_aa64isar1),
++ ARM64_FTR_REG(SYS_ID_AA64ISAR2_EL1, ftr_id_aa64isar2),
+
+ /* Op1 = 0, CRn = 0, CRm = 7 */
+ ARM64_FTR_REG(SYS_ID_AA64MMFR0_EL1, ftr_id_aa64mmfr0),
+@@ -539,6 +550,7 @@ void __init init_cpu_features(struct cpuinfo_arm64 *info)
+ init_cpu_ftr_reg(SYS_ID_AA64DFR1_EL1, info->reg_id_aa64dfr1);
+ init_cpu_ftr_reg(SYS_ID_AA64ISAR0_EL1, info->reg_id_aa64isar0);
+ init_cpu_ftr_reg(SYS_ID_AA64ISAR1_EL1, info->reg_id_aa64isar1);
++ init_cpu_ftr_reg(SYS_ID_AA64ISAR2_EL1, info->reg_id_aa64isar2);
+ init_cpu_ftr_reg(SYS_ID_AA64MMFR0_EL1, info->reg_id_aa64mmfr0);
+ init_cpu_ftr_reg(SYS_ID_AA64MMFR1_EL1, info->reg_id_aa64mmfr1);
+ init_cpu_ftr_reg(SYS_ID_AA64MMFR2_EL1, info->reg_id_aa64mmfr2);
+@@ -656,6 +668,8 @@ void update_cpu_features(int cpu,
+ info->reg_id_aa64isar0, boot->reg_id_aa64isar0);
+ taint |= check_update_ftr_reg(SYS_ID_AA64ISAR1_EL1, cpu,
+ info->reg_id_aa64isar1, boot->reg_id_aa64isar1);
++ taint |= check_update_ftr_reg(SYS_ID_AA64ISAR2_EL1, cpu,
++ info->reg_id_aa64isar2, boot->reg_id_aa64isar2);
+
+ /*
+ * Differing PARange support is fine as long as all peripherals and
+@@ -789,6 +803,7 @@ static u64 __read_sysreg_by_encoding(u32 sys_id)
+ read_sysreg_case(SYS_ID_AA64MMFR2_EL1);
+ read_sysreg_case(SYS_ID_AA64ISAR0_EL1);
+ read_sysreg_case(SYS_ID_AA64ISAR1_EL1);
++ read_sysreg_case(SYS_ID_AA64ISAR2_EL1);
+
+ read_sysreg_case(SYS_CNTFRQ_EL0);
+ read_sysreg_case(SYS_CTR_EL0);
+@@ -963,6 +978,12 @@ kpti_install_ng_mappings(const struct arm64_cpu_capabilities *__unused)
+ static bool kpti_applied = false;
+ int cpu = smp_processor_id();
+
++ if (__this_cpu_read(this_cpu_vector) == vectors) {
++ const char *v = arm64_get_bp_hardening_vector(EL1_VECTOR_KPTI);
++
++ __this_cpu_write(this_cpu_vector, v);
++ }
++
+ if (kpti_applied)
+ return;
+
+diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
+index dce971f2c1673..36bd58d8ca11f 100644
+--- a/arch/arm64/kernel/cpuinfo.c
++++ b/arch/arm64/kernel/cpuinfo.c
+@@ -334,6 +334,7 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info)
+ info->reg_id_aa64dfr1 = read_cpuid(ID_AA64DFR1_EL1);
+ info->reg_id_aa64isar0 = read_cpuid(ID_AA64ISAR0_EL1);
+ info->reg_id_aa64isar1 = read_cpuid(ID_AA64ISAR1_EL1);
++ info->reg_id_aa64isar2 = read_cpuid(ID_AA64ISAR2_EL1);
+ info->reg_id_aa64mmfr0 = read_cpuid(ID_AA64MMFR0_EL1);
+ info->reg_id_aa64mmfr1 = read_cpuid(ID_AA64MMFR1_EL1);
+ info->reg_id_aa64mmfr2 = read_cpuid(ID_AA64MMFR2_EL1);
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 5f800384cb9a8..85433a84783b8 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -70,18 +70,21 @@
+
+ .macro kernel_ventry, el, label, regsize = 64
+ .align 7
+-#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+-alternative_if ARM64_UNMAP_KERNEL_AT_EL0
++.Lventry_start\@:
+ .if \el == 0
++ /*
++ * This must be the first instruction of the EL0 vector entries. It is
++ * skipped by the trampoline vectors, to trigger the cleanup.
++ */
++ b .Lskip_tramp_vectors_cleanup\@
+ .if \regsize == 64
+ mrs x30, tpidrro_el0
+ msr tpidrro_el0, xzr
+ .else
+ mov x30, xzr
+ .endif
++.Lskip_tramp_vectors_cleanup\@:
+ .endif
+-alternative_else_nop_endif
+-#endif
+
+ sub sp, sp, #S_FRAME_SIZE
+ #ifdef CONFIG_VMAP_STACK
+@@ -127,11 +130,15 @@ alternative_else_nop_endif
+ mrs x0, tpidrro_el0
+ #endif
+ b el\()\el\()_\label
++.org .Lventry_start\@ + 128 // Did we overflow the ventry slot?
+ .endm
+
+- .macro tramp_alias, dst, sym
++ .macro tramp_alias, dst, sym, tmp
+ mov_q \dst, TRAMP_VALIAS
+- add \dst, \dst, #(\sym - .entry.tramp.text)
++ adr_l \tmp, \sym
++ add \dst, \dst, \tmp
++ adr_l \tmp, .entry.tramp.text
++ sub \dst, \dst, \tmp
+ .endm
+
+ // This macro corrupts x0-x3. It is the caller's duty
+@@ -342,25 +349,29 @@ alternative_else_nop_endif
+ ldp x24, x25, [sp, #16 * 12]
+ ldp x26, x27, [sp, #16 * 13]
+ ldp x28, x29, [sp, #16 * 14]
+- ldr lr, [sp, #S_LR]
+- add sp, sp, #S_FRAME_SIZE // restore sp
+ /*
+ * ARCH_HAS_MEMBARRIER_SYNC_CORE rely on eret context synchronization
+ * when returning from IPI handler, and when returning to user-space.
+ */
+
+ .if \el == 0
+-alternative_insn eret, nop, ARM64_UNMAP_KERNEL_AT_EL0
++alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0
++ ldr lr, [sp, #S_LR]
++ add sp, sp, #S_FRAME_SIZE // restore sp
++ eret
++alternative_else_nop_endif
+ #ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+ bne 4f
+- msr far_el1, x30
+- tramp_alias x30, tramp_exit_native
++ msr far_el1, x29
++ tramp_alias x30, tramp_exit_native, x29
+ br x30
+ 4:
+- tramp_alias x30, tramp_exit_compat
++ tramp_alias x30, tramp_exit_compat, x29
+ br x30
+ #endif
+ .else
++ ldr lr, [sp, #S_LR]
++ add sp, sp, #S_FRAME_SIZE // restore sp
+ eret
+ .endif
+ .endm
+@@ -920,12 +931,7 @@ ENDPROC(el0_svc)
+
+ .popsection // .entry.text
+
+-#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+-/*
+- * Exception vectors trampoline.
+- */
+- .pushsection ".entry.tramp.text", "ax"
+-
++ // Move from tramp_pg_dir to swapper_pg_dir
+ .macro tramp_map_kernel, tmp
+ mrs \tmp, ttbr1_el1
+ add \tmp, \tmp, #(PAGE_SIZE + RESERVED_TTBR0_SIZE)
+@@ -957,12 +963,47 @@ alternative_else_nop_endif
+ */
+ .endm
+
+- .macro tramp_ventry, regsize = 64
++ .macro tramp_data_page dst
++ adr_l \dst, .entry.tramp.text
++ sub \dst, \dst, PAGE_SIZE
++ .endm
++
++ .macro tramp_data_read_var dst, var
++#ifdef CONFIG_RANDOMIZE_BASE
++ tramp_data_page \dst
++ add \dst, \dst, #:lo12:__entry_tramp_data_\var
++ ldr \dst, [\dst]
++#else
++ ldr \dst, =\var
++#endif
++ .endm
++
++#define BHB_MITIGATION_NONE 0
++#define BHB_MITIGATION_LOOP 1
++#define BHB_MITIGATION_FW 2
++#define BHB_MITIGATION_INSN 3
++
++ .macro tramp_ventry, vector_start, regsize, kpti, bhb
+ .align 7
+ 1:
+ .if \regsize == 64
+ msr tpidrro_el0, x30 // Restored in kernel_ventry
+ .endif
++
++ .if \bhb == BHB_MITIGATION_LOOP
++ /*
++ * This sequence must appear before the first indirect branch. i.e. the
++ * ret out of tramp_ventry. It appears here because x30 is free.
++ */
++ __mitigate_spectre_bhb_loop x30
++ .endif // \bhb == BHB_MITIGATION_LOOP
++
++ .if \bhb == BHB_MITIGATION_INSN
++ clearbhb
++ isb
++ .endif // \bhb == BHB_MITIGATION_INSN
++
++ .if \kpti == 1
+ /*
+ * Defend against branch aliasing attacks by pushing a dummy
+ * entry onto the return stack and using a RET instruction to
+@@ -972,43 +1013,75 @@ alternative_else_nop_endif
+ b .
+ 2:
+ tramp_map_kernel x30
+-#ifdef CONFIG_RANDOMIZE_BASE
+- adr x30, tramp_vectors + PAGE_SIZE
+ alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003
+- ldr x30, [x30]
+-#else
+- ldr x30, =vectors
+-#endif
+- prfm plil1strm, [x30, #(1b - tramp_vectors)]
++ tramp_data_read_var x30, vectors
++ prfm plil1strm, [x30, #(1b - \vector_start)]
+ msr vbar_el1, x30
+- add x30, x30, #(1b - tramp_vectors)
+ isb
++ .else
++ ldr x30, =vectors
++ .endif // \kpti == 1
++
++ .if \bhb == BHB_MITIGATION_FW
++ /*
++ * The firmware sequence must appear before the first indirect branch.
++ * i.e. the ret out of tramp_ventry. But it also needs the stack to be
++ * mapped to save/restore the registers the SMC clobbers.
++ */
++ __mitigate_spectre_bhb_fw
++ .endif // \bhb == BHB_MITIGATION_FW
++
++ add x30, x30, #(1b - \vector_start + 4)
+ ret
++.org 1b + 128 // Did we overflow the ventry slot?
+ .endm
+
+ .macro tramp_exit, regsize = 64
+- adr x30, tramp_vectors
++ tramp_data_read_var x30, this_cpu_vector
++alternative_if_not ARM64_HAS_VIRT_HOST_EXTN
++ mrs x29, tpidr_el1
++alternative_else
++ mrs x29, tpidr_el2
++alternative_endif
++ ldr x30, [x30, x29]
++
+ msr vbar_el1, x30
+- tramp_unmap_kernel x30
++ ldr lr, [sp, #S_LR]
++ tramp_unmap_kernel x29
+ .if \regsize == 64
+- mrs x30, far_el1
++ mrs x29, far_el1
+ .endif
++ add sp, sp, #S_FRAME_SIZE // restore sp
+ eret
+ .endm
+
+- .align 11
+-ENTRY(tramp_vectors)
++ .macro generate_tramp_vector, kpti, bhb
++.Lvector_start\@:
+ .space 0x400
+
+- tramp_ventry
+- tramp_ventry
+- tramp_ventry
+- tramp_ventry
++ .rept 4
++ tramp_ventry .Lvector_start\@, 64, \kpti, \bhb
++ .endr
++ .rept 4
++ tramp_ventry .Lvector_start\@, 32, \kpti, \bhb
++ .endr
++ .endm
+
+- tramp_ventry 32
+- tramp_ventry 32
+- tramp_ventry 32
+- tramp_ventry 32
++#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
++/*
++ * Exception vectors trampoline.
++ * The order must match __bp_harden_el1_vectors and the
++ * arm64_bp_harden_el1_vectors enum.
++ */
++ .pushsection ".entry.tramp.text", "ax"
++ .align 11
++ENTRY(tramp_vectors)
++#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY
++ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_LOOP
++ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_FW
++ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_INSN
++#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */
++ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_NONE
+ END(tramp_vectors)
+
+ ENTRY(tramp_exit_native)
+@@ -1026,11 +1099,55 @@ END(tramp_exit_compat)
+ .align PAGE_SHIFT
+ .globl __entry_tramp_data_start
+ __entry_tramp_data_start:
++__entry_tramp_data_vectors:
+ .quad vectors
++#ifdef CONFIG_ARM_SDE_INTERFACE
++__entry_tramp_data___sdei_asm_handler:
++ .quad __sdei_asm_handler
++#endif /* CONFIG_ARM_SDE_INTERFACE */
++__entry_tramp_data_this_cpu_vector:
++ .quad this_cpu_vector
+ .popsection // .rodata
+ #endif /* CONFIG_RANDOMIZE_BASE */
+ #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */
+
++/*
++ * Exception vectors for spectre mitigations on entry from EL1 when
++ * kpti is not in use.
++ */
++ .macro generate_el1_vector, bhb
++.Lvector_start\@:
++ kernel_ventry 1, sync_invalid // Synchronous EL1t
++ kernel_ventry 1, irq_invalid // IRQ EL1t
++ kernel_ventry 1, fiq_invalid // FIQ EL1t
++ kernel_ventry 1, error_invalid // Error EL1t
++
++ kernel_ventry 1, sync // Synchronous EL1h
++ kernel_ventry 1, irq // IRQ EL1h
++ kernel_ventry 1, fiq_invalid // FIQ EL1h
++ kernel_ventry 1, error // Error EL1h
++
++ .rept 4
++ tramp_ventry .Lvector_start\@, 64, 0, \bhb
++ .endr
++ .rept 4
++ tramp_ventry .Lvector_start\@, 32, 0, \bhb
++ .endr
++ .endm
++
++/* The order must match tramp_vecs and the arm64_bp_harden_el1_vectors enum. */
++ .pushsection ".entry.text", "ax"
++ .align 11
++ENTRY(__bp_harden_el1_vectors)
++#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY
++ generate_el1_vector bhb=BHB_MITIGATION_LOOP
++ generate_el1_vector bhb=BHB_MITIGATION_FW
++ generate_el1_vector bhb=BHB_MITIGATION_INSN
++#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */
++END(__bp_harden_el1_vectors)
++ .popsection
++
++
+ /*
+ * Register switch for AArch64. The callee-saved registers need to be saved
+ * and restored. On entry:
+@@ -1117,13 +1234,7 @@ ENTRY(__sdei_asm_entry_trampoline)
+ */
+ 1: str x4, [x1, #(SDEI_EVENT_INTREGS + S_ORIG_ADDR_LIMIT)]
+
+-#ifdef CONFIG_RANDOMIZE_BASE
+- adr x4, tramp_vectors + PAGE_SIZE
+- add x4, x4, #:lo12:__sdei_asm_trampoline_next_handler
+- ldr x4, [x4]
+-#else
+- ldr x4, =__sdei_asm_handler
+-#endif
++ tramp_data_read_var x4, __sdei_asm_handler
+ br x4
+ ENDPROC(__sdei_asm_entry_trampoline)
+ NOKPROBE(__sdei_asm_entry_trampoline)
+@@ -1146,12 +1257,6 @@ ENDPROC(__sdei_asm_exit_trampoline)
+ NOKPROBE(__sdei_asm_exit_trampoline)
+ .ltorg
+ .popsection // .entry.tramp.text
+-#ifdef CONFIG_RANDOMIZE_BASE
+-.pushsection ".rodata", "a"
+-__sdei_asm_trampoline_next_handler:
+- .quad __sdei_asm_handler
+-.popsection // .rodata
+-#endif /* CONFIG_RANDOMIZE_BASE */
+ #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */
+
+ /*
+@@ -1247,7 +1352,7 @@ alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0
+ alternative_else_nop_endif
+
+ #ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+- tramp_alias dst=x5, sym=__sdei_asm_exit_trampoline
++ tramp_alias dst=x5, sym=__sdei_asm_exit_trampoline, tmp=x3
+ br x5
+ #endif
+ ENDPROC(__sdei_asm_handler)
+diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
+index 69e7c8d4a00f6..370089455d38d 100644
+--- a/arch/arm64/kernel/vmlinux.lds.S
++++ b/arch/arm64/kernel/vmlinux.lds.S
+@@ -259,7 +259,7 @@ ASSERT(__hibernate_exit_text_end - (__hibernate_exit_text_start & ~(SZ_4K - 1))
+ <= SZ_4K, "Hibernate exit text too big or misaligned")
+ #endif
+ #ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+-ASSERT((__entry_tramp_text_end - __entry_tramp_text_start) == PAGE_SIZE,
++ASSERT((__entry_tramp_text_end - __entry_tramp_text_start) <= 3*PAGE_SIZE,
+ "Entry trampoline text too big")
+ #endif
+ /*
+diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S
+index ea063312bca18..01e518b82c495 100644
+--- a/arch/arm64/kvm/hyp/hyp-entry.S
++++ b/arch/arm64/kvm/hyp/hyp-entry.S
+@@ -135,6 +135,10 @@ el1_hvc_guest:
+ /* ARM_SMCCC_ARCH_WORKAROUND_2 handling */
+ eor w1, w1, #(ARM_SMCCC_ARCH_WORKAROUND_1 ^ \
+ ARM_SMCCC_ARCH_WORKAROUND_2)
++ cbz w1, wa_epilogue
++
++ eor w1, w1, #(ARM_SMCCC_ARCH_WORKAROUND_2 ^ \
++ ARM_SMCCC_ARCH_WORKAROUND_3)
+ cbnz w1, el1_trap
+
+ #ifdef CONFIG_ARM64_SSBD
+@@ -334,4 +338,64 @@ ENTRY(__smccc_workaround_1_smc_start)
+ ldp x0, x1, [sp, #(8 * 2)]
+ add sp, sp, #(8 * 4)
+ ENTRY(__smccc_workaround_1_smc_end)
++
++ENTRY(__smccc_workaround_3_smc_start)
++ esb
++ sub sp, sp, #(8 * 4)
++ stp x2, x3, [sp, #(8 * 0)]
++ stp x0, x1, [sp, #(8 * 2)]
++ mov w0, #ARM_SMCCC_ARCH_WORKAROUND_3
++ smc #0
++ ldp x2, x3, [sp, #(8 * 0)]
++ ldp x0, x1, [sp, #(8 * 2)]
++ add sp, sp, #(8 * 4)
++ENTRY(__smccc_workaround_3_smc_end)
++
++ENTRY(__spectre_bhb_loop_k8_start)
++ esb
++ sub sp, sp, #(8 * 2)
++ stp x0, x1, [sp, #(8 * 0)]
++ mov x0, #8
++2: b . + 4
++ subs x0, x0, #1
++ b.ne 2b
++ dsb nsh
++ isb
++ ldp x0, x1, [sp, #(8 * 0)]
++ add sp, sp, #(8 * 2)
++ENTRY(__spectre_bhb_loop_k8_end)
++
++ENTRY(__spectre_bhb_loop_k24_start)
++ esb
++ sub sp, sp, #(8 * 2)
++ stp x0, x1, [sp, #(8 * 0)]
++ mov x0, #24
++2: b . + 4
++ subs x0, x0, #1
++ b.ne 2b
++ dsb nsh
++ isb
++ ldp x0, x1, [sp, #(8 * 0)]
++ add sp, sp, #(8 * 2)
++ENTRY(__spectre_bhb_loop_k24_end)
++
++ENTRY(__spectre_bhb_loop_k32_start)
++ esb
++ sub sp, sp, #(8 * 2)
++ stp x0, x1, [sp, #(8 * 0)]
++ mov x0, #32
++2: b . + 4
++ subs x0, x0, #1
++ b.ne 2b
++ dsb nsh
++ isb
++ ldp x0, x1, [sp, #(8 * 0)]
++ add sp, sp, #(8 * 2)
++ENTRY(__spectre_bhb_loop_k32_end)
++
++ENTRY(__spectre_bhb_clearbhb_start)
++ esb
++ clearbhb
++ isb
++ENTRY(__spectre_bhb_clearbhb_end)
+ #endif
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index 1d16ce0b7e0d6..1c248c12a49e1 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -34,6 +34,7 @@
+ #include <asm/debug-monitors.h>
+ #include <asm/processor.h>
+ #include <asm/thread_info.h>
++#include <asm/vectors.h>
+
+ extern struct exception_table_entry __start___kvm_ex_table;
+ extern struct exception_table_entry __stop___kvm_ex_table;
+@@ -155,10 +156,13 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu)
+
+ static void deactivate_traps_vhe(void)
+ {
+- extern char vectors[]; /* kernel exception vectors */
++ const char *host_vectors = vectors;
+ write_sysreg(HCR_HOST_VHE_FLAGS, hcr_el2);
+ write_sysreg(CPACR_EL1_DEFAULT, cpacr_el1);
+- write_sysreg(vectors, vbar_el1);
++
++ if (!arm64_kernel_unmapped_at_el0())
++ host_vectors = __this_cpu_read(this_cpu_vector);
++ write_sysreg(host_vectors, vbar_el1);
+ }
+ NOKPROBE_SYMBOL(deactivate_traps_vhe);
+
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+index 98e8bc9195830..f06629bf2be16 100644
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -1289,7 +1289,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
+ /* CRm=6 */
+ ID_SANITISED(ID_AA64ISAR0_EL1),
+ ID_SANITISED(ID_AA64ISAR1_EL1),
+- ID_UNALLOCATED(6,2),
++ ID_SANITISED(ID_AA64ISAR2_EL1),
+ ID_UNALLOCATED(6,3),
+ ID_UNALLOCATED(6,4),
+ ID_UNALLOCATED(6,5),
+diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
+index 0fa558176fb10..b0a83dbed2dc4 100644
+--- a/arch/arm64/mm/mmu.c
++++ b/arch/arm64/mm/mmu.c
+@@ -541,6 +541,8 @@ early_param("rodata", parse_rodata);
+ #ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+ static int __init map_entry_trampoline(void)
+ {
++ int i;
++
+ pgprot_t prot = rodata_enabled ? PAGE_KERNEL_ROX : PAGE_KERNEL_EXEC;
+ phys_addr_t pa_start = __pa_symbol(__entry_tramp_text_start);
+
+@@ -549,11 +551,15 @@ static int __init map_entry_trampoline(void)
+
+ /* Map only the text into the trampoline page table */
+ memset(tramp_pg_dir, 0, PGD_SIZE);
+- __create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, PAGE_SIZE,
+- prot, pgd_pgtable_alloc, 0);
++ __create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS,
++ entry_tramp_text_size(), prot, pgd_pgtable_alloc,
++ 0);
+
+ /* Map both the text and data into the kernel page table */
+- __set_fixmap(FIX_ENTRY_TRAMP_TEXT, pa_start, prot);
++ for (i = 0; i < DIV_ROUND_UP(entry_tramp_text_size(), PAGE_SIZE); i++)
++ __set_fixmap(FIX_ENTRY_TRAMP_TEXT1 - i,
++ pa_start + i * PAGE_SIZE, prot);
++
+ if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) {
+ extern char __entry_tramp_data_start[];
+
+diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
+index 1dacbf5e9e09a..0c1dac64e77b8 100644
+--- a/arch/ia64/kernel/acpi.c
++++ b/arch/ia64/kernel/acpi.c
+@@ -537,7 +537,8 @@ void __init acpi_numa_fixup(void)
+ if (srat_num_cpus == 0) {
+ node_set_online(0);
+ node_cpuid[0].phys_id = hard_smp_processor_id();
+- return;
++ node_distance(0, 0) = LOCAL_DISTANCE;
++ goto out;
+ }
+
+ /*
+@@ -580,7 +581,7 @@ void __init acpi_numa_fixup(void)
+ for (j = 0; j < MAX_NUMNODES; j++)
+ node_distance(i, j) = i == j ? LOCAL_DISTANCE :
+ REMOTE_DISTANCE;
+- return;
++ goto out;
+ }
+
+ memset(numa_slit, -1, sizeof(numa_slit));
+@@ -605,6 +606,8 @@ void __init acpi_numa_fixup(void)
+ printk("\n");
+ }
+ #endif
++out:
++ node_possible_map = node_online_map;
+ }
+ #endif /* CONFIG_ACPI_NUMA */
+
+diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
+index d84b9066b4654..7206a6977be9b 100644
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -372,6 +372,9 @@ asmlinkage void start_secondary(void)
+ cpu = smp_processor_id();
+ cpu_data[cpu].udelay_val = loops_per_jiffy;
+
++ set_cpu_sibling_map(cpu);
++ set_cpu_core_map(cpu);
++
+ cpumask_set_cpu(cpu, &cpu_coherent_mask);
+ notify_cpu_starting(cpu);
+
+@@ -383,9 +386,6 @@ asmlinkage void start_secondary(void)
+ /* The CPU is running and counters synchronised, now mark it online */
+ set_cpu_online(cpu, true);
+
+- set_cpu_sibling_map(cpu);
+- set_cpu_core_map(cpu);
+-
+ calculate_cpu_foreign_map();
+
+ /*
+diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
+index 1409d48affb70..f256aeeac1b3f 100644
+--- a/drivers/atm/eni.c
++++ b/drivers/atm/eni.c
+@@ -1114,6 +1114,8 @@ DPRINTK("iovcnt = %d\n",skb_shinfo(skb)->nr_frags);
+ }
+ paddr = dma_map_single(&eni_dev->pci_dev->dev,skb->data,skb->len,
+ DMA_TO_DEVICE);
++ if (dma_mapping_error(&eni_dev->pci_dev->dev, paddr))
++ return enq_next;
+ ENI_PRV_PADDR(skb) = paddr;
+ /* prepare DMA queue entries */
+ j = 0;
+diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
+index ef395b238816c..f7880012b9a01 100644
+--- a/drivers/atm/firestream.c
++++ b/drivers/atm/firestream.c
+@@ -1692,6 +1692,8 @@ static int fs_init(struct fs_dev *dev)
+ dev->hw_base = pci_resource_start(pci_dev, 0);
+
+ dev->base = ioremap(dev->hw_base, 0x1000);
++ if (!dev->base)
++ return 1;
+
+ reset_chip (dev);
+
+diff --git a/drivers/crypto/qcom-rng.c b/drivers/crypto/qcom-rng.c
+index e54249ccc0092..e41ca58bf7b6d 100644
+--- a/drivers/crypto/qcom-rng.c
++++ b/drivers/crypto/qcom-rng.c
+@@ -7,6 +7,7 @@
+ #include <linux/acpi.h>
+ #include <linux/clk.h>
+ #include <linux/crypto.h>
++#include <linux/iopoll.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+@@ -42,16 +43,19 @@ static int qcom_rng_read(struct qcom_rng *rng, u8 *data, unsigned int max)
+ {
+ unsigned int currsize = 0;
+ u32 val;
++ int ret;
+
+ /* read random data from hardware */
+ do {
+- val = readl_relaxed(rng->base + PRNG_STATUS);
+- if (!(val & PRNG_STATUS_DATA_AVAIL))
+- break;
++ ret = readl_poll_timeout(rng->base + PRNG_STATUS, val,
++ val & PRNG_STATUS_DATA_AVAIL,
++ 200, 10000);
++ if (ret)
++ return ret;
+
+ val = readl_relaxed(rng->base + PRNG_DATA_OUT);
+ if (!val)
+- break;
++ return -EINVAL;
+
+ if ((max - currsize) >= WORD_SZ) {
+ memcpy(data, &val, WORD_SZ);
+@@ -60,11 +64,10 @@ static int qcom_rng_read(struct qcom_rng *rng, u8 *data, unsigned int max)
+ } else {
+ /* copy only remaining bytes */
+ memcpy(data, &val, max - currsize);
+- break;
+ }
+ } while (currsize < max);
+
+- return currsize;
++ return 0;
+ }
+
+ static int qcom_rng_generate(struct crypto_rng *tfm,
+@@ -86,7 +89,7 @@ static int qcom_rng_generate(struct crypto_rng *tfm,
+ mutex_unlock(&rng->lock);
+ clk_disable_unprepare(rng->clk);
+
+- return 0;
++ return ret;
+ }
+
+ static int qcom_rng_seed(struct crypto_rng *tfm, const u8 *seed,
+diff --git a/drivers/firmware/efi/apple-properties.c b/drivers/firmware/efi/apple-properties.c
+index 60a95719ecb86..726a23d45da4c 100644
+--- a/drivers/firmware/efi/apple-properties.c
++++ b/drivers/firmware/efi/apple-properties.c
+@@ -34,7 +34,7 @@ static bool dump_properties __initdata;
+ static int __init dump_properties_enable(char *arg)
+ {
+ dump_properties = true;
+- return 0;
++ return 1;
+ }
+
+ __setup("dump_apple_properties", dump_properties_enable);
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index a8180f9090fae..7098744f9276a 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -245,7 +245,7 @@ static int __init efivar_ssdt_setup(char *str)
+ memcpy(efivar_ssdt, str, strlen(str));
+ else
+ pr_warn("efivar_ssdt: name too long: %s\n", str);
+- return 0;
++ return 1;
+ }
+ __setup("efivar_ssdt=", efivar_ssdt_setup);
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 8814aa38c5e7b..a424afdcc77a1 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -1244,7 +1244,7 @@ static const struct display_timing innolux_g070y2_l01_timing = {
+ static const struct panel_desc innolux_g070y2_l01 = {
+ .timings = &innolux_g070y2_l01_timing,
+ .num_timings = 1,
+- .bpc = 6,
++ .bpc = 8,
+ .size = {
+ .width = 152,
+ .height = 91,
+diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
+index dc2ad1cc8fe1d..8f418d984a2d6 100644
+--- a/drivers/input/tablet/aiptek.c
++++ b/drivers/input/tablet/aiptek.c
+@@ -1814,15 +1814,13 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0);
+ input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0);
+
+- /* Verify that a device really has an endpoint */
+- if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
++ err = usb_find_common_endpoints(intf->cur_altsetting,
++ NULL, NULL, &endpoint, NULL);
++ if (err) {
+ dev_err(&intf->dev,
+- "interface has %d endpoints, but must have minimum 1\n",
+- intf->cur_altsetting->desc.bNumEndpoints);
+- err = -EINVAL;
++ "interface has no int in endpoints, but must have minimum 1\n");
+ goto fail3;
+ }
+- endpoint = &intf->cur_altsetting->endpoint[0].desc;
+
+ /* Go set up our URB, which is called when the tablet receives
+ * input.
+diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
+index 786d852a70d58..a1634834b640e 100644
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -1602,15 +1602,15 @@ static int rcar_canfd_channel_probe(struct rcar_canfd_global *gpriv, u32 ch,
+
+ netif_napi_add(ndev, &priv->napi, rcar_canfd_rx_poll,
+ RCANFD_NAPI_WEIGHT);
++ spin_lock_init(&priv->tx_lock);
++ devm_can_led_init(ndev);
++ gpriv->ch[priv->channel] = priv;
+ err = register_candev(ndev);
+ if (err) {
+ dev_err(&pdev->dev,
+ "register_candev() failed, error %d\n", err);
+ goto fail_candev;
+ }
+- spin_lock_init(&priv->tx_lock);
+- devm_can_led_init(ndev);
+- gpriv->ch[priv->channel] = priv;
+ dev_info(&pdev->dev, "device registered (channel %u)\n", priv->channel);
+ return 0;
+
+diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
+index dfad93fca0a61..0fa64b8b79bf2 100644
+--- a/drivers/net/ethernet/sfc/mcdi.c
++++ b/drivers/net/ethernet/sfc/mcdi.c
+@@ -166,9 +166,9 @@ static void efx_mcdi_send_request(struct efx_nic *efx, unsigned cmd,
+ /* Serialise with efx_mcdi_ev_cpl() and efx_mcdi_ev_death() */
+ spin_lock_bh(&mcdi->iface_lock);
+ ++mcdi->seqno;
++ seqno = mcdi->seqno & SEQ_MASK;
+ spin_unlock_bh(&mcdi->iface_lock);
+
+- seqno = mcdi->seqno & SEQ_MASK;
+ xflags = 0;
+ if (mcdi->mode == MCDI_MODE_EVENTS)
+ xflags |= MCDI_HEADER_XFLAGS_EVREQ;
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 2dff0e110c6f3..f094e4bc21751 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -1454,6 +1454,9 @@ static void netvsc_get_ethtool_stats(struct net_device *dev,
+ pcpu_sum = kvmalloc_array(num_possible_cpus(),
+ sizeof(struct netvsc_ethtool_pcpu_stats),
+ GFP_KERNEL);
++ if (!pcpu_sum)
++ return;
++
+ netvsc_get_pcpu_stats(dev, pcpu_sum);
+ for_each_present_cpu(cpu) {
+ struct netvsc_ethtool_pcpu_stats *this_sum = &pcpu_sum[cpu];
+diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
+index 970ed1514f0bc..fa0c173a0d26f 100644
+--- a/drivers/usb/gadget/function/rndis.c
++++ b/drivers/usb/gadget/function/rndis.c
+@@ -640,6 +640,7 @@ static int rndis_set_response(struct rndis_params *params,
+ BufLength = le32_to_cpu(buf->InformationBufferLength);
+ BufOffset = le32_to_cpu(buf->InformationBufferOffset);
+ if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
++ (BufOffset > RNDIS_MAX_TOTAL_SIZE) ||
+ (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
+ return -EINVAL;
+
+diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
+index 87a417d878b8a..e3dc74cdba838 100644
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -1297,7 +1297,6 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
+ usb_gadget_udc_stop(udc);
+
+ udc->driver = NULL;
+- udc->dev.driver = NULL;
+ udc->gadget->dev.driver = NULL;
+ }
+
+@@ -1346,7 +1345,6 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri
+ driver->function);
+
+ udc->driver = driver;
+- udc->dev.driver = &driver->driver;
+ udc->gadget->dev.driver = &driver->driver;
+
+ usb_gadget_udc_set_speed(udc, driver->max_speed);
+@@ -1368,7 +1366,6 @@ err1:
+ dev_err(&udc->dev, "failed to start %s: %d\n",
+ udc->driver->function, ret);
+ udc->driver = NULL;
+- udc->dev.driver = NULL;
+ udc->gadget->dev.driver = NULL;
+ return ret;
+ }
+diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
+index b5aa60430a6a7..7a08053d95c21 100644
+--- a/fs/ocfs2/super.c
++++ b/fs/ocfs2/super.c
+@@ -1150,17 +1150,6 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
+ goto read_super_error;
+ }
+
+- root = d_make_root(inode);
+- if (!root) {
+- status = -ENOMEM;
+- mlog_errno(status);
+- goto read_super_error;
+- }
+-
+- sb->s_root = root;
+-
+- ocfs2_complete_mount_recovery(osb);
+-
+ osb->osb_dev_kset = kset_create_and_add(sb->s_id, NULL,
+ &ocfs2_kset->kobj);
+ if (!osb->osb_dev_kset) {
+@@ -1178,6 +1167,17 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
+ goto read_super_error;
+ }
+
++ root = d_make_root(inode);
++ if (!root) {
++ status = -ENOMEM;
++ mlog_errno(status);
++ goto read_super_error;
++ }
++
++ sb->s_root = root;
++
++ ocfs2_complete_mount_recovery(osb);
++
+ if (ocfs2_mount_local(osb))
+ snprintf(nodestr, sizeof(nodestr), "local");
+ else
+diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
+index 5166eb40917da..011e391497f4e 100644
+--- a/fs/sysfs/file.c
++++ b/fs/sysfs/file.c
+@@ -572,8 +572,7 @@ int sysfs_emit(char *buf, const char *fmt, ...)
+ va_list args;
+ int len;
+
+- if (WARN(!buf || offset_in_page(buf),
+- "invalid sysfs_emit: buf:%p\n", buf))
++ if (WARN(!buf, "invalid sysfs_emit: buf:%p\n", buf))
+ return 0;
+
+ va_start(args, fmt);
+diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h
+index 6366b04c7d5f4..0402668914147 100644
+--- a/include/linux/arm-smccc.h
++++ b/include/linux/arm-smccc.h
+@@ -85,6 +85,13 @@
+ ARM_SMCCC_SMC_32, \
+ 0, 0x7fff)
+
++#define ARM_SMCCC_ARCH_WORKAROUND_3 \
++ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \
++ ARM_SMCCC_SMC_32, \
++ 0, 0x3fff)
++
++#define SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED 1
++
+ #ifndef __ASSEMBLY__
+
+ #include <linux/linkage.h>
+diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
+index e44746de95cdf..c697a05242735 100644
+--- a/include/linux/if_arp.h
++++ b/include/linux/if_arp.h
+@@ -55,6 +55,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev)
+ case ARPHRD_VOID:
+ case ARPHRD_NONE:
+ case ARPHRD_RAWIP:
++ case ARPHRD_PIMREG:
+ return false;
+ default:
+ return true;
+diff --git a/include/linux/topology.h b/include/linux/topology.h
+index cb0775e1ee4bd..707364c90aa64 100644
+--- a/include/linux/topology.h
++++ b/include/linux/topology.h
+@@ -47,6 +47,7 @@ int arch_update_cpu_topology(void);
+ /* Conform to ACPI 2.0 SLIT distance definitions */
+ #define LOCAL_DISTANCE 10
+ #define REMOTE_DISTANCE 20
++#define DISTANCE_BITS 8
+ #ifndef node_distance
+ #define node_distance(from,to) ((from) == (to) ? LOCAL_DISTANCE : REMOTE_DISTANCE)
+ #endif
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index fe8bed557691a..a8aa2bb74ad61 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1763,14 +1763,15 @@ int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+ const struct xfrm_migrate *m, int num_bundles,
+ const struct xfrm_kmaddress *k,
+ const struct xfrm_encap_tmpl *encap);
+-struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net);
++struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net,
++ u32 if_id);
+ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
+ struct xfrm_migrate *m,
+ struct xfrm_encap_tmpl *encap);
+ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+ struct xfrm_migrate *m, int num_bundles,
+ struct xfrm_kmaddress *k, struct net *net,
+- struct xfrm_encap_tmpl *encap);
++ struct xfrm_encap_tmpl *encap, u32 if_id);
+ #endif
+
+ int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport);
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index d43d25acc95ad..153628277a487 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -1528,9 +1528,13 @@ static void cpuset_attach(struct cgroup_taskset *tset)
+ cgroup_taskset_first(tset, &css);
+ cs = css_cs(css);
+
+- cpus_read_lock();
+ mutex_lock(&cpuset_mutex);
+
++ /*
++ * It should hold cpus lock because a cpu offline event can
++ * cause set_cpus_allowed_ptr() failed.
++ */
++ get_online_cpus();
+ /* prepare for attach */
+ if (cs == &top_cpuset)
+ cpumask_copy(cpus_attach, cpu_possible_mask);
+@@ -1549,6 +1553,7 @@ static void cpuset_attach(struct cgroup_taskset *tset)
+ cpuset_change_task_nodemask(task, &cpuset_attach_nodemask_to);
+ cpuset_update_task_spread_flag(cs, task);
+ }
++ put_online_cpus();
+
+ /*
+ * Change mm for all threadgroup leaders. This is expensive and may
+@@ -1584,7 +1589,6 @@ static void cpuset_attach(struct cgroup_taskset *tset)
+ wake_up(&cpuset_attach_wq);
+
+ mutex_unlock(&cpuset_mutex);
+- cpus_read_unlock();
+ }
+
+ /* The various types of files and directories in a cpuset file system */
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index f58efa5cc6474..02e85cd233d42 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -1322,66 +1322,58 @@ static void init_numa_topology_type(void)
+ }
+ }
+
++
++#define NR_DISTANCE_VALUES (1 << DISTANCE_BITS)
++
+ void sched_init_numa(void)
+ {
+- int next_distance, curr_distance = node_distance(0, 0);
+ struct sched_domain_topology_level *tl;
+- int level = 0;
+- int i, j, k;
+-
+- sched_domains_numa_distance = kzalloc(sizeof(int) * (nr_node_ids + 1), GFP_KERNEL);
+- if (!sched_domains_numa_distance)
+- return;
+-
+- /* Includes NUMA identity node at level 0. */
+- sched_domains_numa_distance[level++] = curr_distance;
+- sched_domains_numa_levels = level;
++ unsigned long *distance_map;
++ int nr_levels = 0;
++ int i, j;
+
+ /*
+ * O(nr_nodes^2) deduplicating selection sort -- in order to find the
+ * unique distances in the node_distance() table.
+- *
+- * Assumes node_distance(0,j) includes all distances in
+- * node_distance(i,j) in order to avoid cubic time.
+ */
+- next_distance = curr_distance;
++ distance_map = bitmap_alloc(NR_DISTANCE_VALUES, GFP_KERNEL);
++ if (!distance_map)
++ return;
++
++ bitmap_zero(distance_map, NR_DISTANCE_VALUES);
+ for (i = 0; i < nr_node_ids; i++) {
+ for (j = 0; j < nr_node_ids; j++) {
+- for (k = 0; k < nr_node_ids; k++) {
+- int distance = node_distance(i, k);
+-
+- if (distance > curr_distance &&
+- (distance < next_distance ||
+- next_distance == curr_distance))
+- next_distance = distance;
+-
+- /*
+- * While not a strong assumption it would be nice to know
+- * about cases where if node A is connected to B, B is not
+- * equally connected to A.
+- */
+- if (sched_debug() && node_distance(k, i) != distance)
+- sched_numa_warn("Node-distance not symmetric");
++ int distance = node_distance(i, j);
+
+- if (sched_debug() && i && !find_numa_distance(distance))
+- sched_numa_warn("Node-0 not representative");
++ if (distance < LOCAL_DISTANCE || distance >= NR_DISTANCE_VALUES) {
++ sched_numa_warn("Invalid distance value range");
++ return;
+ }
+- if (next_distance != curr_distance) {
+- sched_domains_numa_distance[level++] = next_distance;
+- sched_domains_numa_levels = level;
+- curr_distance = next_distance;
+- } else break;
++
++ bitmap_set(distance_map, distance, 1);
+ }
++ }
++ /*
++ * We can now figure out how many unique distance values there are and
++ * allocate memory accordingly.
++ */
++ nr_levels = bitmap_weight(distance_map, NR_DISTANCE_VALUES);
+
+- /*
+- * In case of sched_debug() we verify the above assumption.
+- */
+- if (!sched_debug())
+- break;
++ sched_domains_numa_distance = kcalloc(nr_levels, sizeof(int), GFP_KERNEL);
++ if (!sched_domains_numa_distance) {
++ bitmap_free(distance_map);
++ return;
+ }
+
++ for (i = 0, j = 0; i < nr_levels; i++, j++) {
++ j = find_next_bit(distance_map, NR_DISTANCE_VALUES, j);
++ sched_domains_numa_distance[i] = j;
++ }
++
++ bitmap_free(distance_map);
++
+ /*
+- * 'level' contains the number of unique distances
++ * 'nr_levels' contains the number of unique distances
+ *
+ * The sched_domains_numa_distance[] array includes the actual distance
+ * numbers.
+@@ -1390,15 +1382,15 @@ void sched_init_numa(void)
+ /*
+ * Here, we should temporarily reset sched_domains_numa_levels to 0.
+ * If it fails to allocate memory for array sched_domains_numa_masks[][],
+- * the array will contain less then 'level' members. This could be
++ * the array will contain less then 'nr_levels' members. This could be
+ * dangerous when we use it to iterate array sched_domains_numa_masks[][]
+ * in other functions.
+ *
+- * We reset it to 'level' at the end of this function.
++ * We reset it to 'nr_levels' at the end of this function.
+ */
+ sched_domains_numa_levels = 0;
+
+- sched_domains_numa_masks = kzalloc(sizeof(void *) * level, GFP_KERNEL);
++ sched_domains_numa_masks = kzalloc(sizeof(void *) * nr_levels, GFP_KERNEL);
+ if (!sched_domains_numa_masks)
+ return;
+
+@@ -1406,7 +1398,7 @@ void sched_init_numa(void)
+ * Now for each level, construct a mask per node which contains all
+ * CPUs of nodes that are that many hops away from us.
+ */
+- for (i = 0; i < level; i++) {
++ for (i = 0; i < nr_levels; i++) {
+ sched_domains_numa_masks[i] =
+ kzalloc(nr_node_ids * sizeof(void *), GFP_KERNEL);
+ if (!sched_domains_numa_masks[i])
+@@ -1414,12 +1406,17 @@ void sched_init_numa(void)
+
+ for (j = 0; j < nr_node_ids; j++) {
+ struct cpumask *mask = kzalloc(cpumask_size(), GFP_KERNEL);
++ int k;
++
+ if (!mask)
+ return;
+
+ sched_domains_numa_masks[i][j] = mask;
+
+ for_each_node(k) {
++ if (sched_debug() && (node_distance(j, k) != node_distance(k, j)))
++ sched_numa_warn("Node-distance not symmetric");
++
+ if (node_distance(j, k) > sched_domains_numa_distance[i])
+ continue;
+
+@@ -1431,7 +1428,7 @@ void sched_init_numa(void)
+ /* Compute default topology size */
+ for (i = 0; sched_domain_topology[i].mask; i++);
+
+- tl = kzalloc((i + level + 1) *
++ tl = kzalloc((i + nr_levels + 1) *
+ sizeof(struct sched_domain_topology_level), GFP_KERNEL);
+ if (!tl)
+ return;
+@@ -1454,7 +1451,7 @@ void sched_init_numa(void)
+ /*
+ * .. and append 'j' levels of NUMA goodness.
+ */
+- for (j = 1; j < level; i++, j++) {
++ for (j = 1; j < nr_levels; i++, j++) {
+ tl[i] = (struct sched_domain_topology_level){
+ .mask = sd_numa_mask,
+ .sd_flags = cpu_numa_flags,
+@@ -1466,8 +1463,8 @@ void sched_init_numa(void)
+
+ sched_domain_topology = tl;
+
+- sched_domains_numa_levels = level;
+- sched_max_numa_distance = sched_domains_numa_distance[level - 1];
++ sched_domains_numa_levels = nr_levels;
++ sched_max_numa_distance = sched_domains_numa_distance[nr_levels - 1];
+
+ init_numa_topology_type();
+ }
+diff --git a/lib/Kconfig b/lib/Kconfig
+index a3928d4438b50..714ec2f50bb10 100644
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -16,7 +16,6 @@ config BITREVERSE
+ config HAVE_ARCH_BITREVERSE
+ bool
+ default n
+- depends on BITREVERSE
+ help
+ This option enables the use of hardware bit-reversal instructions on
+ architectures which support such operations.
+diff --git a/mm/migrate.c b/mm/migrate.c
+index a69b842f95daf..76f8dedc0e02b 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -472,6 +472,10 @@ int migrate_page_move_mapping(struct address_space *mapping,
+
+ pslot = radix_tree_lookup_slot(&mapping->i_pages,
+ page_index(page));
++ if (pslot == NULL) {
++ xa_unlock_irq(&mapping->i_pages);
++ return -EAGAIN;
++ }
+
+ expected_count += hpage_nr_pages(page) + page_has_private(page);
+ if (page_count(page) != expected_count ||
+@@ -590,6 +594,10 @@ int migrate_huge_page_move_mapping(struct address_space *mapping,
+ xa_lock_irq(&mapping->i_pages);
+
+ pslot = radix_tree_lookup_slot(&mapping->i_pages, page_index(page));
++ if (pslot == NULL) {
++ xa_unlock_irq(&mapping->i_pages);
++ return -EAGAIN;
++ }
+
+ expected_count = 2 + page_has_private(page);
+ if (page_count(page) != expected_count ||
+diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
+index 7c10bc4dacd31..05aadb25e2949 100644
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -596,6 +596,7 @@ static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn)
+ struct net_device *master;
+
+ master = of_find_net_device_by_node(ethernet);
++ of_node_put(ethernet);
+ if (!master)
+ return -EPROBE_DEFER;
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 4dce1b418acc2..f7795488b0adf 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1669,11 +1669,13 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
+ if (!copied)
+ copied = used;
+ break;
+- } else if (used <= len) {
+- seq += used;
+- copied += used;
+- offset += used;
+ }
++ if (WARN_ON_ONCE(used > len))
++ used = len;
++ seq += used;
++ copied += used;
++ offset += used;
++
+ /* If recv_actor drops the lock (e.g. TCP splice
+ * receive) the skb pointer might be invalid when
+ * getting here: tcp_collapse might have deleted it
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index c7d5a6015389b..388910cf09781 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2633,7 +2633,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
+ }
+
+ return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i,
+- kma ? &k : NULL, net, NULL);
++ kma ? &k : NULL, net, NULL, 0);
+
+ out:
+ return err;
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index bd7e8d406c71e..d65051959f852 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2246,8 +2246,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ copy_skb = skb_get(skb);
+ skb_head = skb->data;
+ }
+- if (copy_skb)
++ if (copy_skb) {
++ memset(&PACKET_SKB_CB(copy_skb)->sa.ll, 0,
++ sizeof(PACKET_SKB_CB(copy_skb)->sa.ll));
+ skb_set_owner_r(copy_skb, sk);
++ }
+ }
+ snaplen = po->rx_ring.frame_size - macoff;
+ if ((int)snaplen < 0) {
+@@ -3406,6 +3409,8 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ sock_recv_ts_and_drops(msg, sk, skb);
+
+ if (msg->msg_name) {
++ const size_t max_len = min(sizeof(skb->cb),
++ sizeof(struct sockaddr_storage));
+ int copy_len;
+
+ /* If the address length field is there to be filled
+@@ -3428,6 +3433,10 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ msg->msg_namelen = sizeof(struct sockaddr_ll);
+ }
+ }
++ if (WARN_ON_ONCE(copy_len > max_len)) {
++ copy_len = max_len;
++ msg->msg_namelen = copy_len;
++ }
+ memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ }
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index ebca069064dfd..3d52431dea9bf 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -164,6 +164,12 @@ static enum sctp_disposition __sctp_sf_do_9_1_abort(
+ void *arg,
+ struct sctp_cmd_seq *commands);
+
++static enum sctp_disposition
++__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
++ const struct sctp_association *asoc,
++ const union sctp_subtype type, void *arg,
++ struct sctp_cmd_seq *commands);
++
+ /* Small helper function that checks if the chunk length
+ * is of the appropriate length. The 'required_length' argument
+ * is set to be the size of a specific chunk we are testing.
+@@ -345,6 +351,14 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
+ if (!chunk->singleton)
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
++ /* Make sure that the INIT chunk has a valid length.
++ * Normally, this would cause an ABORT with a Protocol Violation
++ * error, but since we don't have an association, we'll
++ * just discard the packet.
++ */
++ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
+ /* If the packet is an OOTB packet which is temporarily on the
+ * control endpoint, respond with an ABORT.
+ */
+@@ -359,14 +373,6 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
+ if (chunk->sctp_hdr->vtag != 0)
+ return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
+
+- /* Make sure that the INIT chunk has a valid length.
+- * Normally, this would cause an ABORT with a Protocol Violation
+- * error, but since we don't have an association, we'll
+- * just discard the packet.
+- */
+- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+-
+ /* If the INIT is coming toward a closing socket, we'll send back
+ * and ABORT. Essentially, this catches the race of INIT being
+ * backloged to the socket at the same time as the user isses close().
+@@ -1499,19 +1505,16 @@ static enum sctp_disposition sctp_sf_do_unexpected_init(
+ if (!chunk->singleton)
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
++ /* Make sure that the INIT chunk has a valid length. */
++ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
+ /* 3.1 A packet containing an INIT chunk MUST have a zero Verification
+ * Tag.
+ */
+ if (chunk->sctp_hdr->vtag != 0)
+ return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
+
+- /* Make sure that the INIT chunk has a valid length.
+- * In this case, we generate a protocol violation since we have
+- * an association established.
+- */
+- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
+- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+- commands);
+ /* Grab the INIT header. */
+ chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data;
+
+@@ -1829,9 +1832,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
+ * its peer.
+ */
+ if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) {
+- disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc,
+- SCTP_ST_CHUNK(chunk->chunk_hdr->type),
+- chunk, commands);
++ disposition = __sctp_sf_do_9_2_reshutack(net, ep, asoc,
++ SCTP_ST_CHUNK(chunk->chunk_hdr->type),
++ chunk, commands);
+ if (SCTP_DISPOSITION_NOMEM == disposition)
+ goto nomem;
+
+@@ -2301,7 +2304,7 @@ enum sctp_disposition sctp_sf_shutdown_pending_abort(
+ */
+ if (SCTP_ADDR_DEL ==
+ sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
+- return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ if (!sctp_err_chunk_valid(chunk))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+@@ -2347,7 +2350,7 @@ enum sctp_disposition sctp_sf_shutdown_sent_abort(
+ */
+ if (SCTP_ADDR_DEL ==
+ sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
+- return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ if (!sctp_err_chunk_valid(chunk))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+@@ -2617,7 +2620,7 @@ enum sctp_disposition sctp_sf_do_9_1_abort(
+ */
+ if (SCTP_ADDR_DEL ==
+ sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
+- return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ if (!sctp_err_chunk_valid(chunk))
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+@@ -2930,13 +2933,11 @@ enum sctp_disposition sctp_sf_do_9_2_shut_ctsn(
+ * that belong to this association, it should discard the INIT chunk and
+ * retransmit the SHUTDOWN ACK chunk.
+ */
+-enum sctp_disposition sctp_sf_do_9_2_reshutack(
+- struct net *net,
+- const struct sctp_endpoint *ep,
+- const struct sctp_association *asoc,
+- const union sctp_subtype type,
+- void *arg,
+- struct sctp_cmd_seq *commands)
++static enum sctp_disposition
++__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
++ const struct sctp_association *asoc,
++ const union sctp_subtype type, void *arg,
++ struct sctp_cmd_seq *commands)
+ {
+ struct sctp_chunk *chunk = arg;
+ struct sctp_chunk *reply;
+@@ -2970,6 +2971,26 @@ nomem:
+ return SCTP_DISPOSITION_NOMEM;
+ }
+
++enum sctp_disposition
++sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep,
++ const struct sctp_association *asoc,
++ const union sctp_subtype type, void *arg,
++ struct sctp_cmd_seq *commands)
++{
++ struct sctp_chunk *chunk = arg;
++
++ if (!chunk->singleton)
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
++ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk)))
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
++ if (chunk->sctp_hdr->vtag != 0)
++ return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands);
++
++ return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands);
++}
++
+ /*
+ * sctp_sf_do_ecn_cwr
+ *
+@@ -3766,6 +3787,11 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net,
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+ }
+
++ /* Make sure that the ASCONF ADDIP chunk has a valid length. */
++ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
++ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
++ commands);
++
+ /* ADD-IP: Section 4.1.1
+ * This chunk MUST be sent in an authenticated way by using
+ * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
+@@ -3773,13 +3799,7 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net,
+ * described in [I-D.ietf-tsvwg-sctp-auth].
+ */
+ if (!net->sctp.addip_noauth && !chunk->auth)
+- return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
+- commands);
+-
+- /* Make sure that the ASCONF ADDIP chunk has a valid length. */
+- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
+- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+- commands);
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ hdr = (struct sctp_addiphdr *)chunk->skb->data;
+ serial = ntohl(hdr->serial);
+@@ -3908,6 +3928,12 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+ }
+
++ /* Make sure that the ADDIP chunk has a valid length. */
++ if (!sctp_chunk_length_valid(asconf_ack,
++ sizeof(struct sctp_addip_chunk)))
++ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
++ commands);
++
+ /* ADD-IP, Section 4.1.2:
+ * This chunk MUST be sent in an authenticated way by using
+ * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
+@@ -3915,14 +3941,7 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
+ * described in [I-D.ietf-tsvwg-sctp-auth].
+ */
+ if (!net->sctp.addip_noauth && !asconf_ack->auth)
+- return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
+- commands);
+-
+- /* Make sure that the ADDIP chunk has a valid length. */
+- if (!sctp_chunk_length_valid(asconf_ack,
+- sizeof(struct sctp_addip_chunk)))
+- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+- commands);
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
+ addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data;
+ rcvd_serial = ntohl(addip_hdr->serial);
+@@ -4494,6 +4513,9 @@ enum sctp_disposition sctp_sf_discard_chunk(struct net *net,
+ {
+ struct sctp_chunk *chunk = arg;
+
++ if (asoc && !sctp_vtag_verify(chunk, asoc))
++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
+ /* Make sure that the chunk has a valid length.
+ * Since we don't know the chunk type, we use a general
+ * chunkhdr structure to make a comparison.
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index c5806f46f6c95..2799ff117f5ad 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -15518,7 +15518,8 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
+ wdev->chandef = *chandef;
+ wdev->preset_chandef = *chandef;
+
+- if (wdev->iftype == NL80211_IFTYPE_STATION &&
++ if ((wdev->iftype == NL80211_IFTYPE_STATION ||
++ wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
+ !WARN_ON(!wdev->current_bss))
+ wdev->current_bss->pub.channel = chandef->chan;
+
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index e9aea82f370de..ab6d0c6576a6b 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -3050,7 +3050,7 @@ static bool xfrm_migrate_selector_match(const struct xfrm_selector *sel_cmp,
+ }
+
+ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector *sel,
+- u8 dir, u8 type, struct net *net)
++ u8 dir, u8 type, struct net *net, u32 if_id)
+ {
+ struct xfrm_policy *pol, *ret = NULL;
+ struct hlist_head *chain;
+@@ -3059,7 +3059,8 @@ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector *
+ spin_lock_bh(&net->xfrm.xfrm_policy_lock);
+ chain = policy_hash_direct(net, &sel->daddr, &sel->saddr, sel->family, dir);
+ hlist_for_each_entry(pol, chain, bydst) {
+- if (xfrm_migrate_selector_match(sel, &pol->selector) &&
++ if ((if_id == 0 || pol->if_id == if_id) &&
++ xfrm_migrate_selector_match(sel, &pol->selector) &&
+ pol->type == type) {
+ ret = pol;
+ priority = ret->priority;
+@@ -3071,7 +3072,8 @@ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector *
+ if ((pol->priority >= priority) && ret)
+ break;
+
+- if (xfrm_migrate_selector_match(sel, &pol->selector) &&
++ if ((if_id == 0 || pol->if_id == if_id) &&
++ xfrm_migrate_selector_match(sel, &pol->selector) &&
+ pol->type == type) {
+ ret = pol;
+ break;
+@@ -3187,7 +3189,7 @@ static int xfrm_migrate_check(const struct xfrm_migrate *m, int num_migrate)
+ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+ struct xfrm_migrate *m, int num_migrate,
+ struct xfrm_kmaddress *k, struct net *net,
+- struct xfrm_encap_tmpl *encap)
++ struct xfrm_encap_tmpl *encap, u32 if_id)
+ {
+ int i, err, nx_cur = 0, nx_new = 0;
+ struct xfrm_policy *pol = NULL;
+@@ -3206,14 +3208,14 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+ }
+
+ /* Stage 1 - find policy */
+- if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) {
++ if ((pol = xfrm_migrate_policy_find(sel, dir, type, net, if_id)) == NULL) {
+ err = -ENOENT;
+ goto out;
+ }
+
+ /* Stage 2 - find and update state(s) */
+ for (i = 0, mp = m; i < num_migrate; i++, mp++) {
+- if ((x = xfrm_migrate_state_find(mp, net))) {
++ if ((x = xfrm_migrate_state_find(mp, net, if_id))) {
+ x_cur[nx_cur] = x;
+ nx_cur++;
+ xc = xfrm_state_migrate(x, mp, encap);
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 44acc724122bb..cf147e1837a92 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -1442,9 +1442,6 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
+ memcpy(&x->mark, &orig->mark, sizeof(x->mark));
+ memcpy(&x->props.smark, &orig->props.smark, sizeof(x->props.smark));
+
+- if (xfrm_init_state(x) < 0)
+- goto error;
+-
+ x->props.flags = orig->props.flags;
+ x->props.extra_flags = orig->props.extra_flags;
+
+@@ -1466,7 +1463,8 @@ out:
+ return NULL;
+ }
+
+-struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net)
++struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net,
++ u32 if_id)
+ {
+ unsigned int h;
+ struct xfrm_state *x = NULL;
+@@ -1482,6 +1480,8 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n
+ continue;
+ if (m->reqid && x->props.reqid != m->reqid)
+ continue;
++ if (if_id != 0 && x->if_id != if_id)
++ continue;
+ if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr,
+ m->old_family) ||
+ !xfrm_addr_equal(&x->props.saddr, &m->old_saddr,
+@@ -1497,6 +1497,8 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n
+ if (x->props.mode != m->mode ||
+ x->id.proto != m->proto)
+ continue;
++ if (if_id != 0 && x->if_id != if_id)
++ continue;
+ if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr,
+ m->old_family) ||
+ !xfrm_addr_equal(&x->props.saddr, &m->old_saddr,
+@@ -1523,6 +1525,11 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x,
+ if (!xc)
+ return NULL;
+
++ xc->props.family = m->new_family;
++
++ if (xfrm_init_state(xc) < 0)
++ goto error;
++
+ memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr));
+ memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr));
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 8d8f9e778cd4f..3db5cd70b16ac 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -620,13 +620,8 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
+
+ xfrm_smark_init(attrs, &x->props.smark);
+
+- if (attrs[XFRMA_IF_ID]) {
++ if (attrs[XFRMA_IF_ID])
+ x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
+- if (!x->if_id) {
+- err = -EINVAL;
+- goto error;
+- }
+- }
+
+ err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV]);
+ if (err)
+@@ -1332,13 +1327,8 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
+
+ mark = xfrm_mark_get(attrs, &m);
+
+- if (attrs[XFRMA_IF_ID]) {
++ if (attrs[XFRMA_IF_ID])
+ if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
+- if (!if_id) {
+- err = -EINVAL;
+- goto out_noput;
+- }
+- }
+
+ if (p->info.seq) {
+ x = xfrm_find_acq_byseq(net, mark, p->info.seq);
+@@ -1640,13 +1630,8 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_us
+
+ xfrm_mark_get(attrs, &xp->mark);
+
+- if (attrs[XFRMA_IF_ID]) {
++ if (attrs[XFRMA_IF_ID])
+ xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
+- if (!xp->if_id) {
+- err = -EINVAL;
+- goto error;
+- }
+- }
+
+ return xp;
+ error:
+@@ -2384,6 +2369,7 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
+ int n = 0;
+ struct net *net = sock_net(skb->sk);
+ struct xfrm_encap_tmpl *encap = NULL;
++ u32 if_id = 0;
+
+ if (attrs[XFRMA_MIGRATE] == NULL)
+ return -EINVAL;
+@@ -2408,7 +2394,10 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
+ return 0;
+ }
+
+- err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap);
++ if (attrs[XFRMA_IF_ID])
++ if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
++
++ err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap, if_id);
+
+ kfree(encap);
+
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index b6f8349abc672..6abd1dce10ffe 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -217,7 +217,7 @@ void symbols__fixup_end(struct rb_root *symbols)
+ prev = curr;
+ curr = rb_entry(nd, struct symbol, rb_node);
+
+- if (prev->end == prev->start && prev->end != curr->start)
++ if (prev->end == prev->start || prev->end != curr->start)
+ arch__symbols__fixup_end(prev, curr);
+ }
+
+diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c
+index 1963440f67251..b2c7043c0c30d 100644
+--- a/tools/testing/selftests/vm/userfaultfd.c
++++ b/tools/testing/selftests/vm/userfaultfd.c
+@@ -60,6 +60,7 @@
+ #include <signal.h>
+ #include <poll.h>
+ #include <string.h>
++#include <linux/mman.h>
+ #include <sys/mman.h>
+ #include <sys/syscall.h>
+ #include <sys/ioctl.h>
+diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c
+index 34d08ee637471..a161951e55a54 100644
+--- a/virt/kvm/arm/psci.c
++++ b/virt/kvm/arm/psci.c
+@@ -429,6 +429,18 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu)
+ break;
+ }
+ break;
++ case ARM_SMCCC_ARCH_WORKAROUND_3:
++ switch (kvm_arm_get_spectre_bhb_state()) {
++ case SPECTRE_VULNERABLE:
++ break;
++ case SPECTRE_MITIGATED:
++ val = SMCCC_RET_SUCCESS;
++ break;
++ case SPECTRE_UNAFFECTED:
++ val = SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED;
++ break;
++ }
++ break;
+ }
+ break;
+ default:
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-03-28 10:59 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-03-28 10:59 UTC (permalink / raw
To: gentoo-commits
commit: 3038f0c1e16b2a5807f83b890d2add421177d9c4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 28 10:59:27 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Mar 28 10:59:27 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3038f0c1
Linux patch 4.19.237
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1236_linux-4.19.237.patch | 755 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 759 insertions(+)
diff --git a/0000_README b/0000_README
index 0e8f7f4a..eccf1864 100644
--- a/0000_README
+++ b/0000_README
@@ -983,6 +983,10 @@ Patch: 1235_linux-4.19.236.patch
From: https://www.kernel.org
Desc: Linux 4.19.236
+Patch: 1236_linux-4.19.237.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.237
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1236_linux-4.19.237.patch b/1236_linux-4.19.237.patch
new file mode 100644
index 00000000..38435553
--- /dev/null
+++ b/1236_linux-4.19.237.patch
@@ -0,0 +1,755 @@
+diff --git a/Makefile b/Makefile
+index d83513c135206..834336f971c15 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 236
++SUBLEVEL = 237
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/nds32/include/asm/uaccess.h b/arch/nds32/include/asm/uaccess.h
+index 362a32d9bd168..c8b4b8cc65294 100644
+--- a/arch/nds32/include/asm/uaccess.h
++++ b/arch/nds32/include/asm/uaccess.h
+@@ -75,9 +75,7 @@ static inline void set_fs(mm_segment_t fs)
+ * versions are void (ie, don't return a value as such).
+ */
+
+-#define get_user __get_user \
+-
+-#define __get_user(x, ptr) \
++#define get_user(x, ptr) \
+ ({ \
+ long __gu_err = 0; \
+ __get_user_check((x), (ptr), __gu_err); \
+@@ -90,6 +88,14 @@ static inline void set_fs(mm_segment_t fs)
+ (void)0; \
+ })
+
++#define __get_user(x, ptr) \
++({ \
++ long __gu_err = 0; \
++ const __typeof__(*(ptr)) __user *__p = (ptr); \
++ __get_user_err((x), __p, (__gu_err)); \
++ __gu_err; \
++})
++
+ #define __get_user_check(x, ptr, err) \
+ ({ \
+ const __typeof__(*(ptr)) __user *__p = (ptr); \
+@@ -170,12 +176,18 @@ do { \
+ : "r"(addr), "i"(-EFAULT) \
+ : "cc")
+
+-#define put_user __put_user \
++#define put_user(x, ptr) \
++({ \
++ long __pu_err = 0; \
++ __put_user_check((x), (ptr), __pu_err); \
++ __pu_err; \
++})
+
+ #define __put_user(x, ptr) \
+ ({ \
+ long __pu_err = 0; \
+- __put_user_err((x), (ptr), __pu_err); \
++ __typeof__(*(ptr)) __user *__p = (ptr); \
++ __put_user_err((x), __p, __pu_err); \
+ __pu_err; \
+ })
+
+diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
+index b35c34cfbe522..8b1aa1206d980 100644
+--- a/arch/x86/kernel/acpi/boot.c
++++ b/arch/x86/kernel/acpi/boot.c
+@@ -1351,6 +1351,17 @@ static int __init disable_acpi_pci(const struct dmi_system_id *d)
+ return 0;
+ }
+
++static int __init disable_acpi_xsdt(const struct dmi_system_id *d)
++{
++ if (!acpi_force) {
++ pr_notice("%s detected: force use of acpi=rsdt\n", d->ident);
++ acpi_gbl_do_not_use_xsdt = TRUE;
++ } else {
++ pr_notice("Warning: DMI blacklist says broken, but acpi XSDT forced\n");
++ }
++ return 0;
++}
++
+ static int __init dmi_disable_acpi(const struct dmi_system_id *d)
+ {
+ if (!acpi_force) {
+@@ -1475,6 +1486,19 @@ static const struct dmi_system_id acpi_dmi_table[] __initconst = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
+ },
+ },
++ /*
++ * Boxes that need ACPI XSDT use disabled due to corrupted tables
++ */
++ {
++ .callback = disable_acpi_xsdt,
++ .ident = "Advantech DAC-BJ01",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Bearlake CRB Board"),
++ DMI_MATCH(DMI_BIOS_VERSION, "V1.12"),
++ DMI_MATCH(DMI_BIOS_DATE, "02/01/2011"),
++ },
++ },
+ {}
+ };
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index d4e42a578e186..c0c533206e02d 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -90,6 +90,10 @@ extern void *acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir);
+
+ static const struct acpi_device_id battery_device_ids[] = {
+ {"PNP0C0A", 0},
++
++ /* Microsoft Surface Go 3 */
++ {"MSHW0146", 0},
++
+ {"", 0},
+ };
+
+@@ -1416,6 +1420,14 @@ static const struct dmi_system_id bat_dmi_table[] __initconst = {
+ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad"),
+ },
+ },
++ {
++ /* Microsoft Surface Go 3 */
++ .callback = battery_notification_delay_quirk,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 3"),
++ },
++ },
+ {},
+ };
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 86ffb4af4afca..298d9c65e0848 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -356,6 +356,81 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "BA51_MV"),
+ },
+ },
++ /*
++ * Clevo NL5xRU and NL5xNU/TUXEDO Aura 15 Gen1 and Gen2 have both a
++ * working native and video interface. However the default detection
++ * mechanism first registers the video interface before unregistering
++ * it again and switching to the native interface during boot. This
++ * results in a dangling SBIOS request for backlight change for some
++ * reason, causing the backlight to switch to ~2% once per boot on the
++ * first power cord connect or disconnect event. Setting the native
++ * interface explicitly circumvents this buggy behaviour, by avoiding
++ * the unregistering process.
++ */
++ {
++ .callback = video_detect_force_native,
++ .ident = "Clevo NL5xRU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "Clevo NL5xRU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"),
++ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "Clevo NL5xRU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
++ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "Clevo NL5xRU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "AURA1501"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "Clevo NL5xRU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "Clevo NL5xNU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "Clevo NL5xNU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"),
++ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "Clevo NL5xNU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
++ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"),
++ },
++ },
+
+ /*
+ * Desktops which falsely report a backlight and which our heuristics
+diff --git a/drivers/crypto/qat/qat_common/qat_crypto.c b/drivers/crypto/qat/qat_common/qat_crypto.c
+index 3852d31ce0a4b..37a9f969c59cd 100644
+--- a/drivers/crypto/qat/qat_common/qat_crypto.c
++++ b/drivers/crypto/qat/qat_common/qat_crypto.c
+@@ -170,6 +170,14 @@ int qat_crypto_dev_config(struct adf_accel_dev *accel_dev)
+ goto err;
+ if (adf_cfg_section_add(accel_dev, "Accelerator0"))
+ goto err;
++
++ /* Temporarily set the number of crypto instances to zero to avoid
++ * registering the crypto algorithms.
++ * This will be removed when the algorithms will support the
++ * CRYPTO_TFM_REQ_MAY_BACKLOG flag
++ */
++ instances = 0;
++
+ for (i = 0; i < instances; i++) {
+ val = i;
+ snprintf(key, sizeof(key), ADF_CY "%d" ADF_RING_BANK_NUM, i);
+diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+index 3a489b2b99c99..86811de191edb 100644
+--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+@@ -707,6 +707,12 @@ static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring,
+ buf_pool->rx_skb[skb_index] = NULL;
+
+ datalen = xgene_enet_get_data_len(le64_to_cpu(raw_desc->m1));
++
++ /* strip off CRC as HW isn't doing this */
++ nv = GET_VAL(NV, le64_to_cpu(raw_desc->m0));
++ if (!nv)
++ datalen -= 4;
++
+ skb_put(skb, datalen);
+ prefetch(skb->data - NET_IP_ALIGN);
+ skb->protocol = eth_type_trans(skb, ndev);
+@@ -728,12 +734,8 @@ static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring,
+ }
+ }
+
+- nv = GET_VAL(NV, le64_to_cpu(raw_desc->m0));
+- if (!nv) {
+- /* strip off CRC as HW isn't doing this */
+- datalen -= 4;
++ if (!nv)
+ goto skip_jumbo;
+- }
+
+ slots = page_pool->slots - 1;
+ head = page_pool->head;
+diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c
+index fd967a38a94a5..ced3c20d64539 100644
+--- a/drivers/nfc/st21nfca/se.c
++++ b/drivers/nfc/st21nfca/se.c
+@@ -332,6 +332,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
+ return -ENOMEM;
+
+ transaction->aid_len = skb->data[1];
++
++ /* Checking if the length of the AID is valid */
++ if (transaction->aid_len > sizeof(transaction->aid))
++ return -EINVAL;
++
+ memcpy(transaction->aid, &skb->data[2],
+ transaction->aid_len);
+
+@@ -341,6 +346,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
+ return -EPROTO;
+
+ transaction->params_len = skb->data[transaction->aid_len + 3];
++
++ /* Total size is allocated (skb->len - 2) minus fixed array members */
++ if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction)))
++ return -EINVAL;
++
+ memcpy(transaction->params, skb->data +
+ transaction->aid_len + 4, transaction->params_len);
+
+diff --git a/drivers/staging/fbtft/fb_st7789v.c b/drivers/staging/fbtft/fb_st7789v.c
+index 3c3f387936e80..30086ae03605f 100644
+--- a/drivers/staging/fbtft/fb_st7789v.c
++++ b/drivers/staging/fbtft/fb_st7789v.c
+@@ -76,6 +76,8 @@ enum st7789v_command {
+ */
+ static int init_display(struct fbtft_par *par)
+ {
++ par->fbtftops.reset(par);
++
+ /* turn off sleep mode */
+ write_reg(par, MIPI_DCS_EXIT_SLEEP_MODE);
+ mdelay(120);
+diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c
+index e9d58de8b5da6..77967da5d4061 100644
+--- a/drivers/thermal/int340x_thermal/int3400_thermal.c
++++ b/drivers/thermal/int340x_thermal/int3400_thermal.c
+@@ -223,6 +223,10 @@ static void int3400_notify(acpi_handle handle,
+ thermal_prop[4] = NULL;
+ kobject_uevent_env(&priv->thermal->device.kobj, KOBJ_CHANGE,
+ thermal_prop);
++ kfree(thermal_prop[0]);
++ kfree(thermal_prop[1]);
++ kfree(thermal_prop[2]);
++ kfree(thermal_prop[3]);
+ break;
+ default:
+ /* Ignore unknown notification codes sent to INT3400 device */
+diff --git a/include/net/esp.h b/include/net/esp.h
+index 117652eb6ea32..465e38890ee98 100644
+--- a/include/net/esp.h
++++ b/include/net/esp.h
+@@ -4,6 +4,8 @@
+
+ #include <linux/skbuff.h>
+
++#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER)
++
+ struct ip_esp_hdr;
+
+ static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 75677050c82ed..2bf8dcf863f2c 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -2518,6 +2518,9 @@ extern int sysctl_optmem_max;
+ extern __u32 sysctl_wmem_default;
+ extern __u32 sysctl_rmem_default;
+
++/* On 32bit arches, an skb frag is limited to 2^15 */
++#define SKB_FRAG_PAGE_ORDER get_order(32768)
++
+ static inline int sk_get_wmem0(const struct sock *sk, const struct proto *proto)
+ {
+ /* Does this proto have per netns sysctl_wmem ? */
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 41a77027a549b..79f085df52cef 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2207,9 +2207,6 @@ static void sk_leave_memory_pressure(struct sock *sk)
+ }
+ }
+
+-/* On 32bit arches, an skb frag is limited to 2^15 */
+-#define SKB_FRAG_PAGE_ORDER get_order(32768)
+-
+ /**
+ * skb_page_frag_refill - check that a page_frag contains enough room
+ * @sz: minimum size of the fragment we want to get
+diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
+index 0792a9e2a555f..45bb5b60b9940 100644
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -275,6 +275,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
+ struct page *page;
+ struct sk_buff *trailer;
+ int tailen = esp->tailen;
++ unsigned int allocsz;
+
+ /* this is non-NULL only with UDP Encapsulation */
+ if (x->encap) {
+@@ -284,6 +285,10 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
+ return err;
+ }
+
++ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
++ if (allocsz > ESP_SKB_FRAG_MAXSIZE)
++ goto cow;
++
+ if (!skb_cloned(skb)) {
+ if (tailen <= skb_tailroom(skb)) {
+ nfrags = 1;
+diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
+index 25317d5ccf2cc..e3abfc97fde7f 100644
+--- a/net/ipv6/esp6.c
++++ b/net/ipv6/esp6.c
+@@ -241,6 +241,11 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
+ struct page *page;
+ struct sk_buff *trailer;
+ int tailen = esp->tailen;
++ unsigned int allocsz;
++
++ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
++ if (allocsz > ESP_SKB_FRAG_MAXSIZE)
++ goto cow;
+
+ if (!skb_cloned(skb)) {
+ if (tailen <= skb_tailroom(skb)) {
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index fd496bda7ec78..373df391dc93c 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1325,8 +1325,8 @@ static int __ip6_append_data(struct sock *sk,
+ sizeof(struct frag_hdr) : 0) +
+ rt->rt6i_nfheader_len;
+
+- if (mtu < fragheaderlen ||
+- ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr))
++ if (mtu <= fragheaderlen ||
++ ((mtu - fragheaderlen) & ~7) + fragheaderlen <= sizeof(struct frag_hdr))
+ goto emsgsize;
+
+ maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index 89a3dc7d5d400..5cba9199c3c91 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -276,6 +276,7 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
+ {
+ struct sock *sk = sock->sk;
+ struct llc_sock *llc = llc_sk(sk);
++ struct net_device *dev = NULL;
+ struct llc_sap *sap;
+ int rc = -EINVAL;
+
+@@ -287,14 +288,14 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
+ goto out;
+ rc = -ENODEV;
+ if (sk->sk_bound_dev_if) {
+- llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+- if (llc->dev && addr->sllc_arphrd != llc->dev->type) {
+- dev_put(llc->dev);
+- llc->dev = NULL;
++ dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
++ if (dev && addr->sllc_arphrd != dev->type) {
++ dev_put(dev);
++ dev = NULL;
+ }
+ } else
+- llc->dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd);
+- if (!llc->dev)
++ dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd);
++ if (!dev)
+ goto out;
+ rc = -EUSERS;
+ llc->laddr.lsap = llc_ui_autoport();
+@@ -304,6 +305,11 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
+ sap = llc_sap_open(llc->laddr.lsap, NULL);
+ if (!sap)
+ goto out;
++
++ /* Note: We do not expect errors from this point. */
++ llc->dev = dev;
++ dev = NULL;
++
+ memcpy(llc->laddr.mac, llc->dev->dev_addr, IFHWADDRLEN);
+ memcpy(&llc->addr, addr, sizeof(llc->addr));
+ /* assign new connection to its SAP */
+@@ -311,6 +317,7 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
+ sock_reset_flag(sk, SOCK_ZAPPED);
+ rc = 0;
+ out:
++ dev_put(dev);
+ return rc;
+ }
+
+@@ -333,6 +340,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
+ struct sockaddr_llc *addr = (struct sockaddr_llc *)uaddr;
+ struct sock *sk = sock->sk;
+ struct llc_sock *llc = llc_sk(sk);
++ struct net_device *dev = NULL;
+ struct llc_sap *sap;
+ int rc = -EINVAL;
+
+@@ -349,25 +357,26 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
+ rc = -ENODEV;
+ rcu_read_lock();
+ if (sk->sk_bound_dev_if) {
+- llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
+- if (llc->dev) {
++ dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
++ if (dev) {
+ if (is_zero_ether_addr(addr->sllc_mac))
+- memcpy(addr->sllc_mac, llc->dev->dev_addr,
++ memcpy(addr->sllc_mac, dev->dev_addr,
+ IFHWADDRLEN);
+- if (addr->sllc_arphrd != llc->dev->type ||
++ if (addr->sllc_arphrd != dev->type ||
+ !ether_addr_equal(addr->sllc_mac,
+- llc->dev->dev_addr)) {
++ dev->dev_addr)) {
+ rc = -EINVAL;
+- llc->dev = NULL;
++ dev = NULL;
+ }
+ }
+- } else
+- llc->dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd,
++ } else {
++ dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd,
+ addr->sllc_mac);
+- if (llc->dev)
+- dev_hold(llc->dev);
++ }
++ if (dev)
++ dev_hold(dev);
+ rcu_read_unlock();
+- if (!llc->dev)
++ if (!dev)
+ goto out;
+ if (!addr->sllc_sap) {
+ rc = -EUSERS;
+@@ -400,6 +409,11 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
+ goto out_put;
+ }
+ }
++
++ /* Note: We do not expect errors from this point. */
++ llc->dev = dev;
++ dev = NULL;
++
+ llc->laddr.lsap = addr->sllc_sap;
+ memcpy(llc->laddr.mac, addr->sllc_mac, IFHWADDRLEN);
+ memcpy(&llc->addr, addr, sizeof(llc->addr));
+@@ -410,6 +424,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
+ out_put:
+ llc_sap_put(sap);
+ out:
++ dev_put(dev);
+ release_sock(sk);
+ return rc;
+ }
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 6804cdd43befc..9348caf1c611d 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1823,13 +1823,11 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
+ const struct mesh_setup *setup)
+ {
+ u8 *new_ie;
+- const u8 *old_ie;
+ struct ieee80211_sub_if_data *sdata = container_of(ifmsh,
+ struct ieee80211_sub_if_data, u.mesh);
+
+ /* allocate information elements */
+ new_ie = NULL;
+- old_ie = ifmsh->ie;
+
+ if (setup->ie_len) {
+ new_ie = kmemdup(setup->ie, setup->ie_len,
+@@ -1839,7 +1837,6 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
+ }
+ ifmsh->ie_len = setup->ie_len;
+ ifmsh->ie = new_ie;
+- kfree(old_ie);
+
+ /* now copy the rest of the setup parameters */
+ ifmsh->mesh_id_len = setup->mesh_id_len;
+diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
+index a3850414dba2d..7dfaad783cd55 100644
+--- a/net/netfilter/nf_tables_core.c
++++ b/net/netfilter/nf_tables_core.c
+@@ -144,7 +144,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv)
+ struct nft_rule *const *rules;
+ const struct nft_rule *rule;
+ const struct nft_expr *expr, *last;
+- struct nft_regs regs;
++ struct nft_regs regs = {};
+ unsigned int stackptr = 0;
+ struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
+ bool genbit = READ_ONCE(net->nft.gencursor);
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index cd68a0ae82d31..c85fa85285d93 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -789,6 +789,11 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream,
+
+ if (oss_period_size < 16)
+ return -EINVAL;
++
++ /* don't allocate too large period; 1MB period must be enough */
++ if (oss_period_size > 1024 * 1024)
++ return -ENOMEM;
++
+ runtime->oss.period_bytes = oss_period_size;
+ runtime->oss.period_frames = 1;
+ runtime->oss.periods = oss_periods;
+@@ -1060,10 +1065,9 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
+ goto failure;
+ }
+ #endif
+- oss_period_size *= oss_frame_size;
+-
+- oss_buffer_size = oss_period_size * runtime->oss.periods;
+- if (oss_buffer_size < 0) {
++ oss_period_size = array_size(oss_period_size, oss_frame_size);
++ oss_buffer_size = array_size(oss_period_size, runtime->oss.periods);
++ if (oss_buffer_size <= 0) {
+ err = -EINVAL;
+ goto failure;
+ }
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index da400da1fafe6..8b7bbabeea24b 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -61,7 +61,10 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t
+ }
+ if ((width = snd_pcm_format_physical_width(format->format)) < 0)
+ return width;
+- size = frames * format->channels * width;
++ size = array3_size(frames, format->channels, width);
++ /* check for too large period size once again */
++ if (size > 1024 * 1024)
++ return -ENOMEM;
+ if (snd_BUG_ON(size % 8))
+ return -ENXIO;
+ size /= 8;
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index db62dbe7eaa8a..c92eca6278407 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -1648,21 +1648,25 @@ static int snd_pcm_do_reset(struct snd_pcm_substream *substream, int state)
+ int err = substream->ops->ioctl(substream, SNDRV_PCM_IOCTL1_RESET, NULL);
+ if (err < 0)
+ return err;
++ snd_pcm_stream_lock_irq(substream);
+ runtime->hw_ptr_base = 0;
+ runtime->hw_ptr_interrupt = runtime->status->hw_ptr -
+ runtime->status->hw_ptr % runtime->period_size;
+ runtime->silence_start = runtime->status->hw_ptr;
+ runtime->silence_filled = 0;
++ snd_pcm_stream_unlock_irq(substream);
+ return 0;
+ }
+
+ static void snd_pcm_post_reset(struct snd_pcm_substream *substream, int state)
+ {
+ struct snd_pcm_runtime *runtime = substream->runtime;
++ snd_pcm_stream_lock_irq(substream);
+ runtime->control->appl_ptr = runtime->status->hw_ptr;
+ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
+ runtime->silence_size > 0)
+ snd_pcm_playback_silence(substream, ULONG_MAX);
++ snd_pcm_stream_unlock_irq(substream);
+ }
+
+ static const struct action_ops snd_pcm_action_reset = {
+diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
+index 27b468f057dd4..34d75d4fb93f6 100644
+--- a/sound/pci/ac97/ac97_codec.c
++++ b/sound/pci/ac97/ac97_codec.c
+@@ -958,8 +958,8 @@ static int snd_ac97_ad18xx_pcm_get_volume(struct snd_kcontrol *kcontrol, struct
+ int codec = kcontrol->private_value & 3;
+
+ mutex_lock(&ac97->page_mutex);
+- ucontrol->value.integer.value[0] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 0) & 31);
+- ucontrol->value.integer.value[1] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 8) & 31);
++ ucontrol->value.integer.value[0] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 8) & 31);
++ ucontrol->value.integer.value[1] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 0) & 31);
+ mutex_unlock(&ac97->page_mutex);
+ return 0;
+ }
+diff --git a/sound/pci/cmipci.c b/sound/pci/cmipci.c
+index 452cc79b44af3..79df78a7ec56e 100644
+--- a/sound/pci/cmipci.c
++++ b/sound/pci/cmipci.c
+@@ -315,7 +315,6 @@ MODULE_PARM_DESC(joystick_port, "Joystick port address.");
+ #define CM_MICGAINZ 0x01 /* mic boost */
+ #define CM_MICGAINZ_SHIFT 0
+
+-#define CM_REG_MIXER3 0x24
+ #define CM_REG_AUX_VOL 0x26
+ #define CM_VAUXL_MASK 0xf0
+ #define CM_VAUXR_MASK 0x0f
+@@ -3326,7 +3325,7 @@ static void snd_cmipci_remove(struct pci_dev *pci)
+ */
+ static unsigned char saved_regs[] = {
+ CM_REG_FUNCTRL1, CM_REG_CHFORMAT, CM_REG_LEGACY_CTRL, CM_REG_MISC_CTRL,
+- CM_REG_MIXER0, CM_REG_MIXER1, CM_REG_MIXER2, CM_REG_MIXER3, CM_REG_PLL,
++ CM_REG_MIXER0, CM_REG_MIXER1, CM_REG_MIXER2, CM_REG_AUX_VOL, CM_REG_PLL,
+ CM_REG_CH0_FRAME1, CM_REG_CH0_FRAME2,
+ CM_REG_CH1_FRAME1, CM_REG_CH1_FRAME2, CM_REG_EXT_MISC,
+ CM_REG_INT_STATUS, CM_REG_INT_HLDCLR, CM_REG_FUNCTRL0,
+diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c
+index 4b0beb372cd94..908f13623f8cd 100644
+--- a/sound/soc/sti/uniperif_player.c
++++ b/sound/soc/sti/uniperif_player.c
+@@ -91,7 +91,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id)
+ SET_UNIPERIF_ITM_BCLR_FIFO_ERROR(player);
+
+ /* Stop the player */
+- snd_pcm_stop_xrun(player->substream);
++ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN);
+ }
+
+ ret = IRQ_HANDLED;
+@@ -105,7 +105,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id)
+ SET_UNIPERIF_ITM_BCLR_DMA_ERROR(player);
+
+ /* Stop the player */
+- snd_pcm_stop_xrun(player->substream);
++ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN);
+
+ ret = IRQ_HANDLED;
+ }
+@@ -138,7 +138,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id)
+ dev_err(player->dev, "Underflow recovery failed\n");
+
+ /* Stop the player */
+- snd_pcm_stop_xrun(player->substream);
++ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN);
+
+ ret = IRQ_HANDLED;
+ }
+diff --git a/sound/soc/sti/uniperif_reader.c b/sound/soc/sti/uniperif_reader.c
+index 7b63d35ef428b..ee0055e608529 100644
+--- a/sound/soc/sti/uniperif_reader.c
++++ b/sound/soc/sti/uniperif_reader.c
+@@ -65,7 +65,7 @@ static irqreturn_t uni_reader_irq_handler(int irq, void *dev_id)
+ if (unlikely(status & UNIPERIF_ITS_FIFO_ERROR_MASK(reader))) {
+ dev_err(reader->dev, "FIFO error detected\n");
+
+- snd_pcm_stop_xrun(reader->substream);
++ snd_pcm_stop(reader->substream, SNDRV_PCM_STATE_XRUN);
+
+ ret = IRQ_HANDLED;
+ }
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index a74e07eff60c3..3bb89fcaa2f5c 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -1997,9 +1997,10 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
+ if (unitid == 7 && cval->control == UAC_FU_VOLUME)
+ snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
+ break;
+- /* lowest playback value is muted on C-Media devices */
+- case USB_ID(0x0d8c, 0x000c):
+- case USB_ID(0x0d8c, 0x0014):
++ /* lowest playback value is muted on some devices */
++ case USB_ID(0x0d8c, 0x000c): /* C-Media */
++ case USB_ID(0x0d8c, 0x0014): /* C-Media */
++ case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */
+ if (strstr(kctl->id.name, "Playback"))
+ cval->min_mute = 1;
+ break;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-04-12 19:24 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-04-12 19:24 UTC (permalink / raw
To: gentoo-commits
commit: 06b15bb16463d0c9eb7bc43e000b8213b1eb953b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Apr 12 19:23:55 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Apr 12 19:23:55 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=06b15bb1
Select AUTOFS_FS when GENTOO_LINUX_INIT_SYSTEMD selected
Remove deprecated select AUTOFS4_FS
Bug: https://bugs.gentoo.org/838082
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
4567_distro-Gentoo-Kconfig.patch | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index 9b84f322..d4630577 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -119,7 +119,7 @@
+
+ depends on GENTOO_LINUX && GENTOO_LINUX_UDEV
+
-+ select AUTOFS4_FS
++ select AUTOFS_FS
+ select BLK_DEV_BSG
+ select BPF_SYSCALL
+ select CGROUP_BPF
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-04-15 13:11 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-04-15 13:11 UTC (permalink / raw
To: gentoo-commits
commit: b13704d1a39b86e3ed659e39c4aed824a2210c92
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Apr 15 13:10:55 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Apr 15 13:10:55 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b13704d1
Linux patch 4.19.238
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1237_linux-4.19.238.patch | 10371 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 10375 insertions(+)
diff --git a/0000_README b/0000_README
index eccf1864..49064f71 100644
--- a/0000_README
+++ b/0000_README
@@ -987,6 +987,10 @@ Patch: 1236_linux-4.19.237.patch
From: https://www.kernel.org
Desc: Linux 4.19.237
+Patch: 1237_linux-4.19.238.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.238
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1237_linux-4.19.238.patch b/1237_linux-4.19.238.patch
new file mode 100644
index 00000000..3fbdab3e
--- /dev/null
+++ b/1237_linux-4.19.238.patch
@@ -0,0 +1,10371 @@
+diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst
+index 7ba8cd567f843..e5561d78bb63a 100644
+--- a/Documentation/process/stable-kernel-rules.rst
++++ b/Documentation/process/stable-kernel-rules.rst
+@@ -174,7 +174,16 @@ Trees
+ - The finalized and tagged releases of all stable kernels can be found
+ in separate branches per version at:
+
+- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
++ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
++
++ - The release candidate of all stable kernel versions can be found at:
++
++ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/
++
++ .. warning::
++ The -stable-rc tree is a snapshot in time of the stable-queue tree and
++ will change frequently, hence will be rebased often. It should only be
++ used for testing purposes (e.g. to be consumed by CI systems).
+
+
+ Review committee
+diff --git a/Makefile b/Makefile
+index 834336f971c15..c2a8f7c5d993b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 237
++SUBLEVEL = 238
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi
+index beb6c502dadc7..bcad098a7fccb 100644
+--- a/arch/arm/boot/dts/bcm2837.dtsi
++++ b/arch/arm/boot/dts/bcm2837.dtsi
+@@ -38,12 +38,26 @@
+ #size-cells = <0>;
+ enable-method = "brcm,bcm2836-smp"; // for ARM 32-bit
+
++ /* Source for d/i-cache-line-size and d/i-cache-sets
++ * https://developer.arm.com/documentation/ddi0500/e/level-1-memory-system
++ * /about-the-l1-memory-system?lang=en
++ *
++ * Source for d/i-cache-size
++ * https://magpi.raspberrypi.com/articles/raspberry-pi-3-specs-benchmarks
++ */
+ cpu0: cpu@0 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a53";
+ reg = <0>;
+ enable-method = "spin-table";
+ cpu-release-addr = <0x0 0x000000d8>;
++ d-cache-size = <0x8000>;
++ d-cache-line-size = <64>;
++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++ i-cache-size = <0x8000>;
++ i-cache-line-size = <64>;
++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++ next-level-cache = <&l2>;
+ };
+
+ cpu1: cpu@1 {
+@@ -52,6 +66,13 @@
+ reg = <1>;
+ enable-method = "spin-table";
+ cpu-release-addr = <0x0 0x000000e0>;
++ d-cache-size = <0x8000>;
++ d-cache-line-size = <64>;
++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++ i-cache-size = <0x8000>;
++ i-cache-line-size = <64>;
++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++ next-level-cache = <&l2>;
+ };
+
+ cpu2: cpu@2 {
+@@ -60,6 +81,13 @@
+ reg = <2>;
+ enable-method = "spin-table";
+ cpu-release-addr = <0x0 0x000000e8>;
++ d-cache-size = <0x8000>;
++ d-cache-line-size = <64>;
++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++ i-cache-size = <0x8000>;
++ i-cache-line-size = <64>;
++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++ next-level-cache = <&l2>;
+ };
+
+ cpu3: cpu@3 {
+@@ -68,6 +96,27 @@
+ reg = <3>;
+ enable-method = "spin-table";
+ cpu-release-addr = <0x0 0x000000f0>;
++ d-cache-size = <0x8000>;
++ d-cache-line-size = <64>;
++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set
++ i-cache-size = <0x8000>;
++ i-cache-line-size = <64>;
++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set
++ next-level-cache = <&l2>;
++ };
++
++ /* Source for cache-line-size + cache-sets
++ * https://developer.arm.com/documentation/ddi0500
++ * /e/level-2-memory-system/about-the-l2-memory-system?lang=en
++ * Source for cache-size
++ * https://datasheets.raspberrypi.com/cm/cm1-and-cm3-datasheet.pdf
++ */
++ l2: l2-cache0 {
++ compatible = "cache";
++ cache-size = <0x80000>;
++ cache-line-size = <64>;
++ cache-sets = <512>; // 512KiB(size)/64(line-size)=8192ways/16-way set
++ cache-level = <2>;
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
+index d31a68672bfac..d7d756614edd1 100644
+--- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
++++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
+@@ -260,7 +260,7 @@
+ };
+
+ uart3_data: uart3-data {
+- samsung,pins = "gpa1-4", "gpa1-4";
++ samsung,pins = "gpa1-4", "gpa1-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
+ samsung,pin-drv = <EXYNOS4_PIN_DRV_LV1>;
+diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts
+index 594b246afbedc..80479ed69070c 100644
+--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts
++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts
+@@ -116,6 +116,9 @@
+ status = "okay";
+ ddc = <&i2c_2>;
+ hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>;
++ vdd-supply = <&ldo8_reg>;
++ vdd_osc-supply = <&ldo10_reg>;
++ vdd_pll-supply = <&ldo8_reg>;
+ };
+
+ &i2c_0 {
+diff --git a/arch/arm/boot/dts/exynos5420-smdk5420.dts b/arch/arm/boot/dts/exynos5420-smdk5420.dts
+index 831c7336f2376..660a9ad05c9b6 100644
+--- a/arch/arm/boot/dts/exynos5420-smdk5420.dts
++++ b/arch/arm/boot/dts/exynos5420-smdk5420.dts
+@@ -131,6 +131,9 @@
+ hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&hdmi_hpd_irq>;
++ vdd-supply = <&ldo6_reg>;
++ vdd_osc-supply = <&ldo7_reg>;
++ vdd_pll-supply = <&ldo6_reg>;
+ };
+
+ &hsi2c_4 {
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 8328ad589e2ba..59527bb1225a9 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -135,7 +135,8 @@
+ clocks {
+ sleep_clk: sleep_clk {
+ compatible = "fixed-clock";
+- clock-frequency = <32768>;
++ clock-frequency = <32000>;
++ clock-output-names = "gcc_sleep_clk_src";
+ #clock-cells = <0>;
+ };
+
+diff --git a/arch/arm/boot/dts/qcom-msm8960.dtsi b/arch/arm/boot/dts/qcom-msm8960.dtsi
+index 1733d8f40ab15..b256fda0f5ea4 100644
+--- a/arch/arm/boot/dts/qcom-msm8960.dtsi
++++ b/arch/arm/boot/dts/qcom-msm8960.dtsi
+@@ -140,7 +140,9 @@
+ reg = <0x108000 0x1000>;
+ qcom,ipc = <&l2cc 0x8 2>;
+
+- interrupts = <0 19 0>, <0 21 0>, <0 22 0>;
++ interrupts = <GIC_SPI 19 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 21 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 22 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "ack", "err", "wakeup";
+
+ regulators {
+@@ -186,7 +188,7 @@
+ compatible = "qcom,msm-uartdm-v1.3", "qcom,msm-uartdm";
+ reg = <0x16440000 0x1000>,
+ <0x16400000 0x1000>;
+- interrupts = <0 154 0x0>;
++ interrupts = <GIC_SPI 154 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&gcc GSBI5_UART_CLK>, <&gcc GSBI5_H_CLK>;
+ clock-names = "core", "iface";
+ status = "disabled";
+@@ -312,7 +314,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ reg = <0x16080000 0x1000>;
+- interrupts = <0 147 0>;
++ interrupts = <GIC_SPI 147 IRQ_TYPE_LEVEL_HIGH>;
+ spi-max-frequency = <24000000>;
+ cs-gpios = <&msmgpio 8 0>;
+
+diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
+index d856c16d00156..79696d4f4f65d 100644
+--- a/arch/arm/boot/dts/sama5d2.dtsi
++++ b/arch/arm/boot/dts/sama5d2.dtsi
+@@ -1125,7 +1125,7 @@
+ pmecc: ecc-engine@f8014070 {
+ compatible = "atmel,sama5d2-pmecc";
+ reg = <0xf8014070 0x490>,
+- <0xf8014500 0x100>;
++ <0xf8014500 0x200>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/spear1340.dtsi b/arch/arm/boot/dts/spear1340.dtsi
+index d4dbc4098653e..cf1139973bdad 100644
+--- a/arch/arm/boot/dts/spear1340.dtsi
++++ b/arch/arm/boot/dts/spear1340.dtsi
+@@ -142,9 +142,9 @@
+ reg = <0xb4100000 0x1000>;
+ interrupts = <0 105 0x4>;
+ status = "disabled";
+- dmas = <&dwdma0 12 0 1>,
+- <&dwdma0 13 1 0>;
+- dma-names = "tx", "rx";
++ dmas = <&dwdma0 13 0 1>,
++ <&dwdma0 12 1 0>;
++ dma-names = "rx", "tx";
+ };
+
+ thermal@e07008c4 {
+diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi
+index 086b4b3332494..06eb7245d93e8 100644
+--- a/arch/arm/boot/dts/spear13xx.dtsi
++++ b/arch/arm/boot/dts/spear13xx.dtsi
+@@ -290,9 +290,9 @@
+ #size-cells = <0>;
+ interrupts = <0 31 0x4>;
+ status = "disabled";
+- dmas = <&dwdma0 4 0 0>,
+- <&dwdma0 5 0 0>;
+- dma-names = "tx", "rx";
++ dmas = <&dwdma0 5 0 0>,
++ <&dwdma0 4 0 0>;
++ dma-names = "rx", "tx";
+ };
+
+ rtc@e0580000 {
+diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+index 394a6b4dc69d5..69cb65d86c467 100644
+--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi
++++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi
+@@ -183,8 +183,8 @@
+ };
+ conf_ata {
+ nvidia,pins = "ata", "atb", "atc", "atd", "ate",
+- "cdev1", "cdev2", "dap1", "dtb", "gma",
+- "gmb", "gmc", "gmd", "gme", "gpu7",
++ "cdev1", "cdev2", "dap1", "dtb", "dtf",
++ "gma", "gmb", "gmc", "gmd", "gme", "gpu7",
+ "gpv", "i2cp", "irrx", "irtx", "pta",
+ "rm", "slxa", "slxk", "spia", "spib",
+ "uac";
+@@ -203,7 +203,7 @@
+ };
+ conf_crtp {
+ nvidia,pins = "crtp", "dap2", "dap3", "dap4",
+- "dtc", "dte", "dtf", "gpu", "sdio1",
++ "dtc", "dte", "gpu", "sdio1",
+ "slxc", "slxd", "spdi", "spdo", "spig",
+ "uda";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+diff --git a/arch/arm/mach-mmp/sram.c b/arch/arm/mach-mmp/sram.c
+index ba91e4fe444d9..3c4e41dabb021 100644
+--- a/arch/arm/mach-mmp/sram.c
++++ b/arch/arm/mach-mmp/sram.c
+@@ -76,6 +76,8 @@ static int sram_probe(struct platform_device *pdev)
+ if (!info)
+ return -ENOMEM;
+
++ platform_set_drvdata(pdev, info);
++
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (res == NULL) {
+ dev_err(&pdev->dev, "no memory resource defined\n");
+@@ -111,8 +113,6 @@ static int sram_probe(struct platform_device *pdev)
+ list_add(&info->node, &sram_bank_list);
+ mutex_unlock(&sram_lock);
+
+- platform_set_drvdata(pdev, info);
+-
+ dev_info(&pdev->dev, "initialized\n");
+ return 0;
+
+@@ -131,17 +131,19 @@ static int sram_remove(struct platform_device *pdev)
+ struct sram_bank_info *info;
+
+ info = platform_get_drvdata(pdev);
+- if (info == NULL)
+- return -ENODEV;
+
+- mutex_lock(&sram_lock);
+- list_del(&info->node);
+- mutex_unlock(&sram_lock);
++ if (info->sram_size) {
++ mutex_lock(&sram_lock);
++ list_del(&info->node);
++ mutex_unlock(&sram_lock);
++
++ gen_pool_destroy(info->gpool);
++ iounmap(info->sram_virt);
++ kfree(info->pool_name);
++ }
+
+- gen_pool_destroy(info->gpool);
+- iounmap(info->sram_virt);
+- kfree(info->pool_name);
+ kfree(info);
++
+ return 0;
+ }
+
+diff --git a/arch/arm/mach-s3c24xx/mach-jive.c b/arch/arm/mach-s3c24xx/mach-jive.c
+index 885e8f12e4b91..eedc9f8ed2109 100644
+--- a/arch/arm/mach-s3c24xx/mach-jive.c
++++ b/arch/arm/mach-s3c24xx/mach-jive.c
+@@ -237,11 +237,11 @@ static int __init jive_mtdset(char *options)
+ unsigned long set;
+
+ if (options == NULL || options[0] == '\0')
+- return 0;
++ return 1;
+
+ if (kstrtoul(options, 10, &set)) {
+ printk(KERN_ERR "failed to parse mtdset=%s\n", options);
+- return 0;
++ return 1;
+ }
+
+ switch (set) {
+@@ -256,7 +256,7 @@ static int __init jive_mtdset(char *options)
+ "using default.", set);
+ }
+
+- return 0;
++ return 1;
+ }
+
+ /* parse the mtdset= option given to the kernel command line */
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts
+index ec19fbf928a14..12a4b1c03390c 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts
+@@ -111,8 +111,8 @@
+ compatible = "silabs,si3226x";
+ reg = <0>;
+ spi-max-frequency = <5000000>;
+- spi-cpha = <1>;
+- spi-cpol = <1>;
++ spi-cpha;
++ spi-cpol;
+ pl022,hierarchy = <0>;
+ pl022,interface = <0>;
+ pl022,slave-tx-disable = <0>;
+@@ -135,8 +135,8 @@
+ at25,byte-len = <0x8000>;
+ at25,addr-mode = <2>;
+ at25,page-size = <64>;
+- spi-cpha = <1>;
+- spi-cpol = <1>;
++ spi-cpha;
++ spi-cpol;
+ pl022,hierarchy = <0>;
+ pl022,interface = <0>;
+ pl022,slave-tx-disable = <0>;
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+index 6bfb7bbd264af..772ecf4ed3e62 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -687,7 +687,7 @@
+ };
+ };
+
+- sata: ahci@663f2000 {
++ sata: sata@663f2000 {
+ compatible = "brcm,iproc-ahci", "generic-ahci";
+ reg = <0x663f2000 0x1000>;
+ dma-coherent;
+diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
+index 44d3fdbcdf629..0243b6d224533 100644
+--- a/arch/arm64/include/asm/kvm_mmu.h
++++ b/arch/arm64/include/asm/kvm_mmu.h
+@@ -439,7 +439,8 @@ static inline void *kvm_get_hyp_vector(void)
+ int slot = -1;
+
+ if ((cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) ||
+- cpus_have_const_cap(ARM64_SPECTRE_BHB)) && data->template_start) {
++ cpus_have_const_cap(ARM64_SPECTRE_BHB)) &&
++ data && data->template_start) {
+ vect = kern_hyp_va(kvm_ksym_ref(__bp_harden_hyp_vecs_start));
+ slot = data->hyp_vectors_slot;
+ }
+diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
+index cd37edbdedcb7..bc5112b471a51 100644
+--- a/arch/arm64/kernel/insn.c
++++ b/arch/arm64/kernel/insn.c
+@@ -204,8 +204,8 @@ static int __kprobes aarch64_insn_patch_text_cb(void *arg)
+ int i, ret = 0;
+ struct aarch64_insn_patch *pp = arg;
+
+- /* The first CPU becomes master */
+- if (atomic_inc_return(&pp->cpu_count) == 1) {
++ /* The last CPU becomes master */
++ if (atomic_inc_return(&pp->cpu_count) == num_online_cpus()) {
+ for (i = 0; ret == 0 && i < pp->insn_cnt; i++)
+ ret = aarch64_insn_patch_text_nosync(pp->text_addrs[i],
+ pp->new_insns[i]);
+diff --git a/arch/arm64/kernel/module.lds b/arch/arm64/kernel/module.lds
+index 09a0eef71d12b..9371abe2f4c2d 100644
+--- a/arch/arm64/kernel/module.lds
++++ b/arch/arm64/kernel/module.lds
+@@ -1,5 +1,5 @@
+ SECTIONS {
+- .plt 0 (NOLOAD) : { BYTE(0) }
+- .init.plt 0 (NOLOAD) : { BYTE(0) }
+- .text.ftrace_trampoline 0 (NOLOAD) : { BYTE(0) }
++ .plt 0 : { BYTE(0) }
++ .init.plt 0 : { BYTE(0) }
++ .text.ftrace_trampoline 0 : { BYTE(0) }
+ }
+diff --git a/arch/mips/dec/prom/Makefile b/arch/mips/dec/prom/Makefile
+index ae73e42ac20b1..4c369359cdab5 100644
+--- a/arch/mips/dec/prom/Makefile
++++ b/arch/mips/dec/prom/Makefile
+@@ -5,4 +5,4 @@
+
+ lib-y += init.o memory.o cmdline.o identify.o console.o
+
+-lib-$(CONFIG_32BIT) += locore.o
++lib-$(CONFIG_CPU_R3000) += locore.o
+diff --git a/arch/mips/include/asm/dec/prom.h b/arch/mips/include/asm/dec/prom.h
+index b59a2103b61a3..09538ff5e9245 100644
+--- a/arch/mips/include/asm/dec/prom.h
++++ b/arch/mips/include/asm/dec/prom.h
+@@ -47,16 +47,11 @@
+ */
+ #define REX_PROM_MAGIC 0x30464354
+
+-#ifdef CONFIG_64BIT
+-
+-#define prom_is_rex(magic) 1 /* KN04 and KN05 are REX PROMs. */
+-
+-#else /* !CONFIG_64BIT */
+-
+-#define prom_is_rex(magic) ((magic) == REX_PROM_MAGIC)
+-
+-#endif /* !CONFIG_64BIT */
+-
++/* KN04 and KN05 are REX PROMs, so only do the check for R3k systems. */
++static inline bool prom_is_rex(u32 magic)
++{
++ return !IS_ENABLED(CONFIG_CPU_R3000) || magic == REX_PROM_MAGIC;
++}
+
+ /*
+ * 3MIN/MAXINE PROM entry points for DS5000/1xx's, DS5000/xx's and
+diff --git a/arch/mips/include/asm/setup.h b/arch/mips/include/asm/setup.h
+index bb36a400203df..8c56b862fd9c2 100644
+--- a/arch/mips/include/asm/setup.h
++++ b/arch/mips/include/asm/setup.h
+@@ -16,7 +16,7 @@ static inline void setup_8250_early_printk_port(unsigned long base,
+ unsigned int reg_shift, unsigned int timeout) {}
+ #endif
+
+-extern void set_handler(unsigned long offset, void *addr, unsigned long len);
++void set_handler(unsigned long offset, const void *addr, unsigned long len);
+ extern void set_uncached_handler(unsigned long offset, void *addr, unsigned long len);
+
+ typedef void (*vi_handler_t)(void);
+diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
+index b9da2cefb564c..0ca4185cc5e38 100644
+--- a/arch/mips/kernel/traps.c
++++ b/arch/mips/kernel/traps.c
+@@ -1978,19 +1978,19 @@ static void *set_vi_srs_handler(int n, vi_handler_t addr, int srs)
+ * If no shadow set is selected then use the default handler
+ * that does normal register saving and standard interrupt exit
+ */
+- extern char except_vec_vi, except_vec_vi_lui;
+- extern char except_vec_vi_ori, except_vec_vi_end;
+- extern char rollback_except_vec_vi;
+- char *vec_start = using_rollback_handler() ?
+- &rollback_except_vec_vi : &except_vec_vi;
++ extern const u8 except_vec_vi[], except_vec_vi_lui[];
++ extern const u8 except_vec_vi_ori[], except_vec_vi_end[];
++ extern const u8 rollback_except_vec_vi[];
++ const u8 *vec_start = using_rollback_handler() ?
++ rollback_except_vec_vi : except_vec_vi;
+ #if defined(CONFIG_CPU_MICROMIPS) || defined(CONFIG_CPU_BIG_ENDIAN)
+- const int lui_offset = &except_vec_vi_lui - vec_start + 2;
+- const int ori_offset = &except_vec_vi_ori - vec_start + 2;
++ const int lui_offset = except_vec_vi_lui - vec_start + 2;
++ const int ori_offset = except_vec_vi_ori - vec_start + 2;
+ #else
+- const int lui_offset = &except_vec_vi_lui - vec_start;
+- const int ori_offset = &except_vec_vi_ori - vec_start;
++ const int lui_offset = except_vec_vi_lui - vec_start;
++ const int ori_offset = except_vec_vi_ori - vec_start;
+ #endif
+- const int handler_len = &except_vec_vi_end - vec_start;
++ const int handler_len = except_vec_vi_end - vec_start;
+
+ if (handler_len > VECTORSPACING) {
+ /*
+@@ -2210,7 +2210,7 @@ void per_cpu_trap_init(bool is_boot_cpu)
+ }
+
+ /* Install CPU exception handler */
+-void set_handler(unsigned long offset, void *addr, unsigned long size)
++void set_handler(unsigned long offset, const void *addr, unsigned long size)
+ {
+ #ifdef CONFIG_CPU_MICROMIPS
+ memcpy((void *)(ebase + offset), ((unsigned char *)addr - 1), size);
+diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c
+index 354d258396ff9..6624fe15839ad 100644
+--- a/arch/mips/rb532/devices.c
++++ b/arch/mips/rb532/devices.c
+@@ -315,11 +315,9 @@ static int __init plat_setup_devices(void)
+ static int __init setup_kmac(char *s)
+ {
+ printk(KERN_INFO "korina mac = %s\n", s);
+- if (!mac_pton(s, korina_dev0_data.mac)) {
++ if (!mac_pton(s, korina_dev0_data.mac))
+ printk(KERN_ERR "Invalid mac\n");
+- return -EINVAL;
+- }
+- return 0;
++ return 1;
+ }
+
+ __setup("kmac=", setup_kmac);
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index f51e21ea53492..26654d0c2af7e 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -167,7 +167,7 @@ else
+ CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,$(call cc-option,-mtune=power5))
+ CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mcpu=power5,-mcpu=power4)
+ endif
+-else
++else ifdef CONFIG_PPC_BOOK3E_64
+ CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64
+ endif
+
+diff --git a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi
+index 099a598c74c00..bfe1ed5be3374 100644
+--- a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi
++++ b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi
+@@ -139,12 +139,12 @@
+ fman@400000 {
+ ethernet@e6000 {
+ phy-handle = <&phy_rgmii_0>;
+- phy-connection-type = "rgmii";
++ phy-connection-type = "rgmii-id";
+ };
+
+ ethernet@e8000 {
+ phy-handle = <&phy_rgmii_1>;
+- phy-connection-type = "rgmii";
++ phy-connection-type = "rgmii-id";
+ };
+
+ mdio0: mdio@fc000 {
+diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h
+index b855f56489acc..4681d4c50567e 100644
+--- a/arch/powerpc/include/asm/io.h
++++ b/arch/powerpc/include/asm/io.h
+@@ -372,25 +372,37 @@ static inline void __raw_writeq_be(unsigned long v, volatile void __iomem *addr)
+ */
+ static inline void __raw_rm_writeb(u8 val, volatile void __iomem *paddr)
+ {
+- __asm__ __volatile__("stbcix %0,0,%1"
++ __asm__ __volatile__(".machine push; \
++ .machine power6; \
++ stbcix %0,0,%1; \
++ .machine pop;"
+ : : "r" (val), "r" (paddr) : "memory");
+ }
+
+ static inline void __raw_rm_writew(u16 val, volatile void __iomem *paddr)
+ {
+- __asm__ __volatile__("sthcix %0,0,%1"
++ __asm__ __volatile__(".machine push; \
++ .machine power6; \
++ sthcix %0,0,%1; \
++ .machine pop;"
+ : : "r" (val), "r" (paddr) : "memory");
+ }
+
+ static inline void __raw_rm_writel(u32 val, volatile void __iomem *paddr)
+ {
+- __asm__ __volatile__("stwcix %0,0,%1"
++ __asm__ __volatile__(".machine push; \
++ .machine power6; \
++ stwcix %0,0,%1; \
++ .machine pop;"
+ : : "r" (val), "r" (paddr) : "memory");
+ }
+
+ static inline void __raw_rm_writeq(u64 val, volatile void __iomem *paddr)
+ {
+- __asm__ __volatile__("stdcix %0,0,%1"
++ __asm__ __volatile__(".machine push; \
++ .machine power6; \
++ stdcix %0,0,%1; \
++ .machine pop;"
+ : : "r" (val), "r" (paddr) : "memory");
+ }
+
+@@ -402,7 +414,10 @@ static inline void __raw_rm_writeq_be(u64 val, volatile void __iomem *paddr)
+ static inline u8 __raw_rm_readb(volatile void __iomem *paddr)
+ {
+ u8 ret;
+- __asm__ __volatile__("lbzcix %0,0, %1"
++ __asm__ __volatile__(".machine push; \
++ .machine power6; \
++ lbzcix %0,0, %1; \
++ .machine pop;"
+ : "=r" (ret) : "r" (paddr) : "memory");
+ return ret;
+ }
+@@ -410,7 +425,10 @@ static inline u8 __raw_rm_readb(volatile void __iomem *paddr)
+ static inline u16 __raw_rm_readw(volatile void __iomem *paddr)
+ {
+ u16 ret;
+- __asm__ __volatile__("lhzcix %0,0, %1"
++ __asm__ __volatile__(".machine push; \
++ .machine power6; \
++ lhzcix %0,0, %1; \
++ .machine pop;"
+ : "=r" (ret) : "r" (paddr) : "memory");
+ return ret;
+ }
+@@ -418,7 +436,10 @@ static inline u16 __raw_rm_readw(volatile void __iomem *paddr)
+ static inline u32 __raw_rm_readl(volatile void __iomem *paddr)
+ {
+ u32 ret;
+- __asm__ __volatile__("lwzcix %0,0, %1"
++ __asm__ __volatile__(".machine push; \
++ .machine power6; \
++ lwzcix %0,0, %1; \
++ .machine pop;"
+ : "=r" (ret) : "r" (paddr) : "memory");
+ return ret;
+ }
+@@ -426,7 +447,10 @@ static inline u32 __raw_rm_readl(volatile void __iomem *paddr)
+ static inline u64 __raw_rm_readq(volatile void __iomem *paddr)
+ {
+ u64 ret;
+- __asm__ __volatile__("ldcix %0,0, %1"
++ __asm__ __volatile__(".machine push; \
++ .machine power6; \
++ ldcix %0,0, %1; \
++ .machine pop;"
+ : "=r" (ret) : "r" (paddr) : "memory");
+ return ret;
+ }
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index ab6612e35ace3..6ed40fcd8515f 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -217,8 +217,11 @@ extern long __get_user_bad(void);
+ */
+ #define __get_user_atomic_128_aligned(kaddr, uaddr, err) \
+ __asm__ __volatile__( \
++ ".machine push\n" \
++ ".machine altivec\n" \
+ "1: lvx 0,0,%1 # get user\n" \
+ " stvx 0,0,%2 # put kernel\n" \
++ ".machine pop\n" \
+ "2:\n" \
+ ".section .fixup,\"ax\"\n" \
+ "3: li %0,%3\n" \
+diff --git a/arch/powerpc/kernel/kvm.c b/arch/powerpc/kernel/kvm.c
+index cd381e2291dfe..2283b9bfd2d1c 100644
+--- a/arch/powerpc/kernel/kvm.c
++++ b/arch/powerpc/kernel/kvm.c
+@@ -680,7 +680,7 @@ static void kvm_use_magic_page(void)
+ on_each_cpu(kvm_map_magic_page, &features, 1);
+
+ /* Quick self-test to see if the mapping works */
+- if (!fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) {
++ if (fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) {
+ kvm_patching_worked = false;
+ return;
+ }
+diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
+index 094c37fb07a96..437c50bfe4e6b 100644
+--- a/arch/powerpc/kernel/machine_kexec.c
++++ b/arch/powerpc/kernel/machine_kexec.c
+@@ -148,11 +148,18 @@ void __init reserve_crashkernel(void)
+ if (!crashk_res.start) {
+ #ifdef CONFIG_PPC64
+ /*
+- * On 64bit we split the RMO in half but cap it at half of
+- * a small SLB (128MB) since the crash kernel needs to place
+- * itself and some stacks to be in the first segment.
++ * On the LPAR platform place the crash kernel to mid of
++ * RMA size (512MB or more) to ensure the crash kernel
++ * gets enough space to place itself and some stack to be
++ * in the first segment. At the same time normal kernel
++ * also get enough space to allocate memory for essential
++ * system resource in the first segment. Keep the crash
++ * kernel starts at 128MB offset on other platforms.
+ */
+- crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2));
++ if (firmware_has_feature(FW_FEATURE_LPAR))
++ crashk_res.start = ppc64_rma_size / 2;
++ else
++ crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2));
+ #else
+ crashk_res.start = KDUMP_KERNELBASE;
+ #endif
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index b3aa0cea6283f..362c20c8c22f9 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -1357,6 +1357,12 @@ int __init early_init_dt_scan_rtas(unsigned long node,
+ entryp = of_get_flat_dt_prop(node, "linux,rtas-entry", NULL);
+ sizep = of_get_flat_dt_prop(node, "rtas-size", NULL);
+
++#ifdef CONFIG_PPC64
++ /* need this feature to decide the crashkernel offset */
++ if (of_get_flat_dt_prop(node, "ibm,hypertas-functions", NULL))
++ powerpc_firmware_features |= FW_FEATURE_LPAR;
++#endif
++
+ if (basep && entryp && sizep) {
+ rtas.base = *basep;
+ rtas.entry = *entryp;
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index ad5a871a6cbfd..dd352842a1c72 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -1479,7 +1479,7 @@ int kvmppc_handle_vmx_load(struct kvm_run *run, struct kvm_vcpu *vcpu,
+ {
+ enum emulation_result emulated = EMULATE_DONE;
+
+- if (vcpu->arch.mmio_vsx_copy_nums > 2)
++ if (vcpu->arch.mmio_vmx_copy_nums > 2)
+ return EMULATE_FAIL;
+
+ while (vcpu->arch.mmio_vmx_copy_nums) {
+@@ -1576,7 +1576,7 @@ int kvmppc_handle_vmx_store(struct kvm_run *run, struct kvm_vcpu *vcpu,
+ unsigned int index = rs & KVM_MMIO_REG_MASK;
+ enum emulation_result emulated = EMULATE_DONE;
+
+- if (vcpu->arch.mmio_vsx_copy_nums > 2)
++ if (vcpu->arch.mmio_vmx_copy_nums > 2)
+ return EMULATE_FAIL;
+
+ vcpu->arch.io_gpr = rs;
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index e87ae0dabce12..30c434abe8616 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -910,7 +910,10 @@ NOKPROBE_SYMBOL(emulate_dcbz);
+
+ #define __put_user_asmx(x, addr, err, op, cr) \
+ __asm__ __volatile__( \
++ ".machine push\n" \
++ ".machine power8\n" \
+ "1: " op " %2,0,%3\n" \
++ ".machine pop\n" \
+ " mfcr %1\n" \
+ "2:\n" \
+ ".section .fixup,\"ax\"\n" \
+@@ -923,7 +926,10 @@ NOKPROBE_SYMBOL(emulate_dcbz);
+
+ #define __get_user_asmx(x, addr, err, op) \
+ __asm__ __volatile__( \
++ ".machine push\n" \
++ ".machine power8\n" \
+ "1: "op" %1,0,%2\n" \
++ ".machine pop\n" \
+ "2:\n" \
+ ".section .fixup,\"ax\"\n" \
+ "3: li %0,%3\n" \
+@@ -2806,7 +2812,7 @@ int emulate_loadstore(struct pt_regs *regs, struct instruction_op *op)
+ __put_user_asmx(op->val, ea, err, "stbcx.", cr);
+ break;
+ case 2:
+- __put_user_asmx(op->val, ea, err, "stbcx.", cr);
++ __put_user_asmx(op->val, ea, err, "sthcx.", cr);
+ break;
+ #endif
+ case 4:
+diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c
+index 718f50ed22f1f..e15dd09f71dfb 100644
+--- a/arch/powerpc/platforms/powernv/rng.c
++++ b/arch/powerpc/platforms/powernv/rng.c
+@@ -47,7 +47,11 @@ static unsigned long rng_whiten(struct powernv_rng *rng, unsigned long val)
+ unsigned long parity;
+
+ /* Calculate the parity of the value */
+- asm ("popcntd %0,%1" : "=r" (parity) : "r" (val));
++ asm (".machine push; \
++ .machine power7; \
++ popcntd %0,%1; \
++ .machine pop;"
++ : "=r" (parity) : "r" (val));
+
+ /* xor our value with the previous mask */
+ val ^= rng->mask;
+diff --git a/arch/powerpc/sysdev/fsl_gtm.c b/arch/powerpc/sysdev/fsl_gtm.c
+index d902306f47183..42fe959f6fc28 100644
+--- a/arch/powerpc/sysdev/fsl_gtm.c
++++ b/arch/powerpc/sysdev/fsl_gtm.c
+@@ -90,7 +90,7 @@ static LIST_HEAD(gtms);
+ */
+ struct gtm_timer *gtm_get_timer16(void)
+ {
+- struct gtm *gtm = NULL;
++ struct gtm *gtm;
+ int i;
+
+ list_for_each_entry(gtm, >ms, list_node) {
+@@ -107,7 +107,7 @@ struct gtm_timer *gtm_get_timer16(void)
+ spin_unlock_irq(>m->lock);
+ }
+
+- if (gtm)
++ if (!list_empty(>ms))
+ return ERR_PTR(-EBUSY);
+ return ERR_PTR(-ENODEV);
+ }
+diff --git a/arch/riscv/kernel/module.lds b/arch/riscv/kernel/module.lds
+index 295ecfb341a29..18ec719899e28 100644
+--- a/arch/riscv/kernel/module.lds
++++ b/arch/riscv/kernel/module.lds
+@@ -2,7 +2,7 @@
+ /* Copyright (C) 2017 Andes Technology Corporation */
+
+ SECTIONS {
+- .plt (NOLOAD) : { BYTE(0) }
+- .got (NOLOAD) : { BYTE(0) }
+- .got.plt (NOLOAD) : { BYTE(0) }
++ .plt : { BYTE(0) }
++ .got : { BYTE(0) }
++ .got.plt : { BYTE(0) }
+ }
+diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
+index d5f9a2d1da1ba..ef4b00b9590b1 100644
+--- a/arch/um/drivers/mconsole_kern.c
++++ b/arch/um/drivers/mconsole_kern.c
+@@ -218,7 +218,7 @@ void mconsole_go(struct mc_request *req)
+
+ void mconsole_stop(struct mc_request *req)
+ {
+- deactivate_fd(req->originating_fd, MCONSOLE_IRQ);
++ block_signals();
+ os_set_fd_block(req->originating_fd, 1);
+ mconsole_reply(req, "stopped", 0, 0);
+ for (;;) {
+@@ -242,6 +242,7 @@ void mconsole_stop(struct mc_request *req)
+ os_set_fd_block(req->originating_fd, 0);
+ reactivate_fd(req->originating_fd, MCONSOLE_IRQ);
+ mconsole_reply(req, "", 0, 0);
++ unblock_signals();
+ }
+
+ static DEFINE_SPINLOCK(mc_devices_lock);
+diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
+index 849f0ba53a9b9..49b3ea1c1ea19 100644
+--- a/arch/x86/events/intel/pt.c
++++ b/arch/x86/events/intel/pt.c
+@@ -460,7 +460,7 @@ static u64 pt_config_filters(struct perf_event *event)
+ pt->filters.filter[range].msr_b = filter->msr_b;
+ }
+
+- rtit_ctl |= filter->config << pt_address_ranges[range].reg_off;
++ rtit_ctl |= (u64)filter->config << pt_address_ranges[range].reg_off;
+ }
+
+ return rtit_ctl;
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index cee45d46e67dc..bd6ee0bfa1d28 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -480,7 +480,7 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector)
+ } else if (apic_id < min && max - apic_id < KVM_IPI_CLUSTER_SIZE) {
+ ipi_bitmap <<= min - apic_id;
+ min = apic_id;
+- } else if (apic_id < min + KVM_IPI_CLUSTER_SIZE) {
++ } else if (apic_id > min && apic_id < min + KVM_IPI_CLUSTER_SIZE) {
+ max = apic_id < max ? max : apic_id;
+ } else {
+ ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap,
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 3e182c7ae7714..63754d248dfbe 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -1669,11 +1669,6 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ goto exception;
+ }
+
+- if (!seg_desc.p) {
+- err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
+- goto exception;
+- }
+-
+ dpl = seg_desc.dpl;
+
+ switch (seg) {
+@@ -1713,6 +1708,10 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ case VCPU_SREG_TR:
+ if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9))
+ goto exception;
++ if (!seg_desc.p) {
++ err_vec = NP_VECTOR;
++ goto exception;
++ }
+ old_desc = seg_desc;
+ seg_desc.type |= 2; /* busy */
+ ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc,
+@@ -1737,6 +1736,11 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ break;
+ }
+
++ if (!seg_desc.p) {
++ err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR;
++ goto exception;
++ }
++
+ if (seg_desc.s) {
+ /* mark segment as accessed */
+ if (!(seg_desc.type & 1)) {
+diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
+index 3fd6c4b2c2b7b..ca5a6c3f8c911 100644
+--- a/arch/x86/kvm/hyperv.c
++++ b/arch/x86/kvm/hyperv.c
+@@ -237,7 +237,7 @@ static int synic_set_msr(struct kvm_vcpu_hv_synic *synic,
+ struct kvm_vcpu *vcpu = synic_to_vcpu(synic);
+ int ret;
+
+- if (!synic->active && !host)
++ if (!synic->active && (!host || data))
+ return 1;
+
+ trace_kvm_hv_synic_set_msr(vcpu->vcpu_id, msr, data, host);
+@@ -283,6 +283,9 @@ static int synic_set_msr(struct kvm_vcpu_hv_synic *synic,
+ case HV_X64_MSR_EOM: {
+ int i;
+
++ if (!synic->active)
++ break;
++
+ for (i = 0; i < ARRAY_SIZE(synic->sint); i++)
+ kvm_hv_notify_acked_sint(vcpu, i);
+ break;
+@@ -544,6 +547,12 @@ static int stimer_start(struct kvm_vcpu_hv_stimer *stimer)
+ static int stimer_set_config(struct kvm_vcpu_hv_stimer *stimer, u64 config,
+ bool host)
+ {
++ struct kvm_vcpu *vcpu = stimer_to_vcpu(stimer);
++ struct kvm_vcpu_hv_synic *synic = vcpu_to_synic(vcpu);
++
++ if (!synic->active && (!host || config))
++ return 1;
++
+ trace_kvm_hv_stimer_set_config(stimer_to_vcpu(stimer)->vcpu_id,
+ stimer->index, config, host);
+
+@@ -558,6 +567,12 @@ static int stimer_set_config(struct kvm_vcpu_hv_stimer *stimer, u64 config,
+ static int stimer_set_count(struct kvm_vcpu_hv_stimer *stimer, u64 count,
+ bool host)
+ {
++ struct kvm_vcpu *vcpu = stimer_to_vcpu(stimer);
++ struct kvm_vcpu_hv_synic *synic = vcpu_to_synic(vcpu);
++
++ if (!synic->active && (!host || count))
++ return 1;
++
+ trace_kvm_hv_stimer_set_count(stimer_to_vcpu(stimer)->vcpu_id,
+ stimer->index, count, host);
+
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 56a4b9762b0c1..89d07312e58cf 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2045,10 +2045,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data)
+
+ void kvm_lapic_set_tpr(struct kvm_vcpu *vcpu, unsigned long cr8)
+ {
+- struct kvm_lapic *apic = vcpu->arch.apic;
+-
+- apic_set_tpr(apic, ((cr8 & 0x0f) << 4)
+- | (kvm_lapic_get_reg(apic, APIC_TASKPRI) & 4));
++ apic_set_tpr(vcpu->arch.apic, (cr8 & 0x0f) << 4);
+ }
+
+ u64 kvm_lapic_get_cr8(struct kvm_vcpu *vcpu)
+diff --git a/arch/x86/kvm/pmu_amd.c b/arch/x86/kvm/pmu_amd.c
+index 41dff881e0f03..93a135f216b28 100644
+--- a/arch/x86/kvm/pmu_amd.c
++++ b/arch/x86/kvm/pmu_amd.c
+@@ -247,12 +247,10 @@ static int amd_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ /* MSR_EVNTSELn */
+ pmc = get_gp_pmc_amd(pmu, msr, PMU_TYPE_EVNTSEL);
+ if (pmc) {
+- if (data == pmc->eventsel)
+- return 0;
+- if (!(data & pmu->reserved_bits)) {
++ data &= ~pmu->reserved_bits;
++ if (data != pmc->eventsel)
+ reprogram_gp_counter(pmc, data);
+- return 0;
+- }
++ return 0;
+ }
+
+ return 1;
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index 3aa3149df07f9..e00b8c36ab721 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -41,7 +41,8 @@ static void msr_save_context(struct saved_context *ctxt)
+ struct saved_msr *end = msr + ctxt->saved_msrs.num;
+
+ while (msr < end) {
+- msr->valid = !rdmsrl_safe(msr->info.msr_no, &msr->info.reg.q);
++ if (msr->valid)
++ rdmsrl(msr->info.msr_no, msr->info.reg.q);
+ msr++;
+ }
+ }
+@@ -426,8 +427,10 @@ static int msr_build_context(const u32 *msr_id, const int num)
+ }
+
+ for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) {
++ u64 dummy;
++
+ msr_array[i].info.msr_no = msr_id[j];
+- msr_array[i].valid = false;
++ msr_array[i].valid = !rdmsrl_safe(msr_id[j], &dummy);
+ msr_array[i].info.reg.q = 0;
+ }
+ saved_msrs->num = total_num;
+@@ -514,10 +517,24 @@ static int pm_cpu_check(const struct x86_cpu_id *c)
+ return ret;
+ }
+
++static void pm_save_spec_msr(void)
++{
++ u32 spec_msr_id[] = {
++ MSR_IA32_SPEC_CTRL,
++ MSR_IA32_TSX_CTRL,
++ MSR_TSX_FORCE_ABORT,
++ MSR_IA32_MCU_OPT_CTRL,
++ MSR_AMD64_LS_CFG,
++ };
++
++ msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id));
++}
++
+ static int pm_check_save_msr(void)
+ {
+ dmi_check_system(msr_save_dmi_table);
+ pm_cpu_check(msr_save_cpu_table);
++ pm_save_spec_msr();
+
+ return 0;
+ }
+diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c
+index 95997e6c06960..9813298ba57d1 100644
+--- a/arch/x86/xen/pmu.c
++++ b/arch/x86/xen/pmu.c
+@@ -505,10 +505,7 @@ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id)
+ return ret;
+ }
+
+-bool is_xen_pmu(int cpu)
+-{
+- return (get_xenpmu_data() != NULL);
+-}
++bool is_xen_pmu;
+
+ void xen_pmu_init(int cpu)
+ {
+@@ -519,7 +516,7 @@ void xen_pmu_init(int cpu)
+
+ BUILD_BUG_ON(sizeof(struct xen_pmu_data) > PAGE_SIZE);
+
+- if (xen_hvm_domain())
++ if (xen_hvm_domain() || (cpu != 0 && !is_xen_pmu))
+ return;
+
+ xenpmu_data = (struct xen_pmu_data *)get_zeroed_page(GFP_KERNEL);
+@@ -540,7 +537,8 @@ void xen_pmu_init(int cpu)
+ per_cpu(xenpmu_shared, cpu).xenpmu_data = xenpmu_data;
+ per_cpu(xenpmu_shared, cpu).flags = 0;
+
+- if (cpu == 0) {
++ if (!is_xen_pmu) {
++ is_xen_pmu = true;
+ perf_register_guest_info_callbacks(&xen_guest_cbs);
+ xen_pmu_arch_init();
+ }
+diff --git a/arch/x86/xen/pmu.h b/arch/x86/xen/pmu.h
+index 0e83a160589bc..65c58894fc79f 100644
+--- a/arch/x86/xen/pmu.h
++++ b/arch/x86/xen/pmu.h
+@@ -4,6 +4,8 @@
+
+ #include <xen/interface/xenpmu.h>
+
++extern bool is_xen_pmu;
++
+ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id);
+ #ifdef CONFIG_XEN_HAVE_VPMU
+ void xen_pmu_init(int cpu);
+@@ -12,7 +14,6 @@ void xen_pmu_finish(int cpu);
+ static inline void xen_pmu_init(int cpu) {}
+ static inline void xen_pmu_finish(int cpu) {}
+ #endif
+-bool is_xen_pmu(int cpu);
+ bool pmu_msr_read(unsigned int msr, uint64_t *val, int *err);
+ bool pmu_msr_write(unsigned int msr, uint32_t low, uint32_t high, int *err);
+ int pmu_apic_update(uint32_t reg);
+diff --git a/arch/x86/xen/smp_hvm.c b/arch/x86/xen/smp_hvm.c
+index f8d39440b2923..e5bd9eb421915 100644
+--- a/arch/x86/xen/smp_hvm.c
++++ b/arch/x86/xen/smp_hvm.c
+@@ -18,6 +18,12 @@ static void __init xen_hvm_smp_prepare_boot_cpu(void)
+ */
+ xen_vcpu_setup(0);
+
++ /*
++ * Called again in case the kernel boots on vcpu >= MAX_VIRT_CPUS.
++ * Refer to comments in xen_hvm_init_time_ops().
++ */
++ xen_hvm_init_time_ops();
++
+ /*
+ * The alternative logic (which patches the unlock/lock) runs before
+ * the smp bootup up code is activated. Hence we need to set this up
+diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
+index 41fd4c123165a..e8248e8a04ca7 100644
+--- a/arch/x86/xen/smp_pv.c
++++ b/arch/x86/xen/smp_pv.c
+@@ -126,7 +126,7 @@ int xen_smp_intr_init_pv(unsigned int cpu)
+ per_cpu(xen_irq_work, cpu).irq = rc;
+ per_cpu(xen_irq_work, cpu).name = callfunc_name;
+
+- if (is_xen_pmu(cpu)) {
++ if (is_xen_pmu) {
+ pmu_name = kasprintf(GFP_KERNEL, "pmu%d", cpu);
+ rc = bind_virq_to_irqhandler(VIRQ_XENPMU, cpu,
+ xen_pmu_irq_handler,
+diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
+index 01dcccf9185ff..9809de9f2310f 100644
+--- a/arch/x86/xen/time.c
++++ b/arch/x86/xen/time.c
+@@ -547,6 +547,11 @@ static void xen_hvm_setup_cpu_clockevents(void)
+
+ void __init xen_hvm_init_time_ops(void)
+ {
++ static bool hvm_time_initialized;
++
++ if (hvm_time_initialized)
++ return;
++
+ /*
+ * vector callback is needed otherwise we cannot receive interrupts
+ * on cpu > 0 and at this point we don't know how many cpus are
+@@ -556,7 +561,22 @@ void __init xen_hvm_init_time_ops(void)
+ return;
+
+ if (!xen_feature(XENFEAT_hvm_safe_pvclock)) {
+- pr_info("Xen doesn't support pvclock on HVM, disable pv timer");
++ pr_info_once("Xen doesn't support pvclock on HVM, disable pv timer");
++ return;
++ }
++
++ /*
++ * Only MAX_VIRT_CPUS 'vcpu_info' are embedded inside 'shared_info'.
++ * The __this_cpu_read(xen_vcpu) is still NULL when Xen HVM guest
++ * boots on vcpu >= MAX_VIRT_CPUS (e.g., kexec), To access
++ * __this_cpu_read(xen_vcpu) via xen_clocksource_read() will panic.
++ *
++ * The xen_hvm_init_time_ops() should be called again later after
++ * __this_cpu_read(xen_vcpu) is available.
++ */
++ if (!__this_cpu_read(xen_vcpu)) {
++ pr_info("Delay xen_init_time_common() as kernel is running on vcpu=%d\n",
++ xen_vcpu_nr(0));
+ return;
+ }
+
+@@ -568,5 +588,7 @@ void __init xen_hvm_init_time_ops(void)
+ x86_platform.calibrate_tsc = xen_tsc_khz;
+ x86_platform.get_wallclock = xen_get_wallclock;
+ x86_platform.set_wallclock = xen_set_wallclock;
++
++ hvm_time_initialized = true;
+ }
+ #endif
+diff --git a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi
+index 9bf8bad1dd18a..c33932568aa73 100644
+--- a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi
++++ b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi
+@@ -8,19 +8,19 @@
+ reg = <0x00000000 0x08000000>;
+ bank-width = <2>;
+ device-width = <2>;
+- partition@0x0 {
++ partition@0 {
+ label = "data";
+ reg = <0x00000000 0x06000000>;
+ };
+- partition@0x6000000 {
++ partition@6000000 {
+ label = "boot loader area";
+ reg = <0x06000000 0x00800000>;
+ };
+- partition@0x6800000 {
++ partition@6800000 {
+ label = "kernel image";
+ reg = <0x06800000 0x017e0000>;
+ };
+- partition@0x7fe0000 {
++ partition@7fe0000 {
+ label = "boot environment";
+ reg = <0x07fe0000 0x00020000>;
+ };
+diff --git a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi
+index 40c2f81f7cb66..7bde2ab2d6fb5 100644
+--- a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi
++++ b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi
+@@ -8,19 +8,19 @@
+ reg = <0x08000000 0x01000000>;
+ bank-width = <2>;
+ device-width = <2>;
+- partition@0x0 {
++ partition@0 {
+ label = "boot loader area";
+ reg = <0x00000000 0x00400000>;
+ };
+- partition@0x400000 {
++ partition@400000 {
+ label = "kernel image";
+ reg = <0x00400000 0x00600000>;
+ };
+- partition@0xa00000 {
++ partition@a00000 {
+ label = "data";
+ reg = <0x00a00000 0x005e0000>;
+ };
+- partition@0xfe0000 {
++ partition@fe0000 {
+ label = "boot environment";
+ reg = <0x00fe0000 0x00020000>;
+ };
+diff --git a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi
+index fb8d3a9f33c23..0655b868749a4 100644
+--- a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi
++++ b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi
+@@ -8,11 +8,11 @@
+ reg = <0x08000000 0x00400000>;
+ bank-width = <2>;
+ device-width = <2>;
+- partition@0x0 {
++ partition@0 {
+ label = "boot loader area";
+ reg = <0x00000000 0x003f0000>;
+ };
+- partition@0x3f0000 {
++ partition@3f0000 {
+ label = "boot environment";
+ reg = <0x003f0000 0x00010000>;
+ };
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 11686e7684016..a9f42df92ea33 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2155,6 +2155,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
+ * are likely to increase the throughput.
+ */
+ bfqq->new_bfqq = new_bfqq;
++ /*
++ * The above assignment schedules the following redirections:
++ * each time some I/O for bfqq arrives, the process that
++ * generated that I/O is disassociated from bfqq and
++ * associated with new_bfqq. Here we increases new_bfqq->ref
++ * in advance, adding the number of processes that are
++ * expected to be associated with new_bfqq as they happen to
++ * issue I/O.
++ */
+ new_bfqq->ref += process_refs;
+ return new_bfqq;
+ }
+@@ -2214,6 +2223,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ {
+ struct bfq_queue *in_service_bfqq, *new_bfqq;
+
++ /* if a merge has already been setup, then proceed with that first */
++ if (bfqq->new_bfqq)
++ return bfqq->new_bfqq;
++
+ /*
+ * Prevent bfqq from being merged if it has been created too
+ * long ago. The idea is that true cooperating processes, and
+@@ -2228,9 +2241,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ if (bfq_too_late_for_merging(bfqq))
+ return NULL;
+
+- if (bfqq->new_bfqq)
+- return bfqq->new_bfqq;
+-
+ if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
+ return NULL;
+
+@@ -4122,7 +4132,7 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx)
+ struct bfq_data *bfqd = hctx->queue->elevator->elevator_data;
+ struct request *rq;
+ struct bfq_queue *in_serv_queue;
+- bool waiting_rq, idle_timer_disabled;
++ bool waiting_rq, idle_timer_disabled = false;
+
+ spin_lock_irq(&bfqd->lock);
+
+@@ -4130,14 +4140,15 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx)
+ waiting_rq = in_serv_queue && bfq_bfqq_wait_request(in_serv_queue);
+
+ rq = __bfq_dispatch_request(hctx);
+-
+- idle_timer_disabled =
+- waiting_rq && !bfq_bfqq_wait_request(in_serv_queue);
++ if (in_serv_queue == bfqd->in_service_queue) {
++ idle_timer_disabled =
++ waiting_rq && !bfq_bfqq_wait_request(in_serv_queue);
++ }
+
+ spin_unlock_irq(&bfqd->lock);
+-
+- bfq_update_dispatch_stats(hctx->queue, rq, in_serv_queue,
+- idle_timer_disabled);
++ bfq_update_dispatch_stats(hctx->queue, rq,
++ idle_timer_disabled ? in_serv_queue : NULL,
++ idle_timer_disabled);
+
+ return rq;
+ }
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 7efa8c3e2b727..8054410536fd9 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -7,6 +7,8 @@
+ #include <linux/bio.h>
+ #include <linux/blkdev.h>
+ #include <linux/scatterlist.h>
++#include <linux/blkdev.h>
++#include <linux/blk-cgroup.h>
+
+ #include <trace/events/block.h>
+
+@@ -486,6 +488,9 @@ static inline int ll_new_hw_segment(struct request_queue *q,
+ if (req->nr_phys_segments + nr_phys_segs > queue_max_segments(q))
+ goto no_merge;
+
++ if (!blk_cgroup_mergeable(req, bio))
++ goto no_merge;
++
+ if (blk_integrity_merge_bio(q, req, bio) == false)
+ goto no_merge;
+
+@@ -609,6 +614,9 @@ static int ll_merge_requests_fn(struct request_queue *q, struct request *req,
+ if (total_phys_segments > queue_max_segments(q))
+ return 0;
+
++ if (!blk_cgroup_mergeable(req, next->bio))
++ return 0;
++
+ if (blk_integrity_merge_rq(q, req, next) == false)
+ return 0;
+
+@@ -843,6 +851,10 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio)
+ if (rq->rq_disk != bio->bi_disk || req_no_special_merge(rq))
+ return false;
+
++ /* don't merge across cgroup boundaries */
++ if (!blk_cgroup_mergeable(rq, bio))
++ return false;
++
+ /* only merge integrity protected bio into ditto rq */
+ if (blk_integrity_merge_bio(rq->q, rq, bio) == false)
+ return false;
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 07494deb1a26f..67836f212e2db 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -1002,9 +1002,6 @@ void blk_unregister_queue(struct gendisk *disk)
+ */
+ if (q->mq_ops)
+ blk_mq_unregister_dev(disk_to_dev(disk), q);
+-
+- kobject_uevent(&q->kobj, KOBJ_REMOVE);
+- kobject_del(&q->kobj);
+ blk_trace_remove_sysfs(disk_to_dev(disk));
+
+ mutex_lock(&q->sysfs_lock);
+@@ -1015,6 +1012,11 @@ void blk_unregister_queue(struct gendisk *disk)
+ if (q->request_fn || q->elevator)
+ elv_unregister_queue(q);
+ mutex_unlock(&q->sysfs_lock);
++
++ /* Now that we've deleted all child objects, we can delete the queue. */
++ kobject_uevent(&q->kobj, KOBJ_REMOVE);
++ kobject_del(&q->kobj);
++
+ mutex_unlock(&q->sysfs_dir_lock);
+
+ kobject_put(&disk_to_dev(disk)->kobj);
+diff --git a/crypto/authenc.c b/crypto/authenc.c
+index 3ee10fc25aff3..02d4d85174494 100644
+--- a/crypto/authenc.c
++++ b/crypto/authenc.c
+@@ -268,7 +268,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req,
+ dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen);
+
+ skcipher_request_set_tfm(skreq, ctx->enc);
+- skcipher_request_set_callback(skreq, aead_request_flags(req),
++ skcipher_request_set_callback(skreq, flags,
+ req->base.complete, req->base.data);
+ skcipher_request_set_crypt(skreq, src, dst,
+ req->cryptlen - authsize, req->iv);
+diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c
+index e9a061da9bb20..c325789a62bf0 100644
+--- a/drivers/acpi/acpica/nswalk.c
++++ b/drivers/acpi/acpica/nswalk.c
+@@ -169,6 +169,9 @@ acpi_ns_walk_namespace(acpi_object_type type,
+
+ if (start_node == ACPI_ROOT_OBJECT) {
+ start_node = acpi_gbl_root_node;
++ if (!start_node) {
++ return_ACPI_STATUS(AE_NO_NAMESPACE);
++ }
+ }
+
+ /* Null child means "get first node" */
+diff --git a/drivers/acpi/apei/bert.c b/drivers/acpi/apei/bert.c
+index 12771fcf0417d..d2212e092c503 100644
+--- a/drivers/acpi/apei/bert.c
++++ b/drivers/acpi/apei/bert.c
+@@ -31,6 +31,7 @@
+
+ #undef pr_fmt
+ #define pr_fmt(fmt) "BERT: " fmt
++#define ACPI_BERT_PRINT_MAX_LEN 1024
+
+ static int bert_disable;
+
+@@ -59,8 +60,11 @@ static void __init bert_print_all(struct acpi_bert_region *region,
+ }
+
+ pr_info_once("Error records from previous boot:\n");
+-
+- cper_estatus_print(KERN_INFO HW_ERR, estatus);
++ if (region_len < ACPI_BERT_PRINT_MAX_LEN)
++ cper_estatus_print(KERN_INFO HW_ERR, estatus);
++ else
++ pr_info_once("Max print length exceeded, table data is available at:\n"
++ "/sys/firmware/acpi/tables/data/BERT");
+
+ /*
+ * Because the boot error source is "one-time polled" type,
+@@ -82,7 +86,7 @@ static int __init setup_bert_disable(char *str)
+ {
+ bert_disable = 1;
+
+- return 0;
++ return 1;
+ }
+ __setup("bert_disable", setup_bert_disable);
+
+diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
+index ab8faa6d6616f..445e85394db61 100644
+--- a/drivers/acpi/apei/erst.c
++++ b/drivers/acpi/apei/erst.c
+@@ -899,7 +899,7 @@ EXPORT_SYMBOL_GPL(erst_clear);
+ static int __init setup_erst_disable(char *str)
+ {
+ erst_disable = 1;
+- return 0;
++ return 1;
+ }
+
+ __setup("erst_disable", setup_erst_disable);
+diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
+index b1e9f81ebeea2..d536e4d132eb4 100644
+--- a/drivers/acpi/apei/hest.c
++++ b/drivers/acpi/apei/hest.c
+@@ -215,7 +215,7 @@ err:
+ static int __init setup_hest_disable(char *str)
+ {
+ hest_disable = HEST_DISABLED;
+- return 0;
++ return 1;
+ }
+
+ __setup("hest_disable", setup_hest_disable);
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index 1b43f8ebfabea..f68a4ffd3352e 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -742,6 +742,11 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
+ cpc_obj = &out_obj->package.elements[0];
+ if (cpc_obj->type == ACPI_TYPE_INTEGER) {
+ num_ent = cpc_obj->integer.value;
++ if (num_ent <= 1) {
++ pr_debug("Unexpected _CPC NumEntries value (%d) for CPU:%d\n",
++ num_ent, pr->id);
++ goto out_free;
++ }
+ } else {
+ pr_debug("Unexpected entry type(%d) for NumEntries\n",
+ cpc_obj->type);
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index 27db1a968241b..c8018d73d5a79 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -618,7 +618,7 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
+ */
+ if (obj->type == ACPI_TYPE_LOCAL_REFERENCE) {
+ if (index)
+- return -EINVAL;
++ return -ENOENT;
+
+ ret = acpi_bus_get_device(obj->reference.handle, &device);
+ if (ret)
+diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
+index 8487048c5ec9b..564f0826e0229 100644
+--- a/drivers/ata/sata_dwc_460ex.c
++++ b/drivers/ata/sata_dwc_460ex.c
+@@ -149,7 +149,11 @@ struct sata_dwc_device {
+ #endif
+ };
+
+-#define SATA_DWC_QCMD_MAX 32
++/*
++ * Allow one extra special slot for commands and DMA management
++ * to account for libata internal commands.
++ */
++#define SATA_DWC_QCMD_MAX (ATA_MAX_QUEUE + 1)
+
+ struct sata_dwc_device_port {
+ struct sata_dwc_device *hsdev;
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index da413b95afabf..c0284c8db19b1 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -2145,7 +2145,9 @@ static bool pm_ops_is_empty(const struct dev_pm_ops *ops)
+
+ void device_pm_check_callbacks(struct device *dev)
+ {
+- spin_lock_irq(&dev->power.lock);
++ unsigned long flags;
++
++ spin_lock_irqsave(&dev->power.lock, flags);
+ dev->power.no_pm_callbacks =
+ (!dev->bus || (pm_ops_is_empty(dev->bus->pm) &&
+ !dev->bus->suspend && !dev->bus->resume)) &&
+@@ -2154,7 +2156,7 @@ void device_pm_check_callbacks(struct device *dev)
+ (!dev->pm_domain || pm_ops_is_empty(&dev->pm_domain->ops)) &&
+ (!dev->driver || (pm_ops_is_empty(dev->driver->pm) &&
+ !dev->driver->suspend && !dev->driver->resume));
+- spin_unlock_irq(&dev->power.lock);
++ spin_unlock_irqrestore(&dev->power.lock, flags);
+ }
+
+ bool dev_pm_smart_suspend_and_suspended(struct device *dev)
+diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
+index e35a234b0a8f2..4f66cf6879fdd 100644
+--- a/drivers/block/drbd/drbd_int.h
++++ b/drivers/block/drbd/drbd_int.h
+@@ -1688,22 +1688,22 @@ struct sib_info {
+ };
+ void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib);
+
+-extern void notify_resource_state(struct sk_buff *,
++extern int notify_resource_state(struct sk_buff *,
+ unsigned int,
+ struct drbd_resource *,
+ struct resource_info *,
+ enum drbd_notification_type);
+-extern void notify_device_state(struct sk_buff *,
++extern int notify_device_state(struct sk_buff *,
+ unsigned int,
+ struct drbd_device *,
+ struct device_info *,
+ enum drbd_notification_type);
+-extern void notify_connection_state(struct sk_buff *,
++extern int notify_connection_state(struct sk_buff *,
+ unsigned int,
+ struct drbd_connection *,
+ struct connection_info *,
+ enum drbd_notification_type);
+-extern void notify_peer_device_state(struct sk_buff *,
++extern int notify_peer_device_state(struct sk_buff *,
+ unsigned int,
+ struct drbd_peer_device *,
+ struct peer_device_info *,
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index 5b15ffd0c7f57..5a80453be5535 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -4598,7 +4598,7 @@ static int nla_put_notification_header(struct sk_buff *msg,
+ return drbd_notification_header_to_skb(msg, &nh, true);
+ }
+
+-void notify_resource_state(struct sk_buff *skb,
++int notify_resource_state(struct sk_buff *skb,
+ unsigned int seq,
+ struct drbd_resource *resource,
+ struct resource_info *resource_info,
+@@ -4640,16 +4640,17 @@ void notify_resource_state(struct sk_buff *skb,
+ if (err && err != -ESRCH)
+ goto failed;
+ }
+- return;
++ return 0;
+
+ nla_put_failure:
+ nlmsg_free(skb);
+ failed:
+ drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n",
+ err, seq);
++ return err;
+ }
+
+-void notify_device_state(struct sk_buff *skb,
++int notify_device_state(struct sk_buff *skb,
+ unsigned int seq,
+ struct drbd_device *device,
+ struct device_info *device_info,
+@@ -4689,16 +4690,17 @@ void notify_device_state(struct sk_buff *skb,
+ if (err && err != -ESRCH)
+ goto failed;
+ }
+- return;
++ return 0;
+
+ nla_put_failure:
+ nlmsg_free(skb);
+ failed:
+ drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n",
+ err, seq);
++ return err;
+ }
+
+-void notify_connection_state(struct sk_buff *skb,
++int notify_connection_state(struct sk_buff *skb,
+ unsigned int seq,
+ struct drbd_connection *connection,
+ struct connection_info *connection_info,
+@@ -4738,16 +4740,17 @@ void notify_connection_state(struct sk_buff *skb,
+ if (err && err != -ESRCH)
+ goto failed;
+ }
+- return;
++ return 0;
+
+ nla_put_failure:
+ nlmsg_free(skb);
+ failed:
+ drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n",
+ err, seq);
++ return err;
+ }
+
+-void notify_peer_device_state(struct sk_buff *skb,
++int notify_peer_device_state(struct sk_buff *skb,
+ unsigned int seq,
+ struct drbd_peer_device *peer_device,
+ struct peer_device_info *peer_device_info,
+@@ -4788,13 +4791,14 @@ void notify_peer_device_state(struct sk_buff *skb,
+ if (err && err != -ESRCH)
+ goto failed;
+ }
+- return;
++ return 0;
+
+ nla_put_failure:
+ nlmsg_free(skb);
+ failed:
+ drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n",
+ err, seq);
++ return err;
+ }
+
+ void notify_helper(enum drbd_notification_type type,
+@@ -4845,7 +4849,7 @@ fail:
+ err, seq);
+ }
+
+-static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq)
++static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq)
+ {
+ struct drbd_genlmsghdr *dh;
+ int err;
+@@ -4859,11 +4863,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq)
+ if (nla_put_notification_header(skb, NOTIFY_EXISTS))
+ goto nla_put_failure;
+ genlmsg_end(skb, dh);
+- return;
++ return 0;
+
+ nla_put_failure:
+ nlmsg_free(skb);
+ pr_err("Error %d sending event. Event seq:%u\n", err, seq);
++ return err;
+ }
+
+ static void free_state_changes(struct list_head *list)
+@@ -4890,6 +4895,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
+ unsigned int seq = cb->args[2];
+ unsigned int n;
+ enum drbd_notification_type flags = 0;
++ int err = 0;
+
+ /* There is no need for taking notification_mutex here: it doesn't
+ matter if the initial state events mix with later state chage
+@@ -4898,32 +4904,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
+
+ cb->args[5]--;
+ if (cb->args[5] == 1) {
+- notify_initial_state_done(skb, seq);
++ err = notify_initial_state_done(skb, seq);
+ goto out;
+ }
+ n = cb->args[4]++;
+ if (cb->args[4] < cb->args[3])
+ flags |= NOTIFY_CONTINUES;
+ if (n < 1) {
+- notify_resource_state_change(skb, seq, state_change->resource,
++ err = notify_resource_state_change(skb, seq, state_change->resource,
+ NOTIFY_EXISTS | flags);
+ goto next;
+ }
+ n--;
+ if (n < state_change->n_connections) {
+- notify_connection_state_change(skb, seq, &state_change->connections[n],
++ err = notify_connection_state_change(skb, seq, &state_change->connections[n],
+ NOTIFY_EXISTS | flags);
+ goto next;
+ }
+ n -= state_change->n_connections;
+ if (n < state_change->n_devices) {
+- notify_device_state_change(skb, seq, &state_change->devices[n],
++ err = notify_device_state_change(skb, seq, &state_change->devices[n],
+ NOTIFY_EXISTS | flags);
+ goto next;
+ }
+ n -= state_change->n_devices;
+ if (n < state_change->n_devices * state_change->n_connections) {
+- notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n],
++ err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n],
+ NOTIFY_EXISTS | flags);
+ goto next;
+ }
+@@ -4938,7 +4944,10 @@ next:
+ cb->args[4] = 0;
+ }
+ out:
+- return skb->len;
++ if (err)
++ return err;
++ else
++ return skb->len;
+ }
+
+ int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
+diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
+index 19cac36e97371..86c953b7cbc2c 100644
+--- a/drivers/block/drbd/drbd_req.c
++++ b/drivers/block/drbd/drbd_req.c
+@@ -207,7 +207,8 @@ void start_new_tl_epoch(struct drbd_connection *connection)
+ void complete_master_bio(struct drbd_device *device,
+ struct bio_and_error *m)
+ {
+- m->bio->bi_status = errno_to_blk_status(m->error);
++ if (unlikely(m->error))
++ m->bio->bi_status = errno_to_blk_status(m->error);
+ bio_endio(m->bio);
+ dec_ap_bio(device);
+ }
+diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c
+index b452359b6aae8..1474250f94402 100644
+--- a/drivers/block/drbd/drbd_state.c
++++ b/drivers/block/drbd/drbd_state.c
+@@ -1549,7 +1549,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device,
+ return rv;
+ }
+
+-void notify_resource_state_change(struct sk_buff *skb,
++int notify_resource_state_change(struct sk_buff *skb,
+ unsigned int seq,
+ struct drbd_resource_state_change *resource_state_change,
+ enum drbd_notification_type type)
+@@ -1562,10 +1562,10 @@ void notify_resource_state_change(struct sk_buff *skb,
+ .res_susp_fen = resource_state_change->susp_fen[NEW],
+ };
+
+- notify_resource_state(skb, seq, resource, &resource_info, type);
++ return notify_resource_state(skb, seq, resource, &resource_info, type);
+ }
+
+-void notify_connection_state_change(struct sk_buff *skb,
++int notify_connection_state_change(struct sk_buff *skb,
+ unsigned int seq,
+ struct drbd_connection_state_change *connection_state_change,
+ enum drbd_notification_type type)
+@@ -1576,10 +1576,10 @@ void notify_connection_state_change(struct sk_buff *skb,
+ .conn_role = connection_state_change->peer_role[NEW],
+ };
+
+- notify_connection_state(skb, seq, connection, &connection_info, type);
++ return notify_connection_state(skb, seq, connection, &connection_info, type);
+ }
+
+-void notify_device_state_change(struct sk_buff *skb,
++int notify_device_state_change(struct sk_buff *skb,
+ unsigned int seq,
+ struct drbd_device_state_change *device_state_change,
+ enum drbd_notification_type type)
+@@ -1589,10 +1589,10 @@ void notify_device_state_change(struct sk_buff *skb,
+ .dev_disk_state = device_state_change->disk_state[NEW],
+ };
+
+- notify_device_state(skb, seq, device, &device_info, type);
++ return notify_device_state(skb, seq, device, &device_info, type);
+ }
+
+-void notify_peer_device_state_change(struct sk_buff *skb,
++int notify_peer_device_state_change(struct sk_buff *skb,
+ unsigned int seq,
+ struct drbd_peer_device_state_change *p,
+ enum drbd_notification_type type)
+@@ -1606,7 +1606,7 @@ void notify_peer_device_state_change(struct sk_buff *skb,
+ .peer_resync_susp_dependency = p->resync_susp_dependency[NEW],
+ };
+
+- notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type);
++ return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type);
+ }
+
+ static void broadcast_state_change(struct drbd_state_change *state_change)
+@@ -1614,7 +1614,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change)
+ struct drbd_resource_state_change *resource_state_change = &state_change->resource[0];
+ bool resource_state_has_changed;
+ unsigned int n_device, n_connection, n_peer_device, n_peer_devices;
+- void (*last_func)(struct sk_buff *, unsigned int, void *,
++ int (*last_func)(struct sk_buff *, unsigned int, void *,
+ enum drbd_notification_type) = NULL;
+ void *uninitialized_var(last_arg);
+
+diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h
+index ba80f612d6abb..d5b0479bc9a66 100644
+--- a/drivers/block/drbd/drbd_state_change.h
++++ b/drivers/block/drbd/drbd_state_change.h
+@@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_
+ extern void copy_old_to_new_state_change(struct drbd_state_change *);
+ extern void forget_state_change(struct drbd_state_change *);
+
+-extern void notify_resource_state_change(struct sk_buff *,
++extern int notify_resource_state_change(struct sk_buff *,
+ unsigned int,
+ struct drbd_resource_state_change *,
+ enum drbd_notification_type type);
+-extern void notify_connection_state_change(struct sk_buff *,
++extern int notify_connection_state_change(struct sk_buff *,
+ unsigned int,
+ struct drbd_connection_state_change *,
+ enum drbd_notification_type type);
+-extern void notify_device_state_change(struct sk_buff *,
++extern int notify_device_state_change(struct sk_buff *,
+ unsigned int,
+ struct drbd_device_state_change *,
+ enum drbd_notification_type type);
+-extern void notify_peer_device_state_change(struct sk_buff *,
++extern int notify_peer_device_state_change(struct sk_buff *,
+ unsigned int,
+ struct drbd_peer_device_state_change *,
+ enum drbd_notification_type type);
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 19042b42a8baf..c31a76485c9cb 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -795,33 +795,33 @@ static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf)
+
+ static ssize_t loop_attr_offset_show(struct loop_device *lo, char *buf)
+ {
+- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_offset);
++ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_offset);
+ }
+
+ static ssize_t loop_attr_sizelimit_show(struct loop_device *lo, char *buf)
+ {
+- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit);
++ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit);
+ }
+
+ static ssize_t loop_attr_autoclear_show(struct loop_device *lo, char *buf)
+ {
+ int autoclear = (lo->lo_flags & LO_FLAGS_AUTOCLEAR);
+
+- return sprintf(buf, "%s\n", autoclear ? "1" : "0");
++ return sysfs_emit(buf, "%s\n", autoclear ? "1" : "0");
+ }
+
+ static ssize_t loop_attr_partscan_show(struct loop_device *lo, char *buf)
+ {
+ int partscan = (lo->lo_flags & LO_FLAGS_PARTSCAN);
+
+- return sprintf(buf, "%s\n", partscan ? "1" : "0");
++ return sysfs_emit(buf, "%s\n", partscan ? "1" : "0");
+ }
+
+ static ssize_t loop_attr_dio_show(struct loop_device *lo, char *buf)
+ {
+ int dio = (lo->lo_flags & LO_FLAGS_DIRECT_IO);
+
+- return sprintf(buf, "%s\n", dio ? "1" : "0");
++ return sysfs_emit(buf, "%s\n", dio ? "1" : "0");
+ }
+
+ LOOP_ATTR_RO(backing_file);
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index dac1769146d7f..8b3bf11329ba0 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -849,9 +849,17 @@ static int virtblk_probe(struct virtio_device *vdev)
+ err = virtio_cread_feature(vdev, VIRTIO_BLK_F_BLK_SIZE,
+ struct virtio_blk_config, blk_size,
+ &blk_size);
+- if (!err)
++ if (!err) {
++ err = blk_validate_block_size(blk_size);
++ if (err) {
++ dev_err(&vdev->dev,
++ "virtio_blk: invalid block size: 0x%x\n",
++ blk_size);
++ goto out_free_tags;
++ }
++
+ blk_queue_logical_block_size(q, blk_size);
+- else
++ } else
+ blk_size = queue_logical_block_size(q);
+
+ /* Use topology information if available */
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index 7b3aade431e5e..9ebcf0d9e3957 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -288,6 +288,8 @@ int hci_uart_register_device(struct hci_uart *hu,
+ if (err)
+ return err;
+
++ percpu_init_rwsem(&hu->proto_lock);
++
+ err = p->open(hu);
+ if (err)
+ goto err_open;
+@@ -310,7 +312,6 @@ int hci_uart_register_device(struct hci_uart *hu,
+
+ INIT_WORK(&hu->init_ready, hci_uart_init_work);
+ INIT_WORK(&hu->write_work, hci_uart_write_work);
+- percpu_init_rwsem(&hu->proto_lock);
+
+ /* Only when vendor specific setup callback is provided, consider
+ * the manufacturer information valid. This avoids filling in the
+diff --git a/drivers/char/hw_random/atmel-rng.c b/drivers/char/hw_random/atmel-rng.c
+index 433426242b875..40e6951ea0787 100644
+--- a/drivers/char/hw_random/atmel-rng.c
++++ b/drivers/char/hw_random/atmel-rng.c
+@@ -96,6 +96,7 @@ static int atmel_trng_probe(struct platform_device *pdev)
+
+ err_register:
+ clk_disable_unprepare(trng->clk);
++ atmel_trng_disable(trng);
+ return ret;
+ }
+
+diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
+index f79f877942733..2d62a3649402f 100644
+--- a/drivers/char/tpm/tpm-chip.c
++++ b/drivers/char/tpm/tpm-chip.c
+@@ -163,14 +163,6 @@ static void tpm_dev_release(struct device *dev)
+ kfree(chip);
+ }
+
+-static void tpm_devs_release(struct device *dev)
+-{
+- struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs);
+-
+- /* release the master device reference */
+- put_device(&chip->dev);
+-}
+-
+ /**
+ * tpm_class_shutdown() - prepare the TPM device for loss of power.
+ * @dev: device to which the chip is associated.
+@@ -234,7 +226,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev,
+ chip->dev_num = rc;
+
+ device_initialize(&chip->dev);
+- device_initialize(&chip->devs);
+
+ chip->dev.class = tpm_class;
+ chip->dev.class->shutdown_pre = tpm_class_shutdown;
+@@ -242,29 +233,12 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev,
+ chip->dev.parent = pdev;
+ chip->dev.groups = chip->groups;
+
+- chip->devs.parent = pdev;
+- chip->devs.class = tpmrm_class;
+- chip->devs.release = tpm_devs_release;
+- /* get extra reference on main device to hold on
+- * behalf of devs. This holds the chip structure
+- * while cdevs is in use. The corresponding put
+- * is in the tpm_devs_release (TPM2 only)
+- */
+- if (chip->flags & TPM_CHIP_FLAG_TPM2)
+- get_device(&chip->dev);
+-
+ if (chip->dev_num == 0)
+ chip->dev.devt = MKDEV(MISC_MAJOR, TPM_MINOR);
+ else
+ chip->dev.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num);
+
+- chip->devs.devt =
+- MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES);
+-
+ rc = dev_set_name(&chip->dev, "tpm%d", chip->dev_num);
+- if (rc)
+- goto out;
+- rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num);
+ if (rc)
+ goto out;
+
+@@ -272,9 +246,7 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev,
+ chip->flags |= TPM_CHIP_FLAG_VIRTUAL;
+
+ cdev_init(&chip->cdev, &tpm_fops);
+- cdev_init(&chip->cdevs, &tpmrm_fops);
+ chip->cdev.owner = THIS_MODULE;
+- chip->cdevs.owner = THIS_MODULE;
+
+ rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE);
+ if (rc) {
+@@ -286,7 +258,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev,
+ return chip;
+
+ out:
+- put_device(&chip->devs);
+ put_device(&chip->dev);
+ return ERR_PTR(rc);
+ }
+@@ -335,14 +306,9 @@ static int tpm_add_char_device(struct tpm_chip *chip)
+ }
+
+ if (chip->flags & TPM_CHIP_FLAG_TPM2) {
+- rc = cdev_device_add(&chip->cdevs, &chip->devs);
+- if (rc) {
+- dev_err(&chip->devs,
+- "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n",
+- dev_name(&chip->devs), MAJOR(chip->devs.devt),
+- MINOR(chip->devs.devt), rc);
+- return rc;
+- }
++ rc = tpm_devs_add(chip);
++ if (rc)
++ goto err_del_cdev;
+ }
+
+ /* Make the chip available. */
+@@ -350,6 +316,10 @@ static int tpm_add_char_device(struct tpm_chip *chip)
+ idr_replace(&dev_nums_idr, chip, chip->dev_num);
+ mutex_unlock(&idr_lock);
+
++ return 0;
++
++err_del_cdev:
++ cdev_device_del(&chip->cdev, &chip->dev);
+ return rc;
+ }
+
+@@ -508,7 +478,7 @@ void tpm_chip_unregister(struct tpm_chip *chip)
+ hwrng_unregister(&chip->hwrng);
+ tpm_bios_log_teardown(chip);
+ if (chip->flags & TPM_CHIP_FLAG_TPM2)
+- cdev_device_del(&chip->cdevs, &chip->devs);
++ tpm_devs_remove(chip);
+ tpm_del_char_device(chip);
+ }
+ EXPORT_SYMBOL_GPL(tpm_chip_unregister);
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index b9a30f0b88257..7b8e279c180b1 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -605,6 +605,8 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc,
+ u8 *cmd);
+ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space,
+ u32 cc, u8 *buf, size_t *bufsiz);
++int tpm_devs_add(struct tpm_chip *chip);
++void tpm_devs_remove(struct tpm_chip *chip);
+
+ void tpm_bios_log_setup(struct tpm_chip *chip);
+ void tpm_bios_log_teardown(struct tpm_chip *chip);
+diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
+index 205d930d7ea60..a54bb904b2816 100644
+--- a/drivers/char/tpm/tpm2-space.c
++++ b/drivers/char/tpm/tpm2-space.c
+@@ -536,3 +536,68 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space,
+
+ return 0;
+ }
++
++/*
++ * Put the reference to the main device.
++ */
++static void tpm_devs_release(struct device *dev)
++{
++ struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs);
++
++ /* release the master device reference */
++ put_device(&chip->dev);
++}
++
++/*
++ * Remove the device file for exposed TPM spaces and release the device
++ * reference. This may also release the reference to the master device.
++ */
++void tpm_devs_remove(struct tpm_chip *chip)
++{
++ cdev_device_del(&chip->cdevs, &chip->devs);
++ put_device(&chip->devs);
++}
++
++/*
++ * Add a device file to expose TPM spaces. Also take a reference to the
++ * main device.
++ */
++int tpm_devs_add(struct tpm_chip *chip)
++{
++ int rc;
++
++ device_initialize(&chip->devs);
++ chip->devs.parent = chip->dev.parent;
++ chip->devs.class = tpmrm_class;
++
++ /*
++ * Get extra reference on main device to hold on behalf of devs.
++ * This holds the chip structure while cdevs is in use. The
++ * corresponding put is in the tpm_devs_release.
++ */
++ get_device(&chip->dev);
++ chip->devs.release = tpm_devs_release;
++ chip->devs.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES);
++ cdev_init(&chip->cdevs, &tpmrm_fops);
++ chip->cdevs.owner = THIS_MODULE;
++
++ rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num);
++ if (rc)
++ goto err_put_devs;
++
++ rc = cdev_device_add(&chip->cdevs, &chip->devs);
++ if (rc) {
++ dev_err(&chip->devs,
++ "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n",
++ dev_name(&chip->devs), MAJOR(chip->devs.devt),
++ MINOR(chip->devs.devt), rc);
++ goto err_put_devs;
++ }
++
++ return 0;
++
++err_put_devs:
++ put_device(&chip->devs);
++
++ return rc;
++}
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index cdf441942bae4..d3937d6904000 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -1985,6 +1985,13 @@ static void virtcons_remove(struct virtio_device *vdev)
+ list_del(&portdev->list);
+ spin_unlock_irq(&pdrvdata_lock);
+
++ /* Device is going away, exit any polling for buffers */
++ virtio_break_device(vdev);
++ if (use_multiport(portdev))
++ flush_work(&portdev->control_work);
++ else
++ flush_work(&portdev->config_work);
++
+ /* Disable interrupts for vqs */
+ vdev->config->reset(vdev);
+ /* Finish up work that's lined up */
+@@ -2258,7 +2265,7 @@ static struct virtio_driver virtio_rproc_serial = {
+ .remove = virtcons_remove,
+ };
+
+-static int __init init(void)
++static int __init virtio_console_init(void)
+ {
+ int err;
+
+@@ -2295,7 +2302,7 @@ free:
+ return err;
+ }
+
+-static void __exit fini(void)
++static void __exit virtio_console_fini(void)
+ {
+ reclaim_dma_bufs();
+
+@@ -2305,8 +2312,8 @@ static void __exit fini(void)
+ class_destroy(pdrvdata.class);
+ debugfs_remove_recursive(pdrvdata.debugfs_dir);
+ }
+-module_init(init);
+-module_exit(fini);
++module_init(virtio_console_init);
++module_exit(virtio_console_fini);
+
+ MODULE_DESCRIPTION("Virtio console driver");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/clk/actions/owl-s700.c b/drivers/clk/actions/owl-s700.c
+index 5e9531392ee57..aa76b0c103735 100644
+--- a/drivers/clk/actions/owl-s700.c
++++ b/drivers/clk/actions/owl-s700.c
+@@ -160,6 +160,7 @@ static struct clk_div_table hdmia_div_table[] = {
+
+ static struct clk_div_table rmii_div_table[] = {
+ {0, 4}, {1, 10},
++ {0, 0}
+ };
+
+ /* divider clocks */
+diff --git a/drivers/clk/actions/owl-s900.c b/drivers/clk/actions/owl-s900.c
+index 7f60ed6afe639..460b33fc6c548 100644
+--- a/drivers/clk/actions/owl-s900.c
++++ b/drivers/clk/actions/owl-s900.c
+@@ -138,7 +138,7 @@ static struct clk_div_table rmii_ref_div_table[] = {
+
+ static struct clk_div_table usb3_mac_div_table[] = {
+ { 1, 2 }, { 2, 3 }, { 3, 4 },
+- { 0, 8 },
++ { 0, 0 }
+ };
+
+ static struct clk_div_table i2s_div_table[] = {
+diff --git a/drivers/clk/clk-clps711x.c b/drivers/clk/clk-clps711x.c
+index 2c04396402ab4..50b42e91a1377 100644
+--- a/drivers/clk/clk-clps711x.c
++++ b/drivers/clk/clk-clps711x.c
+@@ -32,11 +32,13 @@ static const struct clk_div_table spi_div_table[] = {
+ { .val = 1, .div = 8, },
+ { .val = 2, .div = 2, },
+ { .val = 3, .div = 1, },
++ { /* sentinel */ }
+ };
+
+ static const struct clk_div_table timer_div_table[] = {
+ { .val = 0, .div = 256, },
+ { .val = 1, .div = 1, },
++ { /* sentinel */ }
+ };
+
+ struct clps711x_clk {
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index a9490c8e82a70..32606d1094fe4 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -523,6 +523,24 @@ static void clk_core_get_boundaries(struct clk_core *core,
+ *max_rate = min(*max_rate, clk_user->max_rate);
+ }
+
++static bool clk_core_check_boundaries(struct clk_core *core,
++ unsigned long min_rate,
++ unsigned long max_rate)
++{
++ struct clk *user;
++
++ lockdep_assert_held(&prepare_lock);
++
++ if (min_rate > core->max_rate || max_rate < core->min_rate)
++ return false;
++
++ hlist_for_each_entry(user, &core->clks, clks_node)
++ if (min_rate > user->max_rate || max_rate < user->min_rate)
++ return false;
++
++ return true;
++}
++
+ void clk_hw_set_rate_range(struct clk_hw *hw, unsigned long min_rate,
+ unsigned long max_rate)
+ {
+@@ -2066,6 +2084,11 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max)
+ clk->min_rate = min;
+ clk->max_rate = max;
+
++ if (!clk_core_check_boundaries(clk->core, min, max)) {
++ ret = -EINVAL;
++ goto out;
++ }
++
+ rate = clk_core_get_rate_nolock(clk->core);
+ if (rate < min || rate > max) {
+ /*
+@@ -2094,6 +2117,7 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max)
+ }
+ }
+
++out:
+ if (clk->exclusive_count)
+ clk_core_rate_protect(clk->core);
+
+diff --git a/drivers/clk/loongson1/clk-loongson1c.c b/drivers/clk/loongson1/clk-loongson1c.c
+index 3466f7320b40b..e3aa502761a31 100644
+--- a/drivers/clk/loongson1/clk-loongson1c.c
++++ b/drivers/clk/loongson1/clk-loongson1c.c
+@@ -40,6 +40,7 @@ static const struct clk_div_table ahb_div_table[] = {
+ [1] = { .val = 1, .div = 4 },
+ [2] = { .val = 2, .div = 3 },
+ [3] = { .val = 3, .div = 3 },
++ [4] = { /* sentinel */ }
+ };
+
+ void __init ls1x_clk_init(void)
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index f420f0c968775..04bd29d6aba13 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -625,6 +625,7 @@ static const struct frac_entry frac_table_pixel[] = {
+ { 2, 9 },
+ { 4, 9 },
+ { 1, 1 },
++ { 2, 3 },
+ { }
+ };
+
+diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c
+index 505c6263141d9..708c486a6e960 100644
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -1082,7 +1082,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = {
+ .name = "sdcc1_apps_clk_src",
+ .parent_names = gcc_xo_gpll0_gpll2_gpll0_out_main_div2,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_floor_ops,
+ },
+ };
+
+diff --git a/drivers/clk/qcom/gcc-msm8994.c b/drivers/clk/qcom/gcc-msm8994.c
+index 53f0f369a33ed..4ec481efedc8f 100644
+--- a/drivers/clk/qcom/gcc-msm8994.c
++++ b/drivers/clk/qcom/gcc-msm8994.c
+@@ -115,6 +115,7 @@ static struct clk_alpha_pll gpll4_early = {
+
+ static struct clk_alpha_pll_postdiv gpll4 = {
+ .offset = 0x1dc0,
++ .width = 4,
+ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
+ .clkr.hw.init = &(struct clk_init_data)
+ {
+diff --git a/drivers/clk/tegra/clk-emc.c b/drivers/clk/tegra/clk-emc.c
+index 0621a3a82ea6c..7aeace88be6ea 100644
+--- a/drivers/clk/tegra/clk-emc.c
++++ b/drivers/clk/tegra/clk-emc.c
+@@ -190,6 +190,7 @@ static struct tegra_emc *emc_ensure_emc_driver(struct tegra_clk_emc *tegra)
+
+ tegra->emc = platform_get_drvdata(pdev);
+ if (!tegra->emc) {
++ put_device(&pdev->dev);
+ pr_err("%s: cannot find EMC driver\n", __func__);
+ return NULL;
+ }
+diff --git a/drivers/clk/uniphier/clk-uniphier-fixed-rate.c b/drivers/clk/uniphier/clk-uniphier-fixed-rate.c
+index 0ad0d46173c0e..225de2302cb76 100644
+--- a/drivers/clk/uniphier/clk-uniphier-fixed-rate.c
++++ b/drivers/clk/uniphier/clk-uniphier-fixed-rate.c
+@@ -33,6 +33,7 @@ struct clk_hw *uniphier_clk_register_fixed_rate(struct device *dev,
+
+ init.name = name;
+ init.ops = &clk_fixed_rate_ops;
++ init.flags = 0;
+ init.parent_names = NULL;
+ init.num_parents = 0;
+
+diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
+index 1961e3539b576..05cc8d4e49adc 100644
+--- a/drivers/clocksource/acpi_pm.c
++++ b/drivers/clocksource/acpi_pm.c
+@@ -230,8 +230,10 @@ static int __init parse_pmtmr(char *arg)
+ int ret;
+
+ ret = kstrtouint(arg, 16, &base);
+- if (ret)
+- return ret;
++ if (ret) {
++ pr_warn("PMTMR: invalid 'pmtmr=' value: '%s'\n", arg);
++ return 1;
++ }
+
+ pr_info("PMTMR IOPort override: 0x%04x -> 0x%04x\n", pmtmr_ioport,
+ base);
+diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
+index 6e2cb3693ed89..82bb0d39e8af0 100644
+--- a/drivers/clocksource/timer-of.c
++++ b/drivers/clocksource/timer-of.c
+@@ -164,9 +164,9 @@ static __init int timer_of_base_init(struct device_node *np,
+ of_base->base = of_base->name ?
+ of_io_request_and_map(np, of_base->index, of_base->name) :
+ of_iomap(np, of_base->index);
+- if (IS_ERR(of_base->base)) {
+- pr_err("Failed to iomap (%s)\n", of_base->name);
+- return PTR_ERR(of_base->base);
++ if (IS_ERR_OR_NULL(of_base->base)) {
++ pr_err("Failed to iomap (%s:%s)\n", np->name, of_base->name);
++ return of_base->base ? PTR_ERR(of_base->base) : -ENOMEM;
+ }
+
+ return 0;
+diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
+index a83588d6ba72c..8209273eb85b5 100644
+--- a/drivers/crypto/ccp/ccp-dmaengine.c
++++ b/drivers/crypto/ccp/ccp-dmaengine.c
+@@ -631,6 +631,20 @@ static int ccp_terminate_all(struct dma_chan *dma_chan)
+ return 0;
+ }
+
++static void ccp_dma_release(struct ccp_device *ccp)
++{
++ struct ccp_dma_chan *chan;
++ struct dma_chan *dma_chan;
++ unsigned int i;
++
++ for (i = 0; i < ccp->cmd_q_count; i++) {
++ chan = ccp->ccp_dma_chan + i;
++ dma_chan = &chan->dma_chan;
++ tasklet_kill(&chan->cleanup_tasklet);
++ list_del_rcu(&dma_chan->device_node);
++ }
++}
++
+ int ccp_dmaengine_register(struct ccp_device *ccp)
+ {
+ struct ccp_dma_chan *chan;
+@@ -732,6 +746,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
+ return 0;
+
+ err_reg:
++ ccp_dma_release(ccp);
+ kmem_cache_destroy(ccp->dma_desc_cache);
+
+ err_cache:
+@@ -745,6 +760,7 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp)
+ struct dma_device *dma_dev = &ccp->dma_dev;
+
+ dma_async_device_unregister(dma_dev);
++ ccp_dma_release(ccp);
+
+ kmem_cache_destroy(ccp->dma_desc_cache);
+ kmem_cache_destroy(ccp->dma_cmd_cache);
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index da834ae3586b6..2da6f38e2bcbc 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -328,7 +328,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128);
+ }
+
+- for_each_sg(req->src, src, sg_nents(src), i) {
++ for_each_sg(req->src, src, sg_nents(req->src), i) {
+ src_buf = sg_virt(src);
+ len = sg_dma_len(src);
+ tlen += len;
+diff --git a/drivers/crypto/vmx/Kconfig b/drivers/crypto/vmx/Kconfig
+index c3d524ea69987..f39eeca87932e 100644
+--- a/drivers/crypto/vmx/Kconfig
++++ b/drivers/crypto/vmx/Kconfig
+@@ -1,7 +1,11 @@
+ config CRYPTO_DEV_VMX_ENCRYPT
+ tristate "Encryption acceleration support on P8 CPU"
+ depends on CRYPTO_DEV_VMX
++ select CRYPTO_AES
++ select CRYPTO_CBC
++ select CRYPTO_CTR
+ select CRYPTO_GHASH
++ select CRYPTO_XTS
+ default m
+ help
+ Support for VMX cryptographic acceleration instructions on Power8 CPU.
+diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
+index 419c841aef34d..6b5626e299b22 100644
+--- a/drivers/dma/sh/shdma-base.c
++++ b/drivers/dma/sh/shdma-base.c
+@@ -118,10 +118,8 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
+ ret = pm_runtime_get(schan->dev);
+
+ spin_unlock_irq(&schan->chan_lock);
+- if (ret < 0) {
++ if (ret < 0)
+ dev_err(schan->dev, "%s(): GET = %d\n", __func__, ret);
+- pm_runtime_put(schan->dev);
+- }
+
+ pm_runtime_barrier(schan->dev);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index 447c4c7a36d68..acbd33fcb73d3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -955,6 +955,8 @@ struct amdgpu_gfx {
+ DECLARE_BITMAP (pipe_reserve_bitmap, AMDGPU_MAX_COMPUTE_QUEUES);
+ };
+
++int amdgpu_file_to_fpriv(struct file *filp, struct amdgpu_fpriv **fpriv);
++
+ int amdgpu_ib_get(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ unsigned size, struct amdgpu_ib *ib);
+ void amdgpu_ib_free(struct amdgpu_device *adev, struct amdgpu_ib *ib,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+index f92597c292fe5..4488aad64643b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+@@ -1044,11 +1044,15 @@ int amdgpu_amdkfd_gpuvm_acquire_process_vm(struct kgd_dev *kgd,
+ struct dma_fence **ef)
+ {
+ struct amdgpu_device *adev = get_amdgpu_device(kgd);
+- struct drm_file *drm_priv = filp->private_data;
+- struct amdgpu_fpriv *drv_priv = drm_priv->driver_priv;
+- struct amdgpu_vm *avm = &drv_priv->vm;
++ struct amdgpu_fpriv *drv_priv;
++ struct amdgpu_vm *avm;
+ int ret;
+
++ ret = amdgpu_file_to_fpriv(filp, &drv_priv);
++ if (ret)
++ return ret;
++ avm = &drv_priv->vm;
++
+ /* Already a compute VM? */
+ if (avm->process_info)
+ return -EINVAL;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 81001d8793221..023309296bfcd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -1469,6 +1469,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data,
+ return 0;
+
+ default:
++ dma_fence_put(fence);
+ return -EINVAL;
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 63b1e325b45c5..b3b22a87b232b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1132,6 +1132,22 @@ static const struct file_operations amdgpu_driver_kms_fops = {
+ #endif
+ };
+
++int amdgpu_file_to_fpriv(struct file *filp, struct amdgpu_fpriv **fpriv)
++{
++ struct drm_file *file;
++
++ if (!filp)
++ return -EINVAL;
++
++ if (filp->f_op != &amdgpu_driver_kms_fops) {
++ return -EINVAL;
++ }
++
++ file = filp->private_data;
++ *fpriv = file->driver_priv;
++ return 0;
++}
++
+ static bool
+ amdgpu_get_crtc_scanout_position(struct drm_device *dev, unsigned int pipe,
+ bool in_vblank_irq, int *vpos, int *hpos,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+index 239bf2a4b3c68..eeaa2e825858b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+@@ -173,7 +173,7 @@ static int amdgpu_gfx_kiq_acquire(struct amdgpu_device *adev,
+ * adev->gfx.mec.num_pipe_per_mec
+ * adev->gfx.mec.num_queue_per_pipe;
+
+- while (queue_bit-- >= 0) {
++ while (--queue_bit >= 0) {
+ if (test_bit(queue_bit, adev->gfx.mec.queue_bitmap))
+ continue;
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+index 1cafe8d83a4db..0b70410488b66 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+@@ -54,16 +54,20 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev,
+ enum drm_sched_priority priority)
+ {
+ struct file *filp = fget(fd);
+- struct drm_file *file;
+ struct amdgpu_fpriv *fpriv;
+ struct amdgpu_ctx *ctx;
+ uint32_t id;
++ int r;
+
+ if (!filp)
+ return -EINVAL;
+
+- file = filp->private_data;
+- fpriv = file->driver_priv;
++ r = amdgpu_file_to_fpriv(filp, &fpriv);
++ if (r) {
++ fput(filp);
++ return r;
++ }
++
+ idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id)
+ amdgpu_ctx_priority_override(ctx, priority);
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+index ee4996029a868..e2780643f4c32 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+@@ -733,7 +733,7 @@ int kfd_create_crat_image_acpi(void **crat_image, size_t *size)
+ /* Fetch the CRAT table from ACPI */
+ status = acpi_get_table(CRAT_SIGNATURE, 0, &crat_table);
+ if (status == AE_NOT_FOUND) {
+- pr_warn("CRAT table not found\n");
++ pr_info("CRAT table not found\n");
+ return -ENODATA;
+ } else if (ACPI_FAILURE(status)) {
+ const char *err = acpi_format_exception(status);
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index ed02bb6b2cd07..b2835cd41d3e2 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3593,6 +3593,9 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder,
+ mode = amdgpu_dm_create_common_mode(encoder,
+ common_modes[i].name, common_modes[i].w,
+ common_modes[i].h);
++ if (!mode)
++ continue;
++
+ drm_mode_probed_add(connector, mode);
+ amdgpu_dm_connector->num_modes++;
+ }
+diff --git a/drivers/gpu/drm/bridge/cdns-dsi.c b/drivers/gpu/drm/bridge/cdns-dsi.c
+index ce9496d139869..0573c5250a414 100644
+--- a/drivers/gpu/drm/bridge/cdns-dsi.c
++++ b/drivers/gpu/drm/bridge/cdns-dsi.c
+@@ -1604,6 +1604,7 @@ static const struct of_device_id cdns_dsi_of_match[] = {
+ { .compatible = "cdns,dsi" },
+ { },
+ };
++MODULE_DEVICE_TABLE(of, cdns_dsi_of_match);
+
+ static struct platform_driver cdns_dsi_platform_driver = {
+ .probe = cdns_dsi_drm_probe,
+diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
+index 1ea2a1b0fe375..ea433bb189ca2 100644
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -2122,7 +2122,7 @@ static void sii8620_init_rcp_input_dev(struct sii8620 *ctx)
+ if (ret) {
+ dev_err(ctx->dev, "Failed to register RC device\n");
+ ctx->error = ret;
+- rc_free_device(ctx->rc_dev);
++ rc_free_device(rc_dev);
+ return;
+ }
+ ctx->rc_dev = rc_dev;
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 5c049483de23c..ef26095719c5e 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -4323,7 +4323,8 @@ bool drm_detect_monitor_audio(struct edid *edid)
+ if (!edid_ext)
+ goto end;
+
+- has_audio = ((edid_ext[3] & EDID_BASIC_AUDIO) != 0);
++ has_audio = (edid_ext[0] == CEA_EXT &&
++ (edid_ext[3] & EDID_BASIC_AUDIO) != 0);
+
+ if (has_audio) {
+ DRM_DEBUG_KMS("Monitor has basic audio support\n");
+@@ -4501,16 +4502,8 @@ static void drm_parse_hdmi_deep_color_info(struct drm_connector *connector,
+ connector->name, dc_bpc);
+ info->bpc = dc_bpc;
+
+- /*
+- * Deep color support mandates RGB444 support for all video
+- * modes and forbids YCRCB422 support for all video modes per
+- * HDMI 1.3 spec.
+- */
+- info->color_formats = DRM_COLOR_FORMAT_RGB444;
+-
+ /* YCRCB444 is optional according to spec. */
+ if (hdmi[6] & DRM_EDID_HDMI_DC_Y444) {
+- info->color_formats |= DRM_COLOR_FORMAT_YCRCB444;
+ DRM_DEBUG("%s: HDMI sink does YCRCB444 in deep color.\n",
+ connector->name);
+ }
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 3b70a338e5b47..265df1e67eb3c 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -133,6 +133,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"),
+ },
+ .driver_data = (void *)&lcd720x1280_rightside_up,
++ }, { /* GPD Win Max */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1619-01"),
++ },
++ .driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /*
+ * GPD Pocket, note that the the DMI data is less generic then
+ * it seems, devices with a board-vendor of "AMI Corporation"
+diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c
+index aefd04e18f935..e9dff31b377c4 100644
+--- a/drivers/gpu/drm/imx/parallel-display.c
++++ b/drivers/gpu/drm/imx/parallel-display.c
+@@ -77,8 +77,10 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector)
+ ret = of_get_drm_display_mode(np, &imxpd->mode,
+ &imxpd->bus_flags,
+ OF_USE_NATIVE_MODE);
+- if (ret)
++ if (ret) {
++ drm_mode_destroy(connector->dev, mode);
+ return ret;
++ }
+
+ drm_mode_copy(mode, &imxpd->mode);
+ mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED,
+diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
+index ee6ca8fa1c655..e2903bf7821b1 100644
+--- a/drivers/gpu/drm/tegra/dsi.c
++++ b/drivers/gpu/drm/tegra/dsi.c
+@@ -1456,8 +1456,10 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi)
+ dsi->slave = platform_get_drvdata(gangster);
+ of_node_put(np);
+
+- if (!dsi->slave)
++ if (!dsi->slave) {
++ put_device(&gangster->dev);
+ return -EPROBE_DEFER;
++ }
+
+ dsi->slave->master = dsi;
+ }
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 19f4b807a5d1d..f5dc3122aff84 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -632,6 +632,17 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
+ if (report_type == HID_OUTPUT_REPORT)
+ return -EINVAL;
+
++ /*
++ * In case of unnumbered reports the response from the device will
++ * not have the report ID that the upper layers expect, so we need
++ * to stash it the buffer ourselves and adjust the data size.
++ */
++ if (!report_number) {
++ buf[0] = 0;
++ buf++;
++ count--;
++ }
++
+ /* +2 bytes to include the size of the reply in the query buffer */
+ ask_count = min(count + 2, (size_t)ihid->bufsize);
+
+@@ -653,6 +664,9 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
+ count = min(count, ret_count - 2);
+ memcpy(buf, ihid->rawbuf + 2, count);
+
++ if (!report_number)
++ count++;
++
+ return count;
+ }
+
+@@ -669,17 +683,19 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf,
+
+ mutex_lock(&ihid->reset_lock);
+
+- if (report_id) {
+- buf++;
+- count--;
+- }
+-
++ /*
++ * Note that both numbered and unnumbered reports passed here
++ * are supposed to have report ID stored in the 1st byte of the
++ * buffer, so we strip it off unconditionally before passing payload
++ * to i2c_hid_set_or_send_report which takes care of encoding
++ * everything properly.
++ */
+ ret = i2c_hid_set_or_send_report(client,
+ report_type == HID_FEATURE_REPORT ? 0x03 : 0x02,
+- report_id, buf, count, use_data);
++ report_id, buf + 1, count - 1, use_data);
+
+- if (report_id && ret >= 0)
+- ret++; /* add report_id to the number of transfered bytes */
++ if (ret >= 0)
++ ret++; /* add report_id to the number of transferred bytes */
+
+ mutex_unlock(&ihid->reset_lock);
+
+diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
+index e5fc719a34e70..d442a8d2332eb 100644
+--- a/drivers/hv/hv_balloon.c
++++ b/drivers/hv/hv_balloon.c
+@@ -1548,7 +1548,7 @@ static void balloon_onchannelcallback(void *context)
+ break;
+
+ default:
+- pr_warn("Unhandled message: type: %d\n", dm_hdr->type);
++ pr_warn_ratelimited("Unhandled message: type: %d\n", dm_hdr->type);
+
+ }
+ }
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 51fe219c91fc3..0c17743b4a65c 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -2062,10 +2062,15 @@ static void __exit vmbus_exit(void)
+ if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE) {
+ kmsg_dump_unregister(&hv_kmsg_dumper);
+ unregister_die_notifier(&hyperv_die_block);
+- atomic_notifier_chain_unregister(&panic_notifier_list,
+- &hyperv_panic_block);
+ }
+
++ /*
++ * The panic notifier is always registered, hence we should
++ * also unconditionally unregister it here as well.
++ */
++ atomic_notifier_chain_unregister(&panic_notifier_list,
++ &hyperv_panic_block);
++
+ free_page((unsigned long)hv_panic_page);
+ unregister_sysctl_table(hv_ctl_table_hdr);
+ hv_ctl_table_hdr = NULL;
+diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h
+index 1d24397d36ecd..9d731de852c62 100644
+--- a/drivers/hwmon/pmbus/pmbus.h
++++ b/drivers/hwmon/pmbus/pmbus.h
+@@ -291,6 +291,7 @@ enum pmbus_fan_mode { percent = 0, rpm };
+ /*
+ * STATUS_VOUT, STATUS_INPUT
+ */
++#define PB_VOLTAGE_VIN_OFF BIT(3)
+ #define PB_VOLTAGE_UV_FAULT BIT(4)
+ #define PB_VOLTAGE_UV_WARNING BIT(5)
+ #define PB_VOLTAGE_OV_WARNING BIT(6)
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index cd24b375df1ee..bef28e9559530 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -1337,7 +1337,7 @@ static const struct pmbus_limit_attr vin_limit_attrs[] = {
+ .reg = PMBUS_VIN_UV_FAULT_LIMIT,
+ .attr = "lcrit",
+ .alarm = "lcrit_alarm",
+- .sbit = PB_VOLTAGE_UV_FAULT,
++ .sbit = PB_VOLTAGE_UV_FAULT | PB_VOLTAGE_VIN_OFF,
+ }, {
+ .reg = PMBUS_VIN_OV_WARN_LIMIT,
+ .attr = "max",
+@@ -2074,10 +2074,14 @@ static int pmbus_regulator_is_enabled(struct regulator_dev *rdev)
+ {
+ struct device *dev = rdev_get_dev(rdev);
+ struct i2c_client *client = to_i2c_client(dev->parent);
++ struct pmbus_data *data = i2c_get_clientdata(client);
+ u8 page = rdev_get_id(rdev);
+ int ret;
+
++ mutex_lock(&data->update_lock);
+ ret = pmbus_read_byte_data(client, page, PMBUS_OPERATION);
++ mutex_unlock(&data->update_lock);
++
+ if (ret < 0)
+ return ret;
+
+@@ -2088,11 +2092,17 @@ static int _pmbus_regulator_on_off(struct regulator_dev *rdev, bool enable)
+ {
+ struct device *dev = rdev_get_dev(rdev);
+ struct i2c_client *client = to_i2c_client(dev->parent);
++ struct pmbus_data *data = i2c_get_clientdata(client);
+ u8 page = rdev_get_id(rdev);
++ int ret;
+
+- return pmbus_update_byte_data(client, page, PMBUS_OPERATION,
+- PB_OPERATION_CONTROL_ON,
+- enable ? PB_OPERATION_CONTROL_ON : 0);
++ mutex_lock(&data->update_lock);
++ ret = pmbus_update_byte_data(client, page, PMBUS_OPERATION,
++ PB_OPERATION_CONTROL_ON,
++ enable ? PB_OPERATION_CONTROL_ON : 0);
++ mutex_unlock(&data->update_lock);
++
++ return ret;
+ }
+
+ static int pmbus_regulator_enable(struct regulator_dev *rdev)
+diff --git a/drivers/hwmon/sch56xx-common.c b/drivers/hwmon/sch56xx-common.c
+index bda3d52855861..e1c4e6937a645 100644
+--- a/drivers/hwmon/sch56xx-common.c
++++ b/drivers/hwmon/sch56xx-common.c
+@@ -437,7 +437,7 @@ struct sch56xx_watchdog_data *sch56xx_watchdog_register(struct device *parent,
+ if (nowayout)
+ set_bit(WDOG_NO_WAY_OUT, &data->wddev.status);
+ if (output_enable & SCH56XX_WDOG_OUTPUT_ENABLE)
+- set_bit(WDOG_ACTIVE, &data->wddev.status);
++ set_bit(WDOG_HW_RUNNING, &data->wddev.status);
+
+ /* Since the watchdog uses a downcounter there is no register to read
+ the BIOS set timeout from (if any was set at all) ->
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+index f5fb1e7a9c172..dc3d30ca1188c 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+@@ -367,8 +367,12 @@ static ssize_t mode_store(struct device *dev,
+ mode = ETM_MODE_QELEM(config->mode);
+ /* start by clearing QE bits */
+ config->cfg &= ~(BIT(13) | BIT(14));
+- /* if supported, Q elements with instruction counts are enabled */
+- if ((mode & BIT(0)) && (drvdata->q_support & BIT(0)))
++ /*
++ * if supported, Q elements with instruction counts are enabled.
++ * Always set the low bit for any requested mode. Valid combos are
++ * 0b00, 0b01 and 0b11.
++ */
++ if (mode && drvdata->q_support)
+ config->cfg |= BIT(13);
+ /*
+ * if supported, Q elements with and without instruction
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 8d6b6eeef71c4..52acb185a29cf 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -724,7 +724,6 @@ static const struct i2c_adapter_quirks xiic_quirks = {
+
+ static const struct i2c_adapter xiic_adapter = {
+ .owner = THIS_MODULE,
+- .name = DRIVER_NAME,
+ .class = I2C_CLASS_DEPRECATED,
+ .algo = &xiic_algorithm,
+ .quirks = &xiic_quirks,
+@@ -761,6 +760,8 @@ static int xiic_i2c_probe(struct platform_device *pdev)
+ i2c_set_adapdata(&i2c->adap, i2c);
+ i2c->adap.dev.parent = &pdev->dev;
+ i2c->adap.dev.of_node = pdev->dev.of_node;
++ snprintf(i2c->adap.name, sizeof(i2c->adap.name),
++ DRIVER_NAME " %s", pdev->name);
+
+ mutex_init(&i2c->lock);
+ init_waitqueue_head(&i2c->wait);
+diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+index 9ba9ce5696e12..1b99d0b928a0d 100644
+--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+@@ -262,7 +262,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+
+ err = device_create_file(&pdev->dev, &dev_attr_available_masters);
+ if (err)
+- goto err_rollback;
++ goto err_rollback_activation;
+
+ err = device_create_file(&pdev->dev, &dev_attr_current_master);
+ if (err)
+@@ -272,8 +272,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+
+ err_rollback_available:
+ device_remove_file(&pdev->dev, &dev_attr_available_masters);
+-err_rollback:
++err_rollback_activation:
+ i2c_demux_deactivate_master(priv);
++err_rollback:
+ for (j = 0; j < i; j++) {
+ of_node_put(priv->chan[j].parent_np);
+ of_changeset_destroy(&priv->chan[j].chgset);
+diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c
+index e470510e76ea4..765aaee157e28 100644
+--- a/drivers/iio/adc/twl6030-gpadc.c
++++ b/drivers/iio/adc/twl6030-gpadc.c
+@@ -927,6 +927,8 @@ static int twl6030_gpadc_probe(struct platform_device *pdev)
+ ret = devm_request_threaded_irq(dev, irq, NULL,
+ twl6030_gpadc_irq_handler,
+ IRQF_ONESHOT, "twl6030_gpadc", indio_dev);
++ if (ret)
++ return ret;
+
+ ret = twl6030_gpadc_enable_irq(TWL6030_GPADC_RT_SW1_EOC_MASK);
+ if (ret < 0) {
+diff --git a/drivers/iio/afe/iio-rescale.c b/drivers/iio/afe/iio-rescale.c
+index e9ceee66d1e7c..d9c41db8155f9 100644
+--- a/drivers/iio/afe/iio-rescale.c
++++ b/drivers/iio/afe/iio-rescale.c
+@@ -38,7 +38,7 @@ static int rescale_read_raw(struct iio_dev *indio_dev,
+ int *val, int *val2, long mask)
+ {
+ struct rescale *rescale = iio_priv(indio_dev);
+- unsigned long long tmp;
++ s64 tmp;
+ int ret;
+
+ switch (mask) {
+@@ -59,10 +59,10 @@ static int rescale_read_raw(struct iio_dev *indio_dev,
+ *val2 = rescale->denominator;
+ return IIO_VAL_FRACTIONAL;
+ case IIO_VAL_FRACTIONAL_LOG2:
+- tmp = *val * 1000000000LL;
+- do_div(tmp, rescale->denominator);
++ tmp = (s64)*val * 1000000000LL;
++ tmp = div_s64(tmp, rescale->denominator);
+ tmp *= rescale->numerator;
+- do_div(tmp, 1000000000LL);
++ tmp = div_s64(tmp, 1000000000LL);
+ *val = tmp;
+ return ret;
+ default:
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index 06ca3f7fcc445..a8ccc6e5a7735 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -591,28 +591,50 @@ EXPORT_SYMBOL_GPL(iio_read_channel_average_raw);
+ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ int raw, int *processed, unsigned int scale)
+ {
+- int scale_type, scale_val, scale_val2, offset;
++ int scale_type, scale_val, scale_val2;
++ int offset_type, offset_val, offset_val2;
+ s64 raw64 = raw;
+- int ret;
+
+- ret = iio_channel_read(chan, &offset, NULL, IIO_CHAN_INFO_OFFSET);
+- if (ret >= 0)
+- raw64 += offset;
++ offset_type = iio_channel_read(chan, &offset_val, &offset_val2,
++ IIO_CHAN_INFO_OFFSET);
++ if (offset_type >= 0) {
++ switch (offset_type) {
++ case IIO_VAL_INT:
++ break;
++ case IIO_VAL_INT_PLUS_MICRO:
++ case IIO_VAL_INT_PLUS_NANO:
++ /*
++ * Both IIO_VAL_INT_PLUS_MICRO and IIO_VAL_INT_PLUS_NANO
++ * implicitely truncate the offset to it's integer form.
++ */
++ break;
++ case IIO_VAL_FRACTIONAL:
++ offset_val /= offset_val2;
++ break;
++ case IIO_VAL_FRACTIONAL_LOG2:
++ offset_val >>= offset_val2;
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ raw64 += offset_val;
++ }
+
+ scale_type = iio_channel_read(chan, &scale_val, &scale_val2,
+ IIO_CHAN_INFO_SCALE);
+ if (scale_type < 0) {
+ /*
+- * Just pass raw values as processed if no scaling is
+- * available.
++ * If no channel scaling is available apply consumer scale to
++ * raw value and return.
+ */
+- *processed = raw;
++ *processed = raw * scale;
+ return 0;
+ }
+
+ switch (scale_type) {
+ case IIO_VAL_INT:
+- *processed = raw64 * scale_val;
++ *processed = raw64 * scale_val * scale;
+ break;
+ case IIO_VAL_INT_PLUS_MICRO:
+ if (scale_val2 < 0)
+diff --git a/drivers/input/input.c b/drivers/input/input.c
+index b031174c8d7f7..a0d90022fcf73 100644
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -2118,12 +2118,6 @@ int input_register_device(struct input_dev *dev)
+ /* KEY_RESERVED is not supposed to be transmitted to userspace. */
+ __clear_bit(KEY_RESERVED, dev->keybit);
+
+- /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */
+- if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) {
+- __clear_bit(BTN_RIGHT, dev->keybit);
+- __clear_bit(BTN_MIDDLE, dev->keybit);
+- }
+-
+ /* Make sure that bitmasks not mentioned in dev->evbit are clean. */
+ input_cleanse_bitmasks(dev);
+
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index 6b7664052b5be..9f16f47e70219 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -1250,6 +1250,7 @@ static irqreturn_t arm_smmu_evtq_thread(int irq, void *dev)
+ dev_info(smmu->dev, "\t0x%016llx\n",
+ (unsigned long long)evt[i]);
+
++ cond_resched();
+ }
+
+ /*
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index ac888d7a0b00a..05b9a4cdc8fd5 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -95,11 +95,11 @@ static inline void __iomem *gic_dist_base(struct irq_data *d)
+ return NULL;
+ }
+
+-static void gic_do_wait_for_rwp(void __iomem *base)
++static void gic_do_wait_for_rwp(void __iomem *base, u32 bit)
+ {
+ u32 count = 1000000; /* 1s! */
+
+- while (readl_relaxed(base + GICD_CTLR) & GICD_CTLR_RWP) {
++ while (readl_relaxed(base + GICD_CTLR) & bit) {
+ count--;
+ if (!count) {
+ pr_err_ratelimited("RWP timeout, gone fishing\n");
+@@ -113,13 +113,13 @@ static void gic_do_wait_for_rwp(void __iomem *base)
+ /* Wait for completion of a distributor change */
+ static void gic_dist_wait_for_rwp(void)
+ {
+- gic_do_wait_for_rwp(gic_data.dist_base);
++ gic_do_wait_for_rwp(gic_data.dist_base, GICD_CTLR_RWP);
+ }
+
+ /* Wait for completion of a redistributor change */
+ static void gic_redist_wait_for_rwp(void)
+ {
+- gic_do_wait_for_rwp(gic_data_rdist_rd_base());
++ gic_do_wait_for_rwp(gic_data_rdist_rd_base(), GICR_CTLR_RWP);
+ }
+
+ #ifdef CONFIG_ARM64
+diff --git a/drivers/irqchip/irq-nvic.c b/drivers/irqchip/irq-nvic.c
+index 9694529b709de..330beb62d015c 100644
+--- a/drivers/irqchip/irq-nvic.c
++++ b/drivers/irqchip/irq-nvic.c
+@@ -108,6 +108,7 @@ static int __init nvic_of_init(struct device_node *node,
+
+ if (!nvic_irq_domain) {
+ pr_warn("Failed to allocate irq domain\n");
++ iounmap(nvic_base);
+ return -ENOMEM;
+ }
+
+@@ -117,6 +118,7 @@ static int __init nvic_of_init(struct device_node *node,
+ if (ret) {
+ pr_warn("Failed to allocate irq chips\n");
+ irq_domain_remove(nvic_irq_domain);
++ iounmap(nvic_base);
+ return ret;
+ }
+
+diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c
+index faa7d61b9d6c4..239a889df6080 100644
+--- a/drivers/irqchip/qcom-pdc.c
++++ b/drivers/irqchip/qcom-pdc.c
+@@ -50,17 +50,18 @@ static u32 pdc_reg_read(int reg, u32 i)
+ static void pdc_enable_intr(struct irq_data *d, bool on)
+ {
+ int pin_out = d->hwirq;
++ unsigned long flags;
+ u32 index, mask;
+ u32 enable;
+
+ index = pin_out / 32;
+ mask = pin_out % 32;
+
+- raw_spin_lock(&pdc_lock);
++ raw_spin_lock_irqsave(&pdc_lock, flags);
+ enable = pdc_reg_read(IRQ_ENABLE_BANK, index);
+ enable = on ? ENABLE_INTR(enable, mask) : CLEAR_INTR(enable, mask);
+ pdc_reg_write(IRQ_ENABLE_BANK, index, enable);
+- raw_spin_unlock(&pdc_lock);
++ raw_spin_unlock_irqrestore(&pdc_lock, flags);
+ }
+
+ static void qcom_pdc_gic_mask(struct irq_data *d)
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index a6a26f8e4d8e1..3441ad140b583 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -2107,7 +2107,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string
+
+ static int get_key_size(char **key_string)
+ {
+- return (*key_string[0] == ':') ? -EINVAL : strlen(*key_string) >> 1;
++ return (*key_string[0] == ':') ? -EINVAL : (int)(strlen(*key_string) >> 1);
+ }
+
+ #endif
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index 17cbad58834fc..0aae4a46db662 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -17,6 +17,7 @@
+ #include <linux/dm-ioctl.h>
+ #include <linux/hdreg.h>
+ #include <linux/compat.h>
++#include <linux/nospec.h>
+
+ #include <linux/uaccess.h>
+
+@@ -1670,6 +1671,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
+ if (unlikely(cmd >= ARRAY_SIZE(_ioctls)))
+ return NULL;
+
++ cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls));
+ *ioctl_flags = _ioctls[cmd].flags;
+ return _ioctls[cmd].fn;
+ }
+diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c
+index 52ff00ebd4bda..281eca5253406 100644
+--- a/drivers/media/pci/cx88/cx88-mpeg.c
++++ b/drivers/media/pci/cx88/cx88-mpeg.c
+@@ -171,6 +171,9 @@ int cx8802_start_dma(struct cx8802_dev *dev,
+ cx_write(MO_TS_GPCNTRL, GP_COUNT_CONTROL_RESET);
+ q->count = 0;
+
++ /* clear interrupt status register */
++ cx_write(MO_TS_INTSTAT, 0x1f1111);
++
+ /* enable irqs */
+ dprintk(1, "setting the interrupt mask\n");
+ cx_set(MO_PCI_INTMSK, core->pci_irqmask | PCI_INT_TSINT);
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index fccc771d23a51..5f8da544b98d5 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -376,6 +376,7 @@ static struct vdoa_data *coda_get_vdoa_data(void)
+ if (!vdoa_data)
+ vdoa_data = ERR_PTR(-EPROBE_DEFER);
+
++ put_device(&vdoa_pdev->dev);
+ out:
+ if (vdoa_node)
+ of_node_put(vdoa_node);
+diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c
+index 16352e2263d2d..00ce9f276becd 100644
+--- a/drivers/media/platform/davinci/vpif.c
++++ b/drivers/media/platform/davinci/vpif.c
+@@ -496,6 +496,7 @@ static int vpif_probe(struct platform_device *pdev)
+
+ static int vpif_remove(struct platform_device *pdev)
+ {
++ pm_runtime_put(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ return 0;
+ }
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index 06da08f8efdb1..b14bff7b4ec88 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -3822,6 +3822,8 @@ static int em28xx_usb_probe(struct usb_interface *intf,
+ goto err_free;
+ }
+
++ kref_init(&dev->ref);
++
+ dev->devno = nr;
+ dev->model = id->driver_info;
+ dev->alt = -1;
+@@ -3922,6 +3924,8 @@ static int em28xx_usb_probe(struct usb_interface *intf,
+ }
+
+ if (dev->board.has_dual_ts && em28xx_duplicate_dev(dev) == 0) {
++ kref_init(&dev->dev_next->ref);
++
+ dev->dev_next->ts = SECONDARY_TS;
+ dev->dev_next->alt = -1;
+ dev->dev_next->is_audio_only = has_vendor_audio &&
+@@ -3976,12 +3980,8 @@ static int em28xx_usb_probe(struct usb_interface *intf,
+ em28xx_write_reg(dev, 0x0b, 0x82);
+ mdelay(100);
+ }
+-
+- kref_init(&dev->dev_next->ref);
+ }
+
+- kref_init(&dev->ref);
+-
+ request_modules(dev);
+
+ /*
+@@ -4036,11 +4036,8 @@ static void em28xx_usb_disconnect(struct usb_interface *intf)
+
+ em28xx_close_extension(dev);
+
+- if (dev->dev_next) {
+- em28xx_close_extension(dev->dev_next);
++ if (dev->dev_next)
+ em28xx_release_resources(dev->dev_next);
+- }
+-
+ em28xx_release_resources(dev);
+
+ if (dev->dev_next) {
+diff --git a/drivers/media/usb/go7007/s2250-board.c b/drivers/media/usb/go7007/s2250-board.c
+index 1466db150d82c..625e77f4dbd2e 100644
+--- a/drivers/media/usb/go7007/s2250-board.c
++++ b/drivers/media/usb/go7007/s2250-board.c
+@@ -512,6 +512,7 @@ static int s2250_probe(struct i2c_client *client,
+ u8 *data;
+ struct go7007 *go = i2c_get_adapdata(adapter);
+ struct go7007_usb *usb = go->hpi_context;
++ int err = -EIO;
+
+ audio = i2c_new_dummy(adapter, TLV320_ADDRESS >> 1);
+ if (audio == NULL)
+@@ -540,11 +541,8 @@ static int s2250_probe(struct i2c_client *client,
+ V4L2_CID_HUE, -512, 511, 1, 0);
+ sd->ctrl_handler = &state->hdl;
+ if (state->hdl.error) {
+- int err = state->hdl.error;
+-
+- v4l2_ctrl_handler_free(&state->hdl);
+- kfree(state);
+- return err;
++ err = state->hdl.error;
++ goto fail;
+ }
+
+ state->std = V4L2_STD_NTSC;
+@@ -608,7 +606,7 @@ fail:
+ i2c_unregister_device(audio);
+ v4l2_ctrl_handler_free(&state->hdl);
+ kfree(state);
+- return -EIO;
++ return err;
+ }
+
+ static int s2250_remove(struct i2c_client *client)
+diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
+index 0615996572e41..ce46f87214708 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-video.c
++++ b/drivers/media/usb/hdpvr/hdpvr-video.c
+@@ -312,7 +312,6 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev)
+
+ dev->status = STATUS_STREAMING;
+
+- INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
+ schedule_work(&dev->worker);
+
+ v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev,
+@@ -1175,6 +1174,9 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent,
+ bool ac3 = dev->flags & HDPVR_FLAG_AC3_CAP;
+ int res;
+
++ // initialize dev->worker
++ INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
++
+ dev->cur_std = V4L2_STD_525_60;
+ dev->width = 720;
+ dev->height = 480;
+diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c
+index bb0db4cdc6c75..271994bfe9c56 100644
+--- a/drivers/media/usb/stk1160/stk1160-core.c
++++ b/drivers/media/usb/stk1160/stk1160-core.c
+@@ -413,7 +413,7 @@ static void stk1160_disconnect(struct usb_interface *interface)
+ /* Here is the only place where isoc get released */
+ stk1160_uninit_isoc(dev);
+
+- stk1160_clear_queue(dev);
++ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR);
+
+ video_unregister_device(&dev->vdev);
+ v4l2_device_disconnect(&dev->v4l2_dev);
+diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c
+index 504e413edcd25..381f9f189bb73 100644
+--- a/drivers/media/usb/stk1160/stk1160-v4l.c
++++ b/drivers/media/usb/stk1160/stk1160-v4l.c
+@@ -269,7 +269,7 @@ out_uninit:
+ stk1160_uninit_isoc(dev);
+ out_stop_hw:
+ usb_set_interface(dev->udev, 0, 0);
+- stk1160_clear_queue(dev);
++ stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED);
+
+ mutex_unlock(&dev->v4l_lock);
+
+@@ -317,7 +317,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev)
+
+ stk1160_stop_hw(dev);
+
+- stk1160_clear_queue(dev);
++ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR);
+
+ stk1160_dbg("streaming stopped\n");
+
+@@ -762,7 +762,7 @@ static const struct video_device v4l_template = {
+ /********************************************************************/
+
+ /* Must be called with both v4l_lock and vb_queue_lock hold */
+-void stk1160_clear_queue(struct stk1160 *dev)
++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state)
+ {
+ struct stk1160_buffer *buf;
+ unsigned long flags;
+@@ -773,7 +773,7 @@ void stk1160_clear_queue(struct stk1160 *dev)
+ buf = list_first_entry(&dev->avail_bufs,
+ struct stk1160_buffer, list);
+ list_del(&buf->list);
+- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state);
+ stk1160_dbg("buffer [%p/%d] aborted\n",
+ buf, buf->vb.vb2_buf.index);
+ }
+@@ -783,7 +783,7 @@ void stk1160_clear_queue(struct stk1160 *dev)
+ buf = dev->isoc_ctl.buf;
+ dev->isoc_ctl.buf = NULL;
+
+- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
++ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state);
+ stk1160_dbg("buffer [%p/%d] aborted\n",
+ buf, buf->vb.vb2_buf.index);
+ }
+diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h
+index acd1c811db08a..54a046aacd331 100644
+--- a/drivers/media/usb/stk1160/stk1160.h
++++ b/drivers/media/usb/stk1160/stk1160.h
+@@ -177,7 +177,7 @@ struct regval {
+ int stk1160_vb2_setup(struct stk1160 *dev);
+ int stk1160_video_register(struct stk1160 *dev);
+ void stk1160_video_unregister(struct stk1160 *dev);
+-void stk1160_clear_queue(struct stk1160 *dev);
++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state);
+
+ /* Provided by stk1160-video.c */
+ int stk1160_alloc_isoc(struct stk1160 *dev);
+diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c
+index 1c6b2cc6269ad..45f78b38b0da5 100644
+--- a/drivers/memory/emif.c
++++ b/drivers/memory/emif.c
+@@ -1425,7 +1425,7 @@ static struct emif_data *__init_or_module get_device_details(
+ temp = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL);
+ dev_info = devm_kzalloc(dev, sizeof(*dev_info), GFP_KERNEL);
+
+- if (!emif || !pd || !dev_info) {
++ if (!emif || !temp || !dev_info) {
+ dev_err(dev, "%s:%d: allocation error\n", __func__, __LINE__);
+ goto error;
+ }
+@@ -1517,7 +1517,7 @@ static int __init_or_module emif_probe(struct platform_device *pdev)
+ {
+ struct emif_data *emif;
+ struct resource *res;
+- int irq;
++ int irq, ret;
+
+ if (pdev->dev.of_node)
+ emif = of_get_memory_device_details(pdev->dev.of_node, &pdev->dev);
+@@ -1551,7 +1551,9 @@ static int __init_or_module emif_probe(struct platform_device *pdev)
+ emif_onetime_settings(emif);
+ emif_debugfs_init(emif);
+ disable_and_clear_all_interrupts(emif);
+- setup_interrupts(emif, irq);
++ ret = setup_interrupts(emif, irq);
++ if (ret)
++ goto error;
+
+ /* One-time actions taken on probing the first device */
+ if (!emif1) {
+diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
+index 1531302a50ec3..75584cee0da5c 100644
+--- a/drivers/mfd/asic3.c
++++ b/drivers/mfd/asic3.c
+@@ -918,14 +918,14 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
+ ret = mfd_add_devices(&pdev->dev, pdev->id,
+ &asic3_cell_ds1wm, 1, mem, asic->irq_base, NULL);
+ if (ret < 0)
+- goto out;
++ goto out_unmap;
+ }
+
+ if (mem_sdio && (irq >= 0)) {
+ ret = mfd_add_devices(&pdev->dev, pdev->id,
+ &asic3_cell_mmc, 1, mem_sdio, irq, NULL);
+ if (ret < 0)
+- goto out;
++ goto out_unmap;
+ }
+
+ ret = 0;
+@@ -939,8 +939,12 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
+ ret = mfd_add_devices(&pdev->dev, 0,
+ asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0, NULL);
+ }
++ return ret;
+
+- out:
++out_unmap:
++ if (asic->tmio_cnf)
++ iounmap(asic->tmio_cnf);
++out:
+ return ret;
+ }
+
+diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
+index d0bf50e3568d7..dcbb969af5f4f 100644
+--- a/drivers/mfd/mc13xxx-core.c
++++ b/drivers/mfd/mc13xxx-core.c
+@@ -326,8 +326,10 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
+ adc1 |= MC13783_ADC1_ATOX;
+
+ dev_dbg(mc13xxx->dev, "%s: request irq\n", __func__);
+- mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE,
++ ret = mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE,
+ mc13xxx_handler_adcdone, __func__, &adcdone_data);
++ if (ret)
++ goto out;
+
+ mc13xxx_reg_write(mc13xxx, MC13XXX_ADC0, adc0);
+ mc13xxx_reg_write(mc13xxx, MC13XXX_ADC1, adc1);
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index 49e08b6133f50..bc4dc92af1f60 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -1072,10 +1072,10 @@ static int kgdbts_option_setup(char *opt)
+ {
+ if (strlen(opt) >= MAX_CONFIG_LEN) {
+ printk(KERN_ERR "kgdbts: config string too long\n");
+- return -ENOSPC;
++ return 1;
+ }
+ strcpy(config, opt);
+- return 0;
++ return 1;
+ }
+
+ __setup("kgdbts=", kgdbts_option_setup);
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index dd1c14d8f6863..9de8a3553d424 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -413,6 +413,16 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
+
+ EXPORT_SYMBOL(mmc_alloc_host);
+
++static int mmc_validate_host_caps(struct mmc_host *host)
++{
++ if (host->caps & MMC_CAP_SDIO_IRQ && !host->ops->enable_sdio_irq) {
++ dev_warn(host->parent, "missing ->enable_sdio_irq() ops\n");
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ /**
+ * mmc_add_host - initialise host hardware
+ * @host: mmc host
+@@ -425,8 +435,9 @@ int mmc_add_host(struct mmc_host *host)
+ {
+ int err;
+
+- WARN_ON((host->caps & MMC_CAP_SDIO_IRQ) &&
+- !host->ops->enable_sdio_irq);
++ err = mmc_validate_host_caps(host);
++ if (err)
++ return err;
+
+ err = device_add(&host->class_dev);
+ if (err)
+diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c
+index e6f14257a7d06..70d04962f53ac 100644
+--- a/drivers/mmc/host/davinci_mmc.c
++++ b/drivers/mmc/host/davinci_mmc.c
+@@ -1389,8 +1389,12 @@ static int davinci_mmcsd_suspend(struct device *dev)
+ static int davinci_mmcsd_resume(struct device *dev)
+ {
+ struct mmc_davinci_host *host = dev_get_drvdata(dev);
++ int ret;
++
++ ret = clk_enable(host->clk);
++ if (ret)
++ return ret;
+
+- clk_enable(host->clk);
+ mmc_davinci_reset_ctrl(host, 0);
+
+ return 0;
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index e8ab582551f8e..eabfcb5bbafff 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -302,10 +302,10 @@ static void renesas_sdhi_hs400_complete(struct tmio_mmc_host *host)
+ SH_MOBILE_SDHI_SCC_TMPPORT2_HS400OSEL) |
+ sd_scc_read32(host, priv, SH_MOBILE_SDHI_SCC_TMPPORT2));
+
+- /* Set the sampling clock selection range of HS400 mode */
+ sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_DTCNTL,
+ SH_MOBILE_SDHI_SCC_DTCNTL_TAPEN |
+- 0x4 << SH_MOBILE_SDHI_SCC_DTCNTL_TAPNUM_SHIFT);
++ sd_scc_read32(host, priv,
++ SH_MOBILE_SDHI_SCC_DTCNTL));
+
+
+ if (host->pdata->flags & TMIO_MMC_HAVE_4TAP_HS400)
+diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
+index ca34fa424634f..bd7d159368367 100644
+--- a/drivers/mmc/host/sdhci-xenon.c
++++ b/drivers/mmc/host/sdhci-xenon.c
+@@ -243,16 +243,6 @@ static void xenon_voltage_switch(struct sdhci_host *host)
+ {
+ /* Wait for 5ms after set 1.8V signal enable bit */
+ usleep_range(5000, 5500);
+-
+- /*
+- * For some reason the controller's Host Control2 register reports
+- * the bit representing 1.8V signaling as 0 when read after it was
+- * written as 1. Subsequent read reports 1.
+- *
+- * Since this may cause some issues, do an empty read of the Host
+- * Control2 register here to circumvent this.
+- */
+- sdhci_readw(host, SDHCI_HOST_CONTROL2);
+ }
+
+ static const struct sdhci_ops sdhci_xenon_ops = {
+diff --git a/drivers/mtd/nand/onenand/generic.c b/drivers/mtd/nand/onenand/generic.c
+index acad17ec6581a..bfb5cee1b4722 100644
+--- a/drivers/mtd/nand/onenand/generic.c
++++ b/drivers/mtd/nand/onenand/generic.c
+@@ -56,7 +56,12 @@ static int generic_onenand_probe(struct platform_device *pdev)
+ }
+
+ info->onenand.mmcontrol = pdata ? pdata->mmcontrol : NULL;
+- info->onenand.irq = platform_get_irq(pdev, 0);
++
++ err = platform_get_irq(pdev, 0);
++ if (err < 0)
++ goto out_iounmap;
++
++ info->onenand.irq = err;
+
+ info->mtd.dev.parent = &pdev->dev;
+ info->mtd.priv = &info->onenand;
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index 7887629304872..b2ffd22fec31d 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -1984,13 +1984,15 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
+ nc->mck = of_clk_get(dev->parent->of_node, 0);
+ if (IS_ERR(nc->mck)) {
+ dev_err(dev, "Failed to retrieve MCK clk\n");
+- return PTR_ERR(nc->mck);
++ ret = PTR_ERR(nc->mck);
++ goto out_release_dma;
+ }
+
+ np = of_parse_phandle(dev->parent->of_node, "atmel,smc", 0);
+ if (!np) {
+ dev_err(dev, "Missing or invalid atmel,smc property\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out_release_dma;
+ }
+
+ nc->smc = syscon_node_to_regmap(np);
+@@ -1998,10 +2000,16 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc,
+ if (IS_ERR(nc->smc)) {
+ ret = PTR_ERR(nc->smc);
+ dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret);
+- return ret;
++ goto out_release_dma;
+ }
+
+ return 0;
++
++out_release_dma:
++ if (nc->dmac)
++ dma_release_channel(nc->dmac);
++
++ return ret;
+ }
+
+ static int
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index c120c8761fcd2..1ea3a4977c618 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -363,9 +363,6 @@ static ssize_t dev_attribute_show(struct device *dev,
+ * we still can use 'ubi->ubi_num'.
+ */
+ ubi = container_of(dev, struct ubi_device, dev);
+- ubi = ubi_get_device(ubi->ubi_num);
+- if (!ubi)
+- return -ENODEV;
+
+ if (attr == &dev_eraseblock_size)
+ ret = sprintf(buf, "%d\n", ubi->leb_size);
+@@ -394,7 +391,6 @@ static ssize_t dev_attribute_show(struct device *dev,
+ else
+ ret = -EINVAL;
+
+- ubi_put_device(ubi);
+ return ret;
+ }
+
+@@ -969,9 +965,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
+ goto out_detach;
+ }
+
+- /* Make device "available" before it becomes accessible via sysfs */
+- ubi_devices[ubi_num] = ubi;
+-
+ err = uif_init(ubi);
+ if (err)
+ goto out_detach;
+@@ -1016,6 +1009,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
+ wake_up_process(ubi->bgt_thread);
+ spin_unlock(&ubi->wl_lock);
+
++ ubi_devices[ubi_num] = ubi;
+ ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL);
+ return ubi_num;
+
+@@ -1024,7 +1018,6 @@ out_debugfs:
+ out_uif:
+ uif_close(ubi);
+ out_detach:
+- ubi_devices[ubi_num] = NULL;
+ ubi_wl_close(ubi);
+ ubi_free_internal_volumes(ubi);
+ vfree(ubi->vtbl);
+diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
+index b88ef875236cc..d45c1d6587d18 100644
+--- a/drivers/mtd/ubi/fastmap.c
++++ b/drivers/mtd/ubi/fastmap.c
+@@ -477,7 +477,9 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
+ if (err == UBI_IO_FF_BITFLIPS)
+ scrub = 1;
+
+- add_aeb(ai, free, pnum, ec, scrub);
++ ret = add_aeb(ai, free, pnum, ec, scrub);
++ if (ret)
++ goto out;
+ continue;
+ } else if (err == 0 || err == UBI_IO_BITFLIPS) {
+ dbg_bld("Found non empty PEB:%i in pool", pnum);
+@@ -647,8 +649,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
+ if (fm_pos >= fm_size)
+ goto fail_bad;
+
+- add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum),
+- be32_to_cpu(fmec->ec), 0);
++ ret = add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum),
++ be32_to_cpu(fmec->ec), 0);
++ if (ret)
++ goto fail;
+ }
+
+ /* read EC values from used list */
+@@ -658,8 +662,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
+ if (fm_pos >= fm_size)
+ goto fail_bad;
+
+- add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
+- be32_to_cpu(fmec->ec), 0);
++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
++ be32_to_cpu(fmec->ec), 0);
++ if (ret)
++ goto fail;
+ }
+
+ /* read EC values from scrub list */
+@@ -669,8 +675,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
+ if (fm_pos >= fm_size)
+ goto fail_bad;
+
+- add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
+- be32_to_cpu(fmec->ec), 1);
++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
++ be32_to_cpu(fmec->ec), 1);
++ if (ret)
++ goto fail;
+ }
+
+ /* read EC values from erase list */
+@@ -680,8 +688,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
+ if (fm_pos >= fm_size)
+ goto fail_bad;
+
+- add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum),
+- be32_to_cpu(fmec->ec), 1);
++ ret = add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum),
++ be32_to_cpu(fmec->ec), 1);
++ if (ret)
++ goto fail;
+ }
+
+ ai->mean_ec = div_u64(ai->ec_sum, ai->ec_count);
+diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
+index 729588b94e41e..d0c6b66b74509 100644
+--- a/drivers/mtd/ubi/vmt.c
++++ b/drivers/mtd/ubi/vmt.c
+@@ -69,16 +69,11 @@ static ssize_t vol_attribute_show(struct device *dev,
+ {
+ int ret;
+ struct ubi_volume *vol = container_of(dev, struct ubi_volume, dev);
+- struct ubi_device *ubi;
+-
+- ubi = ubi_get_device(vol->ubi->ubi_num);
+- if (!ubi)
+- return -ENODEV;
++ struct ubi_device *ubi = vol->ubi;
+
+ spin_lock(&ubi->volumes_lock);
+ if (!ubi->volumes[vol->vol_id]) {
+ spin_unlock(&ubi->volumes_lock);
+- ubi_put_device(ubi);
+ return -ENODEV;
+ }
+ /* Take a reference to prevent volume removal */
+@@ -116,7 +111,6 @@ static ssize_t vol_attribute_show(struct device *dev,
+ vol->ref_count -= 1;
+ ubi_assert(vol->ref_count >= 0);
+ spin_unlock(&ubi->volumes_lock);
+- ubi_put_device(ubi);
+ return ret;
+ }
+
+diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
+index 3957b746107f1..31a070226353a 100644
+--- a/drivers/net/can/usb/ems_usb.c
++++ b/drivers/net/can/usb/ems_usb.c
+@@ -835,7 +835,6 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne
+
+ usb_unanchor_urb(urb);
+ usb_free_coherent(dev->udev, size, buf, urb->transfer_dma);
+- dev_kfree_skb(skb);
+
+ atomic_dec(&dev->active_tx_urbs);
+
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
+index 097d4a673b059..ea1de06009d6d 100644
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -44,10 +44,6 @@
+ #define MCBA_USB_RX_BUFF_SIZE 64
+ #define MCBA_USB_TX_BUFF_SIZE (sizeof(struct mcba_usb_msg))
+
+-/* MCBA endpoint numbers */
+-#define MCBA_USB_EP_IN 1
+-#define MCBA_USB_EP_OUT 1
+-
+ /* Microchip command id */
+ #define MBCA_CMD_RECEIVE_MESSAGE 0xE3
+ #define MBCA_CMD_I_AM_ALIVE_FROM_CAN 0xF5
+@@ -95,6 +91,8 @@ struct mcba_priv {
+ atomic_t free_ctx_cnt;
+ void *rxbuf[MCBA_MAX_RX_URBS];
+ dma_addr_t rxbuf_dma[MCBA_MAX_RX_URBS];
++ int rx_pipe;
++ int tx_pipe;
+ };
+
+ /* CAN frame */
+@@ -283,10 +281,8 @@ static netdev_tx_t mcba_usb_xmit(struct mcba_priv *priv,
+
+ memcpy(buf, usb_msg, MCBA_USB_TX_BUFF_SIZE);
+
+- usb_fill_bulk_urb(urb, priv->udev,
+- usb_sndbulkpipe(priv->udev, MCBA_USB_EP_OUT), buf,
+- MCBA_USB_TX_BUFF_SIZE, mcba_usb_write_bulk_callback,
+- ctx);
++ usb_fill_bulk_urb(urb, priv->udev, priv->tx_pipe, buf, MCBA_USB_TX_BUFF_SIZE,
++ mcba_usb_write_bulk_callback, ctx);
+
+ urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+ usb_anchor_urb(urb, &priv->tx_submitted);
+@@ -379,7 +375,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
+ xmit_failed:
+ can_free_echo_skb(priv->netdev, ctx->ndx);
+ mcba_usb_free_ctx(ctx);
+- dev_kfree_skb(skb);
+ stats->tx_dropped++;
+
+ return NETDEV_TX_OK;
+@@ -622,7 +617,7 @@ static void mcba_usb_read_bulk_callback(struct urb *urb)
+ resubmit_urb:
+
+ usb_fill_bulk_urb(urb, priv->udev,
+- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_OUT),
++ priv->rx_pipe,
+ urb->transfer_buffer, MCBA_USB_RX_BUFF_SIZE,
+ mcba_usb_read_bulk_callback, priv);
+
+@@ -667,7 +662,7 @@ static int mcba_usb_start(struct mcba_priv *priv)
+ urb->transfer_dma = buf_dma;
+
+ usb_fill_bulk_urb(urb, priv->udev,
+- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN),
++ priv->rx_pipe,
+ buf, MCBA_USB_RX_BUFF_SIZE,
+ mcba_usb_read_bulk_callback, priv);
+ urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+@@ -821,6 +816,13 @@ static int mcba_usb_probe(struct usb_interface *intf,
+ struct mcba_priv *priv;
+ int err = -ENOMEM;
+ struct usb_device *usbdev = interface_to_usbdev(intf);
++ struct usb_endpoint_descriptor *in, *out;
++
++ err = usb_find_common_endpoints(intf->cur_altsetting, &in, &out, NULL, NULL);
++ if (err) {
++ dev_err(&intf->dev, "Can't find endpoints\n");
++ return err;
++ }
+
+ netdev = alloc_candev(sizeof(struct mcba_priv), MCBA_MAX_TX_URBS);
+ if (!netdev) {
+@@ -866,6 +868,9 @@ static int mcba_usb_probe(struct usb_interface *intf,
+ goto cleanup_free_candev;
+ }
+
++ priv->rx_pipe = usb_rcvbulkpipe(priv->udev, in->bEndpointAddress);
++ priv->tx_pipe = usb_sndbulkpipe(priv->udev, out->bEndpointAddress);
++
+ devm_can_led_init(netdev);
+
+ /* Start USB dev only if we have successfully registered CAN device */
+diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
+index ccd758ba3fb09..8197f04aa8b6c 100644
+--- a/drivers/net/can/vxcan.c
++++ b/drivers/net/can/vxcan.c
+@@ -156,7 +156,7 @@ static void vxcan_setup(struct net_device *dev)
+ dev->hard_header_len = 0;
+ dev->addr_len = 0;
+ dev->tx_queue_len = 0;
+- dev->flags = (IFF_NOARP|IFF_ECHO);
++ dev->flags = IFF_NOARP;
+ dev->netdev_ops = &vxcan_netdev_ops;
+ dev->needs_free_netdev = true;
+ }
+diff --git a/drivers/net/ethernet/8390/mcf8390.c b/drivers/net/ethernet/8390/mcf8390.c
+index 4ad8031ab6695..065fdbe66c425 100644
+--- a/drivers/net/ethernet/8390/mcf8390.c
++++ b/drivers/net/ethernet/8390/mcf8390.c
+@@ -406,12 +406,12 @@ static int mcf8390_init(struct net_device *dev)
+ static int mcf8390_probe(struct platform_device *pdev)
+ {
+ struct net_device *dev;
+- struct resource *mem, *irq;
++ struct resource *mem;
+ resource_size_t msize;
+- int ret;
++ int ret, irq;
+
+- irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (irq == NULL) {
++ irq = platform_get_irq(pdev, 0);
++ if (irq < 0) {
+ dev_err(&pdev->dev, "no IRQ specified?\n");
+ return -ENXIO;
+ }
+@@ -434,7 +434,7 @@ static int mcf8390_probe(struct platform_device *pdev)
+ SET_NETDEV_DEV(dev, &pdev->dev);
+ platform_set_drvdata(pdev, dev);
+
+- dev->irq = irq->start;
++ dev->irq = irq;
+ dev->base_addr = mem->start;
+
+ ret = mcf8390_init(dev);
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index e75a47a9f5119..deba77670b1c7 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1377,9 +1377,7 @@ static int bnxt_set_pauseparam(struct net_device *dev,
+ }
+
+ link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL;
+- if (bp->hwrm_spec_code >= 0x10201)
+- link_info->req_flow_ctrl =
+- PORT_PHY_CFG_REQ_AUTO_PAUSE_AUTONEG_PAUSE;
++ link_info->req_flow_ctrl = 0;
+ } else {
+ /* when transition from auto pause to force pause,
+ * force a link change
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+index 285231bc318bb..402c1c3d84ce2 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+@@ -3002,12 +3002,16 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn,
+ u8 mask = QED_ACCEPT_UCAST_UNMATCHED | QED_ACCEPT_MCAST_UNMATCHED;
+ struct qed_filter_accept_flags *flags = ¶ms->accept_flags;
+ struct qed_public_vf_info *vf_info;
++ u16 tlv_mask;
++
++ tlv_mask = BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM) |
++ BIT(QED_IOV_VP_UPDATE_ACCEPT_ANY_VLAN);
+
+ /* Untrusted VFs can't even be trusted to know that fact.
+ * Simply indicate everything is configured fine, and trace
+ * configuration 'behind their back'.
+ */
+- if (!(*tlvs & BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM)))
++ if (!(*tlvs & tlv_mask))
+ return 0;
+
+ vf_info = qed_iov_get_public_vf_info(hwfn, vfid, true);
+@@ -3024,6 +3028,13 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn,
+ flags->tx_accept_filter &= ~mask;
+ }
+
++ if (params->update_accept_any_vlan_flg) {
++ vf_info->accept_any_vlan = params->accept_any_vlan;
++
++ if (vf_info->forced_vlan && !vf_info->is_trusted_configured)
++ params->accept_any_vlan = false;
++ }
++
+ return 0;
+ }
+
+@@ -4709,6 +4720,7 @@ static int qed_get_vf_config(struct qed_dev *cdev,
+ tx_rate = vf_info->tx_rate;
+ ivi->max_tx_rate = tx_rate ? tx_rate : link.speed;
+ ivi->min_tx_rate = qed_iov_get_vf_min_rate(hwfn, vf_id);
++ ivi->trusted = vf_info->is_trusted_request;
+
+ return 0;
+ }
+@@ -5139,6 +5151,12 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
+
+ params.update_ctl_frame_check = 1;
+ params.mac_chk_en = !vf_info->is_trusted_configured;
++ params.update_accept_any_vlan_flg = 0;
++
++ if (vf_info->accept_any_vlan && vf_info->forced_vlan) {
++ params.update_accept_any_vlan_flg = 1;
++ params.accept_any_vlan = vf_info->accept_any_vlan;
++ }
+
+ if (vf_info->rx_accept_mode & mask) {
+ flags->update_rx_mode_config = 1;
+@@ -5154,13 +5172,20 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
+ if (!vf_info->is_trusted_configured) {
+ flags->rx_accept_filter &= ~mask;
+ flags->tx_accept_filter &= ~mask;
++ params.accept_any_vlan = false;
+ }
+
+ if (flags->update_rx_mode_config ||
+ flags->update_tx_mode_config ||
+- params.update_ctl_frame_check)
++ params.update_ctl_frame_check ||
++ params.update_accept_any_vlan_flg) {
++ DP_VERBOSE(hwfn, QED_MSG_IOV,
++ "vport update config for %s VF[abs 0x%x rel 0x%x]\n",
++ vf_info->is_trusted_configured ? "trusted" : "untrusted",
++ vf->abs_vf_id, vf->relative_vf_id);
+ qed_sp_vport_update(hwfn, ¶ms,
+ QED_SPQ_MODE_EBLOCK, NULL);
++ }
+ }
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.h b/drivers/net/ethernet/qlogic/qed/qed_sriov.h
+index 9a8fd79611f24..853be06bccdf6 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.h
+@@ -88,6 +88,7 @@ struct qed_public_vf_info {
+ bool is_trusted_request;
+ u8 rx_accept_mode;
+ u8 tx_accept_mode;
++ bool accept_any_vlan;
+ };
+
+ struct qed_iov_vf_init_params {
+diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+index 9d5c2e31dfe9b..6a1a7d37dfd71 100644
+--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+@@ -731,6 +731,9 @@ qede_build_skb(struct qede_rx_queue *rxq,
+ buf = page_address(bd->data) + bd->page_offset;
+ skb = build_skb(buf, rxq->rx_buf_seg_size);
+
++ if (unlikely(!skb))
++ return NULL;
++
+ skb_reserve(skb, pad);
+ skb_put(skb, len);
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
+index f4aa6331b367b..0a9d24e86715d 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
+@@ -52,7 +52,7 @@ static inline int qlcnic_dcb_get_hw_capability(struct qlcnic_dcb *dcb)
+ if (dcb && dcb->ops->get_hw_capability)
+ return dcb->ops->get_hw_capability(dcb);
+
+- return 0;
++ return -EOPNOTSUPP;
+ }
+
+ static inline void qlcnic_dcb_free(struct qlcnic_dcb *dcb)
+@@ -66,7 +66,7 @@ static inline int qlcnic_dcb_attach(struct qlcnic_dcb *dcb)
+ if (dcb && dcb->ops->attach)
+ return dcb->ops->attach(dcb);
+
+- return 0;
++ return -EOPNOTSUPP;
+ }
+
+ static inline int
+@@ -75,7 +75,7 @@ qlcnic_dcb_query_hw_capability(struct qlcnic_dcb *dcb, char *buf)
+ if (dcb && dcb->ops->query_hw_capability)
+ return dcb->ops->query_hw_capability(dcb, buf);
+
+- return 0;
++ return -EOPNOTSUPP;
+ }
+
+ static inline void qlcnic_dcb_get_info(struct qlcnic_dcb *dcb)
+@@ -90,7 +90,7 @@ qlcnic_dcb_query_cee_param(struct qlcnic_dcb *dcb, char *buf, u8 type)
+ if (dcb && dcb->ops->query_cee_param)
+ return dcb->ops->query_cee_param(dcb, buf, type);
+
+- return 0;
++ return -EOPNOTSUPP;
+ }
+
+ static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb)
+@@ -98,7 +98,7 @@ static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb)
+ if (dcb && dcb->ops->get_cee_cfg)
+ return dcb->ops->get_cee_cfg(dcb);
+
+- return 0;
++ return -EOPNOTSUPP;
+ }
+
+ static inline void qlcnic_dcb_aen_handler(struct qlcnic_dcb *dcb, void *msg)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+index 05f5084158bf5..9762e687fc73a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -398,8 +398,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
+ plat->interface = of_get_phy_mode(np);
+
+ /* Get max speed of operation from device tree */
+- if (of_property_read_u32(np, "max-speed", &plat->max_speed))
+- plat->max_speed = -1;
++ of_property_read_u32(np, "max-speed", &plat->max_speed);
+
+ plat->bus_id = of_alias_get_id(np, "ethernet");
+ if (plat->bus_id < 0)
+diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
+index 06da2f59fcbff..882908e74cc99 100644
+--- a/drivers/net/ethernet/sun/sunhme.c
++++ b/drivers/net/ethernet/sun/sunhme.c
+@@ -3164,7 +3164,7 @@ static int happy_meal_pci_probe(struct pci_dev *pdev,
+ if (err) {
+ printk(KERN_ERR "happymeal(PCI): Cannot register net device, "
+ "aborting.\n");
+- goto err_out_iounmap;
++ goto err_out_free_coherent;
+ }
+
+ pci_set_drvdata(pdev, hp);
+@@ -3197,6 +3197,10 @@ static int happy_meal_pci_probe(struct pci_dev *pdev,
+
+ return 0;
+
++err_out_free_coherent:
++ dma_free_coherent(hp->dma_dev, PAGE_SIZE,
++ hp->happy_block, hp->hblock_dvma);
++
+ err_out_iounmap:
+ iounmap(hp->gregs);
+
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index af776d7be7806..29431e3eebee3 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -674,14 +674,14 @@ static void sixpack_close(struct tty_struct *tty)
+ */
+ netif_stop_queue(sp->dev);
+
++ unregister_netdev(sp->dev);
++
+ del_timer_sync(&sp->tx_t);
+ del_timer_sync(&sp->resync_t);
+
+ /* Free all 6pack frame buffers. */
+ kfree(sp->rbuff);
+ kfree(sp->xbuff);
+-
+- unregister_netdev(sp->dev);
+ }
+
+ /* Perform I/O control on an active 6pack channel. */
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index 9a10029caf83f..085f1648a8a67 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -132,11 +132,17 @@ static void macvtap_setup(struct net_device *dev)
+ dev->tx_queue_len = TUN_READQ_SIZE;
+ }
+
++static struct net *macvtap_link_net(const struct net_device *dev)
++{
++ return dev_net(macvlan_dev_real_dev(dev));
++}
++
+ static struct rtnl_link_ops macvtap_link_ops __read_mostly = {
+ .kind = "macvtap",
+ .setup = macvtap_setup,
+ .newlink = macvtap_newlink,
+ .dellink = macvtap_dellink,
++ .get_link_net = macvtap_link_net,
+ .priv_size = sizeof(struct macvtap_dev),
+ };
+
+diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
+index e86ea105c8022..94622d119abce 100644
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -15,6 +15,7 @@
+ */
+
+ #include "bcm-phy-lib.h"
++#include <linux/delay.h>
+ #include <linux/module.h>
+ #include <linux/phy.h>
+ #include <linux/brcmphy.h>
+@@ -462,6 +463,26 @@ static int brcm_fet_config_init(struct phy_device *phydev)
+ if (err < 0)
+ return err;
+
++ /* The datasheet indicates the PHY needs up to 1us to complete a reset,
++ * build some slack here.
++ */
++ usleep_range(1000, 2000);
++
++ /* The PHY requires 65 MDC clock cycles to complete a write operation
++ * and turnaround the line properly.
++ *
++ * We ignore -EIO here as the MDIO controller (e.g.: mdio-bcm-unimac)
++ * may flag the lack of turn-around as a read failure. This is
++ * particularly true with this combination since the MDIO controller
++ * only used 64 MDC cycles. This is not a critical failure in this
++ * specific case and it has no functional impact otherwise, so we let
++ * that one go through. If there is a genuine bus error, the next read
++ * of MII_BRCM_FET_INTREG will error out.
++ */
++ err = phy_read(phydev, MII_BMCR);
++ if (err < 0 && err != -EIO)
++ return err;
++
+ reg = phy_read(phydev, MII_BRCM_FET_INTREG);
+ if (reg < 0)
+ return reg;
+diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c
+index a6b179f88d363..1d44227d107d4 100644
+--- a/drivers/net/wireless/ath/ath10k/wow.c
++++ b/drivers/net/wireless/ath/ath10k/wow.c
+@@ -235,14 +235,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif,
+ if (patterns[i].mask[j / 8] & BIT(j % 8))
+ bitmask[j] = 0xff;
+ old_pattern.mask = bitmask;
+- new_pattern = old_pattern;
+
+ if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) {
+- if (patterns[i].pkt_offset < ETH_HLEN)
++ if (patterns[i].pkt_offset < ETH_HLEN) {
+ ath10k_wow_convert_8023_to_80211(&new_pattern,
+ &old_pattern);
+- else
++ } else {
++ new_pattern = old_pattern;
+ new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN;
++ }
+ }
+
+ if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE))
+diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
+index 94d34ee02265d..01163b3339451 100644
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode,
+ }
+ }
+
++ if (idx == AR5K_EEPROM_N_PD_CURVES)
++ goto err_out;
++
+ ee->ee_pd_gains[mode] = 1;
+
+ pd = &chinfo[pier].pd_curves[idx];
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index 05fca38b38ed4..e37de14bc502f 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -30,6 +30,7 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb,
+ hdr->endpoint_id = epid;
+ hdr->flags = flags;
+ hdr->payload_len = cpu_to_be16(len);
++ memset(hdr->control, 0, sizeof(hdr->control));
+
+ status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb);
+
+@@ -274,6 +275,10 @@ int htc_connect_service(struct htc_target *target,
+ conn_msg->dl_pipeid = endpoint->dl_pipeid;
+ conn_msg->ul_pipeid = endpoint->ul_pipeid;
+
++ /* To prevent infoleak */
++ conn_msg->svc_meta_len = 0;
++ conn_msg->pad = 0;
++
+ ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0);
+ if (ret)
+ goto err;
+diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
+index 7064e6fc5dbbb..ab78707467f49 100644
+--- a/drivers/net/wireless/ath/carl9170/main.c
++++ b/drivers/net/wireless/ath/carl9170/main.c
+@@ -1922,7 +1922,7 @@ static int carl9170_parse_eeprom(struct ar9170 *ar)
+ WARN_ON(!(tx_streams >= 1 && tx_streams <=
+ IEEE80211_HT_MCS_TX_MAX_STREAMS));
+
+- tx_params = (tx_streams - 1) <<
++ tx_params |= (tx_streams - 1) <<
+ IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT;
+
+ carl9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+index 9927079a9ace4..4e5a6c311d1ad 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -217,6 +217,8 @@ static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
+ size = BRCMF_FW_MAX_NVRAM_SIZE;
+ else
+ size = data_len;
++ /* Add space for properties we may add */
++ size += strlen(BRCMF_FW_DEFAULT_BOARDREV) + 1;
+ /* Alloc for extra 0 byte + roundup by 4 + length field */
+ size += 1 + 3 + sizeof(u32);
+ nvp->nvram = kzalloc(size, GFP_KERNEL);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+index 4fffa6988087b..a21529d2ccabc 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -22,6 +22,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/bcma/bcma.h>
+ #include <linux/sched.h>
++#include <linux/io.h>
+ #include <asm/unaligned.h>
+
+ #include <soc.h>
+@@ -441,47 +442,6 @@ brcmf_pcie_write_ram32(struct brcmf_pciedev_info *devinfo, u32 mem_offset,
+ }
+
+
+-static void
+-brcmf_pcie_copy_mem_todev(struct brcmf_pciedev_info *devinfo, u32 mem_offset,
+- void *srcaddr, u32 len)
+-{
+- void __iomem *address = devinfo->tcm + mem_offset;
+- __le32 *src32;
+- __le16 *src16;
+- u8 *src8;
+-
+- if (((ulong)address & 4) || ((ulong)srcaddr & 4) || (len & 4)) {
+- if (((ulong)address & 2) || ((ulong)srcaddr & 2) || (len & 2)) {
+- src8 = (u8 *)srcaddr;
+- while (len) {
+- iowrite8(*src8, address);
+- address++;
+- src8++;
+- len--;
+- }
+- } else {
+- len = len / 2;
+- src16 = (__le16 *)srcaddr;
+- while (len) {
+- iowrite16(le16_to_cpu(*src16), address);
+- address += 2;
+- src16++;
+- len--;
+- }
+- }
+- } else {
+- len = len / 4;
+- src32 = (__le32 *)srcaddr;
+- while (len) {
+- iowrite32(le32_to_cpu(*src32), address);
+- address += 4;
+- src32++;
+- len--;
+- }
+- }
+-}
+-
+-
+ static void
+ brcmf_pcie_copy_dev_tomem(struct brcmf_pciedev_info *devinfo, u32 mem_offset,
+ void *dstaddr, u32 len)
+@@ -1503,8 +1463,8 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo,
+ return err;
+
+ brcmf_dbg(PCIE, "Download FW %s\n", devinfo->fw_name);
+- brcmf_pcie_copy_mem_todev(devinfo, devinfo->ci->rambase,
+- (void *)fw->data, fw->size);
++ memcpy_toio(devinfo->tcm + devinfo->ci->rambase,
++ (void *)fw->data, fw->size);
+
+ resetintr = get_unaligned_le32(fw->data);
+ release_firmware(fw);
+@@ -1518,7 +1478,7 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo,
+ brcmf_dbg(PCIE, "Download NVRAM %s\n", devinfo->nvram_name);
+ address = devinfo->ci->rambase + devinfo->ci->ramsize -
+ nvram_len;
+- brcmf_pcie_copy_mem_todev(devinfo, address, nvram, nvram_len);
++ memcpy_toio(devinfo->tcm + address, nvram, nvram_len);
+ brcmf_fw_nvram_free(nvram);
+ } else {
+ brcmf_dbg(PCIE, "No matching NVRAM file found %s\n",
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
+index 82caae02dd094..f2e0cfa2f4a23 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c
+@@ -317,7 +317,7 @@ static int iwlagn_mac_start(struct ieee80211_hw *hw)
+
+ priv->is_open = 1;
+ IWL_DEBUG_MAC80211(priv, "leave\n");
+- return 0;
++ return ret;
+ }
+
+ static void iwlagn_mac_stop(struct ieee80211_hw *hw)
+diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
+index 08c607c031bc0..8704bae39e1bf 100644
+--- a/drivers/net/wireless/ray_cs.c
++++ b/drivers/net/wireless/ray_cs.c
+@@ -394,6 +394,8 @@ static int ray_config(struct pcmcia_device *link)
+ goto failed;
+ local->sram = ioremap(link->resource[2]->start,
+ resource_size(link->resource[2]));
++ if (!local->sram)
++ goto failed;
+
+ /*** Set up 16k window for shared memory (receive buffer) ***************/
+ link->resource[3]->flags |=
+@@ -408,6 +410,8 @@ static int ray_config(struct pcmcia_device *link)
+ goto failed;
+ local->rmem = ioremap(link->resource[3]->start,
+ resource_size(link->resource[3]));
++ if (!local->rmem)
++ goto failed;
+
+ /*** Set up window for attribute memory ***********************************/
+ link->resource[4]->flags |=
+@@ -422,6 +426,8 @@ static int ray_config(struct pcmcia_device *link)
+ goto failed;
+ local->amem = ioremap(link->resource[4]->start,
+ resource_size(link->resource[4]));
++ if (!local->amem)
++ goto failed;
+
+ dev_dbg(&link->dev, "ray_config sram=%p\n", local->sram);
+ dev_dbg(&link->dev, "ray_config rmem=%p\n", local->rmem);
+diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
+index 2b60535a9c7bf..25f36e5197d48 100644
+--- a/drivers/parisc/dino.c
++++ b/drivers/parisc/dino.c
+@@ -144,9 +144,8 @@ struct dino_device
+ {
+ struct pci_hba_data hba; /* 'C' inheritance - must be first */
+ spinlock_t dinosaur_pen;
+- unsigned long txn_addr; /* EIR addr to generate interrupt */
+- u32 txn_data; /* EIR data assign to each dino */
+ u32 imr; /* IRQ's which are enabled */
++ struct gsc_irq gsc_irq;
+ int global_irq[DINO_LOCAL_IRQS]; /* map IMR bit to global irq */
+ #ifdef DINO_DEBUG
+ unsigned int dino_irr0; /* save most recent IRQ line stat */
+@@ -343,14 +342,43 @@ static void dino_unmask_irq(struct irq_data *d)
+ if (tmp & DINO_MASK_IRQ(local_irq)) {
+ DBG(KERN_WARNING "%s(): IRQ asserted! (ILR 0x%x)\n",
+ __func__, tmp);
+- gsc_writel(dino_dev->txn_data, dino_dev->txn_addr);
++ gsc_writel(dino_dev->gsc_irq.txn_data, dino_dev->gsc_irq.txn_addr);
+ }
+ }
+
++#ifdef CONFIG_SMP
++static int dino_set_affinity_irq(struct irq_data *d, const struct cpumask *dest,
++ bool force)
++{
++ struct dino_device *dino_dev = irq_data_get_irq_chip_data(d);
++ struct cpumask tmask;
++ int cpu_irq;
++ u32 eim;
++
++ if (!cpumask_and(&tmask, dest, cpu_online_mask))
++ return -EINVAL;
++
++ cpu_irq = cpu_check_affinity(d, &tmask);
++ if (cpu_irq < 0)
++ return cpu_irq;
++
++ dino_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq);
++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data;
++ __raw_writel(eim, dino_dev->hba.base_addr+DINO_IAR0);
++
++ irq_data_update_effective_affinity(d, &tmask);
++
++ return IRQ_SET_MASK_OK;
++}
++#endif
++
+ static struct irq_chip dino_interrupt_type = {
+ .name = "GSC-PCI",
+ .irq_unmask = dino_unmask_irq,
+ .irq_mask = dino_mask_irq,
++#ifdef CONFIG_SMP
++ .irq_set_affinity = dino_set_affinity_irq,
++#endif
+ };
+
+
+@@ -811,7 +839,6 @@ static int __init dino_common_init(struct parisc_device *dev,
+ {
+ int status;
+ u32 eim;
+- struct gsc_irq gsc_irq;
+ struct resource *res;
+
+ pcibios_register_hba(&dino_dev->hba);
+@@ -826,10 +853,8 @@ static int __init dino_common_init(struct parisc_device *dev,
+ ** still only has 11 IRQ input lines - just map some of them
+ ** to a different processor.
+ */
+- dev->irq = gsc_alloc_irq(&gsc_irq);
+- dino_dev->txn_addr = gsc_irq.txn_addr;
+- dino_dev->txn_data = gsc_irq.txn_data;
+- eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data;
++ dev->irq = gsc_alloc_irq(&dino_dev->gsc_irq);
++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data;
+
+ /*
+ ** Dino needs a PA "IRQ" to get a processor's attention.
+diff --git a/drivers/parisc/gsc.c b/drivers/parisc/gsc.c
+index 1bab5a2cd359f..a0cae6194591d 100644
+--- a/drivers/parisc/gsc.c
++++ b/drivers/parisc/gsc.c
+@@ -139,10 +139,41 @@ static void gsc_asic_unmask_irq(struct irq_data *d)
+ */
+ }
+
++#ifdef CONFIG_SMP
++static int gsc_set_affinity_irq(struct irq_data *d, const struct cpumask *dest,
++ bool force)
++{
++ struct gsc_asic *gsc_dev = irq_data_get_irq_chip_data(d);
++ struct cpumask tmask;
++ int cpu_irq;
++
++ if (!cpumask_and(&tmask, dest, cpu_online_mask))
++ return -EINVAL;
++
++ cpu_irq = cpu_check_affinity(d, &tmask);
++ if (cpu_irq < 0)
++ return cpu_irq;
++
++ gsc_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq);
++ gsc_dev->eim = ((u32) gsc_dev->gsc_irq.txn_addr) | gsc_dev->gsc_irq.txn_data;
++
++ /* switch IRQ's for devices below LASI/WAX to other CPU */
++ gsc_writel(gsc_dev->eim, gsc_dev->hpa + OFFSET_IAR);
++
++ irq_data_update_effective_affinity(d, &tmask);
++
++ return IRQ_SET_MASK_OK;
++}
++#endif
++
++
+ static struct irq_chip gsc_asic_interrupt_type = {
+ .name = "GSC-ASIC",
+ .irq_unmask = gsc_asic_unmask_irq,
+ .irq_mask = gsc_asic_mask_irq,
++#ifdef CONFIG_SMP
++ .irq_set_affinity = gsc_set_affinity_irq,
++#endif
+ };
+
+ int gsc_assign_irq(struct irq_chip *type, void *data)
+diff --git a/drivers/parisc/gsc.h b/drivers/parisc/gsc.h
+index b9d7bfb68e24d..9a364a4d09a51 100644
+--- a/drivers/parisc/gsc.h
++++ b/drivers/parisc/gsc.h
+@@ -32,6 +32,7 @@ struct gsc_asic {
+ int version;
+ int type;
+ int eim;
++ struct gsc_irq gsc_irq;
+ int global_irq[32];
+ };
+
+diff --git a/drivers/parisc/lasi.c b/drivers/parisc/lasi.c
+index 4c92254315004..07ac0b8ee4fe3 100644
+--- a/drivers/parisc/lasi.c
++++ b/drivers/parisc/lasi.c
+@@ -167,7 +167,6 @@ static int __init lasi_init_chip(struct parisc_device *dev)
+ {
+ extern void (*chassis_power_off)(void);
+ struct gsc_asic *lasi;
+- struct gsc_irq gsc_irq;
+ int ret;
+
+ lasi = kzalloc(sizeof(*lasi), GFP_KERNEL);
+@@ -189,7 +188,7 @@ static int __init lasi_init_chip(struct parisc_device *dev)
+ lasi_init_irq(lasi);
+
+ /* the IRQ lasi should use */
+- dev->irq = gsc_alloc_irq(&gsc_irq);
++ dev->irq = gsc_alloc_irq(&lasi->gsc_irq);
+ if (dev->irq < 0) {
+ printk(KERN_ERR "%s(): cannot get GSC irq\n",
+ __func__);
+@@ -197,9 +196,9 @@ static int __init lasi_init_chip(struct parisc_device *dev)
+ return -EBUSY;
+ }
+
+- lasi->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data;
++ lasi->eim = ((u32) lasi->gsc_irq.txn_addr) | lasi->gsc_irq.txn_data;
+
+- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi);
++ ret = request_irq(lasi->gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi);
+ if (ret < 0) {
+ kfree(lasi);
+ return ret;
+diff --git a/drivers/parisc/wax.c b/drivers/parisc/wax.c
+index 6a3e40702b3bf..5c42bfa83398d 100644
+--- a/drivers/parisc/wax.c
++++ b/drivers/parisc/wax.c
+@@ -72,7 +72,6 @@ static int __init wax_init_chip(struct parisc_device *dev)
+ {
+ struct gsc_asic *wax;
+ struct parisc_device *parent;
+- struct gsc_irq gsc_irq;
+ int ret;
+
+ wax = kzalloc(sizeof(*wax), GFP_KERNEL);
+@@ -89,7 +88,7 @@ static int __init wax_init_chip(struct parisc_device *dev)
+ wax_init_irq(wax);
+
+ /* the IRQ wax should use */
+- dev->irq = gsc_claim_irq(&gsc_irq, WAX_GSC_IRQ);
++ dev->irq = gsc_claim_irq(&wax->gsc_irq, WAX_GSC_IRQ);
+ if (dev->irq < 0) {
+ printk(KERN_ERR "%s(): cannot get GSC irq\n",
+ __func__);
+@@ -97,9 +96,9 @@ static int __init wax_init_chip(struct parisc_device *dev)
+ return -EBUSY;
+ }
+
+- wax->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data;
++ wax->eim = ((u32) wax->gsc_irq.txn_addr) | wax->gsc_irq.txn_data;
+
+- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "wax", wax);
++ ret = request_irq(wax->gsc_irq.irq, gsc_asic_intr, 0, "wax", wax);
+ if (ret < 0) {
+ kfree(wax);
+ return ret;
+diff --git a/drivers/pci/access.c b/drivers/pci/access.c
+index 3c8ffd62dc006..98ee5f05fc0fb 100644
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -160,9 +160,12 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn,
+ * write happen to have any RW1C (write-one-to-clear) bits set, we
+ * just inadvertently cleared something we shouldn't have.
+ */
+- dev_warn_ratelimited(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n",
+- size, pci_domain_nr(bus), bus->number,
+- PCI_SLOT(devfn), PCI_FUNC(devfn), where);
++ if (!bus->unsafe_warn) {
++ dev_warn(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n",
++ size, pci_domain_nr(bus), bus->number,
++ PCI_SLOT(devfn), PCI_FUNC(devfn), where);
++ bus->unsafe_warn = 1;
++ }
+
+ mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8));
+ tmp = readl(addr) & mask;
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index e6d60fa2217da..db778a25bae36 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -833,7 +833,7 @@ static void advk_msi_irq_compose_msi_msg(struct irq_data *data,
+
+ msg->address_lo = lower_32_bits(msi_msg);
+ msg->address_hi = upper_32_bits(msi_msg);
+- msg->data = data->irq;
++ msg->data = data->hwirq;
+ }
+
+ static int advk_msi_set_affinity(struct irq_data *irq_data,
+@@ -850,15 +850,11 @@ static int advk_msi_irq_domain_alloc(struct irq_domain *domain,
+ int hwirq, i;
+
+ mutex_lock(&pcie->msi_used_lock);
+- hwirq = bitmap_find_next_zero_area(pcie->msi_used, MSI_IRQ_NUM,
+- 0, nr_irqs, 0);
+- if (hwirq >= MSI_IRQ_NUM) {
+- mutex_unlock(&pcie->msi_used_lock);
+- return -ENOSPC;
+- }
+-
+- bitmap_set(pcie->msi_used, hwirq, nr_irqs);
++ hwirq = bitmap_find_free_region(pcie->msi_used, MSI_IRQ_NUM,
++ order_base_2(nr_irqs));
+ mutex_unlock(&pcie->msi_used_lock);
++ if (hwirq < 0)
++ return -ENOSPC;
+
+ for (i = 0; i < nr_irqs; i++)
+ irq_domain_set_info(domain, virq + i, hwirq + i,
+@@ -876,7 +872,7 @@ static void advk_msi_irq_domain_free(struct irq_domain *domain,
+ struct advk_pcie *pcie = domain->host_data;
+
+ mutex_lock(&pcie->msi_used_lock);
+- bitmap_clear(pcie->msi_used, d->hwirq, nr_irqs);
++ bitmap_release_region(pcie->msi_used, d->hwirq, order_base_2(nr_irqs));
+ mutex_unlock(&pcie->msi_used_lock);
+ }
+
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 53227232243f1..2795445233b3b 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -80,6 +80,8 @@ static int pcie_poll_cmd(struct controller *ctrl, int timeout)
+ if (slot_status & PCI_EXP_SLTSTA_CC) {
+ pcie_capability_write_word(pdev, PCI_EXP_SLTSTA,
+ PCI_EXP_SLTSTA_CC);
++ ctrl->cmd_busy = 0;
++ smp_mb();
+ return 1;
+ }
+ if (timeout < 0)
+@@ -969,6 +971,8 @@ static void quirk_cmd_compl(struct pci_dev *pdev)
+ }
+ DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID,
+ PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl);
++DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0110,
++ PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl);
+ DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0400,
+ PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl);
+ DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0401,
+diff --git a/drivers/perf/qcom_l2_pmu.c b/drivers/perf/qcom_l2_pmu.c
+index 842135cf35a3a..be6ac55e99af0 100644
+--- a/drivers/perf/qcom_l2_pmu.c
++++ b/drivers/perf/qcom_l2_pmu.c
+@@ -797,7 +797,7 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster(
+ {
+ u64 mpidr;
+ int cpu_cluster_id;
+- struct cluster_pmu *cluster = NULL;
++ struct cluster_pmu *cluster;
+
+ /*
+ * This assumes that the cluster_id is in MPIDR[aff1] for
+@@ -819,10 +819,10 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster(
+ cluster->cluster_id);
+ cpumask_set_cpu(cpu, &cluster->cluster_cpus);
+ *per_cpu_ptr(l2cache_pmu->pmu_cluster, cpu) = cluster;
+- break;
++ return cluster;
+ }
+
+- return cluster;
++ return NULL;
+ }
+
+ static int l2cache_pmu_online_cpu(unsigned int cpu, struct hlist_node *node)
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+index 16ff56f935017..64fa544ac8501 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+@@ -1046,6 +1046,7 @@ int mtk_pctrl_init(struct platform_device *pdev,
+ node = of_parse_phandle(np, "mediatek,pctl-regmap", 0);
+ if (node) {
+ pctl->regmap1 = syscon_node_to_regmap(node);
++ of_node_put(node);
+ if (IS_ERR(pctl->regmap1))
+ return PTR_ERR(pctl->regmap1);
+ } else if (regmap) {
+@@ -1059,6 +1060,7 @@ int mtk_pctrl_init(struct platform_device *pdev,
+ node = of_parse_phandle(np, "mediatek,pctl-regmap", 1);
+ if (node) {
+ pctl->regmap2 = syscon_node_to_regmap(node);
++ of_node_put(node);
+ if (IS_ERR(pctl->regmap2))
+ return PTR_ERR(pctl->regmap2);
+ }
+diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+index f0e7a8c114b22..415e913609945 100644
+--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+@@ -1916,8 +1916,10 @@ static int nmk_pinctrl_probe(struct platform_device *pdev)
+ }
+
+ prcm_np = of_parse_phandle(np, "prcm", 0);
+- if (prcm_np)
++ if (prcm_np) {
+ npct->prcm_base = of_iomap(prcm_np, 0);
++ of_node_put(prcm_np);
++ }
+ if (!npct->prcm_base) {
+ if (version == PINCTRL_NMK_STN8815) {
+ dev_info(&pdev->dev,
+diff --git a/drivers/pinctrl/pinconf-generic.c b/drivers/pinctrl/pinconf-generic.c
+index b4f7f8a458eaf..55b56440a5a89 100644
+--- a/drivers/pinctrl/pinconf-generic.c
++++ b/drivers/pinctrl/pinconf-generic.c
+@@ -31,10 +31,10 @@ static const struct pin_config_item conf_items[] = {
+ PCONFDUMP(PIN_CONFIG_BIAS_BUS_HOLD, "input bias bus hold", NULL, false),
+ PCONFDUMP(PIN_CONFIG_BIAS_DISABLE, "input bias disabled", NULL, false),
+ PCONFDUMP(PIN_CONFIG_BIAS_HIGH_IMPEDANCE, "input bias high impedance", NULL, false),
+- PCONFDUMP(PIN_CONFIG_BIAS_PULL_DOWN, "input bias pull down", NULL, false),
++ PCONFDUMP(PIN_CONFIG_BIAS_PULL_DOWN, "input bias pull down", "ohms", true),
+ PCONFDUMP(PIN_CONFIG_BIAS_PULL_PIN_DEFAULT,
+- "input bias pull to pin specific state", NULL, false),
+- PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", NULL, false),
++ "input bias pull to pin specific state", "ohms", true),
++ PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", "ohms", true),
+ PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_DRAIN, "output drive open drain", NULL, false),
+ PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_SOURCE, "output drive open source", NULL, false),
+ PCONFDUMP(PIN_CONFIG_DRIVE_PUSH_PULL, "output drive push pull", NULL, false),
+diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
+index d0d5b8bdbc105..dc405d7aa1b78 100644
+--- a/drivers/pinctrl/pinctrl-rockchip.c
++++ b/drivers/pinctrl/pinctrl-rockchip.c
+@@ -3400,6 +3400,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev)
+ node = of_parse_phandle(np, "rockchip,grf", 0);
+ if (node) {
+ info->regmap_base = syscon_node_to_regmap(node);
++ of_node_put(node);
+ if (IS_ERR(info->regmap_base))
+ return PTR_ERR(info->regmap_base);
+ } else {
+@@ -3436,6 +3437,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev)
+ node = of_parse_phandle(np, "rockchip,pmu", 0);
+ if (node) {
+ info->regmap_pmu = syscon_node_to_regmap(node);
++ of_node_put(node);
+ if (IS_ERR(info->regmap_pmu))
+ return PTR_ERR(info->regmap_pmu);
+ }
+diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
+index 82407e4a16427..41f953661dd62 100644
+--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
+@@ -1002,6 +1002,16 @@ samsung_pinctrl_get_soc_data_for_of_alias(struct platform_device *pdev)
+ return &(of_data->ctrl[id]);
+ }
+
++static void samsung_banks_of_node_put(struct samsung_pinctrl_drv_data *d)
++{
++ struct samsung_pin_bank *bank;
++ unsigned int i;
++
++ bank = d->pin_banks;
++ for (i = 0; i < d->nr_banks; ++i, ++bank)
++ of_node_put(bank->of_node);
++}
++
+ /* retrieve the soc specific data */
+ static const struct samsung_pin_ctrl *
+ samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
+@@ -1116,19 +1126,19 @@ static int samsung_pinctrl_probe(struct platform_device *pdev)
+ if (ctrl->retention_data) {
+ drvdata->retention_ctrl = ctrl->retention_data->init(drvdata,
+ ctrl->retention_data);
+- if (IS_ERR(drvdata->retention_ctrl))
+- return PTR_ERR(drvdata->retention_ctrl);
++ if (IS_ERR(drvdata->retention_ctrl)) {
++ ret = PTR_ERR(drvdata->retention_ctrl);
++ goto err_put_banks;
++ }
+ }
+
+ ret = samsung_pinctrl_register(pdev, drvdata);
+ if (ret)
+- return ret;
++ goto err_put_banks;
+
+ ret = samsung_gpiolib_register(pdev, drvdata);
+- if (ret) {
+- samsung_pinctrl_unregister(pdev, drvdata);
+- return ret;
+- }
++ if (ret)
++ goto err_unregister;
+
+ if (ctrl->eint_gpio_init)
+ ctrl->eint_gpio_init(drvdata);
+@@ -1138,6 +1148,12 @@ static int samsung_pinctrl_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, drvdata);
+
+ return 0;
++
++err_unregister:
++ samsung_pinctrl_unregister(pdev, drvdata);
++err_put_banks:
++ samsung_banks_of_node_put(drvdata);
++ return ret;
+ }
+
+ /**
+diff --git a/drivers/power/reset/gemini-poweroff.c b/drivers/power/reset/gemini-poweroff.c
+index 90e35c07240ae..b7f7a8225f22e 100644
+--- a/drivers/power/reset/gemini-poweroff.c
++++ b/drivers/power/reset/gemini-poweroff.c
+@@ -107,8 +107,8 @@ static int gemini_poweroff_probe(struct platform_device *pdev)
+ return PTR_ERR(gpw->base);
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq)
+- return -EINVAL;
++ if (irq < 0)
++ return irq;
+
+ gpw->dev = dev;
+
+diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
+index b0e77324b0167..675f9d0e8471e 100644
+--- a/drivers/power/supply/ab8500_fg.c
++++ b/drivers/power/supply/ab8500_fg.c
+@@ -2541,8 +2541,10 @@ static int ab8500_fg_sysfs_init(struct ab8500_fg *di)
+ ret = kobject_init_and_add(&di->fg_kobject,
+ &ab8500_fg_ktype,
+ NULL, "battery");
+- if (ret < 0)
++ if (ret < 0) {
++ kobject_put(&di->fg_kobject);
+ dev_err(di->dev, "failed to create sysfs entry\n");
++ }
+
+ return ret;
+ }
+diff --git a/drivers/power/supply/axp20x_battery.c b/drivers/power/supply/axp20x_battery.c
+index e84b6e4da14a8..9fda98b950bab 100644
+--- a/drivers/power/supply/axp20x_battery.c
++++ b/drivers/power/supply/axp20x_battery.c
+@@ -185,7 +185,6 @@ static int axp20x_battery_get_prop(struct power_supply *psy,
+ union power_supply_propval *val)
+ {
+ struct axp20x_batt_ps *axp20x_batt = power_supply_get_drvdata(psy);
+- struct iio_channel *chan;
+ int ret = 0, reg, val1;
+
+ switch (psp) {
+@@ -265,12 +264,12 @@ static int axp20x_battery_get_prop(struct power_supply *psy,
+ if (ret)
+ return ret;
+
+- if (reg & AXP20X_PWR_STATUS_BAT_CHARGING)
+- chan = axp20x_batt->batt_chrg_i;
+- else
+- chan = axp20x_batt->batt_dischrg_i;
+-
+- ret = iio_read_channel_processed(chan, &val->intval);
++ if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) {
++ ret = iio_read_channel_processed(axp20x_batt->batt_chrg_i, &val->intval);
++ } else {
++ ret = iio_read_channel_processed(axp20x_batt->batt_dischrg_i, &val1);
++ val->intval = -val1;
++ }
+ if (ret)
+ return ret;
+
+diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
+index 863208928cf0b..c830343be61e5 100644
+--- a/drivers/power/supply/bq24190_charger.c
++++ b/drivers/power/supply/bq24190_charger.c
+@@ -43,6 +43,7 @@
+ #define BQ24190_REG_POC_CHG_CONFIG_DISABLE 0x0
+ #define BQ24190_REG_POC_CHG_CONFIG_CHARGE 0x1
+ #define BQ24190_REG_POC_CHG_CONFIG_OTG 0x2
++#define BQ24190_REG_POC_CHG_CONFIG_OTG_ALT 0x3
+ #define BQ24190_REG_POC_SYS_MIN_MASK (BIT(3) | BIT(2) | BIT(1))
+ #define BQ24190_REG_POC_SYS_MIN_SHIFT 1
+ #define BQ24190_REG_POC_SYS_MIN_MIN 3000
+@@ -568,7 +569,11 @@ static int bq24190_vbus_is_enabled(struct regulator_dev *dev)
+ pm_runtime_mark_last_busy(bdi->dev);
+ pm_runtime_put_autosuspend(bdi->dev);
+
+- return ret ? ret : val == BQ24190_REG_POC_CHG_CONFIG_OTG;
++ if (ret)
++ return ret;
++
++ return (val == BQ24190_REG_POC_CHG_CONFIG_OTG ||
++ val == BQ24190_REG_POC_CHG_CONFIG_OTG_ALT);
+ }
+
+ static const struct regulator_ops bq24190_vbus_ops = {
+diff --git a/drivers/power/supply/wm8350_power.c b/drivers/power/supply/wm8350_power.c
+index 15c0ca15e2aa9..4fa42d4a8a40a 100644
+--- a/drivers/power/supply/wm8350_power.c
++++ b/drivers/power/supply/wm8350_power.c
+@@ -411,44 +411,112 @@ static const struct power_supply_desc wm8350_usb_desc = {
+ * Initialisation
+ *********************************************************************/
+
+-static void wm8350_init_charger(struct wm8350 *wm8350)
++static int wm8350_init_charger(struct wm8350 *wm8350)
+ {
++ int ret;
++
+ /* register our interest in charger events */
+- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT,
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT,
+ wm8350_charger_handler, 0, "Battery hot", wm8350);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD,
++ if (ret)
++ goto err;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD,
+ wm8350_charger_handler, 0, "Battery cold", wm8350);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL,
++ if (ret)
++ goto free_chg_bat_hot;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL,
+ wm8350_charger_handler, 0, "Battery fail", wm8350);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO,
++ if (ret)
++ goto free_chg_bat_cold;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO,
+ wm8350_charger_handler, 0,
+ "Charger timeout", wm8350);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END,
++ if (ret)
++ goto free_chg_bat_fail;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END,
+ wm8350_charger_handler, 0,
+ "Charge end", wm8350);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START,
++ if (ret)
++ goto free_chg_to;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START,
+ wm8350_charger_handler, 0,
+ "Charge start", wm8350);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY,
++ if (ret)
++ goto free_chg_end;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY,
+ wm8350_charger_handler, 0,
+ "Fast charge ready", wm8350);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9,
++ if (ret)
++ goto free_chg_start;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9,
+ wm8350_charger_handler, 0,
+ "Battery <3.9V", wm8350);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1,
++ if (ret)
++ goto free_chg_fast_rdy;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1,
+ wm8350_charger_handler, 0,
+ "Battery <3.1V", wm8350);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85,
++ if (ret)
++ goto free_chg_vbatt_lt_3p9;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85,
+ wm8350_charger_handler, 0,
+ "Battery <2.85V", wm8350);
++ if (ret)
++ goto free_chg_vbatt_lt_3p1;
+
+ /* and supply change events */
+- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB,
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB,
+ wm8350_charger_handler, 0, "USB", wm8350);
+- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB,
++ if (ret)
++ goto free_chg_vbatt_lt_2p85;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB,
+ wm8350_charger_handler, 0, "Wall", wm8350);
+- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB,
++ if (ret)
++ goto free_ext_usb_fb;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB,
+ wm8350_charger_handler, 0, "Battery", wm8350);
++ if (ret)
++ goto free_ext_wall_fb;
++
++ return 0;
++
++free_ext_wall_fb:
++ wm8350_free_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, wm8350);
++free_ext_usb_fb:
++ wm8350_free_irq(wm8350, WM8350_IRQ_EXT_USB_FB, wm8350);
++free_chg_vbatt_lt_2p85:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350);
++free_chg_vbatt_lt_3p1:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350);
++free_chg_vbatt_lt_3p9:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350);
++free_chg_fast_rdy:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350);
++free_chg_start:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350);
++free_chg_end:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350);
++free_chg_to:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350);
++free_chg_bat_fail:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, wm8350);
++free_chg_bat_cold:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, wm8350);
++free_chg_bat_hot:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, wm8350);
++err:
++ return ret;
+ }
+
+ static void free_charger_irq(struct wm8350 *wm8350)
+@@ -459,6 +527,7 @@ static void free_charger_irq(struct wm8350 *wm8350)
+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350);
+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350);
+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350);
++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350);
+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350);
+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350);
+ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350);
+diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c
+index 48401dfcd999a..f97a5eefa2e23 100644
+--- a/drivers/ptp/ptp_sysfs.c
++++ b/drivers/ptp/ptp_sysfs.c
+@@ -26,7 +26,7 @@ static ssize_t clock_name_show(struct device *dev,
+ struct device_attribute *attr, char *page)
+ {
+ struct ptp_clock *ptp = dev_get_drvdata(dev);
+- return snprintf(page, PAGE_SIZE-1, "%s\n", ptp->info->name);
++ return sysfs_emit(page, "%s\n", ptp->info->name);
+ }
+ static DEVICE_ATTR_RO(clock_name);
+
+@@ -240,7 +240,7 @@ static ssize_t ptp_pin_show(struct device *dev, struct device_attribute *attr,
+
+ mutex_unlock(&ptp->pincfg_mux);
+
+- return snprintf(page, PAGE_SIZE, "%u %u\n", func, chan);
++ return sysfs_emit(page, "%u %u\n", func, chan);
+ }
+
+ static ssize_t ptp_pin_store(struct device *dev, struct device_attribute *attr,
+diff --git a/drivers/pwm/pwm-lpc18xx-sct.c b/drivers/pwm/pwm-lpc18xx-sct.c
+index d7f5f7de030dd..8b3aad06e2360 100644
+--- a/drivers/pwm/pwm-lpc18xx-sct.c
++++ b/drivers/pwm/pwm-lpc18xx-sct.c
+@@ -406,12 +406,6 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev)
+ lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_LIMIT,
+ BIT(lpc18xx_pwm->period_event));
+
+- ret = pwmchip_add(&lpc18xx_pwm->chip);
+- if (ret < 0) {
+- dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret);
+- goto disable_pwmclk;
+- }
+-
+ for (i = 0; i < lpc18xx_pwm->chip.npwm; i++) {
+ struct lpc18xx_pwm_data *data;
+
+@@ -421,14 +415,12 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev)
+ GFP_KERNEL);
+ if (!data) {
+ ret = -ENOMEM;
+- goto remove_pwmchip;
++ goto disable_pwmclk;
+ }
+
+ pwm_set_chip_data(pwm, data);
+ }
+
+- platform_set_drvdata(pdev, lpc18xx_pwm);
+-
+ val = lpc18xx_pwm_readl(lpc18xx_pwm, LPC18XX_PWM_CTRL);
+ val &= ~LPC18XX_PWM_BIDIR;
+ val &= ~LPC18XX_PWM_CTRL_HALT;
+@@ -436,10 +428,16 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev)
+ val |= LPC18XX_PWM_PRE(0);
+ lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_CTRL, val);
+
++ ret = pwmchip_add(&lpc18xx_pwm->chip);
++ if (ret < 0) {
++ dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret);
++ goto disable_pwmclk;
++ }
++
++ platform_set_drvdata(pdev, lpc18xx_pwm);
++
+ return 0;
+
+-remove_pwmchip:
+- pwmchip_remove(&lpc18xx_pwm->chip);
+ disable_pwmclk:
+ clk_disable_unprepare(lpc18xx_pwm->pwm_clk);
+ return ret;
+diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
+index 8d920a3ad40b8..3c6d6afd419e3 100644
+--- a/drivers/regulator/qcom_smd-regulator.c
++++ b/drivers/regulator/qcom_smd-regulator.c
+@@ -751,8 +751,10 @@ static int rpm_reg_probe(struct platform_device *pdev)
+
+ for_each_available_child_of_node(dev->of_node, node) {
+ vreg = devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL);
+- if (!vreg)
++ if (!vreg) {
++ of_node_put(node);
+ return -ENOMEM;
++ }
+
+ ret = rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data);
+
+diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c
+index b0e07e9f42d56..6cc0f9a5533e0 100644
+--- a/drivers/remoteproc/qcom_wcnss.c
++++ b/drivers/remoteproc/qcom_wcnss.c
+@@ -448,6 +448,7 @@ static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss)
+ }
+
+ ret = of_address_to_resource(node, 0, &r);
++ of_node_put(node);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/rtc/rtc-wm8350.c b/drivers/rtc/rtc-wm8350.c
+index 483c7993516bb..ed874e5c5fc88 100644
+--- a/drivers/rtc/rtc-wm8350.c
++++ b/drivers/rtc/rtc-wm8350.c
+@@ -441,14 +441,21 @@ static int wm8350_rtc_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC,
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC,
+ wm8350_rtc_update_handler, 0,
+ "RTC Seconds", wm8350);
++ if (ret)
++ return ret;
++
+ wm8350_mask_irq(wm8350, WM8350_IRQ_RTC_SEC);
+
+- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM,
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM,
+ wm8350_rtc_alarm_handler, 0,
+ "RTC Alarm", wm8350);
++ if (ret) {
++ wm8350_free_irq(wm8350, WM8350_IRQ_RTC_SEC, wm8350);
++ return ret;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c
+index 4d7b0e0adbf70..2690098d44117 100644
+--- a/drivers/scsi/aha152x.c
++++ b/drivers/scsi/aha152x.c
+@@ -3379,13 +3379,11 @@ static int __init aha152x_setup(char *str)
+ setup[setup_count].synchronous = ints[0] >= 6 ? ints[6] : 1;
+ setup[setup_count].delay = ints[0] >= 7 ? ints[7] : DELAY_DEFAULT;
+ setup[setup_count].ext_trans = ints[0] >= 8 ? ints[8] : 0;
+- if (ints[0] > 8) { /*}*/
++ if (ints[0] > 8)
+ printk(KERN_NOTICE "aha152x: usage: aha152x=<IOBASE>[,<IRQ>[,<SCSI ID>"
+ "[,<RECONNECT>[,<PARITY>[,<SYNCHRONOUS>[,<DELAY>[,<EXT_TRANS>]]]]]]]\n");
+- } else {
++ else
+ setup_count++;
+- return 0;
+- }
+
+ return 1;
+ }
+diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c
+index 3b84290cf0a7e..eaab423a5fd09 100644
+--- a/drivers/scsi/bfa/bfad_attr.c
++++ b/drivers/scsi/bfa/bfad_attr.c
+@@ -719,7 +719,7 @@ bfad_im_serial_num_show(struct device *dev, struct device_attribute *attr,
+ char serial_num[BFA_ADAPTER_SERIAL_NUM_LEN];
+
+ bfa_get_adapter_serial_num(&bfad->bfa, serial_num);
+- return snprintf(buf, PAGE_SIZE, "%s\n", serial_num);
++ return sysfs_emit(buf, "%s\n", serial_num);
+ }
+
+ static ssize_t
+@@ -733,7 +733,7 @@ bfad_im_model_show(struct device *dev, struct device_attribute *attr,
+ char model[BFA_ADAPTER_MODEL_NAME_LEN];
+
+ bfa_get_adapter_model(&bfad->bfa, model);
+- return snprintf(buf, PAGE_SIZE, "%s\n", model);
++ return sysfs_emit(buf, "%s\n", model);
+ }
+
+ static ssize_t
+@@ -813,7 +813,7 @@ bfad_im_model_desc_show(struct device *dev, struct device_attribute *attr,
+ snprintf(model_descr, BFA_ADAPTER_MODEL_DESCR_LEN,
+ "Invalid Model");
+
+- return snprintf(buf, PAGE_SIZE, "%s\n", model_descr);
++ return sysfs_emit(buf, "%s\n", model_descr);
+ }
+
+ static ssize_t
+@@ -827,7 +827,7 @@ bfad_im_node_name_show(struct device *dev, struct device_attribute *attr,
+ u64 nwwn;
+
+ nwwn = bfa_fcs_lport_get_nwwn(port->fcs_port);
+- return snprintf(buf, PAGE_SIZE, "0x%llx\n", cpu_to_be64(nwwn));
++ return sysfs_emit(buf, "0x%llx\n", cpu_to_be64(nwwn));
+ }
+
+ static ssize_t
+@@ -844,7 +844,7 @@ bfad_im_symbolic_name_show(struct device *dev, struct device_attribute *attr,
+ bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr);
+ strlcpy(symname, port_attr.port_cfg.sym_name.symname,
+ BFA_SYMNAME_MAXLEN);
+- return snprintf(buf, PAGE_SIZE, "%s\n", symname);
++ return sysfs_emit(buf, "%s\n", symname);
+ }
+
+ static ssize_t
+@@ -858,14 +858,14 @@ bfad_im_hw_version_show(struct device *dev, struct device_attribute *attr,
+ char hw_ver[BFA_VERSION_LEN];
+
+ bfa_get_pci_chip_rev(&bfad->bfa, hw_ver);
+- return snprintf(buf, PAGE_SIZE, "%s\n", hw_ver);
++ return sysfs_emit(buf, "%s\n", hw_ver);
+ }
+
+ static ssize_t
+ bfad_im_drv_version_show(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_VERSION);
++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_VERSION);
+ }
+
+ static ssize_t
+@@ -879,7 +879,7 @@ bfad_im_optionrom_version_show(struct device *dev,
+ char optrom_ver[BFA_VERSION_LEN];
+
+ bfa_get_adapter_optrom_ver(&bfad->bfa, optrom_ver);
+- return snprintf(buf, PAGE_SIZE, "%s\n", optrom_ver);
++ return sysfs_emit(buf, "%s\n", optrom_ver);
+ }
+
+ static ssize_t
+@@ -893,7 +893,7 @@ bfad_im_fw_version_show(struct device *dev, struct device_attribute *attr,
+ char fw_ver[BFA_VERSION_LEN];
+
+ bfa_get_adapter_fw_ver(&bfad->bfa, fw_ver);
+- return snprintf(buf, PAGE_SIZE, "%s\n", fw_ver);
++ return sysfs_emit(buf, "%s\n", fw_ver);
+ }
+
+ static ssize_t
+@@ -905,7 +905,7 @@ bfad_im_num_of_ports_show(struct device *dev, struct device_attribute *attr,
+ (struct bfad_im_port_s *) shost->hostdata[0];
+ struct bfad_s *bfad = im_port->bfad;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n",
++ return sysfs_emit(buf, "%d\n",
+ bfa_get_nports(&bfad->bfa));
+ }
+
+@@ -913,7 +913,7 @@ static ssize_t
+ bfad_im_drv_name_show(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_NAME);
++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_NAME);
+ }
+
+ static ssize_t
+@@ -932,14 +932,14 @@ bfad_im_num_of_discovered_ports_show(struct device *dev,
+ rports = kcalloc(nrports, sizeof(struct bfa_rport_qualifier_s),
+ GFP_ATOMIC);
+ if (rports == NULL)
+- return snprintf(buf, PAGE_SIZE, "Failed\n");
++ return sysfs_emit(buf, "Failed\n");
+
+ spin_lock_irqsave(&bfad->bfad_lock, flags);
+ bfa_fcs_lport_get_rport_quals(port->fcs_port, rports, &nrports);
+ spin_unlock_irqrestore(&bfad->bfad_lock, flags);
+ kfree(rports);
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", nrports);
++ return sysfs_emit(buf, "%d\n", nrports);
+ }
+
+ static DEVICE_ATTR(serial_number, S_IRUGO,
+diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
+index 384458d1f73c3..9fa0aa235cb4c 100644
+--- a/drivers/scsi/libfc/fc_exch.c
++++ b/drivers/scsi/libfc/fc_exch.c
+@@ -1709,6 +1709,7 @@ static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp)
+ if (cancel_delayed_work_sync(&ep->timeout_work)) {
+ FC_EXCH_DBG(ep, "Exchange timer canceled due to ABTS response\n");
+ fc_exch_release(ep); /* release from pending timer hold */
++ return;
+ }
+
+ spin_lock_bh(&ep->ex_lock);
+diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
+index e032af6547334..685d7a16bcd4c 100644
+--- a/drivers/scsi/libsas/sas_ata.c
++++ b/drivers/scsi/libsas/sas_ata.c
+@@ -216,7 +216,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
+ task->total_xfer_len = qc->nbytes;
+ task->num_scatter = qc->n_elem;
+ task->data_dir = qc->dma_dir;
+- } else if (qc->tf.protocol == ATA_PROT_NODATA) {
++ } else if (!ata_is_data(qc->tf.protocol)) {
+ task->data_dir = DMA_NONE;
+ } else {
+ for_each_sg(qc->sg, sg, qc->n_elem, si)
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 98d6608068abd..9c48394ac68ab 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -729,7 +729,7 @@ static ssize_t
+ mvs_show_driver_version(struct device *cdev,
+ struct device_attribute *attr, char *buffer)
+ {
+- return snprintf(buffer, PAGE_SIZE, "%s\n", DRV_VERSION);
++ return sysfs_emit(buffer, "%s\n", DRV_VERSION);
+ }
+
+ static DEVICE_ATTR(driver_version,
+@@ -781,7 +781,7 @@ mvs_store_interrupt_coalescing(struct device *cdev,
+ static ssize_t mvs_show_interrupt_coalescing(struct device *cdev,
+ struct device_attribute *attr, char *buffer)
+ {
+- return snprintf(buffer, PAGE_SIZE, "%d\n", interrupt_coalescing);
++ return sysfs_emit(buffer, "%d\n", interrupt_coalescing);
+ }
+
+ static DEVICE_ATTR(interrupt_coalescing,
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 3e814c0469fbd..d532230c62f3e 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -1748,6 +1748,7 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha,
+ ccb->device = pm8001_ha_dev;
+ ccb->ccb_tag = ccb_tag;
+ ccb->task = task;
++ ccb->n_elem = 0;
+
+ circularQ = &pm8001_ha->inbnd_q_tbl[0];
+
+@@ -1810,6 +1811,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha,
+ ccb->device = pm8001_ha_dev;
+ ccb->ccb_tag = ccb_tag;
+ ccb->task = task;
++ ccb->n_elem = 0;
+ pm8001_ha_dev->id |= NCQ_READ_LOG_FLAG;
+ pm8001_ha_dev->id |= NCQ_2ND_RLE_FLAG;
+
+@@ -1826,7 +1828,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha,
+
+ sata_cmd.tag = cpu_to_le32(ccb_tag);
+ sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id);
+- sata_cmd.ncqtag_atap_dir_m |= ((0x1 << 7) | (0x5 << 9));
++ sata_cmd.ncqtag_atap_dir_m = cpu_to_le32((0x1 << 7) | (0x5 << 9));
+ memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis));
+
+ res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0);
+@@ -3775,12 +3777,11 @@ int pm8001_mpi_task_abort_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ mb();
+
+ if (pm8001_dev->id & NCQ_ABORT_ALL_FLAG) {
+- pm8001_tag_free(pm8001_ha, tag);
+ sas_free_task(t);
+- /* clear the flag */
+- pm8001_dev->id &= 0xBFFFFFFF;
+- } else
++ pm8001_dev->id &= ~NCQ_ABORT_ALL_FLAG;
++ } else {
+ t->task_done(t);
++ }
+
+ return 0;
+ }
+@@ -4727,7 +4728,7 @@ int pm8001_chip_ssp_tm_req(struct pm8001_hba_info *pm8001_ha,
+ memcpy(sspTMCmd.lun, task->ssp_task.LUN, 8);
+ sspTMCmd.tag = cpu_to_le32(ccb->ccb_tag);
+ if (pm8001_ha->chip_id != chip_8001)
+- sspTMCmd.ds_ads_m = 0x08;
++ sspTMCmd.ds_ads_m = cpu_to_le32(0x08);
+ circularQ = &pm8001_ha->inbnd_q_tbl[0];
+ ret = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sspTMCmd, 0);
+ return ret;
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index c63b5db435c59..d655f72db51d5 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -881,9 +881,11 @@ pm80xx_set_thermal_config(struct pm8001_hba_info *pm8001_ha)
+ else
+ page_code = THERMAL_PAGE_CODE_8H;
+
+- payload.cfg_pg[0] = (THERMAL_LOG_ENABLE << 9) |
+- (THERMAL_ENABLE << 8) | page_code;
+- payload.cfg_pg[1] = (LTEMPHIL << 24) | (RTEMPHIL << 8);
++ payload.cfg_pg[0] =
++ cpu_to_le32((THERMAL_LOG_ENABLE << 9) |
++ (THERMAL_ENABLE << 8) | page_code);
++ payload.cfg_pg[1] =
++ cpu_to_le32((LTEMPHIL << 24) | (RTEMPHIL << 8));
+
+ rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, 0);
+ if (rc)
+@@ -1435,6 +1437,7 @@ static void pm80xx_send_abort_all(struct pm8001_hba_info *pm8001_ha,
+ ccb->device = pm8001_ha_dev;
+ ccb->ccb_tag = ccb_tag;
+ ccb->task = task;
++ ccb->n_elem = 0;
+
+ circularQ = &pm8001_ha->inbnd_q_tbl[0];
+
+@@ -1516,7 +1519,7 @@ static void pm80xx_send_read_log(struct pm8001_hba_info *pm8001_ha,
+
+ sata_cmd.tag = cpu_to_le32(ccb_tag);
+ sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id);
+- sata_cmd.ncqtag_atap_dir_m_dad |= ((0x1 << 7) | (0x5 << 9));
++ sata_cmd.ncqtag_atap_dir_m_dad = cpu_to_le32(((0x1 << 7) | (0x5 << 9)));
+ memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis));
+
+ res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0);
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index 47835d26a9730..300ef2e2ae5a9 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -4655,4 +4655,8 @@ struct sff_8247_a0 {
+ #include "qla_gbl.h"
+ #include "qla_dbg.h"
+ #include "qla_inline.h"
++
++#define IS_SESSION_DELETED(_fcport) (_fcport->disc_state == DSC_DELETE_PEND || \
++ _fcport->disc_state == DSC_DELETED)
++
+ #endif
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index c3195d4c25e5c..ba695d6482090 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -691,8 +691,7 @@ qla2x00_rff_id(scsi_qla_host_t *vha, u8 type)
+ return (QLA_SUCCESS);
+ }
+
+- return qla_async_rffid(vha, &vha->d_id, qlt_rff_id(vha),
+- FC4_TYPE_FCP_SCSI);
++ return qla_async_rffid(vha, &vha->d_id, qlt_rff_id(vha), type);
+ }
+
+ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id,
+@@ -744,7 +743,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id,
+ ct_req->req.rff_id.port_id[1] = d_id->b.area;
+ ct_req->req.rff_id.port_id[2] = d_id->b.al_pa;
+ ct_req->req.rff_id.fc4_feature = fc4feature;
+- ct_req->req.rff_id.fc4_type = fc4type; /* SCSI - FCP */
++ ct_req->req.rff_id.fc4_type = fc4type; /* SCSI-FCP or FC-NVMe */
+
+ sp->u.iocb_cmd.u.ctarg.req_size = RFF_ID_REQ_SIZE;
+ sp->u.iocb_cmd.u.ctarg.rsp_size = RFF_ID_RSP_SIZE;
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 613e5467b4bc2..1e3169e3ccbf7 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -219,9 +219,9 @@ qla2x00_async_login(struct scsi_qla_host *vha, fc_port_t *fcport,
+ if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT) ||
+ fcport->loop_id == FC_NO_LOOP_ID) {
+ ql_log(ql_log_warn, vha, 0xffff,
+- "%s: %8phC - not sending command.\n",
+- __func__, fcport->port_name);
+- return rval;
++ "%s: %8phC online %d flags %x - not sending command.\n",
++ __func__, fcport->port_name, vha->flags.online, fcport->flags);
++ goto done;
+ }
+
+ sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
+@@ -891,6 +891,14 @@ int qla24xx_async_gnl(struct scsi_qla_host *vha, fc_port_t *fcport)
+ unsigned long flags;
+ u16 *mb;
+
++ if (IS_SESSION_DELETED(fcport)) {
++ ql_log(ql_log_warn, vha, 0xffff,
++ "%s: %8phC is being delete - not sending command.\n",
++ __func__, fcport->port_name);
++ fcport->flags &= ~FCF_ASYNC_ACTIVE;
++ return rval;
++ }
++
+ if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT))
+ return rval;
+
+@@ -1121,8 +1129,15 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt)
+ struct port_database_24xx *pd;
+ struct qla_hw_data *ha = vha->hw;
+
+- if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT) ||
+- fcport->loop_id == FC_NO_LOOP_ID) {
++ if (IS_SESSION_DELETED(fcport)) {
++ ql_log(ql_log_warn, vha, 0xffff,
++ "%s: %8phC is being delete - not sending command.\n",
++ __func__, fcport->port_name);
++ fcport->flags &= ~FCF_ASYNC_ACTIVE;
++ return rval;
++ }
++
++ if (!vha->flags.online || fcport->flags & FCF_ASYNC_SENT) {
+ ql_log(ql_log_warn, vha, 0xffff,
+ "%s: %8phC - not sending command.\n",
+ __func__, fcport->port_name);
+@@ -1331,7 +1346,8 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
+ fcport->login_gen, fcport->login_retry,
+ fcport->loop_id, fcport->scan_state);
+
+- if (fcport->scan_state != QLA_FCPORT_FOUND)
++ if (fcport->scan_state != QLA_FCPORT_FOUND ||
++ fcport->disc_state == DSC_DELETE_PEND)
+ return 0;
+
+ if ((fcport->loop_id != FC_NO_LOOP_ID) &&
+@@ -1350,7 +1366,7 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
+ if (vha->host->active_mode == MODE_TARGET)
+ return 0;
+
+- if (fcport->flags & FCF_ASYNC_SENT) {
++ if (fcport->flags & (FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE)) {
+ set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
+ return 0;
+ }
+@@ -3151,6 +3167,14 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha)
+ struct rsp_que *rsp = ha->rsp_q_map[0];
+ struct qla2xxx_fw_dump *fw_dump;
+
++ if (ha->fw_dump) {
++ ql_dbg(ql_dbg_init, vha, 0x00bd,
++ "Firmware dump already allocated.\n");
++ return;
++ }
++
++ ha->fw_dumped = 0;
++ ha->fw_dump_cap_flags = 0;
+ dump_size = fixed_size = mem_size = eft_size = fce_size = mq_size = 0;
+ req_q_size = rsp_q_size = 0;
+
+@@ -8709,7 +8733,7 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos,
+ qpair->rsp->req = qpair->req;
+ qpair->rsp->qpair = qpair;
+ /* init qpair to this cpu. Will adjust at run time. */
+- qla_cpu_update(qpair, smp_processor_id());
++ qla_cpu_update(qpair, raw_smp_processor_id());
+
+ if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) {
+ if (ha->fw_attributes & BIT_4)
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index f9b3151f4b10d..9c7af5e1dfb07 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -1819,6 +1819,7 @@ qla24xx_tm_iocb_entry(scsi_qla_host_t *vha, struct req_que *req, void *tsk)
+ iocb->u.tmf.data = QLA_FUNCTION_FAILED;
+ } else if ((le16_to_cpu(sts->scsi_status) &
+ SS_RESPONSE_INFO_LEN_VALID)) {
++ host_to_fcp_swap(sts->data, sizeof(sts->data));
+ if (le32_to_cpu(sts->rsp_data_len) < 4) {
+ ql_log(ql_log_warn, fcport->vha, 0x503b,
+ "Async-%s error - hdl=%x not enough response(%d).\n",
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 5fbac85d7adfb..09c52ef66887a 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -3216,6 +3216,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n",
+ vha->flags.online, qla2x00_reset_active(vha),
+ cmd->reset_count, qpair->chip_reset);
++ res = 0;
+ goto out_unmap_unlock;
+ }
+
+diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c
+index aff31991aea98..ee6d974738532 100644
+--- a/drivers/scsi/zorro7xx.c
++++ b/drivers/scsi/zorro7xx.c
+@@ -158,6 +158,8 @@ static void zorro7xx_remove_one(struct zorro_dev *z)
+ scsi_remove_host(host);
+
+ NCR_700_release(host);
++ if (host->base > 0x01000000)
++ iounmap(hostdata->base);
+ kfree(hostdata);
+ free_irq(host->irq, host);
+ zorro_release_device(z);
+diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c
+index c1fda6acb670a..8358b97505db2 100644
+--- a/drivers/soc/ti/wkup_m3_ipc.c
++++ b/drivers/soc/ti/wkup_m3_ipc.c
+@@ -454,9 +454,9 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev)
+ }
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq) {
++ if (irq < 0) {
+ dev_err(&pdev->dev, "no irq resource\n");
+- return -ENXIO;
++ return irq;
+ }
+
+ ret = devm_request_irq(dev, irq, wkup_m3_txev_handler,
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 82c24c85f45bc..3f291db7b39a0 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -970,7 +970,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem,
+ addr = op->addr.val;
+ len = op->data.nbytes;
+
+- if (bcm_qspi_bspi_ver_three(qspi) == true) {
++ if (has_bspi(qspi) && bcm_qspi_bspi_ver_three(qspi) == true) {
+ /*
+ * The address coming into this function is a raw flash offset.
+ * But for BSPI <= V3, we need to convert it to a remapped BSPI
+@@ -989,7 +989,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem,
+ len < 4)
+ mspi_read = true;
+
+- if (mspi_read)
++ if (!has_bspi(qspi) || mspi_read)
+ return bcm_qspi_mspi_exec_mem_op(spi, op);
+
+ ret = bcm_qspi_bspi_set_mode(qspi, op, 0);
+diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
+index 1736a48bbccec..54e316eb08913 100644
+--- a/drivers/spi/spi-pxa2xx-pci.c
++++ b/drivers/spi/spi-pxa2xx-pci.c
+@@ -72,14 +72,23 @@ static bool lpss_dma_filter(struct dma_chan *chan, void *param)
+ return true;
+ }
+
++static void lpss_dma_put_device(void *dma_dev)
++{
++ pci_dev_put(dma_dev);
++}
++
+ static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+ {
+ struct pci_dev *dma_dev;
++ int ret;
+
+ c->num_chipselect = 1;
+ c->max_clk_rate = 50000000;
+
+ dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
++ ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev);
++ if (ret)
++ return ret;
+
+ if (c->tx_param) {
+ struct dw_dma_slave *slave = c->tx_param;
+@@ -103,8 +112,9 @@ static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+
+ static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+ {
+- struct pci_dev *dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0));
+ struct dw_dma_slave *tx, *rx;
++ struct pci_dev *dma_dev;
++ int ret;
+
+ switch (PCI_FUNC(dev->devfn)) {
+ case 0:
+@@ -129,6 +139,11 @@ static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c)
+ return -ENODEV;
+ }
+
++ dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0));
++ ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev);
++ if (ret)
++ return ret;
++
+ tx = c->tx_param;
+ tx->dma_dev = &dma_dev->dev;
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index c510b53e5e3f5..a8264f880b761 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -1136,6 +1136,10 @@ static int tegra_spi_probe(struct platform_device *pdev)
+ tspi->phys = r->start;
+
+ spi_irq = platform_get_irq(pdev, 0);
++ if (spi_irq < 0) {
++ ret = spi_irq;
++ goto exit_free_master;
++ }
+ tspi->irq = spi_irq;
+
+ tspi->clk = devm_clk_get(&pdev->dev, "spi");
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index bc3097e5cc261..436d559503db1 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -1016,14 +1016,8 @@ static int tegra_slink_probe(struct platform_device *pdev)
+ struct resource *r;
+ int ret, spi_irq;
+ const struct tegra_slink_chip_data *cdata = NULL;
+- const struct of_device_id *match;
+
+- match = of_match_device(tegra_slink_of_match, &pdev->dev);
+- if (!match) {
+- dev_err(&pdev->dev, "Error: No device match found\n");
+- return -ENODEV;
+- }
+- cdata = match->data;
++ cdata = of_device_get_match_data(&pdev->dev);
+
+ master = spi_alloc_master(&pdev->dev, sizeof(*tspi));
+ if (!master) {
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 49f592e433a8d..3bcd6f178f73b 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -779,10 +779,10 @@ int spi_map_buf(struct spi_controller *ctlr, struct device *dev,
+ int i, ret;
+
+ if (vmalloced_buf || kmap_buf) {
+- desc_len = min_t(int, max_seg_size, PAGE_SIZE);
++ desc_len = min_t(unsigned long, max_seg_size, PAGE_SIZE);
+ sgs = DIV_ROUND_UP(len + offset_in_page(buf), desc_len);
+ } else if (virt_addr_valid(buf)) {
+- desc_len = min_t(int, max_seg_size, ctlr->max_dma_len);
++ desc_len = min_t(size_t, max_seg_size, ctlr->max_dma_len);
+ sgs = DIV_ROUND_UP(len, desc_len);
+ } else {
+ return -EINVAL;
+diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c
+index 6a48ad067a8bd..15422d82f8120 100644
+--- a/drivers/staging/iio/adc/ad7280a.c
++++ b/drivers/staging/iio/adc/ad7280a.c
+@@ -102,9 +102,9 @@
+ static unsigned int ad7280a_devaddr(unsigned int addr)
+ {
+ return ((addr & 0x1) << 4) |
+- ((addr & 0x2) << 3) |
++ ((addr & 0x2) << 2) |
+ (addr & 0x4) |
+- ((addr & 0x8) >> 3) |
++ ((addr & 0x8) >> 2) |
+ ((addr & 0x10) >> 4);
+ }
+
+diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c
+index 77967da5d4061..68393c3c103ad 100644
+--- a/drivers/thermal/int340x_thermal/int3400_thermal.c
++++ b/drivers/thermal/int340x_thermal/int3400_thermal.c
+@@ -53,7 +53,7 @@ struct int3400_thermal_priv {
+ struct art *arts;
+ int trt_count;
+ struct trt *trts;
+- u8 uuid_bitmap;
++ u32 uuid_bitmap;
+ int rel_misc_dev_res;
+ int current_uuid_index;
+ };
+diff --git a/drivers/tty/hvc/hvc_iucv.c b/drivers/tty/hvc/hvc_iucv.c
+index 2af1e5751bd63..796fbff623f6e 100644
+--- a/drivers/tty/hvc/hvc_iucv.c
++++ b/drivers/tty/hvc/hvc_iucv.c
+@@ -1470,7 +1470,9 @@ out_error:
+ */
+ static int __init hvc_iucv_config(char *val)
+ {
+- return kstrtoul(val, 10, &hvc_iucv_devices);
++ if (kstrtoul(val, 10, &hvc_iucv_devices))
++ pr_warn("hvc_iucv= invalid parameter value '%s'\n", val);
++ return 1;
+ }
+
+
+diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
+index 8bc15cb67a58b..88eb90361a89c 100644
+--- a/drivers/tty/mxser.c
++++ b/drivers/tty/mxser.c
+@@ -861,6 +861,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+ struct mxser_port *info = container_of(port, struct mxser_port, port);
+ unsigned long page;
+ unsigned long flags;
++ int ret;
+
+ page = __get_free_page(GFP_KERNEL);
+ if (!page)
+@@ -870,9 +871,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+
+ if (!info->ioaddr || !info->type) {
+ set_bit(TTY_IO_ERROR, &tty->flags);
+- free_page(page);
+ spin_unlock_irqrestore(&info->slock, flags);
+- return 0;
++ ret = 0;
++ goto err_free_xmit;
+ }
+ info->port.xmit_buf = (unsigned char *) page;
+
+@@ -898,8 +899,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+ if (capable(CAP_SYS_ADMIN)) {
+ set_bit(TTY_IO_ERROR, &tty->flags);
+ return 0;
+- } else
+- return -ENODEV;
++ }
++
++ ret = -ENODEV;
++ goto err_free_xmit;
+ }
+
+ /*
+@@ -944,6 +947,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
+ spin_unlock_irqrestore(&info->slock, flags);
+
+ return 0;
++err_free_xmit:
++ free_page(page);
++ info->port.xmit_buf = NULL;
++ return ret;
+ }
+
+ /*
+diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c
+index efa0515139f8e..e6c1791609ddf 100644
+--- a/drivers/tty/serial/8250/8250_mid.c
++++ b/drivers/tty/serial/8250/8250_mid.c
+@@ -73,6 +73,11 @@ static int pnw_setup(struct mid8250 *mid, struct uart_port *p)
+ return 0;
+ }
+
++static void pnw_exit(struct mid8250 *mid)
++{
++ pci_dev_put(mid->dma_dev);
++}
++
+ static int tng_handle_irq(struct uart_port *p)
+ {
+ struct mid8250 *mid = p->private_data;
+@@ -124,6 +129,11 @@ static int tng_setup(struct mid8250 *mid, struct uart_port *p)
+ return 0;
+ }
+
++static void tng_exit(struct mid8250 *mid)
++{
++ pci_dev_put(mid->dma_dev);
++}
++
+ static int dnv_handle_irq(struct uart_port *p)
+ {
+ struct mid8250 *mid = p->private_data;
+@@ -330,9 +340,9 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ pci_set_drvdata(pdev, mid);
+ return 0;
++
+ err:
+- if (mid->board->exit)
+- mid->board->exit(mid);
++ mid->board->exit(mid);
+ return ret;
+ }
+
+@@ -342,8 +352,7 @@ static void mid8250_remove(struct pci_dev *pdev)
+
+ serial8250_unregister_port(mid->line);
+
+- if (mid->board->exit)
+- mid->board->exit(mid);
++ mid->board->exit(mid);
+ }
+
+ static const struct mid8250_board pnw_board = {
+@@ -351,6 +360,7 @@ static const struct mid8250_board pnw_board = {
+ .freq = 50000000,
+ .base_baud = 115200,
+ .setup = pnw_setup,
++ .exit = pnw_exit,
+ };
+
+ static const struct mid8250_board tng_board = {
+@@ -358,6 +368,7 @@ static const struct mid8250_board tng_board = {
+ .freq = 38400000,
+ .base_baud = 1843200,
+ .setup = tng_setup,
++ .exit = tng_exit,
+ };
+
+ static const struct mid8250_board dnv_board = {
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 39e821d6e5376..5ec50ccfbec95 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1594,6 +1594,18 @@ static inline void start_tx_rs485(struct uart_port *port)
+ if (!(up->port.rs485.flags & SER_RS485_RX_DURING_TX))
+ serial8250_stop_rx(&up->port);
+
++ /*
++ * While serial8250_em485_handle_stop_tx() is a noop if
++ * em485->active_timer != &em485->stop_tx_timer, it might happen that
++ * the timer is still armed and triggers only after the current bunch of
++ * chars is send and em485->active_timer == &em485->stop_tx_timer again.
++ * So cancel the timer. There is still a theoretical race condition if
++ * the timer is already running and only comes around to check for
++ * em485->active_timer when &em485->stop_tx_timer is armed again.
++ */
++ if (em485->active_timer == &em485->stop_tx_timer)
++ hrtimer_try_to_cancel(&em485->stop_tx_timer);
++
+ em485->active_timer = NULL;
+
+ mcr = serial8250_in_MCR(up);
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index b0aa864f84a97..6e81d782d8a00 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -302,16 +302,16 @@ static int kgdboc_option_setup(char *opt)
+ {
+ if (!opt) {
+ pr_err("config string not provided\n");
+- return -EINVAL;
++ return 1;
+ }
+
+ if (strlen(opt) >= MAX_CONFIG_LEN) {
+ pr_err("config string too long\n");
+- return -ENOSPC;
++ return 1;
+ }
+ strcpy(config, opt);
+
+- return 0;
++ return 1;
+ }
+
+ __setup("kgdboc=", kgdboc_option_setup);
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index 1528a7ba2bf4d..49661cef54693 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -761,11 +761,8 @@ static irqreturn_t s3c24xx_serial_tx_chars(int irq, void *id)
+ goto out;
+ }
+
+- if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) {
+- spin_unlock(&port->lock);
++ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(port);
+- spin_lock(&port->lock);
+- }
+
+ if (uart_circ_empty(xmit))
+ s3c24xx_serial_stop_tx(port);
+diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
+index 0dfb710f48b5e..0b800bc6150d4 100644
+--- a/drivers/usb/dwc3/dwc3-omap.c
++++ b/drivers/usb/dwc3/dwc3-omap.c
+@@ -237,7 +237,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap,
+ break;
+
+ case OMAP_DWC3_ID_FLOAT:
+- if (omap->vbus_reg)
++ if (omap->vbus_reg && regulator_is_enabled(omap->vbus_reg))
+ regulator_disable(omap->vbus_reg);
+ val = dwc3_omap_read_utmi_ctrl(omap);
+ val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG;
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index 56e6fd0f04829..42ace9f92ce92 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -21,6 +21,9 @@ static const char hcd_name[] = "ehci-pci";
+ /* defined here to avoid adding to pci_ids.h for single instance use */
+ #define PCI_DEVICE_ID_INTEL_CE4100_USB 0x2e70
+
++#define PCI_VENDOR_ID_ASPEED 0x1a03
++#define PCI_DEVICE_ID_ASPEED_EHCI 0x2603
++
+ /*-------------------------------------------------------------------------*/
+ #define PCI_DEVICE_ID_INTEL_QUARK_X1000_SOC 0x0939
+ static inline bool is_intel_quark_x1000(struct pci_dev *pdev)
+@@ -223,6 +226,12 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
+ ehci->has_synopsys_hc_bug = 1;
+ }
+ break;
++ case PCI_VENDOR_ID_ASPEED:
++ if (pdev->device == PCI_DEVICE_ID_ASPEED_EHCI) {
++ ehci_info(ehci, "applying Aspeed HC workaround\n");
++ ehci->is_aspeed = 1;
++ }
++ break;
+ }
+
+ /* optional debug port, normally in the first BAR */
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index cf5af8592f3d8..1bb48e53449e6 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -670,7 +670,7 @@ static int xhci_exit_test_mode(struct xhci_hcd *xhci)
+ }
+ pm_runtime_allow(xhci_to_hcd(xhci)->self.controller);
+ xhci->test_mode = 0;
+- return xhci_reset(xhci);
++ return xhci_reset(xhci, XHCI_RESET_SHORT_USEC);
+ }
+
+ void xhci_set_link_state(struct xhci_hcd *xhci, struct xhci_port *port,
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index fb47caf929de5..798823ce2b34f 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -2595,7 +2595,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
+
+ fail:
+ xhci_halt(xhci);
+- xhci_reset(xhci);
++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC);
+ xhci_mem_cleanup(xhci);
+ return -ENOMEM;
+ }
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 353a57f515223..ab255144e5a70 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -66,7 +66,7 @@ static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring)
+ * handshake done). There are two failure modes: "usec" have passed (major
+ * hardware flakeout), or the register reads as all-ones (hardware removed).
+ */
+-int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec)
++int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us)
+ {
+ u32 result;
+ int ret;
+@@ -74,7 +74,7 @@ int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec)
+ ret = readl_poll_timeout_atomic(ptr, result,
+ (result & mask) == done ||
+ result == U32_MAX,
+- 1, usec);
++ 1, timeout_us);
+ if (result == U32_MAX) /* card removed */
+ return -ENODEV;
+
+@@ -163,7 +163,7 @@ int xhci_start(struct xhci_hcd *xhci)
+ * Transactions will be terminated immediately, and operational registers
+ * will be set to their defaults.
+ */
+-int xhci_reset(struct xhci_hcd *xhci)
++int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us)
+ {
+ u32 command;
+ u32 state;
+@@ -196,8 +196,7 @@ int xhci_reset(struct xhci_hcd *xhci)
+ if (xhci->quirks & XHCI_INTEL_HOST)
+ udelay(1000);
+
+- ret = xhci_handshake(&xhci->op_regs->command,
+- CMD_RESET, 0, 10 * 1000 * 1000);
++ ret = xhci_handshake(&xhci->op_regs->command, CMD_RESET, 0, timeout_us);
+ if (ret)
+ return ret;
+
+@@ -210,8 +209,7 @@ int xhci_reset(struct xhci_hcd *xhci)
+ * xHCI cannot write to any doorbells or operational registers other
+ * than status until the "Controller Not Ready" flag is cleared.
+ */
+- ret = xhci_handshake(&xhci->op_regs->status,
+- STS_CNR, 0, 10 * 1000 * 1000);
++ ret = xhci_handshake(&xhci->op_regs->status, STS_CNR, 0, timeout_us);
+
+ for (i = 0; i < 2; i++) {
+ xhci->bus_state[i].port_c_suspend = 0;
+@@ -731,7 +729,7 @@ static void xhci_stop(struct usb_hcd *hcd)
+ xhci->xhc_state |= XHCI_STATE_HALTED;
+ xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
+ xhci_halt(xhci);
+- xhci_reset(xhci);
++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC);
+ spin_unlock_irq(&xhci->lock);
+
+ xhci_cleanup_msix(xhci);
+@@ -784,7 +782,7 @@ void xhci_shutdown(struct usb_hcd *hcd)
+ xhci_halt(xhci);
+ /* Workaround for spurious wakeups at shutdown with HSW */
+ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+- xhci_reset(xhci);
++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC);
+ spin_unlock_irq(&xhci->lock);
+
+ xhci_cleanup_msix(xhci);
+@@ -1162,7 +1160,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ xhci_dbg(xhci, "Stop HCD\n");
+ xhci_halt(xhci);
+ xhci_zero_64b_regs(xhci);
+- retval = xhci_reset(xhci);
++ retval = xhci_reset(xhci, XHCI_RESET_LONG_USEC);
+ spin_unlock_irq(&xhci->lock);
+ if (retval)
+ return retval;
+@@ -5190,7 +5188,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+
+ xhci_dbg(xhci, "Resetting HCD\n");
+ /* Reset the internal HC memory state and registers. */
+- retval = xhci_reset(xhci);
++ retval = xhci_reset(xhci, XHCI_RESET_LONG_USEC);
+ if (retval)
+ return retval;
+ xhci_dbg(xhci, "Reset complete\n");
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index dfc914713704f..3e6cb257fde5a 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -226,6 +226,9 @@ struct xhci_op_regs {
+ #define CMD_ETE (1 << 14)
+ /* bits 15:31 are reserved (and should be preserved on writes). */
+
++#define XHCI_RESET_LONG_USEC (10 * 1000 * 1000)
++#define XHCI_RESET_SHORT_USEC (250 * 1000)
++
+ /* IMAN - Interrupt Management Register */
+ #define IMAN_IE (1 << 1)
+ #define IMAN_IP (1 << 0)
+@@ -2057,11 +2060,11 @@ void xhci_free_container_ctx(struct xhci_hcd *xhci,
+
+ /* xHCI host controller glue */
+ typedef void (*xhci_get_quirks_t)(struct device *, struct xhci_hcd *);
+-int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec);
++int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us);
+ void xhci_quiesce(struct xhci_hcd *xhci);
+ int xhci_halt(struct xhci_hcd *xhci);
+ int xhci_start(struct xhci_hcd *xhci);
+-int xhci_reset(struct xhci_hcd *xhci);
++int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us);
+ int xhci_run(struct usb_hcd *hcd);
+ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks);
+ void xhci_shutdown(struct usb_hcd *hcd);
+diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
+index 533f127c30ad8..22fe96d5d1493 100644
+--- a/drivers/usb/serial/Kconfig
++++ b/drivers/usb/serial/Kconfig
+@@ -65,6 +65,7 @@ config USB_SERIAL_SIMPLE
+ - Libtransistor USB console
+ - a number of Motorola phones
+ - Motorola Tetra devices
++ - Nokia mobile phones
+ - Novatel Wireless GPS receivers
+ - Siemens USB/MPI adapter.
+ - ViVOtech ViVOpay USB device.
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 7df0fbede21bc..2e8cb6d8ba41f 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -110,6 +110,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530GC_PRODUCT_ID) },
+ { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
+ { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) },
++ { USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 3e5442573fe4e..15f746e977a71 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -29,6 +29,9 @@
+ #define ATEN_PRODUCT_UC232B 0x2022
+ #define ATEN_PRODUCT_ID2 0x2118
+
++#define IBM_VENDOR_ID 0x04b3
++#define IBM_PRODUCT_ID 0x4016
++
+ #define IODATA_VENDOR_ID 0x04bb
+ #define IODATA_PRODUCT_ID 0x0a03
+ #define IODATA_PRODUCT_ID_RSAQ5 0x0a0e
+diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
+index bd23a7cb1be2b..4c6747889a194 100644
+--- a/drivers/usb/serial/usb-serial-simple.c
++++ b/drivers/usb/serial/usb-serial-simple.c
+@@ -91,6 +91,11 @@ DEVICE(moto_modem, MOTO_IDS);
+ { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */
+ DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS);
+
++/* Nokia mobile phone driver */
++#define NOKIA_IDS() \
++ { USB_DEVICE(0x0421, 0x069a) } /* Nokia 130 (RM-1035) */
++DEVICE(nokia, NOKIA_IDS);
++
+ /* Novatel Wireless GPS driver */
+ #define NOVATEL_IDS() \
+ { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */
+@@ -123,6 +128,7 @@ static struct usb_serial_driver * const serial_drivers[] = {
+ &vivopay_device,
+ &moto_modem_device,
+ &motorola_tetra_device,
++ &nokia_device,
+ &novatel_gps_device,
+ &hp4x_device,
+ &suunto_device,
+@@ -140,6 +146,7 @@ static const struct usb_device_id id_table[] = {
+ VIVOPAY_IDS(),
+ MOTO_IDS(),
+ MOTOROLA_TETRA_IDS(),
++ NOKIA_IDS(),
+ NOVATEL_IDS(),
+ HP4X_IDS(),
+ SUUNTO_IDS(),
+diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
+index 4d261e4de9ad3..54679679c825d 100644
+--- a/drivers/usb/storage/ene_ub6250.c
++++ b/drivers/usb/storage/ene_ub6250.c
+@@ -236,36 +236,33 @@ static struct us_unusual_dev ene_ub6250_unusual_dev_list[] = {
+ #define memstick_logaddr(logadr1, logadr0) ((((u16)(logadr1)) << 8) | (logadr0))
+
+
+-struct SD_STATUS {
+- u8 Insert:1;
+- u8 Ready:1;
+- u8 MediaChange:1;
+- u8 IsMMC:1;
+- u8 HiCapacity:1;
+- u8 HiSpeed:1;
+- u8 WtP:1;
+- u8 Reserved:1;
+-};
+-
+-struct MS_STATUS {
+- u8 Insert:1;
+- u8 Ready:1;
+- u8 MediaChange:1;
+- u8 IsMSPro:1;
+- u8 IsMSPHG:1;
+- u8 Reserved1:1;
+- u8 WtP:1;
+- u8 Reserved2:1;
+-};
+-
+-struct SM_STATUS {
+- u8 Insert:1;
+- u8 Ready:1;
+- u8 MediaChange:1;
+- u8 Reserved:3;
+- u8 WtP:1;
+- u8 IsMS:1;
+-};
++/* SD_STATUS bits */
++#define SD_Insert BIT(0)
++#define SD_Ready BIT(1)
++#define SD_MediaChange BIT(2)
++#define SD_IsMMC BIT(3)
++#define SD_HiCapacity BIT(4)
++#define SD_HiSpeed BIT(5)
++#define SD_WtP BIT(6)
++ /* Bit 7 reserved */
++
++/* MS_STATUS bits */
++#define MS_Insert BIT(0)
++#define MS_Ready BIT(1)
++#define MS_MediaChange BIT(2)
++#define MS_IsMSPro BIT(3)
++#define MS_IsMSPHG BIT(4)
++ /* Bit 5 reserved */
++#define MS_WtP BIT(6)
++ /* Bit 7 reserved */
++
++/* SM_STATUS bits */
++#define SM_Insert BIT(0)
++#define SM_Ready BIT(1)
++#define SM_MediaChange BIT(2)
++ /* Bits 3-5 reserved */
++#define SM_WtP BIT(6)
++#define SM_IsMS BIT(7)
+
+ struct ms_bootblock_cis {
+ u8 bCistplDEVICE[6]; /* 0 */
+@@ -436,9 +433,9 @@ struct ene_ub6250_info {
+ u8 *bbuf;
+
+ /* for 6250 code */
+- struct SD_STATUS SD_Status;
+- struct MS_STATUS MS_Status;
+- struct SM_STATUS SM_Status;
++ u8 SD_Status;
++ u8 MS_Status;
++ u8 SM_Status;
+
+ /* ----- SD Control Data ---------------- */
+ /*SD_REGISTER SD_Regs; */
+@@ -601,7 +598,7 @@ static int sd_scsi_test_unit_ready(struct us_data *us, struct scsi_cmnd *srb)
+ {
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+
+- if (info->SD_Status.Insert && info->SD_Status.Ready)
++ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready))
+ return USB_STOR_TRANSPORT_GOOD;
+ else {
+ ene_sd_init(us);
+@@ -621,7 +618,7 @@ static int sd_scsi_mode_sense(struct us_data *us, struct scsi_cmnd *srb)
+ 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00,
+ 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 };
+
+- if (info->SD_Status.WtP)
++ if (info->SD_Status & SD_WtP)
+ usb_stor_set_xfer_buf(mediaWP, 12, srb);
+ else
+ usb_stor_set_xfer_buf(mediaNoWP, 12, srb);
+@@ -640,9 +637,9 @@ static int sd_scsi_read_capacity(struct us_data *us, struct scsi_cmnd *srb)
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+
+ usb_stor_dbg(us, "sd_scsi_read_capacity\n");
+- if (info->SD_Status.HiCapacity) {
++ if (info->SD_Status & SD_HiCapacity) {
+ bl_len = 0x200;
+- if (info->SD_Status.IsMMC)
++ if (info->SD_Status & SD_IsMMC)
+ bl_num = info->HC_C_SIZE-1;
+ else
+ bl_num = (info->HC_C_SIZE + 1) * 1024 - 1;
+@@ -692,7 +689,7 @@ static int sd_scsi_read(struct us_data *us, struct scsi_cmnd *srb)
+ return USB_STOR_TRANSPORT_ERROR;
+ }
+
+- if (info->SD_Status.HiCapacity)
++ if (info->SD_Status & SD_HiCapacity)
+ bnByte = bn;
+
+ /* set up the command wrapper */
+@@ -732,7 +729,7 @@ static int sd_scsi_write(struct us_data *us, struct scsi_cmnd *srb)
+ return USB_STOR_TRANSPORT_ERROR;
+ }
+
+- if (info->SD_Status.HiCapacity)
++ if (info->SD_Status & SD_HiCapacity)
+ bnByte = bn;
+
+ /* set up the command wrapper */
+@@ -1454,7 +1451,7 @@ static int ms_scsi_test_unit_ready(struct us_data *us, struct scsi_cmnd *srb)
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra);
+
+ /* pr_info("MS_SCSI_Test_Unit_Ready\n"); */
+- if (info->MS_Status.Insert && info->MS_Status.Ready) {
++ if ((info->MS_Status & MS_Insert) && (info->MS_Status & MS_Ready)) {
+ return USB_STOR_TRANSPORT_GOOD;
+ } else {
+ ene_ms_init(us);
+@@ -1474,7 +1471,7 @@ static int ms_scsi_mode_sense(struct us_data *us, struct scsi_cmnd *srb)
+ 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00,
+ 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 };
+
+- if (info->MS_Status.WtP)
++ if (info->MS_Status & MS_WtP)
+ usb_stor_set_xfer_buf(mediaWP, 12, srb);
+ else
+ usb_stor_set_xfer_buf(mediaNoWP, 12, srb);
+@@ -1493,7 +1490,7 @@ static int ms_scsi_read_capacity(struct us_data *us, struct scsi_cmnd *srb)
+
+ usb_stor_dbg(us, "ms_scsi_read_capacity\n");
+ bl_len = 0x200;
+- if (info->MS_Status.IsMSPro)
++ if (info->MS_Status & MS_IsMSPro)
+ bl_num = info->MSP_TotalBlock - 1;
+ else
+ bl_num = info->MS_Lib.NumberOfLogBlock * info->MS_Lib.blockSize * 2 - 1;
+@@ -1648,7 +1645,7 @@ static int ms_scsi_read(struct us_data *us, struct scsi_cmnd *srb)
+ if (bn > info->bl_num)
+ return USB_STOR_TRANSPORT_ERROR;
+
+- if (info->MS_Status.IsMSPro) {
++ if (info->MS_Status & MS_IsMSPro) {
+ result = ene_load_bincode(us, MSP_RW_PATTERN);
+ if (result != USB_STOR_XFER_GOOD) {
+ usb_stor_dbg(us, "Load MPS RW pattern Fail !!\n");
+@@ -1749,7 +1746,7 @@ static int ms_scsi_write(struct us_data *us, struct scsi_cmnd *srb)
+ if (bn > info->bl_num)
+ return USB_STOR_TRANSPORT_ERROR;
+
+- if (info->MS_Status.IsMSPro) {
++ if (info->MS_Status & MS_IsMSPro) {
+ result = ene_load_bincode(us, MSP_RW_PATTERN);
+ if (result != USB_STOR_XFER_GOOD) {
+ pr_info("Load MSP RW pattern Fail !!\n");
+@@ -1857,12 +1854,12 @@ static int ene_get_card_status(struct us_data *us, u8 *buf)
+
+ tmpreg = (u16) reg4b;
+ reg4b = *(u32 *)(&buf[0x14]);
+- if (info->SD_Status.HiCapacity && !info->SD_Status.IsMMC)
++ if ((info->SD_Status & SD_HiCapacity) && !(info->SD_Status & SD_IsMMC))
+ info->HC_C_SIZE = (reg4b >> 8) & 0x3fffff;
+
+ info->SD_C_SIZE = ((tmpreg & 0x03) << 10) | (u16)(reg4b >> 22);
+ info->SD_C_SIZE_MULT = (u8)(reg4b >> 7) & 0x07;
+- if (info->SD_Status.HiCapacity && info->SD_Status.IsMMC)
++ if ((info->SD_Status & SD_HiCapacity) && (info->SD_Status & SD_IsMMC))
+ info->HC_C_SIZE = *(u32 *)(&buf[0x100]);
+
+ if (info->SD_READ_BL_LEN > SD_BLOCK_LEN) {
+@@ -2074,6 +2071,7 @@ static int ene_ms_init(struct us_data *us)
+ u16 MSP_BlockSize, MSP_UserAreaBlocks;
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+ u8 *bbuf = info->bbuf;
++ unsigned int s;
+
+ printk(KERN_INFO "transport --- ENE_MSInit\n");
+
+@@ -2098,15 +2096,16 @@ static int ene_ms_init(struct us_data *us)
+ return USB_STOR_TRANSPORT_ERROR;
+ }
+ /* the same part to test ENE */
+- info->MS_Status = *(struct MS_STATUS *) bbuf;
+-
+- if (info->MS_Status.Insert && info->MS_Status.Ready) {
+- printk(KERN_INFO "Insert = %x\n", info->MS_Status.Insert);
+- printk(KERN_INFO "Ready = %x\n", info->MS_Status.Ready);
+- printk(KERN_INFO "IsMSPro = %x\n", info->MS_Status.IsMSPro);
+- printk(KERN_INFO "IsMSPHG = %x\n", info->MS_Status.IsMSPHG);
+- printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP);
+- if (info->MS_Status.IsMSPro) {
++ info->MS_Status = bbuf[0];
++
++ s = info->MS_Status;
++ if ((s & MS_Insert) && (s & MS_Ready)) {
++ printk(KERN_INFO "Insert = %x\n", !!(s & MS_Insert));
++ printk(KERN_INFO "Ready = %x\n", !!(s & MS_Ready));
++ printk(KERN_INFO "IsMSPro = %x\n", !!(s & MS_IsMSPro));
++ printk(KERN_INFO "IsMSPHG = %x\n", !!(s & MS_IsMSPHG));
++ printk(KERN_INFO "WtP= %x\n", !!(s & MS_WtP));
++ if (s & MS_IsMSPro) {
+ MSP_BlockSize = (bbuf[6] << 8) | bbuf[7];
+ MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11];
+ info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks;
+@@ -2167,17 +2166,17 @@ static int ene_sd_init(struct us_data *us)
+ return USB_STOR_TRANSPORT_ERROR;
+ }
+
+- info->SD_Status = *(struct SD_STATUS *) bbuf;
+- if (info->SD_Status.Insert && info->SD_Status.Ready) {
+- struct SD_STATUS *s = &info->SD_Status;
++ info->SD_Status = bbuf[0];
++ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) {
++ unsigned int s = info->SD_Status;
+
+ ene_get_card_status(us, bbuf);
+- usb_stor_dbg(us, "Insert = %x\n", s->Insert);
+- usb_stor_dbg(us, "Ready = %x\n", s->Ready);
+- usb_stor_dbg(us, "IsMMC = %x\n", s->IsMMC);
+- usb_stor_dbg(us, "HiCapacity = %x\n", s->HiCapacity);
+- usb_stor_dbg(us, "HiSpeed = %x\n", s->HiSpeed);
+- usb_stor_dbg(us, "WtP = %x\n", s->WtP);
++ usb_stor_dbg(us, "Insert = %x\n", !!(s & SD_Insert));
++ usb_stor_dbg(us, "Ready = %x\n", !!(s & SD_Ready));
++ usb_stor_dbg(us, "IsMMC = %x\n", !!(s & SD_IsMMC));
++ usb_stor_dbg(us, "HiCapacity = %x\n", !!(s & SD_HiCapacity));
++ usb_stor_dbg(us, "HiSpeed = %x\n", !!(s & SD_HiSpeed));
++ usb_stor_dbg(us, "WtP = %x\n", !!(s & SD_WtP));
+ } else {
+ usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]);
+ return USB_STOR_TRANSPORT_ERROR;
+@@ -2199,14 +2198,14 @@ static int ene_init(struct us_data *us)
+
+ misc_reg03 = bbuf[0];
+ if (misc_reg03 & 0x01) {
+- if (!info->SD_Status.Ready) {
++ if (!(info->SD_Status & SD_Ready)) {
+ result = ene_sd_init(us);
+ if (result != USB_STOR_XFER_GOOD)
+ return USB_STOR_TRANSPORT_ERROR;
+ }
+ }
+ if (misc_reg03 & 0x02) {
+- if (!info->MS_Status.Ready) {
++ if (!(info->MS_Status & MS_Ready)) {
+ result = ene_ms_init(us);
+ if (result != USB_STOR_XFER_GOOD)
+ return USB_STOR_TRANSPORT_ERROR;
+@@ -2305,14 +2304,14 @@ static int ene_transport(struct scsi_cmnd *srb, struct us_data *us)
+
+ /*US_DEBUG(usb_stor_show_command(us, srb)); */
+ scsi_set_resid(srb, 0);
+- if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready)))
++ if (unlikely(!(info->SD_Status & SD_Ready) || (info->MS_Status & MS_Ready)))
+ result = ene_init(us);
+ if (result == USB_STOR_XFER_GOOD) {
+ result = USB_STOR_TRANSPORT_ERROR;
+- if (info->SD_Status.Ready)
++ if (info->SD_Status & SD_Ready)
+ result = sd_scsi_irp(us, srb);
+
+- if (info->MS_Status.Ready)
++ if (info->MS_Status & MS_Ready)
+ result = ms_scsi_irp(us, srb);
+ }
+ return result;
+@@ -2376,7 +2375,6 @@ static int ene_ub6250_probe(struct usb_interface *intf,
+
+ static int ene_ub6250_resume(struct usb_interface *iface)
+ {
+- u8 tmp = 0;
+ struct us_data *us = usb_get_intfdata(iface);
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra);
+
+@@ -2388,17 +2386,16 @@ static int ene_ub6250_resume(struct usb_interface *iface)
+ mutex_unlock(&us->dev_mutex);
+
+ info->Power_IsResum = true;
+- /*info->SD_Status.Ready = 0; */
+- info->SD_Status = *(struct SD_STATUS *)&tmp;
+- info->MS_Status = *(struct MS_STATUS *)&tmp;
+- info->SM_Status = *(struct SM_STATUS *)&tmp;
++ /* info->SD_Status &= ~SD_Ready; */
++ info->SD_Status = 0;
++ info->MS_Status = 0;
++ info->SM_Status = 0;
+
+ return 0;
+ }
+
+ static int ene_ub6250_reset_resume(struct usb_interface *iface)
+ {
+- u8 tmp = 0;
+ struct us_data *us = usb_get_intfdata(iface);
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra);
+
+@@ -2410,10 +2407,10 @@ static int ene_ub6250_reset_resume(struct usb_interface *iface)
+ * the device
+ */
+ info->Power_IsResum = true;
+- /*info->SD_Status.Ready = 0; */
+- info->SD_Status = *(struct SD_STATUS *)&tmp;
+- info->MS_Status = *(struct MS_STATUS *)&tmp;
+- info->SM_Status = *(struct SM_STATUS *)&tmp;
++ /* info->SD_Status &= ~SD_Ready; */
++ info->SD_Status = 0;
++ info->MS_Status = 0;
++ info->SM_Status = 0;
+
+ return 0;
+ }
+diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
+index 1d9ce9cbc831d..9c2a1eda3f4f0 100644
+--- a/drivers/usb/storage/realtek_cr.c
++++ b/drivers/usb/storage/realtek_cr.c
+@@ -364,7 +364,7 @@ static int rts51x_read_mem(struct us_data *us, u16 addr, u8 *data, u16 len)
+
+ buf = kmalloc(len, GFP_NOIO);
+ if (buf == NULL)
+- return USB_STOR_TRANSPORT_ERROR;
++ return -ENOMEM;
+
+ usb_stor_dbg(us, "addr = 0x%x, len = %d\n", addr, len);
+
+diff --git a/drivers/video/fbdev/atafb.c b/drivers/video/fbdev/atafb.c
+index fcd2dd670a658..770f77055682b 100644
+--- a/drivers/video/fbdev/atafb.c
++++ b/drivers/video/fbdev/atafb.c
+@@ -1713,9 +1713,9 @@ static int falcon_setcolreg(unsigned int regno, unsigned int red,
+ ((blue & 0xfc00) >> 8));
+ if (regno < 16) {
+ shifter_tt.color_reg[regno] =
+- (((red & 0xe000) >> 13) | ((red & 0x1000) >> 12) << 8) |
+- (((green & 0xe000) >> 13) | ((green & 0x1000) >> 12) << 4) |
+- ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12);
++ ((((red & 0xe000) >> 13) | ((red & 0x1000) >> 12)) << 8) |
++ ((((green & 0xe000) >> 13) | ((green & 0x1000) >> 12)) << 4) |
++ ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12);
+ ((u32 *)info->pseudo_palette)[regno] = ((red & 0xf800) |
+ ((green & 0xfc00) >> 5) |
+ ((blue & 0xf800) >> 11));
+@@ -2001,9 +2001,9 @@ static int stste_setcolreg(unsigned int regno, unsigned int red,
+ green >>= 12;
+ if (ATARIHW_PRESENT(EXTD_SHIFTER))
+ shifter_tt.color_reg[regno] =
+- (((red & 0xe) >> 1) | ((red & 1) << 3) << 8) |
+- (((green & 0xe) >> 1) | ((green & 1) << 3) << 4) |
+- ((blue & 0xe) >> 1) | ((blue & 1) << 3);
++ ((((red & 0xe) >> 1) | ((red & 1) << 3)) << 8) |
++ ((((green & 0xe) >> 1) | ((green & 1) << 3)) << 4) |
++ ((blue & 0xe) >> 1) | ((blue & 1) << 3);
+ else
+ shifter_tt.color_reg[regno] =
+ ((red & 0xe) << 7) |
+diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c
+index b3be06dd29088..72358d187023e 100644
+--- a/drivers/video/fbdev/cirrusfb.c
++++ b/drivers/video/fbdev/cirrusfb.c
+@@ -470,7 +470,7 @@ static int cirrusfb_check_mclk(struct fb_info *info, long freq)
+ return 0;
+ }
+
+-static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
++static int cirrusfb_check_pixclock(struct fb_var_screeninfo *var,
+ struct fb_info *info)
+ {
+ long freq;
+@@ -479,9 +479,7 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
+ unsigned maxclockidx = var->bits_per_pixel >> 3;
+
+ /* convert from ps to kHz */
+- freq = PICOS2KHZ(var->pixclock);
+-
+- dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq);
++ freq = PICOS2KHZ(var->pixclock ? : 1);
+
+ maxclock = cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx];
+ cinfo->multiplexing = 0;
+@@ -489,11 +487,13 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
+ /* If the frequency is greater than we can support, we might be able
+ * to use multiplexing for the video mode */
+ if (freq > maxclock) {
+- dev_err(info->device,
+- "Frequency greater than maxclock (%ld kHz)\n",
+- maxclock);
+- return -EINVAL;
++ var->pixclock = KHZ2PICOS(maxclock);
++
++ while ((freq = PICOS2KHZ(var->pixclock)) > maxclock)
++ var->pixclock++;
+ }
++ dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq);
++
+ /*
+ * Additional constraint: 8bpp uses DAC clock doubling to allow maximum
+ * pixel clock
+diff --git a/drivers/video/fbdev/core/fbcvt.c b/drivers/video/fbdev/core/fbcvt.c
+index 55d2bd0ce5c02..64843464c6613 100644
+--- a/drivers/video/fbdev/core/fbcvt.c
++++ b/drivers/video/fbdev/core/fbcvt.c
+@@ -214,9 +214,11 @@ static u32 fb_cvt_aspect_ratio(struct fb_cvt_data *cvt)
+ static void fb_cvt_print_name(struct fb_cvt_data *cvt)
+ {
+ u32 pixcount, pixcount_mod;
+- int cnt = 255, offset = 0, read = 0;
+- u8 *buf = kzalloc(256, GFP_KERNEL);
++ int size = 256;
++ int off = 0;
++ u8 *buf;
+
++ buf = kzalloc(size, GFP_KERNEL);
+ if (!buf)
+ return;
+
+@@ -224,43 +226,30 @@ static void fb_cvt_print_name(struct fb_cvt_data *cvt)
+ pixcount_mod = (cvt->xres * (cvt->yres/cvt->interlace)) % 1000000;
+ pixcount_mod /= 1000;
+
+- read = snprintf(buf+offset, cnt, "fbcvt: %dx%d@%d: CVT Name - ",
+- cvt->xres, cvt->yres, cvt->refresh);
+- offset += read;
+- cnt -= read;
++ off += scnprintf(buf + off, size - off, "fbcvt: %dx%d@%d: CVT Name - ",
++ cvt->xres, cvt->yres, cvt->refresh);
+
+- if (cvt->status)
+- snprintf(buf+offset, cnt, "Not a CVT standard - %d.%03d Mega "
+- "Pixel Image\n", pixcount, pixcount_mod);
+- else {
+- if (pixcount) {
+- read = snprintf(buf+offset, cnt, "%d", pixcount);
+- cnt -= read;
+- offset += read;
+- }
++ if (cvt->status) {
++ off += scnprintf(buf + off, size - off,
++ "Not a CVT standard - %d.%03d Mega Pixel Image\n",
++ pixcount, pixcount_mod);
++ } else {
++ if (pixcount)
++ off += scnprintf(buf + off, size - off, "%d", pixcount);
+
+- read = snprintf(buf+offset, cnt, ".%03dM", pixcount_mod);
+- cnt -= read;
+- offset += read;
++ off += scnprintf(buf + off, size - off, ".%03dM", pixcount_mod);
+
+ if (cvt->aspect_ratio == 0)
+- read = snprintf(buf+offset, cnt, "3");
++ off += scnprintf(buf + off, size - off, "3");
+ else if (cvt->aspect_ratio == 3)
+- read = snprintf(buf+offset, cnt, "4");
++ off += scnprintf(buf + off, size - off, "4");
+ else if (cvt->aspect_ratio == 1 || cvt->aspect_ratio == 4)
+- read = snprintf(buf+offset, cnt, "9");
++ off += scnprintf(buf + off, size - off, "9");
+ else if (cvt->aspect_ratio == 2)
+- read = snprintf(buf+offset, cnt, "A");
+- else
+- read = 0;
+- cnt -= read;
+- offset += read;
+-
+- if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) {
+- read = snprintf(buf+offset, cnt, "-R");
+- cnt -= read;
+- offset += read;
+- }
++ off += scnprintf(buf + off, size - off, "A");
++
++ if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK)
++ off += scnprintf(buf + off, size - off, "-R");
+ }
+
+ printk(KERN_INFO "%s\n", buf);
+diff --git a/drivers/video/fbdev/nvidia/nv_i2c.c b/drivers/video/fbdev/nvidia/nv_i2c.c
+index d7994a1732459..0b48965a6420c 100644
+--- a/drivers/video/fbdev/nvidia/nv_i2c.c
++++ b/drivers/video/fbdev/nvidia/nv_i2c.c
+@@ -86,7 +86,7 @@ static int nvidia_setup_i2c_bus(struct nvidia_i2c_chan *chan, const char *name,
+ {
+ int rc;
+
+- strcpy(chan->adapter.name, name);
++ strscpy(chan->adapter.name, name, sizeof(chan->adapter.name));
+ chan->adapter.owner = THIS_MODULE;
+ chan->adapter.class = i2c_class;
+ chan->adapter.algo_data = &chan->algo;
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c
+index 06e1db34541e2..41b0db0cc0471 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c
+@@ -254,6 +254,7 @@ static int dvic_probe_of(struct platform_device *pdev)
+ adapter_node = of_parse_phandle(node, "ddc-i2c-bus", 0);
+ if (adapter_node) {
+ adapter = of_get_i2c_adapter_by_node(adapter_node);
++ of_node_put(adapter_node);
+ if (adapter == NULL) {
+ dev_err(&pdev->dev, "failed to parse ddc-i2c-bus\n");
+ omap_dss_put_device(ddata->in);
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
+index 87497a00241fd..1c57ddaeff1b8 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
+@@ -412,7 +412,7 @@ static ssize_t dsicm_num_errors_show(struct device *dev,
+ if (r)
+ return r;
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", errors);
++ return sysfs_emit(buf, "%d\n", errors);
+ }
+
+ static ssize_t dsicm_hw_revision_show(struct device *dev,
+@@ -442,7 +442,7 @@ static ssize_t dsicm_hw_revision_show(struct device *dev,
+ if (r)
+ return r;
+
+- return snprintf(buf, PAGE_SIZE, "%02x.%02x.%02x\n", id1, id2, id3);
++ return sysfs_emit(buf, "%02x.%02x.%02x\n", id1, id2, id3);
+ }
+
+ static ssize_t dsicm_store_ulps(struct device *dev,
+@@ -490,7 +490,7 @@ static ssize_t dsicm_show_ulps(struct device *dev,
+ t = ddata->ulps_enabled;
+ mutex_unlock(&ddata->lock);
+
+- return snprintf(buf, PAGE_SIZE, "%u\n", t);
++ return sysfs_emit(buf, "%u\n", t);
+ }
+
+ static ssize_t dsicm_store_ulps_timeout(struct device *dev,
+@@ -535,7 +535,7 @@ static ssize_t dsicm_show_ulps_timeout(struct device *dev,
+ t = ddata->ulps_timeout;
+ mutex_unlock(&ddata->lock);
+
+- return snprintf(buf, PAGE_SIZE, "%u\n", t);
++ return sysfs_emit(buf, "%u\n", t);
+ }
+
+ static DEVICE_ATTR(num_dsi_errors, S_IRUGO, dsicm_num_errors_show, NULL);
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c
+index f2c2fef3db744..87c4f420a9d92 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c
+@@ -487,7 +487,7 @@ static ssize_t show_cabc_available_modes(struct device *dev,
+ int i;
+
+ if (!ddata->has_cabc)
+- return snprintf(buf, PAGE_SIZE, "%s\n", cabc_modes[0]);
++ return sysfs_emit(buf, "%s\n", cabc_modes[0]);
+
+ for (i = 0, len = 0;
+ len < PAGE_SIZE && i < ARRAY_SIZE(cabc_modes); i++)
+diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c
+index ea8c79a42b41a..3f1389bfba6f0 100644
+--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c
++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c
+@@ -173,7 +173,7 @@ static ssize_t tpo_td043_vmirror_show(struct device *dev,
+ {
+ struct panel_drv_data *ddata = dev_get_drvdata(dev);
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", ddata->vmirror);
++ return sysfs_emit(buf, "%d\n", ddata->vmirror);
+ }
+
+ static ssize_t tpo_td043_vmirror_store(struct device *dev,
+@@ -203,7 +203,7 @@ static ssize_t tpo_td043_mode_show(struct device *dev,
+ {
+ struct panel_drv_data *ddata = dev_get_drvdata(dev);
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", ddata->mode);
++ return sysfs_emit(buf, "%d\n", ddata->mode);
+ }
+
+ static ssize_t tpo_td043_mode_store(struct device *dev,
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 1781ca697f66b..f4396d1389e42 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1047,7 +1047,7 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf,
+ if (count + p > total_size)
+ count = total_size - p;
+
+- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL);
++ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ if (!buffer)
+ return -ENOMEM;
+
+@@ -1059,25 +1059,14 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf,
+ while (count) {
+ c = (count > PAGE_SIZE) ? PAGE_SIZE : count;
+ dst = buffer;
+- for (i = c >> 2; i--;) {
+- *dst = fb_readl(src++);
+- *dst = big_swap(*dst);
++ for (i = (c + 3) >> 2; i--;) {
++ u32 val;
++
++ val = fb_readl(src);
++ *dst = big_swap(val);
++ src++;
+ dst++;
+ }
+- if (c & 3) {
+- u8 *dst8 = (u8 *)dst;
+- u8 __iomem *src8 = (u8 __iomem *)src;
+-
+- for (i = c & 3; i--;) {
+- if (i & 1) {
+- *dst8++ = fb_readb(++src8);
+- } else {
+- *dst8++ = fb_readb(--src8);
+- src8 += 2;
+- }
+- }
+- src = (u32 __iomem *)src8;
+- }
+
+ if (copy_to_user(buf, buffer, c)) {
+ err = -EFAULT;
+@@ -1130,7 +1119,7 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf,
+ count = total_size - p;
+ }
+
+- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL);
++ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ if (!buffer)
+ return -ENOMEM;
+
+@@ -1148,24 +1137,11 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf,
+ break;
+ }
+
+- for (i = c >> 2; i--;) {
+- fb_writel(big_swap(*src), dst++);
++ for (i = (c + 3) >> 2; i--;) {
++ fb_writel(big_swap(*src), dst);
++ dst++;
+ src++;
+ }
+- if (c & 3) {
+- u8 *src8 = (u8 *)src;
+- u8 __iomem *dst8 = (u8 __iomem *)dst;
+-
+- for (i = c & 3; i--;) {
+- if (i & 1) {
+- fb_writeb(*src8++, ++dst8);
+- } else {
+- fb_writeb(*src8++, --dst8);
+- dst8 += 2;
+- }
+- }
+- dst = (u32 __iomem *)dst8;
+- }
+
+ *ppos += c;
+ buf += c;
+diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
+index 22b606af0a875..da54a84d2e62e 100644
+--- a/drivers/video/fbdev/smscufx.c
++++ b/drivers/video/fbdev/smscufx.c
+@@ -1662,6 +1662,7 @@ static int ufx_usb_probe(struct usb_interface *interface,
+ info->par = dev;
+ info->pseudo_palette = dev->pseudo_palette;
+ info->fbops = &ufx_ops;
++ INIT_LIST_HEAD(&info->modelist);
+
+ retval = fb_alloc_cmap(&info->cmap, 256, 0);
+ if (retval < 0) {
+@@ -1672,8 +1673,6 @@ static int ufx_usb_probe(struct usb_interface *interface,
+ INIT_DELAYED_WORK(&dev->free_framebuffer_work,
+ ufx_free_framebuffer_work);
+
+- INIT_LIST_HEAD(&info->modelist);
+-
+ retval = ufx_reg_read(dev, 0x3000, &id_rev);
+ check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval);
+ dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev);
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index f7823aa99340d..08a694e9383f0 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -1430,7 +1430,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
+ struct device_attribute *a, char *buf) {
+ struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ struct dlfb_data *dlfb = fb_info->par;
+- return snprintf(buf, PAGE_SIZE, "%u\n",
++ return sysfs_emit(buf, "%u\n",
+ atomic_read(&dlfb->bytes_rendered));
+ }
+
+@@ -1438,7 +1438,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
+ struct device_attribute *a, char *buf) {
+ struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ struct dlfb_data *dlfb = fb_info->par;
+- return snprintf(buf, PAGE_SIZE, "%u\n",
++ return sysfs_emit(buf, "%u\n",
+ atomic_read(&dlfb->bytes_identical));
+ }
+
+@@ -1446,7 +1446,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
+ struct device_attribute *a, char *buf) {
+ struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ struct dlfb_data *dlfb = fb_info->par;
+- return snprintf(buf, PAGE_SIZE, "%u\n",
++ return sysfs_emit(buf, "%u\n",
+ atomic_read(&dlfb->bytes_sent));
+ }
+
+@@ -1454,7 +1454,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
+ struct device_attribute *a, char *buf) {
+ struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ struct dlfb_data *dlfb = fb_info->par;
+- return snprintf(buf, PAGE_SIZE, "%u\n",
++ return sysfs_emit(buf, "%u\n",
+ atomic_read(&dlfb->cpu_kcycles_used));
+ }
+
+diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c
+index 967030176d87d..307066113c358 100644
+--- a/drivers/video/fbdev/w100fb.c
++++ b/drivers/video/fbdev/w100fb.c
+@@ -773,12 +773,18 @@ out:
+ fb_dealloc_cmap(&info->cmap);
+ kfree(info->pseudo_palette);
+ }
+- if (remapped_fbuf != NULL)
++ if (remapped_fbuf != NULL) {
+ iounmap(remapped_fbuf);
+- if (remapped_regs != NULL)
++ remapped_fbuf = NULL;
++ }
++ if (remapped_regs != NULL) {
+ iounmap(remapped_regs);
+- if (remapped_base != NULL)
++ remapped_regs = NULL;
++ }
++ if (remapped_base != NULL) {
+ iounmap(remapped_base);
++ remapped_base = NULL;
++ }
+ if (info)
+ framebuffer_release(info);
+ return err;
+@@ -803,8 +809,11 @@ static int w100fb_remove(struct platform_device *pdev)
+ fb_dealloc_cmap(&info->cmap);
+
+ iounmap(remapped_base);
++ remapped_base = NULL;
+ iounmap(remapped_regs);
++ remapped_regs = NULL;
+ iounmap(remapped_fbuf);
++ remapped_fbuf = NULL;
+
+ framebuffer_release(info);
+
+diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
+index 3c350dfbcd0be..aba727294bc8a 100644
+--- a/drivers/w1/slaves/w1_therm.c
++++ b/drivers/w1/slaves/w1_therm.c
+@@ -693,16 +693,20 @@ static ssize_t w1_seq_show(struct device *device,
+ if (sl->reg_num.id == reg_num->id)
+ seq = i;
+
++ if (w1_reset_bus(sl->master))
++ goto error;
++
++ /* Put the device into chain DONE state */
++ w1_write_8(sl->master, W1_MATCH_ROM);
++ w1_write_block(sl->master, (u8 *)&rn, 8);
+ w1_write_8(sl->master, W1_42_CHAIN);
+ w1_write_8(sl->master, W1_42_CHAIN_DONE);
+ w1_write_8(sl->master, W1_42_CHAIN_DONE_INV);
+- w1_read_block(sl->master, &ack, sizeof(ack));
+
+ /* check for acknowledgment */
+ ack = w1_read_8(sl->master);
+ if (ack != W1_42_SUCCESS_CONFIRM_BYTE)
+ goto error;
+-
+ }
+
+ /* Exit from CHAIN state */
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index d5089cadd7c49..35a21a602e3ac 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -197,7 +197,7 @@ struct extent_buffer {
+ */
+ struct extent_changeset {
+ /* How many bytes are set/cleared in this operation */
+- unsigned int bytes_changed;
++ u64 bytes_changed;
+
+ /* Changed ranges */
+ struct ulist range_changed;
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index 80a3038e0e464..ad9fd08f66bab 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -780,8 +780,12 @@ static loff_t ext2_max_size(int bits)
+ res += 1LL << (bits-2);
+ res += 1LL << (2*(bits-2));
+ res += 1LL << (3*(bits-2));
++ /* Compute how many metadata blocks are needed */
++ meta_blocks = 1;
++ meta_blocks += 1 + ppb;
++ meta_blocks += 1 + ppb + ppb * ppb;
+ /* Does block tree limit file size? */
+- if (res < upper_limit)
++ if (res + meta_blocks <= upper_limit)
+ goto check_lfs;
+
+ res = upper_limit;
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 7959aae4857e1..96cf0f57ca950 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -2148,6 +2148,15 @@ static int ext4_writepage(struct page *page,
+ else
+ len = PAGE_SIZE;
+
++ /* Should never happen but for bugs in other kernel subsystems */
++ if (!page_has_buffers(page)) {
++ ext4_warning_inode(inode,
++ "page %lu does not have buffers attached", page->index);
++ ClearPageDirty(page);
++ unlock_page(page);
++ return 0;
++ }
++
+ page_bufs = page_buffers(page);
+ /*
+ * We cannot do block allocation or other extent handling in this
+@@ -2697,6 +2706,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd)
+ wait_on_page_writeback(page);
+ BUG_ON(PageWriteback(page));
+
++ /*
++ * Should never happen but for buggy code in
++ * other subsystems that call
++ * set_page_dirty() without properly warning
++ * the file system first. See [1] for more
++ * information.
++ *
++ * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz
++ */
++ if (!page_has_buffers(page)) {
++ ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index);
++ ClearPageDirty(page);
++ unlock_page(page);
++ continue;
++ }
++
+ if (mpd->map.m_len == 0)
+ mpd->first_page = page->index;
+ mpd->next_page = page->index + 1;
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index bd377ff0b403f..ff447bbb5248b 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -589,8 +589,10 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ }
+
+- if (f2fs_check_nid_range(sbi, dni->ino))
++ if (f2fs_check_nid_range(sbi, dni->ino)) {
++ f2fs_put_page(node_page, 1);
+ return false;
++ }
+
+ *nofs = ofs_of_node(node_page);
+ source_blkaddr = datablock_addr(NULL, node_page, ofs_in_node);
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index d1dc545302528..a5144ecd5babd 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -999,7 +999,17 @@ static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep,
+
+ while (count) {
+ if (cs->write && cs->pipebufs && page) {
+- return fuse_ref_page(cs, page, offset, count);
++ /*
++ * Can't control lifetime of pipe buffers, so always
++ * copy user pages.
++ */
++ if (cs->req->user_pages) {
++ err = fuse_copy_fill(cs);
++ if (err)
++ return err;
++ } else {
++ return fuse_ref_page(cs, page, offset, count);
++ }
+ } else if (!cs->len) {
+ if (cs->move_pages && page &&
+ offset == 0 && count == PAGE_SIZE) {
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index ed9b3ebc0cca4..599a6eeed02e0 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1329,6 +1329,7 @@ static int fuse_get_user_pages(struct fuse_req *req, struct iov_iter *ii,
+ (PAGE_SIZE - ret) & (PAGE_SIZE - 1);
+ }
+
++ req->user_pages = true;
+ if (write)
+ req->in.argpages = 1;
+ else
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index 853d37ec81e0c..1c754a02fb06b 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -313,6 +313,8 @@ struct fuse_req {
+ /** refcount */
+ refcount_t count;
+
++ bool user_pages;
++
+ /** Unique ID for the interrupt request */
+ u64 intr_unique;
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 054fdfd4fb8b3..29dcf0973b73f 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1406,7 +1406,8 @@ int gfs2_fitrim(struct file *filp, void __user *argp)
+
+ start = r.start >> bs_shift;
+ end = start + (r.len >> bs_shift);
+- minlen = max_t(u64, r.minlen,
++ minlen = max_t(u64, r.minlen, sdp->sd_sb.sb_bsize);
++ minlen = max_t(u64, minlen,
+ q->limits.discard_granularity) >> bs_shift;
+
+ if (end <= start || minlen > sdp->sd_max_rg_data)
+diff --git a/fs/jffs2/build.c b/fs/jffs2/build.c
+index b288c8ae1236b..837cd55fd4c5e 100644
+--- a/fs/jffs2/build.c
++++ b/fs/jffs2/build.c
+@@ -415,13 +415,15 @@ int jffs2_do_mount_fs(struct jffs2_sb_info *c)
+ jffs2_free_ino_caches(c);
+ jffs2_free_raw_node_refs(c);
+ ret = -EIO;
+- goto out_free;
++ goto out_sum_exit;
+ }
+
+ jffs2_calc_trigger_levels(c);
+
+ return 0;
+
++ out_sum_exit:
++ jffs2_sum_exit(c);
+ out_free:
+ kvfree(c->blocks);
+
+diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
+index eab04eca95a3f..81f7a6efe168b 100644
+--- a/fs/jffs2/fs.c
++++ b/fs/jffs2/fs.c
+@@ -597,8 +597,8 @@ out_root:
+ jffs2_free_ino_caches(c);
+ jffs2_free_raw_node_refs(c);
+ kvfree(c->blocks);
+- out_inohash:
+ jffs2_clear_xattr_subsystem(c);
++ out_inohash:
+ kfree(c->inocache_list);
+ out_wbuf:
+ jffs2_flash_cleanup(c);
+diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
+index 08813789fcf06..664384dac6e58 100644
+--- a/fs/jffs2/scan.c
++++ b/fs/jffs2/scan.c
+@@ -136,7 +136,7 @@ int jffs2_scan_medium(struct jffs2_sb_info *c)
+ if (!s) {
+ JFFS2_WARNING("Can't allocate memory for summary\n");
+ ret = -ENOMEM;
+- goto out;
++ goto out_buf;
+ }
+ }
+
+@@ -274,13 +274,15 @@ int jffs2_scan_medium(struct jffs2_sb_info *c)
+ }
+ ret = 0;
+ out:
++ jffs2_sum_reset_collected(s);
++ kfree(s);
++ out_buf:
+ if (buf_size)
+ kfree(flashbuf);
+ #ifndef __ECOS
+ else
+ mtd_unpoint(c->mtd, 0, c->mtd->size);
+ #endif
+- kfree(s);
+ return ret;
+ }
+
+diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
+index 87b41edc800d0..68779cc3609a6 100644
+--- a/fs/jfs/inode.c
++++ b/fs/jfs/inode.c
+@@ -156,12 +156,13 @@ void jfs_evict_inode(struct inode *inode)
+ dquot_initialize(inode);
+
+ if (JFS_IP(inode)->fileset == FILESYSTEM_I) {
++ struct inode *ipimap = JFS_SBI(inode->i_sb)->ipimap;
+ truncate_inode_pages_final(&inode->i_data);
+
+ if (test_cflag(COMMIT_Freewmap, inode))
+ jfs_free_zero_link(inode);
+
+- if (JFS_SBI(inode->i_sb)->ipimap)
++ if (ipimap && JFS_IP(ipimap)->i_imap)
+ diFree(inode);
+
+ /*
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 687b07b9b4f62..f05805a10a50b 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -161,6 +161,7 @@ static const s8 budtab[256] = {
+ * 0 - success
+ * -ENOMEM - insufficient memory
+ * -EIO - i/o error
++ * -EINVAL - wrong bmap data
+ */
+ int dbMount(struct inode *ipbmap)
+ {
+@@ -192,6 +193,12 @@ int dbMount(struct inode *ipbmap)
+ bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree);
+ bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage);
+ bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
++ if (!bmp->db_numag) {
++ release_metapage(mp);
++ kfree(bmp);
++ return -EINVAL;
++ }
++
+ bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel);
+ bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag);
+ bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref);
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index 03fe8bac36cf4..3ce91ad1ee1b3 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -450,7 +450,8 @@ static const struct address_space_operations minix_aops = {
+ .writepage = minix_writepage,
+ .write_begin = minix_write_begin,
+ .write_end = generic_write_end,
+- .bmap = minix_bmap
++ .bmap = minix_bmap,
++ .direct_IO = noop_direct_IO
+ };
+
+ static const struct inode_operations minix_symlink_inode_operations = {
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index 868d66ed8bcf6..f2a854805f0ea 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -364,12 +364,11 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp,
+ struct cb_process_state *cps)
+ {
+ struct cb_devicenotifyargs *args = argp;
++ const struct pnfs_layoutdriver_type *ld = NULL;
+ uint32_t i;
+ __be32 res = 0;
+- struct nfs_client *clp = cps->clp;
+- struct nfs_server *server = NULL;
+
+- if (!clp) {
++ if (!cps->clp) {
+ res = cpu_to_be32(NFS4ERR_OP_NOT_IN_SESSION);
+ goto out;
+ }
+@@ -377,23 +376,15 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp,
+ for (i = 0; i < args->ndevs; i++) {
+ struct cb_devicenotifyitem *dev = &args->devs[i];
+
+- if (!server ||
+- server->pnfs_curr_ld->id != dev->cbd_layout_type) {
+- rcu_read_lock();
+- list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link)
+- if (server->pnfs_curr_ld &&
+- server->pnfs_curr_ld->id == dev->cbd_layout_type) {
+- rcu_read_unlock();
+- goto found;
+- }
+- rcu_read_unlock();
+- continue;
++ if (!ld || ld->id != dev->cbd_layout_type) {
++ pnfs_put_layoutdriver(ld);
++ ld = pnfs_find_layoutdriver(dev->cbd_layout_type);
++ if (!ld)
++ continue;
+ }
+-
+- found:
+- nfs4_delete_deviceid(server->pnfs_curr_ld, clp, &dev->cbd_dev_id);
++ nfs4_delete_deviceid(ld, cps->clp, &dev->cbd_dev_id);
+ }
+-
++ pnfs_put_layoutdriver(ld);
+ out:
+ kfree(args->devs);
+ return res;
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index 76aa1b456c524..2f84c612838c4 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -281,10 +281,6 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp,
+ n = ntohl(*p++);
+ if (n == 0)
+ goto out;
+- if (n > ULONG_MAX / sizeof(*args->devs)) {
+- status = htonl(NFS4ERR_BADXDR);
+- goto out;
+- }
+
+ args->devs = kmalloc_array(n, sizeof(*args->devs), GFP_KERNEL);
+ if (!args->devs) {
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index e5da9d7fb69e9..6a4083d550c6c 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -288,8 +288,8 @@ ssize_t nfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
+ VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE);
+
+ if (iov_iter_rw(iter) == READ)
+- return nfs_file_direct_read(iocb, iter);
+- return nfs_file_direct_write(iocb, iter);
++ return nfs_file_direct_read(iocb, iter, true);
++ return nfs_file_direct_write(iocb, iter, true);
+ }
+
+ static void nfs_direct_release_pages(struct page **pages, unsigned int npages)
+@@ -553,6 +553,7 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
+ * nfs_file_direct_read - file direct read operation for NFS files
+ * @iocb: target I/O control block
+ * @iter: vector of user buffers into which to read data
++ * @swap: flag indicating this is swap IO, not O_DIRECT IO
+ *
+ * We use this function for direct reads instead of calling
+ * generic_file_aio_read() in order to avoid gfar's check to see if
+@@ -568,7 +569,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
+ * client must read the updated atime from the server back into its
+ * cache.
+ */
+-ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter)
++ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter,
++ bool swap)
+ {
+ struct file *file = iocb->ki_filp;
+ struct address_space *mapping = file->f_mapping;
+@@ -610,12 +612,14 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter)
+ if (iter_is_iovec(iter))
+ dreq->flags = NFS_ODIRECT_SHOULD_DIRTY;
+
+- nfs_start_io_direct(inode);
++ if (!swap)
++ nfs_start_io_direct(inode);
+
+ NFS_I(inode)->read_io += count;
+ requested = nfs_direct_read_schedule_iovec(dreq, iter, iocb->ki_pos);
+
+- nfs_end_io_direct(inode);
++ if (!swap)
++ nfs_end_io_direct(inode);
+
+ if (requested > 0) {
+ result = nfs_direct_wait(dreq);
+@@ -884,7 +888,7 @@ static const struct nfs_pgio_completion_ops nfs_direct_write_completion_ops = {
+ */
+ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
+ struct iov_iter *iter,
+- loff_t pos)
++ loff_t pos, int ioflags)
+ {
+ struct nfs_pageio_descriptor desc;
+ struct inode *inode = dreq->inode;
+@@ -892,7 +896,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
+ size_t requested_bytes = 0;
+ size_t wsize = max_t(size_t, NFS_SERVER(inode)->wsize, PAGE_SIZE);
+
+- nfs_pageio_init_write(&desc, inode, FLUSH_COND_STABLE, false,
++ nfs_pageio_init_write(&desc, inode, ioflags, false,
+ &nfs_direct_write_completion_ops);
+ desc.pg_dreq = dreq;
+ get_dreq(dreq);
+@@ -971,6 +975,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
+ * nfs_file_direct_write - file direct write operation for NFS files
+ * @iocb: target I/O control block
+ * @iter: vector of user buffers from which to write data
++ * @swap: flag indicating this is swap IO, not O_DIRECT IO
+ *
+ * We use this function for direct writes instead of calling
+ * generic_file_aio_write() in order to avoid taking the inode
+@@ -987,7 +992,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
+ * Note that O_APPEND is not supported for NFS direct writes, as there
+ * is no atomic O_APPEND write facility in the NFS protocol.
+ */
+-ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter)
++ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter,
++ bool swap)
+ {
+ ssize_t result = -EINVAL, requested;
+ size_t count;
+@@ -1001,7 +1007,11 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter)
+ dfprintk(FILE, "NFS: direct write(%pD2, %zd@%Ld)\n",
+ file, iov_iter_count(iter), (long long) iocb->ki_pos);
+
+- result = generic_write_checks(iocb, iter);
++ if (swap)
++ /* bypass generic checks */
++ result = iov_iter_count(iter);
++ else
++ result = generic_write_checks(iocb, iter);
+ if (result <= 0)
+ return result;
+ count = result;
+@@ -1031,16 +1041,22 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter)
+ if (!is_sync_kiocb(iocb))
+ dreq->iocb = iocb;
+
+- nfs_start_io_direct(inode);
++ if (swap) {
++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos,
++ FLUSH_STABLE);
++ } else {
++ nfs_start_io_direct(inode);
+
+- requested = nfs_direct_write_schedule_iovec(dreq, iter, pos);
++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos,
++ FLUSH_COND_STABLE);
+
+- if (mapping->nrpages) {
+- invalidate_inode_pages2_range(mapping,
+- pos >> PAGE_SHIFT, end);
+- }
++ if (mapping->nrpages) {
++ invalidate_inode_pages2_range(mapping,
++ pos >> PAGE_SHIFT, end);
++ }
+
+- nfs_end_io_direct(inode);
++ nfs_end_io_direct(inode);
++ }
+
+ if (requested > 0) {
+ result = nfs_direct_wait(dreq);
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index 29553fdba8af7..62a86c4143913 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -157,7 +157,7 @@ nfs_file_read(struct kiocb *iocb, struct iov_iter *to)
+ ssize_t result;
+
+ if (iocb->ki_flags & IOCB_DIRECT)
+- return nfs_file_direct_read(iocb, to);
++ return nfs_file_direct_read(iocb, to, false);
+
+ dprintk("NFS: read(%pD2, %zu@%lu)\n",
+ iocb->ki_filp,
+@@ -606,7 +606,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ return result;
+
+ if (iocb->ki_flags & IOCB_DIRECT)
+- return nfs_file_direct_write(iocb, from);
++ return nfs_file_direct_write(iocb, from, false);
+
+ dprintk("NFS: write(%pD2, %zu@%Ld)\n",
+ file, iov_iter_count(from), (long long) iocb->ki_pos);
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 9c98547fcefcc..30576a10a1f4c 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -49,6 +49,7 @@
+ #include <linux/workqueue.h>
+ #include <linux/bitops.h>
+ #include <linux/jiffies.h>
++#include <linux/sched/mm.h>
+
+ #include <linux/sunrpc/clnt.h>
+
+@@ -2505,9 +2506,17 @@ static int nfs4_bind_conn_to_session(struct nfs_client *clp)
+
+ static void nfs4_state_manager(struct nfs_client *clp)
+ {
++ unsigned int memflags;
+ int status = 0;
+ const char *section = "", *section_sep = "";
+
++ /*
++ * State recovery can deadlock if the direct reclaim code tries
++ * start NFS writeback. So ensure memory allocations are all
++ * GFP_NOFS.
++ */
++ memflags = memalloc_nofs_save();
++
+ /* Ensure exclusive access to NFSv4 state */
+ do {
+ clear_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state);
+@@ -2600,6 +2609,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ goto out_error;
+ }
+
++ memalloc_nofs_restore(memflags);
+ nfs4_end_drain_session(clp);
+ nfs4_clear_state_manager_bit(clp);
+
+@@ -2616,6 +2626,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ return;
+ if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
+ return;
++ memflags = memalloc_nofs_save();
+ } while (refcount_read(&clp->cl_count) > 1 && !signalled());
+ goto out_drain;
+
+@@ -2627,6 +2638,7 @@ out_error:
+ clp->cl_hostname, -status);
+ ssleep(1);
+ out_drain:
++ memalloc_nofs_restore(memflags);
+ nfs4_end_drain_session(clp);
+ nfs4_clear_state_manager_bit(clp);
+ }
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index c900cb2119bae..0f1c158594188 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -92,6 +92,17 @@ find_pnfs_driver(u32 id)
+ return local;
+ }
+
++const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id)
++{
++ return find_pnfs_driver(id);
++}
++
++void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld)
++{
++ if (ld)
++ module_put(ld->owner);
++}
++
+ void
+ unset_pnfs_layoutdriver(struct nfs_server *nfss)
+ {
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 80fafa29e567a..d5d818b1ac9d9 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -225,6 +225,8 @@ struct pnfs_devicelist {
+
+ extern int pnfs_register_layoutdriver(struct pnfs_layoutdriver_type *);
+ extern void pnfs_unregister_layoutdriver(struct pnfs_layoutdriver_type *);
++extern const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id);
++extern void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld);
+
+ /* nfs4proc.c */
+ extern size_t max_response_pages(struct nfs_server *server);
+diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
+index 01f7ce1ae1275..bce1cc686eb5b 100644
+--- a/fs/nfsd/nfsproc.c
++++ b/fs/nfsd/nfsproc.c
+@@ -228,7 +228,7 @@ nfsd_proc_write(struct svc_rqst *rqstp)
+ unsigned long cnt = argp->len;
+ unsigned int nvecs;
+
+- dprintk("nfsd: WRITE %s %d bytes at %d\n",
++ dprintk("nfsd: WRITE %s %u bytes at %d\n",
+ SVCFH_fmt(&argp->fh),
+ argp->len, argp->offset);
+
+diff --git a/fs/nfsd/xdr.h b/fs/nfsd/xdr.h
+index ea7cca3a64b76..6251d8754c82b 100644
+--- a/fs/nfsd/xdr.h
++++ b/fs/nfsd/xdr.h
+@@ -33,7 +33,7 @@ struct nfsd_readargs {
+ struct nfsd_writeargs {
+ svc_fh fh;
+ __u32 offset;
+- int len;
++ __u32 len;
+ struct kvec first;
+ };
+
+diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
+index e844b43f2eacf..0acd1f02b1467 100644
+--- a/fs/ntfs/inode.c
++++ b/fs/ntfs/inode.c
+@@ -1906,6 +1906,10 @@ int ntfs_read_inode_mount(struct inode *vi)
+ }
+ /* Now allocate memory for the attribute list. */
+ ni->attr_list_size = (u32)ntfs_attr_size(a);
++ if (!ni->attr_list_size) {
++ ntfs_error(sb, "Attr_list_size is zero");
++ goto put_err_out;
++ }
+ ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size);
+ if (!ni->attr_list) {
+ ntfs_error(sb, "Not enough memory to allocate buffer "
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index dbdf6a4230fbd..111905ddbfc2e 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -373,15 +373,18 @@ static int do_tmpfile(struct inode *dir, struct dentry *dentry,
+ {
+ struct inode *inode;
+ struct ubifs_info *c = dir->i_sb->s_fs_info;
+- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1};
++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1,
++ .dirtied_ino = 1};
+ struct ubifs_budget_req ino_req = { .dirtied_ino = 1 };
+ struct ubifs_inode *ui, *dir_ui = ubifs_inode(dir);
+ int err, instantiated = 0;
+ struct fscrypt_name nm;
+
+ /*
+- * Budget request settings: new dirty inode, new direntry,
+- * budget for dirtied inode will be released via writeback.
++ * Budget request settings: new inode, new direntry, changing the
++ * parent directory inode.
++ * Allocate budget separately for new dirtied inode, the budget will
++ * be released via writeback.
+ */
+
+ dbg_gen("dent '%pd', mode %#hx in dir ino %lu",
+@@ -451,6 +454,8 @@ out_inode:
+ make_bad_inode(inode);
+ if (!instantiated)
+ iput(inode);
++ else if (whiteout)
++ iput(*whiteout);
+ out_budg:
+ ubifs_release_budget(c, &req);
+ if (!instantiated)
+@@ -971,7 +976,8 @@ static int ubifs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+ struct ubifs_inode *dir_ui = ubifs_inode(dir);
+ struct ubifs_info *c = dir->i_sb->s_fs_info;
+ int err, sz_change;
+- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1 };
++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1,
++ .dirtied_ino = 1};
+ struct fscrypt_name nm;
+
+ /*
+@@ -1341,6 +1347,7 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
+
+ if (flags & RENAME_WHITEOUT) {
+ union ubifs_dev_desc *dev = NULL;
++ struct ubifs_budget_req wht_req;
+
+ dev = kmalloc(sizeof(union ubifs_dev_desc), GFP_NOFS);
+ if (!dev) {
+@@ -1362,6 +1369,23 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
+ whiteout_ui->data = dev;
+ whiteout_ui->data_len = ubifs_encode_dev(dev, MKDEV(0, 0));
+ ubifs_assert(c, !whiteout_ui->dirty);
++
++ memset(&wht_req, 0, sizeof(struct ubifs_budget_req));
++ wht_req.dirtied_ino = 1;
++ wht_req.dirtied_ino_d = ALIGN(whiteout_ui->data_len, 8);
++ /*
++ * To avoid deadlock between space budget (holds ui_mutex and
++ * waits wb work) and writeback work(waits ui_mutex), do space
++ * budget before ubifs inodes locked.
++ */
++ err = ubifs_budget_space(c, &wht_req);
++ if (err) {
++ iput(whiteout);
++ goto out_release;
++ }
++
++ /* Add the old_dentry size to the old_dir size. */
++ old_sz -= CALC_DENT_SIZE(fname_len(&old_nm));
+ }
+
+ lock_4_inodes(old_dir, new_dir, new_inode, whiteout);
+@@ -1436,18 +1460,6 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
+ }
+
+ if (whiteout) {
+- struct ubifs_budget_req wht_req = { .dirtied_ino = 1,
+- .dirtied_ino_d = \
+- ALIGN(ubifs_inode(whiteout)->data_len, 8) };
+-
+- err = ubifs_budget_space(c, &wht_req);
+- if (err) {
+- kfree(whiteout_ui->data);
+- whiteout_ui->data_len = 0;
+- iput(whiteout);
+- goto out_release;
+- }
+-
+ inc_nlink(whiteout);
+ mark_inode_dirty(whiteout);
+
+diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
+index 9542ebf643a5e..0ad819c904dfd 100644
+--- a/fs/ubifs/io.c
++++ b/fs/ubifs/io.c
+@@ -810,16 +810,42 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
+ */
+ n = aligned_len >> c->max_write_shift;
+ if (n) {
+- n <<= c->max_write_shift;
++ int m = n - 1;
++
+ dbg_io("write %d bytes to LEB %d:%d", n, wbuf->lnum,
+ wbuf->offs);
+- err = ubifs_leb_write(c, wbuf->lnum, buf + written,
+- wbuf->offs, n);
++
++ if (m) {
++ /* '(n-1)<<c->max_write_shift < len' is always true. */
++ m <<= c->max_write_shift;
++ err = ubifs_leb_write(c, wbuf->lnum, buf + written,
++ wbuf->offs, m);
++ if (err)
++ goto out;
++ wbuf->offs += m;
++ aligned_len -= m;
++ len -= m;
++ written += m;
++ }
++
++ /*
++ * The non-written len of buf may be less than 'n' because
++ * parameter 'len' is not 8 bytes aligned, so here we read
++ * min(len, n) bytes from buf.
++ */
++ n = 1 << c->max_write_shift;
++ memcpy(wbuf->buf, buf + written, min(len, n));
++ if (n > len) {
++ ubifs_assert(c, n - len < 8);
++ ubifs_pad(c, wbuf->buf + len, n - len);
++ }
++
++ err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf, wbuf->offs, n);
+ if (err)
+ goto out;
+ wbuf->offs += n;
+ aligned_len -= n;
+- len -= n;
++ len -= min(len, n);
+ written += n;
+ }
+
+diff --git a/fs/ubifs/ioctl.c b/fs/ubifs/ioctl.c
+index e666459f63c70..3fca4f7414126 100644
+--- a/fs/ubifs/ioctl.c
++++ b/fs/ubifs/ioctl.c
+@@ -113,7 +113,7 @@ static int setflags(struct inode *inode, int flags)
+ struct ubifs_inode *ui = ubifs_inode(inode);
+ struct ubifs_info *c = inode->i_sb->s_fs_info;
+ struct ubifs_budget_req req = { .dirtied_ino = 1,
+- .dirtied_ino_d = ui->data_len };
++ .dirtied_ino_d = ALIGN(ui->data_len, 8) };
+
+ err = ubifs_budget_space(c, &req);
+ if (err)
+diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h
+index 6d766a19f2bbb..8f1be8b493910 100644
+--- a/include/linux/blk-cgroup.h
++++ b/include/linux/blk-cgroup.h
+@@ -21,6 +21,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/atomic.h>
+ #include <linux/kthread.h>
++#include <linux/blkdev.h>
+
+ /* percpu_counter batch for blkg_[rw]stats, per-cpu drift doesn't matter */
+ #define BLKG_STAT_CPU_BATCH (INT_MAX / 2)
+@@ -844,6 +845,21 @@ static inline void blkcg_use_delay(struct blkcg_gq *blkg)
+ atomic_inc(&blkg->blkcg->css.cgroup->congestion_count);
+ }
+
++/**
++ * blk_cgroup_mergeable - Determine whether to allow or disallow merges
++ * @rq: request to merge into
++ * @bio: bio to merge
++ *
++ * @bio and @rq should belong to the same cgroup and their issue_as_root should
++ * match. The latter is necessary as we don't want to throttle e.g. a metadata
++ * update because it happens to be next to a regular IO.
++ */
++static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio)
++{
++ return rq->bio->bi_blkg == bio->bi_blkg &&
++ bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio);
++}
++
+ static inline int blkcg_unuse_delay(struct blkcg_gq *blkg)
+ {
+ int old = atomic_read(&blkg->use_delay);
+@@ -947,6 +963,7 @@ static inline struct request_list *blk_rq_rl(struct request *rq) { return &rq->q
+
+ static inline bool blkcg_bio_issue_check(struct request_queue *q,
+ struct bio *bio) { return true; }
++static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) { return true; }
+
+ #define blk_queue_for_each_rl(rl, q) \
+ for ((rl) = &(q)->root_rl; (rl); (rl) = NULL)
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 209ba8e7bd317..56fe682d9beb4 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -56,6 +56,14 @@ struct blk_stat_callback;
+ */
+ #define BLKCG_MAX_POLS 5
+
++static inline int blk_validate_block_size(unsigned int bsize)
++{
++ if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
++ return -EINVAL;
++
++ return 0;
++}
++
+ typedef void (rq_end_io_fn)(struct request *, blk_status_t);
+
+ #define BLK_RL_SYNCFULL (1U << 0)
+diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
+index fa02014eba8ea..b4084b6ed5418 100644
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -1155,13 +1155,16 @@ extern struct mem_section mem_section[NR_SECTION_ROOTS][SECTIONS_PER_ROOT];
+
+ static inline struct mem_section *__nr_to_section(unsigned long nr)
+ {
++ unsigned long root = SECTION_NR_TO_ROOT(nr);
++
++ if (unlikely(root >= NR_SECTION_ROOTS))
++ return NULL;
++
+ #ifdef CONFIG_SPARSEMEM_EXTREME
+- if (!mem_section)
++ if (!mem_section || !mem_section[root])
+ return NULL;
+ #endif
+- if (!mem_section[SECTION_NR_TO_ROOT(nr)])
+- return NULL;
+- return &mem_section[SECTION_NR_TO_ROOT(nr)][nr & SECTION_ROOT_MASK];
++ return &mem_section[root][nr & SECTION_ROOT_MASK];
+ }
+ extern int __section_nr(struct mem_section* ms);
+ extern unsigned long usemap_size(void);
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 58ee9d2d6a3ca..8d48b352ee74f 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3674,7 +3674,8 @@ void netdev_run_todo(void);
+ */
+ static inline void dev_put(struct net_device *dev)
+ {
+- this_cpu_dec(*dev->pcpu_refcnt);
++ if (dev)
++ this_cpu_dec(*dev->pcpu_refcnt);
+ }
+
+ /**
+@@ -3685,7 +3686,8 @@ static inline void dev_put(struct net_device *dev)
+ */
+ static inline void dev_hold(struct net_device *dev)
+ {
+- this_cpu_inc(*dev->pcpu_refcnt);
++ if (dev)
++ this_cpu_inc(*dev->pcpu_refcnt);
+ }
+
+ /* Carrier loss detection, dial on demand. The functions netif_carrier_on
+diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
+index 0ff7dd2bf8a4f..8ea7ceed82851 100644
+--- a/include/linux/nfs_fs.h
++++ b/include/linux/nfs_fs.h
+@@ -475,10 +475,10 @@ static inline struct rpc_cred *nfs_file_cred(struct file *file)
+ * linux/fs/nfs/direct.c
+ */
+ extern ssize_t nfs_direct_IO(struct kiocb *, struct iov_iter *);
+-extern ssize_t nfs_file_direct_read(struct kiocb *iocb,
+- struct iov_iter *iter);
+-extern ssize_t nfs_file_direct_write(struct kiocb *iocb,
+- struct iov_iter *iter);
++ssize_t nfs_file_direct_read(struct kiocb *iocb,
++ struct iov_iter *iter, bool swap);
++ssize_t nfs_file_direct_write(struct kiocb *iocb,
++ struct iov_iter *iter, bool swap);
+
+ /*
+ * linux/fs/nfs/dir.c
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index a4bbce871e08e..3e06e9790c255 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -581,6 +581,7 @@ struct pci_bus {
+ struct bin_attribute *legacy_io; /* Legacy I/O for this bus */
+ struct bin_attribute *legacy_mem; /* Legacy mem */
+ unsigned int is_added:1;
++ unsigned int unsafe_warn:1; /* warned about RW1C config write */
+ };
+
+ #define to_pci_bus(n) container_of(n, struct pci_bus, dev)
+diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
+index 33580cc72a43d..8e3d35189bf89 100644
+--- a/include/linux/sunrpc/xdr.h
++++ b/include/linux/sunrpc/xdr.h
+@@ -509,6 +509,8 @@ xdr_stream_decode_uint32_array(struct xdr_stream *xdr,
+
+ if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0))
+ return -EBADMSG;
++ if (len > SIZE_MAX / sizeof(*p))
++ return -EBADMSG;
+ p = xdr_inline_decode(xdr, len * sizeof(*p));
+ if (unlikely(!p))
+ return -EBADMSG;
+diff --git a/include/net/arp.h b/include/net/arp.h
+index c8f580a0e6b1f..dc6e9dd3e1e62 100644
+--- a/include/net/arp.h
++++ b/include/net/arp.h
+@@ -71,6 +71,7 @@ void arp_send(int type, int ptype, __be32 dest_ip,
+ const unsigned char *src_hw, const unsigned char *th);
+ int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir);
+ void arp_ifdown(struct net_device *dev);
++int arp_invalidate(struct net_device *dev, __be32 ip, bool force);
+
+ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+ struct net_device *dev, __be32 src_ip,
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 2bf8dcf863f2c..7d3a4c2eea95b 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -2400,22 +2400,39 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+ void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags);
+
+ /**
+- * sock_tx_timestamp - checks whether the outgoing packet is to be time stamped
++ * _sock_tx_timestamp - checks whether the outgoing packet is to be time stamped
+ * @sk: socket sending this packet
+ * @tsflags: timestamping flags to use
+ * @tx_flags: completed with instructions for time stamping
++ * @tskey: filled in with next sk_tskey (not for TCP, which uses seqno)
+ *
+ * Note: callers should take care of initial ``*tx_flags`` value (usually 0)
+ */
+-static inline void sock_tx_timestamp(const struct sock *sk, __u16 tsflags,
+- __u8 *tx_flags)
++static inline void _sock_tx_timestamp(struct sock *sk, __u16 tsflags,
++ __u8 *tx_flags, __u32 *tskey)
+ {
+- if (unlikely(tsflags))
++ if (unlikely(tsflags)) {
+ __sock_tx_timestamp(tsflags, tx_flags);
++ if (tsflags & SOF_TIMESTAMPING_OPT_ID && tskey &&
++ tsflags & SOF_TIMESTAMPING_TX_RECORD_MASK)
++ *tskey = sk->sk_tskey++;
++ }
+ if (unlikely(sock_flag(sk, SOCK_WIFI_STATUS)))
+ *tx_flags |= SKBTX_WIFI_STATUS;
+ }
+
++static inline void sock_tx_timestamp(struct sock *sk, __u16 tsflags,
++ __u8 *tx_flags)
++{
++ _sock_tx_timestamp(sk, tsflags, tx_flags, NULL);
++}
++
++static inline void skb_setup_tx_timestamp(struct sk_buff *skb, __u16 tsflags)
++{
++ _sock_tx_timestamp(skb->sk, tsflags, &skb_shinfo(skb)->tx_flags,
++ &skb_shinfo(skb)->tskey);
++}
++
+ /**
+ * sk_eat_skb - Release a skb if it is no longer needed
+ * @sk: socket to eat this skb from
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index a8aa2bb74ad61..6b18cd0e511a5 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1739,13 +1739,16 @@ int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
+ void *);
+ void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
+ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
+-struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
+- u8 type, int dir,
++struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net,
++ const struct xfrm_mark *mark,
++ u32 if_id, u8 type, int dir,
+ struct xfrm_selector *sel,
+ struct xfrm_sec_ctx *ctx, int delete,
+ int *err);
+-struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id, u8,
+- int dir, u32 id, int delete, int *err);
++struct xfrm_policy *xfrm_policy_byid(struct net *net,
++ const struct xfrm_mark *mark, u32 if_id,
++ u8 type, int dir, u32 id, int delete,
++ int *err);
+ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
+ void xfrm_policy_hash_rebuild(struct net *net);
+ u32 xfrm_get_acqseq(void);
+diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
+index 8481fc7676c0b..6334aede67fc2 100644
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -1207,8 +1207,8 @@ union bpf_attr {
+ * Return
+ * The return value depends on the result of the test, and can be:
+ *
+- * * 0, if current task belongs to the cgroup2.
+- * * 1, if current task does not belong to the cgroup2.
++ * * 1, if current task belongs to the cgroup2.
++ * * 0, if current task does not belong to the cgroup2.
+ * * A negative error code, if an error occurred.
+ *
+ * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags)
+diff --git a/init/main.c b/init/main.c
+index 7baad67c2e937..272ec131211c0 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -774,7 +774,7 @@ static int __init initcall_blacklist(char *str)
+ }
+ } while (str_entry);
+
+- return 0;
++ return 1;
+ }
+
+ static bool __init_or_module initcall_blacklisted(initcall_t fn)
+@@ -1027,7 +1027,9 @@ static noinline void __init kernel_init_freeable(void);
+ bool rodata_enabled __ro_after_init = true;
+ static int __init set_debug_rodata(char *str)
+ {
+- return strtobool(str, &rodata_enabled);
++ if (strtobool(str, &rodata_enabled))
++ pr_warn("Invalid option string for rodata: '%s'\n", str);
++ return 1;
+ }
+ __setup("rodata=", set_debug_rodata);
+ #endif
+diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h
+index 75568fcf2180d..8f7729b0a6383 100644
+--- a/kernel/cgroup/cgroup-internal.h
++++ b/kernel/cgroup/cgroup-internal.h
+@@ -34,6 +34,25 @@ extern char trace_cgroup_path[TRACE_CGROUP_PATH_LEN];
+ } \
+ } while (0)
+
++struct cgroup_pidlist;
++
++struct cgroup_file_ctx {
++ struct cgroup_namespace *ns;
++
++ struct {
++ void *trigger;
++ } psi;
++
++ struct {
++ bool started;
++ struct css_task_iter iter;
++ } procs;
++
++ struct {
++ struct cgroup_pidlist *pidlist;
++ } procs1;
++};
++
+ /*
+ * A cgroup can be associated with multiple css_sets as different tasks may
+ * belong to different cgroups on different hierarchies. In the other
+diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
+index ced2b3f3547c6..61644976225a9 100644
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -426,6 +426,7 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
+ * next pid to display, if any
+ */
+ struct kernfs_open_file *of = s->private;
++ struct cgroup_file_ctx *ctx = of->priv;
+ struct cgroup *cgrp = seq_css(s)->cgroup;
+ struct cgroup_pidlist *l;
+ enum cgroup_filetype type = seq_cft(s)->private;
+@@ -435,25 +436,24 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
+ mutex_lock(&cgrp->pidlist_mutex);
+
+ /*
+- * !NULL @of->priv indicates that this isn't the first start()
+- * after open. If the matching pidlist is around, we can use that.
+- * Look for it. Note that @of->priv can't be used directly. It
+- * could already have been destroyed.
++ * !NULL @ctx->procs1.pidlist indicates that this isn't the first
++ * start() after open. If the matching pidlist is around, we can use
++ * that. Look for it. Note that @ctx->procs1.pidlist can't be used
++ * directly. It could already have been destroyed.
+ */
+- if (of->priv)
+- of->priv = cgroup_pidlist_find(cgrp, type);
++ if (ctx->procs1.pidlist)
++ ctx->procs1.pidlist = cgroup_pidlist_find(cgrp, type);
+
+ /*
+ * Either this is the first start() after open or the matching
+ * pidlist has been destroyed inbetween. Create a new one.
+ */
+- if (!of->priv) {
+- ret = pidlist_array_load(cgrp, type,
+- (struct cgroup_pidlist **)&of->priv);
++ if (!ctx->procs1.pidlist) {
++ ret = pidlist_array_load(cgrp, type, &ctx->procs1.pidlist);
+ if (ret)
+ return ERR_PTR(ret);
+ }
+- l = of->priv;
++ l = ctx->procs1.pidlist;
+
+ if (pid) {
+ int end = l->length;
+@@ -481,7 +481,8 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
+ static void cgroup_pidlist_stop(struct seq_file *s, void *v)
+ {
+ struct kernfs_open_file *of = s->private;
+- struct cgroup_pidlist *l = of->priv;
++ struct cgroup_file_ctx *ctx = of->priv;
++ struct cgroup_pidlist *l = ctx->procs1.pidlist;
+
+ if (l)
+ mod_delayed_work(cgroup_pidlist_destroy_wq, &l->destroy_dwork,
+@@ -492,7 +493,8 @@ static void cgroup_pidlist_stop(struct seq_file *s, void *v)
+ static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos)
+ {
+ struct kernfs_open_file *of = s->private;
+- struct cgroup_pidlist *l = of->priv;
++ struct cgroup_file_ctx *ctx = of->priv;
++ struct cgroup_pidlist *l = ctx->procs1.pidlist;
+ pid_t *p = v;
+ pid_t *end = l->list + l->length;
+ /*
+@@ -535,10 +537,11 @@ static ssize_t __cgroup1_procs_write(struct kernfs_open_file *of,
+ goto out_unlock;
+
+ /*
+- * Even if we're attaching all tasks in the thread group, we only
+- * need to check permissions on one of them.
++ * Even if we're attaching all tasks in the thread group, we only need
++ * to check permissions on one of them. Check permissions using the
++ * credentials from file open to protect against inherited fd attacks.
+ */
+- cred = current_cred();
++ cred = of->file->f_cred;
+ tcred = get_task_cred(task);
+ if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) &&
+ !uid_eq(cred->euid, tcred->uid) &&
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 63eff85f251f3..4e8284d8cacc0 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -3451,24 +3451,43 @@ static int cpu_stat_show(struct seq_file *seq, void *v)
+ static int cgroup_file_open(struct kernfs_open_file *of)
+ {
+ struct cftype *cft = of->kn->priv;
++ struct cgroup_file_ctx *ctx;
++ int ret;
+
+- if (cft->open)
+- return cft->open(of);
+- return 0;
++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
++ if (!ctx)
++ return -ENOMEM;
++
++ ctx->ns = current->nsproxy->cgroup_ns;
++ get_cgroup_ns(ctx->ns);
++ of->priv = ctx;
++
++ if (!cft->open)
++ return 0;
++
++ ret = cft->open(of);
++ if (ret) {
++ put_cgroup_ns(ctx->ns);
++ kfree(ctx);
++ }
++ return ret;
+ }
+
+ static void cgroup_file_release(struct kernfs_open_file *of)
+ {
+ struct cftype *cft = of->kn->priv;
++ struct cgroup_file_ctx *ctx = of->priv;
+
+ if (cft->release)
+ cft->release(of);
++ put_cgroup_ns(ctx->ns);
++ kfree(ctx);
+ }
+
+ static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf,
+ size_t nbytes, loff_t off)
+ {
+- struct cgroup_namespace *ns = current->nsproxy->cgroup_ns;
++ struct cgroup_file_ctx *ctx = of->priv;
+ struct cgroup *cgrp = of->kn->parent->priv;
+ struct cftype *cft = of->kn->priv;
+ struct cgroup_subsys_state *css;
+@@ -3482,7 +3501,7 @@ static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf,
+ */
+ if ((cgrp->root->flags & CGRP_ROOT_NS_DELEGATE) &&
+ !(cft->flags & CFTYPE_NS_DELEGATABLE) &&
+- ns != &init_cgroup_ns && ns->root_cset->dfl_cgrp == cgrp)
++ ctx->ns != &init_cgroup_ns && ctx->ns->root_cset->dfl_cgrp == cgrp)
+ return -EPERM;
+
+ if (cft->write)
+@@ -4376,21 +4395,21 @@ void css_task_iter_end(struct css_task_iter *it)
+
+ static void cgroup_procs_release(struct kernfs_open_file *of)
+ {
+- if (of->priv) {
+- css_task_iter_end(of->priv);
+- kfree(of->priv);
+- }
++ struct cgroup_file_ctx *ctx = of->priv;
++
++ if (ctx->procs.started)
++ css_task_iter_end(&ctx->procs.iter);
+ }
+
+ static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos)
+ {
+ struct kernfs_open_file *of = s->private;
+- struct css_task_iter *it = of->priv;
++ struct cgroup_file_ctx *ctx = of->priv;
+
+ if (pos)
+ (*pos)++;
+
+- return css_task_iter_next(it);
++ return css_task_iter_next(&ctx->procs.iter);
+ }
+
+ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos,
+@@ -4398,21 +4417,18 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos,
+ {
+ struct kernfs_open_file *of = s->private;
+ struct cgroup *cgrp = seq_css(s)->cgroup;
+- struct css_task_iter *it = of->priv;
++ struct cgroup_file_ctx *ctx = of->priv;
++ struct css_task_iter *it = &ctx->procs.iter;
+
+ /*
+ * When a seq_file is seeked, it's always traversed sequentially
+ * from position 0, so we can simply keep iterating on !0 *pos.
+ */
+- if (!it) {
++ if (!ctx->procs.started) {
+ if (WARN_ON_ONCE((*pos)))
+ return ERR_PTR(-EINVAL);
+-
+- it = kzalloc(sizeof(*it), GFP_KERNEL);
+- if (!it)
+- return ERR_PTR(-ENOMEM);
+- of->priv = it;
+ css_task_iter_start(&cgrp->self, iter_flags, it);
++ ctx->procs.started = true;
+ } else if (!(*pos)) {
+ css_task_iter_end(it);
+ css_task_iter_start(&cgrp->self, iter_flags, it);
+@@ -4447,9 +4463,9 @@ static int cgroup_procs_show(struct seq_file *s, void *v)
+
+ static int cgroup_procs_write_permission(struct cgroup *src_cgrp,
+ struct cgroup *dst_cgrp,
+- struct super_block *sb)
++ struct super_block *sb,
++ struct cgroup_namespace *ns)
+ {
+- struct cgroup_namespace *ns = current->nsproxy->cgroup_ns;
+ struct cgroup *com_cgrp = src_cgrp;
+ struct inode *inode;
+ int ret;
+@@ -4485,8 +4501,10 @@ static int cgroup_procs_write_permission(struct cgroup *src_cgrp,
+ static ssize_t cgroup_procs_write(struct kernfs_open_file *of,
+ char *buf, size_t nbytes, loff_t off)
+ {
++ struct cgroup_file_ctx *ctx = of->priv;
+ struct cgroup *src_cgrp, *dst_cgrp;
+ struct task_struct *task;
++ const struct cred *saved_cred;
+ ssize_t ret;
+
+ dst_cgrp = cgroup_kn_lock_live(of->kn, false);
+@@ -4503,8 +4521,16 @@ static ssize_t cgroup_procs_write(struct kernfs_open_file *of,
+ src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root);
+ spin_unlock_irq(&css_set_lock);
+
++ /*
++ * Process and thread migrations follow same delegation rule. Check
++ * permissions using the credentials from file open to protect against
++ * inherited fd attacks.
++ */
++ saved_cred = override_creds(of->file->f_cred);
+ ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp,
+- of->file->f_path.dentry->d_sb);
++ of->file->f_path.dentry->d_sb,
++ ctx->ns);
++ revert_creds(saved_cred);
+ if (ret)
+ goto out_finish;
+
+@@ -4526,8 +4552,10 @@ static void *cgroup_threads_start(struct seq_file *s, loff_t *pos)
+ static ssize_t cgroup_threads_write(struct kernfs_open_file *of,
+ char *buf, size_t nbytes, loff_t off)
+ {
++ struct cgroup_file_ctx *ctx = of->priv;
+ struct cgroup *src_cgrp, *dst_cgrp;
+ struct task_struct *task;
++ const struct cred *saved_cred;
+ ssize_t ret;
+
+ buf = strstrip(buf);
+@@ -4546,9 +4574,16 @@ static ssize_t cgroup_threads_write(struct kernfs_open_file *of,
+ src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root);
+ spin_unlock_irq(&css_set_lock);
+
+- /* thread migrations follow the cgroup.procs delegation rule */
++ /*
++ * Process and thread migrations follow same delegation rule. Check
++ * permissions using the credentials from file open to protect against
++ * inherited fd attacks.
++ */
++ saved_cred = override_creds(of->file->f_cred);
+ ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp,
+- of->file->f_path.dentry->d_sb);
++ of->file->f_path.dentry->d_sb,
++ ctx->ns);
++ revert_creds(saved_cred);
+ if (ret)
+ goto out_finish;
+
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index 1c82b0d25498f..9c9a5b12f92ff 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -1056,7 +1056,7 @@ static __init int dma_debug_cmdline(char *str)
+ global_disable = true;
+ }
+
+- return 0;
++ return 1;
+ }
+
+ static __init int dma_debug_entries_cmdline(char *str)
+@@ -1065,7 +1065,7 @@ static __init int dma_debug_entries_cmdline(char *str)
+ return -EINVAL;
+ if (!get_option(&str, &nr_prealloc_entries))
+ nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES;
+- return 0;
++ return 1;
+ }
+
+ __setup("dma_debug=", dma_debug_cmdline);
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 2adde229d1af4..ec2f9e433208a 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -9137,8 +9137,11 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
+ }
+
+ /* ready to consume more filters */
++ kfree(filename);
++ filename = NULL;
+ state = IF_STATE_ACTION;
+ filter = NULL;
++ kernel = 0;
+ }
+ }
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index 6670a44ec5d45..6abdfdf571ee7 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -1219,7 +1219,7 @@ static int __init resumedelay_setup(char *str)
+ int rc = kstrtouint(str, 0, &resume_delay);
+
+ if (rc)
+- return rc;
++ pr_warn("resumedelay: bad option string '%s'\n", str);
+ return 1;
+ }
+
+diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c
+index 6a897e8b2a888..3f6345d60256f 100644
+--- a/kernel/power/suspend_test.c
++++ b/kernel/power/suspend_test.c
+@@ -158,22 +158,22 @@ static int __init setup_test_suspend(char *value)
+ value++;
+ suspend_type = strsep(&value, ",");
+ if (!suspend_type)
+- return 0;
++ return 1;
+
+ repeat = strsep(&value, ",");
+ if (repeat) {
+ if (kstrtou32(repeat, 0, &test_repeat_count_max))
+- return 0;
++ return 1;
+ }
+
+ for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++)
+ if (!strcmp(pm_labels[i], suspend_type)) {
+ test_state_label = pm_labels[i];
+- return 0;
++ return 1;
+ }
+
+ printk(warn_bad_state, suspend_type);
+- return 0;
++ return 1;
+ }
+ __setup("test_suspend", setup_test_suspend);
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 57742e193214e..2ba16c426ba5d 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -127,8 +127,10 @@ static int __control_devkmsg(char *str)
+
+ static int __init control_devkmsg(char *str)
+ {
+- if (__control_devkmsg(str) < 0)
++ if (__control_devkmsg(str) < 0) {
++ pr_warn("printk.devkmsg: bad option string '%s'\n", str);
+ return 1;
++ }
+
+ /*
+ * Set sysctl string accordingly:
+@@ -147,7 +149,7 @@ static int __init control_devkmsg(char *str)
+ */
+ devkmsg_log |= DEVKMSG_LOG_MASK_LOCK;
+
+- return 0;
++ return 1;
+ }
+ __setup("printk.devkmsg=", control_devkmsg);
+
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index af74e843221b3..8a98e3e78c704 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -364,6 +364,26 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
+ return !err;
+ }
+
++static int check_ptrace_options(unsigned long data)
++{
++ if (data & ~(unsigned long)PTRACE_O_MASK)
++ return -EINVAL;
++
++ if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) {
++ if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) ||
++ !IS_ENABLED(CONFIG_SECCOMP))
++ return -EINVAL;
++
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
++ if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED ||
++ current->ptrace & PT_SUSPEND_SECCOMP)
++ return -EPERM;
++ }
++ return 0;
++}
++
+ static int ptrace_attach(struct task_struct *task, long request,
+ unsigned long addr,
+ unsigned long flags)
+@@ -375,8 +395,16 @@ static int ptrace_attach(struct task_struct *task, long request,
+ if (seize) {
+ if (addr != 0)
+ goto out;
++ /*
++ * This duplicates the check in check_ptrace_options() because
++ * ptrace_attach() and ptrace_setoptions() have historically
++ * used different error codes for unknown ptrace options.
++ */
+ if (flags & ~(unsigned long)PTRACE_O_MASK)
+ goto out;
++ retval = check_ptrace_options(flags);
++ if (retval)
++ return retval;
+ flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT);
+ } else {
+ flags = PT_PTRACED;
+@@ -649,22 +677,11 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds
+ static int ptrace_setoptions(struct task_struct *child, unsigned long data)
+ {
+ unsigned flags;
++ int ret;
+
+- if (data & ~(unsigned long)PTRACE_O_MASK)
+- return -EINVAL;
+-
+- if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) {
+- if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) ||
+- !IS_ENABLED(CONFIG_SECCOMP))
+- return -EINVAL;
+-
+- if (!capable(CAP_SYS_ADMIN))
+- return -EPERM;
+-
+- if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED ||
+- current->ptrace & PT_SUSPEND_SECCOMP)
+- return -EPERM;
+- }
++ ret = check_ptrace_options(data);
++ if (ret)
++ return ret;
+
+ /* Avoid intermediate state when all opts are cleared */
+ flags = child->ptrace;
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index 9518606fa1e58..b1ef4f2e7edcb 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -871,25 +871,15 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf,
+ static void sched_show_numa(struct task_struct *p, struct seq_file *m)
+ {
+ #ifdef CONFIG_NUMA_BALANCING
+- struct mempolicy *pol;
+-
+ if (p->mm)
+ P(mm->numa_scan_seq);
+
+- task_lock(p);
+- pol = p->mempolicy;
+- if (pol && !(pol->flags & MPOL_F_MORON))
+- pol = NULL;
+- mpol_get(pol);
+- task_unlock(p);
+-
+ P(numa_pages_migrated);
+ P(numa_preferred_nid);
+ P(total_numa_faults);
+ SEQ_printf(m, "current_node=%d, numa_group_id=%d\n",
+ task_node(p), task_numa_group_id(p));
+ show_numa_stats(p, m);
+- mpol_put(pol);
+ #endif
+ }
+
+diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile
+index 79777645cac9c..e7b54ec8ca709 100644
+--- a/lib/raid6/test/Makefile
++++ b/lib/raid6/test/Makefile
+@@ -4,6 +4,8 @@
+ # from userspace.
+ #
+
++pound := \#
++
+ CC = gcc
+ OPTFLAGS = -O2 # Adjust as desired
+ CFLAGS = -I.. -I ../../../include -g $(OPTFLAGS)
+@@ -44,7 +46,7 @@ else ifeq ($(HAS_NEON),yes)
+ OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o
+ CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1
+ else
+- HAS_ALTIVEC := $(shell printf '\#include <altivec.h>\nvector int a;\n' |\
++ HAS_ALTIVEC := $(shell printf '$(pound)include <altivec.h>\nvector int a;\n' |\
+ gcc -c -x c - >/dev/null && rm ./-.o && echo yes)
+ ifeq ($(HAS_ALTIVEC),yes)
+ CFLAGS += -I../../../arch/powerpc/include
+diff --git a/lib/raid6/test/test.c b/lib/raid6/test/test.c
+index b07f4d8e6b033..a7e9372482996 100644
+--- a/lib/raid6/test/test.c
++++ b/lib/raid6/test/test.c
+@@ -22,7 +22,6 @@
+ #define NDISKS 16 /* Including P and Q */
+
+ const char raid6_empty_zero_page[PAGE_SIZE] __attribute__((aligned(PAGE_SIZE)));
+-struct raid6_calls raid6_call;
+
+ char *dataptrs[NDISKS];
+ char data[NDISKS][PAGE_SIZE] __attribute__((aligned(PAGE_SIZE)));
+diff --git a/lib/test_kmod.c b/lib/test_kmod.c
+index 87a0cc750ea23..6813b183aa348 100644
+--- a/lib/test_kmod.c
++++ b/lib/test_kmod.c
+@@ -1155,6 +1155,7 @@ static struct kmod_test_device *register_test_dev_kmod(void)
+ if (ret) {
+ pr_err("could not register misc device: %d\n", ret);
+ free_test_dev_kmod(test_dev);
++ test_dev = NULL;
+ goto out;
+ }
+
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 87cd5bf1b4874..f3aa6e6214d5e 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -6404,7 +6404,7 @@ static int __init cgroup_memory(char *s)
+ if (!strcmp(token, "nokmem"))
+ cgroup_memory_nokmem = true;
+ }
+- return 0;
++ return 1;
+ }
+ __setup("cgroup.memory=", cgroup_memory);
+
+diff --git a/mm/memory.c b/mm/memory.c
+index 1d03085fde02b..8cd80ba56474a 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1302,6 +1302,17 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
+ return ret;
+ }
+
++/* Whether we should zap all COWed (private) pages too */
++static inline bool should_zap_cows(struct zap_details *details)
++{
++ /* By default, zap all pages */
++ if (!details)
++ return true;
++
++ /* Or, we zap COWed pages only if the caller wants to */
++ return !details->check_mapping;
++}
++
+ static unsigned long zap_pte_range(struct mmu_gather *tlb,
+ struct vm_area_struct *vma, pmd_t *pmd,
+ unsigned long addr, unsigned long end,
+@@ -1390,17 +1401,19 @@ again:
+ continue;
+ }
+
+- /* If details->check_mapping, we leave swap entries. */
+- if (unlikely(details))
+- continue;
+-
+ entry = pte_to_swp_entry(ptent);
+- if (!non_swap_entry(entry))
++ if (!non_swap_entry(entry)) {
++ /* Genuine swap entry, hence a private anon page */
++ if (!should_zap_cows(details))
++ continue;
+ rss[MM_SWAPENTS]--;
+- else if (is_migration_entry(entry)) {
++ } else if (is_migration_entry(entry)) {
+ struct page *page;
+
+ page = migration_entry_to_page(entry);
++ if (details && details->check_mapping &&
++ details->check_mapping != page_rmapping(page))
++ continue;
+ rss[mm_counter(page)]--;
+ }
+ if (unlikely(!free_swap_and_cache(entry)))
+@@ -3416,11 +3429,20 @@ static vm_fault_t __do_fault(struct vm_fault *vmf)
+ return ret;
+
+ if (unlikely(PageHWPoison(vmf->page))) {
+- if (ret & VM_FAULT_LOCKED)
+- unlock_page(vmf->page);
+- put_page(vmf->page);
++ struct page *page = vmf->page;
++ vm_fault_t poisonret = VM_FAULT_HWPOISON;
++ if (ret & VM_FAULT_LOCKED) {
++ if (page_mapped(page))
++ unmap_mapping_pages(page_mapping(page),
++ page->index, 1, false);
++ /* Retry if a clean page was removed from the cache. */
++ if (invalidate_inode_page(page))
++ poisonret = VM_FAULT_NOPAGE;
++ unlock_page(page);
++ }
++ put_page(page);
+ vmf->page = NULL;
+- return VM_FAULT_HWPOISON;
++ return poisonret;
+ }
+
+ if (unlikely(!(ret & VM_FAULT_LOCKED)))
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 3cd27c1c729f6..5ada8897ef0ef 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -732,7 +732,6 @@ static int vma_replace_policy(struct vm_area_struct *vma,
+ static int mbind_range(struct mm_struct *mm, unsigned long start,
+ unsigned long end, struct mempolicy *new_pol)
+ {
+- struct vm_area_struct *next;
+ struct vm_area_struct *prev;
+ struct vm_area_struct *vma;
+ int err = 0;
+@@ -748,8 +747,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
+ if (start > vma->vm_start)
+ prev = vma;
+
+- for (; vma && vma->vm_start < end; prev = vma, vma = next) {
+- next = vma->vm_next;
++ for (; vma && vma->vm_start < end; prev = vma, vma = vma->vm_next) {
+ vmstart = max(start, vma->vm_start);
+ vmend = min(end, vma->vm_end);
+
+@@ -763,10 +761,6 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
+ new_pol, vma->vm_userfaultfd_ctx);
+ if (prev) {
+ vma = prev;
+- next = vma->vm_next;
+- if (mpol_equal(vma_policy(vma), new_pol))
+- continue;
+- /* vma_merge() joined vma && vma->next, case 8 */
+ goto replace;
+ }
+ if (vma->vm_start != vmstart) {
+@@ -2569,6 +2563,7 @@ alloc_new:
+ mpol_new = kmem_cache_alloc(policy_cache, GFP_KERNEL);
+ if (!mpol_new)
+ goto err_out;
++ atomic_set(&mpol_new->refcnt, 1);
+ goto restart;
+ }
+
+diff --git a/mm/mmap.c b/mm/mmap.c
+index f875386e7acd4..bb8ba32589459 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2469,7 +2469,7 @@ static int __init cmdline_parse_stack_guard_gap(char *p)
+ if (!*endptr)
+ stack_guard_gap = val << PAGE_SHIFT;
+
+- return 0;
++ return 1;
+ }
+ __setup("stack_guard_gap=", cmdline_parse_stack_guard_gap);
+
+diff --git a/mm/mremap.c b/mm/mremap.c
+index 33d8bbe24dddd..3cf9d77b33341 100644
+--- a/mm/mremap.c
++++ b/mm/mremap.c
+@@ -201,6 +201,9 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
+ unsigned long mmun_start; /* For mmu_notifiers */
+ unsigned long mmun_end; /* For mmu_notifiers */
+
++ if (!len)
++ return 0;
++
+ old_end = old_addr + len;
+ flush_cache_range(vma, old_addr, old_end);
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index afcaa657a0229..1a39fd6a73b88 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -6855,10 +6855,17 @@ restart:
+
+ out2:
+ /* Align start of ZONE_MOVABLE on all nids to MAX_ORDER_NR_PAGES */
+- for (nid = 0; nid < MAX_NUMNODES; nid++)
++ for (nid = 0; nid < MAX_NUMNODES; nid++) {
++ unsigned long start_pfn, end_pfn;
++
+ zone_movable_pfn[nid] =
+ roundup(zone_movable_pfn[nid], MAX_ORDER_NR_PAGES);
+
++ get_pfn_range_for_nid(nid, &start_pfn, &end_pfn);
++ if (zone_movable_pfn[nid] >= end_pfn)
++ zone_movable_pfn[nid] = 0;
++ }
++
+ out:
+ /* restore the node_state */
+ node_states[N_MEMORY] = saved_node_state;
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 699f445e3e78c..e578eb942317b 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -1594,7 +1594,30 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
+
+ /* MADV_FREE page check */
+ if (!PageSwapBacked(page)) {
+- if (!PageDirty(page)) {
++ int ref_count, map_count;
++
++ /*
++ * Synchronize with gup_pte_range():
++ * - clear PTE; barrier; read refcount
++ * - inc refcount; barrier; read PTE
++ */
++ smp_mb();
++
++ ref_count = page_ref_count(page);
++ map_count = page_mapcount(page);
++
++ /*
++ * Order reads for page refcount and dirty flag
++ * (see comments in __remove_mapping()).
++ */
++ smp_rmb();
++
++ /*
++ * The only page refs must be one from isolation
++ * plus the rmap(s) (dropped by discard:).
++ */
++ if (ref_count == 1 + map_count &&
++ !PageDirty(page)) {
+ /* Invalidate as we cleared the pte */
+ mmu_notifier_invalidate_range(mm,
+ address, address + PAGE_SIZE);
+diff --git a/mm/usercopy.c b/mm/usercopy.c
+index e81d11715d95b..a65fbc6282157 100644
+--- a/mm/usercopy.c
++++ b/mm/usercopy.c
+@@ -298,7 +298,10 @@ static bool enable_checks __initdata = true;
+
+ static int __init parse_hardened_usercopy(char *str)
+ {
+- return strtobool(str, &enable_checks);
++ if (strtobool(str, &enable_checks))
++ pr_warn("Invalid option string for hardened_usercopy: '%s'\n",
++ str);
++ return 1;
+ }
+
+ __setup("hardened_usercopy=", parse_hardened_usercopy);
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 196d0d8320070..dd7bf437d88e0 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -4792,8 +4792,9 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
+ hci_dev_lock(hdev);
+
+ hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
+- if (hcon) {
++ if (hcon && hcon->type == AMP_LINK) {
+ hcon->state = BT_CLOSED;
++ hci_disconn_cfm(hcon, ev->reason);
+ hci_conn_del(hcon);
+ }
+
+diff --git a/net/can/raw.c b/net/can/raw.c
+index d0fb5a57c66d5..2a6db8752b61d 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -814,7 +814,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ if (err < 0)
+ goto free_skb;
+
+- sock_tx_timestamp(sk, sk->sk_tsflags, &skb_shinfo(skb)->tx_flags);
++ skb_setup_tx_timestamp(skb, sk->sk_tsflags);
+
+ skb->dev = dev;
+ skb->sk = sk;
+diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
+index e90c89ef8c08a..b18b2a3c54ade 100644
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -1114,13 +1114,18 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev)
+ return err;
+ }
+
+-static int arp_invalidate(struct net_device *dev, __be32 ip)
++int arp_invalidate(struct net_device *dev, __be32 ip, bool force)
+ {
+ struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev);
+ int err = -ENXIO;
+ struct neigh_table *tbl = &arp_tbl;
+
+ if (neigh) {
++ if ((neigh->nud_state & NUD_VALID) && !force) {
++ neigh_release(neigh);
++ return 0;
++ }
++
+ if (neigh->nud_state & ~NUD_NOARP)
+ err = neigh_update(neigh, NULL, NUD_FAILED,
+ NEIGH_UPDATE_F_OVERRIDE|
+@@ -1167,7 +1172,7 @@ static int arp_req_delete(struct net *net, struct arpreq *r,
+ if (!dev)
+ return -EINVAL;
+ }
+- return arp_invalidate(dev, ip);
++ return arp_invalidate(dev, ip, true);
+ }
+
+ /*
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 70e5e9e5d8351..1885a2fbad862 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -917,9 +917,11 @@ void fib_add_ifaddr(struct in_ifaddr *ifa)
+ return;
+
+ /* Add broadcast address, if it is explicitly assigned. */
+- if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF))
++ if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) {
+ fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32,
+ prim, 0);
++ arp_invalidate(dev, ifa->ifa_broadcast, false);
++ }
+
+ if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags & IFA_F_SECONDARY) &&
+ (prefix != addr || ifa->ifa_prefixlen < 32)) {
+@@ -935,6 +937,7 @@ void fib_add_ifaddr(struct in_ifaddr *ifa)
+ prim, 0);
+ fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix | ~mask,
+ 32, prim, 0);
++ arp_invalidate(dev, prefix | ~mask, false);
+ }
+ }
+ }
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index 8cae691c3c9f4..654f586fc0d73 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -391,7 +391,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
+
+ skb->ip_summed = CHECKSUM_NONE;
+
+- sock_tx_timestamp(sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags);
++ skb_setup_tx_timestamp(skb, sockc->tsflags);
+
+ if (flags & MSG_CONFIRM)
+ skb_set_dst_pending_confirm(skb, 1);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index c97c027a8d773..97c3b616d594b 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3425,6 +3425,7 @@ static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb)
+ */
+ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
+ {
++ struct inet_connection_sock *icsk = inet_csk(sk);
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct tcp_fastopen_request *fo = tp->fastopen_req;
+ int space, err = 0;
+@@ -3439,8 +3440,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
+ * private TCP options. The cost is reduced data space in SYN :(
+ */
+ tp->rx_opt.mss_clamp = tcp_mss_clamp(tp, tp->rx_opt.mss_clamp);
++ /* Sync mss_cache after updating the mss_clamp */
++ tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
+
+- space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -
++ space = __tcp_mtu_to_mss(sk, icsk->icsk_pmtu_cookie) -
+ MAX_TCP_OPTION_SPACE;
+
+ space = min_t(size_t, space, fo->size);
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 98c8f98a7660e..ad7bd40b6d533 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -660,7 +660,7 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
+
+ skb->ip_summed = CHECKSUM_NONE;
+
+- sock_tx_timestamp(sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags);
++ skb_setup_tx_timestamp(skb, sockc->tsflags);
+
+ if (flags & MSG_CONFIRM)
+ skb_set_dst_pending_confirm(skb, 1);
+diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
+index b5941c9475f36..fbcec48270712 100644
+--- a/net/ipv6/xfrm6_output.c
++++ b/net/ipv6/xfrm6_output.c
+@@ -142,6 +142,19 @@ static int __xfrm6_output_finish(struct net *net, struct sock *sk, struct sk_buf
+ return x->outer_mode->afinfo->output_finish(sk, skb);
+ }
+
++static int xfrm6_noneed_fragment(struct sk_buff *skb)
++{
++ struct frag_hdr *fh;
++ u8 prevhdr = ipv6_hdr(skb)->nexthdr;
++
++ if (prevhdr != NEXTHDR_FRAGMENT)
++ return 0;
++ fh = (struct frag_hdr *)(skb->data + sizeof(struct ipv6hdr));
++ if (fh->nexthdr == NEXTHDR_ESP || fh->nexthdr == NEXTHDR_AUTH)
++ return 1;
++ return 0;
++}
++
+ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+ struct dst_entry *dst = skb_dst(skb);
+@@ -170,6 +183,9 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+ xfrm6_local_rxpmtu(skb, mtu);
+ kfree_skb(skb);
+ return -EMSGSIZE;
++ } else if (toobig && xfrm6_noneed_fragment(skb)) {
++ skb->ignore_df = 1;
++ goto skip_frag;
+ } else if (!skb->ignore_df && toobig && skb->sk) {
+ xfrm_local_error(skb, mtu);
+ kfree_skb(skb);
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 388910cf09781..a416c0f900567 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1709,7 +1709,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad
+
+ xfrm_probe_algs();
+
+- supp_skb = compose_sadb_supported(hdr, GFP_KERNEL);
++ supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO);
+ if (!supp_skb) {
+ if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC)
+ pfk->registered &= ~(1<<hdr->sadb_msg_satype);
+@@ -2413,7 +2413,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa
+ return err;
+ }
+
+- xp = xfrm_policy_bysel_ctx(net, DUMMY_MARK, 0, XFRM_POLICY_TYPE_MAIN,
++ xp = xfrm_policy_bysel_ctx(net, &dummy_mark, 0, XFRM_POLICY_TYPE_MAIN,
+ pol->sadb_x_policy_dir - 1, &sel, pol_ctx,
+ 1, &err);
+ security_xfrm_policy_free(pol_ctx);
+@@ -2664,7 +2664,7 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, const struct sadb_
+ return -EINVAL;
+
+ delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2);
+- xp = xfrm_policy_byid(net, DUMMY_MARK, 0, XFRM_POLICY_TYPE_MAIN,
++ xp = xfrm_policy_byid(net, &dummy_mark, 0, XFRM_POLICY_TYPE_MAIN,
+ dir, pol->sadb_x_policy_id, delete, &err);
+ if (xp == NULL)
+ return -ENOENT;
+diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
+index 40f8a1252394b..66cda5e2d6b9e 100644
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -362,8 +362,8 @@ static void tcp_options(const struct sk_buff *skb,
+ length, buff);
+ BUG_ON(ptr == NULL);
+
+- state->td_scale =
+- state->flags = 0;
++ state->td_scale = 0;
++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;
+
+ while (length > 0) {
+ int opcode=*ptr++;
+@@ -784,6 +784,16 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct)
+ test_bit(IPS_ASSURED_BIT, &ct->status);
+ }
+
++static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state)
++{
++ state->td_end = 0;
++ state->td_maxend = 0;
++ state->td_maxwin = 0;
++ state->td_maxack = 0;
++ state->td_scale = 0;
++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL;
++}
++
+ /* Returns verdict for packet, or -1 for invalid. */
+ static int tcp_packet(struct nf_conn *ct,
+ const struct sk_buff *skb,
+@@ -882,8 +892,7 @@ static int tcp_packet(struct nf_conn *ct,
+ ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK;
+ ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags =
+ ct->proto.tcp.last_flags;
+- memset(&ct->proto.tcp.seen[dir], 0,
+- sizeof(struct ip_ct_tcp_state));
++ nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]);
+ break;
+ }
+ ct->proto.tcp.last_index = index;
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index a7497361e4d78..5c6241964637f 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -152,6 +152,8 @@ static const struct rhashtable_params netlink_rhashtable_params;
+
+ static inline u32 netlink_group_mask(u32 group)
+ {
++ if (group > 32)
++ return 0;
+ return group ? 1 << (group - 1) : 0;
+ }
+
+diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
+index 100cc09c100d9..8b75afe412842 100644
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -1098,7 +1098,7 @@ static int clone(struct datapath *dp, struct sk_buff *skb,
+ int rem = nla_len(attr);
+ bool dont_clone_flow_key;
+
+- /* The first action is always 'OVS_CLONE_ATTR_ARG'. */
++ /* The first action is always 'OVS_CLONE_ATTR_EXEC'. */
+ clone_arg = nla_data(attr);
+ dont_clone_flow_key = nla_get_u32(clone_arg);
+ actions = nla_next(clone_arg, &rem);
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index eab5e8eaddaaf..4413ffdc1e030 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -2166,8 +2166,8 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
+ icmpv6_key->icmpv6_type = ntohs(output->tp.src);
+ icmpv6_key->icmpv6_code = ntohs(output->tp.dst);
+
+- if (icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_SOLICITATION ||
+- icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) {
++ if (swkey->tp.src == htons(NDISC_NEIGHBOUR_SOLICITATION) ||
++ swkey->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
+ struct ovs_key_nd *nd_key;
+
+ nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key));
+@@ -3173,7 +3173,9 @@ static int clone_action_to_attr(const struct nlattr *attr,
+ if (!start)
+ return -EMSGSIZE;
+
+- err = ovs_nla_put_actions(nla_data(attr), rem, skb);
++ /* Skipping the OVS_CLONE_ATTR_EXEC that is always the first attribute. */
++ attr = nla_next(nla_data(attr), &rem);
++ err = ovs_nla_put_actions(attr, rem, skb);
+
+ if (err)
+ nla_nest_cancel(skb, start);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index d65051959f852..b951f411ddedc 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1978,7 +1978,7 @@ retry:
+ skb->mark = sk->sk_mark;
+ skb->tstamp = sockc.transmit_time;
+
+- sock_tx_timestamp(sk, sockc.tsflags, &skb_shinfo(skb)->tx_flags);
++ skb_setup_tx_timestamp(skb, sockc.tsflags);
+
+ if (unlikely(extra_len == 4))
+ skb->no_fcs = 1;
+@@ -2501,7 +2501,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
+ skb->priority = po->sk.sk_priority;
+ skb->mark = po->sk.sk_mark;
+ skb->tstamp = sockc->transmit_time;
+- sock_tx_timestamp(&po->sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags);
++ skb_setup_tx_timestamp(skb, sockc->tsflags);
+ skb_zcopy_set_nouarg(skb, ph.raw);
+
+ skb_reserve(skb, hlen);
+@@ -2965,7 +2965,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ goto out_free;
+ }
+
+- sock_tx_timestamp(sk, sockc.tsflags, &skb_shinfo(skb)->tx_flags);
++ skb_setup_tx_timestamp(skb, sockc.tsflags);
+
+ if (!vnet_hdr.gso_type && (len > dev->mtu + reserve + extra_len) &&
+ !packet_extra_vlan_len_allowed(dev, skb)) {
+diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c
+index 417d80867c4f4..1b403c2573da2 100644
+--- a/net/rxrpc/net_ns.c
++++ b/net/rxrpc/net_ns.c
+@@ -117,8 +117,8 @@ static __net_exit void rxrpc_exit_net(struct net *net)
+ struct rxrpc_net *rxnet = rxrpc_net(net);
+
+ rxnet->live = false;
+- del_timer_sync(&rxnet->peer_keepalive_timer);
+ cancel_work_sync(&rxnet->peer_keepalive_work);
++ del_timer_sync(&rxnet->peer_keepalive_timer);
+ rxrpc_destroy_all_calls(rxnet);
+ rxrpc_destroy_all_connections(rxnet);
+ rxrpc_destroy_all_peers(rxnet);
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index 6add3094ea9e7..4d421407d6fc6 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -709,7 +709,7 @@ static struct smc_buf_desc *smc_buf_get_slot(int compressed_bufsize,
+ */
+ static inline int smc_rmb_wnd_update_limit(int rmbe_size)
+ {
+- return min_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2);
++ return max_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2);
+ }
+
+ static struct smc_buf_desc *smcr_new_buf_create(struct smc_link_group *lgr,
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index e339f8da1b0a7..e36ae4d4b540c 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -893,8 +893,10 @@ int rpc_malloc(struct rpc_task *task)
+ struct rpc_buffer *buf;
+ gfp_t gfp = GFP_NOIO | __GFP_NOWARN;
+
++ if (RPC_IS_ASYNC(task))
++ gfp = GFP_NOWAIT | __GFP_NOWARN;
+ if (RPC_IS_SWAPPER(task))
+- gfp = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN;
++ gfp |= __GFP_MEMALLOC;
+
+ size += sizeof(struct rpc_buffer);
+ if (size <= RPC_BUFFER_MAXSIZE)
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index 9c4235ce57894..d05fa7c36d001 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -1545,7 +1545,14 @@ static void xprt_destroy(struct rpc_xprt *xprt)
+ */
+ wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_UNINTERRUPTIBLE);
+
++ /*
++ * xprt_schedule_autodisconnect() can run after XPRT_LOCKED
++ * is cleared. We use ->transport_lock to ensure the mod_timer()
++ * can only run *before* del_time_sync(), never after.
++ */
++ spin_lock(&xprt->transport_lock);
+ del_timer_sync(&xprt->timer);
++ spin_unlock(&xprt->transport_lock);
+
+ /*
+ * Destroy sockets etc from the system workqueue so they can
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index fdd14908eacbd..e87a79be7ef02 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -665,8 +665,10 @@ xprt_rdma_allocate(struct rpc_task *task)
+ gfp_t flags;
+
+ flags = RPCRDMA_DEF_GFP;
++ if (RPC_IS_ASYNC(task))
++ flags = GFP_NOWAIT | __GFP_NOWARN;
+ if (RPC_IS_SWAPPER(task))
+- flags = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN;
++ flags |= __GFP_MEMALLOC;
+
+ if (!rpcrdma_get_sendbuf(r_xprt, req, rqst->rq_callsize, flags))
+ goto out_fail;
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index f870027928363..77d8adb27ec76 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -1797,10 +1797,15 @@ void x25_kill_by_neigh(struct x25_neigh *nb)
+
+ write_lock_bh(&x25_list_lock);
+
+- sk_for_each(s, &x25_list)
+- if (x25_sk(s)->neighbour == nb)
++ sk_for_each(s, &x25_list) {
++ if (x25_sk(s)->neighbour == nb) {
++ write_unlock_bh(&x25_list_lock);
++ lock_sock(s);
+ x25_disconnect(s, ENETUNREACH, 0, 0);
+-
++ release_sock(s);
++ write_lock_bh(&x25_list_lock);
++ }
++ }
+ write_unlock_bh(&x25_list_lock);
+
+ /* Remove any related forwards */
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 1ae8caca28a06..3c642328a117c 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -300,7 +300,10 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ if (mtu < IPV6_MIN_MTU)
+ mtu = IPV6_MIN_MTU;
+
+- icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
++ if (skb->len > 1280)
++ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
++ else
++ goto xmit;
+ } else {
+ if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
+ goto xmit;
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index ab6d0c6576a6b..bb1c94e20e820 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -727,14 +727,10 @@ static void xfrm_policy_requeue(struct xfrm_policy *old,
+ spin_unlock_bh(&pq->hold_queue.lock);
+ }
+
+-static bool xfrm_policy_mark_match(struct xfrm_policy *policy,
+- struct xfrm_policy *pol)
++static inline bool xfrm_policy_mark_match(const struct xfrm_mark *mark,
++ struct xfrm_policy *pol)
+ {
+- if (policy->mark.v == pol->mark.v &&
+- policy->priority == pol->priority)
+- return true;
+-
+- return false;
++ return mark->v == pol->mark.v && mark->m == pol->mark.m;
+ }
+
+ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
+@@ -753,7 +749,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
+ if (pol->type == policy->type &&
+ pol->if_id == policy->if_id &&
+ !selector_cmp(&pol->selector, &policy->selector) &&
+- xfrm_policy_mark_match(policy, pol) &&
++ xfrm_policy_mark_match(&policy->mark, pol) &&
+ xfrm_sec_ctx_match(pol->security, policy->security) &&
+ !WARN_ON(delpol)) {
+ if (excl) {
+@@ -803,11 +799,10 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
+ }
+ EXPORT_SYMBOL(xfrm_policy_insert);
+
+-struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
+- u8 type, int dir,
+- struct xfrm_selector *sel,
+- struct xfrm_sec_ctx *ctx, int delete,
+- int *err)
++struct xfrm_policy *
++xfrm_policy_bysel_ctx(struct net *net, const struct xfrm_mark *mark, u32 if_id,
++ u8 type, int dir, struct xfrm_selector *sel,
++ struct xfrm_sec_ctx *ctx, int delete, int *err)
+ {
+ struct xfrm_policy *pol, *ret;
+ struct hlist_head *chain;
+@@ -819,7 +814,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
+ hlist_for_each_entry(pol, chain, bydst) {
+ if (pol->type == type &&
+ pol->if_id == if_id &&
+- (mark & pol->mark.m) == pol->mark.v &&
++ xfrm_policy_mark_match(mark, pol) &&
+ !selector_cmp(sel, &pol->selector) &&
+ xfrm_sec_ctx_match(ctx, pol->security)) {
+ xfrm_pol_hold(pol);
+@@ -844,9 +839,9 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
+ }
+ EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
+
+-struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id,
+- u8 type, int dir, u32 id, int delete,
+- int *err)
++struct xfrm_policy *
++xfrm_policy_byid(struct net *net, const struct xfrm_mark *mark, u32 if_id,
++ u8 type, int dir, u32 id, int delete, int *err)
+ {
+ struct xfrm_policy *pol, *ret;
+ struct hlist_head *chain;
+@@ -861,8 +856,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id,
+ ret = NULL;
+ hlist_for_each_entry(pol, chain, byidx) {
+ if (pol->type == type && pol->index == id &&
+- pol->if_id == if_id &&
+- (mark & pol->mark.m) == pol->mark.v) {
++ pol->if_id == if_id && xfrm_policy_mark_match(mark, pol)) {
+ xfrm_pol_hold(pol);
+ if (delete) {
+ *err = security_xfrm_policy_delete(
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 3db5cd70b16ac..94c7ebc26c48e 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1862,7 +1862,6 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+ struct km_event c;
+ int delete;
+ struct xfrm_mark m;
+- u32 mark = xfrm_mark_get(attrs, &m);
+ u32 if_id = 0;
+
+ p = nlmsg_data(nlh);
+@@ -1879,8 +1878,11 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (attrs[XFRMA_IF_ID])
+ if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
+
++ xfrm_mark_get(attrs, &m);
++
+ if (p->index)
+- xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, delete, &err);
++ xp = xfrm_policy_byid(net, &m, if_id, type, p->dir,
++ p->index, delete, &err);
+ else {
+ struct nlattr *rt = attrs[XFRMA_SEC_CTX];
+ struct xfrm_sec_ctx *ctx;
+@@ -1897,8 +1899,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (err)
+ return err;
+ }
+- xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir, &p->sel,
+- ctx, delete, &err);
++ xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
++ &p->sel, ctx, delete, &err);
+ security_xfrm_policy_free(ctx);
+ }
+ if (xp == NULL)
+@@ -2165,7 +2167,6 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
+ u8 type = XFRM_POLICY_TYPE_MAIN;
+ int err = -ENOENT;
+ struct xfrm_mark m;
+- u32 mark = xfrm_mark_get(attrs, &m);
+ u32 if_id = 0;
+
+ err = copy_from_user_policy_type(&type, attrs);
+@@ -2179,8 +2180,11 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (attrs[XFRMA_IF_ID])
+ if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
+
++ xfrm_mark_get(attrs, &m);
++
+ if (p->index)
+- xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, 0, &err);
++ xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, p->index,
++ 0, &err);
+ else {
+ struct nlattr *rt = attrs[XFRMA_SEC_CTX];
+ struct xfrm_sec_ctx *ctx;
+@@ -2197,7 +2201,7 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if (err)
+ return err;
+ }
+- xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir,
++ xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
+ &p->sel, ctx, 0, &err);
+ security_xfrm_policy_free(ctx);
+ }
+diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
+index 91dc3783ed944..9e803d2a687a6 100644
+--- a/security/selinux/xfrm.c
++++ b/security/selinux/xfrm.c
+@@ -349,7 +349,7 @@ int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
+ int rc;
+ struct xfrm_sec_ctx *ctx;
+ char *ctx_str = NULL;
+- int str_len;
++ u32 str_len;
+
+ if (!polsec)
+ return 0;
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 221de4c755c31..4f65d953fe318 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2586,7 +2586,7 @@ static int smk_ipv6_check(struct smack_known *subject,
+ #ifdef CONFIG_AUDIT
+ smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+ ad.a.u.net->family = PF_INET6;
+- ad.a.u.net->dport = ntohs(address->sin6_port);
++ ad.a.u.net->dport = address->sin6_port;
+ if (act == SMK_RECEIVING)
+ ad.a.u.net->v6info.saddr = address->sin6_addr;
+ else
+diff --git a/security/tomoyo/load_policy.c b/security/tomoyo/load_policy.c
+index 81b9516520511..f8baef1f32775 100644
+--- a/security/tomoyo/load_policy.c
++++ b/security/tomoyo/load_policy.c
+@@ -24,7 +24,7 @@ static const char *tomoyo_loader;
+ static int __init tomoyo_loader_setup(char *str)
+ {
+ tomoyo_loader = str;
+- return 0;
++ return 1;
+ }
+
+ __setup("TOMOYO_loader=", tomoyo_loader_setup);
+@@ -63,7 +63,7 @@ static const char *tomoyo_trigger;
+ static int __init tomoyo_trigger_setup(char *str)
+ {
+ tomoyo_trigger = str;
+- return 0;
++ return 1;
+ }
+
+ __setup("TOMOYO_trigger=", tomoyo_trigger_setup);
+diff --git a/sound/firewire/fcp.c b/sound/firewire/fcp.c
+index 61dda828f767b..c8fbb54269cb1 100644
+--- a/sound/firewire/fcp.c
++++ b/sound/firewire/fcp.c
+@@ -240,9 +240,7 @@ int fcp_avc_transaction(struct fw_unit *unit,
+ t.response_match_bytes = response_match_bytes;
+ t.state = STATE_PENDING;
+ init_waitqueue_head(&t.wait);
+-
+- if (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03)
+- t.deferrable = true;
++ t.deferrable = (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03);
+
+ spin_lock_irq(&transactions_lock);
+ list_add_tail(&t.list, &transactions);
+diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c
+index 7d4e18cb63510..6fff77fe34a8e 100644
+--- a/sound/isa/cs423x/cs4236.c
++++ b/sound/isa/cs423x/cs4236.c
+@@ -559,7 +559,7 @@ static int snd_cs423x_pnpbios_detect(struct pnp_dev *pdev,
+ static int dev;
+ int err;
+ struct snd_card *card;
+- struct pnp_dev *cdev;
++ struct pnp_dev *cdev, *iter;
+ char cid[PNP_ID_LEN];
+
+ if (pnp_device_is_isapnp(pdev))
+@@ -575,9 +575,11 @@ static int snd_cs423x_pnpbios_detect(struct pnp_dev *pdev,
+ strcpy(cid, pdev->id[0].id);
+ cid[5] = '1';
+ cdev = NULL;
+- list_for_each_entry(cdev, &(pdev->protocol->devices), protocol_list) {
+- if (!strcmp(cdev->id[0].id, cid))
++ list_for_each_entry(iter, &(pdev->protocol->devices), protocol_list) {
++ if (!strcmp(iter->id[0].id, cid)) {
++ cdev = iter;
+ break;
++ }
+ }
+ err = snd_cs423x_card_new(&pdev->dev, dev, &card);
+ if (err < 0)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 459f629fa0a86..3f9c2b1e3be63 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3400,8 +3400,8 @@ static void alc256_shutup(struct hda_codec *codec)
+ /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
+ * when booting with headset plugged. So skip setting it for the codec alc257
+ */
+- if (spec->codec_variant != ALC269_TYPE_ALC257 &&
+- spec->codec_variant != ALC269_TYPE_ALC256)
++ if (codec->core.vendor_id != 0x10ec0236 &&
++ codec->core.vendor_id != 0x10ec0257)
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+ if (!spec->no_shutup_pins)
+diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
+index d3b69682d9c22..7272f00222fd2 100644
+--- a/sound/soc/atmel/atmel_ssc_dai.c
++++ b/sound/soc/atmel/atmel_ssc_dai.c
+@@ -296,7 +296,10 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream,
+
+ /* Enable PMC peripheral clock for this SSC */
+ pr_debug("atmel_ssc_dai: Starting clock\n");
+- clk_enable(ssc_p->ssc->clk);
++ ret = clk_enable(ssc_p->ssc->clk);
++ if (ret)
++ return ret;
++
+ ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk);
+
+ /* Reset the SSC unless initialized to keep it in a clean state */
+diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c
+index 98f93e79c6547..5041f43ee5f79 100644
+--- a/sound/soc/atmel/sam9g20_wm8731.c
++++ b/sound/soc/atmel/sam9g20_wm8731.c
+@@ -225,6 +225,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev)
+ cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0);
+ if (!cpu_np) {
+ dev_err(&pdev->dev, "dai and pcm info missing\n");
++ of_node_put(codec_np);
+ return -EINVAL;
+ }
+ at91sam9g20ek_dai.cpu_of_node = cpu_np;
+diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c
+index 6de2ab6f97068..e6750bda542a9 100644
+--- a/sound/soc/codecs/msm8916-wcd-digital.c
++++ b/sound/soc/codecs/msm8916-wcd-digital.c
+@@ -918,7 +918,7 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev)
+ ret = clk_prepare_enable(priv->mclk);
+ if (ret < 0) {
+ dev_err(dev, "failed to enable mclk %d\n", ret);
+- return ret;
++ goto err_clk;
+ }
+
+ dev_set_drvdata(dev, priv);
+@@ -926,6 +926,9 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev)
+ return devm_snd_soc_register_component(dev, &msm8916_wcd_digital,
+ msm8916_wcd_digital_dai,
+ ARRAY_SIZE(msm8916_wcd_digital_dai));
++err_clk:
++ clk_disable_unprepare(priv->ahbclk);
++ return ret;
+ }
+
+ static int msm8916_wcd_digital_remove(struct platform_device *pdev)
+diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c
+index dd77f131ce6c5..b92e1b6ed3830 100644
+--- a/sound/soc/codecs/rt5663.c
++++ b/sound/soc/codecs/rt5663.c
+@@ -3463,6 +3463,8 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev)
+ table_size = sizeof(struct impedance_mapping_table) *
+ rt5663->pdata.impedance_sensing_num;
+ rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL);
++ if (!rt5663->imp_table)
++ return -ENOMEM;
+ ret = device_property_read_u32_array(dev,
+ "realtek,impedance_sensing_table",
+ (u32 *)rt5663->imp_table, table_size);
+diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c
+index e92ebe52d485d..707b31ef93466 100644
+--- a/sound/soc/codecs/wm8350.c
++++ b/sound/soc/codecs/wm8350.c
+@@ -1538,18 +1538,38 @@ static int wm8350_component_probe(struct snd_soc_component *component)
+ wm8350_clear_bits(wm8350, WM8350_JACK_DETECT,
+ WM8350_JDL_ENA | WM8350_JDR_ENA);
+
+- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L,
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L,
+ wm8350_hpl_jack_handler, 0, "Left jack detect",
+ priv);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R,
++ if (ret != 0)
++ goto err;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R,
+ wm8350_hpr_jack_handler, 0, "Right jack detect",
+ priv);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD,
++ if (ret != 0)
++ goto free_jck_det_l;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD,
+ wm8350_mic_handler, 0, "Microphone short", priv);
+- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD,
++ if (ret != 0)
++ goto free_jck_det_r;
++
++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD,
+ wm8350_mic_handler, 0, "Microphone detect", priv);
++ if (ret != 0)
++ goto free_micscd;
+
+ return 0;
++
++free_micscd:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, priv);
++free_jck_det_r:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, priv);
++free_jck_det_l:
++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, priv);
++err:
++ return ret;
+ }
+
+ static void wm8350_component_remove(struct snd_soc_component *component)
+diff --git a/sound/soc/davinci/davinci-i2s.c b/sound/soc/davinci/davinci-i2s.c
+index a3206e65e5e54..205841e46046a 100644
+--- a/sound/soc/davinci/davinci-i2s.c
++++ b/sound/soc/davinci/davinci-i2s.c
+@@ -721,7 +721,9 @@ static int davinci_i2s_probe(struct platform_device *pdev)
+ dev->clk = clk_get(&pdev->dev, NULL);
+ if (IS_ERR(dev->clk))
+ return -ENODEV;
+- clk_enable(dev->clk);
++ ret = clk_enable(dev->clk);
++ if (ret)
++ goto err_put_clk;
+
+ dev->dev = &pdev->dev;
+ dev_set_drvdata(&pdev->dev, dev);
+@@ -743,6 +745,7 @@ err_unregister_component:
+ snd_soc_unregister_component(&pdev->dev);
+ err_release_clk:
+ clk_disable(dev->clk);
++err_put_clk:
+ clk_put(dev->clk);
+ return ret;
+ }
+diff --git a/sound/soc/fsl/imx-es8328.c b/sound/soc/fsl/imx-es8328.c
+index 9953438086e47..735693274f495 100644
+--- a/sound/soc/fsl/imx-es8328.c
++++ b/sound/soc/fsl/imx-es8328.c
+@@ -93,6 +93,7 @@ static int imx_es8328_probe(struct platform_device *pdev)
+ if (int_port > MUX_PORT_MAX || int_port == 0) {
+ dev_err(dev, "mux-int-port: hardware only has %d mux ports\n",
+ MUX_PORT_MAX);
++ ret = -EINVAL;
+ goto fail;
+ }
+
+diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c
+index 156aa7c007878..93c0196701998 100644
+--- a/sound/soc/mxs/mxs-saif.c
++++ b/sound/soc/mxs/mxs-saif.c
+@@ -467,7 +467,10 @@ static int mxs_saif_hw_params(struct snd_pcm_substream *substream,
+ * basic clock which should be fast enough for the internal
+ * logic.
+ */
+- clk_enable(saif->clk);
++ ret = clk_enable(saif->clk);
++ if (ret)
++ return ret;
++
+ ret = clk_set_rate(saif->clk, 24000000);
+ clk_disable(saif->clk);
+ if (ret)
+diff --git a/sound/soc/mxs/mxs-sgtl5000.c b/sound/soc/mxs/mxs-sgtl5000.c
+index 2b3f2408301af..c40e0ab49657f 100644
+--- a/sound/soc/mxs/mxs-sgtl5000.c
++++ b/sound/soc/mxs/mxs-sgtl5000.c
+@@ -120,6 +120,9 @@ static int mxs_sgtl5000_probe(struct platform_device *pdev)
+ codec_np = of_parse_phandle(np, "audio-codec", 0);
+ if (!saif_np[0] || !saif_np[1] || !codec_np) {
+ dev_err(&pdev->dev, "phandle missing or invalid\n");
++ of_node_put(codec_np);
++ of_node_put(saif_np[0]);
++ of_node_put(saif_np[1]);
+ return -EINVAL;
+ }
+
+diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c
+index aa7e902f0c025..f486e2b2c540c 100644
+--- a/sound/soc/sh/fsi.c
++++ b/sound/soc/sh/fsi.c
+@@ -816,14 +816,27 @@ static int fsi_clk_enable(struct device *dev,
+ return ret;
+ }
+
+- clk_enable(clock->xck);
+- clk_enable(clock->ick);
+- clk_enable(clock->div);
++ ret = clk_enable(clock->xck);
++ if (ret)
++ goto err;
++ ret = clk_enable(clock->ick);
++ if (ret)
++ goto disable_xck;
++ ret = clk_enable(clock->div);
++ if (ret)
++ goto disable_ick;
+
+ clock->count++;
+ }
+
+ return ret;
++
++disable_ick:
++ clk_disable(clock->ick);
++disable_xck:
++ clk_disable(clock->xck);
++err:
++ return ret;
+ }
+
+ static int fsi_clk_disable(struct device *dev,
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 273898b358c4b..9ca7dff5593d1 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -3708,7 +3708,7 @@ int snd_soc_get_dai_name(struct of_phandle_args *args,
+ if (!component_of_node && pos->dev->parent)
+ component_of_node = pos->dev->parent->of_node;
+
+- if (component_of_node != args->np)
++ if (component_of_node != args->np || !pos->num_dai)
+ continue;
+
+ if (pos->driver->of_xlate_dai_name) {
+diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c
+index 232df04ca5866..45cce7376191c 100644
+--- a/sound/soc/soc-generic-dmaengine-pcm.c
++++ b/sound/soc/soc-generic-dmaengine-pcm.c
+@@ -91,10 +91,10 @@ static int dmaengine_pcm_hw_params(struct snd_pcm_substream *substream,
+
+ memset(&slave_config, 0, sizeof(slave_config));
+
+- if (!pcm->config)
+- prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config;
+- else
++ if (pcm->config && pcm->config->prepare_slave_config)
+ prepare_slave_config = pcm->config->prepare_slave_config;
++ else
++ prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config;
+
+ if (prepare_slave_config) {
+ ret = prepare_slave_config(substream, params, &slave_config);
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index ccf6dd9411975..776250feb3008 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -547,7 +547,8 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr,
+
+ if (hdr->ops.info == SND_SOC_TPLG_CTL_BYTES
+ && k->iface & SNDRV_CTL_ELEM_IFACE_MIXER
+- && k->access & SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE
++ && (k->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ
++ || k->access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE)
+ && k->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) {
+ struct soc_bytes_ext *sbe;
+ struct snd_soc_tplg_bytes_control *be;
+diff --git a/sound/spi/at73c213.c b/sound/spi/at73c213.c
+index 1ef52edeb5384..3763f06ed7845 100644
+--- a/sound/spi/at73c213.c
++++ b/sound/spi/at73c213.c
+@@ -221,7 +221,9 @@ static int snd_at73c213_pcm_open(struct snd_pcm_substream *substream)
+ runtime->hw = snd_at73c213_playback_hw;
+ chip->substream = substream;
+
+- clk_enable(chip->ssc->clk);
++ err = clk_enable(chip->ssc->clk);
++ if (err)
++ return err;
+
+ return 0;
+ }
+@@ -787,7 +789,9 @@ static int snd_at73c213_chip_init(struct snd_at73c213 *chip)
+ goto out;
+
+ /* Enable DAC master clock. */
+- clk_enable(chip->board->dac_clk);
++ retval = clk_enable(chip->board->dac_clk);
++ if (retval)
++ goto out;
+
+ /* Initialize at73c213 on SPI bus. */
+ retval = snd_at73c213_write_reg(chip, DAC_RST, 0x04);
+@@ -900,7 +904,9 @@ static int snd_at73c213_dev_init(struct snd_card *card,
+ chip->card = card;
+ chip->irq = -1;
+
+- clk_enable(chip->ssc->clk);
++ retval = clk_enable(chip->ssc->clk);
++ if (retval)
++ return retval;
+
+ retval = request_irq(irq, snd_at73c213_interrupt, 0, "at73c213", chip);
+ if (retval) {
+@@ -1019,7 +1025,9 @@ static int snd_at73c213_remove(struct spi_device *spi)
+ int retval;
+
+ /* Stop playback. */
+- clk_enable(chip->ssc->clk);
++ retval = clk_enable(chip->ssc->clk);
++ if (retval)
++ goto out;
+ ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXDIS));
+ clk_disable(chip->ssc->clk);
+
+@@ -1099,9 +1107,16 @@ static int snd_at73c213_resume(struct device *dev)
+ {
+ struct snd_card *card = dev_get_drvdata(dev);
+ struct snd_at73c213 *chip = card->private_data;
++ int retval;
+
+- clk_enable(chip->board->dac_clk);
+- clk_enable(chip->ssc->clk);
++ retval = clk_enable(chip->board->dac_clk);
++ if (retval)
++ return retval;
++ retval = clk_enable(chip->ssc->clk);
++ if (retval) {
++ clk_disable(chip->board->dac_clk);
++ return retval;
++ }
+ ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXEN));
+
+ return 0;
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index 6696a4b79614a..763ee60ac0db8 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -193,9 +193,16 @@ strip-libs = $(filter-out -l%,$(1))
+ PERL_EMBED_LDOPTS = $(shell perl -MExtUtils::Embed -e ldopts 2>/dev/null)
+ PERL_EMBED_LDFLAGS = $(call strip-libs,$(PERL_EMBED_LDOPTS))
+ PERL_EMBED_LIBADD = $(call grep-libs,$(PERL_EMBED_LDOPTS))
+-PERL_EMBED_CCOPTS = `perl -MExtUtils::Embed -e ccopts 2>/dev/null`
++PERL_EMBED_CCOPTS = $(shell perl -MExtUtils::Embed -e ccopts 2>/dev/null)
+ FLAGS_PERL_EMBED=$(PERL_EMBED_CCOPTS) $(PERL_EMBED_LDOPTS)
+
++ifeq ($(CC_NO_CLANG), 0)
++ PERL_EMBED_LDOPTS := $(filter-out -specs=%,$(PERL_EMBED_LDOPTS))
++ PERL_EMBED_CCOPTS := $(filter-out -flto=auto -ffat-lto-objects, $(PERL_EMBED_CCOPTS))
++ PERL_EMBED_CCOPTS := $(filter-out -specs=%,$(PERL_EMBED_CCOPTS))
++ FLAGS_PERL_EMBED += -Wno-compound-token-split-by-macro
++endif
++
+ $(OUTPUT)test-libperl.bin:
+ $(BUILD) $(FLAGS_PERL_EMBED)
+
+diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
+index 9e060c6a01ac2..0c30ab898e2a5 100644
+--- a/tools/include/uapi/linux/bpf.h
++++ b/tools/include/uapi/linux/bpf.h
+@@ -1205,8 +1205,8 @@ union bpf_attr {
+ * Return
+ * The return value depends on the result of the test, and can be:
+ *
+- * * 0, if current task belongs to the cgroup2.
+- * * 1, if current task does not belong to the cgroup2.
++ * * 1, if current task belongs to the cgroup2.
++ * * 0, if current task does not belong to the cgroup2.
+ * * A negative error code, if an error occurred.
+ *
+ * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags)
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index 8e59b42119176..878e49849bfdf 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -662,6 +662,9 @@ else
+ LDFLAGS += $(PERL_EMBED_LDFLAGS)
+ EXTLIBS += $(PERL_EMBED_LIBADD)
+ CFLAGS += -DHAVE_LIBPERL_SUPPORT
++ ifeq ($(CC_NO_CLANG), 0)
++ CFLAGS += -Wno-compound-token-split-by-macro
++ endif
+ $(call detected,CONFIG_LIBPERL)
+ endif
+ endif
+diff --git a/tools/testing/selftests/bpf/test_lirc_mode2.sh b/tools/testing/selftests/bpf/test_lirc_mode2.sh
+index 677686198df34..795e56e3eaec5 100755
+--- a/tools/testing/selftests/bpf/test_lirc_mode2.sh
++++ b/tools/testing/selftests/bpf/test_lirc_mode2.sh
+@@ -3,6 +3,7 @@
+
+ # Kselftest framework requirement - SKIP code is 4.
+ ksft_skip=4
++ret=$ksft_skip
+
+ msg="skip all tests:"
+ if [ $UID != 0 ]; then
+@@ -24,7 +25,7 @@ do
+ fi
+ done
+
+-if [ -n $LIRCDEV ];
++if [ -n "$LIRCDEV" ];
+ then
+ TYPE=lirc_mode2
+ ./test_lirc_mode2_user $LIRCDEV
+@@ -35,3 +36,5 @@ then
+ echo -e ${GREEN}"PASS: $TYPE"${NC}
+ fi
+ fi
++
++exit $ret
+diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c
+index 90418d79ef676..a516d01f0bfc5 100644
+--- a/tools/testing/selftests/cgroup/cgroup_util.c
++++ b/tools/testing/selftests/cgroup/cgroup_util.c
+@@ -192,7 +192,7 @@ int cg_find_unified_root(char *root, size_t len)
+
+ int cg_create(const char *cgroup)
+ {
+- return mkdir(cgroup, 0644);
++ return mkdir(cgroup, 0755);
+ }
+
+ static int cg_killall(const char *cgroup)
+diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c
+index 79053a4f47838..599234c5e496c 100644
+--- a/tools/testing/selftests/cgroup/test_core.c
++++ b/tools/testing/selftests/cgroup/test_core.c
+@@ -1,8 +1,13 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+
++#define _GNU_SOURCE
+ #include <linux/limits.h>
++#include <linux/sched.h>
+ #include <sys/types.h>
++#include <sys/wait.h>
+ #include <unistd.h>
++#include <fcntl.h>
++#include <sched.h>
+ #include <stdio.h>
+ #include <errno.h>
+
+@@ -354,6 +359,166 @@ cleanup:
+ return ret;
+ }
+
++/*
++ * cgroup migration permission check should be performed based on the
++ * credentials at the time of open instead of write.
++ */
++static int test_cgcore_lesser_euid_open(const char *root)
++{
++ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */
++ int ret = KSFT_FAIL;
++ char *cg_test_a = NULL, *cg_test_b = NULL;
++ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL;
++ int cg_test_b_procs_fd = -1;
++ uid_t saved_uid;
++
++ cg_test_a = cg_name(root, "cg_test_a");
++ cg_test_b = cg_name(root, "cg_test_b");
++
++ if (!cg_test_a || !cg_test_b)
++ goto cleanup;
++
++ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs");
++ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs");
++
++ if (!cg_test_a_procs || !cg_test_b_procs)
++ goto cleanup;
++
++ if (cg_create(cg_test_a) || cg_create(cg_test_b))
++ goto cleanup;
++
++ if (cg_enter_current(cg_test_a))
++ goto cleanup;
++
++ if (chown(cg_test_a_procs, test_euid, -1) ||
++ chown(cg_test_b_procs, test_euid, -1))
++ goto cleanup;
++
++ saved_uid = geteuid();
++ if (seteuid(test_euid))
++ goto cleanup;
++
++ cg_test_b_procs_fd = open(cg_test_b_procs, O_RDWR);
++
++ if (seteuid(saved_uid))
++ goto cleanup;
++
++ if (cg_test_b_procs_fd < 0)
++ goto cleanup;
++
++ if (write(cg_test_b_procs_fd, "0", 1) >= 0 || errno != EACCES)
++ goto cleanup;
++
++ ret = KSFT_PASS;
++
++cleanup:
++ cg_enter_current(root);
++ if (cg_test_b_procs_fd >= 0)
++ close(cg_test_b_procs_fd);
++ if (cg_test_b)
++ cg_destroy(cg_test_b);
++ if (cg_test_a)
++ cg_destroy(cg_test_a);
++ free(cg_test_b_procs);
++ free(cg_test_a_procs);
++ free(cg_test_b);
++ free(cg_test_a);
++ return ret;
++}
++
++struct lesser_ns_open_thread_arg {
++ const char *path;
++ int fd;
++ int err;
++};
++
++static int lesser_ns_open_thread_fn(void *arg)
++{
++ struct lesser_ns_open_thread_arg *targ = arg;
++
++ targ->fd = open(targ->path, O_RDWR);
++ targ->err = errno;
++ return 0;
++}
++
++/*
++ * cgroup migration permission check should be performed based on the cgroup
++ * namespace at the time of open instead of write.
++ */
++static int test_cgcore_lesser_ns_open(const char *root)
++{
++ static char stack[65536];
++ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */
++ int ret = KSFT_FAIL;
++ char *cg_test_a = NULL, *cg_test_b = NULL;
++ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL;
++ int cg_test_b_procs_fd = -1;
++ struct lesser_ns_open_thread_arg targ = { .fd = -1 };
++ pid_t pid;
++ int status;
++
++ cg_test_a = cg_name(root, "cg_test_a");
++ cg_test_b = cg_name(root, "cg_test_b");
++
++ if (!cg_test_a || !cg_test_b)
++ goto cleanup;
++
++ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs");
++ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs");
++
++ if (!cg_test_a_procs || !cg_test_b_procs)
++ goto cleanup;
++
++ if (cg_create(cg_test_a) || cg_create(cg_test_b))
++ goto cleanup;
++
++ if (cg_enter_current(cg_test_b))
++ goto cleanup;
++
++ if (chown(cg_test_a_procs, test_euid, -1) ||
++ chown(cg_test_b_procs, test_euid, -1))
++ goto cleanup;
++
++ targ.path = cg_test_b_procs;
++ pid = clone(lesser_ns_open_thread_fn, stack + sizeof(stack),
++ CLONE_NEWCGROUP | CLONE_FILES | CLONE_VM | SIGCHLD,
++ &targ);
++ if (pid < 0)
++ goto cleanup;
++
++ if (waitpid(pid, &status, 0) < 0)
++ goto cleanup;
++
++ if (!WIFEXITED(status))
++ goto cleanup;
++
++ cg_test_b_procs_fd = targ.fd;
++ if (cg_test_b_procs_fd < 0)
++ goto cleanup;
++
++ if (cg_enter_current(cg_test_a))
++ goto cleanup;
++
++ if ((status = write(cg_test_b_procs_fd, "0", 1)) >= 0 || errno != ENOENT)
++ goto cleanup;
++
++ ret = KSFT_PASS;
++
++cleanup:
++ cg_enter_current(root);
++ if (cg_test_b_procs_fd >= 0)
++ close(cg_test_b_procs_fd);
++ if (cg_test_b)
++ cg_destroy(cg_test_b);
++ if (cg_test_a)
++ cg_destroy(cg_test_a);
++ free(cg_test_b_procs);
++ free(cg_test_a_procs);
++ free(cg_test_b);
++ free(cg_test_a);
++ return ret;
++}
++
+ #define T(x) { x, #x }
+ struct corecg_test {
+ int (*fn)(const char *root);
+@@ -366,6 +531,8 @@ struct corecg_test {
+ T(test_cgcore_parent_becomes_threaded),
+ T(test_cgcore_invalid_domain),
+ T(test_cgcore_populated),
++ T(test_cgcore_lesser_euid_open),
++ T(test_cgcore_lesser_ns_open),
+ };
+ #undef T
+
+diff --git a/tools/testing/selftests/x86/check_cc.sh b/tools/testing/selftests/x86/check_cc.sh
+index 172d3293fb7be..356689c563975 100755
+--- a/tools/testing/selftests/x86/check_cc.sh
++++ b/tools/testing/selftests/x86/check_cc.sh
+@@ -7,7 +7,7 @@ CC="$1"
+ TESTPROG="$2"
+ shift 2
+
+-if "$CC" -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then
++if [ -n "$CC" ] && $CC -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then
+ echo 1
+ else
+ echo 0
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 86ef740763b50..3d45ce1342278 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -112,6 +112,8 @@ EXPORT_SYMBOL_GPL(kvm_debugfs_dir);
+ static int kvm_debugfs_num_entries;
+ static const struct file_operations *stat_fops_per_vm[];
+
++static struct file_operations kvm_chardev_ops;
++
+ static long kvm_vcpu_ioctl(struct file *file, unsigned int ioctl,
+ unsigned long arg);
+ #ifdef CONFIG_KVM_COMPAT
+@@ -741,6 +743,16 @@ static struct kvm *kvm_create_vm(unsigned long type)
+
+ preempt_notifier_inc();
+
++ /*
++ * When the fd passed to this ioctl() is opened it pins the module,
++ * but try_module_get() also prevents getting a reference if the module
++ * is in MODULE_STATE_GOING (e.g. if someone ran "rmmod --wait").
++ */
++ if (!try_module_get(kvm_chardev_ops.owner)) {
++ r = -ENODEV;
++ goto out_err;
++ }
++
+ return kvm;
+
+ out_err:
+@@ -817,6 +829,7 @@ static void kvm_destroy_vm(struct kvm *kvm)
+ preempt_notifier_dec();
+ hardware_disable_all();
+ mmdrop(mm);
++ module_put(kvm_chardev_ops.owner);
+ }
+
+ void kvm_get_kvm(struct kvm *kvm)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-04-20 12:09 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-04-20 12:09 UTC (permalink / raw
To: gentoo-commits
commit: 7e1178b1f0c0c9de6f163b8caba9c93a6b72486b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 20 12:09:09 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 20 12:09:09 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7e1178b1
Linux patch 4.19.239
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1238_linux-4.19.239.patch | 804 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 808 insertions(+)
diff --git a/0000_README b/0000_README
index 49064f71..24846e7c 100644
--- a/0000_README
+++ b/0000_README
@@ -991,6 +991,10 @@ Patch: 1237_linux-4.19.238.patch
From: https://www.kernel.org
Desc: Linux 4.19.238
+Patch: 1238_linux-4.19.239.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.239
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1238_linux-4.19.239.patch b/1238_linux-4.19.239.patch
new file mode 100644
index 00000000..63597689
--- /dev/null
+++ b/1238_linux-4.19.239.patch
@@ -0,0 +1,804 @@
+diff --git a/Makefile b/Makefile
+index c2a8f7c5d993b..932bae9fbbbba 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 238
++SUBLEVEL = 239
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c
+index 774a3e535ad08..2afc2ff6f55a4 100644
+--- a/arch/arm/mach-davinci/board-da850-evm.c
++++ b/arch/arm/mach-davinci/board-da850-evm.c
+@@ -1045,11 +1045,13 @@ static int __init da850_evm_config_emac(void)
+ int ret;
+ u32 val;
+ struct davinci_soc_info *soc_info = &davinci_soc_info;
+- u8 rmii_en = soc_info->emac_pdata->rmii_en;
++ u8 rmii_en;
+
+ if (!machine_is_davinci_da850_evm())
+ return 0;
+
++ rmii_en = soc_info->emac_pdata->rmii_en;
++
+ cfg_chip3_base = DA8XX_SYSCFG0_VIRT(DA8XX_CFGCHIP3_REG);
+
+ val = __raw_readl(cfg_chip3_base);
+diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c
+index 0d345622bbba2..3747c8d87bdb2 100644
+--- a/arch/arm64/kernel/alternative.c
++++ b/arch/arm64/kernel/alternative.c
+@@ -42,7 +42,7 @@ struct alt_region {
+ /*
+ * Check if the target PC is within an alternative block.
+ */
+-static bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc)
++static __always_inline bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc)
+ {
+ unsigned long replptr = (unsigned long)ALT_REPL_PTR(alt);
+ return !(pc >= replptr && pc <= (replptr + alt->alt_len));
+@@ -50,7 +50,7 @@ static bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc)
+
+ #define align_down(x, a) ((unsigned long)(x) & ~(((unsigned long)(a)) - 1))
+
+-static u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnptr)
++static __always_inline u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnptr)
+ {
+ u32 insn;
+
+@@ -95,7 +95,7 @@ static u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnp
+ return insn;
+ }
+
+-static void patch_alternative(struct alt_instr *alt,
++static noinstr void patch_alternative(struct alt_instr *alt,
+ __le32 *origptr, __le32 *updptr, int nr_inst)
+ {
+ __le32 *replptr;
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 33d3728f36222..0c10d95577542 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4598,6 +4598,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
++ { "Samsung SSD 840 EVO*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
++ ATA_HORKAGE_NO_DMA_LOG |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Samsung SSD 840*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 47cdc1f89e3fb..6afe833031e38 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -278,8 +278,8 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares,
+ pin = agpio->pin_table[0];
+
+ if (pin <= 255) {
+- char ev_name[5];
+- sprintf(ev_name, "_%c%02hhX",
++ char ev_name[8];
++ sprintf(ev_name, "_%c%02X",
+ agpio->triggering == ACPI_EDGE_SENSITIVE ? 'E' : 'L',
+ pin);
+ if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle)))
+diff --git a/drivers/gpu/drm/amd/amdgpu/ObjectID.h b/drivers/gpu/drm/amd/amdgpu/ObjectID.h
+index 5b393622f5920..a0f0a17e224fe 100644
+--- a/drivers/gpu/drm/amd/amdgpu/ObjectID.h
++++ b/drivers/gpu/drm/amd/amdgpu/ObjectID.h
+@@ -119,6 +119,7 @@
+ #define CONNECTOR_OBJECT_ID_eDP 0x14
+ #define CONNECTOR_OBJECT_ID_MXM 0x15
+ #define CONNECTOR_OBJECT_ID_LVDS_eDP 0x16
++#define CONNECTOR_OBJECT_ID_USBC 0x17
+
+ /* deleted */
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+index e9f0e0a1b41c0..892077377339a 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+@@ -532,6 +532,8 @@ static struct kfd_event_waiter *alloc_event_waiters(uint32_t num_events)
+ event_waiters = kmalloc_array(num_events,
+ sizeof(struct kfd_event_waiter),
+ GFP_KERNEL);
++ if (!event_waiters)
++ return NULL;
+
+ for (i = 0; (event_waiters) && (i < num_events) ; i++) {
+ init_wait(&event_waiters[i].wait);
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index b2835cd41d3e2..57678e6dcdc4c 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -777,7 +777,8 @@ static int dm_resume(void *handle)
+ * this is the case when traversing through already created
+ * MST connectors, should be skipped
+ */
+- if (aconnector->mst_port)
++ if (aconnector->dc_link &&
++ aconnector->dc_link->type == dc_connection_mst_branch)
+ continue;
+
+ mutex_lock(&aconnector->hpd_lock);
+diff --git a/drivers/gpu/ipu-v3/ipu-di.c b/drivers/gpu/ipu-v3/ipu-di.c
+index d2f1bd9d3deb5..c498dc7d88384 100644
+--- a/drivers/gpu/ipu-v3/ipu-di.c
++++ b/drivers/gpu/ipu-v3/ipu-di.c
+@@ -460,8 +460,9 @@ static void ipu_di_config_clock(struct ipu_di *di,
+
+ error = rate / (sig->mode.pixelclock / 1000);
+
+- dev_dbg(di->ipu->dev, " IPU clock can give %lu with divider %u, error %d.%u%%\n",
+- rate, div, (signed)(error - 1000) / 10, error % 10);
++ dev_dbg(di->ipu->dev, " IPU clock can give %lu with divider %u, error %c%d.%d%%\n",
++ rate, div, error < 1000 ? '-' : '+',
++ abs(error - 1000) / 10, abs(error - 1000) % 10);
+
+ /* Allow a 1% error */
+ if (error < 1010 && error >= 990) {
+diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
+index 6cb45f256107e..d97b30af9e031 100644
+--- a/drivers/hv/ring_buffer.c
++++ b/drivers/hv/ring_buffer.c
+@@ -365,7 +365,16 @@ int hv_ringbuffer_read(struct vmbus_channel *channel,
+ static u32 hv_pkt_iter_avail(const struct hv_ring_buffer_info *rbi)
+ {
+ u32 priv_read_loc = rbi->priv_read_index;
+- u32 write_loc = READ_ONCE(rbi->ring_buffer->write_index);
++ u32 write_loc;
++
++ /*
++ * The Hyper-V host writes the packet data, then uses
++ * store_release() to update the write_index. Use load_acquire()
++ * here to prevent loads of the packet data from being re-ordered
++ * before the read of the write_index and potentially getting
++ * stale data.
++ */
++ write_loc = virt_load_acquire(&rbi->ring_buffer->write_index);
+
+ if (write_loc >= priv_read_loc)
+ return write_loc - priv_read_loc;
+diff --git a/drivers/i2c/busses/i2c-pasemi.c b/drivers/i2c/busses/i2c-pasemi.c
+index 50803e5d995b3..46e7399134c91 100644
+--- a/drivers/i2c/busses/i2c-pasemi.c
++++ b/drivers/i2c/busses/i2c-pasemi.c
+@@ -145,6 +145,12 @@ static int pasemi_i2c_xfer_msg(struct i2c_adapter *adapter,
+
+ TXFIFO_WR(smbus, msg->buf[msg->len-1] |
+ (stop ? MTXFIFO_STOP : 0));
++
++ if (stop) {
++ err = pasemi_smb_waitready(smbus);
++ if (err)
++ goto reset_out;
++ }
+ }
+
+ return 0;
+diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
+index 2b9283d4fcb1e..8e7b5a1d29839 100644
+--- a/drivers/memory/atmel-ebi.c
++++ b/drivers/memory/atmel-ebi.c
+@@ -524,20 +524,27 @@ static int atmel_ebi_probe(struct platform_device *pdev)
+ smc_np = of_parse_phandle(dev->of_node, "atmel,smc", 0);
+
+ ebi->smc.regmap = syscon_node_to_regmap(smc_np);
+- if (IS_ERR(ebi->smc.regmap))
+- return PTR_ERR(ebi->smc.regmap);
++ if (IS_ERR(ebi->smc.regmap)) {
++ ret = PTR_ERR(ebi->smc.regmap);
++ goto put_node;
++ }
+
+ ebi->smc.layout = atmel_hsmc_get_reg_layout(smc_np);
+- if (IS_ERR(ebi->smc.layout))
+- return PTR_ERR(ebi->smc.layout);
++ if (IS_ERR(ebi->smc.layout)) {
++ ret = PTR_ERR(ebi->smc.layout);
++ goto put_node;
++ }
+
+ ebi->smc.clk = of_clk_get(smc_np, 0);
+ if (IS_ERR(ebi->smc.clk)) {
+- if (PTR_ERR(ebi->smc.clk) != -ENOENT)
+- return PTR_ERR(ebi->smc.clk);
++ if (PTR_ERR(ebi->smc.clk) != -ENOENT) {
++ ret = PTR_ERR(ebi->smc.clk);
++ goto put_node;
++ }
+
+ ebi->smc.clk = NULL;
+ }
++ of_node_put(smc_np);
+ ret = clk_prepare_enable(ebi->smc.clk);
+ if (ret)
+ return ret;
+@@ -587,6 +594,10 @@ static int atmel_ebi_probe(struct platform_device *pdev)
+ }
+
+ return of_platform_populate(np, NULL, NULL, dev);
++
++put_node:
++ of_node_put(smc_np);
++ return ret;
+ }
+
+ static __maybe_unused int atmel_ebi_resume(struct device *dev)
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c
+index 798bd5aca3847..1d1025fd2d885 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c
+@@ -516,6 +516,7 @@ static int mlxsw_i2c_probe(struct i2c_client *client,
+ return 0;
+
+ errout:
++ mutex_destroy(&mlxsw_i2c->cmd.lock);
+ i2c_set_clientdata(client, NULL);
+
+ return err;
+diff --git a/drivers/net/ethernet/micrel/Kconfig b/drivers/net/ethernet/micrel/Kconfig
+index b7e2f49696b74..aa12bace8673e 100644
+--- a/drivers/net/ethernet/micrel/Kconfig
++++ b/drivers/net/ethernet/micrel/Kconfig
+@@ -45,6 +45,7 @@ config KS8851
+ config KS8851_MLL
+ tristate "Micrel KS8851 MLL"
+ depends on HAS_IOMEM
++ depends on PTP_1588_CLOCK_OPTIONAL
+ select MII
+ ---help---
+ This platform driver is for Micrel KS8851 Address/data bus
+diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
+index 8b50afcdb52df..729df169faa21 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
++++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
+@@ -68,10 +68,6 @@
+ #define TSE_PCS_USE_SGMII_ENA BIT(0)
+ #define TSE_PCS_IF_USE_SGMII 0x03
+
+-#define SGMII_ADAPTER_CTRL_REG 0x00
+-#define SGMII_ADAPTER_DISABLE 0x0001
+-#define SGMII_ADAPTER_ENABLE 0x0000
+-
+ #define AUTONEGO_LINK_TIMER 20
+
+ static int tse_pcs_reset(void __iomem *base, struct tse_pcs *pcs)
+@@ -213,12 +209,8 @@ void tse_pcs_fix_mac_speed(struct tse_pcs *pcs, struct phy_device *phy_dev,
+ unsigned int speed)
+ {
+ void __iomem *tse_pcs_base = pcs->tse_pcs_base;
+- void __iomem *sgmii_adapter_base = pcs->sgmii_adapter_base;
+ u32 val;
+
+- writew(SGMII_ADAPTER_ENABLE,
+- sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG);
+-
+ pcs->autoneg = phy_dev->autoneg;
+
+ if (phy_dev->autoneg == AUTONEG_ENABLE) {
+diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h
+index 2f5882450b06a..254199f2efdbf 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h
++++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h
+@@ -21,6 +21,10 @@
+ #include <linux/phy.h>
+ #include <linux/timer.h>
+
++#define SGMII_ADAPTER_CTRL_REG 0x00
++#define SGMII_ADAPTER_ENABLE 0x0000
++#define SGMII_ADAPTER_DISABLE 0x0001
++
+ struct tse_pcs {
+ struct device *dev;
+ void __iomem *tse_pcs_base;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+index 33407df6bea69..32ead4a4b4604 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+@@ -29,9 +29,6 @@
+
+ #include "altr_tse_pcs.h"
+
+-#define SGMII_ADAPTER_CTRL_REG 0x00
+-#define SGMII_ADAPTER_DISABLE 0x0001
+-
+ #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII 0x0
+ #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RGMII 0x1
+ #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RMII 0x2
+@@ -65,16 +62,14 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, unsigned int speed)
+ {
+ struct socfpga_dwmac *dwmac = (struct socfpga_dwmac *)priv;
+ void __iomem *splitter_base = dwmac->splitter_base;
+- void __iomem *tse_pcs_base = dwmac->pcs.tse_pcs_base;
+ void __iomem *sgmii_adapter_base = dwmac->pcs.sgmii_adapter_base;
+ struct device *dev = dwmac->dev;
+ struct net_device *ndev = dev_get_drvdata(dev);
+ struct phy_device *phy_dev = ndev->phydev;
+ u32 val;
+
+- if ((tse_pcs_base) && (sgmii_adapter_base))
+- writew(SGMII_ADAPTER_DISABLE,
+- sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG);
++ writew(SGMII_ADAPTER_DISABLE,
++ sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG);
+
+ if (splitter_base) {
+ val = readl(splitter_base + EMAC_SPLITTER_CTRL_REG);
+@@ -96,7 +91,9 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, unsigned int speed)
+ writel(val, splitter_base + EMAC_SPLITTER_CTRL_REG);
+ }
+
+- if (tse_pcs_base && sgmii_adapter_base)
++ writew(SGMII_ADAPTER_ENABLE,
++ sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG);
++ if (phy_dev)
+ tse_pcs_fix_mac_speed(&dwmac->pcs, phy_dev, speed);
+ }
+
+diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
+index 5d864f8129556..3ec8d16a4633e 100644
+--- a/drivers/net/slip/slip.c
++++ b/drivers/net/slip/slip.c
+@@ -471,7 +471,7 @@ static void sl_tx_timeout(struct net_device *dev)
+ spin_lock(&sl->lock);
+
+ if (netif_queue_stopped(dev)) {
+- if (!netif_running(dev))
++ if (!netif_running(dev) || !sl->tty)
+ goto out;
+
+ /* May be we must check transmitter timeout here ?
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c
+index 76e834ca54e79..ea999a6639330 100644
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -188,7 +188,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ rcu_read_lock();
+ rcv = rcu_dereference(priv->peer);
+- if (unlikely(!rcv)) {
++ if (unlikely(!rcv) || !pskb_may_pull(skb, ETH_HLEN)) {
+ kfree_skb(skb);
+ goto drop;
+ }
+diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+index f42a619198c46..79bc6c3bfa6e5 100644
+--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
++++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+@@ -44,7 +44,7 @@
+
+ #define IBMVSCSIS_VERSION "v0.2"
+
+-#define INITIAL_SRP_LIMIT 800
++#define INITIAL_SRP_LIMIT 1024
+ #define DEFAULT_MAX_SECTORS 256
+ #define MAX_TXU 1024 * 1024
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 9c48394ac68ab..f2fed5eeefe33 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -678,6 +678,7 @@ static struct pci_device_id mvs_pci_table[] = {
+ { PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1300), chip_1300 },
+ { PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1320), chip_1320 },
+ { PCI_VDEVICE(ADAPTEC2, 0x0450), chip_6440 },
++ { PCI_VDEVICE(TTI, 0x2640), chip_6440 },
+ { PCI_VDEVICE(TTI, 0x2710), chip_9480 },
+ { PCI_VDEVICE(TTI, 0x2720), chip_9480 },
+ { PCI_VDEVICE(TTI, 0x2721), chip_9480 },
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index dd73073755047..f29d600357f3b 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -1499,6 +1499,7 @@ static struct page *tcmu_try_get_block_page(struct tcmu_dev *udev, uint32_t dbi)
+ mutex_lock(&udev->cmdr_lock);
+ page = tcmu_get_block_page(udev, dbi);
+ if (likely(page)) {
++ get_page(page);
+ mutex_unlock(&udev->cmdr_lock);
+ return page;
+ }
+@@ -1537,6 +1538,7 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf)
+ /* For the vmalloc()ed cmd area pages */
+ addr = (void *)(unsigned long)info->mem[mi].addr + offset;
+ page = vmalloc_to_page(addr);
++ get_page(page);
+ } else {
+ uint32_t dbi;
+
+@@ -1547,7 +1549,6 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf)
+ return VM_FAULT_SIGBUS;
+ }
+
+- get_page(page);
+ vmf->page = page;
+ return 0;
+ }
+diff --git a/fs/cifs/link.c b/fs/cifs/link.c
+index 2148b0f60e5e8..5b1c33d9283ae 100644
+--- a/fs/cifs/link.c
++++ b/fs/cifs/link.c
+@@ -97,6 +97,9 @@ parse_mf_symlink(const u8 *buf, unsigned int buf_len, unsigned int *_link_len,
+ if (rc != 1)
+ return -EINVAL;
+
++ if (link_len > CIFS_MF_SYMLINK_LINK_MAXLEN)
++ return -EINVAL;
++
+ rc = symlink_hash(link_len, link_str, md5_hash);
+ if (rc) {
+ cifs_dbg(FYI, "%s: MD5 hash failure: %d\n", __func__, rc);
+diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
+index 99f8580344d03..01229084b3ed4 100644
+--- a/include/net/flow_dissector.h
++++ b/include/net/flow_dissector.h
+@@ -50,6 +50,8 @@ struct flow_dissector_key_vlan {
+ u16 vlan_id:12,
+ vlan_priority:3;
+ __be16 vlan_tpid;
++ __be16 vlan_eth_type;
++ u16 padding;
+ };
+
+ struct flow_dissector_key_mpls {
+diff --git a/kernel/smp.c b/kernel/smp.c
+index 00d208ef07c76..9fa2fe6c0c050 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -221,7 +221,7 @@ static void flush_smp_call_function_queue(bool warn_cpu_offline)
+
+ /* There shouldn't be any pending callbacks on an offline CPU. */
+ if (unlikely(warn_cpu_offline && !cpu_online(smp_processor_id()) &&
+- !warned && !llist_empty(head))) {
++ !warned && entry != NULL)) {
+ warned = true;
+ WARN(1, "IPI on offline CPU %d\n", smp_processor_id());
+
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index f54734abf9466..639acbb91fd53 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -1196,7 +1196,7 @@ EXPORT_SYMBOL(kmemleak_no_scan);
+ void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_count,
+ gfp_t gfp)
+ {
+- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
++ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
+ kmemleak_alloc(__va(phys), size, min_count, gfp);
+ }
+ EXPORT_SYMBOL(kmemleak_alloc_phys);
+@@ -1210,7 +1210,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys);
+ */
+ void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size)
+ {
+- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
++ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
+ kmemleak_free_part(__va(phys), size);
+ }
+ EXPORT_SYMBOL(kmemleak_free_part_phys);
+@@ -1222,7 +1222,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys);
+ */
+ void __ref kmemleak_not_leak_phys(phys_addr_t phys)
+ {
+- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
++ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
+ kmemleak_not_leak(__va(phys));
+ }
+ EXPORT_SYMBOL(kmemleak_not_leak_phys);
+@@ -1234,7 +1234,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys);
+ */
+ void __ref kmemleak_ignore_phys(phys_addr_t phys)
+ {
+- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
++ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
+ kmemleak_ignore(__va(phys));
+ }
+ EXPORT_SYMBOL(kmemleak_ignore_phys);
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 1a39fd6a73b88..f60f7ad5d0ba8 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5091,7 +5091,7 @@ static int build_zonerefs_node(pg_data_t *pgdat, struct zoneref *zonerefs)
+ do {
+ zone_type--;
+ zone = pgdat->node_zones + zone_type;
+- if (managed_zone(zone)) {
++ if (populated_zone(zone)) {
+ zoneref_set_zone(zone, &zonerefs[nr_zones++]);
+ check_highest_zone(zone_type);
+ }
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index 949694c70cbc6..da860a680256c 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -827,6 +827,7 @@ proto_again:
+ VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
+ }
+ key_vlan->vlan_tpid = saved_vlan_tpid;
++ key_vlan->vlan_eth_type = proto;
+ }
+
+ fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 373df391dc93c..6fd1a4b617473 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -460,7 +460,7 @@ int ip6_forward(struct sk_buff *skb)
+ goto drop;
+
+ if (!net->ipv6.devconf_all->disable_policy &&
+- !idev->cnf.disable_policy &&
++ (!idev || !idev->cnf.disable_policy) &&
+ !xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
+ __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
+ goto drop;
+diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
+index 0e0dff72a9e4f..0580e5326641b 100644
+--- a/net/nfc/nci/core.c
++++ b/net/nfc/nci/core.c
+@@ -560,6 +560,10 @@ static int nci_close_device(struct nci_dev *ndev)
+ mutex_lock(&ndev->req_lock);
+
+ if (!test_and_clear_bit(NCI_UP, &ndev->flags)) {
++ /* Need to flush the cmd wq in case
++ * there is a queued/running cmd_work
++ */
++ flush_workqueue(ndev->cmd_wq);
+ del_timer_sync(&ndev->cmd_timer);
+ del_timer_sync(&ndev->data_timer);
+ mutex_unlock(&ndev->req_lock);
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index 208436eb107c4..6163648145c19 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -554,6 +554,7 @@ static int fl_set_key_mpls(struct nlattr **tb,
+ static void fl_set_key_vlan(struct nlattr **tb,
+ __be16 ethertype,
+ int vlan_id_key, int vlan_prio_key,
++ int vlan_next_eth_type_key,
+ struct flow_dissector_key_vlan *key_val,
+ struct flow_dissector_key_vlan *key_mask)
+ {
+@@ -572,6 +573,11 @@ static void fl_set_key_vlan(struct nlattr **tb,
+ }
+ key_val->vlan_tpid = ethertype;
+ key_mask->vlan_tpid = cpu_to_be16(~0);
++ if (tb[vlan_next_eth_type_key]) {
++ key_val->vlan_eth_type =
++ nla_get_be16(tb[vlan_next_eth_type_key]);
++ key_mask->vlan_eth_type = cpu_to_be16(~0);
++ }
+ }
+
+ static void fl_set_key_flag(u32 flower_key, u32 flower_mask,
+@@ -801,8 +807,9 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
+
+ if (eth_type_vlan(ethertype)) {
+ fl_set_key_vlan(tb, ethertype, TCA_FLOWER_KEY_VLAN_ID,
+- TCA_FLOWER_KEY_VLAN_PRIO, &key->vlan,
+- &mask->vlan);
++ TCA_FLOWER_KEY_VLAN_PRIO,
++ TCA_FLOWER_KEY_VLAN_ETH_TYPE,
++ &key->vlan, &mask->vlan);
+
+ if (tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]) {
+ ethertype = nla_get_be16(tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]);
+@@ -810,6 +817,7 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
+ fl_set_key_vlan(tb, ethertype,
+ TCA_FLOWER_KEY_CVLAN_ID,
+ TCA_FLOWER_KEY_CVLAN_PRIO,
++ TCA_FLOWER_KEY_CVLAN_ETH_TYPE,
+ &key->cvlan, &mask->cvlan);
+ fl_set_key_val(tb, &key->basic.n_proto,
+ TCA_FLOWER_KEY_CVLAN_ETH_TYPE,
+@@ -1717,13 +1725,13 @@ static int fl_dump_key(struct sk_buff *skb, struct net *net,
+ goto nla_put_failure;
+
+ if (mask->basic.n_proto) {
+- if (mask->cvlan.vlan_tpid) {
++ if (mask->cvlan.vlan_eth_type) {
+ if (nla_put_be16(skb, TCA_FLOWER_KEY_CVLAN_ETH_TYPE,
+ key->basic.n_proto))
+ goto nla_put_failure;
+- } else if (mask->vlan.vlan_tpid) {
++ } else if (mask->vlan.vlan_eth_type) {
+ if (nla_put_be16(skb, TCA_FLOWER_KEY_VLAN_ETH_TYPE,
+- key->basic.n_proto))
++ key->vlan.vlan_eth_type))
+ goto nla_put_failure;
+ }
+ }
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index d429d59228041..8901bb7afa2be 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -5333,7 +5333,7 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
+ * Set the daddr and initialize id to something more random and also
+ * copy over any ip options.
+ */
+- sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sk);
++ sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sock->sk);
+ sp->pf->copy_ip_options(sk, sock->sk);
+
+ /* Populate the fields of the newsk from the oldsk and migrate the
+diff --git a/scripts/gcc-plugins/latent_entropy_plugin.c b/scripts/gcc-plugins/latent_entropy_plugin.c
+index cbe1d6c4b1a51..c84bef1d28955 100644
+--- a/scripts/gcc-plugins/latent_entropy_plugin.c
++++ b/scripts/gcc-plugins/latent_entropy_plugin.c
+@@ -86,25 +86,31 @@ static struct plugin_info latent_entropy_plugin_info = {
+ .help = "disable\tturn off latent entropy instrumentation\n",
+ };
+
+-static unsigned HOST_WIDE_INT seed;
+-/*
+- * get_random_seed() (this is a GCC function) generates the seed.
+- * This is a simple random generator without any cryptographic security because
+- * the entropy doesn't come from here.
+- */
++static unsigned HOST_WIDE_INT deterministic_seed;
++static unsigned HOST_WIDE_INT rnd_buf[32];
++static size_t rnd_idx = ARRAY_SIZE(rnd_buf);
++static int urandom_fd = -1;
++
+ static unsigned HOST_WIDE_INT get_random_const(void)
+ {
+- unsigned int i;
+- unsigned HOST_WIDE_INT ret = 0;
+-
+- for (i = 0; i < 8 * sizeof(ret); i++) {
+- ret = (ret << 1) | (seed & 1);
+- seed >>= 1;
+- if (ret & 1)
+- seed ^= 0xD800000000000000ULL;
++ if (deterministic_seed) {
++ unsigned HOST_WIDE_INT w = deterministic_seed;
++ w ^= w << 13;
++ w ^= w >> 7;
++ w ^= w << 17;
++ deterministic_seed = w;
++ return deterministic_seed;
+ }
+
+- return ret;
++ if (urandom_fd < 0) {
++ urandom_fd = open("/dev/urandom", O_RDONLY);
++ gcc_assert(urandom_fd >= 0);
++ }
++ if (rnd_idx >= ARRAY_SIZE(rnd_buf)) {
++ gcc_assert(read(urandom_fd, rnd_buf, sizeof(rnd_buf)) == sizeof(rnd_buf));
++ rnd_idx = 0;
++ }
++ return rnd_buf[rnd_idx++];
+ }
+
+ static tree tree_get_random_const(tree type)
+@@ -549,8 +555,6 @@ static void latent_entropy_start_unit(void *gcc_data __unused,
+ tree type, id;
+ int quals;
+
+- seed = get_random_seed(false);
+-
+ if (in_lto_p)
+ return;
+
+@@ -585,6 +589,12 @@ __visible int plugin_init(struct plugin_name_args *plugin_info,
+ const struct plugin_argument * const argv = plugin_info->argv;
+ int i;
+
++ /*
++ * Call get_random_seed() with noinit=true, so that this returns
++ * 0 in the case where no seed has been passed via -frandom-seed.
++ */
++ deterministic_seed = get_random_seed(true);
++
+ static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy[] = {
+ {
+ .base = &latent_entropy_decl,
+diff --git a/sound/core/pcm_misc.c b/sound/core/pcm_misc.c
+index c4eb561d20086..0956be39b0355 100644
+--- a/sound/core/pcm_misc.c
++++ b/sound/core/pcm_misc.c
+@@ -423,7 +423,7 @@ int snd_pcm_format_set_silence(snd_pcm_format_t format, void *data, unsigned int
+ return 0;
+ width = pcm_formats[(INT)format].phys; /* physical width */
+ pat = pcm_formats[(INT)format].silence;
+- if (! width)
++ if (!width || !pat)
+ return -EINVAL;
+ /* signed or 1 byte data */
+ if (pcm_formats[(INT)format].signd == 1 || width <= 8) {
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 3f9c2b1e3be63..a5263453ea64c 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2552,6 +2552,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x65f5, "Clevo PD50PN[NRT]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+diff --git a/tools/testing/selftests/mqueue/mq_perf_tests.c b/tools/testing/selftests/mqueue/mq_perf_tests.c
+index b019e0b8221c7..84fda3b490735 100644
+--- a/tools/testing/selftests/mqueue/mq_perf_tests.c
++++ b/tools/testing/selftests/mqueue/mq_perf_tests.c
+@@ -180,6 +180,9 @@ void shutdown(int exit_val, char *err_cause, int line_no)
+ if (in_shutdown++)
+ return;
+
++ /* Free the cpu_set allocated using CPU_ALLOC in main function */
++ CPU_FREE(cpu_set);
++
+ for (i = 0; i < num_cpus_to_pin; i++)
+ if (cpu_threads[i]) {
+ pthread_kill(cpu_threads[i], SIGUSR1);
+@@ -551,6 +554,12 @@ int main(int argc, char *argv[])
+ perror("sysconf(_SC_NPROCESSORS_ONLN)");
+ exit(1);
+ }
++
++ if (getuid() != 0)
++ ksft_exit_skip("Not running as root, but almost all tests "
++ "require root in order to modify\nsystem settings. "
++ "Exiting.\n");
++
+ cpus_online = min(MAX_CPUS, sysconf(_SC_NPROCESSORS_ONLN));
+ cpu_set = CPU_ALLOC(cpus_online);
+ if (cpu_set == NULL) {
+@@ -589,7 +598,7 @@ int main(int argc, char *argv[])
+ cpu_set)) {
+ fprintf(stderr, "Any given CPU may "
+ "only be given once.\n");
+- exit(1);
++ goto err_code;
+ } else
+ CPU_SET_S(cpus_to_pin[cpu],
+ cpu_set_size, cpu_set);
+@@ -607,7 +616,7 @@ int main(int argc, char *argv[])
+ queue_path = malloc(strlen(option) + 2);
+ if (!queue_path) {
+ perror("malloc()");
+- exit(1);
++ goto err_code;
+ }
+ queue_path[0] = '/';
+ queue_path[1] = 0;
+@@ -622,17 +631,12 @@ int main(int argc, char *argv[])
+ fprintf(stderr, "Must pass at least one CPU to continuous "
+ "mode.\n");
+ poptPrintUsage(popt_context, stderr, 0);
+- exit(1);
++ goto err_code;
+ } else if (!continuous_mode) {
+ num_cpus_to_pin = 1;
+ cpus_to_pin[0] = cpus_online - 1;
+ }
+
+- if (getuid() != 0)
+- ksft_exit_skip("Not running as root, but almost all tests "
+- "require root in order to modify\nsystem settings. "
+- "Exiting.\n");
+-
+ max_msgs = fopen(MAX_MSGS, "r+");
+ max_msgsize = fopen(MAX_MSGSIZE, "r+");
+ if (!max_msgs)
+@@ -740,4 +744,9 @@ int main(int argc, char *argv[])
+ sleep(1);
+ }
+ shutdown(0, "", 0);
++
++err_code:
++ CPU_FREE(cpu_set);
++ exit(1);
++
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-04-27 12:03 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-04-27 12:03 UTC (permalink / raw
To: gentoo-commits
commit: 30268acb55bf8f38da63af8427c716ff98501ff2
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 27 12:03:15 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 27 12:03:15 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=30268acb
Linux patch 4.19.240
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1239_linux-4.19.240.patch | 1623 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1627 insertions(+)
diff --git a/0000_README b/0000_README
index 24846e7c..72dcbc8d 100644
--- a/0000_README
+++ b/0000_README
@@ -995,6 +995,10 @@ Patch: 1238_linux-4.19.239.patch
From: https://www.kernel.org
Desc: Linux 4.19.239
+Patch: 1239_linux-4.19.240.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.240
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1239_linux-4.19.240.patch b/1239_linux-4.19.240.patch
new file mode 100644
index 00000000..b3c17320
--- /dev/null
+++ b/1239_linux-4.19.240.patch
@@ -0,0 +1,1623 @@
+diff --git a/Makefile b/Makefile
+index 932bae9fbbbba..546e52f8a05fa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 239
++SUBLEVEL = 240
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
+index 37ad245cf9899..fb458623f3860 100644
+--- a/arch/arc/kernel/entry.S
++++ b/arch/arc/kernel/entry.S
+@@ -191,6 +191,7 @@ tracesys_exit:
+ st r0, [sp, PT_r0] ; sys call return value in pt_regs
+
+ ;POST Sys Call Ptrace Hook
++ mov r0, sp ; pt_regs needed
+ bl @syscall_trace_exit
+ b ret_from_exception ; NOT ret_from_system_call at is saves r0 which
+ ; we'd done before calling post hook above
+diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c
+index 55bbbc3b328f0..e65c04be86ccb 100644
+--- a/arch/arm/mach-vexpress/spc.c
++++ b/arch/arm/mach-vexpress/spc.c
+@@ -580,7 +580,7 @@ static int __init ve_spc_clk_init(void)
+ }
+
+ cluster = topology_physical_package_id(cpu_dev->id);
+- if (init_opp_table[cluster])
++ if (cluster < 0 || init_opp_table[cluster])
+ continue;
+
+ if (ve_init_opp_table(cpu_dev))
+diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
+index c07b1615ee39d..1aa083db77f18 100644
+--- a/arch/powerpc/perf/power9-pmu.c
++++ b/arch/powerpc/perf/power9-pmu.c
+@@ -143,11 +143,11 @@ int p9_dd22_bl_ev[] = {
+
+ /* Table of alternatives, sorted by column 0 */
+ static const unsigned int power9_event_alternatives[][MAX_ALT] = {
+- { PM_INST_DISP, PM_INST_DISP_ALT },
+- { PM_RUN_CYC_ALT, PM_RUN_CYC },
+- { PM_RUN_INST_CMPL_ALT, PM_RUN_INST_CMPL },
+- { PM_LD_MISS_L1, PM_LD_MISS_L1_ALT },
+ { PM_BR_2PATH, PM_BR_2PATH_ALT },
++ { PM_INST_DISP, PM_INST_DISP_ALT },
++ { PM_RUN_CYC_ALT, PM_RUN_CYC },
++ { PM_LD_MISS_L1, PM_LD_MISS_L1_ALT },
++ { PM_RUN_INST_CMPL_ALT, PM_RUN_INST_CMPL },
+ };
+
+ static int power9_get_alternatives(u64 event, unsigned int flags, u64 alt[])
+diff --git a/arch/x86/include/asm/compat.h b/arch/x86/include/asm/compat.h
+index fb97cf7c41371..1def972b6ca36 100644
+--- a/arch/x86/include/asm/compat.h
++++ b/arch/x86/include/asm/compat.h
+@@ -46,15 +46,13 @@ typedef u64 __attribute__((aligned(4))) compat_u64;
+ typedef u32 compat_uptr_t;
+
+ struct compat_stat {
+- compat_dev_t st_dev;
+- u16 __pad1;
++ u32 st_dev;
+ compat_ino_t st_ino;
+ compat_mode_t st_mode;
+ compat_nlink_t st_nlink;
+ __compat_uid_t st_uid;
+ __compat_gid_t st_gid;
+- compat_dev_t st_rdev;
+- u16 __pad2;
++ u32 st_rdev;
+ u32 st_size;
+ u32 st_blksize;
+ u32 st_blocks;
+diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
+index 6490b2759bcb4..9ef62d42ba5b2 100644
+--- a/block/compat_ioctl.c
++++ b/block/compat_ioctl.c
+@@ -391,7 +391,7 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+ return 0;
+ case BLKGETSIZE:
+ size = i_size_read(bdev->bd_inode);
+- if ((size >> 9) > ~0UL)
++ if ((size >> 9) > ~(compat_ulong_t)0)
+ return -EFBIG;
+ return compat_put_ulong(arg, size >> 9);
+
+diff --git a/drivers/ata/pata_marvell.c b/drivers/ata/pata_marvell.c
+index ff468a6fd8ddc..677f582cf3d6c 100644
+--- a/drivers/ata/pata_marvell.c
++++ b/drivers/ata/pata_marvell.c
+@@ -82,6 +82,8 @@ static int marvell_cable_detect(struct ata_port *ap)
+ switch(ap->port_no)
+ {
+ case 0:
++ if (!ap->ioaddr.bmdma_addr)
++ return ATA_CBL_PATA_UNK;
+ if (ioread8(ap->ioaddr.bmdma_addr + 1) & 1)
+ return ATA_CBL_PATA40;
+ return ATA_CBL_PATA80;
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index 04704c6376baf..d4ba0d9dd17c4 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -1390,7 +1390,7 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
+ {
+ struct at_xdmac_chan *atchan = to_at_xdmac_chan(chan);
+ struct at_xdmac *atxdmac = to_at_xdmac(atchan->chan.device);
+- struct at_xdmac_desc *desc, *_desc;
++ struct at_xdmac_desc *desc, *_desc, *iter;
+ struct list_head *descs_list;
+ enum dma_status ret;
+ int residue, retry;
+@@ -1505,11 +1505,13 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
+ * microblock.
+ */
+ descs_list = &desc->descs_list;
+- list_for_each_entry_safe(desc, _desc, descs_list, desc_node) {
+- dwidth = at_xdmac_get_dwidth(desc->lld.mbr_cfg);
+- residue -= (desc->lld.mbr_ubc & 0xffffff) << dwidth;
+- if ((desc->lld.mbr_nda & 0xfffffffc) == cur_nda)
++ list_for_each_entry_safe(iter, _desc, descs_list, desc_node) {
++ dwidth = at_xdmac_get_dwidth(iter->lld.mbr_cfg);
++ residue -= (iter->lld.mbr_ubc & 0xffffff) << dwidth;
++ if ((iter->lld.mbr_nda & 0xfffffffc) == cur_nda) {
++ desc = iter;
+ break;
++ }
+ }
+ residue += cur_ubc << dwidth;
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index eea89c3b54c1e..709ead443fc5f 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -1771,7 +1771,7 @@ static int sdma_event_remap(struct sdma_engine *sdma)
+ u32 reg, val, shift, num_map, i;
+ int ret = 0;
+
+- if (IS_ERR(np) || IS_ERR(gpr_np))
++ if (IS_ERR(np) || !gpr_np)
+ goto out;
+
+ event_remap = of_find_property(np, propname, NULL);
+@@ -1819,7 +1819,7 @@ static int sdma_event_remap(struct sdma_engine *sdma)
+ }
+
+ out:
+- if (!IS_ERR(gpr_np))
++ if (gpr_np)
+ of_node_put(gpr_np);
+
+ return ret;
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+index 1ddf07514de6d..3d8eaa25bea0f 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+@@ -188,7 +188,10 @@ static void mdp5_plane_reset(struct drm_plane *plane)
+ drm_framebuffer_unreference(plane->state->fb);
+
+ kfree(to_mdp5_plane_state(plane->state));
++ plane->state = NULL;
+ mdp5_state = kzalloc(sizeof(*mdp5_state), GFP_KERNEL);
++ if (!mdp5_state)
++ return;
+
+ /* assign default blend parameters */
+ mdp5_state->alpha = 255;
+diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+index 06bd039159738..f57eec47ef6a9 100644
+--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+@@ -233,7 +233,7 @@ static void rpi_touchscreen_i2c_write(struct rpi_touchscreen *ts,
+
+ ret = i2c_smbus_write_byte_data(ts->i2c, reg, val);
+ if (ret)
+- dev_err(&ts->dsi->dev, "I2C write failed: %d\n", ret);
++ dev_err(&ts->i2c->dev, "I2C write failed: %d\n", ret);
+ }
+
+ static int rpi_touchscreen_write(struct rpi_touchscreen *ts, u16 reg, u32 val)
+@@ -269,7 +269,7 @@ static int rpi_touchscreen_noop(struct drm_panel *panel)
+ return 0;
+ }
+
+-static int rpi_touchscreen_enable(struct drm_panel *panel)
++static int rpi_touchscreen_prepare(struct drm_panel *panel)
+ {
+ struct rpi_touchscreen *ts = panel_to_ts(panel);
+ int i;
+@@ -299,6 +299,13 @@ static int rpi_touchscreen_enable(struct drm_panel *panel)
+ rpi_touchscreen_write(ts, DSI_STARTDSI, 0x01);
+ msleep(100);
+
++ return 0;
++}
++
++static int rpi_touchscreen_enable(struct drm_panel *panel)
++{
++ struct rpi_touchscreen *ts = panel_to_ts(panel);
++
+ /* Turn on the backlight. */
+ rpi_touchscreen_i2c_write(ts, REG_PWM, 255);
+
+@@ -353,7 +360,7 @@ static int rpi_touchscreen_get_modes(struct drm_panel *panel)
+ static const struct drm_panel_funcs rpi_touchscreen_funcs = {
+ .disable = rpi_touchscreen_disable,
+ .unprepare = rpi_touchscreen_noop,
+- .prepare = rpi_touchscreen_noop,
++ .prepare = rpi_touchscreen_prepare,
+ .enable = rpi_touchscreen_enable,
+ .get_modes = rpi_touchscreen_get_modes,
+ };
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index cffd423172726..b0105d53918ab 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -3504,6 +3504,7 @@ try_smaller_buffer:
+ }
+
+ if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) {
++ size_t recalc_tags_size;
+ if (!ic->internal_hash) {
+ r = -EINVAL;
+ ti->error = "Recalculate is only valid with internal hash";
+@@ -3522,8 +3523,10 @@ try_smaller_buffer:
+ r = -ENOMEM;
+ goto bad;
+ }
+- ic->recalc_tags = kvmalloc_array(RECALC_SECTORS >> ic->sb->log2_sectors_per_block,
+- ic->tag_size, GFP_KERNEL);
++ recalc_tags_size = (RECALC_SECTORS >> ic->sb->log2_sectors_per_block) * ic->tag_size;
++ if (crypto_shash_digestsize(ic->internal_hash) > ic->tag_size)
++ recalc_tags_size += crypto_shash_digestsize(ic->internal_hash) - ic->tag_size;
++ ic->recalc_tags = kvmalloc(recalc_tags_size, GFP_KERNEL);
+ if (!ic->recalc_tags) {
+ ti->error = "Cannot allocate tags for recalculating";
+ r = -ENOMEM;
+diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
+index df99354ec12aa..232f45f722f0c 100644
+--- a/drivers/net/can/usb/usb_8dev.c
++++ b/drivers/net/can/usb/usb_8dev.c
+@@ -681,9 +681,20 @@ static netdev_tx_t usb_8dev_start_xmit(struct sk_buff *skb,
+ atomic_inc(&priv->active_tx_urbs);
+
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+- if (unlikely(err))
+- goto failed;
+- else if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS)
++ if (unlikely(err)) {
++ can_free_echo_skb(netdev, context->echo_index);
++
++ usb_unanchor_urb(urb);
++ usb_free_coherent(priv->udev, size, buf, urb->transfer_dma);
++
++ atomic_dec(&priv->active_tx_urbs);
++
++ if (err == -ENODEV)
++ netif_device_detach(netdev);
++ else
++ netdev_warn(netdev, "failed tx_urb %d\n", err);
++ stats->tx_dropped++;
++ } else if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS)
+ /* Slow down tx path */
+ netif_stop_queue(netdev);
+
+@@ -702,19 +713,6 @@ nofreecontext:
+
+ return NETDEV_TX_BUSY;
+
+-failed:
+- can_free_echo_skb(netdev, context->echo_index);
+-
+- usb_unanchor_urb(urb);
+- usb_free_coherent(priv->udev, size, buf, urb->transfer_dma);
+-
+- atomic_dec(&priv->active_tx_urbs);
+-
+- if (err == -ENODEV)
+- netif_device_detach(netdev);
+- else
+- netdev_warn(netdev, "failed tx_urb %d\n", err);
+-
+ nomembuf:
+ usb_free_urb(urb);
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 460bb81acf2bf..d8e4842af055b 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1364,6 +1364,7 @@ static void macb_tx_restart(struct macb_queue *queue)
+ unsigned int head = queue->tx_head;
+ unsigned int tail = queue->tx_tail;
+ struct macb *bp = queue->bp;
++ unsigned int head_idx, tbqp;
+
+ if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+ queue_writel(queue, ISR, MACB_BIT(TXUBR));
+@@ -1371,6 +1372,13 @@ static void macb_tx_restart(struct macb_queue *queue)
+ if (head == tail)
+ return;
+
++ tbqp = queue_readl(queue, TBQP) / macb_dma_desc_get_size(bp);
++ tbqp = macb_adj_dma_desc_idx(bp, macb_tx_ring_wrap(bp, tbqp));
++ head_idx = macb_adj_dma_desc_idx(bp, macb_tx_ring_wrap(bp, head));
++
++ if (tbqp == head_idx)
++ return;
++
+ macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART));
+ }
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c b/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c
+index 3184c8f7cdd05..6e69bcdf9c402 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c
+@@ -530,11 +530,15 @@ static int dpaa_get_ts_info(struct net_device *net_dev,
+ info->phc_index = -1;
+
+ fman_node = of_get_parent(mac_node);
+- if (fman_node)
++ if (fman_node) {
+ ptp_node = of_parse_phandle(fman_node, "ptimer-handle", 0);
++ of_node_put(fman_node);
++ }
+
+- if (ptp_node)
++ if (ptp_node) {
+ ptp_dev = of_find_device_by_node(ptp_node);
++ of_node_put(ptp_node);
++ }
+
+ if (ptp_dev)
+ ptp = platform_get_drvdata(ptp_dev);
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index fbad77450725a..7ec60fbb4740e 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -995,8 +995,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link)
+ {
+ u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) |
+ link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND;
+- u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */
+- u16 lat_enc_d = 0; /* latency decoded */
++ u32 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */
++ u32 lat_enc_d = 0; /* latency decoded */
+ u16 lat_enc = 0; /* latency encoded */
+
+ if (link) {
+diff --git a/drivers/net/ethernet/micrel/Kconfig b/drivers/net/ethernet/micrel/Kconfig
+index aa12bace8673e..b7e2f49696b74 100644
+--- a/drivers/net/ethernet/micrel/Kconfig
++++ b/drivers/net/ethernet/micrel/Kconfig
+@@ -45,7 +45,6 @@ config KS8851
+ config KS8851_MLL
+ tristate "Micrel KS8851 MLL"
+ depends on HAS_IOMEM
+- depends on PTP_1588_CLOCK_OPTIONAL
+ select MII
+ ---help---
+ This platform driver is for Micrel KS8851 Address/data bus
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index eacc1e32d5478..1b98a888a168e 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -524,11 +524,11 @@ static int vxlan_fdb_append(struct vxlan_fdb *f,
+
+ rd = kmalloc(sizeof(*rd), GFP_ATOMIC);
+ if (rd == NULL)
+- return -ENOBUFS;
++ return -ENOMEM;
+
+ if (dst_cache_init(&rd->dst_cache, GFP_ATOMIC)) {
+ kfree(rd);
+- return -ENOBUFS;
++ return -ENOMEM;
+ }
+
+ rd->remote_ip = *ip;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index a5195bdb4d9bd..0a96c1071e5b8 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -560,7 +560,7 @@ enum brcmf_sdio_frmtype {
+ BRCMF_SDIO_FT_SUB,
+ };
+
+-#define SDIOD_DRVSTR_KEY(chip, pmu) (((chip) << 16) | (pmu))
++#define SDIOD_DRVSTR_KEY(chip, pmu) (((unsigned int)(chip) << 16) | (pmu))
+
+ /* SDIO Pad drive strength to select value mappings */
+ struct sdiod_drive_str {
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_pci.c b/drivers/net/wireless/mediatek/mt76/mt76x2_pci.c
+index 26cfda24ce085..e26947f89299d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_pci.c
+@@ -73,7 +73,7 @@ mt76pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ mt76_rmw_field(dev, 0x15a10, 0x1f << 16, 0x9);
+
+ /* RG_SSUSB_G1_CDR_BIC_LTR = 0xf */
+- mt76_rmw_field(dev, 0x15a0c, 0xf << 28, 0xf);
++ mt76_rmw_field(dev, 0x15a0c, 0xfU << 28, 0xf);
+
+ /* RG_SSUSB_CDR_BR_PE1D = 0x3 */
+ mt76_rmw_field(dev, 0x15c58, 0x3 << 6, 0x3);
+diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
+index 77995df7fe547..453fdfdc6311e 100644
+--- a/drivers/perf/arm_pmu.c
++++ b/drivers/perf/arm_pmu.c
+@@ -321,6 +321,9 @@ validate_group(struct perf_event *event)
+ if (!validate_event(event->pmu, &fake_pmu, leader))
+ return -EINVAL;
+
++ if (event == leader)
++ return 0;
++
+ for_each_sibling_event(sibling, leader) {
+ if (!validate_event(event->pmu, &fake_pmu, sibling))
+ return -EINVAL;
+@@ -418,12 +421,7 @@ __hw_perf_event_init(struct perf_event *event)
+ local64_set(&hwc->period_left, hwc->sample_period);
+ }
+
+- if (event->group_leader != event) {
+- if (validate_group(event) != 0)
+- return -EINVAL;
+- }
+-
+- return 0;
++ return validate_group(event);
+ }
+
+ static int armpmu_event_init(struct perf_event *event)
+diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
+index 7b160ee981152..3e66be504a0da 100644
+--- a/drivers/platform/x86/samsung-laptop.c
++++ b/drivers/platform/x86/samsung-laptop.c
+@@ -1125,8 +1125,6 @@ static void kbd_led_set(struct led_classdev *led_cdev,
+
+ if (value > samsung->kbd_led.max_brightness)
+ value = samsung->kbd_led.max_brightness;
+- else if (value < 0)
+- value = 0;
+
+ samsung->kbd_led_wk = value;
+ queue_work(samsung->led_workqueue, &samsung->kbd_led_work);
+diff --git a/drivers/reset/tegra/reset-bpmp.c b/drivers/reset/tegra/reset-bpmp.c
+index 5daf2ee1a396b..f9790b60f9964 100644
+--- a/drivers/reset/tegra/reset-bpmp.c
++++ b/drivers/reset/tegra/reset-bpmp.c
+@@ -23,6 +23,7 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc,
+ struct tegra_bpmp *bpmp = to_tegra_bpmp(rstc);
+ struct mrq_reset_request request;
+ struct tegra_bpmp_message msg;
++ int err;
+
+ memset(&request, 0, sizeof(request));
+ request.cmd = command;
+@@ -33,7 +34,13 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc,
+ msg.tx.data = &request;
+ msg.tx.size = sizeof(request);
+
+- return tegra_bpmp_transfer(bpmp, &msg);
++ err = tegra_bpmp_transfer(bpmp, &msg);
++ if (err)
++ return err;
++ if (msg.rx.ret)
++ return -EINVAL;
++
++ return 0;
+ }
+
+ static int tegra_bpmp_reset_module(struct reset_controller_dev *rstc,
+diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
+index 45c7f829e3872..ad06fe669d98d 100644
+--- a/drivers/staging/android/ion/ion.c
++++ b/drivers/staging/android/ion/ion.c
+@@ -140,6 +140,9 @@ static void *ion_buffer_kmap_get(struct ion_buffer *buffer)
+ void *vaddr;
+
+ if (buffer->kmap_cnt) {
++ if (buffer->kmap_cnt == INT_MAX)
++ return ERR_PTR(-EOVERFLOW);
++
+ buffer->kmap_cnt++;
+ return buffer->vaddr;
+ }
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index baa1713d66958..52b1524b40cdc 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -813,7 +813,7 @@ cifs_loose_read_iter(struct kiocb *iocb, struct iov_iter *iter)
+ ssize_t rc;
+ struct inode *inode = file_inode(iocb->ki_filp);
+
+- if (iocb->ki_filp->f_flags & O_DIRECT)
++ if (iocb->ki_flags & IOCB_DIRECT)
+ return cifs_user_readv(iocb, iter);
+
+ rc = cifs_revalidate_mapping(inode);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 96cf0f57ca950..76c887108df35 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4314,7 +4314,8 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
+ struct super_block *sb = inode->i_sb;
+ ext4_lblk_t first_block, stop_block;
+ struct address_space *mapping = inode->i_mapping;
+- loff_t first_block_offset, last_block_offset;
++ loff_t first_block_offset, last_block_offset, max_length;
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ handle_t *handle;
+ unsigned int credits;
+ int ret = 0;
+@@ -4360,6 +4361,14 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
+ offset;
+ }
+
++ /*
++ * For punch hole the length + offset needs to be within one block
++ * before last range. Adjust the length if it goes beyond that limit.
++ */
++ max_length = sbi->s_bitmap_maxbytes - inode->i_sb->s_blocksize;
++ if (offset + length > max_length)
++ length = max_length - offset;
++
+ if (offset & (sb->s_blocksize - 1) ||
+ (offset + length) & (sb->s_blocksize - 1)) {
+ /*
+diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
+index 9cc79b7b0df11..3de933354a08b 100644
+--- a/fs/ext4/page-io.c
++++ b/fs/ext4/page-io.c
+@@ -105,8 +105,10 @@ static void ext4_finish_bio(struct bio *bio)
+ continue;
+ }
+ clear_buffer_async_write(bh);
+- if (bio->bi_status)
++ if (bio->bi_status) {
++ set_buffer_write_io_error(bh);
+ buffer_io_error(bh);
++ }
+ } while ((bh = bh->b_this_page) != head);
+ bit_spin_unlock(BH_Uptodate_Lock, &head->b_state);
+ local_irq_restore(flags);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 648eb6a24e3a3..6893b87c73547 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3440,9 +3440,11 @@ static int count_overhead(struct super_block *sb, ext4_group_t grp,
+ ext4_fsblk_t first_block, last_block, b;
+ ext4_group_t i, ngroups = ext4_get_groups_count(sb);
+ int s, j, count = 0;
++ int has_super = ext4_bg_has_super(sb, grp);
+
+ if (!ext4_has_feature_bigalloc(sb))
+- return (ext4_bg_has_super(sb, grp) + ext4_bg_num_gdb(sb, grp) +
++ return (has_super + ext4_bg_num_gdb(sb, grp) +
++ (has_super ? le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) : 0) +
+ sbi->s_itb_per_group + 2);
+
+ first_block = le32_to_cpu(sbi->s_es->s_first_data_block) +
+@@ -4421,9 +4423,18 @@ no_journal:
+ * Get the # of file system overhead blocks from the
+ * superblock if present.
+ */
+- if (es->s_overhead_clusters)
+- sbi->s_overhead = le32_to_cpu(es->s_overhead_clusters);
+- else {
++ sbi->s_overhead = le32_to_cpu(es->s_overhead_clusters);
++ /* ignore the precalculated value if it is ridiculous */
++ if (sbi->s_overhead > ext4_blocks_count(es))
++ sbi->s_overhead = 0;
++ /*
++ * If the bigalloc feature is not enabled recalculating the
++ * overhead doesn't take long, so we might as well just redo
++ * it to make sure we are using the correct value.
++ */
++ if (!ext4_has_feature_bigalloc(sb))
++ sbi->s_overhead = 0;
++ if (sbi->s_overhead == 0) {
+ err = ext4_calculate_overhead(sb);
+ if (err)
+ goto failed_mount_wq;
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 29dcf0973b73f..cd2d8d6744678 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -926,15 +926,15 @@ static int read_rindex_entry(struct gfs2_inode *ip)
+ rgd->rd_bitbytes = be32_to_cpu(buf.ri_bitbytes);
+ spin_lock_init(&rgd->rd_rsspin);
+
+- error = compute_bitstructs(rgd);
+- if (error)
+- goto fail;
+-
+ error = gfs2_glock_get(sdp, rgd->rd_addr,
+ &gfs2_rgrp_glops, CREATE, &rgd->rd_gl);
+ if (error)
+ goto fail;
+
++ error = compute_bitstructs(rgd);
++ if (error)
++ goto fail_glock;
++
+ rgd->rd_rgl = (struct gfs2_rgrp_lvb *)rgd->rd_gl->gl_lksb.sb_lvbptr;
+ rgd->rd_flags &= ~(GFS2_RDF_UPTODATE | GFS2_RDF_PREFERRED);
+ if (rgd->rd_data > sdp->sd_max_rg_data)
+@@ -951,6 +951,7 @@ static int read_rindex_entry(struct gfs2_inode *ip)
+ }
+
+ error = 0; /* someone else read in the rgrp; free it and ignore it */
++fail_glock:
+ gfs2_glock_put(rgd->rd_gl);
+
+ fail:
+diff --git a/fs/stat.c b/fs/stat.c
+index f8e6fb2c36576..376543199b5a2 100644
+--- a/fs/stat.c
++++ b/fs/stat.c
+@@ -286,9 +286,6 @@ SYSCALL_DEFINE2(fstat, unsigned int, fd, struct __old_kernel_stat __user *, stat
+ # define choose_32_64(a,b) b
+ #endif
+
+-#define valid_dev(x) choose_32_64(old_valid_dev(x),true)
+-#define encode_dev(x) choose_32_64(old_encode_dev,new_encode_dev)(x)
+-
+ #ifndef INIT_STRUCT_STAT_PADDING
+ # define INIT_STRUCT_STAT_PADDING(st) memset(&st, 0, sizeof(st))
+ #endif
+@@ -297,7 +294,9 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf)
+ {
+ struct stat tmp;
+
+- if (!valid_dev(stat->dev) || !valid_dev(stat->rdev))
++ if (sizeof(tmp.st_dev) < 4 && !old_valid_dev(stat->dev))
++ return -EOVERFLOW;
++ if (sizeof(tmp.st_rdev) < 4 && !old_valid_dev(stat->rdev))
+ return -EOVERFLOW;
+ #if BITS_PER_LONG == 32
+ if (stat->size > MAX_NON_LFS)
+@@ -305,7 +304,7 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf)
+ #endif
+
+ INIT_STRUCT_STAT_PADDING(tmp);
+- tmp.st_dev = encode_dev(stat->dev);
++ tmp.st_dev = new_encode_dev(stat->dev);
+ tmp.st_ino = stat->ino;
+ if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
+ return -EOVERFLOW;
+@@ -315,7 +314,7 @@ static int cp_new_stat(struct kstat *stat, struct stat __user *statbuf)
+ return -EOVERFLOW;
+ SET_UID(tmp.st_uid, from_kuid_munged(current_user_ns(), stat->uid));
+ SET_GID(tmp.st_gid, from_kgid_munged(current_user_ns(), stat->gid));
+- tmp.st_rdev = encode_dev(stat->rdev);
++ tmp.st_rdev = new_encode_dev(stat->rdev);
+ tmp.st_size = stat->size;
+ tmp.st_atime = stat->atime.tv_sec;
+ tmp.st_mtime = stat->mtime.tv_sec;
+@@ -588,11 +587,13 @@ static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
+ {
+ struct compat_stat tmp;
+
+- if (!old_valid_dev(stat->dev) || !old_valid_dev(stat->rdev))
++ if (sizeof(tmp.st_dev) < 4 && !old_valid_dev(stat->dev))
++ return -EOVERFLOW;
++ if (sizeof(tmp.st_rdev) < 4 && !old_valid_dev(stat->rdev))
+ return -EOVERFLOW;
+
+ memset(&tmp, 0, sizeof(tmp));
+- tmp.st_dev = old_encode_dev(stat->dev);
++ tmp.st_dev = new_encode_dev(stat->dev);
+ tmp.st_ino = stat->ino;
+ if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
+ return -EOVERFLOW;
+@@ -602,7 +603,7 @@ static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
+ return -EOVERFLOW;
+ SET_UID(tmp.st_uid, from_kuid_munged(current_user_ns(), stat->uid));
+ SET_GID(tmp.st_gid, from_kgid_munged(current_user_ns(), stat->gid));
+- tmp.st_rdev = old_encode_dev(stat->rdev);
++ tmp.st_rdev = new_encode_dev(stat->rdev);
+ if ((u64) stat->size > MAX_NON_LFS)
+ return -EOVERFLOW;
+ tmp.st_size = stat->size;
+diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
+index 572e11bb86967..e1e9eff096d05 100644
+--- a/include/linux/etherdevice.h
++++ b/include/linux/etherdevice.h
+@@ -130,7 +130,7 @@ static inline bool is_multicast_ether_addr(const u8 *addr)
+ #endif
+ }
+
+-static inline bool is_multicast_ether_addr_64bits(const u8 addr[6+2])
++static inline bool is_multicast_ether_addr_64bits(const u8 *addr)
+ {
+ #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
+ #ifdef __BIG_ENDIAN
+@@ -344,8 +344,7 @@ static inline bool ether_addr_equal(const u8 *addr1, const u8 *addr2)
+ * Please note that alignment of addr1 & addr2 are only guaranteed to be 16 bits.
+ */
+
+-static inline bool ether_addr_equal_64bits(const u8 addr1[6+2],
+- const u8 addr2[6+2])
++static inline bool ether_addr_equal_64bits(const u8 *addr1, const u8 *addr2)
+ {
+ #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
+ u64 fold = (*(const u64 *)addr1) ^ (*(const u64 *)addr2);
+diff --git a/include/net/ax25.h b/include/net/ax25.h
+index 8b7eb46ad72d8..aadff553e4b73 100644
+--- a/include/net/ax25.h
++++ b/include/net/ax25.h
+@@ -236,6 +236,7 @@ typedef struct ax25_dev {
+ #if defined(CONFIG_AX25_DAMA_SLAVE) || defined(CONFIG_AX25_DAMA_MASTER)
+ ax25_dama_info dama;
+ #endif
++ refcount_t refcount;
+ } ax25_dev;
+
+ typedef struct ax25_cb {
+@@ -290,6 +291,17 @@ static __inline__ void ax25_cb_put(ax25_cb *ax25)
+ }
+ }
+
++static inline void ax25_dev_hold(ax25_dev *ax25_dev)
++{
++ refcount_inc(&ax25_dev->refcount);
++}
++
++static inline void ax25_dev_put(ax25_dev *ax25_dev)
++{
++ if (refcount_dec_and_test(&ax25_dev->refcount)) {
++ kfree(ax25_dev);
++ }
++}
+ static inline __be16 ax25_type_trans(struct sk_buff *skb, struct net_device *dev)
+ {
+ skb->dev = dev;
+diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
+index b875dcef173c9..fa5fe23ca6aaa 100644
+--- a/include/net/inet_hashtables.h
++++ b/include/net/inet_hashtables.h
+@@ -232,8 +232,9 @@ void inet_hashinfo2_init(struct inet_hashinfo *h, const char *name,
+ unsigned long low_limit,
+ unsigned long high_limit);
+
+-bool inet_ehash_insert(struct sock *sk, struct sock *osk);
+-bool inet_ehash_nolisten(struct sock *sk, struct sock *osk);
++bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk);
++bool inet_ehash_nolisten(struct sock *sk, struct sock *osk,
++ bool *found_dup_sk);
+ int __inet_hash(struct sock *sk, struct sock *osk);
+ int inet_hash(struct sock *sk);
+ void inet_unhash(struct sock *sk);
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index 32e573c42a68c..4b0bde304ad79 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -1212,7 +1212,14 @@ static void
+ stacktrace_trigger(struct event_trigger_data *data, void *rec,
+ struct ring_buffer_event *event)
+ {
+- trace_dump_stack(STACK_SKIP);
++ struct trace_event_file *file = data->private_data;
++ unsigned long flags;
++
++ if (file) {
++ local_save_flags(flags);
++ __trace_stack(file->tr, flags, STACK_SKIP, preempt_count());
++ } else
++ trace_dump_stack(STACK_SKIP);
+ }
+
+ static void
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index f60f7ad5d0ba8..9c35403d96461 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -7117,7 +7117,7 @@ void __init mem_init_print_info(const char *str)
+ */
+ #define adj_init_size(start, end, size, pos, adj) \
+ do { \
+- if (start <= pos && pos < end && size > adj) \
++ if (&start[0] <= &pos[0] && &pos[0] < &end[0] && size > adj) \
+ size -= adj; \
+ } while (0)
+
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index 3170b43b9f894..7861f2747f843 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -92,17 +92,21 @@ again:
+ sk = s->sk;
+ if (!sk) {
+ spin_unlock_bh(&ax25_list_lock);
+- s->ax25_dev = NULL;
+ ax25_disconnect(s, ENETUNREACH);
++ s->ax25_dev = NULL;
+ spin_lock_bh(&ax25_list_lock);
+ goto again;
+ }
+ sock_hold(sk);
+ spin_unlock_bh(&ax25_list_lock);
+ lock_sock(sk);
++ ax25_disconnect(s, ENETUNREACH);
+ s->ax25_dev = NULL;
++ if (sk->sk_socket) {
++ dev_put(ax25_dev->dev);
++ ax25_dev_put(ax25_dev);
++ }
+ release_sock(sk);
+- ax25_disconnect(s, ENETUNREACH);
+ spin_lock_bh(&ax25_list_lock);
+ sock_put(sk);
+ /* The entry could have been deleted from the
+@@ -368,21 +372,25 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
+ if (copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl)))
+ return -EFAULT;
+
+- if ((ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr)) == NULL)
+- return -ENODEV;
+-
+ if (ax25_ctl.digi_count > AX25_MAX_DIGIS)
+ return -EINVAL;
+
+ if (ax25_ctl.arg > ULONG_MAX / HZ && ax25_ctl.cmd != AX25_KILL)
+ return -EINVAL;
+
++ ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr);
++ if (!ax25_dev)
++ return -ENODEV;
++
+ digi.ndigi = ax25_ctl.digi_count;
+ for (k = 0; k < digi.ndigi; k++)
+ digi.calls[k] = ax25_ctl.digi_addr[k];
+
+- if ((ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, ax25_dev->dev)) == NULL)
++ ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, ax25_dev->dev);
++ if (!ax25) {
++ ax25_dev_put(ax25_dev);
+ return -ENOTCONN;
++ }
+
+ switch (ax25_ctl.cmd) {
+ case AX25_KILL:
+@@ -449,6 +457,7 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
+ }
+
+ out_put:
++ ax25_dev_put(ax25_dev);
+ ax25_cb_put(ax25);
+ return ret;
+
+@@ -974,14 +983,16 @@ static int ax25_release(struct socket *sock)
+ {
+ struct sock *sk = sock->sk;
+ ax25_cb *ax25;
++ ax25_dev *ax25_dev;
+
+ if (sk == NULL)
+ return 0;
+
+ sock_hold(sk);
+- sock_orphan(sk);
+ lock_sock(sk);
++ sock_orphan(sk);
+ ax25 = sk_to_ax25(sk);
++ ax25_dev = ax25->ax25_dev;
+
+ if (sk->sk_type == SOCK_SEQPACKET) {
+ switch (ax25->state) {
+@@ -1043,6 +1054,15 @@ static int ax25_release(struct socket *sock)
+ sk->sk_state_change(sk);
+ ax25_destroy_socket(ax25);
+ }
++ if (ax25_dev) {
++ del_timer_sync(&ax25->timer);
++ del_timer_sync(&ax25->t1timer);
++ del_timer_sync(&ax25->t2timer);
++ del_timer_sync(&ax25->t3timer);
++ del_timer_sync(&ax25->idletimer);
++ dev_put(ax25_dev->dev);
++ ax25_dev_put(ax25_dev);
++ }
+
+ sock->sk = NULL;
+ release_sock(sk);
+@@ -1119,8 +1139,10 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ }
+ }
+
+- if (ax25_dev != NULL)
++ if (ax25_dev) {
+ ax25_fillin_cb(ax25, ax25_dev);
++ dev_hold(ax25_dev->dev);
++ }
+
+ done:
+ ax25_cb_add(ax25);
+diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
+index d92195cd78349..55a611f7239bc 100644
+--- a/net/ax25/ax25_dev.c
++++ b/net/ax25/ax25_dev.c
+@@ -40,6 +40,7 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr)
+ for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next)
+ if (ax25cmp(addr, (ax25_address *)ax25_dev->dev->dev_addr) == 0) {
+ res = ax25_dev;
++ ax25_dev_hold(ax25_dev);
+ }
+ spin_unlock_bh(&ax25_dev_lock);
+
+@@ -59,6 +60,7 @@ void ax25_dev_device_up(struct net_device *dev)
+ return;
+ }
+
++ refcount_set(&ax25_dev->refcount, 1);
+ dev->ax25_ptr = ax25_dev;
+ ax25_dev->dev = dev;
+ dev_hold(dev);
+@@ -87,6 +89,7 @@ void ax25_dev_device_up(struct net_device *dev)
+ ax25_dev->next = ax25_dev_list;
+ ax25_dev_list = ax25_dev;
+ spin_unlock_bh(&ax25_dev_lock);
++ ax25_dev_hold(ax25_dev);
+
+ ax25_register_dev_sysctl(ax25_dev);
+ }
+@@ -116,9 +119,10 @@ void ax25_dev_device_down(struct net_device *dev)
+ if ((s = ax25_dev_list) == ax25_dev) {
+ ax25_dev_list = s->next;
+ spin_unlock_bh(&ax25_dev_lock);
++ ax25_dev_put(ax25_dev);
+ dev->ax25_ptr = NULL;
+ dev_put(dev);
+- kfree(ax25_dev);
++ ax25_dev_put(ax25_dev);
+ return;
+ }
+
+@@ -126,9 +130,10 @@ void ax25_dev_device_down(struct net_device *dev)
+ if (s->next == ax25_dev) {
+ s->next = ax25_dev->next;
+ spin_unlock_bh(&ax25_dev_lock);
++ ax25_dev_put(ax25_dev);
+ dev->ax25_ptr = NULL;
+ dev_put(dev);
+- kfree(ax25_dev);
++ ax25_dev_put(ax25_dev);
+ return;
+ }
+
+@@ -136,6 +141,7 @@ void ax25_dev_device_down(struct net_device *dev)
+ }
+ spin_unlock_bh(&ax25_dev_lock);
+ dev->ax25_ptr = NULL;
++ ax25_dev_put(ax25_dev);
+ }
+
+ int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd)
+@@ -147,20 +153,32 @@ int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd)
+
+ switch (cmd) {
+ case SIOCAX25ADDFWD:
+- if ((fwd_dev = ax25_addr_ax25dev(&fwd->port_to)) == NULL)
++ fwd_dev = ax25_addr_ax25dev(&fwd->port_to);
++ if (!fwd_dev) {
++ ax25_dev_put(ax25_dev);
+ return -EINVAL;
+- if (ax25_dev->forward != NULL)
++ }
++ if (ax25_dev->forward) {
++ ax25_dev_put(fwd_dev);
++ ax25_dev_put(ax25_dev);
+ return -EINVAL;
++ }
+ ax25_dev->forward = fwd_dev->dev;
++ ax25_dev_put(fwd_dev);
++ ax25_dev_put(ax25_dev);
+ break;
+
+ case SIOCAX25DELFWD:
+- if (ax25_dev->forward == NULL)
++ if (!ax25_dev->forward) {
++ ax25_dev_put(ax25_dev);
+ return -EINVAL;
++ }
+ ax25_dev->forward = NULL;
++ ax25_dev_put(ax25_dev);
+ break;
+
+ default:
++ ax25_dev_put(ax25_dev);
+ return -EINVAL;
+ }
+
+diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
+index 66d54fc11831c..8f81de88f0066 100644
+--- a/net/ax25/ax25_route.c
++++ b/net/ax25/ax25_route.c
+@@ -78,11 +78,13 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route)
+ ax25_dev *ax25_dev;
+ int i;
+
+- if ((ax25_dev = ax25_addr_ax25dev(&route->port_addr)) == NULL)
+- return -EINVAL;
+ if (route->digi_count > AX25_MAX_DIGIS)
+ return -EINVAL;
+
++ ax25_dev = ax25_addr_ax25dev(&route->port_addr);
++ if (!ax25_dev)
++ return -EINVAL;
++
+ write_lock_bh(&ax25_route_lock);
+
+ ax25_rt = ax25_route_list;
+@@ -94,6 +96,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route)
+ if (route->digi_count != 0) {
+ if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
+ write_unlock_bh(&ax25_route_lock);
++ ax25_dev_put(ax25_dev);
+ return -ENOMEM;
+ }
+ ax25_rt->digipeat->lastrepeat = -1;
+@@ -104,6 +107,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route)
+ }
+ }
+ write_unlock_bh(&ax25_route_lock);
++ ax25_dev_put(ax25_dev);
+ return 0;
+ }
+ ax25_rt = ax25_rt->next;
+@@ -111,6 +115,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route)
+
+ if ((ax25_rt = kmalloc(sizeof(ax25_route), GFP_ATOMIC)) == NULL) {
+ write_unlock_bh(&ax25_route_lock);
++ ax25_dev_put(ax25_dev);
+ return -ENOMEM;
+ }
+
+@@ -123,6 +128,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route)
+ if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
+ write_unlock_bh(&ax25_route_lock);
+ kfree(ax25_rt);
++ ax25_dev_put(ax25_dev);
+ return -ENOMEM;
+ }
+ ax25_rt->digipeat->lastrepeat = -1;
+@@ -135,6 +141,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route)
+ ax25_rt->next = ax25_route_list;
+ ax25_route_list = ax25_rt;
+ write_unlock_bh(&ax25_route_lock);
++ ax25_dev_put(ax25_dev);
+
+ return 0;
+ }
+@@ -176,6 +183,7 @@ static int ax25_rt_del(struct ax25_routes_struct *route)
+ }
+ }
+ write_unlock_bh(&ax25_route_lock);
++ ax25_dev_put(ax25_dev);
+
+ return 0;
+ }
+@@ -218,6 +226,7 @@ static int ax25_rt_opt(struct ax25_route_opt_struct *rt_option)
+
+ out:
+ write_unlock_bh(&ax25_route_lock);
++ ax25_dev_put(ax25_dev);
+ return err;
+ }
+
+diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
+index 038b109b2be70..c129865cad9f4 100644
+--- a/net/ax25/ax25_subr.c
++++ b/net/ax25/ax25_subr.c
+@@ -264,12 +264,20 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
+ {
+ ax25_clear_queues(ax25);
+
+- if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY))
+- ax25_stop_heartbeat(ax25);
+- ax25_stop_t1timer(ax25);
+- ax25_stop_t2timer(ax25);
+- ax25_stop_t3timer(ax25);
+- ax25_stop_idletimer(ax25);
++ if (reason == ENETUNREACH) {
++ del_timer_sync(&ax25->timer);
++ del_timer_sync(&ax25->t1timer);
++ del_timer_sync(&ax25->t2timer);
++ del_timer_sync(&ax25->t3timer);
++ del_timer_sync(&ax25->idletimer);
++ } else {
++ if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY))
++ ax25_stop_heartbeat(ax25);
++ ax25_stop_t1timer(ax25);
++ ax25_stop_t2timer(ax25);
++ ax25_stop_t3timer(ax25);
++ ax25_stop_idletimer(ax25);
++ }
+
+ ax25->state = AX25_STATE_0;
+
+diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
+index 176bddacc16eb..7e93087d13667 100644
+--- a/net/dccp/ipv4.c
++++ b/net/dccp/ipv4.c
+@@ -428,7 +428,7 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk,
+
+ if (__inet_inherit_port(sk, newsk) < 0)
+ goto put_and_exit;
+- *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
++ *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash), NULL);
+ if (*own_req)
+ ireq->ireq_opt = NULL;
+ else
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 2cd3508a37869..ae4851fdbe9e5 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -538,7 +538,7 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
+ dccp_done(newsk);
+ goto out;
+ }
+- *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
++ *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash), NULL);
+ /* Clone pktoptions received with SYN, if we own the req */
+ if (*own_req && ireq->pktopts) {
+ newnp->pktoptions = skb_clone(ireq->pktopts, GFP_ATOMIC);
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 439a55d1aa993..0a69f92da71b8 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -793,7 +793,7 @@ static void reqsk_queue_hash_req(struct request_sock *req,
+ timer_setup(&req->rsk_timer, reqsk_timer_handler, TIMER_PINNED);
+ mod_timer(&req->rsk_timer, jiffies + timeout);
+
+- inet_ehash_insert(req_to_sk(req), NULL);
++ inet_ehash_insert(req_to_sk(req), NULL, NULL);
+ /* before letting lookups find us, make sure all req fields
+ * are committed to memory and refcnt initialized.
+ */
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index 3a5f12f011cb4..c96a5871b49da 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -24,6 +24,9 @@
+ #include <net/addrconf.h>
+ #include <net/inet_connection_sock.h>
+ #include <net/inet_hashtables.h>
++#if IS_ENABLED(CONFIG_IPV6)
++#include <net/inet6_hashtables.h>
++#endif
+ #include <net/secure_seq.h>
+ #include <net/ip.h>
+ #include <net/tcp.h>
+@@ -513,10 +516,52 @@ static u32 inet_sk_port_offset(const struct sock *sk)
+ inet->inet_dport);
+ }
+
+-/* insert a socket into ehash, and eventually remove another one
+- * (The another one can be a SYN_RECV or TIMEWAIT
++/* Searches for an exsiting socket in the ehash bucket list.
++ * Returns true if found, false otherwise.
+ */
+-bool inet_ehash_insert(struct sock *sk, struct sock *osk)
++static bool inet_ehash_lookup_by_sk(struct sock *sk,
++ struct hlist_nulls_head *list)
++{
++ const __portpair ports = INET_COMBINED_PORTS(sk->sk_dport, sk->sk_num);
++ const int sdif = sk->sk_bound_dev_if;
++ const int dif = sk->sk_bound_dev_if;
++ const struct hlist_nulls_node *node;
++ struct net *net = sock_net(sk);
++ struct sock *esk;
++
++ INET_ADDR_COOKIE(acookie, sk->sk_daddr, sk->sk_rcv_saddr);
++
++ sk_nulls_for_each_rcu(esk, node, list) {
++ if (esk->sk_hash != sk->sk_hash)
++ continue;
++ if (sk->sk_family == AF_INET) {
++ if (unlikely(INET_MATCH(esk, net, acookie,
++ sk->sk_daddr,
++ sk->sk_rcv_saddr,
++ ports, dif, sdif))) {
++ return true;
++ }
++ }
++#if IS_ENABLED(CONFIG_IPV6)
++ else if (sk->sk_family == AF_INET6) {
++ if (unlikely(INET6_MATCH(esk, net,
++ &sk->sk_v6_daddr,
++ &sk->sk_v6_rcv_saddr,
++ ports, dif, sdif))) {
++ return true;
++ }
++ }
++#endif
++ }
++ return false;
++}
++
++/* Insert a socket into ehash, and eventually remove another one
++ * (The another one can be a SYN_RECV or TIMEWAIT)
++ * If an existing socket already exists, socket sk is not inserted,
++ * and sets found_dup_sk parameter to true.
++ */
++bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)
+ {
+ struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
+ struct hlist_nulls_head *list;
+@@ -535,16 +580,23 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk)
+ if (osk) {
+ WARN_ON_ONCE(sk->sk_hash != osk->sk_hash);
+ ret = sk_nulls_del_node_init_rcu(osk);
++ } else if (found_dup_sk) {
++ *found_dup_sk = inet_ehash_lookup_by_sk(sk, list);
++ if (*found_dup_sk)
++ ret = false;
+ }
++
+ if (ret)
+ __sk_nulls_add_node_rcu(sk, list);
++
+ spin_unlock(lock);
++
+ return ret;
+ }
+
+-bool inet_ehash_nolisten(struct sock *sk, struct sock *osk)
++bool inet_ehash_nolisten(struct sock *sk, struct sock *osk, bool *found_dup_sk)
+ {
+- bool ok = inet_ehash_insert(sk, osk);
++ bool ok = inet_ehash_insert(sk, osk, found_dup_sk);
+
+ if (ok) {
+ sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+@@ -588,7 +640,7 @@ int __inet_hash(struct sock *sk, struct sock *osk)
+ int err = 0;
+
+ if (sk->sk_state != TCP_LISTEN) {
+- inet_ehash_nolisten(sk, osk);
++ inet_ehash_nolisten(sk, osk, NULL);
+ return 0;
+ }
+ WARN_ON(!sk_unhashed(sk));
+@@ -683,7 +735,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+ tb = inet_csk(sk)->icsk_bind_hash;
+ spin_lock_bh(&head->lock);
+ if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
+- inet_ehash_nolisten(sk, NULL);
++ inet_ehash_nolisten(sk, NULL, NULL);
+ spin_unlock_bh(&head->lock);
+ return 0;
+ }
+@@ -759,7 +811,7 @@ ok:
+ inet_bind_hash(sk, tb, port);
+ if (sk_unhashed(sk)) {
+ inet_sk(sk)->inet_sport = htons(port);
+- inet_ehash_nolisten(sk, (struct sock *)tw);
++ inet_ehash_nolisten(sk, (struct sock *)tw, NULL);
+ }
+ if (tw)
+ inet_twsk_bind_unhash(tw, hinfo);
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index de4edfbc9e466..c9fc6e3868be3 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1415,6 +1415,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
+ bool *own_req)
+ {
+ struct inet_request_sock *ireq;
++ bool found_dup_sk = false;
+ struct inet_sock *newinet;
+ struct tcp_sock *newtp;
+ struct sock *newsk;
+@@ -1485,12 +1486,22 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
+
+ if (__inet_inherit_port(sk, newsk) < 0)
+ goto put_and_exit;
+- *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
++ *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash),
++ &found_dup_sk);
+ if (likely(*own_req)) {
+ tcp_move_syn(newtp, req);
+ ireq->ireq_opt = NULL;
+ } else {
+ newinet->inet_opt = NULL;
++
++ if (!req_unhash && found_dup_sk) {
++ /* This code path should only be executed in the
++ * syncookie case only
++ */
++ bh_unlock_sock(newsk);
++ sock_put(newsk);
++ newsk = NULL;
++ }
+ }
+ return newsk;
+
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index e8d206725cb75..c332f75f4e9aa 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1090,6 +1090,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
+ struct ipv6_txoptions *opt;
+ struct tcp6_sock *newtcp6sk;
+ struct inet_sock *newinet;
++ bool found_dup_sk = false;
+ struct tcp_sock *newtp;
+ struct sock *newsk;
+ #ifdef CONFIG_TCP_MD5SIG
+@@ -1258,7 +1259,8 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
+ tcp_done(newsk);
+ goto out;
+ }
+- *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
++ *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash),
++ &found_dup_sk);
+ if (*own_req) {
+ tcp_move_syn(newtp, req);
+
+@@ -1273,6 +1275,15 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
+ skb_set_owner_r(newnp->pktoptions, newsk);
+ }
+ }
++ } else {
++ if (!req_unhash && found_dup_sk) {
++ /* This code path should only be executed in the
++ * syncookie case only
++ */
++ bh_unlock_sock(newsk);
++ sock_put(newsk);
++ newsk = NULL;
++ }
+ }
+
+ return newsk;
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 5c6241964637f..e2120221b9578 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -2243,6 +2243,13 @@ static int netlink_dump(struct sock *sk)
+ * single netdev. The outcome is MSG_TRUNC error.
+ */
+ skb_reserve(skb, skb_tailroom(skb) - alloc_size);
++
++ /* Make sure malicious BPF programs can not read unitialized memory
++ * from skb->head -> skb->data
++ */
++ skb_reset_network_header(skb);
++ skb_reset_mac_header(skb);
++
+ netlink_skb_set_owner_r(skb, sk);
+
+ if (nlk->dump_done_errno > 0)
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index 4413ffdc1e030..180f5feb77177 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -2316,7 +2316,7 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
+ new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);
+
+ if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
+- if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {
++ if ((next_offset + req_size) > MAX_ACTIONS_BUFSIZE) {
+ OVS_NLERR(log, "Flow action size exceeds max %u",
+ MAX_ACTIONS_BUFSIZE);
+ return ERR_PTR(-EMSGSIZE);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index b951f411ddedc..f654f79e3310c 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2791,8 +2791,9 @@ tpacket_error:
+
+ status = TP_STATUS_SEND_REQUEST;
+ err = po->xmit(skb);
+- if (unlikely(err > 0)) {
+- err = net_xmit_errno(err);
++ if (unlikely(err != 0)) {
++ if (err > 0)
++ err = net_xmit_errno(err);
+ if (err && __packet_get_status(po, ph) ==
+ TP_STATUS_AVAILABLE) {
+ /* skb was destructed already */
+@@ -2993,8 +2994,12 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ skb->no_fcs = 1;
+
+ err = po->xmit(skb);
+- if (err > 0 && (err = net_xmit_errno(err)) != 0)
+- goto out_unlock;
++ if (unlikely(err != 0)) {
++ if (err > 0)
++ err = net_xmit_errno(err);
++ if (err)
++ goto out_unlock;
++ }
+
+ dev_put(dev);
+
+diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c
+index 1b403c2573da2..39579cfcf9b88 100644
+--- a/net/rxrpc/net_ns.c
++++ b/net/rxrpc/net_ns.c
+@@ -117,7 +117,9 @@ static __net_exit void rxrpc_exit_net(struct net *net)
+ struct rxrpc_net *rxnet = rxrpc_net(net);
+
+ rxnet->live = false;
++ del_timer_sync(&rxnet->peer_keepalive_timer);
+ cancel_work_sync(&rxnet->peer_keepalive_work);
++ /* Remove the timer again as the worker may have restarted it. */
+ del_timer_sync(&rxnet->peer_keepalive_timer);
+ rxrpc_destroy_all_calls(rxnet);
+ rxrpc_destroy_all_connections(rxnet);
+diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
+index fe246e03fcd9c..5eee26cf9011f 100644
+--- a/net/sched/cls_u32.c
++++ b/net/sched/cls_u32.c
+@@ -873,10 +873,6 @@ static struct tc_u_knode *u32_init_knode(struct tcf_proto *tp,
+ new->flags = n->flags;
+ RCU_INIT_POINTER(new->ht_down, ht);
+
+- /* bump reference count as long as we hold pointer to structure */
+- if (ht)
+- ht->refcnt++;
+-
+ #ifdef CONFIG_CLS_U32_PERF
+ /* Statistics may be incremented by readers during update
+ * so we must keep them in tact. When the node is later destroyed
+@@ -899,6 +895,10 @@ static struct tc_u_knode *u32_init_knode(struct tcf_proto *tp,
+ return NULL;
+ }
+
++ /* bump reference count as long as we hold pointer to structure */
++ if (ht)
++ ht->refcnt++;
++
+ return new;
+ }
+
+diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c
+index 5041f43ee5f79..06d32257ddb60 100644
+--- a/sound/soc/atmel/sam9g20_wm8731.c
++++ b/sound/soc/atmel/sam9g20_wm8731.c
+@@ -59,35 +59,6 @@
+ */
+ #undef ENABLE_MIC_INPUT
+
+-static struct clk *mclk;
+-
+-static int at91sam9g20ek_set_bias_level(struct snd_soc_card *card,
+- struct snd_soc_dapm_context *dapm,
+- enum snd_soc_bias_level level)
+-{
+- static int mclk_on;
+- int ret = 0;
+-
+- switch (level) {
+- case SND_SOC_BIAS_ON:
+- case SND_SOC_BIAS_PREPARE:
+- if (!mclk_on)
+- ret = clk_enable(mclk);
+- if (ret == 0)
+- mclk_on = 1;
+- break;
+-
+- case SND_SOC_BIAS_OFF:
+- case SND_SOC_BIAS_STANDBY:
+- if (mclk_on)
+- clk_disable(mclk);
+- mclk_on = 0;
+- break;
+- }
+-
+- return ret;
+-}
+-
+ static const struct snd_soc_dapm_widget at91sam9g20ek_dapm_widgets[] = {
+ SND_SOC_DAPM_MIC("Int Mic", NULL),
+ SND_SOC_DAPM_SPK("Ext Spk", NULL),
+@@ -146,7 +117,6 @@ static struct snd_soc_card snd_soc_at91sam9g20ek = {
+ .owner = THIS_MODULE,
+ .dai_link = &at91sam9g20ek_dai,
+ .num_links = 1,
+- .set_bias_level = at91sam9g20ek_set_bias_level,
+
+ .dapm_widgets = at91sam9g20ek_dapm_widgets,
+ .num_dapm_widgets = ARRAY_SIZE(at91sam9g20ek_dapm_widgets),
+@@ -159,7 +129,6 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev)
+ {
+ struct device_node *np = pdev->dev.of_node;
+ struct device_node *codec_np, *cpu_np;
+- struct clk *pllb;
+ struct snd_soc_card *card = &snd_soc_at91sam9g20ek;
+ int ret;
+
+@@ -173,31 +142,6 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
+- /*
+- * Codec MCLK is supplied by PCK0 - set it up.
+- */
+- mclk = clk_get(NULL, "pck0");
+- if (IS_ERR(mclk)) {
+- dev_err(&pdev->dev, "Failed to get MCLK\n");
+- ret = PTR_ERR(mclk);
+- goto err;
+- }
+-
+- pllb = clk_get(NULL, "pllb");
+- if (IS_ERR(pllb)) {
+- dev_err(&pdev->dev, "Failed to get PLLB\n");
+- ret = PTR_ERR(pllb);
+- goto err_mclk;
+- }
+- ret = clk_set_parent(mclk, pllb);
+- clk_put(pllb);
+- if (ret != 0) {
+- dev_err(&pdev->dev, "Failed to set MCLK parent\n");
+- goto err_mclk;
+- }
+-
+- clk_set_rate(mclk, MCLK_RATE);
+-
+ card->dev = &pdev->dev;
+
+ /* Parse device node info */
+@@ -241,9 +185,6 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev)
+
+ return ret;
+
+-err_mclk:
+- clk_put(mclk);
+- mclk = NULL;
+ err:
+ atmel_ssc_put_audio(0);
+ return ret;
+@@ -253,8 +194,6 @@ static int at91sam9g20ek_audio_remove(struct platform_device *pdev)
+ {
+ struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+- clk_disable(mclk);
+- mclk = NULL;
+ snd_soc_unregister_card(card);
+ atmel_ssc_put_audio(0);
+
+diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c
+index e6750bda542a9..fa813ec321196 100644
+--- a/sound/soc/codecs/msm8916-wcd-digital.c
++++ b/sound/soc/codecs/msm8916-wcd-digital.c
+@@ -923,9 +923,16 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev)
+
+ dev_set_drvdata(dev, priv);
+
+- return devm_snd_soc_register_component(dev, &msm8916_wcd_digital,
++ ret = devm_snd_soc_register_component(dev, &msm8916_wcd_digital,
+ msm8916_wcd_digital_dai,
+ ARRAY_SIZE(msm8916_wcd_digital_dai));
++ if (ret)
++ goto err_mclk;
++
++ return 0;
++
++err_mclk:
++ clk_disable_unprepare(priv->mclk);
+ err_clk:
+ clk_disable_unprepare(priv->ahbclk);
+ return ret;
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index e04c48c67458a..af9f28dd957db 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -1635,8 +1635,7 @@ static void dapm_seq_run(struct snd_soc_card *card,
+ switch (w->id) {
+ case snd_soc_dapm_pre:
+ if (!w->event)
+- list_for_each_entry_safe_continue(w, n, list,
+- power_list);
++ continue;
+
+ if (event == SND_SOC_DAPM_STREAM_START)
+ ret = w->event(w,
+@@ -1648,8 +1647,7 @@ static void dapm_seq_run(struct snd_soc_card *card,
+
+ case snd_soc_dapm_post:
+ if (!w->event)
+- list_for_each_entry_safe_continue(w, n, list,
+- power_list);
++ continue;
+
+ if (event == SND_SOC_DAPM_STREAM_START)
+ ret = w->event(w,
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 1ac8c84c3369a..c9c604f0e1ff7 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1211,6 +1211,7 @@ static void snd_usbmidi_output_drain(struct snd_rawmidi_substream *substream)
+ } while (drain_urbs && timeout);
+ finish_wait(&ep->drain_wait, &wait);
+ }
++ port->active = 0;
+ spin_unlock_irq(&ep->buffer_lock);
+ }
+
+diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
+index 0c7ea78317fca..0206fecfd3770 100644
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -22,7 +22,7 @@
+ */
+
+ /* handling of USB vendor/product ID pairs as 32-bit numbers */
+-#define USB_ID(vendor, product) (((vendor) << 16) | (product))
++#define USB_ID(vendor, product) (((unsigned int)(vendor) << 16) | (product))
+ #define USB_ID_VENDOR(id) ((id) >> 16)
+ #define USB_ID_PRODUCT(id) ((u16)(id))
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-05-01 17:04 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-05-01 17:04 UTC (permalink / raw
To: gentoo-commits
commit: 55290dfd472ad243ed25eea59e4fc6a24470ee6c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun May 1 17:04:13 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun May 1 17:04:13 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=55290dfd
Linux patch 4.19.241
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1240_linux-4.19.241.patch | 486 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 490 insertions(+)
diff --git a/0000_README b/0000_README
index 72dcbc8d..467db0c8 100644
--- a/0000_README
+++ b/0000_README
@@ -999,6 +999,10 @@ Patch: 1239_linux-4.19.240.patch
From: https://www.kernel.org
Desc: Linux 4.19.240
+Patch: 1240_linux-4.19.241.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.241
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1240_linux-4.19.241.patch b/1240_linux-4.19.241.patch
new file mode 100644
index 00000000..3d258971
--- /dev/null
+++ b/1240_linux-4.19.241.patch
@@ -0,0 +1,486 @@
+diff --git a/Makefile b/Makefile
+index 546e52f8a05fa..58fb76d1d7d38 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 240
++SUBLEVEL = 241
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c
+index 9cfd3ac027b71..7fc0806bbdc91 100644
+--- a/arch/ia64/kernel/kprobes.c
++++ b/arch/ia64/kernel/kprobes.c
+@@ -409,10 +409,83 @@ static void kretprobe_trampoline(void)
+ {
+ }
+
++/*
++ * At this point the target function has been tricked into
++ * returning into our trampoline. Lookup the associated instance
++ * and then:
++ * - call the handler function
++ * - cleanup by marking the instance as unused
++ * - long jump back to the original return address
++ */
+ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
+ {
+- regs->cr_iip = __kretprobe_trampoline_handler(regs,
+- dereference_function_descriptor(kretprobe_trampoline), NULL);
++ struct kretprobe_instance *ri = NULL;
++ struct hlist_head *head, empty_rp;
++ struct hlist_node *tmp;
++ unsigned long flags, orig_ret_address = 0;
++ unsigned long trampoline_address =
++ (unsigned long)dereference_function_descriptor(kretprobe_trampoline);
++
++ INIT_HLIST_HEAD(&empty_rp);
++ kretprobe_hash_lock(current, &head, &flags);
++
++ /*
++ * It is possible to have multiple instances associated with a given
++ * task either because an multiple functions in the call path
++ * have a return probe installed on them, and/or more than one return
++ * return probe was registered for a target function.
++ *
++ * We can handle this because:
++ * - instances are always inserted at the head of the list
++ * - when multiple return probes are registered for the same
++ * function, the first instance's ret_addr will point to the
++ * real return address, and all the rest will point to
++ * kretprobe_trampoline
++ */
++ hlist_for_each_entry_safe(ri, tmp, head, hlist) {
++ if (ri->task != current)
++ /* another task is sharing our hash bucket */
++ continue;
++
++ orig_ret_address = (unsigned long)ri->ret_addr;
++ if (orig_ret_address != trampoline_address)
++ /*
++ * This is the real return address. Any other
++ * instances associated with this task are for
++ * other calls deeper on the call stack
++ */
++ break;
++ }
++
++ regs->cr_iip = orig_ret_address;
++
++ hlist_for_each_entry_safe(ri, tmp, head, hlist) {
++ if (ri->task != current)
++ /* another task is sharing our hash bucket */
++ continue;
++
++ if (ri->rp && ri->rp->handler)
++ ri->rp->handler(ri, regs);
++
++ orig_ret_address = (unsigned long)ri->ret_addr;
++ recycle_rp_inst(ri, &empty_rp);
++
++ if (orig_ret_address != trampoline_address)
++ /*
++ * This is the real return address. Any other
++ * instances associated with this task are for
++ * other calls deeper on the call stack
++ */
++ break;
++ }
++ kretprobe_assert(ri, orig_ret_address, trampoline_address);
++
++ kretprobe_hash_unlock(current, &flags);
++
++ hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
++ hlist_del(&ri->hlist);
++ kfree(ri);
++ }
+ /*
+ * By returning a non-zero value, we are telling
+ * kprobe_handler() that we don't want the post_handler
+@@ -425,7 +498,6 @@ void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
+ struct pt_regs *regs)
+ {
+ ri->ret_addr = (kprobe_opcode_t *)regs->b0;
+- ri->fp = NULL;
+
+ /* Replace the return addr with trampoline addr */
+ regs->b0 = (unsigned long)dereference_function_descriptor(kretprobe_trampoline);
+diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
+index 35fb5b11955a0..4fdae1c182df8 100644
+--- a/arch/powerpc/include/asm/exception-64s.h
++++ b/arch/powerpc/include/asm/exception-64s.h
+@@ -48,11 +48,12 @@
+ #define EX_CCR 52
+ #define EX_CFAR 56
+ #define EX_PPR 64
++#define EX_LR 72
+ #if defined(CONFIG_RELOCATABLE)
+-#define EX_CTR 72
+-#define EX_SIZE 10 /* size in u64 units */
++#define EX_CTR 80
++#define EX_SIZE 11 /* size in u64 units */
+ #else
+-#define EX_SIZE 9 /* size in u64 units */
++#define EX_SIZE 10 /* size in u64 units */
+ #endif
+
+ /*
+@@ -60,14 +61,6 @@
+ */
+ #define MAX_MCE_DEPTH 4
+
+-/*
+- * EX_LR is only used in EXSLB and where it does not overlap with EX_DAR
+- * EX_CCR similarly with DSISR, but being 4 byte registers there is a hole
+- * in the save area so it's not necessary to overlap them. Could be used
+- * for future savings though if another 4 byte register was to be saved.
+- */
+-#define EX_LR EX_DAR
+-
+ /*
+ * EX_R3 is only used by the bad_stack handler. bad_stack reloads and
+ * saves DAR from SPRN_DAR, and EX_DAR is not used. So EX_R3 can overlap
+@@ -243,10 +236,22 @@
+ * PPR save/restore macros used in exceptions_64s.S
+ * Used for P7 or later processors
+ */
+-#define SAVE_PPR(area, ra, rb) \
++#define SAVE_PPR(area, ra) \
++BEGIN_FTR_SECTION_NESTED(940) \
++ ld ra,area+EX_PPR(r13); /* Read PPR from paca */ \
++ std ra,RESULT(r1); /* Store PPR in RESULT for now */ \
++END_FTR_SECTION_NESTED(CPU_FTR_HAS_PPR,CPU_FTR_HAS_PPR,940)
++
++/*
++ * This is called after we are finished accessing 'area', so we can now take
++ * SLB faults accessing the thread struct, which will use PACA_EXSLB area.
++ * This is required because the large_addr_slb handler uses EXSLB and it also
++ * uses the common exception macros including this PPR saving.
++ */
++#define MOVE_PPR_TO_THREAD(ra, rb) \
+ BEGIN_FTR_SECTION_NESTED(940) \
+ ld ra,PACACURRENT(r13); \
+- ld rb,area+EX_PPR(r13); /* Read PPR from paca */ \
++ ld rb,RESULT(r1); /* Read PPR from stack */ \
+ std rb,TASKTHREADPPR(ra); \
+ END_FTR_SECTION_NESTED(CPU_FTR_HAS_PPR,CPU_FTR_HAS_PPR,940)
+
+@@ -515,9 +520,11 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
+ 3: EXCEPTION_PROLOG_COMMON_1(); \
+ beq 4f; /* if from kernel mode */ \
+ ACCOUNT_CPU_USER_ENTRY(r13, r9, r10); \
+- SAVE_PPR(area, r9, r10); \
++ SAVE_PPR(area, r9); \
+ 4: EXCEPTION_PROLOG_COMMON_2(area) \
+- EXCEPTION_PROLOG_COMMON_3(n) \
++ beq 5f; /* if from kernel mode */ \
++ MOVE_PPR_TO_THREAD(r9, r10); \
++5: EXCEPTION_PROLOG_COMMON_3(n) \
+ ACCOUNT_STOLEN_TIME
+
+ /* Save original regs values from save area to stack frame. */
+diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
+index 60662771bd465..940132e705c15 100644
+--- a/drivers/block/Kconfig
++++ b/drivers/block/Kconfig
+@@ -39,6 +39,22 @@ config BLK_DEV_FD
+ To compile this driver as a module, choose M here: the
+ module will be called floppy.
+
++config BLK_DEV_FD_RAWCMD
++ bool "Support for raw floppy disk commands (DEPRECATED)"
++ depends on BLK_DEV_FD
++ help
++ If you want to use actual physical floppies and expect to do
++ special low-level hardware accesses to them (access and use
++ non-standard formats, for example), then enable this.
++
++ Note that the code enabled by this option is rarely used and
++ might be unstable or insecure, and distros should not enable it.
++
++ Note: FDRAWCMD is deprecated and will be removed from the kernel
++ in the near future.
++
++ If unsure, say N.
++
+ config AMIGA_FLOPPY
+ tristate "Amiga floppy support"
+ depends on AMIGA
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index e6e95e67c40ee..97c8fc4d6e7bd 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -3023,6 +3023,8 @@ static const char *drive_name(int type, int drive)
+ return "(null)";
+ }
+
++#ifdef CONFIG_BLK_DEV_FD_RAWCMD
++
+ /* raw commands */
+ static void raw_cmd_done(int flag)
+ {
+@@ -3234,6 +3236,35 @@ static int raw_cmd_ioctl(int cmd, void __user *param)
+ return ret;
+ }
+
++static int floppy_raw_cmd_ioctl(int type, int drive, int cmd,
++ void __user *param)
++{
++ int ret;
++
++ pr_warn_once("Note: FDRAWCMD is deprecated and will be removed from the kernel in the near future.\n");
++
++ if (type)
++ return -EINVAL;
++ if (lock_fdc(drive))
++ return -EINTR;
++ set_floppy(drive);
++ ret = raw_cmd_ioctl(cmd, param);
++ if (ret == -EINTR)
++ return -EINTR;
++ process_fd_request();
++ return ret;
++}
++
++#else /* CONFIG_BLK_DEV_FD_RAWCMD */
++
++static int floppy_raw_cmd_ioctl(int type, int drive, int cmd,
++ void __user *param)
++{
++ return -EOPNOTSUPP;
++}
++
++#endif
++
+ static int invalidate_drive(struct block_device *bdev)
+ {
+ /* invalidate the buffer track to force a reread */
+@@ -3421,7 +3452,6 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
+ {
+ int drive = (long)bdev->bd_disk->private_data;
+ int type = ITYPE(UDRS->fd_device);
+- int i;
+ int ret;
+ int size;
+ union inparam {
+@@ -3572,16 +3602,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
+ outparam = UDRWE;
+ break;
+ case FDRAWCMD:
+- if (type)
+- return -EINVAL;
+- if (lock_fdc(drive))
+- return -EINTR;
+- set_floppy(drive);
+- i = raw_cmd_ioctl(cmd, (void __user *)param);
+- if (i == -EINTR)
+- return -EINTR;
+- process_fd_request();
+- return i;
++ return floppy_raw_cmd_ioctl(type, drive, cmd, (void __user *)param);
+ case FDTWADDLE:
+ if (lock_fdc(drive))
+ return -EINTR;
+diff --git a/drivers/lightnvm/Kconfig b/drivers/lightnvm/Kconfig
+index 20706da7aa1cf..38cd49a3aeed1 100644
+--- a/drivers/lightnvm/Kconfig
++++ b/drivers/lightnvm/Kconfig
+@@ -4,7 +4,7 @@
+
+ menuconfig NVM
+ bool "Open-Channel SSD target support"
+- depends on BLOCK && PCI
++ depends on BLOCK && PCI && BROKEN
+ select BLK_DEV_NVME
+ help
+ Say Y here to get to enable Open-channel SSDs.
+diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
+index 7a33a52eaccaa..9d2e1ce536ec0 100644
+--- a/drivers/media/platform/vicodec/vicodec-core.c
++++ b/drivers/media/platform/vicodec/vicodec-core.c
+@@ -1297,12 +1297,12 @@ static int vicodec_release(struct file *file)
+ struct video_device *vfd = video_devdata(file);
+ struct vicodec_ctx *ctx = file2ctx(file);
+
+- v4l2_fh_del(&ctx->fh);
+- v4l2_fh_exit(&ctx->fh);
+- v4l2_ctrl_handler_free(&ctx->hdl);
+ mutex_lock(vfd->lock);
+ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+ mutex_unlock(vfd->lock);
++ v4l2_fh_del(&ctx->fh);
++ v4l2_fh_exit(&ctx->fh);
++ v4l2_ctrl_handler_free(&ctx->hdl);
+ kfree(ctx);
+
+ return 0;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
+index 729df169faa21..8b50afcdb52df 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
++++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
+@@ -68,6 +68,10 @@
+ #define TSE_PCS_USE_SGMII_ENA BIT(0)
+ #define TSE_PCS_IF_USE_SGMII 0x03
+
++#define SGMII_ADAPTER_CTRL_REG 0x00
++#define SGMII_ADAPTER_DISABLE 0x0001
++#define SGMII_ADAPTER_ENABLE 0x0000
++
+ #define AUTONEGO_LINK_TIMER 20
+
+ static int tse_pcs_reset(void __iomem *base, struct tse_pcs *pcs)
+@@ -209,8 +213,12 @@ void tse_pcs_fix_mac_speed(struct tse_pcs *pcs, struct phy_device *phy_dev,
+ unsigned int speed)
+ {
+ void __iomem *tse_pcs_base = pcs->tse_pcs_base;
++ void __iomem *sgmii_adapter_base = pcs->sgmii_adapter_base;
+ u32 val;
+
++ writew(SGMII_ADAPTER_ENABLE,
++ sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG);
++
+ pcs->autoneg = phy_dev->autoneg;
+
+ if (phy_dev->autoneg == AUTONEG_ENABLE) {
+diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h
+index 254199f2efdbf..2f5882450b06a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h
++++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h
+@@ -21,10 +21,6 @@
+ #include <linux/phy.h>
+ #include <linux/timer.h>
+
+-#define SGMII_ADAPTER_CTRL_REG 0x00
+-#define SGMII_ADAPTER_ENABLE 0x0000
+-#define SGMII_ADAPTER_DISABLE 0x0001
+-
+ struct tse_pcs {
+ struct device *dev;
+ void __iomem *tse_pcs_base;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+index 32ead4a4b4604..33407df6bea69 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+@@ -29,6 +29,9 @@
+
+ #include "altr_tse_pcs.h"
+
++#define SGMII_ADAPTER_CTRL_REG 0x00
++#define SGMII_ADAPTER_DISABLE 0x0001
++
+ #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII 0x0
+ #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RGMII 0x1
+ #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RMII 0x2
+@@ -62,14 +65,16 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, unsigned int speed)
+ {
+ struct socfpga_dwmac *dwmac = (struct socfpga_dwmac *)priv;
+ void __iomem *splitter_base = dwmac->splitter_base;
++ void __iomem *tse_pcs_base = dwmac->pcs.tse_pcs_base;
+ void __iomem *sgmii_adapter_base = dwmac->pcs.sgmii_adapter_base;
+ struct device *dev = dwmac->dev;
+ struct net_device *ndev = dev_get_drvdata(dev);
+ struct phy_device *phy_dev = ndev->phydev;
+ u32 val;
+
+- writew(SGMII_ADAPTER_DISABLE,
+- sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG);
++ if ((tse_pcs_base) && (sgmii_adapter_base))
++ writew(SGMII_ADAPTER_DISABLE,
++ sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG);
+
+ if (splitter_base) {
+ val = readl(splitter_base + EMAC_SPLITTER_CTRL_REG);
+@@ -91,9 +96,7 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, unsigned int speed)
+ writel(val, splitter_base + EMAC_SPLITTER_CTRL_REG);
+ }
+
+- writew(SGMII_ADAPTER_ENABLE,
+- sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG);
+- if (phy_dev)
++ if (tse_pcs_base && sgmii_adapter_base)
+ tse_pcs_fix_mac_speed(&dwmac->pcs, phy_dev, speed);
+ }
+
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 29431e3eebee3..87094189af740 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -311,7 +311,6 @@ static void sp_setup(struct net_device *dev)
+ {
+ /* Finish setting up the DEVICE info. */
+ dev->netdev_ops = &sp_netdev_ops;
+- dev->needs_free_netdev = true;
+ dev->mtu = SIXP_MTU;
+ dev->hard_header_len = AX25_MAX_HEADER_LEN;
+ dev->header_ops = &ax25_header_ops;
+@@ -679,9 +678,11 @@ static void sixpack_close(struct tty_struct *tty)
+ del_timer_sync(&sp->tx_t);
+ del_timer_sync(&sp->resync_t);
+
+- /* Free all 6pack frame buffers. */
++ /* Free all 6pack frame buffers after unreg. */
+ kfree(sp->rbuff);
+ kfree(sp->xbuff);
++
++ free_netdev(sp->dev);
+ }
+
+ /* Perform I/O control on an active 6pack channel. */
+diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
+index 5eee26cf9011f..d30256ac35372 100644
+--- a/net/sched/cls_u32.c
++++ b/net/sched/cls_u32.c
+@@ -404,15 +404,20 @@ static int u32_init(struct tcf_proto *tp)
+ return 0;
+ }
+
+-static int u32_destroy_key(struct tcf_proto *tp, struct tc_u_knode *n,
+- bool free_pf)
++static void __u32_destroy_key(struct tc_u_knode *n)
+ {
+ struct tc_u_hnode *ht = rtnl_dereference(n->ht_down);
+
+ tcf_exts_destroy(&n->exts);
+- tcf_exts_put_net(&n->exts);
+ if (ht && --ht->refcnt == 0)
+ kfree(ht);
++ kfree(n);
++}
++
++static void u32_destroy_key(struct tcf_proto *tp, struct tc_u_knode *n,
++ bool free_pf)
++{
++ tcf_exts_put_net(&n->exts);
+ #ifdef CONFIG_CLS_U32_PERF
+ if (free_pf)
+ free_percpu(n->pf);
+@@ -421,8 +426,7 @@ static int u32_destroy_key(struct tcf_proto *tp, struct tc_u_knode *n,
+ if (free_pf)
+ free_percpu(n->pcpu_success);
+ #endif
+- kfree(n);
+- return 0;
++ __u32_destroy_key(n);
+ }
+
+ /* u32_delete_key_rcu should be called when free'ing a copied
+@@ -965,13 +969,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
+ tca[TCA_RATE], ovr, extack);
+
+ if (err) {
+- u32_destroy_key(tp, new, false);
++ __u32_destroy_key(new);
+ return err;
+ }
+
+ err = u32_replace_hw_knode(tp, new, flags, extack);
+ if (err) {
+- u32_destroy_key(tp, new, false);
++ __u32_destroy_key(new);
+ return err;
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-05-12 11:30 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-05-12 11:30 UTC (permalink / raw
To: gentoo-commits
commit: 0f8e141c362918ddc0725d192fdb37178c036238
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu May 12 11:30:44 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu May 12 11:30:44 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0f8e141c
Linux patch 4.19.242
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1241_linux-4.19.242.patch | 2699 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2703 insertions(+)
diff --git a/0000_README b/0000_README
index 467db0c8..2564c5de 100644
--- a/0000_README
+++ b/0000_README
@@ -1003,6 +1003,10 @@ Patch: 1240_linux-4.19.241.patch
From: https://www.kernel.org
Desc: Linux 4.19.241
+Patch: 1241_linux-4.19.242.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.242
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1241_linux-4.19.242.patch b/1241_linux-4.19.242.patch
new file mode 100644
index 00000000..4a82ff92
--- /dev/null
+++ b/1241_linux-4.19.242.patch
@@ -0,0 +1,2699 @@
+diff --git a/Makefile b/Makefile
+index 58fb76d1d7d38..c61c1a508ec70 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 241
++SUBLEVEL = 242
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/imx6qdl-apalis.dtsi b/arch/arm/boot/dts/imx6qdl-apalis.dtsi
+index 05f07ea3e8c80..ed783c91b002a 100644
+--- a/arch/arm/boot/dts/imx6qdl-apalis.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-apalis.dtsi
+@@ -313,6 +313,8 @@
+ codec: sgtl5000@a {
+ compatible = "fsl,sgtl5000";
+ reg = <0x0a>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_sgtl5000>;
+ clocks = <&clks IMX6QDL_CLK_CKO>;
+ VDDA-supply = <®_module_3v3_audio>;
+ VDDIO-supply = <®_module_3v3>;
+@@ -540,8 +542,6 @@
+ MX6QDL_PAD_DISP0_DAT21__AUD4_TXD 0x130b0
+ MX6QDL_PAD_DISP0_DAT22__AUD4_TXFS 0x130b0
+ MX6QDL_PAD_DISP0_DAT23__AUD4_RXD 0x130b0
+- /* SGTL5000 sys_mclk */
+- MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0
+ >;
+ };
+
+@@ -807,6 +807,12 @@
+ >;
+ };
+
++ pinctrl_sgtl5000: sgtl5000grp {
++ fsl,pins = <
++ MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0
++ >;
++ };
++
+ pinctrl_spdif: spdifgrp {
+ fsl,pins = <
+ MX6QDL_PAD_GPIO_16__SPDIF_IN 0x1b0b0
+diff --git a/arch/arm/boot/dts/imx6ull-colibri.dtsi b/arch/arm/boot/dts/imx6ull-colibri.dtsi
+index 6c63a73846114..4219239f0b584 100644
+--- a/arch/arm/boot/dts/imx6ull-colibri.dtsi
++++ b/arch/arm/boot/dts/imx6ull-colibri.dtsi
+@@ -37,7 +37,7 @@
+
+ reg_sd1_vmmc: regulator-sd1-vmmc {
+ compatible = "regulator-gpio";
+- gpio = <&gpio5 9 GPIO_ACTIVE_HIGH>;
++ gpios = <&gpio5 9 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_snvs_reg_sd>;
+ regulator-always-on;
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts b/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts
+index 32d0dc371fc34..4cd72b5e612b9 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts
++++ b/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts
+@@ -15,3 +15,18 @@
+ model = "LogicPD Zoom OMAP35xx SOM-LV Development Kit";
+ compatible = "logicpd,dm3730-som-lv-devkit", "ti,omap3";
+ };
++
++&omap3_pmx_core2 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&hsusb2_2_pins>;
++ hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ pinctrl-single,pins = <
++ OMAP3430_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
++ OMAP3430_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
++ OMAP3430_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d12.hsusb2_dir */
++ OMAP3430_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d13.hsusb2_nxt */
++ OMAP3430_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d14.hsusb2_data0 */
++ OMAP3430_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_data1 */
++ >;
++ };
++};
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
+index 24283739526c4..2aca9111c6999 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
++++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
+@@ -15,3 +15,18 @@
+ model = "LogicPD Zoom DM3730 SOM-LV Development Kit";
+ compatible = "logicpd,dm3730-som-lv-devkit", "ti,omap3630", "ti,omap3";
+ };
++
++&omap3_pmx_core2 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&hsusb2_2_pins>;
++ hsusb2_2_pins: pinmux_hsusb2_2_pins {
++ pinctrl-single,pins = <
++ OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
++ OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
++ OMAP3630_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d12.hsusb2_dir */
++ OMAP3630_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d13.hsusb2_nxt */
++ OMAP3630_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d14.hsusb2_data0 */
++ OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_data1 */
++ >;
++ };
++};
+diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+index c5d54c4d37476..499eea86e1022 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+@@ -269,21 +269,6 @@
+ };
+ };
+
+-&omap3_pmx_core2 {
+- pinctrl-names = "default";
+- pinctrl-0 = <&hsusb2_2_pins>;
+- hsusb2_2_pins: pinmux_hsusb2_2_pins {
+- pinctrl-single,pins = <
+- OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */
+- OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */
+- OMAP3630_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d12.hsusb2_dir */
+- OMAP3630_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d13.hsusb2_nxt */
+- OMAP3630_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d14.hsusb2_data0 */
+- OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_data1 */
+- >;
+- };
+-};
+-
+ &uart2 {
+ interrupts-extended = <&intc 73 &omap3_pmx_core OMAP3_UART2_RX>;
+ pinctrl-names = "default";
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index a5aed92ab54b1..820bdd5326aba 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -29,6 +29,8 @@
+ aliases {
+ display0 = &lcd;
+ display1 = &tv0;
++ /delete-property/ mmc2;
++ /delete-property/ mmc3;
+ };
+
+ /* fixed 26MHz oscillator */
+diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
+index 7074cfd1ff413..79a1e4c51e3d0 100644
+--- a/arch/arm/mach-omap2/omap4-common.c
++++ b/arch/arm/mach-omap2/omap4-common.c
+@@ -318,10 +318,12 @@ void __init omap_gic_of_init(void)
+
+ np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-gic");
+ gic_dist_base_addr = of_iomap(np, 0);
++ of_node_put(np);
+ WARN_ON(!gic_dist_base_addr);
+
+ np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-twd-timer");
+ twd_base = of_iomap(np, 0);
++ of_node_put(np);
+ WARN_ON(!twd_base);
+
+ skip_errata_init:
+diff --git a/arch/mips/include/asm/timex.h b/arch/mips/include/asm/timex.h
+index b05bb70a2e46f..8026baf46e729 100644
+--- a/arch/mips/include/asm/timex.h
++++ b/arch/mips/include/asm/timex.h
+@@ -40,9 +40,9 @@
+ typedef unsigned int cycles_t;
+
+ /*
+- * On R4000/R4400 before version 5.0 an erratum exists such that if the
+- * cycle counter is read in the exact moment that it is matching the
+- * compare register, no interrupt will be generated.
++ * On R4000/R4400 an erratum exists such that if the cycle counter is
++ * read in the exact moment that it is matching the compare register,
++ * no interrupt will be generated.
+ *
+ * There is a suggested workaround and also the erratum can't strike if
+ * the compare interrupt isn't being used as the clock source device.
+@@ -63,7 +63,7 @@ static inline int can_use_mips_counter(unsigned int prid)
+ if (!__builtin_constant_p(cpu_has_counter))
+ asm volatile("" : "=m" (cpu_data[0].options));
+ if (likely(cpu_has_counter &&
+- prid >= (PRID_IMP_R4000 | PRID_REV_ENCODE_44(5, 0))))
++ prid > (PRID_IMP_R4000 | PRID_REV_ENCODE_44(15, 15))))
+ return 1;
+ else
+ return 0;
+diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
+index a0d994a4aaa95..ef79b3fc7588d 100644
+--- a/arch/mips/kernel/time.c
++++ b/arch/mips/kernel/time.c
+@@ -140,15 +140,10 @@ static __init int cpu_has_mfc0_count_bug(void)
+ case CPU_R4400MC:
+ /*
+ * The published errata for the R4400 up to 3.0 say the CPU
+- * has the mfc0 from count bug.
++ * has the mfc0 from count bug. This seems the last version
++ * produced.
+ */
+- if ((current_cpu_data.processor_id & 0xff) <= 0x30)
+- return 1;
+-
+- /*
+- * we assume newer revisions are ok
+- */
+- return 0;
++ return 1;
+ }
+
+ return 0;
+diff --git a/arch/parisc/kernel/processor.c b/arch/parisc/kernel/processor.c
+index 82bd0d0927ce3..0b0194150b682 100644
+--- a/arch/parisc/kernel/processor.c
++++ b/arch/parisc/kernel/processor.c
+@@ -423,8 +423,7 @@ show_cpuinfo (struct seq_file *m, void *v)
+ }
+ seq_printf(m, " (0x%02lx)\n", boot_cpu_data.pdc.capabilities);
+
+- seq_printf(m, "model\t\t: %s\n"
+- "model name\t: %s\n",
++ seq_printf(m, "model\t\t: %s - %s\n",
+ boot_cpu_data.pdc.sys_model_name,
+ cpuinfo->dev ?
+ cpuinfo->dev->name : "Unknown");
+diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
+index 2b7cc5397f80d..91a06cef50c1b 100644
+--- a/arch/x86/include/asm/microcode.h
++++ b/arch/x86/include/asm/microcode.h
+@@ -133,11 +133,13 @@ extern void load_ucode_ap(void);
+ void reload_early_microcode(void);
+ extern bool get_builtin_firmware(struct cpio_data *cd, const char *name);
+ extern bool initrd_gone;
++void microcode_bsp_resume(void);
+ #else
+ static inline int __init microcode_init(void) { return 0; };
+ static inline void __init load_ucode_bsp(void) { }
+ static inline void load_ucode_ap(void) { }
+ static inline void reload_early_microcode(void) { }
++static inline void microcode_bsp_resume(void) { }
+ static inline bool
+ get_builtin_firmware(struct cpio_data *cd, const char *name) { return false; }
+ #endif
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index eab4de387ce64..985ef98c8ba23 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -773,9 +773,9 @@ static struct subsys_interface mc_cpu_interface = {
+ };
+
+ /**
+- * mc_bp_resume - Update boot CPU microcode during resume.
++ * microcode_bsp_resume - Update boot CPU microcode during resume.
+ */
+-static void mc_bp_resume(void)
++void microcode_bsp_resume(void)
+ {
+ int cpu = smp_processor_id();
+ struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
+@@ -787,7 +787,7 @@ static void mc_bp_resume(void)
+ }
+
+ static struct syscore_ops mc_syscore_ops = {
+- .resume = mc_bp_resume,
++ .resume = microcode_bsp_resume,
+ };
+
+ static int mc_cpu_starting(unsigned int cpu)
+diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
+index 097eef712cdc0..0489ffc3dfe5f 100644
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -532,6 +532,11 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ union cpuid10_eax eax;
+ union cpuid10_edx edx;
+
++ if (!static_cpu_has(X86_FEATURE_ARCH_PERFMON)) {
++ entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
++ break;
++ }
++
+ perf_get_x86_pmu_capability(&cap);
+
+ /*
+diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
+index 40dbbd8f1fe41..8c6d0fb72b3a1 100644
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -161,7 +161,7 @@ void memcpy_flushcache(void *_dst, const void *_src, size_t size)
+
+ /* cache copy and flush to align dest */
+ if (!IS_ALIGNED(dest, 8)) {
+- unsigned len = min_t(unsigned, size, ALIGN(dest, 8) - dest);
++ size_t len = min_t(size_t, size, ALIGN(dest, 8) - dest);
+
+ memcpy((void *) dest, (void *) source, len);
+ clean_cache_range((void *) dest, len);
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index e00b8c36ab721..7948249482637 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -26,6 +26,7 @@
+ #include <asm/cpu.h>
+ #include <asm/mmu_context.h>
+ #include <asm/cpu_device_id.h>
++#include <asm/microcode.h>
+
+ #ifdef CONFIG_X86_32
+ __visible unsigned long saved_context_ebx;
+@@ -268,6 +269,13 @@ static void notrace __restore_processor_state(struct saved_context *ctxt)
+ x86_platform.restore_sched_clock_state();
+ mtrr_bp_restore();
+ perf_restore_debug_store();
++
++ microcode_bsp_resume();
++
++ /*
++ * This needs to happen after the microcode has been updated upon resume
++ * because some of the MSRs are "emulated" in microcode.
++ */
+ msr_restore_context(ctxt);
+ }
+
+diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
+index 2ca2cc56bcef6..b85d013a9185f 100644
+--- a/drivers/bus/sunxi-rsb.c
++++ b/drivers/bus/sunxi-rsb.c
+@@ -224,6 +224,8 @@ static struct sunxi_rsb_device *sunxi_rsb_device_create(struct sunxi_rsb *rsb,
+
+ dev_dbg(&rdev->dev, "device %s registered\n", dev_name(&rdev->dev));
+
++ return rdev;
++
+ err_device_add:
+ put_device(&rdev->dev);
+
+diff --git a/drivers/clk/sunxi/clk-sun9i-mmc.c b/drivers/clk/sunxi/clk-sun9i-mmc.c
+index f00d8758ba24f..a706ae9a010a5 100644
+--- a/drivers/clk/sunxi/clk-sun9i-mmc.c
++++ b/drivers/clk/sunxi/clk-sun9i-mmc.c
+@@ -117,6 +117,8 @@ static int sun9i_a80_mmc_config_clk_probe(struct platform_device *pdev)
+ spin_lock_init(&data->lock);
+
+ r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!r)
++ return -EINVAL;
+ /* one clock/reset pair per word */
+ count = DIV_ROUND_UP((resource_size(r)), SUN9I_MMC_WIDTH);
+ data->membase = devm_ioremap_resource(&pdev->dev, r);
+diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
+index 57ea7f4641787..11c634125c7df 100644
+--- a/drivers/firewire/core-card.c
++++ b/drivers/firewire/core-card.c
+@@ -681,6 +681,7 @@ EXPORT_SYMBOL_GPL(fw_card_release);
+ void fw_core_remove_card(struct fw_card *card)
+ {
+ struct fw_card_driver dummy_driver = dummy_driver_template;
++ unsigned long flags;
+
+ card->driver->update_phy_reg(card, 4,
+ PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
+@@ -695,7 +696,9 @@ void fw_core_remove_card(struct fw_card *card)
+ dummy_driver.stop_iso = card->driver->stop_iso;
+ card->driver = &dummy_driver;
+
++ spin_lock_irqsave(&card->lock, flags);
+ fw_destroy_nodes(card);
++ spin_unlock_irqrestore(&card->lock, flags);
+
+ /* Wait for all users, especially device workqueue jobs, to finish. */
+ fw_card_put(card);
+diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
+index d8e185582642b..bf03455b6fc20 100644
+--- a/drivers/firewire/core-cdev.c
++++ b/drivers/firewire/core-cdev.c
+@@ -1495,6 +1495,7 @@ static void outbound_phy_packet_callback(struct fw_packet *packet,
+ {
+ struct outbound_phy_packet_event *e =
+ container_of(packet, struct outbound_phy_packet_event, p);
++ struct client *e_client;
+
+ switch (status) {
+ /* expected: */
+@@ -1511,9 +1512,10 @@ static void outbound_phy_packet_callback(struct fw_packet *packet,
+ }
+ e->phy_packet.data[0] = packet->timestamp;
+
++ e_client = e->client;
+ queue_event(e->client, &e->event, &e->phy_packet,
+ sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0);
+- client_put(e->client);
++ client_put(e_client);
+ }
+
+ static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *arg)
+diff --git a/drivers/firewire/core-topology.c b/drivers/firewire/core-topology.c
+index 7db234d3fbdd1..b86d144f36137 100644
+--- a/drivers/firewire/core-topology.c
++++ b/drivers/firewire/core-topology.c
+@@ -386,16 +386,13 @@ static void report_found_node(struct fw_card *card,
+ card->bm_retries = 0;
+ }
+
++/* Must be called with card->lock held */
+ void fw_destroy_nodes(struct fw_card *card)
+ {
+- unsigned long flags;
+-
+- spin_lock_irqsave(&card->lock, flags);
+ card->color++;
+ if (card->local_node != NULL)
+ for_each_fw_node(card, card->local_node, report_lost_node);
+ card->local_node = NULL;
+- spin_unlock_irqrestore(&card->lock, flags);
+ }
+
+ static void move_tree(struct fw_node *node0, struct fw_node *node1, int port)
+@@ -521,6 +518,8 @@ void fw_core_handle_bus_reset(struct fw_card *card, int node_id, int generation,
+ struct fw_node *local_node;
+ unsigned long flags;
+
++ spin_lock_irqsave(&card->lock, flags);
++
+ /*
+ * If the selfID buffer is not the immediate successor of the
+ * previously processed one, we cannot reliably compare the
+@@ -532,8 +531,6 @@ void fw_core_handle_bus_reset(struct fw_card *card, int node_id, int generation,
+ card->bm_retries = 0;
+ }
+
+- spin_lock_irqsave(&card->lock, flags);
+-
+ card->broadcast_channel_allocated = card->broadcast_channel_auto_allocated;
+ card->node_id = node_id;
+ /*
+diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
+index 4372f9e4b0dae..ce764bebb88c5 100644
+--- a/drivers/firewire/core-transaction.c
++++ b/drivers/firewire/core-transaction.c
+@@ -86,24 +86,25 @@ static int try_cancel_split_timeout(struct fw_transaction *t)
+ static int close_transaction(struct fw_transaction *transaction,
+ struct fw_card *card, int rcode)
+ {
+- struct fw_transaction *t;
++ struct fw_transaction *t = NULL, *iter;
+ unsigned long flags;
+
+ spin_lock_irqsave(&card->lock, flags);
+- list_for_each_entry(t, &card->transaction_list, link) {
+- if (t == transaction) {
+- if (!try_cancel_split_timeout(t)) {
++ list_for_each_entry(iter, &card->transaction_list, link) {
++ if (iter == transaction) {
++ if (!try_cancel_split_timeout(iter)) {
+ spin_unlock_irqrestore(&card->lock, flags);
+ goto timed_out;
+ }
+- list_del_init(&t->link);
+- card->tlabel_mask &= ~(1ULL << t->tlabel);
++ list_del_init(&iter->link);
++ card->tlabel_mask &= ~(1ULL << iter->tlabel);
++ t = iter;
+ break;
+ }
+ }
+ spin_unlock_irqrestore(&card->lock, flags);
+
+- if (&t->link != &card->transaction_list) {
++ if (t) {
+ t->callback(card, rcode, NULL, 0, t->callback_data);
+ return 0;
+ }
+@@ -938,7 +939,7 @@ EXPORT_SYMBOL(fw_core_handle_request);
+
+ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
+ {
+- struct fw_transaction *t;
++ struct fw_transaction *t = NULL, *iter;
+ unsigned long flags;
+ u32 *data;
+ size_t data_length;
+@@ -950,20 +951,21 @@ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
+ rcode = HEADER_GET_RCODE(p->header[1]);
+
+ spin_lock_irqsave(&card->lock, flags);
+- list_for_each_entry(t, &card->transaction_list, link) {
+- if (t->node_id == source && t->tlabel == tlabel) {
+- if (!try_cancel_split_timeout(t)) {
++ list_for_each_entry(iter, &card->transaction_list, link) {
++ if (iter->node_id == source && iter->tlabel == tlabel) {
++ if (!try_cancel_split_timeout(iter)) {
+ spin_unlock_irqrestore(&card->lock, flags);
+ goto timed_out;
+ }
+- list_del_init(&t->link);
+- card->tlabel_mask &= ~(1ULL << t->tlabel);
++ list_del_init(&iter->link);
++ card->tlabel_mask &= ~(1ULL << iter->tlabel);
++ t = iter;
+ break;
+ }
+ }
+ spin_unlock_irqrestore(&card->lock, flags);
+
+- if (&t->link == &card->transaction_list) {
++ if (!t) {
+ timed_out:
+ fw_notice(card, "unsolicited response (source %x, tlabel %x)\n",
+ source, tlabel);
+diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
+index 6bac03999fd49..d418a71faf0b1 100644
+--- a/drivers/firewire/sbp2.c
++++ b/drivers/firewire/sbp2.c
+@@ -421,7 +421,7 @@ static void sbp2_status_write(struct fw_card *card, struct fw_request *request,
+ void *payload, size_t length, void *callback_data)
+ {
+ struct sbp2_logical_unit *lu = callback_data;
+- struct sbp2_orb *orb;
++ struct sbp2_orb *orb = NULL, *iter;
+ struct sbp2_status status;
+ unsigned long flags;
+
+@@ -446,17 +446,18 @@ static void sbp2_status_write(struct fw_card *card, struct fw_request *request,
+
+ /* Lookup the orb corresponding to this status write. */
+ spin_lock_irqsave(&lu->tgt->lock, flags);
+- list_for_each_entry(orb, &lu->orb_list, link) {
++ list_for_each_entry(iter, &lu->orb_list, link) {
+ if (STATUS_GET_ORB_HIGH(status) == 0 &&
+- STATUS_GET_ORB_LOW(status) == orb->request_bus) {
+- orb->rcode = RCODE_COMPLETE;
+- list_del(&orb->link);
++ STATUS_GET_ORB_LOW(status) == iter->request_bus) {
++ iter->rcode = RCODE_COMPLETE;
++ list_del(&iter->link);
++ orb = iter;
+ break;
+ }
+ }
+ spin_unlock_irqrestore(&lu->tgt->lock, flags);
+
+- if (&orb->link != &lu->orb_list) {
++ if (orb) {
+ orb->callback(orb, &status);
+ kref_put(&orb->kref, free_orb); /* orb callback reference */
+ } else {
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index e0f149bdf98ff..09999e3e3109e 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -525,7 +525,7 @@ static void of_gpiochip_init_valid_mask(struct gpio_chip *chip)
+ i, &start);
+ of_property_read_u32_index(np, "gpio-reserved-ranges",
+ i + 1, &count);
+- if (start >= chip->ngpio || start + count >= chip->ngpio)
++ if (start >= chip->ngpio || start + count > chip->ngpio)
+ continue;
+
+ bitmap_clear(chip->valid_mask, start, count);
+diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
+index 1c1a435d354bc..56ed771032c2f 100644
+--- a/drivers/gpu/drm/vgem/vgem_drv.c
++++ b/drivers/gpu/drm/vgem/vgem_drv.c
+@@ -189,9 +189,10 @@ static struct drm_gem_object *vgem_gem_create(struct drm_device *dev,
+ return ERR_CAST(obj);
+
+ ret = drm_gem_handle_create(file, &obj->base, handle);
+- drm_gem_object_put_unlocked(&obj->base);
+- if (ret)
++ if (ret) {
++ drm_gem_object_put_unlocked(&obj->base);
+ return ERR_PTR(ret);
++ }
+
+ return &obj->base;
+ }
+@@ -214,7 +215,9 @@ static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
+ args->size = gem_object->size;
+ args->pitch = pitch;
+
+- DRM_DEBUG_DRIVER("Created object of size %lld\n", size);
++ drm_gem_object_put_unlocked(gem_object);
++
++ DRM_DEBUG_DRIVER("Created object of size %llu\n", args->size);
+
+ return 0;
+ }
+diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
+index 2cd920751441d..6876e3817850d 100644
+--- a/drivers/hwmon/adt7470.c
++++ b/drivers/hwmon/adt7470.c
+@@ -33,6 +33,7 @@
+ #include <linux/kthread.h>
+ #include <linux/slab.h>
+ #include <linux/util_macros.h>
++#include <linux/sched.h>
+
+ /* Addresses to scan */
+ static const unsigned short normal_i2c[] = { 0x2C, 0x2E, 0x2F, I2C_CLIENT_END };
+@@ -273,11 +274,10 @@ static int adt7470_update_thread(void *p)
+ adt7470_read_temperatures(client, data);
+ mutex_unlock(&data->lock);
+
+- set_current_state(TASK_INTERRUPTIBLE);
+ if (kthread_should_stop())
+ break;
+
+- schedule_timeout(msecs_to_jiffies(data->auto_update_interval));
++ schedule_timeout_interruptible(msecs_to_jiffies(data->auto_update_interval));
+ }
+
+ return 0;
+diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c
+index f540c0f11c132..1ebeca7e95751 100644
+--- a/drivers/iio/dac/ad5446.c
++++ b/drivers/iio/dac/ad5446.c
+@@ -171,7 +171,7 @@ static int ad5446_read_raw(struct iio_dev *indio_dev,
+
+ switch (m) {
+ case IIO_CHAN_INFO_RAW:
+- *val = st->cached_val;
++ *val = st->cached_val >> chan->scan_type.shift;
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_SCALE:
+ *val = st->vref_mv;
+diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c
+index 7549abd544c0f..8011245a01d77 100644
+--- a/drivers/iio/dac/ad5592r-base.c
++++ b/drivers/iio/dac/ad5592r-base.c
+@@ -531,7 +531,7 @@ static int ad5592r_alloc_channels(struct ad5592r_state *st)
+ if (!ret)
+ st->channel_modes[reg] = tmp;
+
+- fwnode_property_read_u32(child, "adi,off-state", &tmp);
++ ret = fwnode_property_read_u32(child, "adi,off-state", &tmp);
+ if (!ret)
+ st->channel_offstate[reg] = tmp;
+ }
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index 379aa7f4a8041..3303feb54984a 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -404,6 +404,7 @@ static int ak8975_power_on(const struct ak8975_data *data)
+ if (ret) {
+ dev_warn(&data->client->dev,
+ "Failed to enable specified Vid supply\n");
++ regulator_disable(data->vdd);
+ return ret;
+ }
+ /*
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 01bf5bc925d0b..d2ee97cd7d14e 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -631,21 +631,20 @@ static void start_io_acct(struct dm_io *io)
+ false, 0, &io->stats_aux);
+ }
+
+-static void end_io_acct(struct dm_io *io)
++static void end_io_acct(struct mapped_device *md, struct bio *bio,
++ unsigned long start_time, struct dm_stats_aux *stats_aux)
+ {
+- struct mapped_device *md = io->md;
+- struct bio *bio = io->orig_bio;
+- unsigned long duration = jiffies - io->start_time;
++ unsigned long duration = jiffies - start_time;
+ int pending;
+ int rw = bio_data_dir(bio);
+
+ generic_end_io_acct(md->queue, bio_op(bio), &dm_disk(md)->part0,
+- io->start_time);
++ start_time);
+
+ if (unlikely(dm_stats_used(&md->stats)))
+ dm_stats_account_io(&md->stats, bio_data_dir(bio),
+ bio->bi_iter.bi_sector, bio_sectors(bio),
+- true, duration, &io->stats_aux);
++ true, duration, stats_aux);
+
+ /*
+ * After this is decremented the bio must not be touched if it is
+@@ -872,6 +871,8 @@ static void dec_pending(struct dm_io *io, blk_status_t error)
+ blk_status_t io_error;
+ struct bio *bio;
+ struct mapped_device *md = io->md;
++ unsigned long start_time = 0;
++ struct dm_stats_aux stats_aux;
+
+ /* Push-back supersedes any I/O errors */
+ if (unlikely(error)) {
+@@ -898,8 +899,10 @@ static void dec_pending(struct dm_io *io, blk_status_t error)
+
+ io_error = io->status;
+ bio = io->orig_bio;
+- end_io_acct(io);
++ start_time = io->start_time;
++ stats_aux = io->stats_aux;
+ free_io(md, io);
++ end_io_acct(md, bio, start_time, &stats_aux);
+
+ if (io_error == BLK_STS_DM_REQUEUE)
+ return;
+@@ -2472,6 +2475,8 @@ static int dm_wait_for_completion(struct mapped_device *md, long task_state)
+ }
+ finish_wait(&md->wait, &wait);
+
++ smp_rmb(); /* paired with atomic_dec_return in end_io_acct */
++
+ return r;
+ }
+
+diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
+index c1de8fa50fe8f..98b150c60b428 100644
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -49,10 +49,7 @@ struct realtek_pci_sdmmc {
+ bool double_clk;
+ bool eject;
+ bool initial_mode;
+- int power_state;
+-#define SDMMC_POWER_ON 1
+-#define SDMMC_POWER_OFF 0
+-
++ int prev_power_state;
+ int sg_count;
+ s32 cookie;
+ int cookie_sg_count;
+@@ -914,14 +911,21 @@ static int sd_set_bus_width(struct realtek_pci_sdmmc *host,
+ return err;
+ }
+
+-static int sd_power_on(struct realtek_pci_sdmmc *host)
++static int sd_power_on(struct realtek_pci_sdmmc *host, unsigned char power_mode)
+ {
+ struct rtsx_pcr *pcr = host->pcr;
+ int err;
+
+- if (host->power_state == SDMMC_POWER_ON)
++ if (host->prev_power_state == MMC_POWER_ON)
+ return 0;
+
++ if (host->prev_power_state == MMC_POWER_UP) {
++ rtsx_pci_write_register(pcr, SD_BUS_STAT, SD_CLK_TOGGLE_EN, 0);
++ goto finish;
++ }
++
++ msleep(100);
++
+ rtsx_pci_init_cmd(pcr);
+ rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, CARD_SELECT, 0x07, SD_MOD_SEL);
+ rtsx_pci_add_cmd(pcr, WRITE_REG_CMD, CARD_SHARE_MODE,
+@@ -940,11 +944,17 @@ static int sd_power_on(struct realtek_pci_sdmmc *host)
+ if (err < 0)
+ return err;
+
++ mdelay(1);
++
+ err = rtsx_pci_write_register(pcr, CARD_OE, SD_OUTPUT_EN, SD_OUTPUT_EN);
+ if (err < 0)
+ return err;
+
+- host->power_state = SDMMC_POWER_ON;
++ /* send at least 74 clocks */
++ rtsx_pci_write_register(pcr, SD_BUS_STAT, SD_CLK_TOGGLE_EN, SD_CLK_TOGGLE_EN);
++
++finish:
++ host->prev_power_state = power_mode;
+ return 0;
+ }
+
+@@ -953,7 +963,7 @@ static int sd_power_off(struct realtek_pci_sdmmc *host)
+ struct rtsx_pcr *pcr = host->pcr;
+ int err;
+
+- host->power_state = SDMMC_POWER_OFF;
++ host->prev_power_state = MMC_POWER_OFF;
+
+ rtsx_pci_init_cmd(pcr);
+
+@@ -979,7 +989,7 @@ static int sd_set_power_mode(struct realtek_pci_sdmmc *host,
+ if (power_mode == MMC_POWER_OFF)
+ err = sd_power_off(host);
+ else
+- err = sd_power_on(host);
++ err = sd_power_on(host, power_mode);
+
+ return err;
+ }
+@@ -1414,10 +1424,11 @@ static int rtsx_pci_sdmmc_drv_probe(struct platform_device *pdev)
+
+ host = mmc_priv(mmc);
+ host->pcr = pcr;
++ mmc->ios.power_delay_ms = 5;
+ host->mmc = mmc;
+ host->pdev = pdev;
+ host->cookie = -1;
+- host->power_state = SDMMC_POWER_OFF;
++ host->prev_power_state = MMC_POWER_OFF;
+ INIT_WORK(&host->work, sd_request);
+ platform_set_drvdata(pdev, host);
+ pcr->slots[RTSX_SD_CARD].p_dev = pdev;
+diff --git a/drivers/mtd/nand/raw/mtk_ecc.c b/drivers/mtd/nand/raw/mtk_ecc.c
+index 6432bd70c3b39..9e4a78a808028 100644
+--- a/drivers/mtd/nand/raw/mtk_ecc.c
++++ b/drivers/mtd/nand/raw/mtk_ecc.c
+@@ -51,6 +51,7 @@
+
+ struct mtk_ecc_caps {
+ u32 err_mask;
++ u32 err_shift;
+ const u8 *ecc_strength;
+ const u32 *ecc_regs;
+ u8 num_ecc_strength;
+@@ -84,7 +85,7 @@ static const u8 ecc_strength_mt2712[] = {
+ };
+
+ static const u8 ecc_strength_mt7622[] = {
+- 4, 6, 8, 10, 12, 14, 16
++ 4, 6, 8, 10, 12
+ };
+
+ enum mtk_ecc_regs {
+@@ -229,7 +230,7 @@ void mtk_ecc_get_stats(struct mtk_ecc *ecc, struct mtk_ecc_stats *stats,
+ for (i = 0; i < sectors; i++) {
+ offset = (i >> 2) << 2;
+ err = readl(ecc->regs + ECC_DECENUM0 + offset);
+- err = err >> ((i % 4) * 8);
++ err = err >> ((i % 4) * ecc->caps->err_shift);
+ err &= ecc->caps->err_mask;
+ if (err == ecc->caps->err_mask) {
+ /* uncorrectable errors */
+@@ -453,6 +454,7 @@ EXPORT_SYMBOL(mtk_ecc_get_parity_bits);
+
+ static const struct mtk_ecc_caps mtk_ecc_caps_mt2701 = {
+ .err_mask = 0x3f,
++ .err_shift = 8,
+ .ecc_strength = ecc_strength_mt2701,
+ .ecc_regs = mt2701_ecc_regs,
+ .num_ecc_strength = 20,
+@@ -463,6 +465,7 @@ static const struct mtk_ecc_caps mtk_ecc_caps_mt2701 = {
+
+ static const struct mtk_ecc_caps mtk_ecc_caps_mt2712 = {
+ .err_mask = 0x7f,
++ .err_shift = 8,
+ .ecc_strength = ecc_strength_mt2712,
+ .ecc_regs = mt2712_ecc_regs,
+ .num_ecc_strength = 23,
+@@ -472,10 +475,11 @@ static const struct mtk_ecc_caps mtk_ecc_caps_mt2712 = {
+ };
+
+ static const struct mtk_ecc_caps mtk_ecc_caps_mt7622 = {
+- .err_mask = 0x3f,
++ .err_mask = 0x1f,
++ .err_shift = 5,
+ .ecc_strength = ecc_strength_mt7622,
+ .ecc_regs = mt7622_ecc_regs,
+- .num_ecc_strength = 7,
++ .num_ecc_strength = 5,
+ .ecc_mode_shift = 4,
+ .parity_bits = 13,
+ .pg_irq_sel = 0,
+diff --git a/drivers/mtd/nand/raw/sh_flctl.c b/drivers/mtd/nand/raw/sh_flctl.c
+index 683df1a12989c..07ba149fa9715 100644
+--- a/drivers/mtd/nand/raw/sh_flctl.c
++++ b/drivers/mtd/nand/raw/sh_flctl.c
+@@ -399,7 +399,8 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf,
+ dma_addr_t dma_addr;
+ dma_cookie_t cookie;
+ uint32_t reg;
+- int ret;
++ int ret = 0;
++ unsigned long time_left;
+
+ if (dir == DMA_FROM_DEVICE) {
+ chan = flctl->chan_fifo0_rx;
+@@ -440,13 +441,14 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf,
+ goto out;
+ }
+
+- ret =
++ time_left =
+ wait_for_completion_timeout(&flctl->dma_complete,
+ msecs_to_jiffies(3000));
+
+- if (ret <= 0) {
++ if (time_left == 0) {
+ dmaengine_terminate_all(chan);
+ dev_err(&flctl->pdev->dev, "wait_for_completion_timeout\n");
++ ret = -ETIMEDOUT;
+ }
+
+ out:
+@@ -456,7 +458,7 @@ out:
+
+ dma_unmap_single(chan->device->dev, dma_addr, len, dir);
+
+- /* ret > 0 is success */
++ /* ret == 0 is success */
+ return ret;
+ }
+
+@@ -480,7 +482,7 @@ static void read_fiforeg(struct sh_flctl *flctl, int rlen, int offset)
+
+ /* initiate DMA transfer */
+ if (flctl->chan_fifo0_rx && rlen >= 32 &&
+- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE) > 0)
++ !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE))
+ goto convert; /* DMA success */
+
+ /* do polling transfer */
+@@ -539,7 +541,7 @@ static void write_ec_fiforeg(struct sh_flctl *flctl, int rlen,
+
+ /* initiate DMA transfer */
+ if (flctl->chan_fifo0_tx && rlen >= 32 &&
+- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE) > 0)
++ !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE))
+ return; /* DMA success */
+
+ /* do polling transfer */
+diff --git a/drivers/net/can/grcan.c b/drivers/net/can/grcan.c
+index 7eec1d9f86a05..5784c34ba46e8 100644
+--- a/drivers/net/can/grcan.c
++++ b/drivers/net/can/grcan.c
+@@ -252,6 +252,7 @@ struct grcan_device_config {
+ struct grcan_priv {
+ struct can_priv can; /* must be the first member */
+ struct net_device *dev;
++ struct device *ofdev_dev;
+ struct napi_struct napi;
+
+ struct grcan_registers __iomem *regs; /* ioremap'ed registers */
+@@ -928,7 +929,7 @@ static void grcan_free_dma_buffers(struct net_device *dev)
+ struct grcan_priv *priv = netdev_priv(dev);
+ struct grcan_dma *dma = &priv->dma;
+
+- dma_free_coherent(&dev->dev, dma->base_size, dma->base_buf,
++ dma_free_coherent(priv->ofdev_dev, dma->base_size, dma->base_buf,
+ dma->base_handle);
+ memset(dma, 0, sizeof(*dma));
+ }
+@@ -953,7 +954,7 @@ static int grcan_allocate_dma_buffers(struct net_device *dev,
+
+ /* Extra GRCAN_BUFFER_ALIGNMENT to allow for alignment */
+ dma->base_size = lsize + ssize + GRCAN_BUFFER_ALIGNMENT;
+- dma->base_buf = dma_alloc_coherent(&dev->dev,
++ dma->base_buf = dma_alloc_coherent(priv->ofdev_dev,
+ dma->base_size,
+ &dma->base_handle,
+ GFP_KERNEL);
+@@ -1117,8 +1118,10 @@ static int grcan_close(struct net_device *dev)
+
+ priv->closing = true;
+ if (priv->need_txbug_workaround) {
++ spin_unlock_irqrestore(&priv->lock, flags);
+ del_timer_sync(&priv->hang_timer);
+ del_timer_sync(&priv->rr_timer);
++ spin_lock_irqsave(&priv->lock, flags);
+ }
+ netif_stop_queue(dev);
+ grcan_stop_hardware(dev);
+@@ -1604,6 +1607,7 @@ static int grcan_setup_netdev(struct platform_device *ofdev,
+ memcpy(&priv->config, &grcan_module_config,
+ sizeof(struct grcan_device_config));
+ priv->dev = dev;
++ priv->ofdev_dev = &ofdev->dev;
+ priv->regs = base;
+ priv->can.bittiming_const = &grcan_bittiming_const;
+ priv->can.do_set_bittiming = grcan_set_bittiming;
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index df4f77ad95c4a..91ddde4d647c6 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -14297,10 +14297,6 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
+
+ /* Stop Tx */
+ bnx2x_tx_disable(bp);
+- /* Delete all NAPI objects */
+- bnx2x_del_all_napi(bp);
+- if (CNIC_LOADED(bp))
+- bnx2x_del_all_napi_cnic(bp);
+ netdev_reset_tc(bp->dev);
+
+ del_timer_sync(&bp->timer);
+@@ -14405,6 +14401,11 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct pci_dev *pdev)
+ bnx2x_drain_tx_queues(bp);
+ bnx2x_send_unload_req(bp, UNLOAD_RECOVERY);
+ bnx2x_netif_stop(bp, 1);
++ bnx2x_del_all_napi(bp);
++
++ if (CNIC_LOADED(bp))
++ bnx2x_del_all_napi_cnic(bp);
++
+ bnx2x_free_irq(bp);
+
+ /* Report UNLOAD_DONE to MCP */
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index d4be107ea4cdf..96ef2dd46c78c 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1549,6 +1549,11 @@ static struct sk_buff *bcmgenet_put_tx_csum(struct net_device *dev,
+ return skb;
+ }
+
++static void bcmgenet_hide_tsb(struct sk_buff *skb)
++{
++ __skb_pull(skb, sizeof(struct status_64));
++}
++
+ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bcmgenet_priv *priv = netdev_priv(dev);
+@@ -1657,6 +1662,8 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
+ }
+
+ GENET_CB(skb)->last_cb = tx_cb_ptr;
++
++ bcmgenet_hide_tsb(skb);
+ skb_tx_timestamp(skb);
+
+ /* Decrement total BD count and advance our write pointer */
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+index 997ca79ed892b..7e49188c3009d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+@@ -60,6 +60,13 @@ static int hclge_send_mbx_msg(struct hclge_vport *vport, u8 *msg, u16 msg_len,
+ enum hclge_cmd_status status;
+ struct hclge_desc desc;
+
++ if (msg_len > HCLGE_MBX_MAX_MSG_SIZE) {
++ dev_err(&hdev->pdev->dev,
++ "msg data length(=%u) exceeds maximum(=%u)\n",
++ msg_len, HCLGE_MBX_MAX_MSG_SIZE);
++ return -EMSGSIZE;
++ }
++
+ resp_pf_to_vf = (struct hclge_mbx_pf_to_vf_cmd *)desc.data;
+
+ hclge_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_MBX_PF_TO_VF, false);
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index ae80a223975db..f977fc59dc5ca 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -2446,7 +2446,7 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
+ if (irq == -EPROBE_DEFER) {
+ retval = -EPROBE_DEFER;
+ goto out_0;
+- } else if (irq <= 0) {
++ } else if (irq < 0) {
+ pr_warn("Could not allocate irq resource\n");
+ retval = -ENODEV;
+ goto out_0;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index 0137cba2cb54b..5e66e73998274 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -873,6 +873,7 @@ static int sun8i_dwmac_register_mdio_mux(struct stmmac_priv *priv)
+
+ ret = mdio_mux_init(priv->device, mdio_mux, mdio_mux_syscon_switch_fn,
+ &gmac->mux_handle, priv, priv->mii);
++ of_node_put(mdio_mux);
+ return ret;
+ }
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+index 23a4f9061072b..4e1504587895a 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+@@ -827,10 +827,10 @@ static int xemaclite_mdio_write(struct mii_bus *bus, int phy_id, int reg,
+ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev)
+ {
+ struct mii_bus *bus;
+- int rc;
+ struct resource res;
+ struct device_node *np = of_get_parent(lp->phy_node);
+ struct device_node *npp;
++ int rc, ret;
+
+ /* Don't register the MDIO bus if the phy_node or its parent node
+ * can't be found.
+@@ -840,8 +840,14 @@ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev)
+ return -ENODEV;
+ }
+ npp = of_get_parent(np);
+-
+- of_address_to_resource(npp, 0, &res);
++ ret = of_address_to_resource(npp, 0, &res);
++ of_node_put(npp);
++ if (ret) {
++ dev_err(dev, "%s resource error!\n",
++ dev->of_node->full_name);
++ of_node_put(np);
++ return ret;
++ }
+ if (lp->ndev->mem_start != res.start) {
+ struct phy_device *phydev;
+ phydev = of_phy_find_device(lp->phy_node);
+@@ -850,6 +856,7 @@ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev)
+ "MDIO of the phy is not registered yet\n");
+ else
+ put_device(&phydev->mdio.dev);
++ of_node_put(np);
+ return 0;
+ }
+
+@@ -862,6 +869,7 @@ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev)
+ bus = mdiobus_alloc();
+ if (!bus) {
+ dev_err(dev, "Failed to allocate mdiobus\n");
++ of_node_put(np);
+ return -ENOMEM;
+ }
+
+@@ -874,6 +882,7 @@ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev)
+ bus->parent = dev;
+
+ rc = of_mdiobus_register(bus, np);
++ of_node_put(np);
+ if (rc) {
+ dev_err(dev, "Failed to register mdio bus.\n");
+ goto err_register;
+diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
+index 2a8c33abb363a..a24c55a6c79a1 100644
+--- a/drivers/net/hippi/rrunner.c
++++ b/drivers/net/hippi/rrunner.c
+@@ -1352,7 +1352,9 @@ static int rr_close(struct net_device *dev)
+
+ rrpriv->fw_running = 0;
+
++ spin_unlock_irqrestore(&rrpriv->lock, flags);
+ del_timer_sync(&rrpriv->timer);
++ spin_lock_irqsave(&rrpriv->lock, flags);
+
+ writel(0, ®s->TxPi);
+ writel(0, ®s->IpRxPi);
+diff --git a/drivers/nfc/nfcmrvl/main.c b/drivers/nfc/nfcmrvl/main.c
+index 529be35ac1782..54d228acc0f5d 100644
+--- a/drivers/nfc/nfcmrvl/main.c
++++ b/drivers/nfc/nfcmrvl/main.c
+@@ -194,6 +194,7 @@ void nfcmrvl_nci_unregister_dev(struct nfcmrvl_private *priv)
+ {
+ struct nci_dev *ndev = priv->ndev;
+
++ nci_unregister_device(ndev);
+ if (priv->ndev->nfc_dev->fw_download_in_progress)
+ nfcmrvl_fw_dnld_abort(priv);
+
+@@ -202,7 +203,6 @@ void nfcmrvl_nci_unregister_dev(struct nfcmrvl_private *priv)
+ if (gpio_is_valid(priv->config.reset_n_io))
+ gpio_free(priv->config.reset_n_io);
+
+- nci_unregister_device(ndev);
+ nci_free_device(ndev);
+ kfree(priv);
+ }
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index db778a25bae36..a5bc529e9e826 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -103,6 +103,7 @@
+ #define PCIE_MSI_ADDR_HIGH_REG (CONTROL_BASE_ADDR + 0x54)
+ #define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58)
+ #define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C)
++#define PCIE_MSI_ALL_MASK GENMASK(31, 0)
+ #define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C)
+ #define PCIE_MSI_DATA_MASK GENMASK(15, 0)
+
+@@ -489,6 +490,7 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
+ advk_writel(pcie, reg, PCIE_CORE_CTRL2_REG);
+
+ /* Clear all interrupts */
++ advk_writel(pcie, PCIE_MSI_ALL_MASK, PCIE_MSI_STATUS_REG);
+ advk_writel(pcie, PCIE_ISR0_ALL_MASK, PCIE_ISR0_REG);
+ advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_REG);
+ advk_writel(pcie, PCIE_IRQ_ALL_MASK, HOST_CTRL_INT_STATUS_REG);
+@@ -501,7 +503,7 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
+ advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_MASK_REG);
+
+ /* Unmask all MSI's */
+- advk_writel(pcie, 0, PCIE_MSI_MASK_REG);
++ advk_writel(pcie, ~(u32)PCIE_MSI_ALL_MASK, PCIE_MSI_MASK_REG);
+
+ /* Enable summary interrupt for GIC SPI source */
+ reg = PCIE_IRQ_ALL_MASK & (~PCIE_IRQ_ENABLE_INTS_MASK);
+@@ -1033,23 +1035,19 @@ static void advk_pcie_remove_irq_domain(struct advk_pcie *pcie)
+ static void advk_pcie_handle_msi(struct advk_pcie *pcie)
+ {
+ u32 msi_val, msi_mask, msi_status, msi_idx;
+- u16 msi_data;
++ int virq;
+
+ msi_mask = advk_readl(pcie, PCIE_MSI_MASK_REG);
+ msi_val = advk_readl(pcie, PCIE_MSI_STATUS_REG);
+- msi_status = msi_val & ~msi_mask;
++ msi_status = msi_val & ((~msi_mask) & PCIE_MSI_ALL_MASK);
+
+ for (msi_idx = 0; msi_idx < MSI_IRQ_NUM; msi_idx++) {
+ if (!(BIT(msi_idx) & msi_status))
+ continue;
+
+- /*
+- * msi_idx contains bits [4:0] of the msi_data and msi_data
+- * contains 16bit MSI interrupt number
+- */
+ advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG);
+- msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK;
+- generic_handle_irq(msi_data);
++ virq = irq_find_mapping(pcie->msi_inner_domain, msi_idx);
++ generic_handle_irq(virq);
+ }
+
+ advk_writel(pcie, PCIE_ISR0_MSI_INT_PENDING,
+diff --git a/drivers/phy/samsung/phy-exynos5250-sata.c b/drivers/phy/samsung/phy-exynos5250-sata.c
+index 60e13afcd9b84..2c39d2fd3cd80 100644
+--- a/drivers/phy/samsung/phy-exynos5250-sata.c
++++ b/drivers/phy/samsung/phy-exynos5250-sata.c
+@@ -193,6 +193,7 @@ static int exynos_sata_phy_probe(struct platform_device *pdev)
+ return -EINVAL;
+
+ sata_phy->client = of_find_i2c_device_by_node(node);
++ of_node_put(node);
+ if (!sata_phy->client)
+ return -EPROBE_DEFER;
+
+@@ -201,20 +202,21 @@ static int exynos_sata_phy_probe(struct platform_device *pdev)
+ sata_phy->phyclk = devm_clk_get(dev, "sata_phyctrl");
+ if (IS_ERR(sata_phy->phyclk)) {
+ dev_err(dev, "failed to get clk for PHY\n");
+- return PTR_ERR(sata_phy->phyclk);
++ ret = PTR_ERR(sata_phy->phyclk);
++ goto put_dev;
+ }
+
+ ret = clk_prepare_enable(sata_phy->phyclk);
+ if (ret < 0) {
+ dev_err(dev, "failed to enable source clk\n");
+- return ret;
++ goto put_dev;
+ }
+
+ sata_phy->phy = devm_phy_create(dev, NULL, &exynos_sata_phy_ops);
+ if (IS_ERR(sata_phy->phy)) {
+- clk_disable_unprepare(sata_phy->phyclk);
+ dev_err(dev, "failed to create PHY\n");
+- return PTR_ERR(sata_phy->phy);
++ ret = PTR_ERR(sata_phy->phy);
++ goto clk_disable;
+ }
+
+ phy_set_drvdata(sata_phy->phy, sata_phy);
+@@ -222,11 +224,18 @@ static int exynos_sata_phy_probe(struct platform_device *pdev)
+ phy_provider = devm_of_phy_provider_register(dev,
+ of_phy_simple_xlate);
+ if (IS_ERR(phy_provider)) {
+- clk_disable_unprepare(sata_phy->phyclk);
+- return PTR_ERR(phy_provider);
++ ret = PTR_ERR(phy_provider);
++ goto clk_disable;
+ }
+
+ return 0;
++
++clk_disable:
++ clk_disable_unprepare(sata_phy->phyclk);
++put_dev:
++ put_device(&sata_phy->client->dev);
++
++ return ret;
+ }
+
+ static const struct of_device_id exynos_sata_phy_of_match[] = {
+diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
+index 0d7d379e9bb80..fb7340ad15b3b 100644
+--- a/drivers/pinctrl/pinctrl-pistachio.c
++++ b/drivers/pinctrl/pinctrl-pistachio.c
+@@ -1374,10 +1374,10 @@ static int pistachio_gpio_register(struct pistachio_pinctrl *pctl)
+ }
+
+ irq = irq_of_parse_and_map(child, 0);
+- if (irq < 0) {
+- dev_err(pctl->dev, "No IRQ for bank %u: %d\n", i, irq);
++ if (!irq) {
++ dev_err(pctl->dev, "No IRQ for bank %u\n", i);
+ of_node_put(child);
+- ret = irq;
++ ret = -EINVAL;
+ goto err;
+ }
+
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 4d581140b7a47..5d2bb4d95186f 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -72,6 +72,8 @@ module_param(debug, int, 0600);
+ */
+ #define MAX_MRU 1500
+ #define MAX_MTU 1500
++/* SOF, ADDR, CTRL, LEN1, LEN2, ..., FCS, EOF */
++#define PROT_OVERHEAD 7
+ #define GSM_NET_TX_TIMEOUT (HZ*10)
+
+ /**
+@@ -823,7 +825,7 @@ static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci)
+ break;
+ case 2: /* Unstructed with modem bits.
+ Always one byte as we never send inline break data */
+- *dp++ = gsm_encode_modem(dlci);
++ *dp++ = (gsm_encode_modem(dlci) << 1) | EA;
+ break;
+ }
+ WARN_ON(kfifo_out_locked(dlci->fifo, dp , len, &dlci->lock) != len);
+@@ -1300,11 +1302,12 @@ static void gsm_control_response(struct gsm_mux *gsm, unsigned int command,
+
+ static void gsm_control_transmit(struct gsm_mux *gsm, struct gsm_control *ctrl)
+ {
+- struct gsm_msg *msg = gsm_data_alloc(gsm, 0, ctrl->len + 1, gsm->ftype);
++ struct gsm_msg *msg = gsm_data_alloc(gsm, 0, ctrl->len + 2, gsm->ftype);
+ if (msg == NULL)
+ return;
+- msg->data[0] = (ctrl->cmd << 1) | 2 | EA; /* command */
+- memcpy(msg->data + 1, ctrl->data, ctrl->len);
++ msg->data[0] = (ctrl->cmd << 1) | CR | EA; /* command */
++ msg->data[1] = (ctrl->len << 1) | EA;
++ memcpy(msg->data + 2, ctrl->data, ctrl->len);
+ gsm_data_queue(gsm->dlci[0], msg);
+ }
+
+@@ -1327,7 +1330,6 @@ static void gsm_control_retransmit(struct timer_list *t)
+ spin_lock_irqsave(&gsm->control_lock, flags);
+ ctrl = gsm->pending_cmd;
+ if (ctrl) {
+- gsm->cretries--;
+ if (gsm->cretries == 0) {
+ gsm->pending_cmd = NULL;
+ ctrl->error = -ETIMEDOUT;
+@@ -1336,6 +1338,7 @@ static void gsm_control_retransmit(struct timer_list *t)
+ wake_up(&gsm->event);
+ return;
+ }
++ gsm->cretries--;
+ gsm_control_transmit(gsm, ctrl);
+ mod_timer(&gsm->t2_timer, jiffies + gsm->t2 * HZ / 100);
+ }
+@@ -1376,7 +1379,7 @@ retry:
+
+ /* If DLCI0 is in ADM mode skip retries, it won't respond */
+ if (gsm->dlci[0]->mode == DLCI_MODE_ADM)
+- gsm->cretries = 1;
++ gsm->cretries = 0;
+ else
+ gsm->cretries = gsm->n2;
+
+@@ -1808,7 +1811,6 @@ static void gsm_queue(struct gsm_mux *gsm)
+ gsm_response(gsm, address, UA);
+ gsm_dlci_close(dlci);
+ break;
+- case UA:
+ case UA|PF:
+ if (cr == 0 || dlci == NULL)
+ break;
+@@ -1959,7 +1961,8 @@ static void gsm1_receive(struct gsm_mux *gsm, unsigned char c)
+ }
+ /* Any partial frame was a runt so go back to start */
+ if (gsm->state != GSM_START) {
+- gsm->malformed++;
++ if (gsm->state != GSM_SEARCH)
++ gsm->malformed++;
+ gsm->state = GSM_START;
+ }
+ /* A SOF in GSM_START means we are still reading idling or
+@@ -2096,6 +2099,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm)
+ gsm_dlci_release(gsm->dlci[i]);
+ mutex_unlock(&gsm->mutex);
+ /* Now wipe the queues */
++ tty_ldisc_flush(gsm->tty);
+ list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list)
+ kfree(txq);
+ INIT_LIST_HEAD(&gsm->tx_list);
+@@ -2196,7 +2200,7 @@ static struct gsm_mux *gsm_alloc_mux(void)
+ kfree(gsm);
+ return NULL;
+ }
+- gsm->txframe = kmalloc(2 * MAX_MRU + 2, GFP_KERNEL);
++ gsm->txframe = kmalloc(2 * (MAX_MTU + PROT_OVERHEAD - 1), GFP_KERNEL);
+ if (gsm->txframe == NULL) {
+ kfree(gsm->buf);
+ kfree(gsm);
+@@ -2513,7 +2517,7 @@ static int gsmld_config(struct tty_struct *tty, struct gsm_mux *gsm,
+ /* Check the MRU/MTU range looks sane */
+ if (c->mru > MAX_MRU || c->mtu > MAX_MTU || c->mru < 8 || c->mtu < 8)
+ return -EINVAL;
+- if (c->n2 < 3)
++ if (c->n2 > 255)
+ return -EINVAL;
+ if (c->encapsulation > 1) /* Basic, advanced, no I */
+ return -EINVAL;
+@@ -2856,19 +2860,17 @@ static struct tty_ldisc_ops tty_ldisc_packet = {
+
+ static int gsmtty_modem_update(struct gsm_dlci *dlci, u8 brk)
+ {
+- u8 modembits[5];
++ u8 modembits[3];
+ struct gsm_control *ctrl;
+ int len = 2;
+
+- if (brk)
++ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */
++ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA;
++ if (brk) {
++ modembits[2] = (brk << 4) | 2 | EA; /* Length, Break, EA */
+ len++;
+-
+- modembits[0] = len << 1 | EA; /* Data bytes */
+- modembits[1] = dlci->addr << 2 | 3; /* DLCI, EA, 1 */
+- modembits[2] = gsm_encode_modem(dlci) << 1 | EA;
+- if (brk)
+- modembits[3] = brk << 4 | 2 | EA; /* Valid, EA */
+- ctrl = gsm_control_send(dlci->gsm, CMD_MSC, modembits, len + 1);
++ }
++ ctrl = gsm_control_send(dlci->gsm, CMD_MSC, modembits, len);
+ if (ctrl == NULL)
+ return -ENOMEM;
+ return gsm_control_wait(dlci->gsm, ctrl);
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 173885837e77f..fd9dd800e1a6a 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -2656,7 +2656,7 @@ enum pci_board_num_t {
+ pbn_panacom2,
+ pbn_panacom4,
+ pbn_plx_romulus,
+- pbn_endrun_2_4000000,
++ pbn_endrun_2_3906250,
+ pbn_oxsemi,
+ pbn_oxsemi_1_4000000,
+ pbn_oxsemi_2_4000000,
+@@ -3172,10 +3172,10 @@ static struct pciserial_board pci_boards[] = {
+ * signal now many ports are available
+ * 2 port 952 Uart support
+ */
+- [pbn_endrun_2_4000000] = {
++ [pbn_endrun_2_3906250] = {
+ .flags = FL_BASE0,
+ .num_ports = 2,
+- .base_baud = 4000000,
++ .base_baud = 3906250,
+ .uart_offset = 0x200,
+ .first_offset = 0x1000,
+ },
+@@ -4028,7 +4028,7 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ */
+ { PCI_VENDOR_ID_ENDRUN, PCI_DEVICE_ID_ENDRUN_1588,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_endrun_2_4000000 },
++ pbn_endrun_2_3906250 },
+ /*
+ * Quatech cards. These actually have configurable clocks but for
+ * now we just use the default.
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 5ec50ccfbec95..34687c354f5e9 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -3273,7 +3273,7 @@ static void serial8250_console_restore(struct uart_8250_port *up)
+
+ serial8250_set_divisor(port, baud, quot, frac);
+ serial_port_out(port, UART_LCR, up->lcr);
+- serial8250_out_MCR(up, UART_MCR_DTR | UART_MCR_RTS);
++ serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS);
+ }
+
+ /*
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 7a6e26b12bf64..aeda1fe71eeba 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -1369,7 +1369,7 @@ static int imx_uart_startup(struct uart_port *port)
+ imx_uart_writel(sport, ucr1, UCR1);
+
+ ucr4 = imx_uart_readl(sport, UCR4) & ~UCR4_OREN;
+- if (!sport->dma_is_enabled)
++ if (!dma_is_inited)
+ ucr4 |= UCR4_OREN;
+ imx_uart_writel(sport, ucr4, UCR4);
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index a118c44c70e1e..d5f233fa6f3b4 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -404,6 +404,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
+ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+
++ /* Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader)*/
++ { USB_DEVICE(0x0bda, 0x0151), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ /* Realtek hub in Dell WD19 (Type-C) */
+ { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM },
+ { USB_DEVICE(0x0bda, 0x5487), .driver_info = USB_QUIRK_RESET_RESUME },
+@@ -508,6 +511,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* DJI CineSSD */
+ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* VCOM device */
++ { USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ /* INTEL VALUE SSD */
+ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 87e38a7534581..984faecdd7ecb 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1213,10 +1213,10 @@ static void dwc3_get_properties(struct dwc3 *dwc)
+ u8 lpm_nyet_threshold;
+ u8 tx_de_emphasis;
+ u8 hird_threshold;
+- u8 rx_thr_num_pkt_prd;
+- u8 rx_max_burst_prd;
+- u8 tx_thr_num_pkt_prd;
+- u8 tx_max_burst_prd;
++ u8 rx_thr_num_pkt_prd = 0;
++ u8 rx_max_burst_prd = 0;
++ u8 tx_thr_num_pkt_prd = 0;
++ u8 tx_max_burst_prd = 0;
+
+ /* default to highest possible threshold */
+ lpm_nyet_threshold = 0xf;
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 8620ac8e33296..8be95ca95ef97 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2415,6 +2415,7 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+ const struct dwc3_event_depevt *event,
+ struct dwc3_request *req, int status)
+ {
++ int request_status;
+ int ret;
+
+ if (req->request.num_mapped_sgs)
+@@ -2444,7 +2445,35 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+ req->needs_extra_trb = false;
+ }
+
+- dwc3_gadget_giveback(dep, req, status);
++ /*
++ * The event status only reflects the status of the TRB with IOC set.
++ * For the requests that don't set interrupt on completion, the driver
++ * needs to check and return the status of the completed TRBs associated
++ * with the request. Use the status of the last TRB of the request.
++ */
++ if (req->request.no_interrupt) {
++ struct dwc3_trb *trb;
++
++ trb = dwc3_ep_prev_trb(dep, dep->trb_dequeue);
++ switch (DWC3_TRB_SIZE_TRBSTS(trb->size)) {
++ case DWC3_TRBSTS_MISSED_ISOC:
++ /* Isoc endpoint only */
++ request_status = -EXDEV;
++ break;
++ case DWC3_TRB_STS_XFER_IN_PROG:
++ /* Applicable when End Transfer with ForceRM=0 */
++ case DWC3_TRBSTS_SETUP_PENDING:
++ /* Control endpoint only */
++ case DWC3_TRBSTS_OK:
++ default:
++ request_status = 0;
++ break;
++ }
++ } else {
++ request_status = status;
++ }
++
++ dwc3_gadget_giveback(dep, req, request_status);
+
+ out:
+ return ret;
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 3d4710cc34bc1..2350e97a1662c 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1412,6 +1412,8 @@ static void configfs_composite_unbind(struct usb_gadget *gadget)
+ usb_ep_autoconfig_reset(cdev->gadget);
+ spin_lock_irqsave(&gi->spinlock, flags);
+ cdev->gadget = NULL;
++ cdev->deactivations = 0;
++ gadget->deactivated = false;
+ set_gadget_data(gadget, NULL);
+ spin_unlock_irqrestore(&gi->spinlock, flags);
+ }
+diff --git a/drivers/usb/gadget/function/uvc_queue.c b/drivers/usb/gadget/function/uvc_queue.c
+index 9e33d5206d54a..956341528ecaa 100644
+--- a/drivers/usb/gadget/function/uvc_queue.c
++++ b/drivers/usb/gadget/function/uvc_queue.c
+@@ -242,6 +242,8 @@ void uvcg_queue_cancel(struct uvc_video_queue *queue, int disconnect)
+ buf->state = UVC_BUF_STATE_ERROR;
+ vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR);
+ }
++ queue->buf_used = 0;
++
+ /* This must be protected by the irqlock spinlock to avoid race
+ * conditions between uvc_queue_buffer and the disconnection event that
+ * could result in an interruptible wait in uvc_dequeue_buffer. Do not
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index f5bd91752f2d2..e18b675fb7afe 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2848,6 +2848,8 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
+ if (event_loop++ < TRBS_PER_SEGMENT / 2)
+ continue;
+ xhci_update_erst_dequeue(xhci, event_ring_deq);
++ event_ring_deq = xhci->event_ring->dequeue;
++
+ event_loop = 0;
+ }
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index ab255144e5a70..a9e72fee87a77 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -778,6 +778,17 @@ void xhci_shutdown(struct usb_hcd *hcd)
+ if (xhci->quirks & XHCI_SPURIOUS_REBOOT)
+ usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev));
+
++ /* Don't poll the roothubs after shutdown. */
++ xhci_dbg(xhci, "%s: stopping usb%d port polling.\n",
++ __func__, hcd->self.busnum);
++ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
++ del_timer_sync(&hcd->rh_timer);
++
++ if (xhci->shared_hcd) {
++ clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
++ del_timer_sync(&xhci->shared_hcd->rh_timer);
++ }
++
+ spin_lock_irq(&xhci->lock);
+ xhci_halt(xhci);
+ /* Workaround for spurious wakeups at shutdown with HSW */
+diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
+index 748139d262633..0be8efcda15d5 100644
+--- a/drivers/usb/misc/uss720.c
++++ b/drivers/usb/misc/uss720.c
+@@ -71,6 +71,7 @@ static void destroy_priv(struct kref *kref)
+
+ dev_dbg(&priv->usbdev->dev, "destroying priv datastructure\n");
+ usb_put_dev(priv->usbdev);
++ priv->usbdev = NULL;
+ kfree(priv);
+ }
+
+@@ -736,7 +737,6 @@ static int uss720_probe(struct usb_interface *intf,
+ parport_announce_port(pp);
+
+ usb_set_intfdata(intf, pp);
+- usb_put_dev(usbdev);
+ return 0;
+
+ probe_abort:
+@@ -754,7 +754,6 @@ static void uss720_disconnect(struct usb_interface *intf)
+ usb_set_intfdata(intf, NULL);
+ if (pp) {
+ priv = pp->private_data;
+- priv->usbdev = NULL;
+ priv->pp = NULL;
+ dev_dbg(&intf->dev, "parport_remove_port\n");
+ parport_remove_port(pp);
+diff --git a/drivers/usb/mtu3/mtu3_dr.c b/drivers/usb/mtu3/mtu3_dr.c
+index ac60e9c8564e2..edca5d748f41a 100644
+--- a/drivers/usb/mtu3/mtu3_dr.c
++++ b/drivers/usb/mtu3/mtu3_dr.c
+@@ -30,10 +30,8 @@ enum mtu3_vbus_id_state {
+
+ static void toggle_opstate(struct ssusb_mtk *ssusb)
+ {
+- if (!ssusb->otg_switch.is_u3_drd) {
+- mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION);
+- mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN);
+- }
++ mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION);
++ mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN);
+ }
+
+ /* only port0 supports dual-role mode */
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 452c508397b7b..95a5c73f3f787 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -195,6 +195,8 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */
+ { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */
+ { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */
++ { USB_DEVICE(0x17A8, 0x0101) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Int Ant) */
++ { USB_DEVICE(0x17A8, 0x0102) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Ext Ant) */
+ { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 37d3bc24c5cff..cf77ec17ef3f4 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -432,6 +432,8 @@ static void option_instat_callback(struct urb *urb);
+ #define CINTERION_PRODUCT_CLS8 0x00b0
+ #define CINTERION_PRODUCT_MV31_MBIM 0x00b3
+ #define CINTERION_PRODUCT_MV31_RMNET 0x00b7
++#define CINTERION_PRODUCT_MV32_WA 0x00f1
++#define CINTERION_PRODUCT_MV32_WB 0x00f2
+
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID 0x0b3c
+@@ -1217,6 +1219,10 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */
+ .driver_info = NCTRL(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1057, 0xff), /* Telit FN980 */
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1058, 0xff), /* Telit FN980 (PCIe) */
++ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN920 (rmnet) */
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN920 (MBIM) */
+@@ -1233,6 +1239,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(2) | RSVD(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990 (ECM) */
+ .driver_info = NCTRL(0) | RSVD(1) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990 (PCIe) */
++ .driver_info = RSVD(0) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+@@ -1969,6 +1977,10 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(3)},
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_RMNET, 0xff),
+ .driver_info = RSVD(0)},
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff),
++ .driver_info = RSVD(3)},
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff),
++ .driver_info = RSVD(3)},
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
+ .driver_info = RSVD(4) },
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
+diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
+index 16b275123f10e..40a15c79dd341 100644
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -611,9 +611,8 @@ static int firm_send_command(struct usb_serial_port *port, __u8 command,
+ switch (command) {
+ case WHITEHEAT_GET_DTR_RTS:
+ info = usb_get_serial_port_data(port);
+- memcpy(&info->mcr, command_info->result_buffer,
+- sizeof(struct whiteheat_dr_info));
+- break;
++ info->mcr = command_info->result_buffer[0];
++ break;
+ }
+ }
+ exit:
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index dba14bd8ce799..e00c50ea2eafd 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -4906,6 +4906,18 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
+ mutex_lock(&inode->log_mutex);
+ }
+
++ /*
++ * For symlinks, we must always log their content, which is stored in an
++ * inline extent, otherwise we could end up with an empty symlink after
++ * log replay, which is invalid on linux (symlink(2) returns -ENOENT if
++ * one attempts to create an empty symlink).
++ * We don't need to worry about flushing delalloc, because when we create
++ * the inline extent when the symlink is created (we never have delalloc
++ * for symlinks).
++ */
++ if (S_ISLNK(inode->vfs_inode.i_mode))
++ inode_only = LOG_INODE_ALL;
++
+ /*
+ * a brute force approach to making sure we get the most uptodate
+ * copies of everything.
+@@ -5462,7 +5474,7 @@ process_leaf:
+ }
+
+ ctx->log_new_dentries = false;
+- if (type == BTRFS_FT_DIR || type == BTRFS_FT_SYMLINK)
++ if (type == BTRFS_FT_DIR)
+ log_mode = LOG_INODE_ALL;
+ ret = btrfs_log_inode(trans, root, BTRFS_I(di_inode),
+ log_mode, 0, LLONG_MAX, ctx);
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 61955a7c838b4..cc34a28aecbcd 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1144,9 +1144,17 @@ smb2_copychunk_range(const unsigned int xid,
+ int chunks_copied = 0;
+ bool chunk_sizes_updated = false;
+ ssize_t bytes_written, total_bytes_written = 0;
++ struct inode *inode;
+
+ pcchunk = kmalloc(sizeof(struct copychunk_ioctl), GFP_KERNEL);
+
++ /*
++ * We need to flush all unwritten data before we can send the
++ * copychunk ioctl to the server.
++ */
++ inode = d_inode(trgtfile->dentry);
++ filemap_write_and_wait(inode->i_mapping);
++
+ if (pcchunk == NULL)
+ return -ENOMEM;
+
+diff --git a/include/linux/kernel.h b/include/linux/kernel.h
+index f6f94e54ab966..50733abbe548e 100644
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -631,7 +631,7 @@ static inline char *hex_byte_pack_upper(char *buf, u8 byte)
+ return buf;
+ }
+
+-extern int hex_to_bin(char ch);
++extern int hex_to_bin(unsigned char ch);
+ extern int __must_check hex2bin(u8 *dst, const char *src, size_t count);
+ extern char *bin2hex(char *dst, const void *src, size_t count);
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 3f0d654984cf4..5c5807ed66eef 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -594,6 +594,7 @@ void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req);
+ void tcp_reset(struct sock *sk);
+ void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *skb);
+ void tcp_fin(struct sock *sk);
++void tcp_check_space(struct sock *sk);
+
+ /* tcp_timer.c */
+ void tcp_init_xmit_timers(struct sock *);
+@@ -1938,6 +1939,11 @@ struct tcp_request_sock_ops {
+ enum tcp_synack_type synack_type);
+ };
+
++extern const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops;
++#if IS_ENABLED(CONFIG_IPV6)
++extern const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops;
++#endif
++
+ #ifdef CONFIG_SYN_COOKIES
+ static inline __u32 cookie_init_sequence(const struct tcp_request_sock_ops *ops,
+ const struct sock *sk, struct sk_buff *skb,
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index 3f4618510d051..10eccbc846861 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -29,12 +29,14 @@ extern struct irqaction chained_action;
+ * IRQTF_WARNED - warning "IRQ_WAKE_THREAD w/o thread_fn" has been printed
+ * IRQTF_AFFINITY - irq thread is requested to adjust affinity
+ * IRQTF_FORCED_THREAD - irq action is force threaded
++ * IRQTF_READY - signals that irq thread is ready
+ */
+ enum {
+ IRQTF_RUNTHREAD,
+ IRQTF_WARNED,
+ IRQTF_AFFINITY,
+ IRQTF_FORCED_THREAD,
++ IRQTF_READY,
+ };
+
+ /*
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index 26814a14013cb..3633540b0f160 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -404,6 +404,7 @@ static struct irq_desc *alloc_desc(int irq, int node, unsigned int flags,
+ lockdep_set_class(&desc->lock, &irq_desc_lock_class);
+ mutex_init(&desc->request_mutex);
+ init_rcu_head(&desc->rcu);
++ init_waitqueue_head(&desc->wait_for_threads);
+
+ desc_set_defaults(irq, desc, node, affinity, owner);
+ irqd_set(&desc->irq_data, flags);
+@@ -568,6 +569,7 @@ int __init early_irq_init(void)
+ raw_spin_lock_init(&desc[i].lock);
+ lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
+ mutex_init(&desc[i].request_mutex);
++ init_waitqueue_head(&desc[i].wait_for_threads);
+ desc_set_defaults(i, &desc[i], node, NULL, NULL);
+ }
+ return arch_early_irq_init();
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index c377dbb869f80..18f3cdbf41fd5 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -1063,6 +1063,31 @@ static void irq_wake_secondary(struct irq_desc *desc, struct irqaction *action)
+ raw_spin_unlock_irq(&desc->lock);
+ }
+
++/*
++ * Internal function to notify that a interrupt thread is ready.
++ */
++static void irq_thread_set_ready(struct irq_desc *desc,
++ struct irqaction *action)
++{
++ set_bit(IRQTF_READY, &action->thread_flags);
++ wake_up(&desc->wait_for_threads);
++}
++
++/*
++ * Internal function to wake up a interrupt thread and wait until it is
++ * ready.
++ */
++static void wake_up_and_wait_for_irq_thread_ready(struct irq_desc *desc,
++ struct irqaction *action)
++{
++ if (!action || !action->thread)
++ return;
++
++ wake_up_process(action->thread);
++ wait_event(desc->wait_for_threads,
++ test_bit(IRQTF_READY, &action->thread_flags));
++}
++
+ /*
+ * Interrupt handler thread
+ */
+@@ -1074,6 +1099,8 @@ static int irq_thread(void *data)
+ irqreturn_t (*handler_fn)(struct irq_desc *desc,
+ struct irqaction *action);
+
++ irq_thread_set_ready(desc, action);
++
+ if (force_irqthreads && test_bit(IRQTF_FORCED_THREAD,
+ &action->thread_flags))
+ handler_fn = irq_forced_thread_fn;
+@@ -1462,8 +1489,6 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
+ }
+
+ if (!shared) {
+- init_waitqueue_head(&desc->wait_for_threads);
+-
+ /* Setup the type (level, edge polarity) if configured: */
+ if (new->flags & IRQF_TRIGGER_MASK) {
+ ret = __irq_set_trigger(desc,
+@@ -1553,14 +1578,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
+
+ irq_setup_timings(desc, new);
+
+- /*
+- * Strictly no need to wake it up, but hung_task complains
+- * when no hard interrupt wakes the thread up.
+- */
+- if (new->thread)
+- wake_up_process(new->thread);
+- if (new->secondary)
+- wake_up_process(new->secondary->thread);
++ wake_up_and_wait_for_irq_thread_ready(desc, new);
++ wake_up_and_wait_for_irq_thread_ready(desc, new->secondary);
+
+ register_irq_proc(irq, desc);
+ new->dir = NULL;
+diff --git a/lib/hexdump.c b/lib/hexdump.c
+index 81b70ed372096..fa2fab854f74d 100644
+--- a/lib/hexdump.c
++++ b/lib/hexdump.c
+@@ -25,15 +25,33 @@ EXPORT_SYMBOL(hex_asc_upper);
+ *
+ * hex_to_bin() converts one hex digit to its actual value or -1 in case of bad
+ * input.
++ *
++ * This function is used to load cryptographic keys, so it is coded in such a
++ * way that there are no conditions or memory accesses that depend on data.
++ *
++ * Explanation of the logic:
++ * (ch - '9' - 1) is negative if ch <= '9'
++ * ('0' - 1 - ch) is negative if ch >= '0'
++ * we "and" these two values, so the result is negative if ch is in the range
++ * '0' ... '9'
++ * we are only interested in the sign, so we do a shift ">> 8"; note that right
++ * shift of a negative value is implementation-defined, so we cast the
++ * value to (unsigned) before the shift --- we have 0xffffff if ch is in
++ * the range '0' ... '9', 0 otherwise
++ * we "and" this value with (ch - '0' + 1) --- we have a value 1 ... 10 if ch is
++ * in the range '0' ... '9', 0 otherwise
++ * we add this value to -1 --- we have a value 0 ... 9 if ch is in the range '0'
++ * ... '9', -1 otherwise
++ * the next line is similar to the previous one, but we need to decode both
++ * uppercase and lowercase letters, so we use (ch & 0xdf), which converts
++ * lowercase to uppercase
+ */
+-int hex_to_bin(char ch)
++int hex_to_bin(unsigned char ch)
+ {
+- if ((ch >= '0') && (ch <= '9'))
+- return ch - '0';
+- ch = tolower(ch);
+- if ((ch >= 'a') && (ch <= 'f'))
+- return ch - 'a' + 10;
+- return -1;
++ unsigned char cu = ch & 0xdf;
++ return -1 +
++ ((ch - '0' + 1) & (unsigned)((ch - '9' - 1) & ('0' - 1 - ch)) >> 8) +
++ ((cu - 'A' + 11) & (unsigned)((cu - 'F' - 1) & ('A' - 1 - cu)) >> 8);
+ }
+ EXPORT_SYMBOL(hex_to_bin);
+
+@@ -48,10 +66,13 @@ EXPORT_SYMBOL(hex_to_bin);
+ int hex2bin(u8 *dst, const char *src, size_t count)
+ {
+ while (count--) {
+- int hi = hex_to_bin(*src++);
+- int lo = hex_to_bin(*src++);
++ int hi, lo;
+
+- if ((hi < 0) || (lo < 0))
++ hi = hex_to_bin(*src++);
++ if (unlikely(hi < 0))
++ return -EINVAL;
++ lo = hex_to_bin(*src++);
++ if (unlikely(lo < 0))
+ return -EINVAL;
+
+ *dst++ = (hi << 4) | lo;
+diff --git a/mm/page_io.c b/mm/page_io.c
+index 9b646f07f47f1..929e7829e02d1 100644
+--- a/mm/page_io.c
++++ b/mm/page_io.c
+@@ -71,55 +71,6 @@ void end_swap_bio_write(struct bio *bio)
+ bio_put(bio);
+ }
+
+-static void swap_slot_free_notify(struct page *page)
+-{
+- struct swap_info_struct *sis;
+- struct gendisk *disk;
+- swp_entry_t entry;
+-
+- /*
+- * There is no guarantee that the page is in swap cache - the software
+- * suspend code (at least) uses end_swap_bio_read() against a non-
+- * swapcache page. So we must check PG_swapcache before proceeding with
+- * this optimization.
+- */
+- if (unlikely(!PageSwapCache(page)))
+- return;
+-
+- sis = page_swap_info(page);
+- if (!(sis->flags & SWP_BLKDEV))
+- return;
+-
+- /*
+- * The swap subsystem performs lazy swap slot freeing,
+- * expecting that the page will be swapped out again.
+- * So we can avoid an unnecessary write if the page
+- * isn't redirtied.
+- * This is good for real swap storage because we can
+- * reduce unnecessary I/O and enhance wear-leveling
+- * if an SSD is used as the as swap device.
+- * But if in-memory swap device (eg zram) is used,
+- * this causes a duplicated copy between uncompressed
+- * data in VM-owned memory and compressed data in
+- * zram-owned memory. So let's free zram-owned memory
+- * and make the VM-owned decompressed page *dirty*,
+- * so the page should be swapped out somewhere again if
+- * we again wish to reclaim it.
+- */
+- disk = sis->bdev->bd_disk;
+- entry.val = page_private(page);
+- if (disk->fops->swap_slot_free_notify &&
+- __swap_count(sis, entry) == 1) {
+- unsigned long offset;
+-
+- offset = swp_offset(entry);
+-
+- SetPageDirty(page);
+- disk->fops->swap_slot_free_notify(sis->bdev,
+- offset);
+- }
+-}
+-
+ static void end_swap_bio_read(struct bio *bio)
+ {
+ struct page *page = bio_first_page_all(bio);
+@@ -135,7 +86,6 @@ static void end_swap_bio_read(struct bio *bio)
+ }
+
+ SetPageUptodate(page);
+- swap_slot_free_notify(page);
+ out:
+ unlock_page(page);
+ WRITE_ONCE(bio->bi_private, NULL);
+@@ -373,11 +323,6 @@ int swap_readpage(struct page *page, bool synchronous)
+
+ ret = bdev_read_page(sis->bdev, map_swap_page(page, &sis->bdev), page);
+ if (!ret) {
+- if (trylock_page(page)) {
+- swap_slot_free_notify(page);
+- unlock_page(page);
+- }
+-
+ count_vm_event(PSWPIN);
+ return 0;
+ }
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index 15804cfc19a8c..ee179e08dd20c 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -2416,9 +2416,10 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
+ newpsl->sl_addr[i] = psl->sl_addr[i];
+ /* decrease mem now to avoid the memleak warning */
+ atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+- kfree_rcu(psl, rcu);
+ }
+ rcu_assign_pointer(pmc->sflist, newpsl);
++ if (psl)
++ kfree_rcu(psl, rcu);
+ psl = newpsl;
+ }
+ rv = 1; /* > 0 for insert logic below if sl_count is 0 */
+@@ -2516,11 +2517,13 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
+ psl->sl_count, psl->sl_addr, 0);
+ /* decrease mem now to avoid the memleak warning */
+ atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+- kfree_rcu(psl, rcu);
+- } else
++ } else {
+ (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
+ 0, NULL, 0);
++ }
+ rcu_assign_pointer(pmc->sflist, newpsl);
++ if (psl)
++ kfree_rcu(psl, rcu);
+ pmc->sfmode = msf->imsf_fmode;
+ err = 0;
+ done:
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 0c431fd4b1200..41d0f9bb51914 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -435,14 +435,12 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
+ __be16 proto)
+ {
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+-
+- if (tunnel->parms.o_flags & TUNNEL_SEQ)
+- tunnel->o_seqno++;
++ __be16 flags = tunnel->parms.o_flags;
+
+ /* Push GRE header. */
+ gre_build_header(skb, tunnel->tun_hlen,
+- tunnel->parms.o_flags, proto, tunnel->parms.o_key,
+- htonl(tunnel->o_seqno));
++ flags, proto, tunnel->parms.o_key,
++ (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0);
+
+ ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol);
+ }
+diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
+index 1a06850ef3cc5..929f989de1f63 100644
+--- a/net/ipv4/syncookies.c
++++ b/net/ipv4/syncookies.c
+@@ -337,6 +337,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
+
+ ireq = inet_rsk(req);
+ treq = tcp_rsk(req);
++ treq->af_specific = &tcp_request_sock_ipv4_ops;
+ treq->rcv_isn = ntohl(th->seq) - 1;
+ treq->snt_isn = cookie;
+ treq->ts_off = 0;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 757e1f60e00db..d71326f3777cb 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -5167,7 +5167,17 @@ static void tcp_new_space(struct sock *sk)
+ sk->sk_write_space(sk);
+ }
+
+-static void tcp_check_space(struct sock *sk)
++/* Caller made space either from:
++ * 1) Freeing skbs in rtx queues (after tp->snd_una has advanced)
++ * 2) Sent skbs from output queue (and thus advancing tp->snd_nxt)
++ *
++ * We might be able to generate EPOLLOUT to the application if:
++ * 1) Space consumed in output/rtx queues is below sk->sk_sndbuf/2
++ * 2) notsent amount (tp->write_seq - tp->snd_nxt) became
++ * small enough that tcp_stream_memory_free() decides it
++ * is time to generate EPOLLOUT.
++ */
++void tcp_check_space(struct sock *sk)
+ {
+ if (sock_flag(sk, SOCK_QUEUE_SHRUNK)) {
+ sock_reset_flag(sk, SOCK_QUEUE_SHRUNK);
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index c9fc6e3868be3..2719c60f285b0 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1372,7 +1372,7 @@ struct request_sock_ops tcp_request_sock_ops __read_mostly = {
+ .syn_ack_timeout = tcp_syn_ack_timeout,
+ };
+
+-static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
++const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
+ .mss_clamp = TCP_MSS_DEFAULT,
+ #ifdef CONFIG_TCP_MD5SIG
+ .req_md5_lookup = tcp_v4_md5_lookup,
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index a20b393b45016..c79cb949da66b 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -550,7 +550,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
+ newtp->tsoffset = treq->ts_off;
+ #ifdef CONFIG_TCP_MD5SIG
+ newtp->md5sig_info = NULL; /*XXX*/
+- if (newtp->af_specific->md5_lookup(sk, newsk))
++ if (treq->af_specific->req_md5_lookup(sk, req_to_sk(req)))
+ newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
+ #endif
+ if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 97c3b616d594b..8543cd724d543 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -69,6 +69,7 @@ static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
+
+ NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT,
+ tcp_skb_pcount(skb));
++ tcp_check_space(sk);
+ }
+
+ /* SND.NXT, if window was not shrunk or the amount of shrunk was less than one
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 043e57d08a3e9..4fd6c0929b144 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -750,6 +750,7 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb,
+ struct ip_tunnel_info *tun_info;
+ const struct ip_tunnel_key *key;
+ __be16 flags;
++ int tun_hlen;
+
+ tun_info = skb_tunnel_info(skb);
+ if (unlikely(!tun_info ||
+@@ -767,9 +768,9 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb,
+ dsfield = key->tos;
+ flags = key->tun_flags &
+ (TUNNEL_CSUM | TUNNEL_KEY | TUNNEL_SEQ);
+- tunnel->tun_hlen = gre_calc_hlen(flags);
++ tun_hlen = gre_calc_hlen(flags);
+
+- gre_build_header(skb, tunnel->tun_hlen,
++ gre_build_header(skb, tun_hlen,
+ flags, protocol,
+ tunnel_id_to_key32(tun_info->key.tun_id),
+ (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++)
+diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
+index ec61b67a92be0..ca291e342900c 100644
+--- a/net/ipv6/syncookies.c
++++ b/net/ipv6/syncookies.c
+@@ -181,6 +181,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
+
+ ireq = inet_rsk(req);
+ treq = tcp_rsk(req);
++ treq->af_specific = &tcp_request_sock_ipv6_ops;
+ treq->tfo_listener = false;
+
+ if (security_inet_conn_request(sk, skb, req))
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index c332f75f4e9aa..c9ba827aded26 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -789,7 +789,7 @@ struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
+ .syn_ack_timeout = tcp_syn_ack_timeout,
+ };
+
+-static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
++const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
+ .mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) -
+ sizeof(struct ipv6hdr),
+ #ifdef CONFIG_TCP_MD5SIG
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index 2780a847701e6..95c35aa639ecf 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -1426,7 +1426,7 @@ int __init ip_vs_conn_init(void)
+ pr_info("Connection hash table configured "
+ "(size=%d, memory=%ldKbytes)\n",
+ ip_vs_conn_tab_size,
+- (long)(ip_vs_conn_tab_size*sizeof(struct list_head))/1024);
++ (long)(ip_vs_conn_tab_size*sizeof(*ip_vs_conn_tab))/1024);
+ IP_VS_DBG(0, "Each connection entry needs %zd bytes at least\n",
+ sizeof(struct ip_vs_conn));
+
+diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
+index 637ce3e8c575c..4026ec38526f6 100644
+--- a/net/netfilter/nft_socket.c
++++ b/net/netfilter/nft_socket.c
+@@ -14,6 +14,32 @@ struct nft_socket {
+ };
+ };
+
++static struct sock *nft_socket_do_lookup(const struct nft_pktinfo *pkt)
++{
++ const struct net_device *indev = nft_in(pkt);
++ const struct sk_buff *skb = pkt->skb;
++ struct sock *sk = NULL;
++
++ if (!indev)
++ return NULL;
++
++ switch (nft_pf(pkt)) {
++ case NFPROTO_IPV4:
++ sk = nf_sk_lookup_slow_v4(nft_net(pkt), skb, indev);
++ break;
++#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
++ case NFPROTO_IPV6:
++ sk = nf_sk_lookup_slow_v6(nft_net(pkt), skb, indev);
++ break;
++#endif
++ default:
++ WARN_ON_ONCE(1);
++ break;
++ }
++
++ return sk;
++}
++
+ static void nft_socket_eval(const struct nft_expr *expr,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
+@@ -27,20 +53,7 @@ static void nft_socket_eval(const struct nft_expr *expr,
+ sk = NULL;
+
+ if (!sk)
+- switch(nft_pf(pkt)) {
+- case NFPROTO_IPV4:
+- sk = nf_sk_lookup_slow_v4(nft_net(pkt), skb, nft_in(pkt));
+- break;
+-#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
+- case NFPROTO_IPV6:
+- sk = nf_sk_lookup_slow_v6(nft_net(pkt), skb, nft_in(pkt));
+- break;
+-#endif
+- default:
+- WARN_ON_ONCE(1);
+- regs->verdict.code = NFT_BREAK;
+- return;
+- }
++ sk = nft_socket_do_lookup(pkt);
+
+ if (!sk) {
+ regs->verdict.code = NFT_BREAK;
+@@ -123,6 +136,16 @@ static int nft_socket_dump(struct sk_buff *skb,
+ return 0;
+ }
+
++static int nft_socket_validate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr,
++ const struct nft_data **data)
++{
++ return nft_chain_validate_hooks(ctx->chain,
++ (1 << NF_INET_PRE_ROUTING) |
++ (1 << NF_INET_LOCAL_IN) |
++ (1 << NF_INET_LOCAL_OUT));
++}
++
+ static struct nft_expr_type nft_socket_type;
+ static const struct nft_expr_ops nft_socket_ops = {
+ .type = &nft_socket_type,
+@@ -130,6 +153,7 @@ static const struct nft_expr_ops nft_socket_ops = {
+ .eval = nft_socket_eval,
+ .init = nft_socket_init,
+ .dump = nft_socket_dump,
++ .validate = nft_socket_validate,
+ };
+
+ static struct nft_expr_type nft_socket_type __read_mostly = {
+diff --git a/net/nfc/core.c b/net/nfc/core.c
+index ff646d1758d16..54168bbc07cbf 100644
+--- a/net/nfc/core.c
++++ b/net/nfc/core.c
+@@ -50,7 +50,7 @@ int nfc_fw_download(struct nfc_dev *dev, const char *firmware_name)
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ goto error;
+ }
+@@ -106,7 +106,7 @@ int nfc_dev_up(struct nfc_dev *dev)
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ goto error;
+ }
+@@ -154,7 +154,7 @@ int nfc_dev_down(struct nfc_dev *dev)
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ goto error;
+ }
+@@ -218,7 +218,7 @@ int nfc_start_poll(struct nfc_dev *dev, u32 im_protocols, u32 tm_protocols)
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ goto error;
+ }
+@@ -257,7 +257,7 @@ int nfc_stop_poll(struct nfc_dev *dev)
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ goto error;
+ }
+@@ -302,7 +302,7 @@ int nfc_dep_link_up(struct nfc_dev *dev, int target_index, u8 comm_mode)
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ goto error;
+ }
+@@ -346,7 +346,7 @@ int nfc_dep_link_down(struct nfc_dev *dev)
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ goto error;
+ }
+@@ -412,7 +412,7 @@ int nfc_activate_target(struct nfc_dev *dev, u32 target_idx, u32 protocol)
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ goto error;
+ }
+@@ -458,7 +458,7 @@ int nfc_deactivate_target(struct nfc_dev *dev, u32 target_idx, u8 mode)
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ goto error;
+ }
+@@ -505,7 +505,7 @@ int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ kfree_skb(skb);
+ goto error;
+@@ -562,7 +562,7 @@ int nfc_enable_se(struct nfc_dev *dev, u32 se_idx)
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ goto error;
+ }
+@@ -611,7 +611,7 @@ int nfc_disable_se(struct nfc_dev *dev, u32 se_idx)
+
+ device_lock(&dev->dev);
+
+- if (!device_is_registered(&dev->dev)) {
++ if (dev->shutting_down) {
+ rc = -ENODEV;
+ goto error;
+ }
+@@ -1139,6 +1139,7 @@ int nfc_register_device(struct nfc_dev *dev)
+ dev->rfkill = NULL;
+ }
+ }
++ dev->shutting_down = false;
+ device_unlock(&dev->dev);
+
+ rc = nfc_genl_device_added(dev);
+@@ -1171,12 +1172,10 @@ void nfc_unregister_device(struct nfc_dev *dev)
+ rfkill_unregister(dev->rfkill);
+ rfkill_destroy(dev->rfkill);
+ }
++ dev->shutting_down = true;
+ device_unlock(&dev->dev);
+
+ if (dev->ops->check_presence) {
+- device_lock(&dev->dev);
+- dev->shutting_down = true;
+- device_unlock(&dev->dev);
+ del_timer_sync(&dev->check_pres_timer);
+ cancel_work_sync(&dev->check_pres_work);
+ }
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index 0a3120117c13d..39fb01ee92220 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -1262,7 +1262,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
+ struct sk_buff *msg;
+ void *hdr;
+
+- msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
++ msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+ if (!msg)
+ return -ENOMEM;
+
+@@ -1278,7 +1278,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
+
+ genlmsg_end(msg, hdr);
+
+- genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
++ genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC);
+
+ return 0;
+
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 2a94240eac360..82d96441e64d6 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -473,6 +473,10 @@ void sctp_generate_reconf_event(struct timer_list *t)
+ goto out_unlock;
+ }
+
++ /* This happens when the response arrives after the timer is triggered. */
++ if (!asoc->strreset_chunk)
++ goto out_unlock;
++
+ error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
+ SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_RECONF),
+ asoc->state, asoc->ep, asoc,
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 798fbd89ed42f..a0a82d9a59008 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2974,9 +2974,6 @@ static struct rpc_xprt *xs_setup_local(struct xprt_create *args)
+ }
+ xprt_set_bound(xprt);
+ xs_format_peer_addresses(xprt, "local", RPCBIND_NETID_LOCAL);
+- ret = ERR_PTR(xs_local_setup_socket(transport));
+- if (ret)
+- goto out_err;
+ break;
+ default:
+ ret = ERR_PTR(-EAFNOSUPPORT);
+diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c
+index 5cac26ab20b71..e9209f44cb500 100644
+--- a/sound/firewire/fireworks/fireworks_hwdep.c
++++ b/sound/firewire/fireworks/fireworks_hwdep.c
+@@ -35,6 +35,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
+ type = SNDRV_FIREWIRE_EVENT_EFW_RESPONSE;
+ if (copy_to_user(buf, &type, sizeof(type)))
+ return -EFAULT;
++ count += sizeof(type);
+ remained -= sizeof(type);
+ buf += sizeof(type);
+
+diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
+index 7c8fad865d6b0..3c5c02b034a99 100644
+--- a/sound/soc/codecs/wm8731.c
++++ b/sound/soc/codecs/wm8731.c
+@@ -604,7 +604,7 @@ static int wm8731_hw_init(struct device *dev, struct wm8731_priv *wm8731)
+ ret = wm8731_reset(wm8731->regmap);
+ if (ret < 0) {
+ dev_err(dev, "Failed to issue reset: %d\n", ret);
+- goto err_regulator_enable;
++ goto err;
+ }
+
+ /* Clear POWEROFF, keep everything else disabled */
+@@ -621,10 +621,7 @@ static int wm8731_hw_init(struct device *dev, struct wm8731_priv *wm8731)
+
+ regcache_mark_dirty(wm8731->regmap);
+
+-err_regulator_enable:
+- /* Regulators will be enabled by bias management */
+- regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies);
+-
++err:
+ return ret;
+ }
+
+@@ -768,21 +765,27 @@ static int wm8731_i2c_probe(struct i2c_client *i2c,
+ ret = PTR_ERR(wm8731->regmap);
+ dev_err(&i2c->dev, "Failed to allocate register map: %d\n",
+ ret);
+- return ret;
++ goto err_regulator_enable;
+ }
+
+ ret = wm8731_hw_init(&i2c->dev, wm8731);
+ if (ret != 0)
+- return ret;
++ goto err_regulator_enable;
+
+ ret = devm_snd_soc_register_component(&i2c->dev,
+ &soc_component_dev_wm8731, &wm8731_dai, 1);
+ if (ret != 0) {
+ dev_err(&i2c->dev, "Failed to register CODEC: %d\n", ret);
+- return ret;
++ goto err_regulator_enable;
+ }
+
+ return 0;
++
++err_regulator_enable:
++ /* Regulators will be enabled by bias management */
++ regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies);
++
++ return ret;
+ }
+
+ static int wm8731_i2c_remove(struct i2c_client *client)
+diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c
+index f0a409504a13b..91de7ff3a5a8f 100644
+--- a/sound/soc/codecs/wm8958-dsp2.c
++++ b/sound/soc/codecs/wm8958-dsp2.c
+@@ -537,7 +537,7 @@ static int wm8958_mbc_put(struct snd_kcontrol *kcontrol,
+
+ wm8958_dsp_apply(component, mbc, wm8994->mbc_ena[mbc]);
+
+- return 0;
++ return 1;
+ }
+
+ #define WM8958_MBC_SWITCH(xname, xval) {\
+@@ -663,7 +663,7 @@ static int wm8958_vss_put(struct snd_kcontrol *kcontrol,
+
+ wm8958_dsp_apply(component, vss, wm8994->vss_ena[vss]);
+
+- return 0;
++ return 1;
+ }
+
+
+@@ -737,7 +737,7 @@ static int wm8958_hpf_put(struct snd_kcontrol *kcontrol,
+
+ wm8958_dsp_apply(component, hpf % 3, ucontrol->value.integer.value[0]);
+
+- return 0;
++ return 1;
+ }
+
+ #define WM8958_HPF_SWITCH(xname, xval) {\
+@@ -831,7 +831,7 @@ static int wm8958_enh_eq_put(struct snd_kcontrol *kcontrol,
+
+ wm8958_dsp_apply(component, eq, ucontrol->value.integer.value[0]);
+
+- return 0;
++ return 1;
+ }
+
+ #define WM8958_ENH_EQ_SWITCH(xname, xval) {\
+diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c
+index 45cce7376191c..232df04ca5866 100644
+--- a/sound/soc/soc-generic-dmaengine-pcm.c
++++ b/sound/soc/soc-generic-dmaengine-pcm.c
+@@ -91,10 +91,10 @@ static int dmaengine_pcm_hw_params(struct snd_pcm_substream *substream,
+
+ memset(&slave_config, 0, sizeof(slave_config));
+
+- if (pcm->config && pcm->config->prepare_slave_config)
+- prepare_slave_config = pcm->config->prepare_slave_config;
+- else
++ if (!pcm->config)
+ prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config;
++ else
++ prepare_slave_config = pcm->config->prepare_slave_config;
+
+ if (prepare_slave_config) {
+ ret = prepare_slave_config(substream, params, &slave_config);
+diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh
+index a3402cd8d5b68..9ff22f28032dd 100755
+--- a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh
+@@ -61,9 +61,12 @@ setup_prepare()
+
+ vrf_prepare
+ mirror_gre_topo_create
++ # Avoid changing br1's PVID while it is operational as a L3 interface.
++ ip link set dev br1 down
+
+ ip link set dev $swp3 master br1
+ bridge vlan add dev br1 vid 555 pvid untagged self
++ ip link set dev br1 up
+ ip address add dev br1 192.0.2.129/28
+ ip address add dev br1 2001:db8:2::1/64
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-05-15 22:12 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-05-15 22:12 UTC (permalink / raw
To: gentoo-commits
commit: 12d1221bde1c58924cd6c9a3ef6723fe88fbed80
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun May 15 22:12:04 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun May 15 22:12:04 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=12d1221b
Linux patch 4.19.243
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1242_linux-4.19.243.patch | 673 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 677 insertions(+)
diff --git a/0000_README b/0000_README
index 2564c5de..5dc0a832 100644
--- a/0000_README
+++ b/0000_README
@@ -1007,6 +1007,10 @@ Patch: 1241_linux-4.19.242.patch
From: https://www.kernel.org
Desc: Linux 4.19.242
+Patch: 1242_linux-4.19.243.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.243
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1242_linux-4.19.243.patch b/1242_linux-4.19.243.patch
new file mode 100644
index 00000000..c3a3b9dd
--- /dev/null
+++ b/1242_linux-4.19.243.patch
@@ -0,0 +1,673 @@
+diff --git a/Makefile b/Makefile
+index c61c1a508ec70..6899a8fc4c466 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 242
++SUBLEVEL = 243
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/bmips/setup.c b/arch/mips/bmips/setup.c
+index 231fc5ce375e7..9edc26e52040a 100644
+--- a/arch/mips/bmips/setup.c
++++ b/arch/mips/bmips/setup.c
+@@ -174,7 +174,7 @@ void __init plat_mem_setup(void)
+ dtb = phys_to_virt(fw_arg2);
+ else if (fw_passed_dtb) /* UHI interface */
+ dtb = (void *)fw_passed_dtb;
+- else if (__dtb_start != __dtb_end)
++ else if (&__dtb_start != &__dtb_end)
+ dtb = (void *)__dtb_start;
+ else
+ panic("no dtb found");
+diff --git a/arch/mips/lantiq/prom.c b/arch/mips/lantiq/prom.c
+index d984bd5c2ec5f..dceab67e481a8 100644
+--- a/arch/mips/lantiq/prom.c
++++ b/arch/mips/lantiq/prom.c
+@@ -81,7 +81,7 @@ void __init plat_mem_setup(void)
+
+ if (fw_passed_dtb) /* UHI interface */
+ dtb = (void *)fw_passed_dtb;
+- else if (__dtb_start != __dtb_end)
++ else if (&__dtb_start != &__dtb_end)
+ dtb = (void *)__dtb_start;
+ else
+ panic("no dtb found");
+diff --git a/arch/mips/pic32/pic32mzda/init.c b/arch/mips/pic32/pic32mzda/init.c
+index 51599710472bc..406c6c5cec29b 100644
+--- a/arch/mips/pic32/pic32mzda/init.c
++++ b/arch/mips/pic32/pic32mzda/init.c
+@@ -36,7 +36,7 @@ static ulong get_fdtaddr(void)
+ if (fw_passed_dtb && !fw_arg2 && !fw_arg3)
+ return (ulong)fw_passed_dtb;
+
+- if (__dtb_start < __dtb_end)
++ if (&__dtb_start < &__dtb_end)
+ ftaddr = (ulong)__dtb_start;
+
+ return ftaddr;
+diff --git a/arch/mips/ralink/of.c b/arch/mips/ralink/of.c
+index 92b3d48499967..1f7c686f7218a 100644
+--- a/arch/mips/ralink/of.c
++++ b/arch/mips/ralink/of.c
+@@ -79,7 +79,7 @@ void __init plat_mem_setup(void)
+ */
+ if (fw_passed_dtb)
+ dtb = (void *)fw_passed_dtb;
+- else if (__dtb_start != __dtb_end)
++ else if (&__dtb_start != &__dtb_end)
+ dtb = (void *)__dtb_start;
+
+ __dt_setup_arch(dtb);
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index 5a80453be5535..3f403aab55e1e 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -774,9 +774,11 @@ int drbd_adm_set_role(struct sk_buff *skb, struct genl_info *info)
+ mutex_lock(&adm_ctx.resource->adm_mutex);
+
+ if (info->genlhdr->cmd == DRBD_ADM_PRIMARY)
+- retcode = drbd_set_role(adm_ctx.device, R_PRIMARY, parms.assume_uptodate);
++ retcode = (enum drbd_ret_code)drbd_set_role(adm_ctx.device,
++ R_PRIMARY, parms.assume_uptodate);
+ else
+- retcode = drbd_set_role(adm_ctx.device, R_SECONDARY, 0);
++ retcode = (enum drbd_ret_code)drbd_set_role(adm_ctx.device,
++ R_SECONDARY, 0);
+
+ mutex_unlock(&adm_ctx.resource->adm_mutex);
+ genl_lock();
+@@ -1941,7 +1943,7 @@ int drbd_adm_attach(struct sk_buff *skb, struct genl_info *info)
+ drbd_flush_workqueue(&connection->sender_work);
+
+ rv = _drbd_request_state(device, NS(disk, D_ATTACHING), CS_VERBOSE);
+- retcode = rv; /* FIXME: Type mismatch. */
++ retcode = (enum drbd_ret_code)rv;
+ drbd_resume_io(device);
+ if (rv < SS_SUCCESS)
+ goto fail;
+@@ -2671,7 +2673,8 @@ int drbd_adm_connect(struct sk_buff *skb, struct genl_info *info)
+ }
+ rcu_read_unlock();
+
+- retcode = conn_request_state(connection, NS(conn, C_UNCONNECTED), CS_VERBOSE);
++ retcode = (enum drbd_ret_code)conn_request_state(connection,
++ NS(conn, C_UNCONNECTED), CS_VERBOSE);
+
+ conn_reconfig_done(connection);
+ mutex_unlock(&adm_ctx.resource->adm_mutex);
+@@ -2777,7 +2780,7 @@ int drbd_adm_disconnect(struct sk_buff *skb, struct genl_info *info)
+ mutex_lock(&adm_ctx.resource->adm_mutex);
+ rv = conn_try_disconnect(connection, parms.force_disconnect);
+ if (rv < SS_SUCCESS)
+- retcode = rv; /* FIXME: Type mismatch. */
++ retcode = (enum drbd_ret_code)rv;
+ else
+ retcode = NO_ERROR;
+ mutex_unlock(&adm_ctx.resource->adm_mutex);
+diff --git a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c
+index f20161c5706d7..b375eafad7814 100644
+--- a/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c
++++ b/drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c
+@@ -51,8 +51,8 @@
+ */
+
+ struct gpio_service *dal_gpio_service_create(
+- enum dce_version dce_version_major,
+- enum dce_version dce_version_minor,
++ enum dce_version dce_version,
++ enum dce_environment dce_environment,
+ struct dc_context *ctx)
+ {
+ struct gpio_service *service;
+@@ -66,14 +66,14 @@ struct gpio_service *dal_gpio_service_create(
+ return NULL;
+ }
+
+- if (!dal_hw_translate_init(&service->translate, dce_version_major,
+- dce_version_minor)) {
++ if (!dal_hw_translate_init(&service->translate, dce_version,
++ dce_environment)) {
+ BREAK_TO_DEBUGGER();
+ goto failure_1;
+ }
+
+- if (!dal_hw_factory_init(&service->factory, dce_version_major,
+- dce_version_minor)) {
++ if (!dal_hw_factory_init(&service->factory, dce_version,
++ dce_environment)) {
+ BREAK_TO_DEBUGGER();
+ goto failure_1;
+ }
+diff --git a/drivers/gpu/drm/amd/display/include/gpio_service_interface.h b/drivers/gpu/drm/amd/display/include/gpio_service_interface.h
+index f40259bade400..73b2ff84d50ef 100644
+--- a/drivers/gpu/drm/amd/display/include/gpio_service_interface.h
++++ b/drivers/gpu/drm/amd/display/include/gpio_service_interface.h
+@@ -42,8 +42,8 @@ void dal_gpio_destroy(
+ struct gpio **ptr);
+
+ struct gpio_service *dal_gpio_service_create(
+- enum dce_version dce_version_major,
+- enum dce_version dce_version_minor,
++ enum dce_version dce_version,
++ enum dce_environment dce_environment,
+ struct dc_context *ctx);
+
+ struct gpio *dal_gpio_service_create_irq(
+diff --git a/drivers/net/can/grcan.c b/drivers/net/can/grcan.c
+index 5784c34ba46e8..f07a6ff66d1ce 100644
+--- a/drivers/net/can/grcan.c
++++ b/drivers/net/can/grcan.c
+@@ -245,7 +245,7 @@ struct grcan_device_config {
+ .rxsize = GRCAN_DEFAULT_BUFFER_SIZE, \
+ }
+
+-#define GRCAN_TXBUG_SAFE_GRLIB_VERSION 0x4100
++#define GRCAN_TXBUG_SAFE_GRLIB_VERSION 4100
+ #define GRLIB_VERSION_MASK 0xffff
+
+ /* GRCAN private data structure */
+@@ -1141,7 +1141,7 @@ static int grcan_close(struct net_device *dev)
+ return 0;
+ }
+
+-static int grcan_transmit_catch_up(struct net_device *dev, int budget)
++static void grcan_transmit_catch_up(struct net_device *dev)
+ {
+ struct grcan_priv *priv = netdev_priv(dev);
+ unsigned long flags;
+@@ -1149,7 +1149,7 @@ static int grcan_transmit_catch_up(struct net_device *dev, int budget)
+
+ spin_lock_irqsave(&priv->lock, flags);
+
+- work_done = catch_up_echo_skb(dev, budget, true);
++ work_done = catch_up_echo_skb(dev, -1, true);
+ if (work_done) {
+ if (!priv->resetting && !priv->closing &&
+ !(priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY))
+@@ -1163,8 +1163,6 @@ static int grcan_transmit_catch_up(struct net_device *dev, int budget)
+ }
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+-
+- return work_done;
+ }
+
+ static int grcan_receive(struct net_device *dev, int budget)
+@@ -1246,19 +1244,13 @@ static int grcan_poll(struct napi_struct *napi, int budget)
+ struct net_device *dev = priv->dev;
+ struct grcan_registers __iomem *regs = priv->regs;
+ unsigned long flags;
+- int tx_work_done, rx_work_done;
+- int rx_budget = budget / 2;
+- int tx_budget = budget - rx_budget;
++ int work_done;
+
+- /* Half of the budget for receiveing messages */
+- rx_work_done = grcan_receive(dev, rx_budget);
++ work_done = grcan_receive(dev, budget);
+
+- /* Half of the budget for transmitting messages as that can trigger echo
+- * frames being received
+- */
+- tx_work_done = grcan_transmit_catch_up(dev, tx_budget);
++ grcan_transmit_catch_up(dev);
+
+- if (rx_work_done < rx_budget && tx_work_done < tx_budget) {
++ if (work_done < budget) {
+ napi_complete(napi);
+
+ /* Guarantee no interference with a running reset that otherwise
+@@ -1275,7 +1267,7 @@ static int grcan_poll(struct napi_struct *napi, int budget)
+ spin_unlock_irqrestore(&priv->lock, flags);
+ }
+
+- return rx_work_done + tx_work_done;
++ return work_done;
+ }
+
+ /* Work tx bug by waiting while for the risky situation to clear. If that fails,
+@@ -1660,6 +1652,7 @@ exit_free_candev:
+ static int grcan_probe(struct platform_device *ofdev)
+ {
+ struct device_node *np = ofdev->dev.of_node;
++ struct device_node *sysid_parent;
+ struct resource *res;
+ u32 sysid, ambafreq;
+ int irq, err;
+@@ -1669,10 +1662,15 @@ static int grcan_probe(struct platform_device *ofdev)
+ /* Compare GRLIB version number with the first that does not
+ * have the tx bug (see start_xmit)
+ */
+- err = of_property_read_u32(np, "systemid", &sysid);
+- if (!err && ((sysid & GRLIB_VERSION_MASK)
+- >= GRCAN_TXBUG_SAFE_GRLIB_VERSION))
+- txbug = false;
++ sysid_parent = of_find_node_by_path("/ambapp0");
++ if (sysid_parent) {
++ of_node_get(sysid_parent);
++ err = of_property_read_u32(sysid_parent, "systemid", &sysid);
++ if (!err && ((sysid & GRLIB_VERSION_MASK) >=
++ GRCAN_TXBUG_SAFE_GRLIB_VERSION))
++ txbug = false;
++ of_node_put(sysid_parent);
++ }
+
+ err = of_property_read_u32(np, "freq", &ambafreq);
+ if (err) {
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_asm.c b/drivers/net/ethernet/netronome/nfp/nfp_asm.c
+index cc6ace2be8a9a..ea9f47a357030 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_asm.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_asm.c
+@@ -226,7 +226,7 @@ int swreg_to_unrestricted(swreg dst, swreg lreg, swreg rreg,
+ }
+
+ reg->dst_lmextn = swreg_lmextn(dst);
+- reg->src_lmextn = swreg_lmextn(lreg) | swreg_lmextn(rreg);
++ reg->src_lmextn = swreg_lmextn(lreg) || swreg_lmextn(rreg);
+
+ return 0;
+ }
+@@ -307,7 +307,7 @@ int swreg_to_restricted(swreg dst, swreg lreg, swreg rreg,
+ }
+
+ reg->dst_lmextn = swreg_lmextn(dst);
+- reg->src_lmextn = swreg_lmextn(lreg) | swreg_lmextn(rreg);
++ reg->src_lmextn = swreg_lmextn(lreg) || swreg_lmextn(rreg);
+
+ return 0;
+ }
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 2f3c6a0350a8d..396ff1bcfdade 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2490,9 +2490,12 @@ static int do_new_mount(struct path *path, const char *fstype, int sb_flags,
+ return -ENODEV;
+
+ mnt = vfs_kern_mount(type, sb_flags, name, data);
+- if (!IS_ERR(mnt) && (type->fs_flags & FS_HAS_SUBTYPE) &&
+- !mnt->mnt_sb->s_subtype)
+- mnt = fs_set_subtype(mnt, fstype);
++ if (!IS_ERR(mnt) && (type->fs_flags & FS_HAS_SUBTYPE)) {
++ down_write(&mnt->mnt_sb->s_umount);
++ if (!mnt->mnt_sb->s_subtype)
++ mnt = fs_set_subtype(mnt, fstype);
++ up_write(&mnt->mnt_sb->s_umount);
++ }
+
+ put_filesystem(type);
+ if (IS_ERR(mnt))
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 75d892dc77969..464a78200a31f 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -34,6 +34,9 @@
+ /* HCI priority */
+ #define HCI_PRIO_MAX 7
+
++/* HCI maximum id value */
++#define HCI_MAX_ID 10000
++
+ /* HCI Core structures */
+ struct inquiry_data {
+ bdaddr_t bdaddr;
+diff --git a/include/sound/pcm.h b/include/sound/pcm.h
+index d6bd3caf68787..cd7874535a4b2 100644
+--- a/include/sound/pcm.h
++++ b/include/sound/pcm.h
+@@ -404,6 +404,8 @@ struct snd_pcm_runtime {
+ wait_queue_head_t sleep; /* poll sleep */
+ wait_queue_head_t tsleep; /* transfer sleep */
+ struct fasync_struct *fasync;
++ struct mutex buffer_mutex; /* protect for buffer changes */
++ atomic_t buffer_accessing; /* >0: in r/w operation, <0: blocked */
+
+ /* -- private section -- */
+ void *private_data;
+diff --git a/mm/memory.c b/mm/memory.c
+index 8cd80ba56474a..800834cff4e67 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -4978,6 +4978,8 @@ long copy_huge_page_from_user(struct page *dst_page,
+ if (rc)
+ break;
+
++ flush_dcache_page(subpage);
++
+ cond_resched();
+ }
+ return ret_val;
+diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
+index 93a12cc107c98..aae19c29bcfa8 100644
+--- a/mm/userfaultfd.c
++++ b/mm/userfaultfd.c
+@@ -55,6 +55,8 @@ static int mcopy_atomic_pte(struct mm_struct *dst_mm,
+ /* don't free the page */
+ goto out;
+ }
++
++ flush_dcache_page(page);
+ } else {
+ page = *pagep;
+ *pagep = NULL;
+@@ -574,6 +576,7 @@ retry:
+ err = -EFAULT;
+ goto out;
+ }
++ flush_dcache_page(page);
+ goto retry;
+ } else
+ BUG_ON(page);
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index a5755e0645439..3d780220e2d19 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3180,10 +3180,10 @@ int hci_register_dev(struct hci_dev *hdev)
+ */
+ switch (hdev->dev_type) {
+ case HCI_PRIMARY:
+- id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
++ id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL);
+ break;
+ case HCI_AMP:
+- id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
++ id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL);
+ break;
+ default:
+ return -EINVAL;
+@@ -3192,7 +3192,7 @@ int hci_register_dev(struct hci_dev *hdev)
+ if (id < 0)
+ return id;
+
+- sprintf(hdev->name, "hci%d", id);
++ snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
+ hdev->id = id;
+
+ BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
+diff --git a/sound/core/pcm.c b/sound/core/pcm.c
+index b6ed38dec4357..8eed6244b8325 100644
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -1031,6 +1031,8 @@ int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream,
+ init_waitqueue_head(&runtime->tsleep);
+
+ runtime->status->state = SNDRV_PCM_STATE_OPEN;
++ mutex_init(&runtime->buffer_mutex);
++ atomic_set(&runtime->buffer_accessing, 0);
+
+ substream->runtime = runtime;
+ substream->private_data = pcm->private_data;
+@@ -1062,6 +1064,7 @@ void snd_pcm_detach_substream(struct snd_pcm_substream *substream)
+ substream->runtime = NULL;
+ if (substream->timer)
+ spin_unlock_irq(&substream->timer->lock);
++ mutex_destroy(&runtime->buffer_mutex);
+ kfree(runtime);
+ put_pid(substream->pid);
+ substream->pid = NULL;
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index da454eeee5c91..c376471cf760f 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -2221,10 +2221,15 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
+ snd_pcm_stream_unlock_irq(substream);
+ return -EINVAL;
+ }
++ if (!atomic_inc_unless_negative(&runtime->buffer_accessing)) {
++ err = -EBUSY;
++ goto _end_unlock;
++ }
+ snd_pcm_stream_unlock_irq(substream);
+ err = writer(substream, appl_ofs, data, offset, frames,
+ transfer);
+ snd_pcm_stream_lock_irq(substream);
++ atomic_dec(&runtime->buffer_accessing);
+ if (err < 0)
+ goto _end_unlock;
+ err = pcm_accessible_state(runtime);
+diff --git a/sound/core/pcm_memory.c b/sound/core/pcm_memory.c
+index 4b5356a103159..48e5f0091ce41 100644
+--- a/sound/core/pcm_memory.c
++++ b/sound/core/pcm_memory.c
+@@ -160,19 +160,20 @@ static void snd_pcm_lib_preallocate_proc_write(struct snd_info_entry *entry,
+ size_t size;
+ struct snd_dma_buffer new_dmab;
+
++ mutex_lock(&substream->pcm->open_mutex);
+ if (substream->runtime) {
+ buffer->error = -EBUSY;
+- return;
++ goto unlock;
+ }
+ if (!snd_info_get_line(buffer, line, sizeof(line))) {
+ snd_info_get_str(str, line, sizeof(str));
+ size = simple_strtoul(str, NULL, 10) * 1024;
+ if ((size != 0 && size < 8192) || size > substream->dma_max) {
+ buffer->error = -EINVAL;
+- return;
++ goto unlock;
+ }
+ if (substream->dma_buffer.bytes == size)
+- return;
++ goto unlock;
+ memset(&new_dmab, 0, sizeof(new_dmab));
+ new_dmab.dev = substream->dma_buffer.dev;
+ if (size > 0) {
+@@ -180,7 +181,7 @@ static void snd_pcm_lib_preallocate_proc_write(struct snd_info_entry *entry,
+ substream->dma_buffer.dev.dev,
+ size, &new_dmab) < 0) {
+ buffer->error = -ENOMEM;
+- return;
++ goto unlock;
+ }
+ substream->buffer_bytes_max = size;
+ } else {
+@@ -192,6 +193,8 @@ static void snd_pcm_lib_preallocate_proc_write(struct snd_info_entry *entry,
+ } else {
+ buffer->error = -EINVAL;
+ }
++ unlock:
++ mutex_unlock(&substream->pcm->open_mutex);
+ }
+
+ static inline void preallocate_info_init(struct snd_pcm_substream *substream)
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index c92eca6278407..9862b60bfa063 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -666,6 +666,30 @@ static int snd_pcm_hw_params_choose(struct snd_pcm_substream *pcm,
+ return 0;
+ }
+
++/* acquire buffer_mutex; if it's in r/w operation, return -EBUSY, otherwise
++ * block the further r/w operations
++ */
++static int snd_pcm_buffer_access_lock(struct snd_pcm_runtime *runtime)
++{
++ if (!atomic_dec_unless_positive(&runtime->buffer_accessing))
++ return -EBUSY;
++ mutex_lock(&runtime->buffer_mutex);
++ return 0; /* keep buffer_mutex, unlocked by below */
++}
++
++/* release buffer_mutex and clear r/w access flag */
++static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime)
++{
++ mutex_unlock(&runtime->buffer_mutex);
++ atomic_inc(&runtime->buffer_accessing);
++}
++
++#if IS_ENABLED(CONFIG_SND_PCM_OSS)
++#define is_oss_stream(substream) ((substream)->oss.oss)
++#else
++#define is_oss_stream(substream) false
++#endif
++
+ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
+ struct snd_pcm_hw_params *params)
+ {
+@@ -677,22 +701,25 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
+ if (PCM_RUNTIME_CHECK(substream))
+ return -ENXIO;
+ runtime = substream->runtime;
++ err = snd_pcm_buffer_access_lock(runtime);
++ if (err < 0)
++ return err;
+ snd_pcm_stream_lock_irq(substream);
+ switch (runtime->status->state) {
+ case SNDRV_PCM_STATE_OPEN:
+ case SNDRV_PCM_STATE_SETUP:
+ case SNDRV_PCM_STATE_PREPARED:
++ if (!is_oss_stream(substream) &&
++ atomic_read(&substream->mmap_count))
++ err = -EBADFD;
+ break;
+ default:
+- snd_pcm_stream_unlock_irq(substream);
+- return -EBADFD;
++ err = -EBADFD;
++ break;
+ }
+ snd_pcm_stream_unlock_irq(substream);
+-#if IS_ENABLED(CONFIG_SND_PCM_OSS)
+- if (!substream->oss.oss)
+-#endif
+- if (atomic_read(&substream->mmap_count))
+- return -EBADFD;
++ if (err)
++ goto unlock;
+
+ params->rmask = ~0U;
+ err = snd_pcm_hw_refine(substream, params);
+@@ -769,14 +796,19 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
+ if ((usecs = period_to_usecs(runtime)) >= 0)
+ pm_qos_add_request(&substream->latency_pm_qos_req,
+ PM_QOS_CPU_DMA_LATENCY, usecs);
+- return 0;
++ err = 0;
+ _error:
+- /* hardware might be unusable from this time,
+- so we force application to retry to set
+- the correct hardware parameter settings */
+- snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN);
+- if (substream->ops->hw_free != NULL)
+- substream->ops->hw_free(substream);
++ if (err) {
++ /* hardware might be unusable from this time,
++ * so we force application to retry to set
++ * the correct hardware parameter settings
++ */
++ snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN);
++ if (substream->ops->hw_free != NULL)
++ substream->ops->hw_free(substream);
++ }
++ unlock:
++ snd_pcm_buffer_access_unlock(runtime);
+ return err;
+ }
+
+@@ -809,22 +841,29 @@ static int snd_pcm_hw_free(struct snd_pcm_substream *substream)
+ if (PCM_RUNTIME_CHECK(substream))
+ return -ENXIO;
+ runtime = substream->runtime;
++ result = snd_pcm_buffer_access_lock(runtime);
++ if (result < 0)
++ return result;
+ snd_pcm_stream_lock_irq(substream);
+ switch (runtime->status->state) {
+ case SNDRV_PCM_STATE_SETUP:
+ case SNDRV_PCM_STATE_PREPARED:
++ if (atomic_read(&substream->mmap_count))
++ result = -EBADFD;
+ break;
+ default:
+- snd_pcm_stream_unlock_irq(substream);
+- return -EBADFD;
++ result = -EBADFD;
++ break;
+ }
+ snd_pcm_stream_unlock_irq(substream);
+- if (atomic_read(&substream->mmap_count))
+- return -EBADFD;
++ if (result)
++ goto unlock;
+ if (substream->ops->hw_free)
+ result = substream->ops->hw_free(substream);
+ snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN);
+ pm_qos_remove_request(&substream->latency_pm_qos_req);
++ unlock:
++ snd_pcm_buffer_access_unlock(runtime);
+ return result;
+ }
+
+@@ -1061,15 +1100,17 @@ struct action_ops {
+ */
+ static int snd_pcm_action_group(const struct action_ops *ops,
+ struct snd_pcm_substream *substream,
+- int state, int do_lock)
++ int state, int stream_lock)
+ {
+ struct snd_pcm_substream *s = NULL;
+ struct snd_pcm_substream *s1;
+ int res = 0, depth = 1;
+
+ snd_pcm_group_for_each_entry(s, substream) {
+- if (do_lock && s != substream) {
+- if (s->pcm->nonatomic)
++ if (s != substream) {
++ if (!stream_lock)
++ mutex_lock_nested(&s->runtime->buffer_mutex, depth);
++ else if (s->pcm->nonatomic)
+ mutex_lock_nested(&s->self_group.mutex, depth);
+ else
+ spin_lock_nested(&s->self_group.lock, depth);
+@@ -1097,18 +1138,18 @@ static int snd_pcm_action_group(const struct action_ops *ops,
+ ops->post_action(s, state);
+ }
+ _unlock:
+- if (do_lock) {
+- /* unlock streams */
+- snd_pcm_group_for_each_entry(s1, substream) {
+- if (s1 != substream) {
+- if (s1->pcm->nonatomic)
+- mutex_unlock(&s1->self_group.mutex);
+- else
+- spin_unlock(&s1->self_group.lock);
+- }
+- if (s1 == s) /* end */
+- break;
++ /* unlock streams */
++ snd_pcm_group_for_each_entry(s1, substream) {
++ if (s1 != substream) {
++ if (!stream_lock)
++ mutex_unlock(&s1->runtime->buffer_mutex);
++ else if (s1->pcm->nonatomic)
++ mutex_unlock(&s1->self_group.mutex);
++ else
++ spin_unlock(&s1->self_group.lock);
+ }
++ if (s1 == s) /* end */
++ break;
+ }
+ return res;
+ }
+@@ -1189,10 +1230,15 @@ static int snd_pcm_action_nonatomic(const struct action_ops *ops,
+ int res;
+
+ down_read(&snd_pcm_link_rwsem);
++ res = snd_pcm_buffer_access_lock(substream->runtime);
++ if (res < 0)
++ goto unlock;
+ if (snd_pcm_stream_linked(substream))
+ res = snd_pcm_action_group(ops, substream, state, 0);
+ else
+ res = snd_pcm_action_single(ops, substream, state);
++ snd_pcm_buffer_access_unlock(substream->runtime);
++ unlock:
+ up_read(&snd_pcm_link_rwsem);
+ return res;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-05-18 9:50 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-05-18 9:50 UTC (permalink / raw
To: gentoo-commits
commit: 3921da7798e3803bbcbfcb34b3fc631326321161
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 18 09:49:46 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 18 09:49:46 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3921da77
Linux patch 4.19.244
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1243_linux-4.19.244.patch | 708 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 712 insertions(+)
diff --git a/0000_README b/0000_README
index 5dc0a832..e473c6e1 100644
--- a/0000_README
+++ b/0000_README
@@ -1011,6 +1011,10 @@ Patch: 1242_linux-4.19.243.patch
From: https://www.kernel.org
Desc: Linux 4.19.243
+Patch: 1243_linux-4.19.244.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.244
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1243_linux-4.19.244.patch b/1243_linux-4.19.244.patch
new file mode 100644
index 00000000..a66f3a42
--- /dev/null
+++ b/1243_linux-4.19.244.patch
@@ -0,0 +1,708 @@
+diff --git a/Makefile b/Makefile
+index 6899a8fc4c466..ca86541c67394 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 243
++SUBLEVEL = 244
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/generic/board-ocelot_pcb123.its.S b/arch/mips/generic/board-ocelot_pcb123.its.S
+index 5a7d5e1c878af..6dd54b7c2f076 100644
+--- a/arch/mips/generic/board-ocelot_pcb123.its.S
++++ b/arch/mips/generic/board-ocelot_pcb123.its.S
+@@ -1,23 +1,23 @@
+ /* SPDX-License-Identifier: (GPL-2.0 OR MIT) */
+ / {
+ images {
+- fdt@ocelot_pcb123 {
++ fdt-ocelot_pcb123 {
+ description = "MSCC Ocelot PCB123 Device Tree";
+ data = /incbin/("boot/dts/mscc/ocelot_pcb123.dtb");
+ type = "flat_dt";
+ arch = "mips";
+ compression = "none";
+- hash@0 {
++ hash {
+ algo = "sha1";
+ };
+ };
+ };
+
+ configurations {
+- conf@ocelot_pcb123 {
++ conf-ocelot_pcb123 {
+ description = "Ocelot Linux kernel";
+- kernel = "kernel@0";
+- fdt = "fdt@ocelot_pcb123";
++ kernel = "kernel";
++ fdt = "fdt-ocelot_pcb123";
+ };
+ };
+ };
+diff --git a/arch/s390/Makefile b/arch/s390/Makefile
+index 9a3a698c8fca5..4d0082f3de47d 100644
+--- a/arch/s390/Makefile
++++ b/arch/s390/Makefile
+@@ -27,6 +27,16 @@ KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-option,-ffreestanding)
+ KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, address-of-packed-member)
+ KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO),-g)
+ KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO_DWARF4), $(call cc-option, -gdwarf-4,))
++
++ifdef CONFIG_CC_IS_GCC
++ ifeq ($(call cc-ifversion, -ge, 1200, y), y)
++ ifeq ($(call cc-ifversion, -lt, 1300, y), y)
++ KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds)
++ KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, array-bounds)
++ endif
++ endif
++endif
++
+ UTS_MACHINE := s390x
+ STACK_SIZE := 16384
+ CHECKFLAGS += -D__s390__ -D__s390x__
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+index 2a9112515f464..2fe48e3158ddd 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -498,7 +498,7 @@ static int vmw_fb_kms_detach(struct vmw_fb_par *par,
+
+ static int vmw_fb_kms_framebuffer(struct fb_info *info)
+ {
+- struct drm_mode_fb_cmd2 mode_cmd;
++ struct drm_mode_fb_cmd2 mode_cmd = {0};
+ struct vmw_fb_par *par = info->par;
+ struct fb_var_screeninfo *var = &info->var;
+ struct drm_framebuffer *cur_fb;
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index c7adaca2ab013..d150d0cab1b6f 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -791,7 +791,7 @@ config SENSORS_LTC4261
+
+ config SENSORS_LTQ_CPUTEMP
+ bool "Lantiq cpu temperature sensor driver"
+- depends on LANTIQ
++ depends on SOC_XWAY
+ help
+ If you say yes here you get support for the temperature
+ sensor inside your CPU.
+diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
+index ca54ce5c8e10c..4010b61743f5b 100644
+--- a/drivers/hwmon/f71882fg.c
++++ b/drivers/hwmon/f71882fg.c
+@@ -1590,8 +1590,9 @@ static ssize_t show_temp(struct device *dev, struct device_attribute *devattr,
+ temp *= 125;
+ if (sign)
+ temp -= 128000;
+- } else
+- temp = data->temp[nr] * 1000;
++ } else {
++ temp = ((s8)data->temp[nr]) * 1000;
++ }
+
+ return sprintf(buf, "%d\n", temp);
+ }
+diff --git a/drivers/hwmon/tmp401.c b/drivers/hwmon/tmp401.c
+index 1f2d13dc94396..99b0d7e0a27ab 100644
+--- a/drivers/hwmon/tmp401.c
++++ b/drivers/hwmon/tmp401.c
+@@ -756,10 +756,21 @@ static int tmp401_probe(struct i2c_client *client,
+ return 0;
+ }
+
++static const struct of_device_id __maybe_unused tmp4xx_of_match[] = {
++ { .compatible = "ti,tmp401", },
++ { .compatible = "ti,tmp411", },
++ { .compatible = "ti,tmp431", },
++ { .compatible = "ti,tmp432", },
++ { .compatible = "ti,tmp435", },
++ { },
++};
++MODULE_DEVICE_TABLE(of, tmp4xx_of_match);
++
+ static struct i2c_driver tmp401_driver = {
+ .class = I2C_CLASS_HWMON,
+ .driver = {
+ .name = "tmp401",
++ .of_match_table = of_match_ptr(tmp4xx_of_match),
+ },
+ .probe = tmp401_probe,
+ .id_table = tmp401_id,
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 1f971d31ec302..6b0a4dc1ced14 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -6146,6 +6146,11 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ n_parts++;
+ }
+
++ if (!n_parts) {
++ kfree(parts);
++ return 0;
++ }
++
+ rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
+ fail:
+ if (rc)
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index c84ee5ba53812..3d8e17bb8a101 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -2082,11 +2082,13 @@ static void hw_scan_work(struct work_struct *work)
+ if (req->ie_len)
+ skb_put_data(probe, req->ie, req->ie_len);
+
++ rcu_read_lock();
+ if (!ieee80211_tx_prepare_skb(hwsim->hw,
+ hwsim->hw_scan_vif,
+ probe,
+ hwsim->tmp_chan->band,
+ NULL)) {
++ rcu_read_unlock();
+ kfree_skb(probe);
+ continue;
+ }
+@@ -2094,6 +2096,7 @@ static void hw_scan_work(struct work_struct *work)
+ local_bh_disable();
+ mac80211_hwsim_tx_frame(hwsim->hw, probe,
+ hwsim->tmp_chan);
++ rcu_read_unlock();
+ local_bh_enable();
+ }
+ }
+diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c
+index e02f295d38a9b..07d9668137df3 100644
+--- a/drivers/s390/net/ctcm_mpc.c
++++ b/drivers/s390/net/ctcm_mpc.c
+@@ -625,8 +625,6 @@ static void mpc_rcvd_sweep_resp(struct mpcg_info *mpcginfo)
+ ctcm_clear_busy_do(dev);
+ }
+
+- kfree(mpcginfo);
+-
+ return;
+
+ }
+@@ -1205,10 +1203,10 @@ static void ctcmpc_unpack_skb(struct channel *ch, struct sk_buff *pskb)
+ CTCM_FUNTAIL, dev->name);
+ priv->stats.rx_dropped++;
+ /* mpcginfo only used for non-data transfers */
+- kfree(mpcginfo);
+ if (do_debug_data)
+ ctcmpc_dump_skb(pskb, -8);
+ }
++ kfree(mpcginfo);
+ }
+ done:
+
+@@ -1991,7 +1989,6 @@ static void mpc_action_rcvd_xid0(fsm_instance *fsm, int event, void *arg)
+ }
+ break;
+ }
+- kfree(mpcginfo);
+
+ CTCM_PR_DEBUG("ctcmpc:%s() %s xid2:%i xid7:%i xidt_p2:%i \n",
+ __func__, ch->id, grp->outstanding_xid2,
+@@ -2052,7 +2049,6 @@ static void mpc_action_rcvd_xid7(fsm_instance *fsm, int event, void *arg)
+ mpc_validate_xid(mpcginfo);
+ break;
+ }
+- kfree(mpcginfo);
+ return;
+ }
+
+diff --git a/drivers/s390/net/ctcm_sysfs.c b/drivers/s390/net/ctcm_sysfs.c
+index ded1930a00b2d..e3813a7aa5e68 100644
+--- a/drivers/s390/net/ctcm_sysfs.c
++++ b/drivers/s390/net/ctcm_sysfs.c
+@@ -39,11 +39,12 @@ static ssize_t ctcm_buffer_write(struct device *dev,
+ struct ctcm_priv *priv = dev_get_drvdata(dev);
+ int rc;
+
+- ndev = priv->channel[CTCM_READ]->netdev;
+- if (!(priv && priv->channel[CTCM_READ] && ndev)) {
++ if (!(priv && priv->channel[CTCM_READ] &&
++ priv->channel[CTCM_READ]->netdev)) {
+ CTCM_DBF_TEXT(SETUP, CTC_DBF_ERROR, "bfnondev");
+ return -ENODEV;
+ }
++ ndev = priv->channel[CTCM_READ]->netdev;
+
+ rc = kstrtouint(buf, 0, &bs1);
+ if (rc)
+diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
+index 2d9fe7e4ee400..d8f99ff53a94f 100644
+--- a/drivers/s390/net/lcs.c
++++ b/drivers/s390/net/lcs.c
+@@ -1735,10 +1735,11 @@ lcs_get_control(struct lcs_card *card, struct lcs_cmd *cmd)
+ lcs_schedule_recovery(card);
+ break;
+ case LCS_CMD_STOPLAN:
+- pr_warn("Stoplan for %s initiated by LGW\n",
+- card->dev->name);
+- if (card->dev)
++ if (card->dev) {
++ pr_warn("Stoplan for %s initiated by LGW\n",
++ card->dev->name);
+ netif_carrier_off(card->dev);
++ }
+ break;
+ default:
+ LCS_DBF_TEXT(5, trace, "noLGWcmd");
+diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c
+index db1f5135846aa..3140adf1c5ad8 100644
+--- a/drivers/slimbus/qcom-ctrl.c
++++ b/drivers/slimbus/qcom-ctrl.c
+@@ -515,9 +515,9 @@ static int qcom_slim_probe(struct platform_device *pdev)
+ }
+
+ ctrl->irq = platform_get_irq(pdev, 0);
+- if (!ctrl->irq) {
++ if (ctrl->irq < 0) {
+ dev_err(&pdev->dev, "no slimbus IRQ\n");
+- return -ENODEV;
++ return ctrl->irq;
+ }
+
+ sctrl = &ctrl->ctrl;
+diff --git a/drivers/tty/serial/digicolor-usart.c b/drivers/tty/serial/digicolor-usart.c
+index 13ac36e2da4f0..4446c13629b1c 100644
+--- a/drivers/tty/serial/digicolor-usart.c
++++ b/drivers/tty/serial/digicolor-usart.c
+@@ -472,10 +472,10 @@ static int digicolor_uart_probe(struct platform_device *pdev)
+ return PTR_ERR(uart_clk);
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- dp->port.mapbase = res->start;
+ dp->port.membase = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(dp->port.membase))
+ return PTR_ERR(dp->port.membase);
++ dp->port.mapbase = res->start;
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0)
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 48e775fff16d6..b60a4200fc2be 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -755,6 +755,7 @@ static int wdm_release(struct inode *inode, struct file *file)
+ poison_urbs(desc);
+ spin_lock_irq(&desc->iuspin);
+ desc->resp_count = 0;
++ clear_bit(WDM_RESPONDING, &desc->flags);
+ spin_unlock_irq(&desc->iuspin);
+ desc->manage_power(desc->intf, 0);
+ unpoison_urbs(desc);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index cf77ec17ef3f4..0699b770e058c 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2123,10 +2123,14 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(3) },
+ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */
+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
++ { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */
++ { USB_DEVICE_INTERFACE_CLASS(0x1782, 0x4d11, 0xff) }, /* Fibocom L610 (ECM/RNDIS mode) */
+ { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */
+ .driver_info = RSVD(4) | RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */
+ .driver_info = RSVD(6) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0106, 0xff) }, /* Fibocom MA510 (ECM mode w/ diag intf.) */
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x010a, 0xff) }, /* Fibocom MA510 (ECM mode) */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 2e8cb6d8ba41f..4bbccc30748a2 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -100,6 +100,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) },
++ { USB_DEVICE(HP_VENDOR_ID, HP_LM930_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) },
+ { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) },
+ { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 15f746e977a71..873e50088a36e 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -129,6 +129,7 @@
+ #define HP_TD620_PRODUCT_ID 0x0956
+ #define HP_LD960_PRODUCT_ID 0x0b39
+ #define HP_LD381_PRODUCT_ID 0x0f7f
++#define HP_LM930_PRODUCT_ID 0x0f9b
+ #define HP_LCM220_PRODUCT_ID 0x3139
+ #define HP_LCM960_PRODUCT_ID 0x3239
+ #define HP_LD220_PRODUCT_ID 0x3524
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index b1b9923162a04..3f437f07356b4 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -166,6 +166,8 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */
+ {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */
+ {DEVICE_SWI(0x1199, 0x90d2)}, /* Sierra Wireless EM9191 QDL */
++ {DEVICE_SWI(0x1199, 0xc080)}, /* Sierra Wireless EM7590 QDL */
++ {DEVICE_SWI(0x1199, 0xc081)}, /* Sierra Wireless EM7590 */
+ {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
+ {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
+diff --git a/drivers/usb/typec/tcpci.c b/drivers/usb/typec/tcpci.c
+index 2c34add377085..9f98376d9bef4 100644
+--- a/drivers/usb/typec/tcpci.c
++++ b/drivers/usb/typec/tcpci.c
+@@ -601,7 +601,7 @@ static int tcpci_remove(struct i2c_client *client)
+ /* Disable chip interrupts before unregistering port */
+ err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0);
+ if (err < 0)
+- return err;
++ dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err));
+
+ tcpci_unregister_port(chip->tcpci);
+
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 53ba5019ad063..150cec85c416d 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -1168,13 +1168,12 @@ static int gfs2_iomap_end(struct inode *inode, loff_t pos, loff_t length,
+
+ if (length != written && (iomap->flags & IOMAP_F_NEW)) {
+ /* Deallocate blocks that were just allocated. */
+- loff_t blockmask = i_blocksize(inode) - 1;
+- loff_t end = (pos + length) & ~blockmask;
++ loff_t hstart = round_up(pos + written, i_blocksize(inode));
++ loff_t hend = iomap->offset + iomap->length;
+
+- pos = (pos + written + blockmask) & ~blockmask;
+- if (pos < end) {
+- truncate_pagecache_range(inode, pos, end - 1);
+- punch_hole(ip, pos, end - pos);
++ if (hstart < hend) {
++ truncate_pagecache_range(inode, hstart, hend - 1);
++ punch_hole(ip, hstart, hend - hstart);
+ }
+ }
+
+diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
+index 2a8105d204a96..78411dc4a040f 100644
+--- a/include/linux/netdev_features.h
++++ b/include/linux/netdev_features.h
+@@ -156,7 +156,7 @@ enum {
+ #define NETIF_F_HW_TLS_TX __NETIF_F(HW_TLS_TX)
+ #define NETIF_F_HW_TLS_RX __NETIF_F(HW_TLS_RX)
+
+-/* Finds the next feature with the highest number of the range of start till 0.
++/* Finds the next feature with the highest number of the range of start-1 till 0.
+ */
+ static inline int find_next_netdev_feature(u64 feature, unsigned long start)
+ {
+@@ -175,7 +175,7 @@ static inline int find_next_netdev_feature(u64 feature, unsigned long start)
+ for ((bit) = find_next_netdev_feature((mask_addr), \
+ NETDEV_FEATURE_COUNT); \
+ (bit) >= 0; \
+- (bit) = find_next_netdev_feature((mask_addr), (bit) - 1))
++ (bit) = find_next_netdev_feature((mask_addr), (bit)))
+
+ /* Features valid for ethtool to change */
+ /* = all defined minus driver/device-class-related */
+diff --git a/include/net/tc_act/tc_pedit.h b/include/net/tc_act/tc_pedit.h
+index fac3ad4a86de9..bd74e94527a2a 100644
+--- a/include/net/tc_act/tc_pedit.h
++++ b/include/net/tc_act/tc_pedit.h
+@@ -14,6 +14,7 @@ struct tcf_pedit {
+ struct tc_action common;
+ unsigned char tcfp_nkeys;
+ unsigned char tcfp_flags;
++ u32 tcfp_off_max_hint;
+ struct tc_pedit_key *tcfp_keys;
+ struct tcf_pedit_key_ex *tcfp_keys_ex;
+ };
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index 153628277a487..dcd5755b1fe2a 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -2403,8 +2403,11 @@ static struct notifier_block cpuset_track_online_nodes_nb = {
+ */
+ void __init cpuset_init_smp(void)
+ {
+- cpumask_copy(top_cpuset.cpus_allowed, cpu_active_mask);
+- top_cpuset.mems_allowed = node_states[N_MEMORY];
++ /*
++ * cpus_allowd/mems_allowed set to v2 values in the initial
++ * cpuset_bind() call will be reset to v1 values in another
++ * cpuset_bind() call when v1 cpuset is mounted.
++ */
+ top_cpuset.old_mems_allowed = top_cpuset.mems_allowed;
+
+ cpumask_copy(top_cpuset.effective_cpus, cpu_active_mask);
+diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
+index cc062b69fc8d8..a62eedf889eb3 100644
+--- a/net/batman-adv/fragmentation.c
++++ b/net/batman-adv/fragmentation.c
+@@ -490,6 +490,17 @@ int batadv_frag_send_packet(struct sk_buff *skb,
+ goto free_skb;
+ }
+
++ /* GRO might have added fragments to the fragment list instead of
++ * frags[]. But this is not handled by skb_split and must be
++ * linearized to avoid incorrect length information after all
++ * batman-adv fragments were created and submitted to the
++ * hard-interface
++ */
++ if (skb_has_frag_list(skb) && __skb_linearize(skb)) {
++ ret = -ENOMEM;
++ goto free_skb;
++ }
++
+ /* Create one header to be copied to all fragments */
+ frag_header.packet_type = BATADV_UNICAST_FRAG;
+ frag_header.version = BATADV_COMPAT_VERSION;
+diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
+index af6ad467ed615..3a8128341e6ac 100644
+--- a/net/core/secure_seq.c
++++ b/net/core/secure_seq.c
+@@ -22,6 +22,8 @@
+ static siphash_key_t net_secret __read_mostly;
+ static siphash_key_t ts_secret __read_mostly;
+
++#define EPHEMERAL_PORT_SHUFFLE_PERIOD (10 * HZ)
++
+ static __always_inline void net_secret_init(void)
+ {
+ net_get_random_once(&net_secret, sizeof(net_secret));
+@@ -100,11 +102,13 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+ const struct {
+ struct in6_addr saddr;
+ struct in6_addr daddr;
++ unsigned int timeseed;
+ __be16 dport;
+ } __aligned(SIPHASH_ALIGNMENT) combined = {
+ .saddr = *(struct in6_addr *)saddr,
+ .daddr = *(struct in6_addr *)daddr,
+- .dport = dport
++ .timeseed = jiffies / EPHEMERAL_PORT_SHUFFLE_PERIOD,
++ .dport = dport,
+ };
+ net_secret_init();
+ return siphash(&combined, offsetofend(typeof(combined), dport),
+@@ -145,8 +149,10 @@ EXPORT_SYMBOL_GPL(secure_tcp_seq);
+ u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport)
+ {
+ net_secret_init();
+- return siphash_3u32((__force u32)saddr, (__force u32)daddr,
+- (__force u16)dport, &net_secret);
++ return siphash_4u32((__force u32)saddr, (__force u32)daddr,
++ (__force u16)dport,
++ jiffies / EPHEMERAL_PORT_SHUFFLE_PERIOD,
++ &net_secret);
+ }
+ EXPORT_SYMBOL_GPL(secure_ipv4_port_ephemeral);
+ #endif
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index b068eb01fe993..2e7abad48d83c 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -309,6 +309,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
+ struct net *net = sock_net(sk);
+ if (sk->sk_family == AF_INET) {
+ struct sockaddr_in *addr = (struct sockaddr_in *) uaddr;
++ u32 tb_id = RT_TABLE_LOCAL;
+ int chk_addr_ret;
+
+ if (addr_len < sizeof(*addr))
+@@ -322,7 +323,8 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
+ pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n",
+ sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port));
+
+- chk_addr_ret = inet_addr_type(net, addr->sin_addr.s_addr);
++ tb_id = l3mdev_fib_table_by_index(net, sk->sk_bound_dev_if) ? : tb_id;
++ chk_addr_ret = inet_addr_type_table(net, addr->sin_addr.s_addr, tb_id);
+
+ if (addr->sin_addr.s_addr == htonl(INADDR_ANY))
+ chk_addr_ret = RTN_LOCAL;
+@@ -363,6 +365,14 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
+ return -ENODEV;
+ }
+ }
++
++ if (!dev && sk->sk_bound_dev_if) {
++ dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
++ if (!dev) {
++ rcu_read_unlock();
++ return -ENODEV;
++ }
++ }
+ has_addr = pingv6_ops.ipv6_chk_addr(net, &addr->sin6_addr, dev,
+ scoped);
+ rcu_read_unlock();
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index b41d4acc57e69..d7f17581df7da 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1728,6 +1728,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ #endif
+ RT_CACHE_STAT_INC(in_slow_mc);
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, &rth->dst);
+ return 0;
+ }
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index e2120221b9578..6ffa83319d08b 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1978,7 +1978,6 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ copied = len;
+ }
+
+- skb_reset_transport_header(data_skb);
+ err = skb_copy_datagram_msg(data_skb, 0, msg, copied);
+
+ if (msg->msg_name) {
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index ce14fafb36a1c..fec0f7fdb015d 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -148,7 +148,7 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
+ struct nlattr *pattr;
+ struct tcf_pedit *p;
+ int ret = 0, err;
+- int ksize;
++ int i, ksize;
+ u32 index;
+
+ if (!nla) {
+@@ -221,6 +221,18 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
+ p->tcfp_nkeys = parm->nkeys;
+ }
+ memcpy(p->tcfp_keys, parm->keys, ksize);
++ p->tcfp_off_max_hint = 0;
++ for (i = 0; i < p->tcfp_nkeys; ++i) {
++ u32 cur = p->tcfp_keys[i].off;
++
++ /* The AT option can read a single byte, we can bound the actual
++ * value with uchar max.
++ */
++ cur += (0xff & p->tcfp_keys[i].offmask) >> p->tcfp_keys[i].shift;
++
++ /* Each key touches 4 bytes starting from the computed offset */
++ p->tcfp_off_max_hint = max(p->tcfp_off_max_hint, cur + 4);
++ }
+
+ p->tcfp_flags = parm->flags;
+ p->tcf_action = parm->action;
+@@ -298,13 +310,18 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,
+ struct tcf_result *res)
+ {
+ struct tcf_pedit *p = to_pedit(a);
++ u32 max_offset;
+ int i;
+
+- if (skb_unclone(skb, GFP_ATOMIC))
+- return p->tcf_action;
+-
+ spin_lock(&p->tcf_lock);
+
++ max_offset = (skb_transport_header_was_set(skb) ?
++ skb_transport_offset(skb) :
++ skb_network_offset(skb)) +
++ p->tcfp_off_max_hint;
++ if (skb_ensure_writable(skb, min(skb->len, max_offset)))
++ goto unlock;
++
+ tcf_lastuse_update(&p->tcf_tm);
+
+ if (p->tcfp_nkeys > 0) {
+@@ -393,6 +410,7 @@ bad:
+ p->tcf_qstats.overlimits++;
+ done:
+ bstats_update(&p->tcf_bstats, skb);
++unlock:
+ spin_unlock(&p->tcf_lock);
+ return p->tcf_action;
+ }
+diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c
+index 36340912df48a..a7a4e3ce211a2 100644
+--- a/net/smc/smc_rx.c
++++ b/net/smc/smc_rx.c
+@@ -349,12 +349,12 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
+ }
+ break;
+ }
++ if (!timeo)
++ return -EAGAIN;
+ if (signal_pending(current)) {
+ read_done = sock_intr_errno(timeo);
+ break;
+ }
+- if (!timeo)
+- return -EAGAIN;
+ }
+
+ if (!smc_rx_data_available(conn)) {
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index a5b0c40ee545f..b9f15a260c789 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -419,6 +419,9 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol,
+
+ val = (val >> mc->shift) & mask;
+
++ if (sel < 0 || sel > mc->max)
++ return -EINVAL;
++
+ *select = sel;
+
+ /* Setting a volume is only valid if it is already On */
+@@ -433,7 +436,7 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol,
+ mask << mc->shift,
+ sel << mc->shift);
+
+- return 0;
++ return *select != val;
+ }
+
+ static const char *max98090_perf_pwr_text[] =
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index c88bc6bb41cfe..7a37312c8e0c2 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -523,7 +523,15 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
+ unsigned int mask = (1 << fls(max)) - 1;
+ unsigned int invert = mc->invert;
+ unsigned int val, val_mask;
+- int err, ret;
++ int err, ret, tmp;
++
++ tmp = ucontrol->value.integer.value[0];
++ if (tmp < 0)
++ return -EINVAL;
++ if (mc->platform_max && tmp > mc->platform_max)
++ return -EINVAL;
++ if (tmp > mc->max - mc->min + 1)
++ return -EINVAL;
+
+ if (invert)
+ val = (max - ucontrol->value.integer.value[0]) & mask;
+@@ -538,6 +546,14 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
+ ret = err;
+
+ if (snd_soc_volsw_is_stereo(mc)) {
++ tmp = ucontrol->value.integer.value[1];
++ if (tmp < 0)
++ return -EINVAL;
++ if (mc->platform_max && tmp > mc->platform_max)
++ return -EINVAL;
++ if (tmp > mc->max - mc->min + 1)
++ return -EINVAL;
++
+ if (invert)
+ val = (max - ucontrol->value.integer.value[1]) & mask;
+ else
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-05-25 11:55 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-05-25 11:55 UTC (permalink / raw
To: gentoo-commits
commit: c66e384f94c464fe67ed0a093e2fef9e02676b6f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 25 11:55:42 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 25 11:55:42 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c66e384f
Linux patch 4.19.245
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1244_linux-4.19.245.patch | 1905 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1909 insertions(+)
diff --git a/0000_README b/0000_README
index e473c6e1..b7976b31 100644
--- a/0000_README
+++ b/0000_README
@@ -1015,6 +1015,10 @@ Patch: 1243_linux-4.19.244.patch
From: https://www.kernel.org
Desc: Linux 4.19.244
+Patch: 1244_linux-4.19.245.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.245
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1244_linux-4.19.245.patch b/1244_linux-4.19.245.patch
new file mode 100644
index 00000000..9ff4fbae
--- /dev/null
+++ b/1244_linux-4.19.245.patch
@@ -0,0 +1,1905 @@
+diff --git a/Makefile b/Makefile
+index ca86541c67394..64a64f6ba90d8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 244
++SUBLEVEL = 245
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index a929b6acb149e..d779cd1a3b0c3 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -1067,7 +1067,7 @@ vector_bhb_loop8_\name:
+
+ @ bhb workaround
+ mov r0, #8
+-3: b . + 4
++3: W(b) . + 4
+ subs r0, r0, #1
+ bne 3b
+ dsb
+diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
+index a452b859f485f..d99b453075667 100644
+--- a/arch/arm/kernel/stacktrace.c
++++ b/arch/arm/kernel/stacktrace.c
+@@ -52,17 +52,17 @@ int notrace unwind_frame(struct stackframe *frame)
+ return -EINVAL;
+
+ frame->sp = frame->fp;
+- frame->fp = *(unsigned long *)(fp);
+- frame->pc = *(unsigned long *)(fp + 4);
++ frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp));
++ frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 4));
+ #else
+ /* check current frame pointer is within bounds */
+ if (fp < low + 12 || fp > high - 4)
+ return -EINVAL;
+
+ /* restore the registers from the stack frame */
+- frame->fp = *(unsigned long *)(fp - 12);
+- frame->sp = *(unsigned long *)(fp - 8);
+- frame->pc = *(unsigned long *)(fp - 4);
++ frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 12));
++ frame->sp = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 8));
++ frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 4));
+ #endif
+
+ return 0;
+diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c
+index 8394307272d6f..0381e14954865 100644
+--- a/arch/arm/mm/proc-v7-bugs.c
++++ b/arch/arm/mm/proc-v7-bugs.c
+@@ -302,6 +302,7 @@ void cpu_v7_ca15_ibe(void)
+ {
+ if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0)))
+ cpu_v7_spectre_v2_init();
++ cpu_v7_spectre_bhb_init();
+ }
+
+ void cpu_v7_bugs_init(void)
+diff --git a/arch/mips/lantiq/falcon/sysctrl.c b/arch/mips/lantiq/falcon/sysctrl.c
+index 82bbd0e2e298f..714d926594897 100644
+--- a/arch/mips/lantiq/falcon/sysctrl.c
++++ b/arch/mips/lantiq/falcon/sysctrl.c
+@@ -169,6 +169,8 @@ static inline void clkdev_add_sys(const char *dev, unsigned int module,
+ {
+ struct clk *clk = kzalloc(sizeof(struct clk), GFP_KERNEL);
+
++ if (!clk)
++ return;
+ clk->cl.dev_id = dev;
+ clk->cl.con_id = NULL;
+ clk->cl.clk = clk;
+diff --git a/arch/mips/lantiq/xway/gptu.c b/arch/mips/lantiq/xway/gptu.c
+index e304aabd6678a..7d4081d67d61c 100644
+--- a/arch/mips/lantiq/xway/gptu.c
++++ b/arch/mips/lantiq/xway/gptu.c
+@@ -124,6 +124,8 @@ static inline void clkdev_add_gptu(struct device *dev, const char *con,
+ {
+ struct clk *clk = kzalloc(sizeof(struct clk), GFP_KERNEL);
+
++ if (!clk)
++ return;
+ clk->cl.dev_id = dev_name(dev);
+ clk->cl.con_id = con;
+ clk->cl.clk = clk;
+diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
+index e0af39b33e287..293ebb833659c 100644
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -313,6 +313,8 @@ static void clkdev_add_pmu(const char *dev, const char *con, bool deactivate,
+ {
+ struct clk *clk = kzalloc(sizeof(struct clk), GFP_KERNEL);
+
++ if (!clk)
++ return;
+ clk->cl.dev_id = dev;
+ clk->cl.con_id = con;
+ clk->cl.clk = clk;
+@@ -336,6 +338,8 @@ static void clkdev_add_cgu(const char *dev, const char *con,
+ {
+ struct clk *clk = kzalloc(sizeof(struct clk), GFP_KERNEL);
+
++ if (!clk)
++ return;
+ clk->cl.dev_id = dev;
+ clk->cl.con_id = con;
+ clk->cl.clk = clk;
+@@ -354,24 +358,28 @@ static void clkdev_add_pci(void)
+ struct clk *clk_ext = kzalloc(sizeof(struct clk), GFP_KERNEL);
+
+ /* main pci clock */
+- clk->cl.dev_id = "17000000.pci";
+- clk->cl.con_id = NULL;
+- clk->cl.clk = clk;
+- clk->rate = CLOCK_33M;
+- clk->rates = valid_pci_rates;
+- clk->enable = pci_enable;
+- clk->disable = pmu_disable;
+- clk->module = 0;
+- clk->bits = PMU_PCI;
+- clkdev_add(&clk->cl);
++ if (clk) {
++ clk->cl.dev_id = "17000000.pci";
++ clk->cl.con_id = NULL;
++ clk->cl.clk = clk;
++ clk->rate = CLOCK_33M;
++ clk->rates = valid_pci_rates;
++ clk->enable = pci_enable;
++ clk->disable = pmu_disable;
++ clk->module = 0;
++ clk->bits = PMU_PCI;
++ clkdev_add(&clk->cl);
++ }
+
+ /* use internal/external bus clock */
+- clk_ext->cl.dev_id = "17000000.pci";
+- clk_ext->cl.con_id = "external";
+- clk_ext->cl.clk = clk_ext;
+- clk_ext->enable = pci_ext_enable;
+- clk_ext->disable = pci_ext_disable;
+- clkdev_add(&clk_ext->cl);
++ if (clk_ext) {
++ clk_ext->cl.dev_id = "17000000.pci";
++ clk_ext->cl.con_id = "external";
++ clk_ext->cl.clk = clk_ext;
++ clk_ext->enable = pci_ext_enable;
++ clk_ext->disable = pci_ext_disable;
++ clkdev_add(&clk_ext->cl);
++ }
+ }
+
+ /* xway socs can generate clocks on gpio pins */
+@@ -391,9 +399,15 @@ static void clkdev_add_clkout(void)
+ char *name;
+
+ name = kzalloc(sizeof("clkout0"), GFP_KERNEL);
++ if (!name)
++ continue;
+ sprintf(name, "clkout%d", i);
+
+ clk = kzalloc(sizeof(struct clk), GFP_KERNEL);
++ if (!clk) {
++ kfree(name);
++ continue;
++ }
+ clk->cl.dev_id = "1f103000.cgu";
+ clk->cl.con_id = name;
+ clk->cl.clk = clk;
+diff --git a/arch/x86/um/shared/sysdep/syscalls_64.h b/arch/x86/um/shared/sysdep/syscalls_64.h
+index 8a7d5e1da98e5..1e6875b4ffd83 100644
+--- a/arch/x86/um/shared/sysdep/syscalls_64.h
++++ b/arch/x86/um/shared/sysdep/syscalls_64.h
+@@ -10,13 +10,12 @@
+ #include <linux/msg.h>
+ #include <linux/shm.h>
+
+-typedef long syscall_handler_t(void);
++typedef long syscall_handler_t(long, long, long, long, long, long);
+
+ extern syscall_handler_t *sys_call_table[];
+
+ #define EXECUTE_SYSCALL(syscall, regs) \
+- (((long (*)(long, long, long, long, long, long)) \
+- (*sys_call_table[syscall]))(UPT_SYSCALL_ARG1(®s->regs), \
++ (((*sys_call_table[syscall]))(UPT_SYSCALL_ARG1(®s->regs), \
+ UPT_SYSCALL_ARG2(®s->regs), \
+ UPT_SYSCALL_ARG3(®s->regs), \
+ UPT_SYSCALL_ARG4(®s->regs), \
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index 5e3885f5729b0..c3e4f9d83b29a 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -195,7 +195,7 @@ void tl_release(struct drbd_connection *connection, unsigned int barrier_nr,
+ unsigned int set_size)
+ {
+ struct drbd_request *r;
+- struct drbd_request *req = NULL;
++ struct drbd_request *req = NULL, *tmp = NULL;
+ int expect_epoch = 0;
+ int expect_size = 0;
+
+@@ -249,8 +249,11 @@ void tl_release(struct drbd_connection *connection, unsigned int barrier_nr,
+ * to catch requests being barrier-acked "unexpectedly".
+ * It usually should find the same req again, or some READ preceding it. */
+ list_for_each_entry(req, &connection->transfer_log, tl_requests)
+- if (req->epoch == expect_epoch)
++ if (req->epoch == expect_epoch) {
++ tmp = req;
+ break;
++ }
++ req = list_prepare_entry(tmp, &connection->transfer_log, tl_requests);
+ list_for_each_entry_safe_from(req, r, &connection->transfer_log, tl_requests) {
+ if (req->epoch != expect_epoch)
+ break;
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 97c8fc4d6e7bd..0e66314415c52 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -520,8 +520,8 @@ static unsigned long fdc_busy;
+ static DECLARE_WAIT_QUEUE_HEAD(fdc_wait);
+ static DECLARE_WAIT_QUEUE_HEAD(command_done);
+
+-/* Errors during formatting are counted here. */
+-static int format_errors;
++/* errors encountered on the current (or last) request */
++static int floppy_errors;
+
+ /* Format request descriptor. */
+ static struct format_descr format_req;
+@@ -541,7 +541,6 @@ static struct format_descr format_req;
+ static char *floppy_track_buffer;
+ static int max_buffer_sectors;
+
+-static int *errors;
+ typedef void (*done_f)(int);
+ static const struct cont_t {
+ void (*interrupt)(void);
+@@ -1434,7 +1433,7 @@ static int interpret_errors(void)
+ if (DP->flags & FTD_MSG)
+ DPRINT("Over/Underrun - retrying\n");
+ bad = 0;
+- } else if (*errors >= DP->max_errors.reporting) {
++ } else if (floppy_errors >= DP->max_errors.reporting) {
+ print_errors();
+ }
+ if (ST2 & ST2_WC || ST2 & ST2_BC)
+@@ -2054,7 +2053,7 @@ static void bad_flp_intr(void)
+ if (!next_valid_format())
+ return;
+ }
+- err_count = ++(*errors);
++ err_count = ++floppy_errors;
+ INFBOUND(DRWE->badness, err_count);
+ if (err_count > DP->max_errors.abort)
+ cont->done(0);
+@@ -2199,9 +2198,8 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
+ return -EINVAL;
+ }
+ format_req = *tmp_format_req;
+- format_errors = 0;
+ cont = &format_cont;
+- errors = &format_errors;
++ floppy_errors = 0;
+ ret = wait_til_done(redo_format, true);
+ if (ret == -EINTR)
+ return -EINTR;
+@@ -2684,7 +2682,7 @@ static int make_raw_rw_request(void)
+ */
+ if (!direct ||
+ (indirect * 2 > direct * 3 &&
+- *errors < DP->max_errors.read_track &&
++ floppy_errors < DP->max_errors.read_track &&
+ ((!probing ||
+ (DP->read_track & (1 << DRS->probed_format)))))) {
+ max_size = blk_rq_sectors(current_req);
+@@ -2818,7 +2816,7 @@ static int set_next_request(void)
+ if (q) {
+ current_req = blk_fetch_request(q);
+ if (current_req) {
+- current_req->error_count = 0;
++ floppy_errors = 0;
+ break;
+ }
+ }
+@@ -2880,7 +2878,6 @@ do_request:
+ _floppy = floppy_type + DP->autodetect[DRS->probed_format];
+ } else
+ probing = 0;
+- errors = &(current_req->error_count);
+ tmp = make_raw_rw_request();
+ if (tmp < 2) {
+ request_done(tmp);
+diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c
+index ea23002be4de1..b397556c34d95 100644
+--- a/drivers/clk/at91/clk-generated.c
++++ b/drivers/clk/at91/clk-generated.c
+@@ -119,6 +119,10 @@ static void clk_generated_best_diff(struct clk_rate_request *req,
+ tmp_rate = parent_rate;
+ else
+ tmp_rate = parent_rate / div;
++
++ if (tmp_rate < req->min_rate || tmp_rate > req->max_rate)
++ return;
++
+ tmp_diff = abs(req->rate - tmp_rate);
+
+ if (*best_diff < 0 || *best_diff > tmp_diff) {
+diff --git a/drivers/crypto/qcom-rng.c b/drivers/crypto/qcom-rng.c
+index e41ca58bf7b6d..818e3e9479fe6 100644
+--- a/drivers/crypto/qcom-rng.c
++++ b/drivers/crypto/qcom-rng.c
+@@ -64,6 +64,7 @@ static int qcom_rng_read(struct qcom_rng *rng, u8 *data, unsigned int max)
+ } else {
+ /* copy only remaining bytes */
+ memcpy(data, &val, max - currsize);
++ break;
+ }
+ } while (currsize < max);
+
+diff --git a/drivers/crypto/stm32/stm32_crc32.c b/drivers/crypto/stm32/stm32_crc32.c
+index 6848f34a9e66a..de645bf84980b 100644
+--- a/drivers/crypto/stm32/stm32_crc32.c
++++ b/drivers/crypto/stm32/stm32_crc32.c
+@@ -334,8 +334,10 @@ static int stm32_crc_remove(struct platform_device *pdev)
+ struct stm32_crc *crc = platform_get_drvdata(pdev);
+ int ret = pm_runtime_get_sync(crc->dev);
+
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(crc->dev);
+ return ret;
++ }
+
+ spin_lock(&crc_list.lock);
+ list_del(&crc->list);
+diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
+index 874caed723905..199b96967ca20 100644
+--- a/drivers/gpio/gpio-mvebu.c
++++ b/drivers/gpio/gpio-mvebu.c
+@@ -690,6 +690,9 @@ static int mvebu_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ unsigned long flags;
+ unsigned int on, off;
+
++ if (state->polarity != PWM_POLARITY_NORMAL)
++ return -EINVAL;
++
+ val = (unsigned long long) mvpwm->clk_rate * state->duty_cycle;
+ do_div(val, NSEC_PER_SEC);
+ if (val > UINT_MAX)
+diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
+index a9cb5571de545..f7692999df475 100644
+--- a/drivers/gpio/gpio-vf610.c
++++ b/drivers/gpio/gpio-vf610.c
+@@ -135,9 +135,13 @@ static int vf610_gpio_direction_output(struct gpio_chip *chip, unsigned gpio,
+ {
+ struct vf610_gpio_port *port = gpiochip_get_data(chip);
+ unsigned long mask = BIT(gpio);
++ u32 val;
+
+- if (port->sdata && port->sdata->have_paddr)
+- vf610_gpio_writel(mask, port->gpio_base + GPIO_PDDR);
++ if (port->sdata && port->sdata->have_paddr) {
++ val = vf610_gpio_readl(port->gpio_base + GPIO_PDDR);
++ val |= mask;
++ vf610_gpio_writel(val, port->gpio_base + GPIO_PDDR);
++ }
+
+ vf610_gpio_set(chip, gpio, value);
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index c50fe915f5c84..603ebaa6a7edc 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2987,6 +2987,7 @@ static void fetch_monitor_name(struct drm_dp_mst_topology_mgr *mgr,
+
+ mst_edid = drm_dp_mst_get_edid(port->connector, mgr, port);
+ drm_edid_get_monitor_name(mst_edid, name, namelen);
++ kfree(mst_edid);
+ }
+
+ /**
+diff --git a/drivers/input/input.c b/drivers/input/input.c
+index a0d90022fcf73..dcbf53b5b2bc1 100644
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -50,6 +50,17 @@ static DEFINE_MUTEX(input_mutex);
+
+ static const struct input_value input_value_sync = { EV_SYN, SYN_REPORT, 1 };
+
++static const unsigned int input_max_code[EV_CNT] = {
++ [EV_KEY] = KEY_MAX,
++ [EV_REL] = REL_MAX,
++ [EV_ABS] = ABS_MAX,
++ [EV_MSC] = MSC_MAX,
++ [EV_SW] = SW_MAX,
++ [EV_LED] = LED_MAX,
++ [EV_SND] = SND_MAX,
++ [EV_FF] = FF_MAX,
++};
++
+ static inline int is_event_supported(unsigned int code,
+ unsigned long *bm, unsigned int max)
+ {
+@@ -1915,6 +1926,14 @@ EXPORT_SYMBOL(input_free_device);
+ */
+ void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int code)
+ {
++ if (type < EV_CNT && input_max_code[type] &&
++ code > input_max_code[type]) {
++ pr_err("%s: invalid code %u for type %u\n", __func__, code,
++ type);
++ dump_stack();
++ return;
++ }
++
+ switch (type) {
+ case EV_KEY:
+ __set_bit(code, dev->keybit);
+diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c
+index cd8805d71d977..be1dd504d5b1d 100644
+--- a/drivers/input/touchscreen/stmfts.c
++++ b/drivers/input/touchscreen/stmfts.c
+@@ -339,11 +339,11 @@ static int stmfts_input_open(struct input_dev *dev)
+
+ err = pm_runtime_get_sync(&sdata->client->dev);
+ if (err < 0)
+- return err;
++ goto out;
+
+ err = i2c_smbus_write_byte(sdata->client, STMFTS_MS_MT_SENSE_ON);
+ if (err)
+- return err;
++ goto out;
+
+ mutex_lock(&sdata->mutex);
+ sdata->running = true;
+@@ -366,7 +366,9 @@ static int stmfts_input_open(struct input_dev *dev)
+ "failed to enable touchkey\n");
+ }
+
+- return 0;
++out:
++ pm_runtime_put_noidle(&sdata->client->dev);
++ return err;
+ }
+
+ static void stmfts_input_close(struct input_dev *dev)
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 630f3bcba56dd..c6e83f6021c13 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1133,7 +1133,7 @@ static void mmc_blk_issue_discard_rq(struct mmc_queue *mq, struct request *req)
+ arg == MMC_TRIM_ARG ?
+ INAND_CMD38_ARG_TRIM :
+ INAND_CMD38_ARG_ERASE,
+- 0);
++ card->ext_csd.generic_cmd6_time);
+ }
+ if (!err)
+ err = mmc_erase(card, from, nr, arg);
+@@ -1175,7 +1175,7 @@ retry:
+ arg == MMC_SECURE_TRIM1_ARG ?
+ INAND_CMD38_ARG_SECTRIM1 :
+ INAND_CMD38_ARG_SECERASE,
+- 0);
++ card->ext_csd.generic_cmd6_time);
+ if (err)
+ goto out_retry;
+ }
+@@ -1193,7 +1193,7 @@ retry:
+ err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+ INAND_CMD38_ARG_EXT_CSD,
+ INAND_CMD38_ARG_SECTRIM2,
+- 0);
++ card->ext_csd.generic_cmd6_time);
+ if (err)
+ goto out_retry;
+ }
+@@ -1944,7 +1944,7 @@ static void mmc_blk_urgent_bkops(struct mmc_queue *mq,
+ struct mmc_queue_req *mqrq)
+ {
+ if (mmc_blk_urgent_bkops_needed(mq, mqrq))
+- mmc_start_bkops(mq->card, true);
++ mmc_run_bkops(mq->card);
+ }
+
+ void mmc_blk_mq_complete(struct request *req)
+diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
+index 1170feb8f9698..eef3014524063 100644
+--- a/drivers/mmc/core/card.h
++++ b/drivers/mmc/core/card.h
+@@ -23,15 +23,13 @@
+ #define MMC_STATE_BLOCKADDR (1<<2) /* card uses block-addressing */
+ #define MMC_CARD_SDXC (1<<3) /* card is SDXC */
+ #define MMC_CARD_REMOVED (1<<4) /* card has been removed */
+-#define MMC_STATE_DOING_BKOPS (1<<5) /* card is doing BKOPS */
+-#define MMC_STATE_SUSPENDED (1<<6) /* card is suspended */
++#define MMC_STATE_SUSPENDED (1<<5) /* card is suspended */
+
+ #define mmc_card_present(c) ((c)->state & MMC_STATE_PRESENT)
+ #define mmc_card_readonly(c) ((c)->state & MMC_STATE_READONLY)
+ #define mmc_card_blockaddr(c) ((c)->state & MMC_STATE_BLOCKADDR)
+ #define mmc_card_ext_capacity(c) ((c)->state & MMC_CARD_SDXC)
+ #define mmc_card_removed(c) ((c) && ((c)->state & MMC_CARD_REMOVED))
+-#define mmc_card_doing_bkops(c) ((c)->state & MMC_STATE_DOING_BKOPS)
+ #define mmc_card_suspended(c) ((c)->state & MMC_STATE_SUSPENDED)
+
+ #define mmc_card_set_present(c) ((c)->state |= MMC_STATE_PRESENT)
+@@ -39,8 +37,6 @@
+ #define mmc_card_set_blockaddr(c) ((c)->state |= MMC_STATE_BLOCKADDR)
+ #define mmc_card_set_ext_capacity(c) ((c)->state |= MMC_CARD_SDXC)
+ #define mmc_card_set_removed(c) ((c)->state |= MMC_CARD_REMOVED)
+-#define mmc_card_set_doing_bkops(c) ((c)->state |= MMC_STATE_DOING_BKOPS)
+-#define mmc_card_clr_doing_bkops(c) ((c)->state &= ~MMC_STATE_DOING_BKOPS)
+ #define mmc_card_set_suspended(c) ((c)->state |= MMC_STATE_SUSPENDED)
+ #define mmc_card_clr_suspended(c) ((c)->state &= ~MMC_STATE_SUSPENDED)
+
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index d9202f2726d1a..745a4b07faffc 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -2026,12 +2026,6 @@ static int _mmc_suspend(struct mmc_host *host, bool is_suspend)
+ if (mmc_card_suspended(host->card))
+ goto out;
+
+- if (mmc_card_doing_bkops(host->card)) {
+- err = mmc_stop_bkops(host->card);
+- if (err)
+- goto out;
+- }
+-
+ err = mmc_flush_cache(host->card);
+ if (err)
+ goto out;
+diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
+index 334678707deb7..c2187fc6dcbae 100644
+--- a/drivers/mmc/core/mmc_ops.c
++++ b/drivers/mmc/core/mmc_ops.c
+@@ -23,7 +23,9 @@
+ #include "host.h"
+ #include "mmc_ops.h"
+
+-#define MMC_OPS_TIMEOUT_MS (10 * 60 * 1000) /* 10 minute timeout */
++#define MMC_OPS_TIMEOUT_MS (10 * 60 * 1000) /* 10min*/
++#define MMC_BKOPS_TIMEOUT_MS (120 * 1000) /* 120s */
++#define MMC_CACHE_FLUSH_TIMEOUT_MS (30 * 1000) /* 30s */
+
+ static const u8 tuning_blk_pattern_4bit[] = {
+ 0xff, 0x0f, 0xff, 0x00, 0xff, 0xcc, 0xc3, 0xcc,
+@@ -456,10 +458,6 @@ static int mmc_poll_for_busy(struct mmc_card *card, unsigned int timeout_ms,
+ bool expired = false;
+ bool busy = false;
+
+- /* We have an unspecified cmd timeout, use the fallback value. */
+- if (!timeout_ms)
+- timeout_ms = MMC_OPS_TIMEOUT_MS;
+-
+ /*
+ * In cases when not allowed to poll by using CMD13 or because we aren't
+ * capable of polling by using ->card_busy(), then rely on waiting the
+@@ -532,6 +530,12 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
+
+ mmc_retune_hold(host);
+
++ if (!timeout_ms) {
++ pr_warn("%s: unspecified timeout for CMD6 - use generic\n",
++ mmc_hostname(host));
++ timeout_ms = card->ext_csd.generic_cmd6_time;
++ }
++
+ /*
+ * If the cmd timeout and the max_busy_timeout of the host are both
+ * specified, let's validate them. A failure means we need to prevent
+@@ -540,7 +544,7 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
+ * which also means they are on their own when it comes to deal with the
+ * busy timeout.
+ */
+- if (!(host->caps & MMC_CAP_NEED_RSP_BUSY) && timeout_ms &&
++ if (!(host->caps & MMC_CAP_NEED_RSP_BUSY) &&
+ host->max_busy_timeout && (timeout_ms > host->max_busy_timeout))
+ use_r1b_resp = false;
+
+@@ -552,10 +556,6 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
+ cmd.flags = MMC_CMD_AC;
+ if (use_r1b_resp) {
+ cmd.flags |= MMC_RSP_SPI_R1B | MMC_RSP_R1B;
+- /*
+- * A busy_timeout of zero means the host can decide to use
+- * whatever value it finds suitable.
+- */
+ cmd.busy_timeout = timeout_ms;
+ } else {
+ cmd.flags |= MMC_RSP_SPI_R1 | MMC_RSP_R1;
+@@ -899,34 +899,6 @@ int mmc_can_ext_csd(struct mmc_card *card)
+ return (card && card->csd.mmca_vsn > CSD_SPEC_VER_3);
+ }
+
+-/**
+- * mmc_stop_bkops - stop ongoing BKOPS
+- * @card: MMC card to check BKOPS
+- *
+- * Send HPI command to stop ongoing background operations to
+- * allow rapid servicing of foreground operations, e.g. read/
+- * writes. Wait until the card comes out of the programming state
+- * to avoid errors in servicing read/write requests.
+- */
+-int mmc_stop_bkops(struct mmc_card *card)
+-{
+- int err = 0;
+-
+- err = mmc_interrupt_hpi(card);
+-
+- /*
+- * If err is EINVAL, we can't issue an HPI.
+- * It should complete the BKOPS.
+- */
+- if (!err || (err == -EINVAL)) {
+- mmc_card_clr_doing_bkops(card);
+- mmc_retune_release(card->host);
+- err = 0;
+- }
+-
+- return err;
+-}
+-
+ static int mmc_read_bkops_status(struct mmc_card *card)
+ {
+ int err;
+@@ -943,22 +915,17 @@ static int mmc_read_bkops_status(struct mmc_card *card)
+ }
+
+ /**
+- * mmc_start_bkops - start BKOPS for supported cards
+- * @card: MMC card to start BKOPS
+- * @from_exception: A flag to indicate if this function was
+- * called due to an exception raised by the card
++ * mmc_run_bkops - Run BKOPS for supported cards
++ * @card: MMC card to run BKOPS for
+ *
+- * Start background operations whenever requested.
+- * When the urgent BKOPS bit is set in a R1 command response
+- * then background operations should be started immediately.
++ * Run background operations synchronously for cards having manual BKOPS
++ * enabled and in case it reports urgent BKOPS level.
+ */
+-void mmc_start_bkops(struct mmc_card *card, bool from_exception)
++void mmc_run_bkops(struct mmc_card *card)
+ {
+ int err;
+- int timeout;
+- bool use_busy_signal;
+
+- if (!card->ext_csd.man_bkops_en || mmc_card_doing_bkops(card))
++ if (!card->ext_csd.man_bkops_en)
+ return;
+
+ err = mmc_read_bkops_status(card);
+@@ -968,44 +935,26 @@ void mmc_start_bkops(struct mmc_card *card, bool from_exception)
+ return;
+ }
+
+- if (!card->ext_csd.raw_bkops_status)
++ if (!card->ext_csd.raw_bkops_status ||
++ card->ext_csd.raw_bkops_status < EXT_CSD_BKOPS_LEVEL_2)
+ return;
+
+- if (card->ext_csd.raw_bkops_status < EXT_CSD_BKOPS_LEVEL_2 &&
+- from_exception)
+- return;
+-
+- if (card->ext_csd.raw_bkops_status >= EXT_CSD_BKOPS_LEVEL_2) {
+- timeout = MMC_OPS_TIMEOUT_MS;
+- use_busy_signal = true;
+- } else {
+- timeout = 0;
+- use_busy_signal = false;
+- }
+-
+ mmc_retune_hold(card->host);
+
+- err = __mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+- EXT_CSD_BKOPS_START, 1, timeout, 0,
+- use_busy_signal, true, false);
+- if (err) {
++ /*
++ * For urgent BKOPS status, LEVEL_2 and higher, let's execute
++ * synchronously. Future wise, we may consider to start BKOPS, for less
++ * urgent levels by using an asynchronous background task, when idle.
++ */
++ err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
++ EXT_CSD_BKOPS_START, 1, MMC_BKOPS_TIMEOUT_MS);
++ if (err)
+ pr_warn("%s: Error %d starting bkops\n",
+ mmc_hostname(card->host), err);
+- mmc_retune_release(card->host);
+- return;
+- }
+
+- /*
+- * For urgent bkops status (LEVEL_2 and more)
+- * bkops executed synchronously, otherwise
+- * the operation is in progress
+- */
+- if (!use_busy_signal)
+- mmc_card_set_doing_bkops(card);
+- else
+- mmc_retune_release(card->host);
++ mmc_retune_release(card->host);
+ }
+-EXPORT_SYMBOL(mmc_start_bkops);
++EXPORT_SYMBOL(mmc_run_bkops);
+
+ /*
+ * Flush the cache to the non-volatile storage.
+@@ -1016,7 +965,8 @@ int mmc_flush_cache(struct mmc_card *card)
+
+ if (mmc_cache_enabled(card->host)) {
+ err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+- EXT_CSD_FLUSH_CACHE, 1, 0);
++ EXT_CSD_FLUSH_CACHE, 1,
++ MMC_CACHE_FLUSH_TIMEOUT_MS);
+ if (err)
+ pr_err("%s: cache flush error %d\n",
+ mmc_hostname(card->host), err);
+diff --git a/drivers/mmc/core/mmc_ops.h b/drivers/mmc/core/mmc_ops.h
+index a1390d4863815..018a5e3f66d6f 100644
+--- a/drivers/mmc/core/mmc_ops.h
++++ b/drivers/mmc/core/mmc_ops.h
+@@ -40,8 +40,7 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
+ bool use_busy_signal, bool send_status, bool retry_crc_err);
+ int mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
+ unsigned int timeout_ms);
+-int mmc_stop_bkops(struct mmc_card *card);
+-void mmc_start_bkops(struct mmc_card *card, bool from_exception);
++void mmc_run_bkops(struct mmc_card *card);
+ int mmc_flush_cache(struct mmc_card *card);
+ int mmc_cmdq_enable(struct mmc_card *card);
+ int mmc_cmdq_disable(struct mmc_card *card);
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index c4f914a29c385..bdb0b37c048a8 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -637,6 +637,13 @@ static int hw_atl_b0_hw_ring_tx_head_update(struct aq_hw_s *self,
+ err = -ENXIO;
+ goto err_exit;
+ }
++
++ /* Validate that the new hw_head_ is reasonable. */
++ if (hw_head_ >= ring->size) {
++ err = -ENXIO;
++ goto err_exit;
++ }
++
+ ring->hw_head = hw_head_;
+ err = aq_hw_err_from_flags(self);
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index d8e4842af055b..50331b202f73b 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -915,7 +915,6 @@ static void gem_rx_refill(struct macb_queue *queue)
+ /* Make hw descriptor updates visible to CPU */
+ rmb();
+
+- queue->rx_prepared_head++;
+ desc = macb_rx_desc(queue, entry);
+
+ if (!queue->rx_skbuff[entry]) {
+@@ -954,6 +953,7 @@ static void gem_rx_refill(struct macb_queue *queue)
+ dma_wmb();
+ desc->addr &= ~MACB_BIT(RX_USED);
+ }
++ queue->rx_prepared_head++;
+ }
+
+ /* Make descriptor updates visible to hardware */
+diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
+index 3e3e08698876b..fea4223ad6f15 100644
+--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
++++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
+@@ -1410,8 +1410,10 @@ static int tulip_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ /* alloc_etherdev ensures aligned and zeroed private structures */
+ dev = alloc_etherdev (sizeof (*tp));
+- if (!dev)
++ if (!dev) {
++ pci_disable_device(pdev);
+ return -ENOMEM;
++ }
+
+ SET_NETDEV_DEV(dev, &pdev->dev);
+ if (pci_resource_len (pdev, 0) < tulip_tbl[chip_idx].io_size) {
+@@ -1788,6 +1790,7 @@ err_out_free_res:
+
+ err_out_free_netdev:
+ free_netdev (dev);
++ pci_disable_device(pdev);
+ return -ENODEV;
+ }
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 74b50f17832d1..a93edd31011f5 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -5346,7 +5346,8 @@ static void igb_watchdog_task(struct work_struct *work)
+ break;
+ }
+
+- if (adapter->link_speed != SPEED_1000)
++ if (adapter->link_speed != SPEED_1000 ||
++ !hw->phy.ops.read_reg)
+ goto no_wait;
+
+ /* wait for Remote receiver status OK */
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 5979fcf124bb4..75872aef44d02 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3739,6 +3739,13 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev,
+ netdev_warn(netdev, "Disabling LRO, not supported in legacy RQ\n");
+ }
+
++ if (params->xdp_prog) {
++ if (features & NETIF_F_LRO) {
++ netdev_warn(netdev, "LRO is incompatible with XDP\n");
++ features &= ~NETIF_F_LRO;
++ }
++ }
++
+ if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS)) {
+ features &= ~NETIF_F_RXHASH;
+ if (netdev->features & NETIF_F_RXHASH)
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
+index f38dda1d92e2b..51e17a635d4b5 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -3630,7 +3630,8 @@ static void ql_reset_work(struct work_struct *work)
+ qdev->mem_map_registers;
+ unsigned long hw_flags;
+
+- if (test_bit((QL_RESET_PER_SCSI | QL_RESET_START), &qdev->flags)) {
++ if (test_bit(QL_RESET_PER_SCSI, &qdev->flags) ||
++ test_bit(QL_RESET_START, &qdev->flags)) {
+ clear_bit(QL_LINK_MASTER, &qdev->flags);
+
+ /*
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+index cc1e887e47b50..3dec109251ad9 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+@@ -261,7 +261,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
+ return -ENOMEM;
+
+ /* Enable pci device */
+- ret = pci_enable_device(pdev);
++ ret = pcim_enable_device(pdev);
+ if (ret) {
+ dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n",
+ __func__);
+@@ -313,8 +313,6 @@ static void stmmac_pci_remove(struct pci_dev *pdev)
+ pcim_iounmap_regions(pdev, BIT(i));
+ break;
+ }
+-
+- pci_disable_device(pdev);
+ }
+
+ static int __maybe_unused stmmac_pci_suspend(struct device *dev)
+diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
+index c004819bebe35..a57ea3914968a 100644
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -595,6 +595,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx,
+ if (dma_mapping_error(&adapter->pdev->dev,
+ rbi->dma_addr)) {
+ dev_kfree_skb_any(rbi->skb);
++ rbi->skb = NULL;
+ rq->stats.rx_buf_alloc_failure++;
+ break;
+ }
+@@ -619,6 +620,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx,
+ if (dma_mapping_error(&adapter->pdev->dev,
+ rbi->dma_addr)) {
+ put_page(rbi->page);
++ rbi->page = NULL;
+ rq->stats.rx_buf_alloc_failure++;
+ break;
+ }
+@@ -1584,6 +1586,10 @@ vmxnet3_rq_cleanup(struct vmxnet3_rx_queue *rq,
+ u32 i, ring_idx;
+ struct Vmxnet3_RxDesc *rxd;
+
++ /* ring has already been cleaned up */
++ if (!rq->rx_ring[0].base)
++ return;
++
+ for (ring_idx = 0; ring_idx < 2; ring_idx++) {
+ for (i = 0; i < rq->rx_ring[ring_idx].size; i++) {
+ #ifdef __BIG_ENDIAN_BITFIELD
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 97d69b9be1d49..293b3e3b0083b 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2517,6 +2517,16 @@ static const struct dmi_system_id bridge_d3_blacklist[] = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co., Ltd."),
+ DMI_MATCH(DMI_BOARD_NAME, "X299 DESIGNARE EX-CF"),
+ },
++ /*
++ * Downstream device is not accessible after putting a root port
++ * into D3cold and back into D0 on Elo i2.
++ */
++ .ident = "Elo i2",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Elo Touch Solutions"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Elo i2"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "RevB"),
++ },
+ },
+ #endif
+ { }
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 09c52ef66887a..27d3293eadf53 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -3753,6 +3753,9 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd)
+
+ spin_lock_irqsave(&cmd->cmd_lock, flags);
+ if (cmd->aborted) {
++ if (cmd->sg_mapped)
++ qlt_unmap_sg(vha, cmd);
++
+ spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+ /*
+ * It's normal to see 2 calls in this path:
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index 0c7bbc92b22a9..5ea7b0a94fe38 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -1209,13 +1209,9 @@ err:
+ return ERR_PTR(r);
+ }
+
+-static struct ptr_ring *get_tap_ptr_ring(int fd)
++static struct ptr_ring *get_tap_ptr_ring(struct file *file)
+ {
+ struct ptr_ring *ring;
+- struct file *file = fget(fd);
+-
+- if (!file)
+- return NULL;
+ ring = tun_get_tx_ring(file);
+ if (!IS_ERR(ring))
+ goto out;
+@@ -1224,7 +1220,6 @@ static struct ptr_ring *get_tap_ptr_ring(int fd)
+ goto out;
+ ring = NULL;
+ out:
+- fput(file);
+ return ring;
+ }
+
+@@ -1311,8 +1306,12 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
+ r = vhost_net_enable_vq(n, vq);
+ if (r)
+ goto err_used;
+- if (index == VHOST_NET_VQ_RX)
+- nvq->rx_ring = get_tap_ptr_ring(fd);
++ if (index == VHOST_NET_VQ_RX) {
++ if (sock)
++ nvq->rx_ring = get_tap_ptr_ring(sock->file);
++ else
++ nvq->rx_ring = NULL;
++ }
+
+ oldubufs = nvq->ubufs;
+ nvq->ubufs = ubufs;
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index e6f11da5461be..a12ae3ef8fb44 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -468,10 +468,22 @@ int afs_getattr(const struct path *path, struct kstat *stat,
+ {
+ struct inode *inode = d_inode(path->dentry);
+ struct afs_vnode *vnode = AFS_FS_I(inode);
+- int seq = 0;
++ struct key *key;
++ int ret, seq = 0;
+
+ _enter("{ ino=%lu v=%u }", inode->i_ino, inode->i_generation);
+
++ if (!(query_flags & AT_STATX_DONT_SYNC) &&
++ !test_bit(AFS_VNODE_CB_PROMISED, &vnode->flags)) {
++ key = afs_request_key(vnode->volume->cell);
++ if (IS_ERR(key))
++ return PTR_ERR(key);
++ ret = afs_validate(vnode, key);
++ key_put(key);
++ if (ret < 0)
++ return ret;
++ }
++
+ do {
+ read_seqbegin_or_lock(&vnode->cb_lock, &seq);
+ generic_fillattr(inode, stat);
+diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
+index ebb24a314f431..138ebbb7a1eef 100644
+--- a/fs/nilfs2/btnode.c
++++ b/fs/nilfs2/btnode.c
+@@ -20,6 +20,23 @@
+ #include "page.h"
+ #include "btnode.h"
+
++
++/**
++ * nilfs_init_btnc_inode - initialize B-tree node cache inode
++ * @btnc_inode: inode to be initialized
++ *
++ * nilfs_init_btnc_inode() sets up an inode for B-tree node cache.
++ */
++void nilfs_init_btnc_inode(struct inode *btnc_inode)
++{
++ struct nilfs_inode_info *ii = NILFS_I(btnc_inode);
++
++ btnc_inode->i_mode = S_IFREG;
++ ii->i_flags = 0;
++ memset(&ii->i_bmap_data, 0, sizeof(struct nilfs_bmap));
++ mapping_set_gfp_mask(btnc_inode->i_mapping, GFP_NOFS);
++}
++
+ void nilfs_btnode_cache_clear(struct address_space *btnc)
+ {
+ invalidate_mapping_pages(btnc, 0, -1);
+@@ -29,7 +46,7 @@ void nilfs_btnode_cache_clear(struct address_space *btnc)
+ struct buffer_head *
+ nilfs_btnode_create_block(struct address_space *btnc, __u64 blocknr)
+ {
+- struct inode *inode = NILFS_BTNC_I(btnc);
++ struct inode *inode = btnc->host;
+ struct buffer_head *bh;
+
+ bh = nilfs_grab_buffer(inode, btnc, blocknr, BIT(BH_NILFS_Node));
+@@ -57,7 +74,7 @@ int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,
+ struct buffer_head **pbh, sector_t *submit_ptr)
+ {
+ struct buffer_head *bh;
+- struct inode *inode = NILFS_BTNC_I(btnc);
++ struct inode *inode = btnc->host;
+ struct page *page;
+ int err;
+
+@@ -157,7 +174,7 @@ int nilfs_btnode_prepare_change_key(struct address_space *btnc,
+ struct nilfs_btnode_chkey_ctxt *ctxt)
+ {
+ struct buffer_head *obh, *nbh;
+- struct inode *inode = NILFS_BTNC_I(btnc);
++ struct inode *inode = btnc->host;
+ __u64 oldkey = ctxt->oldkey, newkey = ctxt->newkey;
+ int err;
+
+diff --git a/fs/nilfs2/btnode.h b/fs/nilfs2/btnode.h
+index 0f88dbc9bcb3e..05ab64d354dc9 100644
+--- a/fs/nilfs2/btnode.h
++++ b/fs/nilfs2/btnode.h
+@@ -30,6 +30,7 @@ struct nilfs_btnode_chkey_ctxt {
+ struct buffer_head *newbh;
+ };
+
++void nilfs_init_btnc_inode(struct inode *btnc_inode);
+ void nilfs_btnode_cache_clear(struct address_space *);
+ struct buffer_head *nilfs_btnode_create_block(struct address_space *btnc,
+ __u64 blocknr);
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index 23e043eca237b..919d1238ce45f 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -58,7 +58,8 @@ static void nilfs_btree_free_path(struct nilfs_btree_path *path)
+ static int nilfs_btree_get_new_block(const struct nilfs_bmap *btree,
+ __u64 ptr, struct buffer_head **bhp)
+ {
+- struct address_space *btnc = &NILFS_BMAP_I(btree)->i_btnode_cache;
++ struct inode *btnc_inode = NILFS_BMAP_I(btree)->i_assoc_inode;
++ struct address_space *btnc = btnc_inode->i_mapping;
+ struct buffer_head *bh;
+
+ bh = nilfs_btnode_create_block(btnc, ptr);
+@@ -470,7 +471,8 @@ static int __nilfs_btree_get_block(const struct nilfs_bmap *btree, __u64 ptr,
+ struct buffer_head **bhp,
+ const struct nilfs_btree_readahead_info *ra)
+ {
+- struct address_space *btnc = &NILFS_BMAP_I(btree)->i_btnode_cache;
++ struct inode *btnc_inode = NILFS_BMAP_I(btree)->i_assoc_inode;
++ struct address_space *btnc = btnc_inode->i_mapping;
+ struct buffer_head *bh, *ra_bh;
+ sector_t submit_ptr = 0;
+ int ret;
+@@ -1742,6 +1744,10 @@ nilfs_btree_prepare_convert_and_insert(struct nilfs_bmap *btree, __u64 key,
+ dat = nilfs_bmap_get_dat(btree);
+ }
+
++ ret = nilfs_attach_btree_node_cache(&NILFS_BMAP_I(btree)->vfs_inode);
++ if (ret < 0)
++ return ret;
++
+ ret = nilfs_bmap_prepare_alloc_ptr(btree, dreq, dat);
+ if (ret < 0)
+ return ret;
+@@ -1914,7 +1920,7 @@ static int nilfs_btree_prepare_update_v(struct nilfs_bmap *btree,
+ path[level].bp_ctxt.newkey = path[level].bp_newreq.bpr_ptr;
+ path[level].bp_ctxt.bh = path[level].bp_bh;
+ ret = nilfs_btnode_prepare_change_key(
+- &NILFS_BMAP_I(btree)->i_btnode_cache,
++ NILFS_BMAP_I(btree)->i_assoc_inode->i_mapping,
+ &path[level].bp_ctxt);
+ if (ret < 0) {
+ nilfs_dat_abort_update(dat,
+@@ -1940,7 +1946,7 @@ static void nilfs_btree_commit_update_v(struct nilfs_bmap *btree,
+
+ if (buffer_nilfs_node(path[level].bp_bh)) {
+ nilfs_btnode_commit_change_key(
+- &NILFS_BMAP_I(btree)->i_btnode_cache,
++ NILFS_BMAP_I(btree)->i_assoc_inode->i_mapping,
+ &path[level].bp_ctxt);
+ path[level].bp_bh = path[level].bp_ctxt.bh;
+ }
+@@ -1959,7 +1965,7 @@ static void nilfs_btree_abort_update_v(struct nilfs_bmap *btree,
+ &path[level].bp_newreq.bpr_req);
+ if (buffer_nilfs_node(path[level].bp_bh))
+ nilfs_btnode_abort_change_key(
+- &NILFS_BMAP_I(btree)->i_btnode_cache,
++ NILFS_BMAP_I(btree)->i_assoc_inode->i_mapping,
+ &path[level].bp_ctxt);
+ }
+
+@@ -2135,7 +2141,8 @@ static void nilfs_btree_add_dirty_buffer(struct nilfs_bmap *btree,
+ static void nilfs_btree_lookup_dirty_buffers(struct nilfs_bmap *btree,
+ struct list_head *listp)
+ {
+- struct address_space *btcache = &NILFS_BMAP_I(btree)->i_btnode_cache;
++ struct inode *btnc_inode = NILFS_BMAP_I(btree)->i_assoc_inode;
++ struct address_space *btcache = btnc_inode->i_mapping;
+ struct list_head lists[NILFS_BTREE_LEVEL_MAX];
+ struct pagevec pvec;
+ struct buffer_head *bh, *head;
+@@ -2189,12 +2196,12 @@ static int nilfs_btree_assign_p(struct nilfs_bmap *btree,
+ path[level].bp_ctxt.newkey = blocknr;
+ path[level].bp_ctxt.bh = *bh;
+ ret = nilfs_btnode_prepare_change_key(
+- &NILFS_BMAP_I(btree)->i_btnode_cache,
++ NILFS_BMAP_I(btree)->i_assoc_inode->i_mapping,
+ &path[level].bp_ctxt);
+ if (ret < 0)
+ return ret;
+ nilfs_btnode_commit_change_key(
+- &NILFS_BMAP_I(btree)->i_btnode_cache,
++ NILFS_BMAP_I(btree)->i_assoc_inode->i_mapping,
+ &path[level].bp_ctxt);
+ *bh = path[level].bp_ctxt.bh;
+ }
+@@ -2399,6 +2406,10 @@ int nilfs_btree_init(struct nilfs_bmap *bmap)
+
+ if (nilfs_btree_root_broken(nilfs_btree_get_root(bmap), bmap->b_inode))
+ ret = -EIO;
++ else
++ ret = nilfs_attach_btree_node_cache(
++ &NILFS_BMAP_I(bmap)->vfs_inode);
++
+ return ret;
+ }
+
+diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
+index 6f4066636be9a..a3523a243e113 100644
+--- a/fs/nilfs2/dat.c
++++ b/fs/nilfs2/dat.c
+@@ -497,7 +497,9 @@ int nilfs_dat_read(struct super_block *sb, size_t entry_size,
+ di = NILFS_DAT_I(dat);
+ lockdep_set_class(&di->mi.mi_sem, &dat_lock_key);
+ nilfs_palloc_setup_cache(dat, &di->palloc_cache);
+- nilfs_mdt_setup_shadow_map(dat, &di->shadow);
++ err = nilfs_mdt_setup_shadow_map(dat, &di->shadow);
++ if (err)
++ goto failed;
+
+ err = nilfs_read_inode_common(dat, raw_inode);
+ if (err)
+diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c
+index aa3c328ee189c..114774ac2185a 100644
+--- a/fs/nilfs2/gcinode.c
++++ b/fs/nilfs2/gcinode.c
+@@ -126,9 +126,10 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff,
+ int nilfs_gccache_submit_read_node(struct inode *inode, sector_t pbn,
+ __u64 vbn, struct buffer_head **out_bh)
+ {
++ struct inode *btnc_inode = NILFS_I(inode)->i_assoc_inode;
+ int ret;
+
+- ret = nilfs_btnode_submit_block(&NILFS_I(inode)->i_btnode_cache,
++ ret = nilfs_btnode_submit_block(btnc_inode->i_mapping,
+ vbn ? : pbn, pbn, REQ_OP_READ, 0,
+ out_bh, &pbn);
+ if (ret == -EEXIST) /* internal code (cache hit) */
+@@ -170,7 +171,7 @@ int nilfs_init_gcinode(struct inode *inode)
+ ii->i_flags = 0;
+ nilfs_bmap_init_gc(ii->i_bmap);
+
+- return 0;
++ return nilfs_attach_btree_node_cache(inode);
+ }
+
+ /**
+@@ -185,7 +186,7 @@ void nilfs_remove_all_gcinodes(struct the_nilfs *nilfs)
+ ii = list_first_entry(head, struct nilfs_inode_info, i_dirty);
+ list_del_init(&ii->i_dirty);
+ truncate_inode_pages(&ii->vfs_inode.i_data, 0);
+- nilfs_btnode_cache_clear(&ii->i_btnode_cache);
++ nilfs_btnode_cache_clear(ii->i_assoc_inode->i_mapping);
+ iput(&ii->vfs_inode);
+ }
+ }
+diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
+index 671085512e0fd..35b0bfe9324f2 100644
+--- a/fs/nilfs2/inode.c
++++ b/fs/nilfs2/inode.c
+@@ -28,12 +28,16 @@
+ * @cno: checkpoint number
+ * @root: pointer on NILFS root object (mounted checkpoint)
+ * @for_gc: inode for GC flag
++ * @for_btnc: inode for B-tree node cache flag
++ * @for_shadow: inode for shadowed page cache flag
+ */
+ struct nilfs_iget_args {
+ u64 ino;
+ __u64 cno;
+ struct nilfs_root *root;
+- int for_gc;
++ bool for_gc;
++ bool for_btnc;
++ bool for_shadow;
+ };
+
+ static int nilfs_iget_test(struct inode *inode, void *opaque);
+@@ -322,7 +326,8 @@ static int nilfs_insert_inode_locked(struct inode *inode,
+ unsigned long ino)
+ {
+ struct nilfs_iget_args args = {
+- .ino = ino, .root = root, .cno = 0, .for_gc = 0
++ .ino = ino, .root = root, .cno = 0, .for_gc = false,
++ .for_btnc = false, .for_shadow = false
+ };
+
+ return insert_inode_locked4(inode, ino, nilfs_iget_test, &args);
+@@ -534,6 +539,19 @@ static int nilfs_iget_test(struct inode *inode, void *opaque)
+ return 0;
+
+ ii = NILFS_I(inode);
++ if (test_bit(NILFS_I_BTNC, &ii->i_state)) {
++ if (!args->for_btnc)
++ return 0;
++ } else if (args->for_btnc) {
++ return 0;
++ }
++ if (test_bit(NILFS_I_SHADOW, &ii->i_state)) {
++ if (!args->for_shadow)
++ return 0;
++ } else if (args->for_shadow) {
++ return 0;
++ }
++
+ if (!test_bit(NILFS_I_GCINODE, &ii->i_state))
+ return !args->for_gc;
+
+@@ -545,15 +563,17 @@ static int nilfs_iget_set(struct inode *inode, void *opaque)
+ struct nilfs_iget_args *args = opaque;
+
+ inode->i_ino = args->ino;
+- if (args->for_gc) {
++ NILFS_I(inode)->i_cno = args->cno;
++ NILFS_I(inode)->i_root = args->root;
++ if (args->root && args->ino == NILFS_ROOT_INO)
++ nilfs_get_root(args->root);
++
++ if (args->for_gc)
+ NILFS_I(inode)->i_state = BIT(NILFS_I_GCINODE);
+- NILFS_I(inode)->i_cno = args->cno;
+- NILFS_I(inode)->i_root = NULL;
+- } else {
+- if (args->root && args->ino == NILFS_ROOT_INO)
+- nilfs_get_root(args->root);
+- NILFS_I(inode)->i_root = args->root;
+- }
++ if (args->for_btnc)
++ NILFS_I(inode)->i_state |= BIT(NILFS_I_BTNC);
++ if (args->for_shadow)
++ NILFS_I(inode)->i_state |= BIT(NILFS_I_SHADOW);
+ return 0;
+ }
+
+@@ -561,7 +581,8 @@ struct inode *nilfs_ilookup(struct super_block *sb, struct nilfs_root *root,
+ unsigned long ino)
+ {
+ struct nilfs_iget_args args = {
+- .ino = ino, .root = root, .cno = 0, .for_gc = 0
++ .ino = ino, .root = root, .cno = 0, .for_gc = false,
++ .for_btnc = false, .for_shadow = false
+ };
+
+ return ilookup5(sb, ino, nilfs_iget_test, &args);
+@@ -571,7 +592,8 @@ struct inode *nilfs_iget_locked(struct super_block *sb, struct nilfs_root *root,
+ unsigned long ino)
+ {
+ struct nilfs_iget_args args = {
+- .ino = ino, .root = root, .cno = 0, .for_gc = 0
++ .ino = ino, .root = root, .cno = 0, .for_gc = false,
++ .for_btnc = false, .for_shadow = false
+ };
+
+ return iget5_locked(sb, ino, nilfs_iget_test, nilfs_iget_set, &args);
+@@ -602,7 +624,8 @@ struct inode *nilfs_iget_for_gc(struct super_block *sb, unsigned long ino,
+ __u64 cno)
+ {
+ struct nilfs_iget_args args = {
+- .ino = ino, .root = NULL, .cno = cno, .for_gc = 1
++ .ino = ino, .root = NULL, .cno = cno, .for_gc = true,
++ .for_btnc = false, .for_shadow = false
+ };
+ struct inode *inode;
+ int err;
+@@ -622,6 +645,113 @@ struct inode *nilfs_iget_for_gc(struct super_block *sb, unsigned long ino,
+ return inode;
+ }
+
++/**
++ * nilfs_attach_btree_node_cache - attach a B-tree node cache to the inode
++ * @inode: inode object
++ *
++ * nilfs_attach_btree_node_cache() attaches a B-tree node cache to @inode,
++ * or does nothing if the inode already has it. This function allocates
++ * an additional inode to maintain page cache of B-tree nodes one-on-one.
++ *
++ * Return Value: On success, 0 is returned. On errors, one of the following
++ * negative error code is returned.
++ *
++ * %-ENOMEM - Insufficient memory available.
++ */
++int nilfs_attach_btree_node_cache(struct inode *inode)
++{
++ struct nilfs_inode_info *ii = NILFS_I(inode);
++ struct inode *btnc_inode;
++ struct nilfs_iget_args args;
++
++ if (ii->i_assoc_inode)
++ return 0;
++
++ args.ino = inode->i_ino;
++ args.root = ii->i_root;
++ args.cno = ii->i_cno;
++ args.for_gc = test_bit(NILFS_I_GCINODE, &ii->i_state) != 0;
++ args.for_btnc = true;
++ args.for_shadow = test_bit(NILFS_I_SHADOW, &ii->i_state) != 0;
++
++ btnc_inode = iget5_locked(inode->i_sb, inode->i_ino, nilfs_iget_test,
++ nilfs_iget_set, &args);
++ if (unlikely(!btnc_inode))
++ return -ENOMEM;
++ if (btnc_inode->i_state & I_NEW) {
++ nilfs_init_btnc_inode(btnc_inode);
++ unlock_new_inode(btnc_inode);
++ }
++ NILFS_I(btnc_inode)->i_assoc_inode = inode;
++ NILFS_I(btnc_inode)->i_bmap = ii->i_bmap;
++ ii->i_assoc_inode = btnc_inode;
++
++ return 0;
++}
++
++/**
++ * nilfs_detach_btree_node_cache - detach the B-tree node cache from the inode
++ * @inode: inode object
++ *
++ * nilfs_detach_btree_node_cache() detaches the B-tree node cache and its
++ * holder inode bound to @inode, or does nothing if @inode doesn't have it.
++ */
++void nilfs_detach_btree_node_cache(struct inode *inode)
++{
++ struct nilfs_inode_info *ii = NILFS_I(inode);
++ struct inode *btnc_inode = ii->i_assoc_inode;
++
++ if (btnc_inode) {
++ NILFS_I(btnc_inode)->i_assoc_inode = NULL;
++ ii->i_assoc_inode = NULL;
++ iput(btnc_inode);
++ }
++}
++
++/**
++ * nilfs_iget_for_shadow - obtain inode for shadow mapping
++ * @inode: inode object that uses shadow mapping
++ *
++ * nilfs_iget_for_shadow() allocates a pair of inodes that holds page
++ * caches for shadow mapping. The page cache for data pages is set up
++ * in one inode and the one for b-tree node pages is set up in the
++ * other inode, which is attached to the former inode.
++ *
++ * Return Value: On success, a pointer to the inode for data pages is
++ * returned. On errors, one of the following negative error code is returned
++ * in a pointer type.
++ *
++ * %-ENOMEM - Insufficient memory available.
++ */
++struct inode *nilfs_iget_for_shadow(struct inode *inode)
++{
++ struct nilfs_iget_args args = {
++ .ino = inode->i_ino, .root = NULL, .cno = 0, .for_gc = false,
++ .for_btnc = false, .for_shadow = true
++ };
++ struct inode *s_inode;
++ int err;
++
++ s_inode = iget5_locked(inode->i_sb, inode->i_ino, nilfs_iget_test,
++ nilfs_iget_set, &args);
++ if (unlikely(!s_inode))
++ return ERR_PTR(-ENOMEM);
++ if (!(s_inode->i_state & I_NEW))
++ return inode;
++
++ NILFS_I(s_inode)->i_flags = 0;
++ memset(NILFS_I(s_inode)->i_bmap, 0, sizeof(struct nilfs_bmap));
++ mapping_set_gfp_mask(s_inode->i_mapping, GFP_NOFS);
++
++ err = nilfs_attach_btree_node_cache(s_inode);
++ if (unlikely(err)) {
++ iget_failed(s_inode);
++ return ERR_PTR(err);
++ }
++ unlock_new_inode(s_inode);
++ return s_inode;
++}
++
+ void nilfs_write_inode_common(struct inode *inode,
+ struct nilfs_inode *raw_inode, int has_bmap)
+ {
+@@ -770,7 +900,8 @@ static void nilfs_clear_inode(struct inode *inode)
+ if (test_bit(NILFS_I_BMAP, &ii->i_state))
+ nilfs_bmap_clear(ii->i_bmap);
+
+- nilfs_btnode_cache_clear(&ii->i_btnode_cache);
++ if (!test_bit(NILFS_I_BTNC, &ii->i_state))
++ nilfs_detach_btree_node_cache(inode);
+
+ if (ii->i_root && inode->i_ino == NILFS_ROOT_INO)
+ nilfs_put_root(ii->i_root);
+diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
+index 700870a92bc4a..7c9055d767d16 100644
+--- a/fs/nilfs2/mdt.c
++++ b/fs/nilfs2/mdt.c
+@@ -469,9 +469,18 @@ int nilfs_mdt_init(struct inode *inode, gfp_t gfp_mask, size_t objsz)
+ void nilfs_mdt_clear(struct inode *inode)
+ {
+ struct nilfs_mdt_info *mdi = NILFS_MDT(inode);
++ struct nilfs_shadow_map *shadow = mdi->mi_shadow;
+
+ if (mdi->mi_palloc_cache)
+ nilfs_palloc_destroy_cache(inode);
++
++ if (shadow) {
++ struct inode *s_inode = shadow->inode;
++
++ shadow->inode = NULL;
++ iput(s_inode);
++ mdi->mi_shadow = NULL;
++ }
+ }
+
+ /**
+@@ -505,12 +514,15 @@ int nilfs_mdt_setup_shadow_map(struct inode *inode,
+ struct nilfs_shadow_map *shadow)
+ {
+ struct nilfs_mdt_info *mi = NILFS_MDT(inode);
++ struct inode *s_inode;
+
+ INIT_LIST_HEAD(&shadow->frozen_buffers);
+- address_space_init_once(&shadow->frozen_data);
+- nilfs_mapping_init(&shadow->frozen_data, inode);
+- address_space_init_once(&shadow->frozen_btnodes);
+- nilfs_mapping_init(&shadow->frozen_btnodes, inode);
++
++ s_inode = nilfs_iget_for_shadow(inode);
++ if (IS_ERR(s_inode))
++ return PTR_ERR(s_inode);
++
++ shadow->inode = s_inode;
+ mi->mi_shadow = shadow;
+ return 0;
+ }
+@@ -524,14 +536,15 @@ int nilfs_mdt_save_to_shadow_map(struct inode *inode)
+ struct nilfs_mdt_info *mi = NILFS_MDT(inode);
+ struct nilfs_inode_info *ii = NILFS_I(inode);
+ struct nilfs_shadow_map *shadow = mi->mi_shadow;
++ struct inode *s_inode = shadow->inode;
+ int ret;
+
+- ret = nilfs_copy_dirty_pages(&shadow->frozen_data, inode->i_mapping);
++ ret = nilfs_copy_dirty_pages(s_inode->i_mapping, inode->i_mapping);
+ if (ret)
+ goto out;
+
+- ret = nilfs_copy_dirty_pages(&shadow->frozen_btnodes,
+- &ii->i_btnode_cache);
++ ret = nilfs_copy_dirty_pages(NILFS_I(s_inode)->i_assoc_inode->i_mapping,
++ ii->i_assoc_inode->i_mapping);
+ if (ret)
+ goto out;
+
+@@ -547,7 +560,7 @@ int nilfs_mdt_freeze_buffer(struct inode *inode, struct buffer_head *bh)
+ struct page *page;
+ int blkbits = inode->i_blkbits;
+
+- page = grab_cache_page(&shadow->frozen_data, bh->b_page->index);
++ page = grab_cache_page(shadow->inode->i_mapping, bh->b_page->index);
+ if (!page)
+ return -ENOMEM;
+
+@@ -579,7 +592,7 @@ nilfs_mdt_get_frozen_buffer(struct inode *inode, struct buffer_head *bh)
+ struct page *page;
+ int n;
+
+- page = find_lock_page(&shadow->frozen_data, bh->b_page->index);
++ page = find_lock_page(shadow->inode->i_mapping, bh->b_page->index);
+ if (page) {
+ if (page_has_buffers(page)) {
+ n = bh_offset(bh) >> inode->i_blkbits;
+@@ -620,10 +633,11 @@ void nilfs_mdt_restore_from_shadow_map(struct inode *inode)
+ nilfs_palloc_clear_cache(inode);
+
+ nilfs_clear_dirty_pages(inode->i_mapping, true);
+- nilfs_copy_back_pages(inode->i_mapping, &shadow->frozen_data);
++ nilfs_copy_back_pages(inode->i_mapping, shadow->inode->i_mapping);
+
+- nilfs_clear_dirty_pages(&ii->i_btnode_cache, true);
+- nilfs_copy_back_pages(&ii->i_btnode_cache, &shadow->frozen_btnodes);
++ nilfs_clear_dirty_pages(ii->i_assoc_inode->i_mapping, true);
++ nilfs_copy_back_pages(ii->i_assoc_inode->i_mapping,
++ NILFS_I(shadow->inode)->i_assoc_inode->i_mapping);
+
+ nilfs_bmap_restore(ii->i_bmap, &shadow->bmap_store);
+
+@@ -638,10 +652,11 @@ void nilfs_mdt_clear_shadow_map(struct inode *inode)
+ {
+ struct nilfs_mdt_info *mi = NILFS_MDT(inode);
+ struct nilfs_shadow_map *shadow = mi->mi_shadow;
++ struct inode *shadow_btnc_inode = NILFS_I(shadow->inode)->i_assoc_inode;
+
+ down_write(&mi->mi_sem);
+ nilfs_release_frozen_buffers(shadow);
+- truncate_inode_pages(&shadow->frozen_data, 0);
+- truncate_inode_pages(&shadow->frozen_btnodes, 0);
++ truncate_inode_pages(shadow->inode->i_mapping, 0);
++ truncate_inode_pages(shadow_btnc_inode->i_mapping, 0);
+ up_write(&mi->mi_sem);
+ }
+diff --git a/fs/nilfs2/mdt.h b/fs/nilfs2/mdt.h
+index e77aea4bb921c..9d8ac0d27c16e 100644
+--- a/fs/nilfs2/mdt.h
++++ b/fs/nilfs2/mdt.h
+@@ -18,14 +18,12 @@
+ /**
+ * struct nilfs_shadow_map - shadow mapping of meta data file
+ * @bmap_store: shadow copy of bmap state
+- * @frozen_data: shadowed dirty data pages
+- * @frozen_btnodes: shadowed dirty b-tree nodes' pages
++ * @inode: holder of page caches used in shadow mapping
+ * @frozen_buffers: list of frozen buffers
+ */
+ struct nilfs_shadow_map {
+ struct nilfs_bmap_store bmap_store;
+- struct address_space frozen_data;
+- struct address_space frozen_btnodes;
++ struct inode *inode;
+ struct list_head frozen_buffers;
+ };
+
+diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
+index a2f247b6a209e..8699bdc9e3918 100644
+--- a/fs/nilfs2/nilfs.h
++++ b/fs/nilfs2/nilfs.h
+@@ -28,7 +28,7 @@
+ * @i_xattr: <TODO>
+ * @i_dir_start_lookup: page index of last successful search
+ * @i_cno: checkpoint number for GC inode
+- * @i_btnode_cache: cached pages of b-tree nodes
++ * @i_assoc_inode: associated inode (B-tree node cache holder or back pointer)
+ * @i_dirty: list for connecting dirty files
+ * @xattr_sem: semaphore for extended attributes processing
+ * @i_bh: buffer contains disk inode
+@@ -43,7 +43,7 @@ struct nilfs_inode_info {
+ __u64 i_xattr; /* sector_t ??? */
+ __u32 i_dir_start_lookup;
+ __u64 i_cno; /* check point number for GC inode */
+- struct address_space i_btnode_cache;
++ struct inode *i_assoc_inode;
+ struct list_head i_dirty; /* List for connecting dirty files */
+
+ #ifdef CONFIG_NILFS_XATTR
+@@ -75,13 +75,6 @@ NILFS_BMAP_I(const struct nilfs_bmap *bmap)
+ return container_of(bmap, struct nilfs_inode_info, i_bmap_data);
+ }
+
+-static inline struct inode *NILFS_BTNC_I(struct address_space *btnc)
+-{
+- struct nilfs_inode_info *ii =
+- container_of(btnc, struct nilfs_inode_info, i_btnode_cache);
+- return &ii->vfs_inode;
+-}
+-
+ /*
+ * Dynamic state flags of NILFS on-memory inode (i_state)
+ */
+@@ -98,6 +91,8 @@ enum {
+ NILFS_I_INODE_SYNC, /* dsync is not allowed for inode */
+ NILFS_I_BMAP, /* has bmap and btnode_cache */
+ NILFS_I_GCINODE, /* inode for GC, on memory only */
++ NILFS_I_BTNC, /* inode for btree node cache */
++ NILFS_I_SHADOW, /* inode for shadowed page cache */
+ };
+
+ /*
+@@ -265,6 +260,9 @@ struct inode *nilfs_iget(struct super_block *sb, struct nilfs_root *root,
+ unsigned long ino);
+ extern struct inode *nilfs_iget_for_gc(struct super_block *sb,
+ unsigned long ino, __u64 cno);
++int nilfs_attach_btree_node_cache(struct inode *inode);
++void nilfs_detach_btree_node_cache(struct inode *inode);
++struct inode *nilfs_iget_for_shadow(struct inode *inode);
+ extern void nilfs_update_inode(struct inode *, struct buffer_head *, int);
+ extern void nilfs_truncate(struct inode *);
+ extern void nilfs_evict_inode(struct inode *);
+diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
+index 329a056b73b17..c726b42ca92d1 100644
+--- a/fs/nilfs2/page.c
++++ b/fs/nilfs2/page.c
+@@ -452,10 +452,9 @@ void nilfs_mapping_init(struct address_space *mapping, struct inode *inode)
+ /*
+ * NILFS2 needs clear_page_dirty() in the following two cases:
+ *
+- * 1) For B-tree node pages and data pages of the dat/gcdat, NILFS2 clears
+- * page dirty flags when it copies back pages from the shadow cache
+- * (gcdat->{i_mapping,i_btnode_cache}) to its original cache
+- * (dat->{i_mapping,i_btnode_cache}).
++ * 1) For B-tree node pages and data pages of DAT file, NILFS2 clears dirty
++ * flag of pages when it copies back pages from shadow cache to the
++ * original cache.
+ *
+ * 2) Some B-tree operations like insertion or deletion may dispose buffers
+ * in dirty state, and this needs to cancel the dirty state of their pages.
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 91b58c897f92d..eb3ac76190887 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -738,15 +738,18 @@ static void nilfs_lookup_dirty_node_buffers(struct inode *inode,
+ struct list_head *listp)
+ {
+ struct nilfs_inode_info *ii = NILFS_I(inode);
+- struct address_space *mapping = &ii->i_btnode_cache;
++ struct inode *btnc_inode = ii->i_assoc_inode;
+ struct pagevec pvec;
+ struct buffer_head *bh, *head;
+ unsigned int i;
+ pgoff_t index = 0;
+
++ if (!btnc_inode)
++ return;
++
+ pagevec_init(&pvec);
+
+- while (pagevec_lookup_tag(&pvec, mapping, &index,
++ while (pagevec_lookup_tag(&pvec, btnc_inode->i_mapping, &index,
+ PAGECACHE_TAG_DIRTY)) {
+ for (i = 0; i < pagevec_count(&pvec); i++) {
+ bh = head = page_buffers(pvec.pages[i]);
+@@ -2410,7 +2413,7 @@ nilfs_remove_written_gcinodes(struct the_nilfs *nilfs, struct list_head *head)
+ continue;
+ list_del_init(&ii->i_dirty);
+ truncate_inode_pages(&ii->vfs_inode.i_data, 0);
+- nilfs_btnode_cache_clear(&ii->i_btnode_cache);
++ nilfs_btnode_cache_clear(ii->i_assoc_inode->i_mapping);
+ iput(&ii->vfs_inode);
+ }
+ }
+diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
+index 26290aa1023f3..2a3ad12701333 100644
+--- a/fs/nilfs2/super.c
++++ b/fs/nilfs2/super.c
+@@ -151,7 +151,8 @@ struct inode *nilfs_alloc_inode(struct super_block *sb)
+ ii->i_bh = NULL;
+ ii->i_state = 0;
+ ii->i_cno = 0;
+- nilfs_mapping_init(&ii->i_btnode_cache, &ii->vfs_inode);
++ ii->i_assoc_inode = NULL;
++ ii->i_bmap = &ii->i_bmap_data;
+ return &ii->vfs_inode;
+ }
+
+@@ -1382,8 +1383,6 @@ static void nilfs_inode_init_once(void *obj)
+ #ifdef CONFIG_NILFS_XATTR
+ init_rwsem(&ii->xattr_sem);
+ #endif
+- address_space_init_once(&ii->i_btnode_cache);
+- ii->i_bmap = &ii->i_bmap_data;
+ inode_init_once(&ii->vfs_inode);
+ }
+
+diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
+index 6f7d4e977c5cc..8b1360772fc58 100644
+--- a/kernel/dma/swiotlb.c
++++ b/kernel/dma/swiotlb.c
+@@ -587,10 +587,14 @@ found:
+ */
+ for (i = 0; i < nslots; i++)
+ io_tlb_orig_addr[index+i] = orig_addr + (i << IO_TLB_SHIFT);
+- if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC) &&
+- (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL))
+- swiotlb_bounce(orig_addr, tlb_addr, size, DMA_TO_DEVICE);
+-
++ /*
++ * When dir == DMA_FROM_DEVICE we could omit the copy from the orig
++ * to the tlb buffer, if we knew for sure the device will
++ * overwirte the entire current content. But we don't. Thus
++ * unconditional bounce may prevent leaking swiotlb content (i.e.
++ * kernel memory) to user-space.
++ */
++ swiotlb_bounce(orig_addr, tlb_addr, size, DMA_TO_DEVICE);
+ return tlb_addr;
+ }
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index ec2f9e433208a..88dd1398ae889 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -10758,6 +10758,9 @@ SYSCALL_DEFINE5(perf_event_open,
+ * Do not allow to attach to a group in a different task
+ * or CPU context. If we're moving SW events, we'll fix
+ * this up later, so allow that.
++ *
++ * Racy, not holding group_leader->ctx->mutex, see comment with
++ * perf_event_ctx_lock().
+ */
+ if (!move_group && group_leader->ctx != ctx)
+ goto err_context;
+@@ -10807,6 +10810,7 @@ SYSCALL_DEFINE5(perf_event_open,
+ } else {
+ perf_event_ctx_unlock(group_leader, gctx);
+ move_group = 0;
++ goto not_move_group;
+ }
+ }
+
+@@ -10823,7 +10827,17 @@ SYSCALL_DEFINE5(perf_event_open,
+ }
+ } else {
+ mutex_lock(&ctx->mutex);
++
++ /*
++ * Now that we hold ctx->lock, (re)validate group_leader->ctx == ctx,
++ * see the group_leader && !move_group test earlier.
++ */
++ if (group_leader && group_leader->ctx != ctx) {
++ err = -EINVAL;
++ goto err_locked;
++ }
+ }
++not_move_group:
+
+ if (ctx->task == TASK_TOMBSTONE) {
+ err = -ESRCH;
+diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
+index 2532c1a19645c..14c2fdc268eac 100644
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -47,6 +47,13 @@ static int br_pass_frame_up(struct sk_buff *skb)
+ u64_stats_update_end(&brstats->syncp);
+
+ vg = br_vlan_group_rcu(br);
++
++ /* Reset the offload_fwd_mark because there could be a stacked
++ * bridge above, and it should not think this bridge it doing
++ * that bridge's work forwarding out its ports.
++ */
++ br_switchdev_frame_unmark(skb);
++
+ /* Bridge is just like any other port. Make sure the
+ * packet is allowed except in promisc modue when someone
+ * may be running packet capture.
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index a416c0f900567..170960ef7e360 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2836,8 +2836,10 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
+ void *ext_hdrs[SADB_EXT_MAX];
+ int err;
+
+- pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
+- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
++ err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
++ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
++ if (err)
++ return err;
+
+ memset(ext_hdrs, 0, sizeof(ext_hdrs));
+ err = parse_exthdrs(skb, hdr, ext_hdrs);
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index f30b732af61d7..3598ebe52d087 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1322,8 +1322,7 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
+ goto dont_reorder;
+
+ /* not part of a BA session */
+- if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
+- ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
++ if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
+ goto dont_reorder;
+
+ /* new, potentially un-ordered, ampdu frame - process it */
+diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
+index 5405d073804c6..9e3f9460f14fc 100644
+--- a/net/nfc/nci/data.c
++++ b/net/nfc/nci/data.c
+@@ -130,7 +130,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev,
+
+ skb_frag = nci_skb_alloc(ndev,
+ (NCI_DATA_HDR_SIZE + frag_len),
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ if (skb_frag == NULL) {
+ rc = -ENOMEM;
+ goto free_exit;
+diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c
+index c972c212e7caf..e5c5cff332364 100644
+--- a/net/nfc/nci/hci.c
++++ b/net/nfc/nci/hci.c
+@@ -165,7 +165,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe,
+
+ i = 0;
+ skb = nci_skb_alloc(ndev, conn_info->max_pkt_payload_len +
+- NCI_DATA_HDR_SIZE, GFP_KERNEL);
++ NCI_DATA_HDR_SIZE, GFP_ATOMIC);
+ if (!skb)
+ return -ENOMEM;
+
+@@ -198,7 +198,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 pipe,
+ if (i < data_len) {
+ skb = nci_skb_alloc(ndev,
+ conn_info->max_pkt_payload_len +
+- NCI_DATA_HDR_SIZE, GFP_KERNEL);
++ NCI_DATA_HDR_SIZE, GFP_ATOMIC);
+ if (!skb)
+ return -ENOMEM;
+
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index fec0f7fdb015d..aeb8f84cbd9e2 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -225,6 +225,10 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
+ for (i = 0; i < p->tcfp_nkeys; ++i) {
+ u32 cur = p->tcfp_keys[i].off;
+
++ /* sanitize the shift value for any later use */
++ p->tcfp_keys[i].shift = min_t(size_t, BITS_PER_TYPE(int) - 1,
++ p->tcfp_keys[i].shift);
++
+ /* The AT option can read a single byte, we can bound the actual
+ * value with uchar max.
+ */
+diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
+index 13c8e6542a2fc..9dd0ae377980f 100644
+--- a/sound/isa/wavefront/wavefront_synth.c
++++ b/sound/isa/wavefront/wavefront_synth.c
+@@ -1092,7 +1092,8 @@ wavefront_send_sample (snd_wavefront_t *dev,
+
+ if (dataptr < data_end) {
+
+- __get_user (sample_short, dataptr);
++ if (get_user(sample_short, dataptr))
++ return -EFAULT;
+ dataptr += skip;
+
+ if (data_is_unsigned) { /* GUS ? */
+diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
+index 91c0a4434da27..e7fde88a08455 100644
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -1631,7 +1631,7 @@ static int __bench_numa(const char *name)
+ "GB/sec,", "total-speed", "GB/sec total speed");
+
+ if (g->p.show_details >= 2) {
+- char tname[14 + 2 * 10 + 1];
++ char tname[14 + 2 * 11 + 1];
+ struct thread_data *td;
+ for (p = 0; p < g->p.nr_proc; p++) {
+ for (t = 0; t < g->p.nr_threads; t++) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-05-27 12:24 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-05-27 12:24 UTC (permalink / raw
To: gentoo-commits
commit: 04ab94a3dd2453d23b2b6608b01f94451fe6f5c8
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri May 27 12:24:07 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri May 27 12:24:07 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=04ab94a3
exec: increase BINPRM_BUF_SIZE to 256
Bug: https://bugs.gentoo.org/847655
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +++
1900_fs-increase-BINPRM-BUF-SIZE-to-256.patch | 51 +++++++++++++++++++++++++++
2 files changed, 55 insertions(+)
diff --git a/0000_README b/0000_README
index b7976b31..d527b79c 100644
--- a/0000_README
+++ b/0000_README
@@ -1027,6 +1027,10 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default.
+Patch: 1900_fs-increase-BINPRM-BUF-SIZE-to-256.patch
+From: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/exec.c?id=6eb3c3d0a52dca337e327ae8868ca1f44a712e02
+Desc: exec: increase BINPRM_BUF_SIZE to 256
+
Patch: 2000_BT-Check-key-sizes-only-if-Secure-Simple-Pairing-enabled.patch
From: https://lore.kernel.org/linux-bluetooth/20190522070540.48895-1-marcel@holtmann.org/raw
Desc: Bluetooth: Check key sizes only when Secure Simple Pairing is enabled. See bug #686758
diff --git a/1900_fs-increase-BINPRM-BUF-SIZE-to-256.patch b/1900_fs-increase-BINPRM-BUF-SIZE-to-256.patch
new file mode 100644
index 00000000..2be01c77
--- /dev/null
+++ b/1900_fs-increase-BINPRM-BUF-SIZE-to-256.patch
@@ -0,0 +1,51 @@
+From 6eb3c3d0a52dca337e327ae8868ca1f44a712e02 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Thu, 7 Mar 2019 16:29:26 -0800
+Subject: [PATCH] exec: increase BINPRM_BUF_SIZE to 256
+
+Large enterprise clients often run applications out of networked file
+systems where the IT mandated layout of project volumes can end up
+leading to paths that are longer than 128 characters. Bumping this up
+to the next order of two solves this problem in all but the most
+egregious case while still fitting into a 512b slab.
+
+[oleg@redhat.com: update comment, per Kees]
+Link: http://lkml.kernel.org/r/20181112160956.GA28472@redhat.com
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Reported-by: Ben Woodard <woodard@redhat.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Cc: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ fs/exec.c | 2 +-
+ include/uapi/linux/binfmts.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/exec.c b/fs/exec.c
+index bf0ace3841ad6e..2e0033348d8e10 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1563,7 +1563,7 @@ static void bprm_fill_uid(struct linux_binprm *bprm)
+
+ /*
+ * Fill the binprm structure from the inode.
+- * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
++ * Check permissions, then read the first BINPRM_BUF_SIZE bytes
+ *
+ * This may be called multiple times for binary chains (scripts for example).
+ */
+diff --git a/include/uapi/linux/binfmts.h b/include/uapi/linux/binfmts.h
+index 4abad03a885305..689025d9c185b0 100644
+--- a/include/uapi/linux/binfmts.h
++++ b/include/uapi/linux/binfmts.h
+@@ -16,6 +16,6 @@ struct pt_regs;
+ #define MAX_ARG_STRINGS 0x7FFFFFFF
+
+ /* sizeof(linux_binprm->buf) */
+-#define BINPRM_BUF_SIZE 128
++#define BINPRM_BUF_SIZE 256
+
+ #endif /* _UAPI_LINUX_BINFMTS_H */
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-06-06 11:05 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-06-06 11:05 UTC (permalink / raw
To: gentoo-commits
commit: 2f8052d8b0cab6963d9adda65943c18822146475
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Jun 6 11:05:43 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Jun 6 11:05:43 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2f8052d8
Linux patch 4.19.246
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1245_linux-4.19.246.patch | 930 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 934 insertions(+)
diff --git a/0000_README b/0000_README
index d527b79c..4389c65a 100644
--- a/0000_README
+++ b/0000_README
@@ -1019,6 +1019,10 @@ Patch: 1244_linux-4.19.245.patch
From: https://www.kernel.org
Desc: Linux 4.19.245
+Patch: 1245_linux-4.19.246.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.246
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1245_linux-4.19.246.patch b/1245_linux-4.19.246.patch
new file mode 100644
index 00000000..111b704a
--- /dev/null
+++ b/1245_linux-4.19.246.patch
@@ -0,0 +1,930 @@
+diff --git a/Documentation/process/submitting-patches.rst b/Documentation/process/submitting-patches.rst
+index c0917107b90ab..3739c1ce686d4 100644
+--- a/Documentation/process/submitting-patches.rst
++++ b/Documentation/process/submitting-patches.rst
+@@ -133,7 +133,7 @@ as you intend it to.
+
+ The maintainer will thank you if you write your patch description in a
+ form which can be easily pulled into Linux's source code management
+-system, ``git``, as a "commit log". See :ref:`explicit_in_reply_to`.
++system, ``git``, as a "commit log". See :ref:`the_canonical_patch_format`.
+
+ Solve only one problem per patch. If your description starts to get
+ long, that's a sign that you probably need to split up your patch.
+diff --git a/Makefile b/Makefile
+index 64a64f6ba90d8..e1cbe6e8bcaef 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 245
++SUBLEVEL = 246
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index 22da9bfd8a458..bacf8d988f65f 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -441,6 +441,11 @@ void __init xen_msi_init(void)
+
+ x86_msi.setup_msi_irqs = xen_hvm_setup_msi_irqs;
+ x86_msi.teardown_msi_irq = xen_teardown_msi_irq;
++ /*
++ * With XEN PIRQ/Eventchannels in use PCI/MSI[-X] masking is solely
++ * controlled by the hypervisor.
++ */
++ pci_msi_ignore_mask = 1;
+ }
+ #endif
+
+diff --git a/block/bio.c b/block/bio.c
+index fe749404ef93b..7858b2d239161 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -1528,7 +1528,7 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len,
+ if (bytes > len)
+ bytes = len;
+
+- page = alloc_page(q->bounce_gfp | gfp_mask);
++ page = alloc_page(q->bounce_gfp | __GFP_ZERO | gfp_mask);
+ if (!page)
+ goto cleanup;
+
+diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
+index 39ee0ca636aae..0b6489fd5d0d1 100644
+--- a/drivers/acpi/sysfs.c
++++ b/drivers/acpi/sysfs.c
+@@ -439,18 +439,29 @@ static ssize_t acpi_data_show(struct file *filp, struct kobject *kobj,
+ {
+ struct acpi_data_attr *data_attr;
+ void __iomem *base;
+- ssize_t rc;
++ ssize_t size;
+
+ data_attr = container_of(bin_attr, struct acpi_data_attr, attr);
++ size = data_attr->attr.size;
++
++ if (offset < 0)
++ return -EINVAL;
++
++ if (offset >= size)
++ return 0;
+
+- base = acpi_os_map_memory(data_attr->addr, data_attr->attr.size);
++ if (count > size - offset)
++ count = size - offset;
++
++ base = acpi_os_map_iomem(data_attr->addr, size);
+ if (!base)
+ return -ENOMEM;
+- rc = memory_read_from_buffer(buf, count, &offset, base,
+- data_attr->attr.size);
+- acpi_os_unmap_memory(base, data_attr->attr.size);
+
+- return rc;
++ memcpy_fromio(buf, base + offset, count);
++
++ acpi_os_unmap_iomem(base, size);
++
++ return count;
+ }
+
+ static int acpi_bert_data_init(void *th, struct acpi_data_attr *data_attr)
+diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
+index e71c6b24aed1c..ce497b0691d71 100644
+--- a/drivers/char/tpm/tpm2-cmd.c
++++ b/drivers/char/tpm/tpm2-cmd.c
+@@ -717,7 +717,16 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id, u32 *value,
+ if (!rc) {
+ out = (struct tpm2_get_cap_out *)
+ &buf.data[TPM_HEADER_SIZE];
+- *value = be32_to_cpu(out->value);
++ /*
++ * To prevent failing boot up of some systems, Infineon TPM2.0
++ * returns SUCCESS on TPM2_Startup in field upgrade mode. Also
++ * the TPM2_Getcapability command returns a zero length list
++ * in field upgrade mode.
++ */
++ if (be32_to_cpu(out->property_cnt) > 0)
++ *value = be32_to_cpu(out->value);
++ else
++ rc = -ENODATA;
+ }
+ tpm_buf_destroy(&buf);
+ return rc;
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index 3ba67bc6baba0..80647eb071fd6 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -692,6 +692,7 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+ if (!wait_event_timeout(ibmvtpm->crq_queue.wq,
+ ibmvtpm->rtce_buf != NULL,
+ HZ)) {
++ rc = -ENODEV;
+ dev_err(dev, "CRQ response timed out\n");
+ goto init_irq_cleanup;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 1847faa45d370..af8865281b478 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2814,7 +2814,7 @@ hsw_compute_linetime_wm(const struct intel_crtc_state *cstate)
+ }
+
+ static void intel_read_wm_latency(struct drm_i915_private *dev_priv,
+- uint16_t wm[8])
++ uint16_t wm[])
+ {
+ if (INTEL_GEN(dev_priv) >= 9) {
+ uint32_t val;
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index c20945ed1dc19..e99286258f62f 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -2111,6 +2111,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_GOOGLE,
+ HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, USB_VENDOR_ID_GOOGLE,
+ USB_DEVICE_ID_GOOGLE_TOUCH_ROSE) },
++ { .driver_data = MT_CLS_GOOGLE,
++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, USB_VENDOR_ID_GOOGLE,
++ USB_DEVICE_ID_GOOGLE_WHISKERS) },
+
+ /* Generic MT device */
+ { HID_DEVICE(HID_BUS_ANY, HID_GROUP_MULTITOUCH, HID_ANY_ID, HID_ANY_ID) },
+diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
+index 0d1c3ec8cb407..80796061102f1 100644
+--- a/drivers/i2c/busses/i2c-ismt.c
++++ b/drivers/i2c/busses/i2c-ismt.c
+@@ -80,6 +80,7 @@
+
+ #define ISMT_DESC_ENTRIES 2 /* number of descriptor entries */
+ #define ISMT_MAX_RETRIES 3 /* number of SMBus retries to attempt */
++#define ISMT_LOG_ENTRIES 3 /* number of interrupt cause log entries */
+
+ /* Hardware Descriptor Constants - Control Field */
+ #define ISMT_DESC_CWRL 0x01 /* Command/Write Length */
+@@ -173,6 +174,8 @@ struct ismt_priv {
+ u8 head; /* ring buffer head pointer */
+ struct completion cmp; /* interrupt completion */
+ u8 buffer[I2C_SMBUS_BLOCK_MAX + 16]; /* temp R/W data buffer */
++ dma_addr_t log_dma;
++ u32 *log;
+ };
+
+ /**
+@@ -406,6 +409,9 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr,
+ memset(desc, 0, sizeof(struct ismt_desc));
+ desc->tgtaddr_rw = ISMT_DESC_ADDR_RW(addr, read_write);
+
++ /* Always clear the log entries */
++ memset(priv->log, 0, ISMT_LOG_ENTRIES * sizeof(u32));
++
+ /* Initialize common control bits */
+ if (likely(pci_dev_msi_enabled(priv->pci_dev)))
+ desc->control = ISMT_DESC_INT | ISMT_DESC_FAIR;
+@@ -695,6 +701,8 @@ static void ismt_hw_init(struct ismt_priv *priv)
+ /* initialize the Master Descriptor Base Address (MDBA) */
+ writeq(priv->io_rng_dma, priv->smba + ISMT_MSTR_MDBA);
+
++ writeq(priv->log_dma, priv->smba + ISMT_GR_SMTICL);
++
+ /* initialize the Master Control Register (MCTRL) */
+ writel(ISMT_MCTRL_MEIE, priv->smba + ISMT_MSTR_MCTRL);
+
+@@ -784,6 +792,12 @@ static int ismt_dev_init(struct ismt_priv *priv)
+ priv->head = 0;
+ init_completion(&priv->cmp);
+
++ priv->log = dmam_alloc_coherent(&priv->pci_dev->dev,
++ ISMT_LOG_ENTRIES * sizeof(u32),
++ &priv->log_dma, GFP_KERNEL);
++ if (!priv->log)
++ return -ENOMEM;
++
+ return 0;
+ }
+
+diff --git a/drivers/i2c/busses/i2c-thunderx-pcidrv.c b/drivers/i2c/busses/i2c-thunderx-pcidrv.c
+index 19f8eec387172..107aeb8b54da4 100644
+--- a/drivers/i2c/busses/i2c-thunderx-pcidrv.c
++++ b/drivers/i2c/busses/i2c-thunderx-pcidrv.c
+@@ -208,6 +208,7 @@ static int thunder_i2c_probe_pci(struct pci_dev *pdev,
+ i2c->adap.bus_recovery_info = &octeon_i2c_recovery_info;
+ i2c->adap.dev.parent = dev;
+ i2c->adap.dev.of_node = pdev->dev.of_node;
++ i2c->adap.dev.fwnode = dev->fwnode;
+ snprintf(i2c->adap.name, sizeof(i2c->adap.name),
+ "Cavium ThunderX i2c adapter at %s", dev_name(dev));
+ i2c_set_adapdata(&i2c->adap, i2c);
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 3441ad140b583..e38c713e882e3 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -2932,6 +2932,11 @@ static int crypt_map(struct dm_target *ti, struct bio *bio)
+ return DM_MAPIO_SUBMITTED;
+ }
+
++static char hex2asc(unsigned char c)
++{
++ return c + '0' + ((unsigned)(9 - c) >> 4 & 0x27);
++}
++
+ static void crypt_status(struct dm_target *ti, status_type_t type,
+ unsigned status_flags, char *result, unsigned maxlen)
+ {
+@@ -2950,9 +2955,12 @@ static void crypt_status(struct dm_target *ti, status_type_t type,
+ if (cc->key_size > 0) {
+ if (cc->key_string)
+ DMEMIT(":%u:%s", cc->key_size, cc->key_string);
+- else
+- for (i = 0; i < cc->key_size; i++)
+- DMEMIT("%02x", cc->key[i]);
++ else {
++ for (i = 0; i < cc->key_size; i++) {
++ DMEMIT("%c%c", hex2asc(cc->key[i] >> 4),
++ hex2asc(cc->key[i] & 0xf));
++ }
++ }
+ } else
+ DMEMIT("-");
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index b0105d53918ab..8456e82409e20 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -3565,8 +3565,6 @@ try_smaller_buffer:
+ }
+
+ if (should_write_sb) {
+- int r;
+-
+ init_journal(ic, 0, ic->journal_sections, 0);
+ r = dm_integrity_failed(ic);
+ if (unlikely(r)) {
+diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
+index 21de30b4e2a16..3d59f3e208c50 100644
+--- a/drivers/md/dm-stats.c
++++ b/drivers/md/dm-stats.c
+@@ -224,6 +224,7 @@ void dm_stats_cleanup(struct dm_stats *stats)
+ atomic_read(&shared->in_flight[READ]),
+ atomic_read(&shared->in_flight[WRITE]));
+ }
++ cond_resched();
+ }
+ dm_stat_free(&s->rcu_head);
+ }
+@@ -313,6 +314,7 @@ static int dm_stats_create(struct dm_stats *stats, sector_t start, sector_t end,
+ for (ni = 0; ni < n_entries; ni++) {
+ atomic_set(&s->stat_shared[ni].in_flight[READ], 0);
+ atomic_set(&s->stat_shared[ni].in_flight[WRITE], 0);
++ cond_resched();
+ }
+
+ if (s->n_histogram_entries) {
+@@ -325,6 +327,7 @@ static int dm_stats_create(struct dm_stats *stats, sector_t start, sector_t end,
+ for (ni = 0; ni < n_entries; ni++) {
+ s->stat_shared[ni].tmp.histogram = hi;
+ hi += s->n_histogram_entries + 1;
++ cond_resched();
+ }
+ }
+
+@@ -345,6 +348,7 @@ static int dm_stats_create(struct dm_stats *stats, sector_t start, sector_t end,
+ for (ni = 0; ni < n_entries; ni++) {
+ p[ni].histogram = hi;
+ hi += s->n_histogram_entries + 1;
++ cond_resched();
+ }
+ }
+ }
+@@ -474,6 +478,7 @@ static int dm_stats_list(struct dm_stats *stats, const char *program,
+ }
+ DMEMIT("\n");
+ }
++ cond_resched();
+ }
+ mutex_unlock(&stats->mutex);
+
+@@ -750,6 +755,7 @@ static void __dm_stat_clear(struct dm_stat *s, size_t idx_start, size_t idx_end,
+ local_irq_enable();
+ }
+ }
++ cond_resched();
+ }
+ }
+
+@@ -865,6 +871,8 @@ static int dm_stats_print(struct dm_stats *stats, int id,
+
+ if (unlikely(sz + 1 >= maxlen))
+ goto buffer_overflow;
++
++ cond_resched();
+ }
+
+ if (clear)
+diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
+index fa8c201fca778..36945030520a9 100644
+--- a/drivers/md/dm-verity-target.c
++++ b/drivers/md/dm-verity-target.c
+@@ -1176,6 +1176,7 @@ bad:
+
+ static struct target_type verity_target = {
+ .name = "verity",
++ .features = DM_TARGET_IMMUTABLE,
+ .version = {1, 4, 0},
+ .module = THIS_MODULE,
+ .ctr = verity_ctr,
+diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
+index 964407deca350..23c019d1278cd 100644
+--- a/drivers/net/ethernet/faraday/ftgmac100.c
++++ b/drivers/net/ethernet/faraday/ftgmac100.c
+@@ -1869,6 +1869,11 @@ static int ftgmac100_probe(struct platform_device *pdev)
+ /* AST2400 doesn't have working HW checksum generation */
+ if (np && (of_device_is_compatible(np, "aspeed,ast2400-mac")))
+ netdev->hw_features &= ~NETIF_F_HW_CSUM;
++
++ /* AST2600 tx checksum with NCSI is broken */
++ if (priv->use_ncsi && of_device_is_compatible(np, "aspeed,ast2600-mac"))
++ netdev->hw_features &= ~NETIF_F_HW_CSUM;
++
+ if (np && of_get_property(np, "no-hw-checksum", NULL))
+ netdev->hw_features &= ~(NETIF_F_HW_CSUM | NETIF_F_RXCSUM);
+ netdev->features |= netdev->hw_features;
+diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+index 466d25ccc4bbc..40d7130a4909b 100644
+--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+@@ -1359,9 +1359,11 @@ static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
+
+ sec_len = *(pos++); len-= 1;
+
+- if (sec_len>0 && sec_len<=len) {
++ if (sec_len > 0 &&
++ sec_len <= len &&
++ sec_len <= 32) {
+ ssid[ssid_index].SsidLength = sec_len;
+- memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
++ memcpy(ssid[ssid_index].Ssid, pos, sec_len);
+ /* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */
+ /* , ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */
+ ssid_index++;
+diff --git a/fs/exec.c b/fs/exec.c
+index e87e3c020c61e..28e3b5eb2f4a1 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1805,6 +1805,9 @@ static int __do_execve_file(int fd, struct filename *filename,
+ goto out_unmark;
+
+ bprm->argc = count(argv, MAX_ARG_STRINGS);
++ if (bprm->argc == 0)
++ pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n",
++ current->comm, bprm->filename);
+ if ((retval = bprm->argc) < 0)
+ goto out;
+
+@@ -1829,6 +1832,20 @@ static int __do_execve_file(int fd, struct filename *filename,
+ if (retval < 0)
+ goto out;
+
++ /*
++ * When argv is empty, add an empty string ("") as argv[0] to
++ * ensure confused userspace programs that start processing
++ * from argv[1] won't end up walking envp. See also
++ * bprm_stack_limits().
++ */
++ if (bprm->argc == 0) {
++ const char *argv[] = { "", NULL };
++ retval = copy_strings_kernel(1, argv, bprm);
++ if (retval < 0)
++ goto out;
++ bprm->argc = 1;
++ }
++
+ retval = exec_binprm(bprm);
+ if (retval < 0)
+ goto out;
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index ed5429d18595c..78191320f8e21 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -6401,16 +6401,12 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp,
+ if (sop->so_is_open_owner || !same_owner_str(sop, owner))
+ continue;
+
+- /* see if there are still any locks associated with it */
+- lo = lockowner(sop);
+- list_for_each_entry(stp, &sop->so_stateids, st_perstateowner) {
+- if (check_for_locks(stp->st_stid.sc_file, lo)) {
+- status = nfserr_locks_held;
+- spin_unlock(&clp->cl_lock);
+- return status;
+- }
++ if (atomic_read(&sop->so_count) != 1) {
++ spin_unlock(&clp->cl_lock);
++ return nfserr_locks_held;
+ }
+
++ lo = lockowner(sop);
+ nfs4_get_stateowner(sop);
+ break;
+ }
+diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
+index fa5fe23ca6aaa..2d04f3e06de11 100644
+--- a/include/net/inet_hashtables.h
++++ b/include/net/inet_hashtables.h
+@@ -407,7 +407,7 @@ static inline void sk_rcv_saddr_set(struct sock *sk, __be32 addr)
+ }
+
+ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+- struct sock *sk, u32 port_offset,
++ struct sock *sk, u64 port_offset,
+ int (*check_established)(struct inet_timewait_death_row *,
+ struct sock *, __u16,
+ struct inet_timewait_sock **));
+diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
+index 2a3e0974a6af4..4e3fff9f929b1 100644
+--- a/include/net/netfilter/nf_conntrack_core.h
++++ b/include/net/netfilter/nf_conntrack_core.h
+@@ -58,8 +58,13 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
+ int ret = NF_ACCEPT;
+
+ if (ct) {
+- if (!nf_ct_is_confirmed(ct))
++ if (!nf_ct_is_confirmed(ct)) {
+ ret = __nf_conntrack_confirm(skb);
++
++ if (ret == NF_ACCEPT)
++ ct = (struct nf_conn *)skb_nfct(skb);
++ }
++
+ if (likely(ret == NF_ACCEPT))
+ nf_ct_deliver_cached_events(ct);
+ }
+diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
+index d7d2495f83c27..dac91aa38c5af 100644
+--- a/include/net/secure_seq.h
++++ b/include/net/secure_seq.h
+@@ -4,8 +4,8 @@
+
+ #include <linux/types.h>
+
+-u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
+-u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
++u64 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
++u64 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+ __be16 dport);
+ u32 secure_tcp_seq(__be32 saddr, __be32 daddr,
+ __be16 sport, __be16 dport);
+diff --git a/lib/assoc_array.c b/lib/assoc_array.c
+index 59875eb278ea5..3b1ff063ceca3 100644
+--- a/lib/assoc_array.c
++++ b/lib/assoc_array.c
+@@ -1465,6 +1465,7 @@ int assoc_array_gc(struct assoc_array *array,
+ struct assoc_array_ptr *cursor, *ptr;
+ struct assoc_array_ptr *new_root, *new_parent, **new_ptr_pp;
+ unsigned long nr_leaves_on_tree;
++ bool retained;
+ int keylen, slot, nr_free, next_slot, i;
+
+ pr_devel("-->%s()\n", __func__);
+@@ -1541,6 +1542,7 @@ continue_node:
+ goto descend;
+ }
+
++retry_compress:
+ pr_devel("-- compress node %p --\n", new_n);
+
+ /* Count up the number of empty slots in this node and work out the
+@@ -1558,6 +1560,7 @@ continue_node:
+ pr_devel("free=%d, leaves=%lu\n", nr_free, new_n->nr_leaves_on_branch);
+
+ /* See what we can fold in */
++ retained = false;
+ next_slot = 0;
+ for (slot = 0; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+ struct assoc_array_shortcut *s;
+@@ -1607,9 +1610,14 @@ continue_node:
+ pr_devel("[%d] retain node %lu/%d [nx %d]\n",
+ slot, child->nr_leaves_on_branch, nr_free + 1,
+ next_slot);
++ retained = true;
+ }
+ }
+
++ if (retained && new_n->nr_leaves_on_branch <= ASSOC_ARRAY_FAN_OUT) {
++ pr_devel("internal nodes remain despite enough space, retrying\n");
++ goto retry_compress;
++ }
+ pr_devel("after: %lu\n", new_n->nr_leaves_on_branch);
+
+ nr_leaves_on_tree = new_n->nr_leaves_on_branch;
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index 11e81b3ff0cf3..4d71356ea66a3 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -1812,11 +1812,40 @@ static enum fullness_group putback_zspage(struct size_class *class,
+ */
+ static void lock_zspage(struct zspage *zspage)
+ {
+- struct page *page = get_first_page(zspage);
++ struct page *curr_page, *page;
+
+- do {
+- lock_page(page);
+- } while ((page = get_next_page(page)) != NULL);
++ /*
++ * Pages we haven't locked yet can be migrated off the list while we're
++ * trying to lock them, so we need to be careful and only attempt to
++ * lock each page under migrate_read_lock(). Otherwise, the page we lock
++ * may no longer belong to the zspage. This means that we may wait for
++ * the wrong page to unlock, so we must take a reference to the page
++ * prior to waiting for it to unlock outside migrate_read_lock().
++ */
++ while (1) {
++ migrate_read_lock(zspage);
++ page = get_first_page(zspage);
++ if (trylock_page(page))
++ break;
++ get_page(page);
++ migrate_read_unlock(zspage);
++ wait_on_page_locked(page);
++ put_page(page);
++ }
++
++ curr_page = page;
++ while ((page = get_next_page(curr_page))) {
++ if (trylock_page(page)) {
++ curr_page = page;
++ } else {
++ get_page(page);
++ migrate_read_unlock(zspage);
++ wait_on_page_locked(page);
++ put_page(page);
++ migrate_read_lock(zspage);
++ }
++ }
++ migrate_read_unlock(zspage);
+ }
+
+ static struct dentry *zs_mount(struct file_system_type *fs_type,
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 7d68c98a00aa8..c1310c9d1b903 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -1666,7 +1666,7 @@ BPF_CALL_5(bpf_skb_store_bytes, struct sk_buff *, skb, u32, offset,
+
+ if (unlikely(flags & ~(BPF_F_RECOMPUTE_CSUM | BPF_F_INVALIDATE_HASH)))
+ return -EINVAL;
+- if (unlikely(offset > 0xffff))
++ if (unlikely(offset > INT_MAX))
+ return -EFAULT;
+ if (unlikely(bpf_try_make_writable(skb, offset + len)))
+ return -EFAULT;
+@@ -1701,7 +1701,7 @@ BPF_CALL_4(bpf_skb_load_bytes, const struct sk_buff *, skb, u32, offset,
+ {
+ void *ptr;
+
+- if (unlikely(offset > 0xffff))
++ if (unlikely(offset > INT_MAX))
+ goto err_clear;
+
+ ptr = skb_header_pointer(skb, offset, len, to);
+diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
+index 3a8128341e6ac..6fd25279bee95 100644
+--- a/net/core/secure_seq.c
++++ b/net/core/secure_seq.c
+@@ -96,7 +96,7 @@ u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr,
+ }
+ EXPORT_SYMBOL(secure_tcpv6_seq);
+
+-u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
++u64 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+ __be16 dport)
+ {
+ const struct {
+@@ -146,7 +146,7 @@ u32 secure_tcp_seq(__be32 saddr, __be32 daddr,
+ }
+ EXPORT_SYMBOL_GPL(secure_tcp_seq);
+
+-u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport)
++u64 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport)
+ {
+ net_secret_init();
+ return siphash_4u32((__force u32)saddr, (__force u32)daddr,
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index c96a5871b49da..0a8aec3f37cc6 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -507,7 +507,7 @@ not_unique:
+ return -EADDRNOTAVAIL;
+ }
+
+-static u32 inet_sk_port_offset(const struct sock *sk)
++static u64 inet_sk_port_offset(const struct sock *sk)
+ {
+ const struct inet_sock *inet = inet_sk(sk);
+
+@@ -714,8 +714,19 @@ unlock:
+ }
+ EXPORT_SYMBOL_GPL(inet_unhash);
+
++/* RFC 6056 3.3.4. Algorithm 4: Double-Hash Port Selection Algorithm
++ * Note that we use 32bit integers (vs RFC 'short integers')
++ * because 2^16 is not a multiple of num_ephemeral and this
++ * property might be used by clever attacker.
++ * RFC claims using TABLE_LENGTH=10 buckets gives an improvement,
++ * we use 256 instead to really give more isolation and
++ * privacy, this only consumes 1 KB of kernel memory.
++ */
++#define INET_TABLE_PERTURB_SHIFT 8
++static u32 table_perturb[1 << INET_TABLE_PERTURB_SHIFT];
++
+ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+- struct sock *sk, u32 port_offset,
++ struct sock *sk, u64 port_offset,
+ int (*check_established)(struct inet_timewait_death_row *,
+ struct sock *, __u16, struct inet_timewait_sock **))
+ {
+@@ -727,7 +738,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+ struct inet_bind_bucket *tb;
+ u32 remaining, offset;
+ int ret, i, low, high;
+- static u32 hint;
++ u32 index;
+
+ if (port) {
+ head = &hinfo->bhash[inet_bhashfn(net, port,
+@@ -752,7 +763,12 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+ if (likely(remaining > 1))
+ remaining &= ~1U;
+
+- offset = (hint + port_offset) % remaining;
++ net_get_random_once(table_perturb, sizeof(table_perturb));
++ index = hash_32(port_offset, INET_TABLE_PERTURB_SHIFT);
++
++ offset = READ_ONCE(table_perturb[index]) + port_offset;
++ offset %= remaining;
++
+ /* In first pass we try ports of @low parity.
+ * inet_csk_get_port() does the opposite choice.
+ */
+@@ -805,7 +821,7 @@ next_port:
+ return -EADDRNOTAVAIL;
+
+ ok:
+- hint += i + 2;
++ WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2);
+
+ /* Head lock still held and bh's disabled */
+ inet_bind_hash(sk, tb, port);
+@@ -828,7 +844,7 @@ ok:
+ int inet_hash_connect(struct inet_timewait_death_row *death_row,
+ struct sock *sk)
+ {
+- u32 port_offset = 0;
++ u64 port_offset = 0;
+
+ if (!inet_sk(sk)->inet_num)
+ port_offset = inet_sk_port_offset(sk);
+diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
+index d9e2575dad948..d8391921363ff 100644
+--- a/net/ipv6/inet6_hashtables.c
++++ b/net/ipv6/inet6_hashtables.c
+@@ -311,7 +311,7 @@ not_unique:
+ return -EADDRNOTAVAIL;
+ }
+
+-static u32 inet6_sk_port_offset(const struct sock *sk)
++static u64 inet6_sk_port_offset(const struct sock *sk)
+ {
+ const struct inet_sock *inet = inet_sk(sk);
+
+@@ -323,7 +323,7 @@ static u32 inet6_sk_port_offset(const struct sock *sk)
+ int inet6_hash_connect(struct inet_timewait_death_row *death_row,
+ struct sock *sk)
+ {
+- u32 port_offset = 0;
++ u64 port_offset = 0;
+
+ if (!inet_sk(sk)->inet_num)
+ port_offset = inet6_sk_port_offset(sk);
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 170960ef7e360..1bbb6ec89ff3d 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2910,7 +2910,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t)
+ break;
+ if (!aalg->pfkey_supported)
+ continue;
+- if (aalg_tmpl_set(t, aalg))
++ if (aalg_tmpl_set(t, aalg) && aalg->available)
+ sz += sizeof(struct sadb_comb);
+ }
+ return sz + sizeof(struct sadb_prop);
+@@ -2928,7 +2928,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
+ if (!ealg->pfkey_supported)
+ continue;
+
+- if (!(ealg_tmpl_set(t, ealg)))
++ if (!(ealg_tmpl_set(t, ealg) && ealg->available))
+ continue;
+
+ for (k = 1; ; k++) {
+@@ -2939,7 +2939,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
+ if (!aalg->pfkey_supported)
+ continue;
+
+- if (aalg_tmpl_set(t, aalg))
++ if (aalg_tmpl_set(t, aalg) && aalg->available)
+ sz += sizeof(struct sadb_comb);
+ }
+ }
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index 68660781aa51f..7c66f99046ac8 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -4,6 +4,7 @@
+ * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2013-2014 Intel Mobile Communications GmbH
+ * Copyright 2015-2017 Intel Deutschland GmbH
++ * Copyright (C) 2018-2021 Intel Corporation
+ */
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+@@ -835,9 +836,6 @@ int wiphy_register(struct wiphy *wiphy)
+ return res;
+ }
+
+- /* set up regulatory info */
+- wiphy_regulatory_register(wiphy);
+-
+ list_add_rcu(&rdev->list, &cfg80211_rdev_list);
+ cfg80211_rdev_list_generation++;
+
+@@ -851,6 +849,9 @@ int wiphy_register(struct wiphy *wiphy)
+ cfg80211_debugfs_rdev_add(rdev);
+ nl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY);
+
++ /* set up regulatory info */
++ wiphy_regulatory_register(wiphy);
++
+ if (wiphy->regulatory_flags & REGULATORY_CUSTOM_REG) {
+ struct regulatory_request request;
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index c7825b951f725..dd8503a3ef1e1 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -3756,6 +3756,7 @@ void wiphy_regulatory_register(struct wiphy *wiphy)
+
+ wiphy_update_regulatory(wiphy, lr->initiator);
+ wiphy_all_share_dfs_chan_state(wiphy);
++ reg_process_self_managed_hints();
+ }
+
+ void wiphy_regulatory_deregister(struct wiphy *wiphy)
+diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
+index 05f8a0f27121a..b7f7e4e541d7b 100644
+--- a/tools/lib/traceevent/Makefile
++++ b/tools/lib/traceevent/Makefile
+@@ -263,7 +263,7 @@ define do_generate_dynamic_list_file
+ xargs echo "U w W" | tr 'w ' 'W\n' | sort -u | xargs echo`;\
+ if [ "$$symbol_type" = "U W" ];then \
+ (echo '{'; \
+- $(NM) -u -D $1 | awk 'NF>1 {print "\t"$$2";"}' | sort -u;\
++ $(NM) -u -D $1 | awk 'NF>1 {sub("@.*", "", $$2); print "\t"$$2";"}' | sort -u;\
+ echo '};'; \
+ ) > $2; \
+ else \
+diff --git a/tools/perf/bench/bench.h b/tools/perf/bench/bench.h
+index 6c9fcd757f310..b3e418afc21a2 100644
+--- a/tools/perf/bench/bench.h
++++ b/tools/perf/bench/bench.h
+@@ -2,6 +2,10 @@
+ #ifndef BENCH_H
+ #define BENCH_H
+
++#include <sys/time.h>
++
++extern struct timeval bench__start, bench__end, bench__runtime;
++
+ /*
+ * The madvise transparent hugepage constants were added in glibc
+ * 2.13. For compatibility with older versions of glibc, define these
+diff --git a/tools/perf/bench/futex-hash.c b/tools/perf/bench/futex-hash.c
+index 9aa3a674829b3..ee9b280651093 100644
+--- a/tools/perf/bench/futex-hash.c
++++ b/tools/perf/bench/futex-hash.c
+@@ -35,7 +35,7 @@ static unsigned int nfutexes = 1024;
+ static bool fshared = false, done = false, silent = false;
+ static int futex_flag = 0;
+
+-struct timeval start, end, runtime;
++struct timeval bench__start, bench__end, bench__runtime;
+ static pthread_mutex_t thread_lock;
+ static unsigned int threads_starting;
+ static struct stats throughput_stats;
+@@ -101,8 +101,8 @@ static void toggle_done(int sig __maybe_unused,
+ {
+ /* inform all threads that we're done for the day */
+ done = true;
+- gettimeofday(&end, NULL);
+- timersub(&end, &start, &runtime);
++ gettimeofday(&bench__end, NULL);
++ timersub(&bench__end, &bench__start, &bench__runtime);
+ }
+
+ static void print_summary(void)
+@@ -112,7 +112,7 @@ static void print_summary(void)
+
+ printf("%sAveraged %ld operations/sec (+- %.2f%%), total secs = %d\n",
+ !silent ? "\n" : "", avg, rel_stddev_stats(stddev, avg),
+- (int) runtime.tv_sec);
++ (int)bench__runtime.tv_sec);
+ }
+
+ int bench_futex_hash(int argc, const char **argv)
+@@ -159,7 +159,7 @@ int bench_futex_hash(int argc, const char **argv)
+
+ threads_starting = nthreads;
+ pthread_attr_init(&thread_attr);
+- gettimeofday(&start, NULL);
++ gettimeofday(&bench__start, NULL);
+ for (i = 0; i < nthreads; i++) {
+ worker[i].tid = i;
+ worker[i].futex = calloc(nfutexes, sizeof(*worker[i].futex));
+@@ -202,7 +202,7 @@ int bench_futex_hash(int argc, const char **argv)
+ pthread_mutex_destroy(&thread_lock);
+
+ for (i = 0; i < nthreads; i++) {
+- unsigned long t = worker[i].ops/runtime.tv_sec;
++ unsigned long t = worker[i].ops / bench__runtime.tv_sec;
+ update_stats(&throughput_stats, t);
+ if (!silent) {
+ if (nfutexes == 1)
+diff --git a/tools/perf/bench/futex-lock-pi.c b/tools/perf/bench/futex-lock-pi.c
+index 8e9c4753e3040..017609ae35906 100644
+--- a/tools/perf/bench/futex-lock-pi.c
++++ b/tools/perf/bench/futex-lock-pi.c
+@@ -35,7 +35,6 @@ static bool silent = false, multi = false;
+ static bool done = false, fshared = false;
+ static unsigned int nthreads = 0;
+ static int futex_flag = 0;
+-struct timeval start, end, runtime;
+ static pthread_mutex_t thread_lock;
+ static unsigned int threads_starting;
+ static struct stats throughput_stats;
+@@ -62,7 +61,7 @@ static void print_summary(void)
+
+ printf("%sAveraged %ld operations/sec (+- %.2f%%), total secs = %d\n",
+ !silent ? "\n" : "", avg, rel_stddev_stats(stddev, avg),
+- (int) runtime.tv_sec);
++ (int)bench__runtime.tv_sec);
+ }
+
+ static void toggle_done(int sig __maybe_unused,
+@@ -71,8 +70,8 @@ static void toggle_done(int sig __maybe_unused,
+ {
+ /* inform all threads that we're done for the day */
+ done = true;
+- gettimeofday(&end, NULL);
+- timersub(&end, &start, &runtime);
++ gettimeofday(&bench__end, NULL);
++ timersub(&bench__end, &bench__start, &bench__runtime);
+ }
+
+ static void *workerfn(void *arg)
+@@ -183,7 +182,7 @@ int bench_futex_lock_pi(int argc, const char **argv)
+
+ threads_starting = nthreads;
+ pthread_attr_init(&thread_attr);
+- gettimeofday(&start, NULL);
++ gettimeofday(&bench__start, NULL);
+
+ create_threads(worker, thread_attr, cpu);
+ pthread_attr_destroy(&thread_attr);
+@@ -209,7 +208,7 @@ int bench_futex_lock_pi(int argc, const char **argv)
+ pthread_mutex_destroy(&thread_lock);
+
+ for (i = 0; i < nthreads; i++) {
+- unsigned long t = worker[i].ops/runtime.tv_sec;
++ unsigned long t = worker[i].ops / bench__runtime.tv_sec;
+
+ update_stats(&throughput_stats, t);
+ if (!silent)
+diff --git a/tools/perf/tests/bp_account.c b/tools/perf/tests/bp_account.c
+index a20cbc4454269..624e4ef73d1c0 100644
+--- a/tools/perf/tests/bp_account.c
++++ b/tools/perf/tests/bp_account.c
+@@ -22,7 +22,7 @@
+ #include "perf.h"
+ #include "cloexec.h"
+
+-volatile long the_var;
++static volatile long the_var;
+
+ static noinline int test_function(void)
+ {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-06-14 16:02 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-06-14 16:02 UTC (permalink / raw
To: gentoo-commits
commit: a71234a7a52107ba6170ef14edfbd5b7d265325b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 14 15:46:53 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jun 14 15:46:53 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a71234a7
Linux patch 4.19.247
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1246_linux-4.19.247.patch | 7739 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 7743 insertions(+)
diff --git a/0000_README b/0000_README
index 4389c65a..36b8d1ac 100644
--- a/0000_README
+++ b/0000_README
@@ -1023,6 +1023,10 @@ Patch: 1245_linux-4.19.246.patch
From: https://www.kernel.org
Desc: Linux 4.19.246
+Patch: 1246_linux-4.19.247.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.247
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1246_linux-4.19.247.patch b/1246_linux-4.19.247.patch
new file mode 100644
index 00000000..517a25d0
--- /dev/null
+++ b/1246_linux-4.19.247.patch
@@ -0,0 +1,7739 @@
+diff --git a/Documentation/ABI/testing/sysfs-ata b/Documentation/ABI/testing/sysfs-ata
+index 9ab0ef1dd1c72..299e0d1dc1619 100644
+--- a/Documentation/ABI/testing/sysfs-ata
++++ b/Documentation/ABI/testing/sysfs-ata
+@@ -107,13 +107,14 @@ Description:
+ described in ATA8 7.16 and 7.17. Only valid if
+ the device is not a PM.
+
+- pio_mode: (RO) Transfer modes supported by the device when
+- in PIO mode. Mostly used by PATA device.
++ pio_mode: (RO) PIO transfer mode used by the device.
++ Mostly used by PATA devices.
+
+- xfer_mode: (RO) Current transfer mode
++ xfer_mode: (RO) Current transfer mode. Mostly used by
++ PATA devices.
+
+- dma_mode: (RO) Transfer modes supported by the device when
+- in DMA mode. Mostly used by PATA device.
++ dma_mode: (RO) DMA transfer mode used by the device.
++ Mostly used by PATA devices.
+
+ class: (RO) Device class. Can be "ata" for disk,
+ "atapi" for packet device, "pmp" for PM, or
+diff --git a/Documentation/conf.py b/Documentation/conf.py
+index 22c1a6d96f9ea..f3cf0111bbd23 100644
+--- a/Documentation/conf.py
++++ b/Documentation/conf.py
+@@ -95,7 +95,7 @@ finally:
+ #
+ # This is also used if you do content translation via gettext catalogs.
+ # Usually you set "language" from the command line for these cases.
+-language = None
++language = 'en'
+
+ # There are two options for replacing |today|: either, you set today to some
+ # non-false value, then it is used:
+diff --git a/Documentation/devicetree/bindings/gpio/gpio-altera.txt b/Documentation/devicetree/bindings/gpio/gpio-altera.txt
+index 146e554b3c676..2a80e272cd666 100644
+--- a/Documentation/devicetree/bindings/gpio/gpio-altera.txt
++++ b/Documentation/devicetree/bindings/gpio/gpio-altera.txt
+@@ -9,8 +9,9 @@ Required properties:
+ - The second cell is reserved and is currently unused.
+ - gpio-controller : Marks the device node as a GPIO controller.
+ - interrupt-controller: Mark the device node as an interrupt controller
+-- #interrupt-cells : Should be 1. The interrupt type is fixed in the hardware.
++- #interrupt-cells : Should be 2. The interrupt type is fixed in the hardware.
+ - The first cell is the GPIO offset number within the GPIO controller.
++ - The second cell is the interrupt trigger type and level flags.
+ - interrupts: Specify the interrupt.
+ - altr,interrupt-type: Specifies the interrupt trigger type the GPIO
+ hardware is synthesized. This field is required if the Altera GPIO controller
+@@ -38,6 +39,6 @@ gpio_altr: gpio@ff200000 {
+ altr,interrupt-type = <IRQ_TYPE_EDGE_RISING>;
+ #gpio-cells = <2>;
+ gpio-controller;
+- #interrupt-cells = <1>;
++ #interrupt-cells = <2>;
+ interrupt-controller;
+ };
+diff --git a/Documentation/hwmon/hwmon-kernel-api.txt b/Documentation/hwmon/hwmon-kernel-api.txt
+index eb7a78aebb380..4981df157b04a 100644
+--- a/Documentation/hwmon/hwmon-kernel-api.txt
++++ b/Documentation/hwmon/hwmon-kernel-api.txt
+@@ -71,7 +71,7 @@ hwmon_device_register_with_info is the most comprehensive and preferred means
+ to register a hardware monitoring device. It creates the standard sysfs
+ attributes in the hardware monitoring core, letting the driver focus on reading
+ from and writing to the chip instead of having to bother with sysfs attributes.
+-The parent device parameter cannot be NULL with non-NULL chip info. Its
++The parent device parameter as well as the chip parameter must not be NULL. Its
+ parameters are described in more detail below.
+
+ devm_hwmon_device_register_with_info is similar to
+diff --git a/Makefile b/Makefile
+index e1cbe6e8bcaef..2e3b43ce8a944 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 246
++SUBLEVEL = 247
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-b.dts b/arch/arm/boot/dts/bcm2835-rpi-b.dts
+index 31ff602e2cd36..6bac18d7c0709 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-b.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-b.dts
+@@ -48,18 +48,17 @@
+ "GPIO18",
+ "NC", /* GPIO19 */
+ "NC", /* GPIO20 */
+- "GPIO21",
++ "CAM_GPIO0",
+ "GPIO22",
+ "GPIO23",
+ "GPIO24",
+ "GPIO25",
+ "NC", /* GPIO26 */
+- "CAM_GPIO0",
+- /* Binary number representing build/revision */
+- "CONFIG0",
+- "CONFIG1",
+- "CONFIG2",
+- "CONFIG3",
++ "GPIO27",
++ "GPIO28",
++ "GPIO29",
++ "GPIO30",
++ "GPIO31",
+ "NC", /* GPIO32 */
+ "NC", /* GPIO33 */
+ "NC", /* GPIO34 */
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+index 9f7145b1cc5eb..3509582f92f1d 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+@@ -77,16 +77,18 @@
+ "GPIO27",
+ "SDA0",
+ "SCL0",
+- "NC", /* GPIO30 */
+- "NC", /* GPIO31 */
+- "NC", /* GPIO32 */
+- "NC", /* GPIO33 */
+- "NC", /* GPIO34 */
+- "NC", /* GPIO35 */
+- "NC", /* GPIO36 */
+- "NC", /* GPIO37 */
+- "NC", /* GPIO38 */
+- "NC", /* GPIO39 */
++ /* Used by BT module */
++ "CTS0",
++ "RTS0",
++ "TXD0",
++ "RXD0",
++ /* Used by Wifi */
++ "SD1_CLK",
++ "SD1_CMD",
++ "SD1_DATA0",
++ "SD1_DATA1",
++ "SD1_DATA2",
++ "SD1_DATA3",
+ "CAM_GPIO1", /* GPIO40 */
+ "WL_ON", /* GPIO41 */
+ "NC", /* GPIO42 */
+diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts
+index 80479ed69070c..95a93ef80d974 100644
+--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts
++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts
+@@ -127,7 +127,7 @@
+ samsung,i2c-max-bus-freq = <20000>;
+
+ eeprom@50 {
+- compatible = "samsung,s524ad0xd1";
++ compatible = "samsung,s524ad0xd1", "atmel,24c128";
+ reg = <0x50>;
+ };
+
+@@ -286,7 +286,7 @@
+ samsung,i2c-max-bus-freq = <20000>;
+
+ eeprom@51 {
+- compatible = "samsung,s524ad0xd1";
++ compatible = "samsung,s524ad0xd1", "atmel,24c128";
+ reg = <0x51>;
+ };
+
+diff --git a/arch/arm/boot/dts/ox820.dtsi b/arch/arm/boot/dts/ox820.dtsi
+index f7dddfb01f81e..d629caf8b98f6 100644
+--- a/arch/arm/boot/dts/ox820.dtsi
++++ b/arch/arm/boot/dts/ox820.dtsi
+@@ -286,7 +286,7 @@
+ clocks = <&armclk>;
+ };
+
+- gic: gic@1000 {
++ gic: interrupt-controller@1000 {
+ compatible = "arm,arm11mp-gic";
+ interrupt-controller;
+ #interrupt-cells = <3>;
+diff --git a/arch/arm/mach-hisi/platsmp.c b/arch/arm/mach-hisi/platsmp.c
+index da5689ababf7b..d7fbfb6d293d7 100644
+--- a/arch/arm/mach-hisi/platsmp.c
++++ b/arch/arm/mach-hisi/platsmp.c
+@@ -70,14 +70,17 @@ static void __init hi3xxx_smp_prepare_cpus(unsigned int max_cpus)
+ }
+ ctrl_base = of_iomap(np, 0);
+ if (!ctrl_base) {
++ of_node_put(np);
+ pr_err("failed to map address\n");
+ return;
+ }
+ if (of_property_read_u32(np, "smp-offset", &offset) < 0) {
++ of_node_put(np);
+ pr_err("failed to find smp-offset property\n");
+ return;
+ }
+ ctrl_base += offset;
++ of_node_put(np);
+ }
+ }
+
+@@ -163,6 +166,7 @@ static int hip01_boot_secondary(unsigned int cpu, struct task_struct *idle)
+ if (WARN_ON(!node))
+ return -1;
+ ctrl_base = of_iomap(node, 0);
++ of_node_put(node);
+
+ /* set the secondary core boot from DDR */
+ remap_reg_value = readl_relaxed(ctrl_base + REG_SC_CTRL);
+diff --git a/arch/arm/mach-omap1/clock.c b/arch/arm/mach-omap1/clock.c
+index fa512413a4717..b277409f303ac 100644
+--- a/arch/arm/mach-omap1/clock.c
++++ b/arch/arm/mach-omap1/clock.c
+@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(clockfw_lock);
+ unsigned long omap1_uart_recalc(struct clk *clk)
+ {
+ unsigned int val = __raw_readl(clk->enable_reg);
+- return val & clk->enable_bit ? 48000000 : 12000000;
++ return val & 1 << clk->enable_bit ? 48000000 : 12000000;
+ }
+
+ unsigned long omap1_sossi_recalc(struct clk *clk)
+diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c
+index ee2a0faafaa19..aaade91f65512 100644
+--- a/arch/arm/mach-vexpress/dcscb.c
++++ b/arch/arm/mach-vexpress/dcscb.c
+@@ -146,6 +146,7 @@ static int __init dcscb_init(void)
+ if (!node)
+ return -ENODEV;
+ dcscb_base = of_iomap(node, 0);
++ of_node_put(node);
+ if (!dcscb_base)
+ return -EADDRNOTAVAIL;
+ cfg = readl_relaxed(dcscb_base + DCS_CFG_R);
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index 18226980f7c32..f48d14cd10a3f 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -490,7 +490,7 @@
+ clocks {
+ sleep_clk: sleep_clk {
+ compatible = "fixed-clock";
+- clock-frequency = <32000>;
++ clock-frequency = <32768>;
+ #clock-cells = <0>;
+ };
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 6876e8205042a..321d3880fe13a 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -938,6 +938,7 @@ skip_init_ctx:
+ bpf_jit_binary_free(header);
+ prog->bpf_func = NULL;
+ prog->jited = 0;
++ prog->jited_len = 0;
+ goto out_off;
+ }
+ bpf_jit_binary_lock_ro(header);
+diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu
+index 21f00349af525..b2fd1e2fbd893 100644
+--- a/arch/m68k/Kconfig.cpu
++++ b/arch/m68k/Kconfig.cpu
+@@ -308,7 +308,7 @@ comment "Processor Specific Options"
+
+ config M68KFPU_EMU
+ bool "Math emulation support"
+- depends on MMU
++ depends on M68KCLASSIC && FPU
+ help
+ At some point in the future, this will cause floating-point math
+ instructions to be emulated by the kernel on machines that lack a
+diff --git a/arch/m68k/Kconfig.machine b/arch/m68k/Kconfig.machine
+index 0c451081432ab..d07f3009a4a0e 100644
+--- a/arch/m68k/Kconfig.machine
++++ b/arch/m68k/Kconfig.machine
+@@ -315,6 +315,7 @@ comment "Machine Options"
+
+ config UBOOT
+ bool "Support for U-Boot command line parameters"
++ depends on COLDFIRE
+ help
+ If you say Y here kernel will try to collect command
+ line parameters from the initial u-boot stack.
+diff --git a/arch/m68k/include/asm/pgtable_no.h b/arch/m68k/include/asm/pgtable_no.h
+index fc3a96c77bd87..12f673707d4b4 100644
+--- a/arch/m68k/include/asm/pgtable_no.h
++++ b/arch/m68k/include/asm/pgtable_no.h
+@@ -42,7 +42,8 @@ extern void paging_init(void);
+ * ZERO_PAGE is a global shared page that is always zero: used
+ * for zero-mapped memory areas etc..
+ */
+-#define ZERO_PAGE(vaddr) (virt_to_page(0))
++extern void *empty_zero_page;
++#define ZERO_PAGE(vaddr) (virt_to_page(empty_zero_page))
+
+ /*
+ * No page table caches to initialise.
+diff --git a/arch/mips/include/asm/mach-ip27/cpu-feature-overrides.h b/arch/mips/include/asm/mach-ip27/cpu-feature-overrides.h
+index 136d6d464e320..93c69fc7bbd8c 100644
+--- a/arch/mips/include/asm/mach-ip27/cpu-feature-overrides.h
++++ b/arch/mips/include/asm/mach-ip27/cpu-feature-overrides.h
+@@ -28,7 +28,6 @@
+ #define cpu_has_6k_cache 0
+ #define cpu_has_8k_cache 0
+ #define cpu_has_tx39_cache 0
+-#define cpu_has_fpu 1
+ #define cpu_has_nofpuex 0
+ #define cpu_has_32fpr 1
+ #define cpu_has_counter 1
+diff --git a/arch/mips/kernel/mips-cpc.c b/arch/mips/kernel/mips-cpc.c
+index fcf9af492d602..cf46502c605e6 100644
+--- a/arch/mips/kernel/mips-cpc.c
++++ b/arch/mips/kernel/mips-cpc.c
+@@ -31,6 +31,7 @@ phys_addr_t __weak mips_cpc_default_phys_base(void)
+ cpc_node = of_find_compatible_node(of_root, NULL, "mti,mips-cpc");
+ if (cpc_node) {
+ err = of_address_to_resource(cpc_node, 0, &res);
++ of_node_put(cpc_node);
+ if (!err)
+ return res.start;
+ }
+diff --git a/arch/openrisc/include/asm/timex.h b/arch/openrisc/include/asm/timex.h
+index 9935cad1b9b93..34d015bf04628 100644
+--- a/arch/openrisc/include/asm/timex.h
++++ b/arch/openrisc/include/asm/timex.h
+@@ -27,6 +27,7 @@ static inline cycles_t get_cycles(void)
+ {
+ return mfspr(SPR_TTCR);
+ }
++#define get_cycles get_cycles
+
+ /* This isn't really used any more */
+ #define CLOCK_TICK_RATE 1000
+diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S
+index 31ed257ff0618..d7e49b9471642 100644
+--- a/arch/openrisc/kernel/head.S
++++ b/arch/openrisc/kernel/head.S
+@@ -525,6 +525,15 @@ _start:
+ l.ori r3,r0,0x1
+ l.mtspr r0,r3,SPR_SR
+
++ /*
++ * Start the TTCR as early as possible, so that the RNG can make use of
++ * measurements of boot time from the earliest opportunity. Especially
++ * important is that the TTCR does not return zero by the time we reach
++ * rand_initialize().
++ */
++ l.movhi r3,hi(SPR_TTMR_CR)
++ l.mtspr r0,r3,SPR_TTMR
++
+ CLEAR_GPR(r1)
+ CLEAR_GPR(r2)
+ CLEAR_GPR(r3)
+diff --git a/arch/powerpc/kernel/idle.c b/arch/powerpc/kernel/idle.c
+index d7216c9abda15..ca79aacfeda2a 100644
+--- a/arch/powerpc/kernel/idle.c
++++ b/arch/powerpc/kernel/idle.c
+@@ -41,7 +41,7 @@ static int __init powersave_off(char *arg)
+ {
+ ppc_md.power_save = NULL;
+ cpuidle_disable = IDLE_POWERSAVE_OFF;
+- return 0;
++ return 1;
+ }
+ __setup("powersave=off", powersave_off);
+
+diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
+index e08b32ccf1d96..073117ba75fea 100644
+--- a/arch/powerpc/kernel/ptrace.c
++++ b/arch/powerpc/kernel/ptrace.c
+@@ -3007,8 +3007,13 @@ long arch_ptrace(struct task_struct *child, long request,
+
+ flush_fp_to_thread(child);
+ if (fpidx < (PT_FPSCR - PT_FPR0))
+- memcpy(&tmp, &child->thread.TS_FPR(fpidx),
+- sizeof(long));
++ if (IS_ENABLED(CONFIG_PPC32)) {
++ // On 32-bit the index we are passed refers to 32-bit words
++ tmp = ((u32 *)child->thread.fp_state.fpr)[fpidx];
++ } else {
++ memcpy(&tmp, &child->thread.TS_FPR(fpidx),
++ sizeof(long));
++ }
+ else
+ tmp = child->thread.fp_state.fpscr;
+ }
+@@ -3040,8 +3045,13 @@ long arch_ptrace(struct task_struct *child, long request,
+
+ flush_fp_to_thread(child);
+ if (fpidx < (PT_FPSCR - PT_FPR0))
+- memcpy(&child->thread.TS_FPR(fpidx), &data,
+- sizeof(long));
++ if (IS_ENABLED(CONFIG_PPC32)) {
++ // On 32-bit the index we are passed refers to 32-bit words
++ ((u32 *)child->thread.fp_state.fpr)[fpidx] = data;
++ } else {
++ memcpy(&child->thread.TS_FPR(fpidx), &data,
++ sizeof(long));
++ }
+ else
+ child->thread.fp_state.fpscr = data;
+ ret = 0;
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index a1ff4142cc6a4..08f2227761f60 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -322,7 +322,8 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+ if (event_is_threshold(event) && is_thresh_cmp_valid(event)) {
+ mask |= CNST_THRESH_MASK;
+ value |= CNST_THRESH_VAL(event >> EVENT_THRESH_SHIFT);
+- }
++ } else if (event_is_threshold(event))
++ return -1;
+ } else {
+ /*
+ * Special case for PM_MRK_FAB_RSP_MATCH and PM_MRK_FAB_RSP_MATCH_CYC,
+diff --git a/arch/powerpc/platforms/4xx/cpm.c b/arch/powerpc/platforms/4xx/cpm.c
+index 53ff81ca8a3ce..6400ae3762168 100644
+--- a/arch/powerpc/platforms/4xx/cpm.c
++++ b/arch/powerpc/platforms/4xx/cpm.c
+@@ -341,6 +341,6 @@ late_initcall(cpm_init);
+ static int __init cpm_powersave_off(char *arg)
+ {
+ cpm.powersave_off = 1;
+- return 0;
++ return 1;
+ }
+ __setup("powersave=off", cpm_powersave_off);
+diff --git a/arch/powerpc/sysdev/cpm1.c b/arch/powerpc/sysdev/cpm1.c
+index 4f8dcf124828e..f5b1ea2d65248 100644
+--- a/arch/powerpc/sysdev/cpm1.c
++++ b/arch/powerpc/sysdev/cpm1.c
+@@ -290,6 +290,7 @@ cpm_setbrg(uint brg, uint rate)
+ out_be32(bp, (((BRG_UART_CLK_DIV16 / rate) - 1) << 1) |
+ CPM_BRG_EN | CPM_BRG_DIV16);
+ }
++EXPORT_SYMBOL(cpm_setbrg);
+
+ struct cpm_ioport16 {
+ __be16 dir, par, odr_sor, dat, intr;
+diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
+index 5011ffea4e4b3..c48ebe6779622 100644
+--- a/arch/powerpc/sysdev/fsl_rio.c
++++ b/arch/powerpc/sysdev/fsl_rio.c
+@@ -509,8 +509,10 @@ int fsl_rio_setup(struct platform_device *dev)
+ if (rc) {
+ dev_err(&dev->dev, "Can't get %pOF property 'reg'\n",
+ rmu_node);
++ of_node_put(rmu_node);
+ goto err_rmu;
+ }
++ of_node_put(rmu_node);
+ rmu_regs_win = ioremap(rmu_regs.start, resource_size(&rmu_regs));
+ if (!rmu_regs_win) {
+ dev_err(&dev->dev, "Unable to map rmu register window\n");
+diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
+index e3e52cf035a92..672d8aedae126 100644
+--- a/arch/powerpc/sysdev/xics/icp-opal.c
++++ b/arch/powerpc/sysdev/xics/icp-opal.c
+@@ -199,6 +199,7 @@ int icp_opal_init(void)
+
+ printk("XICS: Using OPAL ICP fallbacks\n");
+
++ of_node_put(np);
+ return 0;
+ }
+
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index 2bc189187ed40..c663caf37ba4f 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -861,7 +861,7 @@ static inline void _gcm_sg_unmap_and_advance(struct gcm_sg_walk *gw,
+ unsigned int nbytes)
+ {
+ gw->walk_bytes_remain -= nbytes;
+- scatterwalk_unmap(&gw->walk);
++ scatterwalk_unmap(gw->walk_ptr);
+ scatterwalk_advance(&gw->walk, nbytes);
+ scatterwalk_done(&gw->walk, 0, gw->walk_bytes_remain);
+ gw->walk_ptr = NULL;
+@@ -936,7 +936,7 @@ static int gcm_out_walk_go(struct gcm_sg_walk *gw, unsigned int minbytesneeded)
+ goto out;
+ }
+
+- scatterwalk_unmap(&gw->walk);
++ scatterwalk_unmap(gw->walk_ptr);
+ gw->walk_ptr = NULL;
+
+ gw->ptr = gw->buf;
+diff --git a/arch/s390/include/asm/preempt.h b/arch/s390/include/asm/preempt.h
+index 23a14d187fb1b..1aebf09fbcd83 100644
+--- a/arch/s390/include/asm/preempt.h
++++ b/arch/s390/include/asm/preempt.h
+@@ -50,10 +50,17 @@ static inline bool test_preempt_need_resched(void)
+
+ static inline void __preempt_count_add(int val)
+ {
+- if (__builtin_constant_p(val) && (val >= -128) && (val <= 127))
+- __atomic_add_const(val, &S390_lowcore.preempt_count);
+- else
+- __atomic_add(val, &S390_lowcore.preempt_count);
++ /*
++ * With some obscure config options and CONFIG_PROFILE_ALL_BRANCHES
++ * enabled, gcc 12 fails to handle __builtin_constant_p().
++ */
++ if (!IS_ENABLED(CONFIG_PROFILE_ALL_BRANCHES)) {
++ if (__builtin_constant_p(val) && (val >= -128) && (val <= 127)) {
++ __atomic_add_const(val, &S390_lowcore.preempt_count);
++ return;
++ }
++ }
++ __atomic_add(val, &S390_lowcore.preempt_count);
+ }
+
+ static inline void __preempt_count_sub(int val)
+diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
+index 669124d5290b8..b3f320a129e3a 100644
+--- a/arch/um/drivers/chan_user.c
++++ b/arch/um/drivers/chan_user.c
+@@ -220,7 +220,7 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out,
+ unsigned long *stack_out)
+ {
+ struct winch_data data;
+- int fds[2], n, err;
++ int fds[2], n, err, pid;
+ char c;
+
+ err = os_pipe(fds, 1, 1);
+@@ -238,8 +238,9 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out,
+ * problem with /dev/net/tun, which if held open by this
+ * thread, prevents the TUN/TAP device from being reused.
+ */
+- err = run_helper_thread(winch_thread, &data, CLONE_FILES, stack_out);
+- if (err < 0) {
++ pid = run_helper_thread(winch_thread, &data, CLONE_FILES, stack_out);
++ if (pid < 0) {
++ err = pid;
+ printk(UM_KERN_ERR "fork of winch_thread failed - errno = %d\n",
+ -err);
+ goto out_close;
+@@ -263,7 +264,7 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out,
+ goto out_close;
+ }
+
+- return err;
++ return pid;
+
+ out_close:
+ close(fds[1]);
+diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c
+index 46caca4d9141b..a1c31bb23170c 100644
+--- a/arch/x86/entry/vdso/vma.c
++++ b/arch/x86/entry/vdso/vma.c
+@@ -329,7 +329,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+ static __init int vdso_setup(char *s)
+ {
+ vdso64_enabled = simple_strtoul(s, NULL, 0);
+- return 0;
++ return 1;
+ }
+ __setup("vdso=", vdso_setup);
+ #endif
+diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
+index 2d9e1372b070c..d157d0adef06e 100644
+--- a/arch/x86/events/amd/ibs.c
++++ b/arch/x86/events/amd/ibs.c
+@@ -324,6 +324,16 @@ static int perf_ibs_init(struct perf_event *event)
+ hwc->config_base = perf_ibs->msr;
+ hwc->config = config;
+
++ /*
++ * rip recorded by IbsOpRip will not be consistent with rsp and rbp
++ * recorded as part of interrupt regs. Thus we need to use rip from
++ * interrupt regs while unwinding call stack. Setting _EARLY flag
++ * makes sure we unwind call-stack before perf sample rip is set to
++ * IbsOpRip.
++ */
++ if (event->attr.sample_type & PERF_SAMPLE_CALLCHAIN)
++ event->attr.sample_type |= __PERF_SAMPLE_CALLCHAIN_EARLY;
++
+ return 0;
+ }
+
+@@ -693,6 +703,14 @@ fail:
+ data.raw = &raw;
+ }
+
++ /*
++ * rip recorded by IbsOpRip will not be consistent with rsp and rbp
++ * recorded as part of interrupt regs. Thus we need to use rip from
++ * interrupt regs while unwinding call stack.
++ */
++ if (event->attr.sample_type & PERF_SAMPLE_CALLCHAIN)
++ data.callchain = perf_callchain(event, iregs);
++
+ throttle = perf_event_overflow(event, &data, ®s);
+ out:
+ if (throttle) {
+diff --git a/arch/x86/include/asm/acenv.h b/arch/x86/include/asm/acenv.h
+index 1b010a859b8b4..6de59a4f723ca 100644
+--- a/arch/x86/include/asm/acenv.h
++++ b/arch/x86/include/asm/acenv.h
+@@ -16,7 +16,19 @@
+
+ /* Asm macros */
+
+-#define ACPI_FLUSH_CPU_CACHE() wbinvd()
++/*
++ * ACPI_FLUSH_CPU_CACHE() flushes caches on entering sleep states.
++ * It is required to prevent data loss.
++ *
++ * While running inside virtual machine, the kernel can bypass cache flushing.
++ * Changing sleep state in a virtual machine doesn't affect the host system
++ * sleep state and cannot lead to data loss.
++ */
++#define ACPI_FLUSH_CPU_CACHE() \
++do { \
++ if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) \
++ wbinvd(); \
++} while (0)
+
+ int __acpi_acquire_global_lock(unsigned int *lock);
+ int __acpi_release_global_lock(unsigned int *lock);
+diff --git a/arch/x86/include/asm/suspend_32.h b/arch/x86/include/asm/suspend_32.h
+index 8be6afb584715..32662cbaa27e8 100644
+--- a/arch/x86/include/asm/suspend_32.h
++++ b/arch/x86/include/asm/suspend_32.h
+@@ -21,7 +21,6 @@ struct saved_context {
+ #endif
+ unsigned long cr0, cr2, cr3, cr4;
+ u64 misc_enable;
+- bool misc_enable_saved;
+ struct saved_msrs saved_msrs;
+ struct desc_ptr gdt_desc;
+ struct desc_ptr idt;
+@@ -30,6 +29,7 @@ struct saved_context {
+ unsigned long tr;
+ unsigned long safety;
+ unsigned long return_address;
++ bool misc_enable_saved;
+ } __attribute__((packed));
+
+ #endif /* _ASM_X86_SUSPEND_32_H */
+diff --git a/arch/x86/include/asm/suspend_64.h b/arch/x86/include/asm/suspend_64.h
+index a7af9f53c0cb7..b2861400c6a2d 100644
+--- a/arch/x86/include/asm/suspend_64.h
++++ b/arch/x86/include/asm/suspend_64.h
+@@ -14,9 +14,13 @@
+ * Image of the saved processor state, used by the low level ACPI suspend to
+ * RAM code and by the low level hibernation code.
+ *
+- * If you modify it, fix arch/x86/kernel/acpi/wakeup_64.S and make sure that
+- * __save/__restore_processor_state(), defined in arch/x86/kernel/suspend_64.c,
+- * still work as required.
++ * If you modify it, check how it is used in arch/x86/kernel/acpi/wakeup_64.S
++ * and make sure that __save/__restore_processor_state(), defined in
++ * arch/x86/power/cpu.c, still work as required.
++ *
++ * Because the structure is packed, make sure to avoid unaligned members. For
++ * optimisation purposes but also because tools like kmemleak only search for
++ * pointers that are aligned.
+ */
+ struct saved_context {
+ struct pt_regs regs;
+@@ -36,7 +40,6 @@ struct saved_context {
+
+ unsigned long cr0, cr2, cr3, cr4, cr8;
+ u64 misc_enable;
+- bool misc_enable_saved;
+ struct saved_msrs saved_msrs;
+ unsigned long efer;
+ u16 gdt_pad; /* Unused */
+@@ -48,6 +51,7 @@ struct saved_context {
+ unsigned long tr;
+ unsigned long safety;
+ unsigned long return_address;
++ bool misc_enable_saved;
+ } __attribute__((packed));
+
+ #define loaddebug(thread,register) \
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 9791828f3fcdd..926939978c1c3 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -166,7 +166,7 @@ static __init int setup_apicpmtimer(char *s)
+ {
+ apic_calibrate_pmtmr = 1;
+ notsc_setup(NULL);
+- return 0;
++ return 1;
+ }
+ __setup("apicpmtimer", setup_apicpmtimer);
+ #endif
+diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
+index a5287b18a63f5..76692590eff86 100644
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -71,7 +71,7 @@ static bool ring3mwait_disabled __read_mostly;
+ static int __init ring3mwait_disable(char *__unused)
+ {
+ ring3mwait_disabled = true;
+- return 0;
++ return 1;
+ }
+ __setup("ring3mwait=disable", ring3mwait_disable);
+
+diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
+index 60d2c3798ba28..2f97d1a1032f3 100644
+--- a/arch/x86/kernel/step.c
++++ b/arch/x86/kernel/step.c
+@@ -175,8 +175,7 @@ void set_task_blockstep(struct task_struct *task, bool on)
+ *
+ * NOTE: this means that set/clear TIF_BLOCKSTEP is only safe if
+ * task is current or it can't be running, otherwise we can race
+- * with __switch_to_xtra(). We rely on ptrace_freeze_traced() but
+- * PTRACE_KILL is not safe.
++ * with __switch_to_xtra(). We rely on ptrace_freeze_traced().
+ */
+ local_irq_disable();
+ debugctl = get_debugctlmsr();
+diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
+index 6a78d4b36a797..9fb266c797fb6 100644
+--- a/arch/x86/kernel/sys_x86_64.c
++++ b/arch/x86/kernel/sys_x86_64.c
+@@ -70,9 +70,6 @@ static int __init control_va_addr_alignment(char *str)
+ if (*str == 0)
+ return 1;
+
+- if (*str == '=')
+- str++;
+-
+ if (!strcmp(str, "32"))
+ va_align.flags = ALIGN_VA_32;
+ else if (!strcmp(str, "64"))
+@@ -82,11 +79,11 @@ static int __init control_va_addr_alignment(char *str)
+ else if (!strcmp(str, "on"))
+ va_align.flags = ALIGN_VA_32 | ALIGN_VA_64;
+ else
+- return 0;
++ pr_warn("invalid option value: 'align_va_addr=%s'\n", str);
+
+ return 1;
+ }
+-__setup("align_va_addr", control_va_addr_alignment);
++__setup("align_va_addr=", control_va_addr_alignment);
+
+ SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len,
+ unsigned long, prot, unsigned long, flags,
+diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
+index 614c2c6b19590..68ca883abfdb0 100644
+--- a/arch/x86/lib/delay.c
++++ b/arch/x86/lib/delay.c
+@@ -43,8 +43,8 @@ static void delay_loop(unsigned long loops)
+ " jnz 2b \n"
+ "3: dec %0 \n"
+
+- : /* we don't need output */
+- :"a" (loops)
++ : "+a" (loops)
++ :
+ );
+ }
+
+diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
+index 324e26d0607ba..b33304c0042a5 100644
+--- a/arch/x86/mm/pat.c
++++ b/arch/x86/mm/pat.c
+@@ -74,7 +74,7 @@ int pat_debug_enable;
+ static int __init pat_debug_setup(char *str)
+ {
+ pat_debug_enable = 1;
+- return 0;
++ return 1;
+ }
+ __setup("debugpat", pat_debug_setup);
+
+diff --git a/arch/x86/um/ldt.c b/arch/x86/um/ldt.c
+index 3ee234b6234dd..255a44dd415a9 100644
+--- a/arch/x86/um/ldt.c
++++ b/arch/x86/um/ldt.c
+@@ -23,9 +23,11 @@ static long write_ldt_entry(struct mm_id *mm_idp, int func,
+ {
+ long res;
+ void *stub_addr;
++
++ BUILD_BUG_ON(sizeof(*desc) % sizeof(long));
++
+ res = syscall_stub_data(mm_idp, (unsigned long *)desc,
+- (sizeof(*desc) + sizeof(long) - 1) &
+- ~(sizeof(long) - 1),
++ sizeof(*desc) / sizeof(long),
+ addr, &stub_addr);
+ if (!res) {
+ unsigned long args[] = { func,
+diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
+index d9541be0605ad..3cfcbdc456aec 100644
+--- a/arch/xtensa/kernel/ptrace.c
++++ b/arch/xtensa/kernel/ptrace.c
+@@ -35,12 +35,12 @@
+
+ void user_enable_single_step(struct task_struct *child)
+ {
+- child->ptrace |= PT_SINGLESTEP;
++ set_tsk_thread_flag(child, TIF_SINGLESTEP);
+ }
+
+ void user_disable_single_step(struct task_struct *child)
+ {
+- child->ptrace &= ~PT_SINGLESTEP;
++ clear_tsk_thread_flag(child, TIF_SINGLESTEP);
+ }
+
+ /*
+diff --git a/arch/xtensa/kernel/signal.c b/arch/xtensa/kernel/signal.c
+index f88e7a0b232cb..72039bd61b726 100644
+--- a/arch/xtensa/kernel/signal.c
++++ b/arch/xtensa/kernel/signal.c
+@@ -455,7 +455,7 @@ static void do_signal(struct pt_regs *regs)
+ /* Set up the stack frame */
+ ret = setup_frame(&ksig, sigmask_to_save(), regs);
+ signal_setup_done(ret, &ksig, 0);
+- if (current->ptrace & PT_SINGLESTEP)
++ if (test_thread_flag(TIF_SINGLESTEP))
+ task_pt_regs(current)->icountlevel = 1;
+
+ return;
+@@ -481,7 +481,7 @@ static void do_signal(struct pt_regs *regs)
+ /* If there's no signal to deliver, we just restore the saved mask. */
+ restore_saved_sigmask();
+
+- if (current->ptrace & PT_SINGLESTEP)
++ if (test_thread_flag(TIF_SINGLESTEP))
+ task_pt_regs(current)->icountlevel = 1;
+ return;
+ }
+diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
+index 019cf002eceec..a4cea7389b534 100644
+--- a/block/blk-iolatency.c
++++ b/block/blk-iolatency.c
+@@ -85,7 +85,17 @@ struct iolatency_grp;
+ struct blk_iolatency {
+ struct rq_qos rqos;
+ struct timer_list timer;
+- atomic_t enabled;
++
++ /*
++ * ->enabled is the master enable switch gating the throttling logic and
++ * inflight tracking. The number of cgroups which have iolat enabled is
++ * tracked in ->enable_cnt, and ->enable is flipped on/off accordingly
++ * from ->enable_work with the request_queue frozen. For details, See
++ * blkiolatency_enable_work_fn().
++ */
++ bool enabled;
++ atomic_t enable_cnt;
++ struct work_struct enable_work;
+ };
+
+ static inline struct blk_iolatency *BLKIOLATENCY(struct rq_qos *rqos)
+@@ -93,11 +103,6 @@ static inline struct blk_iolatency *BLKIOLATENCY(struct rq_qos *rqos)
+ return container_of(rqos, struct blk_iolatency, rqos);
+ }
+
+-static inline bool blk_iolatency_enabled(struct blk_iolatency *blkiolat)
+-{
+- return atomic_read(&blkiolat->enabled) > 0;
+-}
+-
+ struct child_latency_info {
+ spinlock_t lock;
+
+@@ -402,7 +407,7 @@ static void blkcg_iolatency_throttle(struct rq_qos *rqos, struct bio *bio,
+ struct request_queue *q = rqos->q;
+ bool issue_as_root = bio_issue_as_root_blkg(bio);
+
+- if (!blk_iolatency_enabled(blkiolat))
++ if (!blkiolat->enabled)
+ return;
+
+ rcu_read_lock();
+@@ -559,7 +564,6 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+ u64 window_start;
+ u64 now = ktime_to_ns(ktime_get());
+ bool issue_as_root = bio_issue_as_root_blkg(bio);
+- bool enabled = false;
+ int inflight = 0;
+
+ blkg = bio->bi_blkg;
+@@ -570,8 +574,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+ if (!iolat)
+ return;
+
+- enabled = blk_iolatency_enabled(iolat->blkiolat);
+- if (!enabled)
++ if (!iolat->blkiolat->enabled)
+ return;
+
+ while (blkg && blkg->parent) {
+@@ -609,6 +612,7 @@ static void blkcg_iolatency_exit(struct rq_qos *rqos)
+ struct blk_iolatency *blkiolat = BLKIOLATENCY(rqos);
+
+ del_timer_sync(&blkiolat->timer);
++ flush_work(&blkiolat->enable_work);
+ blkcg_deactivate_policy(rqos->q, &blkcg_policy_iolatency);
+ kfree(blkiolat);
+ }
+@@ -680,6 +684,44 @@ next:
+ rcu_read_unlock();
+ }
+
++/**
++ * blkiolatency_enable_work_fn - Enable or disable iolatency on the device
++ * @work: enable_work of the blk_iolatency of interest
++ *
++ * iolatency needs to keep track of the number of in-flight IOs per cgroup. This
++ * is relatively expensive as it involves walking up the hierarchy twice for
++ * every IO. Thus, if iolatency is not enabled in any cgroup for the device, we
++ * want to disable the in-flight tracking.
++ *
++ * We have to make sure that the counting is balanced - we don't want to leak
++ * the in-flight counts by disabling accounting in the completion path while IOs
++ * are in flight. This is achieved by ensuring that no IO is in flight by
++ * freezing the queue while flipping ->enabled. As this requires a sleepable
++ * context, ->enabled flipping is punted to this work function.
++ */
++static void blkiolatency_enable_work_fn(struct work_struct *work)
++{
++ struct blk_iolatency *blkiolat = container_of(work, struct blk_iolatency,
++ enable_work);
++ bool enabled;
++
++ /*
++ * There can only be one instance of this function running for @blkiolat
++ * and it's guaranteed to be executed at least once after the latest
++ * ->enabled_cnt modification. Acting on the latest ->enable_cnt is
++ * sufficient.
++ *
++ * Also, we know @blkiolat is safe to access as ->enable_work is flushed
++ * in blkcg_iolatency_exit().
++ */
++ enabled = atomic_read(&blkiolat->enable_cnt);
++ if (enabled != blkiolat->enabled) {
++ blk_mq_freeze_queue(blkiolat->rqos.q);
++ blkiolat->enabled = enabled;
++ blk_mq_unfreeze_queue(blkiolat->rqos.q);
++ }
++}
++
+ int blk_iolatency_init(struct request_queue *q)
+ {
+ struct blk_iolatency *blkiolat;
+@@ -705,17 +747,15 @@ int blk_iolatency_init(struct request_queue *q)
+ }
+
+ timer_setup(&blkiolat->timer, blkiolatency_timer_fn, 0);
++ INIT_WORK(&blkiolat->enable_work, blkiolatency_enable_work_fn);
+
+ return 0;
+ }
+
+-/*
+- * return 1 for enabling iolatency, return -1 for disabling iolatency, otherwise
+- * return 0.
+- */
+-static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val)
++static void iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val)
+ {
+ struct iolatency_grp *iolat = blkg_to_lat(blkg);
++ struct blk_iolatency *blkiolat = iolat->blkiolat;
+ u64 oldval = iolat->min_lat_nsec;
+
+ iolat->min_lat_nsec = val;
+@@ -723,13 +763,15 @@ static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val)
+ iolat->cur_win_nsec = min_t(u64, iolat->cur_win_nsec,
+ BLKIOLATENCY_MAX_WIN_SIZE);
+
+- if (!oldval && val)
+- return 1;
++ if (!oldval && val) {
++ if (atomic_inc_return(&blkiolat->enable_cnt) == 1)
++ schedule_work(&blkiolat->enable_work);
++ }
+ if (oldval && !val) {
+ blkcg_clear_delay(blkg);
+- return -1;
++ if (atomic_dec_return(&blkiolat->enable_cnt) == 0)
++ schedule_work(&blkiolat->enable_work);
+ }
+- return 0;
+ }
+
+ static void iolatency_clear_scaling(struct blkcg_gq *blkg)
+@@ -762,7 +804,6 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf,
+ u64 lat_val = 0;
+ u64 oldval;
+ int ret;
+- int enable = 0;
+
+ ret = blkg_conf_prep(blkcg, &blkcg_policy_iolatency, buf, &ctx);
+ if (ret)
+@@ -798,41 +839,12 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf,
+ blkg = ctx.blkg;
+ oldval = iolat->min_lat_nsec;
+
+- enable = iolatency_set_min_lat_nsec(blkg, lat_val);
+- if (enable) {
+- if (!blk_get_queue(blkg->q)) {
+- ret = -ENODEV;
+- goto out;
+- }
+-
+- blkg_get(blkg);
+- }
+-
+- if (oldval != iolat->min_lat_nsec) {
++ iolatency_set_min_lat_nsec(blkg, lat_val);
++ if (oldval != iolat->min_lat_nsec)
+ iolatency_clear_scaling(blkg);
+- }
+-
+ ret = 0;
+ out:
+ blkg_conf_finish(&ctx);
+- if (ret == 0 && enable) {
+- struct iolatency_grp *tmp = blkg_to_lat(blkg);
+- struct blk_iolatency *blkiolat = tmp->blkiolat;
+-
+- blk_mq_freeze_queue(blkg->q);
+-
+- if (enable == 1)
+- atomic_inc(&blkiolat->enabled);
+- else if (enable == -1)
+- atomic_dec(&blkiolat->enabled);
+- else
+- WARN_ON_ONCE(1);
+-
+- blk_mq_unfreeze_queue(blkg->q);
+-
+- blkg_put(blkg);
+- blk_put_queue(blkg->q);
+- }
+ return ret ?: nbytes;
+ }
+
+@@ -932,14 +944,8 @@ static void iolatency_pd_offline(struct blkg_policy_data *pd)
+ {
+ struct iolatency_grp *iolat = pd_to_lat(pd);
+ struct blkcg_gq *blkg = lat_to_blkg(iolat);
+- struct blk_iolatency *blkiolat = iolat->blkiolat;
+- int ret;
+
+- ret = iolatency_set_min_lat_nsec(blkg, 0);
+- if (ret == 1)
+- atomic_inc(&blkiolat->enabled);
+- if (ret == -1)
+- atomic_dec(&blkiolat->enabled);
++ iolatency_set_min_lat_nsec(blkg, 0);
+ iolatency_clear_scaling(blkg);
+ }
+
+diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
+index a0b0b4d986f20..43a91495ee678 100644
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -196,7 +196,7 @@ static struct {
+ { XFER_PIO_0, "XFER_PIO_0" },
+ { XFER_PIO_SLOW, "XFER_PIO_SLOW" }
+ };
+-ata_bitfield_name_match(xfer,ata_xfer_names)
++ata_bitfield_name_search(xfer, ata_xfer_names)
+
+ /*
+ * ATA Port attributes
+diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c
+index ac3b1fda820ff..c240d8cbfd417 100644
+--- a/drivers/ata/pata_octeon_cf.c
++++ b/drivers/ata/pata_octeon_cf.c
+@@ -888,12 +888,14 @@ static int octeon_cf_probe(struct platform_device *pdev)
+ int i;
+ res_dma = platform_get_resource(dma_dev, IORESOURCE_MEM, 0);
+ if (!res_dma) {
++ put_device(&dma_dev->dev);
+ of_node_put(dma_node);
+ return -EINVAL;
+ }
+ cf_port->dma_base = (u64)devm_ioremap_nocache(&pdev->dev, res_dma->start,
+ resource_size(res_dma));
+ if (!cf_port->dma_base) {
++ put_device(&dma_dev->dev);
+ of_node_put(dma_node);
+ return -EINVAL;
+ }
+@@ -903,6 +905,7 @@ static int octeon_cf_probe(struct platform_device *pdev)
+ irq = i;
+ irq_handler = octeon_cf_interrupt;
+ }
++ put_device(&dma_dev->dev);
+ }
+ of_node_put(dma_node);
+ }
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 503e2f90e58ef..60c2e32f9f614 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -339,6 +339,7 @@ static int register_node(struct node *node, int num)
+ */
+ void unregister_node(struct node *node)
+ {
++ compaction_unregister_node(node);
+ hugetlb_unregister_node(node); /* no-op, if memoryless node */
+
+ device_unregister(&node->dev);
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 81b955670b120..2ef7eec6461c0 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1288,7 +1288,7 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
+ static void nbd_clear_sock_ioctl(struct nbd_device *nbd,
+ struct block_device *bdev)
+ {
+- sock_shutdown(nbd);
++ nbd_clear_sock(nbd);
+ __invalidate_device(bdev, true);
+ nbd_bdev_reset(bdev);
+ if (test_and_clear_bit(NBD_HAS_CONFIG_REF,
+@@ -1395,15 +1395,20 @@ static struct nbd_config *nbd_alloc_config(void)
+ {
+ struct nbd_config *config;
+
++ if (!try_module_get(THIS_MODULE))
++ return ERR_PTR(-ENODEV);
++
+ config = kzalloc(sizeof(struct nbd_config), GFP_NOFS);
+- if (!config)
+- return NULL;
++ if (!config) {
++ module_put(THIS_MODULE);
++ return ERR_PTR(-ENOMEM);
++ }
++
+ atomic_set(&config->recv_threads, 0);
+ init_waitqueue_head(&config->recv_wq);
+ init_waitqueue_head(&config->conn_wait);
+ config->blksize = NBD_DEF_BLKSIZE;
+ atomic_set(&config->live_connections, 0);
+- try_module_get(THIS_MODULE);
+ return config;
+ }
+
+@@ -1430,12 +1435,13 @@ static int nbd_open(struct block_device *bdev, fmode_t mode)
+ mutex_unlock(&nbd->config_lock);
+ goto out;
+ }
+- config = nbd->config = nbd_alloc_config();
+- if (!config) {
+- ret = -ENOMEM;
++ config = nbd_alloc_config();
++ if (IS_ERR(config)) {
++ ret = PTR_ERR(config);
+ mutex_unlock(&nbd->config_lock);
+ goto out;
+ }
++ nbd->config = config;
+ refcount_set(&nbd->config_refs, 1);
+ refcount_inc(&nbd->refs);
+ mutex_unlock(&nbd->config_lock);
+@@ -1820,13 +1826,14 @@ again:
+ nbd_put(nbd);
+ return -EINVAL;
+ }
+- config = nbd->config = nbd_alloc_config();
+- if (!nbd->config) {
++ config = nbd_alloc_config();
++ if (IS_ERR(config)) {
+ mutex_unlock(&nbd->config_lock);
+ nbd_put(nbd);
+ printk(KERN_ERR "nbd: couldn't allocate config\n");
+- return -ENOMEM;
++ return PTR_ERR(config);
+ }
++ nbd->config = config;
+ refcount_set(&nbd->config_refs, 1);
+ set_bit(NBD_BOUND, &config->runtime_flags);
+
+@@ -2337,6 +2344,12 @@ static void __exit nbd_cleanup(void)
+ struct nbd_device *nbd;
+ LIST_HEAD(del_list);
+
++ /*
++ * Unregister netlink interface prior to waiting
++ * for the completion of netlink commands.
++ */
++ genl_unregister_family(&nbd_genl_family);
++
+ nbd_dbg_close();
+
+ mutex_lock(&nbd_index_mutex);
+@@ -2346,13 +2359,15 @@ static void __exit nbd_cleanup(void)
+ while (!list_empty(&del_list)) {
+ nbd = list_first_entry(&del_list, struct nbd_device, list);
+ list_del_init(&nbd->list);
++ if (refcount_read(&nbd->config_refs))
++ printk(KERN_ERR "nbd: possibly leaking nbd_config (ref %d)\n",
++ refcount_read(&nbd->config_refs));
+ if (refcount_read(&nbd->refs) != 1)
+ printk(KERN_ERR "nbd: possibly leaking a device\n");
+ nbd_put(nbd);
+ }
+
+ idr_destroy(&nbd_index_idr);
+- genl_unregister_family(&nbd_genl_family);
+ unregister_blkdev(NBD_MAJOR, "nbd");
+ }
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index b6a278183d827..bc274ddb9767c 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -1801,7 +1801,9 @@ static int sysc_remove(struct platform_device *pdev)
+ struct sysc *ddata = platform_get_drvdata(pdev);
+ int error;
+
+- cancel_delayed_work_sync(&ddata->idle_work);
++ /* Device can still be enabled, see deferred idle quirk in probe */
++ if (cancel_delayed_work_sync(&ddata->idle_work))
++ ti_sysc_idle(&ddata->idle_work.work);
+
+ error = pm_runtime_get_sync(ddata->dev);
+ if (error < 0) {
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index fec679433f72d..fd1a487443f02 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -801,6 +801,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ break;
+
+ case SSIF_GETTING_EVENTS:
++ if (!msg) {
++ /* Should never happen, but just in case. */
++ dev_warn(&ssif_info->client->dev,
++ "No message set while getting events\n");
++ ipmi_ssif_unlock_cond(ssif_info, flags);
++ break;
++ }
++
+ if ((result < 0) || (len < 3) || (msg->rsp[2] != 0)) {
+ /* Error getting event, probably done. */
+ msg->done(msg);
+@@ -824,6 +832,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ break;
+
+ case SSIF_GETTING_MESSAGES:
++ if (!msg) {
++ /* Should never happen, but just in case. */
++ dev_warn(&ssif_info->client->dev,
++ "No message set while getting messages\n");
++ ipmi_ssif_unlock_cond(ssif_info, flags);
++ break;
++ }
++
+ if ((result < 0) || (len < 3) || (msg->rsp[2] != 0)) {
+ /* Error getting event, probably done. */
+ msg->done(msg);
+@@ -846,6 +862,13 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ deliver_recv_msg(ssif_info, msg);
+ }
+ break;
++
++ default:
++ /* Should never happen, but just in case. */
++ dev_warn(&ssif_info->client->dev,
++ "Invalid state in message done handling: %d\n",
++ ssif_info->ssif_state);
++ ipmi_ssif_unlock_cond(ssif_info, flags);
+ }
+
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+diff --git a/drivers/clocksource/riscv_timer.c b/drivers/clocksource/riscv_timer.c
+index 4e8b347e43e2e..0d5b99ca3bbde 100644
+--- a/drivers/clocksource/riscv_timer.c
++++ b/drivers/clocksource/riscv_timer.c
+@@ -33,7 +33,7 @@ static int riscv_clock_next_event(unsigned long delta,
+
+ static DEFINE_PER_CPU(struct clock_event_device, riscv_clock_event) = {
+ .name = "riscv_timer_clockevent",
+- .features = CLOCK_EVT_FEAT_ONESHOT,
++ .features = CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_C3STOP,
+ .rating = 100,
+ .set_next_event = riscv_clock_next_event,
+ };
+diff --git a/drivers/clocksource/timer-oxnas-rps.c b/drivers/clocksource/timer-oxnas-rps.c
+index 30c6f4ce672b3..cfcd54e66c576 100644
+--- a/drivers/clocksource/timer-oxnas-rps.c
++++ b/drivers/clocksource/timer-oxnas-rps.c
+@@ -247,7 +247,7 @@ static int __init oxnas_rps_timer_init(struct device_node *np)
+ }
+
+ rps->irq = irq_of_parse_and_map(np, 0);
+- if (rps->irq < 0) {
++ if (!rps->irq) {
+ ret = -EINVAL;
+ goto err_iomap;
+ }
+diff --git a/drivers/clocksource/timer-sp804.c b/drivers/clocksource/timer-sp804.c
+index e01222ea888ff..738c50e916f74 100644
+--- a/drivers/clocksource/timer-sp804.c
++++ b/drivers/clocksource/timer-sp804.c
+@@ -228,6 +228,11 @@ static int __init sp804_of_init(struct device_node *np)
+ struct clk *clk1, *clk2;
+ const char *name = of_get_property(np, "compatible", NULL);
+
++ if (initialized) {
++ pr_debug("%pOF: skipping further SP804 timer device\n", np);
++ return 0;
++ }
++
+ base = of_iomap(np, 0);
+ if (!base)
+ return -ENXIO;
+@@ -236,11 +241,6 @@ static int __init sp804_of_init(struct device_node *np)
+ writel(0, base + TIMER_CTRL);
+ writel(0, base + TIMER_2_BASE + TIMER_CTRL);
+
+- if (initialized || !of_device_is_available(np)) {
+- ret = -EINVAL;
+- goto err;
+- }
+-
+ clk1 = of_clk_get(np, 0);
+ if (IS_ERR(clk1))
+ clk1 = NULL;
+diff --git a/drivers/crypto/marvell/cipher.c b/drivers/crypto/marvell/cipher.c
+index 0ae84ec9e21c0..c9b905efc4489 100644
+--- a/drivers/crypto/marvell/cipher.c
++++ b/drivers/crypto/marvell/cipher.c
+@@ -625,7 +625,6 @@ struct skcipher_alg mv_cesa_ecb_des3_ede_alg = {
+ .decrypt = mv_cesa_ecb_des3_ede_decrypt,
+ .min_keysize = DES3_EDE_KEY_SIZE,
+ .max_keysize = DES3_EDE_KEY_SIZE,
+- .ivsize = DES3_EDE_BLOCK_SIZE,
+ .base = {
+ .cra_name = "ecb(des3_ede)",
+ .cra_driver_name = "mv-ecb-des3-ede",
+diff --git a/drivers/devfreq/rk3399_dmc.c b/drivers/devfreq/rk3399_dmc.c
+index e795ad2b3f6b8..eefda6edc89cc 100644
+--- a/drivers/devfreq/rk3399_dmc.c
++++ b/drivers/devfreq/rk3399_dmc.c
+@@ -411,6 +411,8 @@ static int rk3399_dmcfreq_remove(struct platform_device *pdev)
+ {
+ struct rk3399_dmcfreq *dmcfreq = dev_get_drvdata(&pdev->dev);
+
++ devfreq_event_disable_edev(dmcfreq->edev);
++
+ /*
+ * Before remove the opp table we need to unregister the opp notifier.
+ */
+diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
+index 8585fed84e836..3259c450544ca 100644
+--- a/drivers/dma/stm32-mdma.c
++++ b/drivers/dma/stm32-mdma.c
+@@ -50,7 +50,6 @@
+ STM32_MDMA_SHIFT(mask))
+
+ #define STM32_MDMA_GISR0 0x0000 /* MDMA Int Status Reg 1 */
+-#define STM32_MDMA_GISR1 0x0004 /* MDMA Int Status Reg 2 */
+
+ /* MDMA Channel x interrupt/status register */
+ #define STM32_MDMA_CISR(x) (0x40 + 0x40 * (x)) /* x = 0..62 */
+@@ -206,7 +205,7 @@
+
+ #define STM32_MDMA_MAX_BUF_LEN 128
+ #define STM32_MDMA_MAX_BLOCK_LEN 65536
+-#define STM32_MDMA_MAX_CHANNELS 63
++#define STM32_MDMA_MAX_CHANNELS 32
+ #define STM32_MDMA_MAX_REQUESTS 256
+ #define STM32_MDMA_MAX_BURST 128
+ #define STM32_MDMA_VERY_HIGH_PRIORITY 0x11
+@@ -1361,21 +1360,11 @@ static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid)
+
+ /* Find out which channel generates the interrupt */
+ status = readl_relaxed(dmadev->base + STM32_MDMA_GISR0);
+- if (status) {
+- id = __ffs(status);
+- } else {
+- status = readl_relaxed(dmadev->base + STM32_MDMA_GISR1);
+- if (!status) {
+- dev_dbg(mdma2dev(dmadev), "spurious it\n");
+- return IRQ_NONE;
+- }
+- id = __ffs(status);
+- /*
+- * As GISR0 provides status for channel id from 0 to 31,
+- * so GISR1 provides status for channel id from 32 to 62
+- */
+- id += 32;
++ if (!status) {
++ dev_dbg(mdma2dev(dmadev), "spurious it\n");
++ return IRQ_NONE;
+ }
++ id = __ffs(status);
+
+ chan = &dmadev->chan[id];
+ if (!chan) {
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index e70f21ae85ffa..4c70136c7aa3c 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -1245,19 +1245,14 @@ int extcon_dev_register(struct extcon_dev *edev)
+ edev->dev.type = &edev->extcon_dev_type;
+ }
+
+- ret = device_register(&edev->dev);
+- if (ret) {
+- put_device(&edev->dev);
+- goto err_dev;
+- }
+-
+ spin_lock_init(&edev->lock);
+- edev->nh = devm_kcalloc(&edev->dev, edev->max_supported,
+- sizeof(*edev->nh), GFP_KERNEL);
+- if (!edev->nh) {
+- ret = -ENOMEM;
+- device_unregister(&edev->dev);
+- goto err_dev;
++ if (edev->max_supported) {
++ edev->nh = kcalloc(edev->max_supported, sizeof(*edev->nh),
++ GFP_KERNEL);
++ if (!edev->nh) {
++ ret = -ENOMEM;
++ goto err_alloc_nh;
++ }
+ }
+
+ for (index = 0; index < edev->max_supported; index++)
+@@ -1268,6 +1263,12 @@ int extcon_dev_register(struct extcon_dev *edev)
+ dev_set_drvdata(&edev->dev, edev);
+ edev->state = 0;
+
++ ret = device_register(&edev->dev);
++ if (ret) {
++ put_device(&edev->dev);
++ goto err_dev;
++ }
++
+ mutex_lock(&extcon_dev_list_lock);
+ list_add(&edev->entry, &extcon_dev_list);
+ mutex_unlock(&extcon_dev_list_lock);
+@@ -1275,6 +1276,9 @@ int extcon_dev_register(struct extcon_dev *edev)
+ return 0;
+
+ err_dev:
++ if (edev->max_supported)
++ kfree(edev->nh);
++err_alloc_nh:
+ if (edev->max_supported)
+ kfree(edev->extcon_dev_type.groups);
+ err_alloc_groups:
+@@ -1335,6 +1339,7 @@ void extcon_dev_unregister(struct extcon_dev *edev)
+ if (edev->max_supported) {
+ kfree(edev->extcon_dev_type.groups);
+ kfree(edev->cables);
++ kfree(edev->nh);
+ }
+
+ put_device(&edev->dev);
+diff --git a/drivers/firmware/arm_scmi/base.c b/drivers/firmware/arm_scmi/base.c
+index 204390297f4bd..95d892db0dff5 100644
+--- a/drivers/firmware/arm_scmi/base.c
++++ b/drivers/firmware/arm_scmi/base.c
+@@ -164,7 +164,7 @@ static int scmi_base_implementation_list_get(const struct scmi_handle *handle,
+ break;
+
+ loop_num_ret = le32_to_cpu(*num_ret);
+- if (tot_num_ret + loop_num_ret > MAX_PROTOCOLS_IMP) {
++ if (loop_num_ret > MAX_PROTOCOLS_IMP - tot_num_ret) {
+ dev_err(dev, "No. of Protocol > MAX_PROTOCOLS_IMP");
+ break;
+ }
+diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c
+index ecf2eeb5f6f95..5d6b497d54d00 100644
+--- a/drivers/firmware/dmi-sysfs.c
++++ b/drivers/firmware/dmi-sysfs.c
+@@ -602,7 +602,7 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh,
+ "%d-%d", dh->type, entry->instance);
+
+ if (*ret) {
+- kfree(entry);
++ kobject_put(&entry->kobj);
+ return;
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 023309296bfcd..e667bcf64bc7f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -110,7 +110,7 @@ static int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, union drm_amdgpu_cs
+ int ret;
+
+ if (cs->in.num_chunks == 0)
+- return 0;
++ return -EINVAL;
+
+ chunk_array = kmalloc_array(cs->in.num_chunks, sizeof(uint64_t), GFP_KERNEL);
+ if (!chunk_array)
+diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+index cb79a93c2eb73..91504eccc60cb 100644
+--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+@@ -1610,19 +1610,7 @@ static int kv_update_samu_dpm(struct amdgpu_device *adev, bool gate)
+
+ static u8 kv_get_acp_boot_level(struct amdgpu_device *adev)
+ {
+- u8 i;
+- struct amdgpu_clock_voltage_dependency_table *table =
+- &adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table;
+-
+- for (i = 0; i < table->count; i++) {
+- if (table->entries[i].clk >= 0) /* XXX */
+- break;
+- }
+-
+- if (i >= table->count)
+- i = table->count - 1;
+-
+- return i;
++ return 0;
+ }
+
+ static void kv_update_acp_boot_level(struct amdgpu_device *adev)
+diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+index 1de96995e6900..9f811051ceb00 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+@@ -7247,17 +7247,15 @@ static int si_parse_power_table(struct amdgpu_device *adev)
+ if (!adev->pm.dpm.ps)
+ return -ENOMEM;
+ power_state_offset = (u8 *)state_array->states;
+- for (i = 0; i < state_array->ucNumEntries; i++) {
++ for (adev->pm.dpm.num_ps = 0, i = 0; i < state_array->ucNumEntries; i++) {
+ u8 *idx;
+ power_state = (union pplib_power_state *)power_state_offset;
+ non_clock_array_index = power_state->v2.nonClockInfoIndex;
+ non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
+ &non_clock_info_array->nonClockInfo[non_clock_array_index];
+ ps = kzalloc(sizeof(struct si_ps), GFP_KERNEL);
+- if (ps == NULL) {
+- kfree(adev->pm.dpm.ps);
++ if (ps == NULL)
+ return -ENOMEM;
+- }
+ adev->pm.dpm.ps[i].ps_priv = ps;
+ si_parse_pplib_non_clock_info(adev, &adev->pm.dpm.ps[i],
+ non_clock_info,
+@@ -7279,8 +7277,8 @@ static int si_parse_power_table(struct amdgpu_device *adev)
+ k++;
+ }
+ power_state_offset += 2 + power_state->v2.ucNumDPMLevels;
++ adev->pm.dpm.num_ps++;
+ }
+- adev->pm.dpm.num_ps = state_array->ucNumEntries;
+
+ /* fill in the vce power states */
+ for (i = 0; i < adev->pm.dpm.num_of_vce_states; i++) {
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index e7ddd3e3db920..b6e7cc9082ca0 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -1225,6 +1225,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)
+ return 0;
+
+ err_unregister_cec:
++ cec_unregister_adapter(adv7511->cec_adap);
+ i2c_unregister_device(adv7511->i2c_cec);
+ if (adv7511->cec_clk)
+ clk_disable_unprepare(adv7511->cec_clk);
+diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+index 84abf5d6f760a..e21c7673cd5b8 100644
+--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+@@ -1514,8 +1514,19 @@ static ssize_t analogix_dpaux_transfer(struct drm_dp_aux *aux,
+ struct drm_dp_aux_msg *msg)
+ {
+ struct analogix_dp_device *dp = to_dp(aux);
++ int ret;
++
++ pm_runtime_get_sync(dp->dev);
++
++ ret = analogix_dp_detect_hpd(dp);
++ if (ret)
++ goto out;
+
+- return analogix_dp_transfer(dp, msg);
++ ret = analogix_dp_transfer(dp, msg);
++out:
++ pm_runtime_put(dp->dev);
++
++ return ret;
+ }
+
+ struct analogix_dp_device *
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index ef26095719c5e..28ea3d260bea1 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -1709,9 +1709,6 @@ struct edid *drm_do_get_edid(struct drm_connector *connector,
+
+ connector_bad_edid(connector, edid, edid[0x7e] + 1);
+
+- edid[EDID_LENGTH-1] += edid[0x7e] - valid_extensions;
+- edid[0x7e] = valid_extensions;
+-
+ new = kmalloc_array(valid_extensions + 1, EDID_LENGTH,
+ GFP_KERNEL);
+ if (!new)
+@@ -1728,6 +1725,9 @@ struct edid *drm_do_get_edid(struct drm_connector *connector,
+ base += EDID_LENGTH;
+ }
+
++ new[EDID_LENGTH - 1] += new[0x7e] - valid_extensions;
++ new[0x7e] = valid_extensions;
++
+ kfree(edid);
+ edid = new;
+ }
+diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
+index 2411b6de055e2..425e76e39b3b9 100644
+--- a/drivers/gpu/drm/drm_plane.c
++++ b/drivers/gpu/drm/drm_plane.c
+@@ -177,6 +177,13 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
+ if (WARN_ON(config->num_total_plane >= 32))
+ return -EINVAL;
+
++ /*
++ * First driver to need more than 64 formats needs to fix this. Each
++ * format is encoded as a bit and the current code only supports a u64.
++ */
++ if (WARN_ON(format_count > 64))
++ return -EINVAL;
++
+ WARN_ON(drm_drv_uses_atomic_modeset(dev) &&
+ (!funcs->atomic_destroy_state ||
+ !funcs->atomic_duplicate_state));
+@@ -198,13 +205,6 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
+ return -ENOMEM;
+ }
+
+- /*
+- * First driver to need more than 64 formats needs to fix this. Each
+- * format is encoded as a bit and the current code only supports a u64.
+- */
+- if (WARN_ON(format_count > 64))
+- return -EINVAL;
+-
+ if (format_modifiers) {
+ const uint64_t *temp_modifiers = format_modifiers;
+ while (*temp_modifiers++ != DRM_FORMAT_MOD_INVALID)
+diff --git a/drivers/gpu/drm/gma500/psb_intel_display.c b/drivers/gpu/drm/gma500/psb_intel_display.c
+index 8762efaef2839..987f202c70fff 100644
+--- a/drivers/gpu/drm/gma500/psb_intel_display.c
++++ b/drivers/gpu/drm/gma500/psb_intel_display.c
+@@ -543,14 +543,15 @@ void psb_intel_crtc_init(struct drm_device *dev, int pipe,
+
+ struct drm_crtc *psb_intel_get_crtc_from_pipe(struct drm_device *dev, int pipe)
+ {
+- struct drm_crtc *crtc = NULL;
++ struct drm_crtc *crtc;
+
+ list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+ struct gma_crtc *gma_crtc = to_gma_crtc(crtc);
++
+ if (gma_crtc->pipe == pipe)
+- break;
++ return crtc;
+ }
+- return crtc;
++ return NULL;
+ }
+
+ int gma_connector_clones(struct drm_device *dev, int type_mask)
+diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
+index ff34f9bb55a1e..824c90dca7306 100644
+--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
+@@ -71,7 +71,7 @@ static void ipu_crtc_disable_planes(struct ipu_crtc *ipu_crtc,
+ drm_atomic_crtc_state_for_each_plane(plane, old_crtc_state) {
+ if (plane == &ipu_crtc->plane[0]->base)
+ disable_full = true;
+- if (&ipu_crtc->plane[1] && plane == &ipu_crtc->plane[1]->base)
++ if (ipu_crtc->plane[1] && plane == &ipu_crtc->plane[1]->base)
+ disable_partial = true;
+ }
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_cec.c b/drivers/gpu/drm/mediatek/mtk_cec.c
+index 5ce84d0dbf814..acbf878083d76 100644
+--- a/drivers/gpu/drm/mediatek/mtk_cec.c
++++ b/drivers/gpu/drm/mediatek/mtk_cec.c
+@@ -92,7 +92,7 @@ static void mtk_cec_mask(struct mtk_cec *cec, unsigned int offset,
+ u32 tmp = readl(cec->regs + offset) & ~mask;
+
+ tmp |= val & mask;
+- writel(val, cec->regs + offset);
++ writel(tmp, cec->regs + offset);
+ }
+
+ void mtk_cec_set_hpd_event(struct device *dev,
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+index 52474dcd25738..c88bb92282df6 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+@@ -657,8 +657,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms)
+ for (i = 0; i < dpu_kms->catalog->vbif_count; i++) {
+ u32 vbif_idx = dpu_kms->catalog->vbif[i].id;
+
+- if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx])
++ if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) {
+ dpu_hw_vbif_destroy(dpu_kms->hw_vbif[vbif_idx]);
++ dpu_kms->hw_vbif[vbif_idx] = NULL;
++ }
+ }
+ }
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+index aa28a43ff842c..b8a01c95b831f 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+@@ -537,9 +537,15 @@ int mdp5_crtc_setup_pipeline(struct drm_crtc *crtc,
+ if (ret)
+ return ret;
+
+- mdp5_mixer_release(new_crtc_state->state, old_mixer);
++ ret = mdp5_mixer_release(new_crtc_state->state, old_mixer);
++ if (ret)
++ return ret;
++
+ if (old_r_mixer) {
+- mdp5_mixer_release(new_crtc_state->state, old_r_mixer);
++ ret = mdp5_mixer_release(new_crtc_state->state, old_r_mixer);
++ if (ret)
++ return ret;
++
+ if (!need_right_mixer)
+ pipeline->r_mixer = NULL;
+ }
+@@ -905,8 +911,10 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
+
+ ret = msm_gem_get_iova(cursor_bo, kms->aspace,
+ &mdp5_crtc->cursor.iova);
+- if (ret)
++ if (ret) {
++ drm_gem_object_put(cursor_bo);
+ return -EINVAL;
++ }
+
+ pm_runtime_get_sync(&pdev->dev);
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c
+index 113e6b569562c..9c8275300b552 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c
+@@ -127,21 +127,28 @@ int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc,
+ return 0;
+ }
+
+-void mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer)
++int mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer)
+ {
+ struct mdp5_global_state *global_state = mdp5_get_global_state(s);
+- struct mdp5_hw_mixer_state *new_state = &global_state->hwmixer;
++ struct mdp5_hw_mixer_state *new_state;
+
+ if (!mixer)
+- return;
++ return 0;
++
++ if (IS_ERR(global_state))
++ return PTR_ERR(global_state);
++
++ new_state = &global_state->hwmixer;
+
+ if (WARN_ON(!new_state->hwmixer_to_crtc[mixer->idx]))
+- return;
++ return -EINVAL;
+
+ DBG("%s: release from crtc %s", mixer->name,
+ new_state->hwmixer_to_crtc[mixer->idx]->name);
+
+ new_state->hwmixer_to_crtc[mixer->idx] = NULL;
++
++ return 0;
+ }
+
+ void mdp5_mixer_destroy(struct mdp5_hw_mixer *mixer)
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h
+index 9be94f567fbdb..6bcb0b544665e 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h
+@@ -41,7 +41,7 @@ void mdp5_mixer_destroy(struct mdp5_hw_mixer *lm);
+ int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc,
+ uint32_t caps, struct mdp5_hw_mixer **mixer,
+ struct mdp5_hw_mixer **r_mixer);
+-void mdp5_mixer_release(struct drm_atomic_state *s,
+- struct mdp5_hw_mixer *mixer);
++int mdp5_mixer_release(struct drm_atomic_state *s,
++ struct mdp5_hw_mixer *mixer);
+
+ #endif /* __MDP5_LM_H__ */
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c
+index 1ef26bc631631..88de122255825 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c
+@@ -130,18 +130,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane,
+ return 0;
+ }
+
+-void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe)
++int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe)
+ {
+ struct msm_drm_private *priv = s->dev->dev_private;
+ struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms));
+ struct mdp5_global_state *state = mdp5_get_global_state(s);
+- struct mdp5_hw_pipe_state *new_state = &state->hwpipe;
++ struct mdp5_hw_pipe_state *new_state;
+
+ if (!hwpipe)
+- return;
++ return 0;
++
++ if (IS_ERR(state))
++ return PTR_ERR(state);
++
++ new_state = &state->hwpipe;
+
+ if (WARN_ON(!new_state->hwpipe_to_plane[hwpipe->idx]))
+- return;
++ return -EINVAL;
+
+ DBG("%s: release from plane %s", hwpipe->name,
+ new_state->hwpipe_to_plane[hwpipe->idx]->name);
+@@ -152,6 +157,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe)
+ }
+
+ new_state->hwpipe_to_plane[hwpipe->idx] = NULL;
++
++ return 0;
+ }
+
+ void mdp5_pipe_destroy(struct mdp5_hw_pipe *hwpipe)
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h
+index bb2b0ac7aa2bf..072db6a99b85a 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h
+@@ -48,7 +48,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane,
+ uint32_t caps, uint32_t blkcfg,
+ struct mdp5_hw_pipe **hwpipe,
+ struct mdp5_hw_pipe **r_hwpipe);
+-void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe);
++int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe);
+
+ struct mdp5_hw_pipe *mdp5_pipe_init(enum mdp5_pipe pipe,
+ uint32_t reg_offset, uint32_t caps);
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+index 3d8eaa25bea0f..501d7989b9a5f 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+@@ -402,12 +402,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state,
+ mdp5_state->r_hwpipe = NULL;
+
+
+- mdp5_pipe_release(state->state, old_hwpipe);
+- mdp5_pipe_release(state->state, old_right_hwpipe);
++ ret = mdp5_pipe_release(state->state, old_hwpipe);
++ if (ret)
++ return ret;
++
++ ret = mdp5_pipe_release(state->state, old_right_hwpipe);
++ if (ret)
++ return ret;
++
+ }
+ } else {
+- mdp5_pipe_release(state->state, mdp5_state->hwpipe);
+- mdp5_pipe_release(state->state, mdp5_state->r_hwpipe);
++ ret = mdp5_pipe_release(state->state, mdp5_state->hwpipe);
++ if (ret)
++ return ret;
++
++ ret = mdp5_pipe_release(state->state, mdp5_state->r_hwpipe);
++ if (ret)
++ return ret;
++
+ mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL;
+ }
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 9abfb19ea7ede..56cfa0a03fd5b 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -1354,10 +1354,10 @@ static int dsi_cmds2buf_tx(struct msm_dsi_host *msm_host,
+ dsi_get_bpp(msm_host->format) / 8;
+
+ len = dsi_cmd_dma_add(msm_host, msg);
+- if (!len) {
++ if (len < 0) {
+ pr_err("%s: failed to add cmd type = 0x%x\n",
+ __func__, msg->type);
+- return -EINVAL;
++ return len;
+ }
+
+ /* for video mode, do not send cmds more than
+@@ -1376,10 +1376,14 @@ static int dsi_cmds2buf_tx(struct msm_dsi_host *msm_host,
+ }
+
+ ret = dsi_cmd_dma_tx(msm_host, len);
+- if (ret < len) {
+- pr_err("%s: cmd dma tx failed, type=0x%x, data0=0x%x, len=%d\n",
+- __func__, msg->type, (*(u8 *)(msg->tx_buf)), len);
+- return -ECOMM;
++ if (ret < 0) {
++ pr_err("%s: cmd dma tx failed, type=0x%x, data0=0x%x, len=%d, ret=%d\n",
++ __func__, msg->type, (*(u8 *)(msg->tx_buf)), len, ret);
++ return ret;
++ } else if (ret < len) {
++ pr_err("%s: cmd dma tx failed, type=0x%x, data0=0x%x, ret=%d len=%d\n",
++ __func__, msg->type, (*(u8 *)(msg->tx_buf)), ret, len);
++ return -EIO;
+ }
+
+ return len;
+@@ -2105,9 +2109,12 @@ int msm_dsi_host_cmd_rx(struct mipi_dsi_host *host,
+ }
+
+ ret = dsi_cmds2buf_tx(msm_host, msg);
+- if (ret < msg->tx_len) {
++ if (ret < 0) {
+ pr_err("%s: Read cmd Tx failed, %d\n", __func__, ret);
+ return ret;
++ } else if (ret < msg->tx_len) {
++ pr_err("%s: Read cmd Tx failed, too short: %d\n", __func__, ret);
++ return -ECOMM;
+ }
+
+ /*
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
+index 33e083f71a170..0b7cb90d28265 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
+@@ -148,6 +148,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev)
+ /* HDCP needs physical address of hdmi register */
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+ config->mmio_name);
++ if (!res) {
++ ret = -EINVAL;
++ goto fail;
++ }
+ hdmi->mmio_phy_addr = res->start;
+
+ hdmi->qfprom_mmio = msm_ioremap(pdev,
+diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c
+index 13403c6da6c75..7e4664968106f 100644
+--- a/drivers/gpu/drm/msm/msm_gem_prime.c
++++ b/drivers/gpu/drm/msm/msm_gem_prime.c
+@@ -26,7 +26,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj)
+ int npages = obj->size >> PAGE_SHIFT;
+
+ if (WARN_ON(!msm_obj->pages)) /* should have already pinned! */
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ return drm_prime_pages_to_sg(msm_obj->pages, npages);
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
+index ba6a868d4c956..28cccac39c19f 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c
+@@ -134,10 +134,10 @@ nvkm_cstate_find_best(struct nvkm_clk *clk, struct nvkm_pstate *pstate,
+
+ list_for_each_entry_from_reverse(cstate, &pstate->list, head) {
+ if (nvkm_cstate_valid(clk, cstate, max_volt, clk->temp))
+- break;
++ return cstate;
+ }
+
+- return cstate;
++ return NULL;
+ }
+
+ static struct nvkm_cstate *
+@@ -168,6 +168,8 @@ nvkm_cstate_prog(struct nvkm_clk *clk, struct nvkm_pstate *pstate, int cstatei)
+ if (!list_empty(&pstate->list)) {
+ cstate = nvkm_cstate_get(clk, pstate, cstatei);
+ cstate = nvkm_cstate_find_best(clk, pstate, cstate);
++ if (!cstate)
++ return -EINVAL;
+ } else {
+ cstate = &pstate->base;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index b9927101e8450..47240983f3603 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -476,6 +476,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
+ native_mode->vdisplay != 0 &&
+ native_mode->clock != 0) {
+ mode = drm_mode_duplicate(dev, native_mode);
++ if (!mode)
++ return NULL;
+ mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
+ drm_mode_set_name(mode);
+
+@@ -490,6 +492,8 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
+ * simpler.
+ */
+ mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false);
++ if (!mode)
++ return NULL;
+ mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
+ DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name);
+ }
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+index 873624a11ce88..c0b6474359742 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -1595,10 +1595,10 @@ static int vop_bind(struct device *dev, struct device *master, void *data)
+ vop_win_init(vop);
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- vop->len = resource_size(res);
+ vop->regs = devm_ioremap_resource(dev, res);
+ if (IS_ERR(vop->regs))
+ return PTR_ERR(vop->regs);
++ vop->len = resource_size(res);
+
+ vop->regsbak = devm_kzalloc(dev, vop->len, GFP_KERNEL);
+ if (!vop->regsbak)
+diff --git a/drivers/gpu/drm/vc4/vc4_txp.c b/drivers/gpu/drm/vc4/vc4_txp.c
+index 6e23c50168f9a..3b56558a5d653 100644
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -311,12 +311,18 @@ static void vc4_txp_connector_atomic_commit(struct drm_connector *conn,
+ if (WARN_ON(i == ARRAY_SIZE(drm_fmts)))
+ return;
+
+- ctrl = TXP_GO | TXP_VSTART_AT_EOF | TXP_EI |
++ ctrl = TXP_GO | TXP_EI |
+ VC4_SET_FIELD(0xf, TXP_BYTE_ENABLE) |
+ VC4_SET_FIELD(txp_fmts[i], TXP_FORMAT);
+
+ if (fb->format->has_alpha)
+ ctrl |= TXP_ALPHA_ENABLE;
++ else
++ /*
++ * If TXP_ALPHA_ENABLE isn't set and TXP_ALPHA_INVERT is, the
++ * hardware will force the output padding to be 0xff.
++ */
++ ctrl |= TXP_ALPHA_INVERT;
+
+ gem = drm_fb_cma_get_gem_obj(fb, 0);
+ TXP_WRITE(TXP_DST_PTR, gem->paddr + fb->offsets[0]);
+diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c
+index 25503b9335991..7511f416eb67e 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_display.c
++++ b/drivers/gpu/drm/virtio/virtgpu_display.c
+@@ -180,6 +180,8 @@ static int virtio_gpu_conn_get_modes(struct drm_connector *connector)
+ DRM_DEBUG("add mode: %dx%d\n", width, height);
+ mode = drm_cvt_mode(connector->dev, width, height, 60,
+ false, false, false);
++ if (!mode)
++ return count;
+ mode->type |= DRM_MODE_TYPE_PREFERRED;
+ drm_mode_probed_add(connector, mode);
+ count++;
+diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c
+index 7139227edb287..63077fb230262 100644
+--- a/drivers/hid/hid-elan.c
++++ b/drivers/hid/hid-elan.c
+@@ -192,7 +192,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER);
+ if (ret) {
+ hid_err(hdev, "Failed to init elan MT slots: %d\n", ret);
+- input_free_device(input);
+ return ret;
+ }
+
+@@ -204,7 +203,6 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ hid_err(hdev, "Failed to register elan input device: %d\n",
+ ret);
+ input_mt_destroy_slots(input);
+- input_free_device(input);
+ return ret;
+ }
+
+diff --git a/drivers/hid/hid-led.c b/drivers/hid/hid-led.c
+index d3e1ab162f7c6..7fc5982a0ca49 100644
+--- a/drivers/hid/hid-led.c
++++ b/drivers/hid/hid-led.c
+@@ -369,7 +369,7 @@ static const struct hidled_config hidled_configs[] = {
+ .type = DREAM_CHEEKY,
+ .name = "Dream Cheeky Webmail Notifier",
+ .short_name = "dream_cheeky",
+- .max_brightness = 31,
++ .max_brightness = 63,
+ .num_leds = 1,
+ .report_size = 9,
+ .report_type = RAW_REQUEST,
+diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
+index c4051a3e63c29..fb82d8ee0dd6d 100644
+--- a/drivers/hwmon/hwmon.c
++++ b/drivers/hwmon/hwmon.c
+@@ -695,11 +695,12 @@ EXPORT_SYMBOL_GPL(hwmon_device_register_with_groups);
+
+ /**
+ * hwmon_device_register_with_info - register w/ hwmon
+- * @dev: the parent device
+- * @name: hwmon name attribute
+- * @drvdata: driver data to attach to created device
+- * @chip: pointer to hwmon chip information
++ * @dev: the parent device (mandatory)
++ * @name: hwmon name attribute (mandatory)
++ * @drvdata: driver data to attach to created device (optional)
++ * @chip: pointer to hwmon chip information (mandatory)
+ * @extra_groups: pointer to list of additional non-standard attribute groups
++ * (optional)
+ *
+ * hwmon_device_unregister() must be called when the device is no
+ * longer needed.
+@@ -712,13 +713,10 @@ hwmon_device_register_with_info(struct device *dev, const char *name,
+ const struct hwmon_chip_info *chip,
+ const struct attribute_group **extra_groups)
+ {
+- if (!name)
+- return ERR_PTR(-EINVAL);
+-
+- if (chip && (!chip->ops || !chip->ops->is_visible || !chip->info))
++ if (!dev || !name || !chip)
+ return ERR_PTR(-EINVAL);
+
+- if (chip && !dev)
++ if (!chip->ops || !chip->ops->is_visible || !chip->info)
+ return ERR_PTR(-EINVAL);
+
+ return __hwmon_device_register(dev, name, drvdata, chip, extra_groups);
+diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c
+index e8819d7509387..a4eba09691b43 100644
+--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c
++++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c
+@@ -379,9 +379,10 @@ static int debug_notifier_call(struct notifier_block *self,
+ int cpu;
+ struct debug_drvdata *drvdata;
+
+- mutex_lock(&debug_lock);
++ /* Bail out if we can't acquire the mutex or the functionality is off */
++ if (!mutex_trylock(&debug_lock))
++ return NOTIFY_DONE;
+
+- /* Bail out if the functionality is disabled */
+ if (!debug_enable)
+ goto skip_dump;
+
+@@ -400,7 +401,7 @@ static int debug_notifier_call(struct notifier_block *self,
+
+ skip_dump:
+ mutex_unlock(&debug_lock);
+- return 0;
++ return NOTIFY_DONE;
+ }
+
+ static struct notifier_block debug_notifier = {
+diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
+index d51bf536bdf75..29947eb905fb4 100644
+--- a/drivers/i2c/busses/i2c-at91.c
++++ b/drivers/i2c/busses/i2c-at91.c
+@@ -757,6 +757,7 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
+ unsigned int_addr_flag = 0;
+ struct i2c_msg *m_start = msg;
+ bool is_read;
++ u8 *dma_buf = NULL;
+
+ dev_dbg(&adap->dev, "at91_xfer: processing %d messages:\n", num);
+
+@@ -804,7 +805,17 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
+ dev->msg = m_start;
+ dev->recv_len_abort = false;
+
++ if (dev->use_dma) {
++ dma_buf = i2c_get_dma_safe_msg_buf(m_start, 1);
++ if (!dma_buf) {
++ ret = -ENOMEM;
++ goto out;
++ }
++ dev->buf = dma_buf;
++ }
++
+ ret = at91_do_twi_transfer(dev);
++ i2c_put_dma_safe_msg_buf(dma_buf, m_start, !ret);
+
+ ret = (ret < 0) ? ret : num;
+ out:
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index c5475bb4fae6b..2150afdcc0837 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -511,7 +511,7 @@ static void cdns_i2c_master_reset(struct i2c_adapter *adap)
+ static int cdns_i2c_process_msg(struct cdns_i2c *id, struct i2c_msg *msg,
+ struct i2c_adapter *adap)
+ {
+- unsigned long time_left;
++ unsigned long time_left, msg_timeout;
+ u32 reg;
+
+ id->p_msg = msg;
+@@ -536,8 +536,16 @@ static int cdns_i2c_process_msg(struct cdns_i2c *id, struct i2c_msg *msg,
+ else
+ cdns_i2c_msend(id);
+
++ /* Minimal time to execute this message */
++ msg_timeout = msecs_to_jiffies((1000 * msg->len * BITS_PER_BYTE) / id->i2c_clk);
++ /* Plus some wiggle room */
++ msg_timeout += msecs_to_jiffies(500);
++
++ if (msg_timeout < adap->timeout)
++ msg_timeout = adap->timeout;
++
+ /* Wait for the signal of completion */
+- time_left = wait_for_completion_timeout(&id->xfer_done, adap->timeout);
++ time_left = wait_for_completion_timeout(&id->xfer_done, msg_timeout);
+ if (time_left == 0) {
+ cdns_i2c_master_reset(adap);
+ dev_err(id->adap.dev.parent,
+diff --git a/drivers/iio/adc/sc27xx_adc.c b/drivers/iio/adc/sc27xx_adc.c
+index 2b60efea0c39f..4095e1f7d7568 100644
+--- a/drivers/iio/adc/sc27xx_adc.c
++++ b/drivers/iio/adc/sc27xx_adc.c
+@@ -35,8 +35,8 @@
+
+ /* Bits and mask definition for SC27XX_ADC_CH_CFG register */
+ #define SC27XX_ADC_CHN_ID_MASK GENMASK(4, 0)
+-#define SC27XX_ADC_SCALE_MASK GENMASK(10, 8)
+-#define SC27XX_ADC_SCALE_SHIFT 8
++#define SC27XX_ADC_SCALE_MASK GENMASK(10, 9)
++#define SC27XX_ADC_SCALE_SHIFT 9
+
+ /* Bits definitions for SC27XX_ADC_INT_EN registers */
+ #define SC27XX_ADC_IRQ_EN BIT(0)
+diff --git a/drivers/iio/dummy/iio_simple_dummy.c b/drivers/iio/dummy/iio_simple_dummy.c
+index 62052479c349d..f970b4388dda9 100644
+--- a/drivers/iio/dummy/iio_simple_dummy.c
++++ b/drivers/iio/dummy/iio_simple_dummy.c
+@@ -571,10 +571,9 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
+ struct iio_sw_device *swd;
+
+ swd = kzalloc(sizeof(*swd), GFP_KERNEL);
+- if (!swd) {
+- ret = -ENOMEM;
+- goto error_kzalloc;
+- }
++ if (!swd)
++ return ERR_PTR(-ENOMEM);
++
+ /*
+ * Allocate an IIO device.
+ *
+@@ -586,7 +585,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
+ indio_dev = iio_device_alloc(sizeof(*st));
+ if (!indio_dev) {
+ ret = -ENOMEM;
+- goto error_ret;
++ goto error_free_swd;
+ }
+
+ st = iio_priv(indio_dev);
+@@ -617,6 +616,10 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
+ * indio_dev->name = spi_get_device_id(spi)->name;
+ */
+ indio_dev->name = kstrdup(name, GFP_KERNEL);
++ if (!indio_dev->name) {
++ ret = -ENOMEM;
++ goto error_free_device;
++ }
+
+ /* Provide description of available channels */
+ indio_dev->channels = iio_dummy_channels;
+@@ -633,7 +636,7 @@ static struct iio_sw_device *iio_dummy_probe(const char *name)
+
+ ret = iio_simple_dummy_events_register(indio_dev);
+ if (ret < 0)
+- goto error_free_device;
++ goto error_free_name;
+
+ ret = iio_simple_dummy_configure_buffer(indio_dev);
+ if (ret < 0)
+@@ -650,11 +653,12 @@ error_unconfigure_buffer:
+ iio_simple_dummy_unconfigure_buffer(indio_dev);
+ error_unregister_events:
+ iio_simple_dummy_events_unregister(indio_dev);
++error_free_name:
++ kfree(indio_dev->name);
+ error_free_device:
+ iio_device_free(indio_dev);
+-error_ret:
++error_free_swd:
+ kfree(swd);
+-error_kzalloc:
+ return ERR_PTR(ret);
+ }
+
+diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
+index adeb259458de6..64ee11542a566 100644
+--- a/drivers/infiniband/hw/hfi1/file_ops.c
++++ b/drivers/infiniband/hw/hfi1/file_ops.c
+@@ -308,6 +308,8 @@ static ssize_t hfi1_write_iter(struct kiocb *kiocb, struct iov_iter *from)
+ unsigned long dim = from->nr_segs;
+ int idx;
+
++ if (!HFI1_CAP_IS_KSET(SDMA))
++ return -EINVAL;
+ idx = srcu_read_lock(&fd->pq_srcu);
+ pq = srcu_dereference(fd->pq, &fd->pq_srcu);
+ if (!cq || !pq) {
+diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
+index d9890ca1d70a9..c3abf78117464 100644
+--- a/drivers/infiniband/hw/hfi1/init.c
++++ b/drivers/infiniband/hw/hfi1/init.c
+@@ -535,7 +535,7 @@ void set_link_ipg(struct hfi1_pportdata *ppd)
+ u16 shift, mult;
+ u64 src;
+ u32 current_egress_rate; /* Mbits /sec */
+- u32 max_pkt_time;
++ u64 max_pkt_time;
+ /*
+ * max_pkt_time is the maximum packet egress time in units
+ * of the fabric clock period 1/(805 MHz).
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index 38258de75a94c..33ff9eca28f69 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -1313,11 +1313,13 @@ void sdma_clean(struct hfi1_devdata *dd, size_t num_engines)
+ kvfree(sde->tx_ring);
+ sde->tx_ring = NULL;
+ }
+- spin_lock_irq(&dd->sde_map_lock);
+- sdma_map_free(rcu_access_pointer(dd->sdma_map));
+- RCU_INIT_POINTER(dd->sdma_map, NULL);
+- spin_unlock_irq(&dd->sde_map_lock);
+- synchronize_rcu();
++ if (rcu_access_pointer(dd->sdma_map)) {
++ spin_lock_irq(&dd->sde_map_lock);
++ sdma_map_free(rcu_access_pointer(dd->sdma_map));
++ RCU_INIT_POINTER(dd->sdma_map, NULL);
++ spin_unlock_irq(&dd->sde_map_lock);
++ synchronize_rcu();
++ }
+ kfree(dd->per_sdma);
+ dd->per_sdma = NULL;
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 63db49144f62b..4008ab2da0526 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -680,7 +680,7 @@ next_wqe:
+ opcode = next_opcode(qp, wqe, wqe->wr.opcode);
+ if (unlikely(opcode < 0)) {
+ wqe->status = IB_WC_LOC_QP_OP_ERR;
+- goto exit;
++ goto err;
+ }
+
+ mask = rxe_opcode[opcode].mask;
+diff --git a/drivers/input/misc/sparcspkr.c b/drivers/input/misc/sparcspkr.c
+index 4a5afc7fe96ea..f6e1f38267d94 100644
+--- a/drivers/input/misc/sparcspkr.c
++++ b/drivers/input/misc/sparcspkr.c
+@@ -204,6 +204,7 @@ static int bbc_beep_probe(struct platform_device *op)
+
+ info = &state->u.bbc;
+ info->clock_freq = of_getintprop_default(dp, "clock-frequency", 0);
++ of_node_put(dp);
+ if (!info->clock_freq)
+ goto out_free;
+
+diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
+index d0122134f320e..f68816329a2e8 100644
+--- a/drivers/input/mouse/bcm5974.c
++++ b/drivers/input/mouse/bcm5974.c
+@@ -956,17 +956,22 @@ static int bcm5974_probe(struct usb_interface *iface,
+ if (!dev->tp_data)
+ goto err_free_bt_buffer;
+
+- if (dev->bt_urb)
++ if (dev->bt_urb) {
+ usb_fill_int_urb(dev->bt_urb, udev,
+ usb_rcvintpipe(udev, cfg->bt_ep),
+ dev->bt_data, dev->cfg.bt_datalen,
+ bcm5974_irq_button, dev, 1);
+
++ dev->bt_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
++ }
++
+ usb_fill_int_urb(dev->tp_urb, udev,
+ usb_rcvintpipe(udev, cfg->tp_ep),
+ dev->tp_data, dev->cfg.tp_datalen,
+ bcm5974_irq_trackpad, dev, 1);
+
++ dev->tp_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
++
+ /* create bcm5974 device */
+ usb_make_path(udev, dev->phys, sizeof(dev->phys));
+ strlcat(dev->phys, "/input0", sizeof(dev->phys));
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 76ae6968801e4..1c61cd0b1d55d 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -90,7 +90,7 @@
+ #define ACPI_DEVFLAG_LINT1 0x80
+ #define ACPI_DEVFLAG_ATSDIS 0x10000000
+
+-#define LOOP_TIMEOUT 100000
++#define LOOP_TIMEOUT 2000000
+ /*
+ * ACPI table definitions
+ *
+diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c
+index fc5f0b53adaf3..bf7ff0219646a 100644
+--- a/drivers/iommu/msm_iommu.c
++++ b/drivers/iommu/msm_iommu.c
+@@ -638,16 +638,19 @@ static void insert_iommu_master(struct device *dev,
+ static int qcom_iommu_of_xlate(struct device *dev,
+ struct of_phandle_args *spec)
+ {
+- struct msm_iommu_dev *iommu;
++ struct msm_iommu_dev *iommu = NULL, *iter;
+ unsigned long flags;
+ int ret = 0;
+
+ spin_lock_irqsave(&msm_iommu_lock, flags);
+- list_for_each_entry(iommu, &qcom_iommu_devices, dev_node)
+- if (iommu->dev->of_node == spec->np)
++ list_for_each_entry(iter, &qcom_iommu_devices, dev_node) {
++ if (iter->dev->of_node == spec->np) {
++ iommu = iter;
+ break;
++ }
++ }
+
+- if (!iommu || iommu->dev->of_node != spec->np) {
++ if (!iommu) {
+ ret = -ENODEV;
+ goto fail;
+ }
+diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
+index 8e75f34ac8868..7304ad88f1263 100644
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -702,8 +702,7 @@ static int mtk_iommu_remove(struct platform_device *pdev)
+ iommu_device_sysfs_remove(&data->iommu);
+ iommu_device_unregister(&data->iommu);
+
+- if (iommu_present(&platform_bus_type))
+- bus_set_iommu(&platform_bus_type, NULL);
++ list_del(&data->list);
+
+ clk_disable_unprepare(data->bclk);
+ devm_free_irq(&pdev->dev, data->irq, data);
+diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
+index 5849ac5a2ad3b..0fd428db3aa4d 100644
+--- a/drivers/irqchip/irq-armada-370-xp.c
++++ b/drivers/irqchip/irq-armada-370-xp.c
+@@ -392,7 +392,16 @@ static void armada_xp_mpic_smp_cpu_init(void)
+
+ static void armada_xp_mpic_perf_init(void)
+ {
+- unsigned long cpuid = cpu_logical_map(smp_processor_id());
++ unsigned long cpuid;
++
++ /*
++ * This Performance Counter Overflow interrupt is specific for
++ * Armada 370 and XP. It is not available on Armada 375, 38x and 39x.
++ */
++ if (!of_machine_is_compatible("marvell,armada-370-xp"))
++ return;
++
++ cpuid = cpu_logical_map(smp_processor_id());
+
+ /* Enable Performance Counter Overflow interrupts */
+ writel(ARMADA_370_XP_INT_CAUSE_PERF(cpuid),
+diff --git a/drivers/irqchip/irq-aspeed-i2c-ic.c b/drivers/irqchip/irq-aspeed-i2c-ic.c
+index f20200af09927..1274e3bc22132 100644
+--- a/drivers/irqchip/irq-aspeed-i2c-ic.c
++++ b/drivers/irqchip/irq-aspeed-i2c-ic.c
+@@ -82,8 +82,8 @@ static int __init aspeed_i2c_ic_of_init(struct device_node *node,
+ }
+
+ i2c_ic->parent_irq = irq_of_parse_and_map(node, 0);
+- if (i2c_ic->parent_irq < 0) {
+- ret = i2c_ic->parent_irq;
++ if (!i2c_ic->parent_irq) {
++ ret = -EINVAL;
+ goto err_iounmap;
+ }
+
+diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c
+index e539500752d46..345960c60e349 100644
+--- a/drivers/irqchip/irq-xtensa-mx.c
++++ b/drivers/irqchip/irq-xtensa-mx.c
+@@ -141,14 +141,25 @@ static struct irq_chip xtensa_mx_irq_chip = {
+ .irq_set_affinity = xtensa_mx_irq_set_affinity,
+ };
+
++static void __init xtensa_mx_init_common(struct irq_domain *root_domain)
++{
++ unsigned int i;
++
++ irq_set_default_host(root_domain);
++ secondary_init_irq();
++
++ /* Initialize default IRQ routing to CPU 0 */
++ for (i = 0; i < XCHAL_NUM_EXTINTERRUPTS; ++i)
++ set_er(1, MIROUT(i));
++}
++
+ int __init xtensa_mx_init_legacy(struct device_node *interrupt_parent)
+ {
+ struct irq_domain *root_domain =
+ irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0,
+ &xtensa_mx_irq_domain_ops,
+ &xtensa_mx_irq_chip);
+- irq_set_default_host(root_domain);
+- secondary_init_irq();
++ xtensa_mx_init_common(root_domain);
+ return 0;
+ }
+
+@@ -158,8 +169,7 @@ static int __init xtensa_mx_init(struct device_node *np,
+ struct irq_domain *root_domain =
+ irq_domain_add_linear(np, NR_IRQS, &xtensa_mx_irq_domain_ops,
+ &xtensa_mx_irq_chip);
+- irq_set_default_host(root_domain);
+- secondary_init_irq();
++ xtensa_mx_init_common(root_domain);
+ return 0;
+ }
+ IRQCHIP_DECLARE(xtensa_mx_irq_chip, "cdns,xtensa-mx", xtensa_mx_init);
+diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
+index 47c350cdfb121..a316624742f68 100644
+--- a/drivers/macintosh/Kconfig
++++ b/drivers/macintosh/Kconfig
+@@ -66,6 +66,10 @@ config ADB_PMU
+ this device; you should do so if your machine is one of those
+ mentioned above.
+
++config ADB_PMU_EVENT
++ def_bool y
++ depends on ADB_PMU && INPUT=y
++
+ config ADB_PMU_LED
+ bool "Support for the Power/iBook front LED"
+ depends on PPC_PMAC && ADB_PMU
+diff --git a/drivers/macintosh/Makefile b/drivers/macintosh/Makefile
+index 49819b1b6f201..712edcb3e0b08 100644
+--- a/drivers/macintosh/Makefile
++++ b/drivers/macintosh/Makefile
+@@ -12,7 +12,8 @@ obj-$(CONFIG_MAC_EMUMOUSEBTN) += mac_hid.o
+ obj-$(CONFIG_INPUT_ADBHID) += adbhid.o
+ obj-$(CONFIG_ANSLCD) += ans-lcd.o
+
+-obj-$(CONFIG_ADB_PMU) += via-pmu.o via-pmu-event.o
++obj-$(CONFIG_ADB_PMU) += via-pmu.o
++obj-$(CONFIG_ADB_PMU_EVENT) += via-pmu-event.o
+ obj-$(CONFIG_ADB_PMU_LED) += via-pmu-led.o
+ obj-$(CONFIG_PMAC_BACKLIGHT) += via-pmu-backlight.o
+ obj-$(CONFIG_ADB_CUDA) += via-cuda.o
+diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
+index d72c450aebe5c..50299d68ddfc7 100644
+--- a/drivers/macintosh/via-pmu.c
++++ b/drivers/macintosh/via-pmu.c
+@@ -1464,7 +1464,7 @@ next:
+ pmu_pass_intr(data, len);
+ /* len == 6 is probably a bad check. But how do I
+ * know what PMU versions send what events here? */
+- if (len == 6) {
++ if (IS_ENABLED(CONFIG_ADB_PMU_EVENT) && len == 6) {
+ via_pmu_event(PMU_EVT_POWER, !!(data[1]&8));
+ via_pmu_event(PMU_EVT_LID, data[1]&1);
+ }
+diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
+index 10a559cfb7ea3..aa28fdcb81b9c 100644
+--- a/drivers/mailbox/mailbox.c
++++ b/drivers/mailbox/mailbox.c
+@@ -85,11 +85,11 @@ static void msg_submit(struct mbox_chan *chan)
+ exit:
+ spin_unlock_irqrestore(&chan->lock, flags);
+
+- /* kick start the timer immediately to avoid delays */
+ if (!err && (chan->txdone_method & TXDONE_BY_POLL)) {
+- /* but only if not already active */
+- if (!hrtimer_active(&chan->mbox->poll_hrt))
+- hrtimer_start(&chan->mbox->poll_hrt, 0, HRTIMER_MODE_REL);
++ /* kick start the timer immediately to avoid delays */
++ spin_lock_irqsave(&chan->mbox->poll_hrt_lock, flags);
++ hrtimer_start(&chan->mbox->poll_hrt, 0, HRTIMER_MODE_REL);
++ spin_unlock_irqrestore(&chan->mbox->poll_hrt_lock, flags);
+ }
+ }
+
+@@ -123,20 +123,26 @@ static enum hrtimer_restart txdone_hrtimer(struct hrtimer *hrtimer)
+ container_of(hrtimer, struct mbox_controller, poll_hrt);
+ bool txdone, resched = false;
+ int i;
++ unsigned long flags;
+
+ for (i = 0; i < mbox->num_chans; i++) {
+ struct mbox_chan *chan = &mbox->chans[i];
+
+ if (chan->active_req && chan->cl) {
+- resched = true;
+ txdone = chan->mbox->ops->last_tx_done(chan);
+ if (txdone)
+ tx_tick(chan, 0);
++ else
++ resched = true;
+ }
+ }
+
+ if (resched) {
+- hrtimer_forward_now(hrtimer, ms_to_ktime(mbox->txpoll_period));
++ spin_lock_irqsave(&mbox->poll_hrt_lock, flags);
++ if (!hrtimer_is_queued(hrtimer))
++ hrtimer_forward_now(hrtimer, ms_to_ktime(mbox->txpoll_period));
++ spin_unlock_irqrestore(&mbox->poll_hrt_lock, flags);
++
+ return HRTIMER_RESTART;
+ }
+ return HRTIMER_NORESTART;
+@@ -473,6 +479,7 @@ int mbox_controller_register(struct mbox_controller *mbox)
+ hrtimer_init(&mbox->poll_hrt, CLOCK_MONOTONIC,
+ HRTIMER_MODE_REL);
+ mbox->poll_hrt.function = txdone_hrtimer;
++ spin_lock_init(&mbox->poll_hrt_lock);
+ }
+
+ for (i = 0; i < mbox->num_chans; i++) {
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index c1e487d1261cb..958c3a1c453a5 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -1102,6 +1102,12 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio)
+ * which would call closure_get(&dc->disk.cl)
+ */
+ ddip = kzalloc(sizeof(struct detached_dev_io_private), GFP_NOIO);
++ if (!ddip) {
++ bio->bi_status = BLK_STS_RESOURCE;
++ bio->bi_end_io(bio);
++ return;
++ }
++
+ ddip->d = d;
+ ddip->start_time = jiffies;
+ ddip->bi_end_io = bio->bi_end_io;
+diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
+index e79d2aa2372f4..7cf9d34ce20eb 100644
+--- a/drivers/md/md-bitmap.c
++++ b/drivers/md/md-bitmap.c
+@@ -641,14 +641,6 @@ re_read:
+ daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ;
+ write_behind = le32_to_cpu(sb->write_behind);
+ sectors_reserved = le32_to_cpu(sb->sectors_reserved);
+- /* Setup nodes/clustername only if bitmap version is
+- * cluster-compatible
+- */
+- if (sb->version == cpu_to_le32(BITMAP_MAJOR_CLUSTERED)) {
+- nodes = le32_to_cpu(sb->nodes);
+- strlcpy(bitmap->mddev->bitmap_info.cluster_name,
+- sb->cluster_name, 64);
+- }
+
+ /* verify that the bitmap-specific fields are valid */
+ if (sb->magic != cpu_to_le32(BITMAP_MAGIC))
+@@ -670,6 +662,16 @@ re_read:
+ goto out;
+ }
+
++ /*
++ * Setup nodes/clustername only if bitmap version is
++ * cluster-compatible
++ */
++ if (sb->version == cpu_to_le32(BITMAP_MAJOR_CLUSTERED)) {
++ nodes = le32_to_cpu(sb->nodes);
++ strlcpy(bitmap->mddev->bitmap_info.cluster_name,
++ sb->cluster_name, 64);
++ }
++
+ /* keep the array size field of the bitmap superblock up to date */
+ sb->sync_size = cpu_to_le64(bitmap->mddev->resync_max_sectors);
+
+@@ -702,9 +704,9 @@ re_read:
+
+ out:
+ kunmap_atomic(sb);
+- /* Assigning chunksize is required for "re_read" */
+- bitmap->mddev->bitmap_info.chunksize = chunksize;
+ if (err == 0 && nodes && (bitmap->cluster_slot < 0)) {
++ /* Assigning chunksize is required for "re_read" */
++ bitmap->mddev->bitmap_info.chunksize = chunksize;
+ err = md_setup_cluster(bitmap->mddev, nodes);
+ if (err) {
+ pr_warn("%s: Could not setup cluster service (%d)\n",
+@@ -715,18 +717,18 @@ out:
+ goto re_read;
+ }
+
+-
+ out_no_sb:
+- if (test_bit(BITMAP_STALE, &bitmap->flags))
+- bitmap->events_cleared = bitmap->mddev->events;
+- bitmap->mddev->bitmap_info.chunksize = chunksize;
+- bitmap->mddev->bitmap_info.daemon_sleep = daemon_sleep;
+- bitmap->mddev->bitmap_info.max_write_behind = write_behind;
+- bitmap->mddev->bitmap_info.nodes = nodes;
+- if (bitmap->mddev->bitmap_info.space == 0 ||
+- bitmap->mddev->bitmap_info.space > sectors_reserved)
+- bitmap->mddev->bitmap_info.space = sectors_reserved;
+- if (err) {
++ if (err == 0) {
++ if (test_bit(BITMAP_STALE, &bitmap->flags))
++ bitmap->events_cleared = bitmap->mddev->events;
++ bitmap->mddev->bitmap_info.chunksize = chunksize;
++ bitmap->mddev->bitmap_info.daemon_sleep = daemon_sleep;
++ bitmap->mddev->bitmap_info.max_write_behind = write_behind;
++ bitmap->mddev->bitmap_info.nodes = nodes;
++ if (bitmap->mddev->bitmap_info.space == 0 ||
++ bitmap->mddev->bitmap_info.space > sectors_reserved)
++ bitmap->mddev->bitmap_info.space = sectors_reserved;
++ } else {
+ md_bitmap_print_sb(bitmap);
+ if (bitmap->cluster_slot < 0)
+ md_cluster_stop(bitmap->mddev);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 7e0477e883c7b..4594a1ee88b9b 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2443,14 +2443,16 @@ static void sync_sbs(struct mddev *mddev, int nospares)
+
+ static bool does_sb_need_changing(struct mddev *mddev)
+ {
+- struct md_rdev *rdev;
++ struct md_rdev *rdev = NULL, *iter;
+ struct mdp_superblock_1 *sb;
+ int role;
+
+ /* Find a good rdev */
+- rdev_for_each(rdev, mddev)
+- if ((rdev->raid_disk >= 0) && !test_bit(Faulty, &rdev->flags))
++ rdev_for_each(iter, mddev)
++ if ((iter->raid_disk >= 0) && !test_bit(Faulty, &iter->flags)) {
++ rdev = iter;
+ break;
++ }
+
+ /* No good device found. */
+ if (!rdev)
+@@ -7618,17 +7620,22 @@ EXPORT_SYMBOL(md_register_thread);
+
+ void md_unregister_thread(struct md_thread **threadp)
+ {
+- struct md_thread *thread = *threadp;
+- if (!thread)
+- return;
+- pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
+- /* Locking ensures that mddev_unlock does not wake_up a
++ struct md_thread *thread;
++
++ /*
++ * Locking ensures that mddev_unlock does not wake_up a
+ * non-existent thread
+ */
+ spin_lock(&pers_lock);
++ thread = *threadp;
++ if (!thread) {
++ spin_unlock(&pers_lock);
++ return;
++ }
+ *threadp = NULL;
+ spin_unlock(&pers_lock);
+
++ pr_debug("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
+ kthread_stop(thread->tsk);
+ kfree(thread);
+ }
+@@ -9323,16 +9330,18 @@ static int read_rdev(struct mddev *mddev, struct md_rdev *rdev)
+
+ void md_reload_sb(struct mddev *mddev, int nr)
+ {
+- struct md_rdev *rdev;
++ struct md_rdev *rdev = NULL, *iter;
+ int err;
+
+ /* Find the rdev */
+- rdev_for_each_rcu(rdev, mddev) {
+- if (rdev->desc_nr == nr)
++ rdev_for_each_rcu(iter, mddev) {
++ if (iter->desc_nr == nr) {
++ rdev = iter;
+ break;
++ }
+ }
+
+- if (!rdev || rdev->desc_nr != nr) {
++ if (!rdev) {
+ pr_warn("%s: %d Could not find rdev with nr %d\n", __func__, __LINE__, nr);
+ return;
+ }
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index 0272102b207ea..2a782c4f4710b 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -150,21 +150,6 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ pr_debug("md/raid0:%s: FINAL %d zones\n",
+ mdname(mddev), conf->nr_strip_zones);
+
+- if (conf->nr_strip_zones == 1) {
+- conf->layout = RAID0_ORIG_LAYOUT;
+- } else if (mddev->layout == RAID0_ORIG_LAYOUT ||
+- mddev->layout == RAID0_ALT_MULTIZONE_LAYOUT) {
+- conf->layout = mddev->layout;
+- } else if (default_layout == RAID0_ORIG_LAYOUT ||
+- default_layout == RAID0_ALT_MULTIZONE_LAYOUT) {
+- conf->layout = default_layout;
+- } else {
+- pr_err("md/raid0:%s: cannot assemble multi-zone RAID0 with default_layout setting\n",
+- mdname(mddev));
+- pr_err("md/raid0: please set raid0.default_layout to 1 or 2\n");
+- err = -ENOTSUPP;
+- goto abort;
+- }
+ /*
+ * now since we have the hard sector sizes, we can make sure
+ * chunk size is a multiple of that sector size
+@@ -295,6 +280,22 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ (unsigned long long)smallest->sectors);
+ }
+
++ if (conf->nr_strip_zones == 1 || conf->strip_zone[1].nb_dev == 1) {
++ conf->layout = RAID0_ORIG_LAYOUT;
++ } else if (mddev->layout == RAID0_ORIG_LAYOUT ||
++ mddev->layout == RAID0_ALT_MULTIZONE_LAYOUT) {
++ conf->layout = mddev->layout;
++ } else if (default_layout == RAID0_ORIG_LAYOUT ||
++ default_layout == RAID0_ALT_MULTIZONE_LAYOUT) {
++ conf->layout = default_layout;
++ } else {
++ pr_err("md/raid0:%s: cannot assemble multi-zone RAID0 with default_layout setting\n",
++ mdname(mddev));
++ pr_err("md/raid0: please set raid0.default_layout to 1 or 2\n");
++ err = -EOPNOTSUPP;
++ goto abort;
++ }
++
+ pr_debug("md/raid0:%s: done.\n", mdname(mddev));
+ *private_conf = conf;
+
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index 5eeadab15a5f5..a42043379d676 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -1218,7 +1218,7 @@ static int cec_config_log_addr(struct cec_adapter *adap,
+ * While trying to poll the physical address was reset
+ * and the adapter was unconfigured, so bail out.
+ */
+- if (!adap->is_configuring)
++ if (adap->phys_addr == CEC_PHYS_ADDR_INVALID)
+ return -EINTR;
+
+ if (err)
+@@ -1276,7 +1276,6 @@ static void cec_adap_unconfigure(struct cec_adapter *adap)
+ adap->phys_addr != CEC_PHYS_ADDR_INVALID)
+ WARN_ON(adap->ops->adap_log_addr(adap, CEC_LOG_ADDR_INVALID));
+ adap->log_addrs.log_addr_mask = 0;
+- adap->is_configuring = false;
+ adap->is_configured = false;
+ memset(adap->phys_addrs, 0xff, sizeof(adap->phys_addrs));
+ cec_flush(adap);
+@@ -1469,9 +1468,10 @@ unconfigure:
+ for (i = 0; i < las->num_log_addrs; i++)
+ las->log_addr[i] = CEC_LOG_ADDR_INVALID;
+ cec_adap_unconfigure(adap);
++ adap->is_configuring = false;
+ adap->kthread_config = NULL;
+- mutex_unlock(&adap->lock);
+ complete(&adap->config_completion);
++ mutex_unlock(&adap->lock);
+ return 0;
+ }
+
+diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
+index a1d738969d7b1..06e4e1df125c1 100644
+--- a/drivers/media/pci/cx23885/cx23885-core.c
++++ b/drivers/media/pci/cx23885/cx23885-core.c
+@@ -2164,7 +2164,7 @@ static int cx23885_initdev(struct pci_dev *pci_dev,
+ err = pci_set_dma_mask(pci_dev, 0xffffffff);
+ if (err) {
+ pr_err("%s/0: Oops: no 32bit PCI DMA ???\n", dev->name);
+- goto fail_ctrl;
++ goto fail_dma_set_mask;
+ }
+
+ err = request_irq(pci_dev->irq, cx23885_irq,
+@@ -2172,7 +2172,7 @@ static int cx23885_initdev(struct pci_dev *pci_dev,
+ if (err < 0) {
+ pr_err("%s: can't get IRQ %d\n",
+ dev->name, pci_dev->irq);
+- goto fail_irq;
++ goto fail_dma_set_mask;
+ }
+
+ switch (dev->board) {
+@@ -2194,7 +2194,7 @@ static int cx23885_initdev(struct pci_dev *pci_dev,
+
+ return 0;
+
+-fail_irq:
++fail_dma_set_mask:
+ cx23885_dev_unregister(dev);
+ fail_ctrl:
+ v4l2_ctrl_handler_free(hdl);
+diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
+index e04fe9f17b7aa..99359eaf8cdc4 100644
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -1350,11 +1350,11 @@ static void cx25821_finidev(struct pci_dev *pci_dev)
+ struct cx25821_dev *dev = get_cx25821(v4l2_dev);
+
+ cx25821_shutdown(dev);
+- pci_disable_device(pci_dev);
+
+ /* unregister stuff */
+ if (pci_dev->irq)
+ free_irq(pci_dev->irq, dev);
++ pci_disable_device(pci_dev);
+
+ cx25821_dev_unregister(dev);
+ v4l2_device_unregister(v4l2_dev);
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index 5f8da544b98d5..d792122b86c27 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -1894,8 +1894,8 @@ static void coda_encode_ctrls(struct coda_ctx *ctx)
+ 0x0, V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED);
+ v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops,
+ V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+- V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE, 0x0,
+- V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE);
++ V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE, 0x0,
++ V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE);
+ if (ctx->dev->devtype->product == CODA_HX4 ||
+ ctx->dev->devtype->product == CODA_7541) {
+ v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops,
+@@ -1909,12 +1909,15 @@ static void coda_encode_ctrls(struct coda_ctx *ctx)
+ if (ctx->dev->devtype->product == CODA_960) {
+ v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops,
+ V4L2_CID_MPEG_VIDEO_H264_LEVEL,
+- V4L2_MPEG_VIDEO_H264_LEVEL_4_0,
+- ~((1 << V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
++ V4L2_MPEG_VIDEO_H264_LEVEL_4_2,
++ ~((1 << V4L2_MPEG_VIDEO_H264_LEVEL_1_0) |
++ (1 << V4L2_MPEG_VIDEO_H264_LEVEL_2_0) |
+ (1 << V4L2_MPEG_VIDEO_H264_LEVEL_3_0) |
+ (1 << V4L2_MPEG_VIDEO_H264_LEVEL_3_1) |
+ (1 << V4L2_MPEG_VIDEO_H264_LEVEL_3_2) |
+- (1 << V4L2_MPEG_VIDEO_H264_LEVEL_4_0)),
++ (1 << V4L2_MPEG_VIDEO_H264_LEVEL_4_0) |
++ (1 << V4L2_MPEG_VIDEO_H264_LEVEL_4_1) |
++ (1 << V4L2_MPEG_VIDEO_H264_LEVEL_4_2)),
+ V4L2_MPEG_VIDEO_H264_LEVEL_4_0);
+ }
+ v4l2_ctrl_new_std(&ctx->ctrls, &coda_ctrl_ops,
+@@ -1977,7 +1980,7 @@ static void coda_decode_ctrls(struct coda_ctx *ctx)
+ ctx->h264_profile_ctrl = v4l2_ctrl_new_std_menu(&ctx->ctrls,
+ &coda_ctrl_ops, V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+ V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
+- ~((1 << V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE) |
++ ~((1 << V4L2_MPEG_VIDEO_H264_PROFILE_CONSTRAINED_BASELINE) |
+ (1 << V4L2_MPEG_VIDEO_H264_PROFILE_MAIN) |
+ (1 << V4L2_MPEG_VIDEO_H264_PROFILE_HIGH)),
+ V4L2_MPEG_VIDEO_H264_PROFILE_HIGH);
+diff --git a/drivers/media/platform/exynos4-is/fimc-is.c b/drivers/media/platform/exynos4-is/fimc-is.c
+index 0fe9be93fabe2..0f3f82bd4d208 100644
+--- a/drivers/media/platform/exynos4-is/fimc-is.c
++++ b/drivers/media/platform/exynos4-is/fimc-is.c
+@@ -144,7 +144,7 @@ static int fimc_is_enable_clocks(struct fimc_is *is)
+ dev_err(&is->pdev->dev, "clock %s enable failed\n",
+ fimc_is_clocks[i]);
+ for (--i; i >= 0; i--)
+- clk_disable(is->clocks[i]);
++ clk_disable_unprepare(is->clocks[i]);
+ return ret;
+ }
+ pr_debug("enabled clock: %s\n", fimc_is_clocks[i]);
+diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.h b/drivers/media/platform/exynos4-is/fimc-isp-video.h
+index f79a1b348aa6f..67ef85249912b 100644
+--- a/drivers/media/platform/exynos4-is/fimc-isp-video.h
++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.h
+@@ -35,7 +35,7 @@ static inline int fimc_isp_video_device_register(struct fimc_isp *isp,
+ return 0;
+ }
+
+-void fimc_isp_video_device_unregister(struct fimc_isp *isp,
++static inline void fimc_isp_video_device_unregister(struct fimc_isp *isp,
+ enum v4l2_buf_type type)
+ {
+ }
+diff --git a/drivers/media/platform/qcom/venus/hfi.c b/drivers/media/platform/qcom/venus/hfi.c
+index 24207829982f7..8a99e2d8274a7 100644
+--- a/drivers/media/platform/qcom/venus/hfi.c
++++ b/drivers/media/platform/qcom/venus/hfi.c
+@@ -113,6 +113,9 @@ int hfi_core_deinit(struct venus_core *core, bool blocking)
+ mutex_lock(&core->lock);
+ }
+
++ if (!core->ops)
++ goto unlock;
++
+ ret = core->ops->core_deinit(core);
+
+ if (!ret)
+diff --git a/drivers/media/platform/sti/delta/delta-v4l2.c b/drivers/media/platform/sti/delta/delta-v4l2.c
+index 53dc6da2b09e2..eb5e8867967ee 100644
+--- a/drivers/media/platform/sti/delta/delta-v4l2.c
++++ b/drivers/media/platform/sti/delta/delta-v4l2.c
+@@ -1862,7 +1862,7 @@ static int delta_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(delta->dev, "%s failed to initialize firmware ipc channel\n",
+ DELTA_PREFIX);
+- goto err;
++ goto err_pm_disable;
+ }
+
+ /* register all available decoders */
+@@ -1876,7 +1876,7 @@ static int delta_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(delta->dev, "%s failed to register V4L2 device\n",
+ DELTA_PREFIX);
+- goto err;
++ goto err_pm_disable;
+ }
+
+ delta->work_queue = create_workqueue(DELTA_NAME);
+@@ -1901,6 +1901,8 @@ err_work_queue:
+ destroy_workqueue(delta->work_queue);
+ err_v4l2:
+ v4l2_device_unregister(&delta->v4l2_dev);
++err_pm_disable:
++ pm_runtime_disable(dev);
+ err:
+ return ret;
+ }
+diff --git a/drivers/media/platform/vsp1/vsp1_rpf.c b/drivers/media/platform/vsp1/vsp1_rpf.c
+index f8005b60b9d23..abaf4dde3802d 100644
+--- a/drivers/media/platform/vsp1/vsp1_rpf.c
++++ b/drivers/media/platform/vsp1/vsp1_rpf.c
+@@ -290,11 +290,11 @@ static void rpf_configure_partition(struct vsp1_entity *entity,
+ + crop.left * fmtinfo->bpp[0] / 8;
+
+ if (format->num_planes > 1) {
++ unsigned int bpl = format->plane_fmt[1].bytesperline;
+ unsigned int offset;
+
+- offset = crop.top * format->plane_fmt[1].bytesperline
+- + crop.left / fmtinfo->hsub
+- * fmtinfo->bpp[1] / 8;
++ offset = crop.top / fmtinfo->vsub * bpl
++ + crop.left / fmtinfo->hsub * fmtinfo->bpp[1] / 8;
+ mem.addr[1] += offset;
+ mem.addr[2] += offset;
+ }
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index 21ccbbd70dcee..bbb5ff16abd61 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -2561,6 +2561,11 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
+ } while (0);
+ mutex_unlock(&pvr2_unit_mtx);
+
++ INIT_WORK(&hdw->workpoll, pvr2_hdw_worker_poll);
++
++ if (hdw->unit_number == -1)
++ goto fail;
++
+ cnt1 = 0;
+ cnt2 = scnprintf(hdw->name+cnt1,sizeof(hdw->name)-cnt1,"pvrusb2");
+ cnt1 += cnt2;
+@@ -2572,8 +2577,6 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
+ if (cnt1 >= sizeof(hdw->name)) cnt1 = sizeof(hdw->name)-1;
+ hdw->name[cnt1] = 0;
+
+- INIT_WORK(&hdw->workpoll,pvr2_hdw_worker_poll);
+-
+ pvr2_trace(PVR2_TRACE_INIT,"Driver unit number is %d, name is %s",
+ hdw->unit_number,hdw->name);
+
+diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
+index e858f4f189ed9..0371a4a1cd12b 100644
+--- a/drivers/media/usb/uvc/uvc_v4l2.c
++++ b/drivers/media/usb/uvc/uvc_v4l2.c
+@@ -865,29 +865,31 @@ static int uvc_ioctl_enum_input(struct file *file, void *fh,
+ struct uvc_video_chain *chain = handle->chain;
+ const struct uvc_entity *selector = chain->selector;
+ struct uvc_entity *iterm = NULL;
++ struct uvc_entity *it;
+ u32 index = input->index;
+- int pin = 0;
+
+ if (selector == NULL ||
+ (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
+ if (index != 0)
+ return -EINVAL;
+- list_for_each_entry(iterm, &chain->entities, chain) {
+- if (UVC_ENTITY_IS_ITERM(iterm))
++ list_for_each_entry(it, &chain->entities, chain) {
++ if (UVC_ENTITY_IS_ITERM(it)) {
++ iterm = it;
+ break;
++ }
+ }
+- pin = iterm->id;
+ } else if (index < selector->bNrInPins) {
+- pin = selector->baSourceID[index];
+- list_for_each_entry(iterm, &chain->entities, chain) {
+- if (!UVC_ENTITY_IS_ITERM(iterm))
++ list_for_each_entry(it, &chain->entities, chain) {
++ if (!UVC_ENTITY_IS_ITERM(it))
+ continue;
+- if (iterm->id == pin)
++ if (it->id == selector->baSourceID[index]) {
++ iterm = it;
+ break;
++ }
+ }
+ }
+
+- if (iterm == NULL || iterm->id != pin)
++ if (iterm == NULL)
+ return -EINVAL;
+
+ memset(input, 0, sizeof(*input));
+diff --git a/drivers/mfd/ipaq-micro.c b/drivers/mfd/ipaq-micro.c
+index cd762d08f116f..2ba0e2d575c0c 100644
+--- a/drivers/mfd/ipaq-micro.c
++++ b/drivers/mfd/ipaq-micro.c
+@@ -410,7 +410,7 @@ static int __init micro_probe(struct platform_device *pdev)
+ micro_reset_comm(micro);
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq)
++ if (irq < 0)
+ return -EINVAL;
+ ret = devm_request_irq(&pdev->dev, irq, micro_serial_isr,
+ IRQF_SHARED, "ipaq-micro",
+diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c
+index b97903ff1a721..869c176d48ccd 100644
+--- a/drivers/misc/cardreader/rtsx_usb.c
++++ b/drivers/misc/cardreader/rtsx_usb.c
+@@ -678,6 +678,7 @@ static int rtsx_usb_probe(struct usb_interface *intf,
+ return 0;
+
+ out_init_fail:
++ usb_set_intfdata(ucr->pusb_intf, NULL);
+ usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
+ ucr->iobuf_dma);
+ return ret;
+diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
+index 9725aed305bba..b0e020372d110 100644
+--- a/drivers/misc/lkdtm/usercopy.c
++++ b/drivers/misc/lkdtm/usercopy.c
+@@ -30,12 +30,12 @@ static const unsigned char test_text[] = "This is a test.\n";
+ */
+ static noinline unsigned char *trick_compiler(unsigned char *stack)
+ {
+- return stack + 0;
++ return stack + unconst;
+ }
+
+ static noinline unsigned char *do_usercopy_stack_callee(int value)
+ {
+- unsigned char buf[32];
++ unsigned char buf[128];
+ int i;
+
+ /* Exercise stack to avoid everything living in registers. */
+@@ -43,7 +43,12 @@ static noinline unsigned char *do_usercopy_stack_callee(int value)
+ buf[i] = value & 0xff;
+ }
+
+- return trick_compiler(buf);
++ /*
++ * Put the target buffer in the middle of stack allocation
++ * so that we don't step on future stack users regardless
++ * of stack growth direction.
++ */
++ return trick_compiler(&buf[(128/2)-32]);
+ }
+
+ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
+@@ -66,6 +71,12 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
+ bad_stack -= sizeof(unsigned long);
+ }
+
++#ifdef ARCH_HAS_CURRENT_STACK_POINTER
++ pr_info("stack : %px\n", (void *)current_stack_pointer);
++#endif
++ pr_info("good_stack: %px-%px\n", good_stack, good_stack + sizeof(good_stack));
++ pr_info("bad_stack : %px-%px\n", bad_stack, bad_stack + sizeof(good_stack));
++
+ user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
+ PROT_READ | PROT_WRITE | PROT_EXEC,
+ MAP_ANONYMOUS | MAP_PRIVATE, 0);
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index c6e83f6021c13..3029886a42b6d 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1499,8 +1499,7 @@ void mmc_blk_cqe_recovery(struct mmc_queue *mq)
+ err = mmc_cqe_recovery(host);
+ if (err)
+ mmc_blk_reset(mq->blkdata, host, MMC_BLK_CQE_RECOVERY);
+- else
+- mmc_blk_reset_success(mq->blkdata, MMC_BLK_CQE_RECOVERY);
++ mmc_blk_reset_success(mq->blkdata, MMC_BLK_CQE_RECOVERY);
+
+ pr_debug("%s: CQE recovery done\n", mmc_hostname(host));
+ }
+diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
+index 3ab75d3e2ce32..fd18141110865 100644
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -49,6 +49,10 @@
+ #define SST49LF008A 0x005a
+ #define AT49BV6416 0x00d6
+
++enum cfi_quirks {
++ CFI_QUIRK_DQ_TRUE_DATA = BIT(0),
++};
++
+ static int cfi_amdstd_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
+ static int cfi_amdstd_write_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
+ static int cfi_amdstd_write_buffers(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
+@@ -365,6 +369,15 @@ static void fixup_s29ns512p_sectors(struct mtd_info *mtd)
+ mtd->name);
+ }
+
++static void fixup_quirks(struct mtd_info *mtd)
++{
++ struct map_info *map = mtd->priv;
++ struct cfi_private *cfi = map->fldrv_priv;
++
++ if (cfi->mfr == CFI_MFR_AMD && cfi->id == 0x0c01)
++ cfi->quirks |= CFI_QUIRK_DQ_TRUE_DATA;
++}
++
+ /* Used to fix CFI-Tables of chips without Extended Query Tables */
+ static struct cfi_fixup cfi_nopri_fixup_table[] = {
+ { CFI_MFR_SST, 0x234a, fixup_sst39vf }, /* SST39VF1602 */
+@@ -403,6 +416,7 @@ static struct cfi_fixup cfi_fixup_table[] = {
+ #if !FORCE_WORD_WRITE
+ { CFI_MFR_ANY, CFI_ID_ANY, fixup_use_write_buffers },
+ #endif
++ { CFI_MFR_ANY, CFI_ID_ANY, fixup_quirks },
+ { 0, 0, NULL }
+ };
+ static struct cfi_fixup jedec_fixup_table[] = {
+@@ -731,50 +745,46 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd)
+ }
+
+ /*
+- * Return true if the chip is ready.
++ * Return true if the chip is ready and has the correct value.
+ *
+ * Ready is one of: read mode, query mode, erase-suspend-read mode (in any
+ * non-suspended sector) and is indicated by no toggle bits toggling.
+ *
++ * Error are indicated by toggling bits or bits held with the wrong value,
++ * or with bits toggling.
++ *
+ * Note that anything more complicated than checking if no bits are toggling
+ * (including checking DQ5 for an error status) is tricky to get working
+ * correctly and is therefore not done (particularly with interleaved chips
+ * as each chip must be checked independently of the others).
+ */
+-static int __xipram chip_ready(struct map_info *map, unsigned long addr)
++static int __xipram chip_ready(struct map_info *map, unsigned long addr,
++ map_word *expected)
+ {
+ map_word d, t;
++ int ret;
+
+ d = map_read(map, addr);
+ t = map_read(map, addr);
+
+- return map_word_equal(map, d, t);
++ ret = map_word_equal(map, d, t);
++
++ if (!ret || !expected)
++ return ret;
++
++ return map_word_equal(map, t, *expected);
+ }
+
+-/*
+- * Return true if the chip is ready and has the correct value.
+- *
+- * Ready is one of: read mode, query mode, erase-suspend-read mode (in any
+- * non-suspended sector) and it is indicated by no bits toggling.
+- *
+- * Error are indicated by toggling bits or bits held with the wrong value,
+- * or with bits toggling.
+- *
+- * Note that anything more complicated than checking if no bits are toggling
+- * (including checking DQ5 for an error status) is tricky to get working
+- * correctly and is therefore not done (particularly with interleaved chips
+- * as each chip must be checked independently of the others).
+- *
+- */
+-static int __xipram chip_good(struct map_info *map, unsigned long addr, map_word expected)
++static int __xipram chip_good(struct map_info *map, unsigned long addr,
++ map_word *expected)
+ {
+- map_word oldd, curd;
++ struct cfi_private *cfi = map->fldrv_priv;
++ map_word *datum = expected;
+
+- oldd = map_read(map, addr);
+- curd = map_read(map, addr);
++ if (cfi->quirks & CFI_QUIRK_DQ_TRUE_DATA)
++ datum = NULL;
+
+- return map_word_equal(map, oldd, curd) &&
+- map_word_equal(map, curd, expected);
++ return chip_ready(map, addr, datum);
+ }
+
+ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr, int mode)
+@@ -791,7 +801,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
+
+ case FL_STATUS:
+ for (;;) {
+- if (chip_ready(map, adr))
++ if (chip_ready(map, adr, NULL))
+ break;
+
+ if (time_after(jiffies, timeo)) {
+@@ -829,7 +839,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
+ chip->state = FL_ERASE_SUSPENDING;
+ chip->erase_suspended = 1;
+ for (;;) {
+- if (chip_ready(map, adr))
++ if (chip_ready(map, adr, NULL))
+ break;
+
+ if (time_after(jiffies, timeo)) {
+@@ -1360,7 +1370,7 @@ static int do_otp_lock(struct map_info *map, struct flchip *chip, loff_t adr,
+ /* wait for chip to become ready */
+ timeo = jiffies + msecs_to_jiffies(2);
+ for (;;) {
+- if (chip_ready(map, adr))
++ if (chip_ready(map, adr, NULL))
+ break;
+
+ if (time_after(jiffies, timeo)) {
+@@ -1630,7 +1640,8 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
+ * We check "time_after" and "!chip_good" before checking
+ * "chip_good" to avoid the failure due to scheduling.
+ */
+- if (time_after(jiffies, timeo) && !chip_good(map, adr, datum)) {
++ if (time_after(jiffies, timeo) &&
++ !chip_good(map, adr, &datum)) {
+ xip_enable(map, chip, adr);
+ printk(KERN_WARNING "MTD %s(): software timeout\n", __func__);
+ xip_disable(map, chip, adr);
+@@ -1638,7 +1649,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
+ break;
+ }
+
+- if (chip_good(map, adr, datum))
++ if (chip_good(map, adr, &datum))
+ break;
+
+ /* Latency issues. Drop the lock, wait a while and retry */
+@@ -1882,13 +1893,13 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
+ }
+
+ /*
+- * We check "time_after" and "!chip_good" before checking "chip_good" to avoid
+- * the failure due to scheduling.
++ * We check "time_after" and "!chip_good" before checking
++ * "chip_good" to avoid the failure due to scheduling.
+ */
+- if (time_after(jiffies, timeo) && !chip_good(map, adr, datum))
++ if (time_after(jiffies, timeo) && !chip_good(map, adr, &datum))
+ break;
+
+- if (chip_good(map, adr, datum)) {
++ if (chip_good(map, adr, &datum)) {
+ xip_enable(map, chip, adr);
+ goto op_done;
+ }
+@@ -2022,7 +2033,7 @@ static int cfi_amdstd_panic_wait(struct map_info *map, struct flchip *chip,
+ * If the driver thinks the chip is idle, and no toggle bits
+ * are changing, then the chip is actually idle for sure.
+ */
+- if (chip->state == FL_READY && chip_ready(map, adr))
++ if (chip->state == FL_READY && chip_ready(map, adr, NULL))
+ return 0;
+
+ /*
+@@ -2039,7 +2050,7 @@ static int cfi_amdstd_panic_wait(struct map_info *map, struct flchip *chip,
+
+ /* wait for the chip to become ready */
+ for (i = 0; i < jiffies_to_usecs(timeo); i++) {
+- if (chip_ready(map, adr))
++ if (chip_ready(map, adr, NULL))
+ return 0;
+
+ udelay(1);
+@@ -2103,13 +2114,13 @@ retry:
+ map_write(map, datum, adr);
+
+ for (i = 0; i < jiffies_to_usecs(uWriteTimeout); i++) {
+- if (chip_ready(map, adr))
++ if (chip_ready(map, adr, NULL))
+ break;
+
+ udelay(1);
+ }
+
+- if (!chip_good(map, adr, datum)) {
++ if (!chip_ready(map, adr, &datum)) {
+ /* reset on all failures. */
+ map_write(map, CMD(0xF0), chip->start);
+ /* FIXME - should have reset delay before continuing */
+@@ -2250,6 +2261,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
+ DECLARE_WAITQUEUE(wait, current);
+ int ret = 0;
+ int retry_cnt = 0;
++ map_word datum = map_word_ff(map);
+
+ adr = cfi->addr_unlock1;
+
+@@ -2304,7 +2316,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
+ chip->erase_suspended = 0;
+ }
+
+- if (chip_good(map, adr, map_word_ff(map)))
++ if (chip_ready(map, adr, &datum))
+ break;
+
+ if (time_after(jiffies, timeo)) {
+@@ -2346,6 +2358,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
+ DECLARE_WAITQUEUE(wait, current);
+ int ret = 0;
+ int retry_cnt = 0;
++ map_word datum = map_word_ff(map);
+
+ adr += chip->start;
+
+@@ -2400,7 +2413,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
+ chip->erase_suspended = 0;
+ }
+
+- if (chip_good(map, adr, map_word_ff(map)))
++ if (chip_ready(map, adr, &datum))
+ break;
+
+ if (time_after(jiffies, timeo)) {
+@@ -2593,7 +2606,7 @@ static int __maybe_unused do_ppb_xxlock(struct map_info *map,
+ */
+ timeo = jiffies + msecs_to_jiffies(2000); /* 2s max (un)locking */
+ for (;;) {
+- if (chip_ready(map, adr))
++ if (chip_ready(map, adr, NULL))
+ break;
+
+ if (time_after(jiffies, timeo)) {
+diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
+index d0c6b66b74509..9f6ffd340a3ef 100644
+--- a/drivers/mtd/ubi/vmt.c
++++ b/drivers/mtd/ubi/vmt.c
+@@ -322,7 +322,6 @@ out_mapping:
+ ubi->volumes[vol_id] = NULL;
+ ubi->vol_count -= 1;
+ spin_unlock(&ubi->volumes_lock);
+- ubi_eba_destroy_table(eba_tbl);
+ out_acc:
+ spin_lock(&ubi->volumes_lock);
+ ubi->rsvd_pebs -= vol->reserved_pebs;
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 1df7aed5ae15d..be064bcfd70a6 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2778,6 +2778,7 @@ static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip,
+ */
+ child = of_get_child_by_name(np, "mdio");
+ err = mv88e6xxx_mdio_register(chip, child, false);
++ of_node_put(child);
+ if (err)
+ return err;
+
+diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
+index 1b4dfd357383b..1b9fb78ef8243 100644
+--- a/drivers/net/ethernet/altera/altera_tse_main.c
++++ b/drivers/net/ethernet/altera/altera_tse_main.c
+@@ -174,7 +174,8 @@ static int altera_tse_mdio_create(struct net_device *dev, unsigned int id)
+ mdio = mdiobus_alloc();
+ if (mdio == NULL) {
+ netdev_err(dev, "Error allocating MDIO bus\n");
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto put_node;
+ }
+
+ mdio->name = ALTERA_TSE_RESOURCE_NAME;
+@@ -191,6 +192,7 @@ static int altera_tse_mdio_create(struct net_device *dev, unsigned int id)
+ mdio->id);
+ goto out_free_mdio;
+ }
++ of_node_put(mdio_node);
+
+ if (netif_msg_drv(priv))
+ netdev_info(dev, "MDIO bus %s: created\n", mdio->id);
+@@ -200,6 +202,8 @@ static int altera_tse_mdio_create(struct net_device *dev, unsigned int id)
+ out_free_mdio:
+ mdiobus_free(mdio);
+ mdio = NULL;
++put_node:
++ of_node_put(mdio_node);
+ return ret;
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/Makefile b/drivers/net/ethernet/broadcom/Makefile
+index 7046ad6d3d0e3..ac50da49ca770 100644
+--- a/drivers/net/ethernet/broadcom/Makefile
++++ b/drivers/net/ethernet/broadcom/Makefile
+@@ -16,3 +16,8 @@ obj-$(CONFIG_BGMAC_BCMA) += bgmac-bcma.o bgmac-bcma-mdio.o
+ obj-$(CONFIG_BGMAC_PLATFORM) += bgmac-platform.o
+ obj-$(CONFIG_SYSTEMPORT) += bcmsysport.o
+ obj-$(CONFIG_BNXT) += bnxt/
++
++# FIXME: temporarily silence -Warray-bounds on non W=1+ builds
++ifndef KBUILD_EXTRA_WARN
++CFLAGS_tg3.o += -Wno-array-bounds
++endif
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+index 8aaf856771d7b..6055a4917ff69 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+@@ -1148,9 +1148,9 @@ static int ixgbe_update_vf_xcast_mode(struct ixgbe_adapter *adapter,
+
+ switch (xcast_mode) {
+ case IXGBEVF_XCAST_MODE_NONE:
+- disable = IXGBE_VMOLR_BAM | IXGBE_VMOLR_ROMPE |
++ disable = IXGBE_VMOLR_ROMPE |
+ IXGBE_VMOLR_MPE | IXGBE_VMOLR_UPE | IXGBE_VMOLR_VPE;
+- enable = 0;
++ enable = IXGBE_VMOLR_BAM;
+ break;
+ case IXGBEVF_XCAST_MODE_MULTI:
+ disable = IXGBE_VMOLR_MPE | IXGBE_VMOLR_UPE | IXGBE_VMOLR_VPE;
+@@ -1172,9 +1172,9 @@ static int ixgbe_update_vf_xcast_mode(struct ixgbe_adapter *adapter,
+ return -EPERM;
+ }
+
+- disable = 0;
++ disable = IXGBE_VMOLR_VPE;
+ enable = IXGBE_VMOLR_BAM | IXGBE_VMOLR_ROMPE |
+- IXGBE_VMOLR_MPE | IXGBE_VMOLR_UPE | IXGBE_VMOLR_VPE;
++ IXGBE_VMOLR_MPE | IXGBE_VMOLR_UPE;
+ break;
+ default:
+ return -EOPNOTSUPP;
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 59f3dce3ab1d9..f2eaf8c13cc22 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1575,6 +1575,9 @@ static int mtk_hwlro_get_fdir_entry(struct net_device *dev,
+ struct ethtool_rx_flow_spec *fsp =
+ (struct ethtool_rx_flow_spec *)&cmd->fs;
+
++ if (fsp->location >= ARRAY_SIZE(mac->hwlro_ip))
++ return -EINVAL;
++
+ /* only tcp dst ipv4 is meaningful, others are meaningless */
+ fsp->flow_type = TCP_V4_FLOW;
+ fsp->h_u.tcp_ip4_spec.ip4dst = ntohl(mac->hwlro_ip[fsp->location]);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+index f652cfd8127bf..1d33fae529b66 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -2083,7 +2083,7 @@ static int mlx4_en_get_module_eeprom(struct net_device *dev,
+ en_err(priv,
+ "mlx4_get_module_info i(%d) offset(%d) bytes_to_read(%d) - FAILED (0x%x)\n",
+ i, offset, ee->len - i, ret);
+- return 0;
++ return ret;
+ }
+
+ i += ret;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+index 2266c09b741a2..a22e932a00b01 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+@@ -637,6 +637,9 @@ static void mlx5_fw_tracer_handle_traces(struct work_struct *work)
+ if (!tracer->owner)
+ return;
+
++ if (unlikely(!tracer->str_db.loaded))
++ goto arm;
++
+ block_count = tracer->buff.size / TRACER_BLOCK_SIZE_BYTE;
+ start_offset = tracer->buff.consumer_index * TRACER_BLOCK_SIZE_BYTE;
+
+@@ -694,6 +697,7 @@ static void mlx5_fw_tracer_handle_traces(struct work_struct *work)
+ &tmp_trace_block[TRACES_PER_BLOCK - 1]);
+ }
+
++arm:
+ mlx5_fw_tracer_arm(dev);
+ }
+
+@@ -935,8 +939,7 @@ void mlx5_fw_tracer_event(struct mlx5_core_dev *dev, struct mlx5_eqe *eqe)
+ queue_work(tracer->work_queue, &tracer->ownership_change_work);
+ break;
+ case MLX5_TRACER_SUBTYPE_TRACES_AVAILABLE:
+- if (likely(tracer->str_db.loaded))
+- queue_work(tracer->work_queue, &tracer->handle_traces_work);
++ queue_work(tracer->work_queue, &tracer->handle_traces_work);
+ break;
+ default:
+ mlx5_core_dbg(dev, "FWTracer: Event with unrecognized subtype: sub_type %d\n",
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 75872aef44d02..6ecb92f55e974 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -4327,6 +4327,11 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog)
+
+ unlock:
+ mutex_unlock(&priv->state_lock);
++
++ /* Need to fix some features. */
++ if (!err)
++ netdev_update_features(netdev);
++
+ return err;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
+index 21296fa7f7fbf..bf51ed94952c5 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
+@@ -227,8 +227,6 @@ static int mlxsw_sp_dcbnl_ieee_setets(struct net_device *dev,
+ static int mlxsw_sp_dcbnl_app_validate(struct net_device *dev,
+ struct dcb_app *app)
+ {
+- int prio;
+-
+ if (app->priority >= IEEE_8021QAZ_MAX_TCS) {
+ netdev_err(dev, "APP entry with priority value %u is invalid\n",
+ app->priority);
+@@ -242,17 +240,6 @@ static int mlxsw_sp_dcbnl_app_validate(struct net_device *dev,
+ app->protocol);
+ return -EINVAL;
+ }
+-
+- /* Warn about any DSCP APP entries with the same PID. */
+- prio = fls(dcb_ieee_getapp_mask(dev, app));
+- if (prio--) {
+- if (prio < app->priority)
+- netdev_warn(dev, "Choosing priority %d for DSCP %d in favor of previously-active value of %d\n",
+- app->priority, app->protocol, prio);
+- else if (prio > app->priority)
+- netdev_warn(dev, "Ignoring new priority %d for DSCP %d in favor of current value of %d\n",
+- app->priority, app->protocol, prio);
+- }
+ break;
+
+ case IEEE_8021QAZ_APP_SEL_ETHERTYPE:
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index 2e75d0af4a585..a51661cfd27f3 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -292,8 +292,6 @@ nfp_net_get_link_ksettings(struct net_device *netdev,
+
+ /* Init to unknowns */
+ ethtool_link_ksettings_add_link_mode(cmd, supported, FIBRE);
+- ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
+- ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause);
+ cmd->base.port = PORT_OTHER;
+ cmd->base.speed = SPEED_UNKNOWN;
+ cmd->base.duplex = DUPLEX_UNKNOWN;
+@@ -301,6 +299,8 @@ nfp_net_get_link_ksettings(struct net_device *netdev,
+ port = nfp_port_from_netdev(netdev);
+ eth_port = nfp_port_get_eth_port(port);
+ if (eth_port) {
++ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
++ ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause);
+ cmd->base.autoneg = eth_port->aneg != NFP_ANEG_DISABLED ?
+ AUTONEG_ENABLE : AUTONEG_DISABLE;
+ nfp_net_set_fec_link_mode(eth_port, cmd);
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index eaa890a6a5d21..efdac68da7f4b 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -746,7 +746,6 @@ int __init mdio_bus_init(void)
+
+ return ret;
+ }
+-EXPORT_SYMBOL_GPL(mdio_bus_init);
+
+ #if IS_ENABLED(CONFIG_PHYLIB)
+ void mdio_bus_exit(void)
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 0135903300595..1d00a563892ae 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -285,7 +285,7 @@ static int kszphy_config_reset(struct phy_device *phydev)
+ }
+ }
+
+- if (priv->led_mode >= 0)
++ if (priv->type && priv->led_mode >= 0)
+ kszphy_setup_led(phydev, priv->type->led_mode_reg, priv->led_mode);
+
+ return 0;
+@@ -301,10 +301,10 @@ static int kszphy_config_init(struct phy_device *phydev)
+
+ type = priv->type;
+
+- if (type->has_broadcast_disable)
++ if (type && type->has_broadcast_disable)
+ kszphy_broadcast_disable(phydev);
+
+- if (type->has_nand_tree_disable)
++ if (type && type->has_nand_tree_disable)
+ kszphy_nand_tree_disable(phydev);
+
+ return kszphy_config_reset(phydev);
+@@ -775,7 +775,7 @@ static int kszphy_probe(struct phy_device *phydev)
+
+ priv->type = type;
+
+- if (type->led_mode_reg) {
++ if (type && type->led_mode_reg) {
+ ret = of_property_read_u32(np, "micrel,led-mode",
+ &priv->led_mode);
+ if (ret)
+@@ -796,7 +796,8 @@ static int kszphy_probe(struct phy_device *phydev)
+ unsigned long rate = clk_get_rate(clk);
+ bool rmii_ref_clk_sel_25_mhz;
+
+- priv->rmii_ref_clk_sel = type->has_rmii_ref_clk_sel;
++ if (type)
++ priv->rmii_ref_clk_sel = type->has_rmii_ref_clk_sel;
+ rmii_ref_clk_sel_25_mhz = of_property_read_bool(np,
+ "micrel,rmii-reference-clock-select-25-mhz");
+
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+index 4d45d5a8ad2ed..db583a6aeb0cb 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -5615,7 +5615,7 @@ unsigned int ar9003_get_paprd_scale_factor(struct ath_hw *ah,
+
+ static u8 ar9003_get_eepmisc(struct ath_hw *ah)
+ {
+- return ah->eeprom.map4k.baseEepHeader.eepMisc;
++ return ah->eeprom.ar9300_eep.baseEepHeader.opCapFlags.eepMisc;
+ }
+
+ const struct eeprom_ops eep_ar9300_ops = {
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+index a171dbb29fbb6..ad949eb02f3d2 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+@@ -720,7 +720,7 @@
+ #define AR_CH0_TOP2 (AR_SREV_9300(ah) ? 0x1628c : \
+ (AR_SREV_9462(ah) ? 0x16290 : 0x16284))
+ #define AR_CH0_TOP2_XPABIASLVL (AR_SREV_9561(ah) ? 0x1e00 : 0xf000)
+-#define AR_CH0_TOP2_XPABIASLVL_S 12
++#define AR_CH0_TOP2_XPABIASLVL_S (AR_SREV_9561(ah) ? 9 : 12)
+
+ #define AR_CH0_XTAL (AR_SREV_9300(ah) ? 0x16294 : \
+ ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : \
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index d567fbe79cffa..3cd3f3ca1000d 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -1005,6 +1005,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
+ goto rx_next;
+ }
+
++ if (rxstatus->rs_keyix >= ATH_KEYMAX &&
++ rxstatus->rs_keyix != ATH9K_RXKEYIX_INVALID) {
++ ath_dbg(common, ANY,
++ "Invalid keyix, dropping (keyix: %d)\n",
++ rxstatus->rs_keyix);
++ goto rx_next;
++ }
++
+ /* Get the RX status information */
+
+ memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
+diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
+index 0cb5b58925dc4..40369cb59eb56 100644
+--- a/drivers/net/wireless/ath/carl9170/tx.c
++++ b/drivers/net/wireless/ath/carl9170/tx.c
+@@ -1554,6 +1554,9 @@ static struct carl9170_vif_info *carl9170_pick_beaconing_vif(struct ar9170 *ar)
+ goto out;
+ }
+ } while (ar->beacon_enabled && i--);
++
++ /* no entry found in list */
++ return NULL;
+ }
+
+ out:
+diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c
+index 88446258e7751..3508a78226193 100644
+--- a/drivers/net/wireless/broadcom/b43/phy_n.c
++++ b/drivers/net/wireless/broadcom/b43/phy_n.c
+@@ -594,7 +594,7 @@ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev)
+ u16 data[4];
+ s16 gain[2];
+ u16 minmax[2];
+- static const u16 lna_gain[4] = { -2, 10, 19, 25 };
++ static const s16 lna_gain[4] = { -2, 10, 19, 25 };
+
+ if (nphy->hang_avoid)
+ b43_nphy_stay_in_carrier_search(dev, 1);
+diff --git a/drivers/net/wireless/broadcom/b43legacy/phy.c b/drivers/net/wireless/broadcom/b43legacy/phy.c
+index 995c7d0c212ae..11ee5ee489767 100644
+--- a/drivers/net/wireless/broadcom/b43legacy/phy.c
++++ b/drivers/net/wireless/broadcom/b43legacy/phy.c
+@@ -1148,7 +1148,7 @@ void b43legacy_phy_lo_b_measure(struct b43legacy_wldev *dev)
+ struct b43legacy_phy *phy = &dev->phy;
+ u16 regstack[12] = { 0 };
+ u16 mls;
+- u16 fval;
++ s16 fval;
+ int i;
+ int j;
+
+diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c
+index 84205aa508dfd..daa4f9eb08fff 100644
+--- a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c
++++ b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c
+@@ -397,7 +397,7 @@ netdev_tx_t libipw_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ /* Each fragment may need to have room for encryption
+ * pre/postfix */
+- if (host_encrypt)
++ if (host_encrypt && crypt && crypt->ops)
+ bytes_per_frag -= crypt->ops->extra_mpdu_prefix_len +
+ crypt->ops->extra_mpdu_postfix_len;
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/power.c b/drivers/net/wireless/intel/iwlwifi/mvm/power.c
+index c11fe2621d510..cd19831ace579 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/power.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/power.c
+@@ -611,6 +611,9 @@ static void iwl_mvm_power_get_vifs_iterator(void *_data, u8 *mac,
+ struct iwl_power_vifs *power_iterator = _data;
+ bool active = mvmvif->phy_ctxt && mvmvif->phy_ctxt->id < NUM_PHY_CTX;
+
++ if (!mvmvif->uploaded)
++ return;
++
+ switch (ieee80211_vif_type_p2p(vif)) {
+ case NL80211_IFTYPE_P2P_DEVICE:
+ break;
+diff --git a/drivers/net/wireless/marvell/mwifiex/11h.c b/drivers/net/wireless/marvell/mwifiex/11h.c
+index 238accfe4f41d..c4176e357b22c 100644
+--- a/drivers/net/wireless/marvell/mwifiex/11h.c
++++ b/drivers/net/wireless/marvell/mwifiex/11h.c
+@@ -303,5 +303,7 @@ void mwifiex_dfs_chan_sw_work_queue(struct work_struct *work)
+
+ mwifiex_dbg(priv->adapter, MSG,
+ "indicating channel switch completion to kernel\n");
++ mutex_lock(&priv->wdev.mtx);
+ cfg80211_ch_switch_notify(priv->netdev, &priv->dfs_chandef);
++ mutex_unlock(&priv->wdev.mtx);
+ }
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
+index 225c1c8851cc4..77bf8a601ca42 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
+@@ -460,8 +460,10 @@ static void rtl8180_tx(struct ieee80211_hw *dev,
+ struct rtl8180_priv *priv = dev->priv;
+ struct rtl8180_tx_ring *ring;
+ struct rtl8180_tx_desc *entry;
++ unsigned int prio = 0;
+ unsigned long flags;
+- unsigned int idx, prio, hw_prio;
++ unsigned int idx, hw_prio;
++
+ dma_addr_t mapping;
+ u32 tx_flags;
+ u8 rc_flags;
+@@ -470,7 +472,9 @@ static void rtl8180_tx(struct ieee80211_hw *dev,
+ /* do arithmetic and then convert to le16 */
+ u16 frame_duration = 0;
+
+- prio = skb_get_queue_mapping(skb);
++ /* rtl8180/rtl8185 only has one useable tx queue */
++ if (dev->queues > IEEE80211_AC_BK)
++ prio = skb_get_queue_mapping(skb);
+ ring = &priv->tx_ring[prio];
+
+ mapping = pci_map_single(priv->pdev, skb->data,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 3d6c0d8c71d7e..395671383ca93 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1042,7 +1042,7 @@ int rtl_usb_probe(struct usb_interface *intf,
+ hw = ieee80211_alloc_hw(sizeof(struct rtl_priv) +
+ sizeof(struct rtl_usb_priv), &rtl_ops);
+ if (!hw) {
+- WARN_ONCE(true, "rtl_usb: ieee80211 alloc failed\n");
++ pr_warn("rtl_usb: ieee80211 alloc failed\n");
+ return -ENOMEM;
+ }
+ rtlpriv = hw->priv;
+diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c
+index ced3c20d64539..52e209950c436 100644
+--- a/drivers/nfc/st21nfca/se.c
++++ b/drivers/nfc/st21nfca/se.c
+@@ -252,7 +252,7 @@ int st21nfca_hci_se_io(struct nfc_hci_dev *hdev, u32 se_idx,
+ }
+ EXPORT_SYMBOL(st21nfca_hci_se_io);
+
+-static void st21nfca_se_wt_timeout(struct timer_list *t)
++static void st21nfca_se_wt_work(struct work_struct *work)
+ {
+ /*
+ * No answer from the secure element
+@@ -265,8 +265,9 @@ static void st21nfca_se_wt_timeout(struct timer_list *t)
+ */
+ /* hardware reset managed through VCC_UICC_OUT power supply */
+ u8 param = 0x01;
+- struct st21nfca_hci_info *info = from_timer(info, t,
+- se_info.bwi_timer);
++ struct st21nfca_hci_info *info = container_of(work,
++ struct st21nfca_hci_info,
++ se_info.timeout_work);
+
+ pr_debug("\n");
+
+@@ -284,6 +285,13 @@ static void st21nfca_se_wt_timeout(struct timer_list *t)
+ info->se_info.cb(info->se_info.cb_context, NULL, 0, -ETIME);
+ }
+
++static void st21nfca_se_wt_timeout(struct timer_list *t)
++{
++ struct st21nfca_hci_info *info = from_timer(info, t, se_info.bwi_timer);
++
++ schedule_work(&info->se_info.timeout_work);
++}
++
+ static void st21nfca_se_activation_timeout(struct timer_list *t)
+ {
+ struct st21nfca_hci_info *info = from_timer(info, t,
+@@ -322,7 +330,7 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
+ * AID 81 5 to 16
+ * PARAMETERS 82 0 to 255
+ */
+- if (skb->len < NFC_MIN_AID_LENGTH + 2 &&
++ if (skb->len < NFC_MIN_AID_LENGTH + 2 ||
+ skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG)
+ return -EPROTO;
+
+@@ -334,22 +342,29 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
+ transaction->aid_len = skb->data[1];
+
+ /* Checking if the length of the AID is valid */
+- if (transaction->aid_len > sizeof(transaction->aid))
++ if (transaction->aid_len > sizeof(transaction->aid)) {
++ devm_kfree(dev, transaction);
+ return -EINVAL;
++ }
+
+ memcpy(transaction->aid, &skb->data[2],
+ transaction->aid_len);
+
+ /* Check next byte is PARAMETERS tag (82) */
+ if (skb->data[transaction->aid_len + 2] !=
+- NFC_EVT_TRANSACTION_PARAMS_TAG)
++ NFC_EVT_TRANSACTION_PARAMS_TAG) {
++ devm_kfree(dev, transaction);
+ return -EPROTO;
++ }
+
+ transaction->params_len = skb->data[transaction->aid_len + 3];
+
+ /* Total size is allocated (skb->len - 2) minus fixed array members */
+- if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction)))
++ if (transaction->params_len > ((skb->len - 2) -
++ sizeof(struct nfc_evt_transaction))) {
++ devm_kfree(dev, transaction);
+ return -EINVAL;
++ }
+
+ memcpy(transaction->params, skb->data +
+ transaction->aid_len + 4, transaction->params_len);
+@@ -376,6 +391,7 @@ int st21nfca_apdu_reader_event_received(struct nfc_hci_dev *hdev,
+ switch (event) {
+ case ST21NFCA_EVT_TRANSMIT_DATA:
+ del_timer_sync(&info->se_info.bwi_timer);
++ cancel_work_sync(&info->se_info.timeout_work);
+ info->se_info.bwi_active = false;
+ r = nfc_hci_send_event(hdev, ST21NFCA_DEVICE_MGNT_GATE,
+ ST21NFCA_EVT_SE_END_OF_APDU_TRANSFER, NULL, 0);
+@@ -405,6 +421,7 @@ void st21nfca_se_init(struct nfc_hci_dev *hdev)
+ struct st21nfca_hci_info *info = nfc_hci_get_clientdata(hdev);
+
+ init_completion(&info->se_info.req_completion);
++ INIT_WORK(&info->se_info.timeout_work, st21nfca_se_wt_work);
+ /* initialize timers */
+ timer_setup(&info->se_info.bwi_timer, st21nfca_se_wt_timeout, 0);
+ info->se_info.bwi_active = false;
+@@ -432,6 +449,7 @@ void st21nfca_se_deinit(struct nfc_hci_dev *hdev)
+ if (info->se_info.se_active)
+ del_timer_sync(&info->se_info.se_active_timer);
+
++ cancel_work_sync(&info->se_info.timeout_work);
+ info->se_info.bwi_active = false;
+ info->se_info.se_active = false;
+ }
+diff --git a/drivers/nfc/st21nfca/st21nfca.h b/drivers/nfc/st21nfca/st21nfca.h
+index 94ffb0501e872..7e2923ac92630 100644
+--- a/drivers/nfc/st21nfca/st21nfca.h
++++ b/drivers/nfc/st21nfca/st21nfca.h
+@@ -152,6 +152,7 @@ struct st21nfca_se_info {
+
+ se_io_cb_t cb;
+ void *cb_context;
++ struct work_struct timeout_work;
+ };
+
+ struct st21nfca_hci_info {
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index d7cf3202cdd3b..b06d2b6bd3feb 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1522,6 +1522,7 @@ static int nvme_alloc_admin_tags(struct nvme_dev *dev)
+ dev->ctrl.admin_q = blk_mq_init_queue(&dev->admin_tagset);
+ if (IS_ERR(dev->ctrl.admin_q)) {
+ blk_mq_free_tag_set(&dev->admin_tagset);
++ dev->ctrl.admin_q = NULL;
+ return -ENOMEM;
+ }
+ if (!blk_get_queue(dev->ctrl.admin_q)) {
+diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
+index a77bfeac867db..fef5b6c2fae23 100644
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -170,9 +170,7 @@ static int overlay_notify(struct overlay_changeset *ovcs,
+
+ ret = blocking_notifier_call_chain(&overlay_notify_chain,
+ action, &nd);
+- if (ret == NOTIFY_OK || ret == NOTIFY_STOP)
+- return 0;
+- if (ret) {
++ if (notifier_to_errno(ret)) {
+ ret = notifier_to_errno(ret);
+ pr_err("overlay changeset %s notifier error %d, target: %pOF\n",
+ of_overlay_action_name[action], ret, nd.target);
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 33e5103939767..133fad284c9fa 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -1331,22 +1331,21 @@ static int qcom_pcie_probe(struct platform_device *pdev)
+ }
+
+ ret = phy_init(pcie->phy);
+- if (ret) {
+- pm_runtime_disable(&pdev->dev);
++ if (ret)
+ goto err_pm_runtime_put;
+- }
+
+ platform_set_drvdata(pdev, pcie);
+
+ ret = dw_pcie_host_init(pp);
+ if (ret) {
+ dev_err(dev, "cannot initialize host\n");
+- pm_runtime_disable(&pdev->dev);
+- goto err_pm_runtime_put;
++ goto err_phy_exit;
+ }
+
+ return 0;
+
++err_phy_exit:
++ phy_exit(pcie->phy);
+ err_pm_runtime_put:
+ pm_runtime_put(dev);
+ pm_runtime_disable(dev);
+diff --git a/drivers/pci/controller/pcie-cadence-ep.c b/drivers/pci/controller/pcie-cadence-ep.c
+index c3a088910f48d..f6da8d562b8a3 100644
+--- a/drivers/pci/controller/pcie-cadence-ep.c
++++ b/drivers/pci/controller/pcie-cadence-ep.c
+@@ -178,8 +178,7 @@ static int cdns_pcie_ep_map_addr(struct pci_epc *epc, u8 fn, phys_addr_t addr,
+ struct cdns_pcie *pcie = &ep->pcie;
+ u32 r;
+
+- r = find_first_zero_bit(&ep->ob_region_map,
+- sizeof(ep->ob_region_map) * BITS_PER_LONG);
++ r = find_first_zero_bit(&ep->ob_region_map, BITS_PER_LONG);
+ if (r >= ep->max_regions - 1) {
+ dev_err(&epc->dev, "no free outbound region\n");
+ return -EINVAL;
+diff --git a/drivers/pci/controller/pcie-rockchip-ep.c b/drivers/pci/controller/pcie-rockchip-ep.c
+index caf34661d38d4..06dd2ab73b6ee 100644
+--- a/drivers/pci/controller/pcie-rockchip-ep.c
++++ b/drivers/pci/controller/pcie-rockchip-ep.c
+@@ -263,8 +263,7 @@ static int rockchip_pcie_ep_map_addr(struct pci_epc *epc, u8 fn,
+ struct rockchip_pcie *pcie = &ep->rockchip;
+ u32 r;
+
+- r = find_first_zero_bit(&ep->ob_region_map,
+- sizeof(ep->ob_region_map) * BITS_PER_LONG);
++ r = find_first_zero_bit(&ep->ob_region_map, BITS_PER_LONG);
+ /*
+ * Region 0 is reserved for configuration space and shouldn't
+ * be used elsewhere per TRM, so leave it out.
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 293b3e3b0083b..48c419b306f34 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2517,6 +2517,8 @@ static const struct dmi_system_id bridge_d3_blacklist[] = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co., Ltd."),
+ DMI_MATCH(DMI_BOARD_NAME, "X299 DESIGNARE EX-CF"),
+ },
++ },
++ {
+ /*
+ * Downstream device is not accessible after putting a root port
+ * into D3cold and back into D0 on Elo i2.
+@@ -4667,18 +4669,18 @@ static int pci_dev_reset_slot_function(struct pci_dev *dev, int probe)
+
+ static void pci_dev_lock(struct pci_dev *dev)
+ {
+- pci_cfg_access_lock(dev);
+ /* block PM suspend, driver probe, etc. */
+ device_lock(&dev->dev);
++ pci_cfg_access_lock(dev);
+ }
+
+ /* Return 1 on successful lock, 0 on contention */
+ static int pci_dev_trylock(struct pci_dev *dev)
+ {
+- if (pci_cfg_access_trylock(dev)) {
+- if (device_trylock(&dev->dev))
++ if (device_trylock(&dev->dev)) {
++ if (pci_cfg_access_trylock(dev))
+ return 1;
+- pci_cfg_access_unlock(dev);
++ device_unlock(&dev->dev);
+ }
+
+ return 0;
+@@ -4686,8 +4688,8 @@ static int pci_dev_trylock(struct pci_dev *dev)
+
+ static void pci_dev_unlock(struct pci_dev *dev)
+ {
+- device_unlock(&dev->dev);
+ pci_cfg_access_unlock(dev);
++ device_unlock(&dev->dev);
+ }
+
+ static void pci_dev_save_and_disable(struct pci_dev *dev)
+diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
+index cbbe4a285b489..a8fdd6df6a126 100644
+--- a/drivers/pcmcia/Kconfig
++++ b/drivers/pcmcia/Kconfig
+@@ -146,7 +146,7 @@ config TCIC
+
+ config PCMCIA_ALCHEMY_DEVBOARD
+ tristate "Alchemy Db/Pb1xxx PCMCIA socket services"
+- depends on MIPS_ALCHEMY && PCMCIA
++ depends on MIPS_DB1XXX && PCMCIA
+ help
+ Enable this driver of you want PCMCIA support on your Alchemy
+ Db1000, Db/Pb1100, Db/Pb1500, Db/Pb1550, Db/Pb1200, DB1300
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c
+index 68107611c70a2..c64262f4ff117 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c
+@@ -1426,6 +1426,11 @@ static const struct phy_ops qcom_qmp_phy_gen_ops = {
+ .owner = THIS_MODULE,
+ };
+
++static void qcom_qmp_reset_control_put(void *data)
++{
++ reset_control_put(data);
++}
++
+ static
+ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id)
+ {
+@@ -1468,7 +1473,7 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id)
+ * all phys that don't need this.
+ */
+ snprintf(prop_name, sizeof(prop_name), "pipe%d", id);
+- qphy->pipe_clk = of_clk_get_by_name(np, prop_name);
++ qphy->pipe_clk = devm_get_clk_from_child(dev, np, prop_name);
+ if (IS_ERR(qphy->pipe_clk)) {
+ if (qmp->cfg->type == PHY_TYPE_PCIE ||
+ qmp->cfg->type == PHY_TYPE_USB3) {
+@@ -1490,6 +1495,10 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id)
+ dev_err(dev, "failed to get lane%d reset\n", id);
+ return PTR_ERR(qphy->lane_rst);
+ }
++ ret = devm_add_action_or_reset(dev, qcom_qmp_reset_control_put,
++ qphy->lane_rst);
++ if (ret)
++ return ret;
+ }
+
+ generic_phy = devm_phy_create(dev, np, &qcom_qmp_phy_gen_ops);
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+index e69b84d9538a0..0c0f834eab823 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -773,7 +773,7 @@ static int armada_37xx_irqchip_register(struct platform_device *pdev,
+ for (i = 0; i < nr_irq_parent; i++) {
+ int irq = irq_of_parse_and_map(np, i);
+
+- if (irq < 0)
++ if (!irq)
+ continue;
+
+ gpiochip_set_chained_irqchip(gc, irqchip, irq,
+diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c
+index 5055ba2c6c940..a5f4c39eeb217 100644
+--- a/drivers/pwm/pwm-lp3943.c
++++ b/drivers/pwm/pwm-lp3943.c
+@@ -128,6 +128,7 @@ static int lp3943_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ if (err)
+ return err;
+
++ duty_ns = min(duty_ns, period_ns);
+ val = (u8)(duty_ns * LP3943_MAX_DUTY / period_ns);
+
+ return lp3943_write_byte(lp3943, reg_duty, val);
+diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
+index 4b8306594c3f1..8b1940110561a 100644
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -513,6 +513,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip)
+ parent = of_get_child_by_name(np, "regulators");
+ if (!parent) {
+ dev_err(dev, "regulators node not found\n");
++ of_node_put(np);
+ return -EINVAL;
+ }
+
+@@ -542,6 +543,7 @@ static int pfuze_parse_regulators_dt(struct pfuze_chip *chip)
+ }
+
+ of_node_put(parent);
++ of_node_put(np);
+ if (ret < 0) {
+ dev_err(dev, "Error parsing regulator init data: %d\n",
+ ret);
+diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
+index aa008fa11002e..f23f10887d93c 100644
+--- a/drivers/rpmsg/qcom_smd.c
++++ b/drivers/rpmsg/qcom_smd.c
+@@ -1388,9 +1388,9 @@ static int qcom_smd_parse_edge(struct device *dev,
+ edge->name = node->name;
+
+ irq = irq_of_parse_and_map(node, 0);
+- if (irq < 0) {
++ if (!irq) {
+ dev_err(dev, "required smd interrupt missing\n");
+- ret = irq;
++ ret = -EINVAL;
+ goto put_node;
+ }
+
+diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c
+index 964ed91416e1b..671b6d275da3e 100644
+--- a/drivers/rtc/rtc-mt6397.c
++++ b/drivers/rtc/rtc-mt6397.c
+@@ -339,6 +339,8 @@ static int mtk_rtc_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res)
++ return -EINVAL;
+ rtc->addr_base = res->start;
+
+ rtc->irq = platform_get_irq(pdev, 0);
+diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
+index 16b9dc2fff6bd..8b5a07503d5f0 100644
+--- a/drivers/scsi/dc395x.c
++++ b/drivers/scsi/dc395x.c
+@@ -3771,10 +3771,19 @@ static struct DeviceCtlBlk *device_alloc(struct AdapterCtlBlk *acb,
+ #endif
+ if (dcb->target_lun != 0) {
+ /* Copy settings */
+- struct DeviceCtlBlk *p;
+- list_for_each_entry(p, &acb->dcb_list, list)
+- if (p->target_id == dcb->target_id)
++ struct DeviceCtlBlk *p = NULL, *iter;
++
++ list_for_each_entry(iter, &acb->dcb_list, list)
++ if (iter->target_id == dcb->target_id) {
++ p = iter;
+ break;
++ }
++
++ if (!p) {
++ kfree(dcb);
++ return NULL;
++ }
++
+ dprintkdbg(DBG_1,
+ "device_alloc: <%02i-%i> copy from <%02i-%i>\n",
+ dcb->target_id, dcb->target_lun,
+diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
+index 658c0726581f9..1e087a206f48e 100644
+--- a/drivers/scsi/fcoe/fcoe_ctlr.c
++++ b/drivers/scsi/fcoe/fcoe_ctlr.c
+@@ -1978,7 +1978,7 @@ EXPORT_SYMBOL(fcoe_ctlr_recv_flogi);
+ *
+ * Returns: u64 fc world wide name
+ */
+-u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN],
++u64 fcoe_wwn_from_mac(unsigned char mac[ETH_ALEN],
+ unsigned int scheme, unsigned int port)
+ {
+ u64 wwn;
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index a84878fbf45d2..7352d46ebb093 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -4641,7 +4641,7 @@ static int __init megaraid_init(void)
+ * major number allocation.
+ */
+ major = register_chrdev(0, "megadev_legacy", &megadev_fops);
+- if (!major) {
++ if (major < 0) {
+ printk(KERN_WARNING
+ "megaraid: failed to register char device\n");
+ }
+diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c
+index 798a74535ea7b..9d70ee149d3e5 100644
+--- a/drivers/scsi/ufs/ufs-qcom.c
++++ b/drivers/scsi/ufs/ufs-qcom.c
+@@ -910,8 +910,11 @@ static void ufs_qcom_dev_ref_clk_ctrl(struct ufs_qcom_host *host, bool enable)
+
+ writel_relaxed(temp, host->dev_ref_clk_ctrl_mmio);
+
+- /* ensure that ref_clk is enabled/disabled before we return */
+- wmb();
++ /*
++ * Make sure the write to ref_clk reaches the destination and
++ * not stored in a Write Buffer (WB).
++ */
++ readl(host->dev_ref_clk_ctrl_mmio);
+
+ /*
+ * If we call hibern8 exit after this, we need to make sure that
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index fee1989e23f01..abc156cf05f60 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -119,8 +119,13 @@ int ufshcd_dump_regs(struct ufs_hba *hba, size_t offset, size_t len,
+ if (!regs)
+ return -ENOMEM;
+
+- for (pos = 0; pos < len; pos += 4)
++ for (pos = 0; pos < len; pos += 4) {
++ if (offset == 0 &&
++ pos >= REG_UIC_ERROR_CODE_PHY_ADAPTER_LAYER &&
++ pos <= REG_UIC_ERROR_CODE_DME)
++ continue;
+ regs[pos / 4] = ufshcd_readl(hba, offset + pos);
++ }
+
+ ufshcd_hex_dump(prefix, regs, len);
+ kfree(regs);
+diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c
+index 7908e7f2850f9..5721a353d95f4 100644
+--- a/drivers/soc/qcom/smp2p.c
++++ b/drivers/soc/qcom/smp2p.c
+@@ -428,6 +428,7 @@ static int smp2p_parse_ipc(struct qcom_smp2p *smp2p)
+ }
+
+ smp2p->ipc_regmap = syscon_node_to_regmap(syscon);
++ of_node_put(syscon);
+ if (IS_ERR(smp2p->ipc_regmap))
+ return PTR_ERR(smp2p->ipc_regmap);
+
+diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c
+index 2b49d2c212dab..5304529b41c9e 100644
+--- a/drivers/soc/qcom/smsm.c
++++ b/drivers/soc/qcom/smsm.c
+@@ -367,6 +367,7 @@ static int smsm_parse_ipc(struct qcom_smsm *smsm, unsigned host_id)
+ return 0;
+
+ host->ipc_regmap = syscon_node_to_regmap(syscon);
++ of_node_put(syscon);
+ if (IS_ERR(host->ipc_regmap))
+ return PTR_ERR(host->ipc_regmap);
+
+diff --git a/drivers/soc/rockchip/grf.c b/drivers/soc/rockchip/grf.c
+index 3b81e1d75a97e..3e7e999ee3245 100644
+--- a/drivers/soc/rockchip/grf.c
++++ b/drivers/soc/rockchip/grf.c
+@@ -151,12 +151,14 @@ static int __init rockchip_grf_init(void)
+ return -ENODEV;
+ if (!match || !match->data) {
+ pr_err("%s: missing grf data\n", __func__);
++ of_node_put(np);
+ return -EINVAL;
+ }
+
+ grf_info = match->data;
+
+ grf = syscon_node_to_regmap(np);
++ of_node_put(np);
+ if (IS_ERR(grf)) {
+ pr_err("%s: could not get grf syscon\n", __func__);
+ return PTR_ERR(grf);
+diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
+index 25a545c985d4a..c63cceec63129 100644
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -774,7 +774,7 @@ static int img_spfi_resume(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret) {
++ if (ret < 0) {
+ pm_runtime_put_noidle(dev);
+ return ret;
+ }
+diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
+index c70b1790a959f..c248b1c38ca64 100644
+--- a/drivers/spi/spi-ti-qspi.c
++++ b/drivers/spi/spi-ti-qspi.c
+@@ -408,6 +408,7 @@ static int ti_qspi_dma_xfer(struct ti_qspi *qspi, dma_addr_t dma_dst,
+ enum dma_ctrl_flags flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT;
+ struct dma_async_tx_descriptor *tx;
+ int ret;
++ unsigned long time_left;
+
+ tx = dmaengine_prep_dma_memcpy(chan, dma_dst, dma_src, len, flags);
+ if (!tx) {
+@@ -427,9 +428,9 @@ static int ti_qspi_dma_xfer(struct ti_qspi *qspi, dma_addr_t dma_dst,
+ }
+
+ dma_async_issue_pending(chan);
+- ret = wait_for_completion_timeout(&qspi->transfer_complete,
++ time_left = wait_for_completion_timeout(&qspi->transfer_complete,
+ msecs_to_jiffies(len));
+- if (ret <= 0) {
++ if (time_left == 0) {
+ dmaengine_terminate_sync(chan);
+ dev_err(qspi->dev, "DMA wait_for_completion_timeout\n");
+ return -ETIMEDOUT;
+diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c
+index 6cbf69a57dfd9..806be9d86338a 100644
+--- a/drivers/staging/greybus/audio_codec.c
++++ b/drivers/staging/greybus/audio_codec.c
+@@ -620,8 +620,8 @@ static int gbcodec_mute_stream(struct snd_soc_dai *dai, int mute, int stream)
+ break;
+ }
+ if (!data) {
+- dev_err(dai->dev, "%s:%s DATA connection missing\n",
+- dai->name, module->name);
++ dev_err(dai->dev, "%s DATA connection missing\n",
++ dai->name);
+ mutex_unlock(&codec->lock);
+ return -ENODEV;
+ }
+diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c
+index 919231fec09cb..5f1dd4e2d12ea 100644
+--- a/drivers/staging/rtl8192e/rtllib_softmac.c
++++ b/drivers/staging/rtl8192e/rtllib_softmac.c
+@@ -654,9 +654,9 @@ static void rtllib_beacons_stop(struct rtllib_device *ieee)
+ spin_lock_irqsave(&ieee->beacon_lock, flags);
+
+ ieee->beacon_txing = 0;
+- del_timer_sync(&ieee->beacon_timer);
+
+ spin_unlock_irqrestore(&ieee->beacon_lock, flags);
++ del_timer_sync(&ieee->beacon_timer);
+
+ }
+
+diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
+index 212cc9ccbb965..426966a29d31b 100644
+--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
++++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
+@@ -529,9 +529,9 @@ static void ieee80211_beacons_stop(struct ieee80211_device *ieee)
+ spin_lock_irqsave(&ieee->beacon_lock, flags);
+
+ ieee->beacon_txing = 0;
+- del_timer_sync(&ieee->beacon_timer);
+
+ spin_unlock_irqrestore(&ieee->beacon_lock, flags);
++ del_timer_sync(&ieee->beacon_timer);
+ }
+
+ void ieee80211_stop_send_beacons(struct ieee80211_device *ieee)
+diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
+index 5e2cdc25401ba..2b1ff63913afc 100644
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -569,13 +569,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
+ } else {
+ AutoloadFail = false;
+ }
+- if (((mac[0] == 0xff) && (mac[1] == 0xff) &&
++ if ((!AutoloadFail) ||
++ ((mac[0] == 0xff) && (mac[1] == 0xff) &&
+ (mac[2] == 0xff) && (mac[3] == 0xff) &&
+ (mac[4] == 0xff) && (mac[5] == 0xff)) ||
+ ((mac[0] == 0x00) && (mac[1] == 0x00) &&
+ (mac[2] == 0x00) && (mac[3] == 0x00) &&
+- (mac[4] == 0x00) && (mac[5] == 0x00)) ||
+- (!AutoloadFail)) {
++ (mac[4] == 0x00) && (mac[5] == 0x00))) {
+ mac[0] = 0x00;
+ mac[1] = 0xe0;
+ mac[2] = 0x4c;
+diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c
+index c8c5cdfc5e199..abc84d84f6386 100644
+--- a/drivers/tty/goldfish.c
++++ b/drivers/tty/goldfish.c
+@@ -407,6 +407,7 @@ static int goldfish_tty_probe(struct platform_device *pdev)
+ err_tty_register_device_failed:
+ free_irq(irq, qtty);
+ err_dec_line_count:
++ tty_port_destroy(&qtty->port);
+ goldfish_tty_current_line_count--;
+ if (goldfish_tty_current_line_count == 0)
+ goldfish_tty_delete_driver();
+@@ -428,6 +429,7 @@ static int goldfish_tty_remove(struct platform_device *pdev)
+ iounmap(qtty->base);
+ qtty->base = NULL;
+ free_irq(qtty->irq, pdev);
++ tty_port_destroy(&qtty->port);
+ goldfish_tty_current_line_count--;
+ if (goldfish_tty_current_line_count == 0)
+ goldfish_tty_delete_driver();
+diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c
+index 79a4958b3f5c8..440023069f4f3 100644
+--- a/drivers/tty/serial/8250/8250_fintek.c
++++ b/drivers/tty/serial/8250/8250_fintek.c
+@@ -197,12 +197,12 @@ static int fintek_8250_rs485_config(struct uart_port *port,
+ if (!pdata)
+ return -EINVAL;
+
+- /* Hardware do not support same RTS level on send and receive */
+- if (!(rs485->flags & SER_RS485_RTS_ON_SEND) ==
+- !(rs485->flags & SER_RS485_RTS_AFTER_SEND))
+- return -EINVAL;
+
+ if (rs485->flags & SER_RS485_ENABLED) {
++ /* Hardware do not support same RTS level on send and receive */
++ if (!(rs485->flags & SER_RS485_RTS_ON_SEND) ==
++ !(rs485->flags & SER_RS485_RTS_AFTER_SEND))
++ return -EINVAL;
+ memset(rs485->padding, 0, sizeof(rs485->padding));
+ config |= RS485_URA;
+ } else {
+diff --git a/drivers/tty/serial/digicolor-usart.c b/drivers/tty/serial/digicolor-usart.c
+index 4446c13629b1c..e06967ca62fa6 100644
+--- a/drivers/tty/serial/digicolor-usart.c
++++ b/drivers/tty/serial/digicolor-usart.c
+@@ -309,6 +309,8 @@ static void digicolor_uart_set_termios(struct uart_port *port,
+ case CS8:
+ default:
+ config |= UA_CONFIG_CHAR_LEN;
++ termios->c_cflag &= ~CSIZE;
++ termios->c_cflag |= CS8;
+ break;
+ }
+
+diff --git a/drivers/tty/serial/icom.c b/drivers/tty/serial/icom.c
+index ad374f7c476d2..cb950c78d66d8 100644
+--- a/drivers/tty/serial/icom.c
++++ b/drivers/tty/serial/icom.c
+@@ -1501,7 +1501,7 @@ static int icom_probe(struct pci_dev *dev,
+ retval = pci_read_config_dword(dev, PCI_COMMAND, &command_reg);
+ if (retval) {
+ dev_err(&dev->dev, "PCI Config read FAILED\n");
+- return retval;
++ goto probe_exit0;
+ }
+
+ pci_write_config_dword(dev, PCI_COMMAND,
+diff --git a/drivers/tty/serial/meson_uart.c b/drivers/tty/serial/meson_uart.c
+index 8a842591b37c7..1838d0be37044 100644
+--- a/drivers/tty/serial/meson_uart.c
++++ b/drivers/tty/serial/meson_uart.c
+@@ -255,6 +255,14 @@ static const char *meson_uart_type(struct uart_port *port)
+ return (port->type == PORT_MESON) ? "meson_uart" : NULL;
+ }
+
++/*
++ * This function is called only from probe() using a temporary io mapping
++ * in order to perform a reset before setting up the device. Since the
++ * temporarily mapped region was successfully requested, there can be no
++ * console on this port at this time. Hence it is not necessary for this
++ * function to acquire the port->lock. (Since there is no console on this
++ * port at this time, the port->lock is not initialized yet.)
++ */
+ static void meson_uart_reset(struct uart_port *port)
+ {
+ u32 val;
+@@ -269,9 +277,12 @@ static void meson_uart_reset(struct uart_port *port)
+
+ static int meson_uart_startup(struct uart_port *port)
+ {
++ unsigned long flags;
+ u32 val;
+ int ret = 0;
+
++ spin_lock_irqsave(&port->lock, flags);
++
+ val = readl(port->membase + AML_UART_CONTROL);
+ val |= AML_UART_CLEAR_ERR;
+ writel(val, port->membase + AML_UART_CONTROL);
+@@ -287,6 +298,8 @@ static int meson_uart_startup(struct uart_port *port)
+ val = (AML_UART_RECV_IRQ(1) | AML_UART_XMIT_IRQ(port->fifosize / 2));
+ writel(val, port->membase + AML_UART_MISC);
+
++ spin_unlock_irqrestore(&port->lock, flags);
++
+ ret = request_irq(port->irq, meson_uart_interrupt, 0,
+ port->name, port);
+
+diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
+index a40827956bd15..d248c43db36a6 100644
+--- a/drivers/tty/serial/msm_serial.c
++++ b/drivers/tty/serial/msm_serial.c
+@@ -1579,6 +1579,7 @@ static inline struct uart_port *msm_get_port_from_line(unsigned int line)
+ static void __msm_console_write(struct uart_port *port, const char *s,
+ unsigned int count, bool is_uartdm)
+ {
++ unsigned long flags;
+ int i;
+ int num_newlines = 0;
+ bool replaced = false;
+@@ -1596,6 +1597,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
+ num_newlines++;
+ count += num_newlines;
+
++ local_irq_save(flags);
++
+ if (port->sysrq)
+ locked = 0;
+ else if (oops_in_progress)
+@@ -1641,6 +1644,8 @@ static void __msm_console_write(struct uart_port *port, const char *s,
+
+ if (locked)
+ spin_unlock(&port->lock);
++
++ local_irq_restore(flags);
+ }
+
+ static void msm_console_write(struct console *co, const char *s,
+diff --git a/drivers/tty/serial/sa1100.c b/drivers/tty/serial/sa1100.c
+index a399772be3fc5..8a65fb1ce5683 100644
+--- a/drivers/tty/serial/sa1100.c
++++ b/drivers/tty/serial/sa1100.c
+@@ -439,6 +439,8 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
+ baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
+ quot = uart_get_divisor(port, baud);
+
++ del_timer_sync(&sport->timer);
++
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+ sport->port.read_status_mask &= UTSR0_TO_SM(UTSR0_TFS);
+@@ -469,8 +471,6 @@ sa1100_set_termios(struct uart_port *port, struct ktermios *termios,
+ UTSR1_TO_SM(UTSR1_ROR);
+ }
+
+- del_timer_sync(&sport->timer);
+-
+ /*
+ * Update the per-port timeout.
+ */
+diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c
+index 2f7ef64536a04..8724db39e9475 100644
+--- a/drivers/tty/serial/serial_txx9.c
++++ b/drivers/tty/serial/serial_txx9.c
+@@ -649,6 +649,8 @@ serial_txx9_set_termios(struct uart_port *port, struct ktermios *termios,
+ case CS6: /* not supported */
+ case CS8:
+ cval |= TXX9_SILCR_UMODE_8BIT;
++ termios->c_cflag &= ~CSIZE;
++ termios->c_cflag |= CS8;
+ break;
+ }
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 6f44c5f0ef3aa..ba7f0b44b7107 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -2382,8 +2382,12 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
+ int best_clk = -1;
+ unsigned long flags;
+
+- if ((termios->c_cflag & CSIZE) == CS7)
++ if ((termios->c_cflag & CSIZE) == CS7) {
+ smr_val |= SCSMR_CHR;
++ } else {
++ termios->c_cflag &= ~CSIZE;
++ termios->c_cflag |= CS8;
++ }
+ if (termios->c_cflag & PARENB)
+ smr_val |= SCSMR_PE;
+ if (termios->c_cflag & PARODD)
+diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c
+index 7971997cdead7..ce35e3a131b16 100644
+--- a/drivers/tty/serial/st-asc.c
++++ b/drivers/tty/serial/st-asc.c
+@@ -540,10 +540,14 @@ static void asc_set_termios(struct uart_port *port, struct ktermios *termios,
+ /* set character length */
+ if ((cflag & CSIZE) == CS7) {
+ ctrl_val |= ASC_CTL_MODE_7BIT_PAR;
++ cflag |= PARENB;
+ } else {
+ ctrl_val |= (cflag & PARENB) ? ASC_CTL_MODE_8BIT_PAR :
+ ASC_CTL_MODE_8BIT;
++ cflag &= ~CSIZE;
++ cflag |= CS8;
+ }
++ termios->c_cflag = cflag;
+
+ /* set stop bit */
+ ctrl_val |= (cflag & CSTOPB) ? ASC_CTL_STOP_2BIT : ASC_CTL_STOP_1BIT;
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index ccaaf804df06d..bb2f6f02ce23b 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -688,13 +688,22 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ * CS8 or (CS7 + parity), 8 bits word aka [M1:M0] = 0b00
+ * M0 and M1 already cleared by cr1 initialization.
+ */
+- if (bits == 9)
++ if (bits == 9) {
+ cr1 |= USART_CR1_M0;
+- else if ((bits == 7) && cfg->has_7bits_data)
++ } else if ((bits == 7) && cfg->has_7bits_data) {
+ cr1 |= USART_CR1_M1;
+- else if (bits != 8)
++ } else if (bits != 8) {
+ dev_dbg(port->dev, "Unsupported data bits config: %u bits\n"
+ , bits);
++ cflag &= ~CSIZE;
++ cflag |= CS8;
++ termios->c_cflag = cflag;
++ bits = 8;
++ if (cflag & PARENB) {
++ bits++;
++ cr1 |= USART_CR1_M0;
++ }
++ }
+
+ if (cflag & PARODD)
+ cr1 |= USART_CR1_PS;
+diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
+index afe34beec7203..11c62fcd67f22 100644
+--- a/drivers/tty/synclink_gt.c
++++ b/drivers/tty/synclink_gt.c
+@@ -1753,6 +1753,8 @@ static int hdlcdev_init(struct slgt_info *info)
+ */
+ static void hdlcdev_exit(struct slgt_info *info)
+ {
++ if (!info->netdev)
++ return;
+ unregister_hdlc_device(info->netdev);
+ free_netdev(info->netdev);
+ info->netdev = NULL;
+diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
+index 6b0cb633679d9..dfe0c8c22cd37 100644
+--- a/drivers/tty/tty_buffer.c
++++ b/drivers/tty/tty_buffer.c
+@@ -167,7 +167,8 @@ static struct tty_buffer *tty_buffer_alloc(struct tty_port *port, size_t size)
+ have queued and recycle that ? */
+ if (atomic_read(&port->buf.mem_used) > port->buf.mem_limit)
+ return NULL;
+- p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
++ p = kmalloc(sizeof(struct tty_buffer) + 2 * size,
++ GFP_ATOMIC | __GFP_NOWARN);
+ if (p == NULL)
+ return NULL;
+
+diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
+index 7537681355f67..fed331d786e22 100644
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -605,10 +605,10 @@ const struct dev_pm_ops usb_hcd_pci_pm_ops = {
+ .suspend_noirq = hcd_pci_suspend_noirq,
+ .resume_noirq = hcd_pci_resume_noirq,
+ .resume = hcd_pci_resume,
+- .freeze = check_root_hub_suspended,
++ .freeze = hcd_pci_suspend,
+ .freeze_noirq = check_root_hub_suspended,
+ .thaw_noirq = NULL,
+- .thaw = NULL,
++ .thaw = hcd_pci_resume,
+ .poweroff = hcd_pci_suspend,
+ .poweroff_noirq = hcd_pci_suspend_noirq,
+ .restore_noirq = hcd_pci_resume_noirq,
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index d5f233fa6f3b4..f8f2de7899a94 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -511,6 +511,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* DJI CineSSD */
+ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* DELL USB GEN2 */
++ { USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME },
++
+ /* VCOM device */
+ { USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 1e46005929e44..85d25f7e9c27a 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -4326,7 +4326,6 @@ static int dwc2_hsotg_udc_start(struct usb_gadget *gadget,
+
+ WARN_ON(hsotg->driver);
+
+- driver->driver.bus = NULL;
+ hsotg->driver = driver;
+ hsotg->gadget.dev.of_node = hsotg->dev->of_node;
+ hsotg->gadget.speed = USB_SPEED_UNKNOWN;
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index ad2cb08b440fb..527938eee8461 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -205,7 +205,7 @@ static void dwc3_pci_resume_work(struct work_struct *work)
+ int ret;
+
+ ret = pm_runtime_get_sync(&dwc3->dev);
+- if (ret) {
++ if (ret < 0) {
+ pm_runtime_put_sync_autosuspend(&dwc3->dev);
+ return;
+ }
+diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
+index 74da136d322ac..361327012c781 100644
+--- a/drivers/usb/host/isp116x-hcd.c
++++ b/drivers/usb/host/isp116x-hcd.c
+@@ -1541,10 +1541,12 @@ static int isp116x_remove(struct platform_device *pdev)
+
+ iounmap(isp116x->data_reg);
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+- release_mem_region(res->start, 2);
++ if (res)
++ release_mem_region(res->start, 2);
+ iounmap(isp116x->addr_reg);
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- release_mem_region(res->start, 2);
++ if (res)
++ release_mem_region(res->start, 2);
+
+ usb_put_hcd(hcd);
+ return 0;
+diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
+index 10d97261b433f..48533eb707e67 100644
+--- a/drivers/usb/host/oxu210hp-hcd.c
++++ b/drivers/usb/host/oxu210hp-hcd.c
+@@ -3476,8 +3476,10 @@ static int oxu_bus_suspend(struct usb_hcd *hcd)
+ }
+ }
+
++ spin_unlock_irq(&oxu->lock);
+ /* turn off now-idle HC */
+ del_timer_sync(&oxu->watchdog);
++ spin_lock_irq(&oxu->lock);
+ ehci_halt(oxu);
+ hcd->state = HC_STATE_SUSPENDED;
+
+diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
+index 24e622c056383..5f1c41e95f569 100644
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -433,6 +433,7 @@ static int omap2430_probe(struct platform_device *pdev)
+ control_node = of_parse_phandle(np, "ctrl-module", 0);
+ if (control_node) {
+ control_pdev = of_find_device_by_node(control_node);
++ of_node_put(control_node);
+ if (!control_pdev) {
+ dev_err(&pdev->dev, "Failed to get control device\n");
+ ret = -EINVAL;
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 0699b770e058c..427a38ab198ba 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1137,6 +1137,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0xff, 0x30) }, /* EM160R-GL */
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0, 0) },
++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0700, 0xff), /* BG95 */
++ .driver_info = RSVD(3) | ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
+diff --git a/drivers/usb/storage/karma.c b/drivers/usb/storage/karma.c
+index edcf2be0e0eb5..09c8add5108a7 100644
+--- a/drivers/usb/storage/karma.c
++++ b/drivers/usb/storage/karma.c
+@@ -172,23 +172,24 @@ static void rio_karma_destructor(void *extra)
+
+ static int rio_karma_init(struct us_data *us)
+ {
+- int ret = 0;
+ struct karma_data *data = kzalloc(sizeof(struct karma_data), GFP_NOIO);
+ if (!data)
+- goto out;
++ return -ENOMEM;
+
+ data->recv = kmalloc(RIO_RECV_LEN, GFP_NOIO);
+ if (!data->recv) {
+ kfree(data);
+- goto out;
++ return -ENOMEM;
+ }
+
+ us->extra = data;
+ us->extra_destructor = rio_karma_destructor;
+- ret = rio_karma_send_command(RIO_ENTER_STORAGE, us);
+- data->in_storage = (ret == 0);
+-out:
+- return ret;
++ if (rio_karma_send_command(RIO_ENTER_STORAGE, us))
++ return -EIO;
++
++ data->in_storage = 1;
++
++ return 0;
+ }
+
+ static struct scsi_host_template karma_host_template;
+diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
+index 0081c1073b083..c64964c32cc97 100644
+--- a/drivers/usb/usbip/stub_dev.c
++++ b/drivers/usb/usbip/stub_dev.c
+@@ -427,7 +427,6 @@ err_files:
+ (struct usb_dev_state *) udev);
+ err_port:
+ dev_set_drvdata(&udev->dev, NULL);
+- usb_put_dev(udev);
+
+ /* we already have busid_priv, just lock busid_lock */
+ spin_lock(&busid_priv->busid_lock);
+@@ -442,6 +441,7 @@ call_put_busid_priv:
+ put_busid_priv(busid_priv);
+
+ sdev_free:
++ usb_put_dev(udev);
+ stub_device_free(sdev);
+
+ return rc;
+diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
+index 8c55cd8330988..b88eeaee637a2 100644
+--- a/drivers/usb/usbip/stub_rx.c
++++ b/drivers/usb/usbip/stub_rx.c
+@@ -138,7 +138,9 @@ static int tweak_set_configuration_cmd(struct urb *urb)
+ req = (struct usb_ctrlrequest *) urb->setup_packet;
+ config = le16_to_cpu(req->wValue);
+
++ usb_lock_device(sdev->udev);
+ err = usb_set_configuration(sdev->udev, config);
++ usb_unlock_device(sdev->udev);
+ if (err && err != -ENODEV)
+ dev_err(&sdev->udev->dev, "can't set config #%d, error %d\n",
+ config, err);
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 97aa9b87e5722..6b2efff1c2970 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -263,7 +263,7 @@ __vringh_iov(struct vringh *vrh, u16 i,
+ gfp_t gfp,
+ int (*copy)(void *dst, const void *src, size_t len))
+ {
+- int err, count = 0, up_next, desc_max;
++ int err, count = 0, indirect_count = 0, up_next, desc_max;
+ struct vring_desc desc, *descs;
+ struct vringh_range range = { -1ULL, 0 }, slowrange;
+ bool slow = false;
+@@ -320,7 +320,12 @@ __vringh_iov(struct vringh *vrh, u16 i,
+ continue;
+ }
+
+- if (count++ == vrh->vring.num) {
++ if (up_next == -1)
++ count++;
++ else
++ indirect_count++;
++
++ if (count > vrh->vring.num || indirect_count > desc_max) {
+ vringh_bad("Descriptor loop in %p", descs);
+ err = -ELOOP;
+ goto fail;
+@@ -382,6 +387,7 @@ __vringh_iov(struct vringh *vrh, u16 i,
+ i = return_from_indirect(vrh, &up_next,
+ &descs, &desc_max);
+ slow = false;
++ indirect_count = 0;
+ } else
+ break;
+ }
+diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c
+index 38c1f324ce15d..549f78e77255c 100644
+--- a/drivers/video/fbdev/amba-clcd.c
++++ b/drivers/video/fbdev/amba-clcd.c
+@@ -838,12 +838,15 @@ static int clcdfb_of_vram_setup(struct clcd_fb *fb)
+ return -ENODEV;
+
+ fb->fb.screen_base = of_iomap(memory, 0);
+- if (!fb->fb.screen_base)
++ if (!fb->fb.screen_base) {
++ of_node_put(memory);
+ return -ENOMEM;
++ }
+
+ fb->fb.fix.smem_start = of_translate_address(memory,
+ of_get_address(memory, 0, &size, NULL));
+ fb->fb.fix.smem_len = size;
++ of_node_put(memory);
+
+ return 0;
+ }
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index bf7959fdf9f44..7c2582892eabe 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -3314,6 +3314,9 @@ static void fbcon_register_existing_fbs(struct work_struct *work)
+
+ console_lock();
+
++ deferred_takeover = false;
++ logo_shown = FBCON_LOGO_DONTSHOW;
++
+ for_each_registered_fb(i)
+ fbcon_fb_registered(registered_fb[i]);
+
+@@ -3331,8 +3334,6 @@ static int fbcon_output_notifier(struct notifier_block *nb,
+ pr_info("fbcon: Taking over console\n");
+
+ dummycon_unregister_output_notifier(&fbcon_output_nb);
+- deferred_takeover = false;
+- logo_shown = FBCON_LOGO_DONTSHOW;
+
+ /* We may get called in atomic context */
+ schedule_work(&fbcon_deferred_takeover_work);
+diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c
+index 69cfb337c8577..43695a33f062f 100644
+--- a/drivers/video/fbdev/pxa3xx-gcu.c
++++ b/drivers/video/fbdev/pxa3xx-gcu.c
+@@ -663,6 +663,7 @@ static int pxa3xx_gcu_probe(struct platform_device *pdev)
+ for (i = 0; i < 8; i++) {
+ ret = pxa3xx_gcu_add_buffer(dev, priv);
+ if (ret) {
++ pxa3xx_gcu_free_buffers(dev, priv);
+ dev_err(dev, "failed to allocate DMA memory\n");
+ goto err_disable_clk;
+ }
+@@ -678,15 +679,15 @@ static int pxa3xx_gcu_probe(struct platform_device *pdev)
+ SHARED_SIZE, irq);
+ return 0;
+
+-err_free_dma:
+- dma_free_coherent(dev, SHARED_SIZE,
+- priv->shared, priv->shared_phys);
++err_disable_clk:
++ clk_disable_unprepare(priv->clk);
+
+ err_misc_deregister:
+ misc_deregister(&priv->misc_dev);
+
+-err_disable_clk:
+- clk_disable_unprepare(priv->clk);
++err_free_dma:
++ dma_free_coherent(dev, SHARED_SIZE,
++ priv->shared, priv->shared_phys);
+
+ return ret;
+ }
+@@ -699,6 +700,7 @@ static int pxa3xx_gcu_remove(struct platform_device *pdev)
+ pxa3xx_gcu_wait_idle(priv);
+ misc_deregister(&priv->misc_dev);
+ dma_free_coherent(dev, SHARED_SIZE, priv->shared, priv->shared_phys);
++ clk_disable_unprepare(priv->clk);
+ pxa3xx_gcu_free_buffers(dev, priv);
+
+ return 0;
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 54e7f6f1405e2..59eb924840518 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -383,8 +383,11 @@ static int afs_dir_iterate_block(struct dir_context *ctx,
+ }
+
+ /* skip if starts before the current position */
+- if (offset < curr)
++ if (offset < curr) {
++ if (next > curr)
++ ctx->pos = blkoff + next * sizeof(union afs_xdr_dirent);
+ continue;
++ }
+
+ /* found the next entry */
+ if (!dir_emit(ctx, dire->u.name, nlen,
+diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
+index e4b59e76afb0d..a6f97d86fb801 100644
+--- a/fs/binfmt_flat.c
++++ b/fs/binfmt_flat.c
+@@ -408,6 +408,30 @@ static void old_reloc(unsigned long rl)
+
+ /****************************************************************************/
+
++static inline u32 __user *skip_got_header(u32 __user *rp)
++{
++ if (IS_ENABLED(CONFIG_RISCV)) {
++ /*
++ * RISC-V has a 16 byte GOT PLT header for elf64-riscv
++ * and 8 byte GOT PLT header for elf32-riscv.
++ * Skip the whole GOT PLT header, since it is reserved
++ * for the dynamic linker (ld.so).
++ */
++ u32 rp_val0, rp_val1;
++
++ if (get_user(rp_val0, rp))
++ return rp;
++ if (get_user(rp_val1, rp + 1))
++ return rp;
++
++ if (rp_val0 == 0xffffffff && rp_val1 == 0xffffffff)
++ rp += 4;
++ else if (rp_val0 == 0xffffffff)
++ rp += 2;
++ }
++ return rp;
++}
++
+ static int load_flat_file(struct linux_binprm *bprm,
+ struct lib_info *libinfo, int id, unsigned long *extra_stack)
+ {
+@@ -745,7 +769,8 @@ static int load_flat_file(struct linux_binprm *bprm,
+ * image.
+ */
+ if (flags & FLAT_FLAG_GOTPIC) {
+- for (rp = (u32 __user *)datapos; ; rp++) {
++ rp = skip_got_header((u32 __user *) datapos);
++ for (; ; rp++) {
+ u32 addr, rp_val;
+ if (get_user(rp_val, rp))
+ return -EFAULT;
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 2ac920bdf4df5..c9fd018dcf764 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -2855,7 +2855,7 @@ int open_ctree(struct super_block *sb,
+ ~BTRFS_FEATURE_INCOMPAT_SUPP;
+ if (features) {
+ btrfs_err(fs_info,
+- "cannot mount because of unsupported optional features (%llx)",
++ "cannot mount because of unsupported optional features (0x%llx)",
+ features);
+ err = -EINVAL;
+ goto fail_alloc;
+@@ -2915,7 +2915,7 @@ int open_ctree(struct super_block *sb,
+ ~BTRFS_FEATURE_COMPAT_RO_SUPP;
+ if (!sb_rdonly(sb) && features) {
+ btrfs_err(fs_info,
+- "cannot mount read-write because of unsupported optional features (%llx)",
++ "cannot mount read-write because of unsupported optional features (0x%llx)",
+ features);
+ err = -EINVAL;
+ goto fail_alloc;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 8f05e6a472c32..2b4d33b58a68a 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -6925,12 +6925,12 @@ int btrfs_read_chunk_tree(struct btrfs_fs_info *fs_info)
+ * do another round of validation checks.
+ */
+ if (total_dev != fs_info->fs_devices->total_devices) {
+- btrfs_err(fs_info,
+- "super_num_devices %llu mismatch with num_devices %llu found here",
++ btrfs_warn(fs_info,
++"super block num_devices %llu mismatch with DEV_ITEM count %llu, will be repaired on next transaction commit",
+ btrfs_super_num_devices(fs_info->super_copy),
+ total_dev);
+- ret = -EINVAL;
+- goto error;
++ fs_info->fs_devices->total_devices = total_dev;
++ btrfs_set_super_num_devices(fs_info->super_copy, total_dev);
+ }
+ if (btrfs_super_total_bytes(fs_info->super_copy) <
+ fs_info->fs_devices->total_rw_bytes) {
+diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
+index a09ce27ab2204..6fa9a784676b4 100644
+--- a/fs/ceph/xattr.c
++++ b/fs/ceph/xattr.c
+@@ -273,6 +273,14 @@ static size_t ceph_vxattrcb_quota_max_files(struct ceph_inode_info *ci,
+ }
+ #define XATTR_RSTAT_FIELD(_type, _name) \
+ XATTR_NAME_CEPH(_type, _name, VXATTR_FLAG_RSTAT)
++#define XATTR_RSTAT_FIELD_UPDATABLE(_type, _name) \
++ { \
++ .name = CEPH_XATTR_NAME(_type, _name), \
++ .name_size = sizeof (CEPH_XATTR_NAME(_type, _name)), \
++ .getxattr_cb = ceph_vxattrcb_ ## _type ## _ ## _name, \
++ .exists_cb = NULL, \
++ .flags = VXATTR_FLAG_RSTAT, \
++ }
+ #define XATTR_LAYOUT_FIELD(_type, _name, _field) \
+ { \
+ .name = CEPH_XATTR_NAME2(_type, _name, _field), \
+@@ -310,7 +318,7 @@ static struct ceph_vxattr ceph_dir_vxattrs[] = {
+ XATTR_RSTAT_FIELD(dir, rfiles),
+ XATTR_RSTAT_FIELD(dir, rsubdirs),
+ XATTR_RSTAT_FIELD(dir, rbytes),
+- XATTR_RSTAT_FIELD(dir, rctime),
++ XATTR_RSTAT_FIELD_UPDATABLE(dir, rctime),
+ {
+ .name = "ceph.quota",
+ .name_size = sizeof("ceph.quota"),
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 43478ec6fd67a..3485b9bf970f5 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -265,6 +265,9 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon)
+ rc = -EHOSTDOWN;
+ mutex_unlock(&tcon->ses->session_mutex);
+ goto failed;
++ } else if (rc) {
++ mutex_unlock(&ses->session_mutex);
++ goto out;
+ }
+ }
+ if (rc || !tcon->need_reconnect) {
+diff --git a/fs/dax.c b/fs/dax.c
+index d09701aa6f2f4..7451efc5020ce 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -907,7 +907,8 @@ static void dax_mapping_entry_mkclean(struct address_space *mapping,
+ if (!pmd_dirty(*pmdp) && !pmd_write(*pmdp))
+ goto unlock_pmd;
+
+- flush_cache_page(vma, address, pfn);
++ flush_cache_range(vma, address,
++ address + HPAGE_PMD_SIZE);
+ pmd = pmdp_invalidate(vma, address, pmdp);
+ pmd = pmd_wrprotect(pmd);
+ pmd = pmd_mkclean(pmd);
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index 26a4847efccca..ac53403e9edb5 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -1553,6 +1553,7 @@ static int _remove_from_waiters(struct dlm_lkb *lkb, int mstype,
+ lkb->lkb_wait_type = 0;
+ lkb->lkb_flags &= ~DLM_IFL_OVERLAP_CANCEL;
+ lkb->lkb_wait_count--;
++ unhold_lkb(lkb);
+ goto out_del;
+ }
+
+@@ -1579,6 +1580,7 @@ static int _remove_from_waiters(struct dlm_lkb *lkb, int mstype,
+ log_error(ls, "remwait error %x reply %d wait_type %d overlap",
+ lkb->lkb_id, mstype, lkb->lkb_wait_type);
+ lkb->lkb_wait_count--;
++ unhold_lkb(lkb);
+ lkb->lkb_wait_type = 0;
+ }
+
+@@ -5314,11 +5316,16 @@ int dlm_recover_waiters_post(struct dlm_ls *ls)
+ lkb->lkb_flags &= ~DLM_IFL_OVERLAP_UNLOCK;
+ lkb->lkb_flags &= ~DLM_IFL_OVERLAP_CANCEL;
+ lkb->lkb_wait_type = 0;
+- lkb->lkb_wait_count = 0;
++ /* drop all wait_count references we still
++ * hold a reference for this iteration.
++ */
++ while (lkb->lkb_wait_count) {
++ lkb->lkb_wait_count--;
++ unhold_lkb(lkb);
++ }
+ mutex_lock(&ls->ls_waiters_mutex);
+ list_del_init(&lkb->lkb_wait_reply);
+ mutex_unlock(&ls->ls_waiters_mutex);
+- unhold_lkb(lkb); /* for waiters list */
+
+ if (oc || ou) {
+ /* do an unlock or cancel instead of resending */
+diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c
+index c7d5a2ea3d030..e0c05e08d8bfe 100644
+--- a/fs/dlm/plock.c
++++ b/fs/dlm/plock.c
+@@ -26,11 +26,11 @@ struct plock_op {
+ struct list_head list;
+ int done;
+ struct dlm_plock_info info;
++ int (*callback)(struct file_lock *fl, int result);
+ };
+
+ struct plock_xop {
+ struct plock_op xop;
+- int (*callback)(struct file_lock *fl, int result);
+ void *fl;
+ void *file;
+ struct file_lock flc;
+@@ -132,19 +132,18 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file,
+ /* fl_owner is lockd which doesn't distinguish
+ processes on the nfs client */
+ op->info.owner = (__u64) fl->fl_pid;
+- xop->callback = fl->fl_lmops->lm_grant;
++ op->callback = fl->fl_lmops->lm_grant;
+ locks_init_lock(&xop->flc);
+ locks_copy_lock(&xop->flc, fl);
+ xop->fl = fl;
+ xop->file = file;
+ } else {
+ op->info.owner = (__u64)(long) fl->fl_owner;
+- xop->callback = NULL;
+ }
+
+ send_op(op);
+
+- if (xop->callback == NULL) {
++ if (!op->callback) {
+ rv = wait_event_interruptible(recv_wq, (op->done != 0));
+ if (rv == -ERESTARTSYS) {
+ log_debug(ls, "dlm_posix_lock: wait killed %llx",
+@@ -206,7 +205,7 @@ static int dlm_plock_callback(struct plock_op *op)
+ file = xop->file;
+ flc = &xop->flc;
+ fl = xop->fl;
+- notify = xop->callback;
++ notify = op->callback;
+
+ if (op->info.rv) {
+ notify(fl, op->info.rv);
+@@ -439,10 +438,9 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,
+ if (op->info.fsid == info.fsid &&
+ op->info.number == info.number &&
+ op->info.owner == info.owner) {
+- struct plock_xop *xop = (struct plock_xop *)op;
+ list_del_init(&op->list);
+ memcpy(&op->info, &info, sizeof(info));
+- if (xop->callback)
++ if (op->callback)
+ do_callback = 1;
+ else
+ op->done = 1;
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index e90b60470344d..a2943382bf18b 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -2021,6 +2021,18 @@ int ext4_convert_inline_data(struct inode *inode)
+ if (!ext4_has_inline_data(inode)) {
+ ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
+ return 0;
++ } else if (!ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) {
++ /*
++ * Inode has inline data but EXT4_STATE_MAY_INLINE_DATA is
++ * cleared. This means we are in the middle of moving of
++ * inline data to delay allocated block. Just force writeout
++ * here to finish conversion.
++ */
++ error = filemap_flush(inode->i_mapping);
++ if (error)
++ return error;
++ if (!ext4_has_inline_data(inode))
++ return 0;
+ }
+
+ needed_blocks = ext4_writepage_trans_blocks(inode);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 797fe41d071f0..621271c2989b4 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -272,9 +272,9 @@ static struct dx_frame *dx_probe(struct ext4_filename *fname,
+ struct dx_hash_info *hinfo,
+ struct dx_frame *frame);
+ static void dx_release(struct dx_frame *frames);
+-static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de,
+- unsigned blocksize, struct dx_hash_info *hinfo,
+- struct dx_map_entry map[]);
++static int dx_make_map(struct inode *dir, struct buffer_head *bh,
++ struct dx_hash_info *hinfo,
++ struct dx_map_entry *map_tail);
+ static void dx_sort_map(struct dx_map_entry *map, unsigned count);
+ static struct ext4_dir_entry_2 *dx_move_dirents(char *from, char *to,
+ struct dx_map_entry *offsets, int count, unsigned blocksize);
+@@ -748,12 +748,14 @@ static struct dx_frame *
+ dx_probe(struct ext4_filename *fname, struct inode *dir,
+ struct dx_hash_info *hinfo, struct dx_frame *frame_in)
+ {
+- unsigned count, indirect;
++ unsigned count, indirect, level, i;
+ struct dx_entry *at, *entries, *p, *q, *m;
+ struct dx_root *root;
+ struct dx_frame *frame = frame_in;
+ struct dx_frame *ret_err = ERR_PTR(ERR_BAD_DX_DIR);
+ u32 hash;
++ ext4_lblk_t block;
++ ext4_lblk_t blocks[EXT4_HTREE_LEVEL];
+
+ memset(frame_in, 0, EXT4_HTREE_LEVEL * sizeof(frame_in[0]));
+ frame->bh = ext4_read_dirblock(dir, 0, INDEX);
+@@ -809,6 +811,8 @@ dx_probe(struct ext4_filename *fname, struct inode *dir,
+ }
+
+ dxtrace(printk("Look up %x", hash));
++ level = 0;
++ blocks[0] = 0;
+ while (1) {
+ count = dx_get_count(entries);
+ if (!count || count > dx_get_limit(entries)) {
+@@ -850,15 +854,27 @@ dx_probe(struct ext4_filename *fname, struct inode *dir,
+ dx_get_block(at)));
+ frame->entries = entries;
+ frame->at = at;
+- if (!indirect--)
++
++ block = dx_get_block(at);
++ for (i = 0; i <= level; i++) {
++ if (blocks[i] == block) {
++ ext4_warning_inode(dir,
++ "dx entry: tree cycle block %u points back to block %u",
++ blocks[level], block);
++ goto fail;
++ }
++ }
++ if (++level > indirect)
+ return frame;
++ blocks[level] = block;
+ frame++;
+- frame->bh = ext4_read_dirblock(dir, dx_get_block(at), INDEX);
++ frame->bh = ext4_read_dirblock(dir, block, INDEX);
+ if (IS_ERR(frame->bh)) {
+ ret_err = (struct dx_frame *) frame->bh;
+ frame->bh = NULL;
+ goto fail;
+ }
++
+ entries = ((struct dx_node *) frame->bh->b_data)->entries;
+
+ if (dx_get_limit(entries) != dx_node_limit(dir)) {
+@@ -1203,15 +1219,23 @@ static inline int search_dirblock(struct buffer_head *bh,
+ * Create map of hash values, offsets, and sizes, stored at end of block.
+ * Returns number of entries mapped.
+ */
+-static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de,
+- unsigned blocksize, struct dx_hash_info *hinfo,
++static int dx_make_map(struct inode *dir, struct buffer_head *bh,
++ struct dx_hash_info *hinfo,
+ struct dx_map_entry *map_tail)
+ {
+ int count = 0;
+- char *base = (char *) de;
++ struct ext4_dir_entry_2 *de = (struct ext4_dir_entry_2 *)bh->b_data;
++ unsigned int buflen = bh->b_size;
++ char *base = bh->b_data;
+ struct dx_hash_info h = *hinfo;
+
+- while ((char *) de < base + blocksize) {
++ if (ext4_has_metadata_csum(dir->i_sb))
++ buflen -= sizeof(struct ext4_dir_entry_tail);
++
++ while ((char *) de < base + buflen) {
++ if (ext4_check_dir_entry(dir, NULL, de, bh, base, buflen,
++ ((char *)de) - base))
++ return -EFSCORRUPTED;
+ if (de->name_len && de->inode) {
+ ext4fs_dirhash(de->name, de->name_len, &h);
+ map_tail--;
+@@ -1221,8 +1245,7 @@ static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de,
+ count++;
+ cond_resched();
+ }
+- /* XXX: do we need to check rec_len == 0 case? -Chris */
+- de = ext4_next_entry(de, blocksize);
++ de = ext4_next_entry(de, dir->i_sb->s_blocksize);
+ }
+ return count;
+ }
+@@ -1756,8 +1779,11 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
+
+ /* create map in the end of data2 block */
+ map = (struct dx_map_entry *) (data2 + blocksize);
+- count = dx_make_map(dir, (struct ext4_dir_entry_2 *) data1,
+- blocksize, hinfo, map);
++ count = dx_make_map(dir, *bh, hinfo, map);
++ if (count < 0) {
++ err = count;
++ goto journal_error;
++ }
+ map -= count;
+ dx_sort_map(map, count);
+ /* Ensure that neither split block is over half full */
+@@ -3333,6 +3359,9 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle,
+ struct buffer_head *bh;
+
+ if (!ext4_has_inline_data(inode)) {
++ struct ext4_dir_entry_2 *de;
++ unsigned int offset;
++
+ /* The first directory block must not be a hole, so
+ * treat it as DIRENT_HTREE
+ */
+@@ -3341,9 +3370,30 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle,
+ *retval = PTR_ERR(bh);
+ return NULL;
+ }
+- *parent_de = ext4_next_entry(
+- (struct ext4_dir_entry_2 *)bh->b_data,
+- inode->i_sb->s_blocksize);
++
++ de = (struct ext4_dir_entry_2 *) bh->b_data;
++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data,
++ bh->b_size, 0) ||
++ le32_to_cpu(de->inode) != inode->i_ino ||
++ strcmp(".", de->name)) {
++ EXT4_ERROR_INODE(inode, "directory missing '.'");
++ brelse(bh);
++ *retval = -EFSCORRUPTED;
++ return NULL;
++ }
++ offset = ext4_rec_len_from_disk(de->rec_len,
++ inode->i_sb->s_blocksize);
++ de = ext4_next_entry(de, inode->i_sb->s_blocksize);
++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data,
++ bh->b_size, offset) ||
++ le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) {
++ EXT4_ERROR_INODE(inode, "directory missing '..'");
++ brelse(bh);
++ *retval = -EFSCORRUPTED;
++ return NULL;
++ }
++ *parent_de = de;
++
+ return bh;
+ }
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 6893b87c73547..bf120842a3074 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1688,6 +1688,7 @@ static const struct mount_opts {
+ MOPT_EXT4_ONLY | MOPT_CLEAR},
+ {Opt_warn_on_error, EXT4_MOUNT_WARN_ON_ERROR, MOPT_SET},
+ {Opt_nowarn_on_error, EXT4_MOUNT_WARN_ON_ERROR, MOPT_CLEAR},
++ {Opt_commit, 0, MOPT_NO_EXT2},
+ {Opt_nojournal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM,
+ MOPT_EXT4_ONLY | MOPT_CLEAR},
+ {Opt_journal_checksum, EXT4_MOUNT_JOURNAL_CHECKSUM,
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 0e3e590a250f7..6fbf0471323e7 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -354,16 +354,19 @@ void f2fs_drop_inmem_page(struct inode *inode, struct page *page)
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct list_head *head = &fi->inmem_pages;
+ struct inmem_pages *cur = NULL;
++ struct inmem_pages *tmp;
+
+ f2fs_bug_on(sbi, !IS_ATOMIC_WRITTEN_PAGE(page));
+
+ mutex_lock(&fi->inmem_lock);
+- list_for_each_entry(cur, head, list) {
+- if (cur->page == page)
++ list_for_each_entry(tmp, head, list) {
++ if (tmp->page == page) {
++ cur = tmp;
+ break;
++ }
+ }
+
+- f2fs_bug_on(sbi, list_empty(head) || cur->page != page);
++ f2fs_bug_on(sbi, !cur);
+ list_del(&cur->list);
+ mutex_unlock(&fi->inmem_lock);
+
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index 1f5db4cbc499e..d5f9c928946f6 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -534,11 +534,10 @@ static inline int reserved_sections(struct f2fs_sb_info *sbi)
+ return GET_SEC_FROM_SEG(sbi, (unsigned int)reserved_segments(sbi));
+ }
+
+-static inline bool has_curseg_enough_space(struct f2fs_sb_info *sbi)
++static inline bool has_curseg_enough_space(struct f2fs_sb_info *sbi,
++ unsigned int node_blocks, unsigned int dent_blocks)
+ {
+- unsigned int node_blocks = get_pages(sbi, F2FS_DIRTY_NODES) +
+- get_pages(sbi, F2FS_DIRTY_DENTS);
+- unsigned int dent_blocks = get_pages(sbi, F2FS_DIRTY_DENTS);
++
+ unsigned int segno, left_blocks;
+ int i;
+
+@@ -564,19 +563,28 @@ static inline bool has_curseg_enough_space(struct f2fs_sb_info *sbi)
+ static inline bool has_not_enough_free_secs(struct f2fs_sb_info *sbi,
+ int freed, int needed)
+ {
+- int node_secs = get_blocktype_secs(sbi, F2FS_DIRTY_NODES);
+- int dent_secs = get_blocktype_secs(sbi, F2FS_DIRTY_DENTS);
+- int imeta_secs = get_blocktype_secs(sbi, F2FS_DIRTY_IMETA);
++ unsigned int total_node_blocks = get_pages(sbi, F2FS_DIRTY_NODES) +
++ get_pages(sbi, F2FS_DIRTY_DENTS) +
++ get_pages(sbi, F2FS_DIRTY_IMETA);
++ unsigned int total_dent_blocks = get_pages(sbi, F2FS_DIRTY_DENTS);
++ unsigned int node_secs = total_node_blocks / BLKS_PER_SEC(sbi);
++ unsigned int dent_secs = total_dent_blocks / BLKS_PER_SEC(sbi);
++ unsigned int node_blocks = total_node_blocks % BLKS_PER_SEC(sbi);
++ unsigned int dent_blocks = total_dent_blocks % BLKS_PER_SEC(sbi);
++ unsigned int free, need_lower, need_upper;
+
+ if (unlikely(is_sbi_flag_set(sbi, SBI_POR_DOING)))
+ return false;
+
+- if (free_sections(sbi) + freed == reserved_sections(sbi) + needed &&
+- has_curseg_enough_space(sbi))
++ free = free_sections(sbi) + freed;
++ need_lower = node_secs + dent_secs + reserved_sections(sbi) + needed;
++ need_upper = need_lower + (node_blocks ? 1 : 0) + (dent_blocks ? 1 : 0);
++
++ if (free > need_upper)
+ return false;
+- return (free_sections(sbi) + freed) <=
+- (node_secs + 2 * dent_secs + imeta_secs +
+- reserved_sections(sbi) + needed);
++ else if (free <= need_lower)
++ return true;
++ return !has_curseg_enough_space(sbi, node_blocks, dent_blocks);
+ }
+
+ static inline bool excess_prefree_segs(struct f2fs_sb_info *sbi)
+diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
+index 4c6c635bc8aaa..5e35307a3d6bf 100644
+--- a/fs/fat/fatent.c
++++ b/fs/fat/fatent.c
+@@ -93,7 +93,8 @@ static int fat12_ent_bread(struct super_block *sb, struct fat_entry *fatent,
+ err_brelse:
+ brelse(bhs[0]);
+ err:
+- fat_msg(sb, KERN_ERR, "FAT read failed (blocknr %llu)", (llu)blocknr);
++ fat_msg_ratelimit(sb, KERN_ERR, "FAT read failed (blocknr %llu)",
++ (llu)blocknr);
+ return -EIO;
+ }
+
+@@ -106,8 +107,8 @@ static int fat_ent_bread(struct super_block *sb, struct fat_entry *fatent,
+ fatent->fat_inode = MSDOS_SB(sb)->fat_inode;
+ fatent->bhs[0] = sb_bread(sb, blocknr);
+ if (!fatent->bhs[0]) {
+- fat_msg(sb, KERN_ERR, "FAT read failed (blocknr %llu)",
+- (llu)blocknr);
++ fat_msg_ratelimit(sb, KERN_ERR, "FAT read failed (blocknr %llu)",
++ (llu)blocknr);
+ return -EIO;
+ }
+ fatent->nr_bhs = 1;
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 869a34a489587..4d687e2e23735 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -1568,11 +1568,12 @@ static long writeback_sb_inodes(struct super_block *sb,
+ };
+ unsigned long start_time = jiffies;
+ long write_chunk;
+- long wrote = 0; /* count both pages and inodes */
++ long total_wrote = 0; /* count both pages and inodes */
+
+ while (!list_empty(&wb->b_io)) {
+ struct inode *inode = wb_inode(wb->b_io.prev);
+ struct bdi_writeback *tmp_wb;
++ long wrote;
+
+ if (inode->i_sb != sb) {
+ if (work->sb) {
+@@ -1648,7 +1649,9 @@ static long writeback_sb_inodes(struct super_block *sb,
+
+ wbc_detach_inode(&wbc);
+ work->nr_pages -= write_chunk - wbc.nr_to_write;
+- wrote += write_chunk - wbc.nr_to_write;
++ wrote = write_chunk - wbc.nr_to_write - wbc.pages_skipped;
++ wrote = wrote < 0 ? 0 : wrote;
++ total_wrote += wrote;
+
+ if (need_resched()) {
+ /*
+@@ -1670,7 +1673,7 @@ static long writeback_sb_inodes(struct super_block *sb,
+ tmp_wb = inode_to_wb_and_lock_list(inode);
+ spin_lock(&inode->i_lock);
+ if (!(inode->i_state & I_DIRTY_ALL))
+- wrote++;
++ total_wrote++;
+ requeue_inode(inode, tmp_wb, &wbc);
+ inode_sync_complete(inode);
+ spin_unlock(&inode->i_lock);
+@@ -1684,14 +1687,14 @@ static long writeback_sb_inodes(struct super_block *sb,
+ * bail out to wb_writeback() often enough to check
+ * background threshold and other termination conditions.
+ */
+- if (wrote) {
++ if (total_wrote) {
+ if (time_is_before_jiffies(start_time + HZ / 10UL))
+ break;
+ if (work->nr_pages <= 0)
+ break;
+ }
+ }
+- return wrote;
++ return total_wrote;
+ }
+
+ static long __writeback_inodes_wb(struct bdi_writeback *wb,
+diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
+index 81f7a6efe168b..6afaace72f2b2 100644
+--- a/fs/jffs2/fs.c
++++ b/fs/jffs2/fs.c
+@@ -598,6 +598,7 @@ out_root:
+ jffs2_free_raw_node_refs(c);
+ kvfree(c->blocks);
+ jffs2_clear_xattr_subsystem(c);
++ jffs2_sum_exit(c);
+ out_inohash:
+ kfree(c->inocache_list);
+ out_wbuf:
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index f05805a10a50b..1014f2a24697f 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -398,7 +398,8 @@ int dbFree(struct inode *ip, s64 blkno, s64 nblocks)
+ }
+
+ /* write the last buffer. */
+- write_metapage(mp);
++ if (mp)
++ write_metapage(mp);
+
+ IREAD_UNLOCK(ipbmap);
+
+diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
+index a4a538abcaf9a..99627d3438e5f 100644
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -20,7 +20,15 @@
+
+ DEFINE_MUTEX(kernfs_mutex);
+ static DEFINE_SPINLOCK(kernfs_rename_lock); /* kn->parent and ->name */
+-static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by rename_lock */
++/*
++ * Don't use rename_lock to piggy back on pr_cont_buf. We don't want to
++ * call pr_cont() while holding rename_lock. Because sometimes pr_cont()
++ * will perform wakeups when releasing console_sem. Holding rename_lock
++ * will introduce deadlock if the scheduler reads the kernfs_name in the
++ * wakeup path.
++ */
++static DEFINE_SPINLOCK(kernfs_pr_cont_lock);
++static char kernfs_pr_cont_buf[PATH_MAX]; /* protected by pr_cont_lock */
+ static DEFINE_SPINLOCK(kernfs_idr_lock); /* root->ino_idr */
+
+ #define rb_to_kn(X) rb_entry((X), struct kernfs_node, rb)
+@@ -229,12 +237,12 @@ void pr_cont_kernfs_name(struct kernfs_node *kn)
+ {
+ unsigned long flags;
+
+- spin_lock_irqsave(&kernfs_rename_lock, flags);
++ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
+
+- kernfs_name_locked(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
++ kernfs_name(kn, kernfs_pr_cont_buf, sizeof(kernfs_pr_cont_buf));
+ pr_cont("%s", kernfs_pr_cont_buf);
+
+- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
++ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
+ }
+
+ /**
+@@ -248,10 +256,10 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
+ unsigned long flags;
+ int sz;
+
+- spin_lock_irqsave(&kernfs_rename_lock, flags);
++ spin_lock_irqsave(&kernfs_pr_cont_lock, flags);
+
+- sz = kernfs_path_from_node_locked(kn, NULL, kernfs_pr_cont_buf,
+- sizeof(kernfs_pr_cont_buf));
++ sz = kernfs_path_from_node(kn, NULL, kernfs_pr_cont_buf,
++ sizeof(kernfs_pr_cont_buf));
+ if (sz < 0) {
+ pr_cont("(error)");
+ goto out;
+@@ -265,7 +273,7 @@ void pr_cont_kernfs_path(struct kernfs_node *kn)
+ pr_cont("%s", kernfs_pr_cont_buf);
+
+ out:
+- spin_unlock_irqrestore(&kernfs_rename_lock, flags);
++ spin_unlock_irqrestore(&kernfs_pr_cont_lock, flags);
+ }
+
+ /**
+@@ -867,13 +875,12 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
+
+ lockdep_assert_held(&kernfs_mutex);
+
+- /* grab kernfs_rename_lock to piggy back on kernfs_pr_cont_buf */
+- spin_lock_irq(&kernfs_rename_lock);
++ spin_lock_irq(&kernfs_pr_cont_lock);
+
+ len = strlcpy(kernfs_pr_cont_buf, path, sizeof(kernfs_pr_cont_buf));
+
+ if (len >= sizeof(kernfs_pr_cont_buf)) {
+- spin_unlock_irq(&kernfs_rename_lock);
++ spin_unlock_irq(&kernfs_pr_cont_lock);
+ return NULL;
+ }
+
+@@ -885,7 +892,7 @@ static struct kernfs_node *kernfs_walk_ns(struct kernfs_node *parent,
+ parent = kernfs_find_ns(parent, name, ns);
+ }
+
+- spin_unlock_irq(&kernfs_rename_lock);
++ spin_unlock_irq(&kernfs_pr_cont_lock);
+
+ return parent;
+ }
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 759c834b60fd6..f48a11fa78bb9 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2920,6 +2920,10 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
+ }
+
+ out:
++ if (opendata->lgp) {
++ nfs4_lgopen_release(opendata->lgp);
++ opendata->lgp = NULL;
++ }
+ if (!opendata->cancelled)
+ nfs4_sequence_free_slot(&opendata->o_res.seq_res);
+ return ret;
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 0f1c158594188..a7d638bfb46b9 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1897,6 +1897,7 @@ lookup_again:
+ lo = pnfs_find_alloc_layout(ino, ctx, gfp_flags);
+ if (lo == NULL) {
+ spin_unlock(&ino->i_lock);
++ lseg = ERR_PTR(-ENOMEM);
+ trace_pnfs_update_layout(ino, pos, count, iomode, lo, lseg,
+ PNFS_UPDATE_LAYOUT_NOMEM);
+ goto out;
+@@ -2024,6 +2025,7 @@ lookup_again:
+
+ lgp = pnfs_alloc_init_layoutget_args(ino, ctx, &stateid, &arg, gfp_flags);
+ if (!lgp) {
++ lseg = ERR_PTR(-ENOMEM);
+ trace_pnfs_update_layout(ino, pos, count, iomode, lo, NULL,
+ PNFS_UPDATE_LAYOUT_NOMEM);
+ nfs_layoutget_end(lo);
+diff --git a/fs/notify/fdinfo.c b/fs/notify/fdinfo.c
+index 86fcf58142798..74aeabbf0ea48 100644
+--- a/fs/notify/fdinfo.c
++++ b/fs/notify/fdinfo.c
+@@ -83,16 +83,9 @@ static void inotify_fdinfo(struct seq_file *m, struct fsnotify_mark *mark)
+ inode_mark = container_of(mark, struct inotify_inode_mark, fsn_mark);
+ inode = igrab(fsnotify_conn_inode(mark->connector));
+ if (inode) {
+- /*
+- * IN_ALL_EVENTS represents all of the mask bits
+- * that we expose to userspace. There is at
+- * least one bit (FS_EVENT_ON_CHILD) which is
+- * used only internally to the kernel.
+- */
+- u32 mask = mark->mask & IN_ALL_EVENTS;
+- seq_printf(m, "inotify wd:%x ino:%lx sdev:%x mask:%x ignored_mask:%x ",
++ seq_printf(m, "inotify wd:%x ino:%lx sdev:%x mask:%x ignored_mask:0 ",
+ inode_mark->wd, inode->i_ino, inode->i_sb->s_dev,
+- mask, mark->ignored_mask);
++ inotify_mark_user_mask(mark));
+ show_mark_fhandle(m, inode);
+ seq_putc(m, '\n');
+ iput(inode);
+diff --git a/fs/notify/inotify/inotify.h b/fs/notify/inotify/inotify.h
+index 7e4578d35b613..5d94c00b1233b 100644
+--- a/fs/notify/inotify/inotify.h
++++ b/fs/notify/inotify/inotify.h
+@@ -21,6 +21,18 @@ static inline struct inotify_event_info *INOTIFY_E(struct fsnotify_event *fse)
+ return container_of(fse, struct inotify_event_info, fse);
+ }
+
++/*
++ * INOTIFY_USER_FLAGS represents all of the mask bits that we expose to
++ * userspace. There is at least one bit (FS_EVENT_ON_CHILD) which is
++ * used only internally to the kernel.
++ */
++#define INOTIFY_USER_MASK (IN_ALL_EVENTS | IN_ONESHOT | IN_EXCL_UNLINK)
++
++static inline __u32 inotify_mark_user_mask(struct fsnotify_mark *fsn_mark)
++{
++ return fsn_mark->mask & INOTIFY_USER_MASK;
++}
++
+ extern void inotify_ignored_and_remove_idr(struct fsnotify_mark *fsn_mark,
+ struct fsnotify_group *group);
+ extern int inotify_handle_event(struct fsnotify_group *group,
+diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
+index 97a51690338ea..83d0b9356844e 100644
+--- a/fs/notify/inotify/inotify_user.c
++++ b/fs/notify/inotify/inotify_user.c
+@@ -96,7 +96,7 @@ static inline __u32 inotify_arg_to_mask(u32 arg)
+ mask = (FS_IN_IGNORED | FS_EVENT_ON_CHILD | FS_UNMOUNT);
+
+ /* mask off the flags used to open the fd */
+- mask |= (arg & (IN_ALL_EVENTS | IN_ONESHOT | IN_EXCL_UNLINK));
++ mask |= (arg & INOTIFY_USER_MASK);
+
+ return mask;
+ }
+diff --git a/fs/notify/mark.c b/fs/notify/mark.c
+index 09535f6423fc5..3afd58170984c 100644
+--- a/fs/notify/mark.c
++++ b/fs/notify/mark.c
+@@ -434,7 +434,7 @@ void fsnotify_free_mark(struct fsnotify_mark *mark)
+ void fsnotify_destroy_mark(struct fsnotify_mark *mark,
+ struct fsnotify_group *group)
+ {
+- mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
++ mutex_lock(&group->mark_mutex);
+ fsnotify_detach_mark(mark);
+ mutex_unlock(&group->mark_mutex);
+ fsnotify_free_mark(mark);
+@@ -703,7 +703,7 @@ void fsnotify_clear_marks_by_group(struct fsnotify_group *group,
+ * move marks to free to to_free list in one go and then free marks in
+ * to_free list one by one.
+ */
+- mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
++ mutex_lock(&group->mark_mutex);
+ list_for_each_entry_safe(mark, lmark, &group->marks_list, g_list) {
+ if ((1U << mark->connector->type) & type_mask)
+ list_move(&mark->g_list, &to_free);
+@@ -712,7 +712,7 @@ void fsnotify_clear_marks_by_group(struct fsnotify_group *group,
+
+ clear:
+ while (1) {
+- mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
++ mutex_lock(&group->mark_mutex);
+ if (list_empty(head)) {
+ mutex_unlock(&group->mark_mutex);
+ break;
+diff --git a/fs/ocfs2/dlmfs/userdlm.c b/fs/ocfs2/dlmfs/userdlm.c
+index 9cecf4857195c..24dbbbf138275 100644
+--- a/fs/ocfs2/dlmfs/userdlm.c
++++ b/fs/ocfs2/dlmfs/userdlm.c
+@@ -449,6 +449,11 @@ again:
+ }
+
+ spin_lock(&lockres->l_lock);
++ if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) {
++ spin_unlock(&lockres->l_lock);
++ status = -EAGAIN;
++ goto bail;
++ }
+
+ /* We only compare against the currently granted level
+ * here. If the lock is blocked waiting on a downconvert,
+@@ -615,7 +620,7 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres)
+ spin_lock(&lockres->l_lock);
+ if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) {
+ spin_unlock(&lockres->l_lock);
+- return 0;
++ goto bail;
+ }
+
+ lockres->l_flags |= USER_LOCK_IN_TEARDOWN;
+@@ -629,12 +634,17 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres)
+ }
+
+ if (lockres->l_ro_holders || lockres->l_ex_holders) {
++ lockres->l_flags &= ~USER_LOCK_IN_TEARDOWN;
+ spin_unlock(&lockres->l_lock);
+ goto bail;
+ }
+
+ status = 0;
+ if (!(lockres->l_flags & USER_LOCK_ATTACHED)) {
++ /*
++ * lock is never requested, leave USER_LOCK_IN_TEARDOWN set
++ * to avoid new lock request coming in.
++ */
+ spin_unlock(&lockres->l_lock);
+ goto bail;
+ }
+@@ -645,6 +655,10 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres)
+
+ status = ocfs2_dlm_unlock(conn, &lockres->l_lksb, DLM_LKF_VALBLK);
+ if (status) {
++ spin_lock(&lockres->l_lock);
++ lockres->l_flags &= ~USER_LOCK_IN_TEARDOWN;
++ lockres->l_flags &= ~USER_LOCK_BUSY;
++ spin_unlock(&lockres->l_lock);
+ user_log_dlm_error("ocfs2_dlm_unlock", status, lockres);
+ goto bail;
+ }
+diff --git a/fs/proc/generic.c b/fs/proc/generic.c
+index bab10368a04d8..d8b3c6a7173fb 100644
+--- a/fs/proc/generic.c
++++ b/fs/proc/generic.c
+@@ -445,6 +445,9 @@ static struct proc_dir_entry *__proc_create(struct proc_dir_entry **parent,
+ proc_set_user(ent, (*parent)->uid, (*parent)->gid);
+
+ ent->proc_dops = &proc_misc_dentry_ops;
++ /* Revalidate everything under /proc/${pid}/net */
++ if ((*parent)->proc_dops == &proc_net_dentry_ops)
++ pde_force_lookup(ent);
+
+ out:
+ return ent;
+diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
+index 096bcc1e7a8a5..68ce173d55904 100644
+--- a/fs/proc/proc_net.c
++++ b/fs/proc/proc_net.c
+@@ -342,6 +342,9 @@ static __net_init int proc_net_ns_init(struct net *net)
+
+ proc_set_user(netd, uid, gid);
+
++ /* Seed dentry revalidation for /proc/${pid}/net */
++ pde_force_lookup(netd);
++
+ err = -EEXIST;
+ net_statd = proc_net_mkdir(net, "stat", netd);
+ if (!net_statd)
+diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h
+index 53be104aab5ce..8b9678bffe7be 100644
+--- a/include/drm/drm_edid.h
++++ b/include/drm/drm_edid.h
+@@ -115,7 +115,7 @@ struct detailed_data_monitor_range {
+ u8 supported_scalings;
+ u8 preferred_refresh;
+ } __attribute__((packed)) cvt;
+- } formula;
++ } __attribute__((packed)) formula;
+ } __attribute__((packed));
+
+ struct detailed_data_wpindex {
+@@ -148,7 +148,7 @@ struct detailed_non_pixel {
+ struct detailed_data_wpindex color;
+ struct std_timing timings[6];
+ struct cvt_timing cvt[4];
+- } data;
++ } __attribute__((packed)) data;
+ } __attribute__((packed));
+
+ #define EDID_DETAIL_EST_TIMINGS 0xf7
+@@ -166,7 +166,7 @@ struct detailed_timing {
+ union {
+ struct detailed_pixel_timing pixel_data;
+ struct detailed_non_pixel other_data;
+- } data;
++ } __attribute__((packed)) data;
+ } __attribute__((packed));
+
+ #define DRM_EDID_INPUT_SERRATION_VSYNC (1 << 0)
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 48e6d68ec5eec..766ea96bf5b82 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -689,6 +689,8 @@ void bpf_offload_dev_netdev_unregister(struct bpf_offload_dev *offdev,
+ struct net_device *netdev);
+ bool bpf_offload_dev_match(struct bpf_prog *prog, struct net_device *netdev);
+
++void unpriv_ebpf_notify(int new_state);
++
+ #if defined(CONFIG_NET) && defined(CONFIG_BPF_SYSCALL)
+ int bpf_prog_offload_init(struct bpf_prog *prog, union bpf_attr *attr);
+
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index 9a5d4b4992716..ec89e8bcc92f3 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -150,6 +150,8 @@ struct capsule_info {
+ size_t page_bytes_remain;
+ };
+
++int efi_capsule_setup_info(struct capsule_info *cap_info, void *kbuff,
++ size_t hdr_bytes);
+ int __efi_capsule_setup_info(struct capsule_info *cap_info);
+
+ /*
+diff --git a/include/linux/mailbox_controller.h b/include/linux/mailbox_controller.h
+index 74deadb42d767..5a4524f66ea16 100644
+--- a/include/linux/mailbox_controller.h
++++ b/include/linux/mailbox_controller.h
+@@ -83,6 +83,7 @@ struct mbox_controller {
+ const struct of_phandle_args *sp);
+ /* Internal to API */
+ struct hrtimer poll_hrt;
++ spinlock_t poll_hrt_lock;
+ struct list_head node;
+ };
+
+diff --git a/include/linux/mtd/cfi.h b/include/linux/mtd/cfi.h
+index 9b57a9b1b081d..4ead3d1559f54 100644
+--- a/include/linux/mtd/cfi.h
++++ b/include/linux/mtd/cfi.h
+@@ -293,6 +293,7 @@ struct cfi_private {
+ map_word sector_erase_cmd;
+ unsigned long chipshift; /* Because they're of the same type */
+ const char *im_name; /* inter_module name for cmdset_setup */
++ unsigned long quirks;
+ struct flchip chips[0]; /* per-chip data structure for each chip */
+ };
+
+diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
+index 5a30ad594ccc1..326744b7d15ed 100644
+--- a/include/linux/nodemask.h
++++ b/include/linux/nodemask.h
+@@ -42,11 +42,11 @@
+ * void nodes_shift_right(dst, src, n) Shift right
+ * void nodes_shift_left(dst, src, n) Shift left
+ *
+- * int first_node(mask) Number lowest set bit, or MAX_NUMNODES
+- * int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
+- * int next_node_in(node, mask) Next node past 'node', or wrap to first,
++ * unsigned int first_node(mask) Number lowest set bit, or MAX_NUMNODES
++ * unsigend int next_node(node, mask) Next node past 'node', or MAX_NUMNODES
++ * unsigned int next_node_in(node, mask) Next node past 'node', or wrap to first,
+ * or MAX_NUMNODES
+- * int first_unset_node(mask) First node not set in mask, or
++ * unsigned int first_unset_node(mask) First node not set in mask, or
+ * MAX_NUMNODES
+ *
+ * nodemask_t nodemask_of_node(node) Return nodemask with bit 'node' set
+@@ -153,7 +153,7 @@ static inline void __nodes_clear(nodemask_t *dstp, unsigned int nbits)
+
+ #define node_test_and_set(node, nodemask) \
+ __node_test_and_set((node), &(nodemask))
+-static inline int __node_test_and_set(int node, nodemask_t *addr)
++static inline bool __node_test_and_set(int node, nodemask_t *addr)
+ {
+ return test_and_set_bit(node, addr->bits);
+ }
+@@ -200,7 +200,7 @@ static inline void __nodes_complement(nodemask_t *dstp,
+
+ #define nodes_equal(src1, src2) \
+ __nodes_equal(&(src1), &(src2), MAX_NUMNODES)
+-static inline int __nodes_equal(const nodemask_t *src1p,
++static inline bool __nodes_equal(const nodemask_t *src1p,
+ const nodemask_t *src2p, unsigned int nbits)
+ {
+ return bitmap_equal(src1p->bits, src2p->bits, nbits);
+@@ -208,7 +208,7 @@ static inline int __nodes_equal(const nodemask_t *src1p,
+
+ #define nodes_intersects(src1, src2) \
+ __nodes_intersects(&(src1), &(src2), MAX_NUMNODES)
+-static inline int __nodes_intersects(const nodemask_t *src1p,
++static inline bool __nodes_intersects(const nodemask_t *src1p,
+ const nodemask_t *src2p, unsigned int nbits)
+ {
+ return bitmap_intersects(src1p->bits, src2p->bits, nbits);
+@@ -216,20 +216,20 @@ static inline int __nodes_intersects(const nodemask_t *src1p,
+
+ #define nodes_subset(src1, src2) \
+ __nodes_subset(&(src1), &(src2), MAX_NUMNODES)
+-static inline int __nodes_subset(const nodemask_t *src1p,
++static inline bool __nodes_subset(const nodemask_t *src1p,
+ const nodemask_t *src2p, unsigned int nbits)
+ {
+ return bitmap_subset(src1p->bits, src2p->bits, nbits);
+ }
+
+ #define nodes_empty(src) __nodes_empty(&(src), MAX_NUMNODES)
+-static inline int __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
++static inline bool __nodes_empty(const nodemask_t *srcp, unsigned int nbits)
+ {
+ return bitmap_empty(srcp->bits, nbits);
+ }
+
+ #define nodes_full(nodemask) __nodes_full(&(nodemask), MAX_NUMNODES)
+-static inline int __nodes_full(const nodemask_t *srcp, unsigned int nbits)
++static inline bool __nodes_full(const nodemask_t *srcp, unsigned int nbits)
+ {
+ return bitmap_full(srcp->bits, nbits);
+ }
+@@ -260,15 +260,15 @@ static inline void __nodes_shift_left(nodemask_t *dstp,
+ > MAX_NUMNODES, then the silly min_ts could be dropped. */
+
+ #define first_node(src) __first_node(&(src))
+-static inline int __first_node(const nodemask_t *srcp)
++static inline unsigned int __first_node(const nodemask_t *srcp)
+ {
+- return min_t(int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
++ return min_t(unsigned int, MAX_NUMNODES, find_first_bit(srcp->bits, MAX_NUMNODES));
+ }
+
+ #define next_node(n, src) __next_node((n), &(src))
+-static inline int __next_node(int n, const nodemask_t *srcp)
++static inline unsigned int __next_node(int n, const nodemask_t *srcp)
+ {
+- return min_t(int,MAX_NUMNODES,find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
++ return min_t(unsigned int, MAX_NUMNODES, find_next_bit(srcp->bits, MAX_NUMNODES, n+1));
+ }
+
+ /*
+@@ -276,7 +276,7 @@ static inline int __next_node(int n, const nodemask_t *srcp)
+ * the first node in src if needed. Returns MAX_NUMNODES if src is empty.
+ */
+ #define next_node_in(n, src) __next_node_in((n), &(src))
+-int __next_node_in(int node, const nodemask_t *srcp);
++unsigned int __next_node_in(int node, const nodemask_t *srcp);
+
+ static inline void init_nodemask_of_node(nodemask_t *mask, int node)
+ {
+@@ -296,9 +296,9 @@ static inline void init_nodemask_of_node(nodemask_t *mask, int node)
+ })
+
+ #define first_unset_node(mask) __first_unset_node(&(mask))
+-static inline int __first_unset_node(const nodemask_t *maskp)
++static inline unsigned int __first_unset_node(const nodemask_t *maskp)
+ {
+- return min_t(int,MAX_NUMNODES,
++ return min_t(unsigned int, MAX_NUMNODES,
+ find_first_zero_bit(maskp->bits, MAX_NUMNODES));
+ }
+
+@@ -375,14 +375,13 @@ static inline void __nodes_fold(nodemask_t *dstp, const nodemask_t *origp,
+ }
+
+ #if MAX_NUMNODES > 1
+-#define for_each_node_mask(node, mask) \
+- for ((node) = first_node(mask); \
+- (node) < MAX_NUMNODES; \
+- (node) = next_node((node), (mask)))
++#define for_each_node_mask(node, mask) \
++ for ((node) = first_node(mask); \
++ (node >= 0) && (node) < MAX_NUMNODES; \
++ (node) = next_node((node), (mask)))
+ #else /* MAX_NUMNODES == 1 */
+-#define for_each_node_mask(node, mask) \
+- if (!nodes_empty(mask)) \
+- for ((node) = 0; (node) < 1; (node)++)
++#define for_each_node_mask(node, mask) \
++ for ((node) = 0; (node) < 1 && !nodes_empty(mask); (node)++)
+ #endif /* MAX_NUMNODES */
+
+ /*
+@@ -435,11 +434,11 @@ static inline int num_node_state(enum node_states state)
+
+ #define first_online_node first_node(node_states[N_ONLINE])
+ #define first_memory_node first_node(node_states[N_MEMORY])
+-static inline int next_online_node(int nid)
++static inline unsigned int next_online_node(int nid)
+ {
+ return next_node(nid, node_states[N_ONLINE]);
+ }
+-static inline int next_memory_node(int nid)
++static inline unsigned int next_memory_node(int nid)
+ {
+ return next_node(nid, node_states[N_MEMORY]);
+ }
+diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
+index 561feb5606194..d41de55cdfb9f 100644
+--- a/include/linux/ptrace.h
++++ b/include/linux/ptrace.h
+@@ -40,12 +40,6 @@ extern int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
+ #define PT_EXITKILL (PTRACE_O_EXITKILL << PT_OPT_FLAG_SHIFT)
+ #define PT_SUSPEND_SECCOMP (PTRACE_O_SUSPEND_SECCOMP << PT_OPT_FLAG_SHIFT)
+
+-/* single stepping state bits (used on ARM and PA-RISC) */
+-#define PT_SINGLESTEP_BIT 31
+-#define PT_SINGLESTEP (1<<PT_SINGLESTEP_BIT)
+-#define PT_BLOCKSTEP_BIT 30
+-#define PT_BLOCKSTEP (1<<PT_BLOCKSTEP_BIT)
+-
+ extern long arch_ptrace(struct task_struct *child, long request,
+ unsigned long addr, unsigned long data);
+ extern int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len);
+diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
+index d7578cf49c3af..3953003b04909 100644
+--- a/include/net/if_inet6.h
++++ b/include/net/if_inet6.h
+@@ -69,6 +69,14 @@ struct inet6_ifaddr {
+
+ struct hlist_node addr_lst;
+ struct list_head if_list;
++ /*
++ * Used to safely traverse idev->addr_list in process context
++ * if the idev->lock needed to protect idev->addr_list cannot be held.
++ * In that case, add the items to this list temporarily and iterate
++ * without holding idev->lock.
++ * See addrconf_ifdown and dev_forward_change.
++ */
++ struct list_head if_list_aux;
+
+ struct list_head tmp_list;
+ struct inet6_ifaddr *ifpub;
+diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h
+index eafccb2d4d6f7..71a00fb2279f8 100644
+--- a/include/scsi/libfcoe.h
++++ b/include/scsi/libfcoe.h
+@@ -261,7 +261,8 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *, struct fc_lport *,
+ struct fc_frame *);
+
+ /* libfcoe funcs */
+-u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int);
++u64 fcoe_wwn_from_mac(unsigned char mac[ETH_ALEN], unsigned int scheme,
++ unsigned int port);
+ int fcoe_libfc_config(struct fc_lport *, struct fcoe_ctlr *,
+ const struct libfc_function_template *, int init_fcp);
+ u32 fcoe_fc_crc(struct fc_frame *fp);
+diff --git a/include/sound/jack.h b/include/sound/jack.h
+index 1e84bfb553cf7..4742f842b4573 100644
+--- a/include/sound/jack.h
++++ b/include/sound/jack.h
+@@ -77,6 +77,7 @@ struct snd_jack {
+ const char *id;
+ #ifdef CONFIG_SND_JACK_INPUT_DEV
+ struct input_dev *input_dev;
++ struct mutex input_dev_lock;
+ int registered;
+ int type;
+ char name[100];
+diff --git a/include/trace/events/vmscan.h b/include/trace/events/vmscan.h
+index a1cb91342231f..7add8c87fe22e 100644
+--- a/include/trace/events/vmscan.h
++++ b/include/trace/events/vmscan.h
+@@ -294,7 +294,7 @@ TRACE_EVENT(mm_vmscan_lru_isolate,
+ __field(unsigned long, nr_scanned)
+ __field(unsigned long, nr_skipped)
+ __field(unsigned long, nr_taken)
+- __field(isolate_mode_t, isolate_mode)
++ __field(unsigned int, isolate_mode)
+ __field(int, lru)
+ ),
+
+@@ -305,7 +305,7 @@ TRACE_EVENT(mm_vmscan_lru_isolate,
+ __entry->nr_scanned = nr_scanned;
+ __entry->nr_skipped = nr_skipped;
+ __entry->nr_taken = nr_taken;
+- __entry->isolate_mode = isolate_mode;
++ __entry->isolate_mode = (__force unsigned int)isolate_mode;
+ __entry->lru = lru;
+ ),
+
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index 9c9a5b12f92ff..7c6cd00d0fca9 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -469,7 +469,7 @@ void debug_dma_dump_mappings(struct device *dev)
+ * At any time debug_dma_assert_idle() can be called to trigger a
+ * warning if any cachelines in the given page are in the active set.
+ */
+-static RADIX_TREE(dma_active_cacheline, GFP_NOWAIT);
++static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC);
+ static DEFINE_SPINLOCK(radix_lock);
+ #define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)
+ #define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT)
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index 8a98e3e78c704..bf8360e86f628 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -1121,9 +1121,8 @@ int ptrace_request(struct task_struct *child, long request,
+ return ptrace_resume(child, request, data);
+
+ case PTRACE_KILL:
+- if (child->exit_state) /* already dead */
+- return 0;
+- return ptrace_resume(child, request, SIGKILL);
++ send_sig_info(SIGKILL, SEND_SIG_NOINFO, child);
++ return 0;
+
+ #ifdef CONFIG_HAVE_ARCH_TRACEHOOK
+ case PTRACE_GETREGSET:
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 063b434c89d26..5b7a6e9b0ab6b 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2331,7 +2331,7 @@ trace_event_buffer_lock_reserve(struct ring_buffer **current_rb,
+ }
+ EXPORT_SYMBOL_GPL(trace_event_buffer_lock_reserve);
+
+-static DEFINE_SPINLOCK(tracepoint_iter_lock);
++static DEFINE_RAW_SPINLOCK(tracepoint_iter_lock);
+ static DEFINE_MUTEX(tracepoint_printk_mutex);
+
+ static void output_printk(struct trace_event_buffer *fbuffer)
+@@ -2352,14 +2352,14 @@ static void output_printk(struct trace_event_buffer *fbuffer)
+
+ event = &fbuffer->trace_file->event_call->event;
+
+- spin_lock_irqsave(&tracepoint_iter_lock, flags);
++ raw_spin_lock_irqsave(&tracepoint_iter_lock, flags);
+ trace_seq_init(&iter->seq);
+ iter->ent = fbuffer->entry;
+ event_call->event.funcs->trace(iter, 0, event);
+ trace_seq_putc(&iter->seq, 0);
+ printk("%s", iter->seq.buffer);
+
+- spin_unlock_irqrestore(&tracepoint_iter_lock, flags);
++ raw_spin_unlock_irqrestore(&tracepoint_iter_lock, flags);
+ }
+
+ int tracepoint_printk_sysctl(struct ctl_table *table, int write,
+@@ -5368,12 +5368,18 @@ static void tracing_set_nop(struct trace_array *tr)
+ tr->current_trace = &nop_trace;
+ }
+
++static bool tracer_options_updated;
++
+ static void add_tracer_options(struct trace_array *tr, struct tracer *t)
+ {
+ /* Only enable if the directory has been created already. */
+ if (!tr->dir)
+ return;
+
++ /* Only create trace option files after update_tracer_options finish */
++ if (!tracer_options_updated)
++ return;
++
+ create_trace_option_files(tr, t);
+ }
+
+@@ -7820,6 +7826,7 @@ static void __update_tracer_options(struct trace_array *tr)
+ static void update_tracer_options(struct trace_array *tr)
+ {
+ mutex_lock(&trace_types_lock);
++ tracer_options_updated = true;
+ __update_tracer_options(tr);
+ mutex_unlock(&trace_types_lock);
+ }
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 9741344cc0a45..e25bc917ec6cf 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -2456,8 +2456,11 @@ static int init_var_ref(struct hist_field *ref_field,
+ return err;
+ free:
+ kfree(ref_field->system);
++ ref_field->system = NULL;
+ kfree(ref_field->event_name);
++ ref_field->event_name = NULL;
+ kfree(ref_field->name);
++ ref_field->name = NULL;
+
+ goto out;
+ }
+diff --git a/lib/nodemask.c b/lib/nodemask.c
+index 3aa454c54c0de..e22647f5181b3 100644
+--- a/lib/nodemask.c
++++ b/lib/nodemask.c
+@@ -3,9 +3,9 @@
+ #include <linux/module.h>
+ #include <linux/random.h>
+
+-int __next_node_in(int node, const nodemask_t *srcp)
++unsigned int __next_node_in(int node, const nodemask_t *srcp)
+ {
+- int ret = __next_node(node, srcp);
++ unsigned int ret = __next_node(node, srcp);
+
+ if (ret == MAX_NUMNODES)
+ ret = __first_node(srcp);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 0c5a2b4e003d5..45e874fafdd70 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4837,7 +4837,14 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+ pud_clear(pud);
+ put_page(virt_to_page(ptep));
+ mm_dec_nr_pmds(mm);
+- *addr = ALIGN(*addr, HPAGE_SIZE * PTRS_PER_PTE) - HPAGE_SIZE;
++ /*
++ * This update of passed address optimizes loops sequentially
++ * processing addresses in increments of huge page size (PMD_SIZE
++ * in this case). By clearing the pud, a PUD_SIZE area is unmapped.
++ * Update address to the 'last page' in the cleared area so that
++ * calling loop can move to first page past this area.
++ */
++ *addr |= PUD_SIZE - PMD_SIZE;
+ return 1;
+ }
+ #define want_pmd_share() (1)
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 1e0a1c0a56b57..14b5288d1432b 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -563,19 +563,24 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
+ addr->sa_family != AF_BLUETOOTH)
+ return -EINVAL;
+
+- if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
+- return -EBADFD;
++ lock_sock(sk);
++ if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
++ err = -EBADFD;
++ goto done;
++ }
+
+- if (sk->sk_type != SOCK_SEQPACKET)
+- return -EINVAL;
++ if (sk->sk_type != SOCK_SEQPACKET) {
++ err = -EINVAL;
++ goto done;
++ }
+
+ hdev = hci_get_route(&sa->sco_bdaddr, &sco_pi(sk)->src, BDADDR_BREDR);
+- if (!hdev)
+- return -EHOSTUNREACH;
++ if (!hdev) {
++ err = -EHOSTUNREACH;
++ goto done;
++ }
+ hci_dev_lock(hdev);
+
+- lock_sock(sk);
+-
+ /* Set destination address and psm */
+ bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 41d0f9bb51914..cf60d0e079657 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -678,21 +678,20 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
+ }
+
+ if (dev->header_ops) {
+- const int pull_len = tunnel->hlen + sizeof(struct iphdr);
+-
+ if (skb_cow_head(skb, 0))
+ goto free_skb;
+
+ tnl_params = (const struct iphdr *)skb->data;
+
+- if (pull_len > skb_transport_offset(skb))
+- goto free_skb;
+-
+ /* Pull skb since ip_tunnel_xmit() needs skb->data pointing
+ * to gre header.
+ */
+- skb_pull(skb, pull_len);
++ skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
+ skb_reset_mac_header(skb);
++
++ if (skb->ip_summed == CHECKSUM_PARTIAL &&
++ skb_checksum_start(skb) < skb->data)
++ goto free_skb;
+ } else {
+ if (skb_cow_head(skb, dev->needed_headroom))
+ goto free_skb;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index d71326f3777cb..92f5068c76807 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2566,12 +2566,15 @@ static void tcp_mtup_probe_success(struct sock *sk)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct inet_connection_sock *icsk = inet_csk(sk);
++ u64 val;
+
+- /* FIXME: breaks with very large cwnd */
+ tp->prior_ssthresh = tcp_current_ssthresh(sk);
+- tp->snd_cwnd = tp->snd_cwnd *
+- tcp_mss_to_mtu(sk, tp->mss_cache) /
+- icsk->icsk_mtup.probe_size;
++
++ val = (u64)tp->snd_cwnd * tcp_mss_to_mtu(sk, tp->mss_cache);
++ do_div(val, icsk->icsk_mtup.probe_size);
++ WARN_ON_ONCE((u32)val != val);
++ tp->snd_cwnd = max_t(u32, 1U, val);
++
+ tp->snd_cwnd_cnt = 0;
+ tp->snd_cwnd_stamp = tcp_jiffies32;
+ tp->snd_ssthresh = tcp_current_ssthresh(sk);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 8543cd724d543..25dbdb27a571d 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3805,8 +3805,8 @@ int tcp_rtx_synack(const struct sock *sk, struct request_sock *req)
+ tcp_rsk(req)->txhash = net_tx_rndhash();
+ res = af_ops->send_synack(sk, NULL, &fl, req, NULL, TCP_SYNACK_NORMAL);
+ if (!res) {
+- __TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS);
+- __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
++ TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS);
++ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
+ if (unlikely(tcp_passive_fastopen(sk)))
+ tcp_sk(sk)->total_retrans++;
+ trace_tcp_retransmit_synack(sk, req);
+diff --git a/net/ipv4/xfrm4_protocol.c b/net/ipv4/xfrm4_protocol.c
+index 8dd0e6ab86065..0e1f5dc2766bc 100644
+--- a/net/ipv4/xfrm4_protocol.c
++++ b/net/ipv4/xfrm4_protocol.c
+@@ -297,4 +297,3 @@ void __init xfrm4_protocol_init(void)
+ {
+ xfrm_input_register_afinfo(&xfrm4_input_afinfo);
+ }
+-EXPORT_SYMBOL(xfrm4_protocol_init);
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 9d8b791f63efc..f261c6d7f1f28 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -739,6 +739,7 @@ static void dev_forward_change(struct inet6_dev *idev)
+ {
+ struct net_device *dev;
+ struct inet6_ifaddr *ifa;
++ LIST_HEAD(tmp_addr_list);
+
+ if (!idev)
+ return;
+@@ -757,14 +758,24 @@ static void dev_forward_change(struct inet6_dev *idev)
+ }
+ }
+
++ read_lock_bh(&idev->lock);
+ list_for_each_entry(ifa, &idev->addr_list, if_list) {
+ if (ifa->flags&IFA_F_TENTATIVE)
+ continue;
++ list_add_tail(&ifa->if_list_aux, &tmp_addr_list);
++ }
++ read_unlock_bh(&idev->lock);
++
++ while (!list_empty(&tmp_addr_list)) {
++ ifa = list_first_entry(&tmp_addr_list,
++ struct inet6_ifaddr, if_list_aux);
++ list_del(&ifa->if_list_aux);
+ if (idev->cnf.forwarding)
+ addrconf_join_anycast(ifa);
+ else
+ addrconf_leave_anycast(ifa);
+ }
++
+ inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF,
+ NETCONFA_FORWARDING,
+ dev->ifindex, &idev->cnf);
+@@ -3658,7 +3669,8 @@ static int addrconf_ifdown(struct net_device *dev, int how)
+ unsigned long event = how ? NETDEV_UNREGISTER : NETDEV_DOWN;
+ struct net *net = dev_net(dev);
+ struct inet6_dev *idev;
+- struct inet6_ifaddr *ifa, *tmp;
++ struct inet6_ifaddr *ifa;
++ LIST_HEAD(tmp_addr_list);
+ bool keep_addr = false;
+ int state, i;
+
+@@ -3746,16 +3758,23 @@ restart:
+ write_lock_bh(&idev->lock);
+ }
+
+- list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
++ list_for_each_entry(ifa, &idev->addr_list, if_list)
++ list_add_tail(&ifa->if_list_aux, &tmp_addr_list);
++ write_unlock_bh(&idev->lock);
++
++ while (!list_empty(&tmp_addr_list)) {
+ struct fib6_info *rt = NULL;
+ bool keep;
+
++ ifa = list_first_entry(&tmp_addr_list,
++ struct inet6_ifaddr, if_list_aux);
++ list_del(&ifa->if_list_aux);
++
+ addrconf_del_dad_work(ifa);
+
+ keep = keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
+ !addr_is_local(&ifa->addr);
+
+- write_unlock_bh(&idev->lock);
+ spin_lock_bh(&ifa->lock);
+
+ if (keep) {
+@@ -3786,15 +3805,14 @@ restart:
+ addrconf_leave_solict(ifa->idev, &ifa->addr);
+ }
+
+- write_lock_bh(&idev->lock);
+ if (!keep) {
++ write_lock_bh(&idev->lock);
+ list_del_rcu(&ifa->if_list);
++ write_unlock_bh(&idev->lock);
+ in6_ifa_put(ifa);
+ }
+ }
+
+- write_unlock_bh(&idev->lock);
+-
+ /* Step 5: Discard anycast and multicast list */
+ if (how) {
+ ipv6_ac_destroy_dev(idev);
+@@ -4125,7 +4143,8 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
+ send_rs = send_mld &&
+ ipv6_accept_ra(ifp->idev) &&
+ ifp->idev->cnf.rtr_solicits != 0 &&
+- (dev->flags&IFF_LOOPBACK) == 0;
++ (dev->flags & IFF_LOOPBACK) == 0 &&
++ (dev->type != ARPHRD_TUNNEL);
+ read_unlock_bh(&ifp->idev->lock);
+
+ /* While dad is in progress mld report's source address is in6_addrany.
+diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c
+index 8546f94f30d47..a886a8f4c0cb3 100644
+--- a/net/ipv6/seg6_hmac.c
++++ b/net/ipv6/seg6_hmac.c
+@@ -406,7 +406,6 @@ int __init seg6_hmac_init(void)
+ {
+ return seg6_hmac_init_algo();
+ }
+-EXPORT_SYMBOL(seg6_hmac_init);
+
+ int __net_init seg6_hmac_net_init(struct net *net)
+ {
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 1bbb6ec89ff3d..af67e0d265c05 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2836,10 +2836,12 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
+ void *ext_hdrs[SADB_EXT_MAX];
+ int err;
+
+- err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
+- BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
+- if (err)
+- return err;
++ /* Non-zero return value of pfkey_broadcast() does not always signal
++ * an error and even on an actual error we may still want to process
++ * the message so rather ignore the return value.
++ */
++ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
++ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
+
+ memset(ext_hdrs, 0, sizeof(ext_hdrs));
+ err = parse_exthdrs(skb, hdr, ext_hdrs);
+diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
+index d9558ffb8acf7..6d95ce1c4a272 100644
+--- a/net/mac80211/chan.c
++++ b/net/mac80211/chan.c
+@@ -1638,12 +1638,9 @@ int ieee80211_vif_use_reserved_context(struct ieee80211_sub_if_data *sdata)
+
+ if (new_ctx->replace_state == IEEE80211_CHANCTX_REPLACE_NONE) {
+ if (old_ctx)
+- err = ieee80211_vif_use_reserved_reassign(sdata);
+- else
+- err = ieee80211_vif_use_reserved_assign(sdata);
++ return ieee80211_vif_use_reserved_reassign(sdata);
+
+- if (err)
+- return err;
++ return ieee80211_vif_use_reserved_assign(sdata);
+ }
+
+ /*
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index dea48696f994d..2c2532196ef60 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1072,6 +1072,9 @@ struct tpt_led_trigger {
+ * a scan complete for an aborted scan.
+ * @SCAN_HW_CANCELLED: Set for our scan work function when the scan is being
+ * cancelled.
++ * @SCAN_BEACON_WAIT: Set whenever we're passive scanning because of radar/no-IR
++ * and could send a probe request after receiving a beacon.
++ * @SCAN_BEACON_DONE: Beacon received, we can now send a probe request
+ */
+ enum {
+ SCAN_SW_SCANNING,
+@@ -1080,6 +1083,8 @@ enum {
+ SCAN_COMPLETED,
+ SCAN_ABORTED,
+ SCAN_HW_CANCELLED,
++ SCAN_BEACON_WAIT,
++ SCAN_BEACON_DONE,
+ };
+
+ /**
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index 5d2a11777718c..de42bcfeda9cc 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -222,6 +222,16 @@ void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
+ if (likely(!sdata1 && !sdata2))
+ return;
+
++ if (test_and_clear_bit(SCAN_BEACON_WAIT, &local->scanning)) {
++ /*
++ * we were passive scanning because of radar/no-IR, but
++ * the beacon/proberesp rx gives us an opportunity to upgrade
++ * to active scan
++ */
++ set_bit(SCAN_BEACON_DONE, &local->scanning);
++ ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0);
++ }
++
+ if (ieee80211_is_probe_resp(mgmt->frame_control)) {
+ struct cfg80211_scan_request *scan_req;
+ struct cfg80211_sched_scan_request *sched_scan_req;
+@@ -706,6 +716,8 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
+ IEEE80211_CHAN_RADAR)) ||
+ !req->n_ssids) {
+ next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
++ if (req->n_ssids)
++ set_bit(SCAN_BEACON_WAIT, &local->scanning);
+ } else {
+ ieee80211_scan_state_send_probe(local, &next_delay);
+ next_delay = IEEE80211_CHANNEL_TIME;
+@@ -886,6 +898,8 @@ static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
+ !scan_req->n_ssids) {
+ *next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
+ local->next_scan_state = SCAN_DECISION;
++ if (scan_req->n_ssids)
++ set_bit(SCAN_BEACON_WAIT, &local->scanning);
+ return;
+ }
+
+@@ -978,6 +992,8 @@ void ieee80211_scan_work(struct work_struct *work)
+ goto out;
+ }
+
++ clear_bit(SCAN_BEACON_WAIT, &local->scanning);
++
+ /*
+ * as long as no delay is required advance immediately
+ * without scheduling a new work
+@@ -988,6 +1004,10 @@ void ieee80211_scan_work(struct work_struct *work)
+ goto out_complete;
+ }
+
++ if (test_and_clear_bit(SCAN_BEACON_DONE, &local->scanning) &&
++ local->next_scan_state == SCAN_DECISION)
++ local->next_scan_state = SCAN_SEND_PROBE;
++
+ switch (local->next_scan_state) {
+ case SCAN_DECISION:
+ /* if no more bands/channels left, complete scan */
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 9cc8e92f4b000..ab68076d2cba3 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2167,27 +2167,31 @@ struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
+
+ err = nf_tables_expr_parse(ctx, nla, &info);
+ if (err < 0)
+- goto err1;
++ goto err_expr_parse;
++
++ err = -EOPNOTSUPP;
++ if (!(info.ops->type->flags & NFT_EXPR_STATEFUL))
++ goto err_expr_stateful;
+
+ err = -ENOMEM;
+ expr = kzalloc(info.ops->size, GFP_KERNEL);
+ if (expr == NULL)
+- goto err2;
++ goto err_expr_stateful;
+
+ err = nf_tables_newexpr(ctx, &info, expr);
+ if (err < 0)
+- goto err3;
++ goto err_expr_new;
+
+ return expr;
+-err3:
++err_expr_new:
+ kfree(expr);
+-err2:
++err_expr_stateful:
+ owner = info.ops->type->owner;
+ if (info.ops->type->release_ops)
+ info.ops->type->release_ops(info.ops);
+
+ module_put(owner);
+-err1:
++err_expr_parse:
+ return ERR_PTR(err);
+ }
+
+diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
+index 4e544044fc2de..cc076d535e145 100644
+--- a/net/netfilter/nft_dynset.c
++++ b/net/netfilter/nft_dynset.c
+@@ -193,9 +193,6 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
+ return PTR_ERR(priv->expr);
+
+ err = -EOPNOTSUPP;
+- if (!(priv->expr->ops->type->flags & NFT_EXPR_STATEFUL))
+- goto err1;
+-
+ if (priv->expr->ops->type->flags & NFT_EXPR_GC) {
+ if (set->flags & NFT_SET_TIMEOUT)
+ goto err1;
+diff --git a/net/nfc/core.c b/net/nfc/core.c
+index 54168bbc07cbf..a84f824da051d 100644
+--- a/net/nfc/core.c
++++ b/net/nfc/core.c
+@@ -1171,6 +1171,7 @@ void nfc_unregister_device(struct nfc_dev *dev)
+ if (dev->rfkill) {
+ rfkill_unregister(dev->rfkill);
+ rfkill_destroy(dev->rfkill);
++ dev->rfkill = NULL;
+ }
+ dev->shutting_down = true;
+ device_unlock(&dev->dev);
+diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
+index 468efc3660c03..12f5c18701033 100644
+--- a/net/rxrpc/call_event.c
++++ b/net/rxrpc/call_event.c
+@@ -429,7 +429,8 @@ recheck_state:
+ goto recheck_state;
+ }
+
+- if (test_and_clear_bit(RXRPC_CALL_EV_RESEND, &call->events)) {
++ if (test_and_clear_bit(RXRPC_CALL_EV_RESEND, &call->events) &&
++ call->state != RXRPC_CALL_CLIENT_RECV_REPLY) {
+ rxrpc_resend(call, now);
+ goto recheck_state;
+ }
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index edd76c41765fe..0220a29350023 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -440,6 +440,12 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
+
+ success:
+ ret = copied;
++ if (READ_ONCE(call->state) == RXRPC_CALL_COMPLETE) {
++ read_lock_bh(&call->state_lock);
++ if (call->error < 0)
++ ret = call->error;
++ read_unlock_bh(&call->state_lock);
++ }
+ out:
+ call->tx_pending = skb;
+ _leave(" = %d", ret);
+diff --git a/net/rxrpc/sysctl.c b/net/rxrpc/sysctl.c
+index d75bd15151e6e..50f825f55c21d 100644
+--- a/net/rxrpc/sysctl.c
++++ b/net/rxrpc/sysctl.c
+@@ -17,7 +17,7 @@
+ static struct ctl_table_header *rxrpc_sysctl_reg_table;
+ static const unsigned int one = 1;
+ static const unsigned int four = 4;
+-static const unsigned int thirtytwo = 32;
++static const unsigned int max_backlog = RXRPC_BACKLOG_MAX - 1;
+ static const unsigned int n_65535 = 65535;
+ static const unsigned int n_max_acks = RXRPC_RXTX_BUFF_SIZE - 1;
+ static const unsigned long one_jiffy = 1;
+@@ -111,7 +111,7 @@ static struct ctl_table rxrpc_sysctl_table[] = {
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = (void *)&four,
+- .extra2 = (void *)&thirtytwo,
++ .extra2 = (void *)&max_backlog,
+ },
+ {
+ .procname = "rx_window_size",
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index 64dc2923a21b0..0e2503e536eda 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -104,6 +104,7 @@ int sctp_rcv(struct sk_buff *skb)
+ struct sctp_chunk *chunk;
+ union sctp_addr src;
+ union sctp_addr dest;
++ int bound_dev_if;
+ int family;
+ struct sctp_af *af;
+ struct net *net = dev_net(skb->dev);
+@@ -181,7 +182,8 @@ int sctp_rcv(struct sk_buff *skb)
+ * If a frame arrives on an interface and the receiving socket is
+ * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB
+ */
+- if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif(skb))) {
++ bound_dev_if = READ_ONCE(sk->sk_bound_dev_if);
++ if (bound_dev_if && (bound_dev_if != af->skb_iif(skb))) {
+ if (transport) {
+ sctp_transport_put(transport);
+ asoc = NULL;
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 540e340e2565c..34596d0e4bdeb 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -544,7 +544,11 @@ static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr,
+ */
+ xdr->p = (void *)p + frag2bytes;
+ space_left = xdr->buf->buflen - xdr->buf->len;
+- xdr->end = (void *)p + min_t(int, space_left, PAGE_SIZE);
++ if (space_left - nbytes >= PAGE_SIZE)
++ xdr->end = (void *)p + PAGE_SIZE;
++ else
++ xdr->end = (void *)p + space_left - frag1bytes;
++
+ xdr->buf->page_len += frag2bytes;
+ xdr->buf->len += nbytes;
+ return p;
+diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
+index f2eaf264726be..3d65a2bccfc7b 100644
+--- a/net/sunrpc/xprtrdma/rpc_rdma.c
++++ b/net/sunrpc/xprtrdma/rpc_rdma.c
+@@ -980,6 +980,7 @@ static bool
+ rpcrdma_is_bcall(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep)
+ #if defined(CONFIG_SUNRPC_BACKCHANNEL)
+ {
++ struct rpc_xprt *xprt = &r_xprt->rx_xprt;
+ struct xdr_stream *xdr = &rep->rr_stream;
+ __be32 *p;
+
+@@ -1003,6 +1004,10 @@ rpcrdma_is_bcall(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep)
+ if (*p != cpu_to_be32(RPC_CALL))
+ return false;
+
++ /* No bc service. */
++ if (xprt->bc_serv == NULL)
++ return false;
++
+ /* Now that we are sure this is a backchannel call,
+ * advance to the RPC header.
+ */
+diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
+index e1006ed4d90ab..0f970259d0d5a 100644
+--- a/net/tipc/bearer.c
++++ b/net/tipc/bearer.c
+@@ -246,9 +246,8 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ u32 i;
+
+ if (!bearer_name_validate(name, &b_names)) {
+- errstr = "illegal name";
+ NL_SET_ERR_MSG(extack, "Illegal name");
+- goto rejected;
++ return res;
+ }
+
+ if (prio > TIPC_MAX_LINK_PRI && prio != TIPC_MEDIA_LINK_PRI) {
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 82279dbd2f627..e79c329427964 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -445,7 +445,7 @@ static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other)
+ * -ECONNREFUSED. Otherwise, if we haven't queued any skbs
+ * to other and its full, we will hang waiting for POLLOUT.
+ */
+- if (unix_recvq_full(other) && !sock_flag(other, SOCK_DEAD))
++ if (unix_recvq_full_lockless(other) && !sock_flag(other, SOCK_DEAD))
+ return 1;
+
+ if (connected)
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 2799ff117f5ad..534f57363f4ae 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -2885,6 +2885,7 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flag
+ wdev_lock(wdev);
+ switch (wdev->iftype) {
+ case NL80211_IFTYPE_AP:
++ case NL80211_IFTYPE_P2P_GO:
+ if (wdev->ssid_len &&
+ nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
+ goto nla_put_failure_locked;
+diff --git a/scripts/faddr2line b/scripts/faddr2line
+index a0149db00be75..226c3f559dc5d 100755
+--- a/scripts/faddr2line
++++ b/scripts/faddr2line
+@@ -44,17 +44,6 @@
+ set -o errexit
+ set -o nounset
+
+-READELF="${CROSS_COMPILE:-}readelf"
+-ADDR2LINE="${CROSS_COMPILE:-}addr2line"
+-SIZE="${CROSS_COMPILE:-}size"
+-NM="${CROSS_COMPILE:-}nm"
+-
+-command -v awk >/dev/null 2>&1 || die "awk isn't installed"
+-command -v ${READELF} >/dev/null 2>&1 || die "readelf isn't installed"
+-command -v ${ADDR2LINE} >/dev/null 2>&1 || die "addr2line isn't installed"
+-command -v ${SIZE} >/dev/null 2>&1 || die "size isn't installed"
+-command -v ${NM} >/dev/null 2>&1 || die "nm isn't installed"
+-
+ usage() {
+ echo "usage: faddr2line [--list] <object file> <func+offset> <func+offset>..." >&2
+ exit 1
+@@ -69,6 +58,14 @@ die() {
+ exit 1
+ }
+
++READELF="${CROSS_COMPILE:-}readelf"
++ADDR2LINE="${CROSS_COMPILE:-}addr2line"
++AWK="awk"
++
++command -v ${AWK} >/dev/null 2>&1 || die "${AWK} isn't installed"
++command -v ${READELF} >/dev/null 2>&1 || die "${READELF} isn't installed"
++command -v ${ADDR2LINE} >/dev/null 2>&1 || die "${ADDR2LINE} isn't installed"
++
+ # Try to figure out the source directory prefix so we can remove it from the
+ # addr2line output. HACK ALERT: This assumes that start_kernel() is in
+ # kernel/init.c! This only works for vmlinux. Otherwise it falls back to
+@@ -76,7 +73,7 @@ die() {
+ find_dir_prefix() {
+ local objfile=$1
+
+- local start_kernel_addr=$(${READELF} -sW $objfile | awk '$8 == "start_kernel" {printf "0x%s", $2}')
++ local start_kernel_addr=$(${READELF} --symbols --wide $objfile | ${AWK} '$8 == "start_kernel" {printf "0x%s", $2}')
+ [[ -z $start_kernel_addr ]] && return
+
+ local file_line=$(${ADDR2LINE} -e $objfile $start_kernel_addr)
+@@ -97,86 +94,133 @@ __faddr2line() {
+ local dir_prefix=$3
+ local print_warnings=$4
+
+- local func=${func_addr%+*}
++ local sym_name=${func_addr%+*}
+ local offset=${func_addr#*+}
+ offset=${offset%/*}
+- local size=
+- [[ $func_addr =~ "/" ]] && size=${func_addr#*/}
++ local user_size=
++ [[ $func_addr =~ "/" ]] && user_size=${func_addr#*/}
+
+- if [[ -z $func ]] || [[ -z $offset ]] || [[ $func = $func_addr ]]; then
++ if [[ -z $sym_name ]] || [[ -z $offset ]] || [[ $sym_name = $func_addr ]]; then
+ warn "bad func+offset $func_addr"
+ DONE=1
+ return
+ fi
+
+ # Go through each of the object's symbols which match the func name.
+- # In rare cases there might be duplicates.
+- file_end=$(${SIZE} -Ax $objfile | awk '$1 == ".text" {print $2}')
+- while read symbol; do
+- local fields=($symbol)
+- local sym_base=0x${fields[0]}
+- local sym_type=${fields[1]}
+- local sym_end=${fields[3]}
+-
+- # calculate the size
+- local sym_size=$(($sym_end - $sym_base))
++ # In rare cases there might be duplicates, in which case we print all
++ # matches.
++ while read line; do
++ local fields=($line)
++ local sym_addr=0x${fields[1]}
++ local sym_elf_size=${fields[2]}
++ local sym_sec=${fields[6]}
++
++ # Get the section size:
++ local sec_size=$(${READELF} --section-headers --wide $objfile |
++ sed 's/\[ /\[/' |
++ ${AWK} -v sec=$sym_sec '$1 == "[" sec "]" { print "0x" $6; exit }')
++
++ if [[ -z $sec_size ]]; then
++ warn "bad section size: section: $sym_sec"
++ DONE=1
++ return
++ fi
++
++ # Calculate the symbol size.
++ #
++ # Unfortunately we can't use the ELF size, because kallsyms
++ # also includes the padding bytes in its size calculation. For
++ # kallsyms, the size calculation is the distance between the
++ # symbol and the next symbol in a sorted list.
++ local sym_size
++ local cur_sym_addr
++ local found=0
++ while read line; do
++ local fields=($line)
++ cur_sym_addr=0x${fields[1]}
++ local cur_sym_elf_size=${fields[2]}
++ local cur_sym_name=${fields[7]:-}
++
++ if [[ $cur_sym_addr = $sym_addr ]] &&
++ [[ $cur_sym_elf_size = $sym_elf_size ]] &&
++ [[ $cur_sym_name = $sym_name ]]; then
++ found=1
++ continue
++ fi
++
++ if [[ $found = 1 ]]; then
++ sym_size=$(($cur_sym_addr - $sym_addr))
++ [[ $sym_size -lt $sym_elf_size ]] && continue;
++ found=2
++ break
++ fi
++ done < <(${READELF} --symbols --wide $objfile | ${AWK} -v sec=$sym_sec '$7 == sec' | sort --key=2)
++
++ if [[ $found = 0 ]]; then
++ warn "can't find symbol: sym_name: $sym_name sym_sec: $sym_sec sym_addr: $sym_addr sym_elf_size: $sym_elf_size"
++ DONE=1
++ return
++ fi
++
++ # If nothing was found after the symbol, assume it's the last
++ # symbol in the section.
++ [[ $found = 1 ]] && sym_size=$(($sec_size - $sym_addr))
++
+ if [[ -z $sym_size ]] || [[ $sym_size -le 0 ]]; then
+- warn "bad symbol size: base: $sym_base end: $sym_end"
++ warn "bad symbol size: sym_addr: $sym_addr cur_sym_addr: $cur_sym_addr"
+ DONE=1
+ return
+ fi
++
+ sym_size=0x$(printf %x $sym_size)
+
+- # calculate the address
+- local addr=$(($sym_base + $offset))
++ # Calculate the section address from user-supplied offset:
++ local addr=$(($sym_addr + $offset))
+ if [[ -z $addr ]] || [[ $addr = 0 ]]; then
+- warn "bad address: $sym_base + $offset"
++ warn "bad address: $sym_addr + $offset"
+ DONE=1
+ return
+ fi
+ addr=0x$(printf %x $addr)
+
+- # weed out non-function symbols
+- if [[ $sym_type != t ]] && [[ $sym_type != T ]]; then
+- [[ $print_warnings = 1 ]] &&
+- echo "skipping $func address at $addr due to non-function symbol of type '$sym_type'"
+- continue
+- fi
+-
+- # if the user provided a size, make sure it matches the symbol's size
+- if [[ -n $size ]] && [[ $size -ne $sym_size ]]; then
++ # If the user provided a size, make sure it matches the symbol's size:
++ if [[ -n $user_size ]] && [[ $user_size -ne $sym_size ]]; then
+ [[ $print_warnings = 1 ]] &&
+- echo "skipping $func address at $addr due to size mismatch ($size != $sym_size)"
++ echo "skipping $sym_name address at $addr due to size mismatch ($user_size != $sym_size)"
+ continue;
+ fi
+
+- # make sure the provided offset is within the symbol's range
++ # Make sure the provided offset is within the symbol's range:
+ if [[ $offset -gt $sym_size ]]; then
+ [[ $print_warnings = 1 ]] &&
+- echo "skipping $func address at $addr due to size mismatch ($offset > $sym_size)"
++ echo "skipping $sym_name address at $addr due to size mismatch ($offset > $sym_size)"
+ continue
+ fi
+
+- # separate multiple entries with a blank line
++ # In case of duplicates or multiple addresses specified on the
++ # cmdline, separate multiple entries with a blank line:
+ [[ $FIRST = 0 ]] && echo
+ FIRST=0
+
+- # pass real address to addr2line
+- echo "$func+$offset/$sym_size:"
+- local file_lines=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;")
+- [[ -z $file_lines ]] && return
++ echo "$sym_name+$offset/$sym_size:"
+
++ # Pass section address to addr2line and strip absolute paths
++ # from the output:
++ local output=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;")
++ [[ -z $output ]] && continue
++
++ # Default output (non --list):
+ if [[ $LIST = 0 ]]; then
+- echo "$file_lines" | while read -r line
++ echo "$output" | while read -r line
+ do
+ echo $line
+ done
+ DONE=1;
+- return
++ continue
+ fi
+
+- # show each line with context
+- echo "$file_lines" | while read -r line
++ # For --list, show each line with its corresponding source code:
++ echo "$output" | while read -r line
+ do
+ echo
+ echo $line
+@@ -184,12 +228,12 @@ __faddr2line() {
+ n1=$[$n-5]
+ n2=$[$n+5]
+ f=$(echo $line | sed 's/.*at \(.\+\):.*/\1/g')
+- awk 'NR>=strtonum("'$n1'") && NR<=strtonum("'$n2'") { if (NR=='$n') printf(">%d<", NR); else printf(" %d ", NR); printf("\t%s\n", $0)}' $f
++ ${AWK} 'NR>=strtonum("'$n1'") && NR<=strtonum("'$n2'") { if (NR=='$n') printf(">%d<", NR); else printf(" %d ", NR); printf("\t%s\n", $0)}' $f
+ done
+
+ DONE=1
+
+- done < <(${NM} -n $objfile | awk -v fn=$func -v end=$file_end '$3 == fn { found=1; line=$0; start=$1; next } found == 1 { found=0; print line, "0x"$1 } END {if (found == 1) print line, end; }')
++ done < <(${READELF} --symbols --wide $objfile | ${AWK} -v fn=$sym_name '$4 == "FUNC" && $8 == fn')
+ }
+
+ [[ $# -lt 2 ]] && usage
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 7c693bd775c1b..e294b6cff9fde 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1218,7 +1218,8 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
+
+ static inline int is_arm_mapping_symbol(const char *str)
+ {
+- return str[0] == '$' && strchr("axtd", str[1])
++ return str[0] == '$' &&
++ (str[1] == 'a' || str[1] == 'd' || str[1] == 't' || str[1] == 'x')
+ && (str[2] == '\0' || str[2] == '.');
+ }
+
+@@ -1937,7 +1938,7 @@ static char *remove_dot(char *s)
+
+ if (n && s[n]) {
+ size_t m = strspn(s + n + 1, "0123456789");
+- if (m && (s[n + m] == '.' || s[n + m] == 0))
++ if (m && (s[n + m + 1] == '.' || s[n + m + 1] == 0))
+ s[n] = 0;
+ }
+ return s;
+diff --git a/sound/core/jack.c b/sound/core/jack.c
+index acb531749efb0..074b15fcb0ac4 100644
+--- a/sound/core/jack.c
++++ b/sound/core/jack.c
+@@ -48,8 +48,11 @@ static int snd_jack_dev_disconnect(struct snd_device *device)
+ #ifdef CONFIG_SND_JACK_INPUT_DEV
+ struct snd_jack *jack = device->device_data;
+
+- if (!jack->input_dev)
++ mutex_lock(&jack->input_dev_lock);
++ if (!jack->input_dev) {
++ mutex_unlock(&jack->input_dev_lock);
+ return 0;
++ }
+
+ /* If the input device is registered with the input subsystem
+ * then we need to use a different deallocator. */
+@@ -58,6 +61,7 @@ static int snd_jack_dev_disconnect(struct snd_device *device)
+ else
+ input_free_device(jack->input_dev);
+ jack->input_dev = NULL;
++ mutex_unlock(&jack->input_dev_lock);
+ #endif /* CONFIG_SND_JACK_INPUT_DEV */
+ return 0;
+ }
+@@ -96,8 +100,11 @@ static int snd_jack_dev_register(struct snd_device *device)
+ snprintf(jack->name, sizeof(jack->name), "%s %s",
+ card->shortname, jack->id);
+
+- if (!jack->input_dev)
++ mutex_lock(&jack->input_dev_lock);
++ if (!jack->input_dev) {
++ mutex_unlock(&jack->input_dev_lock);
+ return 0;
++ }
+
+ jack->input_dev->name = jack->name;
+
+@@ -122,6 +129,7 @@ static int snd_jack_dev_register(struct snd_device *device)
+ if (err == 0)
+ jack->registered = 1;
+
++ mutex_unlock(&jack->input_dev_lock);
+ return err;
+ }
+ #endif /* CONFIG_SND_JACK_INPUT_DEV */
+@@ -242,9 +250,11 @@ int snd_jack_new(struct snd_card *card, const char *id, int type,
+ return -ENOMEM;
+ }
+
+- /* don't creat input device for phantom jack */
+- if (!phantom_jack) {
+ #ifdef CONFIG_SND_JACK_INPUT_DEV
++ mutex_init(&jack->input_dev_lock);
++
++ /* don't create input device for phantom jack */
++ if (!phantom_jack) {
+ int i;
+
+ jack->input_dev = input_allocate_device();
+@@ -262,8 +272,8 @@ int snd_jack_new(struct snd_card *card, const char *id, int type,
+ input_set_capability(jack->input_dev, EV_SW,
+ jack_switch_types[i]);
+
+-#endif /* CONFIG_SND_JACK_INPUT_DEV */
+ }
++#endif /* CONFIG_SND_JACK_INPUT_DEV */
+
+ err = snd_device_new(card, SNDRV_DEV_JACK, jack, &ops);
+ if (err < 0)
+@@ -303,10 +313,14 @@ EXPORT_SYMBOL(snd_jack_new);
+ void snd_jack_set_parent(struct snd_jack *jack, struct device *parent)
+ {
+ WARN_ON(jack->registered);
+- if (!jack->input_dev)
++ mutex_lock(&jack->input_dev_lock);
++ if (!jack->input_dev) {
++ mutex_unlock(&jack->input_dev_lock);
+ return;
++ }
+
+ jack->input_dev->dev.parent = parent;
++ mutex_unlock(&jack->input_dev_lock);
+ }
+ EXPORT_SYMBOL(snd_jack_set_parent);
+
+@@ -354,6 +368,8 @@ EXPORT_SYMBOL(snd_jack_set_key);
+
+ /**
+ * snd_jack_report - Report the current status of a jack
++ * Note: This function uses mutexes and should be called from a
++ * context which can sleep (such as a workqueue).
+ *
+ * @jack: The jack to report status for
+ * @status: The current status of the jack
+@@ -373,8 +389,11 @@ void snd_jack_report(struct snd_jack *jack, int status)
+ status & jack_kctl->mask_bits);
+
+ #ifdef CONFIG_SND_JACK_INPUT_DEV
+- if (!jack->input_dev)
++ mutex_lock(&jack->input_dev_lock);
++ if (!jack->input_dev) {
++ mutex_unlock(&jack->input_dev_lock);
+ return;
++ }
+
+ for (i = 0; i < ARRAY_SIZE(jack->key); i++) {
+ int testbit = SND_JACK_BTN_0 >> i;
+@@ -393,6 +412,7 @@ void snd_jack_report(struct snd_jack *jack, int status)
+ }
+
+ input_sync(jack->input_dev);
++ mutex_unlock(&jack->input_dev_lock);
+ #endif /* CONFIG_SND_JACK_INPUT_DEV */
+ }
+ EXPORT_SYMBOL(snd_jack_report);
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 8851cd11dc9ca..629857f5539ce 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1025,6 +1025,13 @@ static int patch_conexant_auto(struct hda_codec *codec)
+ snd_hda_pick_fixup(codec, cxt5051_fixup_models,
+ cxt5051_fixups, cxt_fixups);
+ break;
++ case 0x14f15098:
++ codec->pin_amp_workaround = 1;
++ spec->gen.mixer_nid = 0x22;
++ spec->gen.add_stereo_mix_input = HDA_HINT_STEREO_MIX_AUTO;
++ snd_hda_pick_fixup(codec, cxt5066_fixup_models,
++ cxt5066_fixups, cxt_fixups);
++ break;
+ case 0x14f150f2:
+ codec->power_save_node = 1;
+ /* Fall through */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index a5263453ea64c..ed0b8ec50d714 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1916,6 +1916,7 @@ enum {
+ ALC1220_FIXUP_CLEVO_PB51ED_PINS,
+ ALC887_FIXUP_ASUS_AUDIO,
+ ALC887_FIXUP_ASUS_HMIC,
++ ALCS1200A_FIXUP_MIC_VREF,
+ };
+
+ static void alc889_fixup_coef(struct hda_codec *codec,
+@@ -2461,6 +2462,14 @@ static const struct hda_fixup alc882_fixups[] = {
+ .chained = true,
+ .chain_id = ALC887_FIXUP_ASUS_AUDIO,
+ },
++ [ALCS1200A_FIXUP_MIC_VREF] = {
++ .type = HDA_FIXUP_PINCTLS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x18, PIN_VREF50 }, /* rear mic */
++ { 0x19, PIN_VREF50 }, /* front mic */
++ {}
++ }
++ },
+ };
+
+ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+@@ -2498,6 +2507,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
+ SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
+ SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
++ SND_PCI_QUIRK(0x1043, 0x8797, "ASUS TUF B550M-PLUS", ALCS1200A_FIXUP_MIC_VREF),
+ SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
+ SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
+ SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
+diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
+index 32fe76c3134ab..0ecff512013ed 100644
+--- a/sound/soc/codecs/rt5514.c
++++ b/sound/soc/codecs/rt5514.c
+@@ -422,7 +422,7 @@ static int rt5514_dsp_voice_wake_up_put(struct snd_kcontrol *kcontrol,
+ }
+ }
+
+- return 0;
++ return 1;
+ }
+
+ static const struct snd_kcontrol_new rt5514_snd_controls[] = {
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index 9185bd7c5a6dc..d34000182f679 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -4105,9 +4105,14 @@ static int rt5645_i2c_remove(struct i2c_client *i2c)
+ if (i2c->irq)
+ free_irq(i2c->irq, rt5645);
+
++ /*
++ * Since the rt5645_btn_check_callback() can queue jack_detect_work,
++ * the timer need to be delted first
++ */
++ del_timer_sync(&rt5645->btn_check_timer);
++
+ cancel_delayed_work_sync(&rt5645->jack_detect_work);
+ cancel_delayed_work_sync(&rt5645->rcclock_work);
+- del_timer_sync(&rt5645->btn_check_timer);
+
+ regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies);
+
+diff --git a/sound/soc/codecs/tscs454.c b/sound/soc/codecs/tscs454.c
+index ff85a0bf61702..00a90ccd6566f 100644
+--- a/sound/soc/codecs/tscs454.c
++++ b/sound/soc/codecs/tscs454.c
+@@ -3129,18 +3129,17 @@ static int set_aif_sample_format(struct snd_soc_component *component,
+ unsigned int width;
+ int ret;
+
+- switch (format) {
+- case SNDRV_PCM_FORMAT_S16_LE:
++ switch (snd_pcm_format_width(format)) {
++ case 16:
+ width = FV_WL_16;
+ break;
+- case SNDRV_PCM_FORMAT_S20_3LE:
++ case 20:
+ width = FV_WL_20;
+ break;
+- case SNDRV_PCM_FORMAT_S24_3LE:
++ case 24:
+ width = FV_WL_24;
+ break;
+- case SNDRV_PCM_FORMAT_S24_LE:
+- case SNDRV_PCM_FORMAT_S32_LE:
++ case 32:
+ width = FV_WL_32;
+ break;
+ default:
+@@ -3338,6 +3337,7 @@ static const struct snd_soc_component_driver soc_component_dev_tscs454 = {
+ .num_dapm_routes = ARRAY_SIZE(tscs454_intercon),
+ .controls = tscs454_snd_controls,
+ .num_controls = ARRAY_SIZE(tscs454_snd_controls),
++ .endianness = 1,
+ };
+
+ #define TSCS454_RATES SNDRV_PCM_RATE_8000_96000
+diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
+index c5ae07234a006..cad39f63b7635 100644
+--- a/sound/soc/codecs/wm2000.c
++++ b/sound/soc/codecs/wm2000.c
+@@ -545,7 +545,7 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000,
+ {
+ struct i2c_client *i2c = wm2000->i2c;
+ int i, j;
+- int ret;
++ int ret = 0;
+
+ if (wm2000->anc_mode == mode)
+ return 0;
+@@ -575,13 +575,13 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000,
+ ret = anc_transitions[i].step[j](i2c,
+ anc_transitions[i].analogue);
+ if (ret != 0)
+- return ret;
++ break;
+ }
+
+ if (anc_transitions[i].dest == ANC_OFF)
+ clk_disable_unprepare(wm2000->mclk);
+
+- return 0;
++ return ret;
+ }
+
+ static int wm2000_anc_set_mode(struct wm2000_priv *wm2000)
+diff --git a/sound/soc/mediatek/mt2701/mt2701-wm8960.c b/sound/soc/mediatek/mt2701/mt2701-wm8960.c
+index 89f34efd97472..a5ede216b7950 100644
+--- a/sound/soc/mediatek/mt2701/mt2701-wm8960.c
++++ b/sound/soc/mediatek/mt2701/mt2701-wm8960.c
+@@ -118,7 +118,8 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev)
+ if (!codec_node) {
+ dev_err(&pdev->dev,
+ "Property 'audio-codec' missing or invalid\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_platform_node;
+ }
+ for (i = 0; i < card->num_links; i++) {
+ if (mt2701_wm8960_dai_links[i].codec_name)
+@@ -129,7 +130,7 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev)
+ ret = snd_soc_of_parse_audio_routing(card, "audio-routing");
+ if (ret) {
+ dev_err(&pdev->dev, "failed to parse audio-routing: %d\n", ret);
+- return ret;
++ goto put_codec_node;
+ }
+
+ ret = devm_snd_soc_register_card(&pdev->dev, card);
+@@ -137,6 +138,10 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+ __func__, ret);
+
++put_codec_node:
++ of_node_put(codec_node);
++put_platform_node:
++ of_node_put(platform_node);
+ return ret;
+ }
+
+diff --git a/sound/soc/mediatek/mt8173/mt8173-max98090.c b/sound/soc/mediatek/mt8173/mt8173-max98090.c
+index 431ba3db17594..c9fc719c2af97 100644
+--- a/sound/soc/mediatek/mt8173/mt8173-max98090.c
++++ b/sound/soc/mediatek/mt8173/mt8173-max98090.c
+@@ -156,7 +156,8 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev)
+ if (!codec_node) {
+ dev_err(&pdev->dev,
+ "Property 'audio-codec' missing or invalid\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_platform_node;
+ }
+ for (i = 0; i < card->num_links; i++) {
+ if (mt8173_max98090_dais[i].codec_name)
+@@ -171,6 +172,8 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev)
+ __func__, ret);
+
+ of_node_put(codec_node);
++
++put_platform_node:
+ of_node_put(platform_node);
+ return ret;
+ }
+diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c
+index 93c0196701998..6d0ab4e755187 100644
+--- a/sound/soc/mxs/mxs-saif.c
++++ b/sound/soc/mxs/mxs-saif.c
+@@ -780,6 +780,7 @@ static int mxs_saif_probe(struct platform_device *pdev)
+ saif->master_id = saif->id;
+ } else {
+ ret = of_alias_get_id(master, "saif");
++ of_node_put(master);
+ if (ret < 0)
+ return ret;
+ else
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index af9f28dd957db..4d70e6bc2c128 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3302,7 +3302,6 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol,
+ update.val = val;
+ card->update = &update;
+ }
+- change |= reg_change;
+
+ ret = soc_dapm_mixer_update_power(card, kcontrol, connect,
+ rconnect);
+@@ -3408,7 +3407,6 @@ int snd_soc_dapm_put_enum_double(struct snd_kcontrol *kcontrol,
+ update.val = val;
+ card->update = &update;
+ }
+- change |= reg_change;
+
+ ret = soc_dapm_mux_update_power(card, kcontrol, item[0], e);
+
+diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
+index 2bd39fdc8ab03..f3c142bd1a11a 100644
+--- a/tools/perf/builtin-c2c.c
++++ b/tools/perf/builtin-c2c.c
+@@ -944,8 +944,8 @@ percent_rmt_hitm_cmp(struct perf_hpp_fmt *fmt __maybe_unused,
+ double per_left;
+ double per_right;
+
+- per_left = PERCENT(left, lcl_hitm);
+- per_right = PERCENT(right, lcl_hitm);
++ per_left = PERCENT(left, rmt_hitm);
++ per_right = PERCENT(right, rmt_hitm);
+
+ return per_left - per_right;
+ }
+@@ -2724,9 +2724,7 @@ static int perf_c2c__report(int argc, const char **argv)
+ "the input file to process"),
+ OPT_INCR('N', "node-info", &c2c.node_info,
+ "show extra node info in report (repeat for more info)"),
+-#ifdef HAVE_SLANG_SUPPORT
+ OPT_BOOLEAN(0, "stdio", &c2c.use_stdio, "Use the stdio interface"),
+-#endif
+ OPT_BOOLEAN(0, "stats", &c2c.stats_only,
+ "Display only statistic tables (implies --stdio)"),
+ OPT_BOOLEAN(0, "full-symbols", &c2c.symbol_full,
+@@ -2753,6 +2751,10 @@ static int perf_c2c__report(int argc, const char **argv)
+ if (argc)
+ usage_with_options(report_c2c_usage, options);
+
++#ifndef HAVE_SLANG_SUPPORT
++ c2c.use_stdio = true;
++#endif
++
+ if (c2c.stats_only)
+ c2c.use_stdio = true;
+
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index 31331c42b0e35..0f5a63026d21a 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -563,7 +563,7 @@ int json_events(const char *fn,
+ } else if (json_streq(map, field, "ExtSel")) {
+ char *code = NULL;
+ addfield(map, &code, "", "", val);
+- eventcode |= strtoul(code, NULL, 0) << 21;
++ eventcode |= strtoul(code, NULL, 0) << 8;
+ free(code);
+ } else if (json_streq(map, field, "EventName")) {
+ addfield(map, &name, "", "", val);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-06-16 11:40 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-06-16 11:40 UTC (permalink / raw
To: gentoo-commits
commit: ea1dba116fa00963b2f7355f85cf859fd774f5c9
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 16 11:40:29 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jun 16 11:40:29 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ea1dba11
Linux patch 4.19.248
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1247_linux-4.19.248.patch | 1093 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1097 insertions(+)
diff --git a/0000_README b/0000_README
index 36b8d1ac..e2ee3819 100644
--- a/0000_README
+++ b/0000_README
@@ -1027,6 +1027,10 @@ Patch: 1246_linux-4.19.247.patch
From: https://www.kernel.org
Desc: Linux 4.19.247
+Patch: 1247_linux-4.19.248.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.248
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1247_linux-4.19.248.patch b/1247_linux-4.19.248.patch
new file mode 100644
index 00000000..a7ec0620
--- /dev/null
+++ b/1247_linux-4.19.248.patch
@@ -0,0 +1,1093 @@
+diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
+index b9c14c11efc58..dee993602c313 100644
+--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
++++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
+@@ -481,6 +481,7 @@ What: /sys/devices/system/cpu/vulnerabilities
+ /sys/devices/system/cpu/vulnerabilities/srbds
+ /sys/devices/system/cpu/vulnerabilities/tsx_async_abort
+ /sys/devices/system/cpu/vulnerabilities/itlb_multihit
++ /sys/devices/system/cpu/vulnerabilities/mmio_stale_data
+ Date: January 2018
+ Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>
+ Description: Information about CPU vulnerabilities
+diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst
+index ca4dbdd9016d5..2adec1e6520a6 100644
+--- a/Documentation/admin-guide/hw-vuln/index.rst
++++ b/Documentation/admin-guide/hw-vuln/index.rst
+@@ -15,3 +15,4 @@ are configurable at compile, boot or run time.
+ tsx_async_abort
+ multihit.rst
+ special-register-buffer-data-sampling.rst
++ processor_mmio_stale_data.rst
+diff --git a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst
+new file mode 100644
+index 0000000000000..9393c50b5afc9
+--- /dev/null
++++ b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst
+@@ -0,0 +1,246 @@
++=========================================
++Processor MMIO Stale Data Vulnerabilities
++=========================================
++
++Processor MMIO Stale Data Vulnerabilities are a class of memory-mapped I/O
++(MMIO) vulnerabilities that can expose data. The sequences of operations for
++exposing data range from simple to very complex. Because most of the
++vulnerabilities require the attacker to have access to MMIO, many environments
++are not affected. System environments using virtualization where MMIO access is
++provided to untrusted guests may need mitigation. These vulnerabilities are
++not transient execution attacks. However, these vulnerabilities may propagate
++stale data into core fill buffers where the data can subsequently be inferred
++by an unmitigated transient execution attack. Mitigation for these
++vulnerabilities includes a combination of microcode update and software
++changes, depending on the platform and usage model. Some of these mitigations
++are similar to those used to mitigate Microarchitectural Data Sampling (MDS) or
++those used to mitigate Special Register Buffer Data Sampling (SRBDS).
++
++Data Propagators
++================
++Propagators are operations that result in stale data being copied or moved from
++one microarchitectural buffer or register to another. Processor MMIO Stale Data
++Vulnerabilities are operations that may result in stale data being directly
++read into an architectural, software-visible state or sampled from a buffer or
++register.
++
++Fill Buffer Stale Data Propagator (FBSDP)
++-----------------------------------------
++Stale data may propagate from fill buffers (FB) into the non-coherent portion
++of the uncore on some non-coherent writes. Fill buffer propagation by itself
++does not make stale data architecturally visible. Stale data must be propagated
++to a location where it is subject to reading or sampling.
++
++Sideband Stale Data Propagator (SSDP)
++-------------------------------------
++The sideband stale data propagator (SSDP) is limited to the client (including
++Intel Xeon server E3) uncore implementation. The sideband response buffer is
++shared by all client cores. For non-coherent reads that go to sideband
++destinations, the uncore logic returns 64 bytes of data to the core, including
++both requested data and unrequested stale data, from a transaction buffer and
++the sideband response buffer. As a result, stale data from the sideband
++response and transaction buffers may now reside in a core fill buffer.
++
++Primary Stale Data Propagator (PSDP)
++------------------------------------
++The primary stale data propagator (PSDP) is limited to the client (including
++Intel Xeon server E3) uncore implementation. Similar to the sideband response
++buffer, the primary response buffer is shared by all client cores. For some
++processors, MMIO primary reads will return 64 bytes of data to the core fill
++buffer including both requested data and unrequested stale data. This is
++similar to the sideband stale data propagator.
++
++Vulnerabilities
++===============
++Device Register Partial Write (DRPW) (CVE-2022-21166)
++-----------------------------------------------------
++Some endpoint MMIO registers incorrectly handle writes that are smaller than
++the register size. Instead of aborting the write or only copying the correct
++subset of bytes (for example, 2 bytes for a 2-byte write), more bytes than
++specified by the write transaction may be written to the register. On
++processors affected by FBSDP, this may expose stale data from the fill buffers
++of the core that created the write transaction.
++
++Shared Buffers Data Sampling (SBDS) (CVE-2022-21125)
++----------------------------------------------------
++After propagators may have moved data around the uncore and copied stale data
++into client core fill buffers, processors affected by MFBDS can leak data from
++the fill buffer. It is limited to the client (including Intel Xeon server E3)
++uncore implementation.
++
++Shared Buffers Data Read (SBDR) (CVE-2022-21123)
++------------------------------------------------
++It is similar to Shared Buffer Data Sampling (SBDS) except that the data is
++directly read into the architectural software-visible state. It is limited to
++the client (including Intel Xeon server E3) uncore implementation.
++
++Affected Processors
++===================
++Not all the CPUs are affected by all the variants. For instance, most
++processors for the server market (excluding Intel Xeon E3 processors) are
++impacted by only Device Register Partial Write (DRPW).
++
++Below is the list of affected Intel processors [#f1]_:
++
++ =================== ============ =========
++ Common name Family_Model Steppings
++ =================== ============ =========
++ HASWELL_X 06_3FH 2,4
++ SKYLAKE_L 06_4EH 3
++ BROADWELL_X 06_4FH All
++ SKYLAKE_X 06_55H 3,4,6,7,11
++ BROADWELL_D 06_56H 3,4,5
++ SKYLAKE 06_5EH 3
++ ICELAKE_X 06_6AH 4,5,6
++ ICELAKE_D 06_6CH 1
++ ICELAKE_L 06_7EH 5
++ ATOM_TREMONT_D 06_86H All
++ LAKEFIELD 06_8AH 1
++ KABYLAKE_L 06_8EH 9 to 12
++ ATOM_TREMONT 06_96H 1
++ ATOM_TREMONT_L 06_9CH 0
++ KABYLAKE 06_9EH 9 to 13
++ COMETLAKE 06_A5H 2,3,5
++ COMETLAKE_L 06_A6H 0,1
++ ROCKETLAKE 06_A7H 1
++ =================== ============ =========
++
++If a CPU is in the affected processor list, but not affected by a variant, it
++is indicated by new bits in MSR IA32_ARCH_CAPABILITIES. As described in a later
++section, mitigation largely remains the same for all the variants, i.e. to
++clear the CPU fill buffers via VERW instruction.
++
++New bits in MSRs
++================
++Newer processors and microcode update on existing affected processors added new
++bits to IA32_ARCH_CAPABILITIES MSR. These bits can be used to enumerate
++specific variants of Processor MMIO Stale Data vulnerabilities and mitigation
++capability.
++
++MSR IA32_ARCH_CAPABILITIES
++--------------------------
++Bit 13 - SBDR_SSDP_NO - When set, processor is not affected by either the
++ Shared Buffers Data Read (SBDR) vulnerability or the sideband stale
++ data propagator (SSDP).
++Bit 14 - FBSDP_NO - When set, processor is not affected by the Fill Buffer
++ Stale Data Propagator (FBSDP).
++Bit 15 - PSDP_NO - When set, processor is not affected by Primary Stale Data
++ Propagator (PSDP).
++Bit 17 - FB_CLEAR - When set, VERW instruction will overwrite CPU fill buffer
++ values as part of MD_CLEAR operations. Processors that do not
++ enumerate MDS_NO (meaning they are affected by MDS) but that do
++ enumerate support for both L1D_FLUSH and MD_CLEAR implicitly enumerate
++ FB_CLEAR as part of their MD_CLEAR support.
++Bit 18 - FB_CLEAR_CTRL - Processor supports read and write to MSR
++ IA32_MCU_OPT_CTRL[FB_CLEAR_DIS]. On such processors, the FB_CLEAR_DIS
++ bit can be set to cause the VERW instruction to not perform the
++ FB_CLEAR action. Not all processors that support FB_CLEAR will support
++ FB_CLEAR_CTRL.
++
++MSR IA32_MCU_OPT_CTRL
++---------------------
++Bit 3 - FB_CLEAR_DIS - When set, VERW instruction does not perform the FB_CLEAR
++action. This may be useful to reduce the performance impact of FB_CLEAR in
++cases where system software deems it warranted (for example, when performance
++is more critical, or the untrusted software has no MMIO access). Note that
++FB_CLEAR_DIS has no impact on enumeration (for example, it does not change
++FB_CLEAR or MD_CLEAR enumeration) and it may not be supported on all processors
++that enumerate FB_CLEAR.
++
++Mitigation
++==========
++Like MDS, all variants of Processor MMIO Stale Data vulnerabilities have the
++same mitigation strategy to force the CPU to clear the affected buffers before
++an attacker can extract the secrets.
++
++This is achieved by using the otherwise unused and obsolete VERW instruction in
++combination with a microcode update. The microcode clears the affected CPU
++buffers when the VERW instruction is executed.
++
++Kernel reuses the MDS function to invoke the buffer clearing:
++
++ mds_clear_cpu_buffers()
++
++On MDS affected CPUs, the kernel already invokes CPU buffer clear on
++kernel/userspace, hypervisor/guest and C-state (idle) transitions. No
++additional mitigation is needed on such CPUs.
++
++For CPUs not affected by MDS or TAA, mitigation is needed only for the attacker
++with MMIO capability. Therefore, VERW is not required for kernel/userspace. For
++virtualization case, VERW is only needed at VMENTER for a guest with MMIO
++capability.
++
++Mitigation points
++-----------------
++Return to user space
++^^^^^^^^^^^^^^^^^^^^
++Same mitigation as MDS when affected by MDS/TAA, otherwise no mitigation
++needed.
++
++C-State transition
++^^^^^^^^^^^^^^^^^^
++Control register writes by CPU during C-state transition can propagate data
++from fill buffer to uncore buffers. Execute VERW before C-state transition to
++clear CPU fill buffers.
++
++Guest entry point
++^^^^^^^^^^^^^^^^^
++Same mitigation as MDS when processor is also affected by MDS/TAA, otherwise
++execute VERW at VMENTER only for MMIO capable guests. On CPUs not affected by
++MDS/TAA, guest without MMIO access cannot extract secrets using Processor MMIO
++Stale Data vulnerabilities, so there is no need to execute VERW for such guests.
++
++Mitigation control on the kernel command line
++---------------------------------------------
++The kernel command line allows to control the Processor MMIO Stale Data
++mitigations at boot time with the option "mmio_stale_data=". The valid
++arguments for this option are:
++
++ ========== =================================================================
++ full If the CPU is vulnerable, enable mitigation; CPU buffer clearing
++ on exit to userspace and when entering a VM. Idle transitions are
++ protected as well. It does not automatically disable SMT.
++ full,nosmt Same as full, with SMT disabled on vulnerable CPUs. This is the
++ complete mitigation.
++ off Disables mitigation completely.
++ ========== =================================================================
++
++If the CPU is affected and mmio_stale_data=off is not supplied on the kernel
++command line, then the kernel selects the appropriate mitigation.
++
++Mitigation status information
++-----------------------------
++The Linux kernel provides a sysfs interface to enumerate the current
++vulnerability status of the system: whether the system is vulnerable, and
++which mitigations are active. The relevant sysfs file is:
++
++ /sys/devices/system/cpu/vulnerabilities/mmio_stale_data
++
++The possible values in this file are:
++
++ .. list-table::
++
++ * - 'Not affected'
++ - The processor is not vulnerable
++ * - 'Vulnerable'
++ - The processor is vulnerable, but no mitigation enabled
++ * - 'Vulnerable: Clear CPU buffers attempted, no microcode'
++ - The processor is vulnerable, but microcode is not updated. The
++ mitigation is enabled on a best effort basis.
++ * - 'Mitigation: Clear CPU buffers'
++ - The processor is vulnerable and the CPU buffer clearing mitigation is
++ enabled.
++
++If the processor is vulnerable then the following information is appended to
++the above information:
++
++ ======================== ===========================================
++ 'SMT vulnerable' SMT is enabled
++ 'SMT disabled' SMT is disabled
++ 'SMT Host state unknown' Kernel runs in a VM, Host SMT state unknown
++ ======================== ===========================================
++
++References
++----------
++.. [#f1] Affected Processors
++ https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 5754585d72650..1dea3d23fc4ca 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2574,6 +2574,7 @@
+ kvm.nx_huge_pages=off [X86]
+ no_entry_flush [PPC]
+ no_uaccess_flush [PPC]
++ mmio_stale_data=off [X86]
+
+ Exceptions:
+ This does not have any effect on
+@@ -2595,6 +2596,7 @@
+ Equivalent to: l1tf=flush,nosmt [X86]
+ mds=full,nosmt [X86]
+ tsx_async_abort=full,nosmt [X86]
++ mmio_stale_data=full,nosmt [X86]
+
+ mminit_loglevel=
+ [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this
+@@ -2604,6 +2606,40 @@
+ log everything. Information is printed at KERN_DEBUG
+ so loglevel=8 may also need to be specified.
+
++ mmio_stale_data=
++ [X86,INTEL] Control mitigation for the Processor
++ MMIO Stale Data vulnerabilities.
++
++ Processor MMIO Stale Data is a class of
++ vulnerabilities that may expose data after an MMIO
++ operation. Exposed data could originate or end in
++ the same CPU buffers as affected by MDS and TAA.
++ Therefore, similar to MDS and TAA, the mitigation
++ is to clear the affected CPU buffers.
++
++ This parameter controls the mitigation. The
++ options are:
++
++ full - Enable mitigation on vulnerable CPUs
++
++ full,nosmt - Enable mitigation and disable SMT on
++ vulnerable CPUs.
++
++ off - Unconditionally disable mitigation
++
++ On MDS or TAA affected machines,
++ mmio_stale_data=off can be prevented by an active
++ MDS or TAA mitigation as these vulnerabilities are
++ mitigated with the same mechanism so in order to
++ disable this mitigation, you need to specify
++ mds=off and tsx_async_abort=off too.
++
++ Not specifying this option is equivalent to
++ mmio_stale_data=full.
++
++ For details see:
++ Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst
++
+ module.sig_enforce
+ [KNL] When CONFIG_MODULE_SIG is set, this means that
+ modules without (valid) signatures will fail to load.
+diff --git a/Makefile b/Makefile
+index 2e3b43ce8a944..afb8b46398da6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 247
++SUBLEVEL = 248
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 8910dde943d13..8025b7da04951 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -394,5 +394,6 @@
+ #define X86_BUG_TAA X86_BUG(22) /* CPU is affected by TSX Async Abort(TAA) */
+ #define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
+ #define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */
++#define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */
+
+ #endif /* _ASM_X86_CPUFEATURES_H */
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 2a8e5f78e23c4..db06f16627b0e 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -64,6 +64,14 @@
+ #define INTEL_FAM6_COMETLAKE 0xA5
+ #define INTEL_FAM6_COMETLAKE_L 0xA6
+
++#define INTEL_FAM6_ROCKETLAKE 0xA7
++
++/* Hybrid Core/Atom Processors */
++
++#define INTEL_FAM6_LAKEFIELD 0x8A
++#define INTEL_FAM6_ALDERLAKE 0x97
++#define INTEL_FAM6_ALDERLAKE_L 0x9A
++
+ /* "Small Core" Processors (Atom) */
+
+ #define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */
+@@ -83,7 +91,10 @@
+ #define INTEL_FAM6_ATOM_GOLDMONT 0x5C /* Apollo Lake */
+ #define INTEL_FAM6_ATOM_GOLDMONT_X 0x5F /* Denverton */
+ #define INTEL_FAM6_ATOM_GOLDMONT_PLUS 0x7A /* Gemini Lake */
++
+ #define INTEL_FAM6_ATOM_TREMONT_X 0x86 /* Jacobsville */
++#define INTEL_FAM6_ATOM_TREMONT 0x96 /* Elkhart Lake */
++#define INTEL_FAM6_ATOM_TREMONT_L 0x9C /* Jasper Lake */
+
+ /* Xeon Phi */
+
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 892af8ab95d70..586be095ed081 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -96,6 +96,30 @@
+ * Not susceptible to
+ * TSX Async Abort (TAA) vulnerabilities.
+ */
++#define ARCH_CAP_SBDR_SSDP_NO BIT(13) /*
++ * Not susceptible to SBDR and SSDP
++ * variants of Processor MMIO stale data
++ * vulnerabilities.
++ */
++#define ARCH_CAP_FBSDP_NO BIT(14) /*
++ * Not susceptible to FBSDP variant of
++ * Processor MMIO stale data
++ * vulnerabilities.
++ */
++#define ARCH_CAP_PSDP_NO BIT(15) /*
++ * Not susceptible to PSDP variant of
++ * Processor MMIO stale data
++ * vulnerabilities.
++ */
++#define ARCH_CAP_FB_CLEAR BIT(17) /*
++ * VERW clears CPU fill buffer
++ * even on MDS_NO CPUs.
++ */
++#define ARCH_CAP_FB_CLEAR_CTRL BIT(18) /*
++ * MSR_IA32_MCU_OPT_CTRL[FB_CLEAR_DIS]
++ * bit available to control VERW
++ * behavior.
++ */
+
+ #define MSR_IA32_FLUSH_CMD 0x0000010b
+ #define L1D_FLUSH BIT(0) /*
+@@ -113,6 +137,7 @@
+ /* SRBDS support */
+ #define MSR_IA32_MCU_OPT_CTRL 0x00000123
+ #define RNGDS_MITG_DIS BIT(0)
++#define FB_CLEAR_DIS BIT(3) /* CPU Fill buffer clear disable */
+
+ #define MSR_IA32_SYSENTER_CS 0x00000174
+ #define MSR_IA32_SYSENTER_ESP 0x00000175
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 812976a6d8642..d3d68b6763d4e 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -323,6 +323,8 @@ DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+ DECLARE_STATIC_KEY_FALSE(mds_user_clear);
+ DECLARE_STATIC_KEY_FALSE(mds_idle_clear);
+
++DECLARE_STATIC_KEY_FALSE(mmio_stale_data_clear);
++
+ #include <asm/segment.h>
+
+ /**
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index f7b5f16455075..058e92b932623 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -40,8 +40,10 @@ static void __init spectre_v2_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
+ static void __init mds_select_mitigation(void);
+-static void __init mds_print_mitigation(void);
++static void __init md_clear_update_mitigation(void);
++static void __init md_clear_select_mitigation(void);
+ static void __init taa_select_mitigation(void);
++static void __init mmio_select_mitigation(void);
+ static void __init srbds_select_mitigation(void);
+
+ /* The base value of the SPEC_CTRL MSR that always has to be preserved. */
+@@ -76,6 +78,10 @@ EXPORT_SYMBOL_GPL(mds_user_clear);
+ DEFINE_STATIC_KEY_FALSE(mds_idle_clear);
+ EXPORT_SYMBOL_GPL(mds_idle_clear);
+
++/* Controls CPU Fill buffer clear before KVM guest MMIO accesses */
++DEFINE_STATIC_KEY_FALSE(mmio_stale_data_clear);
++EXPORT_SYMBOL_GPL(mmio_stale_data_clear);
++
+ void __init check_bugs(void)
+ {
+ identify_boot_cpu();
+@@ -108,16 +114,9 @@ void __init check_bugs(void)
+ spectre_v2_select_mitigation();
+ ssb_select_mitigation();
+ l1tf_select_mitigation();
+- mds_select_mitigation();
+- taa_select_mitigation();
++ md_clear_select_mitigation();
+ srbds_select_mitigation();
+
+- /*
+- * As MDS and TAA mitigations are inter-related, print MDS
+- * mitigation until after TAA mitigation selection is done.
+- */
+- mds_print_mitigation();
+-
+ arch_smt_update();
+
+ #ifdef CONFIG_X86_32
+@@ -257,14 +256,6 @@ static void __init mds_select_mitigation(void)
+ }
+ }
+
+-static void __init mds_print_mitigation(void)
+-{
+- if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off())
+- return;
+-
+- pr_info("%s\n", mds_strings[mds_mitigation]);
+-}
+-
+ static int __init mds_cmdline(char *str)
+ {
+ if (!boot_cpu_has_bug(X86_BUG_MDS))
+@@ -312,7 +303,7 @@ static void __init taa_select_mitigation(void)
+ /* TSX previously disabled by tsx=off */
+ if (!boot_cpu_has(X86_FEATURE_RTM)) {
+ taa_mitigation = TAA_MITIGATION_TSX_DISABLED;
+- goto out;
++ return;
+ }
+
+ if (cpu_mitigations_off()) {
+@@ -326,7 +317,7 @@ static void __init taa_select_mitigation(void)
+ */
+ if (taa_mitigation == TAA_MITIGATION_OFF &&
+ mds_mitigation == MDS_MITIGATION_OFF)
+- goto out;
++ return;
+
+ if (boot_cpu_has(X86_FEATURE_MD_CLEAR))
+ taa_mitigation = TAA_MITIGATION_VERW;
+@@ -358,18 +349,6 @@ static void __init taa_select_mitigation(void)
+
+ if (taa_nosmt || cpu_mitigations_auto_nosmt())
+ cpu_smt_disable(false);
+-
+- /*
+- * Update MDS mitigation, if necessary, as the mds_user_clear is
+- * now enabled for TAA mitigation.
+- */
+- if (mds_mitigation == MDS_MITIGATION_OFF &&
+- boot_cpu_has_bug(X86_BUG_MDS)) {
+- mds_mitigation = MDS_MITIGATION_FULL;
+- mds_select_mitigation();
+- }
+-out:
+- pr_info("%s\n", taa_strings[taa_mitigation]);
+ }
+
+ static int __init tsx_async_abort_parse_cmdline(char *str)
+@@ -393,6 +372,151 @@ static int __init tsx_async_abort_parse_cmdline(char *str)
+ }
+ early_param("tsx_async_abort", tsx_async_abort_parse_cmdline);
+
++#undef pr_fmt
++#define pr_fmt(fmt) "MMIO Stale Data: " fmt
++
++enum mmio_mitigations {
++ MMIO_MITIGATION_OFF,
++ MMIO_MITIGATION_UCODE_NEEDED,
++ MMIO_MITIGATION_VERW,
++};
++
++/* Default mitigation for Processor MMIO Stale Data vulnerabilities */
++static enum mmio_mitigations mmio_mitigation __ro_after_init = MMIO_MITIGATION_VERW;
++static bool mmio_nosmt __ro_after_init = false;
++
++static const char * const mmio_strings[] = {
++ [MMIO_MITIGATION_OFF] = "Vulnerable",
++ [MMIO_MITIGATION_UCODE_NEEDED] = "Vulnerable: Clear CPU buffers attempted, no microcode",
++ [MMIO_MITIGATION_VERW] = "Mitigation: Clear CPU buffers",
++};
++
++static void __init mmio_select_mitigation(void)
++{
++ u64 ia32_cap;
++
++ if (!boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA) ||
++ cpu_mitigations_off()) {
++ mmio_mitigation = MMIO_MITIGATION_OFF;
++ return;
++ }
++
++ if (mmio_mitigation == MMIO_MITIGATION_OFF)
++ return;
++
++ ia32_cap = x86_read_arch_cap_msr();
++
++ /*
++ * Enable CPU buffer clear mitigation for host and VMM, if also affected
++ * by MDS or TAA. Otherwise, enable mitigation for VMM only.
++ */
++ if (boot_cpu_has_bug(X86_BUG_MDS) || (boot_cpu_has_bug(X86_BUG_TAA) &&
++ boot_cpu_has(X86_FEATURE_RTM)))
++ static_branch_enable(&mds_user_clear);
++ else
++ static_branch_enable(&mmio_stale_data_clear);
++
++ /*
++ * If Processor-MMIO-Stale-Data bug is present and Fill Buffer data can
++ * be propagated to uncore buffers, clearing the Fill buffers on idle
++ * is required irrespective of SMT state.
++ */
++ if (!(ia32_cap & ARCH_CAP_FBSDP_NO))
++ static_branch_enable(&mds_idle_clear);
++
++ /*
++ * Check if the system has the right microcode.
++ *
++ * CPU Fill buffer clear mitigation is enumerated by either an explicit
++ * FB_CLEAR or by the presence of both MD_CLEAR and L1D_FLUSH on MDS
++ * affected systems.
++ */
++ if ((ia32_cap & ARCH_CAP_FB_CLEAR) ||
++ (boot_cpu_has(X86_FEATURE_MD_CLEAR) &&
++ boot_cpu_has(X86_FEATURE_FLUSH_L1D) &&
++ !(ia32_cap & ARCH_CAP_MDS_NO)))
++ mmio_mitigation = MMIO_MITIGATION_VERW;
++ else
++ mmio_mitigation = MMIO_MITIGATION_UCODE_NEEDED;
++
++ if (mmio_nosmt || cpu_mitigations_auto_nosmt())
++ cpu_smt_disable(false);
++}
++
++static int __init mmio_stale_data_parse_cmdline(char *str)
++{
++ if (!boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA))
++ return 0;
++
++ if (!str)
++ return -EINVAL;
++
++ if (!strcmp(str, "off")) {
++ mmio_mitigation = MMIO_MITIGATION_OFF;
++ } else if (!strcmp(str, "full")) {
++ mmio_mitigation = MMIO_MITIGATION_VERW;
++ } else if (!strcmp(str, "full,nosmt")) {
++ mmio_mitigation = MMIO_MITIGATION_VERW;
++ mmio_nosmt = true;
++ }
++
++ return 0;
++}
++early_param("mmio_stale_data", mmio_stale_data_parse_cmdline);
++
++#undef pr_fmt
++#define pr_fmt(fmt) "" fmt
++
++static void __init md_clear_update_mitigation(void)
++{
++ if (cpu_mitigations_off())
++ return;
++
++ if (!static_key_enabled(&mds_user_clear))
++ goto out;
++
++ /*
++ * mds_user_clear is now enabled. Update MDS, TAA and MMIO Stale Data
++ * mitigation, if necessary.
++ */
++ if (mds_mitigation == MDS_MITIGATION_OFF &&
++ boot_cpu_has_bug(X86_BUG_MDS)) {
++ mds_mitigation = MDS_MITIGATION_FULL;
++ mds_select_mitigation();
++ }
++ if (taa_mitigation == TAA_MITIGATION_OFF &&
++ boot_cpu_has_bug(X86_BUG_TAA)) {
++ taa_mitigation = TAA_MITIGATION_VERW;
++ taa_select_mitigation();
++ }
++ if (mmio_mitigation == MMIO_MITIGATION_OFF &&
++ boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA)) {
++ mmio_mitigation = MMIO_MITIGATION_VERW;
++ mmio_select_mitigation();
++ }
++out:
++ if (boot_cpu_has_bug(X86_BUG_MDS))
++ pr_info("MDS: %s\n", mds_strings[mds_mitigation]);
++ if (boot_cpu_has_bug(X86_BUG_TAA))
++ pr_info("TAA: %s\n", taa_strings[taa_mitigation]);
++ if (boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA))
++ pr_info("MMIO Stale Data: %s\n", mmio_strings[mmio_mitigation]);
++}
++
++static void __init md_clear_select_mitigation(void)
++{
++ mds_select_mitigation();
++ taa_select_mitigation();
++ mmio_select_mitigation();
++
++ /*
++ * As MDS, TAA and MMIO Stale Data mitigations are inter-related, update
++ * and print their mitigation after MDS, TAA and MMIO Stale Data
++ * mitigation selection is done.
++ */
++ md_clear_update_mitigation();
++}
++
+ #undef pr_fmt
+ #define pr_fmt(fmt) "SRBDS: " fmt
+
+@@ -454,11 +578,13 @@ static void __init srbds_select_mitigation(void)
+ return;
+
+ /*
+- * Check to see if this is one of the MDS_NO systems supporting
+- * TSX that are only exposed to SRBDS when TSX is enabled.
++ * Check to see if this is one of the MDS_NO systems supporting TSX that
++ * are only exposed to SRBDS when TSX is enabled or when CPU is affected
++ * by Processor MMIO Stale Data vulnerability.
+ */
+ ia32_cap = x86_read_arch_cap_msr();
+- if ((ia32_cap & ARCH_CAP_MDS_NO) && !boot_cpu_has(X86_FEATURE_RTM))
++ if ((ia32_cap & ARCH_CAP_MDS_NO) && !boot_cpu_has(X86_FEATURE_RTM) &&
++ !boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA))
+ srbds_mitigation = SRBDS_MITIGATION_TSX_OFF;
+ else if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
+ srbds_mitigation = SRBDS_MITIGATION_HYPERVISOR;
+@@ -1066,6 +1192,8 @@ static void update_indir_branch_cond(void)
+ /* Update the static key controlling the MDS CPU buffer clear in idle */
+ static void update_mds_branch_idle(void)
+ {
++ u64 ia32_cap = x86_read_arch_cap_msr();
++
+ /*
+ * Enable the idle clearing if SMT is active on CPUs which are
+ * affected only by MSBDS and not any other MDS variant.
+@@ -1077,14 +1205,17 @@ static void update_mds_branch_idle(void)
+ if (!boot_cpu_has_bug(X86_BUG_MSBDS_ONLY))
+ return;
+
+- if (sched_smt_active())
++ if (sched_smt_active()) {
+ static_branch_enable(&mds_idle_clear);
+- else
++ } else if (mmio_mitigation == MMIO_MITIGATION_OFF ||
++ (ia32_cap & ARCH_CAP_FBSDP_NO)) {
+ static_branch_disable(&mds_idle_clear);
++ }
+ }
+
+ #define MDS_MSG_SMT "MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.\n"
+ #define TAA_MSG_SMT "TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.\n"
++#define MMIO_MSG_SMT "MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.\n"
+
+ void arch_smt_update(void)
+ {
+@@ -1129,6 +1260,16 @@ void arch_smt_update(void)
+ break;
+ }
+
++ switch (mmio_mitigation) {
++ case MMIO_MITIGATION_VERW:
++ case MMIO_MITIGATION_UCODE_NEEDED:
++ if (sched_smt_active())
++ pr_warn_once(MMIO_MSG_SMT);
++ break;
++ case MMIO_MITIGATION_OFF:
++ break;
++ }
++
+ mutex_unlock(&spec_ctrl_mutex);
+ }
+
+@@ -1680,6 +1821,20 @@ static ssize_t tsx_async_abort_show_state(char *buf)
+ sched_smt_active() ? "vulnerable" : "disabled");
+ }
+
++static ssize_t mmio_stale_data_show_state(char *buf)
++{
++ if (mmio_mitigation == MMIO_MITIGATION_OFF)
++ return sysfs_emit(buf, "%s\n", mmio_strings[mmio_mitigation]);
++
++ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
++ return sysfs_emit(buf, "%s; SMT Host state unknown\n",
++ mmio_strings[mmio_mitigation]);
++ }
++
++ return sysfs_emit(buf, "%s; SMT %s\n", mmio_strings[mmio_mitigation],
++ sched_smt_active() ? "vulnerable" : "disabled");
++}
++
+ static char *stibp_state(void)
+ {
+ if (spectre_v2_in_eibrs_mode(spectre_v2_enabled))
+@@ -1780,6 +1935,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ case X86_BUG_SRBDS:
+ return srbds_show_state(buf);
+
++ case X86_BUG_MMIO_STALE_DATA:
++ return mmio_stale_data_show_state(buf);
++
+ default:
+ break;
+ }
+@@ -1831,4 +1989,9 @@ ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, char *
+ {
+ return cpu_show_common(dev, attr, buf, X86_BUG_SRBDS);
+ }
++
++ssize_t cpu_show_mmio_stale_data(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA);
++}
+ #endif
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 7e7400af77978..389d11b2c70e2 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1019,18 +1019,42 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+ X86_FEATURE_ANY, issues)
+
+ #define SRBDS BIT(0)
++/* CPU is affected by X86_BUG_MMIO_STALE_DATA */
++#define MMIO BIT(1)
++/* CPU is affected by Shared Buffers Data Sampling (SBDS), a variant of X86_BUG_MMIO_STALE_DATA */
++#define MMIO_SBDS BIT(2)
+
+ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
+ VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS),
+ VULNBL_INTEL_STEPPINGS(HASWELL_CORE, X86_STEPPING_ANY, SRBDS),
+ VULNBL_INTEL_STEPPINGS(HASWELL_ULT, X86_STEPPING_ANY, SRBDS),
+ VULNBL_INTEL_STEPPINGS(HASWELL_GT3E, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(HASWELL_X, BIT(2) | BIT(4), MMIO),
++ VULNBL_INTEL_STEPPINGS(BROADWELL_XEON_D,X86_STEPPINGS(0x3, 0x5), MMIO),
+ VULNBL_INTEL_STEPPINGS(BROADWELL_GT3E, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO),
+ VULNBL_INTEL_STEPPINGS(BROADWELL_CORE, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO),
+ VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS),
++ VULNBL_INTEL_STEPPINGS(SKYLAKE_X, BIT(3) | BIT(4) | BIT(6) |
++ BIT(7) | BIT(0xB), MMIO),
++ VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO),
+ VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP, X86_STEPPING_ANY, SRBDS),
+- VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPINGS(0x0, 0xC), SRBDS),
+- VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x0, 0xD), SRBDS),
++ VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPINGS(0x9, 0xC), SRBDS | MMIO),
++ VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPINGS(0x0, 0x8), SRBDS),
++ VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x9, 0xD), SRBDS | MMIO),
++ VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x0, 0x8), SRBDS),
++ VULNBL_INTEL_STEPPINGS(ICELAKE_MOBILE, X86_STEPPINGS(0x5, 0x5), MMIO | MMIO_SBDS),
++ VULNBL_INTEL_STEPPINGS(ICELAKE_XEON_D, X86_STEPPINGS(0x1, 0x1), MMIO),
++ VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPINGS(0x4, 0x6), MMIO),
++ VULNBL_INTEL_STEPPINGS(COMETLAKE, BIT(2) | BIT(3) | BIT(5), MMIO | MMIO_SBDS),
++ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
++ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x0), MMIO),
++ VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
++ VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPINGS(0x1, 0x1), MMIO),
++ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
++ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_X, X86_STEPPING_ANY, MMIO),
++ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPINGS(0x0, 0x0), MMIO | MMIO_SBDS),
+ {}
+ };
+
+@@ -1051,6 +1075,13 @@ u64 x86_read_arch_cap_msr(void)
+ return ia32_cap;
+ }
+
++static bool arch_cap_mmio_immune(u64 ia32_cap)
++{
++ return (ia32_cap & ARCH_CAP_FBSDP_NO &&
++ ia32_cap & ARCH_CAP_PSDP_NO &&
++ ia32_cap & ARCH_CAP_SBDR_SSDP_NO);
++}
++
+ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ {
+ u64 ia32_cap = x86_read_arch_cap_msr();
+@@ -1102,12 +1133,27 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ /*
+ * SRBDS affects CPUs which support RDRAND or RDSEED and are listed
+ * in the vulnerability blacklist.
++ *
++ * Some of the implications and mitigation of Shared Buffers Data
++ * Sampling (SBDS) are similar to SRBDS. Give SBDS same treatment as
++ * SRBDS.
+ */
+ if ((cpu_has(c, X86_FEATURE_RDRAND) ||
+ cpu_has(c, X86_FEATURE_RDSEED)) &&
+- cpu_matches(cpu_vuln_blacklist, SRBDS))
++ cpu_matches(cpu_vuln_blacklist, SRBDS | MMIO_SBDS))
+ setup_force_cpu_bug(X86_BUG_SRBDS);
+
++ /*
++ * Processor MMIO Stale Data bug enumeration
++ *
++ * Affected CPU list is generally enough to enumerate the vulnerability,
++ * but for virtualization case check for ARCH_CAP MSR bits also, VMM may
++ * not want the guest to enumerate the bug.
++ */
++ if (cpu_matches(cpu_vuln_blacklist, MMIO) &&
++ !arch_cap_mmio_immune(ia32_cap))
++ setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);
++
+ if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
+ return;
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 77b9ed5223f37..44cce3e8eb18b 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -212,6 +212,9 @@ static const struct {
+ #define L1D_CACHE_ORDER 4
+ static void *vmx_l1d_flush_pages;
+
++/* Control for disabling CPU Fill buffer clear */
++static bool __read_mostly vmx_fb_clear_ctrl_available;
++
+ static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf)
+ {
+ struct page *page;
+@@ -1045,6 +1048,8 @@ struct vcpu_vmx {
+ u64 msr_ia32_feature_control;
+ u64 msr_ia32_feature_control_valid_bits;
+ u64 ept_pointer;
++ u64 msr_ia32_mcu_opt_ctrl;
++ bool disable_fb_clear;
+ };
+
+ enum segment_cache_field {
+@@ -2107,6 +2112,60 @@ static inline void __invept(unsigned long ext, u64 eptp, gpa_t gpa)
+ BUG_ON(error);
+ }
+
++static void vmx_setup_fb_clear_ctrl(void)
++{
++ u64 msr;
++
++ if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES) &&
++ !boot_cpu_has_bug(X86_BUG_MDS) &&
++ !boot_cpu_has_bug(X86_BUG_TAA)) {
++ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, msr);
++ if (msr & ARCH_CAP_FB_CLEAR_CTRL)
++ vmx_fb_clear_ctrl_available = true;
++ }
++}
++
++static __always_inline void vmx_disable_fb_clear(struct vcpu_vmx *vmx)
++{
++ u64 msr;
++
++ if (!vmx->disable_fb_clear)
++ return;
++
++ rdmsrl(MSR_IA32_MCU_OPT_CTRL, msr);
++ msr |= FB_CLEAR_DIS;
++ wrmsrl(MSR_IA32_MCU_OPT_CTRL, msr);
++ /* Cache the MSR value to avoid reading it later */
++ vmx->msr_ia32_mcu_opt_ctrl = msr;
++}
++
++static __always_inline void vmx_enable_fb_clear(struct vcpu_vmx *vmx)
++{
++ if (!vmx->disable_fb_clear)
++ return;
++
++ vmx->msr_ia32_mcu_opt_ctrl &= ~FB_CLEAR_DIS;
++ wrmsrl(MSR_IA32_MCU_OPT_CTRL, vmx->msr_ia32_mcu_opt_ctrl);
++}
++
++static void vmx_update_fb_clear_dis(struct kvm_vcpu *vcpu, struct vcpu_vmx *vmx)
++{
++ vmx->disable_fb_clear = vmx_fb_clear_ctrl_available;
++
++ /*
++ * If guest will not execute VERW, there is no need to set FB_CLEAR_DIS
++ * at VMEntry. Skip the MSR read/write when a guest has no use case to
++ * execute VERW.
++ */
++ if ((vcpu->arch.arch_capabilities & ARCH_CAP_FB_CLEAR) ||
++ ((vcpu->arch.arch_capabilities & ARCH_CAP_MDS_NO) &&
++ (vcpu->arch.arch_capabilities & ARCH_CAP_TAA_NO) &&
++ (vcpu->arch.arch_capabilities & ARCH_CAP_PSDP_NO) &&
++ (vcpu->arch.arch_capabilities & ARCH_CAP_FBSDP_NO) &&
++ (vcpu->arch.arch_capabilities & ARCH_CAP_SBDR_SSDP_NO)))
++ vmx->disable_fb_clear = false;
++}
++
+ static struct shared_msr_entry *find_msr_entry(struct vcpu_vmx *vmx, u32 msr)
+ {
+ int i;
+@@ -4314,9 +4373,13 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ }
+ break;
+ }
+- ret = kvm_set_msr_common(vcpu, msr_info);
++ ret = kvm_set_msr_common(vcpu, msr_info);
+ }
+
++ /* FB_CLEAR may have changed, also update the FB_CLEAR_DIS behavior */
++ if (msr_index == MSR_IA32_ARCH_CAPABILITIES)
++ vmx_update_fb_clear_dis(vcpu, vmx);
++
+ return ret;
+ }
+
+@@ -6761,6 +6824,8 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
+ vpid_sync_context(vmx->vpid);
+ if (init_event)
+ vmx_clear_hlt(vcpu);
++
++ vmx_update_fb_clear_dis(vcpu, vmx);
+ }
+
+ /*
+@@ -10773,6 +10838,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ vmx_l1d_flush(vcpu);
+ else if (static_branch_unlikely(&mds_user_clear))
+ mds_clear_cpu_buffers();
++ else if (static_branch_unlikely(&mmio_stale_data_clear) &&
++ kvm_arch_has_assigned_device(vcpu->kvm))
++ mds_clear_cpu_buffers();
++
++ vmx_disable_fb_clear(vmx);
+
+ asm volatile (
+ /* Store host registers */
+@@ -10918,6 +10988,8 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ #endif
+ );
+
++ vmx_enable_fb_clear(vmx);
++
+ /*
+ * We do not use IBRS in the kernel. If this vCPU has used the
+ * SPEC_CTRL MSR it may have left it on; save the value and
+@@ -14623,8 +14695,11 @@ static int __init vmx_init(void)
+ }
+ }
+
++ vmx_setup_fb_clear_ctrl();
++
+ for_each_possible_cpu(cpu) {
+ INIT_LIST_HEAD(&per_cpu(loaded_vmcss_on_cpu, cpu));
++
+ INIT_LIST_HEAD(&per_cpu(blocked_vcpu_on_cpu, cpu));
+ spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+ }
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 417abc9ba1ad4..be4697d91bb24 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1220,6 +1220,10 @@ u64 kvm_get_arch_capabilities(void)
+
+ /* KVM does not emulate MSR_IA32_TSX_CTRL. */
+ data &= ~ARCH_CAP_TSX_CTRL_MSR;
++
++ /* Guests don't need to know "Fill buffer clear control" exists */
++ data &= ~ARCH_CAP_FB_CLEAR_CTRL;
++
+ return data;
+ }
+
+diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
+index 1df0574861768..cd204be1f4b7d 100644
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -571,6 +571,12 @@ ssize_t __weak cpu_show_srbds(struct device *dev,
+ return sprintf(buf, "Not affected\n");
+ }
+
++ssize_t __weak cpu_show_mmio_stale_data(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ return sysfs_emit(buf, "Not affected\n");
++}
++
+ static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
+ static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
+ static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
+@@ -580,6 +586,7 @@ static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL);
+ static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL);
+ static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL);
+ static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL);
++static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL);
+
+ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_meltdown.attr,
+@@ -591,6 +598,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_tsx_async_abort.attr,
+ &dev_attr_itlb_multihit.attr,
+ &dev_attr_srbds.attr,
++ &dev_attr_mmio_stale_data.attr,
+ NULL
+ };
+
+diff --git a/include/linux/cpu.h b/include/linux/cpu.h
+index aab4273810e37..8cc06e1d4fc24 100644
+--- a/include/linux/cpu.h
++++ b/include/linux/cpu.h
+@@ -64,6 +64,10 @@ extern ssize_t cpu_show_tsx_async_abort(struct device *dev,
+ char *buf);
+ extern ssize_t cpu_show_itlb_multihit(struct device *dev,
+ struct device_attribute *attr, char *buf);
++extern ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, char *buf);
++extern ssize_t cpu_show_mmio_stale_data(struct device *dev,
++ struct device_attribute *attr,
++ char *buf);
+
+ extern __printf(4, 5)
+ struct device *cpu_device_create(struct device *parent, void *drvdata,
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-06-25 10:22 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-06-25 10:22 UTC (permalink / raw
To: gentoo-commits
commit: 05804623611103d533e73623346a4c790451607a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Jun 25 10:22:22 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Jun 25 10:22:22 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=05804623
Linux patch 4.19.249
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1248_linux-4.19.249.patch | 7929 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 7933 insertions(+)
diff --git a/0000_README b/0000_README
index e2ee3819..de0e7128 100644
--- a/0000_README
+++ b/0000_README
@@ -1031,6 +1031,10 @@ Patch: 1247_linux-4.19.248.patch
From: https://www.kernel.org
Desc: Linux 4.19.248
+Patch: 1248_linux-4.19.249.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.249
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1248_linux-4.19.249.patch b/1248_linux-4.19.249.patch
new file mode 100644
index 00000000..d2d01e98
--- /dev/null
+++ b/1248_linux-4.19.249.patch
@@ -0,0 +1,7929 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 1dea3d23fc4ca..500032af01927 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -3697,6 +3697,12 @@
+ fully seed the kernel's CRNG. Default is controlled
+ by CONFIG_RANDOM_TRUST_CPU.
+
++ random.trust_bootloader={on,off}
++ [KNL] Enable or disable trusting the use of a
++ seed passed by the bootloader (if available) to
++ fully seed the kernel's CRNG. Default is controlled
++ by CONFIG_RANDOM_TRUST_BOOTLOADER.
++
+ ras=option[,option,...] [KNL] RAS-specific options
+
+ cec_disable [X86]
+diff --git a/Documentation/hwmon/hwmon-kernel-api.txt b/Documentation/hwmon/hwmon-kernel-api.txt
+index 4981df157b04a..eb7a78aebb380 100644
+--- a/Documentation/hwmon/hwmon-kernel-api.txt
++++ b/Documentation/hwmon/hwmon-kernel-api.txt
+@@ -71,7 +71,7 @@ hwmon_device_register_with_info is the most comprehensive and preferred means
+ to register a hardware monitoring device. It creates the standard sysfs
+ attributes in the hardware monitoring core, letting the driver focus on reading
+ from and writing to the chip instead of having to bother with sysfs attributes.
+-The parent device parameter as well as the chip parameter must not be NULL. Its
++The parent device parameter cannot be NULL with non-NULL chip info. Its
+ parameters are described in more detail below.
+
+ devm_hwmon_device_register_with_info is similar to
+diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
+index 8bd3b01539593..db1676525ca35 100644
+--- a/Documentation/sysctl/kernel.txt
++++ b/Documentation/sysctl/kernel.txt
+@@ -821,9 +821,40 @@ The kernel command line parameter printk.devkmsg= overrides this and is
+ a one-time setting until next reboot: once set, it cannot be changed by
+ this sysctl interface anymore.
+
+-==============================================================
++pty
++===
++
++See Documentation/filesystems/devpts.rst.
++
++
++random
++======
++
++This is a directory, with the following entries:
++
++* ``boot_id``: a UUID generated the first time this is retrieved, and
++ unvarying after that;
++
++* ``uuid``: a UUID generated every time this is retrieved (this can
++ thus be used to generate UUIDs at will);
++
++* ``entropy_avail``: the pool's entropy count, in bits;
++
++* ``poolsize``: the entropy pool size, in bits;
++
++* ``urandom_min_reseed_secs``: obsolete (used to determine the minimum
++ number of seconds between urandom pool reseeding). This file is
++ writable for compatibility purposes, but writing to it has no effect
++ on any RNG behavior;
++
++* ``write_wakeup_threshold``: when the entropy count drops below this
++ (as a number of bits), processes waiting to write to ``/dev/random``
++ are woken up. This file is writable for compatibility purposes, but
++ writing to it has no effect on any RNG behavior.
++
+
+-randomize_va_space:
++randomize_va_space
++==================
+
+ This option can be used to select the type of process address
+ space randomization that is used in the system, for architectures
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 1061db6fbc326..af0f322cf2f7c 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -12239,6 +12239,7 @@ F: arch/mips/configs/generic/board-ranchu.config
+
+ RANDOM NUMBER DRIVER
+ M: "Theodore Ts'o" <tytso@mit.edu>
++M: Jason A. Donenfeld <Jason@zx2c4.com>
+ S: Maintained
+ F: drivers/char/random.c
+
+diff --git a/Makefile b/Makefile
+index afb8b46398da6..14ba089d5b016 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 248
++SUBLEVEL = 249
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/include/asm/timex.h b/arch/alpha/include/asm/timex.h
+index b565cc6f408e9..f89798da8a147 100644
+--- a/arch/alpha/include/asm/timex.h
++++ b/arch/alpha/include/asm/timex.h
+@@ -28,5 +28,6 @@ static inline cycles_t get_cycles (void)
+ __asm__ __volatile__ ("rpcc %0" : "=r"(ret));
+ return ret;
+ }
++#define get_cycles get_cycles
+
+ #endif
+diff --git a/arch/arm/include/asm/timex.h b/arch/arm/include/asm/timex.h
+index f6fcc67ef06ef..c06d38f0df8ec 100644
+--- a/arch/arm/include/asm/timex.h
++++ b/arch/arm/include/asm/timex.h
+@@ -14,5 +14,6 @@
+
+ typedef unsigned long cycles_t;
+ #define get_cycles() ({ cycles_t c; read_current_timer(&c) ? 0 : c; })
++#define random_get_entropy() (((unsigned long)get_cycles()) ?: random_get_entropy_fallback())
+
+ #endif
+diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c
+index b6618391be8c6..4254d7808def1 100644
+--- a/arch/arm64/kernel/ftrace.c
++++ b/arch/arm64/kernel/ftrace.c
+@@ -72,7 +72,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+ {
+ unsigned long pc = rec->ip;
+ u32 old, new;
+- long offset = (long)pc - (long)addr;
++ long offset = (long)addr - (long)pc;
+
+ if (offset < -SZ_128M || offset >= SZ_128M) {
+ #ifdef CONFIG_ARM64_MODULE_PLTS
+@@ -151,7 +151,7 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
+ unsigned long pc = rec->ip;
+ bool validate = true;
+ u32 old = 0, new;
+- long offset = (long)pc - (long)addr;
++ long offset = (long)addr - (long)pc;
+
+ if (offset < -SZ_128M || offset >= SZ_128M) {
+ #ifdef CONFIG_ARM64_MODULE_PLTS
+diff --git a/arch/ia64/include/asm/timex.h b/arch/ia64/include/asm/timex.h
+index 869a3ac6bf23a..7ccc077a60bed 100644
+--- a/arch/ia64/include/asm/timex.h
++++ b/arch/ia64/include/asm/timex.h
+@@ -39,6 +39,7 @@ get_cycles (void)
+ ret = ia64_getreg(_IA64_REG_AR_ITC);
+ return ret;
+ }
++#define get_cycles get_cycles
+
+ extern void ia64_cpu_local_tick (void);
+ extern unsigned long long ia64_native_sched_clock (void);
+diff --git a/arch/m68k/include/asm/timex.h b/arch/m68k/include/asm/timex.h
+index 6a21d93582805..f4a7a340f4cae 100644
+--- a/arch/m68k/include/asm/timex.h
++++ b/arch/m68k/include/asm/timex.h
+@@ -35,7 +35,7 @@ static inline unsigned long random_get_entropy(void)
+ {
+ if (mach_random_get_entropy)
+ return mach_random_get_entropy();
+- return 0;
++ return random_get_entropy_fallback();
+ }
+ #define random_get_entropy random_get_entropy
+
+diff --git a/arch/mips/include/asm/timex.h b/arch/mips/include/asm/timex.h
+index 8026baf46e729..2e107886f97ac 100644
+--- a/arch/mips/include/asm/timex.h
++++ b/arch/mips/include/asm/timex.h
+@@ -76,25 +76,24 @@ static inline cycles_t get_cycles(void)
+ else
+ return 0; /* no usable counter */
+ }
++#define get_cycles get_cycles
+
+ /*
+ * Like get_cycles - but where c0_count is not available we desperately
+ * use c0_random in an attempt to get at least a little bit of entropy.
+- *
+- * R6000 and R6000A neither have a count register nor a random register.
+- * That leaves no entropy source in the CPU itself.
+ */
+ static inline unsigned long random_get_entropy(void)
+ {
+- unsigned int prid = read_c0_prid();
+- unsigned int imp = prid & PRID_IMP_MASK;
++ unsigned int c0_random;
+
+- if (can_use_mips_counter(prid))
++ if (can_use_mips_counter(read_c0_prid()))
+ return read_c0_count();
+- else if (likely(imp != PRID_IMP_R6000 && imp != PRID_IMP_R6000A))
+- return read_c0_random();
++
++ if (cpu_has_3kex)
++ c0_random = (read_c0_random() >> 8) & 0x3f;
+ else
+- return 0; /* no usable register */
++ c0_random = read_c0_random() & 0x3f;
++ return (random_get_entropy_fallback() << 6) | (0x3f - c0_random);
+ }
+ #define random_get_entropy random_get_entropy
+
+diff --git a/arch/nios2/include/asm/timex.h b/arch/nios2/include/asm/timex.h
+index 2f2abb28ec2fd..9c9b50599ea30 100644
+--- a/arch/nios2/include/asm/timex.h
++++ b/arch/nios2/include/asm/timex.h
+@@ -20,5 +20,8 @@
+ typedef unsigned long cycles_t;
+
+ extern cycles_t get_cycles(void);
++#define get_cycles get_cycles
++
++#define random_get_entropy() (((unsigned long)get_cycles()) ?: random_get_entropy_fallback())
+
+ #endif
+diff --git a/arch/parisc/include/asm/timex.h b/arch/parisc/include/asm/timex.h
+index 45537cd4d1d39..1cd2bd3eef33b 100644
+--- a/arch/parisc/include/asm/timex.h
++++ b/arch/parisc/include/asm/timex.h
+@@ -12,9 +12,10 @@
+
+ typedef unsigned long cycles_t;
+
+-static inline cycles_t get_cycles (void)
++static inline cycles_t get_cycles(void)
+ {
+ return mfctl(16);
+ }
++#define get_cycles get_cycles
+
+ #endif
+diff --git a/arch/powerpc/include/asm/archrandom.h b/arch/powerpc/include/asm/archrandom.h
+index a09595f00cabe..f0f16b4fc5ea1 100644
+--- a/arch/powerpc/include/asm/archrandom.h
++++ b/arch/powerpc/include/asm/archrandom.h
+@@ -6,27 +6,28 @@
+
+ #include <asm/machdep.h>
+
+-static inline int arch_get_random_long(unsigned long *v)
++static inline bool arch_get_random_long(unsigned long *v)
+ {
+- return 0;
++ return false;
+ }
+
+-static inline int arch_get_random_int(unsigned int *v)
++static inline bool arch_get_random_int(unsigned int *v)
+ {
+- return 0;
++ return false;
+ }
+
+-static inline int arch_get_random_seed_long(unsigned long *v)
++static inline bool arch_get_random_seed_long(unsigned long *v)
+ {
+ if (ppc_md.get_random_seed)
+ return ppc_md.get_random_seed(v);
+
+- return 0;
++ return false;
+ }
+-static inline int arch_get_random_seed_int(unsigned int *v)
++
++static inline bool arch_get_random_seed_int(unsigned int *v)
+ {
+ unsigned long val;
+- int rc;
++ bool rc;
+
+ rc = arch_get_random_seed_long(&val);
+ if (rc)
+@@ -34,16 +35,6 @@ static inline int arch_get_random_seed_int(unsigned int *v)
+
+ return rc;
+ }
+-
+-static inline int arch_has_random(void)
+-{
+- return 0;
+-}
+-
+-static inline int arch_has_random_seed(void)
+-{
+- return !!ppc_md.get_random_seed;
+-}
+ #endif /* CONFIG_ARCH_RANDOM */
+
+ #ifdef CONFIG_PPC_POWERNV
+diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
+index d9d5391b2af6f..d0d3dab56225f 100644
+--- a/arch/powerpc/include/asm/ppc-opcode.h
++++ b/arch/powerpc/include/asm/ppc-opcode.h
+@@ -207,6 +207,7 @@
+ #define PPC_INST_ICBT 0x7c00002c
+ #define PPC_INST_ICSWX 0x7c00032d
+ #define PPC_INST_ICSWEPX 0x7c00076d
++#define PPC_INST_DSSALL 0x7e00066c
+ #define PPC_INST_ISEL 0x7c00001e
+ #define PPC_INST_ISEL_MASK 0xfc00003e
+ #define PPC_INST_LDARX 0x7c0000a8
+@@ -424,6 +425,7 @@
+ __PPC_RA(a) | __PPC_RB(b))
+ #define PPC_DCBZL(a, b) stringify_in_c(.long PPC_INST_DCBZL | \
+ __PPC_RA(a) | __PPC_RB(b))
++#define PPC_DSSALL stringify_in_c(.long PPC_INST_DSSALL)
+ #define PPC_LQARX(t, a, b, eh) stringify_in_c(.long PPC_INST_LQARX | \
+ ___PPC_RT(t) | ___PPC_RA(a) | \
+ ___PPC_RB(b) | __PPC_EH(eh))
+diff --git a/arch/powerpc/include/asm/timex.h b/arch/powerpc/include/asm/timex.h
+index 926b9f91a3ef2..7401d6a684c55 100644
+--- a/arch/powerpc/include/asm/timex.h
++++ b/arch/powerpc/include/asm/timex.h
+@@ -50,6 +50,7 @@ static inline cycles_t get_cycles(void)
+ return ret;
+ #endif
+ }
++#define get_cycles get_cycles
+
+ #endif /* __KERNEL__ */
+ #endif /* _ASM_POWERPC_TIMEX_H */
+diff --git a/arch/powerpc/kernel/idle_6xx.S b/arch/powerpc/kernel/idle_6xx.S
+index ff026c9d3cab4..75de66acc3d1b 100644
+--- a/arch/powerpc/kernel/idle_6xx.S
++++ b/arch/powerpc/kernel/idle_6xx.S
+@@ -133,7 +133,7 @@ BEGIN_FTR_SECTION
+ END_FTR_SECTION_IFCLR(CPU_FTR_NO_DPM)
+ mtspr SPRN_HID0,r4
+ BEGIN_FTR_SECTION
+- DSSALL
++ PPC_DSSALL
+ sync
+ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
+ CURRENT_THREAD_INFO(r9, r1)
+diff --git a/arch/powerpc/kernel/l2cr_6xx.S b/arch/powerpc/kernel/l2cr_6xx.S
+index 6e7dbb7d527c8..9d4b42d115cdd 100644
+--- a/arch/powerpc/kernel/l2cr_6xx.S
++++ b/arch/powerpc/kernel/l2cr_6xx.S
+@@ -108,7 +108,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_L2CR)
+
+ /* Stop DST streams */
+ BEGIN_FTR_SECTION
+- DSSALL
++ PPC_DSSALL
+ sync
+ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
+
+@@ -305,7 +305,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_L3CR)
+ isync
+
+ /* Stop DST streams */
+- DSSALL
++ PPC_DSSALL
+ sync
+
+ /* Get the current enable bit of the L3CR into r4 */
+@@ -414,7 +414,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_L3CR)
+ _GLOBAL(__flush_disable_L1)
+ /* Stop pending alitvec streams and memory accesses */
+ BEGIN_FTR_SECTION
+- DSSALL
++ PPC_DSSALL
+ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
+ sync
+
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 02b69a68139cc..56c33285b1dfd 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -2017,12 +2017,12 @@ unsigned long get_wchan(struct task_struct *p)
+ return 0;
+
+ do {
+- sp = *(unsigned long *)sp;
++ sp = READ_ONCE_NOCHECK(*(unsigned long *)sp);
+ if (!validate_sp(sp, p, STACK_FRAME_OVERHEAD) ||
+ p->state == TASK_RUNNING)
+ return 0;
+ if (count > 0) {
+- ip = ((unsigned long *)sp)[STACK_FRAME_LR_SAVE];
++ ip = READ_ONCE_NOCHECK(((unsigned long *)sp)[STACK_FRAME_LR_SAVE]);
+ if (!in_sched_functions(ip))
+ return ip;
+ }
+diff --git a/arch/powerpc/kernel/swsusp_32.S b/arch/powerpc/kernel/swsusp_32.S
+index cbdf86228eaaa..54c44aea338c4 100644
+--- a/arch/powerpc/kernel/swsusp_32.S
++++ b/arch/powerpc/kernel/swsusp_32.S
+@@ -181,7 +181,7 @@ _GLOBAL(swsusp_arch_resume)
+ #ifdef CONFIG_ALTIVEC
+ /* Stop pending alitvec streams and memory accesses */
+ BEGIN_FTR_SECTION
+- DSSALL
++ PPC_DSSALL
+ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
+ #endif
+ sync
+diff --git a/arch/powerpc/kernel/swsusp_asm64.S b/arch/powerpc/kernel/swsusp_asm64.S
+index f83bf6f72cb0e..0af06f3dbb25a 100644
+--- a/arch/powerpc/kernel/swsusp_asm64.S
++++ b/arch/powerpc/kernel/swsusp_asm64.S
+@@ -143,7 +143,7 @@ END_FW_FTR_SECTION_IFCLR(FW_FEATURE_LPAR)
+ _GLOBAL(swsusp_arch_resume)
+ /* Stop pending alitvec streams and memory accesses */
+ BEGIN_FTR_SECTION
+- DSSALL
++ PPC_DSSALL
+ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
+ sync
+
+diff --git a/arch/powerpc/mm/mmu_context.c b/arch/powerpc/mm/mmu_context.c
+index f84e14f23e50a..78a638ccc70fc 100644
+--- a/arch/powerpc/mm/mmu_context.c
++++ b/arch/powerpc/mm/mmu_context.c
+@@ -83,7 +83,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+ * context
+ */
+ if (cpu_has_feature(CPU_FTR_ALTIVEC))
+- asm volatile ("dssall");
++ asm volatile (PPC_DSSALL);
+
+ if (new_on_cpu)
+ radix_kvm_prefetch_workaround(next);
+diff --git a/arch/powerpc/platforms/powermac/cache.S b/arch/powerpc/platforms/powermac/cache.S
+index 27862feee4a57..0dde4a7a60166 100644
+--- a/arch/powerpc/platforms/powermac/cache.S
++++ b/arch/powerpc/platforms/powermac/cache.S
+@@ -53,7 +53,7 @@ flush_disable_75x:
+
+ /* Stop DST streams */
+ BEGIN_FTR_SECTION
+- DSSALL
++ PPC_DSSALL
+ sync
+ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
+
+@@ -201,7 +201,7 @@ flush_disable_745x:
+ isync
+
+ /* Stop prefetch streams */
+- DSSALL
++ PPC_DSSALL
+ sync
+
+ /* Disable L2 prefetching */
+diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h
+index c23578a37b443..fdcc34b4f65bc 100644
+--- a/arch/riscv/include/asm/processor.h
++++ b/arch/riscv/include/asm/processor.h
+@@ -30,6 +30,8 @@
+
+ #ifndef __ASSEMBLY__
+
++#include <asm/barrier.h>
++
+ struct task_struct;
+ struct pt_regs;
+
+diff --git a/arch/s390/include/asm/archrandom.h b/arch/s390/include/asm/archrandom.h
+index c67b82dfa558e..9a6835137a164 100644
+--- a/arch/s390/include/asm/archrandom.h
++++ b/arch/s390/include/asm/archrandom.h
+@@ -21,18 +21,6 @@ extern atomic64_t s390_arch_random_counter;
+
+ bool s390_arch_random_generate(u8 *buf, unsigned int nbytes);
+
+-static inline bool arch_has_random(void)
+-{
+- return false;
+-}
+-
+-static inline bool arch_has_random_seed(void)
+-{
+- if (static_branch_likely(&s390_arch_random_available))
+- return true;
+- return false;
+-}
+-
+ static inline bool arch_get_random_long(unsigned long *v)
+ {
+ return false;
+diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
+index b6a4ce9dafafb..99a7e028232d8 100644
+--- a/arch/s390/include/asm/timex.h
++++ b/arch/s390/include/asm/timex.h
+@@ -177,6 +177,7 @@ static inline cycles_t get_cycles(void)
+ {
+ return (cycles_t) get_tod_clock() >> 2;
+ }
++#define get_cycles get_cycles
+
+ int get_phys_clock(unsigned long *clock);
+ void init_cpu_timer(void);
+diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
+index 4354ac6077503..9f39030898694 100644
+--- a/arch/s390/mm/pgtable.c
++++ b/arch/s390/mm/pgtable.c
+@@ -716,7 +716,7 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ pgste_val(pgste) |= PGSTE_GR_BIT | PGSTE_GC_BIT;
+ ptev = pte_val(*ptep);
+ if (!(ptev & _PAGE_INVALID) && (ptev & _PAGE_WRITE))
+- page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 1);
++ page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 0);
+ pgste_set_unlock(ptep, pgste);
+ preempt_enable();
+ }
+diff --git a/arch/sparc/include/asm/timex_32.h b/arch/sparc/include/asm/timex_32.h
+index 542915b462097..f86326a6f89e0 100644
+--- a/arch/sparc/include/asm/timex_32.h
++++ b/arch/sparc/include/asm/timex_32.h
+@@ -9,8 +9,6 @@
+
+ #define CLOCK_TICK_RATE 1193180 /* Underlying HZ */
+
+-/* XXX Maybe do something better at some point... -DaveM */
+-typedef unsigned long cycles_t;
+-#define get_cycles() (0)
++#include <asm-generic/timex.h>
+
+ #endif
+diff --git a/arch/um/include/asm/timex.h b/arch/um/include/asm/timex.h
+index e392a9a5bc9bd..9f27176adb26d 100644
+--- a/arch/um/include/asm/timex.h
++++ b/arch/um/include/asm/timex.h
+@@ -2,13 +2,8 @@
+ #ifndef __UM_TIMEX_H
+ #define __UM_TIMEX_H
+
+-typedef unsigned long cycles_t;
+-
+-static inline cycles_t get_cycles (void)
+-{
+- return 0;
+-}
+-
+ #define CLOCK_TICK_RATE (HZ)
+
++#include <asm-generic/timex.h>
++
+ #endif
+diff --git a/arch/x86/include/asm/archrandom.h b/arch/x86/include/asm/archrandom.h
+index 3ac991d81e74d..4d3cac3c9b250 100644
+--- a/arch/x86/include/asm/archrandom.h
++++ b/arch/x86/include/asm/archrandom.h
+@@ -86,10 +86,6 @@ static inline bool rdseed_int(unsigned int *v)
+ return ok;
+ }
+
+-/* Conditional execution based on CPU type */
+-#define arch_has_random() static_cpu_has(X86_FEATURE_RDRAND)
+-#define arch_has_random_seed() static_cpu_has(X86_FEATURE_RDSEED)
+-
+ /*
+ * These are the generic interfaces; they must not be declared if the
+ * stubs in <linux/random.h> are to be invoked,
+@@ -99,22 +95,22 @@ static inline bool rdseed_int(unsigned int *v)
+
+ static inline bool arch_get_random_long(unsigned long *v)
+ {
+- return arch_has_random() ? rdrand_long(v) : false;
++ return static_cpu_has(X86_FEATURE_RDRAND) ? rdrand_long(v) : false;
+ }
+
+ static inline bool arch_get_random_int(unsigned int *v)
+ {
+- return arch_has_random() ? rdrand_int(v) : false;
++ return static_cpu_has(X86_FEATURE_RDRAND) ? rdrand_int(v) : false;
+ }
+
+ static inline bool arch_get_random_seed_long(unsigned long *v)
+ {
+- return arch_has_random_seed() ? rdseed_long(v) : false;
++ return static_cpu_has(X86_FEATURE_RDSEED) ? rdseed_long(v) : false;
+ }
+
+ static inline bool arch_get_random_seed_int(unsigned int *v)
+ {
+- return arch_has_random_seed() ? rdseed_int(v) : false;
++ return static_cpu_has(X86_FEATURE_RDSEED) ? rdseed_int(v) : false;
+ }
+
+ extern void x86_init_rdrand(struct cpuinfo_x86 *c);
+diff --git a/arch/x86/include/asm/timex.h b/arch/x86/include/asm/timex.h
+index a4a8b1b16c0c1..956e4145311b1 100644
+--- a/arch/x86/include/asm/timex.h
++++ b/arch/x86/include/asm/timex.h
+@@ -5,6 +5,15 @@
+ #include <asm/processor.h>
+ #include <asm/tsc.h>
+
++static inline unsigned long random_get_entropy(void)
++{
++ if (!IS_ENABLED(CONFIG_X86_TSC) &&
++ !cpu_feature_enabled(X86_FEATURE_TSC))
++ return random_get_entropy_fallback();
++ return rdtsc();
++}
++#define random_get_entropy random_get_entropy
++
+ /* Assume we use the PIT time source for the clock tick */
+ #define CLOCK_TICK_RATE PIT_TICK_RATE
+
+diff --git a/arch/x86/include/asm/tsc.h b/arch/x86/include/asm/tsc.h
+index eb5bbfeccb661..196cf01f58fdf 100644
+--- a/arch/x86/include/asm/tsc.h
++++ b/arch/x86/include/asm/tsc.h
+@@ -22,13 +22,12 @@ extern void disable_TSC(void);
+
+ static inline cycles_t get_cycles(void)
+ {
+-#ifndef CONFIG_X86_TSC
+- if (!boot_cpu_has(X86_FEATURE_TSC))
++ if (!IS_ENABLED(CONFIG_X86_TSC) &&
++ !cpu_feature_enabled(X86_FEATURE_TSC))
+ return 0;
+-#endif
+-
+ return rdtsc();
+ }
++#define get_cycles get_cycles
+
+ extern struct system_counterval_t convert_art_to_tsc(u64 art);
+ extern struct system_counterval_t convert_art_ns_to_tsc(u64 art_ns);
+diff --git a/arch/xtensa/include/asm/timex.h b/arch/xtensa/include/asm/timex.h
+index f9b389d4e9739..d866bc847d8dc 100644
+--- a/arch/xtensa/include/asm/timex.h
++++ b/arch/xtensa/include/asm/timex.h
+@@ -30,10 +30,6 @@
+
+ extern unsigned long ccount_freq;
+
+-typedef unsigned long long cycles_t;
+-
+-#define get_cycles() (0)
+-
+ void local_timer_setup(unsigned cpu);
+
+ /*
+@@ -69,4 +65,6 @@ static inline void set_linux_timer (unsigned long ccompare)
+ WSR_CCOMPARE(LINUX_TIMER, ccompare);
+ }
+
++#include <asm-generic/timex.h>
++
+ #endif /* _XTENSA_TIMEX_H */
+diff --git a/certs/blacklist_hashes.c b/certs/blacklist_hashes.c
+index 344892337be07..d5961aa3d3380 100644
+--- a/certs/blacklist_hashes.c
++++ b/certs/blacklist_hashes.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include "blacklist.h"
+
+-const char __initdata *const blacklist_hashes[] = {
++const char __initconst *const blacklist_hashes[] = {
+ #include CONFIG_SYSTEM_BLACKLIST_HASH_LIST
+ , NULL
+ };
+diff --git a/crypto/drbg.c b/crypto/drbg.c
+index bc52d95626110..c8c56763dfded 100644
+--- a/crypto/drbg.c
++++ b/crypto/drbg.c
+@@ -219,6 +219,57 @@ static inline unsigned short drbg_sec_strength(drbg_flag_t flags)
+ }
+ }
+
++/*
++ * FIPS 140-2 continuous self test for the noise source
++ * The test is performed on the noise source input data. Thus, the function
++ * implicitly knows the size of the buffer to be equal to the security
++ * strength.
++ *
++ * Note, this function disregards the nonce trailing the entropy data during
++ * initial seeding.
++ *
++ * drbg->drbg_mutex must have been taken.
++ *
++ * @drbg DRBG handle
++ * @entropy buffer of seed data to be checked
++ *
++ * return:
++ * 0 on success
++ * -EAGAIN on when the CTRNG is not yet primed
++ * < 0 on error
++ */
++static int drbg_fips_continuous_test(struct drbg_state *drbg,
++ const unsigned char *entropy)
++{
++ unsigned short entropylen = drbg_sec_strength(drbg->core->flags);
++ int ret = 0;
++
++ if (!IS_ENABLED(CONFIG_CRYPTO_FIPS))
++ return 0;
++
++ /* skip test if we test the overall system */
++ if (list_empty(&drbg->test_data.list))
++ return 0;
++ /* only perform test in FIPS mode */
++ if (!fips_enabled)
++ return 0;
++
++ if (!drbg->fips_primed) {
++ /* Priming of FIPS test */
++ memcpy(drbg->prev, entropy, entropylen);
++ drbg->fips_primed = true;
++ /* priming: another round is needed */
++ return -EAGAIN;
++ }
++ ret = memcmp(drbg->prev, entropy, entropylen);
++ if (!ret)
++ panic("DRBG continuous self test failed\n");
++ memcpy(drbg->prev, entropy, entropylen);
++
++ /* the test shall pass when the two values are not equal */
++ return 0;
++}
++
+ /*
+ * Convert an integer into a byte representation of this integer.
+ * The byte representation is big-endian
+@@ -984,55 +1035,79 @@ static const struct drbg_state_ops drbg_hash_ops = {
+ ******************************************************************/
+
+ static inline int __drbg_seed(struct drbg_state *drbg, struct list_head *seed,
+- int reseed)
++ int reseed, enum drbg_seed_state new_seed_state)
+ {
+ int ret = drbg->d_ops->update(drbg, seed, reseed);
+
+ if (ret)
+ return ret;
+
+- drbg->seeded = true;
++ drbg->seeded = new_seed_state;
+ /* 10.1.1.2 / 10.1.1.3 step 5 */
+ drbg->reseed_ctr = 1;
+
++ switch (drbg->seeded) {
++ case DRBG_SEED_STATE_UNSEEDED:
++ /* Impossible, but handle it to silence compiler warnings. */
++ case DRBG_SEED_STATE_PARTIAL:
++ /*
++ * Require frequent reseeds until the seed source is
++ * fully initialized.
++ */
++ drbg->reseed_threshold = 50;
++ break;
++
++ case DRBG_SEED_STATE_FULL:
++ /*
++ * Seed source has become fully initialized, frequent
++ * reseeds no longer required.
++ */
++ drbg->reseed_threshold = drbg_max_requests(drbg);
++ break;
++ }
++
+ return ret;
+ }
+
+-static void drbg_async_seed(struct work_struct *work)
++static inline int drbg_get_random_bytes(struct drbg_state *drbg,
++ unsigned char *entropy,
++ unsigned int entropylen)
++{
++ int ret;
++
++ do {
++ get_random_bytes(entropy, entropylen);
++ ret = drbg_fips_continuous_test(drbg, entropy);
++ if (ret && ret != -EAGAIN)
++ return ret;
++ } while (ret);
++
++ return 0;
++}
++
++static int drbg_seed_from_random(struct drbg_state *drbg)
+ {
+ struct drbg_string data;
+ LIST_HEAD(seedlist);
+- struct drbg_state *drbg = container_of(work, struct drbg_state,
+- seed_work);
+ unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
+ unsigned char entropy[32];
++ int ret;
+
+ BUG_ON(!entropylen);
+ BUG_ON(entropylen > sizeof(entropy));
+- get_random_bytes(entropy, entropylen);
+
+ drbg_string_fill(&data, entropy, entropylen);
+ list_add_tail(&data.list, &seedlist);
+
+- mutex_lock(&drbg->drbg_mutex);
+-
+- /* If nonblocking pool is initialized, deactivate Jitter RNG */
+- crypto_free_rng(drbg->jent);
+- drbg->jent = NULL;
+-
+- /* Set seeded to false so that if __drbg_seed fails the
+- * next generate call will trigger a reseed.
+- */
+- drbg->seeded = false;
+-
+- __drbg_seed(drbg, &seedlist, true);
+-
+- if (drbg->seeded)
+- drbg->reseed_threshold = drbg_max_requests(drbg);
++ ret = drbg_get_random_bytes(drbg, entropy, entropylen);
++ if (ret)
++ goto out;
+
+- mutex_unlock(&drbg->drbg_mutex);
++ ret = __drbg_seed(drbg, &seedlist, true, DRBG_SEED_STATE_FULL);
+
++out:
+ memzero_explicit(entropy, entropylen);
++ return ret;
+ }
+
+ /*
+@@ -1054,6 +1129,7 @@ static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
+ unsigned int entropylen = drbg_sec_strength(drbg->core->flags);
+ struct drbg_string data1;
+ LIST_HEAD(seedlist);
++ enum drbg_seed_state new_seed_state = DRBG_SEED_STATE_FULL;
+
+ /* 9.1 / 9.2 / 9.3.1 step 3 */
+ if (pers && pers->len > (drbg_max_addtl(drbg))) {
+@@ -1081,7 +1157,12 @@ static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
+ BUG_ON((entropylen * 2) > sizeof(entropy));
+
+ /* Get seed from in-kernel /dev/urandom */
+- get_random_bytes(entropy, entropylen);
++ if (!rng_is_initialized())
++ new_seed_state = DRBG_SEED_STATE_PARTIAL;
++
++ ret = drbg_get_random_bytes(drbg, entropy, entropylen);
++ if (ret)
++ goto out;
+
+ if (!drbg->jent) {
+ drbg_string_fill(&data1, entropy, entropylen);
+@@ -1094,7 +1175,23 @@ static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
+ entropylen);
+ if (ret) {
+ pr_devel("DRBG: jent failed with %d\n", ret);
+- return ret;
++
++ /*
++ * Do not treat the transient failure of the
++ * Jitter RNG as an error that needs to be
++ * reported. The combined number of the
++ * maximum reseed threshold times the maximum
++ * number of Jitter RNG transient errors is
++ * less than the reseed threshold required by
++ * SP800-90A allowing us to treat the
++ * transient errors as such.
++ *
++ * However, we mandate that at least the first
++ * seeding operation must succeed with the
++ * Jitter RNG.
++ */
++ if (!reseed || ret != -EAGAIN)
++ goto out;
+ }
+
+ drbg_string_fill(&data1, entropy, entropylen * 2);
+@@ -1119,8 +1216,9 @@ static int drbg_seed(struct drbg_state *drbg, struct drbg_string *pers,
+ memset(drbg->C, 0, drbg_statelen(drbg));
+ }
+
+- ret = __drbg_seed(drbg, &seedlist, reseed);
++ ret = __drbg_seed(drbg, &seedlist, reseed, new_seed_state);
+
++out:
+ memzero_explicit(entropy, entropylen * 2);
+
+ return ret;
+@@ -1142,6 +1240,11 @@ static inline void drbg_dealloc_state(struct drbg_state *drbg)
+ drbg->reseed_ctr = 0;
+ drbg->d_ops = NULL;
+ drbg->core = NULL;
++ if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
++ kzfree(drbg->prev);
++ drbg->prev = NULL;
++ drbg->fips_primed = false;
++ }
+ }
+
+ /*
+@@ -1211,6 +1314,14 @@ static inline int drbg_alloc_state(struct drbg_state *drbg)
+ drbg->scratchpad = PTR_ALIGN(drbg->scratchpadbuf, ret + 1);
+ }
+
++ if (IS_ENABLED(CONFIG_CRYPTO_FIPS)) {
++ drbg->prev = kzalloc(drbg_sec_strength(drbg->core->flags),
++ GFP_KERNEL);
++ if (!drbg->prev)
++ goto fini;
++ drbg->fips_primed = false;
++ }
++
+ return 0;
+
+ fini:
+@@ -1283,19 +1394,25 @@ static int drbg_generate(struct drbg_state *drbg,
+ * here. The spec is a bit convoluted here, we make it simpler.
+ */
+ if (drbg->reseed_threshold < drbg->reseed_ctr)
+- drbg->seeded = false;
++ drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
+
+- if (drbg->pr || !drbg->seeded) {
++ if (drbg->pr || drbg->seeded == DRBG_SEED_STATE_UNSEEDED) {
+ pr_devel("DRBG: reseeding before generation (prediction "
+ "resistance: %s, state %s)\n",
+ drbg->pr ? "true" : "false",
+- drbg->seeded ? "seeded" : "unseeded");
++ (drbg->seeded == DRBG_SEED_STATE_FULL ?
++ "seeded" : "unseeded"));
+ /* 9.3.1 steps 7.1 through 7.3 */
+ len = drbg_seed(drbg, addtl, true);
+ if (len)
+ goto err;
+ /* 9.3.1 step 7.4 */
+ addtl = NULL;
++ } else if (rng_is_initialized() &&
++ drbg->seeded == DRBG_SEED_STATE_PARTIAL) {
++ len = drbg_seed_from_random(drbg);
++ if (len)
++ goto err;
+ }
+
+ if (addtl && 0 < addtl->len)
+@@ -1388,51 +1505,15 @@ static int drbg_generate_long(struct drbg_state *drbg,
+ return 0;
+ }
+
+-static void drbg_schedule_async_seed(struct random_ready_callback *rdy)
+-{
+- struct drbg_state *drbg = container_of(rdy, struct drbg_state,
+- random_ready);
+-
+- schedule_work(&drbg->seed_work);
+-}
+-
+ static int drbg_prepare_hrng(struct drbg_state *drbg)
+ {
+- int err;
+-
+ /* We do not need an HRNG in test mode. */
+ if (list_empty(&drbg->test_data.list))
+ return 0;
+
+- INIT_WORK(&drbg->seed_work, drbg_async_seed);
+-
+- drbg->random_ready.owner = THIS_MODULE;
+- drbg->random_ready.func = drbg_schedule_async_seed;
+-
+- err = add_random_ready_callback(&drbg->random_ready);
+-
+- switch (err) {
+- case 0:
+- break;
+-
+- case -EALREADY:
+- err = 0;
+- /* fall through */
+-
+- default:
+- drbg->random_ready.func = NULL;
+- return err;
+- }
+-
+ drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
+
+- /*
+- * Require frequent reseeds until the seed source is fully
+- * initialized.
+- */
+- drbg->reseed_threshold = 50;
+-
+- return err;
++ return 0;
+ }
+
+ /*
+@@ -1475,7 +1556,7 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
+ if (!drbg->core) {
+ drbg->core = &drbg_cores[coreref];
+ drbg->pr = pr;
+- drbg->seeded = false;
++ drbg->seeded = DRBG_SEED_STATE_UNSEEDED;
+ drbg->reseed_threshold = drbg_max_requests(drbg);
+
+ ret = drbg_alloc_state(drbg);
+@@ -1526,12 +1607,9 @@ free_everything:
+ */
+ static int drbg_uninstantiate(struct drbg_state *drbg)
+ {
+- if (drbg->random_ready.func) {
+- del_random_ready_callback(&drbg->random_ready);
+- cancel_work_sync(&drbg->seed_work);
++ if (!IS_ERR_OR_NULL(drbg->jent))
+ crypto_free_rng(drbg->jent);
+- drbg->jent = NULL;
+- }
++ drbg->jent = NULL;
+
+ if (drbg->d_ops)
+ drbg->d_ops->crypto_fini(drbg);
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 0c10d95577542..b0dea0702c748 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6253,7 +6253,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev,
+ const struct ata_port_info * const * ppi,
+ int n_ports)
+ {
+- const struct ata_port_info *pi;
++ const struct ata_port_info *pi = &ata_dummy_port_info;
+ struct ata_host *host;
+ int i, j;
+
+@@ -6261,7 +6261,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev,
+ if (!host)
+ return NULL;
+
+- for (i = 0, j = 0, pi = NULL; i < host->n_ports; i++) {
++ for (i = 0, j = 0; i < host->n_ports; i++) {
+ struct ata_port *ap = host->ports[i];
+
+ if (ppi[j])
+diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
+index 1df9cb8e659e2..f55c9bbd58fba 100644
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -552,19 +552,41 @@ config ADI
+ and SSM (Silicon Secured Memory). Intended consumers of this
+ driver include crash and makedumpfile.
+
+-endmenu
+-
+ config RANDOM_TRUST_CPU
+- bool "Trust the CPU manufacturer to initialize Linux's CRNG"
+- depends on X86 || S390 || PPC
+- default n
++ bool "Initialize RNG using CPU RNG instructions"
++ default y
++ depends on ARCH_RANDOM
+ help
+- Assume that CPU manufacturer (e.g., Intel or AMD for RDSEED or
+- RDRAND, IBM for the S390 and Power PC architectures) is trustworthy
+- for the purposes of initializing Linux's CRNG. Since this is not
+- something that can be independently audited, this amounts to trusting
+- that CPU manufacturer (perhaps with the insistence or mandate
+- of a Nation State's intelligence or law enforcement agencies)
+- has not installed a hidden back door to compromise the CPU's
+- random number generation facilities. This can also be configured
+- at boot with "random.trust_cpu=on/off".
++ Initialize the RNG using random numbers supplied by the CPU's
++ RNG instructions (e.g. RDRAND), if supported and available. These
++ random numbers are never used directly, but are rather hashed into
++ the main input pool, and this happens regardless of whether or not
++ this option is enabled. Instead, this option controls whether the
++ they are credited and hence can initialize the RNG. Additionally,
++ other sources of randomness are always used, regardless of this
++ setting. Enabling this implies trusting that the CPU can supply high
++ quality and non-backdoored random numbers.
++
++ Say Y here unless you have reason to mistrust your CPU or believe
++ its RNG facilities may be faulty. This may also be configured at
++ boot time with "random.trust_cpu=on/off".
++
++config RANDOM_TRUST_BOOTLOADER
++ bool "Initialize RNG using bootloader-supplied seed"
++ default y
++ help
++ Initialize the RNG using a seed supplied by the bootloader or boot
++ environment (e.g. EFI or a bootloader-generated device tree). This
++ seed is not used directly, but is rather hashed into the main input
++ pool, and this happens regardless of whether or not this option is
++ enabled. Instead, this option controls whether the seed is credited
++ and hence can initialize the RNG. Additionally, other sources of
++ randomness are always used, regardless of this setting. Enabling
++ this implies trusting that the bootloader can supply high quality and
++ non-backdoored seeds.
++
++ Say Y here unless you have reason to mistrust your bootloader or
++ believe its RNG facilities may be faulty. This may also be configured
++ at boot time with "random.trust_bootloader=on/off".
++
++endmenu
+diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
+index 0ef7cb0448e86..c9757fa2d3081 100644
+--- a/drivers/char/hw_random/core.c
++++ b/drivers/char/hw_random/core.c
+@@ -15,6 +15,7 @@
+ #include <linux/err.h>
+ #include <linux/fs.h>
+ #include <linux/hw_random.h>
++#include <linux/random.h>
+ #include <linux/kernel.h>
+ #include <linux/kthread.h>
+ #include <linux/sched/signal.h>
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 1127343781465..55b23104fe33d 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1,242 +1,29 @@
++// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+ /*
+- * random.c -- A strong random number generator
+- *
+- * Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All
+- * Rights Reserved.
+- *
++ * Copyright (C) 2017-2022 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
+ * Copyright Matt Mackall <mpm@selenic.com>, 2003, 2004, 2005
+- *
+- * Copyright Theodore Ts'o, 1994, 1995, 1996, 1997, 1998, 1999. All
+- * rights reserved.
+- *
+- * Redistribution and use in source and binary forms, with or without
+- * modification, are permitted provided that the following conditions
+- * are met:
+- * 1. Redistributions of source code must retain the above copyright
+- * notice, and the entire permission notice in its entirety,
+- * including the disclaimer of warranties.
+- * 2. Redistributions in binary form must reproduce the above copyright
+- * notice, this list of conditions and the following disclaimer in the
+- * documentation and/or other materials provided with the distribution.
+- * 3. The name of the author may not be used to endorse or promote
+- * products derived from this software without specific prior
+- * written permission.
+- *
+- * ALTERNATIVELY, this product may be distributed under the terms of
+- * the GNU General Public License, in which case the provisions of the GPL are
+- * required INSTEAD OF the above restrictions. (This clause is
+- * necessary due to a potential bad interaction between the GPL and
+- * the restrictions contained in a BSD-style copyright.)
+- *
+- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF
+- * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE
+- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
+- * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+- * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+- * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH
+- * DAMAGE.
++ * Copyright Theodore Ts'o, 1994, 1995, 1996, 1997, 1998, 1999. All rights reserved.
++ *
++ * This driver produces cryptographically secure pseudorandom data. It is divided
++ * into roughly six sections, each with a section header:
++ *
++ * - Initialization and readiness waiting.
++ * - Fast key erasure RNG, the "crng".
++ * - Entropy accumulation and extraction routines.
++ * - Entropy collection routines.
++ * - Userspace reader/writer interfaces.
++ * - Sysctl interface.
++ *
++ * The high level overview is that there is one input pool, into which
++ * various pieces of data are hashed. Prior to initialization, some of that
++ * data is then "credited" as having a certain number of bits of entropy.
++ * When enough bits of entropy are available, the hash is finalized and
++ * handed as a key to a stream cipher that expands it indefinitely for
++ * various consumers. This key is periodically refreshed as the various
++ * entropy collectors, described below, add data to the input pool.
+ */
+
+-/*
+- * (now, with legal B.S. out of the way.....)
+- *
+- * This routine gathers environmental noise from device drivers, etc.,
+- * and returns good random numbers, suitable for cryptographic use.
+- * Besides the obvious cryptographic uses, these numbers are also good
+- * for seeding TCP sequence numbers, and other places where it is
+- * desirable to have numbers which are not only random, but hard to
+- * predict by an attacker.
+- *
+- * Theory of operation
+- * ===================
+- *
+- * Computers are very predictable devices. Hence it is extremely hard
+- * to produce truly random numbers on a computer --- as opposed to
+- * pseudo-random numbers, which can easily generated by using a
+- * algorithm. Unfortunately, it is very easy for attackers to guess
+- * the sequence of pseudo-random number generators, and for some
+- * applications this is not acceptable. So instead, we must try to
+- * gather "environmental noise" from the computer's environment, which
+- * must be hard for outside attackers to observe, and use that to
+- * generate random numbers. In a Unix environment, this is best done
+- * from inside the kernel.
+- *
+- * Sources of randomness from the environment include inter-keyboard
+- * timings, inter-interrupt timings from some interrupts, and other
+- * events which are both (a) non-deterministic and (b) hard for an
+- * outside observer to measure. Randomness from these sources are
+- * added to an "entropy pool", which is mixed using a CRC-like function.
+- * This is not cryptographically strong, but it is adequate assuming
+- * the randomness is not chosen maliciously, and it is fast enough that
+- * the overhead of doing it on every interrupt is very reasonable.
+- * As random bytes are mixed into the entropy pool, the routines keep
+- * an *estimate* of how many bits of randomness have been stored into
+- * the random number generator's internal state.
+- *
+- * When random bytes are desired, they are obtained by taking the SHA
+- * hash of the contents of the "entropy pool". The SHA hash avoids
+- * exposing the internal state of the entropy pool. It is believed to
+- * be computationally infeasible to derive any useful information
+- * about the input of SHA from its output. Even if it is possible to
+- * analyze SHA in some clever way, as long as the amount of data
+- * returned from the generator is less than the inherent entropy in
+- * the pool, the output data is totally unpredictable. For this
+- * reason, the routine decreases its internal estimate of how many
+- * bits of "true randomness" are contained in the entropy pool as it
+- * outputs random numbers.
+- *
+- * If this estimate goes to zero, the routine can still generate
+- * random numbers; however, an attacker may (at least in theory) be
+- * able to infer the future output of the generator from prior
+- * outputs. This requires successful cryptanalysis of SHA, which is
+- * not believed to be feasible, but there is a remote possibility.
+- * Nonetheless, these numbers should be useful for the vast majority
+- * of purposes.
+- *
+- * Exported interfaces ---- output
+- * ===============================
+- *
+- * There are three exported interfaces; the first is one designed to
+- * be used from within the kernel:
+- *
+- * void get_random_bytes(void *buf, int nbytes);
+- *
+- * This interface will return the requested number of random bytes,
+- * and place it in the requested buffer.
+- *
+- * The two other interfaces are two character devices /dev/random and
+- * /dev/urandom. /dev/random is suitable for use when very high
+- * quality randomness is desired (for example, for key generation or
+- * one-time pads), as it will only return a maximum of the number of
+- * bits of randomness (as estimated by the random number generator)
+- * contained in the entropy pool.
+- *
+- * The /dev/urandom device does not have this limit, and will return
+- * as many bytes as are requested. As more and more random bytes are
+- * requested without giving time for the entropy pool to recharge,
+- * this will result in random numbers that are merely cryptographically
+- * strong. For many applications, however, this is acceptable.
+- *
+- * Exported interfaces ---- input
+- * ==============================
+- *
+- * The current exported interfaces for gathering environmental noise
+- * from the devices are:
+- *
+- * void add_device_randomness(const void *buf, unsigned int size);
+- * void add_input_randomness(unsigned int type, unsigned int code,
+- * unsigned int value);
+- * void add_interrupt_randomness(int irq, int irq_flags);
+- * void add_disk_randomness(struct gendisk *disk);
+- *
+- * add_device_randomness() is for adding data to the random pool that
+- * is likely to differ between two devices (or possibly even per boot).
+- * This would be things like MAC addresses or serial numbers, or the
+- * read-out of the RTC. This does *not* add any actual entropy to the
+- * pool, but it initializes the pool to different values for devices
+- * that might otherwise be identical and have very little entropy
+- * available to them (particularly common in the embedded world).
+- *
+- * add_input_randomness() uses the input layer interrupt timing, as well as
+- * the event type information from the hardware.
+- *
+- * add_interrupt_randomness() uses the interrupt timing as random
+- * inputs to the entropy pool. Using the cycle counters and the irq source
+- * as inputs, it feeds the randomness roughly once a second.
+- *
+- * add_disk_randomness() uses what amounts to the seek time of block
+- * layer request events, on a per-disk_devt basis, as input to the
+- * entropy pool. Note that high-speed solid state drives with very low
+- * seek times do not make for good sources of entropy, as their seek
+- * times are usually fairly consistent.
+- *
+- * All of these routines try to estimate how many bits of randomness a
+- * particular randomness source. They do this by keeping track of the
+- * first and second order deltas of the event timings.
+- *
+- * Ensuring unpredictability at system startup
+- * ============================================
+- *
+- * When any operating system starts up, it will go through a sequence
+- * of actions that are fairly predictable by an adversary, especially
+- * if the start-up does not involve interaction with a human operator.
+- * This reduces the actual number of bits of unpredictability in the
+- * entropy pool below the value in entropy_count. In order to
+- * counteract this effect, it helps to carry information in the
+- * entropy pool across shut-downs and start-ups. To do this, put the
+- * following lines an appropriate script which is run during the boot
+- * sequence:
+- *
+- * echo "Initializing random number generator..."
+- * random_seed=/var/run/random-seed
+- * # Carry a random seed from start-up to start-up
+- * # Load and then save the whole entropy pool
+- * if [ -f $random_seed ]; then
+- * cat $random_seed >/dev/urandom
+- * else
+- * touch $random_seed
+- * fi
+- * chmod 600 $random_seed
+- * dd if=/dev/urandom of=$random_seed count=1 bs=512
+- *
+- * and the following lines in an appropriate script which is run as
+- * the system is shutdown:
+- *
+- * # Carry a random seed from shut-down to start-up
+- * # Save the whole entropy pool
+- * echo "Saving random seed..."
+- * random_seed=/var/run/random-seed
+- * touch $random_seed
+- * chmod 600 $random_seed
+- * dd if=/dev/urandom of=$random_seed count=1 bs=512
+- *
+- * For example, on most modern systems using the System V init
+- * scripts, such code fragments would be found in
+- * /etc/rc.d/init.d/random. On older Linux systems, the correct script
+- * location might be in /etc/rcb.d/rc.local or /etc/rc.d/rc.0.
+- *
+- * Effectively, these commands cause the contents of the entropy pool
+- * to be saved at shut-down time and reloaded into the entropy pool at
+- * start-up. (The 'dd' in the addition to the bootup script is to
+- * make sure that /etc/random-seed is different for every start-up,
+- * even if the system crashes without executing rc.0.) Even with
+- * complete knowledge of the start-up activities, predicting the state
+- * of the entropy pool requires knowledge of the previous history of
+- * the system.
+- *
+- * Configuring the /dev/random driver under Linux
+- * ==============================================
+- *
+- * The /dev/random driver under Linux uses minor numbers 8 and 9 of
+- * the /dev/mem major number (#1). So if your system does not have
+- * /dev/random and /dev/urandom created already, they can be created
+- * by using the commands:
+- *
+- * mknod /dev/random c 1 8
+- * mknod /dev/urandom c 1 9
+- *
+- * Acknowledgements:
+- * =================
+- *
+- * Ideas for constructing this random number generator were derived
+- * from Pretty Good Privacy's random number generator, and from private
+- * discussions with Phil Karn. Colin Plumb provided a faster random
+- * number generator, which speed up the mixing function of the entropy
+- * pool, taken from PGPfone. Dale Worley has also contributed many
+- * useful ideas and suggestions to improve this driver.
+- *
+- * Any flaws in the design are solely my responsibility, and should
+- * not be attributed to the Phil, Colin, or any of authors of PGP.
+- *
+- * Further background information on this topic may be obtained from
+- * RFC 1750, "Randomness Recommendations for Security", by Donald
+- * Eastlake, Steve Crocker, and Jeff Schiller.
+- */
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+ #include <linux/utsname.h>
+ #include <linux/module.h>
+@@ -256,8 +43,6 @@
+ #include <linux/spinlock.h>
+ #include <linux/kthread.h>
+ #include <linux/percpu.h>
+-#include <linux/cryptohash.h>
+-#include <linux/fips.h>
+ #include <linux/ptrace.h>
+ #include <linux/workqueue.h>
+ #include <linux/irq.h>
+@@ -265,1636 +50,1067 @@
+ #include <linux/syscalls.h>
+ #include <linux/completion.h>
+ #include <linux/uuid.h>
++#include <linux/uaccess.h>
++#include <linux/siphash.h>
++#include <linux/uio.h>
+ #include <crypto/chacha20.h>
+-
++#include <crypto/blake2s.h>
+ #include <asm/processor.h>
+-#include <linux/uaccess.h>
+ #include <asm/irq.h>
+ #include <asm/irq_regs.h>
+ #include <asm/io.h>
+
+-#define CREATE_TRACE_POINTS
+-#include <trace/events/random.h>
+-
+-/* #define ADD_INTERRUPT_BENCH */
++/*********************************************************************
++ *
++ * Initialization and readiness waiting.
++ *
++ * Much of the RNG infrastructure is devoted to various dependencies
++ * being able to wait until the RNG has collected enough entropy and
++ * is ready for safe consumption.
++ *
++ *********************************************************************/
+
+ /*
+- * Configuration information
++ * crng_init is protected by base_crng->lock, and only increases
++ * its value (from empty->early->ready).
+ */
+-#define INPUT_POOL_SHIFT 12
+-#define INPUT_POOL_WORDS (1 << (INPUT_POOL_SHIFT-5))
+-#define OUTPUT_POOL_SHIFT 10
+-#define OUTPUT_POOL_WORDS (1 << (OUTPUT_POOL_SHIFT-5))
+-#define SEC_XFER_SIZE 512
+-#define EXTRACT_SIZE 10
+-
++static enum {
++ CRNG_EMPTY = 0, /* Little to no entropy collected */
++ CRNG_EARLY = 1, /* At least POOL_EARLY_BITS collected */
++ CRNG_READY = 2 /* Fully initialized with POOL_READY_BITS collected */
++} crng_init __read_mostly = CRNG_EMPTY;
++#define crng_ready() (likely(crng_init >= CRNG_READY))
++/* Various types of waiters for crng_init->CRNG_READY transition. */
++static DECLARE_WAIT_QUEUE_HEAD(crng_init_wait);
++static struct fasync_struct *fasync;
++static DEFINE_SPINLOCK(random_ready_chain_lock);
++static RAW_NOTIFIER_HEAD(random_ready_chain);
+
+-#define LONGS(x) (((x) + sizeof(unsigned long) - 1)/sizeof(unsigned long))
++/* Control how we warn userspace. */
++static struct ratelimit_state urandom_warning =
++ RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3);
++static int ratelimit_disable __read_mostly =
++ IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM);
++module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
++MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
+
+ /*
+- * To allow fractional bits to be tracked, the entropy_count field is
+- * denominated in units of 1/8th bits.
++ * Returns whether or not the input pool has been seeded and thus guaranteed
++ * to supply cryptographically secure random numbers. This applies to: the
++ * /dev/urandom device, the get_random_bytes function, and the get_random_{u32,
++ * ,u64,int,long} family of functions.
+ *
+- * 2*(ENTROPY_SHIFT + log2(poolbits)) must <= 31, or the multiply in
+- * credit_entropy_bits() needs to be 64 bits wide.
++ * Returns: true if the input pool has been seeded.
++ * false if the input pool has not been seeded.
+ */
+-#define ENTROPY_SHIFT 3
+-#define ENTROPY_BITS(r) ((r)->entropy_count >> ENTROPY_SHIFT)
++bool rng_is_initialized(void)
++{
++ return crng_ready();
++}
++EXPORT_SYMBOL(rng_is_initialized);
+
+-/*
+- * The minimum number of bits of entropy before we wake up a read on
+- * /dev/random. Should be enough to do a significant reseed.
+- */
+-static int random_read_wakeup_bits = 64;
++/* Used by wait_for_random_bytes(), and considered an entropy collector, below. */
++static void try_to_generate_entropy(void);
+
+ /*
+- * If the entropy count falls under this number of bits, then we
+- * should wake up processes which are selecting or polling on write
+- * access to /dev/random.
++ * Wait for the input pool to be seeded and thus guaranteed to supply
++ * cryptographically secure random numbers. This applies to: the /dev/urandom
++ * device, the get_random_bytes function, and the get_random_{u32,u64,int,long}
++ * family of functions. Using any of these functions without first calling
++ * this function forfeits the guarantee of security.
++ *
++ * Returns: 0 if the input pool has been seeded.
++ * -ERESTARTSYS if the function was interrupted by a signal.
+ */
+-static int random_write_wakeup_bits = 28 * OUTPUT_POOL_WORDS;
++int wait_for_random_bytes(void)
++{
++ while (!crng_ready()) {
++ int ret;
++
++ try_to_generate_entropy();
++ ret = wait_event_interruptible_timeout(crng_init_wait, crng_ready(), HZ);
++ if (ret)
++ return ret > 0 ? 0 : ret;
++ }
++ return 0;
++}
++EXPORT_SYMBOL(wait_for_random_bytes);
+
+ /*
+- * Originally, we used a primitive polynomial of degree .poolwords
+- * over GF(2). The taps for various sizes are defined below. They
+- * were chosen to be evenly spaced except for the last tap, which is 1
+- * to get the twisting happening as fast as possible.
+- *
+- * For the purposes of better mixing, we use the CRC-32 polynomial as
+- * well to make a (modified) twisted Generalized Feedback Shift
+- * Register. (See M. Matsumoto & Y. Kurita, 1992. Twisted GFSR
+- * generators. ACM Transactions on Modeling and Computer Simulation
+- * 2(3):179-194. Also see M. Matsumoto & Y. Kurita, 1994. Twisted
+- * GFSR generators II. ACM Transactions on Modeling and Computer
+- * Simulation 4:254-266)
+- *
+- * Thanks to Colin Plumb for suggesting this.
+- *
+- * The mixing operation is much less sensitive than the output hash,
+- * where we use SHA-1. All that we want of mixing operation is that
+- * it be a good non-cryptographic hash; i.e. it not produce collisions
+- * when fed "random" data of the sort we expect to see. As long as
+- * the pool state differs for different inputs, we have preserved the
+- * input entropy and done a good job. The fact that an intelligent
+- * attacker can construct inputs that will produce controlled
+- * alterations to the pool's state is not important because we don't
+- * consider such inputs to contribute any randomness. The only
+- * property we need with respect to them is that the attacker can't
+- * increase his/her knowledge of the pool's state. Since all
+- * additions are reversible (knowing the final state and the input,
+- * you can reconstruct the initial state), if an attacker has any
+- * uncertainty about the initial state, he/she can only shuffle that
+- * uncertainty about, but never cause any collisions (which would
+- * decrease the uncertainty).
++ * Add a callback function that will be invoked when the input
++ * pool is initialised.
+ *
+- * Our mixing functions were analyzed by Lacharme, Roeck, Strubel, and
+- * Videau in their paper, "The Linux Pseudorandom Number Generator
+- * Revisited" (see: http://eprint.iacr.org/2012/251.pdf). In their
+- * paper, they point out that we are not using a true Twisted GFSR,
+- * since Matsumoto & Kurita used a trinomial feedback polynomial (that
+- * is, with only three taps, instead of the six that we are using).
+- * As a result, the resulting polynomial is neither primitive nor
+- * irreducible, and hence does not have a maximal period over
+- * GF(2**32). They suggest a slight change to the generator
+- * polynomial which improves the resulting TGFSR polynomial to be
+- * irreducible, which we have made here.
++ * returns: 0 if callback is successfully added
++ * -EALREADY if pool is already initialised (callback not called)
+ */
+-static struct poolinfo {
+- int poolbitshift, poolwords, poolbytes, poolbits, poolfracbits;
+-#define S(x) ilog2(x)+5, (x), (x)*4, (x)*32, (x) << (ENTROPY_SHIFT+5)
+- int tap1, tap2, tap3, tap4, tap5;
+-} poolinfo_table[] = {
+- /* was: x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 */
+- /* x^128 + x^104 + x^76 + x^51 +x^25 + x + 1 */
+- { S(128), 104, 76, 51, 25, 1 },
+- /* was: x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 */
+- /* x^32 + x^26 + x^19 + x^14 + x^7 + x + 1 */
+- { S(32), 26, 19, 14, 7, 1 },
+-#if 0
+- /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
+- { S(2048), 1638, 1231, 819, 411, 1 },
+-
+- /* x^1024 + x^817 + x^615 + x^412 + x^204 + x + 1 -- 290 */
+- { S(1024), 817, 615, 412, 204, 1 },
+-
+- /* x^1024 + x^819 + x^616 + x^410 + x^207 + x^2 + 1 -- 115 */
+- { S(1024), 819, 616, 410, 207, 2 },
+-
+- /* x^512 + x^411 + x^308 + x^208 + x^104 + x + 1 -- 225 */
+- { S(512), 411, 308, 208, 104, 1 },
+-
+- /* x^512 + x^409 + x^307 + x^206 + x^102 + x^2 + 1 -- 95 */
+- { S(512), 409, 307, 206, 102, 2 },
+- /* x^512 + x^409 + x^309 + x^205 + x^103 + x^2 + 1 -- 95 */
+- { S(512), 409, 309, 205, 103, 2 },
+-
+- /* x^256 + x^205 + x^155 + x^101 + x^52 + x + 1 -- 125 */
+- { S(256), 205, 155, 101, 52, 1 },
+-
+- /* x^128 + x^103 + x^78 + x^51 + x^27 + x^2 + 1 -- 70 */
+- { S(128), 103, 78, 51, 27, 2 },
+-
+- /* x^64 + x^52 + x^39 + x^26 + x^14 + x + 1 -- 15 */
+- { S(64), 52, 39, 26, 14, 1 },
+-#endif
+-};
++int __cold register_random_ready_notifier(struct notifier_block *nb)
++{
++ unsigned long flags;
++ int ret = -EALREADY;
++
++ if (crng_ready())
++ return ret;
++
++ spin_lock_irqsave(&random_ready_chain_lock, flags);
++ if (!crng_ready())
++ ret = raw_notifier_chain_register(&random_ready_chain, nb);
++ spin_unlock_irqrestore(&random_ready_chain_lock, flags);
++ return ret;
++}
+
+ /*
+- * Static global variables
++ * Delete a previously registered readiness callback function.
+ */
+-static DECLARE_WAIT_QUEUE_HEAD(random_read_wait);
+-static DECLARE_WAIT_QUEUE_HEAD(random_write_wait);
+-static struct fasync_struct *fasync;
+-
+-static DEFINE_SPINLOCK(random_ready_list_lock);
+-static LIST_HEAD(random_ready_list);
++int __cold unregister_random_ready_notifier(struct notifier_block *nb)
++{
++ unsigned long flags;
++ int ret;
+
+-struct crng_state {
+- __u32 state[16];
+- unsigned long init_time;
+- spinlock_t lock;
+-};
++ spin_lock_irqsave(&random_ready_chain_lock, flags);
++ ret = raw_notifier_chain_unregister(&random_ready_chain, nb);
++ spin_unlock_irqrestore(&random_ready_chain_lock, flags);
++ return ret;
++}
+
+-struct crng_state primary_crng = {
+- .lock = __SPIN_LOCK_UNLOCKED(primary_crng.lock),
+-};
++static void __cold process_random_ready_list(void)
++{
++ unsigned long flags;
+
+-/*
+- * crng_init = 0 --> Uninitialized
+- * 1 --> Initialized
+- * 2 --> Initialized from input_pool
+- *
+- * crng_init is protected by primary_crng->lock, and only increases
+- * its value (from 0->1->2).
+- */
+-static int crng_init = 0;
+-#define crng_ready() (likely(crng_init > 1))
+-static int crng_init_cnt = 0;
+-static unsigned long crng_global_init_time = 0;
+-#define CRNG_INIT_CNT_THRESH (2*CHACHA20_KEY_SIZE)
+-static void _extract_crng(struct crng_state *crng,
+- __u8 out[CHACHA20_BLOCK_SIZE]);
+-static void _crng_backtrack_protect(struct crng_state *crng,
+- __u8 tmp[CHACHA20_BLOCK_SIZE], int used);
+-static void process_random_ready_list(void);
+-static void _get_random_bytes(void *buf, int nbytes);
+-
+-static struct ratelimit_state unseeded_warning =
+- RATELIMIT_STATE_INIT("warn_unseeded_randomness", HZ, 3);
+-static struct ratelimit_state urandom_warning =
+- RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3);
++ spin_lock_irqsave(&random_ready_chain_lock, flags);
++ raw_notifier_call_chain(&random_ready_chain, 0, NULL);
++ spin_unlock_irqrestore(&random_ready_chain_lock, flags);
++}
+
+-static int ratelimit_disable __read_mostly;
++#define warn_unseeded_randomness() \
++ if (IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM) && !crng_ready()) \
++ pr_notice("%s called from %pS with crng_init=%d\n", \
++ __func__, (void *)_RET_IP_, crng_init)
+
+-module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
+-MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
+
+-/**********************************************************************
++/*********************************************************************
+ *
+- * OS independent entropy store. Here are the functions which handle
+- * storing entropy in an entropy pool.
++ * Fast key erasure RNG, the "crng".
+ *
+- **********************************************************************/
++ * These functions expand entropy from the entropy extractor into
++ * long streams for external consumption using the "fast key erasure"
++ * RNG described at <https://blog.cr.yp.to/20170723-random.html>.
++ *
++ * There are a few exported interfaces for use by other drivers:
++ *
++ * void get_random_bytes(void *buf, size_t len)
++ * u32 get_random_u32()
++ * u64 get_random_u64()
++ * unsigned int get_random_int()
++ * unsigned long get_random_long()
++ *
++ * These interfaces will return the requested number of random bytes
++ * into the given buffer or as a return value. This is equivalent to
++ * a read from /dev/urandom. The u32, u64, int, and long family of
++ * functions may be higher performance for one-off random integers,
++ * because they do a bit of buffering and do not invoke reseeding
++ * until the buffer is emptied.
++ *
++ *********************************************************************/
+
+-struct entropy_store;
+-struct entropy_store {
+- /* read-only data: */
+- const struct poolinfo *poolinfo;
+- __u32 *pool;
+- const char *name;
+- struct entropy_store *pull;
+- struct work_struct push_work;
+-
+- /* read-write data: */
+- unsigned long last_pulled;
+- spinlock_t lock;
+- unsigned short add_ptr;
+- unsigned short input_rotate;
+- int entropy_count;
+- int entropy_total;
+- unsigned int initialized:1;
+- unsigned int last_data_init:1;
+- __u8 last_data[EXTRACT_SIZE];
++enum {
++ CRNG_RESEED_START_INTERVAL = HZ,
++ CRNG_RESEED_INTERVAL = 60 * HZ
+ };
+
+-static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+- size_t nbytes, int min, int rsvd);
+-static ssize_t _extract_entropy(struct entropy_store *r, void *buf,
+- size_t nbytes, int fips);
+-
+-static void crng_reseed(struct crng_state *crng, struct entropy_store *r);
+-static void push_to_pool(struct work_struct *work);
+-static __u32 input_pool_data[INPUT_POOL_WORDS] __latent_entropy;
+-static __u32 blocking_pool_data[OUTPUT_POOL_WORDS] __latent_entropy;
+-
+-static struct entropy_store input_pool = {
+- .poolinfo = &poolinfo_table[0],
+- .name = "input",
+- .lock = __SPIN_LOCK_UNLOCKED(input_pool.lock),
+- .pool = input_pool_data
++static struct {
++ u8 key[CHACHA20_KEY_SIZE] __aligned(__alignof__(long));
++ unsigned long birth;
++ unsigned long generation;
++ spinlock_t lock;
++} base_crng = {
++ .lock = __SPIN_LOCK_UNLOCKED(base_crng.lock)
+ };
+
+-static struct entropy_store blocking_pool = {
+- .poolinfo = &poolinfo_table[1],
+- .name = "blocking",
+- .pull = &input_pool,
+- .lock = __SPIN_LOCK_UNLOCKED(blocking_pool.lock),
+- .pool = blocking_pool_data,
+- .push_work = __WORK_INITIALIZER(blocking_pool.push_work,
+- push_to_pool),
++struct crng {
++ u8 key[CHACHA20_KEY_SIZE];
++ unsigned long generation;
+ };
+
+-static __u32 const twist_table[8] = {
+- 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
+- 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
+-
+-/*
+- * This function adds bytes into the entropy "pool". It does not
+- * update the entropy estimate. The caller should call
+- * credit_entropy_bits if this is appropriate.
+- *
+- * The pool is stirred with a primitive polynomial of the appropriate
+- * degree, and then twisted. We twist by three bits at a time because
+- * it's cheap to do so and helps slightly in the expected case where
+- * the entropy is concentrated in the low-order bits.
+- */
+-static void _mix_pool_bytes(struct entropy_store *r, const void *in,
+- int nbytes)
+-{
+- unsigned long i, tap1, tap2, tap3, tap4, tap5;
+- int input_rotate;
+- int wordmask = r->poolinfo->poolwords - 1;
+- const char *bytes = in;
+- __u32 w;
+-
+- tap1 = r->poolinfo->tap1;
+- tap2 = r->poolinfo->tap2;
+- tap3 = r->poolinfo->tap3;
+- tap4 = r->poolinfo->tap4;
+- tap5 = r->poolinfo->tap5;
+-
+- input_rotate = r->input_rotate;
+- i = r->add_ptr;
+-
+- /* mix one byte at a time to simplify size handling and churn faster */
+- while (nbytes--) {
+- w = rol32(*bytes++, input_rotate);
+- i = (i - 1) & wordmask;
+-
+- /* XOR in the various taps */
+- w ^= r->pool[i];
+- w ^= r->pool[(i + tap1) & wordmask];
+- w ^= r->pool[(i + tap2) & wordmask];
+- w ^= r->pool[(i + tap3) & wordmask];
+- w ^= r->pool[(i + tap4) & wordmask];
+- w ^= r->pool[(i + tap5) & wordmask];
+-
+- /* Mix the result back in with a twist */
+- r->pool[i] = (w >> 3) ^ twist_table[w & 7];
+-
+- /*
+- * Normally, we add 7 bits of rotation to the pool.
+- * At the beginning of the pool, add an extra 7 bits
+- * rotation, so that successive passes spread the
+- * input bits across the pool evenly.
+- */
+- input_rotate = (input_rotate + (i ? 7 : 14)) & 31;
+- }
+-
+- r->input_rotate = input_rotate;
+- r->add_ptr = i;
+-}
++static DEFINE_PER_CPU(struct crng, crngs) = {
++ .generation = ULONG_MAX
++};
+
+-static void __mix_pool_bytes(struct entropy_store *r, const void *in,
+- int nbytes)
+-{
+- trace_mix_pool_bytes_nolock(r->name, nbytes, _RET_IP_);
+- _mix_pool_bytes(r, in, nbytes);
+-}
++/* Used by crng_reseed() and crng_make_state() to extract a new seed from the input pool. */
++static void extract_entropy(void *buf, size_t len);
+
+-static void mix_pool_bytes(struct entropy_store *r, const void *in,
+- int nbytes)
++/* This extracts a new crng key from the input pool. */
++static void crng_reseed(void)
+ {
+ unsigned long flags;
++ unsigned long next_gen;
++ u8 key[CHACHA20_KEY_SIZE];
+
+- trace_mix_pool_bytes(r->name, nbytes, _RET_IP_);
+- spin_lock_irqsave(&r->lock, flags);
+- _mix_pool_bytes(r, in, nbytes);
+- spin_unlock_irqrestore(&r->lock, flags);
+-}
++ extract_entropy(key, sizeof(key));
+
+-struct fast_pool {
+- __u32 pool[4];
+- unsigned long last;
+- unsigned short reg_idx;
+- unsigned char count;
+-};
++ /*
++ * We copy the new key into the base_crng, overwriting the old one,
++ * and update the generation counter. We avoid hitting ULONG_MAX,
++ * because the per-cpu crngs are initialized to ULONG_MAX, so this
++ * forces new CPUs that come online to always initialize.
++ */
++ spin_lock_irqsave(&base_crng.lock, flags);
++ memcpy(base_crng.key, key, sizeof(base_crng.key));
++ next_gen = base_crng.generation + 1;
++ if (next_gen == ULONG_MAX)
++ ++next_gen;
++ WRITE_ONCE(base_crng.generation, next_gen);
++ WRITE_ONCE(base_crng.birth, jiffies);
++ if (!crng_ready())
++ crng_init = CRNG_READY;
++ spin_unlock_irqrestore(&base_crng.lock, flags);
++ memzero_explicit(key, sizeof(key));
++}
+
+ /*
+- * This is a fast mixing routine used by the interrupt randomness
+- * collector. It's hardcoded for an 128 bit pool and assumes that any
+- * locks that might be needed are taken by the caller.
++ * This generates a ChaCha block using the provided key, and then
++ * immediately overwites that key with half the block. It returns
++ * the resultant ChaCha state to the user, along with the second
++ * half of the block containing 32 bytes of random data that may
++ * be used; random_data_len may not be greater than 32.
++ *
++ * The returned ChaCha state contains within it a copy of the old
++ * key value, at index 4, so the state should always be zeroed out
++ * immediately after using in order to maintain forward secrecy.
++ * If the state cannot be erased in a timely manner, then it is
++ * safer to set the random_data parameter to &chacha_state[4] so
++ * that this function overwrites it before returning.
+ */
+-static void fast_mix(struct fast_pool *f)
++static void crng_fast_key_erasure(u8 key[CHACHA20_KEY_SIZE],
++ u32 chacha_state[CHACHA20_BLOCK_SIZE / sizeof(u32)],
++ u8 *random_data, size_t random_data_len)
+ {
+- __u32 a = f->pool[0], b = f->pool[1];
+- __u32 c = f->pool[2], d = f->pool[3];
++ u8 first_block[CHACHA20_BLOCK_SIZE];
+
+- a += b; c += d;
+- b = rol32(b, 6); d = rol32(d, 27);
+- d ^= a; b ^= c;
++ BUG_ON(random_data_len > 32);
+
+- a += b; c += d;
+- b = rol32(b, 16); d = rol32(d, 14);
+- d ^= a; b ^= c;
++ chacha_init_consts(chacha_state);
++ memcpy(&chacha_state[4], key, CHACHA20_KEY_SIZE);
++ memset(&chacha_state[12], 0, sizeof(u32) * 4);
++ chacha20_block(chacha_state, first_block);
+
+- a += b; c += d;
+- b = rol32(b, 6); d = rol32(d, 27);
+- d ^= a; b ^= c;
+-
+- a += b; c += d;
+- b = rol32(b, 16); d = rol32(d, 14);
+- d ^= a; b ^= c;
+-
+- f->pool[0] = a; f->pool[1] = b;
+- f->pool[2] = c; f->pool[3] = d;
+- f->count++;
++ memcpy(key, first_block, CHACHA20_KEY_SIZE);
++ memcpy(random_data, first_block + CHACHA20_KEY_SIZE, random_data_len);
++ memzero_explicit(first_block, sizeof(first_block));
+ }
+
+-static void process_random_ready_list(void)
+-{
+- unsigned long flags;
+- struct random_ready_callback *rdy, *tmp;
+-
+- spin_lock_irqsave(&random_ready_list_lock, flags);
+- list_for_each_entry_safe(rdy, tmp, &random_ready_list, list) {
+- struct module *owner = rdy->owner;
+-
+- list_del_init(&rdy->list);
+- rdy->func(rdy);
+- module_put(owner);
++/*
++ * Return whether the crng seed is considered to be sufficiently old
++ * that a reseeding is needed. This happens if the last reseeding
++ * was CRNG_RESEED_INTERVAL ago, or during early boot, at an interval
++ * proportional to the uptime.
++ */
++static bool crng_has_old_seed(void)
++{
++ static bool early_boot = true;
++ unsigned long interval = CRNG_RESEED_INTERVAL;
++
++ if (unlikely(READ_ONCE(early_boot))) {
++ time64_t uptime = ktime_get_seconds();
++ if (uptime >= CRNG_RESEED_INTERVAL / HZ * 2)
++ WRITE_ONCE(early_boot, false);
++ else
++ interval = max_t(unsigned int, CRNG_RESEED_START_INTERVAL,
++ (unsigned int)uptime / 2 * HZ);
+ }
+- spin_unlock_irqrestore(&random_ready_list_lock, flags);
++ return time_is_before_jiffies(READ_ONCE(base_crng.birth) + interval);
+ }
+
+ /*
+- * Credit (or debit) the entropy store with n bits of entropy.
+- * Use credit_entropy_bits_safe() if the value comes from userspace
+- * or otherwise should be checked for extreme values.
++ * This function returns a ChaCha state that you may use for generating
++ * random data. It also returns up to 32 bytes on its own of random data
++ * that may be used; random_data_len may not be greater than 32.
+ */
+-static void credit_entropy_bits(struct entropy_store *r, int nbits)
++static void crng_make_state(u32 chacha_state[CHACHA20_BLOCK_SIZE / sizeof(u32)],
++ u8 *random_data, size_t random_data_len)
+ {
+- int entropy_count, orig;
+- const int pool_size = r->poolinfo->poolfracbits;
+- int nfrac = nbits << ENTROPY_SHIFT;
+-
+- if (!nbits)
+- return;
++ unsigned long flags;
++ struct crng *crng;
+
+-retry:
+- entropy_count = orig = READ_ONCE(r->entropy_count);
+- if (nfrac < 0) {
+- /* Debit */
+- entropy_count += nfrac;
+- } else {
+- /*
+- * Credit: we have to account for the possibility of
+- * overwriting already present entropy. Even in the
+- * ideal case of pure Shannon entropy, new contributions
+- * approach the full value asymptotically:
+- *
+- * entropy <- entropy + (pool_size - entropy) *
+- * (1 - exp(-add_entropy/pool_size))
+- *
+- * For add_entropy <= pool_size/2 then
+- * (1 - exp(-add_entropy/pool_size)) >=
+- * (add_entropy/pool_size)*0.7869...
+- * so we can approximate the exponential with
+- * 3/4*add_entropy/pool_size and still be on the
+- * safe side by adding at most pool_size/2 at a time.
+- *
+- * The use of pool_size-2 in the while statement is to
+- * prevent rounding artifacts from making the loop
+- * arbitrarily long; this limits the loop to log2(pool_size)*2
+- * turns no matter how large nbits is.
+- */
+- int pnfrac = nfrac;
+- const int s = r->poolinfo->poolbitshift + ENTROPY_SHIFT + 2;
+- /* The +2 corresponds to the /4 in the denominator */
+-
+- do {
+- unsigned int anfrac = min(pnfrac, pool_size/2);
+- unsigned int add =
+- ((pool_size - entropy_count)*anfrac*3) >> s;
+-
+- entropy_count += add;
+- pnfrac -= anfrac;
+- } while (unlikely(entropy_count < pool_size-2 && pnfrac));
+- }
++ BUG_ON(random_data_len > 32);
+
+- if (unlikely(entropy_count < 0)) {
+- pr_warn("random: negative entropy/overflow: pool %s count %d\n",
+- r->name, entropy_count);
+- WARN_ON(1);
+- entropy_count = 0;
+- } else if (entropy_count > pool_size)
+- entropy_count = pool_size;
+- if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
+- goto retry;
+-
+- r->entropy_total += nbits;
+- if (!r->initialized && r->entropy_total > 128) {
+- r->initialized = 1;
+- r->entropy_total = 0;
++ /*
++ * For the fast path, we check whether we're ready, unlocked first, and
++ * then re-check once locked later. In the case where we're really not
++ * ready, we do fast key erasure with the base_crng directly, extracting
++ * when crng_init is CRNG_EMPTY.
++ */
++ if (!crng_ready()) {
++ bool ready;
++
++ spin_lock_irqsave(&base_crng.lock, flags);
++ ready = crng_ready();
++ if (!ready) {
++ if (crng_init == CRNG_EMPTY)
++ extract_entropy(base_crng.key, sizeof(base_crng.key));
++ crng_fast_key_erasure(base_crng.key, chacha_state,
++ random_data, random_data_len);
++ }
++ spin_unlock_irqrestore(&base_crng.lock, flags);
++ if (!ready)
++ return;
+ }
+
+- trace_credit_entropy_bits(r->name, nbits,
+- entropy_count >> ENTROPY_SHIFT,
+- r->entropy_total, _RET_IP_);
+-
+- if (r == &input_pool) {
+- int entropy_bits = entropy_count >> ENTROPY_SHIFT;
++ /*
++ * If the base_crng is old enough, we reseed, which in turn bumps the
++ * generation counter that we check below.
++ */
++ if (unlikely(crng_has_old_seed()))
++ crng_reseed();
+
+- if (crng_init < 2 && entropy_bits >= 128) {
+- crng_reseed(&primary_crng, r);
+- entropy_bits = r->entropy_count >> ENTROPY_SHIFT;
+- }
++ local_irq_save(flags);
++ crng = raw_cpu_ptr(&crngs);
+
+- /* should we wake readers? */
+- if (entropy_bits >= random_read_wakeup_bits &&
+- wq_has_sleeper(&random_read_wait)) {
+- wake_up_interruptible(&random_read_wait);
+- kill_fasync(&fasync, SIGIO, POLL_IN);
+- }
+- /* If the input pool is getting full, send some
+- * entropy to the blocking pool until it is 75% full.
+- */
+- if (entropy_bits > random_write_wakeup_bits &&
+- r->initialized &&
+- r->entropy_total >= 2*random_read_wakeup_bits) {
+- struct entropy_store *other = &blocking_pool;
+-
+- if (other->entropy_count <=
+- 3 * other->poolinfo->poolfracbits / 4) {
+- schedule_work(&other->push_work);
+- r->entropy_total = 0;
+- }
+- }
++ /*
++ * If our per-cpu crng is older than the base_crng, then it means
++ * somebody reseeded the base_crng. In that case, we do fast key
++ * erasure on the base_crng, and use its output as the new key
++ * for our per-cpu crng. This brings us up to date with base_crng.
++ */
++ if (unlikely(crng->generation != READ_ONCE(base_crng.generation))) {
++ spin_lock(&base_crng.lock);
++ crng_fast_key_erasure(base_crng.key, chacha_state,
++ crng->key, sizeof(crng->key));
++ crng->generation = base_crng.generation;
++ spin_unlock(&base_crng.lock);
+ }
++
++ /*
++ * Finally, when we've made it this far, our per-cpu crng has an up
++ * to date key, and we can do fast key erasure with it to produce
++ * some random data and a ChaCha state for the caller. All other
++ * branches of this function are "unlikely", so most of the time we
++ * should wind up here immediately.
++ */
++ crng_fast_key_erasure(crng->key, chacha_state, random_data, random_data_len);
++ local_irq_restore(flags);
+ }
+
+-static int credit_entropy_bits_safe(struct entropy_store *r, int nbits)
++static void _get_random_bytes(void *buf, size_t len)
+ {
+- const int nbits_max = r->poolinfo->poolwords * 32;
+-
+- if (nbits < 0)
+- return -EINVAL;
++ u32 chacha_state[CHACHA20_BLOCK_SIZE / sizeof(u32)];
++ u8 tmp[CHACHA20_BLOCK_SIZE];
++ size_t first_block_len;
+
+- /* Cap the value to avoid overflows */
+- nbits = min(nbits, nbits_max);
++ if (!len)
++ return;
+
+- credit_entropy_bits(r, nbits);
+- return 0;
+-}
++ first_block_len = min_t(size_t, 32, len);
++ crng_make_state(chacha_state, buf, first_block_len);
++ len -= first_block_len;
++ buf += first_block_len;
+
+-/*********************************************************************
+- *
+- * CRNG using CHACHA20
+- *
+- *********************************************************************/
++ while (len) {
++ if (len < CHACHA20_BLOCK_SIZE) {
++ chacha20_block(chacha_state, tmp);
++ memcpy(buf, tmp, len);
++ memzero_explicit(tmp, sizeof(tmp));
++ break;
++ }
+
+-#define CRNG_RESEED_INTERVAL (300*HZ)
++ chacha20_block(chacha_state, buf);
++ if (unlikely(chacha_state[12] == 0))
++ ++chacha_state[13];
++ len -= CHACHA20_BLOCK_SIZE;
++ buf += CHACHA20_BLOCK_SIZE;
++ }
+
+-static DECLARE_WAIT_QUEUE_HEAD(crng_init_wait);
++ memzero_explicit(chacha_state, sizeof(chacha_state));
++}
+
+-#ifdef CONFIG_NUMA
+ /*
+- * Hack to deal with crazy userspace progams when they are all trying
+- * to access /dev/urandom in parallel. The programs are almost
+- * certainly doing something terribly wrong, but we'll work around
+- * their brain damage.
++ * This function is the exported kernel interface. It returns some
++ * number of good random numbers, suitable for key generation, seeding
++ * TCP sequence numbers, etc. It does not rely on the hardware random
++ * number generator. For random bytes direct from the hardware RNG
++ * (when available), use get_random_bytes_arch(). In order to ensure
++ * that the randomness provided by this function is okay, the function
++ * wait_for_random_bytes() should be called and return 0 at least once
++ * at any point prior.
+ */
+-static struct crng_state **crng_node_pool __read_mostly;
+-#endif
+-
+-static void invalidate_batched_entropy(void);
+-static void numa_crng_init(void);
+-
+-static bool trust_cpu __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU);
+-static int __init parse_trust_cpu(char *arg)
++void get_random_bytes(void *buf, size_t len)
+ {
+- return kstrtobool(arg, &trust_cpu);
++ warn_unseeded_randomness();
++ _get_random_bytes(buf, len);
+ }
+-early_param("random.trust_cpu", parse_trust_cpu);
++EXPORT_SYMBOL(get_random_bytes);
+
+-static void crng_initialize(struct crng_state *crng)
++static ssize_t get_random_bytes_user(struct iov_iter *iter)
+ {
+- int i;
+- int arch_init = 1;
+- unsigned long rv;
+-
+- memcpy(&crng->state[0], "expand 32-byte k", 16);
+- if (crng == &primary_crng)
+- _extract_entropy(&input_pool, &crng->state[4],
+- sizeof(__u32) * 12, 0);
+- else
+- _get_random_bytes(&crng->state[4], sizeof(__u32) * 12);
+- for (i = 4; i < 16; i++) {
+- if (!arch_get_random_seed_long(&rv) &&
+- !arch_get_random_long(&rv)) {
+- rv = random_get_entropy();
+- arch_init = 0;
+- }
+- crng->state[i] ^= rv;
+- }
+- if (trust_cpu && arch_init && crng == &primary_crng) {
+- invalidate_batched_entropy();
+- numa_crng_init();
+- crng_init = 2;
+- pr_notice("random: crng done (trusting CPU's manufacturer)\n");
+- }
+- crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;
+-}
++ u32 chacha_state[CHACHA20_BLOCK_SIZE / sizeof(u32)];
++ u8 block[CHACHA20_BLOCK_SIZE];
++ size_t ret = 0, copied;
+
+-#ifdef CONFIG_NUMA
+-static void do_numa_crng_init(struct work_struct *work)
+-{
+- int i;
+- struct crng_state *crng;
+- struct crng_state **pool;
+-
+- pool = kcalloc(nr_node_ids, sizeof(*pool), GFP_KERNEL|__GFP_NOFAIL);
+- for_each_online_node(i) {
+- crng = kmalloc_node(sizeof(struct crng_state),
+- GFP_KERNEL | __GFP_NOFAIL, i);
+- spin_lock_init(&crng->lock);
+- crng_initialize(crng);
+- pool[i] = crng;
+- }
+- /* pairs with READ_ONCE() in select_crng() */
+- if (cmpxchg_release(&crng_node_pool, NULL, pool) != NULL) {
+- for_each_node(i)
+- kfree(pool[i]);
+- kfree(pool);
+- }
+-}
++ if (unlikely(!iov_iter_count(iter)))
++ return 0;
+
+-static DECLARE_WORK(numa_crng_init_work, do_numa_crng_init);
++ /*
++ * Immediately overwrite the ChaCha key at index 4 with random
++ * bytes, in case userspace causes copy_to_user() below to sleep
++ * forever, so that we still retain forward secrecy in that case.
++ */
++ crng_make_state(chacha_state, (u8 *)&chacha_state[4], CHACHA20_KEY_SIZE);
++ /*
++ * However, if we're doing a read of len <= 32, we don't need to
++ * use chacha_state after, so we can simply return those bytes to
++ * the user directly.
++ */
++ if (iov_iter_count(iter) <= CHACHA20_KEY_SIZE) {
++ ret = copy_to_iter(&chacha_state[4], CHACHA20_KEY_SIZE, iter);
++ goto out_zero_chacha;
++ }
+
+-static void numa_crng_init(void)
+-{
+- schedule_work(&numa_crng_init_work);
+-}
++ for (;;) {
++ chacha20_block(chacha_state, block);
++ if (unlikely(chacha_state[12] == 0))
++ ++chacha_state[13];
+
+-static struct crng_state *select_crng(void)
+-{
+- struct crng_state **pool;
+- int nid = numa_node_id();
++ copied = copy_to_iter(block, sizeof(block), iter);
++ ret += copied;
++ if (!iov_iter_count(iter) || copied != sizeof(block))
++ break;
+
+- /* pairs with cmpxchg_release() in do_numa_crng_init() */
+- pool = READ_ONCE(crng_node_pool);
+- if (pool && pool[nid])
+- return pool[nid];
++ BUILD_BUG_ON(PAGE_SIZE % sizeof(block) != 0);
++ if (ret % PAGE_SIZE == 0) {
++ if (signal_pending(current))
++ break;
++ cond_resched();
++ }
++ }
+
+- return &primary_crng;
++ memzero_explicit(block, sizeof(block));
++out_zero_chacha:
++ memzero_explicit(chacha_state, sizeof(chacha_state));
++ return ret ? ret : -EFAULT;
+ }
+-#else
+-static void numa_crng_init(void) {}
+
+-static struct crng_state *select_crng(void)
++/*
++ * Batched entropy returns random integers. The quality of the random
++ * number is good as /dev/urandom. In order to ensure that the randomness
++ * provided by this function is okay, the function wait_for_random_bytes()
++ * should be called and return 0 at least once at any point prior.
++ */
++
++#define DEFINE_BATCHED_ENTROPY(type) \
++struct batch_ ##type { \
++ /* \
++ * We make this 1.5x a ChaCha block, so that we get the \
++ * remaining 32 bytes from fast key erasure, plus one full \
++ * block from the detached ChaCha state. We can increase \
++ * the size of this later if needed so long as we keep the \
++ * formula of (integer_blocks + 0.5) * CHACHA20_BLOCK_SIZE. \
++ */ \
++ type entropy[CHACHA20_BLOCK_SIZE * 3 / (2 * sizeof(type))]; \
++ unsigned long generation; \
++ unsigned int position; \
++}; \
++ \
++static DEFINE_PER_CPU(struct batch_ ##type, batched_entropy_ ##type) = { \
++ .position = UINT_MAX \
++}; \
++ \
++type get_random_ ##type(void) \
++{ \
++ type ret; \
++ unsigned long flags; \
++ struct batch_ ##type *batch; \
++ unsigned long next_gen; \
++ \
++ warn_unseeded_randomness(); \
++ \
++ if (!crng_ready()) { \
++ _get_random_bytes(&ret, sizeof(ret)); \
++ return ret; \
++ } \
++ \
++ local_irq_save(flags); \
++ batch = raw_cpu_ptr(&batched_entropy_##type); \
++ \
++ next_gen = READ_ONCE(base_crng.generation); \
++ if (batch->position >= ARRAY_SIZE(batch->entropy) || \
++ next_gen != batch->generation) { \
++ _get_random_bytes(batch->entropy, sizeof(batch->entropy)); \
++ batch->position = 0; \
++ batch->generation = next_gen; \
++ } \
++ \
++ ret = batch->entropy[batch->position]; \
++ batch->entropy[batch->position] = 0; \
++ ++batch->position; \
++ local_irq_restore(flags); \
++ return ret; \
++} \
++EXPORT_SYMBOL(get_random_ ##type);
++
++DEFINE_BATCHED_ENTROPY(u64)
++DEFINE_BATCHED_ENTROPY(u32)
++
++#ifdef CONFIG_SMP
++/*
++ * This function is called when the CPU is coming up, with entry
++ * CPUHP_RANDOM_PREPARE, which comes before CPUHP_WORKQUEUE_PREP.
++ */
++int __cold random_prepare_cpu(unsigned int cpu)
+ {
+- return &primary_crng;
++ /*
++ * When the cpu comes back online, immediately invalidate both
++ * the per-cpu crng and all batches, so that we serve fresh
++ * randomness.
++ */
++ per_cpu_ptr(&crngs, cpu)->generation = ULONG_MAX;
++ per_cpu_ptr(&batched_entropy_u32, cpu)->position = UINT_MAX;
++ per_cpu_ptr(&batched_entropy_u64, cpu)->position = UINT_MAX;
++ return 0;
+ }
+ #endif
+
+ /*
+- * crng_fast_load() can be called by code in the interrupt service
+- * path. So we can't afford to dilly-dally.
++ * This function will use the architecture-specific hardware random
++ * number generator if it is available. It is not recommended for
++ * use. Use get_random_bytes() instead. It returns the number of
++ * bytes filled in.
+ */
+-static int crng_fast_load(const char *cp, size_t len)
++size_t __must_check get_random_bytes_arch(void *buf, size_t len)
+ {
+- unsigned long flags;
+- char *p;
++ size_t left = len;
++ u8 *p = buf;
+
+- if (!spin_trylock_irqsave(&primary_crng.lock, flags))
+- return 0;
+- if (crng_init != 0) {
+- spin_unlock_irqrestore(&primary_crng.lock, flags);
+- return 0;
+- }
+- p = (unsigned char *) &primary_crng.state[4];
+- while (len > 0 && crng_init_cnt < CRNG_INIT_CNT_THRESH) {
+- p[crng_init_cnt % CHACHA20_KEY_SIZE] ^= *cp;
+- cp++; crng_init_cnt++; len--;
+- }
+- spin_unlock_irqrestore(&primary_crng.lock, flags);
+- if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) {
+- invalidate_batched_entropy();
+- crng_init = 1;
+- wake_up_interruptible(&crng_init_wait);
+- pr_notice("random: fast init done\n");
+- }
+- return 1;
+-}
+-
+-/*
+- * crng_slow_load() is called by add_device_randomness, which has two
+- * attributes. (1) We can't trust the buffer passed to it is
+- * guaranteed to be unpredictable (so it might not have any entropy at
+- * all), and (2) it doesn't have the performance constraints of
+- * crng_fast_load().
+- *
+- * So we do something more comprehensive which is guaranteed to touch
+- * all of the primary_crng's state, and which uses a LFSR with a
+- * period of 255 as part of the mixing algorithm. Finally, we do
+- * *not* advance crng_init_cnt since buffer we may get may be something
+- * like a fixed DMI table (for example), which might very well be
+- * unique to the machine, but is otherwise unvarying.
+- */
+-static int crng_slow_load(const char *cp, size_t len)
+-{
+- unsigned long flags;
+- static unsigned char lfsr = 1;
+- unsigned char tmp;
+- unsigned i, max = CHACHA20_KEY_SIZE;
+- const char * src_buf = cp;
+- char * dest_buf = (char *) &primary_crng.state[4];
+-
+- if (!spin_trylock_irqsave(&primary_crng.lock, flags))
+- return 0;
+- if (crng_init != 0) {
+- spin_unlock_irqrestore(&primary_crng.lock, flags);
+- return 0;
+- }
+- if (len > max)
+- max = len;
+-
+- for (i = 0; i < max ; i++) {
+- tmp = lfsr;
+- lfsr >>= 1;
+- if (tmp & 1)
+- lfsr ^= 0xE1;
+- tmp = dest_buf[i % CHACHA20_KEY_SIZE];
+- dest_buf[i % CHACHA20_KEY_SIZE] ^= src_buf[i % len] ^ lfsr;
+- lfsr += (tmp << 3) | (tmp >> 5);
+- }
+- spin_unlock_irqrestore(&primary_crng.lock, flags);
+- return 1;
+-}
+-
+-static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
+-{
+- unsigned long flags;
+- int i, num;
+- union {
+- __u8 block[CHACHA20_BLOCK_SIZE];
+- __u32 key[8];
+- } buf;
+-
+- if (r) {
+- num = extract_entropy(r, &buf, 32, 16, 0);
+- if (num == 0)
+- return;
+- } else {
+- _extract_crng(&primary_crng, buf.block);
+- _crng_backtrack_protect(&primary_crng, buf.block,
+- CHACHA20_KEY_SIZE);
+- }
+- spin_lock_irqsave(&crng->lock, flags);
+- for (i = 0; i < 8; i++) {
+- unsigned long rv;
+- if (!arch_get_random_seed_long(&rv) &&
+- !arch_get_random_long(&rv))
+- rv = random_get_entropy();
+- crng->state[i+4] ^= buf.key[i] ^ rv;
+- }
+- memzero_explicit(&buf, sizeof(buf));
+- WRITE_ONCE(crng->init_time, jiffies);
+- spin_unlock_irqrestore(&crng->lock, flags);
+- if (crng == &primary_crng && crng_init < 2) {
+- invalidate_batched_entropy();
+- numa_crng_init();
+- crng_init = 2;
+- process_random_ready_list();
+- wake_up_interruptible(&crng_init_wait);
+- pr_notice("random: crng init done\n");
+- if (unseeded_warning.missed) {
+- pr_notice("random: %d get_random_xx warning(s) missed "
+- "due to ratelimiting\n",
+- unseeded_warning.missed);
+- unseeded_warning.missed = 0;
+- }
+- if (urandom_warning.missed) {
+- pr_notice("random: %d urandom warning(s) missed "
+- "due to ratelimiting\n",
+- urandom_warning.missed);
+- urandom_warning.missed = 0;
+- }
+- }
+-}
+-
+-static void _extract_crng(struct crng_state *crng,
+- __u8 out[CHACHA20_BLOCK_SIZE])
+-{
+- unsigned long v, flags, init_time;
+-
+- if (crng_ready()) {
+- init_time = READ_ONCE(crng->init_time);
+- if (time_after(READ_ONCE(crng_global_init_time), init_time) ||
+- time_after(jiffies, init_time + CRNG_RESEED_INTERVAL))
+- crng_reseed(crng, crng == &primary_crng ?
+- &input_pool : NULL);
+- }
+- spin_lock_irqsave(&crng->lock, flags);
+- if (arch_get_random_long(&v))
+- crng->state[14] ^= v;
+- chacha20_block(&crng->state[0], out);
+- if (crng->state[12] == 0)
+- crng->state[13]++;
+- spin_unlock_irqrestore(&crng->lock, flags);
+-}
+-
+-static void extract_crng(__u8 out[CHACHA20_BLOCK_SIZE])
+-{
+- _extract_crng(select_crng(), out);
+-}
+-
+-/*
+- * Use the leftover bytes from the CRNG block output (if there is
+- * enough) to mutate the CRNG key to provide backtracking protection.
+- */
+-static void _crng_backtrack_protect(struct crng_state *crng,
+- __u8 tmp[CHACHA20_BLOCK_SIZE], int used)
+-{
+- unsigned long flags;
+- __u32 *s, *d;
+- int i;
+-
+- used = round_up(used, sizeof(__u32));
+- if (used + CHACHA20_KEY_SIZE > CHACHA20_BLOCK_SIZE) {
+- extract_crng(tmp);
+- used = 0;
+- }
+- spin_lock_irqsave(&crng->lock, flags);
+- s = (__u32 *) &tmp[used];
+- d = &crng->state[4];
+- for (i=0; i < 8; i++)
+- *d++ ^= *s++;
+- spin_unlock_irqrestore(&crng->lock, flags);
+-}
+-
+-static void crng_backtrack_protect(__u8 tmp[CHACHA20_BLOCK_SIZE], int used)
+-{
+- _crng_backtrack_protect(select_crng(), tmp, used);
+-}
+-
+-static ssize_t extract_crng_user(void __user *buf, size_t nbytes)
+-{
+- ssize_t ret = 0, i = CHACHA20_BLOCK_SIZE;
+- __u8 tmp[CHACHA20_BLOCK_SIZE] __aligned(4);
+- int large_request = (nbytes > 256);
+-
+- while (nbytes) {
+- if (large_request && need_resched()) {
+- if (signal_pending(current)) {
+- if (ret == 0)
+- ret = -ERESTARTSYS;
+- break;
+- }
+- schedule();
+- }
++ while (left) {
++ unsigned long v;
++ size_t block_len = min_t(size_t, left, sizeof(unsigned long));
+
+- extract_crng(tmp);
+- i = min_t(int, nbytes, CHACHA20_BLOCK_SIZE);
+- if (copy_to_user(buf, tmp, i)) {
+- ret = -EFAULT;
++ if (!arch_get_random_long(&v))
+ break;
+- }
+
+- nbytes -= i;
+- buf += i;
+- ret += i;
++ memcpy(p, &v, block_len);
++ p += block_len;
++ left -= block_len;
+ }
+- crng_backtrack_protect(tmp, i);
+-
+- /* Wipe data just written to memory */
+- memzero_explicit(tmp, sizeof(tmp));
+
+- return ret;
++ return len - left;
+ }
++EXPORT_SYMBOL(get_random_bytes_arch);
+
+
+-/*********************************************************************
++/**********************************************************************
+ *
+- * Entropy input management
++ * Entropy accumulation and extraction routines.
+ *
+- *********************************************************************/
++ * Callers may add entropy via:
++ *
++ * static void mix_pool_bytes(const void *buf, size_t len)
++ *
++ * After which, if added entropy should be credited:
++ *
++ * static void credit_init_bits(size_t bits)
++ *
++ * Finally, extract entropy via:
++ *
++ * static void extract_entropy(void *buf, size_t len)
++ *
++ **********************************************************************/
+
+-/* There is one of these per entropy source */
+-struct timer_rand_state {
+- cycles_t last_time;
+- long last_delta, last_delta2;
++enum {
++ POOL_BITS = BLAKE2S_HASH_SIZE * 8,
++ POOL_READY_BITS = POOL_BITS, /* When crng_init->CRNG_READY */
++ POOL_EARLY_BITS = POOL_READY_BITS / 2 /* When crng_init->CRNG_EARLY */
++};
++
++static struct {
++ struct blake2s_state hash;
++ spinlock_t lock;
++ unsigned int init_bits;
++} input_pool = {
++ .hash.h = { BLAKE2S_IV0 ^ (0x01010000 | BLAKE2S_HASH_SIZE),
++ BLAKE2S_IV1, BLAKE2S_IV2, BLAKE2S_IV3, BLAKE2S_IV4,
++ BLAKE2S_IV5, BLAKE2S_IV6, BLAKE2S_IV7 },
++ .hash.outlen = BLAKE2S_HASH_SIZE,
++ .lock = __SPIN_LOCK_UNLOCKED(input_pool.lock),
+ };
+
+-#define INIT_TIMER_RAND_STATE { INITIAL_JIFFIES, };
++static void _mix_pool_bytes(const void *buf, size_t len)
++{
++ blake2s_update(&input_pool.hash, buf, len);
++}
+
+ /*
+- * Add device- or boot-specific data to the input pool to help
+- * initialize it.
+- *
+- * None of this adds any entropy; it is meant to avoid the problem of
+- * the entropy pool having similar initial state across largely
+- * identical devices.
++ * This function adds bytes into the input pool. It does not
++ * update the initialization bit counter; the caller should call
++ * credit_init_bits if this is appropriate.
+ */
+-void add_device_randomness(const void *buf, unsigned int size)
++static void mix_pool_bytes(const void *buf, size_t len)
+ {
+- unsigned long time = random_get_entropy() ^ jiffies;
+ unsigned long flags;
+
+- if (!crng_ready() && size)
+- crng_slow_load(buf, size);
+-
+- trace_add_device_randomness(size, _RET_IP_);
+ spin_lock_irqsave(&input_pool.lock, flags);
+- _mix_pool_bytes(&input_pool, buf, size);
+- _mix_pool_bytes(&input_pool, &time, sizeof(time));
++ _mix_pool_bytes(buf, len);
+ spin_unlock_irqrestore(&input_pool.lock, flags);
+ }
+-EXPORT_SYMBOL(add_device_randomness);
+-
+-static struct timer_rand_state input_timer_state = INIT_TIMER_RAND_STATE;
+
+ /*
+- * This function adds entropy to the entropy "pool" by using timing
+- * delays. It uses the timer_rand_state structure to make an estimate
+- * of how many bits of entropy this call has added to the pool.
+- *
+- * The number "num" is also added to the pool - it should somehow describe
+- * the type of event which just happened. This is currently 0-255 for
+- * keyboard scan codes, and 256 upwards for interrupts.
+- *
++ * This is an HKDF-like construction for using the hashed collected entropy
++ * as a PRF key, that's then expanded block-by-block.
+ */
+-static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
++static void extract_entropy(void *buf, size_t len)
+ {
+- struct entropy_store *r;
++ unsigned long flags;
++ u8 seed[BLAKE2S_HASH_SIZE], next_key[BLAKE2S_HASH_SIZE];
+ struct {
+- long jiffies;
+- unsigned cycles;
+- unsigned num;
+- } sample;
+- long delta, delta2, delta3;
+-
+- sample.jiffies = jiffies;
+- sample.cycles = random_get_entropy();
+- sample.num = num;
+- r = &input_pool;
+- mix_pool_bytes(r, &sample, sizeof(sample));
+-
+- /*
+- * Calculate number of bits of randomness we probably added.
+- * We take into account the first, second and third-order deltas
+- * in order to make our estimate.
+- */
+- delta = sample.jiffies - READ_ONCE(state->last_time);
+- WRITE_ONCE(state->last_time, sample.jiffies);
+-
+- delta2 = delta - READ_ONCE(state->last_delta);
+- WRITE_ONCE(state->last_delta, delta);
+-
+- delta3 = delta2 - READ_ONCE(state->last_delta2);
+- WRITE_ONCE(state->last_delta2, delta2);
+-
+- if (delta < 0)
+- delta = -delta;
+- if (delta2 < 0)
+- delta2 = -delta2;
+- if (delta3 < 0)
+- delta3 = -delta3;
+- if (delta > delta2)
+- delta = delta2;
+- if (delta > delta3)
+- delta = delta3;
+-
+- /*
+- * delta is now minimum absolute delta.
+- * Round down by 1 bit on general principles,
+- * and limit entropy entimate to 12 bits.
+- */
+- credit_entropy_bits(r, min_t(int, fls(delta>>1), 11));
+-}
+-
+-void add_input_randomness(unsigned int type, unsigned int code,
+- unsigned int value)
+-{
+- static unsigned char last_value;
+-
+- /* ignore autorepeat and the like */
+- if (value == last_value)
+- return;
++ unsigned long rdseed[32 / sizeof(long)];
++ size_t counter;
++ } block;
++ size_t i;
++
++ for (i = 0; i < ARRAY_SIZE(block.rdseed); ++i) {
++ if (!arch_get_random_seed_long(&block.rdseed[i]) &&
++ !arch_get_random_long(&block.rdseed[i]))
++ block.rdseed[i] = random_get_entropy();
++ }
+
+- last_value = value;
+- add_timer_randomness(&input_timer_state,
+- (type << 4) ^ code ^ (code >> 4) ^ value);
+- trace_add_input_randomness(ENTROPY_BITS(&input_pool));
+-}
+-EXPORT_SYMBOL_GPL(add_input_randomness);
++ spin_lock_irqsave(&input_pool.lock, flags);
+
+-static DEFINE_PER_CPU(struct fast_pool, irq_randomness);
++ /* seed = HASHPRF(last_key, entropy_input) */
++ blake2s_final(&input_pool.hash, seed);
+
+-#ifdef ADD_INTERRUPT_BENCH
+-static unsigned long avg_cycles, avg_deviation;
++ /* next_key = HASHPRF(seed, RDSEED || 0) */
++ block.counter = 0;
++ blake2s(next_key, (u8 *)&block, seed, sizeof(next_key), sizeof(block), sizeof(seed));
++ blake2s_init_key(&input_pool.hash, BLAKE2S_HASH_SIZE, next_key, sizeof(next_key));
+
+-#define AVG_SHIFT 8 /* Exponential average factor k=1/256 */
+-#define FIXED_1_2 (1 << (AVG_SHIFT-1))
++ spin_unlock_irqrestore(&input_pool.lock, flags);
++ memzero_explicit(next_key, sizeof(next_key));
++
++ while (len) {
++ i = min_t(size_t, len, BLAKE2S_HASH_SIZE);
++ /* output = HASHPRF(seed, RDSEED || ++counter) */
++ ++block.counter;
++ blake2s(buf, (u8 *)&block, seed, i, sizeof(block), sizeof(seed));
++ len -= i;
++ buf += i;
++ }
+
+-static void add_interrupt_bench(cycles_t start)
+-{
+- long delta = random_get_entropy() - start;
+-
+- /* Use a weighted moving average */
+- delta = delta - ((avg_cycles + FIXED_1_2) >> AVG_SHIFT);
+- avg_cycles += delta;
+- /* And average deviation */
+- delta = abs(delta) - ((avg_deviation + FIXED_1_2) >> AVG_SHIFT);
+- avg_deviation += delta;
++ memzero_explicit(seed, sizeof(seed));
++ memzero_explicit(&block, sizeof(block));
+ }
+-#else
+-#define add_interrupt_bench(x)
+-#endif
+
+-static __u32 get_reg(struct fast_pool *f, struct pt_regs *regs)
+-{
+- __u32 *ptr = (__u32 *) regs;
+- unsigned int idx;
+-
+- if (regs == NULL)
+- return 0;
+- idx = READ_ONCE(f->reg_idx);
+- if (idx >= sizeof(struct pt_regs) / sizeof(__u32))
+- idx = 0;
+- ptr += idx++;
+- WRITE_ONCE(f->reg_idx, idx);
+- return *ptr;
+-}
++#define credit_init_bits(bits) if (!crng_ready()) _credit_init_bits(bits)
+
+-void add_interrupt_randomness(int irq, int irq_flags)
++static void __cold _credit_init_bits(size_t bits)
+ {
+- struct entropy_store *r;
+- struct fast_pool *fast_pool = this_cpu_ptr(&irq_randomness);
+- struct pt_regs *regs = get_irq_regs();
+- unsigned long now = jiffies;
+- cycles_t cycles = random_get_entropy();
+- __u32 c_high, j_high;
+- __u64 ip;
+- unsigned long seed;
+- int credit = 0;
+-
+- if (cycles == 0)
+- cycles = get_reg(fast_pool, regs);
+- c_high = (sizeof(cycles) > 4) ? cycles >> 32 : 0;
+- j_high = (sizeof(now) > 4) ? now >> 32 : 0;
+- fast_pool->pool[0] ^= cycles ^ j_high ^ irq;
+- fast_pool->pool[1] ^= now ^ c_high;
+- ip = regs ? instruction_pointer(regs) : _RET_IP_;
+- fast_pool->pool[2] ^= ip;
+- fast_pool->pool[3] ^= (sizeof(ip) > 4) ? ip >> 32 :
+- get_reg(fast_pool, regs);
+-
+- fast_mix(fast_pool);
+- add_interrupt_bench(cycles);
+-
+- if (unlikely(crng_init == 0)) {
+- if ((fast_pool->count >= 64) &&
+- crng_fast_load((char *) fast_pool->pool,
+- sizeof(fast_pool->pool))) {
+- fast_pool->count = 0;
+- fast_pool->last = now;
+- }
+- return;
+- }
++ unsigned int new, orig, add;
++ unsigned long flags;
+
+- if ((fast_pool->count < 64) &&
+- !time_after(now, fast_pool->last + HZ))
++ if (!bits)
+ return;
+
+- r = &input_pool;
+- if (!spin_trylock(&r->lock))
+- return;
++ add = min_t(size_t, bits, POOL_BITS);
+
+- fast_pool->last = now;
+- __mix_pool_bytes(r, &fast_pool->pool, sizeof(fast_pool->pool));
++ do {
++ orig = READ_ONCE(input_pool.init_bits);
++ new = min_t(unsigned int, POOL_BITS, orig + add);
++ } while (cmpxchg(&input_pool.init_bits, orig, new) != orig);
+
+- /*
+- * If we have architectural seed generator, produce a seed and
+- * add it to the pool. For the sake of paranoia don't let the
+- * architectural seed generator dominate the input from the
+- * interrupt noise.
+- */
+- if (arch_get_random_seed_long(&seed)) {
+- __mix_pool_bytes(r, &seed, sizeof(seed));
+- credit = 1;
++ if (orig < POOL_READY_BITS && new >= POOL_READY_BITS) {
++ crng_reseed(); /* Sets crng_init to CRNG_READY under base_crng.lock. */
++ process_random_ready_list();
++ wake_up_interruptible(&crng_init_wait);
++ kill_fasync(&fasync, SIGIO, POLL_IN);
++ pr_notice("crng init done\n");
++ if (urandom_warning.missed)
++ pr_notice("%d urandom warning(s) missed due to ratelimiting\n",
++ urandom_warning.missed);
++ } else if (orig < POOL_EARLY_BITS && new >= POOL_EARLY_BITS) {
++ spin_lock_irqsave(&base_crng.lock, flags);
++ /* Check if crng_init is CRNG_EMPTY, to avoid race with crng_reseed(). */
++ if (crng_init == CRNG_EMPTY) {
++ extract_entropy(base_crng.key, sizeof(base_crng.key));
++ crng_init = CRNG_EARLY;
++ }
++ spin_unlock_irqrestore(&base_crng.lock, flags);
+ }
+- spin_unlock(&r->lock);
+-
+- fast_pool->count = 0;
+-
+- /* award one bit for the contents of the fast pool */
+- credit_entropy_bits(r, credit + 1);
+ }
+-EXPORT_SYMBOL_GPL(add_interrupt_randomness);
+
+-#ifdef CONFIG_BLOCK
+-void add_disk_randomness(struct gendisk *disk)
+-{
+- if (!disk || !disk->random)
+- return;
+- /* first major is 1, so we get >= 0x200 here */
+- add_timer_randomness(disk->random, 0x100 + disk_devt(disk));
+- trace_add_disk_randomness(disk_devt(disk), ENTROPY_BITS(&input_pool));
+-}
+-EXPORT_SYMBOL_GPL(add_disk_randomness);
+-#endif
+
+-/*********************************************************************
++/**********************************************************************
+ *
+- * Entropy extraction routines
++ * Entropy collection routines.
+ *
+- *********************************************************************/
+-
+-/*
+- * This utility inline function is responsible for transferring entropy
+- * from the primary pool to the secondary extraction pool. We make
+- * sure we pull enough for a 'catastrophic reseed'.
+- */
+-static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes);
+-static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
+-{
+- if (!r->pull ||
+- r->entropy_count >= (nbytes << (ENTROPY_SHIFT + 3)) ||
+- r->entropy_count > r->poolinfo->poolfracbits)
+- return;
+-
+- _xfer_secondary_pool(r, nbytes);
+-}
++ * The following exported functions are used for pushing entropy into
++ * the above entropy accumulation routines:
++ *
++ * void add_device_randomness(const void *buf, size_t len);
++ * void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy);
++ * void add_bootloader_randomness(const void *buf, size_t len);
++ * void add_interrupt_randomness(int irq);
++ * void add_input_randomness(unsigned int type, unsigned int code, unsigned int value);
++ * void add_disk_randomness(struct gendisk *disk);
++ *
++ * add_device_randomness() adds data to the input pool that
++ * is likely to differ between two devices (or possibly even per boot).
++ * This would be things like MAC addresses or serial numbers, or the
++ * read-out of the RTC. This does *not* credit any actual entropy to
++ * the pool, but it initializes the pool to different values for devices
++ * that might otherwise be identical and have very little entropy
++ * available to them (particularly common in the embedded world).
++ *
++ * add_hwgenerator_randomness() is for true hardware RNGs, and will credit
++ * entropy as specified by the caller. If the entropy pool is full it will
++ * block until more entropy is needed.
++ *
++ * add_bootloader_randomness() is called by bootloader drivers, such as EFI
++ * and device tree, and credits its input depending on whether or not the
++ * configuration option CONFIG_RANDOM_TRUST_BOOTLOADER is set.
++ *
++ * add_interrupt_randomness() uses the interrupt timing as random
++ * inputs to the entropy pool. Using the cycle counters and the irq source
++ * as inputs, it feeds the input pool roughly once a second or after 64
++ * interrupts, crediting 1 bit of entropy for whichever comes first.
++ *
++ * add_input_randomness() uses the input layer interrupt timing, as well
++ * as the event type information from the hardware.
++ *
++ * add_disk_randomness() uses what amounts to the seek time of block
++ * layer request events, on a per-disk_devt basis, as input to the
++ * entropy pool. Note that high-speed solid state drives with very low
++ * seek times do not make for good sources of entropy, as their seek
++ * times are usually fairly consistent.
++ *
++ * The last two routines try to estimate how many bits of entropy
++ * to credit. They do this by keeping track of the first and second
++ * order deltas of the event timings.
++ *
++ **********************************************************************/
+
+-static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
++static bool trust_cpu __initdata = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU);
++static bool trust_bootloader __initdata = IS_ENABLED(CONFIG_RANDOM_TRUST_BOOTLOADER);
++static int __init parse_trust_cpu(char *arg)
+ {
+- __u32 tmp[OUTPUT_POOL_WORDS];
+-
+- int bytes = nbytes;
+-
+- /* pull at least as much as a wakeup */
+- bytes = max_t(int, bytes, random_read_wakeup_bits / 8);
+- /* but never more than the buffer size */
+- bytes = min_t(int, bytes, sizeof(tmp));
+-
+- trace_xfer_secondary_pool(r->name, bytes * 8, nbytes * 8,
+- ENTROPY_BITS(r), ENTROPY_BITS(r->pull));
+- bytes = extract_entropy(r->pull, tmp, bytes,
+- random_read_wakeup_bits / 8, 0);
+- mix_pool_bytes(r, tmp, bytes);
+- credit_entropy_bits(r, bytes*8);
++ return kstrtobool(arg, &trust_cpu);
+ }
+-
+-/*
+- * Used as a workqueue function so that when the input pool is getting
+- * full, we can "spill over" some entropy to the output pools. That
+- * way the output pools can store some of the excess entropy instead
+- * of letting it go to waste.
+- */
+-static void push_to_pool(struct work_struct *work)
++static int __init parse_trust_bootloader(char *arg)
+ {
+- struct entropy_store *r = container_of(work, struct entropy_store,
+- push_work);
+- BUG_ON(!r);
+- _xfer_secondary_pool(r, random_read_wakeup_bits/8);
+- trace_push_to_pool(r->name, r->entropy_count >> ENTROPY_SHIFT,
+- r->pull->entropy_count >> ENTROPY_SHIFT);
++ return kstrtobool(arg, &trust_bootloader);
+ }
++early_param("random.trust_cpu", parse_trust_cpu);
++early_param("random.trust_bootloader", parse_trust_bootloader);
+
+ /*
+- * This function decides how many bytes to actually take from the
+- * given pool, and also debits the entropy count accordingly.
++ * The first collection of entropy occurs at system boot while interrupts
++ * are still turned off. Here we push in latent entropy, RDSEED, a timestamp,
++ * utsname(), and the command line. Depending on the above configuration knob,
++ * RDSEED may be considered sufficient for initialization. Note that much
++ * earlier setup may already have pushed entropy into the input pool by the
++ * time we get here.
+ */
+-static size_t account(struct entropy_store *r, size_t nbytes, int min,
+- int reserved)
++int __init random_init(const char *command_line)
+ {
+- int entropy_count, orig, have_bytes;
+- size_t ibytes, nfrac;
+-
+- BUG_ON(r->entropy_count > r->poolinfo->poolfracbits);
+-
+- /* Can we pull enough? */
+-retry:
+- entropy_count = orig = READ_ONCE(r->entropy_count);
+- ibytes = nbytes;
+- /* never pull more than available */
+- have_bytes = entropy_count >> (ENTROPY_SHIFT + 3);
+-
+- if ((have_bytes -= reserved) < 0)
+- have_bytes = 0;
+- ibytes = min_t(size_t, ibytes, have_bytes);
+- if (ibytes < min)
+- ibytes = 0;
+-
+- if (unlikely(entropy_count < 0)) {
+- pr_warn("random: negative entropy count: pool %s count %d\n",
+- r->name, entropy_count);
+- WARN_ON(1);
+- entropy_count = 0;
+- }
+- nfrac = ibytes << (ENTROPY_SHIFT + 3);
+- if ((size_t) entropy_count > nfrac)
+- entropy_count -= nfrac;
+- else
+- entropy_count = 0;
++ ktime_t now = ktime_get_real();
++ unsigned int i, arch_bits;
++ unsigned long entropy;
+
+- if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
+- goto retry;
++#if defined(LATENT_ENTROPY_PLUGIN)
++ static const u8 compiletime_seed[BLAKE2S_BLOCK_SIZE] __initconst __latent_entropy;
++ _mix_pool_bytes(compiletime_seed, sizeof(compiletime_seed));
++#endif
+
+- trace_debit_entropy(r->name, 8 * ibytes);
+- if (ibytes &&
+- (r->entropy_count >> ENTROPY_SHIFT) < random_write_wakeup_bits) {
+- wake_up_interruptible(&random_write_wait);
+- kill_fasync(&fasync, SIGIO, POLL_OUT);
++ for (i = 0, arch_bits = BLAKE2S_BLOCK_SIZE * 8;
++ i < BLAKE2S_BLOCK_SIZE; i += sizeof(entropy)) {
++ if (!arch_get_random_seed_long_early(&entropy) &&
++ !arch_get_random_long_early(&entropy)) {
++ entropy = random_get_entropy();
++ arch_bits -= sizeof(entropy) * 8;
++ }
++ _mix_pool_bytes(&entropy, sizeof(entropy));
+ }
++ _mix_pool_bytes(&now, sizeof(now));
++ _mix_pool_bytes(utsname(), sizeof(*(utsname())));
++ _mix_pool_bytes(command_line, strlen(command_line));
++ add_latent_entropy();
+
+- return ibytes;
++ if (crng_ready())
++ crng_reseed();
++ else if (trust_cpu)
++ _credit_init_bits(arch_bits);
++
++ return 0;
+ }
+
+ /*
+- * This function does the actual extraction for extract_entropy and
+- * extract_entropy_user.
++ * Add device- or boot-specific data to the input pool to help
++ * initialize it.
+ *
+- * Note: we assume that .poolwords is a multiple of 16 words.
++ * None of this adds any entropy; it is meant to avoid the problem of
++ * the entropy pool having similar initial state across largely
++ * identical devices.
+ */
+-static void extract_buf(struct entropy_store *r, __u8 *out)
+-{
+- int i;
+- union {
+- __u32 w[5];
+- unsigned long l[LONGS(20)];
+- } hash;
+- __u32 workspace[SHA_WORKSPACE_WORDS];
+- unsigned long flags;
+-
+- /*
+- * If we have an architectural hardware random number
+- * generator, use it for SHA's initial vector
+- */
+- sha_init(hash.w);
+- for (i = 0; i < LONGS(20); i++) {
+- unsigned long v;
+- if (!arch_get_random_long(&v))
+- break;
+- hash.l[i] = v;
+- }
+-
+- /* Generate a hash across the pool, 16 words (512 bits) at a time */
+- spin_lock_irqsave(&r->lock, flags);
+- for (i = 0; i < r->poolinfo->poolwords; i += 16)
+- sha_transform(hash.w, (__u8 *)(r->pool + i), workspace);
+-
+- /*
+- * We mix the hash back into the pool to prevent backtracking
+- * attacks (where the attacker knows the state of the pool
+- * plus the current outputs, and attempts to find previous
+- * ouputs), unless the hash function can be inverted. By
+- * mixing at least a SHA1 worth of hash data back, we make
+- * brute-forcing the feedback as hard as brute-forcing the
+- * hash.
+- */
+- __mix_pool_bytes(r, hash.w, sizeof(hash.w));
+- spin_unlock_irqrestore(&r->lock, flags);
+-
+- memzero_explicit(workspace, sizeof(workspace));
+-
+- /*
+- * In case the hash function has some recognizable output
+- * pattern, we fold it in half. Thus, we always feed back
+- * twice as much data as we output.
+- */
+- hash.w[0] ^= hash.w[3];
+- hash.w[1] ^= hash.w[4];
+- hash.w[2] ^= rol32(hash.w[2], 16);
+-
+- memcpy(out, &hash, EXTRACT_SIZE);
+- memzero_explicit(&hash, sizeof(hash));
+-}
+-
+-static ssize_t _extract_entropy(struct entropy_store *r, void *buf,
+- size_t nbytes, int fips)
++void add_device_randomness(const void *buf, size_t len)
+ {
+- ssize_t ret = 0, i;
+- __u8 tmp[EXTRACT_SIZE];
++ unsigned long entropy = random_get_entropy();
+ unsigned long flags;
+
+- while (nbytes) {
+- extract_buf(r, tmp);
+-
+- if (fips) {
+- spin_lock_irqsave(&r->lock, flags);
+- if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
+- panic("Hardware RNG duplicated output!\n");
+- memcpy(r->last_data, tmp, EXTRACT_SIZE);
+- spin_unlock_irqrestore(&r->lock, flags);
+- }
+- i = min_t(int, nbytes, EXTRACT_SIZE);
+- memcpy(buf, tmp, i);
+- nbytes -= i;
+- buf += i;
+- ret += i;
+- }
+-
+- /* Wipe data just returned from memory */
+- memzero_explicit(tmp, sizeof(tmp));
+-
+- return ret;
++ spin_lock_irqsave(&input_pool.lock, flags);
++ _mix_pool_bytes(&entropy, sizeof(entropy));
++ _mix_pool_bytes(buf, len);
++ spin_unlock_irqrestore(&input_pool.lock, flags);
+ }
++EXPORT_SYMBOL(add_device_randomness);
+
+ /*
+- * This function extracts randomness from the "entropy pool", and
+- * returns it in a buffer.
+- *
+- * The min parameter specifies the minimum amount we can pull before
+- * failing to avoid races that defeat catastrophic reseeding while the
+- * reserved parameter indicates how much entropy we must leave in the
+- * pool after each pull to avoid starving other readers.
++ * Interface for in-kernel drivers of true hardware RNGs.
++ * Those devices may produce endless random bits and will be throttled
++ * when our pool is full.
+ */
+-static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+- size_t nbytes, int min, int reserved)
++void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy)
+ {
+- __u8 tmp[EXTRACT_SIZE];
+- unsigned long flags;
++ mix_pool_bytes(buf, len);
++ credit_init_bits(entropy);
+
+- /* if last_data isn't primed, we need EXTRACT_SIZE extra bytes */
+- if (fips_enabled) {
+- spin_lock_irqsave(&r->lock, flags);
+- if (!r->last_data_init) {
+- r->last_data_init = 1;
+- spin_unlock_irqrestore(&r->lock, flags);
+- trace_extract_entropy(r->name, EXTRACT_SIZE,
+- ENTROPY_BITS(r), _RET_IP_);
+- xfer_secondary_pool(r, EXTRACT_SIZE);
+- extract_buf(r, tmp);
+- spin_lock_irqsave(&r->lock, flags);
+- memcpy(r->last_data, tmp, EXTRACT_SIZE);
+- }
+- spin_unlock_irqrestore(&r->lock, flags);
+- }
+-
+- trace_extract_entropy(r->name, nbytes, ENTROPY_BITS(r), _RET_IP_);
+- xfer_secondary_pool(r, nbytes);
+- nbytes = account(r, nbytes, min, reserved);
+-
+- return _extract_entropy(r, buf, nbytes, fips_enabled);
++ /*
++ * Throttle writing to once every CRNG_RESEED_INTERVAL, unless
++ * we're not yet initialized.
++ */
++ if (!kthread_should_stop() && crng_ready())
++ schedule_timeout_interruptible(CRNG_RESEED_INTERVAL);
+ }
++EXPORT_SYMBOL_GPL(add_hwgenerator_randomness);
+
+ /*
+- * This function extracts randomness from the "entropy pool", and
+- * returns it in a userspace buffer.
++ * Handle random seed passed by bootloader, and credit it if
++ * CONFIG_RANDOM_TRUST_BOOTLOADER is set.
+ */
+-static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
+- size_t nbytes)
++void __init add_bootloader_randomness(const void *buf, size_t len)
+ {
+- ssize_t ret = 0, i;
+- __u8 tmp[EXTRACT_SIZE];
+- int large_request = (nbytes > 256);
+-
+- trace_extract_entropy_user(r->name, nbytes, ENTROPY_BITS(r), _RET_IP_);
+- xfer_secondary_pool(r, nbytes);
+- nbytes = account(r, nbytes, 0, 0);
+-
+- while (nbytes) {
+- if (large_request && need_resched()) {
+- if (signal_pending(current)) {
+- if (ret == 0)
+- ret = -ERESTARTSYS;
+- break;
+- }
+- schedule();
+- }
+-
+- extract_buf(r, tmp);
+- i = min_t(int, nbytes, EXTRACT_SIZE);
+- if (copy_to_user(buf, tmp, i)) {
+- ret = -EFAULT;
+- break;
+- }
+-
+- nbytes -= i;
+- buf += i;
+- ret += i;
+- }
+-
+- /* Wipe data just returned from memory */
+- memzero_explicit(tmp, sizeof(tmp));
+-
+- return ret;
++ mix_pool_bytes(buf, len);
++ if (trust_bootloader)
++ credit_init_bits(len * 8);
+ }
+
+-#define warn_unseeded_randomness(previous) \
+- _warn_unseeded_randomness(__func__, (void *) _RET_IP_, (previous))
++struct fast_pool {
++ struct work_struct mix;
++ unsigned long pool[4];
++ unsigned long last;
++ unsigned int count;
++};
+
+-static void _warn_unseeded_randomness(const char *func_name, void *caller,
+- void **previous)
+-{
+-#ifdef CONFIG_WARN_ALL_UNSEEDED_RANDOM
+- const bool print_once = false;
++static DEFINE_PER_CPU(struct fast_pool, irq_randomness) = {
++#ifdef CONFIG_64BIT
++#define FASTMIX_PERM SIPHASH_PERMUTATION
++ .pool = { SIPHASH_CONST_0, SIPHASH_CONST_1, SIPHASH_CONST_2, SIPHASH_CONST_3 }
+ #else
+- static bool print_once __read_mostly;
+-#endif
+-
+- if (print_once ||
+- crng_ready() ||
+- (previous && (caller == READ_ONCE(*previous))))
+- return;
+- WRITE_ONCE(*previous, caller);
+-#ifndef CONFIG_WARN_ALL_UNSEEDED_RANDOM
+- print_once = true;
++#define FASTMIX_PERM HSIPHASH_PERMUTATION
++ .pool = { HSIPHASH_CONST_0, HSIPHASH_CONST_1, HSIPHASH_CONST_2, HSIPHASH_CONST_3 }
+ #endif
+- if (__ratelimit(&unseeded_warning))
+- pr_notice("random: %s called from %pS with crng_init=%d\n",
+- func_name, caller, crng_init);
+-}
++};
+
+ /*
+- * This function is the exported kernel interface. It returns some
+- * number of good random numbers, suitable for key generation, seeding
+- * TCP sequence numbers, etc. It does not rely on the hardware random
+- * number generator. For random bytes direct from the hardware RNG
+- * (when available), use get_random_bytes_arch(). In order to ensure
+- * that the randomness provided by this function is okay, the function
+- * wait_for_random_bytes() should be called and return 0 at least once
+- * at any point prior.
++ * This is [Half]SipHash-1-x, starting from an empty key. Because
++ * the key is fixed, it assumes that its inputs are non-malicious,
++ * and therefore this has no security on its own. s represents the
++ * four-word SipHash state, while v represents a two-word input.
+ */
+-static void _get_random_bytes(void *buf, int nbytes)
+-{
+- __u8 tmp[CHACHA20_BLOCK_SIZE] __aligned(4);
+-
+- trace_get_random_bytes(nbytes, _RET_IP_);
+-
+- while (nbytes >= CHACHA20_BLOCK_SIZE) {
+- extract_crng(buf);
+- buf += CHACHA20_BLOCK_SIZE;
+- nbytes -= CHACHA20_BLOCK_SIZE;
+- }
+-
+- if (nbytes > 0) {
+- extract_crng(tmp);
+- memcpy(buf, tmp, nbytes);
+- crng_backtrack_protect(tmp, nbytes);
+- } else
+- crng_backtrack_protect(tmp, CHACHA20_BLOCK_SIZE);
+- memzero_explicit(tmp, sizeof(tmp));
+-}
+-
+-void get_random_bytes(void *buf, int nbytes)
++static void fast_mix(unsigned long s[4], unsigned long v1, unsigned long v2)
+ {
+- static void *previous;
+-
+- warn_unseeded_randomness(&previous);
+- _get_random_bytes(buf, nbytes);
++ s[3] ^= v1;
++ FASTMIX_PERM(s[0], s[1], s[2], s[3]);
++ s[0] ^= v1;
++ s[3] ^= v2;
++ FASTMIX_PERM(s[0], s[1], s[2], s[3]);
++ s[0] ^= v2;
+ }
+-EXPORT_SYMBOL(get_random_bytes);
+-
+
++#ifdef CONFIG_SMP
+ /*
+- * Each time the timer fires, we expect that we got an unpredictable
+- * jump in the cycle counter. Even if the timer is running on another
+- * CPU, the timer activity will be touching the stack of the CPU that is
+- * generating entropy..
+- *
+- * Note that we don't re-arm the timer in the timer itself - we are
+- * happy to be scheduled away, since that just makes the load more
+- * complex, but we do not want the timer to keep ticking unless the
+- * entropy loop is running.
+- *
+- * So the re-arming always happens in the entropy loop itself.
++ * This function is called when the CPU has just come online, with
++ * entry CPUHP_AP_RANDOM_ONLINE, just after CPUHP_AP_WORKQUEUE_ONLINE.
+ */
+-static void entropy_timer(struct timer_list *t)
++int __cold random_online_cpu(unsigned int cpu)
+ {
+- credit_entropy_bits(&input_pool, 1);
++ /*
++ * During CPU shutdown and before CPU onlining, add_interrupt_
++ * randomness() may schedule mix_interrupt_randomness(), and
++ * set the MIX_INFLIGHT flag. However, because the worker can
++ * be scheduled on a different CPU during this period, that
++ * flag will never be cleared. For that reason, we zero out
++ * the flag here, which runs just after workqueues are onlined
++ * for the CPU again. This also has the effect of setting the
++ * irq randomness count to zero so that new accumulated irqs
++ * are fresh.
++ */
++ per_cpu_ptr(&irq_randomness, cpu)->count = 0;
++ return 0;
+ }
++#endif
+
+-/*
+- * If we have an actual cycle counter, see if we can
+- * generate enough entropy with timing noise
+- */
+-static void try_to_generate_entropy(void)
++static void mix_interrupt_randomness(struct work_struct *work)
+ {
+- struct {
+- unsigned long now;
+- struct timer_list timer;
+- } stack;
+-
+- stack.now = random_get_entropy();
++ struct fast_pool *fast_pool = container_of(work, struct fast_pool, mix);
++ /*
++ * The size of the copied stack pool is explicitly 2 longs so that we
++ * only ever ingest half of the siphash output each time, retaining
++ * the other half as the next "key" that carries over. The entropy is
++ * supposed to be sufficiently dispersed between bits so on average
++ * we don't wind up "losing" some.
++ */
++ unsigned long pool[2];
++ unsigned int count;
+
+- /* Slow counter - or none. Don't even bother */
+- if (stack.now == random_get_entropy())
++ /* Check to see if we're running on the wrong CPU due to hotplug. */
++ local_irq_disable();
++ if (fast_pool != this_cpu_ptr(&irq_randomness)) {
++ local_irq_enable();
+ return;
+-
+- timer_setup_on_stack(&stack.timer, entropy_timer, 0);
+- while (!crng_ready()) {
+- if (!timer_pending(&stack.timer))
+- mod_timer(&stack.timer, jiffies+1);
+- mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now));
+- schedule();
+- stack.now = random_get_entropy();
+ }
+
+- del_timer_sync(&stack.timer);
+- destroy_timer_on_stack(&stack.timer);
+- mix_pool_bytes(&input_pool, &stack.now, sizeof(stack.now));
+-}
+-
+-/*
+- * Wait for the urandom pool to be seeded and thus guaranteed to supply
+- * cryptographically secure random numbers. This applies to: the /dev/urandom
+- * device, the get_random_bytes function, and the get_random_{u32,u64,int,long}
+- * family of functions. Using any of these functions without first calling
+- * this function forfeits the guarantee of security.
+- *
+- * Returns: 0 if the urandom pool has been seeded.
+- * -ERESTARTSYS if the function was interrupted by a signal.
+- */
+-int wait_for_random_bytes(void)
+-{
+- if (likely(crng_ready()))
+- return 0;
+-
+- do {
+- int ret;
+- ret = wait_event_interruptible_timeout(crng_init_wait, crng_ready(), HZ);
+- if (ret)
+- return ret > 0 ? 0 : ret;
++ /*
++ * Copy the pool to the stack so that the mixer always has a
++ * consistent view, before we reenable irqs again.
++ */
++ memcpy(pool, fast_pool->pool, sizeof(pool));
++ count = fast_pool->count;
++ fast_pool->count = 0;
++ fast_pool->last = jiffies;
++ local_irq_enable();
+
+- try_to_generate_entropy();
+- } while (!crng_ready());
++ mix_pool_bytes(pool, sizeof(pool));
++ credit_init_bits(max(1u, (count & U16_MAX) / 64));
+
+- return 0;
++ memzero_explicit(pool, sizeof(pool));
+ }
+-EXPORT_SYMBOL(wait_for_random_bytes);
+
+-/*
+- * Returns whether or not the urandom pool has been seeded and thus guaranteed
+- * to supply cryptographically secure random numbers. This applies to: the
+- * /dev/urandom device, the get_random_bytes function, and the get_random_{u32,
+- * ,u64,int,long} family of functions.
+- *
+- * Returns: true if the urandom pool has been seeded.
+- * false if the urandom pool has not been seeded.
+- */
+-bool rng_is_initialized(void)
++void add_interrupt_randomness(int irq)
+ {
+- return crng_ready();
+-}
+-EXPORT_SYMBOL(rng_is_initialized);
++ enum { MIX_INFLIGHT = 1U << 31 };
++ unsigned long entropy = random_get_entropy();
++ struct fast_pool *fast_pool = this_cpu_ptr(&irq_randomness);
++ struct pt_regs *regs = get_irq_regs();
++ unsigned int new_count;
+
+-/*
+- * Add a callback function that will be invoked when the nonblocking
+- * pool is initialised.
+- *
+- * returns: 0 if callback is successfully added
+- * -EALREADY if pool is already initialised (callback not called)
+- * -ENOENT if module for callback is not alive
+- */
+-int add_random_ready_callback(struct random_ready_callback *rdy)
+-{
+- struct module *owner;
+- unsigned long flags;
+- int err = -EALREADY;
+-
+- if (crng_ready())
+- return err;
+-
+- owner = rdy->owner;
+- if (!try_module_get(owner))
+- return -ENOENT;
+-
+- spin_lock_irqsave(&random_ready_list_lock, flags);
+- if (crng_ready())
+- goto out;
+-
+- owner = NULL;
+-
+- list_add(&rdy->list, &random_ready_list);
+- err = 0;
++ fast_mix(fast_pool->pool, entropy,
++ (regs ? instruction_pointer(regs) : _RET_IP_) ^ swab(irq));
++ new_count = ++fast_pool->count;
+
+-out:
+- spin_unlock_irqrestore(&random_ready_list_lock, flags);
++ if (new_count & MIX_INFLIGHT)
++ return;
+
+- module_put(owner);
++ if (new_count < 64 && !time_is_before_jiffies(fast_pool->last + HZ))
++ return;
+
+- return err;
++ if (unlikely(!fast_pool->mix.func))
++ INIT_WORK(&fast_pool->mix, mix_interrupt_randomness);
++ fast_pool->count |= MIX_INFLIGHT;
++ queue_work_on(raw_smp_processor_id(), system_highpri_wq, &fast_pool->mix);
+ }
+-EXPORT_SYMBOL(add_random_ready_callback);
++EXPORT_SYMBOL_GPL(add_interrupt_randomness);
++
++/* There is one of these per entropy source */
++struct timer_rand_state {
++ unsigned long last_time;
++ long last_delta, last_delta2;
++};
+
+ /*
+- * Delete a previously registered readiness callback function.
++ * This function adds entropy to the entropy "pool" by using timing
++ * delays. It uses the timer_rand_state structure to make an estimate
++ * of how many bits of entropy this call has added to the pool. The
++ * value "num" is also added to the pool; it should somehow describe
++ * the type of event that just happened.
+ */
+-void del_random_ready_callback(struct random_ready_callback *rdy)
++static void add_timer_randomness(struct timer_rand_state *state, unsigned int num)
+ {
+- unsigned long flags;
+- struct module *owner = NULL;
++ unsigned long entropy = random_get_entropy(), now = jiffies, flags;
++ long delta, delta2, delta3;
++ unsigned int bits;
+
+- spin_lock_irqsave(&random_ready_list_lock, flags);
+- if (!list_empty(&rdy->list)) {
+- list_del_init(&rdy->list);
+- owner = rdy->owner;
++ /*
++ * If we're in a hard IRQ, add_interrupt_randomness() will be called
++ * sometime after, so mix into the fast pool.
++ */
++ if (in_irq()) {
++ fast_mix(this_cpu_ptr(&irq_randomness)->pool, entropy, num);
++ } else {
++ spin_lock_irqsave(&input_pool.lock, flags);
++ _mix_pool_bytes(&entropy, sizeof(entropy));
++ _mix_pool_bytes(&num, sizeof(num));
++ spin_unlock_irqrestore(&input_pool.lock, flags);
+ }
+- spin_unlock_irqrestore(&random_ready_list_lock, flags);
+
+- module_put(owner);
+-}
+-EXPORT_SYMBOL(del_random_ready_callback);
++ if (crng_ready())
++ return;
+
+-/*
+- * This function will use the architecture-specific hardware random
+- * number generator if it is available. The arch-specific hw RNG will
+- * almost certainly be faster than what we can do in software, but it
+- * is impossible to verify that it is implemented securely (as
+- * opposed, to, say, the AES encryption of a sequence number using a
+- * key known by the NSA). So it's useful if we need the speed, but
+- * only if we're willing to trust the hardware manufacturer not to
+- * have put in a back door.
+- *
+- * Return number of bytes filled in.
+- */
+-int __must_check get_random_bytes_arch(void *buf, int nbytes)
+-{
+- int left = nbytes;
+- char *p = buf;
++ /*
++ * Calculate number of bits of randomness we probably added.
++ * We take into account the first, second and third-order deltas
++ * in order to make our estimate.
++ */
++ delta = now - READ_ONCE(state->last_time);
++ WRITE_ONCE(state->last_time, now);
+
+- trace_get_random_bytes_arch(left, _RET_IP_);
+- while (left) {
+- unsigned long v;
+- int chunk = min_t(int, left, sizeof(unsigned long));
++ delta2 = delta - READ_ONCE(state->last_delta);
++ WRITE_ONCE(state->last_delta, delta);
+
+- if (!arch_get_random_long(&v))
+- break;
++ delta3 = delta2 - READ_ONCE(state->last_delta2);
++ WRITE_ONCE(state->last_delta2, delta2);
+
+- memcpy(p, &v, chunk);
+- p += chunk;
+- left -= chunk;
+- }
++ if (delta < 0)
++ delta = -delta;
++ if (delta2 < 0)
++ delta2 = -delta2;
++ if (delta3 < 0)
++ delta3 = -delta3;
++ if (delta > delta2)
++ delta = delta2;
++ if (delta > delta3)
++ delta = delta3;
+
+- return nbytes - left;
++ /*
++ * delta is now minimum absolute delta. Round down by 1 bit
++ * on general principles, and limit entropy estimate to 11 bits.
++ */
++ bits = min(fls(delta >> 1), 11);
++
++ /*
++ * As mentioned above, if we're in a hard IRQ, add_interrupt_randomness()
++ * will run after this, which uses a different crediting scheme of 1 bit
++ * per every 64 interrupts. In order to let that function do accounting
++ * close to the one in this function, we credit a full 64/64 bit per bit,
++ * and then subtract one to account for the extra one added.
++ */
++ if (in_irq())
++ this_cpu_ptr(&irq_randomness)->count += max(1u, bits * 64) - 1;
++ else
++ _credit_init_bits(bits);
+ }
+-EXPORT_SYMBOL(get_random_bytes_arch);
+
+-/*
+- * init_std_data - initialize pool with system data
+- *
+- * @r: pool to initialize
+- *
+- * This function clears the pool's entropy count and mixes some system
+- * data into the pool to prepare it for use. The pool is not cleared
+- * as that can only decrease the entropy in the pool.
+- */
+-static void init_std_data(struct entropy_store *r)
++void add_input_randomness(unsigned int type, unsigned int code, unsigned int value)
+ {
+- int i;
+- ktime_t now = ktime_get_real();
+- unsigned long rv;
+-
+- r->last_pulled = jiffies;
+- mix_pool_bytes(r, &now, sizeof(now));
+- for (i = r->poolinfo->poolbytes; i > 0; i -= sizeof(rv)) {
+- if (!arch_get_random_seed_long(&rv) &&
+- !arch_get_random_long(&rv))
+- rv = random_get_entropy();
+- mix_pool_bytes(r, &rv, sizeof(rv));
+- }
+- mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
++ static unsigned char last_value;
++ static struct timer_rand_state input_timer_state = { INITIAL_JIFFIES };
++
++ /* Ignore autorepeat and the like. */
++ if (value == last_value)
++ return;
++
++ last_value = value;
++ add_timer_randomness(&input_timer_state,
++ (type << 4) ^ code ^ (code >> 4) ^ value);
+ }
++EXPORT_SYMBOL_GPL(add_input_randomness);
+
+-/*
+- * Note that setup_arch() may call add_device_randomness()
+- * long before we get here. This allows seeding of the pools
+- * with some platform dependent data very early in the boot
+- * process. But it limits our options here. We must use
+- * statically allocated structures that already have all
+- * initializations complete at compile time. We should also
+- * take care not to overwrite the precious per platform data
+- * we were given.
+- */
+-static int rand_initialize(void)
++#ifdef CONFIG_BLOCK
++void add_disk_randomness(struct gendisk *disk)
+ {
+- init_std_data(&input_pool);
+- init_std_data(&blocking_pool);
+- crng_initialize(&primary_crng);
+- crng_global_init_time = jiffies;
+- if (ratelimit_disable) {
+- urandom_warning.interval = 0;
+- unseeded_warning.interval = 0;
+- }
+- return 0;
++ if (!disk || !disk->random)
++ return;
++ /* First major is 1, so we get >= 0x200 here. */
++ add_timer_randomness(disk->random, 0x100 + disk_devt(disk));
+ }
+-early_initcall(rand_initialize);
++EXPORT_SYMBOL_GPL(add_disk_randomness);
+
+-#ifdef CONFIG_BLOCK
+-void rand_initialize_disk(struct gendisk *disk)
++void __cold rand_initialize_disk(struct gendisk *disk)
+ {
+ struct timer_rand_state *state;
+
+@@ -1910,134 +1126,189 @@ void rand_initialize_disk(struct gendisk *disk)
+ }
+ #endif
+
+-static ssize_t
+-_random_read(int nonblock, char __user *buf, size_t nbytes)
++/*
++ * Each time the timer fires, we expect that we got an unpredictable
++ * jump in the cycle counter. Even if the timer is running on another
++ * CPU, the timer activity will be touching the stack of the CPU that is
++ * generating entropy..
++ *
++ * Note that we don't re-arm the timer in the timer itself - we are
++ * happy to be scheduled away, since that just makes the load more
++ * complex, but we do not want the timer to keep ticking unless the
++ * entropy loop is running.
++ *
++ * So the re-arming always happens in the entropy loop itself.
++ */
++static void __cold entropy_timer(struct timer_list *t)
+ {
+- ssize_t n;
++ credit_init_bits(1);
++}
+
+- if (nbytes == 0)
+- return 0;
++/*
++ * If we have an actual cycle counter, see if we can
++ * generate enough entropy with timing noise
++ */
++static void __cold try_to_generate_entropy(void)
++{
++ struct {
++ unsigned long entropy;
++ struct timer_list timer;
++ } stack;
+
+- nbytes = min_t(size_t, nbytes, SEC_XFER_SIZE);
+- while (1) {
+- n = extract_entropy_user(&blocking_pool, buf, nbytes);
+- if (n < 0)
+- return n;
+- trace_random_read(n*8, (nbytes-n)*8,
+- ENTROPY_BITS(&blocking_pool),
+- ENTROPY_BITS(&input_pool));
+- if (n > 0)
+- return n;
+-
+- /* Pool is (near) empty. Maybe wait and retry. */
+- if (nonblock)
+- return -EAGAIN;
++ stack.entropy = random_get_entropy();
++
++ /* Slow counter - or none. Don't even bother */
++ if (stack.entropy == random_get_entropy())
++ return;
+
+- wait_event_interruptible(random_read_wait,
+- ENTROPY_BITS(&input_pool) >=
+- random_read_wakeup_bits);
+- if (signal_pending(current))
+- return -ERESTARTSYS;
++ timer_setup_on_stack(&stack.timer, entropy_timer, 0);
++ while (!crng_ready() && !signal_pending(current)) {
++ if (!timer_pending(&stack.timer))
++ mod_timer(&stack.timer, jiffies + 1);
++ mix_pool_bytes(&stack.entropy, sizeof(stack.entropy));
++ schedule();
++ stack.entropy = random_get_entropy();
+ }
+-}
+
+-static ssize_t
+-random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
+-{
+- return _random_read(file->f_flags & O_NONBLOCK, buf, nbytes);
++ del_timer_sync(&stack.timer);
++ destroy_timer_on_stack(&stack.timer);
++ mix_pool_bytes(&stack.entropy, sizeof(stack.entropy));
+ }
+
+-static ssize_t
+-urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
++
++/**********************************************************************
++ *
++ * Userspace reader/writer interfaces.
++ *
++ * getrandom(2) is the primary modern interface into the RNG and should
++ * be used in preference to anything else.
++ *
++ * Reading from /dev/random has the same functionality as calling
++ * getrandom(2) with flags=0. In earlier versions, however, it had
++ * vastly different semantics and should therefore be avoided, to
++ * prevent backwards compatibility issues.
++ *
++ * Reading from /dev/urandom has the same functionality as calling
++ * getrandom(2) with flags=GRND_INSECURE. Because it does not block
++ * waiting for the RNG to be ready, it should not be used.
++ *
++ * Writing to either /dev/random or /dev/urandom adds entropy to
++ * the input pool but does not credit it.
++ *
++ * Polling on /dev/random indicates when the RNG is initialized, on
++ * the read side, and when it wants new entropy, on the write side.
++ *
++ * Both /dev/random and /dev/urandom have the same set of ioctls for
++ * adding entropy, getting the entropy count, zeroing the count, and
++ * reseeding the crng.
++ *
++ **********************************************************************/
++
++SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags)
+ {
+- unsigned long flags;
+- static int maxwarn = 10;
++ struct iov_iter iter;
++ struct iovec iov;
+ int ret;
+
+- if (!crng_ready() && maxwarn > 0) {
+- maxwarn--;
+- if (__ratelimit(&urandom_warning))
+- printk(KERN_NOTICE "random: %s: uninitialized "
+- "urandom read (%zd bytes read)\n",
+- current->comm, nbytes);
+- spin_lock_irqsave(&primary_crng.lock, flags);
+- crng_init_cnt = 0;
+- spin_unlock_irqrestore(&primary_crng.lock, flags);
++ if (flags & ~(GRND_NONBLOCK | GRND_RANDOM | GRND_INSECURE))
++ return -EINVAL;
++
++ /*
++ * Requesting insecure and blocking randomness at the same time makes
++ * no sense.
++ */
++ if ((flags & (GRND_INSECURE | GRND_RANDOM)) == (GRND_INSECURE | GRND_RANDOM))
++ return -EINVAL;
++
++ if (!crng_ready() && !(flags & GRND_INSECURE)) {
++ if (flags & GRND_NONBLOCK)
++ return -EAGAIN;
++ ret = wait_for_random_bytes();
++ if (unlikely(ret))
++ return ret;
+ }
+- nbytes = min_t(size_t, nbytes, INT_MAX >> (ENTROPY_SHIFT + 3));
+- ret = extract_crng_user(buf, nbytes);
+- trace_urandom_read(8 * nbytes, 0, ENTROPY_BITS(&input_pool));
+- return ret;
++
++ ret = import_single_range(READ, ubuf, len, &iov, &iter);
++ if (unlikely(ret))
++ return ret;
++ return get_random_bytes_user(&iter);
+ }
+
+-static __poll_t
+-random_poll(struct file *file, poll_table * wait)
++static __poll_t random_poll(struct file *file, poll_table *wait)
+ {
+- __poll_t mask;
+-
+- poll_wait(file, &random_read_wait, wait);
+- poll_wait(file, &random_write_wait, wait);
+- mask = 0;
+- if (ENTROPY_BITS(&input_pool) >= random_read_wakeup_bits)
+- mask |= EPOLLIN | EPOLLRDNORM;
+- if (ENTROPY_BITS(&input_pool) < random_write_wakeup_bits)
+- mask |= EPOLLOUT | EPOLLWRNORM;
+- return mask;
++ poll_wait(file, &crng_init_wait, wait);
++ return crng_ready() ? EPOLLIN | EPOLLRDNORM : EPOLLOUT | EPOLLWRNORM;
+ }
+
+-static int
+-write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
++static ssize_t write_pool_user(struct iov_iter *iter)
+ {
+- size_t bytes;
+- __u32 t, buf[16];
+- const char __user *p = buffer;
++ u8 block[BLAKE2S_BLOCK_SIZE];
++ ssize_t ret = 0;
++ size_t copied;
+
+- while (count > 0) {
+- int b, i = 0;
++ if (unlikely(!iov_iter_count(iter)))
++ return 0;
+
+- bytes = min(count, sizeof(buf));
+- if (copy_from_user(&buf, p, bytes))
+- return -EFAULT;
++ for (;;) {
++ copied = copy_from_iter(block, sizeof(block), iter);
++ ret += copied;
++ mix_pool_bytes(block, copied);
++ if (!iov_iter_count(iter) || copied != sizeof(block))
++ break;
+
+- for (b = bytes ; b > 0 ; b -= sizeof(__u32), i++) {
+- if (!arch_get_random_int(&t))
++ BUILD_BUG_ON(PAGE_SIZE % sizeof(block) != 0);
++ if (ret % PAGE_SIZE == 0) {
++ if (signal_pending(current))
+ break;
+- buf[i] ^= t;
++ cond_resched();
+ }
++ }
++
++ memzero_explicit(block, sizeof(block));
++ return ret ? ret : -EFAULT;
++}
++
++static ssize_t random_write_iter(struct kiocb *kiocb, struct iov_iter *iter)
++{
++ return write_pool_user(iter);
++}
+
+- count -= bytes;
+- p += bytes;
++static ssize_t urandom_read_iter(struct kiocb *kiocb, struct iov_iter *iter)
++{
++ static int maxwarn = 10;
+
+- mix_pool_bytes(r, buf, bytes);
+- cond_resched();
++ if (!crng_ready()) {
++ if (!ratelimit_disable && maxwarn <= 0)
++ ++urandom_warning.missed;
++ else if (ratelimit_disable || __ratelimit(&urandom_warning)) {
++ --maxwarn;
++ pr_notice("%s: uninitialized urandom read (%zu bytes read)\n",
++ current->comm, iov_iter_count(iter));
++ }
+ }
+
+- return 0;
++ return get_random_bytes_user(iter);
+ }
+
+-static ssize_t random_write(struct file *file, const char __user *buffer,
+- size_t count, loff_t *ppos)
++static ssize_t random_read_iter(struct kiocb *kiocb, struct iov_iter *iter)
+ {
+- size_t ret;
++ int ret;
+
+- ret = write_pool(&input_pool, buffer, count);
+- if (ret)
++ ret = wait_for_random_bytes();
++ if (ret != 0)
+ return ret;
+-
+- return (ssize_t)count;
++ return get_random_bytes_user(iter);
+ }
+
+ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+ {
+- int size, ent_count;
+ int __user *p = (int __user *)arg;
+- int retval;
++ int ent_count;
+
+ switch (cmd) {
+ case RNDGETENTCNT:
+- /* inherently racy, no point locking */
+- ent_count = ENTROPY_BITS(&input_pool);
+- if (put_user(ent_count, p))
++ /* Inherently racy, no point locking. */
++ if (put_user(input_pool.init_bits, p))
+ return -EFAULT;
+ return 0;
+ case RNDADDTOENTCNT:
+@@ -2045,39 +1316,48 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+ return -EPERM;
+ if (get_user(ent_count, p))
+ return -EFAULT;
+- return credit_entropy_bits_safe(&input_pool, ent_count);
+- case RNDADDENTROPY:
++ if (ent_count < 0)
++ return -EINVAL;
++ credit_init_bits(ent_count);
++ return 0;
++ case RNDADDENTROPY: {
++ struct iov_iter iter;
++ struct iovec iov;
++ ssize_t ret;
++ int len;
++
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+ if (get_user(ent_count, p++))
+ return -EFAULT;
+ if (ent_count < 0)
+ return -EINVAL;
+- if (get_user(size, p++))
++ if (get_user(len, p++))
++ return -EFAULT;
++ ret = import_single_range(WRITE, p, len, &iov, &iter);
++ if (unlikely(ret))
++ return ret;
++ ret = write_pool_user(&iter);
++ if (unlikely(ret < 0))
++ return ret;
++ /* Since we're crediting, enforce that it was all written into the pool. */
++ if (unlikely(ret != len))
+ return -EFAULT;
+- retval = write_pool(&input_pool, (const char __user *)p,
+- size);
+- if (retval < 0)
+- return retval;
+- return credit_entropy_bits_safe(&input_pool, ent_count);
++ credit_init_bits(ent_count);
++ return 0;
++ }
+ case RNDZAPENTCNT:
+ case RNDCLEARPOOL:
+- /*
+- * Clear the entropy pool counters. We no longer clear
+- * the entropy pool, as that's silly.
+- */
++ /* No longer has any effect. */
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+- input_pool.entropy_count = 0;
+- blocking_pool.entropy_count = 0;
+ return 0;
+ case RNDRESEEDCRNG:
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+- if (crng_init < 2)
++ if (!crng_ready())
+ return -ENODATA;
+- crng_reseed(&primary_crng, &input_pool);
+- WRITE_ONCE(crng_global_init_time, jiffies - 1);
++ crng_reseed();
+ return 0;
+ default:
+ return -EINVAL;
+@@ -2090,49 +1370,54 @@ static int random_fasync(int fd, struct file *filp, int on)
+ }
+
+ const struct file_operations random_fops = {
+- .read = random_read,
+- .write = random_write,
+- .poll = random_poll,
++ .read_iter = random_read_iter,
++ .write_iter = random_write_iter,
++ .poll = random_poll,
+ .unlocked_ioctl = random_ioctl,
+ .fasync = random_fasync,
+ .llseek = noop_llseek,
++ .splice_read = generic_file_splice_read,
++ .splice_write = iter_file_splice_write,
+ };
+
+ const struct file_operations urandom_fops = {
+- .read = urandom_read,
+- .write = random_write,
++ .read_iter = urandom_read_iter,
++ .write_iter = random_write_iter,
+ .unlocked_ioctl = random_ioctl,
+ .fasync = random_fasync,
+ .llseek = noop_llseek,
++ .splice_read = generic_file_splice_read,
++ .splice_write = iter_file_splice_write,
+ };
+
+-SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count,
+- unsigned int, flags)
+-{
+- int ret;
+-
+- if (flags & ~(GRND_NONBLOCK|GRND_RANDOM))
+- return -EINVAL;
+-
+- if (count > INT_MAX)
+- count = INT_MAX;
+-
+- if (flags & GRND_RANDOM)
+- return _random_read(flags & GRND_NONBLOCK, buf, count);
+-
+- if (!crng_ready()) {
+- if (flags & GRND_NONBLOCK)
+- return -EAGAIN;
+- ret = wait_for_random_bytes();
+- if (unlikely(ret))
+- return ret;
+- }
+- return urandom_read(NULL, buf, count, NULL);
+-}
+
+ /********************************************************************
+ *
+- * Sysctl interface
++ * Sysctl interface.
++ *
++ * These are partly unused legacy knobs with dummy values to not break
++ * userspace and partly still useful things. They are usually accessible
++ * in /proc/sys/kernel/random/ and are as follows:
++ *
++ * - boot_id - a UUID representing the current boot.
++ *
++ * - uuid - a random UUID, different each time the file is read.
++ *
++ * - poolsize - the number of bits of entropy that the input pool can
++ * hold, tied to the POOL_BITS constant.
++ *
++ * - entropy_avail - the number of bits of entropy currently in the
++ * input pool. Always <= poolsize.
++ *
++ * - write_wakeup_threshold - the amount of entropy in the input pool
++ * below which write polls to /dev/random will unblock, requesting
++ * more entropy, tied to the POOL_READY_BITS constant. It is writable
++ * to avoid breaking old userspaces, but writing to it does not
++ * change any behavior of the RNG.
++ *
++ * - urandom_min_reseed_secs - fixed to the value CRNG_RESEED_INTERVAL.
++ * It is writable to avoid breaking old userspaces, but writing
++ * to it does not change any behavior of the RNG.
+ *
+ ********************************************************************/
+
+@@ -2140,26 +1425,28 @@ SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count,
+
+ #include <linux/sysctl.h>
+
+-static int min_read_thresh = 8, min_write_thresh;
+-static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
+-static int max_write_thresh = INPUT_POOL_WORDS * 32;
+-static int random_min_urandom_seed = 60;
+-static char sysctl_bootid[16];
++static int sysctl_random_min_urandom_seed = CRNG_RESEED_INTERVAL / HZ;
++static int sysctl_random_write_wakeup_bits = POOL_READY_BITS;
++static int sysctl_poolsize = POOL_BITS;
++static u8 sysctl_bootid[UUID_SIZE];
+
+ /*
+ * This function is used to return both the bootid UUID, and random
+- * UUID. The difference is in whether table->data is NULL; if it is,
++ * UUID. The difference is in whether table->data is NULL; if it is,
+ * then a new UUID is generated and returned to the user.
+- *
+- * If the user accesses this via the proc interface, the UUID will be
+- * returned as an ASCII string in the standard UUID format; if via the
+- * sysctl system call, as 16 bytes of binary data.
+ */
+-static int proc_do_uuid(struct ctl_table *table, int write,
+- void __user *buffer, size_t *lenp, loff_t *ppos)
+-{
+- struct ctl_table fake_table;
+- unsigned char buf[64], tmp_uuid[16], *uuid;
++static int proc_do_uuid(struct ctl_table *table, int write, void __user *buf,
++ size_t *lenp, loff_t *ppos)
++{
++ u8 tmp_uuid[UUID_SIZE], *uuid;
++ char uuid_string[UUID_STRING_LEN + 1];
++ struct ctl_table fake_table = {
++ .data = uuid_string,
++ .maxlen = UUID_STRING_LEN
++ };
++
++ if (write)
++ return -EPERM;
+
+ uuid = table->data;
+ if (!uuid) {
+@@ -2174,32 +1461,17 @@ static int proc_do_uuid(struct ctl_table *table, int write,
+ spin_unlock(&bootid_spinlock);
+ }
+
+- sprintf(buf, "%pU", uuid);
+-
+- fake_table.data = buf;
+- fake_table.maxlen = sizeof(buf);
+-
+- return proc_dostring(&fake_table, write, buffer, lenp, ppos);
++ snprintf(uuid_string, sizeof(uuid_string), "%pU", uuid);
++ return proc_dostring(&fake_table, 0, buf, lenp, ppos);
+ }
+
+-/*
+- * Return entropy available scaled to integral bits
+- */
+-static int proc_do_entropy(struct ctl_table *table, int write,
+- void __user *buffer, size_t *lenp, loff_t *ppos)
++/* The same as proc_dointvec, but writes don't change anything. */
++static int proc_do_rointvec(struct ctl_table *table, int write, void __user *buf,
++ size_t *lenp, loff_t *ppos)
+ {
+- struct ctl_table fake_table;
+- int entropy_count;
+-
+- entropy_count = *(int *)table->data >> ENTROPY_SHIFT;
+-
+- fake_table.data = &entropy_count;
+- fake_table.maxlen = sizeof(entropy_count);
+-
+- return proc_dointvec(&fake_table, write, buffer, lenp, ppos);
++ return write ? 0 : proc_dointvec(table, 0, buf, lenp, ppos);
+ }
+
+-static int sysctl_poolsize = INPUT_POOL_WORDS * 32;
+ extern struct ctl_table random_table[];
+ struct ctl_table random_table[] = {
+ {
+@@ -2211,213 +1483,36 @@ struct ctl_table random_table[] = {
+ },
+ {
+ .procname = "entropy_avail",
++ .data = &input_pool.init_bits,
+ .maxlen = sizeof(int),
+ .mode = 0444,
+- .proc_handler = proc_do_entropy,
+- .data = &input_pool.entropy_count,
+- },
+- {
+- .procname = "read_wakeup_threshold",
+- .data = &random_read_wakeup_bits,
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &min_read_thresh,
+- .extra2 = &max_read_thresh,
++ .proc_handler = proc_dointvec,
+ },
+ {
+ .procname = "write_wakeup_threshold",
+- .data = &random_write_wakeup_bits,
++ .data = &sysctl_random_write_wakeup_bits,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &min_write_thresh,
+- .extra2 = &max_write_thresh,
++ .proc_handler = proc_do_rointvec,
+ },
+ {
+ .procname = "urandom_min_reseed_secs",
+- .data = &random_min_urandom_seed,
++ .data = &sysctl_random_min_urandom_seed,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_do_rointvec,
+ },
+ {
+ .procname = "boot_id",
+ .data = &sysctl_bootid,
+- .maxlen = 16,
+ .mode = 0444,
+ .proc_handler = proc_do_uuid,
+ },
+ {
+ .procname = "uuid",
+- .maxlen = 16,
+ .mode = 0444,
+ .proc_handler = proc_do_uuid,
+ },
+-#ifdef ADD_INTERRUPT_BENCH
+- {
+- .procname = "add_interrupt_avg_cycles",
+- .data = &avg_cycles,
+- .maxlen = sizeof(avg_cycles),
+- .mode = 0444,
+- .proc_handler = proc_doulongvec_minmax,
+- },
+- {
+- .procname = "add_interrupt_avg_deviation",
+- .data = &avg_deviation,
+- .maxlen = sizeof(avg_deviation),
+- .mode = 0444,
+- .proc_handler = proc_doulongvec_minmax,
+- },
+-#endif
+ { }
+ };
+-#endif /* CONFIG_SYSCTL */
+-
+-struct batched_entropy {
+- union {
+- u64 entropy_u64[CHACHA20_BLOCK_SIZE / sizeof(u64)];
+- u32 entropy_u32[CHACHA20_BLOCK_SIZE / sizeof(u32)];
+- };
+- unsigned int position;
+- spinlock_t batch_lock;
+-};
+-
+-/*
+- * Get a random word for internal kernel use only. The quality of the random
+- * number is good as /dev/urandom, but there is no backtrack protection, with
+- * the goal of being quite fast and not depleting entropy. In order to ensure
+- * that the randomness provided by this function is okay, the function
+- * wait_for_random_bytes() should be called and return 0 at least once at any
+- * point prior.
+- */
+-static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64) = {
+- .batch_lock = __SPIN_LOCK_UNLOCKED(batched_entropy_u64.lock),
+-};
+-
+-u64 get_random_u64(void)
+-{
+- u64 ret;
+- unsigned long flags;
+- struct batched_entropy *batch;
+- static void *previous;
+-
+- warn_unseeded_randomness(&previous);
+-
+- batch = raw_cpu_ptr(&batched_entropy_u64);
+- spin_lock_irqsave(&batch->batch_lock, flags);
+- if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
+- extract_crng((u8 *)batch->entropy_u64);
+- batch->position = 0;
+- }
+- ret = batch->entropy_u64[batch->position++];
+- spin_unlock_irqrestore(&batch->batch_lock, flags);
+- return ret;
+-}
+-EXPORT_SYMBOL(get_random_u64);
+-
+-static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32) = {
+- .batch_lock = __SPIN_LOCK_UNLOCKED(batched_entropy_u32.lock),
+-};
+-u32 get_random_u32(void)
+-{
+- u32 ret;
+- unsigned long flags;
+- struct batched_entropy *batch;
+- static void *previous;
+-
+- warn_unseeded_randomness(&previous);
+-
+- batch = raw_cpu_ptr(&batched_entropy_u32);
+- spin_lock_irqsave(&batch->batch_lock, flags);
+- if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
+- extract_crng((u8 *)batch->entropy_u32);
+- batch->position = 0;
+- }
+- ret = batch->entropy_u32[batch->position++];
+- spin_unlock_irqrestore(&batch->batch_lock, flags);
+- return ret;
+-}
+-EXPORT_SYMBOL(get_random_u32);
+-
+-/* It's important to invalidate all potential batched entropy that might
+- * be stored before the crng is initialized, which we can do lazily by
+- * simply resetting the counter to zero so that it's re-extracted on the
+- * next usage. */
+-static void invalidate_batched_entropy(void)
+-{
+- int cpu;
+- unsigned long flags;
+-
+- for_each_possible_cpu (cpu) {
+- struct batched_entropy *batched_entropy;
+-
+- batched_entropy = per_cpu_ptr(&batched_entropy_u32, cpu);
+- spin_lock_irqsave(&batched_entropy->batch_lock, flags);
+- batched_entropy->position = 0;
+- spin_unlock(&batched_entropy->batch_lock);
+-
+- batched_entropy = per_cpu_ptr(&batched_entropy_u64, cpu);
+- spin_lock(&batched_entropy->batch_lock);
+- batched_entropy->position = 0;
+- spin_unlock_irqrestore(&batched_entropy->batch_lock, flags);
+- }
+-}
+-
+-/**
+- * randomize_page - Generate a random, page aligned address
+- * @start: The smallest acceptable address the caller will take.
+- * @range: The size of the area, starting at @start, within which the
+- * random address must fall.
+- *
+- * If @start + @range would overflow, @range is capped.
+- *
+- * NOTE: Historical use of randomize_range, which this replaces, presumed that
+- * @start was already page aligned. We now align it regardless.
+- *
+- * Return: A page aligned address within [start, start + range). On error,
+- * @start is returned.
+- */
+-unsigned long
+-randomize_page(unsigned long start, unsigned long range)
+-{
+- if (!PAGE_ALIGNED(start)) {
+- range -= PAGE_ALIGN(start) - start;
+- start = PAGE_ALIGN(start);
+- }
+-
+- if (start > ULONG_MAX - range)
+- range = ULONG_MAX - start;
+-
+- range >>= PAGE_SHIFT;
+-
+- if (range == 0)
+- return start;
+-
+- return start + (get_random_long() % range << PAGE_SHIFT);
+-}
+-
+-/* Interface for in-kernel drivers of true hardware RNGs.
+- * Those devices may produce endless random bits and will be throttled
+- * when our pool is full.
+- */
+-void add_hwgenerator_randomness(const char *buffer, size_t count,
+- size_t entropy)
+-{
+- struct entropy_store *poolp = &input_pool;
+-
+- if (unlikely(crng_init == 0)) {
+- crng_fast_load(buffer, count);
+- return;
+- }
+-
+- /* Suspend writing if we're above the trickle threshold.
+- * We'll be woken up again once below random_write_wakeup_thresh,
+- * or when the calling thread is about to terminate.
+- */
+- wait_event_interruptible(random_write_wait, kthread_should_stop() ||
+- ENTROPY_BITS(&input_pool) <= random_write_wakeup_bits);
+- mix_pool_bytes(poolp, buffer, count);
+- credit_entropy_bits(poolp, entropy);
+-}
+-EXPORT_SYMBOL_GPL(add_hwgenerator_randomness);
++#endif /* CONFIG_SYSCTL */
+diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
+index 12bc9fa211117..08bcefca313db 100644
+--- a/drivers/hv/hv.c
++++ b/drivers/hv/hv.c
+@@ -115,7 +115,7 @@ static void hv_stimer0_isr(void)
+
+ hv_cpu = this_cpu_ptr(hv_context.cpu_context);
+ hv_cpu->clk_evt->event_handler(hv_cpu->clk_evt);
+- add_interrupt_randomness(stimer0_vector, 0);
++ add_interrupt_randomness(stimer0_vector);
+ }
+
+ static int hv_ce_set_next_event(unsigned long delta,
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 0c17743b4a65c..fca092cfe2004 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -1146,7 +1146,7 @@ static void vmbus_isr(void)
+ tasklet_schedule(&hv_cpu->msg_dpc);
+ }
+
+- add_interrupt_randomness(HYPERVISOR_CALLBACK_VECTOR, 0);
++ add_interrupt_randomness(HYPERVISOR_CALLBACK_VECTOR);
+ }
+
+ /*
+diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
+index fb82d8ee0dd6d..c4051a3e63c29 100644
+--- a/drivers/hwmon/hwmon.c
++++ b/drivers/hwmon/hwmon.c
+@@ -695,12 +695,11 @@ EXPORT_SYMBOL_GPL(hwmon_device_register_with_groups);
+
+ /**
+ * hwmon_device_register_with_info - register w/ hwmon
+- * @dev: the parent device (mandatory)
+- * @name: hwmon name attribute (mandatory)
+- * @drvdata: driver data to attach to created device (optional)
+- * @chip: pointer to hwmon chip information (mandatory)
++ * @dev: the parent device
++ * @name: hwmon name attribute
++ * @drvdata: driver data to attach to created device
++ * @chip: pointer to hwmon chip information
+ * @extra_groups: pointer to list of additional non-standard attribute groups
+- * (optional)
+ *
+ * hwmon_device_unregister() must be called when the device is no
+ * longer needed.
+@@ -713,10 +712,13 @@ hwmon_device_register_with_info(struct device *dev, const char *name,
+ const struct hwmon_chip_info *chip,
+ const struct attribute_group **extra_groups)
+ {
+- if (!dev || !name || !chip)
++ if (!name)
++ return ERR_PTR(-EINVAL);
++
++ if (chip && (!chip->ops || !chip->ops->is_visible || !chip->info))
+ return ERR_PTR(-EINVAL);
+
+- if (!chip->ops || !chip->ops->is_visible || !chip->info)
++ if (chip && !dev)
+ return ERR_PTR(-EINVAL);
+
+ return __hwmon_device_register(dev, name, drvdata, chip, extra_groups);
+diff --git a/drivers/irqchip/irq-gic-realview.c b/drivers/irqchip/irq-gic-realview.c
+index b4c1924f02554..38fab02ffe9d0 100644
+--- a/drivers/irqchip/irq-gic-realview.c
++++ b/drivers/irqchip/irq-gic-realview.c
+@@ -57,6 +57,7 @@ realview_gic_of_init(struct device_node *node, struct device_node *parent)
+
+ /* The PB11MPCore GIC needs to be configured in the syscon */
+ map = syscon_node_to_regmap(np);
++ of_node_put(np);
+ if (!IS_ERR(map)) {
+ /* new irq mode with no DCC */
+ regmap_write(map, REALVIEW_SYS_LOCK_OFFSET,
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index 05b9a4cdc8fd5..8d8b8d192e2e3 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1205,12 +1205,15 @@ static void __init gic_populate_ppi_partitions(struct device_node *gic_node)
+ continue;
+
+ cpu = of_cpu_node_to_id(cpu_node);
+- if (WARN_ON(cpu < 0))
++ if (WARN_ON(cpu < 0)) {
++ of_node_put(cpu_node);
+ continue;
++ }
+
+ pr_cont("%pOF[%d] ", cpu_node, cpu);
+
+ cpumask_set_cpu(cpu, &part->mask);
++ of_node_put(cpu_node);
+ }
+
+ pr_cont("}\n");
+diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
+index f9caf233e2cc0..48521861beb52 100644
+--- a/drivers/misc/atmel-ssc.c
++++ b/drivers/misc/atmel-ssc.c
+@@ -235,9 +235,9 @@ static int ssc_probe(struct platform_device *pdev)
+ clk_disable_unprepare(ssc->clk);
+
+ ssc->irq = platform_get_irq(pdev, 0);
+- if (!ssc->irq) {
++ if (ssc->irq < 0) {
+ dev_dbg(&pdev->dev, "could not get irq\n");
+- return -ENXIO;
++ return ssc->irq;
+ }
+
+ mutex_lock(&user_lock);
+diff --git a/drivers/net/ethernet/broadcom/bgmac-bcma.c b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+index 6fe074c1588bb..77de92eb08b21 100644
+--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+@@ -323,7 +323,6 @@ static void bgmac_remove(struct bcma_device *core)
+ bcma_mdio_mii_unregister(bgmac->mii_bus);
+ bgmac_enet_remove(bgmac);
+ bcma_set_drvdata(core, NULL);
+- kfree(bgmac);
+ }
+
+ static struct bcma_driver bgmac_bcma_driver = {
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 5242d3dfeb22d..6a70e62836f8f 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -2195,15 +2195,16 @@ static void i40e_diag_test(struct net_device *netdev,
+
+ set_bit(__I40E_TESTING, pf->state);
+
++ if (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state) ||
++ test_bit(__I40E_RESET_INTR_RECEIVED, pf->state)) {
++ dev_warn(&pf->pdev->dev,
++ "Cannot start offline testing when PF is in reset state.\n");
++ goto skip_ol_tests;
++ }
++
+ if (i40e_active_vfs(pf) || i40e_active_vmdqs(pf)) {
+ dev_warn(&pf->pdev->dev,
+ "Please take active VFs and Netqueues offline and restart the adapter before running NIC diagnostics\n");
+- data[I40E_ETH_TEST_REG] = 1;
+- data[I40E_ETH_TEST_EEPROM] = 1;
+- data[I40E_ETH_TEST_INTR] = 1;
+- data[I40E_ETH_TEST_LINK] = 1;
+- eth_test->flags |= ETH_TEST_FL_FAILED;
+- clear_bit(__I40E_TESTING, pf->state);
+ goto skip_ol_tests;
+ }
+
+@@ -2250,9 +2251,17 @@ static void i40e_diag_test(struct net_device *netdev,
+ data[I40E_ETH_TEST_INTR] = 0;
+ }
+
+-skip_ol_tests:
+-
+ netif_info(pf, drv, netdev, "testing finished\n");
++ return;
++
++skip_ol_tests:
++ data[I40E_ETH_TEST_REG] = 1;
++ data[I40E_ETH_TEST_EEPROM] = 1;
++ data[I40E_ETH_TEST_INTR] = 1;
++ data[I40E_ETH_TEST_LINK] = 1;
++ eth_test->flags |= ETH_TEST_FL_FAILED;
++ clear_bit(__I40E_TESTING, pf->state);
++ netif_info(pf, drv, netdev, "testing failed\n");
+ }
+
+ static void i40e_get_wol(struct net_device *netdev,
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 21ea0cdea6668..3615c6533cf4f 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -7508,6 +7508,11 @@ static int i40e_configure_clsflower(struct i40e_vsi *vsi,
+ return -EOPNOTSUPP;
+ }
+
++ if (!tc) {
++ dev_err(&pf->pdev->dev, "Unable to add filter because of invalid destination");
++ return -EINVAL;
++ }
++
+ if (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state) ||
+ test_bit(__I40E_RESET_INTR_RECEIVED, pf->state))
+ return -EBUSY;
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index f2eaf8c13cc22..53cff913abf0b 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -597,6 +597,17 @@ static inline void mtk_rx_get_desc(struct mtk_rx_dma *rxd,
+ rxd->rxd4 = READ_ONCE(dma_rxd->rxd4);
+ }
+
++static void *mtk_max_lro_buf_alloc(gfp_t gfp_mask)
++{
++ unsigned int size = mtk_max_frag_size(MTK_MAX_LRO_RX_LENGTH);
++ unsigned long data;
++
++ data = __get_free_pages(gfp_mask | __GFP_COMP | __GFP_NOWARN,
++ get_order(size));
++
++ return (void *)data;
++}
++
+ /* the qdma core needs scratch memory to be setup */
+ static int mtk_init_fq_dma(struct mtk_eth *eth)
+ {
+@@ -1005,7 +1016,10 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
+ goto release_desc;
+
+ /* alloc new buffer */
+- new_data = napi_alloc_frag(ring->frag_size);
++ if (ring->frag_size <= PAGE_SIZE)
++ new_data = napi_alloc_frag(ring->frag_size);
++ else
++ new_data = mtk_max_lro_buf_alloc(GFP_ATOMIC);
+ if (unlikely(!new_data)) {
+ netdev->stats.rx_dropped++;
+ goto release_desc;
+@@ -1312,7 +1326,10 @@ static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag)
+ return -ENOMEM;
+
+ for (i = 0; i < rx_dma_size; i++) {
+- ring->data[i] = netdev_alloc_frag(ring->frag_size);
++ if (ring->frag_size <= PAGE_SIZE)
++ ring->data[i] = netdev_alloc_frag(ring->frag_size);
++ else
++ ring->data[i] = mtk_max_lro_buf_alloc(GFP_KERNEL);
+ if (!ring->data[i])
+ return -ENOMEM;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h
+index 81465e267b100..b7eb3674e2856 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.h
+@@ -7,8 +7,8 @@
+ #include "spectrum.h"
+
+ enum mlxsw_sp_counter_sub_pool_id {
+- MLXSW_SP_COUNTER_SUB_POOL_FLOW,
+ MLXSW_SP_COUNTER_SUB_POOL_RIF,
++ MLXSW_SP_COUNTER_SUB_POOL_FLOW,
+ };
+
+ int mlxsw_sp_counter_alloc(struct mlxsw_sp *mlxsw_sp,
+diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
+index 888e298f610b8..f26986eb53f19 100644
+--- a/drivers/nfc/nfcmrvl/usb.c
++++ b/drivers/nfc/nfcmrvl/usb.c
+@@ -401,13 +401,25 @@ static void nfcmrvl_play_deferred(struct nfcmrvl_usb_drv_data *drv_data)
+ int err;
+
+ while ((urb = usb_get_from_anchor(&drv_data->deferred))) {
++ usb_anchor_urb(urb, &drv_data->tx_anchor);
++
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+- if (err)
++ if (err) {
++ kfree(urb->setup_packet);
++ usb_unanchor_urb(urb);
++ usb_free_urb(urb);
+ break;
++ }
+
+ drv_data->tx_in_flight++;
++ usb_free_urb(urb);
++ }
++
++ /* Cleanup the rest deferred urbs. */
++ while ((urb = usb_get_from_anchor(&drv_data->deferred))) {
++ kfree(urb->setup_packet);
++ usb_free_urb(urb);
+ }
+- usb_scuttle_anchored_urbs(&drv_data->deferred);
+ }
+
+ static int nfcmrvl_resume(struct usb_interface *intf)
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 1eb6af6439ad6..2e9ea7f1e719b 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -25,6 +25,7 @@
+ #include <linux/debugfs.h>
+ #include <linux/serial_core.h>
+ #include <linux/sysfs.h>
++#include <linux/random.h>
+
+ #include <asm/setup.h> /* for COMMAND_LINE_SIZE */
+ #include <asm/page.h>
+@@ -1077,6 +1078,7 @@ int __init early_init_dt_scan_chosen(unsigned long node, const char *uname,
+ {
+ int l;
+ const char *p;
++ const void *rng_seed;
+
+ pr_debug("search \"chosen\", depth: %d, uname: %s\n", depth, uname);
+
+@@ -1111,6 +1113,14 @@ int __init early_init_dt_scan_chosen(unsigned long node, const char *uname,
+
+ pr_debug("Command line is: %s\n", (char*)data);
+
++ rng_seed = of_get_flat_dt_prop(node, "rng-seed", &l);
++ if (rng_seed && l > 0) {
++ add_bootloader_randomness(rng_seed, l);
++
++ /* try to clear seed so it won't be found. */
++ fdt_nop_property(initial_boot_params, node, "rng-seed");
++ }
++
+ /* break now */
+ return 1;
+ }
+@@ -1213,8 +1223,6 @@ bool __init early_init_dt_verify(void *params)
+
+ /* Setup flat device-tree pointer */
+ initial_boot_params = params;
+- of_fdt_crc32 = crc32_be(~0, initial_boot_params,
+- fdt_totalsize(initial_boot_params));
+ return true;
+ }
+
+@@ -1240,6 +1248,8 @@ bool __init early_init_dt_scan(void *params)
+ return false;
+
+ early_init_dt_scan_nodes();
++ of_fdt_crc32 = crc32_be(~0, initial_boot_params,
++ fdt_totalsize(initial_boot_params));
+ return true;
+ }
+
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 1b04a8223eb01..c6cde552b995e 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -9783,7 +9783,7 @@ static int ipr_alloc_mem(struct ipr_ioa_cfg *ioa_cfg)
+ GFP_KERNEL);
+
+ if (!ioa_cfg->hrrq[i].host_rrq) {
+- while (--i > 0)
++ while (--i >= 0)
+ dma_free_coherent(&pdev->dev,
+ sizeof(u32) * ioa_cfg->hrrq[i].size,
+ ioa_cfg->hrrq[i].host_rrq,
+@@ -10056,7 +10056,7 @@ static int ipr_request_other_msi_irqs(struct ipr_ioa_cfg *ioa_cfg,
+ ioa_cfg->vectors_info[i].desc,
+ &ioa_cfg->hrrq[i]);
+ if (rc) {
+- while (--i >= 0)
++ while (--i > 0)
+ free_irq(pci_irq_vector(pdev, i),
+ &ioa_cfg->hrrq[i]);
+ return rc;
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index 9442fb30e7cd8..f666518d84b0a 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -662,7 +662,8 @@ lpfc_rcv_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ else
+ lpfc_els_rsp_acc(vport, ELS_CMD_ACC, cmdiocb, ndlp, NULL);
+ if (ndlp->nlp_DID == Fabric_DID) {
+- if (vport->port_state <= LPFC_FDISC)
++ if (vport->port_state <= LPFC_FDISC ||
++ vport->fc_flag & FC_PT2PT)
+ goto out;
+ lpfc_linkdown_port(vport);
+ spin_lock_irq(shost->host_lock);
+diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
+index 4e86994e10e81..6e96229c58e05 100644
+--- a/drivers/scsi/pmcraid.c
++++ b/drivers/scsi/pmcraid.c
+@@ -4559,7 +4559,7 @@ pmcraid_register_interrupt_handler(struct pmcraid_instance *pinstance)
+ return 0;
+
+ out_unwind:
+- while (--i > 0)
++ while (--i >= 0)
+ free_irq(pci_irq_vector(pdev, i), &pinstance->hrrq_vector[i]);
+ pci_free_irq_vectors(pdev);
+ return rc;
+diff --git a/drivers/scsi/vmw_pvscsi.h b/drivers/scsi/vmw_pvscsi.h
+index 75966d3f326e0..d87c12324c032 100644
+--- a/drivers/scsi/vmw_pvscsi.h
++++ b/drivers/scsi/vmw_pvscsi.h
+@@ -333,8 +333,8 @@ struct PVSCSIRingReqDesc {
+ u8 tag;
+ u8 bus;
+ u8 target;
+- u8 vcpuHint;
+- u8 unused[59];
++ u16 vcpuHint;
++ u8 unused[58];
+ } __packed;
+
+ /*
+diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
+index 7769eadfaf61d..ccc65cfc519f5 100644
+--- a/drivers/staging/comedi/drivers/vmk80xx.c
++++ b/drivers/staging/comedi/drivers/vmk80xx.c
+@@ -685,7 +685,7 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
+ if (!devpriv->usb_rx_buf)
+ return -ENOMEM;
+
+- size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
++ size = max(usb_endpoint_maxp(devpriv->ep_tx), MIN_BUF_SIZE);
+ devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
+ if (!devpriv->usb_tx_buf)
+ return -ENOMEM;
+diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c
+index abc84d84f6386..9180ca5e4dcd4 100644
+--- a/drivers/tty/goldfish.c
++++ b/drivers/tty/goldfish.c
+@@ -428,7 +428,7 @@ static int goldfish_tty_remove(struct platform_device *pdev)
+ tty_unregister_device(goldfish_tty_driver, qtty->console.index);
+ iounmap(qtty->base);
+ qtty->base = NULL;
+- free_irq(qtty->irq, pdev);
++ free_irq(qtty->irq, qtty);
+ tty_port_destroy(&qtty->port);
+ goldfish_tty_current_line_count--;
+ if (goldfish_tty_current_line_count == 0)
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 34687c354f5e9..5a2e67a8ddc75 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1522,6 +1522,8 @@ static inline void __stop_tx(struct uart_8250_port *p)
+
+ if (em485) {
+ unsigned char lsr = serial_in(p, UART_LSR);
++ p->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
++
+ /*
+ * To provide required timeing and allow FIFO transfer,
+ * __stop_tx_rs485() must be called only when both FIFO and
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 22c4d554865ee..cfda883185838 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -5236,7 +5236,7 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!res) {
+ retval = -EINVAL;
+- goto error1;
++ goto error2;
+ }
+ hcd->rsrc_start = res->start;
+ hcd->rsrc_len = resource_size(res);
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 1b3e674e6330d..2fe91f120bb1d 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -772,9 +772,13 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g,
+ dev->qmult = qmult;
+ snprintf(net->name, sizeof(net->name), "%s%%d", netname);
+
+- if (get_ether_addr(dev_addr, net->dev_addr))
++ if (get_ether_addr(dev_addr, net->dev_addr)) {
++ net->addr_assign_type = NET_ADDR_RANDOM;
+ dev_warn(&g->dev,
+ "using random %s ethernet address\n", "self");
++ } else {
++ net->addr_assign_type = NET_ADDR_SET;
++ }
+ if (get_ether_addr(host_addr, dev->host_mac))
+ dev_warn(&g->dev,
+ "using random %s ethernet address\n", "host");
+@@ -831,6 +835,9 @@ struct net_device *gether_setup_name_default(const char *netname)
+ INIT_LIST_HEAD(&dev->tx_reqs);
+ INIT_LIST_HEAD(&dev->rx_reqs);
+
++ /* by default we always have a random MAC address */
++ net->addr_assign_type = NET_ADDR_RANDOM;
++
+ skb_queue_head_init(&dev->rx_frames);
+
+ /* network device setup */
+@@ -868,7 +875,6 @@ int gether_register_netdev(struct net_device *net)
+ g = dev->gadget;
+
+ memcpy(net->dev_addr, dev->dev_mac, ETH_ALEN);
+- net->addr_assign_type = NET_ADDR_RANDOM;
+
+ status = register_netdev(net);
+ if (status < 0) {
+@@ -908,6 +914,7 @@ int gether_set_dev_addr(struct net_device *net, const char *dev_addr)
+ if (get_ether_addr(dev_addr, new_addr))
+ return -EINVAL;
+ memcpy(dev->dev_mac, new_addr, ETH_ALEN);
++ net->addr_assign_type = NET_ADDR_SET;
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(gether_set_dev_addr);
+diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
+index cf56819f16e4c..f7735d5ac6beb 100644
+--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
+@@ -3021,6 +3021,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
+ }
+
+ udc->isp1301_i2c_client = isp1301_get_client(isp1301_node);
++ of_node_put(isp1301_node);
+ if (!udc->isp1301_i2c_client) {
+ retval = -EPROBE_DEFER;
+ goto phy_fail;
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index 6d1d6efa30554..a4421e1a6c07a 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -168,6 +168,7 @@ static const struct usb_device_id edgeport_2port_id_table[] = {
+ { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_8S) },
+ { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_416) },
+ { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_416B) },
++ { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_E5805A) },
+ { }
+ };
+
+@@ -206,6 +207,7 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_8S) },
+ { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_416) },
+ { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_TI_EDGEPORT_416B) },
++ { USB_DEVICE(USB_VENDOR_ID_ION, ION_DEVICE_ID_E5805A) },
+ { }
+ };
+
+diff --git a/drivers/usb/serial/io_usbvend.h b/drivers/usb/serial/io_usbvend.h
+index c38e87ac5ea9e..7ca5ca49adff8 100644
+--- a/drivers/usb/serial/io_usbvend.h
++++ b/drivers/usb/serial/io_usbvend.h
+@@ -212,6 +212,7 @@
+ //
+ // Definitions for other product IDs
+ #define ION_DEVICE_ID_MT4X56USB 0x1403 // OEM device
++#define ION_DEVICE_ID_E5805A 0x1A01 // OEM device (rebranded Edgeport/4)
+
+
+ #define GENERATION_ID_FROM_USB_PRODUCT_ID(ProductId) \
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 427a38ab198ba..4f99818ca70ed 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -432,6 +432,8 @@ static void option_instat_callback(struct urb *urb);
+ #define CINTERION_PRODUCT_CLS8 0x00b0
+ #define CINTERION_PRODUCT_MV31_MBIM 0x00b3
+ #define CINTERION_PRODUCT_MV31_RMNET 0x00b7
++#define CINTERION_PRODUCT_MV31_2_MBIM 0x00b8
++#define CINTERION_PRODUCT_MV31_2_RMNET 0x00b9
+ #define CINTERION_PRODUCT_MV32_WA 0x00f1
+ #define CINTERION_PRODUCT_MV32_WB 0x00f2
+
+@@ -1979,6 +1981,10 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(3)},
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_RMNET, 0xff),
+ .driver_info = RSVD(0)},
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_2_MBIM, 0xff),
++ .driver_info = RSVD(3)},
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_2_RMNET, 0xff),
++ .driver_info = RSVD(0)},
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff),
+ .driver_info = RSVD(3)},
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff),
+diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
+index 4cd9ea5c75be7..c69c755bf5538 100644
+--- a/drivers/virtio/virtio_mmio.c
++++ b/drivers/virtio/virtio_mmio.c
+@@ -663,6 +663,7 @@ static int vm_cmdline_set(const char *device,
+ if (!vm_cmdline_parent_registered) {
+ err = device_register(&vm_cmdline_parent);
+ if (err) {
++ put_device(&vm_cmdline_parent);
+ pr_err("Failed to register parent device!\n");
+ return err;
+ }
+diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
+index b7cc63f556eea..40618ccffeb8b 100644
+--- a/drivers/virtio/virtio_pci_common.c
++++ b/drivers/virtio/virtio_pci_common.c
+@@ -257,8 +257,7 @@ void vp_del_vqs(struct virtio_device *vdev)
+
+ if (vp_dev->msix_affinity_masks) {
+ for (i = 0; i < vp_dev->msix_vectors; i++)
+- if (vp_dev->msix_affinity_masks[i])
+- free_cpumask_var(vp_dev->msix_affinity_masks[i]);
++ free_cpumask_var(vp_dev->msix_affinity_masks[i]);
+ }
+
+ if (vp_dev->msix_enabled) {
+diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
+index a950a927a626f..c94e0748fc321 100644
+--- a/fs/9p/vfs_inode_dotl.c
++++ b/fs/9p/vfs_inode_dotl.c
+@@ -656,14 +656,10 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode,
+ if (stat->st_result_mask & P9_STATS_NLINK)
+ set_nlink(inode, stat->st_nlink);
+ if (stat->st_result_mask & P9_STATS_MODE) {
+- inode->i_mode = stat->st_mode;
+- if ((S_ISBLK(inode->i_mode)) ||
+- (S_ISCHR(inode->i_mode)))
+- init_special_inode(inode, inode->i_mode,
+- inode->i_rdev);
++ mode = stat->st_mode & S_IALLUGO;
++ mode |= inode->i_mode & ~S_IALLUGO;
++ inode->i_mode = mode;
+ }
+- if (stat->st_result_mask & P9_STATS_RDEV)
+- inode->i_rdev = new_decode_dev(stat->st_rdev);
+ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE) &&
+ stat->st_result_mask & P9_STATS_SIZE)
+ v9fs_i_size_write(inode, stat->st_size);
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index db8243627b085..4ea4fe92eb8c9 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3170,6 +3170,15 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
+ size = size >> bsbits;
+ start = start_off >> bsbits;
+
++ /*
++ * For tiny groups (smaller than 8MB) the chosen allocation
++ * alignment may be larger than group size. Make sure the
++ * alignment does not move allocation to a different group which
++ * makes mballoc fail assertions later.
++ */
++ start = max(start, rounddown(ac->ac_o_ex.fe_logical,
++ (ext4_lblk_t)EXT4_BLOCKS_PER_GROUP(ac->ac_sb)));
++
+ /* don't cover already allocated blocks in selected range */
+ if (ar->pleft && start <= ar->lleft) {
+ size -= ar->lleft + 1 - start;
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 621271c2989b4..5f85994191504 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1743,7 +1743,8 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
+ struct dx_hash_info *hinfo)
+ {
+ unsigned blocksize = dir->i_sb->s_blocksize;
+- unsigned count, continued;
++ unsigned continued;
++ int count;
+ struct buffer_head *bh2;
+ ext4_lblk_t newblock;
+ u32 hash2;
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 5f954620efbf2..d37493b39ab97 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -52,6 +52,16 @@ int ext4_resize_begin(struct super_block *sb)
+ if (!capable(CAP_SYS_RESOURCE))
+ return -EPERM;
+
++ /*
++ * If the reserved GDT blocks is non-zero, the resize_inode feature
++ * should always be set.
++ */
++ if (EXT4_SB(sb)->s_es->s_reserved_gdt_blocks &&
++ !ext4_has_feature_resize_inode(sb)) {
++ ext4_error(sb, "resize_inode disabled but reserved GDT blocks non-zero");
++ return -EFSCORRUPTED;
++ }
++
+ /*
+ * If we are not using the primary superblock/GDT copy don't resize,
+ * because the user tools have no way of handling this. Probably a
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index a7d638bfb46b9..cfb1fe5dfb1e1 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2045,6 +2045,12 @@ lookup_again:
+ case -ERECALLCONFLICT:
+ case -EAGAIN:
+ break;
++ case -ENODATA:
++ /* The server returned NFS4ERR_LAYOUTUNAVAILABLE */
++ pnfs_layout_set_fail_bit(
++ lo, pnfs_iomode_to_fail_bit(iomode));
++ lseg = NULL;
++ goto out_put_layout_hdr;
+ default:
+ if (!nfs_error_is_fatal(PTR_ERR(lseg))) {
+ pnfs_layout_clear_fail_bit(lo, pnfs_iomode_to_fail_bit(iomode));
+diff --git a/include/crypto/blake2s.h b/include/crypto/blake2s.h
+new file mode 100644
+index 0000000000000..d439496fa6baa
+--- /dev/null
++++ b/include/crypto/blake2s.h
+@@ -0,0 +1,102 @@
++/* SPDX-License-Identifier: GPL-2.0 OR MIT */
++/*
++ * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
++ */
++
++#ifndef _CRYPTO_BLAKE2S_H
++#define _CRYPTO_BLAKE2S_H
++
++#include <linux/bug.h>
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <linux/string.h>
++
++enum blake2s_lengths {
++ BLAKE2S_BLOCK_SIZE = 64,
++ BLAKE2S_HASH_SIZE = 32,
++ BLAKE2S_KEY_SIZE = 32,
++
++ BLAKE2S_128_HASH_SIZE = 16,
++ BLAKE2S_160_HASH_SIZE = 20,
++ BLAKE2S_224_HASH_SIZE = 28,
++ BLAKE2S_256_HASH_SIZE = 32,
++};
++
++struct blake2s_state {
++ u32 h[8];
++ u32 t[2];
++ u32 f[2];
++ u8 buf[BLAKE2S_BLOCK_SIZE];
++ unsigned int buflen;
++ unsigned int outlen;
++};
++
++enum blake2s_iv {
++ BLAKE2S_IV0 = 0x6A09E667UL,
++ BLAKE2S_IV1 = 0xBB67AE85UL,
++ BLAKE2S_IV2 = 0x3C6EF372UL,
++ BLAKE2S_IV3 = 0xA54FF53AUL,
++ BLAKE2S_IV4 = 0x510E527FUL,
++ BLAKE2S_IV5 = 0x9B05688CUL,
++ BLAKE2S_IV6 = 0x1F83D9ABUL,
++ BLAKE2S_IV7 = 0x5BE0CD19UL,
++};
++
++void blake2s_update(struct blake2s_state *state, const u8 *in, size_t inlen);
++void blake2s_final(struct blake2s_state *state, u8 *out);
++
++static inline void blake2s_init_param(struct blake2s_state *state,
++ const u32 param)
++{
++ *state = (struct blake2s_state){{
++ BLAKE2S_IV0 ^ param,
++ BLAKE2S_IV1,
++ BLAKE2S_IV2,
++ BLAKE2S_IV3,
++ BLAKE2S_IV4,
++ BLAKE2S_IV5,
++ BLAKE2S_IV6,
++ BLAKE2S_IV7,
++ }};
++}
++
++static inline void blake2s_init(struct blake2s_state *state,
++ const size_t outlen)
++{
++ blake2s_init_param(state, 0x01010000 | outlen);
++ state->outlen = outlen;
++}
++
++static inline void blake2s_init_key(struct blake2s_state *state,
++ const size_t outlen, const void *key,
++ const size_t keylen)
++{
++ WARN_ON(IS_ENABLED(DEBUG) && (!outlen || outlen > BLAKE2S_HASH_SIZE ||
++ !key || !keylen || keylen > BLAKE2S_KEY_SIZE));
++
++ blake2s_init_param(state, 0x01010000 | keylen << 8 | outlen);
++ memcpy(state->buf, key, keylen);
++ state->buflen = BLAKE2S_BLOCK_SIZE;
++ state->outlen = outlen;
++}
++
++static inline void blake2s(u8 *out, const u8 *in, const u8 *key,
++ const size_t outlen, const size_t inlen,
++ const size_t keylen)
++{
++ struct blake2s_state state;
++
++ WARN_ON(IS_ENABLED(DEBUG) && ((!in && inlen > 0) || !out || !outlen ||
++ outlen > BLAKE2S_HASH_SIZE || keylen > BLAKE2S_KEY_SIZE ||
++ (!key && keylen)));
++
++ if (keylen)
++ blake2s_init_key(&state, outlen, key, keylen);
++ else
++ blake2s_init(&state, outlen);
++
++ blake2s_update(&state, in, inlen);
++ blake2s_final(&state, out);
++}
++
++#endif /* _CRYPTO_BLAKE2S_H */
+diff --git a/include/crypto/chacha20.h b/include/crypto/chacha20.h
+index f76302d99e2be..3dd5ab189543f 100644
+--- a/include/crypto/chacha20.h
++++ b/include/crypto/chacha20.h
+@@ -24,4 +24,19 @@ int crypto_chacha20_setkey(struct crypto_skcipher *tfm, const u8 *key,
+ unsigned int keysize);
+ int crypto_chacha20_crypt(struct skcipher_request *req);
+
++enum chacha_constants { /* expand 32-byte k */
++ CHACHA_CONSTANT_EXPA = 0x61707865U,
++ CHACHA_CONSTANT_ND_3 = 0x3320646eU,
++ CHACHA_CONSTANT_2_BY = 0x79622d32U,
++ CHACHA_CONSTANT_TE_K = 0x6b206574U
++};
++
++static inline void chacha_init_consts(u32 *state)
++{
++ state[0] = CHACHA_CONSTANT_EXPA;
++ state[1] = CHACHA_CONSTANT_ND_3;
++ state[2] = CHACHA_CONSTANT_2_BY;
++ state[3] = CHACHA_CONSTANT_TE_K;
++}
++
+ #endif
+diff --git a/include/crypto/drbg.h b/include/crypto/drbg.h
+index 3fb581bf3b875..a6c3b8e7deb64 100644
+--- a/include/crypto/drbg.h
++++ b/include/crypto/drbg.h
+@@ -105,6 +105,12 @@ struct drbg_test_data {
+ struct drbg_string *testentropy; /* TEST PARAMETER: test entropy */
+ };
+
++enum drbg_seed_state {
++ DRBG_SEED_STATE_UNSEEDED,
++ DRBG_SEED_STATE_PARTIAL, /* Seeded with !rng_is_initialized() */
++ DRBG_SEED_STATE_FULL,
++};
++
+ struct drbg_state {
+ struct mutex drbg_mutex; /* lock around DRBG */
+ unsigned char *V; /* internal state 10.1.1.1 1a) */
+@@ -127,14 +133,14 @@ struct drbg_state {
+ struct crypto_wait ctr_wait; /* CTR mode async wait obj */
+ struct scatterlist sg_in, sg_out; /* CTR mode SGLs */
+
+- bool seeded; /* DRBG fully seeded? */
++ enum drbg_seed_state seeded; /* DRBG fully seeded? */
+ bool pr; /* Prediction resistance enabled? */
+- struct work_struct seed_work; /* asynchronous seeding support */
++ bool fips_primed; /* Continuous test primed? */
++ unsigned char *prev; /* FIPS 140-2 continuous test value */
+ struct crypto_rng *jent;
+ const struct drbg_state_ops *d_ops;
+ const struct drbg_core *core;
+ struct drbg_string test_data;
+- struct random_ready_callback random_ready;
+ };
+
+ static inline __u8 drbg_statelen(struct drbg_state *drbg)
+@@ -182,11 +188,7 @@ static inline size_t drbg_max_addtl(struct drbg_state *drbg)
+ static inline size_t drbg_max_requests(struct drbg_state *drbg)
+ {
+ /* SP800-90A requires 2**48 maximum requests before reseeding */
+-#if (__BITS_PER_LONG == 32)
+- return SIZE_MAX;
+-#else
+- return (1UL<<48);
+-#endif
++ return (1<<20);
+ }
+
+ /*
+diff --git a/include/crypto/internal/blake2s.h b/include/crypto/internal/blake2s.h
+new file mode 100644
+index 0000000000000..3ba066845b699
+--- /dev/null
++++ b/include/crypto/internal/blake2s.h
+@@ -0,0 +1,19 @@
++/* SPDX-License-Identifier: GPL-2.0 OR MIT */
++
++#ifndef _CRYPTO_INTERNAL_BLAKE2S_H
++#define _CRYPTO_INTERNAL_BLAKE2S_H
++
++#include <crypto/blake2s.h>
++
++void blake2s_compress_generic(struct blake2s_state *state,const u8 *block,
++ size_t nblocks, const u32 inc);
++
++void blake2s_compress_arch(struct blake2s_state *state,const u8 *block,
++ size_t nblocks, const u32 inc);
++
++static inline void blake2s_set_lastblock(struct blake2s_state *state)
++{
++ state->f[0] = -1;
++}
++
++#endif /* _CRYPTO_INTERNAL_BLAKE2S_H */
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index b51da879d7be0..60efd9810d536 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -60,6 +60,7 @@ enum cpuhp_state {
+ CPUHP_LUSTRE_CFS_DEAD,
+ CPUHP_AP_ARM_CACHE_B15_RAC_DEAD,
+ CPUHP_PADATA_DEAD,
++ CPUHP_RANDOM_PREPARE,
+ CPUHP_WORKQUEUE_PREP,
+ CPUHP_POWER_NUMA_PREPARE,
+ CPUHP_HRTIMERS_PREPARE,
+@@ -171,6 +172,7 @@ enum cpuhp_state {
+ CPUHP_AP_PERF_POWERPC_THREAD_IMC_ONLINE,
+ CPUHP_AP_WATCHDOG_ONLINE,
+ CPUHP_AP_WORKQUEUE_ONLINE,
++ CPUHP_AP_RANDOM_ONLINE,
+ CPUHP_AP_RCUTREE_ONLINE,
+ CPUHP_AP_BASE_CACHEINFO_ONLINE,
+ CPUHP_AP_ONLINE_DYN,
+diff --git a/include/linux/hw_random.h b/include/linux/hw_random.h
+index bee0827766a39..31587f36c06e5 100644
+--- a/include/linux/hw_random.h
++++ b/include/linux/hw_random.h
+@@ -59,7 +59,5 @@ extern int devm_hwrng_register(struct device *dev, struct hwrng *rng);
+ /** Unregister a Hardware Random Number Generator driver. */
+ extern void hwrng_unregister(struct hwrng *rng);
+ extern void devm_hwrng_unregister(struct device *dve, struct hwrng *rng);
+-/** Feed random bits into the pool. */
+-extern void add_hwgenerator_randomness(const char *buffer, size_t count, size_t entropy);
+
+ #endif /* LINUX_HWRANDOM_H_ */
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index c736c677b876d..26a5fba226644 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -2308,6 +2308,8 @@ extern int install_special_mapping(struct mm_struct *mm,
+ unsigned long addr, unsigned long len,
+ unsigned long flags, struct page **pages);
+
++unsigned long randomize_page(unsigned long start, unsigned long range);
++
+ extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
+
+ extern unsigned long mmap_region(struct file *file, unsigned long addr,
+diff --git a/include/linux/prandom.h b/include/linux/prandom.h
+index e20339c78a84c..709e8e69fb39b 100644
+--- a/include/linux/prandom.h
++++ b/include/linux/prandom.h
+@@ -10,6 +10,7 @@
+
+ #include <linux/types.h>
+ #include <linux/percpu.h>
++#include <linux/siphash.h>
+
+ u32 prandom_u32(void);
+ void prandom_bytes(void *buf, size_t nbytes);
+@@ -21,15 +22,10 @@ void prandom_reseed_late(void);
+ * The core SipHash round function. Each line can be executed in
+ * parallel given enough CPU resources.
+ */
+-#define PRND_SIPROUND(v0, v1, v2, v3) ( \
+- v0 += v1, v1 = rol64(v1, 13), v2 += v3, v3 = rol64(v3, 16), \
+- v1 ^= v0, v0 = rol64(v0, 32), v3 ^= v2, \
+- v0 += v3, v3 = rol64(v3, 21), v2 += v1, v1 = rol64(v1, 17), \
+- v3 ^= v0, v1 ^= v2, v2 = rol64(v2, 32) \
+-)
++#define PRND_SIPROUND(v0, v1, v2, v3) SIPHASH_PERMUTATION(v0, v1, v2, v3)
+
+-#define PRND_K0 (0x736f6d6570736575 ^ 0x6c7967656e657261)
+-#define PRND_K1 (0x646f72616e646f6d ^ 0x7465646279746573)
++#define PRND_K0 (SIPHASH_CONST_0 ^ SIPHASH_CONST_2)
++#define PRND_K1 (SIPHASH_CONST_1 ^ SIPHASH_CONST_3)
+
+ #elif BITS_PER_LONG == 32
+ /*
+@@ -37,14 +33,9 @@ void prandom_reseed_late(void);
+ * This is weaker, but 32-bit machines are not used for high-traffic
+ * applications, so there is less output for an attacker to analyze.
+ */
+-#define PRND_SIPROUND(v0, v1, v2, v3) ( \
+- v0 += v1, v1 = rol32(v1, 5), v2 += v3, v3 = rol32(v3, 8), \
+- v1 ^= v0, v0 = rol32(v0, 16), v3 ^= v2, \
+- v0 += v3, v3 = rol32(v3, 7), v2 += v1, v1 = rol32(v1, 13), \
+- v3 ^= v0, v1 ^= v2, v2 = rol32(v2, 16) \
+-)
+-#define PRND_K0 0x6c796765
+-#define PRND_K1 0x74656462
++#define PRND_SIPROUND(v0, v1, v2, v3) HSIPHASH_PERMUTATION(v0, v1, v2, v3)
++#define PRND_K0 (HSIPHASH_CONST_0 ^ HSIPHASH_CONST_2)
++#define PRND_K1 (HSIPHASH_CONST_1 ^ HSIPHASH_CONST_3)
+
+ #else
+ #error Unsupported BITS_PER_LONG
+diff --git a/include/linux/random.h b/include/linux/random.h
+index 37209b3b22ae4..3feafab498ad9 100644
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -1,50 +1,35 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+-/*
+- * include/linux/random.h
+- *
+- * Include file for the random number generator.
+- */
++
+ #ifndef _LINUX_RANDOM_H
+ #define _LINUX_RANDOM_H
+
++#include <linux/bug.h>
++#include <linux/kernel.h>
+ #include <linux/list.h>
+ #include <linux/once.h>
+
+ #include <uapi/linux/random.h>
+
+-struct random_ready_callback {
+- struct list_head list;
+- void (*func)(struct random_ready_callback *rdy);
+- struct module *owner;
+-};
++struct notifier_block;
+
+-extern void add_device_randomness(const void *, unsigned int);
++void add_device_randomness(const void *buf, size_t len);
++void __init add_bootloader_randomness(const void *buf, size_t len);
++void add_input_randomness(unsigned int type, unsigned int code,
++ unsigned int value) __latent_entropy;
++void add_interrupt_randomness(int irq) __latent_entropy;
++void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy);
+
+-#if defined(CONFIG_GCC_PLUGIN_LATENT_ENTROPY) && !defined(__CHECKER__)
++#if defined(LATENT_ENTROPY_PLUGIN) && !defined(__CHECKER__)
+ static inline void add_latent_entropy(void)
+ {
+- add_device_randomness((const void *)&latent_entropy,
+- sizeof(latent_entropy));
++ add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy));
+ }
+ #else
+-static inline void add_latent_entropy(void) {}
+-#endif
+-
+-extern void add_input_randomness(unsigned int type, unsigned int code,
+- unsigned int value) __latent_entropy;
+-extern void add_interrupt_randomness(int irq, int irq_flags) __latent_entropy;
+-
+-extern void get_random_bytes(void *buf, int nbytes);
+-extern int wait_for_random_bytes(void);
+-extern bool rng_is_initialized(void);
+-extern int add_random_ready_callback(struct random_ready_callback *rdy);
+-extern void del_random_ready_callback(struct random_ready_callback *rdy);
+-extern int __must_check get_random_bytes_arch(void *buf, int nbytes);
+-
+-#ifndef MODULE
+-extern const struct file_operations random_fops, urandom_fops;
++static inline void add_latent_entropy(void) { }
+ #endif
+
++void get_random_bytes(void *buf, size_t len);
++size_t __must_check get_random_bytes_arch(void *buf, size_t len);
+ u32 get_random_u32(void);
+ u64 get_random_u64(void);
+ static inline unsigned int get_random_int(void)
+@@ -76,36 +61,38 @@ static inline unsigned long get_random_long(void)
+
+ static inline unsigned long get_random_canary(void)
+ {
+- unsigned long val = get_random_long();
+-
+- return val & CANARY_MASK;
++ return get_random_long() & CANARY_MASK;
+ }
+
++int __init random_init(const char *command_line);
++bool rng_is_initialized(void);
++int wait_for_random_bytes(void);
++int register_random_ready_notifier(struct notifier_block *nb);
++int unregister_random_ready_notifier(struct notifier_block *nb);
++
+ /* Calls wait_for_random_bytes() and then calls get_random_bytes(buf, nbytes).
+ * Returns the result of the call to wait_for_random_bytes. */
+-static inline int get_random_bytes_wait(void *buf, int nbytes)
++static inline int get_random_bytes_wait(void *buf, size_t nbytes)
+ {
+ int ret = wait_for_random_bytes();
+ get_random_bytes(buf, nbytes);
+ return ret;
+ }
+
+-#define declare_get_random_var_wait(var) \
+- static inline int get_random_ ## var ## _wait(var *out) { \
++#define declare_get_random_var_wait(name, ret_type) \
++ static inline int get_random_ ## name ## _wait(ret_type *out) { \
+ int ret = wait_for_random_bytes(); \
+ if (unlikely(ret)) \
+ return ret; \
+- *out = get_random_ ## var(); \
++ *out = get_random_ ## name(); \
+ return 0; \
+ }
+-declare_get_random_var_wait(u32)
+-declare_get_random_var_wait(u64)
+-declare_get_random_var_wait(int)
+-declare_get_random_var_wait(long)
++declare_get_random_var_wait(u32, u32)
++declare_get_random_var_wait(u64, u32)
++declare_get_random_var_wait(int, unsigned int)
++declare_get_random_var_wait(long, unsigned long)
+ #undef declare_get_random_var
+
+-unsigned long randomize_page(unsigned long start, unsigned long range);
+-
+ /*
+ * This is designed to be standalone for just prandom
+ * users, but for now we include it from <linux/random.h>
+@@ -116,30 +103,39 @@ unsigned long randomize_page(unsigned long start, unsigned long range);
+ #ifdef CONFIG_ARCH_RANDOM
+ # include <asm/archrandom.h>
+ #else
+-static inline bool arch_get_random_long(unsigned long *v)
+-{
+- return 0;
+-}
+-static inline bool arch_get_random_int(unsigned int *v)
+-{
+- return 0;
+-}
+-static inline bool arch_has_random(void)
+-{
+- return 0;
+-}
+-static inline bool arch_get_random_seed_long(unsigned long *v)
+-{
+- return 0;
+-}
+-static inline bool arch_get_random_seed_int(unsigned int *v)
++static inline bool __must_check arch_get_random_long(unsigned long *v) { return false; }
++static inline bool __must_check arch_get_random_int(unsigned int *v) { return false; }
++static inline bool __must_check arch_get_random_seed_long(unsigned long *v) { return false; }
++static inline bool __must_check arch_get_random_seed_int(unsigned int *v) { return false; }
++#endif
++
++/*
++ * Called from the boot CPU during startup; not valid to call once
++ * secondary CPUs are up and preemption is possible.
++ */
++#ifndef arch_get_random_seed_long_early
++static inline bool __init arch_get_random_seed_long_early(unsigned long *v)
+ {
+- return 0;
++ WARN_ON(system_state != SYSTEM_BOOTING);
++ return arch_get_random_seed_long(v);
+ }
+-static inline bool arch_has_random_seed(void)
++#endif
++
++#ifndef arch_get_random_long_early
++static inline bool __init arch_get_random_long_early(unsigned long *v)
+ {
+- return 0;
++ WARN_ON(system_state != SYSTEM_BOOTING);
++ return arch_get_random_long(v);
+ }
+ #endif
+
++#ifdef CONFIG_SMP
++int random_prepare_cpu(unsigned int cpu);
++int random_online_cpu(unsigned int cpu);
++#endif
++
++#ifndef MODULE
++extern const struct file_operations random_fops, urandom_fops;
++#endif
++
+ #endif /* _LINUX_RANDOM_H */
+diff --git a/include/linux/siphash.h b/include/linux/siphash.h
+index 0cda61855d907..0bb5ecd507bef 100644
+--- a/include/linux/siphash.h
++++ b/include/linux/siphash.h
+@@ -136,4 +136,32 @@ static inline u32 hsiphash(const void *data, size_t len,
+ return ___hsiphash_aligned(data, len, key);
+ }
+
++/*
++ * These macros expose the raw SipHash and HalfSipHash permutations.
++ * Do not use them directly! If you think you have a use for them,
++ * be sure to CC the maintainer of this file explaining why.
++ */
++
++#define SIPHASH_PERMUTATION(a, b, c, d) ( \
++ (a) += (b), (b) = rol64((b), 13), (b) ^= (a), (a) = rol64((a), 32), \
++ (c) += (d), (d) = rol64((d), 16), (d) ^= (c), \
++ (a) += (d), (d) = rol64((d), 21), (d) ^= (a), \
++ (c) += (b), (b) = rol64((b), 17), (b) ^= (c), (c) = rol64((c), 32))
++
++#define SIPHASH_CONST_0 0x736f6d6570736575ULL
++#define SIPHASH_CONST_1 0x646f72616e646f6dULL
++#define SIPHASH_CONST_2 0x6c7967656e657261ULL
++#define SIPHASH_CONST_3 0x7465646279746573ULL
++
++#define HSIPHASH_PERMUTATION(a, b, c, d) ( \
++ (a) += (b), (b) = rol32((b), 5), (b) ^= (a), (a) = rol32((a), 16), \
++ (c) += (d), (d) = rol32((d), 8), (d) ^= (c), \
++ (a) += (d), (d) = rol32((d), 7), (d) ^= (a), \
++ (c) += (b), (b) = rol32((b), 13), (b) ^= (c), (c) = rol32((c), 16))
++
++#define HSIPHASH_CONST_0 0U
++#define HSIPHASH_CONST_1 0U
++#define HSIPHASH_CONST_2 0x6c796765U
++#define HSIPHASH_CONST_3 0x74656462U
++
+ #endif /* _LINUX_SIPHASH_H */
+diff --git a/include/linux/timex.h b/include/linux/timex.h
+index 39c25dbebfe80..c7616cfb48d20 100644
+--- a/include/linux/timex.h
++++ b/include/linux/timex.h
+@@ -62,6 +62,8 @@
+ #include <linux/types.h>
+ #include <linux/param.h>
+
++unsigned long random_get_entropy_fallback(void);
++
+ #include <asm/timex.h>
+
+ #ifndef random_get_entropy
+@@ -74,8 +76,14 @@
+ *
+ * By default we use get_cycles() for this purpose, but individual
+ * architectures may override this in their asm/timex.h header file.
++ * If a given arch does not have get_cycles(), then we fallback to
++ * using random_get_entropy_fallback().
+ */
+-#define random_get_entropy() get_cycles()
++#ifdef get_cycles
++#define random_get_entropy() ((unsigned long)get_cycles())
++#else
++#define random_get_entropy() random_get_entropy_fallback()
++#endif
+ #endif
+
+ /*
+diff --git a/include/trace/events/random.h b/include/trace/events/random.h
+deleted file mode 100644
+index 0560dfc33f1c3..0000000000000
+--- a/include/trace/events/random.h
++++ /dev/null
+@@ -1,316 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#undef TRACE_SYSTEM
+-#define TRACE_SYSTEM random
+-
+-#if !defined(_TRACE_RANDOM_H) || defined(TRACE_HEADER_MULTI_READ)
+-#define _TRACE_RANDOM_H
+-
+-#include <linux/writeback.h>
+-#include <linux/tracepoint.h>
+-
+-TRACE_EVENT(add_device_randomness,
+- TP_PROTO(int bytes, unsigned long IP),
+-
+- TP_ARGS(bytes, IP),
+-
+- TP_STRUCT__entry(
+- __field( int, bytes )
+- __field(unsigned long, IP )
+- ),
+-
+- TP_fast_assign(
+- __entry->bytes = bytes;
+- __entry->IP = IP;
+- ),
+-
+- TP_printk("bytes %d caller %pS",
+- __entry->bytes, (void *)__entry->IP)
+-);
+-
+-DECLARE_EVENT_CLASS(random__mix_pool_bytes,
+- TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
+-
+- TP_ARGS(pool_name, bytes, IP),
+-
+- TP_STRUCT__entry(
+- __field( const char *, pool_name )
+- __field( int, bytes )
+- __field(unsigned long, IP )
+- ),
+-
+- TP_fast_assign(
+- __entry->pool_name = pool_name;
+- __entry->bytes = bytes;
+- __entry->IP = IP;
+- ),
+-
+- TP_printk("%s pool: bytes %d caller %pS",
+- __entry->pool_name, __entry->bytes, (void *)__entry->IP)
+-);
+-
+-DEFINE_EVENT(random__mix_pool_bytes, mix_pool_bytes,
+- TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
+-
+- TP_ARGS(pool_name, bytes, IP)
+-);
+-
+-DEFINE_EVENT(random__mix_pool_bytes, mix_pool_bytes_nolock,
+- TP_PROTO(const char *pool_name, int bytes, unsigned long IP),
+-
+- TP_ARGS(pool_name, bytes, IP)
+-);
+-
+-TRACE_EVENT(credit_entropy_bits,
+- TP_PROTO(const char *pool_name, int bits, int entropy_count,
+- int entropy_total, unsigned long IP),
+-
+- TP_ARGS(pool_name, bits, entropy_count, entropy_total, IP),
+-
+- TP_STRUCT__entry(
+- __field( const char *, pool_name )
+- __field( int, bits )
+- __field( int, entropy_count )
+- __field( int, entropy_total )
+- __field(unsigned long, IP )
+- ),
+-
+- TP_fast_assign(
+- __entry->pool_name = pool_name;
+- __entry->bits = bits;
+- __entry->entropy_count = entropy_count;
+- __entry->entropy_total = entropy_total;
+- __entry->IP = IP;
+- ),
+-
+- TP_printk("%s pool: bits %d entropy_count %d entropy_total %d "
+- "caller %pS", __entry->pool_name, __entry->bits,
+- __entry->entropy_count, __entry->entropy_total,
+- (void *)__entry->IP)
+-);
+-
+-TRACE_EVENT(push_to_pool,
+- TP_PROTO(const char *pool_name, int pool_bits, int input_bits),
+-
+- TP_ARGS(pool_name, pool_bits, input_bits),
+-
+- TP_STRUCT__entry(
+- __field( const char *, pool_name )
+- __field( int, pool_bits )
+- __field( int, input_bits )
+- ),
+-
+- TP_fast_assign(
+- __entry->pool_name = pool_name;
+- __entry->pool_bits = pool_bits;
+- __entry->input_bits = input_bits;
+- ),
+-
+- TP_printk("%s: pool_bits %d input_pool_bits %d",
+- __entry->pool_name, __entry->pool_bits,
+- __entry->input_bits)
+-);
+-
+-TRACE_EVENT(debit_entropy,
+- TP_PROTO(const char *pool_name, int debit_bits),
+-
+- TP_ARGS(pool_name, debit_bits),
+-
+- TP_STRUCT__entry(
+- __field( const char *, pool_name )
+- __field( int, debit_bits )
+- ),
+-
+- TP_fast_assign(
+- __entry->pool_name = pool_name;
+- __entry->debit_bits = debit_bits;
+- ),
+-
+- TP_printk("%s: debit_bits %d", __entry->pool_name,
+- __entry->debit_bits)
+-);
+-
+-TRACE_EVENT(add_input_randomness,
+- TP_PROTO(int input_bits),
+-
+- TP_ARGS(input_bits),
+-
+- TP_STRUCT__entry(
+- __field( int, input_bits )
+- ),
+-
+- TP_fast_assign(
+- __entry->input_bits = input_bits;
+- ),
+-
+- TP_printk("input_pool_bits %d", __entry->input_bits)
+-);
+-
+-TRACE_EVENT(add_disk_randomness,
+- TP_PROTO(dev_t dev, int input_bits),
+-
+- TP_ARGS(dev, input_bits),
+-
+- TP_STRUCT__entry(
+- __field( dev_t, dev )
+- __field( int, input_bits )
+- ),
+-
+- TP_fast_assign(
+- __entry->dev = dev;
+- __entry->input_bits = input_bits;
+- ),
+-
+- TP_printk("dev %d,%d input_pool_bits %d", MAJOR(__entry->dev),
+- MINOR(__entry->dev), __entry->input_bits)
+-);
+-
+-TRACE_EVENT(xfer_secondary_pool,
+- TP_PROTO(const char *pool_name, int xfer_bits, int request_bits,
+- int pool_entropy, int input_entropy),
+-
+- TP_ARGS(pool_name, xfer_bits, request_bits, pool_entropy,
+- input_entropy),
+-
+- TP_STRUCT__entry(
+- __field( const char *, pool_name )
+- __field( int, xfer_bits )
+- __field( int, request_bits )
+- __field( int, pool_entropy )
+- __field( int, input_entropy )
+- ),
+-
+- TP_fast_assign(
+- __entry->pool_name = pool_name;
+- __entry->xfer_bits = xfer_bits;
+- __entry->request_bits = request_bits;
+- __entry->pool_entropy = pool_entropy;
+- __entry->input_entropy = input_entropy;
+- ),
+-
+- TP_printk("pool %s xfer_bits %d request_bits %d pool_entropy %d "
+- "input_entropy %d", __entry->pool_name, __entry->xfer_bits,
+- __entry->request_bits, __entry->pool_entropy,
+- __entry->input_entropy)
+-);
+-
+-DECLARE_EVENT_CLASS(random__get_random_bytes,
+- TP_PROTO(int nbytes, unsigned long IP),
+-
+- TP_ARGS(nbytes, IP),
+-
+- TP_STRUCT__entry(
+- __field( int, nbytes )
+- __field(unsigned long, IP )
+- ),
+-
+- TP_fast_assign(
+- __entry->nbytes = nbytes;
+- __entry->IP = IP;
+- ),
+-
+- TP_printk("nbytes %d caller %pS", __entry->nbytes, (void *)__entry->IP)
+-);
+-
+-DEFINE_EVENT(random__get_random_bytes, get_random_bytes,
+- TP_PROTO(int nbytes, unsigned long IP),
+-
+- TP_ARGS(nbytes, IP)
+-);
+-
+-DEFINE_EVENT(random__get_random_bytes, get_random_bytes_arch,
+- TP_PROTO(int nbytes, unsigned long IP),
+-
+- TP_ARGS(nbytes, IP)
+-);
+-
+-DECLARE_EVENT_CLASS(random__extract_entropy,
+- TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
+- unsigned long IP),
+-
+- TP_ARGS(pool_name, nbytes, entropy_count, IP),
+-
+- TP_STRUCT__entry(
+- __field( const char *, pool_name )
+- __field( int, nbytes )
+- __field( int, entropy_count )
+- __field(unsigned long, IP )
+- ),
+-
+- TP_fast_assign(
+- __entry->pool_name = pool_name;
+- __entry->nbytes = nbytes;
+- __entry->entropy_count = entropy_count;
+- __entry->IP = IP;
+- ),
+-
+- TP_printk("%s pool: nbytes %d entropy_count %d caller %pS",
+- __entry->pool_name, __entry->nbytes, __entry->entropy_count,
+- (void *)__entry->IP)
+-);
+-
+-
+-DEFINE_EVENT(random__extract_entropy, extract_entropy,
+- TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
+- unsigned long IP),
+-
+- TP_ARGS(pool_name, nbytes, entropy_count, IP)
+-);
+-
+-DEFINE_EVENT(random__extract_entropy, extract_entropy_user,
+- TP_PROTO(const char *pool_name, int nbytes, int entropy_count,
+- unsigned long IP),
+-
+- TP_ARGS(pool_name, nbytes, entropy_count, IP)
+-);
+-
+-TRACE_EVENT(random_read,
+- TP_PROTO(int got_bits, int need_bits, int pool_left, int input_left),
+-
+- TP_ARGS(got_bits, need_bits, pool_left, input_left),
+-
+- TP_STRUCT__entry(
+- __field( int, got_bits )
+- __field( int, need_bits )
+- __field( int, pool_left )
+- __field( int, input_left )
+- ),
+-
+- TP_fast_assign(
+- __entry->got_bits = got_bits;
+- __entry->need_bits = need_bits;
+- __entry->pool_left = pool_left;
+- __entry->input_left = input_left;
+- ),
+-
+- TP_printk("got_bits %d still_needed_bits %d "
+- "blocking_pool_entropy_left %d input_entropy_left %d",
+- __entry->got_bits, __entry->got_bits, __entry->pool_left,
+- __entry->input_left)
+-);
+-
+-TRACE_EVENT(urandom_read,
+- TP_PROTO(int got_bits, int pool_left, int input_left),
+-
+- TP_ARGS(got_bits, pool_left, input_left),
+-
+- TP_STRUCT__entry(
+- __field( int, got_bits )
+- __field( int, pool_left )
+- __field( int, input_left )
+- ),
+-
+- TP_fast_assign(
+- __entry->got_bits = got_bits;
+- __entry->pool_left = pool_left;
+- __entry->input_left = input_left;
+- ),
+-
+- TP_printk("got_bits %d nonblocking_pool_entropy_left %d "
+- "input_entropy_left %d", __entry->got_bits,
+- __entry->pool_left, __entry->input_left)
+-);
+-
+-#endif /* _TRACE_RANDOM_H */
+-
+-/* This part must be outside protection */
+-#include <trace/define_trace.h>
+diff --git a/include/uapi/linux/random.h b/include/uapi/linux/random.h
+index 26ee91300e3ec..dcc1b3e6106fe 100644
+--- a/include/uapi/linux/random.h
++++ b/include/uapi/linux/random.h
+@@ -48,9 +48,11 @@ struct rand_pool_info {
+ * Flags for getrandom(2)
+ *
+ * GRND_NONBLOCK Don't block and return EAGAIN instead
+- * GRND_RANDOM Use the /dev/random pool instead of /dev/urandom
++ * GRND_RANDOM No effect
++ * GRND_INSECURE Return non-cryptographic random bytes
+ */
+ #define GRND_NONBLOCK 0x0001
+ #define GRND_RANDOM 0x0002
++#define GRND_INSECURE 0x0004
+
+ #endif /* _UAPI_LINUX_RANDOM_H */
+diff --git a/init/main.c b/init/main.c
+index 272ec131211c0..489a5aa7ba53c 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -549,13 +549,6 @@ asmlinkage __visible void __init start_kernel(void)
+ page_address_init();
+ pr_notice("%s", linux_banner);
+ setup_arch(&command_line);
+- /*
+- * Set up the the initial canary and entropy after arch
+- * and after adding latent and command line entropy.
+- */
+- add_latent_entropy();
+- add_device_randomness(command_line, strlen(command_line));
+- boot_init_stack_canary();
+ mm_init_cpumask(&init_mm);
+ setup_command_line(command_line);
+ setup_nr_cpu_ids();
+@@ -641,6 +634,17 @@ asmlinkage __visible void __init start_kernel(void)
+ softirq_init();
+ timekeeping_init();
+ time_init();
++
++ /*
++ * For best initial stack canary entropy, prepare it after:
++ * - setup_arch() for any UEFI RNG entropy and boot cmdline access
++ * - timekeeping_init() for ktime entropy used in random_init()
++ * - time_init() for making random_get_entropy() work on some platforms
++ * - random_init() to initialize the RNG from from early entropy sources
++ */
++ random_init(command_line);
++ boot_init_stack_canary();
++
+ perf_event_init();
+ profile_init();
+ call_function_init();
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index d6fd362afc81f..c9ca190ec0347 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -32,6 +32,7 @@
+ #include <linux/slab.h>
+ #include <linux/percpu-rwsem.h>
+ #include <linux/cpuset.h>
++#include <linux/random.h>
+
+ #include <trace/events/power.h>
+ #define CREATE_TRACE_POINTS
+@@ -1404,6 +1405,11 @@ static struct cpuhp_step cpuhp_hp_states[] = {
+ .startup.single = perf_event_init_cpu,
+ .teardown.single = perf_event_exit_cpu,
+ },
++ [CPUHP_RANDOM_PREPARE] = {
++ .name = "random:prepare",
++ .startup.single = random_prepare_cpu,
++ .teardown.single = NULL,
++ },
+ [CPUHP_WORKQUEUE_PREP] = {
+ .name = "workqueue:prepare",
+ .startup.single = workqueue_prepare_cpu,
+@@ -1520,6 +1526,11 @@ static struct cpuhp_step cpuhp_hp_states[] = {
+ .startup.single = workqueue_online_cpu,
+ .teardown.single = workqueue_offline_cpu,
+ },
++ [CPUHP_AP_RANDOM_ONLINE] = {
++ .name = "random:online",
++ .startup.single = random_online_cpu,
++ .teardown.single = NULL,
++ },
+ [CPUHP_AP_RCUTREE_ONLINE] = {
+ .name = "RCU/tree:online",
+ .startup.single = rcutree_online_cpu,
+diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
+index 38554bc353755..e2f7afcb1ae69 100644
+--- a/kernel/irq/handle.c
++++ b/kernel/irq/handle.c
+@@ -188,7 +188,7 @@ irqreturn_t handle_irq_event_percpu(struct irq_desc *desc)
+
+ retval = __handle_irq_event_percpu(desc, &flags);
+
+- add_interrupt_randomness(desc->irq_data.irq, flags);
++ add_interrupt_randomness(desc->irq_data.irq);
+
+ if (!noirqdebug)
+ note_interrupt(desc, retval);
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index f246818e35dbc..087f71183c3f2 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -22,6 +22,7 @@
+ #include <linux/clocksource.h>
+ #include <linux/jiffies.h>
+ #include <linux/time.h>
++#include <linux/timex.h>
+ #include <linux/tick.h>
+ #include <linux/stop_machine.h>
+ #include <linux/pvclock_gtod.h>
+@@ -2308,6 +2309,20 @@ static int timekeeping_validate_timex(const struct timex *txc)
+ return 0;
+ }
+
++/**
++ * random_get_entropy_fallback - Returns the raw clock source value,
++ * used by random.c for platforms with no valid random_get_entropy().
++ */
++unsigned long random_get_entropy_fallback(void)
++{
++ struct tk_read_base *tkr = &tk_core.timekeeper.tkr_mono;
++ struct clocksource *clock = READ_ONCE(tkr->clock);
++
++ if (unlikely(timekeeping_suspended || !clock))
++ return 0;
++ return clock->read(clock);
++}
++EXPORT_SYMBOL_GPL(random_get_entropy_fallback);
+
+ /**
+ * do_adjtimex() - Accessor function to NTP __do_adjtimex function
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 621859a453f82..9a4277034c647 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -1277,8 +1277,7 @@ config WARN_ALL_UNSEEDED_RANDOM
+ so architecture maintainers really need to do what they can
+ to get the CRNG seeded sooner after the system is booted.
+ However, since users cannot do anything actionable to
+- address this, by default the kernel will issue only a single
+- warning for the first use of unseeded randomness.
++ address this, by default this option is disabled.
+
+ Say Y here if you want to receive warnings for all uses of
+ unseeded randomness. This will be of use primarily for
+diff --git a/lib/Makefile b/lib/Makefile
+index 1d7a705d72074..e08544c509a84 100644
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -283,3 +283,5 @@ obj-$(CONFIG_GENERIC_LIB_LSHRDI3) += lshrdi3.o
+ obj-$(CONFIG_GENERIC_LIB_MULDI3) += muldi3.o
+ obj-$(CONFIG_GENERIC_LIB_CMPDI2) += cmpdi2.o
+ obj-$(CONFIG_GENERIC_LIB_UCMPDI2) += ucmpdi2.o
++
++obj-y += crypto/
+diff --git a/lib/crypto/Makefile b/lib/crypto/Makefile
+new file mode 100644
+index 0000000000000..d0bca68618f03
+--- /dev/null
++++ b/lib/crypto/Makefile
+@@ -0,0 +1,7 @@
++# SPDX-License-Identifier: GPL-2.0
++
++obj-y += libblake2s.o
++libblake2s-y += blake2s.o blake2s-generic.o
++ifneq ($(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS),y)
++libblake2s-y += blake2s-selftest.o
++endif
+diff --git a/lib/crypto/blake2s-generic.c b/lib/crypto/blake2s-generic.c
+new file mode 100644
+index 0000000000000..04ff8df245136
+--- /dev/null
++++ b/lib/crypto/blake2s-generic.c
+@@ -0,0 +1,111 @@
++// SPDX-License-Identifier: GPL-2.0 OR MIT
++/*
++ * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
++ *
++ * This is an implementation of the BLAKE2s hash and PRF functions.
++ *
++ * Information: https://blake2.net/
++ *
++ */
++
++#include <crypto/internal/blake2s.h>
++#include <linux/types.h>
++#include <linux/string.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/bug.h>
++#include <asm/unaligned.h>
++
++static const u8 blake2s_sigma[10][16] = {
++ { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
++ { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
++ { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
++ { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
++ { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
++ { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
++ { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
++ { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
++ { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
++ { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 },
++};
++
++static inline void blake2s_increment_counter(struct blake2s_state *state,
++ const u32 inc)
++{
++ state->t[0] += inc;
++ state->t[1] += (state->t[0] < inc);
++}
++
++void blake2s_compress_generic(struct blake2s_state *state,const u8 *block,
++ size_t nblocks, const u32 inc)
++{
++ u32 m[16];
++ u32 v[16];
++ int i;
++
++ WARN_ON(IS_ENABLED(DEBUG) &&
++ (nblocks > 1 && inc != BLAKE2S_BLOCK_SIZE));
++
++ while (nblocks > 0) {
++ blake2s_increment_counter(state, inc);
++ memcpy(m, block, BLAKE2S_BLOCK_SIZE);
++ le32_to_cpu_array(m, ARRAY_SIZE(m));
++ memcpy(v, state->h, 32);
++ v[ 8] = BLAKE2S_IV0;
++ v[ 9] = BLAKE2S_IV1;
++ v[10] = BLAKE2S_IV2;
++ v[11] = BLAKE2S_IV3;
++ v[12] = BLAKE2S_IV4 ^ state->t[0];
++ v[13] = BLAKE2S_IV5 ^ state->t[1];
++ v[14] = BLAKE2S_IV6 ^ state->f[0];
++ v[15] = BLAKE2S_IV7 ^ state->f[1];
++
++#define G(r, i, a, b, c, d) do { \
++ a += b + m[blake2s_sigma[r][2 * i + 0]]; \
++ d = ror32(d ^ a, 16); \
++ c += d; \
++ b = ror32(b ^ c, 12); \
++ a += b + m[blake2s_sigma[r][2 * i + 1]]; \
++ d = ror32(d ^ a, 8); \
++ c += d; \
++ b = ror32(b ^ c, 7); \
++} while (0)
++
++#define ROUND(r) do { \
++ G(r, 0, v[0], v[ 4], v[ 8], v[12]); \
++ G(r, 1, v[1], v[ 5], v[ 9], v[13]); \
++ G(r, 2, v[2], v[ 6], v[10], v[14]); \
++ G(r, 3, v[3], v[ 7], v[11], v[15]); \
++ G(r, 4, v[0], v[ 5], v[10], v[15]); \
++ G(r, 5, v[1], v[ 6], v[11], v[12]); \
++ G(r, 6, v[2], v[ 7], v[ 8], v[13]); \
++ G(r, 7, v[3], v[ 4], v[ 9], v[14]); \
++} while (0)
++ ROUND(0);
++ ROUND(1);
++ ROUND(2);
++ ROUND(3);
++ ROUND(4);
++ ROUND(5);
++ ROUND(6);
++ ROUND(7);
++ ROUND(8);
++ ROUND(9);
++
++#undef G
++#undef ROUND
++
++ for (i = 0; i < 8; ++i)
++ state->h[i] ^= v[i] ^ v[i + 8];
++
++ block += BLAKE2S_BLOCK_SIZE;
++ --nblocks;
++ }
++}
++
++EXPORT_SYMBOL(blake2s_compress_generic);
++
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("BLAKE2s hash function");
++MODULE_AUTHOR("Jason A. Donenfeld <Jason@zx2c4.com>");
+diff --git a/lib/crypto/blake2s-selftest.c b/lib/crypto/blake2s-selftest.c
+new file mode 100644
+index 0000000000000..7a9edc96ddddf
+--- /dev/null
++++ b/lib/crypto/blake2s-selftest.c
+@@ -0,0 +1,591 @@
++// SPDX-License-Identifier: GPL-2.0 OR MIT
++/*
++ * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
++ */
++
++#include <crypto/blake2s.h>
++#include <linux/string.h>
++
++/*
++ * blake2s_testvecs[] generated with the program below (using libb2-dev and
++ * libssl-dev [OpenSSL])
++ *
++ * #include <blake2.h>
++ * #include <stdint.h>
++ * #include <stdio.h>
++ *
++ * #include <openssl/evp.h>
++ *
++ * #define BLAKE2S_TESTVEC_COUNT 256
++ *
++ * static void print_vec(const uint8_t vec[], int len)
++ * {
++ * int i;
++ *
++ * printf(" { ");
++ * for (i = 0; i < len; i++) {
++ * if (i && (i % 12) == 0)
++ * printf("\n ");
++ * printf("0x%02x, ", vec[i]);
++ * }
++ * printf("},\n");
++ * }
++ *
++ * int main(void)
++ * {
++ * uint8_t key[BLAKE2S_KEYBYTES];
++ * uint8_t buf[BLAKE2S_TESTVEC_COUNT];
++ * uint8_t hash[BLAKE2S_OUTBYTES];
++ * int i, j;
++ *
++ * key[0] = key[1] = 1;
++ * for (i = 2; i < BLAKE2S_KEYBYTES; ++i)
++ * key[i] = key[i - 2] + key[i - 1];
++ *
++ * for (i = 0; i < BLAKE2S_TESTVEC_COUNT; ++i)
++ * buf[i] = (uint8_t)i;
++ *
++ * printf("static const u8 blake2s_testvecs[][BLAKE2S_HASH_SIZE] __initconst = {\n");
++ *
++ * for (i = 0; i < BLAKE2S_TESTVEC_COUNT; ++i) {
++ * int outlen = 1 + i % BLAKE2S_OUTBYTES;
++ * int keylen = (13 * i) % (BLAKE2S_KEYBYTES + 1);
++ *
++ * blake2s(hash, buf, key + BLAKE2S_KEYBYTES - keylen, outlen, i,
++ * keylen);
++ * print_vec(hash, outlen);
++ * }
++ * printf("};\n\n");
++ *
++ * return 0;
++ *}
++ */
++static const u8 blake2s_testvecs[][BLAKE2S_HASH_SIZE] __initconst = {
++ { 0xa1, },
++ { 0x7c, 0x89, },
++ { 0x74, 0x0e, 0xd4, },
++ { 0x47, 0x0c, 0x21, 0x15, },
++ { 0x18, 0xd6, 0x9c, 0xa6, 0xc4, },
++ { 0x13, 0x5d, 0x16, 0x63, 0x2e, 0xf9, },
++ { 0x2c, 0xb5, 0x04, 0xb7, 0x99, 0xe2, 0x73, },
++ { 0x9a, 0x0f, 0xd2, 0x39, 0xd6, 0x68, 0x1b, 0x92, },
++ { 0xc8, 0xde, 0x7a, 0xea, 0x2f, 0xf4, 0xd2, 0xe3, 0x2b, },
++ { 0x5b, 0xf9, 0x43, 0x52, 0x0c, 0x12, 0xba, 0xb5, 0x93, 0x9f, },
++ { 0xc6, 0x2c, 0x4e, 0x80, 0xfc, 0x32, 0x5b, 0x33, 0xb8, 0xb8, 0x0a, },
++ { 0xa7, 0x5c, 0xfd, 0x3a, 0xcc, 0xbf, 0x90, 0xca, 0xb7, 0x97, 0xde, 0xd8, },
++ { 0x66, 0xca, 0x3c, 0xc4, 0x19, 0xef, 0x92, 0x66, 0x3f, 0x21, 0x8f, 0xda,
++ 0xb7, },
++ { 0xba, 0xe5, 0xbb, 0x30, 0x25, 0x94, 0x6d, 0xc3, 0x89, 0x09, 0xc4, 0x25,
++ 0x52, 0x3e, },
++ { 0xa2, 0xef, 0x0e, 0x52, 0x0b, 0x5f, 0xa2, 0x01, 0x6d, 0x0a, 0x25, 0xbc,
++ 0x57, 0xe2, 0x27, },
++ { 0x4f, 0xe0, 0xf9, 0x52, 0x12, 0xda, 0x84, 0xb7, 0xab, 0xae, 0xb0, 0xa6,
++ 0x47, 0x2a, 0xc7, 0xf5, },
++ { 0x56, 0xe7, 0xa8, 0x1c, 0x4c, 0xca, 0xed, 0x90, 0x31, 0xec, 0x87, 0x43,
++ 0xe7, 0x72, 0x08, 0xec, 0xbe, },
++ { 0x7e, 0xdf, 0x80, 0x1c, 0x93, 0x33, 0xfd, 0x53, 0x44, 0xba, 0xfd, 0x96,
++ 0xe1, 0xbb, 0xb5, 0x65, 0xa5, 0x00, },
++ { 0xec, 0x6b, 0xed, 0xf7, 0x7b, 0x62, 0x1d, 0x7d, 0xf4, 0x82, 0xf3, 0x1e,
++ 0x18, 0xff, 0x2b, 0xc4, 0x06, 0x20, 0x2a, },
++ { 0x74, 0x98, 0xd7, 0x68, 0x63, 0xed, 0x87, 0xe4, 0x5d, 0x8d, 0x9e, 0x1d,
++ 0xfd, 0x2a, 0xbb, 0x86, 0xac, 0xe9, 0x2a, 0x89, },
++ { 0x89, 0xc3, 0x88, 0xce, 0x2b, 0x33, 0x1e, 0x10, 0xd1, 0x37, 0x20, 0x86,
++ 0x28, 0x43, 0x70, 0xd9, 0xfb, 0x96, 0xd9, 0xb5, 0xd3, },
++ { 0xcb, 0x56, 0x74, 0x41, 0x8d, 0x80, 0x01, 0x9a, 0x6b, 0x38, 0xe1, 0x41,
++ 0xad, 0x9c, 0x62, 0x74, 0xce, 0x35, 0xd5, 0x6c, 0x89, 0x6e, },
++ { 0x79, 0xaf, 0x94, 0x59, 0x99, 0x26, 0xe1, 0xc9, 0x34, 0xfe, 0x7c, 0x22,
++ 0xf7, 0x43, 0xd7, 0x65, 0xd4, 0x48, 0x18, 0xac, 0x3d, 0xfd, 0x93, },
++ { 0x85, 0x0d, 0xff, 0xb8, 0x3e, 0x87, 0x41, 0xb0, 0x95, 0xd3, 0x3d, 0x00,
++ 0x47, 0x55, 0x9e, 0xd2, 0x69, 0xea, 0xbf, 0xe9, 0x7a, 0x2d, 0x61, 0x45, },
++ { 0x03, 0xe0, 0x85, 0xec, 0x54, 0xb5, 0x16, 0x53, 0xa8, 0xc4, 0x71, 0xe9,
++ 0x6a, 0xe7, 0xcb, 0xc4, 0x15, 0x02, 0xfc, 0x34, 0xa4, 0xa4, 0x28, 0x13,
++ 0xd1, },
++ { 0xe3, 0x34, 0x4b, 0xe1, 0xd0, 0x4b, 0x55, 0x61, 0x8f, 0xc0, 0x24, 0x05,
++ 0xe6, 0xe0, 0x3d, 0x70, 0x24, 0x4d, 0xda, 0xb8, 0x91, 0x05, 0x29, 0x07,
++ 0x01, 0x3e, },
++ { 0x61, 0xff, 0x01, 0x72, 0xb1, 0x4d, 0xf6, 0xfe, 0xd1, 0xd1, 0x08, 0x74,
++ 0xe6, 0x91, 0x44, 0xeb, 0x61, 0xda, 0x40, 0xaf, 0xfc, 0x8c, 0x91, 0x6b,
++ 0xec, 0x13, 0xed, },
++ { 0xd4, 0x40, 0xd2, 0xa0, 0x7f, 0xc1, 0x58, 0x0c, 0x85, 0xa0, 0x86, 0xc7,
++ 0x86, 0xb9, 0x61, 0xc9, 0xea, 0x19, 0x86, 0x1f, 0xab, 0x07, 0xce, 0x37,
++ 0x72, 0x67, 0x09, 0xfc, },
++ { 0x9e, 0xf8, 0x18, 0x67, 0x93, 0x10, 0x9b, 0x39, 0x75, 0xe8, 0x8b, 0x38,
++ 0x82, 0x7d, 0xb8, 0xb7, 0xa5, 0xaf, 0xe6, 0x6a, 0x22, 0x5e, 0x1f, 0x9c,
++ 0x95, 0x29, 0x19, 0xf2, 0x4b, },
++ { 0xc8, 0x62, 0x25, 0xf5, 0x98, 0xc9, 0xea, 0xe5, 0x29, 0x3a, 0xd3, 0x22,
++ 0xeb, 0xeb, 0x07, 0x7c, 0x15, 0x07, 0xee, 0x15, 0x61, 0xbb, 0x05, 0x30,
++ 0x99, 0x7f, 0x11, 0xf6, 0x0a, 0x1d, },
++ { 0x68, 0x70, 0xf7, 0x90, 0xa1, 0x8b, 0x1f, 0x0f, 0xbb, 0xce, 0xd2, 0x0e,
++ 0x33, 0x1f, 0x7f, 0xa9, 0x78, 0xa8, 0xa6, 0x81, 0x66, 0xab, 0x8d, 0xcd,
++ 0x58, 0x55, 0x3a, 0x0b, 0x7a, 0xdb, 0xb5, },
++ { 0xdd, 0x35, 0xd2, 0xb4, 0xf6, 0xc7, 0xea, 0xab, 0x64, 0x24, 0x4e, 0xfe,
++ 0xe5, 0x3d, 0x4e, 0x95, 0x8b, 0x6d, 0x6c, 0xbc, 0xb0, 0xf8, 0x88, 0x61,
++ 0x09, 0xb7, 0x78, 0xa3, 0x31, 0xfe, 0xd9, 0x2f, },
++ { 0x0a, },
++ { 0x6e, 0xd4, },
++ { 0x64, 0xe9, 0xd1, },
++ { 0x30, 0xdd, 0x71, 0xef, },
++ { 0x11, 0xb5, 0x0c, 0x87, 0xc9, },
++ { 0x06, 0x1c, 0x6d, 0x04, 0x82, 0xd0, },
++ { 0x5c, 0x42, 0x0b, 0xee, 0xc5, 0x9c, 0xb2, },
++ { 0xe8, 0x29, 0xd6, 0xb4, 0x5d, 0xf7, 0x2b, 0x93, },
++ { 0x18, 0xca, 0x27, 0x72, 0x43, 0x39, 0x16, 0xbc, 0x6a, },
++ { 0x39, 0x8f, 0xfd, 0x64, 0xf5, 0x57, 0x23, 0xb0, 0x45, 0xf8, },
++ { 0xbb, 0x3a, 0x78, 0x6b, 0x02, 0x1d, 0x0b, 0x16, 0xe3, 0xb2, 0x9a, },
++ { 0xb8, 0xb4, 0x0b, 0xe5, 0xd4, 0x1d, 0x0d, 0x85, 0x49, 0x91, 0x35, 0xfa, },
++ { 0x6d, 0x48, 0x2a, 0x0c, 0x42, 0x08, 0xbd, 0xa9, 0x78, 0x6f, 0x18, 0xaf,
++ 0xe2, },
++ { 0x10, 0x45, 0xd4, 0x58, 0x88, 0xec, 0x4e, 0x1e, 0xf6, 0x14, 0x92, 0x64,
++ 0x7e, 0xb0, },
++ { 0x8b, 0x0b, 0x95, 0xee, 0x92, 0xc6, 0x3b, 0x91, 0xf1, 0x1e, 0xeb, 0x51,
++ 0x98, 0x0a, 0x8d, },
++ { 0xa3, 0x50, 0x4d, 0xa5, 0x1d, 0x03, 0x68, 0xe9, 0x57, 0x78, 0xd6, 0x04,
++ 0xf1, 0xc3, 0x94, 0xd8, },
++ { 0xb8, 0x66, 0x6e, 0xdd, 0x46, 0x15, 0xae, 0x3d, 0x83, 0x7e, 0xcf, 0xe7,
++ 0x2c, 0xe8, 0x8f, 0xc7, 0x34, },
++ { 0x2e, 0xc0, 0x1f, 0x29, 0xea, 0xf6, 0xb9, 0xe2, 0xc2, 0x93, 0xeb, 0x41,
++ 0x0d, 0xf0, 0x0a, 0x13, 0x0e, 0xa2, },
++ { 0x71, 0xb8, 0x33, 0xa9, 0x1b, 0xac, 0xf1, 0xb5, 0x42, 0x8f, 0x5e, 0x81,
++ 0x34, 0x43, 0xb7, 0xa4, 0x18, 0x5c, 0x47, },
++ { 0xda, 0x45, 0xb8, 0x2e, 0x82, 0x1e, 0xc0, 0x59, 0x77, 0x9d, 0xfa, 0xb4,
++ 0x1c, 0x5e, 0xa0, 0x2b, 0x33, 0x96, 0x5a, 0x58, },
++ { 0xe3, 0x09, 0x05, 0xa9, 0xeb, 0x48, 0x13, 0xad, 0x71, 0x88, 0x81, 0x9a,
++ 0x3e, 0x2c, 0xe1, 0x23, 0x99, 0x13, 0x35, 0x9f, 0xb5, },
++ { 0xb7, 0x86, 0x2d, 0x16, 0xe1, 0x04, 0x00, 0x47, 0x47, 0x61, 0x31, 0xfb,
++ 0x14, 0xac, 0xd8, 0xe9, 0xe3, 0x49, 0xbd, 0xf7, 0x9c, 0x3f, },
++ { 0x7f, 0xd9, 0x95, 0xa8, 0xa7, 0xa0, 0xcc, 0xba, 0xef, 0xb1, 0x0a, 0xa9,
++ 0x21, 0x62, 0x08, 0x0f, 0x1b, 0xff, 0x7b, 0x9d, 0xae, 0xb2, 0x95, },
++ { 0x85, 0x99, 0xea, 0x33, 0xe0, 0x56, 0xff, 0x13, 0xc6, 0x61, 0x8c, 0xf9,
++ 0x57, 0x05, 0x03, 0x11, 0xf9, 0xfb, 0x3a, 0xf7, 0xce, 0xbb, 0x52, 0x30, },
++ { 0xb2, 0x72, 0x9c, 0xf8, 0x77, 0x4e, 0x8f, 0x6b, 0x01, 0x6c, 0xff, 0x4e,
++ 0x4f, 0x02, 0xd2, 0xbc, 0xeb, 0x51, 0x28, 0x99, 0x50, 0xab, 0xc4, 0x42,
++ 0xe3, },
++ { 0x8b, 0x0a, 0xb5, 0x90, 0x8f, 0xf5, 0x7b, 0xdd, 0xba, 0x47, 0x37, 0xc9,
++ 0x2a, 0xd5, 0x4b, 0x25, 0x08, 0x8b, 0x02, 0x17, 0xa7, 0x9e, 0x6b, 0x6e,
++ 0xe3, 0x90, },
++ { 0x90, 0xdd, 0xf7, 0x75, 0xa7, 0xa3, 0x99, 0x5e, 0x5b, 0x7d, 0x75, 0xc3,
++ 0x39, 0x6b, 0xa0, 0xe2, 0x44, 0x53, 0xb1, 0x9e, 0xc8, 0xf1, 0x77, 0x10,
++ 0x58, 0x06, 0x9a, },
++ { 0x99, 0x52, 0xf0, 0x49, 0xa8, 0x8c, 0xec, 0xa6, 0x97, 0x32, 0x13, 0xb5,
++ 0xf7, 0xa3, 0x8e, 0xfb, 0x4b, 0x59, 0x31, 0x3d, 0x01, 0x59, 0x98, 0x5d,
++ 0x53, 0x03, 0x1a, 0x39, },
++ { 0x9f, 0xe0, 0xc2, 0xe5, 0x5d, 0x93, 0xd6, 0x9b, 0x47, 0x8f, 0x9b, 0xe0,
++ 0x26, 0x35, 0x84, 0x20, 0x1d, 0xc5, 0x53, 0x10, 0x0f, 0x22, 0xb9, 0xb5,
++ 0xd4, 0x36, 0xb1, 0xac, 0x73, },
++ { 0x30, 0x32, 0x20, 0x3b, 0x10, 0x28, 0xec, 0x1f, 0x4f, 0x9b, 0x47, 0x59,
++ 0xeb, 0x7b, 0xee, 0x45, 0xfb, 0x0c, 0x49, 0xd8, 0x3d, 0x69, 0xbd, 0x90,
++ 0x2c, 0xf0, 0x9e, 0x8d, 0xbf, 0xd5, },
++ { 0x2a, 0x37, 0x73, 0x7f, 0xf9, 0x96, 0x19, 0xaa, 0x25, 0xd8, 0x13, 0x28,
++ 0x01, 0x29, 0x89, 0xdf, 0x6e, 0x0c, 0x9b, 0x43, 0x44, 0x51, 0xe9, 0x75,
++ 0x26, 0x0c, 0xb7, 0x87, 0x66, 0x0b, 0x5f, },
++ { 0x23, 0xdf, 0x96, 0x68, 0x91, 0x86, 0xd0, 0x93, 0x55, 0x33, 0x24, 0xf6,
++ 0xba, 0x08, 0x75, 0x5b, 0x59, 0x11, 0x69, 0xb8, 0xb9, 0xe5, 0x2c, 0x77,
++ 0x02, 0xf6, 0x47, 0xee, 0x81, 0xdd, 0xb9, 0x06, },
++ { 0x9d, },
++ { 0x9d, 0x7d, },
++ { 0xfd, 0xc3, 0xda, },
++ { 0xe8, 0x82, 0xcd, 0x21, },
++ { 0xc3, 0x1d, 0x42, 0x4c, 0x74, },
++ { 0xe9, 0xda, 0xf1, 0xa2, 0xe5, 0x7c, },
++ { 0x52, 0xb8, 0x6f, 0x81, 0x5c, 0x3a, 0x4c, },
++ { 0x5b, 0x39, 0x26, 0xfc, 0x92, 0x5e, 0xe0, 0x49, },
++ { 0x59, 0xe4, 0x7c, 0x93, 0x1c, 0xf9, 0x28, 0x93, 0xde, },
++ { 0xde, 0xdf, 0xb2, 0x43, 0x61, 0x0b, 0x86, 0x16, 0x4c, 0x2e, },
++ { 0x14, 0x8f, 0x75, 0x51, 0xaf, 0xb9, 0xee, 0x51, 0x5a, 0xae, 0x23, },
++ { 0x43, 0x5f, 0x50, 0xd5, 0x70, 0xb0, 0x5b, 0x87, 0xf5, 0xd9, 0xb3, 0x6d, },
++ { 0x66, 0x0a, 0x64, 0x93, 0x79, 0x71, 0x94, 0x40, 0xb7, 0x68, 0x2d, 0xd3,
++ 0x63, },
++ { 0x15, 0x00, 0xc4, 0x0c, 0x7d, 0x1b, 0x10, 0xa9, 0x73, 0x1b, 0x90, 0x6f,
++ 0xe6, 0xa9, },
++ { 0x34, 0x75, 0xf3, 0x86, 0x8f, 0x56, 0xcf, 0x2a, 0x0a, 0xf2, 0x62, 0x0a,
++ 0xf6, 0x0e, 0x20, },
++ { 0xb1, 0xde, 0xc9, 0xf5, 0xdb, 0xf3, 0x2f, 0x4c, 0xd6, 0x41, 0x7d, 0x39,
++ 0x18, 0x3e, 0xc7, 0xc3, },
++ { 0xc5, 0x89, 0xb2, 0xf8, 0xb8, 0xc0, 0xa3, 0xb9, 0x3b, 0x10, 0x6d, 0x7c,
++ 0x92, 0xfc, 0x7f, 0x34, 0x41, },
++ { 0xc4, 0xd8, 0xef, 0xba, 0xef, 0xd2, 0xaa, 0xc5, 0x6c, 0x8e, 0x3e, 0xbb,
++ 0x12, 0xfc, 0x0f, 0x72, 0xbf, 0x0f, },
++ { 0xdd, 0x91, 0xd1, 0x15, 0x9e, 0x7d, 0xf8, 0xc1, 0xb9, 0x14, 0x63, 0x96,
++ 0xb5, 0xcb, 0x83, 0x1d, 0x35, 0x1c, 0xec, },
++ { 0xa9, 0xf8, 0x52, 0xc9, 0x67, 0x76, 0x2b, 0xad, 0xfb, 0xd8, 0x3a, 0xa6,
++ 0x74, 0x02, 0xae, 0xb8, 0x25, 0x2c, 0x63, 0x49, },
++ { 0x77, 0x1f, 0x66, 0x70, 0xfd, 0x50, 0x29, 0xaa, 0xeb, 0xdc, 0xee, 0xba,
++ 0x75, 0x98, 0xdc, 0x93, 0x12, 0x3f, 0xdc, 0x7c, 0x38, },
++ { 0xe2, 0xe1, 0x89, 0x5c, 0x37, 0x38, 0x6a, 0xa3, 0x40, 0xac, 0x3f, 0xb0,
++ 0xca, 0xfc, 0xa7, 0xf3, 0xea, 0xf9, 0x0f, 0x5d, 0x8e, 0x39, },
++ { 0x0f, 0x67, 0xc8, 0x38, 0x01, 0xb1, 0xb7, 0xb8, 0xa2, 0xe7, 0x0a, 0x6d,
++ 0xd2, 0x63, 0x69, 0x9e, 0xcc, 0xf0, 0xf2, 0xbe, 0x9b, 0x98, 0xdd, },
++ { 0x13, 0xe1, 0x36, 0x30, 0xfe, 0xc6, 0x01, 0x8a, 0xa1, 0x63, 0x96, 0x59,
++ 0xc2, 0xa9, 0x68, 0x3f, 0x58, 0xd4, 0x19, 0x0c, 0x40, 0xf3, 0xde, 0x02, },
++ { 0xa3, 0x9e, 0xce, 0xda, 0x42, 0xee, 0x8c, 0x6c, 0x5a, 0x7d, 0xdc, 0x89,
++ 0x02, 0x77, 0xdd, 0xe7, 0x95, 0xbb, 0xff, 0x0d, 0xa4, 0xb5, 0x38, 0x1e,
++ 0xaf, },
++ { 0x9a, 0xf6, 0xb5, 0x9a, 0x4f, 0xa9, 0x4f, 0x2c, 0x35, 0x3c, 0x24, 0xdc,
++ 0x97, 0x6f, 0xd9, 0xa1, 0x7d, 0x1a, 0x85, 0x0b, 0xf5, 0xda, 0x2e, 0xe7,
++ 0xb1, 0x1d, },
++ { 0x84, 0x1e, 0x8e, 0x3d, 0x45, 0xa5, 0xf2, 0x27, 0xf3, 0x31, 0xfe, 0xb9,
++ 0xfb, 0xc5, 0x45, 0x99, 0x99, 0xdd, 0x93, 0x43, 0x02, 0xee, 0x58, 0xaf,
++ 0xee, 0x6a, 0xbe, },
++ { 0x07, 0x2f, 0xc0, 0xa2, 0x04, 0xc4, 0xab, 0x7c, 0x26, 0xbb, 0xa8, 0xd8,
++ 0xe3, 0x1c, 0x75, 0x15, 0x64, 0x5d, 0x02, 0x6a, 0xf0, 0x86, 0xe9, 0xcd,
++ 0x5c, 0xef, 0xa3, 0x25, },
++ { 0x2f, 0x3b, 0x1f, 0xb5, 0x91, 0x8f, 0x86, 0xe0, 0xdc, 0x31, 0x48, 0xb6,
++ 0xa1, 0x8c, 0xfd, 0x75, 0xbb, 0x7d, 0x3d, 0xc1, 0xf0, 0x10, 0x9a, 0xd8,
++ 0x4b, 0x0e, 0xe3, 0x94, 0x9f, },
++ { 0x29, 0xbb, 0x8f, 0x6c, 0xd1, 0xf2, 0xb6, 0xaf, 0xe5, 0xe3, 0x2d, 0xdc,
++ 0x6f, 0xa4, 0x53, 0x88, 0xd8, 0xcf, 0x4d, 0x45, 0x42, 0x62, 0xdb, 0xdf,
++ 0xf8, 0x45, 0xc2, 0x13, 0xec, 0x35, },
++ { 0x06, 0x3c, 0xe3, 0x2c, 0x15, 0xc6, 0x43, 0x03, 0x81, 0xfb, 0x08, 0x76,
++ 0x33, 0xcb, 0x02, 0xc1, 0xba, 0x33, 0xe5, 0xe0, 0xd1, 0x92, 0xa8, 0x46,
++ 0x28, 0x3f, 0x3e, 0x9d, 0x2c, 0x44, 0x54, },
++ { 0xea, 0xbb, 0x96, 0xf8, 0xd1, 0x8b, 0x04, 0x11, 0x40, 0x78, 0x42, 0x02,
++ 0x19, 0xd1, 0xbc, 0x65, 0x92, 0xd3, 0xc3, 0xd6, 0xd9, 0x19, 0xe7, 0xc3,
++ 0x40, 0x97, 0xbd, 0xd4, 0xed, 0xfa, 0x5e, 0x28, },
++ { 0x02, },
++ { 0x52, 0xa8, },
++ { 0x38, 0x25, 0x0d, },
++ { 0xe3, 0x04, 0xd4, 0x92, },
++ { 0x97, 0xdb, 0xf7, 0x81, 0xca, },
++ { 0x8a, 0x56, 0x9d, 0x62, 0x56, 0xcc, },
++ { 0xa1, 0x8e, 0x3c, 0x72, 0x8f, 0x63, 0x03, },
++ { 0xf7, 0xf3, 0x39, 0x09, 0x0a, 0xa1, 0xbb, 0x23, },
++ { 0x6b, 0x03, 0xc0, 0xe9, 0xd9, 0x83, 0x05, 0x22, 0x01, },
++ { 0x1b, 0x4b, 0xf5, 0xd6, 0x4f, 0x05, 0x75, 0x91, 0x4c, 0x7f, },
++ { 0x4c, 0x8c, 0x25, 0x20, 0x21, 0xcb, 0xc2, 0x4b, 0x3a, 0x5b, 0x8d, },
++ { 0x56, 0xe2, 0x77, 0xa0, 0xb6, 0x9f, 0x81, 0xec, 0x83, 0x75, 0xc4, 0xf9, },
++ { 0x71, 0x70, 0x0f, 0xad, 0x4d, 0x35, 0x81, 0x9d, 0x88, 0x69, 0xf9, 0xaa,
++ 0xd3, },
++ { 0x50, 0x6e, 0x86, 0x6e, 0x43, 0xc0, 0xc2, 0x44, 0xc2, 0xe2, 0xa0, 0x1c,
++ 0xb7, 0x9a, },
++ { 0xe4, 0x7e, 0x72, 0xc6, 0x12, 0x8e, 0x7c, 0xfc, 0xbd, 0xe2, 0x08, 0x31,
++ 0x3d, 0x47, 0x3d, },
++ { 0x08, 0x97, 0x5b, 0x80, 0xae, 0xc4, 0x1d, 0x50, 0x77, 0xdf, 0x1f, 0xd0,
++ 0x24, 0xf0, 0x17, 0xc0, },
++ { 0x01, 0xb6, 0x29, 0xf4, 0xaf, 0x78, 0x5f, 0xb6, 0x91, 0xdd, 0x76, 0x76,
++ 0xd2, 0xfd, 0x0c, 0x47, 0x40, },
++ { 0xa1, 0xd8, 0x09, 0x97, 0x7a, 0xa6, 0xc8, 0x94, 0xf6, 0x91, 0x7b, 0xae,
++ 0x2b, 0x9f, 0x0d, 0x83, 0x48, 0xf7, },
++ { 0x12, 0xd5, 0x53, 0x7d, 0x9a, 0xb0, 0xbe, 0xd9, 0xed, 0xe9, 0x9e, 0xee,
++ 0x61, 0x5b, 0x42, 0xf2, 0xc0, 0x73, 0xc0, },
++ { 0xd5, 0x77, 0xd6, 0x5c, 0x6e, 0xa5, 0x69, 0x2b, 0x3b, 0x8c, 0xd6, 0x7d,
++ 0x1d, 0xbe, 0x2c, 0xa1, 0x02, 0x21, 0xcd, 0x29, },
++ { 0xa4, 0x98, 0x80, 0xca, 0x22, 0xcf, 0x6a, 0xab, 0x5e, 0x40, 0x0d, 0x61,
++ 0x08, 0x21, 0xef, 0xc0, 0x6c, 0x52, 0xb4, 0xb0, 0x53, },
++ { 0xbf, 0xaf, 0x8f, 0x3b, 0x7a, 0x97, 0x33, 0xe5, 0xca, 0x07, 0x37, 0xfd,
++ 0x15, 0xdf, 0xce, 0x26, 0x2a, 0xb1, 0xa7, 0x0b, 0xb3, 0xac, },
++ { 0x16, 0x22, 0xe1, 0xbc, 0x99, 0x4e, 0x01, 0xf0, 0xfa, 0xff, 0x8f, 0xa5,
++ 0x0c, 0x61, 0xb0, 0xad, 0xcc, 0xb1, 0xe1, 0x21, 0x46, 0xfa, 0x2e, },
++ { 0x11, 0x5b, 0x0b, 0x2b, 0xe6, 0x14, 0xc1, 0xd5, 0x4d, 0x71, 0x5e, 0x17,
++ 0xea, 0x23, 0xdd, 0x6c, 0xbd, 0x1d, 0xbe, 0x12, 0x1b, 0xee, 0x4c, 0x1a, },
++ { 0x40, 0x88, 0x22, 0xf3, 0x20, 0x6c, 0xed, 0xe1, 0x36, 0x34, 0x62, 0x2c,
++ 0x98, 0x83, 0x52, 0xe2, 0x25, 0xee, 0xe9, 0xf5, 0xe1, 0x17, 0xf0, 0x5c,
++ 0xae, },
++ { 0xc3, 0x76, 0x37, 0xde, 0x95, 0x8c, 0xca, 0x2b, 0x0c, 0x23, 0xe7, 0xb5,
++ 0x38, 0x70, 0x61, 0xcc, 0xff, 0xd3, 0x95, 0x7b, 0xf3, 0xff, 0x1f, 0x9d,
++ 0x59, 0x00, },
++ { 0x0c, 0x19, 0x52, 0x05, 0x22, 0x53, 0xcb, 0x48, 0xd7, 0x10, 0x0e, 0x7e,
++ 0x14, 0x69, 0xb5, 0xa2, 0x92, 0x43, 0xa3, 0x9e, 0x4b, 0x8f, 0x51, 0x2c,
++ 0x5a, 0x2c, 0x3b, },
++ { 0xe1, 0x9d, 0x70, 0x70, 0x28, 0xec, 0x86, 0x40, 0x55, 0x33, 0x56, 0xda,
++ 0x88, 0xca, 0xee, 0xc8, 0x6a, 0x20, 0xb1, 0xe5, 0x3d, 0x57, 0xf8, 0x3c,
++ 0x10, 0x07, 0x2a, 0xc4, },
++ { 0x0b, 0xae, 0xf1, 0xc4, 0x79, 0xee, 0x1b, 0x3d, 0x27, 0x35, 0x8d, 0x14,
++ 0xd6, 0xae, 0x4e, 0x3c, 0xe9, 0x53, 0x50, 0xb5, 0xcc, 0x0c, 0xf7, 0xdf,
++ 0xee, 0xa1, 0x74, 0xd6, 0x71, },
++ { 0xe6, 0xa4, 0xf4, 0x99, 0x98, 0xb9, 0x80, 0xea, 0x96, 0x7f, 0x4f, 0x33,
++ 0xcf, 0x74, 0x25, 0x6f, 0x17, 0x6c, 0xbf, 0xf5, 0x5c, 0x38, 0xd0, 0xff,
++ 0x96, 0xcb, 0x13, 0xf9, 0xdf, 0xfd, },
++ { 0xbe, 0x92, 0xeb, 0xba, 0x44, 0x2c, 0x24, 0x74, 0xd4, 0x03, 0x27, 0x3c,
++ 0x5d, 0x5b, 0x03, 0x30, 0x87, 0x63, 0x69, 0xe0, 0xb8, 0x94, 0xf4, 0x44,
++ 0x7e, 0xad, 0xcd, 0x20, 0x12, 0x16, 0x79, },
++ { 0x30, 0xf1, 0xc4, 0x8e, 0x05, 0x90, 0x2a, 0x97, 0x63, 0x94, 0x46, 0xff,
++ 0xce, 0xd8, 0x67, 0xa7, 0xac, 0x33, 0x8c, 0x95, 0xb7, 0xcd, 0xa3, 0x23,
++ 0x98, 0x9d, 0x76, 0x6c, 0x9d, 0xa8, 0xd6, 0x8a, },
++ { 0xbe, },
++ { 0x17, 0x6c, },
++ { 0x1a, 0x42, 0x4f, },
++ { 0xba, 0xaf, 0xb7, 0x65, },
++ { 0xc2, 0x63, 0x43, 0x6a, 0xea, },
++ { 0xe4, 0x4d, 0xad, 0xf2, 0x0b, 0x02, },
++ { 0x04, 0xc7, 0xc4, 0x7f, 0xa9, 0x2b, 0xce, },
++ { 0x66, 0xf6, 0x67, 0xcb, 0x03, 0x53, 0xc8, 0xf1, },
++ { 0x56, 0xa3, 0x60, 0x78, 0xc9, 0x5f, 0x70, 0x1b, 0x5e, },
++ { 0x99, 0xff, 0x81, 0x7c, 0x13, 0x3c, 0x29, 0x79, 0x4b, 0x65, },
++ { 0x51, 0x10, 0x50, 0x93, 0x01, 0x93, 0xb7, 0x01, 0xc9, 0x18, 0xb7, },
++ { 0x8e, 0x3c, 0x42, 0x1e, 0x5e, 0x7d, 0xc1, 0x50, 0x70, 0x1f, 0x00, 0x98, },
++ { 0x5f, 0xd9, 0x9b, 0xc8, 0xd7, 0xb2, 0x72, 0x62, 0x1a, 0x1e, 0xba, 0x92,
++ 0xe9, },
++ { 0x70, 0x2b, 0xba, 0xfe, 0xad, 0x5d, 0x96, 0x3f, 0x27, 0xc2, 0x41, 0x6d,
++ 0xc4, 0xb3, },
++ { 0xae, 0xe0, 0xd5, 0xd4, 0xc7, 0xae, 0x15, 0x5e, 0xdc, 0xdd, 0x33, 0x60,
++ 0xd7, 0xd3, 0x5e, },
++ { 0x79, 0x8e, 0xbc, 0x9e, 0x20, 0xb9, 0x19, 0x4b, 0x63, 0x80, 0xf3, 0x16,
++ 0xaf, 0x39, 0xbd, 0x92, },
++ { 0xc2, 0x0e, 0x85, 0xa0, 0x0b, 0x9a, 0xb0, 0xec, 0xde, 0x38, 0xd3, 0x10,
++ 0xd9, 0xa7, 0x66, 0x27, 0xcf, },
++ { 0x0e, 0x3b, 0x75, 0x80, 0x67, 0x14, 0x0c, 0x02, 0x90, 0xd6, 0xb3, 0x02,
++ 0x81, 0xf6, 0xa6, 0x87, 0xce, 0x58, },
++ { 0x79, 0xb5, 0xe9, 0x5d, 0x52, 0x4d, 0xf7, 0x59, 0xf4, 0x2e, 0x27, 0xdd,
++ 0xb3, 0xed, 0x57, 0x5b, 0x82, 0xea, 0x6f, },
++ { 0xa2, 0x97, 0xf5, 0x80, 0x02, 0x3d, 0xde, 0xa3, 0xf9, 0xf6, 0xab, 0xe3,
++ 0x57, 0x63, 0x7b, 0x9b, 0x10, 0x42, 0x6f, 0xf2, },
++ { 0x12, 0x7a, 0xfc, 0xb7, 0x67, 0x06, 0x0c, 0x78, 0x1a, 0xfe, 0x88, 0x4f,
++ 0xc6, 0xac, 0x52, 0x96, 0x64, 0x28, 0x97, 0x84, 0x06, },
++ { 0xc5, 0x04, 0x44, 0x6b, 0xb2, 0xa5, 0xa4, 0x66, 0xe1, 0x76, 0xa2, 0x51,
++ 0xf9, 0x59, 0x69, 0x97, 0x56, 0x0b, 0xbf, 0x50, 0xb3, 0x34, },
++ { 0x21, 0x32, 0x6b, 0x42, 0xb5, 0xed, 0x71, 0x8d, 0xf7, 0x5a, 0x35, 0xe3,
++ 0x90, 0xe2, 0xee, 0xaa, 0x89, 0xf6, 0xc9, 0x9c, 0x4d, 0x73, 0xf4, },
++ { 0x4c, 0xa6, 0x09, 0xf4, 0x48, 0xe7, 0x46, 0xbc, 0x49, 0xfc, 0xe5, 0xda,
++ 0xd1, 0x87, 0x13, 0x17, 0x4c, 0x59, 0x71, 0x26, 0x5b, 0x2c, 0x42, 0xb7, },
++ { 0x13, 0x63, 0xf3, 0x40, 0x02, 0xe5, 0xa3, 0x3a, 0x5e, 0x8e, 0xf8, 0xb6,
++ 0x8a, 0x49, 0x60, 0x76, 0x34, 0x72, 0x94, 0x73, 0xf6, 0xd9, 0x21, 0x6a,
++ 0x26, },
++ { 0xdf, 0x75, 0x16, 0x10, 0x1b, 0x5e, 0x81, 0xc3, 0xc8, 0xde, 0x34, 0x24,
++ 0xb0, 0x98, 0xeb, 0x1b, 0x8f, 0xa1, 0x9b, 0x05, 0xee, 0xa5, 0xe9, 0x35,
++ 0xf4, 0x1d, },
++ { 0xcd, 0x21, 0x93, 0x6e, 0x5b, 0xa0, 0x26, 0x2b, 0x21, 0x0e, 0xa0, 0xb9,
++ 0x1c, 0xb5, 0xbb, 0xb8, 0xf8, 0x1e, 0xff, 0x5c, 0xa8, 0xf9, 0x39, 0x46,
++ 0x4e, 0x29, 0x26, },
++ { 0x73, 0x7f, 0x0e, 0x3b, 0x0b, 0x5c, 0xf9, 0x60, 0xaa, 0x88, 0xa1, 0x09,
++ 0xb1, 0x5d, 0x38, 0x7b, 0x86, 0x8f, 0x13, 0x7a, 0x8d, 0x72, 0x7a, 0x98,
++ 0x1a, 0x5b, 0xff, 0xc9, },
++ { 0xd3, 0x3c, 0x61, 0x71, 0x44, 0x7e, 0x31, 0x74, 0x98, 0x9d, 0x9a, 0xd2,
++ 0x27, 0xf3, 0x46, 0x43, 0x42, 0x51, 0xd0, 0x5f, 0xe9, 0x1c, 0x5c, 0x69,
++ 0xbf, 0xf6, 0xbe, 0x3c, 0x40, },
++ { 0x31, 0x99, 0x31, 0x9f, 0xaa, 0x43, 0x2e, 0x77, 0x3e, 0x74, 0x26, 0x31,
++ 0x5e, 0x61, 0xf1, 0x87, 0xe2, 0xeb, 0x9b, 0xcd, 0xd0, 0x3a, 0xee, 0x20,
++ 0x7e, 0x10, 0x0a, 0x0b, 0x7e, 0xfa, },
++ { 0xa4, 0x27, 0x80, 0x67, 0x81, 0x2a, 0xa7, 0x62, 0xf7, 0x6e, 0xda, 0xd4,
++ 0x5c, 0x39, 0x74, 0xad, 0x7e, 0xbe, 0xad, 0xa5, 0x84, 0x7f, 0xa9, 0x30,
++ 0x5d, 0xdb, 0xe2, 0x05, 0x43, 0xf7, 0x1b, },
++ { 0x0b, 0x37, 0xd8, 0x02, 0xe1, 0x83, 0xd6, 0x80, 0xf2, 0x35, 0xc2, 0xb0,
++ 0x37, 0xef, 0xef, 0x5e, 0x43, 0x93, 0xf0, 0x49, 0x45, 0x0a, 0xef, 0xb5,
++ 0x76, 0x70, 0x12, 0x44, 0xc4, 0xdb, 0xf5, 0x7a, },
++ { 0x1f, },
++ { 0x82, 0x60, },
++ { 0xcc, 0xe3, 0x08, },
++ { 0x56, 0x17, 0xe4, 0x59, },
++ { 0xe2, 0xd7, 0x9e, 0xc4, 0x4c, },
++ { 0xb2, 0xad, 0xd3, 0x78, 0x58, 0x5a, },
++ { 0xce, 0x43, 0xb4, 0x02, 0x96, 0xab, 0x3c, },
++ { 0xe6, 0x05, 0x1a, 0x73, 0x22, 0x32, 0xbb, 0x77, },
++ { 0x23, 0xe7, 0xda, 0xfe, 0x2c, 0xef, 0x8c, 0x22, 0xec, },
++ { 0xe9, 0x8e, 0x55, 0x38, 0xd1, 0xd7, 0x35, 0x23, 0x98, 0xc7, },
++ { 0xb5, 0x81, 0x1a, 0xe5, 0xb5, 0xa5, 0xd9, 0x4d, 0xca, 0x41, 0xe7, },
++ { 0x41, 0x16, 0x16, 0x95, 0x8d, 0x9e, 0x0c, 0xea, 0x8c, 0x71, 0x9a, 0xc1, },
++ { 0x7c, 0x33, 0xc0, 0xa4, 0x00, 0x62, 0xea, 0x60, 0x67, 0xe4, 0x20, 0xbc,
++ 0x5b, },
++ { 0xdb, 0xb1, 0xdc, 0xfd, 0x08, 0xc0, 0xde, 0x82, 0xd1, 0xde, 0x38, 0xc0,
++ 0x90, 0x48, },
++ { 0x37, 0x18, 0x2e, 0x0d, 0x61, 0xaa, 0x61, 0xd7, 0x86, 0x20, 0x16, 0x60,
++ 0x04, 0xd9, 0xd5, },
++ { 0xb0, 0xcf, 0x2c, 0x4c, 0x5e, 0x5b, 0x4f, 0x2a, 0x23, 0x25, 0x58, 0x47,
++ 0xe5, 0x31, 0x06, 0x70, },
++ { 0x91, 0xa0, 0xa3, 0x86, 0x4e, 0xe0, 0x72, 0x38, 0x06, 0x67, 0x59, 0x5c,
++ 0x70, 0x25, 0xdb, 0x33, 0x27, },
++ { 0x44, 0x58, 0x66, 0xb8, 0x58, 0xc7, 0x13, 0xed, 0x4c, 0xc0, 0xf4, 0x9a,
++ 0x1e, 0x67, 0x75, 0x33, 0xb6, 0xb8, },
++ { 0x7f, 0x98, 0x4a, 0x8e, 0x50, 0xa2, 0x5c, 0xcd, 0x59, 0xde, 0x72, 0xb3,
++ 0x9d, 0xc3, 0x09, 0x8a, 0xab, 0x56, 0xf1, },
++ { 0x80, 0x96, 0x49, 0x1a, 0x59, 0xa2, 0xc5, 0xd5, 0xa7, 0x20, 0x8a, 0xb7,
++ 0x27, 0x62, 0x84, 0x43, 0xc6, 0xe1, 0x1b, 0x5d, },
++ { 0x6b, 0xb7, 0x2b, 0x26, 0x62, 0x14, 0x70, 0x19, 0x3d, 0x4d, 0xac, 0xac,
++ 0x63, 0x58, 0x5e, 0x94, 0xb5, 0xb7, 0xe8, 0xe8, 0xa2, },
++ { 0x20, 0xa8, 0xc0, 0xfd, 0x63, 0x3d, 0x6e, 0x98, 0xcf, 0x0c, 0x49, 0x98,
++ 0xe4, 0x5a, 0xfe, 0x8c, 0xaa, 0x70, 0x82, 0x1c, 0x7b, 0x74, },
++ { 0xc8, 0xe8, 0xdd, 0xdf, 0x69, 0x30, 0x01, 0xc2, 0x0f, 0x7e, 0x2f, 0x11,
++ 0xcc, 0x3e, 0x17, 0xa5, 0x69, 0x40, 0x3f, 0x0e, 0x79, 0x7f, 0xcf, },
++ { 0xdb, 0x61, 0xc0, 0xe2, 0x2e, 0x49, 0x07, 0x31, 0x1d, 0x91, 0x42, 0x8a,
++ 0xfc, 0x5e, 0xd3, 0xf8, 0x56, 0x1f, 0x2b, 0x73, 0xfd, 0x9f, 0xb2, 0x8e, },
++ { 0x0c, 0x89, 0x55, 0x0c, 0x1f, 0x59, 0x2c, 0x9d, 0x1b, 0x29, 0x1d, 0x41,
++ 0x1d, 0xe6, 0x47, 0x8f, 0x8c, 0x2b, 0xea, 0x8f, 0xf0, 0xff, 0x21, 0x70,
++ 0x88, },
++ { 0x12, 0x18, 0x95, 0xa6, 0x59, 0xb1, 0x31, 0x24, 0x45, 0x67, 0x55, 0xa4,
++ 0x1a, 0x2d, 0x48, 0x67, 0x1b, 0x43, 0x88, 0x2d, 0x8e, 0xa0, 0x70, 0xb3,
++ 0xc6, 0xbb, },
++ { 0xe7, 0xb1, 0x1d, 0xb2, 0x76, 0x4d, 0x68, 0x68, 0x68, 0x23, 0x02, 0x55,
++ 0x3a, 0xe2, 0xe5, 0xd5, 0x4b, 0x43, 0xf9, 0x34, 0x77, 0x5c, 0xa1, 0xf5,
++ 0x55, 0xfd, 0x4f, },
++ { 0x8c, 0x87, 0x5a, 0x08, 0x3a, 0x73, 0xad, 0x61, 0xe1, 0xe7, 0x99, 0x7e,
++ 0xf0, 0x5d, 0xe9, 0x5d, 0x16, 0x43, 0x80, 0x2f, 0xd0, 0x66, 0x34, 0xe2,
++ 0x42, 0x64, 0x3b, 0x1a, },
++ { 0x39, 0xc1, 0x99, 0xcf, 0x22, 0xbf, 0x16, 0x8f, 0x9f, 0x80, 0x7f, 0x95,
++ 0x0a, 0x05, 0x67, 0x27, 0xe7, 0x15, 0xdf, 0x9d, 0xb2, 0xfe, 0x1c, 0xb5,
++ 0x1d, 0x60, 0x8f, 0x8a, 0x1d, },
++ { 0x9b, 0x6e, 0x08, 0x09, 0x06, 0x73, 0xab, 0x68, 0x02, 0x62, 0x1a, 0xe4,
++ 0xd4, 0xdf, 0xc7, 0x02, 0x4c, 0x6a, 0x5f, 0xfd, 0x23, 0xac, 0xae, 0x6d,
++ 0x43, 0xa4, 0x7a, 0x50, 0x60, 0x3c, },
++ { 0x1d, 0xb4, 0xc6, 0xe1, 0xb1, 0x4b, 0xe3, 0xf2, 0xe2, 0x1a, 0x73, 0x1b,
++ 0xa0, 0x92, 0xa7, 0xf5, 0xff, 0x8f, 0x8b, 0x5d, 0xdf, 0xa8, 0x04, 0xb3,
++ 0xb0, 0xf7, 0xcc, 0x12, 0xfa, 0x35, 0x46, },
++ { 0x49, 0x45, 0x97, 0x11, 0x0f, 0x1c, 0x60, 0x8e, 0xe8, 0x47, 0x30, 0xcf,
++ 0x60, 0xa8, 0x71, 0xc5, 0x1b, 0xe9, 0x39, 0x4d, 0x49, 0xb6, 0x12, 0x1f,
++ 0x24, 0xab, 0x37, 0xff, 0x83, 0xc2, 0xe1, 0x3a, },
++ { 0x60, },
++ { 0x24, 0x26, },
++ { 0x47, 0xeb, 0xc9, },
++ { 0x4a, 0xd0, 0xbc, 0xf0, },
++ { 0x8e, 0x2b, 0xc9, 0x85, 0x3c, },
++ { 0xa2, 0x07, 0x15, 0xb8, 0x12, 0x74, },
++ { 0x0f, 0xdb, 0x5b, 0x33, 0x69, 0xfe, 0x4b, },
++ { 0xa2, 0x86, 0x54, 0xf4, 0xfd, 0xb2, 0xd4, 0xe6, },
++ { 0xbb, 0x84, 0x78, 0x49, 0x27, 0x8e, 0x61, 0xda, 0x60, },
++ { 0x04, 0xc3, 0xcd, 0xaa, 0x8f, 0xa7, 0x03, 0xc9, 0xf9, 0xb6, },
++ { 0xf8, 0x27, 0x1d, 0x61, 0xdc, 0x21, 0x42, 0xdd, 0xad, 0x92, 0x40, },
++ { 0x12, 0x87, 0xdf, 0xc2, 0x41, 0x45, 0x5a, 0x36, 0x48, 0x5b, 0x51, 0x2b, },
++ { 0xbb, 0x37, 0x5d, 0x1f, 0xf1, 0x68, 0x7a, 0xc4, 0xa5, 0xd2, 0xa4, 0x91,
++ 0x8d, },
++ { 0x5b, 0x27, 0xd1, 0x04, 0x54, 0x52, 0x9f, 0xa3, 0x47, 0x86, 0x33, 0x33,
++ 0xbf, 0xa0, },
++ { 0xcf, 0x04, 0xea, 0xf8, 0x03, 0x2a, 0x43, 0xff, 0xa6, 0x68, 0x21, 0x4c,
++ 0xd5, 0x4b, 0xed, },
++ { 0xaf, 0xb8, 0xbc, 0x63, 0x0f, 0x18, 0x4d, 0xe2, 0x7a, 0xdd, 0x46, 0x44,
++ 0xc8, 0x24, 0x0a, 0xb7, },
++ { 0x3e, 0xdc, 0x36, 0xe4, 0x89, 0xb1, 0xfa, 0xc6, 0x40, 0x93, 0x2e, 0x75,
++ 0xb2, 0x15, 0xd1, 0xb1, 0x10, },
++ { 0x6c, 0xd8, 0x20, 0x3b, 0x82, 0x79, 0xf9, 0xc8, 0xbc, 0x9d, 0xe0, 0x35,
++ 0xbe, 0x1b, 0x49, 0x1a, 0xbc, 0x3a, },
++ { 0x78, 0x65, 0x2c, 0xbe, 0x35, 0x67, 0xdc, 0x78, 0xd4, 0x41, 0xf6, 0xc9,
++ 0xde, 0xde, 0x1f, 0x18, 0x13, 0x31, 0x11, },
++ { 0x8a, 0x7f, 0xb1, 0x33, 0x8f, 0x0c, 0x3c, 0x0a, 0x06, 0x61, 0xf0, 0x47,
++ 0x29, 0x1b, 0x29, 0xbc, 0x1c, 0x47, 0xef, 0x7a, },
++ { 0x65, 0x91, 0xf1, 0xe6, 0xb3, 0x96, 0xd3, 0x8c, 0xc2, 0x4a, 0x59, 0x35,
++ 0x72, 0x8e, 0x0b, 0x9a, 0x87, 0xca, 0x34, 0x7b, 0x63, },
++ { 0x5f, 0x08, 0x87, 0x80, 0x56, 0x25, 0x89, 0x77, 0x61, 0x8c, 0x64, 0xa1,
++ 0x59, 0x6d, 0x59, 0x62, 0xe8, 0x4a, 0xc8, 0x58, 0x99, 0xd1, },
++ { 0x23, 0x87, 0x1d, 0xed, 0x6f, 0xf2, 0x91, 0x90, 0xe2, 0xfe, 0x43, 0x21,
++ 0xaf, 0x97, 0xc6, 0xbc, 0xd7, 0x15, 0xc7, 0x2d, 0x08, 0x77, 0x91, },
++ { 0x90, 0x47, 0x9a, 0x9e, 0x3a, 0xdf, 0xf3, 0xc9, 0x4c, 0x1e, 0xa7, 0xd4,
++ 0x6a, 0x32, 0x90, 0xfe, 0xb7, 0xb6, 0x7b, 0xfa, 0x96, 0x61, 0xfb, 0xa4, },
++ { 0xb1, 0x67, 0x60, 0x45, 0xb0, 0x96, 0xc5, 0x15, 0x9f, 0x4d, 0x26, 0xd7,
++ 0x9d, 0xf1, 0xf5, 0x6d, 0x21, 0x00, 0x94, 0x31, 0x64, 0x94, 0xd3, 0xa7,
++ 0xd3, },
++ { 0x02, 0x3e, 0xaf, 0xf3, 0x79, 0x73, 0xa5, 0xf5, 0xcc, 0x7a, 0x7f, 0xfb,
++ 0x79, 0x2b, 0x85, 0x8c, 0x88, 0x72, 0x06, 0xbe, 0xfe, 0xaf, 0xc1, 0x16,
++ 0xa6, 0xd6, },
++ { 0x2a, 0xb0, 0x1a, 0xe5, 0xaa, 0x6e, 0xb3, 0xae, 0x53, 0x85, 0x33, 0x80,
++ 0x75, 0xae, 0x30, 0xe6, 0xb8, 0x72, 0x42, 0xf6, 0x25, 0x4f, 0x38, 0x88,
++ 0x55, 0xd1, 0xa9, },
++ { 0x90, 0xd8, 0x0c, 0xc0, 0x93, 0x4b, 0x4f, 0x9e, 0x65, 0x6c, 0xa1, 0x54,
++ 0xa6, 0xf6, 0x6e, 0xca, 0xd2, 0xbb, 0x7e, 0x6a, 0x1c, 0xd3, 0xce, 0x46,
++ 0xef, 0xb0, 0x00, 0x8d, },
++ { 0xed, 0x9c, 0x49, 0xcd, 0xc2, 0xde, 0x38, 0x0e, 0xe9, 0x98, 0x6c, 0xc8,
++ 0x90, 0x9e, 0x3c, 0xd4, 0xd3, 0xeb, 0x88, 0x32, 0xc7, 0x28, 0xe3, 0x94,
++ 0x1c, 0x9f, 0x8b, 0xf3, 0xcb, },
++ { 0xac, 0xe7, 0x92, 0x16, 0xb4, 0x14, 0xa0, 0xe4, 0x04, 0x79, 0xa2, 0xf4,
++ 0x31, 0xe6, 0x0c, 0x26, 0xdc, 0xbf, 0x2f, 0x69, 0x1b, 0x55, 0x94, 0x67,
++ 0xda, 0x0c, 0xd7, 0x32, 0x1f, 0xef, },
++ { 0x68, 0x63, 0x85, 0x57, 0x95, 0x9e, 0x42, 0x27, 0x41, 0x43, 0x42, 0x02,
++ 0xa5, 0x78, 0xa7, 0xc6, 0x43, 0xc1, 0x6a, 0xba, 0x70, 0x80, 0xcd, 0x04,
++ 0xb6, 0x78, 0x76, 0x29, 0xf3, 0xe8, 0xa0, },
++ { 0xe6, 0xac, 0x8d, 0x9d, 0xf0, 0xc0, 0xf7, 0xf7, 0xe3, 0x3e, 0x4e, 0x28,
++ 0x0f, 0x59, 0xb2, 0x67, 0x9e, 0x84, 0x34, 0x42, 0x96, 0x30, 0x2b, 0xca,
++ 0x49, 0xb6, 0xc5, 0x9a, 0x84, 0x59, 0xa7, 0x81, },
++ { 0x7e, },
++ { 0x1e, 0x21, },
++ { 0x26, 0xd3, 0xdd, },
++ { 0x2c, 0xd4, 0xb3, 0x3d, },
++ { 0x86, 0x7b, 0x76, 0x3c, 0xf0, },
++ { 0x12, 0xc3, 0x70, 0x1d, 0x55, 0x18, },
++ { 0x96, 0xc2, 0xbd, 0x61, 0x55, 0xf4, 0x24, },
++ { 0x20, 0x51, 0xf7, 0x86, 0x58, 0x8f, 0x07, 0x2a, },
++ { 0x93, 0x15, 0xa8, 0x1d, 0xda, 0x97, 0xee, 0x0e, 0x6c, },
++ { 0x39, 0x93, 0xdf, 0xd5, 0x0e, 0xca, 0xdc, 0x7a, 0x92, 0xce, },
++ { 0x60, 0xd5, 0xfd, 0xf5, 0x1b, 0x26, 0x82, 0x26, 0x73, 0x02, 0xbc, },
++ { 0x98, 0xf2, 0x34, 0xe1, 0xf5, 0xfb, 0x00, 0xac, 0x10, 0x4a, 0x38, 0x9f, },
++ { 0xda, 0x3a, 0x92, 0x8a, 0xd0, 0xcd, 0x12, 0xcd, 0x15, 0xbb, 0xab, 0x77,
++ 0x66, },
++ { 0xa2, 0x92, 0x1a, 0xe5, 0xca, 0x0c, 0x30, 0x75, 0xeb, 0xaf, 0x00, 0x31,
++ 0x55, 0x66, },
++ { 0x06, 0xea, 0xfd, 0x3e, 0x86, 0x38, 0x62, 0x4e, 0xa9, 0x12, 0xa4, 0x12,
++ 0x43, 0xbf, 0xa1, },
++ { 0xe4, 0x71, 0x7b, 0x94, 0xdb, 0xa0, 0xd2, 0xff, 0x9b, 0xeb, 0xad, 0x8e,
++ 0x95, 0x8a, 0xc5, 0xed, },
++ { 0x25, 0x5a, 0x77, 0x71, 0x41, 0x0e, 0x7a, 0xe9, 0xed, 0x0c, 0x10, 0xef,
++ 0xf6, 0x2b, 0x3a, 0xba, 0x60, },
++ { 0xee, 0xe2, 0xa3, 0x67, 0x64, 0x1d, 0xc6, 0x04, 0xc4, 0xe1, 0x68, 0xd2,
++ 0x6e, 0xd2, 0x91, 0x75, 0x53, 0x07, },
++ { 0xe0, 0xf6, 0x4d, 0x8f, 0x68, 0xfc, 0x06, 0x7e, 0x18, 0x79, 0x7f, 0x2b,
++ 0x6d, 0xef, 0x46, 0x7f, 0xab, 0xb2, 0xad, },
++ { 0x3d, 0x35, 0x88, 0x9f, 0x2e, 0xcf, 0x96, 0x45, 0x07, 0x60, 0x71, 0x94,
++ 0x00, 0x8d, 0xbf, 0xf4, 0xef, 0x46, 0x2e, 0x3c, },
++ { 0x43, 0xcf, 0x98, 0xf7, 0x2d, 0xf4, 0x17, 0xe7, 0x8c, 0x05, 0x2d, 0x9b,
++ 0x24, 0xfb, 0x4d, 0xea, 0x4a, 0xec, 0x01, 0x25, 0x29, },
++ { 0x8e, 0x73, 0x9a, 0x78, 0x11, 0xfe, 0x48, 0xa0, 0x3b, 0x1a, 0x26, 0xdf,
++ 0x25, 0xe9, 0x59, 0x1c, 0x70, 0x07, 0x9f, 0xdc, 0xa0, 0xa6, },
++ { 0xe8, 0x47, 0x71, 0xc7, 0x3e, 0xdf, 0xb5, 0x13, 0xb9, 0x85, 0x13, 0xa8,
++ 0x54, 0x47, 0x6e, 0x59, 0x96, 0x09, 0x13, 0x5f, 0x82, 0x16, 0x0b, },
++ { 0xfb, 0xc0, 0x8c, 0x03, 0x21, 0xb3, 0xc4, 0xb5, 0x43, 0x32, 0x6c, 0xea,
++ 0x7f, 0xa8, 0x43, 0x91, 0xe8, 0x4e, 0x3f, 0xbf, 0x45, 0x58, 0x6a, 0xa3, },
++ { 0x55, 0xf8, 0xf3, 0x00, 0x76, 0x09, 0xef, 0x69, 0x5d, 0xd2, 0x8a, 0xf2,
++ 0x65, 0xc3, 0xcb, 0x9b, 0x43, 0xfd, 0xb1, 0x7e, 0x7f, 0xa1, 0x94, 0xb0,
++ 0xd7, },
++ { 0xaa, 0x13, 0xc1, 0x51, 0x40, 0x6d, 0x8d, 0x4c, 0x0a, 0x95, 0x64, 0x7b,
++ 0xd1, 0x96, 0xb6, 0x56, 0xb4, 0x5b, 0xcf, 0xd6, 0xd9, 0x15, 0x97, 0xdd,
++ 0xb6, 0xef, },
++ { 0xaf, 0xb7, 0x36, 0xb0, 0x04, 0xdb, 0xd7, 0x9c, 0x9a, 0x44, 0xc4, 0xf6,
++ 0x1f, 0x12, 0x21, 0x2d, 0x59, 0x30, 0x54, 0xab, 0x27, 0x61, 0xa3, 0x57,
++ 0xef, 0xf8, 0x53, },
++ { 0x97, 0x34, 0x45, 0x3e, 0xce, 0x7c, 0x35, 0xa2, 0xda, 0x9f, 0x4b, 0x46,
++ 0x6c, 0x11, 0x67, 0xff, 0x2f, 0x76, 0x58, 0x15, 0x71, 0xfa, 0x44, 0x89,
++ 0x89, 0xfd, 0xf7, 0x99, },
++ { 0x1f, 0xb1, 0x62, 0xeb, 0x83, 0xc5, 0x9c, 0x89, 0xf9, 0x2c, 0xd2, 0x03,
++ 0x61, 0xbc, 0xbb, 0xa5, 0x74, 0x0e, 0x9b, 0x7e, 0x82, 0x3e, 0x70, 0x0a,
++ 0xa9, 0x8f, 0x2b, 0x59, 0xfb, },
++ { 0xf8, 0xca, 0x5e, 0x3a, 0x4f, 0x9e, 0x10, 0x69, 0x10, 0xd5, 0x4c, 0xeb,
++ 0x1a, 0x0f, 0x3c, 0x6a, 0x98, 0xf5, 0xb0, 0x97, 0x5b, 0x37, 0x2f, 0x0d,
++ 0xbd, 0x42, 0x4b, 0x69, 0xa1, 0x82, },
++ { 0x12, 0x8c, 0x6d, 0x52, 0x08, 0xef, 0x74, 0xb2, 0xe6, 0xaa, 0xd3, 0xb0,
++ 0x26, 0xb0, 0xd9, 0x94, 0xb6, 0x11, 0x45, 0x0e, 0x36, 0x71, 0x14, 0x2d,
++ 0x41, 0x8c, 0x21, 0x53, 0x31, 0xe9, 0x68, },
++ { 0xee, 0xea, 0x0d, 0x89, 0x47, 0x7e, 0x72, 0xd1, 0xd8, 0xce, 0x58, 0x4c,
++ 0x94, 0x1f, 0x0d, 0x51, 0x08, 0xa3, 0xb6, 0x3d, 0xe7, 0x82, 0x46, 0x92,
++ 0xd6, 0x98, 0x6b, 0x07, 0x10, 0x65, 0x52, 0x65, },
++};
++
++bool __init blake2s_selftest(void)
++{
++ u8 key[BLAKE2S_KEY_SIZE];
++ u8 buf[ARRAY_SIZE(blake2s_testvecs)];
++ u8 hash[BLAKE2S_HASH_SIZE];
++ struct blake2s_state state;
++ bool success = true;
++ int i, l;
++
++ key[0] = key[1] = 1;
++ for (i = 2; i < sizeof(key); ++i)
++ key[i] = key[i - 2] + key[i - 1];
++
++ for (i = 0; i < sizeof(buf); ++i)
++ buf[i] = (u8)i;
++
++ for (i = l = 0; i < ARRAY_SIZE(blake2s_testvecs); l = (l + 37) % ++i) {
++ int outlen = 1 + i % BLAKE2S_HASH_SIZE;
++ int keylen = (13 * i) % (BLAKE2S_KEY_SIZE + 1);
++
++ blake2s(hash, buf, key + BLAKE2S_KEY_SIZE - keylen, outlen, i,
++ keylen);
++ if (memcmp(hash, blake2s_testvecs[i], outlen)) {
++ pr_err("blake2s self-test %d: FAIL\n", i + 1);
++ success = false;
++ }
++
++ if (!keylen)
++ blake2s_init(&state, outlen);
++ else
++ blake2s_init_key(&state, outlen,
++ key + BLAKE2S_KEY_SIZE - keylen,
++ keylen);
++
++ blake2s_update(&state, buf, l);
++ blake2s_update(&state, buf + l, i - l);
++ blake2s_final(&state, hash);
++ if (memcmp(hash, blake2s_testvecs[i], outlen)) {
++ pr_err("blake2s init/update/final self-test %d: FAIL\n",
++ i + 1);
++ success = false;
++ }
++ }
++
++ return success;
++}
+diff --git a/lib/crypto/blake2s.c b/lib/crypto/blake2s.c
+new file mode 100644
+index 0000000000000..536fce87555b3
+--- /dev/null
++++ b/lib/crypto/blake2s.c
+@@ -0,0 +1,78 @@
++// SPDX-License-Identifier: GPL-2.0 OR MIT
++/*
++ * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
++ *
++ * This is an implementation of the BLAKE2s hash and PRF functions.
++ *
++ * Information: https://blake2.net/
++ *
++ */
++
++#include <crypto/internal/blake2s.h>
++#include <linux/types.h>
++#include <linux/string.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/bug.h>
++#include <asm/unaligned.h>
++
++bool blake2s_selftest(void);
++
++void blake2s_update(struct blake2s_state *state, const u8 *in, size_t inlen)
++{
++ const size_t fill = BLAKE2S_BLOCK_SIZE - state->buflen;
++
++ if (unlikely(!inlen))
++ return;
++ if (inlen > fill) {
++ memcpy(state->buf + state->buflen, in, fill);
++ blake2s_compress_generic(state, state->buf, 1,
++ BLAKE2S_BLOCK_SIZE);
++ state->buflen = 0;
++ in += fill;
++ inlen -= fill;
++ }
++ if (inlen > BLAKE2S_BLOCK_SIZE) {
++ const size_t nblocks = DIV_ROUND_UP(inlen, BLAKE2S_BLOCK_SIZE);
++ /* Hash one less (full) block than strictly possible */
++ blake2s_compress_generic(state, in, nblocks - 1,
++ BLAKE2S_BLOCK_SIZE);
++ in += BLAKE2S_BLOCK_SIZE * (nblocks - 1);
++ inlen -= BLAKE2S_BLOCK_SIZE * (nblocks - 1);
++ }
++ memcpy(state->buf + state->buflen, in, inlen);
++ state->buflen += inlen;
++}
++EXPORT_SYMBOL(blake2s_update);
++
++void blake2s_final(struct blake2s_state *state, u8 *out)
++{
++ WARN_ON(IS_ENABLED(DEBUG) && !out);
++ blake2s_set_lastblock(state);
++ memset(state->buf + state->buflen, 0,
++ BLAKE2S_BLOCK_SIZE - state->buflen); /* Padding */
++ blake2s_compress_generic(state, state->buf, 1, state->buflen);
++ cpu_to_le32_array(state->h, ARRAY_SIZE(state->h));
++ memcpy(out, state->h, state->outlen);
++ memzero_explicit(state, sizeof(*state));
++}
++EXPORT_SYMBOL(blake2s_final);
++
++static int __init mod_init(void)
++{
++ if (!IS_ENABLED(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS) &&
++ WARN_ON(!blake2s_selftest()))
++ return -ENODEV;
++ return 0;
++}
++
++static void __exit mod_exit(void)
++{
++}
++
++module_init(mod_init);
++module_exit(mod_exit);
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("BLAKE2s hash function");
++MODULE_AUTHOR("Jason A. Donenfeld <Jason@zx2c4.com>");
+diff --git a/lib/random32.c b/lib/random32.c
+index 9085b1172015e..339624191b515 100644
+--- a/lib/random32.c
++++ b/lib/random32.c
+@@ -38,6 +38,9 @@
+ #include <linux/jiffies.h>
+ #include <linux/random.h>
+ #include <linux/sched.h>
++#include <linux/bitops.h>
++#include <linux/slab.h>
++#include <linux/notifier.h>
+ #include <asm/unaligned.h>
+
+ /**
+@@ -544,9 +547,11 @@ static void prandom_reseed(struct timer_list *unused)
+ * To avoid worrying about whether it's safe to delay that interrupt
+ * long enough to seed all CPUs, just schedule an immediate timer event.
+ */
+-static void prandom_timer_start(struct random_ready_callback *unused)
++static int prandom_timer_start(struct notifier_block *nb,
++ unsigned long action, void *data)
+ {
+ mod_timer(&seed_timer, jiffies);
++ return 0;
+ }
+
+ /*
+@@ -555,13 +560,13 @@ static void prandom_timer_start(struct random_ready_callback *unused)
+ */
+ static int __init prandom_init_late(void)
+ {
+- static struct random_ready_callback random_ready = {
+- .func = prandom_timer_start
++ static struct notifier_block random_ready = {
++ .notifier_call = prandom_timer_start
+ };
+- int ret = add_random_ready_callback(&random_ready);
++ int ret = register_random_ready_notifier(&random_ready);
+
+ if (ret == -EALREADY) {
+- prandom_timer_start(&random_ready);
++ prandom_timer_start(&random_ready, 0, NULL);
+ ret = 0;
+ }
+ return ret;
+diff --git a/lib/sha1.c b/lib/sha1.c
+index 1d96d2c02b826..bad46695476bd 100644
+--- a/lib/sha1.c
++++ b/lib/sha1.c
+@@ -10,6 +10,7 @@
+ #include <linux/export.h>
+ #include <linux/bitops.h>
+ #include <linux/cryptohash.h>
++#include <linux/string.h>
+ #include <asm/unaligned.h>
+
+ /*
+@@ -55,7 +56,8 @@
+ #define SHA_ROUND(t, input, fn, constant, A, B, C, D, E) do { \
+ __u32 TEMP = input(t); setW(t, TEMP); \
+ E += TEMP + rol32(A,5) + (fn) + (constant); \
+- B = ror32(B, 2); } while (0)
++ B = ror32(B, 2); \
++ TEMP = E; E = D; D = C; C = B; B = A; A = TEMP; } while (0)
+
+ #define T_0_15(t, A, B, C, D, E) SHA_ROUND(t, SHA_SRC, (((C^D)&B)^D) , 0x5a827999, A, B, C, D, E )
+ #define T_16_19(t, A, B, C, D, E) SHA_ROUND(t, SHA_MIX, (((C^D)&B)^D) , 0x5a827999, A, B, C, D, E )
+@@ -82,6 +84,7 @@
+ void sha_transform(__u32 *digest, const char *data, __u32 *array)
+ {
+ __u32 A, B, C, D, E;
++ unsigned int i = 0;
+
+ A = digest[0];
+ B = digest[1];
+@@ -90,94 +93,24 @@ void sha_transform(__u32 *digest, const char *data, __u32 *array)
+ E = digest[4];
+
+ /* Round 1 - iterations 0-16 take their input from 'data' */
+- T_0_15( 0, A, B, C, D, E);
+- T_0_15( 1, E, A, B, C, D);
+- T_0_15( 2, D, E, A, B, C);
+- T_0_15( 3, C, D, E, A, B);
+- T_0_15( 4, B, C, D, E, A);
+- T_0_15( 5, A, B, C, D, E);
+- T_0_15( 6, E, A, B, C, D);
+- T_0_15( 7, D, E, A, B, C);
+- T_0_15( 8, C, D, E, A, B);
+- T_0_15( 9, B, C, D, E, A);
+- T_0_15(10, A, B, C, D, E);
+- T_0_15(11, E, A, B, C, D);
+- T_0_15(12, D, E, A, B, C);
+- T_0_15(13, C, D, E, A, B);
+- T_0_15(14, B, C, D, E, A);
+- T_0_15(15, A, B, C, D, E);
++ for (; i < 16; ++i)
++ T_0_15(i, A, B, C, D, E);
+
+ /* Round 1 - tail. Input from 512-bit mixing array */
+- T_16_19(16, E, A, B, C, D);
+- T_16_19(17, D, E, A, B, C);
+- T_16_19(18, C, D, E, A, B);
+- T_16_19(19, B, C, D, E, A);
++ for (; i < 20; ++i)
++ T_16_19(i, A, B, C, D, E);
+
+ /* Round 2 */
+- T_20_39(20, A, B, C, D, E);
+- T_20_39(21, E, A, B, C, D);
+- T_20_39(22, D, E, A, B, C);
+- T_20_39(23, C, D, E, A, B);
+- T_20_39(24, B, C, D, E, A);
+- T_20_39(25, A, B, C, D, E);
+- T_20_39(26, E, A, B, C, D);
+- T_20_39(27, D, E, A, B, C);
+- T_20_39(28, C, D, E, A, B);
+- T_20_39(29, B, C, D, E, A);
+- T_20_39(30, A, B, C, D, E);
+- T_20_39(31, E, A, B, C, D);
+- T_20_39(32, D, E, A, B, C);
+- T_20_39(33, C, D, E, A, B);
+- T_20_39(34, B, C, D, E, A);
+- T_20_39(35, A, B, C, D, E);
+- T_20_39(36, E, A, B, C, D);
+- T_20_39(37, D, E, A, B, C);
+- T_20_39(38, C, D, E, A, B);
+- T_20_39(39, B, C, D, E, A);
++ for (; i < 40; ++i)
++ T_20_39(i, A, B, C, D, E);
+
+ /* Round 3 */
+- T_40_59(40, A, B, C, D, E);
+- T_40_59(41, E, A, B, C, D);
+- T_40_59(42, D, E, A, B, C);
+- T_40_59(43, C, D, E, A, B);
+- T_40_59(44, B, C, D, E, A);
+- T_40_59(45, A, B, C, D, E);
+- T_40_59(46, E, A, B, C, D);
+- T_40_59(47, D, E, A, B, C);
+- T_40_59(48, C, D, E, A, B);
+- T_40_59(49, B, C, D, E, A);
+- T_40_59(50, A, B, C, D, E);
+- T_40_59(51, E, A, B, C, D);
+- T_40_59(52, D, E, A, B, C);
+- T_40_59(53, C, D, E, A, B);
+- T_40_59(54, B, C, D, E, A);
+- T_40_59(55, A, B, C, D, E);
+- T_40_59(56, E, A, B, C, D);
+- T_40_59(57, D, E, A, B, C);
+- T_40_59(58, C, D, E, A, B);
+- T_40_59(59, B, C, D, E, A);
++ for (; i < 60; ++i)
++ T_40_59(i, A, B, C, D, E);
+
+ /* Round 4 */
+- T_60_79(60, A, B, C, D, E);
+- T_60_79(61, E, A, B, C, D);
+- T_60_79(62, D, E, A, B, C);
+- T_60_79(63, C, D, E, A, B);
+- T_60_79(64, B, C, D, E, A);
+- T_60_79(65, A, B, C, D, E);
+- T_60_79(66, E, A, B, C, D);
+- T_60_79(67, D, E, A, B, C);
+- T_60_79(68, C, D, E, A, B);
+- T_60_79(69, B, C, D, E, A);
+- T_60_79(70, A, B, C, D, E);
+- T_60_79(71, E, A, B, C, D);
+- T_60_79(72, D, E, A, B, C);
+- T_60_79(73, C, D, E, A, B);
+- T_60_79(74, B, C, D, E, A);
+- T_60_79(75, A, B, C, D, E);
+- T_60_79(76, E, A, B, C, D);
+- T_60_79(77, D, E, A, B, C);
+- T_60_79(78, C, D, E, A, B);
+- T_60_79(79, B, C, D, E, A);
++ for (; i < 80; ++i)
++ T_60_79(i, A, B, C, D, E);
+
+ digest[0] += A;
+ digest[1] += B;
+diff --git a/lib/siphash.c b/lib/siphash.c
+index e632ee40aac1a..5b34b5c839887 100644
+--- a/lib/siphash.c
++++ b/lib/siphash.c
+@@ -18,19 +18,13 @@
+ #include <asm/word-at-a-time.h>
+ #endif
+
+-#define SIPROUND \
+- do { \
+- v0 += v1; v1 = rol64(v1, 13); v1 ^= v0; v0 = rol64(v0, 32); \
+- v2 += v3; v3 = rol64(v3, 16); v3 ^= v2; \
+- v0 += v3; v3 = rol64(v3, 21); v3 ^= v0; \
+- v2 += v1; v1 = rol64(v1, 17); v1 ^= v2; v2 = rol64(v2, 32); \
+- } while (0)
++#define SIPROUND SIPHASH_PERMUTATION(v0, v1, v2, v3)
+
+ #define PREAMBLE(len) \
+- u64 v0 = 0x736f6d6570736575ULL; \
+- u64 v1 = 0x646f72616e646f6dULL; \
+- u64 v2 = 0x6c7967656e657261ULL; \
+- u64 v3 = 0x7465646279746573ULL; \
++ u64 v0 = SIPHASH_CONST_0; \
++ u64 v1 = SIPHASH_CONST_1; \
++ u64 v2 = SIPHASH_CONST_2; \
++ u64 v3 = SIPHASH_CONST_3; \
+ u64 b = ((u64)(len)) << 56; \
+ v3 ^= key->key[1]; \
+ v2 ^= key->key[0]; \
+@@ -389,19 +383,13 @@ u32 hsiphash_4u32(const u32 first, const u32 second, const u32 third,
+ }
+ EXPORT_SYMBOL(hsiphash_4u32);
+ #else
+-#define HSIPROUND \
+- do { \
+- v0 += v1; v1 = rol32(v1, 5); v1 ^= v0; v0 = rol32(v0, 16); \
+- v2 += v3; v3 = rol32(v3, 8); v3 ^= v2; \
+- v0 += v3; v3 = rol32(v3, 7); v3 ^= v0; \
+- v2 += v1; v1 = rol32(v1, 13); v1 ^= v2; v2 = rol32(v2, 16); \
+- } while (0)
++#define HSIPROUND HSIPHASH_PERMUTATION(v0, v1, v2, v3)
+
+ #define HPREAMBLE(len) \
+- u32 v0 = 0; \
+- u32 v1 = 0; \
+- u32 v2 = 0x6c796765U; \
+- u32 v3 = 0x74656462U; \
++ u32 v0 = HSIPHASH_CONST_0; \
++ u32 v1 = HSIPHASH_CONST_1; \
++ u32 v2 = HSIPHASH_CONST_2; \
++ u32 v3 = HSIPHASH_CONST_3; \
+ u32 b = ((u32)(len)) << 24; \
+ v3 ^= key->key[1]; \
+ v2 ^= key->key[0]; \
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index c2619510636eb..5e672480d3be2 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -1700,14 +1700,16 @@ static void enable_ptr_key_workfn(struct work_struct *work)
+
+ static DECLARE_WORK(enable_ptr_key_work, enable_ptr_key_workfn);
+
+-static void fill_random_ptr_key(struct random_ready_callback *unused)
++static int fill_random_ptr_key(struct notifier_block *nb,
++ unsigned long action, void *data)
+ {
+ /* This may be in an interrupt handler. */
+ queue_work(system_unbound_wq, &enable_ptr_key_work);
++ return 0;
+ }
+
+-static struct random_ready_callback random_ready = {
+- .func = fill_random_ptr_key
++static struct notifier_block random_ready = {
++ .notifier_call = fill_random_ptr_key
+ };
+
+ static int __init initialize_ptr_random(void)
+@@ -1721,7 +1723,7 @@ static int __init initialize_ptr_random(void)
+ return 0;
+ }
+
+- ret = add_random_ready_callback(&random_ready);
++ ret = register_random_ready_notifier(&random_ready);
+ if (!ret) {
+ return 0;
+ } else if (ret == -EALREADY) {
+diff --git a/mm/util.c b/mm/util.c
+index 621afcea2bfa8..e63eeb95f0f0a 100644
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -14,6 +14,7 @@
+ #include <linux/hugetlb.h>
+ #include <linux/vmalloc.h>
+ #include <linux/userfaultfd_k.h>
++#include <linux/random.h>
+
+ #include <asm/sections.h>
+ #include <linux/uaccess.h>
+@@ -286,6 +287,38 @@ int vma_is_stack_for_current(struct vm_area_struct *vma)
+ return (vma->vm_start <= KSTK_ESP(t) && vma->vm_end >= KSTK_ESP(t));
+ }
+
++/**
++ * randomize_page - Generate a random, page aligned address
++ * @start: The smallest acceptable address the caller will take.
++ * @range: The size of the area, starting at @start, within which the
++ * random address must fall.
++ *
++ * If @start + @range would overflow, @range is capped.
++ *
++ * NOTE: Historical use of randomize_range, which this replaces, presumed that
++ * @start was already page aligned. We now align it regardless.
++ *
++ * Return: A page aligned address within [start, start + range). On error,
++ * @start is returned.
++ */
++unsigned long randomize_page(unsigned long start, unsigned long range)
++{
++ if (!PAGE_ALIGNED(start)) {
++ range -= PAGE_ALIGN(start) - start;
++ start = PAGE_ALIGN(start);
++ }
++
++ if (start > ULONG_MAX - range)
++ range = ULONG_MAX - start;
++
++ range >>= PAGE_SHIFT;
++
++ if (range == 0)
++ return start;
++
++ return start + (get_random_long() % range << PAGE_SHIFT);
++}
++
+ #if defined(CONFIG_MMU) && !defined(HAVE_ARCH_PICK_MMAP_LAYOUT)
+ void arch_pick_mmap_layout(struct mm_struct *mm, struct rlimit *rlim_stack)
+ {
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index 0a8aec3f37cc6..5295a579ec820 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -718,12 +718,14 @@ EXPORT_SYMBOL_GPL(inet_unhash);
+ * Note that we use 32bit integers (vs RFC 'short integers')
+ * because 2^16 is not a multiple of num_ephemeral and this
+ * property might be used by clever attacker.
+- * RFC claims using TABLE_LENGTH=10 buckets gives an improvement,
+- * we use 256 instead to really give more isolation and
+- * privacy, this only consumes 1 KB of kernel memory.
++ * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though
++ * attacks were since demonstrated, thus we use 65536 instead to really
++ * give more isolation and privacy, at the expense of 256kB of kernel
++ * memory.
+ */
+-#define INET_TABLE_PERTURB_SHIFT 8
+-static u32 table_perturb[1 << INET_TABLE_PERTURB_SHIFT];
++#define INET_TABLE_PERTURB_SHIFT 16
++#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT)
++static u32 *table_perturb;
+
+ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+ struct sock *sk, u64 port_offset,
+@@ -763,10 +765,11 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+ if (likely(remaining > 1))
+ remaining &= ~1U;
+
+- net_get_random_once(table_perturb, sizeof(table_perturb));
+- index = hash_32(port_offset, INET_TABLE_PERTURB_SHIFT);
++ net_get_random_once(table_perturb,
++ INET_TABLE_PERTURB_SIZE * sizeof(*table_perturb));
++ index = port_offset & (INET_TABLE_PERTURB_SIZE - 1);
+
+- offset = READ_ONCE(table_perturb[index]) + port_offset;
++ offset = READ_ONCE(table_perturb[index]) + (port_offset >> 32);
+ offset %= remaining;
+
+ /* In first pass we try ports of @low parity.
+@@ -821,6 +824,12 @@ next_port:
+ return -EADDRNOTAVAIL;
+
+ ok:
++ /* Here we want to add a little bit of randomness to the next source
++ * port that will be chosen. We use a max() with a random here so that
++ * on low contention the randomness is maximal and on high contention
++ * it may be inexistent.
++ */
++ i = max_t(int, i, (prandom_u32() & 7) * 2);
+ WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2);
+
+ /* Head lock still held and bh's disabled */
+@@ -890,6 +899,12 @@ void __init inet_hashinfo2_init(struct inet_hashinfo *h, const char *name,
+ INIT_HLIST_HEAD(&h->lhash2[i].head);
+ h->lhash2[i].count = 0;
+ }
++
++ /* this one is used for source ports of outgoing connections */
++ table_perturb = kmalloc_array(INET_TABLE_PERTURB_SIZE,
++ sizeof(*table_perturb), GFP_KERNEL);
++ if (!table_perturb)
++ panic("TCP: failed to alloc table_perturb");
+ }
+
+ int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo)
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index 2ff25c445b821..9dae10d8880cf 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -519,14 +519,15 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ struct ipcm6_cookie ipc6;
+ int addr_len = msg->msg_namelen;
+ int transhdrlen = 4; /* zero session-id */
+- int ulen = len + transhdrlen;
++ int ulen;
+ int err;
+
+ /* Rough check on arithmetic overflow,
+ better check is made in ip6_append_data().
+ */
+- if (len > INT_MAX)
++ if (len > INT_MAX - transhdrlen)
+ return -EMSGSIZE;
++ ulen = len + transhdrlen;
+
+ /* Mirror BSD error message compatibility */
+ if (msg->msg_flags & MSG_OOB)
+diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
+index 8b75afe412842..091202b84b6e6 100644
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -443,6 +443,7 @@ static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
+ update_ip_l4_checksum(skb, nh, *addr, new_addr);
+ csum_replace4(&nh->check, *addr, new_addr);
+ skb_clear_hash(skb);
++ ovs_ct_clear(skb, NULL);
+ *addr = new_addr;
+ }
+
+@@ -490,6 +491,7 @@ static void set_ipv6_addr(struct sk_buff *skb, u8 l4_proto,
+ update_ipv6_checksum(skb, l4_proto, addr, new_addr);
+
+ skb_clear_hash(skb);
++ ovs_ct_clear(skb, NULL);
+ memcpy(addr, new_addr, sizeof(__be32[4]));
+ }
+
+@@ -730,6 +732,7 @@ static int set_nsh(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ static void set_tp_port(struct sk_buff *skb, __be16 *port,
+ __be16 new_port, __sum16 *check)
+ {
++ ovs_ct_clear(skb, NULL);
+ inet_proto_csum_replace2(check, skb, *port, new_port, false);
+ *port = new_port;
+ }
+@@ -769,6 +772,7 @@ static int set_udp(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ uh->dest = dst;
+ flow_key->tp.src = src;
+ flow_key->tp.dst = dst;
++ ovs_ct_clear(skb, NULL);
+ }
+
+ skb_clear_hash(skb);
+@@ -831,6 +835,8 @@ static int set_sctp(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ sh->checksum = old_csum ^ old_correct_csum ^ new_csum;
+
+ skb_clear_hash(skb);
++ ovs_ct_clear(skb, NULL);
++
+ flow_key->tp.src = sh->source;
+ flow_key->tp.dst = sh->dest;
+
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index fb13fcfedaf4f..0777c8d416f1b 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -1303,7 +1303,8 @@ int ovs_ct_clear(struct sk_buff *skb, struct sw_flow_key *key)
+ if (skb_nfct(skb)) {
+ nf_conntrack_put(skb_nfct(skb));
+ nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
+- ovs_ct_fill_key(skb, key);
++ if (key)
++ ovs_ct_fill_key(skb, key);
+ }
+
+ return 0;
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index 180f5feb77177..eba94cf3d2d01 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -2253,6 +2253,36 @@ static struct sw_flow_actions *nla_alloc_flow_actions(int size)
+ return sfa;
+ }
+
++static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len);
++
++static void ovs_nla_free_clone_action(const struct nlattr *action)
++{
++ const struct nlattr *a = nla_data(action);
++ int rem = nla_len(action);
++
++ switch (nla_type(a)) {
++ case OVS_CLONE_ATTR_EXEC:
++ /* The real list of actions follows this attribute. */
++ a = nla_next(a, &rem);
++ ovs_nla_free_nested_actions(a, rem);
++ break;
++ }
++}
++
++static void ovs_nla_free_sample_action(const struct nlattr *action)
++{
++ const struct nlattr *a = nla_data(action);
++ int rem = nla_len(action);
++
++ switch (nla_type(a)) {
++ case OVS_SAMPLE_ATTR_ARG:
++ /* The real list of actions follows this attribute. */
++ a = nla_next(a, &rem);
++ ovs_nla_free_nested_actions(a, rem);
++ break;
++ }
++}
++
+ static void ovs_nla_free_set_action(const struct nlattr *a)
+ {
+ const struct nlattr *ovs_key = nla_data(a);
+@@ -2266,25 +2296,46 @@ static void ovs_nla_free_set_action(const struct nlattr *a)
+ }
+ }
+
+-void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts)
++static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len)
+ {
+ const struct nlattr *a;
+ int rem;
+
+- if (!sf_acts)
++ /* Whenever new actions are added, the need to update this
++ * function should be considered.
++ */
++ BUILD_BUG_ON(OVS_ACTION_ATTR_MAX != 20);
++
++ if (!actions)
+ return;
+
+- nla_for_each_attr(a, sf_acts->actions, sf_acts->actions_len, rem) {
++ nla_for_each_attr(a, actions, len, rem) {
+ switch (nla_type(a)) {
+- case OVS_ACTION_ATTR_SET:
+- ovs_nla_free_set_action(a);
++ case OVS_ACTION_ATTR_CLONE:
++ ovs_nla_free_clone_action(a);
+ break;
++
+ case OVS_ACTION_ATTR_CT:
+ ovs_ct_free_action(a);
+ break;
++
++ case OVS_ACTION_ATTR_SAMPLE:
++ ovs_nla_free_sample_action(a);
++ break;
++
++ case OVS_ACTION_ATTR_SET:
++ ovs_nla_free_set_action(a);
++ break;
+ }
+ }
++}
++
++void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts)
++{
++ if (!sf_acts)
++ return;
+
++ ovs_nla_free_nested_actions(sf_acts->actions, sf_acts->actions_len);
+ kfree(sf_acts);
+ }
+
+diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
+index 3d65a2bccfc7b..7f9d8365c9320 100644
+--- a/net/sunrpc/xprtrdma/rpc_rdma.c
++++ b/net/sunrpc/xprtrdma/rpc_rdma.c
+@@ -72,7 +72,7 @@ static unsigned int rpcrdma_max_call_header_size(unsigned int maxsegs)
+
+ /* Maximum Read list size */
+ maxsegs += 2; /* segment for head and tail buffers */
+- size = maxsegs * rpcrdma_readchunk_maxsz * sizeof(__be32);
++ size += maxsegs * rpcrdma_readchunk_maxsz * sizeof(__be32);
+
+ /* Minimal Read chunk size */
+ size += sizeof(__be32); /* segment count */
+@@ -98,7 +98,7 @@ static unsigned int rpcrdma_max_reply_header_size(unsigned int maxsegs)
+
+ /* Maximum Write list size */
+ maxsegs += 2; /* segment for head and tail buffers */
+- size = sizeof(__be32); /* segment count */
++ size += sizeof(__be32); /* segment count */
+ size += maxsegs * rpcrdma_segment_maxsz * sizeof(__be32);
+ size += sizeof(__be32); /* list discriminator */
+
+diff --git a/scripts/faddr2line b/scripts/faddr2line
+index 226c3f559dc5d..2571caac3156c 100755
+--- a/scripts/faddr2line
++++ b/scripts/faddr2line
+@@ -95,17 +95,25 @@ __faddr2line() {
+ local print_warnings=$4
+
+ local sym_name=${func_addr%+*}
+- local offset=${func_addr#*+}
+- offset=${offset%/*}
++ local func_offset=${func_addr#*+}
++ func_offset=${func_offset%/*}
+ local user_size=
++ local file_type
++ local is_vmlinux=0
+ [[ $func_addr =~ "/" ]] && user_size=${func_addr#*/}
+
+- if [[ -z $sym_name ]] || [[ -z $offset ]] || [[ $sym_name = $func_addr ]]; then
++ if [[ -z $sym_name ]] || [[ -z $func_offset ]] || [[ $sym_name = $func_addr ]]; then
+ warn "bad func+offset $func_addr"
+ DONE=1
+ return
+ fi
+
++ # vmlinux uses absolute addresses in the section table rather than
++ # section offsets.
++ local file_type=$(${READELF} --file-header $objfile |
++ ${AWK} '$1 == "Type:" { print $2; exit }')
++ [[ $file_type = "EXEC" ]] && is_vmlinux=1
++
+ # Go through each of the object's symbols which match the func name.
+ # In rare cases there might be duplicates, in which case we print all
+ # matches.
+@@ -114,9 +122,11 @@ __faddr2line() {
+ local sym_addr=0x${fields[1]}
+ local sym_elf_size=${fields[2]}
+ local sym_sec=${fields[6]}
++ local sec_size
++ local sec_name
+
+ # Get the section size:
+- local sec_size=$(${READELF} --section-headers --wide $objfile |
++ sec_size=$(${READELF} --section-headers --wide $objfile |
+ sed 's/\[ /\[/' |
+ ${AWK} -v sec=$sym_sec '$1 == "[" sec "]" { print "0x" $6; exit }')
+
+@@ -126,6 +136,17 @@ __faddr2line() {
+ return
+ fi
+
++ # Get the section name:
++ sec_name=$(${READELF} --section-headers --wide $objfile |
++ sed 's/\[ /\[/' |
++ ${AWK} -v sec=$sym_sec '$1 == "[" sec "]" { print $2; exit }')
++
++ if [[ -z $sec_name ]]; then
++ warn "bad section name: section: $sym_sec"
++ DONE=1
++ return
++ fi
++
+ # Calculate the symbol size.
+ #
+ # Unfortunately we can't use the ELF size, because kallsyms
+@@ -174,10 +195,10 @@ __faddr2line() {
+
+ sym_size=0x$(printf %x $sym_size)
+
+- # Calculate the section address from user-supplied offset:
+- local addr=$(($sym_addr + $offset))
++ # Calculate the address from user-supplied offset:
++ local addr=$(($sym_addr + $func_offset))
+ if [[ -z $addr ]] || [[ $addr = 0 ]]; then
+- warn "bad address: $sym_addr + $offset"
++ warn "bad address: $sym_addr + $func_offset"
+ DONE=1
+ return
+ fi
+@@ -191,9 +212,9 @@ __faddr2line() {
+ fi
+
+ # Make sure the provided offset is within the symbol's range:
+- if [[ $offset -gt $sym_size ]]; then
++ if [[ $func_offset -gt $sym_size ]]; then
+ [[ $print_warnings = 1 ]] &&
+- echo "skipping $sym_name address at $addr due to size mismatch ($offset > $sym_size)"
++ echo "skipping $sym_name address at $addr due to size mismatch ($func_offset > $sym_size)"
+ continue
+ fi
+
+@@ -202,11 +223,13 @@ __faddr2line() {
+ [[ $FIRST = 0 ]] && echo
+ FIRST=0
+
+- echo "$sym_name+$offset/$sym_size:"
++ echo "$sym_name+$func_offset/$sym_size:"
+
+ # Pass section address to addr2line and strip absolute paths
+ # from the output:
+- local output=$(${ADDR2LINE} -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;")
++ local args="--functions --pretty-print --inlines --exe=$objfile"
++ [[ $is_vmlinux = 0 ]] && args="$args --section=$sec_name"
++ local output=$(${ADDR2LINE} $args $addr | sed "s; $dir_prefix\(\./\)*; ;")
+ [[ -z $output ]] && continue
+
+ # Default output (non --list):
+diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
+index 3d83c1be12922..de311299432b6 100644
+--- a/sound/soc/codecs/cs42l52.c
++++ b/sound/soc/codecs/cs42l52.c
+@@ -141,7 +141,9 @@ static DECLARE_TLV_DB_SCALE(mic_tlv, 1600, 100, 0);
+
+ static DECLARE_TLV_DB_SCALE(pga_tlv, -600, 50, 0);
+
+-static DECLARE_TLV_DB_SCALE(mix_tlv, -50, 50, 0);
++static DECLARE_TLV_DB_SCALE(pass_tlv, -6000, 50, 0);
++
++static DECLARE_TLV_DB_SCALE(mix_tlv, -5150, 50, 0);
+
+ static DECLARE_TLV_DB_SCALE(beep_tlv, -56, 200, 0);
+
+@@ -355,7 +357,7 @@ static const struct snd_kcontrol_new cs42l52_snd_controls[] = {
+ CS42L52_SPKB_VOL, 0, 0x40, 0xC0, hl_tlv),
+
+ SOC_DOUBLE_R_SX_TLV("Bypass Volume", CS42L52_PASSTHRUA_VOL,
+- CS42L52_PASSTHRUB_VOL, 0, 0x88, 0x90, pga_tlv),
++ CS42L52_PASSTHRUB_VOL, 0, 0x88, 0x90, pass_tlv),
+
+ SOC_DOUBLE("Bypass Mute", CS42L52_MISC_CTL, 4, 5, 1, 0),
+
+@@ -368,7 +370,7 @@ static const struct snd_kcontrol_new cs42l52_snd_controls[] = {
+ CS42L52_ADCB_VOL, 0, 0xA0, 0x78, ipd_tlv),
+ SOC_DOUBLE_R_SX_TLV("ADC Mixer Volume",
+ CS42L52_ADCA_MIXER_VOL, CS42L52_ADCB_MIXER_VOL,
+- 0, 0x19, 0x7F, ipd_tlv),
++ 0, 0x19, 0x7F, mix_tlv),
+
+ SOC_DOUBLE("ADC Switch", CS42L52_ADC_MISC_CTL, 0, 1, 1, 0),
+
+diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c
+index 04f89b751304c..deaad703a7dbf 100644
+--- a/sound/soc/codecs/cs42l56.c
++++ b/sound/soc/codecs/cs42l56.c
+@@ -403,9 +403,9 @@ static const struct snd_kcontrol_new cs42l56_snd_controls[] = {
+ SOC_DOUBLE("ADC Boost Switch", CS42L56_GAIN_BIAS_CTL, 3, 2, 1, 1),
+
+ SOC_DOUBLE_R_SX_TLV("Headphone Volume", CS42L56_HPA_VOLUME,
+- CS42L56_HPB_VOLUME, 0, 0x84, 0x48, hl_tlv),
++ CS42L56_HPB_VOLUME, 0, 0x44, 0x48, hl_tlv),
+ SOC_DOUBLE_R_SX_TLV("LineOut Volume", CS42L56_LOA_VOLUME,
+- CS42L56_LOB_VOLUME, 0, 0x84, 0x48, hl_tlv),
++ CS42L56_LOB_VOLUME, 0, 0x44, 0x48, hl_tlv),
+
+ SOC_SINGLE_TLV("Bass Shelving Volume", CS42L56_TONE_CTL,
+ 0, 0x00, 1, tone_tlv),
+diff --git a/sound/soc/codecs/cs53l30.c b/sound/soc/codecs/cs53l30.c
+index 8995ea45b4ca8..86e93904b001c 100644
+--- a/sound/soc/codecs/cs53l30.c
++++ b/sound/soc/codecs/cs53l30.c
+@@ -351,22 +351,22 @@ static const struct snd_kcontrol_new cs53l30_snd_controls[] = {
+ SOC_ENUM("ADC2 NG Delay", adc2_ng_delay_enum),
+
+ SOC_SINGLE_SX_TLV("ADC1A PGA Volume",
+- CS53L30_ADC1A_AFE_CTL, 0, 0x34, 0x18, pga_tlv),
++ CS53L30_ADC1A_AFE_CTL, 0, 0x34, 0x24, pga_tlv),
+ SOC_SINGLE_SX_TLV("ADC1B PGA Volume",
+- CS53L30_ADC1B_AFE_CTL, 0, 0x34, 0x18, pga_tlv),
++ CS53L30_ADC1B_AFE_CTL, 0, 0x34, 0x24, pga_tlv),
+ SOC_SINGLE_SX_TLV("ADC2A PGA Volume",
+- CS53L30_ADC2A_AFE_CTL, 0, 0x34, 0x18, pga_tlv),
++ CS53L30_ADC2A_AFE_CTL, 0, 0x34, 0x24, pga_tlv),
+ SOC_SINGLE_SX_TLV("ADC2B PGA Volume",
+- CS53L30_ADC2B_AFE_CTL, 0, 0x34, 0x18, pga_tlv),
++ CS53L30_ADC2B_AFE_CTL, 0, 0x34, 0x24, pga_tlv),
+
+ SOC_SINGLE_SX_TLV("ADC1A Digital Volume",
+- CS53L30_ADC1A_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv),
++ CS53L30_ADC1A_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv),
+ SOC_SINGLE_SX_TLV("ADC1B Digital Volume",
+- CS53L30_ADC1B_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv),
++ CS53L30_ADC1B_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv),
+ SOC_SINGLE_SX_TLV("ADC2A Digital Volume",
+- CS53L30_ADC2A_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv),
++ CS53L30_ADC2A_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv),
+ SOC_SINGLE_SX_TLV("ADC2B Digital Volume",
+- CS53L30_ADC2B_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv),
++ CS53L30_ADC2B_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv),
+ };
+
+ static const struct snd_soc_dapm_widget cs53l30_dapm_widgets[] = {
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index 3afa163f7652d..dcb01889e177b 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -165,13 +165,16 @@ static int es8328_put_deemph(struct snd_kcontrol *kcontrol,
+ if (deemph > 1)
+ return -EINVAL;
+
++ if (es8328->deemph == deemph)
++ return 0;
++
+ ret = es8328_set_deemph(component);
+ if (ret < 0)
+ return ret;
+
+ es8328->deemph = deemph;
+
+- return 0;
++ return 1;
+ }
+
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index dde015fd70a41..3f75cb3209ffa 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -3861,6 +3861,7 @@ static int wm8962_runtime_suspend(struct device *dev)
+ #endif
+
+ static const struct dev_pm_ops wm8962_pm = {
++ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
+ SET_RUNTIME_PM_OPS(wm8962_runtime_suspend, wm8962_runtime_resume, NULL)
+ };
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index 02c557e1f779c..c5b0b56d9c94e 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -697,7 +697,7 @@ int wm_adsp_fw_put(struct snd_kcontrol *kcontrol,
+ struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol);
+ struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
+ struct wm_adsp *dsp = snd_soc_component_get_drvdata(component);
+- int ret = 0;
++ int ret = 1;
+
+ if (ucontrol->value.enumerated.item[0] == dsp[e->shift_l].fw)
+ return 0;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-07-02 16:07 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-07-02 16:07 UTC (permalink / raw
To: gentoo-commits
commit: 579d60642ab4b191c0b6754fc5731b1f3d941339
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Jul 2 16:07:20 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Jul 2 16:07:20 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=579d6064
Linux patch 4.19.250
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1249_linux-4.19.250.patch | 1595 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1599 insertions(+)
diff --git a/0000_README b/0000_README
index de0e7128..295b34e0 100644
--- a/0000_README
+++ b/0000_README
@@ -1035,6 +1035,10 @@ Patch: 1248_linux-4.19.249.patch
From: https://www.kernel.org
Desc: Linux 4.19.249
+Patch: 1249_linux-4.19.250.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.250
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1249_linux-4.19.250.patch b/1249_linux-4.19.250.patch
new file mode 100644
index 00000000..a721fcd2
--- /dev/null
+++ b/1249_linux-4.19.250.patch
@@ -0,0 +1,1595 @@
+diff --git a/Documentation/ABI/testing/sysfs-bus-iio-vf610 b/Documentation/ABI/testing/sysfs-bus-iio-vf610
+index 308a6756d3bf3..491ead8044888 100644
+--- a/Documentation/ABI/testing/sysfs-bus-iio-vf610
++++ b/Documentation/ABI/testing/sysfs-bus-iio-vf610
+@@ -1,4 +1,4 @@
+-What: /sys/bus/iio/devices/iio:deviceX/conversion_mode
++What: /sys/bus/iio/devices/iio:deviceX/in_conversion_mode
+ KernelVersion: 4.2
+ Contact: linux-iio@vger.kernel.org
+ Description:
+diff --git a/Makefile b/Makefile
+index 14ba089d5b016..f78a5a3604c31 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 249
++SUBLEVEL = 250
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -1017,7 +1017,7 @@ PHONY += autoksyms_recursive
+ autoksyms_recursive: $(vmlinux-deps)
+ ifdef CONFIG_TRIM_UNUSED_KSYMS
+ $(Q)$(CONFIG_SHELL) $(srctree)/scripts/adjust_autoksyms.sh \
+- "$(MAKE) -f $(srctree)/Makefile vmlinux"
++ "$(MAKE) -f $(srctree)/Makefile autoksyms_recursive"
+ endif
+
+ # For the kernel to actually contain only the needed exported symbols,
+diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
+index 9f88b5691f052..d91cc532d0e2c 100644
+--- a/arch/arm/boot/dts/imx6qdl.dtsi
++++ b/arch/arm/boot/dts/imx6qdl.dtsi
+@@ -753,7 +753,7 @@
+ regulator-name = "vddpu";
+ regulator-min-microvolt = <725000>;
+ regulator-max-microvolt = <1450000>;
+- regulator-enable-ramp-delay = <150>;
++ regulator-enable-ramp-delay = <380>;
+ anatop-reg-offset = <0x140>;
+ anatop-vol-bit-shift = <9>;
+ anatop-vol-bit-width = <5>;
+diff --git a/arch/arm/mach-axxia/platsmp.c b/arch/arm/mach-axxia/platsmp.c
+index 502e3df69f696..c706a11c21931 100644
+--- a/arch/arm/mach-axxia/platsmp.c
++++ b/arch/arm/mach-axxia/platsmp.c
+@@ -42,6 +42,7 @@ static int axxia_boot_secondary(unsigned int cpu, struct task_struct *idle)
+ return -ENOENT;
+
+ syscon = of_iomap(syscon_np, 0);
++ of_node_put(syscon_np);
+ if (!syscon)
+ return -ENOMEM;
+
+diff --git a/arch/arm/mach-cns3xxx/core.c b/arch/arm/mach-cns3xxx/core.c
+index 7d5a44a06648d..95716fc9e6286 100644
+--- a/arch/arm/mach-cns3xxx/core.c
++++ b/arch/arm/mach-cns3xxx/core.c
+@@ -379,6 +379,7 @@ static void __init cns3xxx_init(void)
+ /* De-Asscer SATA Reset */
+ cns3xxx_pwr_soft_rst(CNS3XXX_PWR_SOFTWARE_RST(SATA));
+ }
++ of_node_put(dn);
+
+ dn = of_find_compatible_node(NULL, NULL, "cavium,cns3420-sdhci");
+ if (of_device_is_available(dn)) {
+@@ -392,6 +393,7 @@ static void __init cns3xxx_init(void)
+ cns3xxx_pwr_clk_en(CNS3XXX_PWR_CLK_EN(SDIO));
+ cns3xxx_pwr_soft_rst(CNS3XXX_PWR_SOFTWARE_RST(SDIO));
+ }
++ of_node_put(dn);
+
+ pm_power_off = cns3xxx_power_off;
+
+diff --git a/arch/arm/mach-exynos/exynos.c b/arch/arm/mach-exynos/exynos.c
+index 865dcc4c3181a..23adb1a54bcd9 100644
+--- a/arch/arm/mach-exynos/exynos.c
++++ b/arch/arm/mach-exynos/exynos.c
+@@ -131,6 +131,7 @@ static void exynos_map_pmu(void)
+ np = of_find_matching_node(NULL, exynos_dt_pmu_match);
+ if (np)
+ pmu_base_addr = of_iomap(np, 0);
++ of_node_put(np);
+ }
+
+ static void __init exynos_init_irq(void)
+diff --git a/arch/mips/vr41xx/common/icu.c b/arch/mips/vr41xx/common/icu.c
+index 745b7b4369618..42f77b318974d 100644
+--- a/arch/mips/vr41xx/common/icu.c
++++ b/arch/mips/vr41xx/common/icu.c
+@@ -653,8 +653,6 @@ static int icu_get_irq(unsigned int irq)
+
+ printk(KERN_ERR "spurious ICU interrupt: %04x,%04x\n", pend1, pend2);
+
+- atomic_inc(&irq_err_count);
+-
+ return -1;
+ }
+
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 56c33285b1dfd..9f89fac4ed087 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -1731,7 +1731,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
+ tm_reclaim_current(0);
+ #endif
+
+- memset(regs->gpr, 0, sizeof(regs->gpr));
++ memset(®s->gpr[1], 0, sizeof(regs->gpr) - sizeof(regs->gpr[0]));
+ regs->ctr = 0;
+ regs->link = 0;
+ regs->xer = 0;
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 362c20c8c22f9..b492cb1c36fd9 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -1105,7 +1105,7 @@ static struct rtas_filter rtas_filters[] __ro_after_init = {
+ { "get-time-of-day", -1, -1, -1, -1, -1 },
+ { "ibm,get-vpd", -1, 0, -1, 1, 2 },
+ { "ibm,lpar-perftools", -1, 2, 3, -1, -1 },
+- { "ibm,platform-dump", -1, 4, 5, -1, -1 },
++ { "ibm,platform-dump", -1, 4, 5, -1, -1 }, /* Special cased */
+ { "ibm,read-slot-reset-state", -1, -1, -1, -1, -1 },
+ { "ibm,scan-log-dump", -1, 0, 1, -1, -1 },
+ { "ibm,set-dynamic-indicator", -1, 2, -1, -1, -1 },
+@@ -1152,6 +1152,15 @@ static bool block_rtas_call(int token, int nargs,
+ size = 1;
+
+ end = base + size - 1;
++
++ /*
++ * Special case for ibm,platform-dump - NULL buffer
++ * address is used to indicate end of dump processing
++ */
++ if (!strcmp(f->name, "ibm,platform-dump") &&
++ base == 0)
++ return false;
++
+ if (!in_rmo_buf(base, end))
+ goto err;
+ }
+diff --git a/arch/powerpc/platforms/powernv/powernv.h b/arch/powerpc/platforms/powernv/powernv.h
+index fd4a1c5a6369f..cd9180cc0e133 100644
+--- a/arch/powerpc/platforms/powernv/powernv.h
++++ b/arch/powerpc/platforms/powernv/powernv.h
+@@ -30,4 +30,6 @@ extern void opal_event_shutdown(void);
+
+ bool cpu_core_split_required(void);
+
++void pnv_rng_init(void);
++
+ #endif /* _POWERNV_H */
+diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c
+index e15dd09f71dfb..c5c1d5cd7b10d 100644
+--- a/arch/powerpc/platforms/powernv/rng.c
++++ b/arch/powerpc/platforms/powernv/rng.c
+@@ -21,6 +21,7 @@
+ #include <asm/prom.h>
+ #include <asm/machdep.h>
+ #include <asm/smp.h>
++#include "powernv.h"
+
+ #define DARN_ERR 0xFFFFFFFFFFFFFFFFul
+
+@@ -32,7 +33,6 @@ struct powernv_rng {
+
+ static DEFINE_PER_CPU(struct powernv_rng *, powernv_rng);
+
+-
+ int powernv_hwrng_present(void)
+ {
+ struct powernv_rng *rng;
+@@ -102,9 +102,6 @@ static int initialise_darn(void)
+ return 0;
+ }
+ }
+-
+- pr_warn("Unable to use DARN for get_random_seed()\n");
+-
+ return -EIO;
+ }
+
+@@ -167,32 +164,55 @@ static __init int rng_create(struct device_node *dn)
+
+ rng_init_per_cpu(rng, dn);
+
+- pr_info_once("Registering arch random hook.\n");
+-
+ ppc_md.get_random_seed = powernv_get_random_long;
+
+ return 0;
+ }
+
+-static __init int rng_init(void)
++static int __init pnv_get_random_long_early(unsigned long *v)
+ {
+ struct device_node *dn;
+- int rc;
++
++ if (!slab_is_available())
++ return 0;
++
++ if (cmpxchg(&ppc_md.get_random_seed, pnv_get_random_long_early,
++ NULL) != pnv_get_random_long_early)
++ return 0;
+
+ for_each_compatible_node(dn, NULL, "ibm,power-rng") {
+- rc = rng_create(dn);
+- if (rc) {
+- pr_err("Failed creating rng for %pOF (%d).\n",
+- dn, rc);
++ if (rng_create(dn))
+ continue;
+- }
+-
+ /* Create devices for hwrng driver */
+ of_platform_device_create(dn, NULL, NULL);
+ }
+
+- initialise_darn();
++ if (!ppc_md.get_random_seed)
++ return 0;
++ return ppc_md.get_random_seed(v);
++}
++
++void __init pnv_rng_init(void)
++{
++ struct device_node *dn;
+
++ /* Prefer darn over the rest. */
++ if (!initialise_darn())
++ return;
++
++ dn = of_find_compatible_node(NULL, NULL, "ibm,power-rng");
++ if (dn)
++ ppc_md.get_random_seed = pnv_get_random_long_early;
++
++ of_node_put(dn);
++}
++
++static int __init pnv_rng_late_init(void)
++{
++ unsigned long v;
++ /* In case it wasn't called during init for some other reason. */
++ if (ppc_md.get_random_seed == pnv_get_random_long_early)
++ pnv_get_random_long_early(&v);
+ return 0;
+ }
+-machine_subsys_initcall(powernv, rng_init);
++machine_subsys_initcall(powernv, pnv_rng_late_init);
+diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
+index 5068dd7f6e74b..0ade08dd0ea27 100644
+--- a/arch/powerpc/platforms/powernv/setup.c
++++ b/arch/powerpc/platforms/powernv/setup.c
+@@ -171,6 +171,8 @@ static void __init pnv_setup_arch(void)
+ powersave_nap = 1;
+
+ /* XXX PMCS */
++
++ pnv_rng_init();
+ }
+
+ static void __init pnv_init(void)
+diff --git a/arch/powerpc/platforms/pseries/pseries.h b/arch/powerpc/platforms/pseries/pseries.h
+index 60db2ee511fb4..2f7c5d1c1751e 100644
+--- a/arch/powerpc/platforms/pseries/pseries.h
++++ b/arch/powerpc/platforms/pseries/pseries.h
+@@ -110,4 +110,6 @@ int dlpar_workqueue_init(void);
+
+ void pseries_setup_rfi_flush(void);
+
++void pseries_rng_init(void);
++
+ #endif /* _PSERIES_PSERIES_H */
+diff --git a/arch/powerpc/platforms/pseries/rng.c b/arch/powerpc/platforms/pseries/rng.c
+index 262b8c5e1b9d0..2262630543e91 100644
+--- a/arch/powerpc/platforms/pseries/rng.c
++++ b/arch/powerpc/platforms/pseries/rng.c
+@@ -14,6 +14,7 @@
+ #include <asm/archrandom.h>
+ #include <asm/machdep.h>
+ #include <asm/plpar_wrappers.h>
++#include "pseries.h"
+
+
+ static int pseries_get_random_long(unsigned long *v)
+@@ -28,19 +29,13 @@ static int pseries_get_random_long(unsigned long *v)
+ return 0;
+ }
+
+-static __init int rng_init(void)
++void __init pseries_rng_init(void)
+ {
+ struct device_node *dn;
+
+ dn = of_find_compatible_node(NULL, NULL, "ibm,random");
+ if (!dn)
+- return -ENODEV;
+-
+- pr_info("Registering arch random hook.\n");
+-
++ return;
+ ppc_md.get_random_seed = pseries_get_random_long;
+-
+ of_node_put(dn);
+- return 0;
+ }
+-machine_subsys_initcall(pseries, rng_init);
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index 885d910bfd9db..77423d7650017 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -792,6 +792,7 @@ static void __init pSeries_setup_arch(void)
+ }
+
+ ppc_md.pcibios_root_bridge_prepare = pseries_root_bridge_prepare;
++ pseries_rng_init();
+ }
+
+ static void pseries_panic(char *str)
+diff --git a/arch/s390/include/asm/kexec.h b/arch/s390/include/asm/kexec.h
+index 825dd0f7f2211..ba9b0e76470c5 100644
+--- a/arch/s390/include/asm/kexec.h
++++ b/arch/s390/include/asm/kexec.h
+@@ -9,6 +9,8 @@
+ #ifndef _S390_KEXEC_H
+ #define _S390_KEXEC_H
+
++#include <linux/module.h>
++
+ #include <asm/processor.h>
+ #include <asm/page.h>
+ /*
+@@ -69,4 +71,12 @@ int *kexec_file_update_kernel(struct kimage *iamge,
+ extern const struct kexec_file_ops s390_kexec_image_ops;
+ extern const struct kexec_file_ops s390_kexec_elf_ops;
+
++#ifdef CONFIG_KEXEC_FILE
++struct purgatory_info;
++int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
++ Elf_Shdr *section,
++ const Elf_Shdr *relsec,
++ const Elf_Shdr *symtab);
++#define arch_kexec_apply_relocations_add arch_kexec_apply_relocations_add
++#endif
+ #endif /*_S390_KEXEC_H */
+diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h
+index 5125fca472bb0..0a41c62369f2c 100644
+--- a/arch/x86/include/asm/kexec.h
++++ b/arch/x86/include/asm/kexec.h
+@@ -21,6 +21,7 @@
+ #ifndef __ASSEMBLY__
+
+ #include <linux/string.h>
++#include <linux/module.h>
+
+ #include <asm/page.h>
+ #include <asm/ptrace.h>
+@@ -217,6 +218,14 @@ extern int arch_kexec_post_alloc_pages(void *vaddr, unsigned int pages,
+ extern void arch_kexec_pre_free_pages(void *vaddr, unsigned int pages);
+ #define arch_kexec_pre_free_pages arch_kexec_pre_free_pages
+
++#ifdef CONFIG_KEXEC_FILE
++struct purgatory_info;
++int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
++ Elf_Shdr *section,
++ const Elf_Shdr *relsec,
++ const Elf_Shdr *symtab);
++#define arch_kexec_apply_relocations_add arch_kexec_apply_relocations_add
++#endif
+ #endif
+
+ typedef void crash_vmclear_fn(void);
+diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c
+index 378186b5eb401..071c5f59d6206 100644
+--- a/arch/xtensa/kernel/time.c
++++ b/arch/xtensa/kernel/time.c
+@@ -146,6 +146,7 @@ static void __init calibrate_ccount(void)
+ cpu = of_find_compatible_node(NULL, NULL, "cdns,xtensa-cpu");
+ if (cpu) {
+ clk = of_clk_get(cpu, 0);
++ of_node_put(cpu);
+ if (!IS_ERR(clk)) {
+ ccount_freq = clk_get_rate(clk);
+ return;
+diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
+index db5122765f166..ce00dc2b3a1ec 100644
+--- a/arch/xtensa/platforms/xtfpga/setup.c
++++ b/arch/xtensa/platforms/xtfpga/setup.c
+@@ -152,6 +152,7 @@ static int __init machine_setup(void)
+
+ if ((eth = of_find_compatible_node(eth, NULL, "opencores,ethoc")))
+ update_local_mac(eth);
++ of_node_put(eth);
+ return 0;
+ }
+ arch_initcall(machine_setup);
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 55b23104fe33d..bac4dc501dc4d 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -88,7 +88,7 @@ static RAW_NOTIFIER_HEAD(random_ready_chain);
+
+ /* Control how we warn userspace. */
+ static struct ratelimit_state urandom_warning =
+- RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3);
++ RATELIMIT_STATE_INIT_FLAGS("urandom_warning", HZ, 3, RATELIMIT_MSG_ON_RELEASE);
+ static int ratelimit_disable __read_mostly =
+ IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM);
+ module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
+@@ -996,7 +996,7 @@ void add_interrupt_randomness(int irq)
+ if (new_count & MIX_INFLIGHT)
+ return;
+
+- if (new_count < 64 && !time_is_before_jiffies(fast_pool->last + HZ))
++ if (new_count < 1024 && !time_is_before_jiffies(fast_pool->last + HZ))
+ return;
+
+ if (unlikely(!fast_pool->mix.func))
+diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c
+index 027699cec911b..217b077838aff 100644
+--- a/drivers/gpio/gpio-vr41xx.c
++++ b/drivers/gpio/gpio-vr41xx.c
+@@ -230,8 +230,6 @@ static int giu_get_irq(unsigned int irq)
+ printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
+ maskl, pendl, maskh, pendh);
+
+- atomic_inc(&irq_err_count);
+-
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpio/gpio-winbond.c b/drivers/gpio/gpio-winbond.c
+index 7f8f5b02e31d5..4b61d975cc0ec 100644
+--- a/drivers/gpio/gpio-winbond.c
++++ b/drivers/gpio/gpio-winbond.c
+@@ -385,12 +385,13 @@ static int winbond_gpio_get(struct gpio_chip *gc, unsigned int offset)
+ unsigned long *base = gpiochip_get_data(gc);
+ const struct winbond_gpio_info *info;
+ bool val;
++ int ret;
+
+ winbond_gpio_get_info(&offset, &info);
+
+- val = winbond_sio_enter(*base);
+- if (val)
+- return val;
++ ret = winbond_sio_enter(*base);
++ if (ret)
++ return ret;
+
+ winbond_sio_select_logical(*base, info->dev);
+
+diff --git a/drivers/gpu/drm/drm_crtc_helper_internal.h b/drivers/gpu/drm/drm_crtc_helper_internal.h
+index b5ac1581e6231..d595697d3d7e0 100644
+--- a/drivers/gpu/drm/drm_crtc_helper_internal.h
++++ b/drivers/gpu/drm/drm_crtc_helper_internal.h
+@@ -32,16 +32,6 @@
+ #include <drm/drm_encoder.h>
+ #include <drm/drm_modes.h>
+
+-/* drm_fb_helper.c */
+-#ifdef CONFIG_DRM_FBDEV_EMULATION
+-int drm_fb_helper_modinit(void);
+-#else
+-static inline int drm_fb_helper_modinit(void)
+-{
+- return 0;
+-}
+-#endif
+-
+ /* drm_dp_aux_dev.c */
+ #ifdef CONFIG_DRM_DP_AUX_CHARDEV
+ int drm_dp_aux_dev_init(void);
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index da9a381d6b577..fbe9156c9e7c1 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -3270,24 +3270,3 @@ int drm_fbdev_generic_setup(struct drm_device *dev, unsigned int preferred_bpp)
+ return 0;
+ }
+ EXPORT_SYMBOL(drm_fbdev_generic_setup);
+-
+-/* The Kconfig DRM_KMS_HELPER selects FRAMEBUFFER_CONSOLE (if !EXPERT)
+- * but the module doesn't depend on any fb console symbols. At least
+- * attempt to load fbcon to avoid leaving the system without a usable console.
+- */
+-int __init drm_fb_helper_modinit(void)
+-{
+-#if defined(CONFIG_FRAMEBUFFER_CONSOLE_MODULE) && !defined(CONFIG_EXPERT)
+- const char name[] = "fbcon";
+- struct module *fbcon;
+-
+- mutex_lock(&module_mutex);
+- fbcon = find_module(name);
+- mutex_unlock(&module_mutex);
+-
+- if (!fbcon)
+- request_module_nowait(name);
+-#endif
+- return 0;
+-}
+-EXPORT_SYMBOL(drm_fb_helper_modinit);
+diff --git a/drivers/gpu/drm/drm_kms_helper_common.c b/drivers/gpu/drm/drm_kms_helper_common.c
+index 93e2b30fe1a54..681b297272356 100644
+--- a/drivers/gpu/drm/drm_kms_helper_common.c
++++ b/drivers/gpu/drm/drm_kms_helper_common.c
+@@ -63,19 +63,18 @@ MODULE_PARM_DESC(edid_firmware,
+
+ static int __init drm_kms_helper_init(void)
+ {
+- int ret;
+-
+- /* Call init functions from specific kms helpers here */
+- ret = drm_fb_helper_modinit();
+- if (ret < 0)
+- goto out;
+-
+- ret = drm_dp_aux_dev_init();
+- if (ret < 0)
+- goto out;
+-
+-out:
+- return ret;
++ /*
++ * The Kconfig DRM_KMS_HELPER selects FRAMEBUFFER_CONSOLE (if !EXPERT)
++ * but the module doesn't depend on any fb console symbols. At least
++ * attempt to load fbcon to avoid leaving the system without a usable
++ * console.
++ */
++ if (IS_ENABLED(CONFIG_DRM_FBDEV_EMULATION) &&
++ IS_MODULE(CONFIG_FRAMEBUFFER_CONSOLE) &&
++ !IS_ENABLED(CONFIG_EXPERT))
++ request_module_nowait("fbcon");
++
++ return drm_dp_aux_dev_init();
+ }
+
+ static void __exit drm_kms_helper_exit(void)
+diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
+index 52275dddab3ec..7980bd95e3826 100644
+--- a/drivers/iio/accel/bma180.c
++++ b/drivers/iio/accel/bma180.c
+@@ -780,11 +780,12 @@ static int bma180_probe(struct i2c_client *client,
+ data->trig->dev.parent = &client->dev;
+ data->trig->ops = &bma180_trigger_ops;
+ iio_trigger_set_drvdata(data->trig, indio_dev);
+- indio_dev->trig = iio_trigger_get(data->trig);
+
+ ret = iio_trigger_register(data->trig);
+ if (ret)
+ goto err_trigger_free;
++
++ indio_dev->trig = iio_trigger_get(data->trig);
+ }
+
+ ret = iio_triggered_buffer_setup(indio_dev, NULL,
+diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
+index 1ef75c94987bd..b03c6d9553ae5 100644
+--- a/drivers/iio/accel/mma8452.c
++++ b/drivers/iio/accel/mma8452.c
+@@ -1486,10 +1486,14 @@ static int mma8452_reset(struct i2c_client *client)
+ int i;
+ int ret;
+
+- ret = i2c_smbus_write_byte_data(client, MMA8452_CTRL_REG2,
++ /*
++ * Find on fxls8471, after config reset bit, it reset immediately,
++ * and will not give ACK, so here do not check the return value.
++ * The following code will read the reset register, and check whether
++ * this reset works.
++ */
++ i2c_smbus_write_byte_data(client, MMA8452_CTRL_REG2,
+ MMA8452_CTRL_REG2_RST);
+- if (ret < 0)
+- return ret;
+
+ for (i = 0; i < 10; i++) {
+ usleep_range(100, 200);
+diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
+index e6ce25bcc01ca..8192d20d260aa 100644
+--- a/drivers/iio/adc/axp288_adc.c
++++ b/drivers/iio/adc/axp288_adc.c
+@@ -205,6 +205,14 @@ static const struct dmi_system_id axp288_adc_ts_bias_override[] = {
+ },
+ .driver_data = (void *)(uintptr_t)AXP288_ADC_TS_BIAS_80UA,
+ },
++ {
++ /* Nuvision Solo 10 Draw */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TMAX"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "TM101W610L"),
++ },
++ .driver_data = (void *)(uintptr_t)AXP288_ADC_TS_BIAS_80UA,
++ },
+ {}
+ };
+
+diff --git a/drivers/iio/chemical/ccs811.c b/drivers/iio/chemical/ccs811.c
+index 46d5d48b58b6c..70f1bec3bba86 100644
+--- a/drivers/iio/chemical/ccs811.c
++++ b/drivers/iio/chemical/ccs811.c
+@@ -421,11 +421,11 @@ static int ccs811_probe(struct i2c_client *client,
+ data->drdy_trig->dev.parent = &client->dev;
+ data->drdy_trig->ops = &ccs811_trigger_ops;
+ iio_trigger_set_drvdata(data->drdy_trig, indio_dev);
+- indio_dev->trig = data->drdy_trig;
+- iio_trigger_get(indio_dev->trig);
+ ret = iio_trigger_register(data->drdy_trig);
+ if (ret)
+ goto err_poweroff;
++
++ indio_dev->trig = iio_trigger_get(data->drdy_trig);
+ }
+
+ ret = iio_triggered_buffer_setup(indio_dev, NULL,
+diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
+index e6fdd0f4b4bcb..0d7581a6f5bac 100644
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -873,6 +873,7 @@ static int mpu3050_power_up(struct mpu3050 *mpu3050)
+ ret = regmap_update_bits(mpu3050->map, MPU3050_PWR_MGM,
+ MPU3050_PWR_MGM_SLEEP, 0);
+ if (ret) {
++ regulator_bulk_disable(ARRAY_SIZE(mpu3050->regs), mpu3050->regs);
+ dev_err(mpu3050->dev, "error setting power mode\n");
+ return ret;
+ }
+diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c
+index 3f0dc9a1a5140..cccc07e637a4f 100644
+--- a/drivers/iio/trigger/iio-trig-sysfs.c
++++ b/drivers/iio/trigger/iio-trig-sysfs.c
+@@ -198,6 +198,7 @@ static int iio_sysfs_trigger_remove(int id)
+ }
+
+ iio_trigger_unregister(t->trig);
++ irq_work_sync(&t->work);
+ iio_trigger_free(t->trig);
+
+ list_del(&t->l);
+diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
+index c596fc564a589..da88237f1fe43 100644
+--- a/drivers/md/dm-era-target.c
++++ b/drivers/md/dm-era-target.c
+@@ -1396,7 +1396,7 @@ static void start_worker(struct era *era)
+ static void stop_worker(struct era *era)
+ {
+ atomic_set(&era->suspended, 1);
+- flush_workqueue(era->wq);
++ drain_workqueue(era->wq);
+ }
+
+ /*----------------------------------------------------------------
+@@ -1580,6 +1580,12 @@ static void era_postsuspend(struct dm_target *ti)
+ }
+
+ stop_worker(era);
++
++ r = metadata_commit(era->md);
++ if (r) {
++ DMERR("%s: metadata_commit failed", __func__);
++ /* FIXME: fail mode */
++ }
+ }
+
+ static int era_preresume(struct dm_target *ti)
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 2d70cdd26f89d..cab5c1cc9fe99 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3069,9 +3069,11 @@ re_arm:
+ if (!rtnl_trylock())
+ return;
+
+- if (should_notify_peers)
++ if (should_notify_peers) {
++ bond->send_peer_notif--;
+ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS,
+ bond->dev);
++ }
+ if (should_notify_rtnl) {
+ bond_slave_state_notify(bond);
+ bond_slave_link_notify(bond);
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index a93edd31011f5..9f45ecd9e8e5e 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -9444,11 +9444,10 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba)
+ struct e1000_hw *hw = &adapter->hw;
+ u32 dmac_thr;
+ u16 hwm;
++ u32 reg;
+
+ if (hw->mac.type > e1000_82580) {
+ if (adapter->flags & IGB_FLAG_DMAC) {
+- u32 reg;
+-
+ /* force threshold to 0. */
+ wr32(E1000_DMCTXTH, 0);
+
+@@ -9481,7 +9480,6 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba)
+ /* Disable BMC-to-OS Watchdog Enable */
+ if (hw->mac.type != e1000_i354)
+ reg &= ~E1000_DMACR_DC_BMC2OSW_EN;
+-
+ wr32(E1000_DMACR, reg);
+
+ /* no lower threshold to disable
+@@ -9498,12 +9496,12 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba)
+ */
+ wr32(E1000_DMCTXTH, (IGB_MIN_TXPBSIZE -
+ (IGB_TX_BUF_4096 + adapter->max_frame_size)) >> 6);
++ }
+
+- /* make low power state decision controlled
+- * by DMA coal
+- */
++ if (hw->mac.type >= e1000_i210 ||
++ (adapter->flags & IGB_FLAG_DMAC)) {
+ reg = rd32(E1000_PCIEMISC);
+- reg &= ~E1000_PCIEMISC_LX_DECISION;
++ reg |= E1000_PCIEMISC_LX_DECISION;
+ wr32(E1000_PCIEMISC, reg);
+ } /* endif adapter->dmac is not disabled */
+ } else if (hw->mac.type == e1000_82580) {
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index ea30da1c53f0f..a4e20a62bf8dc 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -1733,8 +1733,12 @@ int ocelot_init(struct ocelot *ocelot)
+ ocelot_write_rix(ocelot,
+ ANA_PGID_PGID_PGID(GENMASK(ocelot->num_phys_ports, 0)),
+ ANA_PGID_PGID, PGID_MC);
+- ocelot_write_rix(ocelot, 0, ANA_PGID_PGID, PGID_MCIPV4);
+- ocelot_write_rix(ocelot, 0, ANA_PGID_PGID, PGID_MCIPV6);
++ ocelot_write_rix(ocelot,
++ ANA_PGID_PGID_PGID(GENMASK(ocelot->num_phys_ports, 0)),
++ ANA_PGID_PGID, PGID_MCIPV4);
++ ocelot_write_rix(ocelot,
++ ANA_PGID_PGID_PGID(GENMASK(ocelot->num_phys_ports, 0)),
++ ANA_PGID_PGID, PGID_MCIPV6);
+
+ /* CPU port Injection/Extraction configuration */
+ ocelot_write_rix(ocelot, QSYS_SWITCH_PORT_MODE_INGRESS_DROP_MODE |
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 1a8fe5bacb19a..415b26c80fe78 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2315,7 +2315,6 @@ static const struct ethtool_ops virtnet_ethtool_ops = {
+ static void virtnet_freeze_down(struct virtio_device *vdev)
+ {
+ struct virtnet_info *vi = vdev->priv;
+- int i;
+
+ /* Make sure no work handler is accessing the device */
+ flush_work(&vi->config_work);
+@@ -2323,14 +2322,8 @@ static void virtnet_freeze_down(struct virtio_device *vdev)
+ netif_tx_lock_bh(vi->dev);
+ netif_device_detach(vi->dev);
+ netif_tx_unlock_bh(vi->dev);
+- cancel_delayed_work_sync(&vi->refill);
+-
+- if (netif_running(vi->dev)) {
+- for (i = 0; i < vi->max_queue_pairs; i++) {
+- napi_disable(&vi->rq[i].napi);
+- virtnet_napi_tx_disable(&vi->sq[i].napi);
+- }
+- }
++ if (netif_running(vi->dev))
++ virtnet_close(vi->dev);
+ }
+
+ static int init_vqs(struct virtnet_info *vi);
+@@ -2338,7 +2331,7 @@ static int init_vqs(struct virtnet_info *vi);
+ static int virtnet_restore_up(struct virtio_device *vdev)
+ {
+ struct virtnet_info *vi = vdev->priv;
+- int err, i;
++ int err;
+
+ err = init_vqs(vi);
+ if (err)
+@@ -2347,15 +2340,9 @@ static int virtnet_restore_up(struct virtio_device *vdev)
+ virtio_device_ready(vdev);
+
+ if (netif_running(vi->dev)) {
+- for (i = 0; i < vi->curr_queue_pairs; i++)
+- if (!try_fill_recv(vi, &vi->rq[i], GFP_KERNEL))
+- schedule_delayed_work(&vi->refill, 0);
+-
+- for (i = 0; i < vi->max_queue_pairs; i++) {
+- virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
+- virtnet_napi_tx_enable(vi, vi->sq[i].vq,
+- &vi->sq[i].napi);
+- }
++ err = virtnet_open(vi->dev);
++ if (err)
++ return err;
+ }
+
+ netif_tx_lock_bh(vi->dev);
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 2e9ea7f1e719b..9fecac72c358c 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1119,6 +1119,10 @@ int __init early_init_dt_scan_chosen(unsigned long node, const char *uname,
+
+ /* try to clear seed so it won't be found. */
+ fdt_nop_property(initial_boot_params, node, "rng-seed");
++
++ /* update CRC check value */
++ of_fdt_crc32 = crc32_be(~0, initial_boot_params,
++ fdt_totalsize(initial_boot_params));
+ }
+
+ /* break now */
+@@ -1223,6 +1227,8 @@ bool __init early_init_dt_verify(void *params)
+
+ /* Setup flat device-tree pointer */
+ initial_boot_params = params;
++ of_fdt_crc32 = crc32_be(~0, initial_boot_params,
++ fdt_totalsize(initial_boot_params));
+ return true;
+ }
+
+@@ -1248,8 +1254,6 @@ bool __init early_init_dt_scan(void *params)
+ return false;
+
+ early_init_dt_scan_nodes();
+- of_fdt_crc32 = crc32_be(~0, initial_boot_params,
+- fdt_totalsize(initial_boot_params));
+ return true;
+ }
+
+diff --git a/drivers/soc/bcm/brcmstb/pm/pm-arm.c b/drivers/soc/bcm/brcmstb/pm/pm-arm.c
+index 8ee06347447c0..f4ad45a1efabe 100644
+--- a/drivers/soc/bcm/brcmstb/pm/pm-arm.c
++++ b/drivers/soc/bcm/brcmstb/pm/pm-arm.c
+@@ -788,6 +788,7 @@ static int brcmstb_pm_probe(struct platform_device *pdev)
+ }
+
+ ret = brcmstb_init_sram(dn);
++ of_node_put(dn);
+ if (ret) {
+ pr_err("error setting up SRAM for PM\n");
+ return ret;
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 72e3989dffa60..dca627ccece57 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -4472,16 +4472,8 @@ static int con_font_get(struct vc_data *vc, struct console_font_op *op)
+
+ if (op->data && font.charcount > op->charcount)
+ rc = -ENOSPC;
+- if (!(op->flags & KD_FONT_FLAG_OLD)) {
+- if (font.width > op->width || font.height > op->height)
+- rc = -ENOSPC;
+- } else {
+- if (font.width != 8)
+- rc = -EIO;
+- else if ((op->height && font.height > op->height) ||
+- font.height > 32)
+- rc = -ENOSPC;
+- }
++ if (font.width > op->width || font.height > op->height)
++ rc = -ENOSPC;
+ if (rc)
+ goto out;
+
+@@ -4509,7 +4501,7 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op)
+ return -EINVAL;
+ if (op->charcount > 512)
+ return -EINVAL;
+- if (op->width <= 0 || op->width > 32 || op->height > 32)
++ if (op->width <= 0 || op->width > 32 || !op->height || op->height > 32)
+ return -EINVAL;
+ size = (op->width+7)/8 * 32 * op->charcount;
+ if (size > max_font_size)
+@@ -4519,31 +4511,6 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op)
+ if (IS_ERR(font.data))
+ return PTR_ERR(font.data);
+
+- if (!op->height) { /* Need to guess font height [compat] */
+- int h, i;
+- u8 *charmap = font.data;
+-
+- /*
+- * If from KDFONTOP ioctl, don't allow things which can be done
+- * in userland,so that we can get rid of this soon
+- */
+- if (!(op->flags & KD_FONT_FLAG_OLD)) {
+- kfree(font.data);
+- return -EINVAL;
+- }
+-
+- for (h = 32; h > 0; h--)
+- for (i = 0; i < op->charcount; i++)
+- if (charmap[32*i+h-1])
+- goto nonzero;
+-
+- kfree(font.data);
+- return -EINVAL;
+-
+- nonzero:
+- op->height = h;
+- }
+-
+ font.charcount = op->charcount;
+ font.width = op->width;
+ font.height = op->height;
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index 78ae1f0908fd5..86efb54935439 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -241,48 +241,6 @@ int vt_waitactive(int n)
+ #define GPLAST 0x3df
+ #define GPNUM (GPLAST - GPFIRST + 1)
+
+-
+-
+-static inline int
+-do_fontx_ioctl(struct vc_data *vc, int cmd, struct consolefontdesc __user *user_cfd, int perm, struct console_font_op *op)
+-{
+- struct consolefontdesc cfdarg;
+- int i;
+-
+- if (copy_from_user(&cfdarg, user_cfd, sizeof(struct consolefontdesc)))
+- return -EFAULT;
+-
+- switch (cmd) {
+- case PIO_FONTX:
+- if (!perm)
+- return -EPERM;
+- op->op = KD_FONT_OP_SET;
+- op->flags = KD_FONT_FLAG_OLD;
+- op->width = 8;
+- op->height = cfdarg.charheight;
+- op->charcount = cfdarg.charcount;
+- op->data = cfdarg.chardata;
+- return con_font_op(vc, op);
+-
+- case GIO_FONTX:
+- op->op = KD_FONT_OP_GET;
+- op->flags = KD_FONT_FLAG_OLD;
+- op->width = 8;
+- op->height = cfdarg.charheight;
+- op->charcount = cfdarg.charcount;
+- op->data = cfdarg.chardata;
+- i = con_font_op(vc, op);
+- if (i)
+- return i;
+- cfdarg.charheight = op->height;
+- cfdarg.charcount = op->charcount;
+- if (copy_to_user(user_cfd, &cfdarg, sizeof(struct consolefontdesc)))
+- return -EFAULT;
+- return 0;
+- }
+- return -EINVAL;
+-}
+-
+ static inline int
+ do_unimap_ioctl(int cmd, struct unimapdesc __user *user_ud, int perm, struct vc_data *vc)
+ {
+@@ -919,30 +877,6 @@ int vt_ioctl(struct tty_struct *tty,
+ break;
+ }
+
+- case PIO_FONT: {
+- if (!perm)
+- return -EPERM;
+- op.op = KD_FONT_OP_SET;
+- op.flags = KD_FONT_FLAG_OLD | KD_FONT_FLAG_DONT_RECALC; /* Compatibility */
+- op.width = 8;
+- op.height = 0;
+- op.charcount = 256;
+- op.data = up;
+- ret = con_font_op(vc, &op);
+- break;
+- }
+-
+- case GIO_FONT: {
+- op.op = KD_FONT_OP_GET;
+- op.flags = KD_FONT_FLAG_OLD;
+- op.width = 8;
+- op.height = 32;
+- op.charcount = 256;
+- op.data = up;
+- ret = con_font_op(vc, &op);
+- break;
+- }
+-
+ case PIO_CMAP:
+ if (!perm)
+ ret = -EPERM;
+@@ -954,36 +888,6 @@ int vt_ioctl(struct tty_struct *tty,
+ ret = con_get_cmap(up);
+ break;
+
+- case PIO_FONTX:
+- case GIO_FONTX:
+- ret = do_fontx_ioctl(vc, cmd, up, perm, &op);
+- break;
+-
+- case PIO_FONTRESET:
+- {
+- if (!perm)
+- return -EPERM;
+-
+-#ifdef BROKEN_GRAPHICS_PROGRAMS
+- /* With BROKEN_GRAPHICS_PROGRAMS defined, the default
+- font is not saved. */
+- ret = -ENOSYS;
+- break;
+-#else
+- {
+- op.op = KD_FONT_OP_SET_DEFAULT;
+- op.data = NULL;
+- ret = con_font_op(vc, &op);
+- if (ret)
+- break;
+- console_lock();
+- con_set_default_unimap(vc);
+- console_unlock();
+- break;
+- }
+-#endif
+- }
+-
+ case KDFONTOP: {
+ if (copy_from_user(&op, up, sizeof(op))) {
+ ret = -EFAULT;
+@@ -1097,54 +1001,6 @@ void vc_SAK(struct work_struct *work)
+
+ #ifdef CONFIG_COMPAT
+
+-struct compat_consolefontdesc {
+- unsigned short charcount; /* characters in font (256 or 512) */
+- unsigned short charheight; /* scan lines per character (1-32) */
+- compat_caddr_t chardata; /* font data in expanded form */
+-};
+-
+-static inline int
+-compat_fontx_ioctl(struct vc_data *vc, int cmd,
+- struct compat_consolefontdesc __user *user_cfd,
+- int perm, struct console_font_op *op)
+-{
+- struct compat_consolefontdesc cfdarg;
+- int i;
+-
+- if (copy_from_user(&cfdarg, user_cfd, sizeof(struct compat_consolefontdesc)))
+- return -EFAULT;
+-
+- switch (cmd) {
+- case PIO_FONTX:
+- if (!perm)
+- return -EPERM;
+- op->op = KD_FONT_OP_SET;
+- op->flags = KD_FONT_FLAG_OLD;
+- op->width = 8;
+- op->height = cfdarg.charheight;
+- op->charcount = cfdarg.charcount;
+- op->data = compat_ptr(cfdarg.chardata);
+- return con_font_op(vc, op);
+-
+- case GIO_FONTX:
+- op->op = KD_FONT_OP_GET;
+- op->flags = KD_FONT_FLAG_OLD;
+- op->width = 8;
+- op->height = cfdarg.charheight;
+- op->charcount = cfdarg.charcount;
+- op->data = compat_ptr(cfdarg.chardata);
+- i = con_font_op(vc, op);
+- if (i)
+- return i;
+- cfdarg.charheight = op->height;
+- cfdarg.charcount = op->charcount;
+- if (copy_to_user(user_cfd, &cfdarg, sizeof(struct compat_consolefontdesc)))
+- return -EFAULT;
+- return 0;
+- }
+- return -EINVAL;
+-}
+-
+ struct compat_console_font_op {
+ compat_uint_t op; /* operation code KD_FONT_OP_* */
+ compat_uint_t flags; /* KD_FONT_FLAG_* */
+@@ -1222,11 +1078,6 @@ long vt_compat_ioctl(struct tty_struct *tty,
+ /*
+ * these need special handlers for incompatible data structures
+ */
+- case PIO_FONTX:
+- case GIO_FONTX:
+- ret = compat_fontx_ioctl(vc, cmd, up, perm, &op);
+- break;
+-
+ case KDFONTOP:
+ ret = compat_kdfontop_ioctl(up, perm, &op, vc);
+ break;
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index 169ccfacfc755..3bda856ff2cab 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -920,6 +920,9 @@ isr_setup_status_complete(struct usb_ep *ep, struct usb_request *req)
+ struct ci_hdrc *ci = req->context;
+ unsigned long flags;
+
++ if (req->status < 0)
++ return;
++
+ if (ci->setaddr) {
+ hw_usb_set_address(ci, ci->address);
+ ci->setaddr = false;
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 1bb48e53449e6..e40370ed7d8a5 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -565,7 +565,7 @@ struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd)
+ * It will release and re-aquire the lock while calling ACPI
+ * method.
+ */
+-static void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd,
++void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd,
+ u16 index, bool on, unsigned long *flags)
+ {
+ struct xhci_hub *rhub;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index a9e72fee87a77..677587479d260 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -774,6 +774,8 @@ static void xhci_stop(struct usb_hcd *hcd)
+ void xhci_shutdown(struct usb_hcd *hcd)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ unsigned long flags;
++ int i;
+
+ if (xhci->quirks & XHCI_SPURIOUS_REBOOT)
+ usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev));
+@@ -789,12 +791,21 @@ void xhci_shutdown(struct usb_hcd *hcd)
+ del_timer_sync(&xhci->shared_hcd->rh_timer);
+ }
+
+- spin_lock_irq(&xhci->lock);
++ spin_lock_irqsave(&xhci->lock, flags);
+ xhci_halt(xhci);
++
++ /* Power off USB2 ports*/
++ for (i = 0; i < xhci->usb2_rhub.num_ports; i++)
++ xhci_set_port_power(xhci, xhci->main_hcd, i, false, &flags);
++
++ /* Power off USB3 ports*/
++ for (i = 0; i < xhci->usb3_rhub.num_ports; i++)
++ xhci_set_port_power(xhci, xhci->shared_hcd, i, false, &flags);
++
+ /* Workaround for spurious wakeups at shutdown with HSW */
+ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+ xhci_reset(xhci, XHCI_RESET_SHORT_USEC);
+- spin_unlock_irq(&xhci->lock);
++ spin_unlock_irqrestore(&xhci->lock, flags);
+
+ xhci_cleanup_msix(xhci);
+
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 3e6cb257fde5a..3b29dfc6f79e3 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -2145,6 +2145,8 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
+ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf);
+ int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1);
+ struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd);
++void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd, u16 index,
++ bool on, unsigned long *flags);
+
+ void xhci_hc_died(struct xhci_hcd *xhci);
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 4f99818ca70ed..d7ea64e8b0249 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -252,10 +252,12 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_EG95 0x0195
+ #define QUECTEL_PRODUCT_BG96 0x0296
+ #define QUECTEL_PRODUCT_EP06 0x0306
++#define QUECTEL_PRODUCT_EM05G 0x030a
+ #define QUECTEL_PRODUCT_EM12 0x0512
+ #define QUECTEL_PRODUCT_RM500Q 0x0800
+ #define QUECTEL_PRODUCT_EC200S_CN 0x6002
+ #define QUECTEL_PRODUCT_EC200T 0x6026
++#define QUECTEL_PRODUCT_RM500K 0x7001
+
+ #define CMOTECH_VENDOR_ID 0x16d8
+ #define CMOTECH_PRODUCT_6001 0x6001
+@@ -1134,6 +1136,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff),
++ .driver_info = RSVD(6) | ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
+@@ -1147,6 +1151,7 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) },
+
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+@@ -1279,6 +1284,7 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */
+ .driver_info = NCTRL(2) | RSVD(3) },
++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x1250, 0xff, 0x00, 0x00) }, /* Telit LE910Cx (rmnet) */
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
+diff --git a/drivers/xen/features.c b/drivers/xen/features.c
+index d7d34fdfc9938..f466f776604f2 100644
+--- a/drivers/xen/features.c
++++ b/drivers/xen/features.c
+@@ -28,6 +28,6 @@ void xen_setup_features(void)
+ if (HYPERVISOR_xen_version(XENVER_get_features, &fi) < 0)
+ break;
+ for (j = 0; j < 32; j++)
+- xen_features[i * 32 + j] = !!(fi.submap & 1<<j);
++ xen_features[i * 32 + j] = !!(fi.submap & 1U << j);
+ }
+ }
+diff --git a/drivers/xen/xlate_mmu.c b/drivers/xen/xlate_mmu.c
+index e7df65d32c918..136345b45b29d 100644
+--- a/drivers/xen/xlate_mmu.c
++++ b/drivers/xen/xlate_mmu.c
+@@ -262,4 +262,3 @@ int __init xen_xlate_map_ballooned_pages(xen_pfn_t **gfns, void **virt,
+
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(xen_xlate_map_ballooned_pages);
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index a12ae3ef8fb44..0983d7e859c85 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -473,7 +473,8 @@ int afs_getattr(const struct path *path, struct kstat *stat,
+
+ _enter("{ ino=%lu v=%u }", inode->i_ino, inode->i_generation);
+
+- if (!(query_flags & AT_STATX_DONT_SYNC) &&
++ if (vnode->volume &&
++ !(query_flags & AT_STATX_DONT_SYNC) &&
+ !test_bit(AFS_VNODE_CB_PROMISED, &vnode->flags)) {
+ key = afs_request_key(vnode->volume->cell);
+ if (IS_ERR(key))
+diff --git a/include/linux/kd.h b/include/linux/kd.h
+deleted file mode 100644
+index b130a18f860f0..0000000000000
+--- a/include/linux/kd.h
++++ /dev/null
+@@ -1,8 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _LINUX_KD_H
+-#define _LINUX_KD_H
+-
+-#include <uapi/linux/kd.h>
+-
+-#define KD_FONT_FLAG_OLD 0x80000000 /* Invoked via old interface [compat] */
+-#endif /* _LINUX_KD_H */
+diff --git a/include/linux/kexec.h b/include/linux/kexec.h
+index fe9f6f2dd811d..29bffbc6d73aa 100644
+--- a/include/linux/kexec.h
++++ b/include/linux/kexec.h
+@@ -174,14 +174,6 @@ int kexec_purgatory_get_set_symbol(struct kimage *image, const char *name,
+ bool get_value);
+ void *kexec_purgatory_get_symbol_addr(struct kimage *image, const char *name);
+
+-int __weak arch_kexec_apply_relocations_add(struct purgatory_info *pi,
+- Elf_Shdr *section,
+- const Elf_Shdr *relsec,
+- const Elf_Shdr *symtab);
+-int __weak arch_kexec_apply_relocations(struct purgatory_info *pi,
+- Elf_Shdr *section,
+- const Elf_Shdr *relsec,
+- const Elf_Shdr *symtab);
+
+ int __weak arch_kexec_walk_mem(struct kexec_buf *kbuf,
+ int (*func)(struct resource *, void *));
+@@ -206,6 +198,44 @@ extern int crash_exclude_mem_range(struct crash_mem *mem,
+ unsigned long long mend);
+ extern int crash_prepare_elf64_headers(struct crash_mem *mem, int kernel_map,
+ void **addr, unsigned long *sz);
++
++#ifndef arch_kexec_apply_relocations_add
++/*
++ * arch_kexec_apply_relocations_add - apply relocations of type RELA
++ * @pi: Purgatory to be relocated.
++ * @section: Section relocations applying to.
++ * @relsec: Section containing RELAs.
++ * @symtab: Corresponding symtab.
++ *
++ * Return: 0 on success, negative errno on error.
++ */
++static inline int
++arch_kexec_apply_relocations_add(struct purgatory_info *pi, Elf_Shdr *section,
++ const Elf_Shdr *relsec, const Elf_Shdr *symtab)
++{
++ pr_err("RELA relocation unsupported.\n");
++ return -ENOEXEC;
++}
++#endif
++
++#ifndef arch_kexec_apply_relocations
++/*
++ * arch_kexec_apply_relocations - apply relocations of type REL
++ * @pi: Purgatory to be relocated.
++ * @section: Section relocations applying to.
++ * @relsec: Section containing RELs.
++ * @symtab: Corresponding symtab.
++ *
++ * Return: 0 on success, negative errno on error.
++ */
++static inline int
++arch_kexec_apply_relocations(struct purgatory_info *pi, Elf_Shdr *section,
++ const Elf_Shdr *relsec, const Elf_Shdr *symtab)
++{
++ pr_err("REL relocation unsupported.\n");
++ return -ENOEXEC;
++}
++#endif
+ #endif /* CONFIG_KEXEC_FILE */
+
+ struct kimage {
+diff --git a/include/linux/ratelimit.h b/include/linux/ratelimit.h
+index 8ddf79e9207a9..1df12e8dde6f6 100644
+--- a/include/linux/ratelimit.h
++++ b/include/linux/ratelimit.h
+@@ -23,12 +23,16 @@ struct ratelimit_state {
+ unsigned long flags;
+ };
+
+-#define RATELIMIT_STATE_INIT(name, interval_init, burst_init) { \
+- .lock = __RAW_SPIN_LOCK_UNLOCKED(name.lock), \
+- .interval = interval_init, \
+- .burst = burst_init, \
++#define RATELIMIT_STATE_INIT_FLAGS(name, interval_init, burst_init, flags_init) { \
++ .lock = __RAW_SPIN_LOCK_UNLOCKED(name.lock), \
++ .interval = interval_init, \
++ .burst = burst_init, \
++ .flags = flags_init, \
+ }
+
++#define RATELIMIT_STATE_INIT(name, interval_init, burst_init) \
++ RATELIMIT_STATE_INIT_FLAGS(name, interval_init, burst_init, 0)
++
+ #define RATELIMIT_STATE_INIT_DISABLED \
+ RATELIMIT_STATE_INIT(ratelimit_state, 0, DEFAULT_RATELIMIT_BURST)
+
+diff --git a/include/trace/events/libata.h b/include/trace/events/libata.h
+index ab69434e2329e..72e785a903b65 100644
+--- a/include/trace/events/libata.h
++++ b/include/trace/events/libata.h
+@@ -249,6 +249,7 @@ DECLARE_EVENT_CLASS(ata_qc_complete_template,
+ __entry->hob_feature = qc->result_tf.hob_feature;
+ __entry->nsect = qc->result_tf.nsect;
+ __entry->hob_nsect = qc->result_tf.hob_nsect;
++ __entry->flags = qc->flags;
+ ),
+
+ TP_printk("ata_port=%u ata_dev=%u tag=%d flags=%s status=%s " \
+diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
+index 8b1360772fc58..b1e2ce2f9c2de 100644
+--- a/kernel/dma/swiotlb.c
++++ b/kernel/dma/swiotlb.c
+@@ -594,7 +594,8 @@ found:
+ * unconditional bounce may prevent leaking swiotlb content (i.e.
+ * kernel memory) to user-space.
+ */
+- swiotlb_bounce(orig_addr, tlb_addr, size, DMA_TO_DEVICE);
++ if (orig_addr)
++ swiotlb_bounce(orig_addr, tlb_addr, size, DMA_TO_DEVICE);
+ return tlb_addr;
+ }
+
+diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
+index 89d41c0a10f1e..ab1934a2b2e6e 100644
+--- a/kernel/kexec_file.c
++++ b/kernel/kexec_file.c
+@@ -110,40 +110,6 @@ int __weak arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
+ }
+ #endif
+
+-/*
+- * arch_kexec_apply_relocations_add - apply relocations of type RELA
+- * @pi: Purgatory to be relocated.
+- * @section: Section relocations applying to.
+- * @relsec: Section containing RELAs.
+- * @symtab: Corresponding symtab.
+- *
+- * Return: 0 on success, negative errno on error.
+- */
+-int __weak
+-arch_kexec_apply_relocations_add(struct purgatory_info *pi, Elf_Shdr *section,
+- const Elf_Shdr *relsec, const Elf_Shdr *symtab)
+-{
+- pr_err("RELA relocation unsupported.\n");
+- return -ENOEXEC;
+-}
+-
+-/*
+- * arch_kexec_apply_relocations - apply relocations of type REL
+- * @pi: Purgatory to be relocated.
+- * @section: Section relocations applying to.
+- * @relsec: Section containing RELs.
+- * @symtab: Corresponding symtab.
+- *
+- * Return: 0 on success, negative errno on error.
+- */
+-int __weak
+-arch_kexec_apply_relocations(struct purgatory_info *pi, Elf_Shdr *section,
+- const Elf_Shdr *relsec, const Elf_Shdr *symtab)
+-{
+- pr_err("REL relocation unsupported.\n");
+- return -ENOEXEC;
+-}
+-
+ /*
+ * Free up memory used by kernel, initrd, and command line. This is temporary
+ * memory allocation which is not needed any more after these buffers have
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index cf60d0e079657..c72432ce9bf50 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -574,7 +574,6 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
+ int tunnel_hlen;
+ int version;
+ int nhoff;
+- int thoff;
+
+ tun_info = skb_tunnel_info(skb);
+ if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) ||
+@@ -609,10 +608,16 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
+ (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff))
+ truncate = true;
+
+- thoff = skb_transport_header(skb) - skb_mac_header(skb);
+- if (skb->protocol == htons(ETH_P_IPV6) &&
+- (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff))
+- truncate = true;
++ if (skb->protocol == htons(ETH_P_IPV6)) {
++ int thoff;
++
++ if (skb_transport_header_was_set(skb))
++ thoff = skb_transport_header(skb) - skb_mac_header(skb);
++ else
++ thoff = nhoff + sizeof(struct ipv6hdr);
++ if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff)
++ truncate = true;
++ }
+
+ if (version == 1) {
+ erspan_build_header(skb, ntohl(tunnel_id_to_key32(key->tun_id)),
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 4fd6c0929b144..e617a98f4df61 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -946,7 +946,6 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ __be16 proto;
+ __u32 mtu;
+ int nhoff;
+- int thoff;
+
+ if (!pskb_inet_may_pull(skb))
+ goto tx_err;
+@@ -967,10 +966,16 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff))
+ truncate = true;
+
+- thoff = skb_transport_header(skb) - skb_mac_header(skb);
+- if (skb->protocol == htons(ETH_P_IPV6) &&
+- (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff))
+- truncate = true;
++ if (skb->protocol == htons(ETH_P_IPV6)) {
++ int thoff;
++
++ if (skb_transport_header_was_set(skb))
++ thoff = skb_transport_header(skb) - skb_mac_header(skb);
++ else
++ thoff = nhoff + sizeof(struct ipv6hdr);
++ if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff)
++ truncate = true;
++ }
+
+ if (skb_cow_head(skb, dev->needed_headroom ?: t->hlen))
+ goto tx_err;
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 7c1b1eff84f4c..cad2586c34734 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -970,8 +970,6 @@ static void qdisc_destroy(struct Qdisc *qdisc)
+ const struct Qdisc_ops *ops;
+ struct sk_buff *skb, *tmp;
+
+- if (!qdisc)
+- return;
+ ops = qdisc->ops;
+
+ #ifdef CONFIG_NET_SCHED
+@@ -1003,6 +1001,9 @@ static void qdisc_destroy(struct Qdisc *qdisc)
+
+ void qdisc_put(struct Qdisc *qdisc)
+ {
++ if (!qdisc)
++ return;
++
+ if (qdisc->flags & TCQ_F_BUILTIN ||
+ !refcount_dec_and_test(&qdisc->refcnt))
+ return;
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index ad400f4f9a2d6..31793af1a77bd 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -1120,9 +1120,9 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
+ struct tc_netem_rate rate;
+ struct tc_netem_slot slot;
+
+- qopt.latency = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->latency),
++ qopt.latency = min_t(psched_time_t, PSCHED_NS2TICKS(q->latency),
+ UINT_MAX);
+- qopt.jitter = min_t(psched_tdiff_t, PSCHED_NS2TICKS(q->jitter),
++ qopt.jitter = min_t(psched_time_t, PSCHED_NS2TICKS(q->jitter),
+ UINT_MAX);
+ qopt.limit = q->limit;
+ qopt.loss = q->loss;
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index e294b6cff9fde..8c2847ef4e422 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1066,7 +1066,7 @@ static const struct sectioncheck sectioncheck[] = {
+ },
+ /* Do not export init/exit functions or data */
+ {
+- .fromsec = { "__ksymtab*", NULL },
++ .fromsec = { "___ksymtab*", NULL },
+ .bad_tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
+ .mismatch = EXPORT_TO_INIT_EXIT,
+ .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 629857f5539ce..9b7f474ee6ca1 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1061,11 +1061,11 @@ static int patch_conexant_auto(struct hda_codec *codec)
+ if (err < 0)
+ goto error;
+
+- err = snd_hda_gen_parse_auto_config(codec, &spec->gen.autocfg);
++ err = cx_auto_parse_beep(codec);
+ if (err < 0)
+ goto error;
+
+- err = cx_auto_parse_beep(codec);
++ err = snd_hda_gen_parse_auto_config(codec, &spec->gen.autocfg);
+ if (err < 0)
+ goto error;
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index ed0b8ec50d714..2915bf0857df6 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2567,6 +2567,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67f1, "Clevo PC70H[PRS]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x67f5, "Clevo PD70PN[NRT]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x7715, "Clevo X170KM-G", ALC1220_FIXUP_CLEVO_PB51ED),
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index 0046ea78abd25..937155b1fae0f 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -533,11 +533,11 @@ static int via_parse_auto_config(struct hda_codec *codec)
+ if (err < 0)
+ return err;
+
+- err = snd_hda_gen_parse_auto_config(codec, &spec->gen.autocfg);
++ err = auto_parse_beep(codec);
+ if (err < 0)
+ return err;
+
+- err = auto_parse_beep(codec);
++ err = snd_hda_gen_parse_auto_config(codec, &spec->gen.autocfg);
+ if (err < 0)
+ return err;
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-07-07 16:18 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-07-07 16:18 UTC (permalink / raw
To: gentoo-commits
commit: 22edce8a3bff3be008dd11b73522dd4109bfe055
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jul 7 16:18:40 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jul 7 16:18:40 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=22edce8a
Linux patch 4.19.251
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1250_linux-4.19.251.patch | 1676 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1680 insertions(+)
diff --git a/0000_README b/0000_README
index 295b34e0..1fd6a3cd 100644
--- a/0000_README
+++ b/0000_README
@@ -1039,6 +1039,10 @@ Patch: 1249_linux-4.19.250.patch
From: https://www.kernel.org
Desc: Linux 4.19.250
+Patch: 1250_linux-4.19.251.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.251
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1250_linux-4.19.251.patch b/1250_linux-4.19.251.patch
new file mode 100644
index 00000000..896b550f
--- /dev/null
+++ b/1250_linux-4.19.251.patch
@@ -0,0 +1,1676 @@
+diff --git a/Makefile b/Makefile
+index f78a5a3604c31..35717e4c2b870 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 250
++SUBLEVEL = 251
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/xen/p2m.c b/arch/arm/xen/p2m.c
+index 8a8a388549e7a..e04b5044f5973 100644
+--- a/arch/arm/xen/p2m.c
++++ b/arch/arm/xen/p2m.c
+@@ -61,11 +61,12 @@ out:
+
+ unsigned long __pfn_to_mfn(unsigned long pfn)
+ {
+- struct rb_node *n = phys_to_mach.rb_node;
++ struct rb_node *n;
+ struct xen_p2m_entry *entry;
+ unsigned long irqflags;
+
+ read_lock_irqsave(&p2m_lock, irqflags);
++ n = phys_to_mach.rb_node;
+ while (n) {
+ entry = rb_entry(n, struct xen_p2m_entry, rbnode_phys);
+ if (entry->pfn <= pfn &&
+@@ -151,10 +152,11 @@ bool __set_phys_to_machine_multi(unsigned long pfn,
+ int rc;
+ unsigned long irqflags;
+ struct xen_p2m_entry *p2m_entry;
+- struct rb_node *n = phys_to_mach.rb_node;
++ struct rb_node *n;
+
+ if (mfn == INVALID_P2M_ENTRY) {
+ write_lock_irqsave(&p2m_lock, irqflags);
++ n = phys_to_mach.rb_node;
+ while (n) {
+ p2m_entry = rb_entry(n, struct xen_p2m_entry, rbnode_phys);
+ if (p2m_entry->pfn <= pfn &&
+diff --git a/arch/s390/crypto/arch_random.c b/arch/s390/crypto/arch_random.c
+index 4cbb4b6d85a83..1f2d40993c4d2 100644
+--- a/arch/s390/crypto/arch_random.c
++++ b/arch/s390/crypto/arch_random.c
+@@ -2,126 +2,17 @@
+ /*
+ * s390 arch random implementation.
+ *
+- * Copyright IBM Corp. 2017, 2018
++ * Copyright IBM Corp. 2017, 2020
+ * Author(s): Harald Freudenberger
+- *
+- * The s390_arch_random_generate() function may be called from random.c
+- * in interrupt context. So this implementation does the best to be very
+- * fast. There is a buffer of random data which is asynchronously checked
+- * and filled by a workqueue thread.
+- * If there are enough bytes in the buffer the s390_arch_random_generate()
+- * just delivers these bytes. Otherwise false is returned until the
+- * worker thread refills the buffer.
+- * The worker fills the rng buffer by pulling fresh entropy from the
+- * high quality (but slow) true hardware random generator. This entropy
+- * is then spread over the buffer with an pseudo random generator PRNG.
+- * As the arch_get_random_seed_long() fetches 8 bytes and the calling
+- * function add_interrupt_randomness() counts this as 1 bit entropy the
+- * distribution needs to make sure there is in fact 1 bit entropy contained
+- * in 8 bytes of the buffer. The current values pull 32 byte entropy
+- * and scatter this into a 2048 byte buffer. So 8 byte in the buffer
+- * will contain 1 bit of entropy.
+- * The worker thread is rescheduled based on the charge level of the
+- * buffer but at least with 500 ms delay to avoid too much CPU consumption.
+- * So the max. amount of rng data delivered via arch_get_random_seed is
+- * limited to 4k bytes per second.
+ */
+
+ #include <linux/kernel.h>
+ #include <linux/atomic.h>
+ #include <linux/random.h>
+-#include <linux/slab.h>
+ #include <linux/static_key.h>
+-#include <linux/workqueue.h>
+ #include <asm/cpacf.h>
+
+ DEFINE_STATIC_KEY_FALSE(s390_arch_random_available);
+
+ atomic64_t s390_arch_random_counter = ATOMIC64_INIT(0);
+ EXPORT_SYMBOL(s390_arch_random_counter);
+-
+-#define ARCH_REFILL_TICKS (HZ/2)
+-#define ARCH_PRNG_SEED_SIZE 32
+-#define ARCH_RNG_BUF_SIZE 2048
+-
+-static DEFINE_SPINLOCK(arch_rng_lock);
+-static u8 *arch_rng_buf;
+-static unsigned int arch_rng_buf_idx;
+-
+-static void arch_rng_refill_buffer(struct work_struct *);
+-static DECLARE_DELAYED_WORK(arch_rng_work, arch_rng_refill_buffer);
+-
+-bool s390_arch_random_generate(u8 *buf, unsigned int nbytes)
+-{
+- /* max hunk is ARCH_RNG_BUF_SIZE */
+- if (nbytes > ARCH_RNG_BUF_SIZE)
+- return false;
+-
+- /* lock rng buffer */
+- if (!spin_trylock(&arch_rng_lock))
+- return false;
+-
+- /* try to resolve the requested amount of bytes from the buffer */
+- arch_rng_buf_idx -= nbytes;
+- if (arch_rng_buf_idx < ARCH_RNG_BUF_SIZE) {
+- memcpy(buf, arch_rng_buf + arch_rng_buf_idx, nbytes);
+- atomic64_add(nbytes, &s390_arch_random_counter);
+- spin_unlock(&arch_rng_lock);
+- return true;
+- }
+-
+- /* not enough bytes in rng buffer, refill is done asynchronously */
+- spin_unlock(&arch_rng_lock);
+-
+- return false;
+-}
+-EXPORT_SYMBOL(s390_arch_random_generate);
+-
+-static void arch_rng_refill_buffer(struct work_struct *unused)
+-{
+- unsigned int delay = ARCH_REFILL_TICKS;
+-
+- spin_lock(&arch_rng_lock);
+- if (arch_rng_buf_idx > ARCH_RNG_BUF_SIZE) {
+- /* buffer is exhausted and needs refill */
+- u8 seed[ARCH_PRNG_SEED_SIZE];
+- u8 prng_wa[240];
+- /* fetch ARCH_PRNG_SEED_SIZE bytes of entropy */
+- cpacf_trng(NULL, 0, seed, sizeof(seed));
+- /* blow this entropy up to ARCH_RNG_BUF_SIZE with PRNG */
+- memset(prng_wa, 0, sizeof(prng_wa));
+- cpacf_prno(CPACF_PRNO_SHA512_DRNG_SEED,
+- &prng_wa, NULL, 0, seed, sizeof(seed));
+- cpacf_prno(CPACF_PRNO_SHA512_DRNG_GEN,
+- &prng_wa, arch_rng_buf, ARCH_RNG_BUF_SIZE, NULL, 0);
+- arch_rng_buf_idx = ARCH_RNG_BUF_SIZE;
+- }
+- delay += (ARCH_REFILL_TICKS * arch_rng_buf_idx) / ARCH_RNG_BUF_SIZE;
+- spin_unlock(&arch_rng_lock);
+-
+- /* kick next check */
+- queue_delayed_work(system_long_wq, &arch_rng_work, delay);
+-}
+-
+-static int __init s390_arch_random_init(void)
+-{
+- /* all the needed PRNO subfunctions available ? */
+- if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG) &&
+- cpacf_query_func(CPACF_PRNO, CPACF_PRNO_SHA512_DRNG_GEN)) {
+-
+- /* alloc arch random working buffer */
+- arch_rng_buf = kmalloc(ARCH_RNG_BUF_SIZE, GFP_KERNEL);
+- if (!arch_rng_buf)
+- return -ENOMEM;
+-
+- /* kick worker queue job to fill the random buffer */
+- queue_delayed_work(system_long_wq,
+- &arch_rng_work, ARCH_REFILL_TICKS);
+-
+- /* enable arch random to the outside world */
+- static_branch_enable(&s390_arch_random_available);
+- }
+-
+- return 0;
+-}
+-arch_initcall(s390_arch_random_init);
+diff --git a/arch/s390/include/asm/archrandom.h b/arch/s390/include/asm/archrandom.h
+index 9a6835137a164..2c6e1c6ecbe78 100644
+--- a/arch/s390/include/asm/archrandom.h
++++ b/arch/s390/include/asm/archrandom.h
+@@ -2,7 +2,7 @@
+ /*
+ * Kernel interface for the s390 arch_random_* functions
+ *
+- * Copyright IBM Corp. 2017
++ * Copyright IBM Corp. 2017, 2020
+ *
+ * Author: Harald Freudenberger <freude@de.ibm.com>
+ *
+@@ -15,34 +15,37 @@
+
+ #include <linux/static_key.h>
+ #include <linux/atomic.h>
++#include <asm/cpacf.h>
+
+ DECLARE_STATIC_KEY_FALSE(s390_arch_random_available);
+ extern atomic64_t s390_arch_random_counter;
+
+-bool s390_arch_random_generate(u8 *buf, unsigned int nbytes);
+-
+-static inline bool arch_get_random_long(unsigned long *v)
++static inline bool __must_check arch_get_random_long(unsigned long *v)
+ {
+ return false;
+ }
+
+-static inline bool arch_get_random_int(unsigned int *v)
++static inline bool __must_check arch_get_random_int(unsigned int *v)
+ {
+ return false;
+ }
+
+-static inline bool arch_get_random_seed_long(unsigned long *v)
++static inline bool __must_check arch_get_random_seed_long(unsigned long *v)
+ {
+ if (static_branch_likely(&s390_arch_random_available)) {
+- return s390_arch_random_generate((u8 *)v, sizeof(*v));
++ cpacf_trng(NULL, 0, (u8 *)v, sizeof(*v));
++ atomic64_add(sizeof(*v), &s390_arch_random_counter);
++ return true;
+ }
+ return false;
+ }
+
+-static inline bool arch_get_random_seed_int(unsigned int *v)
++static inline bool __must_check arch_get_random_seed_int(unsigned int *v)
+ {
+ if (static_branch_likely(&s390_arch_random_available)) {
+- return s390_arch_random_generate((u8 *)v, sizeof(*v));
++ cpacf_trng(NULL, 0, (u8 *)v, sizeof(*v));
++ atomic64_add(sizeof(*v), &s390_arch_random_counter);
++ return true;
+ }
+ return false;
+ }
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 098794fc5dc81..bfd6c01a68f07 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -851,6 +851,11 @@ static void __init setup_randomness(void)
+ if (stsi(vmms, 3, 2, 2) == 0 && vmms->count)
+ add_device_randomness(&vmms->vm, sizeof(vmms->vm[0]) * vmms->count);
+ memblock_free((unsigned long) vmms, PAGE_SIZE);
++
++#ifdef CONFIG_ARCH_RANDOM
++ if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG))
++ static_branch_enable(&s390_arch_random_available);
++#endif
+ }
+
+ /*
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 482d2e37e20c7..7ee618ab1567b 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -151,6 +151,10 @@ static unsigned int xen_blkif_max_ring_order;
+ module_param_named(max_ring_page_order, xen_blkif_max_ring_order, int, 0444);
+ MODULE_PARM_DESC(max_ring_page_order, "Maximum order of pages to be used for the shared ring");
+
++static bool __read_mostly xen_blkif_trusted = true;
++module_param_named(trusted, xen_blkif_trusted, bool, 0644);
++MODULE_PARM_DESC(trusted, "Is the backend trusted");
++
+ #define BLK_RING_SIZE(info) \
+ __CONST_RING_SIZE(blkif, XEN_PAGE_SIZE * (info)->nr_ring_pages)
+
+@@ -211,6 +215,7 @@ struct blkfront_info
+ unsigned int feature_discard:1;
+ unsigned int feature_secdiscard:1;
+ unsigned int feature_persistent:1;
++ unsigned int bounce:1;
+ unsigned int discard_granularity;
+ unsigned int discard_alignment;
+ /* Number of 4KB segments handled */
+@@ -300,8 +305,8 @@ static int fill_grant_buffer(struct blkfront_ring_info *rinfo, int num)
+ if (!gnt_list_entry)
+ goto out_of_memory;
+
+- if (info->feature_persistent) {
+- granted_page = alloc_page(GFP_NOIO);
++ if (info->bounce) {
++ granted_page = alloc_page(GFP_NOIO | __GFP_ZERO);
+ if (!granted_page) {
+ kfree(gnt_list_entry);
+ goto out_of_memory;
+@@ -320,7 +325,7 @@ out_of_memory:
+ list_for_each_entry_safe(gnt_list_entry, n,
+ &rinfo->grants, node) {
+ list_del(&gnt_list_entry->node);
+- if (info->feature_persistent)
++ if (info->bounce)
+ __free_page(gnt_list_entry->page);
+ kfree(gnt_list_entry);
+ i--;
+@@ -366,7 +371,7 @@ static struct grant *get_grant(grant_ref_t *gref_head,
+ /* Assign a gref to this page */
+ gnt_list_entry->gref = gnttab_claim_grant_reference(gref_head);
+ BUG_ON(gnt_list_entry->gref == -ENOSPC);
+- if (info->feature_persistent)
++ if (info->bounce)
+ grant_foreign_access(gnt_list_entry, info);
+ else {
+ /* Grant access to the GFN passed by the caller */
+@@ -390,7 +395,7 @@ static struct grant *get_indirect_grant(grant_ref_t *gref_head,
+ /* Assign a gref to this page */
+ gnt_list_entry->gref = gnttab_claim_grant_reference(gref_head);
+ BUG_ON(gnt_list_entry->gref == -ENOSPC);
+- if (!info->feature_persistent) {
++ if (!info->bounce) {
+ struct page *indirect_page;
+
+ /* Fetch a pre-allocated page to use for indirect grefs */
+@@ -705,7 +710,7 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri
+ .grant_idx = 0,
+ .segments = NULL,
+ .rinfo = rinfo,
+- .need_copy = rq_data_dir(req) && info->feature_persistent,
++ .need_copy = rq_data_dir(req) && info->bounce,
+ };
+
+ /*
+@@ -1026,11 +1031,12 @@ static void xlvbd_flush(struct blkfront_info *info)
+ {
+ blk_queue_write_cache(info->rq, info->feature_flush ? true : false,
+ info->feature_fua ? true : false);
+- pr_info("blkfront: %s: %s %s %s %s %s\n",
++ pr_info("blkfront: %s: %s %s %s %s %s %s %s\n",
+ info->gd->disk_name, flush_info(info),
+ "persistent grants:", info->feature_persistent ?
+ "enabled;" : "disabled;", "indirect descriptors:",
+- info->max_indirect_segments ? "enabled;" : "disabled;");
++ info->max_indirect_segments ? "enabled;" : "disabled;",
++ "bounce buffer:", info->bounce ? "enabled" : "disabled;");
+ }
+
+ static int xen_translate_vdev(int vdevice, int *minor, unsigned int *offset)
+@@ -1265,7 +1271,7 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo)
+ if (!list_empty(&rinfo->indirect_pages)) {
+ struct page *indirect_page, *n;
+
+- BUG_ON(info->feature_persistent);
++ BUG_ON(info->bounce);
+ list_for_each_entry_safe(indirect_page, n, &rinfo->indirect_pages, lru) {
+ list_del(&indirect_page->lru);
+ __free_page(indirect_page);
+@@ -1282,7 +1288,7 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo)
+ 0, 0UL);
+ rinfo->persistent_gnts_c--;
+ }
+- if (info->feature_persistent)
++ if (info->bounce)
+ __free_page(persistent_gnt->page);
+ kfree(persistent_gnt);
+ }
+@@ -1303,7 +1309,7 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo)
+ for (j = 0; j < segs; j++) {
+ persistent_gnt = rinfo->shadow[i].grants_used[j];
+ gnttab_end_foreign_access(persistent_gnt->gref, 0, 0UL);
+- if (info->feature_persistent)
++ if (info->bounce)
+ __free_page(persistent_gnt->page);
+ kfree(persistent_gnt);
+ }
+@@ -1493,7 +1499,7 @@ static int blkif_completion(unsigned long *id,
+ data.s = s;
+ num_sg = s->num_sg;
+
+- if (bret->operation == BLKIF_OP_READ && info->feature_persistent) {
++ if (bret->operation == BLKIF_OP_READ && info->bounce) {
+ for_each_sg(s->sg, sg, num_sg, i) {
+ BUG_ON(sg->offset + sg->length > PAGE_SIZE);
+
+@@ -1552,7 +1558,7 @@ static int blkif_completion(unsigned long *id,
+ * Add the used indirect page back to the list of
+ * available pages for indirect grefs.
+ */
+- if (!info->feature_persistent) {
++ if (!info->bounce) {
+ indirect_page = s->indirect_grants[i]->page;
+ list_add(&indirect_page->lru, &rinfo->indirect_pages);
+ }
+@@ -1744,7 +1750,7 @@ static int setup_blkring(struct xenbus_device *dev,
+ for (i = 0; i < info->nr_ring_pages; i++)
+ rinfo->ring_ref[i] = GRANT_INVALID_REF;
+
+- sring = alloc_pages_exact(ring_size, GFP_NOIO);
++ sring = alloc_pages_exact(ring_size, GFP_NOIO | __GFP_ZERO);
+ if (!sring) {
+ xenbus_dev_fatal(dev, -ENOMEM, "allocating shared ring");
+ return -ENOMEM;
+@@ -1847,6 +1853,10 @@ static int talk_to_blkback(struct xenbus_device *dev,
+ if (!info)
+ return -ENODEV;
+
++ /* Check if backend is trusted. */
++ info->bounce = !xen_blkif_trusted ||
++ !xenbus_read_unsigned(dev->nodename, "trusted", 1);
++
+ max_page_order = xenbus_read_unsigned(info->xbdev->otherend,
+ "max-ring-page-order", 0);
+ ring_page_order = min(xen_blkif_max_ring_order, max_page_order);
+@@ -2273,17 +2283,18 @@ static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo)
+ if (err)
+ goto out_of_memory;
+
+- if (!info->feature_persistent && info->max_indirect_segments) {
++ if (!info->bounce && info->max_indirect_segments) {
+ /*
+- * We are using indirect descriptors but not persistent
+- * grants, we need to allocate a set of pages that can be
++ * We are using indirect descriptors but don't have a bounce
++ * buffer, we need to allocate a set of pages that can be
+ * used for mapping indirect grefs
+ */
+ int num = INDIRECT_GREFS(grants) * BLK_RING_SIZE(info);
+
+ BUG_ON(!list_empty(&rinfo->indirect_pages));
+ for (i = 0; i < num; i++) {
+- struct page *indirect_page = alloc_page(GFP_KERNEL);
++ struct page *indirect_page = alloc_page(GFP_KERNEL |
++ __GFP_ZERO);
+ if (!indirect_page)
+ goto out_of_memory;
+ list_add(&indirect_page->lru, &rinfo->indirect_pages);
+@@ -2375,6 +2386,8 @@ static void blkfront_gather_backend_features(struct blkfront_info *info)
+ info->feature_persistent =
+ !!xenbus_read_unsigned(info->xbdev->otherend,
+ "feature-persistent", 0);
++ if (info->feature_persistent)
++ info->bounce = true;
+
+ indirect_segments = xenbus_read_unsigned(info->xbdev->otherend,
+ "feature-max-indirect-segments", 0);
+@@ -2750,6 +2763,13 @@ static void blkfront_delay_work(struct work_struct *work)
+ struct blkfront_info *info;
+ bool need_schedule_work = false;
+
++ /*
++ * Note that when using bounce buffers but not persistent grants
++ * there's no need to run blkfront_delay_work because grants are
++ * revoked in blkif_completion or else an error is reported and the
++ * connection is closed.
++ */
++
+ mutex_lock(&blkfront_mutex);
+
+ list_for_each_entry(info, &info_list, info_list) {
+diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c
+index 1f643782ce047..c9cfc958e853b 100644
+--- a/drivers/hwmon/ibmaem.c
++++ b/drivers/hwmon/ibmaem.c
+@@ -563,7 +563,7 @@ static int aem_init_aem1_inst(struct aem_ipmi_data *probe, u8 module_handle)
+
+ res = platform_device_add(data->pdev);
+ if (res)
+- goto ipmi_err;
++ goto dev_add_err;
+
+ platform_set_drvdata(data->pdev, data);
+
+@@ -611,7 +611,9 @@ hwmon_reg_err:
+ ipmi_destroy_user(data->ipmi.user);
+ ipmi_err:
+ platform_set_drvdata(data->pdev, NULL);
+- platform_device_unregister(data->pdev);
++ platform_device_del(data->pdev);
++dev_add_err:
++ platform_device_put(data->pdev);
+ dev_err:
+ ida_simple_remove(&aem_ida, data->id);
+ id_err:
+@@ -703,7 +705,7 @@ static int aem_init_aem2_inst(struct aem_ipmi_data *probe,
+
+ res = platform_device_add(data->pdev);
+ if (res)
+- goto ipmi_err;
++ goto dev_add_err;
+
+ platform_set_drvdata(data->pdev, data);
+
+@@ -751,7 +753,9 @@ hwmon_reg_err:
+ ipmi_destroy_user(data->ipmi.user);
+ ipmi_err:
+ platform_set_drvdata(data->pdev, NULL);
+- platform_device_unregister(data->pdev);
++ platform_device_del(data->pdev);
++dev_add_err:
++ platform_device_put(data->pdev);
+ dev_err:
+ ida_simple_remove(&aem_ida, data->id);
+ id_err:
+diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
+index cca12100c5833..055033aeaef25 100644
+--- a/drivers/infiniband/hw/qedr/qedr.h
++++ b/drivers/infiniband/hw/qedr/qedr.h
+@@ -407,6 +407,7 @@ struct qedr_qp {
+ u32 sq_psn;
+ u32 qkey;
+ u32 dest_qp_num;
++ u8 timeout;
+
+ /* Relevant to qps created from kernel space only (ULPs) */
+ u8 prev_wqe_size;
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 7dd6ca11f7062..eb5bcf627b5ed 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -2376,6 +2376,8 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ 1 << max_t(int, attr->timeout - 8, 0);
+ else
+ qp_params.ack_timeout = 0;
++
++ qp->timeout = attr->timeout;
+ }
+
+ if (attr_mask & IB_QP_RETRY_CNT) {
+@@ -2535,7 +2537,7 @@ int qedr_query_qp(struct ib_qp *ibqp,
+ rdma_ah_set_dgid_raw(&qp_attr->ah_attr, ¶ms.dgid.bytes[0]);
+ rdma_ah_set_port_num(&qp_attr->ah_attr, 1);
+ rdma_ah_set_sl(&qp_attr->ah_attr, 0);
+- qp_attr->timeout = params.timeout;
++ qp_attr->timeout = qp->timeout;
+ qp_attr->rnr_retry = params.rnr_retry;
+ qp_attr->retry_cnt = params.retry_cnt;
+ qp_attr->min_rnr_timer = params.min_rnr_nak_timer;
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index b163329172208..dd56536ab7288 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -998,12 +998,13 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size)
+ static int validate_raid_redundancy(struct raid_set *rs)
+ {
+ unsigned int i, rebuild_cnt = 0;
+- unsigned int rebuilds_per_group = 0, copies;
++ unsigned int rebuilds_per_group = 0, copies, raid_disks;
+ unsigned int group_size, last_group_start;
+
+- for (i = 0; i < rs->md.raid_disks; i++)
+- if (!test_bit(In_sync, &rs->dev[i].rdev.flags) ||
+- !rs->dev[i].rdev.sb_page)
++ for (i = 0; i < rs->raid_disks; i++)
++ if (!test_bit(FirstUse, &rs->dev[i].rdev.flags) &&
++ ((!test_bit(In_sync, &rs->dev[i].rdev.flags) ||
++ !rs->dev[i].rdev.sb_page)))
+ rebuild_cnt++;
+
+ switch (rs->md.level) {
+@@ -1043,8 +1044,9 @@ static int validate_raid_redundancy(struct raid_set *rs)
+ * A A B B C
+ * C D D E E
+ */
++ raid_disks = min(rs->raid_disks, rs->md.raid_disks);
+ if (__is_raid10_near(rs->md.new_layout)) {
+- for (i = 0; i < rs->md.raid_disks; i++) {
++ for (i = 0; i < raid_disks; i++) {
+ if (!(i % copies))
+ rebuilds_per_group = 0;
+ if ((!rs->dev[i].rdev.sb_page ||
+@@ -1067,10 +1069,10 @@ static int validate_raid_redundancy(struct raid_set *rs)
+ * results in the need to treat the last (potentially larger)
+ * set differently.
+ */
+- group_size = (rs->md.raid_disks / copies);
+- last_group_start = (rs->md.raid_disks / group_size) - 1;
++ group_size = (raid_disks / copies);
++ last_group_start = (raid_disks / group_size) - 1;
+ last_group_start *= group_size;
+- for (i = 0; i < rs->md.raid_disks; i++) {
++ for (i = 0; i < raid_disks; i++) {
+ if (!(i % copies) && !(i > last_group_start))
+ rebuilds_per_group = 0;
+ if ((!rs->dev[i].rdev.sb_page ||
+@@ -1585,7 +1587,7 @@ static sector_t __rdev_sectors(struct raid_set *rs)
+ {
+ int i;
+
+- for (i = 0; i < rs->md.raid_disks; i++) {
++ for (i = 0; i < rs->raid_disks; i++) {
+ struct md_rdev *rdev = &rs->dev[i].rdev;
+
+ if (!test_bit(Journal, &rdev->flags) &&
+@@ -3751,13 +3753,13 @@ static int raid_iterate_devices(struct dm_target *ti,
+ unsigned int i;
+ int r = 0;
+
+- for (i = 0; !r && i < rs->md.raid_disks; i++)
+- if (rs->dev[i].data_dev)
+- r = fn(ti,
+- rs->dev[i].data_dev,
+- 0, /* No offset on data devs */
+- rs->md.dev_sectors,
+- data);
++ for (i = 0; !r && i < rs->raid_disks; i++) {
++ if (rs->dev[i].data_dev) {
++ r = fn(ti, rs->dev[i].data_dev,
++ 0, /* No offset on data devs */
++ rs->md.dev_sectors, data);
++ }
++ }
+
+ return r;
+ }
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c7bda4b0bcedf..dad426cc0f903 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -7716,6 +7716,7 @@ static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ */
+ if (rdev->saved_raid_disk >= 0 &&
+ rdev->saved_raid_disk >= first &&
++ rdev->saved_raid_disk <= last &&
+ conf->disks[rdev->saved_raid_disk].rdev == NULL)
+ first = rdev->saved_raid_disk;
+
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index e3f814e83d9c8..b3eaef31b7673 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -2199,7 +2199,8 @@ void bond_3ad_unbind_slave(struct slave *slave)
+ temp_aggregator->num_of_ports--;
+ if (__agg_active_ports(temp_aggregator) == 0) {
+ select_new_active_agg = temp_aggregator->is_active;
+- ad_clear_agg(temp_aggregator);
++ if (temp_aggregator->num_of_ports == 0)
++ ad_clear_agg(temp_aggregator);
+ if (select_new_active_agg) {
+ netdev_info(bond->dev, "Removing an active aggregator\n");
+ /* select new active aggregator */
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index 61ae622125c43..3fc439d924451 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -1292,12 +1292,12 @@ int bond_alb_initialize(struct bonding *bond, int rlb_enabled)
+ return res;
+
+ if (rlb_enabled) {
+- bond->alb_info.rlb_enabled = 1;
+ res = rlb_initialize(bond);
+ if (res) {
+ tlb_deinitialize(bond);
+ return res;
+ }
++ bond->alb_info.rlb_enabled = 1;
+ } else {
+ bond->alb_info.rlb_enabled = 0;
+ }
+diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c
+index 2814e0dee4bbe..df10e2d0d4b72 100644
+--- a/drivers/net/caif/caif_virtio.c
++++ b/drivers/net/caif/caif_virtio.c
+@@ -727,13 +727,21 @@ static int cfv_probe(struct virtio_device *vdev)
+ /* Carrier is off until netdevice is opened */
+ netif_carrier_off(netdev);
+
++ /* serialize netdev register + virtio_device_ready() with ndo_open() */
++ rtnl_lock();
++
+ /* register Netdev */
+- err = register_netdev(netdev);
++ err = register_netdevice(netdev);
+ if (err) {
++ rtnl_unlock();
+ dev_err(&vdev->dev, "Unable to register netdev (%d)\n", err);
+ goto err;
+ }
+
++ virtio_device_ready(vdev);
++
++ rtnl_unlock();
++
+ debugfs_init(cfv);
+
+ return 0;
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 3deda0321c00d..8a67c6f76e3b4 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -599,6 +599,11 @@ force_link:
+ reg |= LINK_STS;
+ if (state->duplex == DUPLEX_FULL)
+ reg |= DUPLX_MODE;
++ if (state->pause & MLO_PAUSE_TXRX_MASK) {
++ if (state->pause & MLO_PAUSE_TX)
++ reg |= TXFLOW_CNTL;
++ reg |= RXFLOW_CNTL;
++ }
+
+ core_writel(priv, reg, offset);
+ }
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index d5bb972cbc9a6..c3390999842a1 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -333,6 +333,12 @@ static void tun_napi_init(struct tun_struct *tun, struct tun_file *tfile,
+ }
+ }
+
++static void tun_napi_enable(struct tun_file *tfile)
++{
++ if (tfile->napi_enabled)
++ napi_enable(&tfile->napi);
++}
++
+ static void tun_napi_disable(struct tun_file *tfile)
+ {
+ if (tfile->napi_enabled)
+@@ -704,7 +710,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
+ tun = rtnl_dereference(tfile->tun);
+
+ if (tun && clean) {
+- tun_napi_disable(tfile);
++ if (!tfile->detached)
++ tun_napi_disable(tfile);
+ tun_napi_del(tfile);
+ }
+
+@@ -723,8 +730,10 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
+ if (clean) {
+ RCU_INIT_POINTER(tfile->tun, NULL);
+ sock_put(&tfile->sk);
+- } else
++ } else {
+ tun_disable_queue(tun, tfile);
++ tun_napi_disable(tfile);
++ }
+
+ synchronize_net();
+ tun_flow_delete_by_queue(tun, tun->numqueues + 1);
+@@ -797,6 +806,7 @@ static void tun_detach_all(struct net_device *dev)
+ sock_put(&tfile->sk);
+ }
+ list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
++ tun_napi_del(tfile);
+ tun_enable_queue(tfile);
+ tun_queue_purge(tfile);
+ xdp_rxq_info_unreg(&tfile->xdp_rxq);
+@@ -877,6 +887,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
+
+ if (tfile->detached) {
+ tun_enable_queue(tfile);
++ tun_napi_enable(tfile);
+ } else {
+ sock_hold(&tfile->sk);
+ tun_napi_init(tun, tfile, napi, napi_frags);
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index 684eec0aa0d63..cf6ff8732fb2c 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1377,6 +1377,42 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ * are bundled into this buffer and where we can find an array of
+ * per-packet metadata (which contains elements encoded into u16).
+ */
++
++ /* SKB contents for current firmware:
++ * <packet 1> <padding>
++ * ...
++ * <packet N> <padding>
++ * <per-packet metadata entry 1> <dummy header>
++ * ...
++ * <per-packet metadata entry N> <dummy header>
++ * <padding2> <rx_hdr>
++ *
++ * where:
++ * <packet N> contains pkt_len bytes:
++ * 2 bytes of IP alignment pseudo header
++ * packet received
++ * <per-packet metadata entry N> contains 4 bytes:
++ * pkt_len and fields AX_RXHDR_*
++ * <padding> 0-7 bytes to terminate at
++ * 8 bytes boundary (64-bit).
++ * <padding2> 4 bytes to make rx_hdr terminate at
++ * 8 bytes boundary (64-bit)
++ * <dummy-header> contains 4 bytes:
++ * pkt_len=0 and AX_RXHDR_DROP_ERR
++ * <rx-hdr> contains 4 bytes:
++ * pkt_cnt and hdr_off (offset of
++ * <per-packet metadata entry 1>)
++ *
++ * pkt_cnt is number of entrys in the per-packet metadata.
++ * In current firmware there is 2 entrys per packet.
++ * The first points to the packet and the
++ * second is a dummy header.
++ * This was done probably to align fields in 64-bit and
++ * maintain compatibility with old firmware.
++ * This code assumes that <dummy header> and <padding2> are
++ * optional.
++ */
++
+ if (skb->len < 4)
+ return 0;
+ skb_trim(skb, skb->len - 4);
+@@ -1391,51 +1427,66 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ /* Make sure that the bounds of the metadata array are inside the SKB
+ * (and in front of the counter at the end).
+ */
+- if (pkt_cnt * 2 + hdr_off > skb->len)
++ if (pkt_cnt * 4 + hdr_off > skb->len)
+ return 0;
+ pkt_hdr = (u32 *)(skb->data + hdr_off);
+
+ /* Packets must not overlap the metadata array */
+ skb_trim(skb, hdr_off);
+
+- for (; ; pkt_cnt--, pkt_hdr++) {
++ for (; pkt_cnt > 0; pkt_cnt--, pkt_hdr++) {
++ u16 pkt_len_plus_padd;
+ u16 pkt_len;
+
+ le32_to_cpus(pkt_hdr);
+ pkt_len = (*pkt_hdr >> 16) & 0x1fff;
++ pkt_len_plus_padd = (pkt_len + 7) & 0xfff8;
+
+- if (pkt_len > skb->len)
++ /* Skip dummy header used for alignment
++ */
++ if (pkt_len == 0)
++ continue;
++
++ if (pkt_len_plus_padd > skb->len)
+ return 0;
+
+ /* Check CRC or runt packet */
+- if (((*pkt_hdr & (AX_RXHDR_CRC_ERR | AX_RXHDR_DROP_ERR)) == 0) &&
+- pkt_len >= 2 + ETH_HLEN) {
+- bool last = (pkt_cnt == 0);
+-
+- if (last) {
+- ax_skb = skb;
+- } else {
+- ax_skb = skb_clone(skb, GFP_ATOMIC);
+- if (!ax_skb)
+- return 0;
+- }
+- ax_skb->len = pkt_len;
+- /* Skip IP alignment pseudo header */
+- skb_pull(ax_skb, 2);
+- skb_set_tail_pointer(ax_skb, ax_skb->len);
+- ax_skb->truesize = pkt_len + sizeof(struct sk_buff);
+- ax88179_rx_checksum(ax_skb, pkt_hdr);
++ if ((*pkt_hdr & (AX_RXHDR_CRC_ERR | AX_RXHDR_DROP_ERR)) ||
++ pkt_len < 2 + ETH_HLEN) {
++ dev->net->stats.rx_errors++;
++ skb_pull(skb, pkt_len_plus_padd);
++ continue;
++ }
+
+- if (last)
+- return 1;
++ /* last packet */
++ if (pkt_len_plus_padd == skb->len) {
++ skb_trim(skb, pkt_len);
+
+- usbnet_skb_return(dev, ax_skb);
++ /* Skip IP alignment pseudo header */
++ skb_pull(skb, 2);
++
++ skb->truesize = SKB_TRUESIZE(pkt_len_plus_padd);
++ ax88179_rx_checksum(skb, pkt_hdr);
++ return 1;
+ }
+
+- /* Trim this packet away from the SKB */
+- if (!skb_pull(skb, (pkt_len + 7) & 0xFFF8))
++ ax_skb = skb_clone(skb, GFP_ATOMIC);
++ if (!ax_skb)
+ return 0;
++ skb_trim(ax_skb, pkt_len);
++
++ /* Skip IP alignment pseudo header */
++ skb_pull(ax_skb, 2);
++
++ skb->truesize = pkt_len_plus_padd +
++ SKB_DATA_ALIGN(sizeof(struct sk_buff));
++ ax88179_rx_checksum(ax_skb, pkt_hdr);
++ usbnet_skb_return(dev, ax_skb);
++
++ skb_pull(skb, pkt_len_plus_padd);
+ }
++
++ return 0;
+ }
+
+ static struct sk_buff *
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index c2e872f926f1c..fcf21a1ca7761 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1318,6 +1318,8 @@ static const struct usb_device_id products[] = {
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */
+ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */
+ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */
+ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 867cadb1e5ccd..2aa28c961d260 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1998,7 +1998,7 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
+ cmd, reqtype, value, index, size);
+
+ if (size) {
+- buf = kmalloc(size, GFP_KERNEL);
++ buf = kmalloc(size, GFP_NOIO);
+ if (!buf)
+ goto out;
+ }
+@@ -2030,7 +2030,7 @@ static int __usbnet_write_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
+ cmd, reqtype, value, index, size);
+
+ if (data) {
+- buf = kmemdup(data, size, GFP_KERNEL);
++ buf = kmemdup(data, size, GFP_NOIO);
+ if (!buf)
+ goto out;
+ } else {
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 415b26c80fe78..406ef4cc636d4 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -3105,14 +3105,20 @@ static int virtnet_probe(struct virtio_device *vdev)
+ }
+ }
+
+- err = register_netdev(dev);
++ /* serialize netdev register + virtio_device_ready() with ndo_open() */
++ rtnl_lock();
++
++ err = register_netdevice(dev);
+ if (err) {
+ pr_debug("virtio_net: registering device failed\n");
++ rtnl_unlock();
+ goto free_failover;
+ }
+
+ virtio_device_ready(vdev);
+
++ rtnl_unlock();
++
+ err = virtnet_cpu_notif_add(vi);
+ if (err) {
+ pr_debug("virtio_net: registering cpu notifier failed\n");
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 70af7830eed86..4b75ecb19d890 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -63,6 +63,10 @@ module_param_named(max_queues, xennet_max_queues, uint, 0644);
+ MODULE_PARM_DESC(max_queues,
+ "Maximum number of queues per virtual interface");
+
++static bool __read_mostly xennet_trusted = true;
++module_param_named(trusted, xennet_trusted, bool, 0644);
++MODULE_PARM_DESC(trusted, "Is the backend trusted");
++
+ #define XENNET_TIMEOUT (5 * HZ)
+
+ static const struct ethtool_ops xennet_ethtool_ops;
+@@ -163,6 +167,9 @@ struct netfront_info {
+ /* Is device behaving sane? */
+ bool broken;
+
++ /* Should skbs be bounced into a zeroed buffer? */
++ bool bounce;
++
+ atomic_t rx_gso_checksum_fixup;
+ };
+
+@@ -261,7 +268,7 @@ static struct sk_buff *xennet_alloc_one_rx_buffer(struct netfront_queue *queue)
+ if (unlikely(!skb))
+ return NULL;
+
+- page = alloc_page(GFP_ATOMIC | __GFP_NOWARN);
++ page = alloc_page(GFP_ATOMIC | __GFP_NOWARN | __GFP_ZERO);
+ if (!page) {
+ kfree_skb(skb);
+ return NULL;
+@@ -593,6 +600,34 @@ static void xennet_mark_tx_pending(struct netfront_queue *queue)
+ queue->tx_link[i] = TX_PENDING;
+ }
+
++struct sk_buff *bounce_skb(const struct sk_buff *skb)
++{
++ unsigned int headerlen = skb_headroom(skb);
++ /* Align size to allocate full pages and avoid contiguous data leaks */
++ unsigned int size = ALIGN(skb_end_offset(skb) + skb->data_len,
++ XEN_PAGE_SIZE);
++ struct sk_buff *n = alloc_skb(size, GFP_ATOMIC | __GFP_ZERO);
++
++ if (!n)
++ return NULL;
++
++ if (!IS_ALIGNED((uintptr_t)n->head, XEN_PAGE_SIZE)) {
++ WARN_ONCE(1, "misaligned skb allocated\n");
++ kfree_skb(n);
++ return NULL;
++ }
++
++ /* Set the data pointer */
++ skb_reserve(n, headerlen);
++ /* Set the tail pointer and length */
++ skb_put(n, skb->len);
++
++ BUG_ON(skb_copy_bits(skb, -headerlen, n->head, headerlen + skb->len));
++
++ skb_copy_header(n, skb);
++ return n;
++}
++
+ #define MAX_XEN_SKB_FRAGS (65536 / XEN_PAGE_SIZE + 1)
+
+ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+@@ -645,9 +680,13 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev
+
+ /* The first req should be at least ETH_HLEN size or the packet will be
+ * dropped by netback.
++ *
++ * If the backend is not trusted bounce all data to zeroed pages to
++ * avoid exposing contiguous data on the granted page not belonging to
++ * the skb.
+ */
+- if (unlikely(PAGE_SIZE - offset < ETH_HLEN)) {
+- nskb = skb_copy(skb, GFP_ATOMIC);
++ if (np->bounce || unlikely(PAGE_SIZE - offset < ETH_HLEN)) {
++ nskb = bounce_skb(skb);
+ if (!nskb)
+ goto drop;
+ dev_consume_skb_any(skb);
+@@ -1953,6 +1992,10 @@ static int talk_to_netback(struct xenbus_device *dev,
+
+ info->netdev->irq = 0;
+
++ /* Check if backend is trusted. */
++ info->bounce = !xennet_trusted ||
++ !xenbus_read_unsigned(dev->nodename, "trusted", 1);
++
+ /* Check if backend supports multiple queues */
+ max_queues = xenbus_read_unsigned(info->xbdev->otherend,
+ "multi-queue-max-queues", 1);
+@@ -2106,6 +2149,9 @@ static int xennet_connect(struct net_device *dev)
+ err = talk_to_netback(np->xbdev, np);
+ if (err)
+ return err;
++ if (np->bounce)
++ dev_info(&np->xbdev->dev,
++ "bouncing transmitted data to zeroed pages\n");
+
+ /* talk_to_netback() sets the correct number of queues */
+ num_queues = dev->real_num_tx_queues;
+diff --git a/drivers/nfc/nfcmrvl/i2c.c b/drivers/nfc/nfcmrvl/i2c.c
+index 0f22379887ca8..919b4d2f5d8b5 100644
+--- a/drivers/nfc/nfcmrvl/i2c.c
++++ b/drivers/nfc/nfcmrvl/i2c.c
+@@ -186,9 +186,9 @@ static int nfcmrvl_i2c_parse_dt(struct device_node *node,
+ pdata->irq_polarity = IRQF_TRIGGER_RISING;
+
+ ret = irq_of_parse_and_map(node, 0);
+- if (ret < 0) {
+- pr_err("Unable to get irq, error: %d\n", ret);
+- return ret;
++ if (!ret) {
++ pr_err("Unable to get irq\n");
++ return -EINVAL;
+ }
+ pdata->irq = ret;
+
+diff --git a/drivers/nfc/nfcmrvl/spi.c b/drivers/nfc/nfcmrvl/spi.c
+index 8e0ddb4347704..1f4120e3314b2 100644
+--- a/drivers/nfc/nfcmrvl/spi.c
++++ b/drivers/nfc/nfcmrvl/spi.c
+@@ -129,9 +129,9 @@ static int nfcmrvl_spi_parse_dt(struct device_node *node,
+ }
+
+ ret = irq_of_parse_and_map(node, 0);
+- if (ret < 0) {
+- pr_err("Unable to get irq, error: %d\n", ret);
+- return ret;
++ if (!ret) {
++ pr_err("Unable to get irq\n");
++ return -EINVAL;
+ }
+ pdata->irq = ret;
+
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index 0df745cad601a..16c52d4c833c5 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -178,6 +178,9 @@ static int nxp_nci_i2c_nci_read(struct nxp_nci_i2c_phy *phy,
+
+ skb_put_data(*skb, (void *)&header, NCI_CTRL_HDR_SIZE);
+
++ if (!header.plen)
++ return 0;
++
+ r = i2c_master_recv(client, skb_put(*skb, header.plen), header.plen);
+ if (r != header.plen) {
+ nfc_err(&client->dev,
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 48a070a37ea9b..6b38b373ed14f 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -196,8 +196,8 @@ static int nvdimm_clear_badblocks_region(struct device *dev, void *data)
+ ndr_end = nd_region->ndr_start + nd_region->ndr_size - 1;
+
+ /* make sure we are in the region */
+- if (ctx->phys < nd_region->ndr_start
+- || (ctx->phys + ctx->cleared) > ndr_end)
++ if (ctx->phys < nd_region->ndr_start ||
++ (ctx->phys + ctx->cleared - 1) > ndr_end)
+ return 0;
+
+ sector = (ctx->phys - nd_region->ndr_start) / 512;
+diff --git a/drivers/xen/gntdev-common.h b/drivers/xen/gntdev-common.h
+index 2f8b949c3eeb1..fab6f5a54d5b2 100644
+--- a/drivers/xen/gntdev-common.h
++++ b/drivers/xen/gntdev-common.h
+@@ -15,6 +15,8 @@
+ #include <linux/mman.h>
+ #include <linux/mmu_notifier.h>
+ #include <linux/types.h>
++#include <xen/interface/event_channel.h>
++#include <xen/grant_table.h>
+
+ struct gntdev_dmabuf_priv;
+
+@@ -61,6 +63,7 @@ struct gntdev_grant_map {
+ struct gnttab_unmap_grant_ref *unmap_ops;
+ struct gnttab_map_grant_ref *kmap_ops;
+ struct gnttab_unmap_grant_ref *kunmap_ops;
++ bool *being_removed;
+ struct page **pages;
+ unsigned long pages_vm_start;
+
+@@ -78,6 +81,11 @@ struct gntdev_grant_map {
+ /* Needed to avoid allocation in gnttab_dma_free_pages(). */
+ xen_pfn_t *frames;
+ #endif
++
++ /* Number of live grants */
++ atomic_t live_grants;
++ /* Needed to avoid allocation in __unmap_grant_pages */
++ struct gntab_unmap_queue_data unmap_data;
+ };
+
+ struct gntdev_grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count,
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index e519063e421e2..492084814f55d 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -64,11 +64,12 @@ MODULE_PARM_DESC(limit, "Maximum number of grants that may be mapped by "
+
+ static atomic_t pages_mapped = ATOMIC_INIT(0);
+
++/* True in PV mode, false otherwise */
+ static int use_ptemod;
+ #define populate_freeable_maps use_ptemod
+
+-static int unmap_grant_pages(struct gntdev_grant_map *map,
+- int offset, int pages);
++static void unmap_grant_pages(struct gntdev_grant_map *map,
++ int offset, int pages);
+
+ static struct miscdevice gntdev_miscdev;
+
+@@ -125,6 +126,7 @@ static void gntdev_free_map(struct gntdev_grant_map *map)
+ kfree(map->unmap_ops);
+ kfree(map->kmap_ops);
+ kfree(map->kunmap_ops);
++ kfree(map->being_removed);
+ kfree(map);
+ }
+
+@@ -144,12 +146,15 @@ struct gntdev_grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count,
+ add->kmap_ops = kcalloc(count, sizeof(add->kmap_ops[0]), GFP_KERNEL);
+ add->kunmap_ops = kcalloc(count, sizeof(add->kunmap_ops[0]), GFP_KERNEL);
+ add->pages = kcalloc(count, sizeof(add->pages[0]), GFP_KERNEL);
++ add->being_removed =
++ kcalloc(count, sizeof(add->being_removed[0]), GFP_KERNEL);
+ if (NULL == add->grants ||
+ NULL == add->map_ops ||
+ NULL == add->unmap_ops ||
+ NULL == add->kmap_ops ||
+ NULL == add->kunmap_ops ||
+- NULL == add->pages)
++ NULL == add->pages ||
++ NULL == add->being_removed)
+ goto err;
+
+ #ifdef CONFIG_XEN_GRANT_DMA_ALLOC
+@@ -245,6 +250,35 @@ void gntdev_put_map(struct gntdev_priv *priv, struct gntdev_grant_map *map)
+ return;
+
+ atomic_sub(map->count, &pages_mapped);
++ if (map->pages && !use_ptemod) {
++ /*
++ * Increment the reference count. This ensures that the
++ * subsequent call to unmap_grant_pages() will not wind up
++ * re-entering itself. It *can* wind up calling
++ * gntdev_put_map() recursively, but such calls will be with a
++ * reference count greater than 1, so they will return before
++ * this code is reached. The recursion depth is thus limited to
++ * 1. Do NOT use refcount_inc() here, as it will detect that
++ * the reference count is zero and WARN().
++ */
++ refcount_set(&map->users, 1);
++
++ /*
++ * Unmap the grants. This may or may not be asynchronous, so it
++ * is possible that the reference count is 1 on return, but it
++ * could also be greater than 1.
++ */
++ unmap_grant_pages(map, 0, map->count);
++
++ /* Check if the memory now needs to be freed */
++ if (!refcount_dec_and_test(&map->users))
++ return;
++
++ /*
++ * All pages have been returned to the hypervisor, so free the
++ * map.
++ */
++ }
+
+ if (map->notify.flags & UNMAP_NOTIFY_SEND_EVENT) {
+ notify_remote_via_evtchn(map->notify.event);
+@@ -302,6 +336,7 @@ static int set_grant_ptes_as_special(pte_t *pte, pgtable_t token,
+
+ int gntdev_map_grant_pages(struct gntdev_grant_map *map)
+ {
++ size_t alloced = 0;
+ int i, err = 0;
+
+ if (!use_ptemod) {
+@@ -350,87 +385,109 @@ int gntdev_map_grant_pages(struct gntdev_grant_map *map)
+ map->pages, map->count);
+
+ for (i = 0; i < map->count; i++) {
+- if (map->map_ops[i].status == GNTST_okay)
++ if (map->map_ops[i].status == GNTST_okay) {
+ map->unmap_ops[i].handle = map->map_ops[i].handle;
+- else if (!err)
++ if (!use_ptemod)
++ alloced++;
++ } else if (!err)
+ err = -EINVAL;
+
+ if (map->flags & GNTMAP_device_map)
+ map->unmap_ops[i].dev_bus_addr = map->map_ops[i].dev_bus_addr;
+
+ if (use_ptemod) {
+- if (map->kmap_ops[i].status == GNTST_okay)
++ if (map->kmap_ops[i].status == GNTST_okay) {
++ if (map->map_ops[i].status == GNTST_okay)
++ alloced++;
+ map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
+- else if (!err)
++ } else if (!err)
+ err = -EINVAL;
+ }
+ }
++ atomic_add(alloced, &map->live_grants);
+ return err;
+ }
+
+-static int __unmap_grant_pages(struct gntdev_grant_map *map, int offset,
+- int pages)
++static void __unmap_grant_pages_done(int result,
++ struct gntab_unmap_queue_data *data)
+ {
+- int i, err = 0;
+- struct gntab_unmap_queue_data unmap_data;
++ unsigned int i;
++ struct gntdev_grant_map *map = data->data;
++ unsigned int offset = data->unmap_ops - map->unmap_ops;
+
++ for (i = 0; i < data->count; i++) {
++ WARN_ON(map->unmap_ops[offset+i].status);
++ pr_debug("unmap handle=%d st=%d\n",
++ map->unmap_ops[offset+i].handle,
++ map->unmap_ops[offset+i].status);
++ map->unmap_ops[offset+i].handle = -1;
++ }
++ /*
++ * Decrease the live-grant counter. This must happen after the loop to
++ * prevent premature reuse of the grants by gnttab_mmap().
++ */
++ atomic_sub(data->count, &map->live_grants);
++
++ /* Release reference taken by __unmap_grant_pages */
++ gntdev_put_map(NULL, map);
++}
++
++static void __unmap_grant_pages(struct gntdev_grant_map *map, int offset,
++ int pages)
++{
+ if (map->notify.flags & UNMAP_NOTIFY_CLEAR_BYTE) {
+ int pgno = (map->notify.addr >> PAGE_SHIFT);
++
+ if (pgno >= offset && pgno < offset + pages) {
+ /* No need for kmap, pages are in lowmem */
+ uint8_t *tmp = pfn_to_kaddr(page_to_pfn(map->pages[pgno]));
++
+ tmp[map->notify.addr & (PAGE_SIZE-1)] = 0;
+ map->notify.flags &= ~UNMAP_NOTIFY_CLEAR_BYTE;
+ }
+ }
+
+- unmap_data.unmap_ops = map->unmap_ops + offset;
+- unmap_data.kunmap_ops = use_ptemod ? map->kunmap_ops + offset : NULL;
+- unmap_data.pages = map->pages + offset;
+- unmap_data.count = pages;
++ map->unmap_data.unmap_ops = map->unmap_ops + offset;
++ map->unmap_data.kunmap_ops = use_ptemod ? map->kunmap_ops + offset : NULL;
++ map->unmap_data.pages = map->pages + offset;
++ map->unmap_data.count = pages;
++ map->unmap_data.done = __unmap_grant_pages_done;
++ map->unmap_data.data = map;
++ refcount_inc(&map->users); /* to keep map alive during async call below */
+
+- err = gnttab_unmap_refs_sync(&unmap_data);
+- if (err)
+- return err;
+-
+- for (i = 0; i < pages; i++) {
+- if (map->unmap_ops[offset+i].status)
+- err = -EINVAL;
+- pr_debug("unmap handle=%d st=%d\n",
+- map->unmap_ops[offset+i].handle,
+- map->unmap_ops[offset+i].status);
+- map->unmap_ops[offset+i].handle = -1;
+- }
+- return err;
++ gnttab_unmap_refs_async(&map->unmap_data);
+ }
+
+-static int unmap_grant_pages(struct gntdev_grant_map *map, int offset,
+- int pages)
++static void unmap_grant_pages(struct gntdev_grant_map *map, int offset,
++ int pages)
+ {
+- int range, err = 0;
++ int range;
++
++ if (atomic_read(&map->live_grants) == 0)
++ return; /* Nothing to do */
+
+ pr_debug("unmap %d+%d [%d+%d]\n", map->index, map->count, offset, pages);
+
+ /* It is possible the requested range will have a "hole" where we
+ * already unmapped some of the grants. Only unmap valid ranges.
+ */
+- while (pages && !err) {
+- while (pages && map->unmap_ops[offset].handle == -1) {
++ while (pages) {
++ while (pages && map->being_removed[offset]) {
+ offset++;
+ pages--;
+ }
+ range = 0;
+ while (range < pages) {
+- if (map->unmap_ops[offset+range].handle == -1)
++ if (map->being_removed[offset + range])
+ break;
++ map->being_removed[offset + range] = true;
+ range++;
+ }
+- err = __unmap_grant_pages(map, offset, range);
++ if (range)
++ __unmap_grant_pages(map, offset, range);
+ offset += range;
+ pages -= range;
+ }
+-
+- return err;
+ }
+
+ /* ------------------------------------------------------------------ */
+@@ -500,7 +557,6 @@ static int unmap_if_in_range(struct gntdev_grant_map *map,
+ bool blockable)
+ {
+ unsigned long mstart, mend;
+- int err;
+
+ if (!in_range(map, start, end))
+ return 0;
+@@ -514,10 +570,9 @@ static int unmap_if_in_range(struct gntdev_grant_map *map,
+ map->index, map->count,
+ map->vma->vm_start, map->vma->vm_end,
+ start, end, mstart, mend);
+- err = unmap_grant_pages(map,
++ unmap_grant_pages(map,
+ (mstart - map->vma->vm_start) >> PAGE_SHIFT,
+ (mend - mstart) >> PAGE_SHIFT);
+- WARN_ON(err);
+
+ return 0;
+ }
+@@ -558,7 +613,6 @@ static void mn_release(struct mmu_notifier *mn,
+ {
+ struct gntdev_priv *priv = container_of(mn, struct gntdev_priv, mn);
+ struct gntdev_grant_map *map;
+- int err;
+
+ mutex_lock(&priv->lock);
+ list_for_each_entry(map, &priv->maps, next) {
+@@ -567,8 +621,7 @@ static void mn_release(struct mmu_notifier *mn,
+ pr_debug("map %d+%d (%lx %lx)\n",
+ map->index, map->count,
+ map->vma->vm_start, map->vma->vm_end);
+- err = unmap_grant_pages(map, /* offset */ 0, map->count);
+- WARN_ON(err);
++ unmap_grant_pages(map, /* offset */ 0, map->count);
+ }
+ list_for_each_entry(map, &priv->freeable_maps, next) {
+ if (!map->vma)
+@@ -576,8 +629,7 @@ static void mn_release(struct mmu_notifier *mn,
+ pr_debug("map %d+%d (%lx %lx)\n",
+ map->index, map->count,
+ map->vma->vm_start, map->vma->vm_end);
+- err = unmap_grant_pages(map, /* offset */ 0, map->count);
+- WARN_ON(err);
++ unmap_grant_pages(map, /* offset */ 0, map->count);
+ }
+ mutex_unlock(&priv->lock);
+ }
+@@ -1113,6 +1165,10 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
+ goto unlock_out;
+ }
+
++ if (atomic_read(&map->live_grants)) {
++ err = -EAGAIN;
++ goto unlock_out;
++ }
+ refcount_inc(&map->users);
+
+ vma->vm_ops = &gntdev_vmops;
+diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c
+index a886a8f4c0cb3..b801283da28df 100644
+--- a/net/ipv6/seg6_hmac.c
++++ b/net/ipv6/seg6_hmac.c
+@@ -415,7 +415,6 @@ int __net_init seg6_hmac_net_init(struct net *net)
+
+ return 0;
+ }
+-EXPORT_SYMBOL(seg6_hmac_net_init);
+
+ void seg6_hmac_exit(void)
+ {
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 55c999cbe6e96..420b9fcc10d7d 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -314,9 +314,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
+ kcalloc(cmax, sizeof(*kp), GFP_KERNEL | __GFP_NOWARN) :
+ NULL;
+
+- rcu_read_lock();
+-
+- ca = t->prl_count < cmax ? t->prl_count : cmax;
++ ca = min(t->prl_count, cmax);
+
+ if (!kp) {
+ /* We don't try hard to allocate much memory for
+@@ -331,7 +329,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
+ }
+ }
+
+- c = 0;
++ rcu_read_lock();
+ for_each_prl_rcu(t->prl) {
+ if (c >= cmax)
+ break;
+@@ -343,7 +341,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
+ if (kprl.addr != htonl(INADDR_ANY))
+ break;
+ }
+-out:
++
+ rcu_read_unlock();
+
+ len = sizeof(*kp) * c;
+@@ -352,7 +350,7 @@ out:
+ ret = -EFAULT;
+
+ kfree(kp);
+-
++out:
+ return ret;
+ }
+
+diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
+index dbc4ed643b4bc..0b8510a4185da 100644
+--- a/net/netfilter/nft_set_hash.c
++++ b/net/netfilter/nft_set_hash.c
+@@ -145,6 +145,7 @@ static bool nft_rhash_update(struct nft_set *set, const u32 *key,
+ /* Another cpu may race to insert the element with the same key */
+ if (prev) {
+ nft_set_elem_destroy(set, he, true);
++ atomic_dec(&set->nelems);
+ he = prev;
+ }
+
+@@ -154,6 +155,7 @@ out:
+
+ err2:
+ nft_set_elem_destroy(set, he, true);
++ atomic_dec(&set->nelems);
+ err1:
+ return false;
+ }
+diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c
+index 74555fb956154..cede9d0ceff8b 100644
+--- a/net/rose/rose_timer.c
++++ b/net/rose/rose_timer.c
+@@ -34,89 +34,89 @@ static void rose_idletimer_expiry(struct timer_list *);
+
+ void rose_start_heartbeat(struct sock *sk)
+ {
+- del_timer(&sk->sk_timer);
++ sk_stop_timer(sk, &sk->sk_timer);
+
+ sk->sk_timer.function = rose_heartbeat_expiry;
+ sk->sk_timer.expires = jiffies + 5 * HZ;
+
+- add_timer(&sk->sk_timer);
++ sk_reset_timer(sk, &sk->sk_timer, sk->sk_timer.expires);
+ }
+
+ void rose_start_t1timer(struct sock *sk)
+ {
+ struct rose_sock *rose = rose_sk(sk);
+
+- del_timer(&rose->timer);
++ sk_stop_timer(sk, &rose->timer);
+
+ rose->timer.function = rose_timer_expiry;
+ rose->timer.expires = jiffies + rose->t1;
+
+- add_timer(&rose->timer);
++ sk_reset_timer(sk, &rose->timer, rose->timer.expires);
+ }
+
+ void rose_start_t2timer(struct sock *sk)
+ {
+ struct rose_sock *rose = rose_sk(sk);
+
+- del_timer(&rose->timer);
++ sk_stop_timer(sk, &rose->timer);
+
+ rose->timer.function = rose_timer_expiry;
+ rose->timer.expires = jiffies + rose->t2;
+
+- add_timer(&rose->timer);
++ sk_reset_timer(sk, &rose->timer, rose->timer.expires);
+ }
+
+ void rose_start_t3timer(struct sock *sk)
+ {
+ struct rose_sock *rose = rose_sk(sk);
+
+- del_timer(&rose->timer);
++ sk_stop_timer(sk, &rose->timer);
+
+ rose->timer.function = rose_timer_expiry;
+ rose->timer.expires = jiffies + rose->t3;
+
+- add_timer(&rose->timer);
++ sk_reset_timer(sk, &rose->timer, rose->timer.expires);
+ }
+
+ void rose_start_hbtimer(struct sock *sk)
+ {
+ struct rose_sock *rose = rose_sk(sk);
+
+- del_timer(&rose->timer);
++ sk_stop_timer(sk, &rose->timer);
+
+ rose->timer.function = rose_timer_expiry;
+ rose->timer.expires = jiffies + rose->hb;
+
+- add_timer(&rose->timer);
++ sk_reset_timer(sk, &rose->timer, rose->timer.expires);
+ }
+
+ void rose_start_idletimer(struct sock *sk)
+ {
+ struct rose_sock *rose = rose_sk(sk);
+
+- del_timer(&rose->idletimer);
++ sk_stop_timer(sk, &rose->idletimer);
+
+ if (rose->idle > 0) {
+ rose->idletimer.function = rose_idletimer_expiry;
+ rose->idletimer.expires = jiffies + rose->idle;
+
+- add_timer(&rose->idletimer);
++ sk_reset_timer(sk, &rose->idletimer, rose->idletimer.expires);
+ }
+ }
+
+ void rose_stop_heartbeat(struct sock *sk)
+ {
+- del_timer(&sk->sk_timer);
++ sk_stop_timer(sk, &sk->sk_timer);
+ }
+
+ void rose_stop_timer(struct sock *sk)
+ {
+- del_timer(&rose_sk(sk)->timer);
++ sk_stop_timer(sk, &rose_sk(sk)->timer);
+ }
+
+ void rose_stop_idletimer(struct sock *sk)
+ {
+- del_timer(&rose_sk(sk)->idletimer);
++ sk_stop_timer(sk, &rose_sk(sk)->idletimer);
+ }
+
+ static void rose_heartbeat_expiry(struct timer_list *t)
+@@ -133,6 +133,7 @@ static void rose_heartbeat_expiry(struct timer_list *t)
+ (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) {
+ bh_unlock_sock(sk);
+ rose_destroy_socket(sk);
++ sock_put(sk);
+ return;
+ }
+ break;
+@@ -155,6 +156,7 @@ static void rose_heartbeat_expiry(struct timer_list *t)
+
+ rose_start_heartbeat(sk);
+ bh_unlock_sock(sk);
++ sock_put(sk);
+ }
+
+ static void rose_timer_expiry(struct timer_list *t)
+@@ -184,6 +186,7 @@ static void rose_timer_expiry(struct timer_list *t)
+ break;
+ }
+ bh_unlock_sock(sk);
++ sock_put(sk);
+ }
+
+ static void rose_idletimer_expiry(struct timer_list *t)
+@@ -208,4 +211,5 @@ static void rose_idletimer_expiry(struct timer_list *t)
+ sock_set_flag(sk, SOCK_DEAD);
+ }
+ bh_unlock_sock(sk);
++ sock_put(sk);
+ }
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 34596d0e4bdeb..7459180e992bd 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -544,7 +544,7 @@ static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr,
+ */
+ xdr->p = (void *)p + frag2bytes;
+ space_left = xdr->buf->buflen - xdr->buf->len;
+- if (space_left - nbytes >= PAGE_SIZE)
++ if (space_left - frag1bytes >= PAGE_SIZE)
+ xdr->end = (void *)p + PAGE_SIZE;
+ else
+ xdr->end = (void *)p + space_left - frag1bytes;
+diff --git a/tools/testing/selftests/net/udpgso_bench.sh b/tools/testing/selftests/net/udpgso_bench.sh
+index 99e537ab5ad9a..dd2f621ca3f92 100755
+--- a/tools/testing/selftests/net/udpgso_bench.sh
++++ b/tools/testing/selftests/net/udpgso_bench.sh
+@@ -57,7 +57,7 @@ run_all() {
+ run_udp "${ipv4_args}"
+
+ echo "ipv6"
+- run_tcp "${ipv4_args}"
++ run_tcp "${ipv6_args}"
+ run_udp "${ipv6_args}"
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-07-12 16:01 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-07-12 16:01 UTC (permalink / raw
To: gentoo-commits
commit: 661d2253ec51c06137cadeb44300c8b30697a775
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jul 12 16:01:42 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jul 12 16:01:42 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=661d2253
Linux patch 4.19.252
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1251_linux-4.19.252.patch | 1469 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1473 insertions(+)
diff --git a/0000_README b/0000_README
index 1fd6a3cd..0126558b 100644
--- a/0000_README
+++ b/0000_README
@@ -1043,6 +1043,10 @@ Patch: 1250_linux-4.19.251.patch
From: https://www.kernel.org
Desc: Linux 4.19.251
+Patch: 1251_linux-4.19.252.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.252
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1251_linux-4.19.252.patch b/1251_linux-4.19.252.patch
new file mode 100644
index 00000000..af894b7a
--- /dev/null
+++ b/1251_linux-4.19.252.patch
@@ -0,0 +1,1469 @@
+diff --git a/Makefile b/Makefile
+index 35717e4c2b870..73a75363bba0b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 251
++SUBLEVEL = 252
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
+index 21bfe9b6e16a1..3ba0c6c560d8e 100644
+--- a/arch/arm/mach-at91/pm.c
++++ b/arch/arm/mach-at91/pm.c
+@@ -95,7 +95,7 @@ static const struct wakeup_source_info ws_info[] = {
+
+ static const struct of_device_id sama5d2_ws_ids[] = {
+ { .compatible = "atmel,sama5d2-gem", .data = &ws_info[0] },
+- { .compatible = "atmel,at91rm9200-rtc", .data = &ws_info[1] },
++ { .compatible = "atmel,sama5d2-rtc", .data = &ws_info[1] },
+ { .compatible = "atmel,sama5d3-udc", .data = &ws_info[2] },
+ { .compatible = "atmel,at91rm9200-ohci", .data = &ws_info[2] },
+ { .compatible = "usb-ohci", .data = &ws_info[2] },
+diff --git a/arch/arm/mach-meson/platsmp.c b/arch/arm/mach-meson/platsmp.c
+index cad7ee8f0d6b4..75e16a2c3c816 100644
+--- a/arch/arm/mach-meson/platsmp.c
++++ b/arch/arm/mach-meson/platsmp.c
+@@ -81,6 +81,7 @@ static void __init meson_smp_prepare_cpus(const char *scu_compatible,
+ }
+
+ sram_base = of_iomap(node, 0);
++ of_node_put(node);
+ if (!sram_base) {
+ pr_err("Couldn't map SRAM registers\n");
+ return;
+@@ -101,6 +102,7 @@ static void __init meson_smp_prepare_cpus(const char *scu_compatible,
+ }
+
+ scu_base = of_iomap(node, 0);
++ of_node_put(node);
+ if (!scu_base) {
+ pr_err("Couldn't map SCU registers\n");
+ return;
+diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c
+index c5c1d5cd7b10d..6fb1ceb5756d0 100644
+--- a/arch/powerpc/platforms/powernv/rng.c
++++ b/arch/powerpc/platforms/powernv/rng.c
+@@ -180,12 +180,8 @@ static int __init pnv_get_random_long_early(unsigned long *v)
+ NULL) != pnv_get_random_long_early)
+ return 0;
+
+- for_each_compatible_node(dn, NULL, "ibm,power-rng") {
+- if (rng_create(dn))
+- continue;
+- /* Create devices for hwrng driver */
+- of_platform_device_create(dn, NULL, NULL);
+- }
++ for_each_compatible_node(dn, NULL, "ibm,power-rng")
++ rng_create(dn);
+
+ if (!ppc_md.get_random_seed)
+ return 0;
+@@ -209,10 +205,18 @@ void __init pnv_rng_init(void)
+
+ static int __init pnv_rng_late_init(void)
+ {
++ struct device_node *dn;
+ unsigned long v;
++
+ /* In case it wasn't called during init for some other reason. */
+ if (ppc_md.get_random_seed == pnv_get_random_long_early)
+ pnv_get_random_long_early(&v);
++
++ if (ppc_md.get_random_seed == powernv_get_random_long) {
++ for_each_compatible_node(dn, NULL, "ibm,power-rng")
++ of_platform_device_create(dn, NULL, NULL);
++ }
++
+ return 0;
+ }
+ machine_subsys_initcall(powernv, pnv_rng_late_init);
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index d4ba0d9dd17c4..a451ecae16692 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -1804,6 +1804,11 @@ static int at_xdmac_alloc_chan_resources(struct dma_chan *chan)
+ for (i = 0; i < init_nr_desc_per_channel; i++) {
+ desc = at_xdmac_alloc_desc(chan, GFP_ATOMIC);
+ if (!desc) {
++ if (i == 0) {
++ dev_warn(chan2dev(chan),
++ "can't allocate any descriptors\n");
++ return -EIO;
++ }
+ dev_warn(chan2dev(chan),
+ "only %d descriptors have been allocated\n", i);
+ break;
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 8166305052946..9cb1c42282051 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2568,7 +2568,7 @@ static struct dma_pl330_desc *pl330_get_desc(struct dma_pl330_chan *pch)
+
+ /* If the DMAC pool is empty, alloc new */
+ if (!desc) {
+- DEFINE_SPINLOCK(lock);
++ static DEFINE_SPINLOCK(lock);
+ LIST_HEAD(pool);
+
+ if (!add_desc(&pool, &lock, GFP_ATOMIC, 1))
+diff --git a/drivers/dma/ti/dma-crossbar.c b/drivers/dma/ti/dma-crossbar.c
+index 6574cb5a12fee..932c638ef4a0b 100644
+--- a/drivers/dma/ti/dma-crossbar.c
++++ b/drivers/dma/ti/dma-crossbar.c
+@@ -251,6 +251,7 @@ static void *ti_dra7_xbar_route_allocate(struct of_phandle_args *dma_spec,
+ if (dma_spec->args[0] >= xbar->xbar_requests) {
+ dev_err(&pdev->dev, "Invalid XBAR request number: %d\n",
+ dma_spec->args[0]);
++ put_device(&pdev->dev);
+ return ERR_PTR(-EINVAL);
+ }
+
+@@ -258,12 +259,14 @@ static void *ti_dra7_xbar_route_allocate(struct of_phandle_args *dma_spec,
+ dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
+ if (!dma_spec->np) {
+ dev_err(&pdev->dev, "Can't get DMA master\n");
++ put_device(&pdev->dev);
+ return ERR_PTR(-EINVAL);
+ }
+
+ map = kzalloc(sizeof(*map), GFP_KERNEL);
+ if (!map) {
+ of_node_put(dma_spec->np);
++ put_device(&pdev->dev);
+ return ERR_PTR(-ENOMEM);
+ }
+
+@@ -274,6 +277,8 @@ static void *ti_dra7_xbar_route_allocate(struct of_phandle_args *dma_spec,
+ mutex_unlock(&xbar->mutex);
+ dev_err(&pdev->dev, "Run out of free DMA requests\n");
+ kfree(map);
++ of_node_put(dma_spec->np);
++ put_device(&pdev->dev);
+ return ERR_PTR(-ENOMEM);
+ }
+ set_bit(map->xbar_out, xbar->dma_inuse);
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index 2150afdcc0837..273f57e277b3d 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -990,6 +990,7 @@ static int cdns_i2c_probe(struct platform_device *pdev)
+ return 0;
+
+ err_clk_dis:
++ clk_notifier_unregister(id->clk, &id->clk_rate_change_nb);
+ clk_disable_unprepare(id->clk);
+ pm_runtime_set_suspended(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index bc565f8e8ac2b..017786d62f474 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -374,7 +374,7 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb,
+
+ static struct notifier_block dmar_pci_bus_nb = {
+ .notifier_call = dmar_pci_bus_notifier,
+- .priority = INT_MIN,
++ .priority = 1,
+ };
+
+ static struct dmar_drhd_unit *
+diff --git a/drivers/misc/cardreader/rtsx_usb.c b/drivers/misc/cardreader/rtsx_usb.c
+index 869c176d48ccd..578d39112229f 100644
+--- a/drivers/misc/cardreader/rtsx_usb.c
++++ b/drivers/misc/cardreader/rtsx_usb.c
+@@ -642,16 +642,20 @@ static int rtsx_usb_probe(struct usb_interface *intf,
+
+ ucr->pusb_dev = usb_dev;
+
+- ucr->iobuf = usb_alloc_coherent(ucr->pusb_dev, IOBUF_SIZE,
+- GFP_KERNEL, &ucr->iobuf_dma);
+- if (!ucr->iobuf)
++ ucr->cmd_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
++ if (!ucr->cmd_buf)
+ return -ENOMEM;
+
++ ucr->rsp_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
++ if (!ucr->rsp_buf) {
++ ret = -ENOMEM;
++ goto out_free_cmd_buf;
++ }
++
+ usb_set_intfdata(intf, ucr);
+
+ ucr->vendor_id = id->idVendor;
+ ucr->product_id = id->idProduct;
+- ucr->cmd_buf = ucr->rsp_buf = ucr->iobuf;
+
+ mutex_init(&ucr->dev_mutex);
+
+@@ -679,8 +683,11 @@ static int rtsx_usb_probe(struct usb_interface *intf,
+
+ out_init_fail:
+ usb_set_intfdata(ucr->pusb_intf, NULL);
+- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
+- ucr->iobuf_dma);
++ kfree(ucr->rsp_buf);
++ ucr->rsp_buf = NULL;
++out_free_cmd_buf:
++ kfree(ucr->cmd_buf);
++ ucr->cmd_buf = NULL;
+ return ret;
+ }
+
+@@ -693,8 +700,12 @@ static void rtsx_usb_disconnect(struct usb_interface *intf)
+ mfd_remove_devices(&intf->dev);
+
+ usb_set_intfdata(ucr->pusb_intf, NULL);
+- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
+- ucr->iobuf_dma);
++
++ kfree(ucr->cmd_buf);
++ ucr->cmd_buf = NULL;
++
++ kfree(ucr->rsp_buf);
++ ucr->rsp_buf = NULL;
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/net/can/grcan.c b/drivers/net/can/grcan.c
+index f07a6ff66d1ce..5d1b7b9d316b7 100644
+--- a/drivers/net/can/grcan.c
++++ b/drivers/net/can/grcan.c
+@@ -1664,7 +1664,6 @@ static int grcan_probe(struct platform_device *ofdev)
+ */
+ sysid_parent = of_find_node_by_path("/ambapp0");
+ if (sysid_parent) {
+- of_node_get(sysid_parent);
+ err = of_property_read_u32(sysid_parent, "systemid", &sysid);
+ if (!err && ((sysid & GRLIB_VERSION_MASK) >=
+ GRCAN_TXBUG_SAFE_GRLIB_VERSION))
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index b2a187bf6c5e4..2101b2fab7df8 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -192,6 +192,8 @@ struct gs_can {
+
+ struct usb_anchor tx_submitted;
+ atomic_t active_tx_urbs;
++ void *rxbuf[GS_MAX_RX_URBS];
++ dma_addr_t rxbuf_dma[GS_MAX_RX_URBS];
+ };
+
+ /* usb interface struct */
+@@ -600,6 +602,7 @@ static int gs_can_open(struct net_device *netdev)
+ for (i = 0; i < GS_MAX_RX_URBS; i++) {
+ struct urb *urb;
+ u8 *buf;
++ dma_addr_t buf_dma;
+
+ /* alloc rx urb */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+@@ -610,7 +613,7 @@ static int gs_can_open(struct net_device *netdev)
+ buf = usb_alloc_coherent(dev->udev,
+ sizeof(struct gs_host_frame),
+ GFP_KERNEL,
+- &urb->transfer_dma);
++ &buf_dma);
+ if (!buf) {
+ netdev_err(netdev,
+ "No memory left for USB buffer\n");
+@@ -618,6 +621,8 @@ static int gs_can_open(struct net_device *netdev)
+ return -ENOMEM;
+ }
+
++ urb->transfer_dma = buf_dma;
++
+ /* fill, anchor, and submit rx urb */
+ usb_fill_bulk_urb(urb,
+ dev->udev,
+@@ -641,10 +646,17 @@ static int gs_can_open(struct net_device *netdev)
+ rc);
+
+ usb_unanchor_urb(urb);
++ usb_free_coherent(dev->udev,
++ sizeof(struct gs_host_frame),
++ buf,
++ buf_dma);
+ usb_free_urb(urb);
+ break;
+ }
+
++ dev->rxbuf[i] = buf;
++ dev->rxbuf_dma[i] = buf_dma;
++
+ /* Drop reference,
+ * USB core will take care of freeing it
+ */
+@@ -709,13 +721,20 @@ static int gs_can_close(struct net_device *netdev)
+ int rc;
+ struct gs_can *dev = netdev_priv(netdev);
+ struct gs_usb *parent = dev->parent;
++ unsigned int i;
+
+ netif_stop_queue(netdev);
+
+ /* Stop polling */
+ parent->active_channels--;
+- if (!parent->active_channels)
++ if (!parent->active_channels) {
+ usb_kill_anchored_urbs(&parent->rx_submitted);
++ for (i = 0; i < GS_MAX_RX_URBS; i++)
++ usb_free_coherent(dev->udev,
++ sizeof(struct gs_host_frame),
++ dev->rxbuf[i],
++ dev->rxbuf_dma[i]);
++ }
+
+ /* Stop sending URBs */
+ usb_kill_anchored_urbs(&dev->tx_submitted);
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
+index 390b6bde883c8..61e67986b625e 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
+@@ -35,9 +35,10 @@
+ #define KVASER_USB_RX_BUFFER_SIZE 3072
+ #define KVASER_USB_MAX_NET_DEVICES 5
+
+-/* USB devices features */
+-#define KVASER_USB_HAS_SILENT_MODE BIT(0)
+-#define KVASER_USB_HAS_TXRX_ERRORS BIT(1)
++/* Kvaser USB device quirks */
++#define KVASER_USB_QUIRK_HAS_SILENT_MODE BIT(0)
++#define KVASER_USB_QUIRK_HAS_TXRX_ERRORS BIT(1)
++#define KVASER_USB_QUIRK_IGNORE_CLK_FREQ BIT(2)
+
+ /* Device capabilities */
+ #define KVASER_USB_CAP_BERR_CAP 0x01
+@@ -65,12 +66,7 @@ struct kvaser_usb_dev_card_data_hydra {
+ struct kvaser_usb_dev_card_data {
+ u32 ctrlmode_supported;
+ u32 capabilities;
+- union {
+- struct {
+- enum kvaser_usb_leaf_family family;
+- } leaf;
+- struct kvaser_usb_dev_card_data_hydra hydra;
+- };
++ struct kvaser_usb_dev_card_data_hydra hydra;
+ };
+
+ /* Context for an outstanding, not yet ACKed, transmission */
+@@ -84,7 +80,7 @@ struct kvaser_usb {
+ struct usb_device *udev;
+ struct usb_interface *intf;
+ struct kvaser_usb_net_priv *nets[KVASER_USB_MAX_NET_DEVICES];
+- const struct kvaser_usb_dev_ops *ops;
++ const struct kvaser_usb_driver_info *driver_info;
+ const struct kvaser_usb_dev_cfg *cfg;
+
+ struct usb_endpoint_descriptor *bulk_in, *bulk_out;
+@@ -166,6 +162,12 @@ struct kvaser_usb_dev_ops {
+ int *cmd_len, u16 transid);
+ };
+
++struct kvaser_usb_driver_info {
++ u32 quirks;
++ enum kvaser_usb_leaf_family family;
++ const struct kvaser_usb_dev_ops *ops;
++};
++
+ struct kvaser_usb_dev_cfg {
+ const struct can_clock clock;
+ const unsigned int timestamp_freq;
+@@ -185,4 +187,7 @@ int kvaser_usb_send_cmd_async(struct kvaser_usb_net_priv *priv, void *cmd,
+ int len);
+
+ int kvaser_usb_can_rx_over_error(struct net_device *netdev);
++
++extern const struct can_bittiming_const kvaser_usb_flexc_bittiming_const;
++
+ #endif /* KVASER_USB_H */
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+index c89c7d4900d75..6e2c15626624f 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+@@ -79,104 +79,134 @@
+ #define USB_ATI_MEMO_PRO_2HS_V2_PRODUCT_ID 269
+ #define USB_HYBRID_PRO_CANLIN_PRODUCT_ID 270
+
+-static inline bool kvaser_is_leaf(const struct usb_device_id *id)
+-{
+- return (id->idProduct >= USB_LEAF_DEVEL_PRODUCT_ID &&
+- id->idProduct <= USB_CAN_R_PRODUCT_ID) ||
+- (id->idProduct >= USB_LEAF_LITE_V2_PRODUCT_ID &&
+- id->idProduct <= USB_MINI_PCIE_2HS_PRODUCT_ID);
+-}
++static const struct kvaser_usb_driver_info kvaser_usb_driver_info_hydra = {
++ .quirks = 0,
++ .ops = &kvaser_usb_hydra_dev_ops,
++};
+
+-static inline bool kvaser_is_usbcan(const struct usb_device_id *id)
+-{
+- return id->idProduct >= USB_USBCAN_REVB_PRODUCT_ID &&
+- id->idProduct <= USB_MEMORATOR_PRODUCT_ID;
+-}
++static const struct kvaser_usb_driver_info kvaser_usb_driver_info_usbcan = {
++ .quirks = KVASER_USB_QUIRK_HAS_TXRX_ERRORS |
++ KVASER_USB_QUIRK_HAS_SILENT_MODE,
++ .family = KVASER_USBCAN,
++ .ops = &kvaser_usb_leaf_dev_ops,
++};
+
+-static inline bool kvaser_is_hydra(const struct usb_device_id *id)
+-{
+- return id->idProduct >= USB_BLACKBIRD_V2_PRODUCT_ID &&
+- id->idProduct <= USB_HYBRID_PRO_CANLIN_PRODUCT_ID;
+-}
++static const struct kvaser_usb_driver_info kvaser_usb_driver_info_leaf = {
++ .quirks = KVASER_USB_QUIRK_IGNORE_CLK_FREQ,
++ .family = KVASER_LEAF,
++ .ops = &kvaser_usb_leaf_dev_ops,
++};
++
++static const struct kvaser_usb_driver_info kvaser_usb_driver_info_leaf_err = {
++ .quirks = KVASER_USB_QUIRK_HAS_TXRX_ERRORS |
++ KVASER_USB_QUIRK_IGNORE_CLK_FREQ,
++ .family = KVASER_LEAF,
++ .ops = &kvaser_usb_leaf_dev_ops,
++};
++
++static const struct kvaser_usb_driver_info kvaser_usb_driver_info_leaf_err_listen = {
++ .quirks = KVASER_USB_QUIRK_HAS_TXRX_ERRORS |
++ KVASER_USB_QUIRK_HAS_SILENT_MODE |
++ KVASER_USB_QUIRK_IGNORE_CLK_FREQ,
++ .family = KVASER_LEAF,
++ .ops = &kvaser_usb_leaf_dev_ops,
++};
++
++static const struct kvaser_usb_driver_info kvaser_usb_driver_info_leafimx = {
++ .quirks = 0,
++ .ops = &kvaser_usb_leaf_dev_ops,
++};
+
+ static const struct usb_device_id kvaser_usb_table[] = {
+- /* Leaf USB product IDs */
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_DEVEL_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_PRODUCT_ID) },
++ /* Leaf M32C USB product IDs */
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_DEVEL_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS |
+- KVASER_USB_HAS_SILENT_MODE },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_SPRO_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS |
+- KVASER_USB_HAS_SILENT_MODE },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_LS_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS |
+- KVASER_USB_HAS_SILENT_MODE },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_SWC_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS |
+- KVASER_USB_HAS_SILENT_MODE },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_LIN_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS |
+- KVASER_USB_HAS_SILENT_MODE },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_SPRO_LS_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS |
+- KVASER_USB_HAS_SILENT_MODE },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_SPRO_SWC_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS |
+- KVASER_USB_HAS_SILENT_MODE },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO2_DEVEL_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS |
+- KVASER_USB_HAS_SILENT_MODE },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO2_HSHS_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS |
+- KVASER_USB_HAS_SILENT_MODE },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_UPRO_HSHS_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_GI_PRODUCT_ID) },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_GI_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_OBDII_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS |
+- KVASER_USB_HAS_SILENT_MODE },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err_listen },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO2_HSLS_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_CH_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_BLACKBIRD_SPRO_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_OEM_MERCURY_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_OEM_LEAF_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_CAN_R_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_V2_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_MINI_PCIE_HS_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LIGHT_HS_V2_OEM_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_LIGHT_2HS_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_MINI_PCIE_2HS_PRODUCT_ID) },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leaf_err },
++
++ /* Leaf i.MX28 USB product IDs */
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_V2_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_MINI_PCIE_HS_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LIGHT_HS_V2_OEM_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_LIGHT_2HS_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_MINI_PCIE_2HS_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_leafimx },
+
+ /* USBCANII USB product IDs */
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN2_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_usbcan },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_REVB_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_usbcan },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMORATOR_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_usbcan },
+ { USB_DEVICE(KVASER_VENDOR_ID, USB_VCI2_PRODUCT_ID),
+- .driver_info = KVASER_USB_HAS_TXRX_ERRORS },
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_usbcan },
+
+ /* Minihydra USB product IDs */
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_BLACKBIRD_V2_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO_PRO_5HS_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_PRO_5HS_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_LIGHT_4HS_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_HS_V2_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_PRO_2HS_V2_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO_2HS_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO_PRO_2HS_V2_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_HYBRID_CANLIN_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_ATI_USBCAN_PRO_2HS_V2_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_ATI_MEMO_PRO_2HS_V2_PRODUCT_ID) },
+- { USB_DEVICE(KVASER_VENDOR_ID, USB_HYBRID_PRO_CANLIN_PRODUCT_ID) },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_BLACKBIRD_V2_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO_PRO_5HS_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_PRO_5HS_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_LIGHT_4HS_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_PRO_HS_V2_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_PRO_2HS_V2_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO_2HS_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_MEMO_PRO_2HS_V2_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_HYBRID_CANLIN_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_ATI_USBCAN_PRO_2HS_V2_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_ATI_MEMO_PRO_2HS_V2_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
++ { USB_DEVICE(KVASER_VENDOR_ID, USB_HYBRID_PRO_CANLIN_PRODUCT_ID),
++ .driver_info = (kernel_ulong_t)&kvaser_usb_driver_info_hydra },
+ { }
+ };
+ MODULE_DEVICE_TABLE(usb, kvaser_usb_table);
+@@ -267,6 +297,7 @@ int kvaser_usb_can_rx_over_error(struct net_device *netdev)
+ static void kvaser_usb_read_bulk_callback(struct urb *urb)
+ {
+ struct kvaser_usb *dev = urb->context;
++ const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
+ int err;
+ unsigned int i;
+
+@@ -283,8 +314,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
+ goto resubmit_urb;
+ }
+
+- dev->ops->dev_read_bulk_callback(dev, urb->transfer_buffer,
+- urb->actual_length);
++ ops->dev_read_bulk_callback(dev, urb->transfer_buffer,
++ urb->actual_length);
+
+ resubmit_urb:
+ usb_fill_bulk_urb(urb, dev->udev,
+@@ -378,6 +409,7 @@ static int kvaser_usb_open(struct net_device *netdev)
+ {
+ struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
+ struct kvaser_usb *dev = priv->dev;
++ const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
+ int err;
+
+ err = open_candev(netdev);
+@@ -388,11 +420,11 @@ static int kvaser_usb_open(struct net_device *netdev)
+ if (err)
+ goto error;
+
+- err = dev->ops->dev_set_opt_mode(priv);
++ err = ops->dev_set_opt_mode(priv);
+ if (err)
+ goto error;
+
+- err = dev->ops->dev_start_chip(priv);
++ err = ops->dev_start_chip(priv);
+ if (err) {
+ netdev_warn(netdev, "Cannot start device, error %d\n", err);
+ goto error;
+@@ -449,22 +481,23 @@ static int kvaser_usb_close(struct net_device *netdev)
+ {
+ struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
+ struct kvaser_usb *dev = priv->dev;
++ const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
+ int err;
+
+ netif_stop_queue(netdev);
+
+- err = dev->ops->dev_flush_queue(priv);
++ err = ops->dev_flush_queue(priv);
+ if (err)
+ netdev_warn(netdev, "Cannot flush queue, error %d\n", err);
+
+- if (dev->ops->dev_reset_chip) {
+- err = dev->ops->dev_reset_chip(dev, priv->channel);
++ if (ops->dev_reset_chip) {
++ err = ops->dev_reset_chip(dev, priv->channel);
+ if (err)
+ netdev_warn(netdev, "Cannot reset card, error %d\n",
+ err);
+ }
+
+- err = dev->ops->dev_stop_chip(priv);
++ err = ops->dev_stop_chip(priv);
+ if (err)
+ netdev_warn(netdev, "Cannot stop device, error %d\n", err);
+
+@@ -503,6 +536,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ {
+ struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
+ struct kvaser_usb *dev = priv->dev;
++ const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
+ struct net_device_stats *stats = &netdev->stats;
+ struct kvaser_usb_tx_urb_context *context = NULL;
+ struct urb *urb;
+@@ -545,8 +579,8 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
+ goto freeurb;
+ }
+
+- buf = dev->ops->dev_frame_to_cmd(priv, skb, &context->dlc, &cmd_len,
+- context->echo_index);
++ buf = ops->dev_frame_to_cmd(priv, skb, &context->dlc, &cmd_len,
++ context->echo_index);
+ if (!buf) {
+ stats->tx_dropped++;
+ dev_kfree_skb(skb);
+@@ -630,15 +664,16 @@ static void kvaser_usb_remove_interfaces(struct kvaser_usb *dev)
+ }
+ }
+
+-static int kvaser_usb_init_one(struct kvaser_usb *dev,
+- const struct usb_device_id *id, int channel)
++static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel)
+ {
+ struct net_device *netdev;
+ struct kvaser_usb_net_priv *priv;
++ const struct kvaser_usb_driver_info *driver_info = dev->driver_info;
++ const struct kvaser_usb_dev_ops *ops = driver_info->ops;
+ int err;
+
+- if (dev->ops->dev_reset_chip) {
+- err = dev->ops->dev_reset_chip(dev, channel);
++ if (ops->dev_reset_chip) {
++ err = ops->dev_reset_chip(dev, channel);
+ if (err)
+ return err;
+ }
+@@ -668,20 +703,19 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev,
+ priv->can.state = CAN_STATE_STOPPED;
+ priv->can.clock.freq = dev->cfg->clock.freq;
+ priv->can.bittiming_const = dev->cfg->bittiming_const;
+- priv->can.do_set_bittiming = dev->ops->dev_set_bittiming;
+- priv->can.do_set_mode = dev->ops->dev_set_mode;
+- if ((id->driver_info & KVASER_USB_HAS_TXRX_ERRORS) ||
++ priv->can.do_set_bittiming = ops->dev_set_bittiming;
++ priv->can.do_set_mode = ops->dev_set_mode;
++ if ((driver_info->quirks & KVASER_USB_QUIRK_HAS_TXRX_ERRORS) ||
+ (priv->dev->card_data.capabilities & KVASER_USB_CAP_BERR_CAP))
+- priv->can.do_get_berr_counter = dev->ops->dev_get_berr_counter;
+- if (id->driver_info & KVASER_USB_HAS_SILENT_MODE)
++ priv->can.do_get_berr_counter = ops->dev_get_berr_counter;
++ if (driver_info->quirks & KVASER_USB_QUIRK_HAS_SILENT_MODE)
+ priv->can.ctrlmode_supported |= CAN_CTRLMODE_LISTENONLY;
+
+ priv->can.ctrlmode_supported |= dev->card_data.ctrlmode_supported;
+
+ if (priv->can.ctrlmode_supported & CAN_CTRLMODE_FD) {
+ priv->can.data_bittiming_const = dev->cfg->data_bittiming_const;
+- priv->can.do_set_data_bittiming =
+- dev->ops->dev_set_data_bittiming;
++ priv->can.do_set_data_bittiming = ops->dev_set_data_bittiming;
+ }
+
+ netdev->flags |= IFF_ECHO;
+@@ -712,29 +746,22 @@ static int kvaser_usb_probe(struct usb_interface *intf,
+ struct kvaser_usb *dev;
+ int err;
+ int i;
++ const struct kvaser_usb_driver_info *driver_info;
++ const struct kvaser_usb_dev_ops *ops;
++
++ driver_info = (const struct kvaser_usb_driver_info *)id->driver_info;
++ if (!driver_info)
++ return -ENODEV;
+
+ dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL);
+ if (!dev)
+ return -ENOMEM;
+
+- if (kvaser_is_leaf(id)) {
+- dev->card_data.leaf.family = KVASER_LEAF;
+- dev->ops = &kvaser_usb_leaf_dev_ops;
+- } else if (kvaser_is_usbcan(id)) {
+- dev->card_data.leaf.family = KVASER_USBCAN;
+- dev->ops = &kvaser_usb_leaf_dev_ops;
+- } else if (kvaser_is_hydra(id)) {
+- dev->ops = &kvaser_usb_hydra_dev_ops;
+- } else {
+- dev_err(&intf->dev,
+- "Product ID (%d) is not a supported Kvaser USB device\n",
+- id->idProduct);
+- return -ENODEV;
+- }
+-
+ dev->intf = intf;
++ dev->driver_info = driver_info;
++ ops = driver_info->ops;
+
+- err = dev->ops->dev_setup_endpoints(dev);
++ err = ops->dev_setup_endpoints(dev);
+ if (err) {
+ dev_err(&intf->dev, "Cannot get usb endpoint(s)");
+ return err;
+@@ -748,22 +775,22 @@ static int kvaser_usb_probe(struct usb_interface *intf,
+
+ dev->card_data.ctrlmode_supported = 0;
+ dev->card_data.capabilities = 0;
+- err = dev->ops->dev_init_card(dev);
++ err = ops->dev_init_card(dev);
+ if (err) {
+ dev_err(&intf->dev,
+ "Failed to initialize card, error %d\n", err);
+ return err;
+ }
+
+- err = dev->ops->dev_get_software_info(dev);
++ err = ops->dev_get_software_info(dev);
+ if (err) {
+ dev_err(&intf->dev,
+ "Cannot get software info, error %d\n", err);
+ return err;
+ }
+
+- if (dev->ops->dev_get_software_details) {
+- err = dev->ops->dev_get_software_details(dev);
++ if (ops->dev_get_software_details) {
++ err = ops->dev_get_software_details(dev);
+ if (err) {
+ dev_err(&intf->dev,
+ "Cannot get software details, error %d\n", err);
+@@ -781,14 +808,14 @@ static int kvaser_usb_probe(struct usb_interface *intf,
+
+ dev_dbg(&intf->dev, "Max outstanding tx = %d URBs\n", dev->max_tx_urbs);
+
+- err = dev->ops->dev_get_card_info(dev);
++ err = ops->dev_get_card_info(dev);
+ if (err) {
+ dev_err(&intf->dev, "Cannot get card info, error %d\n", err);
+ return err;
+ }
+
+- if (dev->ops->dev_get_capabilities) {
+- err = dev->ops->dev_get_capabilities(dev);
++ if (ops->dev_get_capabilities) {
++ err = ops->dev_get_capabilities(dev);
+ if (err) {
+ dev_err(&intf->dev,
+ "Cannot get capabilities, error %d\n", err);
+@@ -798,7 +825,7 @@ static int kvaser_usb_probe(struct usb_interface *intf,
+ }
+
+ for (i = 0; i < dev->nchannels; i++) {
+- err = kvaser_usb_init_one(dev, id, i);
++ err = kvaser_usb_init_one(dev, i);
+ if (err) {
+ kvaser_usb_remove_interfaces(dev);
+ return err;
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index 218fadc911558..a7c408acb0c09 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -371,7 +371,7 @@ static const struct can_bittiming_const kvaser_usb_hydra_kcan_bittiming_c = {
+ .brp_inc = 1,
+ };
+
+-static const struct can_bittiming_const kvaser_usb_hydra_flexc_bittiming_c = {
++const struct can_bittiming_const kvaser_usb_flexc_bittiming_const = {
+ .name = "kvaser_usb_flex",
+ .tseg1_min = 4,
+ .tseg1_max = 16,
+@@ -2024,5 +2024,5 @@ static const struct kvaser_usb_dev_cfg kvaser_usb_hydra_dev_cfg_flexc = {
+ .freq = 24000000,
+ },
+ .timestamp_freq = 1,
+- .bittiming_const = &kvaser_usb_hydra_flexc_bittiming_c,
++ .bittiming_const = &kvaser_usb_flexc_bittiming_const,
+ };
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+index 8b5d1add899a6..0e0403dd05500 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -100,16 +100,6 @@
+ #define USBCAN_ERROR_STATE_RX_ERROR BIT(1)
+ #define USBCAN_ERROR_STATE_BUSERROR BIT(2)
+
+-/* bittiming parameters */
+-#define KVASER_USB_TSEG1_MIN 1
+-#define KVASER_USB_TSEG1_MAX 16
+-#define KVASER_USB_TSEG2_MIN 1
+-#define KVASER_USB_TSEG2_MAX 8
+-#define KVASER_USB_SJW_MAX 4
+-#define KVASER_USB_BRP_MIN 1
+-#define KVASER_USB_BRP_MAX 64
+-#define KVASER_USB_BRP_INC 1
+-
+ /* ctrl modes */
+ #define KVASER_CTRL_MODE_NORMAL 1
+ #define KVASER_CTRL_MODE_SILENT 2
+@@ -342,48 +332,68 @@ struct kvaser_usb_err_summary {
+ };
+ };
+
+-static const struct can_bittiming_const kvaser_usb_leaf_bittiming_const = {
+- .name = "kvaser_usb",
+- .tseg1_min = KVASER_USB_TSEG1_MIN,
+- .tseg1_max = KVASER_USB_TSEG1_MAX,
+- .tseg2_min = KVASER_USB_TSEG2_MIN,
+- .tseg2_max = KVASER_USB_TSEG2_MAX,
+- .sjw_max = KVASER_USB_SJW_MAX,
+- .brp_min = KVASER_USB_BRP_MIN,
+- .brp_max = KVASER_USB_BRP_MAX,
+- .brp_inc = KVASER_USB_BRP_INC,
++static const struct can_bittiming_const kvaser_usb_leaf_m16c_bittiming_const = {
++ .name = "kvaser_usb_ucii",
++ .tseg1_min = 4,
++ .tseg1_max = 16,
++ .tseg2_min = 2,
++ .tseg2_max = 8,
++ .sjw_max = 4,
++ .brp_min = 1,
++ .brp_max = 16,
++ .brp_inc = 1,
++};
++
++static const struct can_bittiming_const kvaser_usb_leaf_m32c_bittiming_const = {
++ .name = "kvaser_usb_leaf",
++ .tseg1_min = 3,
++ .tseg1_max = 16,
++ .tseg2_min = 2,
++ .tseg2_max = 8,
++ .sjw_max = 4,
++ .brp_min = 2,
++ .brp_max = 128,
++ .brp_inc = 2,
+ };
+
+-static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_dev_cfg_8mhz = {
++static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_usbcan_dev_cfg = {
+ .clock = {
+ .freq = 8000000,
+ },
+ .timestamp_freq = 1,
+- .bittiming_const = &kvaser_usb_leaf_bittiming_const,
++ .bittiming_const = &kvaser_usb_leaf_m16c_bittiming_const,
++};
++
++static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_m32c_dev_cfg = {
++ .clock = {
++ .freq = 16000000,
++ },
++ .timestamp_freq = 1,
++ .bittiming_const = &kvaser_usb_leaf_m32c_bittiming_const,
+ };
+
+-static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_dev_cfg_16mhz = {
++static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_imx_dev_cfg_16mhz = {
+ .clock = {
+ .freq = 16000000,
+ },
+ .timestamp_freq = 1,
+- .bittiming_const = &kvaser_usb_leaf_bittiming_const,
++ .bittiming_const = &kvaser_usb_flexc_bittiming_const,
+ };
+
+-static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_dev_cfg_24mhz = {
++static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_imx_dev_cfg_24mhz = {
+ .clock = {
+ .freq = 24000000,
+ },
+ .timestamp_freq = 1,
+- .bittiming_const = &kvaser_usb_leaf_bittiming_const,
++ .bittiming_const = &kvaser_usb_flexc_bittiming_const,
+ };
+
+-static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_dev_cfg_32mhz = {
++static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_imx_dev_cfg_32mhz = {
+ .clock = {
+ .freq = 32000000,
+ },
+ .timestamp_freq = 1,
+- .bittiming_const = &kvaser_usb_leaf_bittiming_const,
++ .bittiming_const = &kvaser_usb_flexc_bittiming_const,
+ };
+
+ static void *
+@@ -405,7 +415,7 @@ kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv,
+ sizeof(struct kvaser_cmd_tx_can);
+ cmd->u.tx_can.channel = priv->channel;
+
+- switch (dev->card_data.leaf.family) {
++ switch (dev->driver_info->family) {
+ case KVASER_LEAF:
+ cmd_tx_can_flags = &cmd->u.tx_can.leaf.flags;
+ break;
+@@ -525,16 +535,23 @@ static void kvaser_usb_leaf_get_software_info_leaf(struct kvaser_usb *dev,
+ dev->fw_version = le32_to_cpu(softinfo->fw_version);
+ dev->max_tx_urbs = le16_to_cpu(softinfo->max_outstanding_tx);
+
+- switch (sw_options & KVASER_USB_LEAF_SWOPTION_FREQ_MASK) {
+- case KVASER_USB_LEAF_SWOPTION_FREQ_16_MHZ_CLK:
+- dev->cfg = &kvaser_usb_leaf_dev_cfg_16mhz;
+- break;
+- case KVASER_USB_LEAF_SWOPTION_FREQ_24_MHZ_CLK:
+- dev->cfg = &kvaser_usb_leaf_dev_cfg_24mhz;
+- break;
+- case KVASER_USB_LEAF_SWOPTION_FREQ_32_MHZ_CLK:
+- dev->cfg = &kvaser_usb_leaf_dev_cfg_32mhz;
+- break;
++ if (dev->driver_info->quirks & KVASER_USB_QUIRK_IGNORE_CLK_FREQ) {
++ /* Firmware expects bittiming parameters calculated for 16MHz
++ * clock, regardless of the actual clock
++ */
++ dev->cfg = &kvaser_usb_leaf_m32c_dev_cfg;
++ } else {
++ switch (sw_options & KVASER_USB_LEAF_SWOPTION_FREQ_MASK) {
++ case KVASER_USB_LEAF_SWOPTION_FREQ_16_MHZ_CLK:
++ dev->cfg = &kvaser_usb_leaf_imx_dev_cfg_16mhz;
++ break;
++ case KVASER_USB_LEAF_SWOPTION_FREQ_24_MHZ_CLK:
++ dev->cfg = &kvaser_usb_leaf_imx_dev_cfg_24mhz;
++ break;
++ case KVASER_USB_LEAF_SWOPTION_FREQ_32_MHZ_CLK:
++ dev->cfg = &kvaser_usb_leaf_imx_dev_cfg_32mhz;
++ break;
++ }
+ }
+ }
+
+@@ -551,7 +568,7 @@ static int kvaser_usb_leaf_get_software_info_inner(struct kvaser_usb *dev)
+ if (err)
+ return err;
+
+- switch (dev->card_data.leaf.family) {
++ switch (dev->driver_info->family) {
+ case KVASER_LEAF:
+ kvaser_usb_leaf_get_software_info_leaf(dev, &cmd.u.leaf.softinfo);
+ break;
+@@ -559,7 +576,7 @@ static int kvaser_usb_leaf_get_software_info_inner(struct kvaser_usb *dev)
+ dev->fw_version = le32_to_cpu(cmd.u.usbcan.softinfo.fw_version);
+ dev->max_tx_urbs =
+ le16_to_cpu(cmd.u.usbcan.softinfo.max_outstanding_tx);
+- dev->cfg = &kvaser_usb_leaf_dev_cfg_8mhz;
++ dev->cfg = &kvaser_usb_leaf_usbcan_dev_cfg;
+ break;
+ }
+
+@@ -598,7 +615,7 @@ static int kvaser_usb_leaf_get_card_info(struct kvaser_usb *dev)
+
+ dev->nchannels = cmd.u.cardinfo.nchannels;
+ if (dev->nchannels > KVASER_USB_MAX_NET_DEVICES ||
+- (dev->card_data.leaf.family == KVASER_USBCAN &&
++ (dev->driver_info->family == KVASER_USBCAN &&
+ dev->nchannels > MAX_USBCAN_NET_DEVICES))
+ return -EINVAL;
+
+@@ -734,7 +751,7 @@ kvaser_usb_leaf_rx_error_update_can_state(struct kvaser_usb_net_priv *priv,
+ new_state < CAN_STATE_BUS_OFF)
+ priv->can.can_stats.restarts++;
+
+- switch (dev->card_data.leaf.family) {
++ switch (dev->driver_info->family) {
+ case KVASER_LEAF:
+ if (es->leaf.error_factor) {
+ priv->can.can_stats.bus_error++;
+@@ -813,7 +830,7 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev,
+ }
+ }
+
+- switch (dev->card_data.leaf.family) {
++ switch (dev->driver_info->family) {
+ case KVASER_LEAF:
+ if (es->leaf.error_factor) {
+ cf->can_id |= CAN_ERR_BUSERROR | CAN_ERR_PROT;
+@@ -1005,7 +1022,7 @@ static void kvaser_usb_leaf_rx_can_msg(const struct kvaser_usb *dev,
+ stats = &priv->netdev->stats;
+
+ if ((cmd->u.rx_can_header.flag & MSG_FLAG_ERROR_FRAME) &&
+- (dev->card_data.leaf.family == KVASER_LEAF &&
++ (dev->driver_info->family == KVASER_LEAF &&
+ cmd->id == CMD_LEAF_LOG_MESSAGE)) {
+ kvaser_usb_leaf_leaf_rx_error(dev, cmd);
+ return;
+@@ -1021,7 +1038,7 @@ static void kvaser_usb_leaf_rx_can_msg(const struct kvaser_usb *dev,
+ return;
+ }
+
+- switch (dev->card_data.leaf.family) {
++ switch (dev->driver_info->family) {
+ case KVASER_LEAF:
+ rx_data = cmd->u.leaf.rx_can.data;
+ break;
+@@ -1036,7 +1053,7 @@ static void kvaser_usb_leaf_rx_can_msg(const struct kvaser_usb *dev,
+ return;
+ }
+
+- if (dev->card_data.leaf.family == KVASER_LEAF && cmd->id ==
++ if (dev->driver_info->family == KVASER_LEAF && cmd->id ==
+ CMD_LEAF_LOG_MESSAGE) {
+ cf->can_id = le32_to_cpu(cmd->u.leaf.log_message.id);
+ if (cf->can_id & KVASER_EXTENDED_FRAME)
+@@ -1133,14 +1150,14 @@ static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev,
+ break;
+
+ case CMD_LEAF_LOG_MESSAGE:
+- if (dev->card_data.leaf.family != KVASER_LEAF)
++ if (dev->driver_info->family != KVASER_LEAF)
+ goto warn;
+ kvaser_usb_leaf_rx_can_msg(dev, cmd);
+ break;
+
+ case CMD_CHIP_STATE_EVENT:
+ case CMD_CAN_ERROR_EVENT:
+- if (dev->card_data.leaf.family == KVASER_LEAF)
++ if (dev->driver_info->family == KVASER_LEAF)
+ kvaser_usb_leaf_leaf_rx_error(dev, cmd);
+ else
+ kvaser_usb_leaf_usbcan_rx_error(dev, cmd);
+@@ -1152,12 +1169,12 @@ static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev,
+
+ /* Ignored commands */
+ case CMD_USBCAN_CLOCK_OVERFLOW_EVENT:
+- if (dev->card_data.leaf.family != KVASER_USBCAN)
++ if (dev->driver_info->family != KVASER_USBCAN)
+ goto warn;
+ break;
+
+ case CMD_FLUSH_QUEUE_REPLY:
+- if (dev->card_data.leaf.family != KVASER_LEAF)
++ if (dev->driver_info->family != KVASER_LEAF)
+ goto warn;
+ break;
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index ae3eea4a4213e..1463cf4321a83 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -4691,6 +4691,15 @@ static int ibmvnic_reset_init(struct ibmvnic_adapter *adapter)
+ release_sub_crqs(adapter, 0);
+ rc = init_sub_crqs(adapter);
+ } else {
++ /* no need to reinitialize completely, but we do
++ * need to clean up transmits that were in flight
++ * when we processed the reset. Failure to do so
++ * will confound the upper layer, usually TCP, by
++ * creating the illusion of transmits that are
++ * awaiting completion.
++ */
++ clean_tx_pools(adapter);
++
+ rc = reset_sub_crq_queues(adapter);
+ }
+ } else {
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 2aa28c961d260..e5c7a5c051090 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -2131,7 +2131,7 @@ static void usbnet_async_cmd_cb(struct urb *urb)
+ int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype,
+ u16 value, u16 index, const void *data, u16 size)
+ {
+- struct usb_ctrlrequest *req = NULL;
++ struct usb_ctrlrequest *req;
+ struct urb *urb;
+ int err = -ENOMEM;
+ void *buf = NULL;
+@@ -2149,7 +2149,7 @@ int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype,
+ if (!buf) {
+ netdev_err(dev->net, "Error allocating buffer"
+ " in %s!\n", __func__);
+- goto fail_free;
++ goto fail_free_urb;
+ }
+ }
+
+@@ -2173,14 +2173,21 @@ int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype,
+ if (err < 0) {
+ netdev_err(dev->net, "Error submitting the control"
+ " message: status=%d\n", err);
+- goto fail_free;
++ goto fail_free_all;
+ }
+ return 0;
+
++fail_free_all:
++ kfree(req);
+ fail_free_buf:
+ kfree(buf);
+-fail_free:
+- kfree(req);
++ /*
++ * avoid a double free
++ * needed because the flag can be set only
++ * after filling the URB
++ */
++ urb->transfer_flags = 0;
++fail_free_urb:
+ usb_free_urb(urb);
+ fail:
+ return err;
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+index 4ada80317a3bd..b5c1a8f363f32 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+@@ -158,26 +158,26 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = {
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 14),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+- SUNXI_FUNCTION(0x2, "nand"), /* DQ6 */
++ SUNXI_FUNCTION(0x2, "nand0"), /* DQ6 */
+ SUNXI_FUNCTION(0x3, "mmc2")), /* D6 */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 15),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+- SUNXI_FUNCTION(0x2, "nand"), /* DQ7 */
++ SUNXI_FUNCTION(0x2, "nand0"), /* DQ7 */
+ SUNXI_FUNCTION(0x3, "mmc2")), /* D7 */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 16),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+- SUNXI_FUNCTION(0x2, "nand"), /* DQS */
++ SUNXI_FUNCTION(0x2, "nand0"), /* DQS */
+ SUNXI_FUNCTION(0x3, "mmc2")), /* RST */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 17),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+- SUNXI_FUNCTION(0x2, "nand")), /* CE2 */
++ SUNXI_FUNCTION(0x2, "nand0")), /* CE2 */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 18),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+- SUNXI_FUNCTION(0x2, "nand")), /* CE3 */
++ SUNXI_FUNCTION(0x2, "nand0")), /* CE3 */
+ /* Hole */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(D, 2),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 7c2582892eabe..17ed20a73c2db 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -2468,6 +2468,11 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font,
+ if (charcount != 256 && charcount != 512)
+ return -EINVAL;
+
++ /* font bigger than screen resolution ? */
++ if (w > FBCON_SWAP(info->var.rotate, info->var.xres, info->var.yres) ||
++ h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres))
++ return -EINVAL;
++
+ /* Make sure drawing engine can handle the font */
+ if (!(info->pixmap.blit_x & (1 << (font->width - 1))) ||
+ !(info->pixmap.blit_y & (1 << (font->height - 1))))
+diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
+index cd81d6d9848d1..0370ee34b71c4 100644
+--- a/fs/xfs/xfs_inode.c
++++ b/fs/xfs/xfs_inode.c
+@@ -2899,7 +2899,6 @@ xfs_rename(
+ * appropriately.
+ */
+ if (flags & RENAME_WHITEOUT) {
+- ASSERT(!(flags & (RENAME_NOREPLACE | RENAME_EXCHANGE)));
+ error = xfs_rename_alloc_whiteout(target_dp, &wip);
+ if (error)
+ return error;
+diff --git a/include/linux/rtsx_usb.h b/include/linux/rtsx_usb.h
+index c446e4fd6b5cc..09b08ff08830c 100644
+--- a/include/linux/rtsx_usb.h
++++ b/include/linux/rtsx_usb.h
+@@ -65,8 +65,6 @@ struct rtsx_ucr {
+ struct usb_device *pusb_dev;
+ struct usb_interface *pusb_intf;
+ struct usb_sg_request current_sg;
+- unsigned char *iobuf;
+- dma_addr_t iobuf_dma;
+
+ struct timer_list sg_timer;
+ struct mutex dev_mutex;
+diff --git a/include/net/esp.h b/include/net/esp.h
+index 465e38890ee98..117652eb6ea32 100644
+--- a/include/net/esp.h
++++ b/include/net/esp.h
+@@ -4,8 +4,6 @@
+
+ #include <linux/skbuff.h>
+
+-#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER)
+-
+ struct ip_esp_hdr;
+
+ static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb)
+diff --git a/include/video/of_display_timing.h b/include/video/of_display_timing.h
+index bb29e59540006..338f3839a299f 100644
+--- a/include/video/of_display_timing.h
++++ b/include/video/of_display_timing.h
+@@ -9,6 +9,8 @@
+ #ifndef __LINUX_OF_DISPLAY_TIMING_H
+ #define __LINUX_OF_DISPLAY_TIMING_H
+
++#include <linux/errno.h>
++
+ struct device_node;
+ struct display_timing;
+ struct display_timings;
+diff --git a/lib/idr.c b/lib/idr.c
+index 6ff3b1c36e0a5..82c24a417dc65 100644
+--- a/lib/idr.c
++++ b/lib/idr.c
+@@ -573,7 +573,9 @@ void ida_free(struct ida *ida, unsigned int id)
+ {
+ unsigned long flags;
+
+- BUG_ON((int)id < 0);
++ if ((int)id < 0)
++ return;
++
+ xa_lock_irqsave(&ida->ida_rt, flags);
+ ida_remove(ida, id);
+ xa_unlock_irqrestore(&ida->ida_rt, flags);
+diff --git a/mm/slub.c b/mm/slub.c
+index 499fb073d1ffd..0fefe0ad8f572 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -2162,6 +2162,7 @@ redo:
+
+ c->page = NULL;
+ c->freelist = NULL;
++ c->tid = next_tid(c->tid);
+ }
+
+ /*
+@@ -2295,8 +2296,6 @@ static inline void flush_slab(struct kmem_cache *s, struct kmem_cache_cpu *c)
+ {
+ stat(s, CPUSLAB_FLUSH);
+ deactivate_slab(s, c->page, c->freelist, c);
+-
+- c->tid = next_tid(c->tid);
+ }
+
+ /*
+@@ -2583,6 +2582,7 @@ redo:
+
+ if (!freelist) {
+ c->page = NULL;
++ c->tid = next_tid(c->tid);
+ stat(s, DEACTIVATE_BYPASS);
+ goto new_slab;
+ }
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 353098166031b..3c825b158fb57 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -99,6 +99,7 @@ static inline u64 get_u64(const struct canfd_frame *cp, int offset)
+
+ struct bcm_op {
+ struct list_head list;
++ struct rcu_head rcu;
+ int ifindex;
+ canid_t can_id;
+ u32 flags;
+@@ -717,10 +718,9 @@ static struct bcm_op *bcm_find_op(struct list_head *ops,
+ return NULL;
+ }
+
+-static void bcm_remove_op(struct bcm_op *op)
++static void bcm_free_op_rcu(struct rcu_head *rcu_head)
+ {
+- hrtimer_cancel(&op->timer);
+- hrtimer_cancel(&op->thrtimer);
++ struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu);
+
+ if ((op->frames) && (op->frames != &op->sframe))
+ kfree(op->frames);
+@@ -731,6 +731,14 @@ static void bcm_remove_op(struct bcm_op *op)
+ kfree(op);
+ }
+
++static void bcm_remove_op(struct bcm_op *op)
++{
++ hrtimer_cancel(&op->timer);
++ hrtimer_cancel(&op->thrtimer);
++
++ call_rcu(&op->rcu, bcm_free_op_rcu);
++}
++
+ static void bcm_rx_unreg(struct net_device *dev, struct bcm_op *op)
+ {
+ if (op->rx_reg_dev == dev) {
+@@ -756,6 +764,9 @@ static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh,
+ if ((op->can_id == mh->can_id) && (op->ifindex == ifindex) &&
+ (op->flags & CAN_FD_FRAME) == (mh->flags & CAN_FD_FRAME)) {
+
++ /* disable automatic timer on frame reception */
++ op->flags |= RX_NO_AUTOTIMER;
++
+ /*
+ * Don't care if we're bound or not (due to netdev
+ * problems) can_rx_unregister() is always a save
+@@ -784,7 +795,6 @@ static int bcm_delete_rx_op(struct list_head *ops, struct bcm_msg_head *mh,
+ bcm_rx_handler, op);
+
+ list_del(&op->list);
+- synchronize_rcu();
+ bcm_remove_op(op);
+ return 1; /* done */
+ }
+diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
+index 45bb5b60b9940..203569500b914 100644
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -275,7 +275,6 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
+ struct page *page;
+ struct sk_buff *trailer;
+ int tailen = esp->tailen;
+- unsigned int allocsz;
+
+ /* this is non-NULL only with UDP Encapsulation */
+ if (x->encap) {
+@@ -285,8 +284,8 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
+ return err;
+ }
+
+- allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+- if (allocsz > ESP_SKB_FRAG_MAXSIZE)
++ if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
++ ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
+ goto cow;
+
+ if (!skb_cloned(skb)) {
+diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
+index e3abfc97fde7f..d847ffbe97451 100644
+--- a/net/ipv6/esp6.c
++++ b/net/ipv6/esp6.c
+@@ -241,10 +241,9 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
+ struct page *page;
+ struct sk_buff *trailer;
+ int tailen = esp->tailen;
+- unsigned int allocsz;
+
+- allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+- if (allocsz > ESP_SKB_FRAG_MAXSIZE)
++ if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
++ ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
+ goto cow;
+
+ if (!skb_cloned(skb)) {
+diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
+index f2ff21d7df081..46ae92d703247 100644
+--- a/net/rose/rose_route.c
++++ b/net/rose/rose_route.c
+@@ -230,8 +230,8 @@ static void rose_remove_neigh(struct rose_neigh *rose_neigh)
+ {
+ struct rose_neigh *s;
+
+- rose_stop_ftimer(rose_neigh);
+- rose_stop_t0timer(rose_neigh);
++ del_timer_sync(&rose_neigh->ftimer);
++ del_timer_sync(&rose_neigh->t0timer);
+
+ skb_queue_purge(&rose_neigh->queue);
+
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index 08bac6cf1bb3a..ee03552b41167 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -819,6 +819,7 @@ learning_test()
+ # FDB entry was installed.
+ bridge link set dev $br_port1 flood off
+
++ ip link set $host1_if promisc on
+ tc qdisc add dev $host1_if ingress
+ tc filter add dev $host1_if ingress protocol ip pref 1 handle 101 \
+ flower dst_mac $mac action drop
+@@ -829,7 +830,7 @@ learning_test()
+ tc -j -s filter show dev $host1_if ingress \
+ | jq -e ".[] | select(.options.handle == 101) \
+ | select(.options.actions[0].stats.packets == 1)" &> /dev/null
+- check_fail $? "Packet reached second host when should not"
++ check_fail $? "Packet reached first host when should not"
+
+ $MZ $host1_if -c 1 -p 64 -a $mac -t ip -q
+ sleep 1
+@@ -868,6 +869,7 @@ learning_test()
+
+ tc filter del dev $host1_if ingress protocol ip pref 1 handle 101 flower
+ tc qdisc del dev $host1_if ingress
++ ip link set $host1_if promisc off
+
+ bridge link set dev $br_port1 flood on
+
+@@ -885,6 +887,7 @@ flood_test_do()
+
+ # Add an ACL on `host2_if` which will tell us whether the packet
+ # was flooded to it or not.
++ ip link set $host2_if promisc on
+ tc qdisc add dev $host2_if ingress
+ tc filter add dev $host2_if ingress protocol ip pref 1 handle 101 \
+ flower dst_mac $mac action drop
+@@ -902,6 +905,7 @@ flood_test_do()
+
+ tc filter del dev $host2_if ingress protocol ip pref 1 handle 101 flower
+ tc qdisc del dev $host2_if ingress
++ ip link set $host2_if promisc off
+
+ return $err
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-07-21 20:12 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-07-21 20:12 UTC (permalink / raw
To: gentoo-commits
commit: 70c485eb8f970d611810594b4e7b836b2a86ead0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jul 21 20:11:53 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jul 21 20:11:53 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=70c485eb
Linux patch 4.19.253
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 8 +
1252_linux-4.19.253.patch | 1225 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1233 insertions(+)
diff --git a/0000_README b/0000_README
index 0126558b..fc61f80f 100644
--- a/0000_README
+++ b/0000_README
@@ -1047,6 +1047,14 @@ Patch: 1251_linux-4.19.252.patch
From: https://www.kernel.org
Desc: Linux 4.19.252
+Patch: 1251_linux-4.19.252.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.252
+
+Patch: 1252_linux-4.19.253.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.253
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1252_linux-4.19.253.patch b/1252_linux-4.19.253.patch
new file mode 100644
index 00000000..3f890a7f
--- /dev/null
+++ b/1252_linux-4.19.253.patch
@@ -0,0 +1,1225 @@
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index 3c617d620b6f8..e315e6052b9fb 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -810,7 +810,7 @@ cipso_cache_enable - BOOLEAN
+ cipso_cache_bucket_size - INTEGER
+ The CIPSO label cache consists of a fixed size hash table with each
+ hash bucket containing a number of cache entries. This variable limits
+- the number of entries in each hash bucket; the larger the value the
++ the number of entries in each hash bucket; the larger the value is, the
+ more CIPSO label mappings that can be cached. When the number of
+ entries in a given hash bucket reaches this limit adding new entries
+ causes the oldest entry in the bucket to be removed to make room.
+@@ -887,7 +887,7 @@ ip_nonlocal_bind - BOOLEAN
+ which can be quite useful - but may break some applications.
+ Default: 0
+
+-ip_dynaddr - BOOLEAN
++ip_dynaddr - INTEGER
+ If set non-zero, enables support for dynamic addresses.
+ If set to a non-zero value larger than 1, a kernel log
+ message will be printed when dynamic address rewriting
+diff --git a/Makefile b/Makefile
+index 73a75363bba0b..7ae832b9156ff 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 252
++SUBLEVEL = 253
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi
+index f0be516dc28e1..9181fbeb833d3 100644
+--- a/arch/arm/boot/dts/imx6qdl-ts7970.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-ts7970.dtsi
+@@ -226,7 +226,7 @@
+ reg = <0x28>;
+ #gpio-cells = <2>;
+ gpio-controller;
+- ngpio = <32>;
++ ngpios = <62>;
+ };
+
+ sgtl5000: codec@a {
+diff --git a/arch/arm/boot/dts/stm32mp157c.dtsi b/arch/arm/boot/dts/stm32mp157c.dtsi
+index 4278a4b228606..7c5b2727ba2e8 100644
+--- a/arch/arm/boot/dts/stm32mp157c.dtsi
++++ b/arch/arm/boot/dts/stm32mp157c.dtsi
+@@ -413,7 +413,7 @@
+ compatible = "st,stm32-cec";
+ reg = <0x40016000 0x400>;
+ interrupts = <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&rcc CEC_K>, <&clk_lse>;
++ clocks = <&rcc CEC_K>, <&rcc CEC>;
+ clock-names = "cec", "hdmi-cec";
+ status = "disabled";
+ };
+diff --git a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
+index 84cd9c0612275..afc94dbc0752e 100644
+--- a/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
++++ b/arch/arm/boot/dts/sun8i-h2-plus-orangepi-zero.dts
+@@ -170,7 +170,7 @@
+ flash@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "mxicy,mx25l1606e", "winbond,w25q128";
++ compatible = "mxicy,mx25l1606e", "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <40000000>;
+ };
+diff --git a/arch/arm/include/asm/ptrace.h b/arch/arm/include/asm/ptrace.h
+index c7cdbb43ae7c4..15e850aeaecbb 100644
+--- a/arch/arm/include/asm/ptrace.h
++++ b/arch/arm/include/asm/ptrace.h
+@@ -167,5 +167,31 @@ static inline unsigned long user_stack_pointer(struct pt_regs *regs)
+ ((current_stack_pointer | (THREAD_SIZE - 1)) - 7) - 1; \
+ })
+
++
++/*
++ * Update ITSTATE after normal execution of an IT block instruction.
++ *
++ * The 8 IT state bits are split into two parts in CPSR:
++ * ITSTATE<1:0> are in CPSR<26:25>
++ * ITSTATE<7:2> are in CPSR<15:10>
++ */
++static inline unsigned long it_advance(unsigned long cpsr)
++{
++ if ((cpsr & 0x06000400) == 0) {
++ /* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */
++ cpsr &= ~PSR_IT_MASK;
++ } else {
++ /* We need to shift left ITSTATE<4:0> */
++ const unsigned long mask = 0x06001c00; /* Mask ITSTATE<4:0> */
++ unsigned long it = cpsr & mask;
++ it <<= 1;
++ it |= it >> (27 - 10); /* Carry ITSTATE<2> to correct place */
++ it &= mask;
++ cpsr &= ~mask;
++ cpsr |= it;
++ }
++ return cpsr;
++}
++
+ #endif /* __ASSEMBLY__ */
+ #endif
+diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
+index 84a6bbaf8cb20..633d470286952 100644
+--- a/arch/arm/mm/alignment.c
++++ b/arch/arm/mm/alignment.c
+@@ -936,6 +936,9 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ if (type == TYPE_LDST)
+ do_alignment_finish_ldst(addr, instr, regs, offset);
+
++ if (thumb_mode(regs))
++ regs->ARM_cpsr = it_advance(regs->ARM_cpsr);
++
+ return 0;
+
+ bad_or_fault:
+diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c
+index 0381e14954865..e53f824a2583c 100644
+--- a/arch/arm/mm/proc-v7-bugs.c
++++ b/arch/arm/mm/proc-v7-bugs.c
+@@ -110,8 +110,7 @@ static unsigned int spectre_v2_install_workaround(unsigned int method)
+ #else
+ static unsigned int spectre_v2_install_workaround(unsigned int method)
+ {
+- pr_info("CPU%u: Spectre V2: workarounds disabled by configuration\n",
+- smp_processor_id());
++ pr_info_once("Spectre V2: workarounds disabled by configuration\n");
+
+ return SPECTRE_VULNERABLE;
+ }
+@@ -223,10 +222,10 @@ static int spectre_bhb_install_workaround(int method)
+ return SPECTRE_VULNERABLE;
+
+ spectre_bhb_method = method;
+- }
+
+- pr_info("CPU%u: Spectre BHB: using %s workaround\n",
+- smp_processor_id(), spectre_bhb_method_name(method));
++ pr_info("CPU%u: Spectre BHB: enabling %s workaround for all CPUs\n",
++ smp_processor_id(), spectre_bhb_method_name(method));
++ }
+
+ return SPECTRE_MITIGATED;
+ }
+diff --git a/arch/arm/probes/decode.h b/arch/arm/probes/decode.h
+index 548d622a31599..81360638d188e 100644
+--- a/arch/arm/probes/decode.h
++++ b/arch/arm/probes/decode.h
+@@ -22,6 +22,7 @@
+ #include <linux/types.h>
+ #include <linux/stddef.h>
+ #include <asm/probes.h>
++#include <asm/ptrace.h>
+ #include <asm/kprobes.h>
+
+ void __init arm_probes_decode_init(void);
+@@ -43,31 +44,6 @@ void __init find_str_pc_offset(void);
+ #endif
+
+
+-/*
+- * Update ITSTATE after normal execution of an IT block instruction.
+- *
+- * The 8 IT state bits are split into two parts in CPSR:
+- * ITSTATE<1:0> are in CPSR<26:25>
+- * ITSTATE<7:2> are in CPSR<15:10>
+- */
+-static inline unsigned long it_advance(unsigned long cpsr)
+- {
+- if ((cpsr & 0x06000400) == 0) {
+- /* ITSTATE<2:0> == 0 means end of IT block, so clear IT state */
+- cpsr &= ~PSR_IT_MASK;
+- } else {
+- /* We need to shift left ITSTATE<4:0> */
+- const unsigned long mask = 0x06001c00; /* Mask ITSTATE<4:0> */
+- unsigned long it = cpsr & mask;
+- it <<= 1;
+- it |= it >> (27 - 10); /* Carry ITSTATE<2> to correct place */
+- it &= mask;
+- cpsr &= ~mask;
+- cpsr |= it;
+- }
+- return cpsr;
+-}
+-
+ static inline void __kprobes bx_write_pc(long pcv, struct pt_regs *regs)
+ {
+ long cpsr = regs->ARM_cpsr;
+diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
+index 88dc38b4a1479..90c2613af36b6 100644
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -383,6 +383,8 @@ static void __init clear_bss(void)
+ {
+ memset(__bss_start, 0,
+ (unsigned long) __bss_stop - (unsigned long) __bss_start);
++ memset(__brk_base, 0,
++ (unsigned long) __brk_limit - (unsigned long) __brk_base);
+ }
+
+ static unsigned long get_cmd_line_ptr(void)
+diff --git a/drivers/cpufreq/pmac32-cpufreq.c b/drivers/cpufreq/pmac32-cpufreq.c
+index e225edb5c3593..ce0dda1a4241b 100644
+--- a/drivers/cpufreq/pmac32-cpufreq.c
++++ b/drivers/cpufreq/pmac32-cpufreq.c
+@@ -474,6 +474,10 @@ static int pmac_cpufreq_init_MacRISC3(struct device_node *cpunode)
+ if (slew_done_gpio_np)
+ slew_done_gpio = read_gpio(slew_done_gpio_np);
+
++ of_node_put(volt_gpio_np);
++ of_node_put(freq_gpio_np);
++ of_node_put(slew_done_gpio_np);
++
+ /* If we use the frequency GPIOs, calculate the min/max speeds based
+ * on the bus frequencies
+ */
+diff --git a/drivers/irqchip/irq-or1k-pic.c b/drivers/irqchip/irq-or1k-pic.c
+index dd9d5d12fea2f..05931fdedbb99 100644
+--- a/drivers/irqchip/irq-or1k-pic.c
++++ b/drivers/irqchip/irq-or1k-pic.c
+@@ -70,7 +70,6 @@ static struct or1k_pic_dev or1k_pic_level = {
+ .name = "or1k-PIC-level",
+ .irq_unmask = or1k_pic_unmask,
+ .irq_mask = or1k_pic_mask,
+- .irq_mask_ack = or1k_pic_mask_ack,
+ },
+ .handle = handle_level_irq,
+ .flags = IRQ_LEVEL | IRQ_NOPROBE,
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index f5f1367d40d5c..4b88fabbdcbaa 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1438,8 +1438,6 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,
+ M_CAN_FIFO_DATA(i / 4),
+ *(u32 *)(cf->data + i));
+
+- can_put_echo_skb(skb, dev, 0);
+-
+ if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {
+ cccr = m_can_read(priv, M_CAN_CCCR);
+ cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT);
+@@ -1456,6 +1454,9 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,
+ m_can_write(priv, M_CAN_CCCR, cccr);
+ }
+ m_can_write(priv, M_CAN_TXBTIE, 0x1);
++
++ can_put_echo_skb(skb, dev, 0);
++
+ m_can_write(priv, M_CAN_TXBAR, 0x1);
+ /* End of xmit function for version 3.0.x */
+ } else {
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 6b0a4dc1ced14..5462827d9cbbc 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -2059,7 +2059,10 @@ static int efx_ef10_try_update_nic_stats_vf(struct efx_nic *efx)
+
+ efx_update_sw_stats(efx, stats);
+ out:
++ /* releasing a DMA coherent buffer with BH disabled can panic */
++ spin_unlock_bh(&efx->stats_lock);
+ efx_nic_free_buffer(efx, &stats_buf);
++ spin_lock_bh(&efx->stats_lock);
+ return rc;
+ }
+
+diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c
+index f074986a13b1a..fc3cb26f71123 100644
+--- a/drivers/net/ethernet/sfc/ef10_sriov.c
++++ b/drivers/net/ethernet/sfc/ef10_sriov.c
+@@ -415,8 +415,9 @@ fail1:
+ static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force)
+ {
+ struct pci_dev *dev = efx->pci_dev;
++ struct efx_ef10_nic_data *nic_data = efx->nic_data;
+ unsigned int vfs_assigned = pci_vfs_assigned(dev);
+- int rc = 0;
++ int i, rc = 0;
+
+ if (vfs_assigned && !force) {
+ netif_info(efx, drv, efx->net_dev, "VFs are assigned to guests; "
+@@ -424,10 +425,13 @@ static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force)
+ return -EBUSY;
+ }
+
+- if (!vfs_assigned)
++ if (!vfs_assigned) {
++ for (i = 0; i < efx->vf_count; i++)
++ nic_data->vf[i].pci_dev = NULL;
+ pci_disable_sriov(dev);
+- else
++ } else {
+ rc = -EBUSY;
++ }
+
+ efx_ef10_sriov_free_vf_vswitching(efx);
+ efx->vf_count = 0;
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 71bafc8f5ed02..e7af73ad8a443 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -1811,7 +1811,7 @@ static int sfp_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, sfp);
+
+- err = devm_add_action(sfp->dev, sfp_cleanup, sfp);
++ err = devm_add_action_or_reset(sfp->dev, sfp_cleanup, sfp);
+ if (err < 0)
+ return err;
+
+diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c
+index 7f68067c01745..85a5a622ec184 100644
+--- a/drivers/net/xen-netback/rx.c
++++ b/drivers/net/xen-netback/rx.c
+@@ -482,6 +482,7 @@ void xenvif_rx_action(struct xenvif_queue *queue)
+ queue->rx_copy.completed = &completed_skbs;
+
+ while (xenvif_rx_ring_slots_available(queue) &&
++ !skb_queue_empty(&queue->rx_queue) &&
+ work_done < RX_BATCH_SIZE) {
+ xenvif_rx_skb(queue);
+ work_done++;
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index 16c52d4c833c5..e4e0744e2470d 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -138,7 +138,9 @@ static int nxp_nci_i2c_fw_read(struct nxp_nci_i2c_phy *phy,
+ skb_put_data(*skb, &header, NXP_NCI_FW_HDR_LEN);
+
+ r = i2c_master_recv(client, skb_put(*skb, frame_len), frame_len);
+- if (r != frame_len) {
++ if (r < 0) {
++ goto fw_read_exit_free_skb;
++ } else if (r != frame_len) {
+ nfc_err(&client->dev,
+ "Invalid frame length: %u (expected %zu)\n",
+ r, frame_len);
+@@ -182,7 +184,9 @@ static int nxp_nci_i2c_nci_read(struct nxp_nci_i2c_phy *phy,
+ return 0;
+
+ r = i2c_master_recv(client, skb_put(*skb, header.plen), header.plen);
+- if (r != header.plen) {
++ if (r < 0) {
++ goto nci_read_exit_free_skb;
++ } else if (r != header.plen) {
+ nfc_err(&client->dev,
+ "Invalid frame payload length: %u (expected %u)\n",
+ r, header.plen);
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index 93fadd4abf14d..f911410bb4c7a 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -75,6 +75,7 @@ enum hp_wmi_event_ids {
+ HPWMI_BACKLIT_KB_BRIGHTNESS = 0x0D,
+ HPWMI_PEAKSHIFT_PERIOD = 0x0F,
+ HPWMI_BATTERY_CHARGE_PERIOD = 0x10,
++ HPWMI_SANITIZATION_MODE = 0x17,
+ };
+
+ struct bios_args {
+@@ -631,6 +632,8 @@ static void hp_wmi_notify(u32 value, void *context)
+ break;
+ case HPWMI_BATTERY_CHARGE_PERIOD:
+ break;
++ case HPWMI_SANITIZATION_MODE:
++ break;
+ default:
+ pr_info("Unknown event_id - %d - 0x%x\n", event_id, event_data);
+ break;
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 5a2e67a8ddc75..f11d1202566e6 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -2917,8 +2917,10 @@ static int serial8250_request_std_resource(struct uart_8250_port *up)
+ case UPIO_MEM32BE:
+ case UPIO_MEM16:
+ case UPIO_MEM:
+- if (!port->mapbase)
++ if (!port->mapbase) {
++ ret = -EINVAL;
+ break;
++ }
+
+ if (!request_mem_region(port->mapbase, size, "serial")) {
+ ret = -EBUSY;
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index 5edc3813a9b99..7de4bed1ddba7 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1335,6 +1335,15 @@ static void pl011_stop_rx(struct uart_port *port)
+ pl011_dma_rx_stop(uap);
+ }
+
++static void pl011_throttle_rx(struct uart_port *port)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&port->lock, flags);
++ pl011_stop_rx(port);
++ spin_unlock_irqrestore(&port->lock, flags);
++}
++
+ static void pl011_enable_ms(struct uart_port *port)
+ {
+ struct uart_amba_port *uap =
+@@ -1728,9 +1737,10 @@ static int pl011_allocate_irq(struct uart_amba_port *uap)
+ */
+ static void pl011_enable_interrupts(struct uart_amba_port *uap)
+ {
++ unsigned long flags;
+ unsigned int i;
+
+- spin_lock_irq(&uap->port.lock);
++ spin_lock_irqsave(&uap->port.lock, flags);
+
+ /* Clear out any spuriously appearing RX interrupts */
+ pl011_write(UART011_RTIS | UART011_RXIS, uap, REG_ICR);
+@@ -1752,7 +1762,14 @@ static void pl011_enable_interrupts(struct uart_amba_port *uap)
+ if (!pl011_dma_rx_running(uap))
+ uap->im |= UART011_RXIM;
+ pl011_write(uap->im, uap, REG_IMSC);
+- spin_unlock_irq(&uap->port.lock);
++ spin_unlock_irqrestore(&uap->port.lock, flags);
++}
++
++static void pl011_unthrottle_rx(struct uart_port *port)
++{
++ struct uart_amba_port *uap = container_of(port, struct uart_amba_port, port);
++
++ pl011_enable_interrupts(uap);
+ }
+
+ static int pl011_startup(struct uart_port *port)
+@@ -2127,6 +2144,8 @@ static const struct uart_ops amba_pl011_pops = {
+ .stop_tx = pl011_stop_tx,
+ .start_tx = pl011_start_tx,
+ .stop_rx = pl011_stop_rx,
++ .throttle = pl011_throttle_rx,
++ .unthrottle = pl011_unthrottle_rx,
+ .enable_ms = pl011_enable_ms,
+ .break_ctl = pl011_break_ctl,
+ .startup = pl011_startup,
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index 49661cef54693..964d6d33b6097 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -238,8 +238,7 @@ static void enable_tx_dma(struct s3c24xx_uart_port *ourport)
+ /* Enable tx dma mode */
+ ucon = rd_regl(port, S3C2410_UCON);
+ ucon &= ~(S3C64XX_UCON_TXBURST_MASK | S3C64XX_UCON_TXMODE_MASK);
+- ucon |= (dma_get_cache_alignment() >= 16) ?
+- S3C64XX_UCON_TXBURST_16 : S3C64XX_UCON_TXBURST_1;
++ ucon |= S3C64XX_UCON_TXBURST_1;
+ ucon |= S3C64XX_UCON_TXMODE_DMA;
+ wr_regl(port, S3C2410_UCON, ucon);
+
+@@ -512,7 +511,7 @@ static void enable_rx_dma(struct s3c24xx_uart_port *ourport)
+ S3C64XX_UCON_DMASUS_EN |
+ S3C64XX_UCON_TIMEOUT_EN |
+ S3C64XX_UCON_RXMODE_MASK);
+- ucon |= S3C64XX_UCON_RXBURST_16 |
++ ucon |= S3C64XX_UCON_RXBURST_1 |
+ 0xf << S3C64XX_UCON_TIMEOUT_SHIFT |
+ S3C64XX_UCON_EMPTYINT_EN |
+ S3C64XX_UCON_TIMEOUT_EN |
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index bb2f6f02ce23b..d8e1b0356e33b 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -72,6 +72,8 @@ static void stm32_config_reg_rs485(u32 *cr1, u32 *cr3, u32 delay_ADE,
+ *cr3 |= USART_CR3_DEM;
+ over8 = *cr1 & USART_CR1_OVER8;
+
++ *cr1 &= ~(USART_CR1_DEDT_MASK | USART_CR1_DEAT_MASK);
++
+ if (over8)
+ rs485_deat_dedt = delay_ADE * baud * 8;
+ else
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 8be95ca95ef97..3c8ec1c07ef34 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3187,7 +3187,6 @@ static irqreturn_t dwc3_process_event_buf(struct dwc3_event_buffer *evt)
+ }
+
+ evt->count = 0;
+- evt->flags &= ~DWC3_EVENT_PENDING;
+ ret = IRQ_HANDLED;
+
+ /* Unmask interrupt */
+@@ -3200,6 +3199,9 @@ static irqreturn_t dwc3_process_event_buf(struct dwc3_event_buffer *evt)
+ dwc3_writel(dwc->regs, DWC3_DEV_IMOD(0), dwc->imod_interval);
+ }
+
++ /* Keep the clearing of DWC3_EVENT_PENDING at the end */
++ evt->flags &= ~DWC3_EVENT_PENDING;
++
+ return ret;
+ }
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index d966836e7df86..7fa56728696dd 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1013,6 +1013,9 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
+ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
++ /* Belimo Automation devices */
++ { USB_DEVICE(FTDI_VID, BELIMO_ZTH_PID) },
++ { USB_DEVICE(FTDI_VID, BELIMO_ZIP_PID) },
+ /* ICP DAS I-756xU devices */
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
+ { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index d1a9564697a4b..4e92c165c86bf 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1568,6 +1568,12 @@
+ #define CHETCO_SEASMART_LITE_PID 0xA5AE /* SeaSmart Lite USB Adapter */
+ #define CHETCO_SEASMART_ANALOG_PID 0xA5AF /* SeaSmart Analog Adapter */
+
++/*
++ * Belimo Automation
++ */
++#define BELIMO_ZTH_PID 0x8050
++#define BELIMO_ZIP_PID 0xC811
++
+ /*
+ * Unjo AB
+ */
+diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
+index 8dae6ff2377ce..2ede329ce5945 100644
+--- a/drivers/usb/typec/class.c
++++ b/drivers/usb/typec/class.c
+@@ -1377,6 +1377,7 @@ void typec_set_pwr_opmode(struct typec_port *port,
+ partner->usb_pd = 1;
+ sysfs_notify(&partner_dev->kobj, NULL,
+ "supports_usb_power_delivery");
++ kobject_uevent(&partner_dev->kobj, KOBJ_CHANGE);
+ }
+ put_device(partner_dev);
+ }
+diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
+index c69c755bf5538..17cd682acc22b 100644
+--- a/drivers/virtio/virtio_mmio.c
++++ b/drivers/virtio/virtio_mmio.c
+@@ -66,6 +66,7 @@
+ #include <linux/list.h>
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
++#include <linux/pm.h>
+ #include <linux/slab.h>
+ #include <linux/spinlock.h>
+ #include <linux/virtio.h>
+@@ -508,6 +509,28 @@ static const struct virtio_config_ops virtio_mmio_config_ops = {
+ .bus_name = vm_bus_name,
+ };
+
++#ifdef CONFIG_PM_SLEEP
++static int virtio_mmio_freeze(struct device *dev)
++{
++ struct virtio_mmio_device *vm_dev = dev_get_drvdata(dev);
++
++ return virtio_device_freeze(&vm_dev->vdev);
++}
++
++static int virtio_mmio_restore(struct device *dev)
++{
++ struct virtio_mmio_device *vm_dev = dev_get_drvdata(dev);
++
++ if (vm_dev->version == 1)
++ writel(PAGE_SIZE, vm_dev->base + VIRTIO_MMIO_GUEST_PAGE_SIZE);
++
++ return virtio_device_restore(&vm_dev->vdev);
++}
++
++static const struct dev_pm_ops virtio_mmio_pm_ops = {
++ SET_SYSTEM_SLEEP_PM_OPS(virtio_mmio_freeze, virtio_mmio_restore)
++};
++#endif
+
+ static void virtio_mmio_release_dev(struct device *_d)
+ {
+@@ -761,6 +784,9 @@ static struct platform_driver virtio_mmio_driver = {
+ .name = "virtio-mmio",
+ .of_match_table = virtio_mmio_match,
+ .acpi_match_table = ACPI_PTR(virtio_mmio_acpi_match),
++#ifdef CONFIG_PM_SLEEP
++ .pm = &virtio_mmio_pm_ops,
++#endif
+ },
+ };
+
+diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
+index 8699bdc9e3918..cca30f0f965c5 100644
+--- a/fs/nilfs2/nilfs.h
++++ b/fs/nilfs2/nilfs.h
+@@ -198,6 +198,9 @@ static inline int nilfs_acl_chmod(struct inode *inode)
+
+ static inline int nilfs_init_acl(struct inode *inode, struct inode *dir)
+ {
++ if (S_ISLNK(inode->i_mode))
++ return 0;
++
+ inode->i_mode &= ~current_umask();
+ return 0;
+ }
+diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
+index f92264d1ed4fb..56442d3b651db 100644
+--- a/include/linux/cgroup-defs.h
++++ b/include/linux/cgroup-defs.h
+@@ -241,7 +241,8 @@ struct css_set {
+ * List of csets participating in the on-going migration either as
+ * source or destination. Protected by cgroup_mutex.
+ */
+- struct list_head mg_preload_node;
++ struct list_head mg_src_preload_node;
++ struct list_head mg_dst_preload_node;
+ struct list_head mg_node;
+
+ /*
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 7d3a4c2eea95b..98946f90781da 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1381,7 +1381,7 @@ void __sk_mem_reclaim(struct sock *sk, int amount);
+ /* sysctl_mem values are in pages, we convert them in SK_MEM_QUANTUM units */
+ static inline long sk_prot_mem_limits(const struct sock *sk, int index)
+ {
+- long val = sk->sk_prot->sysctl_mem[index];
++ long val = READ_ONCE(sk->sk_prot->sysctl_mem[index]);
+
+ #if PAGE_SIZE > SK_MEM_QUANTUM
+ val <<= PAGE_SHIFT - SK_MEM_QUANTUM_SHIFT;
+diff --git a/include/trace/events/sock.h b/include/trace/events/sock.h
+index a0c4b8a309660..3c85bed744206 100644
+--- a/include/trace/events/sock.h
++++ b/include/trace/events/sock.h
+@@ -97,7 +97,7 @@ TRACE_EVENT(sock_exceed_buf_limit,
+
+ TP_STRUCT__entry(
+ __array(char, name, 32)
+- __field(long *, sysctl_mem)
++ __array(long, sysctl_mem, 3)
+ __field(long, allocated)
+ __field(int, sysctl_rmem)
+ __field(int, rmem_alloc)
+@@ -109,7 +109,9 @@ TRACE_EVENT(sock_exceed_buf_limit,
+
+ TP_fast_assign(
+ strncpy(__entry->name, prot->name, 32);
+- __entry->sysctl_mem = prot->sysctl_mem;
++ __entry->sysctl_mem[0] = READ_ONCE(prot->sysctl_mem[0]);
++ __entry->sysctl_mem[1] = READ_ONCE(prot->sysctl_mem[1]);
++ __entry->sysctl_mem[2] = READ_ONCE(prot->sysctl_mem[2]);
+ __entry->allocated = allocated;
+ __entry->sysctl_rmem = sk_get_rmem0(sk, prot);
+ __entry->rmem_alloc = atomic_read(&sk->sk_rmem_alloc);
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 4e8284d8cacc0..a892a99eb4bfb 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -677,7 +677,8 @@ struct css_set init_css_set = {
+ .task_iters = LIST_HEAD_INIT(init_css_set.task_iters),
+ .threaded_csets = LIST_HEAD_INIT(init_css_set.threaded_csets),
+ .cgrp_links = LIST_HEAD_INIT(init_css_set.cgrp_links),
+- .mg_preload_node = LIST_HEAD_INIT(init_css_set.mg_preload_node),
++ .mg_src_preload_node = LIST_HEAD_INIT(init_css_set.mg_src_preload_node),
++ .mg_dst_preload_node = LIST_HEAD_INIT(init_css_set.mg_dst_preload_node),
+ .mg_node = LIST_HEAD_INIT(init_css_set.mg_node),
+
+ /*
+@@ -1151,7 +1152,8 @@ static struct css_set *find_css_set(struct css_set *old_cset,
+ INIT_LIST_HEAD(&cset->threaded_csets);
+ INIT_HLIST_NODE(&cset->hlist);
+ INIT_LIST_HEAD(&cset->cgrp_links);
+- INIT_LIST_HEAD(&cset->mg_preload_node);
++ INIT_LIST_HEAD(&cset->mg_src_preload_node);
++ INIT_LIST_HEAD(&cset->mg_dst_preload_node);
+ INIT_LIST_HEAD(&cset->mg_node);
+
+ /* Copy the set of subsystem state objects generated in
+@@ -2455,21 +2457,27 @@ int cgroup_migrate_vet_dst(struct cgroup *dst_cgrp)
+ */
+ void cgroup_migrate_finish(struct cgroup_mgctx *mgctx)
+ {
+- LIST_HEAD(preloaded);
+ struct css_set *cset, *tmp_cset;
+
+ lockdep_assert_held(&cgroup_mutex);
+
+ spin_lock_irq(&css_set_lock);
+
+- list_splice_tail_init(&mgctx->preloaded_src_csets, &preloaded);
+- list_splice_tail_init(&mgctx->preloaded_dst_csets, &preloaded);
++ list_for_each_entry_safe(cset, tmp_cset, &mgctx->preloaded_src_csets,
++ mg_src_preload_node) {
++ cset->mg_src_cgrp = NULL;
++ cset->mg_dst_cgrp = NULL;
++ cset->mg_dst_cset = NULL;
++ list_del_init(&cset->mg_src_preload_node);
++ put_css_set_locked(cset);
++ }
+
+- list_for_each_entry_safe(cset, tmp_cset, &preloaded, mg_preload_node) {
++ list_for_each_entry_safe(cset, tmp_cset, &mgctx->preloaded_dst_csets,
++ mg_dst_preload_node) {
+ cset->mg_src_cgrp = NULL;
+ cset->mg_dst_cgrp = NULL;
+ cset->mg_dst_cset = NULL;
+- list_del_init(&cset->mg_preload_node);
++ list_del_init(&cset->mg_dst_preload_node);
+ put_css_set_locked(cset);
+ }
+
+@@ -2511,7 +2519,7 @@ void cgroup_migrate_add_src(struct css_set *src_cset,
+
+ src_cgrp = cset_cgroup_from_root(src_cset, dst_cgrp->root);
+
+- if (!list_empty(&src_cset->mg_preload_node))
++ if (!list_empty(&src_cset->mg_src_preload_node))
+ return;
+
+ WARN_ON(src_cset->mg_src_cgrp);
+@@ -2522,7 +2530,7 @@ void cgroup_migrate_add_src(struct css_set *src_cset,
+ src_cset->mg_src_cgrp = src_cgrp;
+ src_cset->mg_dst_cgrp = dst_cgrp;
+ get_css_set(src_cset);
+- list_add_tail(&src_cset->mg_preload_node, &mgctx->preloaded_src_csets);
++ list_add_tail(&src_cset->mg_src_preload_node, &mgctx->preloaded_src_csets);
+ }
+
+ /**
+@@ -2547,7 +2555,7 @@ int cgroup_migrate_prepare_dst(struct cgroup_mgctx *mgctx)
+
+ /* look up the dst cset for each src cset and link it to src */
+ list_for_each_entry_safe(src_cset, tmp_cset, &mgctx->preloaded_src_csets,
+- mg_preload_node) {
++ mg_src_preload_node) {
+ struct css_set *dst_cset;
+ struct cgroup_subsys *ss;
+ int ssid;
+@@ -2566,7 +2574,7 @@ int cgroup_migrate_prepare_dst(struct cgroup_mgctx *mgctx)
+ if (src_cset == dst_cset) {
+ src_cset->mg_src_cgrp = NULL;
+ src_cset->mg_dst_cgrp = NULL;
+- list_del_init(&src_cset->mg_preload_node);
++ list_del_init(&src_cset->mg_src_preload_node);
+ put_css_set(src_cset);
+ put_css_set(dst_cset);
+ continue;
+@@ -2574,8 +2582,8 @@ int cgroup_migrate_prepare_dst(struct cgroup_mgctx *mgctx)
+
+ src_cset->mg_dst_cset = dst_cset;
+
+- if (list_empty(&dst_cset->mg_preload_node))
+- list_add_tail(&dst_cset->mg_preload_node,
++ if (list_empty(&dst_cset->mg_dst_preload_node))
++ list_add_tail(&dst_cset->mg_dst_preload_node,
+ &mgctx->preloaded_dst_csets);
+ else
+ put_css_set(dst_cset);
+@@ -2809,7 +2817,8 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
+ goto out_finish;
+
+ spin_lock_irq(&css_set_lock);
+- list_for_each_entry(src_cset, &mgctx.preloaded_src_csets, mg_preload_node) {
++ list_for_each_entry(src_cset, &mgctx.preloaded_src_csets,
++ mg_src_preload_node) {
+ struct task_struct *task, *ntask;
+
+ /* all tasks in src_csets need to be migrated */
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 4cc3f3ba13a95..c79b87ac10416 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -1825,12 +1825,12 @@ bool do_notify_parent(struct task_struct *tsk, int sig)
+ bool autoreap = false;
+ u64 utime, stime;
+
+- BUG_ON(sig == -1);
++ WARN_ON_ONCE(sig == -1);
+
+- /* do_notify_parent_cldstop should have been called instead. */
+- BUG_ON(task_is_stopped_or_traced(tsk));
++ /* do_notify_parent_cldstop should have been called instead. */
++ WARN_ON_ONCE(task_is_stopped_or_traced(tsk));
+
+- BUG_ON(!tsk->ptrace &&
++ WARN_ON_ONCE(!tsk->ptrace &&
+ (tsk->group_leader != tsk || !thread_group_empty(tsk)));
+
+ if (sig != SIGCHLD) {
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index e25bc917ec6cf..48f85dab9ef19 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -4266,6 +4266,8 @@ static int parse_var_defs(struct hist_trigger_data *hist_data)
+
+ s = kstrdup(field_str, GFP_KERNEL);
+ if (!s) {
++ kfree(hist_data->attrs->var_defs.name[n_vars]);
++ hist_data->attrs->var_defs.name[n_vars] = NULL;
+ ret = -ENOMEM;
+ goto free;
+ }
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index 4b9d1d6bbf6f9..55c7cdf5e7b83 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -1001,9 +1001,24 @@ int br_nf_hook_thresh(unsigned int hook, struct net *net,
+ return okfn(net, sk, skb);
+
+ ops = nf_hook_entries_get_hook_ops(e);
+- for (i = 0; i < e->num_hook_entries &&
+- ops[i]->priority <= NF_BR_PRI_BRNF; i++)
+- ;
++ for (i = 0; i < e->num_hook_entries; i++) {
++ /* These hooks have already been called */
++ if (ops[i]->priority < NF_BR_PRI_BRNF)
++ continue;
++
++ /* These hooks have not been called yet, run them. */
++ if (ops[i]->priority > NF_BR_PRI_BRNF)
++ break;
++
++ /* take a closer look at NF_BR_PRI_BRNF. */
++ if (ops[i]->hook == br_nf_pre_routing) {
++ /* This hook diverted the skb to this function,
++ * hooks after this have not been run yet.
++ */
++ i++;
++ break;
++ }
++ }
+
+ nf_hook_state_init(&state, hook, NFPROTO_BRIDGE, indev, outdev,
+ sk, net, okfn);
+diff --git a/net/core/filter.c b/net/core/filter.c
+index c1310c9d1b903..5129e89f52bb2 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4570,7 +4570,6 @@ static int bpf_push_seg6_encap(struct sk_buff *skb, u32 type, void *hdr, u32 len
+ if (err)
+ return err;
+
+- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
+ skb_set_transport_header(skb, sizeof(struct ipv6hdr));
+
+ return seg6_lookup_nexthop(skb, NULL, 0);
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index d8c22246629a6..dadd42a07c071 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1209,7 +1209,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
+ if (new_saddr == old_saddr)
+ return 0;
+
+- if (sock_net(sk)->ipv4.sysctl_ip_dynaddr > 1) {
++ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_ip_dynaddr) > 1) {
+ pr_info("%s(): shifting inet->saddr from %pI4 to %pI4\n",
+ __func__, &old_saddr, &new_saddr);
+ }
+@@ -1264,7 +1264,7 @@ int inet_sk_rebuild_header(struct sock *sk)
+ * Other protocols have to map its equivalent state to TCP_SYN_SENT.
+ * DCCP maps its DCCP_REQUESTING state to TCP_SYN_SENT. -acme
+ */
+- if (!sock_net(sk)->ipv4.sysctl_ip_dynaddr ||
++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_ip_dynaddr) ||
+ sk->sk_state != TCP_SYN_SENT ||
+ (sk->sk_userlocks & SOCK_BINDADDR_LOCK) ||
+ (err = inet_sk_reselect_saddr(sk)) != 0)
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index e8b8dd1cb1576..8dcf9aec7b77d 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -254,7 +254,7 @@ static int cipso_v4_cache_check(const unsigned char *key,
+ struct cipso_v4_map_cache_entry *prev_entry = NULL;
+ u32 hash;
+
+- if (!cipso_v4_cache_enabled)
++ if (!READ_ONCE(cipso_v4_cache_enabled))
+ return -ENOENT;
+
+ hash = cipso_v4_map_cache_hash(key, key_len);
+@@ -311,13 +311,14 @@ static int cipso_v4_cache_check(const unsigned char *key,
+ int cipso_v4_cache_add(const unsigned char *cipso_ptr,
+ const struct netlbl_lsm_secattr *secattr)
+ {
++ int bkt_size = READ_ONCE(cipso_v4_cache_bucketsize);
+ int ret_val = -EPERM;
+ u32 bkt;
+ struct cipso_v4_map_cache_entry *entry = NULL;
+ struct cipso_v4_map_cache_entry *old_entry = NULL;
+ u32 cipso_ptr_len;
+
+- if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
++ if (!READ_ONCE(cipso_v4_cache_enabled) || bkt_size <= 0)
+ return 0;
+
+ cipso_ptr_len = cipso_ptr[1];
+@@ -337,7 +338,7 @@ int cipso_v4_cache_add(const unsigned char *cipso_ptr,
+
+ bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1);
+ spin_lock_bh(&cipso_v4_cache[bkt].lock);
+- if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) {
++ if (cipso_v4_cache[bkt].size < bkt_size) {
+ list_add(&entry->list, &cipso_v4_cache[bkt].list);
+ cipso_v4_cache[bkt].size += 1;
+ } else {
+@@ -1214,7 +1215,8 @@ static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def,
+ /* This will send packets using the "optimized" format when
+ * possible as specified in section 3.4.2.6 of the
+ * CIPSO draft. */
+- if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10)
++ if (READ_ONCE(cipso_v4_rbm_optfmt) && ret_val > 0 &&
++ ret_val <= 10)
+ tag_len = 14;
+ else
+ tag_len = 4 + ret_val;
+@@ -1617,7 +1619,7 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
+ * all the CIPSO validations here but it doesn't
+ * really specify _exactly_ what we need to validate
+ * ... so, just make it a sysctl tunable. */
+- if (cipso_v4_rbm_strictvalid) {
++ if (READ_ONCE(cipso_v4_rbm_strictvalid)) {
+ if (cipso_v4_map_lvl_valid(doi_def,
+ tag[3]) < 0) {
+ err_offset = opt_iter + 3;
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index fe10a565b7d85..aa179e6461e17 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -266,11 +266,12 @@ bool icmp_global_allow(void)
+ spin_lock(&icmp_global.lock);
+ delta = min_t(u32, now - icmp_global.stamp, HZ);
+ if (delta >= HZ / 50) {
+- incr = sysctl_icmp_msgs_per_sec * delta / HZ ;
++ incr = READ_ONCE(sysctl_icmp_msgs_per_sec) * delta / HZ;
+ if (incr)
+ WRITE_ONCE(icmp_global.stamp, now);
+ }
+- credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
++ credit = min_t(u32, icmp_global.credit + incr,
++ READ_ONCE(sysctl_icmp_msgs_burst));
+ if (credit) {
+ /* We want to use a credit of one in average, but need to randomize
+ * it for security reasons.
+@@ -294,7 +295,7 @@ static bool icmpv4_mask_allow(struct net *net, int type, int code)
+ return true;
+
+ /* Limit if icmp type is enabled in ratemask. */
+- if (!((1 << type) & net->ipv4.sysctl_icmp_ratemask))
++ if (!((1 << type) & READ_ONCE(net->ipv4.sysctl_icmp_ratemask)))
+ return true;
+
+ return false;
+@@ -332,7 +333,8 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
+
+ vif = l3mdev_master_ifindex(dst->dev);
+ peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif, 1);
+- rc = inet_peer_xrlim_allow(peer, net->ipv4.sysctl_icmp_ratelimit);
++ rc = inet_peer_xrlim_allow(peer,
++ READ_ONCE(net->ipv4.sysctl_icmp_ratelimit));
+ if (peer)
+ inet_putpeer(peer);
+ out:
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index ff327a62c9ce9..a18668552d33d 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -148,16 +148,20 @@ static void inet_peer_gc(struct inet_peer_base *base,
+ struct inet_peer *gc_stack[],
+ unsigned int gc_cnt)
+ {
++ int peer_threshold, peer_maxttl, peer_minttl;
+ struct inet_peer *p;
+ __u32 delta, ttl;
+ int i;
+
+- if (base->total >= inet_peer_threshold)
++ peer_threshold = READ_ONCE(inet_peer_threshold);
++ peer_maxttl = READ_ONCE(inet_peer_maxttl);
++ peer_minttl = READ_ONCE(inet_peer_minttl);
++
++ if (base->total >= peer_threshold)
+ ttl = 0; /* be aggressive */
+ else
+- ttl = inet_peer_maxttl
+- - (inet_peer_maxttl - inet_peer_minttl) / HZ *
+- base->total / inet_peer_threshold * HZ;
++ ttl = peer_maxttl - (peer_maxttl - peer_minttl) / HZ *
++ base->total / peer_threshold * HZ;
+ for (i = 0; i < gc_cnt; i++) {
+ p = gc_stack[i];
+
+diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
+index 26882fd9323a2..2e90672852c86 100644
+--- a/net/ipv6/seg6_iptunnel.c
++++ b/net/ipv6/seg6_iptunnel.c
+@@ -176,6 +176,8 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
+ }
+ #endif
+
++ hdr->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
++
+ skb_postpush_rcsum(skb, hdr, tot_len);
+
+ return 0;
+@@ -228,6 +230,8 @@ int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh)
+ }
+ #endif
+
++ hdr->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
++
+ skb_postpush_rcsum(skb, hdr, sizeof(struct ipv6hdr) + hdrlen);
+
+ return 0;
+@@ -289,7 +293,6 @@ static int seg6_do_srh(struct sk_buff *skb)
+ break;
+ }
+
+- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
+ skb_set_transport_header(skb, sizeof(struct ipv6hdr));
+
+ return 0;
+diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
+index 607709a8847cb..18970f6a68c63 100644
+--- a/net/ipv6/seg6_local.c
++++ b/net/ipv6/seg6_local.c
+@@ -415,7 +415,6 @@ static int input_action_end_b6(struct sk_buff *skb, struct seg6_local_lwt *slwt)
+ if (err)
+ goto drop;
+
+- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
+ skb_set_transport_header(skb, sizeof(struct ipv6hdr));
+
+ seg6_lookup_nexthop(skb, NULL, 0);
+@@ -447,7 +446,6 @@ static int input_action_end_b6_encap(struct sk_buff *skb,
+ if (err)
+ goto drop;
+
+- ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
+ skb_set_transport_header(skb, sizeof(struct ipv6hdr));
+
+ seg6_lookup_nexthop(skb, NULL, 0);
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 6c18b4565ab51..8266452c143b4 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -453,6 +453,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock,
+ sock_init_data(sock, sk);
+ tipc_set_sk_state(sk, TIPC_OPEN);
+ if (tipc_sk_insert(tsk)) {
++ sk_free(sk);
+ pr_warn("Socket create failed; port number exhausted\n");
+ return -EINVAL;
+ }
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 9b7f474ee6ca1..b4cd42643e1ef 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -918,6 +918,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x103c, 0x82b4, "HP ProDesk 600 G3", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2915bf0857df6..9670db6ad1e1b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5844,6 +5844,7 @@ enum {
+ ALC298_FIXUP_LENOVO_SPK_VOLUME,
+ ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER,
+ ALC269_FIXUP_ATIV_BOOK_8,
++ ALC221_FIXUP_HP_288PRO_MIC_NO_PRESENCE,
+ ALC221_FIXUP_HP_MIC_NO_PRESENCE,
+ ALC256_FIXUP_ASUS_HEADSET_MODE,
+ ALC256_FIXUP_ASUS_MIC,
+@@ -6642,6 +6643,16 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC269_FIXUP_NO_SHUTUP
+ },
++ [ALC221_FIXUP_HP_288PRO_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ { 0x1a, 0x01813030 }, /* use as headphone mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE
++ },
+ [ALC221_FIXUP_HP_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -7029,6 +7040,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
++ SND_PCI_QUIRK(0x1028, 0x053c, "Dell Latitude E5430", ALC292_FIXUP_DELL_E7X),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
+ SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
+ SND_PCI_QUIRK(0x1028, 0x05be, "Dell Latitude E6540", ALC292_FIXUP_DELL_E7X),
+@@ -7135,6 +7147,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x2b5e, "HP 288 Pro G2 MT", ALC221_FIXUP_HP_288PRO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x802e, "HP Z240 SFF", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x802f, "HP Z240", ALC221_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 17255e9683f59..13e752f8b3f73 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1769,6 +1769,9 @@ static int sgtl5000_i2c_remove(struct i2c_client *client)
+ {
+ struct sgtl5000_priv *sgtl5000 = i2c_get_clientdata(client);
+
++ regmap_write(sgtl5000->regmap, SGTL5000_CHIP_DIG_POWER, SGTL5000_DIG_POWER_DEFAULT);
++ regmap_write(sgtl5000->regmap, SGTL5000_CHIP_ANA_POWER, SGTL5000_ANA_POWER_DEFAULT);
++
+ clk_disable_unprepare(sgtl5000->mclk);
+ regulator_bulk_disable(sgtl5000->num_supplies, sgtl5000->supplies);
+ regulator_bulk_free(sgtl5000->num_supplies, sgtl5000->supplies);
+@@ -1776,6 +1779,11 @@ static int sgtl5000_i2c_remove(struct i2c_client *client)
+ return 0;
+ }
+
++static void sgtl5000_i2c_shutdown(struct i2c_client *client)
++{
++ sgtl5000_i2c_remove(client);
++}
++
+ static const struct i2c_device_id sgtl5000_id[] = {
+ {"sgtl5000", 0},
+ {},
+@@ -1796,6 +1804,7 @@ static struct i2c_driver sgtl5000_i2c_driver = {
+ },
+ .probe = sgtl5000_i2c_probe,
+ .remove = sgtl5000_i2c_remove,
++ .shutdown = sgtl5000_i2c_shutdown,
+ .id_table = sgtl5000_id,
+ };
+
+diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h
+index 066517e352a70..0ed4bad92cd1f 100644
+--- a/sound/soc/codecs/sgtl5000.h
++++ b/sound/soc/codecs/sgtl5000.h
+@@ -80,6 +80,7 @@
+ /*
+ * SGTL5000_CHIP_DIG_POWER
+ */
++#define SGTL5000_DIG_POWER_DEFAULT 0x0000
+ #define SGTL5000_ADC_EN 0x0040
+ #define SGTL5000_DAC_EN 0x0020
+ #define SGTL5000_DAP_POWERUP 0x0010
+diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
+index b0789a03d699b..e510aca551636 100644
+--- a/sound/soc/codecs/wm5110.c
++++ b/sound/soc/codecs/wm5110.c
+@@ -414,6 +414,7 @@ static int wm5110_put_dre(struct snd_kcontrol *kcontrol,
+ unsigned int rnew = (!!ucontrol->value.integer.value[1]) << mc->rshift;
+ unsigned int lold, rold;
+ unsigned int lena, rena;
++ bool change = false;
+ int ret;
+
+ snd_soc_dapm_mutex_lock(dapm);
+@@ -441,8 +442,8 @@ static int wm5110_put_dre(struct snd_kcontrol *kcontrol,
+ goto err;
+ }
+
+- ret = regmap_update_bits(arizona->regmap, ARIZONA_DRE_ENABLE,
+- mask, lnew | rnew);
++ ret = regmap_update_bits_check(arizona->regmap, ARIZONA_DRE_ENABLE,
++ mask, lnew | rnew, &change);
+ if (ret) {
+ dev_err(arizona->dev, "Failed to set DRE: %d\n", ret);
+ goto err;
+@@ -455,6 +456,9 @@ static int wm5110_put_dre(struct snd_kcontrol *kcontrol,
+ if (!rnew && rold)
+ wm5110_clear_pga_volume(arizona, mc->rshift);
+
++ if (change)
++ ret = 1;
++
+ err:
+ snd_soc_dapm_mutex_unlock(dapm);
+
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index 7a37312c8e0c2..453b61b42dd9e 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -530,7 +530,7 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
+ return -EINVAL;
+ if (mc->platform_max && tmp > mc->platform_max)
+ return -EINVAL;
+- if (tmp > mc->max - mc->min + 1)
++ if (tmp > mc->max - mc->min)
+ return -EINVAL;
+
+ if (invert)
+@@ -551,7 +551,7 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
+ return -EINVAL;
+ if (mc->platform_max && tmp > mc->platform_max)
+ return -EINVAL;
+- if (tmp > mc->max - mc->min + 1)
++ if (tmp > mc->max - mc->min)
+ return -EINVAL;
+
+ if (invert)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-07-29 15:28 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-07-29 15:28 UTC (permalink / raw
To: gentoo-commits
commit: c31b1ff3d3e2e4c076dac2c2a63ef9bdcd45af18
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jul 29 15:27:59 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jul 29 15:27:59 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c31b1ff3
Linux patch 4.19.254
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1253_linux-4.19.254.patch | 2601 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2605 insertions(+)
diff --git a/0000_README b/0000_README
index fc61f80f..373ac001 100644
--- a/0000_README
+++ b/0000_README
@@ -1055,6 +1055,10 @@ Patch: 1252_linux-4.19.253.patch
From: https://www.kernel.org
Desc: Linux 4.19.253
+Patch: 1253_linux-4.19.254.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.254
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1253_linux-4.19.254.patch b/1253_linux-4.19.254.patch
new file mode 100644
index 00000000..f0f6dab6
--- /dev/null
+++ b/1253_linux-4.19.254.patch
@@ -0,0 +1,2601 @@
+diff --git a/Makefile b/Makefile
+index 7ae832b9156ff..c7a0dc943e74c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 253
++SUBLEVEL = 254
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/kernel/srmcons.c b/arch/alpha/kernel/srmcons.c
+index 438b10c44d732..2b7a314b84522 100644
+--- a/arch/alpha/kernel/srmcons.c
++++ b/arch/alpha/kernel/srmcons.c
+@@ -59,7 +59,7 @@ srmcons_do_receive_chars(struct tty_port *port)
+ } while((result.bits.status & 1) && (++loops < 10));
+
+ if (count)
+- tty_schedule_flip(port);
++ tty_flip_buffer_push(port);
+
+ return count;
+ }
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index 110be14e61226..b6c972941881b 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -66,6 +66,7 @@ ifeq ($(CONFIG_MODULE_SECTIONS),y)
+ endif
+
+ KBUILD_CFLAGS_MODULE += $(call cc-option,-mno-relax)
++KBUILD_AFLAGS_MODULE += $(call as-option,-Wa$(comma)-mno-relax)
+
+ # GCC versions that support the "-mstrict-align" option default to allowing
+ # unaligned accesses. While unaligned accesses are explicitly allowed in the
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index bac4dc501dc4d..2be38780a7f71 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -183,8 +183,8 @@ static void __cold process_random_ready_list(void)
+
+ #define warn_unseeded_randomness() \
+ if (IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM) && !crng_ready()) \
+- pr_notice("%s called from %pS with crng_init=%d\n", \
+- __func__, (void *)_RET_IP_, crng_init)
++ printk_deferred(KERN_NOTICE "random: %s called from %pS with crng_init=%d\n", \
++ __func__, (void *)_RET_IP_, crng_init)
+
+
+ /*********************************************************************
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
+index 1067e702c22c7..31a2d1ecce3e7 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
+@@ -657,9 +657,6 @@ static bool tilcdc_crtc_mode_fixup(struct drm_crtc *crtc,
+ static int tilcdc_crtc_atomic_check(struct drm_crtc *crtc,
+ struct drm_crtc_state *state)
+ {
+- struct drm_display_mode *mode = &state->mode;
+- int ret;
+-
+ /* If we are not active we don't care */
+ if (!state->active)
+ return 0;
+@@ -671,12 +668,6 @@ static int tilcdc_crtc_atomic_check(struct drm_crtc *crtc,
+ return -EINVAL;
+ }
+
+- ret = tilcdc_crtc_mode_valid(crtc, mode);
+- if (ret) {
+- dev_dbg(crtc->dev->dev, "Mode \"%s\" not valid", mode->name);
+- return -EINVAL;
+- }
+-
+ return 0;
+ }
+
+@@ -728,13 +719,6 @@ static const struct drm_crtc_funcs tilcdc_crtc_funcs = {
+ .disable_vblank = tilcdc_crtc_disable_vblank,
+ };
+
+-static const struct drm_crtc_helper_funcs tilcdc_crtc_helper_funcs = {
+- .mode_fixup = tilcdc_crtc_mode_fixup,
+- .atomic_check = tilcdc_crtc_atomic_check,
+- .atomic_enable = tilcdc_crtc_atomic_enable,
+- .atomic_disable = tilcdc_crtc_atomic_disable,
+-};
+-
+ int tilcdc_crtc_max_width(struct drm_crtc *crtc)
+ {
+ struct drm_device *dev = crtc->dev;
+@@ -749,7 +733,9 @@ int tilcdc_crtc_max_width(struct drm_crtc *crtc)
+ return max_width;
+ }
+
+-int tilcdc_crtc_mode_valid(struct drm_crtc *crtc, struct drm_display_mode *mode)
++static enum drm_mode_status
++tilcdc_crtc_mode_valid(struct drm_crtc *crtc,
++ const struct drm_display_mode *mode)
+ {
+ struct tilcdc_drm_private *priv = crtc->dev->dev_private;
+ unsigned int bandwidth;
+@@ -837,6 +823,14 @@ int tilcdc_crtc_mode_valid(struct drm_crtc *crtc, struct drm_display_mode *mode)
+ return MODE_OK;
+ }
+
++static const struct drm_crtc_helper_funcs tilcdc_crtc_helper_funcs = {
++ .mode_valid = tilcdc_crtc_mode_valid,
++ .mode_fixup = tilcdc_crtc_mode_fixup,
++ .atomic_check = tilcdc_crtc_atomic_check,
++ .atomic_enable = tilcdc_crtc_atomic_enable,
++ .atomic_disable = tilcdc_crtc_atomic_disable,
++};
++
+ void tilcdc_crtc_set_panel_info(struct drm_crtc *crtc,
+ const struct tilcdc_panel_info *info)
+ {
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+index e1868776da252..96457fe2b8d5b 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+@@ -202,7 +202,6 @@ static void tilcdc_fini(struct drm_device *dev)
+
+ drm_irq_uninstall(dev);
+ drm_mode_config_cleanup(dev);
+- tilcdc_remove_external_device(dev);
+
+ if (priv->clk)
+ clk_put(priv->clk);
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.h b/drivers/gpu/drm/tilcdc/tilcdc_drv.h
+index ead5122166699..35558bbd5cd88 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.h
++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.h
+@@ -89,7 +89,6 @@ struct tilcdc_drm_private {
+
+ struct drm_encoder *external_encoder;
+ struct drm_connector *external_connector;
+- const struct drm_connector_helper_funcs *connector_funcs;
+
+ bool is_registered;
+ bool is_componentized;
+@@ -171,7 +170,6 @@ void tilcdc_crtc_set_panel_info(struct drm_crtc *crtc,
+ const struct tilcdc_panel_info *info);
+ void tilcdc_crtc_set_simulate_vesa_sync(struct drm_crtc *crtc,
+ bool simulate_vesa_sync);
+-int tilcdc_crtc_mode_valid(struct drm_crtc *crtc, struct drm_display_mode *mode);
+ int tilcdc_crtc_max_width(struct drm_crtc *crtc);
+ void tilcdc_crtc_shutdown(struct drm_crtc *crtc);
+ int tilcdc_crtc_update_fb(struct drm_crtc *crtc,
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_external.c b/drivers/gpu/drm/tilcdc/tilcdc_external.c
+index b4eaf9bc87f8e..9c1be0635b538 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_external.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_external.c
+@@ -40,64 +40,6 @@ static const struct tilcdc_panel_info panel_info_default = {
+ .raster_order = 0,
+ };
+
+-static int tilcdc_external_mode_valid(struct drm_connector *connector,
+- struct drm_display_mode *mode)
+-{
+- struct tilcdc_drm_private *priv = connector->dev->dev_private;
+- int ret;
+-
+- ret = tilcdc_crtc_mode_valid(priv->crtc, mode);
+- if (ret != MODE_OK)
+- return ret;
+-
+- BUG_ON(priv->external_connector != connector);
+- BUG_ON(!priv->connector_funcs);
+-
+- /* If the connector has its own mode_valid call it. */
+- if (!IS_ERR(priv->connector_funcs) &&
+- priv->connector_funcs->mode_valid)
+- return priv->connector_funcs->mode_valid(connector, mode);
+-
+- return MODE_OK;
+-}
+-
+-static int tilcdc_add_external_connector(struct drm_device *dev,
+- struct drm_connector *connector)
+-{
+- struct tilcdc_drm_private *priv = dev->dev_private;
+- struct drm_connector_helper_funcs *connector_funcs;
+-
+- /* There should never be more than one connector */
+- if (WARN_ON(priv->external_connector))
+- return -EINVAL;
+-
+- priv->external_connector = connector;
+- connector_funcs = devm_kzalloc(dev->dev, sizeof(*connector_funcs),
+- GFP_KERNEL);
+- if (!connector_funcs)
+- return -ENOMEM;
+-
+- /* connector->helper_private contains always struct
+- * connector_helper_funcs pointer. For tilcdc crtc to have a
+- * say if a specific mode is Ok, we need to install our own
+- * helper functions. In our helper functions we copy
+- * everything else but use our own mode_valid() (above).
+- */
+- if (connector->helper_private) {
+- priv->connector_funcs = connector->helper_private;
+- *connector_funcs = *priv->connector_funcs;
+- } else {
+- priv->connector_funcs = ERR_PTR(-ENOENT);
+- }
+- connector_funcs->mode_valid = tilcdc_external_mode_valid;
+- drm_connector_helper_add(connector, connector_funcs);
+-
+- dev_dbg(dev->dev, "External connector '%s' connected\n",
+- connector->name);
+-
+- return 0;
+-}
+-
+ static
+ struct drm_connector *tilcdc_encoder_find_connector(struct drm_device *ddev,
+ struct drm_encoder *encoder)
+@@ -118,40 +60,30 @@ struct drm_connector *tilcdc_encoder_find_connector(struct drm_device *ddev,
+ int tilcdc_add_component_encoder(struct drm_device *ddev)
+ {
+ struct tilcdc_drm_private *priv = ddev->dev_private;
+- struct drm_connector *connector;
+- struct drm_encoder *encoder;
++ struct drm_encoder *encoder = NULL, *iter;
+
+- list_for_each_entry(encoder, &ddev->mode_config.encoder_list, head)
+- if (encoder->possible_crtcs & (1 << priv->crtc->index))
++ list_for_each_entry(iter, &ddev->mode_config.encoder_list, head)
++ if (iter->possible_crtcs & (1 << priv->crtc->index)) {
++ encoder = iter;
+ break;
++ }
+
+ if (!encoder) {
+ dev_err(ddev->dev, "%s: No suitable encoder found\n", __func__);
+ return -ENODEV;
+ }
+
+- connector = tilcdc_encoder_find_connector(ddev, encoder);
++ priv->external_connector =
++ tilcdc_encoder_find_connector(ddev, encoder);
+
+- if (!connector)
++ if (!priv->external_connector)
+ return -ENODEV;
+
+ /* Only tda998x is supported at the moment. */
+ tilcdc_crtc_set_simulate_vesa_sync(priv->crtc, true);
+ tilcdc_crtc_set_panel_info(priv->crtc, &panel_info_tda998x);
+
+- return tilcdc_add_external_connector(ddev, connector);
+-}
+-
+-void tilcdc_remove_external_device(struct drm_device *dev)
+-{
+- struct tilcdc_drm_private *priv = dev->dev_private;
+-
+- /* Restore the original helper functions, if any. */
+- if (IS_ERR(priv->connector_funcs))
+- drm_connector_helper_add(priv->external_connector, NULL);
+- else if (priv->connector_funcs)
+- drm_connector_helper_add(priv->external_connector,
+- priv->connector_funcs);
++ return 0;
+ }
+
+ static const struct drm_encoder_funcs tilcdc_external_encoder_funcs = {
+@@ -162,7 +94,6 @@ static
+ int tilcdc_attach_bridge(struct drm_device *ddev, struct drm_bridge *bridge)
+ {
+ struct tilcdc_drm_private *priv = ddev->dev_private;
+- struct drm_connector *connector;
+ int ret;
+
+ priv->external_encoder->possible_crtcs = BIT(0);
+@@ -175,13 +106,12 @@ int tilcdc_attach_bridge(struct drm_device *ddev, struct drm_bridge *bridge)
+
+ tilcdc_crtc_set_panel_info(priv->crtc, &panel_info_default);
+
+- connector = tilcdc_encoder_find_connector(ddev, priv->external_encoder);
+- if (!connector)
++ priv->external_connector =
++ tilcdc_encoder_find_connector(ddev, priv->external_encoder);
++ if (!priv->external_connector)
+ return -ENODEV;
+
+- ret = tilcdc_add_external_connector(ddev, connector);
+-
+- return ret;
++ return 0;
+ }
+
+ int tilcdc_attach_external_device(struct drm_device *ddev)
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_external.h b/drivers/gpu/drm/tilcdc/tilcdc_external.h
+index 763d18f006c74..a28b9df68c8fd 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_external.h
++++ b/drivers/gpu/drm/tilcdc/tilcdc_external.h
+@@ -19,7 +19,6 @@
+ #define __TILCDC_EXTERNAL_H__
+
+ int tilcdc_add_component_encoder(struct drm_device *dev);
+-void tilcdc_remove_external_device(struct drm_device *dev);
+ int tilcdc_get_external_components(struct device *dev,
+ struct component_match **match);
+ int tilcdc_attach_external_device(struct drm_device *ddev);
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+index 096a33f12c615..253c555e29974 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+@@ -174,14 +174,6 @@ static int panel_connector_get_modes(struct drm_connector *connector)
+ return i;
+ }
+
+-static int panel_connector_mode_valid(struct drm_connector *connector,
+- struct drm_display_mode *mode)
+-{
+- struct tilcdc_drm_private *priv = connector->dev->dev_private;
+- /* our only constraints are what the crtc can generate: */
+- return tilcdc_crtc_mode_valid(priv->crtc, mode);
+-}
+-
+ static struct drm_encoder *panel_connector_best_encoder(
+ struct drm_connector *connector)
+ {
+@@ -199,7 +191,6 @@ static const struct drm_connector_funcs panel_connector_funcs = {
+
+ static const struct drm_connector_helper_funcs panel_connector_helper_funcs = {
+ .get_modes = panel_connector_get_modes,
+- .mode_valid = panel_connector_mode_valid,
+ .best_encoder = panel_connector_best_encoder,
+ };
+
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c b/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c
+index daebf1aa6b0a8..54c6d825b1a06 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c
+@@ -183,14 +183,6 @@ static int tfp410_connector_get_modes(struct drm_connector *connector)
+ return ret;
+ }
+
+-static int tfp410_connector_mode_valid(struct drm_connector *connector,
+- struct drm_display_mode *mode)
+-{
+- struct tilcdc_drm_private *priv = connector->dev->dev_private;
+- /* our only constraints are what the crtc can generate: */
+- return tilcdc_crtc_mode_valid(priv->crtc, mode);
+-}
+-
+ static struct drm_encoder *tfp410_connector_best_encoder(
+ struct drm_connector *connector)
+ {
+@@ -209,7 +201,6 @@ static const struct drm_connector_funcs tfp410_connector_funcs = {
+
+ static const struct drm_connector_helper_funcs tfp410_connector_helper_funcs = {
+ .get_modes = tfp410_connector_get_modes,
+- .mode_valid = tfp410_connector_mode_valid,
+ .best_encoder = tfp410_connector_best_encoder,
+ };
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 8d4153c73f5cf..70079d29822b7 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -727,6 +727,8 @@
+ #define USB_DEVICE_ID_LENOVO_TPPRODOCK 0x6067
+ #define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085
+ #define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3
++#define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5
++#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d
+
+ #define USB_VENDOR_ID_LG 0x1fd2
+ #define USB_DEVICE_ID_LG_MULTITOUCH 0x0064
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index e99286258f62f..ce027eda9b178 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -72,6 +72,7 @@ MODULE_LICENSE("GPL");
+ #define MT_QUIRK_STICKY_FINGERS BIT(16)
+ #define MT_QUIRK_ASUS_CUSTOM_UP BIT(17)
+ #define MT_QUIRK_WIN8_PTP_BUTTONS BIT(18)
++#define MT_QUIRK_SEPARATE_APP_REPORT BIT(19)
+
+ #define MT_INPUTMODE_TOUCHSCREEN 0x02
+ #define MT_INPUTMODE_TOUCHPAD 0x03
+@@ -107,6 +108,7 @@ struct mt_usages {
+ struct mt_application {
+ struct list_head list;
+ unsigned int application;
++ unsigned int report_id;
+ struct list_head mt_usages; /* mt usages list */
+
+ __s32 quirks;
+@@ -207,6 +209,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app);
+ #define MT_CLS_VTL 0x0110
+ #define MT_CLS_GOOGLE 0x0111
+ #define MT_CLS_RAZER_BLADE_STEALTH 0x0112
++#define MT_CLS_SMART_TECH 0x0113
+
+ #define MT_DEFAULT_MAXCONTACT 10
+ #define MT_MAX_MAXCONTACT 250
+@@ -357,6 +360,12 @@ static const struct mt_class mt_classes[] = {
+ MT_QUIRK_CONTACT_CNT_ACCURATE |
+ MT_QUIRK_WIN8_PTP_BUTTONS,
+ },
++ { .name = MT_CLS_SMART_TECH,
++ .quirks = MT_QUIRK_ALWAYS_VALID |
++ MT_QUIRK_IGNORE_DUPLICATES |
++ MT_QUIRK_CONTACT_CNT_ACCURATE |
++ MT_QUIRK_SEPARATE_APP_REPORT,
++ },
+ { }
+ };
+
+@@ -513,8 +522,9 @@ static struct mt_usages *mt_allocate_usage(struct hid_device *hdev,
+ }
+
+ static struct mt_application *mt_allocate_application(struct mt_device *td,
+- unsigned int application)
++ struct hid_report *report)
+ {
++ unsigned int application = report->application;
+ struct mt_application *mt_application;
+
+ mt_application = devm_kzalloc(&td->hdev->dev, sizeof(*mt_application),
+@@ -539,6 +549,7 @@ static struct mt_application *mt_allocate_application(struct mt_device *td,
+ mt_application->scantime = DEFAULT_ZERO;
+ mt_application->raw_cc = DEFAULT_ZERO;
+ mt_application->quirks = td->mtclass.quirks;
++ mt_application->report_id = report->id;
+
+ list_add_tail(&mt_application->list, &td->applications);
+
+@@ -546,19 +557,23 @@ static struct mt_application *mt_allocate_application(struct mt_device *td,
+ }
+
+ static struct mt_application *mt_find_application(struct mt_device *td,
+- unsigned int application)
++ struct hid_report *report)
+ {
++ unsigned int application = report->application;
+ struct mt_application *tmp, *mt_application = NULL;
+
+ list_for_each_entry(tmp, &td->applications, list) {
+ if (application == tmp->application) {
+- mt_application = tmp;
+- break;
++ if (!(td->mtclass.quirks & MT_QUIRK_SEPARATE_APP_REPORT) ||
++ tmp->report_id == report->id) {
++ mt_application = tmp;
++ break;
++ }
+ }
+ }
+
+ if (!mt_application)
+- mt_application = mt_allocate_application(td, application);
++ mt_application = mt_allocate_application(td, report);
+
+ return mt_application;
+ }
+@@ -575,7 +590,7 @@ static struct mt_report_data *mt_allocate_report_data(struct mt_device *td,
+ return NULL;
+
+ rdata->report = report;
+- rdata->application = mt_find_application(td, report->application);
++ rdata->application = mt_find_application(td, report);
+
+ if (!rdata->application) {
+ devm_kfree(&td->hdev->dev, rdata);
+@@ -1332,6 +1347,13 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ return mt_touch_input_mapping(hdev, hi, field, usage, bit, max,
+ application);
+
++ /*
++ * some egalax touchscreens have "application == DG_TOUCHSCREEN"
++ * for the stylus. Overwrite the hid_input application
++ */
++ if (field->physical == HID_DG_STYLUS)
++ hi->application = HID_DG_STYLUS;
++
+ /* let hid-core decide for the others */
+ return 0;
+ }
+@@ -1520,14 +1542,12 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ struct mt_device *td = hid_get_drvdata(hdev);
+ char *name;
+ const char *suffix = NULL;
+- unsigned int application = 0;
+ struct mt_report_data *rdata;
+ struct mt_application *mt_application = NULL;
+ struct hid_report *report;
+ int ret;
+
+ list_for_each_entry(report, &hi->reports, hidinput_list) {
+- application = report->application;
+ rdata = mt_find_report_data(td, report);
+ if (!rdata) {
+ hid_err(hdev, "failed to allocate data for report\n");
+@@ -1542,46 +1562,36 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ if (ret)
+ return ret;
+ }
+-
+- /*
+- * some egalax touchscreens have "application == DG_TOUCHSCREEN"
+- * for the stylus. Check this first, and then rely on
+- * the application field.
+- */
+- if (report->field[0]->physical == HID_DG_STYLUS) {
+- suffix = "Pen";
+- /* force BTN_STYLUS to allow tablet matching in udev */
+- __set_bit(BTN_STYLUS, hi->input->keybit);
+- }
+ }
+
+- if (!suffix) {
+- switch (application) {
+- case HID_GD_KEYBOARD:
+- case HID_GD_KEYPAD:
+- case HID_GD_MOUSE:
+- case HID_DG_TOUCHPAD:
+- case HID_GD_SYSTEM_CONTROL:
+- case HID_CP_CONSUMER_CONTROL:
+- case HID_GD_WIRELESS_RADIO_CTLS:
+- case HID_GD_SYSTEM_MULTIAXIS:
+- /* already handled by hid core */
+- break;
+- case HID_DG_TOUCHSCREEN:
+- /* we do not set suffix = "Touchscreen" */
+- hi->input->name = hdev->name;
+- break;
+- case HID_DG_STYLUS:
+- /* force BTN_STYLUS to allow tablet matching in udev */
+- __set_bit(BTN_STYLUS, hi->input->keybit);
+- break;
+- case HID_VD_ASUS_CUSTOM_MEDIA_KEYS:
+- suffix = "Custom Media Keys";
+- break;
+- default:
+- suffix = "UNKNOWN";
+- break;
+- }
++ switch (hi->application) {
++ case HID_GD_KEYBOARD:
++ case HID_GD_KEYPAD:
++ case HID_GD_MOUSE:
++ case HID_DG_TOUCHPAD:
++ case HID_GD_SYSTEM_CONTROL:
++ case HID_CP_CONSUMER_CONTROL:
++ case HID_GD_WIRELESS_RADIO_CTLS:
++ case HID_GD_SYSTEM_MULTIAXIS:
++ /* already handled by hid core */
++ break;
++ case HID_DG_TOUCHSCREEN:
++ /* we do not set suffix = "Touchscreen" */
++ hi->input->name = hdev->name;
++ break;
++ case HID_DG_STYLUS:
++ /* force BTN_STYLUS to allow tablet matching in udev */
++ __set_bit(BTN_STYLUS, hi->input->keybit);
++ break;
++ case HID_VD_ASUS_CUSTOM_MEDIA_KEYS:
++ suffix = "Custom Media Keys";
++ break;
++ case HID_DG_PEN:
++ suffix = "Stylus";
++ break;
++ default:
++ suffix = "UNKNOWN";
++ break;
+ }
+
+ if (suffix) {
+@@ -1805,6 +1815,12 @@ static const struct hid_device_id mt_devices[] = {
+ USB_VENDOR_ID_LENOVO,
+ USB_DEVICE_ID_LENOVO_X1_TAB) },
+
++ /* Lenovo X1 TAB Gen 3 */
++ { .driver_data = MT_CLS_WIN_8_DUAL,
++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
++ USB_VENDOR_ID_LENOVO,
++ USB_DEVICE_ID_LENOVO_X1_TAB3) },
++
+ /* Anton devices */
+ { .driver_data = MT_CLS_EXPORT_ALL_INPUTS,
+ MT_USB_DEVICE(USB_VENDOR_ID_ANTON,
+@@ -2040,6 +2056,10 @@ static const struct hid_device_id mt_devices[] = {
+ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+ USB_VENDOR_ID_SYNAPTICS, 0x8323) },
+
++ /* Smart Tech panels */
++ { .driver_data = MT_CLS_SMART_TECH,
++ MT_USB_DEVICE(0x0b8c, 0x0092)},
++
+ /* Stantum panels */
+ { .driver_data = MT_CLS_CONFIDENCE,
+ MT_USB_DEVICE(USB_VENDOR_ID_STANTUM_STM,
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 48e9761d4ace9..c1b76ba85fb44 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -111,6 +111,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_V2), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE_ID2), HID_QUIRK_ALWAYS_POLL },
++ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C007), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS), HID_QUIRK_NOGET },
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index 273f57e277b3d..512c61d31fe5c 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -203,9 +203,9 @@ static inline bool cdns_is_holdquirk(struct cdns_i2c *id, bool hold_wrkaround)
+ */
+ static irqreturn_t cdns_i2c_isr(int irq, void *ptr)
+ {
+- unsigned int isr_status, avail_bytes, updatetx;
++ unsigned int isr_status, avail_bytes;
+ unsigned int bytes_to_send;
+- bool hold_quirk;
++ bool updatetx;
+ struct cdns_i2c *id = ptr;
+ /* Signal completion only after everything is updated */
+ int done_flag = 0;
+@@ -224,11 +224,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr)
+ * Check if transfer size register needs to be updated again for a
+ * large data receive operation.
+ */
+- updatetx = 0;
+- if (id->recv_count > id->curr_recv_count)
+- updatetx = 1;
+-
+- hold_quirk = (id->quirks & CDNS_I2C_BROKEN_HOLD_BIT) && updatetx;
++ updatetx = id->recv_count > id->curr_recv_count;
+
+ /* When receiving, handle data interrupt and completion interrupt */
+ if (id->p_recv_buf &&
+@@ -251,7 +247,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr)
+ id->recv_count--;
+ id->curr_recv_count--;
+
+- if (cdns_is_holdquirk(id, hold_quirk))
++ if (cdns_is_holdquirk(id, updatetx))
+ break;
+ }
+
+@@ -262,7 +258,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr)
+ * maintain transfer size non-zero while performing a large
+ * receive operation.
+ */
+- if (cdns_is_holdquirk(id, hold_quirk)) {
++ if (cdns_is_holdquirk(id, updatetx)) {
+ /* wait while fifo is full */
+ while (cdns_i2c_readreg(CDNS_I2C_XFER_SIZE_OFFSET) !=
+ (id->curr_recv_count - CDNS_I2C_FIFO_DEPTH))
+@@ -284,22 +280,6 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr)
+ CDNS_I2C_XFER_SIZE_OFFSET);
+ id->curr_recv_count = id->recv_count;
+ }
+- } else if (id->recv_count && !hold_quirk &&
+- !id->curr_recv_count) {
+-
+- /* Set the slave address in address register*/
+- cdns_i2c_writereg(id->p_msg->addr & CDNS_I2C_ADDR_MASK,
+- CDNS_I2C_ADDR_OFFSET);
+-
+- if (id->recv_count > CDNS_I2C_TRANSFER_SIZE) {
+- cdns_i2c_writereg(CDNS_I2C_TRANSFER_SIZE,
+- CDNS_I2C_XFER_SIZE_OFFSET);
+- id->curr_recv_count = CDNS_I2C_TRANSFER_SIZE;
+- } else {
+- cdns_i2c_writereg(id->recv_count,
+- CDNS_I2C_XFER_SIZE_OFFSET);
+- id->curr_recv_count = id->recv_count;
+- }
+ }
+
+ /* Clear hold (if not repeated start) and signal completion */
+diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
+index 1e9d882c04ef1..a4a448d97451d 100644
+--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
+@@ -2291,7 +2291,7 @@ err:
+
+ /* Uses sync mcc */
+ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter,
+- u8 page_num, u8 *data)
++ u8 page_num, u32 off, u32 len, u8 *data)
+ {
+ struct be_dma_mem cmd;
+ struct be_mcc_wrb *wrb;
+@@ -2325,10 +2325,10 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter,
+ req->port = cpu_to_le32(adapter->hba_port_num);
+ req->page_num = cpu_to_le32(page_num);
+ status = be_mcc_notify_wait(adapter);
+- if (!status) {
++ if (!status && len > 0) {
+ struct be_cmd_resp_port_type *resp = cmd.va;
+
+- memcpy(data, resp->page_data, PAGE_DATA_LEN);
++ memcpy(data, resp->page_data + off, len);
+ }
+ err:
+ mutex_unlock(&adapter->mcc_lock);
+@@ -2419,7 +2419,7 @@ int be_cmd_query_cable_type(struct be_adapter *adapter)
+ int status;
+
+ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0,
+- page_data);
++ 0, PAGE_DATA_LEN, page_data);
+ if (!status) {
+ switch (adapter->phy.interface_type) {
+ case PHY_TYPE_QSFP:
+@@ -2444,7 +2444,7 @@ int be_cmd_query_sfp_info(struct be_adapter *adapter)
+ int status;
+
+ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0,
+- page_data);
++ 0, PAGE_DATA_LEN, page_data);
+ if (!status) {
+ strlcpy(adapter->phy.vendor_name, page_data +
+ SFP_VENDOR_NAME_OFFSET, SFP_VENDOR_NAME_LEN - 1);
+diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
+index e8b43cf44b6f0..f6f9c51a7d471 100644
+--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
++++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
+@@ -2431,7 +2431,7 @@ int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num, u8 beacon,
+ int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num,
+ u32 *state);
+ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter,
+- u8 page_num, u8 *data);
++ u8 page_num, u32 off, u32 len, u8 *data);
+ int be_cmd_query_cable_type(struct be_adapter *adapter);
+ int be_cmd_query_sfp_info(struct be_adapter *adapter);
+ int lancer_cmd_read_object(struct be_adapter *adapter, struct be_dma_mem *cmd,
+diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c
+index d1905d50c26cb..1c1ac3488da2b 100644
+--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c
++++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c
+@@ -1342,7 +1342,7 @@ static int be_get_module_info(struct net_device *netdev,
+ return -EOPNOTSUPP;
+
+ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0,
+- page_data);
++ 0, PAGE_DATA_LEN, page_data);
+ if (!status) {
+ if (!page_data[SFP_PLUS_SFF_8472_COMP]) {
+ modinfo->type = ETH_MODULE_SFF_8079;
+@@ -1360,25 +1360,32 @@ static int be_get_module_eeprom(struct net_device *netdev,
+ {
+ struct be_adapter *adapter = netdev_priv(netdev);
+ int status;
++ u32 begin, end;
+
+ if (!check_privilege(adapter, MAX_PRIVILEGES))
+ return -EOPNOTSUPP;
+
+- status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0,
+- data);
+- if (status)
+- goto err;
++ begin = eeprom->offset;
++ end = eeprom->offset + eeprom->len;
++
++ if (begin < PAGE_DATA_LEN) {
++ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, begin,
++ min_t(u32, end, PAGE_DATA_LEN) - begin,
++ data);
++ if (status)
++ goto err;
++
++ data += PAGE_DATA_LEN - begin;
++ begin = PAGE_DATA_LEN;
++ }
+
+- if (eeprom->offset + eeprom->len > PAGE_DATA_LEN) {
+- status = be_cmd_read_port_transceiver_data(adapter,
+- TR_PAGE_A2,
+- data +
+- PAGE_DATA_LEN);
++ if (end > PAGE_DATA_LEN) {
++ status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A2,
++ begin - PAGE_DATA_LEN,
++ end - begin, data);
+ if (status)
+ goto err;
+ }
+- if (eeprom->offset)
+- memcpy(data, data + eeprom->offset, eeprom->len);
+ err:
+ return be_cmd_status(status);
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index bc8871e7351f2..00b6af0b2f3a8 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -222,6 +222,9 @@ static void dwmac4_map_mtl_dma(struct mac_device_info *hw, u32 queue, u32 chan)
+ if (queue == 0 || queue == 4) {
+ value &= ~MTL_RXQ_DMA_Q04MDMACH_MASK;
+ value |= MTL_RXQ_DMA_Q04MDMACH(chan);
++ } else if (queue > 4) {
++ value &= ~MTL_RXQ_DMA_QXMDMACH_MASK(queue - 4);
++ value |= MTL_RXQ_DMA_QXMDMACH(chan, queue - 4);
+ } else {
+ value &= ~MTL_RXQ_DMA_QXMDMACH_MASK(queue);
+ value |= MTL_RXQ_DMA_QXMDMACH(chan, queue);
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index cf6ff8732fb2c..efee7bacfd76a 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1706,7 +1706,7 @@ static const struct driver_info ax88179_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1719,7 +1719,7 @@ static const struct driver_info ax88178a_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1732,7 +1732,7 @@ static const struct driver_info cypress_GX3_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1745,7 +1745,7 @@ static const struct driver_info dlink_dub1312_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1758,7 +1758,7 @@ static const struct driver_info sitecom_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1771,7 +1771,7 @@ static const struct driver_info samsung_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1784,7 +1784,7 @@ static const struct driver_info lenovo_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1797,7 +1797,7 @@ static const struct driver_info belkin_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
+index 5c28498466415..63c79e140f1a8 100644
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -831,6 +831,10 @@ static void hv_int_desc_free(struct hv_pci_dev *hpdev,
+ u8 buffer[sizeof(struct pci_delete_interrupt)];
+ } ctxt;
+
++ if (!int_desc->vector_count) {
++ kfree(int_desc);
++ return;
++ }
+ memset(&ctxt, 0, sizeof(ctxt));
+ int_pkt = (struct pci_delete_interrupt *)&ctxt.pkt.message;
+ int_pkt->message_type.type =
+@@ -893,6 +897,28 @@ static void hv_irq_mask(struct irq_data *data)
+ pci_msi_mask_irq(data);
+ }
+
++static unsigned int hv_msi_get_int_vector(struct irq_data *data)
++{
++ struct irq_cfg *cfg = irqd_cfg(data);
++
++ return cfg->vector;
++}
++
++static int hv_msi_prepare(struct irq_domain *domain, struct device *dev,
++ int nvec, msi_alloc_info_t *info)
++{
++ int ret = pci_msi_prepare(domain, dev, nvec, info);
++
++ /*
++ * By using the interrupt remapper in the hypervisor IOMMU, contiguous
++ * CPU vectors is not needed for multi-MSI
++ */
++ if (info->type == X86_IRQ_ALLOC_TYPE_MSI)
++ info->flags &= ~X86_IRQ_ALLOC_CONTIGUOUS_VECTORS;
++
++ return ret;
++}
++
+ /**
+ * hv_irq_unmask() - "Unmask" the IRQ by setting its current
+ * affinity.
+@@ -908,6 +934,7 @@ static void hv_irq_unmask(struct irq_data *data)
+ struct msi_desc *msi_desc = irq_data_get_msi_desc(data);
+ struct irq_cfg *cfg = irqd_cfg(data);
+ struct retarget_msi_interrupt *params;
++ struct tran_int_desc *int_desc;
+ struct hv_pcibus_device *hbus;
+ struct cpumask *dest;
+ struct pci_bus *pbus;
+@@ -922,6 +949,7 @@ static void hv_irq_unmask(struct irq_data *data)
+ pdev = msi_desc_to_pci_dev(msi_desc);
+ pbus = pdev->bus;
+ hbus = container_of(pbus->sysdata, struct hv_pcibus_device, sysdata);
++ int_desc = data->chip_data;
+
+ spin_lock_irqsave(&hbus->retarget_msi_interrupt_lock, flags);
+
+@@ -929,8 +957,8 @@ static void hv_irq_unmask(struct irq_data *data)
+ memset(params, 0, sizeof(*params));
+ params->partition_id = HV_PARTITION_ID_SELF;
+ params->int_entry.source = 1; /* MSI(-X) */
+- params->int_entry.address = msi_desc->msg.address_lo;
+- params->int_entry.data = msi_desc->msg.data;
++ params->int_entry.address = int_desc->address & 0xffffffff;
++ params->int_entry.data = int_desc->data;
+ params->device_id = (hbus->hdev->dev_instance.b[5] << 24) |
+ (hbus->hdev->dev_instance.b[4] << 16) |
+ (hbus->hdev->dev_instance.b[7] << 8) |
+@@ -1018,12 +1046,12 @@ static void hv_pci_compose_compl(void *context, struct pci_response *resp,
+
+ static u32 hv_compose_msi_req_v1(
+ struct pci_create_interrupt *int_pkt, struct cpumask *affinity,
+- u32 slot, u8 vector)
++ u32 slot, u8 vector, u8 vector_count)
+ {
+ int_pkt->message_type.type = PCI_CREATE_INTERRUPT_MESSAGE;
+ int_pkt->wslot.slot = slot;
+ int_pkt->int_desc.vector = vector;
+- int_pkt->int_desc.vector_count = 1;
++ int_pkt->int_desc.vector_count = vector_count;
+ int_pkt->int_desc.delivery_mode = dest_Fixed;
+
+ /*
+@@ -1037,14 +1065,14 @@ static u32 hv_compose_msi_req_v1(
+
+ static u32 hv_compose_msi_req_v2(
+ struct pci_create_interrupt2 *int_pkt, struct cpumask *affinity,
+- u32 slot, u8 vector)
++ u32 slot, u8 vector, u8 vector_count)
+ {
+ int cpu;
+
+ int_pkt->message_type.type = PCI_CREATE_INTERRUPT_MESSAGE2;
+ int_pkt->wslot.slot = slot;
+ int_pkt->int_desc.vector = vector;
+- int_pkt->int_desc.vector_count = 1;
++ int_pkt->int_desc.vector_count = vector_count;
+ int_pkt->int_desc.delivery_mode = dest_Fixed;
+
+ /*
+@@ -1072,7 +1100,6 @@ static u32 hv_compose_msi_req_v2(
+ */
+ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ {
+- struct irq_cfg *cfg = irqd_cfg(data);
+ struct hv_pcibus_device *hbus;
+ struct hv_pci_dev *hpdev;
+ struct pci_bus *pbus;
+@@ -1081,6 +1108,8 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ unsigned long flags;
+ struct compose_comp_ctxt comp;
+ struct tran_int_desc *int_desc;
++ struct msi_desc *msi_desc;
++ u8 vector, vector_count;
+ struct {
+ struct pci_packet pci_pkt;
+ union {
+@@ -1092,7 +1121,17 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ u32 size;
+ int ret;
+
+- pdev = msi_desc_to_pci_dev(irq_data_get_msi_desc(data));
++ /* Reuse the previous allocation */
++ if (data->chip_data) {
++ int_desc = data->chip_data;
++ msg->address_hi = int_desc->address >> 32;
++ msg->address_lo = int_desc->address & 0xffffffff;
++ msg->data = int_desc->data;
++ return;
++ }
++
++ msi_desc = irq_data_get_msi_desc(data);
++ pdev = msi_desc_to_pci_dev(msi_desc);
+ dest = irq_data_get_effective_affinity_mask(data);
+ pbus = pdev->bus;
+ hbus = container_of(pbus->sysdata, struct hv_pcibus_device, sysdata);
+@@ -1100,17 +1139,40 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ if (!hpdev)
+ goto return_null_message;
+
+- /* Free any previous message that might have already been composed. */
+- if (data->chip_data) {
+- int_desc = data->chip_data;
+- data->chip_data = NULL;
+- hv_int_desc_free(hpdev, int_desc);
+- }
+-
+ int_desc = kzalloc(sizeof(*int_desc), GFP_ATOMIC);
+ if (!int_desc)
+ goto drop_reference;
+
++ if (!msi_desc->msi_attrib.is_msix && msi_desc->nvec_used > 1) {
++ /*
++ * If this is not the first MSI of Multi MSI, we already have
++ * a mapping. Can exit early.
++ */
++ if (msi_desc->irq != data->irq) {
++ data->chip_data = int_desc;
++ int_desc->address = msi_desc->msg.address_lo |
++ (u64)msi_desc->msg.address_hi << 32;
++ int_desc->data = msi_desc->msg.data +
++ (data->irq - msi_desc->irq);
++ msg->address_hi = msi_desc->msg.address_hi;
++ msg->address_lo = msi_desc->msg.address_lo;
++ msg->data = int_desc->data;
++ put_pcichild(hpdev);
++ return;
++ }
++ /*
++ * The vector we select here is a dummy value. The correct
++ * value gets sent to the hypervisor in unmask(). This needs
++ * to be aligned with the count, and also not zero. Multi-msi
++ * is powers of 2 up to 32, so 32 will always work here.
++ */
++ vector = 32;
++ vector_count = msi_desc->nvec_used;
++ } else {
++ vector = hv_msi_get_int_vector(data);
++ vector_count = 1;
++ }
++
+ memset(&ctxt, 0, sizeof(ctxt));
+ init_completion(&comp.comp_pkt.host_event);
+ ctxt.pci_pkt.completion_func = hv_pci_compose_compl;
+@@ -1121,14 +1183,16 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ size = hv_compose_msi_req_v1(&ctxt.int_pkts.v1,
+ dest,
+ hpdev->desc.win_slot.slot,
+- cfg->vector);
++ vector,
++ vector_count);
+ break;
+
+ case PCI_PROTOCOL_VERSION_1_2:
+ size = hv_compose_msi_req_v2(&ctxt.int_pkts.v2,
+ dest,
+ hpdev->desc.win_slot.slot,
+- cfg->vector);
++ vector,
++ vector_count);
+ break;
+
+ default:
+@@ -1240,7 +1304,7 @@ static irq_hw_number_t hv_msi_domain_ops_get_hwirq(struct msi_domain_info *info,
+
+ static struct msi_domain_ops hv_msi_ops = {
+ .get_hwirq = hv_msi_domain_ops_get_hwirq,
+- .msi_prepare = pci_msi_prepare,
++ .msi_prepare = hv_msi_prepare,
+ .set_desc = pci_msi_set_desc,
+ .msi_free = hv_msi_free,
+ };
+diff --git a/drivers/power/reset/arm-versatile-reboot.c b/drivers/power/reset/arm-versatile-reboot.c
+index 06d34ab47df53..8022c782f6ff3 100644
+--- a/drivers/power/reset/arm-versatile-reboot.c
++++ b/drivers/power/reset/arm-versatile-reboot.c
+@@ -150,6 +150,7 @@ static int __init versatile_reboot_probe(void)
+ versatile_reboot_type = (enum versatile_reboot)reboot_id->data;
+
+ syscon_regmap = syscon_node_to_regmap(np);
++ of_node_put(np);
+ if (IS_ERR(syscon_regmap))
+ return PTR_ERR(syscon_regmap);
+
+diff --git a/drivers/s390/char/keyboard.h b/drivers/s390/char/keyboard.h
+index c467589c7f452..c06d399b9b1f1 100644
+--- a/drivers/s390/char/keyboard.h
++++ b/drivers/s390/char/keyboard.h
+@@ -56,7 +56,7 @@ static inline void
+ kbd_put_queue(struct tty_port *port, int ch)
+ {
+ tty_insert_flip_char(port, ch, 0);
+- tty_schedule_flip(port);
++ tty_flip_buffer_push(port);
+ }
+
+ static inline void
+@@ -64,5 +64,5 @@ kbd_puts_queue(struct tty_port *port, char *cp)
+ {
+ while (*cp)
+ tty_insert_flip_char(port, *cp++, 0);
+- tty_schedule_flip(port);
++ tty_flip_buffer_push(port);
+ }
+diff --git a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
+index ad811c0438cc7..031526cb1b214 100644
+--- a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
++++ b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c
+@@ -267,6 +267,8 @@ static int rt2880_pinmux_pins(struct rt2880_priv *p)
+ p->func[i]->pin_count,
+ sizeof(int),
+ GFP_KERNEL);
++ if (!p->func[i]->pins)
++ return -ENOMEM;
+ for (j = 0; j < p->func[i]->pin_count; j++)
+ p->func[i]->pins[j] = p->func[i]->pin_first + j;
+
+diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c
+index 5c282e8522fb3..8a44da5b05652 100644
+--- a/drivers/staging/speakup/spk_ttyio.c
++++ b/drivers/staging/speakup/spk_ttyio.c
+@@ -88,7 +88,7 @@ static int spk_ttyio_receive_buf2(struct tty_struct *tty,
+ }
+
+ if (!ldisc_data->buf_free)
+- /* ttyio_in will tty_schedule_flip */
++ /* ttyio_in will tty_flip_buffer_push */
+ return 0;
+
+ /* Make sure the consumer has read buf before we have seen
+@@ -321,7 +321,7 @@ static unsigned char ttyio_in(int timeout)
+ mb();
+ ldisc_data->buf_free = true;
+ /* Let TTY push more characters */
+- tty_schedule_flip(speakup_tty->port);
++ tty_flip_buffer_push(speakup_tty->port);
+
+ return rv;
+ }
+diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
+index 6d3c58051ce33..db048dbe9f785 100644
+--- a/drivers/tty/cyclades.c
++++ b/drivers/tty/cyclades.c
+@@ -556,7 +556,7 @@ static void cyy_chip_rx(struct cyclades_card *cinfo, int chip,
+ }
+ info->idle_stats.recv_idle = jiffies;
+ }
+- tty_schedule_flip(port);
++ tty_flip_buffer_push(port);
+
+ /* end of service */
+ cyy_writeb(info, CyRIR, save_xir & 0x3f);
+@@ -996,7 +996,7 @@ static void cyz_handle_rx(struct cyclades_port *info)
+ mod_timer(&info->rx_full_timer, jiffies + 1);
+ #endif
+ info->idle_stats.recv_idle = jiffies;
+- tty_schedule_flip(&info->port);
++ tty_flip_buffer_push(&info->port);
+
+ /* Update rx_get */
+ cy_writel(&buf_ctrl->rx_get, new_rx_get);
+@@ -1172,7 +1172,7 @@ static void cyz_handle_cmd(struct cyclades_card *cinfo)
+ if (delta_count)
+ wake_up_interruptible(&info->port.delta_msr_wait);
+ if (special_count)
+- tty_schedule_flip(&info->port);
++ tty_flip_buffer_push(&info->port);
+ }
+ }
+
+diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c
+index 9180ca5e4dcd4..d6e82eb61fc2d 100644
+--- a/drivers/tty/goldfish.c
++++ b/drivers/tty/goldfish.c
+@@ -151,7 +151,7 @@ static irqreturn_t goldfish_tty_interrupt(int irq, void *dev_id)
+ address = (unsigned long)(void *)buf;
+ goldfish_tty_rw(qtty, address, count, 0);
+
+- tty_schedule_flip(&qtty->port);
++ tty_flip_buffer_push(&qtty->port);
+ return IRQ_HANDLED;
+ }
+
+diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c
+index 250a19f042d74..181381fa5126c 100644
+--- a/drivers/tty/moxa.c
++++ b/drivers/tty/moxa.c
+@@ -1393,7 +1393,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle,
+ if (inited && !tty_throttled(tty) &&
+ MoxaPortRxQueue(p) > 0) { /* RX */
+ MoxaPortReadData(p);
+- tty_schedule_flip(&p->port);
++ tty_flip_buffer_push(&p->port);
+ }
+ } else {
+ clear_bit(EMPTYWAIT, &p->statusflags);
+@@ -1418,7 +1418,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle,
+
+ if (tty && (intr & IntrBreak) && !I_IGNBRK(tty)) { /* BREAK */
+ tty_insert_flip_char(&p->port, 0, TTY_BREAK);
+- tty_schedule_flip(&p->port);
++ tty_flip_buffer_push(&p->port);
+ }
+
+ if (intr & IntrLine)
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index c6a1d8c4e6894..73226e482e919 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -111,21 +111,11 @@ static void pty_unthrottle(struct tty_struct *tty)
+ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
+ {
+ struct tty_struct *to = tty->link;
+- unsigned long flags;
+
+- if (tty->stopped)
++ if (tty->stopped || !c)
+ return 0;
+
+- if (c > 0) {
+- spin_lock_irqsave(&to->port->lock, flags);
+- /* Stuff the data into the input queue of the other end */
+- c = tty_insert_flip_string(to->port, buf, c);
+- spin_unlock_irqrestore(&to->port->lock, flags);
+- /* And shovel */
+- if (c)
+- tty_flip_buffer_push(to->port);
+- }
+- return c;
++ return tty_insert_flip_string_and_push_buffer(to->port, buf, c);
+ }
+
+ /**
+diff --git a/drivers/tty/serial/lpc32xx_hs.c b/drivers/tty/serial/lpc32xx_hs.c
+index d1d73261575b2..9c145ed0dcf70 100644
+--- a/drivers/tty/serial/lpc32xx_hs.c
++++ b/drivers/tty/serial/lpc32xx_hs.c
+@@ -341,7 +341,7 @@ static irqreturn_t serial_lpc32xx_interrupt(int irq, void *dev_id)
+ LPC32XX_HSUART_IIR(port->membase));
+ port->icount.overrun++;
+ tty_insert_flip_char(tport, 0, TTY_OVERRUN);
+- tty_schedule_flip(tport);
++ tty_flip_buffer_push(tport);
+ }
+
+ /* Data received? */
+diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
+index 77f3f3728a79e..6449c156c4d67 100644
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -442,14 +442,14 @@ static void mvebu_uart_shutdown(struct uart_port *port)
+ }
+ }
+
+-static int mvebu_uart_baud_rate_set(struct uart_port *port, unsigned int baud)
++static unsigned int mvebu_uart_baud_rate_set(struct uart_port *port, unsigned int baud)
+ {
+ struct mvebu_uart *mvuart = to_mvuart(port);
+ unsigned int d_divisor, m_divisor;
+ u32 brdv;
+
+ if (IS_ERR(mvuart->clk))
+- return -PTR_ERR(mvuart->clk);
++ return 0;
+
+ /*
+ * The baudrate is derived from the UART clock thanks to two divisors:
+@@ -469,7 +469,7 @@ static int mvebu_uart_baud_rate_set(struct uart_port *port, unsigned int baud)
+ brdv |= d_divisor;
+ writel(brdv, port->membase + UART_BRDV);
+
+- return 0;
++ return DIV_ROUND_CLOSEST(port->uartclk, d_divisor * m_divisor);
+ }
+
+ static void mvebu_uart_set_termios(struct uart_port *port,
+@@ -506,15 +506,11 @@ static void mvebu_uart_set_termios(struct uart_port *port,
+ max_baud = 230400;
+
+ baud = uart_get_baud_rate(port, termios, old, min_baud, max_baud);
+- if (mvebu_uart_baud_rate_set(port, baud)) {
+- /* No clock available, baudrate cannot be changed */
+- if (old)
+- baud = uart_get_baud_rate(port, old, NULL,
+- min_baud, max_baud);
+- } else {
+- tty_termios_encode_baud_rate(termios, baud, baud);
+- uart_update_timeout(port, termios->c_cflag, baud);
+- }
++ baud = mvebu_uart_baud_rate_set(port, baud);
++
++ /* In case baudrate cannot be changed, report previous old value */
++ if (baud == 0 && old)
++ baud = tty_termios_baud_rate(old);
+
+ /* Only the following flag changes are supported */
+ if (old) {
+@@ -525,6 +521,11 @@ static void mvebu_uart_set_termios(struct uart_port *port,
+ termios->c_cflag |= CS8;
+ }
+
++ if (baud != 0) {
++ tty_termios_encode_baud_rate(termios, baud, baud);
++ uart_update_timeout(port, termios->c_cflag, baud);
++ }
++
+ spin_unlock_irqrestore(&port->lock, flags);
+ }
+
+diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
+index dfe0c8c22cd37..3ef4899c8f6a2 100644
+--- a/drivers/tty/tty_buffer.c
++++ b/drivers/tty/tty_buffer.c
+@@ -389,27 +389,6 @@ int __tty_insert_flip_char(struct tty_port *port, unsigned char ch, char flag)
+ }
+ EXPORT_SYMBOL(__tty_insert_flip_char);
+
+-/**
+- * tty_schedule_flip - push characters to ldisc
+- * @port: tty port to push from
+- *
+- * Takes any pending buffers and transfers their ownership to the
+- * ldisc side of the queue. It then schedules those characters for
+- * processing by the line discipline.
+- */
+-
+-void tty_schedule_flip(struct tty_port *port)
+-{
+- struct tty_bufhead *buf = &port->buf;
+-
+- /* paired w/ acquire in flush_to_ldisc(); ensures
+- * flush_to_ldisc() sees buffer data.
+- */
+- smp_store_release(&buf->tail->commit, buf->tail->used);
+- queue_work(system_unbound_wq, &buf->work);
+-}
+-EXPORT_SYMBOL(tty_schedule_flip);
+-
+ /**
+ * tty_prepare_flip_string - make room for characters
+ * @port: tty port
+@@ -539,6 +518,15 @@ static void flush_to_ldisc(struct work_struct *work)
+
+ }
+
++static inline void tty_flip_buffer_commit(struct tty_buffer *tail)
++{
++ /*
++ * Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees
++ * buffer data.
++ */
++ smp_store_release(&tail->commit, tail->used);
++}
++
+ /**
+ * tty_flip_buffer_push - terminal
+ * @port: tty port to push
+@@ -552,10 +540,44 @@ static void flush_to_ldisc(struct work_struct *work)
+
+ void tty_flip_buffer_push(struct tty_port *port)
+ {
+- tty_schedule_flip(port);
++ struct tty_bufhead *buf = &port->buf;
++
++ tty_flip_buffer_commit(buf->tail);
++ queue_work(system_unbound_wq, &buf->work);
+ }
+ EXPORT_SYMBOL(tty_flip_buffer_push);
+
++/**
++ * tty_insert_flip_string_and_push_buffer - add characters to the tty buffer and
++ * push
++ * @port: tty port
++ * @chars: characters
++ * @size: size
++ *
++ * The function combines tty_insert_flip_string() and tty_flip_buffer_push()
++ * with the exception of properly holding the @port->lock.
++ *
++ * To be used only internally (by pty currently).
++ *
++ * Returns: the number added.
++ */
++int tty_insert_flip_string_and_push_buffer(struct tty_port *port,
++ const unsigned char *chars, size_t size)
++{
++ struct tty_bufhead *buf = &port->buf;
++ unsigned long flags;
++
++ spin_lock_irqsave(&port->lock, flags);
++ size = tty_insert_flip_string(port, chars, size);
++ if (size)
++ tty_flip_buffer_commit(buf->tail);
++ spin_unlock_irqrestore(&port->lock, flags);
++
++ queue_work(system_unbound_wq, &buf->work);
++
++ return size;
++}
++
+ /**
+ * tty_buffer_init - prepare a tty buffer structure
+ * @tty: tty to initialise
+diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
+index 94cad9f86ff98..e3aac11d770fe 100644
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -310,7 +310,7 @@ int kbd_rate(struct kbd_repeat *rpt)
+ static void put_queue(struct vc_data *vc, int ch)
+ {
+ tty_insert_flip_char(&vc->port, ch, 0);
+- tty_schedule_flip(&vc->port);
++ tty_flip_buffer_push(&vc->port);
+ }
+
+ static void puts_queue(struct vc_data *vc, char *cp)
+@@ -319,7 +319,7 @@ static void puts_queue(struct vc_data *vc, char *cp)
+ tty_insert_flip_char(&vc->port, *cp, 0);
+ cp++;
+ }
+- tty_schedule_flip(&vc->port);
++ tty_flip_buffer_push(&vc->port);
+ }
+
+ static void applkey(struct vc_data *vc, int key, char mode)
+@@ -564,7 +564,7 @@ static void fn_inc_console(struct vc_data *vc)
+ static void fn_send_intr(struct vc_data *vc)
+ {
+ tty_insert_flip_char(&vc->port, 0, TTY_BREAK);
+- tty_schedule_flip(&vc->port);
++ tty_flip_buffer_push(&vc->port);
+ }
+
+ static void fn_scroll_forw(struct vc_data *vc)
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index dca627ccece57..20565603a3658 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1838,7 +1838,7 @@ static void respond_string(const char *p, struct tty_port *port)
+ tty_insert_flip_char(port, *p, 0);
+ p++;
+ }
+- tty_schedule_flip(port);
++ tty_flip_buffer_push(port);
+ }
+
+ static void cursor_report(struct vc_data *vc, struct tty_struct *tty)
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index 492084814f55d..27d955c5d9f90 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -416,7 +416,8 @@ static void __unmap_grant_pages_done(int result,
+ unsigned int offset = data->unmap_ops - map->unmap_ops;
+
+ for (i = 0; i < data->count; i++) {
+- WARN_ON(map->unmap_ops[offset+i].status);
++ WARN_ON(map->unmap_ops[offset+i].status &&
++ map->unmap_ops[offset+i].handle != -1);
+ pr_debug("unmap handle=%d st=%d\n",
+ map->unmap_ops[offset+i].handle,
+ map->unmap_ops[offset+i].status);
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index ac53403e9edb5..35bfb681bf133 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -4069,13 +4069,14 @@ static void send_repeat_remove(struct dlm_ls *ls, char *ms_name, int len)
+ rv = _create_message(ls, sizeof(struct dlm_message) + len,
+ dir_nodeid, DLM_MSG_REMOVE, &ms, &mh);
+ if (rv)
+- return;
++ goto out;
+
+ memcpy(ms->m_extra, name, len);
+ ms->m_hash = hash;
+
+ send_message(mh, ms);
+
++out:
+ spin_lock(&ls->ls_remove_spin);
+ ls->ls_remove_len = 0;
+ memset(ls->ls_remove_name, 0, DLM_RESNAME_MAXLEN);
+diff --git a/include/linux/tty_flip.h b/include/linux/tty_flip.h
+index 767f62086bd9b..c326bfdb5ec2c 100644
+--- a/include/linux/tty_flip.h
++++ b/include/linux/tty_flip.h
+@@ -12,7 +12,6 @@ extern int tty_insert_flip_string_fixed_flag(struct tty_port *port,
+ extern int tty_prepare_flip_string(struct tty_port *port,
+ unsigned char **chars, size_t size);
+ extern void tty_flip_buffer_push(struct tty_port *port);
+-void tty_schedule_flip(struct tty_port *port);
+ int __tty_insert_flip_char(struct tty_port *port, unsigned char ch, char flag);
+
+ static inline int tty_insert_flip_char(struct tty_port *port,
+@@ -40,4 +39,7 @@ static inline int tty_insert_flip_string(struct tty_port *port,
+ extern void tty_buffer_lock_exclusive(struct tty_port *port);
+ extern void tty_buffer_unlock_exclusive(struct tty_port *port);
+
++int tty_insert_flip_string_and_push_buffer(struct tty_port *port,
++ const unsigned char *chars, size_t cnt);
++
+ #endif /* _LINUX_TTY_FLIP_H */
+diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
+index fabee6db0abb7..421d41ef4e9ca 100644
+--- a/include/net/bluetooth/bluetooth.h
++++ b/include/net/bluetooth/bluetooth.h
+@@ -370,6 +370,71 @@ out:
+ return NULL;
+ }
+
++/* Shall not be called with lock_sock held */
++static inline struct sk_buff *bt_skb_sendmsg(struct sock *sk,
++ struct msghdr *msg,
++ size_t len, size_t mtu,
++ size_t headroom, size_t tailroom)
++{
++ struct sk_buff *skb;
++ size_t size = min_t(size_t, len, mtu);
++ int err;
++
++ skb = bt_skb_send_alloc(sk, size + headroom + tailroom,
++ msg->msg_flags & MSG_DONTWAIT, &err);
++ if (!skb)
++ return ERR_PTR(err);
++
++ skb_reserve(skb, headroom);
++ skb_tailroom_reserve(skb, mtu, tailroom);
++
++ if (!copy_from_iter_full(skb_put(skb, size), size, &msg->msg_iter)) {
++ kfree_skb(skb);
++ return ERR_PTR(-EFAULT);
++ }
++
++ skb->priority = sk->sk_priority;
++
++ return skb;
++}
++
++/* Similar to bt_skb_sendmsg but can split the msg into multiple fragments
++ * accourding to the MTU.
++ */
++static inline struct sk_buff *bt_skb_sendmmsg(struct sock *sk,
++ struct msghdr *msg,
++ size_t len, size_t mtu,
++ size_t headroom, size_t tailroom)
++{
++ struct sk_buff *skb, **frag;
++
++ skb = bt_skb_sendmsg(sk, msg, len, mtu, headroom, tailroom);
++ if (IS_ERR_OR_NULL(skb))
++ return skb;
++
++ len -= skb->len;
++ if (!len)
++ return skb;
++
++ /* Add remaining data over MTU as continuation fragments */
++ frag = &skb_shinfo(skb)->frag_list;
++ while (len) {
++ struct sk_buff *tmp;
++
++ tmp = bt_skb_sendmsg(sk, msg, len, mtu, headroom, tailroom);
++ if (IS_ERR(tmp)) {
++ return skb;
++ }
++
++ len -= tmp->len;
++
++ *frag = tmp;
++ frag = &(*frag)->next;
++ }
++
++ return skb;
++}
++
+ int bt_to_errno(u16 code);
+
+ void hci_sock_set_flag(struct sock *sk, int nr);
+diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
+index a80fd0ac45632..d5552ff1d361e 100644
+--- a/include/net/inet_sock.h
++++ b/include/net/inet_sock.h
+@@ -111,7 +111,8 @@ static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk)
+
+ static inline u32 inet_request_mark(const struct sock *sk, struct sk_buff *skb)
+ {
+- if (!sk->sk_mark && sock_net(sk)->ipv4.sysctl_tcp_fwmark_accept)
++ if (!sk->sk_mark &&
++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fwmark_accept))
+ return skb->mark;
+
+ return sk->sk_mark;
+@@ -357,7 +358,7 @@ static inline bool inet_get_convert_csum(struct sock *sk)
+ static inline bool inet_can_nonlocal_bind(struct net *net,
+ struct inet_sock *inet)
+ {
+- return net->ipv4.sysctl_ip_nonlocal_bind ||
++ return READ_ONCE(net->ipv4.sysctl_ip_nonlocal_bind) ||
+ inet->freebind || inet->transparent;
+ }
+
+diff --git a/include/net/ip.h b/include/net/ip.h
+index d1a4efedbc039..0f820e68bd8fc 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -341,7 +341,7 @@ void ipfrag_init(void);
+ void ip_static_sysctl_init(void);
+
+ #define IP4_REPLY_MARK(net, mark) \
+- ((net)->ipv4.sysctl_fwmark_reflect ? (mark) : 0)
++ (READ_ONCE((net)->ipv4.sysctl_fwmark_reflect) ? (mark) : 0)
+
+ static inline bool ip_is_fragment(const struct iphdr *iph)
+ {
+@@ -402,7 +402,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
+ struct net *net = dev_net(dst->dev);
+ unsigned int mtu;
+
+- if (net->ipv4.sysctl_ip_fwd_use_pmtu ||
++ if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) ||
+ ip_mtu_locked(dst) ||
+ !forwarding)
+ return dst_mtu(dst);
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 5c5807ed66eef..d28fa78dedb54 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1339,8 +1339,8 @@ static inline void tcp_slow_start_after_idle_check(struct sock *sk)
+ struct tcp_sock *tp = tcp_sk(sk);
+ s32 delta;
+
+- if (!sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle || tp->packets_out ||
+- ca_ops->cong_control)
++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle) ||
++ tp->packets_out || ca_ops->cong_control)
+ return;
+ delta = tcp_jiffies32 - tp->lsndtime;
+ if (delta > inet_csk(sk)->icsk_rto)
+@@ -1430,7 +1430,8 @@ static inline u32 keepalive_time_elapsed(const struct tcp_sock *tp)
+
+ static inline int tcp_fin_time(const struct sock *sk)
+ {
+- int fin_timeout = tcp_sk(sk)->linger2 ? : sock_net(sk)->ipv4.sysctl_tcp_fin_timeout;
++ int fin_timeout = tcp_sk(sk)->linger2 ? :
++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fin_timeout);
+ const int rto = inet_csk(sk)->icsk_rto;
+
+ if (fin_timeout < (rto << 2) - (rto >> 1))
+@@ -1875,7 +1876,7 @@ void __tcp_v4_send_check(struct sk_buff *skb, __be32 saddr, __be32 daddr);
+ static inline u32 tcp_notsent_lowat(const struct tcp_sock *tp)
+ {
+ struct net *net = sock_net((struct sock *)tp);
+- return tp->notsent_lowat ?: net->ipv4.sysctl_tcp_notsent_lowat;
++ return tp->notsent_lowat ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat);
+ }
+
+ static inline bool tcp_stream_memory_free(const struct sock *sk)
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 4e5b5ae05406e..cbbd0168f50c5 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -66,11 +66,13 @@ void *bpf_internal_load_pointer_neg_helper(const struct sk_buff *skb, int k, uns
+ {
+ u8 *ptr = NULL;
+
+- if (k >= SKF_NET_OFF)
++ if (k >= SKF_NET_OFF) {
+ ptr = skb_network_header(skb) + k - SKF_NET_OFF;
+- else if (k >= SKF_LL_OFF)
++ } else if (k >= SKF_LL_OFF) {
++ if (unlikely(!skb_mac_header_was_set(skb)))
++ return NULL;
+ ptr = skb_mac_header(skb) + k - SKF_LL_OFF;
+-
++ }
+ if (ptr >= skb->head && ptr + size <= skb_tail_pointer(skb))
+ return ptr;
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 88dd1398ae889..ba66ea3ca7056 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5719,10 +5719,10 @@ again:
+
+ if (!atomic_inc_not_zero(&event->rb->mmap_count)) {
+ /*
+- * Raced against perf_mmap_close() through
+- * perf_event_set_output(). Try again, hope for better
+- * luck.
++ * Raced against perf_mmap_close(); remove the
++ * event and try again.
+ */
++ ring_buffer_attach(event, NULL);
+ mutex_unlock(&event->mmap_mutex);
+ goto again;
+ }
+@@ -10396,14 +10396,25 @@ err_size:
+ goto out;
+ }
+
++static void mutex_lock_double(struct mutex *a, struct mutex *b)
++{
++ if (b < a)
++ swap(a, b);
++
++ mutex_lock(a);
++ mutex_lock_nested(b, SINGLE_DEPTH_NESTING);
++}
++
+ static int
+ perf_event_set_output(struct perf_event *event, struct perf_event *output_event)
+ {
+ struct ring_buffer *rb = NULL;
+ int ret = -EINVAL;
+
+- if (!output_event)
++ if (!output_event) {
++ mutex_lock(&event->mmap_mutex);
+ goto set;
++ }
+
+ /* don't allow circular references */
+ if (event == output_event)
+@@ -10441,8 +10452,15 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event)
+ event->pmu != output_event->pmu)
+ goto out;
+
++ /*
++ * Hold both mmap_mutex to serialize against perf_mmap_close(). Since
++ * output_event is already on rb->event_list, and the list iteration
++ * restarts after every removal, it is guaranteed this new event is
++ * observed *OR* if output_event is already removed, it's guaranteed we
++ * observe !rb->mmap_count.
++ */
++ mutex_lock_double(&event->mmap_mutex, &output_event->mmap_mutex);
+ set:
+- mutex_lock(&event->mmap_mutex);
+ /* Can't redirect output if we've got an active mmap() */
+ if (atomic_read(&event->mmap_count))
+ goto unlock;
+@@ -10452,6 +10470,12 @@ set:
+ rb = ring_buffer_get(output_event);
+ if (!rb)
+ goto unlock;
++
++ /* did we race against perf_mmap_close() */
++ if (!atomic_read(&rb->mmap_count)) {
++ ring_buffer_put(rb);
++ goto unlock;
++ }
+ }
+
+ ring_buffer_attach(event, rb);
+@@ -10459,20 +10483,13 @@ set:
+ ret = 0;
+ unlock:
+ mutex_unlock(&event->mmap_mutex);
++ if (output_event)
++ mutex_unlock(&output_event->mmap_mutex);
+
+ out:
+ return ret;
+ }
+
+-static void mutex_lock_double(struct mutex *a, struct mutex *b)
+-{
+- if (b < a)
+- swap(a, b);
+-
+- mutex_lock(a);
+- mutex_lock_nested(b, SINGLE_DEPTH_NESTING);
+-}
+-
+ static int perf_event_set_clock(struct perf_event *event, clockid_t clk_id)
+ {
+ bool nmi_safe = false;
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 5ada8897ef0ef..e44e737e90a35 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -348,7 +348,7 @@ static void mpol_rebind_preferred(struct mempolicy *pol,
+ */
+ static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask)
+ {
+- if (!pol)
++ if (!pol || pol->mode == MPOL_LOCAL)
+ return;
+ if (!mpol_store_user_nodemask(pol) && !(pol->flags & MPOL_F_LOCAL) &&
+ nodes_equal(pol->w.cpuset_mems_allowed, *newmask))
+diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
+index b98225d65e87a..e4eaf5d2acbd8 100644
+--- a/net/bluetooth/rfcomm/core.c
++++ b/net/bluetooth/rfcomm/core.c
+@@ -552,22 +552,58 @@ struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
+ return dlc;
+ }
+
++static int rfcomm_dlc_send_frag(struct rfcomm_dlc *d, struct sk_buff *frag)
++{
++ int len = frag->len;
++
++ BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
++
++ if (len > d->mtu)
++ return -EINVAL;
++
++ rfcomm_make_uih(frag, d->addr);
++ __skb_queue_tail(&d->tx_queue, frag);
++
++ return len;
++}
++
+ int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
+ {
+- int len = skb->len;
++ unsigned long flags;
++ struct sk_buff *frag, *next;
++ int len;
+
+ if (d->state != BT_CONNECTED)
+ return -ENOTCONN;
+
+- BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
++ frag = skb_shinfo(skb)->frag_list;
++ skb_shinfo(skb)->frag_list = NULL;
+
+- if (len > d->mtu)
+- return -EINVAL;
++ /* Queue all fragments atomically. */
++ spin_lock_irqsave(&d->tx_queue.lock, flags);
+
+- rfcomm_make_uih(skb, d->addr);
+- skb_queue_tail(&d->tx_queue, skb);
++ len = rfcomm_dlc_send_frag(d, skb);
++ if (len < 0 || !frag)
++ goto unlock;
++
++ for (; frag; frag = next) {
++ int ret;
++
++ next = frag->next;
++
++ ret = rfcomm_dlc_send_frag(d, frag);
++ if (ret < 0) {
++ kfree_skb(frag);
++ goto unlock;
++ }
++
++ len += ret;
++ }
++
++unlock:
++ spin_unlock_irqrestore(&d->tx_queue.lock, flags);
+
+- if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
++ if (len > 0 && !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
+ rfcomm_schedule();
+ return len;
+ }
+diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
+index c044ff2f73e6c..78830efe89d73 100644
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -578,46 +578,20 @@ static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg,
+ lock_sock(sk);
+
+ sent = bt_sock_wait_ready(sk, msg->msg_flags);
+- if (sent)
+- goto done;
+-
+- while (len) {
+- size_t size = min_t(size_t, len, d->mtu);
+- int err;
+-
+- skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
+- msg->msg_flags & MSG_DONTWAIT, &err);
+- if (!skb) {
+- if (sent == 0)
+- sent = err;
+- break;
+- }
+- skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
+-
+- err = memcpy_from_msg(skb_put(skb, size), msg, size);
+- if (err) {
+- kfree_skb(skb);
+- if (sent == 0)
+- sent = err;
+- break;
+- }
+
+- skb->priority = sk->sk_priority;
++ release_sock(sk);
+
+- err = rfcomm_dlc_send(d, skb);
+- if (err < 0) {
+- kfree_skb(skb);
+- if (sent == 0)
+- sent = err;
+- break;
+- }
++ if (sent)
++ return sent;
+
+- sent += size;
+- len -= size;
+- }
++ skb = bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE,
++ RFCOMM_SKB_TAIL_RESERVE);
++ if (IS_ERR(skb))
++ return PTR_ERR(skb);
+
+-done:
+- release_sock(sk);
++ sent = rfcomm_dlc_send(d, skb);
++ if (sent < 0)
++ kfree_skb(skb);
+
+ return sent;
+ }
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 14b5288d1432b..ee321d62b7d6e 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -279,12 +279,10 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk)
+ return err;
+ }
+
+-static int sco_send_frame(struct sock *sk, void *buf, int len,
+- unsigned int msg_flags)
++static int sco_send_frame(struct sock *sk, struct sk_buff *skb)
+ {
+ struct sco_conn *conn = sco_pi(sk)->conn;
+- struct sk_buff *skb;
+- int err;
++ int len = skb->len;
+
+ /* Check outgoing MTU */
+ if (len > conn->mtu)
+@@ -292,11 +290,6 @@ static int sco_send_frame(struct sock *sk, void *buf, int len,
+
+ BT_DBG("sk %p len %d", sk, len);
+
+- skb = bt_skb_send_alloc(sk, len, msg_flags & MSG_DONTWAIT, &err);
+- if (!skb)
+- return err;
+-
+- memcpy(skb_put(skb, len), buf, len);
+ hci_send_sco(conn->hcon, skb);
+
+ return len;
+@@ -715,7 +708,7 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
+ size_t len)
+ {
+ struct sock *sk = sock->sk;
+- void *buf;
++ struct sk_buff *skb;
+ int err;
+
+ BT_DBG("sock %p, sk %p", sock, sk);
+@@ -727,24 +720,21 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
+ if (msg->msg_flags & MSG_OOB)
+ return -EOPNOTSUPP;
+
+- buf = kmalloc(len, GFP_KERNEL);
+- if (!buf)
+- return -ENOMEM;
+-
+- if (memcpy_from_msg(buf, msg, len)) {
+- kfree(buf);
+- return -EFAULT;
+- }
++ skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0);
++ if (IS_ERR(skb))
++ return PTR_ERR(skb);
+
+ lock_sock(sk);
+
+ if (sk->sk_state == BT_CONNECTED)
+- err = sco_send_frame(sk, buf, len, msg->msg_flags);
++ err = sco_send_frame(sk, skb);
+ else
+ err = -ENOTCONN;
+
+ release_sock(sk);
+- kfree(buf);
++
++ if (err < 0)
++ kfree_skb(skb);
+ return err;
+ }
+
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index dadd42a07c071..229519001cc31 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -218,7 +218,7 @@ int inet_listen(struct socket *sock, int backlog)
+ * because the socket was in TCP_LISTEN state previously but
+ * was shutdown() rather than close().
+ */
+- tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen;
++ tcp_fastopen = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen);
+ if ((tcp_fastopen & TFO_SERVER_WO_SOCKOPT1) &&
+ (tcp_fastopen & TFO_SERVER_ENABLE) &&
+ !inet_csk(sk)->icsk_accept_queue.fastopenq.max_qlen) {
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index ee179e08dd20c..b831825f234f6 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -471,7 +471,8 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
+
+ if (pmc->multiaddr == IGMP_ALL_HOSTS)
+ return skb;
+- if (ipv4_is_local_multicast(pmc->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports)
++ if (ipv4_is_local_multicast(pmc->multiaddr) &&
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
+ return skb;
+
+ mtu = READ_ONCE(dev->mtu);
+@@ -597,7 +598,7 @@ static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
+ if (pmc->multiaddr == IGMP_ALL_HOSTS)
+ continue;
+ if (ipv4_is_local_multicast(pmc->multiaddr) &&
+- !net->ipv4.sysctl_igmp_llm_reports)
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
+ continue;
+ spin_lock_bh(&pmc->lock);
+ if (pmc->sfcount[MCAST_EXCLUDE])
+@@ -740,7 +741,8 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
+ if (type == IGMPV3_HOST_MEMBERSHIP_REPORT)
+ return igmpv3_send_report(in_dev, pmc);
+
+- if (ipv4_is_local_multicast(group) && !net->ipv4.sysctl_igmp_llm_reports)
++ if (ipv4_is_local_multicast(group) &&
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
+ return 0;
+
+ if (type == IGMP_HOST_LEAVE_MESSAGE)
+@@ -924,7 +926,8 @@ static bool igmp_heard_report(struct in_device *in_dev, __be32 group)
+
+ if (group == IGMP_ALL_HOSTS)
+ return false;
+- if (ipv4_is_local_multicast(group) && !net->ipv4.sysctl_igmp_llm_reports)
++ if (ipv4_is_local_multicast(group) &&
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
+ return false;
+
+ rcu_read_lock();
+@@ -1049,7 +1052,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ if (im->multiaddr == IGMP_ALL_HOSTS)
+ continue;
+ if (ipv4_is_local_multicast(im->multiaddr) &&
+- !net->ipv4.sysctl_igmp_llm_reports)
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
+ continue;
+ spin_lock_bh(&im->lock);
+ if (im->tm_running)
+@@ -1299,7 +1302,8 @@ static void igmp_group_dropped(struct ip_mc_list *im)
+ #ifdef CONFIG_IP_MULTICAST
+ if (im->multiaddr == IGMP_ALL_HOSTS)
+ return;
+- if (ipv4_is_local_multicast(im->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports)
++ if (ipv4_is_local_multicast(im->multiaddr) &&
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
+ return;
+
+ reporter = im->reporter;
+@@ -1336,7 +1340,8 @@ static void igmp_group_added(struct ip_mc_list *im)
+ #ifdef CONFIG_IP_MULTICAST
+ if (im->multiaddr == IGMP_ALL_HOSTS)
+ return;
+- if (ipv4_is_local_multicast(im->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports)
++ if (ipv4_is_local_multicast(im->multiaddr) &&
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
+ return;
+
+ if (in_dev->dead)
+@@ -1657,7 +1662,7 @@ static void ip_mc_rejoin_groups(struct in_device *in_dev)
+ if (im->multiaddr == IGMP_ALL_HOSTS)
+ continue;
+ if (ipv4_is_local_multicast(im->multiaddr) &&
+- !net->ipv4.sysctl_igmp_llm_reports)
++ !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
+ continue;
+
+ /* a failover is happening and switches
+@@ -2207,7 +2212,7 @@ static int __ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr,
+ count++;
+ }
+ err = -ENOBUFS;
+- if (count >= net->ipv4.sysctl_igmp_max_memberships)
++ if (count >= READ_ONCE(net->ipv4.sysctl_igmp_max_memberships))
+ goto done;
+ iml = sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL);
+ if (!iml)
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index d7f17581df7da..57e2316529d00 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1419,7 +1419,7 @@ u32 ip_mtu_from_fib_result(struct fib_result *res, __be32 daddr)
+ struct net_device *dev = nh->nh_dev;
+ u32 mtu = 0;
+
+- if (dev_net(dev)->ipv4.sysctl_ip_fwd_use_pmtu ||
++ if (READ_ONCE(dev_net(dev)->ipv4.sysctl_ip_fwd_use_pmtu) ||
+ fi->fib_metrics->metrics[RTAX_LOCK - 1] & (1 << RTAX_MTU))
+ mtu = fi->fib_mtu;
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index f7795488b0adf..7acc0d07f1486 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -436,7 +436,7 @@ void tcp_init_sock(struct sock *sk)
+ tp->snd_cwnd_clamp = ~0;
+ tp->mss_cache = TCP_MSS_DEFAULT;
+
+- tp->reordering = sock_net(sk)->ipv4.sysctl_tcp_reordering;
++ tp->reordering = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reordering);
+ tcp_assign_congestion_control(sk);
+
+ tp->tsoffset = 0;
+@@ -1160,7 +1160,8 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
+ struct sockaddr *uaddr = msg->msg_name;
+ int err, flags;
+
+- if (!(sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) ||
++ if (!(READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen) &
++ TFO_CLIENT_ENABLE) ||
+ (uaddr && msg->msg_namelen >= sizeof(uaddr->sa_family) &&
+ uaddr->sa_family == AF_UNSPEC))
+ return -EOPNOTSUPP;
+@@ -3056,7 +3057,8 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ case TCP_FASTOPEN_CONNECT:
+ if (val > 1 || val < 0) {
+ err = -EINVAL;
+- } else if (net->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) {
++ } else if (READ_ONCE(net->ipv4.sysctl_tcp_fastopen) &
++ TFO_CLIENT_ENABLE) {
+ if (sk->sk_state == TCP_CLOSE)
+ tp->fastopen_connect = val;
+ else
+@@ -3386,7 +3388,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
+ case TCP_LINGER2:
+ val = tp->linger2;
+ if (val >= 0)
+- val = (val ? : net->ipv4.sysctl_tcp_fin_timeout) / HZ;
++ val = (val ? : READ_ONCE(net->ipv4.sysctl_tcp_fin_timeout)) / HZ;
+ break;
+ case TCP_DEFER_ACCEPT:
+ val = retrans_to_secs(icsk->icsk_accept_queue.rskq_defer_accept,
+diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
+index 119d2c2f3b047..f726591de7c7a 100644
+--- a/net/ipv4/tcp_fastopen.c
++++ b/net/ipv4/tcp_fastopen.c
+@@ -313,7 +313,7 @@ static bool tcp_fastopen_no_cookie(const struct sock *sk,
+ const struct dst_entry *dst,
+ int flag)
+ {
+- return (sock_net(sk)->ipv4.sysctl_tcp_fastopen & flag) ||
++ return (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen) & flag) ||
+ tcp_sk(sk)->fastopen_no_cookie ||
+ (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE));
+ }
+@@ -328,7 +328,7 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
+ const struct dst_entry *dst)
+ {
+ bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1;
+- int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen;
++ int tcp_fastopen = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen);
+ struct tcp_fastopen_cookie valid_foc = { .len = -1 };
+ struct sock *child;
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 92f5068c76807..26f0994da31bf 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -893,7 +893,7 @@ static void tcp_check_sack_reordering(struct sock *sk, const u32 low_seq,
+ tp->undo_marker ? tp->undo_retrans : 0);
+ #endif
+ tp->reordering = min_t(u32, (metric + mss - 1) / mss,
+- sock_net(sk)->ipv4.sysctl_tcp_max_reordering);
++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_max_reordering));
+ }
+
+ /* This exciting event is worth to be remembered. 8) */
+@@ -1878,7 +1878,7 @@ static void tcp_check_reno_reordering(struct sock *sk, const int addend)
+ return;
+
+ tp->reordering = min_t(u32, tp->packets_out + addend,
+- sock_net(sk)->ipv4.sysctl_tcp_max_reordering);
++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_max_reordering));
+ tp->reord_seen++;
+ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRENOREORDER);
+ }
+@@ -1938,7 +1938,8 @@ static inline void tcp_init_undo(struct tcp_sock *tp)
+
+ static bool tcp_is_rack(const struct sock *sk)
+ {
+- return sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_LOSS_DETECTION;
++ return READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_recovery) &
++ TCP_RACK_LOSS_DETECTION;
+ }
+
+ /* If we detect SACK reneging, forget all SACK information
+@@ -1982,6 +1983,7 @@ void tcp_enter_loss(struct sock *sk)
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct net *net = sock_net(sk);
+ bool new_recovery = icsk->icsk_ca_state < TCP_CA_Recovery;
++ u8 reordering;
+
+ tcp_timeout_mark_lost(sk);
+
+@@ -2002,10 +2004,12 @@ void tcp_enter_loss(struct sock *sk)
+ /* Timeout in disordered state after receiving substantial DUPACKs
+ * suggests that the degree of reordering is over-estimated.
+ */
++ reordering = READ_ONCE(net->ipv4.sysctl_tcp_reordering);
+ if (icsk->icsk_ca_state <= TCP_CA_Disorder &&
+- tp->sacked_out >= net->ipv4.sysctl_tcp_reordering)
++ tp->sacked_out >= reordering)
+ tp->reordering = min_t(unsigned int, tp->reordering,
+- net->ipv4.sysctl_tcp_reordering);
++ reordering);
++
+ tcp_set_ca_state(sk, TCP_CA_Loss);
+ tp->high_seq = tp->snd_nxt;
+ tcp_ecn_queue_cwr(tp);
+@@ -3303,7 +3307,8 @@ static inline bool tcp_may_raise_cwnd(const struct sock *sk, const int flag)
+ * new SACK or ECE mark may first advance cwnd here and later reduce
+ * cwnd in tcp_fastretrans_alert() based on more states.
+ */
+- if (tcp_sk(sk)->reordering > sock_net(sk)->ipv4.sysctl_tcp_reordering)
++ if (tcp_sk(sk)->reordering >
++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reordering))
+ return flag & FLAG_FORWARD_PROGRESS;
+
+ return flag & FLAG_DATA_ACKED;
+@@ -5287,7 +5292,7 @@ static void tcp_check_urg(struct sock *sk, const struct tcphdr *th)
+ struct tcp_sock *tp = tcp_sk(sk);
+ u32 ptr = ntohs(th->urg_ptr);
+
+- if (ptr && !sock_net(sk)->ipv4.sysctl_tcp_stdurg)
++ if (ptr && !READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_stdurg))
+ ptr--;
+ ptr += ntohl(th->seq);
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 2719c60f285b0..ddc1af8731e39 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -110,10 +110,10 @@ static u32 tcp_v4_init_ts_off(const struct net *net, const struct sk_buff *skb)
+
+ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
+ {
++ int reuse = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_tw_reuse);
+ const struct inet_timewait_sock *tw = inet_twsk(sktw);
+ const struct tcp_timewait_sock *tcptw = tcp_twsk(sktw);
+ struct tcp_sock *tp = tcp_sk(sk);
+- int reuse = sock_net(sk)->ipv4.sysctl_tcp_tw_reuse;
+
+ if (reuse == 2) {
+ /* Still does not detect *everything* that goes through
+diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
+index 03b51cdcc731f..61843c6d7a476 100644
+--- a/net/ipv4/tcp_metrics.c
++++ b/net/ipv4/tcp_metrics.c
+@@ -425,7 +425,8 @@ void tcp_update_metrics(struct sock *sk)
+ if (!tcp_metric_locked(tm, TCP_METRIC_REORDERING)) {
+ val = tcp_metric_get(tm, TCP_METRIC_REORDERING);
+ if (val < tp->reordering &&
+- tp->reordering != net->ipv4.sysctl_tcp_reordering)
++ tp->reordering !=
++ READ_ONCE(net->ipv4.sysctl_tcp_reordering))
+ tcp_metric_set(tm, TCP_METRIC_REORDERING,
+ tp->reordering);
+ }
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index c79cb949da66b..0fc238d79b03a 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -179,7 +179,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
+ * Oh well... nobody has a sufficient solution to this
+ * protocol bug yet.
+ */
+- if (twsk_net(tw)->ipv4.sysctl_tcp_rfc1337 == 0) {
++ if (!READ_ONCE(twsk_net(tw)->ipv4.sysctl_tcp_rfc1337)) {
+ kill:
+ inet_twsk_deschedule_put(tw);
+ return TCP_TW_SUCCESS;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 25dbdb27a571d..13d9e8570ce57 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1523,7 +1523,7 @@ void tcp_mtup_init(struct sock *sk)
+ struct inet_connection_sock *icsk = inet_csk(sk);
+ struct net *net = sock_net(sk);
+
+- icsk->icsk_mtup.enabled = net->ipv4.sysctl_tcp_mtu_probing > 1;
++ icsk->icsk_mtup.enabled = READ_ONCE(net->ipv4.sysctl_tcp_mtu_probing) > 1;
+ icsk->icsk_mtup.search_high = tp->rx_opt.mss_clamp + sizeof(struct tcphdr) +
+ icsk->icsk_af_ops->net_header_len;
+ icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, net->ipv4.sysctl_tcp_base_mss);
+@@ -1658,7 +1658,7 @@ static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited)
+ if (tp->packets_out > tp->snd_cwnd_used)
+ tp->snd_cwnd_used = tp->packets_out;
+
+- if (sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle &&
++ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle) &&
+ (s32)(tcp_jiffies32 - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto &&
+ !ca_ops->cong_control)
+ tcp_cwnd_application_limited(sk);
+@@ -2030,7 +2030,7 @@ static inline void tcp_mtu_check_reprobe(struct sock *sk)
+ u32 interval;
+ s32 delta;
+
+- interval = net->ipv4.sysctl_tcp_probe_interval;
++ interval = READ_ONCE(net->ipv4.sysctl_tcp_probe_interval);
+ delta = tcp_jiffies32 - icsk->icsk_mtup.probe_timestamp;
+ if (unlikely(delta >= interval * HZ)) {
+ int mss = tcp_current_mss(sk);
+@@ -2112,7 +2112,7 @@ static int tcp_mtu_probe(struct sock *sk)
+ * probing process by not resetting search range to its orignal.
+ */
+ if (probe_size > tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_high) ||
+- interval < net->ipv4.sysctl_tcp_probe_threshold) {
++ interval < READ_ONCE(net->ipv4.sysctl_tcp_probe_threshold)) {
+ /* Check whether enough time has elaplased for
+ * another round of probing.
+ */
+@@ -2454,7 +2454,7 @@ bool tcp_schedule_loss_probe(struct sock *sk, bool advancing_rto)
+ if (tp->fastopen_rsk)
+ return false;
+
+- early_retrans = sock_net(sk)->ipv4.sysctl_tcp_early_retrans;
++ early_retrans = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_early_retrans);
+ /* Schedule a loss probe in 2*RTT for SACK capable connections
+ * not in loss recovery, that are either limited by cwnd or application.
+ */
+@@ -2816,7 +2816,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
+ struct sk_buff *skb = to, *tmp;
+ bool first = true;
+
+- if (!sock_net(sk)->ipv4.sysctl_tcp_retrans_collapse)
++ if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_retrans_collapse))
+ return;
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
+ return;
+@@ -3776,7 +3776,7 @@ void tcp_send_probe0(struct sock *sk)
+ }
+
+ if (err <= 0) {
+- if (icsk->icsk_backoff < net->ipv4.sysctl_tcp_retries2)
++ if (icsk->icsk_backoff < READ_ONCE(net->ipv4.sysctl_tcp_retries2))
+ icsk->icsk_backoff++;
+ icsk->icsk_probes_out++;
+ probe_max = TCP_RTO_MAX;
+diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c
+index 0d96decba13df..61969bb9395c7 100644
+--- a/net/ipv4/tcp_recovery.c
++++ b/net/ipv4/tcp_recovery.c
+@@ -33,7 +33,8 @@ static u32 tcp_rack_reo_wnd(const struct sock *sk)
+ return 0;
+
+ if (tp->sacked_out >= tp->reordering &&
+- !(sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_NO_DUPTHRESH))
++ !(READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_recovery) &
++ TCP_RACK_NO_DUPTHRESH))
+ return 0;
+ }
+
+@@ -203,7 +204,8 @@ void tcp_rack_update_reo_wnd(struct sock *sk, struct rate_sample *rs)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+
+- if (sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_STATIC_REO_WND ||
++ if ((READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_recovery) &
++ TCP_RACK_STATIC_REO_WND) ||
+ !rs->prior_delivered)
+ return;
+
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index d071ed6b8b9a0..84069db0423a2 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -124,7 +124,7 @@ static int tcp_out_of_resources(struct sock *sk, bool do_reset)
+ */
+ static int tcp_orphan_retries(struct sock *sk, bool alive)
+ {
+- int retries = sock_net(sk)->ipv4.sysctl_tcp_orphan_retries; /* May be zero. */
++ int retries = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_orphan_retries); /* May be zero. */
+
+ /* We know from an ICMP that something is wrong. */
+ if (sk->sk_err_soft && !alive)
+@@ -144,7 +144,7 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
+ int mss;
+
+ /* Black hole detection */
+- if (!net->ipv4.sysctl_tcp_mtu_probing)
++ if (!READ_ONCE(net->ipv4.sysctl_tcp_mtu_probing))
+ return;
+
+ if (!icsk->icsk_mtup.enabled) {
+@@ -226,7 +226,7 @@ static int tcp_write_timeout(struct sock *sk)
+ retry_until = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_syn_retries;
+ expired = icsk->icsk_retransmits >= retry_until;
+ } else {
+- if (retransmits_timed_out(sk, net->ipv4.sysctl_tcp_retries1, 0)) {
++ if (retransmits_timed_out(sk, READ_ONCE(net->ipv4.sysctl_tcp_retries1), 0)) {
+ /* Black hole detection */
+ tcp_mtu_probing(icsk, sk);
+
+@@ -235,7 +235,7 @@ static int tcp_write_timeout(struct sock *sk)
+ sk_rethink_txhash(sk);
+ }
+
+- retry_until = net->ipv4.sysctl_tcp_retries2;
++ retry_until = READ_ONCE(net->ipv4.sysctl_tcp_retries2);
+ if (sock_flag(sk, SOCK_DEAD)) {
+ const bool alive = icsk->icsk_rto < TCP_RTO_MAX;
+
+@@ -362,7 +362,7 @@ static void tcp_probe_timer(struct sock *sk)
+ (s32)(tcp_time_stamp(tp) - start_ts) > icsk->icsk_user_timeout)
+ goto abort;
+
+- max_probes = sock_net(sk)->ipv4.sysctl_tcp_retries2;
++ max_probes = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_retries2);
+ if (sock_flag(sk, SOCK_DEAD)) {
+ const bool alive = inet_csk_rto_backoff(icsk, TCP_RTO_MAX) < TCP_RTO_MAX;
+
+@@ -545,7 +545,7 @@ out_reset_timer:
+ * linear-timeout retransmissions into a black hole
+ */
+ if (sk->sk_state == TCP_ESTABLISHED &&
+- (tp->thin_lto || net->ipv4.sysctl_tcp_thin_linear_timeouts) &&
++ (tp->thin_lto || READ_ONCE(net->ipv4.sysctl_tcp_thin_linear_timeouts)) &&
+ tcp_stream_is_thin(tp) &&
+ icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) {
+ icsk->icsk_backoff = 0;
+@@ -556,7 +556,7 @@ out_reset_timer:
+ }
+ inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+ tcp_clamp_rto_to_user_timeout(sk), TCP_RTO_MAX);
+- if (retransmits_timed_out(sk, net->ipv4.sysctl_tcp_retries1 + 1, 0))
++ if (retransmits_timed_out(sk, READ_ONCE(net->ipv4.sysctl_tcp_retries1) + 1, 0))
+ __sk_dst_reset(sk);
+
+ out:;
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index 7207a9769f1a9..8db8209c5b617 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -373,7 +373,7 @@ static int sctp_v4_available(union sctp_addr *addr, struct sctp_sock *sp)
+ if (addr->v4.sin_addr.s_addr != htonl(INADDR_ANY) &&
+ ret != RTN_LOCAL &&
+ !sp->inet.freebind &&
+- !net->ipv4.sysctl_ip_nonlocal_bind)
++ !READ_ONCE(net->ipv4.sysctl_ip_nonlocal_bind))
+ return 0;
+
+ if (ipv6_only_sock(sctp_opt2sk(sp)))
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index 228e3ce48d437..b290eb3ae155a 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -110,13 +110,16 @@ static void tls_device_queue_ctx_destruction(struct tls_context *ctx)
+ unsigned long flags;
+
+ spin_lock_irqsave(&tls_device_lock, flags);
++ if (unlikely(!refcount_dec_and_test(&ctx->refcount)))
++ goto unlock;
++
+ list_move_tail(&ctx->list, &tls_device_gc_list);
+
+ /* schedule_work inside the spinlock
+ * to make sure tls_device_down waits for that work.
+ */
+ schedule_work(&tls_device_gc_work);
+-
++unlock:
+ spin_unlock_irqrestore(&tls_device_lock, flags);
+ }
+
+@@ -214,8 +217,7 @@ void tls_device_sk_destruct(struct sock *sk)
+ clean_acked_data_disable(inet_csk(sk));
+ }
+
+- if (refcount_dec_and_test(&tls_ctx->refcount))
+- tls_device_queue_ctx_destruction(tls_ctx);
++ tls_device_queue_ctx_destruction(tls_ctx);
+ }
+ EXPORT_SYMBOL(tls_device_sk_destruct);
+
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index bb1c94e20e820..3582f77bab6a8 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1697,8 +1697,10 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family,
+ *num_xfrms = 0;
+ return 0;
+ }
+- if (IS_ERR(pols[0]))
++ if (IS_ERR(pols[0])) {
++ *num_pols = 0;
+ return PTR_ERR(pols[0]);
++ }
+
+ *num_xfrms = pols[0]->xfrm_nr;
+
+@@ -1713,6 +1715,7 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family,
+ if (pols[1]) {
+ if (IS_ERR(pols[1])) {
+ xfrm_pols_put(pols, *num_pols);
++ *num_pols = 0;
+ return PTR_ERR(pols[1]);
+ }
+ (*num_pols)++;
+diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
+index 5095b2e8fceeb..3ec45028a8c54 100644
+--- a/security/integrity/ima/Kconfig
++++ b/security/integrity/ima/Kconfig
+@@ -68,10 +68,9 @@ choice
+ hash, defined as 20 bytes, and a null terminated pathname,
+ limited to 255 characters. The 'ima-ng' measurement list
+ template permits both larger hash digests and longer
+- pathnames.
++ pathnames. The configured default template can be replaced
++ by specifying "ima_template=" on the boot command line.
+
+- config IMA_TEMPLATE
+- bool "ima"
+ config IMA_NG_TEMPLATE
+ bool "ima-ng (default)"
+ config IMA_SIG_TEMPLATE
+@@ -81,7 +80,6 @@ endchoice
+ config IMA_DEFAULT_TEMPLATE
+ string
+ depends on IMA
+- default "ima" if IMA_TEMPLATE
+ default "ima-ng" if IMA_NG_TEMPLATE
+ default "ima-sig" if IMA_SIG_TEMPLATE
+
+@@ -101,15 +99,15 @@ choice
+
+ config IMA_DEFAULT_HASH_SHA256
+ bool "SHA256"
+- depends on CRYPTO_SHA256=y && !IMA_TEMPLATE
++ depends on CRYPTO_SHA256=y
+
+ config IMA_DEFAULT_HASH_SHA512
+ bool "SHA512"
+- depends on CRYPTO_SHA512=y && !IMA_TEMPLATE
++ depends on CRYPTO_SHA512=y
+
+ config IMA_DEFAULT_HASH_WP512
+ bool "WP512"
+- depends on CRYPTO_WP512=y && !IMA_TEMPLATE
++ depends on CRYPTO_WP512=y
+ endchoice
+
+ config IMA_DEFAULT_HASH
+diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c
+index 753d5fc4b284f..81a171668f420 100644
+--- a/sound/core/memalloc.c
++++ b/sound/core/memalloc.c
+@@ -179,6 +179,7 @@ int snd_dma_alloc_pages(int type, struct device *device, size_t size,
+ if (WARN_ON(!dmab))
+ return -ENXIO;
+
++ size = PAGE_ALIGN(size);
+ dmab->dev.type = type;
+ dmab->dev.dev = device;
+ dmab->bytes = 0;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-08-11 12:36 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-08-11 12:36 UTC (permalink / raw
To: gentoo-commits
commit: 86bffc58f593d12516739efd5224b1064c00263b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 11 12:35:53 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Aug 11 12:35:53 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=86bffc58
Linux patch 4.19.255
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1254_linux-4.19.255.patch | 1159 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1163 insertions(+)
diff --git a/0000_README b/0000_README
index 373ac001..3ed2554f 100644
--- a/0000_README
+++ b/0000_README
@@ -1059,6 +1059,10 @@ Patch: 1253_linux-4.19.254.patch
From: https://www.kernel.org
Desc: Linux 4.19.254
+Patch: 1254_linux-4.19.255.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.255
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1254_linux-4.19.255.patch b/1254_linux-4.19.255.patch
new file mode 100644
index 00000000..3c932735
--- /dev/null
+++ b/1254_linux-4.19.255.patch
@@ -0,0 +1,1159 @@
+diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
+index 6bd97cd50d625..7e061ed449aaa 100644
+--- a/Documentation/admin-guide/hw-vuln/spectre.rst
++++ b/Documentation/admin-guide/hw-vuln/spectre.rst
+@@ -422,6 +422,14 @@ The possible values in this file are:
+ 'RSB filling' Protection of RSB on context switch enabled
+ ============= ===========================================
+
++ - EIBRS Post-barrier Return Stack Buffer (PBRSB) protection status:
++
++ =========================== =======================================================
++ 'PBRSB-eIBRS: SW sequence' CPU is affected and protection of RSB on VMEXIT enabled
++ 'PBRSB-eIBRS: Vulnerable' CPU is vulnerable
++ 'PBRSB-eIBRS: Not affected' CPU is not affected by PBRSB
++ =========================== =======================================================
++
+ Full mitigation might require a microcode update from the CPU
+ vendor. When the necessary microcode is not available, the kernel will
+ report vulnerability.
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index e315e6052b9fb..eb24b81372269 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -2170,7 +2170,14 @@ sctp_rmem - vector of 3 INTEGERs: min, default, max
+ Default: 4K
+
+ sctp_wmem - vector of 3 INTEGERs: min, default, max
+- Currently this tunable has no effect.
++ Only the first value ("min") is used, "default" and "max" are
++ ignored.
++
++ min: Minimum size of send buffer that can be used by SCTP sockets.
++ It is guaranteed to each SCTP socket (but not association) even
++ under moderate memory pressure.
++
++ Default: 4K
+
+ addr_scope_policy - INTEGER
+ Control IPv4 address scoping - draft-stewart-tsvwg-sctp-ipv4-00
+diff --git a/Makefile b/Makefile
+index c7a0dc943e74c..b8e5b38e5352d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 254
++SUBLEVEL = 255
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/lib/xor-neon.c b/arch/arm/lib/xor-neon.c
+index c691b901092f5..b4feebc385bca 100644
+--- a/arch/arm/lib/xor-neon.c
++++ b/arch/arm/lib/xor-neon.c
+@@ -29,8 +29,9 @@ MODULE_LICENSE("GPL");
+ * While older versions of GCC do not generate incorrect code, they fail to
+ * recognize the parallel nature of these functions, and emit plain ARM code,
+ * which is known to be slower than the optimized ARM code in asm-arm/xor.h.
++ *
++ * #warning This code requires at least version 4.6 of GCC
+ */
+-#warning This code requires at least version 4.6 of GCC
+ #endif
+
+ #pragma GCC diagnostic ignored "-Wunused-variable"
+diff --git a/arch/s390/include/asm/archrandom.h b/arch/s390/include/asm/archrandom.h
+index 2c6e1c6ecbe78..4120c428dc378 100644
+--- a/arch/s390/include/asm/archrandom.h
++++ b/arch/s390/include/asm/archrandom.h
+@@ -2,7 +2,7 @@
+ /*
+ * Kernel interface for the s390 arch_random_* functions
+ *
+- * Copyright IBM Corp. 2017, 2020
++ * Copyright IBM Corp. 2017, 2022
+ *
+ * Author: Harald Freudenberger <freude@de.ibm.com>
+ *
+@@ -14,6 +14,7 @@
+ #ifdef CONFIG_ARCH_RANDOM
+
+ #include <linux/static_key.h>
++#include <linux/preempt.h>
+ #include <linux/atomic.h>
+ #include <asm/cpacf.h>
+
+@@ -32,7 +33,8 @@ static inline bool __must_check arch_get_random_int(unsigned int *v)
+
+ static inline bool __must_check arch_get_random_seed_long(unsigned long *v)
+ {
+- if (static_branch_likely(&s390_arch_random_available)) {
++ if (static_branch_likely(&s390_arch_random_available) &&
++ in_task()) {
+ cpacf_trng(NULL, 0, (u8 *)v, sizeof(*v));
+ atomic64_add(sizeof(*v), &s390_arch_random_counter);
+ return true;
+@@ -42,7 +44,8 @@ static inline bool __must_check arch_get_random_seed_long(unsigned long *v)
+
+ static inline bool __must_check arch_get_random_seed_int(unsigned int *v)
+ {
+- if (static_branch_likely(&s390_arch_random_available)) {
++ if (static_branch_likely(&s390_arch_random_available) &&
++ in_task()) {
+ cpacf_trng(NULL, 0, (u8 *)v, sizeof(*v));
+ atomic64_add(sizeof(*v), &s390_arch_random_counter);
+ return true;
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 8025b7da04951..89145ea183d6d 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -283,6 +283,7 @@
+ #define X86_FEATURE_CQM_MBM_LOCAL (11*32+ 3) /* LLC Local MBM monitoring */
+ #define X86_FEATURE_FENCE_SWAPGS_USER (11*32+ 4) /* "" LFENCE in user entry SWAPGS path */
+ #define X86_FEATURE_FENCE_SWAPGS_KERNEL (11*32+ 5) /* "" LFENCE in kernel entry SWAPGS path */
++#define X86_FEATURE_RSB_VMEXIT_LITE (11*32+ 6) /* "" Fill RSB on VM exit when EIBRS is enabled */
+
+ /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */
+ #define X86_FEATURE_CLZERO (13*32+ 0) /* CLZERO instruction */
+@@ -395,5 +396,6 @@
+ #define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
+ #define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */
+ #define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */
++#define X86_BUG_EIBRS_PBRSB X86_BUG(26) /* EIBRS is vulnerable to Post Barrier RSB Predictions */
+
+ #endif /* _ASM_X86_CPUFEATURES_H */
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 586be095ed081..7a73799537bf3 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -120,6 +120,10 @@
+ * bit available to control VERW
+ * behavior.
+ */
++#define ARCH_CAP_PBRSB_NO BIT(24) /*
++ * Not susceptible to Post-Barrier
++ * Return Stack Buffer Predictions.
++ */
+
+ #define MSR_IA32_FLUSH_CMD 0x0000010b
+ #define L1D_FLUSH BIT(0) /*
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index d3d68b6763d4e..747549934fe32 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -52,7 +52,17 @@
+ 774: \
+ dec reg; \
+ jnz 771b; \
+- add $(BITS_PER_LONG/8) * nr, sp;
++ add $(BITS_PER_LONG/8) * nr, sp; \
++ /* barrier for jnz misprediction */ \
++ lfence;
++
++/* Sequence to mitigate PBRSB on eIBRS CPUs */
++#define __ISSUE_UNBALANCED_RET_GUARD(sp) \
++ call 881f; \
++ int3; \
++881: \
++ add $(BITS_PER_LONG/8), sp; \
++ lfence;
+
+ #ifdef __ASSEMBLY__
+
+@@ -269,6 +279,13 @@ static inline void vmexit_fill_RSB(void)
+ : "=r" (loops), ASM_CALL_CONSTRAINT
+ : : "memory" );
+ #endif
++ asm volatile (ANNOTATE_NOSPEC_ALTERNATIVE
++ ALTERNATIVE("jmp 920f",
++ __stringify(__ISSUE_UNBALANCED_RET_GUARD(%0)),
++ X86_FEATURE_RSB_VMEXIT_LITE)
++ "920:"
++ : ASM_CALL_CONSTRAINT
++ : : "memory" );
+ }
+
+ static __always_inline
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 058e92b932623..a36be67860432 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -1043,6 +1043,49 @@ static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void)
+ return SPECTRE_V2_RETPOLINE;
+ }
+
++static void __init spectre_v2_determine_rsb_fill_type_at_vmexit(enum spectre_v2_mitigation mode)
++{
++ /*
++ * Similar to context switches, there are two types of RSB attacks
++ * after VM exit:
++ *
++ * 1) RSB underflow
++ *
++ * 2) Poisoned RSB entry
++ *
++ * When retpoline is enabled, both are mitigated by filling/clearing
++ * the RSB.
++ *
++ * When IBRS is enabled, while #1 would be mitigated by the IBRS branch
++ * prediction isolation protections, RSB still needs to be cleared
++ * because of #2. Note that SMEP provides no protection here, unlike
++ * user-space-poisoned RSB entries.
++ *
++ * eIBRS should protect against RSB poisoning, but if the EIBRS_PBRSB
++ * bug is present then a LITE version of RSB protection is required,
++ * just a single call needs to retire before a RET is executed.
++ */
++ switch (mode) {
++ case SPECTRE_V2_NONE:
++ /* These modes already fill RSB at vmexit */
++ case SPECTRE_V2_LFENCE:
++ case SPECTRE_V2_RETPOLINE:
++ case SPECTRE_V2_EIBRS_RETPOLINE:
++ return;
++
++ case SPECTRE_V2_EIBRS_LFENCE:
++ case SPECTRE_V2_EIBRS:
++ if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) {
++ setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT_LITE);
++ pr_info("Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT\n");
++ }
++ return;
++ }
++
++ pr_warn_once("Unknown Spectre v2 mode, disabling RSB mitigation at VM exit");
++ dump_stack();
++}
++
+ static void __init spectre_v2_select_mitigation(void)
+ {
+ enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
+@@ -1135,6 +1178,8 @@ static void __init spectre_v2_select_mitigation(void)
+ setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
+ pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n");
+
++ spectre_v2_determine_rsb_fill_type_at_vmexit(mode);
++
+ /*
+ * Retpoline means the kernel is safe because it has no indirect
+ * branches. Enhanced IBRS protects firmware too, so, enable restricted
+@@ -1867,6 +1912,19 @@ static char *ibpb_state(void)
+ return "";
+ }
+
++static char *pbrsb_eibrs_state(void)
++{
++ if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) {
++ if (boot_cpu_has(X86_FEATURE_RSB_VMEXIT_LITE) ||
++ boot_cpu_has(X86_FEATURE_RETPOLINE))
++ return ", PBRSB-eIBRS: SW sequence";
++ else
++ return ", PBRSB-eIBRS: Vulnerable";
++ } else {
++ return ", PBRSB-eIBRS: Not affected";
++ }
++}
++
+ static ssize_t spectre_v2_show_state(char *buf)
+ {
+ if (spectre_v2_enabled == SPECTRE_V2_LFENCE)
+@@ -1879,12 +1937,13 @@ static ssize_t spectre_v2_show_state(char *buf)
+ spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)
+ return sprintf(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n");
+
+- return sprintf(buf, "%s%s%s%s%s%s\n",
++ return sprintf(buf, "%s%s%s%s%s%s%s\n",
+ spectre_v2_strings[spectre_v2_enabled],
+ ibpb_state(),
+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
+ stibp_state(),
+ boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
++ pbrsb_eibrs_state(),
+ spectre_v2_module_string());
+ }
+
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 389d11b2c70e2..3ab35d5426b76 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -954,6 +954,7 @@ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
+ #define MSBDS_ONLY BIT(5)
+ #define NO_SWAPGS BIT(6)
+ #define NO_ITLB_MULTIHIT BIT(7)
++#define NO_EIBRS_PBRSB BIT(8)
+
+ #define VULNWL(_vendor, _family, _model, _whitelist) \
+ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist }
+@@ -990,7 +991,7 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+
+ VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT),
+ VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT),
+- VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB),
+
+ /*
+ * Technically, swapgs isn't serializing on AMD (despite it previously
+@@ -1000,7 +1001,9 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+ * good enough for our purposes.
+ */
+
+- VULNWL_INTEL(ATOM_TREMONT_X, NO_ITLB_MULTIHIT),
++ VULNWL_INTEL(ATOM_TREMONT, NO_EIBRS_PBRSB),
++ VULNWL_INTEL(ATOM_TREMONT_L, NO_EIBRS_PBRSB),
++ VULNWL_INTEL(ATOM_TREMONT_X, NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB),
+
+ /* AMD Family 0xf - 0x12 */
+ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
+@@ -1154,6 +1157,11 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ !arch_cap_mmio_immune(ia32_cap))
+ setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);
+
++ if (cpu_has(c, X86_FEATURE_IBRS_ENHANCED) &&
++ !cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) &&
++ !(ia32_cap & ARCH_CAP_PBRSB_NO))
++ setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB);
++
+ if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
+ return;
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 44cce3e8eb18b..20ce794584a32 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10988,6 +10988,9 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ #endif
+ );
+
++ /* Eliminate branch target predictions from guest mode */
++ vmexit_fill_RSB();
++
+ vmx_enable_fb_clear(vmx);
+
+ /*
+@@ -11010,9 +11013,6 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+
+ x86_spec_ctrl_restore_host(vmx->spec_ctrl, 0);
+
+- /* Eliminate branch target predictions from guest mode */
+- vmexit_fill_RSB();
+-
+ /* All fields are clean at this point */
+ if (static_branch_unlikely(&enable_evmcs))
+ current_evmcs->hv_clean_fields |=
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 298d9c65e0848..490ae990bd3c2 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -371,7 +371,6 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ .callback = video_detect_force_native,
+ .ident = "Clevo NL5xRU",
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
+ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"),
+ },
+ },
+@@ -379,59 +378,75 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ .callback = video_detect_force_native,
+ .ident = "Clevo NL5xRU",
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"),
+- DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"),
++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "AURA1501"),
+ },
+ },
+ {
+ .callback = video_detect_force_native,
+ .ident = "Clevo NL5xRU",
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
+- DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"),
++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"),
+ },
+ },
+ {
+ .callback = video_detect_force_native,
+- .ident = "Clevo NL5xRU",
++ .ident = "Clevo NL5xNU",
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
+- DMI_MATCH(DMI_BOARD_NAME, "AURA1501"),
++ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"),
+ },
+ },
++ /*
++ * The TongFang PF5PU1G, PF4NU1F, PF5NU1G, and PF5LUXG/TUXEDO BA15 Gen10,
++ * Pulse 14/15 Gen1, and Pulse 15 Gen2 have the same problem as the Clevo
++ * NL5xRU and NL5xNU/TUXEDO Aura 15 Gen1 and Gen2. See the description
++ * above.
++ */
+ {
+ .callback = video_detect_force_native,
+- .ident = "Clevo NL5xRU",
++ .ident = "TongFang PF5PU1G",
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
+- DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"),
++ DMI_MATCH(DMI_BOARD_NAME, "PF5PU1G"),
+ },
+ },
+ {
+ .callback = video_detect_force_native,
+- .ident = "Clevo NL5xNU",
++ .ident = "TongFang PF4NU1F",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "PF4NU1F"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "TongFang PF4NU1F",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
+- DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"),
++ DMI_MATCH(DMI_BOARD_NAME, "PULSE1401"),
+ },
+ },
+ {
+ .callback = video_detect_force_native,
+- .ident = "Clevo NL5xNU",
++ .ident = "TongFang PF5NU1G",
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"),
+- DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"),
++ DMI_MATCH(DMI_BOARD_NAME, "PF5NU1G"),
+ },
+ },
+ {
+ .callback = video_detect_force_native,
+- .ident = "Clevo NL5xNU",
++ .ident = "TongFang PF5NU1G",
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
+- DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"),
++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "PULSE1501"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "TongFang PF5LUXG",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "PF5LUXG"),
+ },
+ },
+-
+ /*
+ * Desktops which falsely report a backlight and which our heuristics
+ * for this do not catch.
+diff --git a/drivers/macintosh/adb.c b/drivers/macintosh/adb.c
+index 76e98f0f7a3e5..2f1952fd3a457 100644
+--- a/drivers/macintosh/adb.c
++++ b/drivers/macintosh/adb.c
+@@ -645,7 +645,7 @@ do_adb_query(struct adb_request *req)
+
+ switch(req->data[1]) {
+ case ADB_QUERY_GETDEVINFO:
+- if (req->nbytes < 3)
++ if (req->nbytes < 3 || req->data[2] >= 16)
+ break;
+ mutex_lock(&adb_handler_mutex);
+ req->reply[0] = adb_handler[req->data[2]].original_address;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 3615c6533cf4f..2f3b393e55068 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -1808,11 +1808,15 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi,
+ * non-zero req_queue_pairs says that user requested a new
+ * queue count via ethtool's set_channels, so use this
+ * value for queues distribution across traffic classes
++ * We need at least one queue pair for the interface
++ * to be usable as we see in else statement.
+ */
+ if (vsi->req_queue_pairs > 0)
+ vsi->num_queue_pairs = vsi->req_queue_pairs;
+ else if (pf->flags & I40E_FLAG_MSIX_ENABLED)
+ vsi->num_queue_pairs = pf->num_lan_msix;
++ else
++ vsi->num_queue_pairs = 1;
+ }
+
+ /* Number of queues per enabled TC */
+diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c
+index 63a8ff816e591..e556b00dfed23 100644
+--- a/drivers/net/sungem_phy.c
++++ b/drivers/net/sungem_phy.c
+@@ -453,6 +453,7 @@ static int bcm5421_init(struct mii_phy* phy)
+ int can_low_power = 1;
+ if (np == NULL || of_get_property(np, "no-autolowpower", NULL))
+ can_low_power = 0;
++ of_node_put(np);
+ if (can_low_power) {
+ /* Enable automatic low-power */
+ sungem_phy_write(phy, 0x1c, 0x9002);
+diff --git a/drivers/net/wireless/mediatek/mt7601u/usb.c b/drivers/net/wireless/mediatek/mt7601u/usb.c
+index d8b7863f79261..11fef99093a7e 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/usb.c
++++ b/drivers/net/wireless/mediatek/mt7601u/usb.c
+@@ -34,6 +34,7 @@ static const struct usb_device_id mt7601u_device_table[] = {
+ { USB_DEVICE(0x2717, 0x4106) },
+ { USB_DEVICE(0x2955, 0x0001) },
+ { USB_DEVICE(0x2955, 0x1001) },
++ { USB_DEVICE(0x2955, 0x1003) },
+ { USB_DEVICE(0x2a5f, 0x1000) },
+ { USB_DEVICE(0x7392, 0x7710) },
+ { 0, }
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 0191708c9dd4e..ace4a7230bcf2 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -2157,8 +2157,7 @@ out_put_budget:
+ case BLK_STS_OK:
+ break;
+ case BLK_STS_RESOURCE:
+- if (atomic_read(&sdev->device_busy) ||
+- scsi_device_blocked(sdev))
++ if (scsi_device_blocked(sdev))
+ ret = BLK_STS_DEV_RESOURCE;
+ break;
+ default:
+diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
+index 57985841a879e..eca6d6db628a4 100644
+--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
++++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
+@@ -124,9 +124,20 @@ out:
+ return ret;
+ }
+
++static bool phandle_exists(const struct device_node *np,
++ const char *phandle_name, int index)
++{
++ struct device_node *parse_np = of_parse_phandle(np, phandle_name, index);
++
++ if (parse_np)
++ of_node_put(parse_np);
++
++ return parse_np != NULL;
++}
++
+ #define MAX_PROP_SIZE 32
+ static int ufshcd_populate_vreg(struct device *dev, const char *name,
+- struct ufs_vreg **out_vreg)
++ struct ufs_vreg **out_vreg)
+ {
+ int ret = 0;
+ char prop_name[MAX_PROP_SIZE];
+@@ -139,7 +150,7 @@ static int ufshcd_populate_vreg(struct device *dev, const char *name,
+ }
+
+ snprintf(prop_name, MAX_PROP_SIZE, "%s-supply", name);
+- if (!of_parse_phandle(np, prop_name, 0)) {
++ if (!phandle_exists(np, prop_name, 0)) {
+ dev_info(dev, "%s: Unable to find %s regulator, assuming enabled\n",
+ __func__, prop_name);
+ goto out;
+diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
+index 44a39a099b54e..62b49197e5f67 100644
+--- a/fs/ntfs/attrib.c
++++ b/fs/ntfs/attrib.c
+@@ -606,8 +606,12 @@ static int ntfs_attr_find(const ATTR_TYPE type, const ntfschar *name,
+ a = (ATTR_RECORD*)((u8*)ctx->attr +
+ le32_to_cpu(ctx->attr->length));
+ for (;; a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))) {
+- if ((u8*)a < (u8*)ctx->mrec || (u8*)a > (u8*)ctx->mrec +
+- le32_to_cpu(ctx->mrec->bytes_allocated))
++ u8 *mrec_end = (u8 *)ctx->mrec +
++ le32_to_cpu(ctx->mrec->bytes_allocated);
++ u8 *name_end = (u8 *)a + le16_to_cpu(a->name_offset) +
++ a->name_length * sizeof(ntfschar);
++ if ((u8*)a < (u8*)ctx->mrec || (u8*)a > mrec_end ||
++ name_end > mrec_end)
+ break;
+ ctx->attr = a;
+ if (unlikely(le32_to_cpu(a->type) > le32_to_cpu(type) ||
+diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
+index 21dbd38f724d4..da0ef935c5a97 100644
+--- a/include/net/bluetooth/l2cap.h
++++ b/include/net/bluetooth/l2cap.h
+@@ -798,6 +798,7 @@ enum {
+ };
+
+ void l2cap_chan_hold(struct l2cap_chan *c);
++struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c);
+ void l2cap_chan_put(struct l2cap_chan *c);
+
+ static inline void l2cap_chan_lock(struct l2cap_chan *chan)
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index d28fa78dedb54..436ad4bc9d4c4 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1355,7 +1355,7 @@ void tcp_select_initial_window(const struct sock *sk, int __space,
+
+ static inline int tcp_win_from_space(const struct sock *sk, int space)
+ {
+- int tcp_adv_win_scale = sock_net(sk)->ipv4.sysctl_tcp_adv_win_scale;
++ int tcp_adv_win_scale = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_adv_win_scale);
+
+ return tcp_adv_win_scale <= 0 ?
+ (space>>(-tcp_adv_win_scale)) :
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index c0d64b4144d4a..709cceef67288 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -113,7 +113,8 @@ static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
+ }
+
+ /* Find channel with given SCID.
+- * Returns locked channel. */
++ * Returns a reference locked channel.
++ */
+ static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
+ u16 cid)
+ {
+@@ -121,15 +122,19 @@ static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
+
+ mutex_lock(&conn->chan_lock);
+ c = __l2cap_get_chan_by_scid(conn, cid);
+- if (c)
+- l2cap_chan_lock(c);
++ if (c) {
++ /* Only lock if chan reference is not 0 */
++ c = l2cap_chan_hold_unless_zero(c);
++ if (c)
++ l2cap_chan_lock(c);
++ }
+ mutex_unlock(&conn->chan_lock);
+
+ return c;
+ }
+
+ /* Find channel with given DCID.
+- * Returns locked channel.
++ * Returns a reference locked channel.
+ */
+ static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
+ u16 cid)
+@@ -138,8 +143,12 @@ static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
+
+ mutex_lock(&conn->chan_lock);
+ c = __l2cap_get_chan_by_dcid(conn, cid);
+- if (c)
+- l2cap_chan_lock(c);
++ if (c) {
++ /* Only lock if chan reference is not 0 */
++ c = l2cap_chan_hold_unless_zero(c);
++ if (c)
++ l2cap_chan_lock(c);
++ }
+ mutex_unlock(&conn->chan_lock);
+
+ return c;
+@@ -164,8 +173,12 @@ static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
+
+ mutex_lock(&conn->chan_lock);
+ c = __l2cap_get_chan_by_ident(conn, ident);
+- if (c)
+- l2cap_chan_lock(c);
++ if (c) {
++ /* Only lock if chan reference is not 0 */
++ c = l2cap_chan_hold_unless_zero(c);
++ if (c)
++ l2cap_chan_lock(c);
++ }
+ mutex_unlock(&conn->chan_lock);
+
+ return c;
+@@ -491,6 +504,16 @@ void l2cap_chan_hold(struct l2cap_chan *c)
+ kref_get(&c->kref);
+ }
+
++struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c)
++{
++ BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
++
++ if (!kref_get_unless_zero(&c->kref))
++ return NULL;
++
++ return c;
++}
++
+ void l2cap_chan_put(struct l2cap_chan *c)
+ {
+ BT_DBG("chan %p orig refcnt %d", c, kref_read(&c->kref));
+@@ -1803,7 +1826,10 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
+ src_match = !bacmp(&c->src, src);
+ dst_match = !bacmp(&c->dst, dst);
+ if (src_match && dst_match) {
+- l2cap_chan_hold(c);
++ c = l2cap_chan_hold_unless_zero(c);
++ if (!c)
++ continue;
++
+ read_unlock(&chan_list_lock);
+ return c;
+ }
+@@ -1818,7 +1844,7 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
+ }
+
+ if (c1)
+- l2cap_chan_hold(c1);
++ c1 = l2cap_chan_hold_unless_zero(c1);
+
+ read_unlock(&chan_list_lock);
+
+@@ -4204,6 +4230,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
+
+ unlock:
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+ return err;
+ }
+
+@@ -4316,6 +4343,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
+
+ done:
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+ return err;
+ }
+
+@@ -5044,6 +5072,7 @@ send_move_response:
+ l2cap_send_move_chan_rsp(chan, result);
+
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+
+ return 0;
+ }
+@@ -5136,6 +5165,7 @@ static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
+ }
+
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+ }
+
+ static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
+@@ -5165,6 +5195,7 @@ static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
+ l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
+
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+ }
+
+ static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
+@@ -5228,6 +5259,7 @@ static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
+ l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
+
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+
+ return 0;
+ }
+@@ -5263,6 +5295,7 @@ static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
+ }
+
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+
+ return 0;
+ }
+@@ -5635,12 +5668,11 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
+ if (credits > max_credits) {
+ BT_ERR("LE credits overflow");
+ l2cap_send_disconn_req(chan, ECONNRESET);
+- l2cap_chan_unlock(chan);
+
+ /* Return 0 so that we don't trigger an unnecessary
+ * command reject packet.
+ */
+- return 0;
++ goto unlock;
+ }
+
+ chan->tx_credits += credits;
+@@ -5651,7 +5683,9 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn,
+ if (chan->tx_credits)
+ chan->ops->resume(chan);
+
++unlock:
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+
+ return 0;
+ }
+@@ -6949,6 +6983,7 @@ drop:
+
+ done:
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+ }
+
+ static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
+@@ -7353,7 +7388,7 @@ static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
+ if (src_type != c->src_type)
+ continue;
+
+- l2cap_chan_hold(c);
++ c = l2cap_chan_hold_unless_zero(c);
+ read_unlock(&chan_list_lock);
+ return c;
+ }
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index b831825f234f6..a08acb54b6b00 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -831,7 +831,7 @@ static void igmp_ifc_event(struct in_device *in_dev)
+ struct net *net = dev_net(in_dev->dev);
+ if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
+ return;
+- WRITE_ONCE(in_dev->mr_ifc_count, in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv);
++ WRITE_ONCE(in_dev->mr_ifc_count, in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv));
+ igmp_ifc_start_timer(in_dev, 1);
+ }
+
+@@ -1013,7 +1013,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ * received value was zero, use the default or statically
+ * configured value.
+ */
+- in_dev->mr_qrv = ih3->qrv ?: net->ipv4.sysctl_igmp_qrv;
++ in_dev->mr_qrv = ih3->qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
+ in_dev->mr_qi = IGMPV3_QQIC(ih3->qqic)*HZ ?: IGMP_QUERY_INTERVAL;
+
+ /* RFC3376, 8.3. Query Response Interval:
+@@ -1192,7 +1192,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
+ pmc->interface = im->interface;
+ in_dev_hold(in_dev);
+ pmc->multiaddr = im->multiaddr;
+- pmc->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
++ pmc->crcount = in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
+ pmc->sfmode = im->sfmode;
+ if (pmc->sfmode == MCAST_INCLUDE) {
+ struct ip_sf_list *psf;
+@@ -1243,9 +1243,11 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
+ swap(im->tomb, pmc->tomb);
+ swap(im->sources, pmc->sources);
+ for (psf = im->sources; psf; psf = psf->sf_next)
+- psf->sf_crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
++ psf->sf_crcount = in_dev->mr_qrv ?:
++ READ_ONCE(net->ipv4.sysctl_igmp_qrv);
+ } else {
+- im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
++ im->crcount = in_dev->mr_qrv ?:
++ READ_ONCE(net->ipv4.sysctl_igmp_qrv);
+ }
+ in_dev_put(pmc->interface);
+ kfree_pmc(pmc);
+@@ -1347,7 +1349,7 @@ static void igmp_group_added(struct ip_mc_list *im)
+ if (in_dev->dead)
+ return;
+
+- im->unsolicit_count = net->ipv4.sysctl_igmp_qrv;
++ im->unsolicit_count = READ_ONCE(net->ipv4.sysctl_igmp_qrv);
+ if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev)) {
+ spin_lock_bh(&im->lock);
+ igmp_start_timer(im, IGMP_INITIAL_REPORT_DELAY);
+@@ -1361,7 +1363,7 @@ static void igmp_group_added(struct ip_mc_list *im)
+ * IN() to IN(A).
+ */
+ if (im->sfmode == MCAST_EXCLUDE)
+- im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
++ im->crcount = in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
+
+ igmp_ifc_event(in_dev);
+ #endif
+@@ -1769,7 +1771,7 @@ static void ip_mc_reset(struct in_device *in_dev)
+
+ in_dev->mr_qi = IGMP_QUERY_INTERVAL;
+ in_dev->mr_qri = IGMP_QUERY_RESPONSE_INTERVAL;
+- in_dev->mr_qrv = net->ipv4.sysctl_igmp_qrv;
++ in_dev->mr_qrv = READ_ONCE(net->ipv4.sysctl_igmp_qrv);
+ }
+ #else
+ static void ip_mc_reset(struct in_device *in_dev)
+@@ -1903,7 +1905,7 @@ static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
+ #ifdef CONFIG_IP_MULTICAST
+ if (psf->sf_oldin &&
+ !IGMP_V1_SEEN(in_dev) && !IGMP_V2_SEEN(in_dev)) {
+- psf->sf_crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
++ psf->sf_crcount = in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
+ psf->sf_next = pmc->tomb;
+ pmc->tomb = psf;
+ rv = 1;
+@@ -1967,7 +1969,7 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
+ /* filter mode change */
+ pmc->sfmode = MCAST_INCLUDE;
+ #ifdef CONFIG_IP_MULTICAST
+- pmc->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
++ pmc->crcount = in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
+ WRITE_ONCE(in_dev->mr_ifc_count, pmc->crcount);
+ for (psf = pmc->sources; psf; psf = psf->sf_next)
+ psf->sf_crcount = 0;
+@@ -2146,7 +2148,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
+ #ifdef CONFIG_IP_MULTICAST
+ /* else no filters; keep old mode for reports */
+
+- pmc->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
++ pmc->crcount = in_dev->mr_qrv ?: READ_ONCE(net->ipv4.sysctl_igmp_qrv);
+ WRITE_ONCE(in_dev->mr_ifc_count, pmc->crcount);
+ for (psf = pmc->sources; psf; psf = psf->sf_next)
+ psf->sf_crcount = 0;
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 7acc0d07f1486..768a7daab5596 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -706,7 +706,7 @@ static bool tcp_should_autocork(struct sock *sk, struct sk_buff *skb,
+ int size_goal)
+ {
+ return skb->len < size_goal &&
+- sock_net(sk)->ipv4.sysctl_tcp_autocorking &&
++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_autocorking) &&
+ !tcp_rtx_queue_empty(sk) &&
+ refcount_read(&sk->sk_wmem_alloc) > skb->truesize;
+ }
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 26f0994da31bf..e1d065ea5a158 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -432,7 +432,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
+ */
+ void tcp_init_buffer_space(struct sock *sk)
+ {
+- int tcp_app_win = sock_net(sk)->ipv4.sysctl_tcp_app_win;
++ int tcp_app_win = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_app_win);
+ struct tcp_sock *tp = tcp_sk(sk);
+ int maxwin;
+
+@@ -2018,7 +2018,7 @@ void tcp_enter_loss(struct sock *sk)
+ * loss recovery is underway except recurring timeout(s) on
+ * the same SND.UNA (sec 3.2). Disable F-RTO on path MTU probing
+ */
+- tp->frto = net->ipv4.sysctl_tcp_frto &&
++ tp->frto = READ_ONCE(net->ipv4.sysctl_tcp_frto) &&
+ (new_recovery || icsk->icsk_retransmits) &&
+ !inet_csk(sk)->icsk_mtup.probe_size;
+ }
+@@ -2903,7 +2903,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,
+
+ static void tcp_update_rtt_min(struct sock *sk, u32 rtt_us, const int flag)
+ {
+- u32 wlen = sock_net(sk)->ipv4.sysctl_tcp_min_rtt_wlen * HZ;
++ u32 wlen = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_rtt_wlen) * HZ;
+ struct tcp_sock *tp = tcp_sk(sk);
+
+ if ((flag & FLAG_ACK_MAYBE_DELAYED) && rtt_us > tcp_min_rtt(tp)) {
+@@ -3420,7 +3420,8 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
+ if (*last_oow_ack_time) {
+ s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time);
+
+- if (0 <= elapsed && elapsed < net->ipv4.sysctl_tcp_invalid_ratelimit) {
++ if (0 <= elapsed &&
++ elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) {
+ NET_INC_STATS(net, mib_idx);
+ return true; /* rate-limited: don't send yet! */
+ }
+@@ -3468,7 +3469,7 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
+ /* Then check host-wide RFC 5961 rate limit. */
+ now = jiffies / HZ;
+ if (now != challenge_timestamp) {
+- u32 ack_limit = net->ipv4.sysctl_tcp_challenge_ack_limit;
++ u32 ack_limit = READ_ONCE(net->ipv4.sysctl_tcp_challenge_ack_limit);
+ u32 half = (ack_limit + 1) >> 1;
+
+ challenge_timestamp = now;
+@@ -4197,7 +4198,7 @@ static void tcp_dsack_set(struct sock *sk, u32 seq, u32 end_seq)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+
+- if (tcp_is_sack(tp) && sock_net(sk)->ipv4.sysctl_tcp_dsack) {
++ if (tcp_is_sack(tp) && READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_dsack)) {
+ int mib_idx;
+
+ if (before(seq, tp->rcv_nxt))
+@@ -4232,7 +4233,7 @@ static void tcp_send_dupack(struct sock *sk, const struct sk_buff *skb)
+ NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKLOST);
+ tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS);
+
+- if (tcp_is_sack(tp) && sock_net(sk)->ipv4.sysctl_tcp_dsack) {
++ if (tcp_is_sack(tp) && READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_dsack)) {
+ u32 end_seq = TCP_SKB_CB(skb)->end_seq;
+
+ if (after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))
+@@ -5238,7 +5239,7 @@ send_now:
+ }
+
+ if (!tcp_is_sack(tp) ||
+- tp->compressed_ack >= sock_net(sk)->ipv4.sysctl_tcp_comp_sack_nr)
++ tp->compressed_ack >= READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_comp_sack_nr))
+ goto send_now;
+
+ if (tp->compressed_ack_rcv_nxt != tp->rcv_nxt) {
+@@ -5261,7 +5262,8 @@ send_now:
+ if (tp->srtt_us && tp->srtt_us < rtt)
+ rtt = tp->srtt_us;
+
+- delay = min_t(unsigned long, sock_net(sk)->ipv4.sysctl_tcp_comp_sack_delay_ns,
++ delay = min_t(unsigned long,
++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_comp_sack_delay_ns),
+ rtt * (NSEC_PER_USEC >> 3)/20);
+ sock_hold(sk);
+ hrtimer_start(&tp->compressed_ack_timer, ns_to_ktime(delay),
+diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
+index 61843c6d7a476..4960e2b6bd7f7 100644
+--- a/net/ipv4/tcp_metrics.c
++++ b/net/ipv4/tcp_metrics.c
+@@ -329,7 +329,7 @@ void tcp_update_metrics(struct sock *sk)
+ int m;
+
+ sk_dst_confirm(sk);
+- if (net->ipv4.sysctl_tcp_nometrics_save || !dst)
++ if (READ_ONCE(net->ipv4.sysctl_tcp_nometrics_save) || !dst)
+ return;
+
+ rcu_read_lock();
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 13d9e8570ce57..3090b61e4edd1 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1745,7 +1745,7 @@ static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now)
+
+ min_tso = ca_ops->min_tso_segs ?
+ ca_ops->min_tso_segs(sk) :
+- sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs;
++ READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
+
+ tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
+ return min_t(u32, tso_segs, sk->sk_gso_max_segs);
+diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
+index 5c9be8594483f..23ae01715e7b1 100644
+--- a/net/ipv6/ping.c
++++ b/net/ipv6/ping.c
+@@ -27,6 +27,11 @@
+ #include <linux/proc_fs.h>
+ #include <net/ping.h>
+
++static void ping_v6_destroy(struct sock *sk)
++{
++ inet6_destroy_sock(sk);
++}
++
+ /* Compatibility glue so we can support IPv6 when it's compiled as a module */
+ static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
+ int *addr_len)
+@@ -170,6 +175,7 @@ struct proto pingv6_prot = {
+ .owner = THIS_MODULE,
+ .init = ping_init_sock,
+ .close = ping_close,
++ .destroy = ping_v6_destroy,
+ .connect = ip6_datagram_connect_v6_only,
+ .disconnect = __udp_disconnect,
+ .setsockopt = ipv6_setsockopt,
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index a5aff2834bd6c..cd496b074a71b 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -850,11 +850,16 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
+ }
+
+ static int
+-nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e, int diff)
++nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int diff)
+ {
+ struct sk_buff *nskb;
+
+ if (diff < 0) {
++ unsigned int min_len = skb_transport_offset(e->skb);
++
++ if (data_len < min_len)
++ return -EINVAL;
++
+ if (pskb_trim(e->skb, data_len))
+ return -ENOMEM;
+ } else if (diff > 0) {
+diff --git a/net/sctp/stream_sched.c b/net/sctp/stream_sched.c
+index a6c04a94b08f2..3a5c0d00e96cd 100644
+--- a/net/sctp/stream_sched.c
++++ b/net/sctp/stream_sched.c
+@@ -178,7 +178,7 @@ int sctp_sched_set_sched(struct sctp_association *asoc,
+ if (!SCTP_SO(&asoc->stream, i)->ext)
+ continue;
+
+- ret = n->init_sid(&asoc->stream, i, GFP_KERNEL);
++ ret = n->init_sid(&asoc->stream, i, GFP_ATOMIC);
+ if (ret)
+ goto err;
+ }
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 166c621e02235..bd33d66139296 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -201,6 +201,33 @@ Elf_Scn *elf_section_by_name(Elf *elf, GElf_Ehdr *ep,
+ return NULL;
+ }
+
++static int elf_read_program_header(Elf *elf, u64 vaddr, GElf_Phdr *phdr)
++{
++ size_t i, phdrnum;
++ u64 sz;
++
++ if (elf_getphdrnum(elf, &phdrnum))
++ return -1;
++
++ for (i = 0; i < phdrnum; i++) {
++ if (gelf_getphdr(elf, i, phdr) == NULL)
++ return -1;
++
++ if (phdr->p_type != PT_LOAD)
++ continue;
++
++ sz = max(phdr->p_memsz, phdr->p_filesz);
++ if (!sz)
++ continue;
++
++ if (vaddr >= phdr->p_vaddr && (vaddr < phdr->p_vaddr + sz))
++ return 0;
++ }
++
++ /* Not found any valid program header */
++ return -1;
++}
++
+ static bool want_demangle(bool is_kernel_sym)
+ {
+ return is_kernel_sym ? symbol_conf.demangle_kernel : symbol_conf.demangle;
+@@ -1063,6 +1090,7 @@ int dso__load_sym(struct dso *dso, struct map *map, struct symsrc *syms_ss,
+ sym.st_value);
+ used_opd = true;
+ }
++
+ /*
+ * When loading symbols in a data mapping, ABS symbols (which
+ * has a value of SHN_ABS in its st_shndx) failed at
+@@ -1099,11 +1127,20 @@ int dso__load_sym(struct dso *dso, struct map *map, struct symsrc *syms_ss,
+ goto out_elf_end;
+ } else if ((used_opd && runtime_ss->adjust_symbols) ||
+ (!used_opd && syms_ss->adjust_symbols)) {
++ GElf_Phdr phdr;
++
++ if (elf_read_program_header(syms_ss->elf,
++ (u64)sym.st_value, &phdr)) {
++ pr_warning("%s: failed to find program header for "
++ "symbol: %s st_value: %#" PRIx64 "\n",
++ __func__, elf_name, (u64)sym.st_value);
++ continue;
++ }
+ pr_debug4("%s: adjusting symbol: st_value: %#" PRIx64 " "
+- "sh_addr: %#" PRIx64 " sh_offset: %#" PRIx64 "\n", __func__,
+- (u64)sym.st_value, (u64)shdr.sh_addr,
+- (u64)shdr.sh_offset);
+- sym.st_value -= shdr.sh_addr - shdr.sh_offset;
++ "p_vaddr: %#" PRIx64 " p_offset: %#" PRIx64 "\n",
++ __func__, (u64)sym.st_value, (u64)phdr.p_vaddr,
++ (u64)phdr.p_offset);
++ sym.st_value -= phdr.p_vaddr - phdr.p_offset;
+ }
+
+ demangled = demangle_sym(dso, kmodule, elf_name);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-08-25 10:35 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-08-25 10:35 UTC (permalink / raw
To: gentoo-commits
commit: dc22a2be91aae4e8b26fe9dc16b5ff11167b736b
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 25 10:35:35 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Aug 25 10:35:35 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dc22a2be
Linux patch 4.19.256
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1255_linux-4.19.256.patch | 7790 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 7794 insertions(+)
diff --git a/0000_README b/0000_README
index 3ed2554f..b20110e2 100644
--- a/0000_README
+++ b/0000_README
@@ -1063,6 +1063,10 @@ Patch: 1254_linux-4.19.255.patch
From: https://www.kernel.org
Desc: Linux 4.19.255
+Patch: 1255_linux-4.19.256.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.256
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1255_linux-4.19.256.patch b/1255_linux-4.19.256.patch
new file mode 100644
index 00000000..f0d5c314
--- /dev/null
+++ b/1255_linux-4.19.256.patch
@@ -0,0 +1,7790 @@
+diff --git a/Documentation/atomic_bitops.txt b/Documentation/atomic_bitops.txt
+index be70b32c95d91..bc3fac8e1db3a 100644
+--- a/Documentation/atomic_bitops.txt
++++ b/Documentation/atomic_bitops.txt
+@@ -59,7 +59,7 @@ Like with atomic_t, the rule of thumb is:
+ - RMW operations that have a return value are fully ordered.
+
+ - RMW operations that are conditional are unordered on FAILURE,
+- otherwise the above rules apply. In the case of test_and_{}_bit() operations,
++ otherwise the above rules apply. In the case of test_and_set_bit_lock(),
+ if the bit in memory is unchanged by the operation then it is deemed to have
+ failed.
+
+diff --git a/Makefile b/Makefile
+index b8e5b38e5352d..ac79aef4520be 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 255
++SUBLEVEL = 256
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -876,6 +876,9 @@ LDFLAGS_BUILD_ID := $(call ld-option, --build-id)
+ KBUILD_LDFLAGS_MODULE += $(LDFLAGS_BUILD_ID)
+ LDFLAGS_vmlinux += $(LDFLAGS_BUILD_ID)
+
++KBUILD_LDFLAGS += -z noexecstack
++KBUILD_LDFLAGS += $(call ld-option,--no-warn-rwx-segments)
++
+ ifeq ($(CONFIG_STRIP_ASM_SYMS),y)
+ LDFLAGS_vmlinux += $(call ld-option, -X,)
+ endif
+diff --git a/arch/arm/boot/dts/aspeed-ast2500-evb.dts b/arch/arm/boot/dts/aspeed-ast2500-evb.dts
+index 2375449c02d05..10626452878ab 100644
+--- a/arch/arm/boot/dts/aspeed-ast2500-evb.dts
++++ b/arch/arm/boot/dts/aspeed-ast2500-evb.dts
+@@ -5,7 +5,7 @@
+
+ / {
+ model = "AST2500 EVB";
+- compatible = "aspeed,ast2500";
++ compatible = "aspeed,ast2500-evb", "aspeed,ast2500";
+
+ aliases {
+ serial4 = &uart5;
+diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
+index adecd6e08468c..334638ff50750 100644
+--- a/arch/arm/boot/dts/imx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul.dtsi
+@@ -61,20 +61,18 @@
+ reg = <0>;
+ clock-latency = <61036>; /* two CLK32 periods */
+ #cooling-cells = <2>;
+- operating-points = <
++ operating-points =
+ /* kHz uV */
+- 696000 1275000
+- 528000 1175000
+- 396000 1025000
+- 198000 950000
+- >;
+- fsl,soc-operating-points = <
++ <696000 1275000>,
++ <528000 1175000>,
++ <396000 1025000>,
++ <198000 950000>;
++ fsl,soc-operating-points =
+ /* KHz uV */
+- 696000 1275000
+- 528000 1175000
+- 396000 1175000
+- 198000 1175000
+- >;
++ <696000 1275000>,
++ <528000 1175000>,
++ <396000 1175000>,
++ <198000 1175000>;
+ clocks = <&clks IMX6UL_CLK_ARM>,
+ <&clks IMX6UL_CLK_PLL2_BUS>,
+ <&clks IMX6UL_CLK_PLL2_PFD2>,
+@@ -169,6 +167,9 @@
+ ocram: sram@900000 {
+ compatible = "mmio-sram";
+ reg = <0x00900000 0x20000>;
++ ranges = <0 0x00900000 0x20000>;
++ #address-cells = <1>;
++ #size-cells = <1>;
+ };
+
+ dma_apbh: dma-apbh@1804000 {
+@@ -939,7 +940,7 @@
+ };
+
+ lcdif: lcdif@21c8000 {
+- compatible = "fsl,imx6ul-lcdif", "fsl,imx28-lcdif";
++ compatible = "fsl,imx6ul-lcdif", "fsl,imx6sx-lcdif";
+ reg = <0x021c8000 0x4000>;
+ interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX6UL_CLK_LCDIF_PIX>,
+@@ -952,7 +953,7 @@
+ qspi: qspi@21e0000 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+- compatible = "fsl,imx6ul-qspi", "fsl,imx6sx-qspi";
++ compatible = "fsl,imx6ul-qspi";
+ reg = <0x021e0000 0x4000>, <0x60000000 0x10000000>;
+ reg-names = "QuadSPI", "QuadSPI-memory";
+ interrupts = <GIC_SPI 107 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/boot/dts/qcom-pm8841.dtsi b/arch/arm/boot/dts/qcom-pm8841.dtsi
+index 2fd59c440903d..c73e5b149ac5e 100644
+--- a/arch/arm/boot/dts/qcom-pm8841.dtsi
++++ b/arch/arm/boot/dts/qcom-pm8841.dtsi
+@@ -25,6 +25,7 @@
+ compatible = "qcom,spmi-temp-alarm";
+ reg = <0x2400>;
+ interrupts = <4 0x24 0 IRQ_TYPE_EDGE_RISING>;
++ #thermal-sensor-cells = <0>;
+ };
+ };
+
+diff --git a/arch/arm/lib/findbit.S b/arch/arm/lib/findbit.S
+index 7848780e88347..20fef6c41f6f7 100644
+--- a/arch/arm/lib/findbit.S
++++ b/arch/arm/lib/findbit.S
+@@ -43,8 +43,8 @@ ENDPROC(_find_first_zero_bit_le)
+ * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset)
+ */
+ ENTRY(_find_next_zero_bit_le)
+- teq r1, #0
+- beq 3b
++ cmp r2, r1
++ bhs 3b
+ ands ip, r2, #7
+ beq 1b @ If new byte, goto old routine
+ ARM( ldrb r3, [r0, r2, lsr #3] )
+@@ -84,8 +84,8 @@ ENDPROC(_find_first_bit_le)
+ * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset)
+ */
+ ENTRY(_find_next_bit_le)
+- teq r1, #0
+- beq 3b
++ cmp r2, r1
++ bhs 3b
+ ands ip, r2, #7
+ beq 1b @ If new byte, goto old routine
+ ARM( ldrb r3, [r0, r2, lsr #3] )
+@@ -118,8 +118,8 @@ ENTRY(_find_first_zero_bit_be)
+ ENDPROC(_find_first_zero_bit_be)
+
+ ENTRY(_find_next_zero_bit_be)
+- teq r1, #0
+- beq 3b
++ cmp r2, r1
++ bhs 3b
+ ands ip, r2, #7
+ beq 1b @ If new byte, goto old routine
+ eor r3, r2, #0x18 @ big endian byte ordering
+@@ -152,8 +152,8 @@ ENTRY(_find_first_bit_be)
+ ENDPROC(_find_first_bit_be)
+
+ ENTRY(_find_next_bit_be)
+- teq r1, #0
+- beq 3b
++ cmp r2, r1
++ bhs 3b
+ ands ip, r2, #7
+ beq 1b @ If new byte, goto old routine
+ eor r3, r2, #0x18 @ big endian byte ordering
+diff --git a/arch/arm/mach-bcm/bcm_kona_smc.c b/arch/arm/mach-bcm/bcm_kona_smc.c
+index a55a7ecf146a2..dd0b4195e629c 100644
+--- a/arch/arm/mach-bcm/bcm_kona_smc.c
++++ b/arch/arm/mach-bcm/bcm_kona_smc.c
+@@ -54,6 +54,7 @@ int __init bcm_kona_smc_init(void)
+ return -ENODEV;
+
+ prop_val = of_get_address(node, 0, &prop_size, NULL);
++ of_node_put(node);
+ if (!prop_val)
+ return -EINVAL;
+
+diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
+index 5d73f2c0b117e..dd2ff10790ab5 100644
+--- a/arch/arm/mach-omap2/display.c
++++ b/arch/arm/mach-omap2/display.c
+@@ -211,6 +211,7 @@ static int __init omapdss_init_fbdev(void)
+ node = of_find_node_by_name(NULL, "omap4_padconf_global");
+ if (node)
+ omap4_dsi_mux_syscon = syscon_node_to_regmap(node);
++ of_node_put(node);
+
+ return 0;
+ }
+diff --git a/arch/arm/mach-omap2/prm3xxx.c b/arch/arm/mach-omap2/prm3xxx.c
+index dfa65fc2c82bc..30445849b5e38 100644
+--- a/arch/arm/mach-omap2/prm3xxx.c
++++ b/arch/arm/mach-omap2/prm3xxx.c
+@@ -711,6 +711,7 @@ static int omap3xxx_prm_late_init(void)
+ }
+
+ irq_num = of_irq_get(np, 0);
++ of_node_put(np);
+ if (irq_num == -EPROBE_DEFER)
+ return irq_num;
+
+diff --git a/arch/arm/mach-zynq/common.c b/arch/arm/mach-zynq/common.c
+index 6aba9ebf80411..a8b1b9c6626ee 100644
+--- a/arch/arm/mach-zynq/common.c
++++ b/arch/arm/mach-zynq/common.c
+@@ -84,6 +84,7 @@ static int __init zynq_get_revision(void)
+ }
+
+ zynq_devcfg_base = of_iomap(np, 0);
++ of_node_put(np);
+ if (!zynq_devcfg_base) {
+ pr_err("%s: Unable to map I/O memory\n", __func__);
+ return -1;
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index f48d14cd10a3f..bdee07305ce54 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -261,7 +261,7 @@
+ status = "disabled";
+ };
+
+- qpic_nand: nand@79b0000 {
++ qpic_nand: nand-controller@79b0000 {
+ compatible = "qcom,ipq8074-nand";
+ reg = <0x79b0000 0x10000>;
+ #address-cells = <1>;
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 078ae020a77b8..1832687f7ba82 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -1039,8 +1039,8 @@
+ vddmx-supply = <&pm8916_l3>;
+ vddpx-supply = <&pm8916_l7>;
+
+- qcom,state = <&wcnss_smp2p_out 0>;
+- qcom,state-names = "stop";
++ qcom,smem-states = <&wcnss_smp2p_out 0>;
++ qcom,smem-state-names = "stop";
+
+ pinctrl-names = "default";
+ pinctrl-0 = <&wcnss_pin_a>;
+diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
+index 773ea8e0e4421..f81074c68ff30 100644
+--- a/arch/arm64/include/asm/processor.h
++++ b/arch/arm64/include/asm/processor.h
+@@ -172,8 +172,9 @@ void tls_preserve_current_state(void);
+
+ static inline void start_thread_common(struct pt_regs *regs, unsigned long pc)
+ {
++ s32 previous_syscall = regs->syscallno;
+ memset(regs, 0, sizeof(*regs));
+- forget_syscall(regs);
++ regs->syscallno = previous_syscall;
+ regs->pc = pc;
+ }
+
+diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
+index 181c29af56179..7c69a203cdf8e 100644
+--- a/arch/arm64/kernel/armv8_deprecated.c
++++ b/arch/arm64/kernel/armv8_deprecated.c
+@@ -62,6 +62,7 @@ struct insn_emulation {
+ static LIST_HEAD(insn_emulation);
+ static int nr_insn_emulated __initdata;
+ static DEFINE_RAW_SPINLOCK(insn_emulation_lock);
++static DEFINE_MUTEX(insn_emulation_mutex);
+
+ static void register_emulation_hooks(struct insn_emulation_ops *ops)
+ {
+@@ -210,10 +211,10 @@ static int emulation_proc_handler(struct ctl_table *table, int write,
+ loff_t *ppos)
+ {
+ int ret = 0;
+- struct insn_emulation *insn = (struct insn_emulation *) table->data;
++ struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode);
+ enum insn_emulation_mode prev_mode = insn->current_mode;
+
+- table->data = &insn->current_mode;
++ mutex_lock(&insn_emulation_mutex);
+ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+
+ if (ret || !write || prev_mode == insn->current_mode)
+@@ -226,7 +227,7 @@ static int emulation_proc_handler(struct ctl_table *table, int write,
+ update_insn_emulation_mode(insn, INSN_UNDEF);
+ }
+ ret:
+- table->data = insn;
++ mutex_unlock(&insn_emulation_mutex);
+ return ret;
+ }
+
+@@ -250,7 +251,7 @@ static void __init register_insn_emulation_sysctl(void)
+ sysctl->maxlen = sizeof(int);
+
+ sysctl->procname = insn->ops->name;
+- sysctl->data = insn;
++ sysctl->data = &insn->current_mode;
+ sysctl->extra1 = &insn->min;
+ sysctl->extra2 = &insn->max;
+ sysctl->proc_handler = emulation_proc_handler;
+diff --git a/arch/ia64/include/asm/processor.h b/arch/ia64/include/asm/processor.h
+index 10061ccf0440d..bbbdeeed702c8 100644
+--- a/arch/ia64/include/asm/processor.h
++++ b/arch/ia64/include/asm/processor.h
+@@ -552,7 +552,7 @@ ia64_get_irr(unsigned int vector)
+ {
+ unsigned int reg = vector / 64;
+ unsigned int bit = vector % 64;
+- u64 irr;
++ unsigned long irr;
+
+ switch (reg) {
+ case 0: irr = ia64_getreg(_IA64_REG_CR_IRR0); break;
+diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
+index 4d83f5bc7211c..54c8389decda4 100644
+--- a/arch/mips/cavium-octeon/octeon-platform.c
++++ b/arch/mips/cavium-octeon/octeon-platform.c
+@@ -86,11 +86,12 @@ static void octeon2_usb_clocks_start(struct device *dev)
+ "refclk-frequency", &clock_rate);
+ if (i) {
+ dev_err(dev, "No UCTL \"refclk-frequency\"\n");
++ of_node_put(uctl_node);
+ goto exit;
+ }
+ i = of_property_read_string(uctl_node,
+ "refclk-type", &clock_type);
+-
++ of_node_put(uctl_node);
+ if (!i && strcmp("crystal", clock_type) == 0)
+ is_crystal_clock = true;
+ }
+diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c
+index f8d36710cd581..d408b3a5bfd57 100644
+--- a/arch/mips/kernel/proc.c
++++ b/arch/mips/kernel/proc.c
+@@ -168,7 +168,7 @@ static void *c_start(struct seq_file *m, loff_t *pos)
+ {
+ unsigned long i = *pos;
+
+- return i < NR_CPUS ? (void *) (i + 1) : NULL;
++ return i < nr_cpu_ids ? (void *) (i + 1) : NULL;
+ }
+
+ static void *c_next(struct seq_file *m, void *v, loff_t *pos)
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index 620abc9686249..a97b3e5a1c00f 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -630,7 +630,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p,
+ return;
+ }
+
+- if (cpu_has_rixi && !!_PAGE_NO_EXEC) {
++ if (cpu_has_rixi && _PAGE_NO_EXEC != 0) {
+ if (fill_includes_sw_bits) {
+ UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL));
+ } else {
+@@ -2559,7 +2559,7 @@ static void check_pabits(void)
+ unsigned long entry;
+ unsigned pabits, fillbits;
+
+- if (!cpu_has_rixi || !_PAGE_NO_EXEC) {
++ if (!cpu_has_rixi || _PAGE_NO_EXEC == 0) {
+ /*
+ * We'll only be making use of the fact that we can rotate bits
+ * into the fill if the CPU supports RIXI, so don't bother
+diff --git a/arch/nios2/include/asm/entry.h b/arch/nios2/include/asm/entry.h
+index cf37f55efbc22..bafb7b2ca59fc 100644
+--- a/arch/nios2/include/asm/entry.h
++++ b/arch/nios2/include/asm/entry.h
+@@ -50,7 +50,8 @@
+ stw r13, PT_R13(sp)
+ stw r14, PT_R14(sp)
+ stw r15, PT_R15(sp)
+- stw r2, PT_ORIG_R2(sp)
++ movi r24, -1
++ stw r24, PT_ORIG_R2(sp)
+ stw r7, PT_ORIG_R7(sp)
+
+ stw ra, PT_RA(sp)
+diff --git a/arch/nios2/include/asm/ptrace.h b/arch/nios2/include/asm/ptrace.h
+index 6424621448728..9da34c3022a27 100644
+--- a/arch/nios2/include/asm/ptrace.h
++++ b/arch/nios2/include/asm/ptrace.h
+@@ -74,6 +74,8 @@ extern void show_regs(struct pt_regs *);
+ ((struct pt_regs *)((unsigned long)current_thread_info() + THREAD_SIZE)\
+ - 1)
+
++#define force_successful_syscall_return() (current_pt_regs()->orig_r2 = -1)
++
+ int do_syscall_trace_enter(void);
+ void do_syscall_trace_exit(void);
+ #endif /* __ASSEMBLY__ */
+diff --git a/arch/nios2/kernel/entry.S b/arch/nios2/kernel/entry.S
+index 1e515ccd698e3..af556588248e7 100644
+--- a/arch/nios2/kernel/entry.S
++++ b/arch/nios2/kernel/entry.S
+@@ -185,6 +185,7 @@ ENTRY(handle_system_call)
+ ldw r5, PT_R5(sp)
+
+ local_restart:
++ stw r2, PT_ORIG_R2(sp)
+ /* Check that the requested system call is within limits */
+ movui r1, __NR_syscalls
+ bgeu r2, r1, ret_invsyscall
+@@ -192,7 +193,6 @@ local_restart:
+ movhi r11, %hiadj(sys_call_table)
+ add r1, r1, r11
+ ldw r1, %lo(sys_call_table)(r1)
+- beq r1, r0, ret_invsyscall
+
+ /* Check if we are being traced */
+ GET_THREAD_INFO r11
+@@ -213,6 +213,9 @@ local_restart:
+ translate_rc_and_ret:
+ movi r1, 0
+ bge r2, zero, 3f
++ ldw r1, PT_ORIG_R2(sp)
++ addi r1, r1, 1
++ beq r1, zero, 3f
+ sub r2, zero, r2
+ movi r1, 1
+ 3:
+@@ -255,9 +258,9 @@ traced_system_call:
+ ldw r6, PT_R6(sp)
+ ldw r7, PT_R7(sp)
+
+- /* Fetch the syscall function, we don't need to check the boundaries
+- * since this is already done.
+- */
++ /* Fetch the syscall function. */
++ movui r1, __NR_syscalls
++ bgeu r2, r1, traced_invsyscall
+ slli r1, r2, 2
+ movhi r11,%hiadj(sys_call_table)
+ add r1, r1, r11
+@@ -276,6 +279,9 @@ traced_system_call:
+ translate_rc_and_ret2:
+ movi r1, 0
+ bge r2, zero, 4f
++ ldw r1, PT_ORIG_R2(sp)
++ addi r1, r1, 1
++ beq r1, zero, 4f
+ sub r2, zero, r2
+ movi r1, 1
+ 4:
+@@ -287,6 +293,11 @@ end_translate_rc_and_ret2:
+ RESTORE_SWITCH_STACK
+ br ret_from_exception
+
++ /* If the syscall number was invalid return ENOSYS */
++traced_invsyscall:
++ movi r2, -ENOSYS
++ br translate_rc_and_ret2
++
+ Luser_return:
+ GET_THREAD_INFO r11 /* get thread_info pointer */
+ ldw r10, TI_FLAGS(r11) /* get thread_info->flags */
+@@ -336,9 +347,6 @@ external_interrupt:
+ /* skip if no interrupt is pending */
+ beq r12, r0, ret_from_interrupt
+
+- movi r24, -1
+- stw r24, PT_ORIG_R2(sp)
+-
+ /*
+ * Process an external hardware interrupt.
+ */
+diff --git a/arch/nios2/kernel/signal.c b/arch/nios2/kernel/signal.c
+index 20662b0f6c9e3..c1be8e1941385 100644
+--- a/arch/nios2/kernel/signal.c
++++ b/arch/nios2/kernel/signal.c
+@@ -240,7 +240,7 @@ static int do_signal(struct pt_regs *regs)
+ /*
+ * If we were from a system call, check for system call restarting...
+ */
+- if (regs->orig_r2 >= 0) {
++ if (regs->orig_r2 >= 0 && regs->r1) {
+ continue_addr = regs->ea;
+ restart_addr = continue_addr - 4;
+ retval = regs->r2;
+@@ -261,6 +261,7 @@ static int do_signal(struct pt_regs *regs)
+ regs->ea = restart_addr;
+ break;
+ }
++ regs->orig_r2 = -1;
+ }
+
+ if (get_signal(&ksig)) {
+diff --git a/arch/nios2/kernel/syscall_table.c b/arch/nios2/kernel/syscall_table.c
+index 06e6ac1835b2e..cd10b6eed1283 100644
+--- a/arch/nios2/kernel/syscall_table.c
++++ b/arch/nios2/kernel/syscall_table.c
+@@ -25,5 +25,6 @@
+ #define __SYSCALL(nr, call) [nr] = (call),
+
+ void *sys_call_table[__NR_syscalls] = {
++ [0 ... __NR_syscalls-1] = sys_ni_syscall,
+ #include <asm/unistd.h>
+ };
+diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
+index 4d5ad9cb0f692..592e8cec16dd5 100644
+--- a/arch/parisc/kernel/drivers.c
++++ b/arch/parisc/kernel/drivers.c
+@@ -499,7 +499,6 @@ alloc_pa_dev(unsigned long hpa, struct hardware_path *mod_path)
+ dev->id.hversion_rev = iodc_data[1] & 0x0f;
+ dev->id.sversion = ((iodc_data[4] & 0x0f) << 16) |
+ (iodc_data[5] << 8) | iodc_data[6];
+- dev->hpa.name = parisc_pathname(dev);
+ dev->hpa.start = hpa;
+ /* This is awkward. The STI spec says that gfx devices may occupy
+ * 32MB or 64MB. Unfortunately, we don't know how to tell whether
+@@ -513,10 +512,10 @@ alloc_pa_dev(unsigned long hpa, struct hardware_path *mod_path)
+ dev->hpa.end = hpa + 0xfff;
+ }
+ dev->hpa.flags = IORESOURCE_MEM;
+- name = parisc_hardware_description(&dev->id);
+- if (name) {
+- strlcpy(dev->name, name, sizeof(dev->name));
+- }
++ dev->hpa.name = dev->name;
++ name = parisc_hardware_description(&dev->id) ? : "unknown";
++ snprintf(dev->name, sizeof(dev->name), "%s [%s]",
++ name, parisc_pathname(dev));
+
+ /* Silently fail things like mouse ports which are subsumed within
+ * the keyboard controller
+diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
+index 74628aca2bf12..b0f8c56ea2829 100644
+--- a/arch/powerpc/kernel/pci-common.c
++++ b/arch/powerpc/kernel/pci-common.c
+@@ -75,23 +75,35 @@ const struct dma_map_ops *get_pci_dma_ops(void)
+ }
+ EXPORT_SYMBOL(get_pci_dma_ops);
+
+-/*
+- * This function should run under locking protection, specifically
+- * hose_spinlock.
+- */
+ static int get_phb_number(struct device_node *dn)
+ {
+ int ret, phb_id = -1;
+- u32 prop_32;
+ u64 prop;
+
+ /*
+ * Try fixed PHB numbering first, by checking archs and reading
+- * the respective device-tree properties. Firstly, try powernv by
+- * reading "ibm,opal-phbid", only present in OPAL environment.
++ * the respective device-tree properties. Firstly, try reading
++ * standard "linux,pci-domain", then try reading "ibm,opal-phbid"
++ * (only present in powernv OPAL environment), then try device-tree
++ * alias and as the last try to use lower bits of "reg" property.
+ */
+- ret = of_property_read_u64(dn, "ibm,opal-phbid", &prop);
++ ret = of_get_pci_domain_nr(dn);
++ if (ret >= 0) {
++ prop = ret;
++ ret = 0;
++ }
++ if (ret)
++ ret = of_property_read_u64(dn, "ibm,opal-phbid", &prop);
++
+ if (ret) {
++ ret = of_alias_get_id(dn, "pci");
++ if (ret >= 0) {
++ prop = ret;
++ ret = 0;
++ }
++ }
++ if (ret) {
++ u32 prop_32;
+ ret = of_property_read_u32_index(dn, "reg", 1, &prop_32);
+ prop = prop_32;
+ }
+@@ -99,18 +111,20 @@ static int get_phb_number(struct device_node *dn)
+ if (!ret)
+ phb_id = (int)(prop & (MAX_PHBS - 1));
+
++ spin_lock(&hose_spinlock);
++
+ /* We need to be sure to not use the same PHB number twice. */
+ if ((phb_id >= 0) && !test_and_set_bit(phb_id, phb_bitmap))
+- return phb_id;
++ goto out_unlock;
+
+- /*
+- * If not pseries nor powernv, or if fixed PHB numbering tried to add
+- * the same PHB number twice, then fallback to dynamic PHB numbering.
+- */
++ /* If everything fails then fallback to dynamic PHB numbering. */
+ phb_id = find_first_zero_bit(phb_bitmap, MAX_PHBS);
+ BUG_ON(phb_id >= MAX_PHBS);
+ set_bit(phb_id, phb_bitmap);
+
++out_unlock:
++ spin_unlock(&hose_spinlock);
++
+ return phb_id;
+ }
+
+@@ -121,10 +135,13 @@ struct pci_controller *pcibios_alloc_controller(struct device_node *dev)
+ phb = zalloc_maybe_bootmem(sizeof(struct pci_controller), GFP_KERNEL);
+ if (phb == NULL)
+ return NULL;
+- spin_lock(&hose_spinlock);
++
+ phb->global_number = get_phb_number(dev);
++
++ spin_lock(&hose_spinlock);
+ list_add_tail(&phb->list_node, &hose_list);
+ spin_unlock(&hose_spinlock);
++
+ phb->dn = dev;
+ phb->is_dynamic = slab_is_available();
+ #ifdef CONFIG_PPC64
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index f8c49e5d4bd3b..c57aeb9f031cb 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -737,6 +737,13 @@ void __init early_init_devtree(void *params)
+ of_scan_flat_dt(early_init_dt_scan_root, NULL);
+ of_scan_flat_dt(early_init_dt_scan_memory_ppc, NULL);
+
++ /*
++ * As generic code authors expect to be able to use static keys
++ * in early_param() handlers, we initialize the static keys just
++ * before parsing early params (it's fine to call jump_label_init()
++ * more than once).
++ */
++ jump_label_init();
+ parse_early_param();
+
+ /* make sure we've parsed cmdline for mem= before this */
+diff --git a/arch/powerpc/mm/Makefile b/arch/powerpc/mm/Makefile
+index cdf6a99600465..3c844bdd16c4e 100644
+--- a/arch/powerpc/mm/Makefile
++++ b/arch/powerpc/mm/Makefile
+@@ -43,5 +43,12 @@ obj-$(CONFIG_HIGHMEM) += highmem.o
+ obj-$(CONFIG_PPC_COPRO_BASE) += copro_fault.o
+ obj-$(CONFIG_SPAPR_TCE_IOMMU) += mmu_context_iommu.o
+ obj-$(CONFIG_PPC_PTDUMP) += dump_linuxpagetables.o
++ifdef CONFIG_PPC_PTDUMP
++obj-$(CONFIG_4xx) += dump_linuxpagetables-generic.o
++obj-$(CONFIG_PPC_8xx) += dump_linuxpagetables-8xx.o
++obj-$(CONFIG_PPC_BOOK3E_MMU) += dump_linuxpagetables-generic.o
++obj-$(CONFIG_PPC_BOOK3S_32) += dump_linuxpagetables-generic.o
++obj-$(CONFIG_PPC_BOOK3S_64) += dump_linuxpagetables-book3s64.o
++endif
+ obj-$(CONFIG_PPC_HTDUMP) += dump_hashpagetable.o
+ obj-$(CONFIG_PPC_MEM_KEYS) += pkeys.o
+diff --git a/arch/powerpc/mm/dump_linuxpagetables-8xx.c b/arch/powerpc/mm/dump_linuxpagetables-8xx.c
+new file mode 100644
+index 0000000000000..33f52a97975b4
+--- /dev/null
++++ b/arch/powerpc/mm/dump_linuxpagetables-8xx.c
+@@ -0,0 +1,82 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * From split of dump_linuxpagetables.c
++ * Copyright 2016, Rashmica Gupta, IBM Corp.
++ *
++ */
++#include <linux/kernel.h>
++#include <asm/pgtable.h>
++
++#include "dump_linuxpagetables.h"
++
++static const struct flag_info flag_array[] = {
++ {
++ .mask = _PAGE_PRIVILEGED,
++ .val = 0,
++ .set = "user",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_RO | _PAGE_NA,
++ .val = 0,
++ .set = "rw",
++ }, {
++ .mask = _PAGE_RO | _PAGE_NA,
++ .val = _PAGE_RO,
++ .set = "r ",
++ }, {
++ .mask = _PAGE_RO | _PAGE_NA,
++ .val = _PAGE_NA,
++ .set = " ",
++ }, {
++ .mask = _PAGE_EXEC,
++ .val = _PAGE_EXEC,
++ .set = " X ",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_PRESENT,
++ .val = _PAGE_PRESENT,
++ .set = "present",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_GUARDED,
++ .val = _PAGE_GUARDED,
++ .set = "guarded",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_DIRTY,
++ .val = _PAGE_DIRTY,
++ .set = "dirty",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_ACCESSED,
++ .val = _PAGE_ACCESSED,
++ .set = "accessed",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_NO_CACHE,
++ .val = _PAGE_NO_CACHE,
++ .set = "no cache",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_SPECIAL,
++ .val = _PAGE_SPECIAL,
++ .set = "special",
++ }
++};
++
++struct pgtable_level pg_level[5] = {
++ {
++ }, { /* pgd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pud */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pmd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pte */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ },
++};
+diff --git a/arch/powerpc/mm/dump_linuxpagetables-book3s64.c b/arch/powerpc/mm/dump_linuxpagetables-book3s64.c
+new file mode 100644
+index 0000000000000..a637e612b2055
+--- /dev/null
++++ b/arch/powerpc/mm/dump_linuxpagetables-book3s64.c
+@@ -0,0 +1,115 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * From split of dump_linuxpagetables.c
++ * Copyright 2016, Rashmica Gupta, IBM Corp.
++ *
++ */
++#include <linux/kernel.h>
++#include <asm/pgtable.h>
++
++#include "dump_linuxpagetables.h"
++
++static const struct flag_info flag_array[] = {
++ {
++ .mask = _PAGE_PRIVILEGED,
++ .val = 0,
++ .set = "user",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_READ,
++ .val = _PAGE_READ,
++ .set = "r",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_WRITE,
++ .val = _PAGE_WRITE,
++ .set = "w",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_EXEC,
++ .val = _PAGE_EXEC,
++ .set = " X ",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_PTE,
++ .val = _PAGE_PTE,
++ .set = "pte",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_PRESENT,
++ .val = _PAGE_PRESENT,
++ .set = "present",
++ .clear = " ",
++ }, {
++ .mask = H_PAGE_HASHPTE,
++ .val = H_PAGE_HASHPTE,
++ .set = "hpte",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_DIRTY,
++ .val = _PAGE_DIRTY,
++ .set = "dirty",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_ACCESSED,
++ .val = _PAGE_ACCESSED,
++ .set = "accessed",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_NON_IDEMPOTENT,
++ .val = _PAGE_NON_IDEMPOTENT,
++ .set = "non-idempotent",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_TOLERANT,
++ .val = _PAGE_TOLERANT,
++ .set = "tolerant",
++ .clear = " ",
++ }, {
++ .mask = H_PAGE_BUSY,
++ .val = H_PAGE_BUSY,
++ .set = "busy",
++ }, {
++#ifdef CONFIG_PPC_64K_PAGES
++ .mask = H_PAGE_COMBO,
++ .val = H_PAGE_COMBO,
++ .set = "combo",
++ }, {
++ .mask = H_PAGE_4K_PFN,
++ .val = H_PAGE_4K_PFN,
++ .set = "4K_pfn",
++ }, {
++#else /* CONFIG_PPC_64K_PAGES */
++ .mask = H_PAGE_F_GIX,
++ .val = H_PAGE_F_GIX,
++ .set = "f_gix",
++ .is_val = true,
++ .shift = H_PAGE_F_GIX_SHIFT,
++ }, {
++ .mask = H_PAGE_F_SECOND,
++ .val = H_PAGE_F_SECOND,
++ .set = "f_second",
++ }, {
++#endif /* CONFIG_PPC_64K_PAGES */
++ .mask = _PAGE_SPECIAL,
++ .val = _PAGE_SPECIAL,
++ .set = "special",
++ }
++};
++
++struct pgtable_level pg_level[5] = {
++ {
++ }, { /* pgd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pud */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pmd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pte */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ },
++};
+diff --git a/arch/powerpc/mm/dump_linuxpagetables-generic.c b/arch/powerpc/mm/dump_linuxpagetables-generic.c
+new file mode 100644
+index 0000000000000..fed6923bcb46e
+--- /dev/null
++++ b/arch/powerpc/mm/dump_linuxpagetables-generic.c
+@@ -0,0 +1,82 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * From split of dump_linuxpagetables.c
++ * Copyright 2016, Rashmica Gupta, IBM Corp.
++ *
++ */
++#include <linux/kernel.h>
++#include <asm/pgtable.h>
++
++#include "dump_linuxpagetables.h"
++
++static const struct flag_info flag_array[] = {
++ {
++ .mask = _PAGE_USER,
++ .val = _PAGE_USER,
++ .set = "user",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_RW,
++ .val = 0,
++ .set = "r ",
++ .clear = "rw",
++ }, {
++#ifndef CONFIG_PPC_BOOK3S_32
++ .mask = _PAGE_EXEC,
++ .val = _PAGE_EXEC,
++ .set = " X ",
++ .clear = " ",
++ }, {
++#endif
++ .mask = _PAGE_PRESENT,
++ .val = _PAGE_PRESENT,
++ .set = "present",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_GUARDED,
++ .val = _PAGE_GUARDED,
++ .set = "guarded",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_DIRTY,
++ .val = _PAGE_DIRTY,
++ .set = "dirty",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_ACCESSED,
++ .val = _PAGE_ACCESSED,
++ .set = "accessed",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_WRITETHRU,
++ .val = _PAGE_WRITETHRU,
++ .set = "write through",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_NO_CACHE,
++ .val = _PAGE_NO_CACHE,
++ .set = "no cache",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_SPECIAL,
++ .val = _PAGE_SPECIAL,
++ .set = "special",
++ }
++};
++
++struct pgtable_level pg_level[5] = {
++ {
++ }, { /* pgd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pud */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pmd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pte */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ },
++};
+diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c
+index 8464c2c01c0ca..6aa41669ac1ae 100644
+--- a/arch/powerpc/mm/dump_linuxpagetables.c
++++ b/arch/powerpc/mm/dump_linuxpagetables.c
+@@ -28,6 +28,8 @@
+ #include <asm/page.h>
+ #include <asm/pgalloc.h>
+
++#include "dump_linuxpagetables.h"
++
+ #ifdef CONFIG_PPC32
+ #define KERN_VIRT_START 0
+ #endif
+@@ -102,159 +104,6 @@ static struct addr_marker address_markers[] = {
+ { -1, NULL },
+ };
+
+-struct flag_info {
+- u64 mask;
+- u64 val;
+- const char *set;
+- const char *clear;
+- bool is_val;
+- int shift;
+-};
+-
+-static const struct flag_info flag_array[] = {
+- {
+- .mask = _PAGE_USER | _PAGE_PRIVILEGED,
+- .val = _PAGE_USER,
+- .set = "user",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_RW | _PAGE_RO | _PAGE_NA,
+- .val = _PAGE_RW,
+- .set = "rw",
+- }, {
+- .mask = _PAGE_RW | _PAGE_RO | _PAGE_NA,
+- .val = _PAGE_RO,
+- .set = "ro",
+- }, {
+-#if _PAGE_NA != 0
+- .mask = _PAGE_RW | _PAGE_RO | _PAGE_NA,
+- .val = _PAGE_RO,
+- .set = "na",
+- }, {
+-#endif
+- .mask = _PAGE_EXEC,
+- .val = _PAGE_EXEC,
+- .set = " X ",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_PTE,
+- .val = _PAGE_PTE,
+- .set = "pte",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_PRESENT,
+- .val = _PAGE_PRESENT,
+- .set = "present",
+- .clear = " ",
+- }, {
+-#ifdef CONFIG_PPC_BOOK3S_64
+- .mask = H_PAGE_HASHPTE,
+- .val = H_PAGE_HASHPTE,
+-#else
+- .mask = _PAGE_HASHPTE,
+- .val = _PAGE_HASHPTE,
+-#endif
+- .set = "hpte",
+- .clear = " ",
+- }, {
+-#ifndef CONFIG_PPC_BOOK3S_64
+- .mask = _PAGE_GUARDED,
+- .val = _PAGE_GUARDED,
+- .set = "guarded",
+- .clear = " ",
+- }, {
+-#endif
+- .mask = _PAGE_DIRTY,
+- .val = _PAGE_DIRTY,
+- .set = "dirty",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_ACCESSED,
+- .val = _PAGE_ACCESSED,
+- .set = "accessed",
+- .clear = " ",
+- }, {
+-#ifndef CONFIG_PPC_BOOK3S_64
+- .mask = _PAGE_WRITETHRU,
+- .val = _PAGE_WRITETHRU,
+- .set = "write through",
+- .clear = " ",
+- }, {
+-#endif
+-#ifndef CONFIG_PPC_BOOK3S_64
+- .mask = _PAGE_NO_CACHE,
+- .val = _PAGE_NO_CACHE,
+- .set = "no cache",
+- .clear = " ",
+- }, {
+-#else
+- .mask = _PAGE_NON_IDEMPOTENT,
+- .val = _PAGE_NON_IDEMPOTENT,
+- .set = "non-idempotent",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_TOLERANT,
+- .val = _PAGE_TOLERANT,
+- .set = "tolerant",
+- .clear = " ",
+- }, {
+-#endif
+-#ifdef CONFIG_PPC_BOOK3S_64
+- .mask = H_PAGE_BUSY,
+- .val = H_PAGE_BUSY,
+- .set = "busy",
+- }, {
+-#ifdef CONFIG_PPC_64K_PAGES
+- .mask = H_PAGE_COMBO,
+- .val = H_PAGE_COMBO,
+- .set = "combo",
+- }, {
+- .mask = H_PAGE_4K_PFN,
+- .val = H_PAGE_4K_PFN,
+- .set = "4K_pfn",
+- }, {
+-#else /* CONFIG_PPC_64K_PAGES */
+- .mask = H_PAGE_F_GIX,
+- .val = H_PAGE_F_GIX,
+- .set = "f_gix",
+- .is_val = true,
+- .shift = H_PAGE_F_GIX_SHIFT,
+- }, {
+- .mask = H_PAGE_F_SECOND,
+- .val = H_PAGE_F_SECOND,
+- .set = "f_second",
+- }, {
+-#endif /* CONFIG_PPC_64K_PAGES */
+-#endif
+- .mask = _PAGE_SPECIAL,
+- .val = _PAGE_SPECIAL,
+- .set = "special",
+- }
+-};
+-
+-struct pgtable_level {
+- const struct flag_info *flag;
+- size_t num;
+- u64 mask;
+-};
+-
+-static struct pgtable_level pg_level[] = {
+- {
+- }, { /* pgd */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pud */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pmd */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pte */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- },
+-};
+-
+ static void dump_flag_info(struct pg_state *st, const struct flag_info
+ *flag, u64 pte, int num)
+ {
+diff --git a/arch/powerpc/mm/dump_linuxpagetables.h b/arch/powerpc/mm/dump_linuxpagetables.h
+new file mode 100644
+index 0000000000000..5d513636de73a
+--- /dev/null
++++ b/arch/powerpc/mm/dump_linuxpagetables.h
+@@ -0,0 +1,19 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#include <linux/types.h>
++
++struct flag_info {
++ u64 mask;
++ u64 val;
++ const char *set;
++ const char *clear;
++ bool is_val;
++ int shift;
++};
++
++struct pgtable_level {
++ const struct flag_info *flag;
++ size_t num;
++ u64 mask;
++};
++
++extern struct pgtable_level pg_level[5];
+diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
+index ad0216c41d2c5..67ad128a9a3d4 100644
+--- a/arch/powerpc/platforms/Kconfig.cputype
++++ b/arch/powerpc/platforms/Kconfig.cputype
+@@ -134,11 +134,11 @@ config POWER9_CPU
+
+ config E5500_CPU
+ bool "Freescale e5500"
+- depends on E500
++ depends on PPC64 && E500
+
+ config E6500_CPU
+ bool "Freescale e6500"
+- depends on E500
++ depends on PPC64 && E500
+
+ config 860_CPU
+ bool "8xx family"
+diff --git a/arch/powerpc/platforms/cell/axon_msi.c b/arch/powerpc/platforms/cell/axon_msi.c
+index 326d34e2aa029..946a09ae9fb25 100644
+--- a/arch/powerpc/platforms/cell/axon_msi.c
++++ b/arch/powerpc/platforms/cell/axon_msi.c
+@@ -230,6 +230,7 @@ static int setup_msi_msg_address(struct pci_dev *dev, struct msi_msg *msg)
+ if (!prop) {
+ dev_dbg(&dev->dev,
+ "axon_msi: no msi-address-(32|64) properties found\n");
++ of_node_put(dn);
+ return -ENOENT;
+ }
+
+diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
+index db329d4bf1c30..8b664d9cfcd41 100644
+--- a/arch/powerpc/platforms/cell/spufs/inode.c
++++ b/arch/powerpc/platforms/cell/spufs/inode.c
+@@ -684,6 +684,7 @@ spufs_init_isolated_loader(void)
+ return;
+
+ loader = of_get_property(dn, "loader", &size);
++ of_node_put(dn);
+ if (!loader)
+ return;
+
+diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c
+index 6fb1ceb5756d0..0f66bdf867ee0 100644
+--- a/arch/powerpc/platforms/powernv/rng.c
++++ b/arch/powerpc/platforms/powernv/rng.c
+@@ -67,6 +67,8 @@ int powernv_get_random_real_mode(unsigned long *v)
+ struct powernv_rng *rng;
+
+ rng = raw_cpu_read(powernv_rng);
++ if (!rng)
++ return 0;
+
+ *v = rng_whiten(rng, __raw_rm_readq(rng->regs_real));
+
+diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c
+index 918be816b0977..6d41aa4db05d9 100644
+--- a/arch/powerpc/sysdev/fsl_pci.c
++++ b/arch/powerpc/sysdev/fsl_pci.c
+@@ -523,6 +523,7 @@ int fsl_add_bridge(struct platform_device *pdev, int is_primary)
+ struct resource rsrc;
+ const int *bus_range;
+ u8 hdr_type, progif;
++ u32 class_code;
+ struct device_node *dev;
+ struct ccsr_pci __iomem *pci;
+ u16 temp;
+@@ -596,6 +597,13 @@ int fsl_add_bridge(struct platform_device *pdev, int is_primary)
+ PPC_INDIRECT_TYPE_SURPRESS_PRIMARY_BUS;
+ if (fsl_pcie_check_link(hose))
+ hose->indirect_type |= PPC_INDIRECT_TYPE_NO_PCIE_LINK;
++ /* Fix Class Code to PCI_CLASS_BRIDGE_PCI_NORMAL for pre-3.0 controller */
++ if (in_be32(&pci->block_rev1) < PCIE_IP_REV_3_0) {
++ early_read_config_dword(hose, 0, 0, PCIE_FSL_CSR_CLASSCODE, &class_code);
++ class_code &= 0xff;
++ class_code |= PCI_CLASS_BRIDGE_PCI_NORMAL << 8;
++ early_write_config_dword(hose, 0, 0, PCIE_FSL_CSR_CLASSCODE, class_code);
++ }
+ } else {
+ /*
+ * Set PBFR(PCI Bus Function Register)[10] = 1 to
+diff --git a/arch/powerpc/sysdev/fsl_pci.h b/arch/powerpc/sysdev/fsl_pci.h
+index 151588530b065..caa05c4aa4272 100644
+--- a/arch/powerpc/sysdev/fsl_pci.h
++++ b/arch/powerpc/sysdev/fsl_pci.h
+@@ -23,6 +23,7 @@ struct platform_device;
+
+ #define PCIE_LTSSM 0x0404 /* PCIE Link Training and Status */
+ #define PCIE_LTSSM_L0 0x16 /* L0 state */
++#define PCIE_FSL_CSR_CLASSCODE 0x474 /* FSL GPEX CSR */
+ #define PCIE_IP_REV_2_2 0x02080202 /* PCIE IP block version Rev2.2 */
+ #define PCIE_IP_REV_3_0 0x02080300 /* PCIE IP block version Rev3.0 */
+ #define PIWAR_EN 0x80000000 /* Enable */
+diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
+index 5566bbc86f4af..aa705732150cc 100644
+--- a/arch/powerpc/sysdev/xive/spapr.c
++++ b/arch/powerpc/sysdev/xive/spapr.c
+@@ -631,6 +631,7 @@ static bool xive_get_max_prio(u8 *max_prio)
+ }
+
+ reg = of_get_property(rootdn, "ibm,plat-res-int-priorities", &len);
++ of_node_put(rootdn);
+ if (!reg) {
+ pr_err("Failed to read 'ibm,plat-res-int-priorities' property\n");
+ return false;
+diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
+index db44da32701f2..516aaa19daf28 100644
+--- a/arch/riscv/kernel/sys_riscv.c
++++ b/arch/riscv/kernel/sys_riscv.c
+@@ -26,9 +26,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
+ if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
+ return -EINVAL;
+
+- if ((prot & PROT_WRITE) && (prot & PROT_EXEC))
+- if (unlikely(!(prot & PROT_READ)))
+- return -EINVAL;
++ if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
++ return -EINVAL;
+
+ return ksys_mmap_pgoff(addr, len, prot, flags, fd,
+ offset >> (PAGE_SHIFT - page_shift_offset));
+diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
+index 24a9333dda2cb..7c65750508f25 100644
+--- a/arch/riscv/kernel/traps.c
++++ b/arch/riscv/kernel/traps.c
+@@ -22,6 +22,7 @@
+ #include <linux/mm.h>
+ #include <linux/module.h>
+ #include <linux/irq.h>
++#include <linux/kexec.h>
+
+ #include <asm/processor.h>
+ #include <asm/ptrace.h>
+@@ -50,6 +51,9 @@ void die(struct pt_regs *regs, const char *str)
+
+ ret = notify_die(DIE_OOPS, str, regs, 0, regs->scause, SIGSEGV);
+
++ if (regs && kexec_should_crash(current))
++ crash_kexec(regs);
++
+ bust_spinlocks(0);
+ add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+ spin_unlock_irq(&die_lock);
+diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
+index 6539c50fb9aae..82500962f1b3d 100644
+--- a/arch/x86/boot/Makefile
++++ b/arch/x86/boot/Makefile
+@@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmlinux FORCE
+ AFLAGS_header.o += -I$(objtree)/$(obj)
+ $(obj)/header.o: $(obj)/zoffset.h
+
+-LDFLAGS_setup.elf := -m elf_i386 -T
++LDFLAGS_setup.elf := -m elf_i386 -z noexecstack -T
+ $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE
+ $(call if_changed,ld)
+
+diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
+index 5642f025b397c..23b6e2da72bf8 100644
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -57,6 +57,10 @@ else
+ KBUILD_LDFLAGS += $(shell $(LD) --help 2>&1 | grep -q "\-z noreloc-overflow" \
+ && echo "-z noreloc-overflow -pie --no-dynamic-linker")
+ endif
++
++KBUILD_LDFLAGS += -z noexecstack
++KBUILD_LDFLAGS += $(call ld-option,--no-warn-rwx-segments)
++
+ LDFLAGS_vmlinux := -T
+
+ hostprogs-y := mkpiggy
+diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
+index 5bfe2243a08f8..ec5d8d0bd2221 100644
+--- a/arch/x86/entry/vdso/Makefile
++++ b/arch/x86/entry/vdso/Makefile
+@@ -172,7 +172,7 @@ quiet_cmd_vdso = VDSO $@
+
+ VDSO_LDFLAGS = -shared $(call ld-option, --hash-style=both) \
+ $(call ld-option, --build-id) $(call ld-option, --eh-frame-hdr) \
+- -Bsymbolic
++ -Bsymbolic -z noexecstack
+ GCOV_PROFILE := n
+
+ #
+diff --git a/arch/x86/kernel/pmem.c b/arch/x86/kernel/pmem.c
+index 6b07faaa15798..23154d24b1173 100644
+--- a/arch/x86/kernel/pmem.c
++++ b/arch/x86/kernel/pmem.c
+@@ -27,6 +27,11 @@ static __init int register_e820_pmem(void)
+ * simply here to trigger the module to load on demand.
+ */
+ pdev = platform_device_alloc("e820_pmem", -1);
+- return platform_device_add(pdev);
++
++ rc = platform_device_add(pdev);
++ if (rc)
++ platform_device_put(pdev);
++
++ return rc;
+ }
+ device_initcall(register_e820_pmem);
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 63754d248dfbe..25bdd06969b34 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -1708,16 +1708,6 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ case VCPU_SREG_TR:
+ if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9))
+ goto exception;
+- if (!seg_desc.p) {
+- err_vec = NP_VECTOR;
+- goto exception;
+- }
+- old_desc = seg_desc;
+- seg_desc.type |= 2; /* busy */
+- ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc,
+- sizeof(seg_desc), &ctxt->exception);
+- if (ret != X86EMUL_CONTINUE)
+- return ret;
+ break;
+ case VCPU_SREG_LDTR:
+ if (seg_desc.s || seg_desc.type != 2)
+@@ -1755,8 +1745,17 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+ if (emul_is_noncanonical_address(get_desc_base(&seg_desc) |
+- ((u64)base3 << 32), ctxt))
+- return emulate_gp(ctxt, 0);
++ ((u64)base3 << 32), ctxt))
++ return emulate_gp(ctxt, err_code);
++ }
++
++ if (seg == VCPU_SREG_TR) {
++ old_desc = seg_desc;
++ seg_desc.type |= 2; /* busy */
++ ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc,
++ sizeof(seg_desc), &ctxt->exception);
++ if (ret != X86EMUL_CONTINUE)
++ return ret;
+ }
+ load:
+ ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg);
+diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
+index ca5a6c3f8c911..2047edb5ff746 100644
+--- a/arch/x86/kvm/hyperv.c
++++ b/arch/x86/kvm/hyperv.c
+@@ -341,6 +341,9 @@ static int synic_set_irq(struct kvm_vcpu_hv_synic *synic, u32 sint)
+ struct kvm_lapic_irq irq;
+ int ret, vector;
+
++ if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm))
++ return -EINVAL;
++
+ if (sint >= ARRAY_SIZE(synic->sint))
+ return -EINVAL;
+
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 89d07312e58cf..027941e3df682 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -961,6 +961,10 @@ bool kvm_irq_delivery_to_apic_fast(struct kvm *kvm, struct kvm_lapic *src,
+ *r = -1;
+
+ if (irq->shorthand == APIC_DEST_SELF) {
++ if (KVM_BUG_ON(!src, kvm)) {
++ *r = 0;
++ return true;
++ }
+ *r = kvm_apic_set_irq(src->vcpu, irq, dest_map);
+ return true;
+ }
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 85181457413e7..e1492a67e988a 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -5142,8 +5142,6 @@ static void svm_set_irq(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_svm *svm = to_svm(vcpu);
+
+- BUG_ON(!(gif_set(svm)));
+-
+ trace_kvm_inj_virq(vcpu->arch.interrupt.nr);
+ ++vcpu->stat.irq_injections;
+
+diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
+index fa150855647cc..b4ff063a43712 100644
+--- a/arch/x86/mm/numa.c
++++ b/arch/x86/mm/numa.c
+@@ -826,7 +826,7 @@ void debug_cpumask_set_cpu(int cpu, int node, bool enable)
+ return;
+ }
+ mask = node_to_cpumask_map[node];
+- if (!mask) {
++ if (!cpumask_available(mask)) {
+ pr_err("node_to_cpumask_map[%i] NULL\n", node);
+ dump_stack();
+ return;
+@@ -872,7 +872,7 @@ const struct cpumask *cpumask_of_node(int node)
+ dump_stack();
+ return cpu_none_mask;
+ }
+- if (node_to_cpumask_map[node] == NULL) {
++ if (!cpumask_available(node_to_cpumask_map[node])) {
+ printk(KERN_WARNING
+ "cpumask_of_node(%d): no node_to_cpumask_map!\n",
+ node);
+diff --git a/arch/x86/platform/olpc/olpc-xo1-sci.c b/arch/x86/platform/olpc/olpc-xo1-sci.c
+index 7fa8b3b53bc0a..193860d7f2c40 100644
+--- a/arch/x86/platform/olpc/olpc-xo1-sci.c
++++ b/arch/x86/platform/olpc/olpc-xo1-sci.c
+@@ -85,7 +85,7 @@ static void send_ebook_state(void)
+ return;
+ }
+
+- if (!!test_bit(SW_TABLET_MODE, ebook_switch_idev->sw) == state)
++ if (test_bit(SW_TABLET_MODE, ebook_switch_idev->sw) == !!state)
+ return; /* Nothing new to report. */
+
+ input_report_switch(ebook_switch_idev, SW_TABLET_MODE, state);
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index ded6c5c17fd73..144cda7da7ee1 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -401,6 +401,9 @@ static int register_device_clock(struct acpi_device *adev,
+ if (!lpss_clk_dev)
+ lpt_register_clock_device();
+
++ if (IS_ERR(lpss_clk_dev))
++ return PTR_ERR(lpss_clk_dev);
++
+ clk_data = platform_get_drvdata(lpss_clk_dev);
+ if (!clk_data)
+ return -ENODEV;
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index f68a4ffd3352e..c0cfd3a3ed5e5 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -630,33 +630,6 @@ int pcc_data_alloc(int pcc_ss_id)
+ return 0;
+ }
+
+-/* Check if CPPC revision + num_ent combination is supported */
+-static bool is_cppc_supported(int revision, int num_ent)
+-{
+- int expected_num_ent;
+-
+- switch (revision) {
+- case CPPC_V2_REV:
+- expected_num_ent = CPPC_V2_NUM_ENT;
+- break;
+- case CPPC_V3_REV:
+- expected_num_ent = CPPC_V3_NUM_ENT;
+- break;
+- default:
+- pr_debug("Firmware exports unsupported CPPC revision: %d\n",
+- revision);
+- return false;
+- }
+-
+- if (expected_num_ent != num_ent) {
+- pr_debug("Firmware exports %d entries. Expected: %d for CPPC rev:%d\n",
+- num_ent, expected_num_ent, revision);
+- return false;
+- }
+-
+- return true;
+-}
+-
+ /*
+ * An example CPC table looks like the following.
+ *
+@@ -752,7 +725,6 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
+ cpc_obj->type);
+ goto out_free;
+ }
+- cpc_ptr->num_entries = num_ent;
+
+ /* Second entry should be revision. */
+ cpc_obj = &out_obj->package.elements[1];
+@@ -763,10 +735,32 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
+ cpc_obj->type);
+ goto out_free;
+ }
+- cpc_ptr->version = cpc_rev;
+
+- if (!is_cppc_supported(cpc_rev, num_ent))
++ if (cpc_rev < CPPC_V2_REV) {
++ pr_debug("Unsupported _CPC Revision (%d) for CPU:%d\n", cpc_rev,
++ pr->id);
+ goto out_free;
++ }
++
++ /*
++ * Disregard _CPC if the number of entries in the return pachage is not
++ * as expected, but support future revisions being proper supersets of
++ * the v3 and only causing more entries to be returned by _CPC.
++ */
++ if ((cpc_rev == CPPC_V2_REV && num_ent != CPPC_V2_NUM_ENT) ||
++ (cpc_rev == CPPC_V3_REV && num_ent != CPPC_V3_NUM_ENT) ||
++ (cpc_rev > CPPC_V3_REV && num_ent <= CPPC_V3_NUM_ENT)) {
++ pr_debug("Unexpected number of _CPC return package entries (%d) for CPU:%d\n",
++ num_ent, pr->id);
++ goto out_free;
++ }
++ if (cpc_rev > CPPC_V3_REV) {
++ num_ent = CPPC_V3_NUM_ENT;
++ cpc_rev = CPPC_V3_REV;
++ }
++
++ cpc_ptr->num_entries = num_ent;
++ cpc_ptr->version = cpc_rev;
+
+ /* Iterate through remaining entries in _CPC */
+ for (i = 2; i < num_ent; i++) {
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index e3df3dda03321..3394ec64fe95d 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -2118,13 +2118,6 @@ static const struct dmi_system_id acpi_ec_no_wakeup[] = {
+ DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"),
+ },
+ },
+- {
+- .ident = "ThinkPad X1 Carbon 6th",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Carbon 6th"),
+- },
+- },
+ {
+ .ident = "ThinkPad X1 Yoga 3rd",
+ .matches = {
+diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
+index c8018d73d5a79..c59235038bf29 100644
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -132,10 +132,10 @@ static bool acpi_nondev_subnode_ok(acpi_handle scope,
+ return acpi_nondev_subnode_data_ok(handle, link, list, parent);
+ }
+
+-static int acpi_add_nondev_subnodes(acpi_handle scope,
+- const union acpi_object *links,
+- struct list_head *list,
+- struct fwnode_handle *parent)
++static bool acpi_add_nondev_subnodes(acpi_handle scope,
++ const union acpi_object *links,
++ struct list_head *list,
++ struct fwnode_handle *parent)
+ {
+ bool ret = false;
+ int i;
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 847db3edcb5b8..a3b4ac97793f1 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -359,6 +359,14 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "80E3"),
+ },
+ },
++ {
++ .callback = init_nvs_save_s3,
++ .ident = "Lenovo G40-45",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "80E1"),
++ },
++ },
+ /*
+ * https://bugzilla.kernel.org/show_bug.cgi?id=196907
+ * Some Dell XPS13 9360 cannot do suspend-to-idle using the Low Power
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 096f29a2f710a..fcc3d7985762a 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2350,6 +2350,7 @@ const char *ata_get_cmd_descript(u8 command)
+ { ATA_CMD_WRITE_QUEUED_FUA_EXT, "WRITE DMA QUEUED FUA EXT" },
+ { ATA_CMD_FPDMA_READ, "READ FPDMA QUEUED" },
+ { ATA_CMD_FPDMA_WRITE, "WRITE FPDMA QUEUED" },
++ { ATA_CMD_NCQ_NON_DATA, "NCQ NON-DATA" },
+ { ATA_CMD_FPDMA_SEND, "SEND FPDMA QUEUED" },
+ { ATA_CMD_FPDMA_RECV, "RECEIVE FPDMA QUEUED" },
+ { ATA_CMD_PIO_READ, "READ SECTOR(S)" },
+diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
+index 3e00ab8a8890c..bc06f5919839c 100644
+--- a/drivers/atm/idt77252.c
++++ b/drivers/atm/idt77252.c
+@@ -3767,6 +3767,7 @@ static void __exit idt77252_exit(void)
+ card = idt77252_chain;
+ dev = card->atmdev;
+ idt77252_chain = card->next;
++ del_timer_sync(&card->tst_timer);
+
+ if (dev->phy->stop)
+ dev->phy->stop(dev);
+diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
+index 4fef1fb918ece..5553df736c720 100644
+--- a/drivers/block/null_blk_main.c
++++ b/drivers/block/null_blk_main.c
+@@ -1819,8 +1819,13 @@ static int null_add_dev(struct nullb_device *dev)
+ blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, nullb->q);
+
+ mutex_lock(&lock);
+- nullb->index = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
+- dev->index = nullb->index;
++ rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL);
++ if (rv < 0) {
++ mutex_unlock(&lock);
++ goto out_cleanup_zone;
++ }
++ nullb->index = rv;
++ dev->index = rv;
+ mutex_unlock(&lock);
+
+ blk_queue_logical_block_size(nullb->q, dev->blocksize);
+@@ -1832,13 +1837,16 @@ static int null_add_dev(struct nullb_device *dev)
+
+ rv = null_gendisk_register(nullb);
+ if (rv)
+- goto out_cleanup_zone;
++ goto out_ida_free;
+
+ mutex_lock(&lock);
+ list_add_tail(&nullb->list, &nullb_list);
+ mutex_unlock(&lock);
+
+ return 0;
++
++out_ida_free:
++ ida_free(&nullb_indexes, nullb->index);
+ out_cleanup_zone:
+ if (dev->zoned)
+ null_zone_exit(dev);
+diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c
+index e9228520e4c7a..727fa4347b1e2 100644
+--- a/drivers/bluetooth/hci_intel.c
++++ b/drivers/bluetooth/hci_intel.c
+@@ -1253,7 +1253,11 @@ static struct platform_driver intel_driver = {
+
+ int __init intel_init(void)
+ {
+- platform_driver_register(&intel_driver);
++ int err;
++
++ err = platform_driver_register(&intel_driver);
++ if (err)
++ return err;
+
+ return hci_uart_register_proto(&intel_proto);
+ }
+diff --git a/drivers/bus/hisi_lpc.c b/drivers/bus/hisi_lpc.c
+index cbd970fb02f18..43342ea82afae 100644
+--- a/drivers/bus/hisi_lpc.c
++++ b/drivers/bus/hisi_lpc.c
+@@ -504,13 +504,13 @@ static int hisi_lpc_acpi_probe(struct device *hostdev)
+ {
+ struct acpi_device *adev = ACPI_COMPANION(hostdev);
+ struct acpi_device *child;
++ struct platform_device *pdev;
+ int ret;
+
+ /* Only consider the children of the host */
+ list_for_each_entry(child, &adev->children, node) {
+ const char *hid = acpi_device_hid(child);
+ const struct hisi_lpc_acpi_cell *cell;
+- struct platform_device *pdev;
+ const struct resource *res;
+ bool found = false;
+ int num_res;
+@@ -573,22 +573,24 @@ static int hisi_lpc_acpi_probe(struct device *hostdev)
+
+ ret = platform_device_add_resources(pdev, res, num_res);
+ if (ret)
+- goto fail;
++ goto fail_put_device;
+
+ ret = platform_device_add_data(pdev, cell->pdata,
+ cell->pdata_size);
+ if (ret)
+- goto fail;
++ goto fail_put_device;
+
+ ret = platform_device_add(pdev);
+ if (ret)
+- goto fail;
++ goto fail_put_device;
+
+ acpi_device_set_enumerated(child);
+ }
+
+ return 0;
+
++fail_put_device:
++ platform_device_put(pdev);
+ fail:
+ hisi_lpc_acpi_remove(hostdev);
+ return ret;
+diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c
+index 708c486a6e960..ee41aec106ac6 100644
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -675,6 +675,7 @@ static struct clk_branch gcc_sleep_clk_src = {
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
++ .flags = CLK_IS_CRITICAL,
+ },
+ },
+ };
+@@ -1796,8 +1797,10 @@ static struct clk_regmap_div nss_port4_tx_div_clk_src = {
+ static const struct freq_tbl ftbl_nss_port5_rx_clk_src[] = {
+ F(19200000, P_XO, 1, 0, 0),
+ F(25000000, P_UNIPHY1_RX, 12.5, 0, 0),
++ F(25000000, P_UNIPHY0_RX, 5, 0, 0),
+ F(78125000, P_UNIPHY1_RX, 4, 0, 0),
+ F(125000000, P_UNIPHY1_RX, 2.5, 0, 0),
++ F(125000000, P_UNIPHY0_RX, 1, 0, 0),
+ F(156250000, P_UNIPHY1_RX, 2, 0, 0),
+ F(312500000, P_UNIPHY1_RX, 1, 0, 0),
+ { }
+@@ -1836,8 +1839,10 @@ static struct clk_regmap_div nss_port5_rx_div_clk_src = {
+ static const struct freq_tbl ftbl_nss_port5_tx_clk_src[] = {
+ F(19200000, P_XO, 1, 0, 0),
+ F(25000000, P_UNIPHY1_TX, 12.5, 0, 0),
++ F(25000000, P_UNIPHY0_TX, 5, 0, 0),
+ F(78125000, P_UNIPHY1_TX, 4, 0, 0),
+ F(125000000, P_UNIPHY1_TX, 2.5, 0, 0),
++ F(125000000, P_UNIPHY0_TX, 1, 0, 0),
+ F(156250000, P_UNIPHY1_TX, 2, 0, 0),
+ F(312500000, P_UNIPHY1_TX, 1, 0, 0),
+ { }
+@@ -1875,8 +1880,10 @@ static struct clk_regmap_div nss_port5_tx_div_clk_src = {
+
+ static const struct freq_tbl ftbl_nss_port6_rx_clk_src[] = {
+ F(19200000, P_XO, 1, 0, 0),
++ F(25000000, P_UNIPHY2_RX, 5, 0, 0),
+ F(25000000, P_UNIPHY2_RX, 12.5, 0, 0),
+ F(78125000, P_UNIPHY2_RX, 4, 0, 0),
++ F(125000000, P_UNIPHY2_RX, 1, 0, 0),
+ F(125000000, P_UNIPHY2_RX, 2.5, 0, 0),
+ F(156250000, P_UNIPHY2_RX, 2, 0, 0),
+ F(312500000, P_UNIPHY2_RX, 1, 0, 0),
+@@ -1915,8 +1922,10 @@ static struct clk_regmap_div nss_port6_rx_div_clk_src = {
+
+ static const struct freq_tbl ftbl_nss_port6_tx_clk_src[] = {
+ F(19200000, P_XO, 1, 0, 0),
++ F(25000000, P_UNIPHY2_TX, 5, 0, 0),
+ F(25000000, P_UNIPHY2_TX, 12.5, 0, 0),
+ F(78125000, P_UNIPHY2_TX, 4, 0, 0),
++ F(125000000, P_UNIPHY2_TX, 1, 0, 0),
+ F(125000000, P_UNIPHY2_TX, 2.5, 0, 0),
+ F(156250000, P_UNIPHY2_TX, 2, 0, 0),
+ F(312500000, P_UNIPHY2_TX, 1, 0, 0),
+@@ -3354,6 +3363,7 @@ static struct clk_branch gcc_nssnoc_ubi1_ahb_clk = {
+
+ static struct clk_branch gcc_ubi0_ahb_clk = {
+ .halt_reg = 0x6820c,
++ .halt_check = BRANCH_HALT_DELAY,
+ .clkr = {
+ .enable_reg = 0x6820c,
+ .enable_mask = BIT(0),
+@@ -3371,6 +3381,7 @@ static struct clk_branch gcc_ubi0_ahb_clk = {
+
+ static struct clk_branch gcc_ubi0_axi_clk = {
+ .halt_reg = 0x68200,
++ .halt_check = BRANCH_HALT_DELAY,
+ .clkr = {
+ .enable_reg = 0x68200,
+ .enable_mask = BIT(0),
+@@ -3388,6 +3399,7 @@ static struct clk_branch gcc_ubi0_axi_clk = {
+
+ static struct clk_branch gcc_ubi0_nc_axi_clk = {
+ .halt_reg = 0x68204,
++ .halt_check = BRANCH_HALT_DELAY,
+ .clkr = {
+ .enable_reg = 0x68204,
+ .enable_mask = BIT(0),
+@@ -3405,6 +3417,7 @@ static struct clk_branch gcc_ubi0_nc_axi_clk = {
+
+ static struct clk_branch gcc_ubi0_core_clk = {
+ .halt_reg = 0x68210,
++ .halt_check = BRANCH_HALT_DELAY,
+ .clkr = {
+ .enable_reg = 0x68210,
+ .enable_mask = BIT(0),
+@@ -3422,6 +3435,7 @@ static struct clk_branch gcc_ubi0_core_clk = {
+
+ static struct clk_branch gcc_ubi0_mpt_clk = {
+ .halt_reg = 0x68208,
++ .halt_check = BRANCH_HALT_DELAY,
+ .clkr = {
+ .enable_reg = 0x68208,
+ .enable_mask = BIT(0),
+@@ -3439,6 +3453,7 @@ static struct clk_branch gcc_ubi0_mpt_clk = {
+
+ static struct clk_branch gcc_ubi1_ahb_clk = {
+ .halt_reg = 0x6822c,
++ .halt_check = BRANCH_HALT_DELAY,
+ .clkr = {
+ .enable_reg = 0x6822c,
+ .enable_mask = BIT(0),
+@@ -3456,6 +3471,7 @@ static struct clk_branch gcc_ubi1_ahb_clk = {
+
+ static struct clk_branch gcc_ubi1_axi_clk = {
+ .halt_reg = 0x68220,
++ .halt_check = BRANCH_HALT_DELAY,
+ .clkr = {
+ .enable_reg = 0x68220,
+ .enable_mask = BIT(0),
+@@ -3473,6 +3489,7 @@ static struct clk_branch gcc_ubi1_axi_clk = {
+
+ static struct clk_branch gcc_ubi1_nc_axi_clk = {
+ .halt_reg = 0x68224,
++ .halt_check = BRANCH_HALT_DELAY,
+ .clkr = {
+ .enable_reg = 0x68224,
+ .enable_mask = BIT(0),
+@@ -3490,6 +3507,7 @@ static struct clk_branch gcc_ubi1_nc_axi_clk = {
+
+ static struct clk_branch gcc_ubi1_core_clk = {
+ .halt_reg = 0x68230,
++ .halt_check = BRANCH_HALT_DELAY,
+ .clkr = {
+ .enable_reg = 0x68230,
+ .enable_mask = BIT(0),
+@@ -3507,6 +3525,7 @@ static struct clk_branch gcc_ubi1_core_clk = {
+
+ static struct clk_branch gcc_ubi1_mpt_clk = {
+ .halt_reg = 0x68228,
++ .halt_check = BRANCH_HALT_DELAY,
+ .clkr = {
+ .enable_reg = 0x68228,
+ .enable_mask = BIT(0),
+diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c
+index 6e03b467395b2..ec48b5516e178 100644
+--- a/drivers/clk/renesas/r9a06g032-clocks.c
++++ b/drivers/clk/renesas/r9a06g032-clocks.c
+@@ -277,8 +277,8 @@ static const struct r9a06g032_clkdesc r9a06g032_clocks[] __initconst = {
+ .name = "uart_group_012",
+ .type = K_BITSEL,
+ .source = 1 + R9A06G032_DIV_UART,
+- /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG1_PR2 */
+- .dual.sel = ((0xec / 4) << 5) | 24,
++ /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG0_0 */
++ .dual.sel = ((0x34 / 4) << 5) | 30,
+ .dual.group = 0,
+ },
+ {
+@@ -286,8 +286,8 @@ static const struct r9a06g032_clkdesc r9a06g032_clocks[] __initconst = {
+ .name = "uart_group_34567",
+ .type = K_BITSEL,
+ .source = 1 + R9A06G032_DIV_P2_PG,
+- /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG0_0 */
+- .dual.sel = ((0x34 / 4) << 5) | 30,
++ /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG1_PR2 */
++ .dual.sel = ((0xec / 4) << 5) | 24,
+ .dual.group = 1,
+ },
+ D_UGATE(CLK_UART0, "clk_uart0", UART_GROUP_012, 0, 0, 0x1b2, 0x1b3, 0x1b4, 0x1b5),
+diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c
+index 3e3cc28d5cfe3..f672dc1ecfacb 100644
+--- a/drivers/crypto/hisilicon/sec/sec_algs.c
++++ b/drivers/crypto/hisilicon/sec/sec_algs.c
+@@ -457,7 +457,7 @@ static void sec_skcipher_alg_callback(struct sec_bd_info *sec_resp,
+ */
+ }
+
+- mutex_lock(&ctx->queue->queuelock);
++ spin_lock_bh(&ctx->queue->queuelock);
+ /* Put the IV in place for chained cases */
+ switch (ctx->cipher_alg) {
+ case SEC_C_AES_CBC_128:
+@@ -517,7 +517,7 @@ static void sec_skcipher_alg_callback(struct sec_bd_info *sec_resp,
+ list_del(&backlog_req->backlog_head);
+ }
+ }
+- mutex_unlock(&ctx->queue->queuelock);
++ spin_unlock_bh(&ctx->queue->queuelock);
+
+ mutex_lock(&sec_req->lock);
+ list_del(&sec_req_el->head);
+@@ -806,7 +806,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ */
+
+ /* Grab a big lock for a long time to avoid concurrency issues */
+- mutex_lock(&queue->queuelock);
++ spin_lock_bh(&queue->queuelock);
+
+ /*
+ * Can go on to queue if we have space in either:
+@@ -822,15 +822,15 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq,
+ ret = -EBUSY;
+ if ((skreq->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) {
+ list_add_tail(&sec_req->backlog_head, &ctx->backlog);
+- mutex_unlock(&queue->queuelock);
++ spin_unlock_bh(&queue->queuelock);
+ goto out;
+ }
+
+- mutex_unlock(&queue->queuelock);
++ spin_unlock_bh(&queue->queuelock);
+ goto err_free_elements;
+ }
+ ret = sec_send_request(sec_req, queue);
+- mutex_unlock(&queue->queuelock);
++ spin_unlock_bh(&queue->queuelock);
+ if (ret)
+ goto err_free_elements;
+
+@@ -889,7 +889,7 @@ static int sec_alg_skcipher_init(struct crypto_skcipher *tfm)
+ if (IS_ERR(ctx->queue))
+ return PTR_ERR(ctx->queue);
+
+- mutex_init(&ctx->queue->queuelock);
++ spin_lock_init(&ctx->queue->queuelock);
+ ctx->queue->havesoftqueue = false;
+
+ return 0;
+diff --git a/drivers/crypto/hisilicon/sec/sec_drv.h b/drivers/crypto/hisilicon/sec/sec_drv.h
+index 2d2f186674ba9..ddc5d6bd7574e 100644
+--- a/drivers/crypto/hisilicon/sec/sec_drv.h
++++ b/drivers/crypto/hisilicon/sec/sec_drv.h
+@@ -347,7 +347,7 @@ struct sec_queue {
+ DECLARE_BITMAP(unprocessed, SEC_QUEUE_LEN);
+ DECLARE_KFIFO_PTR(softqueue, typeof(struct sec_request_el *));
+ bool havesoftqueue;
+- struct mutex queuelock;
++ spinlock_t queuelock;
+ void *shadow[SEC_QUEUE_LEN];
+ };
+
+diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
+index 0fadf6a084943..4ec9a924a3381 100644
+--- a/drivers/dma/sprd-dma.c
++++ b/drivers/dma/sprd-dma.c
+@@ -987,11 +987,8 @@ static int sprd_dma_remove(struct platform_device *pdev)
+ {
+ struct sprd_dma_dev *sdev = platform_get_drvdata(pdev);
+ struct sprd_dma_chn *c, *cn;
+- int ret;
+
+- ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0)
+- return ret;
++ pm_runtime_get_sync(&pdev->dev);
+
+ /* explicitly free the irq */
+ if (sdev->irq > 0)
+diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
+index baa7280eccb34..1ce27bb9deada 100644
+--- a/drivers/firmware/arm_scpi.c
++++ b/drivers/firmware/arm_scpi.c
+@@ -826,7 +826,7 @@ static int scpi_init_versions(struct scpi_drvinfo *info)
+ info->firmware_version = le32_to_cpu(caps.platform_version);
+ }
+ /* Ignore error if not implemented */
+- if (scpi_info->is_legacy && ret == -EOPNOTSUPP)
++ if (info->is_legacy && ret == -EOPNOTSUPP)
+ return 0;
+
+ return ret;
+@@ -916,13 +916,14 @@ static int scpi_probe(struct platform_device *pdev)
+ struct resource res;
+ struct device *dev = &pdev->dev;
+ struct device_node *np = dev->of_node;
++ struct scpi_drvinfo *scpi_drvinfo;
+
+- scpi_info = devm_kzalloc(dev, sizeof(*scpi_info), GFP_KERNEL);
+- if (!scpi_info)
++ scpi_drvinfo = devm_kzalloc(dev, sizeof(*scpi_drvinfo), GFP_KERNEL);
++ if (!scpi_drvinfo)
+ return -ENOMEM;
+
+ if (of_match_device(legacy_scpi_of_match, &pdev->dev))
+- scpi_info->is_legacy = true;
++ scpi_drvinfo->is_legacy = true;
+
+ count = of_count_phandle_with_args(np, "mboxes", "#mbox-cells");
+ if (count < 0) {
+@@ -930,19 +931,19 @@ static int scpi_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
+- scpi_info->channels = devm_kcalloc(dev, count, sizeof(struct scpi_chan),
+- GFP_KERNEL);
+- if (!scpi_info->channels)
++ scpi_drvinfo->channels =
++ devm_kcalloc(dev, count, sizeof(struct scpi_chan), GFP_KERNEL);
++ if (!scpi_drvinfo->channels)
+ return -ENOMEM;
+
+- ret = devm_add_action(dev, scpi_free_channels, scpi_info);
++ ret = devm_add_action(dev, scpi_free_channels, scpi_drvinfo);
+ if (ret)
+ return ret;
+
+- for (; scpi_info->num_chans < count; scpi_info->num_chans++) {
++ for (; scpi_drvinfo->num_chans < count; scpi_drvinfo->num_chans++) {
+ resource_size_t size;
+- int idx = scpi_info->num_chans;
+- struct scpi_chan *pchan = scpi_info->channels + idx;
++ int idx = scpi_drvinfo->num_chans;
++ struct scpi_chan *pchan = scpi_drvinfo->channels + idx;
+ struct mbox_client *cl = &pchan->cl;
+ struct device_node *shmem = of_parse_phandle(np, "shmem", idx);
+
+@@ -986,49 +987,57 @@ static int scpi_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- scpi_info->commands = scpi_std_commands;
++ scpi_drvinfo->commands = scpi_std_commands;
+
+- platform_set_drvdata(pdev, scpi_info);
++ platform_set_drvdata(pdev, scpi_drvinfo);
+
+- if (scpi_info->is_legacy) {
++ if (scpi_drvinfo->is_legacy) {
+ /* Replace with legacy variants */
+ scpi_ops.clk_set_val = legacy_scpi_clk_set_val;
+- scpi_info->commands = scpi_legacy_commands;
++ scpi_drvinfo->commands = scpi_legacy_commands;
+
+ /* Fill priority bitmap */
+ for (idx = 0; idx < ARRAY_SIZE(legacy_hpriority_cmds); idx++)
+ set_bit(legacy_hpriority_cmds[idx],
+- scpi_info->cmd_priority);
++ scpi_drvinfo->cmd_priority);
+ }
+
+- ret = scpi_init_versions(scpi_info);
++ scpi_info = scpi_drvinfo;
++
++ ret = scpi_init_versions(scpi_drvinfo);
+ if (ret) {
+ dev_err(dev, "incorrect or no SCP firmware found\n");
++ scpi_info = NULL;
+ return ret;
+ }
+
+- if (scpi_info->is_legacy && !scpi_info->protocol_version &&
+- !scpi_info->firmware_version)
++ if (scpi_drvinfo->is_legacy && !scpi_drvinfo->protocol_version &&
++ !scpi_drvinfo->firmware_version)
+ dev_info(dev, "SCP Protocol legacy pre-1.0 firmware\n");
+ else
+ dev_info(dev, "SCP Protocol %lu.%lu Firmware %lu.%lu.%lu version\n",
+ FIELD_GET(PROTO_REV_MAJOR_MASK,
+- scpi_info->protocol_version),
++ scpi_drvinfo->protocol_version),
+ FIELD_GET(PROTO_REV_MINOR_MASK,
+- scpi_info->protocol_version),
++ scpi_drvinfo->protocol_version),
+ FIELD_GET(FW_REV_MAJOR_MASK,
+- scpi_info->firmware_version),
++ scpi_drvinfo->firmware_version),
+ FIELD_GET(FW_REV_MINOR_MASK,
+- scpi_info->firmware_version),
++ scpi_drvinfo->firmware_version),
+ FIELD_GET(FW_REV_PATCH_MASK,
+- scpi_info->firmware_version));
+- scpi_info->scpi_ops = &scpi_ops;
++ scpi_drvinfo->firmware_version));
+
+ ret = devm_device_add_groups(dev, versions_groups);
+ if (ret)
+ dev_err(dev, "unable to create sysfs version group\n");
+
+- return devm_of_platform_populate(dev);
++ scpi_drvinfo->scpi_ops = &scpi_ops;
++
++ ret = devm_of_platform_populate(dev);
++ if (ret)
++ scpi_info = NULL;
++
++ return ret;
+ }
+
+ static const struct of_device_id scpi_of_match[] = {
+diff --git a/drivers/fpga/altera-pr-ip-core.c b/drivers/fpga/altera-pr-ip-core.c
+index 65e0b6a2c0313..059ba27f3c29c 100644
+--- a/drivers/fpga/altera-pr-ip-core.c
++++ b/drivers/fpga/altera-pr-ip-core.c
+@@ -108,7 +108,7 @@ static int alt_pr_fpga_write(struct fpga_manager *mgr, const char *buf,
+ u32 *buffer_32 = (u32 *)buf;
+ size_t i = 0;
+
+- if (count <= 0)
++ if (!count)
+ return -EINVAL;
+
+ /* Write out the complete 32-bit chunks */
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index 09999e3e3109e..7bda0f59c1099 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -476,7 +476,8 @@ int of_mm_gpiochip_add_data(struct device_node *np,
+ if (mm_gc->save_regs)
+ mm_gc->save_regs(mm_gc);
+
+- mm_gc->gc.of_node = np;
++ of_node_put(mm_gc->gc.of_node);
++ mm_gc->gc.of_node = of_node_get(np);
+
+ ret = gpiochip_add_data(gc, data);
+ if (ret)
+@@ -484,6 +485,7 @@ int of_mm_gpiochip_add_data(struct device_node *np,
+
+ return 0;
+ err2:
++ of_node_put(np);
+ iounmap(mm_gc->regs);
+ err1:
+ kfree(gc->label);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+index e25952d516e22..b51e7839b41b9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+@@ -883,6 +883,10 @@ int amdgpu_bo_pin_restricted(struct amdgpu_bo *bo, u32 domain,
+ if (WARN_ON_ONCE(min_offset > max_offset))
+ return -EINVAL;
+
++ /* Check domain to be pinned to against preferred domains */
++ if (bo->preferred_domains & domain)
++ domain = bo->preferred_domains & domain;
++
+ /* A shared bo cannot be migrated to VRAM */
+ if (bo->prime_shared_count) {
+ if (domain & AMDGPU_GEM_DOMAIN_GTT)
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index b6e7cc9082ca0..31b75d3ca6e90 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -1301,10 +1301,21 @@ static struct i2c_driver adv7511_driver = {
+
+ static int __init adv7511_init(void)
+ {
+- if (IS_ENABLED(CONFIG_DRM_MIPI_DSI))
+- mipi_dsi_driver_register(&adv7533_dsi_driver);
++ int ret;
++
++ if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) {
++ ret = mipi_dsi_driver_register(&adv7533_dsi_driver);
++ if (ret)
++ return ret;
++ }
+
+- return i2c_add_driver(&adv7511_driver);
++ ret = i2c_add_driver(&adv7511_driver);
++ if (ret) {
++ if (IS_ENABLED(CONFIG_DRM_MIPI_DSI))
++ mipi_dsi_driver_unregister(&adv7533_dsi_driver);
++ }
++
++ return ret;
+ }
+ module_init(adv7511_init);
+
+diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
+index ea433bb189ca2..c72092319a533 100644
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -607,7 +607,7 @@ static void *sii8620_burst_get_tx_buf(struct sii8620 *ctx, int len)
+ u8 *buf = &ctx->burst.tx_buf[ctx->burst.tx_count];
+ int size = len + 2;
+
+- if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) {
++ if (ctx->burst.tx_count + size >= ARRAY_SIZE(ctx->burst.tx_buf)) {
+ dev_err(ctx->dev, "TX-BLK buffer exhausted\n");
+ ctx->error = -EINVAL;
+ return NULL;
+@@ -624,7 +624,7 @@ static u8 *sii8620_burst_get_rx_buf(struct sii8620 *ctx, int len)
+ u8 *buf = &ctx->burst.rx_buf[ctx->burst.rx_count];
+ int size = len + 1;
+
+- if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) {
++ if (ctx->burst.rx_count + size >= ARRAY_SIZE(ctx->burst.rx_buf)) {
+ dev_err(ctx->dev, "RX-BLK buffer exhausted\n");
+ ctx->error = -EINVAL;
+ return NULL;
+diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c
+index 6c0ea39d57392..a263ac4aaab28 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dpi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dpi.c
+@@ -52,13 +52,7 @@ enum mtk_dpi_out_channel_swap {
+ };
+
+ enum mtk_dpi_out_color_format {
+- MTK_DPI_COLOR_FORMAT_RGB,
+- MTK_DPI_COLOR_FORMAT_RGB_FULL,
+- MTK_DPI_COLOR_FORMAT_YCBCR_444,
+- MTK_DPI_COLOR_FORMAT_YCBCR_422,
+- MTK_DPI_COLOR_FORMAT_XV_YCC,
+- MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL,
+- MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL
++ MTK_DPI_COLOR_FORMAT_RGB
+ };
+
+ struct mtk_dpi {
+@@ -347,24 +341,11 @@ static void mtk_dpi_config_2n_h_fre(struct mtk_dpi *dpi)
+ static void mtk_dpi_config_color_format(struct mtk_dpi *dpi,
+ enum mtk_dpi_out_color_format format)
+ {
+- if ((format == MTK_DPI_COLOR_FORMAT_YCBCR_444) ||
+- (format == MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL)) {
+- mtk_dpi_config_yuv422_enable(dpi, false);
+- mtk_dpi_config_csc_enable(dpi, true);
+- mtk_dpi_config_swap_input(dpi, false);
+- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_BGR);
+- } else if ((format == MTK_DPI_COLOR_FORMAT_YCBCR_422) ||
+- (format == MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL)) {
+- mtk_dpi_config_yuv422_enable(dpi, true);
+- mtk_dpi_config_csc_enable(dpi, true);
+- mtk_dpi_config_swap_input(dpi, true);
+- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB);
+- } else {
+- mtk_dpi_config_yuv422_enable(dpi, false);
+- mtk_dpi_config_csc_enable(dpi, false);
+- mtk_dpi_config_swap_input(dpi, false);
+- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB);
+- }
++ /* only support RGB888 */
++ mtk_dpi_config_yuv422_enable(dpi, false);
++ mtk_dpi_config_csc_enable(dpi, false);
++ mtk_dpi_config_swap_input(dpi, false);
++ mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB);
+ }
+
+ static void mtk_dpi_power_off(struct mtk_dpi *dpi, enum mtk_dpi_power_ctl pctl)
+diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
+index 0dd317ac5fe57..a629a69c27568 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
+@@ -651,6 +651,8 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi)
+ mtk_dsi_reset_engine(dsi);
+ mtk_dsi_lane0_ulp_mode_enter(dsi);
+ mtk_dsi_clk_ulp_mode_enter(dsi);
++ /* set the lane number as 0 to pull down mipi */
++ writel(0, dsi->regs + DSI_TXRX_CTRL);
+
+ mtk_dsi_disable(dsi);
+
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 1887473cdd79c..9959522ce802d 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -141,8 +141,11 @@ static bool meson_vpu_has_available_connectors(struct device *dev)
+ for_each_endpoint_of_node(dev->of_node, ep) {
+ /* If the endpoint node exists, consider it enabled */
+ remote = of_graph_get_remote_port(ep);
+- if (remote)
++ if (remote) {
++ of_node_put(remote);
++ of_node_put(ep);
+ return true;
++ }
+ }
+
+ return false;
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c
+index 88de122255825..69fe09b410872 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c
+@@ -134,12 +134,13 @@ int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe)
+ {
+ struct msm_drm_private *priv = s->dev->dev_private;
+ struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms));
+- struct mdp5_global_state *state = mdp5_get_global_state(s);
++ struct mdp5_global_state *state;
+ struct mdp5_hw_pipe_state *new_state;
+
+ if (!hwpipe)
+ return 0;
+
++ state = mdp5_get_global_state(s);
+ if (IS_ERR(state))
+ return PTR_ERR(state);
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c
+index 8bff14ae16b0e..f0368d9a0154d 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c
+@@ -33,7 +33,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 *addr, u8 size)
+ {
+ u32 p = *addr;
+
+- if (*addr > bios->image0_size && bios->imaged_addr) {
++ if (*addr >= bios->image0_size && bios->imaged_addr) {
+ *addr -= bios->image0_size;
+ *addr += bios->imaged_addr;
+ }
+diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
+index f86ca163dcf34..a7273c01de34b 100644
+--- a/drivers/gpu/drm/radeon/ni_dpm.c
++++ b/drivers/gpu/drm/radeon/ni_dpm.c
+@@ -2738,10 +2738,10 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev,
+ table->mc_reg_table_entry[k].mc_data[j] |= 0x100;
+ }
+ j++;
+- if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE)
+- return -EINVAL;
+ break;
+ case MC_SEQ_RESERVE_M >> 2:
++ if (j >= SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE)
++ return -EINVAL;
+ temp_reg = RREG32(MC_PMG_CMD_MRS1);
+ table->mc_reg_address[j].s1 = MC_PMG_CMD_MRS1 >> 2;
+ table->mc_reg_address[j].s0 = MC_SEQ_PMG_CMD_MRS1_LP >> 2;
+@@ -2750,8 +2750,6 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev,
+ (temp_reg & 0xffff0000) |
+ (table->mc_reg_table_entry[k].mc_data[i] & 0x0000ffff);
+ j++;
+- if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE)
+- return -EINVAL;
+ break;
+ default:
+ break;
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+index c0b6474359742..69eb0de9973fb 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -1088,6 +1088,9 @@ static struct drm_crtc_state *vop_crtc_duplicate_state(struct drm_crtc *crtc)
+ {
+ struct rockchip_crtc_state *rockchip_state;
+
++ if (WARN_ON(!crtc->state))
++ return NULL;
++
+ rockchip_state = kzalloc(sizeof(*rockchip_state), GFP_KERNEL);
+ if (!rockchip_state)
+ return NULL;
+diff --git a/drivers/gpu/drm/vc4/vc4_dsi.c b/drivers/gpu/drm/vc4/vc4_dsi.c
+index 0c607eb33d7e0..77003ce666a43 100644
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -853,11 +853,9 @@ static bool vc4_dsi_encoder_mode_fixup(struct drm_encoder *encoder,
+ /* Find what divider gets us a faster clock than the requested
+ * pixel clock.
+ */
+- for (divider = 1; divider < 8; divider++) {
+- if (parent_rate / divider < pll_clock) {
+- divider--;
++ for (divider = 1; divider < 255; divider++) {
++ if (parent_rate / (divider + 1) < pll_clock)
+ break;
+- }
+ }
+
+ /* Now that we've picked a PLL divider, calculate back to its
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index 3eddd8f73b577..116ece4be2c95 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -835,6 +835,8 @@ static const struct hid_device_id alps_id[] = {
+ USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1_DUAL) },
+ { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY,
+ USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1) },
++ { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY,
++ USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY) },
+ { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY,
+ USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_T4_BTNLESS) },
+ { }
+diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
+index 6f65f52572368..637a7ce281c61 100644
+--- a/drivers/hid/hid-cp2112.c
++++ b/drivers/hid/hid-cp2112.c
+@@ -794,6 +794,11 @@ static int cp2112_xfer(struct i2c_adapter *adap, u16 addr,
+ data->word = le16_to_cpup((__le16 *)buf);
+ break;
+ case I2C_SMBUS_I2C_BLOCK_DATA:
++ if (read_length > I2C_SMBUS_BLOCK_MAX) {
++ ret = -EINVAL;
++ goto power_normal;
++ }
++
+ memcpy(data->block + 1, buf, read_length);
+ break;
+ case I2C_SMBUS_BLOCK_DATA:
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 152570b49f3b2..fb63845e9920d 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -2095,7 +2095,7 @@ static int wacom_register_inputs(struct wacom *wacom)
+
+ error = wacom_setup_pad_input_capabilities(pad_input_dev, wacom_wac);
+ if (error) {
+- /* no pad in use on this interface */
++ /* no pad events using this interface */
+ input_free_device(pad_input_dev);
+ wacom_wac->pad_input = NULL;
+ pad_input_dev = NULL;
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 254afea67cf37..826c02a11133b 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -1954,7 +1954,6 @@ static void wacom_wac_pad_usage_mapping(struct hid_device *hdev,
+ wacom_wac->has_mute_touch_switch = true;
+ usage->type = EV_SW;
+ usage->code = SW_MUTE_DEVICE;
+- features->device_type |= WACOM_DEVICETYPE_PAD;
+ break;
+ case WACOM_HID_WD_TOUCHSTRIP:
+ wacom_map_usage(input, usage, field, EV_ABS, ABS_RX, 0);
+@@ -2034,6 +2033,30 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
+ wacom_wac->hid_data.inrange_state |= value;
+ }
+
++ /* Process touch switch state first since it is reported through touch interface,
++ * which is indepentent of pad interface. In the case when there are no other pad
++ * events, the pad interface will not even be created.
++ */
++ if ((equivalent_usage == WACOM_HID_WD_MUTE_DEVICE) ||
++ (equivalent_usage == WACOM_HID_WD_TOUCHONOFF)) {
++ if (wacom_wac->shared->touch_input) {
++ bool *is_touch_on = &wacom_wac->shared->is_touch_on;
++
++ if (equivalent_usage == WACOM_HID_WD_MUTE_DEVICE && value)
++ *is_touch_on = !(*is_touch_on);
++ else if (equivalent_usage == WACOM_HID_WD_TOUCHONOFF)
++ *is_touch_on = value;
++
++ input_report_switch(wacom_wac->shared->touch_input,
++ SW_MUTE_DEVICE, !(*is_touch_on));
++ input_sync(wacom_wac->shared->touch_input);
++ }
++ return;
++ }
++
++ if (!input)
++ return;
++
+ switch (equivalent_usage) {
+ case WACOM_HID_WD_TOUCHRING:
+ /*
+@@ -2063,22 +2086,6 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
+ input_event(input, usage->type, usage->code, 0);
+ break;
+
+- case WACOM_HID_WD_MUTE_DEVICE:
+- case WACOM_HID_WD_TOUCHONOFF:
+- if (wacom_wac->shared->touch_input) {
+- bool *is_touch_on = &wacom_wac->shared->is_touch_on;
+-
+- if (equivalent_usage == WACOM_HID_WD_MUTE_DEVICE && value)
+- *is_touch_on = !(*is_touch_on);
+- else if (equivalent_usage == WACOM_HID_WD_TOUCHONOFF)
+- *is_touch_on = value;
+-
+- input_report_switch(wacom_wac->shared->touch_input,
+- SW_MUTE_DEVICE, !(*is_touch_on));
+- input_sync(wacom_wac->shared->touch_input);
+- }
+- break;
+-
+ case WACOM_HID_WD_MODE_CHANGE:
+ if (wacom_wac->is_direct_mode != value) {
+ wacom_wac->is_direct_mode = value;
+@@ -2719,7 +2726,7 @@ void wacom_wac_event(struct hid_device *hdev, struct hid_field *field,
+ /* usage tests must precede field tests */
+ if (WACOM_BATTERY_USAGE(usage))
+ wacom_wac_battery_event(hdev, field, usage, value);
+- else if (WACOM_PAD_FIELD(field) && wacom->wacom_wac.pad_input)
++ else if (WACOM_PAD_FIELD(field))
+ wacom_wac_pad_event(hdev, field, usage, value);
+ else if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input)
+ wacom_wac_pen_event(hdev, field, usage, value);
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 83fab06ccfebd..6229f8e497fcc 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -245,6 +245,21 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x54a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Raptor Lake-S CPU */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa76f),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
++ {
++ /* Raptor Lake-S */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7a26),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
++ {
++ /* Meteor Lake-P */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7e24),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ {
+ /* Rocket Lake CPU */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4c19),
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index 512c61d31fe5c..bce7bf93d62a4 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -353,8 +353,13 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)
+ ctrl_reg = cdns_i2c_readreg(CDNS_I2C_CR_OFFSET);
+ ctrl_reg |= CDNS_I2C_CR_RW | CDNS_I2C_CR_CLR_FIFO;
+
++ /*
++ * Receive up to I2C_SMBUS_BLOCK_MAX data bytes, plus one message length
++ * byte, plus one checksum byte if PEC is enabled. p_msg->len will be 2 if
++ * PEC is enabled, otherwise 1.
++ */
+ if (id->p_msg->flags & I2C_M_RECV_LEN)
+- id->recv_count = I2C_SMBUS_BLOCK_MAX + 1;
++ id->recv_count = I2C_SMBUS_BLOCK_MAX + id->p_msg->len;
+
+ id->curr_recv_count = id->recv_count;
+
+@@ -540,6 +545,9 @@ static int cdns_i2c_process_msg(struct cdns_i2c *id, struct i2c_msg *msg,
+ if (id->err_status & CDNS_I2C_IXR_ARB_LOST)
+ return -EAGAIN;
+
++ if (msg->flags & I2C_M_RECV_LEN)
++ msg->len += min_t(unsigned int, msg->buf[0], I2C_SMBUS_BLOCK_MAX);
++
+ return 0;
+ }
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 2a43f4e46af04..9079be0d51d15 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -2273,8 +2273,9 @@ void i2c_put_adapter(struct i2c_adapter *adap)
+ if (!adap)
+ return;
+
+- put_device(&adap->dev);
+ module_put(adap->owner);
++ /* Should be last, otherwise we risk use-after-free with 'adap' */
++ put_device(&adap->dev);
+ }
+ EXPORT_SYMBOL(i2c_put_adapter);
+
+diff --git a/drivers/i2c/muxes/i2c-mux-gpmux.c b/drivers/i2c/muxes/i2c-mux-gpmux.c
+index 92cf5f48afe63..5053f1675a294 100644
+--- a/drivers/i2c/muxes/i2c-mux-gpmux.c
++++ b/drivers/i2c/muxes/i2c-mux-gpmux.c
+@@ -141,6 +141,7 @@ static int i2c_mux_probe(struct platform_device *pdev)
+ return 0;
+
+ err_children:
++ of_node_put(child);
+ i2c_mux_del_adapters(muxc);
+ err_parent:
+ i2c_put_adapter(parent);
+diff --git a/drivers/iio/light/isl29028.c b/drivers/iio/light/isl29028.c
+index f9912ab4f65c0..4c2810c2a4bf4 100644
+--- a/drivers/iio/light/isl29028.c
++++ b/drivers/iio/light/isl29028.c
+@@ -639,7 +639,7 @@ static int isl29028_probe(struct i2c_client *client,
+ ISL29028_POWER_OFF_DELAY_MS);
+ pm_runtime_use_autosuspend(&client->dev);
+
+- ret = devm_iio_device_register(indio_dev->dev.parent, indio_dev);
++ ret = iio_device_register(indio_dev);
+ if (ret < 0) {
+ dev_err(&client->dev,
+ "%s(): iio registration failed with error %d\n",
+diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
+index 64ee11542a566..be31faf6cc620 100644
+--- a/drivers/infiniband/hw/hfi1/file_ops.c
++++ b/drivers/infiniband/hw/hfi1/file_ops.c
+@@ -1222,8 +1222,10 @@ static int setup_base_ctxt(struct hfi1_filedata *fd,
+ goto done;
+
+ ret = init_user_ctxt(fd, uctxt);
+- if (ret)
++ if (ret) {
++ hfi1_free_ctxt_rcv_groups(uctxt);
+ goto done;
++ }
+
+ user_init(uctxt);
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 4798b718b085b..a4b5374deac87 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -210,6 +210,14 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp,
+ spin_lock_init(&qp->grp_lock);
+ spin_lock_init(&qp->state_lock);
+
++ spin_lock_init(&qp->req.task.state_lock);
++ spin_lock_init(&qp->resp.task.state_lock);
++ spin_lock_init(&qp->comp.task.state_lock);
++
++ spin_lock_init(&qp->sq.sq_lock);
++ spin_lock_init(&qp->rq.producer_lock);
++ spin_lock_init(&qp->rq.consumer_lock);
++
+ atomic_set(&qp->ssn, 0);
+ atomic_set(&qp->skb_out, 0);
+ }
+@@ -258,7 +266,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
+ qp->req.opcode = -1;
+ qp->comp.opcode = -1;
+
+- spin_lock_init(&qp->sq.sq_lock);
+ skb_queue_head_init(&qp->req_pkts);
+
+ rxe_init_task(rxe, &qp->req.task, qp,
+@@ -308,9 +315,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
+ }
+ }
+
+- spin_lock_init(&qp->rq.producer_lock);
+- spin_lock_init(&qp->rq.consumer_lock);
+-
+ skb_queue_head_init(&qp->resp_pkts);
+
+ rxe_init_task(rxe, &qp->resp.task, qp,
+diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
+index 4bf6049dd2c79..8626c924f724c 100644
+--- a/drivers/iommu/exynos-iommu.c
++++ b/drivers/iommu/exynos-iommu.c
+@@ -640,7 +640,7 @@ static int __init exynos_sysmmu_probe(struct platform_device *pdev)
+
+ ret = iommu_device_register(&data->iommu);
+ if (ret)
+- return ret;
++ goto err_iommu_register;
+
+ platform_set_drvdata(pdev, data);
+
+@@ -667,6 +667,10 @@ static int __init exynos_sysmmu_probe(struct platform_device *pdev)
+ pm_runtime_enable(dev);
+
+ return 0;
++
++err_iommu_register:
++ iommu_device_sysfs_remove(&data->iommu);
++ return ret;
+ }
+
+ static int __maybe_unused exynos_sysmmu_suspend(struct device *dev)
+diff --git a/drivers/iommu/qcom_iommu.c b/drivers/iommu/qcom_iommu.c
+index b0a4a3d2f60ea..244e2f7eae842 100644
+--- a/drivers/iommu/qcom_iommu.c
++++ b/drivers/iommu/qcom_iommu.c
+@@ -767,9 +767,12 @@ static bool qcom_iommu_has_secure_context(struct qcom_iommu_dev *qcom_iommu)
+ {
+ struct device_node *child;
+
+- for_each_child_of_node(qcom_iommu->dev->of_node, child)
+- if (of_device_is_compatible(child, "qcom,msm-iommu-v1-sec"))
++ for_each_child_of_node(qcom_iommu->dev->of_node, child) {
++ if (of_device_is_compatible(child, "qcom,msm-iommu-v1-sec")) {
++ of_node_put(child);
+ return true;
++ }
++ }
+
+ return false;
+ }
+diff --git a/drivers/irqchip/irq-tegra.c b/drivers/irqchip/irq-tegra.c
+index 0abc0cd1c32ed..1b3048ecb6000 100644
+--- a/drivers/irqchip/irq-tegra.c
++++ b/drivers/irqchip/irq-tegra.c
+@@ -157,10 +157,10 @@ static int tegra_ictlr_suspend(void)
+ lic->cop_iep[i] = readl_relaxed(ictlr + ICTLR_COP_IEP_CLASS);
+
+ /* Disable COP interrupts */
+- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR);
+
+ /* Disable CPU interrupts */
+- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR);
+
+ /* Enable the wakeup sources of ictlr */
+ writel_relaxed(lic->ictlr_wake_mask[i], ictlr + ICTLR_CPU_IER_SET);
+@@ -181,12 +181,12 @@ static void tegra_ictlr_resume(void)
+
+ writel_relaxed(lic->cpu_iep[i],
+ ictlr + ICTLR_CPU_IEP_CLASS);
+- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR);
+ writel_relaxed(lic->cpu_ier[i],
+ ictlr + ICTLR_CPU_IER_SET);
+ writel_relaxed(lic->cop_iep[i],
+ ictlr + ICTLR_COP_IEP_CLASS);
+- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR);
+ writel_relaxed(lic->cop_ier[i],
+ ictlr + ICTLR_COP_IER_SET);
+ }
+@@ -321,7 +321,7 @@ static int __init tegra_ictlr_init(struct device_node *node,
+ lic->base[i] = base;
+
+ /* Disable all interrupts */
+- writel_relaxed(~0UL, base + ICTLR_CPU_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), base + ICTLR_CPU_IER_CLR);
+ /* All interrupts target IRQ */
+ writel_relaxed(0, base + ICTLR_CPU_IEP_CLASS);
+
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index dd56536ab7288..5c45100f6d53e 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -3533,7 +3533,7 @@ static void raid_status(struct dm_target *ti, status_type_t type,
+ {
+ struct raid_set *rs = ti->private;
+ struct mddev *mddev = &rs->md;
+- struct r5conf *conf = mddev->private;
++ struct r5conf *conf = rs_is_raid456(rs) ? mddev->private : NULL;
+ int i, max_nr_stripes = conf ? conf->max_nr_stripes : 0;
+ unsigned long recovery;
+ unsigned int raid_param_cnt = 1; /* at least 1 for chunksize */
+@@ -3804,7 +3804,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs)
+
+ memset(cleared_failed_devices, 0, sizeof(cleared_failed_devices));
+
+- for (i = 0; i < mddev->raid_disks; i++) {
++ for (i = 0; i < rs->raid_disks; i++) {
+ r = &rs->dev[i].rdev;
+ /* HM FIXME: enhance journal device recovery processing */
+ if (test_bit(Journal, &r->flags))
+diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c
+index 3ca8627c2f1de..af5af0b78022b 100644
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -20,7 +20,7 @@
+
+ #define HIGH_WATERMARK 50
+ #define LOW_WATERMARK 45
+-#define MAX_WRITEBACK_JOBS 0
++#define MAX_WRITEBACK_JOBS min(0x10000000 / PAGE_SIZE, totalram_pages / 16)
+ #define ENDIO_LATENCY 16
+ #define WRITEBACK_LATENCY 64
+ #define AUTOCOMMIT_BLOCKS_SSD 65536
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index d2ee97cd7d14e..324d1dd58e2bc 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -3122,6 +3122,11 @@ static int dm_call_pr(struct block_device *bdev, iterate_devices_callout_fn fn,
+ goto out;
+ ti = dm_table_get_target(table, 0);
+
++ if (dm_suspended_md(md)) {
++ ret = -EAGAIN;
++ goto out;
++ }
++
+ ret = -EINVAL;
+ if (!ti->type->iterate_devices)
+ goto out;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 8e0f936b3e378..9f9cd2fadc1e7 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1863,9 +1863,12 @@ static int raid10_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
+ int err = 0;
+ int number = rdev->raid_disk;
+ struct md_rdev **rdevp;
+- struct raid10_info *p = conf->mirrors + number;
++ struct raid10_info *p;
+
+ print_conf(conf);
++ if (unlikely(number >= mddev->raid_disks))
++ return 0;
++ p = conf->mirrors + number;
+ if (rdev == p->rdev)
+ rdevp = &p->rdev;
+ else if (rdev == p->replacement)
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index dad426cc0f903..6f04473f08385 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2670,10 +2670,10 @@ static void raid5_end_write_request(struct bio *bi)
+ if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags))
+ clear_bit(R5_LOCKED, &sh->dev[i].flags);
+ set_bit(STRIPE_HANDLE, &sh->state);
+- raid5_release_stripe(sh);
+
+ if (sh->batch_head && sh != sh->batch_head)
+ raid5_release_stripe(sh->batch_head);
++ raid5_release_stripe(sh);
+ }
+
+ static void raid5_error(struct mddev *mddev, struct md_rdev *rdev)
+diff --git a/drivers/media/pci/tw686x/tw686x-core.c b/drivers/media/pci/tw686x/tw686x-core.c
+index 7fb3f07bf0221..8e759728ef22b 100644
+--- a/drivers/media/pci/tw686x/tw686x-core.c
++++ b/drivers/media/pci/tw686x/tw686x-core.c
+@@ -318,13 +318,6 @@ static int tw686x_probe(struct pci_dev *pci_dev,
+
+ spin_lock_init(&dev->lock);
+
+- err = request_irq(pci_dev->irq, tw686x_irq, IRQF_SHARED,
+- dev->name, dev);
+- if (err < 0) {
+- dev_err(&pci_dev->dev, "unable to request interrupt\n");
+- goto iounmap;
+- }
+-
+ timer_setup(&dev->dma_delay_timer, tw686x_dma_delay, 0);
+
+ /*
+@@ -336,18 +329,23 @@ static int tw686x_probe(struct pci_dev *pci_dev,
+ err = tw686x_video_init(dev);
+ if (err) {
+ dev_err(&pci_dev->dev, "can't register video\n");
+- goto free_irq;
++ goto iounmap;
+ }
+
+ err = tw686x_audio_init(dev);
+ if (err)
+ dev_warn(&pci_dev->dev, "can't register audio\n");
+
++ err = request_irq(pci_dev->irq, tw686x_irq, IRQF_SHARED,
++ dev->name, dev);
++ if (err < 0) {
++ dev_err(&pci_dev->dev, "unable to request interrupt\n");
++ goto iounmap;
++ }
++
+ pci_set_drvdata(pci_dev, dev);
+ return 0;
+
+-free_irq:
+- free_irq(pci_dev->irq, dev);
+ iounmap:
+ pci_iounmap(pci_dev, dev->mmio);
+ free_region:
+diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h b/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h
+index 78e2cc0dead1a..4f4a51dd48e14 100644
+--- a/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h
++++ b/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h
+@@ -48,12 +48,14 @@ struct mdp_ipi_init {
+ * @ipi_id : IPI_MDP
+ * @ap_inst : AP mtk_mdp_vpu address
+ * @vpu_inst_addr : VPU MDP instance address
++ * @padding : Alignment padding
+ */
+ struct mdp_ipi_comm {
+ uint32_t msg_id;
+ uint32_t ipi_id;
+ uint64_t ap_inst;
+ uint32_t vpu_inst_addr;
++ uint32_t padding;
+ };
+
+ /**
+diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
+index ce46f87214708..1fb2cdd9c4b2b 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-video.c
++++ b/drivers/media/usb/hdpvr/hdpvr-video.c
+@@ -413,7 +413,7 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count,
+ struct hdpvr_device *dev = video_drvdata(file);
+ struct hdpvr_buffer *buf = NULL;
+ struct urb *urb;
+- unsigned int ret = 0;
++ int ret = 0;
+ int rem, cnt;
+
+ if (*pos)
+diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
+index 7aab26128f6d9..addf76a8d1b0e 100644
+--- a/drivers/memstick/core/ms_block.c
++++ b/drivers/memstick/core/ms_block.c
+@@ -1339,17 +1339,17 @@ static int msb_ftl_initialize(struct msb_data *msb)
+ msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE;
+ msb->logical_block_count = msb->zone_count * 496 - 2;
+
+- msb->used_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL);
+- msb->erased_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL);
++ msb->used_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL);
++ msb->erased_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL);
+ msb->lba_to_pba_table =
+ kmalloc_array(msb->logical_block_count, sizeof(u16),
+ GFP_KERNEL);
+
+ if (!msb->used_blocks_bitmap || !msb->lba_to_pba_table ||
+ !msb->erased_blocks_bitmap) {
+- kfree(msb->used_blocks_bitmap);
++ bitmap_free(msb->used_blocks_bitmap);
++ bitmap_free(msb->erased_blocks_bitmap);
+ kfree(msb->lba_to_pba_table);
+- kfree(msb->erased_blocks_bitmap);
+ return -ENOMEM;
+ }
+
+@@ -1961,7 +1961,8 @@ static int msb_bd_open(struct block_device *bdev, fmode_t mode)
+ static void msb_data_clear(struct msb_data *msb)
+ {
+ kfree(msb->boot_page);
+- kfree(msb->used_blocks_bitmap);
++ bitmap_free(msb->used_blocks_bitmap);
++ bitmap_free(msb->erased_blocks_bitmap);
+ kfree(msb->lba_to_pba_table);
+ kfree(msb->cache);
+ msb->card = NULL;
+diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c
+index 43d8683266de2..caa61649fe797 100644
+--- a/drivers/mfd/t7l66xb.c
++++ b/drivers/mfd/t7l66xb.c
+@@ -412,11 +412,8 @@ err_noirq:
+
+ static int t7l66xb_remove(struct platform_device *dev)
+ {
+- struct t7l66xb_platform_data *pdata = dev_get_platdata(&dev->dev);
+ struct t7l66xb *t7l66xb = platform_get_drvdata(dev);
+- int ret;
+
+- ret = pdata->disable(dev);
+ clk_disable_unprepare(t7l66xb->clk48m);
+ clk_put(t7l66xb->clk48m);
+ clk_disable_unprepare(t7l66xb->clk32k);
+@@ -427,8 +424,7 @@ static int t7l66xb_remove(struct platform_device *dev)
+ mfd_remove_devices(&dev->dev);
+ kfree(t7l66xb);
+
+- return ret;
+-
++ return 0;
+ }
+
+ static struct platform_driver t7l66xb_platform_driver = {
+diff --git a/drivers/misc/cardreader/rtsx_pcr.c b/drivers/misc/cardreader/rtsx_pcr.c
+index 3eb3c237f3398..80b9f36dbca43 100644
+--- a/drivers/misc/cardreader/rtsx_pcr.c
++++ b/drivers/misc/cardreader/rtsx_pcr.c
+@@ -1479,7 +1479,7 @@ static int rtsx_pci_probe(struct pci_dev *pcidev,
+ pcr->remap_addr = ioremap_nocache(base, len);
+ if (!pcr->remap_addr) {
+ ret = -ENOMEM;
+- goto free_handle;
++ goto free_idr;
+ }
+
+ pcr->rtsx_resv_buf = dma_alloc_coherent(&(pcidev->dev),
+@@ -1541,6 +1541,10 @@ disable_msi:
+ pcr->rtsx_resv_buf, pcr->rtsx_resv_buf_addr);
+ unmap:
+ iounmap(pcr->remap_addr);
++free_idr:
++ spin_lock(&rtsx_pci_lock);
++ idr_remove(&rtsx_pci_idr, pcr->id);
++ spin_unlock(&rtsx_pci_lock);
+ free_handle:
+ kfree(handle);
+ free_pcr:
+diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c
+index ce08a9f22308f..0dbe78383f8fa 100644
+--- a/drivers/misc/cxl/irq.c
++++ b/drivers/misc/cxl/irq.c
+@@ -353,6 +353,7 @@ int afu_allocate_irqs(struct cxl_context *ctx, u32 count)
+
+ out:
+ cxl_ops->release_irq_ranges(&ctx->irqs, ctx->afu->adapter);
++ bitmap_free(ctx->irq_bitmap);
+ afu_irq_name_free(ctx);
+ return -ENOMEM;
+ }
+diff --git a/drivers/mmc/host/cavium-octeon.c b/drivers/mmc/host/cavium-octeon.c
+index 22aded1065ae8..2245452a44c86 100644
+--- a/drivers/mmc/host/cavium-octeon.c
++++ b/drivers/mmc/host/cavium-octeon.c
+@@ -288,6 +288,7 @@ static int octeon_mmc_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(&pdev->dev, "Error populating slots\n");
+ octeon_mmc_set_shared_power(host, 0);
++ of_node_put(cn);
+ goto error;
+ }
+ i++;
+diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c
+index eee08d81b2421..f79806e31e7ea 100644
+--- a/drivers/mmc/host/cavium-thunderx.c
++++ b/drivers/mmc/host/cavium-thunderx.c
+@@ -138,8 +138,10 @@ static int thunder_mmc_probe(struct pci_dev *pdev,
+ continue;
+
+ ret = cvm_mmc_of_slot_probe(&host->slot_pdev[i]->dev, host);
+- if (ret)
++ if (ret) {
++ of_node_put(child_node);
+ goto error;
++ }
+ }
+ i++;
+ }
+diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
+index 00b5465dfb0ce..d0db1c37552f8 100644
+--- a/drivers/mmc/host/pxamci.c
++++ b/drivers/mmc/host/pxamci.c
+@@ -653,7 +653,7 @@ static int pxamci_probe(struct platform_device *pdev)
+
+ ret = pxamci_of_init(pdev, mmc);
+ if (ret)
+- return ret;
++ goto out;
+
+ host = mmc_priv(mmc);
+ host->mmc = mmc;
+@@ -677,7 +677,7 @@ static int pxamci_probe(struct platform_device *pdev)
+
+ ret = pxamci_init_ocr(host);
+ if (ret < 0)
+- return ret;
++ goto out;
+
+ mmc->caps = 0;
+ host->cmdat = 0;
+diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
+index 8cd1794768ba1..70ce977cfeeca 100644
+--- a/drivers/mmc/host/sdhci-of-at91.c
++++ b/drivers/mmc/host/sdhci-of-at91.c
+@@ -117,8 +117,13 @@ static void sdhci_at91_set_power(struct sdhci_host *host, unsigned char mode,
+ static void sdhci_at91_set_uhs_signaling(struct sdhci_host *host,
+ unsigned int timing)
+ {
+- if (timing == MMC_TIMING_MMC_DDR52)
+- sdhci_writeb(host, SDMMC_MC1R_DDR, SDMMC_MC1R);
++ u8 mc1r;
++
++ if (timing == MMC_TIMING_MMC_DDR52) {
++ mc1r = sdhci_readb(host, SDMMC_MC1R);
++ mc1r |= SDMMC_MC1R_DDR;
++ sdhci_writeb(host, mc1r, SDMMC_MC1R);
++ }
+ sdhci_set_uhs_signaling(host, timing);
+ }
+
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index d6cb0f9a34880..77ae23077f560 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -704,6 +704,7 @@ static int esdhc_signal_voltage_switch(struct mmc_host *mmc,
+ scfg_node = of_find_matching_node(NULL, scfg_device_ids);
+ if (scfg_node)
+ scfg_base = of_iomap(scfg_node, 0);
++ of_node_put(scfg_node);
+ if (scfg_base) {
+ sdhciovselcr = SDHCIOVSELCR_TGLEN |
+ SDHCIOVSELCR_VSELVAL;
+diff --git a/drivers/mtd/devices/st_spi_fsm.c b/drivers/mtd/devices/st_spi_fsm.c
+index 55d4a77f3b7f5..533096c88ae19 100644
+--- a/drivers/mtd/devices/st_spi_fsm.c
++++ b/drivers/mtd/devices/st_spi_fsm.c
+@@ -2120,10 +2120,12 @@ static int stfsm_probe(struct platform_device *pdev)
+ (long long)fsm->mtd.size, (long long)(fsm->mtd.size >> 20),
+ fsm->mtd.erasesize, (fsm->mtd.erasesize >> 10));
+
+- return mtd_device_register(&fsm->mtd, NULL, 0);
+-
++ ret = mtd_device_register(&fsm->mtd, NULL, 0);
++ if (ret) {
+ err_clk_unprepare:
+- clk_disable_unprepare(fsm->clk);
++ clk_disable_unprepare(fsm->clk);
++ }
++
+ return ret;
+ }
+
+diff --git a/drivers/mtd/maps/physmap_of_versatile.c b/drivers/mtd/maps/physmap_of_versatile.c
+index 03f2b6e7bc7e8..7d56e97bd50f4 100644
+--- a/drivers/mtd/maps/physmap_of_versatile.c
++++ b/drivers/mtd/maps/physmap_of_versatile.c
+@@ -107,6 +107,7 @@ static int ap_flash_init(struct platform_device *pdev)
+ return -ENODEV;
+ }
+ ebi_base = of_iomap(ebi, 0);
++ of_node_put(ebi);
+ if (!ebi_base)
+ return -ENODEV;
+
+@@ -221,6 +222,7 @@ int of_flash_probe_versatile(struct platform_device *pdev,
+
+ versatile_flashprot = (enum versatile_flashprot)devid->data;
+ rmap = syscon_node_to_regmap(sysnp);
++ of_node_put(sysnp);
+ if (IS_ERR(rmap))
+ return PTR_ERR(rmap);
+
+diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
+index f3bd86e136033..e57f7ba054bc5 100644
+--- a/drivers/mtd/sm_ftl.c
++++ b/drivers/mtd/sm_ftl.c
+@@ -1091,9 +1091,9 @@ static void sm_release(struct mtd_blktrans_dev *dev)
+ {
+ struct sm_ftl *ftl = dev->priv;
+
+- mutex_lock(&ftl->mutex);
+ del_timer_sync(&ftl->timer);
+ cancel_work_sync(&ftl->flush_work);
++ mutex_lock(&ftl->mutex);
+ sm_cache_flush(ftl);
+ mutex_unlock(&ftl->mutex);
+ }
+diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c
+index ced11ea892698..25def028a1dce 100644
+--- a/drivers/net/can/pch_can.c
++++ b/drivers/net/can/pch_can.c
+@@ -500,6 +500,7 @@ static void pch_can_error(struct net_device *ndev, u32 status)
+ if (!skb)
+ return;
+
++ errc = ioread32(&priv->regs->errc);
+ if (status & PCH_BUS_OFF) {
+ pch_can_set_tx_all(priv, 0);
+ pch_can_set_rx_all(priv, 0);
+@@ -507,9 +508,11 @@ static void pch_can_error(struct net_device *ndev, u32 status)
+ cf->can_id |= CAN_ERR_BUSOFF;
+ priv->can.can_stats.bus_off++;
+ can_bus_off(ndev);
++ } else {
++ cf->data[6] = errc & PCH_TEC;
++ cf->data[7] = (errc & PCH_REC) >> 8;
+ }
+
+- errc = ioread32(&priv->regs->errc);
+ /* Warning interrupt. */
+ if (status & PCH_EWARN) {
+ state = CAN_STATE_ERROR_WARNING;
+@@ -567,9 +570,6 @@ static void pch_can_error(struct net_device *ndev, u32 status)
+ break;
+ }
+
+- cf->data[6] = errc & PCH_TEC;
+- cf->data[7] = (errc & PCH_REC) >> 8;
+-
+ priv->can.state = state;
+ netif_receive_skb(skb);
+
+diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
+index 963da8eda1687..0156c18d5a2d0 100644
+--- a/drivers/net/can/rcar/rcar_can.c
++++ b/drivers/net/can/rcar/rcar_can.c
+@@ -233,11 +233,8 @@ static void rcar_can_error(struct net_device *ndev)
+ if (eifr & (RCAR_CAN_EIFR_EWIF | RCAR_CAN_EIFR_EPIF)) {
+ txerr = readb(&priv->regs->tecr);
+ rxerr = readb(&priv->regs->recr);
+- if (skb) {
++ if (skb)
+ cf->can_id |= CAN_ERR_CRTL;
+- cf->data[6] = txerr;
+- cf->data[7] = rxerr;
+- }
+ }
+ if (eifr & RCAR_CAN_EIFR_BEIF) {
+ int rx_errors = 0, tx_errors = 0;
+@@ -337,6 +334,9 @@ static void rcar_can_error(struct net_device *ndev)
+ can_bus_off(ndev);
+ if (skb)
+ cf->can_id |= CAN_ERR_BUSOFF;
++ } else if (skb) {
++ cf->data[6] = txerr;
++ cf->data[7] = rxerr;
+ }
+ if (eifr & RCAR_CAN_EIFR_ORIF) {
+ netdev_dbg(priv->ndev, "Receive overrun error interrupt\n");
+diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
+index 9f107798f904b..e7327ceabb76e 100644
+--- a/drivers/net/can/sja1000/sja1000.c
++++ b/drivers/net/can/sja1000/sja1000.c
+@@ -405,9 +405,6 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
+ txerr = priv->read_reg(priv, SJA1000_TXERR);
+ rxerr = priv->read_reg(priv, SJA1000_RXERR);
+
+- cf->data[6] = txerr;
+- cf->data[7] = rxerr;
+-
+ if (isrc & IRQ_DOI) {
+ /* data overrun interrupt */
+ netdev_dbg(dev, "data overrun interrupt\n");
+@@ -429,6 +426,10 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
+ else
+ state = CAN_STATE_ERROR_ACTIVE;
+ }
++ if (state != CAN_STATE_BUS_OFF) {
++ cf->data[6] = txerr;
++ cf->data[7] = rxerr;
++ }
+ if (isrc & IRQ_BEI) {
+ /* bus error interrupt */
+ priv->can.can_stats.bus_error++;
+diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
+index 472175e37055e..5f730f791c27f 100644
+--- a/drivers/net/can/spi/hi311x.c
++++ b/drivers/net/can/spi/hi311x.c
+@@ -688,8 +688,6 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id)
+
+ txerr = hi3110_read(spi, HI3110_READ_TEC);
+ rxerr = hi3110_read(spi, HI3110_READ_REC);
+- cf->data[6] = txerr;
+- cf->data[7] = rxerr;
+ tx_state = txerr >= rxerr ? new_state : 0;
+ rx_state = txerr <= rxerr ? new_state : 0;
+ can_change_state(net, cf, tx_state, rx_state);
+@@ -702,6 +700,9 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id)
+ hi3110_hw_sleep(spi);
+ break;
+ }
++ } else {
++ cf->data[6] = txerr;
++ cf->data[7] = rxerr;
+ }
+ }
+
+diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c
+index 093fc9a529f08..bebdd133d9ed1 100644
+--- a/drivers/net/can/sun4i_can.c
++++ b/drivers/net/can/sun4i_can.c
+@@ -525,11 +525,6 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status)
+ rxerr = (errc >> 16) & 0xFF;
+ txerr = errc & 0xFF;
+
+- if (skb) {
+- cf->data[6] = txerr;
+- cf->data[7] = rxerr;
+- }
+-
+ if (isrc & SUN4I_INT_DATA_OR) {
+ /* data overrun interrupt */
+ netdev_dbg(dev, "data overrun interrupt\n");
+@@ -560,6 +555,10 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status)
+ else
+ state = CAN_STATE_ERROR_ACTIVE;
+ }
++ if (skb && state != CAN_STATE_BUS_OFF) {
++ cf->data[6] = txerr;
++ cf->data[7] = rxerr;
++ }
+ if (isrc & SUN4I_INT_BUS_ERR) {
+ /* bus error interrupt */
+ netdev_dbg(dev, "bus error interrupt\n");
+diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
+index 31a070226353a..23eba9bab7150 100644
+--- a/drivers/net/can/usb/ems_usb.c
++++ b/drivers/net/can/usb/ems_usb.c
+@@ -206,7 +206,7 @@ struct __packed ems_cpc_msg {
+ __le32 ts_sec; /* timestamp in seconds */
+ __le32 ts_nsec; /* timestamp in nano seconds */
+
+- union {
++ union __packed {
+ u8 generic[64];
+ struct cpc_can_msg can_msg;
+ struct cpc_can_params can_params;
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index a7c408acb0c09..01d4a731b579c 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -890,8 +890,10 @@ static void kvaser_usb_hydra_update_state(struct kvaser_usb_net_priv *priv,
+ new_state < CAN_STATE_BUS_OFF)
+ priv->can.can_stats.restarts++;
+
+- cf->data[6] = bec->txerr;
+- cf->data[7] = bec->rxerr;
++ if (new_state != CAN_STATE_BUS_OFF) {
++ cf->data[6] = bec->txerr;
++ cf->data[7] = bec->rxerr;
++ }
+
+ stats = &netdev->stats;
+ stats->rx_packets++;
+@@ -1045,8 +1047,10 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv,
+ shhwtstamps->hwtstamp = hwtstamp;
+
+ cf->can_id |= CAN_ERR_BUSERROR;
+- cf->data[6] = bec.txerr;
+- cf->data[7] = bec.rxerr;
++ if (new_state != CAN_STATE_BUS_OFF) {
++ cf->data[6] = bec.txerr;
++ cf->data[7] = bec.rxerr;
++ }
+
+ stats->rx_packets++;
+ stats->rx_bytes += cf->can_dlc;
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+index 0e0403dd05500..5e281249ad5fe 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -857,8 +857,10 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev,
+ break;
+ }
+
+- cf->data[6] = es->txerr;
+- cf->data[7] = es->rxerr;
++ if (new_state != CAN_STATE_BUS_OFF) {
++ cf->data[6] = es->txerr;
++ cf->data[7] = es->rxerr;
++ }
+
+ stats->rx_packets++;
+ stats->rx_bytes += cf->can_dlc;
+diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
+index 232f45f722f0c..5cb5be4dc941f 100644
+--- a/drivers/net/can/usb/usb_8dev.c
++++ b/drivers/net/can/usb/usb_8dev.c
+@@ -453,9 +453,10 @@ static void usb_8dev_rx_err_msg(struct usb_8dev_priv *priv,
+
+ if (rx_errors)
+ stats->rx_errors++;
+-
+- cf->data[6] = txerr;
+- cf->data[7] = rxerr;
++ if (priv->can.state != CAN_STATE_BUS_OFF) {
++ cf->data[6] = txerr;
++ cf->data[7] = rxerr;
++ }
+
+ priv->bec.txerr = txerr;
+ priv->bec.rxerr = rxerr;
+diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
+index 52a811f913846..eb11a8e7fcb7f 100644
+--- a/drivers/net/ethernet/freescale/fec_ptp.c
++++ b/drivers/net/ethernet/freescale/fec_ptp.c
+@@ -141,11 +141,7 @@ static int fec_ptp_enable_pps(struct fec_enet_private *fep, uint enable)
+ * NSEC_PER_SEC - ts.tv_nsec. Add the remaining nanoseconds
+ * to current timer would be next second.
+ */
+- tempval = readl(fep->hwp + FEC_ATIME_CTRL);
+- tempval |= FEC_T_CTRL_CAPTURE;
+- writel(tempval, fep->hwp + FEC_ATIME_CTRL);
+-
+- tempval = readl(fep->hwp + FEC_ATIME);
++ tempval = fep->cc.read(&fep->cc);
+ /* Convert the ptp local counter to 1588 timestamp */
+ ns = timecounter_cyc2time(&fep->tc, tempval);
+ ts = ns_to_timespec64(ns);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 2f3b393e55068..85337806efc75 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -397,7 +397,9 @@ static void i40e_tx_timeout(struct net_device *netdev)
+ set_bit(__I40E_GLOBAL_RESET_REQUESTED, pf->state);
+ break;
+ default:
+- netdev_err(netdev, "tx_timeout recovery unsuccessful\n");
++ netdev_err(netdev, "tx_timeout recovery unsuccessful, device is in non-recoverable state.\n");
++ set_bit(__I40E_DOWN_REQUESTED, pf->state);
++ set_bit(__I40E_VSI_DOWN_REQUESTED, vsi->state);
+ break;
+ }
+
+diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
+index ca54e268d157b..33cbe4f70d590 100644
+--- a/drivers/net/ethernet/intel/igb/igb.h
++++ b/drivers/net/ethernet/intel/igb/igb.h
+@@ -594,6 +594,8 @@ struct igb_adapter {
+ struct igb_mac_addr *mac_table;
+ struct vf_mac_filter vf_macs;
+ struct vf_mac_filter *vf_mac_list;
++ /* lock for VF resources */
++ spinlock_t vfs_lock;
+ };
+
+ /* flags controlling PTP/1588 function */
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 9f45ecd9e8e5e..aacfa5fcdc408 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -3517,6 +3517,7 @@ static int igb_disable_sriov(struct pci_dev *pdev)
+ struct net_device *netdev = pci_get_drvdata(pdev);
+ struct igb_adapter *adapter = netdev_priv(netdev);
+ struct e1000_hw *hw = &adapter->hw;
++ unsigned long flags;
+
+ /* reclaim resources allocated to VFs */
+ if (adapter->vf_data) {
+@@ -3529,12 +3530,13 @@ static int igb_disable_sriov(struct pci_dev *pdev)
+ pci_disable_sriov(pdev);
+ msleep(500);
+ }
+-
++ spin_lock_irqsave(&adapter->vfs_lock, flags);
+ kfree(adapter->vf_mac_list);
+ adapter->vf_mac_list = NULL;
+ kfree(adapter->vf_data);
+ adapter->vf_data = NULL;
+ adapter->vfs_allocated_count = 0;
++ spin_unlock_irqrestore(&adapter->vfs_lock, flags);
+ wr32(E1000_IOVCTL, E1000_IOVCTL_REUSE_VFQ);
+ wrfl();
+ msleep(100);
+@@ -3694,7 +3696,9 @@ static void igb_remove(struct pci_dev *pdev)
+ igb_release_hw_control(adapter);
+
+ #ifdef CONFIG_PCI_IOV
++ rtnl_lock();
+ igb_disable_sriov(pdev);
++ rtnl_unlock();
+ #endif
+
+ unregister_netdev(netdev);
+@@ -3855,6 +3859,9 @@ static int igb_sw_init(struct igb_adapter *adapter)
+
+ spin_lock_init(&adapter->nfc_lock);
+ spin_lock_init(&adapter->stats64_lock);
++
++ /* init spinlock to avoid concurrency of VF resources */
++ spin_lock_init(&adapter->vfs_lock);
+ #ifdef CONFIG_PCI_IOV
+ switch (hw->mac.type) {
+ case e1000_82576:
+@@ -7601,8 +7608,10 @@ unlock:
+ static void igb_msg_task(struct igb_adapter *adapter)
+ {
+ struct e1000_hw *hw = &adapter->hw;
++ unsigned long flags;
+ u32 vf;
+
++ spin_lock_irqsave(&adapter->vfs_lock, flags);
+ for (vf = 0; vf < adapter->vfs_allocated_count; vf++) {
+ /* process any reset requests */
+ if (!igb_check_for_rst(hw, vf))
+@@ -7616,6 +7625,7 @@ static void igb_msg_task(struct igb_adapter *adapter)
+ if (!igb_check_for_ack(hw, vf))
+ igb_rcv_ack_from_vf(adapter, vf);
+ }
++ spin_unlock_irqrestore(&adapter->vfs_lock, flags);
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+index d79e177f89901..ec303d4d2d7a5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -95,7 +95,7 @@ struct page_pool;
+ #define MLX5E_LOG_ALIGNED_MPWQE_PPW (ilog2(MLX5E_REQUIRED_WQE_MTTS))
+ #define MLX5E_REQUIRED_MTTS(wqes) (wqes * MLX5E_REQUIRED_WQE_MTTS)
+ #define MLX5E_MAX_RQ_NUM_MTTS \
+- ((1 << 16) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */
++ (ALIGN_DOWN(U16_MAX, 4) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */
+ #define MLX5E_ORDER2_MAX_PACKET_MTU (order_base_2(10 * 1024))
+ #define MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW \
+ (ilog2(MLX5E_MAX_RQ_NUM_MTTS / MLX5E_REQUIRED_WQE_MTTS))
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 8c458c8f57a3b..a19e04f8bcc8f 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -799,8 +799,7 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb,
+ use_cache = false;
+ }
+
+- fl6->flowlabel = ip6_make_flowinfo(RT_TOS(prio),
+- info->key.label);
++ fl6->flowlabel = ip6_make_flowinfo(prio, info->key.label);
+ dst_cache = (struct dst_cache *)&info->dst_cache;
+ if (use_cache) {
+ dst = dst_cache_get_ip6(dst_cache, &fl6->saddr);
+diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
+index 12f100392ed11..ca9042ddb6d71 100644
+--- a/drivers/net/netdevsim/bpf.c
++++ b/drivers/net/netdevsim/bpf.c
+@@ -330,10 +330,12 @@ nsim_map_alloc_elem(struct bpf_offloaded_map *offmap, unsigned int idx)
+ {
+ struct nsim_bpf_bound_map *nmap = offmap->dev_priv;
+
+- nmap->entry[idx].key = kmalloc(offmap->map.key_size, GFP_USER);
++ nmap->entry[idx].key = kmalloc(offmap->map.key_size,
++ GFP_KERNEL_ACCOUNT | __GFP_NOWARN);
+ if (!nmap->entry[idx].key)
+ return -ENOMEM;
+- nmap->entry[idx].value = kmalloc(offmap->map.value_size, GFP_USER);
++ nmap->entry[idx].value = kmalloc(offmap->map.value_size,
++ GFP_KERNEL_ACCOUNT | __GFP_NOWARN);
+ if (!nmap->entry[idx].value) {
+ kfree(nmap->entry[idx].key);
+ nmap->entry[idx].key = NULL;
+@@ -475,7 +477,7 @@ nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap)
+ if (offmap->map.map_flags)
+ return -EINVAL;
+
+- nmap = kzalloc(sizeof(*nmap), GFP_USER);
++ nmap = kzalloc(sizeof(*nmap), GFP_KERNEL_ACCOUNT);
+ if (!nmap)
+ return -ENOMEM;
+
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index efee7bacfd76a..cf6ff8732fb2c 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1706,7 +1706,7 @@ static const struct driver_info ax88179_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1719,7 +1719,7 @@ static const struct driver_info ax88178a_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1732,7 +1732,7 @@ static const struct driver_info cypress_GX3_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1745,7 +1745,7 @@ static const struct driver_info dlink_dub1312_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1758,7 +1758,7 @@ static const struct driver_info sitecom_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1771,7 +1771,7 @@ static const struct driver_info samsung_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1784,7 +1784,7 @@ static const struct driver_info lenovo_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1797,7 +1797,7 @@ static const struct driver_info belkin_info = {
+ .link_reset = ax88179_link_reset,
+ .reset = ax88179_reset,
+ .stop = ax88179_stop,
+- .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
++ .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+ .rx_fixup = ax88179_rx_fixup,
+ .tx_fixup = ax88179_tx_fixup,
+ };
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index e5c7a5c051090..1316f5b0c0d7e 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -845,13 +845,11 @@ int usbnet_stop (struct net_device *net)
+
+ mpn = !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags);
+
+- /* deferred work (task, timer, softirq) must also stop.
+- * can't flush_scheduled_work() until we drop rtnl (later),
+- * else workers could deadlock; so make workers a NOP.
+- */
++ /* deferred work (timer, softirq, task) must also stop */
+ dev->flags = 0;
+ del_timer_sync (&dev->delay);
+ tasklet_kill (&dev->bh);
++ cancel_work_sync(&dev->kevent);
+ if (!pm)
+ usb_autopm_put_interface(dev->intf);
+
+@@ -1614,8 +1612,6 @@ void usbnet_disconnect (struct usb_interface *intf)
+ net = dev->net;
+ unregister_netdev (net);
+
+- cancel_work_sync(&dev->kevent);
+-
+ usb_scuttle_anchored_urbs(&dev->deferred);
+
+ if (dev->driver_info->unbind)
+diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c
+index 241e6f0e1dfe2..4489875fc87b0 100644
+--- a/drivers/net/wireless/ath/ath10k/snoc.c
++++ b/drivers/net/wireless/ath/ath10k/snoc.c
+@@ -879,13 +879,12 @@ static void ath10k_snoc_init_napi(struct ath10k *ar)
+ static int ath10k_snoc_request_irq(struct ath10k *ar)
+ {
+ struct ath10k_snoc *ar_snoc = ath10k_snoc_priv(ar);
+- int irqflags = IRQF_TRIGGER_RISING;
+ int ret, id;
+
+ for (id = 0; id < CE_COUNT_MAX; id++) {
+ ret = request_irq(ar_snoc->ce_irqs[id].irq_line,
+- ath10k_snoc_per_engine_handler,
+- irqflags, ce_name[id], ar);
++ ath10k_snoc_per_engine_handler, 0,
++ ce_name[id], ar);
+ if (ret) {
+ ath10k_err(ar,
+ "failed to register IRQ handler for CE %d: %d",
+diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
+index 9f64e32381f94..81107100e3682 100644
+--- a/drivers/net/wireless/ath/ath9k/htc.h
++++ b/drivers/net/wireless/ath/ath9k/htc.h
+@@ -325,11 +325,11 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb)
+ }
+
+ #ifdef CONFIG_ATH9K_HTC_DEBUGFS
+-
+-#define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
+-#define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a)
+-#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++)
+-#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a)
++#define __STAT_SAFE(expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0)
++#define TX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
++#define TX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a)
++#define RX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++)
++#define RX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a)
+ #define CAB_STAT_INC priv->debug.tx_stats.cab_queued++
+
+ #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++)
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index cb136d9d46214..49d5873309900 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -946,7 +946,6 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
+ priv->hw = hw;
+ priv->htc = htc_handle;
+ priv->dev = dev;
+- htc_handle->drv_priv = priv;
+ SET_IEEE80211_DEV(hw, priv->dev);
+
+ ret = ath9k_htc_wait_for_target(priv);
+@@ -967,6 +966,8 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
+ if (ret)
+ goto err_init;
+
++ htc_handle->drv_priv = priv;
++
+ return 0;
+
+ err_init:
+diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
+index 55a809cb31054..3a46b319e9f10 100644
+--- a/drivers/net/wireless/ath/wil6210/debugfs.c
++++ b/drivers/net/wireless/ath/wil6210/debugfs.c
+@@ -1002,20 +1002,14 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf,
+ void *cmd;
+ int cmdlen = len - sizeof(struct wmi_cmd_hdr);
+ u16 cmdid;
+- int rc, rc1;
++ int rc1;
+
+- if (cmdlen < 0)
++ if (cmdlen < 0 || *ppos != 0)
+ return -EINVAL;
+
+- wmi = kmalloc(len, GFP_KERNEL);
+- if (!wmi)
+- return -ENOMEM;
+-
+- rc = simple_write_to_buffer(wmi, len, ppos, buf, len);
+- if (rc < 0) {
+- kfree(wmi);
+- return rc;
+- }
++ wmi = memdup_user(buf, len);
++ if (IS_ERR(wmi))
++ return PTR_ERR(wmi);
+
+ cmd = (cmdlen > 0) ? &wmi[1] : NULL;
+ cmdid = le16_to_cpu(wmi->command_id);
+@@ -1025,7 +1019,7 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf,
+
+ wil_info(wil, "0x%04x[%d] -> %d\n", cmdid, cmdlen, rc1);
+
+- return rc;
++ return len;
+ }
+
+ static const struct file_operations fops_wmi = {
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-rs.c b/drivers/net/wireless/intel/iwlegacy/4965-rs.c
+index 54ff83829afb1..f204e139e5f02 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-rs.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-rs.c
+@@ -2422,7 +2422,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta,
+ /* Repeat initial/next rate.
+ * For legacy IL_NUMBER_TRY == 1, this loop will not execute.
+ * For HT IL_HT_NUMBER_TRY == 3, this executes twice. */
+- while (repeat_rate > 0 && idx < LINK_QUAL_MAX_RETRY_NUM) {
++ while (repeat_rate > 0) {
+ if (is_legacy(tbl_type.lq_type)) {
+ if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE)
+ ant_toggle_cnt++;
+@@ -2441,6 +2441,8 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta,
+ cpu_to_le32(new_rate);
+ repeat_rate--;
+ idx++;
++ if (idx >= LINK_QUAL_MAX_RETRY_NUM)
++ goto out;
+ }
+
+ il4965_rs_get_tbl_info_from_mcs(new_rate, lq_sta->band,
+@@ -2485,6 +2487,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta,
+ repeat_rate--;
+ }
+
++out:
+ lq_cmd->agg_params.agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
+ lq_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+
+diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c
+index 1c6d428515a48..b15a1b99f28f7 100644
+--- a/drivers/net/wireless/intersil/p54/main.c
++++ b/drivers/net/wireless/intersil/p54/main.c
+@@ -688,7 +688,7 @@ static void p54_flush(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
+ * queues have already been stopped and no new frames can sneak
+ * up from behind.
+ */
+- while ((total = p54_flush_count(priv) && i--)) {
++ while ((total = p54_flush_count(priv)) && i--) {
+ /* waste time */
+ msleep(20);
+ }
+diff --git a/drivers/net/wireless/intersil/p54/p54spi.c b/drivers/net/wireless/intersil/p54/p54spi.c
+index e41bf042352ed..3dcfad5b61ff0 100644
+--- a/drivers/net/wireless/intersil/p54/p54spi.c
++++ b/drivers/net/wireless/intersil/p54/p54spi.c
+@@ -177,7 +177,7 @@ static int p54spi_request_firmware(struct ieee80211_hw *dev)
+
+ ret = p54_parse_firmware(dev, priv->firmware);
+ if (ret) {
+- release_firmware(priv->firmware);
++ /* the firmware is released by the caller */
+ return ret;
+ }
+
+@@ -672,6 +672,7 @@ static int p54spi_probe(struct spi_device *spi)
+ return 0;
+
+ err_free_common:
++ release_firmware(priv->firmware);
+ free_irq(gpio_to_irq(p54spi_gpio_irq), spi);
+ err_free_gpio_irq:
+ gpio_free(p54spi_gpio_irq);
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 3d8e17bb8a101..7de92af2af029 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -552,7 +552,7 @@ struct mac80211_hwsim_data {
+ bool ps_poll_pending;
+ struct dentry *debugfs;
+
+- uintptr_t pending_cookie;
++ atomic_t pending_cookie;
+ struct sk_buff_head pending; /* packets pending */
+ /*
+ * Only radios in the same group can communicate together (the
+@@ -1136,8 +1136,7 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
+ goto nla_put_failure;
+
+ /* We create a cookie to identify this skb */
+- data->pending_cookie++;
+- cookie = data->pending_cookie;
++ cookie = atomic_inc_return(&data->pending_cookie);
+ info->rate_driver_data[0] = (void *)cookie;
+ if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD))
+ goto nla_put_failure;
+@@ -3120,6 +3119,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
+ const u8 *src;
+ unsigned int hwsim_flags;
+ int i;
++ unsigned long flags;
+ bool found = false;
+
+ if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
+@@ -3144,18 +3144,20 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
+ goto out;
+
+ /* look for the skb matching the cookie passed back from user */
++ spin_lock_irqsave(&data2->pending.lock, flags);
+ skb_queue_walk_safe(&data2->pending, skb, tmp) {
+- u64 skb_cookie;
++ uintptr_t skb_cookie;
+
+ txi = IEEE80211_SKB_CB(skb);
+- skb_cookie = (u64)(uintptr_t)txi->rate_driver_data[0];
++ skb_cookie = (uintptr_t)txi->rate_driver_data[0];
+
+ if (skb_cookie == ret_skb_cookie) {
+- skb_unlink(skb, &data2->pending);
++ __skb_unlink(skb, &data2->pending);
+ found = true;
+ break;
+ }
+ }
++ spin_unlock_irqrestore(&data2->pending.lock, flags);
+
+ /* not found */
+ if (!found)
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index f29a154d995c8..d75763410cdc1 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -283,6 +283,7 @@ static int if_usb_probe(struct usb_interface *intf,
+ return 0;
+
+ err_get_fw:
++ usb_put_dev(udev);
+ lbs_remove_card(priv);
+ err_add_card:
+ if_usb_reset_device(cardp);
+diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
+index 1b5abd4816ed7..203b888f38d8e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
++++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
+@@ -114,6 +114,7 @@ static int mt76_led_init(struct mt76_dev *dev)
+ if (!of_property_read_u32(np, "led-sources", &led_pin))
+ dev->led_pin = led_pin;
+ dev->led_al = of_property_read_bool(np, "led-active-low");
++ of_node_put(np);
+ }
+
+ return devm_led_classdev_register(dev->dev, &dev->led_cdev);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index 498994041bbcb..474439fc2da1f 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -370,8 +370,8 @@ static ssize_t rtl_debugfs_set_write_h2c(struct file *filp,
+
+ tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count);
+
+- if (!buffer || copy_from_user(tmp, buffer, tmp_len))
+- return count;
++ if (copy_from_user(tmp, buffer, tmp_len))
++ return -EFAULT;
+
+ tmp[tmp_len] = '\0';
+
+@@ -381,8 +381,8 @@ static ssize_t rtl_debugfs_set_write_h2c(struct file *filp,
+ &h2c_data[4], &h2c_data[5],
+ &h2c_data[6], &h2c_data[7]);
+
+- if (h2c_len <= 0)
+- return count;
++ if (h2c_len == 0)
++ return -EINVAL;
+
+ for (i = 0; i < h2c_len; i++)
+ h2c_data_packed[i] = (u8)h2c_data[i];
+diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
+index 311d6ab8d0160..6301aa413c3b8 100644
+--- a/drivers/ntb/test/ntb_tool.c
++++ b/drivers/ntb/test/ntb_tool.c
+@@ -367,14 +367,16 @@ static ssize_t tool_fn_write(struct tool_ctx *tc,
+ u64 bits;
+ int n;
+
++ if (*offp)
++ return 0;
++
+ buf = kmalloc(size + 1, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+- ret = simple_write_to_buffer(buf, size, offp, ubuf, size);
+- if (ret < 0) {
++ if (copy_from_user(buf, ubuf, size)) {
+ kfree(buf);
+- return ret;
++ return -EFAULT;
+ }
+
+ buf[size] = 0;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 7cd38c9eaa020..f494e76faaa01 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4799,6 +4799,9 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs },
+ /* Broadcom multi-function device */
+ { PCI_VENDOR_ID_BROADCOM, 0x16D7, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs },
+ { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs },
+ { 0 }
+ };
+diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+index 415e913609945..70a3026304b63 100644
+--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+@@ -1455,8 +1455,10 @@ static int nmk_pinctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+
+ has_config = nmk_pinctrl_dt_get_config(np, &configs);
+ np_config = of_parse_phandle(np, "ste,config", 0);
+- if (np_config)
++ if (np_config) {
+ has_config |= nmk_pinctrl_dt_get_config(np_config, &configs);
++ of_node_put(np_config);
++ }
+ if (has_config) {
+ const char *gpio_name;
+ const char *pin;
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm8916.c b/drivers/pinctrl/qcom/pinctrl-msm8916.c
+index 20ebf244e80de..359f5b43bebc2 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm8916.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm8916.c
+@@ -852,8 +852,8 @@ static const struct msm_pingroup msm8916_groups[] = {
+ PINGROUP(28, pwr_modem_enabled_a, NA, NA, NA, NA, NA, qdss_tracedata_b, NA, atest_combodac),
+ PINGROUP(29, cci_i2c, NA, NA, NA, NA, NA, qdss_tracedata_b, NA, atest_combodac),
+ PINGROUP(30, cci_i2c, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b),
+- PINGROUP(31, cci_timer0, NA, NA, NA, NA, NA, NA, NA, NA),
+- PINGROUP(32, cci_timer1, NA, NA, NA, NA, NA, NA, NA, NA),
++ PINGROUP(31, cci_timer0, flash_strobe, NA, NA, NA, NA, NA, NA, NA),
++ PINGROUP(32, cci_timer1, flash_strobe, NA, NA, NA, NA, NA, NA, NA),
+ PINGROUP(33, cci_async, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b),
+ PINGROUP(34, pwr_nav_enabled_a, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b),
+ PINGROUP(35, pwr_crypto_enabled_a, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b),
+diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
+index 374a8028fec77..b36a000ed969b 100644
+--- a/drivers/platform/olpc/olpc-ec.c
++++ b/drivers/platform/olpc/olpc-ec.c
+@@ -170,7 +170,7 @@ static ssize_t ec_dbgfs_cmd_write(struct file *file, const char __user *buf,
+ int i, m;
+ unsigned char ec_cmd[EC_MAX_CMD_ARGS];
+ unsigned int ec_cmd_int[EC_MAX_CMD_ARGS];
+- char cmdbuf[64];
++ char cmdbuf[64] = "";
+ int ec_cmd_bytes;
+
+ mutex_lock(&ec_dbgfs_lock);
+diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
+index b255590aef36e..b2bd7ee46c452 100644
+--- a/drivers/regulator/of_regulator.c
++++ b/drivers/regulator/of_regulator.c
+@@ -189,8 +189,12 @@ static void of_get_regulation_constraints(struct device_node *np,
+ }
+
+ suspend_np = of_get_child_by_name(np, regulator_states[i]);
+- if (!suspend_np || !suspend_state)
++ if (!suspend_np)
+ continue;
++ if (!suspend_state) {
++ of_node_put(suspend_np);
++ continue;
++ }
+
+ if (!of_property_read_u32(suspend_np, "regulator-mode",
+ &pval)) {
+diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c
+index 6cc0f9a5533e0..63726d8fb3320 100644
+--- a/drivers/remoteproc/qcom_wcnss.c
++++ b/drivers/remoteproc/qcom_wcnss.c
+@@ -415,6 +415,7 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss,
+ irq_handler_t thread_fn)
+ {
+ int ret;
++ int irq_number;
+
+ ret = platform_get_irq_byname(pdev, name);
+ if (ret < 0 && optional) {
+@@ -425,14 +426,19 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss,
+ return ret;
+ }
+
++ irq_number = ret;
++
+ ret = devm_request_threaded_irq(&pdev->dev, ret,
+ NULL, thread_fn,
+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+ "wcnss", wcnss);
+- if (ret)
++ if (ret) {
+ dev_err(&pdev->dev, "request %s IRQ failed\n", name);
++ return ret;
++ }
+
+- return ret;
++ /* Return the IRQ number if the IRQ was successfully acquired */
++ return irq_number;
+ }
+
+ static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss)
+diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
+index f23f10887d93c..f4f950c231d69 100644
+--- a/drivers/rpmsg/qcom_smd.c
++++ b/drivers/rpmsg/qcom_smd.c
+@@ -1364,6 +1364,7 @@ static int qcom_smd_parse_edge(struct device *dev,
+ }
+
+ edge->ipc_regmap = syscon_node_to_regmap(syscon_np);
++ of_node_put(syscon_np);
+ if (IS_ERR(edge->ipc_regmap)) {
+ ret = PTR_ERR(edge->ipc_regmap);
+ goto put_node;
+diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
+index 76d3c50bf078b..ba8fc756264b1 100644
+--- a/drivers/s390/char/zcore.c
++++ b/drivers/s390/char/zcore.c
+@@ -53,6 +53,7 @@ static struct dentry *zcore_reipl_file;
+ static struct dentry *zcore_hsa_file;
+ static struct ipl_parameter_block *ipl_block;
+
++static DEFINE_MUTEX(hsa_buf_mutex);
+ static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE);
+
+ /*
+@@ -69,19 +70,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count)
+ if (!hsa_available)
+ return -ENODATA;
+
++ mutex_lock(&hsa_buf_mutex);
+ while (count) {
+ if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
+ TRACE("sclp_sdias_copy() failed\n");
++ mutex_unlock(&hsa_buf_mutex);
+ return -EIO;
+ }
+ offset = src % PAGE_SIZE;
+ bytes = min(PAGE_SIZE - offset, count);
+- if (copy_to_user(dest, hsa_buf + offset, bytes))
++ if (copy_to_user(dest, hsa_buf + offset, bytes)) {
++ mutex_unlock(&hsa_buf_mutex);
+ return -EFAULT;
++ }
+ src += bytes;
+ dest += bytes;
+ count -= bytes;
+ }
++ mutex_unlock(&hsa_buf_mutex);
+ return 0;
+ }
+
+@@ -99,9 +105,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
+ if (!hsa_available)
+ return -ENODATA;
+
++ mutex_lock(&hsa_buf_mutex);
+ while (count) {
+ if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) {
+ TRACE("sclp_sdias_copy() failed\n");
++ mutex_unlock(&hsa_buf_mutex);
+ return -EIO;
+ }
+ offset = src % PAGE_SIZE;
+@@ -111,6 +119,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
+ dest += bytes;
+ count -= bytes;
+ }
++ mutex_unlock(&hsa_buf_mutex);
+ return 0;
+ }
+
+diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
+index 7a06cdff6572d..862b0eb0fe6de 100644
+--- a/drivers/s390/cio/vfio_ccw_drv.c
++++ b/drivers/s390/cio/vfio_ccw_drv.c
+@@ -205,19 +205,11 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process)
+ if (work_pending(&sch->todo_work))
+ goto out_unlock;
+
+- if (cio_update_schib(sch)) {
+- vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER);
+- rc = 0;
+- goto out_unlock;
+- }
+-
+- private = dev_get_drvdata(&sch->dev);
+- if (private->state == VFIO_CCW_STATE_NOT_OPER) {
+- private->state = private->mdev ? VFIO_CCW_STATE_IDLE :
+- VFIO_CCW_STATE_STANDBY;
+- }
+ rc = 0;
+
++ if (cio_update_schib(sch))
++ vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER);
++
+ out_unlock:
+ spin_unlock_irqrestore(sch->lock, flags);
+
+diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
+index 09ce175bbfcf6..dc87a6b84d739 100644
+--- a/drivers/s390/scsi/zfcp_fc.c
++++ b/drivers/s390/scsi/zfcp_fc.c
+@@ -145,27 +145,33 @@ void zfcp_fc_enqueue_event(struct zfcp_adapter *adapter,
+
+ static int zfcp_fc_wka_port_get(struct zfcp_fc_wka_port *wka_port)
+ {
++ int ret = -EIO;
++
+ if (mutex_lock_interruptible(&wka_port->mutex))
+ return -ERESTARTSYS;
+
+ if (wka_port->status == ZFCP_FC_WKA_PORT_OFFLINE ||
+ wka_port->status == ZFCP_FC_WKA_PORT_CLOSING) {
+ wka_port->status = ZFCP_FC_WKA_PORT_OPENING;
+- if (zfcp_fsf_open_wka_port(wka_port))
++ if (zfcp_fsf_open_wka_port(wka_port)) {
++ /* could not even send request, nothing to wait for */
+ wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE;
++ goto out;
++ }
+ }
+
+- mutex_unlock(&wka_port->mutex);
+-
+- wait_event(wka_port->completion_wq,
++ wait_event(wka_port->opened,
+ wka_port->status == ZFCP_FC_WKA_PORT_ONLINE ||
+ wka_port->status == ZFCP_FC_WKA_PORT_OFFLINE);
+
+ if (wka_port->status == ZFCP_FC_WKA_PORT_ONLINE) {
+ atomic_inc(&wka_port->refcount);
+- return 0;
++ ret = 0;
++ goto out;
+ }
+- return -EIO;
++out:
++ mutex_unlock(&wka_port->mutex);
++ return ret;
+ }
+
+ static void zfcp_fc_wka_port_offline(struct work_struct *work)
+@@ -181,9 +187,12 @@ static void zfcp_fc_wka_port_offline(struct work_struct *work)
+
+ wka_port->status = ZFCP_FC_WKA_PORT_CLOSING;
+ if (zfcp_fsf_close_wka_port(wka_port)) {
++ /* could not even send request, nothing to wait for */
+ wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE;
+- wake_up(&wka_port->completion_wq);
++ goto out;
+ }
++ wait_event(wka_port->closed,
++ wka_port->status == ZFCP_FC_WKA_PORT_OFFLINE);
+ out:
+ mutex_unlock(&wka_port->mutex);
+ }
+@@ -193,13 +202,15 @@ static void zfcp_fc_wka_port_put(struct zfcp_fc_wka_port *wka_port)
+ if (atomic_dec_return(&wka_port->refcount) != 0)
+ return;
+ /* wait 10 milliseconds, other reqs might pop in */
+- schedule_delayed_work(&wka_port->work, HZ / 100);
++ queue_delayed_work(wka_port->adapter->work_queue, &wka_port->work,
++ msecs_to_jiffies(10));
+ }
+
+ static void zfcp_fc_wka_port_init(struct zfcp_fc_wka_port *wka_port, u32 d_id,
+ struct zfcp_adapter *adapter)
+ {
+- init_waitqueue_head(&wka_port->completion_wq);
++ init_waitqueue_head(&wka_port->opened);
++ init_waitqueue_head(&wka_port->closed);
+
+ wka_port->adapter = adapter;
+ wka_port->d_id = d_id;
+diff --git a/drivers/s390/scsi/zfcp_fc.h b/drivers/s390/scsi/zfcp_fc.h
+index 3cd74729cfb98..9bfce7ff65952 100644
+--- a/drivers/s390/scsi/zfcp_fc.h
++++ b/drivers/s390/scsi/zfcp_fc.h
+@@ -170,7 +170,8 @@ enum zfcp_fc_wka_status {
+ /**
+ * struct zfcp_fc_wka_port - representation of well-known-address (WKA) FC port
+ * @adapter: Pointer to adapter structure this WKA port belongs to
+- * @completion_wq: Wait for completion of open/close command
++ * @opened: Wait for completion of open command
++ * @closed: Wait for completion of close command
+ * @status: Current status of WKA port
+ * @refcount: Reference count to keep port open as long as it is in use
+ * @d_id: FC destination id or well-known-address
+@@ -180,7 +181,8 @@ enum zfcp_fc_wka_status {
+ */
+ struct zfcp_fc_wka_port {
+ struct zfcp_adapter *adapter;
+- wait_queue_head_t completion_wq;
++ wait_queue_head_t opened;
++ wait_queue_head_t closed;
+ enum zfcp_fc_wka_status status;
+ atomic_t refcount;
+ u32 d_id;
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index 5bb278a604ed2..eae9804f695df 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -1592,7 +1592,7 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
+ wka_port->status = ZFCP_FC_WKA_PORT_ONLINE;
+ }
+ out:
+- wake_up(&wka_port->completion_wq);
++ wake_up(&wka_port->opened);
+ }
+
+ /**
+@@ -1650,7 +1650,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req)
+ }
+
+ wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE;
+- wake_up(&wka_port->completion_wq);
++ wake_up(&wka_port->closed);
+ }
+
+ /**
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 6bb45ae19d587..339582690482a 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -195,7 +195,7 @@ static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size);
+ static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp);
+ static Sg_fd *sg_add_sfp(Sg_device * sdp);
+ static void sg_remove_sfp(struct kref *);
+-static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id);
++static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy);
+ static Sg_request *sg_add_request(Sg_fd * sfp);
+ static int sg_remove_request(Sg_fd * sfp, Sg_request * srp);
+ static Sg_device *sg_get_dev(int dev);
+@@ -417,6 +417,7 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
+ Sg_fd *sfp;
+ Sg_request *srp;
+ int req_pack_id = -1;
++ bool busy;
+ sg_io_hdr_t *hp;
+ struct sg_header *old_hdr = NULL;
+ int retval = 0;
+@@ -464,25 +465,19 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
+ } else
+ req_pack_id = old_hdr->pack_id;
+ }
+- srp = sg_get_rq_mark(sfp, req_pack_id);
++ srp = sg_get_rq_mark(sfp, req_pack_id, &busy);
+ if (!srp) { /* now wait on packet to arrive */
+- if (atomic_read(&sdp->detaching)) {
+- retval = -ENODEV;
+- goto free_old_hdr;
+- }
+ if (filp->f_flags & O_NONBLOCK) {
+ retval = -EAGAIN;
+ goto free_old_hdr;
+ }
+ retval = wait_event_interruptible(sfp->read_wait,
+- (atomic_read(&sdp->detaching) ||
+- (srp = sg_get_rq_mark(sfp, req_pack_id))));
+- if (atomic_read(&sdp->detaching)) {
+- retval = -ENODEV;
+- goto free_old_hdr;
+- }
+- if (retval) {
+- /* -ERESTARTSYS as signal hit process */
++ ((srp = sg_get_rq_mark(sfp, req_pack_id, &busy)) ||
++ (!busy && atomic_read(&sdp->detaching))));
++ if (!srp) {
++ /* signal or detaching */
++ if (!retval)
++ retval = -ENODEV;
+ goto free_old_hdr;
+ }
+ }
+@@ -933,9 +928,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
+ if (result < 0)
+ return result;
+ result = wait_event_interruptible(sfp->read_wait,
+- (srp_done(sfp, srp) || atomic_read(&sdp->detaching)));
+- if (atomic_read(&sdp->detaching))
+- return -ENODEV;
++ srp_done(sfp, srp));
+ write_lock_irq(&sfp->rq_list_lock);
+ if (srp->done) {
+ srp->done = 2;
+@@ -2079,19 +2072,28 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp)
+ }
+
+ static Sg_request *
+-sg_get_rq_mark(Sg_fd * sfp, int pack_id)
++sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy)
+ {
+ Sg_request *resp;
+ unsigned long iflags;
+
++ *busy = false;
+ write_lock_irqsave(&sfp->rq_list_lock, iflags);
+ list_for_each_entry(resp, &sfp->rq_list, entry) {
+- /* look for requests that are ready + not SG_IO owned */
+- if ((1 == resp->done) && (!resp->sg_io_owned) &&
++ /* look for requests that are not SG_IO owned */
++ if ((!resp->sg_io_owned) &&
+ ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
+- resp->done = 2; /* guard against other readers */
+- write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+- return resp;
++ switch (resp->done) {
++ case 0: /* request active */
++ *busy = true;
++ break;
++ case 1: /* request done; response ready to return */
++ resp->done = 2; /* guard against other readers */
++ write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
++ return resp;
++ case 2: /* response already being returned */
++ break;
++ }
+ }
+ }
+ write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+@@ -2145,6 +2147,15 @@ sg_remove_request(Sg_fd * sfp, Sg_request * srp)
+ res = 1;
+ }
+ write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
++
++ /*
++ * If the device is detaching, wakeup any readers in case we just
++ * removed the last response, which would leave nothing for them to
++ * return other than -ENODEV.
++ */
++ if (unlikely(atomic_read(&sfp->parentdp->detaching)))
++ wake_up_interruptible_all(&sfp->read_wait);
++
+ return res;
+ }
+
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index 98f2d076f938f..b86cc0342ae3f 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -4638,10 +4638,10 @@ static int pqi_raid_submit_scsi_cmd_with_io_request(
+ }
+
+ switch (scmd->sc_data_direction) {
+- case DMA_TO_DEVICE:
++ case DMA_FROM_DEVICE:
+ request->data_direction = SOP_READ_FLAG;
+ break;
+- case DMA_FROM_DEVICE:
++ case DMA_TO_DEVICE:
+ request->data_direction = SOP_WRITE_FLAG;
+ break;
+ case DMA_NONE:
+diff --git a/drivers/soc/amlogic/meson-mx-socinfo.c b/drivers/soc/amlogic/meson-mx-socinfo.c
+index 78f0f1aeca578..92125dd65f338 100644
+--- a/drivers/soc/amlogic/meson-mx-socinfo.c
++++ b/drivers/soc/amlogic/meson-mx-socinfo.c
+@@ -126,6 +126,7 @@ static int __init meson_mx_socinfo_init(void)
+ np = of_find_matching_node(NULL, meson_mx_socinfo_analog_top_ids);
+ if (np) {
+ analog_top_regmap = syscon_node_to_regmap(np);
++ of_node_put(np);
+ if (IS_ERR(analog_top_regmap))
+ return PTR_ERR(analog_top_regmap);
+
+diff --git a/drivers/soc/fsl/guts.c b/drivers/soc/fsl/guts.c
+index 302e0c8d69d93..6693c32e74478 100644
+--- a/drivers/soc/fsl/guts.c
++++ b/drivers/soc/fsl/guts.c
+@@ -136,7 +136,7 @@ static int fsl_guts_probe(struct platform_device *pdev)
+ struct device *dev = &pdev->dev;
+ struct resource *res;
+ const struct fsl_soc_die_attr *soc_die;
+- const char *machine;
++ const char *machine = NULL;
+ u32 svr;
+
+ /* Initialize guts */
+diff --git a/drivers/soundwire/bus_type.c b/drivers/soundwire/bus_type.c
+index 283b2832728ee..414621f3c43cd 100644
+--- a/drivers/soundwire/bus_type.c
++++ b/drivers/soundwire/bus_type.c
+@@ -154,12 +154,8 @@ int __sdw_register_driver(struct sdw_driver *drv, struct module *owner)
+
+ drv->driver.owner = owner;
+ drv->driver.probe = sdw_drv_probe;
+-
+- if (drv->remove)
+- drv->driver.remove = sdw_drv_remove;
+-
+- if (drv->shutdown)
+- drv->driver.shutdown = sdw_drv_shutdown;
++ drv->driver.remove = sdw_drv_remove;
++ drv->driver.shutdown = sdw_drv_shutdown;
+
+ return driver_register(&drv->driver);
+ }
+diff --git a/drivers/staging/rtl8192u/r8192U.h b/drivers/staging/rtl8192u/r8192U.h
+index 94a1489940697..2c3b333041731 100644
+--- a/drivers/staging/rtl8192u/r8192U.h
++++ b/drivers/staging/rtl8192u/r8192U.h
+@@ -1000,7 +1000,7 @@ typedef struct r8192_priv {
+ bool bis_any_nonbepkts;
+ bool bcurrent_turbo_EDCA;
+ bool bis_cur_rdlstate;
+- struct timer_list fsync_timer;
++ struct delayed_work fsync_work;
+ bool bfsync_processing; /* 500ms Fsync timer is active or not */
+ u32 rate_record;
+ u32 rateCountDiffRecord;
+diff --git a/drivers/staging/rtl8192u/r8192U_dm.c b/drivers/staging/rtl8192u/r8192U_dm.c
+index 5fb5f583f7038..c24a291895451 100644
+--- a/drivers/staging/rtl8192u/r8192U_dm.c
++++ b/drivers/staging/rtl8192u/r8192U_dm.c
+@@ -2627,19 +2627,20 @@ static void dm_init_fsync(struct net_device *dev)
+ priv->ieee80211->fsync_seconddiff_ratethreshold = 200;
+ priv->ieee80211->fsync_state = Default_Fsync;
+ priv->framesyncMonitor = 1; /* current default 0xc38 monitor on */
+- timer_setup(&priv->fsync_timer, dm_fsync_timer_callback, 0);
++ INIT_DELAYED_WORK(&priv->fsync_work, dm_fsync_work_callback);
+ }
+
+ static void dm_deInit_fsync(struct net_device *dev)
+ {
+ struct r8192_priv *priv = ieee80211_priv(dev);
+
+- del_timer_sync(&priv->fsync_timer);
++ cancel_delayed_work_sync(&priv->fsync_work);
+ }
+
+-void dm_fsync_timer_callback(struct timer_list *t)
++void dm_fsync_work_callback(struct work_struct *work)
+ {
+- struct r8192_priv *priv = from_timer(priv, t, fsync_timer);
++ struct r8192_priv *priv =
++ container_of(work, struct r8192_priv, fsync_work.work);
+ struct net_device *dev = priv->ieee80211->dev;
+ u32 rate_index, rate_count = 0, rate_count_diff = 0;
+ bool bSwitchFromCountDiff = false;
+@@ -2706,17 +2707,16 @@ void dm_fsync_timer_callback(struct timer_list *t)
+ }
+ }
+ if (bDoubleTimeInterval) {
+- if (timer_pending(&priv->fsync_timer))
+- del_timer_sync(&priv->fsync_timer);
+- priv->fsync_timer.expires = jiffies +
+- msecs_to_jiffies(priv->ieee80211->fsync_time_interval*priv->ieee80211->fsync_multiple_timeinterval);
+- add_timer(&priv->fsync_timer);
++ cancel_delayed_work_sync(&priv->fsync_work);
++ schedule_delayed_work(&priv->fsync_work,
++ msecs_to_jiffies(priv
++ ->ieee80211->fsync_time_interval *
++ priv->ieee80211->fsync_multiple_timeinterval));
+ } else {
+- if (timer_pending(&priv->fsync_timer))
+- del_timer_sync(&priv->fsync_timer);
+- priv->fsync_timer.expires = jiffies +
+- msecs_to_jiffies(priv->ieee80211->fsync_time_interval);
+- add_timer(&priv->fsync_timer);
++ cancel_delayed_work_sync(&priv->fsync_work);
++ schedule_delayed_work(&priv->fsync_work,
++ msecs_to_jiffies(priv
++ ->ieee80211->fsync_time_interval));
+ }
+ } else {
+ /* Let Register return to default value; */
+@@ -2744,7 +2744,7 @@ static void dm_EndSWFsync(struct net_device *dev)
+ struct r8192_priv *priv = ieee80211_priv(dev);
+
+ RT_TRACE(COMP_HALDM, "%s\n", __func__);
+- del_timer_sync(&(priv->fsync_timer));
++ cancel_delayed_work_sync(&priv->fsync_work);
+
+ /* Let Register return to default value; */
+ if (priv->bswitch_fsync) {
+@@ -2786,11 +2786,9 @@ static void dm_StartSWFsync(struct net_device *dev)
+ if (priv->ieee80211->fsync_rate_bitmap & rateBitmap)
+ priv->rate_record += priv->stats.received_rate_histogram[1][rateIndex];
+ }
+- if (timer_pending(&priv->fsync_timer))
+- del_timer_sync(&priv->fsync_timer);
+- priv->fsync_timer.expires = jiffies +
+- msecs_to_jiffies(priv->ieee80211->fsync_time_interval);
+- add_timer(&priv->fsync_timer);
++ cancel_delayed_work_sync(&priv->fsync_work);
++ schedule_delayed_work(&priv->fsync_work,
++ msecs_to_jiffies(priv->ieee80211->fsync_time_interval));
+
+ write_nic_dword(dev, rOFDM0_RxDetector2, 0x465c12cd);
+
+diff --git a/drivers/staging/rtl8192u/r8192U_dm.h b/drivers/staging/rtl8192u/r8192U_dm.h
+index 0de0332906bd3..eeb03130de150 100644
+--- a/drivers/staging/rtl8192u/r8192U_dm.h
++++ b/drivers/staging/rtl8192u/r8192U_dm.h
+@@ -167,7 +167,7 @@ void dm_force_tx_fw_info(struct net_device *dev,
+ void dm_init_edca_turbo(struct net_device *dev);
+ void dm_rf_operation_test_callback(unsigned long data);
+ void dm_rf_pathcheck_workitemcallback(struct work_struct *work);
+-void dm_fsync_timer_callback(struct timer_list *t);
++void dm_fsync_work_callback(struct work_struct *work);
+ void dm_cck_txpower_adjust(struct net_device *dev, bool binch14);
+ void dm_shadow_init(struct net_device *dev);
+ void dm_initialize_txpower_tracking(struct net_device *dev);
+diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
+index d42fc2ae8592e..e568cb4b2ffcf 100644
+--- a/drivers/tee/tee_core.c
++++ b/drivers/tee/tee_core.c
+@@ -175,6 +175,10 @@ tee_ioctl_shm_register(struct tee_context *ctx,
+ if (data.flags)
+ return -EINVAL;
+
++ if (!access_ok(VERIFY_WRITE, (void __user *)(unsigned long)data.addr,
++ data.length))
++ return -EFAULT;
++
+ shm = tee_shm_register(ctx, data.addr, data.length,
+ TEE_SHM_DMA_BUF | TEE_SHM_USER_MAPPED);
+ if (IS_ERR(shm))
+diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c
+index 4dce4a8f71ed9..17b2361bc8f21 100644
+--- a/drivers/thermal/thermal_sysfs.c
++++ b/drivers/thermal/thermal_sysfs.c
+@@ -909,12 +909,13 @@ static const struct attribute_group cooling_device_stats_attr_group = {
+
+ static void cooling_device_stats_setup(struct thermal_cooling_device *cdev)
+ {
++ const struct attribute_group *stats_attr_group = NULL;
+ struct cooling_dev_stats *stats;
+ unsigned long states;
+ int var;
+
+ if (cdev->ops->get_max_state(cdev, &states))
+- return;
++ goto out;
+
+ states++; /* Total number of states is highest state + 1 */
+
+@@ -924,7 +925,7 @@ static void cooling_device_stats_setup(struct thermal_cooling_device *cdev)
+
+ stats = kzalloc(var, GFP_KERNEL);
+ if (!stats)
+- return;
++ goto out;
+
+ stats->time_in_state = (ktime_t *)(stats + 1);
+ stats->trans_table = (unsigned int *)(stats->time_in_state + states);
+@@ -934,9 +935,12 @@ static void cooling_device_stats_setup(struct thermal_cooling_device *cdev)
+
+ spin_lock_init(&stats->lock);
+
++ stats_attr_group = &cooling_device_stats_attr_group;
++
++out:
+ /* Fill the empty slot left in cooling_device_attr_groups */
+ var = ARRAY_SIZE(cooling_device_attr_groups) - 2;
+- cooling_device_attr_groups[var] = &cooling_device_stats_attr_group;
++ cooling_device_attr_groups[var] = stats_attr_group;
+ }
+
+ static void cooling_device_stats_destroy(struct thermal_cooling_device *cdev)
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 5d2bb4d95186f..f6d2be13b32ee 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -410,6 +410,27 @@ static int gsm_read_ea(unsigned int *val, u8 c)
+ return c & EA;
+ }
+
++/**
++ * gsm_read_ea_val - read a value until EA
++ * @val: variable holding value
++ * @data: buffer of data
++ * @dlen: length of data
++ *
++ * Processes an EA value. Updates the passed variable and
++ * returns the processed data length.
++ */
++static unsigned int gsm_read_ea_val(unsigned int *val, const u8 *data, int dlen)
++{
++ unsigned int len = 0;
++
++ for (; dlen > 0; dlen--) {
++ len++;
++ if (gsm_read_ea(val, *data++))
++ break;
++ }
++ return len;
++}
++
+ /**
+ * gsm_encode_modem - encode modem data bits
+ * @dlci: DLCI to encode from
+@@ -657,6 +678,37 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len,
+ return m;
+ }
+
++/**
++ * gsm_is_flow_ctrl_msg - checks if flow control message
++ * @msg: message to check
++ *
++ * Returns true if the given message is a flow control command of the
++ * control channel. False is returned in any other case.
++ */
++static bool gsm_is_flow_ctrl_msg(struct gsm_msg *msg)
++{
++ unsigned int cmd;
++
++ if (msg->addr > 0)
++ return false;
++
++ switch (msg->ctrl & ~PF) {
++ case UI:
++ case UIH:
++ cmd = 0;
++ if (gsm_read_ea_val(&cmd, msg->data + 2, msg->len - 2) < 1)
++ break;
++ switch (cmd & ~PF) {
++ case CMD_FCOFF:
++ case CMD_FCON:
++ return true;
++ }
++ break;
++ }
++
++ return false;
++}
++
+ /**
+ * gsm_data_kick - poke the queue
+ * @gsm: GSM Mux
+@@ -675,7 +727,7 @@ static void gsm_data_kick(struct gsm_mux *gsm, struct gsm_dlci *dlci)
+ int len;
+
+ list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) {
+- if (gsm->constipated && msg->addr)
++ if (gsm->constipated && !gsm_is_flow_ctrl_msg(msg))
+ continue;
+ if (gsm->encoding != 0) {
+ gsm->txframe[0] = GSM1_SOF;
+@@ -1330,7 +1382,7 @@ static void gsm_control_retransmit(struct timer_list *t)
+ spin_lock_irqsave(&gsm->control_lock, flags);
+ ctrl = gsm->pending_cmd;
+ if (ctrl) {
+- if (gsm->cretries == 0) {
++ if (gsm->cretries == 0 || !gsm->dlci[0] || gsm->dlci[0]->dead) {
+ gsm->pending_cmd = NULL;
+ ctrl->error = -ETIMEDOUT;
+ ctrl->done = 1;
+@@ -1482,8 +1534,8 @@ static void gsm_dlci_t1(struct timer_list *t)
+
+ switch (dlci->state) {
+ case DLCI_OPENING:
+- dlci->retries--;
+ if (dlci->retries) {
++ dlci->retries--;
+ gsm_command(dlci->gsm, dlci->addr, SABM|PF);
+ mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100);
+ } else if (!dlci->addr && gsm->control == (DM | PF)) {
+@@ -1498,8 +1550,8 @@ static void gsm_dlci_t1(struct timer_list *t)
+
+ break;
+ case DLCI_CLOSING:
+- dlci->retries--;
+ if (dlci->retries) {
++ dlci->retries--;
+ gsm_command(dlci->gsm, dlci->addr, DISC|PF);
+ mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100);
+ } else
+@@ -1840,7 +1892,7 @@ static void gsm_queue(struct gsm_mux *gsm)
+ goto invalid;
+ #endif
+ if (dlci == NULL || dlci->state != DLCI_OPEN) {
+- gsm_command(gsm, address, DM|PF);
++ gsm_response(gsm, address, DM|PF);
+ return;
+ }
+ dlci->data(dlci, gsm->buf, gsm->len);
+@@ -2467,11 +2519,24 @@ static ssize_t gsmld_read(struct tty_struct *tty, struct file *file,
+ static ssize_t gsmld_write(struct tty_struct *tty, struct file *file,
+ const unsigned char *buf, size_t nr)
+ {
+- int space = tty_write_room(tty);
++ struct gsm_mux *gsm = tty->disc_data;
++ unsigned long flags;
++ int space;
++ int ret;
++
++ if (!gsm)
++ return -ENODEV;
++
++ ret = -ENOBUFS;
++ spin_lock_irqsave(&gsm->tx_lock, flags);
++ space = tty_write_room(tty);
+ if (space >= nr)
+- return tty->ops->write(tty, buf, nr);
+- set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+- return -ENOBUFS;
++ ret = tty->ops->write(tty, buf, nr);
++ else
++ set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
++ spin_unlock_irqrestore(&gsm->tx_lock, flags);
++
++ return ret;
+ }
+
+ /**
+@@ -2496,12 +2561,15 @@ static __poll_t gsmld_poll(struct tty_struct *tty, struct file *file,
+
+ poll_wait(file, &tty->read_wait, wait);
+ poll_wait(file, &tty->write_wait, wait);
++
++ if (gsm->dead)
++ mask |= EPOLLHUP;
+ if (tty_hung_up_p(file))
+ mask |= EPOLLHUP;
++ if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
++ mask |= EPOLLHUP;
+ if (!tty_is_writelocked(tty) && tty_write_room(tty) > 0)
+ mask |= EPOLLOUT | EPOLLWRNORM;
+- if (gsm->dead)
+- mask |= EPOLLHUP;
+ return mask;
+ }
+
+diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
+index c73d0eddd9b8d..cc9d1f416db84 100644
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -140,12 +140,15 @@ static void dw8250_check_lcr(struct uart_port *p, int value)
+ /* Returns once the transmitter is empty or we run out of retries */
+ static void dw8250_tx_wait_empty(struct uart_port *p)
+ {
++ struct uart_8250_port *up = up_to_u8250p(p);
+ unsigned int tries = 20000;
+ unsigned int delay_threshold = tries - 1000;
+ unsigned int lsr;
+
+ while (tries--) {
+ lsr = readb (p->membase + (UART_LSR << p->regshift));
++ up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
++
+ if (lsr & UART_LSR_TEMT)
+ break;
+
+diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
+index 6449c156c4d67..70f74ebc25dc3 100644
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -237,6 +237,7 @@ static void mvebu_uart_rx_chars(struct uart_port *port, unsigned int status)
+ struct tty_port *tport = &port->state->port;
+ unsigned char ch = 0;
+ char flag = 0;
++ int ret;
+
+ do {
+ if (status & STAT_RX_RDY(port)) {
+@@ -249,6 +250,16 @@ static void mvebu_uart_rx_chars(struct uart_port *port, unsigned int status)
+ port->icount.parity++;
+ }
+
++ /*
++ * For UART2, error bits are not cleared on buffer read.
++ * This causes interrupt loop and system hang.
++ */
++ if (IS_EXTENDED(port) && (status & STAT_BRK_ERR)) {
++ ret = readl(port->membase + UART_STAT);
++ ret |= STAT_BRK_ERR;
++ writel(ret, port->membase + UART_STAT);
++ }
++
+ if (status & STAT_BRK_DET) {
+ port->icount.brk++;
+ status &= ~(STAT_FRM_ERR | STAT_PAR_ERR);
+diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c
+index 2b6376e6e5ad4..eb0d3f55235ad 100644
+--- a/drivers/tty/serial/ucc_uart.c
++++ b/drivers/tty/serial/ucc_uart.c
+@@ -1141,6 +1141,8 @@ static unsigned int soc_info(unsigned int *rev_h, unsigned int *rev_l)
+ /* No compatible property, so try the name. */
+ soc_string = np->name;
+
++ of_node_put(np);
++
+ /* Extract the SOC number from the "PowerPC," string */
+ if ((sscanf(soc_string, "PowerPC,%u", &soc) != 1) || !soc)
+ return 0;
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 20565603a3658..198bf54568cc4 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -351,7 +351,7 @@ static struct uni_screen *vc_uniscr_alloc(unsigned int cols, unsigned int rows)
+ /* allocate everything in one go */
+ memsize = cols * rows * sizeof(char32_t);
+ memsize += rows * sizeof(char32_t *);
+- p = vmalloc(memsize);
++ p = vzalloc(memsize);
+ if (!p)
+ return NULL;
+
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index df661460e9f96..59d5d506d73c4 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1805,7 +1805,6 @@ static void usb_giveback_urb_bh(unsigned long param)
+
+ spin_lock_irq(&bh->lock);
+ bh->running = true;
+- restart:
+ list_replace_init(&bh->head, &local_list);
+ spin_unlock_irq(&bh->lock);
+
+@@ -1819,10 +1818,17 @@ static void usb_giveback_urb_bh(unsigned long param)
+ bh->completing_ep = NULL;
+ }
+
+- /* check if there are new URBs to giveback */
++ /*
++ * giveback new URBs next time to prevent this function
++ * from not exiting for a long time.
++ */
+ spin_lock_irq(&bh->lock);
+- if (!list_empty(&bh->head))
+- goto restart;
++ if (!list_empty(&bh->head)) {
++ if (bh->high_prio)
++ tasklet_hi_schedule(&bh->bh);
++ else
++ tasklet_schedule(&bh->bh);
++ }
+ bh->running = false;
+ spin_unlock_irq(&bh->lock);
+ }
+@@ -1847,7 +1853,7 @@ static void usb_giveback_urb_bh(unsigned long param)
+ void usb_hcd_giveback_urb(struct usb_hcd *hcd, struct urb *urb, int status)
+ {
+ struct giveback_urb_bh *bh;
+- bool running, high_prio_bh;
++ bool running;
+
+ /* pass status to tasklet via unlinked */
+ if (likely(!urb->unlinked))
+@@ -1858,13 +1864,10 @@ void usb_hcd_giveback_urb(struct usb_hcd *hcd, struct urb *urb, int status)
+ return;
+ }
+
+- if (usb_pipeisoc(urb->pipe) || usb_pipeint(urb->pipe)) {
++ if (usb_pipeisoc(urb->pipe) || usb_pipeint(urb->pipe))
+ bh = &hcd->high_prio_bh;
+- high_prio_bh = true;
+- } else {
++ else
+ bh = &hcd->low_prio_bh;
+- high_prio_bh = false;
+- }
+
+ spin_lock(&bh->lock);
+ list_add_tail(&urb->urb_list, &bh->head);
+@@ -1873,7 +1876,7 @@ void usb_hcd_giveback_urb(struct usb_hcd *hcd, struct urb *urb, int status)
+
+ if (running)
+ ;
+- else if (high_prio_bh)
++ else if (bh->high_prio)
+ tasklet_hi_schedule(&bh->bh);
+ else
+ tasklet_schedule(&bh->bh);
+@@ -2881,6 +2884,7 @@ int usb_add_hcd(struct usb_hcd *hcd,
+
+ /* initialize tasklets */
+ init_giveback_urb_bh(&hcd->high_prio_bh);
++ hcd->high_prio_bh.high_prio = true;
+ init_giveback_urb_bh(&hcd->low_prio_bh);
+
+ /* enable irqs just before we start the controller,
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index 3ebcbd199a791..b0a2b8805f41d 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -361,6 +361,7 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len)
+ spin_unlock_irq (&epdata->dev->lock);
+
+ DBG (epdata->dev, "endpoint gone\n");
++ wait_for_completion(&done);
+ epdata->status = -ENODEV;
+ }
+ }
+diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
+index d83d93c6ef9e2..33b5648b2819b 100644
+--- a/drivers/usb/gadget/udc/Kconfig
++++ b/drivers/usb/gadget/udc/Kconfig
+@@ -309,7 +309,7 @@ source "drivers/usb/gadget/udc/bdc/Kconfig"
+
+ config USB_AMD5536UDC
+ tristate "AMD5536 UDC"
+- depends on USB_PCI
++ depends on USB_PCI && HAS_DMA
+ select USB_SNP_CORE
+ help
+ The AMD5536 UDC is part of the AMD Geode CS5536, an x86 southbridge.
+diff --git a/drivers/usb/host/ehci-ppc-of.c b/drivers/usb/host/ehci-ppc-of.c
+index 576f7d79ad4ef..d1dc644b215c7 100644
+--- a/drivers/usb/host/ehci-ppc-of.c
++++ b/drivers/usb/host/ehci-ppc-of.c
+@@ -148,6 +148,7 @@ static int ehci_hcd_ppc_of_probe(struct platform_device *op)
+ } else {
+ ehci->has_amcc_usb23 = 1;
+ }
++ of_node_put(np);
+ }
+
+ if (of_get_property(dn, "big-endian", NULL)) {
+diff --git a/drivers/usb/host/ohci-nxp.c b/drivers/usb/host/ohci-nxp.c
+index f5f532601092a..a964a93ff35b5 100644
+--- a/drivers/usb/host/ohci-nxp.c
++++ b/drivers/usb/host/ohci-nxp.c
+@@ -153,6 +153,7 @@ static int ohci_hcd_nxp_probe(struct platform_device *pdev)
+ }
+
+ isp1301_i2c_client = isp1301_get_client(isp1301_node);
++ of_node_put(isp1301_node);
+ if (!isp1301_i2c_client)
+ return -EPROBE_DEFER;
+
+diff --git a/drivers/usb/host/ohci-ppc-of.c b/drivers/usb/host/ohci-ppc-of.c
+index 76a9b40b08f15..96c5c7655283d 100644
+--- a/drivers/usb/host/ohci-ppc-of.c
++++ b/drivers/usb/host/ohci-ppc-of.c
+@@ -169,6 +169,7 @@ static int ohci_hcd_ppc_of_probe(struct platform_device *op)
+ release_mem_region(res.start, 0x4);
+ } else
+ pr_debug("%s: cannot get ehci offset from fdt\n", __FILE__);
++ of_node_put(np);
+ }
+
+ irq_dispose_mapping(irq);
+diff --git a/drivers/usb/renesas_usbhs/rza.c b/drivers/usb/renesas_usbhs/rza.c
+index 5b287257ec11c..04eeaf6a028a4 100644
+--- a/drivers/usb/renesas_usbhs/rza.c
++++ b/drivers/usb/renesas_usbhs/rza.c
+@@ -23,6 +23,10 @@ static int usbhs_rza1_hardware_init(struct platform_device *pdev)
+ extal_clk = of_find_node_by_name(NULL, "extal");
+ of_property_read_u32(usb_x1_clk, "clock-frequency", &freq_usb);
+ of_property_read_u32(extal_clk, "clock-frequency", &freq_extal);
++
++ of_node_put(usb_x1_clk);
++ of_node_put(extal_clk);
++
+ if (freq_usb == 0) {
+ if (freq_extal == 12000000) {
+ /* Select 12MHz XTAL */
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index a43263a0edd88..891e52bc5002c 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -757,7 +757,8 @@ static void sierra_close(struct usb_serial_port *port)
+
+ /*
+ * Need to take susp_lock to make sure port is not already being
+- * resumed, but no need to hold it due to initialized
++ * resumed, but no need to hold it due to the tty-port initialized
++ * flag.
+ */
+ spin_lock_irq(&intfdata->susp_lock);
+ if (--intfdata->open_ports == 0)
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index b1f0aa12ba39c..eb4f206511867 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -251,7 +251,7 @@ static int serial_open(struct tty_struct *tty, struct file *filp)
+ *
+ * Shut down a USB serial port. Serialized against activate by the
+ * tport mutex and kept to matching open/close pairs
+- * of calls by the initialized flag.
++ * of calls by the tty-port initialized flag.
+ *
+ * Not called if tty is console.
+ */
+diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
+index 997ff88ec04b6..2ebf0842fa430 100644
+--- a/drivers/usb/serial/usb_wwan.c
++++ b/drivers/usb/serial/usb_wwan.c
+@@ -463,7 +463,8 @@ void usb_wwan_close(struct usb_serial_port *port)
+
+ /*
+ * Need to take susp_lock to make sure port is not already being
+- * resumed, but no need to hold it due to initialized
++ * resumed, but no need to hold it due to the tty-port initialized
++ * flag.
+ */
+ spin_lock_irq(&intfdata->susp_lock);
+ if (--intfdata->open_ports == 0)
+diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
+index 7a386fb30bf1f..0d146b45e0b4e 100644
+--- a/drivers/vfio/vfio.c
++++ b/drivers/vfio/vfio.c
+@@ -1808,6 +1808,7 @@ struct vfio_info_cap_header *vfio_info_cap_add(struct vfio_info_cap *caps,
+ buf = krealloc(caps->buf, caps->size + size, GFP_KERNEL);
+ if (!buf) {
+ kfree(caps->buf);
++ caps->buf = NULL;
+ caps->size = 0;
+ return ERR_PTR(-ENOMEM);
+ }
+diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c
+index 549f78e77255c..81f64ef6fa4c2 100644
+--- a/drivers/video/fbdev/amba-clcd.c
++++ b/drivers/video/fbdev/amba-clcd.c
+@@ -772,8 +772,10 @@ static int clcdfb_of_init_display(struct clcd_fb *fb)
+ return -ENODEV;
+
+ panel = of_graph_get_remote_port_parent(endpoint);
+- if (!panel)
+- return -ENODEV;
++ if (!panel) {
++ err = -ENODEV;
++ goto out_endpoint_put;
++ }
+
+ if (fb->vendor->init_panel) {
+ err = fb->vendor->init_panel(fb, panel);
+@@ -783,11 +785,11 @@ static int clcdfb_of_init_display(struct clcd_fb *fb)
+
+ err = clcdfb_of_get_backlight(panel, fb->panel);
+ if (err)
+- return err;
++ goto out_panel_put;
+
+ err = clcdfb_of_get_mode(&fb->dev->dev, panel, fb->panel);
+ if (err)
+- return err;
++ goto out_panel_put;
+
+ err = of_property_read_u32(fb->dev->dev.of_node, "max-memory-bandwidth",
+ &max_bandwidth);
+@@ -816,11 +818,21 @@ static int clcdfb_of_init_display(struct clcd_fb *fb)
+
+ if (of_property_read_u32_array(endpoint,
+ "arm,pl11x,tft-r0g0b0-pads",
+- tft_r0b0g0, ARRAY_SIZE(tft_r0b0g0)) != 0)
+- return -ENOENT;
++ tft_r0b0g0, ARRAY_SIZE(tft_r0b0g0)) != 0) {
++ err = -ENOENT;
++ goto out_panel_put;
++ }
++
++ of_node_put(panel);
++ of_node_put(endpoint);
+
+ return clcdfb_of_init_tft_panel(fb, tft_r0b0g0[0],
+ tft_r0b0g0[1], tft_r0b0g0[2]);
++out_panel_put:
++ of_node_put(panel);
++out_endpoint_put:
++ of_node_put(endpoint);
++ return err;
+ }
+
+ static int clcdfb_of_vram_setup(struct clcd_fb *fb)
+diff --git a/drivers/video/fbdev/arkfb.c b/drivers/video/fbdev/arkfb.c
+index 13ba371e70aa3..f7920987dd248 100644
+--- a/drivers/video/fbdev/arkfb.c
++++ b/drivers/video/fbdev/arkfb.c
+@@ -778,7 +778,12 @@ static int arkfb_set_par(struct fb_info *info)
+ return -EINVAL;
+ }
+
+- ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul);
++ value = (hdiv * info->var.pixclock) / hmul;
++ if (!value) {
++ fb_dbg(info, "invalid pixclock\n");
++ value = 1;
++ }
++ ark_set_pixclock(info, value);
+ svga_set_timings(par->state.vgabase, &ark_timing_regs, &(info->var), hmul, hdiv,
+ (info->var.vmode & FB_VMODE_DOUBLE) ? 2 : 1,
+ (info->var.vmode & FB_VMODE_INTERLACED) ? 2 : 1,
+@@ -789,6 +794,8 @@ static int arkfb_set_par(struct fb_info *info)
+ value = ((value * hmul / hdiv) / 8) - 5;
+ vga_wcrt(par->state.vgabase, 0x42, (value + 1) / 2);
+
++ if (screen_size > info->screen_size)
++ screen_size = info->screen_size;
+ memset_io(info->screen_base, 0x00, screen_size);
+ /* Device and screen back on */
+ svga_wcrt_mask(par->state.vgabase, 0x17, 0x80, 0x80);
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 17ed20a73c2db..417f4bcc1182c 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -103,8 +103,8 @@ static int logo_lines;
+ enums. */
+ static int logo_shown = FBCON_LOGO_CANSHOW;
+ /* console mappings */
+-static int first_fb_vc;
+-static int last_fb_vc = MAX_NR_CONSOLES - 1;
++static unsigned int first_fb_vc;
++static unsigned int last_fb_vc = MAX_NR_CONSOLES - 1;
+ static int fbcon_is_default = 1;
+ static int fbcon_has_exited;
+ static int primary_device = -1;
+@@ -456,10 +456,12 @@ static int __init fb_console_setup(char *this_opt)
+ options += 3;
+ if (*options)
+ first_fb_vc = simple_strtoul(options, &options, 10) - 1;
+- if (first_fb_vc < 0)
++ if (first_fb_vc >= MAX_NR_CONSOLES)
+ first_fb_vc = 0;
+ if (*options++ == '-')
+ last_fb_vc = simple_strtoul(options, &options, 10) - 1;
++ if (last_fb_vc < first_fb_vc || last_fb_vc >= MAX_NR_CONSOLES)
++ last_fb_vc = MAX_NR_CONSOLES - 1;
+ fbcon_is_default = 0;
+ continue;
+ }
+diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c
+index f6d7b04d6dffa..bdbafff4529f7 100644
+--- a/drivers/video/fbdev/i740fb.c
++++ b/drivers/video/fbdev/i740fb.c
+@@ -399,7 +399,7 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var,
+ u32 xres, right, hslen, left, xtotal;
+ u32 yres, lower, vslen, upper, ytotal;
+ u32 vxres, xoffset, vyres, yoffset;
+- u32 bpp, base, dacspeed24, mem;
++ u32 bpp, base, dacspeed24, mem, freq;
+ u8 r7;
+ int i;
+
+@@ -642,7 +642,12 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var,
+ par->atc[VGA_ATC_OVERSCAN] = 0;
+
+ /* Calculate VCLK that most closely matches the requested dot clock */
+- i740_calc_vclk((((u32)1e9) / var->pixclock) * (u32)(1e3), par);
++ freq = (((u32)1e9) / var->pixclock) * (u32)(1e3);
++ if (freq < I740_RFREQ_FIX) {
++ fb_dbg(info, "invalid pixclock\n");
++ freq = I740_RFREQ_FIX;
++ }
++ i740_calc_vclk(freq, par);
+
+ /* Since we program the clocks ourselves, always use VCLK2. */
+ par->misc |= 0x0C;
+diff --git a/drivers/video/fbdev/s3fb.c b/drivers/video/fbdev/s3fb.c
+index d63f23e26f7d7..b17b806b41878 100644
+--- a/drivers/video/fbdev/s3fb.c
++++ b/drivers/video/fbdev/s3fb.c
+@@ -902,6 +902,8 @@ static int s3fb_set_par(struct fb_info *info)
+ value = clamp((htotal + hsstart + 1) / 2 + 2, hsstart + 4, htotal + 1);
+ svga_wcrt_multi(par->state.vgabase, s3_dtpc_regs, value);
+
++ if (screen_size > info->screen_size)
++ screen_size = info->screen_size;
+ memset_io(info->screen_base, 0x00, screen_size);
+ /* Device and screen back on */
+ svga_wcrt_mask(par->state.vgabase, 0x17, 0x80, 0x80);
+diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
+index fde27feae5d0c..d6b2ce95a8594 100644
+--- a/drivers/video/fbdev/sis/init.c
++++ b/drivers/video/fbdev/sis/init.c
+@@ -355,12 +355,12 @@ SiS_GetModeID(int VGAEngine, unsigned int VBFlags, int HDisplay, int VDisplay,
+ }
+ break;
+ case 400:
+- if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 800) && (LCDwidth >= 600))) {
++ if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 800) && (LCDheight >= 600))) {
+ if(VDisplay == 300) ModeIndex = ModeIndex_400x300[Depth];
+ }
+ break;
+ case 512:
+- if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 1024) && (LCDwidth >= 768))) {
++ if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 1024) && (LCDheight >= 768))) {
+ if(VDisplay == 384) ModeIndex = ModeIndex_512x384[Depth];
+ }
+ break;
+diff --git a/drivers/video/fbdev/vt8623fb.c b/drivers/video/fbdev/vt8623fb.c
+index 5cac871db3ee2..cbae9c5100927 100644
+--- a/drivers/video/fbdev/vt8623fb.c
++++ b/drivers/video/fbdev/vt8623fb.c
+@@ -504,6 +504,8 @@ static int vt8623fb_set_par(struct fb_info *info)
+ (info->var.vmode & FB_VMODE_DOUBLE) ? 2 : 1, 1,
+ 1, info->node);
+
++ if (screen_size > info->screen_size)
++ screen_size = info->screen_size;
+ memset_io(info->screen_base, 0x00, screen_size);
+
+ /* Device and screen back on */
+diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
+index 94e055ee7ad66..aa65b20883ef7 100644
+--- a/drivers/virt/vboxguest/vboxguest_linux.c
++++ b/drivers/virt/vboxguest/vboxguest_linux.c
+@@ -341,8 +341,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ goto err_vbg_core_exit;
+ }
+
+- ret = devm_request_irq(dev, pci->irq, vbg_core_isr, IRQF_SHARED,
+- DEVICE_NAME, gdev);
++ ret = request_irq(pci->irq, vbg_core_isr, IRQF_SHARED, DEVICE_NAME,
++ gdev);
+ if (ret) {
+ vbg_err("vboxguest: Error requesting irq: %d\n", ret);
+ goto err_vbg_core_exit;
+@@ -352,7 +352,7 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ if (ret) {
+ vbg_err("vboxguest: Error misc_register %s failed: %d\n",
+ DEVICE_NAME, ret);
+- goto err_vbg_core_exit;
++ goto err_free_irq;
+ }
+
+ ret = misc_register(&gdev->misc_device_user);
+@@ -388,6 +388,8 @@ err_unregister_misc_device_user:
+ misc_deregister(&gdev->misc_device_user);
+ err_unregister_misc_device:
+ misc_deregister(&gdev->misc_device);
++err_free_irq:
++ free_irq(pci->irq, gdev);
+ err_vbg_core_exit:
+ vbg_core_exit(gdev);
+ err_disable_pcidev:
+@@ -404,6 +406,7 @@ static void vbg_pci_remove(struct pci_dev *pci)
+ vbg_gdev = NULL;
+ mutex_unlock(&vbg_gdev_mutex);
+
++ free_irq(pci->irq, gdev);
+ device_remove_file(gdev->dev, &dev_attr_host_features);
+ device_remove_file(gdev->dev, &dev_attr_host_version);
+ misc_deregister(&gdev->misc_device_user);
+diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
+index 454c6826abdb4..1c1dadfd4e4d7 100644
+--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
+@@ -128,7 +128,7 @@ static ssize_t xenbus_file_read(struct file *filp,
+ {
+ struct xenbus_file_priv *u = filp->private_data;
+ struct read_buffer *rb;
+- unsigned i;
++ ssize_t i;
+ int ret;
+
+ mutex_lock(&u->reply_mutex);
+@@ -148,7 +148,7 @@ again:
+ rb = list_entry(u->read_buffers.next, struct read_buffer, list);
+ i = 0;
+ while (i < len) {
+- unsigned sz = min((unsigned)len - i, rb->len - rb->cons);
++ size_t sz = min_t(size_t, len - i, rb->len - rb->cons);
+
+ ret = copy_to_user(ubuf + i, &rb->msg[rb->cons], sz);
+
+diff --git a/fs/attr.c b/fs/attr.c
+index d22e8187477fa..4d2541c1e68c3 100644
+--- a/fs/attr.c
++++ b/fs/attr.c
+@@ -134,6 +134,8 @@ EXPORT_SYMBOL(setattr_prepare);
+ */
+ int inode_newsize_ok(const struct inode *inode, loff_t offset)
+ {
++ if (offset < 0)
++ return -EINVAL;
+ if (inode->i_size < offset) {
+ unsigned long limit;
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index c9fd018dcf764..98f87cc474332 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -2920,6 +2920,20 @@ int open_ctree(struct super_block *sb,
+ err = -EINVAL;
+ goto fail_alloc;
+ }
++ /*
++ * We have unsupported RO compat features, although RO mounted, we
++ * should not cause any metadata write, including log replay.
++ * Or we could screw up whatever the new feature requires.
++ */
++ if (unlikely(features && btrfs_super_log_root(disk_super) &&
++ !btrfs_test_opt(fs_info, NOLOGREPLAY))) {
++ btrfs_err(fs_info,
++"cannot replay dirty log with unsupported compat_ro features (0x%llx), try rescue=nologreplay",
++ features);
++ err = -EINVAL;
++ goto fail_alloc;
++ }
++
+
+ ret = btrfs_init_workqueues(fs_info, fs_devices);
+ if (ret) {
+diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
+index a91f74cf5cd18..0ce7ab8f875a4 100644
+--- a/fs/btrfs/raid56.c
++++ b/fs/btrfs/raid56.c
+@@ -318,6 +318,9 @@ static void merge_rbio(struct btrfs_raid_bio *dest,
+ {
+ bio_list_merge(&dest->bio_list, &victim->bio_list);
+ dest->bio_list_bytes += victim->bio_list_bytes;
++ /* Also inherit the bitmaps from @victim. */
++ bitmap_or(dest->dbitmap, victim->dbitmap, dest->dbitmap,
++ dest->stripe_npages);
+ dest->generic_bio_cnt += victim->generic_bio_cnt;
+ bio_list_init(&victim->bio_list);
+ }
+@@ -862,6 +865,12 @@ static void rbio_orig_end_io(struct btrfs_raid_bio *rbio, blk_status_t err)
+
+ if (rbio->generic_bio_cnt)
+ btrfs_bio_counter_sub(rbio->fs_info, rbio->generic_bio_cnt);
++ /*
++ * Clear the data bitmap, as the rbio may be cached for later usage.
++ * do this before before unlock_stripe() so there will be no new bio
++ * for this bio.
++ */
++ bitmap_clear(rbio->dbitmap, 0, rbio->stripe_npages);
+
+ /*
+ * At this moment, rbio->bio_list is empty, however since rbio does not
+@@ -1196,6 +1205,9 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
+ else
+ BUG();
+
++ /* We should have at least one data sector. */
++ ASSERT(bitmap_weight(rbio->dbitmap, rbio->stripe_npages));
++
+ /* at this point we either have a full stripe,
+ * or we've read the full stripe from the drive.
+ * recalculate the parity and write the new results.
+@@ -1269,6 +1281,11 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
+ for (stripe = 0; stripe < rbio->real_stripes; stripe++) {
+ for (pagenr = 0; pagenr < rbio->stripe_npages; pagenr++) {
+ struct page *page;
++
++ /* This vertical stripe has no data, skip it. */
++ if (!test_bit(pagenr, rbio->dbitmap))
++ continue;
++
+ if (stripe < rbio->nr_data) {
+ page = page_in_rbio(rbio, stripe, pagenr, 1);
+ if (!page)
+@@ -1293,6 +1310,11 @@ static noinline void finish_rmw(struct btrfs_raid_bio *rbio)
+
+ for (pagenr = 0; pagenr < rbio->stripe_npages; pagenr++) {
+ struct page *page;
++
++ /* This vertical stripe has no data, skip it. */
++ if (!test_bit(pagenr, rbio->dbitmap))
++ continue;
++
+ if (stripe < rbio->nr_data) {
+ page = page_in_rbio(rbio, stripe, pagenr, 1);
+ if (!page)
+@@ -1733,6 +1755,33 @@ static void btrfs_raid_unplug(struct blk_plug_cb *cb, bool from_schedule)
+ run_plug(plug);
+ }
+
++/* Add the original bio into rbio->bio_list, and update rbio::dbitmap. */
++static void rbio_add_bio(struct btrfs_raid_bio *rbio, struct bio *orig_bio)
++{
++ const struct btrfs_fs_info *fs_info = rbio->fs_info;
++ const u64 orig_logical = orig_bio->bi_iter.bi_sector << SECTOR_SHIFT;
++ const u64 full_stripe_start = rbio->bbio->raid_map[0];
++ const u32 orig_len = orig_bio->bi_iter.bi_size;
++ const u32 sectorsize = fs_info->sectorsize;
++ u64 cur_logical;
++
++ ASSERT(orig_logical >= full_stripe_start &&
++ orig_logical + orig_len <= full_stripe_start +
++ rbio->nr_data * rbio->stripe_len);
++
++ bio_list_add(&rbio->bio_list, orig_bio);
++ rbio->bio_list_bytes += orig_bio->bi_iter.bi_size;
++
++ /* Update the dbitmap. */
++ for (cur_logical = orig_logical; cur_logical < orig_logical + orig_len;
++ cur_logical += sectorsize) {
++ int bit = ((u32)(cur_logical - full_stripe_start) >>
++ PAGE_SHIFT) % rbio->stripe_npages;
++
++ set_bit(bit, rbio->dbitmap);
++ }
++}
++
+ /*
+ * our main entry point for writes from the rest of the FS.
+ */
+@@ -1749,9 +1798,8 @@ int raid56_parity_write(struct btrfs_fs_info *fs_info, struct bio *bio,
+ btrfs_put_bbio(bbio);
+ return PTR_ERR(rbio);
+ }
+- bio_list_add(&rbio->bio_list, bio);
+- rbio->bio_list_bytes = bio->bi_iter.bi_size;
+ rbio->operation = BTRFS_RBIO_WRITE;
++ rbio_add_bio(rbio, bio);
+
+ btrfs_bio_counter_inc_noblocked(fs_info);
+ rbio->generic_bio_cnt = 1;
+@@ -2053,9 +2101,12 @@ static int __raid56_parity_recover(struct btrfs_raid_bio *rbio)
+ atomic_set(&rbio->error, 0);
+
+ /*
+- * read everything that hasn't failed. Thanks to the
+- * stripe cache, it is possible that some or all of these
+- * pages are going to be uptodate.
++ * Read everything that hasn't failed. However this time we will
++ * not trust any cached sector.
++ * As we may read out some stale data but higher layer is not reading
++ * that stale part.
++ *
++ * So here we always re-read everything in recovery path.
+ */
+ for (stripe = 0; stripe < rbio->real_stripes; stripe++) {
+ if (rbio->faila == stripe || rbio->failb == stripe) {
+@@ -2064,16 +2115,6 @@ static int __raid56_parity_recover(struct btrfs_raid_bio *rbio)
+ }
+
+ for (pagenr = 0; pagenr < rbio->stripe_npages; pagenr++) {
+- struct page *p;
+-
+- /*
+- * the rmw code may have already read this
+- * page in
+- */
+- p = rbio_stripe_page(rbio, stripe, pagenr);
+- if (PageUptodate(p))
+- continue;
+-
+ ret = rbio_add_io_page(rbio, &bio_list,
+ rbio_stripe_page(rbio, stripe, pagenr),
+ stripe, pagenr, rbio->stripe_len);
+@@ -2155,8 +2196,7 @@ int raid56_parity_recover(struct btrfs_fs_info *fs_info, struct bio *bio,
+ }
+
+ rbio->operation = BTRFS_RBIO_READ_REBUILD;
+- bio_list_add(&rbio->bio_list, bio);
+- rbio->bio_list_bytes = bio->bi_iter.bi_size;
++ rbio_add_bio(rbio, bio);
+
+ rbio->faila = find_logical_bio_stripe(rbio, bio);
+ if (rbio->faila == -1) {
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index e00c50ea2eafd..0fe32c567ed74 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1081,7 +1081,9 @@ again:
+ extref = btrfs_lookup_inode_extref(NULL, root, path, name, namelen,
+ inode_objectid, parent_objectid, 0,
+ 0);
+- if (!IS_ERR_OR_NULL(extref)) {
++ if (IS_ERR(extref)) {
++ return PTR_ERR(extref);
++ } else if (extref) {
+ u32 item_size;
+ u32 cur_offset = 0;
+ unsigned long base;
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index cc34a28aecbcd..f906984eb25b0 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -762,9 +762,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ size_t name_len, value_len, user_name_len;
+
+ while (src_size > 0) {
+- name = &src->ea_data[0];
+ name_len = (size_t)src->ea_name_length;
+- value = &src->ea_data[src->ea_name_length + 1];
+ value_len = (size_t)le16_to_cpu(src->ea_value_length);
+
+ if (name_len == 0) {
+@@ -777,6 +775,9 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ goto out;
+ }
+
++ name = &src->ea_data[0];
++ value = &src->ea_data[src->ea_name_length + 1];
++
+ if (ea_name) {
+ if (ea_name_len == name_len &&
+ memcmp(ea_name, name, name_len) == 0) {
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index ad9fd08f66bab..44a1f356aca29 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -1088,9 +1088,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
+ sbi->s_frags_per_group);
+ goto failed_mount;
+ }
+- if (sbi->s_inodes_per_group > sb->s_blocksize * 8) {
++ if (sbi->s_inodes_per_group < sbi->s_inodes_per_block ||
++ sbi->s_inodes_per_group > sb->s_blocksize * 8) {
+ ext2_msg(sb, KERN_ERR,
+- "error: #inodes per group too big: %lu",
++ "error: invalid #inodes per group: %lu",
+ sbi->s_inodes_per_group);
+ goto failed_mount;
+ }
+@@ -1100,6 +1101,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
+ sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) -
+ le32_to_cpu(es->s_first_data_block) - 1)
+ / EXT2_BLOCKS_PER_GROUP(sb)) + 1;
++ if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group !=
++ le32_to_cpu(es->s_inodes_count)) {
++ ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu",
++ le32_to_cpu(es->s_inodes_count),
++ (u64)sbi->s_groups_count * sbi->s_inodes_per_group);
++ goto failed_mount;
++ }
+ db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) /
+ EXT2_DESC_PER_BLOCK(sb);
+ sbi->s_group_desc = kmalloc_array (db_count,
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index a2943382bf18b..b1c6b9398eef5 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -34,6 +34,9 @@ static int get_max_inline_xattr_value_size(struct inode *inode,
+ struct ext4_inode *raw_inode;
+ int free, min_offs;
+
++ if (!EXT4_INODE_HAS_XATTR_SPACE(inode))
++ return 0;
++
+ min_offs = EXT4_SB(inode->i_sb)->s_inode_size -
+ EXT4_GOOD_OLD_INODE_SIZE -
+ EXT4_I(inode)->i_extra_isize -
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 76c887108df35..34cee87a0ac7d 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1755,7 +1755,14 @@ static void mpage_release_unused_pages(struct mpage_da_data *mpd,
+ ext4_lblk_t start, last;
+ start = index << (PAGE_SHIFT - inode->i_blkbits);
+ last = end << (PAGE_SHIFT - inode->i_blkbits);
++
++ /*
++ * avoid racing with extent status tree scans made by
++ * ext4_insert_delayed_block()
++ */
++ down_write(&EXT4_I(inode)->i_data_sem);
+ ext4_es_remove_extent(inode, start, last - start + 1);
++ up_write(&EXT4_I(inode)->i_data_sem);
+ }
+
+ pagevec_init(&pvec);
+@@ -4837,8 +4844,7 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
+ __le32 *magic = (void *)raw_inode +
+ EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize;
+
+- if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32) <=
+- EXT4_INODE_SIZE(inode->i_sb) &&
++ if (EXT4_INODE_HAS_XATTR_SPACE(inode) &&
+ *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
+ ext4_set_inode_state(inode, EXT4_STATE_XATTR);
+ return ext4_find_inline_data_nolock(inode);
+diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
+index 9adfe217b39d2..37ce665ae1d29 100644
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -435,7 +435,7 @@ int ext4_ext_migrate(struct inode *inode)
+ struct inode *tmp_inode = NULL;
+ struct migrate_struct lb;
+ unsigned long max_entries;
+- __u32 goal;
++ __u32 goal, tmp_csum_seed;
+ uid_t owner[2];
+
+ /*
+@@ -483,6 +483,7 @@ int ext4_ext_migrate(struct inode *inode)
+ * the migration.
+ */
+ ei = EXT4_I(inode);
++ tmp_csum_seed = EXT4_I(tmp_inode)->i_csum_seed;
+ EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed;
+ i_size_write(tmp_inode, i_size_read(inode));
+ /*
+@@ -593,6 +594,7 @@ err_out:
+ * the inode is not visible to user space.
+ */
+ tmp_inode->i_blocks = 0;
++ EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed;
+
+ /* Reset the extent details */
+ ext4_ext_tree_init(handle, tmp_inode);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 5f85994191504..a878b9a8d9ead 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -53,6 +53,7 @@ static struct buffer_head *ext4_append(handle_t *handle,
+ struct inode *inode,
+ ext4_lblk_t *block)
+ {
++ struct ext4_map_blocks map;
+ struct buffer_head *bh;
+ int err;
+
+@@ -62,6 +63,21 @@ static struct buffer_head *ext4_append(handle_t *handle,
+ return ERR_PTR(-ENOSPC);
+
+ *block = inode->i_size >> inode->i_sb->s_blocksize_bits;
++ map.m_lblk = *block;
++ map.m_len = 1;
++
++ /*
++ * We're appending new directory block. Make sure the block is not
++ * allocated yet, otherwise we will end up corrupting the
++ * directory.
++ */
++ err = ext4_map_blocks(NULL, inode, &map, 0);
++ if (err < 0)
++ return ERR_PTR(err);
++ if (err) {
++ EXT4_ERROR_INODE(inode, "Logical block already allocated");
++ return ERR_PTR(-EFSCORRUPTED);
++ }
+
+ bh = ext4_bread(handle, inode, *block, EXT4_GET_BLOCKS_CREATE);
+ if (IS_ERR(bh))
+@@ -2826,11 +2842,8 @@ bool ext4_empty_dir(struct inode *inode)
+ de = (struct ext4_dir_entry_2 *) (bh->b_data +
+ (offset & (sb->s_blocksize - 1)));
+ if (ext4_check_dir_entry(inode, NULL, de, bh,
+- bh->b_data, bh->b_size, offset)) {
+- offset = (offset | (sb->s_blocksize - 1)) + 1;
+- continue;
+- }
+- if (le32_to_cpu(de->inode)) {
++ bh->b_data, bh->b_size, offset) ||
++ le32_to_cpu(de->inode)) {
+ brelse(bh);
+ return false;
+ }
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index d37493b39ab97..dd23c97ae951d 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1483,6 +1483,7 @@ static void ext4_update_super(struct super_block *sb,
+ * Update the fs overhead information
+ */
+ ext4_calculate_overhead(sb);
++ es->s_overhead_clusters = cpu_to_le32(sbi->s_overhead);
+
+ if (test_opt(sb, DEBUG))
+ printk(KERN_DEBUG "EXT4-fs: added group %u:"
+@@ -1980,6 +1981,16 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
+ }
+ brelse(bh);
+
++ /*
++ * For bigalloc, trim the requested size to the nearest cluster
++ * boundary to avoid creating an unusable filesystem. We do this
++ * silently, instead of returning an error, to avoid breaking
++ * callers that blindly resize the filesystem to the full size of
++ * the underlying block device.
++ */
++ if (ext4_has_feature_bigalloc(sb))
++ n_blocks_count &= ~((1 << EXT4_CLUSTER_BITS(sb)) - 1);
++
+ retry:
+ o_blocks_count = ext4_blocks_count(es);
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 0cd9b84bdd9db..497649c69bba7 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -2188,8 +2188,9 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i,
+ struct ext4_inode *raw_inode;
+ int error;
+
+- if (EXT4_I(inode)->i_extra_isize == 0)
++ if (!EXT4_INODE_HAS_XATTR_SPACE(inode))
+ return 0;
++
+ raw_inode = ext4_raw_inode(&is->iloc);
+ header = IHDR(inode, raw_inode);
+ is->s.base = is->s.first = IFIRST(header);
+@@ -2217,8 +2218,9 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode,
+ struct ext4_xattr_search *s = &is->s;
+ int error;
+
+- if (EXT4_I(inode)->i_extra_isize == 0)
++ if (!EXT4_INODE_HAS_XATTR_SPACE(inode))
+ return -ENOSPC;
++
+ error = ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */);
+ if (error)
+ return error;
+diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
+index f39cad2abe2a8..990084e00374f 100644
+--- a/fs/ext4/xattr.h
++++ b/fs/ext4/xattr.h
+@@ -95,6 +95,19 @@ struct ext4_xattr_entry {
+
+ #define EXT4_ZERO_XATTR_VALUE ((void *)-1)
+
++/*
++ * If we want to add an xattr to the inode, we should make sure that
++ * i_extra_isize is not 0 and that the inode size is not less than
++ * EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad.
++ * EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data
++ * |--------------------------|------------|------|---------|---|-------|
++ */
++#define EXT4_INODE_HAS_XATTR_SPACE(inode) \
++ ((EXT4_I(inode)->i_extra_isize != 0) && \
++ (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \
++ sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <= \
++ EXT4_INODE_SIZE((inode)->i_sb)))
++
+ struct ext4_xattr_info {
+ const char *name;
+ const void *value;
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index ff3f97ba1a555..2c28f488ac2f0 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1232,7 +1232,11 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs)
+ dec_valid_node_count(sbi, dn->inode, !ofs);
+ goto fail;
+ }
+- f2fs_bug_on(sbi, new_ni.blk_addr != NULL_ADDR);
++ if (unlikely(new_ni.blk_addr != NULL_ADDR)) {
++ err = -EFSCORRUPTED;
++ set_sbi_flag(sbi, SBI_NEED_FSCK);
++ goto fail;
++ }
+ #endif
+ new_ni.nid = dn->nid;
+ new_ni.ino = dn->inode->i_ino;
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 821597c618843..3b51c881baf8c 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -174,6 +174,12 @@ void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
+ inode->i_uid = make_kuid(fc->user_ns, attr->uid);
+ inode->i_gid = make_kgid(fc->user_ns, attr->gid);
+ inode->i_blocks = attr->blocks;
++
++ /* Sanitize nsecs */
++ attr->atimensec = min_t(u32, attr->atimensec, NSEC_PER_SEC - 1);
++ attr->mtimensec = min_t(u32, attr->mtimensec, NSEC_PER_SEC - 1);
++ attr->ctimensec = min_t(u32, attr->ctimensec, NSEC_PER_SEC - 1);
++
+ inode->i_atime.tv_sec = attr->atime;
+ inode->i_atime.tv_nsec = attr->atimensec;
+ /* mtime from server may be stale due to local buffered write */
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 8c305593fb51f..dbad00c20aa16 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1339,8 +1339,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
+ struct journal_head *jh;
+ int ret = 0;
+
+- if (is_handle_aborted(handle))
+- return -EROFS;
+ if (!buffer_jbd(bh))
+ return -EUCLEAN;
+
+@@ -1387,6 +1385,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
+ journal = transaction->t_journal;
+ jbd_lock_bh_state(bh);
+
++ if (is_handle_aborted(handle)) {
++ /*
++ * Check journal aborting with @jh->b_state_lock locked,
++ * since 'jh->b_transaction' could be replaced with
++ * 'jh->b_next_transaction' during old transaction
++ * committing if journal aborted, which may fail
++ * assertion on 'jh->b_frozen_data == NULL'.
++ */
++ ret = -EROFS;
++ goto out_unlock_bh;
++ }
++
+ if (jh->b_modified == 0) {
+ /*
+ * This buffer's got modified and becoming part
+diff --git a/fs/namei.c b/fs/namei.c
+index 327844fedf3d2..c34ee9653559c 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -3453,6 +3453,8 @@ struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode, int open_flag)
+ child = d_alloc(dentry, &slash_name);
+ if (unlikely(!child))
+ goto out_err;
++ if (!IS_POSIXACL(dir))
++ mode &= ~current_umask();
+ error = dir->i_op->tmpfile(dir, child, mode);
+ if (error)
+ goto out_err;
+diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c
+index bf34ddaa2ad74..c1c26b06764fe 100644
+--- a/fs/nfs/nfs4idmap.c
++++ b/fs/nfs/nfs4idmap.c
+@@ -547,22 +547,20 @@ nfs_idmap_prepare_pipe_upcall(struct idmap *idmap,
+ return true;
+ }
+
+-static void
+-nfs_idmap_complete_pipe_upcall_locked(struct idmap *idmap, int ret)
++static void nfs_idmap_complete_pipe_upcall(struct idmap_legacy_upcalldata *data,
++ int ret)
+ {
+- struct key *authkey = idmap->idmap_upcall_data->authkey;
+-
+- kfree(idmap->idmap_upcall_data);
+- idmap->idmap_upcall_data = NULL;
+- complete_request_key(authkey, ret);
+- key_put(authkey);
++ complete_request_key(data->authkey, ret);
++ key_put(data->authkey);
++ kfree(data);
+ }
+
+-static void
+-nfs_idmap_abort_pipe_upcall(struct idmap *idmap, int ret)
++static void nfs_idmap_abort_pipe_upcall(struct idmap *idmap,
++ struct idmap_legacy_upcalldata *data,
++ int ret)
+ {
+- if (idmap->idmap_upcall_data != NULL)
+- nfs_idmap_complete_pipe_upcall_locked(idmap, ret);
++ if (cmpxchg(&idmap->idmap_upcall_data, data, NULL) == data)
++ nfs_idmap_complete_pipe_upcall(data, ret);
+ }
+
+ static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux)
+@@ -599,7 +597,7 @@ static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux)
+
+ ret = rpc_queue_upcall(idmap->idmap_pipe, msg);
+ if (ret < 0)
+- nfs_idmap_abort_pipe_upcall(idmap, ret);
++ nfs_idmap_abort_pipe_upcall(idmap, data, ret);
+
+ return ret;
+ out2:
+@@ -655,6 +653,7 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+ struct request_key_auth *rka;
+ struct rpc_inode *rpci = RPC_I(file_inode(filp));
+ struct idmap *idmap = (struct idmap *)rpci->private;
++ struct idmap_legacy_upcalldata *data;
+ struct key *authkey;
+ struct idmap_msg im;
+ size_t namelen_in;
+@@ -664,10 +663,11 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+ * will have been woken up and someone else may now have used
+ * idmap_key_cons - so after this point we may no longer touch it.
+ */
+- if (idmap->idmap_upcall_data == NULL)
++ data = xchg(&idmap->idmap_upcall_data, NULL);
++ if (data == NULL)
+ goto out_noupcall;
+
+- authkey = idmap->idmap_upcall_data->authkey;
++ authkey = data->authkey;
+ rka = get_request_key_auth(authkey);
+
+ if (mlen != sizeof(im)) {
+@@ -689,18 +689,17 @@ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+ if (namelen_in == 0 || namelen_in == IDMAP_NAMESZ) {
+ ret = -EINVAL;
+ goto out;
+-}
++ }
+
+- ret = nfs_idmap_read_and_verify_message(&im,
+- &idmap->idmap_upcall_data->idmap_msg,
+- rka->target_key, authkey);
++ ret = nfs_idmap_read_and_verify_message(&im, &data->idmap_msg,
++ rka->target_key, authkey);
+ if (ret >= 0) {
+ key_set_timeout(rka->target_key, nfs_idmap_cache_timeout);
+ ret = mlen;
+ }
+
+ out:
+- nfs_idmap_complete_pipe_upcall_locked(idmap, ret);
++ nfs_idmap_complete_pipe_upcall(data, ret);
+ out_noupcall:
+ return ret;
+ }
+@@ -714,7 +713,7 @@ idmap_pipe_destroy_msg(struct rpc_pipe_msg *msg)
+ struct idmap *idmap = data->idmap;
+
+ if (msg->errno)
+- nfs_idmap_abort_pipe_upcall(idmap, msg->errno);
++ nfs_idmap_abort_pipe_upcall(idmap, data, msg->errno);
+ }
+
+ static void
+@@ -722,8 +721,11 @@ idmap_release_pipe(struct inode *inode)
+ {
+ struct rpc_inode *rpci = RPC_I(inode);
+ struct idmap *idmap = (struct idmap *)rpci->private;
++ struct idmap_legacy_upcalldata *data;
+
+- nfs_idmap_abort_pipe_upcall(idmap, -EPIPE);
++ data = xchg(&idmap->idmap_upcall_data, NULL);
++ if (data)
++ nfs_idmap_complete_pipe_upcall(data, -EPIPE);
+ }
+
+ int nfs_map_name_to_uid(const struct nfs_server *server, const char *name, size_t namelen, kuid_t *uid)
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index f48a11fa78bb9..f9f76594b866b 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2920,12 +2920,13 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
+ }
+
+ out:
+- if (opendata->lgp) {
+- nfs4_lgopen_release(opendata->lgp);
+- opendata->lgp = NULL;
+- }
+- if (!opendata->cancelled)
++ if (!opendata->cancelled) {
++ if (opendata->lgp) {
++ nfs4_lgopen_release(opendata->lgp);
++ opendata->lgp = NULL;
++ }
+ nfs4_sequence_free_slot(&opendata->o_res.seq_res);
++ }
+ return ret;
+ }
+
+@@ -8701,6 +8702,9 @@ static int nfs41_reclaim_complete_handle_errors(struct rpc_task *task, struct nf
+ rpc_delay(task, NFS4_POLL_RETRY_MAX);
+ /* fall through */
+ case -NFS4ERR_RETRY_UNCACHED_REP:
++ case -EACCES:
++ dprintk("%s: failed to reclaim complete error %d for server %s, retrying\n",
++ __func__, task->tk_status, clp->cl_hostname);
+ return -EAGAIN;
+ case -NFS4ERR_BADSESSION:
+ case -NFS4ERR_DEADSESSION:
+diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c
+index ba6c7c59261a0..271f8c9fe2538 100644
+--- a/fs/overlayfs/export.c
++++ b/fs/overlayfs/export.c
+@@ -277,7 +277,7 @@ static int ovl_encode_fh(struct inode *inode, u32 *fid, int *max_len,
+ return FILEID_INVALID;
+
+ dentry = d_find_any_alias(inode);
+- if (WARN_ON(!dentry))
++ if (!dentry)
+ return FILEID_INVALID;
+
+ type = ovl_dentry_to_fh(dentry, fid, max_len);
+diff --git a/fs/splice.c b/fs/splice.c
+index fd28c7da3c837..ef1604e307f18 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -899,17 +899,15 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+ {
+ struct pipe_inode_info *pipe;
+ long ret, bytes;
+- umode_t i_mode;
+ size_t len;
+ int i, flags, more;
+
+ /*
+- * We require the input being a regular file, as we don't want to
+- * randomly drop data for eg socket -> socket splicing. Use the
+- * piped splicing for that!
++ * We require the input to be seekable, as we don't want to randomly
++ * drop data for eg socket -> socket splicing. Use the piped splicing
++ * for that!
+ */
+- i_mode = file_inode(in)->i_mode;
+- if (unlikely(!S_ISREG(i_mode) && !S_ISBLK(i_mode)))
++ if (unlikely(!(in->f_mode & FMODE_LSEEK)))
+ return -EINVAL;
+
+ /*
+diff --git a/include/acpi/cppc_acpi.h b/include/acpi/cppc_acpi.h
+index 8e0b8250a1399..c1f437d31a888 100644
+--- a/include/acpi/cppc_acpi.h
++++ b/include/acpi/cppc_acpi.h
+@@ -20,7 +20,7 @@
+ #include <acpi/pcc.h>
+ #include <acpi/processor.h>
+
+-/* Support CPPCv2 and CPPCv3 */
++/* CPPCv2 and CPPCv3 support */
+ #define CPPC_V2_REV 2
+ #define CPPC_V3_REV 3
+ #define CPPC_V2_NUM_ENT 21
+diff --git a/include/asm-generic/bitops/atomic.h b/include/asm-generic/bitops/atomic.h
+index dd90c9792909d..18399e3759a24 100644
+--- a/include/asm-generic/bitops/atomic.h
++++ b/include/asm-generic/bitops/atomic.h
+@@ -35,9 +35,6 @@ static inline int test_and_set_bit(unsigned int nr, volatile unsigned long *p)
+ unsigned long mask = BIT_MASK(nr);
+
+ p += BIT_WORD(nr);
+- if (READ_ONCE(*p) & mask)
+- return 1;
+-
+ old = atomic_long_fetch_or(mask, (atomic_long_t *)p);
+ return !!(old & mask);
+ }
+@@ -48,9 +45,6 @@ static inline int test_and_clear_bit(unsigned int nr, volatile unsigned long *p)
+ unsigned long mask = BIT_MASK(nr);
+
+ p += BIT_WORD(nr);
+- if (!(READ_ONCE(*p) & mask))
+- return 0;
+-
+ old = atomic_long_fetch_andnot(mask, (atomic_long_t *)p);
+ return !!(old & mask);
+ }
+diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
+index 9168fc33a4f78..9d5b0a0a651f1 100644
+--- a/include/linux/buffer_head.h
++++ b/include/linux/buffer_head.h
+@@ -117,7 +117,6 @@ static __always_inline int test_clear_buffer_##name(struct buffer_head *bh) \
+ * of the form "mark_buffer_foo()". These are higher-level functions which
+ * do something in addition to setting a b_state bit.
+ */
+-BUFFER_FNS(Uptodate, uptodate)
+ BUFFER_FNS(Dirty, dirty)
+ TAS_BUFFER_FNS(Dirty, dirty)
+ BUFFER_FNS(Lock, locked)
+@@ -135,6 +134,30 @@ BUFFER_FNS(Meta, meta)
+ BUFFER_FNS(Prio, prio)
+ BUFFER_FNS(Defer_Completion, defer_completion)
+
++static __always_inline void set_buffer_uptodate(struct buffer_head *bh)
++{
++ /*
++ * make it consistent with folio_mark_uptodate
++ * pairs with smp_load_acquire in buffer_uptodate
++ */
++ smp_mb__before_atomic();
++ set_bit(BH_Uptodate, &bh->b_state);
++}
++
++static __always_inline void clear_buffer_uptodate(struct buffer_head *bh)
++{
++ clear_bit(BH_Uptodate, &bh->b_state);
++}
++
++static __always_inline int buffer_uptodate(const struct buffer_head *bh)
++{
++ /*
++ * make it consistent with folio_test_uptodate
++ * pairs with smp_mb__before_atomic in set_buffer_uptodate
++ */
++ return (smp_load_acquire(&bh->b_state) & (1UL << BH_Uptodate)) != 0;
++}
++
+ #define bh_offset(bh) ((unsigned long)(bh)->b_data & ~PAGE_MASK)
+
+ /* If we *know* page->private refers to buffer_heads */
+diff --git a/include/linux/kfifo.h b/include/linux/kfifo.h
+index 89fc8dc7bf38d..ab9ff74818a4f 100644
+--- a/include/linux/kfifo.h
++++ b/include/linux/kfifo.h
+@@ -629,7 +629,7 @@ __kfifo_uint_must_check_helper( \
+ * writer, you don't need extra locking to use these macro.
+ */
+ #define kfifo_to_user(fifo, to, len, copied) \
+-__kfifo_uint_must_check_helper( \
++__kfifo_int_must_check_helper( \
+ ({ \
+ typeof((fifo) + 1) __tmp = (fifo); \
+ void __user *__to = (to); \
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 827f70ce0b497..4f96aef4e8b85 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -128,6 +128,7 @@ static inline bool is_error_page(struct page *page)
+ #define KVM_REQ_MMU_RELOAD (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)
+ #define KVM_REQ_PENDING_TIMER 2
+ #define KVM_REQ_UNHALT 3
++#define KVM_REQ_VM_BUGGED (4 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)
+ #define KVM_REQUEST_ARCH_BASE 8
+
+ #define KVM_ARCH_REQ_FLAGS(nr, flags) ({ \
+@@ -482,6 +483,7 @@ struct kvm {
+ struct srcu_struct srcu;
+ struct srcu_struct irq_srcu;
+ pid_t userspace_pid;
++ bool vm_bugged;
+ };
+
+ #define kvm_err(fmt, ...) \
+@@ -510,6 +512,31 @@ struct kvm {
+ #define vcpu_err(vcpu, fmt, ...) \
+ kvm_err("vcpu%i " fmt, (vcpu)->vcpu_id, ## __VA_ARGS__)
+
++bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req);
++static inline void kvm_vm_bugged(struct kvm *kvm)
++{
++ kvm->vm_bugged = true;
++ kvm_make_all_cpus_request(kvm, KVM_REQ_VM_BUGGED);
++}
++
++#define KVM_BUG(cond, kvm, fmt...) \
++({ \
++ int __ret = (cond); \
++ \
++ if (WARN_ONCE(__ret && !(kvm)->vm_bugged, fmt)) \
++ kvm_vm_bugged(kvm); \
++ unlikely(__ret); \
++})
++
++#define KVM_BUG_ON(cond, kvm) \
++({ \
++ int __ret = (cond); \
++ \
++ if (WARN_ON_ONCE(__ret && !(kvm)->vm_bugged)) \
++ kvm_vm_bugged(kvm); \
++ unlikely(__ret); \
++})
++
+ static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx)
+ {
+ return srcu_dereference_check(kvm->buses[idx], &kvm->srcu,
+@@ -770,7 +797,6 @@ void kvm_reload_remote_mmus(struct kvm *kvm);
+
+ bool kvm_make_vcpus_request_mask(struct kvm *kvm, unsigned int req,
+ unsigned long *vcpu_bitmap, cpumask_var_t tmp);
+-bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req);
+
+ long kvm_arch_dev_ioctl(struct file *filp,
+ unsigned int ioctl, unsigned long arg);
+diff --git a/include/linux/mfd/t7l66xb.h b/include/linux/mfd/t7l66xb.h
+index b4629818aea58..d4e7f0453c915 100644
+--- a/include/linux/mfd/t7l66xb.h
++++ b/include/linux/mfd/t7l66xb.h
+@@ -16,7 +16,6 @@
+
+ struct t7l66xb_platform_data {
+ int (*enable)(struct platform_device *dev);
+- int (*disable)(struct platform_device *dev);
+ int (*suspend)(struct platform_device *dev);
+ int (*resume)(struct platform_device *dev);
+
+diff --git a/include/linux/nmi.h b/include/linux/nmi.h
+index 9003e29cde461..e972d1ae1ee63 100644
+--- a/include/linux/nmi.h
++++ b/include/linux/nmi.h
+@@ -122,6 +122,8 @@ int watchdog_nmi_probe(void);
+ int watchdog_nmi_enable(unsigned int cpu);
+ void watchdog_nmi_disable(unsigned int cpu);
+
++void lockup_detector_reconfigure(void);
++
+ /**
+ * touch_nmi_watchdog - restart NMI watchdog timeout.
+ *
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index c0dd2f749d3f8..1658e9f8d8032 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -59,6 +59,8 @@
+ #define PCI_CLASS_BRIDGE_EISA 0x0602
+ #define PCI_CLASS_BRIDGE_MC 0x0603
+ #define PCI_CLASS_BRIDGE_PCI 0x0604
++#define PCI_CLASS_BRIDGE_PCI_NORMAL 0x060400
++#define PCI_CLASS_BRIDGE_PCI_SUBTRACTIVE 0x060401
+ #define PCI_CLASS_BRIDGE_PCMCIA 0x0605
+ #define PCI_CLASS_BRIDGE_NUBUS 0x0606
+ #define PCI_CLASS_BRIDGE_CARDBUS 0x0607
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index 97e2ddec18b1a..cf7feb8eb1bae 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -66,6 +66,7 @@
+
+ struct giveback_urb_bh {
+ bool running;
++ bool high_prio;
+ spinlock_t lock;
+ struct list_head head;
+ struct tasklet_struct bh;
+diff --git a/include/sound/core.h b/include/sound/core.h
+index 36a5934cf4b10..b5a8cc4d02cc1 100644
+--- a/include/sound/core.h
++++ b/include/sound/core.h
+@@ -444,4 +444,12 @@ snd_pci_quirk_lookup_id(u16 vendor, u16 device,
+ }
+ #endif
+
++/* async signal helpers */
++struct snd_fasync;
++
++int snd_fasync_helper(int fd, struct file *file, int on,
++ struct snd_fasync **fasyncp);
++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll);
++void snd_fasync_free(struct snd_fasync *fasync);
++
+ #endif /* __SOUND_CORE_H */
+diff --git a/include/trace/events/spmi.h b/include/trace/events/spmi.h
+index 8b60efe18ba68..a6819fd85cdf4 100644
+--- a/include/trace/events/spmi.h
++++ b/include/trace/events/spmi.h
+@@ -21,15 +21,15 @@ TRACE_EVENT(spmi_write_begin,
+ __field ( u8, sid )
+ __field ( u16, addr )
+ __field ( u8, len )
+- __dynamic_array ( u8, buf, len + 1 )
++ __dynamic_array ( u8, buf, len )
+ ),
+
+ TP_fast_assign(
+ __entry->opcode = opcode;
+ __entry->sid = sid;
+ __entry->addr = addr;
+- __entry->len = len + 1;
+- memcpy(__get_dynamic_array(buf), buf, len + 1);
++ __entry->len = len;
++ memcpy(__get_dynamic_array(buf), buf, len);
+ ),
+
+ TP_printk("opc=%d sid=%02d addr=0x%04x len=%d buf=0x[%*phD]",
+@@ -92,7 +92,7 @@ TRACE_EVENT(spmi_read_end,
+ __field ( u16, addr )
+ __field ( int, ret )
+ __field ( u8, len )
+- __dynamic_array ( u8, buf, len + 1 )
++ __dynamic_array ( u8, buf, len )
+ ),
+
+ TP_fast_assign(
+@@ -100,8 +100,8 @@ TRACE_EVENT(spmi_read_end,
+ __entry->sid = sid;
+ __entry->addr = addr;
+ __entry->ret = ret;
+- __entry->len = len + 1;
+- memcpy(__get_dynamic_array(buf), buf, len + 1);
++ __entry->len = len;
++ memcpy(__get_dynamic_array(buf), buf, len);
+ ),
+
+ TP_printk("opc=%d sid=%02d addr=0x%04x ret=%d len=%02d buf=0x[%*phD]",
+diff --git a/include/uapi/linux/can/error.h b/include/uapi/linux/can/error.h
+index bfc4b5d22a5e6..383f3d508a53d 100644
+--- a/include/uapi/linux/can/error.h
++++ b/include/uapi/linux/can/error.h
+@@ -120,6 +120,9 @@
+ #define CAN_ERR_TRX_CANL_SHORT_TO_GND 0x70 /* 0111 0000 */
+ #define CAN_ERR_TRX_CANL_SHORT_TO_CANH 0x80 /* 1000 0000 */
+
+-/* controller specific additional information / data[5..7] */
++/* data[5] is reserved (do not use) */
++
++/* TX error counter / data[6] */
++/* RX error counter / data[7] */
+
+ #endif /* _UAPI_CAN_ERROR_H */
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 30ac8ee8294c3..694ee0b1fefea 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -3496,6 +3496,7 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ coerce_reg_to_size(dst_reg, 4);
+ }
+
++ __update_reg_bounds(dst_reg);
+ __reg_deduce_bounds(dst_reg);
+ __reg_bound_offset(dst_reg);
+ return 0;
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 993b84cc1db5a..099191716d4c9 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1566,7 +1566,8 @@ static int check_kprobe_address_safe(struct kprobe *p,
+ preempt_disable();
+
+ /* Ensure it is not in reserved area nor out of text */
+- if (!kernel_text_address((unsigned long) p->addr) ||
++ if (!(core_kernel_text((unsigned long) p->addr) ||
++ is_module_text_address((unsigned long) p->addr)) ||
+ within_kprobe_blacklist((unsigned long) p->addr) ||
+ jump_label_text_reserved(p->addr, p->addr) ||
+ find_bug((unsigned long)p->addr)) {
+diff --git a/kernel/power/user.c b/kernel/power/user.c
+index 2d8b60a3c86b9..6a11154b3d526 100644
+--- a/kernel/power/user.c
++++ b/kernel/power/user.c
+@@ -29,6 +29,7 @@
+
+ #include "power.h"
+
++static bool need_wait;
+
+ #define SNAPSHOT_MINOR 231
+
+@@ -82,7 +83,7 @@ static int snapshot_open(struct inode *inode, struct file *filp)
+ * Resuming. We may need to wait for the image device to
+ * appear.
+ */
+- wait_for_device_probe();
++ need_wait = true;
+
+ data->swap = -1;
+ data->mode = O_WRONLY;
+@@ -174,6 +175,11 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf,
+ ssize_t res;
+ loff_t pg_offp = *offp & ~PAGE_MASK;
+
++ if (need_wait) {
++ wait_for_device_probe();
++ need_wait = false;
++ }
++
+ lock_system_sleep();
+
+ data = filp->private_data;
+@@ -209,6 +215,11 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
+ loff_t size;
+ sector_t offset;
+
++ if (need_wait) {
++ wait_for_device_probe();
++ need_wait = false;
++ }
++
+ if (_IOC_TYPE(cmd) != SNAPSHOT_IOC_MAGIC)
+ return -ENOTTY;
+ if (_IOC_NR(cmd) > SNAPSHOT_IOC_MAXNR)
+diff --git a/kernel/profile.c b/kernel/profile.c
+index efa58f63dc1bf..7fc6214042308 100644
+--- a/kernel/profile.c
++++ b/kernel/profile.c
+@@ -108,6 +108,13 @@ int __ref profile_init(void)
+
+ /* only text is profiled */
+ prof_len = (_etext - _stext) >> prof_shift;
++
++ if (!prof_len) {
++ pr_warn("profiling shift: %u too large\n", prof_shift);
++ prof_on = 0;
++ return -EINVAL;
++ }
++
+ buffer_bytes = prof_len*sizeof(atomic_t);
+
+ if (!alloc_cpumask_var(&prof_cpu_mask, GFP_KERNEL))
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index 70e8cd3954745..9c6c3572b1312 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -434,7 +434,7 @@ static inline void rt_queue_push_tasks(struct rq *rq)
+ #endif /* CONFIG_SMP */
+
+ static void enqueue_top_rt_rq(struct rt_rq *rt_rq);
+-static void dequeue_top_rt_rq(struct rt_rq *rt_rq);
++static void dequeue_top_rt_rq(struct rt_rq *rt_rq, unsigned int count);
+
+ static inline int on_rt_rq(struct sched_rt_entity *rt_se)
+ {
+@@ -516,7 +516,7 @@ static void sched_rt_rq_dequeue(struct rt_rq *rt_rq)
+ rt_se = rt_rq->tg->rt_se[cpu];
+
+ if (!rt_se) {
+- dequeue_top_rt_rq(rt_rq);
++ dequeue_top_rt_rq(rt_rq, rt_rq->rt_nr_running);
+ /* Kick cpufreq (see the comment in kernel/sched/sched.h). */
+ cpufreq_update_util(rq_of_rt_rq(rt_rq), 0);
+ }
+@@ -602,7 +602,7 @@ static inline void sched_rt_rq_enqueue(struct rt_rq *rt_rq)
+
+ static inline void sched_rt_rq_dequeue(struct rt_rq *rt_rq)
+ {
+- dequeue_top_rt_rq(rt_rq);
++ dequeue_top_rt_rq(rt_rq, rt_rq->rt_nr_running);
+ }
+
+ static inline int rt_rq_throttled(struct rt_rq *rt_rq)
+@@ -1001,7 +1001,7 @@ static void update_curr_rt(struct rq *rq)
+ }
+
+ static void
+-dequeue_top_rt_rq(struct rt_rq *rt_rq)
++dequeue_top_rt_rq(struct rt_rq *rt_rq, unsigned int count)
+ {
+ struct rq *rq = rq_of_rt_rq(rt_rq);
+
+@@ -1012,7 +1012,7 @@ dequeue_top_rt_rq(struct rt_rq *rt_rq)
+
+ BUG_ON(!rq->nr_running);
+
+- sub_nr_running(rq, rt_rq->rt_nr_running);
++ sub_nr_running(rq, count);
+ rt_rq->rt_queued = 0;
+
+ }
+@@ -1291,18 +1291,21 @@ static void __dequeue_rt_entity(struct sched_rt_entity *rt_se, unsigned int flag
+ static void dequeue_rt_stack(struct sched_rt_entity *rt_se, unsigned int flags)
+ {
+ struct sched_rt_entity *back = NULL;
++ unsigned int rt_nr_running;
+
+ for_each_sched_rt_entity(rt_se) {
+ rt_se->back = back;
+ back = rt_se;
+ }
+
+- dequeue_top_rt_rq(rt_rq_of_se(back));
++ rt_nr_running = rt_rq_of_se(back)->rt_nr_running;
+
+ for (rt_se = back; rt_se; rt_se = rt_se->back) {
+ if (on_rt_rq(rt_se))
+ __dequeue_rt_entity(rt_se, flags);
+ }
++
++ dequeue_top_rt_rq(rt_rq_of_se(back), rt_nr_running);
+ }
+
+ static void enqueue_rt_entity(struct sched_rt_entity *rt_se, unsigned int flags)
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 1ca64a9296d0d..d2f9146d1ad74 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -173,6 +173,7 @@ static int trace_define_generic_fields(void)
+
+ __generic_field(int, CPU, FILTER_CPU);
+ __generic_field(int, cpu, FILTER_CPU);
++ __generic_field(int, common_cpu, FILTER_CPU);
+ __generic_field(char *, COMM, FILTER_COMM);
+ __generic_field(char *, comm, FILTER_COMM);
+
+diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
+index e99c3ce7aa654..d85ee1778b99a 100644
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -361,7 +361,7 @@ static int parse_probe_vars(char *arg, const struct fetch_type *t,
+ }
+ } else
+ ret = -EINVAL;
+- } else if (strcmp(arg, "comm") == 0) {
++ } else if (strcmp(arg, "comm") == 0 || strcmp(arg, "COMM") == 0) {
+ if (strcmp(t->name, "string") != 0 &&
+ strcmp(t->name, "string_size") != 0)
+ return -EINVAL;
+@@ -544,7 +544,7 @@ int traceprobe_parse_probe_arg(char *arg, ssize_t *size,
+ * The default type of $comm should be "string", and it can't be
+ * dereferenced.
+ */
+- if (!t && strcmp(arg, "$comm") == 0)
++ if (!t && (strcmp(arg, "$comm") == 0 || strcmp(arg, "$COMM") == 0))
+ t = "string";
+ parg->type = find_fetch_type(t, ftbl);
+ if (!parg->type) {
+diff --git a/kernel/watchdog.c b/kernel/watchdog.c
+index 6d60701dc6361..44096c4f4d60f 100644
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -561,7 +561,7 @@ int lockup_detector_offline_cpu(unsigned int cpu)
+ return 0;
+ }
+
+-static void lockup_detector_reconfigure(void)
++static void __lockup_detector_reconfigure(void)
+ {
+ cpus_read_lock();
+ watchdog_nmi_stop();
+@@ -581,6 +581,13 @@ static void lockup_detector_reconfigure(void)
+ __lockup_detector_cleanup();
+ }
+
++void lockup_detector_reconfigure(void)
++{
++ mutex_lock(&watchdog_mutex);
++ __lockup_detector_reconfigure();
++ mutex_unlock(&watchdog_mutex);
++}
++
+ /*
+ * Create the watchdog thread infrastructure and configure the detector(s).
+ *
+@@ -601,13 +608,13 @@ static __init void lockup_detector_setup(void)
+ return;
+
+ mutex_lock(&watchdog_mutex);
+- lockup_detector_reconfigure();
++ __lockup_detector_reconfigure();
+ softlockup_initialized = true;
+ mutex_unlock(&watchdog_mutex);
+ }
+
+ #else /* CONFIG_SOFTLOCKUP_DETECTOR */
+-static void lockup_detector_reconfigure(void)
++static void __lockup_detector_reconfigure(void)
+ {
+ cpus_read_lock();
+ watchdog_nmi_stop();
+@@ -615,9 +622,13 @@ static void lockup_detector_reconfigure(void)
+ watchdog_nmi_start();
+ cpus_read_unlock();
+ }
++void lockup_detector_reconfigure(void)
++{
++ __lockup_detector_reconfigure();
++}
+ static inline void lockup_detector_setup(void)
+ {
+- lockup_detector_reconfigure();
++ __lockup_detector_reconfigure();
+ }
+ #endif /* !CONFIG_SOFTLOCKUP_DETECTOR */
+
+@@ -657,7 +668,7 @@ static void proc_watchdog_update(void)
+ {
+ /* Remove impossible cpus to keep sysctl output clean. */
+ cpumask_and(&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask);
+- lockup_detector_reconfigure();
++ __lockup_detector_reconfigure();
+ }
+
+ /*
+diff --git a/lib/list_debug.c b/lib/list_debug.c
+index 5d5424b51b746..413daa72a3d83 100644
+--- a/lib/list_debug.c
++++ b/lib/list_debug.c
+@@ -20,7 +20,11 @@
+ bool __list_add_valid(struct list_head *new, struct list_head *prev,
+ struct list_head *next)
+ {
+- if (CHECK_DATA_CORRUPTION(next->prev != prev,
++ if (CHECK_DATA_CORRUPTION(prev == NULL,
++ "list_add corruption. prev is NULL.\n") ||
++ CHECK_DATA_CORRUPTION(next == NULL,
++ "list_add corruption. next is NULL.\n") ||
++ CHECK_DATA_CORRUPTION(next->prev != prev,
+ "list_add corruption. next->prev should be prev (%px), but was %px. (next=%px).\n",
+ prev, next->prev, next) ||
+ CHECK_DATA_CORRUPTION(prev->next != next,
+@@ -42,7 +46,11 @@ bool __list_del_entry_valid(struct list_head *entry)
+ prev = entry->prev;
+ next = entry->next;
+
+- if (CHECK_DATA_CORRUPTION(next == LIST_POISON1,
++ if (CHECK_DATA_CORRUPTION(next == NULL,
++ "list_del corruption, %px->next is NULL\n", entry) ||
++ CHECK_DATA_CORRUPTION(prev == NULL,
++ "list_del corruption, %px->prev is NULL\n", entry) ||
++ CHECK_DATA_CORRUPTION(next == LIST_POISON1,
+ "list_del corruption, %px->next is LIST_POISON1 (%px)\n",
+ entry, LIST_POISON1) ||
+ CHECK_DATA_CORRUPTION(prev == LIST_POISON2,
+diff --git a/mm/mmap.c b/mm/mmap.c
+index bb8ba32589459..590840c3a3b5f 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1821,7 +1821,6 @@ unmap_and_free_vma:
+
+ /* Undo any partial mapping done by a device driver. */
+ unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
+- charged = 0;
+ if (vm_flags & VM_SHARED)
+ mapping_unmap_writable(file->f_mapping);
+ allow_write_and_free_vma:
+diff --git a/net/9p/client.c b/net/9p/client.c
+index bb0a43b8a6b0f..98301add20f49 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -908,16 +908,13 @@ static struct p9_fid *p9_fid_create(struct p9_client *clnt)
+ struct p9_fid *fid;
+
+ p9_debug(P9_DEBUG_FID, "clnt %p\n", clnt);
+- fid = kmalloc(sizeof(struct p9_fid), GFP_KERNEL);
++ fid = kzalloc(sizeof(struct p9_fid), GFP_KERNEL);
+ if (!fid)
+ return NULL;
+
+- memset(&fid->qid, 0, sizeof(struct p9_qid));
+ fid->mode = -1;
+ fid->uid = current_fsuid();
+ fid->clnt = clnt;
+- fid->rdir = NULL;
+- fid->fid = 0;
+
+ idr_preload(GFP_KERNEL);
+ spin_lock_irq(&clnt->lock);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 709cceef67288..0dfc47adccb17 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -1804,11 +1804,11 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
+ bdaddr_t *dst,
+ u8 link_type)
+ {
+- struct l2cap_chan *c, *c1 = NULL;
++ struct l2cap_chan *c, *tmp, *c1 = NULL;
+
+ read_lock(&chan_list_lock);
+
+- list_for_each_entry(c, &chan_list, global_l) {
++ list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
+ if (state && c->state != state)
+ continue;
+
+@@ -1827,11 +1827,10 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
+ dst_match = !bacmp(&c->dst, dst);
+ if (src_match && dst_match) {
+ c = l2cap_chan_hold_unless_zero(c);
+- if (!c)
+- continue;
+-
+- read_unlock(&chan_list_lock);
+- return c;
++ if (c) {
++ read_unlock(&chan_list_lock);
++ return c;
++ }
+ }
+
+ /* Closest match */
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c
+index 43733accf58eb..dbbcf50aea35d 100644
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -769,11 +769,6 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+
+ lock_sock(sk);
+
+- if (dccp_qpolicy_full(sk)) {
+- rc = -EAGAIN;
+- goto out_release;
+- }
+-
+ timeo = sock_sndtimeo(sk, noblock);
+
+ /*
+@@ -792,6 +787,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ if (skb == NULL)
+ goto out_release;
+
++ if (dccp_qpolicy_full(sk)) {
++ rc = -EAGAIN;
++ goto out_discard;
++ }
++
+ if (sk->sk_state == DCCP_CLOSED) {
+ rc = -ENOTCONN;
+ goto out_discard;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 3090b61e4edd1..35bf585992231 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2856,7 +2856,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
+ struct tcp_sock *tp = tcp_sk(sk);
+ unsigned int cur_mss;
+ int diff, len, err;
+-
++ int avail_wnd;
+
+ /* Inconclusive MTU probe */
+ if (icsk->icsk_mtup.probe_size)
+@@ -2886,17 +2886,25 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
+ return -EHOSTUNREACH; /* Routing failure or similar. */
+
+ cur_mss = tcp_current_mss(sk);
++ avail_wnd = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
+
+ /* If receiver has shrunk his window, and skb is out of
+ * new window, do not retransmit it. The exception is the
+ * case, when window is shrunk to zero. In this case
+- * our retransmit serves as a zero window probe.
++ * our retransmit of one segment serves as a zero window probe.
+ */
+- if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp)) &&
+- TCP_SKB_CB(skb)->seq != tp->snd_una)
+- return -EAGAIN;
++ if (avail_wnd <= 0) {
++ if (TCP_SKB_CB(skb)->seq != tp->snd_una)
++ return -EAGAIN;
++ avail_wnd = cur_mss;
++ }
+
+ len = cur_mss * segs;
++ if (len > avail_wnd) {
++ len = rounddown(avail_wnd, cur_mss);
++ if (!len)
++ len = avail_wnd;
++ }
+ if (skb->len > len) {
+ if (tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb, len,
+ cur_mss, GFP_ATOMIC))
+@@ -2910,8 +2918,9 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
+ diff -= tcp_skb_pcount(skb);
+ if (diff)
+ tcp_adjust_pcount(sk, skb, diff);
+- if (skb->len < cur_mss)
+- tcp_retrans_try_collapse(sk, skb, cur_mss);
++ avail_wnd = min_t(int, avail_wnd, cur_mss);
++ if (skb->len < avail_wnd)
++ tcp_retrans_try_collapse(sk, skb, avail_wnd);
+ }
+
+ /* RFC3168, section 6.1.1.1. ECN fallback */
+@@ -3070,11 +3079,12 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
+ */
+ void sk_forced_mem_schedule(struct sock *sk, int size)
+ {
+- int amt;
++ int delta, amt;
+
+- if (size <= sk->sk_forward_alloc)
++ delta = size - sk->sk_forward_alloc;
++ if (delta <= 0)
+ return;
+- amt = sk_mem_pages(size);
++ amt = sk_mem_pages(delta);
+ sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
+ sk_memory_allocated_add(sk, amt);
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index ab68076d2cba3..079f768496937 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -96,6 +96,7 @@ static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
+ if (trans == NULL)
+ return NULL;
+
++ INIT_LIST_HEAD(&trans->list);
+ trans->msg_type = msg_type;
+ trans->ctx = *ctx;
+
+@@ -3039,6 +3040,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
+ }
+
+ static struct nft_set *nft_set_lookup_byid(const struct net *net,
++ const struct nft_table *table,
+ const struct nlattr *nla, u8 genmask)
+ {
+ struct nft_trans *trans;
+@@ -3049,6 +3051,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net,
+ struct nft_set *set = nft_trans_set(trans);
+
+ if (id == nft_trans_set_id(trans) &&
++ set->table == table &&
+ nft_active_genmask(set, genmask))
+ return set;
+ }
+@@ -3069,7 +3072,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net,
+ if (!nla_set_id)
+ return set;
+
+- set = nft_set_lookup_byid(net, nla_set_id, genmask);
++ set = nft_set_lookup_byid(net, table, nla_set_id, genmask);
+ }
+ return set;
+ }
+@@ -3095,7 +3098,7 @@ cont:
+ list_for_each_entry(i, &ctx->table->sets, list) {
+ int tmp;
+
+- if (!nft_is_active_next(ctx->net, set))
++ if (!nft_is_active_next(ctx->net, i))
+ continue;
+ if (!sscanf(i->name, name, &tmp))
+ continue;
+diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
+index 2f16146e4ec94..18e0e3cba1acf 100644
+--- a/net/rds/ib_recv.c
++++ b/net/rds/ib_recv.c
+@@ -362,6 +362,7 @@ static int acquire_refill(struct rds_connection *conn)
+ static void release_refill(struct rds_connection *conn)
+ {
+ clear_bit(RDS_RECV_REFILL, &conn->c_flags);
++ smp_mb__after_atomic();
+
+ /* We don't use wait_on_bit()/wake_up_bit() because our waking is in a
+ * hot path and finding waiters is very rare. We don't want to walk
+diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
+index d00a0ef39a56b..03a1ee221112e 100644
+--- a/net/rose/af_rose.c
++++ b/net/rose/af_rose.c
+@@ -194,6 +194,7 @@ static void rose_kill_by_device(struct net_device *dev)
+ rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
+ if (rose->neighbour)
+ rose->neighbour->use--;
++ dev_put(rose->device);
+ rose->device = NULL;
+ }
+ }
+@@ -594,6 +595,8 @@ static struct sock *rose_make_new(struct sock *osk)
+ rose->idle = orose->idle;
+ rose->defer = orose->defer;
+ rose->device = orose->device;
++ if (rose->device)
++ dev_hold(rose->device);
+ rose->qbitincl = orose->qbitincl;
+
+ return sk;
+@@ -647,6 +650,7 @@ static int rose_release(struct socket *sock)
+ break;
+ }
+
++ dev_put(rose->device);
+ sock->sk = NULL;
+ release_sock(sk);
+ sock_put(sk);
+@@ -721,7 +725,6 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
+ struct rose_sock *rose = rose_sk(sk);
+ struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
+ unsigned char cause, diagnostic;
+- struct net_device *dev;
+ ax25_uid_assoc *user;
+ int n, err = 0;
+
+@@ -778,9 +781,12 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
+ }
+
+ if (sock_flag(sk, SOCK_ZAPPED)) { /* Must bind first - autobinding in this may or may not work */
++ struct net_device *dev;
++
+ sock_reset_flag(sk, SOCK_ZAPPED);
+
+- if ((dev = rose_dev_first()) == NULL) {
++ dev = rose_dev_first();
++ if (!dev) {
+ err = -ENETUNREACH;
+ goto out_release;
+ }
+@@ -788,6 +794,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
+ user = ax25_findbyuid(current_euid());
+ if (!user) {
+ err = -EINVAL;
++ dev_put(dev);
+ goto out_release;
+ }
+
+diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
+index 46ae92d703247..5671853bef83a 100644
+--- a/net/rose/rose_route.c
++++ b/net/rose/rose_route.c
+@@ -616,6 +616,8 @@ struct net_device *rose_dev_first(void)
+ if (first == NULL || strncmp(dev->name, first->name, 3) < 0)
+ first = dev;
+ }
++ if (first)
++ dev_hold(first);
+ rcu_read_unlock();
+
+ return first;
+diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
+index 0256777b838e6..4c7fa1cfd8e38 100644
+--- a/net/sched/cls_route.c
++++ b/net/sched/cls_route.c
+@@ -427,6 +427,11 @@ static int route4_set_parms(struct net *net, struct tcf_proto *tp,
+ return -EINVAL;
+ }
+
++ if (!nhandle) {
++ NL_SET_ERR_MSG(extack, "Replacing with handle of 0 is invalid");
++ return -EINVAL;
++ }
++
+ h1 = to_hash(nhandle);
+ b = rtnl_dereference(head->table[h1]);
+ if (!b) {
+@@ -480,6 +485,11 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
+ int err;
+ bool new = true;
+
++ if (!handle) {
++ NL_SET_ERR_MSG(extack, "Creating with handle of 0 is invalid");
++ return -EINVAL;
++ }
++
+ if (opt == NULL)
+ return handle ? -EINVAL : 0;
+
+@@ -528,7 +538,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
+ rcu_assign_pointer(f->next, f1);
+ rcu_assign_pointer(*fp, f);
+
+- if (fold && fold->handle && f->handle != fold->handle) {
++ if (fold) {
+ th = to_hash(fold->handle);
+ h = from_hash(fold->handle >> 16);
+ b = rtnl_dereference(head->table[th]);
+diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
+index 3c15a99b97003..e41427e1740da 100644
+--- a/net/sunrpc/backchannel_rqst.c
++++ b/net/sunrpc/backchannel_rqst.c
+@@ -69,6 +69,17 @@ static void xprt_free_allocation(struct rpc_rqst *req)
+ kfree(req);
+ }
+
++static void xprt_bc_reinit_xdr_buf(struct xdr_buf *buf)
++{
++ buf->head[0].iov_len = PAGE_SIZE;
++ buf->tail[0].iov_len = 0;
++ buf->pages = NULL;
++ buf->page_len = 0;
++ buf->flags = 0;
++ buf->len = 0;
++ buf->buflen = PAGE_SIZE;
++}
++
+ static int xprt_alloc_xdr_buf(struct xdr_buf *buf, gfp_t gfp_flags)
+ {
+ struct page *page;
+@@ -291,6 +302,9 @@ void xprt_free_bc_rqst(struct rpc_rqst *req)
+ */
+ spin_lock_bh(&xprt->bc_pa_lock);
+ if (xprt_need_to_requeue(xprt)) {
++ xprt_bc_reinit_xdr_buf(&req->rq_snd_buf);
++ xprt_bc_reinit_xdr_buf(&req->rq_rcv_buf);
++ req->rq_rcv_buf.len = PAGE_SIZE;
+ list_add_tail(&req->rq_bc_pa_list, &xprt->bc_pa_list);
+ xprt->bc_alloc_count++;
+ req = NULL;
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 22931a5f62bc6..d55a47858d6d3 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1118,6 +1118,7 @@ static void vsock_connect_timeout(struct work_struct *work)
+ if (sk->sk_state == TCP_SYN_SENT &&
+ (sk->sk_shutdown != SHUTDOWN_MASK)) {
+ sk->sk_state = TCP_CLOSE;
++ sk->sk_socket->state = SS_UNCONNECTED;
+ sk->sk_err = ETIMEDOUT;
+ sk->sk_error_report(sk);
+ vsock_transport_cancel_pkt(vsk);
+@@ -1215,7 +1216,14 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
+ * timeout fires.
+ */
+ sock_hold(sk);
+- schedule_delayed_work(&vsk->connect_work, timeout);
++
++ /* If the timeout function is already scheduled,
++ * reschedule it, then ungrab the socket refcount to
++ * keep it balanced.
++ */
++ if (mod_delayed_work(system_wq, &vsk->connect_work,
++ timeout))
++ sock_put(sk);
+
+ /* Skip ahead to preserve error code set above. */
+ goto out_wait;
+diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
+index 93ca13e4f8f95..66bbe77ed7570 100644
+--- a/scripts/Makefile.gcc-plugins
++++ b/scripts/Makefile.gcc-plugins
+@@ -6,7 +6,7 @@ gcc-plugin-$(CONFIG_GCC_PLUGIN_LATENT_ENTROPY) += latent_entropy_plugin.so
+ gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_LATENT_ENTROPY) \
+ += -DLATENT_ENTROPY_PLUGIN
+ ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
+- DISABLE_LATENT_ENTROPY_PLUGIN += -fplugin-arg-latent_entropy_plugin-disable
++ DISABLE_LATENT_ENTROPY_PLUGIN += -fplugin-arg-latent_entropy_plugin-disable -ULATENT_ENTROPY_PLUGIN
+ endif
+ export DISABLE_LATENT_ENTROPY_PLUGIN
+
+diff --git a/scripts/faddr2line b/scripts/faddr2line
+index 2571caac3156c..70f8c3ecd5559 100755
+--- a/scripts/faddr2line
++++ b/scripts/faddr2line
+@@ -112,7 +112,9 @@ __faddr2line() {
+ # section offsets.
+ local file_type=$(${READELF} --file-header $objfile |
+ ${AWK} '$1 == "Type:" { print $2; exit }')
+- [[ $file_type = "EXEC" ]] && is_vmlinux=1
++ if [[ $file_type = "EXEC" ]] || [[ $file_type == "DYN" ]]; then
++ is_vmlinux=1
++ fi
+
+ # Go through each of the object's symbols which match the func name.
+ # In rare cases there might be duplicates, in which case we print all
+diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
+index 900c865b9e5ff..8868c475205ff 100644
+--- a/security/apparmor/apparmorfs.c
++++ b/security/apparmor/apparmorfs.c
+@@ -403,7 +403,7 @@ static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf,
+
+ data->size = copy_size;
+ if (copy_from_user(data->data, userbuf, copy_size)) {
+- kvfree(data);
++ aa_put_loaddata(data);
+ return ERR_PTR(-EFAULT);
+ }
+
+diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c
+index 70b9730c0be6a..86ce3ec18a8aa 100644
+--- a/security/apparmor/audit.c
++++ b/security/apparmor/audit.c
+@@ -143,7 +143,7 @@ int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
+ }
+ if (AUDIT_MODE(profile) == AUDIT_QUIET ||
+ (type == AUDIT_APPARMOR_DENIED &&
+- AUDIT_MODE(profile) == AUDIT_QUIET))
++ AUDIT_MODE(profile) == AUDIT_QUIET_DENIED))
+ return aad(sa)->error;
+
+ if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED)
+diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
+index 13b33490e0792..dad704825294d 100644
+--- a/security/apparmor/domain.c
++++ b/security/apparmor/domain.c
+@@ -464,7 +464,7 @@ restart:
+ * xattrs, or a longer match
+ */
+ candidate = profile;
+- candidate_len = profile->xmatch_len;
++ candidate_len = max(count, profile->xmatch_len);
+ candidate_xattrs = ret;
+ conflict = false;
+ }
+diff --git a/security/apparmor/include/lib.h b/security/apparmor/include/lib.h
+index 6505e1ad9e230..a6d747dc148d0 100644
+--- a/security/apparmor/include/lib.h
++++ b/security/apparmor/include/lib.h
+@@ -25,6 +25,11 @@
+ */
+
+ #define DEBUG_ON (aa_g_debug)
++/*
++ * split individual debug cases out in preparation for finer grained
++ * debug controls in the future.
++ */
++#define AA_DEBUG_LABEL DEBUG_ON
+ #define dbg_printk(__fmt, __args...) pr_debug(__fmt, ##__args)
+ #define AA_DEBUG(fmt, args...) \
+ do { \
+diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
+index 28c098fb6208b..92fa4f6102120 100644
+--- a/security/apparmor/include/policy.h
++++ b/security/apparmor/include/policy.h
+@@ -139,7 +139,7 @@ struct aa_profile {
+
+ const char *attach;
+ struct aa_dfa *xmatch;
+- int xmatch_len;
++ unsigned int xmatch_len;
+ enum audit_mode audit;
+ long mode;
+ u32 path_flags;
+diff --git a/security/apparmor/label.c b/security/apparmor/label.c
+index 5a80a16a7f751..fed6bd75fcc1c 100644
+--- a/security/apparmor/label.c
++++ b/security/apparmor/label.c
+@@ -1641,9 +1641,9 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
+ AA_BUG(!str && size != 0);
+ AA_BUG(!label);
+
+- if (flags & FLAG_ABS_ROOT) {
++ if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) {
+ ns = root_ns;
+- len = snprintf(str, size, "=");
++ len = snprintf(str, size, "_");
+ update_for_len(total, len, size, str);
+ } else if (!ns) {
+ ns = labels_ns(label);
+@@ -1754,7 +1754,7 @@ void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
+ if (!use_label_hname(ns, label, flags) ||
+ display_mode(ns, label, flags)) {
+ len = aa_label_asxprint(&name, ns, label, flags, gfp);
+- if (len == -1) {
++ if (len < 0) {
+ AA_DEBUG("label print error");
+ return;
+ }
+@@ -1782,7 +1782,7 @@ void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
+ int len;
+
+ len = aa_label_asxprint(&str, ns, label, flags, gfp);
+- if (len == -1) {
++ if (len < 0) {
+ AA_DEBUG("label print error");
+ return;
+ }
+@@ -1805,7 +1805,7 @@ void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
+ int len;
+
+ len = aa_label_asxprint(&str, ns, label, flags, gfp);
+- if (len == -1) {
++ if (len < 0) {
+ AA_DEBUG("label print error");
+ return;
+ }
+@@ -1905,7 +1905,8 @@ struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
+ AA_BUG(!str);
+
+ str = skipn_spaces(str, n);
+- if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label))
++ if (str == NULL || (AA_DEBUG_LABEL && *str == '_' &&
++ base != &root_ns->unconfined->label))
+ return ERR_PTR(-EINVAL);
+
+ len = label_count_strn_entries(str, end - str);
+diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c
+index c1da22482bfbb..85dc8a548c4ba 100644
+--- a/security/apparmor/mount.c
++++ b/security/apparmor/mount.c
+@@ -232,7 +232,8 @@ static const char * const mnt_info_table[] = {
+ "failed srcname match",
+ "failed type match",
+ "failed flags match",
+- "failed data match"
++ "failed data match",
++ "failed perms check"
+ };
+
+ /*
+@@ -287,8 +288,8 @@ static int do_match_mnt(struct aa_dfa *dfa, unsigned int start,
+ return 0;
+ }
+
+- /* failed at end of flags match */
+- return 4;
++ /* failed at perms check, don't confuse with flags match */
++ return 6;
+ }
+
+
+@@ -685,6 +686,7 @@ int aa_pivotroot(struct aa_label *label, const struct path *old_path,
+ aa_put_label(target);
+ goto out;
+ }
++ aa_put_label(target);
+ } else
+ /* already audited error */
+ error = PTR_ERR(target);
+diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
+index 215f8f30ac5a5..2a479785ebd41 100644
+--- a/security/selinux/ss/policydb.h
++++ b/security/selinux/ss/policydb.h
+@@ -360,6 +360,8 @@ static inline int put_entry(const void *buf, size_t bytes, int num, struct polic
+ {
+ size_t len = bytes * num;
+
++ if (len > fp->len)
++ return -EINVAL;
+ memcpy(fp->data, buf, len);
+ fp->data += len;
+ fp->len -= len;
+diff --git a/sound/core/info.c b/sound/core/info.c
+index 3fa8336794f82..2ac656db0b1c1 100644
+--- a/sound/core/info.c
++++ b/sound/core/info.c
+@@ -127,9 +127,9 @@ static loff_t snd_info_entry_llseek(struct file *file, loff_t offset, int orig)
+ entry = data->entry;
+ mutex_lock(&entry->access);
+ if (entry->c.ops->llseek) {
+- offset = entry->c.ops->llseek(entry,
+- data->file_private_data,
+- file, offset, orig);
++ ret = entry->c.ops->llseek(entry,
++ data->file_private_data,
++ file, offset, orig);
+ goto out;
+ }
+
+diff --git a/sound/core/misc.c b/sound/core/misc.c
+index 0f818d593c9ee..d100feba26b5c 100644
+--- a/sound/core/misc.c
++++ b/sound/core/misc.c
+@@ -25,6 +25,7 @@
+ #include <linux/time.h>
+ #include <linux/slab.h>
+ #include <linux/ioport.h>
++#include <linux/fs.h>
+ #include <sound/core.h>
+
+ #ifdef CONFIG_SND_DEBUG
+@@ -160,3 +161,96 @@ snd_pci_quirk_lookup(struct pci_dev *pci, const struct snd_pci_quirk *list)
+ }
+ EXPORT_SYMBOL(snd_pci_quirk_lookup);
+ #endif
++
++/*
++ * Deferred async signal helpers
++ *
++ * Below are a few helper functions to wrap the async signal handling
++ * in the deferred work. The main purpose is to avoid the messy deadlock
++ * around tasklist_lock and co at the kill_fasync() invocation.
++ * fasync_helper() and kill_fasync() are replaced with snd_fasync_helper()
++ * and snd_kill_fasync(), respectively. In addition, snd_fasync_free() has
++ * to be called at releasing the relevant file object.
++ */
++struct snd_fasync {
++ struct fasync_struct *fasync;
++ int signal;
++ int poll;
++ int on;
++ struct list_head list;
++};
++
++static DEFINE_SPINLOCK(snd_fasync_lock);
++static LIST_HEAD(snd_fasync_list);
++
++static void snd_fasync_work_fn(struct work_struct *work)
++{
++ struct snd_fasync *fasync;
++
++ spin_lock_irq(&snd_fasync_lock);
++ while (!list_empty(&snd_fasync_list)) {
++ fasync = list_first_entry(&snd_fasync_list, struct snd_fasync, list);
++ list_del_init(&fasync->list);
++ spin_unlock_irq(&snd_fasync_lock);
++ if (fasync->on)
++ kill_fasync(&fasync->fasync, fasync->signal, fasync->poll);
++ spin_lock_irq(&snd_fasync_lock);
++ }
++ spin_unlock_irq(&snd_fasync_lock);
++}
++
++static DECLARE_WORK(snd_fasync_work, snd_fasync_work_fn);
++
++int snd_fasync_helper(int fd, struct file *file, int on,
++ struct snd_fasync **fasyncp)
++{
++ struct snd_fasync *fasync = NULL;
++
++ if (on) {
++ fasync = kzalloc(sizeof(*fasync), GFP_KERNEL);
++ if (!fasync)
++ return -ENOMEM;
++ INIT_LIST_HEAD(&fasync->list);
++ }
++
++ spin_lock_irq(&snd_fasync_lock);
++ if (*fasyncp) {
++ kfree(fasync);
++ fasync = *fasyncp;
++ } else {
++ if (!fasync) {
++ spin_unlock_irq(&snd_fasync_lock);
++ return 0;
++ }
++ *fasyncp = fasync;
++ }
++ fasync->on = on;
++ spin_unlock_irq(&snd_fasync_lock);
++ return fasync_helper(fd, file, on, &fasync->fasync);
++}
++EXPORT_SYMBOL_GPL(snd_fasync_helper);
++
++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll)
++{
++ unsigned long flags;
++
++ if (!fasync || !fasync->on)
++ return;
++ spin_lock_irqsave(&snd_fasync_lock, flags);
++ fasync->signal = signal;
++ fasync->poll = poll;
++ list_move(&fasync->list, &snd_fasync_list);
++ schedule_work(&snd_fasync_work);
++ spin_unlock_irqrestore(&snd_fasync_lock, flags);
++}
++EXPORT_SYMBOL_GPL(snd_kill_fasync);
++
++void snd_fasync_free(struct snd_fasync *fasync)
++{
++ if (!fasync)
++ return;
++ fasync->on = 0;
++ flush_work(&snd_fasync_work);
++ kfree(fasync);
++}
++EXPORT_SYMBOL_GPL(snd_fasync_free);
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 4920ec4f45948..f0e8b98f346ea 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -75,7 +75,7 @@ struct snd_timer_user {
+ unsigned int filter;
+ struct timespec tstamp; /* trigger tstamp */
+ wait_queue_head_t qchange_sleep;
+- struct fasync_struct *fasync;
++ struct snd_fasync *fasync;
+ struct mutex ioctl_lock;
+ };
+
+@@ -1306,7 +1306,7 @@ static void snd_timer_user_interrupt(struct snd_timer_instance *timeri,
+ }
+ __wake:
+ spin_unlock(&tu->qlock);
+- kill_fasync(&tu->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN);
+ wake_up(&tu->qchange_sleep);
+ }
+
+@@ -1343,7 +1343,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri,
+ spin_lock_irqsave(&tu->qlock, flags);
+ snd_timer_user_append_to_tqueue(tu, &r1);
+ spin_unlock_irqrestore(&tu->qlock, flags);
+- kill_fasync(&tu->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN);
+ wake_up(&tu->qchange_sleep);
+ }
+
+@@ -1410,7 +1410,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri,
+ spin_unlock(&tu->qlock);
+ if (append == 0)
+ return;
+- kill_fasync(&tu->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN);
+ wake_up(&tu->qchange_sleep);
+ }
+
+@@ -1476,6 +1476,7 @@ static int snd_timer_user_release(struct inode *inode, struct file *file)
+ if (tu->timeri)
+ snd_timer_close(tu->timeri);
+ mutex_unlock(&tu->ioctl_lock);
++ snd_fasync_free(tu->fasync);
+ kfree(tu->queue);
+ kfree(tu->tqueue);
+ kfree(tu);
+@@ -2027,7 +2028,7 @@ static int snd_timer_user_fasync(int fd, struct file * file, int on)
+ struct snd_timer_user *tu;
+
+ tu = file->private_data;
+- return fasync_helper(fd, file, on, &tu->fasync);
++ return snd_fasync_helper(fd, file, on, &tu->fasync);
+ }
+
+ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
+diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
+index a7f91be451946..5bd7b9b0e568d 100644
+--- a/sound/pci/hda/patch_cirrus.c
++++ b/sound/pci/hda/patch_cirrus.c
+@@ -409,6 +409,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
+
+ /* codec SSID */
+ SND_PCI_QUIRK(0x106b, 0x0600, "iMac 14,1", CS420X_IMAC27_122),
++ SND_PCI_QUIRK(0x106b, 0x0900, "iMac 12,1", CS420X_IMAC27_122),
+ SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
+ SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
+ SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index b4cd42643e1ef..b1a8ee8cf17e8 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -210,6 +210,7 @@ enum {
+ CXT_PINCFG_LEMOTE_A1205,
+ CXT_PINCFG_COMPAQ_CQ60,
+ CXT_FIXUP_STEREO_DMIC,
++ CXT_PINCFG_LENOVO_NOTEBOOK,
+ CXT_FIXUP_INC_MIC_BOOST,
+ CXT_FIXUP_HEADPHONE_MIC_PIN,
+ CXT_FIXUP_HEADPHONE_MIC,
+@@ -750,6 +751,14 @@ static const struct hda_fixup cxt_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = cxt_fixup_stereo_dmic,
+ },
++ [CXT_PINCFG_LENOVO_NOTEBOOK] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x1a, 0x05d71030 },
++ { }
++ },
++ .chain_id = CXT_FIXUP_STEREO_DMIC,
++ },
+ [CXT_FIXUP_INC_MIC_BOOST] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = cxt5066_increase_mic_boost,
+@@ -943,7 +952,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
+- SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
++ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_PINCFG_LENOVO_NOTEBOOK),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
+diff --git a/sound/soc/codecs/da7210.c b/sound/soc/codecs/da7210.c
+index e172913d04a4a..efc5049c0796e 100644
+--- a/sound/soc/codecs/da7210.c
++++ b/sound/soc/codecs/da7210.c
+@@ -1333,6 +1333,8 @@ static int __init da7210_modinit(void)
+ int ret = 0;
+ #if IS_ENABLED(CONFIG_I2C)
+ ret = i2c_add_driver(&da7210_i2c_driver);
++ if (ret)
++ return ret;
+ #endif
+ #if defined(CONFIG_SPI_MASTER)
+ ret = spi_register_driver(&da7210_spi_driver);
+diff --git a/sound/soc/mediatek/mt6797/mt6797-mt6351.c b/sound/soc/mediatek/mt6797/mt6797-mt6351.c
+index b1558c57b9ca7..0c49e1a9a8971 100644
+--- a/sound/soc/mediatek/mt6797/mt6797-mt6351.c
++++ b/sound/soc/mediatek/mt6797/mt6797-mt6351.c
+@@ -179,7 +179,8 @@ static int mt6797_mt6351_dev_probe(struct platform_device *pdev)
+ if (!codec_node) {
+ dev_err(&pdev->dev,
+ "Property 'audio-codec' missing or invalid\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_platform_node;
+ }
+ for (i = 0; i < card->num_links; i++) {
+ if (mt6797_mt6351_dai_links[i].codec_name)
+@@ -192,6 +193,9 @@ static int mt6797_mt6351_dev_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+ __func__, ret);
+
++ of_node_put(codec_node);
++put_platform_node:
++ of_node_put(platform_node);
+ return ret;
+ }
+
+diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
+index 242f99716c619..c37c962173d98 100644
+--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
+@@ -245,14 +245,16 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev)
+ if (!mt8173_rt5650_rt5676_codecs[0].of_node) {
+ dev_err(&pdev->dev,
+ "Property 'audio-codec' missing or invalid\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_node;
+ }
+ mt8173_rt5650_rt5676_codecs[1].of_node =
+ of_parse_phandle(pdev->dev.of_node, "mediatek,audio-codec", 1);
+ if (!mt8173_rt5650_rt5676_codecs[1].of_node) {
+ dev_err(&pdev->dev,
+ "Property 'audio-codec' missing or invalid\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_node;
+ }
+ mt8173_rt5650_rt5676_codec_conf[0].of_node =
+ mt8173_rt5650_rt5676_codecs[1].of_node;
+@@ -265,7 +267,8 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev)
+ if (!mt8173_rt5650_rt5676_dais[DAI_LINK_HDMI_I2S].codec_of_node) {
+ dev_err(&pdev->dev,
+ "Property 'audio-codec' missing or invalid\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_node;
+ }
+
+ card->dev = &pdev->dev;
+@@ -275,6 +278,7 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+ __func__, ret);
+
++put_node:
+ of_node_put(platform_node);
+ return ret;
+ }
+diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
+index 14011a70bcc41..8b613f8627fab 100644
+--- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c
++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
+@@ -260,7 +260,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev)
+ if (!mt8173_rt5650_codecs[0].of_node) {
+ dev_err(&pdev->dev,
+ "Property 'audio-codec' missing or invalid\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_platform_node;
+ }
+ mt8173_rt5650_codecs[1].of_node = mt8173_rt5650_codecs[0].of_node;
+
+@@ -272,7 +273,7 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev,
+ "%s codec_capture_dai name fail %d\n",
+ __func__, ret);
+- return ret;
++ goto put_platform_node;
+ }
+ mt8173_rt5650_codecs[1].dai_name = codec_capture_dai;
+ }
+@@ -293,7 +294,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev)
+ if (!mt8173_rt5650_dais[DAI_LINK_HDMI_I2S].codec_of_node) {
+ dev_err(&pdev->dev,
+ "Property 'audio-codec' missing or invalid\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto put_platform_node;
+ }
+ card->dev = &pdev->dev;
+
+@@ -302,6 +304,7 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+ __func__, ret);
+
++put_platform_node:
+ of_node_put(platform_node);
+ return ret;
+ }
+diff --git a/sound/soc/qcom/qdsp6/q6adm.c b/sound/soc/qcom/qdsp6/q6adm.c
+index 932c3ebfd2524..01f9127daf5c8 100644
+--- a/sound/soc/qcom/qdsp6/q6adm.c
++++ b/sound/soc/qcom/qdsp6/q6adm.c
+@@ -218,7 +218,7 @@ static struct q6copp *q6adm_alloc_copp(struct q6adm *adm, int port_idx)
+ idx = find_first_zero_bit(&adm->copp_bitmap[port_idx],
+ MAX_COPPS_PER_PORT);
+
+- if (idx > MAX_COPPS_PER_PORT)
++ if (idx >= MAX_COPPS_PER_PORT)
+ return ERR_PTR(-EBUSY);
+
+ c = kzalloc(sizeof(*c), GFP_ATOMIC);
+diff --git a/sound/usb/bcd2000/bcd2000.c b/sound/usb/bcd2000/bcd2000.c
+index d6c8b29fe430b..bdab5426aa170 100644
+--- a/sound/usb/bcd2000/bcd2000.c
++++ b/sound/usb/bcd2000/bcd2000.c
+@@ -357,7 +357,8 @@ static int bcd2000_init_midi(struct bcd2000 *bcd2k)
+ static void bcd2000_free_usb_related_resources(struct bcd2000 *bcd2k,
+ struct usb_interface *interface)
+ {
+- /* usb_kill_urb not necessary, urb is aborted automatically */
++ usb_kill_urb(bcd2k->midi_out_urb);
++ usb_kill_urb(bcd2k->midi_in_urb);
+
+ usb_free_urb(bcd2k->midi_out_urb);
+ usb_free_urb(bcd2k->midi_in_urb);
+diff --git a/tools/build/feature/test-libcrypto.c b/tools/build/feature/test-libcrypto.c
+index a98174e0569c8..bc34a5bbb5049 100644
+--- a/tools/build/feature/test-libcrypto.c
++++ b/tools/build/feature/test-libcrypto.c
+@@ -1,16 +1,23 @@
+ // SPDX-License-Identifier: GPL-2.0
++#include <openssl/evp.h>
+ #include <openssl/sha.h>
+ #include <openssl/md5.h>
+
+ int main(void)
+ {
+- MD5_CTX context;
++ EVP_MD_CTX *mdctx;
+ unsigned char md[MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH];
+ unsigned char dat[] = "12345";
++ unsigned int digest_len;
+
+- MD5_Init(&context);
+- MD5_Update(&context, &dat[0], sizeof(dat));
+- MD5_Final(&md[0], &context);
++ mdctx = EVP_MD_CTX_new();
++ if (!mdctx)
++ return 0;
++
++ EVP_DigestInit_ex(mdctx, EVP_md5(), NULL);
++ EVP_DigestUpdate(mdctx, &dat[0], sizeof(dat));
++ EVP_DigestFinal_ex(mdctx, &md[0], &digest_len);
++ EVP_MD_CTX_free(mdctx);
+
+ SHA1(&dat[0], sizeof(dat), &md[0]);
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 249fa8d7376e3..76cf63705c86a 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1060,7 +1060,7 @@ static int bpf_map_find_btf_info(struct bpf_map *map, const struct btf *btf)
+ int bpf_map__reuse_fd(struct bpf_map *map, int fd)
+ {
+ struct bpf_map_info info = {};
+- __u32 len = sizeof(info);
++ __u32 len = sizeof(info), name_len;
+ int new_fd, err;
+ char *new_name;
+
+@@ -1068,7 +1068,12 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd)
+ if (err)
+ return err;
+
+- new_name = strdup(info.name);
++ name_len = strlen(info.name);
++ if (name_len == BPF_OBJ_NAME_LEN - 1 && strncmp(map->name, info.name, name_len) == 0)
++ new_name = strdup(map->name);
++ else
++ new_name = strdup(info.name);
++
+ if (!new_name)
+ return -errno;
+
+diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c
+index aafbe54fd3fae..afb8fe3a8e353 100644
+--- a/tools/perf/util/genelf.c
++++ b/tools/perf/util/genelf.c
+@@ -35,7 +35,11 @@
+
+ #define BUILD_ID_URANDOM /* different uuid for each run */
+
+-#ifdef HAVE_LIBCRYPTO
++// FIXME, remove this and fix the deprecation warnings before its removed and
++// We'll break for good here...
++#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
++
++#ifdef HAVE_LIBCRYPTO_SUPPORT
+
+ #define BUILD_ID_MD5
+ #undef BUILD_ID_SHA /* does not seem to work well when linked with Java */
+diff --git a/tools/testing/selftests/timers/clocksource-switch.c b/tools/testing/selftests/timers/clocksource-switch.c
+index bfc974b4572d5..c18313a5f357b 100644
+--- a/tools/testing/selftests/timers/clocksource-switch.c
++++ b/tools/testing/selftests/timers/clocksource-switch.c
+@@ -110,10 +110,10 @@ int run_tests(int secs)
+
+ sprintf(buf, "./inconsistency-check -t %i", secs);
+ ret = system(buf);
+- if (ret)
+- return ret;
++ if (WIFEXITED(ret) && WEXITSTATUS(ret))
++ return WEXITSTATUS(ret);
+ ret = system("./nanosleep");
+- return ret;
++ return WIFEXITED(ret) ? WEXITSTATUS(ret) : 0;
+ }
+
+
+diff --git a/tools/testing/selftests/timers/valid-adjtimex.c b/tools/testing/selftests/timers/valid-adjtimex.c
+index 5397de708d3c2..48b9a803235a8 100644
+--- a/tools/testing/selftests/timers/valid-adjtimex.c
++++ b/tools/testing/selftests/timers/valid-adjtimex.c
+@@ -40,7 +40,7 @@
+ #define ADJ_SETOFFSET 0x0100
+
+ #include <sys/syscall.h>
+-static int clock_adjtime(clockid_t id, struct timex *tx)
++int clock_adjtime(clockid_t id, struct timex *tx)
+ {
+ return syscall(__NR_clock_adjtime, id, tx);
+ }
+diff --git a/tools/thermal/tmon/sysfs.c b/tools/thermal/tmon/sysfs.c
+index 18f523557983b..1b17cbc54c9d7 100644
+--- a/tools/thermal/tmon/sysfs.c
++++ b/tools/thermal/tmon/sysfs.c
+@@ -22,6 +22,7 @@
+ #include <stdint.h>
+ #include <dirent.h>
+ #include <libintl.h>
++#include <limits.h>
+ #include <ctype.h>
+ #include <time.h>
+ #include <syslog.h>
+@@ -42,9 +43,9 @@ int sysfs_set_ulong(char *path, char *filename, unsigned long val)
+ {
+ FILE *fd;
+ int ret = -1;
+- char filepath[256];
++ char filepath[PATH_MAX + 2]; /* NUL and '/' */
+
+- snprintf(filepath, 256, "%s/%s", path, filename);
++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename);
+
+ fd = fopen(filepath, "w");
+ if (!fd) {
+@@ -66,9 +67,9 @@ static int sysfs_get_ulong(char *path, char *filename, unsigned long *p_ulong)
+ {
+ FILE *fd;
+ int ret = -1;
+- char filepath[256];
++ char filepath[PATH_MAX + 2]; /* NUL and '/' */
+
+- snprintf(filepath, 256, "%s/%s", path, filename);
++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename);
+
+ fd = fopen(filepath, "r");
+ if (!fd) {
+@@ -85,9 +86,9 @@ static int sysfs_get_string(char *path, char *filename, char *str)
+ {
+ FILE *fd;
+ int ret = -1;
+- char filepath[256];
++ char filepath[PATH_MAX + 2]; /* NUL and '/' */
+
+- snprintf(filepath, 256, "%s/%s", path, filename);
++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename);
+
+ fd = fopen(filepath, "r");
+ if (!fd) {
+@@ -208,8 +209,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name,
+ {
+ unsigned long trip_instance = 0;
+ char cdev_name_linked[256];
+- char cdev_name[256];
+- char cdev_trip_name[256];
++ char cdev_name[PATH_MAX];
++ char cdev_trip_name[PATH_MAX];
+ int cdev_id;
+
+ if (nl->d_type == DT_LNK) {
+@@ -222,7 +223,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name,
+ return -EINVAL;
+ }
+ /* find the link to real cooling device record binding */
+- snprintf(cdev_name, 256, "%s/%s", tz_name, nl->d_name);
++ snprintf(cdev_name, sizeof(cdev_name) - 2, "%s/%s",
++ tz_name, nl->d_name);
+ memset(cdev_name_linked, 0, sizeof(cdev_name_linked));
+ if (readlink(cdev_name, cdev_name_linked,
+ sizeof(cdev_name_linked) - 1) != -1) {
+@@ -235,8 +237,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name,
+ /* find the trip point in which the cdev is binded to
+ * in this tzone
+ */
+- snprintf(cdev_trip_name, 256, "%s%s", nl->d_name,
+- "_trip_point");
++ snprintf(cdev_trip_name, sizeof(cdev_trip_name) - 1,
++ "%s%s", nl->d_name, "_trip_point");
+ sysfs_get_ulong(tz_name, cdev_trip_name,
+ &trip_instance);
+ /* validate trip point range, e.g. trip could return -1
+diff --git a/tools/thermal/tmon/tmon.h b/tools/thermal/tmon/tmon.h
+index 9e3c49c547ac8..7b090a6c95b69 100644
+--- a/tools/thermal/tmon/tmon.h
++++ b/tools/thermal/tmon/tmon.h
+@@ -36,6 +36,9 @@
+ #define NR_LINES_TZDATA 1
+ #define TMON_LOG_FILE "/var/tmp/tmon.log"
+
++#include <sys/time.h>
++#include <pthread.h>
++
+ extern unsigned long ticktime;
+ extern double time_elapsed;
+ extern unsigned long target_temp_user;
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 3d45ce1342278..6f9c0060a3e59 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2820,7 +2820,7 @@ static long kvm_vcpu_ioctl(struct file *filp,
+ struct kvm_fpu *fpu = NULL;
+ struct kvm_sregs *kvm_sregs = NULL;
+
+- if (vcpu->kvm->mm != current->mm)
++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged)
+ return -EIO;
+
+ if (unlikely(_IOC_TYPE(ioctl) != KVMIO))
+@@ -3026,7 +3026,7 @@ static long kvm_vcpu_compat_ioctl(struct file *filp,
+ void __user *argp = compat_ptr(arg);
+ int r;
+
+- if (vcpu->kvm->mm != current->mm)
++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged)
+ return -EIO;
+
+ switch (ioctl) {
+@@ -3081,7 +3081,7 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl,
+ {
+ struct kvm_device *dev = filp->private_data;
+
+- if (dev->kvm->mm != current->mm)
++ if (dev->kvm->mm != current->mm || dev->kvm->vm_bugged)
+ return -EIO;
+
+ switch (ioctl) {
+@@ -3244,7 +3244,7 @@ static long kvm_vm_ioctl(struct file *filp,
+ void __user *argp = (void __user *)arg;
+ int r;
+
+- if (kvm->mm != current->mm)
++ if (kvm->mm != current->mm || kvm->vm_bugged)
+ return -EIO;
+ switch (ioctl) {
+ case KVM_CREATE_VCPU:
+@@ -3422,7 +3422,7 @@ static long kvm_vm_compat_ioctl(struct file *filp,
+ struct kvm *kvm = filp->private_data;
+ int r;
+
+- if (kvm->mm != current->mm)
++ if (kvm->mm != current->mm || kvm->vm_bugged)
+ return -EIO;
+ switch (ioctl) {
+ case KVM_GET_DIRTY_LOG: {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-09-05 12:06 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-09-05 12:06 UTC (permalink / raw
To: gentoo-commits
commit: ea21b2e23e5097ddcbc070fe25f180daae7f821f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Sep 5 12:05:47 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Sep 5 12:05:47 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ea21b2e2
Linux patch 4.19.257
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1256_linux-4.19.257.patch | 2134 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2138 insertions(+)
diff --git a/0000_README b/0000_README
index b20110e2..dff212f8 100644
--- a/0000_README
+++ b/0000_README
@@ -1067,6 +1067,10 @@ Patch: 1255_linux-4.19.256.patch
From: https://www.kernel.org
Desc: Linux 4.19.256
+Patch: 1256_linux-4.19.257.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.257
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1256_linux-4.19.257.patch b/1256_linux-4.19.257.patch
new file mode 100644
index 00000000..7b7b81b6
--- /dev/null
+++ b/1256_linux-4.19.257.patch
@@ -0,0 +1,2134 @@
+diff --git a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst
+index 9393c50b5afc9..c98fd11907cc8 100644
+--- a/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst
++++ b/Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst
+@@ -230,6 +230,20 @@ The possible values in this file are:
+ * - 'Mitigation: Clear CPU buffers'
+ - The processor is vulnerable and the CPU buffer clearing mitigation is
+ enabled.
++ * - 'Unknown: No mitigations'
++ - The processor vulnerability status is unknown because it is
++ out of Servicing period. Mitigation is not attempted.
++
++Definitions:
++------------
++
++Servicing period: The process of providing functional and security updates to
++Intel processors or platforms, utilizing the Intel Platform Update (IPU)
++process or other similar mechanisms.
++
++End of Servicing Updates (ESU): ESU is the date at which Intel will no
++longer provide Servicing, such as through IPU or other similar update
++processes. ESU dates will typically be aligned to end of quarter.
+
+ If the processor is vulnerable then the following information is appended to
+ the above information:
+diff --git a/Makefile b/Makefile
+index ac79aef4520be..18ccab9a01b06 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 256
++SUBLEVEL = 257
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h
+index b37d185e0e841..3dda6ff32efd7 100644
+--- a/arch/arm64/include/asm/mmu.h
++++ b/arch/arm64/include/asm/mmu.h
+@@ -98,7 +98,7 @@ extern void init_mem_pgprot(void);
+ extern void create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys,
+ unsigned long virt, phys_addr_t size,
+ pgprot_t prot, bool page_mappings_only);
+-extern void *fixmap_remap_fdt(phys_addr_t dt_phys);
++extern void *fixmap_remap_fdt(phys_addr_t dt_phys, int *size, pgprot_t prot);
+ extern void mark_linear_text_alias_ro(void);
+
+ #endif /* !__ASSEMBLY__ */
+diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
+index 06941c1fe418e..92bb53460401c 100644
+--- a/arch/arm64/kernel/kaslr.c
++++ b/arch/arm64/kernel/kaslr.c
+@@ -65,9 +65,6 @@ out:
+ return default_cmdline;
+ }
+
+-extern void *__init __fixmap_remap_fdt(phys_addr_t dt_phys, int *size,
+- pgprot_t prot);
+-
+ /*
+ * This routine will be executed with the kernel mapped at its default virtual
+ * address, and if it returns successfully, the kernel will be remapped, and
+@@ -96,7 +93,7 @@ u64 __init kaslr_early_init(u64 dt_phys)
+ * attempt at mapping the FDT in setup_machine()
+ */
+ early_fixmap_init();
+- fdt = __fixmap_remap_fdt(dt_phys, &size, PAGE_KERNEL);
++ fdt = fixmap_remap_fdt(dt_phys, &size, PAGE_KERNEL);
+ if (!fdt)
+ return 0;
+
+diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
+index b3354ff94e798..43e9786f1d604 100644
+--- a/arch/arm64/kernel/setup.c
++++ b/arch/arm64/kernel/setup.c
+@@ -183,9 +183,13 @@ static void __init smp_build_mpidr_hash(void)
+
+ static void __init setup_machine_fdt(phys_addr_t dt_phys)
+ {
+- void *dt_virt = fixmap_remap_fdt(dt_phys);
++ int size;
++ void *dt_virt = fixmap_remap_fdt(dt_phys, &size, PAGE_KERNEL);
+ const char *name;
+
++ if (dt_virt)
++ memblock_reserve(dt_phys, size);
++
+ if (!dt_virt || !early_init_dt_scan(dt_virt)) {
+ pr_crit("\n"
+ "Error: invalid device tree blob at physical address %pa (virtual address 0x%p)\n"
+@@ -197,6 +201,9 @@ static void __init setup_machine_fdt(phys_addr_t dt_phys)
+ cpu_relax();
+ }
+
++ /* Early fixups are done, map the FDT as read-only now */
++ fixmap_remap_fdt(dt_phys, &size, PAGE_KERNEL_RO);
++
+ name = of_flat_dt_get_machine_name();
+ if (!name)
+ return;
+diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
+index b0a83dbed2dc4..7042fbb6d92ba 100644
+--- a/arch/arm64/mm/mmu.c
++++ b/arch/arm64/mm/mmu.c
+@@ -859,7 +859,7 @@ void __set_fixmap(enum fixed_addresses idx,
+ }
+ }
+
+-void *__init __fixmap_remap_fdt(phys_addr_t dt_phys, int *size, pgprot_t prot)
++void *__init fixmap_remap_fdt(phys_addr_t dt_phys, int *size, pgprot_t prot)
+ {
+ const u64 dt_virt_base = __fix_to_virt(FIX_FDT);
+ int offset;
+@@ -912,19 +912,6 @@ void *__init __fixmap_remap_fdt(phys_addr_t dt_phys, int *size, pgprot_t prot)
+ return dt_virt;
+ }
+
+-void *__init fixmap_remap_fdt(phys_addr_t dt_phys)
+-{
+- void *dt_virt;
+- int size;
+-
+- dt_virt = __fixmap_remap_fdt(dt_phys, &size, PAGE_KERNEL_RO);
+- if (!dt_virt)
+- return NULL;
+-
+- memblock_reserve(dt_phys, size);
+- return dt_virt;
+-}
+-
+ int __init arch_ioremap_pud_supported(void)
+ {
+ /*
+diff --git a/arch/parisc/kernel/unaligned.c b/arch/parisc/kernel/unaligned.c
+index c16af267362e4..a8b5ad11c7a41 100644
+--- a/arch/parisc/kernel/unaligned.c
++++ b/arch/parisc/kernel/unaligned.c
+@@ -121,7 +121,7 @@
+ #define R1(i) (((i)>>21)&0x1f)
+ #define R2(i) (((i)>>16)&0x1f)
+ #define R3(i) ((i)&0x1f)
+-#define FR3(i) ((((i)<<1)&0x1f)|(((i)>>6)&1))
++#define FR3(i) ((((i)&0x1f)<<1)|(((i)>>6)&1))
+ #define IM(i,n) (((i)>>1&((1<<(n-1))-1))|((i)&1?((0-1L)<<(n-1)):0))
+ #define IM5_2(i) IM((i)>>16,5)
+ #define IM5_3(i) IM((i),5)
+diff --git a/arch/s390/hypfs/hypfs_diag.c b/arch/s390/hypfs/hypfs_diag.c
+index 3452e18bb1ca8..38105ba35c814 100644
+--- a/arch/s390/hypfs/hypfs_diag.c
++++ b/arch/s390/hypfs/hypfs_diag.c
+@@ -437,7 +437,7 @@ __init int hypfs_diag_init(void)
+ int rc;
+
+ if (diag204_probe()) {
+- pr_err("The hardware system does not support hypfs\n");
++ pr_info("The hardware system does not support hypfs\n");
+ return -ENODATA;
+ }
+ if (diag204_info_type == DIAG204_INFO_EXT) {
+diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c
+index e4d17d9ea93d8..4af5c0dd9fbe2 100644
+--- a/arch/s390/hypfs/inode.c
++++ b/arch/s390/hypfs/inode.c
+@@ -494,9 +494,9 @@ fail_hypfs_vm_exit:
+ hypfs_vm_exit();
+ fail_hypfs_diag_exit:
+ hypfs_diag_exit();
++ pr_err("Initialization of hypfs failed with rc=%i\n", rc);
+ fail_dbfs_exit:
+ hypfs_dbfs_exit();
+- pr_err("Initialization of hypfs failed with rc=%i\n", rc);
+ return rc;
+ }
+ device_initcall(hypfs_init)
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index 99ef537e548a3..5772ef90dd26c 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -75,6 +75,18 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+
+ memcpy(dst, src, arch_task_struct_size);
+ dst->thread.fpu.regs = dst->thread.fpu.fprs;
++
++ /*
++ * Don't transfer over the runtime instrumentation or the guarded
++ * storage control block pointers. These fields are cleared here instead
++ * of in copy_thread() to avoid premature freeing of associated memory
++ * on fork() failure. Wait to clear the RI flag because ->stack still
++ * refers to the source thread.
++ */
++ dst->thread.ri_cb = NULL;
++ dst->thread.gs_cb = NULL;
++ dst->thread.gs_bc_cb = NULL;
++
+ return 0;
+ }
+
+@@ -131,13 +143,11 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long new_stackp,
+ frame->childregs.flags = 0;
+ if (new_stackp)
+ frame->childregs.gprs[15] = new_stackp;
+-
+- /* Don't copy runtime instrumentation info */
+- p->thread.ri_cb = NULL;
++ /*
++ * Clear the runtime instrumentation flag after the above childregs
++ * copy. The CB pointer was already cleared in arch_dup_task_struct().
++ */
+ frame->childregs.psw.mask &= ~PSW_MASK_RI;
+- /* Don't copy guarded storage control block */
+- p->thread.gs_cb = NULL;
+- p->thread.gs_bc_cb = NULL;
+
+ /* Set a new TLS ? */
+ if (clone_flags & CLONE_SETTLS) {
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index a6e3c7022245d..d64b180caedaf 100644
+--- a/arch/s390/mm/fault.c
++++ b/arch/s390/mm/fault.c
+@@ -455,7 +455,9 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access)
+ flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+ if (user_mode(regs))
+ flags |= FAULT_FLAG_USER;
+- if (access == VM_WRITE || (trans_exc_code & store_indication) == 0x400)
++ if ((trans_exc_code & store_indication) == 0x400)
++ access = VM_WRITE;
++ if (access == VM_WRITE)
+ flags |= FAULT_FLAG_WRITE;
+ down_read(&mm->mmap_sem);
+
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 89145ea183d6d..e9b79bac9b2af 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -396,6 +396,7 @@
+ #define X86_BUG_ITLB_MULTIHIT X86_BUG(23) /* CPU may incur MCE during certain page attribute changes */
+ #define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */
+ #define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */
+-#define X86_BUG_EIBRS_PBRSB X86_BUG(26) /* EIBRS is vulnerable to Post Barrier RSB Predictions */
++#define X86_BUG_MMIO_UNKNOWN X86_BUG(26) /* CPU is too old and its MMIO Stale Data status is unknown */
++#define X86_BUG_EIBRS_PBRSB X86_BUG(27) /* EIBRS is vulnerable to Post Barrier RSB Predictions */
+
+ #endif /* _ASM_X86_CPUFEATURES_H */
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index a36be67860432..501d09d59abcc 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -396,7 +396,8 @@ static void __init mmio_select_mitigation(void)
+ u64 ia32_cap;
+
+ if (!boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA) ||
+- cpu_mitigations_off()) {
++ boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN) ||
++ cpu_mitigations_off()) {
+ mmio_mitigation = MMIO_MITIGATION_OFF;
+ return;
+ }
+@@ -501,6 +502,8 @@ out:
+ pr_info("TAA: %s\n", taa_strings[taa_mitigation]);
+ if (boot_cpu_has_bug(X86_BUG_MMIO_STALE_DATA))
+ pr_info("MMIO Stale Data: %s\n", mmio_strings[mmio_mitigation]);
++ else if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN))
++ pr_info("MMIO Stale Data: Unknown: No mitigations\n");
+ }
+
+ static void __init md_clear_select_mitigation(void)
+@@ -1868,6 +1871,9 @@ static ssize_t tsx_async_abort_show_state(char *buf)
+
+ static ssize_t mmio_stale_data_show_state(char *buf)
+ {
++ if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN))
++ return sysfs_emit(buf, "Unknown: No mitigations\n");
++
+ if (mmio_mitigation == MMIO_MITIGATION_OFF)
+ return sysfs_emit(buf, "%s\n", mmio_strings[mmio_mitigation]);
+
+@@ -1995,6 +2001,7 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ return srbds_show_state(buf);
+
+ case X86_BUG_MMIO_STALE_DATA:
++ case X86_BUG_MMIO_UNKNOWN:
+ return mmio_stale_data_show_state(buf);
+
+ default:
+@@ -2051,6 +2058,9 @@ ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr, char *
+
+ ssize_t cpu_show_mmio_stale_data(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+- return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA);
++ if (boot_cpu_has_bug(X86_BUG_MMIO_UNKNOWN))
++ return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_UNKNOWN);
++ else
++ return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA);
+ }
+ #endif
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 3ab35d5426b76..653ced7cb3964 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -955,6 +955,7 @@ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
+ #define NO_SWAPGS BIT(6)
+ #define NO_ITLB_MULTIHIT BIT(7)
+ #define NO_EIBRS_PBRSB BIT(8)
++#define NO_MMIO BIT(9)
+
+ #define VULNWL(_vendor, _family, _model, _whitelist) \
+ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist }
+@@ -972,6 +973,11 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+ VULNWL(NSC, 5, X86_MODEL_ANY, NO_SPECULATION),
+
+ /* Intel Family 6 */
++ VULNWL_INTEL(TIGERLAKE, NO_MMIO),
++ VULNWL_INTEL(TIGERLAKE_L, NO_MMIO),
++ VULNWL_INTEL(ALDERLAKE, NO_MMIO),
++ VULNWL_INTEL(ALDERLAKE_L, NO_MMIO),
++
+ VULNWL_INTEL(ATOM_SALTWELL, NO_SPECULATION | NO_ITLB_MULTIHIT),
+ VULNWL_INTEL(ATOM_SALTWELL_TABLET, NO_SPECULATION | NO_ITLB_MULTIHIT),
+ VULNWL_INTEL(ATOM_SALTWELL_MID, NO_SPECULATION | NO_ITLB_MULTIHIT),
+@@ -989,9 +995,9 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+
+ VULNWL_INTEL(ATOM_AIRMONT_MID, NO_L1TF | MSBDS_ONLY | NO_SWAPGS | NO_ITLB_MULTIHIT),
+
+- VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT),
+- VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT),
+- VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB),
++ VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
++ VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
++ VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO | NO_EIBRS_PBRSB),
+
+ /*
+ * Technically, swapgs isn't serializing on AMD (despite it previously
+@@ -1006,13 +1012,13 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+ VULNWL_INTEL(ATOM_TREMONT_X, NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB),
+
+ /* AMD Family 0xf - 0x12 */
+- VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
+- VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
+- VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
+- VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
++ VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
++ VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
++ VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
+
+ /* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */
+- VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT),
++ VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_MMIO),
+ {}
+ };
+
+@@ -1152,10 +1158,16 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ * Affected CPU list is generally enough to enumerate the vulnerability,
+ * but for virtualization case check for ARCH_CAP MSR bits also, VMM may
+ * not want the guest to enumerate the bug.
++ *
++ * Set X86_BUG_MMIO_UNKNOWN for CPUs that are neither in the blacklist,
++ * nor in the whitelist and also don't enumerate MSR ARCH_CAP MMIO bits.
+ */
+- if (cpu_matches(cpu_vuln_blacklist, MMIO) &&
+- !arch_cap_mmio_immune(ia32_cap))
+- setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);
++ if (!arch_cap_mmio_immune(ia32_cap)) {
++ if (cpu_matches(cpu_vuln_blacklist, MMIO))
++ setup_force_cpu_bug(X86_BUG_MMIO_STALE_DATA);
++ else if (!cpu_matches(cpu_vuln_whitelist, NO_MMIO))
++ setup_force_cpu_bug(X86_BUG_MMIO_UNKNOWN);
++ }
+
+ if (cpu_has(c, X86_FEATURE_IBRS_ENHANCED) &&
+ !cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) &&
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 4f17c1c949498..5c48d2c4cabe6 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -89,22 +89,27 @@ static struct orc_entry *orc_find(unsigned long ip);
+ static struct orc_entry *orc_ftrace_find(unsigned long ip)
+ {
+ struct ftrace_ops *ops;
+- unsigned long caller;
++ unsigned long tramp_addr, offset;
+
+ ops = ftrace_ops_trampoline(ip);
+ if (!ops)
+ return NULL;
+
++ /* Set tramp_addr to the start of the code copied by the trampoline */
+ if (ops->flags & FTRACE_OPS_FL_SAVE_REGS)
+- caller = (unsigned long)ftrace_regs_call;
++ tramp_addr = (unsigned long)ftrace_regs_caller;
+ else
+- caller = (unsigned long)ftrace_call;
++ tramp_addr = (unsigned long)ftrace_caller;
++
++ /* Now place tramp_addr to the location within the trampoline ip is at */
++ offset = ip - ops->trampoline;
++ tramp_addr += offset;
+
+ /* Prevent unlikely recursion */
+- if (ip == caller)
++ if (ip == tramp_addr)
+ return NULL;
+
+- return orc_find(caller);
++ return orc_find(tramp_addr);
+ }
+ #else
+ static struct orc_entry *orc_ftrace_find(unsigned long ip)
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index c31a76485c9cb..12eb48980df7b 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1351,6 +1351,11 @@ loop_get_status(struct loop_device *lo, struct loop_info64 *info)
+ info->lo_number = lo->lo_number;
+ info->lo_offset = lo->lo_offset;
+ info->lo_sizelimit = lo->lo_sizelimit;
++
++ /* loff_t vars have been assigned __u64 */
++ if (lo->lo_offset < 0 || lo->lo_sizelimit < 0)
++ return -EOVERFLOW;
++
+ info->lo_flags = lo->lo_flags;
+ memcpy(info->lo_file_name, lo->lo_file_name, LO_NAME_SIZE);
+ memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE);
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
+index 411f89218e019..cb5c44b339e09 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
+@@ -452,6 +452,11 @@ void optc1_enable_optc_clock(struct timing_generator *optc, bool enable)
+ OTG_CLOCK_ON, 1,
+ 1, 1000);
+ } else {
++
++ //last chance to clear underflow, otherwise, it will always there due to clock is off.
++ if (optc->funcs->is_optc_underflow_occurred(optc) == true)
++ optc->funcs->clear_optc_underflow(optc);
++
+ REG_UPDATE_2(OTG_CLOCK_CONTROL,
+ OTG_CLOCK_GATE_DIS, 0,
+ OTG_CLOCK_EN, 0);
+diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
+index a3b151b29bd71..fc616db4231bb 100644
+--- a/drivers/hid/hid-steam.c
++++ b/drivers/hid/hid-steam.c
+@@ -134,6 +134,11 @@ static int steam_recv_report(struct steam_device *steam,
+ int ret;
+
+ r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0];
++ if (!r) {
++ hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n");
++ return -EINVAL;
++ }
++
+ if (hid_report_len(r) < 64)
+ return -EINVAL;
+
+@@ -165,6 +170,11 @@ static int steam_send_report(struct steam_device *steam,
+ int ret;
+
+ r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0];
++ if (!r) {
++ hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n");
++ return -EINVAL;
++ }
++
+ if (hid_report_len(r) < 64)
+ return -EINVAL;
+
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index c4ba2d28dd731..6a5c5ce85d85b 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -354,10 +354,13 @@ static int hidraw_release(struct inode * inode, struct file * file)
+ unsigned int minor = iminor(inode);
+ struct hidraw_list *list = file->private_data;
+ unsigned long flags;
++ int i;
+
+ mutex_lock(&minors_lock);
+
+ spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
++ for (i = list->tail; i < list->head; i++)
++ kfree(list->buffer[i].value);
+ list_del(&list->node);
+ spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
+ kfree(list);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 4594a1ee88b9b..38cbde9061339 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5937,6 +5937,7 @@ void md_stop(struct mddev *mddev)
+ /* stop the array and free an attached data structures.
+ * This is called from dm-raid
+ */
++ __md_stop_writes(mddev);
+ __md_stop(mddev);
+ bioset_exit(&mddev->bio_set);
+ bioset_exit(&mddev->sync_set);
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index bbb5ff16abd61..4cbb39bfb7da4 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -2602,6 +2602,7 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
+ del_timer_sync(&hdw->encoder_run_timer);
+ del_timer_sync(&hdw->encoder_wait_timer);
+ flush_work(&hdw->workpoll);
++ v4l2_device_unregister(&hdw->v4l2_dev);
+ usb_free_urb(hdw->ctl_read_urb);
+ usb_free_urb(hdw->ctl_write_urb);
+ kfree(hdw->ctl_read_buffer);
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index b3eaef31b7673..a6bb7e915f74f 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -1977,30 +1977,24 @@ void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout)
+ */
+ void bond_3ad_initialize(struct bonding *bond, u16 tick_resolution)
+ {
+- /* check that the bond is not initialized yet */
+- if (!MAC_ADDRESS_EQUAL(&(BOND_AD_INFO(bond).system.sys_mac_addr),
+- bond->dev->dev_addr)) {
+-
+- BOND_AD_INFO(bond).aggregator_identifier = 0;
+-
+- BOND_AD_INFO(bond).system.sys_priority =
+- bond->params.ad_actor_sys_prio;
+- if (is_zero_ether_addr(bond->params.ad_actor_system))
+- BOND_AD_INFO(bond).system.sys_mac_addr =
+- *((struct mac_addr *)bond->dev->dev_addr);
+- else
+- BOND_AD_INFO(bond).system.sys_mac_addr =
+- *((struct mac_addr *)bond->params.ad_actor_system);
++ BOND_AD_INFO(bond).aggregator_identifier = 0;
++ BOND_AD_INFO(bond).system.sys_priority =
++ bond->params.ad_actor_sys_prio;
++ if (is_zero_ether_addr(bond->params.ad_actor_system))
++ BOND_AD_INFO(bond).system.sys_mac_addr =
++ *((struct mac_addr *)bond->dev->dev_addr);
++ else
++ BOND_AD_INFO(bond).system.sys_mac_addr =
++ *((struct mac_addr *)bond->params.ad_actor_system);
+
+- /* initialize how many times this module is called in one
+- * second (should be about every 100ms)
+- */
+- ad_ticks_per_sec = tick_resolution;
++ /* initialize how many times this module is called in one
++ * second (should be about every 100ms)
++ */
++ ad_ticks_per_sec = tick_resolution;
+
+- bond_3ad_initiate_agg_selection(bond,
+- AD_AGGREGATOR_SELECTION_TIMER *
+- ad_ticks_per_sec);
+- }
++ bond_3ad_initiate_agg_selection(bond,
++ AD_AGGREGATOR_SELECTION_TIMER *
++ ad_ticks_per_sec);
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+index b3e0d8bb5cbd8..eec68cc9288c8 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+@@ -1066,7 +1066,6 @@ void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter)
+ struct cyclecounter cc;
+ unsigned long flags;
+ u32 incval = 0;
+- u32 tsauxc = 0;
+ u32 fuse0 = 0;
+
+ /* For some of the boards below this mask is technically incorrect.
+@@ -1101,18 +1100,6 @@ void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter)
+ case ixgbe_mac_x550em_a:
+ case ixgbe_mac_X550:
+ cc.read = ixgbe_ptp_read_X550;
+-
+- /* enable SYSTIME counter */
+- IXGBE_WRITE_REG(hw, IXGBE_SYSTIMR, 0);
+- IXGBE_WRITE_REG(hw, IXGBE_SYSTIML, 0);
+- IXGBE_WRITE_REG(hw, IXGBE_SYSTIMH, 0);
+- tsauxc = IXGBE_READ_REG(hw, IXGBE_TSAUXC);
+- IXGBE_WRITE_REG(hw, IXGBE_TSAUXC,
+- tsauxc & ~IXGBE_TSAUXC_DISABLE_SYSTIME);
+- IXGBE_WRITE_REG(hw, IXGBE_TSIM, IXGBE_TSIM_TXTS);
+- IXGBE_WRITE_REG(hw, IXGBE_EIMS, IXGBE_EIMS_TIMESYNC);
+-
+- IXGBE_WRITE_FLUSH(hw);
+ break;
+ case ixgbe_mac_X540:
+ cc.read = ixgbe_ptp_read_82599;
+@@ -1144,6 +1131,50 @@ void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter)
+ spin_unlock_irqrestore(&adapter->tmreg_lock, flags);
+ }
+
++/**
++ * ixgbe_ptp_init_systime - Initialize SYSTIME registers
++ * @adapter: the ixgbe private board structure
++ *
++ * Initialize and start the SYSTIME registers.
++ */
++static void ixgbe_ptp_init_systime(struct ixgbe_adapter *adapter)
++{
++ struct ixgbe_hw *hw = &adapter->hw;
++ u32 tsauxc;
++
++ switch (hw->mac.type) {
++ case ixgbe_mac_X550EM_x:
++ case ixgbe_mac_x550em_a:
++ case ixgbe_mac_X550:
++ tsauxc = IXGBE_READ_REG(hw, IXGBE_TSAUXC);
++
++ /* Reset SYSTIME registers to 0 */
++ IXGBE_WRITE_REG(hw, IXGBE_SYSTIMR, 0);
++ IXGBE_WRITE_REG(hw, IXGBE_SYSTIML, 0);
++ IXGBE_WRITE_REG(hw, IXGBE_SYSTIMH, 0);
++
++ /* Reset interrupt settings */
++ IXGBE_WRITE_REG(hw, IXGBE_TSIM, IXGBE_TSIM_TXTS);
++ IXGBE_WRITE_REG(hw, IXGBE_EIMS, IXGBE_EIMS_TIMESYNC);
++
++ /* Activate the SYSTIME counter */
++ IXGBE_WRITE_REG(hw, IXGBE_TSAUXC,
++ tsauxc & ~IXGBE_TSAUXC_DISABLE_SYSTIME);
++ break;
++ case ixgbe_mac_X540:
++ case ixgbe_mac_82599EB:
++ /* Reset SYSTIME registers to 0 */
++ IXGBE_WRITE_REG(hw, IXGBE_SYSTIML, 0);
++ IXGBE_WRITE_REG(hw, IXGBE_SYSTIMH, 0);
++ break;
++ default:
++ /* Other devices aren't supported */
++ return;
++ };
++
++ IXGBE_WRITE_FLUSH(hw);
++}
++
+ /**
+ * ixgbe_ptp_reset
+ * @adapter: the ixgbe private board structure
+@@ -1170,6 +1201,8 @@ void ixgbe_ptp_reset(struct ixgbe_adapter *adapter)
+
+ ixgbe_ptp_start_cyclecounter(adapter);
+
++ ixgbe_ptp_init_systime(adapter);
++
+ spin_lock_irqsave(&adapter->tmreg_lock, flags);
+ timecounter_init(&adapter->hw_tc, &adapter->hw_cc,
+ ktime_to_ns(ktime_get_real()));
+diff --git a/drivers/net/ipvlan/ipvtap.c b/drivers/net/ipvlan/ipvtap.c
+index 0bcc07f346c3e..2e517e30c5ac1 100644
+--- a/drivers/net/ipvlan/ipvtap.c
++++ b/drivers/net/ipvlan/ipvtap.c
+@@ -193,7 +193,7 @@ static struct notifier_block ipvtap_notifier_block __read_mostly = {
+ .notifier_call = ipvtap_device_event,
+ };
+
+-static int ipvtap_init(void)
++static int __init ipvtap_init(void)
+ {
+ int err;
+
+@@ -227,7 +227,7 @@ out1:
+ }
+ module_init(ipvtap_init);
+
+-static void ipvtap_exit(void)
++static void __exit ipvtap_exit(void)
+ {
+ rtnl_link_unregister(&ipvtap_link_ops);
+ unregister_netdevice_notifier(&ipvtap_notifier_block);
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index 8d2dbf607bd15..66b9c5826ec03 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -798,6 +798,7 @@ static int amd_gpio_suspend(struct device *dev)
+ struct platform_device *pdev = to_platform_device(dev);
+ struct amd_gpio *gpio_dev = platform_get_drvdata(pdev);
+ struct pinctrl_desc *desc = gpio_dev->pctrl->desc;
++ unsigned long flags;
+ int i;
+
+ for (i = 0; i < desc->npins; i++) {
+@@ -806,7 +807,9 @@ static int amd_gpio_suspend(struct device *dev)
+ if (!amd_gpio_should_save(gpio_dev, pin))
+ continue;
+
+- gpio_dev->saved_regs[i] = readl(gpio_dev->base + pin*4);
++ raw_spin_lock_irqsave(&gpio_dev->lock, flags);
++ gpio_dev->saved_regs[i] = readl(gpio_dev->base + pin * 4) & ~PIN_IRQ_PENDING;
++ raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
+ }
+
+ return 0;
+@@ -817,6 +820,7 @@ static int amd_gpio_resume(struct device *dev)
+ struct platform_device *pdev = to_platform_device(dev);
+ struct amd_gpio *gpio_dev = platform_get_drvdata(pdev);
+ struct pinctrl_desc *desc = gpio_dev->pctrl->desc;
++ unsigned long flags;
+ int i;
+
+ for (i = 0; i < desc->npins; i++) {
+@@ -825,7 +829,10 @@ static int amd_gpio_resume(struct device *dev)
+ if (!amd_gpio_should_save(gpio_dev, pin))
+ continue;
+
+- writel(gpio_dev->saved_regs[i], gpio_dev->base + pin*4);
++ raw_spin_lock_irqsave(&gpio_dev->lock, flags);
++ gpio_dev->saved_regs[i] |= readl(gpio_dev->base + pin * 4) & PIN_IRQ_PENDING;
++ writel(gpio_dev->saved_regs[i], gpio_dev->base + pin * 4);
++ raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
+ }
+
+ return 0;
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 0c2ba075bc713..f3701b4e374b6 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1858,7 +1858,7 @@ static int storvsc_probe(struct hv_device *device,
+ */
+ host_dev->handle_error_wq =
+ alloc_ordered_workqueue("storvsc_error_wq_%d",
+- WQ_MEM_RECLAIM,
++ 0,
+ host->host_no);
+ if (!host_dev->handle_error_wq)
+ goto err_out2;
+diff --git a/drivers/video/fbdev/pm2fb.c b/drivers/video/fbdev/pm2fb.c
+index 1dcf02e12af4f..8ae010f07d7da 100644
+--- a/drivers/video/fbdev/pm2fb.c
++++ b/drivers/video/fbdev/pm2fb.c
+@@ -616,6 +616,11 @@ static int pm2fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ return -EINVAL;
+ }
+
++ if (!var->pixclock) {
++ DPRINTK("pixclock is zero\n");
++ return -EINVAL;
++ }
++
+ if (PICOS2KHZ(var->pixclock) > PM2_MAX_PIXCLOCK) {
+ DPRINTK("pixclock too high (%ldKHz)\n",
+ PICOS2KHZ(var->pixclock));
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index f141b45ce3498..6adee94637a93 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -369,6 +369,9 @@ static int btrfs_xattr_handler_set(const struct xattr_handler *handler,
+ const char *name, const void *buffer,
+ size_t size, int flags)
+ {
++ if (btrfs_root_readonly(BTRFS_I(inode)->root))
++ return -EROFS;
++
+ name = xattr_full_name(handler, name);
+ return btrfs_setxattr(NULL, inode, name, buffer, size, flags);
+ }
+diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
+index ea5987bb0b84a..40e03afa9ad10 100644
+--- a/include/asm-generic/sections.h
++++ b/include/asm-generic/sections.h
+@@ -100,7 +100,7 @@ static inline bool memory_contains(void *begin, void *end, void *virt,
+ /**
+ * memory_intersects - checks if the region occupied by an object intersects
+ * with another memory region
+- * @begin: virtual address of the beginning of the memory regien
++ * @begin: virtual address of the beginning of the memory region
+ * @end: virtual address of the end of the memory region
+ * @virt: virtual address of the memory object
+ * @size: size of the memory object
+@@ -113,7 +113,10 @@ static inline bool memory_intersects(void *begin, void *end, void *virt,
+ {
+ void *vend = virt + size;
+
+- return (virt >= begin && virt < end) || (vend >= begin && vend < end);
++ if (virt < end && vend > begin)
++ return true;
++
++ return false;
+ }
+
+ /**
+diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
+index c6935be7c6ca3..954ffe32f6227 100644
+--- a/include/linux/netfilter_bridge/ebtables.h
++++ b/include/linux/netfilter_bridge/ebtables.h
+@@ -94,10 +94,6 @@ struct ebt_table {
+ struct ebt_replace_kernel *table;
+ unsigned int valid_hooks;
+ rwlock_t lock;
+- /* e.g. could be the table explicitly only allows certain
+- * matches, targets, ... 0 == let it in */
+- int (*check)(const struct ebt_table_info *info,
+- unsigned int valid_hooks);
+ /* the data used by the kernel */
+ struct ebt_table_info *private;
+ struct module *me;
+diff --git a/include/linux/rmap.h b/include/linux/rmap.h
+index 91ccae9467164..c80bd129e9399 100644
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -39,12 +39,15 @@ struct anon_vma {
+ atomic_t refcount;
+
+ /*
+- * Count of child anon_vmas and VMAs which points to this anon_vma.
++ * Count of child anon_vmas. Equals to the count of all anon_vmas that
++ * have ->parent pointing to this one, including itself.
+ *
+ * This counter is used for making decision about reusing anon_vma
+ * instead of forking new one. See comments in function anon_vma_clone.
+ */
+- unsigned degree;
++ unsigned long num_children;
++ /* Count of VMAs whose ->anon_vma pointer points to this object. */
++ unsigned long num_active_vmas;
+
+ struct anon_vma *parent; /* Parent of this anon_vma */
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index f92d5ae6d04e7..fd4899236037f 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -528,10 +528,6 @@ struct sched_dl_entity {
+ * task has to wait for a replenishment to be performed at the
+ * next firing of dl_timer.
+ *
+- * @dl_boosted tells if we are boosted due to DI. If so we are
+- * outside bandwidth enforcement mechanism (but only until we
+- * exit the critical section);
+- *
+ * @dl_yielded tells if task gave up the CPU before consuming
+ * all its available runtime during the last job.
+ *
+@@ -546,7 +542,6 @@ struct sched_dl_entity {
+ * overruns.
+ */
+ unsigned int dl_throttled : 1;
+- unsigned int dl_boosted : 1;
+ unsigned int dl_yielded : 1;
+ unsigned int dl_non_contending : 1;
+ unsigned int dl_overrun : 1;
+@@ -565,6 +560,15 @@ struct sched_dl_entity {
+ * time.
+ */
+ struct hrtimer inactive_timer;
++
++#ifdef CONFIG_RT_MUTEXES
++ /*
++ * Priority Inheritance. When a DEADLINE scheduling entity is boosted
++ * pi_se points to the donor, otherwise points to the dl_se it belongs
++ * to (the original one/itself).
++ */
++ struct sched_dl_entity *pi_se;
++#endif
+ };
+
+ union rcu_special {
+diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
+index c76a5e9894dac..8f42f6f3af86f 100644
+--- a/include/net/busy_poll.h
++++ b/include/net/busy_poll.h
+@@ -43,7 +43,7 @@ extern unsigned int sysctl_net_busy_poll __read_mostly;
+
+ static inline bool net_busy_loop_on(void)
+ {
+- return sysctl_net_busy_poll;
++ return READ_ONCE(sysctl_net_busy_poll);
+ }
+
+ static inline bool sk_can_busy_loop(const struct sock *sk)
+diff --git a/kernel/audit_fsnotify.c b/kernel/audit_fsnotify.c
+index fba78047fb37c..57404292c6d14 100644
+--- a/kernel/audit_fsnotify.c
++++ b/kernel/audit_fsnotify.c
+@@ -111,6 +111,7 @@ struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule, char *pa
+
+ ret = fsnotify_add_inode_mark(&audit_mark->mark, inode, true);
+ if (ret < 0) {
++ audit_mark->path = NULL;
+ fsnotify_put_mark(&audit_mark->mark);
+ audit_mark = ERR_PTR(ret);
+ }
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 099191716d4c9..b2fcad8635bcf 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1709,11 +1709,12 @@ static struct kprobe *__disable_kprobe(struct kprobe *p)
+ /* Try to disarm and disable this/parent probe */
+ if (p == orig_p || aggr_kprobe_disabled(orig_p)) {
+ /*
+- * If kprobes_all_disarmed is set, orig_p
+- * should have already been disarmed, so
+- * skip unneed disarming process.
++ * Don't be lazy here. Even if 'kprobes_all_disarmed'
++ * is false, 'orig_p' might not have been armed yet.
++ * Note arm_all_kprobes() __tries__ to arm all kprobes
++ * on the best effort basis.
+ */
+- if (!kprobes_all_disarmed) {
++ if (!kprobes_all_disarmed && !kprobe_disabled(orig_p)) {
+ ret = disarm_kprobe(orig_p, true);
+ if (ret) {
+ p->flags &= ~KPROBE_FLAG_DISABLED;
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 32af895bd86b3..a034642497718 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3869,20 +3869,21 @@ void rt_mutex_setprio(struct task_struct *p, struct task_struct *pi_task)
+ if (!dl_prio(p->normal_prio) ||
+ (pi_task && dl_prio(pi_task->prio) &&
+ dl_entity_preempt(&pi_task->dl, &p->dl))) {
+- p->dl.dl_boosted = 1;
++ p->dl.pi_se = pi_task->dl.pi_se;
+ queue_flag |= ENQUEUE_REPLENISH;
+- } else
+- p->dl.dl_boosted = 0;
++ } else {
++ p->dl.pi_se = &p->dl;
++ }
+ p->sched_class = &dl_sched_class;
+ } else if (rt_prio(prio)) {
+ if (dl_prio(oldprio))
+- p->dl.dl_boosted = 0;
++ p->dl.pi_se = &p->dl;
+ if (oldprio < prio)
+ queue_flag |= ENQUEUE_HEAD;
+ p->sched_class = &rt_sched_class;
+ } else {
+ if (dl_prio(oldprio))
+- p->dl.dl_boosted = 0;
++ p->dl.pi_se = &p->dl;
+ if (rt_prio(oldprio))
+ p->rt.timeout = 0;
+ p->sched_class = &fair_sched_class;
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index beec5081a55af..29ed5d8d30d68 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -43,6 +43,28 @@ static inline int on_dl_rq(struct sched_dl_entity *dl_se)
+ return !RB_EMPTY_NODE(&dl_se->rb_node);
+ }
+
++#ifdef CONFIG_RT_MUTEXES
++static inline struct sched_dl_entity *pi_of(struct sched_dl_entity *dl_se)
++{
++ return dl_se->pi_se;
++}
++
++static inline bool is_dl_boosted(struct sched_dl_entity *dl_se)
++{
++ return pi_of(dl_se) != dl_se;
++}
++#else
++static inline struct sched_dl_entity *pi_of(struct sched_dl_entity *dl_se)
++{
++ return dl_se;
++}
++
++static inline bool is_dl_boosted(struct sched_dl_entity *dl_se)
++{
++ return false;
++}
++#endif
++
+ #ifdef CONFIG_SMP
+ static inline struct dl_bw *dl_bw_of(int i)
+ {
+@@ -657,7 +679,7 @@ static inline void setup_new_dl_entity(struct sched_dl_entity *dl_se)
+ struct dl_rq *dl_rq = dl_rq_of_se(dl_se);
+ struct rq *rq = rq_of_dl_rq(dl_rq);
+
+- WARN_ON(dl_se->dl_boosted);
++ WARN_ON(is_dl_boosted(dl_se));
+ WARN_ON(dl_time_before(rq_clock(rq), dl_se->deadline));
+
+ /*
+@@ -695,21 +717,20 @@ static inline void setup_new_dl_entity(struct sched_dl_entity *dl_se)
+ * could happen are, typically, a entity voluntarily trying to overcome its
+ * runtime, or it just underestimated it during sched_setattr().
+ */
+-static void replenish_dl_entity(struct sched_dl_entity *dl_se,
+- struct sched_dl_entity *pi_se)
++static void replenish_dl_entity(struct sched_dl_entity *dl_se)
+ {
+ struct dl_rq *dl_rq = dl_rq_of_se(dl_se);
+ struct rq *rq = rq_of_dl_rq(dl_rq);
+
+- BUG_ON(pi_se->dl_runtime <= 0);
++ BUG_ON(pi_of(dl_se)->dl_runtime <= 0);
+
+ /*
+ * This could be the case for a !-dl task that is boosted.
+ * Just go with full inherited parameters.
+ */
+ if (dl_se->dl_deadline == 0) {
+- dl_se->deadline = rq_clock(rq) + pi_se->dl_deadline;
+- dl_se->runtime = pi_se->dl_runtime;
++ dl_se->deadline = rq_clock(rq) + pi_of(dl_se)->dl_deadline;
++ dl_se->runtime = pi_of(dl_se)->dl_runtime;
+ }
+
+ if (dl_se->dl_yielded && dl_se->runtime > 0)
+@@ -722,8 +743,8 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se,
+ * arbitrary large.
+ */
+ while (dl_se->runtime <= 0) {
+- dl_se->deadline += pi_se->dl_period;
+- dl_se->runtime += pi_se->dl_runtime;
++ dl_se->deadline += pi_of(dl_se)->dl_period;
++ dl_se->runtime += pi_of(dl_se)->dl_runtime;
+ }
+
+ /*
+@@ -737,8 +758,8 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se,
+ */
+ if (dl_time_before(dl_se->deadline, rq_clock(rq))) {
+ printk_deferred_once("sched: DL replenish lagged too much\n");
+- dl_se->deadline = rq_clock(rq) + pi_se->dl_deadline;
+- dl_se->runtime = pi_se->dl_runtime;
++ dl_se->deadline = rq_clock(rq) + pi_of(dl_se)->dl_deadline;
++ dl_se->runtime = pi_of(dl_se)->dl_runtime;
+ }
+
+ if (dl_se->dl_yielded)
+@@ -771,8 +792,7 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se,
+ * task with deadline equal to period this is the same of using
+ * dl_period instead of dl_deadline in the equation above.
+ */
+-static bool dl_entity_overflow(struct sched_dl_entity *dl_se,
+- struct sched_dl_entity *pi_se, u64 t)
++static bool dl_entity_overflow(struct sched_dl_entity *dl_se, u64 t)
+ {
+ u64 left, right;
+
+@@ -794,9 +814,9 @@ static bool dl_entity_overflow(struct sched_dl_entity *dl_se,
+ * of anything below microseconds resolution is actually fiction
+ * (but still we want to give the user that illusion >;).
+ */
+- left = (pi_se->dl_deadline >> DL_SCALE) * (dl_se->runtime >> DL_SCALE);
++ left = (pi_of(dl_se)->dl_deadline >> DL_SCALE) * (dl_se->runtime >> DL_SCALE);
+ right = ((dl_se->deadline - t) >> DL_SCALE) *
+- (pi_se->dl_runtime >> DL_SCALE);
++ (pi_of(dl_se)->dl_runtime >> DL_SCALE);
+
+ return dl_time_before(right, left);
+ }
+@@ -881,24 +901,23 @@ static inline bool dl_is_implicit(struct sched_dl_entity *dl_se)
+ * Please refer to the comments update_dl_revised_wakeup() function to find
+ * more about the Revised CBS rule.
+ */
+-static void update_dl_entity(struct sched_dl_entity *dl_se,
+- struct sched_dl_entity *pi_se)
++static void update_dl_entity(struct sched_dl_entity *dl_se)
+ {
+ struct dl_rq *dl_rq = dl_rq_of_se(dl_se);
+ struct rq *rq = rq_of_dl_rq(dl_rq);
+
+ if (dl_time_before(dl_se->deadline, rq_clock(rq)) ||
+- dl_entity_overflow(dl_se, pi_se, rq_clock(rq))) {
++ dl_entity_overflow(dl_se, rq_clock(rq))) {
+
+ if (unlikely(!dl_is_implicit(dl_se) &&
+ !dl_time_before(dl_se->deadline, rq_clock(rq)) &&
+- !dl_se->dl_boosted)){
++ !is_dl_boosted(dl_se))) {
+ update_dl_revised_wakeup(dl_se, rq);
+ return;
+ }
+
+- dl_se->deadline = rq_clock(rq) + pi_se->dl_deadline;
+- dl_se->runtime = pi_se->dl_runtime;
++ dl_se->deadline = rq_clock(rq) + pi_of(dl_se)->dl_deadline;
++ dl_se->runtime = pi_of(dl_se)->dl_runtime;
+ }
+ }
+
+@@ -997,7 +1016,7 @@ static enum hrtimer_restart dl_task_timer(struct hrtimer *timer)
+ * The task might have been boosted by someone else and might be in the
+ * boosting/deboosting path, its not throttled.
+ */
+- if (dl_se->dl_boosted)
++ if (is_dl_boosted(dl_se))
+ goto unlock;
+
+ /*
+@@ -1025,7 +1044,7 @@ static enum hrtimer_restart dl_task_timer(struct hrtimer *timer)
+ * but do not enqueue -- wait for our wakeup to do that.
+ */
+ if (!task_on_rq_queued(p)) {
+- replenish_dl_entity(dl_se, dl_se);
++ replenish_dl_entity(dl_se);
+ goto unlock;
+ }
+
+@@ -1115,7 +1134,7 @@ static inline void dl_check_constrained_dl(struct sched_dl_entity *dl_se)
+
+ if (dl_time_before(dl_se->deadline, rq_clock(rq)) &&
+ dl_time_before(rq_clock(rq), dl_next_period(dl_se))) {
+- if (unlikely(dl_se->dl_boosted || !start_dl_timer(p)))
++ if (unlikely(is_dl_boosted(dl_se) || !start_dl_timer(p)))
+ return;
+ dl_se->dl_throttled = 1;
+ if (dl_se->runtime > 0)
+@@ -1246,7 +1265,7 @@ throttle:
+ dl_se->dl_overrun = 1;
+
+ __dequeue_task_dl(rq, curr, 0);
+- if (unlikely(dl_se->dl_boosted || !start_dl_timer(curr)))
++ if (unlikely(is_dl_boosted(dl_se) || !start_dl_timer(curr)))
+ enqueue_task_dl(rq, curr, ENQUEUE_REPLENISH);
+
+ if (!is_leftmost(curr, &rq->dl))
+@@ -1440,8 +1459,7 @@ static void __dequeue_dl_entity(struct sched_dl_entity *dl_se)
+ }
+
+ static void
+-enqueue_dl_entity(struct sched_dl_entity *dl_se,
+- struct sched_dl_entity *pi_se, int flags)
++enqueue_dl_entity(struct sched_dl_entity *dl_se, int flags)
+ {
+ BUG_ON(on_dl_rq(dl_se));
+
+@@ -1452,9 +1470,9 @@ enqueue_dl_entity(struct sched_dl_entity *dl_se,
+ */
+ if (flags & ENQUEUE_WAKEUP) {
+ task_contending(dl_se, flags);
+- update_dl_entity(dl_se, pi_se);
++ update_dl_entity(dl_se);
+ } else if (flags & ENQUEUE_REPLENISH) {
+- replenish_dl_entity(dl_se, pi_se);
++ replenish_dl_entity(dl_se);
+ } else if ((flags & ENQUEUE_RESTORE) &&
+ dl_time_before(dl_se->deadline,
+ rq_clock(rq_of_dl_rq(dl_rq_of_se(dl_se))))) {
+@@ -1471,28 +1489,40 @@ static void dequeue_dl_entity(struct sched_dl_entity *dl_se)
+
+ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
+ {
+- struct task_struct *pi_task = rt_mutex_get_top_task(p);
+- struct sched_dl_entity *pi_se = &p->dl;
+-
+- /*
+- * Use the scheduling parameters of the top pi-waiter task if:
+- * - we have a top pi-waiter which is a SCHED_DEADLINE task AND
+- * - our dl_boosted is set (i.e. the pi-waiter's (absolute) deadline is
+- * smaller than our deadline OR we are a !SCHED_DEADLINE task getting
+- * boosted due to a SCHED_DEADLINE pi-waiter).
+- * Otherwise we keep our runtime and deadline.
+- */
+- if (pi_task && dl_prio(pi_task->normal_prio) && p->dl.dl_boosted) {
+- pi_se = &pi_task->dl;
++ if (is_dl_boosted(&p->dl)) {
++ /*
++ * Because of delays in the detection of the overrun of a
++ * thread's runtime, it might be the case that a thread
++ * goes to sleep in a rt mutex with negative runtime. As
++ * a consequence, the thread will be throttled.
++ *
++ * While waiting for the mutex, this thread can also be
++ * boosted via PI, resulting in a thread that is throttled
++ * and boosted at the same time.
++ *
++ * In this case, the boost overrides the throttle.
++ */
++ if (p->dl.dl_throttled) {
++ /*
++ * The replenish timer needs to be canceled. No
++ * problem if it fires concurrently: boosted threads
++ * are ignored in dl_task_timer().
++ */
++ hrtimer_try_to_cancel(&p->dl.dl_timer);
++ p->dl.dl_throttled = 0;
++ }
+ } else if (!dl_prio(p->normal_prio)) {
+ /*
+- * Special case in which we have a !SCHED_DEADLINE task
+- * that is going to be deboosted, but exceeds its
+- * runtime while doing so. No point in replenishing
+- * it, as it's going to return back to its original
+- * scheduling class after this.
++ * Special case in which we have a !SCHED_DEADLINE task that is going
++ * to be deboosted, but exceeds its runtime while doing so. No point in
++ * replenishing it, as it's going to return back to its original
++ * scheduling class after this. If it has been throttled, we need to
++ * clear the flag, otherwise the task may wake up as throttled after
++ * being boosted again with no means to replenish the runtime and clear
++ * the throttle.
+ */
+- BUG_ON(!p->dl.dl_boosted || flags != ENQUEUE_REPLENISH);
++ p->dl.dl_throttled = 0;
++ BUG_ON(!is_dl_boosted(&p->dl) || flags != ENQUEUE_REPLENISH);
+ return;
+ }
+
+@@ -1529,7 +1559,7 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
+ return;
+ }
+
+- enqueue_dl_entity(&p->dl, pi_se, flags);
++ enqueue_dl_entity(&p->dl, flags);
+
+ if (!task_current(rq, p) && p->nr_cpus_allowed > 1)
+ enqueue_pushable_dl_task(rq, p);
+@@ -2691,11 +2721,14 @@ void __dl_clear_params(struct task_struct *p)
+ dl_se->dl_bw = 0;
+ dl_se->dl_density = 0;
+
+- dl_se->dl_boosted = 0;
+ dl_se->dl_throttled = 0;
+ dl_se->dl_yielded = 0;
+ dl_se->dl_non_contending = 0;
+ dl_se->dl_overrun = 0;
++
++#ifdef CONFIG_RT_MUTEXES
++ dl_se->pi_se = dl_se;
++#endif
+ }
+
+ bool dl_param_changed(struct task_struct *p, const struct sched_attr *attr)
+diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
+index df556175be506..acd7e12217743 100644
+--- a/kernel/sys_ni.c
++++ b/kernel/sys_ni.c
+@@ -257,6 +257,7 @@ COND_SYSCALL_COMPAT(keyctl);
+
+ /* mm/fadvise.c */
+ COND_SYSCALL(fadvise64_64);
++COND_SYSCALL_COMPAT(fadvise64_64);
+
+ /* mm/, CONFIG_MMU only */
+ COND_SYSCALL(swapon);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 998d141488a95..d2272fff2f591 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2748,6 +2748,16 @@ static int ftrace_startup(struct ftrace_ops *ops, int command)
+
+ ftrace_startup_enable(command);
+
++ /*
++ * If ftrace is in an undefined state, we just remove ops from list
++ * to prevent the NULL pointer, instead of totally rolling it back and
++ * free trampoline, because those actions could cause further damage.
++ */
++ if (unlikely(ftrace_disabled)) {
++ __unregister_ftrace_function(ops);
++ return -ENODEV;
++ }
++
+ ops->flags &= ~FTRACE_OPS_FL_ADDING;
+
+ return 0;
+diff --git a/lib/ratelimit.c b/lib/ratelimit.c
+index d01f471352390..b805702de84dd 100644
+--- a/lib/ratelimit.c
++++ b/lib/ratelimit.c
+@@ -27,10 +27,16 @@
+ */
+ int ___ratelimit(struct ratelimit_state *rs, const char *func)
+ {
++ /* Paired with WRITE_ONCE() in .proc_handler().
++ * Changing two values seperately could be inconsistent
++ * and some message could be lost. (See: net_ratelimit_state).
++ */
++ int interval = READ_ONCE(rs->interval);
++ int burst = READ_ONCE(rs->burst);
+ unsigned long flags;
+ int ret;
+
+- if (!rs->interval)
++ if (!interval)
+ return 1;
+
+ /*
+@@ -45,7 +51,7 @@ int ___ratelimit(struct ratelimit_state *rs, const char *func)
+ if (!rs->begin)
+ rs->begin = jiffies;
+
+- if (time_is_before_jiffies(rs->begin + rs->interval)) {
++ if (time_is_before_jiffies(rs->begin + interval)) {
+ if (rs->missed) {
+ if (!(rs->flags & RATELIMIT_MSG_ON_RELEASE)) {
+ printk_deferred(KERN_WARNING
+@@ -57,7 +63,7 @@ int ___ratelimit(struct ratelimit_state *rs, const char *func)
+ rs->begin = jiffies;
+ rs->printed = 0;
+ }
+- if (rs->burst && rs->burst > rs->printed) {
++ if (burst && burst > rs->printed) {
+ rs->printed++;
+ ret = 1;
+ } else {
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 590840c3a3b5f..5ee3c91450de1 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1640,8 +1640,12 @@ int vma_wants_writenotify(struct vm_area_struct *vma, pgprot_t vm_page_prot)
+ pgprot_val(vm_pgprot_modify(vm_page_prot, vm_flags)))
+ return 0;
+
+- /* Do we need to track softdirty? */
+- if (IS_ENABLED(CONFIG_MEM_SOFT_DIRTY) && !(vm_flags & VM_SOFTDIRTY))
++ /*
++ * Do we need to track softdirty? hugetlb does not support softdirty
++ * tracking yet.
++ */
++ if (IS_ENABLED(CONFIG_MEM_SOFT_DIRTY) && !(vm_flags & VM_SOFTDIRTY) &&
++ !is_vm_hugetlb_page(vma))
+ return 1;
+
+ /* Specialty mapping? */
+@@ -2568,6 +2572,18 @@ static void unmap_region(struct mm_struct *mm,
+ tlb_gather_mmu(&tlb, mm, start, end);
+ update_hiwater_rss(mm);
+ unmap_vmas(&tlb, vma, start, end);
++
++ /*
++ * Ensure we have no stale TLB entries by the time this mapping is
++ * removed from the rmap.
++ * Note that we don't have to worry about nested flushes here because
++ * we're holding the mm semaphore for removing the mapping - so any
++ * concurrent flush in this region has to be coming through the rmap,
++ * and we synchronize against that using the rmap lock.
++ */
++ if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0)
++ tlb_flush_mmu(&tlb);
++
+ free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS,
+ next ? next->vm_start : USER_PGTABLES_CEILING);
+ tlb_finish_mmu(&tlb, start, end);
+diff --git a/mm/rmap.c b/mm/rmap.c
+index e578eb942317b..3c2a439381529 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -82,7 +82,8 @@ static inline struct anon_vma *anon_vma_alloc(void)
+ anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
+ if (anon_vma) {
+ atomic_set(&anon_vma->refcount, 1);
+- anon_vma->degree = 1; /* Reference for first vma */
++ anon_vma->num_children = 0;
++ anon_vma->num_active_vmas = 0;
+ anon_vma->parent = anon_vma;
+ /*
+ * Initialise the anon_vma root to point to itself. If called
+@@ -190,6 +191,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma)
+ anon_vma = anon_vma_alloc();
+ if (unlikely(!anon_vma))
+ goto out_enomem_free_avc;
++ anon_vma->num_children++; /* self-parent link for new root */
+ allocated = anon_vma;
+ }
+
+@@ -199,8 +201,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma)
+ if (likely(!vma->anon_vma)) {
+ vma->anon_vma = anon_vma;
+ anon_vma_chain_link(vma, avc, anon_vma);
+- /* vma reference or self-parent link for new root */
+- anon_vma->degree++;
++ anon_vma->num_active_vmas++;
+ allocated = NULL;
+ avc = NULL;
+ }
+@@ -279,19 +280,19 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
+ anon_vma_chain_link(dst, avc, anon_vma);
+
+ /*
+- * Reuse existing anon_vma if its degree lower than two,
+- * that means it has no vma and only one anon_vma child.
++ * Reuse existing anon_vma if it has no vma and only one
++ * anon_vma child.
+ *
+- * Do not chose parent anon_vma, otherwise first child
+- * will always reuse it. Root anon_vma is never reused:
++ * Root anon_vma is never reused:
+ * it has self-parent reference and at least one child.
+ */
+- if (!dst->anon_vma && anon_vma != src->anon_vma &&
+- anon_vma->degree < 2)
++ if (!dst->anon_vma &&
++ anon_vma->num_children < 2 &&
++ anon_vma->num_active_vmas == 0)
+ dst->anon_vma = anon_vma;
+ }
+ if (dst->anon_vma)
+- dst->anon_vma->degree++;
++ dst->anon_vma->num_active_vmas++;
+ unlock_anon_vma_root(root);
+ return 0;
+
+@@ -341,6 +342,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ anon_vma = anon_vma_alloc();
+ if (!anon_vma)
+ goto out_error;
++ anon_vma->num_active_vmas++;
+ avc = anon_vma_chain_alloc(GFP_KERNEL);
+ if (!avc)
+ goto out_error_free_anon_vma;
+@@ -361,7 +363,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ vma->anon_vma = anon_vma;
+ anon_vma_lock_write(anon_vma);
+ anon_vma_chain_link(vma, avc, anon_vma);
+- anon_vma->parent->degree++;
++ anon_vma->parent->num_children++;
+ anon_vma_unlock_write(anon_vma);
+
+ return 0;
+@@ -393,7 +395,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
+ * to free them outside the lock.
+ */
+ if (RB_EMPTY_ROOT(&anon_vma->rb_root.rb_root)) {
+- anon_vma->parent->degree--;
++ anon_vma->parent->num_children--;
+ continue;
+ }
+
+@@ -401,7 +403,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
+ anon_vma_chain_free(avc);
+ }
+ if (vma->anon_vma)
+- vma->anon_vma->degree--;
++ vma->anon_vma->num_active_vmas--;
+ unlock_anon_vma_root(root);
+
+ /*
+@@ -412,7 +414,8 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
+ list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
+ struct anon_vma *anon_vma = avc->anon_vma;
+
+- VM_WARN_ON(anon_vma->degree);
++ VM_WARN_ON(anon_vma->num_children);
++ VM_WARN_ON(anon_vma->num_active_vmas);
+ put_anon_vma(anon_vma);
+
+ list_del(&avc->same_vma);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 0dfc47adccb17..65d20bdff0238 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -1826,11 +1826,11 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
+ src_match = !bacmp(&c->src, src);
+ dst_match = !bacmp(&c->dst, dst);
+ if (src_match && dst_match) {
+- c = l2cap_chan_hold_unless_zero(c);
+- if (c) {
+- read_unlock(&chan_list_lock);
+- return c;
+- }
++ if (!l2cap_chan_hold_unless_zero(c))
++ continue;
++
++ read_unlock(&chan_list_lock);
++ return c;
+ }
+
+ /* Closest match */
+diff --git a/net/bridge/netfilter/ebtable_broute.c b/net/bridge/netfilter/ebtable_broute.c
+index 276b60262981c..b21c8a317be73 100644
+--- a/net/bridge/netfilter/ebtable_broute.c
++++ b/net/bridge/netfilter/ebtable_broute.c
+@@ -33,18 +33,10 @@ static struct ebt_replace_kernel initial_table = {
+ .entries = (char *)&initial_chain,
+ };
+
+-static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
+-{
+- if (valid_hooks & ~(1 << NF_BR_BROUTING))
+- return -EINVAL;
+- return 0;
+-}
+-
+ static const struct ebt_table broute_table = {
+ .name = "broute",
+ .table = &initial_table,
+ .valid_hooks = 1 << NF_BR_BROUTING,
+- .check = check,
+ .me = THIS_MODULE,
+ };
+
+diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
+index 550324c516ee3..c71795e4c18cf 100644
+--- a/net/bridge/netfilter/ebtable_filter.c
++++ b/net/bridge/netfilter/ebtable_filter.c
+@@ -42,18 +42,10 @@ static struct ebt_replace_kernel initial_table = {
+ .entries = (char *)initial_chains,
+ };
+
+-static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
+-{
+- if (valid_hooks & ~FILTER_VALID_HOOKS)
+- return -EINVAL;
+- return 0;
+-}
+-
+ static const struct ebt_table frame_filter = {
+ .name = "filter",
+ .table = &initial_table,
+ .valid_hooks = FILTER_VALID_HOOKS,
+- .check = check,
+ .me = THIS_MODULE,
+ };
+
+diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
+index c0fb3ca518af8..44dde9e635e24 100644
+--- a/net/bridge/netfilter/ebtable_nat.c
++++ b/net/bridge/netfilter/ebtable_nat.c
+@@ -42,18 +42,10 @@ static struct ebt_replace_kernel initial_table = {
+ .entries = (char *)initial_chains,
+ };
+
+-static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
+-{
+- if (valid_hooks & ~NAT_VALID_HOOKS)
+- return -EINVAL;
+- return 0;
+-}
+-
+ static const struct ebt_table frame_nat = {
+ .name = "nat",
+ .table = &initial_table,
+ .valid_hooks = NAT_VALID_HOOKS,
+- .check = check,
+ .me = THIS_MODULE,
+ };
+
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index f59230e4fc295..ea27bacbd0057 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -1003,8 +1003,7 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
+ goto free_iterate;
+ }
+
+- /* the table doesn't like it */
+- if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
++ if (repl->valid_hooks != t->valid_hooks)
+ goto free_unlock;
+
+ if (repl->num_counters && repl->num_counters != t->private->nentries) {
+@@ -1197,11 +1196,6 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table,
+ if (ret != 0)
+ goto free_chainstack;
+
+- if (table->check && table->check(newinfo, table->valid_hooks)) {
+- ret = -EINVAL;
+- goto free_chainstack;
+- }
+-
+ table->private = newinfo;
+ rwlock_init(&table->lock);
+ mutex_lock(&ebt_mutex);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 42f6ff8b9703c..880b096eef8a6 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4474,7 +4474,7 @@ static int netif_rx_internal(struct sk_buff *skb)
+ {
+ int ret;
+
+- net_timestamp_check(netdev_tstamp_prequeue, skb);
++ net_timestamp_check(READ_ONCE(netdev_tstamp_prequeue), skb);
+
+ trace_netif_rx(skb);
+
+@@ -4794,7 +4794,7 @@ static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
+ int ret = NET_RX_DROP;
+ __be16 type;
+
+- net_timestamp_check(!netdev_tstamp_prequeue, skb);
++ net_timestamp_check(!READ_ONCE(netdev_tstamp_prequeue), skb);
+
+ trace_netif_receive_skb(skb);
+
+@@ -5146,7 +5146,7 @@ static int netif_receive_skb_internal(struct sk_buff *skb)
+ {
+ int ret;
+
+- net_timestamp_check(netdev_tstamp_prequeue, skb);
++ net_timestamp_check(READ_ONCE(netdev_tstamp_prequeue), skb);
+
+ if (skb_defer_rx_timestamp(skb))
+ return NET_RX_SUCCESS;
+@@ -5176,7 +5176,7 @@ static void netif_receive_skb_list_internal(struct list_head *head)
+
+ INIT_LIST_HEAD(&sublist);
+ list_for_each_entry_safe(skb, next, head, list) {
+- net_timestamp_check(netdev_tstamp_prequeue, skb);
++ net_timestamp_check(READ_ONCE(netdev_tstamp_prequeue), skb);
+ skb_list_del_init(skb);
+ if (!skb_defer_rx_timestamp(skb))
+ list_add_tail(&skb->list, &sublist);
+@@ -5851,7 +5851,7 @@ static int process_backlog(struct napi_struct *napi, int quota)
+ net_rps_action_and_irq_enable(sd);
+ }
+
+- napi->weight = dev_rx_weight;
++ napi->weight = READ_ONCE(dev_rx_weight);
+ while (again) {
+ struct sk_buff *skb;
+
+@@ -6335,8 +6335,8 @@ static __latent_entropy void net_rx_action(struct softirq_action *h)
+ {
+ struct softnet_data *sd = this_cpu_ptr(&softnet_data);
+ unsigned long time_limit = jiffies +
+- usecs_to_jiffies(netdev_budget_usecs);
+- int budget = netdev_budget;
++ usecs_to_jiffies(READ_ONCE(netdev_budget_usecs));
++ int budget = READ_ONCE(netdev_budget);
+ LIST_HEAD(list);
+ LIST_HEAD(repoll);
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 6233e9856016e..73042407eb5b4 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -224,11 +224,26 @@ static int neigh_del_timer(struct neighbour *n)
+ return 0;
+ }
+
+-static void pneigh_queue_purge(struct sk_buff_head *list)
++static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net)
+ {
++ struct sk_buff_head tmp;
++ unsigned long flags;
+ struct sk_buff *skb;
+
+- while ((skb = skb_dequeue(list)) != NULL) {
++ skb_queue_head_init(&tmp);
++ spin_lock_irqsave(&list->lock, flags);
++ skb = skb_peek(list);
++ while (skb != NULL) {
++ struct sk_buff *skb_next = skb_peek_next(skb, list);
++ if (net == NULL || net_eq(dev_net(skb->dev), net)) {
++ __skb_unlink(skb, list);
++ __skb_queue_tail(&tmp, skb);
++ }
++ skb = skb_next;
++ }
++ spin_unlock_irqrestore(&list->lock, flags);
++
++ while ((skb = __skb_dequeue(&tmp))) {
+ dev_put(skb->dev);
+ kfree_skb(skb);
+ }
+@@ -297,9 +312,9 @@ int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
+ write_lock_bh(&tbl->lock);
+ neigh_flush_dev(tbl, dev);
+ pneigh_ifdown_and_unlock(tbl, dev);
+-
+- del_timer_sync(&tbl->proxy_timer);
+- pneigh_queue_purge(&tbl->proxy_queue);
++ pneigh_queue_purge(&tbl->proxy_queue, dev_net(dev));
++ if (skb_queue_empty_lockless(&tbl->proxy_queue))
++ del_timer_sync(&tbl->proxy_timer);
+ return 0;
+ }
+ EXPORT_SYMBOL(neigh_ifdown);
+@@ -1614,7 +1629,7 @@ int neigh_table_clear(int index, struct neigh_table *tbl)
+ /* It is not clean... Fix it to unload IPv6 module safely */
+ cancel_delayed_work_sync(&tbl->gc_work);
+ del_timer_sync(&tbl->proxy_timer);
+- pneigh_queue_purge(&tbl->proxy_queue);
++ pneigh_queue_purge(&tbl->proxy_queue, NULL);
+ neigh_ifdown(tbl, NULL);
+ if (atomic_read(&tbl->entries))
+ pr_crit("neighbour leakage\n");
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index c623c129d0ab6..e0be1f8651bbe 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4377,7 +4377,7 @@ static bool skb_may_tx_timestamp(struct sock *sk, bool tsonly)
+ {
+ bool ret;
+
+- if (likely(sysctl_tstamp_allow_data || tsonly))
++ if (likely(READ_ONCE(sysctl_tstamp_allow_data) || tsonly))
+ return true;
+
+ read_lock_bh(&sk->sk_callback_lock);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 79f085df52cef..cd23a8e4556ca 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2856,7 +2856,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+ sk->sk_napi_id = 0;
+- sk->sk_ll_usec = sysctl_net_busy_read;
++ sk->sk_ll_usec = READ_ONCE(sysctl_net_busy_read);
+ #endif
+
+ sk->sk_max_pacing_rate = ~0U;
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index 0a0bf80623658..d7e39167ceca0 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -231,14 +231,17 @@ static int set_default_qdisc(struct ctl_table *table, int write,
+ static int proc_do_dev_weight(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+- int ret;
++ static DEFINE_MUTEX(dev_weight_mutex);
++ int ret, weight;
+
++ mutex_lock(&dev_weight_mutex);
+ ret = proc_dointvec(table, write, buffer, lenp, ppos);
+- if (ret != 0)
+- return ret;
+-
+- dev_rx_weight = weight_p * dev_weight_rx_bias;
+- dev_tx_weight = weight_p * dev_weight_tx_bias;
++ if (!ret && write) {
++ weight = READ_ONCE(weight_p);
++ WRITE_ONCE(dev_rx_weight, weight * dev_weight_rx_bias);
++ WRITE_ONCE(dev_tx_weight, weight * dev_weight_tx_bias);
++ }
++ mutex_unlock(&dev_weight_mutex);
+
+ return ret;
+ }
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index af67e0d265c05..337c6bc8211ed 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1707,9 +1707,12 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad
+ pfk->registered |= (1<<hdr->sadb_msg_satype);
+ }
+
++ mutex_lock(&pfkey_mutex);
+ xfrm_probe_algs();
+
+ supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO);
++ mutex_unlock(&pfkey_mutex);
++
+ if (!supp_skb) {
+ if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC)
+ pfk->registered &= ~(1<<hdr->sadb_msg_satype);
+diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
+index 56cddadb65d0c..92e0514f624fa 100644
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -117,7 +117,6 @@ config NF_CONNTRACK_ZONES
+
+ config NF_CONNTRACK_PROCFS
+ bool "Supply CT list in procfs (OBSOLETE)"
+- default y
+ depends on PROC_FS
+ ---help---
+ This option enables for the list of known conntrack entries
+diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
+index e259454b6a643..4fac2d9a4b885 100644
+--- a/net/netfilter/nft_osf.c
++++ b/net/netfilter/nft_osf.c
+@@ -81,9 +81,21 @@ static int nft_osf_validate(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nft_data **data)
+ {
+- return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) |
+- (1 << NF_INET_PRE_ROUTING) |
+- (1 << NF_INET_FORWARD));
++ unsigned int hooks;
++
++ switch (ctx->family) {
++ case NFPROTO_IPV4:
++ case NFPROTO_IPV6:
++ case NFPROTO_INET:
++ hooks = (1 << NF_INET_LOCAL_IN) |
++ (1 << NF_INET_PRE_ROUTING) |
++ (1 << NF_INET_FORWARD);
++ break;
++ default:
++ return -EOPNOTSUPP;
++ }
++
++ return nft_chain_validate_hooks(ctx->chain, hooks);
+ }
+
+ static struct nft_expr_type nft_osf_type;
+diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
+index fd87216bc0a99..5732b32ab9320 100644
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -332,6 +332,8 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
+ const struct nlattr * const tb[])
+ {
+ struct nft_payload_set *priv = nft_expr_priv(expr);
++ u32 csum_offset, csum_type = NFT_PAYLOAD_CSUM_NONE;
++ int err;
+
+ priv->base = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
+ priv->offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
+@@ -339,11 +341,15 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
+ priv->sreg = nft_parse_register(tb[NFTA_PAYLOAD_SREG]);
+
+ if (tb[NFTA_PAYLOAD_CSUM_TYPE])
+- priv->csum_type =
+- ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_TYPE]));
+- if (tb[NFTA_PAYLOAD_CSUM_OFFSET])
+- priv->csum_offset =
+- ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_OFFSET]));
++ csum_type = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_TYPE]));
++ if (tb[NFTA_PAYLOAD_CSUM_OFFSET]) {
++ err = nft_parse_u32_check(tb[NFTA_PAYLOAD_CSUM_OFFSET], U8_MAX,
++ &csum_offset);
++ if (err < 0)
++ return err;
++
++ priv->csum_offset = csum_offset;
++ }
+ if (tb[NFTA_PAYLOAD_CSUM_FLAGS]) {
+ u32 flags;
+
+@@ -354,13 +360,14 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
+ priv->csum_flags = flags;
+ }
+
+- switch (priv->csum_type) {
++ switch (csum_type) {
+ case NFT_PAYLOAD_CSUM_NONE:
+ case NFT_PAYLOAD_CSUM_INET:
+ break;
+ default:
+ return -EOPNOTSUPP;
+ }
++ priv->csum_type = csum_type;
+
+ return nft_validate_register_load(priv->sreg, priv->len);
+ }
+@@ -398,6 +405,7 @@ nft_payload_select_ops(const struct nft_ctx *ctx,
+ {
+ enum nft_payload_bases base;
+ unsigned int offset, len;
++ int err;
+
+ if (tb[NFTA_PAYLOAD_BASE] == NULL ||
+ tb[NFTA_PAYLOAD_OFFSET] == NULL ||
+@@ -423,8 +431,13 @@ nft_payload_select_ops(const struct nft_ctx *ctx,
+ if (tb[NFTA_PAYLOAD_DREG] == NULL)
+ return ERR_PTR(-EINVAL);
+
+- offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
+- len = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
++ err = nft_parse_u32_check(tb[NFTA_PAYLOAD_OFFSET], U8_MAX, &offset);
++ if (err < 0)
++ return ERR_PTR(err);
++
++ err = nft_parse_u32_check(tb[NFTA_PAYLOAD_LEN], U8_MAX, &len);
++ if (err < 0)
++ return ERR_PTR(err);
+
+ if (len <= 4 && is_power_of_2(len) && IS_ALIGNED(offset, len) &&
+ base != NFT_PAYLOAD_LL_HEADER)
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index 8ae948fd9dcfc..3fc55c81f16ac 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -104,6 +104,7 @@ static const struct nft_expr_ops nft_tunnel_get_ops = {
+
+ static struct nft_expr_type nft_tunnel_type __read_mostly = {
+ .name = "tunnel",
++ .family = NFPROTO_NETDEV,
+ .ops = &nft_tunnel_get_ops,
+ .policy = nft_tunnel_policy,
+ .maxattr = NFTA_TUNNEL_MAX,
+diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
+index c318e5c9f6df3..56eea298b8ef7 100644
+--- a/net/rose/rose_loopback.c
++++ b/net/rose/rose_loopback.c
+@@ -99,7 +99,8 @@ static void rose_loopback_timer(struct timer_list *unused)
+ }
+
+ if (frametype == ROSE_CALL_REQUEST) {
+- if (!rose_loopback_neigh->dev) {
++ if (!rose_loopback_neigh->dev &&
++ !rose_loopback_neigh->loopback) {
+ kfree_skb(skb);
+ continue;
+ }
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index cad2586c34734..c966dacf1130b 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -397,7 +397,7 @@ static inline bool qdisc_restart(struct Qdisc *q, int *packets)
+
+ void __qdisc_run(struct Qdisc *q)
+ {
+- int quota = dev_tx_weight;
++ int quota = READ_ONCE(dev_tx_weight);
+ int packets;
+
+ while (qdisc_restart(q, &packets)) {
+diff --git a/net/socket.c b/net/socket.c
+index e5cc9f2b981ed..a5167f03c31db 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1619,7 +1619,7 @@ int __sys_listen(int fd, int backlog)
+
+ sock = sockfd_lookup_light(fd, &err, &fput_needed);
+ if (sock) {
+- somaxconn = sock_net(sock->sk)->core.sysctl_somaxconn;
++ somaxconn = READ_ONCE(sock_net(sock->sk)->core.sysctl_somaxconn);
+ if ((unsigned int)backlog > somaxconn)
+ backlog = somaxconn;
+
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 3582f77bab6a8..1cd21a8c4deac 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -2403,6 +2403,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+ if (pols[1]) {
+ if (IS_ERR(pols[1])) {
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
++ xfrm_pol_put(pols[0]);
+ return 0;
+ }
+ pols[1]->curlft.use_time = ktime_get_real_seconds();
+diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
+index 51884c7b80697..4eac2ecb35fb9 100644
+--- a/scripts/Makefile.modpost
++++ b/scripts/Makefile.modpost
+@@ -51,8 +51,7 @@ obj := $(KBUILD_EXTMOD)
+ src := $(obj)
+
+ # Include the module's Makefile to find KBUILD_EXTRA_SYMBOLS
+-include $(if $(wildcard $(KBUILD_EXTMOD)/Kbuild), \
+- $(KBUILD_EXTMOD)/Kbuild, $(KBUILD_EXTMOD)/Makefile)
++include $(if $(wildcard $(src)/Kbuild), $(src)/Kbuild, $(src)/Makefile)
+ endif
+
+ include scripts/Makefile.lib
+diff --git a/tools/testing/selftests/bpf/test_align.c b/tools/testing/selftests/bpf/test_align.c
+index 3c789d03b629d..0ae7a74154146 100644
+--- a/tools/testing/selftests/bpf/test_align.c
++++ b/tools/testing/selftests/bpf/test_align.c
+@@ -359,15 +359,15 @@ static struct bpf_align_test tests[] = {
+ * is still (4n), fixed offset is not changed.
+ * Also, we create a new reg->id.
+ */
+- {29, "R5_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc))"},
++ {29, "R5_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc)"},
+ /* At the time the word size load is performed from R5,
+ * its total fixed offset is NET_IP_ALIGN + reg->off (18)
+ * which is 20. Then the variable offset is (4n), so
+ * the total offset is 4-byte aligned and meets the
+ * load's requirements.
+ */
+- {33, "R4=pkt(id=4,off=22,r=22,umax_value=2040,var_off=(0x0; 0x7fc))"},
+- {33, "R5=pkt(id=4,off=18,r=22,umax_value=2040,var_off=(0x0; 0x7fc))"},
++ {33, "R4=pkt(id=4,off=22,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"},
++ {33, "R5=pkt(id=4,off=18,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"},
+ },
+ },
+ {
+@@ -410,15 +410,15 @@ static struct bpf_align_test tests[] = {
+ /* Adding 14 makes R6 be (4n+2) */
+ {9, "R6_w=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},
+ /* Packet pointer has (4n+2) offset */
+- {11, "R5_w=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},
+- {13, "R4=pkt(id=1,off=4,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},
++ {11, "R5_w=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc)"},
++ {13, "R4=pkt(id=1,off=4,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc)"},
+ /* At the time the word size load is performed from R5,
+ * its total fixed offset is NET_IP_ALIGN + reg->off (0)
+ * which is 2. Then the variable offset is (4n+2), so
+ * the total offset is 4-byte aligned and meets the
+ * load's requirements.
+ */
+- {15, "R5=pkt(id=1,off=0,r=4,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"},
++ {15, "R5=pkt(id=1,off=0,r=4,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc)"},
+ /* Newly read value in R6 was shifted left by 2, so has
+ * known alignment of 4.
+ */
+@@ -426,15 +426,15 @@ static struct bpf_align_test tests[] = {
+ /* Added (4n) to packet pointer's (4n+2) var_off, giving
+ * another (4n+2).
+ */
+- {19, "R5_w=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"},
+- {21, "R4=pkt(id=2,off=4,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"},
++ {19, "R5_w=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc)"},
++ {21, "R4=pkt(id=2,off=4,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc)"},
+ /* At the time the word size load is performed from R5,
+ * its total fixed offset is NET_IP_ALIGN + reg->off (0)
+ * which is 2. Then the variable offset is (4n+2), so
+ * the total offset is 4-byte aligned and meets the
+ * load's requirements.
+ */
+- {23, "R5=pkt(id=2,off=0,r=4,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"},
++ {23, "R5=pkt(id=2,off=0,r=4,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc)"},
+ },
+ },
+ {
+@@ -469,11 +469,11 @@ static struct bpf_align_test tests[] = {
+ .matches = {
+ {4, "R5_w=pkt_end(id=0,off=0,imm=0)"},
+ /* (ptr - ptr) << 2 == unknown, (4n) */
+- {6, "R5_w=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc))"},
++ {6, "R5_w=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc)"},
+ /* (4n) + 14 == (4n+2). We blow our bounds, because
+ * the add could overflow.
+ */
+- {7, "R5=inv(id=0,var_off=(0x2; 0xfffffffffffffffc))"},
++ {7, "R5=inv(id=0,smin_value=-9223372036854775806,smax_value=9223372036854775806,umin_value=2,umax_value=18446744073709551614,var_off=(0x2; 0xfffffffffffffffc)"},
+ /* Checked s>=0 */
+ {9, "R5=inv(id=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},
+ /* packet pointer + nonnegative (4n+2) */
+@@ -528,7 +528,7 @@ static struct bpf_align_test tests[] = {
+ /* New unknown value in R7 is (4n) */
+ {11, "R7_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"},
+ /* Subtracting it from R6 blows our unsigned bounds */
+- {12, "R6=inv(id=0,smin_value=-1006,smax_value=1034,var_off=(0x2; 0xfffffffffffffffc))"},
++ {12, "R6=inv(id=0,smin_value=-1006,smax_value=1034,umin_value=2,umax_value=18446744073709551614,var_off=(0x2; 0xfffffffffffffffc)"},
+ /* Checked s>= 0 */
+ {14, "R6=inv(id=0,umin_value=2,umax_value=1034,var_off=(0x2; 0x7fc))"},
+ /* At the time the word size load is performed from R5,
+@@ -537,7 +537,8 @@ static struct bpf_align_test tests[] = {
+ * the total offset is 4-byte aligned and meets the
+ * load's requirements.
+ */
+- {20, "R5=pkt(id=1,off=0,r=4,umin_value=2,umax_value=1034,var_off=(0x2; 0x7fc))"},
++ {20, "R5=pkt(id=1,off=0,r=4,umin_value=2,umax_value=1034,var_off=(0x2; 0x7fc)"},
++
+ },
+ },
+ {
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index 858e551432339..9a103bd3542cf 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -9108,10 +9108,10 @@ static struct bpf_test tests[] = {
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+ offsetof(struct xdp_md, data_end)),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+ BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
+@@ -9166,10 +9166,10 @@ static struct bpf_test tests[] = {
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+ offsetof(struct xdp_md, data_end)),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+ BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
+@@ -9279,9 +9279,9 @@ static struct bpf_test tests[] = {
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+ offsetof(struct xdp_md, data_end)),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+ BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
+@@ -9451,9 +9451,9 @@ static struct bpf_test tests[] = {
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+ offsetof(struct xdp_md, data_end)),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+ BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
+@@ -9564,10 +9564,10 @@ static struct bpf_test tests[] = {
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+ offsetof(struct xdp_md, data)),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+ BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
+@@ -9622,10 +9622,10 @@ static struct bpf_test tests[] = {
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+ offsetof(struct xdp_md, data)),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+ BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
+ BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
+@@ -9735,9 +9735,9 @@ static struct bpf_test tests[] = {
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+ offsetof(struct xdp_md, data)),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+ BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
+@@ -9907,9 +9907,9 @@ static struct bpf_test tests[] = {
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+ offsetof(struct xdp_md, data)),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+- BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+ BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
+- BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-09-15 11:09 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-09-15 11:09 UTC (permalink / raw
To: gentoo-commits
commit: 4c8a0a4020ed1952402fcaf2a05f18ebc2d6979a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 15 11:09:05 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Sep 15 11:09:05 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4c8a0a40
Linux patch 4.19.258
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1257_linux-4.19.258.patch | 1908 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1912 insertions(+)
diff --git a/0000_README b/0000_README
index dff212f8..f372055b 100644
--- a/0000_README
+++ b/0000_README
@@ -1071,6 +1071,10 @@ Patch: 1256_linux-4.19.257.patch
From: https://www.kernel.org
Desc: Linux 4.19.257
+Patch: 1257_linux-4.19.258.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.258
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1257_linux-4.19.258.patch b/1257_linux-4.19.258.patch
new file mode 100644
index 00000000..65f5957f
--- /dev/null
+++ b/1257_linux-4.19.258.patch
@@ -0,0 +1,1908 @@
+diff --git a/Makefile b/Makefile
+index 18ccab9a01b06..e35356f7a1e66 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 257
++SUBLEVEL = 258
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c
+index d17414cbb89a8..473935695efb7 100644
+--- a/arch/arm64/kernel/cacheinfo.c
++++ b/arch/arm64/kernel/cacheinfo.c
+@@ -47,7 +47,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf,
+
+ int init_cache_level(unsigned int cpu)
+ {
+- unsigned int ctype, level, leaves, fw_level;
++ unsigned int ctype, level, leaves;
++ int fw_level;
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+
+ for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) {
+@@ -65,6 +66,9 @@ int init_cache_level(unsigned int cpu)
+ else
+ fw_level = acpi_find_last_cache_level(cpu);
+
++ if (fw_level < 0)
++ return fw_level;
++
+ if (level < fw_level) {
+ /*
+ * some external caches not specified in CLIDR_EL1
+diff --git a/arch/mips/loongson32/ls1c/board.c b/arch/mips/loongson32/ls1c/board.c
+index eb2d913c694fd..2d9675a6782c3 100644
+--- a/arch/mips/loongson32/ls1c/board.c
++++ b/arch/mips/loongson32/ls1c/board.c
+@@ -19,7 +19,6 @@ static struct platform_device *ls1c_platform_devices[] __initdata = {
+ static int __init ls1c_platform_init(void)
+ {
+ ls1x_serial_set_uartclk(&ls1x_uart_pdev);
+- ls1x_rtc_set_extclk(&ls1x_rtc_pdev);
+
+ return platform_add_devices(ls1c_platform_devices,
+ ARRAY_SIZE(ls1c_platform_devices));
+diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
+index f56cbab64ac10..92bc2fa7e6929 100644
+--- a/arch/parisc/kernel/head.S
++++ b/arch/parisc/kernel/head.S
+@@ -22,7 +22,7 @@
+ #include <linux/linkage.h>
+ #include <linux/init.h>
+
+- .level PA_ASM_LEVEL
++ .level 1.1
+
+ __INITDATA
+ ENTRY(boot_args)
+@@ -69,6 +69,47 @@ $bss_loop:
+ stw,ma %arg2,4(%r1)
+ stw,ma %arg3,4(%r1)
+
++#if !defined(CONFIG_64BIT) && defined(CONFIG_PA20)
++ /* This 32-bit kernel was compiled for PA2.0 CPUs. Check current CPU
++ * and halt kernel if we detect a PA1.x CPU. */
++ ldi 32,%r10
++ mtctl %r10,%cr11
++ .level 2.0
++ mfctl,w %cr11,%r10
++ .level 1.1
++ comib,<>,n 0,%r10,$cpu_ok
++
++ load32 PA(msg1),%arg0
++ ldi msg1_end-msg1,%arg1
++$iodc_panic:
++ copy %arg0, %r10
++ copy %arg1, %r11
++ load32 PA(init_stack),%sp
++#define MEM_CONS 0x3A0
++ ldw MEM_CONS+32(%r0),%arg0 // HPA
++ ldi ENTRY_IO_COUT,%arg1
++ ldw MEM_CONS+36(%r0),%arg2 // SPA
++ ldw MEM_CONS+8(%r0),%arg3 // layers
++ load32 PA(__bss_start),%r1
++ stw %r1,-52(%sp) // arg4
++ stw %r0,-56(%sp) // arg5
++ stw %r10,-60(%sp) // arg6 = ptr to text
++ stw %r11,-64(%sp) // arg7 = len
++ stw %r0,-68(%sp) // arg8
++ load32 PA(.iodc_panic_ret), %rp
++ ldw MEM_CONS+40(%r0),%r1 // ENTRY_IODC
++ bv,n (%r1)
++.iodc_panic_ret:
++ b . /* wait endless with ... */
++ or %r10,%r10,%r10 /* qemu idle sleep */
++msg1: .ascii "Can't boot kernel which was built for PA8x00 CPUs on this machine.\r\n"
++msg1_end:
++
++$cpu_ok:
++#endif
++
++ .level PA_ASM_LEVEL
++
+ /* Initialize startup VM. Just map first 16/32 MB of memory */
+ load32 PA(swapper_pg_dir),%r4
+ mtctl %r4,%cr24 /* Initialize kernel root pointer */
+diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h
+index 2d1afa58a4b6b..23e5751940841 100644
+--- a/arch/s390/include/asm/hugetlb.h
++++ b/arch/s390/include/asm/hugetlb.h
+@@ -30,9 +30,11 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+ static inline int prepare_hugepage_range(struct file *file,
+ unsigned long addr, unsigned long len)
+ {
+- if (len & ~HPAGE_MASK)
++ struct hstate *h = hstate_file(file);
++
++ if (len & ~huge_page_mask(h))
+ return -EINVAL;
+- if (addr & ~HPAGE_MASK)
++ if (addr & ~huge_page_mask(h))
+ return -EINVAL;
+ return 0;
+ }
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index 18ede6e806b91..160a05c6ce881 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -121,6 +121,7 @@ SECTIONS
+ /*
+ * Table with the patch locations to undo expolines
+ */
++ . = ALIGN(4);
+ .nospec_call_table : {
+ __nospec_call_start = . ;
+ *(.s390_indirect*)
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 747549934fe32..17a236a8b2370 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -35,6 +35,7 @@
+ * the optimal version — two calls, each with their own speculation
+ * trap should their return address end up getting used, in a loop.
+ */
++#ifdef CONFIG_X86_64
+ #define __FILL_RETURN_BUFFER(reg, nr, sp) \
+ mov $(nr/2), reg; \
+ 771: \
+@@ -55,6 +56,19 @@
+ add $(BITS_PER_LONG/8) * nr, sp; \
+ /* barrier for jnz misprediction */ \
+ lfence;
++#else
++/*
++ * i386 doesn't unconditionally have LFENCE, as such it can't
++ * do a loop.
++ */
++#define __FILL_RETURN_BUFFER(reg, nr, sp) \
++ .rept nr; \
++ call 772f; \
++ int3; \
++772:; \
++ .endr; \
++ add $(BITS_PER_LONG/8) * nr, sp;
++#endif
+
+ /* Sequence to mitigate PBRSB on eIBRS CPUs */
+ #define __ISSUE_UNBALANCED_RET_GUARD(sp) \
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 35c13be4adc60..3e57d5682b693 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -1809,6 +1809,18 @@ static int binder_inc_ref_for_node(struct binder_proc *proc,
+ }
+ ret = binder_inc_ref_olocked(ref, strong, target_list);
+ *rdata = ref->data;
++ if (ret && ref == new_ref) {
++ /*
++ * Cleanup the failed reference here as the target
++ * could now be dead and have already released its
++ * references by now. Calling on the new reference
++ * with strong=0 and a tmp_refs will not decrement
++ * the node. The new_ref gets kfree'd below.
++ */
++ binder_cleanup_ref_olocked(new_ref);
++ ref = NULL;
++ }
++
+ binder_proc_unlock(proc);
+ if (new_ref && ref != new_ref)
+ /*
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 26ba7a99b7d5b..63390a416b445 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -738,6 +738,11 @@ static int __device_attach_driver(struct device_driver *drv, void *_data)
+ } else if (ret == -EPROBE_DEFER) {
+ dev_dbg(dev, "Device match requests probe deferral\n");
+ driver_deferred_probe_add(dev);
++ /*
++ * Device can't match with a driver right now, so don't attempt
++ * to match or bind with other drivers on the bus.
++ */
++ return ret;
+ } else if (ret < 0) {
+ dev_dbg(dev, "Bus failed to match device: %d", ret);
+ return ret;
+@@ -891,6 +896,11 @@ static int __driver_attach(struct device *dev, void *data)
+ } else if (ret == -EPROBE_DEFER) {
+ dev_dbg(dev, "Device match requests probe deferral\n");
+ driver_deferred_probe_add(dev);
++ /*
++ * Driver could not match with device, but may match with
++ * another device on the bus.
++ */
++ return 0;
+ } else if (ret < 0) {
+ dev_dbg(dev, "Bus failed to match device: %d", ret);
+ return ret;
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 32606d1094fe4..53ac3a0e741d7 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -732,10 +732,9 @@ static void clk_core_unprepare(struct clk_core *core)
+ if (core->ops->unprepare)
+ core->ops->unprepare(core->hw);
+
+- clk_pm_runtime_put(core);
+-
+ trace_clk_unprepare_complete(core);
+ clk_core_unprepare(core->parent);
++ clk_pm_runtime_put(core);
+ }
+
+ static void clk_core_unprepare_lock(struct clk_core *core)
+diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c
+index 96688986da56a..94aae1e67c996 100644
+--- a/drivers/firmware/efi/capsule-loader.c
++++ b/drivers/firmware/efi/capsule-loader.c
+@@ -243,29 +243,6 @@ failed:
+ return ret;
+ }
+
+-/**
+- * efi_capsule_flush - called by file close or file flush
+- * @file: file pointer
+- * @id: not used
+- *
+- * If a capsule is being partially uploaded then calling this function
+- * will be treated as upload termination and will free those completed
+- * buffer pages and -ECANCELED will be returned.
+- **/
+-static int efi_capsule_flush(struct file *file, fl_owner_t id)
+-{
+- int ret = 0;
+- struct capsule_info *cap_info = file->private_data;
+-
+- if (cap_info->index > 0) {
+- pr_err("capsule upload not complete\n");
+- efi_free_all_buff_pages(cap_info);
+- ret = -ECANCELED;
+- }
+-
+- return ret;
+-}
+-
+ /**
+ * efi_capsule_release - called by file close
+ * @inode: not used
+@@ -278,6 +255,13 @@ static int efi_capsule_release(struct inode *inode, struct file *file)
+ {
+ struct capsule_info *cap_info = file->private_data;
+
++ if (cap_info->index > 0 &&
++ (cap_info->header.headersize == 0 ||
++ cap_info->count < cap_info->total_size)) {
++ pr_err("capsule upload not complete\n");
++ efi_free_all_buff_pages(cap_info);
++ }
++
+ kfree(cap_info->pages);
+ kfree(cap_info->phys);
+ kfree(file->private_data);
+@@ -325,7 +309,6 @@ static const struct file_operations efi_capsule_fops = {
+ .owner = THIS_MODULE,
+ .open = efi_capsule_open,
+ .write = efi_capsule_write,
+- .flush = efi_capsule_flush,
+ .release = efi_capsule_release,
+ .llseek = no_llseek,
+ };
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index d8ae6a23e6133..d36bea68a67e1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -1771,7 +1771,8 @@ static void gfx_v9_0_gpu_init(struct amdgpu_device *adev)
+
+ gfx_v9_0_tiling_mode_table_init(adev);
+
+- gfx_v9_0_setup_rb(adev);
++ if (adev->gfx.num_gfx_rings)
++ gfx_v9_0_setup_rb(adev);
+ gfx_v9_0_get_cu_info(adev, &adev->gfx.cu_info);
+ adev->gfx.config.db_debug2 = RREG32_SOC15(GC, 0, mmDB_DEBUG2);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
+index c963eec58c702..923bc097a00b2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
+@@ -155,6 +155,7 @@ static void mmhub_v1_0_init_cache_regs(struct amdgpu_device *adev)
+ tmp = REG_SET_FIELD(tmp, VM_L2_CNTL2, INVALIDATE_L2_CACHE, 1);
+ WREG32_SOC15(MMHUB, 0, mmVM_L2_CNTL2, tmp);
+
++ tmp = mmVM_L2_CNTL3_DEFAULT;
+ if (adev->gmc.translate_further) {
+ tmp = REG_SET_FIELD(tmp, VM_L2_CNTL3, BANK_SELECT, 12);
+ tmp = REG_SET_FIELD(tmp, VM_L2_CNTL3,
+diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
+index 94c1089ecf59e..1bde4b618d151 100644
+--- a/drivers/gpu/drm/i915/gvt/handlers.c
++++ b/drivers/gpu/drm/i915/gvt/handlers.c
+@@ -651,7 +651,7 @@ static int update_fdi_rx_iir_status(struct intel_vgpu *vgpu,
+ else if (FDI_RX_IMR_TO_PIPE(offset) != INVALID_INDEX)
+ index = FDI_RX_IMR_TO_PIPE(offset);
+ else {
+- gvt_vgpu_err("Unsupport registers %x\n", offset);
++ gvt_vgpu_err("Unsupported registers %x\n", offset);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+index dcdfb1bb54f98..ad9d693e11da7 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+@@ -105,7 +105,7 @@ static const char * const dsi_8996_bus_clk_names[] = {
+ static const struct msm_dsi_config msm8996_dsi_cfg = {
+ .io_offset = DSI_6G_REG_SHIFT,
+ .reg_cfg = {
+- .num = 2,
++ .num = 3,
+ .regs = {
+ {"vdda", 18160, 1 }, /* 1.25 V */
+ {"vcca", 17000, 32 }, /* 0.925 V */
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+index f01e245cd0eee..bed0cd72e3ebd 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+@@ -355,7 +355,7 @@ int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_timing *timing,
+ } else {
+ timing->shared_timings.clk_pre =
+ linear_inter(tmax, tmin, pcnt2, 0, false);
+- timing->shared_timings.clk_pre_inc_by_2 = 0;
++ timing->shared_timings.clk_pre_inc_by_2 = 0;
+ }
+
+ timing->ta_go = 3;
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 59c8a6647ff21..cc1c07963116c 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -1625,6 +1625,9 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend,
+ if (r) {
+ /* delay GPU reset to resume */
+ radeon_fence_driver_force_completion(rdev, i);
++ } else {
++ /* finish executing delayed work */
++ flush_delayed_work(&rdev->fence_drv[i].lockup_work);
+ }
+ }
+
+diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
+index a3974cddef079..534a175a6e4cf 100644
+--- a/drivers/hwmon/gpio-fan.c
++++ b/drivers/hwmon/gpio-fan.c
+@@ -404,6 +404,9 @@ static int gpio_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ if (!fan_data)
+ return -EINVAL;
+
++ if (state >= fan_data->num_speed)
++ return -EINVAL;
++
+ set_fan_speed(fan_data, state);
+ return 0;
+ }
+diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/mad.c
+index cdf6e26ebc87d..fb6dcd12db254 100644
+--- a/drivers/infiniband/hw/mlx5/mad.c
++++ b/drivers/infiniband/hw/mlx5/mad.c
+@@ -216,6 +216,12 @@ static int process_pma_cmd(struct mlx5_ib_dev *dev, u8 port_num,
+ mdev = dev->mdev;
+ mdev_port_num = 1;
+ }
++ if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1) {
++ /* set local port to one for Function-Per-Port HCA. */
++ mdev = dev->mdev;
++ mdev_port_num = 1;
++ }
++
+ /* Declaring support of extended counters */
+ if (in_mad->mad_hdr.attr_id == IB_PMA_CLASS_PORT_INFO) {
+ struct ib_class_port_info cpi = {};
+diff --git a/drivers/input/misc/rk805-pwrkey.c b/drivers/input/misc/rk805-pwrkey.c
+index 921003963a53c..cdcad5c01e3c0 100644
+--- a/drivers/input/misc/rk805-pwrkey.c
++++ b/drivers/input/misc/rk805-pwrkey.c
+@@ -106,6 +106,7 @@ static struct platform_driver rk805_pwrkey_driver = {
+ };
+ module_platform_driver(rk805_pwrkey_driver);
+
++MODULE_ALIAS("platform:rk805-pwrkey");
+ MODULE_AUTHOR("Joseph Chen <chenjh@rock-chips.com>");
+ MODULE_DESCRIPTION("RK805 PMIC Power Key driver");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
+index c1832a8487140..2fa4becdaee92 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
+@@ -178,6 +178,10 @@ void i40e_notify_client_of_netdev_close(struct i40e_vsi *vsi, bool reset)
+ "Cannot locate client instance close routine\n");
+ return;
+ }
++ if (!test_bit(__I40E_CLIENT_INSTANCE_OPENED, &cdev->state)) {
++ dev_dbg(&pf->pdev->dev, "Client is not open, abort close\n");
++ return;
++ }
+ cdev->client->ops->close(&cdev->lan_info, cdev->client, reset);
+ clear_bit(__I40E_CLIENT_INSTANCE_OPENED, &cdev->state);
+ i40e_client_release_qvlist(&cdev->lan_info);
+@@ -376,7 +380,6 @@ void i40e_client_subtask(struct i40e_pf *pf)
+ /* Remove failed client instance */
+ clear_bit(__I40E_CLIENT_INSTANCE_OPENED,
+ &cdev->state);
+- i40e_client_del_instance(pf);
+ return;
+ }
+ }
+diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c
+index 6473cc68c2d5c..4039e1fc6e92a 100644
+--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c
++++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c
+@@ -1276,7 +1276,7 @@ static int ofdpa_port_ipv4_neigh(struct ofdpa_port *ofdpa_port,
+ bool removing;
+ int err = 0;
+
+- entry = kzalloc(sizeof(*entry), GFP_KERNEL);
++ entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+ if (!entry)
+ return -ENOMEM;
+
+diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
+index a686926bba71e..6ef5523f4e717 100644
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -1318,10 +1318,11 @@ static int adf7242_remove(struct spi_device *spi)
+
+ debugfs_remove_recursive(lp->debugfs_root);
+
++ ieee802154_unregister_hw(lp->hw);
++
+ cancel_delayed_work_sync(&lp->work);
+ destroy_workqueue(lp->wqueue);
+
+- ieee802154_unregister_hw(lp->hw);
+ mutex_destroy(&lp->bmux);
+ ieee802154_free_hw(lp->hw);
+
+diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c
+index 9e2ed98f7df2b..cffa0cb517204 100644
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -204,7 +204,6 @@ static int dp83822_config_intr(struct phy_device *phydev)
+ return misr_status;
+
+ misr_status |= (DP83822_RX_ERR_HF_INT_EN |
+- DP83822_FALSE_CARRIER_HF_INT_EN |
+ DP83822_ANEG_COMPLETE_INT_EN |
+ DP83822_DUP_MODE_CHANGE_INT_EN |
+ DP83822_SPEED_CHANGED_INT_EN |
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-rs.c b/drivers/net/wireless/intel/iwlegacy/4965-rs.c
+index f204e139e5f02..cfa54d35ba2e0 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-rs.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-rs.c
+@@ -2422,7 +2422,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta,
+ /* Repeat initial/next rate.
+ * For legacy IL_NUMBER_TRY == 1, this loop will not execute.
+ * For HT IL_HT_NUMBER_TRY == 3, this executes twice. */
+- while (repeat_rate > 0) {
++ while (repeat_rate > 0 && idx < (LINK_QUAL_MAX_RETRY_NUM - 1)) {
+ if (is_legacy(tbl_type.lq_type)) {
+ if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE)
+ ant_toggle_cnt++;
+@@ -2441,8 +2441,6 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta,
+ cpu_to_le32(new_rate);
+ repeat_rate--;
+ idx++;
+- if (idx >= LINK_QUAL_MAX_RETRY_NUM)
+- goto out;
+ }
+
+ il4965_rs_get_tbl_info_from_mcs(new_rate, lq_sta->band,
+@@ -2487,7 +2485,6 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta,
+ repeat_rate--;
+ }
+
+-out:
+ lq_cmd->agg_params.agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
+ lq_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+
+diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
+index 6efab7a06c5fc..73ee74d6e7a3d 100644
+--- a/drivers/parisc/ccio-dma.c
++++ b/drivers/parisc/ccio-dma.c
+@@ -1390,15 +1390,17 @@ ccio_init_resource(struct resource *res, char *name, void __iomem *ioaddr)
+ }
+ }
+
+-static void __init ccio_init_resources(struct ioc *ioc)
++static int __init ccio_init_resources(struct ioc *ioc)
+ {
+ struct resource *res = ioc->mmio_region;
+ char *name = kmalloc(14, GFP_KERNEL);
+-
++ if (unlikely(!name))
++ return -ENOMEM;
+ snprintf(name, 14, "GSC Bus [%d/]", ioc->hw_path);
+
+ ccio_init_resource(res, name, &ioc->ioc_regs->io_io_low);
+ ccio_init_resource(res + 1, name, &ioc->ioc_regs->io_io_low_hv);
++ return 0;
+ }
+
+ static int new_ioc_area(struct resource *res, unsigned long size,
+@@ -1552,7 +1554,10 @@ static int __init ccio_probe(struct parisc_device *dev)
+ return -ENOMEM;
+ }
+ ccio_ioc_init(ioc);
+- ccio_init_resources(ioc);
++ if (ccio_init_resources(ioc)) {
++ kfree(ioc);
++ return -ENOMEM;
++ }
+ hppa_dma_ops = &ccio_ops;
+ dev->dev.platform_data = kzalloc(sizeof(struct pci_hba_data), GFP_KERNEL);
+
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index 682fc49d172cb..e8440850b73ac 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -253,7 +253,7 @@ static void pmc_power_off(void)
+ pm1_cnt_port = acpi_base_addr + PM1_CNT;
+
+ pm1_cnt_value = inl(pm1_cnt_port);
+- pm1_cnt_value &= SLEEP_TYPE_MASK;
++ pm1_cnt_value &= ~SLEEP_TYPE_MASK;
+ pm1_cnt_value |= SLEEP_TYPE_S5;
+ pm1_cnt_value |= SLEEP_ENABLE;
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index d899f216245e5..c8d97dc2ca63d 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -3215,6 +3215,7 @@ static struct fw_event_work *dequeue_next_fw_event(struct MPT3SAS_ADAPTER *ioc)
+ fw_event = list_first_entry(&ioc->fw_event_list,
+ struct fw_event_work, list);
+ list_del_init(&fw_event->list);
++ fw_event_work_put(fw_event);
+ }
+ spin_unlock_irqrestore(&ioc->fw_event_lock, flags);
+
+@@ -3249,7 +3250,6 @@ _scsih_fw_event_cleanup_queue(struct MPT3SAS_ADAPTER *ioc)
+ if (cancel_work_sync(&fw_event->work))
+ fw_event_work_put(fw_event);
+
+- fw_event_work_put(fw_event);
+ }
+ }
+
+diff --git a/drivers/soc/bcm/brcmstb/pm/pm-arm.c b/drivers/soc/bcm/brcmstb/pm/pm-arm.c
+index f4ad45a1efabe..fd124e0850207 100644
+--- a/drivers/soc/bcm/brcmstb/pm/pm-arm.c
++++ b/drivers/soc/bcm/brcmstb/pm/pm-arm.c
+@@ -689,13 +689,14 @@ static int brcmstb_pm_probe(struct platform_device *pdev)
+ const struct of_device_id *of_id = NULL;
+ struct device_node *dn;
+ void __iomem *base;
+- int ret, i;
++ int ret, i, s;
+
+ /* AON ctrl registers */
+ base = brcmstb_ioremap_match(aon_ctrl_dt_ids, 0, NULL);
+ if (IS_ERR(base)) {
+ pr_err("error mapping AON_CTRL\n");
+- return PTR_ERR(base);
++ ret = PTR_ERR(base);
++ goto aon_err;
+ }
+ ctrl.aon_ctrl_base = base;
+
+@@ -705,8 +706,10 @@ static int brcmstb_pm_probe(struct platform_device *pdev)
+ /* Assume standard offset */
+ ctrl.aon_sram = ctrl.aon_ctrl_base +
+ AON_CTRL_SYSTEM_DATA_RAM_OFS;
++ s = 0;
+ } else {
+ ctrl.aon_sram = base;
++ s = 1;
+ }
+
+ writel_relaxed(0, ctrl.aon_sram + AON_REG_PANIC);
+@@ -716,7 +719,8 @@ static int brcmstb_pm_probe(struct platform_device *pdev)
+ (const void **)&ddr_phy_data);
+ if (IS_ERR(base)) {
+ pr_err("error mapping DDR PHY\n");
+- return PTR_ERR(base);
++ ret = PTR_ERR(base);
++ goto ddr_phy_err;
+ }
+ ctrl.support_warm_boot = ddr_phy_data->supports_warm_boot;
+ ctrl.pll_status_offset = ddr_phy_data->pll_status_offset;
+@@ -736,17 +740,20 @@ static int brcmstb_pm_probe(struct platform_device *pdev)
+ for_each_matching_node(dn, ddr_shimphy_dt_ids) {
+ i = ctrl.num_memc;
+ if (i >= MAX_NUM_MEMC) {
++ of_node_put(dn);
+ pr_warn("too many MEMCs (max %d)\n", MAX_NUM_MEMC);
+ break;
+ }
+
+ base = of_io_request_and_map(dn, 0, dn->full_name);
+ if (IS_ERR(base)) {
++ of_node_put(dn);
+ if (!ctrl.support_warm_boot)
+ break;
+
+ pr_err("error mapping DDR SHIMPHY %d\n", i);
+- return PTR_ERR(base);
++ ret = PTR_ERR(base);
++ goto ddr_shimphy_err;
+ }
+ ctrl.memcs[i].ddr_shimphy_base = base;
+ ctrl.num_memc++;
+@@ -757,14 +764,18 @@ static int brcmstb_pm_probe(struct platform_device *pdev)
+ for_each_matching_node(dn, brcmstb_memc_of_match) {
+ base = of_iomap(dn, 0);
+ if (!base) {
++ of_node_put(dn);
+ pr_err("error mapping DDR Sequencer %d\n", i);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto brcmstb_memc_err;
+ }
+
+ of_id = of_match_node(brcmstb_memc_of_match, dn);
+ if (!of_id) {
+ iounmap(base);
+- return -EINVAL;
++ of_node_put(dn);
++ ret = -EINVAL;
++ goto brcmstb_memc_err;
+ }
+
+ ddr_seq_data = of_id->data;
+@@ -784,21 +795,24 @@ static int brcmstb_pm_probe(struct platform_device *pdev)
+ dn = of_find_matching_node(NULL, sram_dt_ids);
+ if (!dn) {
+ pr_err("SRAM not found\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto brcmstb_memc_err;
+ }
+
+ ret = brcmstb_init_sram(dn);
+ of_node_put(dn);
+ if (ret) {
+ pr_err("error setting up SRAM for PM\n");
+- return ret;
++ goto brcmstb_memc_err;
+ }
+
+ ctrl.pdev = pdev;
+
+ ctrl.s3_params = kmalloc(sizeof(*ctrl.s3_params), GFP_KERNEL);
+- if (!ctrl.s3_params)
+- return -ENOMEM;
++ if (!ctrl.s3_params) {
++ ret = -ENOMEM;
++ goto s3_params_err;
++ }
+ ctrl.s3_params_pa = dma_map_single(&pdev->dev, ctrl.s3_params,
+ sizeof(*ctrl.s3_params),
+ DMA_TO_DEVICE);
+@@ -818,7 +832,21 @@ static int brcmstb_pm_probe(struct platform_device *pdev)
+
+ out:
+ kfree(ctrl.s3_params);
+-
++s3_params_err:
++ iounmap(ctrl.boot_sram);
++brcmstb_memc_err:
++ for (i--; i >= 0; i--)
++ iounmap(ctrl.memcs[i].ddr_ctrl);
++ddr_shimphy_err:
++ for (i = 0; i < ctrl.num_memc; i++)
++ iounmap(ctrl.memcs[i].ddr_shimphy_base);
++
++ iounmap(ctrl.memcs[0].ddr_phy_base);
++ddr_phy_err:
++ iounmap(ctrl.aon_ctrl_base);
++ if (s)
++ iounmap(ctrl.aon_sram);
++aon_err:
+ pr_warn("PM: initialization failed with code %d\n", ret);
+
+ return ret;
+diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c
+index 63bc811681d96..fb092d4ec5219 100644
+--- a/drivers/staging/rtl8712/rtl8712_cmd.c
++++ b/drivers/staging/rtl8712/rtl8712_cmd.c
+@@ -129,34 +129,6 @@ static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf)
+ kfree(pdrvcmd->pbuf);
+ }
+
+-static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
+-{
+- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
+- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
+-
+- /* invoke cmd->callback function */
+- pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
+- if (!pcmd_callback)
+- r8712_free_cmd_obj(pcmd);
+- else
+- pcmd_callback(padapter, pcmd);
+- return H2C_SUCCESS;
+-}
+-
+-static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
+-{
+- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd);
+- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
+-
+- /* invoke cmd->callback function */
+- pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
+- if (!pcmd_callback)
+- r8712_free_cmd_obj(pcmd);
+- else
+- pcmd_callback(padapter, pcmd);
+- return H2C_SUCCESS;
+-}
+-
+ static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
+ {
+ struct cmd_obj *pcmd = (struct cmd_obj *)pbuf;
+@@ -225,14 +197,6 @@ static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter,
+ pcmd_r = NULL;
+
+ switch (pcmd->cmdcode) {
+- case GEN_CMD_CODE(_Read_MACREG):
+- read_macreg_hdl(padapter, (u8 *)pcmd);
+- pcmd_r = pcmd;
+- break;
+- case GEN_CMD_CODE(_Write_MACREG):
+- write_macreg_hdl(padapter, (u8 *)pcmd);
+- pcmd_r = pcmd;
+- break;
+ case GEN_CMD_CODE(_Read_BBREG):
+ read_bbreg_hdl(padapter, (u8 *)pcmd);
+ break;
+diff --git a/drivers/thunderbolt/ctl.c b/drivers/thunderbolt/ctl.c
+index 37a7f4c735d05..dcdfd3767a487 100644
+--- a/drivers/thunderbolt/ctl.c
++++ b/drivers/thunderbolt/ctl.c
+@@ -387,7 +387,7 @@ static void tb_ctl_rx_submit(struct ctl_pkg *pkg)
+
+ static int tb_async_error(const struct ctl_pkg *pkg)
+ {
+- const struct cfg_error_pkg *error = (const struct cfg_error_pkg *)pkg;
++ const struct cfg_error_pkg *error = pkg->buffer;
+
+ if (pkg->frame.eof != TB_CFG_PKG_ERROR)
+ return false;
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index b757fd1bdbfa5..069d02354c825 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1102,9 +1102,9 @@ static int lpuart_config_rs485(struct uart_port *port,
+ * Note: UART is assumed to be active high.
+ */
+ if (rs485->flags & SER_RS485_RTS_ON_SEND)
+- modem &= ~UARTMODEM_TXRTSPOL;
+- else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
+ modem |= UARTMODEM_TXRTSPOL;
++ else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
++ modem &= ~UARTMODEM_TXRTSPOL;
+ }
+
+ /* Store the new configuration */
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 198bf54568cc4..c9083d853076a 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -4518,9 +4518,11 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op)
+ console_lock();
+ if (vc->vc_mode != KD_TEXT)
+ rc = -EINVAL;
+- else if (vc->vc_sw->con_font_set)
++ else if (vc->vc_sw->con_font_set) {
++ if (vc_is_sel(vc))
++ clear_selection();
+ rc = vc->vc_sw->con_font_set(vc, &font, op->flags);
+- else
++ } else
+ rc = -ENOSYS;
+ console_unlock();
+ kfree(font.data);
+@@ -4547,9 +4549,11 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
+ console_unlock();
+ return -EINVAL;
+ }
+- if (vc->vc_sw->con_font_default)
++ if (vc->vc_sw->con_font_default) {
++ if (vc_is_sel(vc))
++ clear_selection();
+ rc = vc->vc_sw->con_font_default(vc, &font, s);
+- else
++ } else
+ rc = -ENOSYS;
+ console_unlock();
+ if (!rc) {
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 0522bd2d9d3cc..e927631c79c67 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1883,6 +1883,9 @@ static const struct usb_device_id acm_ids[] = {
+ { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
+ .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
+ },
++ { USB_DEVICE(0x0c26, 0x0020), /* Icom ICF3400 Serie */
++ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
++ },
+ { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */
+ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+ },
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 29cc2aa5abff5..4d04c75ac3815 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5851,6 +5851,11 @@ re_enumerate_no_bos:
+ * the reset is over (using their post_reset method).
+ *
+ * Return: The same as for usb_reset_and_verify_device().
++ * However, if a reset is already in progress (for instance, if a
++ * driver doesn't have pre_ or post_reset() callbacks, and while
++ * being unbound or re-bound during the ongoing reset its disconnect()
++ * or probe() routine tries to perform a second, nested reset), the
++ * routine returns -EINPROGRESS.
+ *
+ * Note:
+ * The caller must own the device lock. For example, it's safe to use
+@@ -5884,6 +5889,10 @@ int usb_reset_device(struct usb_device *udev)
+ return -EISDIR;
+ }
+
++ if (udev->reset_in_progress)
++ return -EINPROGRESS;
++ udev->reset_in_progress = 1;
++
+ port_dev = hub->ports[udev->portnum - 1];
+
+ /*
+@@ -5948,6 +5957,7 @@ int usb_reset_device(struct usb_device *udev)
+
+ usb_autosuspend_device(udev);
+ memalloc_noio_restore(noio_flag);
++ udev->reset_in_progress = 0;
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(usb_reset_device);
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
+index a9e86f5e6eaa3..4f30994960191 100644
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -142,9 +142,9 @@ static int __dwc2_lowlevel_hw_enable(struct dwc2_hsotg *hsotg)
+ } else if (hsotg->plat && hsotg->plat->phy_init) {
+ ret = hsotg->plat->phy_init(pdev, hsotg->plat->phy_type);
+ } else {
+- ret = phy_power_on(hsotg->phy);
++ ret = phy_init(hsotg->phy);
+ if (ret == 0)
+- ret = phy_init(hsotg->phy);
++ ret = phy_power_on(hsotg->phy);
+ }
+
+ return ret;
+@@ -176,9 +176,9 @@ static int __dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg)
+ } else if (hsotg->plat && hsotg->plat->phy_exit) {
+ ret = hsotg->plat->phy_exit(pdev, hsotg->plat->phy_type);
+ } else {
+- ret = phy_exit(hsotg->phy);
++ ret = phy_power_off(hsotg->phy);
+ if (ret == 0)
+- ret = phy_power_off(hsotg->phy);
++ ret = phy_exit(hsotg->phy);
+ }
+ if (ret)
+ return ret;
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 984faecdd7ecb..465aabb6e96c8 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -673,15 +673,16 @@ static void dwc3_core_exit(struct dwc3 *dwc)
+ {
+ dwc3_event_buffers_cleanup(dwc);
+
++ usb_phy_set_suspend(dwc->usb2_phy, 1);
++ usb_phy_set_suspend(dwc->usb3_phy, 1);
++ phy_power_off(dwc->usb2_generic_phy);
++ phy_power_off(dwc->usb3_generic_phy);
++
+ usb_phy_shutdown(dwc->usb2_phy);
+ usb_phy_shutdown(dwc->usb3_phy);
+ phy_exit(dwc->usb2_generic_phy);
+ phy_exit(dwc->usb3_generic_phy);
+
+- usb_phy_set_suspend(dwc->usb2_phy, 1);
+- usb_phy_set_suspend(dwc->usb3_phy, 1);
+- phy_power_off(dwc->usb2_generic_phy);
+- phy_power_off(dwc->usb3_generic_phy);
+ clk_bulk_disable(dwc->num_clks, dwc->clks);
+ clk_bulk_unprepare(dwc->num_clks, dwc->clks);
+ reset_control_assert(dwc->reset);
+@@ -1509,16 +1510,16 @@ err5:
+ dwc3_debugfs_exit(dwc);
+ dwc3_event_buffers_cleanup(dwc);
+
+- usb_phy_shutdown(dwc->usb2_phy);
+- usb_phy_shutdown(dwc->usb3_phy);
+- phy_exit(dwc->usb2_generic_phy);
+- phy_exit(dwc->usb3_generic_phy);
+-
+ usb_phy_set_suspend(dwc->usb2_phy, 1);
+ usb_phy_set_suspend(dwc->usb3_phy, 1);
+ phy_power_off(dwc->usb2_generic_phy);
+ phy_power_off(dwc->usb3_generic_phy);
+
++ usb_phy_shutdown(dwc->usb2_phy);
++ usb_phy_shutdown(dwc->usb3_phy);
++ phy_exit(dwc->usb2_generic_phy);
++ phy_exit(dwc->usb3_generic_phy);
++
+ dwc3_ulpi_exit(dwc);
+
+ err4:
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 5bb5384f36125..9d5320562e81f 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -173,6 +173,14 @@ static int dwc3_qcom_register_extcon(struct dwc3_qcom *qcom)
+ return 0;
+ }
+
++/* Only usable in contexts where the role can not change. */
++static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom)
++{
++ struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3);
++
++ return dwc->xhci;
++}
++
+ static void dwc3_qcom_disable_interrupts(struct dwc3_qcom *qcom)
+ {
+ if (qcom->hs_phy_irq) {
+@@ -280,7 +288,11 @@ static irqreturn_t qcom_dwc3_resume_irq(int irq, void *data)
+ if (qcom->pm_suspended)
+ return IRQ_HANDLED;
+
+- if (dwc->xhci)
++ /*
++ * This is safe as role switching is done from a freezable workqueue
++ * and the wakeup interrupts are disabled as part of resume.
++ */
++ if (dwc3_qcom_is_host(qcom))
+ pm_runtime_resume(&dwc->xhci->dev);
+
+ return IRQ_HANDLED;
+diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
+index 1a3878a3be78f..124e9f80dccd8 100644
+--- a/drivers/usb/dwc3/host.c
++++ b/drivers/usb/dwc3/host.c
+@@ -142,4 +142,5 @@ void dwc3_host_exit(struct dwc3 *dwc)
+ phy_remove_lookup(dwc->usb3_generic_phy, "usb3-phy",
+ dev_name(dwc->dev));
+ platform_device_unregister(dwc->xhci);
++ dwc->xhci = NULL;
+ }
+diff --git a/drivers/usb/gadget/function/storage_common.c b/drivers/usb/gadget/function/storage_common.c
+index f7e6c42558eb7..021984921f919 100644
+--- a/drivers/usb/gadget/function/storage_common.c
++++ b/drivers/usb/gadget/function/storage_common.c
+@@ -294,8 +294,10 @@ EXPORT_SYMBOL_GPL(fsg_lun_fsync_sub);
+ void store_cdrom_address(u8 *dest, int msf, u32 addr)
+ {
+ if (msf) {
+- /* Convert to Minutes-Seconds-Frames */
+- addr >>= 2; /* Convert to 2048-byte frames */
++ /*
++ * Convert to Minutes-Seconds-Frames.
++ * Sector size is already set to 2048 bytes.
++ */
+ addr += 2*75; /* Lead-in occupies 2 seconds */
+ dest[3] = addr % 75; /* Frames */
+ addr /= 75;
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index e40370ed7d8a5..b5a18817c8071 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -565,7 +565,7 @@ struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd)
+ * It will release and re-aquire the lock while calling ACPI
+ * method.
+ */
+-void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd,
++static void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd,
+ u16 index, bool on, unsigned long *flags)
+ {
+ struct xhci_hub *rhub;
+@@ -1464,6 +1464,17 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+
+ status = bus_state->resuming_ports;
+
++ /*
++ * SS devices are only visible to roothub after link training completes.
++ * Keep polling roothubs for a grace period after xHC start
++ */
++ if (xhci->run_graceperiod) {
++ if (time_before(jiffies, xhci->run_graceperiod))
++ status = 1;
++ else
++ xhci->run_graceperiod = 0;
++ }
++
+ mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
+
+ /* For each port, did anything change? If so, set that bit in buf. */
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 677587479d260..7fef6d9ed04f8 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -149,9 +149,11 @@ int xhci_start(struct xhci_hcd *xhci)
+ xhci_err(xhci, "Host took too long to start, "
+ "waited %u microseconds.\n",
+ XHCI_MAX_HALT_USEC);
+- if (!ret)
++ if (!ret) {
+ /* clear state flags. Including dying, halted or removing */
+ xhci->xhc_state = 0;
++ xhci->run_graceperiod = jiffies + msecs_to_jiffies(500);
++ }
+
+ return ret;
+ }
+@@ -774,8 +776,6 @@ static void xhci_stop(struct usb_hcd *hcd)
+ void xhci_shutdown(struct usb_hcd *hcd)
+ {
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+- unsigned long flags;
+- int i;
+
+ if (xhci->quirks & XHCI_SPURIOUS_REBOOT)
+ usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev));
+@@ -791,21 +791,12 @@ void xhci_shutdown(struct usb_hcd *hcd)
+ del_timer_sync(&xhci->shared_hcd->rh_timer);
+ }
+
+- spin_lock_irqsave(&xhci->lock, flags);
++ spin_lock_irq(&xhci->lock);
+ xhci_halt(xhci);
+-
+- /* Power off USB2 ports*/
+- for (i = 0; i < xhci->usb2_rhub.num_ports; i++)
+- xhci_set_port_power(xhci, xhci->main_hcd, i, false, &flags);
+-
+- /* Power off USB3 ports*/
+- for (i = 0; i < xhci->usb3_rhub.num_ports; i++)
+- xhci_set_port_power(xhci, xhci->shared_hcd, i, false, &flags);
+-
+ /* Workaround for spurious wakeups at shutdown with HSW */
+ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+ xhci_reset(xhci, XHCI_RESET_SHORT_USEC);
+- spin_unlock_irqrestore(&xhci->lock, flags);
++ spin_unlock_irq(&xhci->lock);
+
+ xhci_cleanup_msix(xhci);
+
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 3b29dfc6f79e3..029ffcb13d62e 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1811,7 +1811,7 @@ struct xhci_hcd {
+
+ /* Host controller watchdog timer structures */
+ unsigned int xhc_state;
+-
++ unsigned long run_graceperiod;
+ u32 command;
+ struct s3_save s3;
+ /* Host controller is dying - not responding to commands. "I'm not dead yet!"
+@@ -2145,8 +2145,6 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
+ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf);
+ int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1);
+ struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd);
+-void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd, u16 index,
+- bool on, unsigned long *flags);
+
+ void xhci_hc_died(struct xhci_hcd *xhci);
+
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index f789b60ed8c17..7eabb1bfafde5 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -96,6 +96,8 @@ struct ch341_private {
+ u8 mcr;
+ u8 msr;
+ u8 lcr;
++
++ u8 version;
+ };
+
+ static void ch341_set_termios(struct tty_struct *tty,
+@@ -174,13 +176,20 @@ static int ch341_set_baudrate_lcr(struct usb_device *dev,
+ /*
+ * CH341A buffers data until a full endpoint-size packet (32 bytes)
+ * has been received unless bit 7 is set.
++ *
++ * At least one device with version 0x27 appears to have this bit
++ * inverted.
+ */
+- a |= BIT(7);
++ if (priv->version > 0x27)
++ a |= BIT(7);
+
+ r = ch341_control_out(dev, CH341_REQ_WRITE_REG, 0x1312, a);
+ if (r)
+ return r;
+
++ if (priv->version < 0x30)
++ return 0;
++
+ r = ch341_control_out(dev, CH341_REQ_WRITE_REG, 0x2518, lcr);
+ if (r)
+ return r;
+@@ -232,7 +241,9 @@ static int ch341_configure(struct usb_device *dev, struct ch341_private *priv)
+ r = ch341_control_in(dev, CH341_REQ_READ_VERSION, 0, 0, buffer, size);
+ if (r < 0)
+ goto out;
+- dev_dbg(&dev->dev, "Chip version: 0x%02x\n", buffer[0]);
++
++ priv->version = buffer[0];
++ dev_dbg(&dev->dev, "Chip version: 0x%02x\n", priv->version);
+
+ r = ch341_control_out(dev, CH341_REQ_SERIAL_INIT, 0, 0);
+ if (r < 0)
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 95a5c73f3f787..c7c6d5d1dfbc8 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -131,6 +131,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */
+ { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */
+ { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
++ { USB_DEVICE(0x10C4, 0x8414) }, /* Decagon USB Cable Adapter */
+ { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
+ { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
+ { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 7fa56728696dd..623b54a5cd498 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1035,6 +1035,8 @@ static const struct usb_device_id id_table_combined[] = {
+ /* IDS GmbH devices */
+ { USB_DEVICE(IDS_VID, IDS_SI31A_PID) },
+ { USB_DEVICE(IDS_VID, IDS_CM31A_PID) },
++ /* Omron devices */
++ { USB_DEVICE(OMRON_VID, OMRON_CS1W_CIF31_PID) },
+ /* U-Blox devices */
+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 4e92c165c86bf..31c8ccabbbb78 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -661,6 +661,12 @@
+ #define INFINEON_TRIBOARD_TC1798_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
+ #define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */
+
++/*
++ * Omron corporation (https://www.omron.com)
++ */
++ #define OMRON_VID 0x0590
++ #define OMRON_CS1W_CIF31_PID 0x00b2
++
+ /*
+ * Acton Research Corp.
+ */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index d7ea64e8b0249..fe4e340ac66ee 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -253,6 +253,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_BG96 0x0296
+ #define QUECTEL_PRODUCT_EP06 0x0306
+ #define QUECTEL_PRODUCT_EM05G 0x030a
++#define QUECTEL_PRODUCT_EM060K 0x030b
+ #define QUECTEL_PRODUCT_EM12 0x0512
+ #define QUECTEL_PRODUCT_RM500Q 0x0800
+ #define QUECTEL_PRODUCT_EC200S_CN 0x6002
+@@ -438,6 +439,8 @@ static void option_instat_callback(struct urb *urb);
+ #define CINTERION_PRODUCT_MV31_2_RMNET 0x00b9
+ #define CINTERION_PRODUCT_MV32_WA 0x00f1
+ #define CINTERION_PRODUCT_MV32_WB 0x00f2
++#define CINTERION_PRODUCT_MV32_WA_RMNET 0x00f3
++#define CINTERION_PRODUCT_MV32_WB_RMNET 0x00f4
+
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID 0x0b3c
+@@ -573,6 +576,10 @@ static void option_instat_callback(struct urb *urb);
+ #define WETELECOM_PRODUCT_6802 0x6802
+ #define WETELECOM_PRODUCT_WMD300 0x6803
+
++/* OPPO products */
++#define OPPO_VENDOR_ID 0x22d9
++#define OPPO_PRODUCT_R11 0x276c
++
+
+ /* Device flags */
+
+@@ -1138,6 +1145,9 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff),
+ .driver_info = RSVD(6) | ZLP },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
+@@ -1993,8 +2003,12 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(0)},
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff),
+ .driver_info = RSVD(3)},
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA_RMNET, 0xff),
++ .driver_info = RSVD(0) },
+ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff),
+ .driver_info = RSVD(3)},
++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB_RMNET, 0xff),
++ .driver_info = RSVD(0) },
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
+ .driver_info = RSVD(4) },
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
+@@ -2155,6 +2169,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
++ { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 66e7f5d123c46..6a59950a63a03 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2294,6 +2294,13 @@ UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0000,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
+
++/* Reported by Witold Lipieta <witold.lipieta@thaumatec.com> */
++UNUSUAL_DEV( 0x1fc9, 0x0117, 0x0100, 0x0100,
++ "NXP Semiconductors",
++ "PN7462AU",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_IGNORE_RESIDUE ),
++
+ /* Supplied with some Castlewood ORB removable drives */
+ UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x9999,
+ "Double-H Technology",
+diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
+index 3f06e94771a72..52cdc06e1deac 100644
+--- a/drivers/usb/typec/altmodes/displayport.c
++++ b/drivers/usb/typec/altmodes/displayport.c
+@@ -91,8 +91,8 @@ static int dp_altmode_configure(struct dp_altmode *dp, u8 con)
+ case DP_STATUS_CON_UFP_D:
+ case DP_STATUS_CON_BOTH: /* NOTE: First acting as DP source */
+ conf |= DP_CONF_UFP_U_AS_UFP_D;
+- pin_assign = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo) &
+- DP_CAP_UFP_D_PIN_ASSIGN(dp->port->vdo);
++ pin_assign = DP_CAP_PIN_ASSIGN_UFP_D(dp->alt->vdo) &
++ DP_CAP_PIN_ASSIGN_DFP_D(dp->port->vdo);
+ break;
+ default:
+ break;
+diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
+index 413b465e69d8e..7ca149ab86d20 100644
+--- a/drivers/video/fbdev/chipsfb.c
++++ b/drivers/video/fbdev/chipsfb.c
+@@ -432,6 +432,7 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ err_release_fb:
+ framebuffer_release(p);
+ err_disable:
++ pci_disable_device(dp);
+ err_out:
+ return rc;
+ }
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index e5126fad57c5a..4661ecaf6741c 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -766,6 +766,28 @@ void debugfs_remove_recursive(struct dentry *dentry)
+ }
+ EXPORT_SYMBOL_GPL(debugfs_remove_recursive);
+
++/**
++ * debugfs_lookup_and_remove - lookup a directory or file and recursively remove it
++ * @name: a pointer to a string containing the name of the item to look up.
++ * @parent: a pointer to the parent dentry of the item.
++ *
++ * This is the equlivant of doing something like
++ * debugfs_remove(debugfs_lookup(..)) but with the proper reference counting
++ * handled for the directory being looked up.
++ */
++void debugfs_lookup_and_remove(const char *name, struct dentry *parent)
++{
++ struct dentry *dentry;
++
++ dentry = debugfs_lookup(name, parent);
++ if (!dentry)
++ return;
++
++ debugfs_remove(dentry);
++ dput(dentry);
++}
++EXPORT_SYMBOL_GPL(debugfs_lookup_and_remove);
++
+ /**
+ * debugfs_rename - rename a file/directory in the debugfs filesystem
+ * @old_dir: a pointer to the parent dentry for the renamed object. This
+diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
+index 9d5b0a0a651f1..87fbaa84b0dfb 100644
+--- a/include/linux/buffer_head.h
++++ b/include/linux/buffer_head.h
+@@ -136,6 +136,17 @@ BUFFER_FNS(Defer_Completion, defer_completion)
+
+ static __always_inline void set_buffer_uptodate(struct buffer_head *bh)
+ {
++ /*
++ * If somebody else already set this uptodate, they will
++ * have done the memory barrier, and a reader will thus
++ * see *some* valid buffer state.
++ *
++ * Any other serialization (with IO errors or whatever that
++ * might clear the bit) has to come from other state (eg BH_Lock).
++ */
++ if (test_bit(BH_Uptodate, &bh->b_state))
++ return;
++
+ /*
+ * make it consistent with folio_mark_uptodate
+ * pairs with smp_load_acquire in buffer_uptodate
+diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h
+index 3bc1034c57e66..2a4638bb40338 100644
+--- a/include/linux/debugfs.h
++++ b/include/linux/debugfs.h
+@@ -85,6 +85,8 @@ struct dentry *debugfs_create_automount(const char *name,
+ void debugfs_remove(struct dentry *dentry);
+ void debugfs_remove_recursive(struct dentry *dentry);
+
++void debugfs_lookup_and_remove(const char *name, struct dentry *parent);
++
+ const struct file_operations *debugfs_real_fops(const struct file *filp);
+
+ int debugfs_file_get(struct dentry *dentry);
+@@ -217,6 +219,10 @@ static inline void debugfs_remove(struct dentry *dentry)
+ static inline void debugfs_remove_recursive(struct dentry *dentry)
+ { }
+
++static inline void debugfs_lookup_and_remove(const char *name,
++ struct dentry *parent)
++{ }
++
+ const struct file_operations *debugfs_real_fops(const struct file *filp);
+
+ static inline int debugfs_file_get(struct dentry *dentry)
+diff --git a/include/linux/platform_data/x86/pmc_atom.h b/include/linux/platform_data/x86/pmc_atom.h
+index e4905fe69c381..e4cfcb6f16633 100644
+--- a/include/linux/platform_data/x86/pmc_atom.h
++++ b/include/linux/platform_data/x86/pmc_atom.h
+@@ -16,6 +16,8 @@
+ #ifndef PMC_ATOM_H
+ #define PMC_ATOM_H
+
++#include <linux/bits.h>
++
+ /* ValleyView Power Control Unit PCI Device ID */
+ #define PCI_DEVICE_ID_VLV_PMC 0x0F1C
+ /* CherryTrail Power Control Unit PCI Device ID */
+@@ -148,9 +150,9 @@
+ #define ACPI_MMIO_REG_LEN 0x100
+
+ #define PM1_CNT 0x4
+-#define SLEEP_TYPE_MASK 0xFFFFECFF
++#define SLEEP_TYPE_MASK GENMASK(12, 10)
+ #define SLEEP_TYPE_S5 0x1C00
+-#define SLEEP_ENABLE 0x2000
++#define SLEEP_ENABLE BIT(13)
+
+ extern int pmc_atom_read(int offset, u32 *value);
+ extern int pmc_atom_write(int offset, u32 value);
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index ff010d1fd1c78..744023c91404a 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -580,6 +580,7 @@ struct usb3_lpm_parameters {
+ * @level: number of USB hub ancestors
+ * @can_submit: URBs may be submitted
+ * @persist_enabled: USB_PERSIST enabled for this device
++ * @reset_in_progress: the device is being reset
+ * @have_langid: whether string_langid is valid
+ * @authorized: policy has said we can use it;
+ * (user space) policy determines if we authorize this device to be
+@@ -664,6 +665,7 @@ struct usb_device {
+
+ unsigned can_submit:1;
+ unsigned persist_enabled:1;
++ unsigned reset_in_progress:1;
+ unsigned have_langid:1;
+ unsigned authorized:1;
+ unsigned authenticated:1;
+diff --git a/include/linux/usb/typec_dp.h b/include/linux/usb/typec_dp.h
+index 55ae781d60a9e..92460ccd16ad3 100644
+--- a/include/linux/usb/typec_dp.h
++++ b/include/linux/usb/typec_dp.h
+@@ -68,6 +68,11 @@ enum {
+ #define DP_CAP_USB BIT(7)
+ #define DP_CAP_DFP_D_PIN_ASSIGN(_cap_) (((_cap_) & GENMASK(15, 8)) >> 8)
+ #define DP_CAP_UFP_D_PIN_ASSIGN(_cap_) (((_cap_) & GENMASK(23, 16)) >> 16)
++/* Get pin assignment taking plug & receptacle into consideration */
++#define DP_CAP_PIN_ASSIGN_UFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \
++ DP_CAP_UFP_D_PIN_ASSIGN(_cap_) : DP_CAP_DFP_D_PIN_ASSIGN(_cap_))
++#define DP_CAP_PIN_ASSIGN_DFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \
++ DP_CAP_DFP_D_PIN_ASSIGN(_cap_) : DP_CAP_UFP_D_PIN_ASSIGN(_cap_))
+
+ /* DisplayPort Status Update VDO bits */
+ #define DP_STATUS_CONNECTION(_status_) ((_status_) & 3)
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index b2fcad8635bcf..b2f01e61f0eec 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1568,6 +1568,7 @@ static int check_kprobe_address_safe(struct kprobe *p,
+ /* Ensure it is not in reserved area nor out of text */
+ if (!(core_kernel_text((unsigned long) p->addr) ||
+ is_module_text_address((unsigned long) p->addr)) ||
++ in_gate_area_no_mm((unsigned long) p->addr) ||
+ within_kprobe_blacklist((unsigned long) p->addr) ||
+ jump_label_text_reserved(p->addr, p->addr) ||
+ find_bug((unsigned long)p->addr)) {
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index 639acbb91fd53..f54734abf9466 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -1196,7 +1196,7 @@ EXPORT_SYMBOL(kmemleak_no_scan);
+ void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_count,
+ gfp_t gfp)
+ {
+- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
++ if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
+ kmemleak_alloc(__va(phys), size, min_count, gfp);
+ }
+ EXPORT_SYMBOL(kmemleak_alloc_phys);
+@@ -1210,7 +1210,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys);
+ */
+ void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size)
+ {
+- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
++ if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
+ kmemleak_free_part(__va(phys), size);
+ }
+ EXPORT_SYMBOL(kmemleak_free_part_phys);
+@@ -1222,7 +1222,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys);
+ */
+ void __ref kmemleak_not_leak_phys(phys_addr_t phys)
+ {
+- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
++ if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
+ kmemleak_not_leak(__va(phys));
+ }
+ EXPORT_SYMBOL(kmemleak_not_leak_phys);
+@@ -1234,7 +1234,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys);
+ */
+ void __ref kmemleak_ignore_phys(phys_addr_t phys)
+ {
+- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
++ if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
+ kmemleak_ignore(__va(phys));
+ }
+ EXPORT_SYMBOL(kmemleak_ignore_phys);
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index 55c7cdf5e7b83..35642dc96852a 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -385,6 +385,7 @@ static int br_nf_pre_routing_finish(struct net *net, struct sock *sk, struct sk_
+ /* - Bridged-and-DNAT'ed traffic doesn't
+ * require ip_forwarding. */
+ if (rt->dst.dev == dev) {
++ skb_dst_drop(skb);
+ skb_dst_set(skb, &rt->dst);
+ goto bridged_dnat;
+ }
+@@ -414,6 +415,7 @@ bridged_dnat:
+ kfree_skb(skb);
+ return 0;
+ }
++ skb_dst_drop(skb);
+ skb_dst_set_noref(skb, &rt->dst);
+ }
+
+diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
+index 09d5e0c7b3ba4..995d86777e7cb 100644
+--- a/net/bridge/br_netfilter_ipv6.c
++++ b/net/bridge/br_netfilter_ipv6.c
+@@ -201,6 +201,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *net, struct sock *sk, struc
+ kfree_skb(skb);
+ return 0;
+ }
++ skb_dst_drop(skb);
+ skb_dst_set_noref(skb, &rt->dst);
+ }
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index e1d065ea5a158..aac5d5b739268 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2372,6 +2372,21 @@ static inline bool tcp_may_undo(const struct tcp_sock *tp)
+ return tp->undo_marker && (!tp->undo_retrans || tcp_packet_delayed(tp));
+ }
+
++static bool tcp_is_non_sack_preventing_reopen(struct sock *sk)
++{
++ struct tcp_sock *tp = tcp_sk(sk);
++
++ if (tp->snd_una == tp->high_seq && tcp_is_reno(tp)) {
++ /* Hold old state until something *above* high_seq
++ * is ACKed. For Reno it is MUST to prevent false
++ * fast retransmits (RFC2582). SACK TCP is safe. */
++ if (!tcp_any_retrans_done(sk))
++ tp->retrans_stamp = 0;
++ return true;
++ }
++ return false;
++}
++
+ /* People celebrate: "We love our President!" */
+ static bool tcp_try_undo_recovery(struct sock *sk)
+ {
+@@ -2394,14 +2409,8 @@ static bool tcp_try_undo_recovery(struct sock *sk)
+ } else if (tp->rack.reo_wnd_persist) {
+ tp->rack.reo_wnd_persist--;
+ }
+- if (tp->snd_una == tp->high_seq && tcp_is_reno(tp)) {
+- /* Hold old state until something *above* high_seq
+- * is ACKed. For Reno it is MUST to prevent false
+- * fast retransmits (RFC2582). SACK TCP is safe. */
+- if (!tcp_any_retrans_done(sk))
+- tp->retrans_stamp = 0;
++ if (tcp_is_non_sack_preventing_reopen(sk))
+ return true;
+- }
+ tcp_set_ca_state(sk, TCP_CA_Open);
+ tp->is_sack_reneg = 0;
+ return false;
+@@ -2437,6 +2446,8 @@ static bool tcp_try_undo_loss(struct sock *sk, bool frto_undo)
+ NET_INC_STATS(sock_net(sk),
+ LINUX_MIB_TCPSPURIOUSRTOS);
+ inet_csk(sk)->icsk_retransmits = 0;
++ if (tcp_is_non_sack_preventing_reopen(sk))
++ return true;
+ if (frto_undo || tcp_is_sack(tp)) {
+ tcp_set_ca_state(sk, TCP_CA_Open);
+ tp->is_sack_reneg = 0;
+@@ -3468,11 +3479,11 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
+
+ /* Then check host-wide RFC 5961 rate limit. */
+ now = jiffies / HZ;
+- if (now != challenge_timestamp) {
++ if (now != READ_ONCE(challenge_timestamp)) {
+ u32 ack_limit = READ_ONCE(net->ipv4.sysctl_tcp_challenge_ack_limit);
+ u32 half = (ack_limit + 1) >> 1;
+
+- challenge_timestamp = now;
++ WRITE_ONCE(challenge_timestamp, now);
+ WRITE_ONCE(challenge_count, half + prandom_u32_max(ack_limit));
+ }
+ count = READ_ONCE(challenge_count);
+diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
+index 9b2f272ca1649..89d55770ac74b 100644
+--- a/net/ipv6/seg6.c
++++ b/net/ipv6/seg6.c
+@@ -130,6 +130,11 @@ static int seg6_genl_sethmac(struct sk_buff *skb, struct genl_info *info)
+ goto out_unlock;
+ }
+
++ if (slen > nla_len(info->attrs[SEG6_ATTR_SECRET])) {
++ err = -EINVAL;
++ goto out_unlock;
++ }
++
+ if (hinfo) {
+ err = seg6_hmac_info_del(net, hmackeyid);
+ if (err)
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
+index b919db02c7f9e..ef2543a4c1fc5 100644
+--- a/net/kcm/kcmsock.c
++++ b/net/kcm/kcmsock.c
+@@ -1412,12 +1412,6 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
+ psock->sk = csk;
+ psock->bpf_prog = prog;
+
+- err = strp_init(&psock->strp, csk, &cb);
+- if (err) {
+- kmem_cache_free(kcm_psockp, psock);
+- goto out;
+- }
+-
+ write_lock_bh(&csk->sk_callback_lock);
+
+ /* Check if sk_user_data is aready by KCM or someone else.
+@@ -1425,13 +1419,18 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
+ */
+ if (csk->sk_user_data) {
+ write_unlock_bh(&csk->sk_callback_lock);
+- strp_stop(&psock->strp);
+- strp_done(&psock->strp);
+ kmem_cache_free(kcm_psockp, psock);
+ err = -EALREADY;
+ goto out;
+ }
+
++ err = strp_init(&psock->strp, csk, &cb);
++ if (err) {
++ write_unlock_bh(&csk->sk_callback_lock);
++ kmem_cache_free(kcm_psockp, psock);
++ goto out;
++ }
++
+ psock->save_data_ready = csk->sk_data_ready;
+ psock->save_write_space = csk->sk_write_space;
+ psock->save_state_change = csk->sk_state_change;
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index fa13eef25f2c9..38383b7e44190 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -544,6 +544,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
+
+ sdata_assert_lock(sdata);
+
++ /* When not connected/joined, sending CSA doesn't make sense. */
++ if (ifibss->state != IEEE80211_IBSS_MLME_JOINED)
++ return -ENOLINK;
++
+ /* update cfg80211 bss information with the new channel */
+ if (!is_zero_ether_addr(ifibss->bssid)) {
+ cbss = cfg80211_get_bss(sdata->local->hw.wiphy,
+diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
+index 4dcf6e18563a6..060ccd0e14ce7 100644
+--- a/net/mac802154/rx.c
++++ b/net/mac802154/rx.c
+@@ -52,7 +52,7 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
+
+ switch (mac_cb(skb)->dest.mode) {
+ case IEEE802154_ADDR_NONE:
+- if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE)
++ if (hdr->source.mode != IEEE802154_ADDR_NONE)
+ /* FIXME: check if we are PAN coordinator */
+ skb->pkt_type = PACKET_OTHERHOST;
+ else
+diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
+index 4099f4d79bae7..b7436935b57d0 100644
+--- a/net/netfilter/nf_conntrack_irc.c
++++ b/net/netfilter/nf_conntrack_irc.c
+@@ -187,8 +187,9 @@ static int help(struct sk_buff *skb, unsigned int protoff,
+
+ /* dcc_ip can be the internal OR external (NAT'ed) IP */
+ tuple = &ct->tuplehash[dir].tuple;
+- if (tuple->src.u3.ip != dcc_ip &&
+- tuple->dst.u3.ip != dcc_ip) {
++ if ((tuple->src.u3.ip != dcc_ip &&
++ ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) ||
++ dcc_port == 0) {
+ net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
+ &tuple->src.u3.ip,
+ &dcc_ip, dcc_port);
+diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
+index 81d205acb1b6a..a8ef8efa62fc0 100644
+--- a/net/sched/sch_sfb.c
++++ b/net/sched/sch_sfb.c
+@@ -139,15 +139,15 @@ static void increment_one_qlen(u32 sfbhash, u32 slot, struct sfb_sched_data *q)
+ }
+ }
+
+-static void increment_qlen(const struct sk_buff *skb, struct sfb_sched_data *q)
++static void increment_qlen(const struct sfb_skb_cb *cb, struct sfb_sched_data *q)
+ {
+ u32 sfbhash;
+
+- sfbhash = sfb_hash(skb, 0);
++ sfbhash = cb->hashes[0];
+ if (sfbhash)
+ increment_one_qlen(sfbhash, 0, q);
+
+- sfbhash = sfb_hash(skb, 1);
++ sfbhash = cb->hashes[1];
+ if (sfbhash)
+ increment_one_qlen(sfbhash, 1, q);
+ }
+@@ -285,8 +285,10 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ {
+
+ struct sfb_sched_data *q = qdisc_priv(sch);
++ unsigned int len = qdisc_pkt_len(skb);
+ struct Qdisc *child = q->qdisc;
+ struct tcf_proto *fl;
++ struct sfb_skb_cb cb;
+ int i;
+ u32 p_min = ~0;
+ u32 minqlen = ~0;
+@@ -403,11 +405,12 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ }
+
+ enqueue:
++ memcpy(&cb, sfb_skb_cb(skb), sizeof(cb));
+ ret = qdisc_enqueue(skb, child, to_free);
+ if (likely(ret == NET_XMIT_SUCCESS)) {
+- qdisc_qstats_backlog_inc(sch, skb);
++ sch->qstats.backlog += len;
+ sch->q.qlen++;
+- increment_qlen(skb, q);
++ increment_qlen(&cb, q);
+ } else if (net_xmit_drop_count(ret)) {
+ q->stats.childdrop++;
+ qdisc_qstats_drop(sch);
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 4c904ab29e0e6..dcd00b514c3f9 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1031,7 +1031,6 @@ static void smc_listen_out_connected(struct smc_sock *new_smc)
+ {
+ struct sock *newsmcsk = &new_smc->sk;
+
+- sk_refcnt_debug_inc(newsmcsk);
+ if (newsmcsk->sk_state == SMC_INIT)
+ newsmcsk->sk_state = SMC_ACTIVE;
+
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index d05fa7c36d001..b1abf4848bbc7 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -1550,9 +1550,9 @@ static void xprt_destroy(struct rpc_xprt *xprt)
+ * is cleared. We use ->transport_lock to ensure the mod_timer()
+ * can only run *before* del_time_sync(), never after.
+ */
+- spin_lock(&xprt->transport_lock);
++ spin_lock_bh(&xprt->transport_lock);
+ del_timer_sync(&xprt->timer);
+- spin_unlock(&xprt->transport_lock);
++ spin_unlock_bh(&xprt->transport_lock);
+
+ /*
+ * Destroy sockets etc from the system workqueue so they can
+diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
+index 7b6c1c5c30dc8..0268857a3cfed 100644
+--- a/net/tipc/monitor.c
++++ b/net/tipc/monitor.c
+@@ -130,7 +130,7 @@ static void map_set(u64 *up_map, int i, unsigned int v)
+
+ static int map_get(u64 up_map, int i)
+ {
+- return (up_map & (1 << i)) >> i;
++ return (up_map & (1ULL << i)) >> i;
+ }
+
+ static struct tipc_peer *peer_prev(struct tipc_peer *peer)
+diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
+index 30fc6eb352bcc..e6410487e25da 100644
+--- a/net/wireless/debugfs.c
++++ b/net/wireless/debugfs.c
+@@ -68,9 +68,10 @@ static ssize_t ht40allow_map_read(struct file *file,
+ {
+ struct wiphy *wiphy = file->private_data;
+ char *buf;
+- unsigned int offset = 0, buf_size = PAGE_SIZE, i, r;
++ unsigned int offset = 0, buf_size = PAGE_SIZE, i;
+ enum nl80211_band band;
+ struct ieee80211_supported_band *sband;
++ ssize_t r;
+
+ buf = kzalloc(buf_size, GFP_KERNEL);
+ if (!buf)
+diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
+index b7bef25b34cca..838c3c8b403cb 100644
+--- a/sound/core/seq/oss/seq_oss_midi.c
++++ b/sound/core/seq/oss/seq_oss_midi.c
+@@ -280,7 +280,9 @@ snd_seq_oss_midi_clear_all(void)
+ void
+ snd_seq_oss_midi_setup(struct seq_oss_devinfo *dp)
+ {
++ spin_lock_irq(®ister_lock);
+ dp->max_mididev = max_midi_devs;
++ spin_unlock_irq(®ister_lock);
+ }
+
+ /*
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index aaf9c419c3dde..96cd8b7d790ea 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -136,13 +136,13 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid)
+ spin_unlock_irqrestore(&clients_lock, flags);
+ #ifdef CONFIG_MODULES
+ if (!in_interrupt()) {
+- static char client_requested[SNDRV_SEQ_GLOBAL_CLIENTS];
+- static char card_requested[SNDRV_CARDS];
++ static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS);
++ static DECLARE_BITMAP(card_requested, SNDRV_CARDS);
++
+ if (clientid < SNDRV_SEQ_GLOBAL_CLIENTS) {
+ int idx;
+
+- if (!client_requested[clientid]) {
+- client_requested[clientid] = 1;
++ if (!test_and_set_bit(clientid, client_requested)) {
+ for (idx = 0; idx < 15; idx++) {
+ if (seq_client_load[idx] < 0)
+ break;
+@@ -157,10 +157,8 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid)
+ int card = (clientid - SNDRV_SEQ_GLOBAL_CLIENTS) /
+ SNDRV_SEQ_CLIENTS_PER_CARD;
+ if (card < snd_ecards_limit) {
+- if (! card_requested[card]) {
+- card_requested[card] = 1;
++ if (!test_and_set_bit(card, card_requested))
+ snd_request_card(card);
+- }
+ snd_seq_device_load_drivers();
+ }
+ }
+diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
+index 3c65e52b014c1..1948d064fc953 100644
+--- a/sound/drivers/aloop.c
++++ b/sound/drivers/aloop.c
+@@ -477,17 +477,18 @@ static unsigned int loopback_pos_update(struct loopback_cable *cable)
+ cable->streams[SNDRV_PCM_STREAM_PLAYBACK];
+ struct loopback_pcm *dpcm_capt =
+ cable->streams[SNDRV_PCM_STREAM_CAPTURE];
+- unsigned long delta_play = 0, delta_capt = 0;
++ unsigned long delta_play = 0, delta_capt = 0, cur_jiffies;
+ unsigned int running, count1, count2;
+
++ cur_jiffies = jiffies;
+ running = cable->running ^ cable->pause;
+ if (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) {
+- delta_play = jiffies - dpcm_play->last_jiffies;
++ delta_play = cur_jiffies - dpcm_play->last_jiffies;
+ dpcm_play->last_jiffies += delta_play;
+ }
+
+ if (running & (1 << SNDRV_PCM_STREAM_CAPTURE)) {
+- delta_capt = jiffies - dpcm_capt->last_jiffies;
++ delta_capt = cur_jiffies - dpcm_capt->last_jiffies;
+ dpcm_capt->last_jiffies += delta_capt;
+ }
+
+diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
+index 9f2b6097f486d..623776b13f8da 100644
+--- a/sound/pci/emu10k1/emupcm.c
++++ b/sound/pci/emu10k1/emupcm.c
+@@ -137,7 +137,7 @@ static int snd_emu10k1_pcm_channel_alloc(struct snd_emu10k1_pcm * epcm, int voic
+ epcm->voices[0]->epcm = epcm;
+ if (voices > 1) {
+ for (i = 1; i < voices; i++) {
+- epcm->voices[i] = &epcm->emu->voices[epcm->voices[0]->number + i];
++ epcm->voices[i] = &epcm->emu->voices[(epcm->voices[0]->number + i) % NUM_G];
+ epcm->voices[i]->epcm = epcm;
+ }
+ }
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index 9a950aaf5e356..1cfb30465df7d 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -1111,7 +1111,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
+ * Dallas DS4201 workaround: It presents 5 altsettings, but the last
+ * one misses syncpipe, and does not produce any sound.
+ */
+- if (chip->usb_id == USB_ID(0x04fa, 0x4201))
++ if (chip->usb_id == USB_ID(0x04fa, 0x4201) && num >= 4)
+ num = 4;
+
+ for (i = 0; i < num; i++) {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-09-20 12:03 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-09-20 12:03 UTC (permalink / raw
To: gentoo-commits
commit: 50884cd0bee3e7a80b7899fa36abcaaa0bb85c43
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Sep 20 12:03:15 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Sep 20 12:03:15 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=50884cd0
Linux patch 4.19.259
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1258_linux-4.19.259.patch | 284 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 288 insertions(+)
diff --git a/0000_README b/0000_README
index f372055b..e00dbd74 100644
--- a/0000_README
+++ b/0000_README
@@ -1075,6 +1075,10 @@ Patch: 1257_linux-4.19.258.patch
From: https://www.kernel.org
Desc: Linux 4.19.258
+Patch: 1258_linux-4.19.259.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.259
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1258_linux-4.19.259.patch b/1258_linux-4.19.259.patch
new file mode 100644
index 00000000..bc8a1105
--- /dev/null
+++ b/1258_linux-4.19.259.patch
@@ -0,0 +1,284 @@
+diff --git a/Documentation/input/joydev/joystick.rst b/Documentation/input/joydev/joystick.rst
+index 9746fd76cc581..f38c330c028e5 100644
+--- a/Documentation/input/joydev/joystick.rst
++++ b/Documentation/input/joydev/joystick.rst
+@@ -517,6 +517,7 @@ All I-Force devices are supported by the iforce module. This includes:
+ * AVB Mag Turbo Force
+ * AVB Top Shot Pegasus
+ * AVB Top Shot Force Feedback Racing Wheel
++* Boeder Force Feedback Wheel
+ * Logitech WingMan Force
+ * Logitech WingMan Force Wheel
+ * Guillemot Race Leader Force Feedback
+diff --git a/Makefile b/Makefile
+index e35356f7a1e66..133683dfc7b89 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 258
++SUBLEVEL = 259
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
+index d4cc5ceb22d01..bb65aab49c214 100644
+--- a/drivers/gpu/drm/msm/msm_rd.c
++++ b/drivers/gpu/drm/msm/msm_rd.c
+@@ -199,6 +199,9 @@ static int rd_open(struct inode *inode, struct file *file)
+ file->private_data = rd;
+ rd->open = true;
+
++ /* Reset fifo to clear any previously unread data: */
++ rd->fifo.head = rd->fifo.tail = 0;
++
+ /* the parsing tools need to know gpu-id to know which
+ * register database to load.
+ */
+diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.h b/drivers/hid/intel-ish-hid/ishtp-hid.h
+index f5c7eb79b7b53..fa16983007f60 100644
+--- a/drivers/hid/intel-ish-hid/ishtp-hid.h
++++ b/drivers/hid/intel-ish-hid/ishtp-hid.h
+@@ -118,7 +118,7 @@ struct report_list {
+ * @multi_packet_cnt: Count of fragmented packet count
+ *
+ * This structure is used to store completion flags and per client data like
+- * like report description, number of HID devices etc.
++ * report description, number of HID devices etc.
+ */
+ struct ishtp_cl_data {
+ /* completion flags */
+diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
+index 58d5cfe465263..12d96937c83f0 100644
+--- a/drivers/input/joystick/iforce/iforce-main.c
++++ b/drivers/input/joystick/iforce/iforce-main.c
+@@ -64,6 +64,7 @@ static struct iforce_device iforce_device[] = {
+ { 0x046d, 0xc291, "Logitech WingMan Formula Force", btn_wheel, abs_wheel, ff_iforce },
+ { 0x05ef, 0x020a, "AVB Top Shot Pegasus", btn_joystick_avb, abs_avb_pegasus, ff_iforce },
+ { 0x05ef, 0x8884, "AVB Mag Turbo Force", btn_wheel, abs_wheel, ff_iforce },
++ { 0x05ef, 0x8886, "Boeder Force Feedback Wheel", btn_wheel, abs_wheel, ff_iforce },
+ { 0x05ef, 0x8888, "AVB Top Shot Force Feedback Racing Wheel", btn_wheel, abs_wheel, ff_iforce }, //?
+ { 0x061c, 0xc0a4, "ACT LABS Force RS", btn_wheel, abs_wheel, ff_iforce }, //?
+ { 0x061c, 0xc084, "ACT LABS Force RS", btn_wheel, abs_wheel, ff_iforce },
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 6fcf9646d141b..d1ca3d3f51a7a 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -18207,16 +18207,20 @@ static void tg3_shutdown(struct pci_dev *pdev)
+ struct net_device *dev = pci_get_drvdata(pdev);
+ struct tg3 *tp = netdev_priv(dev);
+
++ tg3_reset_task_cancel(tp);
++
+ rtnl_lock();
++
+ netif_device_detach(dev);
+
+ if (netif_running(dev))
+ dev_close(dev);
+
+- if (system_state == SYSTEM_POWER_OFF)
+- tg3_power_down(tp);
++ tg3_power_down(tp);
+
+ rtnl_unlock();
++
++ pci_disable_device(pdev);
+ }
+
+ /**
+diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c
+index 0c89d3edf901c..fa3a4db517d69 100644
+--- a/drivers/net/ieee802154/cc2520.c
++++ b/drivers/net/ieee802154/cc2520.c
+@@ -512,6 +512,7 @@ cc2520_tx(struct ieee802154_hw *hw, struct sk_buff *skb)
+ goto err_tx;
+
+ if (status & CC2520_STATUS_TX_UNDERFLOW) {
++ rc = -EINVAL;
+ dev_err(&priv->spi->dev, "cc2520 tx underflow exception\n");
+ goto err_tx;
+ }
+diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c
+index cffa0cb517204..3738beb0fb40b 100644
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -203,8 +203,7 @@ static int dp83822_config_intr(struct phy_device *phydev)
+ if (misr_status < 0)
+ return misr_status;
+
+- misr_status |= (DP83822_RX_ERR_HF_INT_EN |
+- DP83822_ANEG_COMPLETE_INT_EN |
++ misr_status |= (DP83822_ANEG_COMPLETE_INT_EN |
+ DP83822_DUP_MODE_CHANGE_INT_EN |
+ DP83822_SPEED_CHANGED_INT_EN |
+ DP83822_LINK_STAT_INT_EN |
+diff --git a/drivers/perf/arm_pmu_platform.c b/drivers/perf/arm_pmu_platform.c
+index 199293450acfc..0ffa4f45a8391 100644
+--- a/drivers/perf/arm_pmu_platform.c
++++ b/drivers/perf/arm_pmu_platform.c
+@@ -118,7 +118,7 @@ static int pmu_parse_irqs(struct arm_pmu *pmu)
+
+ if (num_irqs == 1) {
+ int irq = platform_get_irq(pdev, 0);
+- if (irq && irq_is_percpu_devid(irq))
++ if ((irq > 0) && irq_is_percpu_devid(irq))
+ return pmu_parse_percpu_irq(pmu, irq);
+ }
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index bd25c8a156d24..c73ce07b66c9a 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -106,6 +106,7 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
+ {KE_KEY, 0x22, {KEY_PROG2} }, /* Arcade */
+ {KE_KEY, 0x23, {KEY_PROG3} }, /* P_Key */
+ {KE_KEY, 0x24, {KEY_PROG4} }, /* Social networking_Key */
++ {KE_KEY, 0x27, {KEY_HELP} },
+ {KE_KEY, 0x29, {KEY_PROG3} }, /* P_Key for TM8372 */
+ {KE_IGNORE, 0x41, {KEY_MUTE} },
+ {KE_IGNORE, 0x42, {KEY_PREVIOUSSONG} },
+@@ -119,7 +120,13 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
+ {KE_IGNORE, 0x48, {KEY_VOLUMEUP} },
+ {KE_IGNORE, 0x49, {KEY_VOLUMEDOWN} },
+ {KE_IGNORE, 0x4a, {KEY_VOLUMEDOWN} },
+- {KE_IGNORE, 0x61, {KEY_SWITCHVIDEOMODE} },
++ /*
++ * 0x61 is KEY_SWITCHVIDEOMODE. Usually this is a duplicate input event
++ * with the "Video Bus" input device events. But sometimes it is not
++ * a dup. Map it to KEY_UNKNOWN instead of using KE_IGNORE so that
++ * udev/hwdb can override it on systems where it is not a dup.
++ */
++ {KE_KEY, 0x61, {KEY_UNKNOWN} },
+ {KE_IGNORE, 0x62, {KEY_BRIGHTNESSUP} },
+ {KE_IGNORE, 0x63, {KEY_BRIGHTNESSDOWN} },
+ {KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} }, /* Display Switch */
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 2f72753c3e225..0b37c8e550e7d 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -62,6 +62,13 @@ UNUSUAL_DEV(0x0984, 0x0301, 0x0128, 0x0128,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_UAS),
+
++/* Reported-by: Tom Hu <huxiaoying@kylinos.cn> */
++UNUSUAL_DEV(0x0b05, 0x1932, 0x0000, 0x9999,
++ "ASUS",
++ "External HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_IGNORE_UAS),
++
+ /* Reported-by: David Webb <djw@noc.ac.uk> */
+ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999,
+ "Seagate",
+diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
+index 01b0eec4140d4..4ad24d0371c8c 100644
+--- a/fs/tracefs/inode.c
++++ b/fs/tracefs/inode.c
+@@ -142,6 +142,8 @@ struct tracefs_mount_opts {
+ kuid_t uid;
+ kgid_t gid;
+ umode_t mode;
++ /* Opt_* bitfield. */
++ unsigned int opts;
+ };
+
+ enum {
+@@ -242,6 +244,7 @@ static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts)
+ kgid_t gid;
+ char *p;
+
++ opts->opts = 0;
+ opts->mode = TRACEFS_DEFAULT_MODE;
+
+ while ((p = strsep(&data, ",")) != NULL) {
+@@ -276,24 +279,36 @@ static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts)
+ * but traditionally tracefs has ignored all mount options
+ */
+ }
++
++ opts->opts |= BIT(token);
+ }
+
+ return 0;
+ }
+
+-static int tracefs_apply_options(struct super_block *sb)
++static int tracefs_apply_options(struct super_block *sb, bool remount)
+ {
+ struct tracefs_fs_info *fsi = sb->s_fs_info;
+ struct inode *inode = sb->s_root->d_inode;
+ struct tracefs_mount_opts *opts = &fsi->mount_opts;
+
+- inode->i_mode &= ~S_IALLUGO;
+- inode->i_mode |= opts->mode;
++ /*
++ * On remount, only reset mode/uid/gid if they were provided as mount
++ * options.
++ */
++
++ if (!remount || opts->opts & BIT(Opt_mode)) {
++ inode->i_mode &= ~S_IALLUGO;
++ inode->i_mode |= opts->mode;
++ }
+
+- inode->i_uid = opts->uid;
++ if (!remount || opts->opts & BIT(Opt_uid))
++ inode->i_uid = opts->uid;
+
+- /* Set all the group ids to the mount option */
+- set_gid(sb->s_root, opts->gid);
++ if (!remount || opts->opts & BIT(Opt_gid)) {
++ /* Set all the group ids to the mount option */
++ set_gid(sb->s_root, opts->gid);
++ }
+
+ return 0;
+ }
+@@ -308,7 +323,7 @@ static int tracefs_remount(struct super_block *sb, int *flags, char *data)
+ if (err)
+ goto fail;
+
+- tracefs_apply_options(sb);
++ tracefs_apply_options(sb, true);
+
+ fail:
+ return err;
+@@ -360,7 +375,7 @@ static int trace_fill_super(struct super_block *sb, void *data, int silent)
+
+ sb->s_op = &tracefs_super_operations;
+
+- tracefs_apply_options(sb);
++ tracefs_apply_options(sb, false);
+
+ return 0;
+
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 5ee3c91450de1..38541885ea450 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2567,6 +2567,7 @@ static void unmap_region(struct mm_struct *mm,
+ {
+ struct vm_area_struct *next = prev ? prev->vm_next : mm->mmap;
+ struct mmu_gather tlb;
++ struct vm_area_struct *cur_vma;
+
+ lru_add_drain();
+ tlb_gather_mmu(&tlb, mm, start, end);
+@@ -2581,8 +2582,12 @@ static void unmap_region(struct mm_struct *mm,
+ * concurrent flush in this region has to be coming through the rmap,
+ * and we synchronize against that using the rmap lock.
+ */
+- if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0)
+- tlb_flush_mmu(&tlb);
++ for (cur_vma = vma; cur_vma; cur_vma = cur_vma->vm_next) {
++ if ((cur_vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) {
++ tlb_flush_mmu(&tlb);
++ break;
++ }
++ }
+
+ free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS,
+ next ? next->vm_start : USER_PGTABLES_CEILING);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-09-28 9:18 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-09-28 9:18 UTC (permalink / raw
To: gentoo-commits
commit: d0dbe5f09387abf0f110e5369e17cf8301c8a9fb
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 28 09:17:57 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Sep 28 09:17:57 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d0dbe5f0
Linux patch 4.19.260
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1259_linux-4.19.260.patch | 1271 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1275 insertions(+)
diff --git a/0000_README b/0000_README
index e00dbd74..6bbe74fa 100644
--- a/0000_README
+++ b/0000_README
@@ -1079,6 +1079,10 @@ Patch: 1258_linux-4.19.259.patch
From: https://www.kernel.org
Desc: Linux 4.19.259
+Patch: 1259_linux-4.19.260.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.260
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1259_linux-4.19.260.patch b/1259_linux-4.19.260.patch
new file mode 100644
index 00000000..b6d782ed
--- /dev/null
+++ b/1259_linux-4.19.260.patch
@@ -0,0 +1,1271 @@
+diff --git a/Makefile b/Makefile
+index 133683dfc7b89..61971754a74e8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 259
++SUBLEVEL = 260
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
+index ff81dfda3b952..3ba927f303479 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
+@@ -232,6 +232,14 @@
+ &edp {
+ status = "okay";
+
++ /*
++ * eDP PHY/clk don't sync reliably at anything other than 24 MHz. Only
++ * set this here, because rk3399-gru.dtsi ensures we can generate this
++ * off GPLL=600MHz, whereas some other RK3399 boards may not.
++ */
++ assigned-clocks = <&cru PCLK_EDP>;
++ assigned-clock-rates = <24000000>;
++
+ ports {
+ edp_out: port@1 {
+ reg = <1>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+index ce1320e4c1060..6750b8100421c 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+@@ -102,7 +102,6 @@
+ vcc5v0_host: vcc5v0-host-regulator {
+ compatible = "regulator-fixed";
+ gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_LOW>;
+- enable-active-low;
+ pinctrl-names = "default";
+ pinctrl-0 = <&vcc5v0_host_en>;
+ regulator-name = "vcc5v0_host";
+diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
+index 43e4fc1b373ca..3e5cf5515c01f 100644
+--- a/arch/mips/cavium-octeon/octeon-irq.c
++++ b/arch/mips/cavium-octeon/octeon-irq.c
+@@ -127,6 +127,16 @@ static void octeon_irq_free_cd(struct irq_domain *d, unsigned int irq)
+ static int octeon_irq_force_ciu_mapping(struct irq_domain *domain,
+ int irq, int line, int bit)
+ {
++ struct device_node *of_node;
++ int ret;
++
++ of_node = irq_domain_get_of_node(domain);
++ if (!of_node)
++ return -EINVAL;
++ ret = irq_alloc_desc_at(irq, of_node_to_nid(of_node));
++ if (ret < 0)
++ return ret;
++
+ return irq_domain_associate(domain, irq, line << 6 | bit);
+ }
+
+diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c
+index f5fab99d1751c..851f6bf925a63 100644
+--- a/arch/mips/lantiq/clk.c
++++ b/arch/mips/lantiq/clk.c
+@@ -52,6 +52,7 @@ struct clk *clk_get_io(void)
+ {
+ return &cpu_clk_generic[2];
+ }
++EXPORT_SYMBOL_GPL(clk_get_io);
+
+ struct clk *clk_get_ppe(void)
+ {
+diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
+index 72d9dfbebf08e..ea03096033afc 100644
+--- a/drivers/firmware/efi/libstub/secureboot.c
++++ b/drivers/firmware/efi/libstub/secureboot.c
+@@ -21,7 +21,7 @@ static const efi_char16_t efi_SetupMode_name[] = L"SetupMode";
+
+ /* SHIM variables */
+ static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID;
+-static const efi_char16_t shim_MokSBState_name[] = L"MokSBState";
++static const efi_char16_t shim_MokSBState_name[] = L"MokSBStateRT";
+
+ #define get_efi_var(name, vendor, ...) \
+ efi_call_runtime(get_variable, \
+@@ -60,8 +60,8 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
+
+ /*
+ * See if a user has put the shim into insecure mode. If so, and if the
+- * variable doesn't have the runtime attribute set, we might as well
+- * honor that.
++ * variable doesn't have the non-volatile attribute set, we might as
++ * well honor that.
+ */
+ size = sizeof(moksbstate);
+ status = get_efi_var(shim_MokSBState_name, &shim_guid,
+@@ -70,7 +70,7 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
+ /* If it fails, we don't care why. Default to secure */
+ if (status != EFI_SUCCESS)
+ goto secure_boot_enabled;
+- if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS) && moksbstate == 1)
++ if (!(attr & EFI_VARIABLE_NON_VOLATILE) && moksbstate == 1)
+ return efi_secureboot_mode_disabled;
+
+ secure_boot_enabled:
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index 1899d172590b8..546f8c453addb 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -168,6 +168,7 @@ static int mpc8xxx_irq_set_type(struct irq_data *d, unsigned int flow_type)
+
+ switch (flow_type) {
+ case IRQ_TYPE_EDGE_FALLING:
++ case IRQ_TYPE_LEVEL_LOW:
+ raw_spin_lock_irqsave(&mpc8xxx_gc->lock, flags);
+ gc->write_reg(mpc8xxx_gc->regs + GPIO_ICR,
+ gc->read_reg(mpc8xxx_gc->regs + GPIO_ICR)
+diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+index 11ea1a0e629bd..4e866317ec250 100644
+--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
++++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+@@ -1206,6 +1206,7 @@ static void interpolate_user_regamma(uint32_t hw_points_num,
+ struct fixed31_32 lut2;
+ struct fixed31_32 delta_lut;
+ struct fixed31_32 delta_index;
++ const struct fixed31_32 one = dc_fixpt_from_int(1);
+
+ i = 0;
+ /* fixed_pt library has problems handling too small values */
+@@ -1234,6 +1235,9 @@ static void interpolate_user_regamma(uint32_t hw_points_num,
+ } else
+ hw_x = coordinates_x[i].x;
+
++ if (dc_fixpt_le(one, hw_x))
++ hw_x = one;
++
+ norm_x = dc_fixpt_mul(norm_factor, hw_x);
+ index = dc_fixpt_floor(norm_x);
+ if (index < 0 || index > 255)
+diff --git a/drivers/gpu/drm/meson/meson_plane.c b/drivers/gpu/drm/meson/meson_plane.c
+index c7daae53fa1f5..26ff2dc564198 100644
+--- a/drivers/gpu/drm/meson/meson_plane.c
++++ b/drivers/gpu/drm/meson/meson_plane.c
+@@ -101,7 +101,7 @@ static void meson_plane_atomic_update(struct drm_plane *plane,
+
+ /* Enable OSD and BLK0, set max global alpha */
+ priv->viu.osd1_ctrl_stat = OSD_ENABLE |
+- (0xFF << OSD_GLOBAL_ALPHA_SHIFT) |
++ (0x100 << OSD_GLOBAL_ALPHA_SHIFT) |
+ OSD_BLK0_ENABLE;
+
+ /* Set up BLK0 to point to the right canvas */
+diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c
+index 3feab563e50a7..3f992e5a75c97 100644
+--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
++++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
+@@ -284,8 +284,9 @@ static int cdn_dp_connector_get_modes(struct drm_connector *connector)
+ return ret;
+ }
+
+-static int cdn_dp_connector_mode_valid(struct drm_connector *connector,
+- struct drm_display_mode *mode)
++static enum drm_mode_status
++cdn_dp_connector_mode_valid(struct drm_connector *connector,
++ struct drm_display_mode *mode)
+ {
+ struct cdn_dp_device *dp = connector_to_dp(connector);
+ struct drm_display_info *display_info = &dp->connector.display_info;
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index fca092cfe2004..9cbe0b00ebf74 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -1846,7 +1846,7 @@ int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj,
+ bool fb_overlap_ok)
+ {
+ struct resource *iter, *shadow;
+- resource_size_t range_min, range_max, start;
++ resource_size_t range_min, range_max, start, end;
+ const char *dev_n = dev_name(&device_obj->device);
+ int retval;
+
+@@ -1881,6 +1881,14 @@ int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj,
+ range_max = iter->end;
+ start = (range_min + align - 1) & ~(align - 1);
+ for (; start + size - 1 <= range_max; start += align) {
++ end = start + size - 1;
++
++ /* Skip the whole fb_mmio region if not fb_overlap_ok */
++ if (!fb_overlap_ok && fb_mmio &&
++ (((start >= fb_mmio->start) && (start <= fb_mmio->end)) ||
++ ((end >= fb_mmio->start) && (end <= fb_mmio->end))))
++ continue;
++
+ shadow = __request_region(iter, start, size, NULL,
+ IORESOURCE_BUSY);
+ if (!shadow)
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index 2101b2fab7df8..62ca4964a863a 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -686,6 +686,7 @@ static int gs_can_open(struct net_device *netdev)
+ flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
+
+ /* finally start device */
++ dev->can.state = CAN_STATE_ERROR_ACTIVE;
+ dm->mode = cpu_to_le32(GS_CAN_MODE_START);
+ dm->flags = cpu_to_le32(flags);
+ rc = usb_control_msg(interface_to_usbdev(dev->iface),
+@@ -702,13 +703,12 @@ static int gs_can_open(struct net_device *netdev)
+ if (rc < 0) {
+ netdev_err(netdev, "Couldn't start device (err=%d)\n", rc);
+ kfree(dm);
++ dev->can.state = CAN_STATE_STOPPED;
+ return rc;
+ }
+
+ kfree(dm);
+
+- dev->can.state = CAN_STATE_ERROR_ACTIVE;
+-
+ parent->active_channels++;
+ if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY))
+ netif_start_queue(netdev);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 85337806efc75..9669d8c8b6c72 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -5487,6 +5487,26 @@ static int i40e_get_link_speed(struct i40e_vsi *vsi)
+ }
+ }
+
++/**
++ * i40e_bw_bytes_to_mbits - Convert max_tx_rate from bytes to mbits
++ * @vsi: Pointer to vsi structure
++ * @max_tx_rate: max TX rate in bytes to be converted into Mbits
++ *
++ * Helper function to convert units before send to set BW limit
++ **/
++static u64 i40e_bw_bytes_to_mbits(struct i40e_vsi *vsi, u64 max_tx_rate)
++{
++ if (max_tx_rate < I40E_BW_MBPS_DIVISOR) {
++ dev_warn(&vsi->back->pdev->dev,
++ "Setting max tx rate to minimum usable value of 50Mbps.\n");
++ max_tx_rate = I40E_BW_CREDIT_DIVISOR;
++ } else {
++ do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR);
++ }
++
++ return max_tx_rate;
++}
++
+ /**
+ * i40e_set_bw_limit - setup BW limit for Tx traffic based on max_tx_rate
+ * @vsi: VSI to be configured
+@@ -5509,10 +5529,10 @@ int i40e_set_bw_limit(struct i40e_vsi *vsi, u16 seid, u64 max_tx_rate)
+ max_tx_rate, seid);
+ return -EINVAL;
+ }
+- if (max_tx_rate && max_tx_rate < 50) {
++ if (max_tx_rate && max_tx_rate < I40E_BW_CREDIT_DIVISOR) {
+ dev_warn(&pf->pdev->dev,
+ "Setting max tx rate to minimum usable value of 50Mbps.\n");
+- max_tx_rate = 50;
++ max_tx_rate = I40E_BW_CREDIT_DIVISOR;
+ }
+
+ /* Tx rate credits are in values of 50Mbps, 0 is disabled */
+@@ -6949,9 +6969,9 @@ config_tc:
+
+ if (pf->flags & I40E_FLAG_TC_MQPRIO) {
+ if (vsi->mqprio_qopt.max_rate[0]) {
+- u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0];
++ u64 max_tx_rate = i40e_bw_bytes_to_mbits(vsi,
++ vsi->mqprio_qopt.max_rate[0]);
+
+- do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR);
+ ret = i40e_set_bw_limit(vsi, vsi->seid, max_tx_rate);
+ if (!ret) {
+ u64 credits = max_tx_rate;
+@@ -9613,10 +9633,10 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
+ }
+
+ if (vsi->mqprio_qopt.max_rate[0]) {
+- u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0];
++ u64 max_tx_rate = i40e_bw_bytes_to_mbits(vsi,
++ vsi->mqprio_qopt.max_rate[0]);
+ u64 credits = 0;
+
+- do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR);
+ ret = i40e_set_bw_limit(vsi, vsi->seid, max_tx_rate);
+ if (ret)
+ goto end_unlock;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index a39a8fe073ca8..973350b34e085 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1712,6 +1712,25 @@ static void i40e_del_qch(struct i40e_vf *vf)
+ }
+ }
+
++/**
++ * i40e_vc_get_max_frame_size
++ * @vf: pointer to the VF
++ *
++ * Max frame size is determined based on the current port's max frame size and
++ * whether a port VLAN is configured on this VF. The VF is not aware whether
++ * it's in a port VLAN so the PF needs to account for this in max frame size
++ * checks and sending the max frame size to the VF.
++ **/
++static u16 i40e_vc_get_max_frame_size(struct i40e_vf *vf)
++{
++ u16 max_frame_size = vf->pf->hw.phy.link_info.max_frame_size;
++
++ if (vf->port_vlan_id)
++ max_frame_size -= VLAN_HLEN;
++
++ return max_frame_size;
++}
++
+ /**
+ * i40e_vc_get_vf_resources_msg
+ * @vf: pointer to the VF info
+@@ -1814,6 +1833,7 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg)
+ vfres->max_vectors = pf->hw.func_caps.num_msix_vectors_vf;
+ vfres->rss_key_size = I40E_HKEY_ARRAY_SIZE;
+ vfres->rss_lut_size = I40E_VF_HLUT_ARRAY_SIZE;
++ vfres->max_mtu = i40e_vc_get_max_frame_size(vf);
+
+ if (vf->lan_vsi_idx) {
+ vfres->vsi_res[0].vsi_id = vf->lan_vsi_id;
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+index b56d22b530a70..1bf9734ae9cf0 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+@@ -115,8 +115,11 @@ u32 i40evf_get_tx_pending(struct i40e_ring *ring, bool in_sw)
+ {
+ u32 head, tail;
+
++ /* underlying hardware might not allow access and/or always return
++ * 0 for the head/tail registers so just use the cached values
++ */
+ head = ring->next_to_clean;
+- tail = readl(ring->tail);
++ tail = ring->next_to_use;
+
+ if (head != tail)
+ return (head < tail) ?
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c
+index f9744a61e5dd6..87d9cbe10cec1 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c
+@@ -484,8 +484,6 @@ static int mvpp2_dbgfs_flow_port_init(struct dentry *parent,
+ struct dentry *port_dir;
+
+ port_dir = debugfs_create_dir(port->dev->name, parent);
+- if (IS_ERR(port_dir))
+- return PTR_ERR(port_dir);
+
+ /* This will be freed by 'hash_opts' release op */
+ port_entry = kmalloc(sizeof(*port_entry), GFP_KERNEL);
+@@ -515,8 +513,6 @@ static int mvpp2_dbgfs_flow_entry_init(struct dentry *parent,
+ sprintf(flow_entry_name, "%02d", flow);
+
+ flow_entry_dir = debugfs_create_dir(flow_entry_name, parent);
+- if (!flow_entry_dir)
+- return -ENOMEM;
+
+ /* This will be freed by 'type' release op */
+ entry = kmalloc(sizeof(*entry), GFP_KERNEL);
+@@ -554,8 +550,6 @@ static int mvpp2_dbgfs_flow_init(struct dentry *parent, struct mvpp2 *priv)
+ int i, ret;
+
+ flow_dir = debugfs_create_dir("flows", parent);
+- if (!flow_dir)
+- return -ENOMEM;
+
+ for (i = 0; i < MVPP2_N_FLOWS; i++) {
+ ret = mvpp2_dbgfs_flow_entry_init(flow_dir, priv, i);
+@@ -579,8 +573,6 @@ static int mvpp2_dbgfs_prs_entry_init(struct dentry *parent,
+ sprintf(prs_entry_name, "%03d", tid);
+
+ prs_entry_dir = debugfs_create_dir(prs_entry_name, parent);
+- if (!prs_entry_dir)
+- return -ENOMEM;
+
+ /* The 'valid' entry's ops will free that */
+ entry = kmalloc(sizeof(*entry), GFP_KERNEL);
+@@ -618,8 +610,6 @@ static int mvpp2_dbgfs_prs_init(struct dentry *parent, struct mvpp2 *priv)
+ int i, ret;
+
+ prs_dir = debugfs_create_dir("parser", parent);
+- if (!prs_dir)
+- return -ENOMEM;
+
+ for (i = 0; i < MVPP2_PRS_TCAM_SRAM_SIZE; i++) {
+ ret = mvpp2_dbgfs_prs_entry_init(prs_dir, priv, i);
+@@ -636,8 +626,6 @@ static int mvpp2_dbgfs_port_init(struct dentry *parent,
+ struct dentry *port_dir;
+
+ port_dir = debugfs_create_dir(port->dev->name, parent);
+- if (IS_ERR(port_dir))
+- return PTR_ERR(port_dir);
+
+ debugfs_create_file("parser_entries", 0444, port_dir, port,
+ &mvpp2_dbgfs_port_parser_fops);
+@@ -671,15 +659,10 @@ void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name)
+ int ret, i;
+
+ mvpp2_root = debugfs_lookup(MVPP2_DRIVER_NAME, NULL);
+- if (!mvpp2_root) {
++ if (!mvpp2_root)
+ mvpp2_root = debugfs_create_dir(MVPP2_DRIVER_NAME, NULL);
+- if (IS_ERR(mvpp2_root))
+- return;
+- }
+
+ mvpp2_dir = debugfs_create_dir(name, mvpp2_root);
+- if (IS_ERR(mvpp2_dir))
+- return;
+
+ priv->dbgfs_dir = mvpp2_dir;
+
+diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
+index 882908e74cc99..a4090163d870c 100644
+--- a/drivers/net/ethernet/sun/sunhme.c
++++ b/drivers/net/ethernet/sun/sunhme.c
+@@ -2064,9 +2064,9 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev)
+
+ skb_reserve(copy_skb, 2);
+ skb_put(copy_skb, len);
+- dma_sync_single_for_cpu(hp->dma_dev, dma_addr, len, DMA_FROM_DEVICE);
++ dma_sync_single_for_cpu(hp->dma_dev, dma_addr, len + 2, DMA_FROM_DEVICE);
+ skb_copy_from_linear_data(skb, copy_skb->data, len);
+- dma_sync_single_for_device(hp->dma_dev, dma_addr, len, DMA_FROM_DEVICE);
++ dma_sync_single_for_device(hp->dma_dev, dma_addr, len + 2, DMA_FROM_DEVICE);
+ /* Reuse original ring buffer. */
+ hme_write_rxd(hp, this,
+ (RXFLAG_OWN|((RX_BUF_ALLOC_SIZE-RX_OFFSET)<<16)),
+diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
+index 40ac60904c8dd..63f0226b0a70c 100644
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -502,7 +502,6 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
+
+ static int ipvlan_process_outbound(struct sk_buff *skb)
+ {
+- struct ethhdr *ethh = eth_hdr(skb);
+ int ret = NET_XMIT_DROP;
+
+ /* The ipvlan is a pseudo-L2 device, so the packets that we receive
+@@ -512,6 +511,8 @@ static int ipvlan_process_outbound(struct sk_buff *skb)
+ if (skb_mac_header_was_set(skb)) {
+ /* In this mode we dont care about
+ * multicast and broadcast traffic */
++ struct ethhdr *ethh = eth_hdr(skb);
++
+ if (is_multicast_ether_addr(ethh->h_dest)) {
+ pr_debug_ratelimited(
+ "Dropped {multi|broad}cast of type=[%x]\n",
+@@ -596,7 +597,7 @@ out:
+ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
+ {
+ const struct ipvl_dev *ipvlan = netdev_priv(dev);
+- struct ethhdr *eth = eth_hdr(skb);
++ struct ethhdr *eth = skb_eth_hdr(skb);
+ struct ipvl_addr *addr;
+ void *lyr3h;
+ int addr_type;
+@@ -626,6 +627,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
+ return dev_forward_skb(ipvlan->phy_dev, skb);
+
+ } else if (is_multicast_ether_addr(eth->h_dest)) {
++ skb_reset_mac_header(skb);
+ ipvlan_skb_crossing_ns(skb, NULL);
+ ipvlan_multicast_enqueue(ipvlan->port, skb, true);
+ return NET_XMIT_SUCCESS;
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 8a1e9dba1249e..2410f08e2bb5c 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -1280,10 +1280,12 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
+ }
+ }
+
+- netif_addr_lock_bh(dev);
+- dev_uc_sync_multiple(port_dev, dev);
+- dev_mc_sync_multiple(port_dev, dev);
+- netif_addr_unlock_bh(dev);
++ if (dev->flags & IFF_UP) {
++ netif_addr_lock_bh(dev);
++ dev_uc_sync_multiple(port_dev, dev);
++ dev_mc_sync_multiple(port_dev, dev);
++ netif_addr_unlock_bh(dev);
++ }
+
+ port->index = -1;
+ list_add_tail_rcu(&port->list, &team->port_list);
+@@ -1354,8 +1356,10 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
+ netdev_rx_handler_unregister(port_dev);
+ team_port_disable_netpoll(port);
+ vlan_vids_del_by_dev(port_dev, dev);
+- dev_uc_unsync(port_dev, dev);
+- dev_mc_unsync(port_dev, dev);
++ if (dev->flags & IFF_UP) {
++ dev_uc_unsync(port_dev, dev);
++ dev_mc_unsync(port_dev, dev);
++ }
+ dev_close(port_dev);
+ team_port_leave(team, port);
+
+@@ -1703,6 +1707,14 @@ static int team_open(struct net_device *dev)
+
+ static int team_close(struct net_device *dev)
+ {
++ struct team *team = netdev_priv(dev);
++ struct team_port *port;
++
++ list_for_each_entry(port, &team->port_list, list) {
++ dev_uc_unsync(port->dev, dev);
++ dev_mc_unsync(port->dev, dev);
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index fcf21a1ca7761..8d10c29ba1763 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1049,6 +1049,7 @@ static const struct usb_device_id products[] = {
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)}, /* Quectel EM160R-GL */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0801)}, /* Quectel RM520N */
+
+ /* 3. Combined interface devices matching on interface number */
+ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index 1a35d73c39c35..80b5aae1bdc9b 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -504,6 +504,7 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status)
+ {
+ u32 old_sqhd, new_sqhd;
+ u16 sqhd;
++ struct nvmet_ns *ns = req->ns;
+
+ if (status)
+ nvmet_set_status(req, status);
+@@ -520,9 +521,9 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status)
+ req->rsp->sq_id = cpu_to_le16(req->sq->qid);
+ req->rsp->command_id = req->cmd->common.command_id;
+
+- if (req->ns)
+- nvmet_put_namespace(req->ns);
+ req->ops->queue_response(req);
++ if (ns)
++ nvmet_put_namespace(ns);
+ }
+
+ void nvmet_req_complete(struct nvmet_req *req, u16 status)
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 9fecac72c358c..7c284ca0212c5 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -392,7 +392,7 @@ static int unflatten_dt_nodes(const void *blob,
+ for (offset = 0;
+ offset >= 0 && depth >= initial_depth;
+ offset = fdt_next_node(blob, offset, &depth)) {
+- if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH))
++ if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH - 1))
+ continue;
+
+ if (!IS_ENABLED(CONFIG_OF_KOBJ) &&
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index 100adacfdca94..9031c57aa1b56 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -283,6 +283,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
+ return 0;
+
+ unregister:
++ of_node_put(child);
+ mdiobus_unregister(mdio);
+ return rc;
+ }
+diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
+index 73ee74d6e7a3d..2c763f9d75df4 100644
+--- a/drivers/parisc/ccio-dma.c
++++ b/drivers/parisc/ccio-dma.c
+@@ -1555,6 +1555,7 @@ static int __init ccio_probe(struct parisc_device *dev)
+ }
+ ccio_ioc_init(ioc);
+ if (ccio_init_resources(ioc)) {
++ iounmap(ioc->ioc_regs);
+ kfree(ioc);
+ return -ENOMEM;
+ }
+diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
+index 8b1940110561a..b1d73a6c7809e 100644
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -710,7 +710,7 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
+ ((pfuze_chip->chip_id == PFUZE3000) ? "3000" : "3001"))));
+
+ memcpy(pfuze_chip->regulator_descs, pfuze_chip->pfuze_regulators,
+- sizeof(pfuze_chip->regulator_descs));
++ regulator_num * sizeof(struct pfuze_regulator));
+
+ ret = pfuze_parse_regulators_dt(pfuze_chip);
+ if (ret)
+diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
+index dc78a523a69f2..b6b938aa66158 100644
+--- a/drivers/s390/block/dasd_alias.c
++++ b/drivers/s390/block/dasd_alias.c
+@@ -675,12 +675,12 @@ int dasd_alias_remove_device(struct dasd_device *device)
+ struct dasd_device *dasd_alias_get_start_dev(struct dasd_device *base_device)
+ {
+ struct dasd_eckd_private *alias_priv, *private = base_device->private;
+- struct alias_pav_group *group = private->pavgroup;
+ struct alias_lcu *lcu = private->lcu;
+ struct dasd_device *alias_device;
++ struct alias_pav_group *group;
+ unsigned long flags;
+
+- if (!group || !lcu)
++ if (!lcu)
+ return NULL;
+ if (lcu->pav == NO_PAV ||
+ lcu->flags & (NEED_UAC_UPDATE | UPDATE_PENDING))
+@@ -697,6 +697,11 @@ struct dasd_device *dasd_alias_get_start_dev(struct dasd_device *base_device)
+ }
+
+ spin_lock_irqsave(&lcu->lock, flags);
++ group = private->pavgroup;
++ if (!group) {
++ spin_unlock_irqrestore(&lcu->lock, flags);
++ return NULL;
++ }
+ alias_device = group->next;
+ if (!alias_device) {
+ if (list_empty(&group->aliaslist)) {
+diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
+index af2a29cfbbe98..ee480a1480e86 100644
+--- a/drivers/tty/serial/serial-tegra.c
++++ b/drivers/tty/serial/serial-tegra.c
+@@ -398,7 +398,7 @@ static void tegra_uart_tx_dma_complete(void *args)
+ count = tup->tx_bytes_requested - state.residue;
+ async_tx_ack(tup->tx_dma_desc);
+ spin_lock_irqsave(&tup->uport.lock, flags);
+- xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);
++ uart_xmit_advance(&tup->uport, count);
+ tup->tx_in_progress = 0;
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(&tup->uport);
+@@ -482,7 +482,6 @@ static unsigned int tegra_uart_tx_empty(struct uart_port *u)
+ static void tegra_uart_stop_tx(struct uart_port *u)
+ {
+ struct tegra_uart_port *tup = to_tegra_uport(u);
+- struct circ_buf *xmit = &tup->uport.state->xmit;
+ struct dma_tx_state state;
+ unsigned int count;
+
+@@ -493,7 +492,7 @@ static void tegra_uart_stop_tx(struct uart_port *u)
+ dmaengine_tx_status(tup->tx_dma_chan, tup->tx_cookie, &state);
+ count = tup->tx_bytes_requested - state.residue;
+ async_tx_ack(tup->tx_dma_desc);
+- xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);
++ uart_xmit_advance(&tup->uport, count);
+ tup->tx_in_progress = 0;
+ }
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 4d04c75ac3815..d1a7f22cb3a92 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5852,7 +5852,7 @@ re_enumerate_no_bos:
+ *
+ * Return: The same as for usb_reset_and_verify_device().
+ * However, if a reset is already in progress (for instance, if a
+- * driver doesn't have pre_ or post_reset() callbacks, and while
++ * driver doesn't have pre_reset() or post_reset() callbacks, and while
+ * being unbound or re-bound during the ongoing reset its disconnect()
+ * or probe() routine tries to perform a second, nested reset), the
+ * routine returns -EINPROGRESS.
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 527938eee8461..955bf820f4102 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -36,6 +36,11 @@
+ #define PCI_DEVICE_ID_INTEL_CNPH 0xa36e
+ #define PCI_DEVICE_ID_INTEL_CNPV 0xa3b0
+ #define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee
++#define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e
++#define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee
++#define PCI_DEVICE_ID_INTEL_TGPH 0x43ee
++#define PCI_DEVICE_ID_INTEL_JSP 0x4dee
++#define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1
+
+ #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
+ #define PCI_INTEL_BXT_FUNC_PMU_PWR 4
+@@ -144,7 +149,8 @@ static int dwc3_pci_quirks(struct dwc3_pci *dwc)
+
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
+ if (pdev->device == PCI_DEVICE_ID_INTEL_BXT ||
+- pdev->device == PCI_DEVICE_ID_INTEL_BXT_M) {
++ pdev->device == PCI_DEVICE_ID_INTEL_BXT_M ||
++ pdev->device == PCI_DEVICE_ID_INTEL_EHLLP) {
+ guid_parse(PCI_INTEL_BXT_DSM_GUID, &dwc->guid);
+ dwc->has_dsm_for_pm = true;
+ }
+@@ -351,6 +357,21 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ICLLP),
+ (kernel_ulong_t) &dwc3_pci_intel_properties, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_EHLLP),
++ (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPLP),
++ (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPH),
++ (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_JSP),
++ (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS),
++ (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB),
+ (kernel_ulong_t) &dwc3_pci_amd_properties, },
+ { } /* Terminating Entry */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index fe4e340ac66ee..560e628912e54 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -256,6 +256,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_EM060K 0x030b
+ #define QUECTEL_PRODUCT_EM12 0x0512
+ #define QUECTEL_PRODUCT_RM500Q 0x0800
++#define QUECTEL_PRODUCT_RM520N 0x0801
+ #define QUECTEL_PRODUCT_EC200S_CN 0x6002
+ #define QUECTEL_PRODUCT_EC200T 0x6026
+ #define QUECTEL_PRODUCT_RM500K 0x7001
+@@ -1138,6 +1139,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0xff, 0xff),
+ .driver_info = NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0, 0) },
++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0203, 0xff), /* BG95-M3 */
++ .driver_info = ZLP },
+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
+@@ -1159,6 +1162,9 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
+ .driver_info = ZLP },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) },
+diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c
+index 43695a33f062f..aec0b85db5bf4 100644
+--- a/drivers/video/fbdev/pxa3xx-gcu.c
++++ b/drivers/video/fbdev/pxa3xx-gcu.c
+@@ -394,7 +394,7 @@ pxa3xx_gcu_write(struct file *file, const char *buff,
+ struct pxa3xx_gcu_batch *buffer;
+ struct pxa3xx_gcu_priv *priv = to_pxa3xx_gcu_priv(file);
+
+- int words = count / 4;
++ size_t words = count / 4;
+
+ /* Does not need to be atomic. There's a lock in user space,
+ * but anyhow, this is just for statistics. */
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 59643acb6d679..3f9029cf09fc6 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -168,8 +168,8 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
+
+ *sent = 0;
+
+- smb_msg->msg_name = (struct sockaddr *) &server->dstaddr;
+- smb_msg->msg_namelen = sizeof(struct sockaddr);
++ smb_msg->msg_name = NULL;
++ smb_msg->msg_namelen = 0;
+ smb_msg->msg_control = NULL;
+ smb_msg->msg_controllen = 0;
+ if (server->noblocksnd)
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 5cb19fdf6450c..5dfb34802aed5 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -505,7 +505,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,
+ goto fallback;
+ }
+
+- max_dirs = ndirs / ngroups + inodes_per_group / 16;
++ max_dirs = ndirs / ngroups + inodes_per_group*flex_size / 16;
+ min_inodes = avefreei - inodes_per_group*flex_size / 4;
+ if (min_inodes < 1)
+ min_inodes = 1;
+diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
+index 3460b15a26078..af8143fb644cc 100644
+--- a/include/linux/serial_core.h
++++ b/include/linux/serial_core.h
+@@ -306,6 +306,23 @@ struct uart_state {
+ /* number of characters left in xmit buffer before we ask for more */
+ #define WAKEUP_CHARS 256
+
++/**
++ * uart_xmit_advance - Advance xmit buffer and account Tx'ed chars
++ * @up: uart_port structure describing the port
++ * @chars: number of characters sent
++ *
++ * This function advances the tail of circular xmit buffer by the number of
++ * @chars transmitted and handles accounting of transmitted bytes (into
++ * @up's icount.tx).
++ */
++static inline void uart_xmit_advance(struct uart_port *up, unsigned int chars)
++{
++ struct circ_buf *xmit = &up->state->xmit;
++
++ xmit->tail = (xmit->tail + chars) & (UART_XMIT_SIZE - 1);
++ up->icount.tx += chars;
++}
++
+ struct module;
+ struct tty_driver;
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index b1bb6cb5802ec..4ea2f7fd20ceb 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -2917,10 +2917,8 @@ static bool __flush_work(struct work_struct *work, bool from_cancel)
+ if (WARN_ON(!work->func))
+ return false;
+
+- if (!from_cancel) {
+- lock_map_acquire(&work->lockdep_map);
+- lock_map_release(&work->lockdep_map);
+- }
++ lock_map_acquire(&work->lockdep_map);
++ lock_map_release(&work->lockdep_map);
+
+ if (start_flush_work(work, &barr, from_cancel)) {
+ wait_for_completion(&barr.done);
+diff --git a/mm/slub.c b/mm/slub.c
+index 0fefe0ad8f572..ef730ea8263cb 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -5688,7 +5688,8 @@ static char *create_unique_id(struct kmem_cache *s)
+ char *name = kmalloc(ID_STR_LENGTH, GFP_KERNEL);
+ char *p = name;
+
+- BUG_ON(!name);
++ if (!name)
++ return ERR_PTR(-ENOMEM);
+
+ *p++ = ':';
+ /*
+@@ -5770,6 +5771,8 @@ static int sysfs_slab_add(struct kmem_cache *s)
+ * for the symlinks.
+ */
+ name = create_unique_id(s);
++ if (IS_ERR(name))
++ return PTR_ERR(name);
+ }
+
+ s->kobj.kset = kset;
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index ea27bacbd0057..59d8974ee92b4 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -1003,8 +1003,10 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
+ goto free_iterate;
+ }
+
+- if (repl->valid_hooks != t->valid_hooks)
++ if (repl->valid_hooks != t->valid_hooks) {
++ ret = -EINVAL;
+ goto free_unlock;
++ }
+
+ if (repl->num_counters && repl->num_counters != t->private->nentries) {
+ ret = -EINVAL;
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index de42bcfeda9cc..e3d8be4feea50 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -412,10 +412,6 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
+ scan_req = rcu_dereference_protected(local->scan_req,
+ lockdep_is_held(&local->mtx));
+
+- if (scan_req != local->int_scan_req) {
+- local->scan_info.aborted = aborted;
+- cfg80211_scan_done(scan_req, &local->scan_info);
+- }
+ RCU_INIT_POINTER(local->scan_req, NULL);
+
+ scan_sdata = rcu_dereference_protected(local->scan_sdata,
+@@ -425,6 +421,13 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
+ local->scanning = 0;
+ local->scan_chandef.chan = NULL;
+
++ synchronize_rcu();
++
++ if (scan_req != local->int_scan_req) {
++ local->scan_info.aborted = aborted;
++ cfg80211_scan_done(scan_req, &local->scan_info);
++ }
++
+ /* Set power back to normal operating levels. */
+ ieee80211_hw_config(local, 0);
+
+diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
+index b7436935b57d0..23ead02c6aa50 100644
+--- a/net/netfilter/nf_conntrack_irc.c
++++ b/net/netfilter/nf_conntrack_irc.c
+@@ -150,15 +150,37 @@ static int help(struct sk_buff *skb, unsigned int protoff,
+ data = ib_ptr;
+ data_limit = ib_ptr + skb->len - dataoff;
+
+- /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
+- * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
+- while (data < data_limit - (19 + MINMATCHLEN)) {
+- if (memcmp(data, "\1DCC ", 5)) {
++ /* Skip any whitespace */
++ while (data < data_limit - 10) {
++ if (*data == ' ' || *data == '\r' || *data == '\n')
++ data++;
++ else
++ break;
++ }
++
++ /* strlen("PRIVMSG x ")=10 */
++ if (data < data_limit - 10) {
++ if (strncasecmp("PRIVMSG ", data, 8))
++ goto out;
++ data += 8;
++ }
++
++ /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26
++ * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26
++ */
++ while (data < data_limit - (21 + MINMATCHLEN)) {
++ /* Find first " :", the start of message */
++ if (memcmp(data, " :", 2)) {
+ data++;
+ continue;
+ }
++ data += 2;
++
++ /* then check that place only for the DCC command */
++ if (memcmp(data, "\1DCC ", 5))
++ goto out;
+ data += 5;
+- /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
++ /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */
+
+ iph = ip_hdr(skb);
+ pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
+@@ -174,7 +196,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
+ pr_debug("DCC %s detected\n", dccprotos[i]);
+
+ /* we have at least
+- * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
++ * (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid
+ * data left (== 14/13 bytes) */
+ if (parse_dcc(data, data_limit, &dcc_ip,
+ &dcc_port, &addr_beg_p, &addr_end_p)) {
+diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
+index c8d2b6688a2a0..046f118dea06b 100644
+--- a/net/netfilter/nf_conntrack_sip.c
++++ b/net/netfilter/nf_conntrack_sip.c
+@@ -471,7 +471,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
+ return ret;
+ if (ret == 0)
+ break;
+- dataoff += *matchoff;
++ dataoff = *matchoff;
+ }
+ *in_header = 0;
+ }
+@@ -483,7 +483,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
+ break;
+ if (ret == 0)
+ return ret;
+- dataoff += *matchoff;
++ dataoff = *matchoff;
+ }
+
+ if (in_header)
+diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
+index fe190a6918727..5a01479aae3f3 100644
+--- a/net/rxrpc/local_object.c
++++ b/net/rxrpc/local_object.c
+@@ -452,6 +452,9 @@ static void rxrpc_local_processor(struct work_struct *work)
+ container_of(work, struct rxrpc_local, processor);
+ bool again;
+
++ if (local->dead)
++ return;
++
+ trace_rxrpc_local(local->debug_id, rxrpc_local_processing,
+ atomic_read(&local->usage), NULL);
+
+diff --git a/scripts/mksysmap b/scripts/mksysmap
+index 9aa23d15862a0..ad8bbc52267d0 100755
+--- a/scripts/mksysmap
++++ b/scripts/mksysmap
+@@ -41,4 +41,4 @@
+ # so we just ignore them to let readprofile continue to work.
+ # (At least sparc64 has __crc_ in the middle).
+
+-$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)' > $2
++$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)\|\( L0\)' > $2
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 686f0fed6f6e4..d3d26be93cd2d 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2634,6 +2634,8 @@ static const struct pci_device_id azx_ids[] = {
+ /* 5 Series/3400 */
+ { PCI_DEVICE(0x8086, 0x3b56),
+ .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
++ { PCI_DEVICE(0x8086, 0x3b57),
++ .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
+ /* Poulsbo */
+ { PCI_DEVICE(0x8086, 0x811b),
+ .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE },
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index d21a4eb1ca492..cbd5118570fd5 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3455,6 +3455,7 @@ static int patch_tegra_hdmi(struct hda_codec *codec)
+ if (err)
+ return err;
+
++ codec->depop_delay = 10;
+ codec->patch_ops.build_pcms = tegra_hdmi_build_pcms;
+ spec = codec->spec;
+ spec->chmap.ops.chmap_cea_alloc_validate_get_type =
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9670db6ad1e1b..cb556390de229 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7081,6 +7081,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
++ SND_PCI_QUIRK(0x1028, 0x087d, "Dell Precision 5530", ALC289_FIXUP_DUAL_SPK),
+ SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 85c33f528d7b3..8d09312b2e428 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -222,6 +222,7 @@ struct sigmatel_spec {
+
+ /* beep widgets */
+ hda_nid_t anabeep_nid;
++ bool beep_power_on;
+
+ /* SPDIF-out mux */
+ const char * const *spdif_labels;
+@@ -4463,6 +4464,28 @@ static int stac_suspend(struct hda_codec *codec)
+ stac_shutup(codec);
+ return 0;
+ }
++
++static int stac_check_power_status(struct hda_codec *codec, hda_nid_t nid)
++{
++#ifdef CONFIG_SND_HDA_INPUT_BEEP
++ struct sigmatel_spec *spec = codec->spec;
++#endif
++ int ret = snd_hda_gen_check_power_status(codec, nid);
++
++#ifdef CONFIG_SND_HDA_INPUT_BEEP
++ if (nid == spec->gen.beep_nid && codec->beep) {
++ if (codec->beep->enabled != spec->beep_power_on) {
++ spec->beep_power_on = codec->beep->enabled;
++ if (spec->beep_power_on)
++ snd_hda_power_up_pm(codec);
++ else
++ snd_hda_power_down_pm(codec);
++ }
++ ret |= spec->beep_power_on;
++ }
++#endif
++ return ret;
++}
+ #else
+ #define stac_suspend NULL
+ #endif /* CONFIG_PM */
+@@ -4475,6 +4498,7 @@ static const struct hda_codec_ops stac_patch_ops = {
+ .unsol_event = snd_hda_jack_unsol_event,
+ #ifdef CONFIG_PM
+ .suspend = stac_suspend,
++ .check_power_status = stac_check_power_status,
+ #endif
+ .reboot_notify = stac_shutup,
+ };
+diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
+index 4af87340b1655..4f18bb272e929 100644
+--- a/sound/soc/codecs/nau8824.c
++++ b/sound/soc/codecs/nau8824.c
+@@ -1075,6 +1075,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
+ struct snd_soc_component *component = dai->component;
+ struct nau8824 *nau8824 = snd_soc_component_get_drvdata(component);
+ unsigned int val_len = 0, osr, ctrl_val, bclk_fs, bclk_div;
++ int err = -EINVAL;
+
+ nau8824_sema_acquire(nau8824, HZ);
+
+@@ -1091,7 +1092,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
+ osr &= NAU8824_DAC_OVERSAMPLE_MASK;
+ if (nau8824_clock_check(nau8824, substream->stream,
+ nau8824->fs, osr))
+- return -EINVAL;
++ goto error;
+ regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+ NAU8824_CLK_DAC_SRC_MASK,
+ osr_dac_sel[osr].clk_src << NAU8824_CLK_DAC_SRC_SFT);
+@@ -1101,7 +1102,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
+ osr &= NAU8824_ADC_SYNC_DOWN_MASK;
+ if (nau8824_clock_check(nau8824, substream->stream,
+ nau8824->fs, osr))
+- return -EINVAL;
++ goto error;
+ regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+ NAU8824_CLK_ADC_SRC_MASK,
+ osr_adc_sel[osr].clk_src << NAU8824_CLK_ADC_SRC_SFT);
+@@ -1122,7 +1123,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
+ else if (bclk_fs <= 256)
+ bclk_div = 0;
+ else
+- return -EINVAL;
++ goto error;
+ regmap_update_bits(nau8824->regmap,
+ NAU8824_REG_PORT0_I2S_PCM_CTRL_2,
+ NAU8824_I2S_LRC_DIV_MASK | NAU8824_I2S_BLK_DIV_MASK,
+@@ -1143,15 +1144,17 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
+ val_len |= NAU8824_I2S_DL_32;
+ break;
+ default:
+- return -EINVAL;
++ goto error;
+ }
+
+ regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1,
+ NAU8824_I2S_DL_MASK, val_len);
++ err = 0;
+
++ error:
+ nau8824_sema_release(nau8824);
+
+- return 0;
++ return err;
+ }
+
+ static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+@@ -1160,8 +1163,6 @@ static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ struct nau8824 *nau8824 = snd_soc_component_get_drvdata(component);
+ unsigned int ctrl1_val = 0, ctrl2_val = 0;
+
+- nau8824_sema_acquire(nau8824, HZ);
+-
+ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+ case SND_SOC_DAIFMT_CBM_CFM:
+ ctrl2_val |= NAU8824_I2S_MS_MASTER;
+@@ -1203,6 +1204,8 @@ static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ return -EINVAL;
+ }
+
++ nau8824_sema_acquire(nau8824, HZ);
++
+ regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1,
+ NAU8824_I2S_DF_MASK | NAU8824_I2S_BP_MASK |
+ NAU8824_I2S_PCMB_EN, ctrl1_val);
+diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c
+index afb8fe3a8e353..65e41e259af8b 100644
+--- a/tools/perf/util/genelf.c
++++ b/tools/perf/util/genelf.c
+@@ -256,6 +256,7 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym,
+ Elf_Data *d;
+ Elf_Scn *scn;
+ Elf_Ehdr *ehdr;
++ Elf_Phdr *phdr;
+ Elf_Shdr *shdr;
+ uint64_t eh_frame_base_offset;
+ char *strsym = NULL;
+@@ -290,6 +291,19 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym,
+ ehdr->e_version = EV_CURRENT;
+ ehdr->e_shstrndx= unwinding ? 4 : 2; /* shdr index for section name */
+
++ /*
++ * setup program header
++ */
++ phdr = elf_newphdr(e, 1);
++ phdr[0].p_type = PT_LOAD;
++ phdr[0].p_offset = 0;
++ phdr[0].p_vaddr = 0;
++ phdr[0].p_paddr = 0;
++ phdr[0].p_filesz = csize;
++ phdr[0].p_memsz = csize;
++ phdr[0].p_flags = PF_X | PF_R;
++ phdr[0].p_align = 8;
++
+ /*
+ * setup text section
+ */
+diff --git a/tools/perf/util/genelf.h b/tools/perf/util/genelf.h
+index de322d51c7fe2..23a7401a63d02 100644
+--- a/tools/perf/util/genelf.h
++++ b/tools/perf/util/genelf.h
+@@ -41,8 +41,10 @@ int jit_add_debug_info(Elf *e, uint64_t code_addr, void *debug, int nr_debug_ent
+
+ #if GEN_ELF_CLASS == ELFCLASS64
+ #define elf_newehdr elf64_newehdr
++#define elf_newphdr elf64_newphdr
+ #define elf_getshdr elf64_getshdr
+ #define Elf_Ehdr Elf64_Ehdr
++#define Elf_Phdr Elf64_Phdr
+ #define Elf_Shdr Elf64_Shdr
+ #define Elf_Sym Elf64_Sym
+ #define ELF_ST_TYPE(a) ELF64_ST_TYPE(a)
+@@ -50,8 +52,10 @@ int jit_add_debug_info(Elf *e, uint64_t code_addr, void *debug, int nr_debug_ent
+ #define ELF_ST_VIS(a) ELF64_ST_VISIBILITY(a)
+ #else
+ #define elf_newehdr elf32_newehdr
++#define elf_newphdr elf32_newphdr
+ #define elf_getshdr elf32_getshdr
+ #define Elf_Ehdr Elf32_Ehdr
++#define Elf_Phdr Elf32_Phdr
+ #define Elf_Shdr Elf32_Shdr
+ #define Elf_Sym Elf32_Sym
+ #define ELF_ST_TYPE(a) ELF32_ST_TYPE(a)
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index bd33d66139296..5fba57c10eddc 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1871,8 +1871,8 @@ static int kcore_copy__compare_file(const char *from_dir, const char *to_dir,
+ * unusual. One significant peculiarity is that the mapping (start -> pgoff)
+ * is not the same for the kernel map and the modules map. That happens because
+ * the data is copied adjacently whereas the original kcore has gaps. Finally,
+- * kallsyms and modules files are compared with their copies to check that
+- * modules have not been loaded or unloaded while the copies were taking place.
++ * kallsyms file is compared with its copy to check that modules have not been
++ * loaded or unloaded while the copies were taking place.
+ *
+ * Return: %0 on success, %-1 on failure.
+ */
+@@ -1935,9 +1935,6 @@ int kcore_copy(const char *from_dir, const char *to_dir)
+ goto out_extract_close;
+ }
+
+- if (kcore_copy__compare_file(from_dir, to_dir, "modules"))
+- goto out_extract_close;
+-
+ if (kcore_copy__compare_file(from_dir, to_dir, "kallsyms"))
+ goto out_extract_close;
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-10-05 11:59 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-10-05 11:59 UTC (permalink / raw
To: gentoo-commits
commit: b6b17bcba0ccba7341c05c6f3c1572b20e2abdd0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 5 11:59:21 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Oct 5 11:59:21 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b6b17bcb
Linux patch 4.19.261
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1260_linux-4.19.261.patch | 615 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 619 insertions(+)
diff --git a/0000_README b/0000_README
index 6bbe74fa..05c6a58c 100644
--- a/0000_README
+++ b/0000_README
@@ -1083,6 +1083,10 @@ Patch: 1259_linux-4.19.260.patch
From: https://www.kernel.org
Desc: Linux 4.19.260
+Patch: 1260_linux-4.19.261.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.261
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1260_linux-4.19.261.patch b/1260_linux-4.19.261.patch
new file mode 100644
index 00000000..c3f6bb94
--- /dev/null
+++ b/1260_linux-4.19.261.patch
@@ -0,0 +1,615 @@
+diff --git a/Makefile b/Makefile
+index 61971754a74e8..165812d2f786b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 260
++SUBLEVEL = 261
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/integratorap.dts b/arch/arm/boot/dts/integratorap.dts
+index 94d2ff9836d00..e6c5a99e07416 100644
+--- a/arch/arm/boot/dts/integratorap.dts
++++ b/arch/arm/boot/dts/integratorap.dts
+@@ -155,6 +155,7 @@
+
+ pci: pciv3@62000000 {
+ compatible = "arm,integrator-ap-pci", "v3,v360epc-pci";
++ device_type = "pci";
+ #interrupt-cells = <1>;
+ #size-cells = <2>;
+ #address-cells = <3>;
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index b0dea0702c748..6d110a1c090dd 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4560,6 +4560,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "PIONEER DVD-RW DVR-212D", NULL, ATA_HORKAGE_NOSETXFER },
+ { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER },
+
++ /* These specific Pioneer models have LPM issues */
++ { "PIONEER BD-RW BDR-207M", NULL, ATA_HORKAGE_NOLPM },
++ { "PIONEER BD-RW BDR-205", NULL, ATA_HORKAGE_NOLPM },
++
+ /* Crucial BX100 SSD 500GB has broken LPM support */
+ { "CT500BX100SSD1", NULL, ATA_HORKAGE_NOLPM },
+
+diff --git a/drivers/clk/bcm/clk-iproc-pll.c b/drivers/clk/bcm/clk-iproc-pll.c
+index 274441e2ddb28..8f0619f362e3b 100644
+--- a/drivers/clk/bcm/clk-iproc-pll.c
++++ b/drivers/clk/bcm/clk-iproc-pll.c
+@@ -736,6 +736,7 @@ void iproc_pll_clk_setup(struct device_node *node,
+ const char *parent_name;
+ struct iproc_clk *iclk_array;
+ struct clk_hw_onecell_data *clk_data;
++ const char *clk_name;
+
+ if (WARN_ON(!pll_ctrl) || WARN_ON(!clk_ctrl))
+ return;
+@@ -783,7 +784,12 @@ void iproc_pll_clk_setup(struct device_node *node,
+ iclk = &iclk_array[0];
+ iclk->pll = pll;
+
+- init.name = node->name;
++ ret = of_property_read_string_index(node, "clock-output-names",
++ 0, &clk_name);
++ if (WARN_ON(ret))
++ goto err_pll_register;
++
++ init.name = clk_name;
+ init.ops = &iproc_pll_ops;
+ init.flags = 0;
+ parent_name = of_clk_get_parent_name(node, 0);
+@@ -803,13 +809,11 @@ void iproc_pll_clk_setup(struct device_node *node,
+ goto err_pll_register;
+
+ clk_data->hws[0] = &iclk->hw;
++ parent_name = clk_name;
+
+ /* now initialize and register all leaf clocks */
+ for (i = 1; i < num_clks; i++) {
+- const char *clk_name;
+-
+ memset(&init, 0, sizeof(init));
+- parent_name = node->name;
+
+ ret = of_property_read_string_index(node, "clock-output-names",
+ i, &clk_name);
+diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+index e21c7673cd5b8..57781833cae1b 100644
+--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+@@ -1690,12 +1690,6 @@ EXPORT_SYMBOL_GPL(analogix_dp_unbind);
+ int analogix_dp_suspend(struct analogix_dp_device *dp)
+ {
+ clk_disable_unprepare(dp->clock);
+-
+- if (dp->plat_data->panel) {
+- if (drm_panel_unprepare(dp->plat_data->panel))
+- DRM_ERROR("failed to turnoff the panel\n");
+- }
+-
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(analogix_dp_suspend);
+@@ -1710,13 +1704,6 @@ int analogix_dp_resume(struct analogix_dp_device *dp)
+ return ret;
+ }
+
+- if (dp->plat_data->panel) {
+- if (drm_panel_prepare(dp->plat_data->panel)) {
+- DRM_ERROR("failed to setup the panel\n");
+- return -EBUSY;
+- }
+- }
+-
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(analogix_dp_resume);
+diff --git a/drivers/input/touchscreen/melfas_mip4.c b/drivers/input/touchscreen/melfas_mip4.c
+index 430a2bc5f7caf..5d947e721fa5d 100644
+--- a/drivers/input/touchscreen/melfas_mip4.c
++++ b/drivers/input/touchscreen/melfas_mip4.c
+@@ -1462,7 +1462,7 @@ static int mip4_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ "ce", GPIOD_OUT_LOW);
+ if (IS_ERR(ts->gpio_ce)) {
+ error = PTR_ERR(ts->gpio_ce);
+- if (error != EPROBE_DEFER)
++ if (error != -EPROBE_DEFER)
+ dev_err(&client->dev,
+ "Failed to get gpio: %d\n", error);
+ return error;
+diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
+index 5c81dc7371db7..1552d1f09c5c4 100644
+--- a/drivers/mmc/host/moxart-mmc.c
++++ b/drivers/mmc/host/moxart-mmc.c
+@@ -111,8 +111,8 @@
+ #define CLK_DIV_MASK 0x7f
+
+ /* REG_BUS_WIDTH */
+-#define BUS_WIDTH_8 BIT(2)
+-#define BUS_WIDTH_4 BIT(1)
++#define BUS_WIDTH_4_SUPPORT BIT(3)
++#define BUS_WIDTH_4 BIT(2)
+ #define BUS_WIDTH_1 BIT(0)
+
+ #define MMC_VDD_360 23
+@@ -527,9 +527,6 @@ static void moxart_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ case MMC_BUS_WIDTH_4:
+ writel(BUS_WIDTH_4, host->base + REG_BUS_WIDTH);
+ break;
+- case MMC_BUS_WIDTH_8:
+- writel(BUS_WIDTH_8, host->base + REG_BUS_WIDTH);
+- break;
+ default:
+ writel(BUS_WIDTH_1, host->base + REG_BUS_WIDTH);
+ break;
+@@ -646,16 +643,8 @@ static int moxart_probe(struct platform_device *pdev)
+ dmaengine_slave_config(host->dma_chan_rx, &cfg);
+ }
+
+- switch ((readl(host->base + REG_BUS_WIDTH) >> 3) & 3) {
+- case 1:
++ if (readl(host->base + REG_BUS_WIDTH) & BUS_WIDTH_4_SUPPORT)
+ mmc->caps |= MMC_CAP_4_BIT_DATA;
+- break;
+- case 2:
+- mmc->caps |= MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA;
+- break;
+- default:
+- break;
+- }
+
+ writel(0, host->base + REG_INTERRUPT_MASK);
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 8d10c29ba1763..56115792bea16 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1357,6 +1357,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x413c, 0x81b3, 8)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+ {QMI_FIXED_INTF(0x413c, 0x81b6, 8)}, /* Dell Wireless 5811e */
+ {QMI_FIXED_INTF(0x413c, 0x81b6, 10)}, /* Dell Wireless 5811e */
++ {QMI_FIXED_INTF(0x413c, 0x81c2, 8)}, /* Dell Wireless 5811e */
+ {QMI_FIXED_INTF(0x413c, 0x81cc, 8)}, /* Dell Wireless 5816e */
+ {QMI_FIXED_INTF(0x413c, 0x81d7, 0)}, /* Dell Wireless 5821e */
+ {QMI_FIXED_INTF(0x413c, 0x81d7, 1)}, /* Dell Wireless 5821e preproduction config */
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 1316f5b0c0d7e..2263a66f6314e 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1596,6 +1596,7 @@ void usbnet_disconnect (struct usb_interface *intf)
+ struct usbnet *dev;
+ struct usb_device *xdev;
+ struct net_device *net;
++ struct urb *urb;
+
+ dev = usb_get_intfdata(intf);
+ usb_set_intfdata(intf, NULL);
+@@ -1612,7 +1613,11 @@ void usbnet_disconnect (struct usb_interface *intf)
+ net = dev->net;
+ unregister_netdev (net);
+
+- usb_scuttle_anchored_urbs(&dev->deferred);
++ while ((urb = usb_get_from_anchor(&dev->deferred))) {
++ dev_kfree_skb(urb->context);
++ kfree(urb->sg);
++ usb_free_urb(urb);
++ }
+
+ if (dev->driver_info->unbind)
+ dev->driver_info->unbind (dev, intf);
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index a0a805a5ab6b2..582c3b1904180 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1716,18 +1716,21 @@ static int nvme_pr_preempt(struct block_device *bdev, u64 old, u64 new,
+ enum pr_type type, bool abort)
+ {
+ u32 cdw10 = nvme_pr_type(type) << 8 | (abort ? 2 : 1);
++
+ return nvme_pr_command(bdev, cdw10, old, new, nvme_cmd_resv_acquire);
+ }
+
+ static int nvme_pr_clear(struct block_device *bdev, u64 key)
+ {
+- u32 cdw10 = 1 | (key ? 1 << 3 : 0);
+- return nvme_pr_command(bdev, cdw10, key, 0, nvme_cmd_resv_register);
++ u32 cdw10 = 1 | (key ? 0 : 1 << 3);
++
++ return nvme_pr_command(bdev, cdw10, key, 0, nvme_cmd_resv_release);
+ }
+
+ static int nvme_pr_release(struct block_device *bdev, u64 key, enum pr_type type)
+ {
+- u32 cdw10 = nvme_pr_type(type) << 8 | (key ? 1 << 3 : 0);
++ u32 cdw10 = nvme_pr_type(type) << 8 | (key ? 0 : 1 << 3);
++
+ return nvme_pr_command(bdev, cdw10, key, 0, nvme_cmd_resv_release);
+ }
+
+diff --git a/drivers/soc/sunxi/sunxi_sram.c b/drivers/soc/sunxi/sunxi_sram.c
+index b4b0f3480bd36..2c1672f9aac9b 100644
+--- a/drivers/soc/sunxi/sunxi_sram.c
++++ b/drivers/soc/sunxi/sunxi_sram.c
+@@ -78,8 +78,8 @@ static struct sunxi_sram_desc sun4i_a10_sram_d = {
+
+ static struct sunxi_sram_desc sun50i_a64_sram_c = {
+ .data = SUNXI_SRAM_DATA("C", 0x4, 24, 1,
+- SUNXI_SRAM_MAP(0, 1, "cpu"),
+- SUNXI_SRAM_MAP(1, 0, "de2")),
++ SUNXI_SRAM_MAP(1, 0, "cpu"),
++ SUNXI_SRAM_MAP(0, 1, "de2")),
+ };
+
+ static const struct of_device_id sunxi_sram_dt_ids[] = {
+@@ -264,6 +264,7 @@ int sunxi_sram_claim(struct device *dev)
+ writel(val | ((device << sram_data->offset) & mask),
+ base + sram_data->reg);
+
++ sram_desc->claimed = true;
+ spin_unlock(&sram_lock);
+
+ return 0;
+@@ -324,12 +325,12 @@ static struct regmap_config sunxi_sram_emac_clock_regmap = {
+ .writeable_reg = sunxi_sram_regmap_accessible_reg,
+ };
+
+-static int sunxi_sram_probe(struct platform_device *pdev)
++static int __init sunxi_sram_probe(struct platform_device *pdev)
+ {
+ struct resource *res;
+- struct dentry *d;
+ struct regmap *emac_clock;
+ const struct sunxi_sramc_variant *variant;
++ struct device *dev = &pdev->dev;
+
+ sram_dev = &pdev->dev;
+
+@@ -342,13 +343,6 @@ static int sunxi_sram_probe(struct platform_device *pdev)
+ if (IS_ERR(base))
+ return PTR_ERR(base);
+
+- of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev);
+-
+- d = debugfs_create_file("sram", S_IRUGO, NULL, NULL,
+- &sunxi_sram_fops);
+- if (!d)
+- return -ENOMEM;
+-
+ if (variant->has_emac_clock) {
+ emac_clock = devm_regmap_init_mmio(&pdev->dev, base,
+ &sunxi_sram_emac_clock_regmap);
+@@ -357,6 +351,10 @@ static int sunxi_sram_probe(struct platform_device *pdev)
+ return PTR_ERR(emac_clock);
+ }
+
++ of_platform_populate(dev->of_node, NULL, NULL, dev);
++
++ debugfs_create_file("sram", 0444, NULL, NULL, &sunxi_sram_fops);
++
+ return 0;
+ }
+
+@@ -398,9 +396,8 @@ static struct platform_driver sunxi_sram_driver = {
+ .name = "sunxi-sram",
+ .of_match_table = sunxi_sram_dt_match,
+ },
+- .probe = sunxi_sram_probe,
+ };
+-module_platform_driver(sunxi_sram_driver);
++builtin_platform_driver_probe(sunxi_sram_driver, sunxi_sram_probe);
+
+ MODULE_AUTHOR("Maxime Ripard <maxime.ripard@free-electrons.com>");
+ MODULE_DESCRIPTION("Allwinner sunXi SRAM Controller Driver");
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 0b37c8e550e7d..92e9bd006622d 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -52,6 +52,13 @@ UNUSUAL_DEV(0x059f, 0x1061, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME),
+
++/* Reported-by: Hongling Zeng <zenghongling@kylinos.cn> */
++UNUSUAL_DEV(0x090c, 0x2000, 0x0000, 0x9999,
++ "Hiksemi",
++ "External HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_IGNORE_UAS),
++
+ /*
+ * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI
+ * commands in UAS mode. Observed with the 1.28 firmware; are there others?
+@@ -76,6 +83,13 @@ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_REPORT_LUNS),
+
++/* Reported-by: Hongling Zeng <zenghongling@kylinos.cn> */
++UNUSUAL_DEV(0x0bda, 0x9210, 0x0000, 0x9999,
++ "Hiksemi",
++ "External HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_IGNORE_UAS),
++
+ /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+ UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
+ "Initio Corporation",
+@@ -118,6 +132,13 @@ UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
++/* Reported-by: Hongling Zeng <zenghongling@kylinos.cn> */
++UNUSUAL_DEV(0x17ef, 0x3899, 0x0000, 0x9999,
++ "Thinkplus",
++ "External HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_IGNORE_UAS),
++
+ /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+ UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
+ "VIA",
+diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
+index bb7159f697f2f..f47a3390118fe 100644
+--- a/fs/ntfs/super.c
++++ b/fs/ntfs/super.c
+@@ -2106,7 +2106,8 @@ get_ctx_vol_failed:
+ // TODO: Initialize security.
+ /* Get the extended system files' directory inode. */
+ vol->extend_ino = ntfs_iget(sb, FILE_Extend);
+- if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) {
++ if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) ||
++ !S_ISDIR(vol->extend_ino->i_mode)) {
+ if (!IS_ERR(vol->extend_ino))
+ iput(vol->extend_ino);
+ ntfs_error(sb, "Failed to load $Extend.");
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 76f8dedc0e02b..171573613c397 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -2359,13 +2359,14 @@ next:
+ migrate->dst[migrate->npages] = 0;
+ migrate->src[migrate->npages++] = mpfn;
+ }
+- arch_leave_lazy_mmu_mode();
+- pte_unmap_unlock(ptep - 1, ptl);
+
+ /* Only flush the TLB if we actually modified any entries */
+ if (unmapped)
+ flush_tlb_range(walk->vma, start, end);
+
++ arch_leave_lazy_mmu_mode();
++ pte_unmap_unlock(ptep - 1, ptl);
++
+ return 0;
+ }
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 9c35403d96461..1cffd4e1fd8fb 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -3779,6 +3779,30 @@ void fs_reclaim_release(gfp_t gfp_mask)
+ EXPORT_SYMBOL_GPL(fs_reclaim_release);
+ #endif
+
++/*
++ * Zonelists may change due to hotplug during allocation. Detect when zonelists
++ * have been rebuilt so allocation retries. Reader side does not lock and
++ * retries the allocation if zonelist changes. Writer side is protected by the
++ * embedded spin_lock.
++ */
++static DEFINE_SEQLOCK(zonelist_update_seq);
++
++static unsigned int zonelist_iter_begin(void)
++{
++ if (IS_ENABLED(CONFIG_MEMORY_HOTREMOVE))
++ return read_seqbegin(&zonelist_update_seq);
++
++ return 0;
++}
++
++static unsigned int check_retry_zonelist(unsigned int seq)
++{
++ if (IS_ENABLED(CONFIG_MEMORY_HOTREMOVE))
++ return read_seqretry(&zonelist_update_seq, seq);
++
++ return seq;
++}
++
+ /* Perform direct synchronous page reclaim */
+ static int
+ __perform_reclaim(gfp_t gfp_mask, unsigned int order,
+@@ -4084,6 +4108,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
+ int compaction_retries;
+ int no_progress_loops;
+ unsigned int cpuset_mems_cookie;
++ unsigned int zonelist_iter_cookie;
+ int reserve_flags;
+
+ /*
+@@ -4094,11 +4119,12 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
+ (__GFP_ATOMIC|__GFP_DIRECT_RECLAIM)))
+ gfp_mask &= ~__GFP_ATOMIC;
+
+-retry_cpuset:
++restart:
+ compaction_retries = 0;
+ no_progress_loops = 0;
+ compact_priority = DEF_COMPACT_PRIORITY;
+ cpuset_mems_cookie = read_mems_allowed_begin();
++ zonelist_iter_cookie = zonelist_iter_begin();
+
+ /*
+ * The fast path uses conservative alloc_flags to succeed only until
+@@ -4247,9 +4273,13 @@ retry:
+ goto retry;
+
+
+- /* Deal with possible cpuset update races before we start OOM killing */
+- if (check_retry_cpuset(cpuset_mems_cookie, ac))
+- goto retry_cpuset;
++ /*
++ * Deal with possible cpuset update races or zonelist updates to avoid
++ * a unnecessary OOM kill.
++ */
++ if (check_retry_cpuset(cpuset_mems_cookie, ac) ||
++ check_retry_zonelist(zonelist_iter_cookie))
++ goto restart;
+
+ /* Reclaim has failed us, start killing things */
+ page = __alloc_pages_may_oom(gfp_mask, order, ac, &did_some_progress);
+@@ -4269,9 +4299,13 @@ retry:
+ }
+
+ nopage:
+- /* Deal with possible cpuset update races before we fail */
+- if (check_retry_cpuset(cpuset_mems_cookie, ac))
+- goto retry_cpuset;
++ /*
++ * Deal with possible cpuset update races or zonelist updates to avoid
++ * a unnecessary OOM kill.
++ */
++ if (check_retry_cpuset(cpuset_mems_cookie, ac) ||
++ check_retry_zonelist(zonelist_iter_cookie))
++ goto restart;
+
+ /*
+ * Make sure that __GFP_NOFAIL request doesn't leak out and make sure
+@@ -4569,6 +4603,18 @@ refill:
+ /* reset page count bias and offset to start of new frag */
+ nc->pagecnt_bias = PAGE_FRAG_CACHE_MAX_SIZE + 1;
+ offset = size - fragsz;
++ if (unlikely(offset < 0)) {
++ /*
++ * The caller is trying to allocate a fragment
++ * with fragsz > PAGE_SIZE but the cache isn't big
++ * enough to satisfy the request, this may
++ * happen in low memory conditions.
++ * We don't release the cache page because
++ * it could make memory pressure worse
++ * so we simply return NULL here.
++ */
++ return NULL;
++ }
+ }
+
+ nc->pagecnt_bias--;
+@@ -5379,9 +5425,8 @@ static void __build_all_zonelists(void *data)
+ int nid;
+ int __maybe_unused cpu;
+ pg_data_t *self = data;
+- static DEFINE_SPINLOCK(lock);
+
+- spin_lock(&lock);
++ write_seqlock(&zonelist_update_seq);
+
+ #ifdef CONFIG_NUMA
+ memset(node_load, 0, sizeof(node_load));
+@@ -5414,7 +5459,7 @@ static void __build_all_zonelists(void *data)
+ #endif
+ }
+
+- spin_unlock(&lock);
++ write_sequnlock(&zonelist_update_seq);
+ }
+
+ static noinline void __init
+diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
+index d12b07eb3a585..e2916b115b930 100644
+--- a/security/integrity/ima/ima.h
++++ b/security/integrity/ima/ima.h
+@@ -298,6 +298,7 @@ static inline int ima_read_xattr(struct dentry *dentry,
+ #ifdef CONFIG_IMA_LSM_RULES
+
+ #define security_filter_rule_init security_audit_rule_init
++#define security_filter_rule_free security_audit_rule_free
+ #define security_filter_rule_match security_audit_rule_match
+
+ #else
+@@ -308,6 +309,10 @@ static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr,
+ return -EINVAL;
+ }
+
++static inline void security_filter_rule_free(void *lsmrule)
++{
++}
++
+ static inline int security_filter_rule_match(u32 secid, u32 field, u32 op,
+ void *lsmrule,
+ struct audit_context *actx)
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 2d5a3daa02f92..b2dadff3626b9 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -241,6 +241,21 @@ static int __init default_appraise_policy_setup(char *str)
+ }
+ __setup("ima_appraise_tcb", default_appraise_policy_setup);
+
++static void ima_free_rule(struct ima_rule_entry *entry)
++{
++ int i;
++
++ if (!entry)
++ return;
++
++ kfree(entry->fsname);
++ for (i = 0; i < MAX_LSM_RULES; i++) {
++ security_filter_rule_free(entry->lsm[i].rule);
++ kfree(entry->lsm[i].args_p);
++ }
++ kfree(entry);
++}
++
+ /*
+ * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
+ * to the old, stale LSM policy. Update the IMA LSM based rules to reflect
+@@ -647,6 +662,7 @@ static int ima_lsm_rule_init(struct ima_rule_entry *entry,
+ &entry->lsm[lsm_rule].rule);
+ if (!entry->lsm[lsm_rule].rule) {
+ kfree(entry->lsm[lsm_rule].args_p);
++ entry->lsm[lsm_rule].args_p = NULL;
+ return -EINVAL;
+ }
+
+@@ -1019,7 +1035,7 @@ ssize_t ima_parse_add_rule(char *rule)
+
+ result = ima_parse_rule(p, entry);
+ if (result) {
+- kfree(entry);
++ ima_free_rule(entry);
+ integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
+ NULL, op, "invalid-policy", result,
+ audit_info);
+@@ -1040,15 +1056,11 @@ ssize_t ima_parse_add_rule(char *rule)
+ void ima_delete_rules(void)
+ {
+ struct ima_rule_entry *entry, *tmp;
+- int i;
+
+ temp_ima_appraise = 0;
+ list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
+- for (i = 0; i < MAX_LSM_RULES; i++)
+- kfree(entry->lsm[i].args_p);
+-
+ list_del(&entry->list);
+- kfree(entry);
++ ima_free_rule(entry);
+ }
+ }
+
+diff --git a/tools/testing/selftests/net/reuseport_bpf.c b/tools/testing/selftests/net/reuseport_bpf.c
+index b5277106df1fd..b0cc082fbb84f 100644
+--- a/tools/testing/selftests/net/reuseport_bpf.c
++++ b/tools/testing/selftests/net/reuseport_bpf.c
+@@ -330,7 +330,7 @@ static void test_extra_filter(const struct test_params p)
+ if (bind(fd1, addr, sockaddr_size()))
+ error(1, errno, "failed to bind recv socket 1");
+
+- if (!bind(fd2, addr, sockaddr_size()) && errno != EADDRINUSE)
++ if (!bind(fd2, addr, sockaddr_size()) || errno != EADDRINUSE)
+ error(1, errno, "bind socket 2 should fail with EADDRINUSE");
+
+ free(addr);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-10-26 11:41 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-10-26 11:41 UTC (permalink / raw
To: gentoo-commits
commit: 8fd9bfa77cf165e59e2fb7988e828a1a019775be
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 26 11:41:34 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Oct 26 11:41:34 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=8fd9bfa7
Linux patch 4.19.262
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1261_linux-4.19.262.patch | 6006 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6010 insertions(+)
diff --git a/0000_README b/0000_README
index 05c6a58c..6baf37a1 100644
--- a/0000_README
+++ b/0000_README
@@ -1087,6 +1087,10 @@ Patch: 1260_linux-4.19.261.patch
From: https://www.kernel.org
Desc: Linux 4.19.261
+Patch: 1261_linux-4.19.262.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.262
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1261_linux-4.19.262.patch b/1261_linux-4.19.262.patch
new file mode 100644
index 00000000..648dfa4a
--- /dev/null
+++ b/1261_linux-4.19.262.patch
@@ -0,0 +1,6006 @@
+diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
+index d10bcca6c3fb8..b3adbb33a8686 100644
+--- a/Documentation/ABI/testing/sysfs-bus-iio
++++ b/Documentation/ABI/testing/sysfs-bus-iio
+@@ -135,7 +135,7 @@ Description:
+ Raw capacitance measurement from channel Y. Units after
+ application of scale and offset are nanofarads.
+
+-What: /sys/.../iio:deviceX/in_capacitanceY-in_capacitanceZ_raw
++What: /sys/.../iio:deviceX/in_capacitanceY-capacitanceZ_raw
+ KernelVersion: 3.2
+ Contact: linux-iio@vger.kernel.org
+ Description:
+diff --git a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
+index 8a9f3559335b5..7e14e26676ec9 100644
+--- a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
++++ b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
+@@ -34,8 +34,8 @@ Example:
+ Use specific request line passing from dma
+ For example, MMC request line is 5
+
+- sdhci: sdhci@98e00000 {
+- compatible = "moxa,moxart-sdhci";
++ mmc: mmc@98e00000 {
++ compatible = "moxa,moxart-mmc";
+ reg = <0x98e00000 0x5C>;
+ interrupts = <5 0>;
+ clocks = <&clk_apb>;
+diff --git a/Documentation/process/code-of-conduct-interpretation.rst b/Documentation/process/code-of-conduct-interpretation.rst
+index e899f14a4ba24..4f8a06b00f608 100644
+--- a/Documentation/process/code-of-conduct-interpretation.rst
++++ b/Documentation/process/code-of-conduct-interpretation.rst
+@@ -51,7 +51,7 @@ the Technical Advisory Board (TAB) or other maintainers if you're
+ uncertain how to handle situations that come up. It will not be
+ considered a violation report unless you want it to be. If you are
+ uncertain about approaching the TAB or any other maintainers, please
+-reach out to our conflict mediator, Mishi Choudhary <mishi@linux.com>.
++reach out to our conflict mediator, Joanna Lee <joanna.lee@gesmer.com>.
+
+ In the end, "be kind to each other" is really what the end goal is for
+ everybody. We know everyone is human and we all fail at times, but the
+diff --git a/Makefile b/Makefile
+index 165812d2f786b..08c9d316e5c21 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 261
++SUBLEVEL = 262
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index d89d013f586cb..41bde0e62e90b 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -68,7 +68,7 @@ config ARM
+ select HAVE_EFFICIENT_UNALIGNED_ACCESS if (CPU_V6 || CPU_V6K || CPU_V7) && MMU
+ select HAVE_EXIT_THREAD
+ select HAVE_FTRACE_MCOUNT_RECORD if (!XIP_KERNEL)
+- select HAVE_FUNCTION_GRAPH_TRACER if (!THUMB2_KERNEL)
++ select HAVE_FUNCTION_GRAPH_TRACER if (!THUMB2_KERNEL && !CC_IS_CLANG)
+ select HAVE_FUNCTION_TRACER if (!XIP_KERNEL)
+ select HAVE_FUTEX_CMPXCHG if FUTEX
+ select HAVE_GCC_PLUGINS
+@@ -1943,7 +1943,6 @@ config CMDLINE
+ choice
+ prompt "Kernel command line type" if CMDLINE != ""
+ default CMDLINE_FROM_BOOTLOADER
+- depends on ATAGS
+
+ config CMDLINE_FROM_BOOTLOADER
+ bool "Use bootloader kernel arguments if available"
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index 01c760929c9e4..b931fac129a1b 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -47,8 +47,8 @@ config DEBUG_WX
+
+ choice
+ prompt "Choose kernel unwinder"
+- default UNWINDER_ARM if AEABI && !FUNCTION_GRAPH_TRACER
+- default UNWINDER_FRAME_POINTER if !AEABI || FUNCTION_GRAPH_TRACER
++ default UNWINDER_ARM if AEABI
++ default UNWINDER_FRAME_POINTER if !AEABI
+ help
+ This determines which method will be used for unwinding kernel stack
+ traces for panics, oopses, bugs, warnings, perf, /proc/<pid>/stack,
+@@ -65,7 +65,7 @@ config UNWINDER_FRAME_POINTER
+
+ config UNWINDER_ARM
+ bool "ARM EABI stack unwinder"
+- depends on AEABI
++ depends on AEABI && !FUNCTION_GRAPH_TRACER
+ select ARM_UNWIND
+ help
+ This option enables stack unwinding support in the kernel
+diff --git a/arch/arm/boot/dts/armada-385-turris-omnia.dts b/arch/arm/boot/dts/armada-385-turris-omnia.dts
+index fde4c302f08ec..92e08486ec81f 100644
+--- a/arch/arm/boot/dts/armada-385-turris-omnia.dts
++++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts
+@@ -307,7 +307,7 @@
+ marvell,function = "spi0";
+ };
+
+- spi0cs1_pins: spi0cs1-pins {
++ spi0cs2_pins: spi0cs2-pins {
+ marvell,pins = "mpp26";
+ marvell,function = "spi0";
+ };
+@@ -342,7 +342,7 @@
+ };
+ };
+
+- /* MISO, MOSI, SCLK and CS1 are routed to pin header CN11 */
++ /* MISO, MOSI, SCLK and CS2 are routed to pin header CN11 */
+ };
+
+ &uart0 {
+diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi
+index 60fbad25b5f26..93c8918e599bd 100644
+--- a/arch/arm/boot/dts/exynos4412-midas.dtsi
++++ b/arch/arm/boot/dts/exynos4412-midas.dtsi
+@@ -525,7 +525,7 @@
+ clocks = <&camera 1>;
+ clock-names = "extclk";
+ samsung,camclk-out = <1>;
+- gpios = <&gpm1 6 GPIO_ACTIVE_HIGH>;
++ gpios = <&gpm1 6 GPIO_ACTIVE_LOW>;
+
+ port {
+ is_s5k6a3_ep: endpoint {
+diff --git a/arch/arm/boot/dts/exynos4412-origen.dts b/arch/arm/boot/dts/exynos4412-origen.dts
+index 346f719324571..e5bfa76185a22 100644
+--- a/arch/arm/boot/dts/exynos4412-origen.dts
++++ b/arch/arm/boot/dts/exynos4412-origen.dts
+@@ -87,7 +87,7 @@
+ };
+
+ &ehci {
+- samsung,vbus-gpio = <&gpx3 5 1>;
++ samsung,vbus-gpio = <&gpx3 5 GPIO_ACTIVE_HIGH>;
+ status = "okay";
+
+ port@1 {
+diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi
+index f0607eb41df42..079f77c7e0f09 100644
+--- a/arch/arm/boot/dts/imx6dl.dtsi
++++ b/arch/arm/boot/dts/imx6dl.dtsi
+@@ -81,6 +81,9 @@
+ ocram: sram@900000 {
+ compatible = "mmio-sram";
+ reg = <0x00900000 0x20000>;
++ ranges = <0 0x00900000 0x20000>;
++ #address-cells = <1>;
++ #size-cells = <1>;
+ clocks = <&clks IMX6QDL_CLK_OCRAM>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6q.dtsi b/arch/arm/boot/dts/imx6q.dtsi
+index 0193ee6fe964a..a28dce3c64572 100644
+--- a/arch/arm/boot/dts/imx6q.dtsi
++++ b/arch/arm/boot/dts/imx6q.dtsi
+@@ -158,6 +158,9 @@
+ ocram: sram@900000 {
+ compatible = "mmio-sram";
+ reg = <0x00900000 0x40000>;
++ ranges = <0 0x00900000 0x40000>;
++ #address-cells = <1>;
++ #size-cells = <1>;
+ clocks = <&clks IMX6QDL_CLK_OCRAM>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6qp.dtsi b/arch/arm/boot/dts/imx6qp.dtsi
+index d91f92f944c53..3633383db7060 100644
+--- a/arch/arm/boot/dts/imx6qp.dtsi
++++ b/arch/arm/boot/dts/imx6qp.dtsi
+@@ -9,12 +9,18 @@
+ ocram2: sram@940000 {
+ compatible = "mmio-sram";
+ reg = <0x00940000 0x20000>;
++ ranges = <0 0x00940000 0x20000>;
++ #address-cells = <1>;
++ #size-cells = <1>;
+ clocks = <&clks IMX6QDL_CLK_OCRAM>;
+ };
+
+ ocram3: sram@960000 {
+ compatible = "mmio-sram";
+ reg = <0x00960000 0x20000>;
++ ranges = <0 0x00960000 0x20000>;
++ #address-cells = <1>;
++ #size-cells = <1>;
+ clocks = <&clks IMX6QDL_CLK_OCRAM>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
+index 9d19183f40e15..afde0ed6d71af 100644
+--- a/arch/arm/boot/dts/imx6sl.dtsi
++++ b/arch/arm/boot/dts/imx6sl.dtsi
+@@ -118,6 +118,9 @@
+ ocram: sram@900000 {
+ compatible = "mmio-sram";
+ reg = <0x00900000 0x20000>;
++ ranges = <0 0x00900000 0x20000>;
++ #address-cells = <1>;
++ #size-cells = <1>;
+ clocks = <&clks IMX6SL_CLK_OCRAM>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi
+index 7c7d5c47578e2..d7d092a5522a3 100644
+--- a/arch/arm/boot/dts/imx6sll.dtsi
++++ b/arch/arm/boot/dts/imx6sll.dtsi
+@@ -131,6 +131,9 @@
+ ocram: sram@900000 {
+ compatible = "mmio-sram";
+ reg = <0x00900000 0x20000>;
++ ranges = <0 0x00900000 0x20000>;
++ #address-cells = <1>;
++ #size-cells = <1>;
+ };
+
+ L2: l2-cache@a02000 {
+diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
+index ae0728df542e9..b9ab1118be30b 100644
+--- a/arch/arm/boot/dts/imx6sx.dtsi
++++ b/arch/arm/boot/dts/imx6sx.dtsi
+@@ -167,12 +167,18 @@
+ ocram_s: sram@8f8000 {
+ compatible = "mmio-sram";
+ reg = <0x008f8000 0x4000>;
++ ranges = <0 0x008f8000 0x4000>;
++ #address-cells = <1>;
++ #size-cells = <1>;
+ clocks = <&clks IMX6SX_CLK_OCRAM_S>;
+ };
+
+ ocram: sram@900000 {
+ compatible = "mmio-sram";
+ reg = <0x00900000 0x20000>;
++ ranges = <0 0x00900000 0x20000>;
++ #address-cells = <1>;
++ #size-cells = <1>;
+ clocks = <&clks IMX6SX_CLK_OCRAM>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
+index 317f1bcc56e2a..bd2c3c8f4ebb3 100644
+--- a/arch/arm/boot/dts/imx7d-sdb.dts
++++ b/arch/arm/boot/dts/imx7d-sdb.dts
+@@ -163,12 +163,7 @@
+ interrupt-parent = <&gpio2>;
+ interrupts = <29 0>;
+ pendown-gpio = <&gpio2 29 GPIO_ACTIVE_HIGH>;
+- ti,x-min = /bits/ 16 <0>;
+- ti,x-max = /bits/ 16 <0>;
+- ti,y-min = /bits/ 16 <0>;
+- ti,y-max = /bits/ 16 <0>;
+- ti,pressure-max = /bits/ 16 <0>;
+- ti,x-plate-ohms = /bits/ 16 <400>;
++ touchscreen-max-pressure = <255>;
+ wakeup-source;
+ };
+ };
+diff --git a/arch/arm/boot/dts/kirkwood-lsxl.dtsi b/arch/arm/boot/dts/kirkwood-lsxl.dtsi
+index 7b151acb99846..88b70ba1c8fee 100644
+--- a/arch/arm/boot/dts/kirkwood-lsxl.dtsi
++++ b/arch/arm/boot/dts/kirkwood-lsxl.dtsi
+@@ -10,6 +10,11 @@
+
+ ocp@f1000000 {
+ pinctrl: pin-controller@10000 {
++ /* Non-default UART pins */
++ pmx_uart0: pmx-uart0 {
++ marvell,pins = "mpp4", "mpp5";
++ };
++
+ pmx_power_hdd: pmx-power-hdd {
+ marvell,pins = "mpp10";
+ marvell,function = "gpo";
+@@ -213,22 +218,11 @@
+ &mdio {
+ status = "okay";
+
+- ethphy0: ethernet-phy@0 {
+- reg = <0>;
+- };
+-
+ ethphy1: ethernet-phy@8 {
+ reg = <8>;
+ };
+ };
+
+-ð0 {
+- status = "okay";
+- ethernet0-port@0 {
+- phy-handle = <ðphy0>;
+- };
+-};
+-
+ ð1 {
+ status = "okay";
+ ethernet1-port@0 {
+diff --git a/arch/arm/boot/dts/moxart-uc7112lx.dts b/arch/arm/boot/dts/moxart-uc7112lx.dts
+index 4a962a26482df..59d8775a3a939 100644
+--- a/arch/arm/boot/dts/moxart-uc7112lx.dts
++++ b/arch/arm/boot/dts/moxart-uc7112lx.dts
+@@ -80,7 +80,7 @@
+ clocks = <&ref12>;
+ };
+
+-&sdhci {
++&mmc {
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/moxart.dtsi b/arch/arm/boot/dts/moxart.dtsi
+index da7b3237bfe98..804a2bc6ec822 100644
+--- a/arch/arm/boot/dts/moxart.dtsi
++++ b/arch/arm/boot/dts/moxart.dtsi
+@@ -93,8 +93,8 @@
+ clock-names = "PCLK";
+ };
+
+- sdhci: sdhci@98e00000 {
+- compatible = "moxa,moxart-sdhci";
++ mmc: mmc@98e00000 {
++ compatible = "moxa,moxart-mmc";
+ reg = <0x98e00000 0x5C>;
+ interrupts = <5 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_apb>;
+diff --git a/arch/mips/bcm47xx/prom.c b/arch/mips/bcm47xx/prom.c
+index 135a5407f0154..d26d9a6f6ee76 100644
+--- a/arch/mips/bcm47xx/prom.c
++++ b/arch/mips/bcm47xx/prom.c
+@@ -85,7 +85,7 @@ static __init void prom_init_mem(void)
+ pr_debug("Assume 128MB RAM\n");
+ break;
+ }
+- if (!memcmp(prom_init, prom_init + mem, 32))
++ if (!memcmp((void *)prom_init, (void *)prom_init + mem, 32))
+ break;
+ }
+ lowmem = mem;
+@@ -162,7 +162,7 @@ void __init bcm47xx_prom_highmem_init(void)
+
+ off = EXTVBASE + __pa(off);
+ for (extmem = 128 << 20; extmem < 512 << 20; extmem <<= 1) {
+- if (!memcmp(prom_init, (void *)(off + extmem), 16))
++ if (!memcmp((void *)prom_init, (void *)(off + extmem), 16))
+ break;
+ }
+ extmem -= lowmem;
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 26654d0c2af7e..5987ae0d8fbbb 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -165,7 +165,7 @@ CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=power8
+ CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power9,-mtune=power8)
+ else
+ CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,$(call cc-option,-mtune=power5))
+-CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mcpu=power5,-mcpu=power4)
++CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=power4
+ endif
+ else ifdef CONFIG_PPC_BOOK3E_64
+ CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64
+diff --git a/arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi b/arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi
+new file mode 100644
+index 0000000000000..7e2a90cde72e5
+--- /dev/null
++++ b/arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi
+@@ -0,0 +1,51 @@
++/*
++ * e500v1 Power ISA Device Tree Source (include)
++ *
++ * Copyright 2012 Freescale Semiconductor Inc.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions are met:
++ * * Redistributions of source code must retain the above copyright
++ * notice, this list of conditions and the following disclaimer.
++ * * Redistributions in binary form must reproduce the above copyright
++ * notice, this list of conditions and the following disclaimer in the
++ * documentation and/or other materials provided with the distribution.
++ * * Neither the name of Freescale Semiconductor nor the
++ * names of its contributors may be used to endorse or promote products
++ * derived from this software without specific prior written permission.
++ *
++ *
++ * ALTERNATIVELY, this software may be distributed under the terms of the
++ * GNU General Public License ("GPL") as published by the Free Software
++ * Foundation, either version 2 of that License or (at your option) any
++ * later version.
++ *
++ * THIS SOFTWARE IS PROVIDED BY Freescale Semiconductor "AS IS" AND ANY
++ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
++ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
++ * DISCLAIMED. IN NO EVENT SHALL Freescale Semiconductor BE LIABLE FOR ANY
++ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
++ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
++ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++ */
++
++/ {
++ cpus {
++ power-isa-version = "2.03";
++ power-isa-b; // Base
++ power-isa-e; // Embedded
++ power-isa-atb; // Alternate Time Base
++ power-isa-cs; // Cache Specification
++ power-isa-e.le; // Embedded.Little-Endian
++ power-isa-e.pm; // Embedded.Performance Monitor
++ power-isa-ecl; // Embedded Cache Locking
++ power-isa-mmc; // Memory Coherence
++ power-isa-sp; // Signal Processing Engine
++ power-isa-sp.fs; // SPE.Embedded Float Scalar Single
++ power-isa-sp.fv; // SPE.Embedded Float Vector
++ mmu-type = "power-embedded";
++ };
++};
+diff --git a/arch/powerpc/boot/dts/fsl/mpc8540ads.dts b/arch/powerpc/boot/dts/fsl/mpc8540ads.dts
+index e6d0b166d68dc..b4314aa6769cd 100644
+--- a/arch/powerpc/boot/dts/fsl/mpc8540ads.dts
++++ b/arch/powerpc/boot/dts/fsl/mpc8540ads.dts
+@@ -11,7 +11,7 @@
+
+ /dts-v1/;
+
+-/include/ "e500v2_power_isa.dtsi"
++/include/ "e500v1_power_isa.dtsi"
+
+ / {
+ model = "MPC8540ADS";
+diff --git a/arch/powerpc/boot/dts/fsl/mpc8541cds.dts b/arch/powerpc/boot/dts/fsl/mpc8541cds.dts
+index 9fa2c734a988b..48492c621edfc 100644
+--- a/arch/powerpc/boot/dts/fsl/mpc8541cds.dts
++++ b/arch/powerpc/boot/dts/fsl/mpc8541cds.dts
+@@ -11,7 +11,7 @@
+
+ /dts-v1/;
+
+-/include/ "e500v2_power_isa.dtsi"
++/include/ "e500v1_power_isa.dtsi"
+
+ / {
+ model = "MPC8541CDS";
+diff --git a/arch/powerpc/boot/dts/fsl/mpc8555cds.dts b/arch/powerpc/boot/dts/fsl/mpc8555cds.dts
+index 272f08caea929..325c817dedeba 100644
+--- a/arch/powerpc/boot/dts/fsl/mpc8555cds.dts
++++ b/arch/powerpc/boot/dts/fsl/mpc8555cds.dts
+@@ -11,7 +11,7 @@
+
+ /dts-v1/;
+
+-/include/ "e500v2_power_isa.dtsi"
++/include/ "e500v1_power_isa.dtsi"
+
+ / {
+ model = "MPC8555CDS";
+diff --git a/arch/powerpc/boot/dts/fsl/mpc8560ads.dts b/arch/powerpc/boot/dts/fsl/mpc8560ads.dts
+index 7a822b08aa35d..b5fb5ae3ed682 100644
+--- a/arch/powerpc/boot/dts/fsl/mpc8560ads.dts
++++ b/arch/powerpc/boot/dts/fsl/mpc8560ads.dts
+@@ -11,7 +11,7 @@
+
+ /dts-v1/;
+
+-/include/ "e500v2_power_isa.dtsi"
++/include/ "e500v1_power_isa.dtsi"
+
+ / {
+ model = "MPC8560ADS";
+diff --git a/arch/powerpc/kernel/pci_dn.c b/arch/powerpc/kernel/pci_dn.c
+index 7cecc3bd953b7..bd68c3259fadd 100644
+--- a/arch/powerpc/kernel/pci_dn.c
++++ b/arch/powerpc/kernel/pci_dn.c
+@@ -338,6 +338,7 @@ struct pci_dn *pci_add_device_node_info(struct pci_controller *hose,
+ INIT_LIST_HEAD(&pdn->list);
+ parent = of_get_parent(dn);
+ pdn->parent = parent ? PCI_DN(parent) : NULL;
++ of_node_put(parent);
+ if (pdn->parent)
+ list_add_tail(&pdn->list, &pdn->parent->child_list);
+
+diff --git a/arch/powerpc/math-emu/math_efp.c b/arch/powerpc/math-emu/math_efp.c
+index 581f404caa1d6..b9848179dbaa6 100644
+--- a/arch/powerpc/math-emu/math_efp.c
++++ b/arch/powerpc/math-emu/math_efp.c
+@@ -21,6 +21,7 @@
+
+ #include <linux/types.h>
+ #include <linux/prctl.h>
++#include <linux/module.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/reg.h>
+diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
+index edf9032e2e5cc..96a3d23132ba5 100644
+--- a/arch/powerpc/platforms/powernv/opal.c
++++ b/arch/powerpc/platforms/powernv/opal.c
+@@ -740,6 +740,7 @@ static void opal_export_attrs(void)
+ kobj = kobject_create_and_add("exports", opal_kobj);
+ if (!kobj) {
+ pr_warn("kobject_create_and_add() of exports failed\n");
++ of_node_put(np);
+ return;
+ }
+
+diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c
+index df95102e732cb..44aedb6b9f556 100644
+--- a/arch/powerpc/sysdev/fsl_msi.c
++++ b/arch/powerpc/sysdev/fsl_msi.c
+@@ -216,8 +216,10 @@ static int fsl_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
+ dev_err(&pdev->dev,
+ "node %pOF has an invalid fsl,msi phandle %u\n",
+ hose->dn, np->phandle);
++ of_node_put(np);
+ return -EINVAL;
+ }
++ of_node_put(np);
+ }
+
+ for_each_pci_msi_entry(entry, pdev) {
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index b6c972941881b..e6d09ad417e5b 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -49,9 +49,16 @@ ifeq ($(CONFIG_RISCV_ISA_C),y)
+ KBUILD_ARCH_C = c
+ endif
+
+-KBUILD_AFLAGS += -march=$(KBUILD_MARCH)$(KBUILD_ARCH_A)fd$(KBUILD_ARCH_C)
++# Newer binutils versions default to ISA spec version 20191213 which moves some
++# instructions from the I extension to the Zicsr and Zifencei extensions.
++toolchain-need-zicsr-zifencei := $(call cc-option-yn, -march=$(riscv-march-y)_zicsr_zifencei)
++ifeq ($(toolchain-need-zicsr-zifencei),y)
++ KBUILD_ARCH_ZISCR_ZIFENCEI = _zicsr_zifencei
++endif
++
++KBUILD_AFLAGS += -march=$(KBUILD_MARCH)$(KBUILD_ARCH_A)fd$(KBUILD_ARCH_C)$(KBUILD_ARCH_ZISCR_ZIFENCEI)
+
+-KBUILD_CFLAGS += -march=$(KBUILD_MARCH)$(KBUILD_ARCH_A)$(KBUILD_ARCH_C)
++KBUILD_CFLAGS += -march=$(KBUILD_MARCH)$(KBUILD_ARCH_A)$(KBUILD_ARCH_C)$(KBUILD_ARCH_ZISCR_ZIFENCEI)
+ KBUILD_CFLAGS += -mno-save-restore
+ KBUILD_CFLAGS += -DCONFIG_PAGE_OFFSET=$(CONFIG_PAGE_OFFSET)
+
+diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
+index 516aaa19daf28..3a9d42e6616e3 100644
+--- a/arch/riscv/kernel/sys_riscv.c
++++ b/arch/riscv/kernel/sys_riscv.c
+@@ -26,9 +26,6 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
+ if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
+ return -EINVAL;
+
+- if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
+- return -EINVAL;
+-
+ return ksys_mmap_pgoff(addr, len, prot, flags, fd,
+ offset >> (PAGE_SHIFT - page_shift_offset));
+ }
+diff --git a/arch/sh/include/asm/sections.h b/arch/sh/include/asm/sections.h
+index 8edb824049b9e..0cb0ca149ac34 100644
+--- a/arch/sh/include/asm/sections.h
++++ b/arch/sh/include/asm/sections.h
+@@ -4,7 +4,7 @@
+
+ #include <asm-generic/sections.h>
+
+-extern long __machvec_start, __machvec_end;
++extern char __machvec_start[], __machvec_end[];
+ extern char __uncached_start, __uncached_end;
+ extern char __start_eh_frame[], __stop_eh_frame[];
+
+diff --git a/arch/sh/kernel/machvec.c b/arch/sh/kernel/machvec.c
+index ec05f491c3471..a9f797a76e7c1 100644
+--- a/arch/sh/kernel/machvec.c
++++ b/arch/sh/kernel/machvec.c
+@@ -22,8 +22,8 @@
+ #define MV_NAME_SIZE 32
+
+ #define for_each_mv(mv) \
+- for ((mv) = (struct sh_machine_vector *)&__machvec_start; \
+- (mv) && (unsigned long)(mv) < (unsigned long)&__machvec_end; \
++ for ((mv) = (struct sh_machine_vector *)__machvec_start; \
++ (mv) && (unsigned long)(mv) < (unsigned long)__machvec_end; \
+ (mv)++)
+
+ static struct sh_machine_vector * __init get_mv_byname(const char *name)
+@@ -89,8 +89,8 @@ void __init sh_mv_setup(void)
+ if (!machvec_selected) {
+ unsigned long machvec_size;
+
+- machvec_size = ((unsigned long)&__machvec_end -
+- (unsigned long)&__machvec_start);
++ machvec_size = ((unsigned long)__machvec_end -
++ (unsigned long)__machvec_start);
+
+ /*
+ * Sanity check for machvec section alignment. Ensure
+@@ -104,7 +104,7 @@ void __init sh_mv_setup(void)
+ * vector (usually the only one) from .machvec.init.
+ */
+ if (machvec_size >= sizeof(struct sh_machine_vector))
+- sh_mv = *(struct sh_machine_vector *)&__machvec_start;
++ sh_mv = *(struct sh_machine_vector *)__machvec_start;
+ }
+
+ printk(KERN_NOTICE "Booting machvec: %s\n", get_system_type());
+diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c
+index a818ccef30ca2..c23f8857a798b 100644
+--- a/arch/um/kernel/um_arch.c
++++ b/arch/um/kernel/um_arch.c
+@@ -77,7 +77,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)
+
+ static void *c_start(struct seq_file *m, loff_t *pos)
+ {
+- return *pos < NR_CPUS ? cpu_data + *pos : NULL;
++ return *pos < nr_cpu_ids ? cpu_data + *pos : NULL;
+ }
+
+ static void *c_next(struct seq_file *m, void *v, loff_t *pos)
+diff --git a/arch/x86/include/asm/hyperv-tlfs.h b/arch/x86/include/asm/hyperv-tlfs.h
+index 00e01d215f74c..e1bd23641fc6e 100644
+--- a/arch/x86/include/asm/hyperv-tlfs.h
++++ b/arch/x86/include/asm/hyperv-tlfs.h
+@@ -682,7 +682,7 @@ struct hv_enlightened_vmcs {
+ u64 guest_rip;
+
+ u32 hv_clean_fields;
+- u32 hv_padding_32;
++ u32 padding32_1;
+ u32 hv_synthetic_controls;
+ struct {
+ u32 nested_flush_hypercall:1;
+@@ -690,7 +690,7 @@ struct hv_enlightened_vmcs {
+ u32 reserved:30;
+ } hv_enlightenments_control;
+ u32 hv_vp_id;
+-
++ u32 padding32_2;
+ u64 hv_vm_id;
+ u64 partition_assist_page;
+ u64 padding64_4[4];
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 25bdd06969b34..b1490e08f8911 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -1975,7 +1975,7 @@ static int em_pop_sreg(struct x86_emulate_ctxt *ctxt)
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+
+- if (ctxt->modrm_reg == VCPU_SREG_SS)
++ if (seg == VCPU_SREG_SS)
+ ctxt->interruptibility = KVM_X86_SHADOW_INT_MOV_SS;
+ if (ctxt->op_bytes > 2)
+ rsp_increment(ctxt, ctxt->op_bytes - 2);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 20ce794584a32..c7e4dacca4cd0 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -13276,14 +13276,6 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
+ */
+ vmcs12_save_pending_event(vcpu, vmcs12);
+ }
+-
+- /*
+- * Drop what we picked up for L2 via vmx_complete_interrupts. It is
+- * preserved above and would only end up incorrectly in L1.
+- */
+- vcpu->arch.nmi_injected = false;
+- kvm_clear_exception_queue(vcpu);
+- kvm_clear_interrupt_queue(vcpu);
+ }
+
+ /*
+@@ -13617,6 +13609,17 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+ nested_vmx_abort(vcpu, VMX_ABORT_SAVE_GUEST_MSR_FAIL);
+ }
+
++ /*
++ * Drop events/exceptions that were queued for re-injection to L2
++ * (picked up via vmx_complete_interrupts()), as well as exceptions
++ * that were pending for L2. Note, this must NOT be hoisted above
++ * prepare_vmcs12(), events/exceptions queued for re-injection need to
++ * be captured in vmcs12 (see vmcs12_save_pending_event()).
++ */
++ vcpu->arch.nmi_injected = false;
++ kvm_clear_exception_queue(vcpu);
++ kvm_clear_interrupt_queue(vcpu);
++
+ vmx_switch_vmcs(vcpu, &vmx->vmcs01);
+ vm_entry_controls_reset_shadow(vmx);
+ vm_exit_controls_reset_shadow(vmx);
+diff --git a/arch/x86/um/shared/sysdep/syscalls_32.h b/arch/x86/um/shared/sysdep/syscalls_32.h
+index 68fd2cf526fd7..f6e9f84397e79 100644
+--- a/arch/x86/um/shared/sysdep/syscalls_32.h
++++ b/arch/x86/um/shared/sysdep/syscalls_32.h
+@@ -6,10 +6,9 @@
+ #include <asm/unistd.h>
+ #include <sysdep/ptrace.h>
+
+-typedef long syscall_handler_t(struct pt_regs);
++typedef long syscall_handler_t(struct syscall_args);
+
+ extern syscall_handler_t *sys_call_table[];
+
+ #define EXECUTE_SYSCALL(syscall, regs) \
+- ((long (*)(struct syscall_args)) \
+- (*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs))
++ ((*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs))
+diff --git a/arch/x86/um/tls_32.c b/arch/x86/um/tls_32.c
+index 5bd949da7a4a5..b69ab24094306 100644
+--- a/arch/x86/um/tls_32.c
++++ b/arch/x86/um/tls_32.c
+@@ -65,9 +65,6 @@ static int get_free_idx(struct task_struct* task)
+ struct thread_struct *t = &task->thread;
+ int idx;
+
+- if (!t->arch.tls_array)
+- return GDT_ENTRY_TLS_MIN;
+-
+ for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++)
+ if (!t->arch.tls_array[idx].present)
+ return idx + GDT_ENTRY_TLS_MIN;
+@@ -242,9 +239,6 @@ static int get_tls_entry(struct task_struct *task, struct user_desc *info,
+ {
+ struct thread_struct *t = &task->thread;
+
+- if (!t->arch.tls_array)
+- goto clear;
+-
+ if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
+ return -EINVAL;
+
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index ac54fc03cf819..eb7fca6f94442 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -511,6 +511,22 @@ static const struct dmi_system_id video_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE R830"),
+ },
+ },
++ {
++ .callback = video_disable_backlight_sysfs_if,
++ .ident = "Toshiba Satellite Z830",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE Z830"),
++ },
++ },
++ {
++ .callback = video_disable_backlight_sysfs_if,
++ .ident = "Toshiba Portege Z830",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE Z830"),
++ },
++ },
+ /*
+ * Some machine's _DOD IDs don't have bit 31(Device ID Scheme) set
+ * but the IDs actually follow the Device ID Scheme.
+diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
+index 6a55aac0c60fc..63086f90bbf8a 100644
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -421,14 +421,24 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev,
+ }
+ }
+
+- hpriv->nports = child_nodes = of_get_child_count(dev->of_node);
++ /*
++ * Too many sub-nodes most likely means having something wrong with
++ * the firmware.
++ */
++ child_nodes = of_get_child_count(dev->of_node);
++ if (child_nodes > AHCI_MAX_PORTS) {
++ rc = -EINVAL;
++ goto err_out;
++ }
+
+ /*
+ * If no sub-node was found, we still need to set nports to
+ * one in order to be able to use the
+ * ahci_platform_[en|dis]able_[phys|regulators] functions.
+ */
+- if (!child_nodes)
++ if (child_nodes)
++ hpriv->nports = child_nodes;
++ else
+ hpriv->nports = 1;
+
+ hpriv->phys = devm_kcalloc(dev, hpriv->nports, sizeof(*hpriv->phys), GFP_KERNEL);
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 2ef7eec6461c0..cc66983e8b6ab 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1271,10 +1271,12 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b
+ mutex_unlock(&nbd->config_lock);
+ ret = wait_event_interruptible(config->recv_wq,
+ atomic_read(&config->recv_threads) == 0);
+- if (ret)
++ if (ret) {
+ sock_shutdown(nbd);
+- flush_workqueue(nbd->recv_workq);
++ nbd_clear_que(nbd);
++ }
+
++ flush_workqueue(nbd->recv_workq);
+ mutex_lock(&nbd->config_lock);
+ nbd_bdev_reset(bdev);
+ /* user requested, ignore socket errors */
+diff --git a/drivers/char/mem.c b/drivers/char/mem.c
+index 54b86490d9cab..9f1caa7eb8d13 100644
+--- a/drivers/char/mem.c
++++ b/drivers/char/mem.c
+@@ -893,8 +893,8 @@ static const struct memdev {
+ #endif
+ [5] = { "zero", 0666, &zero_fops, 0 },
+ [7] = { "full", 0666, &full_fops, 0 },
+- [8] = { "random", 0666, &random_fops, 0 },
+- [9] = { "urandom", 0666, &urandom_fops, 0 },
++ [8] = { "random", 0666, &random_fops, FMODE_NOWAIT },
++ [9] = { "urandom", 0666, &urandom_fops, FMODE_NOWAIT },
+ #ifdef CONFIG_PRINTK
+ [11] = { "kmsg", 0644, &kmsg_fops, 0 },
+ #endif
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 2be38780a7f71..6aea12fa48ba7 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -890,20 +890,23 @@ void __init add_bootloader_randomness(const void *buf, size_t len)
+ }
+
+ struct fast_pool {
+- struct work_struct mix;
+ unsigned long pool[4];
+ unsigned long last;
+ unsigned int count;
++ struct timer_list mix;
+ };
+
++static void mix_interrupt_randomness(struct timer_list *work);
++
+ static DEFINE_PER_CPU(struct fast_pool, irq_randomness) = {
+ #ifdef CONFIG_64BIT
+ #define FASTMIX_PERM SIPHASH_PERMUTATION
+- .pool = { SIPHASH_CONST_0, SIPHASH_CONST_1, SIPHASH_CONST_2, SIPHASH_CONST_3 }
++ .pool = { SIPHASH_CONST_0, SIPHASH_CONST_1, SIPHASH_CONST_2, SIPHASH_CONST_3 },
+ #else
+ #define FASTMIX_PERM HSIPHASH_PERMUTATION
+- .pool = { HSIPHASH_CONST_0, HSIPHASH_CONST_1, HSIPHASH_CONST_2, HSIPHASH_CONST_3 }
++ .pool = { HSIPHASH_CONST_0, HSIPHASH_CONST_1, HSIPHASH_CONST_2, HSIPHASH_CONST_3 },
+ #endif
++ .mix = __TIMER_INITIALIZER(mix_interrupt_randomness, 0)
+ };
+
+ /*
+@@ -945,7 +948,7 @@ int __cold random_online_cpu(unsigned int cpu)
+ }
+ #endif
+
+-static void mix_interrupt_randomness(struct work_struct *work)
++static void mix_interrupt_randomness(struct timer_list *work)
+ {
+ struct fast_pool *fast_pool = container_of(work, struct fast_pool, mix);
+ /*
+@@ -976,7 +979,7 @@ static void mix_interrupt_randomness(struct work_struct *work)
+ local_irq_enable();
+
+ mix_pool_bytes(pool, sizeof(pool));
+- credit_init_bits(max(1u, (count & U16_MAX) / 64));
++ credit_init_bits(clamp_t(unsigned int, (count & U16_MAX) / 64, 1, sizeof(pool) * 8));
+
+ memzero_explicit(pool, sizeof(pool));
+ }
+@@ -999,10 +1002,11 @@ void add_interrupt_randomness(int irq)
+ if (new_count < 1024 && !time_is_before_jiffies(fast_pool->last + HZ))
+ return;
+
+- if (unlikely(!fast_pool->mix.func))
+- INIT_WORK(&fast_pool->mix, mix_interrupt_randomness);
+ fast_pool->count |= MIX_INFLIGHT;
+- queue_work_on(raw_smp_processor_id(), system_highpri_wq, &fast_pool->mix);
++ if (!timer_pending(&fast_pool->mix)) {
++ fast_pool->mix.expires = jiffies;
++ add_timer_on(&fast_pool->mix, raw_smp_processor_id());
++ }
+ }
+ EXPORT_SYMBOL_GPL(add_interrupt_randomness);
+
+@@ -1294,6 +1298,11 @@ static ssize_t random_read_iter(struct kiocb *kiocb, struct iov_iter *iter)
+ {
+ int ret;
+
++ if (!crng_ready() &&
++ ((kiocb->ki_flags & IOCB_NOWAIT) ||
++ (kiocb->ki_filp->f_flags & O_NONBLOCK)))
++ return -EAGAIN;
++
+ ret = wait_for_random_bytes();
+ if (ret != 0)
+ return ret;
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index fd78dd5356ed7..180abc00160dd 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -950,9 +950,9 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw,
+ return div;
+ }
+
+-static long bcm2835_clock_rate_from_divisor(struct bcm2835_clock *clock,
+- unsigned long parent_rate,
+- u32 div)
++static unsigned long bcm2835_clock_rate_from_divisor(struct bcm2835_clock *clock,
++ unsigned long parent_rate,
++ u32 div)
+ {
+ const struct bcm2835_clock_data *data = clock->data;
+ u64 temp;
+@@ -1737,7 +1737,7 @@ static const struct bcm2835_clk_desc clk_desc_array[] = {
+ .load_mask = CM_PLLC_LOADPER,
+ .hold_mask = CM_PLLC_HOLDPER,
+ .fixed_divider = 1,
+- .flags = CLK_SET_RATE_PARENT),
++ .flags = CLK_IS_CRITICAL | CLK_SET_RATE_PARENT),
+
+ /*
+ * PLLD is the display PLL, used to drive DSI display panels.
+diff --git a/drivers/clk/berlin/bg2.c b/drivers/clk/berlin/bg2.c
+index 0b4b44a2579e1..6efc3e02da473 100644
+--- a/drivers/clk/berlin/bg2.c
++++ b/drivers/clk/berlin/bg2.c
+@@ -499,12 +499,15 @@ static void __init berlin2_clock_setup(struct device_node *np)
+ int n, ret;
+
+ clk_data = kzalloc(struct_size(clk_data, hws, MAX_CLKS), GFP_KERNEL);
+- if (!clk_data)
++ if (!clk_data) {
++ of_node_put(parent_np);
+ return;
++ }
+ clk_data->num = MAX_CLKS;
+ hws = clk_data->hws;
+
+ gbase = of_iomap(parent_np, 0);
++ of_node_put(parent_np);
+ if (!gbase)
+ return;
+
+diff --git a/drivers/clk/berlin/bg2q.c b/drivers/clk/berlin/bg2q.c
+index 9b9db743df255..5bcd8406ac93a 100644
+--- a/drivers/clk/berlin/bg2q.c
++++ b/drivers/clk/berlin/bg2q.c
+@@ -285,19 +285,23 @@ static void __init berlin2q_clock_setup(struct device_node *np)
+ int n, ret;
+
+ clk_data = kzalloc(struct_size(clk_data, hws, MAX_CLKS), GFP_KERNEL);
+- if (!clk_data)
++ if (!clk_data) {
++ of_node_put(parent_np);
+ return;
++ }
+ clk_data->num = MAX_CLKS;
+ hws = clk_data->hws;
+
+ gbase = of_iomap(parent_np, 0);
+ if (!gbase) {
++ of_node_put(parent_np);
+ pr_err("%pOF: Unable to map global base\n", np);
+ return;
+ }
+
+ /* BG2Q CPU PLL is not part of global registers */
+ cpupll_base = of_iomap(parent_np, 1);
++ of_node_put(parent_np);
+ if (!cpupll_base) {
+ pr_err("%pOF: Unable to map cpupll base\n", np);
+ iounmap(gbase);
+diff --git a/drivers/clk/clk-oxnas.c b/drivers/clk/clk-oxnas.c
+index e51e0023fc6ec..a92bf71f03ac8 100644
+--- a/drivers/clk/clk-oxnas.c
++++ b/drivers/clk/clk-oxnas.c
+@@ -218,7 +218,7 @@ static const struct of_device_id oxnas_stdclk_dt_ids[] = {
+
+ static int oxnas_stdclk_probe(struct platform_device *pdev)
+ {
+- struct device_node *np = pdev->dev.of_node;
++ struct device_node *np = pdev->dev.of_node, *parent_np;
+ const struct oxnas_stdclk_data *data;
+ const struct of_device_id *id;
+ struct regmap *regmap;
+@@ -230,7 +230,9 @@ static int oxnas_stdclk_probe(struct platform_device *pdev)
+ return -ENODEV;
+ data = id->data;
+
+- regmap = syscon_node_to_regmap(of_get_parent(np));
++ parent_np = of_get_parent(np);
++ regmap = syscon_node_to_regmap(parent_np);
++ of_node_put(parent_np);
+ if (IS_ERR(regmap)) {
+ dev_err(&pdev->dev, "failed to have parent regmap\n");
+ return PTR_ERR(regmap);
+diff --git a/drivers/clk/tegra/clk-tegra114.c b/drivers/clk/tegra/clk-tegra114.c
+index 625d110913308..1e5025c127bd7 100644
+--- a/drivers/clk/tegra/clk-tegra114.c
++++ b/drivers/clk/tegra/clk-tegra114.c
+@@ -1348,6 +1348,7 @@ static void __init tegra114_clock_init(struct device_node *np)
+ }
+
+ pmc_base = of_iomap(node, 0);
++ of_node_put(node);
+ if (!pmc_base) {
+ pr_err("Can't map pmc registers\n");
+ WARN_ON(1);
+diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c
+index 68551effb5ca2..5859b8ee14781 100644
+--- a/drivers/clk/tegra/clk-tegra20.c
++++ b/drivers/clk/tegra/clk-tegra20.c
+@@ -1152,6 +1152,7 @@ static void __init tegra20_clock_init(struct device_node *np)
+ }
+
+ pmc_base = of_iomap(node, 0);
++ of_node_put(node);
+ if (!pmc_base) {
+ pr_err("Can't map pmc registers\n");
+ BUG();
+diff --git a/drivers/clk/tegra/clk-tegra210.c b/drivers/clk/tegra/clk-tegra210.c
+index 7264e97310348..f97c4b0a91641 100644
+--- a/drivers/clk/tegra/clk-tegra210.c
++++ b/drivers/clk/tegra/clk-tegra210.c
+@@ -3529,6 +3529,7 @@ static void __init tegra210_clock_init(struct device_node *np)
+ }
+
+ pmc_base = of_iomap(node, 0);
++ of_node_put(node);
+ if (!pmc_base) {
+ pr_err("Can't map pmc registers\n");
+ WARN_ON(1);
+diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
+index beb672a215b6c..a4b6f3ac2d34a 100644
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -252,14 +252,16 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)
+ if (rc) {
+ pr_err("%s: failed to lookup atl clock %d\n", __func__,
+ i);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto pm_put;
+ }
+
+ clk = of_clk_get_from_provider(&clkspec);
+ if (IS_ERR(clk)) {
+ pr_err("%s: failed to get atl clock %d from provider\n",
+ __func__, i);
+- return PTR_ERR(clk);
++ ret = PTR_ERR(clk);
++ goto pm_put;
+ }
+
+ cdesc = to_atl_desc(__clk_get_hw(clk));
+@@ -292,8 +294,9 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)
+ if (cdesc->enabled)
+ atl_clk_enable(__clk_get_hw(clk));
+ }
+- pm_runtime_put_sync(cinfo->dev);
+
++pm_put:
++ pm_runtime_put_sync(cinfo->dev);
+ return ret;
+ }
+
+diff --git a/drivers/crypto/cavium/cpt/cptpf_main.c b/drivers/crypto/cavium/cpt/cptpf_main.c
+index 06ad85ab5e865..7416f30ee976d 100644
+--- a/drivers/crypto/cavium/cpt/cptpf_main.c
++++ b/drivers/crypto/cavium/cpt/cptpf_main.c
+@@ -257,6 +257,7 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae)
+ const struct firmware *fw_entry;
+ struct device *dev = &cpt->pdev->dev;
+ struct ucode_header *ucode;
++ unsigned int code_length;
+ struct microcode *mcode;
+ int j, ret = 0;
+
+@@ -267,11 +268,12 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae)
+ ucode = (struct ucode_header *)fw_entry->data;
+ mcode = &cpt->mcode[cpt->next_mc_idx];
+ memcpy(mcode->version, (u8 *)fw_entry->data, CPT_UCODE_VERSION_SZ);
+- mcode->code_size = ntohl(ucode->code_length) * 2;
+- if (!mcode->code_size) {
++ code_length = ntohl(ucode->code_length);
++ if (code_length == 0 || code_length >= INT_MAX / 2) {
+ ret = -EINVAL;
+ goto fw_release;
+ }
++ mcode->code_size = code_length * 2;
+
+ mcode->is_ae = is_ae;
+ mcode->core_mask = 0ULL;
+diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
+index 890cadf3ec5d8..e86a3d19b7182 100644
+--- a/drivers/dma/ioat/dma.c
++++ b/drivers/dma/ioat/dma.c
+@@ -653,7 +653,7 @@ static void __cleanup(struct ioatdma_chan *ioat_chan, dma_addr_t phys_complete)
+ if (active - i == 0) {
+ dev_dbg(to_dev(ioat_chan), "%s: cancel completion timeout\n",
+ __func__);
+- mod_timer(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
++ mod_timer_pending(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
+ }
+
+ /* microsecond delay by sysfs variable per pending descriptor */
+@@ -679,7 +679,7 @@ static void ioat_cleanup(struct ioatdma_chan *ioat_chan)
+
+ if (chanerr &
+ (IOAT_CHANERR_HANDLE_MASK | IOAT_CHANERR_RECOVER_MASK)) {
+- mod_timer(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
++ mod_timer_pending(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
+ ioat_eh(ioat_chan);
+ }
+ }
+@@ -876,7 +876,7 @@ static void check_active(struct ioatdma_chan *ioat_chan)
+ }
+
+ if (test_and_clear_bit(IOAT_CHAN_ACTIVE, &ioat_chan->state))
+- mod_timer(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
++ mod_timer_pending(&ioat_chan->timer, jiffies + IDLE_TIMEOUT);
+ }
+
+ void ioat_timer_event(struct timer_list *t)
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index 3f38df6b51f2a..0ba70be4ea85d 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -2654,7 +2654,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+ if (err < 0) {
+ dev_err(xdev->dev,
+ "missing xlnx,num-fstores property\n");
+- return err;
++ goto disable_clks;
+ }
+
+ err = of_property_read_u32(node, "xlnx,flush-fsync",
+@@ -2674,7 +2674,11 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+ xdev->ext_addr = false;
+
+ /* Set the dma mask bits */
+- dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width));
++ err = dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width));
++ if (err < 0) {
++ dev_err(xdev->dev, "DMA mask error %d\n", err);
++ goto disable_clks;
++ }
+
+ /* Initialize the DMA engine */
+ xdev->common.dev = &pdev->dev;
+diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+index 177874adccf0d..b0c8962b98854 100644
+--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c
++++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+@@ -106,9 +106,28 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev)
+ scmi_pd_data->domains = domains;
+ scmi_pd_data->num_domains = num_domains;
+
++ dev_set_drvdata(dev, scmi_pd_data);
++
+ return of_genpd_add_provider_onecell(np, scmi_pd_data);
+ }
+
++static void scmi_pm_domain_remove(struct scmi_device *sdev)
++{
++ int i;
++ struct genpd_onecell_data *scmi_pd_data;
++ struct device *dev = &sdev->dev;
++ struct device_node *np = dev->of_node;
++
++ of_genpd_del_provider(np);
++
++ scmi_pd_data = dev_get_drvdata(dev);
++ for (i = 0; i < scmi_pd_data->num_domains; i++) {
++ if (!scmi_pd_data->domains[i])
++ continue;
++ pm_genpd_remove(scmi_pd_data->domains[i]);
++ }
++}
++
+ static const struct scmi_device_id scmi_id_table[] = {
+ { SCMI_PROTOCOL_POWER },
+ { },
+@@ -118,6 +137,7 @@ MODULE_DEVICE_TABLE(scmi, scmi_id_table);
+ static struct scmi_driver scmi_power_domain_driver = {
+ .name = "scmi-power-domain",
+ .probe = scmi_pm_domain_probe,
++ .remove = scmi_pm_domain_remove,
+ .id_table = scmi_id_table,
+ };
+ module_scmi_driver(scmi_power_domain_driver);
+diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
+index dba296a44f4ec..2a1a587edef9c 100644
+--- a/drivers/firmware/efi/libstub/fdt.c
++++ b/drivers/firmware/efi/libstub/fdt.c
+@@ -301,14 +301,6 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
+ goto fail;
+ }
+
+- /*
+- * Now that we have done our final memory allocation (and free)
+- * we can get the memory map key needed for exit_boot_services().
+- */
+- status = efi_get_memory_map(sys_table, &map);
+- if (status != EFI_SUCCESS)
+- goto fail_free_new_fdt;
+-
+ status = update_fdt(sys_table, (void *)fdt_addr, fdt_size,
+ (void *)*new_fdt_addr, MAX_FDT_SIZE, cmdline_ptr,
+ initrd_addr, initrd_size);
+diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c
+index 62337be07afcb..2e3ef0eb6e821 100644
+--- a/drivers/firmware/google/gsmi.c
++++ b/drivers/firmware/google/gsmi.c
+@@ -661,6 +661,15 @@ static struct notifier_block gsmi_die_notifier = {
+ static int gsmi_panic_callback(struct notifier_block *nb,
+ unsigned long reason, void *arg)
+ {
++
++ /*
++ * Panic callbacks are executed with all other CPUs stopped,
++ * so we must not attempt to spin waiting for gsmi_dev.lock
++ * to be released.
++ */
++ if (spin_is_locked(&gsmi_dev.lock))
++ return NOTIFY_DONE;
++
+ gsmi_shutdown_reason(GSMI_SHUTDOWN_PANIC);
+ return NOTIFY_DONE;
+ }
+diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c
+index 5b4ca6142270e..5133fe0a0abea 100644
+--- a/drivers/fsi/fsi-core.c
++++ b/drivers/fsi/fsi-core.c
+@@ -1279,6 +1279,9 @@ int fsi_master_register(struct fsi_master *master)
+
+ mutex_init(&master->scan_lock);
+ master->idx = ida_simple_get(&master_ida, 0, INT_MAX, GFP_KERNEL);
++ if (master->idx < 0)
++ return master->idx;
++
+ dev_set_name(&master->dev, "fsi%d", master->idx);
+
+ rc = device_register(&master->dev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+index 3e4305c3c9831..86ceefb8b8fb4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -1638,10 +1638,12 @@ amdgpu_connector_add(struct amdgpu_device *adev,
+ adev->mode_info.dither_property,
+ AMDGPU_FMT_DITHER_DISABLE);
+
+- if (amdgpu_audio != 0)
++ if (amdgpu_audio != 0) {
+ drm_object_attach_property(&amdgpu_connector->base.base,
+ adev->mode_info.audio_property,
+ AMDGPU_AUDIO_AUTO);
++ amdgpu_connector->audio = AMDGPU_AUDIO_AUTO;
++ }
+
+ subpixel_order = SubPixelHorizontalRGB;
+ connector->interlace_allowed = true;
+@@ -1746,6 +1748,7 @@ amdgpu_connector_add(struct amdgpu_device *adev,
+ drm_object_attach_property(&amdgpu_connector->base.base,
+ adev->mode_info.audio_property,
+ AMDGPU_AUDIO_AUTO);
++ amdgpu_connector->audio = AMDGPU_AUDIO_AUTO;
+ }
+ drm_object_attach_property(&amdgpu_connector->base.base,
+ adev->mode_info.dither_property,
+@@ -1794,6 +1797,7 @@ amdgpu_connector_add(struct amdgpu_device *adev,
+ drm_object_attach_property(&amdgpu_connector->base.base,
+ adev->mode_info.audio_property,
+ AMDGPU_AUDIO_AUTO);
++ amdgpu_connector->audio = AMDGPU_AUDIO_AUTO;
+ }
+ drm_object_attach_property(&amdgpu_connector->base.base,
+ adev->mode_info.dither_property,
+@@ -1839,6 +1843,7 @@ amdgpu_connector_add(struct amdgpu_device *adev,
+ drm_object_attach_property(&amdgpu_connector->base.base,
+ adev->mode_info.audio_property,
+ AMDGPU_AUDIO_AUTO);
++ amdgpu_connector->audio = AMDGPU_AUDIO_AUTO;
+ }
+ drm_object_attach_property(&amdgpu_connector->base.base,
+ adev->mode_info.dither_property,
+diff --git a/drivers/gpu/drm/amd/display/dc/calcs/bw_fixed.c b/drivers/gpu/drm/amd/display/dc/calcs/bw_fixed.c
+index 6ca288fb5fb9e..2d46bc527b218 100644
+--- a/drivers/gpu/drm/amd/display/dc/calcs/bw_fixed.c
++++ b/drivers/gpu/drm/amd/display/dc/calcs/bw_fixed.c
+@@ -26,12 +26,12 @@
+ #include "bw_fixed.h"
+
+
+-#define MIN_I64 \
+- (int64_t)(-(1LL << 63))
+-
+ #define MAX_I64 \
+ (int64_t)((1ULL << 63) - 1)
+
++#define MIN_I64 \
++ (-MAX_I64 - 1)
++
+ #define FRACTIONAL_PART_MASK \
+ ((1ULL << BW_FIXED_BITS_PER_FRACTIONAL_PART) - 1)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511.h b/drivers/gpu/drm/bridge/adv7511/adv7511.h
+index 73d8ccb977427..d214865c24598 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511.h
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511.h
+@@ -383,10 +383,7 @@ void adv7511_cec_irq_process(struct adv7511 *adv7511, unsigned int irq1);
+ #else
+ static inline int adv7511_cec_init(struct device *dev, struct adv7511 *adv7511)
+ {
+- unsigned int offset = adv7511->type == ADV7533 ?
+- ADV7533_REG_CEC_OFFSET : 0;
+-
+- regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL + offset,
++ regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL,
+ ADV7511_CEC_CTRL_POWER_DOWN);
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c b/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c
+index a20a45c0b353f..ddd1305b82b2c 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c
+@@ -316,7 +316,7 @@ int adv7511_cec_init(struct device *dev, struct adv7511 *adv7511)
+ goto err_cec_alloc;
+ }
+
+- regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL + offset, 0);
++ regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL, 0);
+ /* cec soft reset */
+ regmap_write(adv7511->regmap_cec,
+ ADV7511_REG_CEC_SOFT_RESET + offset, 0x01);
+@@ -343,7 +343,7 @@ err_cec_alloc:
+ dev_info(dev, "Initializing CEC failed with error %d, disabling CEC\n",
+ ret);
+ err_cec_parse_dt:
+- regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL + offset,
++ regmap_write(adv7511->regmap, ADV7511_REG_CEC_CTRL,
+ ADV7511_CEC_CTRL_POWER_DOWN);
+ return ret == -EPROBE_DEFER ? ret : 0;
+ }
+diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
+index a8d776edccc15..07e3a8aaa0e4b 100644
+--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
++++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
+@@ -290,7 +290,9 @@ static void ge_b850v3_lvds_remove(void)
+ * This check is to avoid both the drivers
+ * removing the bridge in their remove() function
+ */
+- if (!ge_b850v3_lvds_ptr)
++ if (!ge_b850v3_lvds_ptr ||
++ !ge_b850v3_lvds_ptr->stdp2690_i2c ||
++ !ge_b850v3_lvds_ptr->stdp4028_i2c)
+ goto out;
+
+ drm_bridge_remove(&ge_b850v3_lvds_ptr->bridge);
+diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
+index babd7ebabfef8..2651bfb763a41 100644
+--- a/drivers/gpu/drm/drm_ioctl.c
++++ b/drivers/gpu/drm/drm_ioctl.c
+@@ -458,7 +458,13 @@ EXPORT_SYMBOL(drm_invalid_op);
+ */
+ static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value)
+ {
+- int len;
++ size_t len;
++
++ /* don't attempt to copy a NULL pointer */
++ if (WARN_ONCE(!value, "BUG: the value to copy was not set!")) {
++ *buf_len = 0;
++ return 0;
++ }
+
+ /* don't overflow userbuf */
+ len = strlen(value);
+diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c
+index 7ed8e510565ec..c8c9daecd00da 100644
+--- a/drivers/gpu/drm/drm_mipi_dsi.c
++++ b/drivers/gpu/drm/drm_mipi_dsi.c
+@@ -305,6 +305,7 @@ static int mipi_dsi_remove_device_fn(struct device *dev, void *priv)
+ {
+ struct mipi_dsi_device *dsi = to_mipi_dsi_device(dev);
+
++ mipi_dsi_detach(dsi);
+ mipi_dsi_device_unregister(dsi);
+
+ return 0;
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 265df1e67eb3c..bea1d3e7e964f 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -95,6 +95,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"),
+ },
+ .driver_data = (void *)&lcd800x1280_rightside_up,
++ }, { /* Anbernic Win600 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Anbernic"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Win600"),
++ },
++ .driver_data = (void *)&lcd720x1280_rightside_up,
+ }, { /* Asus T100HA */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+index c88bb92282df6..57b40cf0f199f 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+@@ -654,12 +654,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms)
+ _dpu_kms_mmu_destroy(dpu_kms);
+
+ if (dpu_kms->catalog) {
+- for (i = 0; i < dpu_kms->catalog->vbif_count; i++) {
+- u32 vbif_idx = dpu_kms->catalog->vbif[i].id;
+-
+- if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) {
+- dpu_hw_vbif_destroy(dpu_kms->hw_vbif[vbif_idx]);
+- dpu_kms->hw_vbif[vbif_idx] = NULL;
++ for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) {
++ if (dpu_kms->hw_vbif[i]) {
++ dpu_hw_vbif_destroy(dpu_kms->hw_vbif[i]);
++ dpu_kms->hw_vbif[i] = NULL;
+ }
+ }
+ }
+@@ -1094,7 +1092,7 @@ static int dpu_kms_hw_init(struct msm_kms *kms)
+ for (i = 0; i < dpu_kms->catalog->vbif_count; i++) {
+ u32 vbif_idx = dpu_kms->catalog->vbif[i].id;
+
+- dpu_kms->hw_vbif[i] = dpu_hw_vbif_init(vbif_idx,
++ dpu_kms->hw_vbif[vbif_idx] = dpu_hw_vbif_init(vbif_idx,
+ dpu_kms->vbif[vbif_idx], dpu_kms->catalog);
+ if (IS_ERR_OR_NULL(dpu_kms->hw_vbif[vbif_idx])) {
+ rc = PTR_ERR(dpu_kms->hw_vbif[vbif_idx]);
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c
+index 2955282922964..24d009e066ab6 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c
+@@ -18,6 +18,14 @@
+ #include "dpu_hw_vbif.h"
+ #include "dpu_trace.h"
+
++static struct dpu_hw_vbif *dpu_get_vbif(struct dpu_kms *dpu_kms, enum dpu_vbif vbif_idx)
++{
++ if (vbif_idx < ARRAY_SIZE(dpu_kms->hw_vbif))
++ return dpu_kms->hw_vbif[vbif_idx];
++
++ return NULL;
++}
++
+ /**
+ * _dpu_vbif_wait_for_xin_halt - wait for the xin to halt
+ * @vbif: Pointer to hardware vbif driver
+@@ -155,11 +163,11 @@ exit:
+ void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms,
+ struct dpu_vbif_set_ot_params *params)
+ {
+- struct dpu_hw_vbif *vbif = NULL;
++ struct dpu_hw_vbif *vbif;
+ struct dpu_hw_mdp *mdp;
+ bool forced_on = false;
+ u32 ot_lim;
+- int ret, i;
++ int ret;
+
+ if (!dpu_kms) {
+ DPU_ERROR("invalid arguments\n");
+@@ -167,12 +175,7 @@ void dpu_vbif_set_ot_limit(struct dpu_kms *dpu_kms,
+ }
+ mdp = dpu_kms->hw_mdp;
+
+- for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) {
+- if (dpu_kms->hw_vbif[i] &&
+- dpu_kms->hw_vbif[i]->idx == params->vbif_idx)
+- vbif = dpu_kms->hw_vbif[i];
+- }
+-
++ vbif = dpu_get_vbif(dpu_kms, params->vbif_idx);
+ if (!vbif || !mdp) {
+ DPU_DEBUG("invalid arguments vbif %d mdp %d\n",
+ vbif != 0, mdp != 0);
+@@ -217,7 +220,7 @@ exit:
+ void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms,
+ struct dpu_vbif_set_qos_params *params)
+ {
+- struct dpu_hw_vbif *vbif = NULL;
++ struct dpu_hw_vbif *vbif;
+ struct dpu_hw_mdp *mdp;
+ bool forced_on = false;
+ const struct dpu_vbif_qos_tbl *qos_tbl;
+@@ -229,13 +232,7 @@ void dpu_vbif_set_qos_remap(struct dpu_kms *dpu_kms,
+ }
+ mdp = dpu_kms->hw_mdp;
+
+- for (i = 0; i < ARRAY_SIZE(dpu_kms->hw_vbif); i++) {
+- if (dpu_kms->hw_vbif[i] &&
+- dpu_kms->hw_vbif[i]->idx == params->vbif_idx) {
+- vbif = dpu_kms->hw_vbif[i];
+- break;
+- }
+- }
++ vbif = dpu_get_vbif(dpu_kms, params->vbif_idx);
+
+ if (!vbif || !vbif->cap) {
+ DPU_ERROR("invalid vbif %d\n", params->vbif_idx);
+diff --git a/drivers/gpu/drm/vc4/vc4_vec.c b/drivers/gpu/drm/vc4/vc4_vec.c
+index 8e7facb6514ef..ae0354ceb2a3d 100644
+--- a/drivers/gpu/drm/vc4/vc4_vec.c
++++ b/drivers/gpu/drm/vc4/vc4_vec.c
+@@ -291,7 +291,7 @@ static void vc4_vec_ntsc_j_mode_set(struct vc4_vec *vec)
+ static const struct drm_display_mode ntsc_mode = {
+ DRM_MODE("720x480", DRM_MODE_TYPE_DRIVER, 13500,
+ 720, 720 + 14, 720 + 14 + 64, 720 + 14 + 64 + 60, 0,
+- 480, 480 + 3, 480 + 3 + 3, 480 + 3 + 3 + 16, 0,
++ 480, 480 + 7, 480 + 7 + 6, 525, 0,
+ DRM_MODE_FLAG_INTERLACE)
+ };
+
+@@ -313,7 +313,7 @@ static void vc4_vec_pal_m_mode_set(struct vc4_vec *vec)
+ static const struct drm_display_mode pal_mode = {
+ DRM_MODE("720x576", DRM_MODE_TYPE_DRIVER, 13500,
+ 720, 720 + 20, 720 + 20 + 64, 720 + 20 + 64 + 60, 0,
+- 576, 576 + 2, 576 + 2 + 3, 576 + 2 + 3 + 20, 0,
++ 576, 576 + 4, 576 + 4 + 6, 625, 0,
+ DRM_MODE_FLAG_INTERLACE)
+ };
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index ce027eda9b178..4b1c223be9933 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1154,7 +1154,7 @@ static void mt_touch_report(struct hid_device *hid,
+ int contact_count = -1;
+
+ /* sticky fingers release in progress, abort */
+- if (test_and_set_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))
++ if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))
+ return;
+
+ scantime = *app->scantime;
+@@ -1235,7 +1235,7 @@ static void mt_touch_report(struct hid_device *hid,
+ del_timer(&td->release_timer);
+ }
+
+- clear_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
++ clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
+ }
+
+ static int mt_touch_input_configured(struct hid_device *hdev,
+@@ -1672,11 +1672,11 @@ static void mt_expired_timeout(struct timer_list *t)
+ * An input report came in just before we release the sticky fingers,
+ * it will take care of the sticky fingers.
+ */
+- if (test_and_set_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))
++ if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))
+ return;
+ if (test_bit(MT_IO_FLAGS_PENDING_SLOTS, &td->mt_io_flags))
+ mt_release_contacts(hdev);
+- clear_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
++ clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
+ }
+
+ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
+diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c
+index 5be8de70c6517..c9cec00b4e6e3 100644
+--- a/drivers/hid/hid-roccat.c
++++ b/drivers/hid/hid-roccat.c
+@@ -260,6 +260,8 @@ int roccat_report_event(int minor, u8 const *data)
+ if (!new_value)
+ return -ENOMEM;
+
++ mutex_lock(&device->cbuf_lock);
++
+ report = &device->cbuf[device->cbuf_end];
+
+ /* passing NULL is safe */
+@@ -279,6 +281,8 @@ int roccat_report_event(int minor, u8 const *data)
+ reader->cbuf_start = (reader->cbuf_start + 1) % ROCCAT_CBUF_SIZE;
+ }
+
++ mutex_unlock(&device->cbuf_lock);
++
+ wake_up_interruptible(&device->wait);
+ return 0;
+ }
+diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
+index 129c5e6bc6547..15ecc4bc8de60 100644
+--- a/drivers/hsi/controllers/omap_ssi_core.c
++++ b/drivers/hsi/controllers/omap_ssi_core.c
+@@ -560,6 +560,7 @@ static int ssi_probe(struct platform_device *pd)
+ if (!childpdev) {
+ err = -ENODEV;
+ dev_err(&pd->dev, "failed to create ssi controller port\n");
++ of_node_put(child);
+ goto out3;
+ }
+ }
+diff --git a/drivers/hsi/controllers/omap_ssi_port.c b/drivers/hsi/controllers/omap_ssi_port.c
+index 2ada82d2ec8cc..e6149fd43b628 100644
+--- a/drivers/hsi/controllers/omap_ssi_port.c
++++ b/drivers/hsi/controllers/omap_ssi_port.c
+@@ -253,10 +253,10 @@ static int ssi_start_dma(struct hsi_msg *msg, int lch)
+ if (msg->ttype == HSI_MSG_READ) {
+ err = dma_map_sg(&ssi->device, msg->sgt.sgl, msg->sgt.nents,
+ DMA_FROM_DEVICE);
+- if (err < 0) {
++ if (!err) {
+ dev_dbg(&ssi->device, "DMA map SG failed !\n");
+ pm_runtime_put_autosuspend(omap_port->pdev);
+- return err;
++ return -EIO;
+ }
+ csdp = SSI_DST_BURST_4x32_BIT | SSI_DST_MEMORY_PORT |
+ SSI_SRC_SINGLE_ACCESS0 | SSI_SRC_PERIPHERAL_PORT |
+@@ -270,10 +270,10 @@ static int ssi_start_dma(struct hsi_msg *msg, int lch)
+ } else {
+ err = dma_map_sg(&ssi->device, msg->sgt.sgl, msg->sgt.nents,
+ DMA_TO_DEVICE);
+- if (err < 0) {
++ if (!err) {
+ dev_dbg(&ssi->device, "DMA map SG failed !\n");
+ pm_runtime_put_autosuspend(omap_port->pdev);
+- return err;
++ return -EIO;
+ }
+ csdp = SSI_SRC_BURST_4x32_BIT | SSI_SRC_MEMORY_PORT |
+ SSI_DST_SINGLE_ACCESS0 | SSI_DST_PERIPHERAL_PORT |
+diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
+index 129c3adad4c05..b355899f54cc9 100644
+--- a/drivers/iio/adc/at91-sama5d2_adc.c
++++ b/drivers/iio/adc/at91-sama5d2_adc.c
+@@ -81,7 +81,7 @@
+ #define AT91_SAMA5D2_MR_ANACH BIT(23)
+ /* Tracking Time */
+ #define AT91_SAMA5D2_MR_TRACKTIM(v) ((v) << 24)
+-#define AT91_SAMA5D2_MR_TRACKTIM_MAX 0xff
++#define AT91_SAMA5D2_MR_TRACKTIM_MAX 0xf
+ /* Transfer Time */
+ #define AT91_SAMA5D2_MR_TRANSFER(v) ((v) << 28)
+ #define AT91_SAMA5D2_MR_TRANSFER_MAX 0x3
+@@ -1329,8 +1329,10 @@ static int at91_adc_read_info_raw(struct iio_dev *indio_dev,
+ *val = tmp_val;
+ mutex_unlock(&st->lock);
+ iio_device_release_direct_mode(indio_dev);
++ if (ret > 0)
++ ret = at91_adc_adjust_val_osr(st, val);
+
+- return at91_adc_adjust_val_osr(st, val);
++ return ret;
+ }
+ if (chan->type == IIO_PRESSURE) {
+ ret = iio_device_claim_direct_mode(indio_dev);
+@@ -1343,8 +1345,10 @@ static int at91_adc_read_info_raw(struct iio_dev *indio_dev,
+ *val = tmp_val;
+ mutex_unlock(&st->lock);
+ iio_device_release_direct_mode(indio_dev);
++ if (ret > 0)
++ ret = at91_adc_adjust_val_osr(st, val);
+
+- return at91_adc_adjust_val_osr(st, val);
++ return ret;
+ }
+
+ /* in this case we have a voltage channel */
+diff --git a/drivers/iio/dac/ad5593r.c b/drivers/iio/dac/ad5593r.c
+index fc11ea098f98f..3d807522a35f9 100644
+--- a/drivers/iio/dac/ad5593r.c
++++ b/drivers/iio/dac/ad5593r.c
+@@ -15,6 +15,8 @@
+ #include <linux/of.h>
+ #include <linux/acpi.h>
+
++#include <asm/unaligned.h>
++
+ #define AD5593R_MODE_CONF (0 << 4)
+ #define AD5593R_MODE_DAC_WRITE (1 << 4)
+ #define AD5593R_MODE_ADC_READBACK (4 << 4)
+@@ -22,6 +24,24 @@
+ #define AD5593R_MODE_GPIO_READBACK (6 << 4)
+ #define AD5593R_MODE_REG_READBACK (7 << 4)
+
++static int ad5593r_read_word(struct i2c_client *i2c, u8 reg, u16 *value)
++{
++ int ret;
++ u8 buf[2];
++
++ ret = i2c_smbus_write_byte(i2c, reg);
++ if (ret < 0)
++ return ret;
++
++ ret = i2c_master_recv(i2c, buf, sizeof(buf));
++ if (ret < 0)
++ return ret;
++
++ *value = get_unaligned_be16(buf);
++
++ return 0;
++}
++
+ static int ad5593r_write_dac(struct ad5592r_state *st, unsigned chan, u16 value)
+ {
+ struct i2c_client *i2c = to_i2c_client(st->dev);
+@@ -40,13 +60,7 @@ static int ad5593r_read_adc(struct ad5592r_state *st, unsigned chan, u16 *value)
+ if (val < 0)
+ return (int) val;
+
+- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_ADC_READBACK);
+- if (val < 0)
+- return (int) val;
+-
+- *value = (u16) val;
+-
+- return 0;
++ return ad5593r_read_word(i2c, AD5593R_MODE_ADC_READBACK, value);
+ }
+
+ static int ad5593r_reg_write(struct ad5592r_state *st, u8 reg, u16 value)
+@@ -60,25 +74,19 @@ static int ad5593r_reg_write(struct ad5592r_state *st, u8 reg, u16 value)
+ static int ad5593r_reg_read(struct ad5592r_state *st, u8 reg, u16 *value)
+ {
+ struct i2c_client *i2c = to_i2c_client(st->dev);
+- s32 val;
+-
+- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_REG_READBACK | reg);
+- if (val < 0)
+- return (int) val;
+
+- *value = (u16) val;
+-
+- return 0;
++ return ad5593r_read_word(i2c, AD5593R_MODE_REG_READBACK | reg, value);
+ }
+
+ static int ad5593r_gpio_read(struct ad5592r_state *st, u8 *value)
+ {
+ struct i2c_client *i2c = to_i2c_client(st->dev);
+- s32 val;
++ u16 val;
++ int ret;
+
+- val = i2c_smbus_read_word_swapped(i2c, AD5593R_MODE_GPIO_READBACK);
+- if (val < 0)
+- return (int) val;
++ ret = ad5593r_read_word(i2c, AD5593R_MODE_GPIO_READBACK, &val);
++ if (ret)
++ return ret;
+
+ *value = (u8) val;
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index a8ccc6e5a7735..5108b0504616c 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -139,9 +139,10 @@ static int __of_iio_channel_get(struct iio_channel *channel,
+
+ idev = bus_find_device(&iio_bus_type, NULL, iiospec.np,
+ iio_dev_node_match);
+- of_node_put(iiospec.np);
+- if (idev == NULL)
++ if (idev == NULL) {
++ of_node_put(iiospec.np);
+ return -EPROBE_DEFER;
++ }
+
+ indio_dev = dev_to_iio_dev(idev);
+ channel->indio_dev = indio_dev;
+@@ -149,6 +150,7 @@ static int __of_iio_channel_get(struct iio_channel *channel,
+ index = indio_dev->info->of_xlate(indio_dev, &iiospec);
+ else
+ index = __of_iio_simple_xlate(indio_dev, &iiospec);
++ of_node_put(iiospec.np);
+ if (index < 0)
+ goto err_put;
+ channel->channel = &indio_dev->channels[index];
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index a4b5374deac87..6320390f531ce 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -799,7 +799,9 @@ void rxe_qp_destroy(struct rxe_qp *qp)
+ rxe_cleanup_task(&qp->comp.task);
+
+ /* flush out any receive wr's or pending requests */
+- __rxe_do_task(&qp->req.task);
++ if (qp->req.task.func)
++ __rxe_do_task(&qp->req.task);
++
+ if (qp->sq.queue) {
+ __rxe_do_task(&qp->comp.task);
+ __rxe_do_task(&qp->req.task);
+@@ -839,8 +841,10 @@ static void rxe_qp_do_cleanup(struct work_struct *work)
+
+ free_rd_atomic_resources(qp);
+
+- kernel_sock_shutdown(qp->sk, SHUT_RDWR);
+- sock_release(qp->sk);
++ if (qp->sk) {
++ kernel_sock_shutdown(qp->sk, SHUT_RDWR);
++ sock_release(qp->sk);
++ }
+ }
+
+ /* called when the last reference to the qp is dropped */
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 4423db71eda73..c125cd42faee7 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -126,6 +126,8 @@ static const struct xpad_device {
+ u8 xtype;
+ } xpad_device[] = {
+ { 0x0079, 0x18d4, "GPD Win 2 X-Box Controller", 0, XTYPE_XBOX360 },
++ { 0x03eb, 0xff01, "Wooting One (Legacy)", 0, XTYPE_XBOX360 },
++ { 0x03eb, 0xff02, "Wooting Two (Legacy)", 0, XTYPE_XBOX360 },
+ { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX },
+ { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
+@@ -256,6 +258,7 @@ static const struct xpad_device {
+ { 0x0f0d, 0x0063, "Hori Real Arcade Pro Hayabusa (USA) Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x0f0d, 0x0067, "HORIPAD ONE", 0, XTYPE_XBOXONE },
+ { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
++ { 0x0f0d, 0x00c5, "Hori Fighting Commander ONE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x0f30, 0x010b, "Philips Recoil", 0, XTYPE_XBOX },
+ { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
+ { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
+@@ -272,6 +275,7 @@ static const struct xpad_device {
+ { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
+ { 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 },
+ { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
++ { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 },
+ { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
+@@ -336,6 +340,7 @@ static const struct xpad_device {
+ { 0x24c6, 0x5502, "Hori Fighting Stick VX Alt", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x24c6, 0x5503, "Hori Fighting Edge", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x24c6, 0x5506, "Hori SOULCALIBUR V Stick", 0, XTYPE_XBOX360 },
++ { 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x24c6, 0x550d, "Hori GEM Xbox controller", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x550e, "Hori Real Arcade Pro V Kai 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+ { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE },
+@@ -345,6 +350,14 @@ static const struct xpad_device {
+ { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 },
+ { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
++ { 0x2563, 0x058d, "OneXPlayer Gamepad", 0, XTYPE_XBOX360 },
++ { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE },
++ { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 },
++ { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 },
++ { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 },
++ { 0x31e3, 0x1220, "Wooting Two HE", 0, XTYPE_XBOX360 },
++ { 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 },
++ { 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 },
+ { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 },
+ { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
+ { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
+@@ -430,6 +443,7 @@ static const signed short xpad_abs_triggers[] = {
+ static const struct usb_device_id xpad_table[] = {
+ { USB_INTERFACE_INFO('X', 'B', 0) }, /* X-Box USB-IF not approved class */
+ XPAD_XBOX360_VENDOR(0x0079), /* GPD Win 2 Controller */
++ XPAD_XBOX360_VENDOR(0x03eb), /* Wooting Keyboards (Legacy) */
+ XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster X-Box 360 controllers */
+ XPAD_XBOX360_VENDOR(0x045e), /* Microsoft X-Box 360 controllers */
+ XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft X-Box One controllers */
+@@ -440,6 +454,7 @@ static const struct usb_device_id xpad_table[] = {
+ { USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */
+ XPAD_XBOXONE_VENDOR(0x0738), /* Mad Catz FightStick TE 2 */
+ XPAD_XBOX360_VENDOR(0x07ff), /* Mad Catz GamePad */
++ XPAD_XBOX360_VENDOR(0x0c12), /* Zeroplus X-Box 360 controllers */
+ XPAD_XBOX360_VENDOR(0x0e6f), /* 0x0e6f X-Box 360 controllers */
+ XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f X-Box One controllers */
+ XPAD_XBOX360_VENDOR(0x0f0d), /* Hori Controllers */
+@@ -460,8 +475,12 @@ static const struct usb_device_id xpad_table[] = {
+ XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA Controllers */
+ XPAD_XBOX360_VENDOR(0x24c6), /* PowerA Controllers */
+ XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA Controllers */
++ XPAD_XBOX360_VENDOR(0x2563), /* OneXPlayer Gamepad */
++ XPAD_XBOX360_VENDOR(0x260d), /* Dareu H101 */
++ XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Pro 2 Wired Controller for Xbox */
+ XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Duke X-Box One pad */
+ XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */
++ XPAD_XBOX360_VENDOR(0x31e3), /* Wooting Keyboards */
+ XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */
+ { }
+ };
+@@ -1978,7 +1997,6 @@ static struct usb_driver xpad_driver = {
+ .disconnect = xpad_disconnect,
+ .suspend = xpad_suspend,
+ .resume = xpad_resume,
+- .reset_resume = xpad_resume,
+ .id_table = xpad_table,
+ };
+
+diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
+index 5ce55fabc9d80..726702d01522a 100644
+--- a/drivers/iommu/omap-iommu-debug.c
++++ b/drivers/iommu/omap-iommu-debug.c
+@@ -35,12 +35,12 @@ static inline bool is_omap_iommu_detached(struct omap_iommu *obj)
+ ssize_t bytes; \
+ const char *str = "%20s: %08x\n"; \
+ const int maxcol = 32; \
+- bytes = snprintf(p, maxcol, str, __stringify(name), \
++ if (len < maxcol) \
++ goto out; \
++ bytes = scnprintf(p, maxcol, str, __stringify(name), \
+ iommu_read_reg(obj, MMU_##name)); \
+ p += bytes; \
+ len -= bytes; \
+- if (len < maxcol) \
+- goto out; \
+ } while (0)
+
+ static ssize_t
+diff --git a/drivers/isdn/mISDN/l1oip.h b/drivers/isdn/mISDN/l1oip.h
+index 7ea10db20e3a6..48133d0228120 100644
+--- a/drivers/isdn/mISDN/l1oip.h
++++ b/drivers/isdn/mISDN/l1oip.h
+@@ -59,6 +59,7 @@ struct l1oip {
+ int bundle; /* bundle channels in one frm */
+ int codec; /* codec to use for transmis. */
+ int limit; /* limit number of bchannels */
++ bool shutdown; /* if card is released */
+
+ /* timer */
+ struct timer_list keep_tl;
+diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
+index b05022f94f18c..2f4a01ab25e8d 100644
+--- a/drivers/isdn/mISDN/l1oip_core.c
++++ b/drivers/isdn/mISDN/l1oip_core.c
+@@ -289,7 +289,7 @@ l1oip_socket_send(struct l1oip *hc, u8 localcodec, u8 channel, u32 chanmask,
+ p = frame;
+
+ /* restart timer */
+- if (time_before(hc->keep_tl.expires, jiffies + 5 * HZ))
++ if (time_before(hc->keep_tl.expires, jiffies + 5 * HZ) && !hc->shutdown)
+ mod_timer(&hc->keep_tl, jiffies + L1OIP_KEEPALIVE * HZ);
+ else
+ hc->keep_tl.expires = jiffies + L1OIP_KEEPALIVE * HZ;
+@@ -615,7 +615,9 @@ multiframe:
+ goto multiframe;
+
+ /* restart timer */
+- if (time_before(hc->timeout_tl.expires, jiffies + 5 * HZ) || !hc->timeout_on) {
++ if ((time_before(hc->timeout_tl.expires, jiffies + 5 * HZ) ||
++ !hc->timeout_on) &&
++ !hc->shutdown) {
+ hc->timeout_on = 1;
+ mod_timer(&hc->timeout_tl, jiffies + L1OIP_TIMEOUT * HZ);
+ } else /* only adjust timer */
+@@ -1247,11 +1249,10 @@ release_card(struct l1oip *hc)
+ {
+ int ch;
+
+- if (timer_pending(&hc->keep_tl))
+- del_timer(&hc->keep_tl);
++ hc->shutdown = true;
+
+- if (timer_pending(&hc->timeout_tl))
+- del_timer(&hc->timeout_tl);
++ del_timer_sync(&hc->keep_tl);
++ del_timer_sync(&hc->timeout_tl);
+
+ cancel_work_sync(&hc->workq);
+
+diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
+index 96bcabfebc239..543c4a4a8fcaf 100644
+--- a/drivers/mailbox/bcm-flexrm-mailbox.c
++++ b/drivers/mailbox/bcm-flexrm-mailbox.c
+@@ -634,15 +634,15 @@ static int flexrm_spu_dma_map(struct device *dev, struct brcm_message *msg)
+
+ rc = dma_map_sg(dev, msg->spu.src, sg_nents(msg->spu.src),
+ DMA_TO_DEVICE);
+- if (rc < 0)
+- return rc;
++ if (!rc)
++ return -EIO;
+
+ rc = dma_map_sg(dev, msg->spu.dst, sg_nents(msg->spu.dst),
+ DMA_FROM_DEVICE);
+- if (rc < 0) {
++ if (!rc) {
+ dma_unmap_sg(dev, msg->spu.src, sg_nents(msg->spu.src),
+ DMA_TO_DEVICE);
+- return rc;
++ return -EIO;
+ }
+
+ return 0;
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index 2a782c4f4710b..252ef0eab41cb 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -70,8 +70,8 @@ static void dump_zones(struct mddev *mddev)
+ int len = 0;
+
+ for (k = 0; k < conf->strip_zone[j].nb_dev; k++)
+- len += snprintf(line+len, 200-len, "%s%s", k?"/":"",
+- bdevname(conf->devlist[j*raid_disks
++ len += scnprintf(line+len, 200-len, "%s%s", k?"/":"",
++ bdevname(conf->devlist[j*raid_disks
+ + k]->bdev, b));
+ pr_debug("md: zone%d=[%s]\n", j, line);
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 6f04473f08385..7fe0619c487ae 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -44,6 +44,7 @@
+ */
+
+ #include <linux/blkdev.h>
++#include <linux/delay.h>
+ #include <linux/kthread.h>
+ #include <linux/raid/pq.h>
+ #include <linux/async_tx.h>
+@@ -3723,7 +3724,7 @@ static void handle_stripe_fill(struct stripe_head *sh,
+ * back cache (prexor with orig_page, and then xor with
+ * page) in the read path
+ */
+- if (s->injournal && s->failed) {
++ if (s->to_read && s->injournal && s->failed) {
+ if (test_bit(STRIPE_R5C_CACHING, &sh->state))
+ r5c_make_stripe_write_out(sh);
+ goto out;
+@@ -6329,7 +6330,18 @@ static void raid5d(struct md_thread *thread)
+ spin_unlock_irq(&conf->device_lock);
+ md_check_recovery(mddev);
+ spin_lock_irq(&conf->device_lock);
++
++ /*
++ * Waiting on MD_SB_CHANGE_PENDING below may deadlock
++ * seeing md_check_recovery() is needed to clear
++ * the flag when using mdmon.
++ */
++ continue;
+ }
++
++ wait_event_lock_irq(mddev->sb_wait,
++ !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags),
++ conf->device_lock);
+ }
+ pr_debug("%d stripes handled\n", handled);
+
+diff --git a/drivers/media/pci/cx88/cx88-vbi.c b/drivers/media/pci/cx88/cx88-vbi.c
+index 58489ea0c1da1..7cf2271866d05 100644
+--- a/drivers/media/pci/cx88/cx88-vbi.c
++++ b/drivers/media/pci/cx88/cx88-vbi.c
+@@ -144,11 +144,10 @@ static int buffer_prepare(struct vb2_buffer *vb)
+ return -EINVAL;
+ vb2_set_plane_payload(vb, 0, size);
+
+- cx88_risc_buffer(dev->pci, &buf->risc, sgt->sgl,
+- 0, VBI_LINE_LENGTH * lines,
+- VBI_LINE_LENGTH, 0,
+- lines);
+- return 0;
++ return cx88_risc_buffer(dev->pci, &buf->risc, sgt->sgl,
++ 0, VBI_LINE_LENGTH * lines,
++ VBI_LINE_LENGTH, 0,
++ lines);
+ }
+
+ static void buffer_finish(struct vb2_buffer *vb)
+diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
+index 248fb3b6833cc..2bc5080198bba 100644
+--- a/drivers/media/pci/cx88/cx88-video.c
++++ b/drivers/media/pci/cx88/cx88-video.c
+@@ -452,6 +452,7 @@ static int queue_setup(struct vb2_queue *q,
+
+ static int buffer_prepare(struct vb2_buffer *vb)
+ {
++ int ret;
+ struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb);
+ struct cx8800_dev *dev = vb->vb2_queue->drv_priv;
+ struct cx88_core *core = dev->core;
+@@ -466,35 +467,35 @@ static int buffer_prepare(struct vb2_buffer *vb)
+
+ switch (core->field) {
+ case V4L2_FIELD_TOP:
+- cx88_risc_buffer(dev->pci, &buf->risc,
+- sgt->sgl, 0, UNSET,
+- buf->bpl, 0, core->height);
++ ret = cx88_risc_buffer(dev->pci, &buf->risc,
++ sgt->sgl, 0, UNSET,
++ buf->bpl, 0, core->height);
+ break;
+ case V4L2_FIELD_BOTTOM:
+- cx88_risc_buffer(dev->pci, &buf->risc,
+- sgt->sgl, UNSET, 0,
+- buf->bpl, 0, core->height);
++ ret = cx88_risc_buffer(dev->pci, &buf->risc,
++ sgt->sgl, UNSET, 0,
++ buf->bpl, 0, core->height);
+ break;
+ case V4L2_FIELD_SEQ_TB:
+- cx88_risc_buffer(dev->pci, &buf->risc,
+- sgt->sgl,
+- 0, buf->bpl * (core->height >> 1),
+- buf->bpl, 0,
+- core->height >> 1);
++ ret = cx88_risc_buffer(dev->pci, &buf->risc,
++ sgt->sgl,
++ 0, buf->bpl * (core->height >> 1),
++ buf->bpl, 0,
++ core->height >> 1);
+ break;
+ case V4L2_FIELD_SEQ_BT:
+- cx88_risc_buffer(dev->pci, &buf->risc,
+- sgt->sgl,
+- buf->bpl * (core->height >> 1), 0,
+- buf->bpl, 0,
+- core->height >> 1);
++ ret = cx88_risc_buffer(dev->pci, &buf->risc,
++ sgt->sgl,
++ buf->bpl * (core->height >> 1), 0,
++ buf->bpl, 0,
++ core->height >> 1);
+ break;
+ case V4L2_FIELD_INTERLACED:
+ default:
+- cx88_risc_buffer(dev->pci, &buf->risc,
+- sgt->sgl, 0, buf->bpl,
+- buf->bpl, buf->bpl,
+- core->height >> 1);
++ ret = cx88_risc_buffer(dev->pci, &buf->risc,
++ sgt->sgl, 0, buf->bpl,
++ buf->bpl, buf->bpl,
++ core->height >> 1);
+ break;
+ }
+ dprintk(2,
+@@ -502,7 +503,7 @@ static int buffer_prepare(struct vb2_buffer *vb)
+ buf, buf->vb.vb2_buf.index,
+ core->width, core->height, dev->fmt->depth, dev->fmt->name,
+ (unsigned long)buf->risc.dma);
+- return 0;
++ return ret;
+ }
+
+ static void buffer_finish(struct vb2_buffer *vb)
+diff --git a/drivers/media/platform/exynos4-is/fimc-is.c b/drivers/media/platform/exynos4-is/fimc-is.c
+index 0f3f82bd4d208..6f59fe02c7279 100644
+--- a/drivers/media/platform/exynos4-is/fimc-is.c
++++ b/drivers/media/platform/exynos4-is/fimc-is.c
+@@ -217,6 +217,7 @@ static int fimc_is_register_subdevs(struct fimc_is *is)
+
+ if (ret < 0 || index >= FIMC_IS_SENSORS_NUM) {
+ of_node_put(child);
++ of_node_put(i2c_bus);
+ return ret;
+ }
+ index++;
+diff --git a/drivers/media/platform/xilinx/xilinx-vipp.c b/drivers/media/platform/xilinx/xilinx-vipp.c
+index 6d95ec1e9a6b4..9177db789b073 100644
+--- a/drivers/media/platform/xilinx/xilinx-vipp.c
++++ b/drivers/media/platform/xilinx/xilinx-vipp.c
+@@ -464,7 +464,7 @@ static int xvip_graph_dma_init(struct xvip_composite_device *xdev)
+ {
+ struct device_node *ports;
+ struct device_node *port;
+- int ret;
++ int ret = 0;
+
+ ports = of_get_child_by_name(xdev->dev->of_node, "ports");
+ if (ports == NULL) {
+@@ -474,13 +474,14 @@ static int xvip_graph_dma_init(struct xvip_composite_device *xdev)
+
+ for_each_child_of_node(ports, port) {
+ ret = xvip_graph_dma_init_one(xdev, port);
+- if (ret < 0) {
++ if (ret) {
+ of_node_put(port);
+- return ret;
++ break;
+ }
+ }
+
+- return 0;
++ of_node_put(ports);
++ return ret;
+ }
+
+ static void xvip_graph_cleanup(struct xvip_composite_device *xdev)
+diff --git a/drivers/memory/of_memory.c b/drivers/memory/of_memory.c
+index 2f5ed7366eec7..83a559d48f93b 100644
+--- a/drivers/memory/of_memory.c
++++ b/drivers/memory/of_memory.c
+@@ -135,6 +135,7 @@ const struct lpddr2_timings *of_get_ddr_timings(struct device_node *np_ddr,
+ for_each_child_of_node(np_ddr, np_tim) {
+ if (of_device_is_compatible(np_tim, tim_compat)) {
+ if (of_do_get_timings(np_tim, &timings[i])) {
++ of_node_put(np_tim);
+ devm_kfree(dev, timings);
+ goto default_timings;
+ }
+diff --git a/drivers/mfd/fsl-imx25-tsadc.c b/drivers/mfd/fsl-imx25-tsadc.c
+index dbb85caaafede..2718fcb267864 100644
+--- a/drivers/mfd/fsl-imx25-tsadc.c
++++ b/drivers/mfd/fsl-imx25-tsadc.c
+@@ -89,6 +89,19 @@ static int mx25_tsadc_setup_irq(struct platform_device *pdev,
+ return 0;
+ }
+
++static int mx25_tsadc_unset_irq(struct platform_device *pdev)
++{
++ struct mx25_tsadc *tsadc = platform_get_drvdata(pdev);
++ int irq = platform_get_irq(pdev, 0);
++
++ if (irq) {
++ irq_set_chained_handler_and_data(irq, NULL, NULL);
++ irq_domain_remove(tsadc->domain);
++ }
++
++ return 0;
++}
++
+ static void mx25_tsadc_setup_clk(struct platform_device *pdev,
+ struct mx25_tsadc *tsadc)
+ {
+@@ -176,18 +189,21 @@ static int mx25_tsadc_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, tsadc);
+
+- return devm_of_platform_populate(dev);
++ ret = devm_of_platform_populate(dev);
++ if (ret)
++ goto err_irq;
++
++ return 0;
++
++err_irq:
++ mx25_tsadc_unset_irq(pdev);
++
++ return ret;
+ }
+
+ static int mx25_tsadc_remove(struct platform_device *pdev)
+ {
+- struct mx25_tsadc *tsadc = platform_get_drvdata(pdev);
+- int irq = platform_get_irq(pdev, 0);
+-
+- if (irq) {
+- irq_set_chained_handler_and_data(irq, NULL, NULL);
+- irq_domain_remove(tsadc->domain);
+- }
++ mx25_tsadc_unset_irq(pdev);
+
+ return 0;
+ }
+diff --git a/drivers/mfd/intel_soc_pmic_core.c b/drivers/mfd/intel_soc_pmic_core.c
+index 274306d98ac11..75a2a793ac149 100644
+--- a/drivers/mfd/intel_soc_pmic_core.c
++++ b/drivers/mfd/intel_soc_pmic_core.c
+@@ -118,6 +118,7 @@ static int intel_soc_pmic_i2c_probe(struct i2c_client *i2c,
+ return 0;
+
+ err_del_irq_chip:
++ pwm_remove_table(crc_pwm_lookup, ARRAY_SIZE(crc_pwm_lookup));
+ regmap_del_irq_chip(pmic->irq, pmic->irq_chip_data);
+ return ret;
+ }
+diff --git a/drivers/mfd/lp8788-irq.c b/drivers/mfd/lp8788-irq.c
+index 792d51bae20f5..ae65928f35f09 100644
+--- a/drivers/mfd/lp8788-irq.c
++++ b/drivers/mfd/lp8788-irq.c
+@@ -179,6 +179,7 @@ int lp8788_irq_init(struct lp8788 *lp, int irq)
+ IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+ "lp8788-irq", irqd);
+ if (ret) {
++ irq_domain_remove(lp->irqdm);
+ dev_err(lp->dev, "failed to create a thread for IRQ_N\n");
+ return ret;
+ }
+@@ -192,4 +193,6 @@ void lp8788_irq_exit(struct lp8788 *lp)
+ {
+ if (lp->irq)
+ free_irq(lp->irq, lp->irqdm);
++ if (lp->irqdm)
++ irq_domain_remove(lp->irqdm);
+ }
+diff --git a/drivers/mfd/lp8788.c b/drivers/mfd/lp8788.c
+index acf616559512e..e47150cdf7477 100644
+--- a/drivers/mfd/lp8788.c
++++ b/drivers/mfd/lp8788.c
+@@ -199,8 +199,16 @@ static int lp8788_probe(struct i2c_client *cl, const struct i2c_device_id *id)
+ if (ret)
+ return ret;
+
+- return mfd_add_devices(lp->dev, -1, lp8788_devs,
+- ARRAY_SIZE(lp8788_devs), NULL, 0, NULL);
++ ret = mfd_add_devices(lp->dev, -1, lp8788_devs,
++ ARRAY_SIZE(lp8788_devs), NULL, 0, NULL);
++ if (ret)
++ goto err_exit_irq;
++
++ return 0;
++
++err_exit_irq:
++ lp8788_irq_exit(lp);
++ return ret;
+ }
+
+ static int lp8788_remove(struct i2c_client *cl)
+diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
+index ec1ac61a21ed1..6254b4025b5ef 100644
+--- a/drivers/mfd/sm501.c
++++ b/drivers/mfd/sm501.c
+@@ -1738,7 +1738,12 @@ static struct platform_driver sm501_plat_driver = {
+
+ static int __init sm501_base_init(void)
+ {
+- platform_driver_register(&sm501_plat_driver);
++ int ret;
++
++ ret = platform_driver_register(&sm501_plat_driver);
++ if (ret < 0)
++ return ret;
++
+ return pci_register_driver(&sm501_pci_driver);
+ }
+
+diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
+index c179c4984e311..fc775c4401795 100644
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -787,7 +787,8 @@ try_again:
+ * the CCS bit is set as well. We deliberately deviate from the spec in
+ * regards to this, which allows UHS-I to be supported for SDSC cards.
+ */
+- if (!mmc_host_is_spi(host) && rocr && (*rocr & 0x01000000)) {
++ if (!mmc_host_is_spi(host) && (ocr & SD_OCR_S18R) &&
++ rocr && (*rocr & SD_ROCR_S18A)) {
+ err = mmc_set_uhs_voltage(host, pocr);
+ if (err == -EAGAIN) {
+ retries--;
+diff --git a/drivers/mmc/host/au1xmmc.c b/drivers/mmc/host/au1xmmc.c
+index 9b4be67330dd2..7cd0551aec783 100644
+--- a/drivers/mmc/host/au1xmmc.c
++++ b/drivers/mmc/host/au1xmmc.c
+@@ -1118,8 +1118,9 @@ out5:
+ if (host->platdata && host->platdata->cd_setup &&
+ !(mmc->caps & MMC_CAP_NEEDS_POLL))
+ host->platdata->cd_setup(mmc, 0);
+-out_clk:
++
+ clk_disable_unprepare(host->clk);
++out_clk:
+ clk_put(host->clk);
+ out_irq:
+ free_irq(host->irq, host);
+diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c
+index 3ba42f5080143..f8b1696846938 100644
+--- a/drivers/mmc/host/wmt-sdmmc.c
++++ b/drivers/mmc/host/wmt-sdmmc.c
+@@ -853,7 +853,7 @@ static int wmt_mci_probe(struct platform_device *pdev)
+ if (IS_ERR(priv->clk_sdmmc)) {
+ dev_err(&pdev->dev, "Error getting clock\n");
+ ret = PTR_ERR(priv->clk_sdmmc);
+- goto fail5;
++ goto fail5_and_a_half;
+ }
+
+ ret = clk_prepare_enable(priv->clk_sdmmc);
+@@ -870,6 +870,9 @@ static int wmt_mci_probe(struct platform_device *pdev)
+ return 0;
+ fail6:
+ clk_put(priv->clk_sdmmc);
++fail5_and_a_half:
++ dma_free_coherent(&pdev->dev, mmc->max_blk_count * 16,
++ priv->dma_desc_buffer, priv->dma_desc_device_addr);
+ fail5:
+ free_irq(dma_irq, priv);
+ fail4:
+diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
+index 512bd4c2eec0b..740a09c9f67af 100644
+--- a/drivers/mtd/devices/docg3.c
++++ b/drivers/mtd/devices/docg3.c
+@@ -1990,9 +1990,14 @@ static int __init docg3_probe(struct platform_device *pdev)
+ dev_err(dev, "No I/O memory resource defined\n");
+ return ret;
+ }
+- base = devm_ioremap(dev, ress->start, DOC_IOSPACE_SIZE);
+
+ ret = -ENOMEM;
++ base = devm_ioremap(dev, ress->start, DOC_IOSPACE_SIZE);
++ if (!base) {
++ dev_err(dev, "devm_ioremap dev failed\n");
++ return ret;
++ }
++
+ cascade = devm_kcalloc(dev, DOC_MAX_NBFLOORS, sizeof(*cascade),
+ GFP_KERNEL);
+ if (!cascade)
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index b2ffd22fec31d..0a420b068adb2 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -398,6 +398,7 @@ static int atmel_nand_dma_transfer(struct atmel_nand_controller *nc,
+
+ dma_async_issue_pending(nc->dmac);
+ wait_for_completion(&finished);
++ dma_unmap_single(nc->dev, buf_dma, len, dir);
+
+ return 0;
+
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
+index 61e67986b625e..62958f04a2f20 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
+@@ -178,6 +178,8 @@ struct kvaser_usb_dev_cfg {
+ extern const struct kvaser_usb_dev_ops kvaser_usb_hydra_dev_ops;
+ extern const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops;
+
++void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv);
++
+ int kvaser_usb_recv_cmd(const struct kvaser_usb *dev, void *cmd, int len,
+ int *actual_len);
+
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+index 6e2c15626624f..379df22d51231 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+@@ -453,7 +453,7 @@ static void kvaser_usb_reset_tx_urb_contexts(struct kvaser_usb_net_priv *priv)
+ /* This method might sleep. Do not call it in the atomic context
+ * of URB completions.
+ */
+-static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
++void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
+ {
+ usb_kill_anchored_urbs(&priv->tx_submitted);
+ kvaser_usb_reset_tx_urb_contexts(priv);
+@@ -691,6 +691,7 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel)
+ init_usb_anchor(&priv->tx_submitted);
+ init_completion(&priv->start_comp);
+ init_completion(&priv->stop_comp);
++ init_completion(&priv->flush_comp);
+ priv->can.ctrlmode_supported = 0;
+
+ priv->dev = dev;
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index 01d4a731b579c..5d642458bac54 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -1886,7 +1886,7 @@ static int kvaser_usb_hydra_flush_queue(struct kvaser_usb_net_priv *priv)
+ {
+ int err;
+
+- init_completion(&priv->flush_comp);
++ reinit_completion(&priv->flush_comp);
+
+ err = kvaser_usb_hydra_send_simple_cmd(priv->dev, CMD_FLUSH_QUEUE,
+ priv->channel);
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+index 5e281249ad5fe..78d52a5e8fd5d 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -309,6 +309,38 @@ struct kvaser_cmd {
+ } u;
+ } __packed;
+
++#define CMD_SIZE_ANY 0xff
++#define kvaser_fsize(field) sizeof_field(struct kvaser_cmd, field)
++
++static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = {
++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo),
++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header),
++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.leaf.softinfo),
++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.leaf.rx_can),
++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.leaf.rx_can),
++ [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message),
++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event),
++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event),
++ /* ignored events: */
++ [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY,
++};
++
++static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = {
++ [CMD_START_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_STOP_CHIP_REPLY] = kvaser_fsize(u.simple),
++ [CMD_GET_CARD_INFO_REPLY] = kvaser_fsize(u.cardinfo),
++ [CMD_TX_ACKNOWLEDGE] = kvaser_fsize(u.tx_acknowledge_header),
++ [CMD_GET_SOFTWARE_INFO_REPLY] = kvaser_fsize(u.usbcan.softinfo),
++ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.usbcan.rx_can),
++ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can),
++ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event),
++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event),
++ /* ignored events: */
++ [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY,
++};
++
+ /* Summary of a kvaser error event, for a unified Leaf/Usbcan error
+ * handling. Some discrepancies between the two families exist:
+ *
+@@ -396,6 +428,43 @@ static const struct kvaser_usb_dev_cfg kvaser_usb_leaf_imx_dev_cfg_32mhz = {
+ .bittiming_const = &kvaser_usb_flexc_bittiming_const,
+ };
+
++static int kvaser_usb_leaf_verify_size(const struct kvaser_usb *dev,
++ const struct kvaser_cmd *cmd)
++{
++ /* buffer size >= cmd->len ensured by caller */
++ u8 min_size = 0;
++
++ switch (dev->driver_info->family) {
++ case KVASER_LEAF:
++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_leaf))
++ min_size = kvaser_usb_leaf_cmd_sizes_leaf[cmd->id];
++ break;
++ case KVASER_USBCAN:
++ if (cmd->id < ARRAY_SIZE(kvaser_usb_leaf_cmd_sizes_usbcan))
++ min_size = kvaser_usb_leaf_cmd_sizes_usbcan[cmd->id];
++ break;
++ }
++
++ if (min_size == CMD_SIZE_ANY)
++ return 0;
++
++ if (min_size) {
++ min_size += CMD_HEADER_LEN;
++ if (cmd->len >= min_size)
++ return 0;
++
++ dev_err_ratelimited(&dev->intf->dev,
++ "Received command %u too short (size %u, needed %u)",
++ cmd->id, cmd->len, min_size);
++ return -EIO;
++ }
++
++ dev_warn_ratelimited(&dev->intf->dev,
++ "Unhandled command (%d, size %d)\n",
++ cmd->id, cmd->len);
++ return -EINVAL;
++}
++
+ static void *
+ kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv,
+ const struct sk_buff *skb, int *frame_len,
+@@ -503,6 +572,9 @@ static int kvaser_usb_leaf_wait_cmd(const struct kvaser_usb *dev, u8 id,
+ end:
+ kfree(buf);
+
++ if (err == 0)
++ err = kvaser_usb_leaf_verify_size(dev, cmd);
++
+ return err;
+ }
+
+@@ -1137,6 +1209,9 @@ static void kvaser_usb_leaf_stop_chip_reply(const struct kvaser_usb *dev,
+ static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev,
+ const struct kvaser_cmd *cmd)
+ {
++ if (kvaser_usb_leaf_verify_size(dev, cmd) < 0)
++ return;
++
+ switch (cmd->id) {
+ case CMD_START_CHIP_REPLY:
+ kvaser_usb_leaf_start_chip_reply(dev, cmd);
+@@ -1355,9 +1430,13 @@ static int kvaser_usb_leaf_set_mode(struct net_device *netdev,
+
+ switch (mode) {
+ case CAN_MODE_START:
++ kvaser_usb_unlink_tx_urbs(priv);
++
+ err = kvaser_usb_leaf_simple_cmd_async(priv, CMD_START_CHIP);
+ if (err)
+ return err;
++
++ priv->can.state = CAN_STATE_ERROR_ACTIVE;
+ break;
+ default:
+ return -EOPNOTSUPP;
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 2610acf9ac36c..53b1b05f905e3 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -788,6 +788,7 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
+ BNX2X_ERR("skb_put is about to fail... pad %d len %d rx_buf_size %d\n",
+ pad, len, fp->rx_buf_size);
+ bnx2x_panic();
++ bnx2x_frag_free(fp, new_data);
+ return;
+ }
+ #endif
+diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
+index 99fe2c210d0f6..61f4b6e50d29b 100644
+--- a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
++++ b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
+@@ -98,7 +98,7 @@ static int do_pd_setup(struct fs_enet_private *fep)
+ return -EINVAL;
+
+ fep->fec.fecp = of_iomap(ofdev->dev.of_node, 0);
+- if (!fep->fcc.fccp)
++ if (!fep->fec.fecp)
+ return -EINVAL;
+
+ return 0;
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+index 46911b67b0398..23f60bc5d48f5 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+@@ -1107,5 +1107,6 @@ void mvpp2_percpu_write_relaxed(struct mvpp2 *priv, int cpu, u32 offset,
+ void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name);
+
+ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv);
++void mvpp2_dbgfs_exit(void);
+
+ #endif
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c
+index 87d9cbe10cec1..004e0fac5455c 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c
+@@ -648,6 +648,13 @@ static int mvpp2_dbgfs_port_init(struct dentry *parent,
+ return 0;
+ }
+
++static struct dentry *mvpp2_root;
++
++void mvpp2_dbgfs_exit(void)
++{
++ debugfs_remove(mvpp2_root);
++}
++
+ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv)
+ {
+ debugfs_remove_recursive(priv->dbgfs_dir);
+@@ -655,10 +662,9 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv)
+
+ void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name)
+ {
+- struct dentry *mvpp2_dir, *mvpp2_root;
++ struct dentry *mvpp2_dir;
+ int ret, i;
+
+- mvpp2_root = debugfs_lookup(MVPP2_DRIVER_NAME, NULL);
+ if (!mvpp2_root)
+ mvpp2_root = debugfs_create_dir(MVPP2_DRIVER_NAME, NULL);
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 52fdb200a0c79..788fe627e78ab 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -5417,7 +5417,18 @@ static struct platform_driver mvpp2_driver = {
+ },
+ };
+
+-module_platform_driver(mvpp2_driver);
++static int __init mvpp2_driver_init(void)
++{
++ return platform_driver_register(&mvpp2_driver);
++}
++module_init(mvpp2_driver_init);
++
++static void __exit mvpp2_driver_exit(void)
++{
++ platform_driver_unregister(&mvpp2_driver);
++ mvpp2_dbgfs_exit();
++}
++module_exit(mvpp2_driver_exit);
+
+ MODULE_DESCRIPTION("Marvell PPv2 Ethernet Driver - www.marvell.com");
+ MODULE_AUTHOR("Marcin Wojtas <mw@semihalf.com>");
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 4764e4f54cefe..d5a74a71bf597 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -1386,7 +1386,9 @@ static void intr_callback(struct urb *urb)
+ "Stop submitting intr, status %d\n", status);
+ return;
+ case -EOVERFLOW:
+- netif_info(tp, intr, tp->netdev, "intr status -EOVERFLOW\n");
++ if (net_ratelimit())
++ netif_info(tp, intr, tp->netdev,
++ "intr status -EOVERFLOW\n");
+ goto resubmit;
+ /* -EPIPE: should clear the halt */
+ default:
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 6e4096fd66334..07308571665cf 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -819,11 +819,36 @@ static int ath10k_peer_delete(struct ath10k *ar, u32 vdev_id, const u8 *addr)
+ return 0;
+ }
+
++static void ath10k_peer_map_cleanup(struct ath10k *ar, struct ath10k_peer *peer)
++{
++ int peer_id, i;
++
++ lockdep_assert_held(&ar->conf_mutex);
++
++ for_each_set_bit(peer_id, peer->peer_ids,
++ ATH10K_MAX_NUM_PEER_IDS) {
++ ar->peer_map[peer_id] = NULL;
++ }
++
++ /* Double check that peer is properly un-referenced from
++ * the peer_map
++ */
++ for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
++ if (ar->peer_map[i] == peer) {
++ ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %pK idx %d)\n",
++ peer->addr, peer, i);
++ ar->peer_map[i] = NULL;
++ }
++ }
++
++ list_del(&peer->list);
++ kfree(peer);
++ ar->num_peers--;
++}
++
+ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
+ {
+ struct ath10k_peer *peer, *tmp;
+- int peer_id;
+- int i;
+
+ lockdep_assert_held(&ar->conf_mutex);
+
+@@ -835,25 +860,7 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
+ ath10k_warn(ar, "removing stale peer %pM from vdev_id %d\n",
+ peer->addr, vdev_id);
+
+- for_each_set_bit(peer_id, peer->peer_ids,
+- ATH10K_MAX_NUM_PEER_IDS) {
+- ar->peer_map[peer_id] = NULL;
+- }
+-
+- /* Double check that peer is properly un-referenced from
+- * the peer_map
+- */
+- for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
+- if (ar->peer_map[i] == peer) {
+- ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %pK idx %d)\n",
+- peer->addr, peer, i);
+- ar->peer_map[i] = NULL;
+- }
+- }
+-
+- list_del(&peer->list);
+- kfree(peer);
+- ar->num_peers--;
++ ath10k_peer_map_cleanup(ar, peer);
+ }
+ spin_unlock_bh(&ar->data_lock);
+ }
+@@ -6371,10 +6378,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
+ /* Clean up the peer object as well since we
+ * must have failed to do this above.
+ */
+- list_del(&peer->list);
+- ar->peer_map[i] = NULL;
+- kfree(peer);
+- ar->num_peers--;
++ ath10k_peer_map_cleanup(ar, peer);
+ }
+ }
+ spin_unlock_bh(&ar->data_lock);
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index e37de14bc502f..6d69cf69fd86e 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -367,33 +367,27 @@ ret:
+ }
+
+ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,
+- struct sk_buff *skb)
++ struct sk_buff *skb, u32 len)
+ {
+ uint32_t *pattern = (uint32_t *)skb->data;
+
+- switch (*pattern) {
+- case 0x33221199:
+- {
++ if (*pattern == 0x33221199 && len >= sizeof(struct htc_panic_bad_vaddr)) {
+ struct htc_panic_bad_vaddr *htc_panic;
+ htc_panic = (struct htc_panic_bad_vaddr *) skb->data;
+ dev_err(htc_handle->dev, "ath: firmware panic! "
+ "exccause: 0x%08x; pc: 0x%08x; badvaddr: 0x%08x.\n",
+ htc_panic->exccause, htc_panic->pc,
+ htc_panic->badvaddr);
+- break;
+- }
+- case 0x33221299:
+- {
++ return;
++ }
++ if (*pattern == 0x33221299) {
+ struct htc_panic_bad_epid *htc_panic;
+ htc_panic = (struct htc_panic_bad_epid *) skb->data;
+ dev_err(htc_handle->dev, "ath: firmware panic! "
+ "bad epid: 0x%08x\n", htc_panic->epid);
+- break;
+- }
+- default:
+- dev_err(htc_handle->dev, "ath: unknown panic pattern!\n");
+- break;
++ return;
+ }
++ dev_err(htc_handle->dev, "ath: unknown panic pattern!\n");
+ }
+
+ /*
+@@ -414,16 +408,26 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
+ if (!htc_handle || !skb)
+ return;
+
++ /* A valid message requires len >= 8.
++ *
++ * sizeof(struct htc_frame_hdr) == 8
++ * sizeof(struct htc_ready_msg) == 8
++ * sizeof(struct htc_panic_bad_vaddr) == 16
++ * sizeof(struct htc_panic_bad_epid) == 8
++ */
++ if (unlikely(len < sizeof(struct htc_frame_hdr)))
++ goto invalid;
+ htc_hdr = (struct htc_frame_hdr *) skb->data;
+ epid = htc_hdr->endpoint_id;
+
+ if (epid == 0x99) {
+- ath9k_htc_fw_panic_report(htc_handle, skb);
++ ath9k_htc_fw_panic_report(htc_handle, skb, len);
+ kfree_skb(skb);
+ return;
+ }
+
+ if (epid < 0 || epid >= ENDPOINT_MAX) {
++invalid:
+ if (pipe_id != USB_REG_IN_PIPE)
+ dev_kfree_skb_any(skb);
+ else
+@@ -435,21 +439,30 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
+
+ /* Handle trailer */
+ if (htc_hdr->flags & HTC_FLAGS_RECV_TRAILER) {
+- if (be32_to_cpu(*(__be32 *) skb->data) == 0x00C60000)
++ if (be32_to_cpu(*(__be32 *) skb->data) == 0x00C60000) {
+ /* Move past the Watchdog pattern */
+ htc_hdr = (struct htc_frame_hdr *)(skb->data + 4);
++ len -= 4;
++ }
+ }
+
+ /* Get the message ID */
++ if (unlikely(len < sizeof(struct htc_frame_hdr) + sizeof(__be16)))
++ goto invalid;
+ msg_id = (__be16 *) ((void *) htc_hdr +
+ sizeof(struct htc_frame_hdr));
+
+ /* Now process HTC messages */
+ switch (be16_to_cpu(*msg_id)) {
+ case HTC_MSG_READY_ID:
++ if (unlikely(len < sizeof(struct htc_ready_msg)))
++ goto invalid;
+ htc_process_target_rdy(htc_handle, htc_hdr);
+ break;
+ case HTC_MSG_CONNECT_SERVICE_RESPONSE_ID:
++ if (unlikely(len < sizeof(struct htc_frame_hdr) +
++ sizeof(struct htc_conn_svc_rspmsg)))
++ goto invalid;
+ htc_process_conn_rsp(htc_handle, htc_hdr);
+ break;
+ default:
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+index db4c541f58ae0..31bf2eb47b49f 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -270,6 +270,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
+ struct brcmf_pub *drvr = ifp->drvr;
+ struct ethhdr *eh;
+ int head_delta;
++ unsigned int tx_bytes = skb->len;
+
+ brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
+
+@@ -341,7 +342,7 @@ done:
+ ndev->stats.tx_dropped++;
+ } else {
+ ndev->stats.tx_packets++;
+- ndev->stats.tx_bytes += skb->len;
++ ndev->stats.tx_bytes += tx_bytes;
+ }
+
+ /* Return ok: we always eat the packet */
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+index ffa243e2e2d0f..581a23549ee51 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+@@ -163,12 +163,12 @@ static int brcmf_pno_set_random(struct brcmf_if *ifp, struct brcmf_pno_info *pi)
+ struct brcmf_pno_macaddr_le pfn_mac;
+ u8 *mac_addr = NULL;
+ u8 *mac_mask = NULL;
+- int err, i;
++ int err, i, ri;
+
+- for (i = 0; i < pi->n_reqs; i++)
+- if (pi->reqs[i]->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
+- mac_addr = pi->reqs[i]->mac_addr;
+- mac_mask = pi->reqs[i]->mac_addr_mask;
++ for (ri = 0; ri < pi->n_reqs; ri++)
++ if (pi->reqs[ri]->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
++ mac_addr = pi->reqs[ri]->mac_addr;
++ mac_mask = pi->reqs[ri]->mac_addr_mask;
+ break;
+ }
+
+@@ -190,7 +190,7 @@ static int brcmf_pno_set_random(struct brcmf_if *ifp, struct brcmf_pno_info *pi)
+ pfn_mac.mac[0] |= 0x02;
+
+ brcmf_dbg(SCAN, "enabling random mac: reqid=%llu mac=%pM\n",
+- pi->reqs[i]->reqid, pfn_mac.mac);
++ pi->reqs[ri]->reqid, pfn_mac.mac);
+ err = brcmf_fil_iovar_data_set(ifp, "pfn_macaddr", &pfn_mac,
+ sizeof(pfn_mac));
+ if (err)
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 7de92af2af029..c52802adb5b24 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3270,6 +3270,8 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
+
+ rx_status.band = data2->channel->band;
+ rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
++ if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
++ goto out;
+ rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
+
+ memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+index a567bc273ffc6..c9fa56b721b28 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3658,7 +3658,10 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
+ rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
+ rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+ rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
+- rt2800_bbp_write(rt2x00dev, 86, 0);
++ if (rt2x00_rt(rt2x00dev, RT6352))
++ rt2800_bbp_write(rt2x00dev, 86, 0x38);
++ else
++ rt2800_bbp_write(rt2x00dev, 86, 0);
+ }
+
+ if (rf->channel <= 14) {
+@@ -3838,7 +3841,8 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
+ reg += 2 * rt2x00dev->lna_gain;
+ rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
+
+- rt2800_iq_calibrate(rt2x00dev, rf->channel);
++ if (rt2x00_rt(rt2x00dev, RT5592))
++ rt2800_iq_calibrate(rt2x00dev, rf->channel);
+ }
+
+ bbp = rt2800_bbp_read(rt2x00dev, 4);
+@@ -5317,7 +5321,7 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
+ rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
+ } else if (rt2x00_rt(rt2x00dev, RT6352)) {
+ rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
+- rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
++ rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
+ rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
+ rt2800_register_write(rt2x00dev, MIMO_PS_CFG, 0x00000002);
+ rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x00150F0F);
+@@ -5569,6 +5573,27 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
+ reg = rt2800_register_read(rt2x00dev, US_CYC_CNT);
+ rt2x00_set_field32(®, US_CYC_CNT_CLOCK_CYCLE, 125);
+ rt2800_register_write(rt2x00dev, US_CYC_CNT, reg);
++ } else if (rt2x00_is_soc(rt2x00dev)) {
++ struct clk *clk = clk_get_sys("bus", NULL);
++ int rate;
++
++ if (IS_ERR(clk)) {
++ clk = clk_get_sys("cpu", NULL);
++
++ if (IS_ERR(clk)) {
++ rate = 125;
++ } else {
++ rate = clk_get_rate(clk) / 3000000;
++ clk_put(clk);
++ }
++ } else {
++ rate = clk_get_rate(clk) / 1000000;
++ clk_put(clk);
++ }
++
++ reg = rt2800_register_read(rt2x00dev, US_CYC_CNT);
++ rt2x00_set_field32(®, US_CYC_CNT_CLOCK_CYCLE, rate);
++ rt2800_register_write(rt2x00dev, US_CYC_CNT, reg);
+ }
+
+ reg = rt2800_register_read(rt2x00dev, HT_FBK_CFG0);
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index b80cff96dea1e..38f06ee98b356 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -1879,13 +1879,6 @@ static int rtl8xxxu_read_efuse(struct rtl8xxxu_priv *priv)
+
+ /* We have 8 bits to indicate validity */
+ map_addr = offset * 8;
+- if (map_addr >= EFUSE_MAP_LEN) {
+- dev_warn(dev, "%s: Illegal map_addr (%04x), "
+- "efuse corrupt!\n",
+- __func__, map_addr);
+- ret = -EINVAL;
+- goto exit;
+- }
+ for (i = 0; i < EFUSE_MAX_WORD_UNIT; i++) {
+ /* Check word enable condition in the section */
+ if (word_mask & BIT(i)) {
+@@ -1896,6 +1889,13 @@ static int rtl8xxxu_read_efuse(struct rtl8xxxu_priv *priv)
+ ret = rtl8xxxu_read_efuse8(priv, efuse_addr++, &val8);
+ if (ret)
+ goto exit;
++ if (map_addr >= EFUSE_MAP_LEN - 1) {
++ dev_warn(dev, "%s: Illegal map_addr (%04x), "
++ "efuse corrupt!\n",
++ __func__, map_addr);
++ ret = -EINVAL;
++ goto exit;
++ }
+ priv->efuse_wifi.raw[map_addr++] = val8;
+
+ ret = rtl8xxxu_read_efuse8(priv, efuse_addr++, &val8);
+@@ -2930,12 +2930,12 @@ bool rtl8xxxu_gen2_simularity_compare(struct rtl8xxxu_priv *priv,
+ }
+
+ if (!(simubitmap & 0x30) && priv->tx_paths > 1) {
+- /* path B RX OK */
++ /* path B TX OK */
+ for (i = 4; i < 6; i++)
+ result[3][i] = result[c1][i];
+ }
+
+- if (!(simubitmap & 0x30) && priv->tx_paths > 1) {
++ if (!(simubitmap & 0xc0) && priv->tx_paths > 1) {
+ /* path B RX OK */
+ for (i = 6; i < 8; i++)
+ result[3][i] = result[c1][i];
+@@ -4955,6 +4955,8 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw,
+ if (control && control->sta)
+ sta = control->sta;
+
++ queue = rtl8xxxu_queue_select(hw, skb);
++
+ tx_desc = skb_push(skb, tx_desc_size);
+
+ memset(tx_desc, 0, tx_desc_size);
+@@ -4967,7 +4969,6 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw,
+ is_broadcast_ether_addr(ieee80211_get_DA(hdr)))
+ tx_desc->txdw0 |= TXDESC_BROADMULTICAST;
+
+- queue = rtl8xxxu_queue_select(hw, skb);
+ tx_desc->txdw1 = cpu_to_le32(queue << TXDESC_QUEUE_SHIFT);
+
+ if (tx_info->control.hw_key) {
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 582c3b1904180..986912e680d86 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2320,7 +2320,6 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
+ nvme_init_subnqn(subsys, ctrl, id);
+ memcpy(subsys->serial, id->sn, sizeof(subsys->serial));
+ memcpy(subsys->model, id->mn, sizeof(subsys->model));
+- memcpy(subsys->firmware_rev, id->fr, sizeof(subsys->firmware_rev));
+ subsys->vendor_id = le16_to_cpu(id->vid);
+ subsys->cmic = id->cmic;
+
+@@ -2481,6 +2480,8 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
+ ctrl->quirks |= core_quirks[i].quirks;
+ }
+ }
++ memcpy(ctrl->subsys->firmware_rev, id->fr,
++ sizeof(ctrl->subsys->firmware_rev));
+
+ if (force_apst && (ctrl->quirks & NVME_QUIRK_NO_DEEPEST_PS)) {
+ dev_warn(ctrl->device, "forcibly allowing all power states due to nvme_core.force_apst -- use at your own risk\n");
+diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
+index d21fa04fa44d2..c35c61816903e 100644
+--- a/drivers/pci/setup-res.c
++++ b/drivers/pci/setup-res.c
+@@ -209,6 +209,17 @@ static int pci_revert_fw_address(struct resource *res, struct pci_dev *dev,
+
+ root = pci_find_parent_resource(dev, res);
+ if (!root) {
++ /*
++ * If dev is behind a bridge, accesses will only reach it
++ * if res is inside the relevant bridge window.
++ */
++ if (pci_upstream_bridge(dev))
++ return -ENXIO;
++
++ /*
++ * On the root bus, assume the host bridge will forward
++ * everything.
++ */
+ if (res->flags & IORESOURCE_IO)
+ root = &ioport_resource;
+ else
+diff --git a/drivers/phy/qualcomm/phy-qcom-usb-hsic.c b/drivers/phy/qualcomm/phy-qcom-usb-hsic.c
+index c110563a73cb9..00926df4bc5bb 100644
+--- a/drivers/phy/qualcomm/phy-qcom-usb-hsic.c
++++ b/drivers/phy/qualcomm/phy-qcom-usb-hsic.c
+@@ -57,8 +57,10 @@ static int qcom_usb_hsic_phy_power_on(struct phy *phy)
+
+ /* Configure pins for HSIC functionality */
+ pins_default = pinctrl_lookup_state(uphy->pctl, PINCTRL_STATE_DEFAULT);
+- if (IS_ERR(pins_default))
+- return PTR_ERR(pins_default);
++ if (IS_ERR(pins_default)) {
++ ret = PTR_ERR(pins_default);
++ goto err_ulpi;
++ }
+
+ ret = pinctrl_select_state(uphy->pctl, pins_default);
+ if (ret)
+diff --git a/drivers/platform/chrome/chromeos_laptop.c b/drivers/platform/chrome/chromeos_laptop.c
+index 24326eecd7876..096e8e5b2cdec 100644
+--- a/drivers/platform/chrome/chromeos_laptop.c
++++ b/drivers/platform/chrome/chromeos_laptop.c
+@@ -716,6 +716,7 @@ static int __init
+ chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop,
+ const struct chromeos_laptop *src)
+ {
++ struct i2c_peripheral *i2c_peripherals;
+ struct i2c_peripheral *i2c_dev;
+ struct i2c_board_info *info;
+ int i;
+@@ -724,17 +725,15 @@ chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop,
+ if (!src->num_i2c_peripherals)
+ return 0;
+
+- cros_laptop->i2c_peripherals = kmemdup(src->i2c_peripherals,
+- src->num_i2c_peripherals *
+- sizeof(*src->i2c_peripherals),
+- GFP_KERNEL);
+- if (!cros_laptop->i2c_peripherals)
++ i2c_peripherals = kmemdup(src->i2c_peripherals,
++ src->num_i2c_peripherals *
++ sizeof(*src->i2c_peripherals),
++ GFP_KERNEL);
++ if (!i2c_peripherals)
+ return -ENOMEM;
+
+- cros_laptop->num_i2c_peripherals = src->num_i2c_peripherals;
+-
+- for (i = 0; i < cros_laptop->num_i2c_peripherals; i++) {
+- i2c_dev = &cros_laptop->i2c_peripherals[i];
++ for (i = 0; i < src->num_i2c_peripherals; i++) {
++ i2c_dev = &i2c_peripherals[i];
+ info = &i2c_dev->board_info;
+
+ error = chromeos_laptop_setup_irq(i2c_dev);
+@@ -752,16 +751,19 @@ chromeos_laptop_prepare_i2c_peripherals(struct chromeos_laptop *cros_laptop,
+ }
+ }
+
++ cros_laptop->i2c_peripherals = i2c_peripherals;
++ cros_laptop->num_i2c_peripherals = src->num_i2c_peripherals;
++
+ return 0;
+
+ err_out:
+ while (--i >= 0) {
+- i2c_dev = &cros_laptop->i2c_peripherals[i];
++ i2c_dev = &i2c_peripherals[i];
+ info = &i2c_dev->board_info;
+ if (info->properties)
+ property_entries_free(info->properties);
+ }
+- kfree(cros_laptop->i2c_peripherals);
++ kfree(i2c_peripherals);
+ return error;
+ }
+
+diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c
+index d5bfcc602090a..42b31c549db00 100644
+--- a/drivers/platform/x86/msi-laptop.c
++++ b/drivers/platform/x86/msi-laptop.c
+@@ -609,11 +609,10 @@ static const struct dmi_system_id msi_dmi_table[] __initconst = {
+ {
+ .ident = "MSI S270",
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "MICRO-STAR INT'L CO.,LTD"),
++ DMI_MATCH(DMI_SYS_VENDOR, "MICRO-STAR INT"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MS-1013"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "0131"),
+- DMI_MATCH(DMI_CHASSIS_VENDOR,
+- "MICRO-STAR INT'L CO.,LTD")
++ DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-STAR INT")
+ },
+ .driver_data = &quirk_old_ec_model,
+ .callback = dmi_check_cb
+@@ -646,8 +645,7 @@ static const struct dmi_system_id msi_dmi_table[] __initconst = {
+ DMI_MATCH(DMI_SYS_VENDOR, "NOTEBOOK"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "SAM2000"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "0131"),
+- DMI_MATCH(DMI_CHASSIS_VENDOR,
+- "MICRO-STAR INT'L CO.,LTD")
++ DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-STAR INT")
+ },
+ .driver_data = &quirk_old_ec_model,
+ .callback = dmi_check_cb
+@@ -1061,8 +1059,7 @@ static int __init msi_init(void)
+ return -EINVAL;
+
+ /* Register backlight stuff */
+-
+- if (quirks->old_ec_model ||
++ if (quirks->old_ec_model &&
+ acpi_video_get_backlight_type() == acpi_backlight_vendor) {
+ struct backlight_properties props;
+ memset(&props, 0, sizeof(struct backlight_properties));
+@@ -1130,6 +1127,8 @@ fail_create_attr:
+ fail_create_group:
+ if (quirks->load_scm_model) {
+ i8042_remove_filter(msi_laptop_i8042_filter);
++ cancel_delayed_work_sync(&msi_touchpad_dwork);
++ input_unregister_device(msi_laptop_input_dev);
+ cancel_delayed_work_sync(&msi_rfkill_dwork);
+ cancel_work_sync(&msi_rfkill_work);
+ rfkill_cleanup();
+@@ -1150,6 +1149,7 @@ static void __exit msi_cleanup(void)
+ {
+ if (quirks->load_scm_model) {
+ i8042_remove_filter(msi_laptop_i8042_filter);
++ cancel_delayed_work_sync(&msi_touchpad_dwork);
+ input_unregister_device(msi_laptop_input_dev);
+ cancel_delayed_work_sync(&msi_rfkill_dwork);
+ cancel_work_sync(&msi_rfkill_work);
+diff --git a/drivers/power/supply/adp5061.c b/drivers/power/supply/adp5061.c
+index 939fd3d8fb1a8..1ad0443305997 100644
+--- a/drivers/power/supply/adp5061.c
++++ b/drivers/power/supply/adp5061.c
+@@ -428,11 +428,11 @@ static int adp5061_get_chg_type(struct adp5061_state *st,
+ if (ret < 0)
+ return ret;
+
+- chg_type = adp5061_chg_type[ADP5061_CHG_STATUS_1_CHG_STATUS(status1)];
+- if (chg_type > ADP5061_CHG_FAST_CV)
++ chg_type = ADP5061_CHG_STATUS_1_CHG_STATUS(status1);
++ if (chg_type >= ARRAY_SIZE(adp5061_chg_type))
+ val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
+ else
+- val->intval = chg_type;
++ val->intval = adp5061_chg_type[chg_type];
+
+ return ret;
+ }
+diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
+index 8cbfcce57a068..ae6721333c0fe 100644
+--- a/drivers/powercap/intel_rapl.c
++++ b/drivers/powercap/intel_rapl.c
+@@ -1068,6 +1068,9 @@ static u64 rapl_compute_time_window_core(struct rapl_package *rp, u64 value,
+ y = value & 0x1f;
+ value = (1 << y) * (4 + f) * rp->time_unit / 4;
+ } else {
++ if (value < rp->time_unit)
++ return 0;
++
+ do_div(value, rp->time_unit);
+ y = ilog2(value);
+ f = div64_u64(4 * (value - (1 << y)), 1 << y);
+diff --git a/drivers/regulator/qcom_rpm-regulator.c b/drivers/regulator/qcom_rpm-regulator.c
+index 88dc0b0f003c8..b64baea6d5335 100644
+--- a/drivers/regulator/qcom_rpm-regulator.c
++++ b/drivers/regulator/qcom_rpm-regulator.c
+@@ -820,6 +820,12 @@ static const struct rpm_regulator_data rpm_pm8018_regulators[] = {
+ };
+
+ static const struct rpm_regulator_data rpm_pm8058_regulators[] = {
++ { "s0", QCOM_RPM_PM8058_SMPS0, &pm8058_smps, "vdd_s0" },
++ { "s1", QCOM_RPM_PM8058_SMPS1, &pm8058_smps, "vdd_s1" },
++ { "s2", QCOM_RPM_PM8058_SMPS2, &pm8058_smps, "vdd_s2" },
++ { "s3", QCOM_RPM_PM8058_SMPS3, &pm8058_smps, "vdd_s3" },
++ { "s4", QCOM_RPM_PM8058_SMPS4, &pm8058_smps, "vdd_s4" },
++
+ { "l0", QCOM_RPM_PM8058_LDO0, &pm8058_nldo, "vdd_l0_l1_lvs" },
+ { "l1", QCOM_RPM_PM8058_LDO1, &pm8058_nldo, "vdd_l0_l1_lvs" },
+ { "l2", QCOM_RPM_PM8058_LDO2, &pm8058_pldo, "vdd_l2_l11_l12" },
+@@ -847,12 +853,6 @@ static const struct rpm_regulator_data rpm_pm8058_regulators[] = {
+ { "l24", QCOM_RPM_PM8058_LDO24, &pm8058_nldo, "vdd_l23_l24_l25" },
+ { "l25", QCOM_RPM_PM8058_LDO25, &pm8058_nldo, "vdd_l23_l24_l25" },
+
+- { "s0", QCOM_RPM_PM8058_SMPS0, &pm8058_smps, "vdd_s0" },
+- { "s1", QCOM_RPM_PM8058_SMPS1, &pm8058_smps, "vdd_s1" },
+- { "s2", QCOM_RPM_PM8058_SMPS2, &pm8058_smps, "vdd_s2" },
+- { "s3", QCOM_RPM_PM8058_SMPS3, &pm8058_smps, "vdd_s3" },
+- { "s4", QCOM_RPM_PM8058_SMPS4, &pm8058_smps, "vdd_s4" },
+-
+ { "lvs0", QCOM_RPM_PM8058_LVS0, &pm8058_switch, "vdd_l0_l1_lvs" },
+ { "lvs1", QCOM_RPM_PM8058_LVS1, &pm8058_switch, "vdd_l0_l1_lvs" },
+
+@@ -861,6 +861,12 @@ static const struct rpm_regulator_data rpm_pm8058_regulators[] = {
+ };
+
+ static const struct rpm_regulator_data rpm_pm8901_regulators[] = {
++ { "s0", QCOM_RPM_PM8901_SMPS0, &pm8901_ftsmps, "vdd_s0" },
++ { "s1", QCOM_RPM_PM8901_SMPS1, &pm8901_ftsmps, "vdd_s1" },
++ { "s2", QCOM_RPM_PM8901_SMPS2, &pm8901_ftsmps, "vdd_s2" },
++ { "s3", QCOM_RPM_PM8901_SMPS3, &pm8901_ftsmps, "vdd_s3" },
++ { "s4", QCOM_RPM_PM8901_SMPS4, &pm8901_ftsmps, "vdd_s4" },
++
+ { "l0", QCOM_RPM_PM8901_LDO0, &pm8901_nldo, "vdd_l0" },
+ { "l1", QCOM_RPM_PM8901_LDO1, &pm8901_pldo, "vdd_l1" },
+ { "l2", QCOM_RPM_PM8901_LDO2, &pm8901_pldo, "vdd_l2" },
+@@ -869,12 +875,6 @@ static const struct rpm_regulator_data rpm_pm8901_regulators[] = {
+ { "l5", QCOM_RPM_PM8901_LDO5, &pm8901_pldo, "vdd_l5" },
+ { "l6", QCOM_RPM_PM8901_LDO6, &pm8901_pldo, "vdd_l6" },
+
+- { "s0", QCOM_RPM_PM8901_SMPS0, &pm8901_ftsmps, "vdd_s0" },
+- { "s1", QCOM_RPM_PM8901_SMPS1, &pm8901_ftsmps, "vdd_s1" },
+- { "s2", QCOM_RPM_PM8901_SMPS2, &pm8901_ftsmps, "vdd_s2" },
+- { "s3", QCOM_RPM_PM8901_SMPS3, &pm8901_ftsmps, "vdd_s3" },
+- { "s4", QCOM_RPM_PM8901_SMPS4, &pm8901_ftsmps, "vdd_s4" },
+-
+ { "lvs0", QCOM_RPM_PM8901_LVS0, &pm8901_switch, "lvs0_in" },
+ { "lvs1", QCOM_RPM_PM8901_LVS1, &pm8901_switch, "lvs1_in" },
+ { "lvs2", QCOM_RPM_PM8901_LVS2, &pm8901_switch, "lvs2_in" },
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index 8fa0f0eaaf430..c10230ad90b29 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -1472,7 +1472,7 @@ static void qcom_glink_rx_close(struct qcom_glink *glink, unsigned int rcid)
+ cancel_work_sync(&channel->intent_work);
+
+ if (channel->rpdev) {
+- strncpy(chinfo.name, channel->name, sizeof(chinfo.name));
++ strscpy_pad(chinfo.name, channel->name, sizeof(chinfo.name));
+ chinfo.src = RPMSG_ADDR_ANY;
+ chinfo.dst = RPMSG_ADDR_ANY;
+
+diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
+index f4f950c231d69..61557e05d5ca6 100644
+--- a/drivers/rpmsg/qcom_smd.c
++++ b/drivers/rpmsg/qcom_smd.c
+@@ -1073,7 +1073,7 @@ static int qcom_smd_create_device(struct qcom_smd_channel *channel)
+
+ /* Assign public information to the rpmsg_device */
+ rpdev = &qsdev->rpdev;
+- strncpy(rpdev->id.name, channel->name, RPMSG_NAME_SIZE);
++ strscpy_pad(rpdev->id.name, channel->name, RPMSG_NAME_SIZE);
+ rpdev->src = RPMSG_ADDR_ANY;
+ rpdev->dst = RPMSG_ADDR_ANY;
+
+@@ -1304,7 +1304,7 @@ static void qcom_channel_state_worker(struct work_struct *work)
+
+ spin_unlock_irqrestore(&edge->channels_lock, flags);
+
+- strncpy(chinfo.name, channel->name, sizeof(chinfo.name));
++ strscpy_pad(chinfo.name, channel->name, sizeof(chinfo.name));
+ chinfo.src = RPMSG_ADDR_ANY;
+ chinfo.dst = RPMSG_ADDR_ANY;
+ rpmsg_unregister_device(&edge->dev, &chinfo);
+diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
+index 27521fc3ef5ab..ea2cd8ecc3a56 100644
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -2009,7 +2009,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
+ retval = pci_enable_device(pdev);
+ if (retval) {
+ TW_PRINTK(host, TW_DRIVER, 0x34, "Failed to enable pci device");
+- goto out_disable_device;
++ return -ENODEV;
+ }
+
+ pci_set_master(pdev);
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index b253523217b8b..01e27285b26ba 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -3345,11 +3345,6 @@ err2:
+ err1:
+ scsi_host_put(lport->host);
+ err0:
+- if (qedf) {
+- QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC, "Probe done.\n");
+-
+- clear_bit(QEDF_PROBING, &qedf->flags);
+- }
+ return rc;
+ }
+
+diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c
+index 9b20643ab49de..124a5d0ec05ca 100644
+--- a/drivers/scsi/stex.c
++++ b/drivers/scsi/stex.c
+@@ -673,16 +673,17 @@ stex_queuecommand_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
+ return 0;
+ case PASSTHRU_CMD:
+ if (cmd->cmnd[1] == PASSTHRU_GET_DRVVER) {
+- struct st_drvver ver;
++ const struct st_drvver ver = {
++ .major = ST_VER_MAJOR,
++ .minor = ST_VER_MINOR,
++ .oem = ST_OEM,
++ .build = ST_BUILD_VER,
++ .signature[0] = PASSTHRU_SIGNATURE,
++ .console_id = host->max_id - 1,
++ .host_no = hba->host->host_no,
++ };
+ size_t cp_len = sizeof(ver);
+
+- ver.major = ST_VER_MAJOR;
+- ver.minor = ST_VER_MINOR;
+- ver.oem = ST_OEM;
+- ver.build = ST_BUILD_VER;
+- ver.signature[0] = PASSTHRU_SIGNATURE;
+- ver.console_id = host->max_id - 1;
+- ver.host_no = hba->host->host_no;
+ cp_len = scsi_sg_copy_from_buffer(cmd, &ver, cp_len);
+ cmd->result = sizeof(ver) == cp_len ?
+ DID_OK << 16 | COMMAND_COMPLETE << 8 :
+diff --git a/drivers/soc/qcom/smem_state.c b/drivers/soc/qcom/smem_state.c
+index d5437ca76ed92..1502cf037a6ba 100644
+--- a/drivers/soc/qcom/smem_state.c
++++ b/drivers/soc/qcom/smem_state.c
+@@ -144,6 +144,7 @@ static void qcom_smem_state_release(struct kref *ref)
+ struct qcom_smem_state *state = container_of(ref, struct qcom_smem_state, refcount);
+
+ list_del(&state->list);
++ of_node_put(state->of_node);
+ kfree(state);
+ }
+
+@@ -177,7 +178,7 @@ struct qcom_smem_state *qcom_smem_state_register(struct device_node *of_node,
+
+ kref_init(&state->refcount);
+
+- state->of_node = of_node;
++ state->of_node = of_node_get(of_node);
+ state->ops = *ops;
+ state->priv = priv;
+
+diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c
+index 5304529b41c9e..a8a1dc49519e8 100644
+--- a/drivers/soc/qcom/smsm.c
++++ b/drivers/soc/qcom/smsm.c
+@@ -519,7 +519,7 @@ static int qcom_smsm_probe(struct platform_device *pdev)
+ for (id = 0; id < smsm->num_hosts; id++) {
+ ret = smsm_parse_ipc(smsm, id);
+ if (ret < 0)
+- return ret;
++ goto out_put;
+ }
+
+ /* Acquire the main SMSM state vector */
+@@ -527,13 +527,14 @@ static int qcom_smsm_probe(struct platform_device *pdev)
+ smsm->num_entries * sizeof(u32));
+ if (ret < 0 && ret != -EEXIST) {
+ dev_err(&pdev->dev, "unable to allocate shared state entry\n");
+- return ret;
++ goto out_put;
+ }
+
+ states = qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_SMSM_SHARED_STATE, NULL);
+ if (IS_ERR(states)) {
+ dev_err(&pdev->dev, "Unable to acquire shared state entry\n");
+- return PTR_ERR(states);
++ ret = PTR_ERR(states);
++ goto out_put;
+ }
+
+ /* Acquire the list of interrupt mask vectors */
+@@ -541,13 +542,14 @@ static int qcom_smsm_probe(struct platform_device *pdev)
+ ret = qcom_smem_alloc(QCOM_SMEM_HOST_ANY, SMEM_SMSM_CPU_INTR_MASK, size);
+ if (ret < 0 && ret != -EEXIST) {
+ dev_err(&pdev->dev, "unable to allocate smsm interrupt mask\n");
+- return ret;
++ goto out_put;
+ }
+
+ intr_mask = qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_SMSM_CPU_INTR_MASK, NULL);
+ if (IS_ERR(intr_mask)) {
+ dev_err(&pdev->dev, "unable to acquire shared memory interrupt mask\n");
+- return PTR_ERR(intr_mask);
++ ret = PTR_ERR(intr_mask);
++ goto out_put;
+ }
+
+ /* Setup the reference to the local state bits */
+@@ -558,7 +560,8 @@ static int qcom_smsm_probe(struct platform_device *pdev)
+ smsm->state = qcom_smem_state_register(local_node, &smsm_state_ops, smsm);
+ if (IS_ERR(smsm->state)) {
+ dev_err(smsm->dev, "failed to register qcom_smem_state\n");
+- return PTR_ERR(smsm->state);
++ ret = PTR_ERR(smsm->state);
++ goto out_put;
+ }
+
+ /* Register handlers for remote processor entries of interest. */
+@@ -588,16 +591,19 @@ static int qcom_smsm_probe(struct platform_device *pdev)
+ }
+
+ platform_set_drvdata(pdev, smsm);
++ of_node_put(local_node);
+
+ return 0;
+
+ unwind_interfaces:
++ of_node_put(node);
+ for (id = 0; id < smsm->num_entries; id++)
+ if (smsm->entries[id].domain)
+ irq_domain_remove(smsm->entries[id].domain);
+
+ qcom_smem_state_unregister(smsm->state);
+-
++out_put:
++ of_node_put(local_node);
+ return ret;
+ }
+
+diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c
+index 2eeb0fe2eed28..022f5bccef815 100644
+--- a/drivers/spi/spi-omap-100k.c
++++ b/drivers/spi/spi-omap-100k.c
+@@ -425,6 +425,7 @@ static int omap1_spi100k_probe(struct platform_device *pdev)
+ return status;
+
+ err_fck:
++ pm_runtime_disable(&pdev->dev);
+ clk_disable_unprepare(spi100k->fck);
+ err_ick:
+ clk_disable_unprepare(spi100k->ick);
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index cb74fd1af2053..1ca678bcb5279 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1172,8 +1172,10 @@ static int spi_qup_pm_resume_runtime(struct device *device)
+ return ret;
+
+ ret = clk_prepare_enable(controller->cclk);
+- if (ret)
++ if (ret) {
++ clk_disable_unprepare(controller->iclk);
+ return ret;
++ }
+
+ /* Disable clocks auto gaiting */
+ config = readl_relaxed(controller->base + QUP_CONFIG);
+@@ -1219,14 +1221,25 @@ static int spi_qup_resume(struct device *device)
+ return ret;
+
+ ret = clk_prepare_enable(controller->cclk);
+- if (ret)
++ if (ret) {
++ clk_disable_unprepare(controller->iclk);
+ return ret;
++ }
+
+ ret = spi_qup_set_state(controller, QUP_STATE_RESET);
+ if (ret)
+- return ret;
++ goto disable_clk;
+
+- return spi_master_resume(master);
++ ret = spi_master_resume(master);
++ if (ret)
++ goto disable_clk;
++
++ return 0;
++
++disable_clk:
++ clk_disable_unprepare(controller->cclk);
++ clk_disable_unprepare(controller->iclk);
++ return ret;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+
+diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
+index 1d948fee1a039..d9420561236c2 100644
+--- a/drivers/spi/spi-s3c64xx.c
++++ b/drivers/spi/spi-s3c64xx.c
+@@ -84,6 +84,7 @@
+ #define S3C64XX_SPI_ST_TX_FIFORDY (1<<0)
+
+ #define S3C64XX_SPI_PACKET_CNT_EN (1<<16)
++#define S3C64XX_SPI_PACKET_CNT_MASK GENMASK(15, 0)
+
+ #define S3C64XX_SPI_PND_TX_UNDERRUN_CLR (1<<4)
+ #define S3C64XX_SPI_PND_TX_OVERRUN_CLR (1<<3)
+@@ -654,6 +655,13 @@ static int s3c64xx_spi_prepare_message(struct spi_master *master,
+ return 0;
+ }
+
++static size_t s3c64xx_spi_max_transfer_size(struct spi_device *spi)
++{
++ struct spi_controller *ctlr = spi->controller;
++
++ return ctlr->can_dma ? S3C64XX_SPI_PACKET_CNT_MASK : SIZE_MAX;
++}
++
+ static int s3c64xx_spi_transfer_one(struct spi_master *master,
+ struct spi_device *spi,
+ struct spi_transfer *xfer)
+@@ -1118,6 +1126,7 @@ static int s3c64xx_spi_probe(struct platform_device *pdev)
+ master->prepare_transfer_hardware = s3c64xx_spi_prepare_transfer;
+ master->prepare_message = s3c64xx_spi_prepare_message;
+ master->transfer_one = s3c64xx_spi_transfer_one;
++ master->max_transfer_size = s3c64xx_spi_max_transfer_size;
+ master->num_chipselect = sci->num_cs;
+ master->dma_alignment = 8;
+ master->bits_per_word_mask = SPI_BPW_MASK(32) | SPI_BPW_MASK(16) |
+diff --git a/drivers/spmi/spmi-pmic-arb.c b/drivers/spmi/spmi-pmic-arb.c
+index 360b8218f322c..0eb156aa4975c 100644
+--- a/drivers/spmi/spmi-pmic-arb.c
++++ b/drivers/spmi/spmi-pmic-arb.c
+@@ -867,7 +867,8 @@ static int pmic_arb_read_apid_map_v5(struct spmi_pmic_arb *pmic_arb)
+ * version 5, there is more than one APID mapped to each PPID.
+ * The owner field for each of these mappings specifies the EE which is
+ * allowed to write to the APID. The owner of the last (highest) APID
+- * for a given PPID will receive interrupts from the PPID.
++ * which has the IRQ owner bit set for a given PPID will receive
++ * interrupts from the PPID.
+ */
+ for (i = 0; ; i++, apidd++) {
+ offset = pmic_arb->ver_ops->apid_map_offset(i);
+@@ -890,16 +891,16 @@ static int pmic_arb_read_apid_map_v5(struct spmi_pmic_arb *pmic_arb)
+ apid = pmic_arb->ppid_to_apid[ppid] & ~PMIC_ARB_APID_VALID;
+ prev_apidd = &pmic_arb->apid_data[apid];
+
+- if (valid && is_irq_ee &&
+- prev_apidd->write_ee == pmic_arb->ee) {
++ if (!valid || apidd->write_ee == pmic_arb->ee) {
++ /* First PPID mapping or one for this EE */
++ pmic_arb->ppid_to_apid[ppid] = i | PMIC_ARB_APID_VALID;
++ } else if (valid && is_irq_ee &&
++ prev_apidd->write_ee == pmic_arb->ee) {
+ /*
+ * Duplicate PPID mapping after the one for this EE;
+ * override the irq owner
+ */
+ prev_apidd->irq_ee = apidd->irq_ee;
+- } else if (!valid || is_irq_ee) {
+- /* First PPID mapping or duplicate for another EE */
+- pmic_arb->ppid_to_apid[ppid] = i | PMIC_ARB_APID_VALID;
+ }
+
+ apidd->ppid = ppid;
+diff --git a/drivers/staging/mt7621-spi/spi-mt7621.c b/drivers/staging/mt7621-spi/spi-mt7621.c
+index 75ed48f60c8c7..b73823830e3a7 100644
+--- a/drivers/staging/mt7621-spi/spi-mt7621.c
++++ b/drivers/staging/mt7621-spi/spi-mt7621.c
+@@ -442,11 +442,9 @@ static int mt7621_spi_probe(struct platform_device *pdev)
+ return PTR_ERR(base);
+
+ clk = devm_clk_get(&pdev->dev, NULL);
+- if (IS_ERR(clk)) {
+- dev_err(&pdev->dev, "unable to get SYS clock, err=%d\n",
+- status);
+- return PTR_ERR(clk);
+- }
++ if (IS_ERR(clk))
++ return dev_err_probe(&pdev->dev, PTR_ERR(clk),
++ "unable to get SYS clock\n");
+
+ status = clk_prepare_enable(clk);
+ if (status)
+diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
+index 76f434c1c088a..4c4432adb6c95 100644
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -567,7 +567,7 @@ err_free_rd:
+ kfree(desc->rd_info);
+
+ err_free_desc:
+- while (--i) {
++ while (i--) {
+ desc = &priv->aRD0Ring[i];
+ device_free_rx_buf(priv, desc);
+ kfree(desc->rd_info);
+@@ -613,7 +613,7 @@ err_free_rd:
+ kfree(desc->rd_info);
+
+ err_free_desc:
+- while (--i) {
++ while (i--) {
+ desc = &priv->aRD1Ring[i];
+ device_free_rx_buf(priv, desc);
+ kfree(desc->rd_info);
+@@ -677,7 +677,7 @@ static int device_init_td0_ring(struct vnt_private *priv)
+ return 0;
+
+ err_free_desc:
+- while (--i) {
++ while (i--) {
+ desc = &priv->apTD0Rings[i];
+ kfree(desc->td_info);
+ }
+@@ -717,7 +717,7 @@ static int device_init_td1_ring(struct vnt_private *priv)
+ return 0;
+
+ err_free_desc:
+- while (--i) {
++ while (i--) {
+ desc = &priv->apTD1Rings[i];
+ kfree(desc->td_info);
+ }
+diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
+index 8e8328347c0ed..dffefcde0628f 100644
+--- a/drivers/thermal/intel_powerclamp.c
++++ b/drivers/thermal/intel_powerclamp.c
+@@ -549,9 +549,7 @@ static int start_power_clamp(void)
+ get_online_cpus();
+
+ /* prefer BSP */
+- control_cpu = 0;
+- if (!cpu_online(control_cpu))
+- control_cpu = smp_processor_id();
++ control_cpu = cpumask_first(cpu_online_mask);
+
+ clamping = true;
+ schedule_delayed_work(&poll_pkg_cstate_work, 0);
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index f11d1202566e6..6fc89888a52ed 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -3269,8 +3269,13 @@ static void serial8250_console_restore(struct uart_8250_port *up)
+ unsigned int baud, quot, frac = 0;
+
+ termios.c_cflag = port->cons->cflag;
+- if (port->state->port.tty && termios.c_cflag == 0)
++ termios.c_ispeed = port->cons->ispeed;
++ termios.c_ospeed = port->cons->ospeed;
++ if (port->state->port.tty && termios.c_cflag == 0) {
+ termios.c_cflag = port->state->port.tty->termios.c_cflag;
++ termios.c_ispeed = port->state->port.tty->termios.c_ispeed;
++ termios.c_ospeed = port->state->port.tty->termios.c_ospeed;
++ }
+
+ baud = serial8250_get_baud_rate(port, &termios, NULL);
+ quot = serial8250_get_divisor(port, baud, &frac);
+diff --git a/drivers/tty/serial/jsm/jsm_driver.c b/drivers/tty/serial/jsm/jsm_driver.c
+index 592e51d8944ee..07e9be9865c78 100644
+--- a/drivers/tty/serial/jsm/jsm_driver.c
++++ b/drivers/tty/serial/jsm/jsm_driver.c
+@@ -212,7 +212,8 @@ static int jsm_probe_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ break;
+ default:
+- return -ENXIO;
++ rc = -ENXIO;
++ goto out_kfree_brd;
+ }
+
+ rc = request_irq(brd->irq, brd->bd_ops->intr, IRQF_SHARED, "JSM", brd);
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index c22bd40fc6f0b..ded9f16d08ebe 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -365,6 +365,8 @@ static irqreturn_t cdns_uart_isr(int irq, void *dev_id)
+ isrstatus &= ~CDNS_UART_IXR_TXEMPTY;
+ }
+
++ isrstatus &= port->read_status_mask;
++ isrstatus &= ~port->ignore_status_mask;
+ /*
+ * Skip RX processing if RX is disabled as RXEMPTY will never be set
+ * as read bytes will not be removed from the FIFO.
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index f8f2de7899a94..dd7947547054a 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -438,6 +438,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1532, 0x0116), .driver_info =
+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
++ /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */
++ { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x17ef, 0x1019), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */
+ { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM },
+
+diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
+index 2a1868b2d24cf..dd5eb6202fe11 100644
+--- a/drivers/usb/gadget/function/f_printer.c
++++ b/drivers/usb/gadget/function/f_printer.c
+@@ -87,7 +87,7 @@ struct printer_dev {
+ u8 printer_cdev_open;
+ wait_queue_head_t wait;
+ unsigned q_len;
+- char *pnp_string; /* We don't own memory! */
++ char **pnp_string; /* We don't own memory! */
+ struct usb_function function;
+ };
+
+@@ -963,16 +963,16 @@ static int printer_func_setup(struct usb_function *f,
+ if ((wIndex>>8) != dev->interface)
+ break;
+
+- if (!dev->pnp_string) {
++ if (!*dev->pnp_string) {
+ value = 0;
+ break;
+ }
+- value = strlen(dev->pnp_string);
++ value = strlen(*dev->pnp_string);
+ buf[0] = (value >> 8) & 0xFF;
+ buf[1] = value & 0xFF;
+- memcpy(buf + 2, dev->pnp_string, value);
++ memcpy(buf + 2, *dev->pnp_string, value);
+ DBG(dev, "1284 PNP String: %x %s\n", value,
+- dev->pnp_string);
++ *dev->pnp_string);
+ break;
+
+ case GET_PORT_STATUS: /* Get Port Status */
+@@ -1435,7 +1435,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)
+ kref_init(&dev->kref);
+ ++opts->refcnt;
+ dev->minor = opts->minor;
+- dev->pnp_string = opts->pnp_string;
++ dev->pnp_string = &opts->pnp_string;
+ dev->q_len = opts->q_len;
+ mutex_unlock(&opts->lock);
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 798823ce2b34f..7de21722d4553 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -650,7 +650,7 @@ struct xhci_stream_info *xhci_alloc_stream_info(struct xhci_hcd *xhci,
+ num_stream_ctxs, &stream_info->ctx_array_dma,
+ mem_flags);
+ if (!stream_info->stream_ctx_array)
+- goto cleanup_ctx;
++ goto cleanup_ring_array;
+ memset(stream_info->stream_ctx_array, 0,
+ sizeof(struct xhci_stream_ctx)*num_stream_ctxs);
+
+@@ -711,6 +711,11 @@ cleanup_rings:
+ }
+ xhci_free_command(xhci, stream_info->free_streams_command);
+ cleanup_ctx:
++ xhci_free_stream_ctx(xhci,
++ stream_info->num_stream_ctxs,
++ stream_info->stream_ctx_array,
++ stream_info->ctx_array_dma);
++cleanup_ring_array:
+ kfree(stream_info->stream_rings);
+ cleanup_info:
+ kfree(stream_info);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 7fef6d9ed04f8..3a1ed63d73349 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1155,7 +1155,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ /* re-initialize the HC on Restore Error, or Host Controller Error */
+ if (temp & (STS_SRE | STS_HCE)) {
+ reinit_xhc = true;
+- xhci_warn(xhci, "xHC error in resume, USBSTS 0x%x, Reinit\n", temp);
++ if (!xhci->broken_suspend)
++ xhci_warn(xhci, "xHC error in resume, USBSTS 0x%x, Reinit\n", temp);
+ }
+
+ if (reinit_xhc) {
+diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
+index bb24527f3c701..ba2b6fbab9b8f 100644
+--- a/drivers/usb/misc/idmouse.c
++++ b/drivers/usb/misc/idmouse.c
+@@ -178,10 +178,6 @@ static int idmouse_create_image(struct usb_idmouse *dev)
+ bytes_read += bulk_read;
+ }
+
+- /* reset the device */
+-reset:
+- ftip_command(dev, FTIP_RELEASE, 0, 0);
+-
+ /* check for valid image */
+ /* right border should be black (0x00) */
+ for (bytes_read = sizeof(HEADER)-1 + WIDTH-1; bytes_read < IMGSIZE; bytes_read += WIDTH)
+@@ -193,6 +189,10 @@ reset:
+ if (dev->bulk_in_buffer[bytes_read] != 0xFF)
+ return -EAGAIN;
+
++ /* reset the device */
++reset:
++ ftip_command(dev, FTIP_RELEASE, 0, 0);
++
+ /* should be IMGSIZE == 65040 */
+ dev_dbg(&dev->interface->dev, "read %d bytes fingerprint data\n",
+ bytes_read);
+diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
+index f48a23adbc35d..094e812e9e692 100644
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -1268,6 +1268,11 @@ static int mon_bin_mmap(struct file *filp, struct vm_area_struct *vma)
+ {
+ /* don't do anything here: "fault" will set up page table entries */
+ vma->vm_ops = &mon_bin_vm_ops;
++
++ if (vma->vm_flags & VM_WRITE)
++ return -EPERM;
++
++ vma->vm_flags &= ~VM_MAYWRITE;
+ vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
+ vma->vm_private_data = filp->private_data;
+ mon_bin_vma_open(vma);
+diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
+index 4622400ba4ddb..8e83995fc3bd2 100644
+--- a/drivers/usb/musb/musb_gadget.c
++++ b/drivers/usb/musb/musb_gadget.c
+@@ -760,6 +760,9 @@ static void rxstate(struct musb *musb, struct musb_request *req)
+ musb_writew(epio, MUSB_RXCSR, csr);
+
+ buffer_aint_mapped:
++ fifo_count = min_t(unsigned int,
++ request->length - request->actual,
++ (unsigned int)fifo_count);
+ musb_read_fifo(musb_ep->hw_ep, fifo_count, (u8 *)
+ (request->buf + request->actual));
+ request->actual += fifo_count;
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 623b54a5cd498..1afffa92420ae 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1304,8 +1304,7 @@ static u32 get_ftdi_divisor(struct tty_struct *tty,
+ case 38400: div_value = ftdi_sio_b38400; break;
+ case 57600: div_value = ftdi_sio_b57600; break;
+ case 115200: div_value = ftdi_sio_b115200; break;
+- } /* baud */
+- if (div_value == 0) {
++ default:
+ dev_dbg(dev, "%s - Baudrate (%d) requested is not supported\n",
+ __func__, baud);
+ div_value = ftdi_sio_b9600;
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index 3f437f07356b4..b7ba15d0ed6c1 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -177,6 +177,7 @@ static const struct usb_device_id id_table[] = {
+ {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+ {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */
+ {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */
++ {DEVICE_SWI(0x413c, 0x81c2)}, /* Dell Wireless 5811e */
+ {DEVICE_SWI(0x413c, 0x81cb)}, /* Dell Wireless 5816e QDL */
+ {DEVICE_SWI(0x413c, 0x81cc)}, /* Dell Wireless 5816e */
+ {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 6a59950a63a03..b270be141b8e3 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1275,12 +1275,6 @@ UNUSUAL_DEV( 0x090a, 0x1200, 0x0000, 0x9999,
+ USB_SC_RBC, USB_PR_BULK, NULL,
+ 0 ),
+
+-UNUSUAL_DEV(0x090c, 0x1000, 0x1100, 0x1100,
+- "Samsung",
+- "Flash Drive FIT",
+- USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+- US_FL_MAX_SECTORS_64),
+-
+ /* aeb */
+ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
+ "Feiya",
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 9f67717eaf453..08d49f34c785b 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -354,7 +354,7 @@ vhost_vsock_alloc_pkt(struct vhost_virtqueue *vq,
+ return NULL;
+ }
+
+- pkt->buf = kmalloc(pkt->len, GFP_KERNEL);
++ pkt->buf = kvmalloc(pkt->len, GFP_KERNEL);
+ if (!pkt->buf) {
+ kfree(pkt);
+ return NULL;
+diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
+index da54a84d2e62e..8d31b0806cb72 100644
+--- a/drivers/video/fbdev/smscufx.c
++++ b/drivers/video/fbdev/smscufx.c
+@@ -140,6 +140,8 @@ static int ufx_submit_urb(struct ufx_data *dev, struct urb * urb, size_t len);
+ static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size);
+ static void ufx_free_urb_list(struct ufx_data *dev);
+
++static DEFINE_MUTEX(disconnect_mutex);
++
+ /* reads a control register */
+ static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data)
+ {
+@@ -1073,9 +1075,13 @@ static int ufx_ops_open(struct fb_info *info, int user)
+ if (user == 0 && !console)
+ return -EBUSY;
+
++ mutex_lock(&disconnect_mutex);
++
+ /* If the USB device is gone, we don't accept new opens */
+- if (dev->virtualized)
++ if (dev->virtualized) {
++ mutex_unlock(&disconnect_mutex);
+ return -ENODEV;
++ }
+
+ dev->fb_count++;
+
+@@ -1099,6 +1105,8 @@ static int ufx_ops_open(struct fb_info *info, int user)
+ pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d",
+ info->node, user, info, dev->fb_count);
+
++ mutex_unlock(&disconnect_mutex);
++
+ return 0;
+ }
+
+@@ -1746,6 +1754,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface)
+ {
+ struct ufx_data *dev;
+
++ mutex_lock(&disconnect_mutex);
++
+ dev = usb_get_intfdata(interface);
+
+ pr_debug("USB disconnect starting\n");
+@@ -1766,6 +1776,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface)
+ kref_put(&dev->kref, ufx_free);
+
+ /* consider ufx_data freed */
++
++ mutex_unlock(&disconnect_mutex);
+ }
+
+ static struct usb_driver ufx_driver = {
+diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c
+index 9e88e3f594c29..9530ed46f4358 100644
+--- a/drivers/video/fbdev/stifb.c
++++ b/drivers/video/fbdev/stifb.c
+@@ -1257,7 +1257,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+
+ /* limit fbsize to max visible screen size */
+ if (fix->smem_len > yres*fix->line_length)
+- fix->smem_len = yres*fix->line_length;
++ fix->smem_len = ALIGN(yres*fix->line_length, 4*1024*1024);
+
+ fix->accel = FB_ACCEL_NONE;
+
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 7bda5586e4332..886ab4beb5797 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -1035,6 +1035,21 @@ out_add_root:
+ fs_info->qgroup_rescan_running = true;
+ btrfs_queue_work(fs_info->qgroup_rescan_workers,
+ &fs_info->qgroup_rescan_work);
++ } else {
++ /*
++ * We have set both BTRFS_FS_QUOTA_ENABLED and
++ * BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with
++ * -EINPROGRESS. That can happen because someone started the
++ * rescan worker by calling quota rescan ioctl before we
++ * attempted to initialize the rescan worker. Failure due to
++ * quotas disabled in the meanwhile is not possible, because
++ * we are holding a write lock on fs_info->subvol_sem, which
++ * is also acquired when disabling quotas.
++ * Ignore such error, and any other error would need to undo
++ * everything we did in the transaction we just committed.
++ */
++ ASSERT(ret == -EINPROGRESS);
++ ret = 0;
+ }
+
+ out_free_path:
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 4ce2752c8b71c..95d7906fb9eaf 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -446,6 +446,12 @@ int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
+ if (dentry->d_name.len > NAME_MAX)
+ return -ENAMETOOLONG;
+
++ /*
++ * Do not truncate the file, since atomic_open is called before the
++ * permission check. The caller will do the truncation afterward.
++ */
++ flags &= ~O_TRUNC;
++
+ if (flags & O_CREAT) {
+ if (ceph_quota_is_max_files_exceeded(dir))
+ return -EDQUOT;
+@@ -478,9 +484,7 @@ int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
+
+ req->r_parent = dir;
+ set_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags);
+- err = ceph_mdsc_do_request(mdsc,
+- (flags & (O_CREAT|O_TRUNC)) ? dir : NULL,
+- req);
++ err = ceph_mdsc_do_request(mdsc, (flags & O_CREAT) ? dir : NULL, req);
+ err = ceph_handle_snapdir(req, dentry, err);
+ if (err)
+ goto out_req;
+diff --git a/fs/dlm/ast.c b/fs/dlm/ast.c
+index 47ee66d701098..0b6fc9f8e8a76 100644
+--- a/fs/dlm/ast.c
++++ b/fs/dlm/ast.c
+@@ -200,13 +200,13 @@ void dlm_add_cb(struct dlm_lkb *lkb, uint32_t flags, int mode, int status,
+ if (!prev_seq) {
+ kref_get(&lkb->lkb_ref);
+
++ mutex_lock(&ls->ls_cb_mutex);
+ if (test_bit(LSFL_CB_DELAY, &ls->ls_flags)) {
+- mutex_lock(&ls->ls_cb_mutex);
+ list_add(&lkb->lkb_cb_list, &ls->ls_cb_delay);
+- mutex_unlock(&ls->ls_cb_mutex);
+ } else {
+ queue_work(ls->ls_callback_wq, &lkb->lkb_cb_work);
+ }
++ mutex_unlock(&ls->ls_cb_mutex);
+ }
+ out:
+ mutex_unlock(&lkb->lkb_cb_mutex);
+@@ -286,7 +286,9 @@ void dlm_callback_stop(struct dlm_ls *ls)
+
+ void dlm_callback_suspend(struct dlm_ls *ls)
+ {
++ mutex_lock(&ls->ls_cb_mutex);
+ set_bit(LSFL_CB_DELAY, &ls->ls_flags);
++ mutex_unlock(&ls->ls_cb_mutex);
+
+ if (ls->ls_callback_wq)
+ flush_workqueue(ls->ls_callback_wq);
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index 35bfb681bf133..d4e204473e76b 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -2890,24 +2890,24 @@ static int set_unlock_args(uint32_t flags, void *astarg, struct dlm_args *args)
+ static int validate_lock_args(struct dlm_ls *ls, struct dlm_lkb *lkb,
+ struct dlm_args *args)
+ {
+- int rv = -EINVAL;
++ int rv = -EBUSY;
+
+ if (args->flags & DLM_LKF_CONVERT) {
+- if (lkb->lkb_flags & DLM_IFL_MSTCPY)
++ if (lkb->lkb_status != DLM_LKSTS_GRANTED)
+ goto out;
+
+- if (args->flags & DLM_LKF_QUECVT &&
+- !__quecvt_compat_matrix[lkb->lkb_grmode+1][args->mode+1])
++ if (lkb->lkb_wait_type)
+ goto out;
+
+- rv = -EBUSY;
+- if (lkb->lkb_status != DLM_LKSTS_GRANTED)
++ if (is_overlap(lkb))
+ goto out;
+
+- if (lkb->lkb_wait_type)
++ rv = -EINVAL;
++ if (lkb->lkb_flags & DLM_IFL_MSTCPY)
+ goto out;
+
+- if (is_overlap(lkb))
++ if (args->flags & DLM_LKF_QUECVT &&
++ !__quecvt_compat_matrix[lkb->lkb_grmode+1][args->mode+1])
+ goto out;
+ }
+
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 52d155b4e7334..d8b7e97dd450b 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -501,6 +501,12 @@ loff_t ext4_llseek(struct file *file, loff_t offset, int whence)
+ inode_unlock_shared(inode);
+ break;
+ }
++ /*
++ * Make sure inline data cannot be created anymore since we are going
++ * to allocate blocks for DIO. We know the inode does not have any
++ * inline data now because ext4_dio_supported() checked for that.
++ */
++ ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
+
+ if (offset < 0)
+ return offset;
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 34cee87a0ac7d..95139c992a540 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1310,6 +1310,13 @@ retry_grab:
+ page = grab_cache_page_write_begin(mapping, index, flags);
+ if (!page)
+ return -ENOMEM;
++ /*
++ * The same as page allocation, we prealloc buffer heads before
++ * starting the handle.
++ */
++ if (!page_has_buffers(page))
++ create_empty_buffers(page, inode->i_sb->s_blocksize, 0);
++
+ unlock_page(page);
+
+ retry_journal:
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index dd23c97ae951d..8737d1bcdb6ef 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -2092,7 +2092,7 @@ retry:
+ goto out;
+ }
+
+- if (ext4_blocks_count(es) == n_blocks_count)
++ if (ext4_blocks_count(es) == n_blocks_count && n_blocks_count_retry == 0)
+ goto out;
+
+ err = ext4_alloc_flex_bg_array(sb, n_group + 1);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index bf120842a3074..f00cc301da369 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3112,6 +3112,7 @@ static int ext4_lazyinit_thread(void *arg)
+ unsigned long next_wakeup, cur;
+
+ BUG_ON(NULL == eli);
++ set_freezable();
+
+ cont_thread:
+ while (true) {
+@@ -5721,7 +5722,7 @@ static int ext4_write_info(struct super_block *sb, int type)
+ handle_t *handle;
+
+ /* Data block + inode block */
+- handle = ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2);
++ handle = ext4_journal_start_sb(sb, EXT4_HT_QUOTA, 2);
+ if (IS_ERR(handle))
+ return PTR_ERR(handle);
+ ret = dquot_commit_info(sb, type);
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index a70cd2580eae1..36d6b561b524f 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -717,9 +717,8 @@ void f2fs_drop_extent_tree(struct inode *inode)
+ if (!f2fs_may_extent_tree(inode))
+ return;
+
+- set_inode_flag(inode, FI_NO_EXTENT);
+-
+ write_lock(&et->lock);
++ set_inode_flag(inode, FI_NO_EXTENT);
+ __free_extent_tree(sbi, et);
+ if (et->largest.len) {
+ et->largest.len = 0;
+diff --git a/fs/inode.c b/fs/inode.c
+index c9eb5041ffae1..5df2e8ee23eda 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -166,8 +166,6 @@ int inode_init_always(struct super_block *sb, struct inode *inode)
+ inode->i_wb_frn_history = 0;
+ #endif
+
+- if (security_inode_alloc(inode))
+- goto out;
+ spin_lock_init(&inode->i_lock);
+ lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);
+
+@@ -195,11 +193,12 @@ int inode_init_always(struct super_block *sb, struct inode *inode)
+ inode->i_fsnotify_mask = 0;
+ #endif
+ inode->i_flctx = NULL;
++
++ if (unlikely(security_inode_alloc(inode)))
++ return -ENOMEM;
+ this_cpu_inc(nr_inodes);
+
+ return 0;
+-out:
+- return -ENOMEM;
+ }
+ EXPORT_SYMBOL(inode_init_always);
+
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index f67c5de1aeb8d..96b79bd906313 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -3594,7 +3594,7 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr,
+ if (resp->xdr.buf->page_len &&
+ test_bit(RQ_SPLICE_OK, &resp->rqstp->rq_flags)) {
+ WARN_ON_ONCE(1);
+- return nfserr_resource;
++ return nfserr_serverfault;
+ }
+ xdr_commit_encode(xdr);
+
+diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
+index 35b0bfe9324f2..cf01aa55dd44c 100644
+--- a/fs/nilfs2/inode.c
++++ b/fs/nilfs2/inode.c
+@@ -340,6 +340,7 @@ struct inode *nilfs_new_inode(struct inode *dir, umode_t mode)
+ struct inode *inode;
+ struct nilfs_inode_info *ii;
+ struct nilfs_root *root;
++ struct buffer_head *bh;
+ int err = -ENOMEM;
+ ino_t ino;
+
+@@ -355,11 +356,26 @@ struct inode *nilfs_new_inode(struct inode *dir, umode_t mode)
+ ii->i_state = BIT(NILFS_I_NEW);
+ ii->i_root = root;
+
+- err = nilfs_ifile_create_inode(root->ifile, &ino, &ii->i_bh);
++ err = nilfs_ifile_create_inode(root->ifile, &ino, &bh);
+ if (unlikely(err))
+ goto failed_ifile_create_inode;
+ /* reference count of i_bh inherits from nilfs_mdt_read_block() */
+
++ if (unlikely(ino < NILFS_USER_INO)) {
++ nilfs_msg(sb, KERN_WARNING,
++ "inode bitmap is inconsistent for reserved inodes");
++ do {
++ brelse(bh);
++ err = nilfs_ifile_create_inode(root->ifile, &ino, &bh);
++ if (unlikely(err))
++ goto failed_ifile_create_inode;
++ } while (ino < NILFS_USER_INO);
++
++ nilfs_msg(sb, KERN_INFO,
++ "repaired inode bitmap for reserved inodes");
++ }
++ ii->i_bh = bh;
++
+ atomic64_inc(&root->inodes_count);
+ inode_init_owner(inode, dir, mode);
+ inode->i_ino = ino;
+@@ -451,6 +467,8 @@ int nilfs_read_inode_common(struct inode *inode,
+ inode->i_atime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec);
+ inode->i_ctime.tv_nsec = le32_to_cpu(raw_inode->i_ctime_nsec);
+ inode->i_mtime.tv_nsec = le32_to_cpu(raw_inode->i_mtime_nsec);
++ if (nilfs_is_metadata_file_inode(inode) && !S_ISREG(inode->i_mode))
++ return -EIO; /* this inode is for metadata and corrupted */
+ if (inode->i_nlink == 0)
+ return -ESTALE; /* this inode is deleted */
+
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index eb3ac76190887..535543ab4e26a 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -880,9 +880,11 @@ static int nilfs_segctor_create_checkpoint(struct nilfs_sc_info *sci)
+ nilfs_mdt_mark_dirty(nilfs->ns_cpfile);
+ nilfs_cpfile_put_checkpoint(
+ nilfs->ns_cpfile, nilfs->ns_cno, bh_cp);
+- } else
+- WARN_ON(err == -EINVAL || err == -ENOENT);
+-
++ } else if (err == -EINVAL || err == -ENOENT) {
++ nilfs_error(sci->sc_super,
++ "checkpoint creation failed due to metadata corruption.");
++ err = -EIO;
++ }
+ return err;
+ }
+
+@@ -896,7 +898,11 @@ static int nilfs_segctor_fill_in_checkpoint(struct nilfs_sc_info *sci)
+ err = nilfs_cpfile_get_checkpoint(nilfs->ns_cpfile, nilfs->ns_cno, 0,
+ &raw_cp, &bh_cp);
+ if (unlikely(err)) {
+- WARN_ON(err == -EINVAL || err == -ENOENT);
++ if (err == -EINVAL || err == -ENOENT) {
++ nilfs_error(sci->sc_super,
++ "checkpoint finalization failed due to metadata corruption.");
++ err = -EIO;
++ }
+ goto failed_ibh;
+ }
+ raw_cp->cp_snapshot_list.ssl_next = 0;
+@@ -2786,10 +2792,9 @@ int nilfs_attach_log_writer(struct super_block *sb, struct nilfs_root *root)
+ inode_attach_wb(nilfs->ns_bdev->bd_inode, NULL);
+
+ err = nilfs_segctor_start_thread(nilfs->ns_writer);
+- if (err) {
+- kfree(nilfs->ns_writer);
+- nilfs->ns_writer = NULL;
+- }
++ if (unlikely(err))
++ nilfs_detach_log_writer(sb);
++
+ return err;
+ }
+
+diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c
+index 833cd3e3758bf..ae2ed96d4847f 100644
+--- a/fs/quota/quota_tree.c
++++ b/fs/quota/quota_tree.c
+@@ -79,6 +79,35 @@ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf)
+ return ret;
+ }
+
++static inline int do_check_range(struct super_block *sb, const char *val_name,
++ uint val, uint min_val, uint max_val)
++{
++ if (val < min_val || val > max_val) {
++ quota_error(sb, "Getting %s %u out of range %u-%u",
++ val_name, val, min_val, max_val);
++ return -EUCLEAN;
++ }
++
++ return 0;
++}
++
++static int check_dquot_block_header(struct qtree_mem_dqinfo *info,
++ struct qt_disk_dqdbheader *dh)
++{
++ int err = 0;
++
++ err = do_check_range(info->dqi_sb, "dqdh_next_free",
++ le32_to_cpu(dh->dqdh_next_free), 0,
++ info->dqi_blocks - 1);
++ if (err)
++ return err;
++ err = do_check_range(info->dqi_sb, "dqdh_prev_free",
++ le32_to_cpu(dh->dqdh_prev_free), 0,
++ info->dqi_blocks - 1);
++
++ return err;
++}
++
+ /* Remove empty block from list and return it */
+ static int get_free_dqblk(struct qtree_mem_dqinfo *info)
+ {
+@@ -93,6 +122,9 @@ static int get_free_dqblk(struct qtree_mem_dqinfo *info)
+ ret = read_blk(info, blk, buf);
+ if (ret < 0)
+ goto out_buf;
++ ret = check_dquot_block_header(info, dh);
++ if (ret)
++ goto out_buf;
+ info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free);
+ }
+ else {
+@@ -240,6 +272,9 @@ static uint find_free_dqentry(struct qtree_mem_dqinfo *info,
+ *err = read_blk(info, blk, buf);
+ if (*err < 0)
+ goto out_buf;
++ *err = check_dquot_block_header(info, dh);
++ if (*err)
++ goto out_buf;
+ } else {
+ blk = get_free_dqblk(info);
+ if ((int)blk < 0) {
+@@ -432,6 +467,9 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot,
+ goto out_buf;
+ }
+ dh = (struct qt_disk_dqdbheader *)buf;
++ ret = check_dquot_block_header(info, dh);
++ if (ret)
++ goto out_buf;
+ le16_add_cpu(&dh->dqdh_entries, -1);
+ if (!le16_to_cpu(dh->dqdh_entries)) { /* Block got free? */
+ ret = remove_free_dqentry(info, buf, blk);
+diff --git a/fs/splice.c b/fs/splice.c
+index ef1604e307f18..fd28c7da3c837 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -899,15 +899,17 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+ {
+ struct pipe_inode_info *pipe;
+ long ret, bytes;
++ umode_t i_mode;
+ size_t len;
+ int i, flags, more;
+
+ /*
+- * We require the input to be seekable, as we don't want to randomly
+- * drop data for eg socket -> socket splicing. Use the piped splicing
+- * for that!
++ * We require the input being a regular file, as we don't want to
++ * randomly drop data for eg socket -> socket splicing. Use the
++ * piped splicing for that!
+ */
+- if (unlikely(!(in->f_mode & FMODE_LSEEK)))
++ i_mode = file_inode(in)->i_mode;
++ if (unlikely(!S_ISREG(i_mode) && !S_ISBLK(i_mode)))
+ return -EINVAL;
+
+ /*
+diff --git a/include/linux/ata.h b/include/linux/ata.h
+index 40d150ad7e071..981eb1cb7e497 100644
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -581,6 +581,18 @@ struct ata_bmdma_prd {
+ ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \
+ ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \
+ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 2)))
++#define ata_id_has_devslp(id) \
++ ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \
++ ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \
++ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8)))
++#define ata_id_has_ncq_autosense(id) \
++ ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \
++ ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \
++ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7)))
++#define ata_id_has_dipm(id) \
++ ((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \
++ ((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \
++ ((id)[ATA_ID_FEATURE_SUPP] & (1 << 3)))
+ #define ata_id_iordy_disable(id) ((id)[ATA_ID_CAPABILITY] & (1 << 10))
+ #define ata_id_has_iordy(id) ((id)[ATA_ID_CAPABILITY] & (1 << 11))
+ #define ata_id_u32(id,n) \
+@@ -593,9 +605,6 @@ struct ata_bmdma_prd {
+
+ #define ata_id_cdb_intr(id) (((id)[ATA_ID_CONFIG] & 0x60) == 0x20)
+ #define ata_id_has_da(id) ((id)[ATA_ID_SATA_CAPABILITY_2] & (1 << 4))
+-#define ata_id_has_devslp(id) ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8))
+-#define ata_id_has_ncq_autosense(id) \
+- ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7))
+
+ static inline bool ata_id_has_hipm(const u16 *id)
+ {
+@@ -607,17 +616,6 @@ static inline bool ata_id_has_hipm(const u16 *id)
+ return val & (1 << 9);
+ }
+
+-static inline bool ata_id_has_dipm(const u16 *id)
+-{
+- u16 val = id[ATA_ID_FEATURE_SUPP];
+-
+- if (val == 0 || val == 0xffff)
+- return false;
+-
+- return val & (1 << 3);
+-}
+-
+-
+ static inline bool ata_id_has_fua(const u16 *id)
+ {
+ if ((id[ATA_ID_CFSSE] & 0xC000) != 0x4000)
+@@ -786,16 +784,21 @@ static inline bool ata_id_has_read_log_dma_ext(const u16 *id)
+
+ static inline bool ata_id_has_sense_reporting(const u16 *id)
+ {
+- if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15)))
++ if (!(id[ATA_ID_CFS_ENABLE_2] & BIT(15)))
++ return false;
++ if ((id[ATA_ID_COMMAND_SET_3] & (BIT(15) | BIT(14))) != BIT(14))
+ return false;
+- return id[ATA_ID_COMMAND_SET_3] & (1 << 6);
++ return id[ATA_ID_COMMAND_SET_3] & BIT(6);
+ }
+
+ static inline bool ata_id_sense_reporting_enabled(const u16 *id)
+ {
+- if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15)))
++ if (!ata_id_has_sense_reporting(id))
++ return false;
++ /* ata_id_has_sense_reporting() == true, word 86 must have bit 15 set */
++ if ((id[ATA_ID_COMMAND_SET_4] & (BIT(15) | BIT(14))) != BIT(14))
+ return false;
+- return id[ATA_ID_COMMAND_SET_4] & (1 << 6);
++ return id[ATA_ID_COMMAND_SET_4] & BIT(6);
+ }
+
+ /**
+diff --git a/include/linux/dynamic_debug.h b/include/linux/dynamic_debug.h
+index b3419da1a7766..77a16b2eb42fd 100644
+--- a/include/linux/dynamic_debug.h
++++ b/include/linux/dynamic_debug.h
+@@ -168,7 +168,7 @@ static inline int ddebug_remove_module(const char *mod)
+ static inline int ddebug_dyndbg_module_param_cb(char *param, char *val,
+ const char *modname)
+ {
+- if (strstr(param, "dyndbg")) {
++ if (!strcmp(param, "dyndbg")) {
+ /* avoid pr_warn(), which wants pr_fmt() fully defined */
+ printk(KERN_WARNING "dyndbg param is supported only in "
+ "CONFIG_DYNAMIC_DEBUG builds\n");
+diff --git a/include/linux/iova.h b/include/linux/iova.h
+index 84fbe73d2ec08..8d4616c532daf 100644
+--- a/include/linux/iova.h
++++ b/include/linux/iova.h
+@@ -133,7 +133,7 @@ static inline unsigned long iova_pfn(struct iova_domain *iovad, dma_addr_t iova)
+ return iova >> iova_shift(iovad);
+ }
+
+-#if IS_ENABLED(CONFIG_IOMMU_IOVA)
++#if IS_REACHABLE(CONFIG_IOMMU_IOVA)
+ int iova_cache_get(void);
+ void iova_cache_put(void);
+
+diff --git a/include/linux/once.h b/include/linux/once.h
+index ae6f4eb41cbe7..bb58e1c3aa034 100644
+--- a/include/linux/once.h
++++ b/include/linux/once.h
+@@ -5,10 +5,18 @@
+ #include <linux/types.h>
+ #include <linux/jump_label.h>
+
++/* Helpers used from arbitrary contexts.
++ * Hard irqs are blocked, be cautious.
++ */
+ bool __do_once_start(bool *done, unsigned long *flags);
+ void __do_once_done(bool *done, struct static_key_true *once_key,
+ unsigned long *flags, struct module *mod);
+
++/* Variant for process contexts only. */
++bool __do_once_slow_start(bool *done);
++void __do_once_slow_done(bool *done, struct static_key_true *once_key,
++ struct module *mod);
++
+ /* Call a function exactly once. The idea of DO_ONCE() is to perform
+ * a function call such as initialization of random seeds, etc, only
+ * once, where DO_ONCE() can live in the fast-path. After @func has
+@@ -52,9 +60,29 @@ void __do_once_done(bool *done, struct static_key_true *once_key,
+ ___ret; \
+ })
+
++/* Variant of DO_ONCE() for process/sleepable contexts. */
++#define DO_ONCE_SLOW(func, ...) \
++ ({ \
++ bool ___ret = false; \
++ static bool __section(".data.once") ___done = false; \
++ static DEFINE_STATIC_KEY_TRUE(___once_key); \
++ if (static_branch_unlikely(&___once_key)) { \
++ ___ret = __do_once_slow_start(&___done); \
++ if (unlikely(___ret)) { \
++ func(__VA_ARGS__); \
++ __do_once_slow_done(&___done, &___once_key, \
++ THIS_MODULE); \
++ } \
++ } \
++ ___ret; \
++ })
++
+ #define get_random_once(buf, nbytes) \
+ DO_ONCE(get_random_bytes, (buf), (nbytes))
+ #define get_random_once_wait(buf, nbytes) \
+ DO_ONCE(get_random_bytes_wait, (buf), (nbytes)) \
+
++#define get_random_slow_once(buf, nbytes) \
++ DO_ONCE_SLOW(get_random_bytes, (buf), (nbytes))
++
+ #endif /* _LINUX_ONCE_H */
+diff --git a/include/linux/tcp.h b/include/linux/tcp.h
+index 1192f1e76015f..621ab5a7fb8fa 100644
+--- a/include/linux/tcp.h
++++ b/include/linux/tcp.h
+@@ -263,7 +263,7 @@ struct tcp_sock {
+ u32 packets_out; /* Packets which are "in flight" */
+ u32 retrans_out; /* Retransmitted packets out */
+ u32 max_packets_out; /* max packets_out in last window */
+- u32 max_packets_seq; /* right edge of max_packets_out flight */
++ u32 cwnd_usage_seq; /* right edge of cwnd usage tracking flight */
+
+ u16 urg_data; /* Saved octet of OOB data and control flags */
+ u8 ecn_flags; /* ECN status bits. */
+diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
+index c4b31601cd536..588c86f677960 100644
+--- a/include/net/ieee802154_netdev.h
++++ b/include/net/ieee802154_netdev.h
+@@ -23,6 +23,22 @@
+ #ifndef IEEE802154_NETDEVICE_H
+ #define IEEE802154_NETDEVICE_H
+
++#define IEEE802154_REQUIRED_SIZE(struct_type, member) \
++ (offsetof(typeof(struct_type), member) + \
++ sizeof(((typeof(struct_type) *)(NULL))->member))
++
++#define IEEE802154_ADDR_OFFSET \
++ offsetof(typeof(struct sockaddr_ieee802154), addr)
++
++#define IEEE802154_MIN_NAMELEN (IEEE802154_ADDR_OFFSET + \
++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, addr_type))
++
++#define IEEE802154_NAMELEN_SHORT (IEEE802154_ADDR_OFFSET + \
++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, short_addr))
++
++#define IEEE802154_NAMELEN_LONG (IEEE802154_ADDR_OFFSET + \
++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, hwaddr))
++
+ #include <net/af_ieee802154.h>
+ #include <linux/netdevice.h>
+ #include <linux/skbuff.h>
+@@ -173,6 +189,33 @@ static inline void ieee802154_devaddr_to_raw(void *raw, __le64 addr)
+ memcpy(raw, &temp, IEEE802154_ADDR_LEN);
+ }
+
++static inline int
++ieee802154_sockaddr_check_size(struct sockaddr_ieee802154 *daddr, int len)
++{
++ struct ieee802154_addr_sa *sa;
++ int ret = 0;
++
++ sa = &daddr->addr;
++ if (len < IEEE802154_MIN_NAMELEN)
++ return -EINVAL;
++ switch (sa->addr_type) {
++ case IEEE802154_ADDR_NONE:
++ break;
++ case IEEE802154_ADDR_SHORT:
++ if (len < IEEE802154_NAMELEN_SHORT)
++ ret = -EINVAL;
++ break;
++ case IEEE802154_ADDR_LONG:
++ if (len < IEEE802154_NAMELEN_LONG)
++ ret = -EINVAL;
++ break;
++ default:
++ ret = -EINVAL;
++ break;
++ }
++ return ret;
++}
++
+ static inline void ieee802154_addr_from_sa(struct ieee802154_addr *a,
+ const struct ieee802154_addr_sa *sa)
+ {
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 98946f90781da..30315a03b4abd 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -401,7 +401,7 @@ struct sock {
+ #ifdef CONFIG_XFRM
+ struct xfrm_policy __rcu *sk_policy[2];
+ #endif
+- struct dst_entry *sk_rx_dst;
++ struct dst_entry __rcu *sk_rx_dst;
+ struct dst_entry __rcu *sk_dst_cache;
+ atomic_t sk_omem_alloc;
+ int sk_sndbuf;
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 436ad4bc9d4c4..487b6c5f53f49 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1231,11 +1231,14 @@ static inline bool tcp_is_cwnd_limited(const struct sock *sk)
+ {
+ const struct tcp_sock *tp = tcp_sk(sk);
+
++ if (tp->is_cwnd_limited)
++ return true;
++
+ /* If in slow start, ensure cwnd grows to twice what was ACKed. */
+ if (tcp_in_slow_start(tp))
+ return tp->snd_cwnd < 2 * tp->max_packets_out;
+
+- return tp->is_cwnd_limited;
++ return false;
+ }
+
+ /* BBR congestion control needs pacing.
+diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
+index c891ada3c5c25..3ed69ed35c60e 100644
+--- a/include/scsi/scsi_cmnd.h
++++ b/include/scsi/scsi_cmnd.h
+@@ -227,7 +227,7 @@ static inline struct scsi_data_buffer *scsi_out(struct scsi_cmnd *cmd)
+ }
+
+ static inline int scsi_sg_copy_from_buffer(struct scsi_cmnd *cmd,
+- void *buf, int buflen)
++ const void *buf, int buflen)
+ {
+ return sg_copy_from_buffer(scsi_sglist(cmd), scsi_sg_count(cmd),
+ buf, buflen);
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 471cc5c117a5c..62e05b6283c0f 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -1660,7 +1660,7 @@ static int btf_struct_resolve(struct btf_verifier_env *env,
+ if (v->next_member) {
+ const struct btf_type *last_member_type;
+ const struct btf_member *last_member;
+- u16 last_member_type_id;
++ u32 last_member_type_id;
+
+ last_member = btf_type_member(v->t) + v->next_member - 1;
+ last_member_type_id = last_member->type;
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index e940c1f65938d..02e5bdb82a9a1 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -2325,7 +2325,9 @@ static int bpf_task_fd_query(const union bpf_attr *attr,
+ if (attr->task_fd_query.flags != 0)
+ return -EINVAL;
+
++ rcu_read_lock();
+ task = get_pid_task(find_vpid(pid), PIDTYPE_PID);
++ rcu_read_unlock();
+ if (!task)
+ return -ENOENT;
+
+diff --git a/kernel/gcov/gcc_4_7.c b/kernel/gcov/gcc_4_7.c
+index 5b9e76117ded1..bb6ccf456e2df 100644
+--- a/kernel/gcov/gcc_4_7.c
++++ b/kernel/gcov/gcc_4_7.c
+@@ -33,6 +33,13 @@
+
+ #define GCOV_TAG_FUNCTION_LENGTH 3
+
++/* Since GCC 12.1 sizes are in BYTES and not in WORDS (4B). */
++#if (__GNUC__ >= 12)
++#define GCOV_UNIT_SIZE 4
++#else
++#define GCOV_UNIT_SIZE 1
++#endif
++
+ static struct gcov_info *gcov_info_head;
+
+ /**
+@@ -439,12 +446,18 @@ static size_t convert_to_gcda(char *buffer, struct gcov_info *info)
+ pos += store_gcov_u32(buffer, pos, info->version);
+ pos += store_gcov_u32(buffer, pos, info->stamp);
+
++#if (__GNUC__ >= 12)
++ /* Use zero as checksum of the compilation unit. */
++ pos += store_gcov_u32(buffer, pos, 0);
++#endif
++
+ for (fi_idx = 0; fi_idx < info->n_functions; fi_idx++) {
+ fi_ptr = info->functions[fi_idx];
+
+ /* Function record. */
+ pos += store_gcov_u32(buffer, pos, GCOV_TAG_FUNCTION);
+- pos += store_gcov_u32(buffer, pos, GCOV_TAG_FUNCTION_LENGTH);
++ pos += store_gcov_u32(buffer, pos,
++ GCOV_TAG_FUNCTION_LENGTH * GCOV_UNIT_SIZE);
+ pos += store_gcov_u32(buffer, pos, fi_ptr->ident);
+ pos += store_gcov_u32(buffer, pos, fi_ptr->lineno_checksum);
+ pos += store_gcov_u32(buffer, pos, fi_ptr->cfg_checksum);
+@@ -458,7 +471,8 @@ static size_t convert_to_gcda(char *buffer, struct gcov_info *info)
+ /* Counter record. */
+ pos += store_gcov_u32(buffer, pos,
+ GCOV_TAG_FOR_COUNTER(ct_idx));
+- pos += store_gcov_u32(buffer, pos, ci_ptr->num * 2);
++ pos += store_gcov_u32(buffer, pos,
++ ci_ptr->num * 2 * GCOV_UNIT_SIZE);
+
+ for (cv_idx = 0; cv_idx < ci_ptr->num; cv_idx++) {
+ pos += store_gcov_u64(buffer, pos,
+diff --git a/kernel/livepatch/transition.c b/kernel/livepatch/transition.c
+index 5bc349805e033..20277ad6b7d2b 100644
+--- a/kernel/livepatch/transition.c
++++ b/kernel/livepatch/transition.c
+@@ -563,9 +563,23 @@ void klp_reverse_transition(void)
+ /* Called from copy_process() during fork */
+ void klp_copy_process(struct task_struct *child)
+ {
+- child->patch_state = current->patch_state;
+
+- /* TIF_PATCH_PENDING gets copied in setup_thread_stack() */
++ /*
++ * The parent process may have gone through a KLP transition since
++ * the thread flag was copied in setup_thread_stack earlier. Bring
++ * the task flag up to date with the parent here.
++ *
++ * The operation is serialized against all klp_*_transition()
++ * operations by the tasklist_lock. The only exception is
++ * klp_update_patch_state(current), but we cannot race with
++ * that because we are current.
++ */
++ if (test_tsk_thread_flag(current, TIF_PATCH_PENDING))
++ set_tsk_thread_flag(child, TIF_PATCH_PENDING);
++ else
++ clear_tsk_thread_flag(child, TIF_PATCH_PENDING);
++
++ child->patch_state = current->patch_state;
+ }
+
+ /*
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index d2272fff2f591..ba7d361878aac 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -5054,8 +5054,12 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
+
+ if (filter_hash) {
+ orig_hash = &iter->ops->func_hash->filter_hash;
+- if (iter->tr && !list_empty(&iter->tr->mod_trace))
+- iter->hash->flags |= FTRACE_HASH_FL_MOD;
++ if (iter->tr) {
++ if (list_empty(&iter->tr->mod_trace))
++ iter->hash->flags &= ~FTRACE_HASH_FL_MOD;
++ else
++ iter->hash->flags |= FTRACE_HASH_FL_MOD;
++ }
+ } else
+ orig_hash = &iter->ops->func_hash->notrace_hash;
+
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 987d3447bf2a1..a0353c8f08912 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -542,8 +542,9 @@ static void rb_wake_up_waiters(struct irq_work *work)
+ struct rb_irq_work *rbwork = container_of(work, struct rb_irq_work, work);
+
+ wake_up_all(&rbwork->waiters);
+- if (rbwork->wakeup_full) {
++ if (rbwork->full_waiters_pending || rbwork->wakeup_full) {
+ rbwork->wakeup_full = false;
++ rbwork->full_waiters_pending = false;
+ wake_up_all(&rbwork->full_waiters);
+ }
+ }
+@@ -2156,6 +2157,9 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
+ /* Mark the rest of the page with padding */
+ rb_event_set_padding(event);
+
++ /* Make sure the padding is visible before the write update */
++ smp_wmb();
++
+ /* Set the write back to the previous setting */
+ local_sub(length, &tail_page->write);
+ return;
+@@ -2167,6 +2171,9 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
+ /* time delta must be non zero */
+ event->time_delta = 1;
+
++ /* Make sure the padding is visible before the tail_page->write update */
++ smp_wmb();
++
+ /* Set write to end of buffer */
+ length = (tail + length) - BUF_PAGE_SIZE;
+ local_sub(length, &tail_page->write);
+@@ -3812,6 +3819,33 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
+ arch_spin_unlock(&cpu_buffer->lock);
+ local_irq_restore(flags);
+
++ /*
++ * The writer has preempt disable, wait for it. But not forever
++ * Although, 1 second is pretty much "forever"
++ */
++#define USECS_WAIT 1000000
++ for (nr_loops = 0; nr_loops < USECS_WAIT; nr_loops++) {
++ /* If the write is past the end of page, a writer is still updating it */
++ if (likely(!reader || rb_page_write(reader) <= BUF_PAGE_SIZE))
++ break;
++
++ udelay(1);
++
++ /* Get the latest version of the reader write value */
++ smp_rmb();
++ }
++
++ /* The writer is not moving forward? Something is wrong */
++ if (RB_WARN_ON(cpu_buffer, nr_loops == USECS_WAIT))
++ reader = NULL;
++
++ /*
++ * Make sure we see any padding after the write update
++ * (see rb_reset_tail())
++ */
++ smp_rmb();
++
++
+ return reader;
+ }
+
+@@ -4770,7 +4804,15 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
+ unsigned int pos = 0;
+ unsigned int size;
+
+- if (full)
++ /*
++ * If a full page is expected, this can still be returned
++ * if there's been a previous partial read and the
++ * rest of the page can be read and the commit page is off
++ * the reader page.
++ */
++ if (full &&
++ (!read || (len < (commit - read)) ||
++ cpu_buffer->reader_page == cpu_buffer->commit_page))
+ goto out_unlock;
+
+ if (len > (commit - read))
+diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
+index 9305ff43fc155..fec610703095f 100644
+--- a/lib/dynamic_debug.c
++++ b/lib/dynamic_debug.c
+@@ -327,10 +327,6 @@ static int ddebug_parse_query(char *words[], int nwords,
+ }
+ memset(query, 0, sizeof(*query));
+
+- if (modname)
+- /* support $modname.dyndbg=<multiple queries> */
+- query->module = modname;
+-
+ for (i = 0; i < nwords; i += 2) {
+ if (!strcmp(words[i], "func")) {
+ rc = check_set(&query->function, words[i+1], "func");
+@@ -379,6 +375,13 @@ static int ddebug_parse_query(char *words[], int nwords,
+ if (rc)
+ return rc;
+ }
++ if (!query->module && modname)
++ /*
++ * support $modname.dyndbg=<multiple queries>, when
++ * not given in the query itself
++ */
++ query->module = modname;
++
+ vpr_info_dq(query, "parsed");
+ return 0;
+ }
+diff --git a/lib/once.c b/lib/once.c
+index 59149bf3bfb4a..351f66aad310a 100644
+--- a/lib/once.c
++++ b/lib/once.c
+@@ -66,3 +66,33 @@ void __do_once_done(bool *done, struct static_key_true *once_key,
+ once_disable_jump(once_key, mod);
+ }
+ EXPORT_SYMBOL(__do_once_done);
++
++static DEFINE_MUTEX(once_mutex);
++
++bool __do_once_slow_start(bool *done)
++ __acquires(once_mutex)
++{
++ mutex_lock(&once_mutex);
++ if (*done) {
++ mutex_unlock(&once_mutex);
++ /* Keep sparse happy by restoring an even lock count on
++ * this mutex. In case we return here, we don't call into
++ * __do_once_done but return early in the DO_ONCE_SLOW() macro.
++ */
++ __acquire(once_mutex);
++ return false;
++ }
++
++ return true;
++}
++EXPORT_SYMBOL(__do_once_slow_start);
++
++void __do_once_slow_done(bool *done, struct static_key_true *once_key,
++ struct module *mod)
++ __releases(once_mutex)
++{
++ *done = true;
++ mutex_unlock(&once_mutex);
++ once_disable_jump(once_key, mod);
++}
++EXPORT_SYMBOL(__do_once_slow_done);
+diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
+index b69d88b88d2e4..ccd2c377bf83c 100644
+--- a/net/bluetooth/hci_sysfs.c
++++ b/net/bluetooth/hci_sysfs.c
+@@ -48,6 +48,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
+
+ BT_DBG("conn %p", conn);
+
++ if (device_is_registered(&conn->dev))
++ return;
++
+ dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
+
+ if (device_add(&conn->dev) < 0) {
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 65d20bdff0238..5c965f7b17094 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -63,6 +63,9 @@ static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
+
+ static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
+ struct sk_buff_head *skbs, u8 event);
++static void l2cap_retrans_timeout(struct work_struct *work);
++static void l2cap_monitor_timeout(struct work_struct *work);
++static void l2cap_ack_timeout(struct work_struct *work);
+
+ static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
+ {
+@@ -470,6 +473,9 @@ struct l2cap_chan *l2cap_chan_create(void)
+ write_unlock(&chan_list_lock);
+
+ INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
++ INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
++ INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
++ INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
+
+ chan->state = BT_OPEN;
+
+@@ -3154,10 +3160,6 @@ int l2cap_ertm_init(struct l2cap_chan *chan)
+ chan->rx_state = L2CAP_RX_STATE_RECV;
+ chan->tx_state = L2CAP_TX_STATE_XMIT;
+
+- INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
+- INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
+- INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
+-
+ skb_queue_head_init(&chan->srej_q);
+
+ err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
+@@ -4047,6 +4049,12 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
+ }
+ }
+
++ chan = l2cap_chan_hold_unless_zero(chan);
++ if (!chan) {
++ err = -EBADSLT;
++ goto unlock;
++ }
++
+ err = 0;
+
+ l2cap_chan_lock(chan);
+@@ -4076,6 +4084,7 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
+ }
+
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+
+ unlock:
+ mutex_unlock(&conn->chan_lock);
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 3c825b158fb57..74e555a22de75 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -273,6 +273,7 @@ static void bcm_can_tx(struct bcm_op *op)
+ struct sk_buff *skb;
+ struct net_device *dev;
+ struct canfd_frame *cf = op->frames + op->cfsiz * op->currframe;
++ int err;
+
+ /* no target device? => exit */
+ if (!op->ifindex)
+@@ -297,11 +298,11 @@ static void bcm_can_tx(struct bcm_op *op)
+ /* send with loopback */
+ skb->dev = dev;
+ can_skb_set_owner(skb, op->sk);
+- can_send(skb, 1);
++ err = can_send(skb, 1);
++ if (!err)
++ op->frames_abs++;
+
+- /* update statistics */
+ op->currframe++;
+- op->frames_abs++;
+
+ /* reached last frame? */
+ if (op->currframe >= op->nframes)
+diff --git a/net/core/stream.c b/net/core/stream.c
+index 3d98774cf1285..7b411a91a81cf 100644
+--- a/net/core/stream.c
++++ b/net/core/stream.c
+@@ -159,7 +159,8 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
+ *timeo_p = current_timeo;
+ }
+ out:
+- remove_wait_queue(sk_sleep(sk), &wait);
++ if (!sock_flag(sk, SOCK_DEAD))
++ remove_wait_queue(sk_sleep(sk), &wait);
+ return err;
+
+ do_error:
+diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
+index 14c6fac039f9e..76ad550dd48ec 100644
+--- a/net/ieee802154/socket.c
++++ b/net/ieee802154/socket.c
+@@ -213,8 +213,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *_uaddr, int len)
+ int err = 0;
+ struct net_device *dev = NULL;
+
+- if (len < sizeof(*uaddr))
+- return -EINVAL;
++ err = ieee802154_sockaddr_check_size(uaddr, len);
++ if (err < 0)
++ return err;
+
+ uaddr = (struct sockaddr_ieee802154 *)_uaddr;
+ if (uaddr->family != AF_IEEE802154)
+@@ -284,6 +285,10 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ err = -EMSGSIZE;
+ goto out_dev;
+ }
++ if (!size) {
++ err = 0;
++ goto out_dev;
++ }
+
+ hlen = LL_RESERVED_SPACE(dev);
+ tlen = dev->needed_tailroom;
+@@ -509,7 +514,8 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
+
+ ro->bound = 0;
+
+- if (len < sizeof(*addr))
++ err = ieee802154_sockaddr_check_size(addr, len);
++ if (err < 0)
+ goto out;
+
+ if (addr->family != AF_IEEE802154)
+@@ -580,8 +586,9 @@ static int dgram_connect(struct sock *sk, struct sockaddr *uaddr,
+ struct dgram_sock *ro = dgram_sk(sk);
+ int err = 0;
+
+- if (len < sizeof(*addr))
+- return -EINVAL;
++ err = ieee802154_sockaddr_check_size(addr, len);
++ if (err < 0)
++ return err;
+
+ if (addr->family != AF_IEEE802154)
+ return -EINVAL;
+@@ -620,6 +627,7 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ struct ieee802154_mac_cb *cb;
+ struct dgram_sock *ro = dgram_sk(sk);
+ struct ieee802154_addr dst_addr;
++ DECLARE_SOCKADDR(struct sockaddr_ieee802154*, daddr, msg->msg_name);
+ int hlen, tlen;
+ int err;
+
+@@ -628,10 +636,20 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ return -EOPNOTSUPP;
+ }
+
+- if (!ro->connected && !msg->msg_name)
+- return -EDESTADDRREQ;
+- else if (ro->connected && msg->msg_name)
+- return -EISCONN;
++ if (msg->msg_name) {
++ if (ro->connected)
++ return -EISCONN;
++ if (msg->msg_namelen < IEEE802154_MIN_NAMELEN)
++ return -EINVAL;
++ err = ieee802154_sockaddr_check_size(daddr, msg->msg_namelen);
++ if (err < 0)
++ return err;
++ ieee802154_addr_from_sa(&dst_addr, &daddr->addr);
++ } else {
++ if (!ro->connected)
++ return -EDESTADDRREQ;
++ dst_addr = ro->dst_addr;
++ }
+
+ if (!ro->bound)
+ dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154);
+@@ -667,16 +685,6 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ cb = mac_cb_init(skb);
+ cb->type = IEEE802154_FC_TYPE_DATA;
+ cb->ackreq = ro->want_ack;
+-
+- if (msg->msg_name) {
+- DECLARE_SOCKADDR(struct sockaddr_ieee802154*,
+- daddr, msg->msg_name);
+-
+- ieee802154_addr_from_sa(&dst_addr, &daddr->addr);
+- } else {
+- dst_addr = ro->dst_addr;
+- }
+-
+ cb->secen = ro->secen;
+ cb->secen_override = ro->secen_override;
+ cb->seclevel = ro->seclevel;
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 229519001cc31..3cf9cd1808980 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -157,7 +157,7 @@ void inet_sock_destruct(struct sock *sk)
+
+ kfree(rcu_dereference_protected(inet->inet_opt, 1));
+ dst_release(rcu_dereference_check(sk->sk_dst_cache, 1));
+- dst_release(sk->sk_rx_dst);
++ dst_release(rcu_dereference_protected(sk->sk_rx_dst, 1));
+ sk_refcnt_debug_dec(sk);
+ }
+ EXPORT_SYMBOL(inet_sock_destruct);
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index 5295a579ec820..70070f1003a06 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -765,8 +765,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+ if (likely(remaining > 1))
+ remaining &= ~1U;
+
+- net_get_random_once(table_perturb,
+- INET_TABLE_PERTURB_SIZE * sizeof(*table_perturb));
++ get_random_slow_once(table_perturb,
++ INET_TABLE_PERTURB_SIZE * sizeof(*table_perturb));
+ index = port_offset & (INET_TABLE_PERTURB_SIZE - 1);
+
+ offset = READ_ONCE(table_perturb[index]) + (port_offset >> 32);
+diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c
+index e50976e3c2133..3b2e8ac45d4ee 100644
+--- a/net/ipv4/netfilter/nft_fib_ipv4.c
++++ b/net/ipv4/netfilter/nft_fib_ipv4.c
+@@ -95,6 +95,9 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs,
+ else
+ oif = NULL;
+
++ if (priv->flags & NFTA_FIB_F_IIF)
++ fl4.flowi4_oif = l3mdev_master_ifindex_rcu(oif);
++
+ if (nft_hook(pkt) == NF_INET_PRE_ROUTING &&
+ nft_fib_is_loopback(pkt->skb, nft_in(pkt))) {
+ nft_fib_store_result(dest, priv, pkt,
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 768a7daab5596..68f89fe7f9233 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2607,6 +2607,8 @@ int tcp_disconnect(struct sock *sk, int flags)
+ icsk->icsk_probes_out = 0;
+ tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+ tp->snd_cwnd_cnt = 0;
++ tp->is_cwnd_limited = 0;
++ tp->max_packets_out = 0;
+ tp->window_clamp = 0;
+ tp->delivered = 0;
+ tp->delivered_ce = 0;
+@@ -2624,8 +2626,7 @@ int tcp_disconnect(struct sock *sk, int flags)
+ icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
+ memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
+ __sk_dst_reset(sk);
+- dst_release(sk->sk_rx_dst);
+- sk->sk_rx_dst = NULL;
++ dst_release(xchg((__force struct dst_entry **)&sk->sk_rx_dst, NULL));
+ tcp_saved_syn_free(tp);
+ tp->compressed_ack = 0;
+ tp->segs_in = 0;
+@@ -3690,12 +3691,16 @@ static void __tcp_alloc_md5sig_pool(void)
+ * to memory. See smp_rmb() in tcp_get_md5sig_pool()
+ */
+ smp_wmb();
+- tcp_md5sig_pool_populated = true;
++ /* Paired with READ_ONCE() from tcp_alloc_md5sig_pool()
++ * and tcp_get_md5sig_pool().
++ */
++ WRITE_ONCE(tcp_md5sig_pool_populated, true);
+ }
+
+ bool tcp_alloc_md5sig_pool(void)
+ {
+- if (unlikely(!tcp_md5sig_pool_populated)) {
++ /* Paired with WRITE_ONCE() from __tcp_alloc_md5sig_pool() */
++ if (unlikely(!READ_ONCE(tcp_md5sig_pool_populated))) {
+ mutex_lock(&tcp_md5sig_mutex);
+
+ if (!tcp_md5sig_pool_populated)
+@@ -3703,7 +3708,8 @@ bool tcp_alloc_md5sig_pool(void)
+
+ mutex_unlock(&tcp_md5sig_mutex);
+ }
+- return tcp_md5sig_pool_populated;
++ /* Paired with WRITE_ONCE() from __tcp_alloc_md5sig_pool() */
++ return READ_ONCE(tcp_md5sig_pool_populated);
+ }
+ EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
+
+@@ -3719,7 +3725,8 @@ struct tcp_md5sig_pool *tcp_get_md5sig_pool(void)
+ {
+ local_bh_disable();
+
+- if (tcp_md5sig_pool_populated) {
++ /* Paired with WRITE_ONCE() from __tcp_alloc_md5sig_pool() */
++ if (READ_ONCE(tcp_md5sig_pool_populated)) {
+ /* coupled with smp_wmb() in __tcp_alloc_md5sig_pool() */
+ smp_rmb();
+ return this_cpu_ptr(&tcp_md5sig_pool);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index aac5d5b739268..079f150e480d2 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -5552,7 +5552,7 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb)
+ trace_tcp_probe(sk, skb);
+
+ tcp_mstamp_refresh(tp);
+- if (unlikely(!sk->sk_rx_dst))
++ if (unlikely(!rcu_access_pointer(sk->sk_rx_dst)))
+ inet_csk(sk)->icsk_af_ops->sk_rx_dst_set(sk, skb);
+ /*
+ * Header prediction.
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index ddc1af8731e39..6549e07ce19c0 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1544,15 +1544,18 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
+ struct sock *rsk;
+
+ if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+- struct dst_entry *dst = sk->sk_rx_dst;
++ struct dst_entry *dst;
++
++ dst = rcu_dereference_protected(sk->sk_rx_dst,
++ lockdep_sock_is_held(sk));
+
+ sock_rps_save_rxhash(sk, skb);
+ sk_mark_napi_id(sk, skb);
+ if (dst) {
+ if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
+ !dst->ops->check(dst, 0)) {
++ RCU_INIT_POINTER(sk->sk_rx_dst, NULL);
+ dst_release(dst);
+- sk->sk_rx_dst = NULL;
+ }
+ }
+ tcp_rcv_established(sk, skb);
+@@ -1627,7 +1630,7 @@ int tcp_v4_early_demux(struct sk_buff *skb)
+ skb->sk = sk;
+ skb->destructor = sock_edemux;
+ if (sk_fullsock(sk)) {
+- struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
++ struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst);
+
+ if (dst)
+ dst = dst_check(dst, 0);
+@@ -1932,7 +1935,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+ struct dst_entry *dst = skb_dst(skb);
+
+ if (dst && dst_hold_safe(dst)) {
+- sk->sk_rx_dst = dst;
++ rcu_assign_pointer(sk->sk_rx_dst, dst);
+ inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+ }
+ }
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 35bf585992231..8962864223b43 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1638,15 +1638,20 @@ static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited)
+ const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
+ struct tcp_sock *tp = tcp_sk(sk);
+
+- /* Track the maximum number of outstanding packets in each
+- * window, and remember whether we were cwnd-limited then.
++ /* Track the strongest available signal of the degree to which the cwnd
++ * is fully utilized. If cwnd-limited then remember that fact for the
++ * current window. If not cwnd-limited then track the maximum number of
++ * outstanding packets in the current window. (If cwnd-limited then we
++ * chose to not update tp->max_packets_out to avoid an extra else
++ * clause with no functional impact.)
+ */
+- if (!before(tp->snd_una, tp->max_packets_seq) ||
+- tp->packets_out > tp->max_packets_out ||
+- is_cwnd_limited) {
+- tp->max_packets_out = tp->packets_out;
+- tp->max_packets_seq = tp->snd_nxt;
++ if (!before(tp->snd_una, tp->cwnd_usage_seq) ||
++ is_cwnd_limited ||
++ (!tp->is_cwnd_limited &&
++ tp->packets_out > tp->max_packets_out)) {
+ tp->is_cwnd_limited = is_cwnd_limited;
++ tp->max_packets_out = tp->packets_out;
++ tp->cwnd_usage_seq = tp->snd_nxt;
+ }
+
+ if (tcp_is_cwnd_limited(sk)) {
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index b7acb6afdbce6..dd3fa0ff84e79 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2050,7 +2050,7 @@ bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
+ struct dst_entry *old;
+
+ if (dst_hold_safe(dst)) {
+- old = xchg(&sk->sk_rx_dst, dst);
++ old = xchg((__force struct dst_entry **)&sk->sk_rx_dst, dst);
+ dst_release(old);
+ return old != dst;
+ }
+@@ -2240,7 +2240,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ struct dst_entry *dst = skb_dst(skb);
+ int ret;
+
+- if (unlikely(sk->sk_rx_dst != dst))
++ if (unlikely(rcu_dereference(sk->sk_rx_dst) != dst))
+ udp_sk_rx_dst_set(sk, dst);
+
+ ret = udp_unicast_rcv_skb(sk, skb, uh);
+@@ -2398,7 +2398,7 @@ int udp_v4_early_demux(struct sk_buff *skb)
+
+ skb->sk = sk;
+ skb->destructor = sock_efree;
+- dst = READ_ONCE(sk->sk_rx_dst);
++ dst = rcu_dereference(sk->sk_rx_dst);
+
+ if (dst)
+ dst = dst_check(dst, 0);
+diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
+index 36be3cf0adefb..fa71e40789ed9 100644
+--- a/net/ipv6/netfilter/nft_fib_ipv6.c
++++ b/net/ipv6/netfilter/nft_fib_ipv6.c
+@@ -41,6 +41,9 @@ static int nft_fib6_flowi_init(struct flowi6 *fl6, const struct nft_fib *priv,
+ if (ipv6_addr_type(&fl6->daddr) & IPV6_ADDR_LINKLOCAL) {
+ lookup_flags |= RT6_LOOKUP_F_IFACE;
+ fl6->flowi6_oif = get_ifindex(dev ? dev : pkt->skb->dev);
++ } else if ((priv->flags & NFTA_FIB_F_IIF) &&
++ (netif_is_l3_master(dev) || netif_is_l3_slave(dev))) {
++ fl6->flowi6_oif = dev->ifindex;
+ }
+
+ if (ipv6_addr_type(&fl6->saddr) & IPV6_ADDR_UNICAST)
+@@ -189,7 +192,8 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
+ if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL))
+ goto put_rt_err;
+
+- if (oif && oif != rt->rt6i_idev->dev)
++ if (oif && oif != rt->rt6i_idev->dev &&
++ l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) != oif->ifindex)
+ goto put_rt_err;
+
+ switch (priv->result) {
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index c9ba827aded26..549ea5211bfaa 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -97,7 +97,7 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+ if (dst && dst_hold_safe(dst)) {
+ const struct rt6_info *rt = (const struct rt6_info *)dst;
+
+- sk->sk_rx_dst = dst;
++ rcu_assign_pointer(sk->sk_rx_dst, dst);
+ inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+ inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
+ }
+@@ -1344,15 +1344,18 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+ opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
+
+ if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+- struct dst_entry *dst = sk->sk_rx_dst;
++ struct dst_entry *dst;
++
++ dst = rcu_dereference_protected(sk->sk_rx_dst,
++ lockdep_sock_is_held(sk));
+
+ sock_rps_save_rxhash(sk, skb);
+ sk_mark_napi_id(sk, skb);
+ if (dst) {
+ if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
+ dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
++ RCU_INIT_POINTER(sk->sk_rx_dst, NULL);
+ dst_release(dst);
+- sk->sk_rx_dst = NULL;
+ }
+ }
+
+@@ -1697,7 +1700,7 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
+ skb->sk = sk;
+ skb->destructor = sock_edemux;
+ if (sk_fullsock(sk)) {
+- struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
++ struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst);
+
+ if (dst)
+ dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 7d3caafdf2059..fb71da6c6c74d 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -828,7 +828,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ struct dst_entry *dst = skb_dst(skb);
+ int ret;
+
+- if (unlikely(sk->sk_rx_dst != dst))
++ if (unlikely(rcu_dereference(sk->sk_rx_dst) != dst))
+ udp6_sk_rx_dst_set(sk, dst);
+
+ if (!uh->check && !udp_sk(sk)->no_check6_rx) {
+@@ -940,7 +940,7 @@ static void udp_v6_early_demux(struct sk_buff *skb)
+
+ skb->sk = sk;
+ skb->destructor = sock_efree;
+- dst = READ_ONCE(sk->sk_rx_dst);
++ dst = rcu_dereference(sk->sk_rx_dst);
+
+ if (dst)
+ dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 9348caf1c611d..5659af1bec179 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -3136,9 +3136,6 @@ static int ieee80211_set_csa_beacon(struct ieee80211_sub_if_data *sdata,
+ case NL80211_IFTYPE_MESH_POINT: {
+ struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+
+- if (params->chandef.width != sdata->vif.bss_conf.chandef.width)
+- return -EINVAL;
+-
+ /* changes into another band are not supported */
+ if (sdata->vif.bss_conf.chandef.chan->band !=
+ params->chandef.chan->band)
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index f350faef044d5..b4e3db194140a 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -249,10 +249,17 @@ void ovs_dp_process_packet(struct sk_buff *skb, struct sw_flow_key *key)
+ upcall.portid = ovs_vport_find_upcall_portid(p, skb);
+ upcall.mru = OVS_CB(skb)->mru;
+ error = ovs_dp_upcall(dp, skb, key, &upcall, 0);
+- if (unlikely(error))
+- kfree_skb(skb);
+- else
++ switch (error) {
++ case 0:
++ case -EAGAIN:
++ case -ERESTARTSYS:
++ case -EINTR:
+ consume_skb(skb);
++ break;
++ default:
++ kfree_skb(skb);
++ break;
++ }
+ stats_counter = &stats->n_missed;
+ goto out;
+ }
+@@ -519,8 +526,9 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
+ out:
+ if (err)
+ skb_tx_error(skb);
+- kfree_skb(user_skb);
+- kfree_skb(nskb);
++ consume_skb(user_skb);
++ consume_skb(nskb);
++
+ return err;
+ }
+
+diff --git a/net/rds/tcp.c b/net/rds/tcp.c
+index d4e6466d3989a..645cbb17c13ac 100644
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -176,10 +176,10 @@ void rds_tcp_reset_callbacks(struct socket *sock,
+ */
+ atomic_set(&cp->cp_state, RDS_CONN_RESETTING);
+ wait_event(cp->cp_waitq, !test_bit(RDS_IN_XMIT, &cp->cp_flags));
+- lock_sock(osock->sk);
+ /* reset receive side state for rds_tcp_data_recv() for osock */
+ cancel_delayed_work_sync(&cp->cp_send_w);
+ cancel_delayed_work_sync(&cp->cp_recv_w);
++ lock_sock(osock->sk);
+ if (tc->t_tinc) {
+ rds_inc_put(&tc->t_tinc->ti_inc);
+ tc->t_tinc = NULL;
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index 9e0c98df20daf..9cf61a18098a5 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -886,12 +886,17 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,
+ }
+
+ list_del_init(&shkey->key_list);
+- sctp_auth_shkey_release(shkey);
+ list_add(&cur_key->key_list, sh_keys);
+
+- if (asoc && asoc->active_key_id == auth_key->sca_keynumber)
+- sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL);
++ if (asoc && asoc->active_key_id == auth_key->sca_keynumber &&
++ sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL)) {
++ list_del_init(&cur_key->key_list);
++ sctp_auth_shkey_release(cur_key);
++ list_add(&shkey->key_list, sh_keys);
++ return -ENOMEM;
++ }
+
++ sctp_auth_shkey_release(shkey);
+ return 0;
+ }
+
+@@ -920,8 +925,13 @@ int sctp_auth_set_active_key(struct sctp_endpoint *ep,
+ return -EINVAL;
+
+ if (asoc) {
++ __u16 active_key_id = asoc->active_key_id;
++
+ asoc->active_key_id = key_id;
+- sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL);
++ if (sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL)) {
++ asoc->active_key_id = active_key_id;
++ return -ENOMEM;
++ }
+ } else
+ ep->active_key_id = key_id;
+
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index cbb336f01cf2b..449b5261e6610 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -1079,7 +1079,7 @@ EXPORT_SYMBOL_GPL(virtio_transport_recv_pkt);
+
+ void virtio_transport_free_pkt(struct virtio_vsock_pkt *pkt)
+ {
+- kfree(pkt->buf);
++ kvfree(pkt->buf);
+ kfree(pkt);
+ }
+ EXPORT_SYMBOL_GPL(virtio_transport_free_pkt);
+diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
+index a00ec715aa468..32aed1d0f6ee6 100644
+--- a/net/xfrm/xfrm_ipcomp.c
++++ b/net/xfrm/xfrm_ipcomp.c
+@@ -216,6 +216,7 @@ static void ipcomp_free_scratches(void)
+ vfree(*per_cpu_ptr(scratches, i));
+
+ free_percpu(scratches);
++ ipcomp_scratches = NULL;
+ }
+
+ static void * __percpu *ipcomp_alloc_scratches(void)
+diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
+index 65df6141397fe..e15cd63428ba7 100644
+--- a/scripts/Makefile.extrawarn
++++ b/scripts/Makefile.extrawarn
+@@ -74,5 +74,6 @@ KBUILD_CFLAGS += $(call cc-disable-warning, format-zero-length)
+ KBUILD_CFLAGS += $(call cc-disable-warning, uninitialized)
+ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast)
+ KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access)
++KBUILD_CFLAGS += $(call cc-disable-warning, cast-function-type-strict)
+ endif
+ endif
+diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh
+index 0b86c47baf7da..481d88b2c5824 100755
+--- a/scripts/selinux/install_policy.sh
++++ b/scripts/selinux/install_policy.sh
+@@ -57,7 +57,7 @@ fi
+ cd /etc/selinux/dummy/contexts/files
+ $SF file_contexts /
+
+-mounts=`cat /proc/$$/mounts | egrep "ext2|ext3|xfs|jfs|ext4|ext4dev|gfs2" | awk '{ print $2 '}`
++mounts=`cat /proc/$$/mounts | grep -E "ext2|ext3|xfs|jfs|ext4|ext4dev|gfs2" | awk '{ print $2 '}`
+ $SF file_contexts $mounts
+
+
+diff --git a/sound/core/pcm_dmaengine.c b/sound/core/pcm_dmaengine.c
+index 8eb58c709b141..6f6da1128edc2 100644
+--- a/sound/core/pcm_dmaengine.c
++++ b/sound/core/pcm_dmaengine.c
+@@ -139,12 +139,14 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_set_config_from_dai_data);
+
+ static void dmaengine_pcm_dma_complete(void *arg)
+ {
++ unsigned int new_pos;
+ struct snd_pcm_substream *substream = arg;
+ struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream);
+
+- prtd->pos += snd_pcm_lib_period_bytes(substream);
+- if (prtd->pos >= snd_pcm_lib_buffer_bytes(substream))
+- prtd->pos = 0;
++ new_pos = prtd->pos + snd_pcm_lib_period_bytes(substream);
++ if (new_pos >= snd_pcm_lib_buffer_bytes(substream))
++ new_pos = 0;
++ prtd->pos = new_pos;
+
+ snd_pcm_period_elapsed(substream);
+ }
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index f4f855d7a7910..d84c7271c2f1b 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -1655,10 +1655,8 @@ static int snd_rawmidi_free(struct snd_rawmidi *rmidi)
+
+ snd_info_free_entry(rmidi->proc_entry);
+ rmidi->proc_entry = NULL;
+- mutex_lock(®ister_mutex);
+ if (rmidi->ops && rmidi->ops->dev_unregister)
+ rmidi->ops->dev_unregister(rmidi);
+- mutex_unlock(®ister_mutex);
+
+ snd_rawmidi_free_substreams(&rmidi->streams[SNDRV_RAWMIDI_STREAM_INPUT]);
+ snd_rawmidi_free_substreams(&rmidi->streams[SNDRV_RAWMIDI_STREAM_OUTPUT]);
+diff --git a/sound/core/sound_oss.c b/sound/core/sound_oss.c
+index 0a5c66229a227..cb065746d5c46 100644
+--- a/sound/core/sound_oss.c
++++ b/sound/core/sound_oss.c
+@@ -177,7 +177,6 @@ int snd_unregister_oss_device(int type, struct snd_card *card, int dev)
+ mutex_unlock(&sound_oss_mutex);
+ return -ENOENT;
+ }
+- unregister_sound_special(minor);
+ switch (SNDRV_MINOR_OSS_DEVICE(minor)) {
+ case SNDRV_MINOR_OSS_PCM:
+ track2 = SNDRV_MINOR_OSS(cidx, SNDRV_MINOR_OSS_AUDIO);
+@@ -189,12 +188,18 @@ int snd_unregister_oss_device(int type, struct snd_card *card, int dev)
+ track2 = SNDRV_MINOR_OSS(cidx, SNDRV_MINOR_OSS_DMMIDI1);
+ break;
+ }
+- if (track2 >= 0) {
+- unregister_sound_special(track2);
++ if (track2 >= 0)
+ snd_oss_minors[track2] = NULL;
+- }
+ snd_oss_minors[minor] = NULL;
+ mutex_unlock(&sound_oss_mutex);
++
++ /* call unregister_sound_special() outside sound_oss_mutex;
++ * otherwise may deadlock, as it can trigger the release of a card
++ */
++ unregister_sound_special(minor);
++ if (track2 >= 0)
++ unregister_sound_special(track2);
++
+ kfree(mptr);
+ return 0;
+ }
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index d3d26be93cd2d..40d596248fab8 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2638,7 +2638,8 @@ static const struct pci_device_id azx_ids[] = {
+ .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
+ /* Poulsbo */
+ { PCI_DEVICE(0x8086, 0x811b),
+- .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE },
++ .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE |
++ AZX_DCAPS_POSFIX_LPIB },
+ /* Oaktrail */
+ { PCI_DEVICE(0x8086, 0x080a),
+ .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE },
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index cb556390de229..9670db6ad1e1b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7081,7 +7081,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
+- SND_PCI_QUIRK(0x1028, 0x087d, "Dell Precision 5530", ALC289_FIXUP_DUAL_SPK),
+ SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
+index 7e817e1877c22..9b33c87c2fe4d 100644
+--- a/sound/soc/codecs/wm5102.c
++++ b/sound/soc/codecs/wm5102.c
+@@ -2085,9 +2085,6 @@ static int wm5102_probe(struct platform_device *pdev)
+ regmap_update_bits(arizona->regmap, wm5102_digital_vu[i],
+ WM5102_DIG_VU, WM5102_DIG_VU);
+
+- pm_runtime_enable(&pdev->dev);
+- pm_runtime_idle(&pdev->dev);
+-
+ ret = arizona_request_irq(arizona, ARIZONA_IRQ_DSP_IRQ1,
+ "ADSP2 Compressed IRQ", wm5102_adsp2_irq,
+ wm5102);
+@@ -2120,6 +2117,9 @@ static int wm5102_probe(struct platform_device *pdev)
+ goto err_spk_irqs;
+ }
+
++ pm_runtime_enable(&pdev->dev);
++ pm_runtime_idle(&pdev->dev);
++
+ return ret;
+
+ err_spk_irqs:
+diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
+index e510aca551636..43a47312d71b7 100644
+--- a/sound/soc/codecs/wm5110.c
++++ b/sound/soc/codecs/wm5110.c
+@@ -2453,9 +2453,6 @@ static int wm5110_probe(struct platform_device *pdev)
+ regmap_update_bits(arizona->regmap, wm5110_digital_vu[i],
+ WM5110_DIG_VU, WM5110_DIG_VU);
+
+- pm_runtime_enable(&pdev->dev);
+- pm_runtime_idle(&pdev->dev);
+-
+ ret = arizona_request_irq(arizona, ARIZONA_IRQ_DSP_IRQ1,
+ "ADSP2 Compressed IRQ", wm5110_adsp2_irq,
+ wm5110);
+@@ -2488,6 +2485,9 @@ static int wm5110_probe(struct platform_device *pdev)
+ goto err_spk_irqs;
+ }
+
++ pm_runtime_enable(&pdev->dev);
++ pm_runtime_idle(&pdev->dev);
++
+ return ret;
+
+ err_spk_irqs:
+diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
+index bb6a95be87265..9f819113af1e6 100644
+--- a/sound/soc/codecs/wm8997.c
++++ b/sound/soc/codecs/wm8997.c
+@@ -1159,9 +1159,6 @@ static int wm8997_probe(struct platform_device *pdev)
+ regmap_update_bits(arizona->regmap, wm8997_digital_vu[i],
+ WM8997_DIG_VU, WM8997_DIG_VU);
+
+- pm_runtime_enable(&pdev->dev);
+- pm_runtime_idle(&pdev->dev);
+-
+ arizona_init_common(arizona);
+
+ ret = arizona_init_vol_limit(arizona);
+@@ -1180,6 +1177,9 @@ static int wm8997_probe(struct platform_device *pdev)
+ goto err_spk_irqs;
+ }
+
++ pm_runtime_enable(&pdev->dev);
++ pm_runtime_idle(&pdev->dev);
++
+ return ret;
+
+ err_spk_irqs:
+diff --git a/sound/soc/fsl/eukrea-tlv320.c b/sound/soc/fsl/eukrea-tlv320.c
+index 30a3d68b5c033..3705b003f5280 100644
+--- a/sound/soc/fsl/eukrea-tlv320.c
++++ b/sound/soc/fsl/eukrea-tlv320.c
+@@ -87,7 +87,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)
+ int ret;
+ int int_port = 0, ext_port;
+ struct device_node *np = pdev->dev.of_node;
+- struct device_node *ssi_np = NULL, *codec_np = NULL;
++ struct device_node *ssi_np = NULL, *codec_np = NULL, *tmp_np = NULL;
+
+ eukrea_tlv320.dev = &pdev->dev;
+ if (np) {
+@@ -144,7 +144,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)
+ }
+
+ if (machine_is_eukrea_cpuimx27() ||
+- of_find_compatible_node(NULL, NULL, "fsl,imx21-audmux")) {
++ (tmp_np = of_find_compatible_node(NULL, NULL, "fsl,imx21-audmux"))) {
+ imx_audmux_v1_configure_port(MX27_AUDMUX_HPCR1_SSI0,
+ IMX_AUDMUX_V1_PCR_SYN |
+ IMX_AUDMUX_V1_PCR_TFSDIR |
+@@ -159,10 +159,11 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)
+ IMX_AUDMUX_V1_PCR_SYN |
+ IMX_AUDMUX_V1_PCR_RXDSEL(MX27_AUDMUX_HPCR1_SSI0)
+ );
++ of_node_put(tmp_np);
+ } else if (machine_is_eukrea_cpuimx25sd() ||
+ machine_is_eukrea_cpuimx35sd() ||
+ machine_is_eukrea_cpuimx51sd() ||
+- of_find_compatible_node(NULL, NULL, "fsl,imx31-audmux")) {
++ (tmp_np = of_find_compatible_node(NULL, NULL, "fsl,imx31-audmux"))) {
+ if (!np)
+ ext_port = machine_is_eukrea_cpuimx25sd() ?
+ 4 : 3;
+@@ -179,6 +180,7 @@ static int eukrea_tlv320_probe(struct platform_device *pdev)
+ IMX_AUDMUX_V2_PTCR_SYN,
+ IMX_AUDMUX_V2_PDCR_RXDSEL(int_port)
+ );
++ of_node_put(tmp_np);
+ } else {
+ if (np) {
+ /* The eukrea,asoc-tlv320 driver was explicitly
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 727ef9889e94a..e428d8b36c00a 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -86,12 +86,13 @@ static inline unsigned get_usb_high_speed_rate(unsigned int rate)
+ */
+ static void release_urb_ctx(struct snd_urb_ctx *u)
+ {
+- if (u->buffer_size)
++ if (u->urb && u->buffer_size)
+ usb_free_coherent(u->ep->chip->dev, u->buffer_size,
+ u->urb->transfer_buffer,
+ u->urb->transfer_dma);
+ usb_free_urb(u->urb);
+ u->urb = NULL;
++ u->buffer_size = 0;
+ }
+
+ static const char *usb_error_string(int err)
+@@ -816,6 +817,7 @@ static int sync_ep_set_params(struct snd_usb_endpoint *ep)
+ if (!ep->syncbuf)
+ return -ENOMEM;
+
++ ep->nurbs = SYNC_URBS;
+ for (i = 0; i < SYNC_URBS; i++) {
+ struct snd_urb_ctx *u = &ep->urb[i];
+ u->index = i;
+@@ -835,8 +837,6 @@ static int sync_ep_set_params(struct snd_usb_endpoint *ep)
+ u->urb->complete = snd_complete_urb;
+ }
+
+- ep->nurbs = SYNC_URBS;
+-
+ return 0;
+
+ out_of_memory:
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index 1e7c619228a2e..2da43d930ed38 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -164,7 +164,7 @@ static int btf_dumper_int(const struct btf_type *t, __u8 bit_offset,
+ *(char *)data);
+ break;
+ case BTF_INT_BOOL:
+- jsonw_bool(jw, *(int *)data);
++ jsonw_bool(jw, *(bool *)data);
+ break;
+ default:
+ /* shouldn't happen */
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index 256b4755c0870..e90f1044a8397 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -2373,6 +2373,7 @@ static const char * const intel_pt_info_fmts[] = {
+ [INTEL_PT_SNAPSHOT_MODE] = " Snapshot mode %"PRId64"\n",
+ [INTEL_PT_PER_CPU_MMAPS] = " Per-cpu maps %"PRId64"\n",
+ [INTEL_PT_MTC_BIT] = " MTC bit %#"PRIx64"\n",
++ [INTEL_PT_MTC_FREQ_BITS] = " MTC freq bits %#"PRIx64"\n",
+ [INTEL_PT_TSC_CTC_N] = " TSC:CTC numerator %"PRIu64"\n",
+ [INTEL_PT_TSC_CTC_D] = " TSC:CTC denominator %"PRIu64"\n",
+ [INTEL_PT_CYC_BIT] = " CYC bit %#"PRIx64"\n",
+@@ -2387,8 +2388,12 @@ static void intel_pt_print_info(u64 *arr, int start, int finish)
+ if (!dump_trace)
+ return;
+
+- for (i = start; i <= finish; i++)
+- fprintf(stdout, intel_pt_info_fmts[i], arr[i]);
++ for (i = start; i <= finish; i++) {
++ const char *fmt = intel_pt_info_fmts[i];
++
++ if (fmt)
++ fprintf(stdout, fmt, arr[i]);
++ }
+ }
+
+ static void intel_pt_print_info_str(const char *name, const char *str)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-11-01 19:48 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-11-01 19:48 UTC (permalink / raw
To: gentoo-commits
commit: 3b94aa7caf5c24407c43d7d510eae189a18f1bf8
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 1 19:48:10 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 1 19:48:10 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3b94aa7c
Linux patch 4.19.263
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 ++++
1262_linux-4.19.263.patch | 26 ++++++++++++++++++++++++++
2 files changed, 30 insertions(+)
diff --git a/0000_README b/0000_README
index 6baf37a1..b1528289 100644
--- a/0000_README
+++ b/0000_README
@@ -1091,6 +1091,10 @@ Patch: 1261_linux-4.19.262.patch
From: https://www.kernel.org
Desc: Linux 4.19.262
+Patch: 1262_linux-4.19.263.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.263
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1262_linux-4.19.263.patch b/1262_linux-4.19.263.patch
new file mode 100644
index 00000000..af6440db
--- /dev/null
+++ b/1262_linux-4.19.263.patch
@@ -0,0 +1,26 @@
+diff --git a/Makefile b/Makefile
+index 08c9d316e5c21..8a517dd456f4c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 262
++SUBLEVEL = 263
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/include/linux/once.h b/include/linux/once.h
+index bb58e1c3aa034..3a6671d961b98 100644
+--- a/include/linux/once.h
++++ b/include/linux/once.h
+@@ -64,7 +64,7 @@ void __do_once_slow_done(bool *done, struct static_key_true *once_key,
+ #define DO_ONCE_SLOW(func, ...) \
+ ({ \
+ bool ___ret = false; \
+- static bool __section(".data.once") ___done = false; \
++ static bool __section(.data.once) ___done = false; \
+ static DEFINE_STATIC_KEY_TRUE(___once_key); \
+ if (static_branch_unlikely(&___once_key)) { \
+ ___ret = __do_once_slow_start(&___done); \
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-11-03 15:11 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-11-03 15:11 UTC (permalink / raw
To: gentoo-commits
commit: 54ed418ff5121280f94970d4cb41106c9d7d7dc5
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 3 15:10:51 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Nov 3 15:10:51 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=54ed418f
Linux patch 4.19.264
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1263_linux-4.19.264.patch | 2617 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2621 insertions(+)
diff --git a/0000_README b/0000_README
index b1528289..3f9cf874 100644
--- a/0000_README
+++ b/0000_README
@@ -1095,6 +1095,10 @@ Patch: 1262_linux-4.19.263.patch
From: https://www.kernel.org
Desc: Linux 4.19.263
+Patch: 1263_linux-4.19.264.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.264
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1263_linux-4.19.264.patch b/1263_linux-4.19.264.patch
new file mode 100644
index 00000000..4a4c0f9b
--- /dev/null
+++ b/1263_linux-4.19.264.patch
@@ -0,0 +1,2617 @@
+diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt
+index 667ea906266ed..5329e3e00e04f 100644
+--- a/Documentation/arm64/silicon-errata.txt
++++ b/Documentation/arm64/silicon-errata.txt
+@@ -55,7 +55,9 @@ stable kernels.
+ | ARM | Cortex-A57 | #832075 | ARM64_ERRATUM_832075 |
+ | ARM | Cortex-A57 | #852523 | N/A |
+ | ARM | Cortex-A57 | #834220 | ARM64_ERRATUM_834220 |
++| ARM | Cortex-A57 | #1742098 | ARM64_ERRATUM_1742098 |
+ | ARM | Cortex-A72 | #853709 | N/A |
++| ARM | Cortex-A72 | #1655431 | ARM64_ERRATUM_1742098 |
+ | ARM | Cortex-A73 | #858921 | ARM64_ERRATUM_858921 |
+ | ARM | Cortex-A55 | #1024718 | ARM64_ERRATUM_1024718 |
+ | ARM | Cortex-A76 | #1463225 | ARM64_ERRATUM_1463225 |
+diff --git a/Makefile b/Makefile
+index 8a517dd456f4c..bc4864f3bd0e2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 263
++SUBLEVEL = 264
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -744,7 +744,9 @@ KBUILD_CFLAGS += $(call cc-option, -gsplit-dwarf, -g)
+ else
+ KBUILD_CFLAGS += -g
+ endif
+-ifneq ($(LLVM_IAS),1)
++ifeq ($(LLVM_IAS),1)
++KBUILD_AFLAGS += -g
++else
+ KBUILD_AFLAGS += -Wa,-gdwarf-2
+ endif
+ endif
+diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h
+index 2f39d9b3886e4..19d0cab60a390 100644
+--- a/arch/arc/include/asm/io.h
++++ b/arch/arc/include/asm/io.h
+@@ -35,7 +35,7 @@ static inline void ioport_unmap(void __iomem *addr)
+ {
+ }
+
+-extern void iounmap(const void __iomem *addr);
++extern void iounmap(const volatile void __iomem *addr);
+
+ #define ioremap_nocache(phy, sz) ioremap(phy, sz)
+ #define ioremap_wc(phy, sz) ioremap(phy, sz)
+diff --git a/arch/arc/mm/ioremap.c b/arch/arc/mm/ioremap.c
+index 9881bd740ccc1..0719b1280ef87 100644
+--- a/arch/arc/mm/ioremap.c
++++ b/arch/arc/mm/ioremap.c
+@@ -95,7 +95,7 @@ void __iomem *ioremap_prot(phys_addr_t paddr, unsigned long size,
+ EXPORT_SYMBOL(ioremap_prot);
+
+
+-void iounmap(const void __iomem *addr)
++void iounmap(const volatile void __iomem *addr)
+ {
+ /* weird double cast to handle phys_addr_t > 32 bits */
+ if (arc_uncached_addr_space((phys_addr_t)(u32)addr))
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index a101f5d2fbed4..e16f0d45b47ac 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -515,6 +515,22 @@ config ARM64_ERRATUM_1542419
+
+ If unsure, say Y.
+
++config ARM64_ERRATUM_1742098
++ bool "Cortex-A57/A72: 1742098: ELR recorded incorrectly on interrupt taken between cryptographic instructions in a sequence"
++ depends on COMPAT
++ default y
++ help
++ This option removes the AES hwcap for aarch32 user-space to
++ workaround erratum 1742098 on Cortex-A57 and Cortex-A72.
++
++ Affected parts may corrupt the AES state if an interrupt is
++ taken between a pair of AES instructions. These instructions
++ are only present if the cryptography extensions are present.
++ All software should have a fallback implementation for CPUs
++ that don't implement the cryptography extensions.
++
++ If unsure, say Y.
++
+ config CAVIUM_ERRATUM_22375
+ bool "Cavium erratum 22375, 24313"
+ default y
+diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h
+index 64ae14371cae9..61fd28522d74f 100644
+--- a/arch/arm64/include/asm/cpucaps.h
++++ b/arch/arm64/include/asm/cpucaps.h
+@@ -55,7 +55,8 @@
+ #define ARM64_SSBS 34
+ #define ARM64_WORKAROUND_1542419 35
+ #define ARM64_SPECTRE_BHB 36
++#define ARM64_WORKAROUND_1742098 37
+
+-#define ARM64_NCAPS 37
++#define ARM64_NCAPS 38
+
+ #endif /* __ASM_CPUCAPS_H */
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index d0b7dd60861bc..5435550d1c9bf 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -683,6 +683,15 @@ static const struct midr_range arm64_harden_el2_vectors[] = {
+
+ #endif
+
++#ifdef CONFIG_ARM64_ERRATUM_1742098
++static struct midr_range broken_aarch32_aes[] = {
++ MIDR_RANGE(MIDR_CORTEX_A57, 0, 1, 0xf, 0xf),
++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A72),
++ {},
++};
++#endif
++
++
+ const struct arm64_cpu_capabilities arm64_errata[] = {
+ #if defined(CONFIG_ARM64_ERRATUM_826319) || \
+ defined(CONFIG_ARM64_ERRATUM_827319) || \
+@@ -883,6 +892,14 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ .matches = has_neoverse_n1_erratum_1542419,
+ .cpu_enable = cpu_enable_trap_ctr_access,
+ },
++#endif
++#ifdef CONFIG_ARM64_ERRATUM_1742098
++ {
++ .desc = "ARM erratum 1742098",
++ .capability = ARM64_WORKAROUND_1742098,
++ CAP_MIDR_RANGE_LIST(broken_aarch32_aes),
++ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
++ },
+ #endif
+ {
+ }
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index 03b0fdccaf052..d7e73a7963d1b 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -31,6 +31,7 @@
+ #include <asm/cpufeature.h>
+ #include <asm/cpu_ops.h>
+ #include <asm/fpsimd.h>
++#include <asm/hwcap.h>
+ #include <asm/mmu_context.h>
+ #include <asm/processor.h>
+ #include <asm/sysreg.h>
+@@ -1154,6 +1155,14 @@ static void cpu_enable_ssbs(const struct arm64_cpu_capabilities *__unused)
+ }
+ #endif /* CONFIG_ARM64_SSBD */
+
++static void elf_hwcap_fixup(void)
++{
++#ifdef CONFIG_ARM64_ERRATUM_1742098
++ if (cpus_have_const_cap(ARM64_WORKAROUND_1742098))
++ compat_elf_hwcap2 &= ~COMPAT_HWCAP2_AES;
++#endif /* ARM64_ERRATUM_1742098 */
++}
++
+ static const struct arm64_cpu_capabilities arm64_features[] = {
+ {
+ .desc = "GIC system register CPU interface",
+@@ -1802,8 +1811,10 @@ void __init setup_cpu_features(void)
+ mark_const_caps_ready();
+ setup_elf_hwcaps(arm64_elf_hwcaps);
+
+- if (system_supports_32bit_el0())
++ if (system_supports_32bit_el0()) {
+ setup_elf_hwcaps(compat_elf_hwcaps);
++ elf_hwcap_fixup();
++ }
+
+ if (system_uses_ttbr0_pan())
+ pr_info("emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching\n");
+diff --git a/arch/s390/include/asm/futex.h b/arch/s390/include/asm/futex.h
+index 5e97a43531470..7837c791f7e87 100644
+--- a/arch/s390/include/asm/futex.h
++++ b/arch/s390/include/asm/futex.h
+@@ -16,7 +16,8 @@
+ "3: jl 1b\n" \
+ " lhi %0,0\n" \
+ "4: sacf 768\n" \
+- EX_TABLE(0b,4b) EX_TABLE(2b,4b) EX_TABLE(3b,4b) \
++ EX_TABLE(0b,4b) EX_TABLE(1b,4b) \
++ EX_TABLE(2b,4b) EX_TABLE(3b,4b) \
+ : "=d" (ret), "=&d" (oldval), "=&d" (newval), \
+ "=m" (*uaddr) \
+ : "0" (-EFAULT), "d" (oparg), "a" (uaddr), \
+diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
+index a4e7e100ed26b..8396c77e93230 100644
+--- a/arch/x86/kernel/cpu/microcode/amd.c
++++ b/arch/x86/kernel/cpu/microcode/amd.c
+@@ -222,7 +222,13 @@ apply_microcode_early_amd(u32 cpuid_1_eax, void *ucode, size_t size, bool save_p
+ return ret;
+
+ native_rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
+- if (rev >= mc->hdr.patch_id)
++
++ /*
++ * Allow application of the same revision to pick up SMT-specific
++ * changes even if the revision of the other SMT thread is already
++ * up-to-date.
++ */
++ if (rev > mc->hdr.patch_id)
+ return ret;
+
+ if (!__apply_microcode_amd(mc)) {
+@@ -304,8 +310,12 @@ void load_ucode_amd_ap(unsigned int cpuid_1_eax)
+
+ native_rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
+
+- /* Check whether we have saved a new patch already: */
+- if (*new_rev && rev < mc->hdr.patch_id) {
++ /*
++ * Check whether a new patch has been saved already. Also, allow application of
++ * the same revision in order to pick up SMT-thread-specific configuration even
++ * if the sibling SMT thread already has an up-to-date revision.
++ */
++ if (*new_rev && rev <= mc->hdr.patch_id) {
+ if (!__apply_microcode_amd(mc)) {
+ *new_rev = mc->hdr.patch_id;
+ return;
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 5c48d2c4cabe6..0c0f0eda327da 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -668,7 +668,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ /* Otherwise, skip ahead to the user-specified starting frame: */
+ while (!unwind_done(state) &&
+ (!on_stack(&state->stack_info, first_frame, sizeof(long)) ||
+- state->sp < (unsigned long)first_frame))
++ state->sp <= (unsigned long)first_frame))
+ unwind_next_frame(state);
+
+ return;
+diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
+index 943b1dc2d0b3c..e05309bc41cce 100644
+--- a/drivers/acpi/acpi_extlog.c
++++ b/drivers/acpi/acpi_extlog.c
+@@ -13,6 +13,7 @@
+ #include <linux/ratelimit.h>
+ #include <linux/edac.h>
+ #include <linux/ras.h>
++#include <acpi/ghes.h>
+ #include <asm/cpu.h>
+ #include <asm/mce.h>
+
+@@ -141,8 +142,8 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,
+ int cpu = mce->extcpu;
+ struct acpi_hest_generic_status *estatus, *tmp;
+ struct acpi_hest_generic_data *gdata;
+- const guid_t *fru_id = &guid_null;
+- char *fru_text = "";
++ const guid_t *fru_id;
++ char *fru_text;
+ guid_t *sec_type;
+ static u32 err_seq;
+
+@@ -163,17 +164,23 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,
+
+ /* log event via trace */
+ err_seq++;
+- gdata = (struct acpi_hest_generic_data *)(tmp + 1);
+- if (gdata->validation_bits & CPER_SEC_VALID_FRU_ID)
+- fru_id = (guid_t *)gdata->fru_id;
+- if (gdata->validation_bits & CPER_SEC_VALID_FRU_TEXT)
+- fru_text = gdata->fru_text;
+- sec_type = (guid_t *)gdata->section_type;
+- if (guid_equal(sec_type, &CPER_SEC_PLATFORM_MEM)) {
+- struct cper_sec_mem_err *mem = (void *)(gdata + 1);
+- if (gdata->error_data_length >= sizeof(*mem))
+- trace_extlog_mem_event(mem, err_seq, fru_id, fru_text,
+- (u8)gdata->error_severity);
++ apei_estatus_for_each_section(tmp, gdata) {
++ if (gdata->validation_bits & CPER_SEC_VALID_FRU_ID)
++ fru_id = (guid_t *)gdata->fru_id;
++ else
++ fru_id = &guid_null;
++ if (gdata->validation_bits & CPER_SEC_VALID_FRU_TEXT)
++ fru_text = gdata->fru_text;
++ else
++ fru_text = "";
++ sec_type = (guid_t *)gdata->section_type;
++ if (guid_equal(sec_type, &CPER_SEC_PLATFORM_MEM)) {
++ struct cper_sec_mem_err *mem = (void *)(gdata + 1);
++
++ if (gdata->error_data_length >= sizeof(*mem))
++ trace_extlog_mem_event(mem, err_seq, fru_id, fru_text,
++ (u8)gdata->error_severity);
++ }
+ }
+
+ out:
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 490ae990bd3c2..0ec74ab2a3995 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -447,6 +447,70 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "PF5LUXG"),
+ },
+ },
++ /*
++ * More Tongfang devices with the same issue as the Clevo NL5xRU and
++ * NL5xNU/TUXEDO Aura 15 Gen1 and Gen2. See the description above.
++ */
++ {
++ .callback = video_detect_force_native,
++ .ident = "TongFang GKxNRxx",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "GKxNRxx"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "TongFang GKxNRxx",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "POLARIS1501A1650TI"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "TongFang GKxNRxx",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "POLARIS1501A2060"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "TongFang GKxNRxx",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "POLARIS1701A1650TI"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "TongFang GKxNRxx",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "POLARIS1701A2060"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "TongFang GMxNGxx",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "GMxNGxx"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "TongFang GMxZGxx",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "GMxZGxx"),
++ },
++ },
++ {
++ .callback = video_detect_force_native,
++ .ident = "TongFang GMxRGxx",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"),
++ },
++ },
+ /*
+ * Desktops which falsely report a backlight and which our heuristics
+ * for this do not catch.
+diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
+index 9290e787abdc4..d5b9f96898776 100644
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -265,7 +265,7 @@ enum {
+ PCS_7 = 0x94, /* 7+ port PCS (Denverton) */
+
+ /* em constants */
+- EM_MAX_SLOTS = 8,
++ EM_MAX_SLOTS = SATA_PMP_MAX_PORTS,
+ EM_MAX_RETRY = 5,
+
+ /* em_ctl bits */
+diff --git a/drivers/ata/ahci_imx.c b/drivers/ata/ahci_imx.c
+index b00799d208f50..46e61a1ab968b 100644
+--- a/drivers/ata/ahci_imx.c
++++ b/drivers/ata/ahci_imx.c
+@@ -1250,4 +1250,4 @@ module_platform_driver(imx_ahci_driver);
+ MODULE_DESCRIPTION("Freescale i.MX AHCI SATA platform driver");
+ MODULE_AUTHOR("Richard Zhu <Hong-Xing.Zhu@freescale.com>");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("ahci:imx");
++MODULE_ALIAS("platform:" DRV_NAME);
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index 52c292d0908a2..e865aa4b25047 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -2459,6 +2459,10 @@ static int genpd_iterate_idle_states(struct device_node *dn,
+ np = it.node;
+ if (!of_match_node(idle_state_match, np))
+ continue;
++
++ if (!of_device_is_available(np))
++ continue;
++
+ if (states) {
+ ret = genpd_parse_state(&states[i], np);
+ if (ret) {
+diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c
+index 5368e621999ce..0bfa7e68408a9 100644
+--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c
++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c
+@@ -74,8 +74,9 @@ static int mdp4_lvds_connector_get_modes(struct drm_connector *connector)
+ return ret;
+ }
+
+-static int mdp4_lvds_connector_mode_valid(struct drm_connector *connector,
+- struct drm_display_mode *mode)
++static enum drm_mode_status
++mdp4_lvds_connector_mode_valid(struct drm_connector *connector,
++ struct drm_display_mode *mode)
+ {
+ struct mdp4_lvds_connector *mdp4_lvds_connector =
+ to_mdp4_lvds_connector(connector);
+diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c
+index 5cf6eac9c1d3b..4c8b147bb339b 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi.c
++++ b/drivers/gpu/drm/msm/dsi/dsi.c
+@@ -200,6 +200,12 @@ int msm_dsi_modeset_init(struct msm_dsi *msm_dsi, struct drm_device *dev,
+ return -EINVAL;
+
+ priv = dev->dev_private;
++
++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) {
++ DRM_DEV_ERROR(dev->dev, "too many bridges\n");
++ return -ENOSPC;
++ }
++
+ msm_dsi->dev = dev;
+
+ ret = msm_dsi_host_modeset_init(msm_dsi->host, dev);
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
+index 0b7cb90d28265..e03f08757b252 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
+@@ -299,6 +299,11 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi,
+ struct platform_device *pdev = hdmi->pdev;
+ int ret;
+
++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) {
++ DRM_DEV_ERROR(dev->dev, "too many bridges\n");
++ return -ENOSPC;
++ }
++
+ hdmi->dev = dev;
+ hdmi->encoder = encoder;
+
+diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
+index 8af62696f2ca7..5604175c06618 100644
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -343,7 +343,7 @@ static int magicmouse_raw_event(struct hid_device *hdev,
+ magicmouse_raw_event(hdev, report, data + 2, data[1]);
+ magicmouse_raw_event(hdev, report, data + 2 + data[1],
+ size - 2 - data[1]);
+- break;
++ return 0;
+ default:
+ return 0;
+ }
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index 10645c9bb7be1..6030cb539a7b1 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -59,9 +59,6 @@ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
+ #define TOTAL_ATTRS (MAX_CORE_ATTRS + 1)
+ #define MAX_CORE_DATA (NUM_REAL_CORES + BASE_SYSFS_ATTR_NO)
+
+-#define TO_CORE_ID(cpu) (cpu_data(cpu).cpu_core_id)
+-#define TO_ATTR_NO(cpu) (TO_CORE_ID(cpu) + BASE_SYSFS_ATTR_NO)
+-
+ #ifdef CONFIG_SMP
+ #define for_each_sibling(i, cpu) \
+ for_each_cpu(i, topology_sibling_cpumask(cpu))
+@@ -104,6 +101,8 @@ struct temp_data {
+ struct platform_data {
+ struct device *hwmon_dev;
+ u16 pkg_id;
++ u16 cpu_map[NUM_REAL_CORES];
++ struct ida ida;
+ struct cpumask cpumask;
+ struct temp_data *core_data[MAX_CORE_DATA];
+ struct device_attribute name_attr;
+@@ -454,7 +453,7 @@ static struct temp_data *init_temp_data(unsigned int cpu, int pkg_flag)
+ MSR_IA32_THERM_STATUS;
+ tdata->is_pkg_data = pkg_flag;
+ tdata->cpu = cpu;
+- tdata->cpu_core_id = TO_CORE_ID(cpu);
++ tdata->cpu_core_id = topology_core_id(cpu);
+ tdata->attr_size = MAX_CORE_ATTRS;
+ mutex_init(&tdata->update_lock);
+ return tdata;
+@@ -467,7 +466,7 @@ static int create_core_data(struct platform_device *pdev, unsigned int cpu,
+ struct platform_data *pdata = platform_get_drvdata(pdev);
+ struct cpuinfo_x86 *c = &cpu_data(cpu);
+ u32 eax, edx;
+- int err, attr_no;
++ int err, index, attr_no;
+
+ /*
+ * Find attr number for sysfs:
+@@ -475,14 +474,26 @@ static int create_core_data(struct platform_device *pdev, unsigned int cpu,
+ * The attr number is always core id + 2
+ * The Pkgtemp will always show up as temp1_*, if available
+ */
+- attr_no = pkg_flag ? PKG_SYSFS_ATTR_NO : TO_ATTR_NO(cpu);
++ if (pkg_flag) {
++ attr_no = PKG_SYSFS_ATTR_NO;
++ } else {
++ index = ida_alloc(&pdata->ida, GFP_KERNEL);
++ if (index < 0)
++ return index;
++ pdata->cpu_map[index] = topology_core_id(cpu);
++ attr_no = index + BASE_SYSFS_ATTR_NO;
++ }
+
+- if (attr_no > MAX_CORE_DATA - 1)
+- return -ERANGE;
++ if (attr_no > MAX_CORE_DATA - 1) {
++ err = -ERANGE;
++ goto ida_free;
++ }
+
+ tdata = init_temp_data(cpu, pkg_flag);
+- if (!tdata)
+- return -ENOMEM;
++ if (!tdata) {
++ err = -ENOMEM;
++ goto ida_free;
++ }
+
+ /* Test if we can access the status register */
+ err = rdmsr_safe_on_cpu(cpu, tdata->status_reg, &eax, &edx);
+@@ -518,6 +529,9 @@ static int create_core_data(struct platform_device *pdev, unsigned int cpu,
+ exit_free:
+ pdata->core_data[attr_no] = NULL;
+ kfree(tdata);
++ida_free:
++ if (!pkg_flag)
++ ida_free(&pdata->ida, index);
+ return err;
+ }
+
+@@ -537,6 +551,9 @@ static void coretemp_remove_core(struct platform_data *pdata, int indx)
+
+ kfree(pdata->core_data[indx]);
+ pdata->core_data[indx] = NULL;
++
++ if (indx >= BASE_SYSFS_ATTR_NO)
++ ida_free(&pdata->ida, indx - BASE_SYSFS_ATTR_NO);
+ }
+
+ static int coretemp_probe(struct platform_device *pdev)
+@@ -550,6 +567,7 @@ static int coretemp_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ pdata->pkg_id = pdev->id;
++ ida_init(&pdata->ida);
+ platform_set_drvdata(pdev, pdata);
+
+ pdata->hwmon_dev = devm_hwmon_device_register_with_groups(dev, DRVNAME,
+@@ -566,6 +584,7 @@ static int coretemp_remove(struct platform_device *pdev)
+ if (pdata->core_data[i])
+ coretemp_remove_core(pdata, i);
+
++ ida_destroy(&pdata->ida);
+ return 0;
+ }
+
+@@ -660,7 +679,7 @@ static int coretemp_cpu_offline(unsigned int cpu)
+ struct platform_device *pdev = coretemp_get_pdev(cpu);
+ struct platform_data *pd;
+ struct temp_data *tdata;
+- int indx, target;
++ int i, indx = -1, target;
+
+ /*
+ * Don't execute this on suspend as the device remove locks
+@@ -673,12 +692,19 @@ static int coretemp_cpu_offline(unsigned int cpu)
+ if (!pdev)
+ return 0;
+
+- /* The core id is too big, just return */
+- indx = TO_ATTR_NO(cpu);
+- if (indx > MAX_CORE_DATA - 1)
++ pd = platform_get_drvdata(pdev);
++
++ for (i = 0; i < NUM_REAL_CORES; i++) {
++ if (pd->cpu_map[i] == topology_core_id(cpu)) {
++ indx = i + BASE_SYSFS_ATTR_NO;
++ break;
++ }
++ }
++
++ /* Too many cores and this core is not populated, just return */
++ if (indx < 0)
+ return 0;
+
+- pd = platform_get_drvdata(pdev);
+ tdata = pd->core_data[indx];
+
+ cpumask_clear_cpu(cpu, &pd->cpumask);
+diff --git a/drivers/iio/light/tsl2583.c b/drivers/iio/light/tsl2583.c
+index 23295fec5be59..23e5911d97a3c 100644
+--- a/drivers/iio/light/tsl2583.c
++++ b/drivers/iio/light/tsl2583.c
+@@ -866,7 +866,7 @@ static int tsl2583_probe(struct i2c_client *clientp,
+ TSL2583_POWER_OFF_DELAY_MS);
+ pm_runtime_use_autosuspend(&clientp->dev);
+
+- ret = devm_iio_device_register(indio_dev->dev.parent, indio_dev);
++ ret = iio_device_register(indio_dev);
+ if (ret) {
+ dev_err(&clientp->dev, "%s: iio registration failed\n",
+ __func__);
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index dcb865d193090..1b25f5c0dfad2 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2800,6 +2800,7 @@ static int __init si_domain_init(int hw)
+
+ if (md_domain_init(si_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) {
+ domain_exit(si_domain);
++ si_domain = NULL;
+ return -EFAULT;
+ }
+
+@@ -3502,6 +3503,10 @@ free_iommu:
+ disable_dmar_iommu(iommu);
+ free_dmar_iommu(iommu);
+ }
++ if (si_domain) {
++ domain_exit(si_domain);
++ si_domain = NULL;
++ }
+
+ kfree(g_iommus);
+
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index e3972dbf4c9a3..177a1bf2b8e0e 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -155,6 +155,8 @@ vdec_try_fmt_common(struct venus_inst *inst, struct v4l2_format *f)
+ else
+ return NULL;
+ fmt = find_format(inst, pixmp->pixelformat, f->type);
++ if (!fmt)
++ return NULL;
+ }
+
+ pixmp->width = clamp(pixmp->width, frame_width_min(inst),
+diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
+index b603ca412387b..e8cd189ec9ef2 100644
+--- a/drivers/media/platform/vivid/vivid-core.c
++++ b/drivers/media/platform/vivid/vivid-core.c
+@@ -297,6 +297,28 @@ static int vidioc_g_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *a
+ return vivid_vid_out_g_fbuf(file, fh, a);
+ }
+
++/*
++ * Only support the framebuffer of one of the vivid instances.
++ * Anything else is rejected.
++ */
++bool vivid_validate_fb(const struct v4l2_framebuffer *a)
++{
++ struct vivid_dev *dev;
++ int i;
++
++ for (i = 0; i < n_devs; i++) {
++ dev = vivid_devs[i];
++ if (!dev || !dev->video_pbase)
++ continue;
++ if ((unsigned long)a->base == dev->video_pbase &&
++ a->fmt.width <= dev->display_width &&
++ a->fmt.height <= dev->display_height &&
++ a->fmt.bytesperline <= dev->display_byte_stride)
++ return true;
++ }
++ return false;
++}
++
+ static int vidioc_s_fbuf(struct file *file, void *fh, const struct v4l2_framebuffer *a)
+ {
+ struct video_device *vdev = video_devdata(file);
+diff --git a/drivers/media/platform/vivid/vivid-core.h b/drivers/media/platform/vivid/vivid-core.h
+index cd4c8230563c7..6ea4448dfb7c8 100644
+--- a/drivers/media/platform/vivid/vivid-core.h
++++ b/drivers/media/platform/vivid/vivid-core.h
+@@ -551,4 +551,6 @@ static inline bool vivid_is_hdmi_out(const struct vivid_dev *dev)
+ return dev->output_type[dev->output] == HDMI;
+ }
+
++bool vivid_validate_fb(const struct v4l2_framebuffer *a);
++
+ #endif
+diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
+index c58ae489f39cb..48f2c9c96fc92 100644
+--- a/drivers/media/platform/vivid/vivid-vid-cap.c
++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
+@@ -441,6 +441,12 @@ void vivid_update_format_cap(struct vivid_dev *dev, bool keep_controls)
+ tpg_reset_source(&dev->tpg, dev->src_rect.width, dev->src_rect.height, dev->field_cap);
+ dev->crop_cap = dev->src_rect;
+ dev->crop_bounds_cap = dev->src_rect;
++ if (dev->bitmap_cap &&
++ (dev->compose_cap.width != dev->crop_cap.width ||
++ dev->compose_cap.height != dev->crop_cap.height)) {
++ vfree(dev->bitmap_cap);
++ dev->bitmap_cap = NULL;
++ }
+ dev->compose_cap = dev->crop_cap;
+ if (V4L2_FIELD_HAS_T_OR_B(dev->field_cap))
+ dev->compose_cap.height /= 2;
+@@ -871,6 +877,8 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection
+ struct vivid_dev *dev = video_drvdata(file);
+ struct v4l2_rect *crop = &dev->crop_cap;
+ struct v4l2_rect *compose = &dev->compose_cap;
++ unsigned orig_compose_w = compose->width;
++ unsigned orig_compose_h = compose->height;
+ unsigned factor = V4L2_FIELD_HAS_T_OR_B(dev->field_cap) ? 2 : 1;
+ int ret;
+
+@@ -987,17 +995,17 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection
+ s->r.height /= factor;
+ }
+ v4l2_rect_map_inside(&s->r, &dev->fmt_cap_rect);
+- if (dev->bitmap_cap && (compose->width != s->r.width ||
+- compose->height != s->r.height)) {
+- vfree(dev->bitmap_cap);
+- dev->bitmap_cap = NULL;
+- }
+ *compose = s->r;
+ break;
+ default:
+ return -EINVAL;
+ }
+
++ if (dev->bitmap_cap && (compose->width != orig_compose_w ||
++ compose->height != orig_compose_h)) {
++ vfree(dev->bitmap_cap);
++ dev->bitmap_cap = NULL;
++ }
+ tpg_s_crop_compose(&dev->tpg, crop, compose);
+ return 0;
+ }
+@@ -1240,7 +1248,14 @@ int vivid_vid_cap_s_fbuf(struct file *file, void *fh,
+ return -EINVAL;
+ if (a->fmt.bytesperline < (a->fmt.width * fmt->bit_depth[0]) / 8)
+ return -EINVAL;
+- if (a->fmt.height * a->fmt.bytesperline < a->fmt.sizeimage)
++ if (a->fmt.bytesperline > a->fmt.sizeimage / a->fmt.height)
++ return -EINVAL;
++
++ /*
++ * Only support the framebuffer of one of the vivid instances.
++ * Anything else is rejected.
++ */
++ if (!vivid_validate_fb(a))
+ return -EINVAL;
+
+ dev->fb_vbase_cap = phys_to_virt((unsigned long)a->base);
+diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
+index af38c989ff336..2c32124c18232 100644
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -161,6 +161,20 @@ bool v4l2_valid_dv_timings(const struct v4l2_dv_timings *t,
+ (bt->interlaced && !(caps & V4L2_DV_BT_CAP_INTERLACED)) ||
+ (!bt->interlaced && !(caps & V4L2_DV_BT_CAP_PROGRESSIVE)))
+ return false;
++
++ /* sanity checks for the blanking timings */
++ if (!bt->interlaced &&
++ (bt->il_vbackporch || bt->il_vsync || bt->il_vfrontporch))
++ return false;
++ if (bt->hfrontporch > 2 * bt->width ||
++ bt->hsync > 1024 || bt->hbackporch > 1024)
++ return false;
++ if (bt->vfrontporch > 4096 ||
++ bt->vsync > 128 || bt->vbackporch > 4096)
++ return false;
++ if (bt->interlaced && (bt->il_vfrontporch > 4096 ||
++ bt->il_vsync > 128 || bt->il_vbackporch > 4096))
++ return false;
+ return fnc == NULL || fnc(t, fnc_handle);
+ }
+ EXPORT_SYMBOL_GPL(v4l2_valid_dv_timings);
+diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
+index fc237b820c4fb..75c51007768e3 100644
+--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
++++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
+@@ -445,19 +445,14 @@ int v4l2_m2m_reqbufs(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+ }
+ EXPORT_SYMBOL_GPL(v4l2_m2m_reqbufs);
+
+-int v4l2_m2m_querybuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+- struct v4l2_buffer *buf)
++static void v4l2_m2m_adjust_mem_offset(struct vb2_queue *vq,
++ struct v4l2_buffer *buf)
+ {
+- struct vb2_queue *vq;
+- int ret = 0;
+- unsigned int i;
+-
+- vq = v4l2_m2m_get_vq(m2m_ctx, buf->type);
+- ret = vb2_querybuf(vq, buf);
+-
+ /* Adjust MMAP memory offsets for the CAPTURE queue */
+ if (buf->memory == V4L2_MEMORY_MMAP && !V4L2_TYPE_IS_OUTPUT(vq->type)) {
+ if (V4L2_TYPE_IS_MULTIPLANAR(vq->type)) {
++ unsigned int i;
++
+ for (i = 0; i < buf->length; ++i)
+ buf->m.planes[i].m.mem_offset
+ += DST_QUEUE_OFF_BASE;
+@@ -465,8 +460,23 @@ int v4l2_m2m_querybuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+ buf->m.offset += DST_QUEUE_OFF_BASE;
+ }
+ }
++}
+
+- return ret;
++int v4l2_m2m_querybuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
++ struct v4l2_buffer *buf)
++{
++ struct vb2_queue *vq;
++ int ret;
++
++ vq = v4l2_m2m_get_vq(m2m_ctx, buf->type);
++ ret = vb2_querybuf(vq, buf);
++ if (ret)
++ return ret;
++
++ /* Adjust MMAP memory offsets for the CAPTURE queue */
++ v4l2_m2m_adjust_mem_offset(vq, buf);
++
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_m2m_querybuf);
+
+@@ -478,10 +488,15 @@ int v4l2_m2m_qbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+
+ vq = v4l2_m2m_get_vq(m2m_ctx, buf->type);
+ ret = vb2_qbuf(vq, buf);
+- if (!ret)
+- v4l2_m2m_try_schedule(m2m_ctx);
++ if (ret)
++ return ret;
+
+- return ret;
++ /* Adjust MMAP memory offsets for the CAPTURE queue */
++ v4l2_m2m_adjust_mem_offset(vq, buf);
++
++ v4l2_m2m_try_schedule(m2m_ctx);
++
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_m2m_qbuf);
+
+@@ -489,9 +504,17 @@ int v4l2_m2m_dqbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+ struct v4l2_buffer *buf)
+ {
+ struct vb2_queue *vq;
++ int ret;
+
+ vq = v4l2_m2m_get_vq(m2m_ctx, buf->type);
+- return vb2_dqbuf(vq, buf, file->f_flags & O_NONBLOCK);
++ ret = vb2_dqbuf(vq, buf, file->f_flags & O_NONBLOCK);
++ if (ret)
++ return ret;
++
++ /* Adjust MMAP memory offsets for the CAPTURE queue */
++ v4l2_m2m_adjust_mem_offset(vq, buf);
++
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_m2m_dqbuf);
+
+@@ -503,10 +526,15 @@ int v4l2_m2m_prepare_buf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+
+ vq = v4l2_m2m_get_vq(m2m_ctx, buf->type);
+ ret = vb2_prepare_buf(vq, buf);
+- if (!ret)
+- v4l2_m2m_try_schedule(m2m_ctx);
++ if (ret)
++ return ret;
+
+- return ret;
++ /* Adjust MMAP memory offsets for the CAPTURE queue */
++ v4l2_m2m_adjust_mem_offset(vq, buf);
++
++ v4l2_m2m_try_schedule(m2m_ctx);
++
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_m2m_prepare_buf);
+
+diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
+index b6d8203e46ebe..8aebdc4ff623a 100644
+--- a/drivers/mmc/core/sdio_bus.c
++++ b/drivers/mmc/core/sdio_bus.c
+@@ -264,7 +264,8 @@ static void sdio_release_func(struct device *dev)
+ {
+ struct sdio_func *func = dev_to_sdio_func(dev);
+
+- sdio_free_func_cis(func);
++ if (!(func->card->quirks & MMC_QUIRK_NONSTD_SDIO))
++ sdio_free_func_cis(func);
+
+ kfree(func->info);
+ kfree(func->tmpbuf);
+diff --git a/drivers/net/can/mscan/mpc5xxx_can.c b/drivers/net/can/mscan/mpc5xxx_can.c
+index 2949a381a94dc..21993ba7ae2a9 100644
+--- a/drivers/net/can/mscan/mpc5xxx_can.c
++++ b/drivers/net/can/mscan/mpc5xxx_can.c
+@@ -336,14 +336,14 @@ static int mpc5xxx_can_probe(struct platform_device *ofdev)
+ &mscan_clksrc);
+ if (!priv->can.clock.freq) {
+ dev_err(&ofdev->dev, "couldn't get MSCAN clock properties\n");
+- goto exit_free_mscan;
++ goto exit_put_clock;
+ }
+
+ err = register_mscandev(dev, mscan_clksrc);
+ if (err) {
+ dev_err(&ofdev->dev, "registering %s failed (err=%d)\n",
+ DRV_NAME, err);
+- goto exit_free_mscan;
++ goto exit_put_clock;
+ }
+
+ dev_info(&ofdev->dev, "MSCAN at 0x%p, irq %d, clock %d Hz\n",
+@@ -351,7 +351,9 @@ static int mpc5xxx_can_probe(struct platform_device *ofdev)
+
+ return 0;
+
+-exit_free_mscan:
++exit_put_clock:
++ if (data->put_clock)
++ data->put_clock(ofdev);
+ free_candev(dev);
+ exit_dispose_irq:
+ irq_dispose_mapping(irq);
+diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
+index a1634834b640e..cb1388267fe0a 100644
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -1079,7 +1079,7 @@ static irqreturn_t rcar_canfd_global_interrupt(int irq, void *dev_id)
+ struct rcar_canfd_global *gpriv = dev_id;
+ struct net_device *ndev;
+ struct rcar_canfd_channel *priv;
+- u32 sts, gerfl;
++ u32 sts, cc, gerfl;
+ u32 ch, ridx;
+
+ /* Global error interrupts still indicate a condition specific
+@@ -1097,7 +1097,9 @@ static irqreturn_t rcar_canfd_global_interrupt(int irq, void *dev_id)
+
+ /* Handle Rx interrupts */
+ sts = rcar_canfd_read(priv->base, RCANFD_RFSTS(ridx));
+- if (likely(sts & RCANFD_RFSTS_RFIF)) {
++ cc = rcar_canfd_read(priv->base, RCANFD_RFCC(ridx));
++ if (likely(sts & RCANFD_RFSTS_RFIF &&
++ cc & RCANFD_RFCC_RFIE)) {
+ if (napi_schedule_prep(&priv->napi)) {
+ /* Disable Rx FIFO interrupts */
+ rcar_canfd_clear_bit(priv->base,
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index 5d642458bac54..45d2787248839 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -1845,7 +1845,7 @@ static int kvaser_usb_hydra_start_chip(struct kvaser_usb_net_priv *priv)
+ {
+ int err;
+
+- init_completion(&priv->start_comp);
++ reinit_completion(&priv->start_comp);
+
+ err = kvaser_usb_hydra_send_simple_cmd(priv->dev, CMD_START_CHIP_REQ,
+ priv->channel);
+@@ -1863,7 +1863,7 @@ static int kvaser_usb_hydra_stop_chip(struct kvaser_usb_net_priv *priv)
+ {
+ int err;
+
+- init_completion(&priv->stop_comp);
++ reinit_completion(&priv->stop_comp);
+
+ /* Make sure we do not report invalid BUS_OFF from CMD_CHIP_STATE_EVENT
+ * see comment in kvaser_usb_hydra_update_state()
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+index 78d52a5e8fd5d..15380cc08ee69 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -1324,7 +1324,7 @@ static int kvaser_usb_leaf_start_chip(struct kvaser_usb_net_priv *priv)
+ {
+ int err;
+
+- init_completion(&priv->start_comp);
++ reinit_completion(&priv->start_comp);
+
+ err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_START_CHIP,
+ priv->channel);
+@@ -1342,7 +1342,7 @@ static int kvaser_usb_leaf_stop_chip(struct kvaser_usb_net_priv *priv)
+ {
+ int err;
+
+- init_completion(&priv->stop_comp);
++ reinit_completion(&priv->stop_comp);
+
+ err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_STOP_CHIP,
+ priv->channel);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index 714aead72c579..d54e6e138aafe 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -238,6 +238,7 @@ enum xgbe_sfp_speed {
+ #define XGBE_SFP_BASE_BR_1GBE_MAX 0x0d
+ #define XGBE_SFP_BASE_BR_10GBE_MIN 0x64
+ #define XGBE_SFP_BASE_BR_10GBE_MAX 0x68
++#define XGBE_MOLEX_SFP_BASE_BR_10GBE_MAX 0x78
+
+ #define XGBE_SFP_BASE_CU_CABLE_LEN 18
+
+@@ -283,6 +284,8 @@ struct xgbe_sfp_eeprom {
+ #define XGBE_BEL_FUSE_VENDOR "BEL-FUSE "
+ #define XGBE_BEL_FUSE_PARTNO "1GBT-SFP06 "
+
++#define XGBE_MOLEX_VENDOR "Molex Inc. "
++
+ struct xgbe_sfp_ascii {
+ union {
+ char vendor[XGBE_SFP_BASE_VENDOR_NAME_LEN + 1];
+@@ -833,7 +836,11 @@ static bool xgbe_phy_sfp_bit_rate(struct xgbe_sfp_eeprom *sfp_eeprom,
+ break;
+ case XGBE_SFP_SPEED_10000:
+ min = XGBE_SFP_BASE_BR_10GBE_MIN;
+- max = XGBE_SFP_BASE_BR_10GBE_MAX;
++ if (memcmp(&sfp_eeprom->base[XGBE_SFP_BASE_VENDOR_NAME],
++ XGBE_MOLEX_VENDOR, XGBE_SFP_BASE_VENDOR_NAME_LEN) == 0)
++ max = XGBE_MOLEX_SFP_BASE_BR_10GBE_MAX;
++ else
++ max = XGBE_SFP_BASE_BR_10GBE_MAX;
+ break;
+ default:
+ return false;
+@@ -1138,7 +1145,10 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata)
+ }
+
+ /* Determine the type of SFP */
+- if (sfp_base[XGBE_SFP_BASE_10GBE_CC] & XGBE_SFP_BASE_10GBE_CC_SR)
++ if (phy_data->sfp_cable == XGBE_SFP_CABLE_PASSIVE &&
++ xgbe_phy_sfp_bit_rate(sfp_eeprom, XGBE_SFP_SPEED_10000))
++ phy_data->sfp_base = XGBE_SFP_BASE_10000_CR;
++ else if (sfp_base[XGBE_SFP_BASE_10GBE_CC] & XGBE_SFP_BASE_10GBE_CC_SR)
+ phy_data->sfp_base = XGBE_SFP_BASE_10000_SR;
+ else if (sfp_base[XGBE_SFP_BASE_10GBE_CC] & XGBE_SFP_BASE_10GBE_CC_LR)
+ phy_data->sfp_base = XGBE_SFP_BASE_10000_LR;
+@@ -1154,9 +1164,6 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata)
+ phy_data->sfp_base = XGBE_SFP_BASE_1000_CX;
+ else if (sfp_base[XGBE_SFP_BASE_1GBE_CC] & XGBE_SFP_BASE_1GBE_CC_T)
+ phy_data->sfp_base = XGBE_SFP_BASE_1000_T;
+- else if ((phy_data->sfp_cable == XGBE_SFP_CABLE_PASSIVE) &&
+- xgbe_phy_sfp_bit_rate(sfp_eeprom, XGBE_SFP_SPEED_10000))
+- phy_data->sfp_base = XGBE_SFP_BASE_10000_CR;
+
+ switch (phy_data->sfp_base) {
+ case XGBE_SFP_BASE_1000_T:
+diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
+index b758b3e793370..38aa4b74a6abb 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
++++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
+@@ -423,8 +423,10 @@ int hnae_ae_register(struct hnae_ae_dev *hdev, struct module *owner)
+ hdev->cls_dev.release = hnae_release;
+ (void)dev_set_name(&hdev->cls_dev, "hnae%d", hdev->id);
+ ret = device_register(&hdev->cls_dev);
+- if (ret)
++ if (ret) {
++ put_device(&hdev->cls_dev);
+ return ret;
++ }
+
+ __module_get(THIS_MODULE);
+
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index 5a1fe49030b11..25f579a924d6d 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -2916,6 +2916,7 @@ static struct device *ehea_register_port(struct ehea_port *port,
+ ret = of_device_register(&port->ofdev);
+ if (ret) {
+ pr_err("failed to register device. ret=%d\n", ret);
++ put_device(&port->ofdev.dev);
+ goto out;
+ }
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 6a70e62836f8f..16adba824811d 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -2699,10 +2699,17 @@ static int i40e_get_rss_hash_opts(struct i40e_pf *pf, struct ethtool_rxnfc *cmd)
+
+ if (cmd->flow_type == TCP_V4_FLOW ||
+ cmd->flow_type == UDP_V4_FLOW) {
+- if (i_set & I40E_L3_SRC_MASK)
+- cmd->data |= RXH_IP_SRC;
+- if (i_set & I40E_L3_DST_MASK)
+- cmd->data |= RXH_IP_DST;
++ if (hw->mac.type == I40E_MAC_X722) {
++ if (i_set & I40E_X722_L3_SRC_MASK)
++ cmd->data |= RXH_IP_SRC;
++ if (i_set & I40E_X722_L3_DST_MASK)
++ cmd->data |= RXH_IP_DST;
++ } else {
++ if (i_set & I40E_L3_SRC_MASK)
++ cmd->data |= RXH_IP_SRC;
++ if (i_set & I40E_L3_DST_MASK)
++ cmd->data |= RXH_IP_DST;
++ }
+ } else if (cmd->flow_type == TCP_V6_FLOW ||
+ cmd->flow_type == UDP_V6_FLOW) {
+ if (i_set & I40E_L3_V6_SRC_MASK)
+@@ -3009,12 +3016,15 @@ static int i40e_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd,
+
+ /**
+ * i40e_get_rss_hash_bits - Read RSS Hash bits from register
++ * @hw: hw structure
+ * @nfc: pointer to user request
+ * @i_setc: bits currently set
+ *
+ * Returns value of bits to be set per user request
+ **/
+-static u64 i40e_get_rss_hash_bits(struct ethtool_rxnfc *nfc, u64 i_setc)
++static u64 i40e_get_rss_hash_bits(struct i40e_hw *hw,
++ struct ethtool_rxnfc *nfc,
++ u64 i_setc)
+ {
+ u64 i_set = i_setc;
+ u64 src_l3 = 0, dst_l3 = 0;
+@@ -3033,8 +3043,13 @@ static u64 i40e_get_rss_hash_bits(struct ethtool_rxnfc *nfc, u64 i_setc)
+ dst_l3 = I40E_L3_V6_DST_MASK;
+ } else if (nfc->flow_type == TCP_V4_FLOW ||
+ nfc->flow_type == UDP_V4_FLOW) {
+- src_l3 = I40E_L3_SRC_MASK;
+- dst_l3 = I40E_L3_DST_MASK;
++ if (hw->mac.type == I40E_MAC_X722) {
++ src_l3 = I40E_X722_L3_SRC_MASK;
++ dst_l3 = I40E_X722_L3_DST_MASK;
++ } else {
++ src_l3 = I40E_L3_SRC_MASK;
++ dst_l3 = I40E_L3_DST_MASK;
++ }
+ } else {
+ /* Any other flow type are not supported here */
+ return i_set;
+@@ -3052,6 +3067,7 @@ static u64 i40e_get_rss_hash_bits(struct ethtool_rxnfc *nfc, u64 i_setc)
+ return i_set;
+ }
+
++#define FLOW_PCTYPES_SIZE 64
+ /**
+ * i40e_set_rss_hash_opt - Enable/Disable flow types for RSS hash
+ * @pf: pointer to the physical function struct
+@@ -3064,9 +3080,11 @@ static int i40e_set_rss_hash_opt(struct i40e_pf *pf, struct ethtool_rxnfc *nfc)
+ struct i40e_hw *hw = &pf->hw;
+ u64 hena = (u64)i40e_read_rx_ctl(hw, I40E_PFQF_HENA(0)) |
+ ((u64)i40e_read_rx_ctl(hw, I40E_PFQF_HENA(1)) << 32);
+- u8 flow_pctype = 0;
++ DECLARE_BITMAP(flow_pctypes, FLOW_PCTYPES_SIZE);
+ u64 i_set, i_setc;
+
++ bitmap_zero(flow_pctypes, FLOW_PCTYPES_SIZE);
++
+ if (pf->flags & I40E_FLAG_MFP_ENABLED) {
+ dev_err(&pf->pdev->dev,
+ "Change of RSS hash input set is not supported when MFP mode is enabled\n");
+@@ -3082,36 +3100,35 @@ static int i40e_set_rss_hash_opt(struct i40e_pf *pf, struct ethtool_rxnfc *nfc)
+
+ switch (nfc->flow_type) {
+ case TCP_V4_FLOW:
+- flow_pctype = I40E_FILTER_PCTYPE_NONF_IPV4_TCP;
++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV4_TCP, flow_pctypes);
+ if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE)
+- hena |=
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK);
++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK,
++ flow_pctypes);
+ break;
+ case TCP_V6_FLOW:
+- flow_pctype = I40E_FILTER_PCTYPE_NONF_IPV6_TCP;
+- if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE)
+- hena |=
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK);
++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV6_TCP, flow_pctypes);
+ if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE)
+- hena |=
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_TCP_SYN_NO_ACK);
++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV6_TCP_SYN_NO_ACK,
++ flow_pctypes);
+ break;
+ case UDP_V4_FLOW:
+- flow_pctype = I40E_FILTER_PCTYPE_NONF_IPV4_UDP;
+- if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE)
+- hena |=
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV4_UDP) |
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV4_UDP);
+-
++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV4_UDP, flow_pctypes);
++ if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE) {
++ set_bit(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV4_UDP,
++ flow_pctypes);
++ set_bit(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV4_UDP,
++ flow_pctypes);
++ }
+ hena |= BIT_ULL(I40E_FILTER_PCTYPE_FRAG_IPV4);
+ break;
+ case UDP_V6_FLOW:
+- flow_pctype = I40E_FILTER_PCTYPE_NONF_IPV6_UDP;
+- if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE)
+- hena |=
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV6_UDP) |
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV6_UDP);
+-
++ set_bit(I40E_FILTER_PCTYPE_NONF_IPV6_UDP, flow_pctypes);
++ if (pf->hw_features & I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE) {
++ set_bit(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV6_UDP,
++ flow_pctypes);
++ set_bit(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV6_UDP,
++ flow_pctypes);
++ }
+ hena |= BIT_ULL(I40E_FILTER_PCTYPE_FRAG_IPV6);
+ break;
+ case AH_ESP_V4_FLOW:
+@@ -3144,17 +3161,20 @@ static int i40e_set_rss_hash_opt(struct i40e_pf *pf, struct ethtool_rxnfc *nfc)
+ return -EINVAL;
+ }
+
+- if (flow_pctype) {
+- i_setc = (u64)i40e_read_rx_ctl(hw, I40E_GLQF_HASH_INSET(0,
+- flow_pctype)) |
+- ((u64)i40e_read_rx_ctl(hw, I40E_GLQF_HASH_INSET(1,
+- flow_pctype)) << 32);
+- i_set = i40e_get_rss_hash_bits(nfc, i_setc);
+- i40e_write_rx_ctl(hw, I40E_GLQF_HASH_INSET(0, flow_pctype),
+- (u32)i_set);
+- i40e_write_rx_ctl(hw, I40E_GLQF_HASH_INSET(1, flow_pctype),
+- (u32)(i_set >> 32));
+- hena |= BIT_ULL(flow_pctype);
++ if (bitmap_weight(flow_pctypes, FLOW_PCTYPES_SIZE)) {
++ u8 flow_id;
++
++ for_each_set_bit(flow_id, flow_pctypes, FLOW_PCTYPES_SIZE) {
++ i_setc = (u64)i40e_read_rx_ctl(hw, I40E_GLQF_HASH_INSET(0, flow_id)) |
++ ((u64)i40e_read_rx_ctl(hw, I40E_GLQF_HASH_INSET(1, flow_id)) << 32);
++ i_set = i40e_get_rss_hash_bits(&pf->hw, nfc, i_setc);
++
++ i40e_write_rx_ctl(hw, I40E_GLQF_HASH_INSET(0, flow_id),
++ (u32)i_set);
++ i40e_write_rx_ctl(hw, I40E_GLQF_HASH_INSET(1, flow_id),
++ (u32)(i_set >> 32));
++ hena |= BIT_ULL(flow_id);
++ }
+ }
+
+ i40e_write_rx_ctl(hw, I40E_PFQF_HENA(0), (u32)hena);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_type.h b/drivers/net/ethernet/intel/i40e/i40e_type.h
+index 7df969c59855c..2e40a50ebfab3 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_type.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_type.h
+@@ -1462,6 +1462,10 @@ struct i40e_lldp_variables {
+ #define I40E_PFQF_CTL_0_HASHLUTSIZE_512 0x00010000
+
+ /* INPUT SET MASK for RSS, flow director, and flexible payload */
++#define I40E_X722_L3_SRC_SHIFT 49
++#define I40E_X722_L3_SRC_MASK (0x3ULL << I40E_X722_L3_SRC_SHIFT)
++#define I40E_X722_L3_DST_SHIFT 41
++#define I40E_X722_L3_DST_MASK (0x3ULL << I40E_X722_L3_DST_SHIFT)
+ #define I40E_L3_SRC_SHIFT 47
+ #define I40E_L3_SRC_MASK (0x3ULL << I40E_L3_SRC_SHIFT)
+ #define I40E_L3_V6_SRC_SHIFT 43
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 973350b34e085..e98e3af06cf81 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1227,10 +1227,12 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr)
+ if (test_bit(__I40E_VF_RESETS_DISABLED, pf->state))
+ return true;
+
+- /* If the VFs have been disabled, this means something else is
+- * resetting the VF, so we shouldn't continue.
+- */
+- if (test_and_set_bit(__I40E_VF_DISABLE, pf->state))
++ /* Bail out if VFs are disabled. */
++ if (test_bit(__I40E_VF_DISABLE, pf->state))
++ return true;
++
++ /* If VF is being reset already we don't need to continue. */
++ if (test_and_set_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))
+ return true;
+
+ i40e_trigger_vf_reset(vf, flr);
+@@ -1267,7 +1269,7 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr)
+ i40e_cleanup_reset_vf(vf);
+
+ i40e_flush(hw);
+- clear_bit(__I40E_VF_DISABLE, pf->state);
++ clear_bit(I40E_VF_STATE_RESETTING, &vf->vf_states);
+
+ return true;
+ }
+@@ -1300,8 +1302,12 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr)
+ return false;
+
+ /* Begin reset on all VFs at once */
+- for (v = 0; v < pf->num_alloc_vfs; v++)
+- i40e_trigger_vf_reset(&pf->vf[v], flr);
++ for (v = 0; v < pf->num_alloc_vfs; v++) {
++ vf = &pf->vf[v];
++ /* If VF is being reset no need to trigger reset again */
++ if (!test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))
++ i40e_trigger_vf_reset(&pf->vf[v], flr);
++ }
+
+ /* HW requires some time to make sure it can flush the FIFO for a VF
+ * when it resets it. Poll the VPGEN_VFRSTAT register for each VF in
+@@ -1317,9 +1323,11 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr)
+ */
+ while (v < pf->num_alloc_vfs) {
+ vf = &pf->vf[v];
+- reg = rd32(hw, I40E_VPGEN_VFRSTAT(vf->vf_id));
+- if (!(reg & I40E_VPGEN_VFRSTAT_VFRD_MASK))
+- break;
++ if (!test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states)) {
++ reg = rd32(hw, I40E_VPGEN_VFRSTAT(vf->vf_id));
++ if (!(reg & I40E_VPGEN_VFRSTAT_VFRD_MASK))
++ break;
++ }
+
+ /* If the current VF has finished resetting, move on
+ * to the next VF in sequence.
+@@ -1347,6 +1355,10 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr)
+ if (pf->vf[v].lan_vsi_idx == 0)
+ continue;
+
++ /* If VF is reset in another thread just continue */
++ if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))
++ continue;
++
+ i40e_vsi_stop_rings_no_wait(pf->vsi[pf->vf[v].lan_vsi_idx]);
+ }
+
+@@ -1358,6 +1370,10 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr)
+ if (pf->vf[v].lan_vsi_idx == 0)
+ continue;
+
++ /* If VF is reset in another thread just continue */
++ if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))
++ continue;
++
+ i40e_vsi_wait_queues_disabled(pf->vsi[pf->vf[v].lan_vsi_idx]);
+ }
+
+@@ -1367,8 +1383,13 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr)
+ mdelay(50);
+
+ /* Finish the reset on each VF */
+- for (v = 0; v < pf->num_alloc_vfs; v++)
++ for (v = 0; v < pf->num_alloc_vfs; v++) {
++ /* If VF is reset in another thread just continue */
++ if (test_bit(I40E_VF_STATE_RESETTING, &vf->vf_states))
++ continue;
++
+ i40e_cleanup_reset_vf(&pf->vf[v]);
++ }
+
+ i40e_flush(hw);
+ clear_bit(__I40E_VF_DISABLE, pf->state);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
+index bf67d62e2b5fd..1e001b2bd761b 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
+@@ -37,6 +37,7 @@ enum i40e_vf_states {
+ I40E_VF_STATE_MC_PROMISC,
+ I40E_VF_STATE_UC_PROMISC,
+ I40E_VF_STATE_PRE_ENABLE,
++ I40E_VF_STATE_RESETTING
+ };
+
+ /* VF capabilities */
+diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
+index e08301d833e2e..8c58ae565073f 100644
+--- a/drivers/net/ethernet/lantiq_etop.c
++++ b/drivers/net/ethernet/lantiq_etop.c
+@@ -480,7 +480,6 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev)
+ len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
+
+ if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) || ch->skb[ch->dma.desc]) {
+- dev_kfree_skb_any(skb);
+ netdev_err(dev, "tx ring full\n");
+ netif_tx_stop_queue(txq);
+ return NETDEV_TX_BUSY;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+index c467f5e981f61..70087f2542b2b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+@@ -117,7 +117,6 @@ static bool mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry)
+ struct xfrm_replay_state_esn *replay_esn;
+ u32 seq_bottom;
+ u8 overlap;
+- u32 *esn;
+
+ if (!(sa_entry->x->props.flags & XFRM_STATE_ESN)) {
+ sa_entry->esn_state.trigger = 0;
+@@ -130,11 +129,9 @@ static bool mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry)
+
+ sa_entry->esn_state.esn = xfrm_replay_seqhi(sa_entry->x,
+ htonl(seq_bottom));
+- esn = &sa_entry->esn_state.esn;
+
+ sa_entry->esn_state.trigger = 1;
+ if (unlikely(overlap && seq_bottom < MLX5E_IPSEC_ESN_SCOPE_MID)) {
+- ++(*esn);
+ sa_entry->esn_state.overlap = 0;
+ return true;
+ } else if (unlikely(!overlap &&
+diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
+index 623a05d78343d..beec87ec15f5f 100644
+--- a/drivers/net/ethernet/micrel/ksz884x.c
++++ b/drivers/net/ethernet/micrel/ksz884x.c
+@@ -6936,7 +6936,7 @@ static int pcidev_init(struct pci_dev *pdev, const struct pci_device_id *id)
+ char banner[sizeof(version)];
+ struct ksz_switch *sw = NULL;
+
+- result = pci_enable_device(pdev);
++ result = pcim_enable_device(pdev);
+ if (result)
+ return result;
+
+diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
+index 3693a59b6d010..5c0629b4fccc0 100644
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -1549,11 +1549,13 @@ static int netsec_register_mdio(struct netsec_priv *priv, u32 phy_addr)
+ ret = PTR_ERR(priv->phydev);
+ dev_err(priv->dev, "get_phy_device err(%d)\n", ret);
+ priv->phydev = NULL;
++ mdiobus_unregister(bus);
+ return -ENODEV;
+ }
+
+ ret = phy_device_register(priv->phydev);
+ if (ret) {
++ phy_device_free(priv->phydev);
+ mdiobus_unregister(bus);
+ dev_err(priv->dev,
+ "phy_device_register err(%d)\n", ret);
+diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
+index dfa801315da6b..e02ff5e33e2d9 100644
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -950,6 +950,9 @@ struct net_device_context {
+ u32 vf_alloc;
+ /* Serial number of the VF to team with */
+ u32 vf_serial;
++
++ /* completion variable to confirm vf association */
++ struct completion vf_add;
+ };
+
+ /* Per channel data */
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 77a9a753d9794..092c5f315b498 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1227,6 +1227,10 @@ static void netvsc_send_vf(struct net_device *ndev,
+
+ net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
+ net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
++
++ if (net_device_ctx->vf_alloc)
++ complete(&net_device_ctx->vf_add);
++
+ netdev_info(ndev, "VF slot %u %s\n",
+ net_device_ctx->vf_serial,
+ net_device_ctx->vf_alloc ? "added" : "removed");
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index f094e4bc21751..9528932361a83 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -2121,6 +2121,7 @@ static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
+ {
+ struct device *parent = vf_netdev->dev.parent;
+ struct net_device_context *ndev_ctx;
++ struct net_device *ndev;
+ struct pci_dev *pdev;
+ u32 serial;
+
+@@ -2147,6 +2148,18 @@ static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
+ return hv_get_drvdata(ndev_ctx->device_ctx);
+ }
+
++ /* Fallback path to check synthetic vf with
++ * help of mac addr
++ */
++ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
++ ndev = hv_get_drvdata(ndev_ctx->device_ctx);
++ if (ether_addr_equal(vf_netdev->perm_addr, ndev->perm_addr)) {
++ netdev_notice(vf_netdev,
++ "falling back to mac addr based matching\n");
++ return ndev;
++ }
++ }
++
+ netdev_notice(vf_netdev,
+ "no netdev found for vf serial:%u\n", serial);
+ return NULL;
+@@ -2216,6 +2229,11 @@ static int netvsc_vf_changed(struct net_device *vf_netdev)
+ if (!netvsc_dev)
+ return NOTIFY_DONE;
+
++ if (vf_is_up && !net_device_ctx->vf_alloc) {
++ netdev_info(ndev, "Waiting for the VF association from host\n");
++ wait_for_completion(&net_device_ctx->vf_add);
++ }
++
+ netvsc_switch_datapath(ndev, vf_is_up);
+ netdev_info(ndev, "Data path switched %s VF: %s\n",
+ vf_is_up ? "to" : "from", vf_netdev->name);
+@@ -2237,6 +2255,7 @@ static int netvsc_unregister_vf(struct net_device *vf_netdev)
+
+ netdev_info(ndev, "VF unregistering: %s\n", vf_netdev->name);
+
++ reinit_completion(&net_device_ctx->vf_add);
+ netdev_rx_handler_unregister(vf_netdev);
+ netdev_upper_dev_unlink(vf_netdev, ndev);
+ RCU_INIT_POINTER(net_device_ctx->vf_netdev, NULL);
+@@ -2274,6 +2293,7 @@ static int netvsc_probe(struct hv_device *dev,
+
+ INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
+
++ init_completion(&net_device_ctx->vf_add);
+ spin_lock_init(&net_device_ctx->lock);
+ INIT_LIST_HEAD(&net_device_ctx->reconfig_events);
+ INIT_DELAYED_WORK(&net_device_ctx->vf_takeover, netvsc_vf_setup);
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 778bd9aaba9f1..17b932505be0c 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -777,6 +777,13 @@ static const struct usb_device_id products[] = {
+ },
+ #endif
+
++/* Lenovo ThinkPad OneLink+ Dock (based on Realtek RTL8153) */
++{
++ USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x3054, USB_CLASS_COMM,
++ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
++ .driver_info = 0,
++},
++
+ /* ThinkPad USB-C Dock (based on Realtek RTL8153) */
+ {
+ USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x3062, USB_CLASS_COMM,
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index d5a74a71bf597..9c17332c19fd3 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -5327,6 +5327,7 @@ static const struct usb_device_id rtl8152_table[] = {
+ {REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x0927)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x304f)},
++ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3054)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3062)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3069)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x7205)},
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index dd7947547054a..62a063ed8220a 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -388,6 +388,15 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Kingston DataTraveler 3.0 */
+ { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* NVIDIA Jetson devices in Force Recovery mode */
++ { USB_DEVICE(0x0955, 0x7018), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7019), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7418), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7721), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7c18), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7e19), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x0955, 0x7f21), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
+ { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 3c8ec1c07ef34..6c82ea6d8e206 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -981,8 +981,8 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
+ trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS;
+ }
+
+- /* always enable Interrupt on Missed ISOC */
+- trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI;
++ if (!no_interrupt && !chain)
++ trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI;
+ break;
+
+ case USB_ENDPOINT_XFER_BULK:
+@@ -2363,6 +2363,10 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
+ if (event->status & DEPEVT_STATUS_SHORT && !chain)
+ return 1;
+
++ if ((trb->ctrl & DWC3_TRB_CTRL_ISP_IMI) &&
++ DWC3_TRB_SIZE_TRBSTS(trb->size) == DWC3_TRBSTS_MISSED_ISOC)
++ return 1;
++
+ if ((trb->ctrl & DWC3_TRB_CTRL_IOC) ||
+ (trb->ctrl & DWC3_TRB_CTRL_LST))
+ return 1;
+diff --git a/drivers/usb/gadget/udc/bdc/bdc_udc.c b/drivers/usb/gadget/udc/bdc/bdc_udc.c
+index 7bfd58c846f73..71ed3a15130fd 100644
+--- a/drivers/usb/gadget/udc/bdc/bdc_udc.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_udc.c
+@@ -151,6 +151,7 @@ static void bdc_uspc_disconnected(struct bdc *bdc, bool reinit)
+ bdc->delayed_status = false;
+ bdc->reinit = reinit;
+ bdc->test_mode = false;
++ usb_gadget_set_state(&bdc->gadget, USB_STATE_NOTATTACHED);
+ }
+
+ /* TNotify wkaeup timer */
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 7de21722d4553..3bfb344a164a4 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -906,15 +906,19 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
+ if (dev->eps[i].stream_info)
+ xhci_free_stream_info(xhci,
+ dev->eps[i].stream_info);
+- /* Endpoints on the TT/root port lists should have been removed
+- * when usb_disable_device() was called for the device.
+- * We can't drop them anyway, because the udev might have gone
+- * away by this point, and we can't tell what speed it was.
++ /*
++ * Endpoints are normally deleted from the bandwidth list when
++ * endpoints are dropped, before device is freed.
++ * If host is dying or being removed then endpoints aren't
++ * dropped cleanly, so delete the endpoint from list here.
++ * Only applicable for hosts with software bandwidth checking.
+ */
+- if (!list_empty(&dev->eps[i].bw_endpoint_list))
+- xhci_warn(xhci, "Slot %u endpoint %u "
+- "not removed from BW list!\n",
+- slot_id, i);
++
++ if (!list_empty(&dev->eps[i].bw_endpoint_list)) {
++ list_del_init(&dev->eps[i].bw_endpoint_list);
++ xhci_dbg(xhci, "Slot %u endpoint %u not removed from BW list!\n",
++ slot_id, i);
++ }
+ }
+ /* If this is a hub, free the TT(s) from the TT list */
+ xhci_free_tt_info(xhci, dev, slot_id);
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index e6bbb91955546..7f640603b1033 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -242,8 +242,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_BROKEN_STREAMS;
+
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+- pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI)
++ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) {
++ /*
++ * try to tame the ASMedia 1042 controller which reports 0.96
++ * but appears to behave more like 1.0
++ */
++ xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
+ xhci->quirks |= XHCI_BROKEN_STREAMS;
++ }
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) {
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
+index 8d31b0806cb72..b0134835af20c 100644
+--- a/drivers/video/fbdev/smscufx.c
++++ b/drivers/video/fbdev/smscufx.c
+@@ -100,7 +100,6 @@ struct ufx_data {
+ struct kref kref;
+ int fb_count;
+ bool virtualized; /* true when physical usb device not present */
+- struct delayed_work free_framebuffer_work;
+ atomic_t usb_active; /* 0 = update virtual buffer, but no usb traffic */
+ atomic_t lost_pixels; /* 1 = a render op failed. Need screen refresh */
+ u8 *edid; /* null until we read edid from hw or get from sysfs */
+@@ -1119,15 +1118,24 @@ static void ufx_free(struct kref *kref)
+ {
+ struct ufx_data *dev = container_of(kref, struct ufx_data, kref);
+
+- /* this function will wait for all in-flight urbs to complete */
+- if (dev->urbs.count > 0)
+- ufx_free_urb_list(dev);
++ kfree(dev);
++}
+
+- pr_debug("freeing ufx_data %p", dev);
++static void ufx_ops_destory(struct fb_info *info)
++{
++ struct ufx_data *dev = info->par;
++ int node = info->node;
+
+- kfree(dev);
++ /* Assume info structure is freed after this point */
++ framebuffer_release(info);
++
++ pr_debug("fb_info for /dev/fb%d has been freed", node);
++
++ /* release reference taken by kref_init in probe() */
++ kref_put(&dev->kref, ufx_free);
+ }
+
++
+ static void ufx_release_urb_work(struct work_struct *work)
+ {
+ struct urb_node *unode = container_of(work, struct urb_node,
+@@ -1136,14 +1144,9 @@ static void ufx_release_urb_work(struct work_struct *work)
+ up(&unode->dev->urbs.limit_sem);
+ }
+
+-static void ufx_free_framebuffer_work(struct work_struct *work)
++static void ufx_free_framebuffer(struct ufx_data *dev)
+ {
+- struct ufx_data *dev = container_of(work, struct ufx_data,
+- free_framebuffer_work.work);
+ struct fb_info *info = dev->info;
+- int node = info->node;
+-
+- unregister_framebuffer(info);
+
+ if (info->cmap.len != 0)
+ fb_dealloc_cmap(&info->cmap);
+@@ -1155,11 +1158,6 @@ static void ufx_free_framebuffer_work(struct work_struct *work)
+
+ dev->info = NULL;
+
+- /* Assume info structure is freed after this point */
+- framebuffer_release(info);
+-
+- pr_debug("fb_info for /dev/fb%d has been freed", node);
+-
+ /* ref taken in probe() as part of registering framebfufer */
+ kref_put(&dev->kref, ufx_free);
+ }
+@@ -1171,11 +1169,13 @@ static int ufx_ops_release(struct fb_info *info, int user)
+ {
+ struct ufx_data *dev = info->par;
+
++ mutex_lock(&disconnect_mutex);
++
+ dev->fb_count--;
+
+ /* We can't free fb_info here - fbmem will touch it when we return */
+ if (dev->virtualized && (dev->fb_count == 0))
+- schedule_delayed_work(&dev->free_framebuffer_work, HZ);
++ ufx_free_framebuffer(dev);
+
+ if ((dev->fb_count == 0) && (info->fbdefio)) {
+ fb_deferred_io_cleanup(info);
+@@ -1189,6 +1189,8 @@ static int ufx_ops_release(struct fb_info *info, int user)
+
+ kref_put(&dev->kref, ufx_free);
+
++ mutex_unlock(&disconnect_mutex);
++
+ return 0;
+ }
+
+@@ -1295,6 +1297,7 @@ static struct fb_ops ufx_ops = {
+ .fb_blank = ufx_ops_blank,
+ .fb_check_var = ufx_ops_check_var,
+ .fb_set_par = ufx_ops_set_par,
++ .fb_destroy = ufx_ops_destory,
+ };
+
+ /* Assumes &info->lock held by caller
+@@ -1678,9 +1681,6 @@ static int ufx_usb_probe(struct usb_interface *interface,
+ goto destroy_modedb;
+ }
+
+- INIT_DELAYED_WORK(&dev->free_framebuffer_work,
+- ufx_free_framebuffer_work);
+-
+ retval = ufx_reg_read(dev, 0x3000, &id_rev);
+ check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval);
+ dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev);
+@@ -1753,10 +1753,12 @@ e_nomem:
+ static void ufx_usb_disconnect(struct usb_interface *interface)
+ {
+ struct ufx_data *dev;
++ struct fb_info *info;
+
+ mutex_lock(&disconnect_mutex);
+
+ dev = usb_get_intfdata(interface);
++ info = dev->info;
+
+ pr_debug("USB disconnect starting\n");
+
+@@ -1770,12 +1772,15 @@ static void ufx_usb_disconnect(struct usb_interface *interface)
+
+ /* if clients still have us open, will be freed on last close */
+ if (dev->fb_count == 0)
+- schedule_delayed_work(&dev->free_framebuffer_work, 0);
++ ufx_free_framebuffer(dev);
+
+- /* release reference taken by kref_init in probe() */
+- kref_put(&dev->kref, ufx_free);
++ /* this function will wait for all in-flight urbs to complete */
++ if (dev->urbs.count > 0)
++ ufx_free_urb_list(dev);
+
+- /* consider ufx_data freed */
++ pr_debug("freeing ufx_data %p", dev);
++
++ unregister_framebuffer(info);
+
+ mutex_unlock(&disconnect_mutex);
+ }
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index 27d955c5d9f90..e5d4a1e1411df 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -387,8 +387,7 @@ int gntdev_map_grant_pages(struct gntdev_grant_map *map)
+ for (i = 0; i < map->count; i++) {
+ if (map->map_ops[i].status == GNTST_okay) {
+ map->unmap_ops[i].handle = map->map_ops[i].handle;
+- if (!use_ptemod)
+- alloced++;
++ alloced++;
+ } else if (!err)
+ err = -EINVAL;
+
+@@ -397,8 +396,7 @@ int gntdev_map_grant_pages(struct gntdev_grant_map *map)
+
+ if (use_ptemod) {
+ if (map->kmap_ops[i].status == GNTST_okay) {
+- if (map->map_ops[i].status == GNTST_okay)
+- alloced++;
++ alloced++;
+ map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
+ } else if (!err)
+ err = -EINVAL;
+@@ -414,20 +412,42 @@ static void __unmap_grant_pages_done(int result,
+ unsigned int i;
+ struct gntdev_grant_map *map = data->data;
+ unsigned int offset = data->unmap_ops - map->unmap_ops;
++ int successful_unmaps = 0;
++ int live_grants;
+
+ for (i = 0; i < data->count; i++) {
++ if (map->unmap_ops[offset + i].status == GNTST_okay &&
++ map->unmap_ops[offset + i].handle != -1)
++ successful_unmaps++;
++
+ WARN_ON(map->unmap_ops[offset+i].status &&
+ map->unmap_ops[offset+i].handle != -1);
+ pr_debug("unmap handle=%d st=%d\n",
+ map->unmap_ops[offset+i].handle,
+ map->unmap_ops[offset+i].status);
+ map->unmap_ops[offset+i].handle = -1;
++ if (use_ptemod) {
++ if (map->kunmap_ops[offset + i].status == GNTST_okay &&
++ map->kunmap_ops[offset + i].handle != -1)
++ successful_unmaps++;
++
++ WARN_ON(map->kunmap_ops[offset+i].status &&
++ map->kunmap_ops[offset+i].handle != -1);
++ pr_debug("kunmap handle=%u st=%d\n",
++ map->kunmap_ops[offset+i].handle,
++ map->kunmap_ops[offset+i].status);
++ map->kunmap_ops[offset+i].handle = -1;
++ }
+ }
++
+ /*
+ * Decrease the live-grant counter. This must happen after the loop to
+ * prevent premature reuse of the grants by gnttab_mmap().
+ */
+- atomic_sub(data->count, &map->live_grants);
++ live_grants = atomic_sub_return(successful_unmaps, &map->live_grants);
++ if (WARN_ON(live_grants < 0))
++ pr_err("%s: live_grants became negative (%d) after unmapping %d pages!\n",
++ __func__, live_grants, successful_unmaps);
+
+ /* Release reference taken by __unmap_grant_pages */
+ gntdev_put_map(NULL, map);
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 3fe15d6f40873..781c725e64329 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -136,6 +136,7 @@ struct share_check {
+ u64 root_objectid;
+ u64 inum;
+ int share_count;
++ bool have_delayed_delete_refs;
+ };
+
+ static inline int extent_is_shared(struct share_check *sc)
+@@ -760,16 +761,11 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info,
+ struct share_check *sc)
+ {
+ struct btrfs_delayed_ref_node *node;
+- struct btrfs_delayed_extent_op *extent_op = head->extent_op;
+ struct btrfs_key key;
+- struct btrfs_key tmp_op_key;
+ struct rb_node *n;
+ int count;
+ int ret = 0;
+
+- if (extent_op && extent_op->update_key)
+- btrfs_disk_key_to_cpu(&tmp_op_key, &extent_op->key);
+-
+ spin_lock(&head->lock);
+ for (n = rb_first(&head->ref_tree); n; n = rb_next(n)) {
+ node = rb_entry(n, struct btrfs_delayed_ref_node,
+@@ -796,10 +792,16 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info,
+ case BTRFS_TREE_BLOCK_REF_KEY: {
+ /* NORMAL INDIRECT METADATA backref */
+ struct btrfs_delayed_tree_ref *ref;
++ struct btrfs_key *key_ptr = NULL;
++
++ if (head->extent_op && head->extent_op->update_key) {
++ btrfs_disk_key_to_cpu(&key, &head->extent_op->key);
++ key_ptr = &key;
++ }
+
+ ref = btrfs_delayed_node_to_tree_ref(node);
+ ret = add_indirect_ref(fs_info, preftrees, ref->root,
+- &tmp_op_key, ref->level + 1,
++ key_ptr, ref->level + 1,
+ node->bytenr, count, sc,
+ GFP_ATOMIC);
+ break;
+@@ -825,13 +827,22 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info,
+ key.offset = ref->offset;
+
+ /*
+- * Found a inum that doesn't match our known inum, we
+- * know it's shared.
++ * If we have a share check context and a reference for
++ * another inode, we can't exit immediately. This is
++ * because even if this is a BTRFS_ADD_DELAYED_REF
++ * reference we may find next a BTRFS_DROP_DELAYED_REF
++ * which cancels out this ADD reference.
++ *
++ * If this is a DROP reference and there was no previous
++ * ADD reference, then we need to signal that when we
++ * process references from the extent tree (through
++ * add_inline_refs() and add_keyed_refs()), we should
++ * not exit early if we find a reference for another
++ * inode, because one of the delayed DROP references
++ * may cancel that reference in the extent tree.
+ */
+- if (sc && sc->inum && ref->objectid != sc->inum) {
+- ret = BACKREF_FOUND_SHARED;
+- goto out;
+- }
++ if (sc && count < 0)
++ sc->have_delayed_delete_refs = true;
+
+ ret = add_indirect_ref(fs_info, preftrees, ref->root,
+ &key, 0, node->bytenr, count, sc,
+@@ -861,7 +872,7 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info,
+ }
+ if (!ret)
+ ret = extent_is_shared(sc);
+-out:
++
+ spin_unlock(&head->lock);
+ return ret;
+ }
+@@ -965,7 +976,8 @@ static int add_inline_refs(const struct btrfs_fs_info *fs_info,
+ key.type = BTRFS_EXTENT_DATA_KEY;
+ key.offset = btrfs_extent_data_ref_offset(leaf, dref);
+
+- if (sc && sc->inum && key.objectid != sc->inum) {
++ if (sc && sc->inum && key.objectid != sc->inum &&
++ !sc->have_delayed_delete_refs) {
+ ret = BACKREF_FOUND_SHARED;
+ break;
+ }
+@@ -975,6 +987,7 @@ static int add_inline_refs(const struct btrfs_fs_info *fs_info,
+ ret = add_indirect_ref(fs_info, preftrees, root,
+ &key, 0, bytenr, count,
+ sc, GFP_NOFS);
++
+ break;
+ }
+ default:
+@@ -1064,7 +1077,8 @@ static int add_keyed_refs(struct btrfs_fs_info *fs_info,
+ key.type = BTRFS_EXTENT_DATA_KEY;
+ key.offset = btrfs_extent_data_ref_offset(leaf, dref);
+
+- if (sc && sc->inum && key.objectid != sc->inum) {
++ if (sc && sc->inum && key.objectid != sc->inum &&
++ !sc->have_delayed_delete_refs) {
+ ret = BACKREF_FOUND_SHARED;
+ break;
+ }
+@@ -1490,6 +1504,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr)
+ .root_objectid = root->objectid,
+ .inum = inum,
+ .share_count = 0,
++ .have_delayed_delete_refs = false,
+ };
+
+ tmp = ulist_alloc(GFP_NOFS);
+@@ -1528,6 +1543,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr)
+ break;
+ bytenr = node->val;
+ shared.share_count = 0;
++ shared.have_delayed_delete_refs = false;
+ cond_resched();
+ }
+
+diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
+index 99627d3438e5f..5a4e3aa8baf75 100644
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -1513,8 +1513,11 @@ int kernfs_remove_by_name_ns(struct kernfs_node *parent, const char *name,
+ mutex_lock(&kernfs_mutex);
+
+ kn = kernfs_find_ns(parent, name, ns);
+- if (kn)
++ if (kn) {
++ kernfs_get(kn);
+ __kernfs_remove(kn);
++ kernfs_put(kn);
++ }
+
+ mutex_unlock(&kernfs_mutex);
+
+diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
+index b7ca84bc3df73..d437b21925228 100644
+--- a/fs/ocfs2/namei.c
++++ b/fs/ocfs2/namei.c
+@@ -245,6 +245,7 @@ static int ocfs2_mknod(struct inode *dir,
+ handle_t *handle = NULL;
+ struct ocfs2_super *osb;
+ struct ocfs2_dinode *dirfe;
++ struct ocfs2_dinode *fe = NULL;
+ struct buffer_head *new_fe_bh = NULL;
+ struct inode *inode = NULL;
+ struct ocfs2_alloc_context *inode_ac = NULL;
+@@ -395,6 +396,7 @@ static int ocfs2_mknod(struct inode *dir,
+ goto leave;
+ }
+
++ fe = (struct ocfs2_dinode *) new_fe_bh->b_data;
+ if (S_ISDIR(mode)) {
+ status = ocfs2_fill_new_dir(osb, handle, dir, inode,
+ new_fe_bh, data_ac, meta_ac);
+@@ -460,8 +462,11 @@ static int ocfs2_mknod(struct inode *dir,
+ leave:
+ if (status < 0 && did_quota_inode)
+ dquot_free_inode(inode);
+- if (handle)
++ if (handle) {
++ if (status < 0 && fe)
++ ocfs2_set_links_count(fe, 0);
+ ocfs2_commit_trans(osb, handle);
++ }
+
+ ocfs2_inode_unlock(dir, 1);
+ if (did_block_signals)
+@@ -639,18 +644,9 @@ static int ocfs2_mknod_locked(struct ocfs2_super *osb,
+ return status;
+ }
+
+- status = __ocfs2_mknod_locked(dir, inode, dev, new_fe_bh,
++ return __ocfs2_mknod_locked(dir, inode, dev, new_fe_bh,
+ parent_fe_bh, handle, inode_ac,
+ fe_blkno, suballoc_loc, suballoc_bit);
+- if (status < 0) {
+- u64 bg_blkno = ocfs2_which_suballoc_group(fe_blkno, suballoc_bit);
+- int tmp = ocfs2_free_suballoc_bits(handle, inode_ac->ac_inode,
+- inode_ac->ac_bh, suballoc_bit, bg_blkno, 1);
+- if (tmp)
+- mlog_errno(tmp);
+- }
+-
+- return status;
+ }
+
+ static int ocfs2_mkdir(struct inode *dir,
+@@ -2031,8 +2027,11 @@ bail:
+ ocfs2_clusters_to_bytes(osb->sb, 1));
+ if (status < 0 && did_quota_inode)
+ dquot_free_inode(inode);
+- if (handle)
++ if (handle) {
++ if (status < 0 && fe)
++ ocfs2_set_links_count(fe, 0);
+ ocfs2_commit_trans(osb, handle);
++ }
+
+ ocfs2_inode_unlock(dir, 1);
+ if (did_block_signals)
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index efa6273c00067..dc63d4c6029e1 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -843,7 +843,7 @@ static int show_smaps_rollup(struct seq_file *m, void *v)
+ last_vma_end = vma->vm_end;
+ }
+
+- show_vma_header_prefix(m, priv->mm->mmap->vm_start,
++ show_vma_header_prefix(m, priv->mm->mmap ? priv->mm->mmap->vm_start : 0,
+ last_vma_end, 0, 0, 0, 0);
+ seq_pad(m, ' ');
+ seq_puts(m, "[rollup]\n");
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index b73f4423bc09d..ad6a633f5848a 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -1418,7 +1418,8 @@ struct v4l2_bt_timings {
+ ((bt)->width + V4L2_DV_BT_BLANKING_WIDTH(bt))
+ #define V4L2_DV_BT_BLANKING_HEIGHT(bt) \
+ ((bt)->vfrontporch + (bt)->vsync + (bt)->vbackporch + \
+- (bt)->il_vfrontporch + (bt)->il_vsync + (bt)->il_vbackporch)
++ ((bt)->interlaced ? \
++ ((bt)->il_vfrontporch + (bt)->il_vsync + (bt)->il_vbackporch) : 0))
+ #define V4L2_DV_BT_FRAME_HEIGHT(bt) \
+ ((bt)->height + V4L2_DV_BT_BLANKING_HEIGHT(bt))
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index 6abdfdf571ee7..6737ae6ffbae1 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -626,7 +626,7 @@ static void power_down(void)
+ int error;
+
+ if (hibernation_mode == HIBERNATION_SUSPEND) {
+- error = suspend_devices_and_enter(PM_SUSPEND_MEM);
++ error = suspend_devices_and_enter(mem_sleep_current);
+ if (error) {
+ hibernation_mode = hibernation_ops ?
+ HIBERNATION_PLATFORM :
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 45e874fafdd70..47e98a5726c46 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2116,11 +2116,11 @@ struct page *alloc_huge_page(struct vm_area_struct *vma,
+ page = alloc_buddy_huge_page_with_mpol(h, vma, addr);
+ if (!page)
+ goto out_uncharge_cgroup;
++ spin_lock(&hugetlb_lock);
+ if (!avoid_reserve && vma_has_reserves(vma, gbl_chg)) {
+ SetPagePrivate(page);
+ h->resv_huge_pages--;
+ }
+- spin_lock(&hugetlb_lock);
+ list_move(&page->lru, &h->hugepage_activelist);
+ /* Fall through */
+ }
+diff --git a/net/atm/mpoa_proc.c b/net/atm/mpoa_proc.c
+index 46d6cd9a36ae7..c4e9538ac144d 100644
+--- a/net/atm/mpoa_proc.c
++++ b/net/atm/mpoa_proc.c
+@@ -222,11 +222,12 @@ static ssize_t proc_mpc_write(struct file *file, const char __user *buff,
+ if (!page)
+ return -ENOMEM;
+
+- for (p = page, len = 0; len < nbytes; p++, len++) {
++ for (p = page, len = 0; len < nbytes; p++) {
+ if (get_user(*p, buff++)) {
+ free_page((unsigned long)page);
+ return -EFAULT;
+ }
++ len += 1;
+ if (*p == '\0' || *p == '\n')
+ break;
+ }
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 3368624be5ecd..56c240c98a567 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -112,6 +112,7 @@ static int net_assign_generic(struct net *net, unsigned int id, void *data)
+
+ static int ops_init(const struct pernet_operations *ops, struct net *net)
+ {
++ struct net_generic *ng;
+ int err = -ENOMEM;
+ void *data = NULL;
+
+@@ -130,7 +131,13 @@ static int ops_init(const struct pernet_operations *ops, struct net *net)
+ if (!err)
+ return 0;
+
++ if (ops->id && ops->size) {
+ cleanup:
++ ng = rcu_dereference_protected(net->gen,
++ lockdep_is_held(&pernet_ops_rwsem));
++ ng->ptr[*ops->id] = NULL;
++ }
++
+ kfree(data);
+
+ out:
+diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
+index 76ad550dd48ec..ee1536de5fca4 100644
+--- a/net/ieee802154/socket.c
++++ b/net/ieee802154/socket.c
+@@ -518,8 +518,10 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
+ if (err < 0)
+ goto out;
+
+- if (addr->family != AF_IEEE802154)
++ if (addr->family != AF_IEEE802154) {
++ err = -EINVAL;
+ goto out;
++ }
+
+ ieee802154_addr_from_sa(&haddr, &addr->addr);
+ dev = ieee802154_get_dev(sock_net(sk), &haddr);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 079f150e480d2..11716780667c7 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2035,7 +2035,8 @@ void tcp_enter_loss(struct sock *sk)
+ */
+ static bool tcp_check_sack_reneging(struct sock *sk, int flag)
+ {
+- if (flag & FLAG_SACK_RENEGING) {
++ if (flag & FLAG_SACK_RENEGING &&
++ flag & FLAG_SND_UNA_ADVANCED) {
+ struct tcp_sock *tp = tcp_sk(sk);
+ unsigned long delay = max(usecs_to_jiffies(tp->srtt_us >> 4),
+ msecs_to_jiffies(10));
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
+index ef2543a4c1fc5..f2fbccd3fcf43 100644
+--- a/net/kcm/kcmsock.c
++++ b/net/kcm/kcmsock.c
+@@ -164,7 +164,8 @@ static void kcm_rcv_ready(struct kcm_sock *kcm)
+ /* Buffer limit is okay now, add to ready list */
+ list_add_tail(&kcm->wait_rx_list,
+ &kcm->mux->kcm_rx_waiters);
+- kcm->rx_wait = true;
++ /* paired with lockless reads in kcm_rfree() */
++ WRITE_ONCE(kcm->rx_wait, true);
+ }
+
+ static void kcm_rfree(struct sk_buff *skb)
+@@ -180,7 +181,7 @@ static void kcm_rfree(struct sk_buff *skb)
+ /* For reading rx_wait and rx_psock without holding lock */
+ smp_mb__after_atomic();
+
+- if (!kcm->rx_wait && !kcm->rx_psock &&
++ if (!READ_ONCE(kcm->rx_wait) && !READ_ONCE(kcm->rx_psock) &&
+ sk_rmem_alloc_get(sk) < sk->sk_rcvlowat) {
+ spin_lock_bh(&mux->rx_lock);
+ kcm_rcv_ready(kcm);
+@@ -239,7 +240,8 @@ try_again:
+ if (kcm_queue_rcv_skb(&kcm->sk, skb)) {
+ /* Should mean socket buffer full */
+ list_del(&kcm->wait_rx_list);
+- kcm->rx_wait = false;
++ /* paired with lockless reads in kcm_rfree() */
++ WRITE_ONCE(kcm->rx_wait, false);
+
+ /* Commit rx_wait to read in kcm_free */
+ smp_wmb();
+@@ -282,10 +284,12 @@ static struct kcm_sock *reserve_rx_kcm(struct kcm_psock *psock,
+ kcm = list_first_entry(&mux->kcm_rx_waiters,
+ struct kcm_sock, wait_rx_list);
+ list_del(&kcm->wait_rx_list);
+- kcm->rx_wait = false;
++ /* paired with lockless reads in kcm_rfree() */
++ WRITE_ONCE(kcm->rx_wait, false);
+
+ psock->rx_kcm = kcm;
+- kcm->rx_psock = psock;
++ /* paired with lockless reads in kcm_rfree() */
++ WRITE_ONCE(kcm->rx_psock, psock);
+
+ spin_unlock_bh(&mux->rx_lock);
+
+@@ -312,7 +316,8 @@ static void unreserve_rx_kcm(struct kcm_psock *psock,
+ spin_lock_bh(&mux->rx_lock);
+
+ psock->rx_kcm = NULL;
+- kcm->rx_psock = NULL;
++ /* paired with lockless reads in kcm_rfree() */
++ WRITE_ONCE(kcm->rx_psock, NULL);
+
+ /* Commit kcm->rx_psock before sk_rmem_alloc_get to sync with
+ * kcm_rfree
+@@ -1240,7 +1245,8 @@ static void kcm_recv_disable(struct kcm_sock *kcm)
+ if (!kcm->rx_psock) {
+ if (kcm->rx_wait) {
+ list_del(&kcm->wait_rx_list);
+- kcm->rx_wait = false;
++ /* paired with lockless reads in kcm_rfree() */
++ WRITE_ONCE(kcm->rx_wait, false);
+ }
+
+ requeue_rx_msgs(mux, &kcm->sk.sk_receive_queue);
+@@ -1793,7 +1799,8 @@ static void kcm_done(struct kcm_sock *kcm)
+
+ if (kcm->rx_wait) {
+ list_del(&kcm->wait_rx_list);
+- kcm->rx_wait = false;
++ /* paired with lockless reads in kcm_rfree() */
++ WRITE_ONCE(kcm->rx_wait, false);
+ }
+ /* Move any pending receive messages to other kcm sockets */
+ requeue_rx_msgs(mux, &sk->sk_receive_queue);
+diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
+index 060ccd0e14ce7..dc1a384bc1374 100644
+--- a/net/mac802154/rx.c
++++ b/net/mac802154/rx.c
+@@ -140,7 +140,7 @@ static int
+ ieee802154_parse_frame_start(struct sk_buff *skb, struct ieee802154_hdr *hdr)
+ {
+ int hlen;
+- struct ieee802154_mac_cb *cb = mac_cb_init(skb);
++ struct ieee802154_mac_cb *cb = mac_cb(skb);
+
+ skb_reset_mac_header(skb);
+
+@@ -302,8 +302,9 @@ void
+ ieee802154_rx_irqsafe(struct ieee802154_hw *hw, struct sk_buff *skb, u8 lqi)
+ {
+ struct ieee802154_local *local = hw_to_local(hw);
++ struct ieee802154_mac_cb *cb = mac_cb_init(skb);
+
+- mac_cb(skb)->lqi = lqi;
++ cb->lqi = lqi;
+ skb->pkt_type = IEEE802154_RX_MSG;
+ skb_queue_tail(&local->skb_queue, skb);
+ tasklet_schedule(&local->tasklet);
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index b4e3db194140a..e9a10a66b4cad 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -1551,7 +1551,8 @@ static void ovs_dp_reset_user_features(struct sk_buff *skb, struct genl_info *in
+ if (IS_ERR(dp))
+ return;
+
+- WARN(dp->user_features, "Dropping previously announced user features\n");
++ pr_warn("%s: Dropping previously announced user features\n",
++ ovs_dp_name(dp));
+ dp->user_features = 0;
+ }
+
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index 18c207b85d513..01a177cfa5333 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -2149,8 +2149,12 @@ retry:
+
+ static void cake_reset(struct Qdisc *sch)
+ {
++ struct cake_sched_data *q = qdisc_priv(sch);
+ u32 c;
+
++ if (!q->tins)
++ return;
++
+ for (c = 0; c < CAKE_MAX_TINS; c++)
+ cake_clear_tin(sch, c);
+ }
+diff --git a/net/tipc/discover.c b/net/tipc/discover.c
+index c138d68e8a695..0006c9f871998 100644
+--- a/net/tipc/discover.c
++++ b/net/tipc/discover.c
+@@ -146,8 +146,8 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
+ {
+ struct net *net = d->net;
+ struct tipc_net *tn = tipc_net(net);
+- bool trial = time_before(jiffies, tn->addr_trial_end);
+ u32 self = tipc_own_addr(net);
++ bool trial = time_before(jiffies, tn->addr_trial_end) && !self;
+
+ if (mtyp == DSC_TRIAL_FAIL_MSG) {
+ if (!trial)
+diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
+index 1c4733153d749..5a88a93e67ef2 100644
+--- a/net/tipc/topsrv.c
++++ b/net/tipc/topsrv.c
+@@ -457,12 +457,19 @@ static void tipc_conn_data_ready(struct sock *sk)
+ static void tipc_topsrv_accept(struct work_struct *work)
+ {
+ struct tipc_topsrv *srv = container_of(work, struct tipc_topsrv, awork);
+- struct socket *lsock = srv->listener;
+- struct socket *newsock;
++ struct socket *newsock, *lsock;
+ struct tipc_conn *con;
+ struct sock *newsk;
+ int ret;
+
++ spin_lock_bh(&srv->idr_lock);
++ if (!srv->listener) {
++ spin_unlock_bh(&srv->idr_lock);
++ return;
++ }
++ lsock = srv->listener;
++ spin_unlock_bh(&srv->idr_lock);
++
+ while (1) {
+ ret = kernel_accept(lsock, &newsock, O_NONBLOCK);
+ if (ret < 0)
+@@ -496,7 +503,7 @@ static void tipc_topsrv_listener_data_ready(struct sock *sk)
+
+ read_lock_bh(&sk->sk_callback_lock);
+ srv = sk->sk_user_data;
+- if (srv->listener)
++ if (srv)
+ queue_work(srv->rcv_wq, &srv->awork);
+ read_unlock_bh(&sk->sk_callback_lock);
+ }
+@@ -575,7 +582,7 @@ bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type, u32 lower,
+ sub.seq.upper = upper;
+ sub.timeout = TIPC_WAIT_FOREVER;
+ sub.filter = filter;
+- *(u32 *)&sub.usr_handle = port;
++ *(u64 *)&sub.usr_handle = (u64)port;
+
+ con = tipc_conn_alloc(tipc_topsrv(net));
+ if (IS_ERR(con))
+@@ -706,8 +713,9 @@ static void tipc_topsrv_stop(struct net *net)
+ __module_get(lsock->sk->sk_prot_creator->owner);
+ srv->listener = NULL;
+ spin_unlock_bh(&srv->idr_lock);
+- sock_release(lsock);
++
+ tipc_topsrv_work_stop(srv);
++ sock_release(lsock);
+ idr_destroy(&srv->conn_idr);
+ kfree(srv);
+ }
+diff --git a/sound/aoa/soundbus/i2sbus/core.c b/sound/aoa/soundbus/i2sbus/core.c
+index 000b585221063..2811e1f1e2fa9 100644
+--- a/sound/aoa/soundbus/i2sbus/core.c
++++ b/sound/aoa/soundbus/i2sbus/core.c
+@@ -148,6 +148,7 @@ static int i2sbus_get_and_fixup_rsrc(struct device_node *np, int index,
+ return rc;
+ }
+
++/* Returns 1 if added, 0 for otherwise; don't return a negative value! */
+ /* FIXME: look at device node refcounting */
+ static int i2sbus_add_dev(struct macio_dev *macio,
+ struct i2sbus_control *control,
+@@ -213,7 +214,7 @@ static int i2sbus_add_dev(struct macio_dev *macio,
+ * either as the second one in that case is just a modem. */
+ if (!ok) {
+ kfree(dev);
+- return -ENODEV;
++ return 0;
+ }
+
+ mutex_init(&dev->lock);
+@@ -302,6 +303,10 @@ static int i2sbus_add_dev(struct macio_dev *macio,
+
+ if (soundbus_add_one(&dev->sound)) {
+ printk(KERN_DEBUG "i2sbus: device registration error!\n");
++ if (dev->sound.ofdev.dev.kobj.state_initialized) {
++ soundbus_dev_put(&dev->sound);
++ return 0;
++ }
+ goto err;
+ }
+
+diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
+index 34d75d4fb93f6..a276c4283c7bb 100644
+--- a/sound/pci/ac97/ac97_codec.c
++++ b/sound/pci/ac97/ac97_codec.c
+@@ -1965,6 +1965,7 @@ static int snd_ac97_dev_register(struct snd_device *device)
+ snd_ac97_get_short_name(ac97));
+ if ((err = device_register(&ac97->dev)) < 0) {
+ ac97_err(ac97, "Can't register ac97 bus\n");
++ put_device(&ac97->dev);
+ ac97->dev.bus = NULL;
+ return err;
+ }
+diff --git a/sound/pci/au88x0/au88x0.h b/sound/pci/au88x0/au88x0.h
+index e3e31f07d7661..631eafc4143ef 100644
+--- a/sound/pci/au88x0/au88x0.h
++++ b/sound/pci/au88x0/au88x0.h
+@@ -153,7 +153,7 @@ struct snd_vortex {
+ #ifndef CHIP_AU8810
+ stream_t dma_wt[NR_WT];
+ wt_voice_t wt_voice[NR_WT]; /* WT register cache. */
+- char mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */
++ s8 mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */
+ #endif
+
+ /* Global resources */
+@@ -247,8 +247,8 @@ static int vortex_alsafmt_aspfmt(snd_pcm_format_t alsafmt, vortex_t *v);
+ static void vortex_connect_default(vortex_t * vortex, int en);
+ static int vortex_adb_allocroute(vortex_t * vortex, int dma, int nr_ch,
+ int dir, int type, int subdev);
+-static char vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out,
+- int restype);
++static int vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out,
++ int restype);
+ #ifndef CHIP_AU8810
+ static int vortex_wt_allocroute(vortex_t * vortex, int dma, int nr_ch);
+ static void vortex_wt_connect(vortex_t * vortex, int en);
+diff --git a/sound/pci/au88x0/au88x0_core.c b/sound/pci/au88x0/au88x0_core.c
+index 2e5b460a847c6..49e5bd078ad05 100644
+--- a/sound/pci/au88x0/au88x0_core.c
++++ b/sound/pci/au88x0/au88x0_core.c
+@@ -2004,7 +2004,7 @@ static int resnum[VORTEX_RESOURCE_LAST] =
+ out: Mean checkout if != 0. Else mean Checkin resource.
+ restype: Indicates type of resource to be checked in or out.
+ */
+-static char
++static int
+ vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, int restype)
+ {
+ int i, qty = resnum[restype], resinuse = 0;
+diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c
+index d8140ad98d5f0..6f6f40fbe548c 100644
+--- a/sound/synth/emux/emux.c
++++ b/sound/synth/emux/emux.c
+@@ -138,15 +138,10 @@ EXPORT_SYMBOL(snd_emux_register);
+ */
+ int snd_emux_free(struct snd_emux *emu)
+ {
+- unsigned long flags;
+-
+ if (! emu)
+ return -EINVAL;
+
+- spin_lock_irqsave(&emu->voice_lock, flags);
+- if (emu->timer_active)
+- del_timer(&emu->tlist);
+- spin_unlock_irqrestore(&emu->voice_lock, flags);
++ del_timer_sync(&emu->tlist);
+
+ snd_emux_proc_free(emu);
+ snd_emux_delete_virmidi(emu);
+diff --git a/tools/iio/iio_utils.c b/tools/iio/iio_utils.c
+index 55272fef3b508..d60a252577f0b 100644
+--- a/tools/iio/iio_utils.c
++++ b/tools/iio/iio_utils.c
+@@ -546,6 +546,10 @@ static int calc_digits(int num)
+ {
+ int count = 0;
+
++ /* It takes a digit to represent zero */
++ if (!num)
++ return 1;
++
+ while (num != 0) {
+ num /= 10;
+ count++;
+diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
+index f7c4dcb9d5821..05cbdb6e6be8e 100644
+--- a/tools/perf/util/auxtrace.c
++++ b/tools/perf/util/auxtrace.c
+@@ -1678,11 +1678,19 @@ struct sym_args {
+ bool near;
+ };
+
++static bool kern_sym_name_match(const char *kname, const char *name)
++{
++ size_t n = strlen(name);
++
++ return !strcmp(kname, name) ||
++ (!strncmp(kname, name, n) && kname[n] == '\t');
++}
++
+ static bool kern_sym_match(struct sym_args *args, const char *name, char type)
+ {
+ /* A function with the same name, and global or the n'th found or any */
+ return kallsyms__is_function(type) &&
+- !strcmp(name, args->name) &&
++ kern_sym_name_match(name, args->name) &&
+ ((args->global && isupper(type)) ||
+ (args->selected && ++(args->cnt) == args->idx) ||
+ (!args->global && !args->selected));
+diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
+index f139b1c62ca38..cb36774a750c8 100644
+--- a/virt/kvm/arm/vgic/vgic-its.c
++++ b/virt/kvm/arm/vgic/vgic-its.c
+@@ -1915,7 +1915,7 @@ static int scan_its_table(struct vgic_its *its, gpa_t base, int size, u32 esz,
+
+ memset(entry, 0, esz);
+
+- while (len > 0) {
++ while (true) {
+ int next_offset;
+ size_t byte_offset;
+
+@@ -1928,6 +1928,9 @@ static int scan_its_table(struct vgic_its *its, gpa_t base, int size, u32 esz,
+ return next_offset;
+
+ byte_offset = next_offset * esz;
++ if (byte_offset >= len)
++ break;
++
+ id += next_offset;
+ gpa += byte_offset;
+ len -= byte_offset;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-11-10 17:58 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-11-10 17:58 UTC (permalink / raw
To: gentoo-commits
commit: 2ffdae15b41e2c50afdb927768e488e0cab00051
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Nov 10 17:57:44 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Nov 10 17:57:44 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2ffdae15
Linux patch 4.19.265
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1264_linux-4.19.265.patch | 1605 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1609 insertions(+)
diff --git a/0000_README b/0000_README
index 3f9cf874..31133058 100644
--- a/0000_README
+++ b/0000_README
@@ -1099,6 +1099,10 @@ Patch: 1263_linux-4.19.264.patch
From: https://www.kernel.org
Desc: Linux 4.19.264
+Patch: 1264_linux-4.19.265.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.265
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1264_linux-4.19.265.patch b/1264_linux-4.19.265.patch
new file mode 100644
index 00000000..6128ca7d
--- /dev/null
+++ b/1264_linux-4.19.265.patch
@@ -0,0 +1,1605 @@
+diff --git a/Documentation/trace/histogram.rst b/Documentation/trace/histogram.rst
+index c14dab13a47e8..d2849713d37be 100644
+--- a/Documentation/trace/histogram.rst
++++ b/Documentation/trace/histogram.rst
+@@ -39,7 +39,7 @@ Documentation written by Tom Zanussi
+ will use the event's kernel stacktrace as the key. The keywords
+ 'keys' or 'key' can be used to specify keys, and the keywords
+ 'values', 'vals', or 'val' can be used to specify values. Compound
+- keys consisting of up to two fields can be specified by the 'keys'
++ keys consisting of up to three fields can be specified by the 'keys'
+ keyword. Hashing a compound key produces a unique entry in the
+ table for each unique combination of component keys, and can be
+ useful for providing more fine-grained summaries of event data.
+diff --git a/Makefile b/Makefile
+index bc4864f3bd0e2..592e6928e0203 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 264
++SUBLEVEL = 265
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/parisc/include/asm/hardware.h b/arch/parisc/include/asm/hardware.h
+index d6e1ed1450312..f4eab68e25a94 100644
+--- a/arch/parisc/include/asm/hardware.h
++++ b/arch/parisc/include/asm/hardware.h
+@@ -10,12 +10,12 @@
+ #define SVERSION_ANY_ID PA_SVERSION_ANY_ID
+
+ struct hp_hardware {
+- unsigned short hw_type:5; /* HPHW_xxx */
+- unsigned short hversion;
+- unsigned long sversion:28;
+- unsigned short opt;
+- const char name[80]; /* The hardware description */
+-};
++ unsigned int hw_type:8; /* HPHW_xxx */
++ unsigned int hversion:12;
++ unsigned int sversion:12;
++ unsigned char opt;
++ unsigned char name[59]; /* The hardware description */
++} __packed;
+
+ struct parisc_device;
+
+diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
+index 592e8cec16dd5..01a2ed59d2f2a 100644
+--- a/arch/parisc/kernel/drivers.c
++++ b/arch/parisc/kernel/drivers.c
+@@ -861,15 +861,13 @@ void __init walk_central_bus(void)
+ &root);
+ }
+
+-static void print_parisc_device(struct parisc_device *dev)
++static __init void print_parisc_device(struct parisc_device *dev)
+ {
+- char hw_path[64];
+- static int count;
++ static int count __initdata;
+
+- print_pa_hwpath(dev, hw_path);
+- pr_info("%d. %s at %pap [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
+- ++count, dev->name, &(dev->hpa.start), hw_path, dev->id.hw_type,
+- dev->id.hversion_rev, dev->id.hversion, dev->id.sversion);
++ pr_info("%d. %s at %pap { type:%d, hv:%#x, sv:%#x, rev:%#x }",
++ ++count, dev->name, &(dev->hpa.start), dev->id.hw_type,
++ dev->id.hversion, dev->id.sversion, dev->id.hversion_rev);
+
+ if (dev->num_addrs) {
+ int k;
+@@ -1058,7 +1056,7 @@ static __init int qemu_print_iodc_data(struct device *lin_dev, void *data)
+
+
+
+-static int print_one_device(struct device * dev, void * data)
++static __init int print_one_device(struct device * dev, void * data)
+ {
+ struct parisc_device * pdev = to_parisc_device(dev);
+
+diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
+index 0489ffc3dfe5f..768a765c49b0d 100644
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -680,6 +680,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ g_phys_as = phys_as;
+
+ entry->eax = g_phys_as | (virt_as << 8);
++ entry->ecx &= ~(GENMASK(31, 16) | GENMASK(11, 8));
+ entry->edx = 0;
+ /*
+ * IBRS, IBPB and VIRT_SSBD aren't necessarily present in
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index b1490e08f8911..0cb75d29e67b7 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -759,8 +759,7 @@ static int linearize(struct x86_emulate_ctxt *ctxt,
+ ctxt->mode, linear);
+ }
+
+-static inline int assign_eip(struct x86_emulate_ctxt *ctxt, ulong dst,
+- enum x86emul_mode mode)
++static inline int assign_eip(struct x86_emulate_ctxt *ctxt, ulong dst)
+ {
+ ulong linear;
+ int rc;
+@@ -770,41 +769,71 @@ static inline int assign_eip(struct x86_emulate_ctxt *ctxt, ulong dst,
+
+ if (ctxt->op_bytes != sizeof(unsigned long))
+ addr.ea = dst & ((1UL << (ctxt->op_bytes << 3)) - 1);
+- rc = __linearize(ctxt, addr, &max_size, 1, false, true, mode, &linear);
++ rc = __linearize(ctxt, addr, &max_size, 1, false, true, ctxt->mode, &linear);
+ if (rc == X86EMUL_CONTINUE)
+ ctxt->_eip = addr.ea;
+ return rc;
+ }
+
++static inline int emulator_recalc_and_set_mode(struct x86_emulate_ctxt *ctxt)
++{
++ u64 efer;
++ struct desc_struct cs;
++ u16 selector;
++ u32 base3;
++
++ ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
++
++ if (!(ctxt->ops->get_cr(ctxt, 0) & X86_CR0_PE)) {
++ /* Real mode. cpu must not have long mode active */
++ if (efer & EFER_LMA)
++ return X86EMUL_UNHANDLEABLE;
++ ctxt->mode = X86EMUL_MODE_REAL;
++ return X86EMUL_CONTINUE;
++ }
++
++ if (ctxt->eflags & X86_EFLAGS_VM) {
++ /* Protected/VM86 mode. cpu must not have long mode active */
++ if (efer & EFER_LMA)
++ return X86EMUL_UNHANDLEABLE;
++ ctxt->mode = X86EMUL_MODE_VM86;
++ return X86EMUL_CONTINUE;
++ }
++
++ if (!ctxt->ops->get_segment(ctxt, &selector, &cs, &base3, VCPU_SREG_CS))
++ return X86EMUL_UNHANDLEABLE;
++
++ if (efer & EFER_LMA) {
++ if (cs.l) {
++ /* Proper long mode */
++ ctxt->mode = X86EMUL_MODE_PROT64;
++ } else if (cs.d) {
++ /* 32 bit compatibility mode*/
++ ctxt->mode = X86EMUL_MODE_PROT32;
++ } else {
++ ctxt->mode = X86EMUL_MODE_PROT16;
++ }
++ } else {
++ /* Legacy 32 bit / 16 bit mode */
++ ctxt->mode = cs.d ? X86EMUL_MODE_PROT32 : X86EMUL_MODE_PROT16;
++ }
++
++ return X86EMUL_CONTINUE;
++}
++
+ static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst)
+ {
+- return assign_eip(ctxt, dst, ctxt->mode);
++ return assign_eip(ctxt, dst);
+ }
+
+-static int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst,
+- const struct desc_struct *cs_desc)
++static int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst)
+ {
+- enum x86emul_mode mode = ctxt->mode;
+- int rc;
++ int rc = emulator_recalc_and_set_mode(ctxt);
+
+-#ifdef CONFIG_X86_64
+- if (ctxt->mode >= X86EMUL_MODE_PROT16) {
+- if (cs_desc->l) {
+- u64 efer = 0;
++ if (rc != X86EMUL_CONTINUE)
++ return rc;
+
+- ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
+- if (efer & EFER_LMA)
+- mode = X86EMUL_MODE_PROT64;
+- } else
+- mode = X86EMUL_MODE_PROT32; /* temporary value */
+- }
+-#endif
+- if (mode == X86EMUL_MODE_PROT16 || mode == X86EMUL_MODE_PROT32)
+- mode = cs_desc->d ? X86EMUL_MODE_PROT32 : X86EMUL_MODE_PROT16;
+- rc = assign_eip(ctxt, dst, mode);
+- if (rc == X86EMUL_CONTINUE)
+- ctxt->mode = mode;
+- return rc;
++ return assign_eip(ctxt, dst);
+ }
+
+ static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
+@@ -2192,7 +2221,7 @@ static int em_jmp_far(struct x86_emulate_ctxt *ctxt)
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+
+- rc = assign_eip_far(ctxt, ctxt->src.val, &new_desc);
++ rc = assign_eip_far(ctxt, ctxt->src.val);
+ /* Error handling is not implemented. */
+ if (rc != X86EMUL_CONTINUE)
+ return X86EMUL_UNHANDLEABLE;
+@@ -2273,7 +2302,7 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
+ &new_desc);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+- rc = assign_eip_far(ctxt, eip, &new_desc);
++ rc = assign_eip_far(ctxt, eip);
+ /* Error handling is not implemented. */
+ if (rc != X86EMUL_CONTINUE)
+ return X86EMUL_UNHANDLEABLE;
+@@ -2895,6 +2924,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
+
+ ctxt->_eip = rdx;
++ ctxt->mode = usermode;
+ *reg_write(ctxt, VCPU_REGS_RSP) = rcx;
+
+ return X86EMUL_CONTINUE;
+@@ -3491,7 +3521,7 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt)
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+
+- rc = assign_eip_far(ctxt, ctxt->src.val, &new_desc);
++ rc = assign_eip_far(ctxt, ctxt->src.val);
+ if (rc != X86EMUL_CONTINUE)
+ goto fail;
+
+@@ -3638,11 +3668,25 @@ static int em_movbe(struct x86_emulate_ctxt *ctxt)
+
+ static int em_cr_write(struct x86_emulate_ctxt *ctxt)
+ {
+- if (ctxt->ops->set_cr(ctxt, ctxt->modrm_reg, ctxt->src.val))
++ int cr_num = ctxt->modrm_reg;
++ int r;
++
++ if (ctxt->ops->set_cr(ctxt, cr_num, ctxt->src.val))
+ return emulate_gp(ctxt, 0);
+
+ /* Disable writeback. */
+ ctxt->dst.type = OP_NONE;
++
++ if (cr_num == 0) {
++ /*
++ * CR0 write might have updated CR0.PE and/or CR0.PG
++ * which can affect the cpu's execution mode.
++ */
++ r = emulator_recalc_and_set_mode(ctxt);
++ if (r != X86EMUL_CONTINUE)
++ return r;
++ }
++
+ return X86EMUL_CONTINUE;
+ }
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index a9f42df92ea33..7415db053217c 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -416,6 +416,8 @@ static struct bfq_io_cq *bfq_bic_lookup(struct bfq_data *bfqd,
+ */
+ void bfq_schedule_dispatch(struct bfq_data *bfqd)
+ {
++ lockdep_assert_held(&bfqd->lock);
++
+ if (bfqd->queued != 0) {
+ bfq_log(bfqd, "schedule dispatch");
+ blk_mq_run_hw_queues(bfqd->queue, true);
+@@ -5278,8 +5280,8 @@ bfq_idle_slice_timer_body(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+ bfq_bfqq_expire(bfqd, bfqq, true, reason);
+
+ schedule_dispatch:
+- spin_unlock_irqrestore(&bfqd->lock, flags);
+ bfq_schedule_dispatch(bfqd);
++ spin_unlock_irqrestore(&bfqd->lock, flags);
+ }
+
+ /*
+diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
+index 52cea1b3ea706..591778024054f 100644
+--- a/drivers/ata/pata_legacy.c
++++ b/drivers/ata/pata_legacy.c
+@@ -292,9 +292,10 @@ static void pdc20230_set_piomode(struct ata_port *ap, struct ata_device *adev)
+ outb(inb(0x1F4) & 0x07, 0x1F4);
+
+ rt = inb(0x1F3);
+- rt &= 0x07 << (3 * adev->devno);
++ rt &= ~(0x07 << (3 * !adev->devno));
+ if (pio)
+- rt |= (1 + 3 * pio) << (3 * adev->devno);
++ rt |= (1 + 3 * pio) << (3 * !adev->devno);
++ outb(rt, 0x1F3);
+
+ udelay(100);
+ outb(inb(0x1F2) | 0x01, 0x1F2);
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index 7098744f9276a..f0ef2643b70ed 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -556,7 +556,7 @@ int __init efi_config_parse_tables(void *config_tables, int count, int sz,
+
+ seed = early_memremap(efi.rng_seed, sizeof(*seed));
+ if (seed != NULL) {
+- size = seed->size;
++ size = min(seed->size, EFI_RANDOM_SEED_SIZE);
+ early_memunmap(seed, sizeof(*seed));
+ } else {
+ pr_err("Could not map UEFI random seed!\n");
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 70079d29822b7..00943ddbe4172 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -793,6 +793,7 @@
+ #define USB_DEVICE_ID_MADCATZ_BEATPAD 0x4540
+ #define USB_DEVICE_ID_MADCATZ_RAT5 0x1705
+ #define USB_DEVICE_ID_MADCATZ_RAT9 0x1709
++#define USB_DEVICE_ID_MADCATZ_MMO7 0x1713
+
+ #define USB_VENDOR_ID_MCC 0x09db
+ #define USB_DEVICE_ID_MCC_PMD1024LS 0x0076
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index c1b76ba85fb44..8de294aa3184a 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -620,6 +620,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT5) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_MMO7) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_SAMSUNG)
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
+diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c
+index 683861f324e3c..95e004d9b1106 100644
+--- a/drivers/hid/hid-saitek.c
++++ b/drivers/hid/hid-saitek.c
+@@ -191,6 +191,8 @@ static const struct hid_device_id saitek_devices[] = {
+ .driver_data = SAITEK_RELEASE_MODE_RAT7 },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7),
+ .driver_data = SAITEK_RELEASE_MODE_MMO7 },
++ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_MMO7),
++ .driver_data = SAITEK_RELEASE_MODE_MMO7 },
+ { }
+ };
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 52acb185a29cf..03ce9b7d6456a 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -893,6 +893,7 @@ static struct platform_driver xiic_i2c_driver = {
+
+ module_platform_driver(xiic_i2c_driver);
+
++MODULE_ALIAS("platform:" DRIVER_NAME);
+ MODULE_AUTHOR("info@mocean-labs.com");
+ MODULE_DESCRIPTION("Xilinx I2C bus driver");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
+index 2a82661620fe7..72ec9d36799ff 100644
+--- a/drivers/infiniband/hw/qedr/main.c
++++ b/drivers/infiniband/hw/qedr/main.c
+@@ -338,6 +338,10 @@ static int qedr_alloc_resources(struct qedr_dev *dev)
+ spin_lock_init(&dev->qpidr.idr_lock);
+ idr_init(&dev->qpidr.idr);
+ dev->iwarp_wq = create_singlethread_workqueue("qedr_iwarpq");
++ if (!dev->iwarp_wq) {
++ rc = -ENOMEM;
++ goto err1;
++ }
+ }
+
+ /* Allocate Status blocks for CNQ */
+@@ -345,7 +349,7 @@ static int qedr_alloc_resources(struct qedr_dev *dev)
+ GFP_KERNEL);
+ if (!dev->sb_array) {
+ rc = -ENOMEM;
+- goto err1;
++ goto err_destroy_wq;
+ }
+
+ dev->cnq_array = kcalloc(dev->num_cnq,
+@@ -399,6 +403,9 @@ err3:
+ kfree(dev->cnq_array);
+ err2:
+ kfree(dev->sb_array);
++err_destroy_wq:
++ if (IS_IWARP(dev))
++ destroy_workqueue(dev->iwarp_wq);
+ err1:
+ kfree(dev->sgid_tbl);
+ return rc;
+diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
+index 4a342daac98dc..45b6aaf3de4ad 100644
+--- a/drivers/isdn/hardware/mISDN/netjet.c
++++ b/drivers/isdn/hardware/mISDN/netjet.c
+@@ -970,7 +970,7 @@ nj_release(struct tiger_hw *card)
+ }
+ if (card->irq > 0)
+ free_irq(card->irq, card);
+- if (card->isac.dch.dev.dev.class)
++ if (device_is_registered(&card->isac.dch.dev.dev))
+ mISDN_unregister_device(&card->isac.dch.dev);
+
+ for (i = 0; i < 2; i++) {
+diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c
+index f5a06a6fb297f..5cd53b2c47c75 100644
+--- a/drivers/isdn/mISDN/core.c
++++ b/drivers/isdn/mISDN/core.c
+@@ -242,11 +242,12 @@ mISDN_register_device(struct mISDNdevice *dev,
+ if (debug & DEBUG_CORE)
+ printk(KERN_DEBUG "mISDN_register %s %d\n",
+ dev_name(&dev->dev), dev->id);
++ dev->dev.class = &mISDN_class;
++
+ err = create_stack(dev);
+ if (err)
+ goto error1;
+
+- dev->dev.class = &mISDN_class;
+ dev->dev.platform_data = dev;
+ dev->dev.parent = parent;
+ dev_set_drvdata(&dev->dev, dev);
+@@ -258,8 +259,8 @@ mISDN_register_device(struct mISDNdevice *dev,
+
+ error3:
+ delete_stack(dev);
+- return err;
+ error1:
++ put_device(&dev->dev);
+ return err;
+
+ }
+diff --git a/drivers/media/dvb-frontends/drxk_hard.c b/drivers/media/dvb-frontends/drxk_hard.c
+index 84ac3f73f8fe4..100a3a0b2db37 100644
+--- a/drivers/media/dvb-frontends/drxk_hard.c
++++ b/drivers/media/dvb-frontends/drxk_hard.c
+@@ -6694,7 +6694,7 @@ static int drxk_read_snr(struct dvb_frontend *fe, u16 *snr)
+ static int drxk_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
+ {
+ struct drxk_state *state = fe->demodulator_priv;
+- u16 err;
++ u16 err = 0;
+
+ dprintk(1, "\n");
+
+diff --git a/drivers/media/platform/cros-ec-cec/cros-ec-cec.c b/drivers/media/platform/cros-ec-cec/cros-ec-cec.c
+index 7bc4d8a9af287..1f35770245d1f 100644
+--- a/drivers/media/platform/cros-ec-cec/cros-ec-cec.c
++++ b/drivers/media/platform/cros-ec-cec/cros-ec-cec.c
+@@ -44,6 +44,8 @@ static void handle_cec_message(struct cros_ec_cec *cros_ec_cec)
+ uint8_t *cec_message = cros_ec->event_data.data.cec_message;
+ unsigned int len = cros_ec->event_size;
+
++ if (len > CEC_MAX_MSG_SIZE)
++ len = CEC_MAX_MSG_SIZE;
+ cros_ec_cec->rx_msg.len = len;
+ memcpy(cros_ec_cec->rx_msg.msg, cec_message, len);
+
+diff --git a/drivers/media/platform/s5p-cec/s5p_cec.c b/drivers/media/platform/s5p-cec/s5p_cec.c
+index 3032247c63a51..554c8f2b60b8b 100644
+--- a/drivers/media/platform/s5p-cec/s5p_cec.c
++++ b/drivers/media/platform/s5p-cec/s5p_cec.c
+@@ -116,6 +116,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv)
+ dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n");
+ cec->rx = STATE_BUSY;
+ cec->msg.len = status >> 24;
++ if (cec->msg.len > CEC_MAX_MSG_SIZE)
++ cec->msg.len = CEC_MAX_MSG_SIZE;
+ cec->msg.rx_status = CEC_RX_STATUS_OK;
+ s5p_cec_get_rx_buf(cec, cec->msg.len,
+ cec->msg.msg);
+diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
+index 990de7c54b460..30f8f0117a307 100644
+--- a/drivers/net/dsa/dsa_loop.c
++++ b/drivers/net/dsa/dsa_loop.c
+@@ -333,6 +333,17 @@ static struct mdio_driver dsa_loop_drv = {
+
+ #define NUM_FIXED_PHYS (DSA_LOOP_NUM_PORTS - 2)
+
++static void dsa_loop_phydevs_unregister(void)
++{
++ unsigned int i;
++
++ for (i = 0; i < NUM_FIXED_PHYS; i++)
++ if (!IS_ERR(phydevs[i])) {
++ fixed_phy_unregister(phydevs[i]);
++ phy_device_free(phydevs[i]);
++ }
++}
++
+ static int __init dsa_loop_init(void)
+ {
+ struct fixed_phy_status status = {
+@@ -340,23 +351,23 @@ static int __init dsa_loop_init(void)
+ .speed = SPEED_100,
+ .duplex = DUPLEX_FULL,
+ };
+- unsigned int i;
++ unsigned int i, ret;
+
+ for (i = 0; i < NUM_FIXED_PHYS; i++)
+ phydevs[i] = fixed_phy_register(PHY_POLL, &status, -1, NULL);
+
+- return mdio_driver_register(&dsa_loop_drv);
++ ret = mdio_driver_register(&dsa_loop_drv);
++ if (ret)
++ dsa_loop_phydevs_unregister();
++
++ return ret;
+ }
+ module_init(dsa_loop_init);
+
+ static void __exit dsa_loop_exit(void)
+ {
+- unsigned int i;
+-
+ mdio_driver_unregister(&dsa_loop_drv);
+- for (i = 0; i < NUM_FIXED_PHYS; i++)
+- if (!IS_ERR(phydevs[i]))
+- fixed_phy_unregister(phydevs[i]);
++ dsa_loop_phydevs_unregister();
+ }
+ module_exit(dsa_loop_exit);
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index fcd5d845e99ae..e97ab9545a792 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -623,7 +623,7 @@ fec_enet_txq_put_data_tso(struct fec_enet_priv_tx_q *txq, struct sk_buff *skb,
+ dev_kfree_skb_any(skb);
+ if (net_ratelimit())
+ netdev_err(ndev, "Tx DMA memory map failed\n");
+- return NETDEV_TX_BUSY;
++ return NETDEV_TX_OK;
+ }
+
+ bdp->cbd_datlen = cpu_to_fec16(size);
+@@ -685,7 +685,7 @@ fec_enet_txq_put_hdr_tso(struct fec_enet_priv_tx_q *txq,
+ dev_kfree_skb_any(skb);
+ if (net_ratelimit())
+ netdev_err(ndev, "Tx DMA memory map failed\n");
+- return NETDEV_TX_BUSY;
++ return NETDEV_TX_OK;
+ }
+ }
+
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index efdac68da7f4b..1d1fbd7bd6fc1 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -412,7 +412,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
+ bus->reset(bus);
+
+ for (i = 0; i < PHY_MAX_ADDR; i++) {
+- if ((bus->phy_mask & (1 << i)) == 0) {
++ if ((bus->phy_mask & BIT(i)) == 0) {
+ struct phy_device *phydev;
+
+ phydev = mdiobus_scan(bus, i);
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index c3390999842a1..8d1b34640f79b 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1473,7 +1473,8 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile,
+ int err;
+ int i;
+
+- if (it->nr_segs > MAX_SKB_FRAGS + 1)
++ if (it->nr_segs > MAX_SKB_FRAGS + 1 ||
++ len > (ETH_MAX_MTU - NET_SKB_PAD - NET_IP_ALIGN))
+ return ERR_PTR(-EMSGSIZE);
+
+ local_bh_disable();
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+index e7eaa57d11d98..4a900d8d98b83 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+@@ -237,6 +237,10 @@ static void brcmf_fweh_event_worker(struct work_struct *work)
+ brcmf_fweh_event_name(event->code), event->code,
+ event->emsg.ifidx, event->emsg.bsscfgidx,
+ event->emsg.addr);
++ if (event->emsg.bsscfgidx >= BRCMF_MAX_IFS) {
++ brcmf_err("invalid bsscfg index: %u\n", event->emsg.bsscfgidx);
++ goto event_free;
++ }
+
+ /* convert event message */
+ emsg_be = &event->emsg;
+diff --git a/drivers/nfc/nfcmrvl/i2c.c b/drivers/nfc/nfcmrvl/i2c.c
+index 919b4d2f5d8b5..fa6db971bee97 100644
+--- a/drivers/nfc/nfcmrvl/i2c.c
++++ b/drivers/nfc/nfcmrvl/i2c.c
+@@ -151,10 +151,15 @@ static int nfcmrvl_i2c_nci_send(struct nfcmrvl_private *priv,
+ ret = -EREMOTEIO;
+ } else
+ ret = 0;
++ }
++
++ if (ret) {
+ kfree_skb(skb);
++ return ret;
+ }
+
+- return ret;
++ consume_skb(skb);
++ return 0;
+ }
+
+ static void nfcmrvl_i2c_nci_update_config(struct nfcmrvl_private *priv,
+diff --git a/drivers/nfc/s3fwrn5/core.c b/drivers/nfc/s3fwrn5/core.c
+index 64b58455e620b..f23a1e4d7e1e7 100644
+--- a/drivers/nfc/s3fwrn5/core.c
++++ b/drivers/nfc/s3fwrn5/core.c
+@@ -108,11 +108,15 @@ static int s3fwrn5_nci_send(struct nci_dev *ndev, struct sk_buff *skb)
+ }
+
+ ret = s3fwrn5_write(info, skb);
+- if (ret < 0)
++ if (ret < 0) {
+ kfree_skb(skb);
++ mutex_unlock(&info->mutex);
++ return ret;
++ }
+
++ consume_skb(skb);
+ mutex_unlock(&info->mutex);
+- return ret;
++ return 0;
+ }
+
+ static int s3fwrn5_nci_post_setup(struct nci_dev *ndev)
+diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
+index 144c77dfe4b19..eb9137faccf74 100644
+--- a/drivers/parisc/iosapic.c
++++ b/drivers/parisc/iosapic.c
+@@ -889,6 +889,7 @@ int iosapic_serial_irq(struct parisc_device *dev)
+
+ return vi->txn_irq;
+ }
++EXPORT_SYMBOL(iosapic_serial_irq);
+ #endif
+
+
+diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
+index f005eaf8bc57a..a9ddd76d41701 100644
+--- a/drivers/tty/serial/8250/Kconfig
++++ b/drivers/tty/serial/8250/Kconfig
+@@ -106,7 +106,7 @@ config SERIAL_8250_CONSOLE
+
+ config SERIAL_8250_GSC
+ tristate
+- depends on SERIAL_8250 && GSC
++ depends on SERIAL_8250 && PARISC
+ default SERIAL_8250
+
+ config SERIAL_8250_DMA
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 781c725e64329..a1eb573fbb10b 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -589,6 +589,18 @@ unode_aux_to_inode_list(struct ulist_node *node)
+ return (struct extent_inode_elem *)(uintptr_t)node->aux;
+ }
+
++static void free_leaf_list(struct ulist *ulist)
++{
++ struct ulist_node *node;
++ struct ulist_iterator uiter;
++
++ ULIST_ITER_INIT(&uiter);
++ while ((node = ulist_next(ulist, &uiter)))
++ free_inode_elem_list(unode_aux_to_inode_list(node));
++
++ ulist_free(ulist);
++}
++
+ /*
+ * We maintain three seperate rbtrees: one for direct refs, one for
+ * indirect refs which have a key, and one for indirect refs which do not
+@@ -703,7 +715,11 @@ static int resolve_indirect_refs(struct btrfs_fs_info *fs_info,
+ cond_resched();
+ }
+ out:
+- ulist_free(parents);
++ /*
++ * We may have inode lists attached to refs in the parents ulist, so we
++ * must free them before freeing the ulist and its refs.
++ */
++ free_leaf_list(parents);
+ return ret;
+ }
+
+@@ -1360,24 +1376,6 @@ out:
+ return ret;
+ }
+
+-static void free_leaf_list(struct ulist *blocks)
+-{
+- struct ulist_node *node = NULL;
+- struct extent_inode_elem *eie;
+- struct ulist_iterator uiter;
+-
+- ULIST_ITER_INIT(&uiter);
+- while ((node = ulist_next(blocks, &uiter))) {
+- if (!node->aux)
+- continue;
+- eie = unode_aux_to_inode_list(node);
+- free_inode_elem_list(eie);
+- node->aux = 0;
+- }
+-
+- ulist_free(blocks);
+-}
+-
+ /*
+ * Finds all leafs with a reference to the specified combination of bytenr and
+ * offset. key_list_head will point to a list of corresponding keys (caller must
+diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
+index 665ec85cb09b8..ecc33e3a3c063 100644
+--- a/fs/btrfs/export.c
++++ b/fs/btrfs/export.c
+@@ -58,7 +58,7 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len,
+ }
+
+ struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid,
+- u64 root_objectid, u32 generation,
++ u64 root_objectid, u64 generation,
+ int check_generation)
+ {
+ struct btrfs_fs_info *fs_info = btrfs_sb(sb);
+diff --git a/fs/btrfs/export.h b/fs/btrfs/export.h
+index f32f4113c976a..5afb7ca428289 100644
+--- a/fs/btrfs/export.h
++++ b/fs/btrfs/export.h
+@@ -19,7 +19,7 @@ struct btrfs_fid {
+ } __attribute__ ((packed));
+
+ struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid,
+- u64 root_objectid, u32 generation,
++ u64 root_objectid, u64 generation,
+ int check_generation);
+ struct dentry *btrfs_get_parent(struct dentry *child);
+
+diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c
+index d07dd26194b15..24a61e5248611 100644
+--- a/fs/btrfs/tests/qgroup-tests.c
++++ b/fs/btrfs/tests/qgroup-tests.c
+@@ -237,8 +237,10 @@ static int test_no_shared_qgroup(struct btrfs_root *root,
+
+ ret = insert_normal_tree_ref(root, nodesize, nodesize, 0,
+ BTRFS_FS_TREE_OBJECTID);
+- if (ret)
++ if (ret) {
++ ulist_free(old_roots);
+ return ret;
++ }
+
+ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots,
+ false);
+@@ -273,8 +275,10 @@ static int test_no_shared_qgroup(struct btrfs_root *root,
+ }
+
+ ret = remove_extent_item(root, nodesize, nodesize);
+- if (ret)
++ if (ret) {
++ ulist_free(old_roots);
+ return -EINVAL;
++ }
+
+ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots,
+ false);
+@@ -338,8 +342,10 @@ static int test_multiple_refs(struct btrfs_root *root,
+
+ ret = insert_normal_tree_ref(root, nodesize, nodesize, 0,
+ BTRFS_FS_TREE_OBJECTID);
+- if (ret)
++ if (ret) {
++ ulist_free(old_roots);
+ return ret;
++ }
+
+ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots,
+ false);
+@@ -373,8 +379,10 @@ static int test_multiple_refs(struct btrfs_root *root,
+
+ ret = add_tree_ref(root, nodesize, nodesize, 0,
+ BTRFS_FIRST_FREE_OBJECTID);
+- if (ret)
++ if (ret) {
++ ulist_free(old_roots);
+ return ret;
++ }
+
+ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots,
+ false);
+@@ -414,8 +422,10 @@ static int test_multiple_refs(struct btrfs_root *root,
+
+ ret = remove_extent_ref(root, nodesize, nodesize, 0,
+ BTRFS_FIRST_FREE_OBJECTID);
+- if (ret)
++ if (ret) {
++ ulist_free(old_roots);
+ return ret;
++ }
+
+ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots,
+ false);
+diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
+index 37ce665ae1d29..4a72583c75593 100644
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -443,7 +443,8 @@ int ext4_ext_migrate(struct inode *inode)
+ * already is extent-based, error out.
+ */
+ if (!ext4_has_feature_extents(inode->i_sb) ||
+- (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
++ ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS) ||
++ ext4_has_inline_data(inode))
+ return -EINVAL;
+
+ if (S_ISLNK(inode->i_mode) && inode->i_blocks == 0)
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index c97ec2fa0bbcd..50d352011ea6a 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -340,6 +340,7 @@ int nfs40_init_client(struct nfs_client *clp)
+ ret = nfs4_setup_slot_table(tbl, NFS4_MAX_SLOT_TABLE,
+ "NFSv4.0 transport Slot table");
+ if (ret) {
++ nfs4_shutdown_slot_table(tbl);
+ kfree(tbl);
+ return ret;
+ }
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 30576a10a1f4c..5ab021f87ecf8 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1736,6 +1736,7 @@ static void nfs4_state_mark_reclaim_helper(struct nfs_client *clp,
+
+ static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp)
+ {
++ set_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state);
+ /* Mark all delegations for reclaim */
+ nfs_delegation_mark_reclaim(clp);
+ nfs4_state_mark_reclaim_helper(clp, nfs4_state_mark_reclaim_reboot);
+@@ -2589,6 +2590,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ if (status < 0)
+ goto out_error;
+ nfs4_state_end_reclaim_reboot(clp);
++ continue;
+ }
+
+ /* Detect expired delegations... */
+diff --git a/include/linux/bits.h b/include/linux/bits.h
+index 2b7b532c1d51d..669d69441a625 100644
+--- a/include/linux/bits.h
++++ b/include/linux/bits.h
+@@ -1,13 +1,15 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+ #ifndef __LINUX_BITS_H
+ #define __LINUX_BITS_H
++
++#include <linux/const.h>
+ #include <asm/bitsperlong.h>
+
+-#define BIT(nr) (1UL << (nr))
+-#define BIT_ULL(nr) (1ULL << (nr))
+-#define BIT_MASK(nr) (1UL << ((nr) % BITS_PER_LONG))
++#define BIT(nr) (UL(1) << (nr))
++#define BIT_ULL(nr) (ULL(1) << (nr))
++#define BIT_MASK(nr) (UL(1) << ((nr) % BITS_PER_LONG))
+ #define BIT_WORD(nr) ((nr) / BITS_PER_LONG)
+-#define BIT_ULL_MASK(nr) (1ULL << ((nr) % BITS_PER_LONG_LONG))
++#define BIT_ULL_MASK(nr) (ULL(1) << ((nr) % BITS_PER_LONG_LONG))
+ #define BIT_ULL_WORD(nr) ((nr) / BITS_PER_LONG_LONG)
+ #define BITS_PER_BYTE 8
+
+@@ -17,10 +19,11 @@
+ * GENMASK_ULL(39, 21) gives us the 64bit vector 0x000000ffffe00000.
+ */
+ #define GENMASK(h, l) \
+- (((~0UL) - (1UL << (l)) + 1) & (~0UL >> (BITS_PER_LONG - 1 - (h))))
++ (((~UL(0)) - (UL(1) << (l)) + 1) & \
++ (~UL(0) >> (BITS_PER_LONG - 1 - (h))))
+
+ #define GENMASK_ULL(h, l) \
+- (((~0ULL) - (1ULL << (l)) + 1) & \
+- (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h))))
++ (((~ULL(0)) - (ULL(1) << (l)) + 1) & \
++ (~ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h))))
+
+ #endif /* __LINUX_BITS_H */
+diff --git a/include/linux/efi.h b/include/linux/efi.h
+index ec89e8bcc92f3..789a194e18a46 100644
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -1655,7 +1655,7 @@ efi_status_t efi_exit_boot_services(efi_system_table_t *sys_table,
+ void *priv,
+ efi_exit_boot_map_processing priv_func);
+
+-#define EFI_RANDOM_SEED_SIZE 64U
++#define EFI_RANDOM_SEED_SIZE 32U // BLAKE2S_HASH_SIZE
+
+ struct linux_efi_random_seed {
+ u32 size;
+diff --git a/include/net/protocol.h b/include/net/protocol.h
+index 4fc75f7ae23be..312a27393e0b7 100644
+--- a/include/net/protocol.h
++++ b/include/net/protocol.h
+@@ -39,8 +39,6 @@
+
+ /* This is used to register protocols. */
+ struct net_protocol {
+- int (*early_demux)(struct sk_buff *skb);
+- int (*early_demux_handler)(struct sk_buff *skb);
+ int (*handler)(struct sk_buff *skb);
+ void (*err_handler)(struct sk_buff *skb, u32 info);
+ unsigned int no_policy:1,
+@@ -54,8 +52,6 @@ struct net_protocol {
+
+ #if IS_ENABLED(CONFIG_IPV6)
+ struct inet6_protocol {
+- void (*early_demux)(struct sk_buff *skb);
+- void (*early_demux_handler)(struct sk_buff *skb);
+ int (*handler)(struct sk_buff *skb);
+
+ void (*err_handler)(struct sk_buff *skb,
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 487b6c5f53f49..9a154fe06c60d 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -901,6 +901,8 @@ static inline int tcp_v6_sdif(const struct sk_buff *skb)
+ #endif
+ return 0;
+ }
++
++void tcp_v6_early_demux(struct sk_buff *skb);
+ #endif
+
+ static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb)
+diff --git a/include/net/udp.h b/include/net/udp.h
+index 8482a990b0bb8..618c83bea50da 100644
+--- a/include/net/udp.h
++++ b/include/net/udp.h
+@@ -173,6 +173,7 @@ typedef struct sock *(*udp_lookup_t)(struct sk_buff *skb, __be16 sport,
+ struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb,
+ struct udphdr *uh, udp_lookup_t lookup);
+ int udp_gro_complete(struct sk_buff *skb, int nhoff, udp_lookup_t lookup);
++void udp_v6_early_demux(struct sk_buff *skb);
+
+ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
+ netdev_features_t features);
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index b2f01e61f0eec..33aba4e2e3e39 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2172,8 +2172,11 @@ int enable_kprobe(struct kprobe *kp)
+ if (!kprobes_all_disarmed && kprobe_disabled(p)) {
+ p->flags &= ~KPROBE_FLAG_DISABLED;
+ ret = arm_kprobe(p);
+- if (ret)
++ if (ret) {
+ p->flags |= KPROBE_FLAG_DISABLED;
++ if (p != kp)
++ kp->flags |= KPROBE_FLAG_DISABLED;
++ }
+ }
+ out:
+ mutex_unlock(&kprobe_mutex);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 5c965f7b17094..251da90642cde 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -3551,7 +3551,8 @@ done:
+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+ sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
+
+- if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
++ if (remote_efs &&
++ test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
+ chan->remote_id = efs.id;
+ chan->remote_stype = efs.stype;
+ chan->remote_msdu = le16_to_cpu(efs.msdu);
+@@ -6255,6 +6256,7 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan,
+ struct l2cap_ctrl *control,
+ struct sk_buff *skb, u8 event)
+ {
++ struct l2cap_ctrl local_control;
+ int err = 0;
+ bool skb_in_use = false;
+
+@@ -6279,15 +6281,32 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan,
+ chan->buffer_seq = chan->expected_tx_seq;
+ skb_in_use = true;
+
++ /* l2cap_reassemble_sdu may free skb, hence invalidate
++ * control, so make a copy in advance to use it after
++ * l2cap_reassemble_sdu returns and to avoid the race
++ * condition, for example:
++ *
++ * The current thread calls:
++ * l2cap_reassemble_sdu
++ * chan->ops->recv == l2cap_sock_recv_cb
++ * __sock_queue_rcv_skb
++ * Another thread calls:
++ * bt_sock_recvmsg
++ * skb_recv_datagram
++ * skb_free_datagram
++ * Then the current thread tries to access control, but
++ * it was freed by skb_free_datagram.
++ */
++ local_control = *control;
+ err = l2cap_reassemble_sdu(chan, skb, control);
+ if (err)
+ break;
+
+- if (control->final) {
++ if (local_control.final) {
+ if (!test_and_clear_bit(CONN_REJ_ACT,
+ &chan->conn_state)) {
+- control->final = 0;
+- l2cap_retransmit_all(chan, control);
++ local_control.final = 0;
++ l2cap_retransmit_all(chan, &local_control);
+ l2cap_ertm_send(chan);
+ }
+ }
+@@ -6667,11 +6686,27 @@ static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
+ static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
+ struct sk_buff *skb)
+ {
++ /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store
++ * the txseq field in advance to use it after l2cap_reassemble_sdu
++ * returns and to avoid the race condition, for example:
++ *
++ * The current thread calls:
++ * l2cap_reassemble_sdu
++ * chan->ops->recv == l2cap_sock_recv_cb
++ * __sock_queue_rcv_skb
++ * Another thread calls:
++ * bt_sock_recvmsg
++ * skb_recv_datagram
++ * skb_free_datagram
++ * Then the current thread tries to access control, but it was freed by
++ * skb_free_datagram.
++ */
++ u16 txseq = control->txseq;
++
+ BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
+ chan->rx_state);
+
+- if (l2cap_classify_txseq(chan, control->txseq) ==
+- L2CAP_TXSEQ_EXPECTED) {
++ if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) {
+ l2cap_pass_to_tx(chan, control);
+
+ BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
+@@ -6694,8 +6729,8 @@ static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
+ }
+ }
+
+- chan->last_acked_seq = control->txseq;
+- chan->expected_tx_seq = __next_seq(chan, control->txseq);
++ chan->last_acked_seq = txseq;
++ chan->expected_tx_seq = __next_seq(chan, txseq);
+
+ return 0;
+ }
+@@ -6933,6 +6968,7 @@ static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
+ return;
+ }
+
++ l2cap_chan_hold(chan);
+ l2cap_chan_lock(chan);
+ } else {
+ BT_DBG("unknown cid 0x%4.4x", cid);
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 73042407eb5b4..2b96e9a7fc597 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -312,7 +312,7 @@ int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
+ write_lock_bh(&tbl->lock);
+ neigh_flush_dev(tbl, dev);
+ pneigh_ifdown_and_unlock(tbl, dev);
+- pneigh_queue_purge(&tbl->proxy_queue, dev_net(dev));
++ pneigh_queue_purge(&tbl->proxy_queue, dev ? dev_net(dev) : NULL);
+ if (skb_queue_empty_lockless(&tbl->proxy_queue))
+ del_timer_sync(&tbl->proxy_timer);
+ return 0;
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 3cf9cd1808980..4b26ae525d6d2 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1678,12 +1678,7 @@ static const struct net_protocol igmp_protocol = {
+ };
+ #endif
+
+-/* thinking of making this const? Don't.
+- * early_demux can change based on sysctl.
+- */
+-static struct net_protocol tcp_protocol = {
+- .early_demux = tcp_v4_early_demux,
+- .early_demux_handler = tcp_v4_early_demux,
++static const struct net_protocol tcp_protocol = {
+ .handler = tcp_v4_rcv,
+ .err_handler = tcp_v4_err,
+ .no_policy = 1,
+@@ -1691,12 +1686,7 @@ static struct net_protocol tcp_protocol = {
+ .icmp_strict_tag_validation = 1,
+ };
+
+-/* thinking of making this const? Don't.
+- * early_demux can change based on sysctl.
+- */
+-static struct net_protocol udp_protocol = {
+- .early_demux = udp_v4_early_demux,
+- .early_demux_handler = udp_v4_early_demux,
++static const struct net_protocol udp_protocol = {
+ .handler = udp_rcv,
+ .err_handler = udp_err,
+ .no_policy = 1,
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
+index c3a0683e83dfb..7ead5192b2a9b 100644
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -306,28 +306,38 @@ drop:
+ return true;
+ }
+
++int udp_v4_early_demux(struct sk_buff *);
++int tcp_v4_early_demux(struct sk_buff *);
+ static int ip_rcv_finish_core(struct net *net, struct sock *sk,
+ struct sk_buff *skb, struct net_device *dev)
+ {
+ const struct iphdr *iph = ip_hdr(skb);
+- int (*edemux)(struct sk_buff *skb);
+ struct rtable *rt;
+ int err;
+
+- if (net->ipv4.sysctl_ip_early_demux &&
++ if (READ_ONCE(net->ipv4.sysctl_ip_early_demux) &&
+ !skb_dst(skb) &&
+ !skb->sk &&
+ !ip_is_fragment(iph)) {
+- const struct net_protocol *ipprot;
+- int protocol = iph->protocol;
++ switch (iph->protocol) {
++ case IPPROTO_TCP:
++ if (READ_ONCE(net->ipv4.sysctl_tcp_early_demux)) {
++ tcp_v4_early_demux(skb);
+
+- ipprot = rcu_dereference(inet_protos[protocol]);
+- if (ipprot && (edemux = READ_ONCE(ipprot->early_demux))) {
+- err = edemux(skb);
+- if (unlikely(err))
+- goto drop_error;
+- /* must reload iph, skb->head might have changed */
+- iph = ip_hdr(skb);
++ /* must reload iph, skb->head might have changed */
++ iph = ip_hdr(skb);
++ }
++ break;
++ case IPPROTO_UDP:
++ if (READ_ONCE(net->ipv4.sysctl_udp_early_demux)) {
++ err = udp_v4_early_demux(skb);
++ if (unlikely(err))
++ goto drop_error;
++
++ /* must reload iph, skb->head might have changed */
++ iph = ip_hdr(skb);
++ }
++ break;
+ }
+ }
+
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index ad132b6e8cfad..c97ba2a44b8bf 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -332,61 +332,6 @@ bad_key:
+ return ret;
+ }
+
+-static void proc_configure_early_demux(int enabled, int protocol)
+-{
+- struct net_protocol *ipprot;
+-#if IS_ENABLED(CONFIG_IPV6)
+- struct inet6_protocol *ip6prot;
+-#endif
+-
+- rcu_read_lock();
+-
+- ipprot = rcu_dereference(inet_protos[protocol]);
+- if (ipprot)
+- ipprot->early_demux = enabled ? ipprot->early_demux_handler :
+- NULL;
+-
+-#if IS_ENABLED(CONFIG_IPV6)
+- ip6prot = rcu_dereference(inet6_protos[protocol]);
+- if (ip6prot)
+- ip6prot->early_demux = enabled ? ip6prot->early_demux_handler :
+- NULL;
+-#endif
+- rcu_read_unlock();
+-}
+-
+-static int proc_tcp_early_demux(struct ctl_table *table, int write,
+- void __user *buffer, size_t *lenp, loff_t *ppos)
+-{
+- int ret = 0;
+-
+- ret = proc_dointvec(table, write, buffer, lenp, ppos);
+-
+- if (write && !ret) {
+- int enabled = init_net.ipv4.sysctl_tcp_early_demux;
+-
+- proc_configure_early_demux(enabled, IPPROTO_TCP);
+- }
+-
+- return ret;
+-}
+-
+-static int proc_udp_early_demux(struct ctl_table *table, int write,
+- void __user *buffer, size_t *lenp, loff_t *ppos)
+-{
+- int ret = 0;
+-
+- ret = proc_dointvec(table, write, buffer, lenp, ppos);
+-
+- if (write && !ret) {
+- int enabled = init_net.ipv4.sysctl_udp_early_demux;
+-
+- proc_configure_early_demux(enabled, IPPROTO_UDP);
+- }
+-
+- return ret;
+-}
+-
+ static int proc_tfo_blackhole_detect_timeout(struct ctl_table *table,
+ int write,
+ void __user *buffer,
+@@ -638,14 +583,14 @@ static struct ctl_table ipv4_net_table[] = {
+ .data = &init_net.ipv4.sysctl_udp_early_demux,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_udp_early_demux
++ .proc_handler = proc_douintvec_minmax,
+ },
+ {
+ .procname = "tcp_early_demux",
+ .data = &init_net.ipv4.sysctl_tcp_early_demux,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_tcp_early_demux
++ .proc_handler = proc_douintvec_minmax,
+ },
+ {
+ .procname = "ip_default_ttl",
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index 57d84accbf1e3..2bdb03a45bafe 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -47,18 +47,25 @@
+ #include <net/inet_ecn.h>
+ #include <net/dst_metadata.h>
+
++void udp_v6_early_demux(struct sk_buff *);
++void tcp_v6_early_demux(struct sk_buff *);
+ static void ip6_rcv_finish_core(struct net *net, struct sock *sk,
+ struct sk_buff *skb)
+ {
+- void (*edemux)(struct sk_buff *skb);
+-
+- if (net->ipv4.sysctl_ip_early_demux && !skb_dst(skb) && skb->sk == NULL) {
+- const struct inet6_protocol *ipprot;
+-
+- ipprot = rcu_dereference(inet6_protos[ipv6_hdr(skb)->nexthdr]);
+- if (ipprot && (edemux = READ_ONCE(ipprot->early_demux)))
+- edemux(skb);
++ if (READ_ONCE(net->ipv4.sysctl_ip_early_demux) &&
++ !skb_dst(skb) && !skb->sk) {
++ switch (ipv6_hdr(skb)->nexthdr) {
++ case IPPROTO_TCP:
++ if (READ_ONCE(net->ipv4.sysctl_tcp_early_demux))
++ tcp_v6_early_demux(skb);
++ break;
++ case IPPROTO_UDP:
++ if (READ_ONCE(net->ipv4.sysctl_udp_early_demux))
++ udp_v6_early_demux(skb);
++ break;
++ }
+ }
++
+ if (!skb_valid_dst(skb))
+ ip6_route_input(skb);
+ }
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index b940285a111eb..7b41d5d3575fd 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -5374,10 +5374,16 @@ static void __net_exit ip6_route_net_exit(struct net *net)
+ static int __net_init ip6_route_net_init_late(struct net *net)
+ {
+ #ifdef CONFIG_PROC_FS
+- proc_create_net("ipv6_route", 0, net->proc_net, &ipv6_route_seq_ops,
+- sizeof(struct ipv6_route_iter));
+- proc_create_net_single("rt6_stats", 0444, net->proc_net,
+- rt6_stats_seq_show, NULL);
++ if (!proc_create_net("ipv6_route", 0, net->proc_net,
++ &ipv6_route_seq_ops,
++ sizeof(struct ipv6_route_iter)))
++ return -ENOMEM;
++
++ if (!proc_create_net_single("rt6_stats", 0444, net->proc_net,
++ rt6_stats_seq_show, NULL)) {
++ remove_proc_entry("ipv6_route", net->proc_net);
++ return -ENOMEM;
++ }
+ #endif
+ return 0;
+ }
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 549ea5211bfaa..7a5a7a4265cf0 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1673,7 +1673,7 @@ do_time_wait:
+ goto discard_it;
+ }
+
+-static void tcp_v6_early_demux(struct sk_buff *skb)
++void tcp_v6_early_demux(struct sk_buff *skb)
+ {
+ const struct ipv6hdr *hdr;
+ const struct tcphdr *th;
+@@ -2028,12 +2028,7 @@ struct proto tcpv6_prot = {
+ .diag_destroy = tcp_abort,
+ };
+
+-/* thinking of making this const? Don't.
+- * early_demux can change based on sysctl.
+- */
+-static struct inet6_protocol tcpv6_protocol = {
+- .early_demux = tcp_v6_early_demux,
+- .early_demux_handler = tcp_v6_early_demux,
++static const struct inet6_protocol tcpv6_protocol = {
+ .handler = tcp_v6_rcv,
+ .err_handler = tcp_v6_err,
+ .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index fb71da6c6c74d..9b0cae403027e 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -912,7 +912,7 @@ static struct sock *__udp6_lib_demux_lookup(struct net *net,
+ return NULL;
+ }
+
+-static void udp_v6_early_demux(struct sk_buff *skb)
++void udp_v6_early_demux(struct sk_buff *skb)
+ {
+ struct net *net = dev_net(skb->dev);
+ const struct udphdr *uh;
+@@ -1533,12 +1533,7 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
+ }
+ #endif
+
+-/* thinking of making this const? Don't.
+- * early_demux can change based on sysctl.
+- */
+-static struct inet6_protocol udpv6_protocol = {
+- .early_demux = udp_v6_early_demux,
+- .early_demux_handler = udp_v6_early_demux,
++static const struct inet6_protocol udpv6_protocol = {
+ .handler = udpv6_rcv,
+ .err_handler = udpv6_err,
+ .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
+diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
+index 80759aadd3e06..21149f4e0b6e7 100644
+--- a/net/netfilter/ipvs/ip_vs_app.c
++++ b/net/netfilter/ipvs/ip_vs_app.c
+@@ -604,13 +604,19 @@ static const struct seq_operations ip_vs_app_seq_ops = {
+ int __net_init ip_vs_app_net_init(struct netns_ipvs *ipvs)
+ {
+ INIT_LIST_HEAD(&ipvs->app_list);
+- proc_create_net("ip_vs_app", 0, ipvs->net->proc_net, &ip_vs_app_seq_ops,
+- sizeof(struct seq_net_private));
++#ifdef CONFIG_PROC_FS
++ if (!proc_create_net("ip_vs_app", 0, ipvs->net->proc_net,
++ &ip_vs_app_seq_ops,
++ sizeof(struct seq_net_private)))
++ return -ENOMEM;
++#endif
+ return 0;
+ }
+
+ void __net_exit ip_vs_app_net_cleanup(struct netns_ipvs *ipvs)
+ {
+ unregister_ip_vs_app(ipvs, NULL /* all */);
++#ifdef CONFIG_PROC_FS
+ remove_proc_entry("ip_vs_app", ipvs->net->proc_net);
++#endif
+ }
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index 95c35aa639ecf..51679d1e2d7d7 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -1230,8 +1230,8 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
+ * The drop rate array needs tuning for real environments.
+ * Called from timer bh only => no locking
+ */
+- static const char todrop_rate[9] = {0, 1, 2, 3, 4, 5, 6, 7, 8};
+- static char todrop_counter[9] = {0};
++ static const signed char todrop_rate[9] = {0, 1, 2, 3, 4, 5, 6, 7, 8};
++ static signed char todrop_counter[9] = {0};
+ int i;
+
+ /* if the conn entry hasn't lasted for 60 seconds, don't drop it.
+@@ -1378,20 +1378,36 @@ int __net_init ip_vs_conn_net_init(struct netns_ipvs *ipvs)
+ {
+ atomic_set(&ipvs->conn_count, 0);
+
+- proc_create_net("ip_vs_conn", 0, ipvs->net->proc_net,
+- &ip_vs_conn_seq_ops, sizeof(struct ip_vs_iter_state));
+- proc_create_net("ip_vs_conn_sync", 0, ipvs->net->proc_net,
+- &ip_vs_conn_sync_seq_ops,
+- sizeof(struct ip_vs_iter_state));
++#ifdef CONFIG_PROC_FS
++ if (!proc_create_net("ip_vs_conn", 0, ipvs->net->proc_net,
++ &ip_vs_conn_seq_ops,
++ sizeof(struct ip_vs_iter_state)))
++ goto err_conn;
++
++ if (!proc_create_net("ip_vs_conn_sync", 0, ipvs->net->proc_net,
++ &ip_vs_conn_sync_seq_ops,
++ sizeof(struct ip_vs_iter_state)))
++ goto err_conn_sync;
++#endif
++
+ return 0;
++
++#ifdef CONFIG_PROC_FS
++err_conn_sync:
++ remove_proc_entry("ip_vs_conn", ipvs->net->proc_net);
++err_conn:
++ return -ENOMEM;
++#endif
+ }
+
+ void __net_exit ip_vs_conn_net_cleanup(struct netns_ipvs *ipvs)
+ {
+ /* flush all the connection entries first */
+ ip_vs_conn_flush(ipvs);
++#ifdef CONFIG_PROC_FS
+ remove_proc_entry("ip_vs_conn", ipvs->net->proc_net);
+ remove_proc_entry("ip_vs_conn_sync", ipvs->net->proc_net);
++#endif
+ }
+
+ int __init ip_vs_conn_init(void)
+diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c
+index 62055d3069d2a..f3d7105c6cdd5 100644
+--- a/net/rose/rose_link.c
++++ b/net/rose/rose_link.c
+@@ -239,6 +239,9 @@ void rose_transmit_clear_request(struct rose_neigh *neigh, unsigned int lci, uns
+ unsigned char *dptr;
+ int len;
+
++ if (!neigh->dev)
++ return;
++
+ len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN + 3;
+
+ if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL)
+diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
+index 0424aa747c341..afe0c2d689b17 100644
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -63,6 +63,7 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ {
+ struct red_sched_data *q = qdisc_priv(sch);
+ struct Qdisc *child = q->qdisc;
++ unsigned int len;
+ int ret;
+
+ q->vars.qavg = red_calc_qavg(&q->parms,
+@@ -98,9 +99,10 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ break;
+ }
+
++ len = qdisc_pkt_len(skb);
+ ret = qdisc_enqueue(skb, child, to_free);
+ if (likely(ret == NET_XMIT_SUCCESS)) {
+- qdisc_qstats_backlog_inc(sch, skb);
++ sch->qstats.backlog += len;
+ sch->q.qlen++;
+ } else if (net_xmit_drop_count(ret)) {
+ q->stats.pdrop++;
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 876cfe01d9391..28b204eacc7a3 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -397,8 +397,10 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ &tmpbuf, size, GFP_NOFS);
+ dput(dentry);
+
+- if (ret < 0 || !tmpbuf)
+- return ret;
++ if (ret < 0 || !tmpbuf) {
++ size = ret;
++ goto out_free;
++ }
+
+ fs_ns = inode->i_sb->s_user_ns;
+ cap = (struct vfs_cap_data *) tmpbuf;
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 1e0d946036928..3f353e051a1de 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3526,6 +3526,64 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */
+ }
+ },
+
++/*
++ * MacroSilicon MS2100/MS2106 based AV capture cards
++ *
++ * These claim 96kHz 1ch in the descriptors, but are actually 48kHz 2ch.
++ * They also need QUIRK_AUDIO_ALIGN_TRANSFER, which makes one wonder if
++ * they pretend to be 96kHz mono as a workaround for stereo being broken
++ * by that...
++ *
++ * They also have an issue with initial stream alignment that causes the
++ * channels to be swapped and out of phase, which is dealt with in quirks.c.
++ */
++{
++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
++ USB_DEVICE_ID_MATCH_INT_CLASS |
++ USB_DEVICE_ID_MATCH_INT_SUBCLASS,
++ .idVendor = 0x534d,
++ .idProduct = 0x0021,
++ .bInterfaceClass = USB_CLASS_AUDIO,
++ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .vendor_name = "MacroSilicon",
++ .product_name = "MS210x",
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = &(const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_ALIGN_TRANSFER,
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_MIXER,
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_AUDIO_FIXED_ENDPOINT,
++ .data = &(const struct audioformat) {
++ .formats = SNDRV_PCM_FMTBIT_S16_LE,
++ .channels = 2,
++ .iface = 3,
++ .altsetting = 1,
++ .altset_idx = 1,
++ .attributes = 0,
++ .endpoint = 0x82,
++ .ep_attr = USB_ENDPOINT_XFER_ISOC |
++ USB_ENDPOINT_SYNC_ASYNC,
++ .rates = SNDRV_PCM_RATE_CONTINUOUS,
++ .rate_min = 48000,
++ .rate_max = 48000,
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++
+ /*
+ * MacroSilicon MS2109 based HDMI capture cards
+ *
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index b1bd63a9fc6d7..512e052e59f7d 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1174,6 +1174,7 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
+ case USB_ID(0x041e, 0x3f19): /* E-Mu 0204 USB */
+ set_format_emu_quirk(subs, fmt);
+ break;
++ case USB_ID(0x534d, 0x0021): /* MacroSilicon MS2100/MS2106 */
+ case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */
+ subs->stream_offset_adj = 2;
+ break;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-11-23 9:39 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2022-11-23 9:39 UTC (permalink / raw
To: gentoo-commits
commit: a0fc2f9aa9f5ae283ce73d8b3b9b7e735c01132e
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 23 09:36:49 2022 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Nov 23 09:38:49 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a0fc2f9a
Linux patch 4.19.266
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1265_linux-4.19.266.patch | 2018 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2022 insertions(+)
diff --git a/0000_README b/0000_README
index 31133058..557fb8e3 100644
--- a/0000_README
+++ b/0000_README
@@ -1103,6 +1103,10 @@ Patch: 1264_linux-4.19.265.patch
From: https://www.kernel.org
Desc: Linux 4.19.265
+Patch: 1265_linux-4.19.266.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.266
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1265_linux-4.19.266.patch b/1265_linux-4.19.266.patch
new file mode 100644
index 00000000..03ca9ba1
--- /dev/null
+++ b/1265_linux-4.19.266.patch
@@ -0,0 +1,2018 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 500032af01927..68f31b6660323 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -4132,6 +4132,18 @@
+
+ retain_initrd [RAM] Keep initrd memory after extraction
+
++ retbleed= [X86] Control mitigation of RETBleed (Arbitrary
++ Speculative Code Execution with Return Instructions)
++ vulnerability.
++
++ off - unconditionally disable
++ auto - automatically select a migitation
++
++ Selecting 'auto' will choose a mitigation method at run
++ time according to the CPU.
++
++ Not specifying this option is equivalent to retbleed=auto.
++
+ rfkill.default_state=
+ 0 "airplane mode". All wifi, bluetooth, wimax, gps, fm,
+ etc. communication is blocked by default.
+@@ -4377,6 +4389,7 @@
+ eibrs - enhanced IBRS
+ eibrs,retpoline - enhanced IBRS + Retpolines
+ eibrs,lfence - enhanced IBRS + LFENCE
++ ibrs - use IBRS to protect kernel
+
+ Not specifying this option is equivalent to
+ spectre_v2=auto.
+diff --git a/Makefile b/Makefile
+index 592e6928e0203..a0cfded5d0cc9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 265
++SUBLEVEL = 266
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
+index 993dd06c8923c..806729a7172fc 100644
+--- a/arch/x86/entry/calling.h
++++ b/arch/x86/entry/calling.h
+@@ -6,6 +6,8 @@
+ #include <asm/percpu.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/processor-flags.h>
++#include <asm/msr.h>
++#include <asm/nospec-branch.h>
+
+ /*
+
+@@ -146,27 +148,19 @@ For 32-bit we have the following conventions - kernel is built with
+
+ .endm
+
+-.macro POP_REGS pop_rdi=1 skip_r11rcx=0
++.macro POP_REGS pop_rdi=1
+ popq %r15
+ popq %r14
+ popq %r13
+ popq %r12
+ popq %rbp
+ popq %rbx
+- .if \skip_r11rcx
+- popq %rsi
+- .else
+ popq %r11
+- .endif
+ popq %r10
+ popq %r9
+ popq %r8
+ popq %rax
+- .if \skip_r11rcx
+- popq %rsi
+- .else
+ popq %rcx
+- .endif
+ popq %rdx
+ popq %rsi
+ .if \pop_rdi
+@@ -316,6 +310,62 @@ For 32-bit we have the following conventions - kernel is built with
+
+ #endif
+
++/*
++ * IBRS kernel mitigation for Spectre_v2.
++ *
++ * Assumes full context is established (PUSH_REGS, CR3 and GS) and it clobbers
++ * the regs it uses (AX, CX, DX). Must be called before the first RET
++ * instruction (NOTE! UNTRAIN_RET includes a RET instruction)
++ *
++ * The optional argument is used to save/restore the current value,
++ * which is used on the paranoid paths.
++ *
++ * Assumes x86_spec_ctrl_{base,current} to have SPEC_CTRL_IBRS set.
++ */
++.macro IBRS_ENTER save_reg
++ ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_KERNEL_IBRS
++ movl $MSR_IA32_SPEC_CTRL, %ecx
++
++.ifnb \save_reg
++ rdmsr
++ shl $32, %rdx
++ or %rdx, %rax
++ mov %rax, \save_reg
++ test $SPEC_CTRL_IBRS, %eax
++ jz .Ldo_wrmsr_\@
++ lfence
++ jmp .Lend_\@
++.Ldo_wrmsr_\@:
++.endif
++
++ movq PER_CPU_VAR(x86_spec_ctrl_current), %rdx
++ movl %edx, %eax
++ shr $32, %rdx
++ wrmsr
++.Lend_\@:
++.endm
++
++/*
++ * Similar to IBRS_ENTER, requires KERNEL GS,CR3 and clobbers (AX, CX, DX)
++ * regs. Must be called after the last RET.
++ */
++.macro IBRS_EXIT save_reg
++ ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_KERNEL_IBRS
++ movl $MSR_IA32_SPEC_CTRL, %ecx
++
++.ifnb \save_reg
++ mov \save_reg, %rdx
++.else
++ movq PER_CPU_VAR(x86_spec_ctrl_current), %rdx
++ andl $(~SPEC_CTRL_IBRS), %edx
++.endif
++
++ movl %edx, %eax
++ shr $32, %rdx
++ wrmsr
++.Lend_\@:
++.endm
++
+ /*
+ * Mitigate Spectre v1 for conditional swapgs code paths.
+ *
+diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
+index 37d9016d47683..78b308f2f2ea6 100644
+--- a/arch/x86/entry/entry_32.S
++++ b/arch/x86/entry/entry_32.S
+@@ -643,7 +643,6 @@ ENTRY(__switch_to_asm)
+ movl %ebx, PER_CPU_VAR(stack_canary)+stack_canary_offset
+ #endif
+
+-#ifdef CONFIG_RETPOLINE
+ /*
+ * When switching from a shallower to a deeper call stack
+ * the RSB may either underflow or use entries populated
+@@ -652,7 +651,6 @@ ENTRY(__switch_to_asm)
+ * speculative execution to prevent attack.
+ */
+ FILL_RETURN_BUFFER %ebx, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
+-#endif
+
+ /* restore callee-saved registers */
+ popfl
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index dfe26f3cfffc2..3f418aedef8d7 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -235,6 +235,10 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
+ /* IRQs are off. */
+ movq %rax, %rdi
+ movq %rsp, %rsi
++
++ /* clobbers %rax, make sure it is after saving the syscall nr */
++ IBRS_ENTER
++
+ call do_syscall_64 /* returns with IRQs disabled */
+
+ TRACE_IRQS_IRETQ /* we're about to change IF */
+@@ -311,8 +315,8 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
+ * perf profiles. Nothing jumps here.
+ */
+ syscall_return_via_sysret:
+- /* rcx and r11 are already restored (see code above) */
+- POP_REGS pop_rdi=0 skip_r11rcx=1
++ IBRS_EXIT
++ POP_REGS pop_rdi=0
+
+ /*
+ * Now all regs are restored except RSP and RDI.
+@@ -363,7 +367,6 @@ ENTRY(__switch_to_asm)
+ movq %rbx, PER_CPU_VAR(irq_stack_union)+stack_canary_offset
+ #endif
+
+-#ifdef CONFIG_RETPOLINE
+ /*
+ * When switching from a shallower to a deeper call stack
+ * the RSB may either underflow or use entries populated
+@@ -372,7 +375,6 @@ ENTRY(__switch_to_asm)
+ * speculative execution to prevent attack.
+ */
+ FILL_RETURN_BUFFER %r12, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
+-#endif
+
+ /* restore callee-saved registers */
+ popfq
+@@ -685,6 +687,7 @@ GLOBAL(retint_user)
+ TRACE_IRQS_IRETQ
+
+ GLOBAL(swapgs_restore_regs_and_return_to_usermode)
++ IBRS_EXIT
+ #ifdef CONFIG_DEBUG_ENTRY
+ /* Assert that pt_regs indicates user mode. */
+ testb $3, CS(%rsp)
+@@ -1250,7 +1253,13 @@ ENTRY(paranoid_entry)
+ */
+ FENCE_SWAPGS_KERNEL_ENTRY
+
+- ret
++ /*
++ * Once we have CR3 and %GS setup save and set SPEC_CTRL. Just like
++ * CR3 above, keep the old value in a callee saved register.
++ */
++ IBRS_ENTER save_reg=%r15
++
++ RET
+ END(paranoid_entry)
+
+ /*
+@@ -1278,12 +1287,20 @@ ENTRY(paranoid_exit)
+ jmp .Lparanoid_exit_restore
+ .Lparanoid_exit_no_swapgs:
+ TRACE_IRQS_IRETQ_DEBUG
++
++ /*
++ * Must restore IBRS state before both CR3 and %GS since we need access
++ * to the per-CPU x86_spec_ctrl_shadow variable.
++ */
++ IBRS_EXIT save_reg=%r15
++
+ /* Always restore stashed CR3 value (see paranoid_entry) */
+ RESTORE_CR3 scratch_reg=%rbx save_reg=%r14
+ .Lparanoid_exit_restore:
+ jmp restore_regs_and_return_to_kernel
+ END(paranoid_exit)
+
++
+ /*
+ * Save all registers in pt_regs, and switch GS if needed.
+ */
+@@ -1303,6 +1320,7 @@ ENTRY(error_entry)
+ FENCE_SWAPGS_USER_ENTRY
+ /* We have user CR3. Change to kernel CR3. */
+ SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
++ IBRS_ENTER
+
+ .Lerror_entry_from_usermode_after_swapgs:
+ /* Put us onto the real thread stack. */
+@@ -1367,6 +1385,7 @@ ENTRY(error_entry)
+ SWAPGS
+ FENCE_SWAPGS_USER_ENTRY
+ SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
++ IBRS_ENTER
+
+ /*
+ * Pretend that the exception came from user mode: set up pt_regs
+@@ -1472,6 +1491,8 @@ ENTRY(nmi)
+ PUSH_AND_CLEAR_REGS rdx=(%rdx)
+ ENCODE_FRAME_POINTER
+
++ IBRS_ENTER
++
+ /*
+ * At this point we no longer need to worry about stack damage
+ * due to nesting -- we're on the normal thread stack and we're
+@@ -1695,6 +1716,9 @@ end_repeat_nmi:
+ movq $-1, %rsi
+ call do_nmi
+
++ /* Always restore stashed SPEC_CTRL value (see paranoid_entry) */
++ IBRS_EXIT save_reg=%r15
++
+ /* Always restore stashed CR3 value (see paranoid_entry) */
+ RESTORE_CR3 scratch_reg=%r15 save_reg=%r14
+
+diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
+index 40d2834a8101e..85dd05de648ce 100644
+--- a/arch/x86/entry/entry_64_compat.S
++++ b/arch/x86/entry/entry_64_compat.S
+@@ -4,7 +4,6 @@
+ *
+ * Copyright 2000-2002 Andi Kleen, SuSE Labs.
+ */
+-#include "calling.h"
+ #include <asm/asm-offsets.h>
+ #include <asm/current.h>
+ #include <asm/errno.h>
+@@ -17,6 +16,8 @@
+ #include <linux/linkage.h>
+ #include <linux/err.h>
+
++#include "calling.h"
++
+ .section .entry.text, "ax"
+
+ /*
+@@ -106,6 +107,8 @@ ENTRY(entry_SYSENTER_compat)
+ xorl %r15d, %r15d /* nospec r15 */
+ cld
+
++ IBRS_ENTER
++
+ /*
+ * SYSENTER doesn't filter flags, so we need to clear NT and AC
+ * ourselves. To save a few cycles, we can check whether
+@@ -253,6 +256,8 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
+ */
+ TRACE_IRQS_OFF
+
++ IBRS_ENTER
++
+ movq %rsp, %rdi
+ call do_fast_syscall_32
+ /* XEN PV guests always use IRET path */
+@@ -262,6 +267,9 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
+ /* Opportunistic SYSRET */
+ sysret32_from_system_call:
+ TRACE_IRQS_ON /* User mode traces as IRQs on. */
++
++ IBRS_EXIT
++
+ movq RBX(%rsp), %rbx /* pt_regs->rbx */
+ movq RBP(%rsp), %rbp /* pt_regs->rbp */
+ movq EFLAGS(%rsp), %r11 /* pt_regs->flags (in r11) */
+@@ -403,6 +411,7 @@ ENTRY(entry_INT80_compat)
+ * gate turned them off.
+ */
+ TRACE_IRQS_OFF
++ IBRS_ENTER
+
+ movq %rsp, %rdi
+ call do_int80_syscall_32
+diff --git a/arch/x86/include/asm/cpu_device_id.h b/arch/x86/include/asm/cpu_device_id.h
+index 8844665929437..cdf39decf7340 100644
+--- a/arch/x86/include/asm/cpu_device_id.h
++++ b/arch/x86/include/asm/cpu_device_id.h
+@@ -1,16 +1,26 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _CPU_DEVICE_ID
+-#define _CPU_DEVICE_ID 1
++#ifndef _ASM_X86_CPU_DEVICE_ID
++#define _ASM_X86_CPU_DEVICE_ID
+
+ /*
+ * Declare drivers belonging to specific x86 CPUs
+ * Similar in spirit to pci_device_id and related PCI functions
++ *
++ * The wildcard initializers are in mod_devicetable.h because
++ * file2alias needs them. Sigh.
+ */
+-
+ #include <linux/mod_devicetable.h>
++/* Get the INTEL_FAM* model defines */
++#include <asm/intel-family.h>
++/* And the X86_VENDOR_* ones */
++#include <asm/processor.h>
+
+-#define X86_STEPPINGS(mins, maxs) GENMASK(maxs, mins)
++/* Centaur FAM6 models */
++#define X86_CENTAUR_FAM6_C7_A 0xa
++#define X86_CENTAUR_FAM6_C7_D 0xd
++#define X86_CENTAUR_FAM6_NANO 0xf
+
++#define X86_STEPPINGS(mins, maxs) GENMASK(maxs, mins)
+ /**
+ * X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE - Base macro for CPU matching
+ * @_vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
+@@ -23,8 +33,11 @@
+ * format is unsigned long. The supplied value, pointer
+ * etc. is casted to unsigned long internally.
+ *
+- * Backport version to keep the SRBDS pile consistant. No shorter variants
+- * required for this.
++ * Use only if you need all selectors. Otherwise use one of the shorter
++ * macros of the X86_MATCH_* family. If there is no matching shorthand
++ * macro, consider to add one. If you really need to wrap one of the macros
++ * into another macro at the usage site for good reasons, then please
++ * start this local macro with X86_MATCH to allow easy grepping.
+ */
+ #define X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(_vendor, _family, _model, \
+ _steppings, _feature, _data) { \
+@@ -36,6 +49,147 @@
+ .driver_data = (unsigned long) _data \
+ }
+
++/**
++ * X86_MATCH_VENDOR_FAM_MODEL_FEATURE - Macro for CPU matching
++ * @_vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
++ * The name is expanded to X86_VENDOR_@_vendor
++ * @_family: The family number or X86_FAMILY_ANY
++ * @_model: The model number, model constant or X86_MODEL_ANY
++ * @_feature: A X86_FEATURE bit or X86_FEATURE_ANY
++ * @_data: Driver specific data or NULL. The internal storage
++ * format is unsigned long. The supplied value, pointer
++ * etc. is casted to unsigned long internally.
++ *
++ * The steppings arguments of X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE() is
++ * set to wildcards.
++ */
++#define X86_MATCH_VENDOR_FAM_MODEL_FEATURE(vendor, family, model, feature, data) \
++ X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(vendor, family, model, \
++ X86_STEPPING_ANY, feature, data)
++
++/**
++ * X86_MATCH_VENDOR_FAM_FEATURE - Macro for matching vendor, family and CPU feature
++ * @vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
++ * The name is expanded to X86_VENDOR_@vendor
++ * @family: The family number or X86_FAMILY_ANY
++ * @feature: A X86_FEATURE bit
++ * @data: Driver specific data or NULL. The internal storage
++ * format is unsigned long. The supplied value, pointer
++ * etc. is casted to unsigned long internally.
++ *
++ * All other missing arguments of X86_MATCH_VENDOR_FAM_MODEL_FEATURE() are
++ * set to wildcards.
++ */
++#define X86_MATCH_VENDOR_FAM_FEATURE(vendor, family, feature, data) \
++ X86_MATCH_VENDOR_FAM_MODEL_FEATURE(vendor, family, \
++ X86_MODEL_ANY, feature, data)
++
++/**
++ * X86_MATCH_VENDOR_FEATURE - Macro for matching vendor and CPU feature
++ * @vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
++ * The name is expanded to X86_VENDOR_@vendor
++ * @feature: A X86_FEATURE bit
++ * @data: Driver specific data or NULL. The internal storage
++ * format is unsigned long. The supplied value, pointer
++ * etc. is casted to unsigned long internally.
++ *
++ * All other missing arguments of X86_MATCH_VENDOR_FAM_MODEL_FEATURE() are
++ * set to wildcards.
++ */
++#define X86_MATCH_VENDOR_FEATURE(vendor, feature, data) \
++ X86_MATCH_VENDOR_FAM_FEATURE(vendor, X86_FAMILY_ANY, feature, data)
++
++/**
++ * X86_MATCH_FEATURE - Macro for matching a CPU feature
++ * @feature: A X86_FEATURE bit
++ * @data: Driver specific data or NULL. The internal storage
++ * format is unsigned long. The supplied value, pointer
++ * etc. is casted to unsigned long internally.
++ *
++ * All other missing arguments of X86_MATCH_VENDOR_FAM_MODEL_FEATURE() are
++ * set to wildcards.
++ */
++#define X86_MATCH_FEATURE(feature, data) \
++ X86_MATCH_VENDOR_FEATURE(ANY, feature, data)
++
++/* Transitional to keep the existing code working */
++#define X86_FEATURE_MATCH(feature) X86_MATCH_FEATURE(feature, NULL)
++
++/**
++ * X86_MATCH_VENDOR_FAM_MODEL - Match vendor, family and model
++ * @vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
++ * The name is expanded to X86_VENDOR_@vendor
++ * @family: The family number or X86_FAMILY_ANY
++ * @model: The model number, model constant or X86_MODEL_ANY
++ * @data: Driver specific data or NULL. The internal storage
++ * format is unsigned long. The supplied value, pointer
++ * etc. is casted to unsigned long internally.
++ *
++ * All other missing arguments of X86_MATCH_VENDOR_FAM_MODEL_FEATURE() are
++ * set to wildcards.
++ */
++#define X86_MATCH_VENDOR_FAM_MODEL(vendor, family, model, data) \
++ X86_MATCH_VENDOR_FAM_MODEL_FEATURE(vendor, family, model, \
++ X86_FEATURE_ANY, data)
++
++/**
++ * X86_MATCH_VENDOR_FAM - Match vendor and family
++ * @vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
++ * The name is expanded to X86_VENDOR_@vendor
++ * @family: The family number or X86_FAMILY_ANY
++ * @data: Driver specific data or NULL. The internal storage
++ * format is unsigned long. The supplied value, pointer
++ * etc. is casted to unsigned long internally.
++ *
++ * All other missing arguments to X86_MATCH_VENDOR_FAM_MODEL_FEATURE() are
++ * set of wildcards.
++ */
++#define X86_MATCH_VENDOR_FAM(vendor, family, data) \
++ X86_MATCH_VENDOR_FAM_MODEL(vendor, family, X86_MODEL_ANY, data)
++
++/**
++ * X86_MATCH_INTEL_FAM6_MODEL - Match vendor INTEL, family 6 and model
++ * @model: The model name without the INTEL_FAM6_ prefix or ANY
++ * The model name is expanded to INTEL_FAM6_@model internally
++ * @data: Driver specific data or NULL. The internal storage
++ * format is unsigned long. The supplied value, pointer
++ * etc. is casted to unsigned long internally.
++ *
++ * The vendor is set to INTEL, the family to 6 and all other missing
++ * arguments of X86_MATCH_VENDOR_FAM_MODEL_FEATURE() are set to wildcards.
++ *
++ * See X86_MATCH_VENDOR_FAM_MODEL_FEATURE() for further information.
++ */
++#define X86_MATCH_INTEL_FAM6_MODEL(model, data) \
++ X86_MATCH_VENDOR_FAM_MODEL(INTEL, 6, INTEL_FAM6_##model, data)
++
++/*
++ * Match specific microcode revisions.
++ *
++ * vendor/family/model/stepping must be all set.
++ *
++ * Only checks against the boot CPU. When mixed-stepping configs are
++ * valid for a CPU model, add a quirk for every valid stepping and
++ * do the fine-tuning in the quirk handler.
++ */
++
++struct x86_cpu_desc {
++ u8 x86_family;
++ u8 x86_vendor;
++ u8 x86_model;
++ u8 x86_stepping;
++ u32 x86_microcode_rev;
++};
++
++#define INTEL_CPU_DESC(model, stepping, revision) { \
++ .x86_family = 6, \
++ .x86_vendor = X86_VENDOR_INTEL, \
++ .x86_model = (model), \
++ .x86_stepping = (stepping), \
++ .x86_microcode_rev = (revision), \
++}
++
+ extern const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match);
++extern bool x86_cpu_has_min_microcode_rev(const struct x86_cpu_desc *table);
+
+-#endif
++#endif /* _ASM_X86_CPU_DEVICE_ID */
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index e9b79bac9b2af..caaab0a20e262 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -202,8 +202,8 @@
+ #define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */
+ #define X86_FEATURE_SME ( 7*32+10) /* AMD Secure Memory Encryption */
+ #define X86_FEATURE_PTI ( 7*32+11) /* Kernel Page Table Isolation enabled */
+-#define X86_FEATURE_RETPOLINE ( 7*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */
+-#define X86_FEATURE_RETPOLINE_LFENCE ( 7*32+13) /* "" Use LFENCE for Spectre variant 2 */
++#define X86_FEATURE_KERNEL_IBRS ( 7*32+12) /* "" Set/clear IBRS on kernel entry/exit */
++#define X86_FEATURE_RSB_VMEXIT ( 7*32+13) /* "" Fill RSB on VM-Exit */
+ #define X86_FEATURE_INTEL_PPIN ( 7*32+14) /* Intel Processor Inventory Number */
+ #define X86_FEATURE_CDP_L2 ( 7*32+15) /* Code and Data Prioritization L2 */
+ #define X86_FEATURE_MSR_SPEC_CTRL ( 7*32+16) /* "" MSR SPEC_CTRL is implemented */
+@@ -283,7 +283,15 @@
+ #define X86_FEATURE_CQM_MBM_LOCAL (11*32+ 3) /* LLC Local MBM monitoring */
+ #define X86_FEATURE_FENCE_SWAPGS_USER (11*32+ 4) /* "" LFENCE in user entry SWAPGS path */
+ #define X86_FEATURE_FENCE_SWAPGS_KERNEL (11*32+ 5) /* "" LFENCE in kernel entry SWAPGS path */
+-#define X86_FEATURE_RSB_VMEXIT_LITE (11*32+ 6) /* "" Fill RSB on VM exit when EIBRS is enabled */
++/* FREE! (11*32+ 6) */
++/* FREE! (11*32+ 7) */
++/* FREE! (11*32+ 8) */
++/* FREE! (11*32+ 9) */
++/* FREE! (11*32+10) */
++#define X86_FEATURE_RRSBA_CTRL (11*32+11) /* "" RET prediction control */
++#define X86_FEATURE_RETPOLINE (11*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */
++#define X86_FEATURE_RETPOLINE_LFENCE (11*32+13) /* "" Use LFENCE for Spectre variant 2 */
++#define X86_FEATURE_RSB_VMEXIT_LITE (11*32+17) /* "" Fill RSB on VM exit when EIBRS is enabled */
+
+ /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */
+ #define X86_FEATURE_CLZERO (13*32+ 0) /* CLZERO instruction */
+@@ -296,6 +304,7 @@
+ #define X86_FEATURE_AMD_SSBD (13*32+24) /* "" Speculative Store Bypass Disable */
+ #define X86_FEATURE_VIRT_SSBD (13*32+25) /* Virtualized Speculative Store Bypass Disable */
+ #define X86_FEATURE_AMD_SSB_NO (13*32+26) /* "" Speculative Store Bypass is fixed in hardware. */
++#define X86_FEATURE_BTC_NO (13*32+29) /* "" Not vulnerable to Branch Type Confusion */
+
+ /* Thermal and Power Management Leaf, CPUID level 0x00000006 (EAX), word 14 */
+ #define X86_FEATURE_DTHERM (14*32+ 0) /* Digital Thermal Sensor */
+@@ -397,6 +406,7 @@
+ #define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */
+ #define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */
+ #define X86_BUG_MMIO_UNKNOWN X86_BUG(26) /* CPU is too old and its MMIO Stale Data status is unknown */
+-#define X86_BUG_EIBRS_PBRSB X86_BUG(27) /* EIBRS is vulnerable to Post Barrier RSB Predictions */
++#define X86_BUG_RETBLEED X86_BUG(27) /* CPU is affected by RETBleed */
++#define X86_BUG_EIBRS_PBRSB X86_BUG(28) /* EIBRS is vulnerable to Post Barrier RSB Predictions */
+
+ #endif /* _ASM_X86_CPUFEATURES_H */
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index db06f16627b0e..1f2f52a340868 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -13,6 +13,9 @@
+ * that group keep the CPUID for the variants sorted by model number.
+ */
+
++/* Wildcard match for FAM6 so X86_MATCH_INTEL_FAM6_MODEL(ANY) works */
++#define INTEL_FAM6_ANY X86_MODEL_ANY
++
+ #define INTEL_FAM6_CORE_YONAH 0x0E
+
+ #define INTEL_FAM6_CORE2_MEROM 0x0F
+@@ -101,6 +104,9 @@
+ #define INTEL_FAM6_XEON_PHI_KNL 0x57 /* Knights Landing */
+ #define INTEL_FAM6_XEON_PHI_KNM 0x85 /* Knights Mill */
+
++/* Family 5 */
++#define INTEL_FAM5_QUARK_X1000 0x09 /* Quark X1000 SoC */
++
+ /* Useful macros */
+ #define INTEL_CPU_FAM_ANY(_family, _model, _driver_data) \
+ { \
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 7a73799537bf3..dbe98e8ed1640 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -47,6 +47,8 @@
+ #define SPEC_CTRL_STIBP BIT(SPEC_CTRL_STIBP_SHIFT) /* STIBP mask */
+ #define SPEC_CTRL_SSBD_SHIFT 2 /* Speculative Store Bypass Disable bit */
+ #define SPEC_CTRL_SSBD BIT(SPEC_CTRL_SSBD_SHIFT) /* Speculative Store Bypass Disable */
++#define SPEC_CTRL_RRSBA_DIS_S_SHIFT 6 /* Disable RRSBA behavior */
++#define SPEC_CTRL_RRSBA_DIS_S BIT(SPEC_CTRL_RRSBA_DIS_S_SHIFT)
+
+ #define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */
+ #define PRED_CMD_IBPB BIT(0) /* Indirect Branch Prediction Barrier */
+@@ -73,6 +75,7 @@
+ #define MSR_IA32_ARCH_CAPABILITIES 0x0000010a
+ #define ARCH_CAP_RDCL_NO BIT(0) /* Not susceptible to Meltdown */
+ #define ARCH_CAP_IBRS_ALL BIT(1) /* Enhanced IBRS support */
++#define ARCH_CAP_RSBA BIT(2) /* RET may use alternative branch predictors */
+ #define ARCH_CAP_SKIP_VMENTRY_L1DFLUSH BIT(3) /* Skip L1D flush on vmentry */
+ #define ARCH_CAP_SSB_NO BIT(4) /*
+ * Not susceptible to Speculative Store Bypass
+@@ -120,6 +123,13 @@
+ * bit available to control VERW
+ * behavior.
+ */
++#define ARCH_CAP_RRSBA BIT(19) /*
++ * Indicates RET may use predictors
++ * other than the RSB. With eIBRS
++ * enabled predictions in kernel mode
++ * are restricted to targets in
++ * kernel.
++ */
+ #define ARCH_CAP_PBRSB_NO BIT(24) /*
+ * Not susceptible to Post-Barrier
+ * Return Stack Buffer Predictions.
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 17a236a8b2370..64b086c47b4a4 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -4,11 +4,14 @@
+ #define _ASM_X86_NOSPEC_BRANCH_H_
+
+ #include <linux/static_key.h>
++#include <linux/frame.h>
+
+ #include <asm/alternative.h>
+ #include <asm/alternative-asm.h>
+ #include <asm/cpufeatures.h>
+ #include <asm/msr-index.h>
++#include <asm/unwind_hints.h>
++#include <asm/percpu.h>
+
+ /*
+ * Fill the CPU return stack buffer.
+@@ -51,9 +54,9 @@
+ lfence; \
+ jmp 775b; \
+ 774: \
++ add $(BITS_PER_LONG/8) * 2, sp; \
+ dec reg; \
+ jnz 771b; \
+- add $(BITS_PER_LONG/8) * nr, sp; \
+ /* barrier for jnz misprediction */ \
+ lfence;
+ #else
+@@ -70,12 +73,11 @@
+ add $(BITS_PER_LONG/8) * nr, sp;
+ #endif
+
+-/* Sequence to mitigate PBRSB on eIBRS CPUs */
+-#define __ISSUE_UNBALANCED_RET_GUARD(sp) \
+- call 881f; \
++#define ISSUE_UNBALANCED_RET_GUARD(sp) \
++ call 992f; \
+ int3; \
+-881: \
+- add $(BITS_PER_LONG/8), sp; \
++992: \
++ add $(BITS_PER_LONG/8), sp; \
+ lfence;
+
+ #ifdef __ASSEMBLY__
+@@ -165,13 +167,9 @@
+ * monstrosity above, manually.
+ */
+ .macro FILL_RETURN_BUFFER reg:req nr:req ftr:req
+-#ifdef CONFIG_RETPOLINE
+- ANNOTATE_NOSPEC_ALTERNATIVE
+- ALTERNATIVE "jmp .Lskip_rsb_\@", \
+- __stringify(__FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP)) \
+- \ftr
++ ALTERNATIVE "jmp .Lskip_rsb_\@", "", \ftr
++ __FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP)
+ .Lskip_rsb_\@:
+-#endif
+ .endm
+
+ #else /* __ASSEMBLY__ */
+@@ -252,6 +250,7 @@ enum spectre_v2_mitigation {
+ SPECTRE_V2_EIBRS,
+ SPECTRE_V2_EIBRS_RETPOLINE,
+ SPECTRE_V2_EIBRS_LFENCE,
++ SPECTRE_V2_IBRS,
+ };
+
+ /* The indirect branch speculation control variants */
+@@ -280,26 +279,21 @@ extern char __indirect_thunk_end[];
+ * retpoline and IBRS mitigations for Spectre v2 need this; only on future
+ * CPUs with IBRS_ALL *might* it be avoided.
+ */
+-static inline void vmexit_fill_RSB(void)
++static __always_inline void vmexit_fill_RSB(void)
+ {
+ #ifdef CONFIG_RETPOLINE
+ unsigned long loops;
+
+ asm volatile (ANNOTATE_NOSPEC_ALTERNATIVE
+- ALTERNATIVE("jmp 910f",
+- __stringify(__FILL_RETURN_BUFFER(%0, RSB_CLEAR_LOOPS, %1)),
+- X86_FEATURE_RETPOLINE)
++ ALTERNATIVE_2("jmp 910f", "", X86_FEATURE_RSB_VMEXIT,
++ "jmp 911f", X86_FEATURE_RSB_VMEXIT_LITE)
++ __stringify(__FILL_RETURN_BUFFER(%0, RSB_CLEAR_LOOPS, %1))
++ "911:"
++ __stringify(ISSUE_UNBALANCED_RET_GUARD(%1))
+ "910:"
+ : "=r" (loops), ASM_CALL_CONSTRAINT
+ : : "memory" );
+ #endif
+- asm volatile (ANNOTATE_NOSPEC_ALTERNATIVE
+- ALTERNATIVE("jmp 920f",
+- __stringify(__ISSUE_UNBALANCED_RET_GUARD(%0)),
+- X86_FEATURE_RSB_VMEXIT_LITE)
+- "920:"
+- : ASM_CALL_CONSTRAINT
+- : : "memory" );
+ }
+
+ static __always_inline
+@@ -322,6 +316,9 @@ static inline void indirect_branch_prediction_barrier(void)
+
+ /* The Intel SPEC CTRL MSR base value cache */
+ extern u64 x86_spec_ctrl_base;
++DECLARE_PER_CPU(u64, x86_spec_ctrl_current);
++extern void write_spec_ctrl_current(u64 val, bool force);
++extern u64 spec_ctrl_current(void);
+
+ /*
+ * With retpoline, we must use IBRS to restrict branch prediction
+@@ -331,18 +328,16 @@ extern u64 x86_spec_ctrl_base;
+ */
+ #define firmware_restrict_branch_speculation_start() \
+ do { \
+- u64 val = x86_spec_ctrl_base | SPEC_CTRL_IBRS; \
+- \
+ preempt_disable(); \
+- alternative_msr_write(MSR_IA32_SPEC_CTRL, val, \
++ alternative_msr_write(MSR_IA32_SPEC_CTRL, \
++ spec_ctrl_current() | SPEC_CTRL_IBRS, \
+ X86_FEATURE_USE_IBRS_FW); \
+ } while (0)
+
+ #define firmware_restrict_branch_speculation_end() \
+ do { \
+- u64 val = x86_spec_ctrl_base; \
+- \
+- alternative_msr_write(MSR_IA32_SPEC_CTRL, val, \
++ alternative_msr_write(MSR_IA32_SPEC_CTRL, \
++ spec_ctrl_current(), \
+ X86_FEATURE_USE_IBRS_FW); \
+ preempt_enable(); \
+ } while (0)
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 98c23126f7512..f1f41c96d319e 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -885,12 +885,21 @@ static void init_amd_zn(struct cpuinfo_x86 *c)
+ {
+ set_cpu_cap(c, X86_FEATURE_ZEN);
+
+- /*
+- * Fix erratum 1076: CPB feature bit not being set in CPUID.
+- * Always set it, except when running under a hypervisor.
+- */
+- if (!cpu_has(c, X86_FEATURE_HYPERVISOR) && !cpu_has(c, X86_FEATURE_CPB))
+- set_cpu_cap(c, X86_FEATURE_CPB);
++ /* Fix up CPUID bits, but only if not virtualised. */
++ if (!cpu_has(c, X86_FEATURE_HYPERVISOR)) {
++
++ /* Erratum 1076: CPB feature bit not being set in CPUID. */
++ if (!cpu_has(c, X86_FEATURE_CPB))
++ set_cpu_cap(c, X86_FEATURE_CPB);
++
++ /*
++ * Zen3 (Fam19 model < 0x10) parts are not susceptible to
++ * Branch Type Confusion, but predate the allocation of the
++ * BTC_NO bit.
++ */
++ if (c->x86 == 0x19 && !cpu_has(c, X86_FEATURE_BTC_NO))
++ set_cpu_cap(c, X86_FEATURE_BTC_NO);
++ }
+ }
+
+ static void init_amd(struct cpuinfo_x86 *c)
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 501d09d59abcc..6668f92f43213 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -37,6 +37,8 @@
+
+ static void __init spectre_v1_select_mitigation(void);
+ static void __init spectre_v2_select_mitigation(void);
++static void __init retbleed_select_mitigation(void);
++static void __init spectre_v2_user_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
+ static void __init mds_select_mitigation(void);
+@@ -46,16 +48,40 @@ static void __init taa_select_mitigation(void);
+ static void __init mmio_select_mitigation(void);
+ static void __init srbds_select_mitigation(void);
+
+-/* The base value of the SPEC_CTRL MSR that always has to be preserved. */
++/* The base value of the SPEC_CTRL MSR without task-specific bits set */
+ u64 x86_spec_ctrl_base;
+ EXPORT_SYMBOL_GPL(x86_spec_ctrl_base);
++
++/* The current value of the SPEC_CTRL MSR with task-specific bits set */
++DEFINE_PER_CPU(u64, x86_spec_ctrl_current);
++EXPORT_SYMBOL_GPL(x86_spec_ctrl_current);
++
+ static DEFINE_MUTEX(spec_ctrl_mutex);
+
+ /*
+- * The vendor and possibly platform specific bits which can be modified in
+- * x86_spec_ctrl_base.
++ * Keep track of the SPEC_CTRL MSR value for the current task, which may differ
++ * from x86_spec_ctrl_base due to STIBP/SSB in __speculation_ctrl_update().
+ */
+-static u64 __ro_after_init x86_spec_ctrl_mask = SPEC_CTRL_IBRS;
++void write_spec_ctrl_current(u64 val, bool force)
++{
++ if (this_cpu_read(x86_spec_ctrl_current) == val)
++ return;
++
++ this_cpu_write(x86_spec_ctrl_current, val);
++
++ /*
++ * When KERNEL_IBRS this MSR is written on return-to-user, unless
++ * forced the update can be delayed until that time.
++ */
++ if (force || !cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS))
++ wrmsrl(MSR_IA32_SPEC_CTRL, val);
++}
++
++u64 spec_ctrl_current(void)
++{
++ return this_cpu_read(x86_spec_ctrl_current);
++}
++EXPORT_SYMBOL_GPL(spec_ctrl_current);
+
+ /*
+ * AMD specific MSR info for Speculative Store Bypass control.
+@@ -105,13 +131,21 @@ void __init check_bugs(void)
+ if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
+ rdmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+
+- /* Allow STIBP in MSR_SPEC_CTRL if supported */
+- if (boot_cpu_has(X86_FEATURE_STIBP))
+- x86_spec_ctrl_mask |= SPEC_CTRL_STIBP;
+-
+ /* Select the proper CPU mitigations before patching alternatives: */
+ spectre_v1_select_mitigation();
+ spectre_v2_select_mitigation();
++ /*
++ * retbleed_select_mitigation() relies on the state set by
++ * spectre_v2_select_mitigation(); specifically it wants to know about
++ * spectre_v2=ibrs.
++ */
++ retbleed_select_mitigation();
++ /*
++ * spectre_v2_user_select_mitigation() relies on the state set by
++ * retbleed_select_mitigation(); specifically the STIBP selection is
++ * forced for UNRET.
++ */
++ spectre_v2_user_select_mitigation();
+ ssb_select_mitigation();
+ l1tf_select_mitigation();
+ md_clear_select_mitigation();
+@@ -151,31 +185,17 @@ void __init check_bugs(void)
+ #endif
+ }
+
++/*
++ * NOTE: For VMX, this function is not called in the vmexit path.
++ * It uses vmx_spec_ctrl_restore_host() instead.
++ */
+ void
+ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
+ {
+- u64 msrval, guestval, hostval = x86_spec_ctrl_base;
++ u64 msrval, guestval = guest_spec_ctrl, hostval = spec_ctrl_current();
+ struct thread_info *ti = current_thread_info();
+
+- /* Is MSR_SPEC_CTRL implemented ? */
+ if (static_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) {
+- /*
+- * Restrict guest_spec_ctrl to supported values. Clear the
+- * modifiable bits in the host base value and or the
+- * modifiable bits from the guest value.
+- */
+- guestval = hostval & ~x86_spec_ctrl_mask;
+- guestval |= guest_spec_ctrl & x86_spec_ctrl_mask;
+-
+- /* SSBD controlled in MSR_SPEC_CTRL */
+- if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
+- static_cpu_has(X86_FEATURE_AMD_SSBD))
+- hostval |= ssbd_tif_to_spec_ctrl(ti->flags);
+-
+- /* Conditional STIBP enabled? */
+- if (static_branch_unlikely(&switch_to_cond_stibp))
+- hostval |= stibp_tif_to_spec_ctrl(ti->flags);
+-
+ if (hostval != guestval) {
+ msrval = setguest ? guestval : hostval;
+ wrmsrl(MSR_IA32_SPEC_CTRL, msrval);
+@@ -705,12 +725,103 @@ static int __init nospectre_v1_cmdline(char *str)
+ }
+ early_param("nospectre_v1", nospectre_v1_cmdline);
+
+-#undef pr_fmt
+-#define pr_fmt(fmt) "Spectre V2 : " fmt
+-
+ static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+ SPECTRE_V2_NONE;
+
++#undef pr_fmt
++#define pr_fmt(fmt) "RETBleed: " fmt
++
++enum retbleed_mitigation {
++ RETBLEED_MITIGATION_NONE,
++ RETBLEED_MITIGATION_IBRS,
++ RETBLEED_MITIGATION_EIBRS,
++};
++
++enum retbleed_mitigation_cmd {
++ RETBLEED_CMD_OFF,
++ RETBLEED_CMD_AUTO,
++};
++
++const char * const retbleed_strings[] = {
++ [RETBLEED_MITIGATION_NONE] = "Vulnerable",
++ [RETBLEED_MITIGATION_IBRS] = "Mitigation: IBRS",
++ [RETBLEED_MITIGATION_EIBRS] = "Mitigation: Enhanced IBRS",
++};
++
++static enum retbleed_mitigation retbleed_mitigation __ro_after_init =
++ RETBLEED_MITIGATION_NONE;
++static enum retbleed_mitigation_cmd retbleed_cmd __ro_after_init =
++ RETBLEED_CMD_AUTO;
++
++static int __init retbleed_parse_cmdline(char *str)
++{
++ if (!str)
++ return -EINVAL;
++
++ if (!strcmp(str, "off"))
++ retbleed_cmd = RETBLEED_CMD_OFF;
++ else if (!strcmp(str, "auto"))
++ retbleed_cmd = RETBLEED_CMD_AUTO;
++ else
++ pr_err("Unknown retbleed option (%s). Defaulting to 'auto'\n", str);
++
++ return 0;
++}
++early_param("retbleed", retbleed_parse_cmdline);
++
++#define RETBLEED_UNTRAIN_MSG "WARNING: BTB untrained return thunk mitigation is only effective on AMD/Hygon!\n"
++#define RETBLEED_COMPILER_MSG "WARNING: kernel not compiled with RETPOLINE or -mfunction-return capable compiler!\n"
++#define RETBLEED_INTEL_MSG "WARNING: Spectre v2 mitigation leaves CPU vulnerable to RETBleed attacks, data leaks possible!\n"
++
++static void __init retbleed_select_mitigation(void)
++{
++ if (!boot_cpu_has_bug(X86_BUG_RETBLEED) || cpu_mitigations_off())
++ return;
++
++ switch (retbleed_cmd) {
++ case RETBLEED_CMD_OFF:
++ return;
++
++ case RETBLEED_CMD_AUTO:
++ default:
++ /*
++ * The Intel mitigation (IBRS) was already selected in
++ * spectre_v2_select_mitigation().
++ */
++
++ break;
++ }
++
++ switch (retbleed_mitigation) {
++ default:
++ break;
++ }
++
++ /*
++ * Let IBRS trump all on Intel without affecting the effects of the
++ * retbleed= cmdline option.
++ */
++ if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
++ switch (spectre_v2_enabled) {
++ case SPECTRE_V2_IBRS:
++ retbleed_mitigation = RETBLEED_MITIGATION_IBRS;
++ break;
++ case SPECTRE_V2_EIBRS:
++ case SPECTRE_V2_EIBRS_RETPOLINE:
++ case SPECTRE_V2_EIBRS_LFENCE:
++ retbleed_mitigation = RETBLEED_MITIGATION_EIBRS;
++ break;
++ default:
++ pr_err(RETBLEED_INTEL_MSG);
++ }
++ }
++
++ pr_info("%s\n", retbleed_strings[retbleed_mitigation]);
++}
++
++#undef pr_fmt
++#define pr_fmt(fmt) "Spectre V2 : " fmt
++
+ static enum spectre_v2_user_mitigation spectre_v2_user_stibp __ro_after_init =
+ SPECTRE_V2_USER_NONE;
+ static enum spectre_v2_user_mitigation spectre_v2_user_ibpb __ro_after_init =
+@@ -740,6 +851,7 @@ static inline const char *spectre_v2_module_string(void) { return ""; }
+ #define SPECTRE_V2_LFENCE_MSG "WARNING: LFENCE mitigation is not recommended for this CPU, data leaks possible!\n"
+ #define SPECTRE_V2_EIBRS_EBPF_MSG "WARNING: Unprivileged eBPF is enabled with eIBRS on, data leaks possible via Spectre v2 BHB attacks!\n"
+ #define SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG "WARNING: Unprivileged eBPF is enabled with eIBRS+LFENCE mitigation and SMT, data leaks possible via Spectre v2 BHB attacks!\n"
++#define SPECTRE_V2_IBRS_PERF_MSG "WARNING: IBRS mitigation selected on Enhanced IBRS CPU, this may cause unnecessary performance loss\n"
+
+ #ifdef CONFIG_BPF_SYSCALL
+ void unpriv_ebpf_notify(int new_state)
+@@ -781,6 +893,7 @@ enum spectre_v2_mitigation_cmd {
+ SPECTRE_V2_CMD_EIBRS,
+ SPECTRE_V2_CMD_EIBRS_RETPOLINE,
+ SPECTRE_V2_CMD_EIBRS_LFENCE,
++ SPECTRE_V2_CMD_IBRS,
+ };
+
+ enum spectre_v2_user_cmd {
+@@ -821,13 +934,15 @@ static void __init spec_v2_user_print_cond(const char *reason, bool secure)
+ pr_info("spectre_v2_user=%s forced on command line.\n", reason);
+ }
+
++static __ro_after_init enum spectre_v2_mitigation_cmd spectre_v2_cmd;
++
+ static enum spectre_v2_user_cmd __init
+-spectre_v2_parse_user_cmdline(enum spectre_v2_mitigation_cmd v2_cmd)
++spectre_v2_parse_user_cmdline(void)
+ {
+ char arg[20];
+ int ret, i;
+
+- switch (v2_cmd) {
++ switch (spectre_v2_cmd) {
+ case SPECTRE_V2_CMD_NONE:
+ return SPECTRE_V2_USER_CMD_NONE;
+ case SPECTRE_V2_CMD_FORCE:
+@@ -853,15 +968,16 @@ spectre_v2_parse_user_cmdline(enum spectre_v2_mitigation_cmd v2_cmd)
+ return SPECTRE_V2_USER_CMD_AUTO;
+ }
+
+-static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode)
++static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
+ {
+- return (mode == SPECTRE_V2_EIBRS ||
+- mode == SPECTRE_V2_EIBRS_RETPOLINE ||
+- mode == SPECTRE_V2_EIBRS_LFENCE);
++ return mode == SPECTRE_V2_IBRS ||
++ mode == SPECTRE_V2_EIBRS ||
++ mode == SPECTRE_V2_EIBRS_RETPOLINE ||
++ mode == SPECTRE_V2_EIBRS_LFENCE;
+ }
+
+ static void __init
+-spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
++spectre_v2_user_select_mitigation(void)
+ {
+ enum spectre_v2_user_mitigation mode = SPECTRE_V2_USER_NONE;
+ bool smt_possible = IS_ENABLED(CONFIG_SMP);
+@@ -874,7 +990,7 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ cpu_smt_control == CPU_SMT_NOT_SUPPORTED)
+ smt_possible = false;
+
+- cmd = spectre_v2_parse_user_cmdline(v2_cmd);
++ cmd = spectre_v2_parse_user_cmdline();
+ switch (cmd) {
+ case SPECTRE_V2_USER_CMD_NONE:
+ goto set_mode;
+@@ -922,12 +1038,12 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ }
+
+ /*
+- * If no STIBP, enhanced IBRS is enabled or SMT impossible, STIBP is not
+- * required.
++ * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible,
++ * STIBP is not required.
+ */
+ if (!boot_cpu_has(X86_FEATURE_STIBP) ||
+ !smt_possible ||
+- spectre_v2_in_eibrs_mode(spectre_v2_enabled))
++ spectre_v2_in_ibrs_mode(spectre_v2_enabled))
+ return;
+
+ /*
+@@ -952,6 +1068,7 @@ static const char * const spectre_v2_strings[] = {
+ [SPECTRE_V2_EIBRS] = "Mitigation: Enhanced IBRS",
+ [SPECTRE_V2_EIBRS_LFENCE] = "Mitigation: Enhanced IBRS + LFENCE",
+ [SPECTRE_V2_EIBRS_RETPOLINE] = "Mitigation: Enhanced IBRS + Retpolines",
++ [SPECTRE_V2_IBRS] = "Mitigation: IBRS",
+ };
+
+ static const struct {
+@@ -969,6 +1086,7 @@ static const struct {
+ { "eibrs,lfence", SPECTRE_V2_CMD_EIBRS_LFENCE, false },
+ { "eibrs,retpoline", SPECTRE_V2_CMD_EIBRS_RETPOLINE, false },
+ { "auto", SPECTRE_V2_CMD_AUTO, false },
++ { "ibrs", SPECTRE_V2_CMD_IBRS, false },
+ };
+
+ static void __init spec_v2_print_cond(const char *reason, bool secure)
+@@ -1031,6 +1149,24 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ return SPECTRE_V2_CMD_AUTO;
+ }
+
++ if (cmd == SPECTRE_V2_CMD_IBRS && boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) {
++ pr_err("%s selected but not Intel CPU. Switching to AUTO select\n",
++ mitigation_options[i].option);
++ return SPECTRE_V2_CMD_AUTO;
++ }
++
++ if (cmd == SPECTRE_V2_CMD_IBRS && !boot_cpu_has(X86_FEATURE_IBRS)) {
++ pr_err("%s selected but CPU doesn't have IBRS. Switching to AUTO select\n",
++ mitigation_options[i].option);
++ return SPECTRE_V2_CMD_AUTO;
++ }
++
++ if (cmd == SPECTRE_V2_CMD_IBRS && boot_cpu_has(X86_FEATURE_XENPV)) {
++ pr_err("%s selected but running as XenPV guest. Switching to AUTO select\n",
++ mitigation_options[i].option);
++ return SPECTRE_V2_CMD_AUTO;
++ }
++
+ spec_v2_print_cond(mitigation_options[i].option,
+ mitigation_options[i].secure);
+ return cmd;
+@@ -1046,6 +1182,22 @@ static enum spectre_v2_mitigation __init spectre_v2_select_retpoline(void)
+ return SPECTRE_V2_RETPOLINE;
+ }
+
++/* Disable in-kernel use of non-RSB RET predictors */
++static void __init spec_ctrl_disable_kernel_rrsba(void)
++{
++ u64 ia32_cap;
++
++ if (!boot_cpu_has(X86_FEATURE_RRSBA_CTRL))
++ return;
++
++ ia32_cap = x86_read_arch_cap_msr();
++
++ if (ia32_cap & ARCH_CAP_RRSBA) {
++ x86_spec_ctrl_base |= SPEC_CTRL_RRSBA_DIS_S;
++ write_spec_ctrl_current(x86_spec_ctrl_base, true);
++ }
++}
++
+ static void __init spectre_v2_determine_rsb_fill_type_at_vmexit(enum spectre_v2_mitigation mode)
+ {
+ /*
+@@ -1070,19 +1222,24 @@ static void __init spectre_v2_determine_rsb_fill_type_at_vmexit(enum spectre_v2_
+ */
+ switch (mode) {
+ case SPECTRE_V2_NONE:
+- /* These modes already fill RSB at vmexit */
+- case SPECTRE_V2_LFENCE:
+- case SPECTRE_V2_RETPOLINE:
+- case SPECTRE_V2_EIBRS_RETPOLINE:
+ return;
+
+ case SPECTRE_V2_EIBRS_LFENCE:
+ case SPECTRE_V2_EIBRS:
+- if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) {
++ if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB) &&
++ (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)) {
+ setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT_LITE);
+ pr_info("Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT\n");
+ }
+ return;
++
++ case SPECTRE_V2_EIBRS_RETPOLINE:
++ case SPECTRE_V2_RETPOLINE:
++ case SPECTRE_V2_LFENCE:
++ case SPECTRE_V2_IBRS:
++ setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT);
++ pr_info("Spectre v2 / SpectreRSB : Filling RSB on VMEXIT\n");
++ return;
+ }
+
+ pr_warn_once("Unknown Spectre v2 mode, disabling RSB mitigation at VM exit");
+@@ -1113,6 +1270,14 @@ static void __init spectre_v2_select_mitigation(void)
+ break;
+ }
+
++ if (boot_cpu_has_bug(X86_BUG_RETBLEED) &&
++ retbleed_cmd != RETBLEED_CMD_OFF &&
++ boot_cpu_has(X86_FEATURE_IBRS) &&
++ boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
++ mode = SPECTRE_V2_IBRS;
++ break;
++ }
++
+ mode = spectre_v2_select_retpoline();
+ break;
+
+@@ -1129,6 +1294,10 @@ static void __init spectre_v2_select_mitigation(void)
+ mode = spectre_v2_select_retpoline();
+ break;
+
++ case SPECTRE_V2_CMD_IBRS:
++ mode = SPECTRE_V2_IBRS;
++ break;
++
+ case SPECTRE_V2_CMD_EIBRS:
+ mode = SPECTRE_V2_EIBRS;
+ break;
+@@ -1145,10 +1314,9 @@ static void __init spectre_v2_select_mitigation(void)
+ if (mode == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
+ pr_err(SPECTRE_V2_EIBRS_EBPF_MSG);
+
+- if (spectre_v2_in_eibrs_mode(mode)) {
+- /* Force it so VMEXIT will restore correctly */
++ if (spectre_v2_in_ibrs_mode(mode)) {
+ x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
+- wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++ write_spec_ctrl_current(x86_spec_ctrl_base, true);
+ }
+
+ switch (mode) {
+@@ -1156,6 +1324,12 @@ static void __init spectre_v2_select_mitigation(void)
+ case SPECTRE_V2_EIBRS:
+ break;
+
++ case SPECTRE_V2_IBRS:
++ setup_force_cpu_cap(X86_FEATURE_KERNEL_IBRS);
++ if (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED))
++ pr_warn(SPECTRE_V2_IBRS_PERF_MSG);
++ break;
++
+ case SPECTRE_V2_LFENCE:
+ case SPECTRE_V2_EIBRS_LFENCE:
+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE_LFENCE);
+@@ -1167,16 +1341,56 @@ static void __init spectre_v2_select_mitigation(void)
+ break;
+ }
+
++ /*
++ * Disable alternate RSB predictions in kernel when indirect CALLs and
++ * JMPs gets protection against BHI and Intramode-BTI, but RET
++ * prediction from a non-RSB predictor is still a risk.
++ */
++ if (mode == SPECTRE_V2_EIBRS_LFENCE ||
++ mode == SPECTRE_V2_EIBRS_RETPOLINE ||
++ mode == SPECTRE_V2_RETPOLINE)
++ spec_ctrl_disable_kernel_rrsba();
++
+ spectre_v2_enabled = mode;
+ pr_info("%s\n", spectre_v2_strings[mode]);
+
+ /*
+- * If spectre v2 protection has been enabled, unconditionally fill
+- * RSB during a context switch; this protects against two independent
+- * issues:
++ * If Spectre v2 protection has been enabled, fill the RSB during a
++ * context switch. In general there are two types of RSB attacks
++ * across context switches, for which the CALLs/RETs may be unbalanced.
++ *
++ * 1) RSB underflow
++ *
++ * Some Intel parts have "bottomless RSB". When the RSB is empty,
++ * speculated return targets may come from the branch predictor,
++ * which could have a user-poisoned BTB or BHB entry.
++ *
++ * AMD has it even worse: *all* returns are speculated from the BTB,
++ * regardless of the state of the RSB.
++ *
++ * When IBRS or eIBRS is enabled, the "user -> kernel" attack
++ * scenario is mitigated by the IBRS branch prediction isolation
++ * properties, so the RSB buffer filling wouldn't be necessary to
++ * protect against this type of attack.
++ *
++ * The "user -> user" attack scenario is mitigated by RSB filling.
+ *
+- * - RSB underflow (and switch to BTB) on Skylake+
+- * - SpectreRSB variant of spectre v2 on X86_BUG_SPECTRE_V2 CPUs
++ * 2) Poisoned RSB entry
++ *
++ * If the 'next' in-kernel return stack is shorter than 'prev',
++ * 'next' could be tricked into speculating with a user-poisoned RSB
++ * entry.
++ *
++ * The "user -> kernel" attack scenario is mitigated by SMEP and
++ * eIBRS.
++ *
++ * The "user -> user" scenario, also known as SpectreBHB, requires
++ * RSB clearing.
++ *
++ * So to mitigate all cases, unconditionally fill RSB on context
++ * switches.
++ *
++ * FIXME: Is this pointless for retbleed-affected AMD?
+ */
+ setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
+ pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n");
+@@ -1184,28 +1398,29 @@ static void __init spectre_v2_select_mitigation(void)
+ spectre_v2_determine_rsb_fill_type_at_vmexit(mode);
+
+ /*
+- * Retpoline means the kernel is safe because it has no indirect
+- * branches. Enhanced IBRS protects firmware too, so, enable restricted
+- * speculation around firmware calls only when Enhanced IBRS isn't
+- * supported.
++ * Retpoline protects the kernel, but doesn't protect firmware. IBRS
++ * and Enhanced IBRS protect firmware too, so enable IBRS around
++ * firmware calls only when IBRS / Enhanced IBRS aren't otherwise
++ * enabled.
+ *
+ * Use "mode" to check Enhanced IBRS instead of boot_cpu_has(), because
+ * the user might select retpoline on the kernel command line and if
+ * the CPU supports Enhanced IBRS, kernel might un-intentionally not
+ * enable IBRS around firmware calls.
+ */
+- if (boot_cpu_has(X86_FEATURE_IBRS) && !spectre_v2_in_eibrs_mode(mode)) {
++ if (boot_cpu_has(X86_FEATURE_IBRS) && !spectre_v2_in_ibrs_mode(mode)) {
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+ pr_info("Enabling Restricted Speculation for firmware calls\n");
+ }
+
+ /* Set up IBPB and STIBP depending on the general spectre V2 command */
+- spectre_v2_user_select_mitigation(cmd);
++ spectre_v2_cmd = cmd;
+ }
+
+ static void update_stibp_msr(void * __unused)
+ {
+- wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++ u64 val = spec_ctrl_current() | (x86_spec_ctrl_base & SPEC_CTRL_STIBP);
++ write_spec_ctrl_current(val, true);
+ }
+
+ /* Update x86_spec_ctrl_base in case SMT state changed. */
+@@ -1421,16 +1636,6 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void)
+ break;
+ }
+
+- /*
+- * If SSBD is controlled by the SPEC_CTRL MSR, then set the proper
+- * bit in the mask to allow guests to use the mitigation even in the
+- * case where the host does not enable it.
+- */
+- if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
+- static_cpu_has(X86_FEATURE_AMD_SSBD)) {
+- x86_spec_ctrl_mask |= SPEC_CTRL_SSBD;
+- }
+-
+ /*
+ * We have three CPU feature flags that are in play here:
+ * - X86_BUG_SPEC_STORE_BYPASS - CPU is susceptible.
+@@ -1448,7 +1653,7 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void)
+ x86_amd_ssb_disable();
+ } else {
+ x86_spec_ctrl_base |= SPEC_CTRL_SSBD;
+- wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++ write_spec_ctrl_current(x86_spec_ctrl_base, true);
+ }
+ }
+
+@@ -1653,7 +1858,7 @@ int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which)
+ void x86_spec_ctrl_setup_ap(void)
+ {
+ if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
+- wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++ write_spec_ctrl_current(x86_spec_ctrl_base, true);
+
+ if (ssb_mode == SPEC_STORE_BYPASS_DISABLE)
+ x86_amd_ssb_disable();
+@@ -1888,7 +2093,7 @@ static ssize_t mmio_stale_data_show_state(char *buf)
+
+ static char *stibp_state(void)
+ {
+- if (spectre_v2_in_eibrs_mode(spectre_v2_enabled))
++ if (spectre_v2_in_ibrs_mode(spectre_v2_enabled))
+ return "";
+
+ switch (spectre_v2_user_stibp) {
+@@ -1922,7 +2127,7 @@ static char *pbrsb_eibrs_state(void)
+ {
+ if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) {
+ if (boot_cpu_has(X86_FEATURE_RSB_VMEXIT_LITE) ||
+- boot_cpu_has(X86_FEATURE_RETPOLINE))
++ boot_cpu_has(X86_FEATURE_RSB_VMEXIT))
+ return ", PBRSB-eIBRS: SW sequence";
+ else
+ return ", PBRSB-eIBRS: Vulnerable";
+@@ -1958,6 +2163,11 @@ static ssize_t srbds_show_state(char *buf)
+ return sprintf(buf, "%s\n", srbds_strings[srbds_mitigation]);
+ }
+
++static ssize_t retbleed_show_state(char *buf)
++{
++ return sprintf(buf, "%s\n", retbleed_strings[retbleed_mitigation]);
++}
++
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+ char *buf, unsigned int bug)
+ {
+@@ -2004,6 +2214,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ case X86_BUG_MMIO_UNKNOWN:
+ return mmio_stale_data_show_state(buf);
+
++ case X86_BUG_RETBLEED:
++ return retbleed_show_state(buf);
++
+ default:
+ break;
+ }
+@@ -2063,4 +2276,9 @@ ssize_t cpu_show_mmio_stale_data(struct device *dev, struct device_attribute *at
+ else
+ return cpu_show_common(dev, attr, buf, X86_BUG_MMIO_STALE_DATA);
+ }
++
++ssize_t cpu_show_retbleed(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ return cpu_show_common(dev, attr, buf, X86_BUG_RETBLEED);
++}
+ #endif
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 653ced7cb3964..55293e5dcbffd 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -954,8 +954,8 @@ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
+ #define MSBDS_ONLY BIT(5)
+ #define NO_SWAPGS BIT(6)
+ #define NO_ITLB_MULTIHIT BIT(7)
+-#define NO_EIBRS_PBRSB BIT(8)
+-#define NO_MMIO BIT(9)
++#define NO_MMIO BIT(8)
++#define NO_EIBRS_PBRSB BIT(9)
+
+ #define VULNWL(_vendor, _family, _model, _whitelist) \
+ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist }
+@@ -1022,48 +1022,55 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+ {}
+ };
+
++#define VULNBL(vendor, family, model, blacklist) \
++ X86_MATCH_VENDOR_FAM_MODEL(vendor, family, model, blacklist)
++
+ #define VULNBL_INTEL_STEPPINGS(model, steppings, issues) \
+ X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, \
+ INTEL_FAM6_##model, steppings, \
+ X86_FEATURE_ANY, issues)
+
++#define VULNBL_AMD(family, blacklist) \
++ VULNBL(AMD, family, X86_MODEL_ANY, blacklist)
++
+ #define SRBDS BIT(0)
+ /* CPU is affected by X86_BUG_MMIO_STALE_DATA */
+ #define MMIO BIT(1)
+ /* CPU is affected by Shared Buffers Data Sampling (SBDS), a variant of X86_BUG_MMIO_STALE_DATA */
+ #define MMIO_SBDS BIT(2)
++/* CPU is affected by RETbleed, speculating where you would not expect it */
++#define RETBLEED BIT(3)
+
+ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
+ VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS),
+ VULNBL_INTEL_STEPPINGS(HASWELL_CORE, X86_STEPPING_ANY, SRBDS),
+ VULNBL_INTEL_STEPPINGS(HASWELL_ULT, X86_STEPPING_ANY, SRBDS),
+ VULNBL_INTEL_STEPPINGS(HASWELL_GT3E, X86_STEPPING_ANY, SRBDS),
+- VULNBL_INTEL_STEPPINGS(HASWELL_X, BIT(2) | BIT(4), MMIO),
+- VULNBL_INTEL_STEPPINGS(BROADWELL_XEON_D,X86_STEPPINGS(0x3, 0x5), MMIO),
++ VULNBL_INTEL_STEPPINGS(HASWELL_X, X86_STEPPING_ANY, MMIO),
++ VULNBL_INTEL_STEPPINGS(BROADWELL_XEON_D,X86_STEPPING_ANY, MMIO),
+ VULNBL_INTEL_STEPPINGS(BROADWELL_GT3E, X86_STEPPING_ANY, SRBDS),
+ VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO),
+ VULNBL_INTEL_STEPPINGS(BROADWELL_CORE, X86_STEPPING_ANY, SRBDS),
+- VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO),
+- VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS),
+- VULNBL_INTEL_STEPPINGS(SKYLAKE_X, BIT(3) | BIT(4) | BIT(6) |
+- BIT(7) | BIT(0xB), MMIO),
+- VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP, X86_STEPPINGS(0x3, 0x3), SRBDS | MMIO),
+- VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP, X86_STEPPING_ANY, SRBDS),
+- VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPINGS(0x9, 0xC), SRBDS | MMIO),
+- VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPINGS(0x0, 0x8), SRBDS),
+- VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x9, 0xD), SRBDS | MMIO),
+- VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPINGS(0x0, 0x8), SRBDS),
+- VULNBL_INTEL_STEPPINGS(ICELAKE_MOBILE, X86_STEPPINGS(0x5, 0x5), MMIO | MMIO_SBDS),
+- VULNBL_INTEL_STEPPINGS(ICELAKE_XEON_D, X86_STEPPINGS(0x1, 0x1), MMIO),
+- VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPINGS(0x4, 0x6), MMIO),
+- VULNBL_INTEL_STEPPINGS(COMETLAKE, BIT(2) | BIT(3) | BIT(5), MMIO | MMIO_SBDS),
+- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
+- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPINGS(0x0, 0x0), MMIO),
+- VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
+- VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPINGS(0x1, 0x1), MMIO),
+- VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPINGS(0x1, 0x1), MMIO | MMIO_SBDS),
++ VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(CANNONLAKE_MOBILE,X86_STEPPING_ANY, RETBLEED),
++ VULNBL_INTEL_STEPPINGS(ICELAKE_MOBILE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(ICELAKE_XEON_D, X86_STEPPING_ANY, MMIO),
++ VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPING_ANY, MMIO),
++ VULNBL_INTEL_STEPPINGS(COMETLAKE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPING_ANY, MMIO | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPING_ANY, MMIO | MMIO_SBDS),
+ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_X, X86_STEPPING_ANY, MMIO),
+- VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPINGS(0x0, 0x0), MMIO | MMIO_SBDS),
++ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS),
++
++ VULNBL_AMD(0x15, RETBLEED),
++ VULNBL_AMD(0x16, RETBLEED),
++ VULNBL_AMD(0x17, RETBLEED),
+ {}
+ };
+
+@@ -1169,6 +1176,11 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ setup_force_cpu_bug(X86_BUG_MMIO_UNKNOWN);
+ }
+
++ if (!cpu_has(c, X86_FEATURE_BTC_NO)) {
++ if (cpu_matches(cpu_vuln_blacklist, RETBLEED) || (ia32_cap & ARCH_CAP_RSBA))
++ setup_force_cpu_bug(X86_BUG_RETBLEED);
++ }
++
+ if (cpu_has(c, X86_FEATURE_IBRS_ENHANCED) &&
+ !cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) &&
+ !(ia32_cap & ARCH_CAP_PBRSB_NO))
+diff --git a/arch/x86/kernel/cpu/match.c b/arch/x86/kernel/cpu/match.c
+index 751e590574660..ad6776081e60d 100644
+--- a/arch/x86/kernel/cpu/match.c
++++ b/arch/x86/kernel/cpu/match.c
+@@ -16,12 +16,17 @@
+ * respective wildcard entries.
+ *
+ * A typical table entry would be to match a specific CPU
+- * { X86_VENDOR_INTEL, 6, 0x12 }
+- * or to match a specific CPU feature
+- * { X86_FEATURE_MATCH(X86_FEATURE_FOOBAR) }
++ *
++ * X86_MATCH_VENDOR_FAM_MODEL_FEATURE(INTEL, 6, INTEL_FAM6_BROADWELL,
++ * X86_FEATURE_ANY, NULL);
+ *
+ * Fields can be wildcarded with %X86_VENDOR_ANY, %X86_FAMILY_ANY,
+- * %X86_MODEL_ANY, %X86_FEATURE_ANY or 0 (except for vendor)
++ * %X86_MODEL_ANY, %X86_FEATURE_ANY (except for vendor)
++ *
++ * asm/cpu_device_id.h contains a set of useful macros which are shortcuts
++ * for various common selections. The above can be shortened to:
++ *
++ * X86_MATCH_INTEL_FAM6_MODEL(BROADWELL, NULL);
+ *
+ * Arrays used to match for this should also be declared using
+ * MODULE_DEVICE_TABLE(x86cpu, ...)
+@@ -53,3 +58,34 @@ const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match)
+ return NULL;
+ }
+ EXPORT_SYMBOL(x86_match_cpu);
++
++static const struct x86_cpu_desc *
++x86_match_cpu_with_stepping(const struct x86_cpu_desc *match)
++{
++ struct cpuinfo_x86 *c = &boot_cpu_data;
++ const struct x86_cpu_desc *m;
++
++ for (m = match; m->x86_family | m->x86_model; m++) {
++ if (c->x86_vendor != m->x86_vendor)
++ continue;
++ if (c->x86 != m->x86_family)
++ continue;
++ if (c->x86_model != m->x86_model)
++ continue;
++ if (c->x86_stepping != m->x86_stepping)
++ continue;
++ return m;
++ }
++ return NULL;
++}
++
++bool x86_cpu_has_min_microcode_rev(const struct x86_cpu_desc *table)
++{
++ const struct x86_cpu_desc *res = x86_match_cpu_with_stepping(table);
++
++ if (!res || res->x86_microcode_rev > boot_cpu_data.microcode)
++ return false;
++
++ return true;
++}
++EXPORT_SYMBOL_GPL(x86_cpu_has_min_microcode_rev);
+diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
+index 5a52672e3f8ba..90bd155d7e7a2 100644
+--- a/arch/x86/kernel/cpu/scattered.c
++++ b/arch/x86/kernel/cpu/scattered.c
+@@ -21,6 +21,7 @@ struct cpuid_bit {
+ static const struct cpuid_bit cpuid_bits[] = {
+ { X86_FEATURE_APERFMPERF, CPUID_ECX, 0, 0x00000006, 0 },
+ { X86_FEATURE_EPB, CPUID_ECX, 3, 0x00000006, 0 },
++ { X86_FEATURE_RRSBA_CTRL, CPUID_EDX, 2, 0x00000007, 2 },
+ { X86_FEATURE_CQM_LLC, CPUID_EDX, 1, 0x0000000f, 0 },
+ { X86_FEATURE_CQM_OCCUP_LLC, CPUID_EDX, 0, 0x0000000f, 1 },
+ { X86_FEATURE_CQM_MBM_TOTAL, CPUID_EDX, 1, 0x0000000f, 1 },
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index cd138bfd926c2..a95b9e090f9e5 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -434,7 +434,7 @@ static __always_inline void __speculation_ctrl_update(unsigned long tifp,
+ }
+
+ if (updmsr)
+- wrmsrl(MSR_IA32_SPEC_CTRL, msr);
++ write_spec_ctrl_current(msr, false);
+ }
+
+ static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk)
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index e1492a67e988a..5b68ec68fc13b 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -50,6 +50,7 @@
+ #include <asm/kvm_para.h>
+ #include <asm/irq_remapping.h>
+ #include <asm/spec-ctrl.h>
++#include <asm/cpu_device_id.h>
+
+ #include <asm/virtext.h>
+ #include "trace.h"
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index c7e4dacca4cd0..9bb696d7300c0 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -41,6 +41,7 @@
+
+ #include <asm/asm.h>
+ #include <asm/cpu.h>
++#include <asm/cpu_device_id.h>
+ #include <asm/io.h>
+ #include <asm/desc.h>
+ #include <asm/vmx.h>
+@@ -2132,9 +2133,9 @@ static __always_inline void vmx_disable_fb_clear(struct vcpu_vmx *vmx)
+ if (!vmx->disable_fb_clear)
+ return;
+
+- rdmsrl(MSR_IA32_MCU_OPT_CTRL, msr);
++ msr = __rdmsr(MSR_IA32_MCU_OPT_CTRL);
+ msr |= FB_CLEAR_DIS;
+- wrmsrl(MSR_IA32_MCU_OPT_CTRL, msr);
++ native_wrmsrl(MSR_IA32_MCU_OPT_CTRL, msr);
+ /* Cache the MSR value to avoid reading it later */
+ vmx->msr_ia32_mcu_opt_ctrl = msr;
+ }
+@@ -2145,7 +2146,7 @@ static __always_inline void vmx_enable_fb_clear(struct vcpu_vmx *vmx)
+ return;
+
+ vmx->msr_ia32_mcu_opt_ctrl &= ~FB_CLEAR_DIS;
+- wrmsrl(MSR_IA32_MCU_OPT_CTRL, vmx->msr_ia32_mcu_opt_ctrl);
++ native_wrmsrl(MSR_IA32_MCU_OPT_CTRL, vmx->msr_ia32_mcu_opt_ctrl);
+ }
+
+ static void vmx_update_fb_clear_dis(struct kvm_vcpu *vcpu, struct vcpu_vmx *vmx)
+@@ -10759,10 +10760,35 @@ static void vmx_update_hv_timer(struct kvm_vcpu *vcpu)
+ vmx->loaded_vmcs->hv_timer_armed = false;
+ }
+
++u64 __always_inline vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx)
++{
++ u64 guestval, hostval = this_cpu_read(x86_spec_ctrl_current);
++
++ if (!cpu_feature_enabled(X86_FEATURE_MSR_SPEC_CTRL))
++ return 0;
++
++ guestval = __rdmsr(MSR_IA32_SPEC_CTRL);
++
++ /*
++ *
++ * For legacy IBRS, the IBRS bit always needs to be written after
++ * transitioning from a less privileged predictor mode, regardless of
++ * whether the guest/host values differ.
++ */
++ if (cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS) ||
++ guestval != hostval)
++ native_wrmsrl(MSR_IA32_SPEC_CTRL, hostval);
++
++ barrier_nospec();
++
++ return guestval;
++}
++
+ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
+ unsigned long cr3, cr4, evmcs_rsp;
++ u64 spec_ctrl;
+
+ /* Record the guest's net vcpu time for enforced NMI injections. */
+ if (unlikely(!enable_vnmi &&
+@@ -10988,9 +11014,24 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ #endif
+ );
+
+- /* Eliminate branch target predictions from guest mode */
++ /*
++ * IMPORTANT: RSB filling and SPEC_CTRL handling must be done before
++ * the first unbalanced RET after vmexit!
++ *
++ * For retpoline or IBRS, RSB filling is needed to prevent poisoned RSB
++ * entries and (in some cases) RSB underflow.
++ *
++ * eIBRS has its own protection against poisoned RSB, so it doesn't
++ * need the RSB filling sequence. But it does need to be enabled, and a
++ * single call to retire, before the first unbalanced RET.
++ *
++ * So no RETs before vmx_spec_ctrl_restore_host() below.
++ */
+ vmexit_fill_RSB();
+
++ /* Save this for below */
++ spec_ctrl = vmx_spec_ctrl_restore_host(vmx);
++
+ vmx_enable_fb_clear(vmx);
+
+ /*
+@@ -11009,9 +11050,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ * save it.
+ */
+ if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)))
+- vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL);
+-
+- x86_spec_ctrl_restore_host(vmx->spec_ctrl, 0);
++ vmx->spec_ctrl = spec_ctrl;
+
+ /* All fields are clean at this point */
+ if (static_branch_unlikely(&enable_evmcs))
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index be4697d91bb24..3c6c2253c2fb8 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -9736,9 +9736,9 @@ void kvm_arch_end_assignment(struct kvm *kvm)
+ }
+ EXPORT_SYMBOL_GPL(kvm_arch_end_assignment);
+
+-bool kvm_arch_has_assigned_device(struct kvm *kvm)
++bool noinstr kvm_arch_has_assigned_device(struct kvm *kvm)
+ {
+- return atomic_read(&kvm->arch.assigned_device_count);
++ return arch_atomic_read(&kvm->arch.assigned_device_count);
+ }
+ EXPORT_SYMBOL_GPL(kvm_arch_has_assigned_device);
+
+diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
+index cd204be1f4b7d..ce5b3ffbd6eef 100644
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -577,6 +577,12 @@ ssize_t __weak cpu_show_mmio_stale_data(struct device *dev,
+ return sysfs_emit(buf, "Not affected\n");
+ }
+
++ssize_t __weak cpu_show_retbleed(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ return sysfs_emit(buf, "Not affected\n");
++}
++
+ static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
+ static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
+ static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
+@@ -587,6 +593,7 @@ static DEVICE_ATTR(tsx_async_abort, 0444, cpu_show_tsx_async_abort, NULL);
+ static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL);
+ static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL);
+ static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL);
++static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL);
+
+ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_meltdown.attr,
+@@ -599,6 +606,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_itlb_multihit.attr,
+ &dev_attr_srbds.attr,
+ &dev_attr_mmio_stale_data.attr,
++ &dev_attr_retbleed.attr,
+ NULL
+ };
+
+diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
+index 9e86404a361f5..40c969432f459 100644
+--- a/drivers/cpufreq/acpi-cpufreq.c
++++ b/drivers/cpufreq/acpi-cpufreq.c
+@@ -47,6 +47,7 @@
+ #include <asm/msr.h>
+ #include <asm/processor.h>
+ #include <asm/cpufeature.h>
++#include <asm/cpu_device_id.h>
+
+ MODULE_AUTHOR("Paul Diefenbaugh, Dominik Brodowski");
+ MODULE_DESCRIPTION("ACPI Processor P-States Driver");
+diff --git a/drivers/cpufreq/amd_freq_sensitivity.c b/drivers/cpufreq/amd_freq_sensitivity.c
+index be926d9a66e57..4b4f128c3488f 100644
+--- a/drivers/cpufreq/amd_freq_sensitivity.c
++++ b/drivers/cpufreq/amd_freq_sensitivity.c
+@@ -21,6 +21,7 @@
+
+ #include <asm/msr.h>
+ #include <asm/cpufeature.h>
++#include <asm/cpu_device_id.h>
+
+ #include "cpufreq_ondemand.h"
+
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index c4bb67ed8da35..6360c045e3d06 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -58,11 +58,13 @@
+ #include <linux/tick.h>
+ #include <trace/events/power.h>
+ #include <linux/sched.h>
++#include <linux/sched/smt.h>
+ #include <linux/notifier.h>
+ #include <linux/cpu.h>
+ #include <linux/moduleparam.h>
+ #include <asm/cpu_device_id.h>
+ #include <asm/intel-family.h>
++#include <asm/nospec-branch.h>
+ #include <asm/mwait.h>
+ #include <asm/msr.h>
+
+@@ -109,6 +111,12 @@ static struct cpuidle_state *cpuidle_state_table;
+ */
+ #define CPUIDLE_FLAG_TLB_FLUSHED 0x10000
+
++/*
++ * Disable IBRS across idle (when KERNEL_IBRS), is exclusive vs IRQ_ENABLE
++ * above.
++ */
++#define CPUIDLE_FLAG_IBRS BIT(16)
++
+ /*
+ * MWAIT takes an 8-bit "hint" in EAX "suggesting"
+ * the C-state (top nibble) and sub-state (bottom nibble)
+@@ -119,6 +127,24 @@ static struct cpuidle_state *cpuidle_state_table;
+ #define flg2MWAIT(flags) (((flags) >> 24) & 0xFF)
+ #define MWAIT2flg(eax) ((eax & 0xFF) << 24)
+
++static __cpuidle int intel_idle_ibrs(struct cpuidle_device *dev,
++ struct cpuidle_driver *drv, int index)
++{
++ bool smt_active = sched_smt_active();
++ u64 spec_ctrl = spec_ctrl_current();
++ int ret;
++
++ if (smt_active)
++ wrmsrl(MSR_IA32_SPEC_CTRL, 0);
++
++ ret = intel_idle(dev, drv, index);
++
++ if (smt_active)
++ wrmsrl(MSR_IA32_SPEC_CTRL, spec_ctrl);
++
++ return ret;
++}
++
+ /*
+ * States are indexed by the cstate number,
+ * which is also the index into the MWAIT hint array.
+@@ -617,7 +643,7 @@ static struct cpuidle_state skl_cstates[] = {
+ {
+ .name = "C6",
+ .desc = "MWAIT 0x20",
+- .flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED,
++ .flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,
+ .exit_latency = 85,
+ .target_residency = 200,
+ .enter = &intel_idle,
+@@ -625,7 +651,7 @@ static struct cpuidle_state skl_cstates[] = {
+ {
+ .name = "C7s",
+ .desc = "MWAIT 0x33",
+- .flags = MWAIT2flg(0x33) | CPUIDLE_FLAG_TLB_FLUSHED,
++ .flags = MWAIT2flg(0x33) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,
+ .exit_latency = 124,
+ .target_residency = 800,
+ .enter = &intel_idle,
+@@ -633,7 +659,7 @@ static struct cpuidle_state skl_cstates[] = {
+ {
+ .name = "C8",
+ .desc = "MWAIT 0x40",
+- .flags = MWAIT2flg(0x40) | CPUIDLE_FLAG_TLB_FLUSHED,
++ .flags = MWAIT2flg(0x40) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,
+ .exit_latency = 200,
+ .target_residency = 800,
+ .enter = &intel_idle,
+@@ -641,7 +667,7 @@ static struct cpuidle_state skl_cstates[] = {
+ {
+ .name = "C9",
+ .desc = "MWAIT 0x50",
+- .flags = MWAIT2flg(0x50) | CPUIDLE_FLAG_TLB_FLUSHED,
++ .flags = MWAIT2flg(0x50) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,
+ .exit_latency = 480,
+ .target_residency = 5000,
+ .enter = &intel_idle,
+@@ -649,7 +675,7 @@ static struct cpuidle_state skl_cstates[] = {
+ {
+ .name = "C10",
+ .desc = "MWAIT 0x60",
+- .flags = MWAIT2flg(0x60) | CPUIDLE_FLAG_TLB_FLUSHED,
++ .flags = MWAIT2flg(0x60) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,
+ .exit_latency = 890,
+ .target_residency = 5000,
+ .enter = &intel_idle,
+@@ -678,7 +704,7 @@ static struct cpuidle_state skx_cstates[] = {
+ {
+ .name = "C6",
+ .desc = "MWAIT 0x20",
+- .flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED,
++ .flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED | CPUIDLE_FLAG_IBRS,
+ .exit_latency = 133,
+ .target_residency = 600,
+ .enter = &intel_idle,
+@@ -1384,6 +1410,11 @@ static void __init intel_idle_cpuidle_driver_init(void)
+ drv->states[drv->state_count] = /* structure copy */
+ cpuidle_state_table[cstate];
+
++ if (cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS) &&
++ cpuidle_state_table[cstate].flags & CPUIDLE_FLAG_IBRS) {
++ drv->states[drv->state_count].enter = intel_idle_ibrs;
++ }
++
+ drv->state_count += 1;
+ }
+
+diff --git a/include/linux/cpu.h b/include/linux/cpu.h
+index 8cc06e1d4fc24..12ed4cb751dee 100644
+--- a/include/linux/cpu.h
++++ b/include/linux/cpu.h
+@@ -68,6 +68,8 @@ extern ssize_t cpu_show_srbds(struct device *dev, struct device_attribute *attr,
+ extern ssize_t cpu_show_mmio_stale_data(struct device *dev,
+ struct device_attribute *attr,
+ char *buf);
++extern ssize_t cpu_show_retbleed(struct device *dev,
++ struct device_attribute *attr, char *buf);
+
+ extern __printf(4, 5)
+ struct device *cpu_device_create(struct device *parent, void *drvdata,
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 4f96aef4e8b85..f67ab4e9b6657 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -928,7 +928,7 @@ static inline void kvm_arch_end_assignment(struct kvm *kvm)
+ {
+ }
+
+-static inline bool kvm_arch_has_assigned_device(struct kvm *kvm)
++static __always_inline bool kvm_arch_has_assigned_device(struct kvm *kvm)
+ {
+ return false;
+ }
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index 610cdf8082f2e..9e3600572e9cf 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -636,9 +636,7 @@ struct x86_cpu_id {
+ __u16 steppings;
+ };
+
+-#define X86_FEATURE_MATCH(x) \
+- { X86_VENDOR_ANY, X86_FAMILY_ANY, X86_MODEL_ANY, x }
+-
++/* Wild cards for x86_cpu_id::vendor, family, model and feature */
+ #define X86_VENDOR_ANY 0xffff
+ #define X86_FAMILY_ANY 0
+ #define X86_MODEL_ANY 0
+diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
+index beab4d4e4a354..5882ff3e70948 100644
+--- a/tools/arch/x86/include/asm/cpufeatures.h
++++ b/tools/arch/x86/include/asm/cpufeatures.h
+@@ -271,6 +271,7 @@
+
+ /* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:0 (EDX), word 11 */
+ #define X86_FEATURE_CQM_LLC (11*32+ 1) /* LLC QoS if 1 */
++#define X86_FEATURE_RSB_VMEXIT_LITE (11*32+17) /* "" Fill RSB on VM-Exit when EIBRS is enabled */
+
+ /* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:1 (EDX), word 12 */
+ #define X86_FEATURE_CQM_OCCUP_LLC (12*32+ 0) /* LLC occupancy monitoring */
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-11-25 17:04 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-11-25 17:04 UTC (permalink / raw
To: gentoo-commits
commit: 496556c9473dc37a735f70cd76b62cec6545cfe3
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Nov 25 17:04:10 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Nov 25 17:04:10 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=496556c9
Linux patch 4.19.267
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1266_linux-4.19.267.patch | 2512 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2516 insertions(+)
diff --git a/0000_README b/0000_README
index 557fb8e3..47e22062 100644
--- a/0000_README
+++ b/0000_README
@@ -1107,6 +1107,10 @@ Patch: 1265_linux-4.19.266.patch
From: https://www.kernel.org
Desc: Linux 4.19.266
+Patch: 1266_linux-4.19.267.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.267
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1266_linux-4.19.267.patch b/1266_linux-4.19.267.patch
new file mode 100644
index 00000000..765d4d4e
--- /dev/null
+++ b/1266_linux-4.19.267.patch
@@ -0,0 +1,2512 @@
+diff --git a/Documentation/process/code-of-conduct-interpretation.rst b/Documentation/process/code-of-conduct-interpretation.rst
+index 4f8a06b00f608..43da2cc2e3b9b 100644
+--- a/Documentation/process/code-of-conduct-interpretation.rst
++++ b/Documentation/process/code-of-conduct-interpretation.rst
+@@ -51,7 +51,7 @@ the Technical Advisory Board (TAB) or other maintainers if you're
+ uncertain how to handle situations that come up. It will not be
+ considered a violation report unless you want it to be. If you are
+ uncertain about approaching the TAB or any other maintainers, please
+-reach out to our conflict mediator, Joanna Lee <joanna.lee@gesmer.com>.
++reach out to our conflict mediator, Joanna Lee <jlee@linuxfoundation.org>.
+
+ In the end, "be kind to each other" is really what the end goal is for
+ everybody. We know everyone is human and we all fail at times, but the
+diff --git a/Makefile b/Makefile
+index a0cfded5d0cc9..c5a4fbb0444ba 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 266
++SUBLEVEL = 267
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
+index 4f9acb5fbe970..5b425ed9cd823 100644
+--- a/arch/arm64/kernel/efi.c
++++ b/arch/arm64/kernel/efi.c
+@@ -16,6 +16,14 @@
+
+ #include <asm/efi.h>
+
++static bool region_is_misaligned(const efi_memory_desc_t *md)
++{
++ if (PAGE_SIZE == EFI_PAGE_SIZE)
++ return false;
++ return !PAGE_ALIGNED(md->phys_addr) ||
++ !PAGE_ALIGNED(md->num_pages << EFI_PAGE_SHIFT);
++}
++
+ /*
+ * Only regions of type EFI_RUNTIME_SERVICES_CODE need to be
+ * executable, everything else can be mapped with the XN bits
+@@ -29,14 +37,22 @@ static __init pteval_t create_mapping_protection(efi_memory_desc_t *md)
+ if (type == EFI_MEMORY_MAPPED_IO)
+ return PROT_DEVICE_nGnRE;
+
+- if (WARN_ONCE(!PAGE_ALIGNED(md->phys_addr),
+- "UEFI Runtime regions are not aligned to 64 KB -- buggy firmware?"))
++ if (region_is_misaligned(md)) {
++ static bool __initdata code_is_misaligned;
++
+ /*
+- * If the region is not aligned to the page size of the OS, we
+- * can not use strict permissions, since that would also affect
+- * the mapping attributes of the adjacent regions.
++ * Regions that are not aligned to the OS page size cannot be
++ * mapped with strict permissions, as those might interfere
++ * with the permissions that are needed by the adjacent
++ * region's mapping. However, if we haven't encountered any
++ * misaligned runtime code regions so far, we can safely use
++ * non-executable permissions for non-code regions.
+ */
+- return pgprot_val(PAGE_KERNEL_EXEC);
++ code_is_misaligned |= (type == EFI_RUNTIME_SERVICES_CODE);
++
++ return code_is_misaligned ? pgprot_val(PAGE_KERNEL_EXEC)
++ : pgprot_val(PAGE_KERNEL);
++ }
+
+ /* R-- */
+ if ((attr & (EFI_MEMORY_XP | EFI_MEMORY_RO)) ==
+@@ -66,19 +82,16 @@ int __init efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md)
+ bool page_mappings_only = (md->type == EFI_RUNTIME_SERVICES_CODE ||
+ md->type == EFI_RUNTIME_SERVICES_DATA);
+
+- if (!PAGE_ALIGNED(md->phys_addr) ||
+- !PAGE_ALIGNED(md->num_pages << EFI_PAGE_SHIFT)) {
+- /*
+- * If the end address of this region is not aligned to page
+- * size, the mapping is rounded up, and may end up sharing a
+- * page frame with the next UEFI memory region. If we create
+- * a block entry now, we may need to split it again when mapping
+- * the next region, and support for that is going to be removed
+- * from the MMU routines. So avoid block mappings altogether in
+- * that case.
+- */
++ /*
++ * If this region is not aligned to the page size used by the OS, the
++ * mapping will be rounded outwards, and may end up sharing a page
++ * frame with an adjacent runtime memory region. Given that the page
++ * table descriptor covering the shared page will be rewritten when the
++ * adjacent region gets mapped, we must avoid block mappings here so we
++ * don't have to worry about splitting them when that happens.
++ */
++ if (region_is_misaligned(md))
+ page_mappings_only = true;
+- }
+
+ create_pgd_mapping(mm, md->phys_addr, md->virt_addr,
+ md->num_pages << EFI_PAGE_SHIFT,
+@@ -106,6 +119,9 @@ int __init efi_set_mapping_permissions(struct mm_struct *mm,
+ BUG_ON(md->type != EFI_RUNTIME_SERVICES_CODE &&
+ md->type != EFI_RUNTIME_SERVICES_DATA);
+
++ if (region_is_misaligned(md))
++ return 0;
++
+ /*
+ * Calling apply_to_page_range() is only safe on regions that are
+ * guaranteed to be mapped down to pages. Since we are only called
+diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
+index d7c6ca7c95ae6..64180108072c5 100644
+--- a/arch/riscv/kernel/process.c
++++ b/arch/riscv/kernel/process.c
+@@ -104,6 +104,8 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
+ {
+ struct pt_regs *childregs = task_pt_regs(p);
+
++ memset(&p->thread.s, 0, sizeof(p->thread.s));
++
+ /* p->thread holds context to be restored by __switch_to() */
+ if (unlikely(p->flags & PF_KTHREAD)) {
+ /* Kernel thread */
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index dbe98e8ed1640..0bd07699dba38 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -399,6 +399,11 @@
+ #define MSR_AMD64_OSVW_STATUS 0xc0010141
+ #define MSR_AMD64_LS_CFG 0xc0011020
+ #define MSR_AMD64_DC_CFG 0xc0011022
++
++#define MSR_AMD64_DE_CFG 0xc0011029
++#define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT 1
++#define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE BIT_ULL(MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT)
++
+ #define MSR_AMD64_BU_CFG2 0xc001102a
+ #define MSR_AMD64_IBSFETCHCTL 0xc0011030
+ #define MSR_AMD64_IBSFETCHLINAD 0xc0011031
+@@ -467,9 +472,6 @@
+ #define FAM10H_MMIO_CONF_BASE_MASK 0xfffffffULL
+ #define FAM10H_MMIO_CONF_BASE_SHIFT 20
+ #define MSR_FAM10H_NODE_ID 0xc001100c
+-#define MSR_F10H_DECFG 0xc0011029
+-#define MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT 1
+-#define MSR_F10H_DECFG_LFENCE_SERIALIZE BIT_ULL(MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT)
+
+ /* K8 MSRs */
+ #define MSR_K8_TOP_MEM1 0xc001001a
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index f1f41c96d319e..e017f64e09d60 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -789,8 +789,6 @@ static void init_amd_gh(struct cpuinfo_x86 *c)
+ set_cpu_bug(c, X86_BUG_AMD_TLB_MMATCH);
+ }
+
+-#define MSR_AMD64_DE_CFG 0xC0011029
+-
+ static void init_amd_ln(struct cpuinfo_x86 *c)
+ {
+ /*
+@@ -960,16 +958,16 @@ static void init_amd(struct cpuinfo_x86 *c)
+ * msr_set_bit() uses the safe accessors, too, even if the MSR
+ * is not present.
+ */
+- msr_set_bit(MSR_F10H_DECFG,
+- MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT);
++ msr_set_bit(MSR_AMD64_DE_CFG,
++ MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT);
+
+ /*
+ * Verify that the MSR write was successful (could be running
+ * under a hypervisor) and only then assume that LFENCE is
+ * serializing.
+ */
+- ret = rdmsrl_safe(MSR_F10H_DECFG, &val);
+- if (!ret && (val & MSR_F10H_DECFG_LFENCE_SERIALIZE)) {
++ ret = rdmsrl_safe(MSR_AMD64_DE_CFG, &val);
++ if (!ret && (val & MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT)) {
+ /* A serializing LFENCE stops RDTSC speculation */
+ set_cpu_cap(c, X86_FEATURE_LFENCE_RDTSC);
+ } else {
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 5b68ec68fc13b..cd3432df0d241 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -4155,9 +4155,9 @@ static int svm_get_msr_feature(struct kvm_msr_entry *msr)
+ msr->data = 0;
+
+ switch (msr->index) {
+- case MSR_F10H_DECFG:
+- if (boot_cpu_has(X86_FEATURE_LFENCE_RDTSC))
+- msr->data |= MSR_F10H_DECFG_LFENCE_SERIALIZE;
++ case MSR_AMD64_DE_CFG:
++ if (cpu_feature_enabled(X86_FEATURE_LFENCE_RDTSC))
++ msr->data |= MSR_AMD64_DE_CFG_LFENCE_SERIALIZE;
+ break;
+ default:
+ return 1;
+@@ -4259,7 +4259,7 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ msr_info->data = 0x1E;
+ }
+ break;
+- case MSR_F10H_DECFG:
++ case MSR_AMD64_DE_CFG:
+ msr_info->data = svm->msr_decfg;
+ break;
+ default:
+@@ -4446,7 +4446,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
+ case MSR_VM_IGNNE:
+ vcpu_unimpl(vcpu, "unimplemented wrmsr: 0x%x data 0x%llx\n", ecx, data);
+ break;
+- case MSR_F10H_DECFG: {
++ case MSR_AMD64_DE_CFG: {
+ struct kvm_msr_entry msr_entry;
+
+ msr_entry.index = msr->index;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 3c6c2253c2fb8..8fe615df8e5b6 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1156,7 +1156,7 @@ static u32 msr_based_features[] = {
+ MSR_IA32_VMX_EPT_VPID_CAP,
+ MSR_IA32_VMX_VMFUNC,
+
+- MSR_F10H_DECFG,
++ MSR_AMD64_DE_CFG,
+ MSR_IA32_UCODE_REV,
+ MSR_IA32_ARCH_CAPABILITIES,
+ };
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index 7948249482637..dea9d6246e008 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -533,6 +533,7 @@ static void pm_save_spec_msr(void)
+ MSR_TSX_FORCE_ABORT,
+ MSR_IA32_MCU_OPT_CTRL,
+ MSR_AMD64_LS_CFG,
++ MSR_AMD64_DE_CFG,
+ };
+
+ msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id));
+diff --git a/block/sed-opal.c b/block/sed-opal.c
+index 1196408972937..9651c40e093a5 100644
+--- a/block/sed-opal.c
++++ b/block/sed-opal.c
+@@ -94,8 +94,8 @@ struct opal_dev {
+ u64 lowest_lba;
+
+ size_t pos;
+- u8 cmd[IO_BUFFER_LENGTH];
+- u8 resp[IO_BUFFER_LENGTH];
++ u8 *cmd;
++ u8 *resp;
+
+ struct parsed_resp parsed;
+ size_t prev_d_len;
+@@ -2028,6 +2028,8 @@ void free_opal_dev(struct opal_dev *dev)
+ if (!dev)
+ return;
+ clean_opal_dev(dev);
++ kfree(dev->resp);
++ kfree(dev->cmd);
+ kfree(dev);
+ }
+ EXPORT_SYMBOL(free_opal_dev);
+@@ -2040,16 +2042,38 @@ struct opal_dev *init_opal_dev(void *data, sec_send_recv *send_recv)
+ if (!dev)
+ return NULL;
+
++ /*
++ * Presumably DMA-able buffers must be cache-aligned. Kmalloc makes
++ * sure the allocated buffer is DMA-safe in that regard.
++ */
++ dev->cmd = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL);
++ if (!dev->cmd)
++ goto err_free_dev;
++
++ dev->resp = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL);
++ if (!dev->resp)
++ goto err_free_cmd;
++
+ INIT_LIST_HEAD(&dev->unlk_lst);
+ mutex_init(&dev->dev_lock);
+ dev->data = data;
+ dev->send_recv = send_recv;
+ if (check_opal_support(dev) != 0) {
+ pr_debug("Opal is not supported on this device\n");
+- kfree(dev);
+- return NULL;
++ goto err_free_resp;
+ }
+ return dev;
++
++err_free_resp:
++ kfree(dev->resp);
++
++err_free_cmd:
++ kfree(dev->cmd);
++
++err_free_dev:
++ kfree(dev);
++
++ return NULL;
+ }
+ EXPORT_SYMBOL(init_opal_dev);
+
+diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
+index 43a91495ee678..f04f4f977400d 100644
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -317,7 +317,6 @@ int ata_tport_add(struct device *parent,
+ tport_err:
+ transport_destroy_device(dev);
+ put_device(dev);
+- ata_host_put(ap->host);
+ return error;
+ }
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index c3e4f9d83b29a..3ae718aa6b39f 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -2770,7 +2770,7 @@ static int init_submitter(struct drbd_device *device)
+ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsigned int minor)
+ {
+ struct drbd_resource *resource = adm_ctx->resource;
+- struct drbd_connection *connection;
++ struct drbd_connection *connection, *n;
+ struct drbd_device *device;
+ struct drbd_peer_device *peer_device, *tmp_peer_device;
+ struct gendisk *disk;
+@@ -2898,7 +2898,7 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig
+ out_idr_remove_vol:
+ idr_remove(&connection->peer_devices, vnr);
+ out_idr_remove_from_resource:
+- for_each_connection(connection, resource) {
++ for_each_connection_safe(connection, n, resource) {
+ peer_device = idr_remove(&connection->peer_devices, vnr);
+ if (peer_device)
+ kref_put(&connection->kref, drbd_destroy_connection);
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index c52718b37f8fd..adcae1077fd3b 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -252,6 +252,8 @@ static void atc_dostart(struct at_dma_chan *atchan, struct at_desc *first)
+ ATC_SPIP_BOUNDARY(first->boundary));
+ channel_writel(atchan, DPIP, ATC_DPIP_HOLE(first->dst_hole) |
+ ATC_DPIP_BOUNDARY(first->boundary));
++ /* Don't allow CPU to reorder channel enable. */
++ wmb();
+ dma_writel(atdma, CHER, atchan->mask);
+
+ vdbg_dump_regs(atchan);
+@@ -312,7 +314,8 @@ static int atc_get_bytes_left(struct dma_chan *chan, dma_cookie_t cookie)
+ struct at_desc *desc_first = atc_first_active(atchan);
+ struct at_desc *desc;
+ int ret;
+- u32 ctrla, dscr, trials;
++ u32 ctrla, dscr;
++ unsigned int i;
+
+ /*
+ * If the cookie doesn't match to the currently running transfer then
+@@ -382,7 +385,7 @@ static int atc_get_bytes_left(struct dma_chan *chan, dma_cookie_t cookie)
+ dscr = channel_readl(atchan, DSCR);
+ rmb(); /* ensure DSCR is read before CTRLA */
+ ctrla = channel_readl(atchan, CTRLA);
+- for (trials = 0; trials < ATC_MAX_DSCR_TRIALS; ++trials) {
++ for (i = 0; i < ATC_MAX_DSCR_TRIALS; ++i) {
+ u32 new_dscr;
+
+ rmb(); /* ensure DSCR is read after CTRLA */
+@@ -408,7 +411,7 @@ static int atc_get_bytes_left(struct dma_chan *chan, dma_cookie_t cookie)
+ rmb(); /* ensure DSCR is read before CTRLA */
+ ctrla = channel_readl(atchan, CTRLA);
+ }
+- if (unlikely(trials >= ATC_MAX_DSCR_TRIALS))
++ if (unlikely(i == ATC_MAX_DSCR_TRIALS))
+ return -ETIMEDOUT;
+
+ /* for the first descriptor we can be more accurate */
+@@ -556,10 +559,6 @@ static void atc_handle_error(struct at_dma_chan *atchan)
+ bad_desc = atc_first_active(atchan);
+ list_del_init(&bad_desc->desc_node);
+
+- /* As we are stopped, take advantage to push queued descriptors
+- * in active_list */
+- list_splice_init(&atchan->queue, atchan->active_list.prev);
+-
+ /* Try to restart the controller */
+ if (!list_empty(&atchan->active_list))
+ atc_dostart(atchan, atc_first_active(atchan));
+@@ -680,19 +679,11 @@ static dma_cookie_t atc_tx_submit(struct dma_async_tx_descriptor *tx)
+ spin_lock_irqsave(&atchan->lock, flags);
+ cookie = dma_cookie_assign(tx);
+
+- if (list_empty(&atchan->active_list)) {
+- dev_vdbg(chan2dev(tx->chan), "tx_submit: started %u\n",
+- desc->txd.cookie);
+- atc_dostart(atchan, desc);
+- list_add_tail(&desc->desc_node, &atchan->active_list);
+- } else {
+- dev_vdbg(chan2dev(tx->chan), "tx_submit: queued %u\n",
+- desc->txd.cookie);
+- list_add_tail(&desc->desc_node, &atchan->queue);
+- }
+-
++ list_add_tail(&desc->desc_node, &atchan->queue);
+ spin_unlock_irqrestore(&atchan->lock, flags);
+
++ dev_vdbg(chan2dev(tx->chan), "tx_submit: queued %u\n",
++ desc->txd.cookie);
+ return cookie;
+ }
+
+@@ -1967,7 +1958,11 @@ static int __init at_dma_probe(struct platform_device *pdev)
+ dma_has_cap(DMA_SLAVE, atdma->dma_common.cap_mask) ? "slave " : "",
+ plat_dat->nr_channels);
+
+- dma_async_device_register(&atdma->dma_common);
++ err = dma_async_device_register(&atdma->dma_common);
++ if (err) {
++ dev_err(&pdev->dev, "Unable to register: %d.\n", err);
++ goto err_dma_async_device_register;
++ }
+
+ /*
+ * Do not return an error if the dmac node is not present in order to
+@@ -1987,6 +1982,7 @@ static int __init at_dma_probe(struct platform_device *pdev)
+
+ err_of_dma_controller_register:
+ dma_async_device_unregister(&atdma->dma_common);
++err_dma_async_device_register:
+ dma_pool_destroy(atdma->memset_pool);
+ err_memset_pool_create:
+ dma_pool_destroy(atdma->dma_desc_pool);
+diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
+index ef3f227ce3e6c..00517cbd3a311 100644
+--- a/drivers/dma/at_hdmac_regs.h
++++ b/drivers/dma/at_hdmac_regs.h
+@@ -168,13 +168,13 @@
+ /* LLI == Linked List Item; aka DMA buffer descriptor */
+ struct at_lli {
+ /* values that are not changed by hardware */
+- dma_addr_t saddr;
+- dma_addr_t daddr;
++ u32 saddr;
++ u32 daddr;
+ /* value that may get written back: */
+- u32 ctrla;
++ u32 ctrla;
+ /* more values that are not changed by hardware */
+- u32 ctrlb;
+- dma_addr_t dscr; /* chain to next lli */
++ u32 ctrlb;
++ u32 dscr; /* chain to next lli */
+ };
+
+ /**
+diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
+index 462adf7e4e952..62864b3e120f9 100644
+--- a/drivers/dma/mv_xor_v2.c
++++ b/drivers/dma/mv_xor_v2.c
+@@ -906,6 +906,7 @@ static int mv_xor_v2_remove(struct platform_device *pdev)
+ tasklet_kill(&xor_dev->irq_tasklet);
+
+ clk_disable_unprepare(xor_dev->clk);
++ clk_disable_unprepare(xor_dev->reg_clk);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
+index 82e2ca17a441e..15f21f60fc8a4 100644
+--- a/drivers/gpu/drm/i915/i915_gem_dmabuf.c
++++ b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
+@@ -55,13 +55,13 @@ static struct sg_table *i915_gem_map_dma_buf(struct dma_buf_attachment *attachme
+ goto err_unpin_pages;
+ }
+
+- ret = sg_alloc_table(st, obj->mm.pages->nents, GFP_KERNEL);
++ ret = sg_alloc_table(st, obj->mm.pages->orig_nents, GFP_KERNEL);
+ if (ret)
+ goto err_free;
+
+ src = obj->mm.pages->sgl;
+ dst = st->sgl;
+- for (i = 0; i < obj->mm.pages->nents; i++) {
++ for (i = 0; i < obj->mm.pages->orig_nents; i++) {
+ sg_set_page(dst, sg_page(src), src->length, 0);
+ dst = sg_next(dst);
+ src = sg_next(src);
+diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c
+index c19c1dfbfcdc4..de3996fe90be7 100644
+--- a/drivers/gpu/drm/imx/imx-tve.c
++++ b/drivers/gpu/drm/imx/imx-tve.c
+@@ -243,8 +243,9 @@ static int imx_tve_connector_get_modes(struct drm_connector *connector)
+ return ret;
+ }
+
+-static int imx_tve_connector_mode_valid(struct drm_connector *connector,
+- struct drm_display_mode *mode)
++static enum drm_mode_status
++imx_tve_connector_mode_valid(struct drm_connector *connector,
++ struct drm_display_mode *mode)
+ {
+ struct imx_tve *tve = con_to_tve(connector);
+ unsigned long rate;
+diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
+index 868dd1ef3b693..f210560a48310 100644
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -394,7 +394,12 @@ static int __init vc4_drm_register(void)
+ if (ret)
+ return ret;
+
+- return platform_driver_register(&vc4_platform_driver);
++ ret = platform_driver_register(&vc4_platform_driver);
++ if (ret)
++ platform_unregister_drivers(component_drivers,
++ ARRAY_SIZE(component_drivers));
++
++ return ret;
+ }
+
+ static void __exit vc4_drm_unregister(void)
+diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c
+index 4d1496f60071f..8f2bf70218bf6 100644
+--- a/drivers/hid/hid-hyperv.c
++++ b/drivers/hid/hid-hyperv.c
+@@ -500,7 +500,7 @@ static int mousevsc_probe(struct hv_device *device,
+
+ ret = hid_add_device(hid_dev);
+ if (ret)
+- goto probe_err1;
++ goto probe_err2;
+
+
+ ret = hid_parse(hid_dev);
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index 596841a3c4db7..93f4bb7ace346 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -617,8 +617,10 @@ static struct iio_trigger *at91_adc_allocate_trigger(struct iio_dev *idev,
+ trig->ops = &at91_adc_trigger_ops;
+
+ ret = iio_trigger_register(trig);
+- if (ret)
++ if (ret) {
++ iio_trigger_free(trig);
+ return NULL;
++ }
+
+ return trig;
+ }
+diff --git a/drivers/iio/pressure/ms5611_spi.c b/drivers/iio/pressure/ms5611_spi.c
+index 932e05001e1a9..a582515ae2e6b 100644
+--- a/drivers/iio/pressure/ms5611_spi.c
++++ b/drivers/iio/pressure/ms5611_spi.c
+@@ -95,7 +95,7 @@ static int ms5611_spi_probe(struct spi_device *spi)
+ spi_set_drvdata(spi, indio_dev);
+
+ spi->mode = SPI_MODE_0;
+- spi->max_speed_hz = 20000000;
++ spi->max_speed_hz = min(spi->max_speed_hz, 20000000U);
+ spi->bits_per_word = 8;
+ ret = spi_setup(spi);
+ if (ret < 0)
+diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c
+index cccc07e637a4f..9daba4b16a588 100644
+--- a/drivers/iio/trigger/iio-trig-sysfs.c
++++ b/drivers/iio/trigger/iio-trig-sysfs.c
+@@ -211,9 +211,13 @@ static int iio_sysfs_trigger_remove(int id)
+
+ static int __init iio_sysfs_trig_init(void)
+ {
++ int ret;
+ device_initialize(&iio_sysfs_trig_dev);
+ dev_set_name(&iio_sysfs_trig_dev, "iio_sysfs_trigger");
+- return device_add(&iio_sysfs_trig_dev);
++ ret = device_add(&iio_sysfs_trig_dev);
++ if (ret)
++ put_device(&iio_sysfs_trig_dev);
++ return ret;
+ }
+ module_init(iio_sysfs_trig_init);
+
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 082afbf088d67..c9b51511b33d6 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -1544,8 +1544,6 @@ static int i8042_probe(struct platform_device *dev)
+ {
+ int error;
+
+- i8042_platform_device = dev;
+-
+ if (i8042_reset == I8042_RESET_ALWAYS) {
+ error = i8042_controller_selftest();
+ if (error)
+@@ -1583,7 +1581,6 @@ static int i8042_probe(struct platform_device *dev)
+ i8042_free_aux_ports(); /* in case KBD failed but AUX not */
+ i8042_free_irqs();
+ i8042_controller_reset(false);
+- i8042_platform_device = NULL;
+
+ return error;
+ }
+@@ -1593,7 +1590,6 @@ static int i8042_remove(struct platform_device *dev)
+ i8042_unregister_ports();
+ i8042_free_irqs();
+ i8042_controller_reset(false);
+- i8042_platform_device = NULL;
+
+ return 0;
+ }
+diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c
+index 5cd53b2c47c75..e542439f49506 100644
+--- a/drivers/isdn/mISDN/core.c
++++ b/drivers/isdn/mISDN/core.c
+@@ -231,7 +231,7 @@ mISDN_register_device(struct mISDNdevice *dev,
+
+ err = get_free_devid();
+ if (err < 0)
+- goto error1;
++ return err;
+ dev->id = err;
+
+ device_initialize(&dev->dev);
+diff --git a/drivers/isdn/mISDN/dsp_pipeline.c b/drivers/isdn/mISDN/dsp_pipeline.c
+index e72b4e73cd615..796cae691560d 100644
+--- a/drivers/isdn/mISDN/dsp_pipeline.c
++++ b/drivers/isdn/mISDN/dsp_pipeline.c
+@@ -97,6 +97,7 @@ int mISDN_dsp_element_register(struct mISDN_dsp_element *elem)
+ if (!entry)
+ return -ENOMEM;
+
++ INIT_LIST_HEAD(&entry->list);
+ entry->elem = elem;
+
+ entry->dev.class = elements_class;
+@@ -131,7 +132,7 @@ err2:
+ device_unregister(&entry->dev);
+ return ret;
+ err1:
+- kfree(entry);
++ put_device(&entry->dev);
+ return ret;
+ }
+ EXPORT_SYMBOL(mISDN_dsp_element_register);
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index 0aae4a46db662..0c8ddf37ef39d 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -573,7 +573,7 @@ static void list_version_get_needed(struct target_type *tt, void *needed_param)
+ size_t *needed = needed_param;
+
+ *needed += sizeof(struct dm_target_versions);
+- *needed += strlen(tt->name);
++ *needed += strlen(tt->name) + 1;
+ *needed += ALIGN_MASK;
+ }
+
+@@ -628,7 +628,7 @@ static int list_versions(struct file *filp, struct dm_ioctl *param, size_t param
+ iter_info.old_vers = NULL;
+ iter_info.vers = vers;
+ iter_info.flags = 0;
+- iter_info.end = (char *)vers+len;
++ iter_info.end = (char *)vers + needed;
+
+ /*
+ * Now loop through filling out the names & versions.
+diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+index db433d285effa..e353ad27ad302 100644
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -865,6 +865,7 @@ static int qp_notify_peer_local(bool attach, struct vmci_handle handle)
+ u32 context_id = vmci_get_context_id();
+ struct vmci_event_qp ev;
+
++ memset(&ev, 0, sizeof(ev));
+ ev.msg.hdr.dst = vmci_make_handle(context_id, VMCI_EVENT_HANDLER);
+ ev.msg.hdr.src = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID,
+ VMCI_CONTEXT_RESOURCE_ID);
+@@ -1476,6 +1477,7 @@ static int qp_notify_peer(bool attach,
+ * kernel.
+ */
+
++ memset(&ev, 0, sizeof(ev));
+ ev.msg.hdr.dst = vmci_make_handle(peer_id, VMCI_EVENT_HANDLER);
+ ev.msg.hdr.src = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID,
+ VMCI_CONTEXT_RESOURCE_ID);
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index e340791a8eab3..6937f39fe6575 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1461,7 +1461,13 @@ u32 mmc_select_voltage(struct mmc_host *host, u32 ocr)
+ mmc_power_cycle(host, ocr);
+ } else {
+ bit = fls(ocr) - 1;
+- ocr &= 3 << bit;
++ /*
++ * The bit variable represents the highest voltage bit set in
++ * the OCR register.
++ * To keep a range of 2 values (e.g. 3.2V/3.3V and 3.3V/3.4V),
++ * we must shift the mask '3' with (bit - 1).
++ */
++ ocr &= 3 << (bit - 1);
+ if (bit != host->ios.vdd)
+ dev_warn(mmc_dev(host), "exceeding card's volts\n");
+ }
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index cb4a0458f098c..fecab3633a136 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -1532,6 +1532,8 @@ static int amd_probe(struct sdhci_pci_chip *chip)
+ }
+ }
+
++ pci_dev_put(smbus_dev);
++
+ if (gen == AMD_CHIPSET_BEFORE_ML || gen == AMD_CHIPSET_CZ)
+ chip->quirks2 |= SDHCI_QUIRK2_CLEAR_TRANSFERMODE_REG_BEFORE_CMD;
+
+diff --git a/drivers/mtd/spi-nor/intel-spi.c b/drivers/mtd/spi-nor/intel-spi.c
+index d60cbf23d9aa0..642a6f9071f2a 100644
+--- a/drivers/mtd/spi-nor/intel-spi.c
++++ b/drivers/mtd/spi-nor/intel-spi.c
+@@ -116,7 +116,7 @@
+ #define ERASE_OPCODE_SHIFT 8
+ #define ERASE_OPCODE_MASK (0xff << ERASE_OPCODE_SHIFT)
+ #define ERASE_64K_OPCODE_SHIFT 16
+-#define ERASE_64K_OPCODE_MASK (0xff << ERASE_OPCODE_SHIFT)
++#define ERASE_64K_OPCODE_MASK (0xff << ERASE_64K_OPCODE_SHIFT)
+
+ #define INTEL_SPI_TIMEOUT 5000 /* ms */
+ #define INTEL_SPI_FIFO_SZ 64
+diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+index 86811de191edb..f27391abd7da5 100644
+--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+@@ -1015,8 +1015,10 @@ static int xgene_enet_open(struct net_device *ndev)
+
+ xgene_enet_napi_enable(pdata);
+ ret = xgene_enet_register_irq(ndev);
+- if (ret)
++ if (ret) {
++ xgene_enet_napi_disable(pdata);
+ return ret;
++ }
+
+ if (ndev->phydev) {
+ phy_start(ndev->phydev);
+diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
+index 4c94d9218bba9..50c5afc46eb00 100644
+--- a/drivers/net/ethernet/broadcom/bgmac.c
++++ b/drivers/net/ethernet/broadcom/bgmac.c
+@@ -1566,7 +1566,6 @@ void bgmac_enet_remove(struct bgmac *bgmac)
+ phy_disconnect(bgmac->net_dev->phydev);
+ netif_napi_del(&bgmac->napi);
+ bgmac_dma_free(bgmac);
+- free_netdev(bgmac->net_dev);
+ }
+ EXPORT_SYMBOL_GPL(bgmac_enet_remove);
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 5e30299bcf646..dc106212259a5 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8327,8 +8327,8 @@ static int bnxt_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
+ rcu_read_lock();
+ hlist_for_each_entry_rcu(fltr, head, hash) {
+ if (bnxt_fltr_match(fltr, new_fltr)) {
++ rc = fltr->sw_id;
+ rcu_read_unlock();
+- rc = 0;
+ goto err_free;
+ }
+ }
+@@ -9383,8 +9383,16 @@ static struct pci_driver bnxt_pci_driver = {
+
+ static int __init bnxt_init(void)
+ {
++ int err;
++
+ bnxt_debug_init();
+- return pci_register_driver(&bnxt_pci_driver);
++ err = pci_register_driver(&bnxt_pci_driver);
++ if (err) {
++ bnxt_debug_exit();
++ return err;
++ }
++
++ return 0;
+ }
+
+ static void __exit bnxt_exit(void)
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+index c82469ab7aba1..2c72e716b973f 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+@@ -1304,6 +1304,7 @@ static int cxgb_up(struct adapter *adap)
+ if (ret < 0) {
+ CH_ERR(adap, "failed to bind qsets, err %d\n", ret);
+ t3_intr_disable(adap);
++ quiesce_rx(adap);
+ free_irq_resources(adap);
+ err = ret;
+ goto out;
+diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
+index 713abcd9371fa..390849faf4cde 100644
+--- a/drivers/net/ethernet/freescale/fman/mac.c
++++ b/drivers/net/ethernet/freescale/fman/mac.c
+@@ -891,12 +891,21 @@ _return:
+ return err;
+ }
+
++static int mac_remove(struct platform_device *pdev)
++{
++ struct mac_device *mac_dev = platform_get_drvdata(pdev);
++
++ platform_device_unregister(mac_dev->priv->eth_dev);
++ return 0;
++}
++
+ static struct platform_driver mac_driver = {
+ .driver = {
+ .name = KBUILD_MODNAME,
+ .of_match_table = mac_match,
+ },
+ .probe = mac_probe,
++ .remove = mac_remove,
+ };
+
+ builtin_platform_driver(mac_driver);
+diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
+index 59007d6cd36d9..2bfad889fdec3 100644
+--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
++++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
+@@ -2495,6 +2495,7 @@ out_free:
+ for (i = 0; i < mp->rxq_count; i++)
+ rxq_deinit(mp->rxq + i);
+ out:
++ napi_disable(&mp->napi);
+ free_irq(dev->irq, dev);
+
+ return err;
+diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c
+index 85a54215616c5..0a8483c615d4f 100644
+--- a/drivers/net/ethernet/neterion/s2io.c
++++ b/drivers/net/ethernet/neterion/s2io.c
+@@ -7126,9 +7126,8 @@ static int s2io_card_up(struct s2io_nic *sp)
+ if (ret) {
+ DBG_PRINT(ERR_DBG, "%s: Out of memory in Open\n",
+ dev->name);
+- s2io_reset(sp);
+- free_rx_buffers(sp);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto err_fill_buff;
+ }
+ DBG_PRINT(INFO_DBG, "Buf in ring:%d is %d:\n", i,
+ ring->rx_bufs_left);
+@@ -7166,18 +7165,16 @@ static int s2io_card_up(struct s2io_nic *sp)
+ /* Enable Rx Traffic and interrupts on the NIC */
+ if (start_nic(sp)) {
+ DBG_PRINT(ERR_DBG, "%s: Starting NIC failed\n", dev->name);
+- s2io_reset(sp);
+- free_rx_buffers(sp);
+- return -ENODEV;
++ ret = -ENODEV;
++ goto err_out;
+ }
+
+ /* Add interrupt service routine */
+ if (s2io_add_isr(sp) != 0) {
+ if (sp->config.intr_type == MSI_X)
+ s2io_rem_isr(sp);
+- s2io_reset(sp);
+- free_rx_buffers(sp);
+- return -ENODEV;
++ ret = -ENODEV;
++ goto err_out;
+ }
+
+ timer_setup(&sp->alarm_timer, s2io_alarm_handle, 0);
+@@ -7197,6 +7194,20 @@ static int s2io_card_up(struct s2io_nic *sp)
+ }
+
+ return 0;
++
++err_out:
++ if (config->napi) {
++ if (config->intr_type == MSI_X) {
++ for (i = 0; i < sp->config.rx_ring_num; i++)
++ napi_disable(&sp->mac_control.rings[i].napi);
++ } else {
++ napi_disable(&sp->napi);
++ }
++ }
++err_fill_buff:
++ s2io_reset(sp);
++ free_rx_buffers(sp);
++ return ret;
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
+index a791d7932b0ef..abbb25f1384c3 100644
+--- a/drivers/net/ethernet/ni/nixge.c
++++ b/drivers/net/ethernet/ni/nixge.c
+@@ -833,6 +833,7 @@ static int nixge_open(struct net_device *ndev)
+ err_rx_irq:
+ free_irq(priv->tx_irq, ndev);
+ err_tx_irq:
++ napi_disable(&priv->napi);
+ phy_stop(phy);
+ phy_disconnect(phy);
+ tasklet_kill(&priv->dma_err_tasklet);
+diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
+index 777fa59f5e0cd..1eeddfea389c8 100644
+--- a/drivers/net/hamradio/bpqether.c
++++ b/drivers/net/hamradio/bpqether.c
+@@ -537,7 +537,7 @@ static int bpq_device_event(struct notifier_block *this,
+ if (!net_eq(dev_net(dev), &init_net))
+ return NOTIFY_DONE;
+
+- if (!dev_is_ethdev(dev))
++ if (!dev_is_ethdev(dev) && !bpq_get_ax25_dev(dev))
+ return NOTIFY_DONE;
+
+ switch (event) {
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index e226a96da3a39..e1f95fd08d721 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -1137,7 +1137,7 @@ void macvlan_common_setup(struct net_device *dev)
+ {
+ ether_setup(dev);
+
+- dev->min_mtu = 0;
++ /* ether_setup() has set dev->min_mtu to ETH_MIN_MTU. */
+ dev->max_mtu = ETH_MAX_MTU;
+ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ netif_keep_dst(dev);
+@@ -1471,8 +1471,10 @@ destroy_macvlan_port:
+ /* the macvlan port may be freed by macvlan_uninit when fail to register.
+ * so we destroy the macvlan port only when it's valid.
+ */
+- if (create && macvlan_port_get_rtnl(lowerdev))
++ if (create && macvlan_port_get_rtnl(lowerdev)) {
++ macvlan_flush_sources(port, vlan);
+ macvlan_port_destroy(port->dev);
++ }
+ return err;
+ }
+ EXPORT_SYMBOL_GPL(macvlan_common_newlink);
+diff --git a/drivers/net/thunderbolt.c b/drivers/net/thunderbolt.c
+index 4b5af24139703..51b5442fbc668 100644
+--- a/drivers/net/thunderbolt.c
++++ b/drivers/net/thunderbolt.c
+@@ -1342,12 +1342,21 @@ static int __init tbnet_init(void)
+ TBNET_MATCH_FRAGS_ID);
+
+ ret = tb_register_property_dir("network", tbnet_dir);
+- if (ret) {
+- tb_property_free_dir(tbnet_dir);
+- return ret;
+- }
++ if (ret)
++ goto err_free_dir;
++
++ ret = tb_register_service_driver(&tbnet_driver);
++ if (ret)
++ goto err_unregister;
+
+- return tb_register_service_driver(&tbnet_driver);
++ return 0;
++
++err_unregister:
++ tb_unregister_property_dir("network", tbnet_dir);
++err_free_dir:
++ tb_property_free_dir(tbnet_dir);
++
++ return ret;
+ }
+ module_init(tbnet_init);
+
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 8d1b34640f79b..8df651999b2bf 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1962,17 +1962,25 @@ drop:
+ headlen = eth_get_headlen(skb->data, skb_headlen(skb));
+
+ if (unlikely(headlen > skb_headlen(skb))) {
++ WARN_ON_ONCE(1);
++ err = -ENOMEM;
+ this_cpu_inc(tun->pcpu_stats->rx_dropped);
++napi_busy:
+ napi_free_frags(&tfile->napi);
+ rcu_read_unlock();
+ mutex_unlock(&tfile->napi_mutex);
+- WARN_ON(1);
+- return -ENOMEM;
++ return err;
+ }
+
+- local_bh_disable();
+- napi_gro_frags(&tfile->napi);
+- local_bh_enable();
++ if (likely(napi_schedule_prep(&tfile->napi))) {
++ local_bh_disable();
++ napi_gro_frags(&tfile->napi);
++ napi_complete(&tfile->napi);
++ local_bh_enable();
++ } else {
++ err = -EBUSY;
++ goto napi_busy;
++ }
+ mutex_unlock(&tfile->napi_mutex);
+ } else if (tfile->napi_enabled) {
+ struct sk_buff_head *queue = &tfile->sk.sk_write_queue;
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 3ec922bed2d84..6233805fc032c 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -406,7 +406,7 @@ static int lapbeth_device_event(struct notifier_block *this,
+ if (dev_net(dev) != &init_net)
+ return NOTIFY_DONE;
+
+- if (!dev_is_ethdev(dev))
++ if (!dev_is_ethdev(dev) && !lapbeth_get_x25_dev(dev))
+ return NOTIFY_DONE;
+
+ switch (event) {
+diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
+index dee5b9e35ffd6..d99ac73a1d89e 100644
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -474,7 +474,7 @@ static size_t parport_pc_fifo_write_block_pio(struct parport *port,
+ const unsigned char *bufp = buf;
+ size_t left = length;
+ unsigned long expire = jiffies + port->physport->cad->timeout;
+- const int fifo = FIFO(port);
++ const unsigned long fifo = FIFO(port);
+ int poll_for = 8; /* 80 usecs */
+ const struct parport_pc_private *priv = port->physport->private_data;
+ const int fifo_depth = priv->fifo_depth;
+diff --git a/drivers/phy/st/phy-stm32-usbphyc.c b/drivers/phy/st/phy-stm32-usbphyc.c
+index 1255cd1d9a60c..5056662d29272 100644
+--- a/drivers/phy/st/phy-stm32-usbphyc.c
++++ b/drivers/phy/st/phy-stm32-usbphyc.c
+@@ -393,6 +393,8 @@ static int stm32_usbphyc_probe(struct platform_device *pdev)
+ ret = of_property_read_u32(child, "reg", &index);
+ if (ret || index > usbphyc->nphys) {
+ dev_err(&phy->dev, "invalid reg property: %d\n", ret);
++ if (!ret)
++ ret = -EINVAL;
+ goto put_child;
+ }
+
+diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
+index 177ee1136e349..6f5acfcba57ce 100644
+--- a/drivers/pinctrl/devicetree.c
++++ b/drivers/pinctrl/devicetree.c
+@@ -235,6 +235,8 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev)
+ for (state = 0; ; state++) {
+ /* Retrieve the pinctrl-* property */
+ propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state);
++ if (!propname)
++ return -ENOMEM;
+ prop = of_find_property(np, propname, &size);
+ kfree(propname);
+ if (!prop) {
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index f911410bb4c7a..ba1a3e2fcebe4 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -894,8 +894,16 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
+ wwan_rfkill = NULL;
+ rfkill2_count = 0;
+
+- if (hp_wmi_rfkill_setup(device))
+- hp_wmi_rfkill2_setup(device);
++ /*
++ * In pre-2009 BIOS, command 1Bh return 0x4 to indicate that
++ * BIOS no longer controls the power for the wireless
++ * devices. All features supported by this command will no
++ * longer be supported.
++ */
++ if (!hp_wmi_bios_2009_later()) {
++ if (hp_wmi_rfkill_setup(device))
++ hp_wmi_rfkill2_setup(device);
++ }
+
+ err = device_create_file(&device->dev, &dev_attr_display);
+ if (err)
+diff --git a/drivers/siox/siox-core.c b/drivers/siox/siox-core.c
+index f8c08fb9891d7..e0ffef6e93865 100644
+--- a/drivers/siox/siox-core.c
++++ b/drivers/siox/siox-core.c
+@@ -835,6 +835,8 @@ static struct siox_device *siox_device_add(struct siox_master *smaster,
+
+ err_device_register:
+ /* don't care to make the buffer smaller again */
++ put_device(&sdevice->dev);
++ sdevice = NULL;
+
+ err_buf_alloc:
+ siox_master_unlock(smaster);
+diff --git a/drivers/slimbus/stream.c b/drivers/slimbus/stream.c
+index 2fa05324ed074..2a376afed35c5 100644
+--- a/drivers/slimbus/stream.c
++++ b/drivers/slimbus/stream.c
+@@ -67,10 +67,10 @@ static const int slim_presence_rate_table[] = {
+ 384000,
+ 768000,
+ 0, /* Reserved */
+- 110250,
+- 220500,
+- 441000,
+- 882000,
++ 11025,
++ 22050,
++ 44100,
++ 88200,
+ 176400,
+ 352800,
+ 705600,
+diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
+index d4a74f7ddf6b1..5e4e2f423e42f 100644
+--- a/drivers/staging/speakup/main.c
++++ b/drivers/staging/speakup/main.c
+@@ -1778,7 +1778,7 @@ static void speakup_con_update(struct vc_data *vc)
+ {
+ unsigned long flags;
+
+- if (!speakup_console[vc->vc_num] || spk_parked)
++ if (!speakup_console[vc->vc_num] || spk_parked || !synth)
+ return;
+ if (!spin_trylock_irqsave(&speakup_info.spinlock, flags))
+ /* Speakup output, discard */
+diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
+index bc8918f382e4c..80b74db4048b9 100644
+--- a/drivers/target/loopback/tcm_loop.c
++++ b/drivers/target/loopback/tcm_loop.c
+@@ -409,6 +409,7 @@ static int tcm_loop_setup_hba_bus(struct tcm_loop_hba *tl_hba, int tcm_loop_host
+ ret = device_register(&tl_hba->dev);
+ if (ret) {
+ pr_err("device_register() failed for tl_hba->dev: %d\n", ret);
++ put_device(&tl_hba->dev);
+ return -ENODEV;
+ }
+
+@@ -1103,7 +1104,7 @@ check_len:
+ */
+ ret = tcm_loop_setup_hba_bus(tl_hba, tcm_loop_hba_no_cnt);
+ if (ret)
+- goto out;
++ return ERR_PTR(ret);
+
+ sh = tl_hba->sh;
+ tcm_loop_hba_no_cnt++;
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index f6d2be13b32ee..4a890011eba34 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -1413,7 +1413,7 @@ static struct gsm_control *gsm_control_send(struct gsm_mux *gsm,
+ unsigned int command, u8 *data, int clen)
+ {
+ struct gsm_control *ctrl = kzalloc(sizeof(struct gsm_control),
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ unsigned long flags;
+ if (ctrl == NULL)
+ return NULL;
+diff --git a/drivers/tty/serial/8250/8250_lpss.c b/drivers/tty/serial/8250/8250_lpss.c
+index 98dbc796353fb..448388ec03e23 100644
+--- a/drivers/tty/serial/8250/8250_lpss.c
++++ b/drivers/tty/serial/8250/8250_lpss.c
+@@ -246,8 +246,13 @@ static int lpss8250_dma_setup(struct lpss8250 *lpss, struct uart_8250_port *port
+ struct dw_dma_slave *rx_param, *tx_param;
+ struct device *dev = port->port.dev;
+
+- if (!lpss->dma_param.dma_dev)
++ if (!lpss->dma_param.dma_dev) {
++ dma = port->dma;
++ if (dma)
++ goto out_configuration_only;
++
+ return 0;
++ }
+
+ rx_param = devm_kzalloc(dev, sizeof(*rx_param), GFP_KERNEL);
+ if (!rx_param)
+@@ -258,16 +263,18 @@ static int lpss8250_dma_setup(struct lpss8250 *lpss, struct uart_8250_port *port
+ return -ENOMEM;
+
+ *rx_param = lpss->dma_param;
+- dma->rxconf.src_maxburst = lpss->dma_maxburst;
+-
+ *tx_param = lpss->dma_param;
+- dma->txconf.dst_maxburst = lpss->dma_maxburst;
+
+ dma->fn = lpss8250_dma_filter;
+ dma->rx_param = rx_param;
+ dma->tx_param = tx_param;
+
+ port->dma = dma;
++
++out_configuration_only:
++ dma->rxconf.src_maxburst = lpss->dma_maxburst;
++ dma->txconf.dst_maxburst = lpss->dma_maxburst;
++
+ return 0;
+ }
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index c1166b45c288b..8cf4819312f5b 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -162,27 +162,10 @@ static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl)
+ static void omap_8250_mdr1_errataset(struct uart_8250_port *up,
+ struct omap8250_priv *priv)
+ {
+- u8 timeout = 255;
+-
+ serial_out(up, UART_OMAP_MDR1, priv->mdr1);
+ udelay(2);
+ serial_out(up, UART_FCR, up->fcr | UART_FCR_CLEAR_XMIT |
+ UART_FCR_CLEAR_RCVR);
+- /*
+- * Wait for FIFO to empty: when empty, RX_FIFO_E bit is 0 and
+- * TX_FIFO_E bit is 1.
+- */
+- while (UART_LSR_THRE != (serial_in(up, UART_LSR) &
+- (UART_LSR_THRE | UART_LSR_DR))) {
+- timeout--;
+- if (!timeout) {
+- /* Should *never* happen. we warn and carry on */
+- dev_crit(up->port.dev, "Errata i202: timedout %x\n",
+- serial_in(up, UART_LSR));
+- break;
+- }
+- udelay(1);
+- }
+ }
+
+ static void omap_8250_get_divisor(struct uart_port *port, unsigned int baud,
+@@ -1279,6 +1262,7 @@ static int omap8250_remove(struct platform_device *pdev)
+
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
+ pm_runtime_put_sync(&pdev->dev);
++ flush_work(&priv->qos_work);
+ pm_runtime_disable(&pdev->dev);
+ serial8250_unregister_port(priv->line);
+ pm_qos_remove_request(&priv->pm_qos_request);
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 6fc89888a52ed..ce266e10a21e0 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1865,10 +1865,13 @@ EXPORT_SYMBOL_GPL(serial8250_modem_status);
+ static bool handle_rx_dma(struct uart_8250_port *up, unsigned int iir)
+ {
+ switch (iir & 0x3f) {
+- case UART_IIR_RX_TIMEOUT:
+- serial8250_rx_dma_flush(up);
++ case UART_IIR_RDI:
++ if (!up->dma->rx_running)
++ break;
+ /* fall-through */
+ case UART_IIR_RLSI:
++ case UART_IIR_RX_TIMEOUT:
++ serial8250_rx_dma_flush(up);
+ return true;
+ }
+ return up->dma->rx_dma(up);
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index aeda1fe71eeba..819f340a8a7ad 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -2510,6 +2510,7 @@ static const struct dev_pm_ops imx_uart_pm_ops = {
+ .suspend_noirq = imx_uart_suspend_noirq,
+ .resume_noirq = imx_uart_resume_noirq,
+ .freeze_noirq = imx_uart_suspend_noirq,
++ .thaw_noirq = imx_uart_resume_noirq,
+ .restore_noirq = imx_uart_resume_noirq,
+ .suspend = imx_uart_suspend,
+ .resume = imx_uart_resume,
+diff --git a/drivers/usb/chipidea/otg_fsm.c b/drivers/usb/chipidea/otg_fsm.c
+index 6ed4b00dba961..7a2a9559693fb 100644
+--- a/drivers/usb/chipidea/otg_fsm.c
++++ b/drivers/usb/chipidea/otg_fsm.c
+@@ -256,8 +256,10 @@ static void ci_otg_del_timer(struct ci_hdrc *ci, enum otg_fsm_timer t)
+ ci->enabled_otg_timer_bits &= ~(1 << t);
+ if (ci->next_otg_timer == t) {
+ if (ci->enabled_otg_timer_bits == 0) {
++ spin_unlock_irqrestore(&ci->lock, flags);
+ /* No enabled timers after delete it */
+ hrtimer_cancel(&ci->otg_fsm_hrtimer);
++ spin_lock_irqsave(&ci->lock, flags);
+ ci->next_otg_timer = NUM_OTG_FSM_TIMERS;
+ } else {
+ /* Find the next timer */
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 62a063ed8220a..35a11f7bcb658 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -362,6 +362,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM },
+ { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* Realforce 87U Keyboard */
++ { USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 560e628912e54..ebb2936271299 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -162,6 +162,8 @@ static void option_instat_callback(struct urb *urb);
+ #define NOVATELWIRELESS_PRODUCT_G2 0xA010
+ #define NOVATELWIRELESS_PRODUCT_MC551 0xB001
+
++#define UBLOX_VENDOR_ID 0x1546
++
+ /* AMOI PRODUCTS */
+ #define AMOI_VENDOR_ID 0x1614
+ #define AMOI_PRODUCT_H01 0x0800
+@@ -240,7 +242,6 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_UC15 0x9090
+ /* These u-blox products use Qualcomm's vendor ID */
+ #define UBLOX_PRODUCT_R410M 0x90b2
+-#define UBLOX_PRODUCT_R6XX 0x90fa
+ /* These Yuga products use Qualcomm's vendor ID */
+ #define YUGA_PRODUCT_CLM920_NC5 0x9625
+
+@@ -581,6 +582,9 @@ static void option_instat_callback(struct urb *urb);
+ #define OPPO_VENDOR_ID 0x22d9
+ #define OPPO_PRODUCT_R11 0x276c
+
++/* Sierra Wireless products */
++#define SIERRA_VENDOR_ID 0x1199
++#define SIERRA_PRODUCT_EM9191 0x90d3
+
+ /* Device flags */
+
+@@ -1124,8 +1128,16 @@ static const struct usb_device_id option_ids[] = {
+ /* u-blox products using Qualcomm vendor ID */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M),
+ .driver_info = RSVD(1) | RSVD(3) },
+- { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R6XX),
++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x908b), /* u-blox LARA-R6 00B */
++ .driver_info = RSVD(4) },
++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa),
+ .driver_info = RSVD(3) },
++ /* u-blox products */
++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1341) }, /* u-blox LARA-L6 */
++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1342), /* u-blox LARA-L6 (RMNET) */
++ .driver_info = RSVD(4) },
++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1343), /* u-blox LARA-L6 (ECM) */
++ .driver_info = RSVD(4) },
+ /* Quectel products using Quectel vendor ID */
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21, 0xff, 0xff, 0xff),
+ .driver_info = NUMEP2 },
+@@ -2167,6 +2179,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x010a, 0xff) }, /* Fibocom MA510 (ECM mode) */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */
++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) }, /* Fibocom FM160 (MBIM mode) */
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */
+@@ -2176,6 +2189,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
+ { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/xen/pcpu.c b/drivers/xen/pcpu.c
+index cdc6daa7a9f66..9cf7085a260b4 100644
+--- a/drivers/xen/pcpu.c
++++ b/drivers/xen/pcpu.c
+@@ -228,7 +228,7 @@ static int register_pcpu(struct pcpu *pcpu)
+
+ err = device_register(dev);
+ if (err) {
+- pcpu_release(dev);
++ put_device(dev);
+ return err;
+ }
+
+diff --git a/fs/btrfs/tests/btrfs-tests.c b/fs/btrfs/tests/btrfs-tests.c
+index 82d874b104383..86c6ff2cc689d 100644
+--- a/fs/btrfs/tests/btrfs-tests.c
++++ b/fs/btrfs/tests/btrfs-tests.c
+@@ -174,7 +174,7 @@ void btrfs_free_dummy_fs_info(struct btrfs_fs_info *fs_info)
+
+ void btrfs_free_dummy_root(struct btrfs_root *root)
+ {
+- if (!root)
++ if (IS_ERR_OR_NULL(root))
+ return;
+ /* Will be freed by btrfs_free_fs_roots */
+ if (WARN_ON(test_bit(BTRFS_ROOT_IN_RADIX, &root->state)))
+diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c
+index 24a61e5248611..9b43907324a31 100644
+--- a/fs/btrfs/tests/qgroup-tests.c
++++ b/fs/btrfs/tests/qgroup-tests.c
+@@ -230,7 +230,6 @@ static int test_no_shared_qgroup(struct btrfs_root *root,
+ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots,
+ false);
+ if (ret) {
+- ulist_free(old_roots);
+ test_err("couldn't find old roots: %d", ret);
+ return ret;
+ }
+@@ -246,7 +245,6 @@ static int test_no_shared_qgroup(struct btrfs_root *root,
+ false);
+ if (ret) {
+ ulist_free(old_roots);
+- ulist_free(new_roots);
+ test_err("couldn't find old roots: %d", ret);
+ return ret;
+ }
+@@ -258,18 +256,19 @@ static int test_no_shared_qgroup(struct btrfs_root *root,
+ return ret;
+ }
+
++ /* btrfs_qgroup_account_extent() always frees the ulists passed to it. */
++ old_roots = NULL;
++ new_roots = NULL;
++
+ if (btrfs_verify_qgroup_counts(fs_info, BTRFS_FS_TREE_OBJECTID,
+ nodesize, nodesize)) {
+ test_err("qgroup counts didn't match expected values");
+ return -EINVAL;
+ }
+- old_roots = NULL;
+- new_roots = NULL;
+
+ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots,
+ false);
+ if (ret) {
+- ulist_free(old_roots);
+ test_err("couldn't find old roots: %d", ret);
+ return ret;
+ }
+@@ -284,7 +283,6 @@ static int test_no_shared_qgroup(struct btrfs_root *root,
+ false);
+ if (ret) {
+ ulist_free(old_roots);
+- ulist_free(new_roots);
+ test_err("couldn't find old roots: %d", ret);
+ return ret;
+ }
+@@ -335,7 +333,6 @@ static int test_multiple_refs(struct btrfs_root *root,
+ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots,
+ false);
+ if (ret) {
+- ulist_free(old_roots);
+ test_err("couldn't find old roots: %d", ret);
+ return ret;
+ }
+@@ -351,7 +348,6 @@ static int test_multiple_refs(struct btrfs_root *root,
+ false);
+ if (ret) {
+ ulist_free(old_roots);
+- ulist_free(new_roots);
+ test_err("couldn't find old roots: %d", ret);
+ return ret;
+ }
+@@ -372,7 +368,6 @@ static int test_multiple_refs(struct btrfs_root *root,
+ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots,
+ false);
+ if (ret) {
+- ulist_free(old_roots);
+ test_err("couldn't find old roots: %d", ret);
+ return ret;
+ }
+@@ -388,7 +383,6 @@ static int test_multiple_refs(struct btrfs_root *root,
+ false);
+ if (ret) {
+ ulist_free(old_roots);
+- ulist_free(new_roots);
+ test_err("couldn't find old roots: %d", ret);
+ return ret;
+ }
+@@ -415,7 +409,6 @@ static int test_multiple_refs(struct btrfs_root *root,
+ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots,
+ false);
+ if (ret) {
+- ulist_free(old_roots);
+ test_err("couldn't find old roots: %d", ret);
+ return ret;
+ }
+@@ -431,7 +424,6 @@ static int test_multiple_refs(struct btrfs_root *root,
+ false);
+ if (ret) {
+ ulist_free(old_roots);
+- ulist_free(new_roots);
+ test_err("couldn't find old roots: %d", ret);
+ return ret;
+ }
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 356e289d19f20..5bc0877f223fd 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -2321,7 +2321,7 @@ int generic_cont_expand_simple(struct inode *inode, loff_t size)
+ {
+ struct address_space *mapping = inode->i_mapping;
+ struct page *page;
+- void *fsdata;
++ void *fsdata = NULL;
+ int err;
+
+ err = inode_newsize_ok(inode, size);
+@@ -2347,7 +2347,7 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping,
+ struct inode *inode = mapping->host;
+ unsigned int blocksize = i_blocksize(inode);
+ struct page *page;
+- void *fsdata;
++ void *fsdata = NULL;
+ pgoff_t index, curidx;
+ loff_t curpos;
+ unsigned zerofrom, offset, len;
+diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
+index 54f32f9143a91..5a7020e767e45 100644
+--- a/fs/cifs/ioctl.c
++++ b/fs/cifs/ioctl.c
+@@ -149,7 +149,7 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
+ rc = put_user(ExtAttrBits &
+ FS_FL_USER_VISIBLE,
+ (int __user *)arg);
+- if (rc != EOPNOTSUPP)
++ if (rc != -EOPNOTSUPP)
+ break;
+ }
+ #endif /* CONFIG_CIFS_POSIX */
+@@ -178,7 +178,7 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
+ * pSMBFile->fid.netfid,
+ * extAttrBits,
+ * &ExtAttrMask);
+- * if (rc != EOPNOTSUPP)
++ * if (rc != -EOPNOTSUPP)
+ * break;
+ */
+
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index 17001f4e9f845..e5e7a8101aa6e 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -172,7 +172,10 @@ static int gfs2_check_sb(struct gfs2_sbd *sdp, int silent)
+ pr_warn("Invalid superblock size\n");
+ return -EINVAL;
+ }
+-
++ if (sb->sb_bsize_shift != ffs(sb->sb_bsize) - 1) {
++ pr_warn("Invalid block size shift\n");
++ return -EINVAL;
++ }
+ return 0;
+ }
+
+@@ -369,8 +372,10 @@ static int init_names(struct gfs2_sbd *sdp, int silent)
+ if (!table[0])
+ table = sdp->sd_vfs->s_id;
+
+- strlcpy(sdp->sd_proto_name, proto, GFS2_FSNAME_LEN);
+- strlcpy(sdp->sd_table_name, table, GFS2_FSNAME_LEN);
++ BUILD_BUG_ON(GFS2_LOCKNAME_LEN > GFS2_FSNAME_LEN);
++
++ strscpy(sdp->sd_proto_name, proto, GFS2_LOCKNAME_LEN);
++ strscpy(sdp->sd_table_name, table, GFS2_LOCKNAME_LEN);
+
+ table = sdp->sd_table_name;
+ while ((table = strchr(table, '/')))
+diff --git a/fs/namei.c b/fs/namei.c
+index c34ee9653559c..9e8fca598acc5 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -4826,7 +4826,7 @@ int __page_symlink(struct inode *inode, const char *symname, int len, int nofs)
+ {
+ struct address_space *mapping = inode->i_mapping;
+ struct page *page;
+- void *fsdata;
++ void *fsdata = NULL;
+ int err;
+ unsigned int flags = 0;
+ if (nofs)
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index f9f76594b866b..9a0f48f7f2b83 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -6613,6 +6613,7 @@ static void nfs4_lock_done(struct rpc_task *task, void *calldata)
+ {
+ struct nfs4_lockdata *data = calldata;
+ struct nfs4_lock_state *lsp = data->lsp;
++ struct nfs_server *server = NFS_SERVER(d_inode(data->ctx->dentry));
+
+ dprintk("%s: begin!\n", __func__);
+
+@@ -6622,8 +6623,7 @@ static void nfs4_lock_done(struct rpc_task *task, void *calldata)
+ data->rpc_status = task->tk_status;
+ switch (task->tk_status) {
+ case 0:
+- renew_lease(NFS_SERVER(d_inode(data->ctx->dentry)),
+- data->timestamp);
++ renew_lease(server, data->timestamp);
+ if (data->arg.new_lock && !data->cancelled) {
+ data->fl.fl_flags &= ~(FL_SLEEP | FL_ACCESS);
+ if (locks_lock_inode_wait(lsp->ls_state->inode, &data->fl) < 0)
+@@ -6644,6 +6644,8 @@ static void nfs4_lock_done(struct rpc_task *task, void *calldata)
+ if (!nfs4_stateid_match(&data->arg.open_stateid,
+ &lsp->ls_state->open_stateid))
+ goto out_restart;
++ else if (nfs4_async_handle_error(task, server, lsp->ls_state, NULL) == -EAGAIN)
++ goto out_restart;
+ } else if (!nfs4_stateid_match(&data->arg.lock_stateid,
+ &lsp->ls_stateid))
+ goto out_restart;
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 535543ab4e26a..11914b3585b34 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -322,7 +322,7 @@ void nilfs_relax_pressure_in_lock(struct super_block *sb)
+ struct the_nilfs *nilfs = sb->s_fs_info;
+ struct nilfs_sc_info *sci = nilfs->ns_writer;
+
+- if (!sci || !sci->sc_flush_request)
++ if (sb_rdonly(sb) || unlikely(!sci) || !sci->sc_flush_request)
+ return;
+
+ set_bit(NILFS_SC_PRIOR_FLUSH, &sci->sc_flags);
+@@ -2243,7 +2243,7 @@ int nilfs_construct_segment(struct super_block *sb)
+ struct nilfs_transaction_info *ti;
+ int err;
+
+- if (!sci)
++ if (sb_rdonly(sb) || unlikely(!sci))
+ return -EROFS;
+
+ /* A call inside transactions causes a deadlock. */
+@@ -2282,7 +2282,7 @@ int nilfs_construct_dsync_segment(struct super_block *sb, struct inode *inode,
+ struct nilfs_transaction_info ti;
+ int err = 0;
+
+- if (!sci)
++ if (sb_rdonly(sb) || unlikely(!sci))
+ return -EROFS;
+
+ nilfs_transaction_lock(sb, &ti, 0);
+@@ -2778,11 +2778,12 @@ int nilfs_attach_log_writer(struct super_block *sb, struct nilfs_root *root)
+
+ if (nilfs->ns_writer) {
+ /*
+- * This happens if the filesystem was remounted
+- * read/write after nilfs_error degenerated it into a
+- * read-only mount.
++ * This happens if the filesystem is made read-only by
++ * __nilfs_error or nilfs_remount and then remounted
++ * read/write. In these cases, reuse the existing
++ * writer.
+ */
+- nilfs_detach_log_writer(sb);
++ return 0;
+ }
+
+ nilfs->ns_writer = nilfs_segctor_new(sb, root);
+diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
+index 2a3ad12701333..5e4d7d19102c5 100644
+--- a/fs/nilfs2/super.c
++++ b/fs/nilfs2/super.c
+@@ -1138,8 +1138,6 @@ static int nilfs_remount(struct super_block *sb, int *flags, char *data)
+ if ((bool)(*flags & SB_RDONLY) == sb_rdonly(sb))
+ goto out;
+ if (*flags & SB_RDONLY) {
+- /* Shutting down log writer */
+- nilfs_detach_log_writer(sb);
+ sb->s_flags |= SB_RDONLY;
+
+ /*
+diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
+index 931870768556c..fb61c33c60045 100644
+--- a/fs/nilfs2/the_nilfs.c
++++ b/fs/nilfs2/the_nilfs.c
+@@ -695,9 +695,7 @@ int nilfs_count_free_blocks(struct the_nilfs *nilfs, sector_t *nblocks)
+ {
+ unsigned long ncleansegs;
+
+- down_read(&NILFS_MDT(nilfs->ns_dat)->mi_sem);
+ ncleansegs = nilfs_sufile_get_ncleansegs(nilfs->ns_sufile);
+- up_read(&NILFS_MDT(nilfs->ns_dat)->mi_sem);
+ *nblocks = (sector_t)ncleansegs * nilfs->ns_blocks_per_segment;
+ return 0;
+ }
+diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
+index 62b49197e5f67..0a7efbe2adb3c 100644
+--- a/fs/ntfs/attrib.c
++++ b/fs/ntfs/attrib.c
+@@ -608,17 +608,37 @@ static int ntfs_attr_find(const ATTR_TYPE type, const ntfschar *name,
+ for (;; a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))) {
+ u8 *mrec_end = (u8 *)ctx->mrec +
+ le32_to_cpu(ctx->mrec->bytes_allocated);
+- u8 *name_end = (u8 *)a + le16_to_cpu(a->name_offset) +
+- a->name_length * sizeof(ntfschar);
+- if ((u8*)a < (u8*)ctx->mrec || (u8*)a > mrec_end ||
+- name_end > mrec_end)
++ u8 *name_end;
++
++ /* check whether ATTR_RECORD wrap */
++ if ((u8 *)a < (u8 *)ctx->mrec)
++ break;
++
++ /* check whether Attribute Record Header is within bounds */
++ if ((u8 *)a > mrec_end ||
++ (u8 *)a + sizeof(ATTR_RECORD) > mrec_end)
++ break;
++
++ /* check whether ATTR_RECORD's name is within bounds */
++ name_end = (u8 *)a + le16_to_cpu(a->name_offset) +
++ a->name_length * sizeof(ntfschar);
++ if (name_end > mrec_end)
+ break;
++
+ ctx->attr = a;
+ if (unlikely(le32_to_cpu(a->type) > le32_to_cpu(type) ||
+ a->type == AT_END))
+ return -ENOENT;
+ if (unlikely(!a->length))
+ break;
++
++ /* check whether ATTR_RECORD's length wrap */
++ if ((u8 *)a + le32_to_cpu(a->length) < (u8 *)a)
++ break;
++ /* check whether ATTR_RECORD's length is within bounds */
++ if ((u8 *)a + le32_to_cpu(a->length) > mrec_end)
++ break;
++
+ if (a->type != type)
+ continue;
+ /*
+diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
+index 0acd1f02b1467..97d34de2a8f3b 100644
+--- a/fs/ntfs/inode.c
++++ b/fs/ntfs/inode.c
+@@ -1854,6 +1854,13 @@ int ntfs_read_inode_mount(struct inode *vi)
+ goto err_out;
+ }
+
++ /* Sanity check offset to the first attribute */
++ if (le16_to_cpu(m->attrs_offset) >= le32_to_cpu(m->bytes_allocated)) {
++ ntfs_error(sb, "Incorrect mft offset to the first attribute %u in superblock.",
++ le16_to_cpu(m->attrs_offset));
++ goto err_out;
++ }
++
+ /* Need this to sanity check attribute list references to $MFT. */
+ vi->i_generation = ni->seq_no = le16_to_cpu(m->sequence_number);
+
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index 1dfb9c36e6da0..d13ded8e2c309 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -241,7 +241,7 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
+ poffset - lfi);
+ else {
+ if (!copy_name) {
+- copy_name = kmalloc(UDF_NAME_LEN,
++ copy_name = kmalloc(UDF_NAME_LEN_CS0,
+ GFP_NOFS);
+ if (!copy_name) {
+ fi = ERR_PTR(-ENOMEM);
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index a26e6f5034a63..d56faf8944923 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -242,6 +242,7 @@
+ #define DATA_DATA \
+ *(.xiptext) \
+ *(DATA_MAIN) \
++ *(.data..decrypted) \
+ *(.ref.data) \
+ *(.data..shared_aligned) /* percpu related */ \
+ MEM_KEEP(init.data*) \
+@@ -843,7 +844,6 @@
+ #ifdef CONFIG_AMD_MEM_ENCRYPT
+ #define PERCPU_DECRYPTED_SECTION \
+ . = ALIGN(PAGE_SIZE); \
+- *(.data..decrypted) \
+ *(.data..percpu..decrypted) \
+ . = ALIGN(PAGE_SIZE);
+ #else
+diff --git a/include/uapi/linux/capability.h b/include/uapi/linux/capability.h
+index 240fdb9a60f68..6e0d68e841cdb 100644
+--- a/include/uapi/linux/capability.h
++++ b/include/uapi/linux/capability.h
+@@ -376,7 +376,7 @@ struct vfs_ns_cap_data {
+ */
+
+ #define CAP_TO_INDEX(x) ((x) >> 5) /* 1 << 5 == bits in __u32 */
+-#define CAP_TO_MASK(x) (1 << ((x) & 31)) /* mask for indexed __u32 */
++#define CAP_TO_MASK(x) (1U << ((x) & 31)) /* mask for indexed __u32 */
+
+
+ #endif /* _UAPI_LINUX_CAPABILITY_H */
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index ba7d361878aac..9c77955664362 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1331,6 +1331,7 @@ static int ftrace_add_mod(struct trace_array *tr,
+ if (!ftrace_mod)
+ return -ENOMEM;
+
++ INIT_LIST_HEAD(&ftrace_mod->list);
+ ftrace_mod->func = kstrdup(func, GFP_KERNEL);
+ ftrace_mod->module = kstrdup(module, GFP_KERNEL);
+ ftrace_mod->enable = enable;
+@@ -3033,7 +3034,7 @@ static int ftrace_allocate_records(struct ftrace_page *pg, int count)
+ /* if we can't allocate this size, try something smaller */
+ if (!order)
+ return -ENOMEM;
+- order >>= 1;
++ order--;
+ goto again;
+ }
+
+@@ -6229,7 +6230,7 @@ void __init ftrace_init(void)
+ }
+
+ pr_info("ftrace: allocating %ld entries in %ld pages\n",
+- count, count / ENTRIES_PER_PAGE + 1);
++ count, DIV_ROUND_UP(count, ENTRIES_PER_PAGE));
+
+ last_ftrace_enabled = ftrace_enabled = 1;
+
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index a0353c8f08912..5e5b0c067f611 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -1328,9 +1328,9 @@ static void rb_free_cpu_buffer(struct ring_buffer_per_cpu *cpu_buffer)
+
+ free_buffer_page(cpu_buffer->reader_page);
+
+- rb_head_page_deactivate(cpu_buffer);
+-
+ if (head) {
++ rb_head_page_deactivate(cpu_buffer);
++
+ list_for_each_entry_safe(bpage, tmp, head, list) {
+ list_del_init(&bpage->list);
+ free_buffer_page(bpage);
+diff --git a/mm/filemap.c b/mm/filemap.c
+index f2e777003b901..e61ec2c88bd03 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -3140,7 +3140,7 @@ ssize_t generic_perform_write(struct file *file,
+ unsigned long offset; /* Offset into pagecache page */
+ unsigned long bytes; /* Bytes to write to page */
+ size_t copied; /* Bytes copied from user */
+- void *fsdata;
++ void *fsdata = NULL;
+
+ offset = (pos & (PAGE_SIZE - 1));
+ bytes = min_t(unsigned long, PAGE_SIZE - offset,
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index 9268f808afc08..7194ffa58d3e7 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -220,6 +220,8 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
+ list_move(&req->req_list, &cancel_list);
+ }
+
++ spin_unlock(&m->client->lock);
++
+ list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) {
+ p9_debug(P9_DEBUG_ERROR, "call back req %p\n", req);
+ list_del(&req->req_list);
+@@ -227,7 +229,6 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
+ req->t_err = err;
+ p9_client_cb(m->client, req, REQ_STATUS_ERROR);
+ }
+- spin_unlock(&m->client->lock);
+ }
+
+ static __poll_t
+@@ -835,11 +836,14 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
+ goto out_free_ts;
+ if (!(ts->rd->f_mode & FMODE_READ))
+ goto out_put_rd;
++ /* prevent workers from hanging on IO when fd is a pipe */
++ ts->rd->f_flags |= O_NONBLOCK;
+ ts->wr = fget(wfd);
+ if (!ts->wr)
+ goto out_put_rd;
+ if (!(ts->wr->f_mode & FMODE_WRITE))
+ goto out_put_wr;
++ ts->wr->f_flags |= O_NONBLOCK;
+
+ client->trans = ts;
+ client->status = Connected;
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 251da90642cde..82e3629617c8e 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -1824,7 +1824,7 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
+ if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
+ continue;
+
+- if (c->psm == psm) {
++ if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) {
+ int src_match, dst_match;
+ int src_any, dst_any;
+
+diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
+index f4078830ea505..e0c6dfae42d8f 100644
+--- a/net/bpf/test_run.c
++++ b/net/bpf/test_run.c
+@@ -87,6 +87,7 @@ static void *bpf_test_init(const union bpf_attr *kattr, u32 size,
+ if (size < ETH_HLEN || size > PAGE_SIZE - headroom - tailroom)
+ return ERR_PTR(-EINVAL);
+
++ size = SKB_DATA_ALIGN(size);
+ data = kzalloc(size + headroom + tailroom, GFP_USER);
+ if (!data)
+ return ERR_PTR(-ENOMEM);
+diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
+index 8aeece7aa9e97..ece140ad0ac1a 100644
+--- a/net/caif/chnl_net.c
++++ b/net/caif/chnl_net.c
+@@ -314,9 +314,6 @@ static int chnl_net_open(struct net_device *dev)
+
+ if (result == 0) {
+ pr_debug("connect timeout\n");
+- caif_disconnect_client(dev_net(dev), &priv->chnl);
+- priv->state = CAIF_DISCONNECTED;
+- pr_debug("state disconnected\n");
+ result = -ETIMEDOUT;
+ goto error;
+ }
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index e0be1f8651bbe..4178fc28c2770 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3560,23 +3560,25 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
+ int pos;
+ int dummy;
+
+- if (list_skb && !list_skb->head_frag && skb_headlen(list_skb) &&
+- (skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY)) {
+- /* gso_size is untrusted, and we have a frag_list with a linear
+- * non head_frag head.
+- *
+- * (we assume checking the first list_skb member suffices;
+- * i.e if either of the list_skb members have non head_frag
+- * head, then the first one has too).
+- *
+- * If head_skb's headlen does not fit requested gso_size, it
+- * means that the frag_list members do NOT terminate on exact
+- * gso_size boundaries. Hence we cannot perform skb_frag_t page
+- * sharing. Therefore we must fallback to copying the frag_list
+- * skbs; we do so by disabling SG.
+- */
+- if (mss != GSO_BY_FRAGS && mss != skb_headlen(head_skb))
+- features &= ~NETIF_F_SG;
++ if ((skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY) &&
++ mss != GSO_BY_FRAGS && mss != skb_headlen(head_skb)) {
++ struct sk_buff *check_skb;
++
++ for (check_skb = list_skb; check_skb; check_skb = check_skb->next) {
++ if (skb_headlen(check_skb) && !check_skb->head_frag) {
++ /* gso_size is untrusted, and we have a frag_list with
++ * a linear non head_frag item.
++ *
++ * If head_skb's headlen does not fit requested gso_size,
++ * it means that the frag_list members do NOT terminate
++ * on exact gso_size boundaries. Hence we cannot perform
++ * skb_frag_t page sharing. Therefore we must fallback to
++ * copying the frag_list skbs; we do so by disabling SG.
++ */
++ features &= ~NETIF_F_SG;
++ break;
++ }
++ }
+ }
+
+ __skb_push(head_skb, doffset);
+diff --git a/net/ipv4/tcp_cdg.c b/net/ipv4/tcp_cdg.c
+index 06fbe102a425f..10daea1fcefc6 100644
+--- a/net/ipv4/tcp_cdg.c
++++ b/net/ipv4/tcp_cdg.c
+@@ -374,6 +374,7 @@ static void tcp_cdg_init(struct sock *sk)
+ struct cdg *ca = inet_csk_ca(sk);
+ struct tcp_sock *tp = tcp_sk(sk);
+
++ ca->gradients = NULL;
+ /* We silently fall back to window = 1 if allocation fails. */
+ if (window > 1)
+ ca->gradients = kcalloc(window, sizeof(ca->gradients[0]),
+@@ -387,6 +388,7 @@ static void tcp_cdg_release(struct sock *sk)
+ struct cdg *ca = inet_csk_ca(sk);
+
+ kfree(ca->gradients);
++ ca->gradients = NULL;
+ }
+
+ static struct tcp_congestion_ops tcp_cdg __read_mostly = {
+diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
+index c7dc8b2de6c22..7fdd433b968ec 100644
+--- a/net/ipv6/addrlabel.c
++++ b/net/ipv6/addrlabel.c
+@@ -437,6 +437,7 @@ static void ip6addrlbl_putmsg(struct nlmsghdr *nlh,
+ {
+ struct ifaddrlblmsg *ifal = nlmsg_data(nlh);
+ ifal->ifal_family = AF_INET6;
++ ifal->__ifal_reserved = 0;
+ ifal->ifal_prefixlen = prefixlen;
+ ifal->ifal_flags = 0;
+ ifal->ifal_index = ifindex;
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
+index f2fbccd3fcf43..c0034546a9edf 100644
+--- a/net/kcm/kcmsock.c
++++ b/net/kcm/kcmsock.c
+@@ -224,7 +224,7 @@ static void requeue_rx_msgs(struct kcm_mux *mux, struct sk_buff_head *head)
+ struct sk_buff *skb;
+ struct kcm_sock *kcm;
+
+- while ((skb = __skb_dequeue(head))) {
++ while ((skb = skb_dequeue(head))) {
+ /* Reset destructor to avoid calling kcm_rcv_ready */
+ skb->destructor = sock_rfree;
+ skb_orphan(skb);
+@@ -1085,53 +1085,18 @@ out_error:
+ return err;
+ }
+
+-static struct sk_buff *kcm_wait_data(struct sock *sk, int flags,
+- long timeo, int *err)
+-{
+- struct sk_buff *skb;
+-
+- while (!(skb = skb_peek(&sk->sk_receive_queue))) {
+- if (sk->sk_err) {
+- *err = sock_error(sk);
+- return NULL;
+- }
+-
+- if (sock_flag(sk, SOCK_DONE))
+- return NULL;
+-
+- if ((flags & MSG_DONTWAIT) || !timeo) {
+- *err = -EAGAIN;
+- return NULL;
+- }
+-
+- sk_wait_data(sk, &timeo, NULL);
+-
+- /* Handle signals */
+- if (signal_pending(current)) {
+- *err = sock_intr_errno(timeo);
+- return NULL;
+- }
+- }
+-
+- return skb;
+-}
+-
+ static int kcm_recvmsg(struct socket *sock, struct msghdr *msg,
+ size_t len, int flags)
+ {
++ int noblock = flags & MSG_DONTWAIT;
+ struct sock *sk = sock->sk;
+ struct kcm_sock *kcm = kcm_sk(sk);
+ int err = 0;
+- long timeo;
+ struct strp_msg *stm;
+ int copied = 0;
+ struct sk_buff *skb;
+
+- timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+-
+- lock_sock(sk);
+-
+- skb = kcm_wait_data(sk, flags, timeo, &err);
++ skb = skb_recv_datagram(sk, flags, noblock, &err);
+ if (!skb)
+ goto out;
+
+@@ -1162,14 +1127,11 @@ msg_finished:
+ /* Finished with message */
+ msg->msg_flags |= MSG_EOR;
+ KCM_STATS_INCR(kcm->stats.rx_msgs);
+- skb_unlink(skb, &sk->sk_receive_queue);
+- kfree_skb(skb);
+ }
+ }
+
+ out:
+- release_sock(sk);
+-
++ skb_free_datagram(sk, skb);
+ return copied ? : err;
+ }
+
+@@ -1177,9 +1139,9 @@ static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos,
+ struct pipe_inode_info *pipe, size_t len,
+ unsigned int flags)
+ {
++ int noblock = flags & MSG_DONTWAIT;
+ struct sock *sk = sock->sk;
+ struct kcm_sock *kcm = kcm_sk(sk);
+- long timeo;
+ struct strp_msg *stm;
+ int err = 0;
+ ssize_t copied;
+@@ -1187,11 +1149,7 @@ static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos,
+
+ /* Only support splice for SOCKSEQPACKET */
+
+- timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+-
+- lock_sock(sk);
+-
+- skb = kcm_wait_data(sk, flags, timeo, &err);
++ skb = skb_recv_datagram(sk, flags, noblock, &err);
+ if (!skb)
+ goto err_out;
+
+@@ -1219,13 +1177,11 @@ static ssize_t kcm_splice_read(struct socket *sock, loff_t *ppos,
+ * finish reading the message.
+ */
+
+- release_sock(sk);
+-
++ skb_free_datagram(sk, skb);
+ return copied;
+
+ err_out:
+- release_sock(sk);
+-
++ skb_free_datagram(sk, skb);
+ return err;
+ }
+
+@@ -1845,10 +1801,10 @@ static int kcm_release(struct socket *sock)
+ kcm = kcm_sk(sk);
+ mux = kcm->mux;
+
++ lock_sock(sk);
+ sock_orphan(sk);
+ kfree_skb(kcm->seq_skb);
+
+- lock_sock(sk);
+ /* Purge queue under lock to avoid race condition with tx_work trying
+ * to act when queue is nonempty. If tx_work runs after this point
+ * it will just return.
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 5086e27d3011e..59e8e17d8da9c 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -865,7 +865,7 @@ static int tipc_nl_compat_name_table_dump_header(struct tipc_nl_compat_msg *msg)
+ };
+
+ ntq = (struct tipc_name_table_query *)TLV_DATA(msg->req);
+- if (TLV_GET_DATA_LEN(msg->req) < sizeof(struct tipc_name_table_query))
++ if (TLV_GET_DATA_LEN(msg->req) < (int)sizeof(struct tipc_name_table_query))
+ return -EINVAL;
+
+ depth = ntohl(ntq->depth);
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index dd8503a3ef1e1..07d053603e3a6 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1050,6 +1050,8 @@ static void regdb_fw_cb(const struct firmware *fw, void *context)
+
+ static int query_regdb_file(const char *alpha2)
+ {
++ int err;
++
+ ASSERT_RTNL();
+
+ if (regdb)
+@@ -1059,9 +1061,13 @@ static int query_regdb_file(const char *alpha2)
+ if (!alpha2)
+ return -ENOMEM;
+
+- return request_firmware_nowait(THIS_MODULE, true, "regulatory.db",
+- ®_pdev->dev, GFP_KERNEL,
+- (void *)alpha2, regdb_fw_cb);
++ err = request_firmware_nowait(THIS_MODULE, true, "regulatory.db",
++ ®_pdev->dev, GFP_KERNEL,
++ (void *)alpha2, regdb_fw_cb);
++ if (err)
++ kfree(alpha2);
++
++ return err;
+ }
+
+ int reg_reload_regdb(void)
+diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
+index 30f71620d4e3f..24f2676e3b66e 100644
+--- a/net/x25/x25_dev.c
++++ b/net/x25/x25_dev.c
+@@ -122,7 +122,7 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev,
+
+ if (!pskb_may_pull(skb, 1)) {
+ x25_neigh_put(nb);
+- return 0;
++ goto drop;
+ }
+
+ switch (skb->data[0]) {
+diff --git a/scripts/extract-cert.c b/scripts/extract-cert.c
+index b071bf476fea7..dd1a4bd706a2e 100644
+--- a/scripts/extract-cert.c
++++ b/scripts/extract-cert.c
+@@ -23,6 +23,13 @@
+ #include <openssl/err.h>
+ #include <openssl/engine.h>
+
++/*
++ * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
++ *
++ * Remove this if/when that API is no longer used
++ */
++#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
++
+ #define PKEY_ID_PKCS7 2
+
+ static __attribute__((noreturn))
+diff --git a/scripts/sign-file.c b/scripts/sign-file.c
+index fbd34b8e8f578..7434e9ea926e2 100644
+--- a/scripts/sign-file.c
++++ b/scripts/sign-file.c
+@@ -29,6 +29,13 @@
+ #include <openssl/err.h>
+ #include <openssl/engine.h>
+
++/*
++ * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
++ *
++ * Remove this if/when that API is no longer used
++ */
++#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
++
+ /*
+ * Use CMS if we have openssl-1.0.0 or newer available - otherwise we have to
+ * assume that it's not available and its header file is missing and that we
+diff --git a/sound/hda/hdac_sysfs.c b/sound/hda/hdac_sysfs.c
+index fb2aa344981e6..ce2af695a19af 100644
+--- a/sound/hda/hdac_sysfs.c
++++ b/sound/hda/hdac_sysfs.c
+@@ -346,8 +346,10 @@ static int add_widget_node(struct kobject *parent, hda_nid_t nid,
+ return -ENOMEM;
+ kobject_init(kobj, &widget_ktype);
+ err = kobject_add(kobj, parent, "%02x", nid);
+- if (err < 0)
++ if (err < 0) {
++ kobject_put(kobj);
+ return err;
++ }
+ err = sysfs_create_group(kobj, group);
+ if (err < 0) {
+ kobject_put(kobj);
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 004a7772bb5d0..23f00ba993cb7 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -1070,6 +1070,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = {
+ SND_PCI_QUIRK(0x1458, 0xA026, "Gigabyte G1.Sniper Z97", QUIRK_R3DI),
+ SND_PCI_QUIRK(0x1458, 0xA036, "Gigabyte GA-Z170X-Gaming 7", QUIRK_R3DI),
+ SND_PCI_QUIRK(0x3842, 0x1038, "EVGA X99 Classified", QUIRK_R3DI),
++ SND_PCI_QUIRK(0x3842, 0x1055, "EVGA Z390 DARK", QUIRK_R3DI),
+ SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D),
+ {}
+ };
+diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
+index 9b33c87c2fe4d..7e817e1877c22 100644
+--- a/sound/soc/codecs/wm5102.c
++++ b/sound/soc/codecs/wm5102.c
+@@ -2085,6 +2085,9 @@ static int wm5102_probe(struct platform_device *pdev)
+ regmap_update_bits(arizona->regmap, wm5102_digital_vu[i],
+ WM5102_DIG_VU, WM5102_DIG_VU);
+
++ pm_runtime_enable(&pdev->dev);
++ pm_runtime_idle(&pdev->dev);
++
+ ret = arizona_request_irq(arizona, ARIZONA_IRQ_DSP_IRQ1,
+ "ADSP2 Compressed IRQ", wm5102_adsp2_irq,
+ wm5102);
+@@ -2117,9 +2120,6 @@ static int wm5102_probe(struct platform_device *pdev)
+ goto err_spk_irqs;
+ }
+
+- pm_runtime_enable(&pdev->dev);
+- pm_runtime_idle(&pdev->dev);
+-
+ return ret;
+
+ err_spk_irqs:
+diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
+index 43a47312d71b7..e510aca551636 100644
+--- a/sound/soc/codecs/wm5110.c
++++ b/sound/soc/codecs/wm5110.c
+@@ -2453,6 +2453,9 @@ static int wm5110_probe(struct platform_device *pdev)
+ regmap_update_bits(arizona->regmap, wm5110_digital_vu[i],
+ WM5110_DIG_VU, WM5110_DIG_VU);
+
++ pm_runtime_enable(&pdev->dev);
++ pm_runtime_idle(&pdev->dev);
++
+ ret = arizona_request_irq(arizona, ARIZONA_IRQ_DSP_IRQ1,
+ "ADSP2 Compressed IRQ", wm5110_adsp2_irq,
+ wm5110);
+@@ -2485,9 +2488,6 @@ static int wm5110_probe(struct platform_device *pdev)
+ goto err_spk_irqs;
+ }
+
+- pm_runtime_enable(&pdev->dev);
+- pm_runtime_idle(&pdev->dev);
+-
+ return ret;
+
+ err_spk_irqs:
+diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
+index 9f819113af1e6..bb6a95be87265 100644
+--- a/sound/soc/codecs/wm8997.c
++++ b/sound/soc/codecs/wm8997.c
+@@ -1159,6 +1159,9 @@ static int wm8997_probe(struct platform_device *pdev)
+ regmap_update_bits(arizona->regmap, wm8997_digital_vu[i],
+ WM8997_DIG_VU, WM8997_DIG_VU);
+
++ pm_runtime_enable(&pdev->dev);
++ pm_runtime_idle(&pdev->dev);
++
+ arizona_init_common(arizona);
+
+ ret = arizona_init_vol_limit(arizona);
+@@ -1177,9 +1180,6 @@ static int wm8997_probe(struct platform_device *pdev)
+ goto err_spk_irqs;
+ }
+
+- pm_runtime_enable(&pdev->dev);
+- pm_runtime_idle(&pdev->dev);
+-
+ return ret;
+
+ err_spk_irqs:
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 9ca7dff5593d1..07875867f5c2b 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -3863,10 +3863,23 @@ EXPORT_SYMBOL_GPL(snd_soc_of_get_dai_link_codecs);
+
+ static int __init snd_soc_init(void)
+ {
++ int ret;
++
+ snd_soc_debugfs_init();
+- snd_soc_util_init();
++ ret = snd_soc_util_init();
++ if (ret)
++ goto err_util_init;
+
+- return platform_driver_register(&soc_driver);
++ ret = platform_driver_register(&soc_driver);
++ if (ret)
++ goto err_register;
++ return 0;
++
++err_register:
++ snd_soc_util_exit();
++err_util_init:
++ snd_soc_debugfs_exit();
++ return ret;
+ }
+ module_init(snd_soc_init);
+
+diff --git a/sound/soc/soc-utils.c b/sound/soc/soc-utils.c
+index e0c93496c0cda..ba7e5ee30f66c 100644
+--- a/sound/soc/soc-utils.c
++++ b/sound/soc/soc-utils.c
+@@ -373,7 +373,7 @@ int __init snd_soc_util_init(void)
+ return ret;
+ }
+
+-void __exit snd_soc_util_exit(void)
++void snd_soc_util_exit(void)
+ {
+ platform_driver_unregister(&soc_dummy_driver);
+ platform_device_unregister(soc_dummy_dev);
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index c9c604f0e1ff7..78637bfafd09b 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1149,10 +1149,8 @@ static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream)
+ port = &umidi->endpoints[i].out->ports[j];
+ break;
+ }
+- if (!port) {
+- snd_BUG();
++ if (!port)
+ return -ENXIO;
+- }
+
+ substream->runtime->private_data = port;
+ port->state = STATE_UNKNOWN;
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 3f353e051a1de..e72f744bc305d 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2109,6 +2109,10 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+ }
+ },
++{
++ /* M-Audio Micro */
++ USB_DEVICE_VENDOR_SPEC(0x0763, 0x201a),
++},
+ {
+ USB_DEVICE_VENDOR_SPEC(0x0763, 0x2030),
+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 512e052e59f7d..43cbaaff163fa 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1410,6 +1410,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ /* XMOS based USB DACs */
+ switch (chip->usb_id) {
+ case USB_ID(0x1511, 0x0037): /* AURALiC VEGA */
++ case USB_ID(0x21ed, 0xd75a): /* Accuphase DAC-60 option card */
+ case USB_ID(0x2522, 0x0012): /* LH Labs VI DAC Infinity */
+ case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */
+ if (fp->altsetting == 2)
+diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
+index 30996306cabcf..479531f5865d2 100644
+--- a/tools/testing/selftests/futex/functional/Makefile
++++ b/tools/testing/selftests/futex/functional/Makefile
+@@ -3,11 +3,11 @@ INCLUDES := -I../include -I../../
+ CFLAGS := $(CFLAGS) -g -O2 -Wall -D_GNU_SOURCE -pthread $(INCLUDES)
+ LDFLAGS := $(LDFLAGS) -pthread -lrt
+
+-HEADERS := \
++LOCAL_HDRS := \
+ ../include/futextest.h \
+ ../include/atomic.h \
+ ../include/logging.h
+-TEST_GEN_FILES := \
++TEST_GEN_PROGS := \
+ futex_wait_timeout \
+ futex_wait_wouldblock \
+ futex_requeue_pi \
+@@ -21,5 +21,3 @@ TEST_PROGS := run.sh
+ top_srcdir = ../../../../..
+ KSFT_KHDR_INSTALL := 1
+ include ../../lib.mk
+-
+-$(TEST_GEN_FILES): $(HEADERS)
+diff --git a/tools/testing/selftests/intel_pstate/Makefile b/tools/testing/selftests/intel_pstate/Makefile
+index 7340fd6a9a9f2..9fc1a40b01276 100644
+--- a/tools/testing/selftests/intel_pstate/Makefile
++++ b/tools/testing/selftests/intel_pstate/Makefile
+@@ -2,10 +2,10 @@
+ CFLAGS := $(CFLAGS) -Wall -D_GNU_SOURCE
+ LDLIBS := $(LDLIBS) -lm
+
+-uname_M := $(shell uname -m 2>/dev/null || echo not)
+-ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/)
++ARCH ?= $(shell uname -m 2>/dev/null || echo not)
++ARCH_PROCESSED := $(shell echo $(ARCH) | sed -e s/i.86/x86/ -e s/x86_64/x86/)
+
+-ifeq (x86,$(ARCH))
++ifeq (x86,$(ARCH_PROCESSED))
+ TEST_GEN_FILES := msr aperf
+ endif
+
+diff --git a/tools/testing/selftests/kvm/include/x86.h b/tools/testing/selftests/kvm/include/x86.h
+index a7667a613bbc7..68b69f13a50d7 100644
+--- a/tools/testing/selftests/kvm/include/x86.h
++++ b/tools/testing/selftests/kvm/include/x86.h
+@@ -614,6 +614,11 @@ void vcpu_load_state(struct kvm_vm *vm, uint32_t vcpuid, struct kvm_x86_state *s
+ #define MSR_AMD64_OSVW_STATUS 0xc0010141
+ #define MSR_AMD64_LS_CFG 0xc0011020
+ #define MSR_AMD64_DC_CFG 0xc0011022
++
++#define MSR_AMD64_DE_CFG 0xc0011029
++#define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT 1
++#define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE BIT_ULL(MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT)
++
+ #define MSR_AMD64_BU_CFG2 0xc001102a
+ #define MSR_AMD64_IBSFETCHCTL 0xc0011030
+ #define MSR_AMD64_IBSFETCHLINAD 0xc0011031
+@@ -664,9 +669,6 @@ void vcpu_load_state(struct kvm_vm *vm, uint32_t vcpuid, struct kvm_x86_state *s
+ #define FAM10H_MMIO_CONF_BASE_MASK 0xfffffffULL
+ #define FAM10H_MMIO_CONF_BASE_SHIFT 20
+ #define MSR_FAM10H_NODE_ID 0xc001100c
+-#define MSR_F10H_DECFG 0xc0011029
+-#define MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT 1
+-#define MSR_F10H_DECFG_LFENCE_SERIALIZE BIT_ULL(MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT)
+
+ /* K8 MSRs */
+ #define MSR_K8_TOP_MEM1 0xc001001a
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-12-08 12:14 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2022-12-08 12:14 UTC (permalink / raw
To: gentoo-commits
commit: e6c0720f3b7c99e0afb30b73bb61ef4eb8217896
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Thu Dec 8 11:55:26 2022 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Thu Dec 8 11:55:26 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e6c0720f
Linux patch 4.19.268
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1267_linux-4.19.268.patch | 3095 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3099 insertions(+)
diff --git a/0000_README b/0000_README
index 47e22062..4871e1c3 100644
--- a/0000_README
+++ b/0000_README
@@ -1111,6 +1111,10 @@ Patch: 1266_linux-4.19.267.patch
From: https://www.kernel.org
Desc: Linux 4.19.267
+Patch: 1267_linux-4.19.268.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.268
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1267_linux-4.19.268.patch b/1267_linux-4.19.268.patch
new file mode 100644
index 00000000..03741d82
--- /dev/null
+++ b/1267_linux-4.19.268.patch
@@ -0,0 +1,3095 @@
+diff --git a/Makefile b/Makefile
+index c5a4fbb0444ba..f852f1161bed8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 267
++SUBLEVEL = 268
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/am335x-pcm-953.dtsi b/arch/arm/boot/dts/am335x-pcm-953.dtsi
+index 572fbd2546905..495c55e5b5db7 100644
+--- a/arch/arm/boot/dts/am335x-pcm-953.dtsi
++++ b/arch/arm/boot/dts/am335x-pcm-953.dtsi
+@@ -15,22 +15,20 @@
+ compatible = "phytec,am335x-pcm-953", "phytec,am335x-phycore-som", "ti,am33xx";
+
+ /* Power */
+- regulators {
+- vcc3v3: fixedregulator@1 {
+- compatible = "regulator-fixed";
+- regulator-name = "vcc3v3";
+- regulator-min-microvolt = <3300000>;
+- regulator-max-microvolt = <3300000>;
+- regulator-boot-on;
+- };
++ vcc3v3: fixedregulator1 {
++ compatible = "regulator-fixed";
++ regulator-name = "vcc3v3";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ regulator-boot-on;
++ };
+
+- vcc1v8: fixedregulator@2 {
+- compatible = "regulator-fixed";
+- regulator-name = "vcc1v8";
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
+- regulator-boot-on;
+- };
++ vcc1v8: fixedregulator2 {
++ compatible = "regulator-fixed";
++ regulator-name = "vcc1v8";
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ regulator-boot-on;
+ };
+
+ /* User IO */
+diff --git a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+index ec1f17ab6753b..0b990761d80ab 100644
+--- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
++++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+@@ -39,6 +39,13 @@
+
+ };
+
++ usb1 {
++ pinctrl_usb1_vbus_gpio: usb1_vbus_gpio {
++ atmel,pins =
++ <AT91_PIOC 5 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>; /* PC5 GPIO */
++ };
++ };
++
+ mmc0_slot1 {
+ pinctrl_board_mmc0_slot1: mmc0_slot1-board {
+ atmel,pins =
+@@ -84,6 +91,8 @@
+ };
+
+ usb1: gadget@fffa4000 {
++ pinctrl-0 = <&pinctrl_usb1_vbus_gpio>;
++ pinctrl-names = "default";
+ atmel,vbus-gpio = <&pioC 5 GPIO_ACTIVE_HIGH>;
+ status = "okay";
+ };
+diff --git a/arch/arm/mach-mxs/mach-mxs.c b/arch/arm/mach-mxs/mach-mxs.c
+index 1c6062d240c8b..4063fc1f435bb 100644
+--- a/arch/arm/mach-mxs/mach-mxs.c
++++ b/arch/arm/mach-mxs/mach-mxs.c
+@@ -393,8 +393,10 @@ static void __init mxs_machine_init(void)
+
+ root = of_find_node_by_path("/");
+ ret = of_property_read_string(root, "model", &soc_dev_attr->machine);
+- if (ret)
++ if (ret) {
++ kfree(soc_dev_attr);
+ return;
++ }
+
+ soc_dev_attr->family = "Freescale MXS Family";
+ soc_dev_attr->soc_id = mxs_get_soc_id();
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
+index 1e6a71066c163..ea990543d929b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts
+@@ -203,7 +203,7 @@
+ cap-sd-highspeed;
+ cd-gpios = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>;
+ disable-wp;
+- max-frequency = <150000000>;
++ max-frequency = <40000000>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_cd &sdmmc_bus4>;
+ vmmc-supply = <&vcc3v3_baseboard>;
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index 5435550d1c9bf..7edb587fec55d 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -142,9 +142,12 @@ static void install_bp_hardening_cb(bp_hardening_cb_t fn,
+ __copy_hyp_vect_bpi(slot, hyp_vecs_start, hyp_vecs_end);
+ }
+
+- __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
+- __this_cpu_write(bp_hardening_data.fn, fn);
+- __this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start);
++ if (fn != __this_cpu_read(bp_hardening_data.fn)) {
++ __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
++ __this_cpu_write(bp_hardening_data.fn, fn);
++ __this_cpu_write(bp_hardening_data.template_start,
++ hyp_vecs_start);
++ }
+ spin_unlock(&bp_lock);
+ }
+ #else
+@@ -1203,8 +1206,11 @@ static void kvm_setup_bhb_slot(const char *hyp_vecs_start)
+ __copy_hyp_vect_bpi(slot, hyp_vecs_start, hyp_vecs_end);
+ }
+
+- __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
+- __this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start);
++ if (hyp_vecs_start != __this_cpu_read(bp_hardening_data.template_start)) {
++ __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
++ __this_cpu_write(bp_hardening_data.template_start,
++ hyp_vecs_start);
++ }
+ spin_unlock(&bp_lock);
+ }
+ #else
+@@ -1240,7 +1246,13 @@ void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry)
+ } else if (spectre_bhb_loop_affected(SCOPE_LOCAL_CPU)) {
+ switch (spectre_bhb_loop_affected(SCOPE_SYSTEM)) {
+ case 8:
+- kvm_setup_bhb_slot(__spectre_bhb_loop_k8_start);
++ /*
++ * A57/A72-r0 will already have selected the
++ * spectre-indirect vector, which is sufficient
++ * for BHB too.
++ */
++ if (!__this_cpu_read(bp_hardening_data.fn))
++ kvm_setup_bhb_slot(__spectre_bhb_loop_k8_start);
+ break;
+ case 24:
+ kvm_setup_bhb_slot(__spectre_bhb_loop_k24_start);
+diff --git a/arch/mips/include/asm/fw/fw.h b/arch/mips/include/asm/fw/fw.h
+index d0ef8b4892bbe..d0494ce4b3373 100644
+--- a/arch/mips/include/asm/fw/fw.h
++++ b/arch/mips/include/asm/fw/fw.h
+@@ -26,6 +26,6 @@ extern char *fw_getcmdline(void);
+ extern void fw_meminit(void);
+ extern char *fw_getenv(char *name);
+ extern unsigned long fw_getenvl(char *name);
+-extern void fw_init_early_console(char port);
++extern void fw_init_early_console(void);
+
+ #endif /* __ASM_FW_H_ */
+diff --git a/arch/mips/pic32/pic32mzda/early_console.c b/arch/mips/pic32/pic32mzda/early_console.c
+index 8ed4961b1271f..c00c6149ee30b 100644
+--- a/arch/mips/pic32/pic32mzda/early_console.c
++++ b/arch/mips/pic32/pic32mzda/early_console.c
+@@ -35,7 +35,7 @@
+ #define U_BRG(x) (UART_BASE(x) + 0x40)
+
+ static void __iomem *uart_base;
+-static char console_port = -1;
++static int console_port = -1;
+
+ static int __init configure_uart_pins(int port)
+ {
+@@ -55,7 +55,7 @@ static int __init configure_uart_pins(int port)
+ return 0;
+ }
+
+-static void __init configure_uart(char port, int baud)
++static void __init configure_uart(int port, int baud)
+ {
+ u32 pbclk;
+
+@@ -68,7 +68,7 @@ static void __init configure_uart(char port, int baud)
+ uart_base + PIC32_SET(U_STA(port)));
+ }
+
+-static void __init setup_early_console(char port, int baud)
++static void __init setup_early_console(int port, int baud)
+ {
+ if (configure_uart_pins(port))
+ return;
+@@ -138,16 +138,15 @@ _out:
+ return baud;
+ }
+
+-void __init fw_init_early_console(char port)
++void __init fw_init_early_console(void)
+ {
+ char *arch_cmdline = pic32_getcmdline();
+- int baud = -1;
++ int baud, port;
+
+ uart_base = ioremap_nocache(PIC32_BASE_UART, 0xc00);
+
+ baud = get_baud_from_cmdline(arch_cmdline);
+- if (port == -1)
+- port = get_port_from_cmdline(arch_cmdline);
++ port = get_port_from_cmdline(arch_cmdline);
+
+ if (port == -1)
+ port = EARLY_CONSOLE_PORT;
+diff --git a/arch/mips/pic32/pic32mzda/init.c b/arch/mips/pic32/pic32mzda/init.c
+index 406c6c5cec29b..cf2625551b458 100644
+--- a/arch/mips/pic32/pic32mzda/init.c
++++ b/arch/mips/pic32/pic32mzda/init.c
+@@ -68,7 +68,7 @@ void __init plat_mem_setup(void)
+ strlcpy(arcs_cmdline, boot_command_line, COMMAND_LINE_SIZE);
+
+ #ifdef CONFIG_EARLY_PRINTK
+- fw_init_early_console(-1);
++ fw_init_early_console();
+ #endif
+ pic32_config_init();
+ }
+diff --git a/arch/nios2/boot/Makefile b/arch/nios2/boot/Makefile
+index 2ba23a6797320..70139de9a0dfa 100644
+--- a/arch/nios2/boot/Makefile
++++ b/arch/nios2/boot/Makefile
+@@ -20,7 +20,7 @@ $(obj)/vmlinux.bin: vmlinux FORCE
+ $(obj)/vmlinux.gz: $(obj)/vmlinux.bin FORCE
+ $(call if_changed,gzip)
+
+-$(obj)/vmImage: $(obj)/vmlinux.gz
++$(obj)/vmImage: $(obj)/vmlinux.gz FORCE
+ $(call if_changed,uimage)
+ @$(kecho) 'Kernel: $@ is ready'
+
+diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
+index 1dd134fc0d84a..ba833b79051f9 100644
+--- a/arch/riscv/kernel/vdso/Makefile
++++ b/arch/riscv/kernel/vdso/Makefile
+@@ -17,6 +17,9 @@ obj-vdso := $(addprefix $(obj)/, $(obj-vdso))
+
+ obj-y += vdso.o vdso-syms.o
+ CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
++ifneq ($(filter vgettimeofday, $(vdso-syms)),)
++CPPFLAGS_vdso.lds += -DHAS_VGETTIMEOFDAY
++endif
+
+ # Disable gcov profiling for VDSO code
+ GCOV_PROFILE := n
+diff --git a/arch/riscv/kernel/vdso/vdso.lds.S b/arch/riscv/kernel/vdso/vdso.lds.S
+index cd1d47e0724ba..8910712f6fb24 100644
+--- a/arch/riscv/kernel/vdso/vdso.lds.S
++++ b/arch/riscv/kernel/vdso/vdso.lds.S
+@@ -70,9 +70,11 @@ VERSION
+ LINUX_4.15 {
+ global:
+ __vdso_rt_sigreturn;
++#ifdef HAS_VGETTIMEOFDAY
+ __vdso_gettimeofday;
+ __vdso_clock_gettime;
+ __vdso_clock_getres;
++#endif
+ __vdso_getcpu;
+ __vdso_flush_icache;
+ local: *;
+diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
+index 376f6b6dfb3cb..7fb7d4dc18dcb 100644
+--- a/arch/s390/kernel/crash_dump.c
++++ b/arch/s390/kernel/crash_dump.c
+@@ -45,7 +45,7 @@ struct save_area {
+ u64 fprs[16];
+ u32 fpc;
+ u32 prefix;
+- u64 todpreg;
++ u32 todpreg;
+ u64 timer;
+ u64 todcmp;
+ u64 vxrs_low[16];
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index caaab0a20e262..bd4374f56651b 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -292,6 +292,7 @@
+ #define X86_FEATURE_RETPOLINE (11*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */
+ #define X86_FEATURE_RETPOLINE_LFENCE (11*32+13) /* "" Use LFENCE for Spectre variant 2 */
+ #define X86_FEATURE_RSB_VMEXIT_LITE (11*32+17) /* "" Fill RSB on VM exit when EIBRS is enabled */
++#define X86_FEATURE_MSR_TSX_CTRL (11*32+18) /* "" MSR IA32_TSX_CTRL (Intel) implemented */
+
+ /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */
+ #define X86_FEATURE_CLZERO (13*32+ 0) /* CLZERO instruction */
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 64b086c47b4a4..8dba996e9f9e3 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -4,13 +4,11 @@
+ #define _ASM_X86_NOSPEC_BRANCH_H_
+
+ #include <linux/static_key.h>
+-#include <linux/frame.h>
+
+ #include <asm/alternative.h>
+ #include <asm/alternative-asm.h>
+ #include <asm/cpufeatures.h>
+ #include <asm/msr-index.h>
+-#include <asm/unwind_hints.h>
+ #include <asm/percpu.h>
+
+ /*
+@@ -54,9 +52,9 @@
+ lfence; \
+ jmp 775b; \
+ 774: \
+- add $(BITS_PER_LONG/8) * 2, sp; \
+ dec reg; \
+ jnz 771b; \
++ add $(BITS_PER_LONG/8) * nr, sp; \
+ /* barrier for jnz misprediction */ \
+ lfence;
+ #else
+@@ -167,8 +165,10 @@
+ * monstrosity above, manually.
+ */
+ .macro FILL_RETURN_BUFFER reg:req nr:req ftr:req
+- ALTERNATIVE "jmp .Lskip_rsb_\@", "", \ftr
+- __FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP)
++ ANNOTATE_NOSPEC_ALTERNATIVE
++ ALTERNATIVE "jmp .Lskip_rsb_\@", \
++ __stringify(__FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP)) \
++ \ftr
+ .Lskip_rsb_\@:
+ .endm
+
+@@ -317,7 +317,7 @@ static inline void indirect_branch_prediction_barrier(void)
+ /* The Intel SPEC CTRL MSR base value cache */
+ extern u64 x86_spec_ctrl_base;
+ DECLARE_PER_CPU(u64, x86_spec_ctrl_current);
+-extern void write_spec_ctrl_current(u64 val, bool force);
++extern void update_spec_ctrl_cond(u64 val);
+ extern u64 spec_ctrl_current(void);
+
+ /*
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 6668f92f43213..f1f57acca1396 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -58,11 +58,18 @@ EXPORT_SYMBOL_GPL(x86_spec_ctrl_current);
+
+ static DEFINE_MUTEX(spec_ctrl_mutex);
+
++/* Update SPEC_CTRL MSR and its cached copy unconditionally */
++static void update_spec_ctrl(u64 val)
++{
++ this_cpu_write(x86_spec_ctrl_current, val);
++ wrmsrl(MSR_IA32_SPEC_CTRL, val);
++}
++
+ /*
+ * Keep track of the SPEC_CTRL MSR value for the current task, which may differ
+ * from x86_spec_ctrl_base due to STIBP/SSB in __speculation_ctrl_update().
+ */
+-void write_spec_ctrl_current(u64 val, bool force)
++void update_spec_ctrl_cond(u64 val)
+ {
+ if (this_cpu_read(x86_spec_ctrl_current) == val)
+ return;
+@@ -73,7 +80,7 @@ void write_spec_ctrl_current(u64 val, bool force)
+ * When KERNEL_IBRS this MSR is written on return-to-user, unless
+ * forced the update can be delayed until that time.
+ */
+- if (force || !cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS))
++ if (!cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS))
+ wrmsrl(MSR_IA32_SPEC_CTRL, val);
+ }
+
+@@ -1194,7 +1201,7 @@ static void __init spec_ctrl_disable_kernel_rrsba(void)
+
+ if (ia32_cap & ARCH_CAP_RRSBA) {
+ x86_spec_ctrl_base |= SPEC_CTRL_RRSBA_DIS_S;
+- write_spec_ctrl_current(x86_spec_ctrl_base, true);
++ update_spec_ctrl(x86_spec_ctrl_base);
+ }
+ }
+
+@@ -1316,7 +1323,7 @@ static void __init spectre_v2_select_mitigation(void)
+
+ if (spectre_v2_in_ibrs_mode(mode)) {
+ x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
+- write_spec_ctrl_current(x86_spec_ctrl_base, true);
++ update_spec_ctrl(x86_spec_ctrl_base);
+ }
+
+ switch (mode) {
+@@ -1420,7 +1427,7 @@ static void __init spectre_v2_select_mitigation(void)
+ static void update_stibp_msr(void * __unused)
+ {
+ u64 val = spec_ctrl_current() | (x86_spec_ctrl_base & SPEC_CTRL_STIBP);
+- write_spec_ctrl_current(val, true);
++ update_spec_ctrl(val);
+ }
+
+ /* Update x86_spec_ctrl_base in case SMT state changed. */
+@@ -1653,7 +1660,7 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void)
+ x86_amd_ssb_disable();
+ } else {
+ x86_spec_ctrl_base |= SPEC_CTRL_SSBD;
+- write_spec_ctrl_current(x86_spec_ctrl_base, true);
++ update_spec_ctrl(x86_spec_ctrl_base);
+ }
+ }
+
+@@ -1858,7 +1865,7 @@ int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which)
+ void x86_spec_ctrl_setup_ap(void)
+ {
+ if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
+- write_spec_ctrl_current(x86_spec_ctrl_base, true);
++ update_spec_ctrl(x86_spec_ctrl_base);
+
+ if (ssb_mode == SPEC_STORE_BYPASS_DISABLE)
+ x86_amd_ssb_disable();
+diff --git a/arch/x86/kernel/cpu/tsx.c b/arch/x86/kernel/cpu/tsx.c
+index 032509adf9de9..88a553ee77042 100644
+--- a/arch/x86/kernel/cpu/tsx.c
++++ b/arch/x86/kernel/cpu/tsx.c
+@@ -55,24 +55,6 @@ void tsx_enable(void)
+ wrmsrl(MSR_IA32_TSX_CTRL, tsx);
+ }
+
+-static bool __init tsx_ctrl_is_supported(void)
+-{
+- u64 ia32_cap = x86_read_arch_cap_msr();
+-
+- /*
+- * TSX is controlled via MSR_IA32_TSX_CTRL. However, support for this
+- * MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES.
+- *
+- * TSX control (aka MSR_IA32_TSX_CTRL) is only available after a
+- * microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES
+- * bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get
+- * MSR_IA32_TSX_CTRL support even after a microcode update. Thus,
+- * tsx= cmdline requests will do nothing on CPUs without
+- * MSR_IA32_TSX_CTRL support.
+- */
+- return !!(ia32_cap & ARCH_CAP_TSX_CTRL_MSR);
+-}
+-
+ static enum tsx_ctrl_states x86_get_tsx_auto_mode(void)
+ {
+ if (boot_cpu_has_bug(X86_BUG_TAA))
+@@ -86,9 +68,22 @@ void __init tsx_init(void)
+ char arg[5] = {};
+ int ret;
+
+- if (!tsx_ctrl_is_supported())
++ /*
++ * TSX is controlled via MSR_IA32_TSX_CTRL. However, support for this
++ * MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES.
++ *
++ * TSX control (aka MSR_IA32_TSX_CTRL) is only available after a
++ * microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES
++ * bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get
++ * MSR_IA32_TSX_CTRL support even after a microcode update. Thus,
++ * tsx= cmdline requests will do nothing on CPUs without
++ * MSR_IA32_TSX_CTRL support.
++ */
++ if (!(x86_read_arch_cap_msr() & ARCH_CAP_TSX_CTRL_MSR))
+ return;
+
++ setup_force_cpu_cap(X86_FEATURE_MSR_TSX_CTRL);
++
+ ret = cmdline_find_option(boot_command_line, "tsx", arg, sizeof(arg));
+ if (ret >= 0) {
+ if (!strcmp(arg, "on")) {
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index a95b9e090f9e5..e8d40a5979ec8 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -434,7 +434,7 @@ static __always_inline void __speculation_ctrl_update(unsigned long tifp,
+ }
+
+ if (updmsr)
+- write_spec_ctrl_current(msr, false);
++ update_spec_ctrl_cond(msr);
+ }
+
+ static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk)
+diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
+index adc77904fc3ed..7da9b427044cf 100644
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -171,9 +171,15 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
+ * Mappings have to be page-aligned
+ */
+ offset = phys_addr & ~PAGE_MASK;
+- phys_addr &= PHYSICAL_PAGE_MASK;
++ phys_addr &= PAGE_MASK;
+ size = PAGE_ALIGN(last_addr+1) - phys_addr;
+
++ /*
++ * Mask out any bits not part of the actual physical
++ * address, like memory encryption bits.
++ */
++ phys_addr &= PHYSICAL_PAGE_MASK;
++
+ retval = reserve_memtype(phys_addr, (u64)phys_addr + size,
+ pcm, &new_pcm);
+ if (retval) {
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index dea9d6246e008..75cd943f03a73 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -527,16 +527,23 @@ static int pm_cpu_check(const struct x86_cpu_id *c)
+
+ static void pm_save_spec_msr(void)
+ {
+- u32 spec_msr_id[] = {
+- MSR_IA32_SPEC_CTRL,
+- MSR_IA32_TSX_CTRL,
+- MSR_TSX_FORCE_ABORT,
+- MSR_IA32_MCU_OPT_CTRL,
+- MSR_AMD64_LS_CFG,
+- MSR_AMD64_DE_CFG,
++ struct msr_enumeration {
++ u32 msr_no;
++ u32 feature;
++ } msr_enum[] = {
++ { MSR_IA32_SPEC_CTRL, X86_FEATURE_MSR_SPEC_CTRL },
++ { MSR_IA32_TSX_CTRL, X86_FEATURE_MSR_TSX_CTRL },
++ { MSR_TSX_FORCE_ABORT, X86_FEATURE_TSX_FORCE_ABORT },
++ { MSR_IA32_MCU_OPT_CTRL, X86_FEATURE_SRBDS_CTRL },
++ { MSR_AMD64_LS_CFG, X86_FEATURE_LS_CFG_SSBD },
++ { MSR_AMD64_DE_CFG, X86_FEATURE_LFENCE_RDTSC },
+ };
++ int i;
+
+- msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id));
++ for (i = 0; i < ARRAY_SIZE(msr_enum); i++) {
++ if (boot_cpu_has(msr_enum[i].feature))
++ msr_build_context(&msr_enum[i].msr_no, 1);
++ }
+ }
+
+ static int pm_check_save_msr(void)
+diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
+index b85d013a9185f..d3fb350dc9eea 100644
+--- a/drivers/bus/sunxi-rsb.c
++++ b/drivers/bus/sunxi-rsb.c
+@@ -268,6 +268,9 @@ EXPORT_SYMBOL_GPL(sunxi_rsb_driver_register);
+ /* common code that starts a transfer */
+ static int _sunxi_rsb_run_xfer(struct sunxi_rsb *rsb)
+ {
++ u32 int_mask, status;
++ bool timeout;
++
+ if (readl(rsb->regs + RSB_CTRL) & RSB_CTRL_START_TRANS) {
+ dev_dbg(rsb->dev, "RSB transfer still in progress\n");
+ return -EBUSY;
+@@ -275,13 +278,23 @@ static int _sunxi_rsb_run_xfer(struct sunxi_rsb *rsb)
+
+ reinit_completion(&rsb->complete);
+
+- writel(RSB_INTS_LOAD_BSY | RSB_INTS_TRANS_ERR | RSB_INTS_TRANS_OVER,
+- rsb->regs + RSB_INTE);
++ int_mask = RSB_INTS_LOAD_BSY | RSB_INTS_TRANS_ERR | RSB_INTS_TRANS_OVER;
++ writel(int_mask, rsb->regs + RSB_INTE);
+ writel(RSB_CTRL_START_TRANS | RSB_CTRL_GLOBAL_INT_ENB,
+ rsb->regs + RSB_CTRL);
+
+- if (!wait_for_completion_io_timeout(&rsb->complete,
+- msecs_to_jiffies(100))) {
++ if (irqs_disabled()) {
++ timeout = readl_poll_timeout_atomic(rsb->regs + RSB_INTS,
++ status, (status & int_mask),
++ 10, 100000);
++ writel(status, rsb->regs + RSB_INTS);
++ } else {
++ timeout = !wait_for_completion_io_timeout(&rsb->complete,
++ msecs_to_jiffies(100));
++ status = rsb->status;
++ }
++
++ if (timeout) {
+ dev_dbg(rsb->dev, "RSB timeout\n");
+
+ /* abort the transfer */
+@@ -293,18 +306,18 @@ static int _sunxi_rsb_run_xfer(struct sunxi_rsb *rsb)
+ return -ETIMEDOUT;
+ }
+
+- if (rsb->status & RSB_INTS_LOAD_BSY) {
++ if (status & RSB_INTS_LOAD_BSY) {
+ dev_dbg(rsb->dev, "RSB busy\n");
+ return -EBUSY;
+ }
+
+- if (rsb->status & RSB_INTS_TRANS_ERR) {
+- if (rsb->status & RSB_INTS_TRANS_ERR_ACK) {
++ if (status & RSB_INTS_TRANS_ERR) {
++ if (status & RSB_INTS_TRANS_ERR_ACK) {
+ dev_dbg(rsb->dev, "RSB slave nack\n");
+ return -EINVAL;
+ }
+
+- if (rsb->status & RSB_INTS_TRANS_ERR_DATA) {
++ if (status & RSB_INTS_TRANS_ERR_DATA) {
+ dev_dbg(rsb->dev, "RSB transfer data error\n");
+ return -EIO;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+index 0db05ff4a652a..bce78af697be5 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+@@ -328,11 +328,9 @@ int amdgpu_gem_userptr_ioctl(struct drm_device *dev, void *data,
+ if (r)
+ goto release_object;
+
+- if (args->flags & AMDGPU_GEM_USERPTR_REGISTER) {
+- r = amdgpu_mn_register(bo, args->addr);
+- if (r)
+- goto release_object;
+- }
++ r = amdgpu_mn_register(bo, args->addr);
++ if (r)
++ goto release_object;
+
+ if (args->flags & AMDGPU_GEM_USERPTR_VALIDATE) {
+ r = amdgpu_ttm_tt_get_user_pages(bo->tbo.ttm,
+diff --git a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
+index f0f2ce6da8278..e67753a3d9d36 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
+@@ -324,7 +324,8 @@ static const struct dce_audio_registers audio_regs[] = {
+ audio_regs(2),
+ audio_regs(3),
+ audio_regs(4),
+- audio_regs(5)
++ audio_regs(5),
++ audio_regs(6),
+ };
+
+ #define DCE120_AUD_COMMON_MASK_SH_LIST(mask_sh)\
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index bea1d3e7e964f..7a2a148b8ec62 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -95,6 +95,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"),
+ },
+ .driver_data = (void *)&lcd800x1280_rightside_up,
++ }, { /* Acer Switch V 10 (SW5-017) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SW5-017"),
++ },
++ .driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* Anbernic Win600 */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Anbernic"),
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index a3f6933f94e30..ccfa5ceb43c0c 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -508,13 +508,17 @@ static void vmbus_add_channel_work(struct work_struct *work)
+ * Add the new device to the bus. This will kick off device-driver
+ * binding which eventually invokes the device driver's AddDevice()
+ * method.
++ *
++ * If vmbus_device_register() fails, the 'device_obj' is freed in
++ * vmbus_device_release() as called by device_unregister() in the
++ * error path of vmbus_device_register(). In the outside error
++ * path, there's no need to free it.
+ */
+ ret = vmbus_device_register(newchannel->device_obj);
+
+ if (ret != 0) {
+ pr_err("unable to add child device object (relid %d)\n",
+ newchannel->offermsg.child_relid);
+- kfree(newchannel->device_obj);
+ goto err_deq_chan;
+ }
+
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 9cbe0b00ebf74..a2a304e7d10cc 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -1634,6 +1634,7 @@ int vmbus_device_register(struct hv_device *child_device_obj)
+ ret = device_register(&child_device_obj->device);
+ if (ret) {
+ pr_err("Unable to register child device\n");
++ put_device(&child_device_obj->device);
+ return ret;
+ }
+
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index 6030cb539a7b1..1b2f750577dad 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -255,10 +255,13 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
+ */
+ if (host_bridge && host_bridge->vendor == PCI_VENDOR_ID_INTEL) {
+ for (i = 0; i < ARRAY_SIZE(tjmax_pci_table); i++) {
+- if (host_bridge->device == tjmax_pci_table[i].device)
++ if (host_bridge->device == tjmax_pci_table[i].device) {
++ pci_dev_put(host_bridge);
+ return tjmax_pci_table[i].tjmax;
++ }
+ }
+ }
++ pci_dev_put(host_bridge);
+
+ for (i = 0; i < ARRAY_SIZE(tjmax_table); i++) {
+ if (strstr(c->x86_model_id, tjmax_table[i].id))
+@@ -546,6 +549,10 @@ static void coretemp_remove_core(struct platform_data *pdata, int indx)
+ {
+ struct temp_data *tdata = pdata->core_data[indx];
+
++ /* if we errored on add then this is already gone */
++ if (!tdata)
++ return;
++
+ /* Remove the sysfs attributes */
+ sysfs_remove_group(&pdata->hwmon_dev->kobj, &tdata->attr_group);
+
+diff --git a/drivers/hwmon/i5500_temp.c b/drivers/hwmon/i5500_temp.c
+index 400e0675a90bd..03fa12c781093 100644
+--- a/drivers/hwmon/i5500_temp.c
++++ b/drivers/hwmon/i5500_temp.c
+@@ -117,7 +117,7 @@ static int i5500_temp_probe(struct pci_dev *pdev,
+ u32 tstimer;
+ s8 tsfsc;
+
+- err = pci_enable_device(pdev);
++ err = pcim_enable_device(pdev);
+ if (err) {
+ dev_err(&pdev->dev, "Failed to enable device\n");
+ return err;
+diff --git a/drivers/hwmon/ibmpex.c b/drivers/hwmon/ibmpex.c
+index ab72cabf5a955..e289c845f9704 100644
+--- a/drivers/hwmon/ibmpex.c
++++ b/drivers/hwmon/ibmpex.c
+@@ -517,6 +517,7 @@ static void ibmpex_register_bmc(int iface, struct device *dev)
+ return;
+
+ out_register:
++ list_del(&data->list);
+ hwmon_device_unregister(data->hwmon_dev);
+ out_user:
+ ipmi_destroy_user(data->user);
+diff --git a/drivers/iio/health/afe4403.c b/drivers/iio/health/afe4403.c
+index 63210a3b1b878..ae56821011813 100644
+--- a/drivers/iio/health/afe4403.c
++++ b/drivers/iio/health/afe4403.c
+@@ -253,14 +253,14 @@ static int afe4403_read_raw(struct iio_dev *indio_dev,
+ int *val, int *val2, long mask)
+ {
+ struct afe4403_data *afe = iio_priv(indio_dev);
+- unsigned int reg = afe4403_channel_values[chan->address];
+- unsigned int field = afe4403_channel_leds[chan->address];
++ unsigned int reg, field;
+ int ret;
+
+ switch (chan->type) {
+ case IIO_INTENSITY:
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
++ reg = afe4403_channel_values[chan->address];
+ ret = afe4403_read(afe, reg, val);
+ if (ret)
+ return ret;
+@@ -270,6 +270,7 @@ static int afe4403_read_raw(struct iio_dev *indio_dev,
+ case IIO_CURRENT:
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
++ field = afe4403_channel_leds[chan->address];
+ ret = regmap_field_read(afe->fields[field], val);
+ if (ret)
+ return ret;
+diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c
+index 23e1ac6501a1a..a081cdfd7071f 100644
+--- a/drivers/iio/health/afe4404.c
++++ b/drivers/iio/health/afe4404.c
+@@ -258,20 +258,20 @@ static int afe4404_read_raw(struct iio_dev *indio_dev,
+ int *val, int *val2, long mask)
+ {
+ struct afe4404_data *afe = iio_priv(indio_dev);
+- unsigned int value_reg = afe4404_channel_values[chan->address];
+- unsigned int led_field = afe4404_channel_leds[chan->address];
+- unsigned int offdac_field = afe4404_channel_offdacs[chan->address];
++ unsigned int value_reg, led_field, offdac_field;
+ int ret;
+
+ switch (chan->type) {
+ case IIO_INTENSITY:
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
++ value_reg = afe4404_channel_values[chan->address];
+ ret = regmap_read(afe->regmap, value_reg, val);
+ if (ret)
+ return ret;
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_OFFSET:
++ offdac_field = afe4404_channel_offdacs[chan->address];
+ ret = regmap_field_read(afe->fields[offdac_field], val);
+ if (ret)
+ return ret;
+@@ -281,6 +281,7 @@ static int afe4404_read_raw(struct iio_dev *indio_dev,
+ case IIO_CURRENT:
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
++ led_field = afe4404_channel_leds[chan->address];
+ ret = regmap_field_read(afe->fields[led_field], val);
+ if (ret)
+ return ret;
+@@ -303,19 +304,20 @@ static int afe4404_write_raw(struct iio_dev *indio_dev,
+ int val, int val2, long mask)
+ {
+ struct afe4404_data *afe = iio_priv(indio_dev);
+- unsigned int led_field = afe4404_channel_leds[chan->address];
+- unsigned int offdac_field = afe4404_channel_offdacs[chan->address];
++ unsigned int led_field, offdac_field;
+
+ switch (chan->type) {
+ case IIO_INTENSITY:
+ switch (mask) {
+ case IIO_CHAN_INFO_OFFSET:
++ offdac_field = afe4404_channel_offdacs[chan->address];
+ return regmap_field_write(afe->fields[offdac_field], val);
+ }
+ break;
+ case IIO_CURRENT:
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
++ led_field = afe4404_channel_leds[chan->address];
+ return regmap_field_write(afe->fields[led_field], val);
+ }
+ break;
+diff --git a/drivers/iio/industrialio-sw-trigger.c b/drivers/iio/industrialio-sw-trigger.c
+index bc6b7fb43e3a1..b4b177c168659 100644
+--- a/drivers/iio/industrialio-sw-trigger.c
++++ b/drivers/iio/industrialio-sw-trigger.c
+@@ -61,8 +61,12 @@ int iio_register_sw_trigger_type(struct iio_sw_trigger_type *t)
+
+ t->group = configfs_register_default_group(iio_triggers_group, t->name,
+ &iio_trigger_type_group_type);
+- if (IS_ERR(t->group))
++ if (IS_ERR(t->group)) {
++ mutex_lock(&iio_trigger_types_lock);
++ list_del(&t->list);
++ mutex_unlock(&iio_trigger_types_lock);
+ ret = PTR_ERR(t->group);
++ }
+
+ return ret;
+ }
+diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
+index d66ea754fffff..485362f0a213e 100644
+--- a/drivers/iio/light/Kconfig
++++ b/drivers/iio/light/Kconfig
+@@ -238,6 +238,8 @@ config RPR0521
+ tristate "ROHM RPR0521 ALS and proximity sensor driver"
+ depends on I2C
+ select REGMAP_I2C
++ select IIO_BUFFER
++ select IIO_TRIGGERED_BUFFER
+ help
+ Say Y here if you want to build support for ROHM's RPR0521
+ ambient light and proximity sensor device.
+diff --git a/drivers/iio/light/apds9960.c b/drivers/iio/light/apds9960.c
+index 1f112ae15f3c3..4d43867749658 100644
+--- a/drivers/iio/light/apds9960.c
++++ b/drivers/iio/light/apds9960.c
+@@ -55,9 +55,6 @@
+ #define APDS9960_REG_CONTROL_PGAIN_MASK_SHIFT 2
+
+ #define APDS9960_REG_CONFIG_2 0x90
+-#define APDS9960_REG_CONFIG_2_GGAIN_MASK 0x60
+-#define APDS9960_REG_CONFIG_2_GGAIN_MASK_SHIFT 5
+-
+ #define APDS9960_REG_ID 0x92
+
+ #define APDS9960_REG_STATUS 0x93
+@@ -78,6 +75,9 @@
+ #define APDS9960_REG_GCONF_1_GFIFO_THRES_MASK_SHIFT 6
+
+ #define APDS9960_REG_GCONF_2 0xa3
++#define APDS9960_REG_GCONF_2_GGAIN_MASK 0x60
++#define APDS9960_REG_GCONF_2_GGAIN_MASK_SHIFT 5
++
+ #define APDS9960_REG_GOFFSET_U 0xa4
+ #define APDS9960_REG_GOFFSET_D 0xa5
+ #define APDS9960_REG_GPULSE 0xa6
+@@ -396,9 +396,9 @@ static int apds9960_set_pxs_gain(struct apds9960_data *data, int val)
+ }
+
+ ret = regmap_update_bits(data->regmap,
+- APDS9960_REG_CONFIG_2,
+- APDS9960_REG_CONFIG_2_GGAIN_MASK,
+- idx << APDS9960_REG_CONFIG_2_GGAIN_MASK_SHIFT);
++ APDS9960_REG_GCONF_2,
++ APDS9960_REG_GCONF_2_GGAIN_MASK,
++ idx << APDS9960_REG_GCONF_2_GGAIN_MASK_SHIFT);
+ if (!ret)
+ data->pxs_gain = idx;
+ mutex_unlock(&data->lock);
+diff --git a/drivers/iio/pressure/ms5611.h b/drivers/iio/pressure/ms5611.h
+index ead9e9f858948..afcd622841ddd 100644
+--- a/drivers/iio/pressure/ms5611.h
++++ b/drivers/iio/pressure/ms5611.h
+@@ -28,13 +28,6 @@ enum {
+ MS5607,
+ };
+
+-struct ms5611_chip_info {
+- u16 prom[MS5611_PROM_WORDS_NB];
+-
+- int (*temp_and_pressure_compensate)(struct ms5611_chip_info *chip_info,
+- s32 *temp, s32 *pressure);
+-};
+-
+ /*
+ * OverSampling Rate descriptor.
+ * Warning: cmd MUST be kept aligned on a word boundary (see
+@@ -53,12 +46,15 @@ struct ms5611_state {
+ const struct ms5611_osr *pressure_osr;
+ const struct ms5611_osr *temp_osr;
+
+- int (*reset)(struct device *dev);
+- int (*read_prom_word)(struct device *dev, int index, u16 *word);
+- int (*read_adc_temp_and_pressure)(struct device *dev,
++ u16 prom[MS5611_PROM_WORDS_NB];
++
++ int (*reset)(struct ms5611_state *st);
++ int (*read_prom_word)(struct ms5611_state *st, int index, u16 *word);
++ int (*read_adc_temp_and_pressure)(struct ms5611_state *st,
+ s32 *temp, s32 *pressure);
+
+- struct ms5611_chip_info *chip_info;
++ int (*compensate_temp_and_pressure)(struct ms5611_state *st, s32 *temp,
++ s32 *pressure);
+ struct regulator *vdd;
+ };
+
+diff --git a/drivers/iio/pressure/ms5611_core.c b/drivers/iio/pressure/ms5611_core.c
+index f4ea886fdde48..5c7a734ede54c 100644
+--- a/drivers/iio/pressure/ms5611_core.c
++++ b/drivers/iio/pressure/ms5611_core.c
+@@ -88,8 +88,7 @@ static int ms5611_read_prom(struct iio_dev *indio_dev)
+ struct ms5611_state *st = iio_priv(indio_dev);
+
+ for (i = 0; i < MS5611_PROM_WORDS_NB; i++) {
+- ret = st->read_prom_word(&indio_dev->dev,
+- i, &st->chip_info->prom[i]);
++ ret = st->read_prom_word(st, i, &st->prom[i]);
+ if (ret < 0) {
+ dev_err(&indio_dev->dev,
+ "failed to read prom at %d\n", i);
+@@ -97,7 +96,7 @@ static int ms5611_read_prom(struct iio_dev *indio_dev)
+ }
+ }
+
+- if (!ms5611_prom_is_valid(st->chip_info->prom, MS5611_PROM_WORDS_NB)) {
++ if (!ms5611_prom_is_valid(st->prom, MS5611_PROM_WORDS_NB)) {
+ dev_err(&indio_dev->dev, "PROM integrity check failed\n");
+ return -ENODEV;
+ }
+@@ -111,28 +110,27 @@ static int ms5611_read_temp_and_pressure(struct iio_dev *indio_dev,
+ int ret;
+ struct ms5611_state *st = iio_priv(indio_dev);
+
+- ret = st->read_adc_temp_and_pressure(&indio_dev->dev, temp, pressure);
++ ret = st->read_adc_temp_and_pressure(st, temp, pressure);
+ if (ret < 0) {
+ dev_err(&indio_dev->dev,
+ "failed to read temperature and pressure\n");
+ return ret;
+ }
+
+- return st->chip_info->temp_and_pressure_compensate(st->chip_info,
+- temp, pressure);
++ return st->compensate_temp_and_pressure(st, temp, pressure);
+ }
+
+-static int ms5611_temp_and_pressure_compensate(struct ms5611_chip_info *chip_info,
++static int ms5611_temp_and_pressure_compensate(struct ms5611_state *st,
+ s32 *temp, s32 *pressure)
+ {
+ s32 t = *temp, p = *pressure;
+ s64 off, sens, dt;
+
+- dt = t - (chip_info->prom[5] << 8);
+- off = ((s64)chip_info->prom[2] << 16) + ((chip_info->prom[4] * dt) >> 7);
+- sens = ((s64)chip_info->prom[1] << 15) + ((chip_info->prom[3] * dt) >> 8);
++ dt = t - (st->prom[5] << 8);
++ off = ((s64)st->prom[2] << 16) + ((st->prom[4] * dt) >> 7);
++ sens = ((s64)st->prom[1] << 15) + ((st->prom[3] * dt) >> 8);
+
+- t = 2000 + ((chip_info->prom[6] * dt) >> 23);
++ t = 2000 + ((st->prom[6] * dt) >> 23);
+ if (t < 2000) {
+ s64 off2, sens2, t2;
+
+@@ -158,17 +156,17 @@ static int ms5611_temp_and_pressure_compensate(struct ms5611_chip_info *chip_inf
+ return 0;
+ }
+
+-static int ms5607_temp_and_pressure_compensate(struct ms5611_chip_info *chip_info,
++static int ms5607_temp_and_pressure_compensate(struct ms5611_state *st,
+ s32 *temp, s32 *pressure)
+ {
+ s32 t = *temp, p = *pressure;
+ s64 off, sens, dt;
+
+- dt = t - (chip_info->prom[5] << 8);
+- off = ((s64)chip_info->prom[2] << 17) + ((chip_info->prom[4] * dt) >> 6);
+- sens = ((s64)chip_info->prom[1] << 16) + ((chip_info->prom[3] * dt) >> 7);
++ dt = t - (st->prom[5] << 8);
++ off = ((s64)st->prom[2] << 17) + ((st->prom[4] * dt) >> 6);
++ sens = ((s64)st->prom[1] << 16) + ((st->prom[3] * dt) >> 7);
+
+- t = 2000 + ((chip_info->prom[6] * dt) >> 23);
++ t = 2000 + ((st->prom[6] * dt) >> 23);
+ if (t < 2000) {
+ s64 off2, sens2, t2, tmp;
+
+@@ -199,7 +197,7 @@ static int ms5611_reset(struct iio_dev *indio_dev)
+ int ret;
+ struct ms5611_state *st = iio_priv(indio_dev);
+
+- ret = st->reset(&indio_dev->dev);
++ ret = st->reset(st);
+ if (ret < 0) {
+ dev_err(&indio_dev->dev, "failed to reset device\n");
+ return ret;
+@@ -346,15 +344,6 @@ static int ms5611_write_raw(struct iio_dev *indio_dev,
+
+ static const unsigned long ms5611_scan_masks[] = {0x3, 0};
+
+-static struct ms5611_chip_info chip_info_tbl[] = {
+- [MS5611] = {
+- .temp_and_pressure_compensate = ms5611_temp_and_pressure_compensate,
+- },
+- [MS5607] = {
+- .temp_and_pressure_compensate = ms5607_temp_and_pressure_compensate,
+- }
+-};
+-
+ static const struct iio_chan_spec ms5611_channels[] = {
+ {
+ .type = IIO_PRESSURE,
+@@ -437,7 +426,20 @@ int ms5611_probe(struct iio_dev *indio_dev, struct device *dev,
+ struct ms5611_state *st = iio_priv(indio_dev);
+
+ mutex_init(&st->lock);
+- st->chip_info = &chip_info_tbl[type];
++
++ switch (type) {
++ case MS5611:
++ st->compensate_temp_and_pressure =
++ ms5611_temp_and_pressure_compensate;
++ break;
++ case MS5607:
++ st->compensate_temp_and_pressure =
++ ms5607_temp_and_pressure_compensate;
++ break;
++ default:
++ return -EINVAL;
++ }
++
+ st->temp_osr =
+ &ms5611_avail_temp_osr[ARRAY_SIZE(ms5611_avail_temp_osr) - 1];
+ st->pressure_osr =
+diff --git a/drivers/iio/pressure/ms5611_i2c.c b/drivers/iio/pressure/ms5611_i2c.c
+index 55fb5fc0b6eac..d78db17d65686 100644
+--- a/drivers/iio/pressure/ms5611_i2c.c
++++ b/drivers/iio/pressure/ms5611_i2c.c
+@@ -21,17 +21,15 @@
+
+ #include "ms5611.h"
+
+-static int ms5611_i2c_reset(struct device *dev)
++static int ms5611_i2c_reset(struct ms5611_state *st)
+ {
+- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev));
+-
+ return i2c_smbus_write_byte(st->client, MS5611_RESET);
+ }
+
+-static int ms5611_i2c_read_prom_word(struct device *dev, int index, u16 *word)
++static int ms5611_i2c_read_prom_word(struct ms5611_state *st, int index,
++ u16 *word)
+ {
+ int ret;
+- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev));
+
+ ret = i2c_smbus_read_word_swapped(st->client,
+ MS5611_READ_PROM_WORD + (index << 1));
+@@ -58,11 +56,10 @@ static int ms5611_i2c_read_adc(struct ms5611_state *st, s32 *val)
+ return 0;
+ }
+
+-static int ms5611_i2c_read_adc_temp_and_pressure(struct device *dev,
++static int ms5611_i2c_read_adc_temp_and_pressure(struct ms5611_state *st,
+ s32 *temp, s32 *pressure)
+ {
+ int ret;
+- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev));
+ const struct ms5611_osr *osr = st->temp_osr;
+
+ ret = i2c_smbus_write_byte(st->client, osr->cmd);
+diff --git a/drivers/iio/pressure/ms5611_spi.c b/drivers/iio/pressure/ms5611_spi.c
+index a582515ae2e6b..42983d0736bee 100644
+--- a/drivers/iio/pressure/ms5611_spi.c
++++ b/drivers/iio/pressure/ms5611_spi.c
+@@ -16,18 +16,17 @@
+
+ #include "ms5611.h"
+
+-static int ms5611_spi_reset(struct device *dev)
++static int ms5611_spi_reset(struct ms5611_state *st)
+ {
+ u8 cmd = MS5611_RESET;
+- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev));
+
+ return spi_write_then_read(st->client, &cmd, 1, NULL, 0);
+ }
+
+-static int ms5611_spi_read_prom_word(struct device *dev, int index, u16 *word)
++static int ms5611_spi_read_prom_word(struct ms5611_state *st, int index,
++ u16 *word)
+ {
+ int ret;
+- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev));
+
+ ret = spi_w8r16be(st->client, MS5611_READ_PROM_WORD + (index << 1));
+ if (ret < 0)
+@@ -38,11 +37,10 @@ static int ms5611_spi_read_prom_word(struct device *dev, int index, u16 *word)
+ return 0;
+ }
+
+-static int ms5611_spi_read_adc(struct device *dev, s32 *val)
++static int ms5611_spi_read_adc(struct ms5611_state *st, s32 *val)
+ {
+ int ret;
+ u8 buf[3] = { MS5611_READ_ADC };
+- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev));
+
+ ret = spi_write_then_read(st->client, buf, 1, buf, 3);
+ if (ret < 0)
+@@ -53,11 +51,10 @@ static int ms5611_spi_read_adc(struct device *dev, s32 *val)
+ return 0;
+ }
+
+-static int ms5611_spi_read_adc_temp_and_pressure(struct device *dev,
++static int ms5611_spi_read_adc_temp_and_pressure(struct ms5611_state *st,
+ s32 *temp, s32 *pressure)
+ {
+ int ret;
+- struct ms5611_state *st = iio_priv(dev_to_iio_dev(dev));
+ const struct ms5611_osr *osr = st->temp_osr;
+
+ /*
+@@ -69,7 +66,7 @@ static int ms5611_spi_read_adc_temp_and_pressure(struct device *dev,
+ return ret;
+
+ usleep_range(osr->conv_usec, osr->conv_usec + (osr->conv_usec / 10UL));
+- ret = ms5611_spi_read_adc(dev, temp);
++ ret = ms5611_spi_read_adc(st, temp);
+ if (ret < 0)
+ return ret;
+
+@@ -79,7 +76,7 @@ static int ms5611_spi_read_adc_temp_and_pressure(struct device *dev,
+ return ret;
+
+ usleep_range(osr->conv_usec, osr->conv_usec + (osr->conv_usec / 10UL));
+- return ms5611_spi_read_adc(dev, pressure);
++ return ms5611_spi_read_adc(st, pressure);
+ }
+
+ static int ms5611_spi_probe(struct spi_device *spi)
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index c6d393114502d..7dc8ca5fd75f2 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -192,6 +192,7 @@ static const char * const smbus_pnp_ids[] = {
+ "SYN3221", /* HP 15-ay000 */
+ "SYN323d", /* HP Spectre X360 13-w013dx */
+ "SYN3257", /* HP Envy 13-ad105ng */
++ "SYN3286", /* HP Laptop 15-da3001TU */
+ NULL
+ };
+
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 017786d62f474..3ea851583724a 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -804,6 +804,7 @@ int __init dmar_dev_scope_init(void)
+ info = dmar_alloc_pci_notify_info(dev,
+ BUS_NOTIFY_ADD_DEVICE);
+ if (!info) {
++ pci_dev_put(dev);
+ return dmar_dev_scope_status;
+ } else {
+ dmar_pci_bus_add_dev(info);
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 8456e82409e20..b054271066ace 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -2116,10 +2116,6 @@ static void integrity_writer(struct work_struct *w)
+
+ unsigned prev_free_sectors;
+
+- /* the following test is not needed, but it tests the replay code */
+- if (unlikely(dm_post_suspending(ic->ti)) && !ic->meta_dev)
+- return;
+-
+ spin_lock_irq(&ic->endio_wait.lock);
+ write_start = ic->committed_section;
+ write_sections = ic->n_committed_sections;
+@@ -2455,8 +2451,7 @@ static void dm_integrity_postsuspend(struct dm_target *ti)
+ drain_workqueue(ic->commit_wq);
+
+ if (ic->mode == 'J') {
+- if (ic->meta_dev)
+- queue_work(ic->writer_wq, &ic->writer_work);
++ queue_work(ic->writer_wq, &ic->writer_work);
+ drain_workqueue(ic->writer_wq);
+ dm_integrity_flush_buffers(ic, true);
+ }
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 8ff37f06e6917..57be129fe4f33 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -13,6 +13,7 @@
+ * - JMicron (hardware and technical support)
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/delay.h>
+ #include <linux/ktime.h>
+ #include <linux/highmem.h>
+@@ -263,6 +264,7 @@ static void sdhci_init(struct sdhci_host *host, int soft)
+ if (soft) {
+ /* force clock reconfiguration */
+ host->clock = 0;
++ host->reinit_uhs = true;
+ mmc->ops->set_ios(mmc, &mmc->ios);
+ }
+ }
+@@ -1418,10 +1420,9 @@ u16 sdhci_calc_clk(struct sdhci_host *host, unsigned int clock,
+
+ clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
+ pre_val = sdhci_get_preset_value(host);
+- div = (pre_val & SDHCI_PRESET_SDCLK_FREQ_MASK)
+- >> SDHCI_PRESET_SDCLK_FREQ_SHIFT;
++ div = FIELD_GET(SDHCI_PRESET_SDCLK_FREQ_MASK, pre_val);
+ if (host->clk_mul &&
+- (pre_val & SDHCI_PRESET_CLKGEN_SEL_MASK)) {
++ (pre_val & SDHCI_PRESET_CLKGEN_SEL)) {
+ clk = SDHCI_PROG_CLOCK_MODE;
+ real_div = div + 1;
+ clk_mul = host->clk_mul;
+@@ -1736,11 +1737,46 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing)
+ }
+ EXPORT_SYMBOL_GPL(sdhci_set_uhs_signaling);
+
++static bool sdhci_timing_has_preset(unsigned char timing)
++{
++ switch (timing) {
++ case MMC_TIMING_UHS_SDR12:
++ case MMC_TIMING_UHS_SDR25:
++ case MMC_TIMING_UHS_SDR50:
++ case MMC_TIMING_UHS_SDR104:
++ case MMC_TIMING_UHS_DDR50:
++ case MMC_TIMING_MMC_DDR52:
++ return true;
++ };
++ return false;
++}
++
++static bool sdhci_preset_needed(struct sdhci_host *host, unsigned char timing)
++{
++ return !(host->quirks2 & SDHCI_QUIRK2_PRESET_VALUE_BROKEN) &&
++ sdhci_timing_has_preset(timing);
++}
++
++static bool sdhci_presetable_values_change(struct sdhci_host *host, struct mmc_ios *ios)
++{
++ /*
++ * Preset Values are: Driver Strength, Clock Generator and SDCLK/RCLK
++ * Frequency. Check if preset values need to be enabled, or the Driver
++ * Strength needs updating. Note, clock changes are handled separately.
++ */
++ return !host->preset_enabled &&
++ (sdhci_preset_needed(host, ios->timing) || host->drv_type != ios->drv_type);
++}
++
+ void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ {
+ struct sdhci_host *host = mmc_priv(mmc);
++ bool reinit_uhs = host->reinit_uhs;
++ bool turning_on_clk = false;
+ u8 ctrl;
+
++ host->reinit_uhs = false;
++
+ if (ios->power_mode == MMC_POWER_UNDEFINED)
+ return;
+
+@@ -1766,6 +1802,8 @@ void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ sdhci_enable_preset_value(host, false);
+
+ if (!ios->clock || ios->clock != host->clock) {
++ turning_on_clk = ios->clock && !host->clock;
++
+ host->ops->set_clock(host, ios->clock);
+ host->clock = ios->clock;
+
+@@ -1792,6 +1830,17 @@ void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+
+ host->ops->set_bus_width(host, ios->bus_width);
+
++ /*
++ * Special case to avoid multiple clock changes during voltage
++ * switching.
++ */
++ if (!reinit_uhs &&
++ turning_on_clk &&
++ host->timing == ios->timing &&
++ host->version >= SDHCI_SPEC_300 &&
++ !sdhci_presetable_values_change(host, ios))
++ return;
++
+ ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL);
+
+ if (!(host->quirks & SDHCI_QUIRK_NO_HISPD_BIT)) {
+@@ -1835,6 +1884,7 @@ void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ }
+
+ sdhci_writew(host, ctrl_2, SDHCI_HOST_CONTROL2);
++ host->drv_type = ios->drv_type;
+ } else {
+ /*
+ * According to SDHC Spec v3.00, if the Preset Value
+@@ -1862,19 +1912,14 @@ void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ host->ops->set_uhs_signaling(host, ios->timing);
+ host->timing = ios->timing;
+
+- if (!(host->quirks2 & SDHCI_QUIRK2_PRESET_VALUE_BROKEN) &&
+- ((ios->timing == MMC_TIMING_UHS_SDR12) ||
+- (ios->timing == MMC_TIMING_UHS_SDR25) ||
+- (ios->timing == MMC_TIMING_UHS_SDR50) ||
+- (ios->timing == MMC_TIMING_UHS_SDR104) ||
+- (ios->timing == MMC_TIMING_UHS_DDR50) ||
+- (ios->timing == MMC_TIMING_MMC_DDR52))) {
++ if (sdhci_preset_needed(host, ios->timing)) {
+ u16 preset;
+
+ sdhci_enable_preset_value(host, true);
+ preset = sdhci_get_preset_value(host);
+- ios->drv_type = (preset & SDHCI_PRESET_DRV_MASK)
+- >> SDHCI_PRESET_DRV_SHIFT;
++ ios->drv_type = FIELD_GET(SDHCI_PRESET_DRV_MASK,
++ preset);
++ host->drv_type = ios->drv_type;
+ }
+
+ /* Re-enable SD Clock */
+@@ -3128,6 +3173,7 @@ int sdhci_resume_host(struct sdhci_host *host)
+ sdhci_init(host, 0);
+ host->pwr = 0;
+ host->clock = 0;
++ host->reinit_uhs = true;
+ mmc->ops->set_ios(mmc, &mmc->ios);
+ } else {
+ sdhci_init(host, (host->mmc->pm_flags & MMC_PM_KEEP_POWER));
+@@ -3191,6 +3237,7 @@ int sdhci_runtime_resume_host(struct sdhci_host *host)
+ /* Force clock and power re-program */
+ host->pwr = 0;
+ host->clock = 0;
++ host->reinit_uhs = true;
+ mmc->ops->start_signal_voltage_switch(mmc, &mmc->ios);
+ mmc->ops->set_ios(mmc, &mmc->ios);
+
+diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
+index 2959fed39a385..fe610331eee61 100644
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -13,6 +13,7 @@
+ #ifndef __SDHCI_HW_H
+ #define __SDHCI_HW_H
+
++#include <linux/bits.h>
+ #include <linux/scatterlist.h>
+ #include <linux/compiler.h>
+ #include <linux/types.h>
+@@ -259,12 +260,9 @@
+ #define SDHCI_PRESET_FOR_SDR104 0x6C
+ #define SDHCI_PRESET_FOR_DDR50 0x6E
+ #define SDHCI_PRESET_FOR_HS400 0x74 /* Non-standard */
+-#define SDHCI_PRESET_DRV_MASK 0xC000
+-#define SDHCI_PRESET_DRV_SHIFT 14
+-#define SDHCI_PRESET_CLKGEN_SEL_MASK 0x400
+-#define SDHCI_PRESET_CLKGEN_SEL_SHIFT 10
+-#define SDHCI_PRESET_SDCLK_FREQ_MASK 0x3FF
+-#define SDHCI_PRESET_SDCLK_FREQ_SHIFT 0
++#define SDHCI_PRESET_DRV_MASK GENMASK(15, 14)
++#define SDHCI_PRESET_CLKGEN_SEL BIT(10)
++#define SDHCI_PRESET_SDCLK_FREQ_MASK GENMASK(9, 0)
+
+ #define SDHCI_SLOT_INT_STATUS 0xFC
+
+@@ -503,6 +501,8 @@ struct sdhci_host {
+
+ unsigned int clock; /* Current clock (MHz) */
+ u8 pwr; /* Current voltage */
++ u8 drv_type; /* Current UHS-I driver type */
++ bool reinit_uhs; /* Force UHS-related re-initialization */
+
+ bool runtime_suspended; /* Host is runtime suspended */
+ bool bus_on; /* Bus power prevents runtime suspend */
+diff --git a/drivers/net/can/cc770/cc770_isa.c b/drivers/net/can/cc770/cc770_isa.c
+index fcd34698074f7..9f2bc66572e44 100644
+--- a/drivers/net/can/cc770/cc770_isa.c
++++ b/drivers/net/can/cc770/cc770_isa.c
+@@ -272,22 +272,24 @@ static int cc770_isa_probe(struct platform_device *pdev)
+ if (err) {
+ dev_err(&pdev->dev,
+ "couldn't register device (err=%d)\n", err);
+- goto exit_unmap;
++ goto exit_free;
+ }
+
+ dev_info(&pdev->dev, "device registered (reg_base=0x%p, irq=%d)\n",
+ priv->reg_base, dev->irq);
+ return 0;
+
+- exit_unmap:
++exit_free:
++ free_cc770dev(dev);
++exit_unmap:
+ if (mem[idx])
+ iounmap(base);
+- exit_release:
++exit_release:
+ if (mem[idx])
+ release_mem_region(mem[idx], iosize);
+ else
+ release_region(port[idx], iosize);
+- exit:
++exit:
+ return err;
+ }
+
+diff --git a/drivers/net/can/sja1000/sja1000_isa.c b/drivers/net/can/sja1000/sja1000_isa.c
+index 1a2ae6ce8d872..b11f3431fd85b 100644
+--- a/drivers/net/can/sja1000/sja1000_isa.c
++++ b/drivers/net/can/sja1000/sja1000_isa.c
+@@ -213,22 +213,24 @@ static int sja1000_isa_probe(struct platform_device *pdev)
+ if (err) {
+ dev_err(&pdev->dev, "registering %s failed (err=%d)\n",
+ DRV_NAME, err);
+- goto exit_unmap;
++ goto exit_free;
+ }
+
+ dev_info(&pdev->dev, "%s device registered (reg_base=0x%p, irq=%d)\n",
+ DRV_NAME, priv->reg_base, dev->irq);
+ return 0;
+
+- exit_unmap:
++exit_free:
++ free_sja1000dev(dev);
++exit_unmap:
+ if (mem[idx])
+ iounmap(base);
+- exit_release:
++exit_release:
+ if (mem[idx])
+ release_mem_region(mem[idx], iosize);
+ else
+ release_region(port[idx], iosize);
+- exit:
++exit:
+ return err;
+ }
+
+diff --git a/drivers/net/dsa/lan9303-core.c b/drivers/net/dsa/lan9303-core.c
+index 70ce37cd94af5..03dc075ff4e85 100644
+--- a/drivers/net/dsa/lan9303-core.c
++++ b/drivers/net/dsa/lan9303-core.c
+@@ -966,7 +966,7 @@ static const struct lan9303_mib_desc lan9303_mib[] = {
+ { .offset = LAN9303_MAC_TX_BRDCST_CNT_0, .name = "TxBroad", },
+ { .offset = LAN9303_MAC_TX_PAUSE_CNT_0, .name = "TxPause", },
+ { .offset = LAN9303_MAC_TX_MULCST_CNT_0, .name = "TxMulti", },
+- { .offset = LAN9303_MAC_RX_UNDSZE_CNT_0, .name = "TxUnderRun", },
++ { .offset = LAN9303_MAC_RX_UNDSZE_CNT_0, .name = "RxShort", },
+ { .offset = LAN9303_MAC_TX_64_CNT_0, .name = "Tx64Byte", },
+ { .offset = LAN9303_MAC_TX_127_CNT_0, .name = "Tx128Byte", },
+ { .offset = LAN9303_MAC_TX_255_CNT_0, .name = "Tx256Byte", },
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+index b3ff8d13c31af..83868f49b6c74 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+@@ -806,16 +806,20 @@ static void bnx2x_vf_enable_traffic(struct bnx2x *bp, struct bnx2x_virtf *vf)
+
+ static u8 bnx2x_vf_is_pcie_pending(struct bnx2x *bp, u8 abs_vfid)
+ {
+- struct pci_dev *dev;
+ struct bnx2x_virtf *vf = bnx2x_vf_by_abs_fid(bp, abs_vfid);
++ struct pci_dev *dev;
++ bool pending;
+
+ if (!vf)
+ return false;
+
+ dev = pci_get_domain_bus_and_slot(vf->domain, vf->bus, vf->devfn);
+- if (dev)
+- return bnx2x_is_pcie_pending(dev);
+- return false;
++ if (!dev)
++ return false;
++ pending = bnx2x_is_pcie_pending(dev);
++ pci_dev_put(dev);
++
++ return pending;
+ }
+
+ int bnx2x_vf_flr_clnup_epilog(struct bnx2x *bp, u8 abs_vfid)
+diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+index e5fc89813852c..3cde9a2a0ab7f 100644
+--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+@@ -1447,8 +1447,10 @@ static acpi_status bgx_acpi_match_id(acpi_handle handle, u32 lvl,
+ return AE_OK;
+ }
+
+- if (strncmp(string.pointer, bgx_sel, 4))
++ if (strncmp(string.pointer, bgx_sel, 4)) {
++ kfree(string.pointer);
+ return AE_OK;
++ }
+
+ acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, 1,
+ bgx_acpi_register_phy, NULL, bgx, NULL);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
+index 427e7a31862c2..d7f2890c254fe 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
+@@ -697,7 +697,8 @@ static int mlx4_create_zones(struct mlx4_dev *dev,
+ err = mlx4_bitmap_init(*bitmap + k, 1,
+ MLX4_QP_TABLE_RAW_ETH_SIZE - 1, 0,
+ 0);
+- mlx4_bitmap_alloc_range(*bitmap + k, 1, 1, 0);
++ if (!err)
++ mlx4_bitmap_alloc_range(*bitmap + k, 1, 1, 0);
+ }
+
+ if (err)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index a686082762df7..14cdac9805207 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -1324,8 +1324,8 @@ static ssize_t outlen_write(struct file *filp, const char __user *buf,
+ return -EFAULT;
+
+ err = sscanf(outlen_str, "%d", &outlen);
+- if (err < 0)
+- return err;
++ if (err != 1)
++ return -EINVAL;
+
+ ptr = kzalloc(outlen, GFP_KERNEL);
+ if (!ptr)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+index a22e932a00b01..ef9f932f02263 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+@@ -600,7 +600,7 @@ static void mlx5_tracer_handle_timestamp_trace(struct mlx5_fw_tracer *tracer,
+ trace_timestamp = (timestamp_event.timestamp & MASK_52_7) |
+ (str_frmt->timestamp & MASK_6_0);
+ else
+- trace_timestamp = ((timestamp_event.timestamp & MASK_52_7) - 1) |
++ trace_timestamp = ((timestamp_event.timestamp - 1) & MASK_52_7) |
+ (str_frmt->timestamp & MASK_6_0);
+
+ mlx5_tracer_print_trace(str_frmt, dev, trace_timestamp);
+diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+index 5a45648e31245..d85d51201e368 100644
+--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
++++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+@@ -1177,6 +1177,7 @@ static void pch_gbe_tx_queue(struct pch_gbe_adapter *adapter,
+ buffer_info->dma = 0;
+ buffer_info->time_stamp = 0;
+ tx_ring->next_to_use = ring_num;
++ dev_kfree_skb_any(skb);
+ return;
+ }
+ buffer_info->mapped = true;
+@@ -2491,6 +2492,7 @@ static void pch_gbe_remove(struct pci_dev *pdev)
+ unregister_netdev(netdev);
+
+ pch_gbe_phy_hw_reset(&adapter->hw);
++ pci_dev_put(adapter->ptp_pdev);
+
+ free_netdev(netdev);
+ }
+@@ -2572,7 +2574,7 @@ static int pch_gbe_probe(struct pci_dev *pdev,
+ /* setup the private structure */
+ ret = pch_gbe_sw_init(adapter);
+ if (ret)
+- goto err_free_netdev;
++ goto err_put_dev;
+
+ /* Initialize PHY */
+ ret = pch_gbe_init_phy(adapter);
+@@ -2630,6 +2632,8 @@ static int pch_gbe_probe(struct pci_dev *pdev,
+
+ err_free_adapter:
+ pch_gbe_phy_hw_reset(&adapter->hw);
++err_put_dev:
++ pci_dev_put(adapter->ptp_pdev);
+ err_free_netdev:
+ free_netdev(netdev);
+ return ret;
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
+index 51e17a635d4b5..7a65a1534e41a 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -2477,6 +2477,7 @@ static netdev_tx_t ql3xxx_send(struct sk_buff *skb,
+ skb_shinfo(skb)->nr_frags);
+ if (tx_cb->seg_count == -1) {
+ netdev_err(ndev, "%s: invalid segment count!\n", __func__);
++ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+index d857d44547a53..b3f1f1bd52a84 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+@@ -2993,7 +2993,7 @@ static void qlcnic_83xx_recover_driver_lock(struct qlcnic_adapter *adapter)
+ QLCWRX(adapter->ahw, QLC_83XX_RECOVER_DRV_LOCK, val);
+ dev_info(&adapter->pdev->dev,
+ "%s: lock recovery initiated\n", __func__);
+- msleep(QLC_83XX_DRV_LOCK_RECOVERY_DELAY);
++ mdelay(QLC_83XX_DRV_LOCK_RECOVERY_DELAY);
+ val = QLCRDX(adapter->ahw, QLC_83XX_RECOVER_DRV_LOCK);
+ id = ((val >> 2) & 0xF);
+ if (id == adapter->portnum) {
+@@ -3029,7 +3029,7 @@ int qlcnic_83xx_lock_driver(struct qlcnic_adapter *adapter)
+ if (status)
+ break;
+
+- msleep(QLC_83XX_DRV_LOCK_WAIT_DELAY);
++ mdelay(QLC_83XX_DRV_LOCK_WAIT_DELAY);
+ i++;
+
+ if (i == 1)
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index c24b7ea37e399..9077014f6f403 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -2310,6 +2310,7 @@ static int __maybe_unused ravb_resume(struct device *dev)
+ ret = ravb_open(ndev);
+ if (ret < 0)
+ return ret;
++ ravb_set_rx_mode(ndev);
+ netif_device_attach(ndev);
+ }
+
+diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c
+index df8d49ad48c38..33974e7519cef 100644
+--- a/drivers/net/ntb_netdev.c
++++ b/drivers/net/ntb_netdev.c
+@@ -506,7 +506,14 @@ static int __init ntb_netdev_init_module(void)
+ rc = ntb_transport_register_client_dev(KBUILD_MODNAME);
+ if (rc)
+ return rc;
+- return ntb_transport_register_client(&ntb_netdev_client);
++
++ rc = ntb_transport_register_client(&ntb_netdev_client);
++ if (rc) {
++ ntb_transport_unregister_client_dev(KBUILD_MODNAME);
++ return rc;
++ }
++
++ return 0;
+ }
+ module_init(ntb_netdev_init_module);
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index a03d0627efb06..4d29865d97a45 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1083,6 +1083,7 @@ error:
+
+ error_module_put:
+ module_put(d->driver->owner);
++ d->driver = NULL;
+ error_put_device:
+ put_device(d);
+ if (ndev_owner != bus->owner)
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 8df651999b2bf..5194b2ccd4b75 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -756,7 +756,6 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
+ if (tun)
+ xdp_rxq_info_unreg(&tfile->xdp_rxq);
+ ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free);
+- sock_put(&tfile->sk);
+ }
+ }
+
+@@ -772,6 +771,9 @@ static void tun_detach(struct tun_file *tfile, bool clean)
+ if (dev)
+ netdev_state_change(dev);
+ rtnl_unlock();
++
++ if (clean)
++ sock_put(&tfile->sk);
+ }
+
+ static void tun_detach_all(struct net_device *dev)
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 56115792bea16..24fb9708fb11d 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1317,6 +1317,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
+ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x103a, 0)}, /* Telit LE910C4-WWX */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index c52802adb5b24..22738ba7d65b2 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -686,6 +686,7 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
+ struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
+ struct sk_buff *skb;
+ struct ieee80211_hdr *hdr;
++ struct ieee80211_tx_info *cb;
+
+ if (!vp->assoc)
+ return;
+@@ -707,6 +708,10 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
+ memcpy(hdr->addr2, mac, ETH_ALEN);
+ memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
+
++ cb = IEEE80211_SKB_CB(skb);
++ cb->control.rates[0].count = 1;
++ cb->control.rates[1].idx = -1;
++
+ rcu_read_lock();
+ mac80211_hwsim_tx_frame(data->hw, skb,
+ rcu_dereference(vif->chanctx_conf)->def.chan);
+diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c
+index 5d6e7e931bc6c..cdf9e915c974b 100644
+--- a/drivers/nfc/st-nci/se.c
++++ b/drivers/nfc/st-nci/se.c
+@@ -338,7 +338,7 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,
+ * AID 81 5 to 16
+ * PARAMETERS 82 0 to 255
+ */
+- if (skb->len < NFC_MIN_AID_LENGTH + 2 &&
++ if (skb->len < NFC_MIN_AID_LENGTH + 2 ||
+ skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG)
+ return -EPROTO;
+
+@@ -352,8 +352,10 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,
+
+ /* Check next byte is PARAMETERS tag (82) */
+ if (skb->data[transaction->aid_len + 2] !=
+- NFC_EVT_TRANSACTION_PARAMS_TAG)
++ NFC_EVT_TRANSACTION_PARAMS_TAG) {
++ devm_kfree(dev, transaction);
+ return -EPROTO;
++ }
+
+ transaction->params_len = skb->data[transaction->aid_len + 3];
+ memcpy(transaction->params, skb->data +
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 986912e680d86..f47f3b9921613 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2675,11 +2675,17 @@ static long nvme_dev_ioctl(struct file *file, unsigned int cmd,
+ case NVME_IOCTL_IO_CMD:
+ return nvme_dev_user_cmd(ctrl, argp);
+ case NVME_IOCTL_RESET:
++ if (!capable(CAP_SYS_ADMIN))
++ return -EACCES;
+ dev_warn(ctrl->device, "resetting controller\n");
+ return nvme_reset_ctrl_sync(ctrl);
+ case NVME_IOCTL_SUBSYS_RESET:
++ if (!capable(CAP_SYS_ADMIN))
++ return -EACCES;
+ return nvme_reset_subsystem(ctrl);
+ case NVME_IOCTL_RESCAN:
++ if (!capable(CAP_SYS_ADMIN))
++ return -EACCES;
+ nvme_queue_scan(ctrl);
+ return 0;
+ default:
+diff --git a/drivers/of/property.c b/drivers/of/property.c
+index 43720c2de138b..13c7e55f5cbad 100644
+--- a/drivers/of/property.c
++++ b/drivers/of/property.c
+@@ -918,8 +918,10 @@ of_fwnode_get_reference_args(const struct fwnode_handle *fwnode,
+ nargs, index, &of_args);
+ if (ret < 0)
+ return ret;
+- if (!args)
++ if (!args) {
++ of_node_put(of_args.np);
+ return 0;
++ }
+
+ args->nargs = of_args.args_count;
+ args->fwnode = of_fwnode_handle(of_args.np);
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
+index 5e0adb00b4307..f9eb37bb39051 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.c
++++ b/drivers/pinctrl/intel/pinctrl-intel.c
+@@ -423,9 +423,14 @@ static void __intel_gpio_set_direction(void __iomem *padcfg0, bool input)
+ writel(value, padcfg0);
+ }
+
++static int __intel_gpio_get_gpio_mode(u32 value)
++{
++ return (value & PADCFG0_PMODE_MASK) >> PADCFG0_PMODE_SHIFT;
++}
++
+ static int intel_gpio_get_gpio_mode(void __iomem *padcfg0)
+ {
+- return (readl(padcfg0) & PADCFG0_PMODE_MASK) >> PADCFG0_PMODE_SHIFT;
++ return __intel_gpio_get_gpio_mode(readl(padcfg0));
+ }
+
+ static void intel_gpio_set_gpio_mode(void __iomem *padcfg0)
+@@ -1429,6 +1434,7 @@ EXPORT_SYMBOL_GPL(intel_pinctrl_probe);
+ static bool intel_pinctrl_should_save(struct intel_pinctrl *pctrl, unsigned pin)
+ {
+ const struct pin_desc *pd = pin_desc_get(pctrl->pctldev, pin);
++ u32 value;
+
+ if (!pd || !intel_pad_usable(pctrl, pin))
+ return false;
+@@ -1443,6 +1449,25 @@ static bool intel_pinctrl_should_save(struct intel_pinctrl *pctrl, unsigned pin)
+ gpiochip_line_is_irq(&pctrl->chip, pin))
+ return true;
+
++ /*
++ * The firmware on some systems may configure GPIO pins to be
++ * an interrupt source in so called "direct IRQ" mode. In such
++ * cases the GPIO controller driver has no idea if those pins
++ * are being used or not. At the same time, there is a known bug
++ * in the firmwares that don't restore the pin settings correctly
++ * after suspend, i.e. by an unknown reason the Rx value becomes
++ * inverted.
++ *
++ * Hence, let's save and restore the pins that are configured
++ * as GPIOs in the input mode with GPIROUTIOXAPIC bit set.
++ *
++ * See https://bugzilla.kernel.org/show_bug.cgi?id=214749.
++ */
++ value = readl(intel_get_padcfg(pctrl, pin, PADCFG0));
++ if ((value & PADCFG0_GPIROUTIOXAPIC) && (value & PADCFG0_GPIOTXDIS) &&
++ (__intel_gpio_get_gpio_mode(value) == PADCFG0_PMODE_GPIO))
++ return true;
++
+ return false;
+ }
+
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index c2f807bf34899..2b50030ad97e0 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -703,7 +703,7 @@ static int pcs_allocate_pin_table(struct pcs_device *pcs)
+
+ mux_bytes = pcs->width / BITS_PER_BYTE;
+
+- if (pcs->bits_per_mux) {
++ if (pcs->bits_per_mux && pcs->fmask) {
+ pcs->bits_per_pin = fls(pcs->fmask);
+ nr_pins = (pcs->size * BITS_PER_BYTE) / pcs->bits_per_pin;
+ num_pins_in_register = pcs->width / pcs->bits_per_pin;
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index c73ce07b66c9a..9387a370b2ff8 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -550,6 +550,15 @@ static const struct dmi_system_id acer_quirks[] __initconst = {
+ },
+ .driver_data = (void *)ACER_CAP_KBD_DOCK,
+ },
++ {
++ .callback = set_force_caps,
++ .ident = "Acer Aspire Switch V 10 SW5-017",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SW5-017"),
++ },
++ .driver_data = (void *)ACER_CAP_KBD_DOCK,
++ },
+ {
+ .callback = set_force_caps,
+ .ident = "Acer One 10 (S1003)",
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index 339b753ba447f..3723ae37993d6 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -1176,6 +1176,8 @@ static void asus_wmi_set_xusb2pr(struct asus_wmi *asus)
+ pci_write_config_dword(xhci_pdev, USB_INTEL_XUSB2PR,
+ cpu_to_le32(ports_available));
+
++ pci_dev_put(xhci_pdev);
++
+ pr_info("set USB_INTEL_XUSB2PR old: 0x%04x, new: 0x%04x\n",
+ orig_ports_available, ports_available);
+ }
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index ba1a3e2fcebe4..c65b800310f3a 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -76,6 +76,7 @@ enum hp_wmi_event_ids {
+ HPWMI_PEAKSHIFT_PERIOD = 0x0F,
+ HPWMI_BATTERY_CHARGE_PERIOD = 0x10,
+ HPWMI_SANITIZATION_MODE = 0x17,
++ HPWMI_SMART_EXPERIENCE_APP = 0x21,
+ };
+
+ struct bios_args {
+@@ -634,6 +635,8 @@ static void hp_wmi_notify(u32 value, void *context)
+ break;
+ case HPWMI_SANITIZATION_MODE:
+ break;
++ case HPWMI_SMART_EXPERIENCE_APP:
++ break;
+ default:
+ pr_info("Unknown event_id - %d - 0x%x\n", event_id, event_data);
+ break;
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index a2e34c853ca98..4d6fd3205be75 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -3788,7 +3788,6 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_raw(struct dasd_device *startdev,
+ struct dasd_device *basedev;
+ struct req_iterator iter;
+ struct dasd_ccw_req *cqr;
+- unsigned int first_offs;
+ unsigned int trkcount;
+ unsigned long *idaws;
+ unsigned int size;
+@@ -3822,7 +3821,6 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_raw(struct dasd_device *startdev,
+ last_trk = (blk_rq_pos(req) + blk_rq_sectors(req) - 1) /
+ DASD_RAW_SECTORS_PER_TRACK;
+ trkcount = last_trk - first_trk + 1;
+- first_offs = 0;
+
+ if (rq_data_dir(req) == READ)
+ cmd = DASD_ECKD_CCW_READ_TRACK;
+@@ -3866,13 +3864,13 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_raw(struct dasd_device *startdev,
+
+ if (use_prefix) {
+ prefix_LRE(ccw++, data, first_trk, last_trk, cmd, basedev,
+- startdev, 1, first_offs + 1, trkcount, 0, 0);
++ startdev, 1, 0, trkcount, 0, 0);
+ } else {
+ define_extent(ccw++, data, first_trk, last_trk, cmd, basedev, 0);
+ ccw[-1].flags |= CCW_FLAG_CC;
+
+ data += sizeof(struct DE_eckd_data);
+- locate_record_ext(ccw++, data, first_trk, first_offs + 1,
++ locate_record_ext(ccw++, data, first_trk, 0,
+ trkcount, cmd, basedev, 0, 0);
+ }
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 5b6f3655c366a..ec2296a4c44dd 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -429,8 +429,7 @@ static unsigned int mx51_ecspi_clkdiv(struct spi_imx_data *spi_imx,
+ unsigned int pre, post;
+ unsigned int fin = spi_imx->spi_clk;
+
+- if (unlikely(fspi > fin))
+- return 0;
++ fspi = min(fspi, fin);
+
+ post = fls(fin) - fls(fspi);
+ if (fin > fspi << post)
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 8d692f16d90ac..b8565da54a726 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -255,7 +255,7 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz)
+ u32 div, mbrdiv;
+
+ /* Ensure spi->clk_rate is even */
+- div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz);
++ div = DIV_ROUND_CLOSEST(spi->clk_rate & ~0x1, speed_hz);
+
+ /*
+ * SPI framework set xfer->speed_hz to master->max_speed_hz if
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index 8cf4819312f5b..b9352d3bb2ed7 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -244,6 +244,7 @@ static void omap8250_restore_regs(struct uart_8250_port *up)
+ {
+ struct omap8250_priv *priv = up->port.private_data;
+ struct uart_8250_dma *dma = up->dma;
++ u8 mcr = serial8250_in_MCR(up);
+
+ if (dma && dma->tx_running) {
+ /*
+@@ -260,7 +261,7 @@ static void omap8250_restore_regs(struct uart_8250_port *up)
+ serial_out(up, UART_EFR, UART_EFR_ECB);
+
+ serial_out(up, UART_LCR, UART_LCR_CONF_MODE_A);
+- serial8250_out_MCR(up, UART_MCR_TCRTLR);
++ serial8250_out_MCR(up, mcr | UART_MCR_TCRTLR);
+ serial_out(up, UART_FCR, up->fcr);
+
+ omap8250_update_scr(up, priv);
+@@ -276,7 +277,8 @@ static void omap8250_restore_regs(struct uart_8250_port *up)
+ serial_out(up, UART_LCR, 0);
+
+ /* drop TCR + TLR access, we setup XON/XOFF later */
+- serial8250_out_MCR(up, up->mcr);
++ serial8250_out_MCR(up, mcr);
++
+ serial_out(up, UART_IER, up->ier);
+
+ serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B);
+@@ -585,7 +587,6 @@ static int omap_8250_startup(struct uart_port *port)
+
+ pm_runtime_get_sync(port->dev);
+
+- up->mcr = 0;
+ serial_out(up, UART_FCR, UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT);
+
+ serial_out(up, UART_LCR, UART_LCR_WLEN8);
+diff --git a/drivers/xen/platform-pci.c b/drivers/xen/platform-pci.c
+index 4cec8146609ad..c7e190e5db30d 100644
+--- a/drivers/xen/platform-pci.c
++++ b/drivers/xen/platform-pci.c
+@@ -150,7 +150,7 @@ static int platform_pci_probe(struct pci_dev *pdev,
+ if (ret) {
+ dev_warn(&pdev->dev, "Unable to set the evtchn callback "
+ "err=%d\n", ret);
+- goto out;
++ goto irq_out;
+ }
+ }
+
+@@ -158,13 +158,16 @@ static int platform_pci_probe(struct pci_dev *pdev,
+ grant_frames = alloc_xen_mmio(PAGE_SIZE * max_nr_gframes);
+ ret = gnttab_setup_auto_xlat_frames(grant_frames);
+ if (ret)
+- goto out;
++ goto irq_out;
+ ret = gnttab_init();
+ if (ret)
+ goto grant_out;
+ return 0;
+ grant_out:
+ gnttab_free_auto_xlat_frames();
++irq_out:
++ if (!xen_have_vector_callback)
++ free_irq(pdev->irq, pdev);
+ out:
+ pci_release_region(pdev, 0);
+ mem_out:
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 717385b7f66f7..752b5d2652843 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2759,6 +2759,8 @@ static int btrfs_ioctl_get_subvol_info(struct file *file, void __user *argp)
+ }
+ }
+
++ btrfs_free_path(path);
++ path = NULL;
+ if (copy_to_user(argp, subvol_info, sizeof(*subvol_info)))
+ ret = -EFAULT;
+
+@@ -2849,6 +2851,8 @@ static int btrfs_ioctl_get_subvol_rootref(struct file *file, void __user *argp)
+ }
+
+ out:
++ btrfs_free_path(path);
++
+ if (!ret || ret == -EOVERFLOW) {
+ rootrefs->num_items = found;
+ /* update min_treeid for next search */
+@@ -2860,7 +2864,6 @@ out:
+ }
+
+ kfree(rootrefs);
+- btrfs_free_path(path);
+
+ return ret;
+ }
+@@ -4886,6 +4889,8 @@ static long btrfs_ioctl_ino_to_path(struct btrfs_root *root, void __user *arg)
+ ipath->fspath->val[i] = rel_ptr;
+ }
+
++ btrfs_free_path(path);
++ path = NULL;
+ ret = copy_to_user((void __user *)(unsigned long)ipa->fspath,
+ ipath->fspath, size);
+ if (ret) {
+@@ -4956,21 +4961,20 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_fs_info *fs_info,
+ size = min_t(u32, loi->size, SZ_16M);
+ }
+
+- path = btrfs_alloc_path();
+- if (!path) {
+- ret = -ENOMEM;
+- goto out;
+- }
+-
+ inodes = init_data_container(size);
+ if (IS_ERR(inodes)) {
+ ret = PTR_ERR(inodes);
+- inodes = NULL;
+- goto out;
++ goto out_loi;
+ }
+
++ path = btrfs_alloc_path();
++ if (!path) {
++ ret = -ENOMEM;
++ goto out;
++ }
+ ret = iterate_inodes_from_logical(loi->logical, fs_info, path,
+ build_ino_list, inodes, ignore_offset);
++ btrfs_free_path(path);
+ if (ret == -EINVAL)
+ ret = -ENOENT;
+ if (ret < 0)
+@@ -4982,7 +4986,6 @@ static long btrfs_ioctl_logical_to_ino(struct btrfs_fs_info *fs_info,
+ ret = -EFAULT;
+
+ out:
+- btrfs_free_path(path);
+ kvfree(inodes);
+ out_loi:
+ kfree(loi);
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 886ab4beb5797..69b43df186a89 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2368,14 +2368,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle *trans, u64 srcid,
+ dstgroup->rsv_rfer = inherit->lim.rsv_rfer;
+ dstgroup->rsv_excl = inherit->lim.rsv_excl;
+
+- ret = update_qgroup_limit_item(trans, dstgroup);
+- if (ret) {
+- fs_info->qgroup_flags |= BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT;
+- btrfs_info(fs_info,
+- "unable to update quota limit for %llu",
+- dstgroup->qgroupid);
+- goto unlock;
+- }
++ qgroup_dirty(fs_info, dstgroup);
+ }
+
+ if (srcid) {
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index 5cf7b5f4db947..a5ef8275440d5 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -671,14 +671,17 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc,
+ struct ceph_mds_snap_realm *ri; /* encoded */
+ __le64 *snaps; /* encoded */
+ __le64 *prior_parent_snaps; /* encoded */
+- struct ceph_snap_realm *realm = NULL;
++ struct ceph_snap_realm *realm;
+ struct ceph_snap_realm *first_realm = NULL;
+- int invalidate = 0;
++ struct ceph_snap_realm *realm_to_rebuild = NULL;
++ int rebuild_snapcs;
+ int err = -ENOMEM;
+ LIST_HEAD(dirty_realms);
+
+ dout("update_snap_trace deletion=%d\n", deletion);
+ more:
++ realm = NULL;
++ rebuild_snapcs = 0;
+ ceph_decode_need(&p, e, sizeof(*ri), bad);
+ ri = p;
+ p += sizeof(*ri);
+@@ -702,7 +705,7 @@ more:
+ err = adjust_snap_realm_parent(mdsc, realm, le64_to_cpu(ri->parent));
+ if (err < 0)
+ goto fail;
+- invalidate += err;
++ rebuild_snapcs += err;
+
+ if (le64_to_cpu(ri->seq) > realm->seq) {
+ dout("update_snap_trace updating %llx %p %lld -> %lld\n",
+@@ -727,22 +730,30 @@ more:
+ if (realm->seq > mdsc->last_snap_seq)
+ mdsc->last_snap_seq = realm->seq;
+
+- invalidate = 1;
++ rebuild_snapcs = 1;
+ } else if (!realm->cached_context) {
+ dout("update_snap_trace %llx %p seq %lld new\n",
+ realm->ino, realm, realm->seq);
+- invalidate = 1;
++ rebuild_snapcs = 1;
+ } else {
+ dout("update_snap_trace %llx %p seq %lld unchanged\n",
+ realm->ino, realm, realm->seq);
+ }
+
+- dout("done with %llx %p, invalidated=%d, %p %p\n", realm->ino,
+- realm, invalidate, p, e);
++ dout("done with %llx %p, rebuild_snapcs=%d, %p %p\n", realm->ino,
++ realm, rebuild_snapcs, p, e);
++
++ /*
++ * this will always track the uppest parent realm from which
++ * we need to rebuild the snapshot contexts _downward_ in
++ * hierarchy.
++ */
++ if (rebuild_snapcs)
++ realm_to_rebuild = realm;
+
+- /* invalidate when we reach the _end_ (root) of the trace */
+- if (invalidate && p >= e)
+- rebuild_snap_realms(realm, &dirty_realms);
++ /* rebuild_snapcs when we reach the _end_ (root) of the trace */
++ if (realm_to_rebuild && p >= e)
++ rebuild_snap_realms(realm_to_rebuild, &dirty_realms);
+
+ if (!first_realm)
+ first_realm = realm;
+diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
+index a3523a243e113..e2a5320f27186 100644
+--- a/fs/nilfs2/dat.c
++++ b/fs/nilfs2/dat.c
+@@ -111,6 +111,13 @@ static void nilfs_dat_commit_free(struct inode *dat,
+ kunmap_atomic(kaddr);
+
+ nilfs_dat_commit_entry(dat, req);
++
++ if (unlikely(req->pr_desc_bh == NULL || req->pr_bitmap_bh == NULL)) {
++ nilfs_error(dat->i_sb,
++ "state inconsistency probably due to duplicate use of vblocknr = %llu",
++ (unsigned long long)req->pr_entry_nr);
++ return;
++ }
+ nilfs_palloc_commit_free_entry(dat, req);
+ }
+
+diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
+index bf3f8f05c89b3..150845a432259 100644
+--- a/fs/nilfs2/sufile.c
++++ b/fs/nilfs2/sufile.c
+@@ -498,14 +498,22 @@ void nilfs_sufile_do_free(struct inode *sufile, __u64 segnum,
+ int nilfs_sufile_mark_dirty(struct inode *sufile, __u64 segnum)
+ {
+ struct buffer_head *bh;
++ void *kaddr;
++ struct nilfs_segment_usage *su;
+ int ret;
+
++ down_write(&NILFS_MDT(sufile)->mi_sem);
+ ret = nilfs_sufile_get_segment_usage_block(sufile, segnum, 0, &bh);
+ if (!ret) {
+ mark_buffer_dirty(bh);
+ nilfs_mdt_mark_dirty(sufile);
++ kaddr = kmap_atomic(bh->b_page);
++ su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr);
++ nilfs_segment_usage_set_dirty(su);
++ kunmap_atomic(kaddr);
+ brelse(bh);
+ }
++ up_write(&NILFS_MDT(sufile)->mi_sem);
+ return ret;
+ }
+
+diff --git a/include/linux/mmdebug.h b/include/linux/mmdebug.h
+index 5d0767cb424aa..4ed52879ce552 100644
+--- a/include/linux/mmdebug.h
++++ b/include/linux/mmdebug.h
+@@ -38,7 +38,7 @@ void dump_mm(const struct mm_struct *mm);
+ } \
+ } while (0)
+ #define VM_WARN_ON_ONCE_PAGE(cond, page) ({ \
+- static bool __section(".data.once") __warned; \
++ static bool __section(.data.once) __warned; \
+ int __ret_warn_once = !!(cond); \
+ \
+ if (unlikely(__ret_warn_once && !__warned)) { \
+diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
+index 818ae690ab791..b163911b1d390 100644
+--- a/include/uapi/linux/audit.h
++++ b/include/uapi/linux/audit.h
+@@ -177,7 +177,7 @@
+ #define AUDIT_MAX_KEY_LEN 256
+ #define AUDIT_BITMASK_SIZE 64
+ #define AUDIT_WORD(nr) ((__u32)((nr)/32))
+-#define AUDIT_BIT(nr) (1 << ((nr) - AUDIT_WORD(nr)*32))
++#define AUDIT_BIT(nr) (1U << ((nr) - AUDIT_WORD(nr)*32))
+
+ #define AUDIT_SYSCALL_CLASSES 16
+ #define AUDIT_CLASS_DIR_WRITE 0
+diff --git a/ipc/sem.c b/ipc/sem.c
+index 2bf535dd0b934..cc6af85d1b157 100644
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -2148,6 +2148,7 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
+ * scenarios where we were awakened externally, during the
+ * window between wake_q_add() and wake_up_q().
+ */
++ rcu_read_lock();
+ error = READ_ONCE(queue.status);
+ if (error != -EINTR) {
+ /*
+@@ -2157,10 +2158,10 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
+ * overwritten by the previous owner of the semaphore.
+ */
+ smp_mb();
++ rcu_read_unlock();
+ goto out_free;
+ }
+
+- rcu_read_lock();
+ locknum = sem_lock(sma, sops, nsops);
+
+ if (!ipc_valid_object(&sma->sem_perm))
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 93a7bd4185d07..4bb194f096ece 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2081,13 +2081,14 @@ int proc_dostring(struct ctl_table *table, int write,
+ (char __user *)buffer, lenp, ppos);
+ }
+
+-static size_t proc_skip_spaces(char **buf)
++static void proc_skip_spaces(char **buf, size_t *size)
+ {
+- size_t ret;
+- char *tmp = skip_spaces(*buf);
+- ret = tmp - *buf;
+- *buf = tmp;
+- return ret;
++ while (*size) {
++ if (!isspace(**buf))
++ break;
++ (*size)--;
++ (*buf)++;
++ }
+ }
+
+ static void proc_skip_char(char **buf, size_t *size, const char v)
+@@ -2156,13 +2157,12 @@ static int proc_get_long(char **buf, size_t *size,
+ unsigned long *val, bool *neg,
+ const char *perm_tr, unsigned perm_tr_len, char *tr)
+ {
+- int len;
+ char *p, tmp[TMPBUFLEN];
++ ssize_t len = *size;
+
+- if (!*size)
++ if (len <= 0)
+ return -EINVAL;
+
+- len = *size;
+ if (len > TMPBUFLEN - 1)
+ len = TMPBUFLEN - 1;
+
+@@ -2325,7 +2325,7 @@ static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
+ bool neg;
+
+ if (write) {
+- left -= proc_skip_spaces(&p);
++ proc_skip_spaces(&p, &left);
+
+ if (!left)
+ break;
+@@ -2356,7 +2356,7 @@ static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
+ if (!write && !first && left && !err)
+ err = proc_put_char(&buffer, &left, '\n');
+ if (write && !err && left)
+- left -= proc_skip_spaces(&p);
++ proc_skip_spaces(&p, &left);
+ if (write) {
+ kfree(kbuf);
+ if (first)
+@@ -2405,7 +2405,7 @@ static int do_proc_douintvec_w(unsigned int *tbl_data,
+ if (IS_ERR(kbuf))
+ return -EINVAL;
+
+- left -= proc_skip_spaces(&p);
++ proc_skip_spaces(&p, &left);
+ if (!left) {
+ err = -EINVAL;
+ goto out_free;
+@@ -2425,7 +2425,7 @@ static int do_proc_douintvec_w(unsigned int *tbl_data,
+ }
+
+ if (!err && left)
+- left -= proc_skip_spaces(&p);
++ proc_skip_spaces(&p, &left);
+
+ out_free:
+ kfree(kbuf);
+@@ -2846,7 +2846,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
+ if (write) {
+ bool neg;
+
+- left -= proc_skip_spaces(&p);
++ proc_skip_spaces(&p, &left);
+ if (!left)
+ break;
+
+@@ -2879,7 +2879,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
+ if (!write && !first && left && !err)
+ err = proc_put_char(&buffer, &left, '\n');
+ if (write && !err)
+- left -= proc_skip_spaces(&p);
++ proc_skip_spaces(&p, &left);
+ if (write) {
+ kfree(kbuf);
+ if (first)
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 9a4277034c647..d03fe77801848 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -224,8 +224,10 @@ config FRAME_WARN
+ range 0 8192
+ default 3072 if KASAN_EXTRA
+ default 2048 if GCC_PLUGIN_LATENT_ENTROPY
+- default 1280 if (!64BIT && PARISC)
+- default 1024 if (!64BIT && !PARISC)
++ default 2048 if PARISC
++ default 1536 if (!64BIT && XTENSA)
++ default 1280 if KASAN && !64BIT
++ default 1024 if !64BIT
+ default 2048 if 64BIT
+ help
+ Tell gcc to warn at build time for stack frames larger than this.
+@@ -1510,8 +1512,14 @@ config NETDEV_NOTIFIER_ERROR_INJECT
+ If unsure, say N.
+
+ config FUNCTION_ERROR_INJECTION
+- def_bool y
++ bool "Fault-injections of functions"
+ depends on HAVE_FUNCTION_ERROR_INJECTION && KPROBES
++ help
++ Add fault injections into various functions that are annotated with
++ ALLOW_ERROR_INJECTION() in the kernel. BPF may also modify the return
++ value of theses functions. This is useful to test error paths of code.
++
++ If unsure, say N
+
+ config FAULT_INJECTION
+ bool "Fault-injection framework"
+diff --git a/mm/frame_vector.c b/mm/frame_vector.c
+index c64dca6e27c28..7124410a0016e 100644
+--- a/mm/frame_vector.c
++++ b/mm/frame_vector.c
+@@ -37,7 +37,6 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames,
+ struct mm_struct *mm = current->mm;
+ struct vm_area_struct *vma;
+ int ret = 0;
+- int err;
+ int locked;
+
+ if (nr_frames == 0)
+@@ -72,32 +71,14 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames,
+ vec->is_pfns = false;
+ ret = get_user_pages_locked(start, nr_frames,
+ gup_flags, (struct page **)(vec->ptrs), &locked);
+- goto out;
++ if (likely(ret > 0))
++ goto out;
+ }
+
+- vec->got_ref = false;
+- vec->is_pfns = true;
+- do {
+- unsigned long *nums = frame_vector_pfns(vec);
+-
+- while (ret < nr_frames && start + PAGE_SIZE <= vma->vm_end) {
+- err = follow_pfn(vma, start, &nums[ret]);
+- if (err) {
+- if (ret == 0)
+- ret = err;
+- goto out;
+- }
+- start += PAGE_SIZE;
+- ret++;
+- }
+- /*
+- * We stop if we have enough pages or if VMA doesn't completely
+- * cover the tail page.
+- */
+- if (ret >= nr_frames || start < vma->vm_end)
+- break;
+- vma = find_vma_intersection(mm, start, start + 1);
+- } while (vma && vma->vm_flags & (VM_IO | VM_PFNMAP));
++ /* This used to (racily) return non-refcounted pfns. Let people know */
++ WARN_ONCE(1, "get_vaddr_frames() cannot follow VM_IO mapping");
++ vec->nr_frames = 0;
++
+ out:
+ if (locked)
+ up_read(&mm->mmap_sem);
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index 7194ffa58d3e7..e03ff8df1d3f6 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -215,9 +215,11 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
+
+ list_for_each_entry_safe(req, rtmp, &m->req_list, req_list) {
+ list_move(&req->req_list, &cancel_list);
++ req->status = REQ_STATUS_ERROR;
+ }
+ list_for_each_entry_safe(req, rtmp, &m->unsent_req_list, req_list) {
+ list_move(&req->req_list, &cancel_list);
++ req->status = REQ_STATUS_ERROR;
+ }
+
+ spin_unlock(&m->client->lock);
+@@ -865,8 +867,10 @@ static int p9_socket_open(struct p9_client *client, struct socket *csocket)
+ struct file *file;
+
+ p = kzalloc(sizeof(struct p9_trans_fd), GFP_KERNEL);
+- if (!p)
++ if (!p) {
++ sock_release(csocket);
+ return -ENOMEM;
++ }
+
+ csocket->sk->sk_allocation = GFP_NOIO;
+ file = sock_alloc_file(csocket, 0, NULL);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 82e3629617c8e..fd6cd47a6c5ab 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -5553,6 +5553,19 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn,
+ BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
+ scid, mtu, mps);
+
++ /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
++ * page 1059:
++ *
++ * Valid range: 0x0001-0x00ff
++ *
++ * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
++ */
++ if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
++ result = L2CAP_CR_BAD_PSM;
++ chan = NULL;
++ goto response;
++ }
++
+ /* Check if we have socket listening on psm */
+ pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
+ &conn->hcon->dst, LE_LINK);
+diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
+index 7e93087d13667..c021d5dde8f72 100644
+--- a/net/dccp/ipv4.c
++++ b/net/dccp/ipv4.c
+@@ -134,6 +134,8 @@ failure:
+ * This unhashes the socket and releases the local port, if necessary.
+ */
+ dccp_set_state(sk, DCCP_CLOSED);
++ if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
++ inet_reset_saddr(sk);
+ ip_rt_put(rt);
+ sk->sk_route_caps = 0;
+ inet->inet_dport = 0;
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index ae4851fdbe9e5..72803e1ea10a8 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -957,6 +957,8 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+
+ late_failure:
+ dccp_set_state(sk, DCCP_CLOSED);
++ if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
++ inet_reset_saddr(sk);
+ __sk_dst_reset(sk);
+ failure:
+ inet->inet_dport = 0;
+diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
+index 04b5450c5a557..adfb497606785 100644
+--- a/net/hsr/hsr_forward.c
++++ b/net/hsr/hsr_forward.c
+@@ -207,17 +207,18 @@ static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev,
+ struct hsr_node *node_src)
+ {
+ bool was_multicast_frame;
+- int res;
++ int res, recv_len;
+
+ was_multicast_frame = (skb->pkt_type == PACKET_MULTICAST);
+ hsr_addr_subst_source(node_src, skb);
+ skb_pull(skb, ETH_HLEN);
++ recv_len = skb->len;
+ res = netif_rx(skb);
+ if (res == NET_RX_DROP) {
+ dev->stats.rx_dropped++;
+ } else {
+ dev->stats.rx_packets++;
+- dev->stats.rx_bytes += skb->len;
++ dev->stats.rx_bytes += recv_len;
+ if (was_multicast_frame)
+ dev->stats.multicast++;
+ }
+diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
+index 2e12f848203a4..8acfa14874782 100644
+--- a/net/ipv4/Kconfig
++++ b/net/ipv4/Kconfig
+@@ -388,6 +388,16 @@ config INET_IPCOMP
+
+ If unsure, say Y.
+
++config INET_TABLE_PERTURB_ORDER
++ int "INET: Source port perturbation table size (as power of 2)" if EXPERT
++ default 16
++ help
++ Source port perturbation table size (as power of 2) for
++ RFC 6056 3.3.4. Algorithm 4: Double-Hash Port Selection Algorithm.
++
++ The default is almost always what you want.
++ Only change this if you know what you are doing.
++
+ config INET_XFRM_TUNNEL
+ tristate
+ select INET_TUNNEL
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index 70070f1003a06..3c58019f07187 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -718,13 +718,13 @@ EXPORT_SYMBOL_GPL(inet_unhash);
+ * Note that we use 32bit integers (vs RFC 'short integers')
+ * because 2^16 is not a multiple of num_ephemeral and this
+ * property might be used by clever attacker.
++ *
+ * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though
+- * attacks were since demonstrated, thus we use 65536 instead to really
+- * give more isolation and privacy, at the expense of 256kB of kernel
+- * memory.
++ * attacks were since demonstrated, thus we use 65536 by default instead
++ * to really give more isolation and privacy, at the expense of 256kB
++ * of kernel memory.
+ */
+-#define INET_TABLE_PERTURB_SHIFT 16
+-#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT)
++#define INET_TABLE_PERTURB_SIZE (1 << CONFIG_INET_TABLE_PERTURB_ORDER)
+ static u32 *table_perturb;
+
+ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 6549e07ce19c0..bd374eac9a75f 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -328,6 +328,8 @@ failure:
+ * if necessary.
+ */
+ tcp_set_state(sk, TCP_CLOSE);
++ if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
++ inet_reset_saddr(sk);
+ ip_rt_put(rt);
+ sk->sk_route_caps = 0;
+ inet->inet_dport = 0;
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index 4e1da6cb9ed71..4f958d24f9e4a 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -166,6 +166,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ rtnl_lock();
+ lock_sock(sk);
+
++ /* Another thread has converted the socket into IPv4 with
++ * IPV6_ADDRFORM concurrently.
++ */
++ if (unlikely(sk->sk_family != AF_INET6))
++ goto unlock;
++
+ switch (optname) {
+
+ case IPV6_ADDRFORM:
+@@ -913,6 +919,7 @@ pref_skip_coa:
+ break;
+ }
+
++unlock:
+ release_sock(sk);
+ if (needs_rtnl)
+ rtnl_unlock();
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 7a5a7a4265cf0..babf69b2403ba 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -327,6 +327,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+
+ late_failure:
+ tcp_set_state(sk, TCP_CLOSE);
++ if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
++ inet_reset_saddr(sk);
+ failure:
+ inet->inet_dport = 0;
+ sk->sk_route_caps = 0;
+diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
+index 30232591cf2bf..1925fb91e514a 100644
+--- a/net/ipv6/xfrm6_policy.c
++++ b/net/ipv6/xfrm6_policy.c
+@@ -416,9 +416,13 @@ int __init xfrm6_init(void)
+ if (ret)
+ goto out_state;
+
+- register_pernet_subsys(&xfrm6_net_ops);
++ ret = register_pernet_subsys(&xfrm6_net_ops);
++ if (ret)
++ goto out_protocol;
+ out:
+ return ret;
++out_protocol:
++ xfrm6_protocol_fini();
+ out_state:
+ xfrm6_state_fini();
+ out_policy:
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 337c6bc8211ed..976b67089ac15 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2915,7 +2915,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t)
+ break;
+ if (!aalg->pfkey_supported)
+ continue;
+- if (aalg_tmpl_set(t, aalg) && aalg->available)
++ if (aalg_tmpl_set(t, aalg))
+ sz += sizeof(struct sadb_comb);
+ }
+ return sz + sizeof(struct sadb_prop);
+@@ -2933,7 +2933,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
+ if (!ealg->pfkey_supported)
+ continue;
+
+- if (!(ealg_tmpl_set(t, ealg) && ealg->available))
++ if (!(ealg_tmpl_set(t, ealg)))
+ continue;
+
+ for (k = 1; ; k++) {
+@@ -2944,16 +2944,17 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
+ if (!aalg->pfkey_supported)
+ continue;
+
+- if (aalg_tmpl_set(t, aalg) && aalg->available)
++ if (aalg_tmpl_set(t, aalg))
+ sz += sizeof(struct sadb_comb);
+ }
+ }
+ return sz + sizeof(struct sadb_prop);
+ }
+
+-static void dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
++static int dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
+ {
+ struct sadb_prop *p;
++ int sz = 0;
+ int i;
+
+ p = skb_put(skb, sizeof(struct sadb_prop));
+@@ -2981,13 +2982,17 @@ static void dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
+ c->sadb_comb_soft_addtime = 20*60*60;
+ c->sadb_comb_hard_usetime = 8*60*60;
+ c->sadb_comb_soft_usetime = 7*60*60;
++ sz += sizeof(*c);
+ }
+ }
++
++ return sz + sizeof(*p);
+ }
+
+-static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
++static int dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
+ {
+ struct sadb_prop *p;
++ int sz = 0;
+ int i, k;
+
+ p = skb_put(skb, sizeof(struct sadb_prop));
+@@ -3029,8 +3034,11 @@ static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
+ c->sadb_comb_soft_addtime = 20*60*60;
+ c->sadb_comb_hard_usetime = 8*60*60;
+ c->sadb_comb_soft_usetime = 7*60*60;
++ sz += sizeof(*c);
+ }
+ }
++
++ return sz + sizeof(*p);
+ }
+
+ static int key_notify_policy_expire(struct xfrm_policy *xp, const struct km_event *c)
+@@ -3160,6 +3168,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
+ struct sadb_x_sec_ctx *sec_ctx;
+ struct xfrm_sec_ctx *xfrm_ctx;
+ int ctx_size = 0;
++ int alg_size = 0;
+
+ sockaddr_size = pfkey_sockaddr_size(x->props.family);
+ if (!sockaddr_size)
+@@ -3171,16 +3180,16 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
+ sizeof(struct sadb_x_policy);
+
+ if (x->id.proto == IPPROTO_AH)
+- size += count_ah_combs(t);
++ alg_size = count_ah_combs(t);
+ else if (x->id.proto == IPPROTO_ESP)
+- size += count_esp_combs(t);
++ alg_size = count_esp_combs(t);
+
+ if ((xfrm_ctx = x->security)) {
+ ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
+ size += sizeof(struct sadb_x_sec_ctx) + ctx_size;
+ }
+
+- skb = alloc_skb(size + 16, GFP_ATOMIC);
++ skb = alloc_skb(size + alg_size + 16, GFP_ATOMIC);
+ if (skb == NULL)
+ return -ENOMEM;
+
+@@ -3234,10 +3243,13 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
+ pol->sadb_x_policy_priority = xp->priority;
+
+ /* Set sadb_comb's. */
++ alg_size = 0;
+ if (x->id.proto == IPPROTO_AH)
+- dump_ah_combs(skb, t);
++ alg_size = dump_ah_combs(skb, t);
+ else if (x->id.proto == IPPROTO_ESP)
+- dump_esp_combs(skb, t);
++ alg_size = dump_esp_combs(skb, t);
++
++ hdr->sadb_msg_len += alg_size / 8;
+
+ /* security context */
+ if (xfrm_ctx) {
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index 06b44c3c831ad..71ebdc85755c9 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -731,7 +731,7 @@ int mesh_path_send_to_gates(struct mesh_path *mpath)
+ void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata,
+ struct sk_buff *skb)
+ {
+- kfree_skb(skb);
++ ieee80211_free_txskb(&sdata->local->hw, skb);
+ sdata->u.mesh.mshstats.dropped_frames_no_route++;
+ }
+
+diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
+index 0580e5326641b..66608e6c5b0ec 100644
+--- a/net/nfc/nci/core.c
++++ b/net/nfc/nci/core.c
+@@ -542,7 +542,7 @@ static int nci_open_device(struct nci_dev *ndev)
+ skb_queue_purge(&ndev->tx_q);
+
+ ndev->ops->close(ndev);
+- ndev->flags = 0;
++ ndev->flags &= BIT(NCI_UNREG);
+ }
+
+ done:
+diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
+index 9e3f9460f14fc..5d46d8dfad721 100644
+--- a/net/nfc/nci/data.c
++++ b/net/nfc/nci/data.c
+@@ -291,8 +291,10 @@ void nci_rx_data_packet(struct nci_dev *ndev, struct sk_buff *skb)
+ nci_plen(skb->data));
+
+ conn_info = nci_get_conn_info_by_conn_id(ndev, nci_conn_id(skb->data));
+- if (!conn_info)
++ if (!conn_info) {
++ kfree_skb(skb);
+ return;
++ }
+
+ /* strip the nci data header */
+ skb_pull(skb, NCI_DATA_HDR_SIZE);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index f654f79e3310c..6fa0a9a453a8b 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2209,8 +2209,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ if (skb->ip_summed == CHECKSUM_PARTIAL)
+ status |= TP_STATUS_CSUMNOTREADY;
+ else if (skb->pkt_type != PACKET_OUTGOING &&
+- (skb->ip_summed == CHECKSUM_COMPLETE ||
+- skb_csum_unnecessary(skb)))
++ skb_csum_unnecessary(skb))
+ status |= TP_STATUS_CSUM_VALID;
+
+ if (snaplen > res)
+@@ -3452,8 +3451,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ if (skb->ip_summed == CHECKSUM_PARTIAL)
+ aux.tp_status |= TP_STATUS_CSUMNOTREADY;
+ else if (skb->pkt_type != PACKET_OUTGOING &&
+- (skb->ip_summed == CHECKSUM_COMPLETE ||
+- skb_csum_unnecessary(skb)))
++ skb_csum_unnecessary(skb))
+ aux.tp_status |= TP_STATUS_CSUM_VALID;
+
+ aux.tp_len = origlen;
+diff --git a/net/tipc/discover.c b/net/tipc/discover.c
+index 0006c9f871998..0436c8f2967d4 100644
+--- a/net/tipc/discover.c
++++ b/net/tipc/discover.c
+@@ -208,7 +208,10 @@ void tipc_disc_rcv(struct net *net, struct sk_buff *skb,
+ u32 self;
+ int err;
+
+- skb_linearize(skb);
++ if (skb_linearize(skb)) {
++ kfree_skb(skb);
++ return;
++ }
+ hdr = buf_msg(skb);
+
+ if (caps & TIPC_NODE_ID128)
+diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
+index 5a88a93e67ef2..d3bb19cd0ec0c 100644
+--- a/net/tipc/topsrv.c
++++ b/net/tipc/topsrv.c
+@@ -184,7 +184,7 @@ static void tipc_conn_close(struct tipc_conn *con)
+ conn_put(con);
+ }
+
+-static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s)
++static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s, struct socket *sock)
+ {
+ struct tipc_conn *con;
+ int ret;
+@@ -210,10 +210,12 @@ static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s)
+ }
+ con->conid = ret;
+ s->idr_in_use++;
+- spin_unlock_bh(&s->idr_lock);
+
+ set_bit(CF_CONNECTED, &con->flags);
+ con->server = s;
++ con->sock = sock;
++ conn_get(con);
++ spin_unlock_bh(&s->idr_lock);
+
+ return con;
+ }
+@@ -474,7 +476,7 @@ static void tipc_topsrv_accept(struct work_struct *work)
+ ret = kernel_accept(lsock, &newsock, O_NONBLOCK);
+ if (ret < 0)
+ return;
+- con = tipc_conn_alloc(srv);
++ con = tipc_conn_alloc(srv, newsock);
+ if (IS_ERR(con)) {
+ ret = PTR_ERR(con);
+ sock_release(newsock);
+@@ -486,11 +488,11 @@ static void tipc_topsrv_accept(struct work_struct *work)
+ newsk->sk_data_ready = tipc_conn_data_ready;
+ newsk->sk_write_space = tipc_conn_write_space;
+ newsk->sk_user_data = con;
+- con->sock = newsock;
+ write_unlock_bh(&newsk->sk_callback_lock);
+
+ /* Wake up receive process in case of 'SYN+' message */
+ newsk->sk_data_ready(newsk);
++ conn_put(con);
+ }
+ }
+
+@@ -584,17 +586,17 @@ bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type, u32 lower,
+ sub.filter = filter;
+ *(u64 *)&sub.usr_handle = (u64)port;
+
+- con = tipc_conn_alloc(tipc_topsrv(net));
++ con = tipc_conn_alloc(tipc_topsrv(net), NULL);
+ if (IS_ERR(con))
+ return false;
+
+ *conid = con->conid;
+- con->sock = NULL;
+ rc = tipc_conn_rcv_sub(tipc_topsrv(net), con, &sub);
+- if (rc >= 0)
+- return true;
++ if (rc)
++ conn_put(con);
++
+ conn_put(con);
+- return false;
++ return !rc;
+ }
+
+ void tipc_topsrv_kern_unsubscr(struct net *net, int conid)
+diff --git a/scripts/faddr2line b/scripts/faddr2line
+index 70f8c3ecd5559..42c46f4980219 100755
+--- a/scripts/faddr2line
++++ b/scripts/faddr2line
+@@ -73,7 +73,8 @@ command -v ${ADDR2LINE} >/dev/null 2>&1 || die "${ADDR2LINE} isn't installed"
+ find_dir_prefix() {
+ local objfile=$1
+
+- local start_kernel_addr=$(${READELF} --symbols --wide $objfile | ${AWK} '$8 == "start_kernel" {printf "0x%s", $2}')
++ local start_kernel_addr=$(${READELF} --symbols --wide $objfile | sed 's/\[.*\]//' |
++ ${AWK} '$8 == "start_kernel" {printf "0x%s", $2}')
+ [[ -z $start_kernel_addr ]] && return
+
+ local file_line=$(${ADDR2LINE} -e $objfile $start_kernel_addr)
+@@ -177,7 +178,7 @@ __faddr2line() {
+ found=2
+ break
+ fi
+- done < <(${READELF} --symbols --wide $objfile | ${AWK} -v sec=$sym_sec '$7 == sec' | sort --key=2)
++ done < <(${READELF} --symbols --wide $objfile | sed 's/\[.*\]//' | ${AWK} -v sec=$sym_sec '$7 == sec' | sort --key=2)
+
+ if [[ $found = 0 ]]; then
+ warn "can't find symbol: sym_name: $sym_name sym_sec: $sym_sec sym_addr: $sym_addr sym_elf_size: $sym_elf_size"
+@@ -258,7 +259,7 @@ __faddr2line() {
+
+ DONE=1
+
+- done < <(${READELF} --symbols --wide $objfile | ${AWK} -v fn=$sym_name '$4 == "FUNC" && $8 == fn')
++ done < <(${READELF} --symbols --wide $objfile | sed 's/\[.*\]//' | ${AWK} -v fn=$sym_name '$4 == "FUNC" && $8 == fn')
+ }
+
+ [[ $# -lt 2 ]] && usage
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 13e752f8b3f73..0708b5019910a 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1769,6 +1769,7 @@ static int sgtl5000_i2c_remove(struct i2c_client *client)
+ {
+ struct sgtl5000_priv *sgtl5000 = i2c_get_clientdata(client);
+
++ regmap_write(sgtl5000->regmap, SGTL5000_CHIP_CLK_CTRL, SGTL5000_CHIP_CLK_CTRL_DEFAULT);
+ regmap_write(sgtl5000->regmap, SGTL5000_CHIP_DIG_POWER, SGTL5000_DIG_POWER_DEFAULT);
+ regmap_write(sgtl5000->regmap, SGTL5000_CHIP_ANA_POWER, SGTL5000_ANA_POWER_DEFAULT);
+
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index 453b61b42dd9e..2faf95d4bb75f 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -445,7 +445,7 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol,
+ val = ucontrol->value.integer.value[0];
+ if (mc->platform_max && val > mc->platform_max)
+ return -EINVAL;
+- if (val > max - min)
++ if (val > max)
+ return -EINVAL;
+ if (val < 0)
+ return -EINVAL;
+diff --git a/tools/vm/slabinfo-gnuplot.sh b/tools/vm/slabinfo-gnuplot.sh
+index 0cf28aa6f21c3..b809beee6e2a9 100644
+--- a/tools/vm/slabinfo-gnuplot.sh
++++ b/tools/vm/slabinfo-gnuplot.sh
+@@ -157,7 +157,7 @@ do_preprocess()
+ let lines=3
+ out=`basename "$in"`"-slabs-by-loss"
+ `cat "$in" | grep -A "$lines" 'Slabs sorted by loss' |\
+- egrep -iv '\-\-|Name|Slabs'\
++ grep -E -iv '\-\-|Name|Slabs'\
+ | awk '{print $1" "$4+$2*$3" "$4}' > "$out"`
+ if [ $? -eq 0 ]; then
+ do_slabs_plotting "$out"
+@@ -166,7 +166,7 @@ do_preprocess()
+ let lines=3
+ out=`basename "$in"`"-slabs-by-size"
+ `cat "$in" | grep -A "$lines" 'Slabs sorted by size' |\
+- egrep -iv '\-\-|Name|Slabs'\
++ grep -E -iv '\-\-|Name|Slabs'\
+ | awk '{print $1" "$4" "$4-$2*$3}' > "$out"`
+ if [ $? -eq 0 ]; then
+ do_slabs_plotting "$out"
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2022-12-14 12:15 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2022-12-14 12:15 UTC (permalink / raw
To: gentoo-commits
commit: edec81ce052f99f774d293a09a93805e6b06817f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 14 12:15:35 2022 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 14 12:15:35 2022 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=edec81ce
Linux patch 4.19.269
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1268_linux-4.19.269.patch | 1632 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1636 insertions(+)
diff --git a/0000_README b/0000_README
index 4871e1c3..fa94191a 100644
--- a/0000_README
+++ b/0000_README
@@ -1115,6 +1115,10 @@ Patch: 1267_linux-4.19.268.patch
From: https://www.kernel.org
Desc: Linux 4.19.268
+Patch: 1268_linux-4.19.269.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.269
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1268_linux-4.19.269.patch b/1268_linux-4.19.269.patch
new file mode 100644
index 00000000..a5a88f03
--- /dev/null
+++ b/1268_linux-4.19.269.patch
@@ -0,0 +1,1632 @@
+diff --git a/Makefile b/Makefile
+index f852f1161bed8..bde1d2d704e72 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 268
++SUBLEVEL = 269
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/rk3036-evb.dts b/arch/arm/boot/dts/rk3036-evb.dts
+index 2a7e6624efb93..ea23ba98625e7 100644
+--- a/arch/arm/boot/dts/rk3036-evb.dts
++++ b/arch/arm/boot/dts/rk3036-evb.dts
+@@ -31,7 +31,7 @@
+ &i2c1 {
+ status = "okay";
+
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+diff --git a/arch/arm/boot/dts/rk3188-radxarock.dts b/arch/arm/boot/dts/rk3188-radxarock.dts
+index 4a2890618f6fc..720d0136f1abc 100644
+--- a/arch/arm/boot/dts/rk3188-radxarock.dts
++++ b/arch/arm/boot/dts/rk3188-radxarock.dts
+@@ -67,7 +67,7 @@
+ #sound-dai-cells = <0>;
+ };
+
+- ir_recv: gpio-ir-receiver {
++ ir_recv: ir-receiver {
+ compatible = "gpio-ir-receiver";
+ gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_LOW>;
+ pinctrl-names = "default";
+diff --git a/arch/arm/boot/dts/rk3188.dtsi b/arch/arm/boot/dts/rk3188.dtsi
+index 3b7cae6f41275..24efc9b31d891 100644
+--- a/arch/arm/boot/dts/rk3188.dtsi
++++ b/arch/arm/boot/dts/rk3188.dtsi
+@@ -509,7 +509,6 @@
+
+ &global_timer {
+ interrupts = <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
+- status = "disabled";
+ };
+
+ &local_timer {
+diff --git a/arch/arm/boot/dts/rk3288-evb-act8846.dts b/arch/arm/boot/dts/rk3288-evb-act8846.dts
+index 6592c809e2a54..ccc07740ee3d9 100644
+--- a/arch/arm/boot/dts/rk3288-evb-act8846.dts
++++ b/arch/arm/boot/dts/rk3288-evb-act8846.dts
+@@ -53,7 +53,7 @@
+ vin-supply = <&vcc_sys>;
+ };
+
+- hym8563@51 {
++ rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+
+diff --git a/arch/arm/boot/dts/rk3288-firefly.dtsi b/arch/arm/boot/dts/rk3288-firefly.dtsi
+index a6ff7eac4aa84..8970b7ad1a6bc 100644
+--- a/arch/arm/boot/dts/rk3288-firefly.dtsi
++++ b/arch/arm/boot/dts/rk3288-firefly.dtsi
+@@ -233,7 +233,7 @@
+ vin-supply = <&vcc_sys>;
+ };
+
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+diff --git a/arch/arm/boot/dts/rk3288-miqi.dts b/arch/arm/boot/dts/rk3288-miqi.dts
+index 504ab1177aa79..ec7c7bf5ae95f 100644
+--- a/arch/arm/boot/dts/rk3288-miqi.dts
++++ b/arch/arm/boot/dts/rk3288-miqi.dts
+@@ -146,7 +146,7 @@
+ vin-supply = <&vcc_sys>;
+ };
+
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+diff --git a/arch/arm/boot/dts/rk3288-rock2-square.dts b/arch/arm/boot/dts/rk3288-rock2-square.dts
+index 6a30cadad88a1..47dd843ae6291 100644
+--- a/arch/arm/boot/dts/rk3288-rock2-square.dts
++++ b/arch/arm/boot/dts/rk3288-rock2-square.dts
+@@ -166,7 +166,7 @@
+ };
+
+ &i2c0 {
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+diff --git a/arch/arm/boot/dts/rk3xxx.dtsi b/arch/arm/boot/dts/rk3xxx.dtsi
+index 86a0d98d28ffb..1b6429843bd48 100644
+--- a/arch/arm/boot/dts/rk3xxx.dtsi
++++ b/arch/arm/boot/dts/rk3xxx.dtsi
+@@ -108,6 +108,13 @@
+ reg = <0x1013c200 0x20>;
+ interrupts = <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_EDGE_RISING)>;
+ clocks = <&cru CORE_PERI>;
++ status = "disabled";
++ /* The clock source and the sched_clock provided by the arm_global_timer
++ * on Rockchip rk3066a/rk3188 are quite unstable because their rates
++ * depend on the CPU frequency.
++ * Keep the arm_global_timer disabled in order to have the
++ * DW_APB_TIMER (rk3066a) or ROCKCHIP_TIMER (rk3188) selected by default.
++ */
+ };
+
+ local_timer: local-timer@1013c600 {
+diff --git a/arch/arm/include/asm/perf_event.h b/arch/arm/include/asm/perf_event.h
+index 4f9dec489931a..c5d27140834e7 100644
+--- a/arch/arm/include/asm/perf_event.h
++++ b/arch/arm/include/asm/perf_event.h
+@@ -21,7 +21,7 @@ extern unsigned long perf_misc_flags(struct pt_regs *regs);
+
+ #define perf_arch_fetch_caller_regs(regs, __ip) { \
+ (regs)->ARM_pc = (__ip); \
+- (regs)->ARM_fp = (unsigned long) __builtin_frame_address(0); \
++ frame_pointer((regs)) = (unsigned long) __builtin_frame_address(0); \
+ (regs)->ARM_sp = current_stack_pointer; \
+ (regs)->ARM_cpsr = SVC_MODE; \
+ }
+diff --git a/arch/arm/include/asm/pgtable-nommu.h b/arch/arm/include/asm/pgtable-nommu.h
+index a0d726a47c8a2..e7ca798513c10 100644
+--- a/arch/arm/include/asm/pgtable-nommu.h
++++ b/arch/arm/include/asm/pgtable-nommu.h
+@@ -54,12 +54,6 @@
+
+ typedef pte_t *pte_addr_t;
+
+-/*
+- * ZERO_PAGE is a global shared page that is always zero: used
+- * for zero-mapped memory areas etc..
+- */
+-#define ZERO_PAGE(vaddr) (virt_to_page(0))
+-
+ /*
+ * Mark the prot value as uncacheable and unbufferable.
+ */
+diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
+index a757401129f95..fdc3bc07061ff 100644
+--- a/arch/arm/include/asm/pgtable.h
++++ b/arch/arm/include/asm/pgtable.h
+@@ -13,6 +13,15 @@
+ #include <linux/const.h>
+ #include <asm/proc-fns.h>
+
++#ifndef __ASSEMBLY__
++/*
++ * ZERO_PAGE is a global shared page that is always zero: used
++ * for zero-mapped memory areas etc..
++ */
++extern struct page *empty_zero_page;
++#define ZERO_PAGE(vaddr) (empty_zero_page)
++#endif
++
+ #ifndef CONFIG_MMU
+
+ #include <asm-generic/4level-fixup.h>
+@@ -166,13 +175,6 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
+ #define __S111 __PAGE_SHARED_EXEC
+
+ #ifndef __ASSEMBLY__
+-/*
+- * ZERO_PAGE is a global shared page that is always zero: used
+- * for zero-mapped memory areas etc..
+- */
+-extern struct page *empty_zero_page;
+-#define ZERO_PAGE(vaddr) (empty_zero_page)
+-
+
+ extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
+
+diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
+index 7d67c70bbded3..e803fd16248bc 100644
+--- a/arch/arm/mm/nommu.c
++++ b/arch/arm/mm/nommu.c
+@@ -25,6 +25,13 @@
+
+ unsigned long vectors_base;
+
++/*
++ * empty_zero_page is a special page that is used for
++ * zero-initialized data and COW.
++ */
++struct page *empty_zero_page;
++EXPORT_SYMBOL(empty_zero_page);
++
+ #ifdef CONFIG_ARM_MPU
+ struct mpu_rgn_info mpu_rgn_info;
+ #endif
+@@ -147,9 +154,21 @@ void __init adjust_lowmem_bounds(void)
+ */
+ void __init paging_init(const struct machine_desc *mdesc)
+ {
++ void *zero_page;
++
+ early_trap_init((void *)vectors_base);
+ mpu_setup();
++
++ /* allocate the zero page. */
++ zero_page = memblock_alloc(PAGE_SIZE, PAGE_SIZE);
++ if (!zero_page)
++ panic("%s: Failed to allocate %lu bytes align=0x%lx\n",
++ __func__, PAGE_SIZE, PAGE_SIZE);
++
+ bootmem_init();
++
++ empty_zero_page = virt_to_page(zero_page);
++ flush_dcache_page(empty_zero_page);
+ }
+
+ /*
+diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
+index 17d73b71df1d8..df5d44a7c3de6 100644
+--- a/arch/s390/kvm/vsie.c
++++ b/arch/s390/kvm/vsie.c
+@@ -376,8 +376,10 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
+ if (test_kvm_cpu_feat(vcpu->kvm, KVM_S390_VM_CPU_FEAT_CEI))
+ scb_s->eca |= scb_o->eca & ECA_CEI;
+ /* Epoch Extension */
+- if (test_kvm_facility(vcpu->kvm, 139))
++ if (test_kvm_facility(vcpu->kvm, 139)) {
+ scb_s->ecd |= scb_o->ecd & ECD_MEF;
++ scb_s->epdx = scb_o->epdx;
++ }
+
+ /* etoken */
+ if (test_kvm_facility(vcpu->kvm, 156))
+diff --git a/drivers/gpio/gpio-amd8111.c b/drivers/gpio/gpio-amd8111.c
+index fdcebe59510dd..68d95051dd0e6 100644
+--- a/drivers/gpio/gpio-amd8111.c
++++ b/drivers/gpio/gpio-amd8111.c
+@@ -231,7 +231,10 @@ found:
+ ioport_unmap(gp.pm);
+ goto out;
+ }
++ return 0;
++
+ out:
++ pci_dev_put(pdev);
+ return err;
+ }
+
+@@ -239,6 +242,7 @@ static void __exit amd_gpio_exit(void)
+ {
+ gpiochip_remove(&gp.chip);
+ ioport_unmap(gp.pm);
++ pci_dev_put(gp.pdev);
+ }
+
+ module_init(amd_gpio_init);
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 4549fbb741563..62656636d30c6 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1131,6 +1131,9 @@ static s32 snto32(__u32 value, unsigned n)
+ if (!value || !n)
+ return 0;
+
++ if (n > 32)
++ n = 32;
++
+ switch (n) {
+ case 8: return ((__s8)value);
+ case 16: return ((__s16)value);
+diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c
+index ef80c592b88a3..a85e805ca2c00 100644
+--- a/drivers/hid/hid-lg4ff.c
++++ b/drivers/hid/hid-lg4ff.c
+@@ -878,6 +878,12 @@ static ssize_t lg4ff_alternate_modes_store(struct device *dev, struct device_att
+ return -ENOMEM;
+
+ i = strlen(lbuf);
++
++ if (i == 0) {
++ kfree(lbuf);
++ return -EINVAL;
++ }
++
+ if (lbuf[i-1] == '\n') {
+ if (i == 1) {
+ kfree(lbuf);
+diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
+index 2c32124c18232..ec7d7f643ea7e 100644
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -145,6 +145,8 @@ bool v4l2_valid_dv_timings(const struct v4l2_dv_timings *t,
+ const struct v4l2_bt_timings *bt = &t->bt;
+ const struct v4l2_bt_timings_cap *cap = &dvcap->bt;
+ u32 caps = cap->capabilities;
++ const u32 max_vert = 10240;
++ u32 max_hor = 3 * bt->width;
+
+ if (t->type != V4L2_DV_BT_656_1120)
+ return false;
+@@ -166,14 +168,20 @@ bool v4l2_valid_dv_timings(const struct v4l2_dv_timings *t,
+ if (!bt->interlaced &&
+ (bt->il_vbackporch || bt->il_vsync || bt->il_vfrontporch))
+ return false;
+- if (bt->hfrontporch > 2 * bt->width ||
+- bt->hsync > 1024 || bt->hbackporch > 1024)
++ /*
++ * Some video receivers cannot properly separate the frontporch,
++ * backporch and sync values, and instead they only have the total
++ * blanking. That can be assigned to any of these three fields.
++ * So just check that none of these are way out of range.
++ */
++ if (bt->hfrontporch > max_hor ||
++ bt->hsync > max_hor || bt->hbackporch > max_hor)
+ return false;
+- if (bt->vfrontporch > 4096 ||
+- bt->vsync > 128 || bt->vbackporch > 4096)
++ if (bt->vfrontporch > max_vert ||
++ bt->vsync > max_vert || bt->vbackporch > max_vert)
+ return false;
+- if (bt->interlaced && (bt->il_vfrontporch > 4096 ||
+- bt->il_vsync > 128 || bt->il_vbackporch > 4096))
++ if (bt->interlaced && (bt->il_vfrontporch > max_vert ||
++ bt->il_vsync > max_vert || bt->il_vbackporch > max_vert))
+ return false;
+ return fnc == NULL || fnc(t, fnc_handle);
+ }
+diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
+index d4e6b40f0ed4e..ffdee5aeb8a93 100644
+--- a/drivers/net/can/usb/esd_usb2.c
++++ b/drivers/net/can/usb/esd_usb2.c
+@@ -239,6 +239,10 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,
+ u8 rxerr = msg->msg.rx.data[2];
+ u8 txerr = msg->msg.rx.data[3];
+
++ netdev_dbg(priv->netdev,
++ "CAN_ERR_EV_EXT: dlc=%#02x state=%02x ecc=%02x rec=%02x tec=%02x\n",
++ msg->msg.rx.dlc, state, ecc, rxerr, txerr);
++
+ skb = alloc_can_err_skb(priv->netdev, &cf);
+ if (skb == NULL) {
+ stats->rx_dropped++;
+@@ -265,6 +269,8 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,
+ break;
+ default:
+ priv->can.state = CAN_STATE_ERROR_ACTIVE;
++ txerr = 0;
++ rxerr = 0;
+ break;
+ }
+ } else {
+diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c
+index a20e95b39cf79..4df8da8f5e7e3 100644
+--- a/drivers/net/ethernet/aeroflex/greth.c
++++ b/drivers/net/ethernet/aeroflex/greth.c
+@@ -262,6 +262,7 @@ static int greth_init_rings(struct greth_private *greth)
+ if (dma_mapping_error(greth->dev, dma_addr)) {
+ if (netif_msg_ifup(greth))
+ dev_err(greth->dev, "Could not create initial DMA mapping\n");
++ dev_kfree_skb(skb);
+ goto cleanup;
+ }
+ greth->rx_skbuff[i] = skb;
+diff --git a/drivers/net/ethernet/hisilicon/hisi_femac.c b/drivers/net/ethernet/hisilicon/hisi_femac.c
+index 2c2808830e957..f29040520ca0c 100644
+--- a/drivers/net/ethernet/hisilicon/hisi_femac.c
++++ b/drivers/net/ethernet/hisilicon/hisi_femac.c
+@@ -295,7 +295,7 @@ static int hisi_femac_rx(struct net_device *dev, int limit)
+ skb->protocol = eth_type_trans(skb, dev);
+ napi_gro_receive(&priv->napi, skb);
+ dev->stats.rx_packets++;
+- dev->stats.rx_bytes += skb->len;
++ dev->stats.rx_bytes += len;
+ next:
+ pos = (pos + 1) % rxq->num;
+ if (rx_pkts_num >= limit)
+diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+index b63871ef8a403..e69a64a501278 100644
+--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+@@ -554,7 +554,7 @@ static int hix5hd2_rx(struct net_device *dev, int limit)
+ skb->protocol = eth_type_trans(skb, dev);
+ napi_gro_receive(&priv->napi, skb);
+ dev->stats.rx_packets++;
+- dev->stats.rx_bytes += skb->len;
++ dev->stats.rx_bytes += len;
+ next:
+ pos = dma_ring_incr(pos, RX_DESC_NUM);
+ }
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 398f5951d11c5..0629f87a20be7 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -5877,9 +5877,9 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
+ e1000_tx_queue(tx_ring, tx_flags, count);
+ /* Make sure there is space in the ring for the next send. */
+ e1000_maybe_stop_tx(tx_ring,
+- (MAX_SKB_FRAGS *
++ ((MAX_SKB_FRAGS + 1) *
+ DIV_ROUND_UP(PAGE_SIZE,
+- adapter->tx_fifo_limit) + 2));
++ adapter->tx_fifo_limit) + 4));
+
+ if (!skb->xmit_more ||
+ netif_xmit_stopped(netdev_get_tx_queue(netdev, 0))) {
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 16adba824811d..fbfd43a7e592d 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -3850,11 +3850,7 @@ static int i40e_check_fdir_input_set(struct i40e_vsi *vsi,
+ return -EOPNOTSUPP;
+
+ /* First 4 bytes of L4 header */
+- if (usr_ip4_spec->l4_4_bytes == htonl(0xFFFFFFFF))
+- new_mask |= I40E_L4_SRC_MASK | I40E_L4_DST_MASK;
+- else if (!usr_ip4_spec->l4_4_bytes)
+- new_mask &= ~(I40E_L4_SRC_MASK | I40E_L4_DST_MASK);
+- else
++ if (usr_ip4_spec->l4_4_bytes)
+ return -EOPNOTSUPP;
+
+ /* Filtering on Type of Service is not supported. */
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 9669d8c8b6c72..8a5baaf403ae8 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -9367,6 +9367,21 @@ static int i40e_rebuild_channels(struct i40e_vsi *vsi)
+ return 0;
+ }
+
++/**
++ * i40e_clean_xps_state - clean xps state for every tx_ring
++ * @vsi: ptr to the VSI
++ **/
++static void i40e_clean_xps_state(struct i40e_vsi *vsi)
++{
++ int i;
++
++ if (vsi->tx_rings)
++ for (i = 0; i < vsi->num_queue_pairs; i++)
++ if (vsi->tx_rings[i])
++ clear_bit(__I40E_TX_XPS_INIT_DONE,
++ vsi->tx_rings[i]->state);
++}
++
+ /**
+ * i40e_prep_for_reset - prep for the core to reset
+ * @pf: board private structure
+@@ -9398,8 +9413,10 @@ static void i40e_prep_for_reset(struct i40e_pf *pf, bool lock_acquired)
+ rtnl_unlock();
+
+ for (v = 0; v < pf->num_alloc_vsi; v++) {
+- if (pf->vsi[v])
++ if (pf->vsi[v]) {
++ i40e_clean_xps_state(pf->vsi[v]);
+ pf->vsi[v]->seid = 0;
++ }
+ }
+
+ i40e_shutdown_adminq(&pf->hw);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index e98e3af06cf81..240083201dbf4 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1269,6 +1269,7 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr)
+ i40e_cleanup_reset_vf(vf);
+
+ i40e_flush(hw);
++ usleep_range(20000, 40000);
+ clear_bit(I40E_VF_STATE_RESETTING, &vf->vf_states);
+
+ return true;
+@@ -1392,6 +1393,7 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr)
+ }
+
+ i40e_flush(hw);
++ usleep_range(20000, 40000);
+ clear_bit(__I40E_VF_DISABLE, pf->state);
+
+ return true;
+diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+index 2e17625e6c35c..d0f5b92bead73 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+@@ -1399,6 +1399,8 @@ static int igb_intr_test(struct igb_adapter *adapter, u64 *data)
+ *data = 1;
+ return -1;
+ }
++ wr32(E1000_IVAR_MISC, E1000_IVAR_VALID << 8);
++ wr32(E1000_EIMS, BIT(0));
+ } else if (adapter->flags & IGB_FLAG_HAS_MSI) {
+ shared_int = false;
+ if (request_irq(irq,
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 382d010e1294e..fd13116812006 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -3620,7 +3620,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp)
+ /* Use the cpu associated to the rxq when it is online, in all
+ * the other cases, use the cpu 0 which can't be offline.
+ */
+- if (cpu_online(pp->rxq_def))
++ if (pp->rxq_def < nr_cpu_ids && cpu_online(pp->rxq_def))
+ elected_cpu = pp->rxq_def;
+
+ max_cpu = num_present_cpus();
+diff --git a/drivers/net/ethernet/microchip/encx24j600-regmap.c b/drivers/net/ethernet/microchip/encx24j600-regmap.c
+index 46181559d1f1b..4a8d9633e0825 100644
+--- a/drivers/net/ethernet/microchip/encx24j600-regmap.c
++++ b/drivers/net/ethernet/microchip/encx24j600-regmap.c
+@@ -367,7 +367,7 @@ static int regmap_encx24j600_phy_reg_read(void *context, unsigned int reg,
+ goto err_out;
+
+ usleep_range(26, 100);
+- while ((ret = regmap_read(ctx->regmap, MISTAT, &mistat) != 0) &&
++ while (((ret = regmap_read(ctx->regmap, MISTAT, &mistat)) == 0) &&
+ (mistat & BUSY))
+ cpu_relax();
+
+@@ -405,7 +405,7 @@ static int regmap_encx24j600_phy_reg_write(void *context, unsigned int reg,
+ goto err_out;
+
+ usleep_range(26, 100);
+- while ((ret = regmap_read(ctx->regmap, MISTAT, &mistat) != 0) &&
++ while (((ret = regmap_read(ctx->regmap, MISTAT, &mistat)) == 0) &&
+ (mistat & BUSY))
+ cpu_relax();
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+index 9762e687fc73a..9e040eb629ed2 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -114,10 +114,10 @@ static struct stmmac_axi *stmmac_axi_setup(struct platform_device *pdev)
+
+ axi->axi_lpi_en = of_property_read_bool(np, "snps,lpi_en");
+ axi->axi_xit_frm = of_property_read_bool(np, "snps,xit_frm");
+- axi->axi_kbbe = of_property_read_bool(np, "snps,axi_kbbe");
+- axi->axi_fb = of_property_read_bool(np, "snps,axi_fb");
+- axi->axi_mb = of_property_read_bool(np, "snps,axi_mb");
+- axi->axi_rb = of_property_read_bool(np, "snps,axi_rb");
++ axi->axi_kbbe = of_property_read_bool(np, "snps,kbbe");
++ axi->axi_fb = of_property_read_bool(np, "snps,fb");
++ axi->axi_mb = of_property_read_bool(np, "snps,mb");
++ axi->axi_rb = of_property_read_bool(np, "snps,rb");
+
+ if (of_property_read_u32(np, "snps,wr_osr_lmt", &axi->axi_wr_osr_lmt))
+ axi->axi_wr_osr_lmt = 1;
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index 7c5db4f73cce6..917edb3d04b78 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -925,7 +925,7 @@ static int ca8210_spi_transfer(
+
+ dev_dbg(&spi->dev, "%s called\n", __func__);
+
+- cas_ctl = kmalloc(sizeof(*cas_ctl), GFP_ATOMIC);
++ cas_ctl = kzalloc(sizeof(*cas_ctl), GFP_ATOMIC);
+ if (!cas_ctl)
+ return -ENOMEM;
+
+diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c
+index fa3a4db517d69..57110246e71e3 100644
+--- a/drivers/net/ieee802154/cc2520.c
++++ b/drivers/net/ieee802154/cc2520.c
+@@ -978,7 +978,7 @@ static int cc2520_hw_init(struct cc2520_private *priv)
+
+ if (timeout-- <= 0) {
+ dev_err(&priv->spi->dev, "oscillator start failed!\n");
+- return ret;
++ return -ETIMEDOUT;
+ }
+ udelay(1);
+ } while (!(status & CC2520_STATUS_XOSC32M_STABLE));
+diff --git a/drivers/net/plip/plip.c b/drivers/net/plip/plip.c
+index feb92ecd18803..06d59e3af6649 100644
+--- a/drivers/net/plip/plip.c
++++ b/drivers/net/plip/plip.c
+@@ -448,12 +448,12 @@ plip_bh_timeout_error(struct net_device *dev, struct net_local *nl,
+ }
+ rcv->state = PLIP_PK_DONE;
+ if (rcv->skb) {
+- kfree_skb(rcv->skb);
++ dev_kfree_skb_irq(rcv->skb);
+ rcv->skb = NULL;
+ }
+ snd->state = PLIP_PK_DONE;
+ if (snd->skb) {
+- dev_kfree_skb(snd->skb);
++ dev_consume_skb_irq(snd->skb);
+ snd->skb = NULL;
+ }
+ spin_unlock_irq(&nl->lock);
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 24fb9708fb11d..24ce49b311c4c 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1377,6 +1377,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */
+ {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/
+ {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */
++ {QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)}, /* u-blox LARA-L6 */
+
+ /* 4. Gobi 1000 devices */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 751254dcee3b5..92d30ebdb1112 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -48,7 +48,6 @@
+ #include <linux/debugfs.h>
+
+ typedef unsigned int pending_ring_idx_t;
+-#define INVALID_PENDING_RING_IDX (~0U)
+
+ struct pending_tx_info {
+ struct xen_netif_tx_request req; /* tx request */
+@@ -82,8 +81,6 @@ struct xenvif_rx_meta {
+ /* Discriminate from any valid pending_idx value. */
+ #define INVALID_PENDING_IDX 0xFFFF
+
+-#define MAX_BUFFER_OFFSET XEN_PAGE_SIZE
+-
+ #define MAX_PENDING_REQS XEN_NETIF_TX_RING_SIZE
+
+ /* The maximum number of frags is derived from the size of a grant (same
+@@ -346,11 +343,6 @@ void xenvif_free(struct xenvif *vif);
+ int xenvif_xenbus_init(void);
+ void xenvif_xenbus_fini(void);
+
+-int xenvif_schedulable(struct xenvif *vif);
+-
+-int xenvif_queue_stopped(struct xenvif_queue *queue);
+-void xenvif_wake_queue(struct xenvif_queue *queue);
+-
+ /* (Un)Map communication rings. */
+ void xenvif_unmap_frontend_data_rings(struct xenvif_queue *queue);
+ int xenvif_map_frontend_data_rings(struct xenvif_queue *queue,
+@@ -373,17 +365,13 @@ int xenvif_dealloc_kthread(void *data);
+ irqreturn_t xenvif_ctrl_irq_fn(int irq, void *data);
+
+ bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread);
+-void xenvif_rx_action(struct xenvif_queue *queue);
+-void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb);
++bool xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb);
+
+ void xenvif_carrier_on(struct xenvif *vif);
+
+ /* Callback from stack when TX packet can be released */
+ void xenvif_zerocopy_callback(struct ubuf_info *ubuf, bool zerocopy_success);
+
+-/* Unmap a pending page and release it back to the guest */
+-void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx);
+-
+ static inline pending_ring_idx_t nr_pending_reqs(struct xenvif_queue *queue)
+ {
+ return MAX_PENDING_REQS -
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index 3b5fdb24ef1b9..df20270827631 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -70,7 +70,7 @@ void xenvif_skb_zerocopy_complete(struct xenvif_queue *queue)
+ wake_up(&queue->dealloc_wq);
+ }
+
+-int xenvif_schedulable(struct xenvif *vif)
++static int xenvif_schedulable(struct xenvif *vif)
+ {
+ return netif_running(vif->dev) &&
+ test_bit(VIF_STATUS_CONNECTED, &vif->status) &&
+@@ -178,20 +178,6 @@ irqreturn_t xenvif_interrupt(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-int xenvif_queue_stopped(struct xenvif_queue *queue)
+-{
+- struct net_device *dev = queue->vif->dev;
+- unsigned int id = queue->id;
+- return netif_tx_queue_stopped(netdev_get_tx_queue(dev, id));
+-}
+-
+-void xenvif_wake_queue(struct xenvif_queue *queue)
+-{
+- struct net_device *dev = queue->vif->dev;
+- unsigned int id = queue->id;
+- netif_tx_wake_queue(netdev_get_tx_queue(dev, id));
+-}
+-
+ static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb,
+ struct net_device *sb_dev,
+ select_queue_fallback_t fallback)
+@@ -269,14 +255,16 @@ xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (vif->hash.alg == XEN_NETIF_CTRL_HASH_ALGORITHM_NONE)
+ skb_clear_hash(skb);
+
+- xenvif_rx_queue_tail(queue, skb);
++ if (!xenvif_rx_queue_tail(queue, skb))
++ goto drop;
++
+ xenvif_kick_thread(queue);
+
+ return NETDEV_TX_OK;
+
+ drop:
+ vif->dev->stats.tx_dropped++;
+- dev_kfree_skb(skb);
++ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+ }
+
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 4d0d5501ca56f..fc389f2bba7aa 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -105,6 +105,8 @@ static void make_tx_response(struct xenvif_queue *queue,
+ s8 st);
+ static void push_tx_responses(struct xenvif_queue *queue);
+
++static void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx);
++
+ static inline int tx_work_todo(struct xenvif_queue *queue);
+
+ static inline unsigned long idx_to_pfn(struct xenvif_queue *queue,
+@@ -323,10 +325,13 @@ static int xenvif_count_requests(struct xenvif_queue *queue,
+
+
+ struct xenvif_tx_cb {
+- u16 pending_idx;
++ u16 copy_pending_idx[XEN_NETBK_LEGACY_SLOTS_MAX + 1];
++ u8 copy_count;
+ };
+
+ #define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb)
++#define copy_pending_idx(skb, i) (XENVIF_TX_CB(skb)->copy_pending_idx[i])
++#define copy_count(skb) (XENVIF_TX_CB(skb)->copy_count)
+
+ static inline void xenvif_tx_create_map_op(struct xenvif_queue *queue,
+ u16 pending_idx,
+@@ -361,31 +366,93 @@ static inline struct sk_buff *xenvif_alloc_skb(unsigned int size)
+ return skb;
+ }
+
+-static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *queue,
+- struct sk_buff *skb,
+- struct xen_netif_tx_request *txp,
+- struct gnttab_map_grant_ref *gop,
+- unsigned int frag_overflow,
+- struct sk_buff *nskb)
++static void xenvif_get_requests(struct xenvif_queue *queue,
++ struct sk_buff *skb,
++ struct xen_netif_tx_request *first,
++ struct xen_netif_tx_request *txfrags,
++ unsigned *copy_ops,
++ unsigned *map_ops,
++ unsigned int frag_overflow,
++ struct sk_buff *nskb,
++ unsigned int extra_count,
++ unsigned int data_len)
+ {
+ struct skb_shared_info *shinfo = skb_shinfo(skb);
+ skb_frag_t *frags = shinfo->frags;
+- u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
+- int start;
++ u16 pending_idx;
+ pending_ring_idx_t index;
+ unsigned int nr_slots;
++ struct gnttab_copy *cop = queue->tx_copy_ops + *copy_ops;
++ struct gnttab_map_grant_ref *gop = queue->tx_map_ops + *map_ops;
++ struct xen_netif_tx_request *txp = first;
++
++ nr_slots = shinfo->nr_frags + 1;
++
++ copy_count(skb) = 0;
+
+- nr_slots = shinfo->nr_frags;
++ /* Create copy ops for exactly data_len bytes into the skb head. */
++ __skb_put(skb, data_len);
++ while (data_len > 0) {
++ int amount = data_len > txp->size ? txp->size : data_len;
+
+- /* Skip first skb fragment if it is on same page as header fragment. */
+- start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
++ cop->source.u.ref = txp->gref;
++ cop->source.domid = queue->vif->domid;
++ cop->source.offset = txp->offset;
+
+- for (shinfo->nr_frags = start; shinfo->nr_frags < nr_slots;
+- shinfo->nr_frags++, txp++, gop++) {
++ cop->dest.domid = DOMID_SELF;
++ cop->dest.offset = (offset_in_page(skb->data +
++ skb_headlen(skb) -
++ data_len)) & ~XEN_PAGE_MASK;
++ cop->dest.u.gmfn = virt_to_gfn(skb->data + skb_headlen(skb)
++ - data_len);
++
++ cop->len = amount;
++ cop->flags = GNTCOPY_source_gref;
++
++ index = pending_index(queue->pending_cons);
++ pending_idx = queue->pending_ring[index];
++ callback_param(queue, pending_idx).ctx = NULL;
++ copy_pending_idx(skb, copy_count(skb)) = pending_idx;
++ copy_count(skb)++;
++
++ cop++;
++ data_len -= amount;
++
++ if (amount == txp->size) {
++ /* The copy op covered the full tx_request */
++
++ memcpy(&queue->pending_tx_info[pending_idx].req,
++ txp, sizeof(*txp));
++ queue->pending_tx_info[pending_idx].extra_count =
++ (txp == first) ? extra_count : 0;
++
++ if (txp == first)
++ txp = txfrags;
++ else
++ txp++;
++ queue->pending_cons++;
++ nr_slots--;
++ } else {
++ /* The copy op partially covered the tx_request.
++ * The remainder will be mapped.
++ */
++ txp->offset += amount;
++ txp->size -= amount;
++ }
++ }
++
++ for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots;
++ shinfo->nr_frags++, gop++) {
+ index = pending_index(queue->pending_cons++);
+ pending_idx = queue->pending_ring[index];
+- xenvif_tx_create_map_op(queue, pending_idx, txp, 0, gop);
++ xenvif_tx_create_map_op(queue, pending_idx, txp,
++ txp == first ? extra_count : 0, gop);
+ frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx);
++
++ if (txp == first)
++ txp = txfrags;
++ else
++ txp++;
+ }
+
+ if (frag_overflow) {
+@@ -406,7 +473,8 @@ static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *que
+ skb_shinfo(skb)->frag_list = nskb;
+ }
+
+- return gop;
++ (*copy_ops) = cop - queue->tx_copy_ops;
++ (*map_ops) = gop - queue->tx_map_ops;
+ }
+
+ static inline void xenvif_grant_handle_set(struct xenvif_queue *queue,
+@@ -442,7 +510,7 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
+ struct gnttab_copy **gopp_copy)
+ {
+ struct gnttab_map_grant_ref *gop_map = *gopp_map;
+- u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
++ u16 pending_idx;
+ /* This always points to the shinfo of the skb being checked, which
+ * could be either the first or the one on the frag_list
+ */
+@@ -453,24 +521,37 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
+ struct skb_shared_info *first_shinfo = NULL;
+ int nr_frags = shinfo->nr_frags;
+ const bool sharedslot = nr_frags &&
+- frag_get_pending_idx(&shinfo->frags[0]) == pending_idx;
+- int i, err;
++ frag_get_pending_idx(&shinfo->frags[0]) ==
++ copy_pending_idx(skb, copy_count(skb) - 1);
++ int i, err = 0;
+
+- /* Check status of header. */
+- err = (*gopp_copy)->status;
+- if (unlikely(err)) {
+- if (net_ratelimit())
+- netdev_dbg(queue->vif->dev,
+- "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n",
+- (*gopp_copy)->status,
+- pending_idx,
+- (*gopp_copy)->source.u.ref);
+- /* The first frag might still have this slot mapped */
+- if (!sharedslot)
+- xenvif_idx_release(queue, pending_idx,
+- XEN_NETIF_RSP_ERROR);
++ for (i = 0; i < copy_count(skb); i++) {
++ int newerr;
++
++ /* Check status of header. */
++ pending_idx = copy_pending_idx(skb, i);
++
++ newerr = (*gopp_copy)->status;
++ if (likely(!newerr)) {
++ /* The first frag might still have this slot mapped */
++ if (i < copy_count(skb) - 1 || !sharedslot)
++ xenvif_idx_release(queue, pending_idx,
++ XEN_NETIF_RSP_OKAY);
++ } else {
++ err = newerr;
++ if (net_ratelimit())
++ netdev_dbg(queue->vif->dev,
++ "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n",
++ (*gopp_copy)->status,
++ pending_idx,
++ (*gopp_copy)->source.u.ref);
++ /* The first frag might still have this slot mapped */
++ if (i < copy_count(skb) - 1 || !sharedslot)
++ xenvif_idx_release(queue, pending_idx,
++ XEN_NETIF_RSP_ERROR);
++ }
++ (*gopp_copy)++;
+ }
+- (*gopp_copy)++;
+
+ check_frags:
+ for (i = 0; i < nr_frags; i++, gop_map++) {
+@@ -517,14 +598,6 @@ check_frags:
+ if (err)
+ continue;
+
+- /* First error: if the header haven't shared a slot with the
+- * first frag, release it as well.
+- */
+- if (!sharedslot)
+- xenvif_idx_release(queue,
+- XENVIF_TX_CB(skb)->pending_idx,
+- XEN_NETIF_RSP_OKAY);
+-
+ /* Invalidate preceding fragments of this skb. */
+ for (j = 0; j < i; j++) {
+ pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
+@@ -794,7 +867,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+ unsigned *copy_ops,
+ unsigned *map_ops)
+ {
+- struct gnttab_map_grant_ref *gop = queue->tx_map_ops;
+ struct sk_buff *skb, *nskb;
+ int ret;
+ unsigned int frag_overflow;
+@@ -876,8 +948,12 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+ continue;
+ }
+
++ data_len = (txreq.size > XEN_NETBACK_TX_COPY_LEN) ?
++ XEN_NETBACK_TX_COPY_LEN : txreq.size;
++
+ ret = xenvif_count_requests(queue, &txreq, extra_count,
+ txfrags, work_to_do);
++
+ if (unlikely(ret < 0))
+ break;
+
+@@ -903,9 +979,8 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+ index = pending_index(queue->pending_cons);
+ pending_idx = queue->pending_ring[index];
+
+- data_len = (txreq.size > XEN_NETBACK_TX_COPY_LEN &&
+- ret < XEN_NETBK_LEGACY_SLOTS_MAX) ?
+- XEN_NETBACK_TX_COPY_LEN : txreq.size;
++ if (ret >= XEN_NETBK_LEGACY_SLOTS_MAX - 1 && data_len < txreq.size)
++ data_len = txreq.size;
+
+ skb = xenvif_alloc_skb(data_len);
+ if (unlikely(skb == NULL)) {
+@@ -916,8 +991,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+ }
+
+ skb_shinfo(skb)->nr_frags = ret;
+- if (data_len < txreq.size)
+- skb_shinfo(skb)->nr_frags++;
+ /* At this point shinfo->nr_frags is in fact the number of
+ * slots, which can be as large as XEN_NETBK_LEGACY_SLOTS_MAX.
+ */
+@@ -979,54 +1052,19 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+ type);
+ }
+
+- XENVIF_TX_CB(skb)->pending_idx = pending_idx;
+-
+- __skb_put(skb, data_len);
+- queue->tx_copy_ops[*copy_ops].source.u.ref = txreq.gref;
+- queue->tx_copy_ops[*copy_ops].source.domid = queue->vif->domid;
+- queue->tx_copy_ops[*copy_ops].source.offset = txreq.offset;
+-
+- queue->tx_copy_ops[*copy_ops].dest.u.gmfn =
+- virt_to_gfn(skb->data);
+- queue->tx_copy_ops[*copy_ops].dest.domid = DOMID_SELF;
+- queue->tx_copy_ops[*copy_ops].dest.offset =
+- offset_in_page(skb->data) & ~XEN_PAGE_MASK;
+-
+- queue->tx_copy_ops[*copy_ops].len = data_len;
+- queue->tx_copy_ops[*copy_ops].flags = GNTCOPY_source_gref;
+-
+- (*copy_ops)++;
+-
+- if (data_len < txreq.size) {
+- frag_set_pending_idx(&skb_shinfo(skb)->frags[0],
+- pending_idx);
+- xenvif_tx_create_map_op(queue, pending_idx, &txreq,
+- extra_count, gop);
+- gop++;
+- } else {
+- frag_set_pending_idx(&skb_shinfo(skb)->frags[0],
+- INVALID_PENDING_IDX);
+- memcpy(&queue->pending_tx_info[pending_idx].req,
+- &txreq, sizeof(txreq));
+- queue->pending_tx_info[pending_idx].extra_count =
+- extra_count;
+- }
+-
+- queue->pending_cons++;
+-
+- gop = xenvif_get_requests(queue, skb, txfrags, gop,
+- frag_overflow, nskb);
++ xenvif_get_requests(queue, skb, &txreq, txfrags, copy_ops,
++ map_ops, frag_overflow, nskb, extra_count,
++ data_len);
+
+ __skb_queue_tail(&queue->tx_queue, skb);
+
+ queue->tx.req_cons = idx;
+
+- if (((gop-queue->tx_map_ops) >= ARRAY_SIZE(queue->tx_map_ops)) ||
++ if ((*map_ops >= ARRAY_SIZE(queue->tx_map_ops)) ||
+ (*copy_ops >= ARRAY_SIZE(queue->tx_copy_ops)))
+ break;
+ }
+
+- (*map_ops) = gop - queue->tx_map_ops;
+ return;
+ }
+
+@@ -1105,9 +1143,8 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
+ while ((skb = __skb_dequeue(&queue->tx_queue)) != NULL) {
+ struct xen_netif_tx_request *txp;
+ u16 pending_idx;
+- unsigned data_len;
+
+- pending_idx = XENVIF_TX_CB(skb)->pending_idx;
++ pending_idx = copy_pending_idx(skb, 0);
+ txp = &queue->pending_tx_info[pending_idx].req;
+
+ /* Check the remap error code. */
+@@ -1126,18 +1163,6 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
+ continue;
+ }
+
+- data_len = skb->len;
+- callback_param(queue, pending_idx).ctx = NULL;
+- if (data_len < txp->size) {
+- /* Append the packet payload as a fragment. */
+- txp->offset += data_len;
+- txp->size -= data_len;
+- } else {
+- /* Schedule a response immediately. */
+- xenvif_idx_release(queue, pending_idx,
+- XEN_NETIF_RSP_OKAY);
+- }
+-
+ if (txp->flags & XEN_NETTXF_csum_blank)
+ skb->ip_summed = CHECKSUM_PARTIAL;
+ else if (txp->flags & XEN_NETTXF_data_validated)
+@@ -1314,7 +1339,7 @@ static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue)
+ /* Called after netfront has transmitted */
+ int xenvif_tx_action(struct xenvif_queue *queue, int budget)
+ {
+- unsigned nr_mops, nr_cops = 0;
++ unsigned nr_mops = 0, nr_cops = 0;
+ int work_done, ret;
+
+ if (unlikely(!tx_work_todo(queue)))
+@@ -1401,7 +1426,7 @@ static void push_tx_responses(struct xenvif_queue *queue)
+ notify_remote_via_irq(queue->tx_irq);
+ }
+
+-void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
++static void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
+ {
+ int ret;
+ struct gnttab_unmap_grant_ref tx_unmap_op;
+diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c
+index 85a5a622ec184..ab216970137c5 100644
+--- a/drivers/net/xen-netback/rx.c
++++ b/drivers/net/xen-netback/rx.c
+@@ -82,9 +82,10 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
+ return false;
+ }
+
+-void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
++bool xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
+ {
+ unsigned long flags;
++ bool ret = true;
+
+ spin_lock_irqsave(&queue->rx_queue.lock, flags);
+
+@@ -92,8 +93,7 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
+ struct net_device *dev = queue->vif->dev;
+
+ netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id));
+- kfree_skb(skb);
+- queue->vif->dev->stats.rx_dropped++;
++ ret = false;
+ } else {
+ if (skb_queue_empty(&queue->rx_queue))
+ xenvif_update_needed_slots(queue, skb);
+@@ -104,6 +104,8 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
+ }
+
+ spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
++
++ return ret;
+ }
+
+ static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue)
+@@ -473,7 +475,7 @@ static void xenvif_rx_skb(struct xenvif_queue *queue)
+
+ #define RX_BATCH_SIZE 64
+
+-void xenvif_rx_action(struct xenvif_queue *queue)
++static void xenvif_rx_action(struct xenvif_queue *queue)
+ {
+ struct sk_buff_head completed_skbs;
+ unsigned int work_done = 0;
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 4b75ecb19d890..8c3f9f0415941 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1624,6 +1624,12 @@ static int netfront_resume(struct xenbus_device *dev)
+ netif_tx_unlock_bh(info->netdev);
+
+ xennet_disconnect_backend(info);
++
++ rtnl_lock();
++ if (info->queues)
++ xennet_destroy_queues(info);
++ rtnl_unlock();
++
+ return 0;
+ }
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index f47f3b9921613..6adff541282be 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2463,10 +2463,6 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
+ if (!ctrl->identified) {
+ int i;
+
+- ret = nvme_init_subsystem(ctrl, id);
+- if (ret)
+- goto out_free;
+-
+ /*
+ * Check for quirks. Quirk can depend on firmware version,
+ * so, in principle, the set of quirks present can change
+@@ -2479,6 +2475,10 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
+ if (quirk_matches(id, &core_quirks[i]))
+ ctrl->quirks |= core_quirks[i].quirks;
+ }
++
++ ret = nvme_init_subsystem(ctrl, id);
++ if (ret)
++ goto out_free;
+ }
+ memcpy(ctrl->subsys->firmware_rev, id->fr,
+ sizeof(ctrl->subsys->firmware_rev));
+diff --git a/drivers/regulator/twl6030-regulator.c b/drivers/regulator/twl6030-regulator.c
+index 219cbd910dbf5..485d25f683d8b 100644
+--- a/drivers/regulator/twl6030-regulator.c
++++ b/drivers/regulator/twl6030-regulator.c
+@@ -71,6 +71,7 @@ struct twlreg_info {
+ #define TWL6030_CFG_STATE_SLEEP 0x03
+ #define TWL6030_CFG_STATE_GRP_SHIFT 5
+ #define TWL6030_CFG_STATE_APP_SHIFT 2
++#define TWL6030_CFG_STATE_MASK 0x03
+ #define TWL6030_CFG_STATE_APP_MASK (0x03 << TWL6030_CFG_STATE_APP_SHIFT)
+ #define TWL6030_CFG_STATE_APP(v) (((v) & TWL6030_CFG_STATE_APP_MASK) >>\
+ TWL6030_CFG_STATE_APP_SHIFT)
+@@ -131,13 +132,14 @@ static int twl6030reg_is_enabled(struct regulator_dev *rdev)
+ if (grp < 0)
+ return grp;
+ grp &= P1_GRP_6030;
++ val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE);
++ val = TWL6030_CFG_STATE_APP(val);
+ } else {
++ val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE);
++ val &= TWL6030_CFG_STATE_MASK;
+ grp = 1;
+ }
+
+- val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE);
+- val = TWL6030_CFG_STATE_APP(val);
+-
+ return grp && (val == TWL6030_CFG_STATE_ON);
+ }
+
+@@ -190,7 +192,12 @@ static int twl6030reg_get_status(struct regulator_dev *rdev)
+
+ val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE);
+
+- switch (TWL6030_CFG_STATE_APP(val)) {
++ if (info->features & TWL6032_SUBCLASS)
++ val &= TWL6030_CFG_STATE_MASK;
++ else
++ val = TWL6030_CFG_STATE_APP(val);
++
++ switch (val) {
+ case TWL6030_CFG_STATE_ON:
+ return REGULATOR_STATUS_NORMAL;
+
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 417f4bcc1182c..9fcd583b78351 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -579,7 +579,7 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info,
+ if (scr_readw(r) != vc->vc_video_erase_char)
+ break;
+ if (r != q && new_rows >= rows + logo_lines) {
+- save = kmalloc(array3_size(logo_lines, new_cols, 2),
++ save = kzalloc(array3_size(logo_lines, new_cols, 2),
+ GFP_KERNEL);
+ if (save) {
+ int i = cols < new_cols ? cols : new_cols;
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index 02da4e1def61e..6b5d35f5087c0 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -69,6 +69,7 @@ struct css_task_iter {
+ struct list_head iters_node; /* css_set->task_iters */
+ };
+
++extern struct file_system_type cgroup_fs_type;
+ extern struct cgroup_root cgrp_dfl_root;
+ extern struct css_set init_css_set;
+
+diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h
+index 8f7729b0a6383..4168e7d97e870 100644
+--- a/kernel/cgroup/cgroup-internal.h
++++ b/kernel/cgroup/cgroup-internal.h
+@@ -148,7 +148,6 @@ extern struct mutex cgroup_mutex;
+ extern spinlock_t css_set_lock;
+ extern struct cgroup_subsys *cgroup_subsys[];
+ extern struct list_head cgroup_roots;
+-extern struct file_system_type cgroup_fs_type;
+
+ /* iterate across the hierarchies */
+ #define for_each_root(root) \
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index f3aa6e6214d5e..bc4c61dcf95c7 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -4120,6 +4120,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
+ unsigned int efd, cfd;
+ struct fd efile;
+ struct fd cfile;
++ struct dentry *cdentry;
+ const char *name;
+ char *endp;
+ int ret;
+@@ -4170,6 +4171,16 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
+ if (ret < 0)
+ goto out_put_cfile;
+
++ /*
++ * The control file must be a regular cgroup1 file. As a regular cgroup
++ * file can't be renamed, it's safe to access its name afterwards.
++ */
++ cdentry = cfile.file->f_path.dentry;
++ if (cdentry->d_sb->s_type != &cgroup_fs_type || !d_is_reg(cdentry)) {
++ ret = -EINVAL;
++ goto out_put_cfile;
++ }
++
+ /*
+ * Determine the event callbacks and set them in @event. This used
+ * to be done via struct cftype but cgroup core no longer knows
+@@ -4178,7 +4189,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
+ *
+ * DO NOT ADD NEW FILES.
+ */
+- name = cfile.file->f_path.dentry->d_name.name;
++ name = cdentry->d_name.name;
+
+ if (!strcmp(name, "memory.usage_in_bytes")) {
+ event->register_event = mem_cgroup_usage_register_event;
+@@ -4202,7 +4213,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
+ * automatically removed on cgroup destruction but the removal is
+ * asynchronous, so take an extra ref on @css.
+ */
+- cfile_css = css_tryget_online_from_dir(cfile.file->f_path.dentry->d_parent,
++ cfile_css = css_tryget_online_from_dir(cdentry->d_parent,
+ &memory_cgrp_subsys);
+ ret = -EINVAL;
+ if (IS_ERR(cfile_css))
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index e03ff8df1d3f6..0ef3d2ede6e6d 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -133,7 +133,7 @@ struct p9_conn {
+ struct list_head unsent_req_list;
+ struct p9_req_t *rreq;
+ struct p9_req_t *wreq;
+- char tmp_buf[7];
++ char tmp_buf[P9_HDRSZ];
+ struct p9_fcall rc;
+ int wpos;
+ int wsize;
+@@ -306,7 +306,7 @@ static void p9_read_work(struct work_struct *work)
+ if (!m->rc.sdata) {
+ m->rc.sdata = m->tmp_buf;
+ m->rc.offset = 0;
+- m->rc.capacity = 7; /* start by reading header */
++ m->rc.capacity = P9_HDRSZ; /* start by reading header */
+ }
+
+ clear_bit(Rpending, &m->wsched);
+@@ -329,7 +329,7 @@ static void p9_read_work(struct work_struct *work)
+ p9_debug(P9_DEBUG_TRANS, "got new header\n");
+
+ /* Header size */
+- m->rc.size = 7;
++ m->rc.size = P9_HDRSZ;
+ err = p9_parse_header(&m->rc, &m->rc.size, NULL, NULL, 0);
+ if (err) {
+ p9_debug(P9_DEBUG_ERROR,
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index ac60ddfcd88b6..6459c2356ff9f 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -230,6 +230,14 @@ static void p9_xen_response(struct work_struct *work)
+ continue;
+ }
+
++ if (h.size > req->rc.capacity) {
++ dev_warn(&priv->dev->dev,
++ "requested packet size too big: %d for tag %d with capacity %zd\n",
++ h.size, h.tag, req->rc.capacity);
++ req->status = REQ_STATUS_ERROR;
++ goto recv_error;
++ }
++
+ memcpy(&req->rc, &h, sizeof(h));
+ req->rc.offset = 0;
+
+@@ -239,6 +247,7 @@ static void p9_xen_response(struct work_struct *work)
+ masked_prod, &masked_cons,
+ XEN_9PFS_RING_SIZE);
+
++recv_error:
+ virt_mb();
+ cons += h.size;
+ ring->intf->in_cons = cons;
+diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
+index 9a75f9b00b512..4530ffb2481a4 100644
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -1014,6 +1014,7 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
+ hci_dev_lock(hdev);
+ hcon = hci_conn_hash_lookup_le(hdev, addr, *addr_type);
+ hci_dev_unlock(hdev);
++ hci_dev_put(hdev);
+
+ if (!hcon)
+ return -ENOENT;
+diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
+index ee60c30f3be2b..798f8f485e5af 100644
+--- a/net/bluetooth/af_bluetooth.c
++++ b/net/bluetooth/af_bluetooth.c
+@@ -743,7 +743,7 @@ static int __init bt_init(void)
+
+ err = bt_sysfs_init();
+ if (err < 0)
+- return err;
++ goto cleanup_led;
+
+ err = sock_register(&bt_sock_family_ops);
+ if (err)
+@@ -779,6 +779,8 @@ unregister_socket:
+ sock_unregister(PF_BLUETOOTH);
+ cleanup_sysfs:
+ bt_sysfs_cleanup();
++cleanup_led:
++ bt_leds_cleanup();
+ return err;
+ }
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 6fd1a4b617473..70820d049b92a 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -734,6 +734,9 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ ipv6_hdr(skb)->payload_len = htons(first_len -
+ sizeof(struct ipv6hdr));
+
++ /* We prevent @rt from being freed. */
++ rcu_read_lock();
++
+ for (;;) {
+ /* Prepare header of the next frame,
+ * before previous one went down. */
+@@ -776,6 +779,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ if (err == 0) {
+ IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
+ IPSTATS_MIB_FRAGOKS);
++ rcu_read_unlock();
+ return 0;
+ }
+
+@@ -783,6 +787,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+
+ IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
+ IPSTATS_MIB_FRAGFAILS);
++ rcu_read_unlock();
+ return err;
+
+ slow_path_clean:
+diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
+index bd88a9b80773e..8c2aedf3fa742 100644
+--- a/net/mac802154/iface.c
++++ b/net/mac802154/iface.c
+@@ -669,6 +669,7 @@ ieee802154_if_add(struct ieee802154_local *local, const char *name,
+ sdata->dev = ndev;
+ sdata->wpan_dev.wpan_phy = local->hw.phy;
+ sdata->local = local;
++ INIT_LIST_HEAD(&sdata->wpan_dev.list);
+
+ /* setup type-dependent data */
+ ret = ieee802154_setup_sdata(sdata, type);
+diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
+index 1e8c1a12aaec3..4f75453c07aab 100644
+--- a/net/nfc/nci/ntf.c
++++ b/net/nfc/nci/ntf.c
+@@ -230,6 +230,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev,
+ target->sens_res = nfca_poll->sens_res;
+ target->sel_res = nfca_poll->sel_res;
+ target->nfcid1_len = nfca_poll->nfcid1_len;
++ if (target->nfcid1_len > ARRAY_SIZE(target->nfcid1))
++ return -EPROTO;
+ if (target->nfcid1_len > 0) {
+ memcpy(target->nfcid1, nfca_poll->nfcid1,
+ target->nfcid1_len);
+@@ -238,6 +240,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev,
+ nfcb_poll = (struct rf_tech_specific_params_nfcb_poll *)params;
+
+ target->sensb_res_len = nfcb_poll->sensb_res_len;
++ if (target->sensb_res_len > ARRAY_SIZE(target->sensb_res))
++ return -EPROTO;
+ if (target->sensb_res_len > 0) {
+ memcpy(target->sensb_res, nfcb_poll->sensb_res,
+ target->sensb_res_len);
+@@ -246,6 +250,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev,
+ nfcf_poll = (struct rf_tech_specific_params_nfcf_poll *)params;
+
+ target->sensf_res_len = nfcf_poll->sensf_res_len;
++ if (target->sensf_res_len > ARRAY_SIZE(target->sensf_res))
++ return -EPROTO;
+ if (target->sensf_res_len > 0) {
+ memcpy(target->sensf_res, nfcf_poll->sensf_res,
+ target->sensf_res_len);
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 0d2ee4eb131f5..ee4aca974622e 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1595,7 +1595,9 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
+ if (tipc_own_addr(l->net) > msg_prevnode(hdr))
+ l->net_plane = msg_net_plane(hdr);
+
+- skb_linearize(skb);
++ if (skb_linearize(skb))
++ goto exit;
++
+ hdr = buf_msg(skb);
+ data = msg_data(hdr);
+
+diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
+index 5b0388202bac5..ac854beb8347e 100644
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -126,15 +126,19 @@ EXPORT_SYMBOL(snd_seq_dump_var_event);
+ * expand the variable length event to linear buffer space.
+ */
+
+-static int seq_copy_in_kernel(char **bufptr, const void *src, int size)
++static int seq_copy_in_kernel(void *ptr, void *src, int size)
+ {
++ char **bufptr = ptr;
++
+ memcpy(*bufptr, src, size);
+ *bufptr += size;
+ return 0;
+ }
+
+-static int seq_copy_in_user(char __user **bufptr, const void *src, int size)
++static int seq_copy_in_user(void *ptr, void *src, int size)
+ {
++ char __user **bufptr = ptr;
++
+ if (copy_to_user(*bufptr, src, size))
+ return -EFAULT;
+ *bufptr += size;
+@@ -163,8 +167,7 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char
+ return newlen;
+ }
+ err = snd_seq_dump_var_event(event,
+- in_kernel ? (snd_seq_dump_func_t)seq_copy_in_kernel :
+- (snd_seq_dump_func_t)seq_copy_in_user,
++ in_kernel ? seq_copy_in_kernel : seq_copy_in_user,
+ &buf);
+ return err < 0 ? err : newlen;
+ }
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index c03b653bf6ff3..1fabb285b016f 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1266,6 +1266,8 @@ static void dpcm_be_reparent(struct snd_soc_pcm_runtime *fe,
+ return;
+
+ be_substream = snd_soc_dpcm_get_substream(be, stream);
++ if (!be_substream)
++ return;
+
+ list_for_each_entry(dpcm, &be->dpcm[stream].fe_clients, list_fe) {
+ if (dpcm->fe == fe)
+diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh
+index ff665de788efb..10733aae2b8d1 100755
+--- a/tools/testing/selftests/net/rtnetlink.sh
++++ b/tools/testing/selftests/net/rtnetlink.sh
+@@ -681,7 +681,7 @@ kci_test_ipsec_offload()
+ tmpl proto esp src $srcip dst $dstip spi 9 \
+ mode transport reqid 42
+ check_err $?
+- ip x p add dir out src $dstip/24 dst $srcip/24 \
++ ip x p add dir in src $dstip/24 dst $srcip/24 \
+ tmpl proto esp src $dstip dst $srcip spi 9 \
+ mode transport reqid 42
+ check_err $?
+diff --git a/tools/testing/selftests/rcutorture/bin/kvm.sh b/tools/testing/selftests/rcutorture/bin/kvm.sh
+index 5a7a62d76a50b..19864f1cb27a4 100755
+--- a/tools/testing/selftests/rcutorture/bin/kvm.sh
++++ b/tools/testing/selftests/rcutorture/bin/kvm.sh
+@@ -194,6 +194,14 @@ do
+ shift
+ done
+
++if test -z "$TORTURE_INITRD" || tools/testing/selftests/rcutorture/bin/mkinitrd.sh
++then
++ :
++else
++ echo No initrd and unable to create one, aborting test >&2
++ exit 1
++fi
++
+ CONFIGFRAG=${KVM}/configs/${TORTURE_SUITE}; export CONFIGFRAG
+
+ if test -z "$configs"
+diff --git a/tools/testing/selftests/rcutorture/bin/mkinitrd.sh b/tools/testing/selftests/rcutorture/bin/mkinitrd.sh
+new file mode 100755
+index 0000000000000..ae773760f3969
+--- /dev/null
++++ b/tools/testing/selftests/rcutorture/bin/mkinitrd.sh
+@@ -0,0 +1,60 @@
++#!/bin/bash
++#
++# Create an initrd directory if one does not already exist.
++#
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 2 of the License, or
++# (at your option) any later version.
++#
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++# GNU General Public License for more details.
++#
++# You should have received a copy of the GNU General Public License
++# along with this program; if not, you can access it online at
++# http://www.gnu.org/licenses/gpl-2.0.html.
++#
++# Copyright (C) IBM Corporation, 2013
++#
++# Author: Connor Shu <Connor.Shu@ibm.com>
++
++D=tools/testing/selftests/rcutorture
++
++# Prerequisite checks
++[ -z "$D" ] && echo >&2 "No argument supplied" && exit 1
++if [ ! -d "$D" ]; then
++ echo >&2 "$D does not exist: Malformed kernel source tree?"
++ exit 1
++fi
++if [ -d "$D/initrd" ]; then
++ echo "$D/initrd already exists, no need to create it"
++ exit 0
++fi
++
++T=${TMPDIR-/tmp}/mkinitrd.sh.$$
++trap 'rm -rf $T' 0 2
++mkdir $T
++
++cat > $T/init << '__EOF___'
++#!/bin/sh
++while :
++do
++ sleep 1000000
++done
++__EOF___
++
++# Try using dracut to create initrd
++command -v dracut >/dev/null 2>&1 || { echo >&2 "Dracut not installed"; exit 1; }
++echo Creating $D/initrd using dracut.
++
++# Filesystem creation
++dracut --force --no-hostonly --no-hostonly-cmdline --module "base" $T/initramfs.img
++cd $D
++mkdir initrd
++cd initrd
++zcat $T/initramfs.img | cpio -id
++cp $T/init init
++echo Done creating $D/initrd using dracut
++exit 0
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-01-18 11:11 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-01-18 11:11 UTC (permalink / raw
To: gentoo-commits
commit: 56b72a550443e7e9eefd7614b6850bd17794ddef
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 18 11:10:58 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jan 18 11:10:58 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=56b72a55
Linux patch 4.19.270
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1269_linux-4.19.270.patch | 16094 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 16098 insertions(+)
diff --git a/0000_README b/0000_README
index fa94191a..851ba936 100644
--- a/0000_README
+++ b/0000_README
@@ -1119,6 +1119,10 @@ Patch: 1268_linux-4.19.269.patch
From: https://www.kernel.org
Desc: Linux 4.19.269
+Patch: 1269_linux-4.19.270.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.270
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1269_linux-4.19.270.patch b/1269_linux-4.19.270.patch
new file mode 100644
index 00000000..49a7e801
--- /dev/null
+++ b/1269_linux-4.19.270.patch
@@ -0,0 +1,16094 @@
+diff --git a/Documentation/driver-api/spi.rst b/Documentation/driver-api/spi.rst
+index f64cb666498aa..f28887045049d 100644
+--- a/Documentation/driver-api/spi.rst
++++ b/Documentation/driver-api/spi.rst
+@@ -25,8 +25,8 @@ hardware, which may be as simple as a set of GPIO pins or as complex as
+ a pair of FIFOs connected to dual DMA engines on the other side of the
+ SPI shift register (maximizing throughput). Such drivers bridge between
+ whatever bus they sit on (often the platform bus) and SPI, and expose
+-the SPI side of their device as a :c:type:`struct spi_master
+-<spi_master>`. SPI devices are children of that master,
++the SPI side of their device as a :c:type:`struct spi_controller
++<spi_controller>`. SPI devices are children of that master,
+ represented as a :c:type:`struct spi_device <spi_device>` and
+ manufactured from :c:type:`struct spi_board_info
+ <spi_board_info>` descriptors which are usually provided by
+diff --git a/Documentation/fault-injection/fault-injection.txt b/Documentation/fault-injection/fault-injection.txt
+index 4d1b7b4ccfaf0..b2b86147bafe4 100644
+--- a/Documentation/fault-injection/fault-injection.txt
++++ b/Documentation/fault-injection/fault-injection.txt
+@@ -71,8 +71,8 @@ configuration of fault-injection capabilities.
+
+ - /sys/kernel/debug/fail*/times:
+
+- specifies how many times failures may happen at most.
+- A value of -1 means "no limit".
++ specifies how many times failures may happen at most. A value of -1
++ means "no limit".
+
+ - /sys/kernel/debug/fail*/space:
+
+diff --git a/Documentation/sphinx/load_config.py b/Documentation/sphinx/load_config.py
+index 301a21aa4f631..4c9cdcb71c2c6 100644
+--- a/Documentation/sphinx/load_config.py
++++ b/Documentation/sphinx/load_config.py
+@@ -3,7 +3,7 @@
+
+ import os
+ import sys
+-from sphinx.util.pycompat import execfile_
++from sphinx.util.osutil import fs_encoding
+
+ # ------------------------------------------------------------------------------
+ def loadConfig(namespace):
+@@ -25,7 +25,9 @@ def loadConfig(namespace):
+ sys.stdout.write("load additional sphinx-config: %s\n" % config_file)
+ config = namespace.copy()
+ config['__file__'] = config_file
+- execfile_(config_file, config)
++ with open(config_file, 'rb') as f:
++ code = compile(f.read(), fs_encoding, 'exec')
++ exec(code, config)
+ del config['__file__']
+ namespace.update(config)
+ else:
+diff --git a/Makefile b/Makefile
+index bde1d2d704e72..11c68e88776a5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 269
++SUBLEVEL = 270
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/kernel/entry.S b/arch/alpha/kernel/entry.S
+index c64806a2daf54..ebe52200a9dca 100644
+--- a/arch/alpha/kernel/entry.S
++++ b/arch/alpha/kernel/entry.S
+@@ -469,8 +469,10 @@ entSys:
+ #ifdef CONFIG_AUDITSYSCALL
+ lda $6, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
+ and $3, $6, $3
+-#endif
+ bne $3, strace
++#else
++ blbs $3, strace /* check for SYSCALL_TRACE in disguise */
++#endif
+ beq $4, 1f
+ ldq $27, 0($5)
+ 1: jsr $26, ($27), alpha_ni_syscall
+diff --git a/arch/arm/boot/dts/armada-370.dtsi b/arch/arm/boot/dts/armada-370.dtsi
+index 46e6d3ed8f35a..c042c416a94a3 100644
+--- a/arch/arm/boot/dts/armada-370.dtsi
++++ b/arch/arm/boot/dts/armada-370.dtsi
+@@ -74,7 +74,7 @@
+
+ pcie2: pcie@2,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82002800 0 0x80000 0 0x2000>;
++ assigned-addresses = <0x82001000 0 0x80000 0 0x2000>;
+ reg = <0x1000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+diff --git a/arch/arm/boot/dts/armada-375.dtsi b/arch/arm/boot/dts/armada-375.dtsi
+index 2932a29ae272e..230f6dd876a2a 100644
+--- a/arch/arm/boot/dts/armada-375.dtsi
++++ b/arch/arm/boot/dts/armada-375.dtsi
+@@ -584,7 +584,7 @@
+
+ pcie1: pcie@2,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>;
++ assigned-addresses = <0x82001000 0 0x44000 0 0x2000>;
+ reg = <0x1000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+diff --git a/arch/arm/boot/dts/armada-380.dtsi b/arch/arm/boot/dts/armada-380.dtsi
+index cff1269f3fbfd..7146cc8f082af 100644
+--- a/arch/arm/boot/dts/armada-380.dtsi
++++ b/arch/arm/boot/dts/armada-380.dtsi
+@@ -79,7 +79,7 @@
+ /* x1 port */
+ pcie@2,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x40000 0 0x2000>;
++ assigned-addresses = <0x82001000 0 0x40000 0 0x2000>;
+ reg = <0x1000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -98,7 +98,7 @@
+ /* x1 port */
+ pcie@3,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>;
++ assigned-addresses = <0x82001800 0 0x44000 0 0x2000>;
+ reg = <0x1800 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+diff --git a/arch/arm/boot/dts/armada-385-turris-omnia.dts b/arch/arm/boot/dts/armada-385-turris-omnia.dts
+index 92e08486ec81f..320c759b4090f 100644
+--- a/arch/arm/boot/dts/armada-385-turris-omnia.dts
++++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts
+@@ -22,6 +22,12 @@
+ stdout-path = &uart0;
+ };
+
++ aliases {
++ ethernet0 = ð0;
++ ethernet1 = ð1;
++ ethernet2 = ð2;
++ };
++
+ memory {
+ device_type = "memory";
+ reg = <0x00000000 0x40000000>; /* 1024 MB */
+@@ -291,7 +297,17 @@
+ };
+ };
+
+- /* port 6 is connected to eth0 */
++ ports@6 {
++ reg = <6>;
++ label = "cpu";
++ ethernet = <ð0>;
++ phy-mode = "rgmii-id";
++
++ fixed-link {
++ speed = <1000>;
++ full-duplex;
++ };
++ };
+ };
+ };
+ };
+diff --git a/arch/arm/boot/dts/armada-385.dtsi b/arch/arm/boot/dts/armada-385.dtsi
+index f0022d10c7159..f081f7cb66e5f 100644
+--- a/arch/arm/boot/dts/armada-385.dtsi
++++ b/arch/arm/boot/dts/armada-385.dtsi
+@@ -84,7 +84,7 @@
+ /* x1 port */
+ pcie2: pcie@2,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x40000 0 0x2000>;
++ assigned-addresses = <0x82001000 0 0x40000 0 0x2000>;
+ reg = <0x1000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -103,7 +103,7 @@
+ /* x1 port */
+ pcie3: pcie@3,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>;
++ assigned-addresses = <0x82001800 0 0x44000 0 0x2000>;
+ reg = <0x1800 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -125,7 +125,7 @@
+ */
+ pcie4: pcie@4,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x48000 0 0x2000>;
++ assigned-addresses = <0x82002000 0 0x48000 0 0x2000>;
+ reg = <0x2000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+diff --git a/arch/arm/boot/dts/armada-39x.dtsi b/arch/arm/boot/dts/armada-39x.dtsi
+index f0c949831efb7..f589112e76975 100644
+--- a/arch/arm/boot/dts/armada-39x.dtsi
++++ b/arch/arm/boot/dts/armada-39x.dtsi
+@@ -456,7 +456,7 @@
+ /* x1 port */
+ pcie@2,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x40000 0 0x2000>;
++ assigned-addresses = <0x82001000 0 0x40000 0 0x2000>;
+ reg = <0x1000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -475,7 +475,7 @@
+ /* x1 port */
+ pcie@3,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>;
++ assigned-addresses = <0x82001800 0 0x44000 0 0x2000>;
+ reg = <0x1800 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -497,7 +497,7 @@
+ */
+ pcie@4,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x48000 0 0x2000>;
++ assigned-addresses = <0x82002000 0 0x48000 0 0x2000>;
+ reg = <0x2000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+diff --git a/arch/arm/boot/dts/armada-xp-mv78230.dtsi b/arch/arm/boot/dts/armada-xp-mv78230.dtsi
+index 8558bf6bb54c6..d55fe162fc7f0 100644
+--- a/arch/arm/boot/dts/armada-xp-mv78230.dtsi
++++ b/arch/arm/boot/dts/armada-xp-mv78230.dtsi
+@@ -97,7 +97,7 @@
+
+ pcie2: pcie@2,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>;
++ assigned-addresses = <0x82001000 0 0x44000 0 0x2000>;
+ reg = <0x1000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -115,7 +115,7 @@
+
+ pcie3: pcie@3,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x48000 0 0x2000>;
++ assigned-addresses = <0x82001800 0 0x48000 0 0x2000>;
+ reg = <0x1800 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -133,7 +133,7 @@
+
+ pcie4: pcie@4,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x4c000 0 0x2000>;
++ assigned-addresses = <0x82002000 0 0x4c000 0 0x2000>;
+ reg = <0x2000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -151,7 +151,7 @@
+
+ pcie5: pcie@5,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x80000 0 0x2000>;
++ assigned-addresses = <0x82002800 0 0x80000 0 0x2000>;
+ reg = <0x2800 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+diff --git a/arch/arm/boot/dts/armada-xp-mv78260.dtsi b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
+index 2d85fe8ac3272..fdcc818199401 100644
+--- a/arch/arm/boot/dts/armada-xp-mv78260.dtsi
++++ b/arch/arm/boot/dts/armada-xp-mv78260.dtsi
+@@ -112,7 +112,7 @@
+
+ pcie2: pcie@2,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>;
++ assigned-addresses = <0x82001000 0 0x44000 0 0x2000>;
+ reg = <0x1000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -130,7 +130,7 @@
+
+ pcie3: pcie@3,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x48000 0 0x2000>;
++ assigned-addresses = <0x82001800 0 0x48000 0 0x2000>;
+ reg = <0x1800 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -148,7 +148,7 @@
+
+ pcie4: pcie@4,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x4c000 0 0x2000>;
++ assigned-addresses = <0x82002000 0 0x4c000 0 0x2000>;
+ reg = <0x2000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -166,7 +166,7 @@
+
+ pcie5: pcie@5,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x80000 0 0x2000>;
++ assigned-addresses = <0x82002800 0 0x80000 0 0x2000>;
+ reg = <0x2800 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -184,7 +184,7 @@
+
+ pcie6: pcie@6,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x84000 0 0x2000>;
++ assigned-addresses = <0x82003000 0 0x84000 0 0x2000>;
+ reg = <0x3000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -202,7 +202,7 @@
+
+ pcie7: pcie@7,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x88000 0 0x2000>;
++ assigned-addresses = <0x82003800 0 0x88000 0 0x2000>;
+ reg = <0x3800 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -220,7 +220,7 @@
+
+ pcie8: pcie@8,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x8c000 0 0x2000>;
++ assigned-addresses = <0x82004000 0 0x8c000 0 0x2000>;
+ reg = <0x4000 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+@@ -238,7 +238,7 @@
+
+ pcie9: pcie@9,0 {
+ device_type = "pci";
+- assigned-addresses = <0x82000800 0 0x42000 0 0x2000>;
++ assigned-addresses = <0x82004800 0 0x42000 0 0x2000>;
+ reg = <0x4800 0 0 0 0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi
+index 250ad0535e8cc..c677d1a74a905 100644
+--- a/arch/arm/boot/dts/dove.dtsi
++++ b/arch/arm/boot/dts/dove.dtsi
+@@ -129,7 +129,7 @@
+ pcie1: pcie@2 {
+ device_type = "pci";
+ status = "disabled";
+- assigned-addresses = <0x82002800 0 0x80000 0 0x2000>;
++ assigned-addresses = <0x82001000 0 0x80000 0 0x2000>;
+ reg = <0x1000 0 0 0 0>;
+ clocks = <&gate_clk 5>;
+ marvell,pcie-port = <1>;
+diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
+index 00daa844bf8c6..3b9d70eadeb95 100644
+--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
+@@ -1604,7 +1604,7 @@
+ };
+
+ etb@1a01000 {
+- compatible = "coresight-etb10", "arm,primecell";
++ compatible = "arm,coresight-etb10", "arm,primecell";
+ reg = <0x1a01000 0x1000>;
+
+ clocks = <&rpmcc RPM_QDSS_CLK>;
+diff --git a/arch/arm/boot/dts/spear600.dtsi b/arch/arm/boot/dts/spear600.dtsi
+index 00166eb9be86f..ca07e73e1f27d 100644
+--- a/arch/arm/boot/dts/spear600.dtsi
++++ b/arch/arm/boot/dts/spear600.dtsi
+@@ -53,7 +53,7 @@
+ compatible = "arm,pl110", "arm,primecell";
+ reg = <0xfc200000 0x1000>;
+ interrupt-parent = <&vic1>;
+- interrupts = <12>;
++ interrupts = <13>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm/mach-mmp/time.c b/arch/arm/mach-mmp/time.c
+index 96ad1db0b04be..edd280e755462 100644
+--- a/arch/arm/mach-mmp/time.c
++++ b/arch/arm/mach-mmp/time.c
+@@ -52,18 +52,21 @@
+ static void __iomem *mmp_timer_base = TIMERS_VIRT_BASE;
+
+ /*
+- * FIXME: the timer needs some delay to stablize the counter capture
++ * Read the timer through the CVWR register. Delay is required after requesting
++ * a read. The CR register cannot be directly read due to metastability issues
++ * documented in the PXA168 software manual.
+ */
+ static inline uint32_t timer_read(void)
+ {
+- int delay = 100;
++ uint32_t val;
++ int delay = 3;
+
+ __raw_writel(1, mmp_timer_base + TMR_CVWR(1));
+
+ while (delay--)
+- cpu_relax();
++ val = __raw_readl(mmp_timer_base + TMR_CVWR(1));
+
+- return __raw_readl(mmp_timer_base + TMR_CVWR(1));
++ return val;
+ }
+
+ static u64 notrace mmp_read_sched_clock(void)
+diff --git a/arch/arm/nwfpe/Makefile b/arch/arm/nwfpe/Makefile
+index 303400fa2cdf7..2aec85ab1e8b9 100644
+--- a/arch/arm/nwfpe/Makefile
++++ b/arch/arm/nwfpe/Makefile
+@@ -11,3 +11,9 @@ nwfpe-y += fpa11.o fpa11_cpdo.o fpa11_cpdt.o \
+ entry.o
+
+ nwfpe-$(CONFIG_FPE_NWFPE_XP) += extended_cpdo.o
++
++# Try really hard to avoid generating calls to __aeabi_uldivmod() from
++# float64_rem() due to loop elision.
++ifdef CONFIG_CC_IS_CLANG
++CFLAGS_softfloat.o += -mllvm -replexitval=never
++endif
+diff --git a/arch/arm64/boot/dts/mediatek/mt2712-evb.dts b/arch/arm64/boot/dts/mediatek/mt2712-evb.dts
+index 4ce9d6ca0bf78..424c22a266c4d 100644
+--- a/arch/arm64/boot/dts/mediatek/mt2712-evb.dts
++++ b/arch/arm64/boot/dts/mediatek/mt2712-evb.dts
+@@ -25,14 +25,14 @@
+ stdout-path = "serial0:921600n8";
+ };
+
+- cpus_fixed_vproc0: fixedregulator@0 {
++ cpus_fixed_vproc0: regulator-vproc-buck0 {
+ compatible = "regulator-fixed";
+ regulator-name = "vproc_buck0";
+ regulator-min-microvolt = <1000000>;
+ regulator-max-microvolt = <1000000>;
+ };
+
+- cpus_fixed_vproc1: fixedregulator@1 {
++ cpus_fixed_vproc1: regulator-vproc-buck1 {
+ compatible = "regulator-fixed";
+ regulator-name = "vproc_buck1";
+ regulator-min-microvolt = <1000000>;
+diff --git a/arch/arm64/boot/dts/mediatek/mt2712e.dtsi b/arch/arm64/boot/dts/mediatek/mt2712e.dtsi
+index 75cc0f7cc0888..9acbd82fb44b4 100644
+--- a/arch/arm64/boot/dts/mediatek/mt2712e.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt2712e.dtsi
+@@ -158,70 +158,70 @@
+ #clock-cells = <0>;
+ };
+
+- clk26m: oscillator@0 {
++ clk26m: oscillator-26m {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <26000000>;
+ clock-output-names = "clk26m";
+ };
+
+- clk32k: oscillator@1 {
++ clk32k: oscillator-32k {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <32768>;
+ clock-output-names = "clk32k";
+ };
+
+- clkfpc: oscillator@2 {
++ clkfpc: oscillator-50m {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <50000000>;
+ clock-output-names = "clkfpc";
+ };
+
+- clkaud_ext_i_0: oscillator@3 {
++ clkaud_ext_i_0: oscillator-aud0 {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <6500000>;
+ clock-output-names = "clkaud_ext_i_0";
+ };
+
+- clkaud_ext_i_1: oscillator@4 {
++ clkaud_ext_i_1: oscillator-aud1 {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <196608000>;
+ clock-output-names = "clkaud_ext_i_1";
+ };
+
+- clkaud_ext_i_2: oscillator@5 {
++ clkaud_ext_i_2: oscillator-aud2 {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <180633600>;
+ clock-output-names = "clkaud_ext_i_2";
+ };
+
+- clki2si0_mck_i: oscillator@6 {
++ clki2si0_mck_i: oscillator-i2s0 {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <30000000>;
+ clock-output-names = "clki2si0_mck_i";
+ };
+
+- clki2si1_mck_i: oscillator@7 {
++ clki2si1_mck_i: oscillator-i2s1 {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <30000000>;
+ clock-output-names = "clki2si1_mck_i";
+ };
+
+- clki2si2_mck_i: oscillator@8 {
++ clki2si2_mck_i: oscillator-i2s2 {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <30000000>;
+ clock-output-names = "clki2si2_mck_i";
+ };
+
+- clktdmin_mclk_i: oscillator@9 {
++ clktdmin_mclk_i: oscillator-mclk {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <30000000>;
+@@ -264,7 +264,7 @@
+ reg = <0 0x10005000 0 0x1000>;
+ };
+
+- pio: pinctrl@10005000 {
++ pio: pinctrl@1000b000 {
+ compatible = "mediatek,mt2712-pinctrl";
+ reg = <0 0x1000b000 0 0x1000>;
+ mediatek,pctl-regmap = <&syscfg_pctl_a>;
+diff --git a/arch/arm64/boot/dts/mediatek/mt6797.dtsi b/arch/arm64/boot/dts/mediatek/mt6797.dtsi
+index 4beaa71107d7d..ebe1b5343966d 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6797.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt6797.dtsi
+@@ -101,7 +101,7 @@
+ };
+ };
+
+- clk26m: oscillator@0 {
++ clk26m: oscillator-26m {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+ clock-frequency = <26000000>;
+diff --git a/arch/arm64/include/asm/atomic_ll_sc.h b/arch/arm64/include/asm/atomic_ll_sc.h
+index 1cc42441bc672..a9b315dc7e24e 100644
+--- a/arch/arm64/include/asm/atomic_ll_sc.h
++++ b/arch/arm64/include/asm/atomic_ll_sc.h
+@@ -320,7 +320,7 @@ __LL_SC_PREFIX(__cmpxchg_double##name(unsigned long old1, \
+ " cbnz %w0, 1b\n" \
+ " " #mb "\n" \
+ "2:" \
+- : "=&r" (tmp), "=&r" (ret), "+Q" (*(unsigned long *)ptr) \
++ : "=&r" (tmp), "=&r" (ret), "+Q" (*(__uint128_t *)ptr) \
+ : "r" (old1), "r" (old2), "r" (new1), "r" (new2) \
+ : cl); \
+ \
+diff --git a/arch/arm64/include/asm/atomic_lse.h b/arch/arm64/include/asm/atomic_lse.h
+index 80cadc789f1a7..393d73797e733 100644
+--- a/arch/arm64/include/asm/atomic_lse.h
++++ b/arch/arm64/include/asm/atomic_lse.h
+@@ -555,7 +555,7 @@ static inline long __cmpxchg_double##name(unsigned long old1, \
+ " eor %[old2], %[old2], %[oldval2]\n" \
+ " orr %[old1], %[old1], %[old2]") \
+ : [old1] "+&r" (x0), [old2] "+&r" (x1), \
+- [v] "+Q" (*(unsigned long *)ptr) \
++ [v] "+Q" (*(__uint128_t *)ptr) \
+ : [new1] "r" (x2), [new2] "r" (x3), [ptr] "r" (x4), \
+ [oldval1] "r" (oldval1), [oldval2] "r" (oldval2) \
+ : __LL_SC_CLOBBERS, ##cl); \
+diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c
+index dcfa0ea912fe1..f183c45503ce1 100644
+--- a/arch/mips/bcm63xx/clk.c
++++ b/arch/mips/bcm63xx/clk.c
+@@ -361,6 +361,8 @@ static struct clk clk_periph = {
+ */
+ int clk_enable(struct clk *clk)
+ {
++ if (!clk)
++ return 0;
+ mutex_lock(&clocks_mutex);
+ clk_enable_unlocked(clk);
+ mutex_unlock(&clocks_mutex);
+diff --git a/arch/mips/kernel/vpe-cmp.c b/arch/mips/kernel/vpe-cmp.c
+index 9268ebc0f61e6..903c07bdc92d9 100644
+--- a/arch/mips/kernel/vpe-cmp.c
++++ b/arch/mips/kernel/vpe-cmp.c
+@@ -75,7 +75,6 @@ ATTRIBUTE_GROUPS(vpe);
+
+ static void vpe_device_release(struct device *cd)
+ {
+- kfree(cd);
+ }
+
+ static struct class vpe_class = {
+@@ -157,6 +156,7 @@ out_dev:
+ device_del(&vpe_device);
+
+ out_class:
++ put_device(&vpe_device);
+ class_unregister(&vpe_class);
+
+ out_chrdev:
+@@ -169,7 +169,7 @@ void __exit vpe_module_exit(void)
+ {
+ struct vpe *v, *n;
+
+- device_del(&vpe_device);
++ device_unregister(&vpe_device);
+ class_unregister(&vpe_class);
+ unregister_chrdev(major, VPE_MODULE_NAME);
+
+diff --git a/arch/mips/kernel/vpe-mt.c b/arch/mips/kernel/vpe-mt.c
+index 2e003b11a098f..9fd7cd48ea1d2 100644
+--- a/arch/mips/kernel/vpe-mt.c
++++ b/arch/mips/kernel/vpe-mt.c
+@@ -313,7 +313,6 @@ ATTRIBUTE_GROUPS(vpe);
+
+ static void vpe_device_release(struct device *cd)
+ {
+- kfree(cd);
+ }
+
+ static struct class vpe_class = {
+@@ -497,6 +496,7 @@ out_dev:
+ device_del(&vpe_device);
+
+ out_class:
++ put_device(&vpe_device);
+ class_unregister(&vpe_class);
+
+ out_chrdev:
+@@ -509,7 +509,7 @@ void __exit vpe_module_exit(void)
+ {
+ struct vpe *v, *n;
+
+- device_del(&vpe_device);
++ device_unregister(&vpe_device);
+ class_unregister(&vpe_class);
+ unregister_chrdev(major, VPE_MODULE_NAME);
+
+diff --git a/arch/parisc/include/uapi/asm/mman.h b/arch/parisc/include/uapi/asm/mman.h
+index 870fbf8c70881..13f61fdf38239 100644
+--- a/arch/parisc/include/uapi/asm/mman.h
++++ b/arch/parisc/include/uapi/asm/mman.h
+@@ -50,25 +50,24 @@
+ #define MADV_DONTFORK 10 /* don't inherit across fork */
+ #define MADV_DOFORK 11 /* do inherit across fork */
+
+-#define MADV_MERGEABLE 65 /* KSM may merge identical pages */
+-#define MADV_UNMERGEABLE 66 /* KSM may not merge identical pages */
++#define MADV_MERGEABLE 12 /* KSM may merge identical pages */
++#define MADV_UNMERGEABLE 13 /* KSM may not merge identical pages */
+
+-#define MADV_HUGEPAGE 67 /* Worth backing with hugepages */
+-#define MADV_NOHUGEPAGE 68 /* Not worth backing with hugepages */
++#define MADV_HUGEPAGE 14 /* Worth backing with hugepages */
++#define MADV_NOHUGEPAGE 15 /* Not worth backing with hugepages */
+
+-#define MADV_DONTDUMP 69 /* Explicity exclude from the core dump,
++#define MADV_DONTDUMP 16 /* Explicity exclude from the core dump,
+ overrides the coredump filter bits */
+-#define MADV_DODUMP 70 /* Clear the MADV_NODUMP flag */
++#define MADV_DODUMP 17 /* Clear the MADV_NODUMP flag */
+
+-#define MADV_WIPEONFORK 71 /* Zero memory on fork, child only */
+-#define MADV_KEEPONFORK 72 /* Undo MADV_WIPEONFORK */
++#define MADV_WIPEONFORK 18 /* Zero memory on fork, child only */
++#define MADV_KEEPONFORK 19 /* Undo MADV_WIPEONFORK */
+
+ #define MADV_HWPOISON 100 /* poison a page for testing */
+ #define MADV_SOFT_OFFLINE 101 /* soft offline page for testing */
+
+ /* compatibility flags */
+ #define MAP_FILE 0
+-#define MAP_VARIABLE 0
+
+ #define PKEY_DISABLE_ACCESS 0x1
+ #define PKEY_DISABLE_WRITE 0x2
+diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
+index 376ea0d1b2759..4306d1bea98bf 100644
+--- a/arch/parisc/kernel/sys_parisc.c
++++ b/arch/parisc/kernel/sys_parisc.c
+@@ -386,3 +386,30 @@ long parisc_personality(unsigned long personality)
+
+ return err;
+ }
++
++/*
++ * madvise() wrapper
++ *
++ * Up to kernel v6.1 parisc has different values than all other
++ * platforms for the MADV_xxx flags listed below.
++ * To keep binary compatibility with existing userspace programs
++ * translate the former values to the new values.
++ *
++ * XXX: Remove this wrapper in year 2025 (or later)
++ */
++
++asmlinkage notrace long parisc_madvise(unsigned long start, size_t len_in, int behavior)
++{
++ switch (behavior) {
++ case 65: behavior = MADV_MERGEABLE; break;
++ case 66: behavior = MADV_UNMERGEABLE; break;
++ case 67: behavior = MADV_HUGEPAGE; break;
++ case 68: behavior = MADV_NOHUGEPAGE; break;
++ case 69: behavior = MADV_DONTDUMP; break;
++ case 70: behavior = MADV_DODUMP; break;
++ case 71: behavior = MADV_WIPEONFORK; break;
++ case 72: behavior = MADV_KEEPONFORK; break;
++ }
++
++ return sys_madvise(start, len_in, behavior);
++}
+diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
+index fe3f2a49d2b10..64a72f161eebb 100644
+--- a/arch/parisc/kernel/syscall_table.S
++++ b/arch/parisc/kernel/syscall_table.S
+@@ -195,7 +195,7 @@
+ ENTRY_COMP(sysinfo)
+ ENTRY_SAME(shutdown)
+ ENTRY_SAME(fsync)
+- ENTRY_SAME(madvise)
++ ENTRY_OURS(madvise)
+ ENTRY_SAME(clone_wrapper) /* 120 */
+ ENTRY_SAME(setdomainname)
+ ENTRY_COMP(sendfile)
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index b492cb1c36fd9..a3f08a380c992 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -717,6 +717,7 @@ void __noreturn rtas_halt(void)
+
+ /* Must be in the RMO region, so we place it here */
+ static char rtas_os_term_buf[2048];
++static s32 ibm_os_term_token = RTAS_UNKNOWN_SERVICE;
+
+ void rtas_os_term(char *str)
+ {
+@@ -728,16 +729,20 @@ void rtas_os_term(char *str)
+ * this property may terminate the partition which we want to avoid
+ * since it interferes with panic_timeout.
+ */
+- if (RTAS_UNKNOWN_SERVICE == rtas_token("ibm,os-term") ||
+- RTAS_UNKNOWN_SERVICE == rtas_token("ibm,extended-os-term"))
++ if (ibm_os_term_token == RTAS_UNKNOWN_SERVICE)
+ return;
+
+ snprintf(rtas_os_term_buf, 2048, "OS panic: %s", str);
+
++ /*
++ * Keep calling as long as RTAS returns a "try again" status,
++ * but don't use rtas_busy_delay(), which potentially
++ * schedules.
++ */
+ do {
+- status = rtas_call(rtas_token("ibm,os-term"), 1, 1, NULL,
++ status = rtas_call(ibm_os_term_token, 1, 1, NULL,
+ __pa(rtas_os_term_buf));
+- } while (rtas_busy_delay(status));
++ } while (rtas_busy_delay_time(status));
+
+ if (status != 0)
+ printk(KERN_EMERG "ibm,os-term call failed %d\n", status);
+@@ -1332,6 +1337,13 @@ void __init rtas_initialize(void)
+ no_entry = of_property_read_u32(rtas.dev, "linux,rtas-entry", &entry);
+ rtas.entry = no_entry ? rtas.base : entry;
+
++ /*
++ * Discover these now to avoid device tree lookups in the
++ * panic path.
++ */
++ if (of_property_read_bool(rtas.dev, "ibm,extended-os-term"))
++ ibm_os_term_token = rtas_token("ibm,os-term");
++
+ /* If RTAS was found, allocate the RMO buffer for it and look for
+ * the stop-self token if any
+ */
+diff --git a/arch/powerpc/perf/callchain.c b/arch/powerpc/perf/callchain.c
+index 0af051a1974e0..26a31a3b661e2 100644
+--- a/arch/powerpc/perf/callchain.c
++++ b/arch/powerpc/perf/callchain.c
+@@ -68,6 +68,7 @@ perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *re
+ next_sp = fp[0];
+
+ if (next_sp == sp + STACK_INT_FRAME_SIZE &&
++ validate_sp(sp, current, STACK_INT_FRAME_SIZE) &&
+ fp[STACK_FRAME_MARKER] == STACK_FRAME_REGS_MARKER) {
+ /*
+ * This looks like an interrupt frame for an
+diff --git a/arch/powerpc/perf/hv-gpci-requests.h b/arch/powerpc/perf/hv-gpci-requests.h
+index 8965b4463d433..5e86371a20c78 100644
+--- a/arch/powerpc/perf/hv-gpci-requests.h
++++ b/arch/powerpc/perf/hv-gpci-requests.h
+@@ -79,6 +79,7 @@ REQUEST(__field(0, 8, partition_id)
+ )
+ #include I(REQUEST_END)
+
++#ifdef ENABLE_EVENTS_COUNTERINFO_V6
+ /*
+ * Not available for counter_info_version >= 0x8, use
+ * run_instruction_cycles_by_partition(0x100) instead.
+@@ -92,6 +93,7 @@ REQUEST(__field(0, 8, partition_id)
+ __count(0x10, 8, cycles)
+ )
+ #include I(REQUEST_END)
++#endif
+
+ #define REQUEST_NAME system_performance_capabilities
+ #define REQUEST_NUM 0x40
+@@ -103,6 +105,7 @@ REQUEST(__field(0, 1, perf_collect_privileged)
+ )
+ #include I(REQUEST_END)
+
++#ifdef ENABLE_EVENTS_COUNTERINFO_V6
+ #define REQUEST_NAME processor_bus_utilization_abc_links
+ #define REQUEST_NUM 0x50
+ #define REQUEST_IDX_KIND "hw_chip_id=?"
+@@ -194,6 +197,7 @@ REQUEST(__field(0, 4, phys_processor_idx)
+ __count(0x28, 8, instructions_completed)
+ )
+ #include I(REQUEST_END)
++#endif
+
+ /* Processor_core_power_mode (0x95) skipped, no counters */
+ /* Affinity_domain_information_by_virtual_processor (0xA0) skipped,
+diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c
+index 160b86d9d8199..126409bb5626e 100644
+--- a/arch/powerpc/perf/hv-gpci.c
++++ b/arch/powerpc/perf/hv-gpci.c
+@@ -74,7 +74,7 @@ static struct attribute_group format_group = {
+
+ static struct attribute_group event_group = {
+ .name = "events",
+- .attrs = hv_gpci_event_attrs,
++ /* .attrs is set in init */
+ };
+
+ #define HV_CAPS_ATTR(_name, _format) \
+@@ -292,6 +292,7 @@ static int hv_gpci_init(void)
+ int r;
+ unsigned long hret;
+ struct hv_perf_caps caps;
++ struct hv_gpci_request_buffer *arg;
+
+ hv_gpci_assert_offsets_correct();
+
+@@ -310,6 +311,36 @@ static int hv_gpci_init(void)
+ /* sampling not supported */
+ h_gpci_pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT;
+
++ arg = (void *)get_cpu_var(hv_gpci_reqb);
++ memset(arg, 0, HGPCI_REQ_BUFFER_SIZE);
++
++ /*
++ * hcall H_GET_PERF_COUNTER_INFO populates the output
++ * counter_info_version value based on the system hypervisor.
++ * Pass the counter request 0x10 corresponds to request type
++ * 'Dispatch_timebase_by_processor', to get the supported
++ * counter_info_version.
++ */
++ arg->params.counter_request = cpu_to_be32(0x10);
++
++ r = plpar_hcall_norets(H_GET_PERF_COUNTER_INFO,
++ virt_to_phys(arg), HGPCI_REQ_BUFFER_SIZE);
++ if (r) {
++ pr_devel("hcall failed, can't get supported counter_info_version: 0x%x\n", r);
++ arg->params.counter_info_version_out = 0x8;
++ }
++
++ /*
++ * Use counter_info_version_out value to assign
++ * required hv-gpci event list.
++ */
++ if (arg->params.counter_info_version_out >= 0x8)
++ event_group.attrs = hv_gpci_event_attrs;
++ else
++ event_group.attrs = hv_gpci_event_attrs_v6;
++
++ put_cpu_var(hv_gpci_reqb);
++
+ r = perf_pmu_register(&h_gpci_pmu, h_gpci_pmu.name, -1);
+ if (r)
+ return r;
+diff --git a/arch/powerpc/perf/hv-gpci.h b/arch/powerpc/perf/hv-gpci.h
+index a3053eda5dcc3..060e464d35c6e 100644
+--- a/arch/powerpc/perf/hv-gpci.h
++++ b/arch/powerpc/perf/hv-gpci.h
+@@ -53,6 +53,7 @@ enum {
+ #define REQUEST_FILE "../hv-gpci-requests.h"
+ #define NAME_LOWER hv_gpci
+ #define NAME_UPPER HV_GPCI
++#define ENABLE_EVENTS_COUNTERINFO_V6
+ #include "req-gen/perf.h"
+ #undef REQUEST_FILE
+ #undef NAME_LOWER
+diff --git a/arch/powerpc/perf/req-gen/perf.h b/arch/powerpc/perf/req-gen/perf.h
+index fa9bc804e67af..6b2a59fefffa7 100644
+--- a/arch/powerpc/perf/req-gen/perf.h
++++ b/arch/powerpc/perf/req-gen/perf.h
+@@ -139,6 +139,26 @@ PMU_EVENT_ATTR_STRING( \
+ #define REQUEST_(r_name, r_value, r_idx_1, r_fields) \
+ r_fields
+
++/* Generate event list for platforms with counter_info_version 0x6 or below */
++static __maybe_unused struct attribute *hv_gpci_event_attrs_v6[] = {
++#include REQUEST_FILE
++ NULL
++};
++
++/*
++ * Based on getPerfCountInfo v1.018 documentation, some of the hv-gpci
++ * events were deprecated for platform firmware that supports
++ * counter_info_version 0x8 or above.
++ * Those deprecated events are still part of platform firmware that
++ * support counter_info_version 0x6 and below. As per the getPerfCountInfo
++ * v1.018 documentation there is no counter_info_version 0x7.
++ * Undefining macro ENABLE_EVENTS_COUNTERINFO_V6, to disable the addition of
++ * deprecated events in "hv_gpci_event_attrs" attribute group, for platforms
++ * that supports counter_info_version 0x8 or above.
++ */
++#undef ENABLE_EVENTS_COUNTERINFO_V6
++
++/* Generate event list for platforms with counter_info_version 0x8 or above*/
+ static __maybe_unused struct attribute *hv_gpci_event_attrs[] = {
+ #include REQUEST_FILE
+ NULL
+diff --git a/arch/powerpc/platforms/52xx/mpc52xx_lpbfifo.c b/arch/powerpc/platforms/52xx/mpc52xx_lpbfifo.c
+index 7bb42a0100de6..caaaaf2bea522 100644
+--- a/arch/powerpc/platforms/52xx/mpc52xx_lpbfifo.c
++++ b/arch/powerpc/platforms/52xx/mpc52xx_lpbfifo.c
+@@ -531,6 +531,7 @@ static int mpc52xx_lpbfifo_probe(struct platform_device *op)
+ err_bcom_rx_irq:
+ bcom_gen_bd_rx_release(lpbfifo.bcom_rx_task);
+ err_bcom_rx:
++ free_irq(lpbfifo.irq, &lpbfifo);
+ err_irq:
+ iounmap(lpbfifo.regs);
+ lpbfifo.regs = NULL;
+diff --git a/arch/powerpc/platforms/83xx/mpc832x_rdb.c b/arch/powerpc/platforms/83xx/mpc832x_rdb.c
+index 4389865938737..bfebfc67b23f5 100644
+--- a/arch/powerpc/platforms/83xx/mpc832x_rdb.c
++++ b/arch/powerpc/platforms/83xx/mpc832x_rdb.c
+@@ -111,7 +111,7 @@ static int __init of_fsl_spi_probe(char *type, char *compatible, u32 sysclk,
+
+ goto next;
+ unreg:
+- platform_device_del(pdev);
++ platform_device_put(pdev);
+ err:
+ pr_err("%pOF: registration failed\n", np);
+ next:
+diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
+index aa705732150cc..ac1eb674f9d67 100644
+--- a/arch/powerpc/sysdev/xive/spapr.c
++++ b/arch/powerpc/sysdev/xive/spapr.c
+@@ -389,6 +389,7 @@ static int xive_spapr_populate_irq_data(u32 hw_irq, struct xive_irq_data *data)
+
+ data->trig_mmio = ioremap(data->trig_page, 1u << data->esb_shift);
+ if (!data->trig_mmio) {
++ iounmap(data->eoi_mmio);
+ pr_err("Failed to map trigger page for irq 0x%x\n", hw_irq);
+ return -ENOMEM;
+ }
+diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
+index f0ea3156192d0..30dd2bf865f4e 100644
+--- a/arch/riscv/include/asm/uaccess.h
++++ b/arch/riscv/include/asm/uaccess.h
+@@ -260,7 +260,7 @@ do { \
+ might_fault(); \
+ access_ok(VERIFY_READ, __p, sizeof(*__p)) ? \
+ __get_user((x), __p) : \
+- ((x) = 0, -EFAULT); \
++ ((x) = (__force __typeof__(x))0, -EFAULT); \
+ })
+
+ #define __put_user_asm(insn, x, ptr, err) \
+diff --git a/arch/s390/include/asm/percpu.h b/arch/s390/include/asm/percpu.h
+index 50f6661ba5664..026a94b03a3c5 100644
+--- a/arch/s390/include/asm/percpu.h
++++ b/arch/s390/include/asm/percpu.h
+@@ -31,7 +31,7 @@
+ pcp_op_T__ *ptr__; \
+ preempt_disable_notrace(); \
+ ptr__ = raw_cpu_ptr(&(pcp)); \
+- prev__ = *ptr__; \
++ prev__ = READ_ONCE(*ptr__); \
+ do { \
+ old__ = prev__; \
+ new__ = old__ op (val); \
+diff --git a/arch/x86/boot/bioscall.S b/arch/x86/boot/bioscall.S
+index d401b4a262b09..a860390852ffc 100644
+--- a/arch/x86/boot/bioscall.S
++++ b/arch/x86/boot/bioscall.S
+@@ -35,7 +35,7 @@ intcall:
+ movw %dx, %si
+ movw %sp, %di
+ movw $11, %cx
+- rep; movsd
++ rep; movsl
+
+ /* Pop full state from the stack */
+ popal
+@@ -70,7 +70,7 @@ intcall:
+ jz 4f
+ movw %sp, %si
+ movw $11, %cx
+- rep; movsd
++ rep; movsl
+ 4: addw $44, %sp
+
+ /* Restore state and return */
+diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
+index 2bf1170f7afdb..34da6d27d839a 100644
+--- a/arch/x86/events/intel/uncore_snbep.c
++++ b/arch/x86/events/intel/uncore_snbep.c
+@@ -2699,6 +2699,7 @@ static bool hswep_has_limit_sbox(unsigned int device)
+ return false;
+
+ pci_read_config_dword(dev, HSWEP_PCU_CAPID4_OFFET, &capid4);
++ pci_dev_put(dev);
+ if (!hswep_get_chop(capid4))
+ return true;
+
+diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
+index 3ebd77770f98b..4cfda3cfae7ff 100644
+--- a/arch/x86/ia32/ia32_aout.c
++++ b/arch/x86/ia32/ia32_aout.c
+@@ -298,6 +298,7 @@ static int load_aout_binary(struct linux_binprm *bprm)
+ set_personality_ia32(false);
+
+ setup_new_exec(bprm);
++ install_exec_creds(bprm);
+
+ regs->cs = __USER32_CS;
+ regs->r8 = regs->r9 = regs->r10 = regs->r11 = regs->r12 =
+@@ -314,8 +315,6 @@ static int load_aout_binary(struct linux_binprm *bprm)
+ if (retval < 0)
+ return retval;
+
+- install_exec_creds(bprm);
+-
+ if (N_MAGIC(ex) == OMAGIC) {
+ unsigned long text_addr, map_size;
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index f1f57acca1396..e298ec9d5d536 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -1778,6 +1778,8 @@ static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
+ if (ctrl == PR_SPEC_FORCE_DISABLE)
+ task_set_spec_ib_force_disable(task);
+ task_update_spec_tif(task);
++ if (task == current)
++ indirect_branch_prediction_barrier();
+ break;
+ default:
+ return -ERANGE;
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index f406e3b85bdb2..1125f752f1269 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -585,8 +585,10 @@ static int __rdtgroup_move_task(struct task_struct *tsk,
+ /*
+ * Ensure the task's closid and rmid are written before determining if
+ * the task is current that will decide if it will be interrupted.
++ * This pairs with the full barrier between the rq->curr update and
++ * resctrl_sched_in() during context switch.
+ */
+- barrier();
++ smp_mb();
+
+ /*
+ * By now, the task's closid and rmid are set. If the task is current
+@@ -2140,19 +2142,23 @@ static void rdt_move_group_tasks(struct rdtgroup *from, struct rdtgroup *to,
+ t->closid = to->closid;
+ t->rmid = to->mon.rmid;
+
+-#ifdef CONFIG_SMP
+ /*
+- * This is safe on x86 w/o barriers as the ordering
+- * of writing to task_cpu() and t->on_cpu is
+- * reverse to the reading here. The detection is
+- * inaccurate as tasks might move or schedule
+- * before the smp function call takes place. In
+- * such a case the function call is pointless, but
++ * Order the closid/rmid stores above before the loads
++ * in task_curr(). This pairs with the full barrier
++ * between the rq->curr update and resctrl_sched_in()
++ * during context switch.
++ */
++ smp_mb();
++
++ /*
++ * If the task is on a CPU, set the CPU in the mask.
++ * The detection is inaccurate as tasks might move or
++ * schedule before the smp function call takes place.
++ * In such a case the function call is pointless, but
+ * there is no other side effect.
+ */
+- if (mask && t->on_cpu)
++ if (IS_ENABLED(CONFIG_SMP) && mask && task_curr(t))
+ cpumask_set_cpu(task_cpu(t), mask);
+-#endif
+ }
+ }
+ read_unlock(&tasklist_lock);
+diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
+index 3aa0e5a453030..31ad79a0c6f32 100644
+--- a/arch/x86/kernel/cpu/microcode/intel.c
++++ b/arch/x86/kernel/cpu/microcode/intel.c
+@@ -662,7 +662,6 @@ void load_ucode_intel_ap(void)
+ else
+ iup = &intel_ucode_patch;
+
+-reget:
+ if (!*iup) {
+ patch = __load_ucode_intel(&uci);
+ if (!patch)
+@@ -673,12 +672,7 @@ reget:
+
+ uci.mc = *iup;
+
+- if (apply_microcode_early(&uci, true)) {
+- /* Mixed-silicon system? Try to refetch the proper patch: */
+- *iup = NULL;
+-
+- goto reget;
+- }
++ apply_microcode_early(&uci, true);
+ }
+
+ static struct microcode_intel *find_patch(struct ucode_cpu_info *uci)
+diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
+index ae9e806a11def..3b87bca027b41 100644
+--- a/arch/x86/kernel/uprobes.c
++++ b/arch/x86/kernel/uprobes.c
+@@ -735,8 +735,9 @@ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
+ switch (opc1) {
+ case 0xeb: /* jmp 8 */
+ case 0xe9: /* jmp 32 */
+- case 0x90: /* prefix* + nop; same as jmp with .offs = 0 */
+ break;
++ case 0x90: /* prefix* + nop; same as jmp with .offs = 0 */
++ goto setup;
+
+ case 0xe8: /* call relative */
+ branch_clear_offset(auprobe, insn);
+@@ -765,6 +766,7 @@ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
+ return -ENOTSUPP;
+ }
+
++setup:
+ auprobe->branch.opc1 = opc1;
+ auprobe->branch.ilen = insn->length;
+ auprobe->branch.offs = insn->immediate.value;
+diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
+index 7a43b2ae19f12..a1cc855c539c1 100644
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -32,30 +32,30 @@ static irqreturn_t xen_reschedule_interrupt(int irq, void *dev_id)
+
+ void xen_smp_intr_free(unsigned int cpu)
+ {
++ kfree(per_cpu(xen_resched_irq, cpu).name);
++ per_cpu(xen_resched_irq, cpu).name = NULL;
+ if (per_cpu(xen_resched_irq, cpu).irq >= 0) {
+ unbind_from_irqhandler(per_cpu(xen_resched_irq, cpu).irq, NULL);
+ per_cpu(xen_resched_irq, cpu).irq = -1;
+- kfree(per_cpu(xen_resched_irq, cpu).name);
+- per_cpu(xen_resched_irq, cpu).name = NULL;
+ }
++ kfree(per_cpu(xen_callfunc_irq, cpu).name);
++ per_cpu(xen_callfunc_irq, cpu).name = NULL;
+ if (per_cpu(xen_callfunc_irq, cpu).irq >= 0) {
+ unbind_from_irqhandler(per_cpu(xen_callfunc_irq, cpu).irq, NULL);
+ per_cpu(xen_callfunc_irq, cpu).irq = -1;
+- kfree(per_cpu(xen_callfunc_irq, cpu).name);
+- per_cpu(xen_callfunc_irq, cpu).name = NULL;
+ }
++ kfree(per_cpu(xen_debug_irq, cpu).name);
++ per_cpu(xen_debug_irq, cpu).name = NULL;
+ if (per_cpu(xen_debug_irq, cpu).irq >= 0) {
+ unbind_from_irqhandler(per_cpu(xen_debug_irq, cpu).irq, NULL);
+ per_cpu(xen_debug_irq, cpu).irq = -1;
+- kfree(per_cpu(xen_debug_irq, cpu).name);
+- per_cpu(xen_debug_irq, cpu).name = NULL;
+ }
++ kfree(per_cpu(xen_callfuncsingle_irq, cpu).name);
++ per_cpu(xen_callfuncsingle_irq, cpu).name = NULL;
+ if (per_cpu(xen_callfuncsingle_irq, cpu).irq >= 0) {
+ unbind_from_irqhandler(per_cpu(xen_callfuncsingle_irq, cpu).irq,
+ NULL);
+ per_cpu(xen_callfuncsingle_irq, cpu).irq = -1;
+- kfree(per_cpu(xen_callfuncsingle_irq, cpu).name);
+- per_cpu(xen_callfuncsingle_irq, cpu).name = NULL;
+ }
+ }
+
+@@ -65,6 +65,7 @@ int xen_smp_intr_init(unsigned int cpu)
+ char *resched_name, *callfunc_name, *debug_name;
+
+ resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu);
++ per_cpu(xen_resched_irq, cpu).name = resched_name;
+ rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR,
+ cpu,
+ xen_reschedule_interrupt,
+@@ -74,9 +75,9 @@ int xen_smp_intr_init(unsigned int cpu)
+ if (rc < 0)
+ goto fail;
+ per_cpu(xen_resched_irq, cpu).irq = rc;
+- per_cpu(xen_resched_irq, cpu).name = resched_name;
+
+ callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu);
++ per_cpu(xen_callfunc_irq, cpu).name = callfunc_name;
+ rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR,
+ cpu,
+ xen_call_function_interrupt,
+@@ -86,18 +87,21 @@ int xen_smp_intr_init(unsigned int cpu)
+ if (rc < 0)
+ goto fail;
+ per_cpu(xen_callfunc_irq, cpu).irq = rc;
+- per_cpu(xen_callfunc_irq, cpu).name = callfunc_name;
+
+- debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu);
+- rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu, xen_debug_interrupt,
+- IRQF_PERCPU | IRQF_NOBALANCING,
+- debug_name, NULL);
+- if (rc < 0)
+- goto fail;
+- per_cpu(xen_debug_irq, cpu).irq = rc;
+- per_cpu(xen_debug_irq, cpu).name = debug_name;
++ if (!xen_fifo_events) {
++ debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu);
++ per_cpu(xen_debug_irq, cpu).name = debug_name;
++ rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu,
++ xen_debug_interrupt,
++ IRQF_PERCPU | IRQF_NOBALANCING,
++ debug_name, NULL);
++ if (rc < 0)
++ goto fail;
++ per_cpu(xen_debug_irq, cpu).irq = rc;
++ }
+
+ callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu);
++ per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name;
+ rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR,
+ cpu,
+ xen_call_function_single_interrupt,
+@@ -107,7 +111,6 @@ int xen_smp_intr_init(unsigned int cpu)
+ if (rc < 0)
+ goto fail;
+ per_cpu(xen_callfuncsingle_irq, cpu).irq = rc;
+- per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name;
+
+ return 0;
+
+diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
+index e8248e8a04ca7..75807c2a1e175 100644
+--- a/arch/x86/xen/smp_pv.c
++++ b/arch/x86/xen/smp_pv.c
+@@ -94,18 +94,18 @@ asmlinkage __visible void cpu_bringup_and_idle(void)
+
+ void xen_smp_intr_free_pv(unsigned int cpu)
+ {
++ kfree(per_cpu(xen_irq_work, cpu).name);
++ per_cpu(xen_irq_work, cpu).name = NULL;
+ if (per_cpu(xen_irq_work, cpu).irq >= 0) {
+ unbind_from_irqhandler(per_cpu(xen_irq_work, cpu).irq, NULL);
+ per_cpu(xen_irq_work, cpu).irq = -1;
+- kfree(per_cpu(xen_irq_work, cpu).name);
+- per_cpu(xen_irq_work, cpu).name = NULL;
+ }
+
++ kfree(per_cpu(xen_pmu_irq, cpu).name);
++ per_cpu(xen_pmu_irq, cpu).name = NULL;
+ if (per_cpu(xen_pmu_irq, cpu).irq >= 0) {
+ unbind_from_irqhandler(per_cpu(xen_pmu_irq, cpu).irq, NULL);
+ per_cpu(xen_pmu_irq, cpu).irq = -1;
+- kfree(per_cpu(xen_pmu_irq, cpu).name);
+- per_cpu(xen_pmu_irq, cpu).name = NULL;
+ }
+ }
+
+@@ -115,6 +115,7 @@ int xen_smp_intr_init_pv(unsigned int cpu)
+ char *callfunc_name, *pmu_name;
+
+ callfunc_name = kasprintf(GFP_KERNEL, "irqwork%d", cpu);
++ per_cpu(xen_irq_work, cpu).name = callfunc_name;
+ rc = bind_ipi_to_irqhandler(XEN_IRQ_WORK_VECTOR,
+ cpu,
+ xen_irq_work_interrupt,
+@@ -124,10 +125,10 @@ int xen_smp_intr_init_pv(unsigned int cpu)
+ if (rc < 0)
+ goto fail;
+ per_cpu(xen_irq_work, cpu).irq = rc;
+- per_cpu(xen_irq_work, cpu).name = callfunc_name;
+
+ if (is_xen_pmu) {
+ pmu_name = kasprintf(GFP_KERNEL, "pmu%d", cpu);
++ per_cpu(xen_pmu_irq, cpu).name = pmu_name;
+ rc = bind_virq_to_irqhandler(VIRQ_XENPMU, cpu,
+ xen_pmu_irq_handler,
+ IRQF_PERCPU|IRQF_NOBALANCING,
+@@ -135,7 +136,6 @@ int xen_smp_intr_init_pv(unsigned int cpu)
+ if (rc < 0)
+ goto fail;
+ per_cpu(xen_pmu_irq, cpu).irq = rc;
+- per_cpu(xen_pmu_irq, cpu).name = pmu_name;
+ }
+
+ return 0;
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index 6fffb86a32add..e6cf1b430fd03 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -83,6 +83,7 @@ void xen_init_lock_cpu(int cpu)
+ cpu, per_cpu(lock_kicker_irq, cpu));
+
+ name = kasprintf(GFP_KERNEL, "spinlock%d", cpu);
++ per_cpu(irq_name, cpu) = name;
+ irq = bind_ipi_to_irqhandler(XEN_SPIN_UNLOCK_VECTOR,
+ cpu,
+ dummy_handler,
+@@ -93,7 +94,6 @@ void xen_init_lock_cpu(int cpu)
+ if (irq >= 0) {
+ disable_irq(irq); /* make sure it's never delivered */
+ per_cpu(lock_kicker_irq, cpu) = irq;
+- per_cpu(irq_name, cpu) = name;
+ }
+
+ printk("cpu %d spinlock event irq %d\n", cpu, irq);
+@@ -106,6 +106,8 @@ void xen_uninit_lock_cpu(int cpu)
+ if (!xen_pvspin)
+ return;
+
++ kfree(per_cpu(irq_name, cpu));
++ per_cpu(irq_name, cpu) = NULL;
+ /*
+ * When booting the kernel with 'mitigations=auto,nosmt', the secondary
+ * CPUs are not activated, and lock_kicker_irq is not initialized.
+@@ -116,8 +118,6 @@ void xen_uninit_lock_cpu(int cpu)
+
+ unbind_from_irqhandler(irq, NULL);
+ per_cpu(lock_kicker_irq, cpu) = -1;
+- kfree(per_cpu(irq_name, cpu));
+- per_cpu(irq_name, cpu) = NULL;
+ }
+
+ PV_CALLEE_SAVE_REGS_THUNK(xen_vcpu_stolen);
+diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
+index 2f111f47ba98c..9faec8543237a 100644
+--- a/arch/x86/xen/xen-ops.h
++++ b/arch/x86/xen/xen-ops.h
+@@ -30,6 +30,8 @@ extern struct start_info *xen_start_info;
+ extern struct shared_info xen_dummy_shared_info;
+ extern struct shared_info *HYPERVISOR_shared_info;
+
++extern bool xen_fifo_events;
++
+ void xen_setup_mfn_list_list(void);
+ void xen_build_mfn_list_list(void);
+ void xen_setup_machphys_mapping(void);
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 5e4b7ed1e897a..ae03e63ffbfdd 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -241,7 +241,7 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
+ {
+ struct request_queue *q = hctx->queue;
+ struct blk_mq_ctx *ctx;
+- int i, ret;
++ int i, j, ret;
+
+ if (!hctx->nr_ctx)
+ return 0;
+@@ -253,9 +253,16 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
+ hctx_for_each_ctx(hctx, ctx, i) {
+ ret = kobject_add(&ctx->kobj, &hctx->kobj, "cpu%u", ctx->cpu);
+ if (ret)
+- break;
++ goto out;
+ }
+
++ return 0;
++out:
++ hctx_for_each_ctx(hctx, ctx, j) {
++ if (j < i)
++ kobject_del(&ctx->kobj);
++ }
++ kobject_del(&hctx->kobj);
+ return ret;
+ }
+
+diff --git a/block/partition-generic.c b/block/partition-generic.c
+index 98d60a59b843c..871f528dcb131 100644
+--- a/block/partition-generic.c
++++ b/block/partition-generic.c
+@@ -276,6 +276,7 @@ void delete_partition(struct gendisk *disk, int partno)
+ struct disk_part_tbl *ptbl =
+ rcu_dereference_protected(disk->part_tbl, 1);
+ struct hd_struct *part;
++ struct block_device *bdev;
+
+ if (partno >= ptbl->len)
+ return;
+@@ -296,6 +297,12 @@ void delete_partition(struct gendisk *disk, int partno)
+ * "in-use" until we really free the gendisk.
+ */
+ blk_invalidate_devt(part_devt(part));
++
++ bdev = bdget(part_devt(part));
++ if (bdev) {
++ remove_inode_hash(bdev->bd_inode);
++ bdput(bdev);
++ }
+ hd_struct_kill(part);
+ }
+
+diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
+index bf797c613ba2d..366f4510acbe4 100644
+--- a/crypto/tcrypt.c
++++ b/crypto/tcrypt.c
+@@ -1285,15 +1285,6 @@ static void test_mb_skcipher_speed(const char *algo, int enc, int secs,
+ goto out_free_tfm;
+ }
+
+-
+- for (i = 0; i < num_mb; ++i)
+- if (testmgr_alloc_buf(data[i].xbuf)) {
+- while (i--)
+- testmgr_free_buf(data[i].xbuf);
+- goto out_free_tfm;
+- }
+-
+-
+ for (i = 0; i < num_mb; ++i) {
+ data[i].req = skcipher_request_alloc(tfm, GFP_KERNEL);
+ if (!data[i].req) {
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index dd4deb678d13e..a00516d9538c2 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -517,7 +517,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ info = ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_evaluate_info));
+ if (!info) {
+ status = AE_NO_MEMORY;
+- goto cleanup;
++ goto pop_walk_state;
+ }
+
+ info->parameters = &this_walk_state->operands[0];
+@@ -529,7 +529,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+
+ ACPI_FREE(info);
+ if (ACPI_FAILURE(status)) {
+- goto cleanup;
++ goto pop_walk_state;
+ }
+
+ /*
+@@ -561,6 +561,12 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+
+ return_ACPI_STATUS(status);
+
++pop_walk_state:
++
++ /* On error, pop the walk state to be deleted from thread */
++
++ acpi_ds_pop_walk_state(thread);
++
+ cleanup:
+
+ /* On error, we must terminate the method properly */
+diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c
+index a872ed7879ca7..056c1741c1e39 100644
+--- a/drivers/acpi/acpica/utcopy.c
++++ b/drivers/acpi/acpica/utcopy.c
+@@ -916,13 +916,6 @@ acpi_ut_copy_ipackage_to_ipackage(union acpi_operand_object *source_obj,
+ status = acpi_ut_walk_package_tree(source_obj, dest_obj,
+ acpi_ut_copy_ielement_to_ielement,
+ walk_state);
+- if (ACPI_FAILURE(status)) {
+-
+- /* On failure, delete the destination package object */
+-
+- acpi_ut_remove_reference(dest_obj);
+- }
+-
+ return_ACPI_STATUS(status);
+ }
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 505920d4530f8..13fb983b3413e 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -97,6 +97,7 @@ enum board_ids {
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static void ahci_remove_one(struct pci_dev *dev);
+ static void ahci_shutdown_one(struct pci_dev *dev);
++static void ahci_intel_pcs_quirk(struct pci_dev *pdev, struct ahci_host_priv *hpriv);
+ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
+ unsigned long deadline);
+ static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
+@@ -655,6 +656,25 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
+ ahci_save_initial_config(&pdev->dev, hpriv);
+ }
+
++static int ahci_pci_reset_controller(struct ata_host *host)
++{
++ struct pci_dev *pdev = to_pci_dev(host->dev);
++ struct ahci_host_priv *hpriv = host->private_data;
++ int rc;
++
++ rc = ahci_reset_controller(host);
++ if (rc)
++ return rc;
++
++ /*
++ * If platform firmware failed to enable ports, try to enable
++ * them here.
++ */
++ ahci_intel_pcs_quirk(pdev, hpriv);
++
++ return 0;
++}
++
+ static void ahci_pci_init_controller(struct ata_host *host)
+ {
+ struct ahci_host_priv *hpriv = host->private_data;
+@@ -857,7 +877,7 @@ static int ahci_pci_device_runtime_resume(struct device *dev)
+ struct ata_host *host = pci_get_drvdata(pdev);
+ int rc;
+
+- rc = ahci_reset_controller(host);
++ rc = ahci_pci_reset_controller(host);
+ if (rc)
+ return rc;
+ ahci_pci_init_controller(host);
+@@ -892,7 +912,7 @@ static int ahci_pci_device_resume(struct device *dev)
+ ahci_mcp89_apple_enable(pdev);
+
+ if (pdev->dev.power.power_state.event == PM_EVENT_SUSPEND) {
+- rc = ahci_reset_controller(host);
++ rc = ahci_pci_reset_controller(host);
+ if (rc)
+ return rc;
+
+@@ -1769,12 +1789,6 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /* save initial config */
+ ahci_pci_save_initial_config(pdev, hpriv);
+
+- /*
+- * If platform firmware failed to enable ports, try to enable
+- * them here.
+- */
+- ahci_intel_pcs_quirk(pdev, hpriv);
+-
+ /* prepare host */
+ if (hpriv->cap & HOST_CAP_NCQ) {
+ pi.flags |= ATA_FLAG_NCQ;
+@@ -1884,7 +1898,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (rc)
+ return rc;
+
+- rc = ahci_reset_controller(host);
++ rc = ahci_pci_reset_controller(host);
+ if (rc)
+ return rc;
+
+diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
+index 867621f8c3873..8c34c64e4d518 100644
+--- a/drivers/ata/pata_ixp4xx_cf.c
++++ b/drivers/ata/pata_ixp4xx_cf.c
+@@ -139,12 +139,12 @@ static void ixp4xx_setup_port(struct ata_port *ap,
+
+ static int ixp4xx_pata_probe(struct platform_device *pdev)
+ {
+- unsigned int irq;
+ struct resource *cs0, *cs1;
+ struct ata_host *host;
+ struct ata_port *ap;
+ struct ixp4xx_pata_data *data = dev_get_platdata(&pdev->dev);
+ int ret;
++ int irq;
+
+ cs0 = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ cs1 = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+diff --git a/drivers/base/class.c b/drivers/base/class.c
+index 54def4e02f005..d36cdbeaa2c83 100644
+--- a/drivers/base/class.c
++++ b/drivers/base/class.c
+@@ -185,6 +185,11 @@ int __class_register(struct class *cls, struct lock_class_key *key)
+ }
+ error = class_add_groups(class_get(cls), cls->class_groups);
+ class_put(cls);
++ if (error) {
++ kobject_del(&cp->subsys.kobj);
++ kfree_const(cp->subsys.kobj.name);
++ kfree(cp);
++ }
+ return error;
+ }
+ EXPORT_SYMBOL_GPL(__class_register);
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 63390a416b445..6a2aa85624715 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -220,7 +220,16 @@ static int deferred_devs_show(struct seq_file *s, void *data)
+ }
+ DEFINE_SHOW_ATTRIBUTE(deferred_devs);
+
++#ifdef CONFIG_MODULES
++/*
++ * In the case of modules, set the default probe timeout to
++ * 30 seconds to give userland some time to load needed modules
++ */
++static int deferred_probe_timeout = 30;
++#else
++/* In the case of !modules, no probe timeout needed */
+ static int deferred_probe_timeout = -1;
++#endif
+ static int __init deferred_probe_timeout_setup(char *str)
+ {
+ deferred_probe_timeout = simple_strtol(str, NULL, 10);
+@@ -902,8 +911,12 @@ static int __driver_attach(struct device *dev, void *data)
+ */
+ return 0;
+ } else if (ret < 0) {
+- dev_dbg(dev, "Bus failed to match device: %d", ret);
+- return ret;
++ dev_dbg(dev, "Bus failed to match device: %d\n", ret);
++ /*
++ * Driver could not match with device, but may match with
++ * another device on the bus.
++ */
++ return 0;
+ } /* ret > 0 means positive match */
+
+ if (dev->parent && dev->bus->need_parent_lock)
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index eaae4adf9ce4b..911bb8a4bf6df 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -403,7 +403,10 @@ static int rpm_idle(struct device *dev, int rpmflags)
+ /* Pending requests need to be canceled. */
+ dev->power.request = RPM_REQ_NONE;
+
+- if (dev->power.no_callbacks)
++ callback = RPM_GET_CALLBACK(dev, runtime_idle);
++
++ /* If no callback assume success. */
++ if (!callback || dev->power.no_callbacks)
+ goto out;
+
+ /* Carry out an asynchronous or a synchronous idle notification. */
+@@ -419,10 +422,17 @@ static int rpm_idle(struct device *dev, int rpmflags)
+
+ dev->power.idle_notification = true;
+
+- callback = RPM_GET_CALLBACK(dev, runtime_idle);
++ if (dev->power.irq_safe)
++ spin_unlock(&dev->power.lock);
++ else
++ spin_unlock_irq(&dev->power.lock);
++
++ retval = callback(dev);
+
+- if (callback)
+- retval = __rpm_callback(callback, dev);
++ if (dev->power.irq_safe)
++ spin_lock(&dev->power.lock);
++ else
++ spin_lock_irq(&dev->power.lock);
+
+ dev->power.idle_notification = false;
+ wake_up_all(&dev->power.wait_queue);
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index 3ae718aa6b39f..1ff5af6c4f3fd 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -2258,7 +2258,6 @@ void drbd_destroy_device(struct kref *kref)
+ kref_put(&peer_device->connection->kref, drbd_destroy_connection);
+ kfree(peer_device);
+ }
+- memset(device, 0xfd, sizeof(*device));
+ kfree(device);
+ kref_put(&resource->kref, drbd_destroy_resource);
+ }
+@@ -2351,7 +2350,6 @@ void drbd_destroy_resource(struct kref *kref)
+ idr_destroy(&resource->devices);
+ free_cpumask_var(resource->cpu_mask);
+ kfree(resource->name);
+- memset(resource, 0xf2, sizeof(*resource));
+ kfree(resource);
+ }
+
+@@ -2748,7 +2746,6 @@ void drbd_destroy_connection(struct kref *kref)
+ drbd_free_socket(&connection->data);
+ kfree(connection->int_dig_in);
+ kfree(connection->int_dig_vv);
+- memset(connection, 0xfc, sizeof(*connection));
+ kfree(connection);
+ kref_put(&resource->kref, drbd_destroy_resource);
+ }
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 7188f0fb2e050..b6eb48e44e6b1 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -501,13 +501,13 @@ static inline void btusb_free_frags(struct btusb_data *data)
+
+ spin_lock_irqsave(&data->rxlock, flags);
+
+- kfree_skb(data->evt_skb);
++ dev_kfree_skb_irq(data->evt_skb);
+ data->evt_skb = NULL;
+
+- kfree_skb(data->acl_skb);
++ dev_kfree_skb_irq(data->acl_skb);
+ data->acl_skb = NULL;
+
+- kfree_skb(data->sco_skb);
++ dev_kfree_skb_irq(data->sco_skb);
+ data->sco_skb = NULL;
+
+ spin_unlock_irqrestore(&data->rxlock, flags);
+diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
+index 27829273f3c91..f6fa0a40dc373 100644
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -393,7 +393,7 @@ static void bcsp_pkt_cull(struct bcsp_struct *bcsp)
+ i++;
+
+ __skb_unlink(skb, &bcsp->unack);
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ }
+
+ if (skb_queue_empty(&bcsp->unack))
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index 79b96251de806..29c80e2acb05d 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -311,7 +311,7 @@ static void h5_pkt_cull(struct h5 *h5)
+ break;
+
+ __skb_unlink(skb, &h5->unack);
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ }
+
+ if (skb_queue_empty(&h5->unack))
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index f96e58de049b3..f8b6823db04ac 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -810,7 +810,7 @@ static int qca_enqueue(struct hci_uart *hu, struct sk_buff *skb)
+ default:
+ BT_ERR("Illegal tx state: %d (losing packet)",
+ qca->tx_ibs_state);
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ break;
+ }
+
+diff --git a/drivers/char/hw_random/amd-rng.c b/drivers/char/hw_random/amd-rng.c
+index 9959c762da2f8..db3dd467194c2 100644
+--- a/drivers/char/hw_random/amd-rng.c
++++ b/drivers/char/hw_random/amd-rng.c
+@@ -143,15 +143,19 @@ static int __init mod_init(void)
+ found:
+ err = pci_read_config_dword(pdev, 0x58, &pmbase);
+ if (err)
+- return err;
++ goto put_dev;
+
+ pmbase &= 0x0000FF00;
+- if (pmbase == 0)
+- return -EIO;
++ if (pmbase == 0) {
++ err = -EIO;
++ goto put_dev;
++ }
+
+ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+- if (!priv)
+- return -ENOMEM;
++ if (!priv) {
++ err = -ENOMEM;
++ goto put_dev;
++ }
+
+ if (!request_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE, DRV_NAME)) {
+ dev_err(&pdev->dev, DRV_NAME " region 0x%x already in use!\n",
+@@ -185,6 +189,8 @@ err_iomap:
+ release_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE);
+ out:
+ kfree(priv);
++put_dev:
++ pci_dev_put(pdev);
+ return err;
+ }
+
+@@ -200,6 +206,8 @@ static void __exit mod_exit(void)
+
+ release_region(priv->pmbase + PMBASE_OFFSET, PMBASE_SIZE);
+
++ pci_dev_put(priv->pcidev);
++
+ kfree(priv);
+ }
+
+diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c
+index e1d421a36a138..207272979f233 100644
+--- a/drivers/char/hw_random/geode-rng.c
++++ b/drivers/char/hw_random/geode-rng.c
+@@ -51,6 +51,10 @@ static const struct pci_device_id pci_tbl[] = {
+ };
+ MODULE_DEVICE_TABLE(pci, pci_tbl);
+
++struct amd_geode_priv {
++ struct pci_dev *pcidev;
++ void __iomem *membase;
++};
+
+ static int geode_rng_data_read(struct hwrng *rng, u32 *data)
+ {
+@@ -90,6 +94,7 @@ static int __init mod_init(void)
+ const struct pci_device_id *ent;
+ void __iomem *mem;
+ unsigned long rng_base;
++ struct amd_geode_priv *priv;
+
+ for_each_pci_dev(pdev) {
+ ent = pci_match_id(pci_tbl, pdev);
+@@ -97,17 +102,26 @@ static int __init mod_init(void)
+ goto found;
+ }
+ /* Device not found. */
+- goto out;
++ return err;
+
+ found:
++ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++ if (!priv) {
++ err = -ENOMEM;
++ goto put_dev;
++ }
++
+ rng_base = pci_resource_start(pdev, 0);
+ if (rng_base == 0)
+- goto out;
++ goto free_priv;
+ err = -ENOMEM;
+ mem = ioremap(rng_base, 0x58);
+ if (!mem)
+- goto out;
+- geode_rng.priv = (unsigned long)mem;
++ goto free_priv;
++
++ geode_rng.priv = (unsigned long)priv;
++ priv->membase = mem;
++ priv->pcidev = pdev;
+
+ pr_info("AMD Geode RNG detected\n");
+ err = hwrng_register(&geode_rng);
+@@ -116,20 +130,26 @@ found:
+ err);
+ goto err_unmap;
+ }
+-out:
+ return err;
+
+ err_unmap:
+ iounmap(mem);
+- goto out;
++free_priv:
++ kfree(priv);
++put_dev:
++ pci_dev_put(pdev);
++ return err;
+ }
+
+ static void __exit mod_exit(void)
+ {
+- void __iomem *mem = (void __iomem *)geode_rng.priv;
++ struct amd_geode_priv *priv;
+
++ priv = (struct amd_geode_priv *)geode_rng.priv;
+ hwrng_unregister(&geode_rng);
+- iounmap(mem);
++ iounmap(priv->membase);
++ pci_dev_put(priv->pcidev);
++ kfree(priv);
+ }
+
+ module_init(mod_init);
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 4cf3ef4ddec35..4265e8d3e71c5 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -1219,6 +1219,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
+ unsigned long flags;
+ struct cmd_rcvr *rcvr;
+ struct cmd_rcvr *rcvrs = NULL;
++ struct module *owner;
+
+ if (!acquire_ipmi_user(user, &i)) {
+ /*
+@@ -1278,8 +1279,9 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
+ kfree(rcvr);
+ }
+
++ owner = intf->owner;
+ kref_put(&intf->refcount, intf_free);
+- module_put(intf->owner);
++ module_put(owner);
+ }
+
+ int ipmi_destroy_user(struct ipmi_user *user)
+@@ -3461,12 +3463,16 @@ static void deliver_smi_err_response(struct ipmi_smi *intf,
+ struct ipmi_smi_msg *msg,
+ unsigned char err)
+ {
++ int rv;
+ msg->rsp[0] = msg->data[0] | 4;
+ msg->rsp[1] = msg->data[1];
+ msg->rsp[2] = err;
+ msg->rsp_size = 3;
+- /* It's an error, so it will never requeue, no need to check return. */
+- handle_one_recv_msg(intf, msg);
++
++ /* This will never requeue, but it may ask us to free the message. */
++ rv = handle_one_recv_msg(intf, msg);
++ if (rv == 0)
++ ipmi_free_smi_msg(msg);
+ }
+
+ static void cleanup_smi_msgs(struct ipmi_smi *intf)
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index 006d765256782..a5e1dce042e8e 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -2187,6 +2187,20 @@ skip_fallback_noirq:
+ }
+ module_init(init_ipmi_si);
+
++static void wait_msg_processed(struct smi_info *smi_info)
++{
++ unsigned long jiffies_now;
++ long time_diff;
++
++ while (smi_info->curr_msg || (smi_info->si_state != SI_NORMAL)) {
++ jiffies_now = jiffies;
++ time_diff = (((long)jiffies_now - (long)smi_info->last_timeout_jiffies)
++ * SI_USEC_PER_JIFFY);
++ smi_event_handler(smi_info, time_diff);
++ schedule_timeout_uninterruptible(1);
++ }
++}
++
+ static void shutdown_smi(void *send_info)
+ {
+ struct smi_info *smi_info = send_info;
+@@ -2221,16 +2235,13 @@ static void shutdown_smi(void *send_info)
+ * in the BMC. Note that timers and CPU interrupts are off,
+ * so no need for locks.
+ */
+- while (smi_info->curr_msg || (smi_info->si_state != SI_NORMAL)) {
+- poll(smi_info);
+- schedule_timeout_uninterruptible(1);
+- }
++ wait_msg_processed(smi_info);
++
+ if (smi_info->handlers)
+ disable_si_irq(smi_info);
+- while (smi_info->curr_msg || (smi_info->si_state != SI_NORMAL)) {
+- poll(smi_info);
+- schedule_timeout_uninterruptible(1);
+- }
++
++ wait_msg_processed(smi_info);
++
+ if (smi_info->handlers)
+ smi_info->handlers->cleanup(smi_info->si_sm);
+
+diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
+index 20f27100708bd..59cd7009277bf 100644
+--- a/drivers/char/tpm/tpm_crb.c
++++ b/drivers/char/tpm/tpm_crb.c
+@@ -256,7 +256,7 @@ static int __crb_relinquish_locality(struct device *dev,
+ iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl);
+ if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value,
+ TPM2_TIMEOUT_C)) {
+- dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
++ dev_warn(dev, "TPM_LOC_STATE_x.Relinquish timed out\n");
+ return -ETIME;
+ }
+
+@@ -680,12 +680,16 @@ static int crb_acpi_add(struct acpi_device *device)
+
+ /* Should the FIFO driver handle this? */
+ sm = buf->start_method;
+- if (sm == ACPI_TPM2_MEMORY_MAPPED)
+- return -ENODEV;
++ if (sm == ACPI_TPM2_MEMORY_MAPPED) {
++ rc = -ENODEV;
++ goto out;
++ }
+
+ priv = devm_kzalloc(dev, sizeof(struct crb_priv), GFP_KERNEL);
+- if (!priv)
+- return -ENOMEM;
++ if (!priv) {
++ rc = -ENOMEM;
++ goto out;
++ }
+
+ if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) {
+ if (buf->header.length < (sizeof(*buf) + sizeof(*crb_smc))) {
+@@ -693,7 +697,8 @@ static int crb_acpi_add(struct acpi_device *device)
+ FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n",
+ buf->header.length,
+ ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC);
+- return -EINVAL;
++ rc = -EINVAL;
++ goto out;
+ }
+ crb_smc = ACPI_ADD_PTR(struct tpm2_crb_smc, buf, sizeof(*buf));
+ priv->smc_func_id = crb_smc->smc_func_id;
+@@ -704,17 +709,23 @@ static int crb_acpi_add(struct acpi_device *device)
+
+ rc = crb_map_io(device, priv, buf);
+ if (rc)
+- return rc;
++ goto out;
+
+ chip = tpmm_chip_alloc(dev, &tpm_crb);
+- if (IS_ERR(chip))
+- return PTR_ERR(chip);
++ if (IS_ERR(chip)) {
++ rc = PTR_ERR(chip);
++ goto out;
++ }
+
+ dev_set_drvdata(&chip->dev, priv);
+ chip->acpi_dev_handle = device->handle;
+ chip->flags = TPM_CHIP_FLAG_TPM2;
+
+- return tpm_chip_register(chip);
++ rc = tpm_chip_register(chip);
++
++out:
++ acpi_put_table((struct acpi_table_header *)buf);
++ return rc;
+ }
+
+ static int crb_acpi_remove(struct acpi_device *device)
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index 5a3a4f0953910..939dc25a78336 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -129,6 +129,7 @@ static int check_acpi_tpm2(struct device *dev)
+ const struct acpi_device_id *aid = acpi_match_device(tpm_acpi_tbl, dev);
+ struct acpi_table_tpm2 *tbl;
+ acpi_status st;
++ int ret = 0;
+
+ if (!aid || aid->driver_data != DEVICE_IS_TPM2)
+ return 0;
+@@ -136,8 +137,7 @@ static int check_acpi_tpm2(struct device *dev)
+ /* If the ACPI TPM2 signature is matched then a global ACPI_SIG_TPM2
+ * table is mandatory
+ */
+- st =
+- acpi_get_table(ACPI_SIG_TPM2, 1, (struct acpi_table_header **)&tbl);
++ st = acpi_get_table(ACPI_SIG_TPM2, 1, (struct acpi_table_header **)&tbl);
+ if (ACPI_FAILURE(st) || tbl->header.length < sizeof(*tbl)) {
+ dev_err(dev, FW_BUG "failed to get TPM2 ACPI table\n");
+ return -EINVAL;
+@@ -145,9 +145,10 @@ static int check_acpi_tpm2(struct device *dev)
+
+ /* The tpm2_crb driver handles this device */
+ if (tbl->start_method != ACPI_TPM2_MEMORY_MAPPED)
+- return -ENODEV;
++ ret = -ENODEV;
+
+- return 0;
++ acpi_put_table((struct acpi_table_header *)tbl);
++ return ret;
+ }
+ #else
+ static int check_acpi_tpm2(struct device *dev)
+diff --git a/drivers/clk/rockchip/clk-pll.c b/drivers/clk/rockchip/clk-pll.c
+index dd0433d4753e8..77aff5defac62 100644
+--- a/drivers/clk/rockchip/clk-pll.c
++++ b/drivers/clk/rockchip/clk-pll.c
+@@ -972,6 +972,7 @@ struct clk *rockchip_clk_register_pll(struct rockchip_clk_provider *ctx,
+ return mux_clk;
+
+ err_pll:
++ kfree(pll->rate_table);
+ clk_unregister(mux_clk);
+ mux_clk = pll_clk;
+ err_mux:
+diff --git a/drivers/clk/samsung/clk-pll.c b/drivers/clk/samsung/clk-pll.c
+index 1c4c7a3039f1b..8cbf0f2cf196b 100644
+--- a/drivers/clk/samsung/clk-pll.c
++++ b/drivers/clk/samsung/clk-pll.c
+@@ -1392,6 +1392,7 @@ static void __init _samsung_clk_register_pll(struct samsung_clk_provider *ctx,
+ if (ret) {
+ pr_err("%s: failed to register pll clock %s : %d\n",
+ __func__, pll_clk->name, ret);
++ kfree(pll->rate_table);
+ kfree(pll);
+ return;
+ }
+diff --git a/drivers/clk/socfpga/clk-gate.c b/drivers/clk/socfpga/clk-gate.c
+index 14918896811d6..139b009eda82b 100644
+--- a/drivers/clk/socfpga/clk-gate.c
++++ b/drivers/clk/socfpga/clk-gate.c
+@@ -183,12 +183,13 @@ static void __init __socfpga_gate_init(struct device_node *node,
+ u32 div_reg[3];
+ u32 clk_phase[2];
+ u32 fixed_div;
+- struct clk *clk;
++ struct clk_hw *hw_clk;
+ struct socfpga_gate_clk *socfpga_clk;
+ const char *clk_name = node->name;
+ const char *parent_name[SOCFPGA_MAX_PARENTS];
+ struct clk_init_data init;
+ int rc;
++ int err;
+
+ socfpga_clk = kzalloc(sizeof(*socfpga_clk), GFP_KERNEL);
+ if (WARN_ON(!socfpga_clk))
+@@ -237,12 +238,14 @@ static void __init __socfpga_gate_init(struct device_node *node,
+ init.parent_names = parent_name;
+ socfpga_clk->hw.hw.init = &init;
+
+- clk = clk_register(NULL, &socfpga_clk->hw.hw);
+- if (WARN_ON(IS_ERR(clk))) {
++ hw_clk = &socfpga_clk->hw.hw;
++
++ err = clk_hw_register(NULL, hw_clk);
++ if (err) {
+ kfree(socfpga_clk);
+ return;
+ }
+- rc = of_clk_add_provider(node, of_clk_src_simple_get, clk);
++ rc = of_clk_add_provider(node, of_clk_src_simple_get, hw_clk);
+ if (WARN_ON(rc))
+ return;
+ }
+diff --git a/drivers/clk/socfpga/clk-periph.c b/drivers/clk/socfpga/clk-periph.c
+index 52c883ea77067..912c3059cbe47 100644
+--- a/drivers/clk/socfpga/clk-periph.c
++++ b/drivers/clk/socfpga/clk-periph.c
+@@ -61,7 +61,7 @@ static __init void __socfpga_periph_init(struct device_node *node,
+ const struct clk_ops *ops)
+ {
+ u32 reg;
+- struct clk *clk;
++ struct clk_hw *hw_clk;
+ struct socfpga_periph_clk *periph_clk;
+ const char *clk_name = node->name;
+ const char *parent_name[SOCFPGA_MAX_PARENTS];
+@@ -104,13 +104,13 @@ static __init void __socfpga_periph_init(struct device_node *node,
+ init.parent_names = parent_name;
+
+ periph_clk->hw.hw.init = &init;
++ hw_clk = &periph_clk->hw.hw;
+
+- clk = clk_register(NULL, &periph_clk->hw.hw);
+- if (WARN_ON(IS_ERR(clk))) {
++ if (clk_hw_register(NULL, hw_clk)) {
+ kfree(periph_clk);
+ return;
+ }
+- rc = of_clk_add_provider(node, of_clk_src_simple_get, clk);
++ rc = of_clk_add_provider(node, of_clk_src_simple_get, hw_clk);
+ }
+
+ void __init socfpga_periph_init(struct device_node *node)
+diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
+index b4b44e9b59011..7bde8ca45d4b1 100644
+--- a/drivers/clk/socfpga/clk-pll.c
++++ b/drivers/clk/socfpga/clk-pll.c
+@@ -80,17 +80,18 @@ static struct clk_ops clk_pll_ops = {
+ .get_parent = clk_pll_get_parent,
+ };
+
+-static __init struct clk *__socfpga_pll_init(struct device_node *node,
++static __init struct clk_hw *__socfpga_pll_init(struct device_node *node,
+ const struct clk_ops *ops)
+ {
+ u32 reg;
+- struct clk *clk;
++ struct clk_hw *hw_clk;
+ struct socfpga_pll *pll_clk;
+ const char *clk_name = node->name;
+ const char *parent_name[SOCFPGA_MAX_PARENTS];
+ struct clk_init_data init;
+ struct device_node *clkmgr_np;
+ int rc;
++ int err;
+
+ of_property_read_u32(node, "reg", ®);
+
+@@ -118,13 +119,15 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
+ clk_pll_ops.enable = clk_gate_ops.enable;
+ clk_pll_ops.disable = clk_gate_ops.disable;
+
+- clk = clk_register(NULL, &pll_clk->hw.hw);
+- if (WARN_ON(IS_ERR(clk))) {
++ hw_clk = &pll_clk->hw.hw;
++
++ err = clk_hw_register(NULL, hw_clk);
++ if (err) {
+ kfree(pll_clk);
+- return NULL;
++ return ERR_PTR(err);
+ }
+- rc = of_clk_add_provider(node, of_clk_src_simple_get, clk);
+- return clk;
++ rc = of_clk_add_provider(node, of_clk_src_simple_get, hw_clk);
++ return hw_clk;
+ }
+
+ void __init socfpga_pll_init(struct device_node *node)
+diff --git a/drivers/clk/st/clkgen-fsyn.c b/drivers/clk/st/clkgen-fsyn.c
+index a79d81985c4e0..bbe113159bc64 100644
+--- a/drivers/clk/st/clkgen-fsyn.c
++++ b/drivers/clk/st/clkgen-fsyn.c
+@@ -948,9 +948,10 @@ static void __init st_of_quadfs_setup(struct device_node *np,
+
+ clk = st_clk_register_quadfs_pll(pll_name, clk_parent_name, data,
+ reg, lock);
+- if (IS_ERR(clk))
++ if (IS_ERR(clk)) {
++ kfree(lock);
+ goto err_exit;
+- else
++ } else
+ pr_debug("%s: parent %s rate %u\n",
+ __clk_get_name(clk),
+ __clk_get_name(clk_get_parent(clk)),
+diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
+index 7a6d4c4c0feba..0ca8819acc4d4 100644
+--- a/drivers/clocksource/sh_cmt.c
++++ b/drivers/clocksource/sh_cmt.c
+@@ -239,6 +239,8 @@ static const struct sh_cmt_info sh_cmt_info[] = {
+ #define CMCNT 1 /* channel register */
+ #define CMCOR 2 /* channel register */
+
++#define CMCLKE 0x1000 /* CLK Enable Register (R-Car Gen2) */
++
+ static inline u32 sh_cmt_read_cmstr(struct sh_cmt_channel *ch)
+ {
+ if (ch->iostart)
+@@ -856,6 +858,7 @@ static int sh_cmt_setup_channel(struct sh_cmt_channel *ch, unsigned int index,
+ unsigned int hwidx, bool clockevent,
+ bool clocksource, struct sh_cmt_device *cmt)
+ {
++ u32 value;
+ int ret;
+
+ /* Skip unused channels. */
+@@ -885,6 +888,11 @@ static int sh_cmt_setup_channel(struct sh_cmt_channel *ch, unsigned int index,
+ ch->iostart = cmt->mapbase + ch->hwidx * 0x100;
+ ch->ioctrl = ch->iostart + 0x10;
+ ch->timer_bit = 0;
++
++ /* Enable the clock supply to the channel */
++ value = ioread32(cmt->mapbase + CMCLKE);
++ value |= BIT(hwidx);
++ iowrite32(value, cmt->mapbase + CMCLKE);
+ break;
+ }
+
+@@ -991,12 +999,10 @@ static int sh_cmt_setup(struct sh_cmt_device *cmt, struct platform_device *pdev)
+ else
+ cmt->rate = clk_get_rate(cmt->clk) / 8;
+
+- clk_disable(cmt->clk);
+-
+ /* Map the memory resource(s). */
+ ret = sh_cmt_map_memory(cmt);
+ if (ret < 0)
+- goto err_clk_unprepare;
++ goto err_clk_disable;
+
+ /* Allocate and setup the channels. */
+ cmt->num_channels = hweight8(cmt->hw_channels);
+@@ -1024,6 +1030,8 @@ static int sh_cmt_setup(struct sh_cmt_device *cmt, struct platform_device *pdev)
+ mask &= ~(1 << hwidx);
+ }
+
++ clk_disable(cmt->clk);
++
+ platform_set_drvdata(pdev, cmt);
+
+ return 0;
+@@ -1031,6 +1039,8 @@ static int sh_cmt_setup(struct sh_cmt_device *cmt, struct platform_device *pdev)
+ err_unmap:
+ kfree(cmt->channels);
+ iounmap(cmt->mapbase);
++err_clk_disable:
++ clk_disable(cmt->clk);
+ err_clk_unprepare:
+ clk_unprepare(cmt->clk);
+ err_clk_put:
+diff --git a/drivers/cpufreq/amd_freq_sensitivity.c b/drivers/cpufreq/amd_freq_sensitivity.c
+index 4b4f128c3488f..cacd4c67d9bed 100644
+--- a/drivers/cpufreq/amd_freq_sensitivity.c
++++ b/drivers/cpufreq/amd_freq_sensitivity.c
+@@ -122,6 +122,8 @@ static int __init amd_freq_sensitivity_init(void)
+ if (!pcidev) {
+ if (!static_cpu_has(X86_FEATURE_PROC_FEEDBACK))
+ return -ENODEV;
++ } else {
++ pci_dev_put(pcidev);
+ }
+
+ if (rdmsrl_safe(MSR_AMD64_FREQ_SENSITIVITY_ACTUAL, &val))
+diff --git a/drivers/cpuidle/dt_idle_states.c b/drivers/cpuidle/dt_idle_states.c
+index 53342b7f10105..ea3c59d3fdadd 100644
+--- a/drivers/cpuidle/dt_idle_states.c
++++ b/drivers/cpuidle/dt_idle_states.c
+@@ -224,6 +224,6 @@ int dt_init_idle_driver(struct cpuidle_driver *drv,
+ * also be 0 on platforms with missing DT idle states or legacy DT
+ * configuration predating the DT idle states bindings.
+ */
+- return i;
++ return state_idx - start_idx;
+ }
+ EXPORT_SYMBOL_GPL(dt_init_idle_driver);
+diff --git a/drivers/crypto/ccree/cc_debugfs.c b/drivers/crypto/ccree/cc_debugfs.c
+index 5ca184e424835..3879f33fb59ea 100644
+--- a/drivers/crypto/ccree/cc_debugfs.c
++++ b/drivers/crypto/ccree/cc_debugfs.c
+@@ -46,7 +46,7 @@ int __init cc_debugfs_global_init(void)
+ return !cc_debugfs_dir;
+ }
+
+-void __exit cc_debugfs_global_fini(void)
++void cc_debugfs_global_fini(void)
+ {
+ debugfs_remove(cc_debugfs_dir);
+ }
+diff --git a/drivers/crypto/img-hash.c b/drivers/crypto/img-hash.c
+index b87000a0a01cb..f70923643a97e 100644
+--- a/drivers/crypto/img-hash.c
++++ b/drivers/crypto/img-hash.c
+@@ -359,12 +359,16 @@ static int img_hash_dma_init(struct img_hash_dev *hdev)
+ static void img_hash_dma_task(unsigned long d)
+ {
+ struct img_hash_dev *hdev = (struct img_hash_dev *)d;
+- struct img_hash_request_ctx *ctx = ahash_request_ctx(hdev->req);
++ struct img_hash_request_ctx *ctx;
+ u8 *addr;
+ size_t nbytes, bleft, wsend, len, tbc;
+ struct scatterlist tsg;
+
+- if (!hdev->req || !ctx->sg)
++ if (!hdev->req)
++ return;
++
++ ctx = ahash_request_ctx(hdev->req);
++ if (!ctx->sg)
+ return;
+
+ addr = sg_virt(ctx->sg);
+diff --git a/drivers/crypto/n2_core.c b/drivers/crypto/n2_core.c
+index 55f34cfc43ff6..11b37ce46e569 100644
+--- a/drivers/crypto/n2_core.c
++++ b/drivers/crypto/n2_core.c
+@@ -1286,6 +1286,7 @@ struct n2_hash_tmpl {
+ const u32 *hash_init;
+ u8 hw_op_hashsz;
+ u8 digest_size;
++ u8 statesize;
+ u8 block_size;
+ u8 auth_type;
+ u8 hmac_type;
+@@ -1317,6 +1318,7 @@ static const struct n2_hash_tmpl hash_tmpls[] = {
+ .hmac_type = AUTH_TYPE_HMAC_MD5,
+ .hw_op_hashsz = MD5_DIGEST_SIZE,
+ .digest_size = MD5_DIGEST_SIZE,
++ .statesize = sizeof(struct md5_state),
+ .block_size = MD5_HMAC_BLOCK_SIZE },
+ { .name = "sha1",
+ .hash_zero = sha1_zero_message_hash,
+@@ -1325,6 +1327,7 @@ static const struct n2_hash_tmpl hash_tmpls[] = {
+ .hmac_type = AUTH_TYPE_HMAC_SHA1,
+ .hw_op_hashsz = SHA1_DIGEST_SIZE,
+ .digest_size = SHA1_DIGEST_SIZE,
++ .statesize = sizeof(struct sha1_state),
+ .block_size = SHA1_BLOCK_SIZE },
+ { .name = "sha256",
+ .hash_zero = sha256_zero_message_hash,
+@@ -1333,6 +1336,7 @@ static const struct n2_hash_tmpl hash_tmpls[] = {
+ .hmac_type = AUTH_TYPE_HMAC_SHA256,
+ .hw_op_hashsz = SHA256_DIGEST_SIZE,
+ .digest_size = SHA256_DIGEST_SIZE,
++ .statesize = sizeof(struct sha256_state),
+ .block_size = SHA256_BLOCK_SIZE },
+ { .name = "sha224",
+ .hash_zero = sha224_zero_message_hash,
+@@ -1341,6 +1345,7 @@ static const struct n2_hash_tmpl hash_tmpls[] = {
+ .hmac_type = AUTH_TYPE_RESERVED,
+ .hw_op_hashsz = SHA256_DIGEST_SIZE,
+ .digest_size = SHA224_DIGEST_SIZE,
++ .statesize = sizeof(struct sha256_state),
+ .block_size = SHA224_BLOCK_SIZE },
+ };
+ #define NUM_HASH_TMPLS ARRAY_SIZE(hash_tmpls)
+@@ -1482,6 +1487,7 @@ static int __n2_register_one_ahash(const struct n2_hash_tmpl *tmpl)
+
+ halg = &ahash->halg;
+ halg->digestsize = tmpl->digest_size;
++ halg->statesize = tmpl->statesize;
+
+ base = &halg->base;
+ snprintf(base->cra_name, CRYPTO_MAX_ALG_NAME, "%s", tmpl->name);
+diff --git a/drivers/dio/dio.c b/drivers/dio/dio.c
+index 92e78d16b4765..fcde602f49020 100644
+--- a/drivers/dio/dio.c
++++ b/drivers/dio/dio.c
+@@ -110,6 +110,12 @@ static char dio_no_name[] = { 0 };
+
+ #endif /* CONFIG_DIO_CONSTANTS */
+
++static void dio_dev_release(struct device *dev)
++{
++ struct dio_dev *ddev = container_of(dev, typeof(struct dio_dev), dev);
++ kfree(ddev);
++}
++
+ int __init dio_find(int deviceid)
+ {
+ /* Called to find a DIO device before the full bus scan has run.
+@@ -222,6 +228,7 @@ static int __init dio_init(void)
+ dev->bus = &dio_bus;
+ dev->dev.parent = &dio_bus.dev;
+ dev->dev.bus = &dio_bus_type;
++ dev->dev.release = dio_dev_release;
+ dev->scode = scode;
+ dev->resource.start = pa;
+ dev->resource.end = pa + DIO_SIZE(scode, va);
+@@ -249,6 +256,7 @@ static int __init dio_init(void)
+ if (error) {
+ pr_err("DIO: Error registering device %s\n",
+ dev->name);
++ put_device(&dev->dev);
+ continue;
+ }
+ error = dio_create_sysfs_dev_files(dev);
+diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
+index 65cf2b9355c47..93d6e6319b3cc 100644
+--- a/drivers/edac/edac_device.c
++++ b/drivers/edac/edac_device.c
+@@ -424,17 +424,16 @@ static void edac_device_workq_teardown(struct edac_device_ctl_info *edac_dev)
+ * Then restart the workq on the new delay
+ */
+ void edac_device_reset_delay_period(struct edac_device_ctl_info *edac_dev,
+- unsigned long value)
++ unsigned long msec)
+ {
+- unsigned long jiffs = msecs_to_jiffies(value);
+-
+- if (value == 1000)
+- jiffs = round_jiffies_relative(value);
+-
+- edac_dev->poll_msec = value;
+- edac_dev->delay = jiffs;
++ edac_dev->poll_msec = msec;
++ edac_dev->delay = msecs_to_jiffies(msec);
+
+- edac_mod_work(&edac_dev->work, jiffs);
++ /* See comment in edac_device_workq_setup() above */
++ if (edac_dev->poll_msec == 1000)
++ edac_mod_work(&edac_dev->work, round_jiffies_relative(edac_dev->delay));
++ else
++ edac_mod_work(&edac_dev->work, edac_dev->delay);
+ }
+
+ int edac_device_alloc_index(void)
+diff --git a/drivers/edac/edac_module.h b/drivers/edac/edac_module.h
+index c9f0e73872a64..a74c441759a80 100644
+--- a/drivers/edac/edac_module.h
++++ b/drivers/edac/edac_module.h
+@@ -57,7 +57,7 @@ bool edac_stop_work(struct delayed_work *work);
+ bool edac_mod_work(struct delayed_work *work, unsigned long delay);
+
+ extern void edac_device_reset_delay_period(struct edac_device_ctl_info
+- *edac_dev, unsigned long value);
++ *edac_dev, unsigned long msec);
+ extern void edac_mc_reset_delay_period(unsigned long value);
+
+ extern void *edac_align_ptr(void **p, unsigned size, int n_elems);
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index f0ef2643b70ed..c966a23de85d5 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -359,8 +359,8 @@ static int __init efisubsys_init(void)
+ efi_kobj = kobject_create_and_add("efi", firmware_kobj);
+ if (!efi_kobj) {
+ pr_err("efi: Firmware registration failed.\n");
+- destroy_workqueue(efi_rts_wq);
+- return -ENOMEM;
++ error = -ENOMEM;
++ goto err_destroy_wq;
+ }
+
+ error = generic_ops_register();
+@@ -396,7 +396,10 @@ err_unregister:
+ generic_ops_unregister();
+ err_put:
+ kobject_put(efi_kobj);
+- destroy_workqueue(efi_rts_wq);
++err_destroy_wq:
++ if (efi_rts_wq)
++ destroy_workqueue(efi_rts_wq);
++
+ return error;
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+index 6cf3dd5edffda..c1e2e9912bf05 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+@@ -312,6 +312,7 @@ static bool amdgpu_atrm_get_bios(struct amdgpu_device *adev)
+
+ if (!found)
+ return false;
++ pci_dev_put(pdev);
+
+ adev->bios = kmalloc(size, GFP_KERNEL);
+ if (!adev->bios) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+index 880ac113a3a9f..d26b6e36be023 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+@@ -48,6 +48,8 @@ struct amdgpu_vf_error_buffer {
+ uint64_t data[AMDGPU_VF_ERROR_ENTRY_SIZE];
+ };
+
++enum idh_request;
++
+ /**
+ * struct amdgpu_virt_ops - amdgpu device virt operations
+ */
+@@ -56,7 +58,8 @@ struct amdgpu_virt_ops {
+ int (*rel_full_gpu)(struct amdgpu_device *adev, bool init);
+ int (*reset_gpu)(struct amdgpu_device *adev);
+ int (*wait_reset)(struct amdgpu_device *adev);
+- void (*trans_msg)(struct amdgpu_device *adev, u32 req, u32 data1, u32 data2, u32 data3);
++ void (*trans_msg)(struct amdgpu_device *adev, enum idh_request req,
++ u32 data1, u32 data2, u32 data3);
+ };
+
+ /*
+diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
+index 7bb68ca4aa0ba..71136cbd183c3 100644
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -413,6 +413,9 @@ void drm_connector_cleanup(struct drm_connector *connector)
+ mutex_destroy(&connector->mutex);
+
+ memset(connector, 0, sizeof(*connector));
++
++ if (dev->registered)
++ drm_sysfs_hotplug_event(dev);
+ }
+ EXPORT_SYMBOL(drm_connector_cleanup);
+
+diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c
+index 2298ed2a9e1c0..3c8c4a820e951 100644
+--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c
++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c
+@@ -83,8 +83,9 @@ static int fsl_dcu_drm_connector_get_modes(struct drm_connector *connector)
+ return num_modes;
+ }
+
+-static int fsl_dcu_drm_connector_mode_valid(struct drm_connector *connector,
+- struct drm_display_mode *mode)
++static enum drm_mode_status
++fsl_dcu_drm_connector_mode_valid(struct drm_connector *connector,
++ struct drm_display_mode *mode)
+ {
+ if (mode->hdisplay & 0xf)
+ return MODE_ERROR;
+diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
+index dd0528cf98183..0246edecc61f1 100644
+--- a/drivers/gpu/drm/radeon/radeon_bios.c
++++ b/drivers/gpu/drm/radeon/radeon_bios.c
+@@ -223,6 +223,7 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
+
+ if (!found)
+ return false;
++ pci_dev_put(pdev);
+
+ rdev->bios = kmalloc(size, GFP_KERNEL);
+ if (!rdev->bios) {
+@@ -608,13 +609,14 @@ static bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
+ acpi_size tbl_size;
+ UEFI_ACPI_VFCT *vfct;
+ unsigned offset;
++ bool r = false;
+
+ if (!ACPI_SUCCESS(acpi_get_table("VFCT", 1, &hdr)))
+ return false;
+ tbl_size = hdr->length;
+ if (tbl_size < sizeof(UEFI_ACPI_VFCT)) {
+ DRM_ERROR("ACPI VFCT table present but broken (too short #1)\n");
+- return false;
++ goto out;
+ }
+
+ vfct = (UEFI_ACPI_VFCT *)hdr;
+@@ -627,13 +629,13 @@ static bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
+ offset += sizeof(VFCT_IMAGE_HEADER);
+ if (offset > tbl_size) {
+ DRM_ERROR("ACPI VFCT image header truncated\n");
+- return false;
++ goto out;
+ }
+
+ offset += vhdr->ImageLength;
+ if (offset > tbl_size) {
+ DRM_ERROR("ACPI VFCT image truncated\n");
+- return false;
++ goto out;
+ }
+
+ if (vhdr->ImageLength &&
+@@ -645,15 +647,18 @@ static bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
+ rdev->bios = kmemdup(&vbios->VbiosContent,
+ vhdr->ImageLength,
+ GFP_KERNEL);
++ if (rdev->bios)
++ r = true;
+
+- if (!rdev->bios)
+- return false;
+- return true;
++ goto out;
+ }
+ }
+
+ DRM_ERROR("ACPI VFCT table present but broken (too short #2)\n");
+- return false;
++
++out:
++ acpi_put_table(hdr);
++ return r;
+ }
+ #else
+ static inline bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
+diff --git a/drivers/gpu/drm/sti/sti_dvo.c b/drivers/gpu/drm/sti/sti_dvo.c
+index b08376b7611b8..794ac057a55c5 100644
+--- a/drivers/gpu/drm/sti/sti_dvo.c
++++ b/drivers/gpu/drm/sti/sti_dvo.c
+@@ -288,7 +288,7 @@ static void sti_dvo_set_mode(struct drm_bridge *bridge,
+
+ DRM_DEBUG_DRIVER("\n");
+
+- memcpy(&dvo->mode, mode, sizeof(struct drm_display_mode));
++ drm_mode_copy(&dvo->mode, mode);
+
+ /* According to the path used (main or aux), the dvo clocks should
+ * have a different parent clock. */
+@@ -346,8 +346,9 @@ static int sti_dvo_connector_get_modes(struct drm_connector *connector)
+
+ #define CLK_TOLERANCE_HZ 50
+
+-static int sti_dvo_connector_mode_valid(struct drm_connector *connector,
+- struct drm_display_mode *mode)
++static enum drm_mode_status
++sti_dvo_connector_mode_valid(struct drm_connector *connector,
++ struct drm_display_mode *mode)
+ {
+ int target = mode->clock * 1000;
+ int target_min = target - CLK_TOLERANCE_HZ;
+diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
+index 19b9b5ed12970..cf5b6dbe86b09 100644
+--- a/drivers/gpu/drm/sti/sti_hda.c
++++ b/drivers/gpu/drm/sti/sti_hda.c
+@@ -518,7 +518,7 @@ static void sti_hda_set_mode(struct drm_bridge *bridge,
+
+ DRM_DEBUG_DRIVER("\n");
+
+- memcpy(&hda->mode, mode, sizeof(struct drm_display_mode));
++ drm_mode_copy(&hda->mode, mode);
+
+ if (!hda_get_mode_idx(hda->mode, &mode_idx)) {
+ DRM_ERROR("Undefined mode\n");
+@@ -596,8 +596,9 @@ static int sti_hda_connector_get_modes(struct drm_connector *connector)
+
+ #define CLK_TOLERANCE_HZ 50
+
+-static int sti_hda_connector_mode_valid(struct drm_connector *connector,
+- struct drm_display_mode *mode)
++static enum drm_mode_status
++sti_hda_connector_mode_valid(struct drm_connector *connector,
++ struct drm_display_mode *mode)
+ {
+ int target = mode->clock * 1000;
+ int target_min = target - CLK_TOLERANCE_HZ;
+diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
+index ccf718404a1c2..c4bc09c9d0b5a 100644
+--- a/drivers/gpu/drm/sti/sti_hdmi.c
++++ b/drivers/gpu/drm/sti/sti_hdmi.c
+@@ -926,7 +926,7 @@ static void sti_hdmi_set_mode(struct drm_bridge *bridge,
+ DRM_DEBUG_DRIVER("\n");
+
+ /* Copy the drm display mode in the connector local structure */
+- memcpy(&hdmi->mode, mode, sizeof(struct drm_display_mode));
++ drm_mode_copy(&hdmi->mode, mode);
+
+ /* Update clock framerate according to the selected mode */
+ ret = clk_set_rate(hdmi->clk_pix, mode->clock * 1000);
+@@ -989,8 +989,9 @@ fail:
+
+ #define CLK_TOLERANCE_HZ 50
+
+-static int sti_hdmi_connector_mode_valid(struct drm_connector *connector,
+- struct drm_display_mode *mode)
++static enum drm_mode_status
++sti_hdmi_connector_mode_valid(struct drm_connector *connector,
++ struct drm_display_mode *mode)
+ {
+ int target = mode->clock * 1000;
+ int target_min = target - CLK_TOLERANCE_HZ;
+diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
+index 03adb4cf325b9..6c8b59a266756 100644
+--- a/drivers/gpu/drm/tegra/dc.c
++++ b/drivers/gpu/drm/tegra/dc.c
+@@ -2376,8 +2376,10 @@ static int tegra_dc_probe(struct platform_device *pdev)
+ usleep_range(2000, 4000);
+
+ err = reset_control_assert(dc->rst);
+- if (err < 0)
++ if (err < 0) {
++ clk_disable_unprepare(dc->clk);
+ return err;
++ }
+
+ usleep_range(2000, 4000);
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+index 8d2f5ded86d66..a539843a03ba3 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+@@ -309,7 +309,6 @@ static int virtio_gpu_resource_create_ioctl(struct drm_device *dev, void *data,
+ }
+ return ret;
+ }
+- drm_gem_object_put_unlocked(obj);
+
+ rc->res_handle = res_id; /* similiar to a VM address */
+ rc->bo_handle = handle;
+@@ -318,6 +317,15 @@ static int virtio_gpu_resource_create_ioctl(struct drm_device *dev, void *data,
+ virtio_gpu_unref_list(&validate_list);
+ dma_fence_put(&fence->f);
+ }
++
++ /*
++ * The handle owns the reference now. But we must drop our
++ * remaining reference *after* we no longer need to dereference
++ * the obj. Otherwise userspace could guess the handle and
++ * race closing it from another thread.
++ */
++ drm_gem_object_put_unlocked(obj);
++
+ return 0;
+ fail_unref:
+ if (vgdev->has_virgl_3d) {
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index d87bd2a8c75fb..bf8c721ebfe9c 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -179,7 +179,8 @@ void vmw_kms_cursor_snoop(struct vmw_surface *srf,
+ if (cmd->dma.guest.ptr.offset % PAGE_SIZE ||
+ box->x != 0 || box->y != 0 || box->z != 0 ||
+ box->srcx != 0 || box->srcy != 0 || box->srcz != 0 ||
+- box->d != 1 || box_count != 1) {
++ box->d != 1 || box_count != 1 ||
++ box->w > 64 || box->h > 64) {
+ /* TODO handle none page aligned offsets */
+ /* TODO handle more dst & src != 0 */
+ /* TODO handle more then one copy */
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 00943ddbe4172..2c9597c8ac92d 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -908,7 +908,10 @@
+ #define USB_DEVICE_ID_ORTEK_IHOME_IMAC_A210S 0x8003
+
+ #define USB_VENDOR_ID_PLANTRONICS 0x047f
++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3210_SERIES 0xc055
+ #define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES 0xc056
++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3215_SERIES 0xc057
++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES 0xc058
+
+ #define USB_VENDOR_ID_PANASONIC 0x04da
+ #define USB_DEVICE_ID_PANABOARD_UBT780 0x1044
+diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c
+index 460711c1124ac..3b75cadd543fa 100644
+--- a/drivers/hid/hid-plantronics.c
++++ b/drivers/hid/hid-plantronics.c
+@@ -201,9 +201,18 @@ err:
+ }
+
+ static const struct hid_device_id plantronics_devices[] = {
++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3210_SERIES),
++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
+ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES),
+ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3215_SERIES),
++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES),
++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
+ { }
+ };
+diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
+index bb012bc032e02..a0c30863e1e0c 100644
+--- a/drivers/hid/hid-sensor-custom.c
++++ b/drivers/hid/hid-sensor-custom.c
+@@ -67,7 +67,7 @@ struct hid_sensor_sample {
+ u32 raw_len;
+ } __packed;
+
+-static struct attribute hid_custom_attrs[] = {
++static struct attribute hid_custom_attrs[HID_CUSTOM_TOTAL_ATTRS] = {
+ {.name = "name", .mode = S_IRUGO},
+ {.name = "units", .mode = S_IRUGO},
+ {.name = "unit-expo", .mode = S_IRUGO},
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index fb63845e9920d..8e32415e0a909 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -163,6 +163,9 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
+ {
+ struct wacom *wacom = hid_get_drvdata(hdev);
+
++ if (wacom->wacom_wac.features.type == BOOTLOADER)
++ return 0;
++
+ if (size > WACOM_PKGLEN_MAX)
+ return 1;
+
+@@ -2759,6 +2762,11 @@ static int wacom_probe(struct hid_device *hdev,
+ goto fail;
+ }
+
++ if (features->type == BOOTLOADER) {
++ hid_warn(hdev, "Using device in hidraw-only mode");
++ return hid_hw_start(hdev, HID_CONNECT_HIDRAW);
++ }
++
+ error = wacom_parse_and_register(wacom, false);
+ if (error)
+ goto fail;
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 826c02a11133b..bc4d6474d8f54 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -4680,6 +4680,9 @@ static const struct wacom_features wacom_features_0x37B =
+ static const struct wacom_features wacom_features_HID_ANY_ID =
+ { "Wacom HID", .type = HID_GENERIC, .oVid = HID_ANY_ID, .oPid = HID_ANY_ID };
+
++static const struct wacom_features wacom_features_0x94 =
++ { "Wacom Bootloader", .type = BOOTLOADER };
++
+ #define USB_DEVICE_WACOM(prod) \
+ HID_DEVICE(BUS_USB, HID_GROUP_WACOM, USB_VENDOR_ID_WACOM, prod),\
+ .driver_data = (kernel_ulong_t)&wacom_features_##prod
+@@ -4753,6 +4756,7 @@ const struct hid_device_id wacom_ids[] = {
+ { USB_DEVICE_WACOM(0x84) },
+ { USB_DEVICE_WACOM(0x90) },
+ { USB_DEVICE_WACOM(0x93) },
++ { USB_DEVICE_WACOM(0x94) },
+ { USB_DEVICE_WACOM(0x97) },
+ { USB_DEVICE_WACOM(0x9A) },
+ { USB_DEVICE_WACOM(0x9F) },
+diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
+index 48ce2b0a4549e..fbdbb74f9f1fd 100644
+--- a/drivers/hid/wacom_wac.h
++++ b/drivers/hid/wacom_wac.h
+@@ -244,6 +244,7 @@ enum {
+ MTTPC,
+ MTTPC_B,
+ HID_GENERIC,
++ BOOTLOADER,
+ MAX_TYPE
+ };
+
+diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
+index 15ecc4bc8de60..6595f34e51aad 100644
+--- a/drivers/hsi/controllers/omap_ssi_core.c
++++ b/drivers/hsi/controllers/omap_ssi_core.c
+@@ -538,8 +538,10 @@ static int ssi_probe(struct platform_device *pd)
+ platform_set_drvdata(pd, ssi);
+
+ err = ssi_add_controller(ssi, pd);
+- if (err < 0)
++ if (err < 0) {
++ hsi_put_controller(ssi);
+ goto out1;
++ }
+
+ pm_runtime_enable(&pd->dev);
+
+@@ -572,9 +574,9 @@ out3:
+ device_for_each_child(&pd->dev, NULL, ssi_remove_ports);
+ out2:
+ ssi_remove_controller(ssi);
++ pm_runtime_disable(&pd->dev);
+ out1:
+ platform_set_drvdata(pd, NULL);
+- pm_runtime_disable(&pd->dev);
+
+ return err;
+ }
+@@ -665,7 +667,13 @@ static int __init ssi_init(void) {
+ if (ret)
+ return ret;
+
+- return platform_driver_register(&ssi_port_pdriver);
++ ret = platform_driver_register(&ssi_port_pdriver);
++ if (ret) {
++ platform_driver_unregister(&ssi_pdriver);
++ return ret;
++ }
++
++ return 0;
+ }
+ module_init(ssi_init);
+
+diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
+index 80796061102f1..9f5915d5f7e75 100644
+--- a/drivers/i2c/busses/i2c-ismt.c
++++ b/drivers/i2c/busses/i2c-ismt.c
+@@ -504,6 +504,9 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr,
+ if (read_write == I2C_SMBUS_WRITE) {
+ /* Block Write */
+ dev_dbg(dev, "I2C_SMBUS_BLOCK_DATA: WRITE\n");
++ if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX)
++ return -EINVAL;
++
+ dma_size = data->block[0] + 1;
+ dma_direction = DMA_TO_DEVICE;
+ desc->wr_len_cmd = dma_size;
+diff --git a/drivers/i2c/busses/i2c-pxa-pci.c b/drivers/i2c/busses/i2c-pxa-pci.c
+index 72ea8f4c61aa4..883937c8408b7 100644
+--- a/drivers/i2c/busses/i2c-pxa-pci.c
++++ b/drivers/i2c/busses/i2c-pxa-pci.c
+@@ -105,7 +105,7 @@ static int ce4100_i2c_probe(struct pci_dev *dev,
+ int i;
+ struct ce4100_devices *sds;
+
+- ret = pci_enable_device_mem(dev);
++ ret = pcim_enable_device(dev);
+ if (ret)
+ return ret;
+
+@@ -114,10 +114,8 @@ static int ce4100_i2c_probe(struct pci_dev *dev,
+ return -EINVAL;
+ }
+ sds = kzalloc(sizeof(*sds), GFP_KERNEL);
+- if (!sds) {
+- ret = -ENOMEM;
+- goto err_mem;
+- }
++ if (!sds)
++ return -ENOMEM;
+
+ for (i = 0; i < ARRAY_SIZE(sds->pdev); i++) {
+ sds->pdev[i] = add_i2c_device(dev, i);
+@@ -133,8 +131,6 @@ static int ce4100_i2c_probe(struct pci_dev *dev,
+
+ err_dev_add:
+ kfree(sds);
+-err_mem:
+- pci_disable_device(dev);
+ return ret;
+ }
+
+diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
+index 25af4c76b57fe..a96943bbd83db 100644
+--- a/drivers/iio/adc/ad_sigma_delta.c
++++ b/drivers/iio/adc/ad_sigma_delta.c
+@@ -283,10 +283,10 @@ int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev,
+ unsigned int sample, raw_sample;
+ int ret = 0;
+
+- if (iio_buffer_enabled(indio_dev))
+- return -EBUSY;
++ ret = iio_device_claim_direct_mode(indio_dev);
++ if (ret)
++ return ret;
+
+- mutex_lock(&indio_dev->mlock);
+ ad_sigma_delta_set_channel(sigma_delta, chan->address);
+
+ spi_bus_lock(sigma_delta->spi->master);
+@@ -320,7 +320,7 @@ out:
+ ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE);
+ sigma_delta->bus_locked = false;
+ spi_bus_unlock(sigma_delta->spi->master);
+- mutex_unlock(&indio_dev->mlock);
++ iio_device_release_direct_mode(indio_dev);
+
+ if (ret)
+ return ret;
+diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
+index f6fa9b115fdad..798bc810b2344 100644
+--- a/drivers/infiniband/core/nldev.c
++++ b/drivers/infiniband/core/nldev.c
+@@ -433,7 +433,7 @@ static int fill_res_cm_id_entry(struct sk_buff *msg,
+ struct nlattr *entry_attr;
+
+ if (port && port != cm_id->port_num)
+- return 0;
++ return -EAGAIN;
+
+ entry_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_RES_CM_ID_ENTRY);
+ if (!entry_attr)
+diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
+index 01ed0a667928d..bb670249bebfe 100644
+--- a/drivers/infiniband/hw/hfi1/affinity.c
++++ b/drivers/infiniband/hw/hfi1/affinity.c
+@@ -217,6 +217,8 @@ out:
+ for (node = 0; node < node_affinity.num_possible_nodes; node++)
+ hfi1_per_node_cntr[node] = 1;
+
++ pci_dev_put(dev);
++
+ return 0;
+ }
+
+diff --git a/drivers/infiniband/hw/hfi1/firmware.c b/drivers/infiniband/hw/hfi1/firmware.c
+index c090807124858..747ec08dec0d9 100644
+--- a/drivers/infiniband/hw/hfi1/firmware.c
++++ b/drivers/infiniband/hw/hfi1/firmware.c
+@@ -1786,6 +1786,7 @@ int parse_platform_config(struct hfi1_devdata *dd)
+
+ if (!dd->platform_config.data) {
+ dd_dev_err(dd, "%s: Missing config file\n", __func__);
++ ret = -EINVAL;
+ goto bail;
+ }
+ ptr = (u32 *)dd->platform_config.data;
+@@ -1794,6 +1795,7 @@ int parse_platform_config(struct hfi1_devdata *dd)
+ ptr++;
+ if (magic_num != PLATFORM_CONFIG_MAGIC_NUM) {
+ dd_dev_err(dd, "%s: Bad config file\n", __func__);
++ ret = -EINVAL;
+ goto bail;
+ }
+
+@@ -1817,6 +1819,7 @@ int parse_platform_config(struct hfi1_devdata *dd)
+ if (file_length > dd->platform_config.size) {
+ dd_dev_info(dd, "%s:File claims to be larger than read size\n",
+ __func__);
++ ret = -EINVAL;
+ goto bail;
+ } else if (file_length < dd->platform_config.size) {
+ dd_dev_info(dd,
+@@ -1837,6 +1840,7 @@ int parse_platform_config(struct hfi1_devdata *dd)
+ dd_dev_err(dd, "%s: Failed validation at offset %ld\n",
+ __func__, (ptr - (u32 *)
+ dd->platform_config.data));
++ ret = -EINVAL;
+ goto bail;
+ }
+
+@@ -1883,6 +1887,7 @@ int parse_platform_config(struct hfi1_devdata *dd)
+ __func__, table_type,
+ (ptr - (u32 *)
+ dd->platform_config.data));
++ ret = -EINVAL;
+ goto bail; /* We don't trust this file now */
+ }
+ pcfgcache->config_tables[table_type].table = ptr;
+@@ -1907,6 +1912,7 @@ int parse_platform_config(struct hfi1_devdata *dd)
+ __func__, table_type,
+ (ptr -
+ (u32 *)dd->platform_config.data));
++ ret = -EINVAL;
+ goto bail; /* We don't trust this file now */
+ }
+ pcfgcache->config_tables[table_type].table_metadata =
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 361b1b8597820..1520a3098f7dc 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3411,6 +3411,40 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ return err;
+ }
+
++static int validate_rd_atomic(struct mlx5_ib_dev *dev, struct ib_qp_attr *attr,
++ int attr_mask, enum ib_qp_type qp_type)
++{
++ int log_max_ra_res;
++ int log_max_ra_req;
++
++ if (qp_type == MLX5_IB_QPT_DCI) {
++ log_max_ra_res = 1 << MLX5_CAP_GEN(dev->mdev,
++ log_max_ra_res_dc);
++ log_max_ra_req = 1 << MLX5_CAP_GEN(dev->mdev,
++ log_max_ra_req_dc);
++ } else {
++ log_max_ra_res = 1 << MLX5_CAP_GEN(dev->mdev,
++ log_max_ra_res_qp);
++ log_max_ra_req = 1 << MLX5_CAP_GEN(dev->mdev,
++ log_max_ra_req_qp);
++ }
++
++ if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC &&
++ attr->max_rd_atomic > log_max_ra_res) {
++ mlx5_ib_dbg(dev, "invalid max_rd_atomic value %d\n",
++ attr->max_rd_atomic);
++ return false;
++ }
++
++ if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC &&
++ attr->max_dest_rd_atomic > log_max_ra_req) {
++ mlx5_ib_dbg(dev, "invalid max_dest_rd_atomic value %d\n",
++ attr->max_dest_rd_atomic);
++ return false;
++ }
++ return true;
++}
++
+ int mlx5_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ int attr_mask, struct ib_udata *udata)
+ {
+@@ -3508,21 +3542,8 @@ int mlx5_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ }
+ }
+
+- if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC &&
+- attr->max_rd_atomic >
+- (1 << MLX5_CAP_GEN(dev->mdev, log_max_ra_res_qp))) {
+- mlx5_ib_dbg(dev, "invalid max_rd_atomic value %d\n",
+- attr->max_rd_atomic);
+- goto out;
+- }
+-
+- if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC &&
+- attr->max_dest_rd_atomic >
+- (1 << MLX5_CAP_GEN(dev->mdev, log_max_ra_req_qp))) {
+- mlx5_ib_dbg(dev, "invalid max_dest_rd_atomic value %d\n",
+- attr->max_dest_rd_atomic);
++ if (!validate_rd_atomic(dev, attr, attr_mask, qp_type))
+ goto out;
+- }
+
+ if (cur_state == new_state && cur_state == IB_QPS_RESET) {
+ err = 0;
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 6320390f531ce..2cae62ae6c64a 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -836,12 +836,12 @@ static void rxe_qp_do_cleanup(struct work_struct *work)
+ qp->resp.mr = NULL;
+ }
+
+- if (qp_type(qp) == IB_QPT_RC)
+- sk_dst_reset(qp->sk->sk);
+-
+ free_rd_atomic_resources(qp);
+
+ if (qp->sk) {
++ if (qp_type(qp) == IB_QPT_RC)
++ sk_dst_reset(qp->sk->sk);
++
+ kernel_sock_shutdown(qp->sk, SHUT_RDWR);
+ sock_release(qp->sk);
+ }
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
+index d4d553a51fa98..285cb28bf14a5 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
+@@ -42,6 +42,11 @@ static const struct nla_policy ipoib_policy[IFLA_IPOIB_MAX + 1] = {
+ [IFLA_IPOIB_UMCAST] = { .type = NLA_U16 },
+ };
+
++static unsigned int ipoib_get_max_num_queues(void)
++{
++ return min_t(unsigned int, num_possible_cpus(), 128);
++}
++
+ static int ipoib_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = ipoib_priv(dev);
+@@ -147,6 +152,8 @@ static struct rtnl_link_ops ipoib_link_ops __read_mostly = {
+ .changelink = ipoib_changelink,
+ .get_size = ipoib_get_size,
+ .fill_info = ipoib_fill_info,
++ .get_num_rx_queues = ipoib_get_max_num_queues,
++ .get_num_tx_queues = ipoib_get_max_num_queues,
+ };
+
+ int __init ipoib_netlink_init(void)
+diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c
+index adfae2d88707b..83e9bded87d9a 100644
+--- a/drivers/input/touchscreen/elants_i2c.c
++++ b/drivers/input/touchscreen/elants_i2c.c
+@@ -1082,14 +1082,12 @@ static int elants_i2c_power_on(struct elants_data *ts)
+ if (IS_ERR_OR_NULL(ts->reset_gpio))
+ return 0;
+
+- gpiod_set_value_cansleep(ts->reset_gpio, 1);
+-
+ error = regulator_enable(ts->vcc33);
+ if (error) {
+ dev_err(&ts->client->dev,
+ "failed to enable vcc33 regulator: %d\n",
+ error);
+- goto release_reset_gpio;
++ return error;
+ }
+
+ error = regulator_enable(ts->vccio);
+@@ -1098,7 +1096,7 @@ static int elants_i2c_power_on(struct elants_data *ts)
+ "failed to enable vccio regulator: %d\n",
+ error);
+ regulator_disable(ts->vcc33);
+- goto release_reset_gpio;
++ return error;
+ }
+
+ /*
+@@ -1107,7 +1105,6 @@ static int elants_i2c_power_on(struct elants_data *ts)
+ */
+ udelay(ELAN_POWERON_DELAY_USEC);
+
+-release_reset_gpio:
+ gpiod_set_value_cansleep(ts->reset_gpio, 0);
+ if (error)
+ return error;
+@@ -1215,7 +1212,7 @@ static int elants_i2c_probe(struct i2c_client *client,
+ return error;
+ }
+
+- ts->reset_gpio = devm_gpiod_get(&client->dev, "reset", GPIOD_OUT_LOW);
++ ts->reset_gpio = devm_gpiod_get(&client->dev, "reset", GPIOD_OUT_HIGH);
+ if (IS_ERR(ts->reset_gpio)) {
+ error = PTR_ERR(ts->reset_gpio);
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 1c61cd0b1d55d..12e7254b39489 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -2946,6 +2946,13 @@ static int __init parse_ivrs_acpihid(char *str)
+ return 1;
+ }
+
++ /*
++ * Ignore leading zeroes after ':', so e.g., AMDI0095:00
++ * will match AMDI0095:0 in the second strcmp in acpi_dev_hid_uid_match
++ */
++ while (*uid == '0' && *(uid + 1))
++ uid++;
++
+ i = early_acpihid_map_size++;
+ memcpy(early_acpihid_map[i].hid, hid, strlen(hid));
+ memcpy(early_acpihid_map[i].uid, uid, strlen(uid));
+diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
+index 7a59a8ebac108..387b72b7e7b36 100644
+--- a/drivers/iommu/amd_iommu_v2.c
++++ b/drivers/iommu/amd_iommu_v2.c
+@@ -626,6 +626,7 @@ out_drop_state:
+ put_device_state(dev_state);
+
+ out:
++ pci_dev_put(pdev);
+ return ret;
+ }
+
+diff --git a/drivers/iommu/fsl_pamu.c b/drivers/iommu/fsl_pamu.c
+index 8540625796a16..b6a0c6d3b204e 100644
+--- a/drivers/iommu/fsl_pamu.c
++++ b/drivers/iommu/fsl_pamu.c
+@@ -1134,7 +1134,7 @@ static int fsl_pamu_probe(struct platform_device *pdev)
+ ret = create_csd(ppaact_phys, mem_size, csd_port_id);
+ if (ret) {
+ dev_err(dev, "could not create coherence subdomain\n");
+- return ret;
++ goto error;
+ }
+ }
+
+diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
+index 676c029494e44..94b16cacb80fc 100644
+--- a/drivers/iommu/mtk_iommu_v1.c
++++ b/drivers/iommu/mtk_iommu_v1.c
+@@ -626,18 +626,34 @@ static int mtk_iommu_probe(struct platform_device *pdev)
+ ret = iommu_device_sysfs_add(&data->iommu, &pdev->dev, NULL,
+ dev_name(&pdev->dev));
+ if (ret)
+- return ret;
++ goto out_clk_unprepare;
+
+ iommu_device_set_ops(&data->iommu, &mtk_iommu_ops);
+
+ ret = iommu_device_register(&data->iommu);
+ if (ret)
+- return ret;
++ goto out_sysfs_remove;
+
+- if (!iommu_present(&platform_bus_type))
+- bus_set_iommu(&platform_bus_type, &mtk_iommu_ops);
++ if (!iommu_present(&platform_bus_type)) {
++ ret = bus_set_iommu(&platform_bus_type, &mtk_iommu_ops);
++ if (ret)
++ goto out_dev_unreg;
++ }
+
+- return component_master_add_with_match(dev, &mtk_iommu_com_ops, match);
++ ret = component_master_add_with_match(dev, &mtk_iommu_com_ops, match);
++ if (ret)
++ goto out_bus_set_null;
++ return ret;
++
++out_bus_set_null:
++ bus_set_iommu(&platform_bus_type, NULL);
++out_dev_unreg:
++ iommu_device_unregister(&data->iommu);
++out_sysfs_remove:
++ iommu_device_sysfs_remove(&data->iommu);
++out_clk_unprepare:
++ clk_disable_unprepare(data->bclk);
++ return ret;
+ }
+
+ static int mtk_iommu_remove(struct platform_device *pdev)
+diff --git a/drivers/irqchip/irq-gic-pm.c b/drivers/irqchip/irq-gic-pm.c
+index ecafd295c31ce..21c5decfc55b4 100644
+--- a/drivers/irqchip/irq-gic-pm.c
++++ b/drivers/irqchip/irq-gic-pm.c
+@@ -112,7 +112,7 @@ static int gic_probe(struct platform_device *pdev)
+
+ pm_runtime_enable(dev);
+
+- ret = pm_runtime_get_sync(dev);
++ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0)
+ goto rpm_disable;
+
+diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
+index 0928fd1f0e0c1..60b3a4aabe6b8 100644
+--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
++++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
+@@ -3233,6 +3233,7 @@ static int
+ hfcm_l1callback(struct dchannel *dch, u_int cmd)
+ {
+ struct hfc_multi *hc = dch->hw;
++ struct sk_buff_head free_queue;
+ u_long flags;
+
+ switch (cmd) {
+@@ -3261,6 +3262,7 @@ hfcm_l1callback(struct dchannel *dch, u_int cmd)
+ l1_event(dch->l1, HW_POWERUP_IND);
+ break;
+ case HW_DEACT_REQ:
++ __skb_queue_head_init(&free_queue);
+ /* start deactivation */
+ spin_lock_irqsave(&hc->lock, flags);
+ if (hc->ctype == HFC_TYPE_E1) {
+@@ -3280,20 +3282,21 @@ hfcm_l1callback(struct dchannel *dch, u_int cmd)
+ plxsd_checksync(hc, 0);
+ }
+ }
+- skb_queue_purge(&dch->squeue);
++ skb_queue_splice_init(&dch->squeue, &free_queue);
+ if (dch->tx_skb) {
+- dev_kfree_skb(dch->tx_skb);
++ __skb_queue_tail(&free_queue, dch->tx_skb);
+ dch->tx_skb = NULL;
+ }
+ dch->tx_idx = 0;
+ if (dch->rx_skb) {
+- dev_kfree_skb(dch->rx_skb);
++ __skb_queue_tail(&free_queue, dch->rx_skb);
+ dch->rx_skb = NULL;
+ }
+ test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
+ if (test_and_clear_bit(FLG_BUSY_TIMER, &dch->Flags))
+ del_timer(&dch->timer);
+ spin_unlock_irqrestore(&hc->lock, flags);
++ __skb_queue_purge(&free_queue);
+ break;
+ case HW_POWERUP_REQ:
+ spin_lock_irqsave(&hc->lock, flags);
+@@ -3400,6 +3403,9 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
+ case PH_DEACTIVATE_REQ:
+ test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags);
+ if (dch->dev.D.protocol != ISDN_P_TE_S0) {
++ struct sk_buff_head free_queue;
++
++ __skb_queue_head_init(&free_queue);
+ spin_lock_irqsave(&hc->lock, flags);
+ if (debug & DEBUG_HFCMULTI_MSG)
+ printk(KERN_DEBUG
+@@ -3421,14 +3427,14 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
+ /* deactivate */
+ dch->state = 1;
+ }
+- skb_queue_purge(&dch->squeue);
++ skb_queue_splice_init(&dch->squeue, &free_queue);
+ if (dch->tx_skb) {
+- dev_kfree_skb(dch->tx_skb);
++ __skb_queue_tail(&free_queue, dch->tx_skb);
+ dch->tx_skb = NULL;
+ }
+ dch->tx_idx = 0;
+ if (dch->rx_skb) {
+- dev_kfree_skb(dch->rx_skb);
++ __skb_queue_tail(&free_queue, dch->rx_skb);
+ dch->rx_skb = NULL;
+ }
+ test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
+@@ -3440,6 +3446,7 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
+ #endif
+ ret = 0;
+ spin_unlock_irqrestore(&hc->lock, flags);
++ __skb_queue_purge(&free_queue);
+ } else
+ ret = l1_event(dch->l1, hh->prim);
+ break;
+diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
+index 53349850f8669..de98e94711d22 100644
+--- a/drivers/isdn/hardware/mISDN/hfcpci.c
++++ b/drivers/isdn/hardware/mISDN/hfcpci.c
+@@ -1633,16 +1633,19 @@ hfcpci_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb)
+ test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags);
+ spin_lock_irqsave(&hc->lock, flags);
+ if (hc->hw.protocol == ISDN_P_NT_S0) {
++ struct sk_buff_head free_queue;
++
++ __skb_queue_head_init(&free_queue);
+ /* prepare deactivation */
+ Write_hfc(hc, HFCPCI_STATES, 0x40);
+- skb_queue_purge(&dch->squeue);
++ skb_queue_splice_init(&dch->squeue, &free_queue);
+ if (dch->tx_skb) {
+- dev_kfree_skb(dch->tx_skb);
++ __skb_queue_tail(&free_queue, dch->tx_skb);
+ dch->tx_skb = NULL;
+ }
+ dch->tx_idx = 0;
+ if (dch->rx_skb) {
+- dev_kfree_skb(dch->rx_skb);
++ __skb_queue_tail(&free_queue, dch->rx_skb);
+ dch->rx_skb = NULL;
+ }
+ test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
+@@ -1655,10 +1658,12 @@ hfcpci_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb)
+ hc->hw.mst_m &= ~HFCPCI_MASTER;
+ Write_hfc(hc, HFCPCI_MST_MODE, hc->hw.mst_m);
+ ret = 0;
++ spin_unlock_irqrestore(&hc->lock, flags);
++ __skb_queue_purge(&free_queue);
+ } else {
+ ret = l1_event(dch->l1, hh->prim);
++ spin_unlock_irqrestore(&hc->lock, flags);
+ }
+- spin_unlock_irqrestore(&hc->lock, flags);
+ break;
+ }
+ if (!ret)
+diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
+index c952002c6301d..c49081ed5734f 100644
+--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
+@@ -337,20 +337,24 @@ hfcusb_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb)
+ test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags);
+
+ if (hw->protocol == ISDN_P_NT_S0) {
++ struct sk_buff_head free_queue;
++
++ __skb_queue_head_init(&free_queue);
+ hfcsusb_ph_command(hw, HFC_L1_DEACTIVATE_NT);
+ spin_lock_irqsave(&hw->lock, flags);
+- skb_queue_purge(&dch->squeue);
++ skb_queue_splice_init(&dch->squeue, &free_queue);
+ if (dch->tx_skb) {
+- dev_kfree_skb(dch->tx_skb);
++ __skb_queue_tail(&free_queue, dch->tx_skb);
+ dch->tx_skb = NULL;
+ }
+ dch->tx_idx = 0;
+ if (dch->rx_skb) {
+- dev_kfree_skb(dch->rx_skb);
++ __skb_queue_tail(&free_queue, dch->rx_skb);
+ dch->rx_skb = NULL;
+ }
+ test_and_clear_bit(FLG_TX_BUSY, &dch->Flags);
+ spin_unlock_irqrestore(&hw->lock, flags);
++ __skb_queue_purge(&free_queue);
+ #ifdef FIXME
+ if (test_and_clear_bit(FLG_L1_BUSY, &dch->Flags))
+ dchannel_sched_event(&hc->dch, D_CLEARBUSY);
+@@ -1344,7 +1348,7 @@ tx_iso_complete(struct urb *urb)
+ printk("\n");
+ }
+
+- dev_kfree_skb(tx_skb);
++ dev_consume_skb_irq(tx_skb);
+ tx_skb = NULL;
+ if (fifo->dch && get_next_dframe(fifo->dch))
+ tx_skb = fifo->dch->tx_skb;
+diff --git a/drivers/macintosh/macio-adb.c b/drivers/macintosh/macio-adb.c
+index eb3adfb7f88d3..172a8b18c5799 100644
+--- a/drivers/macintosh/macio-adb.c
++++ b/drivers/macintosh/macio-adb.c
+@@ -106,6 +106,10 @@ int macio_init(void)
+ return -ENXIO;
+ }
+ adb = ioremap(r.start, sizeof(struct adb_regs));
++ if (!adb) {
++ of_node_put(adbs);
++ return -ENOMEM;
++ }
+
+ out_8(&adb->ctrl.r, 0);
+ out_8(&adb->intr.r, 0);
+diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
+index 07074820a1674..12c360ebd7e95 100644
+--- a/drivers/macintosh/macio_asic.c
++++ b/drivers/macintosh/macio_asic.c
+@@ -427,7 +427,7 @@ static struct macio_dev * macio_add_one_device(struct macio_chip *chip,
+ if (of_device_register(&dev->ofdev) != 0) {
+ printk(KERN_DEBUG"macio: device registration error for %s!\n",
+ dev_name(&dev->ofdev.dev));
+- kfree(dev);
++ put_device(&dev->ofdev.dev);
+ return NULL;
+ }
+
+diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
+index 118d27ee31c2f..7fd32b0183dc1 100644
+--- a/drivers/mcb/mcb-core.c
++++ b/drivers/mcb/mcb-core.c
+@@ -74,8 +74,10 @@ static int mcb_probe(struct device *dev)
+
+ get_device(dev);
+ ret = mdrv->probe(mdev, found_id);
+- if (ret)
++ if (ret) {
+ module_put(carrier_mod);
++ put_device(dev);
++ }
+
+ return ret;
+ }
+diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
+index 7369bda3442fb..3636349648b4f 100644
+--- a/drivers/mcb/mcb-parse.c
++++ b/drivers/mcb/mcb-parse.c
+@@ -107,7 +107,7 @@ static int chameleon_parse_gdd(struct mcb_bus *bus,
+ return 0;
+
+ err:
+- mcb_free_dev(mdev);
++ put_device(&mdev->dev);
+
+ return ret;
+ }
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index af6d4f898e4c1..2ecd0db0f2945 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -551,11 +551,13 @@ static int __create_persistent_data_objects(struct dm_cache_metadata *cmd,
+ return r;
+ }
+
+-static void __destroy_persistent_data_objects(struct dm_cache_metadata *cmd)
++static void __destroy_persistent_data_objects(struct dm_cache_metadata *cmd,
++ bool destroy_bm)
+ {
+ dm_sm_destroy(cmd->metadata_sm);
+ dm_tm_destroy(cmd->tm);
+- dm_block_manager_destroy(cmd->bm);
++ if (destroy_bm)
++ dm_block_manager_destroy(cmd->bm);
+ }
+
+ typedef unsigned long (*flags_mutator)(unsigned long);
+@@ -826,7 +828,7 @@ static struct dm_cache_metadata *lookup_or_open(struct block_device *bdev,
+ cmd2 = lookup(bdev);
+ if (cmd2) {
+ mutex_unlock(&table_lock);
+- __destroy_persistent_data_objects(cmd);
++ __destroy_persistent_data_objects(cmd, true);
+ kfree(cmd);
+ return cmd2;
+ }
+@@ -874,7 +876,7 @@ void dm_cache_metadata_close(struct dm_cache_metadata *cmd)
+ mutex_unlock(&table_lock);
+
+ if (!cmd->fail_io)
+- __destroy_persistent_data_objects(cmd);
++ __destroy_persistent_data_objects(cmd, true);
+ kfree(cmd);
+ }
+ }
+@@ -1808,14 +1810,52 @@ int dm_cache_metadata_needs_check(struct dm_cache_metadata *cmd, bool *result)
+
+ int dm_cache_metadata_abort(struct dm_cache_metadata *cmd)
+ {
+- int r;
++ int r = -EINVAL;
++ struct dm_block_manager *old_bm = NULL, *new_bm = NULL;
++
++ /* fail_io is double-checked with cmd->root_lock held below */
++ if (unlikely(cmd->fail_io))
++ return r;
++
++ /*
++ * Replacement block manager (new_bm) is created and old_bm destroyed outside of
++ * cmd root_lock to avoid ABBA deadlock that would result (due to life-cycle of
++ * shrinker associated with the block manager's bufio client vs cmd root_lock).
++ * - must take shrinker_rwsem without holding cmd->root_lock
++ */
++ new_bm = dm_block_manager_create(cmd->bdev, DM_CACHE_METADATA_BLOCK_SIZE << SECTOR_SHIFT,
++ CACHE_MAX_CONCURRENT_LOCKS);
+
+ WRITE_LOCK(cmd);
+- __destroy_persistent_data_objects(cmd);
+- r = __create_persistent_data_objects(cmd, false);
++ if (cmd->fail_io) {
++ WRITE_UNLOCK(cmd);
++ goto out;
++ }
++
++ __destroy_persistent_data_objects(cmd, false);
++ old_bm = cmd->bm;
++ if (IS_ERR(new_bm)) {
++ DMERR("could not create block manager during abort");
++ cmd->bm = NULL;
++ r = PTR_ERR(new_bm);
++ goto out_unlock;
++ }
++
++ cmd->bm = new_bm;
++ r = __open_or_format_metadata(cmd, false);
++ if (r) {
++ cmd->bm = NULL;
++ goto out_unlock;
++ }
++ new_bm = NULL;
++out_unlock:
+ if (r)
+ cmd->fail_io = true;
+ WRITE_UNLOCK(cmd);
++ dm_block_manager_destroy(old_bm);
++out:
++ if (new_bm && !IS_ERR(new_bm))
++ dm_block_manager_destroy(new_bm);
+
+ return r;
+ }
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index 2ddd575e97f73..df7bc45bc0ced 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -1010,16 +1010,16 @@ static void abort_transaction(struct cache *cache)
+ if (get_cache_mode(cache) >= CM_READ_ONLY)
+ return;
+
+- if (dm_cache_metadata_set_needs_check(cache->cmd)) {
+- DMERR("%s: failed to set 'needs_check' flag in metadata", dev_name);
+- set_cache_mode(cache, CM_FAIL);
+- }
+-
+ DMERR_LIMIT("%s: aborting current metadata transaction", dev_name);
+ if (dm_cache_metadata_abort(cache->cmd)) {
+ DMERR("%s: failed to abort metadata transaction", dev_name);
+ set_cache_mode(cache, CM_FAIL);
+ }
++
++ if (dm_cache_metadata_set_needs_check(cache->cmd)) {
++ DMERR("%s: failed to set 'needs_check' flag in metadata", dev_name);
++ set_cache_mode(cache, CM_FAIL);
++ }
+ }
+
+ static void metadata_operation_failed(struct cache *cache, const char *op, int r)
+@@ -1987,6 +1987,7 @@ static void destroy(struct cache *cache)
+ if (cache->prison)
+ dm_bio_prison_destroy_v2(cache->prison);
+
++ cancel_delayed_work_sync(&cache->waker);
+ if (cache->wq)
+ destroy_workqueue(cache->wq);
+
+diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
+index a6a5cee6b9430..f374f593fe555 100644
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -660,6 +660,15 @@ static int __open_metadata(struct dm_pool_metadata *pmd)
+ goto bad_cleanup_data_sm;
+ }
+
++ /*
++ * For pool metadata opening process, root setting is redundant
++ * because it will be set again in __begin_transaction(). But dm
++ * pool aborting process really needs to get last transaction's
++ * root to avoid accessing broken btree.
++ */
++ pmd->root = le64_to_cpu(disk_super->data_mapping_root);
++ pmd->details_root = le64_to_cpu(disk_super->device_details_root);
++
+ __setup_btree_details(pmd);
+ dm_bm_unlock(sblock);
+
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 435a2ee4a3927..386cb33953783 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2921,6 +2921,8 @@ static void __pool_destroy(struct pool *pool)
+ dm_bio_prison_destroy(pool->prison);
+ dm_kcopyd_client_destroy(pool->copier);
+
++ cancel_delayed_work_sync(&pool->waker);
++ cancel_delayed_work_sync(&pool->no_space_timeout);
+ if (pool->wq)
+ destroy_workqueue(pool->wq);
+
+@@ -3547,20 +3549,28 @@ static int pool_preresume(struct dm_target *ti)
+ */
+ r = bind_control_target(pool, ti);
+ if (r)
+- return r;
++ goto out;
+
+ r = maybe_resize_data_dev(ti, &need_commit1);
+ if (r)
+- return r;
++ goto out;
+
+ r = maybe_resize_metadata_dev(ti, &need_commit2);
+ if (r)
+- return r;
++ goto out;
+
+ if (need_commit1 || need_commit2)
+ (void) commit(pool);
++out:
++ /*
++ * When a thin-pool is PM_FAIL, it cannot be rebuilt if
++ * bio is in deferred list. Therefore need to return 0
++ * to allow pool_resume() to flush IO.
++ */
++ if (r && get_pool_mode(pool) == PM_FAIL)
++ r = 0;
+
+- return 0;
++ return r;
+ }
+
+ static void pool_suspend_active_thins(struct pool *pool)
+diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
+index 7cf9d34ce20eb..1c4c462787198 100644
+--- a/drivers/md/md-bitmap.c
++++ b/drivers/md/md-bitmap.c
+@@ -488,7 +488,7 @@ void md_bitmap_print_sb(struct bitmap *bitmap)
+ sb = kmap_atomic(bitmap->storage.sb_page);
+ pr_debug("%s: bitmap file superblock:\n", bmname(bitmap));
+ pr_debug(" magic: %08x\n", le32_to_cpu(sb->magic));
+- pr_debug(" version: %d\n", le32_to_cpu(sb->version));
++ pr_debug(" version: %u\n", le32_to_cpu(sb->version));
+ pr_debug(" uuid: %08x.%08x.%08x.%08x\n",
+ le32_to_cpu(*(__u32 *)(sb->uuid+0)),
+ le32_to_cpu(*(__u32 *)(sb->uuid+4)),
+@@ -499,11 +499,11 @@ void md_bitmap_print_sb(struct bitmap *bitmap)
+ pr_debug("events cleared: %llu\n",
+ (unsigned long long) le64_to_cpu(sb->events_cleared));
+ pr_debug(" state: %08x\n", le32_to_cpu(sb->state));
+- pr_debug(" chunksize: %d B\n", le32_to_cpu(sb->chunksize));
+- pr_debug(" daemon sleep: %ds\n", le32_to_cpu(sb->daemon_sleep));
++ pr_debug(" chunksize: %u B\n", le32_to_cpu(sb->chunksize));
++ pr_debug(" daemon sleep: %us\n", le32_to_cpu(sb->daemon_sleep));
+ pr_debug(" sync size: %llu KB\n",
+ (unsigned long long)le64_to_cpu(sb->sync_size)/2);
+- pr_debug("max write behind: %d\n", le32_to_cpu(sb->write_behind));
++ pr_debug("max write behind: %u\n", le32_to_cpu(sb->write_behind));
+ kunmap_atomic(sb);
+ }
+
+@@ -2101,7 +2101,8 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+ bytes = DIV_ROUND_UP(chunks, 8);
+ if (!bitmap->mddev->bitmap_info.external)
+ bytes += sizeof(bitmap_super_t);
+- } while (bytes > (space << 9));
++ } while (bytes > (space << 9) && (chunkshift + BITMAP_BLOCK_SHIFT) <
++ (BITS_PER_BYTE * sizeof(((bitmap_super_t *)0)->chunksize) - 1));
+ } else
+ chunkshift = ffz(~chunksize) - BITMAP_BLOCK_SHIFT;
+
+@@ -2146,7 +2147,7 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+ bitmap->counts.missing_pages = pages;
+ bitmap->counts.chunkshift = chunkshift;
+ bitmap->counts.chunks = chunks;
+- bitmap->mddev->bitmap_info.chunksize = 1 << (chunkshift +
++ bitmap->mddev->bitmap_info.chunksize = 1UL << (chunkshift +
+ BITMAP_BLOCK_SHIFT);
+
+ blocks = min(old_counts.chunks << old_counts.chunkshift,
+@@ -2172,8 +2173,8 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+ bitmap->counts.missing_pages = old_counts.pages;
+ bitmap->counts.chunkshift = old_counts.chunkshift;
+ bitmap->counts.chunks = old_counts.chunks;
+- bitmap->mddev->bitmap_info.chunksize = 1 << (old_counts.chunkshift +
+- BITMAP_BLOCK_SHIFT);
++ bitmap->mddev->bitmap_info.chunksize =
++ 1UL << (old_counts.chunkshift + BITMAP_BLOCK_SHIFT);
+ blocks = old_counts.chunks << old_counts.chunkshift;
+ pr_warn("Could not pre-allocate in-memory bitmap for cluster raid\n");
+ break;
+@@ -2191,20 +2192,23 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+
+ if (set) {
+ bmc_new = md_bitmap_get_counter(&bitmap->counts, block, &new_blocks, 1);
+- if (*bmc_new == 0) {
+- /* need to set on-disk bits too. */
+- sector_t end = block + new_blocks;
+- sector_t start = block >> chunkshift;
+- start <<= chunkshift;
+- while (start < end) {
+- md_bitmap_file_set_bit(bitmap, block);
+- start += 1 << chunkshift;
++ if (bmc_new) {
++ if (*bmc_new == 0) {
++ /* need to set on-disk bits too. */
++ sector_t end = block + new_blocks;
++ sector_t start = block >> chunkshift;
++
++ start <<= chunkshift;
++ while (start < end) {
++ md_bitmap_file_set_bit(bitmap, block);
++ start += 1 << chunkshift;
++ }
++ *bmc_new = 2;
++ md_bitmap_count_page(&bitmap->counts, block, 1);
++ md_bitmap_set_pending(&bitmap->counts, block);
+ }
+- *bmc_new = 2;
+- md_bitmap_count_page(&bitmap->counts, block, 1);
+- md_bitmap_set_pending(&bitmap->counts, block);
++ *bmc_new |= NEEDED_MASK;
+ }
+- *bmc_new |= NEEDED_MASK;
+ if (new_blocks < old_blocks)
+ old_blocks = new_blocks;
+ }
+@@ -2496,6 +2500,9 @@ chunksize_store(struct mddev *mddev, const char *buf, size_t len)
+ if (csize < 512 ||
+ !is_power_of_2(csize))
+ return -EINVAL;
++ if (BITS_PER_LONG > 32 && csize >= (1ULL << (BITS_PER_BYTE *
++ sizeof(((bitmap_super_t *)0)->chunksize))))
++ return -EOVERFLOW;
+ mddev->bitmap_info.chunksize = csize;
+ return len;
+ }
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 38cbde9061339..89d4dcc5253e5 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -417,13 +417,14 @@ static void md_end_flush(struct bio *bio)
+ struct md_rdev *rdev = bio->bi_private;
+ struct mddev *mddev = rdev->mddev;
+
++ bio_put(bio);
++
+ rdev_dec_pending(rdev, mddev);
+
+ if (atomic_dec_and_test(&mddev->flush_pending)) {
+ /* The pre-request flush has finished */
+ queue_work(md_wq, &mddev->flush_work);
+ }
+- bio_put(bio);
+ }
+
+ static void md_submit_flush_data(struct work_struct *ws);
+@@ -821,10 +822,12 @@ static void super_written(struct bio *bio)
+ } else
+ clear_bit(LastDev, &rdev->flags);
+
++ bio_put(bio);
++
++ rdev_dec_pending(rdev, mddev);
++
+ if (atomic_dec_and_test(&mddev->pending_writes))
+ wake_up(&mddev->sb_wait);
+- rdev_dec_pending(rdev, mddev);
+- bio_put(bio);
+ }
+
+ void md_super_write(struct mddev *mddev, struct md_rdev *rdev,
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 876d3e1339d17..0f8b1fb3d0517 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -3110,6 +3110,7 @@ static int raid1_run(struct mddev *mddev)
+ * RAID1 needs at least one disk in active
+ */
+ if (conf->raid_disks - mddev->degraded < 1) {
++ md_unregister_thread(&conf->thread);
+ ret = -EINVAL;
+ goto abort;
+ }
+diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
+index 9e0ef3934fa3d..ab0ce852c5b2a 100644
+--- a/drivers/media/dvb-core/dmxdev.c
++++ b/drivers/media/dvb-core/dmxdev.c
+@@ -800,6 +800,11 @@ static int dvb_demux_open(struct inode *inode, struct file *file)
+ if (mutex_lock_interruptible(&dmxdev->mutex))
+ return -ERESTARTSYS;
+
++ if (dmxdev->exit) {
++ mutex_unlock(&dmxdev->mutex);
++ return -ENODEV;
++ }
++
+ for (i = 0; i < dmxdev->filternum; i++)
+ if (dmxdev->filter[i].state == DMXDEV_STATE_FREE)
+ break;
+@@ -1457,7 +1462,10 @@ EXPORT_SYMBOL(dvb_dmxdev_init);
+
+ void dvb_dmxdev_release(struct dmxdev *dmxdev)
+ {
++ mutex_lock(&dmxdev->mutex);
+ dmxdev->exit = 1;
++ mutex_unlock(&dmxdev->mutex);
++
+ if (dmxdev->dvbdev->users > 1) {
+ wait_event(dmxdev->dvbdev->wait_queue,
+ dmxdev->dvbdev->users == 1);
+diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
+index 4d371cea0d5df..36afcea709a75 100644
+--- a/drivers/media/dvb-core/dvb_ca_en50221.c
++++ b/drivers/media/dvb-core/dvb_ca_en50221.c
+@@ -168,7 +168,7 @@ static void dvb_ca_private_free(struct dvb_ca_private *ca)
+ {
+ unsigned int i;
+
+- dvb_free_device(ca->dvbdev);
++ dvb_device_put(ca->dvbdev);
+ for (i = 0; i < ca->slot_count; i++)
+ vfree(ca->slot_info[i].rx_buffer.data);
+
+diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
+index 8a61150ee249e..e0650bc2df613 100644
+--- a/drivers/media/dvb-core/dvb_frontend.c
++++ b/drivers/media/dvb-core/dvb_frontend.c
+@@ -147,7 +147,7 @@ static void __dvb_frontend_free(struct dvb_frontend *fe)
+ struct dvb_frontend_private *fepriv = fe->frontend_priv;
+
+ if (fepriv)
+- dvb_free_device(fepriv->dvbdev);
++ dvb_device_put(fepriv->dvbdev);
+
+ dvb_frontend_invoke_release(fe, fe->ops.release);
+
+@@ -2956,6 +2956,7 @@ int dvb_register_frontend(struct dvb_adapter *dvb,
+ .name = fe->ops.info.name,
+ #endif
+ };
++ int ret;
+
+ dev_dbg(dvb->device, "%s:\n", __func__);
+
+@@ -2989,8 +2990,13 @@ int dvb_register_frontend(struct dvb_adapter *dvb,
+ "DVB: registering adapter %i frontend %i (%s)...\n",
+ fe->dvb->num, fe->id, fe->ops.info.name);
+
+- dvb_register_device(fe->dvb, &fepriv->dvbdev, &dvbdev_template,
++ ret = dvb_register_device(fe->dvb, &fepriv->dvbdev, &dvbdev_template,
+ fe, DVB_DEVICE_FRONTEND, 0);
++ if (ret) {
++ dvb_frontend_put(fe);
++ mutex_unlock(&frontend_mutex);
++ return ret;
++ }
+
+ /*
+ * Initialize the cache to the proper values according with the
+diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
+index d8f19a4d214aa..e103999711fc3 100644
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -107,7 +107,7 @@ static int dvb_device_open(struct inode *inode, struct file *file)
+ new_fops = fops_get(dvbdev->fops);
+ if (!new_fops)
+ goto fail;
+- file->private_data = dvbdev;
++ file->private_data = dvb_device_get(dvbdev);
+ replace_fops(file, new_fops);
+ if (file->f_op->open)
+ err = file->f_op->open(inode, file);
+@@ -171,6 +171,9 @@ int dvb_generic_release(struct inode *inode, struct file *file)
+ }
+
+ dvbdev->users++;
++
++ dvb_device_put(dvbdev);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(dvb_generic_release);
+@@ -342,6 +345,7 @@ static int dvb_create_media_entity(struct dvb_device *dvbdev,
+ GFP_KERNEL);
+ if (!dvbdev->pads) {
+ kfree(dvbdev->entity);
++ dvbdev->entity = NULL;
+ return -ENOMEM;
+ }
+ }
+@@ -488,6 +492,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ }
+
+ memcpy(dvbdev, template, sizeof(struct dvb_device));
++ kref_init(&dvbdev->ref);
+ dvbdev->type = type;
+ dvbdev->id = id;
+ dvbdev->adapter = adap;
+@@ -518,7 +523,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ #endif
+
+ dvbdev->minor = minor;
+- dvb_minors[minor] = dvbdev;
++ dvb_minors[minor] = dvb_device_get(dvbdev);
+ up_write(&minor_rwsem);
+
+ ret = dvb_register_media_device(dvbdev, type, minor, demux_sink_pads);
+@@ -559,6 +564,7 @@ void dvb_remove_device(struct dvb_device *dvbdev)
+
+ down_write(&minor_rwsem);
+ dvb_minors[dvbdev->minor] = NULL;
++ dvb_device_put(dvbdev);
+ up_write(&minor_rwsem);
+
+ dvb_media_device_free(dvbdev);
+@@ -570,21 +576,34 @@ void dvb_remove_device(struct dvb_device *dvbdev)
+ EXPORT_SYMBOL(dvb_remove_device);
+
+
+-void dvb_free_device(struct dvb_device *dvbdev)
++static void dvb_free_device(struct kref *ref)
+ {
+- if (!dvbdev)
+- return;
++ struct dvb_device *dvbdev = container_of(ref, struct dvb_device, ref);
+
+ kfree (dvbdev->fops);
+ kfree (dvbdev);
+ }
+-EXPORT_SYMBOL(dvb_free_device);
++
++
++struct dvb_device *dvb_device_get(struct dvb_device *dvbdev)
++{
++ kref_get(&dvbdev->ref);
++ return dvbdev;
++}
++EXPORT_SYMBOL(dvb_device_get);
++
++
++void dvb_device_put(struct dvb_device *dvbdev)
++{
++ if (dvbdev)
++ kref_put(&dvbdev->ref, dvb_free_device);
++}
+
+
+ void dvb_unregister_device(struct dvb_device *dvbdev)
+ {
+ dvb_remove_device(dvbdev);
+- dvb_free_device(dvbdev);
++ dvb_device_put(dvbdev);
+ }
+ EXPORT_SYMBOL(dvb_unregister_device);
+
+diff --git a/drivers/media/dvb-frontends/bcm3510.c b/drivers/media/dvb-frontends/bcm3510.c
+index e92542b92d349..6457b0912d14d 100644
+--- a/drivers/media/dvb-frontends/bcm3510.c
++++ b/drivers/media/dvb-frontends/bcm3510.c
+@@ -649,6 +649,7 @@ static int bcm3510_download_firmware(struct dvb_frontend* fe)
+ deb_info("firmware chunk, addr: 0x%04x, len: 0x%04x, total length: 0x%04zx\n",addr,len,fw->size);
+ if ((ret = bcm3510_write_ram(st,addr,&b[i+4],len)) < 0) {
+ err("firmware download failed: %d\n",ret);
++ release_firmware(fw);
+ return ret;
+ }
+ i += 4 + len;
+diff --git a/drivers/media/dvb-frontends/stv0288.c b/drivers/media/dvb-frontends/stv0288.c
+index c9a9fa4e2c1b2..ca5d8e41c114f 100644
+--- a/drivers/media/dvb-frontends/stv0288.c
++++ b/drivers/media/dvb-frontends/stv0288.c
+@@ -452,9 +452,8 @@ static int stv0288_set_frontend(struct dvb_frontend *fe)
+ struct stv0288_state *state = fe->demodulator_priv;
+ struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+
+- char tm;
+- unsigned char tda[3];
+- u8 reg, time_out = 0;
++ u8 tda[3], reg, time_out = 0;
++ s8 tm;
+
+ dprintk("%s : FE_SET_FRONTEND\n", __func__);
+
+diff --git a/drivers/media/i2c/ad5820.c b/drivers/media/i2c/ad5820.c
+index 034ebf7540070..c2a6d1d5217a0 100644
+--- a/drivers/media/i2c/ad5820.c
++++ b/drivers/media/i2c/ad5820.c
+@@ -321,18 +321,18 @@ static int ad5820_probe(struct i2c_client *client,
+
+ ret = media_entity_pads_init(&coil->subdev.entity, 0, NULL);
+ if (ret < 0)
+- goto cleanup2;
++ goto clean_mutex;
+
+ ret = v4l2_async_register_subdev(&coil->subdev);
+ if (ret < 0)
+- goto cleanup;
++ goto clean_entity;
+
+ return ret;
+
+-cleanup2:
+- mutex_destroy(&coil->power_lock);
+-cleanup:
++clean_entity:
+ media_entity_cleanup(&coil->subdev.entity);
++clean_mutex:
++ mutex_destroy(&coil->power_lock);
+ return ret;
+ }
+
+diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
+index 5102519df1083..dba9071e8507f 100644
+--- a/drivers/media/pci/saa7164/saa7164-core.c
++++ b/drivers/media/pci/saa7164/saa7164-core.c
+@@ -1237,7 +1237,7 @@ static int saa7164_initdev(struct pci_dev *pci_dev,
+
+ if (saa7164_dev_setup(dev) < 0) {
+ err = -EINVAL;
+- goto fail_free;
++ goto fail_dev;
+ }
+
+ /* print pci info */
+@@ -1405,6 +1405,8 @@ fail_fw:
+
+ fail_irq:
+ saa7164_dev_unregister(dev);
++fail_dev:
++ pci_disable_device(pci_dev);
+ fail_free:
+ v4l2_device_unregister(&dev->v4l2_dev);
+ kfree(dev);
+diff --git a/drivers/media/pci/solo6x10/solo6x10-core.c b/drivers/media/pci/solo6x10/solo6x10-core.c
+index 19ffd2ed3cc7b..d3bca099b78bb 100644
+--- a/drivers/media/pci/solo6x10/solo6x10-core.c
++++ b/drivers/media/pci/solo6x10/solo6x10-core.c
+@@ -429,6 +429,7 @@ static int solo_sysfs_init(struct solo_dev *solo_dev)
+ solo_dev->nr_chans);
+
+ if (device_register(dev)) {
++ put_device(dev);
+ dev->parent = NULL;
+ return -ENOMEM;
+ }
+diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
+index c3eaddced7214..e73bf8e14f331 100644
+--- a/drivers/media/platform/coda/coda-bit.c
++++ b/drivers/media/platform/coda/coda-bit.c
+@@ -670,7 +670,7 @@ static void coda_setup_iram(struct coda_ctx *ctx)
+ /* Only H.264BP and H.263P3 are considered */
+ iram_info->buf_dbk_y_use = coda_iram_alloc(iram_info, w64);
+ iram_info->buf_dbk_c_use = coda_iram_alloc(iram_info, w64);
+- if (!iram_info->buf_dbk_c_use)
++ if (!iram_info->buf_dbk_y_use || !iram_info->buf_dbk_c_use)
+ goto out;
+ iram_info->axi_sram_use |= dbk_bits;
+
+@@ -694,7 +694,7 @@ static void coda_setup_iram(struct coda_ctx *ctx)
+
+ iram_info->buf_dbk_y_use = coda_iram_alloc(iram_info, w128);
+ iram_info->buf_dbk_c_use = coda_iram_alloc(iram_info, w128);
+- if (!iram_info->buf_dbk_c_use)
++ if (!iram_info->buf_dbk_y_use || !iram_info->buf_dbk_c_use)
+ goto out;
+ iram_info->axi_sram_use |= dbk_bits;
+
+@@ -901,10 +901,16 @@ static int coda_start_encoding(struct coda_ctx *ctx)
+ }
+
+ if (dst_fourcc == V4L2_PIX_FMT_JPEG) {
+- if (!ctx->params.jpeg_qmat_tab[0])
++ if (!ctx->params.jpeg_qmat_tab[0]) {
+ ctx->params.jpeg_qmat_tab[0] = kmalloc(64, GFP_KERNEL);
+- if (!ctx->params.jpeg_qmat_tab[1])
++ if (!ctx->params.jpeg_qmat_tab[0])
++ return -ENOMEM;
++ }
++ if (!ctx->params.jpeg_qmat_tab[1]) {
+ ctx->params.jpeg_qmat_tab[1] = kmalloc(64, GFP_KERNEL);
++ if (!ctx->params.jpeg_qmat_tab[1])
++ return -ENOMEM;
++ }
+ coda_set_jpeg_compression_quality(ctx, ctx->params.jpeg_quality);
+ }
+
+diff --git a/drivers/media/platform/exynos4-is/fimc-core.c b/drivers/media/platform/exynos4-is/fimc-core.c
+index d8d8c9902b19f..cc8bc41b7db74 100644
+--- a/drivers/media/platform/exynos4-is/fimc-core.c
++++ b/drivers/media/platform/exynos4-is/fimc-core.c
+@@ -1255,7 +1255,7 @@ int __init fimc_register_driver(void)
+ return platform_driver_register(&fimc_driver);
+ }
+
+-void __exit fimc_unregister_driver(void)
++void fimc_unregister_driver(void)
+ {
+ platform_driver_unregister(&fimc_driver);
+ }
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index 3261dc72cc614..03171f2cf2968 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -1566,7 +1566,11 @@ static int __init fimc_md_init(void)
+ if (ret)
+ return ret;
+
+- return platform_driver_register(&fimc_md_driver);
++ ret = platform_driver_register(&fimc_md_driver);
++ if (ret)
++ fimc_unregister_driver();
++
++ return ret;
+ }
+
+ static void __exit fimc_md_exit(void)
+diff --git a/drivers/media/platform/qcom/camss/camss-video.c b/drivers/media/platform/qcom/camss/camss-video.c
+index e81ebeb0506e4..23701ec8d7de7 100644
+--- a/drivers/media/platform/qcom/camss/camss-video.c
++++ b/drivers/media/platform/qcom/camss/camss-video.c
+@@ -438,7 +438,7 @@ static int video_start_streaming(struct vb2_queue *q, unsigned int count)
+
+ ret = media_pipeline_start(&vdev->entity, &video->pipe);
+ if (ret < 0)
+- return ret;
++ goto flush_buffers;
+
+ ret = video_check_format(video);
+ if (ret < 0)
+@@ -467,6 +467,7 @@ static int video_start_streaming(struct vb2_queue *q, unsigned int count)
+ error:
+ media_pipeline_stop(&vdev->entity);
+
++flush_buffers:
+ video->ops->flush_buffers(video, VB2_BUF_STATE_QUEUED);
+
+ return ret;
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+index 0fc101bc58d67..684aa8491a389 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+@@ -1574,8 +1574,18 @@ static struct s5p_mfc_variant mfc_drvdata_v7 = {
+ .port_num = MFC_NUM_PORTS_V7,
+ .buf_size = &buf_size_v7,
+ .fw_name[0] = "s5p-mfc-v7.fw",
+- .clk_names = {"mfc", "sclk_mfc"},
+- .num_clocks = 2,
++ .clk_names = {"mfc"},
++ .num_clocks = 1,
++};
++
++static struct s5p_mfc_variant mfc_drvdata_v7_3250 = {
++ .version = MFC_VERSION_V7,
++ .version_bit = MFC_V7_BIT,
++ .port_num = MFC_NUM_PORTS_V7,
++ .buf_size = &buf_size_v7,
++ .fw_name[0] = "s5p-mfc-v7.fw",
++ .clk_names = {"mfc", "sclk_mfc"},
++ .num_clocks = 2,
+ };
+
+ static struct s5p_mfc_buf_size_v6 mfc_buf_size_v8 = {
+@@ -1645,6 +1655,9 @@ static const struct of_device_id exynos_mfc_match[] = {
+ }, {
+ .compatible = "samsung,mfc-v7",
+ .data = &mfc_drvdata_v7,
++ }, {
++ .compatible = "samsung,exynos3250-mfc",
++ .data = &mfc_drvdata_v7_3250,
+ }, {
+ .compatible = "samsung,mfc-v8",
+ .data = &mfc_drvdata_v8,
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
+index ee7b15b335e08..31bbf1cc53886 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
+@@ -472,8 +472,10 @@ void s5p_mfc_close_mfc_inst(struct s5p_mfc_dev *dev, struct s5p_mfc_ctx *ctx)
+ s5p_mfc_hw_call(dev->mfc_ops, try_run, dev);
+ /* Wait until instance is returned or timeout occurred */
+ if (s5p_mfc_wait_for_done_ctx(ctx,
+- S5P_MFC_R2H_CMD_CLOSE_INSTANCE_RET, 0))
++ S5P_MFC_R2H_CMD_CLOSE_INSTANCE_RET, 0)){
++ clear_work_bit_irqsave(ctx);
+ mfc_err("Err returning instance\n");
++ }
+
+ /* Free resources */
+ s5p_mfc_hw_call(dev->mfc_ops, release_codec_buffers, ctx);
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
+index 3ad4f5073002c..cc8d101eb2b06 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
+@@ -1224,6 +1224,7 @@ static int enc_post_frame_start(struct s5p_mfc_ctx *ctx)
+ unsigned long mb_y_addr, mb_c_addr;
+ int slice_type;
+ unsigned int strm_size;
++ bool src_ready;
+
+ slice_type = s5p_mfc_hw_call(dev->mfc_ops, get_enc_slice_type, dev);
+ strm_size = s5p_mfc_hw_call(dev->mfc_ops, get_enc_strm_size, dev);
+@@ -1263,7 +1264,8 @@ static int enc_post_frame_start(struct s5p_mfc_ctx *ctx)
+ }
+ }
+ }
+- if ((ctx->src_queue_cnt > 0) && (ctx->state == MFCINST_RUNNING)) {
++ if (ctx->src_queue_cnt > 0 && (ctx->state == MFCINST_RUNNING ||
++ ctx->state == MFCINST_FINISHING)) {
+ mb_entry = list_entry(ctx->src_queue.next, struct s5p_mfc_buf,
+ list);
+ if (mb_entry->flags & MFC_BUF_FLAG_USED) {
+@@ -1294,7 +1296,13 @@ static int enc_post_frame_start(struct s5p_mfc_ctx *ctx)
+ vb2_set_plane_payload(&mb_entry->b->vb2_buf, 0, strm_size);
+ vb2_buffer_done(&mb_entry->b->vb2_buf, VB2_BUF_STATE_DONE);
+ }
+- if ((ctx->src_queue_cnt == 0) || (ctx->dst_queue_cnt == 0))
++
++ src_ready = true;
++ if (ctx->state == MFCINST_RUNNING && ctx->src_queue_cnt == 0)
++ src_ready = false;
++ if (ctx->state == MFCINST_FINISHING && ctx->ref_queue_cnt == 0)
++ src_ready = false;
++ if (!src_ready || ctx->dst_queue_cnt == 0)
+ clear_work_bit(ctx);
+
+ return 0;
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
+index 7c629be432052..1171b76df036d 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
+@@ -1063,7 +1063,7 @@ static int s5p_mfc_set_enc_params_h264(struct s5p_mfc_ctx *ctx)
+ }
+
+ /* aspect ratio VUI */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 5);
+ reg |= ((p_h264->vui_sar & 0x1) << 5);
+ writel(reg, mfc_regs->e_h264_options);
+@@ -1086,7 +1086,7 @@ static int s5p_mfc_set_enc_params_h264(struct s5p_mfc_ctx *ctx)
+
+ /* intra picture period for H.264 open GOP */
+ /* control */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 4);
+ reg |= ((p_h264->open_gop & 0x1) << 4);
+ writel(reg, mfc_regs->e_h264_options);
+@@ -1100,23 +1100,23 @@ static int s5p_mfc_set_enc_params_h264(struct s5p_mfc_ctx *ctx)
+ }
+
+ /* 'WEIGHTED_BI_PREDICTION' for B is disable */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x3 << 9);
+ writel(reg, mfc_regs->e_h264_options);
+
+ /* 'CONSTRAINED_INTRA_PRED_ENABLE' is disable */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 14);
+ writel(reg, mfc_regs->e_h264_options);
+
+ /* ASO */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 6);
+ reg |= ((p_h264->aso & 0x1) << 6);
+ writel(reg, mfc_regs->e_h264_options);
+
+ /* hier qp enable */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 8);
+ reg |= ((p_h264->open_gop & 0x1) << 8);
+ writel(reg, mfc_regs->e_h264_options);
+@@ -1137,7 +1137,7 @@ static int s5p_mfc_set_enc_params_h264(struct s5p_mfc_ctx *ctx)
+ writel(reg, mfc_regs->e_h264_num_t_layer);
+
+ /* frame packing SEI generation */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 25);
+ reg |= ((p_h264->sei_frame_packing & 0x1) << 25);
+ writel(reg, mfc_regs->e_h264_options);
+diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
+index 3c05b3dc49ec0..98c14565bbfd1 100644
+--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
++++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
+@@ -943,6 +943,7 @@ static int configure_channels(struct c8sectpfei *fei)
+ if (ret) {
+ dev_err(fei->dev,
+ "configure_memdma_and_inputblock failed\n");
++ of_node_put(child);
+ goto err_unmap;
+ }
+ index++;
+diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
+index 48f2c9c96fc92..ded48b7ad7744 100644
+--- a/drivers/media/platform/vivid/vivid-vid-cap.c
++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
+@@ -923,6 +923,7 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection
+ if (dev->has_compose_cap) {
+ v4l2_rect_set_min_size(compose, &min_rect);
+ v4l2_rect_set_max_size(compose, &max_rect);
++ v4l2_rect_map_inside(compose, &fmt);
+ }
+ dev->fmt_cap_rect = fmt;
+ tpg_s_buf_height(&dev->tpg, fmt.height);
+diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c
+index ba43a727c0b95..51b961cfba7cb 100644
+--- a/drivers/media/radio/si470x/radio-si470x-usb.c
++++ b/drivers/media/radio/si470x/radio-si470x-usb.c
+@@ -742,8 +742,10 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
+
+ /* start radio */
+ retval = si470x_start_usb(radio);
+- if (retval < 0)
++ if (retval < 0 && !radio->int_in_running)
+ goto err_buf;
++ else if (retval < 0) /* in case of radio->int_in_running == 1 */
++ goto err_all;
+
+ /* set initial frequency */
+ si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index 6b10363fb6f09..99bb7380ee0e5 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -613,15 +613,14 @@ static int send_packet(struct imon_context *ictx)
+ pr_err_ratelimited("error submitting urb(%d)\n", retval);
+ } else {
+ /* Wait for transmission to complete (or abort) */
+- mutex_unlock(&ictx->lock);
+ retval = wait_for_completion_interruptible(
+ &ictx->tx.finished);
+ if (retval) {
+ usb_kill_urb(ictx->tx_urb);
+ pr_err_ratelimited("task interrupted\n");
+ }
+- mutex_lock(&ictx->lock);
+
++ ictx->tx.busy = false;
+ retval = ictx->tx.status;
+ if (retval)
+ pr_err_ratelimited("packet tx failed (%d)\n", retval);
+@@ -928,7 +927,8 @@ static ssize_t vfd_write(struct file *file, const char __user *buf,
+ return -ENODEV;
+ }
+
+- mutex_lock(&ictx->lock);
++ if (mutex_lock_interruptible(&ictx->lock))
++ return -ERESTARTSYS;
+
+ if (!ictx->dev_present_intf0) {
+ pr_err_ratelimited("no iMON device present\n");
+diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c
+index 990719727dc37..7d71ac7811ebd 100644
+--- a/drivers/media/usb/dvb-usb/az6027.c
++++ b/drivers/media/usb/dvb-usb/az6027.c
+@@ -978,6 +978,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
+ if (msg[i].addr == 0x99) {
+ req = 0xBE;
+ index = 0;
++ if (msg[i].len < 1) {
++ i = -EOPNOTSUPP;
++ break;
++ }
+ value = msg[i].buf[0] & 0x00ff;
+ length = 1;
+ az6027_usb_out_op(d, req, value, index, data, length);
+diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
+index 4b1445d806e5b..16be32b19ca17 100644
+--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
+@@ -84,7 +84,7 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs)
+
+ ret = dvb_usb_adapter_stream_init(adap);
+ if (ret)
+- return ret;
++ goto stream_init_err;
+
+ ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs);
+ if (ret)
+@@ -117,6 +117,8 @@ frontend_init_err:
+ dvb_usb_adapter_dvb_exit(adap);
+ dvb_init_err:
+ dvb_usb_adapter_stream_exit(adap);
++stream_init_err:
++ kfree(adap->priv);
+ return ret;
+ }
+
+diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c
+index 08f4a512afad2..3153cf1651a22 100644
+--- a/drivers/misc/cxl/guest.c
++++ b/drivers/misc/cxl/guest.c
+@@ -963,10 +963,10 @@ int cxl_guest_init_afu(struct cxl *adapter, int slice, struct device_node *afu_n
+ * if it returns an error!
+ */
+ if ((rc = cxl_register_afu(afu)))
+- goto err_put1;
++ goto err_put_dev;
+
+ if ((rc = cxl_sysfs_afu_add(afu)))
+- goto err_put1;
++ goto err_del_dev;
+
+ /*
+ * pHyp doesn't expose the programming models supported by the
+@@ -982,7 +982,7 @@ int cxl_guest_init_afu(struct cxl *adapter, int slice, struct device_node *afu_n
+ afu->modes_supported = CXL_MODE_DIRECTED;
+
+ if ((rc = cxl_afu_select_best_mode(afu)))
+- goto err_put2;
++ goto err_remove_sysfs;
+
+ adapter->afu[afu->slice] = afu;
+
+@@ -1002,10 +1002,12 @@ int cxl_guest_init_afu(struct cxl *adapter, int slice, struct device_node *afu_n
+
+ return 0;
+
+-err_put2:
++err_remove_sysfs:
+ cxl_sysfs_afu_remove(afu);
+-err_put1:
+- device_unregister(&afu->dev);
++err_del_dev:
++ device_del(&afu->dev);
++err_put_dev:
++ put_device(&afu->dev);
+ free = false;
+ guest_release_serr_irq(afu);
+ err2:
+@@ -1139,18 +1141,20 @@ struct cxl *cxl_guest_init_adapter(struct device_node *np, struct platform_devic
+ * even if it returns an error!
+ */
+ if ((rc = cxl_register_adapter(adapter)))
+- goto err_put1;
++ goto err_put_dev;
+
+ if ((rc = cxl_sysfs_adapter_add(adapter)))
+- goto err_put1;
++ goto err_del_dev;
+
+ /* release the context lock as the adapter is configured */
+ cxl_adapter_context_unlock(adapter);
+
+ return adapter;
+
+-err_put1:
+- device_unregister(&adapter->dev);
++err_del_dev:
++ device_del(&adapter->dev);
++err_put_dev:
++ put_device(&adapter->dev);
+ free = false;
+ cxl_guest_remove_chardev(adapter);
+ err1:
+diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
+index b9d3c87e9318d..8dbb1998c3124 100644
+--- a/drivers/misc/cxl/pci.c
++++ b/drivers/misc/cxl/pci.c
+@@ -391,6 +391,7 @@ int cxl_calc_capp_routing(struct pci_dev *dev, u64 *chipid,
+ rc = get_phb_index(np, phb_index);
+ if (rc) {
+ pr_err("cxl: invalid phb index\n");
++ of_node_put(np);
+ return rc;
+ }
+
+@@ -1168,10 +1169,10 @@ static int pci_init_afu(struct cxl *adapter, int slice, struct pci_dev *dev)
+ * if it returns an error!
+ */
+ if ((rc = cxl_register_afu(afu)))
+- goto err_put1;
++ goto err_put_dev;
+
+ if ((rc = cxl_sysfs_afu_add(afu)))
+- goto err_put1;
++ goto err_del_dev;
+
+ adapter->afu[afu->slice] = afu;
+
+@@ -1180,10 +1181,12 @@ static int pci_init_afu(struct cxl *adapter, int slice, struct pci_dev *dev)
+
+ return 0;
+
+-err_put1:
++err_del_dev:
++ device_del(&afu->dev);
++err_put_dev:
+ pci_deconfigure_afu(afu);
+ cxl_debugfs_afu_remove(afu);
+- device_unregister(&afu->dev);
++ put_device(&afu->dev);
+ return rc;
+
+ err_free_native:
+@@ -1671,23 +1674,25 @@ static struct cxl *cxl_pci_init_adapter(struct pci_dev *dev)
+ * even if it returns an error!
+ */
+ if ((rc = cxl_register_adapter(adapter)))
+- goto err_put1;
++ goto err_put_dev;
+
+ if ((rc = cxl_sysfs_adapter_add(adapter)))
+- goto err_put1;
++ goto err_del_dev;
+
+ /* Release the context lock as adapter is configured */
+ cxl_adapter_context_unlock(adapter);
+
+ return adapter;
+
+-err_put1:
++err_del_dev:
++ device_del(&adapter->dev);
++err_put_dev:
+ /* This should mirror cxl_remove_adapter, except without the
+ * sysfs parts
+ */
+ cxl_debugfs_adapter_remove(adapter);
+ cxl_deconfigure_adapter(adapter);
+- device_unregister(&adapter->dev);
++ put_device(&adapter->dev);
+ return ERR_PTR(rc);
+
+ err_release:
+diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
+index 93be82fc338ad..16df731e63c56 100644
+--- a/drivers/misc/sgi-gru/grufault.c
++++ b/drivers/misc/sgi-gru/grufault.c
+@@ -661,6 +661,7 @@ int gru_handle_user_call_os(unsigned long cb)
+ if ((cb & (GRU_HANDLE_STRIDE - 1)) || ucbnum >= GRU_NUM_CB)
+ return -EINVAL;
+
++again:
+ gts = gru_find_lock_gts(cb);
+ if (!gts)
+ return -EINVAL;
+@@ -669,7 +670,11 @@ int gru_handle_user_call_os(unsigned long cb)
+ if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)
+ goto exit;
+
+- gru_check_context_placement(gts);
++ if (gru_check_context_placement(gts)) {
++ gru_unlock_gts(gts);
++ gru_unload_context(gts, 1);
++ goto again;
++ }
+
+ /*
+ * CCH may contain stale data if ts_force_cch_reload is set.
+@@ -887,7 +892,11 @@ int gru_set_context_option(unsigned long arg)
+ } else {
+ gts->ts_user_blade_id = req.val1;
+ gts->ts_user_chiplet_id = req.val0;
+- gru_check_context_placement(gts);
++ if (gru_check_context_placement(gts)) {
++ gru_unlock_gts(gts);
++ gru_unload_context(gts, 1);
++ return ret;
++ }
+ }
+ break;
+ case sco_gseg_owner:
+diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c
+index ab174f28e3bef..8c3e0317c115b 100644
+--- a/drivers/misc/sgi-gru/grumain.c
++++ b/drivers/misc/sgi-gru/grumain.c
+@@ -729,9 +729,10 @@ static int gru_check_chiplet_assignment(struct gru_state *gru,
+ * chiplet. Misassignment can occur if the process migrates to a different
+ * blade or if the user changes the selected blade/chiplet.
+ */
+-void gru_check_context_placement(struct gru_thread_state *gts)
++int gru_check_context_placement(struct gru_thread_state *gts)
+ {
+ struct gru_state *gru;
++ int ret = 0;
+
+ /*
+ * If the current task is the context owner, verify that the
+@@ -739,15 +740,23 @@ void gru_check_context_placement(struct gru_thread_state *gts)
+ * references. Pthread apps use non-owner references to the CBRs.
+ */
+ gru = gts->ts_gru;
++ /*
++ * If gru or gts->ts_tgid_owner isn't initialized properly, return
++ * success to indicate that the caller does not need to unload the
++ * gru context.The caller is responsible for their inspection and
++ * reinitialization if needed.
++ */
+ if (!gru || gts->ts_tgid_owner != current->tgid)
+- return;
++ return ret;
+
+ if (!gru_check_chiplet_assignment(gru, gts)) {
+ STAT(check_context_unload);
+- gru_unload_context(gts, 1);
++ ret = -EINVAL;
+ } else if (gru_retarget_intr(gts)) {
+ STAT(check_context_retarget_intr);
+ }
++
++ return ret;
+ }
+
+
+@@ -947,7 +956,12 @@ again:
+ mutex_lock(>s->ts_ctxlock);
+ preempt_disable();
+
+- gru_check_context_placement(gts);
++ if (gru_check_context_placement(gts)) {
++ preempt_enable();
++ mutex_unlock(>s->ts_ctxlock);
++ gru_unload_context(gts, 1);
++ return VM_FAULT_NOPAGE;
++ }
+
+ if (!gts->ts_gru) {
+ STAT(load_user_context);
+diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
+index 3e041b6f7a683..2becf4c3f7cab 100644
+--- a/drivers/misc/sgi-gru/grutables.h
++++ b/drivers/misc/sgi-gru/grutables.h
+@@ -652,7 +652,7 @@ extern int gru_user_flush_tlb(unsigned long arg);
+ extern int gru_user_unload_context(unsigned long arg);
+ extern int gru_get_exception_detail(unsigned long arg);
+ extern int gru_set_context_option(unsigned long address);
+-extern void gru_check_context_placement(struct gru_thread_state *gts);
++extern int gru_check_context_placement(struct gru_thread_state *gts);
+ extern int gru_cpu_fault_map_id(void);
+ extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);
+ extern void gru_flush_all_tlb(struct gru_state *gru);
+diff --git a/drivers/misc/tifm_7xx1.c b/drivers/misc/tifm_7xx1.c
+index 9ac95b48ef924..1d33c4facd445 100644
+--- a/drivers/misc/tifm_7xx1.c
++++ b/drivers/misc/tifm_7xx1.c
+@@ -194,7 +194,7 @@ static void tifm_7xx1_switch_media(struct work_struct *work)
+ spin_unlock_irqrestore(&fm->lock, flags);
+ }
+ if (sock)
+- tifm_free_device(&sock->dev);
++ put_device(&sock->dev);
+ }
+ spin_lock_irqsave(&fm->lock, flags);
+ }
+diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
+index fbc56ee996827..d40bab3d9f4af 100644
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -2262,6 +2262,7 @@ static int atmci_init_slot(struct atmel_mci *host,
+ {
+ struct mmc_host *mmc;
+ struct atmel_mci_slot *slot;
++ int ret;
+
+ mmc = mmc_alloc_host(sizeof(struct atmel_mci_slot), &host->pdev->dev);
+ if (!mmc)
+@@ -2342,11 +2343,13 @@ static int atmci_init_slot(struct atmel_mci *host,
+
+ host->slot[id] = slot;
+ mmc_regulator_get_supply(mmc);
+- mmc_add_host(mmc);
++ ret = mmc_add_host(mmc);
++ if (ret) {
++ mmc_free_host(mmc);
++ return ret;
++ }
+
+ if (gpio_is_valid(slot->detect_pin)) {
+- int ret;
+-
+ timer_setup(&slot->detect_timer, atmci_detect_change, 0);
+
+ ret = request_irq(gpio_to_irq(slot->detect_pin),
+diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
+index 72f34a58928ca..dba98c2886f26 100644
+--- a/drivers/mmc/host/meson-gx-mmc.c
++++ b/drivers/mmc/host/meson-gx-mmc.c
+@@ -1370,7 +1370,9 @@ static int meson_mmc_probe(struct platform_device *pdev)
+ }
+
+ mmc->ops = &meson_mmc_ops;
+- mmc_add_host(mmc);
++ ret = mmc_add_host(mmc);
++ if (ret)
++ goto err_free_irq;
+
+ return 0;
+
+diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
+index fa6268c0f1232..434ba4a39ded7 100644
+--- a/drivers/mmc/host/mmci.c
++++ b/drivers/mmc/host/mmci.c
+@@ -1808,7 +1808,9 @@ static int mmci_probe(struct amba_device *dev,
+ pm_runtime_set_autosuspend_delay(&dev->dev, 50);
+ pm_runtime_use_autosuspend(&dev->dev);
+
+- mmc_add_host(mmc);
++ ret = mmc_add_host(mmc);
++ if (ret)
++ goto clk_disable;
+
+ pm_runtime_put(&dev->dev);
+ return 0;
+diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
+index 1552d1f09c5c4..52307dce08ba8 100644
+--- a/drivers/mmc/host/moxart-mmc.c
++++ b/drivers/mmc/host/moxart-mmc.c
+@@ -660,7 +660,9 @@ static int moxart_probe(struct platform_device *pdev)
+ goto out;
+
+ dev_set_drvdata(dev, mmc);
+- mmc_add_host(mmc);
++ ret = mmc_add_host(mmc);
++ if (ret)
++ goto out;
+
+ dev_dbg(dev, "IRQ=%d, FIFO is %d bytes\n", irq, host->fifo_width);
+
+diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
+index 2f604b312767d..6215feb976e32 100644
+--- a/drivers/mmc/host/mxcmmc.c
++++ b/drivers/mmc/host/mxcmmc.c
+@@ -1167,7 +1167,9 @@ static int mxcmci_probe(struct platform_device *pdev)
+
+ timer_setup(&host->watchdog, mxcmci_watchdog, 0);
+
+- mmc_add_host(mmc);
++ ret = mmc_add_host(mmc);
++ if (ret)
++ goto out_free_dma;
+
+ return 0;
+
+diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c
+index 9a3ff22dd0fe2..1e5f54054a531 100644
+--- a/drivers/mmc/host/rtsx_usb_sdmmc.c
++++ b/drivers/mmc/host/rtsx_usb_sdmmc.c
+@@ -1344,6 +1344,7 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev)
+ #ifdef RTSX_USB_USE_LEDS_CLASS
+ int err;
+ #endif
++ int ret;
+
+ ucr = usb_get_intfdata(to_usb_interface(pdev->dev.parent));
+ if (!ucr)
+@@ -1382,7 +1383,15 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev)
+ INIT_WORK(&host->led_work, rtsx_usb_update_led);
+
+ #endif
+- mmc_add_host(mmc);
++ ret = mmc_add_host(mmc);
++ if (ret) {
++#ifdef RTSX_USB_USE_LEDS_CLASS
++ led_classdev_unregister(&host->led);
++#endif
++ mmc_free_host(mmc);
++ pm_runtime_disable(&pdev->dev);
++ return ret;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/mmc/host/sdhci_f_sdh30.c b/drivers/mmc/host/sdhci_f_sdh30.c
+index 485f7591fae4f..ca9e05440da1d 100644
+--- a/drivers/mmc/host/sdhci_f_sdh30.c
++++ b/drivers/mmc/host/sdhci_f_sdh30.c
+@@ -199,6 +199,9 @@ static int sdhci_f_sdh30_probe(struct platform_device *pdev)
+ if (reg & SDHCI_CAN_DO_8BIT)
+ priv->vendor_hs200 = F_SDH30_EMMC_HS200;
+
++ if (!(reg & SDHCI_TIMEOUT_CLK_MASK))
++ host->quirks |= SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK;
++
+ ret = sdhci_add_host(host);
+ if (ret)
+ goto err_add_host;
+diff --git a/drivers/mmc/host/toshsd.c b/drivers/mmc/host/toshsd.c
+index dd961c54a6a9a..9236965b00fd9 100644
+--- a/drivers/mmc/host/toshsd.c
++++ b/drivers/mmc/host/toshsd.c
+@@ -655,7 +655,9 @@ static int toshsd_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (ret)
+ goto unmap;
+
+- mmc_add_host(mmc);
++ ret = mmc_add_host(mmc);
++ if (ret)
++ goto free_irq;
+
+ base = pci_resource_start(pdev, 0);
+ dev_dbg(&pdev->dev, "MMIO %pa, IRQ %d\n", &base, pdev->irq);
+@@ -664,6 +666,8 @@ static int toshsd_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ return 0;
+
++free_irq:
++ free_irq(pdev->irq, host);
+ unmap:
+ pci_iounmap(pdev, host->ioaddr);
+ release:
+diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c
+index 1b66466d2ed45..b78e96b5289b2 100644
+--- a/drivers/mmc/host/via-sdmmc.c
++++ b/drivers/mmc/host/via-sdmmc.c
+@@ -1166,7 +1166,9 @@ static int via_sd_probe(struct pci_dev *pcidev,
+ pcidev->subsystem_device == 0x3891)
+ sdhost->quirks = VIA_CRDR_QUIRK_300MS_PWRDELAY;
+
+- mmc_add_host(mmc);
++ ret = mmc_add_host(mmc);
++ if (ret)
++ goto unmap;
+
+ return 0;
+
+diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
+index aa8905753be33..e74ab79c99cd9 100644
+--- a/drivers/mmc/host/vub300.c
++++ b/drivers/mmc/host/vub300.c
+@@ -2052,6 +2052,7 @@ static void vub300_enable_sdio_irq(struct mmc_host *mmc, int enable)
+ return;
+ kref_get(&vub300->kref);
+ if (enable) {
++ set_current_state(TASK_RUNNING);
+ mutex_lock(&vub300->irq_mutex);
+ if (vub300->irqs_queued) {
+ vub300->irqs_queued -= 1;
+@@ -2067,6 +2068,7 @@ static void vub300_enable_sdio_irq(struct mmc_host *mmc, int enable)
+ vub300_queue_poll_work(vub300, 0);
+ }
+ mutex_unlock(&vub300->irq_mutex);
++ set_current_state(TASK_INTERRUPTIBLE);
+ } else {
+ vub300->irq_enabled = 0;
+ }
+@@ -2309,14 +2311,14 @@ static int vub300_probe(struct usb_interface *interface,
+ 0x0000, 0x0000, &vub300->system_port_status,
+ sizeof(vub300->system_port_status), 1000);
+ if (retval < 0) {
+- goto error4;
++ goto error5;
+ } else if (sizeof(vub300->system_port_status) == retval) {
+ vub300->card_present =
+ (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
+ vub300->read_only =
+ (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
+ } else {
+- goto error4;
++ goto error5;
+ }
+ usb_set_intfdata(interface, vub300);
+ INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread);
+@@ -2339,8 +2341,13 @@ static int vub300_probe(struct usb_interface *interface,
+ "USB vub300 remote SDIO host controller[%d]"
+ "connected with no SD/SDIO card inserted\n",
+ interface_to_InterfaceNumber(interface));
+- mmc_add_host(mmc);
++ retval = mmc_add_host(mmc);
++ if (retval)
++ goto error6;
++
+ return 0;
++error6:
++ del_timer_sync(&vub300->inactivity_timer);
+ error5:
+ mmc_free_host(mmc);
+ /*
+diff --git a/drivers/mmc/host/wbsd.c b/drivers/mmc/host/wbsd.c
+index 1e54bbf13d75b..9b15431d961ce 100644
+--- a/drivers/mmc/host/wbsd.c
++++ b/drivers/mmc/host/wbsd.c
+@@ -1706,7 +1706,17 @@ static int wbsd_init(struct device *dev, int base, int irq, int dma,
+ */
+ wbsd_init_device(host);
+
+- mmc_add_host(mmc);
++ ret = mmc_add_host(mmc);
++ if (ret) {
++ if (!pnp)
++ wbsd_chip_poweroff(host);
++
++ wbsd_release_resources(host);
++ wbsd_free_mmc(dev);
++
++ mmc_free_host(mmc);
++ return ret;
++ }
+
+ pr_info("%s: W83L51xD", mmc_hostname(mmc));
+ if (host->chip_id != 0)
+diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c
+index f8b1696846938..a132bc822b5c6 100644
+--- a/drivers/mmc/host/wmt-sdmmc.c
++++ b/drivers/mmc/host/wmt-sdmmc.c
+@@ -863,11 +863,15 @@ static int wmt_mci_probe(struct platform_device *pdev)
+ /* configure the controller to a known 'ready' state */
+ wmt_reset_hardware(mmc);
+
+- mmc_add_host(mmc);
++ ret = mmc_add_host(mmc);
++ if (ret)
++ goto fail7;
+
+ dev_info(&pdev->dev, "WMT SDHC Controller initialized\n");
+
+ return 0;
++fail7:
++ clk_disable_unprepare(priv->clk_sdmmc);
+ fail6:
+ clk_put(priv->clk_sdmmc);
+ fail5_and_a_half:
+diff --git a/drivers/mtd/lpddr/lpddr2_nvm.c b/drivers/mtd/lpddr/lpddr2_nvm.c
+index 90e6cb64db69c..b004d3213a667 100644
+--- a/drivers/mtd/lpddr/lpddr2_nvm.c
++++ b/drivers/mtd/lpddr/lpddr2_nvm.c
+@@ -442,6 +442,8 @@ static int lpddr2_nvm_probe(struct platform_device *pdev)
+
+ /* lpddr2_nvm address range */
+ add_range = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!add_range)
++ return -ENODEV;
+
+ /* Populate map_info data structure */
+ *map = (struct map_info) {
+diff --git a/drivers/mtd/maps/pxa2xx-flash.c b/drivers/mtd/maps/pxa2xx-flash.c
+index 2cde28ed95c99..59d2fe1f46e1e 100644
+--- a/drivers/mtd/maps/pxa2xx-flash.c
++++ b/drivers/mtd/maps/pxa2xx-flash.c
+@@ -69,6 +69,7 @@ static int pxa2xx_flash_probe(struct platform_device *pdev)
+ if (!info->map.virt) {
+ printk(KERN_WARNING "Failed to ioremap %s\n",
+ info->map.name);
++ kfree(info);
+ return -ENOMEM;
+ }
+ info->map.cached =
+@@ -91,6 +92,7 @@ static int pxa2xx_flash_probe(struct platform_device *pdev)
+ iounmap((void *)info->map.virt);
+ if (info->map.cached)
+ iounmap(info->map.cached);
++ kfree(info);
+ return -EIO;
+ }
+ info->mtd->dev.parent = &pdev->dev;
+diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
+index a0b1a7814e2e7..90d9c0e93157f 100644
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -567,8 +567,10 @@ int add_mtd_device(struct mtd_info *mtd)
+ dev_set_drvdata(&mtd->dev, mtd);
+ of_node_get(mtd_get_of_node(mtd));
+ error = device_register(&mtd->dev);
+- if (error)
++ if (error) {
++ put_device(&mtd->dev);
+ goto fail_added;
++ }
+
+ if (!IS_ERR_OR_NULL(dfs_dir_mtd)) {
+ mtd->dbg.dfs_dir = debugfs_create_dir(dev_name(&mtd->dev), dfs_dir_mtd);
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index cab5c1cc9fe99..4e4adacb5c2c1 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2096,10 +2096,10 @@ static int bond_slave_info_query(struct net_device *bond_dev, struct ifslave *in
+ /* called with rcu_read_lock() */
+ static int bond_miimon_inspect(struct bonding *bond)
+ {
++ bool ignore_updelay = false;
+ int link_state, commit = 0;
+ struct list_head *iter;
+ struct slave *slave;
+- bool ignore_updelay;
+
+ ignore_updelay = !rcu_dereference(bond->curr_active_slave);
+
+@@ -3993,6 +3993,29 @@ err:
+ bond_slave_arr_work_rearm(bond, 1);
+ }
+
++static void bond_skip_slave(struct bond_up_slave *slaves,
++ struct slave *skipslave)
++{
++ int idx;
++
++ /* Rare situation where caller has asked to skip a specific
++ * slave but allocation failed (most likely!). BTW this is
++ * only possible when the call is initiated from
++ * __bond_release_one(). In this situation; overwrite the
++ * skipslave entry in the array with the last entry from the
++ * array to avoid a situation where the xmit path may choose
++ * this to-be-skipped slave to send a packet out.
++ */
++ for (idx = 0; slaves && idx < slaves->count; idx++) {
++ if (skipslave == slaves->arr[idx]) {
++ slaves->arr[idx] =
++ slaves->arr[slaves->count - 1];
++ slaves->count--;
++ break;
++ }
++ }
++}
++
+ /* Build the usable slaves array in control path for modes that use xmit-hash
+ * to determine the slave interface -
+ * (a) BOND_MODE_8023AD
+@@ -4063,27 +4086,9 @@ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave)
+ if (old_arr)
+ kfree_rcu(old_arr, rcu);
+ out:
+- if (ret != 0 && skipslave) {
+- int idx;
+-
+- /* Rare situation where caller has asked to skip a specific
+- * slave but allocation failed (most likely!). BTW this is
+- * only possible when the call is initiated from
+- * __bond_release_one(). In this situation; overwrite the
+- * skipslave entry in the array with the last entry from the
+- * array to avoid a situation where the xmit path may choose
+- * this to-be-skipped slave to send a packet out.
+- */
+- old_arr = rtnl_dereference(bond->slave_arr);
+- for (idx = 0; old_arr != NULL && idx < old_arr->count; idx++) {
+- if (skipslave == old_arr->arr[idx]) {
+- old_arr->arr[idx] =
+- old_arr->arr[old_arr->count-1];
+- old_arr->count--;
+- break;
+- }
+- }
+- }
++ if (ret != 0 && skipslave)
++ bond_skip_slave(rtnl_dereference(bond->slave_arr), skipslave);
++
+ return ret;
+ }
+
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
+index 62958f04a2f20..5699531f87873 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h
+@@ -76,6 +76,14 @@ struct kvaser_usb_tx_urb_context {
+ int dlc;
+ };
+
++struct kvaser_usb_busparams {
++ __le32 bitrate;
++ u8 tseg1;
++ u8 tseg2;
++ u8 sjw;
++ u8 nsamples;
++} __packed;
++
+ struct kvaser_usb {
+ struct usb_device *udev;
+ struct usb_interface *intf;
+@@ -104,13 +112,19 @@ struct kvaser_usb_net_priv {
+ struct can_priv can;
+ struct can_berr_counter bec;
+
++ /* subdriver-specific data */
++ void *sub_priv;
++
+ struct kvaser_usb *dev;
+ struct net_device *netdev;
+ int channel;
+
+- struct completion start_comp, stop_comp, flush_comp;
++ struct completion start_comp, stop_comp, flush_comp,
++ get_busparams_comp;
+ struct usb_anchor tx_submitted;
+
++ struct kvaser_usb_busparams busparams_nominal, busparams_data;
++
+ spinlock_t tx_contexts_lock; /* lock for active_tx_contexts */
+ int active_tx_contexts;
+ struct kvaser_usb_tx_urb_context tx_contexts[];
+@@ -120,11 +134,15 @@ struct kvaser_usb_net_priv {
+ * struct kvaser_usb_dev_ops - Device specific functions
+ * @dev_set_mode: used for can.do_set_mode
+ * @dev_set_bittiming: used for can.do_set_bittiming
++ * @dev_get_busparams: readback arbitration busparams
+ * @dev_set_data_bittiming: used for can.do_set_data_bittiming
++ * @dev_get_data_busparams: readback data busparams
+ * @dev_get_berr_counter: used for can.do_get_berr_counter
+ *
+ * @dev_setup_endpoints: setup USB in and out endpoints
+ * @dev_init_card: initialize card
++ * @dev_init_channel: initialize channel
++ * @dev_remove_channel: uninitialize channel
+ * @dev_get_software_info: get software info
+ * @dev_get_software_details: get software details
+ * @dev_get_card_info: get card info
+@@ -140,12 +158,18 @@ struct kvaser_usb_net_priv {
+ */
+ struct kvaser_usb_dev_ops {
+ int (*dev_set_mode)(struct net_device *netdev, enum can_mode mode);
+- int (*dev_set_bittiming)(struct net_device *netdev);
+- int (*dev_set_data_bittiming)(struct net_device *netdev);
++ int (*dev_set_bittiming)(const struct net_device *netdev,
++ const struct kvaser_usb_busparams *busparams);
++ int (*dev_get_busparams)(struct kvaser_usb_net_priv *priv);
++ int (*dev_set_data_bittiming)(const struct net_device *netdev,
++ const struct kvaser_usb_busparams *busparams);
++ int (*dev_get_data_busparams)(struct kvaser_usb_net_priv *priv);
+ int (*dev_get_berr_counter)(const struct net_device *netdev,
+ struct can_berr_counter *bec);
+ int (*dev_setup_endpoints)(struct kvaser_usb *dev);
+ int (*dev_init_card)(struct kvaser_usb *dev);
++ int (*dev_init_channel)(struct kvaser_usb_net_priv *priv);
++ void (*dev_remove_channel)(struct kvaser_usb_net_priv *priv);
+ int (*dev_get_software_info)(struct kvaser_usb *dev);
+ int (*dev_get_software_details)(struct kvaser_usb *dev);
+ int (*dev_get_card_info)(struct kvaser_usb *dev);
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+index 379df22d51231..da449d046905d 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+@@ -416,10 +416,6 @@ static int kvaser_usb_open(struct net_device *netdev)
+ if (err)
+ return err;
+
+- err = kvaser_usb_setup_rx_urbs(dev);
+- if (err)
+- goto error;
+-
+ err = ops->dev_set_opt_mode(priv);
+ if (err)
+ goto error;
+@@ -510,6 +506,93 @@ static int kvaser_usb_close(struct net_device *netdev)
+ return 0;
+ }
+
++static int kvaser_usb_set_bittiming(struct net_device *netdev)
++{
++ struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
++ struct kvaser_usb *dev = priv->dev;
++ const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
++ struct can_bittiming *bt = &priv->can.bittiming;
++
++ struct kvaser_usb_busparams busparams;
++ int tseg1 = bt->prop_seg + bt->phase_seg1;
++ int tseg2 = bt->phase_seg2;
++ int sjw = bt->sjw;
++ int err = -EOPNOTSUPP;
++
++ busparams.bitrate = cpu_to_le32(bt->bitrate);
++ busparams.sjw = (u8)sjw;
++ busparams.tseg1 = (u8)tseg1;
++ busparams.tseg2 = (u8)tseg2;
++ if (priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES)
++ busparams.nsamples = 3;
++ else
++ busparams.nsamples = 1;
++
++ err = ops->dev_set_bittiming(netdev, &busparams);
++ if (err)
++ return err;
++
++ err = kvaser_usb_setup_rx_urbs(priv->dev);
++ if (err)
++ return err;
++
++ err = ops->dev_get_busparams(priv);
++ if (err) {
++ /* Treat EOPNOTSUPP as success */
++ if (err == -EOPNOTSUPP)
++ err = 0;
++ return err;
++ }
++
++ if (memcmp(&busparams, &priv->busparams_nominal,
++ sizeof(priv->busparams_nominal)) != 0)
++ err = -EINVAL;
++
++ return err;
++}
++
++static int kvaser_usb_set_data_bittiming(struct net_device *netdev)
++{
++ struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
++ struct kvaser_usb *dev = priv->dev;
++ const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
++ struct can_bittiming *dbt = &priv->can.data_bittiming;
++
++ struct kvaser_usb_busparams busparams;
++ int tseg1 = dbt->prop_seg + dbt->phase_seg1;
++ int tseg2 = dbt->phase_seg2;
++ int sjw = dbt->sjw;
++ int err;
++
++ if (!ops->dev_set_data_bittiming ||
++ !ops->dev_get_data_busparams)
++ return -EOPNOTSUPP;
++
++ busparams.bitrate = cpu_to_le32(dbt->bitrate);
++ busparams.sjw = (u8)sjw;
++ busparams.tseg1 = (u8)tseg1;
++ busparams.tseg2 = (u8)tseg2;
++ busparams.nsamples = 1;
++
++ err = ops->dev_set_data_bittiming(netdev, &busparams);
++ if (err)
++ return err;
++
++ err = kvaser_usb_setup_rx_urbs(priv->dev);
++ if (err)
++ return err;
++
++ err = ops->dev_get_data_busparams(priv);
++ if (err)
++ return err;
++
++ if (memcmp(&busparams, &priv->busparams_data,
++ sizeof(priv->busparams_data)) != 0)
++ err = -EINVAL;
++
++ return err;
++}
++
+ static void kvaser_usb_write_bulk_callback(struct urb *urb)
+ {
+ struct kvaser_usb_tx_urb_context *context = urb->context;
+@@ -645,6 +728,7 @@ static const struct net_device_ops kvaser_usb_netdev_ops = {
+
+ static void kvaser_usb_remove_interfaces(struct kvaser_usb *dev)
+ {
++ const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops;
+ int i;
+
+ for (i = 0; i < dev->nchannels; i++) {
+@@ -660,6 +744,9 @@ static void kvaser_usb_remove_interfaces(struct kvaser_usb *dev)
+ if (!dev->nets[i])
+ continue;
+
++ if (ops->dev_remove_channel)
++ ops->dev_remove_channel(dev->nets[i]);
++
+ free_candev(dev->nets[i]->netdev);
+ }
+ }
+@@ -692,6 +779,7 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel)
+ init_completion(&priv->start_comp);
+ init_completion(&priv->stop_comp);
+ init_completion(&priv->flush_comp);
++ init_completion(&priv->get_busparams_comp);
+ priv->can.ctrlmode_supported = 0;
+
+ priv->dev = dev;
+@@ -704,7 +792,7 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel)
+ priv->can.state = CAN_STATE_STOPPED;
+ priv->can.clock.freq = dev->cfg->clock.freq;
+ priv->can.bittiming_const = dev->cfg->bittiming_const;
+- priv->can.do_set_bittiming = ops->dev_set_bittiming;
++ priv->can.do_set_bittiming = kvaser_usb_set_bittiming;
+ priv->can.do_set_mode = ops->dev_set_mode;
+ if ((driver_info->quirks & KVASER_USB_QUIRK_HAS_TXRX_ERRORS) ||
+ (priv->dev->card_data.capabilities & KVASER_USB_CAP_BERR_CAP))
+@@ -716,7 +804,7 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel)
+
+ if (priv->can.ctrlmode_supported & CAN_CTRLMODE_FD) {
+ priv->can.data_bittiming_const = dev->cfg->data_bittiming_const;
+- priv->can.do_set_data_bittiming = ops->dev_set_data_bittiming;
++ priv->can.do_set_data_bittiming = kvaser_usb_set_data_bittiming;
+ }
+
+ netdev->flags |= IFF_ECHO;
+@@ -728,17 +816,26 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel)
+
+ dev->nets[channel] = priv;
+
++ if (ops->dev_init_channel) {
++ err = ops->dev_init_channel(priv);
++ if (err)
++ goto err;
++ }
++
+ err = register_candev(netdev);
+ if (err) {
+ dev_err(&dev->intf->dev, "Failed to register CAN device\n");
+- free_candev(netdev);
+- dev->nets[channel] = NULL;
+- return err;
++ goto err;
+ }
+
+ netdev_dbg(netdev, "device registered\n");
+
+ return 0;
++
++err:
++ free_candev(netdev);
++ dev->nets[channel] = NULL;
++ return err;
+ }
+
+ static int kvaser_usb_probe(struct usb_interface *intf,
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index 45d2787248839..2764fdd7e84b3 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -43,6 +43,8 @@ static const struct kvaser_usb_dev_cfg kvaser_usb_hydra_dev_cfg_flexc;
+
+ /* Minihydra command IDs */
+ #define CMD_SET_BUSPARAMS_REQ 16
++#define CMD_GET_BUSPARAMS_REQ 17
++#define CMD_GET_BUSPARAMS_RESP 18
+ #define CMD_GET_CHIP_STATE_REQ 19
+ #define CMD_CHIP_STATE_EVENT 20
+ #define CMD_SET_DRIVERMODE_REQ 21
+@@ -193,21 +195,26 @@ struct kvaser_cmd_chip_state_event {
+ #define KVASER_USB_HYDRA_BUS_MODE_CANFD_ISO 0x01
+ #define KVASER_USB_HYDRA_BUS_MODE_NONISO 0x02
+ struct kvaser_cmd_set_busparams {
+- __le32 bitrate;
+- u8 tseg1;
+- u8 tseg2;
+- u8 sjw;
+- u8 nsamples;
++ struct kvaser_usb_busparams busparams_nominal;
+ u8 reserved0[4];
+- __le32 bitrate_d;
+- u8 tseg1_d;
+- u8 tseg2_d;
+- u8 sjw_d;
+- u8 nsamples_d;
++ struct kvaser_usb_busparams busparams_data;
+ u8 canfd_mode;
+ u8 reserved1[7];
+ } __packed;
+
++/* Busparam type */
++#define KVASER_USB_HYDRA_BUSPARAM_TYPE_CAN 0x00
++#define KVASER_USB_HYDRA_BUSPARAM_TYPE_CANFD 0x01
++struct kvaser_cmd_get_busparams_req {
++ u8 type;
++ u8 reserved[27];
++} __packed;
++
++struct kvaser_cmd_get_busparams_res {
++ struct kvaser_usb_busparams busparams;
++ u8 reserved[20];
++} __packed;
++
+ /* Ctrl modes */
+ #define KVASER_USB_HYDRA_CTRLMODE_NORMAL 0x01
+ #define KVASER_USB_HYDRA_CTRLMODE_LISTEN 0x02
+@@ -278,6 +285,8 @@ struct kvaser_cmd {
+ struct kvaser_cmd_error_event error_event;
+
+ struct kvaser_cmd_set_busparams set_busparams_req;
++ struct kvaser_cmd_get_busparams_req get_busparams_req;
++ struct kvaser_cmd_get_busparams_res get_busparams_res;
+
+ struct kvaser_cmd_chip_state_event chip_state_event;
+
+@@ -293,6 +302,7 @@ struct kvaser_cmd {
+ #define KVASER_USB_HYDRA_CF_FLAG_OVERRUN BIT(1)
+ #define KVASER_USB_HYDRA_CF_FLAG_REMOTE_FRAME BIT(4)
+ #define KVASER_USB_HYDRA_CF_FLAG_EXTENDED_ID BIT(5)
++#define KVASER_USB_HYDRA_CF_FLAG_TX_ACK BIT(6)
+ /* CAN frame flags. Used in ext_rx_can and ext_tx_can */
+ #define KVASER_USB_HYDRA_CF_FLAG_OSM_NACK BIT(12)
+ #define KVASER_USB_HYDRA_CF_FLAG_ABL BIT(13)
+@@ -359,6 +369,10 @@ struct kvaser_cmd_ext {
+ } __packed;
+ } __packed;
+
++struct kvaser_usb_net_hydra_priv {
++ int pending_get_busparams_type;
++};
++
+ static const struct can_bittiming_const kvaser_usb_hydra_kcan_bittiming_c = {
+ .name = "kvaser_usb_kcan",
+ .tseg1_min = 1,
+@@ -812,6 +826,39 @@ static void kvaser_usb_hydra_flush_queue_reply(const struct kvaser_usb *dev,
+ complete(&priv->flush_comp);
+ }
+
++static void kvaser_usb_hydra_get_busparams_reply(const struct kvaser_usb *dev,
++ const struct kvaser_cmd *cmd)
++{
++ struct kvaser_usb_net_priv *priv;
++ struct kvaser_usb_net_hydra_priv *hydra;
++
++ priv = kvaser_usb_hydra_net_priv_from_cmd(dev, cmd);
++ if (!priv)
++ return;
++
++ hydra = priv->sub_priv;
++ if (!hydra)
++ return;
++
++ switch (hydra->pending_get_busparams_type) {
++ case KVASER_USB_HYDRA_BUSPARAM_TYPE_CAN:
++ memcpy(&priv->busparams_nominal, &cmd->get_busparams_res.busparams,
++ sizeof(priv->busparams_nominal));
++ break;
++ case KVASER_USB_HYDRA_BUSPARAM_TYPE_CANFD:
++ memcpy(&priv->busparams_data, &cmd->get_busparams_res.busparams,
++ sizeof(priv->busparams_nominal));
++ break;
++ default:
++ dev_warn(&dev->intf->dev, "Unknown get_busparams_type %d\n",
++ hydra->pending_get_busparams_type);
++ break;
++ }
++ hydra->pending_get_busparams_type = -1;
++
++ complete(&priv->get_busparams_comp);
++}
++
+ static void
+ kvaser_usb_hydra_bus_status_to_can_state(const struct kvaser_usb_net_priv *priv,
+ u8 bus_status,
+@@ -1099,6 +1146,7 @@ static void kvaser_usb_hydra_tx_acknowledge(const struct kvaser_usb *dev,
+ struct kvaser_usb_net_priv *priv;
+ unsigned long irq_flags;
+ bool one_shot_fail = false;
++ bool is_err_frame = false;
+ u16 transid = kvaser_usb_hydra_get_cmd_transid(cmd);
+
+ priv = kvaser_usb_hydra_net_priv_from_cmd(dev, cmd);
+@@ -1117,10 +1165,13 @@ static void kvaser_usb_hydra_tx_acknowledge(const struct kvaser_usb *dev,
+ kvaser_usb_hydra_one_shot_fail(priv, cmd_ext);
+ one_shot_fail = true;
+ }
++
++ is_err_frame = flags & KVASER_USB_HYDRA_CF_FLAG_TX_ACK &&
++ flags & KVASER_USB_HYDRA_CF_FLAG_ERROR_FRAME;
+ }
+
+ context = &priv->tx_contexts[transid % dev->max_tx_urbs];
+- if (!one_shot_fail) {
++ if (!one_shot_fail && !is_err_frame) {
+ struct net_device_stats *stats = &priv->netdev->stats;
+
+ stats->tx_packets++;
+@@ -1294,6 +1345,10 @@ static void kvaser_usb_hydra_handle_cmd_std(const struct kvaser_usb *dev,
+ kvaser_usb_hydra_state_event(dev, cmd);
+ break;
+
++ case CMD_GET_BUSPARAMS_RESP:
++ kvaser_usb_hydra_get_busparams_reply(dev, cmd);
++ break;
++
+ case CMD_ERROR_EVENT:
+ kvaser_usb_hydra_error_event(dev, cmd);
+ break;
+@@ -1494,15 +1549,58 @@ static int kvaser_usb_hydra_set_mode(struct net_device *netdev,
+ return err;
+ }
+
+-static int kvaser_usb_hydra_set_bittiming(struct net_device *netdev)
++static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv,
++ int busparams_type)
++{
++ struct kvaser_usb *dev = priv->dev;
++ struct kvaser_usb_net_hydra_priv *hydra = priv->sub_priv;
++ struct kvaser_cmd *cmd;
++ int err;
++
++ if (!hydra)
++ return -EINVAL;
++
++ cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL);
++ if (!cmd)
++ return -ENOMEM;
++
++ cmd->header.cmd_no = CMD_GET_BUSPARAMS_REQ;
++ kvaser_usb_hydra_set_cmd_dest_he
++ (cmd, dev->card_data.hydra.channel_to_he[priv->channel]);
++ kvaser_usb_hydra_set_cmd_transid
++ (cmd, kvaser_usb_hydra_get_next_transid(dev));
++ cmd->get_busparams_req.type = busparams_type;
++ hydra->pending_get_busparams_type = busparams_type;
++
++ reinit_completion(&priv->get_busparams_comp);
++
++ err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd));
++ if (err)
++ return err;
++
++ if (!wait_for_completion_timeout(&priv->get_busparams_comp,
++ msecs_to_jiffies(KVASER_USB_TIMEOUT)))
++ return -ETIMEDOUT;
++
++ return err;
++}
++
++static int kvaser_usb_hydra_get_nominal_busparams(struct kvaser_usb_net_priv *priv)
++{
++ return kvaser_usb_hydra_get_busparams(priv, KVASER_USB_HYDRA_BUSPARAM_TYPE_CAN);
++}
++
++static int kvaser_usb_hydra_get_data_busparams(struct kvaser_usb_net_priv *priv)
++{
++ return kvaser_usb_hydra_get_busparams(priv, KVASER_USB_HYDRA_BUSPARAM_TYPE_CANFD);
++}
++
++static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev,
++ const struct kvaser_usb_busparams *busparams)
+ {
+ struct kvaser_cmd *cmd;
+ struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
+- struct can_bittiming *bt = &priv->can.bittiming;
+ struct kvaser_usb *dev = priv->dev;
+- int tseg1 = bt->prop_seg + bt->phase_seg1;
+- int tseg2 = bt->phase_seg2;
+- int sjw = bt->sjw;
+ int err;
+
+ cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL);
+@@ -1510,11 +1608,8 @@ static int kvaser_usb_hydra_set_bittiming(struct net_device *netdev)
+ return -ENOMEM;
+
+ cmd->header.cmd_no = CMD_SET_BUSPARAMS_REQ;
+- cmd->set_busparams_req.bitrate = cpu_to_le32(bt->bitrate);
+- cmd->set_busparams_req.sjw = (u8)sjw;
+- cmd->set_busparams_req.tseg1 = (u8)tseg1;
+- cmd->set_busparams_req.tseg2 = (u8)tseg2;
+- cmd->set_busparams_req.nsamples = 1;
++ memcpy(&cmd->set_busparams_req.busparams_nominal, busparams,
++ sizeof(cmd->set_busparams_req.busparams_nominal));
+
+ kvaser_usb_hydra_set_cmd_dest_he
+ (cmd, dev->card_data.hydra.channel_to_he[priv->channel]);
+@@ -1528,15 +1623,12 @@ static int kvaser_usb_hydra_set_bittiming(struct net_device *netdev)
+ return err;
+ }
+
+-static int kvaser_usb_hydra_set_data_bittiming(struct net_device *netdev)
++static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev,
++ const struct kvaser_usb_busparams *busparams)
+ {
+ struct kvaser_cmd *cmd;
+ struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
+- struct can_bittiming *dbt = &priv->can.data_bittiming;
+ struct kvaser_usb *dev = priv->dev;
+- int tseg1 = dbt->prop_seg + dbt->phase_seg1;
+- int tseg2 = dbt->phase_seg2;
+- int sjw = dbt->sjw;
+ int err;
+
+ cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL);
+@@ -1544,11 +1636,8 @@ static int kvaser_usb_hydra_set_data_bittiming(struct net_device *netdev)
+ return -ENOMEM;
+
+ cmd->header.cmd_no = CMD_SET_BUSPARAMS_FD_REQ;
+- cmd->set_busparams_req.bitrate_d = cpu_to_le32(dbt->bitrate);
+- cmd->set_busparams_req.sjw_d = (u8)sjw;
+- cmd->set_busparams_req.tseg1_d = (u8)tseg1;
+- cmd->set_busparams_req.tseg2_d = (u8)tseg2;
+- cmd->set_busparams_req.nsamples_d = 1;
++ memcpy(&cmd->set_busparams_req.busparams_data, busparams,
++ sizeof(cmd->set_busparams_req.busparams_data));
+
+ if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {
+ if (priv->can.ctrlmode & CAN_CTRLMODE_FD_NON_ISO)
+@@ -1655,6 +1744,19 @@ static int kvaser_usb_hydra_init_card(struct kvaser_usb *dev)
+ return 0;
+ }
+
++static int kvaser_usb_hydra_init_channel(struct kvaser_usb_net_priv *priv)
++{
++ struct kvaser_usb_net_hydra_priv *hydra;
++
++ hydra = devm_kzalloc(&priv->dev->intf->dev, sizeof(*hydra), GFP_KERNEL);
++ if (!hydra)
++ return -ENOMEM;
++
++ priv->sub_priv = hydra;
++
++ return 0;
++}
++
+ static int kvaser_usb_hydra_get_software_info(struct kvaser_usb *dev)
+ {
+ struct kvaser_cmd cmd;
+@@ -1997,10 +2099,13 @@ kvaser_usb_hydra_frame_to_cmd(const struct kvaser_usb_net_priv *priv,
+ const struct kvaser_usb_dev_ops kvaser_usb_hydra_dev_ops = {
+ .dev_set_mode = kvaser_usb_hydra_set_mode,
+ .dev_set_bittiming = kvaser_usb_hydra_set_bittiming,
++ .dev_get_busparams = kvaser_usb_hydra_get_nominal_busparams,
+ .dev_set_data_bittiming = kvaser_usb_hydra_set_data_bittiming,
++ .dev_get_data_busparams = kvaser_usb_hydra_get_data_busparams,
+ .dev_get_berr_counter = kvaser_usb_hydra_get_berr_counter,
+ .dev_setup_endpoints = kvaser_usb_hydra_setup_endpoints,
+ .dev_init_card = kvaser_usb_hydra_init_card,
++ .dev_init_channel = kvaser_usb_hydra_init_channel,
+ .dev_get_software_info = kvaser_usb_hydra_get_software_info,
+ .dev_get_software_details = kvaser_usb_hydra_get_software_details,
+ .dev_get_card_info = kvaser_usb_hydra_get_card_info,
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+index 15380cc08ee69..f06d63db9077b 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -20,6 +20,7 @@
+ #include <linux/string.h>
+ #include <linux/types.h>
+ #include <linux/usb.h>
++#include <linux/workqueue.h>
+
+ #include <linux/can.h>
+ #include <linux/can/dev.h>
+@@ -55,6 +56,9 @@
+ #define CMD_RX_EXT_MESSAGE 14
+ #define CMD_TX_EXT_MESSAGE 15
+ #define CMD_SET_BUS_PARAMS 16
++#define CMD_GET_BUS_PARAMS 17
++#define CMD_GET_BUS_PARAMS_REPLY 18
++#define CMD_GET_CHIP_STATE 19
+ #define CMD_CHIP_STATE_EVENT 20
+ #define CMD_SET_CTRL_MODE 21
+ #define CMD_RESET_CHIP 24
+@@ -69,10 +73,13 @@
+ #define CMD_GET_CARD_INFO_REPLY 35
+ #define CMD_GET_SOFTWARE_INFO 38
+ #define CMD_GET_SOFTWARE_INFO_REPLY 39
++#define CMD_ERROR_EVENT 45
+ #define CMD_FLUSH_QUEUE 48
+ #define CMD_TX_ACKNOWLEDGE 50
+ #define CMD_CAN_ERROR_EVENT 51
+ #define CMD_FLUSH_QUEUE_REPLY 68
++#define CMD_GET_CAPABILITIES_REQ 95
++#define CMD_GET_CAPABILITIES_RESP 96
+
+ #define CMD_LEAF_LOG_MESSAGE 106
+
+@@ -82,6 +89,8 @@
+ #define KVASER_USB_LEAF_SWOPTION_FREQ_32_MHZ_CLK BIT(5)
+ #define KVASER_USB_LEAF_SWOPTION_FREQ_24_MHZ_CLK BIT(6)
+
++#define KVASER_USB_LEAF_SWOPTION_EXT_CAP BIT(12)
++
+ /* error factors */
+ #define M16C_EF_ACKE BIT(0)
+ #define M16C_EF_CRCE BIT(1)
+@@ -156,11 +165,7 @@ struct usbcan_cmd_softinfo {
+ struct kvaser_cmd_busparams {
+ u8 tid;
+ u8 channel;
+- __le32 bitrate;
+- u8 tseg1;
+- u8 tseg2;
+- u8 sjw;
+- u8 no_samp;
++ struct kvaser_usb_busparams busparams;
+ } __packed;
+
+ struct kvaser_cmd_tx_can {
+@@ -229,7 +234,7 @@ struct kvaser_cmd_tx_acknowledge_header {
+ u8 tid;
+ } __packed;
+
+-struct leaf_cmd_error_event {
++struct leaf_cmd_can_error_event {
+ u8 tid;
+ u8 flags;
+ __le16 time[3];
+@@ -241,7 +246,7 @@ struct leaf_cmd_error_event {
+ u8 error_factor;
+ } __packed;
+
+-struct usbcan_cmd_error_event {
++struct usbcan_cmd_can_error_event {
+ u8 tid;
+ u8 padding;
+ u8 tx_errors_count_ch0;
+@@ -253,6 +258,28 @@ struct usbcan_cmd_error_event {
+ __le16 time;
+ } __packed;
+
++/* CMD_ERROR_EVENT error codes */
++#define KVASER_USB_LEAF_ERROR_EVENT_TX_QUEUE_FULL 0x8
++#define KVASER_USB_LEAF_ERROR_EVENT_PARAM 0x9
++
++struct leaf_cmd_error_event {
++ u8 tid;
++ u8 error_code;
++ __le16 timestamp[3];
++ __le16 padding;
++ __le16 info1;
++ __le16 info2;
++} __packed;
++
++struct usbcan_cmd_error_event {
++ u8 tid;
++ u8 error_code;
++ __le16 info1;
++ __le16 info2;
++ __le16 timestamp;
++ __le16 padding;
++} __packed;
++
+ struct kvaser_cmd_ctrl_mode {
+ u8 tid;
+ u8 channel;
+@@ -277,6 +304,28 @@ struct leaf_cmd_log_message {
+ u8 data[8];
+ } __packed;
+
++/* Sub commands for cap_req and cap_res */
++#define KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE 0x02
++#define KVASER_USB_LEAF_CAP_CMD_ERR_REPORT 0x05
++struct kvaser_cmd_cap_req {
++ __le16 padding0;
++ __le16 cap_cmd;
++ __le16 padding1;
++ __le16 channel;
++} __packed;
++
++/* Status codes for cap_res */
++#define KVASER_USB_LEAF_CAP_STAT_OK 0x00
++#define KVASER_USB_LEAF_CAP_STAT_NOT_IMPL 0x01
++#define KVASER_USB_LEAF_CAP_STAT_UNAVAIL 0x02
++struct kvaser_cmd_cap_res {
++ __le16 padding;
++ __le16 cap_cmd;
++ __le16 status;
++ __le32 mask;
++ __le32 value;
++} __packed;
++
+ struct kvaser_cmd {
+ u8 len;
+ u8 id;
+@@ -292,14 +341,18 @@ struct kvaser_cmd {
+ struct leaf_cmd_softinfo softinfo;
+ struct leaf_cmd_rx_can rx_can;
+ struct leaf_cmd_chip_state_event chip_state_event;
+- struct leaf_cmd_error_event error_event;
++ struct leaf_cmd_can_error_event can_error_event;
+ struct leaf_cmd_log_message log_message;
++ struct leaf_cmd_error_event error_event;
++ struct kvaser_cmd_cap_req cap_req;
++ struct kvaser_cmd_cap_res cap_res;
+ } __packed leaf;
+
+ union {
+ struct usbcan_cmd_softinfo softinfo;
+ struct usbcan_cmd_rx_can rx_can;
+ struct usbcan_cmd_chip_state_event chip_state_event;
++ struct usbcan_cmd_can_error_event can_error_event;
+ struct usbcan_cmd_error_event error_event;
+ } __packed usbcan;
+
+@@ -322,7 +375,10 @@ static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = {
+ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.leaf.rx_can),
+ [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message),
+ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event),
+- [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event),
++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.can_error_event),
++ [CMD_GET_CAPABILITIES_RESP] = kvaser_fsize(u.leaf.cap_res),
++ [CMD_GET_BUS_PARAMS_REPLY] = kvaser_fsize(u.busparams),
++ [CMD_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event),
+ /* ignored events: */
+ [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY,
+ };
+@@ -336,7 +392,8 @@ static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = {
+ [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.usbcan.rx_can),
+ [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can),
+ [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event),
+- [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event),
++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.can_error_event),
++ [CMD_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event),
+ /* ignored events: */
+ [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY,
+ };
+@@ -364,6 +421,12 @@ struct kvaser_usb_err_summary {
+ };
+ };
+
++struct kvaser_usb_net_leaf_priv {
++ struct kvaser_usb_net_priv *net;
++
++ struct delayed_work chip_state_req_work;
++};
++
+ static const struct can_bittiming_const kvaser_usb_leaf_m16c_bittiming_const = {
+ .name = "kvaser_usb_ucii",
+ .tseg1_min = 4,
+@@ -607,6 +670,9 @@ static void kvaser_usb_leaf_get_software_info_leaf(struct kvaser_usb *dev,
+ dev->fw_version = le32_to_cpu(softinfo->fw_version);
+ dev->max_tx_urbs = le16_to_cpu(softinfo->max_outstanding_tx);
+
++ if (sw_options & KVASER_USB_LEAF_SWOPTION_EXT_CAP)
++ dev->card_data.capabilities |= KVASER_USB_CAP_EXT_CAP;
++
+ if (dev->driver_info->quirks & KVASER_USB_QUIRK_IGNORE_CLK_FREQ) {
+ /* Firmware expects bittiming parameters calculated for 16MHz
+ * clock, regardless of the actual clock
+@@ -694,6 +760,116 @@ static int kvaser_usb_leaf_get_card_info(struct kvaser_usb *dev)
+ return 0;
+ }
+
++static int kvaser_usb_leaf_get_single_capability(struct kvaser_usb *dev,
++ u16 cap_cmd_req, u16 *status)
++{
++ struct kvaser_usb_dev_card_data *card_data = &dev->card_data;
++ struct kvaser_cmd *cmd;
++ u32 value = 0;
++ u32 mask = 0;
++ u16 cap_cmd_res;
++ int err;
++ int i;
++
++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
++ if (!cmd)
++ return -ENOMEM;
++
++ cmd->id = CMD_GET_CAPABILITIES_REQ;
++ cmd->u.leaf.cap_req.cap_cmd = cpu_to_le16(cap_cmd_req);
++ cmd->len = CMD_HEADER_LEN + sizeof(struct kvaser_cmd_cap_req);
++
++ err = kvaser_usb_send_cmd(dev, cmd, cmd->len);
++ if (err)
++ goto end;
++
++ err = kvaser_usb_leaf_wait_cmd(dev, CMD_GET_CAPABILITIES_RESP, cmd);
++ if (err)
++ goto end;
++
++ *status = le16_to_cpu(cmd->u.leaf.cap_res.status);
++
++ if (*status != KVASER_USB_LEAF_CAP_STAT_OK)
++ goto end;
++
++ cap_cmd_res = le16_to_cpu(cmd->u.leaf.cap_res.cap_cmd);
++ switch (cap_cmd_res) {
++ case KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE:
++ case KVASER_USB_LEAF_CAP_CMD_ERR_REPORT:
++ value = le32_to_cpu(cmd->u.leaf.cap_res.value);
++ mask = le32_to_cpu(cmd->u.leaf.cap_res.mask);
++ break;
++ default:
++ dev_warn(&dev->intf->dev, "Unknown capability command %u\n",
++ cap_cmd_res);
++ break;
++ }
++
++ for (i = 0; i < dev->nchannels; i++) {
++ if (BIT(i) & (value & mask)) {
++ switch (cap_cmd_res) {
++ case KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE:
++ card_data->ctrlmode_supported |=
++ CAN_CTRLMODE_LISTENONLY;
++ break;
++ case KVASER_USB_LEAF_CAP_CMD_ERR_REPORT:
++ card_data->capabilities |=
++ KVASER_USB_CAP_BERR_CAP;
++ break;
++ }
++ }
++ }
++
++end:
++ kfree(cmd);
++
++ return err;
++}
++
++static int kvaser_usb_leaf_get_capabilities_leaf(struct kvaser_usb *dev)
++{
++ int err;
++ u16 status;
++
++ if (!(dev->card_data.capabilities & KVASER_USB_CAP_EXT_CAP)) {
++ dev_info(&dev->intf->dev,
++ "No extended capability support. Upgrade device firmware.\n");
++ return 0;
++ }
++
++ err = kvaser_usb_leaf_get_single_capability(dev,
++ KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE,
++ &status);
++ if (err)
++ return err;
++ if (status)
++ dev_info(&dev->intf->dev,
++ "KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE failed %u\n",
++ status);
++
++ err = kvaser_usb_leaf_get_single_capability(dev,
++ KVASER_USB_LEAF_CAP_CMD_ERR_REPORT,
++ &status);
++ if (err)
++ return err;
++ if (status)
++ dev_info(&dev->intf->dev,
++ "KVASER_USB_LEAF_CAP_CMD_ERR_REPORT failed %u\n",
++ status);
++
++ return 0;
++}
++
++static int kvaser_usb_leaf_get_capabilities(struct kvaser_usb *dev)
++{
++ int err = 0;
++
++ if (dev->driver_info->family == KVASER_LEAF)
++ err = kvaser_usb_leaf_get_capabilities_leaf(dev);
++
++ return err;
++}
++
+ static void kvaser_usb_leaf_tx_acknowledge(const struct kvaser_usb *dev,
+ const struct kvaser_cmd *cmd)
+ {
+@@ -722,7 +898,7 @@ static void kvaser_usb_leaf_tx_acknowledge(const struct kvaser_usb *dev,
+ context = &priv->tx_contexts[tid % dev->max_tx_urbs];
+
+ /* Sometimes the state change doesn't come after a bus-off event */
+- if (priv->can.restart_ms && priv->can.state >= CAN_STATE_BUS_OFF) {
++ if (priv->can.restart_ms && priv->can.state == CAN_STATE_BUS_OFF) {
+ struct sk_buff *skb;
+ struct can_frame *cf;
+
+@@ -778,6 +954,16 @@ static int kvaser_usb_leaf_simple_cmd_async(struct kvaser_usb_net_priv *priv,
+ return err;
+ }
+
++static void kvaser_usb_leaf_chip_state_req_work(struct work_struct *work)
++{
++ struct kvaser_usb_net_leaf_priv *leaf =
++ container_of(work, struct kvaser_usb_net_leaf_priv,
++ chip_state_req_work.work);
++ struct kvaser_usb_net_priv *priv = leaf->net;
++
++ kvaser_usb_leaf_simple_cmd_async(priv, CMD_GET_CHIP_STATE);
++}
++
+ static void
+ kvaser_usb_leaf_rx_error_update_can_state(struct kvaser_usb_net_priv *priv,
+ const struct kvaser_usb_err_summary *es,
+@@ -796,20 +982,16 @@ kvaser_usb_leaf_rx_error_update_can_state(struct kvaser_usb_net_priv *priv,
+ new_state = CAN_STATE_BUS_OFF;
+ } else if (es->status & M16C_STATE_BUS_PASSIVE) {
+ new_state = CAN_STATE_ERROR_PASSIVE;
+- } else if (es->status & M16C_STATE_BUS_ERROR) {
++ } else if ((es->status & M16C_STATE_BUS_ERROR) &&
++ cur_state >= CAN_STATE_BUS_OFF) {
+ /* Guard against spurious error events after a busoff */
+- if (cur_state < CAN_STATE_BUS_OFF) {
+- if (es->txerr >= 128 || es->rxerr >= 128)
+- new_state = CAN_STATE_ERROR_PASSIVE;
+- else if (es->txerr >= 96 || es->rxerr >= 96)
+- new_state = CAN_STATE_ERROR_WARNING;
+- else if (cur_state > CAN_STATE_ERROR_ACTIVE)
+- new_state = CAN_STATE_ERROR_ACTIVE;
+- }
+- }
+-
+- if (!es->status)
++ } else if (es->txerr >= 128 || es->rxerr >= 128) {
++ new_state = CAN_STATE_ERROR_PASSIVE;
++ } else if (es->txerr >= 96 || es->rxerr >= 96) {
++ new_state = CAN_STATE_ERROR_WARNING;
++ } else {
+ new_state = CAN_STATE_ERROR_ACTIVE;
++ }
+
+ if (new_state != cur_state) {
+ tx_state = (es->txerr >= es->rxerr) ? new_state : 0;
+@@ -819,7 +1001,7 @@ kvaser_usb_leaf_rx_error_update_can_state(struct kvaser_usb_net_priv *priv,
+ }
+
+ if (priv->can.restart_ms &&
+- cur_state >= CAN_STATE_BUS_OFF &&
++ cur_state == CAN_STATE_BUS_OFF &&
+ new_state < CAN_STATE_BUS_OFF)
+ priv->can.can_stats.restarts++;
+
+@@ -853,6 +1035,7 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev,
+ struct sk_buff *skb;
+ struct net_device_stats *stats;
+ struct kvaser_usb_net_priv *priv;
++ struct kvaser_usb_net_leaf_priv *leaf;
+ enum can_state old_state, new_state;
+
+ if (es->channel >= dev->nchannels) {
+@@ -862,8 +1045,13 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev,
+ }
+
+ priv = dev->nets[es->channel];
++ leaf = priv->sub_priv;
+ stats = &priv->netdev->stats;
+
++ /* Ignore e.g. state change to bus-off reported just after stopping */
++ if (!netif_running(priv->netdev))
++ return;
++
+ /* Update all of the CAN interface's state and error counters before
+ * trying any memory allocation that can actually fail with -ENOMEM.
+ *
+@@ -878,6 +1066,14 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev,
+ kvaser_usb_leaf_rx_error_update_can_state(priv, es, &tmp_cf);
+ new_state = priv->can.state;
+
++ /* If there are errors, request status updates periodically as we do
++ * not get automatic notifications of improved state.
++ */
++ if (new_state < CAN_STATE_BUS_OFF &&
++ (es->rxerr || es->txerr || new_state == CAN_STATE_ERROR_PASSIVE))
++ schedule_delayed_work(&leaf->chip_state_req_work,
++ msecs_to_jiffies(500));
++
+ skb = alloc_can_err_skb(priv->netdev, &cf);
+ if (!skb) {
+ stats->rx_dropped++;
+@@ -895,7 +1091,7 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev,
+ }
+
+ if (priv->can.restart_ms &&
+- old_state >= CAN_STATE_BUS_OFF &&
++ old_state == CAN_STATE_BUS_OFF &&
+ new_state < CAN_STATE_BUS_OFF) {
+ cf->can_id |= CAN_ERR_RESTARTED;
+ netif_carrier_on(priv->netdev);
+@@ -995,11 +1191,11 @@ static void kvaser_usb_leaf_usbcan_rx_error(const struct kvaser_usb *dev,
+
+ case CMD_CAN_ERROR_EVENT:
+ es.channel = 0;
+- es.status = cmd->u.usbcan.error_event.status_ch0;
+- es.txerr = cmd->u.usbcan.error_event.tx_errors_count_ch0;
+- es.rxerr = cmd->u.usbcan.error_event.rx_errors_count_ch0;
++ es.status = cmd->u.usbcan.can_error_event.status_ch0;
++ es.txerr = cmd->u.usbcan.can_error_event.tx_errors_count_ch0;
++ es.rxerr = cmd->u.usbcan.can_error_event.rx_errors_count_ch0;
+ es.usbcan.other_ch_status =
+- cmd->u.usbcan.error_event.status_ch1;
++ cmd->u.usbcan.can_error_event.status_ch1;
+ kvaser_usb_leaf_usbcan_conditionally_rx_error(dev, &es);
+
+ /* The USBCAN firmware supports up to 2 channels.
+@@ -1007,13 +1203,13 @@ static void kvaser_usb_leaf_usbcan_rx_error(const struct kvaser_usb *dev,
+ */
+ if (dev->nchannels == MAX_USBCAN_NET_DEVICES) {
+ es.channel = 1;
+- es.status = cmd->u.usbcan.error_event.status_ch1;
++ es.status = cmd->u.usbcan.can_error_event.status_ch1;
+ es.txerr =
+- cmd->u.usbcan.error_event.tx_errors_count_ch1;
++ cmd->u.usbcan.can_error_event.tx_errors_count_ch1;
+ es.rxerr =
+- cmd->u.usbcan.error_event.rx_errors_count_ch1;
++ cmd->u.usbcan.can_error_event.rx_errors_count_ch1;
+ es.usbcan.other_ch_status =
+- cmd->u.usbcan.error_event.status_ch0;
++ cmd->u.usbcan.can_error_event.status_ch0;
+ kvaser_usb_leaf_usbcan_conditionally_rx_error(dev, &es);
+ }
+ break;
+@@ -1030,11 +1226,11 @@ static void kvaser_usb_leaf_leaf_rx_error(const struct kvaser_usb *dev,
+
+ switch (cmd->id) {
+ case CMD_CAN_ERROR_EVENT:
+- es.channel = cmd->u.leaf.error_event.channel;
+- es.status = cmd->u.leaf.error_event.status;
+- es.txerr = cmd->u.leaf.error_event.tx_errors_count;
+- es.rxerr = cmd->u.leaf.error_event.rx_errors_count;
+- es.leaf.error_factor = cmd->u.leaf.error_event.error_factor;
++ es.channel = cmd->u.leaf.can_error_event.channel;
++ es.status = cmd->u.leaf.can_error_event.status;
++ es.txerr = cmd->u.leaf.can_error_event.tx_errors_count;
++ es.rxerr = cmd->u.leaf.can_error_event.rx_errors_count;
++ es.leaf.error_factor = cmd->u.leaf.can_error_event.error_factor;
+ break;
+ case CMD_LEAF_LOG_MESSAGE:
+ es.channel = cmd->u.leaf.log_message.channel;
+@@ -1166,6 +1362,74 @@ static void kvaser_usb_leaf_rx_can_msg(const struct kvaser_usb *dev,
+ netif_rx(skb);
+ }
+
++static void kvaser_usb_leaf_error_event_parameter(const struct kvaser_usb *dev,
++ const struct kvaser_cmd *cmd)
++{
++ u16 info1 = 0;
++
++ switch (dev->driver_info->family) {
++ case KVASER_LEAF:
++ info1 = le16_to_cpu(cmd->u.leaf.error_event.info1);
++ break;
++ case KVASER_USBCAN:
++ info1 = le16_to_cpu(cmd->u.usbcan.error_event.info1);
++ break;
++ }
++
++ /* info1 will contain the offending cmd_no */
++ switch (info1) {
++ case CMD_SET_CTRL_MODE:
++ dev_warn(&dev->intf->dev,
++ "CMD_SET_CTRL_MODE error in parameter\n");
++ break;
++
++ case CMD_SET_BUS_PARAMS:
++ dev_warn(&dev->intf->dev,
++ "CMD_SET_BUS_PARAMS error in parameter\n");
++ break;
++
++ default:
++ dev_warn(&dev->intf->dev,
++ "Unhandled parameter error event cmd_no (%u)\n",
++ info1);
++ break;
++ }
++}
++
++static void kvaser_usb_leaf_error_event(const struct kvaser_usb *dev,
++ const struct kvaser_cmd *cmd)
++{
++ u8 error_code = 0;
++
++ switch (dev->driver_info->family) {
++ case KVASER_LEAF:
++ error_code = cmd->u.leaf.error_event.error_code;
++ break;
++ case KVASER_USBCAN:
++ error_code = cmd->u.usbcan.error_event.error_code;
++ break;
++ }
++
++ switch (error_code) {
++ case KVASER_USB_LEAF_ERROR_EVENT_TX_QUEUE_FULL:
++ /* Received additional CAN message, when firmware TX queue is
++ * already full. Something is wrong with the driver.
++ * This should never happen!
++ */
++ dev_err(&dev->intf->dev,
++ "Received error event TX_QUEUE_FULL\n");
++ break;
++ case KVASER_USB_LEAF_ERROR_EVENT_PARAM:
++ kvaser_usb_leaf_error_event_parameter(dev, cmd);
++ break;
++
++ default:
++ dev_warn(&dev->intf->dev,
++ "Unhandled error event (%d)\n", error_code);
++ break;
++ }
++}
++
+ static void kvaser_usb_leaf_start_chip_reply(const struct kvaser_usb *dev,
+ const struct kvaser_cmd *cmd)
+ {
+@@ -1206,6 +1470,25 @@ static void kvaser_usb_leaf_stop_chip_reply(const struct kvaser_usb *dev,
+ complete(&priv->stop_comp);
+ }
+
++static void kvaser_usb_leaf_get_busparams_reply(const struct kvaser_usb *dev,
++ const struct kvaser_cmd *cmd)
++{
++ struct kvaser_usb_net_priv *priv;
++ u8 channel = cmd->u.busparams.channel;
++
++ if (channel >= dev->nchannels) {
++ dev_err(&dev->intf->dev,
++ "Invalid channel number (%d)\n", channel);
++ return;
++ }
++
++ priv = dev->nets[channel];
++ memcpy(&priv->busparams_nominal, &cmd->u.busparams.busparams,
++ sizeof(priv->busparams_nominal));
++
++ complete(&priv->get_busparams_comp);
++}
++
+ static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev,
+ const struct kvaser_cmd *cmd)
+ {
+@@ -1244,6 +1527,14 @@ static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev,
+ kvaser_usb_leaf_tx_acknowledge(dev, cmd);
+ break;
+
++ case CMD_ERROR_EVENT:
++ kvaser_usb_leaf_error_event(dev, cmd);
++ break;
++
++ case CMD_GET_BUS_PARAMS_REPLY:
++ kvaser_usb_leaf_get_busparams_reply(dev, cmd);
++ break;
++
+ /* Ignored commands */
+ case CMD_USBCAN_CLOCK_OVERFLOW_EVENT:
+ if (dev->driver_info->family != KVASER_USBCAN)
+@@ -1340,10 +1631,13 @@ static int kvaser_usb_leaf_start_chip(struct kvaser_usb_net_priv *priv)
+
+ static int kvaser_usb_leaf_stop_chip(struct kvaser_usb_net_priv *priv)
+ {
++ struct kvaser_usb_net_leaf_priv *leaf = priv->sub_priv;
+ int err;
+
+ reinit_completion(&priv->stop_comp);
+
++ cancel_delayed_work(&leaf->chip_state_req_work);
++
+ err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_STOP_CHIP,
+ priv->channel);
+ if (err)
+@@ -1390,10 +1684,35 @@ static int kvaser_usb_leaf_init_card(struct kvaser_usb *dev)
+ return 0;
+ }
+
+-static int kvaser_usb_leaf_set_bittiming(struct net_device *netdev)
++static int kvaser_usb_leaf_init_channel(struct kvaser_usb_net_priv *priv)
++{
++ struct kvaser_usb_net_leaf_priv *leaf;
++
++ leaf = devm_kzalloc(&priv->dev->intf->dev, sizeof(*leaf), GFP_KERNEL);
++ if (!leaf)
++ return -ENOMEM;
++
++ leaf->net = priv;
++ INIT_DELAYED_WORK(&leaf->chip_state_req_work,
++ kvaser_usb_leaf_chip_state_req_work);
++
++ priv->sub_priv = leaf;
++
++ return 0;
++}
++
++static void kvaser_usb_leaf_remove_channel(struct kvaser_usb_net_priv *priv)
++{
++ struct kvaser_usb_net_leaf_priv *leaf = priv->sub_priv;
++
++ if (leaf)
++ cancel_delayed_work_sync(&leaf->chip_state_req_work);
++}
++
++static int kvaser_usb_leaf_set_bittiming(const struct net_device *netdev,
++ const struct kvaser_usb_busparams *busparams)
+ {
+ struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
+- struct can_bittiming *bt = &priv->can.bittiming;
+ struct kvaser_usb *dev = priv->dev;
+ struct kvaser_cmd *cmd;
+ int rc;
+@@ -1406,15 +1725,8 @@ static int kvaser_usb_leaf_set_bittiming(struct net_device *netdev)
+ cmd->len = CMD_HEADER_LEN + sizeof(struct kvaser_cmd_busparams);
+ cmd->u.busparams.channel = priv->channel;
+ cmd->u.busparams.tid = 0xff;
+- cmd->u.busparams.bitrate = cpu_to_le32(bt->bitrate);
+- cmd->u.busparams.sjw = bt->sjw;
+- cmd->u.busparams.tseg1 = bt->prop_seg + bt->phase_seg1;
+- cmd->u.busparams.tseg2 = bt->phase_seg2;
+-
+- if (priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES)
+- cmd->u.busparams.no_samp = 3;
+- else
+- cmd->u.busparams.no_samp = 1;
++ memcpy(&cmd->u.busparams.busparams, busparams,
++ sizeof(cmd->u.busparams.busparams));
+
+ rc = kvaser_usb_send_cmd(dev, cmd, cmd->len);
+
+@@ -1422,6 +1734,27 @@ static int kvaser_usb_leaf_set_bittiming(struct net_device *netdev)
+ return rc;
+ }
+
++static int kvaser_usb_leaf_get_busparams(struct kvaser_usb_net_priv *priv)
++{
++ int err;
++
++ if (priv->dev->driver_info->family == KVASER_USBCAN)
++ return -EOPNOTSUPP;
++
++ reinit_completion(&priv->get_busparams_comp);
++
++ err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_GET_BUS_PARAMS,
++ priv->channel);
++ if (err)
++ return err;
++
++ if (!wait_for_completion_timeout(&priv->get_busparams_comp,
++ msecs_to_jiffies(KVASER_USB_TIMEOUT)))
++ return -ETIMEDOUT;
++
++ return 0;
++}
++
+ static int kvaser_usb_leaf_set_mode(struct net_device *netdev,
+ enum can_mode mode)
+ {
+@@ -1483,14 +1816,18 @@ static int kvaser_usb_leaf_setup_endpoints(struct kvaser_usb *dev)
+ const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops = {
+ .dev_set_mode = kvaser_usb_leaf_set_mode,
+ .dev_set_bittiming = kvaser_usb_leaf_set_bittiming,
++ .dev_get_busparams = kvaser_usb_leaf_get_busparams,
+ .dev_set_data_bittiming = NULL,
++ .dev_get_data_busparams = NULL,
+ .dev_get_berr_counter = kvaser_usb_leaf_get_berr_counter,
+ .dev_setup_endpoints = kvaser_usb_leaf_setup_endpoints,
+ .dev_init_card = kvaser_usb_leaf_init_card,
++ .dev_init_channel = kvaser_usb_leaf_init_channel,
++ .dev_remove_channel = kvaser_usb_leaf_remove_channel,
+ .dev_get_software_info = kvaser_usb_leaf_get_software_info,
+ .dev_get_software_details = NULL,
+ .dev_get_card_info = kvaser_usb_leaf_get_card_info,
+- .dev_get_capabilities = NULL,
++ .dev_get_capabilities = kvaser_usb_leaf_get_capabilities,
+ .dev_set_opt_mode = kvaser_usb_leaf_set_opt_mode,
+ .dev_start_chip = kvaser_usb_leaf_start_chip,
+ .dev_stop_chip = kvaser_usb_leaf_stop_chip,
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
+index ea1de06009d6d..093458fbde68b 100644
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -58,6 +58,10 @@
+ #define MCBA_VER_REQ_USB 1
+ #define MCBA_VER_REQ_CAN 2
+
++/* Drive the CAN_RES signal LOW "0" to activate R24 and R25 */
++#define MCBA_VER_TERMINATION_ON 0
++#define MCBA_VER_TERMINATION_OFF 1
++
+ #define MCBA_SIDL_EXID_MASK 0x8
+ #define MCBA_DLC_MASK 0xf
+ #define MCBA_DLC_RTR_MASK 0x40
+@@ -480,7 +484,7 @@ static void mcba_usb_process_ka_usb(struct mcba_priv *priv,
+ priv->usb_ka_first_pass = false;
+ }
+
+- if (msg->termination_state)
++ if (msg->termination_state == MCBA_VER_TERMINATION_ON)
+ priv->can.termination = MCBA_TERMINATION_ENABLED;
+ else
+ priv->can.termination = MCBA_TERMINATION_DISABLED;
+@@ -800,9 +804,9 @@ static int mcba_set_termination(struct net_device *netdev, u16 term)
+ };
+
+ if (term == MCBA_TERMINATION_ENABLED)
+- usb_msg.termination = 1;
++ usb_msg.termination = MCBA_VER_TERMINATION_ON;
+ else
+- usb_msg.termination = 0;
++ usb_msg.termination = MCBA_VER_TERMINATION_OFF;
+
+ mcba_usb_xmit_cmd(priv, (struct mcba_usb_msg *)&usb_msg);
+
+diff --git a/drivers/net/dsa/lan9303-core.c b/drivers/net/dsa/lan9303-core.c
+index 03dc075ff4e85..f976b3d64593a 100644
+--- a/drivers/net/dsa/lan9303-core.c
++++ b/drivers/net/dsa/lan9303-core.c
+@@ -1010,9 +1010,11 @@ static void lan9303_get_ethtool_stats(struct dsa_switch *ds, int port,
+ ret = lan9303_read_switch_port(
+ chip, port, lan9303_mib[u].offset, ®);
+
+- if (ret)
++ if (ret) {
+ dev_warn(chip->dev, "Reading status port %d reg %u failed\n",
+ port, lan9303_mib[u].offset);
++ reg = 0;
++ }
+ data[u] = reg;
+ }
+ }
+diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c
+index d3d44e07afbc0..414b990827e8e 100644
+--- a/drivers/net/ethernet/amd/atarilance.c
++++ b/drivers/net/ethernet/amd/atarilance.c
+@@ -825,7 +825,7 @@ lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ lp->memcpy_f( PKTBUF_ADDR(head), (void *)skb->data, skb->len );
+ head->flag = TMD1_OWN_CHIP | TMD1_ENP | TMD1_STP;
+ dev->stats.tx_bytes += skb->len;
+- dev_kfree_skb( skb );
++ dev_consume_skb_irq(skb);
+ lp->cur_tx++;
+ while( lp->cur_tx >= TX_RING_SIZE && lp->dirty_tx >= TX_RING_SIZE ) {
+ lp->cur_tx -= TX_RING_SIZE;
+diff --git a/drivers/net/ethernet/amd/lance.c b/drivers/net/ethernet/amd/lance.c
+index b56d84c7df46e..a21f4f82a9c2f 100644
+--- a/drivers/net/ethernet/amd/lance.c
++++ b/drivers/net/ethernet/amd/lance.c
+@@ -997,7 +997,7 @@ static netdev_tx_t lance_start_xmit(struct sk_buff *skb,
+ skb_copy_from_linear_data(skb, &lp->tx_bounce_buffs[entry], skb->len);
+ lp->tx_ring[entry].base =
+ ((u32)isa_virt_to_bus((lp->tx_bounce_buffs + entry)) & 0xffffff) | 0x83000000;
+- dev_kfree_skb(skb);
++ dev_consume_skb_irq(skb);
+ } else {
+ lp->tx_skbuff[entry] = skb;
+ lp->tx_ring[entry].base = ((u32)isa_virt_to_bus(skb->data) & 0xffffff) | 0x83000000;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 35659f0dbe74e..c1fb1e62557c7 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1140,6 +1140,9 @@ static void xgbe_free_irqs(struct xgbe_prv_data *pdata)
+
+ devm_free_irq(pdata->dev, pdata->dev_irq, pdata);
+
++ tasklet_kill(&pdata->tasklet_dev);
++ tasklet_kill(&pdata->tasklet_ecc);
++
+ if (pdata->vdata->ecc_support && (pdata->dev_irq != pdata->ecc_irq))
+ devm_free_irq(pdata->dev, pdata->ecc_irq, pdata);
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-i2c.c b/drivers/net/ethernet/amd/xgbe/xgbe-i2c.c
+index 4d9062d35930f..530043742a07a 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-i2c.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-i2c.c
+@@ -447,8 +447,10 @@ static void xgbe_i2c_stop(struct xgbe_prv_data *pdata)
+ xgbe_i2c_disable(pdata);
+ xgbe_i2c_clear_all_interrupts(pdata);
+
+- if (pdata->dev_irq != pdata->i2c_irq)
++ if (pdata->dev_irq != pdata->i2c_irq) {
+ devm_free_irq(pdata->dev, pdata->i2c_irq, pdata);
++ tasklet_kill(&pdata->tasklet_i2c);
++ }
+ }
+
+ static int xgbe_i2c_start(struct xgbe_prv_data *pdata)
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 156a0bc8ab01d..97167fc9bebe7 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1390,8 +1390,10 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
+ /* Disable auto-negotiation */
+ xgbe_an_disable_all(pdata);
+
+- if (pdata->dev_irq != pdata->an_irq)
++ if (pdata->dev_irq != pdata->an_irq) {
+ devm_free_irq(pdata->dev, pdata->an_irq, pdata);
++ tasklet_kill(&pdata->tasklet_an);
++ }
+
+ pdata->phy_if.phy_impl.stop(pdata);
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index d54e6e138aafe..e32649c254cd3 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -188,6 +188,7 @@ enum xgbe_sfp_cable {
+ XGBE_SFP_CABLE_UNKNOWN = 0,
+ XGBE_SFP_CABLE_ACTIVE,
+ XGBE_SFP_CABLE_PASSIVE,
++ XGBE_SFP_CABLE_FIBER,
+ };
+
+ enum xgbe_sfp_base {
+@@ -235,10 +236,7 @@ enum xgbe_sfp_speed {
+
+ #define XGBE_SFP_BASE_BR 12
+ #define XGBE_SFP_BASE_BR_1GBE_MIN 0x0a
+-#define XGBE_SFP_BASE_BR_1GBE_MAX 0x0d
+ #define XGBE_SFP_BASE_BR_10GBE_MIN 0x64
+-#define XGBE_SFP_BASE_BR_10GBE_MAX 0x68
+-#define XGBE_MOLEX_SFP_BASE_BR_10GBE_MAX 0x78
+
+ #define XGBE_SFP_BASE_CU_CABLE_LEN 18
+
+@@ -825,29 +823,22 @@ static void xgbe_phy_sfp_phy_settings(struct xgbe_prv_data *pdata)
+ static bool xgbe_phy_sfp_bit_rate(struct xgbe_sfp_eeprom *sfp_eeprom,
+ enum xgbe_sfp_speed sfp_speed)
+ {
+- u8 *sfp_base, min, max;
++ u8 *sfp_base, min;
+
+ sfp_base = sfp_eeprom->base;
+
+ switch (sfp_speed) {
+ case XGBE_SFP_SPEED_1000:
+ min = XGBE_SFP_BASE_BR_1GBE_MIN;
+- max = XGBE_SFP_BASE_BR_1GBE_MAX;
+ break;
+ case XGBE_SFP_SPEED_10000:
+ min = XGBE_SFP_BASE_BR_10GBE_MIN;
+- if (memcmp(&sfp_eeprom->base[XGBE_SFP_BASE_VENDOR_NAME],
+- XGBE_MOLEX_VENDOR, XGBE_SFP_BASE_VENDOR_NAME_LEN) == 0)
+- max = XGBE_MOLEX_SFP_BASE_BR_10GBE_MAX;
+- else
+- max = XGBE_SFP_BASE_BR_10GBE_MAX;
+ break;
+ default:
+ return false;
+ }
+
+- return ((sfp_base[XGBE_SFP_BASE_BR] >= min) &&
+- (sfp_base[XGBE_SFP_BASE_BR] <= max));
++ return sfp_base[XGBE_SFP_BASE_BR] >= min;
+ }
+
+ static void xgbe_phy_free_phy_device(struct xgbe_prv_data *pdata)
+@@ -1136,16 +1127,18 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata)
+ phy_data->sfp_tx_fault = xgbe_phy_check_sfp_tx_fault(phy_data);
+ phy_data->sfp_rx_los = xgbe_phy_check_sfp_rx_los(phy_data);
+
+- /* Assume ACTIVE cable unless told it is PASSIVE */
++ /* Assume FIBER cable unless told otherwise */
+ if (sfp_base[XGBE_SFP_BASE_CABLE] & XGBE_SFP_BASE_CABLE_PASSIVE) {
+ phy_data->sfp_cable = XGBE_SFP_CABLE_PASSIVE;
+ phy_data->sfp_cable_len = sfp_base[XGBE_SFP_BASE_CU_CABLE_LEN];
+- } else {
++ } else if (sfp_base[XGBE_SFP_BASE_CABLE] & XGBE_SFP_BASE_CABLE_ACTIVE) {
+ phy_data->sfp_cable = XGBE_SFP_CABLE_ACTIVE;
++ } else {
++ phy_data->sfp_cable = XGBE_SFP_CABLE_FIBER;
+ }
+
+ /* Determine the type of SFP */
+- if (phy_data->sfp_cable == XGBE_SFP_CABLE_PASSIVE &&
++ if (phy_data->sfp_cable != XGBE_SFP_CABLE_FIBER &&
+ xgbe_phy_sfp_bit_rate(sfp_eeprom, XGBE_SFP_SPEED_10000))
+ phy_data->sfp_base = XGBE_SFP_BASE_10000_CR;
+ else if (sfp_base[XGBE_SFP_BASE_10GBE_CC] & XGBE_SFP_BASE_10GBE_CC_SR)
+diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c
+index ab6ce85540b8a..a0ce699903cf9 100644
+--- a/drivers/net/ethernet/apple/bmac.c
++++ b/drivers/net/ethernet/apple/bmac.c
+@@ -1510,7 +1510,7 @@ static void bmac_tx_timeout(struct timer_list *t)
+ i = bp->tx_empty;
+ ++dev->stats.tx_errors;
+ if (i != bp->tx_fill) {
+- dev_kfree_skb(bp->tx_bufs[i]);
++ dev_kfree_skb_irq(bp->tx_bufs[i]);
+ bp->tx_bufs[i] = NULL;
+ if (++i >= N_TX_RING) i = 0;
+ bp->tx_empty = i;
+diff --git a/drivers/net/ethernet/apple/mace.c b/drivers/net/ethernet/apple/mace.c
+index 68b9ee4894892..8f5e0cc00dddd 100644
+--- a/drivers/net/ethernet/apple/mace.c
++++ b/drivers/net/ethernet/apple/mace.c
+@@ -840,7 +840,7 @@ static void mace_tx_timeout(struct timer_list *t)
+ if (mp->tx_bad_runt) {
+ mp->tx_bad_runt = 0;
+ } else if (i != mp->tx_fill) {
+- dev_kfree_skb(mp->tx_bufs[i]);
++ dev_kfree_skb_irq(mp->tx_bufs[i]);
+ if (++i >= N_TX_RING)
+ i = 0;
+ mp->tx_empty = i;
+diff --git a/drivers/net/ethernet/dnet.c b/drivers/net/ethernet/dnet.c
+index 5a847941c46b9..f7d126a2617e3 100644
+--- a/drivers/net/ethernet/dnet.c
++++ b/drivers/net/ethernet/dnet.c
+@@ -558,11 +558,11 @@ static netdev_tx_t dnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ skb_tx_timestamp(skb);
+
++ spin_unlock_irqrestore(&bp->lock, flags);
++
+ /* free the buffer */
+ dev_kfree_skb(skb);
+
+- spin_unlock_irqrestore(&bp->lock, flags);
+-
+ return NETDEV_TX_OK;
+ }
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index aacfa5fcdc408..87f98170ac937 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -1211,8 +1211,12 @@ static int igb_alloc_q_vector(struct igb_adapter *adapter,
+ if (!q_vector) {
+ q_vector = kzalloc(size, GFP_KERNEL);
+ } else if (size > ksize(q_vector)) {
+- kfree_rcu(q_vector, rcu);
+- q_vector = kzalloc(size, GFP_KERNEL);
++ struct igb_q_vector *new_q_vector;
++
++ new_q_vector = kzalloc(size, GFP_KERNEL);
++ if (new_q_vector)
++ kfree_rcu(q_vector, rcu);
++ q_vector = new_q_vector;
+ } else {
+ memset(q_vector, 0, size);
+ }
+@@ -7165,7 +7169,7 @@ static void igb_vf_reset_msg(struct igb_adapter *adapter, u32 vf)
+ {
+ struct e1000_hw *hw = &adapter->hw;
+ unsigned char *vf_mac = adapter->vf_data[vf].vf_mac_addresses;
+- u32 reg, msgbuf[3];
++ u32 reg, msgbuf[3] = {};
+ u8 *addr = (u8 *)(&msgbuf[1]);
+
+ /* process all the same items cleared in a function level reset */
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+index 0fd62510fb277..dee65443d76b7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+@@ -395,8 +395,8 @@ static int mlx5_ptp_verify(struct ptp_clock_info *ptp, unsigned int pin,
+
+ static const struct ptp_clock_info mlx5_ptp_clock_info = {
+ .owner = THIS_MODULE,
+- .name = "mlx5_p2p",
+- .max_adj = 100000000,
++ .name = "mlx5_ptp",
++ .max_adj = 50000000,
+ .n_alarm = 0,
+ .n_ext_ts = 0,
+ .n_per_out = 0,
+diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+index 3bc570c46f81c..8296b0aa42a9e 100644
+--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+@@ -3960,6 +3960,7 @@ abort_with_slices:
+ myri10ge_free_slices(mgp);
+
+ abort_with_firmware:
++ kfree(mgp->msix_vectors);
+ myri10ge_dummy_rdma(mgp, 0);
+
+ abort_with_ioremap:
+diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c
+index 0a8483c615d4f..b42f81d0c6f05 100644
+--- a/drivers/net/ethernet/neterion/s2io.c
++++ b/drivers/net/ethernet/neterion/s2io.c
+@@ -2375,7 +2375,7 @@ static void free_tx_buffers(struct s2io_nic *nic)
+ skb = s2io_txdl_getskb(&mac_control->fifos[i], txdp, j);
+ if (skb) {
+ swstats->mem_freed += skb->truesize;
+- dev_kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ cnt++;
+ }
+ }
+diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c
+index 4e417f839c3f0..f7b354e796cb6 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c
++++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c
+@@ -874,7 +874,6 @@ area_cache_get(struct nfp_cpp *cpp, u32 id,
+ }
+
+ /* Adjust the start address to be cache size aligned */
+- cache->id = id;
+ cache->addr = addr & ~(u64)(cache->size - 1);
+
+ /* Re-init to the new ID and address */
+@@ -894,6 +893,8 @@ area_cache_get(struct nfp_cpp *cpp, u32 id,
+ return NULL;
+ }
+
++ cache->id = id;
++
+ exit:
+ /* Adjust offset */
+ *offset = addr - cache->addr;
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+index 10286215092f6..85419b8258b59 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+@@ -2525,7 +2525,13 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
+ goto disable_mbx_intr;
+
+ qlcnic_83xx_clear_function_resources(adapter);
+- qlcnic_dcb_enable(adapter->dcb);
++
++ err = qlcnic_dcb_enable(adapter->dcb);
++ if (err) {
++ qlcnic_dcb_free(adapter->dcb);
++ goto disable_mbx_intr;
++ }
++
+ qlcnic_83xx_initialize_nic(adapter, 1);
+ qlcnic_dcb_get_info(adapter->dcb);
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
+index 0a9d24e86715d..eb8000d9b6d0e 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h
+@@ -42,11 +42,6 @@ struct qlcnic_dcb {
+ unsigned long state;
+ };
+
+-static inline void qlcnic_clear_dcb_ops(struct qlcnic_dcb *dcb)
+-{
+- kfree(dcb);
+-}
+-
+ static inline int qlcnic_dcb_get_hw_capability(struct qlcnic_dcb *dcb)
+ {
+ if (dcb && dcb->ops->get_hw_capability)
+@@ -113,9 +108,8 @@ static inline void qlcnic_dcb_init_dcbnl_ops(struct qlcnic_dcb *dcb)
+ dcb->ops->init_dcbnl_ops(dcb);
+ }
+
+-static inline void qlcnic_dcb_enable(struct qlcnic_dcb *dcb)
++static inline int qlcnic_dcb_enable(struct qlcnic_dcb *dcb)
+ {
+- if (dcb && qlcnic_dcb_attach(dcb))
+- qlcnic_clear_dcb_ops(dcb);
++ return dcb ? qlcnic_dcb_attach(dcb) : 0;
+ }
+ #endif
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+index 43920374beae2..a0c427f3b1800 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+@@ -2638,7 +2638,13 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ "Device does not support MSI interrupts\n");
+
+ if (qlcnic_82xx_check(adapter)) {
+- qlcnic_dcb_enable(adapter->dcb);
++ err = qlcnic_dcb_enable(adapter->dcb);
++ if (err) {
++ qlcnic_dcb_free(adapter->dcb);
++ dev_err(&pdev->dev, "Failed to enable DCB\n");
++ goto err_out_free_hw;
++ }
++
+ qlcnic_dcb_get_info(adapter->dcb);
+ err = qlcnic_setup_intr(adapter);
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+index 98275f18a87b0..d28c4436f965b 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+@@ -222,6 +222,8 @@ int qlcnic_sriov_init(struct qlcnic_adapter *adapter, int num_vfs)
+ return 0;
+
+ qlcnic_destroy_async_wq:
++ while (i--)
++ kfree(sriov->vf_info[i].vp);
+ destroy_workqueue(bc->bc_async_wq);
+
+ qlcnic_destroy_trans_wq:
+diff --git a/drivers/net/ethernet/rdc/r6040.c b/drivers/net/ethernet/rdc/r6040.c
+index 2199bd08f4d6a..e377c1f68777b 100644
+--- a/drivers/net/ethernet/rdc/r6040.c
++++ b/drivers/net/ethernet/rdc/r6040.c
+@@ -1184,10 +1184,12 @@ static int r6040_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ err = register_netdev(dev);
+ if (err) {
+ dev_err(&pdev->dev, "Failed to register net device\n");
+- goto err_out_mdio_unregister;
++ goto err_out_phy_disconnect;
+ }
+ return 0;
+
++err_out_phy_disconnect:
++ phy_disconnect(dev->phydev);
+ err_out_mdio_unregister:
+ mdiobus_unregister(lp->mii_bus);
+ err_out_mdio:
+@@ -1211,6 +1213,7 @@ static void r6040_remove_one(struct pci_dev *pdev)
+ struct r6040_private *lp = netdev_priv(dev);
+
+ unregister_netdev(dev);
++ phy_disconnect(dev->phydev);
+ mdiobus_unregister(lp->mii_bus);
+ mdiobus_free(lp->mii_bus);
+ netif_napi_del(&lp->napi);
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 9077014f6f403..ff374d0d80a7d 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -2199,11 +2199,11 @@ static int ravb_remove(struct platform_device *pdev)
+ priv->desc_bat_dma);
+ /* Set reset mode */
+ ravb_write(ndev, CCC_OPC_RESET, CCC);
+- pm_runtime_put_sync(&pdev->dev);
+ unregister_netdev(ndev);
+ netif_napi_del(&priv->napi[RAVB_NC]);
+ netif_napi_del(&priv->napi[RAVB_BE]);
+ ravb_mdio_release(priv);
++ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ free_netdev(ndev);
+ platform_set_drvdata(pdev, NULL);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+index 08a058e1bc75c..541c0449f31c7 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+@@ -53,7 +53,8 @@ static void config_sub_second_increment(void __iomem *ioaddr,
+ if (!(value & PTP_TCR_TSCTRLSSR))
+ data = (data * 1000) / 465;
+
+- data &= PTP_SSIR_SSINC_MASK;
++ if (data > PTP_SSIR_SSINC_MAX)
++ data = PTP_SSIR_SSINC_MAX;
+
+ reg_value = data;
+ if (gmac4)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
+index ecccf895fd7e4..306ebf1a495e4 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
+@@ -66,7 +66,7 @@
+ #define PTP_TCR_TSENMACADDR BIT(18)
+
+ /* SSIR defines */
+-#define PTP_SSIR_SSINC_MASK 0xff
++#define PTP_SSIR_SSINC_MAX 0xff
+ #define GMAC4_PTP_SSIR_SSINC_SHIFT 16
+
+ #endif /* __STMMAC_PTP_H__ */
+diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
+index 6099865217f29..7fdbd2ff55737 100644
+--- a/drivers/net/ethernet/ti/netcp_core.c
++++ b/drivers/net/ethernet/ti/netcp_core.c
+@@ -1276,7 +1276,7 @@ out:
+ }
+
+ /* Submit the packet */
+-static int netcp_ndo_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t netcp_ndo_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct netcp_intf *netcp = netdev_priv(ndev);
+ struct netcp_stats *tx_stats = &netcp->stats;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+index 4e1504587895a..e3f0beaa7d550 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+@@ -543,7 +543,7 @@ static void xemaclite_tx_timeout(struct net_device *dev)
+ xemaclite_enable_interrupts(lp);
+
+ if (lp->deferred_skb) {
+- dev_kfree_skb(lp->deferred_skb);
++ dev_kfree_skb_irq(lp->deferred_skb);
+ lp->deferred_skb = NULL;
+ dev->stats.tx_errors++;
+ }
+diff --git a/drivers/net/fddi/defxx.c b/drivers/net/fddi/defxx.c
+index 3b48c890540ac..7f14aad1c240c 100644
+--- a/drivers/net/fddi/defxx.c
++++ b/drivers/net/fddi/defxx.c
+@@ -3844,10 +3844,24 @@ static int dfx_init(void)
+ int status;
+
+ status = pci_register_driver(&dfx_pci_driver);
+- if (!status)
+- status = eisa_driver_register(&dfx_eisa_driver);
+- if (!status)
+- status = tc_register_driver(&dfx_tc_driver);
++ if (status)
++ goto err_pci_register;
++
++ status = eisa_driver_register(&dfx_eisa_driver);
++ if (status)
++ goto err_eisa_register;
++
++ status = tc_register_driver(&dfx_tc_driver);
++ if (status)
++ goto err_tc_register;
++
++ return 0;
++
++err_tc_register:
++ eisa_driver_unregister(&dfx_eisa_driver);
++err_eisa_register:
++ pci_unregister_driver(&dfx_pci_driver);
++err_pci_register:
+ return status;
+ }
+
+diff --git a/drivers/net/hamradio/baycom_epp.c b/drivers/net/hamradio/baycom_epp.c
+index 1e62d00732f25..787eaf3f4f131 100644
+--- a/drivers/net/hamradio/baycom_epp.c
++++ b/drivers/net/hamradio/baycom_epp.c
+@@ -772,7 +772,7 @@ static void epp_bh(struct work_struct *work)
+ * ===================== network driver interface =========================
+ */
+
+-static int baycom_send_packet(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t baycom_send_packet(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct baycom_state *bc = netdev_priv(dev);
+
+diff --git a/drivers/net/hamradio/scc.c b/drivers/net/hamradio/scc.c
+index 6c03932d8a6bc..3dc4eb841aa1d 100644
+--- a/drivers/net/hamradio/scc.c
++++ b/drivers/net/hamradio/scc.c
+@@ -300,12 +300,12 @@ static inline void scc_discard_buffers(struct scc_channel *scc)
+ spin_lock_irqsave(&scc->lock, flags);
+ if (scc->tx_buff != NULL)
+ {
+- dev_kfree_skb(scc->tx_buff);
++ dev_kfree_skb_irq(scc->tx_buff);
+ scc->tx_buff = NULL;
+ }
+
+ while (!skb_queue_empty(&scc->tx_queue))
+- dev_kfree_skb(skb_dequeue(&scc->tx_queue));
++ dev_kfree_skb_irq(skb_dequeue(&scc->tx_queue));
+
+ spin_unlock_irqrestore(&scc->lock, flags);
+ }
+@@ -1667,7 +1667,7 @@ static netdev_tx_t scc_net_tx(struct sk_buff *skb, struct net_device *dev)
+ if (skb_queue_len(&scc->tx_queue) > scc->dev->tx_queue_len) {
+ struct sk_buff *skb_del;
+ skb_del = skb_dequeue(&scc->tx_queue);
+- dev_kfree_skb(skb_del);
++ dev_kfree_skb_irq(skb_del);
+ }
+ skb_queue_tail(&scc->tx_queue, skb);
+ netif_trans_update(dev);
+diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
+index d192936b76cff..7863918592db9 100644
+--- a/drivers/net/loopback.c
++++ b/drivers/net/loopback.c
+@@ -210,7 +210,7 @@ static __net_init int loopback_net_init(struct net *net)
+ int err;
+
+ err = -ENOMEM;
+- dev = alloc_netdev(0, "lo", NET_NAME_UNKNOWN, loopback_setup);
++ dev = alloc_netdev(0, "lo", NET_NAME_PREDICTABLE, loopback_setup);
+ if (!dev)
+ goto out;
+
+diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c
+index 33974e7519cef..ca0053775d3f9 100644
+--- a/drivers/net/ntb_netdev.c
++++ b/drivers/net/ntb_netdev.c
+@@ -140,7 +140,7 @@ static void ntb_netdev_rx_handler(struct ntb_transport_qp *qp, void *qp_data,
+ enqueue_again:
+ rc = ntb_transport_rx_enqueue(qp, skb, skb->data, ndev->mtu + ETH_HLEN);
+ if (rc) {
+- dev_kfree_skb(skb);
++ dev_kfree_skb_any(skb);
+ ndev->stats.rx_errors++;
+ ndev->stats.rx_fifo_errors++;
+ }
+@@ -195,7 +195,7 @@ static void ntb_netdev_tx_handler(struct ntb_transport_qp *qp, void *qp_data,
+ ndev->stats.tx_aborted_errors++;
+ }
+
+- dev_kfree_skb(skb);
++ dev_kfree_skb_any(skb);
+
+ if (ntb_transport_tx_free_entry(dev->qp) >= tx_start) {
+ /* Make sure anybody stopping the queue after this sees the new
+diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c
+index bd6084e315de2..f44dc80ed3e6a 100644
+--- a/drivers/net/phy/xilinx_gmii2rgmii.c
++++ b/drivers/net/phy/xilinx_gmii2rgmii.c
+@@ -91,6 +91,7 @@ static int xgmiitorgmii_probe(struct mdio_device *mdiodev)
+
+ if (!priv->phy_dev->drv) {
+ dev_info(dev, "Attached phy not ready\n");
++ put_device(&priv->phy_dev->mdio.dev);
+ return -EPROBE_DEFER;
+ }
+
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 3f335b57d5cde..220b28711f98e 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -1528,6 +1528,8 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb)
+ int len;
+ unsigned char *cp;
+
++ skb->dev = ppp->dev;
++
+ if (proto < 0x8000) {
+ #ifdef CONFIG_PPP_FILTER
+ /* check if we should pass this packet */
+diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
+index ab41a63aa4aaa..497d6bcdc2762 100644
+--- a/drivers/net/usb/rndis_host.c
++++ b/drivers/net/usb/rndis_host.c
+@@ -267,7 +267,8 @@ static int rndis_query(struct usbnet *dev, struct usb_interface *intf,
+
+ off = le32_to_cpu(u.get_c->offset);
+ len = le32_to_cpu(u.get_c->len);
+- if (unlikely((8 + off + len) > CONTROL_BUFFER_SIZE))
++ if (unlikely((off > CONTROL_BUFFER_SIZE - 8) ||
++ (len > CONTROL_BUFFER_SIZE - 8 - off)))
+ goto response_error;
+
+ if (*reply_len != -1 && len != *reply_len)
+diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
+index 2a3f0f1a2b0a2..bc249f81c80d9 100644
+--- a/drivers/net/wan/farsync.c
++++ b/drivers/net/wan/farsync.c
+@@ -2617,6 +2617,7 @@ fst_remove_one(struct pci_dev *pdev)
+ for (i = 0; i < card->nports; i++) {
+ struct net_device *dev = port_to_dev(&card->ports[i]);
+ unregister_hdlc_device(dev);
++ free_netdev(dev);
+ }
+
+ fst_disable_intr(card);
+@@ -2637,6 +2638,7 @@ fst_remove_one(struct pci_dev *pdev)
+ card->tx_dma_handle_card);
+ }
+ fst_card_array[card->card_no] = NULL;
++ kfree(card);
+ }
+
+ static struct pci_driver fst_driver = {
+diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
+index 58e189ec672f9..5d3cf354f6cb5 100644
+--- a/drivers/net/wireless/ath/ar5523/ar5523.c
++++ b/drivers/net/wireless/ath/ar5523/ar5523.c
+@@ -241,6 +241,11 @@ static void ar5523_cmd_tx_cb(struct urb *urb)
+ }
+ }
+
++static void ar5523_cancel_tx_cmd(struct ar5523 *ar)
++{
++ usb_kill_urb(ar->tx_cmd.urb_tx);
++}
++
+ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata,
+ int ilen, void *odata, int olen, int flags)
+ {
+@@ -280,6 +285,7 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata,
+ }
+
+ if (!wait_for_completion_timeout(&cmd->done, 2 * HZ)) {
++ ar5523_cancel_tx_cmd(ar);
+ cmd->odata = NULL;
+ ar5523_err(ar, "timeout waiting for command %02x reply\n",
+ code);
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index caece8339a50a..92757495c73b6 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -3739,18 +3739,22 @@ static struct pci_driver ath10k_pci_driver = {
+
+ static int __init ath10k_pci_init(void)
+ {
+- int ret;
++ int ret1, ret2;
+
+- ret = pci_register_driver(&ath10k_pci_driver);
+- if (ret)
++ ret1 = pci_register_driver(&ath10k_pci_driver);
++ if (ret1)
+ printk(KERN_ERR "failed to register ath10k pci driver: %d\n",
+- ret);
++ ret1);
+
+- ret = ath10k_ahb_init();
+- if (ret)
+- printk(KERN_ERR "ahb init failed: %d\n", ret);
++ ret2 = ath10k_ahb_init();
++ if (ret2)
++ printk(KERN_ERR "ahb init failed: %d\n", ret2);
+
+- return ret;
++ if (ret1 && ret2)
++ return ret1;
++
++ /* registered to at least one bus */
++ return 0;
+ }
+ module_init(ath10k_pci_init);
+
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index c8c7afe0e343e..8a18a33b5b59f 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -709,14 +709,13 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+ struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
+ struct hif_device_usb *hif_dev = rx_buf->hif_dev;
+ struct sk_buff *skb = rx_buf->skb;
+- struct sk_buff *nskb;
+ int ret;
+
+ if (!skb)
+ return;
+
+ if (!hif_dev)
+- goto free;
++ goto free_skb;
+
+ switch (urb->status) {
+ case 0:
+@@ -725,7 +724,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+ case -ECONNRESET:
+ case -ENODEV:
+ case -ESHUTDOWN:
+- goto free;
++ goto free_skb;
+ default:
+ skb_reset_tail_pointer(skb);
+ skb_trim(skb, 0);
+@@ -736,25 +735,27 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+ if (likely(urb->actual_length != 0)) {
+ skb_put(skb, urb->actual_length);
+
+- /* Process the command first */
++ /*
++ * Process the command first.
++ * skb is either freed here or passed to be
++ * managed to another callback function.
++ */
+ ath9k_htc_rx_msg(hif_dev->htc_handle, skb,
+ skb->len, USB_REG_IN_PIPE);
+
+-
+- nskb = alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_ATOMIC);
+- if (!nskb) {
++ skb = alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_ATOMIC);
++ if (!skb) {
+ dev_err(&hif_dev->udev->dev,
+ "ath9k_htc: REG_IN memory allocation failure\n");
+- urb->context = NULL;
+- return;
++ goto free_rx_buf;
+ }
+
+- rx_buf->skb = nskb;
++ rx_buf->skb = skb;
+
+ usb_fill_int_urb(urb, hif_dev->udev,
+ usb_rcvintpipe(hif_dev->udev,
+ USB_REG_IN_PIPE),
+- nskb->data, MAX_REG_IN_BUF_SIZE,
++ skb->data, MAX_REG_IN_BUF_SIZE,
+ ath9k_hif_usb_reg_in_cb, rx_buf, 1);
+ }
+
+@@ -763,12 +764,13 @@ resubmit:
+ ret = usb_submit_urb(urb, GFP_ATOMIC);
+ if (ret) {
+ usb_unanchor_urb(urb);
+- goto free;
++ goto free_skb;
+ }
+
+ return;
+-free:
++free_skb:
+ kfree_skb(skb);
++free_rx_buf:
+ kfree(rx_buf);
+ urb->context = NULL;
+ }
+@@ -781,14 +783,10 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
+ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+ list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+ &hif_dev->tx.tx_buf, list) {
+- usb_get_urb(tx_buf->urb);
+- spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+- usb_kill_urb(tx_buf->urb);
+ list_del(&tx_buf->list);
+ usb_free_urb(tx_buf->urb);
+ kfree(tx_buf->buf);
+ kfree(tx_buf);
+- spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+ }
+ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
+@@ -1330,10 +1328,24 @@ static int send_eject_command(struct usb_interface *interface)
+ static int ath9k_hif_usb_probe(struct usb_interface *interface,
+ const struct usb_device_id *id)
+ {
++ struct usb_endpoint_descriptor *bulk_in, *bulk_out, *int_in, *int_out;
+ struct usb_device *udev = interface_to_usbdev(interface);
++ struct usb_host_interface *alt;
+ struct hif_device_usb *hif_dev;
+ int ret = 0;
+
++ /* Verify the expected endpoints are present */
++ alt = interface->cur_altsetting;
++ if (usb_find_common_endpoints(alt, &bulk_in, &bulk_out, &int_in, &int_out) < 0 ||
++ usb_endpoint_num(bulk_in) != USB_WLAN_RX_PIPE ||
++ usb_endpoint_num(bulk_out) != USB_WLAN_TX_PIPE ||
++ usb_endpoint_num(int_in) != USB_REG_IN_PIPE ||
++ usb_endpoint_num(int_out) != USB_REG_OUT_PIPE) {
++ dev_err(&udev->dev,
++ "ath9k_htc: Device endpoint numbers are not the expected ones\n");
++ return -ENODEV;
++ }
++
+ if (id->driver_info == STORAGE_DEVICE)
+ return send_eject_command(interface);
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+index 4e5a6c311d1ad..d8460835ff003 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -648,6 +648,11 @@ brcmf_fw_alloc_request(u32 chip, u32 chiprev,
+ char end = '\0';
+ size_t reqsz;
+
++ if (chiprev >= BITS_PER_TYPE(u32)) {
++ brcmf_err("Invalid chip revision %u\n", chiprev);
++ return NULL;
++ }
++
+ for (i = 0; i < table_size; i++) {
+ if (mapping_table[i].chipid == chip &&
+ mapping_table[i].revmask & BIT(chiprev))
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+index a21529d2ccabc..6ee04af85e9d5 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -612,7 +612,7 @@ static int brcmf_pcie_exit_download_state(struct brcmf_pciedev_info *devinfo,
+ }
+
+ if (!brcmf_chip_set_active(devinfo->ci, resetintr))
+- return -EINVAL;
++ return -EIO;
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 0a96c1071e5b8..6eb1daf513010 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3337,6 +3337,7 @@ static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus,
+ /* Take arm out of reset */
+ if (!brcmf_chip_set_active(bus->ci, rstvec)) {
+ brcmf_err("error getting out of ARM core reset\n");
++ bcmerror = -EIO;
+ goto err;
+ }
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+index bd28deff9b8c6..921a226b18f85 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+@@ -1136,6 +1136,15 @@ enum bt_mp_oper_opcode_8723b {
+ BT_MP_OP_ENABLE_CFO_TRACKING = 0x24,
+ };
+
++enum rtl8xxxu_bw_mode {
++ RTL8XXXU_CHANNEL_WIDTH_20 = 0,
++ RTL8XXXU_CHANNEL_WIDTH_40 = 1,
++ RTL8XXXU_CHANNEL_WIDTH_80 = 2,
++ RTL8XXXU_CHANNEL_WIDTH_160 = 3,
++ RTL8XXXU_CHANNEL_WIDTH_80_80 = 4,
++ RTL8XXXU_CHANNEL_WIDTH_MAX = 5,
++};
++
+ struct rtl8723bu_c2h {
+ u8 id;
+ u8 seq;
+@@ -1186,7 +1195,7 @@ struct rtl8723bu_c2h {
+ u8 dummy3_0;
+ } __packed ra_report;
+ };
+-};
++} __packed;
+
+ struct rtl8xxxu_fileops;
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 38f06ee98b356..c3c8382dd0ba2 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -1614,18 +1614,18 @@ static void rtl8xxxu_print_chipinfo(struct rtl8xxxu_priv *priv)
+ static int rtl8xxxu_identify_chip(struct rtl8xxxu_priv *priv)
+ {
+ struct device *dev = &priv->udev->dev;
+- u32 val32, bonding;
++ u32 val32, bonding, sys_cfg;
+ u16 val16;
+
+- val32 = rtl8xxxu_read32(priv, REG_SYS_CFG);
+- priv->chip_cut = (val32 & SYS_CFG_CHIP_VERSION_MASK) >>
++ sys_cfg = rtl8xxxu_read32(priv, REG_SYS_CFG);
++ priv->chip_cut = (sys_cfg & SYS_CFG_CHIP_VERSION_MASK) >>
+ SYS_CFG_CHIP_VERSION_SHIFT;
+- if (val32 & SYS_CFG_TRP_VAUX_EN) {
++ if (sys_cfg & SYS_CFG_TRP_VAUX_EN) {
+ dev_info(dev, "Unsupported test chip\n");
+ return -ENOTSUPP;
+ }
+
+- if (val32 & SYS_CFG_BT_FUNC) {
++ if (sys_cfg & SYS_CFG_BT_FUNC) {
+ if (priv->chip_cut >= 3) {
+ sprintf(priv->chip_name, "8723BU");
+ priv->rtl_chip = RTL8723B;
+@@ -1647,7 +1647,7 @@ static int rtl8xxxu_identify_chip(struct rtl8xxxu_priv *priv)
+ if (val32 & MULTI_GPS_FUNC_EN)
+ priv->has_gps = 1;
+ priv->is_multi_func = 1;
+- } else if (val32 & SYS_CFG_TYPE_ID) {
++ } else if (sys_cfg & SYS_CFG_TYPE_ID) {
+ bonding = rtl8xxxu_read32(priv, REG_HPON_FSM);
+ bonding &= HPON_FSM_BONDING_MASK;
+ if (priv->fops->tx_desc_size ==
+@@ -1695,7 +1695,7 @@ static int rtl8xxxu_identify_chip(struct rtl8xxxu_priv *priv)
+ case RTL8188E:
+ case RTL8192E:
+ case RTL8723B:
+- switch (val32 & SYS_CFG_VENDOR_EXT_MASK) {
++ switch (sys_cfg & SYS_CFG_VENDOR_EXT_MASK) {
+ case SYS_CFG_VENDOR_ID_TSMC:
+ sprintf(priv->chip_vendor, "TSMC");
+ break;
+@@ -1712,7 +1712,7 @@ static int rtl8xxxu_identify_chip(struct rtl8xxxu_priv *priv)
+ }
+ break;
+ default:
+- if (val32 & SYS_CFG_VENDOR_ID) {
++ if (sys_cfg & SYS_CFG_VENDOR_ID) {
+ sprintf(priv->chip_vendor, "UMC");
+ priv->vendor_umc = 1;
+ } else {
+@@ -4333,7 +4333,7 @@ void rtl8xxxu_gen2_update_rate_mask(struct rtl8xxxu_priv *priv,
+ u32 ramask, int sgi)
+ {
+ struct h2c_cmd h2c;
+- u8 bw = 0;
++ u8 bw = RTL8XXXU_CHANNEL_WIDTH_20;
+
+ memset(&h2c, 0, sizeof(struct h2c_cmd));
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_core.c b/drivers/net/wireless/rsi/rsi_91x_core.c
+index c6c29034b2ead..a939b552a8e47 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_core.c
++++ b/drivers/net/wireless/rsi/rsi_91x_core.c
+@@ -466,7 +466,9 @@ void rsi_core_xmit(struct rsi_common *common, struct sk_buff *skb)
+ tid, 0);
+ }
+ }
+- if (skb->protocol == cpu_to_be16(ETH_P_PAE)) {
++
++ if (IEEE80211_SKB_CB(skb)->control.flags &
++ IEEE80211_TX_CTRL_PORT_CTRL_PROTO) {
+ q_num = MGMT_SOFT_Q;
+ skb->priority = q_num;
+ }
+diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
+index 2cb7cca4ec2d9..b445a52fbfbde 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
+@@ -152,12 +152,16 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb)
+ u8 header_size;
+ u8 vap_id = 0;
+ u8 dword_align_bytes;
++ bool tx_eapol;
+ u16 seq_num;
+
+ info = IEEE80211_SKB_CB(skb);
+ vif = info->control.vif;
+ tx_params = (struct skb_info *)info->driver_data;
+
++ tx_eapol = IEEE80211_SKB_CB(skb)->control.flags &
++ IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
++
+ header_size = FRAME_DESC_SZ + sizeof(struct rsi_xtended_desc);
+ if (header_size > skb_headroom(skb)) {
+ rsi_dbg(ERR_ZONE, "%s: Unable to send pkt\n", __func__);
+@@ -221,7 +225,7 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb)
+ }
+ }
+
+- if (skb->protocol == cpu_to_be16(ETH_P_PAE)) {
++ if (tx_eapol) {
+ rsi_dbg(INFO_ZONE, "*** Tx EAPOL ***\n");
+
+ data_desc->frame_info = cpu_to_le16(RATE_INFO_ENABLE);
+diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
+index 79bf8e1bd39c2..b7f5db3a6aa02 100644
+--- a/drivers/nfc/pn533/pn533.c
++++ b/drivers/nfc/pn533/pn533.c
+@@ -1305,6 +1305,8 @@ static int pn533_poll_dep_complete(struct pn533 *dev, void *arg,
+ if (IS_ERR(resp))
+ return PTR_ERR(resp);
+
++ memset(&nfc_target, 0, sizeof(struct nfc_target));
++
+ rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
+
+ rc = rsp->status & PN533_CMD_RET_MASK;
+@@ -1786,6 +1788,8 @@ static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
+
+ dev_dbg(dev->dev, "Creating new target\n");
+
++ memset(&nfc_target, 0, sizeof(struct nfc_target));
++
+ nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
+ nfc_target.nfcid1_len = 10;
+ memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
+diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c
+index a2c9b3f3bc232..c7da364b63584 100644
+--- a/drivers/nfc/pn533/usb.c
++++ b/drivers/nfc/pn533/usb.c
+@@ -165,10 +165,17 @@ static int pn533_usb_send_ack(struct pn533 *dev, gfp_t flags)
+ return usb_submit_urb(phy->ack_urb, flags);
+ }
+
++struct pn533_out_arg {
++ struct pn533_usb_phy *phy;
++ struct completion done;
++};
++
+ static int pn533_usb_send_frame(struct pn533 *dev,
+ struct sk_buff *out)
+ {
+ struct pn533_usb_phy *phy = dev->phy;
++ struct pn533_out_arg arg;
++ void *cntx;
+ int rc;
+
+ if (phy->priv == NULL)
+@@ -180,10 +187,17 @@ static int pn533_usb_send_frame(struct pn533 *dev,
+ print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
+ out->data, out->len, false);
+
++ init_completion(&arg.done);
++ cntx = phy->out_urb->context;
++ phy->out_urb->context = &arg;
++
+ rc = usb_submit_urb(phy->out_urb, GFP_KERNEL);
+ if (rc)
+ return rc;
+
++ wait_for_completion(&arg.done);
++ phy->out_urb->context = cntx;
++
+ if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
+ /* request for response for sent packet directly */
+ rc = pn533_submit_urb_for_response(phy, GFP_KERNEL);
+@@ -424,7 +438,31 @@ static int pn533_acr122_poweron_rdr(struct pn533_usb_phy *phy)
+ return arg.rc;
+ }
+
+-static void pn533_send_complete(struct urb *urb)
++static void pn533_out_complete(struct urb *urb)
++{
++ struct pn533_out_arg *arg = urb->context;
++ struct pn533_usb_phy *phy = arg->phy;
++
++ switch (urb->status) {
++ case 0:
++ break; /* success */
++ case -ECONNRESET:
++ case -ENOENT:
++ dev_dbg(&phy->udev->dev,
++ "The urb has been stopped (status %d)\n",
++ urb->status);
++ break;
++ case -ESHUTDOWN:
++ default:
++ nfc_err(&phy->udev->dev,
++ "Urb failure (status %d)\n",
++ urb->status);
++ }
++
++ complete(&arg->done);
++}
++
++static void pn533_ack_complete(struct urb *urb)
+ {
+ struct pn533_usb_phy *phy = urb->context;
+
+@@ -512,10 +550,10 @@ static int pn533_usb_probe(struct usb_interface *interface,
+
+ usb_fill_bulk_urb(phy->out_urb, phy->udev,
+ usb_sndbulkpipe(phy->udev, out_endpoint),
+- NULL, 0, pn533_send_complete, phy);
++ NULL, 0, pn533_out_complete, phy);
+ usb_fill_bulk_urb(phy->ack_urb, phy->udev,
+ usb_sndbulkpipe(phy->udev, out_endpoint),
+- NULL, 0, pn533_send_complete, phy);
++ NULL, 0, pn533_ack_complete, phy);
+
+ switch (id->driver_info) {
+ case PN533_DEVICE_STD:
+diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
+index c60b465f6fe45..6a0833f5923c1 100644
+--- a/drivers/parisc/led.c
++++ b/drivers/parisc/led.c
+@@ -141,6 +141,9 @@ static int start_task(void)
+
+ /* Create the work queue and queue the LED task */
+ led_wq = create_singlethread_workqueue("led_wq");
++ if (!led_wq)
++ return -ENOMEM;
++
+ queue_delayed_work(led_wq, &led_task, 0);
+
+ return 0;
+diff --git a/drivers/pci/irq.c b/drivers/pci/irq.c
+index a1de501a27299..3f6a5d5202595 100644
+--- a/drivers/pci/irq.c
++++ b/drivers/pci/irq.c
+@@ -94,6 +94,8 @@ int pci_request_irq(struct pci_dev *dev, unsigned int nr, irq_handler_t handler,
+ va_start(ap, fmt);
+ devname = kvasprintf(GFP_KERNEL, fmt, ap);
+ va_end(ap);
++ if (!devname)
++ return -ENOMEM;
+
+ ret = request_threaded_irq(pci_irq_vector(dev, nr), handler, thread_fn,
+ irqflags, devname, dev_id);
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index 1edf5a1836ea9..34a7b3c137bb0 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -1289,11 +1289,9 @@ static int pci_create_attr(struct pci_dev *pdev, int num, int write_combine)
+
+ sysfs_bin_attr_init(res_attr);
+ if (write_combine) {
+- pdev->res_attr_wc[num] = res_attr;
+ sprintf(res_attr_name, "resource%d_wc", num);
+ res_attr->mmap = pci_mmap_resource_wc;
+ } else {
+- pdev->res_attr[num] = res_attr;
+ sprintf(res_attr_name, "resource%d", num);
+ if (pci_resource_flags(pdev, num) & IORESOURCE_IO) {
+ res_attr->read = pci_read_resource_io;
+@@ -1309,10 +1307,17 @@ static int pci_create_attr(struct pci_dev *pdev, int num, int write_combine)
+ res_attr->size = pci_resource_len(pdev, num);
+ res_attr->private = (void *)(unsigned long)num;
+ retval = sysfs_create_bin_file(&pdev->dev.kobj, res_attr);
+- if (retval)
++ if (retval) {
+ kfree(res_attr);
++ return retval;
++ }
+
+- return retval;
++ if (write_combine)
++ pdev->res_attr_wc[num] = res_attr;
++ else
++ pdev->res_attr[num] = res_attr;
++
++ return 0;
+ }
+
+ /**
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 48c419b306f34..7ac6f4710908b 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5815,6 +5815,8 @@ bool pci_device_is_present(struct pci_dev *pdev)
+ {
+ u32 v;
+
++ /* Check PF if pdev is a VF, since VF Vendor/Device IDs are 0xffff */
++ pdev = pci_physfn(pdev);
+ if (pci_dev_is_disconnected(pdev))
+ return false;
+ return pci_bus_read_dev_vendor_id(pdev->bus, pdev->devfn, &v, 0);
+diff --git a/drivers/perf/arm_dsu_pmu.c b/drivers/perf/arm_dsu_pmu.c
+index 660cb8ac886ac..961533ba33e75 100644
+--- a/drivers/perf/arm_dsu_pmu.c
++++ b/drivers/perf/arm_dsu_pmu.c
+@@ -823,7 +823,11 @@ static int __init dsu_pmu_init(void)
+ if (ret < 0)
+ return ret;
+ dsu_pmu_cpuhp_state = ret;
+- return platform_driver_register(&dsu_pmu_driver);
++ ret = platform_driver_register(&dsu_pmu_driver);
++ if (ret)
++ cpuhp_remove_multi_state(dsu_pmu_cpuhp_state);
++
++ return ret;
+ }
+
+ static void __exit dsu_pmu_exit(void)
+diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
+index 564cfaee129d2..55e3305ede811 100644
+--- a/drivers/pinctrl/mediatek/mtk-eint.c
++++ b/drivers/pinctrl/mediatek/mtk-eint.c
+@@ -277,12 +277,15 @@ static struct irq_chip mtk_eint_irq_chip = {
+
+ static unsigned int mtk_eint_hw_init(struct mtk_eint *eint)
+ {
+- void __iomem *reg = eint->base + eint->regs->dom_en;
++ void __iomem *dom_en = eint->base + eint->regs->dom_en;
++ void __iomem *mask_set = eint->base + eint->regs->mask_set;
+ unsigned int i;
+
+ for (i = 0; i < eint->hw->ap_num; i += 32) {
+- writel(0xffffffff, reg);
+- reg += 4;
++ writel(0xffffffff, dom_en);
++ writel(0xffffffff, mask_set);
++ dom_en += 4;
++ mask_set += 4;
+ }
+
+ return 0;
+diff --git a/drivers/pinctrl/pinconf-generic.c b/drivers/pinctrl/pinconf-generic.c
+index 55b56440a5a89..7e946c54681a5 100644
+--- a/drivers/pinctrl/pinconf-generic.c
++++ b/drivers/pinctrl/pinconf-generic.c
+@@ -390,8 +390,10 @@ int pinconf_generic_dt_node_to_map(struct pinctrl_dev *pctldev,
+ for_each_available_child_of_node(np_config, np) {
+ ret = pinconf_generic_dt_subnode_to_map(pctldev, np, map,
+ &reserved_maps, num_maps, type);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(np);
+ goto exit;
++ }
+ }
+ return 0;
+
+diff --git a/drivers/platform/x86/mxm-wmi.c b/drivers/platform/x86/mxm-wmi.c
+index 35d8b9a939f9f..9c1893a703e62 100644
+--- a/drivers/platform/x86/mxm-wmi.c
++++ b/drivers/platform/x86/mxm-wmi.c
+@@ -48,13 +48,11 @@ int mxm_wmi_call_mxds(int adapter)
+ .xarg = 1,
+ };
+ struct acpi_buffer input = { (acpi_size)sizeof(args), &args };
+- struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+ acpi_status status;
+
+ printk("calling mux switch %d\n", adapter);
+
+- status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input,
+- &output);
++ status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input, NULL);
+
+ if (ACPI_FAILURE(status))
+ return status;
+@@ -73,13 +71,11 @@ int mxm_wmi_call_mxmx(int adapter)
+ .xarg = 1,
+ };
+ struct acpi_buffer input = { (acpi_size)sizeof(args), &args };
+- struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+ acpi_status status;
+
+ printk("calling mux switch %d\n", adapter);
+
+- status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input,
+- &output);
++ status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input, NULL);
+
+ if (ACPI_FAILURE(status))
+ return status;
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index b50f8f73fb478..0977ed356ed11 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -1913,14 +1913,21 @@ static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
+ break;
+ }
+
+- ret = sony_call_snc_handle(handle, probe_base, &result);
+- if (ret)
+- return ret;
++ /*
++ * Only probe if there is a separate probe_base, otherwise the probe call
++ * is equivalent to __sony_nc_kbd_backlight_mode_set(0), resulting in
++ * the keyboard backlight being turned off.
++ */
++ if (probe_base) {
++ ret = sony_call_snc_handle(handle, probe_base, &result);
++ if (ret)
++ return ret;
+
+- if ((handle == 0x0137 && !(result & 0x02)) ||
+- !(result & 0x01)) {
+- dprintk("no backlight keyboard found\n");
+- return 0;
++ if ((handle == 0x0137 && !(result & 0x02)) ||
++ !(result & 0x01)) {
++ dprintk("no backlight keyboard found\n");
++ return 0;
++ }
+ }
+
+ kbdbl_ctl = kzalloc(sizeof(*kbdbl_ctl), GFP_KERNEL);
+diff --git a/drivers/pnp/core.c b/drivers/pnp/core.c
+index 3bf18d7189750..131b925b820d2 100644
+--- a/drivers/pnp/core.c
++++ b/drivers/pnp/core.c
+@@ -160,14 +160,14 @@ struct pnp_dev *pnp_alloc_dev(struct pnp_protocol *protocol, int id,
+ dev->dev.coherent_dma_mask = dev->dma_mask;
+ dev->dev.release = &pnp_release_device;
+
+- dev_set_name(&dev->dev, "%02x:%02x", dev->protocol->number, dev->number);
+-
+ dev_id = pnp_add_id(dev, pnpid);
+ if (!dev_id) {
+ kfree(dev);
+ return NULL;
+ }
+
++ dev_set_name(&dev->dev, "%02x:%02x", dev->protocol->number, dev->number);
++
+ return dev;
+ }
+
+diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c
+index 8760477d0e8af..5ac122cd25b8c 100644
+--- a/drivers/power/avs/smartreflex.c
++++ b/drivers/power/avs/smartreflex.c
+@@ -984,6 +984,7 @@ static int omap_sr_probe(struct platform_device *pdev)
+ err_debugfs:
+ debugfs_remove_recursive(sr_info->dbg_dir);
+ err_list_del:
++ pm_runtime_disable(&pdev->dev);
+ list_del(&sr_info->node);
+
+ pm_runtime_put_sync(&pdev->dev);
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index e43a7b3b570c4..9b98921a3b16a 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -945,8 +945,8 @@ create_triggers_failed:
+ register_cooler_failed:
+ psy_unregister_thermal(psy);
+ register_thermal_failed:
+- device_del(dev);
+ wakeup_init_failed:
++ device_del(dev);
+ device_add_failed:
+ check_supplies_failed:
+ dev_set_name_failed:
+diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
+index a136a7ae77140..ee19c511adce4 100644
+--- a/drivers/rapidio/devices/rio_mport_cdev.c
++++ b/drivers/rapidio/devices/rio_mport_cdev.c
+@@ -1809,8 +1809,11 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
+ rio_init_dbell_res(&rdev->riores[RIO_DOORBELL_RESOURCE],
+ 0, 0xffff);
+ err = rio_add_device(rdev);
+- if (err)
+- goto cleanup;
++ if (err) {
++ put_device(&rdev->dev);
++ return err;
++ }
++
+ rio_dev_get(rdev);
+
+ return 0;
+@@ -1906,10 +1909,6 @@ static int mport_cdev_open(struct inode *inode, struct file *filp)
+
+ priv->md = chdev;
+
+- mutex_lock(&chdev->file_mutex);
+- list_add_tail(&priv->list, &chdev->file_list);
+- mutex_unlock(&chdev->file_mutex);
+-
+ INIT_LIST_HEAD(&priv->db_filters);
+ INIT_LIST_HEAD(&priv->pw_filters);
+ spin_lock_init(&priv->fifo_lock);
+@@ -1918,6 +1917,7 @@ static int mport_cdev_open(struct inode *inode, struct file *filp)
+ sizeof(struct rio_event) * MPORT_EVENT_DEPTH,
+ GFP_KERNEL);
+ if (ret < 0) {
++ put_device(&chdev->dev);
+ dev_err(&chdev->dev, DRV_NAME ": kfifo_alloc failed\n");
+ ret = -ENOMEM;
+ goto err_fifo;
+@@ -1928,6 +1928,9 @@ static int mport_cdev_open(struct inode *inode, struct file *filp)
+ spin_lock_init(&priv->req_lock);
+ mutex_init(&priv->dma_lock);
+ #endif
++ mutex_lock(&chdev->file_mutex);
++ list_add_tail(&priv->list, &chdev->file_list);
++ mutex_unlock(&chdev->file_mutex);
+
+ filp->private_data = priv;
+ goto out;
+diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c
+index fd7b517132ace..d2ddc173c5bd4 100644
+--- a/drivers/rapidio/rio-scan.c
++++ b/drivers/rapidio/rio-scan.c
+@@ -460,8 +460,12 @@ static struct rio_dev *rio_setup_device(struct rio_net *net,
+ 0, 0xffff);
+
+ ret = rio_add_device(rdev);
+- if (ret)
+- goto cleanup;
++ if (ret) {
++ if (rswitch)
++ kfree(rswitch->route_table);
++ put_device(&rdev->dev);
++ return NULL;
++ }
+
+ rio_dev_get(rdev);
+
+diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
+index 83406696c7aa7..4304142d87006 100644
+--- a/drivers/rapidio/rio.c
++++ b/drivers/rapidio/rio.c
+@@ -2271,11 +2271,16 @@ int rio_register_mport(struct rio_mport *port)
+ atomic_set(&port->state, RIO_DEVICE_RUNNING);
+
+ res = device_register(&port->dev);
+- if (res)
++ if (res) {
+ dev_err(&port->dev, "RIO: mport%d registration failed ERR=%d\n",
+ port->id, res);
+- else
++ mutex_lock(&rio_mport_list_lock);
++ list_del(&port->node);
++ mutex_unlock(&rio_mport_list_lock);
++ put_device(&port->dev);
++ } else {
+ dev_dbg(&port->dev, "RIO: registered mport%d\n", port->id);
++ }
+
+ return res;
+ }
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 045075cd256ce..11656b3836748 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1197,7 +1197,13 @@ static int set_machine_constraints(struct regulator_dev *rdev)
+ if (rdev->supply_name && !rdev->supply)
+ return -EPROBE_DEFER;
+
+- if (rdev->supply) {
++ /* If supplying regulator has already been enabled,
++ * it's not intended to have use_count increment
++ * when rdev is only boot-on.
++ */
++ if (rdev->supply &&
++ (rdev->constraints->always_on ||
++ !regulator_is_enabled(rdev->supply))) {
+ ret = regulator_enable(rdev->supply);
+ if (ret < 0) {
+ _regulator_put(rdev->supply);
+@@ -1241,6 +1247,7 @@ static int set_supply(struct regulator_dev *rdev,
+
+ rdev->supply = create_regulator(supply_rdev, &rdev->dev, "SUPPLY");
+ if (rdev->supply == NULL) {
++ module_put(supply_rdev->owner);
+ err = -ENOMEM;
+ return err;
+ }
+@@ -1541,6 +1548,7 @@ static struct regulator_dev *regulator_dev_lookup(struct device *dev,
+ node = of_get_regulator(dev, supply);
+ if (node) {
+ r = of_find_regulator_by_node(node);
++ of_node_put(node);
+ if (r)
+ return r;
+
+diff --git a/drivers/regulator/da9211-regulator.c b/drivers/regulator/da9211-regulator.c
+index 6c122b3df5d03..8847d15c2b90f 100644
+--- a/drivers/regulator/da9211-regulator.c
++++ b/drivers/regulator/da9211-regulator.c
+@@ -469,6 +469,12 @@ static int da9211_i2c_probe(struct i2c_client *i2c,
+
+ chip->chip_irq = i2c->irq;
+
++ ret = da9211_regulator_init(chip);
++ if (ret < 0) {
++ dev_err(chip->dev, "Failed to initialize regulator: %d\n", ret);
++ return ret;
++ }
++
+ if (chip->chip_irq != 0) {
+ ret = devm_request_threaded_irq(chip->dev, chip->chip_irq, NULL,
+ da9211_irq_handler,
+@@ -483,11 +489,6 @@ static int da9211_i2c_probe(struct i2c_client *i2c,
+ dev_warn(chip->dev, "No IRQ configured\n");
+ }
+
+- ret = da9211_regulator_init(chip);
+-
+- if (ret < 0)
+- dev_err(chip->dev, "Failed to initialize regulator: %d\n", ret);
+-
+ return ret;
+ }
+
+diff --git a/drivers/rtc/rtc-mxc_v2.c b/drivers/rtc/rtc-mxc_v2.c
+index 45c7366b72862..c16aa4a389e96 100644
+--- a/drivers/rtc/rtc-mxc_v2.c
++++ b/drivers/rtc/rtc-mxc_v2.c
+@@ -335,8 +335,10 @@ static int mxc_rtc_probe(struct platform_device *pdev)
+ }
+
+ pdata->rtc = devm_rtc_allocate_device(&pdev->dev);
+- if (IS_ERR(pdata->rtc))
++ if (IS_ERR(pdata->rtc)) {
++ clk_disable_unprepare(pdata->clk);
+ return PTR_ERR(pdata->rtc);
++ }
+
+ pdata->rtc->ops = &mxc_rtc_ops;
+ pdata->rtc->range_max = U32_MAX;
+diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
+index 3cf011e120530..b1e13f2877ada 100644
+--- a/drivers/rtc/rtc-snvs.c
++++ b/drivers/rtc/rtc-snvs.c
+@@ -32,6 +32,14 @@
+ #define SNVS_LPPGDR_INIT 0x41736166
+ #define CNTR_TO_SECS_SH 15
+
++/* The maximum RTC clock cycles that are allowed to pass between two
++ * consecutive clock counter register reads. If the values are corrupted a
++ * bigger difference is expected. The RTC frequency is 32kHz. With 320 cycles
++ * we end at 10ms which should be enough for most cases. If it once takes
++ * longer than expected we do a retry.
++ */
++#define MAX_RTC_READ_DIFF_CYCLES 320
++
+ struct snvs_rtc_data {
+ struct rtc_device *rtc;
+ struct regmap *regmap;
+@@ -56,6 +64,7 @@ static u64 rtc_read_lpsrt(struct snvs_rtc_data *data)
+ static u32 rtc_read_lp_counter(struct snvs_rtc_data *data)
+ {
+ u64 read1, read2;
++ s64 diff;
+ unsigned int timeout = 100;
+
+ /* As expected, the registers might update between the read of the LSB
+@@ -66,7 +75,8 @@ static u32 rtc_read_lp_counter(struct snvs_rtc_data *data)
+ do {
+ read2 = read1;
+ read1 = rtc_read_lpsrt(data);
+- } while (read1 != read2 && --timeout);
++ diff = read1 - read2;
++ } while (((diff < 0) || (diff > MAX_RTC_READ_DIFF_CYCLES)) && --timeout);
+ if (!timeout)
+ dev_err(&data->rtc->dev, "Timeout trying to get valid LPSRT Counter read\n");
+
+@@ -78,13 +88,15 @@ static u32 rtc_read_lp_counter(struct snvs_rtc_data *data)
+ static int rtc_read_lp_counter_lsb(struct snvs_rtc_data *data, u32 *lsb)
+ {
+ u32 count1, count2;
++ s32 diff;
+ unsigned int timeout = 100;
+
+ regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1);
+ do {
+ count2 = count1;
+ regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1);
+- } while (count1 != count2 && --timeout);
++ diff = count1 - count2;
++ } while (((diff < 0) || (diff > MAX_RTC_READ_DIFF_CYCLES)) && --timeout);
+ if (!timeout) {
+ dev_err(&data->rtc->dev, "Timeout trying to get valid LPSRT Counter read\n");
+ return -ETIMEDOUT;
+diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c
+index bee75ca7ff79b..e66439b6247a4 100644
+--- a/drivers/rtc/rtc-st-lpc.c
++++ b/drivers/rtc/rtc-st-lpc.c
+@@ -249,6 +249,7 @@ static int st_rtc_probe(struct platform_device *pdev)
+
+ rtc->clkrate = clk_get_rate(rtc->clk);
+ if (!rtc->clkrate) {
++ clk_disable_unprepare(rtc->clk);
+ dev_err(&pdev->dev, "Unable to fetch clock rate\n");
+ return -EINVAL;
+ }
+diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
+index f63c5c871d3dd..d9fdcdd6760b4 100644
+--- a/drivers/s390/net/ctcm_main.c
++++ b/drivers/s390/net/ctcm_main.c
+@@ -867,16 +867,9 @@ done:
+ /**
+ * Start transmission of a packet.
+ * Called from generic network device layer.
+- *
+- * skb Pointer to buffer containing the packet.
+- * dev Pointer to interface struct.
+- *
+- * returns 0 if packet consumed, !0 if packet rejected.
+- * Note: If we return !0, then the packet is free'd by
+- * the generic network layer.
+ */
+ /* first merge version - leaving both functions separated */
+-static int ctcm_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t ctcm_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ctcm_priv *priv = dev->ml_priv;
+
+@@ -919,7 +912,7 @@ static int ctcm_tx(struct sk_buff *skb, struct net_device *dev)
+ }
+
+ /* unmerged MPC variant of ctcm_tx */
+-static int ctcmpc_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t ctcmpc_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ int len = 0;
+ struct ctcm_priv *priv = dev->ml_priv;
+diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
+index d8f99ff53a94f..09e019d76bdd7 100644
+--- a/drivers/s390/net/lcs.c
++++ b/drivers/s390/net/lcs.c
+@@ -1518,9 +1518,8 @@ lcs_txbuffer_cb(struct lcs_channel *channel, struct lcs_buffer *buffer)
+ /**
+ * Packet transmit function called by network stack
+ */
+-static int
+-__lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb,
+- struct net_device *dev)
++static netdev_tx_t __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb,
++ struct net_device *dev)
+ {
+ struct lcs_header *header;
+ int rc = NETDEV_TX_OK;
+@@ -1581,8 +1580,7 @@ out:
+ return rc;
+ }
+
+-static int
+-lcs_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lcs_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lcs_card *card;
+ int rc;
+diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
+index 5ce2424ca7290..e2984b54447b7 100644
+--- a/drivers/s390/net/netiucv.c
++++ b/drivers/s390/net/netiucv.c
+@@ -1344,15 +1344,8 @@ out:
+ /**
+ * Start transmission of a packet.
+ * Called from generic network device layer.
+- *
+- * @param skb Pointer to buffer containing the packet.
+- * @param dev Pointer to interface struct.
+- *
+- * @return 0 if packet consumed, !0 if packet rejected.
+- * Note: If we return !0, then the packet is free'd by
+- * the generic network layer.
+ */
+-static int netiucv_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t netiucv_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct netiucv_priv *privptr = netdev_priv(dev);
+ int rc;
+diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
+index 6768b2e8148a2..c5c4805435f65 100644
+--- a/drivers/scsi/fcoe/fcoe.c
++++ b/drivers/scsi/fcoe/fcoe.c
+@@ -2519,6 +2519,7 @@ static int __init fcoe_init(void)
+
+ out_free:
+ mutex_unlock(&fcoe_config_mutex);
++ fcoe_transport_detach(&fcoe_sw_transport);
+ out_destroy:
+ destroy_workqueue(fcoe_wq);
+ return rc;
+diff --git a/drivers/scsi/fcoe/fcoe_sysfs.c b/drivers/scsi/fcoe/fcoe_sysfs.c
+index 5c8310bade619..dab025e3ed273 100644
+--- a/drivers/scsi/fcoe/fcoe_sysfs.c
++++ b/drivers/scsi/fcoe/fcoe_sysfs.c
+@@ -831,14 +831,15 @@ struct fcoe_ctlr_device *fcoe_ctlr_device_add(struct device *parent,
+
+ dev_set_name(&ctlr->dev, "ctlr_%d", ctlr->id);
+ error = device_register(&ctlr->dev);
+- if (error)
+- goto out_del_q2;
++ if (error) {
++ destroy_workqueue(ctlr->devloss_work_q);
++ destroy_workqueue(ctlr->work_q);
++ put_device(&ctlr->dev);
++ return NULL;
++ }
+
+ return ctlr;
+
+-out_del_q2:
+- destroy_workqueue(ctlr->devloss_work_q);
+- ctlr->devloss_work_q = NULL;
+ out_del_q:
+ destroy_workqueue(ctlr->work_q);
+ ctlr->work_q = NULL;
+@@ -1037,16 +1038,16 @@ struct fcoe_fcf_device *fcoe_fcf_device_add(struct fcoe_ctlr_device *ctlr,
+ fcf->selected = new_fcf->selected;
+
+ error = device_register(&fcf->dev);
+- if (error)
+- goto out_del;
++ if (error) {
++ put_device(&fcf->dev);
++ goto out;
++ }
+
+ fcf->state = FCOE_FCF_STATE_CONNECTED;
+ list_add_tail(&fcf->peers, &ctlr->fcfs);
+
+ return fcf;
+
+-out_del:
+- kfree(fcf);
+ out:
+ return NULL;
+ }
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 0fe21cbdf0ca7..13931c5c0eff2 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -8133,6 +8133,11 @@ static void hpsa_undo_allocations_after_kdump_soft_reset(struct ctlr_info *h)
+ destroy_workqueue(h->rescan_ctlr_wq);
+ h->rescan_ctlr_wq = NULL;
+ }
++ if (h->monitor_ctlr_wq) {
++ destroy_workqueue(h->monitor_ctlr_wq);
++ h->monitor_ctlr_wq = NULL;
++ }
++
+ kfree(h); /* init_one 1 */
+ }
+
+@@ -8481,8 +8486,8 @@ static void hpsa_event_monitor_worker(struct work_struct *work)
+
+ spin_lock_irqsave(&h->lock, flags);
+ if (!h->remove_in_progress)
+- schedule_delayed_work(&h->event_monitor_work,
+- HPSA_EVENT_MONITOR_INTERVAL);
++ queue_delayed_work(h->monitor_ctlr_wq, &h->event_monitor_work,
++ HPSA_EVENT_MONITOR_INTERVAL);
+ spin_unlock_irqrestore(&h->lock, flags);
+ }
+
+@@ -8527,7 +8532,7 @@ static void hpsa_monitor_ctlr_worker(struct work_struct *work)
+
+ spin_lock_irqsave(&h->lock, flags);
+ if (!h->remove_in_progress)
+- schedule_delayed_work(&h->monitor_ctlr_work,
++ queue_delayed_work(h->monitor_ctlr_wq, &h->monitor_ctlr_work,
+ h->heartbeat_sample_interval);
+ spin_unlock_irqrestore(&h->lock, flags);
+ }
+@@ -8695,6 +8700,12 @@ reinit_after_soft_reset:
+ goto clean7; /* aer/h */
+ }
+
++ h->monitor_ctlr_wq = hpsa_create_controller_wq(h, "monitor");
++ if (!h->monitor_ctlr_wq) {
++ rc = -ENOMEM;
++ goto clean7;
++ }
++
+ /*
+ * At this point, the controller is ready to take commands.
+ * Now, if reset_devices and the hard reset didn't work, try
+@@ -8826,7 +8837,11 @@ clean1: /* wq/aer/h */
+ destroy_workqueue(h->rescan_ctlr_wq);
+ h->rescan_ctlr_wq = NULL;
+ }
+- kfree(h);
++ if (h->monitor_ctlr_wq) {
++ destroy_workqueue(h->monitor_ctlr_wq);
++ h->monitor_ctlr_wq = NULL;
++ }
++ hpda_free_ctlr_info(h);
+ return rc;
+ }
+
+@@ -8973,6 +8988,7 @@ static void hpsa_remove_one(struct pci_dev *pdev)
+ cancel_delayed_work_sync(&h->event_monitor_work);
+ destroy_workqueue(h->rescan_ctlr_wq);
+ destroy_workqueue(h->resubmit_wq);
++ destroy_workqueue(h->monitor_ctlr_wq);
+
+ hpsa_delete_sas_host(h);
+
+@@ -9684,7 +9700,8 @@ static int hpsa_add_sas_host(struct ctlr_info *h)
+ return 0;
+
+ free_sas_phy:
+- hpsa_free_sas_phy(hpsa_sas_phy);
++ sas_phy_free(hpsa_sas_phy->phy);
++ kfree(hpsa_sas_phy);
+ free_sas_port:
+ hpsa_free_sas_port(hpsa_sas_port);
+ free_sas_node:
+@@ -9720,10 +9737,12 @@ static int hpsa_add_sas_device(struct hpsa_sas_node *hpsa_sas_node,
+
+ rc = hpsa_sas_port_add_rphy(hpsa_sas_port, rphy);
+ if (rc)
+- goto free_sas_port;
++ goto free_sas_rphy;
+
+ return 0;
+
++free_sas_rphy:
++ sas_rphy_free(rphy);
+ free_sas_port:
+ hpsa_free_sas_port(hpsa_sas_port);
+ device->sas_port = NULL;
+diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
+index 59e023696fffe..7aa7378f70ddb 100644
+--- a/drivers/scsi/hpsa.h
++++ b/drivers/scsi/hpsa.h
+@@ -300,6 +300,7 @@ struct ctlr_info {
+ int needs_abort_tags_swizzled;
+ struct workqueue_struct *resubmit_wq;
+ struct workqueue_struct *rescan_ctlr_wq;
++ struct workqueue_struct *monitor_ctlr_wq;
+ atomic_t abort_cmds_available;
+ wait_queue_head_t event_sync_wait_queue;
+ struct mutex reset_mutex;
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index c6cde552b995e..5989c868bfe08 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -10854,11 +10854,19 @@ static struct notifier_block ipr_notifier = {
+ **/
+ static int __init ipr_init(void)
+ {
++ int rc;
++
+ ipr_info("IBM Power RAID SCSI Device Driver version: %s %s\n",
+ IPR_DRIVER_VERSION, IPR_DRIVER_DATE);
+
+ register_reboot_notifier(&ipr_notifier);
+- return pci_register_driver(&ipr_driver);
++ rc = pci_register_driver(&ipr_driver);
++ if (rc) {
++ unregister_reboot_notifier(&ipr_notifier);
++ return rc;
++ }
++
++ return 0;
+ }
+
+ /**
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index 4d73a7f67dea9..0733ecc9f8781 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -3156,7 +3156,7 @@ static int resp_write_scat(struct scsi_cmnd *scp,
+ mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB, 0);
+ return illegal_condition_result;
+ }
+- lrdp = kzalloc(lbdof_blen, GFP_ATOMIC);
++ lrdp = kzalloc(lbdof_blen, GFP_ATOMIC | __GFP_NOWARN);
+ if (lrdp == NULL)
+ return SCSI_MLQUEUE_HOST_BUSY;
+ if (sdebug_verbose)
+diff --git a/drivers/scsi/snic/snic_disc.c b/drivers/scsi/snic/snic_disc.c
+index b106596cc0cf5..69c5e26a9d5b3 100644
+--- a/drivers/scsi/snic/snic_disc.c
++++ b/drivers/scsi/snic/snic_disc.c
+@@ -317,6 +317,9 @@ snic_tgt_create(struct snic *snic, struct snic_tgt_id *tgtid)
+ ret);
+
+ put_device(&snic->shost->shost_gendev);
++ spin_lock_irqsave(snic->shost->host_lock, flags);
++ list_del(&tgt->list);
++ spin_unlock_irqrestore(snic->shost->host_lock, flags);
+ kfree(tgt);
+ tgt = NULL;
+
+diff --git a/drivers/soc/qcom/Kconfig b/drivers/soc/qcom/Kconfig
+index ba79b609aca21..248759612d7df 100644
+--- a/drivers/soc/qcom/Kconfig
++++ b/drivers/soc/qcom/Kconfig
+@@ -16,6 +16,7 @@ config QCOM_COMMAND_DB
+ config QCOM_GENI_SE
+ tristate "QCOM GENI Serial Engine Driver"
+ depends on ARCH_QCOM || COMPILE_TEST
++ select REGMAP_MMIO
+ help
+ This driver is used to manage Generic Interface (GENI) firmware based
+ Qualcomm Technologies, Inc. Universal Peripheral (QUP) Wrapper. This
+diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
+index 9f5ce52e6c161..b264c36b2c0e3 100644
+--- a/drivers/soc/ti/knav_qmss_queue.c
++++ b/drivers/soc/ti/knav_qmss_queue.c
+@@ -72,7 +72,7 @@ static DEFINE_MUTEX(knav_dev_lock);
+ * Newest followed by older ones. Search is done from start of the array
+ * until a firmware file is found.
+ */
+-const char *knav_acc_firmwares[] = {"ks2_qmss_pdsp_acc48.bin"};
++static const char * const knav_acc_firmwares[] = {"ks2_qmss_pdsp_acc48.bin"};
+
+ static bool device_ready;
+ bool knav_qmss_device_ready(void)
+diff --git a/drivers/soc/ux500/ux500-soc-id.c b/drivers/soc/ux500/ux500-soc-id.c
+index 6c1be74e5fcc6..86a1a3c408df0 100644
+--- a/drivers/soc/ux500/ux500-soc-id.c
++++ b/drivers/soc/ux500/ux500-soc-id.c
+@@ -159,20 +159,18 @@ static ssize_t ux500_get_process(struct device *dev,
+ static const char *db8500_read_soc_id(struct device_node *backupram)
+ {
+ void __iomem *base;
+- void __iomem *uid;
+ const char *retstr;
++ u32 uid[5];
+
+ base = of_iomap(backupram, 0);
+ if (!base)
+ return NULL;
+- uid = base + 0x1fc0;
++ memcpy_fromio(uid, base + 0x1fc0, sizeof(uid));
+
+ /* Throw these device-specific numbers into the entropy pool */
+- add_device_randomness(uid, 0x14);
++ add_device_randomness(uid, sizeof(uid));
+ retstr = kasprintf(GFP_KERNEL, "%08x%08x%08x%08x%08x",
+- readl((u32 *)uid+0),
+- readl((u32 *)uid+1), readl((u32 *)uid+2),
+- readl((u32 *)uid+3), readl((u32 *)uid+4));
++ uid[0], uid[1], uid[2], uid[3], uid[4]);
+ iounmap(base);
+ return retstr;
+ }
+diff --git a/drivers/staging/rtl8192e/rtllib_rx.c b/drivers/staging/rtl8192e/rtllib_rx.c
+index 3bfd63fe4ac10..004d89853a68c 100644
+--- a/drivers/staging/rtl8192e/rtllib_rx.c
++++ b/drivers/staging/rtl8192e/rtllib_rx.c
+@@ -1500,9 +1500,9 @@ static int rtllib_rx_Monitor(struct rtllib_device *ieee, struct sk_buff *skb,
+ hdrlen += 4;
+ }
+
+- rtllib_monitor_rx(ieee, skb, rx_stats, hdrlen);
+ ieee->stats.rx_packets++;
+ ieee->stats.rx_bytes += skb->len;
++ rtllib_monitor_rx(ieee, skb, rx_stats, hdrlen);
+
+ return 1;
+ }
+diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
+index fb824c5174497..14b3daa5f17ee 100644
+--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
++++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
+@@ -961,9 +961,11 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+ #endif
+
+ if (ieee->iw_mode == IW_MODE_MONITOR) {
++ unsigned int len = skb->len;
++
+ ieee80211_monitor_rx(ieee, skb, rx_stats);
+ stats->rx_packets++;
+- stats->rx_bytes += skb->len;
++ stats->rx_bytes += len;
+ return 1;
+ }
+
+diff --git a/drivers/staging/wilc1000/wilc_sdio.c b/drivers/staging/wilc1000/wilc_sdio.c
+index e52c3bdeaf04b..b4d456f3fb1b9 100644
+--- a/drivers/staging/wilc1000/wilc_sdio.c
++++ b/drivers/staging/wilc1000/wilc_sdio.c
+@@ -18,6 +18,7 @@ static const struct sdio_device_id wilc_sdio_ids[] = {
+ { SDIO_DEVICE(SDIO_VENDOR_ID_WILC, SDIO_DEVICE_ID_WILC) },
+ { },
+ };
++MODULE_DEVICE_TABLE(sdio, wilc_sdio_ids);
+
+ #define WILC_SDIO_BLOCK_SIZE 512
+
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index 080adf7bcae43..47ffb485ff34c 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -52,17 +52,22 @@ static DEFINE_SPINLOCK(xencons_lock);
+
+ static struct xencons_info *vtermno_to_xencons(int vtermno)
+ {
+- struct xencons_info *entry, *n, *ret = NULL;
++ struct xencons_info *entry, *ret = NULL;
++ unsigned long flags;
+
+- if (list_empty(&xenconsoles))
+- return NULL;
++ spin_lock_irqsave(&xencons_lock, flags);
++ if (list_empty(&xenconsoles)) {
++ spin_unlock_irqrestore(&xencons_lock, flags);
++ return NULL;
++ }
+
+- list_for_each_entry_safe(entry, n, &xenconsoles, list) {
++ list_for_each_entry(entry, &xenconsoles, list) {
+ if (entry->vtermno == vtermno) {
+ ret = entry;
+ break;
+ }
+ }
++ spin_unlock_irqrestore(&xencons_lock, flags);
+
+ return ret;
+ }
+@@ -223,7 +228,7 @@ static int xen_hvm_console_init(void)
+ {
+ int r;
+ uint64_t v = 0;
+- unsigned long gfn;
++ unsigned long gfn, flags;
+ struct xencons_info *info;
+
+ if (!xen_hvm_domain())
+@@ -258,9 +263,9 @@ static int xen_hvm_console_init(void)
+ goto err;
+ info->vtermno = HVC_COOKIE;
+
+- spin_lock(&xencons_lock);
++ spin_lock_irqsave(&xencons_lock, flags);
+ list_add_tail(&info->list, &xenconsoles);
+- spin_unlock(&xencons_lock);
++ spin_unlock_irqrestore(&xencons_lock, flags);
+
+ return 0;
+ err:
+@@ -283,6 +288,7 @@ static int xencons_info_pv_init(struct xencons_info *info, int vtermno)
+ static int xen_pv_console_init(void)
+ {
+ struct xencons_info *info;
++ unsigned long flags;
+
+ if (!xen_pv_domain())
+ return -ENODEV;
+@@ -299,9 +305,9 @@ static int xen_pv_console_init(void)
+ /* already configured */
+ return 0;
+ }
+- spin_lock(&xencons_lock);
++ spin_lock_irqsave(&xencons_lock, flags);
+ xencons_info_pv_init(info, HVC_COOKIE);
+- spin_unlock(&xencons_lock);
++ spin_unlock_irqrestore(&xencons_lock, flags);
+
+ return 0;
+ }
+@@ -309,6 +315,7 @@ static int xen_pv_console_init(void)
+ static int xen_initial_domain_console_init(void)
+ {
+ struct xencons_info *info;
++ unsigned long flags;
+
+ if (!xen_initial_domain())
+ return -ENODEV;
+@@ -323,9 +330,9 @@ static int xen_initial_domain_console_init(void)
+ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
+ info->vtermno = HVC_COOKIE;
+
+- spin_lock(&xencons_lock);
++ spin_lock_irqsave(&xencons_lock, flags);
+ list_add_tail(&info->list, &xenconsoles);
+- spin_unlock(&xencons_lock);
++ spin_unlock_irqrestore(&xencons_lock, flags);
+
+ return 0;
+ }
+@@ -380,10 +387,12 @@ static void xencons_free(struct xencons_info *info)
+
+ static int xen_console_remove(struct xencons_info *info)
+ {
++ unsigned long flags;
++
+ xencons_disconnect_backend(info);
+- spin_lock(&xencons_lock);
++ spin_lock_irqsave(&xencons_lock, flags);
+ list_del(&info->list);
+- spin_unlock(&xencons_lock);
++ spin_unlock_irqrestore(&xencons_lock, flags);
+ if (info->xbdev != NULL)
+ xencons_free(info);
+ else {
+@@ -464,6 +473,7 @@ static int xencons_probe(struct xenbus_device *dev,
+ {
+ int ret, devid;
+ struct xencons_info *info;
++ unsigned long flags;
+
+ devid = dev->nodename[strlen(dev->nodename) - 1] - '0';
+ if (devid == 0)
+@@ -482,9 +492,9 @@ static int xencons_probe(struct xenbus_device *dev,
+ ret = xencons_connect_backend(dev, info);
+ if (ret < 0)
+ goto error;
+- spin_lock(&xencons_lock);
++ spin_lock_irqsave(&xencons_lock, flags);
+ list_add_tail(&info->list, &xenconsoles);
+- spin_unlock(&xencons_lock);
++ spin_unlock_irqrestore(&xencons_lock, flags);
+
+ return 0;
+
+@@ -583,10 +593,12 @@ static int __init xen_hvc_init(void)
+
+ info->hvc = hvc_alloc(HVC_COOKIE, info->irq, ops, 256);
+ if (IS_ERR(info->hvc)) {
++ unsigned long flags;
++
+ r = PTR_ERR(info->hvc);
+- spin_lock(&xencons_lock);
++ spin_lock_irqsave(&xencons_lock, flags);
+ list_del(&info->list);
+- spin_unlock(&xencons_lock);
++ spin_unlock_irqrestore(&xencons_lock, flags);
+ if (info->irq)
+ unbind_from_irqhandler(info->irq, NULL);
+ kfree(info);
+diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
+index 0e487ce091ac9..d91f76b1d353e 100644
+--- a/drivers/tty/serial/altera_uart.c
++++ b/drivers/tty/serial/altera_uart.c
+@@ -199,9 +199,8 @@ static void altera_uart_set_termios(struct uart_port *port,
+ */
+ }
+
+-static void altera_uart_rx_chars(struct altera_uart *pp)
++static void altera_uart_rx_chars(struct uart_port *port)
+ {
+- struct uart_port *port = &pp->port;
+ unsigned char ch, flag;
+ unsigned short status;
+
+@@ -248,9 +247,8 @@ static void altera_uart_rx_chars(struct altera_uart *pp)
+ spin_lock(&port->lock);
+ }
+
+-static void altera_uart_tx_chars(struct altera_uart *pp)
++static void altera_uart_tx_chars(struct uart_port *port)
+ {
+- struct uart_port *port = &pp->port;
+ struct circ_buf *xmit = &port->state->xmit;
+
+ if (port->x_char) {
+@@ -274,26 +272,25 @@ static void altera_uart_tx_chars(struct altera_uart *pp)
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(port);
+
+- if (xmit->head == xmit->tail) {
+- pp->imr &= ~ALTERA_UART_CONTROL_TRDY_MSK;
+- altera_uart_update_ctrl_reg(pp);
+- }
++ if (uart_circ_empty(xmit))
++ altera_uart_stop_tx(port);
+ }
+
+ static irqreturn_t altera_uart_interrupt(int irq, void *data)
+ {
+ struct uart_port *port = data;
+ struct altera_uart *pp = container_of(port, struct altera_uart, port);
++ unsigned long flags;
+ unsigned int isr;
+
+ isr = altera_uart_readl(port, ALTERA_UART_STATUS_REG) & pp->imr;
+
+- spin_lock(&port->lock);
++ spin_lock_irqsave(&port->lock, flags);
+ if (isr & ALTERA_UART_STATUS_RRDY_MSK)
+- altera_uart_rx_chars(pp);
++ altera_uart_rx_chars(port);
+ if (isr & ALTERA_UART_STATUS_TRDY_MSK)
+- altera_uart_tx_chars(pp);
+- spin_unlock(&port->lock);
++ altera_uart_tx_chars(port);
++ spin_unlock_irqrestore(&port->lock, flags);
+
+ return IRQ_RETVAL(isr);
+ }
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index 7de4bed1ddba7..d1f4882d9f403 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1053,6 +1053,9 @@ static void pl011_dma_rx_callback(void *data)
+ */
+ static inline void pl011_dma_rx_stop(struct uart_amba_port *uap)
+ {
++ if (!uap->using_rx_dma)
++ return;
++
+ /* FIXME. Just disable the DMA enable */
+ uap->dmacr &= ~UART011_RXDMAE;
+ pl011_write(uap->dmacr, uap, REG_DMACR);
+@@ -1768,8 +1771,17 @@ static void pl011_enable_interrupts(struct uart_amba_port *uap)
+ static void pl011_unthrottle_rx(struct uart_port *port)
+ {
+ struct uart_amba_port *uap = container_of(port, struct uart_amba_port, port);
++ unsigned long flags;
+
+- pl011_enable_interrupts(uap);
++ spin_lock_irqsave(&uap->port.lock, flags);
++
++ uap->im = UART011_RTIM;
++ if (!pl011_dma_rx_running(uap))
++ uap->im |= UART011_RXIM;
++
++ pl011_write(uap->im, uap, REG_IMSC);
++
++ spin_unlock_irqrestore(&uap->port.lock, flags);
+ }
+
+ static int pl011_startup(struct uart_port *port)
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index e5ff30544bd0d..447990006d688 100644
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -734,6 +734,7 @@ static void pch_request_dma(struct uart_port *port)
+ if (!chan) {
+ dev_err(priv->port.dev, "%s:dma_request_channel FAILS(Tx)\n",
+ __func__);
++ pci_dev_put(dma_dev);
+ return;
+ }
+ priv->chan_tx = chan;
+@@ -750,6 +751,7 @@ static void pch_request_dma(struct uart_port *port)
+ __func__);
+ dma_release_channel(priv->chan_tx);
+ priv->chan_tx = NULL;
++ pci_dev_put(dma_dev);
+ return;
+ }
+
+@@ -757,6 +759,8 @@ static void pch_request_dma(struct uart_port *port)
+ priv->rx_buf_virt = dma_alloc_coherent(port->dev, port->fifosize,
+ &priv->rx_buf_dma, GFP_KERNEL);
+ priv->chan_rx = chan;
++
++ pci_dev_put(dma_dev);
+ }
+
+ static void pch_dma_rx_complete(void *arg)
+diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
+index ee480a1480e86..41fe45f2349ef 100644
+--- a/drivers/tty/serial/serial-tegra.c
++++ b/drivers/tty/serial/serial-tegra.c
+@@ -62,7 +62,7 @@
+ #define TEGRA_UART_TX_TRIG_4B 0x20
+ #define TEGRA_UART_TX_TRIG_1B 0x30
+
+-#define TEGRA_UART_MAXIMUM 5
++#define TEGRA_UART_MAXIMUM 8
+
+ /* Default UART setting when started: 115200 no parity, stop, 8 data bits */
+ #define TEGRA_UART_DEFAULT_BAUD 115200
+@@ -72,6 +72,8 @@
+ #define TEGRA_TX_PIO 1
+ #define TEGRA_TX_DMA 2
+
++#define TEGRA_UART_FCR_IIR_FIFO_EN 0x40
++
+ /**
+ * tegra_uart_chip_data: SOC specific data.
+ *
+@@ -84,6 +86,17 @@ struct tegra_uart_chip_data {
+ bool tx_fifo_full_status;
+ bool allow_txfifo_reset_fifo_mode;
+ bool support_clk_src_div;
++ bool fifo_mode_enable_status;
++ int uart_max_port;
++ int max_dma_burst_bytes;
++ int error_tolerance_low_range;
++ int error_tolerance_high_range;
++};
++
++struct tegra_baud_tolerance {
++ u32 lower_range_baud;
++ u32 upper_range_baud;
++ s32 tolerance;
+ };
+
+ struct tegra_uart_port {
+@@ -122,10 +135,19 @@ struct tegra_uart_port {
+ dma_cookie_t rx_cookie;
+ unsigned int tx_bytes_requested;
+ unsigned int rx_bytes_requested;
++ struct tegra_baud_tolerance *baud_tolerance;
++ int n_adjustable_baud_rates;
++ int required_rate;
++ int configured_rate;
++ bool use_rx_pio;
++ bool use_tx_pio;
++ bool rx_dma_active;
+ };
+
+ static void tegra_uart_start_next_tx(struct tegra_uart_port *tup);
+ static int tegra_uart_start_rx_dma(struct tegra_uart_port *tup);
++static void tegra_uart_dma_channel_free(struct tegra_uart_port *tup,
++ bool dma_to_memory);
+
+ static inline unsigned long tegra_uart_read(struct tegra_uart_port *tup,
+ unsigned long reg)
+@@ -243,6 +265,21 @@ static void tegra_uart_wait_sym_time(struct tegra_uart_port *tup,
+ tup->current_baud));
+ }
+
++static int tegra_uart_wait_fifo_mode_enabled(struct tegra_uart_port *tup)
++{
++ unsigned long iir;
++ unsigned int tmout = 100;
++
++ do {
++ iir = tegra_uart_read(tup, UART_IIR);
++ if (iir & TEGRA_UART_FCR_IIR_FIFO_EN)
++ return 0;
++ udelay(1);
++ } while (--tmout);
++
++ return -ETIMEDOUT;
++}
++
+ static void tegra_uart_fifo_reset(struct tegra_uart_port *tup, u8 fcr_bits)
+ {
+ unsigned long fcr = tup->fcr_shadow;
+@@ -258,6 +295,8 @@ static void tegra_uart_fifo_reset(struct tegra_uart_port *tup, u8 fcr_bits)
+ tegra_uart_write(tup, fcr, UART_FCR);
+ fcr |= UART_FCR_ENABLE_FIFO;
+ tegra_uart_write(tup, fcr, UART_FCR);
++ if (tup->cdata->fifo_mode_enable_status)
++ tegra_uart_wait_fifo_mode_enabled(tup);
+ }
+
+ /* Dummy read to ensure the write is posted */
+@@ -271,6 +310,37 @@ static void tegra_uart_fifo_reset(struct tegra_uart_port *tup, u8 fcr_bits)
+ tegra_uart_wait_cycle_time(tup, 32);
+ }
+
++static long tegra_get_tolerance_rate(struct tegra_uart_port *tup,
++ unsigned int baud, long rate)
++{
++ int i;
++
++ for (i = 0; i < tup->n_adjustable_baud_rates; ++i) {
++ if (baud >= tup->baud_tolerance[i].lower_range_baud &&
++ baud <= tup->baud_tolerance[i].upper_range_baud)
++ return (rate + (rate *
++ tup->baud_tolerance[i].tolerance) / 10000);
++ }
++
++ return rate;
++}
++
++static int tegra_check_rate_in_range(struct tegra_uart_port *tup)
++{
++ long diff;
++
++ diff = ((long)(tup->configured_rate - tup->required_rate) * 10000)
++ / tup->required_rate;
++ if (diff < (tup->cdata->error_tolerance_low_range * 100) ||
++ diff > (tup->cdata->error_tolerance_high_range * 100)) {
++ dev_err(tup->uport.dev,
++ "configured baud rate is out of range by %ld", diff);
++ return -EIO;
++ }
++
++ return 0;
++}
++
+ static int tegra_set_baudrate(struct tegra_uart_port *tup, unsigned int baud)
+ {
+ unsigned long rate;
+@@ -283,13 +353,22 @@ static int tegra_set_baudrate(struct tegra_uart_port *tup, unsigned int baud)
+
+ if (tup->cdata->support_clk_src_div) {
+ rate = baud * 16;
++ tup->required_rate = rate;
++
++ if (tup->n_adjustable_baud_rates)
++ rate = tegra_get_tolerance_rate(tup, baud, rate);
++
+ ret = clk_set_rate(tup->uart_clk, rate);
+ if (ret < 0) {
+ dev_err(tup->uport.dev,
+ "clk_set_rate() failed for rate %lu\n", rate);
+ return ret;
+ }
++ tup->configured_rate = clk_get_rate(tup->uart_clk);
+ divisor = 1;
++ ret = tegra_check_rate_in_range(tup);
++ if (ret < 0)
++ return ret;
+ } else {
+ rate = clk_get_rate(tup->uart_clk);
+ divisor = DIV_ROUND_CLOSEST(rate, baud * 16);
+@@ -440,12 +519,15 @@ static void tegra_uart_start_next_tx(struct tegra_uart_port *tup)
+ unsigned long count;
+ struct circ_buf *xmit = &tup->uport.state->xmit;
+
++ if (!tup->current_baud)
++ return;
++
+ tail = (unsigned long)&xmit->buf[xmit->tail];
+ count = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE);
+ if (!count)
+ return;
+
+- if (count < TEGRA_UART_MIN_DMA)
++ if (tup->use_tx_pio || count < TEGRA_UART_MIN_DMA)
+ tegra_uart_start_pio_tx(tup, count);
+ else if (BYTES_TO_ALIGN(tail) > 0)
+ tegra_uart_start_pio_tx(tup, BYTES_TO_ALIGN(tail));
+@@ -488,8 +570,9 @@ static void tegra_uart_stop_tx(struct uart_port *u)
+ if (tup->tx_in_progress != TEGRA_UART_TX_DMA)
+ return;
+
+- dmaengine_terminate_all(tup->tx_dma_chan);
++ dmaengine_pause(tup->tx_dma_chan);
+ dmaengine_tx_status(tup->tx_dma_chan, tup->tx_cookie, &state);
++ dmaengine_terminate_all(tup->tx_dma_chan);
+ count = tup->tx_bytes_requested - state.residue;
+ async_tx_ack(tup->tx_dma_desc);
+ uart_xmit_advance(&tup->uport, count);
+@@ -555,11 +638,22 @@ static void tegra_uart_copy_rx_to_tty(struct tegra_uart_port *tup,
+ TEGRA_UART_RX_DMA_BUFFER_SIZE, DMA_TO_DEVICE);
+ }
+
++static void do_handle_rx_pio(struct tegra_uart_port *tup)
++{
++ struct tty_struct *tty = tty_port_tty_get(&tup->uport.state->port);
++ struct tty_port *port = &tup->uport.state->port;
++
++ tegra_uart_handle_rx_pio(tup, port);
++ if (tty) {
++ tty_flip_buffer_push(port);
++ tty_kref_put(tty);
++ }
++}
++
+ static void tegra_uart_rx_buffer_push(struct tegra_uart_port *tup,
+ unsigned int residue)
+ {
+ struct tty_port *port = &tup->uport.state->port;
+- struct tty_struct *tty = tty_port_tty_get(port);
+ unsigned int count;
+
+ async_tx_ack(tup->rx_dma_desc);
+@@ -568,11 +662,7 @@ static void tegra_uart_rx_buffer_push(struct tegra_uart_port *tup,
+ /* If we are here, DMA is stopped */
+ tegra_uart_copy_rx_to_tty(tup, port, count);
+
+- tegra_uart_handle_rx_pio(tup, port);
+- if (tty) {
+- tty_flip_buffer_push(port);
+- tty_kref_put(tty);
+- }
++ do_handle_rx_pio(tup);
+ }
+
+ static void tegra_uart_rx_dma_complete(void *args)
+@@ -596,6 +686,7 @@ static void tegra_uart_rx_dma_complete(void *args)
+ if (tup->rts_active)
+ set_rts(tup, false);
+
++ tup->rx_dma_active = false;
+ tegra_uart_rx_buffer_push(tup, 0);
+ tegra_uart_start_rx_dma(tup);
+
+@@ -607,18 +698,30 @@ done:
+ spin_unlock_irqrestore(&u->lock, flags);
+ }
+
+-static void tegra_uart_handle_rx_dma(struct tegra_uart_port *tup)
++static void tegra_uart_terminate_rx_dma(struct tegra_uart_port *tup)
+ {
+ struct dma_tx_state state;
+
++ if (!tup->rx_dma_active) {
++ do_handle_rx_pio(tup);
++ return;
++ }
++
++ dmaengine_pause(tup->rx_dma_chan);
++ dmaengine_tx_status(tup->rx_dma_chan, tup->rx_cookie, &state);
++ dmaengine_terminate_all(tup->rx_dma_chan);
++
++ tegra_uart_rx_buffer_push(tup, state.residue);
++ tup->rx_dma_active = false;
++}
++
++static void tegra_uart_handle_rx_dma(struct tegra_uart_port *tup)
++{
+ /* Deactivate flow control to stop sender */
+ if (tup->rts_active)
+ set_rts(tup, false);
+
+- dmaengine_terminate_all(tup->rx_dma_chan);
+- dmaengine_tx_status(tup->rx_dma_chan, tup->rx_cookie, &state);
+- tegra_uart_rx_buffer_push(tup, state.residue);
+- tegra_uart_start_rx_dma(tup);
++ tegra_uart_terminate_rx_dma(tup);
+
+ if (tup->rts_active)
+ set_rts(tup, true);
+@@ -628,6 +731,9 @@ static int tegra_uart_start_rx_dma(struct tegra_uart_port *tup)
+ {
+ unsigned int count = TEGRA_UART_RX_DMA_BUFFER_SIZE;
+
++ if (tup->rx_dma_active)
++ return 0;
++
+ tup->rx_dma_desc = dmaengine_prep_slave_single(tup->rx_dma_chan,
+ tup->rx_dma_buf_phys, count, DMA_DEV_TO_MEM,
+ DMA_PREP_INTERRUPT);
+@@ -636,6 +742,7 @@ static int tegra_uart_start_rx_dma(struct tegra_uart_port *tup)
+ return -EIO;
+ }
+
++ tup->rx_dma_active = true;
+ tup->rx_dma_desc->callback = tegra_uart_rx_dma_complete;
+ tup->rx_dma_desc->callback_param = tup;
+ dma_sync_single_for_device(tup->uport.dev, tup->rx_dma_buf_phys,
+@@ -673,6 +780,7 @@ static irqreturn_t tegra_uart_isr(int irq, void *data)
+ struct uart_port *u = &tup->uport;
+ unsigned long iir;
+ unsigned long ier;
++ bool is_rx_start = false;
+ bool is_rx_int = false;
+ unsigned long flags;
+
+@@ -680,15 +788,17 @@ static irqreturn_t tegra_uart_isr(int irq, void *data)
+ while (1) {
+ iir = tegra_uart_read(tup, UART_IIR);
+ if (iir & UART_IIR_NO_INT) {
+- if (is_rx_int) {
++ if (!tup->use_rx_pio && is_rx_int) {
+ tegra_uart_handle_rx_dma(tup);
+ if (tup->rx_in_progress) {
+ ier = tup->ier_shadow;
+ ier |= (UART_IER_RLSI | UART_IER_RTOIE |
+- TEGRA_UART_IER_EORD);
++ TEGRA_UART_IER_EORD | UART_IER_RDI);
+ tup->ier_shadow = ier;
+ tegra_uart_write(tup, ier, UART_IER);
+ }
++ } else if (is_rx_start) {
++ tegra_uart_start_rx_dma(tup);
+ }
+ spin_unlock_irqrestore(&u->lock, flags);
+ return IRQ_HANDLED;
+@@ -707,17 +817,25 @@ static irqreturn_t tegra_uart_isr(int irq, void *data)
+
+ case 4: /* End of data */
+ case 6: /* Rx timeout */
+- case 2: /* Receive */
+- if (!is_rx_int) {
+- is_rx_int = true;
++ if (!tup->use_rx_pio) {
++ is_rx_int = tup->rx_in_progress;
+ /* Disable Rx interrupts */
+ ier = tup->ier_shadow;
+- ier |= UART_IER_RDI;
+- tegra_uart_write(tup, ier, UART_IER);
+ ier &= ~(UART_IER_RDI | UART_IER_RLSI |
+ UART_IER_RTOIE | TEGRA_UART_IER_EORD);
+ tup->ier_shadow = ier;
+ tegra_uart_write(tup, ier, UART_IER);
++ break;
++ }
++ /* Fall through */
++ case 2: /* Receive */
++ if (!tup->use_rx_pio) {
++ is_rx_start = tup->rx_in_progress;
++ tup->ier_shadow &= ~UART_IER_RDI;
++ tegra_uart_write(tup, tup->ier_shadow,
++ UART_IER);
++ } else {
++ do_handle_rx_pio(tup);
+ }
+ break;
+
+@@ -736,7 +854,7 @@ static irqreturn_t tegra_uart_isr(int irq, void *data)
+ static void tegra_uart_stop_rx(struct uart_port *u)
+ {
+ struct tegra_uart_port *tup = to_tegra_uport(u);
+- struct dma_tx_state state;
++ struct tty_port *port = &tup->uport.state->port;
+ unsigned long ier;
+
+ if (tup->rts_active)
+@@ -753,9 +871,11 @@ static void tegra_uart_stop_rx(struct uart_port *u)
+ tup->ier_shadow = ier;
+ tegra_uart_write(tup, ier, UART_IER);
+ tup->rx_in_progress = 0;
+- dmaengine_terminate_all(tup->rx_dma_chan);
+- dmaengine_tx_status(tup->rx_dma_chan, tup->rx_cookie, &state);
+- tegra_uart_rx_buffer_push(tup, state.residue);
++
++ if (!tup->use_rx_pio)
++ tegra_uart_terminate_rx_dma(tup);
++ else
++ tegra_uart_handle_rx_pio(tup, port);
+ }
+
+ static void tegra_uart_hw_deinit(struct tegra_uart_port *tup)
+@@ -803,6 +923,14 @@ static void tegra_uart_hw_deinit(struct tegra_uart_port *tup)
+ tup->current_baud = 0;
+ spin_unlock_irqrestore(&tup->uport.lock, flags);
+
++ tup->rx_in_progress = 0;
++ tup->tx_in_progress = 0;
++
++ if (!tup->use_rx_pio)
++ tegra_uart_dma_channel_free(tup, true);
++ if (!tup->use_tx_pio)
++ tegra_uart_dma_channel_free(tup, false);
++
+ clk_disable_unprepare(tup->uart_clk);
+ }
+
+@@ -845,45 +973,62 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup)
+ * programmed in the DMA registers.
+ */
+ tup->fcr_shadow = UART_FCR_ENABLE_FIFO;
+- tup->fcr_shadow |= UART_FCR_R_TRIG_01;
++
++ if (tup->use_rx_pio) {
++ tup->fcr_shadow |= UART_FCR_R_TRIG_11;
++ } else {
++ if (tup->cdata->max_dma_burst_bytes == 8)
++ tup->fcr_shadow |= UART_FCR_R_TRIG_10;
++ else
++ tup->fcr_shadow |= UART_FCR_R_TRIG_01;
++ }
++
+ tup->fcr_shadow |= TEGRA_UART_TX_TRIG_16B;
+ tegra_uart_write(tup, tup->fcr_shadow, UART_FCR);
+
+ /* Dummy read to ensure the write is posted */
+ tegra_uart_read(tup, UART_SCR);
+
+- /*
+- * For all tegra devices (up to t210), there is a hardware issue that
+- * requires software to wait for 3 UART clock periods after enabling
+- * the TX fifo, otherwise data could be lost.
+- */
+- tegra_uart_wait_cycle_time(tup, 3);
++ if (tup->cdata->fifo_mode_enable_status) {
++ ret = tegra_uart_wait_fifo_mode_enabled(tup);
++ if (ret < 0) {
++ dev_err(tup->uport.dev,
++ "Failed to enable FIFO mode: %d\n", ret);
++ return ret;
++ }
++ } else {
++ /*
++ * For all tegra devices (up to t210), there is a hardware
++ * issue that requires software to wait for 3 UART clock
++ * periods after enabling the TX fifo, otherwise data could
++ * be lost.
++ */
++ tegra_uart_wait_cycle_time(tup, 3);
++ }
+
+ /*
+ * Initialize the UART with default configuration
+ * (115200, N, 8, 1) so that the receive DMA buffer may be
+ * enqueued
+ */
+- tup->lcr_shadow = TEGRA_UART_DEFAULT_LSR;
+- tegra_set_baudrate(tup, TEGRA_UART_DEFAULT_BAUD);
+- tup->fcr_shadow |= UART_FCR_DMA_SELECT;
+- tegra_uart_write(tup, tup->fcr_shadow, UART_FCR);
+-
+- ret = tegra_uart_start_rx_dma(tup);
++ ret = tegra_set_baudrate(tup, TEGRA_UART_DEFAULT_BAUD);
+ if (ret < 0) {
+- dev_err(tup->uport.dev, "Not able to start Rx DMA\n");
++ dev_err(tup->uport.dev, "Failed to set baud rate\n");
+ return ret;
+ }
++ if (!tup->use_rx_pio) {
++ tup->lcr_shadow = TEGRA_UART_DEFAULT_LSR;
++ tup->fcr_shadow |= UART_FCR_DMA_SELECT;
++ tegra_uart_write(tup, tup->fcr_shadow, UART_FCR);
++ } else {
++ tegra_uart_write(tup, tup->fcr_shadow, UART_FCR);
++ }
+ tup->rx_in_progress = 1;
+
+ /*
+ * Enable IE_RXS for the receive status interrupts like line errros.
+ * Enable IE_RX_TIMEOUT to get the bytes which cannot be DMA'd.
+ *
+- * If using DMA mode, enable EORD instead of receive interrupt which
+- * will interrupt after the UART is done with the receive instead of
+- * the interrupt when the FIFO "threshold" is reached.
+- *
+ * EORD is different interrupt than RX_TIMEOUT - RX_TIMEOUT occurs when
+ * the DATA is sitting in the FIFO and couldn't be transferred to the
+ * DMA as the DMA size alignment(4 bytes) is not met. EORD will be
+@@ -894,7 +1039,15 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup)
+ * both the EORD as well as RX_TIMEOUT - SW sees RX_TIMEOUT first
+ * then the EORD.
+ */
+- tup->ier_shadow = UART_IER_RLSI | UART_IER_RTOIE | TEGRA_UART_IER_EORD;
++ tup->ier_shadow = UART_IER_RLSI | UART_IER_RTOIE | UART_IER_RDI;
++
++ /*
++ * If using DMA mode, enable EORD interrupt to notify about RX
++ * completion.
++ */
++ if (!tup->use_rx_pio)
++ tup->ier_shadow |= TEGRA_UART_IER_EORD;
++
+ tegra_uart_write(tup, tup->ier_shadow, UART_IER);
+ return 0;
+ }
+@@ -951,7 +1104,7 @@ static int tegra_uart_dma_channel_allocate(struct tegra_uart_port *tup,
+ }
+ dma_sconfig.src_addr = tup->uport.mapbase;
+ dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE;
+- dma_sconfig.src_maxburst = 4;
++ dma_sconfig.src_maxburst = tup->cdata->max_dma_burst_bytes;
+ tup->rx_dma_chan = dma_chan;
+ tup->rx_dma_buf_virt = dma_buf;
+ tup->rx_dma_buf_phys = dma_phys;
+@@ -989,16 +1142,22 @@ static int tegra_uart_startup(struct uart_port *u)
+ struct tegra_uart_port *tup = to_tegra_uport(u);
+ int ret;
+
+- ret = tegra_uart_dma_channel_allocate(tup, false);
+- if (ret < 0) {
+- dev_err(u->dev, "Tx Dma allocation failed, err = %d\n", ret);
+- return ret;
++ if (!tup->use_tx_pio) {
++ ret = tegra_uart_dma_channel_allocate(tup, false);
++ if (ret < 0) {
++ dev_err(u->dev, "Tx Dma allocation failed, err = %d\n",
++ ret);
++ return ret;
++ }
+ }
+
+- ret = tegra_uart_dma_channel_allocate(tup, true);
+- if (ret < 0) {
+- dev_err(u->dev, "Rx Dma allocation failed, err = %d\n", ret);
+- goto fail_rx_dma;
++ if (!tup->use_rx_pio) {
++ ret = tegra_uart_dma_channel_allocate(tup, true);
++ if (ret < 0) {
++ dev_err(u->dev, "Rx Dma allocation failed, err = %d\n",
++ ret);
++ goto fail_rx_dma;
++ }
+ }
+
+ ret = tegra_uart_hw_init(tup);
+@@ -1016,9 +1175,11 @@ static int tegra_uart_startup(struct uart_port *u)
+ return 0;
+
+ fail_hw_init:
+- tegra_uart_dma_channel_free(tup, true);
++ if (!tup->use_rx_pio)
++ tegra_uart_dma_channel_free(tup, true);
+ fail_rx_dma:
+- tegra_uart_dma_channel_free(tup, false);
++ if (!tup->use_tx_pio)
++ tegra_uart_dma_channel_free(tup, false);
+ return ret;
+ }
+
+@@ -1040,12 +1201,6 @@ static void tegra_uart_shutdown(struct uart_port *u)
+ struct tegra_uart_port *tup = to_tegra_uport(u);
+
+ tegra_uart_hw_deinit(tup);
+-
+- tup->rx_in_progress = 0;
+- tup->tx_in_progress = 0;
+-
+- tegra_uart_dma_channel_free(tup, true);
+- tegra_uart_dma_channel_free(tup, false);
+ free_irq(u->irq, tup);
+ }
+
+@@ -1070,6 +1225,7 @@ static void tegra_uart_set_termios(struct uart_port *u,
+ struct clk *parent_clk = clk_get_parent(tup->uart_clk);
+ unsigned long parent_clk_rate = clk_get_rate(parent_clk);
+ int max_divider = (tup->cdata->support_clk_src_div) ? 0x7FFF : 0xFFFF;
++ int ret;
+
+ max_divider *= 16;
+ spin_lock_irqsave(&u->lock, flags);
+@@ -1142,7 +1298,11 @@ static void tegra_uart_set_termios(struct uart_port *u,
+ parent_clk_rate/max_divider,
+ parent_clk_rate/16);
+ spin_unlock_irqrestore(&u->lock, flags);
+- tegra_set_baudrate(tup, baud);
++ ret = tegra_set_baudrate(tup, baud);
++ if (ret < 0) {
++ dev_err(tup->uport.dev, "Failed to set baud rate\n");
++ return;
++ }
+ if (tty_termios_baud_rate(termios))
+ tty_termios_encode_baud_rate(termios, baud, baud);
+ spin_lock_irqsave(&u->lock, flags);
+@@ -1210,6 +1370,11 @@ static int tegra_uart_parse_dt(struct platform_device *pdev,
+ {
+ struct device_node *np = pdev->dev.of_node;
+ int port;
++ int ret;
++ int index;
++ u32 pval;
++ int count;
++ int n_entries;
+
+ port = of_alias_get_id(np, "serial");
+ if (port < 0) {
+@@ -1220,6 +1385,54 @@ static int tegra_uart_parse_dt(struct platform_device *pdev,
+
+ tup->enable_modem_interrupt = of_property_read_bool(np,
+ "nvidia,enable-modem-interrupt");
++
++ index = of_property_match_string(np, "dma-names", "rx");
++ if (index < 0) {
++ tup->use_rx_pio = true;
++ dev_info(&pdev->dev, "RX in PIO mode\n");
++ }
++ index = of_property_match_string(np, "dma-names", "tx");
++ if (index < 0) {
++ tup->use_tx_pio = true;
++ dev_info(&pdev->dev, "TX in PIO mode\n");
++ }
++
++ n_entries = of_property_count_u32_elems(np, "nvidia,adjust-baud-rates");
++ if (n_entries > 0) {
++ tup->n_adjustable_baud_rates = n_entries / 3;
++ tup->baud_tolerance =
++ devm_kzalloc(&pdev->dev, (tup->n_adjustable_baud_rates) *
++ sizeof(*tup->baud_tolerance), GFP_KERNEL);
++ if (!tup->baud_tolerance)
++ return -ENOMEM;
++ for (count = 0, index = 0; count < n_entries; count += 3,
++ index++) {
++ ret =
++ of_property_read_u32_index(np,
++ "nvidia,adjust-baud-rates",
++ count, &pval);
++ if (!ret)
++ tup->baud_tolerance[index].lower_range_baud =
++ pval;
++ ret =
++ of_property_read_u32_index(np,
++ "nvidia,adjust-baud-rates",
++ count + 1, &pval);
++ if (!ret)
++ tup->baud_tolerance[index].upper_range_baud =
++ pval;
++ ret =
++ of_property_read_u32_index(np,
++ "nvidia,adjust-baud-rates",
++ count + 2, &pval);
++ if (!ret)
++ tup->baud_tolerance[index].tolerance =
++ (s32)pval;
++ }
++ } else {
++ tup->n_adjustable_baud_rates = 0;
++ }
++
+ return 0;
+ }
+
+@@ -1227,12 +1440,44 @@ static struct tegra_uart_chip_data tegra20_uart_chip_data = {
+ .tx_fifo_full_status = false,
+ .allow_txfifo_reset_fifo_mode = true,
+ .support_clk_src_div = false,
++ .fifo_mode_enable_status = false,
++ .uart_max_port = 5,
++ .max_dma_burst_bytes = 4,
++ .error_tolerance_low_range = -4,
++ .error_tolerance_high_range = 4,
+ };
+
+ static struct tegra_uart_chip_data tegra30_uart_chip_data = {
+ .tx_fifo_full_status = true,
+ .allow_txfifo_reset_fifo_mode = false,
+ .support_clk_src_div = true,
++ .fifo_mode_enable_status = false,
++ .uart_max_port = 5,
++ .max_dma_burst_bytes = 4,
++ .error_tolerance_low_range = -4,
++ .error_tolerance_high_range = 4,
++};
++
++static struct tegra_uart_chip_data tegra186_uart_chip_data = {
++ .tx_fifo_full_status = true,
++ .allow_txfifo_reset_fifo_mode = false,
++ .support_clk_src_div = true,
++ .fifo_mode_enable_status = true,
++ .uart_max_port = 8,
++ .max_dma_burst_bytes = 8,
++ .error_tolerance_low_range = 0,
++ .error_tolerance_high_range = 4,
++};
++
++static struct tegra_uart_chip_data tegra194_uart_chip_data = {
++ .tx_fifo_full_status = true,
++ .allow_txfifo_reset_fifo_mode = false,
++ .support_clk_src_div = true,
++ .fifo_mode_enable_status = true,
++ .uart_max_port = 8,
++ .max_dma_burst_bytes = 8,
++ .error_tolerance_low_range = -2,
++ .error_tolerance_high_range = 2,
+ };
+
+ static const struct of_device_id tegra_uart_of_match[] = {
+@@ -1242,6 +1487,12 @@ static const struct of_device_id tegra_uart_of_match[] = {
+ }, {
+ .compatible = "nvidia,tegra20-hsuart",
+ .data = &tegra20_uart_chip_data,
++ }, {
++ .compatible = "nvidia,tegra186-hsuart",
++ .data = &tegra186_uart_chip_data,
++ }, {
++ .compatible = "nvidia,tegra194-hsuart",
++ .data = &tegra194_uart_chip_data,
+ }, {
+ },
+ };
+@@ -1364,11 +1615,22 @@ static struct platform_driver tegra_uart_platform_driver = {
+ static int __init tegra_uart_init(void)
+ {
+ int ret;
++ struct device_node *node;
++ const struct of_device_id *match = NULL;
++ const struct tegra_uart_chip_data *cdata = NULL;
++
++ node = of_find_matching_node(NULL, tegra_uart_of_match);
++ if (node)
++ match = of_match_node(tegra_uart_of_match, node);
++ if (match)
++ cdata = match->data;
++ if (cdata)
++ tegra_uart_driver.nr = cdata->uart_max_port;
+
+ ret = uart_register_driver(&tegra_uart_driver);
+ if (ret < 0) {
+ pr_err("Could not register %s driver\n",
+- tegra_uart_driver.driver_name);
++ tegra_uart_driver.driver_name);
+ return ret;
+ }
+
+diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
+index 72131b5e132eb..beca02c304988 100644
+--- a/drivers/tty/serial/sunsab.c
++++ b/drivers/tty/serial/sunsab.c
+@@ -1140,7 +1140,13 @@ static int __init sunsab_init(void)
+ }
+ }
+
+- return platform_driver_register(&sab_driver);
++ err = platform_driver_register(&sab_driver);
++ if (err) {
++ kfree(sunsab_ports);
++ sunsab_ports = NULL;
++ }
++
++ return err;
+ }
+
+ static void __exit sunsab_exit(void)
+diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c
+index a00b4aee6c799..b4b7fa05b29bc 100644
+--- a/drivers/uio/uio_dmem_genirq.c
++++ b/drivers/uio/uio_dmem_genirq.c
+@@ -113,8 +113,10 @@ static irqreturn_t uio_dmem_genirq_handler(int irq, struct uio_info *dev_info)
+ * remember the state so we can allow user space to enable it later.
+ */
+
++ spin_lock(&priv->lock);
+ if (!test_and_set_bit(0, &priv->flags))
+ disable_irq_nosync(irq);
++ spin_unlock(&priv->lock);
+
+ return IRQ_HANDLED;
+ }
+@@ -128,20 +130,19 @@ static int uio_dmem_genirq_irqcontrol(struct uio_info *dev_info, s32 irq_on)
+ * in the interrupt controller, but keep track of the
+ * state to prevent per-irq depth damage.
+ *
+- * Serialize this operation to support multiple tasks.
++ * Serialize this operation to support multiple tasks and concurrency
++ * with irq handler on SMP systems.
+ */
+
+ spin_lock_irqsave(&priv->lock, flags);
+ if (irq_on) {
+ if (test_and_clear_bit(0, &priv->flags))
+ enable_irq(dev_info->irq);
+- spin_unlock_irqrestore(&priv->lock, flags);
+ } else {
+- if (!test_and_set_bit(0, &priv->flags)) {
+- spin_unlock_irqrestore(&priv->lock, flags);
+- disable_irq(dev_info->irq);
+- }
++ if (!test_and_set_bit(0, &priv->flags))
++ disable_irq_nosync(dev_info->irq);
+ }
++ spin_unlock_irqrestore(&priv->lock, flags);
+
+ return 0;
+ }
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 465aabb6e96c8..65caee589e677 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -914,8 +914,13 @@ static int dwc3_core_init(struct dwc3 *dwc)
+
+ if (!dwc->ulpi_ready) {
+ ret = dwc3_core_ulpi_init(dwc);
+- if (ret)
++ if (ret) {
++ if (ret == -ETIMEDOUT) {
++ dwc3_core_soft_reset(dwc);
++ ret = -EPROBE_DEFER;
++ }
+ goto err0;
++ }
+ dwc->ulpi_ready = true;
+ }
+
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index 1d10d29c115bc..ea877cba0763e 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -45,12 +45,25 @@ struct f_hidg {
+ unsigned short report_desc_length;
+ char *report_desc;
+ unsigned short report_length;
++ /*
++ * use_out_ep - if true, the OUT Endpoint (interrupt out method)
++ * will be used to receive reports from the host
++ * using functions with the "intout" suffix.
++ * Otherwise, the OUT Endpoint will not be configured
++ * and the SETUP/SET_REPORT method ("ssreport" suffix)
++ * will be used to receive reports.
++ */
++ bool use_out_ep;
+
+ /* recv report */
+- struct list_head completed_out_req;
+ spinlock_t read_spinlock;
+ wait_queue_head_t read_queue;
++ /* recv report - interrupt out only (use_out_ep == 1) */
++ struct list_head completed_out_req;
+ unsigned int qlen;
++ /* recv report - setup set_report only (use_out_ep == 0) */
++ char *set_report_buf;
++ unsigned int set_report_length;
+
+ /* send report */
+ spinlock_t write_spinlock;
+@@ -58,7 +71,7 @@ struct f_hidg {
+ wait_queue_head_t write_queue;
+ struct usb_request *req;
+
+- int minor;
++ struct device dev;
+ struct cdev cdev;
+ struct usb_function func;
+
+@@ -71,6 +84,14 @@ static inline struct f_hidg *func_to_hidg(struct usb_function *f)
+ return container_of(f, struct f_hidg, func);
+ }
+
++static void hidg_release(struct device *dev)
++{
++ struct f_hidg *hidg = container_of(dev, struct f_hidg, dev);
++
++ kfree(hidg->set_report_buf);
++ kfree(hidg);
++}
++
+ /*-------------------------------------------------------------------------*/
+ /* Static descriptors */
+
+@@ -79,7 +100,7 @@ static struct usb_interface_descriptor hidg_interface_desc = {
+ .bDescriptorType = USB_DT_INTERFACE,
+ /* .bInterfaceNumber = DYNAMIC */
+ .bAlternateSetting = 0,
+- .bNumEndpoints = 2,
++ /* .bNumEndpoints = DYNAMIC (depends on use_out_ep) */
+ .bInterfaceClass = USB_CLASS_HID,
+ /* .bInterfaceSubClass = DYNAMIC */
+ /* .bInterfaceProtocol = DYNAMIC */
+@@ -140,7 +161,7 @@ static struct usb_ss_ep_comp_descriptor hidg_ss_out_comp_desc = {
+ /* .wBytesPerInterval = DYNAMIC */
+ };
+
+-static struct usb_descriptor_header *hidg_ss_descriptors[] = {
++static struct usb_descriptor_header *hidg_ss_descriptors_intout[] = {
+ (struct usb_descriptor_header *)&hidg_interface_desc,
+ (struct usb_descriptor_header *)&hidg_desc,
+ (struct usb_descriptor_header *)&hidg_ss_in_ep_desc,
+@@ -150,6 +171,14 @@ static struct usb_descriptor_header *hidg_ss_descriptors[] = {
+ NULL,
+ };
+
++static struct usb_descriptor_header *hidg_ss_descriptors_ssreport[] = {
++ (struct usb_descriptor_header *)&hidg_interface_desc,
++ (struct usb_descriptor_header *)&hidg_desc,
++ (struct usb_descriptor_header *)&hidg_ss_in_ep_desc,
++ (struct usb_descriptor_header *)&hidg_ss_in_comp_desc,
++ NULL,
++};
++
+ /* High-Speed Support */
+
+ static struct usb_endpoint_descriptor hidg_hs_in_ep_desc = {
+@@ -176,7 +205,7 @@ static struct usb_endpoint_descriptor hidg_hs_out_ep_desc = {
+ */
+ };
+
+-static struct usb_descriptor_header *hidg_hs_descriptors[] = {
++static struct usb_descriptor_header *hidg_hs_descriptors_intout[] = {
+ (struct usb_descriptor_header *)&hidg_interface_desc,
+ (struct usb_descriptor_header *)&hidg_desc,
+ (struct usb_descriptor_header *)&hidg_hs_in_ep_desc,
+@@ -184,6 +213,13 @@ static struct usb_descriptor_header *hidg_hs_descriptors[] = {
+ NULL,
+ };
+
++static struct usb_descriptor_header *hidg_hs_descriptors_ssreport[] = {
++ (struct usb_descriptor_header *)&hidg_interface_desc,
++ (struct usb_descriptor_header *)&hidg_desc,
++ (struct usb_descriptor_header *)&hidg_hs_in_ep_desc,
++ NULL,
++};
++
+ /* Full-Speed Support */
+
+ static struct usb_endpoint_descriptor hidg_fs_in_ep_desc = {
+@@ -210,7 +246,7 @@ static struct usb_endpoint_descriptor hidg_fs_out_ep_desc = {
+ */
+ };
+
+-static struct usb_descriptor_header *hidg_fs_descriptors[] = {
++static struct usb_descriptor_header *hidg_fs_descriptors_intout[] = {
+ (struct usb_descriptor_header *)&hidg_interface_desc,
+ (struct usb_descriptor_header *)&hidg_desc,
+ (struct usb_descriptor_header *)&hidg_fs_in_ep_desc,
+@@ -218,6 +254,13 @@ static struct usb_descriptor_header *hidg_fs_descriptors[] = {
+ NULL,
+ };
+
++static struct usb_descriptor_header *hidg_fs_descriptors_ssreport[] = {
++ (struct usb_descriptor_header *)&hidg_interface_desc,
++ (struct usb_descriptor_header *)&hidg_desc,
++ (struct usb_descriptor_header *)&hidg_fs_in_ep_desc,
++ NULL,
++};
++
+ /*-------------------------------------------------------------------------*/
+ /* Strings */
+
+@@ -241,8 +284,8 @@ static struct usb_gadget_strings *ct_func_strings[] = {
+ /*-------------------------------------------------------------------------*/
+ /* Char Device */
+
+-static ssize_t f_hidg_read(struct file *file, char __user *buffer,
+- size_t count, loff_t *ptr)
++static ssize_t f_hidg_intout_read(struct file *file, char __user *buffer,
++ size_t count, loff_t *ptr)
+ {
+ struct f_hidg *hidg = file->private_data;
+ struct f_hidg_req_list *list;
+@@ -258,15 +301,15 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer,
+
+ spin_lock_irqsave(&hidg->read_spinlock, flags);
+
+-#define READ_COND (!list_empty(&hidg->completed_out_req))
++#define READ_COND_INTOUT (!list_empty(&hidg->completed_out_req))
+
+ /* wait for at least one buffer to complete */
+- while (!READ_COND) {
++ while (!READ_COND_INTOUT) {
+ spin_unlock_irqrestore(&hidg->read_spinlock, flags);
+ if (file->f_flags & O_NONBLOCK)
+ return -EAGAIN;
+
+- if (wait_event_interruptible(hidg->read_queue, READ_COND))
++ if (wait_event_interruptible(hidg->read_queue, READ_COND_INTOUT))
+ return -ERESTARTSYS;
+
+ spin_lock_irqsave(&hidg->read_spinlock, flags);
+@@ -316,6 +359,60 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer,
+ return count;
+ }
+
++#define READ_COND_SSREPORT (hidg->set_report_buf != NULL)
++
++static ssize_t f_hidg_ssreport_read(struct file *file, char __user *buffer,
++ size_t count, loff_t *ptr)
++{
++ struct f_hidg *hidg = file->private_data;
++ char *tmp_buf = NULL;
++ unsigned long flags;
++
++ if (!count)
++ return 0;
++
++ spin_lock_irqsave(&hidg->read_spinlock, flags);
++
++ while (!READ_COND_SSREPORT) {
++ spin_unlock_irqrestore(&hidg->read_spinlock, flags);
++ if (file->f_flags & O_NONBLOCK)
++ return -EAGAIN;
++
++ if (wait_event_interruptible(hidg->read_queue, READ_COND_SSREPORT))
++ return -ERESTARTSYS;
++
++ spin_lock_irqsave(&hidg->read_spinlock, flags);
++ }
++
++ count = min_t(unsigned int, count, hidg->set_report_length);
++ tmp_buf = hidg->set_report_buf;
++ hidg->set_report_buf = NULL;
++
++ spin_unlock_irqrestore(&hidg->read_spinlock, flags);
++
++ if (tmp_buf != NULL) {
++ count -= copy_to_user(buffer, tmp_buf, count);
++ kfree(tmp_buf);
++ } else {
++ count = -ENOMEM;
++ }
++
++ wake_up(&hidg->read_queue);
++
++ return count;
++}
++
++static ssize_t f_hidg_read(struct file *file, char __user *buffer,
++ size_t count, loff_t *ptr)
++{
++ struct f_hidg *hidg = file->private_data;
++
++ if (hidg->use_out_ep)
++ return f_hidg_intout_read(file, buffer, count, ptr);
++ else
++ return f_hidg_ssreport_read(file, buffer, count, ptr);
++}
++
+ static void f_hidg_req_complete(struct usb_ep *ep, struct usb_request *req)
+ {
+ struct f_hidg *hidg = (struct f_hidg *)ep->driver_data;
+@@ -439,14 +536,20 @@ static __poll_t f_hidg_poll(struct file *file, poll_table *wait)
+ if (WRITE_COND)
+ ret |= EPOLLOUT | EPOLLWRNORM;
+
+- if (READ_COND)
+- ret |= EPOLLIN | EPOLLRDNORM;
++ if (hidg->use_out_ep) {
++ if (READ_COND_INTOUT)
++ ret |= EPOLLIN | EPOLLRDNORM;
++ } else {
++ if (READ_COND_SSREPORT)
++ ret |= EPOLLIN | EPOLLRDNORM;
++ }
+
+ return ret;
+ }
+
+ #undef WRITE_COND
+-#undef READ_COND
++#undef READ_COND_SSREPORT
++#undef READ_COND_INTOUT
+
+ static int f_hidg_release(struct inode *inode, struct file *fd)
+ {
+@@ -473,7 +576,7 @@ static inline struct usb_request *hidg_alloc_ep_req(struct usb_ep *ep,
+ return alloc_ep_req(ep, length);
+ }
+
+-static void hidg_set_report_complete(struct usb_ep *ep, struct usb_request *req)
++static void hidg_intout_complete(struct usb_ep *ep, struct usb_request *req)
+ {
+ struct f_hidg *hidg = (struct f_hidg *) req->context;
+ struct usb_composite_dev *cdev = hidg->func.config->cdev;
+@@ -508,6 +611,37 @@ free_req:
+ }
+ }
+
++static void hidg_ssreport_complete(struct usb_ep *ep, struct usb_request *req)
++{
++ struct f_hidg *hidg = (struct f_hidg *)req->context;
++ struct usb_composite_dev *cdev = hidg->func.config->cdev;
++ char *new_buf = NULL;
++ unsigned long flags;
++
++ if (req->status != 0 || req->buf == NULL || req->actual == 0) {
++ ERROR(cdev,
++ "%s FAILED: status=%d, buf=%p, actual=%d\n",
++ __func__, req->status, req->buf, req->actual);
++ return;
++ }
++
++ spin_lock_irqsave(&hidg->read_spinlock, flags);
++
++ new_buf = krealloc(hidg->set_report_buf, req->actual, GFP_ATOMIC);
++ if (new_buf == NULL) {
++ spin_unlock_irqrestore(&hidg->read_spinlock, flags);
++ return;
++ }
++ hidg->set_report_buf = new_buf;
++
++ hidg->set_report_length = req->actual;
++ memcpy(hidg->set_report_buf, req->buf, req->actual);
++
++ spin_unlock_irqrestore(&hidg->read_spinlock, flags);
++
++ wake_up(&hidg->read_queue);
++}
++
+ static int hidg_setup(struct usb_function *f,
+ const struct usb_ctrlrequest *ctrl)
+ {
+@@ -555,7 +689,11 @@ static int hidg_setup(struct usb_function *f,
+ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
+ | HID_REQ_SET_REPORT):
+ VDBG(cdev, "set_report | wLength=%d\n", ctrl->wLength);
+- goto stall;
++ if (hidg->use_out_ep)
++ goto stall;
++ req->complete = hidg_ssreport_complete;
++ req->context = hidg;
++ goto respond;
+ break;
+
+ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8
+@@ -643,15 +781,18 @@ static void hidg_disable(struct usb_function *f)
+ unsigned long flags;
+
+ usb_ep_disable(hidg->in_ep);
+- usb_ep_disable(hidg->out_ep);
+
+- spin_lock_irqsave(&hidg->read_spinlock, flags);
+- list_for_each_entry_safe(list, next, &hidg->completed_out_req, list) {
+- free_ep_req(hidg->out_ep, list->req);
+- list_del(&list->list);
+- kfree(list);
++ if (hidg->out_ep) {
++ usb_ep_disable(hidg->out_ep);
++
++ spin_lock_irqsave(&hidg->read_spinlock, flags);
++ list_for_each_entry_safe(list, next, &hidg->completed_out_req, list) {
++ free_ep_req(hidg->out_ep, list->req);
++ list_del(&list->list);
++ kfree(list);
++ }
++ spin_unlock_irqrestore(&hidg->read_spinlock, flags);
+ }
+- spin_unlock_irqrestore(&hidg->read_spinlock, flags);
+
+ spin_lock_irqsave(&hidg->write_spinlock, flags);
+ if (!hidg->write_pending) {
+@@ -697,8 +838,7 @@ static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+ }
+ }
+
+-
+- if (hidg->out_ep != NULL) {
++ if (hidg->use_out_ep && hidg->out_ep != NULL) {
+ /* restart endpoint */
+ usb_ep_disable(hidg->out_ep);
+
+@@ -723,7 +863,7 @@ static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+ hidg_alloc_ep_req(hidg->out_ep,
+ hidg->report_length);
+ if (req) {
+- req->complete = hidg_set_report_complete;
++ req->complete = hidg_intout_complete;
+ req->context = hidg;
+ status = usb_ep_queue(hidg->out_ep, req,
+ GFP_ATOMIC);
+@@ -749,7 +889,8 @@ static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+ }
+ return 0;
+ disable_out_ep:
+- usb_ep_disable(hidg->out_ep);
++ if (hidg->out_ep)
++ usb_ep_disable(hidg->out_ep);
+ free_req_in:
+ if (req_in)
+ free_ep_req(hidg->in_ep, req_in);
+@@ -777,9 +918,7 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
+ struct usb_ep *ep;
+ struct f_hidg *hidg = func_to_hidg(f);
+ struct usb_string *us;
+- struct device *device;
+ int status;
+- dev_t dev;
+
+ /* maybe allocate device-global string IDs, and patch descriptors */
+ us = usb_gstrings_attach(c->cdev, ct_func_strings,
+@@ -801,14 +940,21 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
+ goto fail;
+ hidg->in_ep = ep;
+
+- ep = usb_ep_autoconfig(c->cdev->gadget, &hidg_fs_out_ep_desc);
+- if (!ep)
+- goto fail;
+- hidg->out_ep = ep;
++ hidg->out_ep = NULL;
++ if (hidg->use_out_ep) {
++ ep = usb_ep_autoconfig(c->cdev->gadget, &hidg_fs_out_ep_desc);
++ if (!ep)
++ goto fail;
++ hidg->out_ep = ep;
++ }
++
++ /* used only if use_out_ep == 1 */
++ hidg->set_report_buf = NULL;
+
+ /* set descriptor dynamic values */
+ hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass;
+ hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol;
++ hidg_interface_desc.bNumEndpoints = hidg->use_out_ep ? 2 : 1;
+ hidg->protocol = HID_REPORT_PROTOCOL;
+ hidg->idle = 1;
+ hidg_ss_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length);
+@@ -839,9 +985,19 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
+ hidg_ss_out_ep_desc.bEndpointAddress =
+ hidg_fs_out_ep_desc.bEndpointAddress;
+
+- status = usb_assign_descriptors(f, hidg_fs_descriptors,
+- hidg_hs_descriptors, hidg_ss_descriptors,
+- hidg_ss_descriptors);
++ if (hidg->use_out_ep)
++ status = usb_assign_descriptors(f,
++ hidg_fs_descriptors_intout,
++ hidg_hs_descriptors_intout,
++ hidg_ss_descriptors_intout,
++ hidg_ss_descriptors_intout);
++ else
++ status = usb_assign_descriptors(f,
++ hidg_fs_descriptors_ssreport,
++ hidg_hs_descriptors_ssreport,
++ hidg_ss_descriptors_ssreport,
++ hidg_ss_descriptors_ssreport);
++
+ if (status)
+ goto fail;
+
+@@ -855,21 +1011,11 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
+
+ /* create char device */
+ cdev_init(&hidg->cdev, &f_hidg_fops);
+- dev = MKDEV(major, hidg->minor);
+- status = cdev_add(&hidg->cdev, dev, 1);
++ status = cdev_device_add(&hidg->cdev, &hidg->dev);
+ if (status)
+ goto fail_free_descs;
+
+- device = device_create(hidg_class, NULL, dev, NULL,
+- "%s%d", "hidg", hidg->minor);
+- if (IS_ERR(device)) {
+- status = PTR_ERR(device);
+- goto del;
+- }
+-
+ return 0;
+-del:
+- cdev_del(&hidg->cdev);
+ fail_free_descs:
+ usb_free_all_descriptors(f);
+ fail:
+@@ -956,6 +1102,7 @@ CONFIGFS_ATTR(f_hid_opts_, name)
+
+ F_HID_OPT(subclass, 8, 255);
+ F_HID_OPT(protocol, 8, 255);
++F_HID_OPT(no_out_endpoint, 8, 1);
+ F_HID_OPT(report_length, 16, 65535);
+
+ static ssize_t f_hid_opts_report_desc_show(struct config_item *item, char *page)
+@@ -1015,6 +1162,7 @@ CONFIGFS_ATTR_RO(f_hid_opts_, dev);
+ static struct configfs_attribute *hid_attrs[] = {
+ &f_hid_opts_attr_subclass,
+ &f_hid_opts_attr_protocol,
++ &f_hid_opts_attr_no_out_endpoint,
+ &f_hid_opts_attr_report_length,
+ &f_hid_opts_attr_report_desc,
+ &f_hid_opts_attr_dev,
+@@ -1098,8 +1246,7 @@ static void hidg_free(struct usb_function *f)
+
+ hidg = func_to_hidg(f);
+ opts = container_of(f->fi, struct f_hid_opts, func_inst);
+- kfree(hidg->report_desc);
+- kfree(hidg);
++ put_device(&hidg->dev);
+ mutex_lock(&opts->lock);
+ --opts->refcnt;
+ mutex_unlock(&opts->lock);
+@@ -1109,8 +1256,7 @@ static void hidg_unbind(struct usb_configuration *c, struct usb_function *f)
+ {
+ struct f_hidg *hidg = func_to_hidg(f);
+
+- device_destroy(hidg_class, MKDEV(major, hidg->minor));
+- cdev_del(&hidg->cdev);
++ cdev_device_del(&hidg->cdev, &hidg->dev);
+
+ usb_free_all_descriptors(f);
+ }
+@@ -1119,6 +1265,7 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
+ {
+ struct f_hidg *hidg;
+ struct f_hid_opts *opts;
++ int ret;
+
+ /* allocate and initialize one new instance */
+ hidg = kzalloc(sizeof(*hidg), GFP_KERNEL);
+@@ -1130,21 +1277,33 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
+ mutex_lock(&opts->lock);
+ ++opts->refcnt;
+
+- hidg->minor = opts->minor;
++ device_initialize(&hidg->dev);
++ hidg->dev.release = hidg_release;
++ hidg->dev.class = hidg_class;
++ hidg->dev.devt = MKDEV(major, opts->minor);
++ ret = dev_set_name(&hidg->dev, "hidg%d", opts->minor);
++ if (ret) {
++ --opts->refcnt;
++ mutex_unlock(&opts->lock);
++ return ERR_PTR(ret);
++ }
++
+ hidg->bInterfaceSubClass = opts->subclass;
+ hidg->bInterfaceProtocol = opts->protocol;
+ hidg->report_length = opts->report_length;
+ hidg->report_desc_length = opts->report_desc_length;
+ if (opts->report_desc) {
+- hidg->report_desc = kmemdup(opts->report_desc,
+- opts->report_desc_length,
+- GFP_KERNEL);
++ hidg->report_desc = devm_kmemdup(&hidg->dev, opts->report_desc,
++ opts->report_desc_length,
++ GFP_KERNEL);
+ if (!hidg->report_desc) {
+- kfree(hidg);
++ put_device(&hidg->dev);
++ --opts->refcnt;
+ mutex_unlock(&opts->lock);
+ return ERR_PTR(-ENOMEM);
+ }
+ }
++ hidg->use_out_ep = !opts->no_out_endpoint;
+
+ mutex_unlock(&opts->lock);
+
+diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
+index 169e73ed128c8..21893c891c4f8 100644
+--- a/drivers/usb/gadget/function/f_uvc.c
++++ b/drivers/usb/gadget/function/f_uvc.c
+@@ -219,8 +219,9 @@ uvc_function_ep0_complete(struct usb_ep *ep, struct usb_request *req)
+
+ memset(&v4l2_event, 0, sizeof(v4l2_event));
+ v4l2_event.type = UVC_EVENT_DATA;
+- uvc_event->data.length = req->actual;
+- memcpy(&uvc_event->data.data, req->buf, req->actual);
++ uvc_event->data.length = min_t(unsigned int, req->actual,
++ sizeof(uvc_event->data.data));
++ memcpy(&uvc_event->data.data, req->buf, uvc_event->data.length);
+ v4l2_event_queue(&uvc->vdev, &v4l2_event);
+ }
+ }
+diff --git a/drivers/usb/gadget/function/u_hid.h b/drivers/usb/gadget/function/u_hid.h
+index 2f5ca4bfa7ff1..c090eb6c9759e 100644
+--- a/drivers/usb/gadget/function/u_hid.h
++++ b/drivers/usb/gadget/function/u_hid.h
+@@ -20,6 +20,7 @@ struct f_hid_opts {
+ int minor;
+ unsigned char subclass;
+ unsigned char protocol;
++ unsigned char no_out_endpoint;
+ unsigned short report_length;
+ unsigned short report_desc_length;
+ unsigned char *report_desc;
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index 785822ecc3f1a..74c93fa7439c2 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -633,10 +633,10 @@ static void fotg210_request_error(struct fotg210_udc *fotg210)
+ static void fotg210_set_address(struct fotg210_udc *fotg210,
+ struct usb_ctrlrequest *ctrl)
+ {
+- if (ctrl->wValue >= 0x0100) {
++ if (le16_to_cpu(ctrl->wValue) >= 0x0100) {
+ fotg210_request_error(fotg210);
+ } else {
+- fotg210_set_dev_addr(fotg210, ctrl->wValue);
++ fotg210_set_dev_addr(fotg210, le16_to_cpu(ctrl->wValue));
+ fotg210_set_cxdone(fotg210);
+ }
+ }
+@@ -717,17 +717,17 @@ static void fotg210_get_status(struct fotg210_udc *fotg210,
+
+ switch (ctrl->bRequestType & USB_RECIP_MASK) {
+ case USB_RECIP_DEVICE:
+- fotg210->ep0_data = 1 << USB_DEVICE_SELF_POWERED;
++ fotg210->ep0_data = cpu_to_le16(1 << USB_DEVICE_SELF_POWERED);
+ break;
+ case USB_RECIP_INTERFACE:
+- fotg210->ep0_data = 0;
++ fotg210->ep0_data = cpu_to_le16(0);
+ break;
+ case USB_RECIP_ENDPOINT:
+ epnum = ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK;
+ if (epnum)
+ fotg210->ep0_data =
+- fotg210_is_epnstall(fotg210->ep[epnum])
+- << USB_ENDPOINT_HALT;
++ cpu_to_le16(fotg210_is_epnstall(fotg210->ep[epnum])
++ << USB_ENDPOINT_HALT);
+ else
+ fotg210_request_error(fotg210);
+ break;
+diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
+index 8e83995fc3bd2..b8fc818c154ae 100644
+--- a/drivers/usb/musb/musb_gadget.c
++++ b/drivers/usb/musb/musb_gadget.c
+@@ -1629,8 +1629,6 @@ static int musb_gadget_vbus_draw(struct usb_gadget *gadget, unsigned mA)
+ {
+ struct musb *musb = gadget_to_musb(gadget);
+
+- if (!musb->xceiv->set_power)
+- return -EOPNOTSUPP;
+ return usb_phy_set_power(musb->xceiv, mA);
+ }
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index c7c6d5d1dfbc8..f1acc6f686a96 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -196,6 +196,8 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */
+ { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */
+ { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */
++ { USB_DEVICE(0x17A8, 0x0011) }, /* Kamstrup 444 MHz RF sniffer */
++ { USB_DEVICE(0x17A8, 0x0013) }, /* Kamstrup 870 MHz RF sniffer */
+ { USB_DEVICE(0x17A8, 0x0101) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Int Ant) */
+ { USB_DEVICE(0x17A8, 0x0102) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Ext Ant) */
+ { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
+diff --git a/drivers/usb/serial/f81534.c b/drivers/usb/serial/f81534.c
+index db6c93c04b3c8..7f400b1bb8e6c 100644
+--- a/drivers/usb/serial/f81534.c
++++ b/drivers/usb/serial/f81534.c
+@@ -538,9 +538,6 @@ static int f81534_submit_writer(struct usb_serial_port *port, gfp_t mem_flags)
+
+ static u32 f81534_calc_baud_divisor(u32 baudrate, u32 clockrate)
+ {
+- if (!baudrate)
+- return 0;
+-
+ /* Round to nearest divisor */
+ return DIV_ROUND_CLOSEST(clockrate, baudrate);
+ }
+@@ -570,9 +567,14 @@ static int f81534_set_port_config(struct usb_serial_port *port,
+ u32 baud_list[] = {baudrate, old_baudrate, F81534_DEFAULT_BAUD_RATE};
+
+ for (i = 0; i < ARRAY_SIZE(baud_list); ++i) {
+- idx = f81534_find_clk(baud_list[i]);
++ baudrate = baud_list[i];
++ if (baudrate == 0) {
++ tty_encode_baud_rate(tty, 0, 0);
++ return 0;
++ }
++
++ idx = f81534_find_clk(baudrate);
+ if (idx >= 0) {
+- baudrate = baud_list[i];
+ tty_encode_baud_rate(tty, baudrate, baudrate);
+ break;
+ }
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index ebb2936271299..57bef990382b1 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -255,6 +255,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_EP06 0x0306
+ #define QUECTEL_PRODUCT_EM05G 0x030a
+ #define QUECTEL_PRODUCT_EM060K 0x030b
++#define QUECTEL_PRODUCT_EM05G_SG 0x0311
+ #define QUECTEL_PRODUCT_EM12 0x0512
+ #define QUECTEL_PRODUCT_RM500Q 0x0800
+ #define QUECTEL_PRODUCT_RM520N 0x0801
+@@ -1160,6 +1161,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff),
+ .driver_info = RSVD(6) | ZLP },
++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_SG, 0xff),
++ .driver_info = RSVD(6) | ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) },
+diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
+index 6b8edf6178df3..6fcf5fd2ff987 100644
+--- a/drivers/usb/storage/alauda.c
++++ b/drivers/usb/storage/alauda.c
+@@ -437,6 +437,8 @@ static int alauda_init_media(struct us_data *us)
+ + MEDIA_INFO(us).blockshift + MEDIA_INFO(us).pageshift);
+ MEDIA_INFO(us).pba_to_lba = kcalloc(num_zones, sizeof(u16*), GFP_NOIO);
+ MEDIA_INFO(us).lba_to_pba = kcalloc(num_zones, sizeof(u16*), GFP_NOIO);
++ if (MEDIA_INFO(us).pba_to_lba == NULL || MEDIA_INFO(us).lba_to_pba == NULL)
++ return USB_STOR_TRANSPORT_ERROR;
+
+ if (alauda_reset_media(us) != USB_STOR_XFER_GOOD)
+ return USB_STOR_TRANSPORT_ERROR;
+diff --git a/drivers/usb/typec/bus.c b/drivers/usb/typec/bus.c
+index 76299b6ff06da..7605963f71ede 100644
+--- a/drivers/usb/typec/bus.c
++++ b/drivers/usb/typec/bus.c
+@@ -126,7 +126,7 @@ int typec_altmode_exit(struct typec_altmode *adev)
+ if (!adev || !adev->active)
+ return 0;
+
+- if (!pdev->ops || !pdev->ops->enter)
++ if (!pdev->ops || !pdev->ops->exit)
+ return -EOPNOTSUPP;
+
+ /* Moving to USB Safe State */
+diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
+index c29fc6844f845..d8bb6537c688e 100644
+--- a/drivers/vfio/platform/vfio_platform_common.c
++++ b/drivers/vfio/platform/vfio_platform_common.c
+@@ -78,12 +78,11 @@ static int vfio_platform_acpi_call_reset(struct vfio_platform_device *vdev,
+ const char **extra_dbg)
+ {
+ #ifdef CONFIG_ACPI
+- struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+ struct device *dev = vdev->device;
+ acpi_handle handle = ACPI_HANDLE(dev);
+ acpi_status acpi_ret;
+
+- acpi_ret = acpi_evaluate_object(handle, "_RST", NULL, &buffer);
++ acpi_ret = acpi_evaluate_object(handle, "_RST", NULL, NULL);
+ if (ACPI_FAILURE(acpi_ret)) {
+ if (extra_dbg)
+ *extra_dbg = acpi_format_exception(acpi_ret);
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index 97c4319797d5c..afb0c9e4d7382 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -2316,7 +2316,6 @@ config FB_SSD1307
+ select FB_SYS_COPYAREA
+ select FB_SYS_IMAGEBLIT
+ select FB_DEFERRED_IO
+- select PWM
+ select FB_BACKLIGHT
+ help
+ This driver implements support for the Solomon SSD1307
+diff --git a/drivers/video/fbdev/pm2fb.c b/drivers/video/fbdev/pm2fb.c
+index 8ae010f07d7da..0ec4be2f2e8c5 100644
+--- a/drivers/video/fbdev/pm2fb.c
++++ b/drivers/video/fbdev/pm2fb.c
+@@ -1529,8 +1529,10 @@ static int pm2fb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ }
+
+ info = framebuffer_alloc(sizeof(struct pm2fb_par), &pdev->dev);
+- if (!info)
+- return -ENOMEM;
++ if (!info) {
++ err = -ENOMEM;
++ goto err_exit_disable;
++ }
+ default_par = info->par;
+
+ switch (pdev->device) {
+@@ -1711,6 +1713,8 @@ static int pm2fb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ release_mem_region(pm2fb_fix.mmio_start, pm2fb_fix.mmio_len);
+ err_exit_neither:
+ framebuffer_release(info);
++ err_exit_disable:
++ pci_disable_device(pdev);
+ return retval;
+ }
+
+@@ -1737,6 +1741,7 @@ static void pm2fb_remove(struct pci_dev *pdev)
+ fb_dealloc_cmap(&info->cmap);
+ kfree(info->pixmap.addr);
+ framebuffer_release(info);
++ pci_disable_device(pdev);
+ }
+
+ static const struct pci_device_id pm2fb_id_table[] = {
+diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
+index 440a6636d8f0a..f6ebca8839127 100644
+--- a/drivers/video/fbdev/uvesafb.c
++++ b/drivers/video/fbdev/uvesafb.c
+@@ -1755,6 +1755,7 @@ static int uvesafb_probe(struct platform_device *dev)
+ out_unmap:
+ iounmap(info->screen_base);
+ out_mem:
++ arch_phys_wc_del(par->mtrr_handle);
+ release_mem_region(info->fix.smem_start, info->fix.smem_len);
+ out_reg:
+ release_region(0x3c0, 32);
+diff --git a/drivers/video/fbdev/vermilion/vermilion.c b/drivers/video/fbdev/vermilion/vermilion.c
+index 5172fa5811476..be5e43be528aa 100644
+--- a/drivers/video/fbdev/vermilion/vermilion.c
++++ b/drivers/video/fbdev/vermilion/vermilion.c
+@@ -291,8 +291,10 @@ static int vmlfb_get_gpu(struct vml_par *par)
+
+ mutex_unlock(&vml_mutex);
+
+- if (pci_enable_device(par->gpu) < 0)
++ if (pci_enable_device(par->gpu) < 0) {
++ pci_dev_put(par->gpu);
+ return -ENODEV;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/video/fbdev/via/via-core.c b/drivers/video/fbdev/via/via-core.c
+index b041eb27a9bff..3f74bc8af7b3e 100644
+--- a/drivers/video/fbdev/via/via-core.c
++++ b/drivers/video/fbdev/via/via-core.c
+@@ -774,7 +774,14 @@ static int __init via_core_init(void)
+ return ret;
+ viafb_i2c_init();
+ viafb_gpio_init();
+- return pci_register_driver(&via_driver);
++ ret = pci_register_driver(&via_driver);
++ if (ret) {
++ viafb_gpio_exit();
++ viafb_i2c_exit();
++ return ret;
++ }
++
++ return 0;
+ }
+
+ static void __exit via_core_exit(void)
+diff --git a/drivers/vme/bridges/vme_fake.c b/drivers/vme/bridges/vme_fake.c
+index 685a43bdc2a1d..06bfc7f0e0b62 100644
+--- a/drivers/vme/bridges/vme_fake.c
++++ b/drivers/vme/bridges/vme_fake.c
+@@ -1077,6 +1077,8 @@ static int __init fake_init(void)
+
+ /* We need a fake parent device */
+ vme_root = __root_device_register("vme", THIS_MODULE);
++ if (IS_ERR(vme_root))
++ return PTR_ERR(vme_root);
+
+ /* If we want to support more than one bridge at some point, we need to
+ * dynamically allocate this so we get one per device.
+diff --git a/drivers/vme/bridges/vme_tsi148.c b/drivers/vme/bridges/vme_tsi148.c
+index 647d231d4422c..b1be12dc61eb8 100644
+--- a/drivers/vme/bridges/vme_tsi148.c
++++ b/drivers/vme/bridges/vme_tsi148.c
+@@ -1775,6 +1775,7 @@ static int tsi148_dma_list_add(struct vme_dma_list *list,
+ return 0;
+
+ err_dma:
++ list_del(&entry->list);
+ err_dest:
+ err_source:
+ err_align:
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index d138027034fd6..b6b3131cb079f 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -2100,8 +2100,8 @@ void xen_callback_vector(void)
+ void xen_callback_vector(void) {}
+ #endif
+
+-static bool fifo_events = true;
+-module_param(fifo_events, bool, 0);
++bool xen_fifo_events = true;
++module_param_named(fifo_events, xen_fifo_events, bool, 0);
+
+ static int xen_evtchn_cpu_prepare(unsigned int cpu)
+ {
+@@ -2130,10 +2130,12 @@ void __init xen_init_IRQ(void)
+ int ret = -EINVAL;
+ unsigned int evtchn;
+
+- if (fifo_events)
++ if (xen_fifo_events)
+ ret = xen_evtchn_fifo_init();
+- if (ret < 0)
++ if (ret < 0) {
+ xen_evtchn_2l_init();
++ xen_fifo_events = false;
++ }
+
+ xen_cpu_init_eoi(smp_processor_id());
+
+diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
+index 74ff28fda64dc..15ece1041d173 100644
+--- a/drivers/xen/privcmd.c
++++ b/drivers/xen/privcmd.c
+@@ -785,7 +785,7 @@ static long privcmd_ioctl_mmap_resource(struct file *file,
+ goto out;
+ }
+
+- pfns = kcalloc(kdata.num, sizeof(*pfns), GFP_KERNEL);
++ pfns = kcalloc(kdata.num, sizeof(*pfns), GFP_KERNEL | __GFP_NOWARN);
+ if (!pfns) {
+ rc = -ENOMEM;
+ goto out;
+diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
+index c3deb2e35f203..e7a9e8b56e71a 100644
+--- a/fs/binfmt_aout.c
++++ b/fs/binfmt_aout.c
+@@ -244,6 +244,7 @@ static int load_aout_binary(struct linux_binprm * bprm)
+ set_personality(PER_LINUX);
+ #endif
+ setup_new_exec(bprm);
++ install_exec_creds(bprm);
+
+ current->mm->end_code = ex.a_text +
+ (current->mm->start_code = N_TXTADDR(ex));
+@@ -256,7 +257,6 @@ static int load_aout_binary(struct linux_binprm * bprm)
+ if (retval < 0)
+ return retval;
+
+- install_exec_creds(bprm);
+
+ if (N_MAGIC(ex) == OMAGIC) {
+ unsigned long text_addr, map_size;
+diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
+index b53bb3729ac1e..64d0b838085d3 100644
+--- a/fs/binfmt_elf_fdpic.c
++++ b/fs/binfmt_elf_fdpic.c
+@@ -357,6 +357,7 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm)
+ current->personality |= READ_IMPLIES_EXEC;
+
+ setup_new_exec(bprm);
++ install_exec_creds(bprm);
+
+ set_binfmt(&elf_fdpic_format);
+
+@@ -438,9 +439,9 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm)
+ current->mm->start_stack = current->mm->start_brk + stack_size;
+ #endif
+
+- install_exec_creds(bprm);
+- if (create_elf_fdpic_tables(bprm, current->mm,
+- &exec_params, &interp_params) < 0)
++ retval = create_elf_fdpic_tables(bprm, current->mm, &exec_params,
++ &interp_params);
++ if (retval < 0)
+ goto error;
+
+ kdebug("- start_code %lx", current->mm->start_code);
+diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
+index a6f97d86fb801..a909743b1a0e1 100644
+--- a/fs/binfmt_flat.c
++++ b/fs/binfmt_flat.c
+@@ -541,6 +541,7 @@ static int load_flat_file(struct linux_binprm *bprm,
+ /* OK, This is the point of no return */
+ set_personality(PER_LINUX_32BIT);
+ setup_new_exec(bprm);
++ install_exec_creds(bprm);
+ }
+
+ /*
+@@ -965,8 +966,6 @@ static int load_flat_binary(struct linux_binprm *bprm)
+ }
+ }
+
+- install_exec_creds(bprm);
+-
+ set_binfmt(&flat_format);
+
+ #ifdef CONFIG_MMU
+diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
+index 27a04f4925416..8fe7edd2b001f 100644
+--- a/fs/binfmt_misc.c
++++ b/fs/binfmt_misc.c
+@@ -42,10 +42,10 @@ static LIST_HEAD(entries);
+ static int enabled = 1;
+
+ enum {Enabled, Magic};
+-#define MISC_FMT_PRESERVE_ARGV0 (1 << 31)
+-#define MISC_FMT_OPEN_BINARY (1 << 30)
+-#define MISC_FMT_CREDENTIALS (1 << 29)
+-#define MISC_FMT_OPEN_FILE (1 << 28)
++#define MISC_FMT_PRESERVE_ARGV0 (1UL << 31)
++#define MISC_FMT_OPEN_BINARY (1UL << 30)
++#define MISC_FMT_CREDENTIALS (1UL << 29)
++#define MISC_FMT_OPEN_FILE (1UL << 28)
+
+ typedef struct {
+ struct list_head list;
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 752b5d2652843..4f25133885676 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3234,13 +3234,10 @@ static long btrfs_ioctl_dev_info(struct btrfs_fs_info *fs_info,
+ di_args->bytes_used = btrfs_device_get_bytes_used(dev);
+ di_args->total_bytes = btrfs_device_get_total_bytes(dev);
+ memcpy(di_args->uuid, dev->uuid, sizeof(di_args->uuid));
+- if (dev->name) {
+- strncpy(di_args->path, rcu_str_deref(dev->name),
+- sizeof(di_args->path) - 1);
+- di_args->path[sizeof(di_args->path) - 1] = 0;
+- } else {
++ if (dev->name)
++ strscpy(di_args->path, rcu_str_deref(dev->name), sizeof(di_args->path));
++ else
+ di_args->path[0] = '\0';
+- }
+
+ out:
+ rcu_read_unlock();
+diff --git a/fs/btrfs/rcu-string.h b/fs/btrfs/rcu-string.h
+index a97dc74a4d3de..02f15321cecc9 100644
+--- a/fs/btrfs/rcu-string.h
++++ b/fs/btrfs/rcu-string.h
+@@ -18,7 +18,11 @@ static inline struct rcu_string *rcu_string_strdup(const char *src, gfp_t mask)
+ (len * sizeof(char)), mask);
+ if (!ret)
+ return ret;
+- strncpy(ret->str, src, len);
++ /* Warn if the source got unexpectedly truncated. */
++ if (WARN_ON(strscpy(ret->str, src, len) < 0)) {
++ kfree(ret);
++ return NULL;
++ }
+ return ret;
+ }
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index eb2f8e84ffc9e..80d248e88761d 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -1306,6 +1306,7 @@ static int find_extent_clone(struct send_ctx *sctx,
+ u64 disk_byte;
+ u64 num_bytes;
+ u64 extent_item_pos;
++ u64 extent_refs;
+ u64 flags = 0;
+ struct btrfs_file_extent_item *fi;
+ struct extent_buffer *eb = path->nodes[0];
+@@ -1373,14 +1374,22 @@ static int find_extent_clone(struct send_ctx *sctx,
+
+ ei = btrfs_item_ptr(tmp_path->nodes[0], tmp_path->slots[0],
+ struct btrfs_extent_item);
++ extent_refs = btrfs_extent_refs(tmp_path->nodes[0], ei);
+ /*
+ * Backreference walking (iterate_extent_inodes() below) is currently
+ * too expensive when an extent has a large number of references, both
+ * in time spent and used memory. So for now just fallback to write
+ * operations instead of clone operations when an extent has more than
+ * a certain amount of references.
++ *
++ * Also, if we have only one reference and only the send root as a clone
++ * source - meaning no clone roots were given in the struct
++ * btrfs_ioctl_send_args passed to the send ioctl - then it's our
++ * reference and there's no point in doing backref walking which is
++ * expensive, so exit early.
+ */
+- if (btrfs_extent_refs(tmp_path->nodes[0], ei) > SEND_MAX_EXTENT_REFS) {
++ if ((extent_refs == 1 && sctx->clone_roots_cnt == 1) ||
++ extent_refs > SEND_MAX_EXTENT_REFS) {
+ ret = -ENOENT;
+ goto out;
+ }
+diff --git a/fs/char_dev.c b/fs/char_dev.c
+index 5fffd5050fb7a..2c3d519b21c23 100644
+--- a/fs/char_dev.c
++++ b/fs/char_dev.c
+@@ -553,7 +553,7 @@ int cdev_device_add(struct cdev *cdev, struct device *dev)
+ }
+
+ rc = device_add(dev);
+- if (rc)
++ if (rc && dev->devt)
+ cdev_del(cdev);
+
+ return rc;
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index b5aba1c895cb5..a7ef847f285d3 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2940,7 +2940,7 @@ cifs_set_cifscreds(struct smb_vol *vol __attribute__((unused)),
+ static struct cifs_ses *
+ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
+ {
+- int rc = -ENOMEM;
++ int rc = 0;
+ unsigned int xid;
+ struct cifs_ses *ses;
+ struct sockaddr_in *addr = (struct sockaddr_in *)&server->dstaddr;
+@@ -2982,6 +2982,8 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
+ return ses;
+ }
+
++ rc = -ENOMEM;
++
+ cifs_dbg(FYI, "Existing smb sess not found\n");
+ ses = sesInfoAlloc();
+ if (ses == NULL)
+diff --git a/fs/cifs/link.c b/fs/cifs/link.c
+index 5b1c33d9283ae..f590149e21bae 100644
+--- a/fs/cifs/link.c
++++ b/fs/cifs/link.c
+@@ -481,6 +481,7 @@ smb3_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
+ oparms.disposition = FILE_CREATE;
+ oparms.fid = &fid;
+ oparms.reconnect = false;
++ oparms.mode = 0644;
+
+ rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL,
+ NULL);
+diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
+index 4fce1da7db23d..a57d080d2ba57 100644
+--- a/fs/debugfs/file.c
++++ b/fs/debugfs/file.c
+@@ -330,8 +330,8 @@ ssize_t debugfs_attr_read(struct file *file, char __user *buf,
+ }
+ EXPORT_SYMBOL_GPL(debugfs_attr_read);
+
+-ssize_t debugfs_attr_write(struct file *file, const char __user *buf,
+- size_t len, loff_t *ppos)
++static ssize_t debugfs_attr_write_xsigned(struct file *file, const char __user *buf,
++ size_t len, loff_t *ppos, bool is_signed)
+ {
+ struct dentry *dentry = F_DENTRY(file);
+ ssize_t ret;
+@@ -339,12 +339,28 @@ ssize_t debugfs_attr_write(struct file *file, const char __user *buf,
+ ret = debugfs_file_get(dentry);
+ if (unlikely(ret))
+ return ret;
+- ret = simple_attr_write(file, buf, len, ppos);
++ if (is_signed)
++ ret = simple_attr_write_signed(file, buf, len, ppos);
++ else
++ ret = simple_attr_write(file, buf, len, ppos);
+ debugfs_file_put(dentry);
+ return ret;
+ }
++
++ssize_t debugfs_attr_write(struct file *file, const char __user *buf,
++ size_t len, loff_t *ppos)
++{
++ return debugfs_attr_write_xsigned(file, buf, len, ppos, false);
++}
+ EXPORT_SYMBOL_GPL(debugfs_attr_write);
+
++ssize_t debugfs_attr_write_signed(struct file *file, const char __user *buf,
++ size_t len, loff_t *ppos)
++{
++ return debugfs_attr_write_xsigned(file, buf, len, ppos, true);
++}
++EXPORT_SYMBOL_GPL(debugfs_attr_write_signed);
++
+ static struct dentry *debugfs_create_mode_unsafe(const char *name, umode_t mode,
+ struct dentry *parent, void *value,
+ const struct file_operations *fops,
+@@ -742,11 +758,11 @@ static int debugfs_atomic_t_get(void *data, u64 *val)
+ *val = atomic_read((atomic_t *)data);
+ return 0;
+ }
+-DEFINE_DEBUGFS_ATTRIBUTE(fops_atomic_t, debugfs_atomic_t_get,
++DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(fops_atomic_t, debugfs_atomic_t_get,
+ debugfs_atomic_t_set, "%lld\n");
+-DEFINE_DEBUGFS_ATTRIBUTE(fops_atomic_t_ro, debugfs_atomic_t_get, NULL,
++DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(fops_atomic_t_ro, debugfs_atomic_t_get, NULL,
+ "%lld\n");
+-DEFINE_DEBUGFS_ATTRIBUTE(fops_atomic_t_wo, NULL, debugfs_atomic_t_set,
++DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(fops_atomic_t_wo, NULL, debugfs_atomic_t_set,
+ "%lld\n");
+
+ /**
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 6938dff9f04bd..d8068c0e547dc 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -503,7 +503,7 @@ enum {
+ *
+ * It's not paranoia if the Murphy's Law really *is* out to get you. :-)
+ */
+-#define TEST_FLAG_VALUE(FLAG) (EXT4_##FLAG##_FL == (1 << EXT4_INODE_##FLAG))
++#define TEST_FLAG_VALUE(FLAG) (EXT4_##FLAG##_FL == (1U << EXT4_INODE_##FLAG))
+ #define CHECK_FLAG_VALUE(FLAG) BUILD_BUG_ON(!TEST_FLAG_VALUE(FLAG))
+
+ static inline void ext4_check_flag_values(void)
+@@ -1041,6 +1041,9 @@ struct ext4_inode_info {
+ ext4_lblk_t i_da_metadata_calc_last_lblock;
+ int i_da_metadata_calc_len;
+
++ /* pending cluster reservations for bigalloc file systems */
++ struct ext4_pending_tree i_pending_tree;
++
+ /* on-disk additional length */
+ __u16 i_extra_isize;
+
+@@ -3228,10 +3231,6 @@ extern struct ext4_ext_path *ext4_find_extent(struct inode *, ext4_lblk_t,
+ int flags);
+ extern void ext4_ext_drop_refs(struct ext4_ext_path *);
+ extern int ext4_ext_check_inode(struct inode *inode);
+-extern int ext4_find_delalloc_range(struct inode *inode,
+- ext4_lblk_t lblk_start,
+- ext4_lblk_t lblk_end);
+-extern int ext4_find_delalloc_cluster(struct inode *inode, ext4_lblk_t lblk);
+ extern ext4_lblk_t ext4_ext_next_allocated_block(struct ext4_ext_path *path);
+ extern int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ __u64 start, __u64 len);
+@@ -3242,6 +3241,7 @@ extern int ext4_swap_extents(handle_t *handle, struct inode *inode1,
+ struct inode *inode2, ext4_lblk_t lblk1,
+ ext4_lblk_t lblk2, ext4_lblk_t count,
+ int mark_unwritten,int *err);
++extern int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu);
+
+ /* move_extent.c */
+ extern void ext4_double_down_write_data_sem(struct inode *first,
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 6c492fca60c41..1ad4c8eb82c19 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2381,8 +2381,8 @@ ext4_ext_put_gap_in_cache(struct inode *inode, ext4_lblk_t hole_start,
+ {
+ struct extent_status es;
+
+- ext4_es_find_delayed_extent_range(inode, hole_start,
+- hole_start + hole_len - 1, &es);
++ ext4_es_find_extent_range(inode, &ext4_es_is_delayed, hole_start,
++ hole_start + hole_len - 1, &es);
+ if (es.es_len) {
+ /* There's delayed extent containing lblock? */
+ if (es.es_lblk <= hole_start)
+@@ -3852,39 +3852,6 @@ out:
+ return ext4_mark_inode_dirty(handle, inode);
+ }
+
+-/**
+- * ext4_find_delalloc_range: find delayed allocated block in the given range.
+- *
+- * Return 1 if there is a delalloc block in the range, otherwise 0.
+- */
+-int ext4_find_delalloc_range(struct inode *inode,
+- ext4_lblk_t lblk_start,
+- ext4_lblk_t lblk_end)
+-{
+- struct extent_status es;
+-
+- ext4_es_find_delayed_extent_range(inode, lblk_start, lblk_end, &es);
+- if (es.es_len == 0)
+- return 0; /* there is no delay extent in this tree */
+- else if (es.es_lblk <= lblk_start &&
+- lblk_start < es.es_lblk + es.es_len)
+- return 1;
+- else if (lblk_start <= es.es_lblk && es.es_lblk <= lblk_end)
+- return 1;
+- else
+- return 0;
+-}
+-
+-int ext4_find_delalloc_cluster(struct inode *inode, ext4_lblk_t lblk)
+-{
+- struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+- ext4_lblk_t lblk_start, lblk_end;
+- lblk_start = EXT4_LBLK_CMASK(sbi, lblk);
+- lblk_end = lblk_start + sbi->s_cluster_ratio - 1;
+-
+- return ext4_find_delalloc_range(inode, lblk_start, lblk_end);
+-}
+-
+ /**
+ * Determines how many complete clusters (out of those specified by the 'map')
+ * are under delalloc and were reserved quota for.
+@@ -3943,7 +3910,8 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
+ lblk_from = EXT4_LBLK_CMASK(sbi, lblk_start);
+ lblk_to = lblk_from + c_offset - 1;
+
+- if (ext4_find_delalloc_range(inode, lblk_from, lblk_to))
++ if (ext4_es_scan_range(inode, &ext4_es_is_delayed, lblk_from,
++ lblk_to))
+ allocated_clusters--;
+ }
+
+@@ -3953,7 +3921,8 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
+ lblk_from = lblk_start + num_blks;
+ lblk_to = lblk_from + (sbi->s_cluster_ratio - c_offset) - 1;
+
+- if (ext4_find_delalloc_range(inode, lblk_from, lblk_to))
++ if (ext4_es_scan_range(inode, &ext4_es_is_delayed, lblk_from,
++ lblk_to))
+ allocated_clusters--;
+ }
+
+@@ -5108,8 +5077,10 @@ static int ext4_find_delayed_extent(struct inode *inode,
+ ext4_lblk_t block, next_del;
+
+ if (newes->es_pblk == 0) {
+- ext4_es_find_delayed_extent_range(inode, newes->es_lblk,
+- newes->es_lblk + newes->es_len - 1, &es);
++ ext4_es_find_extent_range(inode, &ext4_es_is_delayed,
++ newes->es_lblk,
++ newes->es_lblk + newes->es_len - 1,
++ &es);
+
+ /*
+ * No extent in extent-tree contains block @newes->es_pblk,
+@@ -5130,7 +5101,8 @@ static int ext4_find_delayed_extent(struct inode *inode,
+ }
+
+ block = newes->es_lblk + newes->es_len;
+- ext4_es_find_delayed_extent_range(inode, block, EXT_MAX_BLOCKS, &es);
++ ext4_es_find_extent_range(inode, &ext4_es_is_delayed, block,
++ EXT_MAX_BLOCKS, &es);
+ if (es.es_len == 0)
+ next_del = EXT_MAX_BLOCKS;
+ else
+@@ -5991,3 +5963,90 @@ ext4_swap_extents(handle_t *handle, struct inode *inode1,
+ }
+ return replaced_count;
+ }
++
++/*
++ * ext4_clu_mapped - determine whether any block in a logical cluster has
++ * been mapped to a physical cluster
++ *
++ * @inode - file containing the logical cluster
++ * @lclu - logical cluster of interest
++ *
++ * Returns 1 if any block in the logical cluster is mapped, signifying
++ * that a physical cluster has been allocated for it. Otherwise,
++ * returns 0. Can also return negative error codes. Derived from
++ * ext4_ext_map_blocks().
++ */
++int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu)
++{
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ struct ext4_ext_path *path;
++ int depth, mapped = 0, err = 0;
++ struct ext4_extent *extent;
++ ext4_lblk_t first_lblk, first_lclu, last_lclu;
++
++ /*
++ * if data can be stored inline, the logical cluster isn't
++ * mapped - no physical clusters have been allocated, and the
++ * file has no extents
++ */
++ if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))
++ return 0;
++
++ /* search for the extent closest to the first block in the cluster */
++ path = ext4_find_extent(inode, EXT4_C2B(sbi, lclu), NULL, 0);
++ if (IS_ERR(path)) {
++ err = PTR_ERR(path);
++ path = NULL;
++ goto out;
++ }
++
++ depth = ext_depth(inode);
++
++ /*
++ * A consistent leaf must not be empty. This situation is possible,
++ * though, _during_ tree modification, and it's why an assert can't
++ * be put in ext4_find_extent().
++ */
++ if (unlikely(path[depth].p_ext == NULL && depth != 0)) {
++ EXT4_ERROR_INODE(inode,
++ "bad extent address - lblock: %lu, depth: %d, pblock: %lld",
++ (unsigned long) EXT4_C2B(sbi, lclu),
++ depth, path[depth].p_block);
++ err = -EFSCORRUPTED;
++ goto out;
++ }
++
++ extent = path[depth].p_ext;
++
++ /* can't be mapped if the extent tree is empty */
++ if (extent == NULL)
++ goto out;
++
++ first_lblk = le32_to_cpu(extent->ee_block);
++ first_lclu = EXT4_B2C(sbi, first_lblk);
++
++ /*
++ * Three possible outcomes at this point - found extent spanning
++ * the target cluster, to the left of the target cluster, or to the
++ * right of the target cluster. The first two cases are handled here.
++ * The last case indicates the target cluster is not mapped.
++ */
++ if (lclu >= first_lclu) {
++ last_lclu = EXT4_B2C(sbi, first_lblk +
++ ext4_ext_get_actual_len(extent) - 1);
++ if (lclu <= last_lclu) {
++ mapped = 1;
++ } else {
++ first_lblk = ext4_ext_next_allocated_block(path);
++ first_lclu = EXT4_B2C(sbi, first_lblk);
++ if (lclu == first_lclu)
++ mapped = 1;
++ }
++ }
++
++out:
++ ext4_ext_drop_refs(path);
++ kfree(path);
++
++ return err ? err : mapped;
++}
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index 027c3e1b9f61a..441ee2e747d3e 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -142,6 +142,7 @@
+ */
+
+ static struct kmem_cache *ext4_es_cachep;
++static struct kmem_cache *ext4_pending_cachep;
+
+ static int __es_insert_extent(struct inode *inode, struct extent_status *newes);
+ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+@@ -233,30 +234,38 @@ static struct extent_status *__es_tree_search(struct rb_root *root,
+ }
+
+ /*
+- * ext4_es_find_delayed_extent_range: find the 1st delayed extent covering
+- * @es->lblk if it exists, otherwise, the next extent after @es->lblk.
++ * ext4_es_find_extent_range - find extent with specified status within block
++ * range or next extent following block range in
++ * extents status tree
+ *
+- * @inode: the inode which owns delayed extents
+- * @lblk: the offset where we start to search
+- * @end: the offset where we stop to search
+- * @es: delayed extent that we found
++ * @inode - file containing the range
++ * @matching_fn - pointer to function that matches extents with desired status
++ * @lblk - logical block defining start of range
++ * @end - logical block defining end of range
++ * @es - extent found, if any
++ *
++ * Find the first extent within the block range specified by @lblk and @end
++ * in the extents status tree that satisfies @matching_fn. If a match
++ * is found, it's returned in @es. If not, and a matching extent is found
++ * beyond the block range, it's returned in @es. If no match is found, an
++ * extent is returned in @es whose es_lblk, es_len, and es_pblk components
++ * are 0.
+ */
+-void ext4_es_find_delayed_extent_range(struct inode *inode,
+- ext4_lblk_t lblk, ext4_lblk_t end,
+- struct extent_status *es)
++static void __es_find_extent_range(struct inode *inode,
++ int (*matching_fn)(struct extent_status *es),
++ ext4_lblk_t lblk, ext4_lblk_t end,
++ struct extent_status *es)
+ {
+ struct ext4_es_tree *tree = NULL;
+ struct extent_status *es1 = NULL;
+ struct rb_node *node;
+
+- BUG_ON(es == NULL);
+- BUG_ON(end < lblk);
+- trace_ext4_es_find_delayed_extent_range_enter(inode, lblk);
++ WARN_ON(es == NULL);
++ WARN_ON(end < lblk);
+
+- read_lock(&EXT4_I(inode)->i_es_lock);
+ tree = &EXT4_I(inode)->i_es_tree;
+
+- /* find extent in cache firstly */
++ /* see if the extent has been cached */
+ es->es_lblk = es->es_len = es->es_pblk = 0;
+ if (tree->cache_es) {
+ es1 = tree->cache_es;
+@@ -271,28 +280,133 @@ void ext4_es_find_delayed_extent_range(struct inode *inode,
+ es1 = __es_tree_search(&tree->root, lblk);
+
+ out:
+- if (es1 && !ext4_es_is_delayed(es1)) {
++ if (es1 && !matching_fn(es1)) {
+ while ((node = rb_next(&es1->rb_node)) != NULL) {
+ es1 = rb_entry(node, struct extent_status, rb_node);
+ if (es1->es_lblk > end) {
+ es1 = NULL;
+ break;
+ }
+- if (ext4_es_is_delayed(es1))
++ if (matching_fn(es1))
+ break;
+ }
+ }
+
+- if (es1 && ext4_es_is_delayed(es1)) {
++ if (es1 && matching_fn(es1)) {
+ tree->cache_es = es1;
+ es->es_lblk = es1->es_lblk;
+ es->es_len = es1->es_len;
+ es->es_pblk = es1->es_pblk;
+ }
+
++}
++
++/*
++ * Locking for __es_find_extent_range() for external use
++ */
++void ext4_es_find_extent_range(struct inode *inode,
++ int (*matching_fn)(struct extent_status *es),
++ ext4_lblk_t lblk, ext4_lblk_t end,
++ struct extent_status *es)
++{
++ trace_ext4_es_find_extent_range_enter(inode, lblk);
++
++ read_lock(&EXT4_I(inode)->i_es_lock);
++ __es_find_extent_range(inode, matching_fn, lblk, end, es);
++ read_unlock(&EXT4_I(inode)->i_es_lock);
++
++ trace_ext4_es_find_extent_range_exit(inode, es);
++}
++
++/*
++ * __es_scan_range - search block range for block with specified status
++ * in extents status tree
++ *
++ * @inode - file containing the range
++ * @matching_fn - pointer to function that matches extents with desired status
++ * @lblk - logical block defining start of range
++ * @end - logical block defining end of range
++ *
++ * Returns true if at least one block in the specified block range satisfies
++ * the criterion specified by @matching_fn, and false if not. If at least
++ * one extent has the specified status, then there is at least one block
++ * in the cluster with that status. Should only be called by code that has
++ * taken i_es_lock.
++ */
++static bool __es_scan_range(struct inode *inode,
++ int (*matching_fn)(struct extent_status *es),
++ ext4_lblk_t start, ext4_lblk_t end)
++{
++ struct extent_status es;
++
++ __es_find_extent_range(inode, matching_fn, start, end, &es);
++ if (es.es_len == 0)
++ return false; /* no matching extent in the tree */
++ else if (es.es_lblk <= start &&
++ start < es.es_lblk + es.es_len)
++ return true;
++ else if (start <= es.es_lblk && es.es_lblk <= end)
++ return true;
++ else
++ return false;
++}
++/*
++ * Locking for __es_scan_range() for external use
++ */
++bool ext4_es_scan_range(struct inode *inode,
++ int (*matching_fn)(struct extent_status *es),
++ ext4_lblk_t lblk, ext4_lblk_t end)
++{
++ bool ret;
++
++ read_lock(&EXT4_I(inode)->i_es_lock);
++ ret = __es_scan_range(inode, matching_fn, lblk, end);
++ read_unlock(&EXT4_I(inode)->i_es_lock);
++
++ return ret;
++}
++
++/*
++ * __es_scan_clu - search cluster for block with specified status in
++ * extents status tree
++ *
++ * @inode - file containing the cluster
++ * @matching_fn - pointer to function that matches extents with desired status
++ * @lblk - logical block in cluster to be searched
++ *
++ * Returns true if at least one extent in the cluster containing @lblk
++ * satisfies the criterion specified by @matching_fn, and false if not. If at
++ * least one extent has the specified status, then there is at least one block
++ * in the cluster with that status. Should only be called by code that has
++ * taken i_es_lock.
++ */
++static bool __es_scan_clu(struct inode *inode,
++ int (*matching_fn)(struct extent_status *es),
++ ext4_lblk_t lblk)
++{
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ ext4_lblk_t lblk_start, lblk_end;
++
++ lblk_start = EXT4_LBLK_CMASK(sbi, lblk);
++ lblk_end = lblk_start + sbi->s_cluster_ratio - 1;
++
++ return __es_scan_range(inode, matching_fn, lblk_start, lblk_end);
++}
++
++/*
++ * Locking for __es_scan_clu() for external use
++ */
++bool ext4_es_scan_clu(struct inode *inode,
++ int (*matching_fn)(struct extent_status *es),
++ ext4_lblk_t lblk)
++{
++ bool ret;
++
++ read_lock(&EXT4_I(inode)->i_es_lock);
++ ret = __es_scan_clu(inode, matching_fn, lblk);
+ read_unlock(&EXT4_I(inode)->i_es_lock);
+
+- trace_ext4_es_find_delayed_extent_range_exit(inode, es);
++ return ret;
+ }
+
+ static void ext4_es_list_add(struct inode *inode)
+@@ -1250,3 +1364,242 @@ static int es_reclaim_extents(struct ext4_inode_info *ei, int *nr_to_scan)
+ ei->i_es_tree.cache_es = NULL;
+ return nr_shrunk;
+ }
++
++#ifdef ES_DEBUG__
++static void ext4_print_pending_tree(struct inode *inode)
++{
++ struct ext4_pending_tree *tree;
++ struct rb_node *node;
++ struct pending_reservation *pr;
++
++ printk(KERN_DEBUG "pending reservations for inode %lu:", inode->i_ino);
++ tree = &EXT4_I(inode)->i_pending_tree;
++ node = rb_first(&tree->root);
++ while (node) {
++ pr = rb_entry(node, struct pending_reservation, rb_node);
++ printk(KERN_DEBUG " %u", pr->lclu);
++ node = rb_next(node);
++ }
++ printk(KERN_DEBUG "\n");
++}
++#else
++#define ext4_print_pending_tree(inode)
++#endif
++
++int __init ext4_init_pending(void)
++{
++ ext4_pending_cachep = kmem_cache_create("ext4_pending_reservation",
++ sizeof(struct pending_reservation),
++ 0, (SLAB_RECLAIM_ACCOUNT), NULL);
++ if (ext4_pending_cachep == NULL)
++ return -ENOMEM;
++ return 0;
++}
++
++void ext4_exit_pending(void)
++{
++ kmem_cache_destroy(ext4_pending_cachep);
++}
++
++void ext4_init_pending_tree(struct ext4_pending_tree *tree)
++{
++ tree->root = RB_ROOT;
++}
++
++/*
++ * __get_pending - retrieve a pointer to a pending reservation
++ *
++ * @inode - file containing the pending cluster reservation
++ * @lclu - logical cluster of interest
++ *
++ * Returns a pointer to a pending reservation if it's a member of
++ * the set, and NULL if not. Must be called holding i_es_lock.
++ */
++static struct pending_reservation *__get_pending(struct inode *inode,
++ ext4_lblk_t lclu)
++{
++ struct ext4_pending_tree *tree;
++ struct rb_node *node;
++ struct pending_reservation *pr = NULL;
++
++ tree = &EXT4_I(inode)->i_pending_tree;
++ node = (&tree->root)->rb_node;
++
++ while (node) {
++ pr = rb_entry(node, struct pending_reservation, rb_node);
++ if (lclu < pr->lclu)
++ node = node->rb_left;
++ else if (lclu > pr->lclu)
++ node = node->rb_right;
++ else if (lclu == pr->lclu)
++ return pr;
++ }
++ return NULL;
++}
++
++/*
++ * __insert_pending - adds a pending cluster reservation to the set of
++ * pending reservations
++ *
++ * @inode - file containing the cluster
++ * @lblk - logical block in the cluster to be added
++ *
++ * Returns 0 on successful insertion and -ENOMEM on failure. If the
++ * pending reservation is already in the set, returns successfully.
++ */
++static int __insert_pending(struct inode *inode, ext4_lblk_t lblk)
++{
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ struct ext4_pending_tree *tree = &EXT4_I(inode)->i_pending_tree;
++ struct rb_node **p = &tree->root.rb_node;
++ struct rb_node *parent = NULL;
++ struct pending_reservation *pr;
++ ext4_lblk_t lclu;
++ int ret = 0;
++
++ lclu = EXT4_B2C(sbi, lblk);
++ /* search to find parent for insertion */
++ while (*p) {
++ parent = *p;
++ pr = rb_entry(parent, struct pending_reservation, rb_node);
++
++ if (lclu < pr->lclu) {
++ p = &(*p)->rb_left;
++ } else if (lclu > pr->lclu) {
++ p = &(*p)->rb_right;
++ } else {
++ /* pending reservation already inserted */
++ goto out;
++ }
++ }
++
++ pr = kmem_cache_alloc(ext4_pending_cachep, GFP_ATOMIC);
++ if (pr == NULL) {
++ ret = -ENOMEM;
++ goto out;
++ }
++ pr->lclu = lclu;
++
++ rb_link_node(&pr->rb_node, parent, p);
++ rb_insert_color(&pr->rb_node, &tree->root);
++
++out:
++ return ret;
++}
++
++/*
++ * __remove_pending - removes a pending cluster reservation from the set
++ * of pending reservations
++ *
++ * @inode - file containing the cluster
++ * @lblk - logical block in the pending cluster reservation to be removed
++ *
++ * Returns successfully if pending reservation is not a member of the set.
++ */
++static void __remove_pending(struct inode *inode, ext4_lblk_t lblk)
++{
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ struct pending_reservation *pr;
++ struct ext4_pending_tree *tree;
++
++ pr = __get_pending(inode, EXT4_B2C(sbi, lblk));
++ if (pr != NULL) {
++ tree = &EXT4_I(inode)->i_pending_tree;
++ rb_erase(&pr->rb_node, &tree->root);
++ kmem_cache_free(ext4_pending_cachep, pr);
++ }
++}
++
++/*
++ * ext4_remove_pending - removes a pending cluster reservation from the set
++ * of pending reservations
++ *
++ * @inode - file containing the cluster
++ * @lblk - logical block in the pending cluster reservation to be removed
++ *
++ * Locking for external use of __remove_pending.
++ */
++void ext4_remove_pending(struct inode *inode, ext4_lblk_t lblk)
++{
++ struct ext4_inode_info *ei = EXT4_I(inode);
++
++ write_lock(&ei->i_es_lock);
++ __remove_pending(inode, lblk);
++ write_unlock(&ei->i_es_lock);
++}
++
++/*
++ * ext4_is_pending - determine whether a cluster has a pending reservation
++ * on it
++ *
++ * @inode - file containing the cluster
++ * @lblk - logical block in the cluster
++ *
++ * Returns true if there's a pending reservation for the cluster in the
++ * set of pending reservations, and false if not.
++ */
++bool ext4_is_pending(struct inode *inode, ext4_lblk_t lblk)
++{
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ struct ext4_inode_info *ei = EXT4_I(inode);
++ bool ret;
++
++ read_lock(&ei->i_es_lock);
++ ret = (bool)(__get_pending(inode, EXT4_B2C(sbi, lblk)) != NULL);
++ read_unlock(&ei->i_es_lock);
++
++ return ret;
++}
++
++/*
++ * ext4_es_insert_delayed_block - adds a delayed block to the extents status
++ * tree, adding a pending reservation where
++ * needed
++ *
++ * @inode - file containing the newly added block
++ * @lblk - logical block to be added
++ * @allocated - indicates whether a physical cluster has been allocated for
++ * the logical cluster that contains the block
++ *
++ * Returns 0 on success, negative error code on failure.
++ */
++int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
++ bool allocated)
++{
++ struct extent_status newes;
++ int err = 0;
++
++ es_debug("add [%u/1) delayed to extent status tree of inode %lu\n",
++ lblk, inode->i_ino);
++
++ newes.es_lblk = lblk;
++ newes.es_len = 1;
++ ext4_es_store_pblock_status(&newes, ~0, EXTENT_STATUS_DELAYED);
++ trace_ext4_es_insert_delayed_block(inode, &newes, allocated);
++
++ ext4_es_insert_extent_check(inode, &newes);
++
++ write_lock(&EXT4_I(inode)->i_es_lock);
++
++ err = __es_remove_extent(inode, lblk, lblk);
++ if (err != 0)
++ goto error;
++retry:
++ err = __es_insert_extent(inode, &newes);
++ if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
++ 128, EXT4_I(inode)))
++ goto retry;
++ if (err != 0)
++ goto error;
++
++ if (allocated)
++ __insert_pending(inode, lblk);
++
++error:
++ write_unlock(&EXT4_I(inode)->i_es_lock);
++
++ ext4_es_print_tree(inode);
++ ext4_print_pending_tree(inode);
++
++ return err;
++}
+diff --git a/fs/ext4/extents_status.h b/fs/ext4/extents_status.h
+index 8efdeb903d6ba..9d3c676ec623a 100644
+--- a/fs/ext4/extents_status.h
++++ b/fs/ext4/extents_status.h
+@@ -78,6 +78,51 @@ struct ext4_es_stats {
+ struct percpu_counter es_stats_shk_cnt;
+ };
+
++/*
++ * Pending cluster reservations for bigalloc file systems
++ *
++ * A cluster with a pending reservation is a logical cluster shared by at
++ * least one extent in the extents status tree with delayed and unwritten
++ * status and at least one other written or unwritten extent. The
++ * reservation is said to be pending because a cluster reservation would
++ * have to be taken in the event all blocks in the cluster shared with
++ * written or unwritten extents were deleted while the delayed and
++ * unwritten blocks remained.
++ *
++ * The set of pending cluster reservations is an auxiliary data structure
++ * used with the extents status tree to implement reserved cluster/block
++ * accounting for bigalloc file systems. The set is kept in memory and
++ * records all pending cluster reservations.
++ *
++ * Its primary function is to avoid the need to read extents from the
++ * disk when invalidating pages as a result of a truncate, punch hole, or
++ * collapse range operation. Page invalidation requires a decrease in the
++ * reserved cluster count if it results in the removal of all delayed
++ * and unwritten extents (blocks) from a cluster that is not shared with a
++ * written or unwritten extent, and no decrease otherwise. Determining
++ * whether the cluster is shared can be done by searching for a pending
++ * reservation on it.
++ *
++ * Secondarily, it provides a potentially faster method for determining
++ * whether the reserved cluster count should be increased when a physical
++ * cluster is deallocated as a result of a truncate, punch hole, or
++ * collapse range operation. The necessary information is also present
++ * in the extents status tree, but might be more rapidly accessed in
++ * the pending reservation set in many cases due to smaller size.
++ *
++ * The pending cluster reservation set is implemented as a red-black tree
++ * with the goal of minimizing per page search time overhead.
++ */
++
++struct pending_reservation {
++ struct rb_node rb_node;
++ ext4_lblk_t lclu;
++};
++
++struct ext4_pending_tree {
++ struct rb_root root;
++};
++
+ extern int __init ext4_init_es(void);
+ extern void ext4_exit_es(void);
+ extern void ext4_es_init_tree(struct ext4_es_tree *tree);
+@@ -90,11 +135,18 @@ extern void ext4_es_cache_extent(struct inode *inode, ext4_lblk_t lblk,
+ unsigned int status);
+ extern int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+ ext4_lblk_t len);
+-extern void ext4_es_find_delayed_extent_range(struct inode *inode,
+- ext4_lblk_t lblk, ext4_lblk_t end,
+- struct extent_status *es);
++extern void ext4_es_find_extent_range(struct inode *inode,
++ int (*match_fn)(struct extent_status *es),
++ ext4_lblk_t lblk, ext4_lblk_t end,
++ struct extent_status *es);
+ extern int ext4_es_lookup_extent(struct inode *inode, ext4_lblk_t lblk,
+ struct extent_status *es);
++extern bool ext4_es_scan_range(struct inode *inode,
++ int (*matching_fn)(struct extent_status *es),
++ ext4_lblk_t lblk, ext4_lblk_t end);
++extern bool ext4_es_scan_clu(struct inode *inode,
++ int (*matching_fn)(struct extent_status *es),
++ ext4_lblk_t lblk);
+
+ static inline unsigned int ext4_es_status(struct extent_status *es)
+ {
+@@ -126,6 +178,16 @@ static inline int ext4_es_is_hole(struct extent_status *es)
+ return (ext4_es_type(es) & EXTENT_STATUS_HOLE) != 0;
+ }
+
++static inline int ext4_es_is_mapped(struct extent_status *es)
++{
++ return (ext4_es_is_written(es) || ext4_es_is_unwritten(es));
++}
++
++static inline int ext4_es_is_delonly(struct extent_status *es)
++{
++ return (ext4_es_is_delayed(es) && !ext4_es_is_unwritten(es));
++}
++
+ static inline void ext4_es_set_referenced(struct extent_status *es)
+ {
+ es->es_pblk |= ((ext4_fsblk_t)EXTENT_STATUS_REFERENCED) << ES_SHIFT;
+@@ -175,4 +237,12 @@ extern void ext4_es_unregister_shrinker(struct ext4_sb_info *sbi);
+
+ extern int ext4_seq_es_shrinker_info_show(struct seq_file *seq, void *v);
+
++extern int __init ext4_init_pending(void);
++extern void ext4_exit_pending(void);
++extern void ext4_init_pending_tree(struct ext4_pending_tree *tree);
++extern void ext4_remove_pending(struct inode *inode, ext4_lblk_t lblk);
++extern bool ext4_is_pending(struct inode *inode, ext4_lblk_t lblk);
++extern int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
++ bool allocated);
++
+ #endif /* _EXT4_EXTENTS_STATUS_H */
+diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
+index a5442528a60d2..0cc0d22c08569 100644
+--- a/fs/ext4/indirect.c
++++ b/fs/ext4/indirect.c
+@@ -148,6 +148,7 @@ static Indirect *ext4_get_branch(struct inode *inode, int depth,
+ struct super_block *sb = inode->i_sb;
+ Indirect *p = chain;
+ struct buffer_head *bh;
++ unsigned int key;
+ int ret = -EIO;
+
+ *err = 0;
+@@ -156,7 +157,13 @@ static Indirect *ext4_get_branch(struct inode *inode, int depth,
+ if (!p->key)
+ goto no_block;
+ while (--depth) {
+- bh = sb_getblk(sb, le32_to_cpu(p->key));
++ key = le32_to_cpu(p->key);
++ if (key > ext4_blocks_count(EXT4_SB(sb)->s_es)) {
++ /* the block was out of range */
++ ret = -EFSCORRUPTED;
++ goto failure;
++ }
++ bh = sb_getblk(sb, key);
+ if (unlikely(!bh)) {
+ ret = -ENOMEM;
+ goto failure;
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 95139c992a540..17d120ac20100 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -207,6 +207,8 @@ void ext4_evict_inode(struct inode *inode)
+
+ trace_ext4_evict_inode(inode);
+
++ if (EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)
++ ext4_evict_ea_inode(inode);
+ if (inode->i_nlink) {
+ /*
+ * When journalling data dirty buffers are tracked only in the
+@@ -598,8 +600,8 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
+ EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
+ if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) &&
+ !(status & EXTENT_STATUS_WRITTEN) &&
+- ext4_find_delalloc_range(inode, map->m_lblk,
+- map->m_lblk + map->m_len - 1))
++ ext4_es_scan_range(inode, &ext4_es_is_delayed, map->m_lblk,
++ map->m_lblk + map->m_len - 1))
+ status |= EXTENT_STATUS_DELAYED;
+ ret = ext4_es_insert_extent(inode, map->m_lblk,
+ map->m_len, map->m_pblk, status);
+@@ -722,8 +724,8 @@ found:
+ EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
+ if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) &&
+ !(status & EXTENT_STATUS_WRITTEN) &&
+- ext4_find_delalloc_range(inode, map->m_lblk,
+- map->m_lblk + map->m_len - 1))
++ ext4_es_scan_range(inode, &ext4_es_is_delayed, map->m_lblk,
++ map->m_lblk + map->m_len - 1))
+ status |= EXTENT_STATUS_DELAYED;
+ ret = ext4_es_insert_extent(inode, map->m_lblk, map->m_len,
+ map->m_pblk, status);
+@@ -1715,7 +1717,7 @@ static void ext4_da_page_release_reservation(struct page *page,
+ lblk = (page->index << (PAGE_SHIFT - inode->i_blkbits)) +
+ ((num_clusters - 1) << sbi->s_cluster_bits);
+ if (sbi->s_cluster_ratio == 1 ||
+- !ext4_find_delalloc_cluster(inode, lblk))
++ !ext4_es_scan_clu(inode, &ext4_es_is_delayed, lblk))
+ ext4_da_release_space(inode, 1);
+
+ num_clusters--;
+@@ -1821,6 +1823,65 @@ static int ext4_bh_delay_or_unwritten(handle_t *handle, struct buffer_head *bh)
+ return (buffer_delay(bh) || buffer_unwritten(bh)) && buffer_dirty(bh);
+ }
+
++/*
++ * ext4_insert_delayed_block - adds a delayed block to the extents status
++ * tree, incrementing the reserved cluster/block
++ * count or making a pending reservation
++ * where needed
++ *
++ * @inode - file containing the newly added block
++ * @lblk - logical block to be added
++ *
++ * Returns 0 on success, negative error code on failure.
++ */
++static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk)
++{
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ int ret;
++ bool allocated = false;
++
++ /*
++ * If the cluster containing lblk is shared with a delayed,
++ * written, or unwritten extent in a bigalloc file system, it's
++ * already been accounted for and does not need to be reserved.
++ * A pending reservation must be made for the cluster if it's
++ * shared with a written or unwritten extent and doesn't already
++ * have one. Written and unwritten extents can be purged from the
++ * extents status tree if the system is under memory pressure, so
++ * it's necessary to examine the extent tree if a search of the
++ * extents status tree doesn't get a match.
++ */
++ if (sbi->s_cluster_ratio == 1) {
++ ret = ext4_da_reserve_space(inode);
++ if (ret != 0) /* ENOSPC */
++ goto errout;
++ } else { /* bigalloc */
++ if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk)) {
++ if (!ext4_es_scan_clu(inode,
++ &ext4_es_is_mapped, lblk)) {
++ ret = ext4_clu_mapped(inode,
++ EXT4_B2C(sbi, lblk));
++ if (ret < 0)
++ goto errout;
++ if (ret == 0) {
++ ret = ext4_da_reserve_space(inode);
++ if (ret != 0) /* ENOSPC */
++ goto errout;
++ } else {
++ allocated = true;
++ }
++ } else {
++ allocated = true;
++ }
++ }
++ }
++
++ ret = ext4_es_insert_delayed_block(inode, lblk, allocated);
++
++errout:
++ return ret;
++}
++
+ /*
+ * This function is grabs code from the very beginning of
+ * ext4_map_blocks, but assumes that the caller is from delayed write
+@@ -1900,28 +1961,14 @@ static int ext4_da_map_blocks(struct inode *inode, sector_t iblock,
+ add_delayed:
+ if (retval == 0) {
+ int ret;
++
+ /*
+ * XXX: __block_prepare_write() unmaps passed block,
+ * is it OK?
+ */
+- /*
+- * If the block was allocated from previously allocated cluster,
+- * then we don't need to reserve it again. However we still need
+- * to reserve metadata for every block we're going to write.
+- */
+- if (EXT4_SB(inode->i_sb)->s_cluster_ratio == 1 ||
+- !ext4_find_delalloc_cluster(inode, map->m_lblk)) {
+- ret = ext4_da_reserve_space(inode);
+- if (ret) {
+- /* not enough space to reserve */
+- retval = ret;
+- goto out_unlock;
+- }
+- }
+
+- ret = ext4_es_insert_extent(inode, map->m_lblk, map->m_len,
+- ~0, EXTENT_STATUS_DELAYED);
+- if (ret) {
++ ret = ext4_insert_delayed_block(inode, map->m_lblk);
++ if (ret != 0) {
+ retval = ret;
+ goto out_unlock;
+ }
+@@ -3517,7 +3564,8 @@ static int ext4_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
+ ext4_lblk_t end = map.m_lblk + map.m_len - 1;
+ struct extent_status es;
+
+- ext4_es_find_delayed_extent_range(inode, map.m_lblk, end, &es);
++ ext4_es_find_extent_range(inode, &ext4_es_is_delayed,
++ map.m_lblk, end, &es);
+
+ if (!es.es_len || es.es_lblk > end) {
+ /* entire range is a hole */
+@@ -4549,7 +4597,7 @@ int ext4_truncate(struct inode *inode)
+ trace_ext4_truncate_enter(inode);
+
+ if (!ext4_can_truncate(inode))
+- return 0;
++ goto out_trace;
+
+ ext4_clear_inode_flag(inode, EXT4_INODE_EOFBLOCKS);
+
+@@ -4560,16 +4608,15 @@ int ext4_truncate(struct inode *inode)
+ int has_inline = 1;
+
+ err = ext4_inline_data_truncate(inode, &has_inline);
+- if (err)
+- return err;
+- if (has_inline)
+- return 0;
++ if (err || has_inline)
++ goto out_trace;
+ }
+
+ /* If we zero-out tail of the page, we have to create jinode for jbd2 */
+ if (inode->i_size & (inode->i_sb->s_blocksize - 1)) {
+- if (ext4_inode_attach_jinode(inode) < 0)
+- return 0;
++ err = ext4_inode_attach_jinode(inode);
++ if (err)
++ goto out_trace;
+ }
+
+ if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
+@@ -4578,8 +4625,10 @@ int ext4_truncate(struct inode *inode)
+ credits = ext4_blocks_for_truncate(inode);
+
+ handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE, credits);
+- if (IS_ERR(handle))
+- return PTR_ERR(handle);
++ if (IS_ERR(handle)) {
++ err = PTR_ERR(handle);
++ goto out_trace;
++ }
+
+ if (inode->i_size & (inode->i_sb->s_blocksize - 1))
+ ext4_block_truncate_page(handle, mapping, inode->i_size);
+@@ -4628,6 +4677,7 @@ out_stop:
+ ext4_mark_inode_dirty(handle, inode);
+ ext4_journal_stop(handle);
+
++out_trace:
+ trace_ext4_truncate_exit(inode);
+ return err;
+ }
+@@ -4663,9 +4713,17 @@ static int __ext4_get_inode_loc(struct inode *inode,
+ inodes_per_block = EXT4_SB(sb)->s_inodes_per_block;
+ inode_offset = ((inode->i_ino - 1) %
+ EXT4_INODES_PER_GROUP(sb));
+- block = ext4_inode_table(sb, gdp) + (inode_offset / inodes_per_block);
+ iloc->offset = (inode_offset % inodes_per_block) * EXT4_INODE_SIZE(sb);
+
++ block = ext4_inode_table(sb, gdp);
++ if ((block <= le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) ||
++ (block >= ext4_blocks_count(EXT4_SB(sb)->s_es))) {
++ ext4_error(sb, "Invalid inode table block %llu in "
++ "block_group %u", block, iloc->block_group);
++ return -EFSCORRUPTED;
++ }
++ block += (inode_offset / inodes_per_block);
++
+ bh = sb_getblk(sb, block);
+ if (unlikely(!bh))
+ return -ENOMEM;
+@@ -6033,6 +6091,14 @@ static int __ext4_expand_extra_isize(struct inode *inode,
+ return 0;
+ }
+
++ /*
++ * We may need to allocate external xattr block so we need quotas
++ * initialized. Here we can be called with various locks held so we
++ * cannot affort to initialize quotas ourselves. So just bail.
++ */
++ if (dquot_initialize_needed(inode))
++ return -EAGAIN;
++
+ /* try to expand with EAs present */
+ error = ext4_expand_extra_isize_ea(inode, new_extra_isize,
+ raw_inode, handle);
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index 484cb68c34d92..fd0353017d897 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -169,7 +169,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ /* Protect extent tree against block allocations via delalloc */
+ ext4_double_down_write_data_sem(inode, inode_bl);
+
+- if (inode_bl->i_nlink == 0) {
++ if (is_bad_inode(inode_bl) || !S_ISREG(inode_bl->i_mode)) {
+ /* this inode has never been used as a BOOT_LOADER */
+ set_nlink(inode_bl, 1);
+ i_uid_write(inode_bl, 0);
+@@ -449,6 +449,10 @@ static int ext4_ioctl_setproject(struct file *filp, __u32 projid)
+ if (ext4_is_quota_file(inode))
+ return err;
+
++ err = dquot_initialize(inode);
++ if (err)
++ return err;
++
+ err = ext4_get_inode_loc(inode, &iloc);
+ if (err)
+ return err;
+@@ -464,10 +468,6 @@ static int ext4_ioctl_setproject(struct file *filp, __u32 projid)
+ brelse(iloc.bh);
+ }
+
+- err = dquot_initialize(inode);
+- if (err)
+- return err;
+-
+ handle = ext4_journal_start(inode, EXT4_HT_QUOTA,
+ EXT4_QUOTA_INIT_BLOCKS(sb) +
+ EXT4_QUOTA_DEL_BLOCKS(sb) + 3);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index a878b9a8d9ead..2c68591102bd4 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -3868,6 +3868,9 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
+ return -EXDEV;
+
+ retval = dquot_initialize(old.dir);
++ if (retval)
++ return retval;
++ retval = dquot_initialize(old.inode);
+ if (retval)
+ return retval;
+ retval = dquot_initialize(new.dir);
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 8737d1bcdb6ef..288213cad9143 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1567,8 +1567,8 @@ exit_journal:
+ int meta_bg = ext4_has_feature_meta_bg(sb);
+ sector_t old_gdb = 0;
+
+- update_backups(sb, sbi->s_sbh->b_blocknr, (char *)es,
+- sizeof(struct ext4_super_block), 0);
++ update_backups(sb, ext4_group_first_block_no(sb, 0),
++ (char *)es, sizeof(struct ext4_super_block), 0);
+ for (; gdb_num <= gdb_num_end; gdb_num++) {
+ struct buffer_head *gdb_bh;
+
+@@ -1775,7 +1775,7 @@ errout:
+ if (test_opt(sb, DEBUG))
+ printk(KERN_DEBUG "EXT4-fs: extended group to %llu "
+ "blocks\n", ext4_blocks_count(es));
+- update_backups(sb, EXT4_SB(sb)->s_sbh->b_blocknr,
++ update_backups(sb, ext4_group_first_block_no(sb, 0),
+ (char *)es, sizeof(struct ext4_super_block), 0);
+ }
+ return err;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index f00cc301da369..73a431b6e720f 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1081,6 +1081,7 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
+ return NULL;
+
+ inode_set_iversion(&ei->vfs_inode, 1);
++ ei->i_flags = 0;
+ spin_lock_init(&ei->i_raw_lock);
+ INIT_LIST_HEAD(&ei->i_prealloc_list);
+ spin_lock_init(&ei->i_prealloc_lock);
+@@ -1094,6 +1095,7 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
+ ei->i_da_metadata_calc_len = 0;
+ ei->i_da_metadata_calc_last_lblock = 0;
+ spin_lock_init(&(ei->i_block_reservation_lock));
++ ext4_init_pending_tree(&ei->i_pending_tree);
+ #ifdef CONFIG_QUOTA
+ ei->i_reserved_quota = 0;
+ memset(&ei->i_dquot, 0, sizeof(ei->i_dquot));
+@@ -4302,30 +4304,31 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ ext4_has_feature_journal_needs_recovery(sb)) {
+ ext4_msg(sb, KERN_ERR, "required journal recovery "
+ "suppressed and not mounted read-only");
+- goto failed_mount_wq;
++ goto failed_mount3a;
+ } else {
+ /* Nojournal mode, all journal mount options are illegal */
+- if (test_opt2(sb, EXPLICIT_JOURNAL_CHECKSUM)) {
+- ext4_msg(sb, KERN_ERR, "can't mount with "
+- "journal_checksum, fs mounted w/o journal");
+- goto failed_mount_wq;
+- }
+ if (test_opt(sb, JOURNAL_ASYNC_COMMIT)) {
+ ext4_msg(sb, KERN_ERR, "can't mount with "
+ "journal_async_commit, fs mounted w/o journal");
+- goto failed_mount_wq;
++ goto failed_mount3a;
++ }
++
++ if (test_opt2(sb, EXPLICIT_JOURNAL_CHECKSUM)) {
++ ext4_msg(sb, KERN_ERR, "can't mount with "
++ "journal_checksum, fs mounted w/o journal");
++ goto failed_mount3a;
+ }
+ if (sbi->s_commit_interval != JBD2_DEFAULT_MAX_COMMIT_AGE*HZ) {
+ ext4_msg(sb, KERN_ERR, "can't mount with "
+ "commit=%lu, fs mounted w/o journal",
+ sbi->s_commit_interval / HZ);
+- goto failed_mount_wq;
++ goto failed_mount3a;
+ }
+ if (EXT4_MOUNT_DATA_FLAGS &
+ (sbi->s_mount_opt ^ sbi->s_def_mount_opt)) {
+ ext4_msg(sb, KERN_ERR, "can't mount with "
+ "data=, fs mounted w/o journal");
+- goto failed_mount_wq;
++ goto failed_mount3a;
+ }
+ sbi->s_def_mount_opt &= ~EXT4_MOUNT_JOURNAL_CHECKSUM;
+ clear_opt(sb, JOURNAL_CHECKSUM);
+@@ -4731,7 +4734,7 @@ static struct inode *ext4_get_journal_inode(struct super_block *sb,
+
+ jbd_debug(2, "Journal inode found at %p: %lld bytes\n",
+ journal_inode, journal_inode->i_size);
+- if (!S_ISREG(journal_inode->i_mode)) {
++ if (!S_ISREG(journal_inode->i_mode) || IS_ENCRYPTED(journal_inode)) {
+ ext4_msg(sb, KERN_ERR, "invalid journal inode");
+ iput(journal_inode);
+ return NULL;
+@@ -5839,6 +5842,20 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
+ return err;
+ }
+
++static inline bool ext4_check_quota_inum(int type, unsigned long qf_inum)
++{
++ switch (type) {
++ case USRQUOTA:
++ return qf_inum == EXT4_USR_QUOTA_INO;
++ case GRPQUOTA:
++ return qf_inum == EXT4_GRP_QUOTA_INO;
++ case PRJQUOTA:
++ return qf_inum >= EXT4_GOOD_OLD_FIRST_INO;
++ default:
++ BUG();
++ }
++}
++
+ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
+ unsigned int flags)
+ {
+@@ -5855,9 +5872,16 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
+ if (!qf_inums[type])
+ return -EPERM;
+
++ if (!ext4_check_quota_inum(type, qf_inums[type])) {
++ ext4_error(sb, "Bad quota inum: %lu, type: %d",
++ qf_inums[type], type);
++ return -EUCLEAN;
++ }
++
+ qf_inode = ext4_iget(sb, qf_inums[type], EXT4_IGET_SPECIAL);
+ if (IS_ERR(qf_inode)) {
+- ext4_error(sb, "Bad quota inode # %lu", qf_inums[type]);
++ ext4_error(sb, "Bad quota inode: %lu, type: %d",
++ qf_inums[type], type);
+ return PTR_ERR(qf_inode);
+ }
+
+@@ -5896,8 +5920,9 @@ static int ext4_enable_quotas(struct super_block *sb)
+ if (err) {
+ ext4_warning(sb,
+ "Failed to enable quota tracking "
+- "(type=%d, err=%d). Please run "
+- "e2fsck to fix.", type, err);
++ "(type=%d, err=%d, ino=%lu). "
++ "Please run e2fsck to fix.", type,
++ err, qf_inums[type]);
+ for (type--; type >= 0; type--) {
+ struct inode *inode;
+
+@@ -6165,6 +6190,10 @@ static int __init ext4_init_fs(void)
+ if (err)
+ return err;
+
++ err = ext4_init_pending();
++ if (err)
++ goto out6;
++
+ err = ext4_init_pageio();
+ if (err)
+ goto out5;
+@@ -6203,6 +6232,8 @@ out3:
+ out4:
+ ext4_exit_pageio();
+ out5:
++ ext4_exit_pending();
++out6:
+ ext4_exit_es();
+
+ return err;
+@@ -6220,6 +6251,7 @@ static void __exit ext4_exit_fs(void)
+ ext4_exit_system_zone();
+ ext4_exit_pageio();
+ ext4_exit_es();
++ ext4_exit_pending();
+ }
+
+ MODULE_AUTHOR("Remy Card, Stephen Tweedie, Andrew Morton, Andreas Dilger, Theodore Ts'o and others");
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 497649c69bba7..0772941bbe925 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -434,6 +434,21 @@ error:
+ return err;
+ }
+
++/* Remove entry from mbcache when EA inode is getting evicted */
++void ext4_evict_ea_inode(struct inode *inode)
++{
++ struct mb_cache_entry *oe;
++
++ if (!EA_INODE_CACHE(inode))
++ return;
++ /* Wait for entry to get unused so that we can remove it */
++ while ((oe = mb_cache_entry_delete_or_get(EA_INODE_CACHE(inode),
++ ext4_xattr_inode_get_hash(inode), inode->i_ino))) {
++ mb_cache_entry_wait_unused(oe);
++ mb_cache_entry_put(EA_INODE_CACHE(inode), oe);
++ }
++}
++
+ static int
+ ext4_xattr_inode_verify_hashes(struct inode *ea_inode,
+ struct ext4_xattr_entry *entry, void *buffer,
+@@ -1019,10 +1034,8 @@ static int ext4_xattr_ensure_credits(handle_t *handle, struct inode *inode,
+ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
+ int ref_change)
+ {
+- struct mb_cache *ea_inode_cache = EA_INODE_CACHE(ea_inode);
+ struct ext4_iloc iloc;
+ s64 ref_count;
+- u32 hash;
+ int ret;
+
+ inode_lock(ea_inode);
+@@ -1047,14 +1060,6 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
+
+ set_nlink(ea_inode, 1);
+ ext4_orphan_del(handle, ea_inode);
+-
+- if (ea_inode_cache) {
+- hash = ext4_xattr_inode_get_hash(ea_inode);
+- mb_cache_entry_create(ea_inode_cache,
+- GFP_NOFS, hash,
+- ea_inode->i_ino,
+- true /* reusable */);
+- }
+ }
+ } else {
+ WARN_ONCE(ref_count < 0, "EA inode %lu ref_count=%lld",
+@@ -1067,12 +1072,6 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
+
+ clear_nlink(ea_inode);
+ ext4_orphan_add(handle, ea_inode);
+-
+- if (ea_inode_cache) {
+- hash = ext4_xattr_inode_get_hash(ea_inode);
+- mb_cache_entry_delete(ea_inode_cache, hash,
+- ea_inode->i_ino);
+- }
+ }
+ }
+
+@@ -1253,6 +1252,7 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
+ if (error)
+ goto out;
+
++retry_ref:
+ lock_buffer(bh);
+ hash = le32_to_cpu(BHDR(bh)->h_hash);
+ ref = le32_to_cpu(BHDR(bh)->h_refcount);
+@@ -1262,9 +1262,18 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
+ * This must happen under buffer lock for
+ * ext4_xattr_block_set() to reliably detect freed block
+ */
+- if (ea_block_cache)
+- mb_cache_entry_delete(ea_block_cache, hash,
+- bh->b_blocknr);
++ if (ea_block_cache) {
++ struct mb_cache_entry *oe;
++
++ oe = mb_cache_entry_delete_or_get(ea_block_cache, hash,
++ bh->b_blocknr);
++ if (oe) {
++ unlock_buffer(bh);
++ mb_cache_entry_wait_unused(oe);
++ mb_cache_entry_put(ea_block_cache, oe);
++ goto retry_ref;
++ }
++ }
+ get_bh(bh);
+ unlock_buffer(bh);
+
+@@ -1288,7 +1297,7 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
+ ce = mb_cache_entry_get(ea_block_cache, hash,
+ bh->b_blocknr);
+ if (ce) {
+- ce->e_reusable = 1;
++ set_bit(MBE_REUSABLE_B, &ce->e_flags);
+ mb_cache_entry_put(ea_block_cache, ce);
+ }
+ }
+@@ -1446,6 +1455,9 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,
+ if (!err)
+ err = ext4_inode_attach_jinode(ea_inode);
+ if (err) {
++ if (ext4_xattr_inode_dec_ref(handle, ea_inode))
++ ext4_warning_inode(ea_inode,
++ "cleanup dec ref error %d", err);
+ iput(ea_inode);
+ return ERR_PTR(err);
+ }
+@@ -1872,6 +1884,8 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
+ #define header(x) ((struct ext4_xattr_header *)(x))
+
+ if (s->base) {
++ int offset = (char *)s->here - bs->bh->b_data;
++
+ BUFFER_TRACE(bs->bh, "get_write_access");
+ error = ext4_journal_get_write_access(handle, bs->bh);
+ if (error)
+@@ -1886,9 +1900,20 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
+ * ext4_xattr_block_set() to reliably detect modified
+ * block
+ */
+- if (ea_block_cache)
+- mb_cache_entry_delete(ea_block_cache, hash,
+- bs->bh->b_blocknr);
++ if (ea_block_cache) {
++ struct mb_cache_entry *oe;
++
++ oe = mb_cache_entry_delete_or_get(ea_block_cache,
++ hash, bs->bh->b_blocknr);
++ if (oe) {
++ /*
++ * Xattr block is getting reused. Leave
++ * it alone.
++ */
++ mb_cache_entry_put(ea_block_cache, oe);
++ goto clone_block;
++ }
++ }
+ ea_bdebug(bs->bh, "modifying in-place");
+ error = ext4_xattr_set_entry(i, s, handle, inode,
+ true /* is_block */);
+@@ -1903,50 +1928,47 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
+ if (error)
+ goto cleanup;
+ goto inserted;
+- } else {
+- int offset = (char *)s->here - bs->bh->b_data;
++ }
++clone_block:
++ unlock_buffer(bs->bh);
++ ea_bdebug(bs->bh, "cloning");
++ s->base = kmemdup(BHDR(bs->bh), bs->bh->b_size, GFP_NOFS);
++ error = -ENOMEM;
++ if (s->base == NULL)
++ goto cleanup;
++ s->first = ENTRY(header(s->base)+1);
++ header(s->base)->h_refcount = cpu_to_le32(1);
++ s->here = ENTRY(s->base + offset);
++ s->end = s->base + bs->bh->b_size;
+
+- unlock_buffer(bs->bh);
+- ea_bdebug(bs->bh, "cloning");
+- s->base = kmalloc(bs->bh->b_size, GFP_NOFS);
+- error = -ENOMEM;
+- if (s->base == NULL)
++ /*
++ * If existing entry points to an xattr inode, we need
++ * to prevent ext4_xattr_set_entry() from decrementing
++ * ref count on it because the reference belongs to the
++ * original block. In this case, make the entry look
++ * like it has an empty value.
++ */
++ if (!s->not_found && s->here->e_value_inum) {
++ ea_ino = le32_to_cpu(s->here->e_value_inum);
++ error = ext4_xattr_inode_iget(inode, ea_ino,
++ le32_to_cpu(s->here->e_hash),
++ &tmp_inode);
++ if (error)
+ goto cleanup;
+- memcpy(s->base, BHDR(bs->bh), bs->bh->b_size);
+- s->first = ENTRY(header(s->base)+1);
+- header(s->base)->h_refcount = cpu_to_le32(1);
+- s->here = ENTRY(s->base + offset);
+- s->end = s->base + bs->bh->b_size;
+-
+- /*
+- * If existing entry points to an xattr inode, we need
+- * to prevent ext4_xattr_set_entry() from decrementing
+- * ref count on it because the reference belongs to the
+- * original block. In this case, make the entry look
+- * like it has an empty value.
+- */
+- if (!s->not_found && s->here->e_value_inum) {
+- ea_ino = le32_to_cpu(s->here->e_value_inum);
+- error = ext4_xattr_inode_iget(inode, ea_ino,
+- le32_to_cpu(s->here->e_hash),
+- &tmp_inode);
+- if (error)
+- goto cleanup;
+
+- if (!ext4_test_inode_state(tmp_inode,
+- EXT4_STATE_LUSTRE_EA_INODE)) {
+- /*
+- * Defer quota free call for previous
+- * inode until success is guaranteed.
+- */
+- old_ea_inode_quota = le32_to_cpu(
+- s->here->e_value_size);
+- }
+- iput(tmp_inode);
+-
+- s->here->e_value_inum = 0;
+- s->here->e_value_size = 0;
++ if (!ext4_test_inode_state(tmp_inode,
++ EXT4_STATE_LUSTRE_EA_INODE)) {
++ /*
++ * Defer quota free call for previous
++ * inode until success is guaranteed.
++ */
++ old_ea_inode_quota = le32_to_cpu(
++ s->here->e_value_size);
+ }
++ iput(tmp_inode);
++
++ s->here->e_value_inum = 0;
++ s->here->e_value_size = 0;
+ }
+ } else {
+ /* Allocate a buffer where we construct the new block. */
+@@ -2013,18 +2035,13 @@ inserted:
+ lock_buffer(new_bh);
+ /*
+ * We have to be careful about races with
+- * freeing, rehashing or adding references to
+- * xattr block. Once we hold buffer lock xattr
+- * block's state is stable so we can check
+- * whether the block got freed / rehashed or
+- * not. Since we unhash mbcache entry under
+- * buffer lock when freeing / rehashing xattr
+- * block, checking whether entry is still
+- * hashed is reliable. Same rules hold for
+- * e_reusable handling.
++ * adding references to xattr block. Once we
++ * hold buffer lock xattr block's state is
++ * stable so we can check the additional
++ * reference fits.
+ */
+- if (hlist_bl_unhashed(&ce->e_hash_list) ||
+- !ce->e_reusable) {
++ ref = le32_to_cpu(BHDR(new_bh)->h_refcount) + 1;
++ if (ref > EXT4_XATTR_REFCOUNT_MAX) {
+ /*
+ * Undo everything and check mbcache
+ * again.
+@@ -2039,10 +2056,9 @@ inserted:
+ new_bh = NULL;
+ goto inserted;
+ }
+- ref = le32_to_cpu(BHDR(new_bh)->h_refcount) + 1;
+ BHDR(new_bh)->h_refcount = cpu_to_le32(ref);
+- if (ref >= EXT4_XATTR_REFCOUNT_MAX)
+- ce->e_reusable = 0;
++ if (ref == EXT4_XATTR_REFCOUNT_MAX)
++ clear_bit(MBE_REUSABLE_B, &ce->e_flags);
+ ea_bdebug(new_bh, "reusing; refcount now=%d",
+ ref);
+ ext4_xattr_block_csum_set(inode, new_bh);
+@@ -2070,19 +2086,11 @@ inserted:
+
+ goal = ext4_group_first_block_no(sb,
+ EXT4_I(inode)->i_block_group);
+-
+- /* non-extent files can't have physical blocks past 2^32 */
+- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+- goal = goal & EXT4_MAX_BLOCK_FILE_PHYS;
+-
+ block = ext4_new_meta_blocks(handle, inode, goal, 0,
+ NULL, &error);
+ if (error)
+ goto cleanup;
+
+- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+- BUG_ON(block > EXT4_MAX_BLOCK_FILE_PHYS);
+-
+ ea_idebug(inode, "creating block %llu",
+ (unsigned long long)block);
+
+@@ -2575,7 +2583,7 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode,
+
+ is = kzalloc(sizeof(struct ext4_xattr_ibody_find), GFP_NOFS);
+ bs = kzalloc(sizeof(struct ext4_xattr_block_find), GFP_NOFS);
+- buffer = kmalloc(value_size, GFP_NOFS);
++ buffer = kvmalloc(value_size, GFP_NOFS);
+ b_entry_name = kmalloc(entry->e_name_len + 1, GFP_NOFS);
+ if (!is || !bs || !buffer || !b_entry_name) {
+ error = -ENOMEM;
+@@ -2627,7 +2635,7 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode,
+ error = 0;
+ out:
+ kfree(b_entry_name);
+- kfree(buffer);
++ kvfree(buffer);
+ if (is)
+ brelse(is->iloc.bh);
+ if (bs)
+diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
+index 990084e00374f..231ef308d10cb 100644
+--- a/fs/ext4/xattr.h
++++ b/fs/ext4/xattr.h
+@@ -190,6 +190,7 @@ extern void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *array);
+
+ extern int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
+ struct ext4_inode *raw_inode, handle_t *handle);
++extern void ext4_evict_ea_inode(struct inode *inode);
+
+ extern const struct xattr_handler *ext4_xattr_handlers[];
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 6fbf0471323e7..7596fce92bef1 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -1382,7 +1382,7 @@ static int __issue_discard_cmd(struct f2fs_sb_info *sbi,
+ if (i + 1 < dpolicy->granularity)
+ break;
+
+- if (i < DEFAULT_DISCARD_GRANULARITY && dpolicy->ordered)
++ if (i + 1 < DEFAULT_DISCARD_GRANULARITY && dpolicy->ordered)
+ return __issue_discard_cmd_orderly(sbi, dpolicy);
+
+ pend_list = &dcc->pend_list[i];
+diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
+index da243c84e93b0..ee2ea5532e69b 100644
+--- a/fs/hfs/inode.c
++++ b/fs/hfs/inode.c
+@@ -453,14 +453,16 @@ int hfs_write_inode(struct inode *inode, struct writeback_control *wbc)
+ /* panic? */
+ return -EIO;
+
++ res = -EIO;
++ if (HFS_I(main_inode)->cat_key.CName.len > HFS_NAMELEN)
++ goto out;
+ fd.search_key->cat = HFS_I(main_inode)->cat_key;
+ if (hfs_brec_find(&fd))
+- /* panic? */
+ goto out;
+
+ if (S_ISDIR(main_inode->i_mode)) {
+ if (fd.entrylength < sizeof(struct hfs_cat_dir))
+- /* panic? */;
++ goto out;
+ hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
+ sizeof(struct hfs_cat_dir));
+ if (rec.type != HFS_CDR_DIR ||
+@@ -473,6 +475,8 @@ int hfs_write_inode(struct inode *inode, struct writeback_control *wbc)
+ hfs_bnode_write(fd.bnode, &rec, fd.entryoffset,
+ sizeof(struct hfs_cat_dir));
+ } else if (HFS_IS_RSRC(inode)) {
++ if (fd.entrylength < sizeof(struct hfs_cat_file))
++ goto out;
+ hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
+ sizeof(struct hfs_cat_file));
+ hfs_inode_write_fork(inode, rec.file.RExtRec,
+@@ -481,7 +485,7 @@ int hfs_write_inode(struct inode *inode, struct writeback_control *wbc)
+ sizeof(struct hfs_cat_file));
+ } else {
+ if (fd.entrylength < sizeof(struct hfs_cat_file))
+- /* panic? */;
++ goto out;
+ hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
+ sizeof(struct hfs_cat_file));
+ if (rec.type != HFS_CDR_FIL ||
+@@ -498,9 +502,10 @@ int hfs_write_inode(struct inode *inode, struct writeback_control *wbc)
+ hfs_bnode_write(fd.bnode, &rec, fd.entryoffset,
+ sizeof(struct hfs_cat_file));
+ }
++ res = 0;
+ out:
+ hfs_find_exit(&fd);
+- return 0;
++ return res;
+ }
+
+ static struct dentry *hfs_file_lookup(struct inode *dir, struct dentry *dentry,
+diff --git a/fs/hfs/trans.c b/fs/hfs/trans.c
+index 39f5e343bf4d4..fdb0edb8a607d 100644
+--- a/fs/hfs/trans.c
++++ b/fs/hfs/trans.c
+@@ -109,7 +109,7 @@ void hfs_asc2mac(struct super_block *sb, struct hfs_name *out, const struct qstr
+ if (nls_io) {
+ wchar_t ch;
+
+- while (srclen > 0) {
++ while (srclen > 0 && dstlen > 0) {
+ size = nls_io->char2uni(src, srclen, &ch);
+ if (size < 0) {
+ ch = '?';
+diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
+index dd7ad9f13e3aa..db2e1c750199a 100644
+--- a/fs/hfsplus/hfsplus_fs.h
++++ b/fs/hfsplus/hfsplus_fs.h
+@@ -198,6 +198,8 @@ struct hfsplus_sb_info {
+ #define HFSPLUS_SB_HFSX 3
+ #define HFSPLUS_SB_CASEFOLD 4
+ #define HFSPLUS_SB_NOBARRIER 5
++#define HFSPLUS_SB_UID 6
++#define HFSPLUS_SB_GID 7
+
+ static inline struct hfsplus_sb_info *HFSPLUS_SB(struct super_block *sb)
+ {
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index d7ab9d8c4b674..c7073a1517d68 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -187,11 +187,11 @@ static void hfsplus_get_perms(struct inode *inode,
+ mode = be16_to_cpu(perms->mode);
+
+ i_uid_write(inode, be32_to_cpu(perms->owner));
+- if (!i_uid_read(inode) && !mode)
++ if ((test_bit(HFSPLUS_SB_UID, &sbi->flags)) || (!i_uid_read(inode) && !mode))
+ inode->i_uid = sbi->uid;
+
+ i_gid_write(inode, be32_to_cpu(perms->group));
+- if (!i_gid_read(inode) && !mode)
++ if ((test_bit(HFSPLUS_SB_GID, &sbi->flags)) || (!i_gid_read(inode) && !mode))
+ inode->i_gid = sbi->gid;
+
+ if (dir) {
+@@ -476,8 +476,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ if (type == HFSPLUS_FOLDER) {
+ struct hfsplus_cat_folder *folder = &entry.folder;
+
+- if (fd->entrylength < sizeof(struct hfsplus_cat_folder))
+- /* panic? */;
++ WARN_ON(fd->entrylength < sizeof(struct hfsplus_cat_folder));
+ hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
+ sizeof(struct hfsplus_cat_folder));
+ hfsplus_get_perms(inode, &folder->permissions, 1);
+@@ -497,8 +496,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ } else if (type == HFSPLUS_FILE) {
+ struct hfsplus_cat_file *file = &entry.file;
+
+- if (fd->entrylength < sizeof(struct hfsplus_cat_file))
+- /* panic? */;
++ WARN_ON(fd->entrylength < sizeof(struct hfsplus_cat_file));
+ hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
+ sizeof(struct hfsplus_cat_file));
+
+@@ -555,8 +553,7 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ if (S_ISDIR(main_inode->i_mode)) {
+ struct hfsplus_cat_folder *folder = &entry.folder;
+
+- if (fd.entrylength < sizeof(struct hfsplus_cat_folder))
+- /* panic? */;
++ WARN_ON(fd.entrylength < sizeof(struct hfsplus_cat_folder));
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ sizeof(struct hfsplus_cat_folder));
+ /* simple node checks? */
+@@ -581,8 +578,7 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ } else {
+ struct hfsplus_cat_file *file = &entry.file;
+
+- if (fd.entrylength < sizeof(struct hfsplus_cat_file))
+- /* panic? */;
++ WARN_ON(fd.entrylength < sizeof(struct hfsplus_cat_file));
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ sizeof(struct hfsplus_cat_file));
+ hfsplus_inode_write_fork(inode, &file->data_fork);
+diff --git a/fs/hfsplus/options.c b/fs/hfsplus/options.c
+index 047e05c575601..c94a58762ad6d 100644
+--- a/fs/hfsplus/options.c
++++ b/fs/hfsplus/options.c
+@@ -140,6 +140,8 @@ int hfsplus_parse_options(char *input, struct hfsplus_sb_info *sbi)
+ if (!uid_valid(sbi->uid)) {
+ pr_err("invalid uid specified\n");
+ return 0;
++ } else {
++ set_bit(HFSPLUS_SB_UID, &sbi->flags);
+ }
+ break;
+ case opt_gid:
+@@ -151,6 +153,8 @@ int hfsplus_parse_options(char *input, struct hfsplus_sb_info *sbi)
+ if (!gid_valid(sbi->gid)) {
+ pr_err("invalid gid specified\n");
+ return 0;
++ } else {
++ set_bit(HFSPLUS_SB_GID, &sbi->flags);
+ }
+ break;
+ case opt_part:
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 1014f2a24697f..f06796cad9aa8 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -168,7 +168,7 @@ int dbMount(struct inode *ipbmap)
+ struct bmap *bmp;
+ struct dbmap_disk *dbmp_le;
+ struct metapage *mp;
+- int i;
++ int i, err;
+
+ /*
+ * allocate/initialize the in-memory bmap descriptor
+@@ -183,8 +183,8 @@ int dbMount(struct inode *ipbmap)
+ BMAPBLKNO << JFS_SBI(ipbmap->i_sb)->l2nbperpage,
+ PSIZE, 0);
+ if (mp == NULL) {
+- kfree(bmp);
+- return -EIO;
++ err = -EIO;
++ goto err_kfree_bmp;
+ }
+
+ /* copy the on-disk bmap descriptor to its in-memory version. */
+@@ -194,9 +194,8 @@ int dbMount(struct inode *ipbmap)
+ bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage);
+ bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
+ if (!bmp->db_numag) {
+- release_metapage(mp);
+- kfree(bmp);
+- return -EINVAL;
++ err = -EINVAL;
++ goto err_release_metapage;
+ }
+
+ bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel);
+@@ -207,6 +206,16 @@ int dbMount(struct inode *ipbmap)
+ bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth);
+ bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart);
+ bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size);
++ if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG) {
++ err = -EINVAL;
++ goto err_release_metapage;
++ }
++
++ if (((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) {
++ err = -EINVAL;
++ goto err_release_metapage;
++ }
++
+ for (i = 0; i < MAXAG; i++)
+ bmp->db_agfree[i] = le64_to_cpu(dbmp_le->dn_agfree[i]);
+ bmp->db_agsize = le64_to_cpu(dbmp_le->dn_agsize);
+@@ -227,6 +236,12 @@ int dbMount(struct inode *ipbmap)
+ BMAP_LOCK_INIT(bmp);
+
+ return (0);
++
++err_release_metapage:
++ release_metapage(mp);
++err_kfree_bmp:
++ kfree(bmp);
++ return err;
+ }
+
+
+diff --git a/fs/libfs.c b/fs/libfs.c
+index be57e64834e5a..fd5f6c1060595 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -864,8 +864,8 @@ out:
+ EXPORT_SYMBOL_GPL(simple_attr_read);
+
+ /* interpret the buffer as a number to call the set function with */
+-ssize_t simple_attr_write(struct file *file, const char __user *buf,
+- size_t len, loff_t *ppos)
++static ssize_t simple_attr_write_xsigned(struct file *file, const char __user *buf,
++ size_t len, loff_t *ppos, bool is_signed)
+ {
+ struct simple_attr *attr;
+ unsigned long long val;
+@@ -886,7 +886,10 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+ goto out;
+
+ attr->set_buf[size] = '\0';
+- ret = kstrtoull(attr->set_buf, 0, &val);
++ if (is_signed)
++ ret = kstrtoll(attr->set_buf, 0, &val);
++ else
++ ret = kstrtoull(attr->set_buf, 0, &val);
+ if (ret)
+ goto out;
+ ret = attr->set(attr->data, val);
+@@ -896,8 +899,21 @@ out:
+ mutex_unlock(&attr->mutex);
+ return ret;
+ }
++
++ssize_t simple_attr_write(struct file *file, const char __user *buf,
++ size_t len, loff_t *ppos)
++{
++ return simple_attr_write_xsigned(file, buf, len, ppos, false);
++}
+ EXPORT_SYMBOL_GPL(simple_attr_write);
+
++ssize_t simple_attr_write_signed(struct file *file, const char __user *buf,
++ size_t len, loff_t *ppos)
++{
++ return simple_attr_write_xsigned(file, buf, len, ppos, true);
++}
++EXPORT_SYMBOL_GPL(simple_attr_write_signed);
++
+ /**
+ * generic_fh_to_dentry - generic helper for the fh_to_dentry export operation
+ * @sb: filesystem to do the file handle conversion on
+diff --git a/fs/mbcache.c b/fs/mbcache.c
+index 081ccf0caee35..2e2d4de4cf875 100644
+--- a/fs/mbcache.c
++++ b/fs/mbcache.c
+@@ -10,7 +10,7 @@
+ /*
+ * Mbcache is a simple key-value store. Keys need not be unique, however
+ * key-value pairs are expected to be unique (we use this fact in
+- * mb_cache_entry_delete()).
++ * mb_cache_entry_delete_or_get()).
+ *
+ * Ext2 and ext4 use this cache for deduplication of extended attribute blocks.
+ * Ext4 also uses it for deduplication of xattr values stored in inodes.
+@@ -89,12 +89,19 @@ int mb_cache_entry_create(struct mb_cache *cache, gfp_t mask, u32 key,
+ return -ENOMEM;
+
+ INIT_LIST_HEAD(&entry->e_list);
+- /* One ref for hash, one ref returned */
+- atomic_set(&entry->e_refcnt, 1);
++ /*
++ * We create entry with two references. One reference is kept by the
++ * hash table, the other reference is used to protect us from
++ * mb_cache_entry_delete_or_get() until the entry is fully setup. This
++ * avoids nesting of cache->c_list_lock into hash table bit locks which
++ * is problematic for RT.
++ */
++ atomic_set(&entry->e_refcnt, 2);
+ entry->e_key = key;
+ entry->e_value = value;
+- entry->e_reusable = reusable;
+- entry->e_referenced = 0;
++ entry->e_flags = 0;
++ if (reusable)
++ set_bit(MBE_REUSABLE_B, &entry->e_flags);
+ head = mb_cache_entry_head(cache, key);
+ hlist_bl_lock(head);
+ hlist_bl_for_each_entry(dup, dup_node, head, e_hash_list) {
+@@ -106,24 +113,41 @@ int mb_cache_entry_create(struct mb_cache *cache, gfp_t mask, u32 key,
+ }
+ hlist_bl_add_head(&entry->e_hash_list, head);
+ hlist_bl_unlock(head);
+-
+ spin_lock(&cache->c_list_lock);
+ list_add_tail(&entry->e_list, &cache->c_list);
+- /* Grab ref for LRU list */
+- atomic_inc(&entry->e_refcnt);
+ cache->c_entry_count++;
+ spin_unlock(&cache->c_list_lock);
++ mb_cache_entry_put(cache, entry);
+
+ return 0;
+ }
+ EXPORT_SYMBOL(mb_cache_entry_create);
+
+-void __mb_cache_entry_free(struct mb_cache_entry *entry)
++void __mb_cache_entry_free(struct mb_cache *cache, struct mb_cache_entry *entry)
+ {
++ struct hlist_bl_head *head;
++
++ head = mb_cache_entry_head(cache, entry->e_key);
++ hlist_bl_lock(head);
++ hlist_bl_del(&entry->e_hash_list);
++ hlist_bl_unlock(head);
+ kmem_cache_free(mb_entry_cache, entry);
+ }
+ EXPORT_SYMBOL(__mb_cache_entry_free);
+
++/*
++ * mb_cache_entry_wait_unused - wait to be the last user of the entry
++ *
++ * @entry - entry to work on
++ *
++ * Wait to be the last user of the entry.
++ */
++void mb_cache_entry_wait_unused(struct mb_cache_entry *entry)
++{
++ wait_var_event(&entry->e_refcnt, atomic_read(&entry->e_refcnt) <= 2);
++}
++EXPORT_SYMBOL(mb_cache_entry_wait_unused);
++
+ static struct mb_cache_entry *__entry_find(struct mb_cache *cache,
+ struct mb_cache_entry *entry,
+ u32 key)
+@@ -141,10 +165,10 @@ static struct mb_cache_entry *__entry_find(struct mb_cache *cache,
+ while (node) {
+ entry = hlist_bl_entry(node, struct mb_cache_entry,
+ e_hash_list);
+- if (entry->e_key == key && entry->e_reusable) {
+- atomic_inc(&entry->e_refcnt);
++ if (entry->e_key == key &&
++ test_bit(MBE_REUSABLE_B, &entry->e_flags) &&
++ atomic_inc_not_zero(&entry->e_refcnt))
+ goto out;
+- }
+ node = node->next;
+ }
+ entry = NULL;
+@@ -204,10 +228,9 @@ struct mb_cache_entry *mb_cache_entry_get(struct mb_cache *cache, u32 key,
+ head = mb_cache_entry_head(cache, key);
+ hlist_bl_lock(head);
+ hlist_bl_for_each_entry(entry, node, head, e_hash_list) {
+- if (entry->e_key == key && entry->e_value == value) {
+- atomic_inc(&entry->e_refcnt);
++ if (entry->e_key == key && entry->e_value == value &&
++ atomic_inc_not_zero(&entry->e_refcnt))
+ goto out;
+- }
+ }
+ entry = NULL;
+ out:
+@@ -216,7 +239,7 @@ out:
+ }
+ EXPORT_SYMBOL(mb_cache_entry_get);
+
+-/* mb_cache_entry_delete - remove a cache entry
++/* mb_cache_entry_delete - try to remove a cache entry
+ * @cache - cache we work with
+ * @key - key
+ * @value - value
+@@ -253,6 +276,43 @@ void mb_cache_entry_delete(struct mb_cache *cache, u32 key, u64 value)
+ }
+ EXPORT_SYMBOL(mb_cache_entry_delete);
+
++/* mb_cache_entry_delete_or_get - remove a cache entry if it has no users
++ * @cache - cache we work with
++ * @key - key
++ * @value - value
++ *
++ * Remove entry from cache @cache with key @key and value @value. The removal
++ * happens only if the entry is unused. The function returns NULL in case the
++ * entry was successfully removed or there's no entry in cache. Otherwise the
++ * function grabs reference of the entry that we failed to delete because it
++ * still has users and return it.
++ */
++struct mb_cache_entry *mb_cache_entry_delete_or_get(struct mb_cache *cache,
++ u32 key, u64 value)
++{
++ struct mb_cache_entry *entry;
++
++ entry = mb_cache_entry_get(cache, key, value);
++ if (!entry)
++ return NULL;
++
++ /*
++ * Drop the ref we got from mb_cache_entry_get() and the initial hash
++ * ref if we are the last user
++ */
++ if (atomic_cmpxchg(&entry->e_refcnt, 2, 0) != 2)
++ return entry;
++
++ spin_lock(&cache->c_list_lock);
++ if (!list_empty(&entry->e_list))
++ list_del_init(&entry->e_list);
++ cache->c_entry_count--;
++ spin_unlock(&cache->c_list_lock);
++ __mb_cache_entry_free(cache, entry);
++ return NULL;
++}
++EXPORT_SYMBOL(mb_cache_entry_delete_or_get);
++
+ /* mb_cache_entry_touch - cache entry got used
+ * @cache - cache the entry belongs to
+ * @entry - entry that got used
+@@ -262,7 +322,7 @@ EXPORT_SYMBOL(mb_cache_entry_delete);
+ void mb_cache_entry_touch(struct mb_cache *cache,
+ struct mb_cache_entry *entry)
+ {
+- entry->e_referenced = 1;
++ set_bit(MBE_REFERENCED_B, &entry->e_flags);
+ }
+ EXPORT_SYMBOL(mb_cache_entry_touch);
+
+@@ -280,34 +340,24 @@ static unsigned long mb_cache_shrink(struct mb_cache *cache,
+ unsigned long nr_to_scan)
+ {
+ struct mb_cache_entry *entry;
+- struct hlist_bl_head *head;
+ unsigned long shrunk = 0;
+
+ spin_lock(&cache->c_list_lock);
+ while (nr_to_scan-- && !list_empty(&cache->c_list)) {
+ entry = list_first_entry(&cache->c_list,
+ struct mb_cache_entry, e_list);
+- if (entry->e_referenced) {
+- entry->e_referenced = 0;
++ /* Drop initial hash reference if there is no user */
++ if (test_bit(MBE_REFERENCED_B, &entry->e_flags) ||
++ atomic_cmpxchg(&entry->e_refcnt, 1, 0) != 1) {
++ clear_bit(MBE_REFERENCED_B, &entry->e_flags);
+ list_move_tail(&entry->e_list, &cache->c_list);
+ continue;
+ }
+ list_del_init(&entry->e_list);
+ cache->c_entry_count--;
+- /*
+- * We keep LRU list reference so that entry doesn't go away
+- * from under us.
+- */
+ spin_unlock(&cache->c_list_lock);
+- head = mb_cache_entry_head(cache, entry->e_key);
+- hlist_bl_lock(head);
+- if (!hlist_bl_unhashed(&entry->e_hash_list)) {
+- hlist_bl_del_init(&entry->e_hash_list);
+- atomic_dec(&entry->e_refcnt);
+- }
+- hlist_bl_unlock(head);
+- if (mb_cache_entry_put(cache, entry))
+- shrunk++;
++ __mb_cache_entry_free(cache, entry);
++ shrunk++;
+ cond_resched();
+ spin_lock(&cache->c_list_lock);
+ }
+@@ -399,11 +449,6 @@ void mb_cache_destroy(struct mb_cache *cache)
+ * point.
+ */
+ list_for_each_entry_safe(entry, next, &cache->c_list, e_list) {
+- if (!hlist_bl_unhashed(&entry->e_hash_list)) {
+- hlist_bl_del_init(&entry->e_hash_list);
+- atomic_dec(&entry->e_refcnt);
+- } else
+- WARN_ON(1);
+ list_del(&entry->e_list);
+ WARN_ON(atomic_read(&entry->e_refcnt) != 1);
+ mb_cache_entry_put(cache, entry);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 9a0f48f7f2b83..250fa88303fad 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1980,18 +1980,18 @@ static struct nfs4_opendata *nfs4_open_recoverdata_alloc(struct nfs_open_context
+ }
+
+ static int nfs4_open_recover_helper(struct nfs4_opendata *opendata,
+- fmode_t fmode)
++ fmode_t fmode)
+ {
+ struct nfs4_state *newstate;
++ struct nfs_server *server = NFS_SB(opendata->dentry->d_sb);
++ int openflags = opendata->o_arg.open_flags;
+ int ret;
+
+ if (!nfs4_mode_match_open_stateid(opendata->state, fmode))
+ return 0;
+- opendata->o_arg.open_flags = 0;
+ opendata->o_arg.fmode = fmode;
+- opendata->o_arg.share_access = nfs4_map_atomic_open_share(
+- NFS_SB(opendata->dentry->d_sb),
+- fmode, 0);
++ opendata->o_arg.share_access =
++ nfs4_map_atomic_open_share(server, fmode, openflags);
+ memset(&opendata->o_res, 0, sizeof(opendata->o_res));
+ memset(&opendata->c_res, 0, sizeof(opendata->c_res));
+ nfs4_init_opendata_res(opendata);
+@@ -2569,10 +2569,15 @@ static int _nfs4_open_expired(struct nfs_open_context *ctx, struct nfs4_state *s
+ struct nfs4_opendata *opendata;
+ int ret;
+
+- opendata = nfs4_open_recoverdata_alloc(ctx, state,
+- NFS4_OPEN_CLAIM_FH);
++ opendata = nfs4_open_recoverdata_alloc(ctx, state, NFS4_OPEN_CLAIM_FH);
+ if (IS_ERR(opendata))
+ return PTR_ERR(opendata);
++ /*
++ * We're not recovering a delegation, so ask for no delegation.
++ * Otherwise the recovery thread could deadlock with an outstanding
++ * delegation return.
++ */
++ opendata->o_arg.open_flags = O_DIRECT;
+ ret = nfs4_open_recover(opendata, state);
+ if (ret == -ESTALE)
+ d_drop(ctx->dentry);
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 5ab021f87ecf8..b9fbd01ef4cfe 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1247,6 +1247,8 @@ void nfs4_schedule_state_manager(struct nfs_client *clp)
+ if (IS_ERR(task)) {
+ printk(KERN_ERR "%s: kthread_run: %ld\n",
+ __func__, PTR_ERR(task));
++ if (!nfs_client_init_is_complete(clp))
++ nfs_mark_client_ready(clp, PTR_ERR(task));
+ nfs4_clear_state_manager_bit(clp);
+ nfs_put_client(clp);
+ module_put(THIS_MODULE);
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index 56e48642c43eb..f0021e3b8efdd 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -4277,12 +4277,10 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
+ if (unlikely(!p))
+ goto out_overflow;
+ if (len < NFS4_MAXLABELLEN) {
+- if (label) {
+- if (label->len) {
+- if (label->len < len)
+- return -ERANGE;
+- memcpy(label->label, p, len);
+- }
++ if (label && label->len) {
++ if (label->len < len)
++ return -ERANGE;
++ memcpy(label->label, p, len);
+ label->len = len;
+ label->pi = pi;
+ label->lfs = lfs;
+diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
+index 7ee417b685e98..519d994c0c4c0 100644
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -800,7 +800,6 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c
+ } else {
+ if (!conn->cb_xprt)
+ return -EINVAL;
+- clp->cl_cb_conn.cb_xprt = conn->cb_xprt;
+ clp->cl_cb_session = ses;
+ args.bc_xprt = conn->cb_xprt;
+ args.prognumber = clp->cl_cb_session->se_cb_prog;
+@@ -820,6 +819,9 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c
+ rpc_shutdown_client(client);
+ return PTR_ERR(cred);
+ }
++
++ if (clp->cl_minorversion != 0)
++ clp->cl_cb_conn.cb_xprt = conn->cb_xprt;
+ clp->cl_cb_client = client;
+ clp->cl_cb_cred = cred;
+ return 0;
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 96b79bd906313..c82f898325c1c 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -3102,6 +3102,17 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
+ case nfserr_noent:
+ xdr_truncate_encode(xdr, start_offset);
+ goto skip_entry;
++ case nfserr_jukebox:
++ /*
++ * The pseudoroot should only display dentries that lead to
++ * exports. If we get EJUKEBOX here, then we can't tell whether
++ * this entry should be included. Just fail the whole READDIR
++ * with NFS4ERR_DELAY in that case, and hope that the situation
++ * will resolve itself by the client's next attempt.
++ */
++ if (cd->rd_fhp->fh_export->ex_flags & NFSEXP_V4ROOT)
++ goto fail;
++ /* fallthrough */
+ default:
+ /*
+ * If the client requested the RDATTR_ERROR attribute,
+diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
+index fb61c33c60045..74ef3d313686f 100644
+--- a/fs/nilfs2/the_nilfs.c
++++ b/fs/nilfs2/the_nilfs.c
+@@ -13,6 +13,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/backing-dev.h>
+ #include <linux/random.h>
++#include <linux/log2.h>
+ #include <linux/crc32.h>
+ #include "nilfs.h"
+ #include "segment.h"
+@@ -448,11 +449,33 @@ static int nilfs_valid_sb(struct nilfs_super_block *sbp)
+ return crc == le32_to_cpu(sbp->s_sum);
+ }
+
+-static int nilfs_sb2_bad_offset(struct nilfs_super_block *sbp, u64 offset)
++/**
++ * nilfs_sb2_bad_offset - check the location of the second superblock
++ * @sbp: superblock raw data buffer
++ * @offset: byte offset of second superblock calculated from device size
++ *
++ * nilfs_sb2_bad_offset() checks if the position on the second
++ * superblock is valid or not based on the filesystem parameters
++ * stored in @sbp. If @offset points to a location within the segment
++ * area, or if the parameters themselves are not normal, it is
++ * determined to be invalid.
++ *
++ * Return Value: true if invalid, false if valid.
++ */
++static bool nilfs_sb2_bad_offset(struct nilfs_super_block *sbp, u64 offset)
+ {
+- return offset < ((le64_to_cpu(sbp->s_nsegments) *
+- le32_to_cpu(sbp->s_blocks_per_segment)) <<
+- (le32_to_cpu(sbp->s_log_block_size) + 10));
++ unsigned int shift_bits = le32_to_cpu(sbp->s_log_block_size);
++ u32 blocks_per_segment = le32_to_cpu(sbp->s_blocks_per_segment);
++ u64 nsegments = le64_to_cpu(sbp->s_nsegments);
++ u64 index;
++
++ if (blocks_per_segment < NILFS_SEG_MIN_BLOCKS ||
++ shift_bits > ilog2(NILFS_MAX_BLOCK_SIZE) - BLOCK_SIZE_BITS)
++ return true;
++
++ index = offset >> (shift_bits + BLOCK_SIZE_BITS);
++ do_div(index, blocks_per_segment);
++ return index < nsegments;
+ }
+
+ static void nilfs_release_super_block(struct the_nilfs *nilfs)
+diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
+index e7eb08ac42156..10d691530d83d 100644
+--- a/fs/ocfs2/stackglue.c
++++ b/fs/ocfs2/stackglue.c
+@@ -715,6 +715,8 @@ static struct ctl_table_header *ocfs2_table_header;
+
+ static int __init ocfs2_stack_glue_init(void)
+ {
++ int ret;
++
+ strcpy(cluster_stack_name, OCFS2_STACK_PLUGIN_O2CB);
+
+ ocfs2_table_header = register_sysctl_table(ocfs2_root_table);
+@@ -724,7 +726,11 @@ static int __init ocfs2_stack_glue_init(void)
+ return -ENOMEM; /* or something. */
+ }
+
+- return ocfs2_sysfs_init();
++ ret = ocfs2_sysfs_init();
++ if (ret)
++ unregister_sysctl_table(ocfs2_table_header);
++
++ return ret;
+ }
+
+ static void __exit ocfs2_stack_glue_exit(void)
+diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c
+index e24738c691f66..f79c015fa7cb8 100644
+--- a/fs/orangefs/orangefs-debugfs.c
++++ b/fs/orangefs/orangefs-debugfs.c
+@@ -254,6 +254,8 @@ out:
+ void orangefs_debugfs_cleanup(void)
+ {
+ debugfs_remove_recursive(debug_dir);
++ kfree(debug_help_string);
++ debug_help_string = NULL;
+ }
+
+ /* open ORANGEFS_KMOD_DEBUG_HELP_FILE */
+@@ -709,6 +711,7 @@ int orangefs_prepare_debugfs_help_string(int at_boot)
+ memset(debug_help_string, 0, DEBUG_HELP_STRING_SIZE);
+ strlcat(debug_help_string, new, string_size);
+ mutex_unlock(&orangefs_help_file_lock);
++ kfree(new);
+ }
+
+ rc = 0;
+diff --git a/fs/orangefs/orangefs-mod.c b/fs/orangefs/orangefs-mod.c
+index 85ef87245a872..c8818163e3922 100644
+--- a/fs/orangefs/orangefs-mod.c
++++ b/fs/orangefs/orangefs-mod.c
+@@ -141,7 +141,7 @@ static int __init orangefs_init(void)
+ gossip_err("%s: could not initialize device subsystem %d!\n",
+ __func__,
+ ret);
+- goto cleanup_device;
++ goto cleanup_sysfs;
+ }
+
+ ret = register_filesystem(&orangefs_fs_type);
+@@ -153,11 +153,11 @@ static int __init orangefs_init(void)
+ goto out;
+ }
+
+- orangefs_sysfs_exit();
+-
+-cleanup_device:
+ orangefs_dev_cleanup();
+
++cleanup_sysfs:
++ orangefs_sysfs_exit();
++
+ sysfs_init_failed:
+
+ debugfs_init_failed:
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 06dc649629c74..9fa64dbde97ad 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -561,28 +561,42 @@ static int ovl_create_or_link(struct dentry *dentry, struct inode *inode,
+ goto out_revert_creds;
+ }
+
+- err = -ENOMEM;
+- override_cred = prepare_creds();
+- if (override_cred) {
++ if (!attr->hardlink) {
++ err = -ENOMEM;
++ override_cred = prepare_creds();
++ if (!override_cred)
++ goto out_revert_creds;
++ /*
++ * In the creation cases(create, mkdir, mknod, symlink),
++ * ovl should transfer current's fs{u,g}id to underlying
++ * fs. Because underlying fs want to initialize its new
++ * inode owner using current's fs{u,g}id. And in this
++ * case, the @inode is a new inode that is initialized
++ * in inode_init_owner() to current's fs{u,g}id. So use
++ * the inode's i_{u,g}id to override the cred's fs{u,g}id.
++ *
++ * But in the other hardlink case, ovl_link() does not
++ * create a new inode, so just use the ovl mounter's
++ * fs{u,g}id.
++ */
+ override_cred->fsuid = inode->i_uid;
+ override_cred->fsgid = inode->i_gid;
+- if (!attr->hardlink) {
+- err = security_dentry_create_files_as(dentry,
+- attr->mode, &dentry->d_name, old_cred,
+- override_cred);
+- if (err) {
+- put_cred(override_cred);
+- goto out_revert_creds;
+- }
++ err = security_dentry_create_files_as(dentry,
++ attr->mode, &dentry->d_name, old_cred,
++ override_cred);
++ if (err) {
++ put_cred(override_cred);
++ goto out_revert_creds;
+ }
+ put_cred(override_creds(override_cred));
+ put_cred(override_cred);
+-
+- if (!ovl_dentry_is_whiteout(dentry))
+- err = ovl_create_upper(dentry, inode, attr);
+- else
+- err = ovl_create_over_whiteout(dentry, inode, attr);
+ }
++
++ if (!ovl_dentry_is_whiteout(dentry))
++ err = ovl_create_upper(dentry, inode, attr);
++ else
++ err = ovl_create_over_whiteout(dentry, inode, attr);
++
+ out_revert_creds:
+ revert_creds(old_cred);
+ return err;
+diff --git a/fs/pnode.c b/fs/pnode.c
+index 7910ae91f17e9..d27b7b97c4c17 100644
+--- a/fs/pnode.c
++++ b/fs/pnode.c
+@@ -245,7 +245,7 @@ static int propagate_one(struct mount *m)
+ }
+ do {
+ struct mount *parent = last_source->mnt_parent;
+- if (last_source == first_source)
++ if (peers(last_source, first_source))
+ break;
+ done = parent->mnt_master == p;
+ if (done && peers(n, parent))
+diff --git a/fs/pstore/Kconfig b/fs/pstore/Kconfig
+index 503086f7f7c1b..d5fb6d95d4d40 100644
+--- a/fs/pstore/Kconfig
++++ b/fs/pstore/Kconfig
+@@ -117,6 +117,7 @@ config PSTORE_CONSOLE
+ config PSTORE_PMSG
+ bool "Log user space messages"
+ depends on PSTORE
++ select RT_MUTEXES
+ help
+ When the option is enabled, pstore will export a character
+ interface /dev/pmsg0 to log user space messages. On reboot
+diff --git a/fs/pstore/pmsg.c b/fs/pstore/pmsg.c
+index 24db02de17874..ffc13ea196d2a 100644
+--- a/fs/pstore/pmsg.c
++++ b/fs/pstore/pmsg.c
+@@ -15,9 +15,10 @@
+ #include <linux/device.h>
+ #include <linux/fs.h>
+ #include <linux/uaccess.h>
++#include <linux/rtmutex.h>
+ #include "internal.h"
+
+-static DEFINE_MUTEX(pmsg_lock);
++static DEFINE_RT_MUTEX(pmsg_lock);
+
+ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ size_t count, loff_t *ppos)
+@@ -36,9 +37,9 @@ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ if (!access_ok(VERIFY_READ, buf, count))
+ return -EFAULT;
+
+- mutex_lock(&pmsg_lock);
++ rt_mutex_lock(&pmsg_lock);
+ ret = psinfo->write_user(&record, buf);
+- mutex_unlock(&pmsg_lock);
++ rt_mutex_unlock(&pmsg_lock);
+ return ret ? ret : count;
+ }
+
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index bafbab2dd0392..33294dee7d7f6 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -753,6 +753,7 @@ static int ramoops_probe(struct platform_device *pdev)
+ /* Make sure we didn't get bogus platform data pointer. */
+ if (!pdata) {
+ pr_err("NULL platform data\n");
++ err = -EINVAL;
+ goto fail_out;
+ }
+
+@@ -760,6 +761,7 @@ static int ramoops_probe(struct platform_device *pdev)
+ !pdata->ftrace_size && !pdata->pmsg_size)) {
+ pr_err("The memory size and the record/console size must be "
+ "non-zero\n");
++ err = -EINVAL;
+ goto fail_out;
+ }
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 3c777ec80d470..60dff71804120 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -426,7 +426,11 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
+ phys_addr_t addr = page_start + i * PAGE_SIZE;
+ pages[i] = pfn_to_page(addr >> PAGE_SHIFT);
+ }
+- vaddr = vmap(pages, page_count, VM_MAP, prot);
++ /*
++ * VM_IOREMAP used here to bypass this region during vread()
++ * and kmap_atomic() (i.e. kcore) to avoid __va() failures.
++ */
++ vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot);
+ kfree(pages);
+
+ /*
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index ddb379abd919d..770a2b1434856 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -2298,28 +2298,62 @@ EXPORT_SYMBOL(dquot_quota_off);
+ * Turn quotas on on a device
+ */
+
+-/*
+- * Helper function to turn quotas on when we already have the inode of
+- * quota file and no quota information is loaded.
+- */
+-static int vfs_load_quota_inode(struct inode *inode, int type, int format_id,
++static int vfs_setup_quota_inode(struct inode *inode, int type)
++{
++ struct super_block *sb = inode->i_sb;
++ struct quota_info *dqopt = sb_dqopt(sb);
++
++ if (is_bad_inode(inode))
++ return -EUCLEAN;
++ if (!S_ISREG(inode->i_mode))
++ return -EACCES;
++ if (IS_RDONLY(inode))
++ return -EROFS;
++ if (sb_has_quota_loaded(sb, type))
++ return -EBUSY;
++
++ dqopt->files[type] = igrab(inode);
++ if (!dqopt->files[type])
++ return -EIO;
++ if (!(dqopt->flags & DQUOT_QUOTA_SYS_FILE)) {
++ /* We don't want quota and atime on quota files (deadlocks
++ * possible) Also nobody should write to the file - we use
++ * special IO operations which ignore the immutable bit. */
++ inode_lock(inode);
++ inode->i_flags |= S_NOQUOTA;
++ inode_unlock(inode);
++ /*
++ * When S_NOQUOTA is set, remove dquot references as no more
++ * references can be added
++ */
++ __dquot_drop(inode);
++ }
++ return 0;
++}
++
++static void vfs_cleanup_quota_inode(struct super_block *sb, int type)
++{
++ struct quota_info *dqopt = sb_dqopt(sb);
++ struct inode *inode = dqopt->files[type];
++
++ if (!(dqopt->flags & DQUOT_QUOTA_SYS_FILE)) {
++ inode_lock(inode);
++ inode->i_flags &= ~S_NOQUOTA;
++ inode_unlock(inode);
++ }
++ dqopt->files[type] = NULL;
++ iput(inode);
++}
++
++int dquot_load_quota_sb(struct super_block *sb, int type, int format_id,
+ unsigned int flags)
+ {
+ struct quota_format_type *fmt = find_quota_format(format_id);
+- struct super_block *sb = inode->i_sb;
+ struct quota_info *dqopt = sb_dqopt(sb);
+ int error;
+
+ if (!fmt)
+ return -ESRCH;
+- if (!S_ISREG(inode->i_mode)) {
+- error = -EACCES;
+- goto out_fmt;
+- }
+- if (IS_RDONLY(inode)) {
+- error = -EROFS;
+- goto out_fmt;
+- }
+ if (!sb->s_op->quota_write || !sb->s_op->quota_read ||
+ (type == PRJQUOTA && sb->dq_op->get_projid == NULL)) {
+ error = -EINVAL;
+@@ -2351,27 +2385,9 @@ static int vfs_load_quota_inode(struct inode *inode, int type, int format_id,
+ invalidate_bdev(sb->s_bdev);
+ }
+
+- if (!(dqopt->flags & DQUOT_QUOTA_SYS_FILE)) {
+- /* We don't want quota and atime on quota files (deadlocks
+- * possible) Also nobody should write to the file - we use
+- * special IO operations which ignore the immutable bit. */
+- inode_lock(inode);
+- inode->i_flags |= S_NOQUOTA;
+- inode_unlock(inode);
+- /*
+- * When S_NOQUOTA is set, remove dquot references as no more
+- * references can be added
+- */
+- __dquot_drop(inode);
+- }
+-
+- error = -EIO;
+- dqopt->files[type] = igrab(inode);
+- if (!dqopt->files[type])
+- goto out_file_flags;
+ error = -EINVAL;
+ if (!fmt->qf_ops->check_quota_file(sb, type))
+- goto out_file_init;
++ goto out_fmt;
+
+ dqopt->ops[type] = fmt->qf_ops;
+ dqopt->info[type].dqi_format = fmt;
+@@ -2379,7 +2395,7 @@ static int vfs_load_quota_inode(struct inode *inode, int type, int format_id,
+ INIT_LIST_HEAD(&dqopt->info[type].dqi_dirty_list);
+ error = dqopt->ops[type]->read_file_info(sb, type);
+ if (error < 0)
+- goto out_file_init;
++ goto out_fmt;
+ if (dqopt->flags & DQUOT_QUOTA_SYS_FILE) {
+ spin_lock(&dq_data_lock);
+ dqopt->info[type].dqi_flags |= DQF_SYS_FILE;
+@@ -2394,18 +2410,30 @@ static int vfs_load_quota_inode(struct inode *inode, int type, int format_id,
+ dquot_disable(sb, type, flags);
+
+ return error;
+-out_file_init:
+- dqopt->files[type] = NULL;
+- iput(inode);
+-out_file_flags:
+- inode_lock(inode);
+- inode->i_flags &= ~S_NOQUOTA;
+- inode_unlock(inode);
+ out_fmt:
+ put_quota_format(fmt);
+
+ return error;
+ }
++EXPORT_SYMBOL(dquot_load_quota_sb);
++
++/*
++ * Helper function to turn quotas on when we already have the inode of
++ * quota file and no quota information is loaded.
++ */
++static int vfs_load_quota_inode(struct inode *inode, int type, int format_id,
++ unsigned int flags)
++{
++ int err;
++
++ err = vfs_setup_quota_inode(inode, type);
++ if (err < 0)
++ return err;
++ err = dquot_load_quota_sb(inode->i_sb, type, format_id, flags);
++ if (err < 0)
++ vfs_cleanup_quota_inode(inode->i_sb, type);
++ return err;
++}
+
+ /* Reenable quotas on remount RW */
+ int dquot_resume(struct super_block *sb, int type)
+diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
+index 959a066b7bb07..2843b7cf4d7af 100644
+--- a/fs/reiserfs/namei.c
++++ b/fs/reiserfs/namei.c
+@@ -695,6 +695,7 @@ static int reiserfs_create(struct inode *dir, struct dentry *dentry, umode_t mod
+
+ out_failed:
+ reiserfs_write_unlock(dir->i_sb);
++ reiserfs_security_free(&security);
+ return retval;
+ }
+
+@@ -778,6 +779,7 @@ static int reiserfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode
+
+ out_failed:
+ reiserfs_write_unlock(dir->i_sb);
++ reiserfs_security_free(&security);
+ return retval;
+ }
+
+@@ -876,6 +878,7 @@ static int reiserfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
+ retval = journal_end(&th);
+ out_failed:
+ reiserfs_write_unlock(dir->i_sb);
++ reiserfs_security_free(&security);
+ return retval;
+ }
+
+@@ -1191,6 +1194,7 @@ static int reiserfs_symlink(struct inode *parent_dir,
+ retval = journal_end(&th);
+ out_failed:
+ reiserfs_write_unlock(parent_dir->i_sb);
++ reiserfs_security_free(&security);
+ return retval;
+ }
+
+diff --git a/fs/reiserfs/xattr_security.c b/fs/reiserfs/xattr_security.c
+index 20be9a0e5870e..59d87f9f72fb4 100644
+--- a/fs/reiserfs/xattr_security.c
++++ b/fs/reiserfs/xattr_security.c
+@@ -49,6 +49,7 @@ int reiserfs_security_init(struct inode *dir, struct inode *inode,
+ int error;
+
+ sec->name = NULL;
++ sec->value = NULL;
+
+ /* Don't add selinux attributes on xattrs - they'll never get used */
+ if (IS_PRIVATE(dir))
+@@ -94,7 +95,6 @@ int reiserfs_security_write(struct reiserfs_transaction_handle *th,
+
+ void reiserfs_security_free(struct reiserfs_security_handle *sec)
+ {
+- kfree(sec->name);
+ kfree(sec->value);
+ sec->name = NULL;
+ sec->value = NULL;
+diff --git a/fs/sysv/itree.c b/fs/sysv/itree.c
+index bcb67b0cabe7e..31f66053e2393 100644
+--- a/fs/sysv/itree.c
++++ b/fs/sysv/itree.c
+@@ -438,7 +438,7 @@ static unsigned sysv_nblocks(struct super_block *s, loff_t size)
+ res += blocks;
+ direct = 1;
+ }
+- return blocks;
++ return res;
+ }
+
+ int sysv_getattr(const struct path *path, struct kstat *stat,
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index ec8089a313906..55a86120e756f 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -434,6 +434,12 @@ static int udf_get_block(struct inode *inode, sector_t block,
+ iinfo->i_next_alloc_goal++;
+ }
+
++ /*
++ * Block beyond EOF and prealloc extents? Just discard preallocation
++ * as it is not useful and complicates things.
++ */
++ if (((loff_t)block) << inode->i_blkbits > iinfo->i_lenExtents)
++ udf_discard_prealloc(inode);
+ udf_clear_extent_cache(inode);
+ phys = inode_getblk(inode, block, &err, &new);
+ if (!phys)
+@@ -483,8 +489,6 @@ static int udf_do_extend_file(struct inode *inode,
+ uint32_t add;
+ int count = 0, fake = !(last_ext->extLength & UDF_EXTENT_LENGTH_MASK);
+ struct super_block *sb = inode->i_sb;
+- struct kernel_lb_addr prealloc_loc = {};
+- uint32_t prealloc_len = 0;
+ struct udf_inode_info *iinfo;
+ int err;
+
+@@ -505,19 +509,6 @@ static int udf_do_extend_file(struct inode *inode,
+ ~(sb->s_blocksize - 1);
+ }
+
+- /* Last extent are just preallocated blocks? */
+- if ((last_ext->extLength & UDF_EXTENT_FLAG_MASK) ==
+- EXT_NOT_RECORDED_ALLOCATED) {
+- /* Save the extent so that we can reattach it to the end */
+- prealloc_loc = last_ext->extLocation;
+- prealloc_len = last_ext->extLength;
+- /* Mark the extent as a hole */
+- last_ext->extLength = EXT_NOT_RECORDED_NOT_ALLOCATED |
+- (last_ext->extLength & UDF_EXTENT_LENGTH_MASK);
+- last_ext->extLocation.logicalBlockNum = 0;
+- last_ext->extLocation.partitionReferenceNum = 0;
+- }
+-
+ /* Can we merge with the previous extent? */
+ if ((last_ext->extLength & UDF_EXTENT_FLAG_MASK) ==
+ EXT_NOT_RECORDED_NOT_ALLOCATED) {
+@@ -545,7 +536,7 @@ static int udf_do_extend_file(struct inode *inode,
+ * more extents, we may need to enter possible following
+ * empty indirect extent.
+ */
+- if (new_block_bytes || prealloc_len)
++ if (new_block_bytes)
+ udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
+ }
+
+@@ -579,17 +570,6 @@ static int udf_do_extend_file(struct inode *inode,
+ }
+
+ out:
+- /* Do we have some preallocated blocks saved? */
+- if (prealloc_len) {
+- err = udf_add_aext(inode, last_pos, &prealloc_loc,
+- prealloc_len, 1);
+- if (err)
+- return err;
+- last_ext->extLocation = prealloc_loc;
+- last_ext->extLength = prealloc_len;
+- count++;
+- }
+-
+ /* last_pos should point to the last written extent... */
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
+ last_pos->offset -= sizeof(struct short_ad);
+@@ -605,13 +585,17 @@ out:
+ static void udf_do_extend_final_block(struct inode *inode,
+ struct extent_position *last_pos,
+ struct kernel_long_ad *last_ext,
+- uint32_t final_block_len)
++ uint32_t new_elen)
+ {
+- struct super_block *sb = inode->i_sb;
+ uint32_t added_bytes;
+
+- added_bytes = final_block_len -
+- (last_ext->extLength & (sb->s_blocksize - 1));
++ /*
++ * Extent already large enough? It may be already rounded up to block
++ * size...
++ */
++ if (new_elen <= (last_ext->extLength & UDF_EXTENT_LENGTH_MASK))
++ return;
++ added_bytes = new_elen - (last_ext->extLength & UDF_EXTENT_LENGTH_MASK);
+ last_ext->extLength += added_bytes;
+ UDF_I(inode)->i_lenExtents += added_bytes;
+
+@@ -628,12 +612,12 @@ static int udf_extend_file(struct inode *inode, loff_t newsize)
+ int8_t etype;
+ struct super_block *sb = inode->i_sb;
+ sector_t first_block = newsize >> sb->s_blocksize_bits, offset;
+- unsigned long partial_final_block;
++ loff_t new_elen;
+ int adsize;
+ struct udf_inode_info *iinfo = UDF_I(inode);
+ struct kernel_long_ad extent;
+ int err = 0;
+- int within_final_block;
++ bool within_last_ext;
+
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
+ adsize = sizeof(struct short_ad);
+@@ -642,8 +626,17 @@ static int udf_extend_file(struct inode *inode, loff_t newsize)
+ else
+ BUG();
+
++ /*
++ * When creating hole in file, just don't bother with preserving
++ * preallocation. It likely won't be very useful anyway.
++ */
++ udf_discard_prealloc(inode);
++
+ etype = inode_bmap(inode, first_block, &epos, &eloc, &elen, &offset);
+- within_final_block = (etype != -1);
++ within_last_ext = (etype != -1);
++ /* We don't expect extents past EOF... */
++ WARN_ON_ONCE(within_last_ext &&
++ elen > ((loff_t)offset + 1) << inode->i_blkbits);
+
+ if ((!epos.bh && epos.offset == udf_file_entry_alloc_offset(inode)) ||
+ (epos.bh && epos.offset == sizeof(struct allocExtDesc))) {
+@@ -659,19 +652,17 @@ static int udf_extend_file(struct inode *inode, loff_t newsize)
+ extent.extLength |= etype << 30;
+ }
+
+- partial_final_block = newsize & (sb->s_blocksize - 1);
++ new_elen = ((loff_t)offset << inode->i_blkbits) |
++ (newsize & (sb->s_blocksize - 1));
+
+ /* File has extent covering the new size (could happen when extending
+ * inside a block)?
+ */
+- if (within_final_block) {
++ if (within_last_ext) {
+ /* Extending file within the last file block */
+- udf_do_extend_final_block(inode, &epos, &extent,
+- partial_final_block);
++ udf_do_extend_final_block(inode, &epos, &extent, new_elen);
+ } else {
+- loff_t add = ((loff_t)offset << sb->s_blocksize_bits) |
+- partial_final_block;
+- err = udf_do_extend_file(inode, &epos, &extent, add);
++ err = udf_do_extend_file(inode, &epos, &extent, new_elen);
+ }
+
+ if (err < 0)
+@@ -772,10 +763,11 @@ static sector_t inode_getblk(struct inode *inode, sector_t block,
+ goto out_free;
+ }
+
+- /* Are we beyond EOF? */
++ /* Are we beyond EOF and preallocated extent? */
+ if (etype == -1) {
+ int ret;
+ loff_t hole_len;
++
+ isBeyondEOF = true;
+ if (count) {
+ if (c)
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index d13ded8e2c309..ef251622da137 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -1106,8 +1106,9 @@ static int udf_rename(struct inode *old_dir, struct dentry *old_dentry,
+ return -EINVAL;
+
+ ofi = udf_find_entry(old_dir, &old_dentry->d_name, &ofibh, &ocfi);
+- if (IS_ERR(ofi)) {
+- retval = PTR_ERR(ofi);
++ if (!ofi || IS_ERR(ofi)) {
++ if (IS_ERR(ofi))
++ retval = PTR_ERR(ofi);
+ goto end_rename;
+ }
+
+@@ -1116,8 +1117,7 @@ static int udf_rename(struct inode *old_dir, struct dentry *old_dentry,
+
+ brelse(ofibh.sbh);
+ tloc = lelb_to_cpu(ocfi.icb.extLocation);
+- if (!ofi || udf_get_lb_pblock(old_dir->i_sb, &tloc, 0)
+- != old_inode->i_ino)
++ if (udf_get_lb_pblock(old_dir->i_sb, &tloc, 0) != old_inode->i_ino)
+ goto end_rename;
+
+ nfi = udf_find_entry(new_dir, &new_dentry->d_name, &nfibh, &ncfi);
+diff --git a/fs/udf/truncate.c b/fs/udf/truncate.c
+index 94220ba856285..b0c71edc83f70 100644
+--- a/fs/udf/truncate.c
++++ b/fs/udf/truncate.c
+@@ -120,60 +120,42 @@ void udf_truncate_tail_extent(struct inode *inode)
+
+ void udf_discard_prealloc(struct inode *inode)
+ {
+- struct extent_position epos = { NULL, 0, {0, 0} };
++ struct extent_position epos = {};
++ struct extent_position prev_epos = {};
+ struct kernel_lb_addr eloc;
+ uint32_t elen;
+ uint64_t lbcount = 0;
+ int8_t etype = -1, netype;
+- int adsize;
+ struct udf_inode_info *iinfo = UDF_I(inode);
++ int bsize = 1 << inode->i_blkbits;
+
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB ||
+- inode->i_size == iinfo->i_lenExtents)
++ ALIGN(inode->i_size, bsize) == ALIGN(iinfo->i_lenExtents, bsize))
+ return;
+
+- if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
+- adsize = sizeof(struct short_ad);
+- else if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_LONG)
+- adsize = sizeof(struct long_ad);
+- else
+- adsize = 0;
+-
+ epos.block = iinfo->i_location;
+
+ /* Find the last extent in the file */
+- while ((netype = udf_next_aext(inode, &epos, &eloc, &elen, 1)) != -1) {
+- etype = netype;
++ while ((netype = udf_next_aext(inode, &epos, &eloc, &elen, 0)) != -1) {
++ brelse(prev_epos.bh);
++ prev_epos = epos;
++ if (prev_epos.bh)
++ get_bh(prev_epos.bh);
++
++ etype = udf_next_aext(inode, &epos, &eloc, &elen, 1);
+ lbcount += elen;
+ }
+ if (etype == (EXT_NOT_RECORDED_ALLOCATED >> 30)) {
+- epos.offset -= adsize;
+ lbcount -= elen;
+- extent_trunc(inode, &epos, &eloc, etype, elen, 0);
+- if (!epos.bh) {
+- iinfo->i_lenAlloc =
+- epos.offset -
+- udf_file_entry_alloc_offset(inode);
+- mark_inode_dirty(inode);
+- } else {
+- struct allocExtDesc *aed =
+- (struct allocExtDesc *)(epos.bh->b_data);
+- aed->lengthAllocDescs =
+- cpu_to_le32(epos.offset -
+- sizeof(struct allocExtDesc));
+- if (!UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_STRICT) ||
+- UDF_SB(inode->i_sb)->s_udfrev >= 0x0201)
+- udf_update_tag(epos.bh->b_data, epos.offset);
+- else
+- udf_update_tag(epos.bh->b_data,
+- sizeof(struct allocExtDesc));
+- mark_buffer_dirty_inode(epos.bh, inode);
+- }
++ udf_delete_aext(inode, prev_epos);
++ udf_free_blocks(inode->i_sb, inode, &eloc, 0,
++ DIV_ROUND_UP(elen, 1 << inode->i_blkbits));
+ }
+ /* This inode entry is in-memory only and thus we don't have to mark
+ * the inode dirty */
+ iinfo->i_lenExtents = lbcount;
+ brelse(epos.bh);
++ brelse(prev_epos.bh);
+ }
+
+ static void udf_update_alloc_ext_desc(struct inode *inode,
+diff --git a/fs/xattr.c b/fs/xattr.c
+index 470ee0af32007..5c3407e18e15a 100644
+--- a/fs/xattr.c
++++ b/fs/xattr.c
+@@ -1012,7 +1012,7 @@ static int xattr_list_one(char **buffer, ssize_t *remaining_size,
+ ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
+ char *buffer, size_t size)
+ {
+- bool trusted = capable(CAP_SYS_ADMIN);
++ bool trusted = ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN);
+ struct simple_xattr *xattr;
+ ssize_t remaining_size = size;
+ int err = 0;
+diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
+index db72ad39853b9..737f5cb0dc840 100644
+--- a/include/asm-generic/tlb.h
++++ b/include/asm-generic/tlb.h
+@@ -61,6 +61,12 @@ struct mmu_table_batch {
+ extern void tlb_table_flush(struct mmu_gather *tlb);
+ extern void tlb_remove_table(struct mmu_gather *tlb, void *table);
+
++void tlb_remove_table_sync_one(void);
++
++#else
++
++static inline void tlb_remove_table_sync_one(void) { }
++
+ #endif
+
+ /*
+diff --git a/include/linux/can/platform/sja1000.h b/include/linux/can/platform/sja1000.h
+index 5755ae5a47122..6a869682c1207 100644
+--- a/include/linux/can/platform/sja1000.h
++++ b/include/linux/can/platform/sja1000.h
+@@ -14,7 +14,7 @@
+ #define OCR_MODE_TEST 0x01
+ #define OCR_MODE_NORMAL 0x02
+ #define OCR_MODE_CLOCK 0x03
+-#define OCR_MODE_MASK 0x07
++#define OCR_MODE_MASK 0x03
+ #define OCR_TX0_INVERT 0x04
+ #define OCR_TX0_PULLDOWN 0x08
+ #define OCR_TX0_PULLUP 0x10
+diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h
+index 2a4638bb40338..6ebc269e48ace 100644
+--- a/include/linux/debugfs.h
++++ b/include/linux/debugfs.h
+@@ -39,7 +39,7 @@ struct debugfs_regset32 {
+
+ extern struct dentry *arch_debugfs_dir;
+
+-#define DEFINE_DEBUGFS_ATTRIBUTE(__fops, __get, __set, __fmt) \
++#define DEFINE_DEBUGFS_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, __is_signed) \
+ static int __fops ## _open(struct inode *inode, struct file *file) \
+ { \
+ __simple_attr_check_format(__fmt, 0ull); \
+@@ -50,10 +50,16 @@ static const struct file_operations __fops = { \
+ .open = __fops ## _open, \
+ .release = simple_attr_release, \
+ .read = debugfs_attr_read, \
+- .write = debugfs_attr_write, \
++ .write = (__is_signed) ? debugfs_attr_write_signed : debugfs_attr_write, \
+ .llseek = no_llseek, \
+ }
+
++#define DEFINE_DEBUGFS_ATTRIBUTE(__fops, __get, __set, __fmt) \
++ DEFINE_DEBUGFS_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, false)
++
++#define DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(__fops, __get, __set, __fmt) \
++ DEFINE_DEBUGFS_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, true)
++
+ typedef struct vfsmount *(*debugfs_automount_t)(struct dentry *, void *);
+
+ #if defined(CONFIG_DEBUG_FS)
+@@ -96,6 +102,8 @@ ssize_t debugfs_attr_read(struct file *file, char __user *buf,
+ size_t len, loff_t *ppos);
+ ssize_t debugfs_attr_write(struct file *file, const char __user *buf,
+ size_t len, loff_t *ppos);
++ssize_t debugfs_attr_write_signed(struct file *file, const char __user *buf,
++ size_t len, loff_t *ppos);
+
+ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
+ struct dentry *new_dir, const char *new_name);
+@@ -246,6 +254,13 @@ static inline ssize_t debugfs_attr_write(struct file *file,
+ return -ENODEV;
+ }
+
++static inline ssize_t debugfs_attr_write_signed(struct file *file,
++ const char __user *buf,
++ size_t len, loff_t *ppos)
++{
++ return -ENODEV;
++}
++
+ static inline struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
+ struct dentry *new_dir, char *new_name)
+ {
+diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
+index dc4fd8a6644dd..3482f9365a4db 100644
+--- a/include/linux/eventfd.h
++++ b/include/linux/eventfd.h
+@@ -61,7 +61,7 @@ static inline struct eventfd_ctx *eventfd_ctx_fdget(int fd)
+ return ERR_PTR(-ENOSYS);
+ }
+
+-static inline int eventfd_signal(struct eventfd_ctx *ctx, int n)
++static inline int eventfd_signal(struct eventfd_ctx *ctx, __u64 n)
+ {
+ return -ENOSYS;
+ }
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 86f884e78b6b9..95b8ef09b76cf 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -3353,7 +3353,7 @@ void simple_transaction_set(struct file *file, size_t n);
+ * All attributes contain a text representation of a numeric value
+ * that are accessed with the get() and set() functions.
+ */
+-#define DEFINE_SIMPLE_ATTRIBUTE(__fops, __get, __set, __fmt) \
++#define DEFINE_SIMPLE_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, __is_signed) \
+ static int __fops ## _open(struct inode *inode, struct file *file) \
+ { \
+ __simple_attr_check_format(__fmt, 0ull); \
+@@ -3364,10 +3364,16 @@ static const struct file_operations __fops = { \
+ .open = __fops ## _open, \
+ .release = simple_attr_release, \
+ .read = simple_attr_read, \
+- .write = simple_attr_write, \
++ .write = (__is_signed) ? simple_attr_write_signed : simple_attr_write, \
+ .llseek = generic_file_llseek, \
+ }
+
++#define DEFINE_SIMPLE_ATTRIBUTE(__fops, __get, __set, __fmt) \
++ DEFINE_SIMPLE_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, false)
++
++#define DEFINE_SIMPLE_ATTRIBUTE_SIGNED(__fops, __get, __set, __fmt) \
++ DEFINE_SIMPLE_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, true)
++
+ static inline __printf(1, 2)
+ void __simple_attr_check_format(const char *fmt, ...)
+ {
+@@ -3382,6 +3388,8 @@ ssize_t simple_attr_read(struct file *file, char __user *buf,
+ size_t len, loff_t *ppos);
+ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+ size_t len, loff_t *ppos);
++ssize_t simple_attr_write_signed(struct file *file, const char __user *buf,
++ size_t len, loff_t *ppos);
+
+ struct ctl_table;
+ int proc_nr_files(struct ctl_table *table, int write,
+diff --git a/include/linux/mbcache.h b/include/linux/mbcache.h
+index 20f1e3ff60130..591bc4cefe1d6 100644
+--- a/include/linux/mbcache.h
++++ b/include/linux/mbcache.h
+@@ -10,16 +10,29 @@
+
+ struct mb_cache;
+
++/* Cache entry flags */
++enum {
++ MBE_REFERENCED_B = 0,
++ MBE_REUSABLE_B
++};
++
+ struct mb_cache_entry {
+ /* List of entries in cache - protected by cache->c_list_lock */
+ struct list_head e_list;
+- /* Hash table list - protected by hash chain bitlock */
++ /*
++ * Hash table list - protected by hash chain bitlock. The entry is
++ * guaranteed to be hashed while e_refcnt > 0.
++ */
+ struct hlist_bl_node e_hash_list;
++ /*
++ * Entry refcount. Once it reaches zero, entry is unhashed and freed.
++ * While refcount > 0, the entry is guaranteed to stay in the hash and
++ * e.g. mb_cache_entry_try_delete() will fail.
++ */
+ atomic_t e_refcnt;
+ /* Key in hash - stable during lifetime of the entry */
+ u32 e_key;
+- u32 e_referenced:1;
+- u32 e_reusable:1;
++ unsigned long e_flags;
+ /* User provided value - stable during lifetime of the entry */
+ u64 e_value;
+ };
+@@ -29,16 +42,24 @@ void mb_cache_destroy(struct mb_cache *cache);
+
+ int mb_cache_entry_create(struct mb_cache *cache, gfp_t mask, u32 key,
+ u64 value, bool reusable);
+-void __mb_cache_entry_free(struct mb_cache_entry *entry);
+-static inline int mb_cache_entry_put(struct mb_cache *cache,
+- struct mb_cache_entry *entry)
++void __mb_cache_entry_free(struct mb_cache *cache,
++ struct mb_cache_entry *entry);
++void mb_cache_entry_wait_unused(struct mb_cache_entry *entry);
++static inline void mb_cache_entry_put(struct mb_cache *cache,
++ struct mb_cache_entry *entry)
+ {
+- if (!atomic_dec_and_test(&entry->e_refcnt))
+- return 0;
+- __mb_cache_entry_free(entry);
+- return 1;
++ unsigned int cnt = atomic_dec_return(&entry->e_refcnt);
++
++ if (cnt > 0) {
++ if (cnt <= 2)
++ wake_up_var(&entry->e_refcnt);
++ return;
++ }
++ __mb_cache_entry_free(cache, entry);
+ }
+
++struct mb_cache_entry *mb_cache_entry_delete_or_get(struct mb_cache *cache,
++ u32 key, u64 value);
+ void mb_cache_entry_delete(struct mb_cache *cache, u32 key, u64 value);
+ struct mb_cache_entry *mb_cache_entry_get(struct mb_cache *cache, u32 key,
+ u64 value);
+diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
+index 5141657a0f7f6..c16352fbbe1fe 100644
+--- a/include/linux/proc_fs.h
++++ b/include/linux/proc_fs.h
+@@ -117,8 +117,10 @@ static inline void proc_remove(struct proc_dir_entry *de) {}
+ static inline int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) { return 0; }
+
+ #define proc_create_net_data(name, mode, parent, ops, state_size, data) ({NULL;})
++#define proc_create_net_data_write(name, mode, parent, ops, write, state_size, data) ({NULL;})
+ #define proc_create_net(name, mode, parent, state_size, ops) ({NULL;})
+ #define proc_create_net_single(name, mode, parent, show, data) ({NULL;})
++#define proc_create_net_single_write(name, mode, parent, show, write, data) ({NULL;})
+
+ #endif /* CONFIG_PROC_FS */
+
+diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
+index 91e0b7624053e..ec10897f7f60c 100644
+--- a/include/linux/quotaops.h
++++ b/include/linux/quotaops.h
+@@ -99,6 +99,8 @@ int dquot_file_open(struct inode *inode, struct file *file);
+
+ int dquot_enable(struct inode *inode, int type, int format_id,
+ unsigned int flags);
++int dquot_load_quota_sb(struct super_block *sb, int type, int format_id,
++ unsigned int flags);
+ int dquot_quota_on(struct super_block *sb, int type, int format_id,
+ const struct path *path);
+ int dquot_quota_on_mount(struct super_block *sb, char *qf_name,
+diff --git a/include/linux/sunrpc/rpc_pipe_fs.h b/include/linux/sunrpc/rpc_pipe_fs.h
+index e90b9bd99ded5..396de2ef8767e 100644
+--- a/include/linux/sunrpc/rpc_pipe_fs.h
++++ b/include/linux/sunrpc/rpc_pipe_fs.h
+@@ -94,6 +94,11 @@ extern ssize_t rpc_pipe_generic_upcall(struct file *, struct rpc_pipe_msg *,
+ char __user *, size_t);
+ extern int rpc_queue_upcall(struct rpc_pipe *, struct rpc_pipe_msg *);
+
++/* returns true if the msg is in-flight, i.e., already eaten by the peer */
++static inline bool rpc_msg_is_inflight(const struct rpc_pipe_msg *msg) {
++ return (msg->copied != 0 && list_empty(&msg->list));
++}
++
+ struct rpc_clnt;
+ extern struct dentry *rpc_create_client_dir(struct dentry *, const char *, struct rpc_clnt *);
+ extern int rpc_remove_client_dir(struct rpc_clnt *);
+diff --git a/include/linux/timerqueue.h b/include/linux/timerqueue.h
+index aff122f1062a8..e1a843cb16d49 100644
+--- a/include/linux/timerqueue.h
++++ b/include/linux/timerqueue.h
+@@ -35,7 +35,7 @@ struct timerqueue_node *timerqueue_getnext(struct timerqueue_head *head)
+ {
+ struct rb_node *leftmost = rb_first_cached(&head->rb_root);
+
+- return rb_entry(leftmost, struct timerqueue_node, node);
++ return rb_entry_safe(leftmost, struct timerqueue_node, node);
+ }
+
+ static inline void timerqueue_init(struct timerqueue_node *node)
+diff --git a/include/media/dvbdev.h b/include/media/dvbdev.h
+index 881ca461b7bba..09279ed0051ea 100644
+--- a/include/media/dvbdev.h
++++ b/include/media/dvbdev.h
+@@ -126,6 +126,7 @@ struct dvb_adapter {
+ * struct dvb_device - represents a DVB device node
+ *
+ * @list_head: List head with all DVB devices
++ * @ref: reference counter
+ * @fops: pointer to struct file_operations
+ * @adapter: pointer to the adapter that holds this device node
+ * @type: type of the device, as defined by &enum dvb_device_type.
+@@ -156,6 +157,7 @@ struct dvb_adapter {
+ */
+ struct dvb_device {
+ struct list_head list_head;
++ struct kref ref;
+ const struct file_operations *fops;
+ struct dvb_adapter *adapter;
+ enum dvb_device_type type;
+@@ -187,6 +189,20 @@ struct dvb_device {
+ void *priv;
+ };
+
++/**
++ * dvb_device_get - Increase dvb_device reference
++ *
++ * @dvbdev: pointer to struct dvb_device
++ */
++struct dvb_device *dvb_device_get(struct dvb_device *dvbdev);
++
++/**
++ * dvb_device_put - Decrease dvb_device reference
++ *
++ * @dvbdev: pointer to struct dvb_device
++ */
++void dvb_device_put(struct dvb_device *dvbdev);
++
+ /**
+ * dvb_register_adapter - Registers a new DVB adapter
+ *
+@@ -231,29 +247,17 @@ int dvb_register_device(struct dvb_adapter *adap,
+ /**
+ * dvb_remove_device - Remove a registered DVB device
+ *
+- * This does not free memory. To do that, call dvb_free_device().
++ * This does not free memory. dvb_free_device() will do that when
++ * reference counter is empty
+ *
+ * @dvbdev: pointer to struct dvb_device
+ */
+ void dvb_remove_device(struct dvb_device *dvbdev);
+
+-/**
+- * dvb_free_device - Free memory occupied by a DVB device.
+- *
+- * Call dvb_unregister_device() before calling this function.
+- *
+- * @dvbdev: pointer to struct dvb_device
+- */
+-void dvb_free_device(struct dvb_device *dvbdev);
+
+ /**
+ * dvb_unregister_device - Unregisters a DVB device
+ *
+- * This is a combination of dvb_remove_device() and dvb_free_device().
+- * Using this function is usually a mistake, and is often an indicator
+- * for a use-after-free bug (when a userspace process keeps a file
+- * handle to a detached device).
+- *
+ * @dvbdev: pointer to struct dvb_device
+ */
+ void dvb_unregister_device(struct dvb_device *dvbdev);
+diff --git a/include/net/mrp.h b/include/net/mrp.h
+index ef58b4a071900..c6c53370e390f 100644
+--- a/include/net/mrp.h
++++ b/include/net/mrp.h
+@@ -120,6 +120,7 @@ struct mrp_applicant {
+ struct sk_buff *pdu;
+ struct rb_root mad;
+ struct rcu_head rcu;
++ bool active;
+ };
+
+ struct mrp_port {
+diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h
+index 0dfb174f707e9..20c9b8e77a571 100644
+--- a/include/trace/events/ext4.h
++++ b/include/trace/events/ext4.h
+@@ -2290,7 +2290,7 @@ TRACE_EVENT(ext4_es_remove_extent,
+ __entry->lblk, __entry->len)
+ );
+
+-TRACE_EVENT(ext4_es_find_delayed_extent_range_enter,
++TRACE_EVENT(ext4_es_find_extent_range_enter,
+ TP_PROTO(struct inode *inode, ext4_lblk_t lblk),
+
+ TP_ARGS(inode, lblk),
+@@ -2312,7 +2312,7 @@ TRACE_EVENT(ext4_es_find_delayed_extent_range_enter,
+ (unsigned long) __entry->ino, __entry->lblk)
+ );
+
+-TRACE_EVENT(ext4_es_find_delayed_extent_range_exit,
++TRACE_EVENT(ext4_es_find_extent_range_exit,
+ TP_PROTO(struct inode *inode, struct extent_status *es),
+
+ TP_ARGS(inode, es),
+@@ -2532,6 +2532,41 @@ TRACE_EVENT(ext4_es_shrink,
+ __entry->scan_time, __entry->nr_skipped, __entry->retried)
+ );
+
++TRACE_EVENT(ext4_es_insert_delayed_block,
++ TP_PROTO(struct inode *inode, struct extent_status *es,
++ bool allocated),
++
++ TP_ARGS(inode, es, allocated),
++
++ TP_STRUCT__entry(
++ __field( dev_t, dev )
++ __field( ino_t, ino )
++ __field( ext4_lblk_t, lblk )
++ __field( ext4_lblk_t, len )
++ __field( ext4_fsblk_t, pblk )
++ __field( char, status )
++ __field( bool, allocated )
++ ),
++
++ TP_fast_assign(
++ __entry->dev = inode->i_sb->s_dev;
++ __entry->ino = inode->i_ino;
++ __entry->lblk = es->es_lblk;
++ __entry->len = es->es_len;
++ __entry->pblk = ext4_es_pblock(es);
++ __entry->status = ext4_es_status(es);
++ __entry->allocated = allocated;
++ ),
++
++ TP_printk("dev %d,%d ino %lu es [%u/%u) mapped %llu status %s "
++ "allocated %d",
++ MAJOR(__entry->dev), MINOR(__entry->dev),
++ (unsigned long) __entry->ino,
++ __entry->lblk, __entry->len,
++ __entry->pblk, show_extent_status(__entry->status),
++ __entry->allocated)
++);
++
+ /* fsmap traces */
+ DECLARE_EVENT_CLASS(ext4_fsmap_class,
+ TP_PROTO(struct super_block *sb, u32 keydev, u32 agno, u64 bno, u64 len,
+diff --git a/include/uapi/linux/swab.h b/include/uapi/linux/swab.h
+index 7272f85d6d6ab..3736f2fe15418 100644
+--- a/include/uapi/linux/swab.h
++++ b/include/uapi/linux/swab.h
+@@ -3,7 +3,7 @@
+ #define _UAPI_LINUX_SWAB_H
+
+ #include <linux/types.h>
+-#include <linux/compiler.h>
++#include <linux/stddef.h>
+ #include <asm/bitsperlong.h>
+ #include <asm/swab.h>
+
+diff --git a/include/uapi/sound/asequencer.h b/include/uapi/sound/asequencer.h
+index a75e14edc957e..dbd60f48b4b01 100644
+--- a/include/uapi/sound/asequencer.h
++++ b/include/uapi/sound/asequencer.h
+@@ -344,10 +344,10 @@ typedef int __bitwise snd_seq_client_type_t;
+ #define KERNEL_CLIENT ((__force snd_seq_client_type_t) 2)
+
+ /* event filter flags */
+-#define SNDRV_SEQ_FILTER_BROADCAST (1<<0) /* accept broadcast messages */
+-#define SNDRV_SEQ_FILTER_MULTICAST (1<<1) /* accept multicast messages */
+-#define SNDRV_SEQ_FILTER_BOUNCE (1<<2) /* accept bounce event in error */
+-#define SNDRV_SEQ_FILTER_USE_EVENT (1<<31) /* use event filter */
++#define SNDRV_SEQ_FILTER_BROADCAST (1U<<0) /* accept broadcast messages */
++#define SNDRV_SEQ_FILTER_MULTICAST (1U<<1) /* accept multicast messages */
++#define SNDRV_SEQ_FILTER_BOUNCE (1U<<2) /* accept bounce event in error */
++#define SNDRV_SEQ_FILTER_USE_EVENT (1U<<31) /* use event filter */
+
+ struct snd_seq_client_info {
+ int client; /* client number to inquire */
+diff --git a/kernel/acct.c b/kernel/acct.c
+index 81f9831a78592..6d98aed403bac 100644
+--- a/kernel/acct.c
++++ b/kernel/acct.c
+@@ -331,6 +331,8 @@ static comp_t encode_comp_t(unsigned long value)
+ exp++;
+ }
+
++ if (exp > (((comp_t) ~0U) >> MANTSIZE))
++ return (comp_t) ~0U;
+ /*
+ * Clean it up and polish it off.
+ */
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index ba66ea3ca7056..668e5492e4c4d 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -9682,13 +9682,15 @@ static int pmu_dev_alloc(struct pmu *pmu)
+
+ pmu->dev->groups = pmu->attr_groups;
+ device_initialize(pmu->dev);
+- ret = dev_set_name(pmu->dev, "%s", pmu->name);
+- if (ret)
+- goto free_dev;
+
+ dev_set_drvdata(pmu->dev, pmu);
+ pmu->dev->bus = &pmu_bus;
+ pmu->dev->release = pmu_dev_release;
++
++ ret = dev_set_name(pmu->dev, "%s", pmu->name);
++ if (ret)
++ goto free_dev;
++
+ ret = device_add(pmu->dev);
+ if (ret)
+ goto free_dev;
+diff --git a/kernel/gcov/gcc_4_7.c b/kernel/gcov/gcc_4_7.c
+index bb6ccf456e2df..1c2bd1f23536b 100644
+--- a/kernel/gcov/gcc_4_7.c
++++ b/kernel/gcov/gcc_4_7.c
+@@ -85,6 +85,7 @@ struct gcov_fn_info {
+ * @version: gcov version magic indicating the gcc version used for compilation
+ * @next: list head for a singly-linked list
+ * @stamp: uniquifying time stamp
++ * @checksum: unique object checksum
+ * @filename: name of the associated gcov data file
+ * @merge: merge functions (null for unused counter type)
+ * @n_functions: number of instrumented functions
+@@ -97,6 +98,10 @@ struct gcov_info {
+ unsigned int version;
+ struct gcov_info *next;
+ unsigned int stamp;
++ /* Since GCC 12.1 a checksum field is added. */
++#if (__GNUC__ >= 12)
++ unsigned int checksum;
++#endif
+ const char *filename;
+ void (*merge[GCOV_COUNTERS])(gcov_type *, unsigned int);
+ unsigned int n_functions;
+diff --git a/kernel/relay.c b/kernel/relay.c
+index 735cb208f023b..b7aa7df43955b 100644
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -163,13 +163,13 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan)
+ {
+ struct rchan_buf *buf;
+
+- if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *))
++ if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t))
+ return NULL;
+
+ buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
+ if (!buf)
+ return NULL;
+- buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t *),
++ buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t),
+ GFP_KERNEL);
+ if (!buf->padding)
+ goto free_buf;
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 75ea1a5be31a8..113cbe1a20aa3 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -1594,7 +1594,8 @@ blk_trace_event_print_binary(struct trace_iterator *iter, int flags,
+
+ static enum print_line_t blk_tracer_print_line(struct trace_iterator *iter)
+ {
+- if (!(blk_tracer_flags.val & TRACE_BLK_OPT_CLASSIC))
++ if ((iter->ent->type != TRACE_BLK) ||
++ !(blk_tracer_flags.val & TRACE_BLK_OPT_CLASSIC))
+ return TRACE_TYPE_UNHANDLED;
+
+ return print_one_line(iter, true);
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 5b7a6e9b0ab6b..59ad83499ba25 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -5803,7 +5803,20 @@ waitagain:
+
+ ret = print_trace_line(iter);
+ if (ret == TRACE_TYPE_PARTIAL_LINE) {
+- /* don't print partial lines */
++ /*
++ * If one print_trace_line() fills entire trace_seq in one shot,
++ * trace_seq_to_user() will returns -EBUSY because save_len == 0,
++ * In this case, we need to consume it, otherwise, loop will peek
++ * this event next time, resulting in an infinite loop.
++ */
++ if (save_len == 0) {
++ iter->seq.full = 0;
++ trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n");
++ trace_consume(iter);
++ break;
++ }
++
++ /* In other cases, don't print partial lines */
+ iter->seq.seq.len = save_len;
+ break;
+ }
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 48f85dab9ef19..17b15bd978579 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -5807,7 +5807,7 @@ enable:
+ /* Just return zero, not the number of registered triggers */
+ ret = 0;
+ out:
+- if (ret == 0)
++ if (ret == 0 && glob[0])
+ hist_err_clear();
+
+ return ret;
+diff --git a/lib/notifier-error-inject.c b/lib/notifier-error-inject.c
+index eb4a04afea80a..125ea8ce23a46 100644
+--- a/lib/notifier-error-inject.c
++++ b/lib/notifier-error-inject.c
+@@ -14,7 +14,7 @@ static int debugfs_errno_get(void *data, u64 *val)
+ return 0;
+ }
+
+-DEFINE_SIMPLE_ATTRIBUTE(fops_errno, debugfs_errno_get, debugfs_errno_set,
++DEFINE_SIMPLE_ATTRIBUTE_SIGNED(fops_errno, debugfs_errno_get, debugfs_errno_set,
+ "%lld\n");
+
+ static struct dentry *debugfs_create_errno(const char *name, umode_t mode,
+diff --git a/lib/test_firmware.c b/lib/test_firmware.c
+index a74b1aae74618..f4cc874021da2 100644
+--- a/lib/test_firmware.c
++++ b/lib/test_firmware.c
+@@ -902,6 +902,7 @@ static int __init test_firmware_init(void)
+
+ rc = misc_register(&test_fw_misc_device);
+ if (rc) {
++ __test_firmware_config_free();
+ kfree(test_fw_config);
+ pr_err("could not register misc device: %d\n", rc);
+ return rc;
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index 5dd14ef2e1de8..60f7df9875678 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -23,6 +23,19 @@
+ #include <asm/pgalloc.h>
+ #include "internal.h"
+
++/* gross hack for <=4.19 stable */
++#if defined(CONFIG_S390) || defined(CONFIG_ARM)
++static void tlb_remove_table_smp_sync(void *arg)
++{
++ /* Simply deliver the interrupt */
++}
++
++static void tlb_remove_table_sync_one(void)
++{
++ smp_call_function(tlb_remove_table_smp_sync, NULL, 1);
++}
++#endif
++
+ enum scan_result {
+ SCAN_FAIL,
+ SCAN_SUCCEED,
+@@ -1045,6 +1058,7 @@ static void collapse_huge_page(struct mm_struct *mm,
+ _pmd = pmdp_collapse_flush(vma, address, pmd);
+ spin_unlock(pmd_ptl);
+ mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
++ tlb_remove_table_sync_one();
+
+ spin_lock(pte_ptl);
+ isolated = __collapse_huge_page_isolate(vma, address, pte);
+@@ -1289,12 +1303,20 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
+ */
+ if (down_write_trylock(&mm->mmap_sem)) {
+ if (!khugepaged_test_exit(mm)) {
+- spinlock_t *ptl = pmd_lock(mm, pmd);
++ spinlock_t *ptl;
++ unsigned long end = addr + HPAGE_PMD_SIZE;
++
++ mmu_notifier_invalidate_range_start(mm, addr,
++ end);
++ ptl = pmd_lock(mm, pmd);
+ /* assume page table is clear */
+ _pmd = pmdp_collapse_flush(vma, addr, pmd);
+ spin_unlock(ptl);
+ mm_dec_nr_ptes(mm);
++ tlb_remove_table_sync_one();
+ pte_free(mm, pmd_pgtable(_pmd));
++ mmu_notifier_invalidate_range_end(mm, addr,
++ end);
+ }
+ up_write(&mm->mmap_sem);
+ }
+diff --git a/mm/memory.c b/mm/memory.c
+index 800834cff4e67..b80ce6b3c8f49 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -362,6 +362,11 @@ static void tlb_remove_table_smp_sync(void *arg)
+ /* Simply deliver the interrupt */
+ }
+
++void tlb_remove_table_sync_one(void)
++{
++ smp_call_function(tlb_remove_table_smp_sync, NULL, 1);
++}
++
+ static void tlb_remove_table_one(void *table)
+ {
+ /*
+diff --git a/net/802/mrp.c b/net/802/mrp.c
+index 32f87d458f054..ce6e4774d3338 100644
+--- a/net/802/mrp.c
++++ b/net/802/mrp.c
+@@ -609,7 +609,10 @@ static void mrp_join_timer(struct timer_list *t)
+ spin_unlock(&app->lock);
+
+ mrp_queue_xmit(app);
+- mrp_join_timer_arm(app);
++ spin_lock(&app->lock);
++ if (likely(app->active))
++ mrp_join_timer_arm(app);
++ spin_unlock(&app->lock);
+ }
+
+ static void mrp_periodic_timer_arm(struct mrp_applicant *app)
+@@ -623,11 +626,12 @@ static void mrp_periodic_timer(struct timer_list *t)
+ struct mrp_applicant *app = from_timer(app, t, periodic_timer);
+
+ spin_lock(&app->lock);
+- mrp_mad_event(app, MRP_EVENT_PERIODIC);
+- mrp_pdu_queue(app);
++ if (likely(app->active)) {
++ mrp_mad_event(app, MRP_EVENT_PERIODIC);
++ mrp_pdu_queue(app);
++ mrp_periodic_timer_arm(app);
++ }
+ spin_unlock(&app->lock);
+-
+- mrp_periodic_timer_arm(app);
+ }
+
+ static int mrp_pdu_parse_end_mark(struct sk_buff *skb, int *offset)
+@@ -875,6 +879,7 @@ int mrp_init_applicant(struct net_device *dev, struct mrp_application *appl)
+ app->dev = dev;
+ app->app = appl;
+ app->mad = RB_ROOT;
++ app->active = true;
+ spin_lock_init(&app->lock);
+ skb_queue_head_init(&app->queue);
+ rcu_assign_pointer(dev->mrp_port->applicants[appl->type], app);
+@@ -903,6 +908,9 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
+
+ RCU_INIT_POINTER(port->applicants[appl->type], NULL);
+
++ spin_lock_bh(&app->lock);
++ app->active = false;
++ spin_unlock_bh(&app->lock);
+ /* Delete timer and generate a final TX event to flush out
+ * all pending messages before the applicant is gone.
+ */
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 3d780220e2d19..e87777255c474 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -4331,7 +4331,7 @@ void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
+ *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
+ else
+ *req_complete = bt_cb(skb)->hci.req_complete;
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ }
+ spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
+ }
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index fd6cd47a6c5ab..fd95631205a6a 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -4193,7 +4193,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
+
+ chan->ident = cmd->ident;
+ l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
+- chan->num_conf_rsp++;
++ if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP)
++ chan->num_conf_rsp++;
+
+ /* Reset config buffer. */
+ chan->conf_len = 0;
+diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
+index e4eaf5d2acbd8..86edf512d4971 100644
+--- a/net/bluetooth/rfcomm/core.c
++++ b/net/bluetooth/rfcomm/core.c
+@@ -593,7 +593,7 @@ int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
+
+ ret = rfcomm_dlc_send_frag(d, frag);
+ if (ret < 0) {
+- kfree_skb(frag);
++ dev_kfree_skb_irq(frag);
+ goto unlock;
+ }
+
+diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
+index a1e85f0321081..330cb2b087bb6 100644
+--- a/net/caif/cfctrl.c
++++ b/net/caif/cfctrl.c
+@@ -269,11 +269,15 @@ int cfctrl_linkup_request(struct cflayer *layer,
+ default:
+ pr_warn("Request setup of bad link type = %d\n",
+ param->linktype);
++ cfpkt_destroy(pkt);
+ return -EINVAL;
+ }
+ req = kzalloc(sizeof(*req), GFP_KERNEL);
+- if (!req)
++ if (!req) {
++ cfpkt_destroy(pkt);
+ return -ENOMEM;
++ }
++
+ req->client_layer = user_layer;
+ req->cmd = CFCTRL_CMD_LINK_SETUP;
+ req->param = *param;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 5129e89f52bb2..32d0b8f14aabb 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2025,6 +2025,10 @@ static int __bpf_redirect_no_mac(struct sk_buff *skb, struct net_device *dev,
+
+ if (mlen) {
+ __skb_pull(skb, mlen);
++ if (unlikely(!skb->len)) {
++ kfree_skb(skb);
++ return -ERANGE;
++ }
+
+ /* At ingress, the mac header has already been pulled once.
+ * At egress, skb_pospull_rcsum has to be done in case that
+@@ -2561,15 +2565,18 @@ static int bpf_skb_generic_push(struct sk_buff *skb, u32 off, u32 len)
+
+ static int bpf_skb_generic_pop(struct sk_buff *skb, u32 off, u32 len)
+ {
++ void *old_data;
++
+ /* skb_ensure_writable() is not needed here, as we're
+ * already working on an uncloned skb.
+ */
+ if (unlikely(!pskb_may_pull(skb, off + len)))
+ return -ENOMEM;
+
+- skb_postpull_rcsum(skb, skb->data + off, len);
+- memmove(skb->data + len, skb->data, off);
++ old_data = skb->data;
+ __skb_pull(skb, len);
++ skb_postpull_rcsum(skb, old_data + off, len);
++ memmove(skb->data, old_data, off);
+
+ return 0;
+ }
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 4178fc28c2770..7f501dff4501c 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -1953,6 +1953,9 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta)
+ insp = list;
+ } else {
+ /* Eaten partially. */
++ if (skb_is_gso(skb) && !list->head_frag &&
++ skb_headlen(list))
++ skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
+
+ if (skb_shared(list)) {
+ /* Sucks! We need to fork list. :-( */
+diff --git a/net/core/stream.c b/net/core/stream.c
+index 7b411a91a81cf..58755528d39e1 100644
+--- a/net/core/stream.c
++++ b/net/core/stream.c
+@@ -196,6 +196,12 @@ void sk_stream_kill_queues(struct sock *sk)
+ /* First the read buffer. */
+ __skb_queue_purge(&sk->sk_receive_queue);
+
++ /* Next, the error queue.
++ * We need to use queue lock, because other threads might
++ * add packets to the queue without socket lock being held.
++ */
++ skb_queue_purge(&sk->sk_error_queue);
++
+ /* Next, the write queue. */
+ WARN_ON(!skb_queue_empty(&sk->sk_write_queue));
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 0a69f92da71b8..457f619a34610 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -903,11 +903,25 @@ void inet_csk_prepare_forced_close(struct sock *sk)
+ }
+ EXPORT_SYMBOL(inet_csk_prepare_forced_close);
+
++static int inet_ulp_can_listen(const struct sock *sk)
++{
++ const struct inet_connection_sock *icsk = inet_csk(sk);
++
++ if (icsk->icsk_ulp_ops)
++ return -EINVAL;
++
++ return 0;
++}
++
+ int inet_csk_listen_start(struct sock *sk, int backlog)
+ {
+ struct inet_connection_sock *icsk = inet_csk(sk);
+ struct inet_sock *inet = inet_sk(sk);
+- int err = -EADDRINUSE;
++ int err;
++
++ err = inet_ulp_can_listen(sk);
++ if (unlikely(err))
++ return err;
+
+ reqsk_queue_alloc(&icsk->icsk_accept_queue);
+
+diff --git a/net/ipv4/udp_tunnel.c b/net/ipv4/udp_tunnel.c
+index 6539ff15e9a34..d03d74388870a 100644
+--- a/net/ipv4/udp_tunnel.c
++++ b/net/ipv4/udp_tunnel.c
+@@ -186,6 +186,7 @@ EXPORT_SYMBOL_GPL(udp_tunnel_xmit_skb);
+ void udp_tunnel_sock_release(struct socket *sock)
+ {
+ rcu_assign_sk_user_data(sock->sk, NULL);
++ synchronize_rcu();
+ kernel_sock_shutdown(sock, SHUT_RDWR);
+ sock_release(sock);
+ }
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index ad7bd40b6d533..44e9a240d6070 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -544,6 +544,7 @@ csum_copy_err:
+ static int rawv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
+ struct raw6_sock *rp)
+ {
++ struct ipv6_txoptions *opt;
+ struct sk_buff *skb;
+ int err = 0;
+ int offset;
+@@ -561,6 +562,9 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
+
+ offset = rp->offset;
+ total_len = inet_sk(sk)->cork.base.length;
++ opt = inet6_sk(sk)->cork.opt;
++ total_len -= opt ? opt->opt_flen : 0;
++
+ if (offset >= total_len - 1) {
+ err = -EINVAL;
+ ip6_flush_pending_frames(sk);
+diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
+index e3257077158f8..1b9df64c62360 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
++++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
+@@ -299,8 +299,8 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
+ return -IPSET_ERR_BITMAP_RANGE;
+
+ pr_debug("mask_bits %u, netmask %u\n", mask_bits, netmask);
+- hosts = 2 << (32 - netmask - 1);
+- elements = 2 << (netmask - mask_bits - 1);
++ hosts = 2U << (32 - netmask - 1);
++ elements = 2UL << (netmask - mask_bits - 1);
+ }
+ if (elements > IPSET_BITMAP_MAX_RANGE + 1)
+ return -IPSET_ERR_BITMAP_RANGE_SIZE;
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index 39fb01ee92220..8953b03d5a529 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -1515,6 +1515,7 @@ static int nfc_genl_se_io(struct sk_buff *skb, struct genl_info *info)
+ u32 dev_idx, se_idx;
+ u8 *apdu;
+ size_t apdu_len;
++ int rc;
+
+ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
+ !info->attrs[NFC_ATTR_SE_INDEX] ||
+@@ -1528,25 +1529,37 @@ static int nfc_genl_se_io(struct sk_buff *skb, struct genl_info *info)
+ if (!dev)
+ return -ENODEV;
+
+- if (!dev->ops || !dev->ops->se_io)
+- return -ENOTSUPP;
++ if (!dev->ops || !dev->ops->se_io) {
++ rc = -EOPNOTSUPP;
++ goto put_dev;
++ }
+
+ apdu_len = nla_len(info->attrs[NFC_ATTR_SE_APDU]);
+- if (apdu_len == 0)
+- return -EINVAL;
++ if (apdu_len == 0) {
++ rc = -EINVAL;
++ goto put_dev;
++ }
+
+ apdu = nla_data(info->attrs[NFC_ATTR_SE_APDU]);
+- if (!apdu)
+- return -EINVAL;
++ if (!apdu) {
++ rc = -EINVAL;
++ goto put_dev;
++ }
+
+ ctx = kzalloc(sizeof(struct se_io_ctx), GFP_KERNEL);
+- if (!ctx)
+- return -ENOMEM;
++ if (!ctx) {
++ rc = -ENOMEM;
++ goto put_dev;
++ }
+
+ ctx->dev_idx = dev_idx;
+ ctx->se_idx = se_idx;
+
+- return nfc_se_io(dev, se_idx, apdu, apdu_len, se_io_cb, ctx);
++ rc = nfc_se_io(dev, se_idx, apdu, apdu_len, se_io_cb, ctx);
++
++put_dev:
++ nfc_put_device(dev);
++ return rc;
+ }
+
+ static int nfc_genl_vendor_cmd(struct sk_buff *skb,
+@@ -1569,14 +1582,21 @@ static int nfc_genl_vendor_cmd(struct sk_buff *skb,
+ subcmd = nla_get_u32(info->attrs[NFC_ATTR_VENDOR_SUBCMD]);
+
+ dev = nfc_get_device(dev_idx);
+- if (!dev || !dev->vendor_cmds || !dev->n_vendor_cmds)
++ if (!dev)
+ return -ENODEV;
+
++ if (!dev->vendor_cmds || !dev->n_vendor_cmds) {
++ err = -ENODEV;
++ goto put_dev;
++ }
++
+ if (info->attrs[NFC_ATTR_VENDOR_DATA]) {
+ data = nla_data(info->attrs[NFC_ATTR_VENDOR_DATA]);
+ data_len = nla_len(info->attrs[NFC_ATTR_VENDOR_DATA]);
+- if (data_len == 0)
+- return -EINVAL;
++ if (data_len == 0) {
++ err = -EINVAL;
++ goto put_dev;
++ }
+ } else {
+ data = NULL;
+ data_len = 0;
+@@ -1591,10 +1611,14 @@ static int nfc_genl_vendor_cmd(struct sk_buff *skb,
+ dev->cur_cmd_info = info;
+ err = cmd->doit(dev, data, data_len);
+ dev->cur_cmd_info = NULL;
+- return err;
++ goto put_dev;
+ }
+
+- return -EOPNOTSUPP;
++ err = -EOPNOTSUPP;
++
++put_dev:
++ nfc_put_device(dev);
++ return err;
+ }
+
+ /* message building helper */
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index e9a10a66b4cad..fbc5752472689 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -903,6 +903,7 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ struct sw_flow_mask mask;
+ struct sk_buff *reply;
+ struct datapath *dp;
++ struct sw_flow_key *key;
+ struct sw_flow_actions *acts;
+ struct sw_flow_match match;
+ u32 ufid_flags = ovs_nla_get_ufid_flags(a[OVS_FLOW_ATTR_UFID_FLAGS]);
+@@ -930,24 +931,26 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ }
+
+ /* Extract key. */
+- ovs_match_init(&match, &new_flow->key, false, &mask);
++ key = kzalloc(sizeof(*key), GFP_KERNEL);
++ if (!key) {
++ error = -ENOMEM;
++ goto err_kfree_key;
++ }
++
++ ovs_match_init(&match, key, false, &mask);
+ error = ovs_nla_get_match(net, &match, a[OVS_FLOW_ATTR_KEY],
+ a[OVS_FLOW_ATTR_MASK], log);
+ if (error)
+ goto err_kfree_flow;
+
++ ovs_flow_mask_key(&new_flow->key, key, true, &mask);
++
+ /* Extract flow identifier. */
+ error = ovs_nla_get_identifier(&new_flow->id, a[OVS_FLOW_ATTR_UFID],
+- &new_flow->key, log);
++ key, log);
+ if (error)
+ goto err_kfree_flow;
+
+- /* unmasked key is needed to match when ufid is not used. */
+- if (ovs_identifier_is_key(&new_flow->id))
+- match.key = new_flow->id.unmasked_key;
+-
+- ovs_flow_mask_key(&new_flow->key, &new_flow->key, true, &mask);
+-
+ /* Validate actions. */
+ error = ovs_nla_copy_actions(net, a[OVS_FLOW_ATTR_ACTIONS],
+ &new_flow->key, &acts, log);
+@@ -974,7 +977,7 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ if (ovs_identifier_is_ufid(&new_flow->id))
+ flow = ovs_flow_tbl_lookup_ufid(&dp->table, &new_flow->id);
+ if (!flow)
+- flow = ovs_flow_tbl_lookup(&dp->table, &new_flow->key);
++ flow = ovs_flow_tbl_lookup(&dp->table, key);
+ if (likely(!flow)) {
+ rcu_assign_pointer(new_flow->sf_acts, acts);
+
+@@ -1044,6 +1047,8 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
+
+ if (reply)
+ ovs_notify(&dp_flow_genl_family, reply, info);
++
++ kfree(key);
+ return 0;
+
+ err_unlock_ovs:
+@@ -1053,6 +1058,8 @@ err_kfree_acts:
+ ovs_nla_free_flow_actions(acts);
+ err_kfree_flow:
+ ovs_flow_free(new_flow, false);
++err_kfree_key:
++ kfree(key);
+ error:
+ return error;
+ }
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index 0220a29350023..a7a09eb04d93b 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -689,7 +689,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
+ if (call->tx_total_len != -1 ||
+ call->tx_pending ||
+ call->tx_top != 0)
+- goto error_put;
++ goto out_put_unlock;
+ call->tx_total_len = p.call.tx_total_len;
+ }
+ }
+diff --git a/net/sched/ematch.c b/net/sched/ematch.c
+index 113a133ee5440..5ba3548d2eb74 100644
+--- a/net/sched/ematch.c
++++ b/net/sched/ematch.c
+@@ -259,6 +259,8 @@ static int tcf_em_validate(struct tcf_proto *tp,
+ * the value carried.
+ */
+ if (em_hdr->flags & TCF_EM_SIMPLE) {
++ if (em->ops->datalen > 0)
++ goto errout;
+ if (data_len < sizeof(u32))
+ goto errout;
+ em->data = *(u32 *) data;
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 424e70907b967..41c67cfd264fb 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1031,8 +1031,12 @@ skip:
+ unsigned long cl = cops->find(parent, classid);
+
+ if (cl) {
+- err = cops->graft(parent, cl, new, &old,
+- extack);
++ if (new && new->ops == &noqueue_qdisc_ops) {
++ NL_SET_ERR_MSG(extack, "Cannot assign noqueue to a class");
++ err = -EINVAL;
++ } else {
++ err = cops->graft(parent, cl, new, &old, extack);
++ }
+ } else {
+ NL_SET_ERR_MSG(extack, "Specified class not found");
+ err = -ENOENT;
+diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
+index 9a1bfa13a6cd6..ff825f40ea048 100644
+--- a/net/sched/sch_atm.c
++++ b/net/sched/sch_atm.c
+@@ -394,10 +394,13 @@ static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ result = tcf_classify(skb, fl, &res, true);
+ if (result < 0)
+ continue;
++ if (result == TC_ACT_SHOT)
++ goto done;
++
+ flow = (struct atm_flow_data *)res.class;
+ if (!flow)
+ flow = lookup_flow(sch, res.classid);
+- goto done;
++ goto drop;
+ }
+ }
+ flow = NULL;
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index e61c48c1b37d6..c11e685396025 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -323,7 +323,7 @@ __gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth
+ list_for_each_entry(pos, &pipe->in_downcall, list) {
+ if (!uid_eq(pos->uid, uid))
+ continue;
+- if (auth && pos->auth->service != auth->service)
++ if (pos->auth->service != auth->service)
+ continue;
+ refcount_inc(&pos->count);
+ dprintk("RPC: %s found msg %p\n", __func__, pos);
+@@ -677,6 +677,21 @@ out:
+ return err;
+ }
+
++static struct gss_upcall_msg *
++gss_find_downcall(struct rpc_pipe *pipe, kuid_t uid)
++{
++ struct gss_upcall_msg *pos;
++ list_for_each_entry(pos, &pipe->in_downcall, list) {
++ if (!uid_eq(pos->uid, uid))
++ continue;
++ if (!rpc_msg_is_inflight(&pos->msg))
++ continue;
++ refcount_inc(&pos->count);
++ return pos;
++ }
++ return NULL;
++}
++
+ #define MSG_BUF_MAXSIZE 1024
+
+ static ssize_t
+@@ -723,7 +738,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+ err = -ENOENT;
+ /* Find a matching upcall */
+ spin_lock(&pipe->lock);
+- gss_msg = __gss_find_upcall(pipe, uid, NULL);
++ gss_msg = gss_find_downcall(pipe, uid);
+ if (gss_msg == NULL) {
+ spin_unlock(&pipe->lock);
+ goto err_put_ctx;
+diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
+index d9d03881e4de5..ed6b2a155f44b 100644
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -1088,18 +1088,23 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp,
+ return res;
+
+ inlen = svc_getnl(argv);
+- if (inlen > (argv->iov_len + rqstp->rq_arg.page_len))
++ if (inlen > (argv->iov_len + rqstp->rq_arg.page_len)) {
++ kfree(in_handle->data);
+ return SVC_DENIED;
++ }
+
+ pages = DIV_ROUND_UP(inlen, PAGE_SIZE);
+ in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL);
+- if (!in_token->pages)
++ if (!in_token->pages) {
++ kfree(in_handle->data);
+ return SVC_DENIED;
++ }
+ in_token->page_base = 0;
+ in_token->page_len = inlen;
+ for (i = 0; i < pages; i++) {
+ in_token->pages[i] = alloc_page(GFP_KERNEL);
+ if (!in_token->pages[i]) {
++ kfree(in_handle->data);
+ gss_free_in_token_pages(in_token);
+ return SVC_DENIED;
+ }
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 0d7d149b1b1b0..1946bd13d5df7 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1267,7 +1267,7 @@ static int rpc_sockname(struct net *net, struct sockaddr *sap, size_t salen,
+ break;
+ default:
+ err = -EAFNOSUPPORT;
+- goto out;
++ goto out_release;
+ }
+ if (err < 0) {
+ dprintk("RPC: can't bind UDP socket (%d)\n", err);
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index 42ab3e2ac0602..2a8127f245e8d 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -1733,7 +1733,11 @@ static int vmci_transport_dgram_enqueue(
+ if (!dg)
+ return -ENOMEM;
+
+- memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len);
++ err = memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len);
++ if (err) {
++ kfree(dg);
++ return err;
++ }
+
+ dg->dst = vmci_make_handle(remote_addr->svm_cid,
+ remote_addr->svm_port);
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 07d053603e3a6..beba41f8a178c 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -3918,8 +3918,10 @@ static int __init regulatory_init_db(void)
+ return -EINVAL;
+
+ err = load_builtin_regdb_keys();
+- if (err)
++ if (err) {
++ platform_device_unregister(reg_pdev);
+ return err;
++ }
+
+ /* We always try to get an update for the static regdomain */
+ err = regulatory_hint_core(cfg80211_world_regdom->alpha2);
+diff --git a/samples/vfio-mdev/mdpy-fb.c b/samples/vfio-mdev/mdpy-fb.c
+index a760e130bd0d6..8ad1aa13ddd90 100644
+--- a/samples/vfio-mdev/mdpy-fb.c
++++ b/samples/vfio-mdev/mdpy-fb.c
+@@ -109,7 +109,7 @@ static int mdpy_fb_probe(struct pci_dev *pdev,
+
+ ret = pci_request_regions(pdev, "mdpy-fb");
+ if (ret < 0)
+- return ret;
++ goto err_disable_dev;
+
+ pci_read_config_dword(pdev, MDPY_FORMAT_OFFSET, &format);
+ pci_read_config_dword(pdev, MDPY_WIDTH_OFFSET, &width);
+@@ -191,6 +191,9 @@ err_release_fb:
+ err_release_regions:
+ pci_release_regions(pdev);
+
++err_disable_dev:
++ pci_disable_device(pdev);
++
+ return ret;
+ }
+
+@@ -199,7 +202,10 @@ static void mdpy_fb_remove(struct pci_dev *pdev)
+ struct fb_info *info = pci_get_drvdata(pdev);
+
+ unregister_framebuffer(info);
++ iounmap(info->screen_base);
+ framebuffer_release(info);
++ pci_release_regions(pdev);
++ pci_disable_device(pdev);
+ }
+
+ static struct pci_device_id mdpy_fb_pci_table[] = {
+diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
+index 8868c475205ff..80012d21f0386 100644
+--- a/security/apparmor/apparmorfs.c
++++ b/security/apparmor/apparmorfs.c
+@@ -869,8 +869,10 @@ static struct multi_transaction *multi_transaction_new(struct file *file,
+ if (!t)
+ return ERR_PTR(-ENOMEM);
+ kref_init(&t->count);
+- if (copy_from_user(t->data, buf, size))
++ if (copy_from_user(t->data, buf, size)) {
++ put_multi_transaction(t);
+ return ERR_PTR(-EFAULT);
++ }
+
+ return t;
+ }
+diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
+index 3a4293c46ad53..c4b5d5e3a721a 100644
+--- a/security/apparmor/policy.c
++++ b/security/apparmor/policy.c
+@@ -1125,7 +1125,7 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj,
+
+ if (!name) {
+ /* remove namespace - can only happen if fqname[0] == ':' */
+- mutex_lock_nested(&ns->parent->lock, ns->level);
++ mutex_lock_nested(&ns->parent->lock, ns->parent->level);
+ __aa_bump_ns_revision(ns);
+ __aa_remove_ns(ns);
+ mutex_unlock(&ns->parent->lock);
+diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
+index 612f737cee836..41da5ccc3f3eb 100644
+--- a/security/apparmor/policy_unpack.c
++++ b/security/apparmor/policy_unpack.c
+@@ -892,7 +892,7 @@ static int verify_header(struct aa_ext *e, int required, const char **ns)
+ * if not specified use previous version
+ * Mask off everything that is not kernel abi version
+ */
+- if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v7)) {
++ if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v8)) {
+ audit_iface(NULL, NULL, NULL, "unsupported interface version",
+ e, error);
+ return error;
+diff --git a/security/device_cgroup.c b/security/device_cgroup.c
+index dc28914fa72e0..5ff31eeea68cf 100644
+--- a/security/device_cgroup.c
++++ b/security/device_cgroup.c
+@@ -79,6 +79,17 @@ free_and_exit:
+ return -ENOMEM;
+ }
+
++static void dev_exceptions_move(struct list_head *dest, struct list_head *orig)
++{
++ struct dev_exception_item *ex, *tmp;
++
++ lockdep_assert_held(&devcgroup_mutex);
++
++ list_for_each_entry_safe(ex, tmp, orig, list) {
++ list_move_tail(&ex->list, dest);
++ }
++}
++
+ /*
+ * called under devcgroup_mutex
+ */
+@@ -600,11 +611,13 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
+ int count, rc = 0;
+ struct dev_exception_item ex;
+ struct dev_cgroup *parent = css_to_devcgroup(devcgroup->css.parent);
++ struct dev_cgroup tmp_devcgrp;
+
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+ memset(&ex, 0, sizeof(ex));
++ memset(&tmp_devcgrp, 0, sizeof(tmp_devcgrp));
+ b = buffer;
+
+ switch (*b) {
+@@ -616,15 +629,27 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
+
+ if (!may_allow_all(parent))
+ return -EPERM;
+- dev_exception_clean(devcgroup);
+- devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
+- if (!parent)
++ if (!parent) {
++ devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
++ dev_exception_clean(devcgroup);
+ break;
++ }
+
++ INIT_LIST_HEAD(&tmp_devcgrp.exceptions);
++ rc = dev_exceptions_copy(&tmp_devcgrp.exceptions,
++ &devcgroup->exceptions);
++ if (rc)
++ return rc;
++ dev_exception_clean(devcgroup);
+ rc = dev_exceptions_copy(&devcgroup->exceptions,
+ &parent->exceptions);
+- if (rc)
++ if (rc) {
++ dev_exceptions_move(&devcgroup->exceptions,
++ &tmp_devcgrp.exceptions);
+ return rc;
++ }
++ devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
++ dev_exception_clean(&tmp_devcgrp);
+ break;
+ case DEVCG_DENY:
+ if (css_has_online_children(&devcgroup->css))
+diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c
+index 4dfdccce497b6..ec814cbdae992 100644
+--- a/security/integrity/ima/ima_template.c
++++ b/security/integrity/ima/ima_template.c
+@@ -196,11 +196,11 @@ static int template_desc_init_fields(const char *template_fmt,
+ }
+
+ if (fields && num_fields) {
+- *fields = kmalloc_array(i, sizeof(*fields), GFP_KERNEL);
++ *fields = kmalloc_array(i, sizeof(**fields), GFP_KERNEL);
+ if (*fields == NULL)
+ return -ENOMEM;
+
+- memcpy(*fields, found_fields, i * sizeof(*fields));
++ memcpy(*fields, found_fields, i * sizeof(**fields));
+ *num_fields = i;
+ }
+
+@@ -266,8 +266,11 @@ static struct ima_template_desc *restore_template_fmt(char *template_name)
+
+ template_desc->name = "";
+ template_desc->fmt = kstrdup(template_name, GFP_KERNEL);
+- if (!template_desc->fmt)
++ if (!template_desc->fmt) {
++ kfree(template_desc);
++ template_desc = NULL;
+ goto out;
++ }
+
+ spin_lock(&template_list);
+ list_add_tail_rcu(&template_desc->list, &defined_templates);
+diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
+index 3fc216644e0e8..00d826b048c4a 100644
+--- a/sound/core/control_compat.c
++++ b/sound/core/control_compat.c
+@@ -319,7 +319,9 @@ static int ctl_elem_read_user(struct snd_card *card,
+ err = snd_power_wait(card, SNDRV_CTL_POWER_D0);
+ if (err < 0)
+ goto error;
++ down_read(&card->controls_rwsem);
+ err = snd_ctl_elem_read(card, data);
++ up_read(&card->controls_rwsem);
+ if (err < 0)
+ goto error;
+ err = copy_ctl_value_to_user(userdata, valuep, data, type, count);
+@@ -347,7 +349,9 @@ static int ctl_elem_write_user(struct snd_ctl_file *file,
+ err = snd_power_wait(card, SNDRV_CTL_POWER_D0);
+ if (err < 0)
+ goto error;
++ down_write(&card->controls_rwsem);
+ err = snd_ctl_elem_write(card, file, data);
++ up_write(&card->controls_rwsem);
+ if (err < 0)
+ goto error;
+ err = copy_ctl_value_to_user(userdata, valuep, data, type, count);
+diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
+index b68e71ca7abda..7dceb1e1c3b48 100644
+--- a/sound/drivers/mts64.c
++++ b/sound/drivers/mts64.c
+@@ -830,6 +830,9 @@ static void snd_mts64_interrupt(void *private)
+ u8 status, data;
+ struct snd_rawmidi_substream *substream;
+
++ if (!mts)
++ return;
++
+ spin_lock(&mts->lock);
+ ret = mts64_read(mts->pardev->port);
+ data = ret & 0x00ff;
+diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
+index 3f06986fbecf8..d8c244a5dce05 100644
+--- a/sound/pci/asihpi/hpioctl.c
++++ b/sound/pci/asihpi/hpioctl.c
+@@ -359,7 +359,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev,
+ pci_dev->device, pci_dev->subsystem_vendor,
+ pci_dev->subsystem_device, pci_dev->devfn);
+
+- if (pci_enable_device(pci_dev) < 0) {
++ if (pcim_enable_device(pci_dev) < 0) {
+ dev_err(&pci_dev->dev,
+ "pci_enable_device failed, disabling device\n");
+ return -EIO;
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index cbd5118570fd5..be9f1c4295cde 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1804,33 +1804,43 @@ static int hdmi_add_cvt(struct hda_codec *codec, hda_nid_t cvt_nid)
+
+ static int hdmi_parse_codec(struct hda_codec *codec)
+ {
+- hda_nid_t nid;
++ hda_nid_t start_nid;
++ unsigned int caps;
+ int i, nodes;
+
+- nodes = snd_hda_get_sub_nodes(codec, codec->core.afg, &nid);
+- if (!nid || nodes < 0) {
++ nodes = snd_hda_get_sub_nodes(codec, codec->core.afg, &start_nid);
++ if (!start_nid || nodes < 0) {
+ codec_warn(codec, "HDMI: failed to get afg sub nodes\n");
+ return -EINVAL;
+ }
+
+- for (i = 0; i < nodes; i++, nid++) {
+- unsigned int caps;
+- unsigned int type;
++ /*
++ * hdmi_add_pin() assumes total amount of converters to
++ * be known, so first discover all converters
++ */
++ for (i = 0; i < nodes; i++) {
++ hda_nid_t nid = start_nid + i;
+
+ caps = get_wcaps(codec, nid);
+- type = get_wcaps_type(caps);
+
+ if (!(caps & AC_WCAP_DIGITAL))
+ continue;
+
+- switch (type) {
+- case AC_WID_AUD_OUT:
++ if (get_wcaps_type(caps) == AC_WID_AUD_OUT)
+ hdmi_add_cvt(codec, nid);
+- break;
+- case AC_WID_PIN:
++ }
++
++ /* discover audio pins */
++ for (i = 0; i < nodes; i++) {
++ hda_nid_t nid = start_nid + i;
++
++ caps = get_wcaps(codec, nid);
++
++ if (!(caps & AC_WCAP_DIGITAL))
++ continue;
++
++ if (get_wcaps_type(caps) == AC_WID_PIN)
+ hdmi_add_pin(codec, nid);
+- break;
+- }
+ }
+
+ return 0;
+diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
+index 5272c81641c1c..310cfceab41fb 100644
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -1471,7 +1471,7 @@ int pcm512x_probe(struct device *dev, struct regmap *regmap)
+ if (val > 6) {
+ dev_err(dev, "Invalid pll-in\n");
+ ret = -EINVAL;
+- goto err_clk;
++ goto err_pm;
+ }
+ pcm512x->pll_in = val;
+ }
+@@ -1480,7 +1480,7 @@ int pcm512x_probe(struct device *dev, struct regmap *regmap)
+ if (val > 6) {
+ dev_err(dev, "Invalid pll-out\n");
+ ret = -EINVAL;
+- goto err_clk;
++ goto err_pm;
+ }
+ pcm512x->pll_out = val;
+ }
+@@ -1489,12 +1489,12 @@ int pcm512x_probe(struct device *dev, struct regmap *regmap)
+ dev_err(dev,
+ "Error: both pll-in and pll-out, or none\n");
+ ret = -EINVAL;
+- goto err_clk;
++ goto err_pm;
+ }
+ if (pcm512x->pll_in && pcm512x->pll_in == pcm512x->pll_out) {
+ dev_err(dev, "Error: pll-in == pll-out\n");
+ ret = -EINVAL;
+- goto err_clk;
++ goto err_pm;
+ }
+ }
+ #endif
+diff --git a/sound/soc/codecs/rt298.c b/sound/soc/codecs/rt298.c
+index 06cdba4edfe2c..3181b91a025bc 100644
+--- a/sound/soc/codecs/rt298.c
++++ b/sound/soc/codecs/rt298.c
+@@ -1169,6 +1169,13 @@ static const struct dmi_system_id force_combo_jack_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Geminilake")
+ }
+ },
++ {
++ .ident = "Intel Kabylake R RVP",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Kabylake Client platform")
++ }
++ },
+ { }
+ };
+
+diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
+index 6a2a58e107e37..9dd99d123e440 100644
+--- a/sound/soc/codecs/rt5670.c
++++ b/sound/soc/codecs/rt5670.c
+@@ -3217,8 +3217,6 @@ static int rt5670_i2c_probe(struct i2c_client *i2c,
+ if (ret < 0)
+ goto err;
+
+- pm_runtime_put(&i2c->dev);
+-
+ return 0;
+ err:
+ pm_runtime_disable(&i2c->dev);
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index e3e069277a3ff..13ef2bebf6da3 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -3715,7 +3715,12 @@ static irqreturn_t wm1811_jackdet_irq(int irq, void *data)
+ } else {
+ dev_dbg(component->dev, "Jack not detected\n");
+
++ /* Release wm8994->accdet_lock to avoid deadlock:
++ * cancel_delayed_work_sync() takes wm8994->mic_work internal
++ * lock and wm1811_mic_work takes wm8994->accdet_lock */
++ mutex_unlock(&wm8994->accdet_lock);
+ cancel_delayed_work_sync(&wm8994->mic_work);
++ mutex_lock(&wm8994->accdet_lock);
+
+ snd_soc_component_update_bits(component, WM8958_MICBIAS2,
+ WM8958_MICB2_DISCH, WM8958_MICB2_DISCH);
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index c4d19b88d17dc..2001bc774c643 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -437,6 +437,21 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ {
++ /* Advantech MICA-071 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Advantech"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MICA-071"),
++ },
++ /* OVCD Th = 1500uA to reliable detect head-phones vs -set */
++ .driver_data = (void *)(BYT_RT5640_IN3_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_1500UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_MONO_SPEAKER |
++ BYT_RT5640_DIFF_MIC |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"),
+diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
+index cdb3940710379..9f8d2a00a1cdd 100644
+--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
+@@ -199,14 +199,16 @@ static int mt8173_rt5650_rt5514_dev_probe(struct platform_device *pdev)
+ if (!mt8173_rt5650_rt5514_codecs[0].of_node) {
+ dev_err(&pdev->dev,
+ "Property 'audio-codec' missing or invalid\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out;
+ }
+ mt8173_rt5650_rt5514_codecs[1].of_node =
+ of_parse_phandle(pdev->dev.of_node, "mediatek,audio-codec", 1);
+ if (!mt8173_rt5650_rt5514_codecs[1].of_node) {
+ dev_err(&pdev->dev,
+ "Property 'audio-codec' missing or invalid\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out;
+ }
+ mt8173_rt5650_rt5514_codec_conf[0].of_node =
+ mt8173_rt5650_rt5514_codecs[1].of_node;
+@@ -218,6 +220,7 @@ static int mt8173_rt5650_rt5514_dev_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+ __func__, ret);
+
++out:
+ of_node_put(platform_node);
+ return ret;
+ }
+diff --git a/sound/soc/pxa/mmp-pcm.c b/sound/soc/pxa/mmp-pcm.c
+index d2d4652de32cc..5969aa66410dc 100644
+--- a/sound/soc/pxa/mmp-pcm.c
++++ b/sound/soc/pxa/mmp-pcm.c
+@@ -90,7 +90,7 @@ static bool filter(struct dma_chan *chan, void *param)
+
+ devname = kasprintf(GFP_KERNEL, "%s.%d", dma_data->dma_res->name,
+ dma_data->ssp_id);
+- if ((strcmp(dev_name(chan->device->dev), devname) == 0) &&
++ if (devname && (strcmp(dev_name(chan->device->dev), devname) == 0) &&
+ (chan->chan_id == dma_data->dma_res->start)) {
+ found = true;
+ }
+diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c
+index ad16c8310dd38..7dfd1e6b2c25c 100644
+--- a/sound/soc/rockchip/rockchip_pdm.c
++++ b/sound/soc/rockchip/rockchip_pdm.c
+@@ -303,6 +303,7 @@ static int rockchip_pdm_runtime_resume(struct device *dev)
+
+ ret = clk_prepare_enable(pdm->hclk);
+ if (ret) {
++ clk_disable_unprepare(pdm->clk);
+ dev_err(pdm->dev, "hclock enable failed %d\n", ret);
+ return ret;
+ }
+diff --git a/sound/soc/rockchip/rockchip_spdif.c b/sound/soc/rockchip/rockchip_spdif.c
+index a89fe9b6463ba..5ac726da60158 100644
+--- a/sound/soc/rockchip/rockchip_spdif.c
++++ b/sound/soc/rockchip/rockchip_spdif.c
+@@ -89,6 +89,7 @@ static int __maybe_unused rk_spdif_runtime_resume(struct device *dev)
+
+ ret = clk_prepare_enable(spdif->hclk);
+ if (ret) {
++ clk_disable_unprepare(spdif->mclk);
+ dev_err(spdif->dev, "hclk clock enable failed %d\n", ret);
+ return ret;
+ }
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index 2faf95d4bb75f..e01f3bf3ef171 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -458,8 +458,15 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol,
+ return err;
+
+ if (snd_soc_volsw_is_stereo(mc)) {
++ val2 = ucontrol->value.integer.value[1];
++
++ if (mc->platform_max && val2 > mc->platform_max)
++ return -EINVAL;
++ if (val2 > max)
++ return -EINVAL;
++
+ val_mask = mask << rshift;
+- val2 = (ucontrol->value.integer.value[1] + min) & mask;
++ val2 = (val2 + min) & mask;
+ val2 = val2 << rshift;
+
+ err = snd_soc_component_update_bits(component, reg2, val_mask,
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index 67d74218d861b..2399d500b8812 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -318,7 +318,8 @@ static void line6_data_received(struct urb *urb)
+ for (;;) {
+ done =
+ line6_midibuf_read(mb, line6->buffer_message,
+- LINE6_MIDI_MESSAGE_MAXLEN);
++ LINE6_MIDI_MESSAGE_MAXLEN,
++ LINE6_MIDIBUF_READ_RX);
+
+ if (done <= 0)
+ break;
+diff --git a/sound/usb/line6/midi.c b/sound/usb/line6/midi.c
+index e2cf55c53ea8b..6df1cf26e440c 100644
+--- a/sound/usb/line6/midi.c
++++ b/sound/usb/line6/midi.c
+@@ -48,7 +48,8 @@ static void line6_midi_transmit(struct snd_rawmidi_substream *substream)
+ int req, done;
+
+ for (;;) {
+- req = min(line6_midibuf_bytes_free(mb), line6->max_packet_size);
++ req = min3(line6_midibuf_bytes_free(mb), line6->max_packet_size,
++ LINE6_FALLBACK_MAXPACKETSIZE);
+ done = snd_rawmidi_transmit_peek(substream, chunk, req);
+
+ if (done == 0)
+@@ -60,7 +61,8 @@ static void line6_midi_transmit(struct snd_rawmidi_substream *substream)
+
+ for (;;) {
+ done = line6_midibuf_read(mb, chunk,
+- LINE6_FALLBACK_MAXPACKETSIZE);
++ LINE6_FALLBACK_MAXPACKETSIZE,
++ LINE6_MIDIBUF_READ_TX);
+
+ if (done == 0)
+ break;
+diff --git a/sound/usb/line6/midibuf.c b/sound/usb/line6/midibuf.c
+index c931d48801ebe..4622234723a6e 100644
+--- a/sound/usb/line6/midibuf.c
++++ b/sound/usb/line6/midibuf.c
+@@ -13,6 +13,7 @@
+
+ #include "midibuf.h"
+
++
+ static int midibuf_message_length(unsigned char code)
+ {
+ int message_length;
+@@ -24,12 +25,7 @@ static int midibuf_message_length(unsigned char code)
+
+ message_length = length[(code >> 4) - 8];
+ } else {
+- /*
+- Note that according to the MIDI specification 0xf2 is
+- the "Song Position Pointer", but this is used by Line 6
+- to send sysex messages to the host.
+- */
+- static const int length[] = { -1, 2, -1, 2, -1, -1, 1, 1, 1, 1,
++ static const int length[] = { -1, 2, 2, 2, -1, -1, 1, 1, 1, -1,
+ 1, 1, 1, -1, 1, 1
+ };
+ message_length = length[code & 0x0f];
+@@ -129,7 +125,7 @@ int line6_midibuf_write(struct midi_buffer *this, unsigned char *data,
+ }
+
+ int line6_midibuf_read(struct midi_buffer *this, unsigned char *data,
+- int length)
++ int length, int read_type)
+ {
+ int bytes_used;
+ int length1, length2;
+@@ -152,9 +148,22 @@ int line6_midibuf_read(struct midi_buffer *this, unsigned char *data,
+
+ length1 = this->size - this->pos_read;
+
+- /* check MIDI command length */
+ command = this->buf[this->pos_read];
++ /*
++ PODxt always has status byte lower nibble set to 0010,
++ when it means to send 0000, so we correct if here so
++ that control/program changes come on channel 1 and
++ sysex message status byte is correct
++ */
++ if (read_type == LINE6_MIDIBUF_READ_RX) {
++ if (command == 0xb2 || command == 0xc2 || command == 0xf2) {
++ unsigned char fixed = command & 0xf0;
++ this->buf[this->pos_read] = fixed;
++ command = fixed;
++ }
++ }
+
++ /* check MIDI command length */
+ if (command & 0x80) {
+ midi_length = midibuf_message_length(command);
+ this->command_prev = command;
+diff --git a/sound/usb/line6/midibuf.h b/sound/usb/line6/midibuf.h
+index 6ea21ffb66271..187f49c975c28 100644
+--- a/sound/usb/line6/midibuf.h
++++ b/sound/usb/line6/midibuf.h
+@@ -12,6 +12,9 @@
+ #ifndef MIDIBUF_H
+ #define MIDIBUF_H
+
++#define LINE6_MIDIBUF_READ_TX 0
++#define LINE6_MIDIBUF_READ_RX 1
++
+ struct midi_buffer {
+ unsigned char *buf;
+ int size;
+@@ -27,7 +30,7 @@ extern void line6_midibuf_destroy(struct midi_buffer *mb);
+ extern int line6_midibuf_ignore(struct midi_buffer *mb, int length);
+ extern int line6_midibuf_init(struct midi_buffer *mb, int size, int split);
+ extern int line6_midibuf_read(struct midi_buffer *mb, unsigned char *data,
+- int length);
++ int length, int read_type);
+ extern void line6_midibuf_reset(struct midi_buffer *mb);
+ extern int line6_midibuf_write(struct midi_buffer *mb, unsigned char *data,
+ int length);
+diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c
+index dff8e7d5f3050..41cb655eb4a6f 100644
+--- a/sound/usb/line6/pod.c
++++ b/sound/usb/line6/pod.c
+@@ -169,8 +169,9 @@ static struct line6_pcm_properties pod_pcm_properties = {
+ .bytes_per_channel = 3 /* SNDRV_PCM_FMTBIT_S24_3LE */
+ };
+
++
+ static const char pod_version_header[] = {
+- 0xf2, 0x7e, 0x7f, 0x06, 0x02
++ 0xf0, 0x7e, 0x7f, 0x06, 0x02
+ };
+
+ /* forward declarations: */
+diff --git a/tools/arch/parisc/include/uapi/asm/mman.h b/tools/arch/parisc/include/uapi/asm/mman.h
+index 1bd78758bde98..5d789369aeef8 100644
+--- a/tools/arch/parisc/include/uapi/asm/mman.h
++++ b/tools/arch/parisc/include/uapi/asm/mman.h
+@@ -1,20 +1,20 @@
+ /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+ #ifndef TOOLS_ARCH_PARISC_UAPI_ASM_MMAN_FIX_H
+ #define TOOLS_ARCH_PARISC_UAPI_ASM_MMAN_FIX_H
+-#define MADV_DODUMP 70
++#define MADV_DODUMP 17
+ #define MADV_DOFORK 11
+-#define MADV_DONTDUMP 69
++#define MADV_DONTDUMP 16
+ #define MADV_DONTFORK 10
+ #define MADV_DONTNEED 4
+ #define MADV_FREE 8
+-#define MADV_HUGEPAGE 67
+-#define MADV_MERGEABLE 65
+-#define MADV_NOHUGEPAGE 68
++#define MADV_HUGEPAGE 14
++#define MADV_MERGEABLE 12
++#define MADV_NOHUGEPAGE 15
+ #define MADV_NORMAL 0
+ #define MADV_RANDOM 1
+ #define MADV_REMOVE 9
+ #define MADV_SEQUENTIAL 2
+-#define MADV_UNMERGEABLE 66
++#define MADV_UNMERGEABLE 13
+ #define MADV_WILLNEED 3
+ #define MAP_ANONYMOUS 0x10
+ #define MAP_DENYWRITE 0x0800
+diff --git a/tools/perf/bench/bench.h b/tools/perf/bench/bench.h
+index b3e418afc21a2..71010922cd4d1 100644
+--- a/tools/perf/bench/bench.h
++++ b/tools/perf/bench/bench.h
+@@ -10,25 +10,13 @@ extern struct timeval bench__start, bench__end, bench__runtime;
+ * The madvise transparent hugepage constants were added in glibc
+ * 2.13. For compatibility with older versions of glibc, define these
+ * tokens if they are not already defined.
+- *
+- * PA-RISC uses different madvise values from other architectures and
+- * needs to be special-cased.
+ */
+-#ifdef __hppa__
+-# ifndef MADV_HUGEPAGE
+-# define MADV_HUGEPAGE 67
+-# endif
+-# ifndef MADV_NOHUGEPAGE
+-# define MADV_NOHUGEPAGE 68
+-# endif
+-#else
+ # ifndef MADV_HUGEPAGE
+ # define MADV_HUGEPAGE 14
+ # endif
+ # ifndef MADV_NOHUGEPAGE
+ # define MADV_NOHUGEPAGE 15
+ # endif
+-#endif
+
+ int bench_numa(int argc, const char **argv);
+ int bench_sched_messaging(int argc, const char **argv);
+diff --git a/tools/perf/tests/attr.py b/tools/perf/tests/attr.py
+index 44090a9a19f3b..3e07eee33b103 100644
+--- a/tools/perf/tests/attr.py
++++ b/tools/perf/tests/attr.py
+@@ -1,4 +1,3 @@
+-#! /usr/bin/python
+ # SPDX-License-Identifier: GPL-2.0
+
+ import os
+diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
+index 05cbdb6e6be8e..1e607403c94c1 100644
+--- a/tools/perf/util/auxtrace.c
++++ b/tools/perf/util/auxtrace.c
+@@ -1962,7 +1962,7 @@ static int find_dso_sym(struct dso *dso, const char *sym_name, u64 *start,
+ *size = sym->start - *start;
+ if (idx > 0) {
+ if (*size)
+- return 1;
++ return 0;
+ } else if (dso_sym_match(sym, sym_name, &cnt, idx)) {
+ print_duplicate_syms(dso, sym_name);
+ return -EINVAL;
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 230e94bf7775a..6de57d9ee7cc2 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -267,26 +267,13 @@ static int die_get_attr_udata(Dwarf_Die *tp_die, unsigned int attr_name,
+ {
+ Dwarf_Attribute attr;
+
+- if (dwarf_attr(tp_die, attr_name, &attr) == NULL ||
++ if (dwarf_attr_integrate(tp_die, attr_name, &attr) == NULL ||
+ dwarf_formudata(&attr, result) != 0)
+ return -ENOENT;
+
+ return 0;
+ }
+
+-/* Get attribute and translate it as a sdata */
+-static int die_get_attr_sdata(Dwarf_Die *tp_die, unsigned int attr_name,
+- Dwarf_Sword *result)
+-{
+- Dwarf_Attribute attr;
+-
+- if (dwarf_attr(tp_die, attr_name, &attr) == NULL ||
+- dwarf_formsdata(&attr, result) != 0)
+- return -ENOENT;
+-
+- return 0;
+-}
+-
+ /**
+ * die_is_signed_type - Check whether a type DIE is signed or not
+ * @tp_die: a DIE of a type
+@@ -410,9 +397,9 @@ int die_get_data_member_location(Dwarf_Die *mb_die, Dwarf_Word *offs)
+ /* Get the call file index number in CU DIE */
+ static int die_get_call_fileno(Dwarf_Die *in_die)
+ {
+- Dwarf_Sword idx;
++ Dwarf_Word idx;
+
+- if (die_get_attr_sdata(in_die, DW_AT_call_file, &idx) == 0)
++ if (die_get_attr_udata(in_die, DW_AT_call_file, &idx) == 0)
+ return (int)idx;
+ else
+ return -ENOENT;
+@@ -421,9 +408,9 @@ static int die_get_call_fileno(Dwarf_Die *in_die)
+ /* Get the declared file index number in CU DIE */
+ static int die_get_decl_fileno(Dwarf_Die *pdie)
+ {
+- Dwarf_Sword idx;
++ Dwarf_Word idx;
+
+- if (die_get_attr_sdata(pdie, DW_AT_decl_file, &idx) == 0)
++ if (die_get_attr_udata(pdie, DW_AT_decl_file, &idx) == 0)
+ return (int)idx;
+ else
+ return -ENOENT;
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 5fba57c10eddc..8dde4369fbcdb 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1129,7 +1129,7 @@ int dso__load_sym(struct dso *dso, struct map *map, struct symsrc *syms_ss,
+ (!used_opd && syms_ss->adjust_symbols)) {
+ GElf_Phdr phdr;
+
+- if (elf_read_program_header(syms_ss->elf,
++ if (elf_read_program_header(runtime_ss->elf,
+ (u64)sym.st_value, &phdr)) {
+ pr_warning("%s: failed to find program header for "
+ "symbol: %s st_value: %#" PRIx64 "\n",
+diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
+index 406401f1acc25..a0b53309c5d8f 100755
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -63,6 +63,7 @@ my %default = (
+ "STOP_TEST_AFTER" => 600,
+ "MAX_MONITOR_WAIT" => 1800,
+ "GRUB_REBOOT" => "grub2-reboot",
++ "GRUB_BLS_GET" => "grubby --info=ALL",
+ "SYSLINUX" => "extlinux",
+ "SYSLINUX_PATH" => "/boot/extlinux",
+ "CONNECT_TIMEOUT" => 25,
+@@ -123,6 +124,7 @@ my $last_grub_menu;
+ my $grub_file;
+ my $grub_number;
+ my $grub_reboot;
++my $grub_bls_get;
+ my $syslinux;
+ my $syslinux_path;
+ my $syslinux_label;
+@@ -292,6 +294,7 @@ my %option_map = (
+ "GRUB_MENU" => \$grub_menu,
+ "GRUB_FILE" => \$grub_file,
+ "GRUB_REBOOT" => \$grub_reboot,
++ "GRUB_BLS_GET" => \$grub_bls_get,
+ "SYSLINUX" => \$syslinux,
+ "SYSLINUX_PATH" => \$syslinux_path,
+ "SYSLINUX_LABEL" => \$syslinux_label,
+@@ -437,7 +440,7 @@ EOF
+ ;
+ $config_help{"REBOOT_TYPE"} = << "EOF"
+ Way to reboot the box to the test kernel.
+- Only valid options so far are "grub", "grub2", "syslinux", and "script".
++ Only valid options so far are "grub", "grub2", "grub2bls", "syslinux", and "script".
+
+ If you specify grub, it will assume grub version 1
+ and will search in /boot/grub/menu.lst for the title \$GRUB_MENU
+@@ -451,6 +454,8 @@ $config_help{"REBOOT_TYPE"} = << "EOF"
+ If you specify grub2, then you also need to specify both \$GRUB_MENU
+ and \$GRUB_FILE.
+
++ If you specify grub2bls, then you also need to specify \$GRUB_MENU.
++
+ If you specify syslinux, then you may use SYSLINUX to define the syslinux
+ command (defaults to extlinux), and SYSLINUX_PATH to specify the path to
+ the syslinux install (defaults to /boot/extlinux). But you have to specify
+@@ -476,6 +481,9 @@ $config_help{"GRUB_MENU"} = << "EOF"
+ menu must be a non-nested menu. Add the quotes used in the menu
+ to guarantee your selection, as the first menuentry with the content
+ of \$GRUB_MENU that is found will be used.
++
++ For grub2bls, \$GRUB_MENU is searched on the result of \$GRUB_BLS_GET
++ command for the lines that begin with "title".
+ EOF
+ ;
+ $config_help{"GRUB_FILE"} = << "EOF"
+@@ -692,7 +700,7 @@ sub get_mandatory_configs {
+ }
+ }
+
+- if ($rtype eq "grub") {
++ if (($rtype eq "grub") or ($rtype eq "grub2bls")) {
+ get_mandatory_config("GRUB_MENU");
+ }
+
+@@ -1850,84 +1858,121 @@ sub run_scp_mod {
+ return run_scp($src, $dst, $cp_scp);
+ }
+
+-sub get_grub2_index {
++sub _get_grub_index {
++
++ my ($command, $target, $skip, $submenu) = @_;
+
+ return if (defined($grub_number) && defined($last_grub_menu) &&
+ $last_grub_menu eq $grub_menu && defined($last_machine) &&
+ $last_machine eq $machine);
+
+- doprint "Find grub2 menu ... ";
++ doprint "Find $reboot_type menu ... ";
+ $grub_number = -1;
+
+ my $ssh_grub = $ssh_exec;
+- $ssh_grub =~ s,\$SSH_COMMAND,cat $grub_file,g;
++ $ssh_grub =~ s,\$SSH_COMMAND,$command,g;
+
+ open(IN, "$ssh_grub |")
+- or dodie "unable to get $grub_file";
++ or dodie "unable to execute $command";
+
+ my $found = 0;
+
++ my $submenu_number = 0;
++
+ while (<IN>) {
+- if (/^menuentry.*$grub_menu/) {
++ if (/$target/) {
+ $grub_number++;
+ $found = 1;
+ last;
+- } elsif (/^menuentry\s|^submenu\s/) {
++ } elsif (defined($submenu) && /$submenu/) {
++ $submenu_number++;
++ $grub_number = -1;
++ } elsif (/$skip/) {
+ $grub_number++;
+ }
+ }
+ close(IN);
+
+- dodie "Could not find '$grub_menu' in $grub_file on $machine"
++ dodie "Could not find '$grub_menu' through $command on $machine"
+ if (!$found);
++ if ($submenu_number > 0) {
++ $grub_number = "$submenu_number>$grub_number";
++ }
+ doprint "$grub_number\n";
+ $last_grub_menu = $grub_menu;
+ $last_machine = $machine;
+ }
+
+-sub get_grub_index {
+-
+- if ($reboot_type eq "grub2") {
+- get_grub2_index;
+- return;
+- }
++sub get_grub2_index {
+
+- if ($reboot_type ne "grub") {
+- return;
+- }
+ return if (defined($grub_number) && defined($last_grub_menu) &&
+ $last_grub_menu eq $grub_menu && defined($last_machine) &&
+ $last_machine eq $machine);
+
+- doprint "Find grub menu ... ";
++ doprint "Find grub2 menu ... ";
+ $grub_number = -1;
+
+ my $ssh_grub = $ssh_exec;
+- $ssh_grub =~ s,\$SSH_COMMAND,cat /boot/grub/menu.lst,g;
++ $ssh_grub =~ s,\$SSH_COMMAND,cat $grub_file,g;
+
+ open(IN, "$ssh_grub |")
+- or dodie "unable to get menu.lst";
++ or dodie "unable to get $grub_file";
+
+ my $found = 0;
++ my $grub_menu_qt = quotemeta($grub_menu);
+
+ while (<IN>) {
+- if (/^\s*title\s+$grub_menu\s*$/) {
++ if (/^menuentry.*$grub_menu_qt/) {
+ $grub_number++;
+ $found = 1;
+ last;
+- } elsif (/^\s*title\s/) {
++ } elsif (/^menuentry\s|^submenu\s/) {
+ $grub_number++;
+ }
+ }
+ close(IN);
+
+- dodie "Could not find '$grub_menu' in /boot/grub/menu on $machine"
++ dodie "Could not find '$grub_menu' in $grub_file on $machine"
+ if (!$found);
+ doprint "$grub_number\n";
+ $last_grub_menu = $grub_menu;
+ $last_machine = $machine;
+ }
+
++sub get_grub_index {
++
++ my $command;
++ my $target;
++ my $skip;
++ my $submenu;
++ my $grub_menu_qt;
++
++ if ($reboot_type !~ /^grub/) {
++ return;
++ }
++
++ $grub_menu_qt = quotemeta($grub_menu);
++
++ if ($reboot_type eq "grub") {
++ $command = "cat /boot/grub/menu.lst";
++ $target = '^\s*title\s+' . $grub_menu_qt . '\s*$';
++ $skip = '^\s*title\s';
++ } elsif ($reboot_type eq "grub2") {
++ $command = "cat $grub_file";
++ $target = '^\s*menuentry.*' . $grub_menu_qt;
++ $skip = '^\s*menuentry';
++ $submenu = '^\s*submenu\s';
++ } elsif ($reboot_type eq "grub2bls") {
++ $command = $grub_bls_get;
++ $target = '^title=.*' . $grub_menu_qt;
++ $skip = '^title=';
++ } else {
++ return;
++ }
++
++ _get_grub_index($command, $target, $skip, $submenu);
++}
++
+ sub wait_for_input
+ {
+ my ($fp, $time) = @_;
+@@ -1988,8 +2033,8 @@ sub reboot_to {
+
+ if ($reboot_type eq "grub") {
+ run_ssh "'(echo \"savedefault --default=$grub_number --once\" | grub --batch)'";
+- } elsif ($reboot_type eq "grub2") {
+- run_ssh "$grub_reboot $grub_number";
++ } elsif (($reboot_type eq "grub2") or ($reboot_type eq "grub2bls")) {
++ run_ssh "$grub_reboot \"'$grub_number'\"";
+ } elsif ($reboot_type eq "syslinux") {
+ run_ssh "$syslinux --once \\\"$syslinux_label\\\" $syslinux_path";
+ } elsif (defined $reboot_script) {
+@@ -3706,9 +3751,10 @@ sub test_this_config {
+ # .config to make sure it is missing the config that
+ # we had before
+ my %configs = %min_configs;
+- delete $configs{$config};
++ $configs{$config} = "# $config is not set";
+ make_new_config ((values %configs), (values %keep_configs));
+ make_oldconfig;
++ delete $configs{$config};
+ undef %configs;
+ assign_configs \%configs, $output_config;
+
+@@ -4283,7 +4329,7 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
+
+ if (!$buildonly) {
+ $target = "$ssh_user\@$machine";
+- if ($reboot_type eq "grub") {
++ if (($reboot_type eq "grub") or ($reboot_type eq "grub2bls")) {
+ dodie "GRUB_MENU not defined" if (!defined($grub_menu));
+ } elsif ($reboot_type eq "grub2") {
+ dodie "GRUB_MENU not defined" if (!defined($grub_menu));
+diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
+index 6fed4cf2db81d..79d614f1fe8e4 100644
+--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
+@@ -45,11 +45,18 @@ cnt_trace() {
+
+ test_event_enabled() {
+ val=$1
++ check_times=10 # wait for 10 * SLEEP_TIME at most
+
+- e=`cat $EVENT_ENABLE`
+- if [ "$e" != $val ]; then
+- fail "Expected $val but found $e"
+- fi
++ while [ $check_times -ne 0 ]; do
++ e=`cat $EVENT_ENABLE`
++ if [ "$e" == $val ]; then
++ return 0
++ fi
++ sleep $SLEEP_TIME
++ check_times=$((check_times - 1))
++ done
++
++ fail "Expected $val but found $e"
+ }
+
+ run_enable_disable() {
+diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
+index 9700281bee4c3..e7c205c8df56d 100644
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -144,6 +144,11 @@ endef
+ clean:
+ $(CLEAN)
+
++# Enables to extend CFLAGS and LDFLAGS from command line, e.g.
++# make USERCFLAGS=-Werror USERLDFLAGS=-static
++CFLAGS += $(USERCFLAGS)
++LDFLAGS += $(USERLDFLAGS)
++
+ # When make O= with kselftest target from main level
+ # the following aren't defined.
+ #
+diff --git a/tools/testing/selftests/powerpc/dscr/dscr_sysfs_test.c b/tools/testing/selftests/powerpc/dscr/dscr_sysfs_test.c
+index 1899bd85121f0..3f6d5be5bd145 100644
+--- a/tools/testing/selftests/powerpc/dscr/dscr_sysfs_test.c
++++ b/tools/testing/selftests/powerpc/dscr/dscr_sysfs_test.c
+@@ -27,6 +27,7 @@ static int check_cpu_dscr_default(char *file, unsigned long val)
+ rc = read(fd, buf, sizeof(buf));
+ if (rc == -1) {
+ perror("read() failed");
++ close(fd);
+ return 1;
+ }
+ close(fd);
+@@ -68,8 +69,10 @@ static int check_all_cpu_dscr_defaults(unsigned long val)
+ if (access(file, F_OK))
+ continue;
+
+- if (check_cpu_dscr_default(file, val))
++ if (check_cpu_dscr_default(file, val)) {
++ closedir(sysfs);
+ return 1;
++ }
+ }
+ closedir(sysfs);
+ return 0;
+diff --git a/tools/testing/selftests/proc/proc-uptime-002.c b/tools/testing/selftests/proc/proc-uptime-002.c
+index e7ceabed7f51f..7d0aa22bdc12b 100644
+--- a/tools/testing/selftests/proc/proc-uptime-002.c
++++ b/tools/testing/selftests/proc/proc-uptime-002.c
+@@ -17,6 +17,7 @@
+ // while shifting across CPUs.
+ #undef NDEBUG
+ #include <assert.h>
++#include <errno.h>
+ #include <unistd.h>
+ #include <sys/syscall.h>
+ #include <stdlib.h>
+@@ -54,7 +55,7 @@ int main(void)
+ len += sizeof(unsigned long);
+ free(m);
+ m = malloc(len);
+- } while (sys_sched_getaffinity(0, len, m) == -EINVAL);
++ } while (sys_sched_getaffinity(0, len, m) == -1 && errno == EINVAL);
+
+ fd = open("/proc/uptime", O_RDONLY);
+ assert(fd >= 0);
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-01-24 7:16 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2023-01-24 7:16 UTC (permalink / raw
To: gentoo-commits
commit: 040e9205866fbc2b708b1e4f25d835df22fa3335
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Tue Jan 24 07:15:12 2023 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Tue Jan 24 07:15:54 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=040e9205
Linux patch 4.19.271
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1270_linux-4.19.271.patch | 1644 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1648 insertions(+)
diff --git a/0000_README b/0000_README
index 851ba936..9dab2ece 100644
--- a/0000_README
+++ b/0000_README
@@ -1123,6 +1123,10 @@ Patch: 1269_linux-4.19.270.patch
From: https://www.kernel.org
Desc: Linux 4.19.270
+Patch: 1270_linux-4.19.271.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.271
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1270_linux-4.19.271.patch b/1270_linux-4.19.271.patch
new file mode 100644
index 00000000..ebd730bb
--- /dev/null
+++ b/1270_linux-4.19.271.patch
@@ -0,0 +1,1644 @@
+diff --git a/Makefile b/Makefile
+index 11c68e88776a5..560507d1f7a10 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 270
++SUBLEVEL = 271
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
+index 9692ccc583bb3..a3a570df6be1c 100644
+--- a/arch/x86/kernel/fpu/init.c
++++ b/arch/x86/kernel/fpu/init.c
+@@ -138,9 +138,6 @@ static void __init fpu__init_system_generic(void)
+ unsigned int fpu_kernel_xstate_size;
+ EXPORT_SYMBOL_GPL(fpu_kernel_xstate_size);
+
+-/* Get alignment of the TYPE. */
+-#define TYPE_ALIGN(TYPE) offsetof(struct { char x; TYPE test; }, test)
+-
+ /*
+ * Enforce that 'MEMBER' is the last field of 'TYPE'.
+ *
+@@ -148,8 +145,8 @@ EXPORT_SYMBOL_GPL(fpu_kernel_xstate_size);
+ * because that's how C aligns structs.
+ */
+ #define CHECK_MEMBER_AT_END_OF(TYPE, MEMBER) \
+- BUILD_BUG_ON(sizeof(TYPE) != ALIGN(offsetofend(TYPE, MEMBER), \
+- TYPE_ALIGN(TYPE)))
++ BUILD_BUG_ON(sizeof(TYPE) != \
++ ALIGN(offsetofend(TYPE, MEMBER), _Alignof(TYPE)))
+
+ /*
+ * We append the 'struct fpu' to the task_struct:
+diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+index c05ef7f1d7b66..99a40385267cd 100644
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -551,6 +551,11 @@ static noinline void axi_chan_handle_err(struct axi_dma_chan *chan, u32 status)
+
+ /* The bad descriptor currently is in the head of vc list */
+ vd = vchan_next_desc(&chan->vc);
++ if (!vd) {
++ dev_err(chan2dev(chan), "BUG: %s, IRQ with no descriptors\n",
++ axi_chan_name(chan));
++ goto out;
++ }
+ /* Remove the completed descriptor from issued list */
+ list_del(&vd->node);
+
+@@ -565,6 +570,7 @@ static noinline void axi_chan_handle_err(struct axi_dma_chan *chan, u32 status)
+ /* Try to restart the controller */
+ axi_chan_start_first_queued(chan);
+
++out:
+ spin_unlock_irqrestore(&chan->vc.lock, flags);
+ }
+
+diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c
+index 2e3ef0eb6e821..e50dd4030d908 100644
+--- a/drivers/firmware/google/gsmi.c
++++ b/drivers/firmware/google/gsmi.c
+@@ -343,9 +343,10 @@ static efi_status_t gsmi_get_variable(efi_char16_t *name,
+ memcpy(data, gsmi_dev.data_buf->start, *data_size);
+
+ /* All variables are have the following attributes */
+- *attr = EFI_VARIABLE_NON_VOLATILE |
+- EFI_VARIABLE_BOOTSERVICE_ACCESS |
+- EFI_VARIABLE_RUNTIME_ACCESS;
++ if (attr)
++ *attr = EFI_VARIABLE_NON_VOLATILE |
++ EFI_VARIABLE_BOOTSERVICE_ACCESS |
++ EFI_VARIABLE_RUNTIME_ACCESS;
+ }
+
+ spin_unlock_irqrestore(&gsmi_dev.lock, flags);
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
+index a2706086b9c7d..10cb50b90d7f3 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.h
++++ b/drivers/infiniband/ulp/srp/ib_srp.h
+@@ -63,12 +63,14 @@ enum {
+ SRP_DEFAULT_CMD_SQ_SIZE = SRP_DEFAULT_QUEUE_SIZE - SRP_RSP_SQ_SIZE -
+ SRP_TSK_MGMT_SQ_SIZE,
+
+- SRP_TAG_NO_REQ = ~0U,
+- SRP_TAG_TSK_MGMT = 1U << 31,
+-
+ SRP_MAX_PAGES_PER_MR = 512,
+ };
+
++enum {
++ SRP_TAG_NO_REQ = ~0U,
++ SRP_TAG_TSK_MGMT = BIT(31),
++};
++
+ enum srp_target_state {
+ SRP_TARGET_SCANNING,
+ SRP_TARGET_LIVE,
+diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
+index c4584184525f9..757eb175611fb 100644
+--- a/drivers/mmc/host/sunxi-mmc.c
++++ b/drivers/mmc/host/sunxi-mmc.c
+@@ -1441,9 +1441,11 @@ static int sunxi_mmc_remove(struct platform_device *pdev)
+ struct sunxi_mmc_host *host = mmc_priv(mmc);
+
+ mmc_remove_host(mmc);
+- pm_runtime_force_suspend(&pdev->dev);
+- disable_irq(host->irq);
+- sunxi_mmc_disable(host);
++ pm_runtime_disable(&pdev->dev);
++ if (!pm_runtime_status_suspended(&pdev->dev)) {
++ disable_irq(host->irq);
++ sunxi_mmc_disable(host);
++ }
+ dma_free_coherent(&pdev->dev, PAGE_SIZE, host->sg_cpu, host->sg_dma);
+ mmc_free_host(mmc);
+
+diff --git a/drivers/staging/comedi/drivers/adv_pci1760.c b/drivers/staging/comedi/drivers/adv_pci1760.c
+index f460f21efb90c..0f6faf263c82c 100644
+--- a/drivers/staging/comedi/drivers/adv_pci1760.c
++++ b/drivers/staging/comedi/drivers/adv_pci1760.c
+@@ -59,7 +59,7 @@
+ #define PCI1760_CMD_CLR_IMB2 0x00 /* Clears IMB2 */
+ #define PCI1760_CMD_SET_DO 0x01 /* Set output state */
+ #define PCI1760_CMD_GET_DO 0x02 /* Read output status */
+-#define PCI1760_CMD_GET_STATUS 0x03 /* Read current status */
++#define PCI1760_CMD_GET_STATUS 0x07 /* Read current status */
+ #define PCI1760_CMD_GET_FW_VER 0x0e /* Read firmware version */
+ #define PCI1760_CMD_GET_HW_VER 0x0f /* Read hardware version */
+ #define PCI1760_CMD_SET_PWM_HI(x) (0x10 + (x) * 2) /* Set "hi" period */
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 3ba9ed36d6362..50c4058a00e6a 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -2511,13 +2511,7 @@ static void __init atmel_console_get_options(struct uart_port *port, int *baud,
+ else if (mr == ATMEL_US_PAR_ODD)
+ *parity = 'o';
+
+- /*
+- * The serial core only rounds down when matching this to a
+- * supported baud rate. Make sure we don't end up slightly
+- * lower than one of those, as it would make us fall through
+- * to a much lower baud rate than we really want.
+- */
+- *baud = port->uartclk / (16 * (quot - 1));
++ *baud = port->uartclk / (16 * quot);
+ }
+
+ static int __init atmel_console_setup(struct console *co, char *options)
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index 447990006d688..4b035d61b280a 100644
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -792,7 +792,7 @@ static void pch_dma_tx_complete(void *arg)
+ }
+ xmit->tail &= UART_XMIT_SIZE - 1;
+ async_tx_ack(priv->desc_tx);
+- dma_unmap_sg(port->dev, sg, priv->orig_nent, DMA_TO_DEVICE);
++ dma_unmap_sg(port->dev, priv->sg_tx_p, priv->orig_nent, DMA_TO_DEVICE);
+ priv->tx_dma_use = 0;
+ priv->nent = 0;
+ priv->orig_nent = 0;
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index d1a7f22cb3a92..af9fe76745c36 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -40,6 +40,9 @@
+ #define USB_PRODUCT_USB5534B 0x5534
+ #define USB_VENDOR_CYPRESS 0x04b4
+ #define USB_PRODUCT_CY7C65632 0x6570
++#define USB_VENDOR_TEXAS_INSTRUMENTS 0x0451
++#define USB_PRODUCT_TUSB8041_USB3 0x8140
++#define USB_PRODUCT_TUSB8041_USB2 0x8142
+ #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01
+ #define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02
+
+@@ -5515,6 +5518,16 @@ static const struct usb_device_id hub_id_table[] = {
+ .idVendor = USB_VENDOR_GENESYS_LOGIC,
+ .bInterfaceClass = USB_CLASS_HUB,
+ .driver_info = HUB_QUIRK_CHECK_PORT_AUTOSUSPEND},
++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++ | USB_DEVICE_ID_MATCH_PRODUCT,
++ .idVendor = USB_VENDOR_TEXAS_INSTRUMENTS,
++ .idProduct = USB_PRODUCT_TUSB8041_USB2,
++ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
++ { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++ | USB_DEVICE_ID_MATCH_PRODUCT,
++ .idVendor = USB_VENDOR_TEXAS_INSTRUMENTS,
++ .idProduct = USB_PRODUCT_TUSB8041_USB3,
++ .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
+ { .match_flags = USB_DEVICE_ID_MATCH_DEV_CLASS,
+ .bDeviceClass = USB_CLASS_HUB},
+ { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index 10b4612df8a77..d01fd211566e8 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -86,7 +86,9 @@ static inline struct f_ncm *func_to_ncm(struct usb_function *f)
+ /* peak (theoretical) bulk transfer rate in bits-per-second */
+ static inline unsigned ncm_bitrate(struct usb_gadget *g)
+ {
+- if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
++ if (!g)
++ return 0;
++ else if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
+ return 4250000000U;
+ else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
+ return 3750000000U;
+diff --git a/drivers/usb/gadget/legacy/webcam.c b/drivers/usb/gadget/legacy/webcam.c
+index a9f8eb8e1c767..0d44d3103d146 100644
+--- a/drivers/usb/gadget/legacy/webcam.c
++++ b/drivers/usb/gadget/legacy/webcam.c
+@@ -292,6 +292,7 @@ static const struct uvc_descriptor_header * const uvc_fs_streaming_cls[] = {
+ (const struct uvc_descriptor_header *) &uvc_format_yuv,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p,
++ (const struct uvc_descriptor_header *) &uvc_color_matching,
+ (const struct uvc_descriptor_header *) &uvc_format_mjpg,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
+@@ -304,6 +305,7 @@ static const struct uvc_descriptor_header * const uvc_hs_streaming_cls[] = {
+ (const struct uvc_descriptor_header *) &uvc_format_yuv,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p,
++ (const struct uvc_descriptor_header *) &uvc_color_matching,
+ (const struct uvc_descriptor_header *) &uvc_format_mjpg,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
+@@ -316,6 +318,7 @@ static const struct uvc_descriptor_header * const uvc_ss_streaming_cls[] = {
+ (const struct uvc_descriptor_header *) &uvc_format_yuv,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p,
++ (const struct uvc_descriptor_header *) &uvc_color_matching,
+ (const struct uvc_descriptor_header *) &uvc_format_mjpg,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
+diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
+index 0a9fd2022acfa..768f8a93f19e3 100644
+--- a/drivers/usb/host/ehci-fsl.c
++++ b/drivers/usb/host/ehci-fsl.c
+@@ -28,7 +28,7 @@
+ #include "ehci-fsl.h"
+
+ #define DRIVER_DESC "Freescale EHCI Host controller driver"
+-#define DRV_NAME "ehci-fsl"
++#define DRV_NAME "fsl-ehci"
+
+ static struct hc_driver __read_mostly fsl_ehci_hc_driver;
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 7f640603b1033..55bd970290177 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -378,6 +378,8 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ /* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */
+ pm_runtime_put_noidle(&dev->dev);
+
++ dma_set_max_seg_size(&dev->dev, UINT_MAX);
++
+ return 0;
+
+ put_usb3_hcd:
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index e18b675fb7afe..aa4c5b43fb784 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -896,7 +896,10 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci,
+ struct xhci_virt_ep *ep;
+ struct xhci_ring *ring;
+
+- ep = &xhci->devs[slot_id]->eps[ep_index];
++ ep = xhci_get_virt_ep(xhci, slot_id, ep_index);
++ if (!ep)
++ return;
++
+ if ((ep->ep_state & EP_HAS_STREAMS) ||
+ (ep->ep_state & EP_GETTING_NO_STREAMS)) {
+ int stream_id;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 3a1ed63d73349..13c10ebde296e 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3830,6 +3830,7 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct xhci_virt_device *virt_dev;
+ struct xhci_slot_ctx *slot_ctx;
++ unsigned long flags;
+ int i, ret;
+
+ /*
+@@ -3859,7 +3860,11 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ xhci_debugfs_remove_slot(xhci, udev->slot_id);
+ virt_dev->udev = NULL;
+ xhci_disable_slot(xhci, udev->slot_id);
++
++ spin_lock_irqsave(&xhci->lock, flags);
+ xhci_free_virt_device(xhci, udev->slot_id);
++ spin_unlock_irqrestore(&xhci->lock, flags);
++
+ }
+
+ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
+@@ -4912,6 +4917,7 @@ static int xhci_enable_usb3_lpm_timeout(struct usb_hcd *hcd,
+ struct usb_device *udev, enum usb3_link_state state)
+ {
+ struct xhci_hcd *xhci;
++ struct xhci_port *port;
+ u16 hub_encoded_timeout;
+ int mel;
+ int ret;
+@@ -4925,6 +4931,13 @@ static int xhci_enable_usb3_lpm_timeout(struct usb_hcd *hcd,
+ !xhci->devs[udev->slot_id])
+ return USB3_LPM_DISABLED;
+
++ /* If connected to root port then check port can handle lpm */
++ if (udev->parent && !udev->parent->parent) {
++ port = xhci->usb3_rhub.ports[udev->portnum - 1];
++ if (port->lpm_incapable)
++ return USB3_LPM_DISABLED;
++ }
++
+ hub_encoded_timeout = xhci_calculate_lpm_timeout(hcd, udev, state);
+ mel = calculate_max_exit_latency(udev, state, hub_encoded_timeout);
+ if (mel < 0) {
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 029ffcb13d62e..f2bf3431cd6f4 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1723,6 +1723,7 @@ struct xhci_port {
+ int hcd_portnum;
+ struct xhci_hub *rhub;
+ struct xhci_port_cap *port_cap;
++ unsigned int lpm_incapable:1;
+ };
+
+ struct xhci_hub {
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index 07d6bc63be969..8b04d27059203 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -832,7 +832,7 @@ static int iowarrior_probe(struct usb_interface *interface,
+ break;
+
+ case USB_DEVICE_ID_CODEMERCS_IOW100:
+- dev->report_size = 13;
++ dev->report_size = 12;
+ break;
+ }
+ }
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index f1acc6f686a96..7932a65324d2f 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -61,6 +61,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
+ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
++ { USB_DEVICE(0x0908, 0x0070) }, /* Siemens SCALANCE LPE-9000 USB Serial Console */
+ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
+ { USB_DEVICE(0x0988, 0x0578) }, /* Teraoka AD2000 */
+ { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 57bef990382b1..48b66656dca8e 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -255,10 +255,16 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_EP06 0x0306
+ #define QUECTEL_PRODUCT_EM05G 0x030a
+ #define QUECTEL_PRODUCT_EM060K 0x030b
++#define QUECTEL_PRODUCT_EM05G_CS 0x030c
++#define QUECTEL_PRODUCT_EM05CN_SG 0x0310
+ #define QUECTEL_PRODUCT_EM05G_SG 0x0311
++#define QUECTEL_PRODUCT_EM05CN 0x0312
++#define QUECTEL_PRODUCT_EM05G_GR 0x0313
++#define QUECTEL_PRODUCT_EM05G_RS 0x0314
+ #define QUECTEL_PRODUCT_EM12 0x0512
+ #define QUECTEL_PRODUCT_RM500Q 0x0800
+ #define QUECTEL_PRODUCT_RM520N 0x0801
++#define QUECTEL_PRODUCT_EC200U 0x0901
+ #define QUECTEL_PRODUCT_EC200S_CN 0x6002
+ #define QUECTEL_PRODUCT_EC200T 0x6026
+ #define QUECTEL_PRODUCT_RM500K 0x7001
+@@ -1159,8 +1165,18 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05CN, 0xff),
++ .driver_info = RSVD(6) | ZLP },
++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05CN_SG, 0xff),
++ .driver_info = RSVD(6) | ZLP },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff),
+ .driver_info = RSVD(6) | ZLP },
++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff),
++ .driver_info = RSVD(6) | ZLP },
++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff),
++ .driver_info = RSVD(6) | ZLP },
++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_RS, 0xff),
++ .driver_info = RSVD(6) | ZLP },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_SG, 0xff),
+ .driver_info = RSVD(6) | ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
+@@ -1180,6 +1196,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) },
+diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h
+index 3734a25e09e53..44f0b78be8a96 100644
+--- a/drivers/usb/storage/uas-detect.h
++++ b/drivers/usb/storage/uas-detect.h
+@@ -116,6 +116,19 @@ static int uas_use_uas_driver(struct usb_interface *intf,
+ if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bc2)
+ flags |= US_FL_NO_ATA_1X;
+
++ /*
++ * RTL9210-based enclosure from HIKSEMI, MD202 reportedly have issues
++ * with UAS. This isn't distinguishable with just idVendor and
++ * idProduct, use manufacturer and product too.
++ *
++ * Reported-by: Hongling Zeng <zenghongling@kylinos.cn>
++ */
++ if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bda &&
++ le16_to_cpu(udev->descriptor.idProduct) == 0x9210 &&
++ (udev->manufacturer && !strcmp(udev->manufacturer, "HIKSEMI")) &&
++ (udev->product && !strcmp(udev->product, "MD202")))
++ flags |= US_FL_IGNORE_UAS;
++
+ usb_stor_adjust_quirks(udev, &flags);
+
+ if (flags & US_FL_IGNORE_UAS) {
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 92e9bd006622d..d4fa29b623ff9 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -83,13 +83,6 @@ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_REPORT_LUNS),
+
+-/* Reported-by: Hongling Zeng <zenghongling@kylinos.cn> */
+-UNUSUAL_DEV(0x0bda, 0x9210, 0x0000, 0x9999,
+- "Hiksemi",
+- "External HDD",
+- USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+- US_FL_IGNORE_UAS),
+-
+ /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+ UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
+ "Initio Corporation",
+diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
+index 52cdc06e1deac..2ae3fab36a80e 100644
+--- a/drivers/usb/typec/altmodes/displayport.c
++++ b/drivers/usb/typec/altmodes/displayport.c
+@@ -411,6 +411,18 @@ static const char * const pin_assignments[] = {
+ [DP_PIN_ASSIGN_F] = "F",
+ };
+
++/*
++ * Helper function to extract a peripheral's currently supported
++ * Pin Assignments from its DisplayPort alternate mode state.
++ */
++static u8 get_current_pin_assignments(struct dp_altmode *dp)
++{
++ if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D)
++ return DP_CAP_PIN_ASSIGN_DFP_D(dp->alt->vdo);
++ else
++ return DP_CAP_PIN_ASSIGN_UFP_D(dp->alt->vdo);
++}
++
+ static ssize_t
+ pin_assignment_store(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t size)
+@@ -437,10 +449,7 @@ pin_assignment_store(struct device *dev, struct device_attribute *attr,
+ goto out_unlock;
+ }
+
+- if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D)
+- assignments = DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo);
+- else
+- assignments = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo);
++ assignments = get_current_pin_assignments(dp);
+
+ if (!(DP_CONF_GET_PIN_ASSIGN(conf) & assignments)) {
+ ret = -EINVAL;
+@@ -477,10 +486,7 @@ static ssize_t pin_assignment_show(struct device *dev,
+
+ cur = get_count_order(DP_CONF_GET_PIN_ASSIGN(dp->data.conf));
+
+- if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D)
+- assignments = DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo);
+- else
+- assignments = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo);
++ assignments = get_current_pin_assignments(dp);
+
+ for (i = 0; assignments; assignments >>= 1, i++) {
+ if (assignments & 1) {
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 3485b9bf970f5..50c6405befc4b 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3152,12 +3152,15 @@ smb2_readv_callback(struct mid_q_entry *mid)
+ (struct smb2_sync_hdr *)rdata->iov[0].iov_base;
+ unsigned int credits_received = 0;
+ struct smb_rqst rqst = { .rq_iov = &rdata->iov[1],
+- .rq_nvec = 1,
+- .rq_pages = rdata->pages,
+- .rq_offset = rdata->page_offset,
+- .rq_npages = rdata->nr_pages,
+- .rq_pagesz = rdata->pagesz,
+- .rq_tailsz = rdata->tailsz };
++ .rq_nvec = 1, };
++
++ if (rdata->got_bytes) {
++ rqst.rq_pages = rdata->pages;
++ rqst.rq_offset = rdata->page_offset;
++ rqst.rq_npages = rdata->nr_pages;
++ rqst.rq_pagesz = rdata->pagesz;
++ rqst.rq_tailsz = rdata->tailsz;
++ }
+
+ cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n",
+ __func__, mid->mid, mid->mid_state, rdata->result,
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index d8068c0e547dc..e58b162ad5d6b 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1041,9 +1041,6 @@ struct ext4_inode_info {
+ ext4_lblk_t i_da_metadata_calc_last_lblock;
+ int i_da_metadata_calc_len;
+
+- /* pending cluster reservations for bigalloc file systems */
+- struct ext4_pending_tree i_pending_tree;
+-
+ /* on-disk additional length */
+ __u16 i_extra_isize;
+
+@@ -3231,6 +3228,10 @@ extern struct ext4_ext_path *ext4_find_extent(struct inode *, ext4_lblk_t,
+ int flags);
+ extern void ext4_ext_drop_refs(struct ext4_ext_path *);
+ extern int ext4_ext_check_inode(struct inode *inode);
++extern int ext4_find_delalloc_range(struct inode *inode,
++ ext4_lblk_t lblk_start,
++ ext4_lblk_t lblk_end);
++extern int ext4_find_delalloc_cluster(struct inode *inode, ext4_lblk_t lblk);
+ extern ext4_lblk_t ext4_ext_next_allocated_block(struct ext4_ext_path *path);
+ extern int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+ __u64 start, __u64 len);
+@@ -3241,7 +3242,6 @@ extern int ext4_swap_extents(handle_t *handle, struct inode *inode1,
+ struct inode *inode2, ext4_lblk_t lblk1,
+ ext4_lblk_t lblk2, ext4_lblk_t count,
+ int mark_unwritten,int *err);
+-extern int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu);
+
+ /* move_extent.c */
+ extern void ext4_double_down_write_data_sem(struct inode *first,
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 1ad4c8eb82c19..6c492fca60c41 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2381,8 +2381,8 @@ ext4_ext_put_gap_in_cache(struct inode *inode, ext4_lblk_t hole_start,
+ {
+ struct extent_status es;
+
+- ext4_es_find_extent_range(inode, &ext4_es_is_delayed, hole_start,
+- hole_start + hole_len - 1, &es);
++ ext4_es_find_delayed_extent_range(inode, hole_start,
++ hole_start + hole_len - 1, &es);
+ if (es.es_len) {
+ /* There's delayed extent containing lblock? */
+ if (es.es_lblk <= hole_start)
+@@ -3852,6 +3852,39 @@ out:
+ return ext4_mark_inode_dirty(handle, inode);
+ }
+
++/**
++ * ext4_find_delalloc_range: find delayed allocated block in the given range.
++ *
++ * Return 1 if there is a delalloc block in the range, otherwise 0.
++ */
++int ext4_find_delalloc_range(struct inode *inode,
++ ext4_lblk_t lblk_start,
++ ext4_lblk_t lblk_end)
++{
++ struct extent_status es;
++
++ ext4_es_find_delayed_extent_range(inode, lblk_start, lblk_end, &es);
++ if (es.es_len == 0)
++ return 0; /* there is no delay extent in this tree */
++ else if (es.es_lblk <= lblk_start &&
++ lblk_start < es.es_lblk + es.es_len)
++ return 1;
++ else if (lblk_start <= es.es_lblk && es.es_lblk <= lblk_end)
++ return 1;
++ else
++ return 0;
++}
++
++int ext4_find_delalloc_cluster(struct inode *inode, ext4_lblk_t lblk)
++{
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ ext4_lblk_t lblk_start, lblk_end;
++ lblk_start = EXT4_LBLK_CMASK(sbi, lblk);
++ lblk_end = lblk_start + sbi->s_cluster_ratio - 1;
++
++ return ext4_find_delalloc_range(inode, lblk_start, lblk_end);
++}
++
+ /**
+ * Determines how many complete clusters (out of those specified by the 'map')
+ * are under delalloc and were reserved quota for.
+@@ -3910,8 +3943,7 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
+ lblk_from = EXT4_LBLK_CMASK(sbi, lblk_start);
+ lblk_to = lblk_from + c_offset - 1;
+
+- if (ext4_es_scan_range(inode, &ext4_es_is_delayed, lblk_from,
+- lblk_to))
++ if (ext4_find_delalloc_range(inode, lblk_from, lblk_to))
+ allocated_clusters--;
+ }
+
+@@ -3921,8 +3953,7 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
+ lblk_from = lblk_start + num_blks;
+ lblk_to = lblk_from + (sbi->s_cluster_ratio - c_offset) - 1;
+
+- if (ext4_es_scan_range(inode, &ext4_es_is_delayed, lblk_from,
+- lblk_to))
++ if (ext4_find_delalloc_range(inode, lblk_from, lblk_to))
+ allocated_clusters--;
+ }
+
+@@ -5077,10 +5108,8 @@ static int ext4_find_delayed_extent(struct inode *inode,
+ ext4_lblk_t block, next_del;
+
+ if (newes->es_pblk == 0) {
+- ext4_es_find_extent_range(inode, &ext4_es_is_delayed,
+- newes->es_lblk,
+- newes->es_lblk + newes->es_len - 1,
+- &es);
++ ext4_es_find_delayed_extent_range(inode, newes->es_lblk,
++ newes->es_lblk + newes->es_len - 1, &es);
+
+ /*
+ * No extent in extent-tree contains block @newes->es_pblk,
+@@ -5101,8 +5130,7 @@ static int ext4_find_delayed_extent(struct inode *inode,
+ }
+
+ block = newes->es_lblk + newes->es_len;
+- ext4_es_find_extent_range(inode, &ext4_es_is_delayed, block,
+- EXT_MAX_BLOCKS, &es);
++ ext4_es_find_delayed_extent_range(inode, block, EXT_MAX_BLOCKS, &es);
+ if (es.es_len == 0)
+ next_del = EXT_MAX_BLOCKS;
+ else
+@@ -5963,90 +5991,3 @@ ext4_swap_extents(handle_t *handle, struct inode *inode1,
+ }
+ return replaced_count;
+ }
+-
+-/*
+- * ext4_clu_mapped - determine whether any block in a logical cluster has
+- * been mapped to a physical cluster
+- *
+- * @inode - file containing the logical cluster
+- * @lclu - logical cluster of interest
+- *
+- * Returns 1 if any block in the logical cluster is mapped, signifying
+- * that a physical cluster has been allocated for it. Otherwise,
+- * returns 0. Can also return negative error codes. Derived from
+- * ext4_ext_map_blocks().
+- */
+-int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu)
+-{
+- struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+- struct ext4_ext_path *path;
+- int depth, mapped = 0, err = 0;
+- struct ext4_extent *extent;
+- ext4_lblk_t first_lblk, first_lclu, last_lclu;
+-
+- /*
+- * if data can be stored inline, the logical cluster isn't
+- * mapped - no physical clusters have been allocated, and the
+- * file has no extents
+- */
+- if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))
+- return 0;
+-
+- /* search for the extent closest to the first block in the cluster */
+- path = ext4_find_extent(inode, EXT4_C2B(sbi, lclu), NULL, 0);
+- if (IS_ERR(path)) {
+- err = PTR_ERR(path);
+- path = NULL;
+- goto out;
+- }
+-
+- depth = ext_depth(inode);
+-
+- /*
+- * A consistent leaf must not be empty. This situation is possible,
+- * though, _during_ tree modification, and it's why an assert can't
+- * be put in ext4_find_extent().
+- */
+- if (unlikely(path[depth].p_ext == NULL && depth != 0)) {
+- EXT4_ERROR_INODE(inode,
+- "bad extent address - lblock: %lu, depth: %d, pblock: %lld",
+- (unsigned long) EXT4_C2B(sbi, lclu),
+- depth, path[depth].p_block);
+- err = -EFSCORRUPTED;
+- goto out;
+- }
+-
+- extent = path[depth].p_ext;
+-
+- /* can't be mapped if the extent tree is empty */
+- if (extent == NULL)
+- goto out;
+-
+- first_lblk = le32_to_cpu(extent->ee_block);
+- first_lclu = EXT4_B2C(sbi, first_lblk);
+-
+- /*
+- * Three possible outcomes at this point - found extent spanning
+- * the target cluster, to the left of the target cluster, or to the
+- * right of the target cluster. The first two cases are handled here.
+- * The last case indicates the target cluster is not mapped.
+- */
+- if (lclu >= first_lclu) {
+- last_lclu = EXT4_B2C(sbi, first_lblk +
+- ext4_ext_get_actual_len(extent) - 1);
+- if (lclu <= last_lclu) {
+- mapped = 1;
+- } else {
+- first_lblk = ext4_ext_next_allocated_block(path);
+- first_lclu = EXT4_B2C(sbi, first_lblk);
+- if (lclu == first_lclu)
+- mapped = 1;
+- }
+- }
+-
+-out:
+- ext4_ext_drop_refs(path);
+- kfree(path);
+-
+- return err ? err : mapped;
+-}
+diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
+index 441ee2e747d3e..027c3e1b9f61a 100644
+--- a/fs/ext4/extents_status.c
++++ b/fs/ext4/extents_status.c
+@@ -142,7 +142,6 @@
+ */
+
+ static struct kmem_cache *ext4_es_cachep;
+-static struct kmem_cache *ext4_pending_cachep;
+
+ static int __es_insert_extent(struct inode *inode, struct extent_status *newes);
+ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+@@ -234,38 +233,30 @@ static struct extent_status *__es_tree_search(struct rb_root *root,
+ }
+
+ /*
+- * ext4_es_find_extent_range - find extent with specified status within block
+- * range or next extent following block range in
+- * extents status tree
++ * ext4_es_find_delayed_extent_range: find the 1st delayed extent covering
++ * @es->lblk if it exists, otherwise, the next extent after @es->lblk.
+ *
+- * @inode - file containing the range
+- * @matching_fn - pointer to function that matches extents with desired status
+- * @lblk - logical block defining start of range
+- * @end - logical block defining end of range
+- * @es - extent found, if any
+- *
+- * Find the first extent within the block range specified by @lblk and @end
+- * in the extents status tree that satisfies @matching_fn. If a match
+- * is found, it's returned in @es. If not, and a matching extent is found
+- * beyond the block range, it's returned in @es. If no match is found, an
+- * extent is returned in @es whose es_lblk, es_len, and es_pblk components
+- * are 0.
++ * @inode: the inode which owns delayed extents
++ * @lblk: the offset where we start to search
++ * @end: the offset where we stop to search
++ * @es: delayed extent that we found
+ */
+-static void __es_find_extent_range(struct inode *inode,
+- int (*matching_fn)(struct extent_status *es),
+- ext4_lblk_t lblk, ext4_lblk_t end,
+- struct extent_status *es)
++void ext4_es_find_delayed_extent_range(struct inode *inode,
++ ext4_lblk_t lblk, ext4_lblk_t end,
++ struct extent_status *es)
+ {
+ struct ext4_es_tree *tree = NULL;
+ struct extent_status *es1 = NULL;
+ struct rb_node *node;
+
+- WARN_ON(es == NULL);
+- WARN_ON(end < lblk);
++ BUG_ON(es == NULL);
++ BUG_ON(end < lblk);
++ trace_ext4_es_find_delayed_extent_range_enter(inode, lblk);
+
++ read_lock(&EXT4_I(inode)->i_es_lock);
+ tree = &EXT4_I(inode)->i_es_tree;
+
+- /* see if the extent has been cached */
++ /* find extent in cache firstly */
+ es->es_lblk = es->es_len = es->es_pblk = 0;
+ if (tree->cache_es) {
+ es1 = tree->cache_es;
+@@ -280,133 +271,28 @@ static void __es_find_extent_range(struct inode *inode,
+ es1 = __es_tree_search(&tree->root, lblk);
+
+ out:
+- if (es1 && !matching_fn(es1)) {
++ if (es1 && !ext4_es_is_delayed(es1)) {
+ while ((node = rb_next(&es1->rb_node)) != NULL) {
+ es1 = rb_entry(node, struct extent_status, rb_node);
+ if (es1->es_lblk > end) {
+ es1 = NULL;
+ break;
+ }
+- if (matching_fn(es1))
++ if (ext4_es_is_delayed(es1))
+ break;
+ }
+ }
+
+- if (es1 && matching_fn(es1)) {
++ if (es1 && ext4_es_is_delayed(es1)) {
+ tree->cache_es = es1;
+ es->es_lblk = es1->es_lblk;
+ es->es_len = es1->es_len;
+ es->es_pblk = es1->es_pblk;
+ }
+
+-}
+-
+-/*
+- * Locking for __es_find_extent_range() for external use
+- */
+-void ext4_es_find_extent_range(struct inode *inode,
+- int (*matching_fn)(struct extent_status *es),
+- ext4_lblk_t lblk, ext4_lblk_t end,
+- struct extent_status *es)
+-{
+- trace_ext4_es_find_extent_range_enter(inode, lblk);
+-
+- read_lock(&EXT4_I(inode)->i_es_lock);
+- __es_find_extent_range(inode, matching_fn, lblk, end, es);
+- read_unlock(&EXT4_I(inode)->i_es_lock);
+-
+- trace_ext4_es_find_extent_range_exit(inode, es);
+-}
+-
+-/*
+- * __es_scan_range - search block range for block with specified status
+- * in extents status tree
+- *
+- * @inode - file containing the range
+- * @matching_fn - pointer to function that matches extents with desired status
+- * @lblk - logical block defining start of range
+- * @end - logical block defining end of range
+- *
+- * Returns true if at least one block in the specified block range satisfies
+- * the criterion specified by @matching_fn, and false if not. If at least
+- * one extent has the specified status, then there is at least one block
+- * in the cluster with that status. Should only be called by code that has
+- * taken i_es_lock.
+- */
+-static bool __es_scan_range(struct inode *inode,
+- int (*matching_fn)(struct extent_status *es),
+- ext4_lblk_t start, ext4_lblk_t end)
+-{
+- struct extent_status es;
+-
+- __es_find_extent_range(inode, matching_fn, start, end, &es);
+- if (es.es_len == 0)
+- return false; /* no matching extent in the tree */
+- else if (es.es_lblk <= start &&
+- start < es.es_lblk + es.es_len)
+- return true;
+- else if (start <= es.es_lblk && es.es_lblk <= end)
+- return true;
+- else
+- return false;
+-}
+-/*
+- * Locking for __es_scan_range() for external use
+- */
+-bool ext4_es_scan_range(struct inode *inode,
+- int (*matching_fn)(struct extent_status *es),
+- ext4_lblk_t lblk, ext4_lblk_t end)
+-{
+- bool ret;
+-
+- read_lock(&EXT4_I(inode)->i_es_lock);
+- ret = __es_scan_range(inode, matching_fn, lblk, end);
+- read_unlock(&EXT4_I(inode)->i_es_lock);
+-
+- return ret;
+-}
+-
+-/*
+- * __es_scan_clu - search cluster for block with specified status in
+- * extents status tree
+- *
+- * @inode - file containing the cluster
+- * @matching_fn - pointer to function that matches extents with desired status
+- * @lblk - logical block in cluster to be searched
+- *
+- * Returns true if at least one extent in the cluster containing @lblk
+- * satisfies the criterion specified by @matching_fn, and false if not. If at
+- * least one extent has the specified status, then there is at least one block
+- * in the cluster with that status. Should only be called by code that has
+- * taken i_es_lock.
+- */
+-static bool __es_scan_clu(struct inode *inode,
+- int (*matching_fn)(struct extent_status *es),
+- ext4_lblk_t lblk)
+-{
+- struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+- ext4_lblk_t lblk_start, lblk_end;
+-
+- lblk_start = EXT4_LBLK_CMASK(sbi, lblk);
+- lblk_end = lblk_start + sbi->s_cluster_ratio - 1;
+-
+- return __es_scan_range(inode, matching_fn, lblk_start, lblk_end);
+-}
+-
+-/*
+- * Locking for __es_scan_clu() for external use
+- */
+-bool ext4_es_scan_clu(struct inode *inode,
+- int (*matching_fn)(struct extent_status *es),
+- ext4_lblk_t lblk)
+-{
+- bool ret;
+-
+- read_lock(&EXT4_I(inode)->i_es_lock);
+- ret = __es_scan_clu(inode, matching_fn, lblk);
+ read_unlock(&EXT4_I(inode)->i_es_lock);
+
+- return ret;
++ trace_ext4_es_find_delayed_extent_range_exit(inode, es);
+ }
+
+ static void ext4_es_list_add(struct inode *inode)
+@@ -1364,242 +1250,3 @@ static int es_reclaim_extents(struct ext4_inode_info *ei, int *nr_to_scan)
+ ei->i_es_tree.cache_es = NULL;
+ return nr_shrunk;
+ }
+-
+-#ifdef ES_DEBUG__
+-static void ext4_print_pending_tree(struct inode *inode)
+-{
+- struct ext4_pending_tree *tree;
+- struct rb_node *node;
+- struct pending_reservation *pr;
+-
+- printk(KERN_DEBUG "pending reservations for inode %lu:", inode->i_ino);
+- tree = &EXT4_I(inode)->i_pending_tree;
+- node = rb_first(&tree->root);
+- while (node) {
+- pr = rb_entry(node, struct pending_reservation, rb_node);
+- printk(KERN_DEBUG " %u", pr->lclu);
+- node = rb_next(node);
+- }
+- printk(KERN_DEBUG "\n");
+-}
+-#else
+-#define ext4_print_pending_tree(inode)
+-#endif
+-
+-int __init ext4_init_pending(void)
+-{
+- ext4_pending_cachep = kmem_cache_create("ext4_pending_reservation",
+- sizeof(struct pending_reservation),
+- 0, (SLAB_RECLAIM_ACCOUNT), NULL);
+- if (ext4_pending_cachep == NULL)
+- return -ENOMEM;
+- return 0;
+-}
+-
+-void ext4_exit_pending(void)
+-{
+- kmem_cache_destroy(ext4_pending_cachep);
+-}
+-
+-void ext4_init_pending_tree(struct ext4_pending_tree *tree)
+-{
+- tree->root = RB_ROOT;
+-}
+-
+-/*
+- * __get_pending - retrieve a pointer to a pending reservation
+- *
+- * @inode - file containing the pending cluster reservation
+- * @lclu - logical cluster of interest
+- *
+- * Returns a pointer to a pending reservation if it's a member of
+- * the set, and NULL if not. Must be called holding i_es_lock.
+- */
+-static struct pending_reservation *__get_pending(struct inode *inode,
+- ext4_lblk_t lclu)
+-{
+- struct ext4_pending_tree *tree;
+- struct rb_node *node;
+- struct pending_reservation *pr = NULL;
+-
+- tree = &EXT4_I(inode)->i_pending_tree;
+- node = (&tree->root)->rb_node;
+-
+- while (node) {
+- pr = rb_entry(node, struct pending_reservation, rb_node);
+- if (lclu < pr->lclu)
+- node = node->rb_left;
+- else if (lclu > pr->lclu)
+- node = node->rb_right;
+- else if (lclu == pr->lclu)
+- return pr;
+- }
+- return NULL;
+-}
+-
+-/*
+- * __insert_pending - adds a pending cluster reservation to the set of
+- * pending reservations
+- *
+- * @inode - file containing the cluster
+- * @lblk - logical block in the cluster to be added
+- *
+- * Returns 0 on successful insertion and -ENOMEM on failure. If the
+- * pending reservation is already in the set, returns successfully.
+- */
+-static int __insert_pending(struct inode *inode, ext4_lblk_t lblk)
+-{
+- struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+- struct ext4_pending_tree *tree = &EXT4_I(inode)->i_pending_tree;
+- struct rb_node **p = &tree->root.rb_node;
+- struct rb_node *parent = NULL;
+- struct pending_reservation *pr;
+- ext4_lblk_t lclu;
+- int ret = 0;
+-
+- lclu = EXT4_B2C(sbi, lblk);
+- /* search to find parent for insertion */
+- while (*p) {
+- parent = *p;
+- pr = rb_entry(parent, struct pending_reservation, rb_node);
+-
+- if (lclu < pr->lclu) {
+- p = &(*p)->rb_left;
+- } else if (lclu > pr->lclu) {
+- p = &(*p)->rb_right;
+- } else {
+- /* pending reservation already inserted */
+- goto out;
+- }
+- }
+-
+- pr = kmem_cache_alloc(ext4_pending_cachep, GFP_ATOMIC);
+- if (pr == NULL) {
+- ret = -ENOMEM;
+- goto out;
+- }
+- pr->lclu = lclu;
+-
+- rb_link_node(&pr->rb_node, parent, p);
+- rb_insert_color(&pr->rb_node, &tree->root);
+-
+-out:
+- return ret;
+-}
+-
+-/*
+- * __remove_pending - removes a pending cluster reservation from the set
+- * of pending reservations
+- *
+- * @inode - file containing the cluster
+- * @lblk - logical block in the pending cluster reservation to be removed
+- *
+- * Returns successfully if pending reservation is not a member of the set.
+- */
+-static void __remove_pending(struct inode *inode, ext4_lblk_t lblk)
+-{
+- struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+- struct pending_reservation *pr;
+- struct ext4_pending_tree *tree;
+-
+- pr = __get_pending(inode, EXT4_B2C(sbi, lblk));
+- if (pr != NULL) {
+- tree = &EXT4_I(inode)->i_pending_tree;
+- rb_erase(&pr->rb_node, &tree->root);
+- kmem_cache_free(ext4_pending_cachep, pr);
+- }
+-}
+-
+-/*
+- * ext4_remove_pending - removes a pending cluster reservation from the set
+- * of pending reservations
+- *
+- * @inode - file containing the cluster
+- * @lblk - logical block in the pending cluster reservation to be removed
+- *
+- * Locking for external use of __remove_pending.
+- */
+-void ext4_remove_pending(struct inode *inode, ext4_lblk_t lblk)
+-{
+- struct ext4_inode_info *ei = EXT4_I(inode);
+-
+- write_lock(&ei->i_es_lock);
+- __remove_pending(inode, lblk);
+- write_unlock(&ei->i_es_lock);
+-}
+-
+-/*
+- * ext4_is_pending - determine whether a cluster has a pending reservation
+- * on it
+- *
+- * @inode - file containing the cluster
+- * @lblk - logical block in the cluster
+- *
+- * Returns true if there's a pending reservation for the cluster in the
+- * set of pending reservations, and false if not.
+- */
+-bool ext4_is_pending(struct inode *inode, ext4_lblk_t lblk)
+-{
+- struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+- struct ext4_inode_info *ei = EXT4_I(inode);
+- bool ret;
+-
+- read_lock(&ei->i_es_lock);
+- ret = (bool)(__get_pending(inode, EXT4_B2C(sbi, lblk)) != NULL);
+- read_unlock(&ei->i_es_lock);
+-
+- return ret;
+-}
+-
+-/*
+- * ext4_es_insert_delayed_block - adds a delayed block to the extents status
+- * tree, adding a pending reservation where
+- * needed
+- *
+- * @inode - file containing the newly added block
+- * @lblk - logical block to be added
+- * @allocated - indicates whether a physical cluster has been allocated for
+- * the logical cluster that contains the block
+- *
+- * Returns 0 on success, negative error code on failure.
+- */
+-int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
+- bool allocated)
+-{
+- struct extent_status newes;
+- int err = 0;
+-
+- es_debug("add [%u/1) delayed to extent status tree of inode %lu\n",
+- lblk, inode->i_ino);
+-
+- newes.es_lblk = lblk;
+- newes.es_len = 1;
+- ext4_es_store_pblock_status(&newes, ~0, EXTENT_STATUS_DELAYED);
+- trace_ext4_es_insert_delayed_block(inode, &newes, allocated);
+-
+- ext4_es_insert_extent_check(inode, &newes);
+-
+- write_lock(&EXT4_I(inode)->i_es_lock);
+-
+- err = __es_remove_extent(inode, lblk, lblk);
+- if (err != 0)
+- goto error;
+-retry:
+- err = __es_insert_extent(inode, &newes);
+- if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
+- 128, EXT4_I(inode)))
+- goto retry;
+- if (err != 0)
+- goto error;
+-
+- if (allocated)
+- __insert_pending(inode, lblk);
+-
+-error:
+- write_unlock(&EXT4_I(inode)->i_es_lock);
+-
+- ext4_es_print_tree(inode);
+- ext4_print_pending_tree(inode);
+-
+- return err;
+-}
+diff --git a/fs/ext4/extents_status.h b/fs/ext4/extents_status.h
+index 9d3c676ec623a..8efdeb903d6ba 100644
+--- a/fs/ext4/extents_status.h
++++ b/fs/ext4/extents_status.h
+@@ -78,51 +78,6 @@ struct ext4_es_stats {
+ struct percpu_counter es_stats_shk_cnt;
+ };
+
+-/*
+- * Pending cluster reservations for bigalloc file systems
+- *
+- * A cluster with a pending reservation is a logical cluster shared by at
+- * least one extent in the extents status tree with delayed and unwritten
+- * status and at least one other written or unwritten extent. The
+- * reservation is said to be pending because a cluster reservation would
+- * have to be taken in the event all blocks in the cluster shared with
+- * written or unwritten extents were deleted while the delayed and
+- * unwritten blocks remained.
+- *
+- * The set of pending cluster reservations is an auxiliary data structure
+- * used with the extents status tree to implement reserved cluster/block
+- * accounting for bigalloc file systems. The set is kept in memory and
+- * records all pending cluster reservations.
+- *
+- * Its primary function is to avoid the need to read extents from the
+- * disk when invalidating pages as a result of a truncate, punch hole, or
+- * collapse range operation. Page invalidation requires a decrease in the
+- * reserved cluster count if it results in the removal of all delayed
+- * and unwritten extents (blocks) from a cluster that is not shared with a
+- * written or unwritten extent, and no decrease otherwise. Determining
+- * whether the cluster is shared can be done by searching for a pending
+- * reservation on it.
+- *
+- * Secondarily, it provides a potentially faster method for determining
+- * whether the reserved cluster count should be increased when a physical
+- * cluster is deallocated as a result of a truncate, punch hole, or
+- * collapse range operation. The necessary information is also present
+- * in the extents status tree, but might be more rapidly accessed in
+- * the pending reservation set in many cases due to smaller size.
+- *
+- * The pending cluster reservation set is implemented as a red-black tree
+- * with the goal of minimizing per page search time overhead.
+- */
+-
+-struct pending_reservation {
+- struct rb_node rb_node;
+- ext4_lblk_t lclu;
+-};
+-
+-struct ext4_pending_tree {
+- struct rb_root root;
+-};
+-
+ extern int __init ext4_init_es(void);
+ extern void ext4_exit_es(void);
+ extern void ext4_es_init_tree(struct ext4_es_tree *tree);
+@@ -135,18 +90,11 @@ extern void ext4_es_cache_extent(struct inode *inode, ext4_lblk_t lblk,
+ unsigned int status);
+ extern int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
+ ext4_lblk_t len);
+-extern void ext4_es_find_extent_range(struct inode *inode,
+- int (*match_fn)(struct extent_status *es),
+- ext4_lblk_t lblk, ext4_lblk_t end,
+- struct extent_status *es);
++extern void ext4_es_find_delayed_extent_range(struct inode *inode,
++ ext4_lblk_t lblk, ext4_lblk_t end,
++ struct extent_status *es);
+ extern int ext4_es_lookup_extent(struct inode *inode, ext4_lblk_t lblk,
+ struct extent_status *es);
+-extern bool ext4_es_scan_range(struct inode *inode,
+- int (*matching_fn)(struct extent_status *es),
+- ext4_lblk_t lblk, ext4_lblk_t end);
+-extern bool ext4_es_scan_clu(struct inode *inode,
+- int (*matching_fn)(struct extent_status *es),
+- ext4_lblk_t lblk);
+
+ static inline unsigned int ext4_es_status(struct extent_status *es)
+ {
+@@ -178,16 +126,6 @@ static inline int ext4_es_is_hole(struct extent_status *es)
+ return (ext4_es_type(es) & EXTENT_STATUS_HOLE) != 0;
+ }
+
+-static inline int ext4_es_is_mapped(struct extent_status *es)
+-{
+- return (ext4_es_is_written(es) || ext4_es_is_unwritten(es));
+-}
+-
+-static inline int ext4_es_is_delonly(struct extent_status *es)
+-{
+- return (ext4_es_is_delayed(es) && !ext4_es_is_unwritten(es));
+-}
+-
+ static inline void ext4_es_set_referenced(struct extent_status *es)
+ {
+ es->es_pblk |= ((ext4_fsblk_t)EXTENT_STATUS_REFERENCED) << ES_SHIFT;
+@@ -237,12 +175,4 @@ extern void ext4_es_unregister_shrinker(struct ext4_sb_info *sbi);
+
+ extern int ext4_seq_es_shrinker_info_show(struct seq_file *seq, void *v);
+
+-extern int __init ext4_init_pending(void);
+-extern void ext4_exit_pending(void);
+-extern void ext4_init_pending_tree(struct ext4_pending_tree *tree);
+-extern void ext4_remove_pending(struct inode *inode, ext4_lblk_t lblk);
+-extern bool ext4_is_pending(struct inode *inode, ext4_lblk_t lblk);
+-extern int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
+- bool allocated);
+-
+ #endif /* _EXT4_EXTENTS_STATUS_H */
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 17d120ac20100..3c7bbdaa425a7 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -600,8 +600,8 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
+ EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
+ if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) &&
+ !(status & EXTENT_STATUS_WRITTEN) &&
+- ext4_es_scan_range(inode, &ext4_es_is_delayed, map->m_lblk,
+- map->m_lblk + map->m_len - 1))
++ ext4_find_delalloc_range(inode, map->m_lblk,
++ map->m_lblk + map->m_len - 1))
+ status |= EXTENT_STATUS_DELAYED;
+ ret = ext4_es_insert_extent(inode, map->m_lblk,
+ map->m_len, map->m_pblk, status);
+@@ -724,8 +724,8 @@ found:
+ EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
+ if (!(flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE) &&
+ !(status & EXTENT_STATUS_WRITTEN) &&
+- ext4_es_scan_range(inode, &ext4_es_is_delayed, map->m_lblk,
+- map->m_lblk + map->m_len - 1))
++ ext4_find_delalloc_range(inode, map->m_lblk,
++ map->m_lblk + map->m_len - 1))
+ status |= EXTENT_STATUS_DELAYED;
+ ret = ext4_es_insert_extent(inode, map->m_lblk, map->m_len,
+ map->m_pblk, status);
+@@ -1717,7 +1717,7 @@ static void ext4_da_page_release_reservation(struct page *page,
+ lblk = (page->index << (PAGE_SHIFT - inode->i_blkbits)) +
+ ((num_clusters - 1) << sbi->s_cluster_bits);
+ if (sbi->s_cluster_ratio == 1 ||
+- !ext4_es_scan_clu(inode, &ext4_es_is_delayed, lblk))
++ !ext4_find_delalloc_cluster(inode, lblk))
+ ext4_da_release_space(inode, 1);
+
+ num_clusters--;
+@@ -1823,65 +1823,6 @@ static int ext4_bh_delay_or_unwritten(handle_t *handle, struct buffer_head *bh)
+ return (buffer_delay(bh) || buffer_unwritten(bh)) && buffer_dirty(bh);
+ }
+
+-/*
+- * ext4_insert_delayed_block - adds a delayed block to the extents status
+- * tree, incrementing the reserved cluster/block
+- * count or making a pending reservation
+- * where needed
+- *
+- * @inode - file containing the newly added block
+- * @lblk - logical block to be added
+- *
+- * Returns 0 on success, negative error code on failure.
+- */
+-static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk)
+-{
+- struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+- int ret;
+- bool allocated = false;
+-
+- /*
+- * If the cluster containing lblk is shared with a delayed,
+- * written, or unwritten extent in a bigalloc file system, it's
+- * already been accounted for and does not need to be reserved.
+- * A pending reservation must be made for the cluster if it's
+- * shared with a written or unwritten extent and doesn't already
+- * have one. Written and unwritten extents can be purged from the
+- * extents status tree if the system is under memory pressure, so
+- * it's necessary to examine the extent tree if a search of the
+- * extents status tree doesn't get a match.
+- */
+- if (sbi->s_cluster_ratio == 1) {
+- ret = ext4_da_reserve_space(inode);
+- if (ret != 0) /* ENOSPC */
+- goto errout;
+- } else { /* bigalloc */
+- if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk)) {
+- if (!ext4_es_scan_clu(inode,
+- &ext4_es_is_mapped, lblk)) {
+- ret = ext4_clu_mapped(inode,
+- EXT4_B2C(sbi, lblk));
+- if (ret < 0)
+- goto errout;
+- if (ret == 0) {
+- ret = ext4_da_reserve_space(inode);
+- if (ret != 0) /* ENOSPC */
+- goto errout;
+- } else {
+- allocated = true;
+- }
+- } else {
+- allocated = true;
+- }
+- }
+- }
+-
+- ret = ext4_es_insert_delayed_block(inode, lblk, allocated);
+-
+-errout:
+- return ret;
+-}
+-
+ /*
+ * This function is grabs code from the very beginning of
+ * ext4_map_blocks, but assumes that the caller is from delayed write
+@@ -1961,14 +1902,28 @@ static int ext4_da_map_blocks(struct inode *inode, sector_t iblock,
+ add_delayed:
+ if (retval == 0) {
+ int ret;
+-
+ /*
+ * XXX: __block_prepare_write() unmaps passed block,
+ * is it OK?
+ */
++ /*
++ * If the block was allocated from previously allocated cluster,
++ * then we don't need to reserve it again. However we still need
++ * to reserve metadata for every block we're going to write.
++ */
++ if (EXT4_SB(inode->i_sb)->s_cluster_ratio == 1 ||
++ !ext4_find_delalloc_cluster(inode, map->m_lblk)) {
++ ret = ext4_da_reserve_space(inode);
++ if (ret) {
++ /* not enough space to reserve */
++ retval = ret;
++ goto out_unlock;
++ }
++ }
+
+- ret = ext4_insert_delayed_block(inode, map->m_lblk);
+- if (ret != 0) {
++ ret = ext4_es_insert_extent(inode, map->m_lblk, map->m_len,
++ ~0, EXTENT_STATUS_DELAYED);
++ if (ret) {
+ retval = ret;
+ goto out_unlock;
+ }
+@@ -3564,8 +3519,7 @@ static int ext4_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
+ ext4_lblk_t end = map.m_lblk + map.m_len - 1;
+ struct extent_status es;
+
+- ext4_es_find_extent_range(inode, &ext4_es_is_delayed,
+- map.m_lblk, end, &es);
++ ext4_es_find_delayed_extent_range(inode, map.m_lblk, end, &es);
+
+ if (!es.es_len || es.es_lblk > end) {
+ /* entire range is a hole */
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 73a431b6e720f..e54a5be15636d 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1095,7 +1095,6 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
+ ei->i_da_metadata_calc_len = 0;
+ ei->i_da_metadata_calc_last_lblock = 0;
+ spin_lock_init(&(ei->i_block_reservation_lock));
+- ext4_init_pending_tree(&ei->i_pending_tree);
+ #ifdef CONFIG_QUOTA
+ ei->i_reserved_quota = 0;
+ memset(&ei->i_dquot, 0, sizeof(ei->i_dquot));
+@@ -6190,10 +6189,6 @@ static int __init ext4_init_fs(void)
+ if (err)
+ return err;
+
+- err = ext4_init_pending();
+- if (err)
+- goto out6;
+-
+ err = ext4_init_pageio();
+ if (err)
+ goto out5;
+@@ -6232,8 +6227,6 @@ out3:
+ out4:
+ ext4_exit_pageio();
+ out5:
+- ext4_exit_pending();
+-out6:
+ ext4_exit_es();
+
+ return err;
+@@ -6251,7 +6244,6 @@ static void __exit ext4_exit_fs(void)
+ ext4_exit_system_zone();
+ ext4_exit_pageio();
+ ext4_exit_es();
+- ext4_exit_pending();
+ }
+
+ MODULE_AUTHOR("Remy Card, Stephen Tweedie, Andrew Morton, Andreas Dilger, Theodore Ts'o and others");
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index 36d6b561b524f..e85ed4aa9d46f 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -375,7 +375,8 @@ static bool f2fs_lookup_extent_tree(struct inode *inode, pgoff_t pgofs,
+ struct extent_node *en;
+ bool ret = false;
+
+- f2fs_bug_on(sbi, !et);
++ if (!et)
++ return false;
+
+ trace_f2fs_lookup_extent_tree_start(inode, pgofs);
+
+diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
+index e8e825497cbdc..015d39ac2c8f4 100644
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -837,6 +837,12 @@ filelayout_alloc_lseg(struct pnfs_layout_hdr *layoutid,
+ return &fl->generic_hdr;
+ }
+
++static bool
++filelayout_lseg_is_striped(const struct nfs4_filelayout_segment *flseg)
++{
++ return flseg->num_fh > 1;
++}
++
+ /*
+ * filelayout_pg_test(). Called by nfs_can_coalesce_requests()
+ *
+@@ -857,6 +863,8 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
+ size = pnfs_generic_pg_test(pgio, prev, req);
+ if (!size)
+ return 0;
++ else if (!filelayout_lseg_is_striped(FILELAYOUT_LSEG(pgio->pg_lseg)))
++ return size;
+
+ /* see if req and prev are in the same stripe */
+ if (prev) {
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index 919d1238ce45f..a0e37530dcf30 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -480,9 +480,18 @@ static int __nilfs_btree_get_block(const struct nilfs_bmap *btree, __u64 ptr,
+ ret = nilfs_btnode_submit_block(btnc, ptr, 0, REQ_OP_READ, 0, &bh,
+ &submit_ptr);
+ if (ret) {
+- if (ret != -EEXIST)
+- return ret;
+- goto out_check;
++ if (likely(ret == -EEXIST))
++ goto out_check;
++ if (ret == -ENOENT) {
++ /*
++ * Block address translation failed due to invalid
++ * value of 'ptr'. In this case, return internal code
++ * -EINVAL (broken bmap) to notify bmap layer of fatal
++ * metadata corruption.
++ */
++ ret = -EINVAL;
++ }
++ return ret;
+ }
+
+ if (ra) {
+diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h
+index 20c9b8e77a571..0dfb174f707e9 100644
+--- a/include/trace/events/ext4.h
++++ b/include/trace/events/ext4.h
+@@ -2290,7 +2290,7 @@ TRACE_EVENT(ext4_es_remove_extent,
+ __entry->lblk, __entry->len)
+ );
+
+-TRACE_EVENT(ext4_es_find_extent_range_enter,
++TRACE_EVENT(ext4_es_find_delayed_extent_range_enter,
+ TP_PROTO(struct inode *inode, ext4_lblk_t lblk),
+
+ TP_ARGS(inode, lblk),
+@@ -2312,7 +2312,7 @@ TRACE_EVENT(ext4_es_find_extent_range_enter,
+ (unsigned long) __entry->ino, __entry->lblk)
+ );
+
+-TRACE_EVENT(ext4_es_find_extent_range_exit,
++TRACE_EVENT(ext4_es_find_delayed_extent_range_exit,
+ TP_PROTO(struct inode *inode, struct extent_status *es),
+
+ TP_ARGS(inode, es),
+@@ -2532,41 +2532,6 @@ TRACE_EVENT(ext4_es_shrink,
+ __entry->scan_time, __entry->nr_skipped, __entry->retried)
+ );
+
+-TRACE_EVENT(ext4_es_insert_delayed_block,
+- TP_PROTO(struct inode *inode, struct extent_status *es,
+- bool allocated),
+-
+- TP_ARGS(inode, es, allocated),
+-
+- TP_STRUCT__entry(
+- __field( dev_t, dev )
+- __field( ino_t, ino )
+- __field( ext4_lblk_t, lblk )
+- __field( ext4_lblk_t, len )
+- __field( ext4_fsblk_t, pblk )
+- __field( char, status )
+- __field( bool, allocated )
+- ),
+-
+- TP_fast_assign(
+- __entry->dev = inode->i_sb->s_dev;
+- __entry->ino = inode->i_ino;
+- __entry->lblk = es->es_lblk;
+- __entry->len = es->es_len;
+- __entry->pblk = ext4_es_pblock(es);
+- __entry->status = ext4_es_status(es);
+- __entry->allocated = allocated;
+- ),
+-
+- TP_printk("dev %d,%d ino %lu es [%u/%u) mapped %llu status %s "
+- "allocated %d",
+- MAJOR(__entry->dev), MINOR(__entry->dev),
+- (unsigned long) __entry->ino,
+- __entry->lblk, __entry->len,
+- __entry->pblk, show_extent_status(__entry->status),
+- __entry->allocated)
+-);
+-
+ /* fsmap traces */
+ DECLARE_EVENT_CLASS(ext4_fsmap_class,
+ TP_PROTO(struct super_block *sb, u32 keydev, u32 agno, u64 bno, u64 len,
+diff --git a/kernel/sys.c b/kernel/sys.c
+index d0663f8e6fb80..3548467f6459b 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1530,6 +1530,8 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
+
+ if (resource >= RLIM_NLIMITS)
+ return -EINVAL;
++ resource = array_index_nospec(resource, RLIM_NLIMITS);
++
+ if (new_rlim) {
+ if (new_rlim->rlim_cur > new_rlim->rlim_max)
+ return -EINVAL;
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 4db9512feba83..d007f1cca64c7 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -2023,7 +2023,8 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
+ return n_stats;
+ if (n_stats > S32_MAX / sizeof(u64))
+ return -ENOMEM;
+- WARN_ON_ONCE(!n_stats);
++ if (WARN_ON_ONCE(!n_stats))
++ return -EOPNOTSUPP;
+
+ if (copy_from_user(&stats, useraddr, sizeof(stats)))
+ return -EFAULT;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-02-06 12:49 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-02-06 12:49 UTC (permalink / raw
To: gentoo-commits
commit: a65e0548d27ba07612232f979aa1a902a46535f8
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Feb 6 12:49:34 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Feb 6 12:49:34 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a65e0548
Linux patch 4.19.272
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1271_linux-4.19.272.patch | 2942 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2946 insertions(+)
diff --git a/0000_README b/0000_README
index 9dab2ece..e471309d 100644
--- a/0000_README
+++ b/0000_README
@@ -1127,6 +1127,10 @@ Patch: 1270_linux-4.19.271.patch
From: https://www.kernel.org
Desc: Linux 4.19.271
+Patch: 1271_linux-4.19.272.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.272
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1271_linux-4.19.272.patch b/1271_linux-4.19.272.patch
new file mode 100644
index 00000000..575bc67d
--- /dev/null
+++ b/1271_linux-4.19.272.patch
@@ -0,0 +1,2942 @@
+diff --git a/Documentation/ABI/testing/sysfs-kernel-oops_count b/Documentation/ABI/testing/sysfs-kernel-oops_count
+new file mode 100644
+index 0000000000000..156cca9dbc960
+--- /dev/null
++++ b/Documentation/ABI/testing/sysfs-kernel-oops_count
+@@ -0,0 +1,6 @@
++What: /sys/kernel/oops_count
++Date: November 2022
++KernelVersion: 6.2.0
++Contact: Linux Kernel Hardening List <linux-hardening@vger.kernel.org>
++Description:
++ Shows how many times the system has Oopsed since last boot.
+diff --git a/Documentation/ABI/testing/sysfs-kernel-warn_count b/Documentation/ABI/testing/sysfs-kernel-warn_count
+new file mode 100644
+index 0000000000000..90a029813717d
+--- /dev/null
++++ b/Documentation/ABI/testing/sysfs-kernel-warn_count
+@@ -0,0 +1,6 @@
++What: /sys/kernel/warn_count
++Date: November 2022
++KernelVersion: 6.2.0
++Contact: Linux Kernel Hardening List <linux-hardening@vger.kernel.org>
++Description:
++ Shows how many times the system has Warned since last boot.
+diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
+index db1676525ca35..c8d3dbda3c1e2 100644
+--- a/Documentation/sysctl/kernel.txt
++++ b/Documentation/sysctl/kernel.txt
+@@ -51,6 +51,7 @@ show up in /proc/sys/kernel:
+ - msgmnb
+ - msgmni
+ - nmi_watchdog
++- oops_limit
+ - osrelease
+ - ostype
+ - overflowgid
+@@ -96,6 +97,7 @@ show up in /proc/sys/kernel:
+ - threads-max
+ - unprivileged_bpf_disabled
+ - unknown_nmi_panic
++- warn_limit
+ - watchdog
+ - watchdog_thresh
+ - version
+@@ -555,6 +557,15 @@ scanned for a given scan.
+
+ ==============================================================
+
++oops_limit:
++
++Number of kernel oopses after which the kernel should panic when
++``panic_on_oops`` is not set. Setting this to 0 disables checking
++the count. Setting this to 1 has the same effect as setting
++``panic_on_oops=1``. The default value is 10000.
++
++==============================================================
++
+ osrelease, ostype & version:
+
+ # cat osrelease
+@@ -1104,6 +1115,15 @@ example. If a system hangs up, try pressing the NMI switch.
+
+ ==============================================================
+
++warn_limit:
++
++Number of kernel warnings after which the kernel should panic when
++``panic_on_warn`` is not set. Setting this to 0 disables checking
++the warning count. Setting this to 1 has the same effect as setting
++``panic_on_warn=1``. The default value is 0.
++
++==============================================================
++
+ watchdog:
+
+ This parameter can be used to disable or enable the soft lockup detector
+diff --git a/Makefile b/Makefile
+index 560507d1f7a10..e3822e492543a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 271
++SUBLEVEL = 272
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/kernel/traps.c b/arch/alpha/kernel/traps.c
+index bc9627698796e..22f5c27b96b7c 100644
+--- a/arch/alpha/kernel/traps.c
++++ b/arch/alpha/kernel/traps.c
+@@ -192,7 +192,7 @@ die_if_kernel(char * str, struct pt_regs *regs, long err, unsigned long *r9_15)
+ local_irq_enable();
+ while (1);
+ }
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+
+ #ifndef CONFIG_MATHEMU
+@@ -577,7 +577,7 @@ do_entUna(void * va, unsigned long opcode, unsigned long reg,
+
+ printk("Bad unaligned kernel access at %016lx: %p %lx %lu\n",
+ pc, va, opcode, reg);
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+
+ got_exception:
+ /* Ok, we caught the exception, but we don't want it. Is there
+@@ -632,7 +632,7 @@ got_exception:
+ local_irq_enable();
+ while (1);
+ }
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+
+ /*
+diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
+index 188fc9256baf1..6ce67b05412ec 100644
+--- a/arch/alpha/mm/fault.c
++++ b/arch/alpha/mm/fault.c
+@@ -206,7 +206,7 @@ retry:
+ printk(KERN_ALERT "Unable to handle kernel paging request at "
+ "virtual address %016lx\n", address);
+ die_if_kernel("Oops", regs, cause, (unsigned long*)regs - 16);
+- do_exit(SIGKILL);
++ make_task_dead(SIGKILL);
+
+ /* We ran out of memory, or some other thing happened to us that
+ made us unable to handle the page fault gracefully. */
+diff --git a/arch/arm/boot/dts/imx53-ppd.dts b/arch/arm/boot/dts/imx53-ppd.dts
+index f346673d34ead..0cb5f01f02d15 100644
+--- a/arch/arm/boot/dts/imx53-ppd.dts
++++ b/arch/arm/boot/dts/imx53-ppd.dts
+@@ -462,7 +462,7 @@
+ scl-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>;
+ status = "okay";
+
+- i2c-switch@70 {
++ i2c-mux@70 {
+ compatible = "nxp,pca9547";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/imx6qdl-gw560x.dtsi b/arch/arm/boot/dts/imx6qdl-gw560x.dtsi
+index b5986efe1090c..143d249b821eb 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw560x.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw560x.dtsi
+@@ -463,7 +463,6 @@
+ &uart1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_uart1>;
+- uart-has-rtscts;
+ rts-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>;
+ status = "okay";
+ };
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index d49fafd2b865f..02a4aea52fb05 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -344,7 +344,7 @@ static void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
+ if (panic_on_oops)
+ panic("Fatal exception");
+ if (signr)
+- do_exit(signr);
++ make_task_dead(signr);
+ }
+
+ /*
+diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
+index a9ee0d9dc740a..8457384139cb8 100644
+--- a/arch/arm/mm/fault.c
++++ b/arch/arm/mm/fault.c
+@@ -149,7 +149,7 @@ __do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
+ show_pte(mm, addr);
+ die("Oops", regs, fsr);
+ bust_spinlocks(0);
+- do_exit(SIGKILL);
++ make_task_dead(SIGKILL);
+ }
+
+ /*
+diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
+index e803fd16248bc..46d2142ebd14c 100644
+--- a/arch/arm/mm/nommu.c
++++ b/arch/arm/mm/nommu.c
+@@ -160,7 +160,7 @@ void __init paging_init(const struct machine_desc *mdesc)
+ mpu_setup();
+
+ /* allocate the zero page. */
+- zero_page = memblock_alloc(PAGE_SIZE, PAGE_SIZE);
++ zero_page = (void *)memblock_alloc(PAGE_SIZE, PAGE_SIZE);
+ if (!zero_page)
+ panic("%s: Failed to allocate %lu bytes align=0x%lx\n",
+ __func__, PAGE_SIZE, PAGE_SIZE);
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index 965595fe68045..20f896b27a447 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -224,7 +224,7 @@ void die(const char *str, struct pt_regs *regs, int err)
+ raw_spin_unlock_irqrestore(&die_lock, flags);
+
+ if (ret != NOTIFY_STOP)
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+
+ static bool show_unhandled_signals_ratelimited(void)
+diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
+index b046006a387ff..0d2be8eb87ec8 100644
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -268,7 +268,7 @@ static void die_kernel_fault(const char *msg, unsigned long addr,
+ show_pte(addr);
+ die("Oops", regs, esr);
+ bust_spinlocks(0);
+- do_exit(SIGKILL);
++ make_task_dead(SIGKILL);
+ }
+
+ static void __do_kernel_fault(unsigned long addr, unsigned int esr,
+diff --git a/arch/h8300/kernel/traps.c b/arch/h8300/kernel/traps.c
+index e47a9e0dc278f..090adaee4b84c 100644
+--- a/arch/h8300/kernel/traps.c
++++ b/arch/h8300/kernel/traps.c
+@@ -17,6 +17,7 @@
+ #include <linux/types.h>
+ #include <linux/sched.h>
+ #include <linux/sched/debug.h>
++#include <linux/sched/task.h>
+ #include <linux/mm_types.h>
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+@@ -110,7 +111,7 @@ void die(const char *str, struct pt_regs *fp, unsigned long err)
+ dump(fp);
+
+ spin_unlock_irq(&die_lock);
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+
+ static int kstack_depth_to_print = 24;
+diff --git a/arch/h8300/mm/fault.c b/arch/h8300/mm/fault.c
+index fabffb83930af..573825c3cb708 100644
+--- a/arch/h8300/mm/fault.c
++++ b/arch/h8300/mm/fault.c
+@@ -52,7 +52,7 @@ asmlinkage int do_page_fault(struct pt_regs *regs, unsigned long address,
+ printk(" at virtual address %08lx\n", address);
+ if (!user_mode(regs))
+ die("Oops", regs, error_code);
+- do_exit(SIGKILL);
++ make_task_dead(SIGKILL);
+
+ return 1;
+ }
+diff --git a/arch/hexagon/kernel/traps.c b/arch/hexagon/kernel/traps.c
+index 91ee04842c22c..34a74f73f1690 100644
+--- a/arch/hexagon/kernel/traps.c
++++ b/arch/hexagon/kernel/traps.c
+@@ -234,7 +234,7 @@ int die(const char *str, struct pt_regs *regs, long err)
+ panic("Fatal exception");
+
+ oops_exit();
+- do_exit(err);
++ make_task_dead(err);
+ return 0;
+ }
+
+diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
+index 8b4a0c1748c03..0d56b19b7511a 100644
+--- a/arch/ia64/Kconfig
++++ b/arch/ia64/Kconfig
+@@ -445,7 +445,7 @@ config ARCH_PROC_KCORE_TEXT
+ depends on PROC_KCORE
+
+ config IA64_MCA_RECOVERY
+- tristate "MCA recovery from errors other than TLB."
++ bool "MCA recovery from errors other than TLB."
+
+ config PERFMON
+ bool "Performance monitor support"
+diff --git a/arch/ia64/kernel/mca_drv.c b/arch/ia64/kernel/mca_drv.c
+index 06419a95af309..07353029b003a 100644
+--- a/arch/ia64/kernel/mca_drv.c
++++ b/arch/ia64/kernel/mca_drv.c
+@@ -11,6 +11,7 @@
+ #include <linux/types.h>
+ #include <linux/init.h>
+ #include <linux/sched.h>
++#include <linux/sched/task.h>
+ #include <linux/interrupt.h>
+ #include <linux/irq.h>
+ #include <linux/kallsyms.h>
+@@ -176,7 +177,7 @@ mca_handler_bh(unsigned long paddr, void *iip, unsigned long ipsr)
+ spin_unlock(&mca_bh_lock);
+
+ /* This process is about to be killed itself */
+- do_exit(SIGKILL);
++ make_task_dead(SIGKILL);
+ }
+
+ /**
+diff --git a/arch/ia64/kernel/traps.c b/arch/ia64/kernel/traps.c
+index c6f4932073a18..32c2877b3c0ad 100644
+--- a/arch/ia64/kernel/traps.c
++++ b/arch/ia64/kernel/traps.c
+@@ -85,7 +85,7 @@ die (const char *str, struct pt_regs *regs, long err)
+ if (panic_on_oops)
+ panic("Fatal exception");
+
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ return 0;
+ }
+
+diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
+index a9d55ad8d67be..0b072af7e20d8 100644
+--- a/arch/ia64/mm/fault.c
++++ b/arch/ia64/mm/fault.c
+@@ -302,7 +302,7 @@ retry:
+ regs = NULL;
+ bust_spinlocks(0);
+ if (regs)
+- do_exit(SIGKILL);
++ make_task_dead(SIGKILL);
+ return;
+
+ out_of_memory:
+diff --git a/arch/m68k/kernel/traps.c b/arch/m68k/kernel/traps.c
+index b2fd000b92857..9b70a7f5e7058 100644
+--- a/arch/m68k/kernel/traps.c
++++ b/arch/m68k/kernel/traps.c
+@@ -1139,7 +1139,7 @@ void die_if_kernel (char *str, struct pt_regs *fp, int nr)
+ pr_crit("%s: %08x\n", str, nr);
+ show_registers(fp);
+ add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+
+ asmlinkage void set_esp0(unsigned long ssp)
+diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c
+index 9b6163c05a754..fc3aea6dcaa77 100644
+--- a/arch/m68k/mm/fault.c
++++ b/arch/m68k/mm/fault.c
+@@ -48,7 +48,7 @@ int send_fault_sig(struct pt_regs *regs)
+ pr_alert("Unable to handle kernel access");
+ pr_cont(" at virtual address %p\n", addr);
+ die_if_kernel("Oops", regs, 0 /*error_code*/);
+- do_exit(SIGKILL);
++ make_task_dead(SIGKILL);
+ }
+
+ return 1;
+diff --git a/arch/microblaze/kernel/exceptions.c b/arch/microblaze/kernel/exceptions.c
+index eafff21fcb0e6..182402db6b043 100644
+--- a/arch/microblaze/kernel/exceptions.c
++++ b/arch/microblaze/kernel/exceptions.c
+@@ -44,10 +44,10 @@ void die(const char *str, struct pt_regs *fp, long err)
+ pr_warn("Oops: %s, sig: %ld\n", str, err);
+ show_regs(fp);
+ spin_unlock_irq(&die_lock);
+- /* do_exit() should take care of panic'ing from an interrupt
++ /* make_task_dead() should take care of panic'ing from an interrupt
+ * context so we don't handle it here
+ */
+- do_exit(err);
++ make_task_dead(err);
+ }
+
+ /* for user application debugging */
+diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
+index 0ca4185cc5e38..01c85d37c47ab 100644
+--- a/arch/mips/kernel/traps.c
++++ b/arch/mips/kernel/traps.c
+@@ -412,7 +412,7 @@ void __noreturn die(const char *str, struct pt_regs *regs)
+ if (regs && kexec_should_crash(current))
+ crash_kexec(regs);
+
+- do_exit(sig);
++ make_task_dead(sig);
+ }
+
+ extern struct exception_table_entry __start___dbe_table[];
+diff --git a/arch/nds32/kernel/traps.c b/arch/nds32/kernel/traps.c
+index 1496aab489988..a811f286bc85c 100644
+--- a/arch/nds32/kernel/traps.c
++++ b/arch/nds32/kernel/traps.c
+@@ -183,7 +183,7 @@ void die(const char *str, struct pt_regs *regs, int err)
+
+ bust_spinlocks(0);
+ spin_unlock_irq(&die_lock);
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+
+ EXPORT_SYMBOL(die);
+@@ -286,7 +286,7 @@ void unhandled_interruption(struct pt_regs *regs)
+ pr_emerg("unhandled_interruption\n");
+ show_regs(regs);
+ if (!user_mode(regs))
+- do_exit(SIGKILL);
++ make_task_dead(SIGKILL);
+ force_sig(SIGKILL, current);
+ }
+
+@@ -297,7 +297,7 @@ void unhandled_exceptions(unsigned long entry, unsigned long addr,
+ addr, type);
+ show_regs(regs);
+ if (!user_mode(regs))
+- do_exit(SIGKILL);
++ make_task_dead(SIGKILL);
+ force_sig(SIGKILL, current);
+ }
+
+@@ -324,7 +324,7 @@ void do_revinsn(struct pt_regs *regs)
+ pr_emerg("Reserved Instruction\n");
+ show_regs(regs);
+ if (!user_mode(regs))
+- do_exit(SIGILL);
++ make_task_dead(SIGILL);
+ force_sig(SIGILL, current);
+ }
+
+diff --git a/arch/nios2/kernel/traps.c b/arch/nios2/kernel/traps.c
+index 3bc3cd22b750e..dc6c270a355b6 100644
+--- a/arch/nios2/kernel/traps.c
++++ b/arch/nios2/kernel/traps.c
+@@ -37,10 +37,10 @@ void die(const char *str, struct pt_regs *regs, long err)
+ show_regs(regs);
+ spin_unlock_irq(&die_lock);
+ /*
+- * do_exit() should take care of panic'ing from an interrupt
++ * make_task_dead() should take care of panic'ing from an interrupt
+ * context so we don't handle it here
+ */
+- do_exit(err);
++ make_task_dead(err);
+ }
+
+ void _exception(int signo, struct pt_regs *regs, int code, unsigned long addr)
+diff --git a/arch/openrisc/kernel/traps.c b/arch/openrisc/kernel/traps.c
+index d8981cbb852a5..dfa3db1bccef4 100644
+--- a/arch/openrisc/kernel/traps.c
++++ b/arch/openrisc/kernel/traps.c
+@@ -224,7 +224,7 @@ void die(const char *str, struct pt_regs *regs, long err)
+ __asm__ __volatile__("l.nop 1");
+ do {} while (1);
+ #endif
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+
+ /* This is normally the 'Oops' routine */
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index d7a66d8525091..5d9cf726e4ecd 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -265,7 +265,7 @@ void die_if_kernel(char *str, struct pt_regs *regs, long err)
+ panic("Fatal exception");
+
+ oops_exit();
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+
+ /* gdb uses break 4,8 */
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 2379c4bf3979e..63c751ce130a5 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -251,7 +251,7 @@ static void oops_end(unsigned long flags, struct pt_regs *regs,
+ panic("Fatal exception in interrupt");
+ if (panic_on_oops)
+ panic("Fatal exception");
+- do_exit(signr);
++ make_task_dead(signr);
+ }
+ NOKPROBE_SYMBOL(oops_end);
+
+diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
+index 7c65750508f25..9b736e616131d 100644
+--- a/arch/riscv/kernel/traps.c
++++ b/arch/riscv/kernel/traps.c
+@@ -64,7 +64,7 @@ void die(struct pt_regs *regs, const char *str)
+ if (panic_on_oops)
+ panic("Fatal exception");
+ if (ret != NOTIFY_STOP)
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+
+ void do_trap(struct pt_regs *regs, int signo, int code,
+diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c
+index 523dbfbac03dd..7b5f110f8191a 100644
+--- a/arch/riscv/mm/fault.c
++++ b/arch/riscv/mm/fault.c
+@@ -200,7 +200,7 @@ no_context:
+ (addr < PAGE_SIZE) ? "NULL pointer dereference" :
+ "paging request", addr);
+ die(regs, "Oops");
+- do_exit(SIGKILL);
++ make_task_dead(SIGKILL);
+
+ /*
+ * We ran out of memory, call the OOM killer, and return the userspace
+diff --git a/arch/s390/kernel/dumpstack.c b/arch/s390/kernel/dumpstack.c
+index 5b23c4f6e50cd..7b21019096f44 100644
+--- a/arch/s390/kernel/dumpstack.c
++++ b/arch/s390/kernel/dumpstack.c
+@@ -187,5 +187,5 @@ void die(struct pt_regs *regs, const char *str)
+ if (panic_on_oops)
+ panic("Fatal exception: panic_on_oops");
+ oops_exit();
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
+index 8c867b43c8ebc..471a965ae75a4 100644
+--- a/arch/s390/kernel/nmi.c
++++ b/arch/s390/kernel/nmi.c
+@@ -179,7 +179,7 @@ void s390_handle_mcck(void)
+ "malfunction (code 0x%016lx).\n", mcck.mcck_code);
+ printk(KERN_EMERG "mcck: task: %s, pid: %d.\n",
+ current->comm, current->pid);
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+ }
+ EXPORT_SYMBOL_GPL(s390_handle_mcck);
+diff --git a/arch/sh/kernel/traps.c b/arch/sh/kernel/traps.c
+index 8b49cced663dc..5fafbef7849b1 100644
+--- a/arch/sh/kernel/traps.c
++++ b/arch/sh/kernel/traps.c
+@@ -57,7 +57,7 @@ void die(const char *str, struct pt_regs *regs, long err)
+ if (panic_on_oops)
+ panic("Fatal exception");
+
+- do_exit(SIGSEGV);
++ make_task_dead(SIGSEGV);
+ }
+
+ void die_if_kernel(const char *str, struct pt_regs *regs, long err)
+diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
+index bcdfc6168dd58..ec7fcfbad06c0 100644
+--- a/arch/sparc/kernel/traps_32.c
++++ b/arch/sparc/kernel/traps_32.c
+@@ -86,9 +86,7 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs)
+ }
+ printk("Instruction DUMP:");
+ instruction_dump ((unsigned long *) regs->pc);
+- if(regs->psr & PSR_PS)
+- do_exit(SIGKILL);
+- do_exit(SIGSEGV);
++ make_task_dead((regs->psr & PSR_PS) ? SIGKILL : SIGSEGV);
+ }
+
+ void do_hw_interrupt(struct pt_regs *regs, unsigned long type)
+diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
+index 86879c28910b7..1a338784a37c8 100644
+--- a/arch/sparc/kernel/traps_64.c
++++ b/arch/sparc/kernel/traps_64.c
+@@ -2565,9 +2565,7 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs)
+ }
+ if (panic_on_oops)
+ panic("Fatal exception");
+- if (regs->tstate & TSTATE_PRIV)
+- do_exit(SIGKILL);
+- do_exit(SIGSEGV);
++ make_task_dead((regs->tstate & TSTATE_PRIV)? SIGKILL : SIGSEGV);
+ }
+ EXPORT_SYMBOL(die_if_kernel);
+
+diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
+index 78b308f2f2ea6..e6c258bf95116 100644
+--- a/arch/x86/entry/entry_32.S
++++ b/arch/x86/entry/entry_32.S
+@@ -1500,13 +1500,13 @@ ENTRY(async_page_fault)
+ END(async_page_fault)
+ #endif
+
+-ENTRY(rewind_stack_do_exit)
++ENTRY(rewind_stack_and_make_dead)
+ /* Prevent any naive code from trying to unwind to our caller. */
+ xorl %ebp, %ebp
+
+ movl PER_CPU_VAR(cpu_current_top_of_stack), %esi
+ leal -TOP_OF_KERNEL_STACK_PADDING-PTREGS_SIZE(%esi), %esp
+
+- call do_exit
++ call make_task_dead
+ 1: jmp 1b
+-END(rewind_stack_do_exit)
++END(rewind_stack_and_make_dead)
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index 3f418aedef8d7..ef693d3689aa7 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -1759,10 +1759,10 @@ END(nmi)
+ ENTRY(ignore_sysret)
+ UNWIND_HINT_EMPTY
+ mov $-ENOSYS, %eax
+- sysret
++ sysretl
+ END(ignore_sysret)
+
+-ENTRY(rewind_stack_do_exit)
++ENTRY(rewind_stack_and_make_dead)
+ UNWIND_HINT_FUNC
+ /* Prevent any naive code from trying to unwind to our caller. */
+ xorl %ebp, %ebp
+@@ -1771,5 +1771,5 @@ ENTRY(rewind_stack_do_exit)
+ leaq -PTREGS_SIZE(%rax), %rsp
+ UNWIND_HINT_REGS
+
+- call do_exit
+-END(rewind_stack_do_exit)
++ call make_task_dead
++END(rewind_stack_and_make_dead)
+diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
+index 2b5886401e5f4..2b17a5cec0997 100644
+--- a/arch/x86/kernel/dumpstack.c
++++ b/arch/x86/kernel/dumpstack.c
+@@ -326,7 +326,7 @@ unsigned long oops_begin(void)
+ }
+ NOKPROBE_SYMBOL(oops_begin);
+
+-void __noreturn rewind_stack_do_exit(int signr);
++void __noreturn rewind_stack_and_make_dead(int signr);
+
+ void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
+ {
+@@ -361,7 +361,7 @@ void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
+ * reuse the task stack and that existing poisons are invalid.
+ */
+ kasan_unpoison_task_stack(current);
+- rewind_stack_do_exit(signr);
++ rewind_stack_and_make_dead(signr);
+ }
+ NOKPROBE_SYMBOL(oops_end);
+
+diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
+index fe522691ac717..8821d0ab0a08c 100644
+--- a/arch/x86/kernel/i8259.c
++++ b/arch/x86/kernel/i8259.c
+@@ -114,6 +114,7 @@ static void make_8259A_irq(unsigned int irq)
+ disable_irq_nosync(irq);
+ io_apic_irqs &= ~(1<<irq);
+ irq_set_chip_and_handler(irq, &i8259A_chip, handle_level_irq);
++ irq_set_status_flags(irq, IRQ_LEVEL);
+ enable_irq(irq);
+ lapic_assign_legacy_vector(irq, true);
+ }
+diff --git a/arch/x86/kernel/irqinit.c b/arch/x86/kernel/irqinit.c
+index a0693b71cfc1c..f2c215e1f64c5 100644
+--- a/arch/x86/kernel/irqinit.c
++++ b/arch/x86/kernel/irqinit.c
+@@ -72,8 +72,10 @@ void __init init_ISA_irqs(void)
+
+ legacy_pic->init(0);
+
+- for (i = 0; i < nr_legacy_irqs(); i++)
++ for (i = 0; i < nr_legacy_irqs(); i++) {
+ irq_set_chip_and_handler(i, chip, handle_level_irq);
++ irq_set_status_flags(i, IRQ_LEVEL);
++ }
+ }
+
+ void __init init_IRQ(void)
+diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
+index 33147fef3452c..f1024b51cfee1 100644
+--- a/arch/x86/lib/iomap_copy_64.S
++++ b/arch/x86/lib/iomap_copy_64.S
+@@ -22,6 +22,6 @@
+ */
+ ENTRY(__iowrite32_copy)
+ movl %edx,%ecx
+- rep movsd
++ rep movsl
+ ret
+ ENDPROC(__iowrite32_copy)
+diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c
+index 86507fa7c2d7c..2ae5c505894bd 100644
+--- a/arch/xtensa/kernel/traps.c
++++ b/arch/xtensa/kernel/traps.c
+@@ -542,5 +542,5 @@ void die(const char * str, struct pt_regs * regs, long err)
+ if (panic_on_oops)
+ panic("Fatal exception");
+
+- do_exit(err);
++ make_task_dead(err);
+ }
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 80f3e729fdd4d..4fbf915d9cb01 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -2179,10 +2179,7 @@ static inline bool bio_check_ro(struct bio *bio, struct hd_struct *part)
+
+ if (op_is_flush(bio->bi_opf) && !bio_sectors(bio))
+ return false;
+-
+- WARN_ONCE(1,
+- "generic_make_request: Trying to write "
+- "to read-only block-device %s (partno %d)\n",
++ pr_warn("Trying to write to read-only block-device %s (partno %d)\n",
+ bio_devname(bio, b), part->partno);
+ /* Older lvm-tools actually trigger this */
+ return false;
+diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
+index 8a52a5efee4f5..e1cf7c250c33a 100644
+--- a/drivers/dma/dmaengine.c
++++ b/drivers/dma/dmaengine.c
+@@ -223,7 +223,8 @@ static int dma_chan_get(struct dma_chan *chan)
+ /* The channel is already in use, update client count */
+ if (chan->client_count) {
+ __module_get(owner);
+- goto out;
++ chan->client_count++;
++ return 0;
+ }
+
+ if (!try_module_get(owner))
+@@ -236,11 +237,11 @@ static int dma_chan_get(struct dma_chan *chan)
+ goto err_out;
+ }
+
++ chan->client_count++;
++
+ if (!dma_has_cap(DMA_PRIVATE, chan->device->cap_mask))
+ balance_ref_count(chan);
+
+-out:
+- chan->client_count++;
+ return 0;
+
+ err_out:
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index 709ead443fc5f..5794d3120bb86 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -1347,10 +1347,12 @@ static struct sdma_desc *sdma_transfer_init(struct sdma_channel *sdmac,
+ sdma_config_ownership(sdmac, false, true, false);
+
+ if (sdma_load_context(sdmac))
+- goto err_desc_out;
++ goto err_bd_out;
+
+ return desc;
+
++err_bd_out:
++ sdma_free_bd(desc);
+ err_desc_out:
+ kfree(desc);
+ err_out:
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index 0ba70be4ea85d..5f9945651e95e 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -164,7 +164,9 @@
+ #define XILINX_DMA_REG_BTT 0x28
+
+ /* AXI DMA Specific Masks/Bit fields */
+-#define XILINX_DMA_MAX_TRANS_LEN GENMASK(22, 0)
++#define XILINX_DMA_MAX_TRANS_LEN_MIN 8
++#define XILINX_DMA_MAX_TRANS_LEN_MAX 23
++#define XILINX_DMA_V2_MAX_TRANS_LEN_MAX 26
+ #define XILINX_DMA_CR_COALESCE_MAX GENMASK(23, 16)
+ #define XILINX_DMA_CR_CYCLIC_BD_EN_MASK BIT(4)
+ #define XILINX_DMA_CR_COALESCE_SHIFT 16
+@@ -428,6 +430,7 @@ struct xilinx_dma_config {
+ * @rxs_clk: DMA s2mm stream clock
+ * @nr_channels: Number of channels DMA device supports
+ * @chan_id: DMA channel identifier
++ * @max_buffer_len: Max buffer length
+ */
+ struct xilinx_dma_device {
+ void __iomem *regs;
+@@ -447,6 +450,7 @@ struct xilinx_dma_device {
+ struct clk *rxs_clk;
+ u32 nr_channels;
+ u32 chan_id;
++ u32 max_buffer_len;
+ };
+
+ /* Macros */
+@@ -969,6 +973,25 @@ static int xilinx_dma_alloc_chan_resources(struct dma_chan *dchan)
+ return 0;
+ }
+
++/**
++ * xilinx_dma_calc_copysize - Calculate the amount of data to copy
++ * @chan: Driver specific DMA channel
++ * @size: Total data that needs to be copied
++ * @done: Amount of data that has been already copied
++ *
++ * Return: Amount of data that has to be copied
++ */
++static int xilinx_dma_calc_copysize(struct xilinx_dma_chan *chan,
++ int size, int done)
++{
++ size_t copy;
++
++ copy = min_t(size_t, size - done,
++ chan->xdev->max_buffer_len);
++
++ return copy;
++}
++
+ /**
+ * xilinx_dma_tx_status - Get DMA transaction status
+ * @dchan: DMA channel
+@@ -1002,7 +1025,7 @@ static enum dma_status xilinx_dma_tx_status(struct dma_chan *dchan,
+ list_for_each_entry(segment, &desc->segments, node) {
+ hw = &segment->hw;
+ residue += (hw->control - hw->status) &
+- XILINX_DMA_MAX_TRANS_LEN;
++ chan->xdev->max_buffer_len;
+ }
+ }
+ spin_unlock_irqrestore(&chan->lock, flags);
+@@ -1262,7 +1285,7 @@ static void xilinx_cdma_start_transfer(struct xilinx_dma_chan *chan)
+
+ /* Start the transfer */
+ dma_ctrl_write(chan, XILINX_DMA_REG_BTT,
+- hw->control & XILINX_DMA_MAX_TRANS_LEN);
++ hw->control & chan->xdev->max_buffer_len);
+ }
+
+ list_splice_tail_init(&chan->pending_list, &chan->active_list);
+@@ -1365,7 +1388,7 @@ static void xilinx_dma_start_transfer(struct xilinx_dma_chan *chan)
+
+ /* Start the transfer */
+ dma_ctrl_write(chan, XILINX_DMA_REG_BTT,
+- hw->control & XILINX_DMA_MAX_TRANS_LEN);
++ hw->control & chan->xdev->max_buffer_len);
+ }
+
+ list_splice_tail_init(&chan->pending_list, &chan->active_list);
+@@ -1729,7 +1752,7 @@ xilinx_cdma_prep_memcpy(struct dma_chan *dchan, dma_addr_t dma_dst,
+ struct xilinx_cdma_tx_segment *segment;
+ struct xilinx_cdma_desc_hw *hw;
+
+- if (!len || len > XILINX_DMA_MAX_TRANS_LEN)
++ if (!len || len > chan->xdev->max_buffer_len)
+ return NULL;
+
+ desc = xilinx_dma_alloc_tx_descriptor(chan);
+@@ -1819,8 +1842,8 @@ static struct dma_async_tx_descriptor *xilinx_dma_prep_slave_sg(
+ * Calculate the maximum number of bytes to transfer,
+ * making sure it is less than the hw limit
+ */
+- copy = min_t(size_t, sg_dma_len(sg) - sg_used,
+- XILINX_DMA_MAX_TRANS_LEN);
++ copy = xilinx_dma_calc_copysize(chan, sg_dma_len(sg),
++ sg_used);
+ hw = &segment->hw;
+
+ /* Fill in the descriptor */
+@@ -1924,8 +1947,8 @@ static struct dma_async_tx_descriptor *xilinx_dma_prep_dma_cyclic(
+ * Calculate the maximum number of bytes to transfer,
+ * making sure it is less than the hw limit
+ */
+- copy = min_t(size_t, period_len - sg_used,
+- XILINX_DMA_MAX_TRANS_LEN);
++ copy = xilinx_dma_calc_copysize(chan, period_len,
++ sg_used);
+ hw = &segment->hw;
+ xilinx_axidma_buf(chan, hw, buf_addr, sg_used,
+ period_len * i);
+@@ -2613,7 +2636,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+ struct xilinx_dma_device *xdev;
+ struct device_node *child, *np = pdev->dev.of_node;
+ struct resource *io;
+- u32 num_frames, addr_width;
++ u32 num_frames, addr_width, len_width;
+ int i, err;
+
+ /* Allocate and initialize the DMA engine structure */
+@@ -2640,13 +2663,30 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+ /* Request and map I/O memory */
+ io = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ xdev->regs = devm_ioremap_resource(&pdev->dev, io);
+- if (IS_ERR(xdev->regs))
+- return PTR_ERR(xdev->regs);
+-
++ if (IS_ERR(xdev->regs)) {
++ err = PTR_ERR(xdev->regs);
++ goto disable_clks;
++ }
+ /* Retrieve the DMA engine properties from the device tree */
+ xdev->has_sg = of_property_read_bool(node, "xlnx,include-sg");
+- if (xdev->dma_config->dmatype == XDMA_TYPE_AXIDMA)
++ xdev->max_buffer_len = GENMASK(XILINX_DMA_MAX_TRANS_LEN_MAX - 1, 0);
++
++ if (xdev->dma_config->dmatype == XDMA_TYPE_AXIDMA) {
+ xdev->mcdma = of_property_read_bool(node, "xlnx,mcdma");
++ if (!of_property_read_u32(node, "xlnx,sg-length-width",
++ &len_width)) {
++ if (len_width < XILINX_DMA_MAX_TRANS_LEN_MIN ||
++ len_width > XILINX_DMA_V2_MAX_TRANS_LEN_MAX) {
++ dev_warn(xdev->dev,
++ "invalid xlnx,sg-length-width property value. Using default width\n");
++ } else {
++ if (len_width > XILINX_DMA_MAX_TRANS_LEN_MAX)
++ dev_warn(xdev->dev, "Please ensure that IP supports buffer length > 23 bits\n");
++ xdev->max_buffer_len =
++ GENMASK(len_width - 1, 0);
++ }
++ }
++ }
+
+ if (xdev->dma_config->dmatype == XDMA_TYPE_VDMA) {
+ err = of_property_read_u32(node, "xlnx,num-fstores",
+@@ -2719,8 +2759,10 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+ /* Initialize the channels */
+ for_each_child_of_node(node, child) {
+ err = xilinx_dma_child_probe(xdev, child);
+- if (err < 0)
+- goto disable_clks;
++ if (err < 0) {
++ of_node_put(child);
++ goto error;
++ }
+ }
+
+ if (xdev->dma_config->dmatype == XDMA_TYPE_VDMA) {
+@@ -2753,12 +2795,12 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+
+ return 0;
+
+-disable_clks:
+- xdma_disable_allclks(xdev);
+ error:
+ for (i = 0; i < xdev->nr_channels; i++)
+ if (xdev->chan[i])
+ xilinx_dma_chan_remove(xdev->chan[i]);
++disable_clks:
++ xdma_disable_allclks(xdev);
+
+ return err;
+ }
+diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
+index 93d6e6319b3cc..0ac6c49ecdbf4 100644
+--- a/drivers/edac/edac_device.c
++++ b/drivers/edac/edac_device.c
+@@ -34,6 +34,9 @@
+ static DEFINE_MUTEX(device_ctls_mutex);
+ static LIST_HEAD(edac_device_list);
+
++/* Default workqueue processing interval on this instance, in msecs */
++#define DEFAULT_POLL_INTERVAL 1000
++
+ #ifdef CONFIG_EDAC_DEBUG
+ static void edac_device_dump_device(struct edac_device_ctl_info *edac_dev)
+ {
+@@ -366,7 +369,7 @@ static void edac_device_workq_function(struct work_struct *work_req)
+ * whole one second to save timers firing all over the period
+ * between integral seconds
+ */
+- if (edac_dev->poll_msec == 1000)
++ if (edac_dev->poll_msec == DEFAULT_POLL_INTERVAL)
+ edac_queue_work(&edac_dev->work, round_jiffies_relative(edac_dev->delay));
+ else
+ edac_queue_work(&edac_dev->work, edac_dev->delay);
+@@ -396,7 +399,7 @@ static void edac_device_workq_setup(struct edac_device_ctl_info *edac_dev,
+ * timers firing on sub-second basis, while they are happy
+ * to fire together on the 1 second exactly
+ */
+- if (edac_dev->poll_msec == 1000)
++ if (edac_dev->poll_msec == DEFAULT_POLL_INTERVAL)
+ edac_queue_work(&edac_dev->work, round_jiffies_relative(edac_dev->delay));
+ else
+ edac_queue_work(&edac_dev->work, edac_dev->delay);
+@@ -430,7 +433,7 @@ void edac_device_reset_delay_period(struct edac_device_ctl_info *edac_dev,
+ edac_dev->delay = msecs_to_jiffies(msec);
+
+ /* See comment in edac_device_workq_setup() above */
+- if (edac_dev->poll_msec == 1000)
++ if (edac_dev->poll_msec == DEFAULT_POLL_INTERVAL)
+ edac_mod_work(&edac_dev->work, round_jiffies_relative(edac_dev->delay));
+ else
+ edac_mod_work(&edac_dev->work, edac_dev->delay);
+@@ -472,11 +475,7 @@ int edac_device_add_device(struct edac_device_ctl_info *edac_dev)
+ /* This instance is NOW RUNNING */
+ edac_dev->op_state = OP_RUNNING_POLL;
+
+- /*
+- * enable workq processing on this instance,
+- * default = 1000 msec
+- */
+- edac_device_workq_setup(edac_dev, 1000);
++ edac_device_workq_setup(edac_dev, edac_dev->poll_msec ?: DEFAULT_POLL_INTERVAL);
+ } else {
+ edac_dev->op_state = OP_RUNNING_INTERRUPT;
+ }
+diff --git a/drivers/edac/highbank_mc_edac.c b/drivers/edac/highbank_mc_edac.c
+index 6092e61be6050..bcf41601a9778 100644
+--- a/drivers/edac/highbank_mc_edac.c
++++ b/drivers/edac/highbank_mc_edac.c
+@@ -185,8 +185,10 @@ static int highbank_mc_probe(struct platform_device *pdev)
+ drvdata = mci->pvt_info;
+ platform_set_drvdata(pdev, mci);
+
+- if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL))
+- return -ENOMEM;
++ if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) {
++ res = -ENOMEM;
++ goto free;
++ }
+
+ r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!r) {
+@@ -254,6 +256,7 @@ err2:
+ edac_mc_del_mc(&pdev->dev);
+ err:
+ devres_release_group(&pdev->dev, NULL);
++free:
+ edac_mc_free(mci);
+ return res;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 77a2f7fc2b370..dfa6e6c2f808b 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -4116,7 +4116,18 @@ intel_dp_check_mst_status(struct intel_dp *intel_dp)
+ bool bret;
+
+ if (intel_dp->is_mst) {
+- u8 esi[DP_DPRX_ESI_LEN] = { 0 };
++ /*
++ * The +2 is because DP_DPRX_ESI_LEN is 14, but we then
++ * pass in "esi+10" to drm_dp_channel_eq_ok(), which
++ * takes a 6-byte array. So we actually need 16 bytes
++ * here.
++ *
++ * Somebody who knows what the limits actually are
++ * should check this, but for now this is at least
++ * harmless and avoids a valid compiler warning about
++ * using more of the array than we have allocated.
++ */
++ u8 esi[DP_DPRX_ESI_LEN+2] = { 0 };
+ int ret = 0;
+ int retry;
+ bool handled;
+diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c
+index 9b60efe6ec441..ba386e5aa0557 100644
+--- a/drivers/hid/hid-betopff.c
++++ b/drivers/hid/hid-betopff.c
+@@ -63,7 +63,6 @@ static int betopff_init(struct hid_device *hid)
+ struct list_head *report_list =
+ &hid->report_enum[HID_OUTPUT_REPORT].report_list;
+ struct input_dev *dev;
+- int field_count = 0;
+ int error;
+ int i, j;
+
+@@ -89,19 +88,21 @@ static int betopff_init(struct hid_device *hid)
+ * -----------------------------------------
+ * Do init them with default value.
+ */
++ if (report->maxfield < 4) {
++ hid_err(hid, "not enough fields in the report: %d\n",
++ report->maxfield);
++ return -ENODEV;
++ }
+ for (i = 0; i < report->maxfield; i++) {
++ if (report->field[i]->report_count < 1) {
++ hid_err(hid, "no values in the field\n");
++ return -ENODEV;
++ }
+ for (j = 0; j < report->field[i]->report_count; j++) {
+ report->field[i]->value[j] = 0x00;
+- field_count++;
+ }
+ }
+
+- if (field_count < 4) {
+- hid_err(hid, "not enough fields in the report: %d\n",
+- field_count);
+- return -ENODEV;
+- }
+-
+ betopff = kzalloc(sizeof(*betopff), GFP_KERNEL);
+ if (!betopff)
+ return -ENOMEM;
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 62656636d30c6..8cc79d0d11fb2 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -980,8 +980,8 @@ struct hid_report *hid_validate_values(struct hid_device *hid,
+ * Validating on id 0 means we should examine the first
+ * report in the list.
+ */
+- report = list_entry(
+- hid->report_enum[type].report_list.next,
++ report = list_first_entry_or_null(
++ &hid->report_enum[type].report_list,
+ struct hid_report, list);
+ } else {
+ report = hid->report_enum[type].report_id_hash[id];
+diff --git a/drivers/hid/intel-ish-hid/ishtp/dma-if.c b/drivers/hid/intel-ish-hid/ishtp/dma-if.c
+index 2783f36661149..ff4419c8ed4f6 100644
+--- a/drivers/hid/intel-ish-hid/ishtp/dma-if.c
++++ b/drivers/hid/intel-ish-hid/ishtp/dma-if.c
+@@ -113,6 +113,11 @@ void *ishtp_cl_get_dma_send_buf(struct ishtp_device *dev,
+ int required_slots = (size / DMA_SLOT_SIZE)
+ + 1 * (size % DMA_SLOT_SIZE != 0);
+
++ if (!dev->ishtp_dma_tx_map) {
++ dev_err(dev->devc, "Fail to allocate Tx map\n");
++ return NULL;
++ }
++
+ spin_lock_irqsave(&dev->ishtp_dma_tx_lock, flags);
+ for (i = 0; i <= (dev->ishtp_dma_num_slots - required_slots); i++) {
+ free = 1;
+@@ -159,6 +164,11 @@ void ishtp_cl_release_dma_acked_mem(struct ishtp_device *dev,
+ return;
+ }
+
++ if (!dev->ishtp_dma_tx_map) {
++ dev_err(dev->devc, "Fail to allocate Tx map\n");
++ return;
++ }
++
+ i = (msg_addr - dev->ishtp_host_dma_tx_buf) / DMA_SLOT_SIZE;
+ spin_lock_irqsave(&dev->ishtp_dma_tx_lock, flags);
+ for (j = 0; j < acked_slots; j++) {
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+index 4e417ed08b099..dab823aac95e1 100644
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+@@ -325,6 +325,8 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,
+
+ if (!PAGE_ALIGNED(tinfo->vaddr))
+ return -EINVAL;
++ if (tinfo->length == 0)
++ return -EINVAL;
+
+ tidbuf = kzalloc(sizeof(*tidbuf), GFP_KERNEL);
+ if (!tidbuf)
+@@ -335,40 +337,38 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,
+ tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets),
+ GFP_KERNEL);
+ if (!tidbuf->psets) {
+- kfree(tidbuf);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto fail_release_mem;
+ }
+
+ pinned = pin_rcv_pages(fd, tidbuf);
+ if (pinned <= 0) {
+- kfree(tidbuf->psets);
+- kfree(tidbuf);
+- return pinned;
++ ret = (pinned < 0) ? pinned : -ENOSPC;
++ goto fail_unpin;
+ }
+
+ /* Find sets of physically contiguous pages */
+ tidbuf->n_psets = find_phys_blocks(tidbuf, pinned);
+
+- /*
+- * We don't need to access this under a lock since tid_used is per
+- * process and the same process cannot be in hfi1_user_exp_rcv_clear()
+- * and hfi1_user_exp_rcv_setup() at the same time.
+- */
++ /* Reserve the number of expected tids to be used. */
+ spin_lock(&fd->tid_lock);
+ if (fd->tid_used + tidbuf->n_psets > fd->tid_limit)
+ pageset_count = fd->tid_limit - fd->tid_used;
+ else
+ pageset_count = tidbuf->n_psets;
++ fd->tid_used += pageset_count;
+ spin_unlock(&fd->tid_lock);
+
+- if (!pageset_count)
+- goto bail;
++ if (!pageset_count) {
++ ret = -ENOSPC;
++ goto fail_unreserve;
++ }
+
+ ngroups = pageset_count / dd->rcv_entries.group_size;
+ tidlist = kcalloc(pageset_count, sizeof(*tidlist), GFP_KERNEL);
+ if (!tidlist) {
+ ret = -ENOMEM;
+- goto nomem;
++ goto fail_unreserve;
+ }
+
+ tididx = 0;
+@@ -464,43 +464,60 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,
+ }
+ unlock:
+ mutex_unlock(&uctxt->exp_mutex);
+-nomem:
+ hfi1_cdbg(TID, "total mapped: tidpairs:%u pages:%u (%d)", tididx,
+ mapped_pages, ret);
+- if (tididx) {
+- spin_lock(&fd->tid_lock);
+- fd->tid_used += tididx;
+- spin_unlock(&fd->tid_lock);
+- tinfo->tidcnt = tididx;
+- tinfo->length = mapped_pages * PAGE_SIZE;
+-
+- if (copy_to_user(u64_to_user_ptr(tinfo->tidlist),
+- tidlist, sizeof(tidlist[0]) * tididx)) {
+- /*
+- * On failure to copy to the user level, we need to undo
+- * everything done so far so we don't leak resources.
+- */
+- tinfo->tidlist = (unsigned long)&tidlist;
+- hfi1_user_exp_rcv_clear(fd, tinfo);
+- tinfo->tidlist = 0;
+- ret = -EFAULT;
+- goto bail;
+- }
++
++ /* fail if nothing was programmed, set error if none provided */
++ if (tididx == 0) {
++ if (ret >= 0)
++ ret = -ENOSPC;
++ goto fail_unreserve;
+ }
+
+- /*
+- * If not everything was mapped (due to insufficient RcvArray entries,
+- * for example), unpin all unmapped pages so we can pin them nex time.
+- */
+- if (mapped_pages != pinned)
+- unpin_rcv_pages(fd, tidbuf, NULL, mapped_pages,
+- (pinned - mapped_pages), false);
+-bail:
++ /* adjust reserved tid_used to actual count */
++ spin_lock(&fd->tid_lock);
++ fd->tid_used -= pageset_count - tididx;
++ spin_unlock(&fd->tid_lock);
++
++ /* unpin all pages not covered by a TID */
++ unpin_rcv_pages(fd, tidbuf, NULL, mapped_pages, pinned - mapped_pages,
++ false);
++
++ tinfo->tidcnt = tididx;
++ tinfo->length = mapped_pages * PAGE_SIZE;
++
++ if (copy_to_user(u64_to_user_ptr(tinfo->tidlist),
++ tidlist, sizeof(tidlist[0]) * tididx)) {
++ ret = -EFAULT;
++ goto fail_unprogram;
++ }
++
++ kfree(tidbuf->pages);
+ kfree(tidbuf->psets);
++ kfree(tidbuf);
+ kfree(tidlist);
++ return 0;
++
++fail_unprogram:
++ /* unprogram, unmap, and unpin all allocated TIDs */
++ tinfo->tidlist = (unsigned long)tidlist;
++ hfi1_user_exp_rcv_clear(fd, tinfo);
++ tinfo->tidlist = 0;
++ pinned = 0; /* nothing left to unpin */
++ pageset_count = 0; /* nothing left reserved */
++fail_unreserve:
++ spin_lock(&fd->tid_lock);
++ fd->tid_used -= pageset_count;
++ spin_unlock(&fd->tid_lock);
++fail_unpin:
++ if (pinned > 0)
++ unpin_rcv_pages(fd, tidbuf, NULL, 0, pinned, false);
++fail_release_mem:
+ kfree(tidbuf->pages);
++ kfree(tidbuf->psets);
+ kfree(tidbuf);
+- return ret > 0 ? 0 : ret;
++ kfree(tidlist);
++ return ret;
+ }
+
+ int hfi1_user_exp_rcv_clear(struct hfi1_filedata *fd,
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 7dc8ca5fd75f2..c6d393114502d 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -192,7 +192,6 @@ static const char * const smbus_pnp_ids[] = {
+ "SYN3221", /* HP 15-ay000 */
+ "SYN323d", /* HP Spectre X360 13-w013dx */
+ "SYN3257", /* HP Envy 13-ad105ng */
+- "SYN3286", /* HP Laptop 15-da3001TU */
+ NULL
+ };
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+index 4666084eda16a..9d6fe5a892d9c 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+@@ -524,19 +524,28 @@ static void xgbe_disable_vxlan(struct xgbe_prv_data *pdata)
+ netif_dbg(pdata, drv, pdata->netdev, "VXLAN acceleration disabled\n");
+ }
+
++static unsigned int xgbe_get_fc_queue_count(struct xgbe_prv_data *pdata)
++{
++ unsigned int max_q_count = XGMAC_MAX_FLOW_CONTROL_QUEUES;
++
++ /* From MAC ver 30H the TFCR is per priority, instead of per queue */
++ if (XGMAC_GET_BITS(pdata->hw_feat.version, MAC_VR, SNPSVER) >= 0x30)
++ return max_q_count;
++ else
++ return min_t(unsigned int, pdata->tx_q_count, max_q_count);
++}
++
+ static int xgbe_disable_tx_flow_control(struct xgbe_prv_data *pdata)
+ {
+- unsigned int max_q_count, q_count;
+ unsigned int reg, reg_val;
+- unsigned int i;
++ unsigned int i, q_count;
+
+ /* Clear MTL flow control */
+ for (i = 0; i < pdata->rx_q_count; i++)
+ XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQOMR, EHFC, 0);
+
+ /* Clear MAC flow control */
+- max_q_count = XGMAC_MAX_FLOW_CONTROL_QUEUES;
+- q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count);
++ q_count = xgbe_get_fc_queue_count(pdata);
+ reg = MAC_Q0TFCR;
+ for (i = 0; i < q_count; i++) {
+ reg_val = XGMAC_IOREAD(pdata, reg);
+@@ -553,9 +562,8 @@ static int xgbe_enable_tx_flow_control(struct xgbe_prv_data *pdata)
+ {
+ struct ieee_pfc *pfc = pdata->pfc;
+ struct ieee_ets *ets = pdata->ets;
+- unsigned int max_q_count, q_count;
+ unsigned int reg, reg_val;
+- unsigned int i;
++ unsigned int i, q_count;
+
+ /* Set MTL flow control */
+ for (i = 0; i < pdata->rx_q_count; i++) {
+@@ -579,8 +587,7 @@ static int xgbe_enable_tx_flow_control(struct xgbe_prv_data *pdata)
+ }
+
+ /* Set MAC flow control */
+- max_q_count = XGMAC_MAX_FLOW_CONTROL_QUEUES;
+- q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count);
++ q_count = xgbe_get_fc_queue_count(pdata);
+ reg = MAC_Q0TFCR;
+ for (i = 0; i < q_count; i++) {
+ reg_val = XGMAC_IOREAD(pdata, reg);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 97167fc9bebe7..7840eb4cdb8da 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -496,6 +496,7 @@ static enum xgbe_an xgbe_an73_tx_training(struct xgbe_prv_data *pdata,
+ reg |= XGBE_KR_TRAINING_ENABLE;
+ reg |= XGBE_KR_TRAINING_START;
+ XMDIO_WRITE(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_10GBR_PMD_CTRL, reg);
++ pdata->kr_start_time = jiffies;
+
+ netif_dbg(pdata, link, pdata->netdev,
+ "KR training initiated\n");
+@@ -632,6 +633,8 @@ static enum xgbe_an xgbe_an73_incompat_link(struct xgbe_prv_data *pdata)
+
+ xgbe_switch_mode(pdata);
+
++ pdata->an_result = XGBE_AN_READY;
++
+ xgbe_an_restart(pdata);
+
+ return XGBE_AN_INCOMPAT_LINK;
+@@ -1275,9 +1278,30 @@ static bool xgbe_phy_aneg_done(struct xgbe_prv_data *pdata)
+ static void xgbe_check_link_timeout(struct xgbe_prv_data *pdata)
+ {
+ unsigned long link_timeout;
++ unsigned long kr_time;
++ int wait;
+
+ link_timeout = pdata->link_check + (XGBE_LINK_TIMEOUT * HZ);
+ if (time_after(jiffies, link_timeout)) {
++ if ((xgbe_cur_mode(pdata) == XGBE_MODE_KR) &&
++ pdata->phy.autoneg == AUTONEG_ENABLE) {
++ /* AN restart should not happen while KR training is in progress.
++ * The while loop ensures no AN restart during KR training,
++ * waits up to 500ms and AN restart is triggered only if KR
++ * training is failed.
++ */
++ wait = XGBE_KR_TRAINING_WAIT_ITER;
++ while (wait--) {
++ kr_time = pdata->kr_start_time +
++ msecs_to_jiffies(XGBE_AN_MS_TIMEOUT);
++ if (time_after(jiffies, kr_time))
++ break;
++ /* AN restart is not required, if AN result is COMPLETE */
++ if (pdata->an_result == XGBE_AN_COMPLETE)
++ return;
++ usleep_range(10000, 11000);
++ }
++ }
+ netif_dbg(pdata, link, pdata->netdev, "AN link timeout\n");
+ xgbe_phy_config_aneg(pdata);
+ }
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
+index 0c93a552b921d..729307a96c50d 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
+@@ -290,6 +290,7 @@
+ /* Auto-negotiation */
+ #define XGBE_AN_MS_TIMEOUT 500
+ #define XGBE_LINK_TIMEOUT 5
++#define XGBE_KR_TRAINING_WAIT_ITER 50
+
+ #define XGBE_SGMII_AN_LINK_STATUS BIT(1)
+ #define XGBE_SGMII_AN_LINK_SPEED (BIT(2) | BIT(3))
+@@ -1266,6 +1267,7 @@ struct xgbe_prv_data {
+ unsigned int parallel_detect;
+ unsigned int fec_ability;
+ unsigned long an_start;
++ unsigned long kr_start_time;
+ enum xgbe_an_mode an_mode;
+
+ /* I2C support */
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index d1ca3d3f51a7a..2cf144bbef3ee 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -11189,7 +11189,7 @@ static void tg3_reset_task(struct work_struct *work)
+ rtnl_lock();
+ tg3_full_lock(tp, 0);
+
+- if (!netif_running(tp->dev)) {
++ if (tp->pcierr_recovery || !netif_running(tp->dev)) {
+ tg3_flag_clear(tp, RESET_TASK_PENDING);
+ tg3_full_unlock(tp);
+ rtnl_unlock();
+@@ -18240,6 +18240,9 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
+
+ netdev_info(netdev, "PCI I/O error detected\n");
+
++ /* Want to make sure that the reset task doesn't run */
++ tg3_reset_task_cancel(tp);
++
+ rtnl_lock();
+
+ /* Could be second call or maybe we don't have netdev yet */
+@@ -18256,9 +18259,6 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
+
+ tg3_timer_stop(tp);
+
+- /* Want to make sure that the reset task doesn't run */
+- tg3_reset_task_cancel(tp);
+-
+ netif_device_detach(netdev);
+
+ /* Clean up software state, even if MMIO is blocked */
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 50331b202f73b..324d81516832c 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1738,7 +1738,6 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)
+ bool cloned = skb_cloned(*skb) || skb_header_cloned(*skb) ||
+ skb_is_nonlinear(*skb);
+ int padlen = ETH_ZLEN - (*skb)->len;
+- int headroom = skb_headroom(*skb);
+ int tailroom = skb_tailroom(*skb);
+ struct sk_buff *nskb;
+ u32 fcs;
+@@ -1752,9 +1751,6 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)
+ /* FCS could be appeded to tailroom. */
+ if (tailroom >= ETH_FCS_LEN)
+ goto add_fcs;
+- /* FCS could be appeded by moving data to headroom. */
+- else if (!cloned && headroom + tailroom >= ETH_FCS_LEN)
+- padlen = 0;
+ /* No room for FCS, need to reallocate skb. */
+ else
+ padlen = ETH_FCS_LEN;
+@@ -1763,10 +1759,7 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)
+ padlen += ETH_FCS_LEN;
+ }
+
+- if (!cloned && headroom + tailroom >= padlen) {
+- (*skb)->data = memmove((*skb)->head, (*skb)->data, (*skb)->len);
+- skb_set_tail_pointer(*skb, (*skb)->len);
+- } else {
++ if (cloned || tailroom < padlen) {
+ nskb = skb_copy_expand(*skb, 0, padlen, GFP_ATOMIC);
+ if (!nskb)
+ return -ENOMEM;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index a2b25afa24722..e09bd059984e7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1683,7 +1683,7 @@ static void mlx5_core_verify_params(void)
+ }
+ }
+
+-static int __init init(void)
++static int __init mlx5_init(void)
+ {
+ int err;
+
+@@ -1708,7 +1708,7 @@ err_debug:
+ return err;
+ }
+
+-static void __exit cleanup(void)
++static void __exit mlx5_cleanup(void)
+ {
+ #ifdef CONFIG_MLX5_CORE_EN
+ mlx5e_cleanup();
+@@ -1717,5 +1717,5 @@ static void __exit cleanup(void)
+ mlx5_unregister_debugfs();
+ }
+
+-module_init(init);
+-module_exit(cleanup);
++module_init(mlx5_init);
++module_exit(mlx5_cleanup);
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index ff374d0d80a7d..a1906804c139e 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -738,14 +738,14 @@ static void ravb_error_interrupt(struct net_device *ndev)
+ ravb_write(ndev, ~(EIS_QFS | EIS_RESERVED), EIS);
+ if (eis & EIS_QFS) {
+ ris2 = ravb_read(ndev, RIS2);
+- ravb_write(ndev, ~(RIS2_QFF0 | RIS2_RFFF | RIS2_RESERVED),
++ ravb_write(ndev, ~(RIS2_QFF0 | RIS2_QFF1 | RIS2_RFFF | RIS2_RESERVED),
+ RIS2);
+
+ /* Receive Descriptor Empty int */
+ if (ris2 & RIS2_QFF0)
+ priv->stats[RAVB_BE].rx_over_errors++;
+
+- /* Receive Descriptor Empty int */
++ /* Receive Descriptor Empty int */
+ if (ris2 & RIS2_QFF1)
+ priv->stats[RAVB_NC].rx_over_errors++;
+
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index 1d1fbd7bd6fc1..550806351049d 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -103,7 +103,12 @@ EXPORT_SYMBOL(mdiobus_unregister_device);
+
+ struct phy_device *mdiobus_get_phy(struct mii_bus *bus, int addr)
+ {
+- struct mdio_device *mdiodev = bus->mdio_map[addr];
++ struct mdio_device *mdiodev;
++
++ if (addr < 0 || addr >= ARRAY_SIZE(bus->mdio_map))
++ return NULL;
++
++ mdiodev = bus->mdio_map[addr];
+
+ if (!mdiodev)
+ return NULL;
+diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
+index 83640628c47dd..8bee8286e41a1 100644
+--- a/drivers/net/usb/sr9700.c
++++ b/drivers/net/usb/sr9700.c
+@@ -410,7 +410,7 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ /* ignore the CRC length */
+ len = (skb->data[1] | (skb->data[2] << 8)) - 4;
+
+- if (len > ETH_FRAME_LEN || len > skb->len)
++ if (len > ETH_FRAME_LEN || len > skb->len || len < 0)
+ return 0;
+
+ /* the last packet of current skb */
+diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
+index 51e4e92d95a0d..0bbeb61ec3a38 100644
+--- a/drivers/net/wireless/rndis_wlan.c
++++ b/drivers/net/wireless/rndis_wlan.c
+@@ -712,8 +712,8 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len)
+ struct rndis_query *get;
+ struct rndis_query_c *get_c;
+ } u;
+- int ret, buflen;
+- int resplen, respoffs, copylen;
++ int ret;
++ size_t buflen, resplen, respoffs, copylen;
+
+ buflen = *len + sizeof(*u.get);
+ if (buflen < CONTROL_BUFFER_SIZE)
+@@ -748,22 +748,15 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len)
+
+ if (respoffs > buflen) {
+ /* Device returned data offset outside buffer, error. */
+- netdev_dbg(dev->net, "%s(%s): received invalid "
+- "data offset: %d > %d\n", __func__,
+- oid_to_string(oid), respoffs, buflen);
++ netdev_dbg(dev->net,
++ "%s(%s): received invalid data offset: %zu > %zu\n",
++ __func__, oid_to_string(oid), respoffs, buflen);
+
+ ret = -EINVAL;
+ goto exit_unlock;
+ }
+
+- if ((resplen + respoffs) > buflen) {
+- /* Device would have returned more data if buffer would
+- * have been big enough. Copy just the bits that we got.
+- */
+- copylen = buflen - respoffs;
+- } else {
+- copylen = resplen;
+- }
++ copylen = min(resplen, buflen - respoffs);
+
+ if (copylen > *len)
+ copylen = *len;
+diff --git a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+index 5049dac79bd0f..77c1c3ffaed7e 100644
+--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
++++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+@@ -477,8 +477,10 @@ static int rockchip_usb2phy_power_on(struct phy *phy)
+ return ret;
+
+ ret = property_enable(base, &rport->port_cfg->phy_sus, false);
+- if (ret)
++ if (ret) {
++ clk_disable_unprepare(rphy->clk480m);
+ return ret;
++ }
+
+ /* waiting for the utmi_clk to become stable */
+ usleep_range(1500, 2000);
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 13931c5c0eff2..25d9bdd4bc698 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -5771,7 +5771,7 @@ static int hpsa_scsi_host_alloc(struct ctlr_info *h)
+ {
+ struct Scsi_Host *sh;
+
+- sh = scsi_host_alloc(&hpsa_driver_template, sizeof(h));
++ sh = scsi_host_alloc(&hpsa_driver_template, sizeof(struct ctlr_info));
+ if (sh == NULL) {
+ dev_err(&h->pdev->dev, "scsi_host_alloc failed\n");
+ return -ENOMEM;
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 49eb4e3c760f4..48bdb2a3972bc 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -271,6 +271,9 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
+ struct usb_request *req = ffs->ep0req;
+ int ret;
+
++ if (!req)
++ return -EINVAL;
++
+ req->zero = len < le16_to_cpu(ffs->ev.setup.wLength);
+
+ spin_unlock_irq(&ffs->ev.waitq.lock);
+@@ -1807,10 +1810,14 @@ static void functionfs_unbind(struct ffs_data *ffs)
+ ENTER();
+
+ if (!WARN_ON(!ffs->gadget)) {
++ /* dequeue before freeing ep0req */
++ usb_ep_dequeue(ffs->gadget->ep0, ffs->ep0req);
++ mutex_lock(&ffs->mutex);
+ usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
+ ffs->ep0req = NULL;
+ ffs->gadget = NULL;
+ clear_bit(FFS_FL_BOUND, &ffs->flags);
++ mutex_unlock(&ffs->mutex);
+ ffs_data_put(ffs);
+ }
+ }
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index adc437ca83b88..cb3ba2adae642 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -261,7 +261,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ *priv = *priv_match;
+ }
+
+- device_wakeup_enable(hcd->self.controller);
++ device_set_wakeup_capable(&pdev->dev, true);
+
+ xhci->clk = clk;
+ xhci->reg_clk = reg_clk;
+diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
+index 890c038c25f87..cb3650efc29cd 100644
+--- a/drivers/w1/w1.c
++++ b/drivers/w1/w1.c
+@@ -1140,6 +1140,8 @@ int w1_process(void *data)
+ /* remainder if it woke up early */
+ unsigned long jremain = 0;
+
++ atomic_inc(&dev->refcnt);
++
+ for (;;) {
+
+ if (!jremain && dev->search_count) {
+@@ -1167,8 +1169,10 @@ int w1_process(void *data)
+ */
+ mutex_unlock(&dev->list_mutex);
+
+- if (kthread_should_stop())
++ if (kthread_should_stop()) {
++ __set_current_state(TASK_RUNNING);
+ break;
++ }
+
+ /* Only sleep when the search is active. */
+ if (dev->search_count) {
+diff --git a/drivers/w1/w1_int.c b/drivers/w1/w1_int.c
+index 1c776178f598d..eb851eb443005 100644
+--- a/drivers/w1/w1_int.c
++++ b/drivers/w1/w1_int.c
+@@ -60,10 +60,9 @@ static struct w1_master *w1_alloc_dev(u32 id, int slave_count, int slave_ttl,
+ dev->search_count = w1_search_count;
+ dev->enable_pullup = w1_enable_pullup;
+
+- /* 1 for w1_process to decrement
+- * 1 for __w1_remove_master_device to decrement
++ /* For __w1_remove_master_device to decrement
+ */
+- atomic_set(&dev->refcnt, 2);
++ atomic_set(&dev->refcnt, 1);
+
+ INIT_LIST_HEAD(&dev->slist);
+ INIT_LIST_HEAD(&dev->async_list);
+diff --git a/fs/affs/file.c b/fs/affs/file.c
+index ba084b0b214b9..82bb38370aa9a 100644
+--- a/fs/affs/file.c
++++ b/fs/affs/file.c
+@@ -878,7 +878,7 @@ affs_truncate(struct inode *inode)
+ if (inode->i_size > AFFS_I(inode)->mmu_private) {
+ struct address_space *mapping = inode->i_mapping;
+ struct page *page;
+- void *fsdata;
++ void *fsdata = NULL;
+ loff_t isize = inode->i_size;
+ int res;
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index a7ef847f285d3..37e91f27f49ba 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -429,7 +429,8 @@ cifs_reconnect(struct TCP_Server_Info *server)
+ server->ssocket->state, server->ssocket->flags);
+ sock_release(server->ssocket);
+ server->ssocket = NULL;
+- }
++ } else if (cifs_rdma_enabled(server))
++ smbd_destroy(server);
+ server->sequence_number = 0;
+ server->session_estab = false;
+ kfree(server->session_key.response);
+@@ -799,10 +800,8 @@ static void clean_demultiplex_info(struct TCP_Server_Info *server)
+ wake_up_all(&server->request_q);
+ /* give those requests time to exit */
+ msleep(125);
+- if (cifs_rdma_enabled(server) && server->smbd_conn) {
+- smbd_destroy(server->smbd_conn);
+- server->smbd_conn = NULL;
+- }
++ if (cifs_rdma_enabled(server))
++ smbd_destroy(server);
+ if (server->ssocket) {
+ sock_release(server->ssocket);
+ server->ssocket = NULL;
+diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
+index 784628ec4bc40..591cd5c704323 100644
+--- a/fs/cifs/smbdirect.c
++++ b/fs/cifs/smbdirect.c
+@@ -320,6 +320,9 @@ static int smbd_conn_upcall(
+
+ info->transport_status = SMBD_DISCONNECTED;
+ smbd_process_disconnected(info);
++ wake_up(&info->disconn_wait);
++ wake_up_interruptible(&info->wait_reassembly_queue);
++ wake_up_interruptible_all(&info->wait_send_queue);
+ break;
+
+ default:
+@@ -1478,21 +1481,102 @@ static void idle_connection_timer(struct work_struct *work)
+ info->keep_alive_interval*HZ);
+ }
+
+-/* Destroy this SMBD connection, called from upper layer */
+-void smbd_destroy(struct smbd_connection *info)
++/*
++ * Destroy the transport and related RDMA and memory resources
++ * Need to go through all the pending counters and make sure on one is using
++ * the transport while it is destroyed
++ */
++void smbd_destroy(struct TCP_Server_Info *server)
+ {
++ struct smbd_connection *info = server->smbd_conn;
++ struct smbd_response *response;
++ unsigned long flags;
++
++ if (!info) {
++ log_rdma_event(INFO, "rdma session already destroyed\n");
++ return;
++ }
++
+ log_rdma_event(INFO, "destroying rdma session\n");
++ if (info->transport_status != SMBD_DISCONNECTED) {
++ rdma_disconnect(server->smbd_conn->id);
++ log_rdma_event(INFO, "wait for transport being disconnected\n");
++ wait_event(
++ info->disconn_wait,
++ info->transport_status == SMBD_DISCONNECTED);
++ }
+
+- /* Kick off the disconnection process */
+- smbd_disconnect_rdma_connection(info);
++ log_rdma_event(INFO, "destroying qp\n");
++ ib_drain_qp(info->id->qp);
++ rdma_destroy_qp(info->id);
++
++ log_rdma_event(INFO, "cancelling idle timer\n");
++ cancel_delayed_work_sync(&info->idle_timer_work);
++ log_rdma_event(INFO, "cancelling send immediate work\n");
++ cancel_delayed_work_sync(&info->send_immediate_work);
++
++ log_rdma_event(INFO, "wait for all send posted to IB to finish\n");
++ wait_event(info->wait_send_pending,
++ atomic_read(&info->send_pending) == 0);
++ wait_event(info->wait_send_payload_pending,
++ atomic_read(&info->send_payload_pending) == 0);
++
++ /* It's not posssible for upper layer to get to reassembly */
++ log_rdma_event(INFO, "drain the reassembly queue\n");
++ do {
++ spin_lock_irqsave(&info->reassembly_queue_lock, flags);
++ response = _get_first_reassembly(info);
++ if (response) {
++ list_del(&response->list);
++ spin_unlock_irqrestore(
++ &info->reassembly_queue_lock, flags);
++ put_receive_buffer(info, response);
++ } else
++ spin_unlock_irqrestore(
++ &info->reassembly_queue_lock, flags);
++ } while (response);
++ info->reassembly_data_length = 0;
++
++ log_rdma_event(INFO, "free receive buffers\n");
++ wait_event(info->wait_receive_queues,
++ info->count_receive_queue + info->count_empty_packet_queue
++ == info->receive_credit_max);
++ destroy_receive_buffers(info);
++
++ /*
++ * For performance reasons, memory registration and deregistration
++ * are not locked by srv_mutex. It is possible some processes are
++ * blocked on transport srv_mutex while holding memory registration.
++ * Release the transport srv_mutex to allow them to hit the failure
++ * path when sending data, and then release memory registartions.
++ */
++ log_rdma_event(INFO, "freeing mr list\n");
++ wake_up_interruptible_all(&info->wait_mr);
++ while (atomic_read(&info->mr_used_count)) {
++ mutex_unlock(&server->srv_mutex);
++ msleep(1000);
++ mutex_lock(&server->srv_mutex);
++ }
++ destroy_mr_list(info);
++
++ ib_free_cq(info->send_cq);
++ ib_free_cq(info->recv_cq);
++ ib_dealloc_pd(info->pd);
++ rdma_destroy_id(info->id);
+
+- log_rdma_event(INFO, "wait for transport being destroyed\n");
+- wait_event(info->wait_destroy,
+- info->transport_status == SMBD_DESTROYED);
++ /* free mempools */
++ mempool_destroy(info->request_mempool);
++ kmem_cache_destroy(info->request_cache);
++
++ mempool_destroy(info->response_mempool);
++ kmem_cache_destroy(info->response_cache);
++
++ info->transport_status = SMBD_DESTROYED;
+
+ destroy_workqueue(info->workqueue);
+ log_rdma_event(INFO, "rdma session destroyed\n");
+ kfree(info);
++ server->smbd_conn = NULL;
+ }
+
+ /*
+@@ -1514,17 +1598,9 @@ int smbd_reconnect(struct TCP_Server_Info *server)
+ */
+ if (server->smbd_conn->transport_status == SMBD_CONNECTED) {
+ log_rdma_event(INFO, "disconnecting transport\n");
+- smbd_disconnect_rdma_connection(server->smbd_conn);
++ smbd_destroy(server);
+ }
+
+- /* wait until the transport is destroyed */
+- if (!wait_event_timeout(server->smbd_conn->wait_destroy,
+- server->smbd_conn->transport_status == SMBD_DESTROYED, 5*HZ))
+- return -EAGAIN;
+-
+- destroy_workqueue(server->smbd_conn->workqueue);
+- kfree(server->smbd_conn);
+-
+ create_conn:
+ log_rdma_event(INFO, "creating rdma session\n");
+ server->smbd_conn = smbd_get_connection(
+@@ -1741,12 +1817,13 @@ static struct smbd_connection *_smbd_get_connection(
+ conn_param.retry_count = SMBD_CM_RETRY;
+ conn_param.rnr_retry_count = SMBD_CM_RNR_RETRY;
+ conn_param.flow_control = 0;
+- init_waitqueue_head(&info->wait_destroy);
+
+ log_rdma_event(INFO, "connecting to IP %pI4 port %d\n",
+ &addr_in->sin_addr, port);
+
+ init_waitqueue_head(&info->conn_wait);
++ init_waitqueue_head(&info->disconn_wait);
++ init_waitqueue_head(&info->wait_reassembly_queue);
+ rc = rdma_connect(info->id, &conn_param);
+ if (rc) {
+ log_rdma_event(ERR, "rdma_connect() failed with %i\n", rc);
+@@ -1770,8 +1847,6 @@ static struct smbd_connection *_smbd_get_connection(
+ }
+
+ init_waitqueue_head(&info->wait_send_queue);
+- init_waitqueue_head(&info->wait_reassembly_queue);
+-
+ INIT_DELAYED_WORK(&info->idle_timer_work, idle_connection_timer);
+ INIT_DELAYED_WORK(&info->send_immediate_work, send_immediate_work);
+ queue_delayed_work(info->workqueue, &info->idle_timer_work,
+@@ -1812,7 +1887,7 @@ static struct smbd_connection *_smbd_get_connection(
+
+ allocate_mr_failed:
+ /* At this point, need to a full transport shutdown */
+- smbd_destroy(info);
++ smbd_destroy(server);
+ return NULL;
+
+ negotiation_failed:
+diff --git a/fs/cifs/smbdirect.h b/fs/cifs/smbdirect.h
+index b5c240ff21919..b0ca7df414543 100644
+--- a/fs/cifs/smbdirect.h
++++ b/fs/cifs/smbdirect.h
+@@ -71,6 +71,7 @@ struct smbd_connection {
+ struct completion ri_done;
+ wait_queue_head_t conn_wait;
+ wait_queue_head_t wait_destroy;
++ wait_queue_head_t disconn_wait;
+
+ struct completion negotiate_completion;
+ bool negotiate_done;
+@@ -288,7 +289,7 @@ struct smbd_connection *smbd_get_connection(
+ /* Reconnect SMBDirect session */
+ int smbd_reconnect(struct TCP_Server_Info *server);
+ /* Destroy SMBDirect session */
+-void smbd_destroy(struct smbd_connection *info);
++void smbd_destroy(struct TCP_Server_Info *server);
+
+ /* Interface for carrying upper layer I/O through send/recv */
+ int smbd_recv(struct smbd_connection *info, struct msghdr *msg);
+@@ -331,7 +332,7 @@ struct smbd_connection {};
+ static inline void *smbd_get_connection(
+ struct TCP_Server_Info *server, struct sockaddr *dstaddr) {return NULL;}
+ static inline int smbd_reconnect(struct TCP_Server_Info *server) {return -1; }
+-static inline void smbd_destroy(struct smbd_connection *info) {}
++static inline void smbd_destroy(struct TCP_Server_Info *server) {}
+ static inline int smbd_recv(struct smbd_connection *info, struct msghdr *msg) {return -1; }
+ static inline int smbd_send(struct TCP_Server_Info *server, int num_rqst, struct smb_rqst *rqst) {return -1; }
+ #endif
+diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
+index c95f32b83a942..7c62a526506c1 100644
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -13,6 +13,7 @@
+ #include <linux/namei.h>
+ #include <linux/mm.h>
+ #include <linux/module.h>
++#include <linux/kmemleak.h>
+ #include "internal.h"
+
+ static const struct dentry_operations proc_sys_dentry_operations;
+@@ -1376,6 +1377,38 @@ struct ctl_table_header *register_sysctl(const char *path, struct ctl_table *tab
+ }
+ EXPORT_SYMBOL(register_sysctl);
+
++/**
++ * __register_sysctl_init() - register sysctl table to path
++ * @path: path name for sysctl base
++ * @table: This is the sysctl table that needs to be registered to the path
++ * @table_name: The name of sysctl table, only used for log printing when
++ * registration fails
++ *
++ * The sysctl interface is used by userspace to query or modify at runtime
++ * a predefined value set on a variable. These variables however have default
++ * values pre-set. Code which depends on these variables will always work even
++ * if register_sysctl() fails. If register_sysctl() fails you'd just loose the
++ * ability to query or modify the sysctls dynamically at run time. Chances of
++ * register_sysctl() failing on init are extremely low, and so for both reasons
++ * this function does not return any error as it is used by initialization code.
++ *
++ * Context: Can only be called after your respective sysctl base path has been
++ * registered. So for instance, most base directories are registered early on
++ * init before init levels are processed through proc_sys_init() and
++ * sysctl_init().
++ */
++void __init __register_sysctl_init(const char *path, struct ctl_table *table,
++ const char *table_name)
++{
++ struct ctl_table_header *hdr = register_sysctl(path, table);
++
++ if (unlikely(!hdr)) {
++ pr_err("failed when register_sysctl %s to %s\n", table_name, path);
++ return;
++ }
++ kmemleak_not_leak(hdr);
++}
++
+ static char *append_path(const char *path, char *pos, const char *name)
+ {
+ int namelen;
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index 831a542c22c66..e5be1d747c036 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -1443,7 +1443,6 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
+ unsigned long safe_mask = 0;
+ unsigned int commit_max_age = (unsigned int)-1;
+ struct reiserfs_journal *journal = SB_JOURNAL(s);
+- char *new_opts;
+ int err;
+ char *qf_names[REISERFS_MAXQUOTAS];
+ unsigned int qfmt = 0;
+@@ -1451,10 +1450,6 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
+ int i;
+ #endif
+
+- new_opts = kstrdup(arg, GFP_KERNEL);
+- if (arg && !new_opts)
+- return -ENOMEM;
+-
+ sync_filesystem(s);
+ reiserfs_write_lock(s);
+
+@@ -1605,7 +1600,6 @@ out_ok_unlocked:
+ out_err_unlock:
+ reiserfs_write_unlock(s);
+ out_err:
+- kfree(new_opts);
+ return err;
+ }
+
+diff --git a/include/linux/kernel.h b/include/linux/kernel.h
+index 50733abbe548e..a28ec4c2f3f5a 100644
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -327,6 +327,7 @@ extern long (*panic_blink)(int state);
+ __printf(1, 2)
+ void panic(const char *fmt, ...) __noreturn __cold;
+ void nmi_panic(struct pt_regs *regs, const char *msg);
++void check_panic_on_warn(const char *origin);
+ extern void oops_enter(void);
+ extern void oops_exit(void);
+ void print_oops_end_marker(void);
+diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
+index 91401309b1aa2..0ee9aab3e3091 100644
+--- a/include/linux/sched/task.h
++++ b/include/linux/sched/task.h
+@@ -36,6 +36,7 @@ extern int sched_fork(unsigned long clone_flags, struct task_struct *p);
+ extern void sched_dead(struct task_struct *p);
+
+ void __noreturn do_task_dead(void);
++void __noreturn make_task_dead(int signr);
+
+ extern void proc_caches_init(void);
+
+diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
+index b769ecfcc3bd4..0a980aecc8f02 100644
+--- a/include/linux/sysctl.h
++++ b/include/linux/sysctl.h
+@@ -198,6 +198,9 @@ struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path,
+ void unregister_sysctl_table(struct ctl_table_header * table);
+
+ extern int sysctl_init(void);
++extern void __register_sysctl_init(const char *path, struct ctl_table *table,
++ const char *table_name);
++#define register_sysctl_init(path, table) __register_sysctl_init(path, table, #table)
+
+ extern struct ctl_table sysctl_mount_point[];
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 694ee0b1fefea..61f3a31abc1ad 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1012,7 +1012,9 @@ static int check_stack_write(struct bpf_verifier_env *env,
+ bool sanitize = reg && is_spillable_regtype(reg->type);
+
+ for (i = 0; i < size; i++) {
+- if (state->stack[spi].slot_type[i] == STACK_INVALID) {
++ u8 type = state->stack[spi].slot_type[i];
++
++ if (type != STACK_MISC && type != STACK_ZERO) {
+ sanitize = true;
+ break;
+ }
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 908e7a33e1fcb..02360ec3b1225 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -62,12 +62,59 @@
+ #include <linux/random.h>
+ #include <linux/rcuwait.h>
+ #include <linux/compat.h>
++#include <linux/sysfs.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/unistd.h>
+ #include <asm/pgtable.h>
+ #include <asm/mmu_context.h>
+
++/*
++ * The default value should be high enough to not crash a system that randomly
++ * crashes its kernel from time to time, but low enough to at least not permit
++ * overflowing 32-bit refcounts or the ldsem writer count.
++ */
++static unsigned int oops_limit = 10000;
++
++#ifdef CONFIG_SYSCTL
++static struct ctl_table kern_exit_table[] = {
++ {
++ .procname = "oops_limit",
++ .data = &oops_limit,
++ .maxlen = sizeof(oops_limit),
++ .mode = 0644,
++ .proc_handler = proc_douintvec,
++ },
++ { }
++};
++
++static __init int kernel_exit_sysctls_init(void)
++{
++ register_sysctl_init("kernel", kern_exit_table);
++ return 0;
++}
++late_initcall(kernel_exit_sysctls_init);
++#endif
++
++static atomic_t oops_count = ATOMIC_INIT(0);
++
++#ifdef CONFIG_SYSFS
++static ssize_t oops_count_show(struct kobject *kobj, struct kobj_attribute *attr,
++ char *page)
++{
++ return sysfs_emit(page, "%d\n", atomic_read(&oops_count));
++}
++
++static struct kobj_attribute oops_count_attr = __ATTR_RO(oops_count);
++
++static __init int kernel_exit_sysfs_init(void)
++{
++ sysfs_add_file_to_group(kernel_kobj, &oops_count_attr.attr, NULL);
++ return 0;
++}
++late_initcall(kernel_exit_sysfs_init);
++#endif
++
+ static void __unhash_process(struct task_struct *p, bool group_dead)
+ {
+ nr_threads--;
+@@ -922,6 +969,31 @@ void __noreturn do_exit(long code)
+ }
+ EXPORT_SYMBOL_GPL(do_exit);
+
++void __noreturn make_task_dead(int signr)
++{
++ /*
++ * Take the task off the cpu after something catastrophic has
++ * happened.
++ */
++ unsigned int limit;
++
++ /*
++ * Every time the system oopses, if the oops happens while a reference
++ * to an object was held, the reference leaks.
++ * If the oops doesn't also leak memory, repeated oopsing can cause
++ * reference counters to wrap around (if they're not using refcount_t).
++ * This means that repeated oopsing can make unexploitable-looking bugs
++ * exploitable through repeated oopsing.
++ * To make sure this can't happen, place an upper bound on how often the
++ * kernel may oops without panic().
++ */
++ limit = READ_ONCE(oops_limit);
++ if (atomic_inc_return(&oops_count) >= limit && limit)
++ panic("Oopsed too often (kernel.oops_limit is %d)", limit);
++
++ do_exit(signr);
++}
++
+ void complete_and_exit(struct completion *comp, long code)
+ {
+ if (comp)
+diff --git a/kernel/module.c b/kernel/module.c
+index 42a604401c4dd..6ec0b2e0f01f5 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -3478,7 +3478,8 @@ static bool finished_loading(const char *name)
+ sched_annotate_sleep();
+ mutex_lock(&module_mutex);
+ mod = find_module_all(name, strlen(name), true);
+- ret = !mod || mod->state == MODULE_STATE_LIVE;
++ ret = !mod || mod->state == MODULE_STATE_LIVE
++ || mod->state == MODULE_STATE_GOING;
+ mutex_unlock(&module_mutex);
+
+ return ret;
+@@ -3632,20 +3633,35 @@ static int add_unformed_module(struct module *mod)
+
+ mod->state = MODULE_STATE_UNFORMED;
+
+-again:
+ mutex_lock(&module_mutex);
+ old = find_module_all(mod->name, strlen(mod->name), true);
+ if (old != NULL) {
+- if (old->state != MODULE_STATE_LIVE) {
++ if (old->state == MODULE_STATE_COMING
++ || old->state == MODULE_STATE_UNFORMED) {
+ /* Wait in case it fails to load. */
+ mutex_unlock(&module_mutex);
+ err = wait_event_interruptible(module_wq,
+ finished_loading(mod->name));
+ if (err)
+ goto out_unlocked;
+- goto again;
++
++ /* The module might have gone in the meantime. */
++ mutex_lock(&module_mutex);
++ old = find_module_all(mod->name, strlen(mod->name),
++ true);
+ }
+- err = -EEXIST;
++
++ /*
++ * We are here only when the same module was being loaded. Do
++ * not try to load it again right now. It prevents long delays
++ * caused by serialized module load failures. It might happen
++ * when more devices of the same type trigger load of
++ * a particular module.
++ */
++ if (old && old->state == MODULE_STATE_LIVE)
++ err = -EEXIST;
++ else
++ err = -EBUSY;
+ goto out;
+ }
+ mod_update_bounds(mod);
+diff --git a/kernel/panic.c b/kernel/panic.c
+index 8138a676fb7d1..982ecba286c08 100644
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -29,6 +29,7 @@
+ #include <linux/bug.h>
+ #include <linux/ratelimit.h>
+ #include <linux/debugfs.h>
++#include <linux/sysfs.h>
+ #include <asm/sections.h>
+
+ #define PANIC_TIMER_STEP 100
+@@ -42,6 +43,7 @@ static int pause_on_oops_flag;
+ static DEFINE_SPINLOCK(pause_on_oops_lock);
+ bool crash_kexec_post_notifiers;
+ int panic_on_warn __read_mostly;
++static unsigned int warn_limit __read_mostly;
+
+ int panic_timeout = CONFIG_PANIC_TIMEOUT;
+ EXPORT_SYMBOL_GPL(panic_timeout);
+@@ -50,6 +52,45 @@ ATOMIC_NOTIFIER_HEAD(panic_notifier_list);
+
+ EXPORT_SYMBOL(panic_notifier_list);
+
++#ifdef CONFIG_SYSCTL
++static struct ctl_table kern_panic_table[] = {
++ {
++ .procname = "warn_limit",
++ .data = &warn_limit,
++ .maxlen = sizeof(warn_limit),
++ .mode = 0644,
++ .proc_handler = proc_douintvec,
++ },
++ { }
++};
++
++static __init int kernel_panic_sysctls_init(void)
++{
++ register_sysctl_init("kernel", kern_panic_table);
++ return 0;
++}
++late_initcall(kernel_panic_sysctls_init);
++#endif
++
++static atomic_t warn_count = ATOMIC_INIT(0);
++
++#ifdef CONFIG_SYSFS
++static ssize_t warn_count_show(struct kobject *kobj, struct kobj_attribute *attr,
++ char *page)
++{
++ return sysfs_emit(page, "%d\n", atomic_read(&warn_count));
++}
++
++static struct kobj_attribute warn_count_attr = __ATTR_RO(warn_count);
++
++static __init int kernel_panic_sysfs_init(void)
++{
++ sysfs_add_file_to_group(kernel_kobj, &warn_count_attr.attr, NULL);
++ return 0;
++}
++late_initcall(kernel_panic_sysfs_init);
++#endif
++
+ static long no_blink(int state)
+ {
+ return 0;
+@@ -125,6 +166,19 @@ void nmi_panic(struct pt_regs *regs, const char *msg)
+ }
+ EXPORT_SYMBOL(nmi_panic);
+
++void check_panic_on_warn(const char *origin)
++{
++ unsigned int limit;
++
++ if (panic_on_warn)
++ panic("%s: panic_on_warn set ...\n", origin);
++
++ limit = READ_ONCE(warn_limit);
++ if (atomic_inc_return(&warn_count) >= limit && limit)
++ panic("%s: system warned too often (kernel.warn_limit is %d)",
++ origin, limit);
++}
++
+ /**
+ * panic - halt the system
+ * @fmt: The text string to print
+@@ -142,6 +196,16 @@ void panic(const char *fmt, ...)
+ int old_cpu, this_cpu;
+ bool _crash_kexec_post_notifiers = crash_kexec_post_notifiers;
+
++ if (panic_on_warn) {
++ /*
++ * This thread may hit another WARN() in the panic path.
++ * Resetting this prevents additional WARN() from panicking the
++ * system on this thread. Other threads are blocked by the
++ * panic_mutex in panic().
++ */
++ panic_on_warn = 0;
++ }
++
+ /*
+ * Disable local interrupts. This will prevent panic_smp_self_stop
+ * from deadlocking the first cpu that invokes the panic, since
+@@ -530,16 +594,7 @@ void __warn(const char *file, int line, void *caller, unsigned taint,
+ if (args)
+ vprintk(args->fmt, args->args);
+
+- if (panic_on_warn) {
+- /*
+- * This thread may hit another WARN() in the panic path.
+- * Resetting this prevents additional WARN() from panicking the
+- * system on this thread. Other threads are blocked by the
+- * panic_mutex in panic().
+- */
+- panic_on_warn = 0;
+- panic("panic_on_warn set ...\n");
+- }
++ check_panic_on_warn("kernel");
+
+ print_modules();
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index a034642497718..46227cc48124d 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3316,8 +3316,7 @@ static noinline void __schedule_bug(struct task_struct *prev)
+ print_ip_sym(preempt_disable_ip);
+ pr_cont("\n");
+ }
+- if (panic_on_warn)
+- panic("scheduling while atomic\n");
++ check_panic_on_warn("scheduling while atomic");
+
+ dump_stack();
+ add_taint(TAINT_WARN, LOCKDEP_STILL_OK);
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 59ad83499ba25..98abff0462366 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -8674,6 +8674,8 @@ void __init early_trace_init(void)
+ static_key_enable(&tracepoint_printk_key.key);
+ }
+ tracer_alloc_buffers();
++
++ init_events();
+ }
+
+ void __init trace_init(void)
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 74185fb040f33..0923d1b18d1fb 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -1530,6 +1530,7 @@ extern void trace_event_enable_cmd_record(bool enable);
+ extern void trace_event_enable_tgid_record(bool enable);
+
+ extern int event_trace_init(void);
++extern int init_events(void);
+ extern int event_trace_add_tracer(struct dentry *parent, struct trace_array *tr);
+ extern int event_trace_del_tracer(struct trace_array *tr);
+
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 17b15bd978579..a56ee4ba2afbd 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -2314,6 +2314,8 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data,
+ unsigned long fl = flags & ~HIST_FIELD_FL_LOG2;
+ hist_field->fn = hist_field_log2;
+ hist_field->operands[0] = create_hist_field(hist_data, field, fl, NULL);
++ if (!hist_field->operands[0])
++ goto free;
+ hist_field->size = hist_field->operands[0]->size;
+ hist_field->type = kstrdup(hist_field->operands[0]->type, GFP_KERNEL);
+ if (!hist_field->type)
+diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
+index 6e6cc64faa389..62015d62dd6f5 100644
+--- a/kernel/trace/trace_output.c
++++ b/kernel/trace/trace_output.c
+@@ -1395,7 +1395,7 @@ static struct trace_event *events[] __initdata = {
+ NULL
+ };
+
+-__init static int init_events(void)
++__init int init_events(void)
+ {
+ struct trace_event *event;
+ int i, ret;
+@@ -1413,4 +1413,3 @@ __init static int init_events(void)
+
+ return 0;
+ }
+-early_initcall(init_events);
+diff --git a/mm/kasan/report.c b/mm/kasan/report.c
+index 5c169aa688fde..3ae996824a040 100644
+--- a/mm/kasan/report.c
++++ b/mm/kasan/report.c
+@@ -176,8 +176,7 @@ static void kasan_end_report(unsigned long *flags)
+ pr_err("==================================================================\n");
+ add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
+ spin_unlock_irqrestore(&report_lock, *flags);
+- if (panic_on_warn)
+- panic("panic_on_warn set ...\n");
++ check_panic_on_warn("KASAN");
+ kasan_enable_current();
+ }
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index e87777255c474..497c8ac140d13 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1519,6 +1519,7 @@ static int hci_dev_do_open(struct hci_dev *hdev)
+ hdev->flush(hdev);
+
+ if (hdev->sent_cmd) {
++ cancel_delayed_work_sync(&hdev->cmd_timer);
+ kfree_skb(hdev->sent_cmd);
+ hdev->sent_cmd = NULL;
+ }
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 56c240c98a567..a87774424829c 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -132,12 +132,12 @@ static int ops_init(const struct pernet_operations *ops, struct net *net)
+ return 0;
+
+ if (ops->id && ops->size) {
+-cleanup:
+ ng = rcu_dereference_protected(net->gen,
+ lockdep_is_held(&pernet_ops_rwsem));
+ ng->ptr[*ops->id] = NULL;
+ }
+
++cleanup:
+ kfree(data);
+
+ out:
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index 3c58019f07187..d64522af9c3a8 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -579,8 +579,20 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)
+ spin_lock(lock);
+ if (osk) {
+ WARN_ON_ONCE(sk->sk_hash != osk->sk_hash);
+- ret = sk_nulls_del_node_init_rcu(osk);
+- } else if (found_dup_sk) {
++ ret = sk_hashed(osk);
++ if (ret) {
++ /* Before deleting the node, we insert a new one to make
++ * sure that the look-up-sk process would not miss either
++ * of them and that at least one node would exist in ehash
++ * table all the time. Otherwise there's a tiny chance
++ * that lookup process could find nothing in ehash table.
++ */
++ __sk_nulls_add_node_tail_rcu(sk, list);
++ sk_nulls_del_node_init_rcu(osk);
++ }
++ goto unlock;
++ }
++ if (found_dup_sk) {
+ *found_dup_sk = inet_ehash_lookup_by_sk(sk, list);
+ if (*found_dup_sk)
+ ret = false;
+@@ -589,6 +601,7 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)
+ if (ret)
+ __sk_nulls_add_node_rcu(sk, list);
+
++unlock:
+ spin_unlock(lock);
+
+ return ret;
+diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
+index 88c5069b5d20c..fedd19c22b392 100644
+--- a/net/ipv4/inet_timewait_sock.c
++++ b/net/ipv4/inet_timewait_sock.c
+@@ -80,10 +80,10 @@ void inet_twsk_put(struct inet_timewait_sock *tw)
+ }
+ EXPORT_SYMBOL_GPL(inet_twsk_put);
+
+-static void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw,
+- struct hlist_nulls_head *list)
++static void inet_twsk_add_node_tail_rcu(struct inet_timewait_sock *tw,
++ struct hlist_nulls_head *list)
+ {
+- hlist_nulls_add_head_rcu(&tw->tw_node, list);
++ hlist_nulls_add_tail_rcu(&tw->tw_node, list);
+ }
+
+ static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw,
+@@ -119,7 +119,7 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
+
+ spin_lock(lock);
+
+- inet_twsk_add_node_rcu(tw, &ehead->chain);
++ inet_twsk_add_node_tail_rcu(tw, &ehead->chain);
+
+ /* Step 3: Remove SK from hash chain */
+ if (__sk_nulls_del_node_init_rcu(sk))
+diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c
+index 04311f7067e2e..9a6b01d85cd07 100644
+--- a/net/ipv4/metrics.c
++++ b/net/ipv4/metrics.c
+@@ -1,4 +1,5 @@
+ #include <linux/netlink.h>
++#include <linux/nospec.h>
+ #include <linux/rtnetlink.h>
+ #include <linux/types.h>
+ #include <net/ip.h>
+@@ -24,6 +25,7 @@ int ip_metrics_convert(struct net *net, struct nlattr *fc_mx, int fc_mx_len,
+ if (type > RTAX_MAX)
+ return -EINVAL;
+
++ type = array_index_nospec(type, RTAX_MAX + 1);
+ if (type == RTAX_CC_ALGO) {
+ char tmp[TCP_CA_NAME_MAX];
+
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index e617a98f4df61..00601bc4fdfa3 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1154,14 +1154,16 @@ static void ip6gre_tnl_link_config_route(struct ip6_tnl *t, int set_mtu,
+ dev->needed_headroom = dst_len;
+
+ if (set_mtu) {
+- dev->mtu = rt->dst.dev->mtu - t_hlen;
++ int mtu = rt->dst.dev->mtu - t_hlen;
++
+ if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+- dev->mtu -= 8;
++ mtu -= 8;
+ if (dev->type == ARPHRD_ETHER)
+- dev->mtu -= ETH_HLEN;
++ mtu -= ETH_HLEN;
+
+- if (dev->mtu < IPV6_MIN_MTU)
+- dev->mtu = IPV6_MIN_MTU;
++ if (mtu < IPV6_MIN_MTU)
++ mtu = IPV6_MIN_MTU;
++ WRITE_ONCE(dev->mtu, mtu);
+ }
+ }
+ ip6_rt_put(rt);
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index b647a40376795..75a1ec2605fca 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1435,6 +1435,7 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
+ struct __ip6_tnl_parm *p = &t->parms;
+ struct flowi6 *fl6 = &t->fl.u.ip6;
+ int t_hlen;
++ int mtu;
+
+ memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
+ memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
+@@ -1477,12 +1478,13 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
+ dev->hard_header_len = rt->dst.dev->hard_header_len +
+ t_hlen;
+
+- dev->mtu = rt->dst.dev->mtu - t_hlen;
++ mtu = rt->dst.dev->mtu - t_hlen;
+ if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+- dev->mtu -= 8;
++ mtu -= 8;
+
+- if (dev->mtu < IPV6_MIN_MTU)
+- dev->mtu = IPV6_MIN_MTU;
++ if (mtu < IPV6_MIN_MTU)
++ mtu = IPV6_MIN_MTU;
++ WRITE_ONCE(dev->mtu, mtu);
+ }
+ ip6_rt_put(rt);
+ }
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 420b9fcc10d7d..df734fe64d10a 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1082,10 +1082,12 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
+
+ if (tdev && !netif_is_l3_master(tdev)) {
+ int t_hlen = tunnel->hlen + sizeof(struct iphdr);
++ int mtu;
+
+- dev->mtu = tdev->mtu - t_hlen;
+- if (dev->mtu < IPV6_MIN_MTU)
+- dev->mtu = IPV6_MIN_MTU;
++ mtu = tdev->mtu - t_hlen;
++ if (mtu < IPV6_MIN_MTU)
++ mtu = IPV6_MIN_MTU;
++ WRITE_ONCE(dev->mtu, mtu);
+ }
+ }
+
+diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
+index 8cb62805fd684..cadeb22a48f23 100644
+--- a/net/netfilter/nf_conntrack_proto_sctp.c
++++ b/net/netfilter/nf_conntrack_proto_sctp.c
+@@ -317,22 +317,29 @@ static int sctp_packet(struct nf_conn *ct,
+ for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
+ /* Special cases of Verification tag check (Sec 8.5.1) */
+ if (sch->type == SCTP_CID_INIT) {
+- /* Sec 8.5.1 (A) */
++ /* (A) vtag MUST be zero */
+ if (sh->vtag != 0)
+ goto out_unlock;
+ } else if (sch->type == SCTP_CID_ABORT) {
+- /* Sec 8.5.1 (B) */
+- if (sh->vtag != ct->proto.sctp.vtag[dir] &&
+- sh->vtag != ct->proto.sctp.vtag[!dir])
++ /* (B) vtag MUST match own vtag if T flag is unset OR
++ * MUST match peer's vtag if T flag is set
++ */
++ if ((!(sch->flags & SCTP_CHUNK_FLAG_T) &&
++ sh->vtag != ct->proto.sctp.vtag[dir]) ||
++ ((sch->flags & SCTP_CHUNK_FLAG_T) &&
++ sh->vtag != ct->proto.sctp.vtag[!dir]))
+ goto out_unlock;
+ } else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
+- /* Sec 8.5.1 (C) */
+- if (sh->vtag != ct->proto.sctp.vtag[dir] &&
+- sh->vtag != ct->proto.sctp.vtag[!dir] &&
+- sch->flags & SCTP_CHUNK_FLAG_T)
++ /* (C) vtag MUST match own vtag if T flag is unset OR
++ * MUST match peer's vtag if T flag is set
++ */
++ if ((!(sch->flags & SCTP_CHUNK_FLAG_T) &&
++ sh->vtag != ct->proto.sctp.vtag[dir]) ||
++ ((sch->flags & SCTP_CHUNK_FLAG_T) &&
++ sh->vtag != ct->proto.sctp.vtag[!dir]))
+ goto out_unlock;
+ } else if (sch->type == SCTP_CID_COOKIE_ECHO) {
+- /* Sec 8.5.1 (D) */
++ /* (D) vtag must be same as init_vtag as found in INIT_ACK */
+ if (sh->vtag != ct->proto.sctp.vtag[dir])
+ goto out_unlock;
+ } else if (sch->type == SCTP_CID_HEARTBEAT) {
+diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
+index 66cda5e2d6b9e..955b73a9a05ed 100644
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -1094,6 +1094,16 @@ static int tcp_packet(struct nf_conn *ct,
+ nf_ct_kill_acct(ct, ctinfo, skb);
+ return NF_ACCEPT;
+ }
++
++ if (index == TCP_SYN_SET && old_state == TCP_CONNTRACK_SYN_SENT) {
++ /* do not renew timeout on SYN retransmit.
++ *
++ * Else port reuse by client or NAT middlebox can keep
++ * entry alive indefinitely (including nat info).
++ */
++ return NF_ACCEPT;
++ }
++
+ /* ESTABLISHED without SEEN_REPLY, i.e. mid-connection
+ * pickup with loose=1. Avoid large ESTABLISHED timeout.
+ */
+diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
+index 84d317418d184..78a0f42837870 100644
+--- a/net/netfilter/nft_set_rbtree.c
++++ b/net/netfilter/nft_set_rbtree.c
+@@ -375,23 +375,37 @@ static void nft_rbtree_gc(struct work_struct *work)
+ struct nft_rbtree *priv;
+ struct rb_node *node;
+ struct nft_set *set;
++ struct net *net;
++ u8 genmask;
+
+ priv = container_of(work, struct nft_rbtree, gc_work.work);
+ set = nft_set_container_of(priv);
++ net = read_pnet(&set->net);
++ genmask = nft_genmask_cur(net);
+
+ write_lock_bh(&priv->lock);
+ write_seqcount_begin(&priv->count);
+ for (node = rb_first(&priv->root); node != NULL; node = rb_next(node)) {
+ rbe = rb_entry(node, struct nft_rbtree_elem, node);
+
++ if (!nft_set_elem_active(&rbe->ext, genmask))
++ continue;
++
++ /* elements are reversed in the rbtree for historical reasons,
++ * from highest to lowest value, that is why end element is
++ * always visited before the start element.
++ */
+ if (nft_rbtree_interval_end(rbe)) {
+ rbe_end = rbe;
+ continue;
+ }
+ if (!nft_set_elem_expired(&rbe->ext))
+ continue;
+- if (nft_set_elem_mark_busy(&rbe->ext))
++
++ if (nft_set_elem_mark_busy(&rbe->ext)) {
++ rbe_end = NULL;
+ continue;
++ }
+
+ if (rbe_prev) {
+ rb_erase(&rbe_prev->node, &priv->root);
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 6ffa83319d08b..6a49c0aa55bda 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -578,12 +578,9 @@ static int netlink_insert(struct sock *sk, u32 portid)
+ if (nlk_sk(sk)->bound)
+ goto err;
+
+- err = -ENOMEM;
+- if (BITS_PER_LONG > 32 &&
+- unlikely(atomic_read(&table->hash.nelems) >= UINT_MAX))
+- goto err;
++ /* portid can be read locklessly from netlink_getname(). */
++ WRITE_ONCE(nlk_sk(sk)->portid, portid);
+
+- nlk_sk(sk)->portid = portid;
+ sock_hold(sk);
+
+ err = __netlink_insert(table, sk);
+@@ -1093,9 +1090,11 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
+ return -EINVAL;
+
+ if (addr->sa_family == AF_UNSPEC) {
+- sk->sk_state = NETLINK_UNCONNECTED;
+- nlk->dst_portid = 0;
+- nlk->dst_group = 0;
++ /* paired with READ_ONCE() in netlink_getsockbyportid() */
++ WRITE_ONCE(sk->sk_state, NETLINK_UNCONNECTED);
++ /* dst_portid and dst_group can be read locklessly */
++ WRITE_ONCE(nlk->dst_portid, 0);
++ WRITE_ONCE(nlk->dst_group, 0);
+ return 0;
+ }
+ if (addr->sa_family != AF_NETLINK)
+@@ -1116,9 +1115,11 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
+ err = netlink_autobind(sock);
+
+ if (err == 0) {
+- sk->sk_state = NETLINK_CONNECTED;
+- nlk->dst_portid = nladdr->nl_pid;
+- nlk->dst_group = ffs(nladdr->nl_groups);
++ /* paired with READ_ONCE() in netlink_getsockbyportid() */
++ WRITE_ONCE(sk->sk_state, NETLINK_CONNECTED);
++ /* dst_portid and dst_group can be read locklessly */
++ WRITE_ONCE(nlk->dst_portid, nladdr->nl_pid);
++ WRITE_ONCE(nlk->dst_group, ffs(nladdr->nl_groups));
+ }
+
+ return err;
+@@ -1135,10 +1136,12 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr,
+ nladdr->nl_pad = 0;
+
+ if (peer) {
+- nladdr->nl_pid = nlk->dst_portid;
+- nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
++ /* Paired with WRITE_ONCE() in netlink_connect() */
++ nladdr->nl_pid = READ_ONCE(nlk->dst_portid);
++ nladdr->nl_groups = netlink_group_mask(READ_ONCE(nlk->dst_group));
+ } else {
+- nladdr->nl_pid = nlk->portid;
++ /* Paired with WRITE_ONCE() in netlink_insert() */
++ nladdr->nl_pid = READ_ONCE(nlk->portid);
+ netlink_lock_table();
+ nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
+ netlink_unlock_table();
+@@ -1165,8 +1168,9 @@ static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)
+
+ /* Don't bother queuing skb if kernel socket has no input function */
+ nlk = nlk_sk(sock);
+- if (sock->sk_state == NETLINK_CONNECTED &&
+- nlk->dst_portid != nlk_sk(ssk)->portid) {
++ /* dst_portid and sk_state can be changed in netlink_connect() */
++ if (READ_ONCE(sock->sk_state) == NETLINK_CONNECTED &&
++ READ_ONCE(nlk->dst_portid) != nlk_sk(ssk)->portid) {
+ sock_put(sock);
+ return ERR_PTR(-ECONNREFUSED);
+ }
+@@ -1878,8 +1882,9 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ goto out;
+ netlink_skb_flags |= NETLINK_SKB_DST;
+ } else {
+- dst_portid = nlk->dst_portid;
+- dst_group = nlk->dst_group;
++ /* Paired with WRITE_ONCE() in netlink_connect() */
++ dst_portid = READ_ONCE(nlk->dst_portid);
++ dst_group = READ_ONCE(nlk->dst_group);
+ }
+
+ /* Paired with WRITE_ONCE() in netlink_insert() */
+diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
+index 426d496095244..2bf99bd5be58c 100644
+--- a/net/netrom/nr_timer.c
++++ b/net/netrom/nr_timer.c
+@@ -124,6 +124,7 @@ static void nr_heartbeat_expiry(struct timer_list *t)
+ is accepted() it isn't 'dead' so doesn't get removed. */
+ if (sock_flag(sk, SOCK_DESTROY) ||
+ (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) {
++ sock_hold(sk);
+ bh_unlock_sock(sk);
+ nr_destroy_socket(sk);
+ goto out;
+diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
+index 4fa015208aab1..3290f2275b857 100644
+--- a/net/nfc/llcp_core.c
++++ b/net/nfc/llcp_core.c
+@@ -171,6 +171,7 @@ static void local_cleanup(struct nfc_llcp_local *local)
+ cancel_work_sync(&local->rx_work);
+ cancel_work_sync(&local->timeout_work);
+ kfree_skb(local->rx_pending);
++ local->rx_pending = NULL;
+ del_timer_sync(&local->sdreq_timer);
+ cancel_work_sync(&local->sdreq_timeout_work);
+ nfc_llcp_free_sdp_tlv_list(&local->pending_sdreqs);
+diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
+index f8a2832456728..d723942e5e65d 100644
+--- a/net/sctp/bind_addr.c
++++ b/net/sctp/bind_addr.c
+@@ -88,6 +88,12 @@ int sctp_bind_addr_copy(struct net *net, struct sctp_bind_addr *dest,
+ }
+ }
+
++ /* If somehow no addresses were found that can be used with this
++ * scope, it's an error.
++ */
++ if (list_empty(&dest->address_list))
++ error = -ENETUNREACH;
++
+ out:
+ if (error)
+ sctp_bind_addr_clean(dest);
+diff --git a/security/tomoyo/Makefile b/security/tomoyo/Makefile
+index cca5a3012fee2..221eaadffb09c 100644
+--- a/security/tomoyo/Makefile
++++ b/security/tomoyo/Makefile
+@@ -10,7 +10,7 @@ endef
+ quiet_cmd_policy = POLICY $@
+ cmd_policy = ($(call do_policy,profile); $(call do_policy,exception_policy); $(call do_policy,domain_policy); $(call do_policy,manager); $(call do_policy,stat)) >$@
+
+-$(obj)/builtin-policy.h: $(wildcard $(obj)/policy/*.conf $(src)/policy/*.conf.default) FORCE
++$(obj)/builtin-policy.h: $(wildcard $(obj)/policy/*.conf $(srctree)/$(src)/policy/*.conf.default) FORCE
+ $(call if_changed,policy)
+
+ $(obj)/common.o: $(obj)/builtin-policy.h
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index c0ab27368a345..55f3e7fa1c5d0 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -159,6 +159,7 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
+ "panic",
+ "do_exit",
+ "do_task_dead",
++ "make_task_dead",
+ "__module_put_and_exit",
+ "complete_and_exit",
+ "kvm_spurious_fault",
+@@ -167,7 +168,7 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
+ "fortify_panic",
+ "usercopy_abort",
+ "machine_real_restart",
+- "rewind_stack_do_exit",
++ "rewind_stack_and_make_dead",
+ };
+
+ if (func->bind == STB_WEAK)
+diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c
+index 4c23779e271a3..3641a96a2de4a 100644
+--- a/tools/perf/util/env.c
++++ b/tools/perf/util/env.c
+@@ -163,11 +163,11 @@ static const char *normalize_arch(char *arch)
+
+ const char *perf_env__arch(struct perf_env *env)
+ {
+- struct utsname uts;
+ char *arch_name;
+
+ if (!env || !env->arch) { /* Assume local operation */
+- if (uname(&uts) < 0)
++ static struct utsname uts = { .machine[0] = '\0', };
++ if (uts.machine[0] == '\0' && uname(&uts) < 0)
+ return NULL;
+ arch_name = uts.machine;
+ } else
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-02-22 14:51 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2023-02-22 14:51 UTC (permalink / raw
To: gentoo-commits
commit: dca312933d750be394361d9d95540dbd023aefd3
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 22 13:37:22 2023 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Feb 22 14:50:54 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dca31293
Linux patch 4.19.273
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1272_linux-4.19.273.patch | 35350 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 35354 insertions(+)
diff --git a/0000_README b/0000_README
index e471309d..a6113983 100644
--- a/0000_README
+++ b/0000_README
@@ -1131,6 +1131,10 @@ Patch: 1271_linux-4.19.272.patch
From: https://www.kernel.org
Desc: Linux 4.19.272
+Patch: 1272_linux-4.19.273.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.273
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1272_linux-4.19.273.patch b/1272_linux-4.19.273.patch
new file mode 100644
index 00000000..40eb2545
--- /dev/null
+++ b/1272_linux-4.19.273.patch
@@ -0,0 +1,35350 @@
+diff --git a/Makefile b/Makefile
+index e3822e492543a..bbc26e110a13d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 272
++SUBLEVEL = 273
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+index 3c34f14fa5086..90e9cbcc891f2 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+@@ -167,7 +167,7 @@
+ sd_emmc_b: sd@5000 {
+ compatible = "amlogic,meson-axg-mmc";
+ reg = <0x0 0x5000 0x0 0x800>;
+- interrupts = <GIC_SPI 217 IRQ_TYPE_EDGE_RISING>;
++ interrupts = <GIC_SPI 217 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ clocks = <&clkc CLKID_SD_EMMC_B>,
+ <&clkc CLKID_SD_EMMC_B_CLK0>,
+@@ -179,7 +179,7 @@
+ sd_emmc_c: mmc@7000 {
+ compatible = "amlogic,meson-axg-mmc";
+ reg = <0x0 0x7000 0x0 0x800>;
+- interrupts = <GIC_SPI 218 IRQ_TYPE_EDGE_RISING>;
++ interrupts = <GIC_SPI 218 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ clocks = <&clkc CLKID_SD_EMMC_C>,
+ <&clkc CLKID_SD_EMMC_C_CLK0>,
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+index 4252119bfd901..a127657526c7f 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+@@ -470,21 +470,21 @@
+ sd_emmc_a: mmc@70000 {
+ compatible = "amlogic,meson-gx-mmc", "amlogic,meson-gxbb-mmc";
+ reg = <0x0 0x70000 0x0 0x800>;
+- interrupts = <GIC_SPI 216 IRQ_TYPE_EDGE_RISING>;
++ interrupts = <GIC_SPI 216 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ };
+
+ sd_emmc_b: mmc@72000 {
+ compatible = "amlogic,meson-gx-mmc", "amlogic,meson-gxbb-mmc";
+ reg = <0x0 0x72000 0x0 0x800>;
+- interrupts = <GIC_SPI 217 IRQ_TYPE_EDGE_RISING>;
++ interrupts = <GIC_SPI 217 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ };
+
+ sd_emmc_c: mmc@74000 {
+ compatible = "amlogic,meson-gx-mmc", "amlogic,meson-gxbb-mmc";
+ reg = <0x0 0x74000 0x0 0x800>;
+- interrupts = <GIC_SPI 218 IRQ_TYPE_EDGE_RISING>;
++ interrupts = <GIC_SPI 218 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ };
+ };
+diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c
+index 6d471c00c71af..906b7c8825879 100644
+--- a/arch/parisc/kernel/firmware.c
++++ b/arch/parisc/kernel/firmware.c
+@@ -1197,7 +1197,7 @@ static char __attribute__((aligned(64))) iodc_dbuf[4096];
+ */
+ int pdc_iodc_print(const unsigned char *str, unsigned count)
+ {
+- unsigned int i;
++ unsigned int i, found = 0;
+ unsigned long flags;
+
+ for (i = 0; i < count;) {
+@@ -1206,6 +1206,7 @@ int pdc_iodc_print(const unsigned char *str, unsigned count)
+ iodc_dbuf[i+0] = '\r';
+ iodc_dbuf[i+1] = '\n';
+ i += 2;
++ found = 1;
+ goto print;
+ default:
+ iodc_dbuf[i] = str[i];
+@@ -1222,7 +1223,7 @@ print:
+ __pa(iodc_retbuf), 0, __pa(iodc_dbuf), i, 0);
+ spin_unlock_irqrestore(&pdc_lock, flags);
+
+- return i;
++ return i - found;
+ }
+
+ #if !defined(BOOTLOADER)
+diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
+index de2998cb189e8..bc94acdbf478b 100644
+--- a/arch/parisc/kernel/ptrace.c
++++ b/arch/parisc/kernel/ptrace.c
+@@ -128,6 +128,12 @@ long arch_ptrace(struct task_struct *child, long request,
+ unsigned long tmp;
+ long ret = -EIO;
+
++ unsigned long user_regs_struct_size = sizeof(struct user_regs_struct);
++#ifdef CONFIG_64BIT
++ if (is_compat_task())
++ user_regs_struct_size /= 2;
++#endif
++
+ switch (request) {
+
+ /* Read the word at location addr in the USER area. For ptraced
+@@ -183,14 +189,14 @@ long arch_ptrace(struct task_struct *child, long request,
+ return copy_regset_to_user(child,
+ task_user_regset_view(current),
+ REGSET_GENERAL,
+- 0, sizeof(struct user_regs_struct),
++ 0, user_regs_struct_size,
+ datap);
+
+ case PTRACE_SETREGS: /* Set all gp regs in the child. */
+ return copy_regset_from_user(child,
+ task_user_regset_view(current),
+ REGSET_GENERAL,
+- 0, sizeof(struct user_regs_struct),
++ 0, user_regs_struct_size,
+ datap);
+
+ case PTRACE_GETFPREGS: /* Get the child FPU state. */
+@@ -304,6 +310,11 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+ }
+ }
+ break;
++ case PTRACE_GETREGS:
++ case PTRACE_SETREGS:
++ case PTRACE_GETFPREGS:
++ case PTRACE_SETFPREGS:
++ return arch_ptrace(child, request, addr, data);
+
+ default:
+ ret = compat_ptrace_request(child, request, addr, data);
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index e6d09ad417e5b..a374e255336b3 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -72,6 +72,9 @@ ifeq ($(CONFIG_MODULE_SECTIONS),y)
+ KBUILD_LDFLAGS_MODULE += -T $(srctree)/arch/riscv/kernel/module.lds
+ endif
+
++# Avoid generating .eh_frame sections.
++KBUILD_CFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables
++
+ KBUILD_CFLAGS_MODULE += $(call cc-option,-mno-relax)
+ KBUILD_AFLAGS_MODULE += $(call as-option,-Wa$(comma)-mno-relax)
+
+diff --git a/arch/riscv/mm/cacheflush.c b/arch/riscv/mm/cacheflush.c
+index 498c0a0814fe3..62f8be2fdbb82 100644
+--- a/arch/riscv/mm/cacheflush.c
++++ b/arch/riscv/mm/cacheflush.c
+@@ -18,6 +18,8 @@ void flush_icache_pte(pte_t pte)
+ {
+ struct page *page = pte_page(pte);
+
+- if (!test_and_set_bit(PG_dcache_clean, &page->flags))
++ if (!test_bit(PG_dcache_clean, &page->flags)) {
+ flush_icache_all();
++ set_bit(PG_dcache_clean, &page->flags);
++ }
+ }
+diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
+index a3a570df6be1c..9692ccc583bb3 100644
+--- a/arch/x86/kernel/fpu/init.c
++++ b/arch/x86/kernel/fpu/init.c
+@@ -138,6 +138,9 @@ static void __init fpu__init_system_generic(void)
+ unsigned int fpu_kernel_xstate_size;
+ EXPORT_SYMBOL_GPL(fpu_kernel_xstate_size);
+
++/* Get alignment of the TYPE. */
++#define TYPE_ALIGN(TYPE) offsetof(struct { char x; TYPE test; }, test)
++
+ /*
+ * Enforce that 'MEMBER' is the last field of 'TYPE'.
+ *
+@@ -145,8 +148,8 @@ EXPORT_SYMBOL_GPL(fpu_kernel_xstate_size);
+ * because that's how C aligns structs.
+ */
+ #define CHECK_MEMBER_AT_END_OF(TYPE, MEMBER) \
+- BUILD_BUG_ON(sizeof(TYPE) != \
+- ALIGN(offsetofend(TYPE, MEMBER), _Alignof(TYPE)))
++ BUILD_BUG_ON(sizeof(TYPE) != ALIGN(offsetofend(TYPE, MEMBER), \
++ TYPE_ALIGN(TYPE)))
+
+ /*
+ * We append the 'struct fpu' to the task_struct:
+diff --git a/arch/x86/kvm/Makefile b/arch/x86/kvm/Makefile
+index dc4f2fdf5e579..13fd54de5449b 100644
+--- a/arch/x86/kvm/Makefile
++++ b/arch/x86/kvm/Makefile
+@@ -16,7 +16,7 @@ kvm-y += x86.o mmu.o emulate.o i8259.o irq.o lapic.o \
+ i8254.o ioapic.o irq_comm.o cpuid.o pmu.o mtrr.o \
+ hyperv.o page_track.o debugfs.o
+
+-kvm-intel-y += vmx.o pmu_intel.o
++kvm-intel-y += vmx/vmx.o vmx/pmu_intel.o
+ kvm-amd-y += svm.o pmu_amd.o
+
+ obj-$(CONFIG_KVM) += kvm.o
+diff --git a/arch/x86/kvm/pmu_intel.c b/arch/x86/kvm/pmu_intel.c
+deleted file mode 100644
+index 611f9e60f8154..0000000000000
+--- a/arch/x86/kvm/pmu_intel.c
++++ /dev/null
+@@ -1,374 +0,0 @@
+-/*
+- * KVM PMU support for Intel CPUs
+- *
+- * Copyright 2011 Red Hat, Inc. and/or its affiliates.
+- *
+- * Authors:
+- * Avi Kivity <avi@redhat.com>
+- * Gleb Natapov <gleb@redhat.com>
+- *
+- * This work is licensed under the terms of the GNU GPL, version 2. See
+- * the COPYING file in the top-level directory.
+- *
+- */
+-#include <linux/types.h>
+-#include <linux/kvm_host.h>
+-#include <linux/perf_event.h>
+-#include <asm/perf_event.h>
+-#include "x86.h"
+-#include "cpuid.h"
+-#include "lapic.h"
+-#include "pmu.h"
+-
+-static struct kvm_event_hw_type_mapping intel_arch_events[] = {
+- /* Index must match CPUID 0x0A.EBX bit vector */
+- [0] = { 0x3c, 0x00, PERF_COUNT_HW_CPU_CYCLES },
+- [1] = { 0xc0, 0x00, PERF_COUNT_HW_INSTRUCTIONS },
+- [2] = { 0x3c, 0x01, PERF_COUNT_HW_BUS_CYCLES },
+- [3] = { 0x2e, 0x4f, PERF_COUNT_HW_CACHE_REFERENCES },
+- [4] = { 0x2e, 0x41, PERF_COUNT_HW_CACHE_MISSES },
+- [5] = { 0xc4, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS },
+- [6] = { 0xc5, 0x00, PERF_COUNT_HW_BRANCH_MISSES },
+- [7] = { 0x00, 0x03, PERF_COUNT_HW_REF_CPU_CYCLES },
+-};
+-
+-/* mapping between fixed pmc index and intel_arch_events array */
+-static int fixed_pmc_events[] = {1, 0, 7};
+-
+-static void reprogram_fixed_counters(struct kvm_pmu *pmu, u64 data)
+-{
+- int i;
+-
+- for (i = 0; i < pmu->nr_arch_fixed_counters; i++) {
+- u8 new_ctrl = fixed_ctrl_field(data, i);
+- u8 old_ctrl = fixed_ctrl_field(pmu->fixed_ctr_ctrl, i);
+- struct kvm_pmc *pmc;
+-
+- pmc = get_fixed_pmc(pmu, MSR_CORE_PERF_FIXED_CTR0 + i);
+-
+- if (old_ctrl == new_ctrl)
+- continue;
+-
+- reprogram_fixed_counter(pmc, new_ctrl, i);
+- }
+-
+- pmu->fixed_ctr_ctrl = data;
+-}
+-
+-/* function is called when global control register has been updated. */
+-static void global_ctrl_changed(struct kvm_pmu *pmu, u64 data)
+-{
+- int bit;
+- u64 diff = pmu->global_ctrl ^ data;
+-
+- pmu->global_ctrl = data;
+-
+- for_each_set_bit(bit, (unsigned long *)&diff, X86_PMC_IDX_MAX)
+- reprogram_counter(pmu, bit);
+-}
+-
+-static unsigned intel_find_arch_event(struct kvm_pmu *pmu,
+- u8 event_select,
+- u8 unit_mask)
+-{
+- int i;
+-
+- for (i = 0; i < ARRAY_SIZE(intel_arch_events); i++)
+- if (intel_arch_events[i].eventsel == event_select
+- && intel_arch_events[i].unit_mask == unit_mask
+- && (pmu->available_event_types & (1 << i)))
+- break;
+-
+- if (i == ARRAY_SIZE(intel_arch_events))
+- return PERF_COUNT_HW_MAX;
+-
+- return intel_arch_events[i].event_type;
+-}
+-
+-static unsigned intel_find_fixed_event(int idx)
+-{
+- u32 event;
+- size_t size = ARRAY_SIZE(fixed_pmc_events);
+-
+- if (idx >= size)
+- return PERF_COUNT_HW_MAX;
+-
+- event = fixed_pmc_events[array_index_nospec(idx, size)];
+- return intel_arch_events[event].event_type;
+-}
+-
+-/* check if a PMC is enabled by comparing it with globl_ctrl bits. */
+-static bool intel_pmc_is_enabled(struct kvm_pmc *pmc)
+-{
+- struct kvm_pmu *pmu = pmc_to_pmu(pmc);
+-
+- return test_bit(pmc->idx, (unsigned long *)&pmu->global_ctrl);
+-}
+-
+-static struct kvm_pmc *intel_pmc_idx_to_pmc(struct kvm_pmu *pmu, int pmc_idx)
+-{
+- if (pmc_idx < INTEL_PMC_IDX_FIXED)
+- return get_gp_pmc(pmu, MSR_P6_EVNTSEL0 + pmc_idx,
+- MSR_P6_EVNTSEL0);
+- else {
+- u32 idx = pmc_idx - INTEL_PMC_IDX_FIXED;
+-
+- return get_fixed_pmc(pmu, idx + MSR_CORE_PERF_FIXED_CTR0);
+- }
+-}
+-
+-/* returns 0 if idx's corresponding MSR exists; otherwise returns 1. */
+-static int intel_is_valid_msr_idx(struct kvm_vcpu *vcpu, unsigned idx)
+-{
+- struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+- bool fixed = idx & (1u << 30);
+-
+- idx &= ~(3u << 30);
+-
+- return (!fixed && idx >= pmu->nr_arch_gp_counters) ||
+- (fixed && idx >= pmu->nr_arch_fixed_counters);
+-}
+-
+-static struct kvm_pmc *intel_msr_idx_to_pmc(struct kvm_vcpu *vcpu,
+- unsigned idx, u64 *mask)
+-{
+- struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+- bool fixed = idx & (1u << 30);
+- struct kvm_pmc *counters;
+- unsigned int num_counters;
+-
+- idx &= ~(3u << 30);
+- if (fixed) {
+- counters = pmu->fixed_counters;
+- num_counters = pmu->nr_arch_fixed_counters;
+- } else {
+- counters = pmu->gp_counters;
+- num_counters = pmu->nr_arch_gp_counters;
+- }
+- if (idx >= num_counters)
+- return NULL;
+- *mask &= pmu->counter_bitmask[fixed ? KVM_PMC_FIXED : KVM_PMC_GP];
+- return &counters[array_index_nospec(idx, num_counters)];
+-}
+-
+-static bool intel_is_valid_msr(struct kvm_vcpu *vcpu, u32 msr)
+-{
+- struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+- int ret;
+-
+- switch (msr) {
+- case MSR_CORE_PERF_FIXED_CTR_CTRL:
+- case MSR_CORE_PERF_GLOBAL_STATUS:
+- case MSR_CORE_PERF_GLOBAL_CTRL:
+- case MSR_CORE_PERF_GLOBAL_OVF_CTRL:
+- ret = pmu->version > 1;
+- break;
+- default:
+- ret = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0) ||
+- get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0) ||
+- get_fixed_pmc(pmu, msr);
+- break;
+- }
+-
+- return ret;
+-}
+-
+-static int intel_pmu_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *data)
+-{
+- struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+- struct kvm_pmc *pmc;
+-
+- switch (msr) {
+- case MSR_CORE_PERF_FIXED_CTR_CTRL:
+- *data = pmu->fixed_ctr_ctrl;
+- return 0;
+- case MSR_CORE_PERF_GLOBAL_STATUS:
+- *data = pmu->global_status;
+- return 0;
+- case MSR_CORE_PERF_GLOBAL_CTRL:
+- *data = pmu->global_ctrl;
+- return 0;
+- case MSR_CORE_PERF_GLOBAL_OVF_CTRL:
+- *data = pmu->global_ovf_ctrl;
+- return 0;
+- default:
+- if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0))) {
+- u64 val = pmc_read_counter(pmc);
+- *data = val & pmu->counter_bitmask[KVM_PMC_GP];
+- return 0;
+- } else if ((pmc = get_fixed_pmc(pmu, msr))) {
+- u64 val = pmc_read_counter(pmc);
+- *data = val & pmu->counter_bitmask[KVM_PMC_FIXED];
+- return 0;
+- } else if ((pmc = get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0))) {
+- *data = pmc->eventsel;
+- return 0;
+- }
+- }
+-
+- return 1;
+-}
+-
+-static int intel_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+-{
+- struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+- struct kvm_pmc *pmc;
+- u32 msr = msr_info->index;
+- u64 data = msr_info->data;
+-
+- switch (msr) {
+- case MSR_CORE_PERF_FIXED_CTR_CTRL:
+- if (pmu->fixed_ctr_ctrl == data)
+- return 0;
+- if (!(data & 0xfffffffffffff444ull)) {
+- reprogram_fixed_counters(pmu, data);
+- return 0;
+- }
+- break;
+- case MSR_CORE_PERF_GLOBAL_STATUS:
+- if (msr_info->host_initiated) {
+- pmu->global_status = data;
+- return 0;
+- }
+- break; /* RO MSR */
+- case MSR_CORE_PERF_GLOBAL_CTRL:
+- if (pmu->global_ctrl == data)
+- return 0;
+- if (!(data & pmu->global_ctrl_mask)) {
+- global_ctrl_changed(pmu, data);
+- return 0;
+- }
+- break;
+- case MSR_CORE_PERF_GLOBAL_OVF_CTRL:
+- if (!(data & (pmu->global_ctrl_mask & ~(3ull<<62)))) {
+- if (!msr_info->host_initiated)
+- pmu->global_status &= ~data;
+- pmu->global_ovf_ctrl = data;
+- return 0;
+- }
+- break;
+- default:
+- if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0))) {
+- if (msr_info->host_initiated)
+- pmc->counter = data;
+- else
+- pmc->counter = (s32)data;
+- return 0;
+- } else if ((pmc = get_fixed_pmc(pmu, msr))) {
+- pmc->counter = data;
+- return 0;
+- } else if ((pmc = get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0))) {
+- if (data == pmc->eventsel)
+- return 0;
+- if (!(data & pmu->reserved_bits)) {
+- reprogram_gp_counter(pmc, data);
+- return 0;
+- }
+- }
+- }
+-
+- return 1;
+-}
+-
+-static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+- struct kvm_cpuid_entry2 *entry;
+- union cpuid10_eax eax;
+- union cpuid10_edx edx;
+-
+- pmu->nr_arch_gp_counters = 0;
+- pmu->nr_arch_fixed_counters = 0;
+- pmu->counter_bitmask[KVM_PMC_GP] = 0;
+- pmu->counter_bitmask[KVM_PMC_FIXED] = 0;
+- pmu->version = 0;
+- pmu->reserved_bits = 0xffffffff00200000ull;
+-
+- entry = kvm_find_cpuid_entry(vcpu, 0xa, 0);
+- if (!entry)
+- return;
+- eax.full = entry->eax;
+- edx.full = entry->edx;
+-
+- pmu->version = eax.split.version_id;
+- if (!pmu->version)
+- return;
+-
+- pmu->nr_arch_gp_counters = min_t(int, eax.split.num_counters,
+- INTEL_PMC_MAX_GENERIC);
+- pmu->counter_bitmask[KVM_PMC_GP] = ((u64)1 << eax.split.bit_width) - 1;
+- pmu->available_event_types = ~entry->ebx &
+- ((1ull << eax.split.mask_length) - 1);
+-
+- if (pmu->version == 1) {
+- pmu->nr_arch_fixed_counters = 0;
+- } else {
+- pmu->nr_arch_fixed_counters =
+- min_t(int, edx.split.num_counters_fixed,
+- INTEL_PMC_MAX_FIXED);
+- pmu->counter_bitmask[KVM_PMC_FIXED] =
+- ((u64)1 << edx.split.bit_width_fixed) - 1;
+- }
+-
+- pmu->global_ctrl = ((1ull << pmu->nr_arch_gp_counters) - 1) |
+- (((1ull << pmu->nr_arch_fixed_counters) - 1) << INTEL_PMC_IDX_FIXED);
+- pmu->global_ctrl_mask = ~pmu->global_ctrl;
+-
+- entry = kvm_find_cpuid_entry(vcpu, 7, 0);
+- if (entry &&
+- (boot_cpu_has(X86_FEATURE_HLE) || boot_cpu_has(X86_FEATURE_RTM)) &&
+- (entry->ebx & (X86_FEATURE_HLE|X86_FEATURE_RTM)))
+- pmu->reserved_bits ^= HSW_IN_TX|HSW_IN_TX_CHECKPOINTED;
+-}
+-
+-static void intel_pmu_init(struct kvm_vcpu *vcpu)
+-{
+- int i;
+- struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+-
+- for (i = 0; i < INTEL_PMC_MAX_GENERIC; i++) {
+- pmu->gp_counters[i].type = KVM_PMC_GP;
+- pmu->gp_counters[i].vcpu = vcpu;
+- pmu->gp_counters[i].idx = i;
+- }
+-
+- for (i = 0; i < INTEL_PMC_MAX_FIXED; i++) {
+- pmu->fixed_counters[i].type = KVM_PMC_FIXED;
+- pmu->fixed_counters[i].vcpu = vcpu;
+- pmu->fixed_counters[i].idx = i + INTEL_PMC_IDX_FIXED;
+- }
+-}
+-
+-static void intel_pmu_reset(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
+- int i;
+-
+- for (i = 0; i < INTEL_PMC_MAX_GENERIC; i++) {
+- struct kvm_pmc *pmc = &pmu->gp_counters[i];
+-
+- pmc_stop_counter(pmc);
+- pmc->counter = pmc->eventsel = 0;
+- }
+-
+- for (i = 0; i < INTEL_PMC_MAX_FIXED; i++)
+- pmc_stop_counter(&pmu->fixed_counters[i]);
+-
+- pmu->fixed_ctr_ctrl = pmu->global_ctrl = pmu->global_status =
+- pmu->global_ovf_ctrl = 0;
+-}
+-
+-struct kvm_pmu_ops intel_pmu_ops = {
+- .find_arch_event = intel_find_arch_event,
+- .find_fixed_event = intel_find_fixed_event,
+- .pmc_is_enabled = intel_pmc_is_enabled,
+- .pmc_idx_to_pmc = intel_pmc_idx_to_pmc,
+- .msr_idx_to_pmc = intel_msr_idx_to_pmc,
+- .is_valid_msr_idx = intel_is_valid_msr_idx,
+- .is_valid_msr = intel_is_valid_msr,
+- .get_msr = intel_pmu_get_msr,
+- .set_msr = intel_pmu_set_msr,
+- .refresh = intel_pmu_refresh,
+- .init = intel_pmu_init,
+- .reset = intel_pmu_reset,
+-};
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+deleted file mode 100644
+index 9bb696d7300c0..0000000000000
+--- a/arch/x86/kvm/vmx.c
++++ /dev/null
+@@ -1,14757 +0,0 @@
+-/*
+- * Kernel-based Virtual Machine driver for Linux
+- *
+- * This module enables machines with Intel VT-x extensions to run virtual
+- * machines without emulation or binary translation.
+- *
+- * Copyright (C) 2006 Qumranet, Inc.
+- * Copyright 2010 Red Hat, Inc. and/or its affiliates.
+- *
+- * Authors:
+- * Avi Kivity <avi@qumranet.com>
+- * Yaniv Kamay <yaniv@qumranet.com>
+- *
+- * This work is licensed under the terms of the GNU GPL, version 2. See
+- * the COPYING file in the top-level directory.
+- *
+- */
+-
+-#include "irq.h"
+-#include "mmu.h"
+-#include "cpuid.h"
+-#include "lapic.h"
+-
+-#include <linux/kvm_host.h>
+-#include <linux/module.h>
+-#include <linux/kernel.h>
+-#include <linux/mm.h>
+-#include <linux/highmem.h>
+-#include <linux/sched.h>
+-#include <linux/sched/smt.h>
+-#include <linux/moduleparam.h>
+-#include <linux/mod_devicetable.h>
+-#include <linux/trace_events.h>
+-#include <linux/slab.h>
+-#include <linux/tboot.h>
+-#include <linux/hrtimer.h>
+-#include <linux/frame.h>
+-#include <linux/nospec.h>
+-#include "kvm_cache_regs.h"
+-#include "x86.h"
+-
+-#include <asm/asm.h>
+-#include <asm/cpu.h>
+-#include <asm/cpu_device_id.h>
+-#include <asm/io.h>
+-#include <asm/desc.h>
+-#include <asm/vmx.h>
+-#include <asm/virtext.h>
+-#include <asm/mce.h>
+-#include <asm/fpu/internal.h>
+-#include <asm/perf_event.h>
+-#include <asm/debugreg.h>
+-#include <asm/kexec.h>
+-#include <asm/apic.h>
+-#include <asm/irq_remapping.h>
+-#include <asm/mmu_context.h>
+-#include <asm/spec-ctrl.h>
+-#include <asm/mshyperv.h>
+-
+-#include "trace.h"
+-#include "pmu.h"
+-#include "vmx_evmcs.h"
+-
+-#define __ex(x) __kvm_handle_fault_on_reboot(x)
+-#define __ex_clear(x, reg) \
+- ____kvm_handle_fault_on_reboot(x, "xor " reg " , " reg)
+-
+-MODULE_AUTHOR("Qumranet");
+-MODULE_LICENSE("GPL");
+-
+-static const struct x86_cpu_id vmx_cpu_id[] = {
+- X86_FEATURE_MATCH(X86_FEATURE_VMX),
+- {}
+-};
+-MODULE_DEVICE_TABLE(x86cpu, vmx_cpu_id);
+-
+-static bool __read_mostly enable_vpid = 1;
+-module_param_named(vpid, enable_vpid, bool, 0444);
+-
+-static bool __read_mostly enable_vnmi = 1;
+-module_param_named(vnmi, enable_vnmi, bool, S_IRUGO);
+-
+-static bool __read_mostly flexpriority_enabled = 1;
+-module_param_named(flexpriority, flexpriority_enabled, bool, S_IRUGO);
+-
+-static bool __read_mostly enable_ept = 1;
+-module_param_named(ept, enable_ept, bool, S_IRUGO);
+-
+-static bool __read_mostly enable_unrestricted_guest = 1;
+-module_param_named(unrestricted_guest,
+- enable_unrestricted_guest, bool, S_IRUGO);
+-
+-static bool __read_mostly enable_ept_ad_bits = 1;
+-module_param_named(eptad, enable_ept_ad_bits, bool, S_IRUGO);
+-
+-static bool __read_mostly emulate_invalid_guest_state = true;
+-module_param(emulate_invalid_guest_state, bool, S_IRUGO);
+-
+-static bool __read_mostly fasteoi = 1;
+-module_param(fasteoi, bool, S_IRUGO);
+-
+-static bool __read_mostly enable_apicv = 1;
+-module_param(enable_apicv, bool, S_IRUGO);
+-
+-static bool __read_mostly enable_shadow_vmcs = 1;
+-module_param_named(enable_shadow_vmcs, enable_shadow_vmcs, bool, S_IRUGO);
+-/*
+- * If nested=1, nested virtualization is supported, i.e., guests may use
+- * VMX and be a hypervisor for its own guests. If nested=0, guests may not
+- * use VMX instructions.
+- */
+-static bool __read_mostly nested = 0;
+-module_param(nested, bool, S_IRUGO);
+-
+-static u64 __read_mostly host_xss;
+-
+-static bool __read_mostly enable_pml = 1;
+-module_param_named(pml, enable_pml, bool, S_IRUGO);
+-
+-#define MSR_TYPE_R 1
+-#define MSR_TYPE_W 2
+-#define MSR_TYPE_RW 3
+-
+-#define MSR_BITMAP_MODE_X2APIC 1
+-#define MSR_BITMAP_MODE_X2APIC_APICV 2
+-
+-#define KVM_VMX_TSC_MULTIPLIER_MAX 0xffffffffffffffffULL
+-
+-/* Guest_tsc -> host_tsc conversion requires 64-bit division. */
+-static int __read_mostly cpu_preemption_timer_multi;
+-static bool __read_mostly enable_preemption_timer = 1;
+-#ifdef CONFIG_X86_64
+-module_param_named(preemption_timer, enable_preemption_timer, bool, S_IRUGO);
+-#endif
+-
+-#define KVM_GUEST_CR0_MASK (X86_CR0_NW | X86_CR0_CD)
+-#define KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR0_NE
+-#define KVM_VM_CR0_ALWAYS_ON \
+- (KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST | \
+- X86_CR0_WP | X86_CR0_PG | X86_CR0_PE)
+-#define KVM_CR4_GUEST_OWNED_BITS \
+- (X86_CR4_PVI | X86_CR4_DE | X86_CR4_PCE | X86_CR4_OSFXSR \
+- | X86_CR4_OSXMMEXCPT | X86_CR4_LA57 | X86_CR4_TSD)
+-
+-#define KVM_VM_CR4_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR4_VMXE
+-#define KVM_PMODE_VM_CR4_ALWAYS_ON (X86_CR4_PAE | X86_CR4_VMXE)
+-#define KVM_RMODE_VM_CR4_ALWAYS_ON (X86_CR4_VME | X86_CR4_PAE | X86_CR4_VMXE)
+-
+-#define RMODE_GUEST_OWNED_EFLAGS_BITS (~(X86_EFLAGS_IOPL | X86_EFLAGS_VM))
+-
+-#define VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE 5
+-
+-/*
+- * Hyper-V requires all of these, so mark them as supported even though
+- * they are just treated the same as all-context.
+- */
+-#define VMX_VPID_EXTENT_SUPPORTED_MASK \
+- (VMX_VPID_EXTENT_INDIVIDUAL_ADDR_BIT | \
+- VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT | \
+- VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT | \
+- VMX_VPID_EXTENT_SINGLE_NON_GLOBAL_BIT)
+-
+-/*
+- * These 2 parameters are used to config the controls for Pause-Loop Exiting:
+- * ple_gap: upper bound on the amount of time between two successive
+- * executions of PAUSE in a loop. Also indicate if ple enabled.
+- * According to test, this time is usually smaller than 128 cycles.
+- * ple_window: upper bound on the amount of time a guest is allowed to execute
+- * in a PAUSE loop. Tests indicate that most spinlocks are held for
+- * less than 2^12 cycles
+- * Time is measured based on a counter that runs at the same rate as the TSC,
+- * refer SDM volume 3b section 21.6.13 & 22.1.3.
+- */
+-static unsigned int ple_gap = KVM_DEFAULT_PLE_GAP;
+-module_param(ple_gap, uint, 0444);
+-
+-static unsigned int ple_window = KVM_VMX_DEFAULT_PLE_WINDOW;
+-module_param(ple_window, uint, 0444);
+-
+-/* Default doubles per-vcpu window every exit. */
+-static unsigned int ple_window_grow = KVM_DEFAULT_PLE_WINDOW_GROW;
+-module_param(ple_window_grow, uint, 0444);
+-
+-/* Default resets per-vcpu window every exit to ple_window. */
+-static unsigned int ple_window_shrink = KVM_DEFAULT_PLE_WINDOW_SHRINK;
+-module_param(ple_window_shrink, uint, 0444);
+-
+-/* Default is to compute the maximum so we can never overflow. */
+-static unsigned int ple_window_max = KVM_VMX_DEFAULT_PLE_WINDOW_MAX;
+-module_param(ple_window_max, uint, 0444);
+-
+-extern const ulong vmx_return;
+-
+-static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
+-static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_cond);
+-static DEFINE_MUTEX(vmx_l1d_flush_mutex);
+-
+-/* Storage for pre module init parameter parsing */
+-static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param = VMENTER_L1D_FLUSH_AUTO;
+-
+-static const struct {
+- const char *option;
+- bool for_parse;
+-} vmentry_l1d_param[] = {
+- [VMENTER_L1D_FLUSH_AUTO] = {"auto", true},
+- [VMENTER_L1D_FLUSH_NEVER] = {"never", true},
+- [VMENTER_L1D_FLUSH_COND] = {"cond", true},
+- [VMENTER_L1D_FLUSH_ALWAYS] = {"always", true},
+- [VMENTER_L1D_FLUSH_EPT_DISABLED] = {"EPT disabled", false},
+- [VMENTER_L1D_FLUSH_NOT_REQUIRED] = {"not required", false},
+-};
+-
+-#define L1D_CACHE_ORDER 4
+-static void *vmx_l1d_flush_pages;
+-
+-/* Control for disabling CPU Fill buffer clear */
+-static bool __read_mostly vmx_fb_clear_ctrl_available;
+-
+-static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf)
+-{
+- struct page *page;
+- unsigned int i;
+-
+- if (!enable_ept) {
+- l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_EPT_DISABLED;
+- return 0;
+- }
+-
+- if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) {
+- u64 msr;
+-
+- rdmsrl(MSR_IA32_ARCH_CAPABILITIES, msr);
+- if (msr & ARCH_CAP_SKIP_VMENTRY_L1DFLUSH) {
+- l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED;
+- return 0;
+- }
+- }
+-
+- /* If set to auto use the default l1tf mitigation method */
+- if (l1tf == VMENTER_L1D_FLUSH_AUTO) {
+- switch (l1tf_mitigation) {
+- case L1TF_MITIGATION_OFF:
+- l1tf = VMENTER_L1D_FLUSH_NEVER;
+- break;
+- case L1TF_MITIGATION_FLUSH_NOWARN:
+- case L1TF_MITIGATION_FLUSH:
+- case L1TF_MITIGATION_FLUSH_NOSMT:
+- l1tf = VMENTER_L1D_FLUSH_COND;
+- break;
+- case L1TF_MITIGATION_FULL:
+- case L1TF_MITIGATION_FULL_FORCE:
+- l1tf = VMENTER_L1D_FLUSH_ALWAYS;
+- break;
+- }
+- } else if (l1tf_mitigation == L1TF_MITIGATION_FULL_FORCE) {
+- l1tf = VMENTER_L1D_FLUSH_ALWAYS;
+- }
+-
+- if (l1tf != VMENTER_L1D_FLUSH_NEVER && !vmx_l1d_flush_pages &&
+- !boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
+- page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER);
+- if (!page)
+- return -ENOMEM;
+- vmx_l1d_flush_pages = page_address(page);
+-
+- /*
+- * Initialize each page with a different pattern in
+- * order to protect against KSM in the nested
+- * virtualization case.
+- */
+- for (i = 0; i < 1u << L1D_CACHE_ORDER; ++i) {
+- memset(vmx_l1d_flush_pages + i * PAGE_SIZE, i + 1,
+- PAGE_SIZE);
+- }
+- }
+-
+- l1tf_vmx_mitigation = l1tf;
+-
+- if (l1tf != VMENTER_L1D_FLUSH_NEVER)
+- static_branch_enable(&vmx_l1d_should_flush);
+- else
+- static_branch_disable(&vmx_l1d_should_flush);
+-
+- if (l1tf == VMENTER_L1D_FLUSH_COND)
+- static_branch_enable(&vmx_l1d_flush_cond);
+- else
+- static_branch_disable(&vmx_l1d_flush_cond);
+- return 0;
+-}
+-
+-static int vmentry_l1d_flush_parse(const char *s)
+-{
+- unsigned int i;
+-
+- if (s) {
+- for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
+- if (vmentry_l1d_param[i].for_parse &&
+- sysfs_streq(s, vmentry_l1d_param[i].option))
+- return i;
+- }
+- }
+- return -EINVAL;
+-}
+-
+-static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
+-{
+- int l1tf, ret;
+-
+- l1tf = vmentry_l1d_flush_parse(s);
+- if (l1tf < 0)
+- return l1tf;
+-
+- if (!boot_cpu_has(X86_BUG_L1TF))
+- return 0;
+-
+- /*
+- * Has vmx_init() run already? If not then this is the pre init
+- * parameter parsing. In that case just store the value and let
+- * vmx_init() do the proper setup after enable_ept has been
+- * established.
+- */
+- if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO) {
+- vmentry_l1d_flush_param = l1tf;
+- return 0;
+- }
+-
+- mutex_lock(&vmx_l1d_flush_mutex);
+- ret = vmx_setup_l1d_flush(l1tf);
+- mutex_unlock(&vmx_l1d_flush_mutex);
+- return ret;
+-}
+-
+-static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp)
+-{
+- if (WARN_ON_ONCE(l1tf_vmx_mitigation >= ARRAY_SIZE(vmentry_l1d_param)))
+- return sprintf(s, "???\n");
+-
+- return sprintf(s, "%s\n", vmentry_l1d_param[l1tf_vmx_mitigation].option);
+-}
+-
+-static const struct kernel_param_ops vmentry_l1d_flush_ops = {
+- .set = vmentry_l1d_flush_set,
+- .get = vmentry_l1d_flush_get,
+-};
+-module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, NULL, 0644);
+-
+-enum ept_pointers_status {
+- EPT_POINTERS_CHECK = 0,
+- EPT_POINTERS_MATCH = 1,
+- EPT_POINTERS_MISMATCH = 2
+-};
+-
+-struct kvm_vmx {
+- struct kvm kvm;
+-
+- unsigned int tss_addr;
+- bool ept_identity_pagetable_done;
+- gpa_t ept_identity_map_addr;
+-
+- enum ept_pointers_status ept_pointers_match;
+- spinlock_t ept_pointer_lock;
+-};
+-
+-#define NR_AUTOLOAD_MSRS 8
+-
+-struct vmcs_hdr {
+- u32 revision_id:31;
+- u32 shadow_vmcs:1;
+-};
+-
+-struct vmcs {
+- struct vmcs_hdr hdr;
+- u32 abort;
+- char data[0];
+-};
+-
+-/*
+- * vmcs_host_state tracks registers that are loaded from the VMCS on VMEXIT
+- * and whose values change infrequently, but are not constant. I.e. this is
+- * used as a write-through cache of the corresponding VMCS fields.
+- */
+-struct vmcs_host_state {
+- unsigned long cr3; /* May not match real cr3 */
+- unsigned long cr4; /* May not match real cr4 */
+- unsigned long gs_base;
+- unsigned long fs_base;
+-
+- u16 fs_sel, gs_sel, ldt_sel;
+-#ifdef CONFIG_X86_64
+- u16 ds_sel, es_sel;
+-#endif
+-};
+-
+-/*
+- * Track a VMCS that may be loaded on a certain CPU. If it is (cpu!=-1), also
+- * remember whether it was VMLAUNCHed, and maintain a linked list of all VMCSs
+- * loaded on this CPU (so we can clear them if the CPU goes down).
+- */
+-struct loaded_vmcs {
+- struct vmcs *vmcs;
+- struct vmcs *shadow_vmcs;
+- int cpu;
+- bool launched;
+- bool nmi_known_unmasked;
+- bool hv_timer_armed;
+- /* Support for vnmi-less CPUs */
+- int soft_vnmi_blocked;
+- ktime_t entry_time;
+- s64 vnmi_blocked_time;
+- unsigned long *msr_bitmap;
+- struct list_head loaded_vmcss_on_cpu_link;
+- struct vmcs_host_state host_state;
+-};
+-
+-struct shared_msr_entry {
+- unsigned index;
+- u64 data;
+- u64 mask;
+-};
+-
+-/*
+- * struct vmcs12 describes the state that our guest hypervisor (L1) keeps for a
+- * single nested guest (L2), hence the name vmcs12. Any VMX implementation has
+- * a VMCS structure, and vmcs12 is our emulated VMX's VMCS. This structure is
+- * stored in guest memory specified by VMPTRLD, but is opaque to the guest,
+- * which must access it using VMREAD/VMWRITE/VMCLEAR instructions.
+- * More than one of these structures may exist, if L1 runs multiple L2 guests.
+- * nested_vmx_run() will use the data here to build the vmcs02: a VMCS for the
+- * underlying hardware which will be used to run L2.
+- * This structure is packed to ensure that its layout is identical across
+- * machines (necessary for live migration).
+- *
+- * IMPORTANT: Changing the layout of existing fields in this structure
+- * will break save/restore compatibility with older kvm releases. When
+- * adding new fields, either use space in the reserved padding* arrays
+- * or add the new fields to the end of the structure.
+- */
+-typedef u64 natural_width;
+-struct __packed vmcs12 {
+- /* According to the Intel spec, a VMCS region must start with the
+- * following two fields. Then follow implementation-specific data.
+- */
+- struct vmcs_hdr hdr;
+- u32 abort;
+-
+- u32 launch_state; /* set to 0 by VMCLEAR, to 1 by VMLAUNCH */
+- u32 padding[7]; /* room for future expansion */
+-
+- u64 io_bitmap_a;
+- u64 io_bitmap_b;
+- u64 msr_bitmap;
+- u64 vm_exit_msr_store_addr;
+- u64 vm_exit_msr_load_addr;
+- u64 vm_entry_msr_load_addr;
+- u64 tsc_offset;
+- u64 virtual_apic_page_addr;
+- u64 apic_access_addr;
+- u64 posted_intr_desc_addr;
+- u64 ept_pointer;
+- u64 eoi_exit_bitmap0;
+- u64 eoi_exit_bitmap1;
+- u64 eoi_exit_bitmap2;
+- u64 eoi_exit_bitmap3;
+- u64 xss_exit_bitmap;
+- u64 guest_physical_address;
+- u64 vmcs_link_pointer;
+- u64 guest_ia32_debugctl;
+- u64 guest_ia32_pat;
+- u64 guest_ia32_efer;
+- u64 guest_ia32_perf_global_ctrl;
+- u64 guest_pdptr0;
+- u64 guest_pdptr1;
+- u64 guest_pdptr2;
+- u64 guest_pdptr3;
+- u64 guest_bndcfgs;
+- u64 host_ia32_pat;
+- u64 host_ia32_efer;
+- u64 host_ia32_perf_global_ctrl;
+- u64 vmread_bitmap;
+- u64 vmwrite_bitmap;
+- u64 vm_function_control;
+- u64 eptp_list_address;
+- u64 pml_address;
+- u64 padding64[3]; /* room for future expansion */
+- /*
+- * To allow migration of L1 (complete with its L2 guests) between
+- * machines of different natural widths (32 or 64 bit), we cannot have
+- * unsigned long fields with no explict size. We use u64 (aliased
+- * natural_width) instead. Luckily, x86 is little-endian.
+- */
+- natural_width cr0_guest_host_mask;
+- natural_width cr4_guest_host_mask;
+- natural_width cr0_read_shadow;
+- natural_width cr4_read_shadow;
+- natural_width cr3_target_value0;
+- natural_width cr3_target_value1;
+- natural_width cr3_target_value2;
+- natural_width cr3_target_value3;
+- natural_width exit_qualification;
+- natural_width guest_linear_address;
+- natural_width guest_cr0;
+- natural_width guest_cr3;
+- natural_width guest_cr4;
+- natural_width guest_es_base;
+- natural_width guest_cs_base;
+- natural_width guest_ss_base;
+- natural_width guest_ds_base;
+- natural_width guest_fs_base;
+- natural_width guest_gs_base;
+- natural_width guest_ldtr_base;
+- natural_width guest_tr_base;
+- natural_width guest_gdtr_base;
+- natural_width guest_idtr_base;
+- natural_width guest_dr7;
+- natural_width guest_rsp;
+- natural_width guest_rip;
+- natural_width guest_rflags;
+- natural_width guest_pending_dbg_exceptions;
+- natural_width guest_sysenter_esp;
+- natural_width guest_sysenter_eip;
+- natural_width host_cr0;
+- natural_width host_cr3;
+- natural_width host_cr4;
+- natural_width host_fs_base;
+- natural_width host_gs_base;
+- natural_width host_tr_base;
+- natural_width host_gdtr_base;
+- natural_width host_idtr_base;
+- natural_width host_ia32_sysenter_esp;
+- natural_width host_ia32_sysenter_eip;
+- natural_width host_rsp;
+- natural_width host_rip;
+- natural_width paddingl[8]; /* room for future expansion */
+- u32 pin_based_vm_exec_control;
+- u32 cpu_based_vm_exec_control;
+- u32 exception_bitmap;
+- u32 page_fault_error_code_mask;
+- u32 page_fault_error_code_match;
+- u32 cr3_target_count;
+- u32 vm_exit_controls;
+- u32 vm_exit_msr_store_count;
+- u32 vm_exit_msr_load_count;
+- u32 vm_entry_controls;
+- u32 vm_entry_msr_load_count;
+- u32 vm_entry_intr_info_field;
+- u32 vm_entry_exception_error_code;
+- u32 vm_entry_instruction_len;
+- u32 tpr_threshold;
+- u32 secondary_vm_exec_control;
+- u32 vm_instruction_error;
+- u32 vm_exit_reason;
+- u32 vm_exit_intr_info;
+- u32 vm_exit_intr_error_code;
+- u32 idt_vectoring_info_field;
+- u32 idt_vectoring_error_code;
+- u32 vm_exit_instruction_len;
+- u32 vmx_instruction_info;
+- u32 guest_es_limit;
+- u32 guest_cs_limit;
+- u32 guest_ss_limit;
+- u32 guest_ds_limit;
+- u32 guest_fs_limit;
+- u32 guest_gs_limit;
+- u32 guest_ldtr_limit;
+- u32 guest_tr_limit;
+- u32 guest_gdtr_limit;
+- u32 guest_idtr_limit;
+- u32 guest_es_ar_bytes;
+- u32 guest_cs_ar_bytes;
+- u32 guest_ss_ar_bytes;
+- u32 guest_ds_ar_bytes;
+- u32 guest_fs_ar_bytes;
+- u32 guest_gs_ar_bytes;
+- u32 guest_ldtr_ar_bytes;
+- u32 guest_tr_ar_bytes;
+- u32 guest_interruptibility_info;
+- u32 guest_activity_state;
+- u32 guest_sysenter_cs;
+- u32 host_ia32_sysenter_cs;
+- u32 vmx_preemption_timer_value;
+- u32 padding32[7]; /* room for future expansion */
+- u16 virtual_processor_id;
+- u16 posted_intr_nv;
+- u16 guest_es_selector;
+- u16 guest_cs_selector;
+- u16 guest_ss_selector;
+- u16 guest_ds_selector;
+- u16 guest_fs_selector;
+- u16 guest_gs_selector;
+- u16 guest_ldtr_selector;
+- u16 guest_tr_selector;
+- u16 guest_intr_status;
+- u16 host_es_selector;
+- u16 host_cs_selector;
+- u16 host_ss_selector;
+- u16 host_ds_selector;
+- u16 host_fs_selector;
+- u16 host_gs_selector;
+- u16 host_tr_selector;
+- u16 guest_pml_index;
+-};
+-
+-/*
+- * For save/restore compatibility, the vmcs12 field offsets must not change.
+- */
+-#define CHECK_OFFSET(field, loc) \
+- BUILD_BUG_ON_MSG(offsetof(struct vmcs12, field) != (loc), \
+- "Offset of " #field " in struct vmcs12 has changed.")
+-
+-static inline void vmx_check_vmcs12_offsets(void) {
+- CHECK_OFFSET(hdr, 0);
+- CHECK_OFFSET(abort, 4);
+- CHECK_OFFSET(launch_state, 8);
+- CHECK_OFFSET(io_bitmap_a, 40);
+- CHECK_OFFSET(io_bitmap_b, 48);
+- CHECK_OFFSET(msr_bitmap, 56);
+- CHECK_OFFSET(vm_exit_msr_store_addr, 64);
+- CHECK_OFFSET(vm_exit_msr_load_addr, 72);
+- CHECK_OFFSET(vm_entry_msr_load_addr, 80);
+- CHECK_OFFSET(tsc_offset, 88);
+- CHECK_OFFSET(virtual_apic_page_addr, 96);
+- CHECK_OFFSET(apic_access_addr, 104);
+- CHECK_OFFSET(posted_intr_desc_addr, 112);
+- CHECK_OFFSET(ept_pointer, 120);
+- CHECK_OFFSET(eoi_exit_bitmap0, 128);
+- CHECK_OFFSET(eoi_exit_bitmap1, 136);
+- CHECK_OFFSET(eoi_exit_bitmap2, 144);
+- CHECK_OFFSET(eoi_exit_bitmap3, 152);
+- CHECK_OFFSET(xss_exit_bitmap, 160);
+- CHECK_OFFSET(guest_physical_address, 168);
+- CHECK_OFFSET(vmcs_link_pointer, 176);
+- CHECK_OFFSET(guest_ia32_debugctl, 184);
+- CHECK_OFFSET(guest_ia32_pat, 192);
+- CHECK_OFFSET(guest_ia32_efer, 200);
+- CHECK_OFFSET(guest_ia32_perf_global_ctrl, 208);
+- CHECK_OFFSET(guest_pdptr0, 216);
+- CHECK_OFFSET(guest_pdptr1, 224);
+- CHECK_OFFSET(guest_pdptr2, 232);
+- CHECK_OFFSET(guest_pdptr3, 240);
+- CHECK_OFFSET(guest_bndcfgs, 248);
+- CHECK_OFFSET(host_ia32_pat, 256);
+- CHECK_OFFSET(host_ia32_efer, 264);
+- CHECK_OFFSET(host_ia32_perf_global_ctrl, 272);
+- CHECK_OFFSET(vmread_bitmap, 280);
+- CHECK_OFFSET(vmwrite_bitmap, 288);
+- CHECK_OFFSET(vm_function_control, 296);
+- CHECK_OFFSET(eptp_list_address, 304);
+- CHECK_OFFSET(pml_address, 312);
+- CHECK_OFFSET(cr0_guest_host_mask, 344);
+- CHECK_OFFSET(cr4_guest_host_mask, 352);
+- CHECK_OFFSET(cr0_read_shadow, 360);
+- CHECK_OFFSET(cr4_read_shadow, 368);
+- CHECK_OFFSET(cr3_target_value0, 376);
+- CHECK_OFFSET(cr3_target_value1, 384);
+- CHECK_OFFSET(cr3_target_value2, 392);
+- CHECK_OFFSET(cr3_target_value3, 400);
+- CHECK_OFFSET(exit_qualification, 408);
+- CHECK_OFFSET(guest_linear_address, 416);
+- CHECK_OFFSET(guest_cr0, 424);
+- CHECK_OFFSET(guest_cr3, 432);
+- CHECK_OFFSET(guest_cr4, 440);
+- CHECK_OFFSET(guest_es_base, 448);
+- CHECK_OFFSET(guest_cs_base, 456);
+- CHECK_OFFSET(guest_ss_base, 464);
+- CHECK_OFFSET(guest_ds_base, 472);
+- CHECK_OFFSET(guest_fs_base, 480);
+- CHECK_OFFSET(guest_gs_base, 488);
+- CHECK_OFFSET(guest_ldtr_base, 496);
+- CHECK_OFFSET(guest_tr_base, 504);
+- CHECK_OFFSET(guest_gdtr_base, 512);
+- CHECK_OFFSET(guest_idtr_base, 520);
+- CHECK_OFFSET(guest_dr7, 528);
+- CHECK_OFFSET(guest_rsp, 536);
+- CHECK_OFFSET(guest_rip, 544);
+- CHECK_OFFSET(guest_rflags, 552);
+- CHECK_OFFSET(guest_pending_dbg_exceptions, 560);
+- CHECK_OFFSET(guest_sysenter_esp, 568);
+- CHECK_OFFSET(guest_sysenter_eip, 576);
+- CHECK_OFFSET(host_cr0, 584);
+- CHECK_OFFSET(host_cr3, 592);
+- CHECK_OFFSET(host_cr4, 600);
+- CHECK_OFFSET(host_fs_base, 608);
+- CHECK_OFFSET(host_gs_base, 616);
+- CHECK_OFFSET(host_tr_base, 624);
+- CHECK_OFFSET(host_gdtr_base, 632);
+- CHECK_OFFSET(host_idtr_base, 640);
+- CHECK_OFFSET(host_ia32_sysenter_esp, 648);
+- CHECK_OFFSET(host_ia32_sysenter_eip, 656);
+- CHECK_OFFSET(host_rsp, 664);
+- CHECK_OFFSET(host_rip, 672);
+- CHECK_OFFSET(pin_based_vm_exec_control, 744);
+- CHECK_OFFSET(cpu_based_vm_exec_control, 748);
+- CHECK_OFFSET(exception_bitmap, 752);
+- CHECK_OFFSET(page_fault_error_code_mask, 756);
+- CHECK_OFFSET(page_fault_error_code_match, 760);
+- CHECK_OFFSET(cr3_target_count, 764);
+- CHECK_OFFSET(vm_exit_controls, 768);
+- CHECK_OFFSET(vm_exit_msr_store_count, 772);
+- CHECK_OFFSET(vm_exit_msr_load_count, 776);
+- CHECK_OFFSET(vm_entry_controls, 780);
+- CHECK_OFFSET(vm_entry_msr_load_count, 784);
+- CHECK_OFFSET(vm_entry_intr_info_field, 788);
+- CHECK_OFFSET(vm_entry_exception_error_code, 792);
+- CHECK_OFFSET(vm_entry_instruction_len, 796);
+- CHECK_OFFSET(tpr_threshold, 800);
+- CHECK_OFFSET(secondary_vm_exec_control, 804);
+- CHECK_OFFSET(vm_instruction_error, 808);
+- CHECK_OFFSET(vm_exit_reason, 812);
+- CHECK_OFFSET(vm_exit_intr_info, 816);
+- CHECK_OFFSET(vm_exit_intr_error_code, 820);
+- CHECK_OFFSET(idt_vectoring_info_field, 824);
+- CHECK_OFFSET(idt_vectoring_error_code, 828);
+- CHECK_OFFSET(vm_exit_instruction_len, 832);
+- CHECK_OFFSET(vmx_instruction_info, 836);
+- CHECK_OFFSET(guest_es_limit, 840);
+- CHECK_OFFSET(guest_cs_limit, 844);
+- CHECK_OFFSET(guest_ss_limit, 848);
+- CHECK_OFFSET(guest_ds_limit, 852);
+- CHECK_OFFSET(guest_fs_limit, 856);
+- CHECK_OFFSET(guest_gs_limit, 860);
+- CHECK_OFFSET(guest_ldtr_limit, 864);
+- CHECK_OFFSET(guest_tr_limit, 868);
+- CHECK_OFFSET(guest_gdtr_limit, 872);
+- CHECK_OFFSET(guest_idtr_limit, 876);
+- CHECK_OFFSET(guest_es_ar_bytes, 880);
+- CHECK_OFFSET(guest_cs_ar_bytes, 884);
+- CHECK_OFFSET(guest_ss_ar_bytes, 888);
+- CHECK_OFFSET(guest_ds_ar_bytes, 892);
+- CHECK_OFFSET(guest_fs_ar_bytes, 896);
+- CHECK_OFFSET(guest_gs_ar_bytes, 900);
+- CHECK_OFFSET(guest_ldtr_ar_bytes, 904);
+- CHECK_OFFSET(guest_tr_ar_bytes, 908);
+- CHECK_OFFSET(guest_interruptibility_info, 912);
+- CHECK_OFFSET(guest_activity_state, 916);
+- CHECK_OFFSET(guest_sysenter_cs, 920);
+- CHECK_OFFSET(host_ia32_sysenter_cs, 924);
+- CHECK_OFFSET(vmx_preemption_timer_value, 928);
+- CHECK_OFFSET(virtual_processor_id, 960);
+- CHECK_OFFSET(posted_intr_nv, 962);
+- CHECK_OFFSET(guest_es_selector, 964);
+- CHECK_OFFSET(guest_cs_selector, 966);
+- CHECK_OFFSET(guest_ss_selector, 968);
+- CHECK_OFFSET(guest_ds_selector, 970);
+- CHECK_OFFSET(guest_fs_selector, 972);
+- CHECK_OFFSET(guest_gs_selector, 974);
+- CHECK_OFFSET(guest_ldtr_selector, 976);
+- CHECK_OFFSET(guest_tr_selector, 978);
+- CHECK_OFFSET(guest_intr_status, 980);
+- CHECK_OFFSET(host_es_selector, 982);
+- CHECK_OFFSET(host_cs_selector, 984);
+- CHECK_OFFSET(host_ss_selector, 986);
+- CHECK_OFFSET(host_ds_selector, 988);
+- CHECK_OFFSET(host_fs_selector, 990);
+- CHECK_OFFSET(host_gs_selector, 992);
+- CHECK_OFFSET(host_tr_selector, 994);
+- CHECK_OFFSET(guest_pml_index, 996);
+-}
+-
+-/*
+- * VMCS12_REVISION is an arbitrary id that should be changed if the content or
+- * layout of struct vmcs12 is changed. MSR_IA32_VMX_BASIC returns this id, and
+- * VMPTRLD verifies that the VMCS region that L1 is loading contains this id.
+- *
+- * IMPORTANT: Changing this value will break save/restore compatibility with
+- * older kvm releases.
+- */
+-#define VMCS12_REVISION 0x11e57ed0
+-
+-/*
+- * VMCS12_SIZE is the number of bytes L1 should allocate for the VMXON region
+- * and any VMCS region. Although only sizeof(struct vmcs12) are used by the
+- * current implementation, 4K are reserved to avoid future complications.
+- */
+-#define VMCS12_SIZE 0x1000
+-
+-/*
+- * VMCS12_MAX_FIELD_INDEX is the highest index value used in any
+- * supported VMCS12 field encoding.
+- */
+-#define VMCS12_MAX_FIELD_INDEX 0x17
+-
+-struct nested_vmx_msrs {
+- /*
+- * We only store the "true" versions of the VMX capability MSRs. We
+- * generate the "non-true" versions by setting the must-be-1 bits
+- * according to the SDM.
+- */
+- u32 procbased_ctls_low;
+- u32 procbased_ctls_high;
+- u32 secondary_ctls_low;
+- u32 secondary_ctls_high;
+- u32 pinbased_ctls_low;
+- u32 pinbased_ctls_high;
+- u32 exit_ctls_low;
+- u32 exit_ctls_high;
+- u32 entry_ctls_low;
+- u32 entry_ctls_high;
+- u32 misc_low;
+- u32 misc_high;
+- u32 ept_caps;
+- u32 vpid_caps;
+- u64 basic;
+- u64 cr0_fixed0;
+- u64 cr0_fixed1;
+- u64 cr4_fixed0;
+- u64 cr4_fixed1;
+- u64 vmcs_enum;
+- u64 vmfunc_controls;
+-};
+-
+-/*
+- * The nested_vmx structure is part of vcpu_vmx, and holds information we need
+- * for correct emulation of VMX (i.e., nested VMX) on this vcpu.
+- */
+-struct nested_vmx {
+- /* Has the level1 guest done vmxon? */
+- bool vmxon;
+- gpa_t vmxon_ptr;
+- bool pml_full;
+-
+- /* The guest-physical address of the current VMCS L1 keeps for L2 */
+- gpa_t current_vmptr;
+- /*
+- * Cache of the guest's VMCS, existing outside of guest memory.
+- * Loaded from guest memory during VMPTRLD. Flushed to guest
+- * memory during VMCLEAR and VMPTRLD.
+- */
+- struct vmcs12 *cached_vmcs12;
+- /*
+- * Cache of the guest's shadow VMCS, existing outside of guest
+- * memory. Loaded from guest memory during VM entry. Flushed
+- * to guest memory during VM exit.
+- */
+- struct vmcs12 *cached_shadow_vmcs12;
+- /*
+- * Indicates if the shadow vmcs must be updated with the
+- * data hold by vmcs12
+- */
+- bool sync_shadow_vmcs;
+- bool dirty_vmcs12;
+-
+- bool change_vmcs01_virtual_apic_mode;
+-
+- /* L2 must run next, and mustn't decide to exit to L1. */
+- bool nested_run_pending;
+-
+- struct loaded_vmcs vmcs02;
+-
+- /*
+- * Guest pages referred to in the vmcs02 with host-physical
+- * pointers, so we must keep them pinned while L2 runs.
+- */
+- struct page *apic_access_page;
+- struct page *virtual_apic_page;
+- struct page *pi_desc_page;
+- struct pi_desc *pi_desc;
+- bool pi_pending;
+- u16 posted_intr_nv;
+-
+- struct hrtimer preemption_timer;
+- bool preemption_timer_expired;
+-
+- /* to migrate it to L2 if VM_ENTRY_LOAD_DEBUG_CONTROLS is off */
+- u64 vmcs01_debugctl;
+- u64 vmcs01_guest_bndcfgs;
+-
+- u16 vpid02;
+- u16 last_vpid;
+-
+- struct nested_vmx_msrs msrs;
+-
+- /* SMM related state */
+- struct {
+- /* in VMX operation on SMM entry? */
+- bool vmxon;
+- /* in guest mode on SMM entry? */
+- bool guest_mode;
+- } smm;
+-};
+-
+-#define POSTED_INTR_ON 0
+-#define POSTED_INTR_SN 1
+-
+-/* Posted-Interrupt Descriptor */
+-struct pi_desc {
+- u32 pir[8]; /* Posted interrupt requested */
+- union {
+- struct {
+- /* bit 256 - Outstanding Notification */
+- u16 on : 1,
+- /* bit 257 - Suppress Notification */
+- sn : 1,
+- /* bit 271:258 - Reserved */
+- rsvd_1 : 14;
+- /* bit 279:272 - Notification Vector */
+- u8 nv;
+- /* bit 287:280 - Reserved */
+- u8 rsvd_2;
+- /* bit 319:288 - Notification Destination */
+- u32 ndst;
+- };
+- u64 control;
+- };
+- u32 rsvd[6];
+-} __aligned(64);
+-
+-static bool pi_test_and_set_on(struct pi_desc *pi_desc)
+-{
+- return test_and_set_bit(POSTED_INTR_ON,
+- (unsigned long *)&pi_desc->control);
+-}
+-
+-static bool pi_test_and_clear_on(struct pi_desc *pi_desc)
+-{
+- return test_and_clear_bit(POSTED_INTR_ON,
+- (unsigned long *)&pi_desc->control);
+-}
+-
+-static int pi_test_and_set_pir(int vector, struct pi_desc *pi_desc)
+-{
+- return test_and_set_bit(vector, (unsigned long *)pi_desc->pir);
+-}
+-
+-static inline void pi_clear_sn(struct pi_desc *pi_desc)
+-{
+- return clear_bit(POSTED_INTR_SN,
+- (unsigned long *)&pi_desc->control);
+-}
+-
+-static inline void pi_set_sn(struct pi_desc *pi_desc)
+-{
+- return set_bit(POSTED_INTR_SN,
+- (unsigned long *)&pi_desc->control);
+-}
+-
+-static inline void pi_clear_on(struct pi_desc *pi_desc)
+-{
+- clear_bit(POSTED_INTR_ON,
+- (unsigned long *)&pi_desc->control);
+-}
+-
+-static inline int pi_test_on(struct pi_desc *pi_desc)
+-{
+- return test_bit(POSTED_INTR_ON,
+- (unsigned long *)&pi_desc->control);
+-}
+-
+-static inline int pi_test_sn(struct pi_desc *pi_desc)
+-{
+- return test_bit(POSTED_INTR_SN,
+- (unsigned long *)&pi_desc->control);
+-}
+-
+-struct vmx_msrs {
+- unsigned int nr;
+- struct vmx_msr_entry val[NR_AUTOLOAD_MSRS];
+-};
+-
+-struct vcpu_vmx {
+- struct kvm_vcpu vcpu;
+- unsigned long host_rsp;
+- u8 fail;
+- u8 msr_bitmap_mode;
+- u32 exit_intr_info;
+- u32 idt_vectoring_info;
+- ulong rflags;
+- struct shared_msr_entry *guest_msrs;
+- int nmsrs;
+- int save_nmsrs;
+- bool guest_msrs_dirty;
+- unsigned long host_idt_base;
+-#ifdef CONFIG_X86_64
+- u64 msr_host_kernel_gs_base;
+- u64 msr_guest_kernel_gs_base;
+-#endif
+-
+- u64 spec_ctrl;
+-
+- u32 vm_entry_controls_shadow;
+- u32 vm_exit_controls_shadow;
+- u32 secondary_exec_control;
+-
+- /*
+- * loaded_vmcs points to the VMCS currently used in this vcpu. For a
+- * non-nested (L1) guest, it always points to vmcs01. For a nested
+- * guest (L2), it points to a different VMCS. loaded_cpu_state points
+- * to the VMCS whose state is loaded into the CPU registers that only
+- * need to be switched when transitioning to/from the kernel; a NULL
+- * value indicates that host state is loaded.
+- */
+- struct loaded_vmcs vmcs01;
+- struct loaded_vmcs *loaded_vmcs;
+- struct loaded_vmcs *loaded_cpu_state;
+- bool __launched; /* temporary, used in vmx_vcpu_run */
+- struct msr_autoload {
+- struct vmx_msrs guest;
+- struct vmx_msrs host;
+- } msr_autoload;
+-
+- struct {
+- int vm86_active;
+- ulong save_rflags;
+- struct kvm_segment segs[8];
+- } rmode;
+- struct {
+- u32 bitmask; /* 4 bits per segment (1 bit per field) */
+- struct kvm_save_segment {
+- u16 selector;
+- unsigned long base;
+- u32 limit;
+- u32 ar;
+- } seg[8];
+- } segment_cache;
+- int vpid;
+- bool emulation_required;
+-
+- u32 exit_reason;
+-
+- /* Posted interrupt descriptor */
+- struct pi_desc pi_desc;
+-
+- /* Support for a guest hypervisor (nested VMX) */
+- struct nested_vmx nested;
+-
+- /* Dynamic PLE window. */
+- int ple_window;
+- bool ple_window_dirty;
+-
+- bool req_immediate_exit;
+-
+- /* Support for PML */
+-#define PML_ENTITY_NUM 512
+- struct page *pml_pg;
+-
+- /* apic deadline value in host tsc */
+- u64 hv_deadline_tsc;
+-
+- u64 current_tsc_ratio;
+-
+- u32 host_pkru;
+-
+- unsigned long host_debugctlmsr;
+-
+- /*
+- * Only bits masked by msr_ia32_feature_control_valid_bits can be set in
+- * msr_ia32_feature_control. FEATURE_CONTROL_LOCKED is always included
+- * in msr_ia32_feature_control_valid_bits.
+- */
+- u64 msr_ia32_feature_control;
+- u64 msr_ia32_feature_control_valid_bits;
+- u64 ept_pointer;
+- u64 msr_ia32_mcu_opt_ctrl;
+- bool disable_fb_clear;
+-};
+-
+-enum segment_cache_field {
+- SEG_FIELD_SEL = 0,
+- SEG_FIELD_BASE = 1,
+- SEG_FIELD_LIMIT = 2,
+- SEG_FIELD_AR = 3,
+-
+- SEG_FIELD_NR = 4
+-};
+-
+-static inline struct kvm_vmx *to_kvm_vmx(struct kvm *kvm)
+-{
+- return container_of(kvm, struct kvm_vmx, kvm);
+-}
+-
+-static inline struct vcpu_vmx *to_vmx(struct kvm_vcpu *vcpu)
+-{
+- return container_of(vcpu, struct vcpu_vmx, vcpu);
+-}
+-
+-static struct pi_desc *vcpu_to_pi_desc(struct kvm_vcpu *vcpu)
+-{
+- return &(to_vmx(vcpu)->pi_desc);
+-}
+-
+-#define ROL16(val, n) ((u16)(((u16)(val) << (n)) | ((u16)(val) >> (16 - (n)))))
+-#define VMCS12_OFFSET(x) offsetof(struct vmcs12, x)
+-#define FIELD(number, name) [ROL16(number, 6)] = VMCS12_OFFSET(name)
+-#define FIELD64(number, name) \
+- FIELD(number, name), \
+- [ROL16(number##_HIGH, 6)] = VMCS12_OFFSET(name) + sizeof(u32)
+-
+-
+-static u16 shadow_read_only_fields[] = {
+-#define SHADOW_FIELD_RO(x) x,
+-#include "vmx_shadow_fields.h"
+-};
+-static int max_shadow_read_only_fields =
+- ARRAY_SIZE(shadow_read_only_fields);
+-
+-static u16 shadow_read_write_fields[] = {
+-#define SHADOW_FIELD_RW(x) x,
+-#include "vmx_shadow_fields.h"
+-};
+-static int max_shadow_read_write_fields =
+- ARRAY_SIZE(shadow_read_write_fields);
+-
+-static const unsigned short vmcs_field_to_offset_table[] = {
+- FIELD(VIRTUAL_PROCESSOR_ID, virtual_processor_id),
+- FIELD(POSTED_INTR_NV, posted_intr_nv),
+- FIELD(GUEST_ES_SELECTOR, guest_es_selector),
+- FIELD(GUEST_CS_SELECTOR, guest_cs_selector),
+- FIELD(GUEST_SS_SELECTOR, guest_ss_selector),
+- FIELD(GUEST_DS_SELECTOR, guest_ds_selector),
+- FIELD(GUEST_FS_SELECTOR, guest_fs_selector),
+- FIELD(GUEST_GS_SELECTOR, guest_gs_selector),
+- FIELD(GUEST_LDTR_SELECTOR, guest_ldtr_selector),
+- FIELD(GUEST_TR_SELECTOR, guest_tr_selector),
+- FIELD(GUEST_INTR_STATUS, guest_intr_status),
+- FIELD(GUEST_PML_INDEX, guest_pml_index),
+- FIELD(HOST_ES_SELECTOR, host_es_selector),
+- FIELD(HOST_CS_SELECTOR, host_cs_selector),
+- FIELD(HOST_SS_SELECTOR, host_ss_selector),
+- FIELD(HOST_DS_SELECTOR, host_ds_selector),
+- FIELD(HOST_FS_SELECTOR, host_fs_selector),
+- FIELD(HOST_GS_SELECTOR, host_gs_selector),
+- FIELD(HOST_TR_SELECTOR, host_tr_selector),
+- FIELD64(IO_BITMAP_A, io_bitmap_a),
+- FIELD64(IO_BITMAP_B, io_bitmap_b),
+- FIELD64(MSR_BITMAP, msr_bitmap),
+- FIELD64(VM_EXIT_MSR_STORE_ADDR, vm_exit_msr_store_addr),
+- FIELD64(VM_EXIT_MSR_LOAD_ADDR, vm_exit_msr_load_addr),
+- FIELD64(VM_ENTRY_MSR_LOAD_ADDR, vm_entry_msr_load_addr),
+- FIELD64(PML_ADDRESS, pml_address),
+- FIELD64(TSC_OFFSET, tsc_offset),
+- FIELD64(VIRTUAL_APIC_PAGE_ADDR, virtual_apic_page_addr),
+- FIELD64(APIC_ACCESS_ADDR, apic_access_addr),
+- FIELD64(POSTED_INTR_DESC_ADDR, posted_intr_desc_addr),
+- FIELD64(VM_FUNCTION_CONTROL, vm_function_control),
+- FIELD64(EPT_POINTER, ept_pointer),
+- FIELD64(EOI_EXIT_BITMAP0, eoi_exit_bitmap0),
+- FIELD64(EOI_EXIT_BITMAP1, eoi_exit_bitmap1),
+- FIELD64(EOI_EXIT_BITMAP2, eoi_exit_bitmap2),
+- FIELD64(EOI_EXIT_BITMAP3, eoi_exit_bitmap3),
+- FIELD64(EPTP_LIST_ADDRESS, eptp_list_address),
+- FIELD64(VMREAD_BITMAP, vmread_bitmap),
+- FIELD64(VMWRITE_BITMAP, vmwrite_bitmap),
+- FIELD64(XSS_EXIT_BITMAP, xss_exit_bitmap),
+- FIELD64(GUEST_PHYSICAL_ADDRESS, guest_physical_address),
+- FIELD64(VMCS_LINK_POINTER, vmcs_link_pointer),
+- FIELD64(GUEST_IA32_DEBUGCTL, guest_ia32_debugctl),
+- FIELD64(GUEST_IA32_PAT, guest_ia32_pat),
+- FIELD64(GUEST_IA32_EFER, guest_ia32_efer),
+- FIELD64(GUEST_IA32_PERF_GLOBAL_CTRL, guest_ia32_perf_global_ctrl),
+- FIELD64(GUEST_PDPTR0, guest_pdptr0),
+- FIELD64(GUEST_PDPTR1, guest_pdptr1),
+- FIELD64(GUEST_PDPTR2, guest_pdptr2),
+- FIELD64(GUEST_PDPTR3, guest_pdptr3),
+- FIELD64(GUEST_BNDCFGS, guest_bndcfgs),
+- FIELD64(HOST_IA32_PAT, host_ia32_pat),
+- FIELD64(HOST_IA32_EFER, host_ia32_efer),
+- FIELD64(HOST_IA32_PERF_GLOBAL_CTRL, host_ia32_perf_global_ctrl),
+- FIELD(PIN_BASED_VM_EXEC_CONTROL, pin_based_vm_exec_control),
+- FIELD(CPU_BASED_VM_EXEC_CONTROL, cpu_based_vm_exec_control),
+- FIELD(EXCEPTION_BITMAP, exception_bitmap),
+- FIELD(PAGE_FAULT_ERROR_CODE_MASK, page_fault_error_code_mask),
+- FIELD(PAGE_FAULT_ERROR_CODE_MATCH, page_fault_error_code_match),
+- FIELD(CR3_TARGET_COUNT, cr3_target_count),
+- FIELD(VM_EXIT_CONTROLS, vm_exit_controls),
+- FIELD(VM_EXIT_MSR_STORE_COUNT, vm_exit_msr_store_count),
+- FIELD(VM_EXIT_MSR_LOAD_COUNT, vm_exit_msr_load_count),
+- FIELD(VM_ENTRY_CONTROLS, vm_entry_controls),
+- FIELD(VM_ENTRY_MSR_LOAD_COUNT, vm_entry_msr_load_count),
+- FIELD(VM_ENTRY_INTR_INFO_FIELD, vm_entry_intr_info_field),
+- FIELD(VM_ENTRY_EXCEPTION_ERROR_CODE, vm_entry_exception_error_code),
+- FIELD(VM_ENTRY_INSTRUCTION_LEN, vm_entry_instruction_len),
+- FIELD(TPR_THRESHOLD, tpr_threshold),
+- FIELD(SECONDARY_VM_EXEC_CONTROL, secondary_vm_exec_control),
+- FIELD(VM_INSTRUCTION_ERROR, vm_instruction_error),
+- FIELD(VM_EXIT_REASON, vm_exit_reason),
+- FIELD(VM_EXIT_INTR_INFO, vm_exit_intr_info),
+- FIELD(VM_EXIT_INTR_ERROR_CODE, vm_exit_intr_error_code),
+- FIELD(IDT_VECTORING_INFO_FIELD, idt_vectoring_info_field),
+- FIELD(IDT_VECTORING_ERROR_CODE, idt_vectoring_error_code),
+- FIELD(VM_EXIT_INSTRUCTION_LEN, vm_exit_instruction_len),
+- FIELD(VMX_INSTRUCTION_INFO, vmx_instruction_info),
+- FIELD(GUEST_ES_LIMIT, guest_es_limit),
+- FIELD(GUEST_CS_LIMIT, guest_cs_limit),
+- FIELD(GUEST_SS_LIMIT, guest_ss_limit),
+- FIELD(GUEST_DS_LIMIT, guest_ds_limit),
+- FIELD(GUEST_FS_LIMIT, guest_fs_limit),
+- FIELD(GUEST_GS_LIMIT, guest_gs_limit),
+- FIELD(GUEST_LDTR_LIMIT, guest_ldtr_limit),
+- FIELD(GUEST_TR_LIMIT, guest_tr_limit),
+- FIELD(GUEST_GDTR_LIMIT, guest_gdtr_limit),
+- FIELD(GUEST_IDTR_LIMIT, guest_idtr_limit),
+- FIELD(GUEST_ES_AR_BYTES, guest_es_ar_bytes),
+- FIELD(GUEST_CS_AR_BYTES, guest_cs_ar_bytes),
+- FIELD(GUEST_SS_AR_BYTES, guest_ss_ar_bytes),
+- FIELD(GUEST_DS_AR_BYTES, guest_ds_ar_bytes),
+- FIELD(GUEST_FS_AR_BYTES, guest_fs_ar_bytes),
+- FIELD(GUEST_GS_AR_BYTES, guest_gs_ar_bytes),
+- FIELD(GUEST_LDTR_AR_BYTES, guest_ldtr_ar_bytes),
+- FIELD(GUEST_TR_AR_BYTES, guest_tr_ar_bytes),
+- FIELD(GUEST_INTERRUPTIBILITY_INFO, guest_interruptibility_info),
+- FIELD(GUEST_ACTIVITY_STATE, guest_activity_state),
+- FIELD(GUEST_SYSENTER_CS, guest_sysenter_cs),
+- FIELD(HOST_IA32_SYSENTER_CS, host_ia32_sysenter_cs),
+- FIELD(VMX_PREEMPTION_TIMER_VALUE, vmx_preemption_timer_value),
+- FIELD(CR0_GUEST_HOST_MASK, cr0_guest_host_mask),
+- FIELD(CR4_GUEST_HOST_MASK, cr4_guest_host_mask),
+- FIELD(CR0_READ_SHADOW, cr0_read_shadow),
+- FIELD(CR4_READ_SHADOW, cr4_read_shadow),
+- FIELD(CR3_TARGET_VALUE0, cr3_target_value0),
+- FIELD(CR3_TARGET_VALUE1, cr3_target_value1),
+- FIELD(CR3_TARGET_VALUE2, cr3_target_value2),
+- FIELD(CR3_TARGET_VALUE3, cr3_target_value3),
+- FIELD(EXIT_QUALIFICATION, exit_qualification),
+- FIELD(GUEST_LINEAR_ADDRESS, guest_linear_address),
+- FIELD(GUEST_CR0, guest_cr0),
+- FIELD(GUEST_CR3, guest_cr3),
+- FIELD(GUEST_CR4, guest_cr4),
+- FIELD(GUEST_ES_BASE, guest_es_base),
+- FIELD(GUEST_CS_BASE, guest_cs_base),
+- FIELD(GUEST_SS_BASE, guest_ss_base),
+- FIELD(GUEST_DS_BASE, guest_ds_base),
+- FIELD(GUEST_FS_BASE, guest_fs_base),
+- FIELD(GUEST_GS_BASE, guest_gs_base),
+- FIELD(GUEST_LDTR_BASE, guest_ldtr_base),
+- FIELD(GUEST_TR_BASE, guest_tr_base),
+- FIELD(GUEST_GDTR_BASE, guest_gdtr_base),
+- FIELD(GUEST_IDTR_BASE, guest_idtr_base),
+- FIELD(GUEST_DR7, guest_dr7),
+- FIELD(GUEST_RSP, guest_rsp),
+- FIELD(GUEST_RIP, guest_rip),
+- FIELD(GUEST_RFLAGS, guest_rflags),
+- FIELD(GUEST_PENDING_DBG_EXCEPTIONS, guest_pending_dbg_exceptions),
+- FIELD(GUEST_SYSENTER_ESP, guest_sysenter_esp),
+- FIELD(GUEST_SYSENTER_EIP, guest_sysenter_eip),
+- FIELD(HOST_CR0, host_cr0),
+- FIELD(HOST_CR3, host_cr3),
+- FIELD(HOST_CR4, host_cr4),
+- FIELD(HOST_FS_BASE, host_fs_base),
+- FIELD(HOST_GS_BASE, host_gs_base),
+- FIELD(HOST_TR_BASE, host_tr_base),
+- FIELD(HOST_GDTR_BASE, host_gdtr_base),
+- FIELD(HOST_IDTR_BASE, host_idtr_base),
+- FIELD(HOST_IA32_SYSENTER_ESP, host_ia32_sysenter_esp),
+- FIELD(HOST_IA32_SYSENTER_EIP, host_ia32_sysenter_eip),
+- FIELD(HOST_RSP, host_rsp),
+- FIELD(HOST_RIP, host_rip),
+-};
+-
+-static inline short vmcs_field_to_offset(unsigned long field)
+-{
+- const size_t size = ARRAY_SIZE(vmcs_field_to_offset_table);
+- unsigned short offset;
+- unsigned index;
+-
+- if (field >> 15)
+- return -ENOENT;
+-
+- index = ROL16(field, 6);
+- if (index >= size)
+- return -ENOENT;
+-
+- index = array_index_nospec(index, size);
+- offset = vmcs_field_to_offset_table[index];
+- if (offset == 0)
+- return -ENOENT;
+- return offset;
+-}
+-
+-static inline struct vmcs12 *get_vmcs12(struct kvm_vcpu *vcpu)
+-{
+- return to_vmx(vcpu)->nested.cached_vmcs12;
+-}
+-
+-static inline struct vmcs12 *get_shadow_vmcs12(struct kvm_vcpu *vcpu)
+-{
+- return to_vmx(vcpu)->nested.cached_shadow_vmcs12;
+-}
+-
+-static bool nested_ept_ad_enabled(struct kvm_vcpu *vcpu);
+-static unsigned long nested_ept_get_cr3(struct kvm_vcpu *vcpu);
+-static u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa);
+-static bool vmx_xsaves_supported(void);
+-static void vmx_set_segment(struct kvm_vcpu *vcpu,
+- struct kvm_segment *var, int seg);
+-static void vmx_get_segment(struct kvm_vcpu *vcpu,
+- struct kvm_segment *var, int seg);
+-static bool guest_state_valid(struct kvm_vcpu *vcpu);
+-static u32 vmx_segment_access_rights(struct kvm_segment *var);
+-static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx);
+-static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu);
+-static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked);
+-static bool nested_vmx_is_page_fault_vmexit(struct vmcs12 *vmcs12,
+- u16 error_code);
+-static void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu);
+-static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
+- u32 msr, int type);
+-
+-static DEFINE_PER_CPU(struct vmcs *, vmxarea);
+-static DEFINE_PER_CPU(struct vmcs *, current_vmcs);
+-/*
+- * We maintain a per-CPU linked-list of VMCS loaded on that CPU. This is needed
+- * when a CPU is brought down, and we need to VMCLEAR all VMCSs loaded on it.
+- */
+-static DEFINE_PER_CPU(struct list_head, loaded_vmcss_on_cpu);
+-
+-/*
+- * We maintian a per-CPU linked-list of vCPU, so in wakeup_handler() we
+- * can find which vCPU should be waken up.
+- */
+-static DEFINE_PER_CPU(struct list_head, blocked_vcpu_on_cpu);
+-static DEFINE_PER_CPU(spinlock_t, blocked_vcpu_on_cpu_lock);
+-
+-enum {
+- VMX_VMREAD_BITMAP,
+- VMX_VMWRITE_BITMAP,
+- VMX_BITMAP_NR
+-};
+-
+-static unsigned long *vmx_bitmap[VMX_BITMAP_NR];
+-
+-#define vmx_vmread_bitmap (vmx_bitmap[VMX_VMREAD_BITMAP])
+-#define vmx_vmwrite_bitmap (vmx_bitmap[VMX_VMWRITE_BITMAP])
+-
+-static bool cpu_has_load_ia32_efer;
+-static bool cpu_has_load_perf_global_ctrl;
+-
+-static DECLARE_BITMAP(vmx_vpid_bitmap, VMX_NR_VPIDS);
+-static DEFINE_SPINLOCK(vmx_vpid_lock);
+-
+-static struct vmcs_config {
+- int size;
+- int order;
+- u32 basic_cap;
+- u32 revision_id;
+- u32 pin_based_exec_ctrl;
+- u32 cpu_based_exec_ctrl;
+- u32 cpu_based_2nd_exec_ctrl;
+- u32 vmexit_ctrl;
+- u32 vmentry_ctrl;
+- struct nested_vmx_msrs nested;
+-} vmcs_config;
+-
+-static struct vmx_capability {
+- u32 ept;
+- u32 vpid;
+-} vmx_capability;
+-
+-#define VMX_SEGMENT_FIELD(seg) \
+- [VCPU_SREG_##seg] = { \
+- .selector = GUEST_##seg##_SELECTOR, \
+- .base = GUEST_##seg##_BASE, \
+- .limit = GUEST_##seg##_LIMIT, \
+- .ar_bytes = GUEST_##seg##_AR_BYTES, \
+- }
+-
+-static const struct kvm_vmx_segment_field {
+- unsigned selector;
+- unsigned base;
+- unsigned limit;
+- unsigned ar_bytes;
+-} kvm_vmx_segment_fields[] = {
+- VMX_SEGMENT_FIELD(CS),
+- VMX_SEGMENT_FIELD(DS),
+- VMX_SEGMENT_FIELD(ES),
+- VMX_SEGMENT_FIELD(FS),
+- VMX_SEGMENT_FIELD(GS),
+- VMX_SEGMENT_FIELD(SS),
+- VMX_SEGMENT_FIELD(TR),
+- VMX_SEGMENT_FIELD(LDTR),
+-};
+-
+-static u64 host_efer;
+-
+-static void ept_save_pdptrs(struct kvm_vcpu *vcpu);
+-
+-/*
+- * Keep MSR_STAR at the end, as setup_msrs() will try to optimize it
+- * away by decrementing the array size.
+- */
+-static const u32 vmx_msr_index[] = {
+-#ifdef CONFIG_X86_64
+- MSR_SYSCALL_MASK, MSR_LSTAR, MSR_CSTAR,
+-#endif
+- MSR_EFER, MSR_TSC_AUX, MSR_STAR,
+-};
+-
+-DEFINE_STATIC_KEY_FALSE(enable_evmcs);
+-
+-#define current_evmcs ((struct hv_enlightened_vmcs *)this_cpu_read(current_vmcs))
+-
+-#define KVM_EVMCS_VERSION 1
+-
+-#if IS_ENABLED(CONFIG_HYPERV)
+-static bool __read_mostly enlightened_vmcs = true;
+-module_param(enlightened_vmcs, bool, 0444);
+-
+-static inline void evmcs_write64(unsigned long field, u64 value)
+-{
+- u16 clean_field;
+- int offset = get_evmcs_offset(field, &clean_field);
+-
+- if (offset < 0)
+- return;
+-
+- *(u64 *)((char *)current_evmcs + offset) = value;
+-
+- current_evmcs->hv_clean_fields &= ~clean_field;
+-}
+-
+-static inline void evmcs_write32(unsigned long field, u32 value)
+-{
+- u16 clean_field;
+- int offset = get_evmcs_offset(field, &clean_field);
+-
+- if (offset < 0)
+- return;
+-
+- *(u32 *)((char *)current_evmcs + offset) = value;
+- current_evmcs->hv_clean_fields &= ~clean_field;
+-}
+-
+-static inline void evmcs_write16(unsigned long field, u16 value)
+-{
+- u16 clean_field;
+- int offset = get_evmcs_offset(field, &clean_field);
+-
+- if (offset < 0)
+- return;
+-
+- *(u16 *)((char *)current_evmcs + offset) = value;
+- current_evmcs->hv_clean_fields &= ~clean_field;
+-}
+-
+-static inline u64 evmcs_read64(unsigned long field)
+-{
+- int offset = get_evmcs_offset(field, NULL);
+-
+- if (offset < 0)
+- return 0;
+-
+- return *(u64 *)((char *)current_evmcs + offset);
+-}
+-
+-static inline u32 evmcs_read32(unsigned long field)
+-{
+- int offset = get_evmcs_offset(field, NULL);
+-
+- if (offset < 0)
+- return 0;
+-
+- return *(u32 *)((char *)current_evmcs + offset);
+-}
+-
+-static inline u16 evmcs_read16(unsigned long field)
+-{
+- int offset = get_evmcs_offset(field, NULL);
+-
+- if (offset < 0)
+- return 0;
+-
+- return *(u16 *)((char *)current_evmcs + offset);
+-}
+-
+-static inline void evmcs_touch_msr_bitmap(void)
+-{
+- if (unlikely(!current_evmcs))
+- return;
+-
+- if (current_evmcs->hv_enlightenments_control.msr_bitmap)
+- current_evmcs->hv_clean_fields &=
+- ~HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP;
+-}
+-
+-static void evmcs_load(u64 phys_addr)
+-{
+- struct hv_vp_assist_page *vp_ap =
+- hv_get_vp_assist_page(smp_processor_id());
+-
+- vp_ap->current_nested_vmcs = phys_addr;
+- vp_ap->enlighten_vmentry = 1;
+-}
+-
+-static void evmcs_sanitize_exec_ctrls(struct vmcs_config *vmcs_conf)
+-{
+- /*
+- * Enlightened VMCSv1 doesn't support these:
+- *
+- * POSTED_INTR_NV = 0x00000002,
+- * GUEST_INTR_STATUS = 0x00000810,
+- * APIC_ACCESS_ADDR = 0x00002014,
+- * POSTED_INTR_DESC_ADDR = 0x00002016,
+- * EOI_EXIT_BITMAP0 = 0x0000201c,
+- * EOI_EXIT_BITMAP1 = 0x0000201e,
+- * EOI_EXIT_BITMAP2 = 0x00002020,
+- * EOI_EXIT_BITMAP3 = 0x00002022,
+- */
+- vmcs_conf->pin_based_exec_ctrl &= ~PIN_BASED_POSTED_INTR;
+- vmcs_conf->cpu_based_2nd_exec_ctrl &=
+- ~SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY;
+- vmcs_conf->cpu_based_2nd_exec_ctrl &=
+- ~SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+- vmcs_conf->cpu_based_2nd_exec_ctrl &=
+- ~SECONDARY_EXEC_APIC_REGISTER_VIRT;
+-
+- /*
+- * GUEST_PML_INDEX = 0x00000812,
+- * PML_ADDRESS = 0x0000200e,
+- */
+- vmcs_conf->cpu_based_2nd_exec_ctrl &= ~SECONDARY_EXEC_ENABLE_PML;
+-
+- /* VM_FUNCTION_CONTROL = 0x00002018, */
+- vmcs_conf->cpu_based_2nd_exec_ctrl &= ~SECONDARY_EXEC_ENABLE_VMFUNC;
+-
+- /*
+- * EPTP_LIST_ADDRESS = 0x00002024,
+- * VMREAD_BITMAP = 0x00002026,
+- * VMWRITE_BITMAP = 0x00002028,
+- */
+- vmcs_conf->cpu_based_2nd_exec_ctrl &= ~SECONDARY_EXEC_SHADOW_VMCS;
+-
+- /*
+- * TSC_MULTIPLIER = 0x00002032,
+- */
+- vmcs_conf->cpu_based_2nd_exec_ctrl &= ~SECONDARY_EXEC_TSC_SCALING;
+-
+- /*
+- * PLE_GAP = 0x00004020,
+- * PLE_WINDOW = 0x00004022,
+- */
+- vmcs_conf->cpu_based_2nd_exec_ctrl &= ~SECONDARY_EXEC_PAUSE_LOOP_EXITING;
+-
+- /*
+- * VMX_PREEMPTION_TIMER_VALUE = 0x0000482E,
+- */
+- vmcs_conf->pin_based_exec_ctrl &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
+-
+- /*
+- * GUEST_IA32_PERF_GLOBAL_CTRL = 0x00002808,
+- * HOST_IA32_PERF_GLOBAL_CTRL = 0x00002c04,
+- */
+- vmcs_conf->vmexit_ctrl &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
+- vmcs_conf->vmentry_ctrl &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
+-
+- /*
+- * Currently unsupported in KVM:
+- * GUEST_IA32_RTIT_CTL = 0x00002814,
+- */
+-}
+-
+-/* check_ept_pointer() should be under protection of ept_pointer_lock. */
+-static void check_ept_pointer_match(struct kvm *kvm)
+-{
+- struct kvm_vcpu *vcpu;
+- u64 tmp_eptp = INVALID_PAGE;
+- int i;
+-
+- kvm_for_each_vcpu(i, vcpu, kvm) {
+- if (!VALID_PAGE(tmp_eptp)) {
+- tmp_eptp = to_vmx(vcpu)->ept_pointer;
+- } else if (tmp_eptp != to_vmx(vcpu)->ept_pointer) {
+- to_kvm_vmx(kvm)->ept_pointers_match
+- = EPT_POINTERS_MISMATCH;
+- return;
+- }
+- }
+-
+- to_kvm_vmx(kvm)->ept_pointers_match = EPT_POINTERS_MATCH;
+-}
+-
+-static int vmx_hv_remote_flush_tlb(struct kvm *kvm)
+-{
+- int ret;
+-
+- spin_lock(&to_kvm_vmx(kvm)->ept_pointer_lock);
+-
+- if (to_kvm_vmx(kvm)->ept_pointers_match == EPT_POINTERS_CHECK)
+- check_ept_pointer_match(kvm);
+-
+- if (to_kvm_vmx(kvm)->ept_pointers_match != EPT_POINTERS_MATCH) {
+- ret = -ENOTSUPP;
+- goto out;
+- }
+-
+- /*
+- * FLUSH_GUEST_PHYSICAL_ADDRESS_SPACE hypercall needs the address of the
+- * base of EPT PML4 table, strip off EPT configuration information.
+- */
+- ret = hyperv_flush_guest_mapping(
+- to_vmx(kvm_get_vcpu(kvm, 0))->ept_pointer & PAGE_MASK);
+-
+-out:
+- spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock);
+- return ret;
+-}
+-#else /* !IS_ENABLED(CONFIG_HYPERV) */
+-static inline void evmcs_write64(unsigned long field, u64 value) {}
+-static inline void evmcs_write32(unsigned long field, u32 value) {}
+-static inline void evmcs_write16(unsigned long field, u16 value) {}
+-static inline u64 evmcs_read64(unsigned long field) { return 0; }
+-static inline u32 evmcs_read32(unsigned long field) { return 0; }
+-static inline u16 evmcs_read16(unsigned long field) { return 0; }
+-static inline void evmcs_load(u64 phys_addr) {}
+-static inline void evmcs_sanitize_exec_ctrls(struct vmcs_config *vmcs_conf) {}
+-static inline void evmcs_touch_msr_bitmap(void) {}
+-#endif /* IS_ENABLED(CONFIG_HYPERV) */
+-
+-static inline bool is_exception_n(u32 intr_info, u8 vector)
+-{
+- return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VECTOR_MASK |
+- INTR_INFO_VALID_MASK)) ==
+- (INTR_TYPE_HARD_EXCEPTION | vector | INTR_INFO_VALID_MASK);
+-}
+-
+-static inline bool is_debug(u32 intr_info)
+-{
+- return is_exception_n(intr_info, DB_VECTOR);
+-}
+-
+-static inline bool is_breakpoint(u32 intr_info)
+-{
+- return is_exception_n(intr_info, BP_VECTOR);
+-}
+-
+-static inline bool is_page_fault(u32 intr_info)
+-{
+- return is_exception_n(intr_info, PF_VECTOR);
+-}
+-
+-static inline bool is_no_device(u32 intr_info)
+-{
+- return is_exception_n(intr_info, NM_VECTOR);
+-}
+-
+-static inline bool is_invalid_opcode(u32 intr_info)
+-{
+- return is_exception_n(intr_info, UD_VECTOR);
+-}
+-
+-static inline bool is_gp_fault(u32 intr_info)
+-{
+- return is_exception_n(intr_info, GP_VECTOR);
+-}
+-
+-static inline bool is_external_interrupt(u32 intr_info)
+-{
+- return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
+- == (INTR_TYPE_EXT_INTR | INTR_INFO_VALID_MASK);
+-}
+-
+-static inline bool is_machine_check(u32 intr_info)
+-{
+- return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VECTOR_MASK |
+- INTR_INFO_VALID_MASK)) ==
+- (INTR_TYPE_HARD_EXCEPTION | MC_VECTOR | INTR_INFO_VALID_MASK);
+-}
+-
+-/* Undocumented: icebp/int1 */
+-static inline bool is_icebp(u32 intr_info)
+-{
+- return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
+- == (INTR_TYPE_PRIV_SW_EXCEPTION | INTR_INFO_VALID_MASK);
+-}
+-
+-static inline bool cpu_has_vmx_msr_bitmap(void)
+-{
+- return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS;
+-}
+-
+-static inline bool cpu_has_vmx_tpr_shadow(void)
+-{
+- return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_TPR_SHADOW;
+-}
+-
+-static inline bool cpu_need_tpr_shadow(struct kvm_vcpu *vcpu)
+-{
+- return cpu_has_vmx_tpr_shadow() && lapic_in_kernel(vcpu);
+-}
+-
+-static inline bool cpu_has_secondary_exec_ctrls(void)
+-{
+- return vmcs_config.cpu_based_exec_ctrl &
+- CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
+-}
+-
+-static inline bool cpu_has_vmx_virtualize_apic_accesses(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+-}
+-
+-static inline bool cpu_has_vmx_virtualize_x2apic_mode(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
+-}
+-
+-static inline bool cpu_has_vmx_apic_register_virt(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_APIC_REGISTER_VIRT;
+-}
+-
+-static inline bool cpu_has_vmx_virtual_intr_delivery(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY;
+-}
+-
+-static inline bool cpu_has_vmx_encls_vmexit(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_ENCLS_EXITING;
+-}
+-
+-/*
+- * Comment's format: document - errata name - stepping - processor name.
+- * Refer from
+- * https://www.virtualbox.org/svn/vbox/trunk/src/VBox/VMM/VMMR0/HMR0.cpp
+- */
+-static u32 vmx_preemption_cpu_tfms[] = {
+-/* 323344.pdf - BA86 - D0 - Xeon 7500 Series */
+-0x000206E6,
+-/* 323056.pdf - AAX65 - C2 - Xeon L3406 */
+-/* 322814.pdf - AAT59 - C2 - i7-600, i5-500, i5-400 and i3-300 Mobile */
+-/* 322911.pdf - AAU65 - C2 - i5-600, i3-500 Desktop and Pentium G6950 */
+-0x00020652,
+-/* 322911.pdf - AAU65 - K0 - i5-600, i3-500 Desktop and Pentium G6950 */
+-0x00020655,
+-/* 322373.pdf - AAO95 - B1 - Xeon 3400 Series */
+-/* 322166.pdf - AAN92 - B1 - i7-800 and i5-700 Desktop */
+-/*
+- * 320767.pdf - AAP86 - B1 -
+- * i7-900 Mobile Extreme, i7-800 and i7-700 Mobile
+- */
+-0x000106E5,
+-/* 321333.pdf - AAM126 - C0 - Xeon 3500 */
+-0x000106A0,
+-/* 321333.pdf - AAM126 - C1 - Xeon 3500 */
+-0x000106A1,
+-/* 320836.pdf - AAJ124 - C0 - i7-900 Desktop Extreme and i7-900 Desktop */
+-0x000106A4,
+- /* 321333.pdf - AAM126 - D0 - Xeon 3500 */
+- /* 321324.pdf - AAK139 - D0 - Xeon 5500 */
+- /* 320836.pdf - AAJ124 - D0 - i7-900 Extreme and i7-900 Desktop */
+-0x000106A5,
+-};
+-
+-static inline bool cpu_has_broken_vmx_preemption_timer(void)
+-{
+- u32 eax = cpuid_eax(0x00000001), i;
+-
+- /* Clear the reserved bits */
+- eax &= ~(0x3U << 14 | 0xfU << 28);
+- for (i = 0; i < ARRAY_SIZE(vmx_preemption_cpu_tfms); i++)
+- if (eax == vmx_preemption_cpu_tfms[i])
+- return true;
+-
+- return false;
+-}
+-
+-static inline bool cpu_has_vmx_preemption_timer(void)
+-{
+- return vmcs_config.pin_based_exec_ctrl &
+- PIN_BASED_VMX_PREEMPTION_TIMER;
+-}
+-
+-static inline bool cpu_has_vmx_posted_intr(void)
+-{
+- return IS_ENABLED(CONFIG_X86_LOCAL_APIC) &&
+- vmcs_config.pin_based_exec_ctrl & PIN_BASED_POSTED_INTR;
+-}
+-
+-static inline bool cpu_has_vmx_apicv(void)
+-{
+- return cpu_has_vmx_apic_register_virt() &&
+- cpu_has_vmx_virtual_intr_delivery() &&
+- cpu_has_vmx_posted_intr();
+-}
+-
+-static inline bool cpu_has_vmx_flexpriority(void)
+-{
+- return cpu_has_vmx_tpr_shadow() &&
+- cpu_has_vmx_virtualize_apic_accesses();
+-}
+-
+-static inline bool cpu_has_vmx_ept_execute_only(void)
+-{
+- return vmx_capability.ept & VMX_EPT_EXECUTE_ONLY_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_ept_2m_page(void)
+-{
+- return vmx_capability.ept & VMX_EPT_2MB_PAGE_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_ept_1g_page(void)
+-{
+- return vmx_capability.ept & VMX_EPT_1GB_PAGE_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_ept_4levels(void)
+-{
+- return vmx_capability.ept & VMX_EPT_PAGE_WALK_4_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_ept_mt_wb(void)
+-{
+- return vmx_capability.ept & VMX_EPTP_WB_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_ept_5levels(void)
+-{
+- return vmx_capability.ept & VMX_EPT_PAGE_WALK_5_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_ept_ad_bits(void)
+-{
+- return vmx_capability.ept & VMX_EPT_AD_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_invept_context(void)
+-{
+- return vmx_capability.ept & VMX_EPT_EXTENT_CONTEXT_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_invept_global(void)
+-{
+- return vmx_capability.ept & VMX_EPT_EXTENT_GLOBAL_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_invvpid_individual_addr(void)
+-{
+- return vmx_capability.vpid & VMX_VPID_EXTENT_INDIVIDUAL_ADDR_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_invvpid_single(void)
+-{
+- return vmx_capability.vpid & VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_invvpid_global(void)
+-{
+- return vmx_capability.vpid & VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_invvpid(void)
+-{
+- return vmx_capability.vpid & VMX_VPID_INVVPID_BIT;
+-}
+-
+-static inline bool cpu_has_vmx_ept(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_ENABLE_EPT;
+-}
+-
+-static inline bool cpu_has_vmx_unrestricted_guest(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_UNRESTRICTED_GUEST;
+-}
+-
+-static inline bool cpu_has_vmx_ple(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_PAUSE_LOOP_EXITING;
+-}
+-
+-static inline bool cpu_has_vmx_basic_inout(void)
+-{
+- return (((u64)vmcs_config.basic_cap << 32) & VMX_BASIC_INOUT);
+-}
+-
+-static inline bool cpu_need_virtualize_apic_accesses(struct kvm_vcpu *vcpu)
+-{
+- return flexpriority_enabled && lapic_in_kernel(vcpu);
+-}
+-
+-static inline bool cpu_has_vmx_vpid(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_ENABLE_VPID;
+-}
+-
+-static inline bool cpu_has_vmx_rdtscp(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_RDTSCP;
+-}
+-
+-static inline bool cpu_has_vmx_invpcid(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_ENABLE_INVPCID;
+-}
+-
+-static inline bool cpu_has_virtual_nmis(void)
+-{
+- return vmcs_config.pin_based_exec_ctrl & PIN_BASED_VIRTUAL_NMIS;
+-}
+-
+-static inline bool cpu_has_vmx_wbinvd_exit(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_WBINVD_EXITING;
+-}
+-
+-static inline bool cpu_has_vmx_shadow_vmcs(void)
+-{
+- u64 vmx_msr;
+- rdmsrl(MSR_IA32_VMX_MISC, vmx_msr);
+- /* check if the cpu supports writing r/o exit information fields */
+- if (!(vmx_msr & MSR_IA32_VMX_MISC_VMWRITE_SHADOW_RO_FIELDS))
+- return false;
+-
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_SHADOW_VMCS;
+-}
+-
+-static inline bool cpu_has_vmx_pml(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl & SECONDARY_EXEC_ENABLE_PML;
+-}
+-
+-static inline bool cpu_has_vmx_tsc_scaling(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_TSC_SCALING;
+-}
+-
+-static inline bool cpu_has_vmx_vmfunc(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_ENABLE_VMFUNC;
+-}
+-
+-static bool vmx_umip_emulated(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_DESC;
+-}
+-
+-static inline bool report_flexpriority(void)
+-{
+- return flexpriority_enabled;
+-}
+-
+-static inline unsigned nested_cpu_vmx_misc_cr3_count(struct kvm_vcpu *vcpu)
+-{
+- return vmx_misc_cr3_count(to_vmx(vcpu)->nested.msrs.misc_low);
+-}
+-
+-/*
+- * Do the virtual VMX capability MSRs specify that L1 can use VMWRITE
+- * to modify any valid field of the VMCS, or are the VM-exit
+- * information fields read-only?
+- */
+-static inline bool nested_cpu_has_vmwrite_any_field(struct kvm_vcpu *vcpu)
+-{
+- return to_vmx(vcpu)->nested.msrs.misc_low &
+- MSR_IA32_VMX_MISC_VMWRITE_SHADOW_RO_FIELDS;
+-}
+-
+-static inline bool nested_cpu_has_zero_length_injection(struct kvm_vcpu *vcpu)
+-{
+- return to_vmx(vcpu)->nested.msrs.misc_low & VMX_MISC_ZERO_LEN_INS;
+-}
+-
+-static inline bool nested_cpu_supports_monitor_trap_flag(struct kvm_vcpu *vcpu)
+-{
+- return to_vmx(vcpu)->nested.msrs.procbased_ctls_high &
+- CPU_BASED_MONITOR_TRAP_FLAG;
+-}
+-
+-static inline bool nested_cpu_has_vmx_shadow_vmcs(struct kvm_vcpu *vcpu)
+-{
+- return to_vmx(vcpu)->nested.msrs.secondary_ctls_high &
+- SECONDARY_EXEC_SHADOW_VMCS;
+-}
+-
+-static inline bool nested_cpu_has(struct vmcs12 *vmcs12, u32 bit)
+-{
+- return vmcs12->cpu_based_vm_exec_control & bit;
+-}
+-
+-static inline bool nested_cpu_has2(struct vmcs12 *vmcs12, u32 bit)
+-{
+- return (vmcs12->cpu_based_vm_exec_control &
+- CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) &&
+- (vmcs12->secondary_vm_exec_control & bit);
+-}
+-
+-static inline bool nested_cpu_has_preemption_timer(struct vmcs12 *vmcs12)
+-{
+- return vmcs12->pin_based_vm_exec_control &
+- PIN_BASED_VMX_PREEMPTION_TIMER;
+-}
+-
+-static inline bool nested_cpu_has_nmi_exiting(struct vmcs12 *vmcs12)
+-{
+- return vmcs12->pin_based_vm_exec_control & PIN_BASED_NMI_EXITING;
+-}
+-
+-static inline bool nested_cpu_has_virtual_nmis(struct vmcs12 *vmcs12)
+-{
+- return vmcs12->pin_based_vm_exec_control & PIN_BASED_VIRTUAL_NMIS;
+-}
+-
+-static inline int nested_cpu_has_ept(struct vmcs12 *vmcs12)
+-{
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_EPT);
+-}
+-
+-static inline bool nested_cpu_has_xsaves(struct vmcs12 *vmcs12)
+-{
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES);
+-}
+-
+-static inline bool nested_cpu_has_pml(struct vmcs12 *vmcs12)
+-{
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_PML);
+-}
+-
+-static inline bool nested_cpu_has_virt_x2apic_mode(struct vmcs12 *vmcs12)
+-{
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE);
+-}
+-
+-static inline bool nested_cpu_has_vpid(struct vmcs12 *vmcs12)
+-{
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_VPID);
+-}
+-
+-static inline bool nested_cpu_has_apic_reg_virt(struct vmcs12 *vmcs12)
+-{
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_APIC_REGISTER_VIRT);
+-}
+-
+-static inline bool nested_cpu_has_vid(struct vmcs12 *vmcs12)
+-{
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
+-}
+-
+-static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12)
+-{
+- return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR;
+-}
+-
+-static inline bool nested_cpu_has_vmfunc(struct vmcs12 *vmcs12)
+-{
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_VMFUNC);
+-}
+-
+-static inline bool nested_cpu_has_eptp_switching(struct vmcs12 *vmcs12)
+-{
+- return nested_cpu_has_vmfunc(vmcs12) &&
+- (vmcs12->vm_function_control &
+- VMX_VMFUNC_EPTP_SWITCHING);
+-}
+-
+-static inline bool nested_cpu_has_shadow_vmcs(struct vmcs12 *vmcs12)
+-{
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_SHADOW_VMCS);
+-}
+-
+-static inline bool is_nmi(u32 intr_info)
+-{
+- return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
+- == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
+-}
+-
+-static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+- u32 exit_intr_info,
+- unsigned long exit_qualification);
+-static void nested_vmx_entry_failure(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12,
+- u32 reason, unsigned long qualification);
+-
+-static int __find_msr_index(struct vcpu_vmx *vmx, u32 msr)
+-{
+- int i;
+-
+- for (i = 0; i < vmx->nmsrs; ++i)
+- if (vmx_msr_index[vmx->guest_msrs[i].index] == msr)
+- return i;
+- return -1;
+-}
+-
+-static inline void __invvpid(unsigned long ext, u16 vpid, gva_t gva)
+-{
+- struct {
+- u64 vpid : 16;
+- u64 rsvd : 48;
+- u64 gva;
+- } operand = { vpid, 0, gva };
+- bool error;
+-
+- asm volatile (__ex(ASM_VMX_INVVPID) CC_SET(na)
+- : CC_OUT(na) (error) : "a"(&operand), "c"(ext)
+- : "memory");
+- BUG_ON(error);
+-}
+-
+-static inline void __invept(unsigned long ext, u64 eptp, gpa_t gpa)
+-{
+- struct {
+- u64 eptp, gpa;
+- } operand = {eptp, gpa};
+- bool error;
+-
+- asm volatile (__ex(ASM_VMX_INVEPT) CC_SET(na)
+- : CC_OUT(na) (error) : "a" (&operand), "c" (ext)
+- : "memory");
+- BUG_ON(error);
+-}
+-
+-static void vmx_setup_fb_clear_ctrl(void)
+-{
+- u64 msr;
+-
+- if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES) &&
+- !boot_cpu_has_bug(X86_BUG_MDS) &&
+- !boot_cpu_has_bug(X86_BUG_TAA)) {
+- rdmsrl(MSR_IA32_ARCH_CAPABILITIES, msr);
+- if (msr & ARCH_CAP_FB_CLEAR_CTRL)
+- vmx_fb_clear_ctrl_available = true;
+- }
+-}
+-
+-static __always_inline void vmx_disable_fb_clear(struct vcpu_vmx *vmx)
+-{
+- u64 msr;
+-
+- if (!vmx->disable_fb_clear)
+- return;
+-
+- msr = __rdmsr(MSR_IA32_MCU_OPT_CTRL);
+- msr |= FB_CLEAR_DIS;
+- native_wrmsrl(MSR_IA32_MCU_OPT_CTRL, msr);
+- /* Cache the MSR value to avoid reading it later */
+- vmx->msr_ia32_mcu_opt_ctrl = msr;
+-}
+-
+-static __always_inline void vmx_enable_fb_clear(struct vcpu_vmx *vmx)
+-{
+- if (!vmx->disable_fb_clear)
+- return;
+-
+- vmx->msr_ia32_mcu_opt_ctrl &= ~FB_CLEAR_DIS;
+- native_wrmsrl(MSR_IA32_MCU_OPT_CTRL, vmx->msr_ia32_mcu_opt_ctrl);
+-}
+-
+-static void vmx_update_fb_clear_dis(struct kvm_vcpu *vcpu, struct vcpu_vmx *vmx)
+-{
+- vmx->disable_fb_clear = vmx_fb_clear_ctrl_available;
+-
+- /*
+- * If guest will not execute VERW, there is no need to set FB_CLEAR_DIS
+- * at VMEntry. Skip the MSR read/write when a guest has no use case to
+- * execute VERW.
+- */
+- if ((vcpu->arch.arch_capabilities & ARCH_CAP_FB_CLEAR) ||
+- ((vcpu->arch.arch_capabilities & ARCH_CAP_MDS_NO) &&
+- (vcpu->arch.arch_capabilities & ARCH_CAP_TAA_NO) &&
+- (vcpu->arch.arch_capabilities & ARCH_CAP_PSDP_NO) &&
+- (vcpu->arch.arch_capabilities & ARCH_CAP_FBSDP_NO) &&
+- (vcpu->arch.arch_capabilities & ARCH_CAP_SBDR_SSDP_NO)))
+- vmx->disable_fb_clear = false;
+-}
+-
+-static struct shared_msr_entry *find_msr_entry(struct vcpu_vmx *vmx, u32 msr)
+-{
+- int i;
+-
+- i = __find_msr_index(vmx, msr);
+- if (i >= 0)
+- return &vmx->guest_msrs[i];
+- return NULL;
+-}
+-
+-static void vmcs_clear(struct vmcs *vmcs)
+-{
+- u64 phys_addr = __pa(vmcs);
+- bool error;
+-
+- asm volatile (__ex(ASM_VMX_VMCLEAR_RAX) CC_SET(na)
+- : CC_OUT(na) (error) : "a"(&phys_addr), "m"(phys_addr)
+- : "memory");
+- if (unlikely(error))
+- printk(KERN_ERR "kvm: vmclear fail: %p/%llx\n",
+- vmcs, phys_addr);
+-}
+-
+-static inline void loaded_vmcs_init(struct loaded_vmcs *loaded_vmcs)
+-{
+- vmcs_clear(loaded_vmcs->vmcs);
+- if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched)
+- vmcs_clear(loaded_vmcs->shadow_vmcs);
+- loaded_vmcs->cpu = -1;
+- loaded_vmcs->launched = 0;
+-}
+-
+-static void vmcs_load(struct vmcs *vmcs)
+-{
+- u64 phys_addr = __pa(vmcs);
+- bool error;
+-
+- if (static_branch_unlikely(&enable_evmcs))
+- return evmcs_load(phys_addr);
+-
+- asm volatile (__ex(ASM_VMX_VMPTRLD_RAX) CC_SET(na)
+- : CC_OUT(na) (error) : "a"(&phys_addr), "m"(phys_addr)
+- : "memory");
+- if (unlikely(error))
+- printk(KERN_ERR "kvm: vmptrld %p/%llx failed\n",
+- vmcs, phys_addr);
+-}
+-
+-#ifdef CONFIG_KEXEC_CORE
+-static void crash_vmclear_local_loaded_vmcss(void)
+-{
+- int cpu = raw_smp_processor_id();
+- struct loaded_vmcs *v;
+-
+- list_for_each_entry(v, &per_cpu(loaded_vmcss_on_cpu, cpu),
+- loaded_vmcss_on_cpu_link)
+- vmcs_clear(v->vmcs);
+-}
+-#endif /* CONFIG_KEXEC_CORE */
+-
+-static void __loaded_vmcs_clear(void *arg)
+-{
+- struct loaded_vmcs *loaded_vmcs = arg;
+- int cpu = raw_smp_processor_id();
+-
+- if (loaded_vmcs->cpu != cpu)
+- return; /* vcpu migration can race with cpu offline */
+- if (per_cpu(current_vmcs, cpu) == loaded_vmcs->vmcs)
+- per_cpu(current_vmcs, cpu) = NULL;
+-
+- vmcs_clear(loaded_vmcs->vmcs);
+- if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched)
+- vmcs_clear(loaded_vmcs->shadow_vmcs);
+-
+- list_del(&loaded_vmcs->loaded_vmcss_on_cpu_link);
+-
+- /*
+- * Ensure all writes to loaded_vmcs, including deleting it from its
+- * current percpu list, complete before setting loaded_vmcs->vcpu to
+- * -1, otherwise a different cpu can see vcpu == -1 first and add
+- * loaded_vmcs to its percpu list before it's deleted from this cpu's
+- * list. Pairs with the smp_rmb() in vmx_vcpu_load_vmcs().
+- */
+- smp_wmb();
+-
+- loaded_vmcs->cpu = -1;
+- loaded_vmcs->launched = 0;
+-}
+-
+-static void loaded_vmcs_clear(struct loaded_vmcs *loaded_vmcs)
+-{
+- int cpu = loaded_vmcs->cpu;
+-
+- if (cpu != -1)
+- smp_call_function_single(cpu,
+- __loaded_vmcs_clear, loaded_vmcs, 1);
+-}
+-
+-static inline bool vpid_sync_vcpu_addr(int vpid, gva_t addr)
+-{
+- if (vpid == 0)
+- return true;
+-
+- if (cpu_has_vmx_invvpid_individual_addr()) {
+- __invvpid(VMX_VPID_EXTENT_INDIVIDUAL_ADDR, vpid, addr);
+- return true;
+- }
+-
+- return false;
+-}
+-
+-static inline void vpid_sync_vcpu_single(int vpid)
+-{
+- if (vpid == 0)
+- return;
+-
+- if (cpu_has_vmx_invvpid_single())
+- __invvpid(VMX_VPID_EXTENT_SINGLE_CONTEXT, vpid, 0);
+-}
+-
+-static inline void vpid_sync_vcpu_global(void)
+-{
+- if (cpu_has_vmx_invvpid_global())
+- __invvpid(VMX_VPID_EXTENT_ALL_CONTEXT, 0, 0);
+-}
+-
+-static inline void vpid_sync_context(int vpid)
+-{
+- if (cpu_has_vmx_invvpid_single())
+- vpid_sync_vcpu_single(vpid);
+- else
+- vpid_sync_vcpu_global();
+-}
+-
+-static inline void ept_sync_global(void)
+-{
+- __invept(VMX_EPT_EXTENT_GLOBAL, 0, 0);
+-}
+-
+-static inline void ept_sync_context(u64 eptp)
+-{
+- if (cpu_has_vmx_invept_context())
+- __invept(VMX_EPT_EXTENT_CONTEXT, eptp, 0);
+- else
+- ept_sync_global();
+-}
+-
+-static __always_inline void vmcs_check16(unsigned long field)
+-{
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6001) == 0x2000,
+- "16-bit accessor invalid for 64-bit field");
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6001) == 0x2001,
+- "16-bit accessor invalid for 64-bit high field");
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x4000,
+- "16-bit accessor invalid for 32-bit high field");
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x6000,
+- "16-bit accessor invalid for natural width field");
+-}
+-
+-static __always_inline void vmcs_check32(unsigned long field)
+-{
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0,
+- "32-bit accessor invalid for 16-bit field");
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x6000,
+- "32-bit accessor invalid for natural width field");
+-}
+-
+-static __always_inline void vmcs_check64(unsigned long field)
+-{
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0,
+- "64-bit accessor invalid for 16-bit field");
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6001) == 0x2001,
+- "64-bit accessor invalid for 64-bit high field");
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x4000,
+- "64-bit accessor invalid for 32-bit field");
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x6000,
+- "64-bit accessor invalid for natural width field");
+-}
+-
+-static __always_inline void vmcs_checkl(unsigned long field)
+-{
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0,
+- "Natural width accessor invalid for 16-bit field");
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6001) == 0x2000,
+- "Natural width accessor invalid for 64-bit field");
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6001) == 0x2001,
+- "Natural width accessor invalid for 64-bit high field");
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x4000,
+- "Natural width accessor invalid for 32-bit field");
+-}
+-
+-static __always_inline unsigned long __vmcs_readl(unsigned long field)
+-{
+- unsigned long value;
+-
+- asm volatile (__ex_clear(ASM_VMX_VMREAD_RDX_RAX, "%0")
+- : "=a"(value) : "d"(field) : "cc");
+- return value;
+-}
+-
+-static __always_inline u16 vmcs_read16(unsigned long field)
+-{
+- vmcs_check16(field);
+- if (static_branch_unlikely(&enable_evmcs))
+- return evmcs_read16(field);
+- return __vmcs_readl(field);
+-}
+-
+-static __always_inline u32 vmcs_read32(unsigned long field)
+-{
+- vmcs_check32(field);
+- if (static_branch_unlikely(&enable_evmcs))
+- return evmcs_read32(field);
+- return __vmcs_readl(field);
+-}
+-
+-static __always_inline u64 vmcs_read64(unsigned long field)
+-{
+- vmcs_check64(field);
+- if (static_branch_unlikely(&enable_evmcs))
+- return evmcs_read64(field);
+-#ifdef CONFIG_X86_64
+- return __vmcs_readl(field);
+-#else
+- return __vmcs_readl(field) | ((u64)__vmcs_readl(field+1) << 32);
+-#endif
+-}
+-
+-static __always_inline unsigned long vmcs_readl(unsigned long field)
+-{
+- vmcs_checkl(field);
+- if (static_branch_unlikely(&enable_evmcs))
+- return evmcs_read64(field);
+- return __vmcs_readl(field);
+-}
+-
+-static noinline void vmwrite_error(unsigned long field, unsigned long value)
+-{
+- printk(KERN_ERR "vmwrite error: reg %lx value %lx (err %d)\n",
+- field, value, vmcs_read32(VM_INSTRUCTION_ERROR));
+- dump_stack();
+-}
+-
+-static __always_inline void __vmcs_writel(unsigned long field, unsigned long value)
+-{
+- bool error;
+-
+- asm volatile (__ex(ASM_VMX_VMWRITE_RAX_RDX) CC_SET(na)
+- : CC_OUT(na) (error) : "a"(value), "d"(field));
+- if (unlikely(error))
+- vmwrite_error(field, value);
+-}
+-
+-static __always_inline void vmcs_write16(unsigned long field, u16 value)
+-{
+- vmcs_check16(field);
+- if (static_branch_unlikely(&enable_evmcs))
+- return evmcs_write16(field, value);
+-
+- __vmcs_writel(field, value);
+-}
+-
+-static __always_inline void vmcs_write32(unsigned long field, u32 value)
+-{
+- vmcs_check32(field);
+- if (static_branch_unlikely(&enable_evmcs))
+- return evmcs_write32(field, value);
+-
+- __vmcs_writel(field, value);
+-}
+-
+-static __always_inline void vmcs_write64(unsigned long field, u64 value)
+-{
+- vmcs_check64(field);
+- if (static_branch_unlikely(&enable_evmcs))
+- return evmcs_write64(field, value);
+-
+- __vmcs_writel(field, value);
+-#ifndef CONFIG_X86_64
+- asm volatile ("");
+- __vmcs_writel(field+1, value >> 32);
+-#endif
+-}
+-
+-static __always_inline void vmcs_writel(unsigned long field, unsigned long value)
+-{
+- vmcs_checkl(field);
+- if (static_branch_unlikely(&enable_evmcs))
+- return evmcs_write64(field, value);
+-
+- __vmcs_writel(field, value);
+-}
+-
+-static __always_inline void vmcs_clear_bits(unsigned long field, u32 mask)
+-{
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x2000,
+- "vmcs_clear_bits does not support 64-bit fields");
+- if (static_branch_unlikely(&enable_evmcs))
+- return evmcs_write32(field, evmcs_read32(field) & ~mask);
+-
+- __vmcs_writel(field, __vmcs_readl(field) & ~mask);
+-}
+-
+-static __always_inline void vmcs_set_bits(unsigned long field, u32 mask)
+-{
+- BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x2000,
+- "vmcs_set_bits does not support 64-bit fields");
+- if (static_branch_unlikely(&enable_evmcs))
+- return evmcs_write32(field, evmcs_read32(field) | mask);
+-
+- __vmcs_writel(field, __vmcs_readl(field) | mask);
+-}
+-
+-static inline void vm_entry_controls_reset_shadow(struct vcpu_vmx *vmx)
+-{
+- vmx->vm_entry_controls_shadow = vmcs_read32(VM_ENTRY_CONTROLS);
+-}
+-
+-static inline void vm_entry_controls_init(struct vcpu_vmx *vmx, u32 val)
+-{
+- vmcs_write32(VM_ENTRY_CONTROLS, val);
+- vmx->vm_entry_controls_shadow = val;
+-}
+-
+-static inline void vm_entry_controls_set(struct vcpu_vmx *vmx, u32 val)
+-{
+- if (vmx->vm_entry_controls_shadow != val)
+- vm_entry_controls_init(vmx, val);
+-}
+-
+-static inline u32 vm_entry_controls_get(struct vcpu_vmx *vmx)
+-{
+- return vmx->vm_entry_controls_shadow;
+-}
+-
+-
+-static inline void vm_entry_controls_setbit(struct vcpu_vmx *vmx, u32 val)
+-{
+- vm_entry_controls_set(vmx, vm_entry_controls_get(vmx) | val);
+-}
+-
+-static inline void vm_entry_controls_clearbit(struct vcpu_vmx *vmx, u32 val)
+-{
+- vm_entry_controls_set(vmx, vm_entry_controls_get(vmx) & ~val);
+-}
+-
+-static inline void vm_exit_controls_reset_shadow(struct vcpu_vmx *vmx)
+-{
+- vmx->vm_exit_controls_shadow = vmcs_read32(VM_EXIT_CONTROLS);
+-}
+-
+-static inline void vm_exit_controls_init(struct vcpu_vmx *vmx, u32 val)
+-{
+- vmcs_write32(VM_EXIT_CONTROLS, val);
+- vmx->vm_exit_controls_shadow = val;
+-}
+-
+-static inline void vm_exit_controls_set(struct vcpu_vmx *vmx, u32 val)
+-{
+- if (vmx->vm_exit_controls_shadow != val)
+- vm_exit_controls_init(vmx, val);
+-}
+-
+-static inline u32 vm_exit_controls_get(struct vcpu_vmx *vmx)
+-{
+- return vmx->vm_exit_controls_shadow;
+-}
+-
+-
+-static inline void vm_exit_controls_setbit(struct vcpu_vmx *vmx, u32 val)
+-{
+- vm_exit_controls_set(vmx, vm_exit_controls_get(vmx) | val);
+-}
+-
+-static inline void vm_exit_controls_clearbit(struct vcpu_vmx *vmx, u32 val)
+-{
+- vm_exit_controls_set(vmx, vm_exit_controls_get(vmx) & ~val);
+-}
+-
+-static void vmx_segment_cache_clear(struct vcpu_vmx *vmx)
+-{
+- vmx->segment_cache.bitmask = 0;
+-}
+-
+-static bool vmx_segment_cache_test_set(struct vcpu_vmx *vmx, unsigned seg,
+- unsigned field)
+-{
+- bool ret;
+- u32 mask = 1 << (seg * SEG_FIELD_NR + field);
+-
+- if (!(vmx->vcpu.arch.regs_avail & (1 << VCPU_EXREG_SEGMENTS))) {
+- vmx->vcpu.arch.regs_avail |= (1 << VCPU_EXREG_SEGMENTS);
+- vmx->segment_cache.bitmask = 0;
+- }
+- ret = vmx->segment_cache.bitmask & mask;
+- vmx->segment_cache.bitmask |= mask;
+- return ret;
+-}
+-
+-static u16 vmx_read_guest_seg_selector(struct vcpu_vmx *vmx, unsigned seg)
+-{
+- u16 *p = &vmx->segment_cache.seg[seg].selector;
+-
+- if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_SEL))
+- *p = vmcs_read16(kvm_vmx_segment_fields[seg].selector);
+- return *p;
+-}
+-
+-static ulong vmx_read_guest_seg_base(struct vcpu_vmx *vmx, unsigned seg)
+-{
+- ulong *p = &vmx->segment_cache.seg[seg].base;
+-
+- if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_BASE))
+- *p = vmcs_readl(kvm_vmx_segment_fields[seg].base);
+- return *p;
+-}
+-
+-static u32 vmx_read_guest_seg_limit(struct vcpu_vmx *vmx, unsigned seg)
+-{
+- u32 *p = &vmx->segment_cache.seg[seg].limit;
+-
+- if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_LIMIT))
+- *p = vmcs_read32(kvm_vmx_segment_fields[seg].limit);
+- return *p;
+-}
+-
+-static u32 vmx_read_guest_seg_ar(struct vcpu_vmx *vmx, unsigned seg)
+-{
+- u32 *p = &vmx->segment_cache.seg[seg].ar;
+-
+- if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_AR))
+- *p = vmcs_read32(kvm_vmx_segment_fields[seg].ar_bytes);
+- return *p;
+-}
+-
+-static void update_exception_bitmap(struct kvm_vcpu *vcpu)
+-{
+- u32 eb;
+-
+- eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
+- (1u << DB_VECTOR) | (1u << AC_VECTOR);
+- /*
+- * Guest access to VMware backdoor ports could legitimately
+- * trigger #GP because of TSS I/O permission bitmap.
+- * We intercept those #GP and allow access to them anyway
+- * as VMware does.
+- */
+- if (enable_vmware_backdoor)
+- eb |= (1u << GP_VECTOR);
+- if ((vcpu->guest_debug &
+- (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
+- (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP))
+- eb |= 1u << BP_VECTOR;
+- if (to_vmx(vcpu)->rmode.vm86_active)
+- eb = ~0;
+- if (enable_ept)
+- eb &= ~(1u << PF_VECTOR); /* bypass_guest_pf = 0 */
+-
+- /* When we are running a nested L2 guest and L1 specified for it a
+- * certain exception bitmap, we must trap the same exceptions and pass
+- * them to L1. When running L2, we will only handle the exceptions
+- * specified above if L1 did not want them.
+- */
+- if (is_guest_mode(vcpu))
+- eb |= get_vmcs12(vcpu)->exception_bitmap;
+-
+- vmcs_write32(EXCEPTION_BITMAP, eb);
+-}
+-
+-/*
+- * Check if MSR is intercepted for currently loaded MSR bitmap.
+- */
+-static bool msr_write_intercepted(struct kvm_vcpu *vcpu, u32 msr)
+-{
+- unsigned long *msr_bitmap;
+- int f = sizeof(unsigned long);
+-
+- if (!cpu_has_vmx_msr_bitmap())
+- return true;
+-
+- msr_bitmap = to_vmx(vcpu)->loaded_vmcs->msr_bitmap;
+-
+- if (msr <= 0x1fff) {
+- return !!test_bit(msr, msr_bitmap + 0x800 / f);
+- } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
+- msr &= 0x1fff;
+- return !!test_bit(msr, msr_bitmap + 0xc00 / f);
+- }
+-
+- return true;
+-}
+-
+-/*
+- * Check if MSR is intercepted for L01 MSR bitmap.
+- */
+-static bool msr_write_intercepted_l01(struct kvm_vcpu *vcpu, u32 msr)
+-{
+- unsigned long *msr_bitmap;
+- int f = sizeof(unsigned long);
+-
+- if (!cpu_has_vmx_msr_bitmap())
+- return true;
+-
+- msr_bitmap = to_vmx(vcpu)->vmcs01.msr_bitmap;
+-
+- if (msr <= 0x1fff) {
+- return !!test_bit(msr, msr_bitmap + 0x800 / f);
+- } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
+- msr &= 0x1fff;
+- return !!test_bit(msr, msr_bitmap + 0xc00 / f);
+- }
+-
+- return true;
+-}
+-
+-static void clear_atomic_switch_msr_special(struct vcpu_vmx *vmx,
+- unsigned long entry, unsigned long exit)
+-{
+- vm_entry_controls_clearbit(vmx, entry);
+- vm_exit_controls_clearbit(vmx, exit);
+-}
+-
+-static int find_msr(struct vmx_msrs *m, unsigned int msr)
+-{
+- unsigned int i;
+-
+- for (i = 0; i < m->nr; ++i) {
+- if (m->val[i].index == msr)
+- return i;
+- }
+- return -ENOENT;
+-}
+-
+-static void clear_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr)
+-{
+- int i;
+- struct msr_autoload *m = &vmx->msr_autoload;
+-
+- switch (msr) {
+- case MSR_EFER:
+- if (cpu_has_load_ia32_efer) {
+- clear_atomic_switch_msr_special(vmx,
+- VM_ENTRY_LOAD_IA32_EFER,
+- VM_EXIT_LOAD_IA32_EFER);
+- return;
+- }
+- break;
+- case MSR_CORE_PERF_GLOBAL_CTRL:
+- if (cpu_has_load_perf_global_ctrl) {
+- clear_atomic_switch_msr_special(vmx,
+- VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL,
+- VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL);
+- return;
+- }
+- break;
+- }
+- i = find_msr(&m->guest, msr);
+- if (i < 0)
+- goto skip_guest;
+- --m->guest.nr;
+- m->guest.val[i] = m->guest.val[m->guest.nr];
+- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
+-
+-skip_guest:
+- i = find_msr(&m->host, msr);
+- if (i < 0)
+- return;
+-
+- --m->host.nr;
+- m->host.val[i] = m->host.val[m->host.nr];
+- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
+-}
+-
+-static void add_atomic_switch_msr_special(struct vcpu_vmx *vmx,
+- unsigned long entry, unsigned long exit,
+- unsigned long guest_val_vmcs, unsigned long host_val_vmcs,
+- u64 guest_val, u64 host_val)
+-{
+- vmcs_write64(guest_val_vmcs, guest_val);
+- vmcs_write64(host_val_vmcs, host_val);
+- vm_entry_controls_setbit(vmx, entry);
+- vm_exit_controls_setbit(vmx, exit);
+-}
+-
+-static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
+- u64 guest_val, u64 host_val, bool entry_only)
+-{
+- int i, j = 0;
+- struct msr_autoload *m = &vmx->msr_autoload;
+-
+- switch (msr) {
+- case MSR_EFER:
+- if (cpu_has_load_ia32_efer) {
+- add_atomic_switch_msr_special(vmx,
+- VM_ENTRY_LOAD_IA32_EFER,
+- VM_EXIT_LOAD_IA32_EFER,
+- GUEST_IA32_EFER,
+- HOST_IA32_EFER,
+- guest_val, host_val);
+- return;
+- }
+- break;
+- case MSR_CORE_PERF_GLOBAL_CTRL:
+- if (cpu_has_load_perf_global_ctrl) {
+- add_atomic_switch_msr_special(vmx,
+- VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL,
+- VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL,
+- GUEST_IA32_PERF_GLOBAL_CTRL,
+- HOST_IA32_PERF_GLOBAL_CTRL,
+- guest_val, host_val);
+- return;
+- }
+- break;
+- case MSR_IA32_PEBS_ENABLE:
+- /* PEBS needs a quiescent period after being disabled (to write
+- * a record). Disabling PEBS through VMX MSR swapping doesn't
+- * provide that period, so a CPU could write host's record into
+- * guest's memory.
+- */
+- wrmsrl(MSR_IA32_PEBS_ENABLE, 0);
+- }
+-
+- i = find_msr(&m->guest, msr);
+- if (!entry_only)
+- j = find_msr(&m->host, msr);
+-
+- if ((i < 0 && m->guest.nr == NR_AUTOLOAD_MSRS) ||
+- (j < 0 && m->host.nr == NR_AUTOLOAD_MSRS)) {
+- printk_once(KERN_WARNING "Not enough msr switch entries. "
+- "Can't add msr %x\n", msr);
+- return;
+- }
+- if (i < 0) {
+- i = m->guest.nr++;
+- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
+- }
+- m->guest.val[i].index = msr;
+- m->guest.val[i].value = guest_val;
+-
+- if (entry_only)
+- return;
+-
+- if (j < 0) {
+- j = m->host.nr++;
+- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
+- }
+- m->host.val[j].index = msr;
+- m->host.val[j].value = host_val;
+-}
+-
+-static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset)
+-{
+- u64 guest_efer = vmx->vcpu.arch.efer;
+- u64 ignore_bits = 0;
+-
+- /* Shadow paging assumes NX to be available. */
+- if (!enable_ept)
+- guest_efer |= EFER_NX;
+-
+- /*
+- * LMA and LME handled by hardware; SCE meaningless outside long mode.
+- */
+- ignore_bits |= EFER_SCE;
+-#ifdef CONFIG_X86_64
+- ignore_bits |= EFER_LMA | EFER_LME;
+- /* SCE is meaningful only in long mode on Intel */
+- if (guest_efer & EFER_LMA)
+- ignore_bits &= ~(u64)EFER_SCE;
+-#endif
+-
+- clear_atomic_switch_msr(vmx, MSR_EFER);
+-
+- /*
+- * On EPT, we can't emulate NX, so we must switch EFER atomically.
+- * On CPUs that support "load IA32_EFER", always switch EFER
+- * atomically, since it's faster than switching it manually.
+- */
+- if (cpu_has_load_ia32_efer ||
+- (enable_ept && ((vmx->vcpu.arch.efer ^ host_efer) & EFER_NX))) {
+- if (!(guest_efer & EFER_LMA))
+- guest_efer &= ~EFER_LME;
+- if (guest_efer != host_efer)
+- add_atomic_switch_msr(vmx, MSR_EFER,
+- guest_efer, host_efer, false);
+- return false;
+- } else {
+- guest_efer &= ~ignore_bits;
+- guest_efer |= host_efer & ignore_bits;
+-
+- vmx->guest_msrs[efer_offset].data = guest_efer;
+- vmx->guest_msrs[efer_offset].mask = ~ignore_bits;
+-
+- return true;
+- }
+-}
+-
+-#ifdef CONFIG_X86_32
+-/*
+- * On 32-bit kernels, VM exits still load the FS and GS bases from the
+- * VMCS rather than the segment table. KVM uses this helper to figure
+- * out the current bases to poke them into the VMCS before entry.
+- */
+-static unsigned long segment_base(u16 selector)
+-{
+- struct desc_struct *table;
+- unsigned long v;
+-
+- if (!(selector & ~SEGMENT_RPL_MASK))
+- return 0;
+-
+- table = get_current_gdt_ro();
+-
+- if ((selector & SEGMENT_TI_MASK) == SEGMENT_LDT) {
+- u16 ldt_selector = kvm_read_ldt();
+-
+- if (!(ldt_selector & ~SEGMENT_RPL_MASK))
+- return 0;
+-
+- table = (struct desc_struct *)segment_base(ldt_selector);
+- }
+- v = get_desc_base(&table[selector >> 3]);
+- return v;
+-}
+-#endif
+-
+-static void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct vmcs_host_state *host_state;
+-#ifdef CONFIG_X86_64
+- int cpu = raw_smp_processor_id();
+-#endif
+- unsigned long fs_base, gs_base;
+- u16 fs_sel, gs_sel;
+- int i;
+-
+- vmx->req_immediate_exit = false;
+-
+- /*
+- * Note that guest MSRs to be saved/restored can also be changed
+- * when guest state is loaded. This happens when guest transitions
+- * to/from long-mode by setting MSR_EFER.LMA.
+- */
+- if (!vmx->loaded_cpu_state || vmx->guest_msrs_dirty) {
+- vmx->guest_msrs_dirty = false;
+- for (i = 0; i < vmx->save_nmsrs; ++i)
+- kvm_set_shared_msr(vmx->guest_msrs[i].index,
+- vmx->guest_msrs[i].data,
+- vmx->guest_msrs[i].mask);
+-
+- }
+-
+- if (vmx->loaded_cpu_state)
+- return;
+-
+- vmx->loaded_cpu_state = vmx->loaded_vmcs;
+- host_state = &vmx->loaded_cpu_state->host_state;
+-
+- /*
+- * Set host fs and gs selectors. Unfortunately, 22.2.3 does not
+- * allow segment selectors with cpl > 0 or ti == 1.
+- */
+- host_state->ldt_sel = kvm_read_ldt();
+-
+-#ifdef CONFIG_X86_64
+- savesegment(ds, host_state->ds_sel);
+- savesegment(es, host_state->es_sel);
+-
+- gs_base = cpu_kernelmode_gs_base(cpu);
+- if (likely(is_64bit_mm(current->mm))) {
+- save_fsgs_for_kvm();
+- fs_sel = current->thread.fsindex;
+- gs_sel = current->thread.gsindex;
+- fs_base = current->thread.fsbase;
+- vmx->msr_host_kernel_gs_base = current->thread.gsbase;
+- } else {
+- savesegment(fs, fs_sel);
+- savesegment(gs, gs_sel);
+- fs_base = read_msr(MSR_FS_BASE);
+- vmx->msr_host_kernel_gs_base = read_msr(MSR_KERNEL_GS_BASE);
+- }
+-
+- wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+-#else
+- savesegment(fs, fs_sel);
+- savesegment(gs, gs_sel);
+- fs_base = segment_base(fs_sel);
+- gs_base = segment_base(gs_sel);
+-#endif
+-
+- if (unlikely(fs_sel != host_state->fs_sel)) {
+- if (!(fs_sel & 7))
+- vmcs_write16(HOST_FS_SELECTOR, fs_sel);
+- else
+- vmcs_write16(HOST_FS_SELECTOR, 0);
+- host_state->fs_sel = fs_sel;
+- }
+- if (unlikely(gs_sel != host_state->gs_sel)) {
+- if (!(gs_sel & 7))
+- vmcs_write16(HOST_GS_SELECTOR, gs_sel);
+- else
+- vmcs_write16(HOST_GS_SELECTOR, 0);
+- host_state->gs_sel = gs_sel;
+- }
+- if (unlikely(fs_base != host_state->fs_base)) {
+- vmcs_writel(HOST_FS_BASE, fs_base);
+- host_state->fs_base = fs_base;
+- }
+- if (unlikely(gs_base != host_state->gs_base)) {
+- vmcs_writel(HOST_GS_BASE, gs_base);
+- host_state->gs_base = gs_base;
+- }
+-}
+-
+-static void vmx_prepare_switch_to_host(struct vcpu_vmx *vmx)
+-{
+- struct vmcs_host_state *host_state;
+-
+- if (!vmx->loaded_cpu_state)
+- return;
+-
+- WARN_ON_ONCE(vmx->loaded_cpu_state != vmx->loaded_vmcs);
+- host_state = &vmx->loaded_cpu_state->host_state;
+-
+- ++vmx->vcpu.stat.host_state_reload;
+- vmx->loaded_cpu_state = NULL;
+-
+-#ifdef CONFIG_X86_64
+- rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+-#endif
+- if (host_state->ldt_sel || (host_state->gs_sel & 7)) {
+- kvm_load_ldt(host_state->ldt_sel);
+-#ifdef CONFIG_X86_64
+- load_gs_index(host_state->gs_sel);
+-#else
+- loadsegment(gs, host_state->gs_sel);
+-#endif
+- }
+- if (host_state->fs_sel & 7)
+- loadsegment(fs, host_state->fs_sel);
+-#ifdef CONFIG_X86_64
+- if (unlikely(host_state->ds_sel | host_state->es_sel)) {
+- loadsegment(ds, host_state->ds_sel);
+- loadsegment(es, host_state->es_sel);
+- }
+-#endif
+- invalidate_tss_limit();
+-#ifdef CONFIG_X86_64
+- wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
+-#endif
+- load_fixmap_gdt(raw_smp_processor_id());
+-}
+-
+-#ifdef CONFIG_X86_64
+-static u64 vmx_read_guest_kernel_gs_base(struct vcpu_vmx *vmx)
+-{
+- preempt_disable();
+- if (vmx->loaded_cpu_state)
+- rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
+- preempt_enable();
+- return vmx->msr_guest_kernel_gs_base;
+-}
+-
+-static void vmx_write_guest_kernel_gs_base(struct vcpu_vmx *vmx, u64 data)
+-{
+- preempt_disable();
+- if (vmx->loaded_cpu_state)
+- wrmsrl(MSR_KERNEL_GS_BASE, data);
+- preempt_enable();
+- vmx->msr_guest_kernel_gs_base = data;
+-}
+-#endif
+-
+-static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
+-{
+- struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+- struct pi_desc old, new;
+- unsigned int dest;
+-
+- /*
+- * In case of hot-plug or hot-unplug, we may have to undo
+- * vmx_vcpu_pi_put even if there is no assigned device. And we
+- * always keep PI.NDST up to date for simplicity: it makes the
+- * code easier, and CPU migration is not a fast path.
+- */
+- if (!pi_test_sn(pi_desc) && vcpu->cpu == cpu)
+- return;
+-
+- /*
+- * First handle the simple case where no cmpxchg is necessary; just
+- * allow posting non-urgent interrupts.
+- *
+- * If the 'nv' field is POSTED_INTR_WAKEUP_VECTOR, do not change
+- * PI.NDST: pi_post_block will do it for us and the wakeup_handler
+- * expects the VCPU to be on the blocked_vcpu_list that matches
+- * PI.NDST.
+- */
+- if (pi_desc->nv == POSTED_INTR_WAKEUP_VECTOR ||
+- vcpu->cpu == cpu) {
+- pi_clear_sn(pi_desc);
+- return;
+- }
+-
+- /* The full case. */
+- do {
+- old.control = new.control = pi_desc->control;
+-
+- dest = cpu_physical_id(cpu);
+-
+- if (x2apic_enabled())
+- new.ndst = dest;
+- else
+- new.ndst = (dest << 8) & 0xFF00;
+-
+- new.sn = 0;
+- } while (cmpxchg64(&pi_desc->control, old.control,
+- new.control) != old.control);
+-}
+-
+-static void decache_tsc_multiplier(struct vcpu_vmx *vmx)
+-{
+- vmx->current_tsc_ratio = vmx->vcpu.arch.tsc_scaling_ratio;
+- vmcs_write64(TSC_MULTIPLIER, vmx->current_tsc_ratio);
+-}
+-
+-/*
+- * Switches to specified vcpu, until a matching vcpu_put(), but assumes
+- * vcpu mutex is already taken.
+- */
+-static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- bool already_loaded = vmx->loaded_vmcs->cpu == cpu;
+-
+- if (!already_loaded) {
+- loaded_vmcs_clear(vmx->loaded_vmcs);
+- local_irq_disable();
+-
+- /*
+- * Ensure loaded_vmcs->cpu is read before adding loaded_vmcs to
+- * this cpu's percpu list, otherwise it may not yet be deleted
+- * from its previous cpu's percpu list. Pairs with the
+- * smb_wmb() in __loaded_vmcs_clear().
+- */
+- smp_rmb();
+-
+- list_add(&vmx->loaded_vmcs->loaded_vmcss_on_cpu_link,
+- &per_cpu(loaded_vmcss_on_cpu, cpu));
+- local_irq_enable();
+- }
+-
+- if (per_cpu(current_vmcs, cpu) != vmx->loaded_vmcs->vmcs) {
+- per_cpu(current_vmcs, cpu) = vmx->loaded_vmcs->vmcs;
+- vmcs_load(vmx->loaded_vmcs->vmcs);
+- indirect_branch_prediction_barrier();
+- }
+-
+- if (!already_loaded) {
+- void *gdt = get_current_gdt_ro();
+- unsigned long sysenter_esp;
+-
+- kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
+-
+- /*
+- * Linux uses per-cpu TSS and GDT, so set these when switching
+- * processors. See 22.2.4.
+- */
+- vmcs_writel(HOST_TR_BASE,
+- (unsigned long)&get_cpu_entry_area(cpu)->tss.x86_tss);
+- vmcs_writel(HOST_GDTR_BASE, (unsigned long)gdt); /* 22.2.4 */
+-
+- /*
+- * VM exits change the host TR limit to 0x67 after a VM
+- * exit. This is okay, since 0x67 covers everything except
+- * the IO bitmap and have have code to handle the IO bitmap
+- * being lost after a VM exit.
+- */
+- BUILD_BUG_ON(IO_BITMAP_OFFSET - 1 != 0x67);
+-
+- rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
+- vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
+-
+- vmx->loaded_vmcs->cpu = cpu;
+- }
+-
+- /* Setup TSC multiplier */
+- if (kvm_has_tsc_control &&
+- vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio)
+- decache_tsc_multiplier(vmx);
+-
+- vmx_vcpu_pi_load(vcpu, cpu);
+- vmx->host_pkru = read_pkru();
+- vmx->host_debugctlmsr = get_debugctlmsr();
+-}
+-
+-static void vmx_vcpu_pi_put(struct kvm_vcpu *vcpu)
+-{
+- struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+-
+- if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
+- !irq_remapping_cap(IRQ_POSTING_CAP) ||
+- !kvm_vcpu_apicv_active(vcpu))
+- return;
+-
+- /* Set SN when the vCPU is preempted */
+- if (vcpu->preempted)
+- pi_set_sn(pi_desc);
+-}
+-
+-static void vmx_vcpu_put(struct kvm_vcpu *vcpu)
+-{
+- vmx_vcpu_pi_put(vcpu);
+-
+- vmx_prepare_switch_to_host(to_vmx(vcpu));
+-}
+-
+-static bool emulation_required(struct kvm_vcpu *vcpu)
+-{
+- return emulate_invalid_guest_state && !guest_state_valid(vcpu);
+-}
+-
+-static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu);
+-
+-/*
+- * Return the cr0 value that a nested guest would read. This is a combination
+- * of the real cr0 used to run the guest (guest_cr0), and the bits shadowed by
+- * its hypervisor (cr0_read_shadow).
+- */
+-static inline unsigned long nested_read_cr0(struct vmcs12 *fields)
+-{
+- return (fields->guest_cr0 & ~fields->cr0_guest_host_mask) |
+- (fields->cr0_read_shadow & fields->cr0_guest_host_mask);
+-}
+-static inline unsigned long nested_read_cr4(struct vmcs12 *fields)
+-{
+- return (fields->guest_cr4 & ~fields->cr4_guest_host_mask) |
+- (fields->cr4_read_shadow & fields->cr4_guest_host_mask);
+-}
+-
+-static unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu)
+-{
+- unsigned long rflags, save_rflags;
+-
+- if (!test_bit(VCPU_EXREG_RFLAGS, (ulong *)&vcpu->arch.regs_avail)) {
+- __set_bit(VCPU_EXREG_RFLAGS, (ulong *)&vcpu->arch.regs_avail);
+- rflags = vmcs_readl(GUEST_RFLAGS);
+- if (to_vmx(vcpu)->rmode.vm86_active) {
+- rflags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
+- save_rflags = to_vmx(vcpu)->rmode.save_rflags;
+- rflags |= save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
+- }
+- to_vmx(vcpu)->rflags = rflags;
+- }
+- return to_vmx(vcpu)->rflags;
+-}
+-
+-static void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
+-{
+- unsigned long old_rflags = vmx_get_rflags(vcpu);
+-
+- __set_bit(VCPU_EXREG_RFLAGS, (ulong *)&vcpu->arch.regs_avail);
+- to_vmx(vcpu)->rflags = rflags;
+- if (to_vmx(vcpu)->rmode.vm86_active) {
+- to_vmx(vcpu)->rmode.save_rflags = rflags;
+- rflags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
+- }
+- vmcs_writel(GUEST_RFLAGS, rflags);
+-
+- if ((old_rflags ^ to_vmx(vcpu)->rflags) & X86_EFLAGS_VM)
+- to_vmx(vcpu)->emulation_required = emulation_required(vcpu);
+-}
+-
+-static u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu)
+-{
+- u32 interruptibility = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
+- int ret = 0;
+-
+- if (interruptibility & GUEST_INTR_STATE_STI)
+- ret |= KVM_X86_SHADOW_INT_STI;
+- if (interruptibility & GUEST_INTR_STATE_MOV_SS)
+- ret |= KVM_X86_SHADOW_INT_MOV_SS;
+-
+- return ret;
+-}
+-
+-static void vmx_set_interrupt_shadow(struct kvm_vcpu *vcpu, int mask)
+-{
+- u32 interruptibility_old = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
+- u32 interruptibility = interruptibility_old;
+-
+- interruptibility &= ~(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS);
+-
+- if (mask & KVM_X86_SHADOW_INT_MOV_SS)
+- interruptibility |= GUEST_INTR_STATE_MOV_SS;
+- else if (mask & KVM_X86_SHADOW_INT_STI)
+- interruptibility |= GUEST_INTR_STATE_STI;
+-
+- if ((interruptibility != interruptibility_old))
+- vmcs_write32(GUEST_INTERRUPTIBILITY_INFO, interruptibility);
+-}
+-
+-static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
+-{
+- unsigned long rip;
+-
+- rip = kvm_rip_read(vcpu);
+- rip += vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
+- kvm_rip_write(vcpu, rip);
+-
+- /* skipping an emulated instruction also counts */
+- vmx_set_interrupt_shadow(vcpu, 0);
+-}
+-
+-static void nested_vmx_inject_exception_vmexit(struct kvm_vcpu *vcpu,
+- unsigned long exit_qual)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- unsigned int nr = vcpu->arch.exception.nr;
+- u32 intr_info = nr | INTR_INFO_VALID_MASK;
+-
+- if (vcpu->arch.exception.has_error_code) {
+- vmcs12->vm_exit_intr_error_code = vcpu->arch.exception.error_code;
+- intr_info |= INTR_INFO_DELIVER_CODE_MASK;
+- }
+-
+- if (kvm_exception_is_soft(nr))
+- intr_info |= INTR_TYPE_SOFT_EXCEPTION;
+- else
+- intr_info |= INTR_TYPE_HARD_EXCEPTION;
+-
+- if (!(vmcs12->idt_vectoring_info_field & VECTORING_INFO_VALID_MASK) &&
+- vmx_get_nmi_mask(vcpu))
+- intr_info |= INTR_INFO_UNBLOCK_NMI;
+-
+- nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI, intr_info, exit_qual);
+-}
+-
+-/*
+- * KVM wants to inject page-faults which it got to the guest. This function
+- * checks whether in a nested guest, we need to inject them to L1 or L2.
+- */
+-static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned long *exit_qual)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- unsigned int nr = vcpu->arch.exception.nr;
+-
+- if (nr == PF_VECTOR) {
+- if (vcpu->arch.exception.nested_apf) {
+- *exit_qual = vcpu->arch.apf.nested_apf_token;
+- return 1;
+- }
+- /*
+- * FIXME: we must not write CR2 when L1 intercepts an L2 #PF exception.
+- * The fix is to add the ancillary datum (CR2 or DR6) to structs
+- * kvm_queued_exception and kvm_vcpu_events, so that CR2 and DR6
+- * can be written only when inject_pending_event runs. This should be
+- * conditional on a new capability---if the capability is disabled,
+- * kvm_multiple_exception would write the ancillary information to
+- * CR2 or DR6, for backwards ABI-compatibility.
+- */
+- if (nested_vmx_is_page_fault_vmexit(vmcs12,
+- vcpu->arch.exception.error_code)) {
+- *exit_qual = vcpu->arch.cr2;
+- return 1;
+- }
+- } else {
+- if (vmcs12->exception_bitmap & (1u << nr)) {
+- if (nr == DB_VECTOR) {
+- *exit_qual = vcpu->arch.dr6;
+- *exit_qual &= ~(DR6_FIXED_1 | DR6_BT);
+- *exit_qual ^= DR6_RTM;
+- } else {
+- *exit_qual = 0;
+- }
+- return 1;
+- }
+- }
+-
+- return 0;
+-}
+-
+-static void vmx_clear_hlt(struct kvm_vcpu *vcpu)
+-{
+- /*
+- * Ensure that we clear the HLT state in the VMCS. We don't need to
+- * explicitly skip the instruction because if the HLT state is set,
+- * then the instruction is already executing and RIP has already been
+- * advanced.
+- */
+- if (kvm_hlt_in_guest(vcpu->kvm) &&
+- vmcs_read32(GUEST_ACTIVITY_STATE) == GUEST_ACTIVITY_HLT)
+- vmcs_write32(GUEST_ACTIVITY_STATE, GUEST_ACTIVITY_ACTIVE);
+-}
+-
+-static void vmx_queue_exception(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned nr = vcpu->arch.exception.nr;
+- bool has_error_code = vcpu->arch.exception.has_error_code;
+- u32 error_code = vcpu->arch.exception.error_code;
+- u32 intr_info = nr | INTR_INFO_VALID_MASK;
+-
+- if (has_error_code) {
+- vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE, error_code);
+- intr_info |= INTR_INFO_DELIVER_CODE_MASK;
+- }
+-
+- if (vmx->rmode.vm86_active) {
+- int inc_eip = 0;
+- if (kvm_exception_is_soft(nr))
+- inc_eip = vcpu->arch.event_exit_inst_len;
+- if (kvm_inject_realmode_interrupt(vcpu, nr, inc_eip) != EMULATE_DONE)
+- kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
+- return;
+- }
+-
+- WARN_ON_ONCE(vmx->emulation_required);
+-
+- if (kvm_exception_is_soft(nr)) {
+- vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
+- vmx->vcpu.arch.event_exit_inst_len);
+- intr_info |= INTR_TYPE_SOFT_EXCEPTION;
+- } else
+- intr_info |= INTR_TYPE_HARD_EXCEPTION;
+-
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, intr_info);
+-
+- vmx_clear_hlt(vcpu);
+-}
+-
+-static bool vmx_rdtscp_supported(void)
+-{
+- return cpu_has_vmx_rdtscp();
+-}
+-
+-static bool vmx_invpcid_supported(void)
+-{
+- return cpu_has_vmx_invpcid();
+-}
+-
+-/*
+- * Swap MSR entry in host/guest MSR entry array.
+- */
+-static void move_msr_up(struct vcpu_vmx *vmx, int from, int to)
+-{
+- struct shared_msr_entry tmp;
+-
+- tmp = vmx->guest_msrs[to];
+- vmx->guest_msrs[to] = vmx->guest_msrs[from];
+- vmx->guest_msrs[from] = tmp;
+-}
+-
+-/*
+- * Set up the vmcs to automatically save and restore system
+- * msrs. Don't touch the 64-bit msrs if the guest is in legacy
+- * mode, as fiddling with msrs is very expensive.
+- */
+-static void setup_msrs(struct vcpu_vmx *vmx)
+-{
+- int save_nmsrs, index;
+-
+- save_nmsrs = 0;
+-#ifdef CONFIG_X86_64
+- if (is_long_mode(&vmx->vcpu)) {
+- index = __find_msr_index(vmx, MSR_SYSCALL_MASK);
+- if (index >= 0)
+- move_msr_up(vmx, index, save_nmsrs++);
+- index = __find_msr_index(vmx, MSR_LSTAR);
+- if (index >= 0)
+- move_msr_up(vmx, index, save_nmsrs++);
+- index = __find_msr_index(vmx, MSR_CSTAR);
+- if (index >= 0)
+- move_msr_up(vmx, index, save_nmsrs++);
+- /*
+- * MSR_STAR is only needed on long mode guests, and only
+- * if efer.sce is enabled.
+- */
+- index = __find_msr_index(vmx, MSR_STAR);
+- if ((index >= 0) && (vmx->vcpu.arch.efer & EFER_SCE))
+- move_msr_up(vmx, index, save_nmsrs++);
+- }
+-#endif
+- index = __find_msr_index(vmx, MSR_EFER);
+- if (index >= 0 && update_transition_efer(vmx, index))
+- move_msr_up(vmx, index, save_nmsrs++);
+- index = __find_msr_index(vmx, MSR_TSC_AUX);
+- if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
+- move_msr_up(vmx, index, save_nmsrs++);
+-
+- vmx->save_nmsrs = save_nmsrs;
+- vmx->guest_msrs_dirty = true;
+-
+- if (cpu_has_vmx_msr_bitmap())
+- vmx_update_msr_bitmap(&vmx->vcpu);
+-}
+-
+-static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+-
+- if (is_guest_mode(vcpu) &&
+- (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING))
+- return vcpu->arch.tsc_offset - vmcs12->tsc_offset;
+-
+- return vcpu->arch.tsc_offset;
+-}
+-
+-static u64 vmx_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+-{
+- u64 active_offset = offset;
+- if (is_guest_mode(vcpu)) {
+- /*
+- * We're here if L1 chose not to trap WRMSR to TSC. According
+- * to the spec, this should set L1's TSC; The offset that L1
+- * set for L2 remains unchanged, and still needs to be added
+- * to the newly set TSC to get L2's TSC.
+- */
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- if (nested_cpu_has(vmcs12, CPU_BASED_USE_TSC_OFFSETING))
+- active_offset += vmcs12->tsc_offset;
+- } else {
+- trace_kvm_write_tsc_offset(vcpu->vcpu_id,
+- vmcs_read64(TSC_OFFSET), offset);
+- }
+-
+- vmcs_write64(TSC_OFFSET, active_offset);
+- return active_offset;
+-}
+-
+-/*
+- * nested_vmx_allowed() checks whether a guest should be allowed to use VMX
+- * instructions and MSRs (i.e., nested VMX). Nested VMX is disabled for
+- * all guests if the "nested" module option is off, and can also be disabled
+- * for a single guest by disabling its VMX cpuid bit.
+- */
+-static inline bool nested_vmx_allowed(struct kvm_vcpu *vcpu)
+-{
+- return nested && guest_cpuid_has(vcpu, X86_FEATURE_VMX);
+-}
+-
+-/*
+- * nested_vmx_setup_ctls_msrs() sets up variables containing the values to be
+- * returned for the various VMX controls MSRs when nested VMX is enabled.
+- * The same values should also be used to verify that vmcs12 control fields are
+- * valid during nested entry from L1 to L2.
+- * Each of these control msrs has a low and high 32-bit half: A low bit is on
+- * if the corresponding bit in the (32-bit) control field *must* be on, and a
+- * bit in the high half is on if the corresponding bit in the control field
+- * may be on. See also vmx_control_verify().
+- */
+-static void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, bool apicv)
+-{
+- if (!nested) {
+- memset(msrs, 0, sizeof(*msrs));
+- return;
+- }
+-
+- /*
+- * Note that as a general rule, the high half of the MSRs (bits in
+- * the control fields which may be 1) should be initialized by the
+- * intersection of the underlying hardware's MSR (i.e., features which
+- * can be supported) and the list of features we want to expose -
+- * because they are known to be properly supported in our code.
+- * Also, usually, the low half of the MSRs (bits which must be 1) can
+- * be set to 0, meaning that L1 may turn off any of these bits. The
+- * reason is that if one of these bits is necessary, it will appear
+- * in vmcs01 and prepare_vmcs02, when it bitwise-or's the control
+- * fields of vmcs01 and vmcs02, will turn these bits off - and
+- * nested_vmx_exit_reflected() will not pass related exits to L1.
+- * These rules have exceptions below.
+- */
+-
+- /* pin-based controls */
+- rdmsr(MSR_IA32_VMX_PINBASED_CTLS,
+- msrs->pinbased_ctls_low,
+- msrs->pinbased_ctls_high);
+- msrs->pinbased_ctls_low |=
+- PIN_BASED_ALWAYSON_WITHOUT_TRUE_MSR;
+- msrs->pinbased_ctls_high &=
+- PIN_BASED_EXT_INTR_MASK |
+- PIN_BASED_NMI_EXITING |
+- PIN_BASED_VIRTUAL_NMIS |
+- (apicv ? PIN_BASED_POSTED_INTR : 0);
+- msrs->pinbased_ctls_high |=
+- PIN_BASED_ALWAYSON_WITHOUT_TRUE_MSR |
+- PIN_BASED_VMX_PREEMPTION_TIMER;
+-
+- /* exit controls */
+- rdmsr(MSR_IA32_VMX_EXIT_CTLS,
+- msrs->exit_ctls_low,
+- msrs->exit_ctls_high);
+- msrs->exit_ctls_low =
+- VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR;
+-
+- msrs->exit_ctls_high &=
+-#ifdef CONFIG_X86_64
+- VM_EXIT_HOST_ADDR_SPACE_SIZE |
+-#endif
+- VM_EXIT_LOAD_IA32_PAT | VM_EXIT_SAVE_IA32_PAT;
+- msrs->exit_ctls_high |=
+- VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR |
+- VM_EXIT_LOAD_IA32_EFER | VM_EXIT_SAVE_IA32_EFER |
+- VM_EXIT_SAVE_VMX_PREEMPTION_TIMER | VM_EXIT_ACK_INTR_ON_EXIT;
+-
+- /* We support free control of debug control saving. */
+- msrs->exit_ctls_low &= ~VM_EXIT_SAVE_DEBUG_CONTROLS;
+-
+- /* entry controls */
+- rdmsr(MSR_IA32_VMX_ENTRY_CTLS,
+- msrs->entry_ctls_low,
+- msrs->entry_ctls_high);
+- msrs->entry_ctls_low =
+- VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR;
+- msrs->entry_ctls_high &=
+-#ifdef CONFIG_X86_64
+- VM_ENTRY_IA32E_MODE |
+-#endif
+- VM_ENTRY_LOAD_IA32_PAT;
+- msrs->entry_ctls_high |=
+- (VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR | VM_ENTRY_LOAD_IA32_EFER);
+-
+- /* We support free control of debug control loading. */
+- msrs->entry_ctls_low &= ~VM_ENTRY_LOAD_DEBUG_CONTROLS;
+-
+- /* cpu-based controls */
+- rdmsr(MSR_IA32_VMX_PROCBASED_CTLS,
+- msrs->procbased_ctls_low,
+- msrs->procbased_ctls_high);
+- msrs->procbased_ctls_low =
+- CPU_BASED_ALWAYSON_WITHOUT_TRUE_MSR;
+- msrs->procbased_ctls_high &=
+- CPU_BASED_VIRTUAL_INTR_PENDING |
+- CPU_BASED_VIRTUAL_NMI_PENDING | CPU_BASED_USE_TSC_OFFSETING |
+- CPU_BASED_HLT_EXITING | CPU_BASED_INVLPG_EXITING |
+- CPU_BASED_MWAIT_EXITING | CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_CR3_STORE_EXITING |
+-#ifdef CONFIG_X86_64
+- CPU_BASED_CR8_LOAD_EXITING | CPU_BASED_CR8_STORE_EXITING |
+-#endif
+- CPU_BASED_MOV_DR_EXITING | CPU_BASED_UNCOND_IO_EXITING |
+- CPU_BASED_USE_IO_BITMAPS | CPU_BASED_MONITOR_TRAP_FLAG |
+- CPU_BASED_MONITOR_EXITING | CPU_BASED_RDPMC_EXITING |
+- CPU_BASED_RDTSC_EXITING | CPU_BASED_PAUSE_EXITING |
+- CPU_BASED_TPR_SHADOW | CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
+- /*
+- * We can allow some features even when not supported by the
+- * hardware. For example, L1 can specify an MSR bitmap - and we
+- * can use it to avoid exits to L1 - even when L0 runs L2
+- * without MSR bitmaps.
+- */
+- msrs->procbased_ctls_high |=
+- CPU_BASED_ALWAYSON_WITHOUT_TRUE_MSR |
+- CPU_BASED_USE_MSR_BITMAPS;
+-
+- /* We support free control of CR3 access interception. */
+- msrs->procbased_ctls_low &=
+- ~(CPU_BASED_CR3_LOAD_EXITING | CPU_BASED_CR3_STORE_EXITING);
+-
+- /*
+- * secondary cpu-based controls. Do not include those that
+- * depend on CPUID bits, they are added later by vmx_cpuid_update.
+- */
+- if (msrs->procbased_ctls_high & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS)
+- rdmsr(MSR_IA32_VMX_PROCBASED_CTLS2,
+- msrs->secondary_ctls_low,
+- msrs->secondary_ctls_high);
+-
+- msrs->secondary_ctls_low = 0;
+- msrs->secondary_ctls_high &=
+- SECONDARY_EXEC_DESC |
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
+- SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
+- SECONDARY_EXEC_WBINVD_EXITING;
+-
+- /*
+- * We can emulate "VMCS shadowing," even if the hardware
+- * doesn't support it.
+- */
+- msrs->secondary_ctls_high |=
+- SECONDARY_EXEC_SHADOW_VMCS;
+-
+- if (enable_ept) {
+- /* nested EPT: emulate EPT also to L1 */
+- msrs->secondary_ctls_high |=
+- SECONDARY_EXEC_ENABLE_EPT;
+- msrs->ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
+- VMX_EPTP_WB_BIT | VMX_EPT_INVEPT_BIT;
+- if (cpu_has_vmx_ept_execute_only())
+- msrs->ept_caps |=
+- VMX_EPT_EXECUTE_ONLY_BIT;
+- msrs->ept_caps &= vmx_capability.ept;
+- msrs->ept_caps |= VMX_EPT_EXTENT_GLOBAL_BIT |
+- VMX_EPT_EXTENT_CONTEXT_BIT | VMX_EPT_2MB_PAGE_BIT |
+- VMX_EPT_1GB_PAGE_BIT;
+- if (enable_ept_ad_bits) {
+- msrs->secondary_ctls_high |=
+- SECONDARY_EXEC_ENABLE_PML;
+- msrs->ept_caps |= VMX_EPT_AD_BIT;
+- }
+- }
+-
+- if (cpu_has_vmx_vmfunc()) {
+- msrs->secondary_ctls_high |=
+- SECONDARY_EXEC_ENABLE_VMFUNC;
+- /*
+- * Advertise EPTP switching unconditionally
+- * since we emulate it
+- */
+- if (enable_ept)
+- msrs->vmfunc_controls =
+- VMX_VMFUNC_EPTP_SWITCHING;
+- }
+-
+- /*
+- * Old versions of KVM use the single-context version without
+- * checking for support, so declare that it is supported even
+- * though it is treated as global context. The alternative is
+- * not failing the single-context invvpid, and it is worse.
+- */
+- if (enable_vpid) {
+- msrs->secondary_ctls_high |=
+- SECONDARY_EXEC_ENABLE_VPID;
+- msrs->vpid_caps = VMX_VPID_INVVPID_BIT |
+- VMX_VPID_EXTENT_SUPPORTED_MASK;
+- }
+-
+- if (enable_unrestricted_guest)
+- msrs->secondary_ctls_high |=
+- SECONDARY_EXEC_UNRESTRICTED_GUEST;
+-
+- if (flexpriority_enabled)
+- msrs->secondary_ctls_high |=
+- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+-
+- /* miscellaneous data */
+- rdmsr(MSR_IA32_VMX_MISC,
+- msrs->misc_low,
+- msrs->misc_high);
+- msrs->misc_low &= VMX_MISC_SAVE_EFER_LMA;
+- msrs->misc_low |=
+- MSR_IA32_VMX_MISC_VMWRITE_SHADOW_RO_FIELDS |
+- VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE |
+- VMX_MISC_ACTIVITY_HLT;
+- msrs->misc_high = 0;
+-
+- /*
+- * This MSR reports some information about VMX support. We
+- * should return information about the VMX we emulate for the
+- * guest, and the VMCS structure we give it - not about the
+- * VMX support of the underlying hardware.
+- */
+- msrs->basic =
+- VMCS12_REVISION |
+- VMX_BASIC_TRUE_CTLS |
+- ((u64)VMCS12_SIZE << VMX_BASIC_VMCS_SIZE_SHIFT) |
+- (VMX_BASIC_MEM_TYPE_WB << VMX_BASIC_MEM_TYPE_SHIFT);
+-
+- if (cpu_has_vmx_basic_inout())
+- msrs->basic |= VMX_BASIC_INOUT;
+-
+- /*
+- * These MSRs specify bits which the guest must keep fixed on
+- * while L1 is in VMXON mode (in L1's root mode, or running an L2).
+- * We picked the standard core2 setting.
+- */
+-#define VMXON_CR0_ALWAYSON (X86_CR0_PE | X86_CR0_PG | X86_CR0_NE)
+-#define VMXON_CR4_ALWAYSON X86_CR4_VMXE
+- msrs->cr0_fixed0 = VMXON_CR0_ALWAYSON;
+- msrs->cr4_fixed0 = VMXON_CR4_ALWAYSON;
+-
+- /* These MSRs specify bits which the guest must keep fixed off. */
+- rdmsrl(MSR_IA32_VMX_CR0_FIXED1, msrs->cr0_fixed1);
+- rdmsrl(MSR_IA32_VMX_CR4_FIXED1, msrs->cr4_fixed1);
+-
+- /* highest index: VMX_PREEMPTION_TIMER_VALUE */
+- msrs->vmcs_enum = VMCS12_MAX_FIELD_INDEX << 1;
+-}
+-
+-/*
+- * if fixed0[i] == 1: val[i] must be 1
+- * if fixed1[i] == 0: val[i] must be 0
+- */
+-static inline bool fixed_bits_valid(u64 val, u64 fixed0, u64 fixed1)
+-{
+- return ((val & fixed1) | fixed0) == val;
+-}
+-
+-static inline bool vmx_control_verify(u32 control, u32 low, u32 high)
+-{
+- return fixed_bits_valid(control, low, high);
+-}
+-
+-static inline u64 vmx_control_msr(u32 low, u32 high)
+-{
+- return low | ((u64)high << 32);
+-}
+-
+-static bool is_bitwise_subset(u64 superset, u64 subset, u64 mask)
+-{
+- superset &= mask;
+- subset &= mask;
+-
+- return (superset | subset) == superset;
+-}
+-
+-static int vmx_restore_vmx_basic(struct vcpu_vmx *vmx, u64 data)
+-{
+- const u64 feature_and_reserved =
+- /* feature (except bit 48; see below) */
+- BIT_ULL(49) | BIT_ULL(54) | BIT_ULL(55) |
+- /* reserved */
+- BIT_ULL(31) | GENMASK_ULL(47, 45) | GENMASK_ULL(63, 56);
+- u64 vmx_basic = vmx->nested.msrs.basic;
+-
+- if (!is_bitwise_subset(vmx_basic, data, feature_and_reserved))
+- return -EINVAL;
+-
+- /*
+- * KVM does not emulate a version of VMX that constrains physical
+- * addresses of VMX structures (e.g. VMCS) to 32-bits.
+- */
+- if (data & BIT_ULL(48))
+- return -EINVAL;
+-
+- if (vmx_basic_vmcs_revision_id(vmx_basic) !=
+- vmx_basic_vmcs_revision_id(data))
+- return -EINVAL;
+-
+- if (vmx_basic_vmcs_size(vmx_basic) > vmx_basic_vmcs_size(data))
+- return -EINVAL;
+-
+- vmx->nested.msrs.basic = data;
+- return 0;
+-}
+-
+-static int
+-vmx_restore_control_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data)
+-{
+- u64 supported;
+- u32 *lowp, *highp;
+-
+- switch (msr_index) {
+- case MSR_IA32_VMX_TRUE_PINBASED_CTLS:
+- lowp = &vmx->nested.msrs.pinbased_ctls_low;
+- highp = &vmx->nested.msrs.pinbased_ctls_high;
+- break;
+- case MSR_IA32_VMX_TRUE_PROCBASED_CTLS:
+- lowp = &vmx->nested.msrs.procbased_ctls_low;
+- highp = &vmx->nested.msrs.procbased_ctls_high;
+- break;
+- case MSR_IA32_VMX_TRUE_EXIT_CTLS:
+- lowp = &vmx->nested.msrs.exit_ctls_low;
+- highp = &vmx->nested.msrs.exit_ctls_high;
+- break;
+- case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
+- lowp = &vmx->nested.msrs.entry_ctls_low;
+- highp = &vmx->nested.msrs.entry_ctls_high;
+- break;
+- case MSR_IA32_VMX_PROCBASED_CTLS2:
+- lowp = &vmx->nested.msrs.secondary_ctls_low;
+- highp = &vmx->nested.msrs.secondary_ctls_high;
+- break;
+- default:
+- BUG();
+- }
+-
+- supported = vmx_control_msr(*lowp, *highp);
+-
+- /* Check must-be-1 bits are still 1. */
+- if (!is_bitwise_subset(data, supported, GENMASK_ULL(31, 0)))
+- return -EINVAL;
+-
+- /* Check must-be-0 bits are still 0. */
+- if (!is_bitwise_subset(supported, data, GENMASK_ULL(63, 32)))
+- return -EINVAL;
+-
+- *lowp = data;
+- *highp = data >> 32;
+- return 0;
+-}
+-
+-static int vmx_restore_vmx_misc(struct vcpu_vmx *vmx, u64 data)
+-{
+- const u64 feature_and_reserved_bits =
+- /* feature */
+- BIT_ULL(5) | GENMASK_ULL(8, 6) | BIT_ULL(14) | BIT_ULL(15) |
+- BIT_ULL(28) | BIT_ULL(29) | BIT_ULL(30) |
+- /* reserved */
+- GENMASK_ULL(13, 9) | BIT_ULL(31);
+- u64 vmx_misc;
+-
+- vmx_misc = vmx_control_msr(vmx->nested.msrs.misc_low,
+- vmx->nested.msrs.misc_high);
+-
+- if (!is_bitwise_subset(vmx_misc, data, feature_and_reserved_bits))
+- return -EINVAL;
+-
+- if ((vmx->nested.msrs.pinbased_ctls_high &
+- PIN_BASED_VMX_PREEMPTION_TIMER) &&
+- vmx_misc_preemption_timer_rate(data) !=
+- vmx_misc_preemption_timer_rate(vmx_misc))
+- return -EINVAL;
+-
+- if (vmx_misc_cr3_count(data) > vmx_misc_cr3_count(vmx_misc))
+- return -EINVAL;
+-
+- if (vmx_misc_max_msr(data) > vmx_misc_max_msr(vmx_misc))
+- return -EINVAL;
+-
+- if (vmx_misc_mseg_revid(data) != vmx_misc_mseg_revid(vmx_misc))
+- return -EINVAL;
+-
+- vmx->nested.msrs.misc_low = data;
+- vmx->nested.msrs.misc_high = data >> 32;
+-
+- /*
+- * If L1 has read-only VM-exit information fields, use the
+- * less permissive vmx_vmwrite_bitmap to specify write
+- * permissions for the shadow VMCS.
+- */
+- if (enable_shadow_vmcs && !nested_cpu_has_vmwrite_any_field(&vmx->vcpu))
+- vmcs_write64(VMWRITE_BITMAP, __pa(vmx_vmwrite_bitmap));
+-
+- return 0;
+-}
+-
+-static int vmx_restore_vmx_ept_vpid_cap(struct vcpu_vmx *vmx, u64 data)
+-{
+- u64 vmx_ept_vpid_cap;
+-
+- vmx_ept_vpid_cap = vmx_control_msr(vmx->nested.msrs.ept_caps,
+- vmx->nested.msrs.vpid_caps);
+-
+- /* Every bit is either reserved or a feature bit. */
+- if (!is_bitwise_subset(vmx_ept_vpid_cap, data, -1ULL))
+- return -EINVAL;
+-
+- vmx->nested.msrs.ept_caps = data;
+- vmx->nested.msrs.vpid_caps = data >> 32;
+- return 0;
+-}
+-
+-static int vmx_restore_fixed0_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data)
+-{
+- u64 *msr;
+-
+- switch (msr_index) {
+- case MSR_IA32_VMX_CR0_FIXED0:
+- msr = &vmx->nested.msrs.cr0_fixed0;
+- break;
+- case MSR_IA32_VMX_CR4_FIXED0:
+- msr = &vmx->nested.msrs.cr4_fixed0;
+- break;
+- default:
+- BUG();
+- }
+-
+- /*
+- * 1 bits (which indicates bits which "must-be-1" during VMX operation)
+- * must be 1 in the restored value.
+- */
+- if (!is_bitwise_subset(data, *msr, -1ULL))
+- return -EINVAL;
+-
+- *msr = data;
+- return 0;
+-}
+-
+-/*
+- * Called when userspace is restoring VMX MSRs.
+- *
+- * Returns 0 on success, non-0 otherwise.
+- */
+-static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- /*
+- * Don't allow changes to the VMX capability MSRs while the vCPU
+- * is in VMX operation.
+- */
+- if (vmx->nested.vmxon)
+- return -EBUSY;
+-
+- switch (msr_index) {
+- case MSR_IA32_VMX_BASIC:
+- return vmx_restore_vmx_basic(vmx, data);
+- case MSR_IA32_VMX_PINBASED_CTLS:
+- case MSR_IA32_VMX_PROCBASED_CTLS:
+- case MSR_IA32_VMX_EXIT_CTLS:
+- case MSR_IA32_VMX_ENTRY_CTLS:
+- /*
+- * The "non-true" VMX capability MSRs are generated from the
+- * "true" MSRs, so we do not support restoring them directly.
+- *
+- * If userspace wants to emulate VMX_BASIC[55]=0, userspace
+- * should restore the "true" MSRs with the must-be-1 bits
+- * set according to the SDM Vol 3. A.2 "RESERVED CONTROLS AND
+- * DEFAULT SETTINGS".
+- */
+- return -EINVAL;
+- case MSR_IA32_VMX_TRUE_PINBASED_CTLS:
+- case MSR_IA32_VMX_TRUE_PROCBASED_CTLS:
+- case MSR_IA32_VMX_TRUE_EXIT_CTLS:
+- case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
+- case MSR_IA32_VMX_PROCBASED_CTLS2:
+- return vmx_restore_control_msr(vmx, msr_index, data);
+- case MSR_IA32_VMX_MISC:
+- return vmx_restore_vmx_misc(vmx, data);
+- case MSR_IA32_VMX_CR0_FIXED0:
+- case MSR_IA32_VMX_CR4_FIXED0:
+- return vmx_restore_fixed0_msr(vmx, msr_index, data);
+- case MSR_IA32_VMX_CR0_FIXED1:
+- case MSR_IA32_VMX_CR4_FIXED1:
+- /*
+- * These MSRs are generated based on the vCPU's CPUID, so we
+- * do not support restoring them directly.
+- */
+- return -EINVAL;
+- case MSR_IA32_VMX_EPT_VPID_CAP:
+- return vmx_restore_vmx_ept_vpid_cap(vmx, data);
+- case MSR_IA32_VMX_VMCS_ENUM:
+- vmx->nested.msrs.vmcs_enum = data;
+- return 0;
+- default:
+- /*
+- * The rest of the VMX capability MSRs do not support restore.
+- */
+- return -EINVAL;
+- }
+-}
+-
+-/* Returns 0 on success, non-0 otherwise. */
+-static int vmx_get_vmx_msr(struct nested_vmx_msrs *msrs, u32 msr_index, u64 *pdata)
+-{
+- switch (msr_index) {
+- case MSR_IA32_VMX_BASIC:
+- *pdata = msrs->basic;
+- break;
+- case MSR_IA32_VMX_TRUE_PINBASED_CTLS:
+- case MSR_IA32_VMX_PINBASED_CTLS:
+- *pdata = vmx_control_msr(
+- msrs->pinbased_ctls_low,
+- msrs->pinbased_ctls_high);
+- if (msr_index == MSR_IA32_VMX_PINBASED_CTLS)
+- *pdata |= PIN_BASED_ALWAYSON_WITHOUT_TRUE_MSR;
+- break;
+- case MSR_IA32_VMX_TRUE_PROCBASED_CTLS:
+- case MSR_IA32_VMX_PROCBASED_CTLS:
+- *pdata = vmx_control_msr(
+- msrs->procbased_ctls_low,
+- msrs->procbased_ctls_high);
+- if (msr_index == MSR_IA32_VMX_PROCBASED_CTLS)
+- *pdata |= CPU_BASED_ALWAYSON_WITHOUT_TRUE_MSR;
+- break;
+- case MSR_IA32_VMX_TRUE_EXIT_CTLS:
+- case MSR_IA32_VMX_EXIT_CTLS:
+- *pdata = vmx_control_msr(
+- msrs->exit_ctls_low,
+- msrs->exit_ctls_high);
+- if (msr_index == MSR_IA32_VMX_EXIT_CTLS)
+- *pdata |= VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR;
+- break;
+- case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
+- case MSR_IA32_VMX_ENTRY_CTLS:
+- *pdata = vmx_control_msr(
+- msrs->entry_ctls_low,
+- msrs->entry_ctls_high);
+- if (msr_index == MSR_IA32_VMX_ENTRY_CTLS)
+- *pdata |= VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR;
+- break;
+- case MSR_IA32_VMX_MISC:
+- *pdata = vmx_control_msr(
+- msrs->misc_low,
+- msrs->misc_high);
+- break;
+- case MSR_IA32_VMX_CR0_FIXED0:
+- *pdata = msrs->cr0_fixed0;
+- break;
+- case MSR_IA32_VMX_CR0_FIXED1:
+- *pdata = msrs->cr0_fixed1;
+- break;
+- case MSR_IA32_VMX_CR4_FIXED0:
+- *pdata = msrs->cr4_fixed0;
+- break;
+- case MSR_IA32_VMX_CR4_FIXED1:
+- *pdata = msrs->cr4_fixed1;
+- break;
+- case MSR_IA32_VMX_VMCS_ENUM:
+- *pdata = msrs->vmcs_enum;
+- break;
+- case MSR_IA32_VMX_PROCBASED_CTLS2:
+- *pdata = vmx_control_msr(
+- msrs->secondary_ctls_low,
+- msrs->secondary_ctls_high);
+- break;
+- case MSR_IA32_VMX_EPT_VPID_CAP:
+- *pdata = msrs->ept_caps |
+- ((u64)msrs->vpid_caps << 32);
+- break;
+- case MSR_IA32_VMX_VMFUNC:
+- *pdata = msrs->vmfunc_controls;
+- break;
+- default:
+- return 1;
+- }
+-
+- return 0;
+-}
+-
+-static inline bool vmx_feature_control_msr_valid(struct kvm_vcpu *vcpu,
+- uint64_t val)
+-{
+- uint64_t valid_bits = to_vmx(vcpu)->msr_ia32_feature_control_valid_bits;
+-
+- return !(val & ~valid_bits);
+-}
+-
+-static int vmx_get_msr_feature(struct kvm_msr_entry *msr)
+-{
+- switch (msr->index) {
+- case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
+- if (!nested)
+- return 1;
+- return vmx_get_vmx_msr(&vmcs_config.nested, msr->index, &msr->data);
+- default:
+- return 1;
+- }
+-
+- return 0;
+-}
+-
+-/*
+- * Reads an msr value (of 'msr_index') into 'pdata'.
+- * Returns 0 on success, non-0 otherwise.
+- * Assumes vcpu_load() was already called.
+- */
+-static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct shared_msr_entry *msr;
+-
+- switch (msr_info->index) {
+-#ifdef CONFIG_X86_64
+- case MSR_FS_BASE:
+- msr_info->data = vmcs_readl(GUEST_FS_BASE);
+- break;
+- case MSR_GS_BASE:
+- msr_info->data = vmcs_readl(GUEST_GS_BASE);
+- break;
+- case MSR_KERNEL_GS_BASE:
+- msr_info->data = vmx_read_guest_kernel_gs_base(vmx);
+- break;
+-#endif
+- case MSR_EFER:
+- return kvm_get_msr_common(vcpu, msr_info);
+- case MSR_IA32_SPEC_CTRL:
+- if (!msr_info->host_initiated &&
+- !guest_has_spec_ctrl_msr(vcpu))
+- return 1;
+-
+- msr_info->data = to_vmx(vcpu)->spec_ctrl;
+- break;
+- case MSR_IA32_SYSENTER_CS:
+- msr_info->data = vmcs_read32(GUEST_SYSENTER_CS);
+- break;
+- case MSR_IA32_SYSENTER_EIP:
+- msr_info->data = vmcs_readl(GUEST_SYSENTER_EIP);
+- break;
+- case MSR_IA32_SYSENTER_ESP:
+- msr_info->data = vmcs_readl(GUEST_SYSENTER_ESP);
+- break;
+- case MSR_IA32_BNDCFGS:
+- if (!kvm_mpx_supported() ||
+- (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_MPX)))
+- return 1;
+- msr_info->data = vmcs_read64(GUEST_BNDCFGS);
+- break;
+- case MSR_IA32_MCG_EXT_CTL:
+- if (!msr_info->host_initiated &&
+- !(vmx->msr_ia32_feature_control &
+- FEATURE_CONTROL_LMCE))
+- return 1;
+- msr_info->data = vcpu->arch.mcg_ext_ctl;
+- break;
+- case MSR_IA32_FEATURE_CONTROL:
+- msr_info->data = vmx->msr_ia32_feature_control;
+- break;
+- case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
+- if (!nested_vmx_allowed(vcpu))
+- return 1;
+- return vmx_get_vmx_msr(&vmx->nested.msrs, msr_info->index,
+- &msr_info->data);
+- case MSR_IA32_XSS:
+- if (!vmx_xsaves_supported() ||
+- (!msr_info->host_initiated &&
+- !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
+- guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))))
+- return 1;
+- msr_info->data = vcpu->arch.ia32_xss;
+- break;
+- case MSR_TSC_AUX:
+- if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
+- return 1;
+- /* Otherwise falls through */
+- default:
+- msr = find_msr_entry(vmx, msr_info->index);
+- if (msr) {
+- msr_info->data = msr->data;
+- break;
+- }
+- return kvm_get_msr_common(vcpu, msr_info);
+- }
+-
+- return 0;
+-}
+-
+-static void vmx_leave_nested(struct kvm_vcpu *vcpu);
+-
+-/*
+- * Writes msr value into into the appropriate "register".
+- * Returns 0 on success, non-0 otherwise.
+- * Assumes vcpu_load() was already called.
+- */
+-static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct shared_msr_entry *msr;
+- int ret = 0;
+- u32 msr_index = msr_info->index;
+- u64 data = msr_info->data;
+-
+- switch (msr_index) {
+- case MSR_EFER:
+- ret = kvm_set_msr_common(vcpu, msr_info);
+- break;
+-#ifdef CONFIG_X86_64
+- case MSR_FS_BASE:
+- vmx_segment_cache_clear(vmx);
+- vmcs_writel(GUEST_FS_BASE, data);
+- break;
+- case MSR_GS_BASE:
+- vmx_segment_cache_clear(vmx);
+- vmcs_writel(GUEST_GS_BASE, data);
+- break;
+- case MSR_KERNEL_GS_BASE:
+- vmx_write_guest_kernel_gs_base(vmx, data);
+- break;
+-#endif
+- case MSR_IA32_SYSENTER_CS:
+- vmcs_write32(GUEST_SYSENTER_CS, data);
+- break;
+- case MSR_IA32_SYSENTER_EIP:
+- vmcs_writel(GUEST_SYSENTER_EIP, data);
+- break;
+- case MSR_IA32_SYSENTER_ESP:
+- vmcs_writel(GUEST_SYSENTER_ESP, data);
+- break;
+- case MSR_IA32_BNDCFGS:
+- if (!kvm_mpx_supported() ||
+- (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_MPX)))
+- return 1;
+- if (is_noncanonical_address(data & PAGE_MASK, vcpu) ||
+- (data & MSR_IA32_BNDCFGS_RSVD))
+- return 1;
+- vmcs_write64(GUEST_BNDCFGS, data);
+- break;
+- case MSR_IA32_SPEC_CTRL:
+- if (!msr_info->host_initiated &&
+- !guest_has_spec_ctrl_msr(vcpu))
+- return 1;
+-
+- /* The STIBP bit doesn't fault even if it's not advertised */
+- if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD))
+- return 1;
+-
+- vmx->spec_ctrl = data;
+-
+- if (!data)
+- break;
+-
+- /*
+- * For non-nested:
+- * When it's written (to non-zero) for the first time, pass
+- * it through.
+- *
+- * For nested:
+- * The handling of the MSR bitmap for L2 guests is done in
+- * nested_vmx_merge_msr_bitmap. We should not touch the
+- * vmcs02.msr_bitmap here since it gets completely overwritten
+- * in the merging. We update the vmcs01 here for L1 as well
+- * since it will end up touching the MSR anyway now.
+- */
+- vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap,
+- MSR_IA32_SPEC_CTRL,
+- MSR_TYPE_RW);
+- break;
+- case MSR_IA32_PRED_CMD:
+- if (!msr_info->host_initiated &&
+- !guest_has_pred_cmd_msr(vcpu))
+- return 1;
+-
+- if (data & ~PRED_CMD_IBPB)
+- return 1;
+-
+- if (!data)
+- break;
+-
+- wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB);
+-
+- /*
+- * For non-nested:
+- * When it's written (to non-zero) for the first time, pass
+- * it through.
+- *
+- * For nested:
+- * The handling of the MSR bitmap for L2 guests is done in
+- * nested_vmx_merge_msr_bitmap. We should not touch the
+- * vmcs02.msr_bitmap here since it gets completely overwritten
+- * in the merging.
+- */
+- vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD,
+- MSR_TYPE_W);
+- break;
+- case MSR_IA32_CR_PAT:
+- if (!kvm_pat_valid(data))
+- return 1;
+-
+- if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
+- vmcs_write64(GUEST_IA32_PAT, data);
+- vcpu->arch.pat = data;
+- break;
+- }
+- ret = kvm_set_msr_common(vcpu, msr_info);
+- break;
+- case MSR_IA32_TSC_ADJUST:
+- ret = kvm_set_msr_common(vcpu, msr_info);
+- break;
+- case MSR_IA32_MCG_EXT_CTL:
+- if ((!msr_info->host_initiated &&
+- !(to_vmx(vcpu)->msr_ia32_feature_control &
+- FEATURE_CONTROL_LMCE)) ||
+- (data & ~MCG_EXT_CTL_LMCE_EN))
+- return 1;
+- vcpu->arch.mcg_ext_ctl = data;
+- break;
+- case MSR_IA32_FEATURE_CONTROL:
+- if (!vmx_feature_control_msr_valid(vcpu, data) ||
+- (to_vmx(vcpu)->msr_ia32_feature_control &
+- FEATURE_CONTROL_LOCKED && !msr_info->host_initiated))
+- return 1;
+- vmx->msr_ia32_feature_control = data;
+- if (msr_info->host_initiated && data == 0)
+- vmx_leave_nested(vcpu);
+- break;
+- case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
+- if (!msr_info->host_initiated)
+- return 1; /* they are read-only */
+- if (!nested_vmx_allowed(vcpu))
+- return 1;
+- return vmx_set_vmx_msr(vcpu, msr_index, data);
+- case MSR_IA32_XSS:
+- if (!vmx_xsaves_supported() ||
+- (!msr_info->host_initiated &&
+- !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
+- guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))))
+- return 1;
+- /*
+- * The only supported bit as of Skylake is bit 8, but
+- * it is not supported on KVM.
+- */
+- if (data != 0)
+- return 1;
+- vcpu->arch.ia32_xss = data;
+- if (vcpu->arch.ia32_xss != host_xss)
+- add_atomic_switch_msr(vmx, MSR_IA32_XSS,
+- vcpu->arch.ia32_xss, host_xss, false);
+- else
+- clear_atomic_switch_msr(vmx, MSR_IA32_XSS);
+- break;
+- case MSR_TSC_AUX:
+- if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
+- return 1;
+- /* Check reserved bit, higher 32 bits should be zero */
+- if ((data >> 32) != 0)
+- return 1;
+- /* Otherwise falls through */
+- default:
+- msr = find_msr_entry(vmx, msr_index);
+- if (msr) {
+- u64 old_msr_data = msr->data;
+- msr->data = data;
+- if (msr - vmx->guest_msrs < vmx->save_nmsrs) {
+- preempt_disable();
+- ret = kvm_set_shared_msr(msr->index, msr->data,
+- msr->mask);
+- preempt_enable();
+- if (ret)
+- msr->data = old_msr_data;
+- }
+- break;
+- }
+- ret = kvm_set_msr_common(vcpu, msr_info);
+- }
+-
+- /* FB_CLEAR may have changed, also update the FB_CLEAR_DIS behavior */
+- if (msr_index == MSR_IA32_ARCH_CAPABILITIES)
+- vmx_update_fb_clear_dis(vcpu, vmx);
+-
+- return ret;
+-}
+-
+-static void vmx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
+-{
+- __set_bit(reg, (unsigned long *)&vcpu->arch.regs_avail);
+- switch (reg) {
+- case VCPU_REGS_RSP:
+- vcpu->arch.regs[VCPU_REGS_RSP] = vmcs_readl(GUEST_RSP);
+- break;
+- case VCPU_REGS_RIP:
+- vcpu->arch.regs[VCPU_REGS_RIP] = vmcs_readl(GUEST_RIP);
+- break;
+- case VCPU_EXREG_PDPTR:
+- if (enable_ept)
+- ept_save_pdptrs(vcpu);
+- break;
+- default:
+- break;
+- }
+-}
+-
+-static __init int cpu_has_kvm_support(void)
+-{
+- return cpu_has_vmx();
+-}
+-
+-static __init int vmx_disabled_by_bios(void)
+-{
+- u64 msr;
+-
+- rdmsrl(MSR_IA32_FEATURE_CONTROL, msr);
+- if (msr & FEATURE_CONTROL_LOCKED) {
+- /* launched w/ TXT and VMX disabled */
+- if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX)
+- && tboot_enabled())
+- return 1;
+- /* launched w/o TXT and VMX only enabled w/ TXT */
+- if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
+- && (msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX)
+- && !tboot_enabled()) {
+- printk(KERN_WARNING "kvm: disable TXT in the BIOS or "
+- "activate TXT before enabling KVM\n");
+- return 1;
+- }
+- /* launched w/o TXT and VMX disabled */
+- if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
+- && !tboot_enabled())
+- return 1;
+- }
+-
+- return 0;
+-}
+-
+-static void kvm_cpu_vmxon(u64 addr)
+-{
+- cr4_set_bits(X86_CR4_VMXE);
+- intel_pt_handle_vmx(1);
+-
+- asm volatile (ASM_VMX_VMXON_RAX
+- : : "a"(&addr), "m"(addr)
+- : "memory", "cc");
+-}
+-
+-static int hardware_enable(void)
+-{
+- int cpu = raw_smp_processor_id();
+- u64 phys_addr = __pa(per_cpu(vmxarea, cpu));
+- u64 old, test_bits;
+-
+- if (cr4_read_shadow() & X86_CR4_VMXE)
+- return -EBUSY;
+-
+- /*
+- * This can happen if we hot-added a CPU but failed to allocate
+- * VP assist page for it.
+- */
+- if (static_branch_unlikely(&enable_evmcs) &&
+- !hv_get_vp_assist_page(cpu))
+- return -EFAULT;
+-
+- rdmsrl(MSR_IA32_FEATURE_CONTROL, old);
+-
+- test_bits = FEATURE_CONTROL_LOCKED;
+- test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
+- if (tboot_enabled())
+- test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX;
+-
+- if ((old & test_bits) != test_bits) {
+- /* enable and lock */
+- wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits);
+- }
+- kvm_cpu_vmxon(phys_addr);
+- if (enable_ept)
+- ept_sync_global();
+-
+- return 0;
+-}
+-
+-static void vmclear_local_loaded_vmcss(void)
+-{
+- int cpu = raw_smp_processor_id();
+- struct loaded_vmcs *v, *n;
+-
+- list_for_each_entry_safe(v, n, &per_cpu(loaded_vmcss_on_cpu, cpu),
+- loaded_vmcss_on_cpu_link)
+- __loaded_vmcs_clear(v);
+-}
+-
+-
+-/* Just like cpu_vmxoff(), but with the __kvm_handle_fault_on_reboot()
+- * tricks.
+- */
+-static void kvm_cpu_vmxoff(void)
+-{
+- asm volatile (__ex(ASM_VMX_VMXOFF) : : : "cc");
+-
+- intel_pt_handle_vmx(0);
+- cr4_clear_bits(X86_CR4_VMXE);
+-}
+-
+-static void hardware_disable(void)
+-{
+- vmclear_local_loaded_vmcss();
+- kvm_cpu_vmxoff();
+-}
+-
+-static __init int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt,
+- u32 msr, u32 *result)
+-{
+- u32 vmx_msr_low, vmx_msr_high;
+- u32 ctl = ctl_min | ctl_opt;
+-
+- rdmsr(msr, vmx_msr_low, vmx_msr_high);
+-
+- ctl &= vmx_msr_high; /* bit == 0 in high word ==> must be zero */
+- ctl |= vmx_msr_low; /* bit == 1 in low word ==> must be one */
+-
+- /* Ensure minimum (required) set of control bits are supported. */
+- if (ctl_min & ~ctl)
+- return -EIO;
+-
+- *result = ctl;
+- return 0;
+-}
+-
+-static __init bool allow_1_setting(u32 msr, u32 ctl)
+-{
+- u32 vmx_msr_low, vmx_msr_high;
+-
+- rdmsr(msr, vmx_msr_low, vmx_msr_high);
+- return vmx_msr_high & ctl;
+-}
+-
+-static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
+-{
+- u32 vmx_msr_low, vmx_msr_high;
+- u32 min, opt, min2, opt2;
+- u32 _pin_based_exec_control = 0;
+- u32 _cpu_based_exec_control = 0;
+- u32 _cpu_based_2nd_exec_control = 0;
+- u32 _vmexit_control = 0;
+- u32 _vmentry_control = 0;
+-
+- memset(vmcs_conf, 0, sizeof(*vmcs_conf));
+- min = CPU_BASED_HLT_EXITING |
+-#ifdef CONFIG_X86_64
+- CPU_BASED_CR8_LOAD_EXITING |
+- CPU_BASED_CR8_STORE_EXITING |
+-#endif
+- CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_CR3_STORE_EXITING |
+- CPU_BASED_UNCOND_IO_EXITING |
+- CPU_BASED_MOV_DR_EXITING |
+- CPU_BASED_USE_TSC_OFFSETING |
+- CPU_BASED_MWAIT_EXITING |
+- CPU_BASED_MONITOR_EXITING |
+- CPU_BASED_INVLPG_EXITING |
+- CPU_BASED_RDPMC_EXITING;
+-
+- opt = CPU_BASED_TPR_SHADOW |
+- CPU_BASED_USE_MSR_BITMAPS |
+- CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
+- if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PROCBASED_CTLS,
+- &_cpu_based_exec_control) < 0)
+- return -EIO;
+-#ifdef CONFIG_X86_64
+- if ((_cpu_based_exec_control & CPU_BASED_TPR_SHADOW))
+- _cpu_based_exec_control &= ~CPU_BASED_CR8_LOAD_EXITING &
+- ~CPU_BASED_CR8_STORE_EXITING;
+-#endif
+- if (_cpu_based_exec_control & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) {
+- min2 = 0;
+- opt2 = SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
+- SECONDARY_EXEC_WBINVD_EXITING |
+- SECONDARY_EXEC_ENABLE_VPID |
+- SECONDARY_EXEC_ENABLE_EPT |
+- SECONDARY_EXEC_UNRESTRICTED_GUEST |
+- SECONDARY_EXEC_PAUSE_LOOP_EXITING |
+- SECONDARY_EXEC_DESC |
+- SECONDARY_EXEC_RDTSCP |
+- SECONDARY_EXEC_ENABLE_INVPCID |
+- SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
+- SECONDARY_EXEC_SHADOW_VMCS |
+- SECONDARY_EXEC_XSAVES |
+- SECONDARY_EXEC_RDSEED_EXITING |
+- SECONDARY_EXEC_RDRAND_EXITING |
+- SECONDARY_EXEC_ENABLE_PML |
+- SECONDARY_EXEC_TSC_SCALING |
+- SECONDARY_EXEC_ENABLE_VMFUNC |
+- SECONDARY_EXEC_ENCLS_EXITING;
+- if (adjust_vmx_controls(min2, opt2,
+- MSR_IA32_VMX_PROCBASED_CTLS2,
+- &_cpu_based_2nd_exec_control) < 0)
+- return -EIO;
+- }
+-#ifndef CONFIG_X86_64
+- if (!(_cpu_based_2nd_exec_control &
+- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES))
+- _cpu_based_exec_control &= ~CPU_BASED_TPR_SHADOW;
+-#endif
+-
+- if (!(_cpu_based_exec_control & CPU_BASED_TPR_SHADOW))
+- _cpu_based_2nd_exec_control &= ~(
+- SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
+-
+- rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP,
+- &vmx_capability.ept, &vmx_capability.vpid);
+-
+- if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) {
+- /* CR3 accesses and invlpg don't need to cause VM Exits when EPT
+- enabled */
+- _cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_CR3_STORE_EXITING |
+- CPU_BASED_INVLPG_EXITING);
+- } else if (vmx_capability.ept) {
+- vmx_capability.ept = 0;
+- pr_warn_once("EPT CAP should not exist if not support "
+- "1-setting enable EPT VM-execution control\n");
+- }
+- if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_VPID) &&
+- vmx_capability.vpid) {
+- vmx_capability.vpid = 0;
+- pr_warn_once("VPID CAP should not exist if not support "
+- "1-setting enable VPID VM-execution control\n");
+- }
+-
+- min = VM_EXIT_SAVE_DEBUG_CONTROLS | VM_EXIT_ACK_INTR_ON_EXIT;
+-#ifdef CONFIG_X86_64
+- min |= VM_EXIT_HOST_ADDR_SPACE_SIZE;
+-#endif
+- opt = VM_EXIT_SAVE_IA32_PAT | VM_EXIT_LOAD_IA32_PAT |
+- VM_EXIT_CLEAR_BNDCFGS;
+- if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_EXIT_CTLS,
+- &_vmexit_control) < 0)
+- return -EIO;
+-
+- min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING;
+- opt = PIN_BASED_VIRTUAL_NMIS | PIN_BASED_POSTED_INTR |
+- PIN_BASED_VMX_PREEMPTION_TIMER;
+- if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PINBASED_CTLS,
+- &_pin_based_exec_control) < 0)
+- return -EIO;
+-
+- if (cpu_has_broken_vmx_preemption_timer())
+- _pin_based_exec_control &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
+- if (!(_cpu_based_2nd_exec_control &
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY))
+- _pin_based_exec_control &= ~PIN_BASED_POSTED_INTR;
+-
+- min = VM_ENTRY_LOAD_DEBUG_CONTROLS;
+- opt = VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_BNDCFGS;
+- if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_ENTRY_CTLS,
+- &_vmentry_control) < 0)
+- return -EIO;
+-
+- rdmsr(MSR_IA32_VMX_BASIC, vmx_msr_low, vmx_msr_high);
+-
+- /* IA-32 SDM Vol 3B: VMCS size is never greater than 4kB. */
+- if ((vmx_msr_high & 0x1fff) > PAGE_SIZE)
+- return -EIO;
+-
+-#ifdef CONFIG_X86_64
+- /* IA-32 SDM Vol 3B: 64-bit CPUs always have VMX_BASIC_MSR[48]==0. */
+- if (vmx_msr_high & (1u<<16))
+- return -EIO;
+-#endif
+-
+- /* Require Write-Back (WB) memory type for VMCS accesses. */
+- if (((vmx_msr_high >> 18) & 15) != 6)
+- return -EIO;
+-
+- vmcs_conf->size = vmx_msr_high & 0x1fff;
+- vmcs_conf->order = get_order(vmcs_conf->size);
+- vmcs_conf->basic_cap = vmx_msr_high & ~0x1fff;
+-
+- vmcs_conf->revision_id = vmx_msr_low;
+-
+- vmcs_conf->pin_based_exec_ctrl = _pin_based_exec_control;
+- vmcs_conf->cpu_based_exec_ctrl = _cpu_based_exec_control;
+- vmcs_conf->cpu_based_2nd_exec_ctrl = _cpu_based_2nd_exec_control;
+- vmcs_conf->vmexit_ctrl = _vmexit_control;
+- vmcs_conf->vmentry_ctrl = _vmentry_control;
+-
+- if (static_branch_unlikely(&enable_evmcs))
+- evmcs_sanitize_exec_ctrls(vmcs_conf);
+-
+- cpu_has_load_ia32_efer =
+- allow_1_setting(MSR_IA32_VMX_ENTRY_CTLS,
+- VM_ENTRY_LOAD_IA32_EFER)
+- && allow_1_setting(MSR_IA32_VMX_EXIT_CTLS,
+- VM_EXIT_LOAD_IA32_EFER);
+-
+- cpu_has_load_perf_global_ctrl =
+- allow_1_setting(MSR_IA32_VMX_ENTRY_CTLS,
+- VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL)
+- && allow_1_setting(MSR_IA32_VMX_EXIT_CTLS,
+- VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL);
+-
+- /*
+- * Some cpus support VM_ENTRY_(LOAD|SAVE)_IA32_PERF_GLOBAL_CTRL
+- * but due to errata below it can't be used. Workaround is to use
+- * msr load mechanism to switch IA32_PERF_GLOBAL_CTRL.
+- *
+- * VM Exit May Incorrectly Clear IA32_PERF_GLOBAL_CTRL [34:32]
+- *
+- * AAK155 (model 26)
+- * AAP115 (model 30)
+- * AAT100 (model 37)
+- * BC86,AAY89,BD102 (model 44)
+- * BA97 (model 46)
+- *
+- */
+- if (cpu_has_load_perf_global_ctrl && boot_cpu_data.x86 == 0x6) {
+- switch (boot_cpu_data.x86_model) {
+- case 26:
+- case 30:
+- case 37:
+- case 44:
+- case 46:
+- cpu_has_load_perf_global_ctrl = false;
+- printk_once(KERN_WARNING"kvm: VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL "
+- "does not work properly. Using workaround\n");
+- break;
+- default:
+- break;
+- }
+- }
+-
+- if (boot_cpu_has(X86_FEATURE_XSAVES))
+- rdmsrl(MSR_IA32_XSS, host_xss);
+-
+- return 0;
+-}
+-
+-static struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu)
+-{
+- int node = cpu_to_node(cpu);
+- struct page *pages;
+- struct vmcs *vmcs;
+-
+- pages = __alloc_pages_node(node, GFP_KERNEL, vmcs_config.order);
+- if (!pages)
+- return NULL;
+- vmcs = page_address(pages);
+- memset(vmcs, 0, vmcs_config.size);
+-
+- /* KVM supports Enlightened VMCS v1 only */
+- if (static_branch_unlikely(&enable_evmcs))
+- vmcs->hdr.revision_id = KVM_EVMCS_VERSION;
+- else
+- vmcs->hdr.revision_id = vmcs_config.revision_id;
+-
+- if (shadow)
+- vmcs->hdr.shadow_vmcs = 1;
+- return vmcs;
+-}
+-
+-static void free_vmcs(struct vmcs *vmcs)
+-{
+- free_pages((unsigned long)vmcs, vmcs_config.order);
+-}
+-
+-/*
+- * Free a VMCS, but before that VMCLEAR it on the CPU where it was last loaded
+- */
+-static void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
+-{
+- if (!loaded_vmcs->vmcs)
+- return;
+- loaded_vmcs_clear(loaded_vmcs);
+- free_vmcs(loaded_vmcs->vmcs);
+- loaded_vmcs->vmcs = NULL;
+- if (loaded_vmcs->msr_bitmap)
+- free_page((unsigned long)loaded_vmcs->msr_bitmap);
+- WARN_ON(loaded_vmcs->shadow_vmcs != NULL);
+-}
+-
+-static struct vmcs *alloc_vmcs(bool shadow)
+-{
+- return alloc_vmcs_cpu(shadow, raw_smp_processor_id());
+-}
+-
+-static int alloc_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
+-{
+- loaded_vmcs->vmcs = alloc_vmcs(false);
+- if (!loaded_vmcs->vmcs)
+- return -ENOMEM;
+-
+- loaded_vmcs->shadow_vmcs = NULL;
+- loaded_vmcs_init(loaded_vmcs);
+-
+- if (cpu_has_vmx_msr_bitmap()) {
+- loaded_vmcs->msr_bitmap = (unsigned long *)__get_free_page(GFP_KERNEL);
+- if (!loaded_vmcs->msr_bitmap)
+- goto out_vmcs;
+- memset(loaded_vmcs->msr_bitmap, 0xff, PAGE_SIZE);
+-
+- if (IS_ENABLED(CONFIG_HYPERV) &&
+- static_branch_unlikely(&enable_evmcs) &&
+- (ms_hyperv.nested_features & HV_X64_NESTED_MSR_BITMAP)) {
+- struct hv_enlightened_vmcs *evmcs =
+- (struct hv_enlightened_vmcs *)loaded_vmcs->vmcs;
+-
+- evmcs->hv_enlightenments_control.msr_bitmap = 1;
+- }
+- }
+-
+- memset(&loaded_vmcs->host_state, 0, sizeof(struct vmcs_host_state));
+-
+- return 0;
+-
+-out_vmcs:
+- free_loaded_vmcs(loaded_vmcs);
+- return -ENOMEM;
+-}
+-
+-static void free_kvm_area(void)
+-{
+- int cpu;
+-
+- for_each_possible_cpu(cpu) {
+- free_vmcs(per_cpu(vmxarea, cpu));
+- per_cpu(vmxarea, cpu) = NULL;
+- }
+-}
+-
+-enum vmcs_field_width {
+- VMCS_FIELD_WIDTH_U16 = 0,
+- VMCS_FIELD_WIDTH_U64 = 1,
+- VMCS_FIELD_WIDTH_U32 = 2,
+- VMCS_FIELD_WIDTH_NATURAL_WIDTH = 3
+-};
+-
+-static inline int vmcs_field_width(unsigned long field)
+-{
+- if (0x1 & field) /* the *_HIGH fields are all 32 bit */
+- return VMCS_FIELD_WIDTH_U32;
+- return (field >> 13) & 0x3 ;
+-}
+-
+-static inline int vmcs_field_readonly(unsigned long field)
+-{
+- return (((field >> 10) & 0x3) == 1);
+-}
+-
+-static void init_vmcs_shadow_fields(void)
+-{
+- int i, j;
+-
+- for (i = j = 0; i < max_shadow_read_only_fields; i++) {
+- u16 field = shadow_read_only_fields[i];
+- if (vmcs_field_width(field) == VMCS_FIELD_WIDTH_U64 &&
+- (i + 1 == max_shadow_read_only_fields ||
+- shadow_read_only_fields[i + 1] != field + 1))
+- pr_err("Missing field from shadow_read_only_field %x\n",
+- field + 1);
+-
+- clear_bit(field, vmx_vmread_bitmap);
+-#ifdef CONFIG_X86_64
+- if (field & 1)
+- continue;
+-#endif
+- if (j < i)
+- shadow_read_only_fields[j] = field;
+- j++;
+- }
+- max_shadow_read_only_fields = j;
+-
+- for (i = j = 0; i < max_shadow_read_write_fields; i++) {
+- u16 field = shadow_read_write_fields[i];
+- if (vmcs_field_width(field) == VMCS_FIELD_WIDTH_U64 &&
+- (i + 1 == max_shadow_read_write_fields ||
+- shadow_read_write_fields[i + 1] != field + 1))
+- pr_err("Missing field from shadow_read_write_field %x\n",
+- field + 1);
+-
+- /*
+- * PML and the preemption timer can be emulated, but the
+- * processor cannot vmwrite to fields that don't exist
+- * on bare metal.
+- */
+- switch (field) {
+- case GUEST_PML_INDEX:
+- if (!cpu_has_vmx_pml())
+- continue;
+- break;
+- case VMX_PREEMPTION_TIMER_VALUE:
+- if (!cpu_has_vmx_preemption_timer())
+- continue;
+- break;
+- case GUEST_INTR_STATUS:
+- if (!cpu_has_vmx_apicv())
+- continue;
+- break;
+- default:
+- break;
+- }
+-
+- clear_bit(field, vmx_vmwrite_bitmap);
+- clear_bit(field, vmx_vmread_bitmap);
+-#ifdef CONFIG_X86_64
+- if (field & 1)
+- continue;
+-#endif
+- if (j < i)
+- shadow_read_write_fields[j] = field;
+- j++;
+- }
+- max_shadow_read_write_fields = j;
+-}
+-
+-static __init int alloc_kvm_area(void)
+-{
+- int cpu;
+-
+- for_each_possible_cpu(cpu) {
+- struct vmcs *vmcs;
+-
+- vmcs = alloc_vmcs_cpu(false, cpu);
+- if (!vmcs) {
+- free_kvm_area();
+- return -ENOMEM;
+- }
+-
+- /*
+- * When eVMCS is enabled, alloc_vmcs_cpu() sets
+- * vmcs->revision_id to KVM_EVMCS_VERSION instead of
+- * revision_id reported by MSR_IA32_VMX_BASIC.
+- *
+- * However, even though not explictly documented by
+- * TLFS, VMXArea passed as VMXON argument should
+- * still be marked with revision_id reported by
+- * physical CPU.
+- */
+- if (static_branch_unlikely(&enable_evmcs))
+- vmcs->hdr.revision_id = vmcs_config.revision_id;
+-
+- per_cpu(vmxarea, cpu) = vmcs;
+- }
+- return 0;
+-}
+-
+-static void fix_pmode_seg(struct kvm_vcpu *vcpu, int seg,
+- struct kvm_segment *save)
+-{
+- if (!emulate_invalid_guest_state) {
+- /*
+- * CS and SS RPL should be equal during guest entry according
+- * to VMX spec, but in reality it is not always so. Since vcpu
+- * is in the middle of the transition from real mode to
+- * protected mode it is safe to assume that RPL 0 is a good
+- * default value.
+- */
+- if (seg == VCPU_SREG_CS || seg == VCPU_SREG_SS)
+- save->selector &= ~SEGMENT_RPL_MASK;
+- save->dpl = save->selector & SEGMENT_RPL_MASK;
+- save->s = 1;
+- }
+- vmx_set_segment(vcpu, save, seg);
+-}
+-
+-static void enter_pmode(struct kvm_vcpu *vcpu)
+-{
+- unsigned long flags;
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- /*
+- * Update real mode segment cache. It may be not up-to-date if sement
+- * register was written while vcpu was in a guest mode.
+- */
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_ES], VCPU_SREG_ES);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_DS], VCPU_SREG_DS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_FS], VCPU_SREG_FS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_GS], VCPU_SREG_GS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_SS], VCPU_SREG_SS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_CS], VCPU_SREG_CS);
+-
+- vmx->rmode.vm86_active = 0;
+-
+- vmx_segment_cache_clear(vmx);
+-
+- vmx_set_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_TR], VCPU_SREG_TR);
+-
+- flags = vmcs_readl(GUEST_RFLAGS);
+- flags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
+- flags |= vmx->rmode.save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
+- vmcs_writel(GUEST_RFLAGS, flags);
+-
+- vmcs_writel(GUEST_CR4, (vmcs_readl(GUEST_CR4) & ~X86_CR4_VME) |
+- (vmcs_readl(CR4_READ_SHADOW) & X86_CR4_VME));
+-
+- update_exception_bitmap(vcpu);
+-
+- fix_pmode_seg(vcpu, VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]);
+- fix_pmode_seg(vcpu, VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]);
+- fix_pmode_seg(vcpu, VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]);
+- fix_pmode_seg(vcpu, VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]);
+- fix_pmode_seg(vcpu, VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]);
+- fix_pmode_seg(vcpu, VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]);
+-}
+-
+-static void fix_rmode_seg(int seg, struct kvm_segment *save)
+-{
+- const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
+- struct kvm_segment var = *save;
+-
+- var.dpl = 0x3;
+- if (seg == VCPU_SREG_CS)
+- var.type = 0x3;
+-
+- if (!emulate_invalid_guest_state) {
+- var.selector = var.base >> 4;
+- var.base = var.base & 0xffff0;
+- var.limit = 0xffff;
+- var.g = 0;
+- var.db = 0;
+- var.present = 1;
+- var.s = 1;
+- var.l = 0;
+- var.unusable = 0;
+- var.type = 0x3;
+- var.avl = 0;
+- if (save->base & 0xf)
+- printk_once(KERN_WARNING "kvm: segment base is not "
+- "paragraph aligned when entering "
+- "protected mode (seg=%d)", seg);
+- }
+-
+- vmcs_write16(sf->selector, var.selector);
+- vmcs_writel(sf->base, var.base);
+- vmcs_write32(sf->limit, var.limit);
+- vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(&var));
+-}
+-
+-static void enter_rmode(struct kvm_vcpu *vcpu)
+-{
+- unsigned long flags;
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct kvm_vmx *kvm_vmx = to_kvm_vmx(vcpu->kvm);
+-
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_TR], VCPU_SREG_TR);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_ES], VCPU_SREG_ES);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_DS], VCPU_SREG_DS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_FS], VCPU_SREG_FS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_GS], VCPU_SREG_GS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_SS], VCPU_SREG_SS);
+- vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_CS], VCPU_SREG_CS);
+-
+- vmx->rmode.vm86_active = 1;
+-
+- /*
+- * Very old userspace does not call KVM_SET_TSS_ADDR before entering
+- * vcpu. Warn the user that an update is overdue.
+- */
+- if (!kvm_vmx->tss_addr)
+- printk_once(KERN_WARNING "kvm: KVM_SET_TSS_ADDR need to be "
+- "called before entering vcpu\n");
+-
+- vmx_segment_cache_clear(vmx);
+-
+- vmcs_writel(GUEST_TR_BASE, kvm_vmx->tss_addr);
+- vmcs_write32(GUEST_TR_LIMIT, RMODE_TSS_SIZE - 1);
+- vmcs_write32(GUEST_TR_AR_BYTES, 0x008b);
+-
+- flags = vmcs_readl(GUEST_RFLAGS);
+- vmx->rmode.save_rflags = flags;
+-
+- flags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
+-
+- vmcs_writel(GUEST_RFLAGS, flags);
+- vmcs_writel(GUEST_CR4, vmcs_readl(GUEST_CR4) | X86_CR4_VME);
+- update_exception_bitmap(vcpu);
+-
+- fix_rmode_seg(VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]);
+- fix_rmode_seg(VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]);
+- fix_rmode_seg(VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]);
+- fix_rmode_seg(VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]);
+- fix_rmode_seg(VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]);
+- fix_rmode_seg(VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]);
+-
+- kvm_mmu_reset_context(vcpu);
+-}
+-
+-static void vmx_set_efer(struct kvm_vcpu *vcpu, u64 efer)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct shared_msr_entry *msr = find_msr_entry(vmx, MSR_EFER);
+-
+- if (!msr)
+- return;
+-
+- vcpu->arch.efer = efer;
+- if (efer & EFER_LMA) {
+- vm_entry_controls_setbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
+- msr->data = efer;
+- } else {
+- vm_entry_controls_clearbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
+-
+- msr->data = efer & ~EFER_LME;
+- }
+- setup_msrs(vmx);
+-}
+-
+-#ifdef CONFIG_X86_64
+-
+-static void enter_lmode(struct kvm_vcpu *vcpu)
+-{
+- u32 guest_tr_ar;
+-
+- vmx_segment_cache_clear(to_vmx(vcpu));
+-
+- guest_tr_ar = vmcs_read32(GUEST_TR_AR_BYTES);
+- if ((guest_tr_ar & VMX_AR_TYPE_MASK) != VMX_AR_TYPE_BUSY_64_TSS) {
+- pr_debug_ratelimited("%s: tss fixup for long mode. \n",
+- __func__);
+- vmcs_write32(GUEST_TR_AR_BYTES,
+- (guest_tr_ar & ~VMX_AR_TYPE_MASK)
+- | VMX_AR_TYPE_BUSY_64_TSS);
+- }
+- vmx_set_efer(vcpu, vcpu->arch.efer | EFER_LMA);
+-}
+-
+-static void exit_lmode(struct kvm_vcpu *vcpu)
+-{
+- vm_entry_controls_clearbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
+- vmx_set_efer(vcpu, vcpu->arch.efer & ~EFER_LMA);
+-}
+-
+-#endif
+-
+-static inline void __vmx_flush_tlb(struct kvm_vcpu *vcpu, int vpid,
+- bool invalidate_gpa)
+-{
+- if (enable_ept && (invalidate_gpa || !enable_vpid)) {
+- if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
+- return;
+- ept_sync_context(construct_eptp(vcpu, vcpu->arch.mmu.root_hpa));
+- } else {
+- vpid_sync_context(vpid);
+- }
+-}
+-
+-static void vmx_flush_tlb(struct kvm_vcpu *vcpu, bool invalidate_gpa)
+-{
+- __vmx_flush_tlb(vcpu, to_vmx(vcpu)->vpid, invalidate_gpa);
+-}
+-
+-static void vmx_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t addr)
+-{
+- int vpid = to_vmx(vcpu)->vpid;
+-
+- if (!vpid_sync_vcpu_addr(vpid, addr))
+- vpid_sync_context(vpid);
+-
+- /*
+- * If VPIDs are not supported or enabled, then the above is a no-op.
+- * But we don't really need a TLB flush in that case anyway, because
+- * each VM entry/exit includes an implicit flush when VPID is 0.
+- */
+-}
+-
+-static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
+-{
+- ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits;
+-
+- vcpu->arch.cr0 &= ~cr0_guest_owned_bits;
+- vcpu->arch.cr0 |= vmcs_readl(GUEST_CR0) & cr0_guest_owned_bits;
+-}
+-
+-static void vmx_decache_cr3(struct kvm_vcpu *vcpu)
+-{
+- if (enable_unrestricted_guest || (enable_ept && is_paging(vcpu)))
+- vcpu->arch.cr3 = vmcs_readl(GUEST_CR3);
+- __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
+-}
+-
+-static void vmx_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
+-{
+- ulong cr4_guest_owned_bits = vcpu->arch.cr4_guest_owned_bits;
+-
+- vcpu->arch.cr4 &= ~cr4_guest_owned_bits;
+- vcpu->arch.cr4 |= vmcs_readl(GUEST_CR4) & cr4_guest_owned_bits;
+-}
+-
+-static void ept_load_pdptrs(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
+-
+- if (!test_bit(VCPU_EXREG_PDPTR,
+- (unsigned long *)&vcpu->arch.regs_dirty))
+- return;
+-
+- if (is_pae_paging(vcpu)) {
+- vmcs_write64(GUEST_PDPTR0, mmu->pdptrs[0]);
+- vmcs_write64(GUEST_PDPTR1, mmu->pdptrs[1]);
+- vmcs_write64(GUEST_PDPTR2, mmu->pdptrs[2]);
+- vmcs_write64(GUEST_PDPTR3, mmu->pdptrs[3]);
+- }
+-}
+-
+-static void ept_save_pdptrs(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
+-
+- if (is_pae_paging(vcpu)) {
+- mmu->pdptrs[0] = vmcs_read64(GUEST_PDPTR0);
+- mmu->pdptrs[1] = vmcs_read64(GUEST_PDPTR1);
+- mmu->pdptrs[2] = vmcs_read64(GUEST_PDPTR2);
+- mmu->pdptrs[3] = vmcs_read64(GUEST_PDPTR3);
+- }
+-
+- __set_bit(VCPU_EXREG_PDPTR,
+- (unsigned long *)&vcpu->arch.regs_avail);
+- __set_bit(VCPU_EXREG_PDPTR,
+- (unsigned long *)&vcpu->arch.regs_dirty);
+-}
+-
+-static bool nested_guest_cr0_valid(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+- u64 fixed0 = to_vmx(vcpu)->nested.msrs.cr0_fixed0;
+- u64 fixed1 = to_vmx(vcpu)->nested.msrs.cr0_fixed1;
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+-
+- if (to_vmx(vcpu)->nested.msrs.secondary_ctls_high &
+- SECONDARY_EXEC_UNRESTRICTED_GUEST &&
+- nested_cpu_has2(vmcs12, SECONDARY_EXEC_UNRESTRICTED_GUEST))
+- fixed0 &= ~(X86_CR0_PE | X86_CR0_PG);
+-
+- return fixed_bits_valid(val, fixed0, fixed1);
+-}
+-
+-static bool nested_host_cr0_valid(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+- u64 fixed0 = to_vmx(vcpu)->nested.msrs.cr0_fixed0;
+- u64 fixed1 = to_vmx(vcpu)->nested.msrs.cr0_fixed1;
+-
+- return fixed_bits_valid(val, fixed0, fixed1);
+-}
+-
+-static bool nested_cr4_valid(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+- u64 fixed0 = to_vmx(vcpu)->nested.msrs.cr4_fixed0;
+- u64 fixed1 = to_vmx(vcpu)->nested.msrs.cr4_fixed1;
+-
+- return fixed_bits_valid(val, fixed0, fixed1);
+-}
+-
+-/* No difference in the restrictions on guest and host CR4 in VMX operation. */
+-#define nested_guest_cr4_valid nested_cr4_valid
+-#define nested_host_cr4_valid nested_cr4_valid
+-
+-static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4);
+-
+-static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
+- unsigned long cr0,
+- struct kvm_vcpu *vcpu)
+-{
+- if (!test_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail))
+- vmx_decache_cr3(vcpu);
+- if (!(cr0 & X86_CR0_PG)) {
+- /* From paging/starting to nonpaging */
+- vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
+- vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
+- (CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_CR3_STORE_EXITING));
+- vcpu->arch.cr0 = cr0;
+- vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
+- } else if (!is_paging(vcpu)) {
+- /* From nonpaging to paging */
+- vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
+- vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
+- ~(CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_CR3_STORE_EXITING));
+- vcpu->arch.cr0 = cr0;
+- vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
+- }
+-
+- if (!(cr0 & X86_CR0_WP))
+- *hw_cr0 &= ~X86_CR0_WP;
+-}
+-
+-static void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long hw_cr0;
+-
+- hw_cr0 = (cr0 & ~KVM_GUEST_CR0_MASK);
+- if (enable_unrestricted_guest)
+- hw_cr0 |= KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST;
+- else {
+- hw_cr0 |= KVM_VM_CR0_ALWAYS_ON;
+-
+- if (vmx->rmode.vm86_active && (cr0 & X86_CR0_PE))
+- enter_pmode(vcpu);
+-
+- if (!vmx->rmode.vm86_active && !(cr0 & X86_CR0_PE))
+- enter_rmode(vcpu);
+- }
+-
+-#ifdef CONFIG_X86_64
+- if (vcpu->arch.efer & EFER_LME) {
+- if (!is_paging(vcpu) && (cr0 & X86_CR0_PG))
+- enter_lmode(vcpu);
+- if (is_paging(vcpu) && !(cr0 & X86_CR0_PG))
+- exit_lmode(vcpu);
+- }
+-#endif
+-
+- if (enable_ept && !enable_unrestricted_guest)
+- ept_update_paging_mode_cr0(&hw_cr0, cr0, vcpu);
+-
+- vmcs_writel(CR0_READ_SHADOW, cr0);
+- vmcs_writel(GUEST_CR0, hw_cr0);
+- vcpu->arch.cr0 = cr0;
+-
+- /* depends on vcpu->arch.cr0 to be set to a new value */
+- vmx->emulation_required = emulation_required(vcpu);
+-}
+-
+-static int get_ept_level(struct kvm_vcpu *vcpu)
+-{
+- /* Nested EPT currently only supports 4-level walks. */
+- if (is_guest_mode(vcpu) && nested_cpu_has_ept(get_vmcs12(vcpu)))
+- return 4;
+- if (cpu_has_vmx_ept_5levels() && (cpuid_maxphyaddr(vcpu) > 48))
+- return 5;
+- return 4;
+-}
+-
+-static u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa)
+-{
+- u64 eptp = VMX_EPTP_MT_WB;
+-
+- eptp |= (get_ept_level(vcpu) == 5) ? VMX_EPTP_PWL_5 : VMX_EPTP_PWL_4;
+-
+- if (enable_ept_ad_bits &&
+- (!is_guest_mode(vcpu) || nested_ept_ad_enabled(vcpu)))
+- eptp |= VMX_EPTP_AD_ENABLE_BIT;
+- eptp |= (root_hpa & PAGE_MASK);
+-
+- return eptp;
+-}
+-
+-static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
+-{
+- struct kvm *kvm = vcpu->kvm;
+- unsigned long guest_cr3;
+- u64 eptp;
+-
+- guest_cr3 = cr3;
+- if (enable_ept) {
+- eptp = construct_eptp(vcpu, cr3);
+- vmcs_write64(EPT_POINTER, eptp);
+-
+- if (kvm_x86_ops->tlb_remote_flush) {
+- spin_lock(&to_kvm_vmx(kvm)->ept_pointer_lock);
+- to_vmx(vcpu)->ept_pointer = eptp;
+- to_kvm_vmx(kvm)->ept_pointers_match
+- = EPT_POINTERS_CHECK;
+- spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock);
+- }
+-
+- if (enable_unrestricted_guest || is_paging(vcpu) ||
+- is_guest_mode(vcpu))
+- guest_cr3 = kvm_read_cr3(vcpu);
+- else
+- guest_cr3 = to_kvm_vmx(kvm)->ept_identity_map_addr;
+- ept_load_pdptrs(vcpu);
+- }
+-
+- vmcs_writel(GUEST_CR3, guest_cr3);
+-}
+-
+-static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+-{
+- /*
+- * Pass through host's Machine Check Enable value to hw_cr4, which
+- * is in force while we are in guest mode. Do not let guests control
+- * this bit, even if host CR4.MCE == 0.
+- */
+- unsigned long hw_cr4;
+-
+- hw_cr4 = (cr4_read_shadow() & X86_CR4_MCE) | (cr4 & ~X86_CR4_MCE);
+- if (enable_unrestricted_guest)
+- hw_cr4 |= KVM_VM_CR4_ALWAYS_ON_UNRESTRICTED_GUEST;
+- else if (to_vmx(vcpu)->rmode.vm86_active)
+- hw_cr4 |= KVM_RMODE_VM_CR4_ALWAYS_ON;
+- else
+- hw_cr4 |= KVM_PMODE_VM_CR4_ALWAYS_ON;
+-
+- if (!boot_cpu_has(X86_FEATURE_UMIP) && vmx_umip_emulated()) {
+- if (cr4 & X86_CR4_UMIP) {
+- vmcs_set_bits(SECONDARY_VM_EXEC_CONTROL,
+- SECONDARY_EXEC_DESC);
+- hw_cr4 &= ~X86_CR4_UMIP;
+- } else if (!is_guest_mode(vcpu) ||
+- !nested_cpu_has2(get_vmcs12(vcpu), SECONDARY_EXEC_DESC))
+- vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL,
+- SECONDARY_EXEC_DESC);
+- }
+-
+- if (cr4 & X86_CR4_VMXE) {
+- /*
+- * To use VMXON (and later other VMX instructions), a guest
+- * must first be able to turn on cr4.VMXE (see handle_vmon()).
+- * So basically the check on whether to allow nested VMX
+- * is here. We operate under the default treatment of SMM,
+- * so VMX cannot be enabled under SMM.
+- */
+- if (!nested_vmx_allowed(vcpu) || is_smm(vcpu))
+- return 1;
+- }
+-
+- if (to_vmx(vcpu)->nested.vmxon && !nested_cr4_valid(vcpu, cr4))
+- return 1;
+-
+- vcpu->arch.cr4 = cr4;
+-
+- if (!enable_unrestricted_guest) {
+- if (enable_ept) {
+- if (!is_paging(vcpu)) {
+- hw_cr4 &= ~X86_CR4_PAE;
+- hw_cr4 |= X86_CR4_PSE;
+- } else if (!(cr4 & X86_CR4_PAE)) {
+- hw_cr4 &= ~X86_CR4_PAE;
+- }
+- }
+-
+- /*
+- * SMEP/SMAP/PKU is disabled if CPU is in non-paging mode in
+- * hardware. To emulate this behavior, SMEP/SMAP/PKU needs
+- * to be manually disabled when guest switches to non-paging
+- * mode.
+- *
+- * If !enable_unrestricted_guest, the CPU is always running
+- * with CR0.PG=1 and CR4 needs to be modified.
+- * If enable_unrestricted_guest, the CPU automatically
+- * disables SMEP/SMAP/PKU when the guest sets CR0.PG=0.
+- */
+- if (!is_paging(vcpu))
+- hw_cr4 &= ~(X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE);
+- }
+-
+- vmcs_writel(CR4_READ_SHADOW, cr4);
+- vmcs_writel(GUEST_CR4, hw_cr4);
+- return 0;
+-}
+-
+-static void vmx_get_segment(struct kvm_vcpu *vcpu,
+- struct kvm_segment *var, int seg)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 ar;
+-
+- if (vmx->rmode.vm86_active && seg != VCPU_SREG_LDTR) {
+- *var = vmx->rmode.segs[seg];
+- if (seg == VCPU_SREG_TR
+- || var->selector == vmx_read_guest_seg_selector(vmx, seg))
+- return;
+- var->base = vmx_read_guest_seg_base(vmx, seg);
+- var->selector = vmx_read_guest_seg_selector(vmx, seg);
+- return;
+- }
+- var->base = vmx_read_guest_seg_base(vmx, seg);
+- var->limit = vmx_read_guest_seg_limit(vmx, seg);
+- var->selector = vmx_read_guest_seg_selector(vmx, seg);
+- ar = vmx_read_guest_seg_ar(vmx, seg);
+- var->unusable = (ar >> 16) & 1;
+- var->type = ar & 15;
+- var->s = (ar >> 4) & 1;
+- var->dpl = (ar >> 5) & 3;
+- /*
+- * Some userspaces do not preserve unusable property. Since usable
+- * segment has to be present according to VMX spec we can use present
+- * property to amend userspace bug by making unusable segment always
+- * nonpresent. vmx_segment_access_rights() already marks nonpresent
+- * segment as unusable.
+- */
+- var->present = !var->unusable;
+- var->avl = (ar >> 12) & 1;
+- var->l = (ar >> 13) & 1;
+- var->db = (ar >> 14) & 1;
+- var->g = (ar >> 15) & 1;
+-}
+-
+-static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)
+-{
+- struct kvm_segment s;
+-
+- if (to_vmx(vcpu)->rmode.vm86_active) {
+- vmx_get_segment(vcpu, &s, seg);
+- return s.base;
+- }
+- return vmx_read_guest_seg_base(to_vmx(vcpu), seg);
+-}
+-
+-static int vmx_get_cpl(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (unlikely(vmx->rmode.vm86_active))
+- return 0;
+- else {
+- int ar = vmx_read_guest_seg_ar(vmx, VCPU_SREG_SS);
+- return VMX_AR_DPL(ar);
+- }
+-}
+-
+-static u32 vmx_segment_access_rights(struct kvm_segment *var)
+-{
+- u32 ar;
+-
+- if (var->unusable || !var->present)
+- ar = 1 << 16;
+- else {
+- ar = var->type & 15;
+- ar |= (var->s & 1) << 4;
+- ar |= (var->dpl & 3) << 5;
+- ar |= (var->present & 1) << 7;
+- ar |= (var->avl & 1) << 12;
+- ar |= (var->l & 1) << 13;
+- ar |= (var->db & 1) << 14;
+- ar |= (var->g & 1) << 15;
+- }
+-
+- return ar;
+-}
+-
+-static void vmx_set_segment(struct kvm_vcpu *vcpu,
+- struct kvm_segment *var, int seg)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
+-
+- vmx_segment_cache_clear(vmx);
+-
+- if (vmx->rmode.vm86_active && seg != VCPU_SREG_LDTR) {
+- vmx->rmode.segs[seg] = *var;
+- if (seg == VCPU_SREG_TR)
+- vmcs_write16(sf->selector, var->selector);
+- else if (var->s)
+- fix_rmode_seg(seg, &vmx->rmode.segs[seg]);
+- goto out;
+- }
+-
+- vmcs_writel(sf->base, var->base);
+- vmcs_write32(sf->limit, var->limit);
+- vmcs_write16(sf->selector, var->selector);
+-
+- /*
+- * Fix the "Accessed" bit in AR field of segment registers for older
+- * qemu binaries.
+- * IA32 arch specifies that at the time of processor reset the
+- * "Accessed" bit in the AR field of segment registers is 1. And qemu
+- * is setting it to 0 in the userland code. This causes invalid guest
+- * state vmexit when "unrestricted guest" mode is turned on.
+- * Fix for this setup issue in cpu_reset is being pushed in the qemu
+- * tree. Newer qemu binaries with that qemu fix would not need this
+- * kvm hack.
+- */
+- if (enable_unrestricted_guest && (seg != VCPU_SREG_LDTR))
+- var->type |= 0x1; /* Accessed */
+-
+- vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(var));
+-
+-out:
+- vmx->emulation_required = emulation_required(vcpu);
+-}
+-
+-static void vmx_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
+-{
+- u32 ar = vmx_read_guest_seg_ar(to_vmx(vcpu), VCPU_SREG_CS);
+-
+- *db = (ar >> 14) & 1;
+- *l = (ar >> 13) & 1;
+-}
+-
+-static void vmx_get_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
+-{
+- dt->size = vmcs_read32(GUEST_IDTR_LIMIT);
+- dt->address = vmcs_readl(GUEST_IDTR_BASE);
+-}
+-
+-static void vmx_set_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
+-{
+- vmcs_write32(GUEST_IDTR_LIMIT, dt->size);
+- vmcs_writel(GUEST_IDTR_BASE, dt->address);
+-}
+-
+-static void vmx_get_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
+-{
+- dt->size = vmcs_read32(GUEST_GDTR_LIMIT);
+- dt->address = vmcs_readl(GUEST_GDTR_BASE);
+-}
+-
+-static void vmx_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
+-{
+- vmcs_write32(GUEST_GDTR_LIMIT, dt->size);
+- vmcs_writel(GUEST_GDTR_BASE, dt->address);
+-}
+-
+-static bool rmode_segment_valid(struct kvm_vcpu *vcpu, int seg)
+-{
+- struct kvm_segment var;
+- u32 ar;
+-
+- vmx_get_segment(vcpu, &var, seg);
+- var.dpl = 0x3;
+- if (seg == VCPU_SREG_CS)
+- var.type = 0x3;
+- ar = vmx_segment_access_rights(&var);
+-
+- if (var.base != (var.selector << 4))
+- return false;
+- if (var.limit != 0xffff)
+- return false;
+- if (ar != 0xf3)
+- return false;
+-
+- return true;
+-}
+-
+-static bool code_segment_valid(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_segment cs;
+- unsigned int cs_rpl;
+-
+- vmx_get_segment(vcpu, &cs, VCPU_SREG_CS);
+- cs_rpl = cs.selector & SEGMENT_RPL_MASK;
+-
+- if (cs.unusable)
+- return false;
+- if (~cs.type & (VMX_AR_TYPE_CODE_MASK|VMX_AR_TYPE_ACCESSES_MASK))
+- return false;
+- if (!cs.s)
+- return false;
+- if (cs.type & VMX_AR_TYPE_WRITEABLE_MASK) {
+- if (cs.dpl > cs_rpl)
+- return false;
+- } else {
+- if (cs.dpl != cs_rpl)
+- return false;
+- }
+- if (!cs.present)
+- return false;
+-
+- /* TODO: Add Reserved field check, this'll require a new member in the kvm_segment_field structure */
+- return true;
+-}
+-
+-static bool stack_segment_valid(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_segment ss;
+- unsigned int ss_rpl;
+-
+- vmx_get_segment(vcpu, &ss, VCPU_SREG_SS);
+- ss_rpl = ss.selector & SEGMENT_RPL_MASK;
+-
+- if (ss.unusable)
+- return true;
+- if (ss.type != 3 && ss.type != 7)
+- return false;
+- if (!ss.s)
+- return false;
+- if (ss.dpl != ss_rpl) /* DPL != RPL */
+- return false;
+- if (!ss.present)
+- return false;
+-
+- return true;
+-}
+-
+-static bool data_segment_valid(struct kvm_vcpu *vcpu, int seg)
+-{
+- struct kvm_segment var;
+- unsigned int rpl;
+-
+- vmx_get_segment(vcpu, &var, seg);
+- rpl = var.selector & SEGMENT_RPL_MASK;
+-
+- if (var.unusable)
+- return true;
+- if (!var.s)
+- return false;
+- if (!var.present)
+- return false;
+- if (~var.type & (VMX_AR_TYPE_CODE_MASK|VMX_AR_TYPE_WRITEABLE_MASK)) {
+- if (var.dpl < rpl) /* DPL < RPL */
+- return false;
+- }
+-
+- /* TODO: Add other members to kvm_segment_field to allow checking for other access
+- * rights flags
+- */
+- return true;
+-}
+-
+-static bool tr_valid(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_segment tr;
+-
+- vmx_get_segment(vcpu, &tr, VCPU_SREG_TR);
+-
+- if (tr.unusable)
+- return false;
+- if (tr.selector & SEGMENT_TI_MASK) /* TI = 1 */
+- return false;
+- if (tr.type != 3 && tr.type != 11) /* TODO: Check if guest is in IA32e mode */
+- return false;
+- if (!tr.present)
+- return false;
+-
+- return true;
+-}
+-
+-static bool ldtr_valid(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_segment ldtr;
+-
+- vmx_get_segment(vcpu, &ldtr, VCPU_SREG_LDTR);
+-
+- if (ldtr.unusable)
+- return true;
+- if (ldtr.selector & SEGMENT_TI_MASK) /* TI = 1 */
+- return false;
+- if (ldtr.type != 2)
+- return false;
+- if (!ldtr.present)
+- return false;
+-
+- return true;
+-}
+-
+-static bool cs_ss_rpl_check(struct kvm_vcpu *vcpu)
+-{
+- struct kvm_segment cs, ss;
+-
+- vmx_get_segment(vcpu, &cs, VCPU_SREG_CS);
+- vmx_get_segment(vcpu, &ss, VCPU_SREG_SS);
+-
+- return ((cs.selector & SEGMENT_RPL_MASK) ==
+- (ss.selector & SEGMENT_RPL_MASK));
+-}
+-
+-static bool nested_vmx_check_io_bitmaps(struct kvm_vcpu *vcpu,
+- unsigned int port, int size);
+-static bool nested_vmx_exit_handled_io(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- unsigned long exit_qualification;
+- unsigned short port;
+- int size;
+-
+- if (!nested_cpu_has(vmcs12, CPU_BASED_USE_IO_BITMAPS))
+- return nested_cpu_has(vmcs12, CPU_BASED_UNCOND_IO_EXITING);
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+-
+- port = exit_qualification >> 16;
+- size = (exit_qualification & 7) + 1;
+-
+- return nested_vmx_check_io_bitmaps(vcpu, port, size);
+-}
+-
+-/*
+- * Check if guest state is valid. Returns true if valid, false if
+- * not.
+- * We assume that registers are always usable
+- */
+-static bool guest_state_valid(struct kvm_vcpu *vcpu)
+-{
+- if (enable_unrestricted_guest)
+- return true;
+-
+- /* real mode guest state checks */
+- if (!is_protmode(vcpu) || (vmx_get_rflags(vcpu) & X86_EFLAGS_VM)) {
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_CS))
+- return false;
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_SS))
+- return false;
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_DS))
+- return false;
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_ES))
+- return false;
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_FS))
+- return false;
+- if (!rmode_segment_valid(vcpu, VCPU_SREG_GS))
+- return false;
+- } else {
+- /* protected mode guest state checks */
+- if (!cs_ss_rpl_check(vcpu))
+- return false;
+- if (!code_segment_valid(vcpu))
+- return false;
+- if (!stack_segment_valid(vcpu))
+- return false;
+- if (!data_segment_valid(vcpu, VCPU_SREG_DS))
+- return false;
+- if (!data_segment_valid(vcpu, VCPU_SREG_ES))
+- return false;
+- if (!data_segment_valid(vcpu, VCPU_SREG_FS))
+- return false;
+- if (!data_segment_valid(vcpu, VCPU_SREG_GS))
+- return false;
+- if (!tr_valid(vcpu))
+- return false;
+- if (!ldtr_valid(vcpu))
+- return false;
+- }
+- /* TODO:
+- * - Add checks on RIP
+- * - Add checks on RFLAGS
+- */
+-
+- return true;
+-}
+-
+-static bool page_address_valid(struct kvm_vcpu *vcpu, gpa_t gpa)
+-{
+- return PAGE_ALIGNED(gpa) && !(gpa >> cpuid_maxphyaddr(vcpu));
+-}
+-
+-static int init_rmode_tss(struct kvm *kvm)
+-{
+- gfn_t fn;
+- u16 data = 0;
+- int idx, r;
+-
+- idx = srcu_read_lock(&kvm->srcu);
+- fn = to_kvm_vmx(kvm)->tss_addr >> PAGE_SHIFT;
+- r = kvm_clear_guest_page(kvm, fn, 0, PAGE_SIZE);
+- if (r < 0)
+- goto out;
+- data = TSS_BASE_SIZE + TSS_REDIRECTION_SIZE;
+- r = kvm_write_guest_page(kvm, fn++, &data,
+- TSS_IOPB_BASE_OFFSET, sizeof(u16));
+- if (r < 0)
+- goto out;
+- r = kvm_clear_guest_page(kvm, fn++, 0, PAGE_SIZE);
+- if (r < 0)
+- goto out;
+- r = kvm_clear_guest_page(kvm, fn, 0, PAGE_SIZE);
+- if (r < 0)
+- goto out;
+- data = ~0;
+- r = kvm_write_guest_page(kvm, fn, &data,
+- RMODE_TSS_SIZE - 2 * PAGE_SIZE - 1,
+- sizeof(u8));
+-out:
+- srcu_read_unlock(&kvm->srcu, idx);
+- return r;
+-}
+-
+-static int init_rmode_identity_map(struct kvm *kvm)
+-{
+- struct kvm_vmx *kvm_vmx = to_kvm_vmx(kvm);
+- int i, idx, r = 0;
+- kvm_pfn_t identity_map_pfn;
+- u32 tmp;
+-
+- /* Protect kvm_vmx->ept_identity_pagetable_done. */
+- mutex_lock(&kvm->slots_lock);
+-
+- if (likely(kvm_vmx->ept_identity_pagetable_done))
+- goto out2;
+-
+- if (!kvm_vmx->ept_identity_map_addr)
+- kvm_vmx->ept_identity_map_addr = VMX_EPT_IDENTITY_PAGETABLE_ADDR;
+- identity_map_pfn = kvm_vmx->ept_identity_map_addr >> PAGE_SHIFT;
+-
+- r = __x86_set_memory_region(kvm, IDENTITY_PAGETABLE_PRIVATE_MEMSLOT,
+- kvm_vmx->ept_identity_map_addr, PAGE_SIZE);
+- if (r < 0)
+- goto out2;
+-
+- idx = srcu_read_lock(&kvm->srcu);
+- r = kvm_clear_guest_page(kvm, identity_map_pfn, 0, PAGE_SIZE);
+- if (r < 0)
+- goto out;
+- /* Set up identity-mapping pagetable for EPT in real mode */
+- for (i = 0; i < PT32_ENT_PER_PAGE; i++) {
+- tmp = (i << 22) + (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER |
+- _PAGE_ACCESSED | _PAGE_DIRTY | _PAGE_PSE);
+- r = kvm_write_guest_page(kvm, identity_map_pfn,
+- &tmp, i * sizeof(tmp), sizeof(tmp));
+- if (r < 0)
+- goto out;
+- }
+- kvm_vmx->ept_identity_pagetable_done = true;
+-
+-out:
+- srcu_read_unlock(&kvm->srcu, idx);
+-
+-out2:
+- mutex_unlock(&kvm->slots_lock);
+- return r;
+-}
+-
+-static void seg_setup(int seg)
+-{
+- const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
+- unsigned int ar;
+-
+- vmcs_write16(sf->selector, 0);
+- vmcs_writel(sf->base, 0);
+- vmcs_write32(sf->limit, 0xffff);
+- ar = 0x93;
+- if (seg == VCPU_SREG_CS)
+- ar |= 0x08; /* code segment */
+-
+- vmcs_write32(sf->ar_bytes, ar);
+-}
+-
+-static int alloc_apic_access_page(struct kvm *kvm)
+-{
+- struct page *page;
+- int r = 0;
+-
+- mutex_lock(&kvm->slots_lock);
+- if (kvm->arch.apic_access_page_done)
+- goto out;
+- r = __x86_set_memory_region(kvm, APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
+- APIC_DEFAULT_PHYS_BASE, PAGE_SIZE);
+- if (r)
+- goto out;
+-
+- page = gfn_to_page(kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT);
+- if (is_error_page(page)) {
+- r = -EFAULT;
+- goto out;
+- }
+-
+- /*
+- * Do not pin the page in memory, so that memory hot-unplug
+- * is able to migrate it.
+- */
+- put_page(page);
+- kvm->arch.apic_access_page_done = true;
+-out:
+- mutex_unlock(&kvm->slots_lock);
+- return r;
+-}
+-
+-static int allocate_vpid(void)
+-{
+- int vpid;
+-
+- if (!enable_vpid)
+- return 0;
+- spin_lock(&vmx_vpid_lock);
+- vpid = find_first_zero_bit(vmx_vpid_bitmap, VMX_NR_VPIDS);
+- if (vpid < VMX_NR_VPIDS)
+- __set_bit(vpid, vmx_vpid_bitmap);
+- else
+- vpid = 0;
+- spin_unlock(&vmx_vpid_lock);
+- return vpid;
+-}
+-
+-static void free_vpid(int vpid)
+-{
+- if (!enable_vpid || vpid == 0)
+- return;
+- spin_lock(&vmx_vpid_lock);
+- __clear_bit(vpid, vmx_vpid_bitmap);
+- spin_unlock(&vmx_vpid_lock);
+-}
+-
+-static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
+- u32 msr, int type)
+-{
+- int f = sizeof(unsigned long);
+-
+- if (!cpu_has_vmx_msr_bitmap())
+- return;
+-
+- if (static_branch_unlikely(&enable_evmcs))
+- evmcs_touch_msr_bitmap();
+-
+- /*
+- * See Intel PRM Vol. 3, 20.6.9 (MSR-Bitmap Address). Early manuals
+- * have the write-low and read-high bitmap offsets the wrong way round.
+- * We can control MSRs 0x00000000-0x00001fff and 0xc0000000-0xc0001fff.
+- */
+- if (msr <= 0x1fff) {
+- if (type & MSR_TYPE_R)
+- /* read-low */
+- __clear_bit(msr, msr_bitmap + 0x000 / f);
+-
+- if (type & MSR_TYPE_W)
+- /* write-low */
+- __clear_bit(msr, msr_bitmap + 0x800 / f);
+-
+- } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
+- msr &= 0x1fff;
+- if (type & MSR_TYPE_R)
+- /* read-high */
+- __clear_bit(msr, msr_bitmap + 0x400 / f);
+-
+- if (type & MSR_TYPE_W)
+- /* write-high */
+- __clear_bit(msr, msr_bitmap + 0xc00 / f);
+-
+- }
+-}
+-
+-static __always_inline void vmx_enable_intercept_for_msr(unsigned long *msr_bitmap,
+- u32 msr, int type)
+-{
+- int f = sizeof(unsigned long);
+-
+- if (!cpu_has_vmx_msr_bitmap())
+- return;
+-
+- if (static_branch_unlikely(&enable_evmcs))
+- evmcs_touch_msr_bitmap();
+-
+- /*
+- * See Intel PRM Vol. 3, 20.6.9 (MSR-Bitmap Address). Early manuals
+- * have the write-low and read-high bitmap offsets the wrong way round.
+- * We can control MSRs 0x00000000-0x00001fff and 0xc0000000-0xc0001fff.
+- */
+- if (msr <= 0x1fff) {
+- if (type & MSR_TYPE_R)
+- /* read-low */
+- __set_bit(msr, msr_bitmap + 0x000 / f);
+-
+- if (type & MSR_TYPE_W)
+- /* write-low */
+- __set_bit(msr, msr_bitmap + 0x800 / f);
+-
+- } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
+- msr &= 0x1fff;
+- if (type & MSR_TYPE_R)
+- /* read-high */
+- __set_bit(msr, msr_bitmap + 0x400 / f);
+-
+- if (type & MSR_TYPE_W)
+- /* write-high */
+- __set_bit(msr, msr_bitmap + 0xc00 / f);
+-
+- }
+-}
+-
+-static __always_inline void vmx_set_intercept_for_msr(unsigned long *msr_bitmap,
+- u32 msr, int type, bool value)
+-{
+- if (value)
+- vmx_enable_intercept_for_msr(msr_bitmap, msr, type);
+- else
+- vmx_disable_intercept_for_msr(msr_bitmap, msr, type);
+-}
+-
+-/*
+- * If a msr is allowed by L0, we should check whether it is allowed by L1.
+- * The corresponding bit will be cleared unless both of L0 and L1 allow it.
+- */
+-static void nested_vmx_disable_intercept_for_msr(unsigned long *msr_bitmap_l1,
+- unsigned long *msr_bitmap_nested,
+- u32 msr, int type)
+-{
+- int f = sizeof(unsigned long);
+-
+- /*
+- * See Intel PRM Vol. 3, 20.6.9 (MSR-Bitmap Address). Early manuals
+- * have the write-low and read-high bitmap offsets the wrong way round.
+- * We can control MSRs 0x00000000-0x00001fff and 0xc0000000-0xc0001fff.
+- */
+- if (msr <= 0x1fff) {
+- if (type & MSR_TYPE_R &&
+- !test_bit(msr, msr_bitmap_l1 + 0x000 / f))
+- /* read-low */
+- __clear_bit(msr, msr_bitmap_nested + 0x000 / f);
+-
+- if (type & MSR_TYPE_W &&
+- !test_bit(msr, msr_bitmap_l1 + 0x800 / f))
+- /* write-low */
+- __clear_bit(msr, msr_bitmap_nested + 0x800 / f);
+-
+- } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
+- msr &= 0x1fff;
+- if (type & MSR_TYPE_R &&
+- !test_bit(msr, msr_bitmap_l1 + 0x400 / f))
+- /* read-high */
+- __clear_bit(msr, msr_bitmap_nested + 0x400 / f);
+-
+- if (type & MSR_TYPE_W &&
+- !test_bit(msr, msr_bitmap_l1 + 0xc00 / f))
+- /* write-high */
+- __clear_bit(msr, msr_bitmap_nested + 0xc00 / f);
+-
+- }
+-}
+-
+-static u8 vmx_msr_bitmap_mode(struct kvm_vcpu *vcpu)
+-{
+- u8 mode = 0;
+-
+- if (cpu_has_secondary_exec_ctrls() &&
+- (vmcs_read32(SECONDARY_VM_EXEC_CONTROL) &
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE)) {
+- mode |= MSR_BITMAP_MODE_X2APIC;
+- if (enable_apicv && kvm_vcpu_apicv_active(vcpu))
+- mode |= MSR_BITMAP_MODE_X2APIC_APICV;
+- }
+-
+- return mode;
+-}
+-
+-#define X2APIC_MSR(r) (APIC_BASE_MSR + ((r) >> 4))
+-
+-static void vmx_update_msr_bitmap_x2apic(unsigned long *msr_bitmap,
+- u8 mode)
+-{
+- int msr;
+-
+- for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
+- unsigned word = msr / BITS_PER_LONG;
+- msr_bitmap[word] = (mode & MSR_BITMAP_MODE_X2APIC_APICV) ? 0 : ~0;
+- msr_bitmap[word + (0x800 / sizeof(long))] = ~0;
+- }
+-
+- if (mode & MSR_BITMAP_MODE_X2APIC) {
+- /*
+- * TPR reads and writes can be virtualized even if virtual interrupt
+- * delivery is not in use.
+- */
+- vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_TASKPRI), MSR_TYPE_RW);
+- if (mode & MSR_BITMAP_MODE_X2APIC_APICV) {
+- vmx_enable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_TMCCT), MSR_TYPE_R);
+- vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_EOI), MSR_TYPE_W);
+- vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_SELF_IPI), MSR_TYPE_W);
+- }
+- }
+-}
+-
+-static void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long *msr_bitmap = vmx->vmcs01.msr_bitmap;
+- u8 mode = vmx_msr_bitmap_mode(vcpu);
+- u8 changed = mode ^ vmx->msr_bitmap_mode;
+-
+- if (!changed)
+- return;
+-
+- if (changed & (MSR_BITMAP_MODE_X2APIC | MSR_BITMAP_MODE_X2APIC_APICV))
+- vmx_update_msr_bitmap_x2apic(msr_bitmap, mode);
+-
+- vmx->msr_bitmap_mode = mode;
+-}
+-
+-static bool vmx_get_enable_apicv(struct kvm_vcpu *vcpu)
+-{
+- return enable_apicv;
+-}
+-
+-static void nested_mark_vmcs12_pages_dirty(struct kvm_vcpu *vcpu)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- gfn_t gfn;
+-
+- /*
+- * Don't need to mark the APIC access page dirty; it is never
+- * written to by the CPU during APIC virtualization.
+- */
+-
+- if (nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW)) {
+- gfn = vmcs12->virtual_apic_page_addr >> PAGE_SHIFT;
+- kvm_vcpu_mark_page_dirty(vcpu, gfn);
+- }
+-
+- if (nested_cpu_has_posted_intr(vmcs12)) {
+- gfn = vmcs12->posted_intr_desc_addr >> PAGE_SHIFT;
+- kvm_vcpu_mark_page_dirty(vcpu, gfn);
+- }
+-}
+-
+-
+-static void vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int max_irr;
+- void *vapic_page;
+- u16 status;
+-
+- if (!vmx->nested.pi_desc || !vmx->nested.pi_pending)
+- return;
+-
+- vmx->nested.pi_pending = false;
+- if (!pi_test_and_clear_on(vmx->nested.pi_desc))
+- return;
+-
+- max_irr = find_last_bit((unsigned long *)vmx->nested.pi_desc->pir, 256);
+- if (max_irr != 256) {
+- vapic_page = kmap(vmx->nested.virtual_apic_page);
+- __kvm_apic_update_irr(vmx->nested.pi_desc->pir,
+- vapic_page, &max_irr);
+- kunmap(vmx->nested.virtual_apic_page);
+-
+- status = vmcs_read16(GUEST_INTR_STATUS);
+- if ((u8)max_irr > ((u8)status & 0xff)) {
+- status &= ~0xff;
+- status |= (u8)max_irr;
+- vmcs_write16(GUEST_INTR_STATUS, status);
+- }
+- }
+-
+- nested_mark_vmcs12_pages_dirty(vcpu);
+-}
+-
+-static u8 vmx_get_rvi(void)
+-{
+- return vmcs_read16(GUEST_INTR_STATUS) & 0xff;
+-}
+-
+-static bool vmx_guest_apic_has_interrupt(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- void *vapic_page;
+- u32 vppr;
+- int rvi;
+-
+- if (WARN_ON_ONCE(!is_guest_mode(vcpu)) ||
+- !nested_cpu_has_vid(get_vmcs12(vcpu)) ||
+- WARN_ON_ONCE(!vmx->nested.virtual_apic_page))
+- return false;
+-
+- rvi = vmx_get_rvi();
+-
+- vapic_page = kmap(vmx->nested.virtual_apic_page);
+- vppr = *((u32 *)(vapic_page + APIC_PROCPRI));
+- kunmap(vmx->nested.virtual_apic_page);
+-
+- return ((rvi & 0xf0) > (vppr & 0xf0));
+-}
+-
+-static inline bool kvm_vcpu_trigger_posted_interrupt(struct kvm_vcpu *vcpu,
+- bool nested)
+-{
+-#ifdef CONFIG_SMP
+- int pi_vec = nested ? POSTED_INTR_NESTED_VECTOR : POSTED_INTR_VECTOR;
+-
+- if (vcpu->mode == IN_GUEST_MODE) {
+- /*
+- * The vector of interrupt to be delivered to vcpu had
+- * been set in PIR before this function.
+- *
+- * Following cases will be reached in this block, and
+- * we always send a notification event in all cases as
+- * explained below.
+- *
+- * Case 1: vcpu keeps in non-root mode. Sending a
+- * notification event posts the interrupt to vcpu.
+- *
+- * Case 2: vcpu exits to root mode and is still
+- * runnable. PIR will be synced to vIRR before the
+- * next vcpu entry. Sending a notification event in
+- * this case has no effect, as vcpu is not in root
+- * mode.
+- *
+- * Case 3: vcpu exits to root mode and is blocked.
+- * vcpu_block() has already synced PIR to vIRR and
+- * never blocks vcpu if vIRR is not cleared. Therefore,
+- * a blocked vcpu here does not wait for any requested
+- * interrupts in PIR, and sending a notification event
+- * which has no effect is safe here.
+- */
+-
+- apic->send_IPI_mask(get_cpu_mask(vcpu->cpu), pi_vec);
+- return true;
+- }
+-#endif
+- return false;
+-}
+-
+-static int vmx_deliver_nested_posted_interrupt(struct kvm_vcpu *vcpu,
+- int vector)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (is_guest_mode(vcpu) &&
+- vector == vmx->nested.posted_intr_nv) {
+- /*
+- * If a posted intr is not recognized by hardware,
+- * we will accomplish it in the next vmentry.
+- */
+- vmx->nested.pi_pending = true;
+- kvm_make_request(KVM_REQ_EVENT, vcpu);
+- /* the PIR and ON have been set by L1. */
+- if (!kvm_vcpu_trigger_posted_interrupt(vcpu, true))
+- kvm_vcpu_kick(vcpu);
+- return 0;
+- }
+- return -1;
+-}
+-/*
+- * Send interrupt to vcpu via posted interrupt way.
+- * 1. If target vcpu is running(non-root mode), send posted interrupt
+- * notification to vcpu and hardware will sync PIR to vIRR atomically.
+- * 2. If target vcpu isn't running(root mode), kick it to pick up the
+- * interrupt from PIR in next vmentry.
+- */
+-static int vmx_deliver_posted_interrupt(struct kvm_vcpu *vcpu, int vector)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int r;
+-
+- r = vmx_deliver_nested_posted_interrupt(vcpu, vector);
+- if (!r)
+- return 0;
+-
+- if (!vcpu->arch.apicv_active)
+- return -1;
+-
+- if (pi_test_and_set_pir(vector, &vmx->pi_desc))
+- return 0;
+-
+- /* If a previous notification has sent the IPI, nothing to do. */
+- if (pi_test_and_set_on(&vmx->pi_desc))
+- return 0;
+-
+- if (!kvm_vcpu_trigger_posted_interrupt(vcpu, false))
+- kvm_vcpu_kick(vcpu);
+-
+- return 0;
+-}
+-
+-/*
+- * Set up the vmcs's constant host-state fields, i.e., host-state fields that
+- * will not change in the lifetime of the guest.
+- * Note that host-state that does change is set elsewhere. E.g., host-state
+- * that is set differently for each CPU is set in vmx_vcpu_load(), not here.
+- */
+-static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+-{
+- u32 low32, high32;
+- unsigned long tmpl;
+- struct desc_ptr dt;
+- unsigned long cr0, cr3, cr4;
+-
+- cr0 = read_cr0();
+- WARN_ON(cr0 & X86_CR0_TS);
+- vmcs_writel(HOST_CR0, cr0); /* 22.2.3 */
+-
+- /*
+- * Save the most likely value for this task's CR3 in the VMCS.
+- * We can't use __get_current_cr3_fast() because we're not atomic.
+- */
+- cr3 = __read_cr3();
+- vmcs_writel(HOST_CR3, cr3); /* 22.2.3 FIXME: shadow tables */
+- vmx->loaded_vmcs->host_state.cr3 = cr3;
+-
+- /* Save the most likely value for this task's CR4 in the VMCS. */
+- cr4 = cr4_read_shadow();
+- vmcs_writel(HOST_CR4, cr4); /* 22.2.3, 22.2.5 */
+- vmx->loaded_vmcs->host_state.cr4 = cr4;
+-
+- vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */
+-#ifdef CONFIG_X86_64
+- /*
+- * Load null selectors, so we can avoid reloading them in
+- * vmx_prepare_switch_to_host(), in case userspace uses
+- * the null selectors too (the expected case).
+- */
+- vmcs_write16(HOST_DS_SELECTOR, 0);
+- vmcs_write16(HOST_ES_SELECTOR, 0);
+-#else
+- vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
+- vmcs_write16(HOST_ES_SELECTOR, __KERNEL_DS); /* 22.2.4 */
+-#endif
+- vmcs_write16(HOST_SS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
+- vmcs_write16(HOST_TR_SELECTOR, GDT_ENTRY_TSS*8); /* 22.2.4 */
+-
+- store_idt(&dt);
+- vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
+- vmx->host_idt_base = dt.address;
+-
+- vmcs_writel(HOST_RIP, vmx_return); /* 22.2.5 */
+-
+- rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
+- vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
+- rdmsrl(MSR_IA32_SYSENTER_EIP, tmpl);
+- vmcs_writel(HOST_IA32_SYSENTER_EIP, tmpl); /* 22.2.3 */
+-
+- if (vmcs_config.vmexit_ctrl & VM_EXIT_LOAD_IA32_PAT) {
+- rdmsr(MSR_IA32_CR_PAT, low32, high32);
+- vmcs_write64(HOST_IA32_PAT, low32 | ((u64) high32 << 32));
+- }
+-}
+-
+-static void set_cr4_guest_host_mask(struct vcpu_vmx *vmx)
+-{
+- BUILD_BUG_ON(KVM_CR4_GUEST_OWNED_BITS & ~KVM_POSSIBLE_CR4_GUEST_BITS);
+-
+- vmx->vcpu.arch.cr4_guest_owned_bits = KVM_CR4_GUEST_OWNED_BITS;
+- if (enable_ept)
+- vmx->vcpu.arch.cr4_guest_owned_bits |= X86_CR4_PGE;
+- if (is_guest_mode(&vmx->vcpu))
+- vmx->vcpu.arch.cr4_guest_owned_bits &=
+- ~get_vmcs12(&vmx->vcpu)->cr4_guest_host_mask;
+- vmcs_writel(CR4_GUEST_HOST_MASK, ~vmx->vcpu.arch.cr4_guest_owned_bits);
+-}
+-
+-static u32 vmx_pin_based_exec_ctrl(struct vcpu_vmx *vmx)
+-{
+- u32 pin_based_exec_ctrl = vmcs_config.pin_based_exec_ctrl;
+-
+- if (!kvm_vcpu_apicv_active(&vmx->vcpu))
+- pin_based_exec_ctrl &= ~PIN_BASED_POSTED_INTR;
+-
+- if (!enable_vnmi)
+- pin_based_exec_ctrl &= ~PIN_BASED_VIRTUAL_NMIS;
+-
+- /* Enable the preemption timer dynamically */
+- pin_based_exec_ctrl &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
+- return pin_based_exec_ctrl;
+-}
+-
+-static void vmx_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, vmx_pin_based_exec_ctrl(vmx));
+- if (cpu_has_secondary_exec_ctrls()) {
+- if (kvm_vcpu_apicv_active(vcpu))
+- vmcs_set_bits(SECONDARY_VM_EXEC_CONTROL,
+- SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
+- else
+- vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL,
+- SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
+- }
+-
+- if (cpu_has_vmx_msr_bitmap())
+- vmx_update_msr_bitmap(vcpu);
+-}
+-
+-static u32 vmx_exec_control(struct vcpu_vmx *vmx)
+-{
+- u32 exec_control = vmcs_config.cpu_based_exec_ctrl;
+-
+- if (vmx->vcpu.arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)
+- exec_control &= ~CPU_BASED_MOV_DR_EXITING;
+-
+- if (!cpu_need_tpr_shadow(&vmx->vcpu)) {
+- exec_control &= ~CPU_BASED_TPR_SHADOW;
+-#ifdef CONFIG_X86_64
+- exec_control |= CPU_BASED_CR8_STORE_EXITING |
+- CPU_BASED_CR8_LOAD_EXITING;
+-#endif
+- }
+- if (!enable_ept)
+- exec_control |= CPU_BASED_CR3_STORE_EXITING |
+- CPU_BASED_CR3_LOAD_EXITING |
+- CPU_BASED_INVLPG_EXITING;
+- if (kvm_mwait_in_guest(vmx->vcpu.kvm))
+- exec_control &= ~(CPU_BASED_MWAIT_EXITING |
+- CPU_BASED_MONITOR_EXITING);
+- if (kvm_hlt_in_guest(vmx->vcpu.kvm))
+- exec_control &= ~CPU_BASED_HLT_EXITING;
+- return exec_control;
+-}
+-
+-static bool vmx_rdrand_supported(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_RDRAND_EXITING;
+-}
+-
+-static bool vmx_rdseed_supported(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_RDSEED_EXITING;
+-}
+-
+-static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx)
+-{
+- struct kvm_vcpu *vcpu = &vmx->vcpu;
+-
+- u32 exec_control = vmcs_config.cpu_based_2nd_exec_ctrl;
+-
+- if (!cpu_need_virtualize_apic_accesses(vcpu))
+- exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+- if (vmx->vpid == 0)
+- exec_control &= ~SECONDARY_EXEC_ENABLE_VPID;
+- if (!enable_ept) {
+- exec_control &= ~SECONDARY_EXEC_ENABLE_EPT;
+- enable_unrestricted_guest = 0;
+- }
+- if (!enable_unrestricted_guest)
+- exec_control &= ~SECONDARY_EXEC_UNRESTRICTED_GUEST;
+- if (kvm_pause_in_guest(vmx->vcpu.kvm))
+- exec_control &= ~SECONDARY_EXEC_PAUSE_LOOP_EXITING;
+- if (!kvm_vcpu_apicv_active(vcpu))
+- exec_control &= ~(SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
+- exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
+-
+- /* SECONDARY_EXEC_DESC is enabled/disabled on writes to CR4.UMIP,
+- * in vmx_set_cr4. */
+- exec_control &= ~SECONDARY_EXEC_DESC;
+-
+- /* SECONDARY_EXEC_SHADOW_VMCS is enabled when L1 executes VMPTRLD
+- (handle_vmptrld).
+- We can NOT enable shadow_vmcs here because we don't have yet
+- a current VMCS12
+- */
+- exec_control &= ~SECONDARY_EXEC_SHADOW_VMCS;
+-
+- if (!enable_pml)
+- exec_control &= ~SECONDARY_EXEC_ENABLE_PML;
+-
+- if (vmx_xsaves_supported()) {
+- /* Exposing XSAVES only when XSAVE is exposed */
+- bool xsaves_enabled =
+- guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
+- guest_cpuid_has(vcpu, X86_FEATURE_XSAVES);
+-
+- if (!xsaves_enabled)
+- exec_control &= ~SECONDARY_EXEC_XSAVES;
+-
+- if (nested) {
+- if (xsaves_enabled)
+- vmx->nested.msrs.secondary_ctls_high |=
+- SECONDARY_EXEC_XSAVES;
+- else
+- vmx->nested.msrs.secondary_ctls_high &=
+- ~SECONDARY_EXEC_XSAVES;
+- }
+- }
+-
+- if (vmx_rdtscp_supported()) {
+- bool rdtscp_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP);
+- if (!rdtscp_enabled)
+- exec_control &= ~SECONDARY_EXEC_RDTSCP;
+-
+- if (nested) {
+- if (rdtscp_enabled)
+- vmx->nested.msrs.secondary_ctls_high |=
+- SECONDARY_EXEC_RDTSCP;
+- else
+- vmx->nested.msrs.secondary_ctls_high &=
+- ~SECONDARY_EXEC_RDTSCP;
+- }
+- }
+-
+- if (vmx_invpcid_supported()) {
+- /* Exposing INVPCID only when PCID is exposed */
+- bool invpcid_enabled =
+- guest_cpuid_has(vcpu, X86_FEATURE_INVPCID) &&
+- guest_cpuid_has(vcpu, X86_FEATURE_PCID);
+-
+- if (!invpcid_enabled) {
+- exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
+- guest_cpuid_clear(vcpu, X86_FEATURE_INVPCID);
+- }
+-
+- if (nested) {
+- if (invpcid_enabled)
+- vmx->nested.msrs.secondary_ctls_high |=
+- SECONDARY_EXEC_ENABLE_INVPCID;
+- else
+- vmx->nested.msrs.secondary_ctls_high &=
+- ~SECONDARY_EXEC_ENABLE_INVPCID;
+- }
+- }
+-
+- if (vmx_rdrand_supported()) {
+- bool rdrand_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDRAND);
+- if (rdrand_enabled)
+- exec_control &= ~SECONDARY_EXEC_RDRAND_EXITING;
+-
+- if (nested) {
+- if (rdrand_enabled)
+- vmx->nested.msrs.secondary_ctls_high |=
+- SECONDARY_EXEC_RDRAND_EXITING;
+- else
+- vmx->nested.msrs.secondary_ctls_high &=
+- ~SECONDARY_EXEC_RDRAND_EXITING;
+- }
+- }
+-
+- if (vmx_rdseed_supported()) {
+- bool rdseed_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDSEED);
+- if (rdseed_enabled)
+- exec_control &= ~SECONDARY_EXEC_RDSEED_EXITING;
+-
+- if (nested) {
+- if (rdseed_enabled)
+- vmx->nested.msrs.secondary_ctls_high |=
+- SECONDARY_EXEC_RDSEED_EXITING;
+- else
+- vmx->nested.msrs.secondary_ctls_high &=
+- ~SECONDARY_EXEC_RDSEED_EXITING;
+- }
+- }
+-
+- vmx->secondary_exec_control = exec_control;
+-}
+-
+-static void ept_set_mmio_spte_mask(void)
+-{
+- /*
+- * EPT Misconfigurations can be generated if the value of bits 2:0
+- * of an EPT paging-structure entry is 110b (write/execute).
+- */
+- kvm_mmu_set_mmio_spte_mask(VMX_EPT_RWX_MASK,
+- VMX_EPT_MISCONFIG_WX_VALUE);
+-}
+-
+-#define VMX_XSS_EXIT_BITMAP 0
+-/*
+- * Sets up the vmcs for emulated real mode.
+- */
+-static void vmx_vcpu_setup(struct vcpu_vmx *vmx)
+-{
+- int i;
+-
+- if (enable_shadow_vmcs) {
+- /*
+- * At vCPU creation, "VMWRITE to any supported field
+- * in the VMCS" is supported, so use the more
+- * permissive vmx_vmread_bitmap to specify both read
+- * and write permissions for the shadow VMCS.
+- */
+- vmcs_write64(VMREAD_BITMAP, __pa(vmx_vmread_bitmap));
+- vmcs_write64(VMWRITE_BITMAP, __pa(vmx_vmread_bitmap));
+- }
+- if (cpu_has_vmx_msr_bitmap())
+- vmcs_write64(MSR_BITMAP, __pa(vmx->vmcs01.msr_bitmap));
+-
+- vmcs_write64(VMCS_LINK_POINTER, -1ull); /* 22.3.1.5 */
+-
+- /* Control */
+- vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, vmx_pin_based_exec_ctrl(vmx));
+- vmx->hv_deadline_tsc = -1;
+-
+- vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, vmx_exec_control(vmx));
+-
+- if (cpu_has_secondary_exec_ctrls()) {
+- vmx_compute_secondary_exec_control(vmx);
+- vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
+- vmx->secondary_exec_control);
+- }
+-
+- if (kvm_vcpu_apicv_active(&vmx->vcpu)) {
+- vmcs_write64(EOI_EXIT_BITMAP0, 0);
+- vmcs_write64(EOI_EXIT_BITMAP1, 0);
+- vmcs_write64(EOI_EXIT_BITMAP2, 0);
+- vmcs_write64(EOI_EXIT_BITMAP3, 0);
+-
+- vmcs_write16(GUEST_INTR_STATUS, 0);
+-
+- vmcs_write16(POSTED_INTR_NV, POSTED_INTR_VECTOR);
+- vmcs_write64(POSTED_INTR_DESC_ADDR, __pa((&vmx->pi_desc)));
+- }
+-
+- if (!kvm_pause_in_guest(vmx->vcpu.kvm)) {
+- vmcs_write32(PLE_GAP, ple_gap);
+- vmx->ple_window = ple_window;
+- vmx->ple_window_dirty = true;
+- }
+-
+- vmcs_write32(PAGE_FAULT_ERROR_CODE_MASK, 0);
+- vmcs_write32(PAGE_FAULT_ERROR_CODE_MATCH, 0);
+- vmcs_write32(CR3_TARGET_COUNT, 0); /* 22.2.1 */
+-
+- vmcs_write16(HOST_FS_SELECTOR, 0); /* 22.2.4 */
+- vmcs_write16(HOST_GS_SELECTOR, 0); /* 22.2.4 */
+- vmx_set_constant_host_state(vmx);
+- vmcs_writel(HOST_FS_BASE, 0); /* 22.2.4 */
+- vmcs_writel(HOST_GS_BASE, 0); /* 22.2.4 */
+-
+- if (cpu_has_vmx_vmfunc())
+- vmcs_write64(VM_FUNCTION_CONTROL, 0);
+-
+- vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
+- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
+- vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host.val));
+- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
+- vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest.val));
+-
+- if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT)
+- vmcs_write64(GUEST_IA32_PAT, vmx->vcpu.arch.pat);
+-
+- for (i = 0; i < ARRAY_SIZE(vmx_msr_index); ++i) {
+- u32 index = vmx_msr_index[i];
+- u32 data_low, data_high;
+- int j = vmx->nmsrs;
+-
+- if (rdmsr_safe(index, &data_low, &data_high) < 0)
+- continue;
+- if (wrmsr_safe(index, data_low, data_high) < 0)
+- continue;
+- vmx->guest_msrs[j].index = i;
+- vmx->guest_msrs[j].data = 0;
+- vmx->guest_msrs[j].mask = -1ull;
+- ++vmx->nmsrs;
+- }
+-
+- vm_exit_controls_init(vmx, vmcs_config.vmexit_ctrl);
+-
+- /* 22.2.1, 20.8.1 */
+- vm_entry_controls_init(vmx, vmcs_config.vmentry_ctrl);
+-
+- vmx->vcpu.arch.cr0_guest_owned_bits = X86_CR0_TS;
+- vmcs_writel(CR0_GUEST_HOST_MASK, ~X86_CR0_TS);
+-
+- set_cr4_guest_host_mask(vmx);
+-
+- if (vmx_xsaves_supported())
+- vmcs_write64(XSS_EXIT_BITMAP, VMX_XSS_EXIT_BITMAP);
+-
+- if (enable_pml) {
+- ASSERT(vmx->pml_pg);
+- vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
+- vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
+- }
+-
+- if (cpu_has_vmx_encls_vmexit())
+- vmcs_write64(ENCLS_EXITING_BITMAP, -1ull);
+-}
+-
+-static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct msr_data apic_base_msr;
+- u64 cr0;
+-
+- vmx->rmode.vm86_active = 0;
+- vmx->spec_ctrl = 0;
+-
+- vcpu->arch.microcode_version = 0x100000000ULL;
+- vmx->vcpu.arch.regs[VCPU_REGS_RDX] = get_rdx_init_val();
+- kvm_set_cr8(vcpu, 0);
+-
+- if (!init_event) {
+- apic_base_msr.data = APIC_DEFAULT_PHYS_BASE |
+- MSR_IA32_APICBASE_ENABLE;
+- if (kvm_vcpu_is_reset_bsp(vcpu))
+- apic_base_msr.data |= MSR_IA32_APICBASE_BSP;
+- apic_base_msr.host_initiated = true;
+- kvm_set_apic_base(vcpu, &apic_base_msr);
+- }
+-
+- vmx_segment_cache_clear(vmx);
+-
+- seg_setup(VCPU_SREG_CS);
+- vmcs_write16(GUEST_CS_SELECTOR, 0xf000);
+- vmcs_writel(GUEST_CS_BASE, 0xffff0000ul);
+-
+- seg_setup(VCPU_SREG_DS);
+- seg_setup(VCPU_SREG_ES);
+- seg_setup(VCPU_SREG_FS);
+- seg_setup(VCPU_SREG_GS);
+- seg_setup(VCPU_SREG_SS);
+-
+- vmcs_write16(GUEST_TR_SELECTOR, 0);
+- vmcs_writel(GUEST_TR_BASE, 0);
+- vmcs_write32(GUEST_TR_LIMIT, 0xffff);
+- vmcs_write32(GUEST_TR_AR_BYTES, 0x008b);
+-
+- vmcs_write16(GUEST_LDTR_SELECTOR, 0);
+- vmcs_writel(GUEST_LDTR_BASE, 0);
+- vmcs_write32(GUEST_LDTR_LIMIT, 0xffff);
+- vmcs_write32(GUEST_LDTR_AR_BYTES, 0x00082);
+-
+- if (!init_event) {
+- vmcs_write32(GUEST_SYSENTER_CS, 0);
+- vmcs_writel(GUEST_SYSENTER_ESP, 0);
+- vmcs_writel(GUEST_SYSENTER_EIP, 0);
+- vmcs_write64(GUEST_IA32_DEBUGCTL, 0);
+- }
+-
+- kvm_set_rflags(vcpu, X86_EFLAGS_FIXED);
+- kvm_rip_write(vcpu, 0xfff0);
+-
+- vmcs_writel(GUEST_GDTR_BASE, 0);
+- vmcs_write32(GUEST_GDTR_LIMIT, 0xffff);
+-
+- vmcs_writel(GUEST_IDTR_BASE, 0);
+- vmcs_write32(GUEST_IDTR_LIMIT, 0xffff);
+-
+- vmcs_write32(GUEST_ACTIVITY_STATE, GUEST_ACTIVITY_ACTIVE);
+- vmcs_write32(GUEST_INTERRUPTIBILITY_INFO, 0);
+- vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS, 0);
+- if (kvm_mpx_supported())
+- vmcs_write64(GUEST_BNDCFGS, 0);
+-
+- setup_msrs(vmx);
+-
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0); /* 22.2.1 */
+-
+- if (cpu_has_vmx_tpr_shadow() && !init_event) {
+- vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, 0);
+- if (cpu_need_tpr_shadow(vcpu))
+- vmcs_write64(VIRTUAL_APIC_PAGE_ADDR,
+- __pa(vcpu->arch.apic->regs));
+- vmcs_write32(TPR_THRESHOLD, 0);
+- }
+-
+- kvm_make_request(KVM_REQ_APIC_PAGE_RELOAD, vcpu);
+-
+- if (vmx->vpid != 0)
+- vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
+-
+- cr0 = X86_CR0_NW | X86_CR0_CD | X86_CR0_ET;
+- vmx->vcpu.arch.cr0 = cr0;
+- vmx_set_cr0(vcpu, cr0); /* enter rmode */
+- vmx_set_cr4(vcpu, 0);
+- vmx_set_efer(vcpu, 0);
+-
+- update_exception_bitmap(vcpu);
+-
+- vpid_sync_context(vmx->vpid);
+- if (init_event)
+- vmx_clear_hlt(vcpu);
+-
+- vmx_update_fb_clear_dis(vcpu, vmx);
+-}
+-
+-/*
+- * In nested virtualization, check if L1 asked to exit on external interrupts.
+- * For most existing hypervisors, this will always return true.
+- */
+-static bool nested_exit_on_intr(struct kvm_vcpu *vcpu)
+-{
+- return get_vmcs12(vcpu)->pin_based_vm_exec_control &
+- PIN_BASED_EXT_INTR_MASK;
+-}
+-
+-/*
+- * In nested virtualization, check if L1 has set
+- * VM_EXIT_ACK_INTR_ON_EXIT
+- */
+-static bool nested_exit_intr_ack_set(struct kvm_vcpu *vcpu)
+-{
+- return get_vmcs12(vcpu)->vm_exit_controls &
+- VM_EXIT_ACK_INTR_ON_EXIT;
+-}
+-
+-static bool nested_exit_on_nmi(struct kvm_vcpu *vcpu)
+-{
+- return nested_cpu_has_nmi_exiting(get_vmcs12(vcpu));
+-}
+-
+-static void enable_irq_window(struct kvm_vcpu *vcpu)
+-{
+- vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL,
+- CPU_BASED_VIRTUAL_INTR_PENDING);
+-}
+-
+-static void enable_nmi_window(struct kvm_vcpu *vcpu)
+-{
+- if (!enable_vnmi ||
+- vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
+- enable_irq_window(vcpu);
+- return;
+- }
+-
+- vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL,
+- CPU_BASED_VIRTUAL_NMI_PENDING);
+-}
+-
+-static void vmx_inject_irq(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- uint32_t intr;
+- int irq = vcpu->arch.interrupt.nr;
+-
+- trace_kvm_inj_virq(irq);
+-
+- ++vcpu->stat.irq_injections;
+- if (vmx->rmode.vm86_active) {
+- int inc_eip = 0;
+- if (vcpu->arch.interrupt.soft)
+- inc_eip = vcpu->arch.event_exit_inst_len;
+- if (kvm_inject_realmode_interrupt(vcpu, irq, inc_eip) != EMULATE_DONE)
+- kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
+- return;
+- }
+- intr = irq | INTR_INFO_VALID_MASK;
+- if (vcpu->arch.interrupt.soft) {
+- intr |= INTR_TYPE_SOFT_INTR;
+- vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
+- vmx->vcpu.arch.event_exit_inst_len);
+- } else
+- intr |= INTR_TYPE_EXT_INTR;
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, intr);
+-
+- vmx_clear_hlt(vcpu);
+-}
+-
+-static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (!enable_vnmi) {
+- /*
+- * Tracking the NMI-blocked state in software is built upon
+- * finding the next open IRQ window. This, in turn, depends on
+- * well-behaving guests: They have to keep IRQs disabled at
+- * least as long as the NMI handler runs. Otherwise we may
+- * cause NMI nesting, maybe breaking the guest. But as this is
+- * highly unlikely, we can live with the residual risk.
+- */
+- vmx->loaded_vmcs->soft_vnmi_blocked = 1;
+- vmx->loaded_vmcs->vnmi_blocked_time = 0;
+- }
+-
+- ++vcpu->stat.nmi_injections;
+- vmx->loaded_vmcs->nmi_known_unmasked = false;
+-
+- if (vmx->rmode.vm86_active) {
+- if (kvm_inject_realmode_interrupt(vcpu, NMI_VECTOR, 0) != EMULATE_DONE)
+- kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
+- return;
+- }
+-
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD,
+- INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK | NMI_VECTOR);
+-
+- vmx_clear_hlt(vcpu);
+-}
+-
+-static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- bool masked;
+-
+- if (!enable_vnmi)
+- return vmx->loaded_vmcs->soft_vnmi_blocked;
+- if (vmx->loaded_vmcs->nmi_known_unmasked)
+- return false;
+- masked = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_NMI;
+- vmx->loaded_vmcs->nmi_known_unmasked = !masked;
+- return masked;
+-}
+-
+-static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (!enable_vnmi) {
+- if (vmx->loaded_vmcs->soft_vnmi_blocked != masked) {
+- vmx->loaded_vmcs->soft_vnmi_blocked = masked;
+- vmx->loaded_vmcs->vnmi_blocked_time = 0;
+- }
+- } else {
+- vmx->loaded_vmcs->nmi_known_unmasked = !masked;
+- if (masked)
+- vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+- GUEST_INTR_STATE_NMI);
+- else
+- vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
+- GUEST_INTR_STATE_NMI);
+- }
+-}
+-
+-static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
+-{
+- if (to_vmx(vcpu)->nested.nested_run_pending)
+- return 0;
+-
+- if (!enable_vnmi &&
+- to_vmx(vcpu)->loaded_vmcs->soft_vnmi_blocked)
+- return 0;
+-
+- return !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+- (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_STI
+- | GUEST_INTR_STATE_NMI));
+-}
+-
+-static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu)
+-{
+- if (to_vmx(vcpu)->nested.nested_run_pending)
+- return false;
+-
+- if (is_guest_mode(vcpu) && nested_exit_on_intr(vcpu))
+- return true;
+-
+- return (vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_IF) &&
+- !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
+- (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS));
+-}
+-
+-static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr)
+-{
+- int ret;
+-
+- if (enable_unrestricted_guest)
+- return 0;
+-
+- ret = x86_set_memory_region(kvm, TSS_PRIVATE_MEMSLOT, addr,
+- PAGE_SIZE * 3);
+- if (ret)
+- return ret;
+- to_kvm_vmx(kvm)->tss_addr = addr;
+- return init_rmode_tss(kvm);
+-}
+-
+-static int vmx_set_identity_map_addr(struct kvm *kvm, u64 ident_addr)
+-{
+- to_kvm_vmx(kvm)->ept_identity_map_addr = ident_addr;
+- return 0;
+-}
+-
+-static bool rmode_exception(struct kvm_vcpu *vcpu, int vec)
+-{
+- switch (vec) {
+- case BP_VECTOR:
+- /*
+- * Update instruction length as we may reinject the exception
+- * from user space while in guest debugging mode.
+- */
+- to_vmx(vcpu)->vcpu.arch.event_exit_inst_len =
+- vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
+- if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
+- return false;
+- /* fall through */
+- case DB_VECTOR:
+- if (vcpu->guest_debug &
+- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
+- return false;
+- /* fall through */
+- case DE_VECTOR:
+- case OF_VECTOR:
+- case BR_VECTOR:
+- case UD_VECTOR:
+- case DF_VECTOR:
+- case SS_VECTOR:
+- case GP_VECTOR:
+- case MF_VECTOR:
+- return true;
+- break;
+- }
+- return false;
+-}
+-
+-static int handle_rmode_exception(struct kvm_vcpu *vcpu,
+- int vec, u32 err_code)
+-{
+- /*
+- * Instruction with address size override prefix opcode 0x67
+- * Cause the #SS fault with 0 error code in VM86 mode.
+- */
+- if (((vec == GP_VECTOR) || (vec == SS_VECTOR)) && err_code == 0) {
+- if (kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE) {
+- if (vcpu->arch.halt_request) {
+- vcpu->arch.halt_request = 0;
+- return kvm_vcpu_halt(vcpu);
+- }
+- return 1;
+- }
+- return 0;
+- }
+-
+- /*
+- * Forward all other exceptions that are valid in real mode.
+- * FIXME: Breaks guest debugging in real mode, needs to be fixed with
+- * the required debugging infrastructure rework.
+- */
+- kvm_queue_exception(vcpu, vec);
+- return 1;
+-}
+-
+-/*
+- * Trigger machine check on the host. We assume all the MSRs are already set up
+- * by the CPU and that we still run on the same CPU as the MCE occurred on.
+- * We pass a fake environment to the machine check handler because we want
+- * the guest to be always treated like user space, no matter what context
+- * it used internally.
+- */
+-static void kvm_machine_check(void)
+-{
+-#if defined(CONFIG_X86_MCE)
+- struct pt_regs regs = {
+- .cs = 3, /* Fake ring 3 no matter what the guest ran on */
+- .flags = X86_EFLAGS_IF,
+- };
+-
+- do_machine_check(®s, 0);
+-#endif
+-}
+-
+-static int handle_machine_check(struct kvm_vcpu *vcpu)
+-{
+- /* already handled by vcpu_run */
+- return 1;
+-}
+-
+-static int handle_exception(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct kvm_run *kvm_run = vcpu->run;
+- u32 intr_info, ex_no, error_code;
+- unsigned long cr2, rip, dr6;
+- u32 vect_info;
+- enum emulation_result er;
+-
+- vect_info = vmx->idt_vectoring_info;
+- intr_info = vmx->exit_intr_info;
+-
+- if (is_machine_check(intr_info))
+- return handle_machine_check(vcpu);
+-
+- if (is_nmi(intr_info))
+- return 1; /* already handled by vmx_vcpu_run() */
+-
+- if (is_invalid_opcode(intr_info))
+- return handle_ud(vcpu);
+-
+- error_code = 0;
+- if (intr_info & INTR_INFO_DELIVER_CODE_MASK)
+- error_code = vmcs_read32(VM_EXIT_INTR_ERROR_CODE);
+-
+- if (!vmx->rmode.vm86_active && is_gp_fault(intr_info)) {
+- WARN_ON_ONCE(!enable_vmware_backdoor);
+- er = kvm_emulate_instruction(vcpu,
+- EMULTYPE_VMWARE | EMULTYPE_NO_UD_ON_FAIL);
+- if (er == EMULATE_USER_EXIT)
+- return 0;
+- else if (er != EMULATE_DONE)
+- kvm_queue_exception_e(vcpu, GP_VECTOR, error_code);
+- return 1;
+- }
+-
+- /*
+- * The #PF with PFEC.RSVD = 1 indicates the guest is accessing
+- * MMIO, it is better to report an internal error.
+- * See the comments in vmx_handle_exit.
+- */
+- if ((vect_info & VECTORING_INFO_VALID_MASK) &&
+- !(is_page_fault(intr_info) && !(error_code & PFERR_RSVD_MASK))) {
+- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+- vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_SIMUL_EX;
+- vcpu->run->internal.ndata = 3;
+- vcpu->run->internal.data[0] = vect_info;
+- vcpu->run->internal.data[1] = intr_info;
+- vcpu->run->internal.data[2] = error_code;
+- return 0;
+- }
+-
+- if (is_page_fault(intr_info)) {
+- cr2 = vmcs_readl(EXIT_QUALIFICATION);
+- /* EPT won't cause page fault directly */
+- WARN_ON_ONCE(!vcpu->arch.apf.host_apf_reason && enable_ept);
+- return kvm_handle_page_fault(vcpu, error_code, cr2, NULL, 0);
+- }
+-
+- ex_no = intr_info & INTR_INFO_VECTOR_MASK;
+-
+- if (vmx->rmode.vm86_active && rmode_exception(vcpu, ex_no))
+- return handle_rmode_exception(vcpu, ex_no, error_code);
+-
+- switch (ex_no) {
+- case AC_VECTOR:
+- kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
+- return 1;
+- case DB_VECTOR:
+- dr6 = vmcs_readl(EXIT_QUALIFICATION);
+- if (!(vcpu->guest_debug &
+- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))) {
+- vcpu->arch.dr6 &= ~15;
+- vcpu->arch.dr6 |= dr6 | DR6_RTM;
+- if (is_icebp(intr_info))
+- skip_emulated_instruction(vcpu);
+-
+- kvm_queue_exception(vcpu, DB_VECTOR);
+- return 1;
+- }
+- kvm_run->debug.arch.dr6 = dr6 | DR6_FIXED_1;
+- kvm_run->debug.arch.dr7 = vmcs_readl(GUEST_DR7);
+- /* fall through */
+- case BP_VECTOR:
+- /*
+- * Update instruction length as we may reinject #BP from
+- * user space while in guest debugging mode. Reading it for
+- * #DB as well causes no harm, it is not used in that case.
+- */
+- vmx->vcpu.arch.event_exit_inst_len =
+- vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
+- kvm_run->exit_reason = KVM_EXIT_DEBUG;
+- rip = kvm_rip_read(vcpu);
+- kvm_run->debug.arch.pc = vmcs_readl(GUEST_CS_BASE) + rip;
+- kvm_run->debug.arch.exception = ex_no;
+- break;
+- default:
+- kvm_run->exit_reason = KVM_EXIT_EXCEPTION;
+- kvm_run->ex.exception = ex_no;
+- kvm_run->ex.error_code = error_code;
+- break;
+- }
+- return 0;
+-}
+-
+-static int handle_external_interrupt(struct kvm_vcpu *vcpu)
+-{
+- ++vcpu->stat.irq_exits;
+- return 1;
+-}
+-
+-static int handle_triple_fault(struct kvm_vcpu *vcpu)
+-{
+- vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
+- vcpu->mmio_needed = 0;
+- return 0;
+-}
+-
+-static int handle_io(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification;
+- int size, in, string;
+- unsigned port;
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- string = (exit_qualification & 16) != 0;
+-
+- ++vcpu->stat.io_exits;
+-
+- if (string)
+- return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
+-
+- port = exit_qualification >> 16;
+- size = (exit_qualification & 7) + 1;
+- in = (exit_qualification & 8) != 0;
+-
+- return kvm_fast_pio(vcpu, size, port, in);
+-}
+-
+-static void
+-vmx_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
+-{
+- /*
+- * Patch in the VMCALL instruction:
+- */
+- hypercall[0] = 0x0f;
+- hypercall[1] = 0x01;
+- hypercall[2] = 0xc1;
+-}
+-
+-/* called to set cr0 as appropriate for a mov-to-cr0 exit. */
+-static int handle_set_cr0(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+- if (is_guest_mode(vcpu)) {
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- unsigned long orig_val = val;
+-
+- /*
+- * We get here when L2 changed cr0 in a way that did not change
+- * any of L1's shadowed bits (see nested_vmx_exit_handled_cr),
+- * but did change L0 shadowed bits. So we first calculate the
+- * effective cr0 value that L1 would like to write into the
+- * hardware. It consists of the L2-owned bits from the new
+- * value combined with the L1-owned bits from L1's guest_cr0.
+- */
+- val = (val & ~vmcs12->cr0_guest_host_mask) |
+- (vmcs12->guest_cr0 & vmcs12->cr0_guest_host_mask);
+-
+- if (!nested_guest_cr0_valid(vcpu, val))
+- return 1;
+-
+- if (kvm_set_cr0(vcpu, val))
+- return 1;
+- vmcs_writel(CR0_READ_SHADOW, orig_val);
+- return 0;
+- } else {
+- if (to_vmx(vcpu)->nested.vmxon &&
+- !nested_host_cr0_valid(vcpu, val))
+- return 1;
+-
+- return kvm_set_cr0(vcpu, val);
+- }
+-}
+-
+-static int handle_set_cr4(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+- if (is_guest_mode(vcpu)) {
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- unsigned long orig_val = val;
+-
+- /* analogously to handle_set_cr0 */
+- val = (val & ~vmcs12->cr4_guest_host_mask) |
+- (vmcs12->guest_cr4 & vmcs12->cr4_guest_host_mask);
+- if (kvm_set_cr4(vcpu, val))
+- return 1;
+- vmcs_writel(CR4_READ_SHADOW, orig_val);
+- return 0;
+- } else
+- return kvm_set_cr4(vcpu, val);
+-}
+-
+-static int handle_desc(struct kvm_vcpu *vcpu)
+-{
+- WARN_ON(!(vcpu->arch.cr4 & X86_CR4_UMIP));
+- return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
+-}
+-
+-static int handle_cr(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification, val;
+- int cr;
+- int reg;
+- int err;
+- int ret;
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- cr = exit_qualification & 15;
+- reg = (exit_qualification >> 8) & 15;
+- switch ((exit_qualification >> 4) & 3) {
+- case 0: /* mov to cr */
+- val = kvm_register_readl(vcpu, reg);
+- trace_kvm_cr_write(cr, val);
+- switch (cr) {
+- case 0:
+- err = handle_set_cr0(vcpu, val);
+- return kvm_complete_insn_gp(vcpu, err);
+- case 3:
+- WARN_ON_ONCE(enable_unrestricted_guest);
+- err = kvm_set_cr3(vcpu, val);
+- return kvm_complete_insn_gp(vcpu, err);
+- case 4:
+- err = handle_set_cr4(vcpu, val);
+- return kvm_complete_insn_gp(vcpu, err);
+- case 8: {
+- u8 cr8_prev = kvm_get_cr8(vcpu);
+- u8 cr8 = (u8)val;
+- err = kvm_set_cr8(vcpu, cr8);
+- ret = kvm_complete_insn_gp(vcpu, err);
+- if (lapic_in_kernel(vcpu))
+- return ret;
+- if (cr8_prev <= cr8)
+- return ret;
+- /*
+- * TODO: we might be squashing a
+- * KVM_GUESTDBG_SINGLESTEP-triggered
+- * KVM_EXIT_DEBUG here.
+- */
+- vcpu->run->exit_reason = KVM_EXIT_SET_TPR;
+- return 0;
+- }
+- }
+- break;
+- case 2: /* clts */
+- WARN_ONCE(1, "Guest should always own CR0.TS");
+- vmx_set_cr0(vcpu, kvm_read_cr0_bits(vcpu, ~X86_CR0_TS));
+- trace_kvm_cr_write(0, kvm_read_cr0(vcpu));
+- return kvm_skip_emulated_instruction(vcpu);
+- case 1: /*mov from cr*/
+- switch (cr) {
+- case 3:
+- WARN_ON_ONCE(enable_unrestricted_guest);
+- val = kvm_read_cr3(vcpu);
+- kvm_register_write(vcpu, reg, val);
+- trace_kvm_cr_read(cr, val);
+- return kvm_skip_emulated_instruction(vcpu);
+- case 8:
+- val = kvm_get_cr8(vcpu);
+- kvm_register_write(vcpu, reg, val);
+- trace_kvm_cr_read(cr, val);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- break;
+- case 3: /* lmsw */
+- val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f;
+- trace_kvm_cr_write(0, (kvm_read_cr0(vcpu) & ~0xful) | val);
+- kvm_lmsw(vcpu, val);
+-
+- return kvm_skip_emulated_instruction(vcpu);
+- default:
+- break;
+- }
+- vcpu->run->exit_reason = 0;
+- vcpu_unimpl(vcpu, "unhandled control register: op %d cr %d\n",
+- (int)(exit_qualification >> 4) & 3, cr);
+- return 0;
+-}
+-
+-static int handle_dr(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification;
+- int dr, dr7, reg;
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- dr = exit_qualification & DEBUG_REG_ACCESS_NUM;
+-
+- /* First, if DR does not exist, trigger UD */
+- if (!kvm_require_dr(vcpu, dr))
+- return 1;
+-
+- /* Do not handle if the CPL > 0, will trigger GP on re-entry */
+- if (!kvm_require_cpl(vcpu, 0))
+- return 1;
+- dr7 = vmcs_readl(GUEST_DR7);
+- if (dr7 & DR7_GD) {
+- /*
+- * As the vm-exit takes precedence over the debug trap, we
+- * need to emulate the latter, either for the host or the
+- * guest debugging itself.
+- */
+- if (vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) {
+- vcpu->run->debug.arch.dr6 = vcpu->arch.dr6;
+- vcpu->run->debug.arch.dr7 = dr7;
+- vcpu->run->debug.arch.pc = kvm_get_linear_rip(vcpu);
+- vcpu->run->debug.arch.exception = DB_VECTOR;
+- vcpu->run->exit_reason = KVM_EXIT_DEBUG;
+- return 0;
+- } else {
+- vcpu->arch.dr6 &= ~15;
+- vcpu->arch.dr6 |= DR6_BD | DR6_RTM;
+- kvm_queue_exception(vcpu, DB_VECTOR);
+- return 1;
+- }
+- }
+-
+- if (vcpu->guest_debug == 0) {
+- vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
+- CPU_BASED_MOV_DR_EXITING);
+-
+- /*
+- * No more DR vmexits; force a reload of the debug registers
+- * and reenter on this instruction. The next vmexit will
+- * retrieve the full state of the debug registers.
+- */
+- vcpu->arch.switch_db_regs |= KVM_DEBUGREG_WONT_EXIT;
+- return 1;
+- }
+-
+- reg = DEBUG_REG_ACCESS_REG(exit_qualification);
+- if (exit_qualification & TYPE_MOV_FROM_DR) {
+- unsigned long val;
+-
+- if (kvm_get_dr(vcpu, dr, &val))
+- return 1;
+- kvm_register_write(vcpu, reg, val);
+- } else
+- if (kvm_set_dr(vcpu, dr, kvm_register_readl(vcpu, reg)))
+- return 1;
+-
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static u64 vmx_get_dr6(struct kvm_vcpu *vcpu)
+-{
+- return vcpu->arch.dr6;
+-}
+-
+-static void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+-}
+-
+-static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)
+-{
+- get_debugreg(vcpu->arch.db[0], 0);
+- get_debugreg(vcpu->arch.db[1], 1);
+- get_debugreg(vcpu->arch.db[2], 2);
+- get_debugreg(vcpu->arch.db[3], 3);
+- get_debugreg(vcpu->arch.dr6, 6);
+- vcpu->arch.dr7 = vmcs_readl(GUEST_DR7);
+-
+- vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_WONT_EXIT;
+- vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL, CPU_BASED_MOV_DR_EXITING);
+-}
+-
+-static void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+- vmcs_writel(GUEST_DR7, val);
+-}
+-
+-static int handle_cpuid(struct kvm_vcpu *vcpu)
+-{
+- return kvm_emulate_cpuid(vcpu);
+-}
+-
+-static int handle_rdmsr(struct kvm_vcpu *vcpu)
+-{
+- u32 ecx = vcpu->arch.regs[VCPU_REGS_RCX];
+- struct msr_data msr_info;
+-
+- msr_info.index = ecx;
+- msr_info.host_initiated = false;
+- if (vmx_get_msr(vcpu, &msr_info)) {
+- trace_kvm_msr_read_ex(ecx);
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+-
+- trace_kvm_msr_read(ecx, msr_info.data);
+-
+- /* FIXME: handling of bits 32:63 of rax, rdx */
+- vcpu->arch.regs[VCPU_REGS_RAX] = msr_info.data & -1u;
+- vcpu->arch.regs[VCPU_REGS_RDX] = (msr_info.data >> 32) & -1u;
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static int handle_wrmsr(struct kvm_vcpu *vcpu)
+-{
+- struct msr_data msr;
+- u32 ecx = vcpu->arch.regs[VCPU_REGS_RCX];
+- u64 data = (vcpu->arch.regs[VCPU_REGS_RAX] & -1u)
+- | ((u64)(vcpu->arch.regs[VCPU_REGS_RDX] & -1u) << 32);
+-
+- msr.data = data;
+- msr.index = ecx;
+- msr.host_initiated = false;
+- if (kvm_set_msr(vcpu, &msr) != 0) {
+- trace_kvm_msr_write_ex(ecx, data);
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+-
+- trace_kvm_msr_write(ecx, data);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static int handle_tpr_below_threshold(struct kvm_vcpu *vcpu)
+-{
+- kvm_apic_update_ppr(vcpu);
+- return 1;
+-}
+-
+-static int handle_interrupt_window(struct kvm_vcpu *vcpu)
+-{
+- vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
+- CPU_BASED_VIRTUAL_INTR_PENDING);
+-
+- kvm_make_request(KVM_REQ_EVENT, vcpu);
+-
+- ++vcpu->stat.irq_window_exits;
+- return 1;
+-}
+-
+-static int handle_halt(struct kvm_vcpu *vcpu)
+-{
+- return kvm_emulate_halt(vcpu);
+-}
+-
+-static int handle_vmcall(struct kvm_vcpu *vcpu)
+-{
+- return kvm_emulate_hypercall(vcpu);
+-}
+-
+-static int handle_invd(struct kvm_vcpu *vcpu)
+-{
+- return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
+-}
+-
+-static int handle_invlpg(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+-
+- kvm_mmu_invlpg(vcpu, exit_qualification);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static int handle_rdpmc(struct kvm_vcpu *vcpu)
+-{
+- int err;
+-
+- err = kvm_rdpmc(vcpu);
+- return kvm_complete_insn_gp(vcpu, err);
+-}
+-
+-static int handle_wbinvd(struct kvm_vcpu *vcpu)
+-{
+- return kvm_emulate_wbinvd(vcpu);
+-}
+-
+-static int handle_xsetbv(struct kvm_vcpu *vcpu)
+-{
+- u64 new_bv = kvm_read_edx_eax(vcpu);
+- u32 index = kvm_register_read(vcpu, VCPU_REGS_RCX);
+-
+- if (kvm_set_xcr(vcpu, index, new_bv) == 0)
+- return kvm_skip_emulated_instruction(vcpu);
+- return 1;
+-}
+-
+-static int handle_xsaves(struct kvm_vcpu *vcpu)
+-{
+- kvm_skip_emulated_instruction(vcpu);
+- WARN(1, "this should never happen\n");
+- return 1;
+-}
+-
+-static int handle_xrstors(struct kvm_vcpu *vcpu)
+-{
+- kvm_skip_emulated_instruction(vcpu);
+- WARN(1, "this should never happen\n");
+- return 1;
+-}
+-
+-static int handle_apic_access(struct kvm_vcpu *vcpu)
+-{
+- if (likely(fasteoi)) {
+- unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- int access_type, offset;
+-
+- access_type = exit_qualification & APIC_ACCESS_TYPE;
+- offset = exit_qualification & APIC_ACCESS_OFFSET;
+- /*
+- * Sane guest uses MOV to write EOI, with written value
+- * not cared. So make a short-circuit here by avoiding
+- * heavy instruction emulation.
+- */
+- if ((access_type == TYPE_LINEAR_APIC_INST_WRITE) &&
+- (offset == APIC_EOI)) {
+- kvm_lapic_set_eoi(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- }
+- return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
+-}
+-
+-static int handle_apic_eoi_induced(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- int vector = exit_qualification & 0xff;
+-
+- /* EOI-induced VM exit is trap-like and thus no need to adjust IP */
+- kvm_apic_set_eoi_accelerated(vcpu, vector);
+- return 1;
+-}
+-
+-static int handle_apic_write(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- u32 offset = exit_qualification & 0xfff;
+-
+- /* APIC-write VM exit is trap-like and thus no need to adjust IP */
+- kvm_apic_write_nodecode(vcpu, offset);
+- return 1;
+-}
+-
+-static int handle_task_switch(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long exit_qualification;
+- bool has_error_code = false;
+- u32 error_code = 0;
+- u16 tss_selector;
+- int reason, type, idt_v, idt_index;
+-
+- idt_v = (vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK);
+- idt_index = (vmx->idt_vectoring_info & VECTORING_INFO_VECTOR_MASK);
+- type = (vmx->idt_vectoring_info & VECTORING_INFO_TYPE_MASK);
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+-
+- reason = (u32)exit_qualification >> 30;
+- if (reason == TASK_SWITCH_GATE && idt_v) {
+- switch (type) {
+- case INTR_TYPE_NMI_INTR:
+- vcpu->arch.nmi_injected = false;
+- vmx_set_nmi_mask(vcpu, true);
+- break;
+- case INTR_TYPE_EXT_INTR:
+- case INTR_TYPE_SOFT_INTR:
+- kvm_clear_interrupt_queue(vcpu);
+- break;
+- case INTR_TYPE_HARD_EXCEPTION:
+- if (vmx->idt_vectoring_info &
+- VECTORING_INFO_DELIVER_CODE_MASK) {
+- has_error_code = true;
+- error_code =
+- vmcs_read32(IDT_VECTORING_ERROR_CODE);
+- }
+- /* fall through */
+- case INTR_TYPE_SOFT_EXCEPTION:
+- kvm_clear_exception_queue(vcpu);
+- break;
+- default:
+- break;
+- }
+- }
+- tss_selector = exit_qualification;
+-
+- if (!idt_v || (type != INTR_TYPE_HARD_EXCEPTION &&
+- type != INTR_TYPE_EXT_INTR &&
+- type != INTR_TYPE_NMI_INTR))
+- skip_emulated_instruction(vcpu);
+-
+- if (kvm_task_switch(vcpu, tss_selector,
+- type == INTR_TYPE_SOFT_INTR ? idt_index : -1, reason,
+- has_error_code, error_code) == EMULATE_FAIL) {
+- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+- vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
+- vcpu->run->internal.ndata = 0;
+- return 0;
+- }
+-
+- /*
+- * TODO: What about debug traps on tss switch?
+- * Are we supposed to inject them and update dr6?
+- */
+-
+- return 1;
+-}
+-
+-static int handle_ept_violation(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification;
+- gpa_t gpa;
+- u64 error_code;
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+-
+- /*
+- * EPT violation happened while executing iret from NMI,
+- * "blocked by NMI" bit has to be set before next VM entry.
+- * There are errata that may cause this bit to not be set:
+- * AAK134, BY25.
+- */
+- if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
+- enable_vnmi &&
+- (exit_qualification & INTR_INFO_UNBLOCK_NMI))
+- vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
+-
+- gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
+- trace_kvm_page_fault(gpa, exit_qualification);
+-
+- /* Is it a read fault? */
+- error_code = (exit_qualification & EPT_VIOLATION_ACC_READ)
+- ? PFERR_USER_MASK : 0;
+- /* Is it a write fault? */
+- error_code |= (exit_qualification & EPT_VIOLATION_ACC_WRITE)
+- ? PFERR_WRITE_MASK : 0;
+- /* Is it a fetch fault? */
+- error_code |= (exit_qualification & EPT_VIOLATION_ACC_INSTR)
+- ? PFERR_FETCH_MASK : 0;
+- /* ept page table entry is present? */
+- error_code |= (exit_qualification &
+- (EPT_VIOLATION_READABLE | EPT_VIOLATION_WRITABLE |
+- EPT_VIOLATION_EXECUTABLE))
+- ? PFERR_PRESENT_MASK : 0;
+-
+- error_code |= (exit_qualification & 0x100) != 0 ?
+- PFERR_GUEST_FINAL_MASK : PFERR_GUEST_PAGE_MASK;
+-
+- vcpu->arch.exit_qualification = exit_qualification;
+- return kvm_mmu_page_fault(vcpu, gpa, error_code, NULL, 0);
+-}
+-
+-static int handle_ept_misconfig(struct kvm_vcpu *vcpu)
+-{
+- gpa_t gpa;
+-
+- /*
+- * A nested guest cannot optimize MMIO vmexits, because we have an
+- * nGPA here instead of the required GPA.
+- */
+- gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
+- if (!is_guest_mode(vcpu) &&
+- !kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, gpa, 0, NULL)) {
+- trace_kvm_fast_mmio(gpa);
+- /*
+- * Doing kvm_skip_emulated_instruction() depends on undefined
+- * behavior: Intel's manual doesn't mandate
+- * VM_EXIT_INSTRUCTION_LEN to be set in VMCS when EPT MISCONFIG
+- * occurs and while on real hardware it was observed to be set,
+- * other hypervisors (namely Hyper-V) don't set it, we end up
+- * advancing IP with some random value. Disable fast mmio when
+- * running nested and keep it for real hardware in hope that
+- * VM_EXIT_INSTRUCTION_LEN will always be set correctly.
+- */
+- if (!static_cpu_has(X86_FEATURE_HYPERVISOR))
+- return kvm_skip_emulated_instruction(vcpu);
+- else
+- return kvm_emulate_instruction(vcpu, EMULTYPE_SKIP) ==
+- EMULATE_DONE;
+- }
+-
+- return kvm_mmu_page_fault(vcpu, gpa, PFERR_RSVD_MASK, NULL, 0);
+-}
+-
+-static int handle_nmi_window(struct kvm_vcpu *vcpu)
+-{
+- WARN_ON_ONCE(!enable_vnmi);
+- vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
+- CPU_BASED_VIRTUAL_NMI_PENDING);
+- ++vcpu->stat.nmi_window_exits;
+- kvm_make_request(KVM_REQ_EVENT, vcpu);
+-
+- return 1;
+-}
+-
+-static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- enum emulation_result err = EMULATE_DONE;
+- int ret = 1;
+- u32 cpu_exec_ctrl;
+- bool intr_window_requested;
+- unsigned count = 130;
+-
+- /*
+- * We should never reach the point where we are emulating L2
+- * due to invalid guest state as that means we incorrectly
+- * allowed a nested VMEntry with an invalid vmcs12.
+- */
+- WARN_ON_ONCE(vmx->emulation_required && vmx->nested.nested_run_pending);
+-
+- cpu_exec_ctrl = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
+- intr_window_requested = cpu_exec_ctrl & CPU_BASED_VIRTUAL_INTR_PENDING;
+-
+- while (vmx->emulation_required && count-- != 0) {
+- if (intr_window_requested && vmx_interrupt_allowed(vcpu))
+- return handle_interrupt_window(&vmx->vcpu);
+-
+- if (kvm_test_request(KVM_REQ_EVENT, vcpu))
+- return 1;
+-
+- err = kvm_emulate_instruction(vcpu, 0);
+-
+- if (err == EMULATE_USER_EXIT) {
+- ++vcpu->stat.mmio_exits;
+- ret = 0;
+- goto out;
+- }
+-
+- if (err != EMULATE_DONE)
+- goto emulation_error;
+-
+- if (vmx->emulation_required && !vmx->rmode.vm86_active &&
+- vcpu->arch.exception.pending)
+- goto emulation_error;
+-
+- if (vcpu->arch.halt_request) {
+- vcpu->arch.halt_request = 0;
+- ret = kvm_vcpu_halt(vcpu);
+- goto out;
+- }
+-
+- if (signal_pending(current))
+- goto out;
+- if (need_resched())
+- schedule();
+- }
+-
+-out:
+- return ret;
+-
+-emulation_error:
+- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+- vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
+- vcpu->run->internal.ndata = 0;
+- return 0;
+-}
+-
+-static void grow_ple_window(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int old = vmx->ple_window;
+-
+- vmx->ple_window = __grow_ple_window(old, ple_window,
+- ple_window_grow,
+- ple_window_max);
+-
+- if (vmx->ple_window != old)
+- vmx->ple_window_dirty = true;
+-
+- trace_kvm_ple_window_grow(vcpu->vcpu_id, vmx->ple_window, old);
+-}
+-
+-static void shrink_ple_window(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int old = vmx->ple_window;
+-
+- vmx->ple_window = __shrink_ple_window(old, ple_window,
+- ple_window_shrink,
+- ple_window);
+-
+- if (vmx->ple_window != old)
+- vmx->ple_window_dirty = true;
+-
+- trace_kvm_ple_window_shrink(vcpu->vcpu_id, vmx->ple_window, old);
+-}
+-
+-/*
+- * Handler for POSTED_INTERRUPT_WAKEUP_VECTOR.
+- */
+-static void wakeup_handler(void)
+-{
+- struct kvm_vcpu *vcpu;
+- int cpu = smp_processor_id();
+-
+- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+- list_for_each_entry(vcpu, &per_cpu(blocked_vcpu_on_cpu, cpu),
+- blocked_vcpu_list) {
+- struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+-
+- if (pi_test_on(pi_desc) == 1)
+- kvm_vcpu_kick(vcpu);
+- }
+- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+-}
+-
+-static void vmx_enable_tdp(void)
+-{
+- kvm_mmu_set_mask_ptes(VMX_EPT_READABLE_MASK,
+- enable_ept_ad_bits ? VMX_EPT_ACCESS_BIT : 0ull,
+- enable_ept_ad_bits ? VMX_EPT_DIRTY_BIT : 0ull,
+- 0ull, VMX_EPT_EXECUTABLE_MASK,
+- cpu_has_vmx_ept_execute_only() ? 0ull : VMX_EPT_READABLE_MASK,
+- VMX_EPT_RWX_MASK, 0ull);
+-
+- ept_set_mmio_spte_mask();
+- kvm_enable_tdp();
+-}
+-
+-static __init int hardware_setup(void)
+-{
+- unsigned long host_bndcfgs;
+- int r = -ENOMEM, i;
+-
+- rdmsrl_safe(MSR_EFER, &host_efer);
+-
+- for (i = 0; i < ARRAY_SIZE(vmx_msr_index); ++i)
+- kvm_define_shared_msr(i, vmx_msr_index[i]);
+-
+- for (i = 0; i < VMX_BITMAP_NR; i++) {
+- vmx_bitmap[i] = (unsigned long *)__get_free_page(GFP_KERNEL);
+- if (!vmx_bitmap[i])
+- goto out;
+- }
+-
+- memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE);
+- memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE);
+-
+- if (setup_vmcs_config(&vmcs_config) < 0) {
+- r = -EIO;
+- goto out;
+- }
+-
+- if (boot_cpu_has(X86_FEATURE_NX))
+- kvm_enable_efer_bits(EFER_NX);
+-
+- if (boot_cpu_has(X86_FEATURE_MPX)) {
+- rdmsrl(MSR_IA32_BNDCFGS, host_bndcfgs);
+- WARN_ONCE(host_bndcfgs, "KVM: BNDCFGS in host will be lost");
+- }
+-
+- if (!cpu_has_vmx_vpid() || !cpu_has_vmx_invvpid() ||
+- !(cpu_has_vmx_invvpid_single() || cpu_has_vmx_invvpid_global()))
+- enable_vpid = 0;
+-
+- if (!cpu_has_vmx_ept() ||
+- !cpu_has_vmx_ept_4levels() ||
+- !cpu_has_vmx_ept_mt_wb() ||
+- !cpu_has_vmx_invept_global())
+- enable_ept = 0;
+-
+- if (!cpu_has_vmx_ept_ad_bits() || !enable_ept)
+- enable_ept_ad_bits = 0;
+-
+- if (!cpu_has_vmx_unrestricted_guest() || !enable_ept)
+- enable_unrestricted_guest = 0;
+-
+- if (!cpu_has_vmx_flexpriority())
+- flexpriority_enabled = 0;
+-
+- if (!cpu_has_virtual_nmis())
+- enable_vnmi = 0;
+-
+- /*
+- * set_apic_access_page_addr() is used to reload apic access
+- * page upon invalidation. No need to do anything if not
+- * using the APIC_ACCESS_ADDR VMCS field.
+- */
+- if (!flexpriority_enabled)
+- kvm_x86_ops->set_apic_access_page_addr = NULL;
+-
+- if (!cpu_has_vmx_tpr_shadow())
+- kvm_x86_ops->update_cr8_intercept = NULL;
+-
+- if (enable_ept && !cpu_has_vmx_ept_2m_page())
+- kvm_disable_largepages();
+-
+-#if IS_ENABLED(CONFIG_HYPERV)
+- if (ms_hyperv.nested_features & HV_X64_NESTED_GUEST_MAPPING_FLUSH
+- && enable_ept)
+- kvm_x86_ops->tlb_remote_flush = vmx_hv_remote_flush_tlb;
+-#endif
+-
+- if (!cpu_has_vmx_ple()) {
+- ple_gap = 0;
+- ple_window = 0;
+- ple_window_grow = 0;
+- ple_window_max = 0;
+- ple_window_shrink = 0;
+- }
+-
+- if (!cpu_has_vmx_apicv()) {
+- enable_apicv = 0;
+- kvm_x86_ops->sync_pir_to_irr = NULL;
+- }
+-
+- if (cpu_has_vmx_tsc_scaling()) {
+- kvm_has_tsc_control = true;
+- kvm_max_tsc_scaling_ratio = KVM_VMX_TSC_MULTIPLIER_MAX;
+- kvm_tsc_scaling_ratio_frac_bits = 48;
+- }
+-
+- set_bit(0, vmx_vpid_bitmap); /* 0 is reserved for host */
+-
+- if (enable_ept)
+- vmx_enable_tdp();
+- else
+- kvm_disable_tdp();
+-
+- if (!nested) {
+- kvm_x86_ops->get_nested_state = NULL;
+- kvm_x86_ops->set_nested_state = NULL;
+- }
+-
+- /*
+- * Only enable PML when hardware supports PML feature, and both EPT
+- * and EPT A/D bit features are enabled -- PML depends on them to work.
+- */
+- if (!enable_ept || !enable_ept_ad_bits || !cpu_has_vmx_pml())
+- enable_pml = 0;
+-
+- if (!enable_pml) {
+- kvm_x86_ops->slot_enable_log_dirty = NULL;
+- kvm_x86_ops->slot_disable_log_dirty = NULL;
+- kvm_x86_ops->flush_log_dirty = NULL;
+- kvm_x86_ops->enable_log_dirty_pt_masked = NULL;
+- }
+-
+- if (!cpu_has_vmx_preemption_timer())
+- kvm_x86_ops->request_immediate_exit = __kvm_request_immediate_exit;
+-
+- if (cpu_has_vmx_preemption_timer() && enable_preemption_timer) {
+- u64 vmx_msr;
+-
+- rdmsrl(MSR_IA32_VMX_MISC, vmx_msr);
+- cpu_preemption_timer_multi =
+- vmx_msr & VMX_MISC_PREEMPTION_TIMER_RATE_MASK;
+- } else {
+- kvm_x86_ops->set_hv_timer = NULL;
+- kvm_x86_ops->cancel_hv_timer = NULL;
+- }
+-
+- if (!cpu_has_vmx_shadow_vmcs())
+- enable_shadow_vmcs = 0;
+- if (enable_shadow_vmcs)
+- init_vmcs_shadow_fields();
+-
+- kvm_set_posted_intr_wakeup_handler(wakeup_handler);
+- nested_vmx_setup_ctls_msrs(&vmcs_config.nested, enable_apicv);
+-
+- kvm_mce_cap_supported |= MCG_LMCE_P;
+-
+- r = alloc_kvm_area();
+- if (r)
+- goto out;
+- return 0;
+-
+-out:
+- for (i = 0; i < VMX_BITMAP_NR; i++)
+- free_page((unsigned long)vmx_bitmap[i]);
+-
+- return r;
+-}
+-
+-static __exit void hardware_unsetup(void)
+-{
+- int i;
+-
+- for (i = 0; i < VMX_BITMAP_NR; i++)
+- free_page((unsigned long)vmx_bitmap[i]);
+-
+- free_kvm_area();
+-}
+-
+-/*
+- * Indicate a busy-waiting vcpu in spinlock. We do not enable the PAUSE
+- * exiting, so only get here on cpu with PAUSE-Loop-Exiting.
+- */
+-static int handle_pause(struct kvm_vcpu *vcpu)
+-{
+- if (!kvm_pause_in_guest(vcpu->kvm))
+- grow_ple_window(vcpu);
+-
+- /*
+- * Intel sdm vol3 ch-25.1.3 says: The "PAUSE-loop exiting"
+- * VM-execution control is ignored if CPL > 0. OTOH, KVM
+- * never set PAUSE_EXITING and just set PLE if supported,
+- * so the vcpu must be CPL=0 if it gets a PAUSE exit.
+- */
+- kvm_vcpu_on_spin(vcpu, true);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static int handle_nop(struct kvm_vcpu *vcpu)
+-{
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static int handle_mwait(struct kvm_vcpu *vcpu)
+-{
+- printk_once(KERN_WARNING "kvm: MWAIT instruction emulated as NOP!\n");
+- return handle_nop(vcpu);
+-}
+-
+-static int handle_invalid_op(struct kvm_vcpu *vcpu)
+-{
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+-}
+-
+-static int handle_monitor_trap(struct kvm_vcpu *vcpu)
+-{
+- return 1;
+-}
+-
+-static int handle_monitor(struct kvm_vcpu *vcpu)
+-{
+- printk_once(KERN_WARNING "kvm: MONITOR instruction emulated as NOP!\n");
+- return handle_nop(vcpu);
+-}
+-
+-/*
+- * The following 3 functions, nested_vmx_succeed()/failValid()/failInvalid(),
+- * set the success or error code of an emulated VMX instruction, as specified
+- * by Vol 2B, VMX Instruction Reference, "Conventions".
+- */
+-static void nested_vmx_succeed(struct kvm_vcpu *vcpu)
+-{
+- vmx_set_rflags(vcpu, vmx_get_rflags(vcpu)
+- & ~(X86_EFLAGS_CF | X86_EFLAGS_PF | X86_EFLAGS_AF |
+- X86_EFLAGS_ZF | X86_EFLAGS_SF | X86_EFLAGS_OF));
+-}
+-
+-static void nested_vmx_failInvalid(struct kvm_vcpu *vcpu)
+-{
+- vmx_set_rflags(vcpu, (vmx_get_rflags(vcpu)
+- & ~(X86_EFLAGS_PF | X86_EFLAGS_AF | X86_EFLAGS_ZF |
+- X86_EFLAGS_SF | X86_EFLAGS_OF))
+- | X86_EFLAGS_CF);
+-}
+-
+-static void nested_vmx_failValid(struct kvm_vcpu *vcpu,
+- u32 vm_instruction_error)
+-{
+- if (to_vmx(vcpu)->nested.current_vmptr == -1ull) {
+- /*
+- * failValid writes the error number to the current VMCS, which
+- * can't be done there isn't a current VMCS.
+- */
+- nested_vmx_failInvalid(vcpu);
+- return;
+- }
+- vmx_set_rflags(vcpu, (vmx_get_rflags(vcpu)
+- & ~(X86_EFLAGS_CF | X86_EFLAGS_PF | X86_EFLAGS_AF |
+- X86_EFLAGS_SF | X86_EFLAGS_OF))
+- | X86_EFLAGS_ZF);
+- get_vmcs12(vcpu)->vm_instruction_error = vm_instruction_error;
+- /*
+- * We don't need to force a shadow sync because
+- * VM_INSTRUCTION_ERROR is not shadowed
+- */
+-}
+-
+-static void nested_vmx_abort(struct kvm_vcpu *vcpu, u32 indicator)
+-{
+- /* TODO: not to reset guest simply here. */
+- kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
+- pr_debug_ratelimited("kvm: nested vmx abort, indicator %d\n", indicator);
+-}
+-
+-static enum hrtimer_restart vmx_preemption_timer_fn(struct hrtimer *timer)
+-{
+- struct vcpu_vmx *vmx =
+- container_of(timer, struct vcpu_vmx, nested.preemption_timer);
+-
+- vmx->nested.preemption_timer_expired = true;
+- kvm_make_request(KVM_REQ_EVENT, &vmx->vcpu);
+- kvm_vcpu_kick(&vmx->vcpu);
+-
+- return HRTIMER_NORESTART;
+-}
+-
+-/*
+- * Decode the memory-address operand of a vmx instruction, as recorded on an
+- * exit caused by such an instruction (run by a guest hypervisor).
+- * On success, returns 0. When the operand is invalid, returns 1 and throws
+- * #UD or #GP.
+- */
+-static int get_vmx_mem_address(struct kvm_vcpu *vcpu,
+- unsigned long exit_qualification,
+- u32 vmx_instruction_info, bool wr, gva_t *ret)
+-{
+- gva_t off;
+- bool exn;
+- struct kvm_segment s;
+-
+- /*
+- * According to Vol. 3B, "Information for VM Exits Due to Instruction
+- * Execution", on an exit, vmx_instruction_info holds most of the
+- * addressing components of the operand. Only the displacement part
+- * is put in exit_qualification (see 3B, "Basic VM-Exit Information").
+- * For how an actual address is calculated from all these components,
+- * refer to Vol. 1, "Operand Addressing".
+- */
+- int scaling = vmx_instruction_info & 3;
+- int addr_size = (vmx_instruction_info >> 7) & 7;
+- bool is_reg = vmx_instruction_info & (1u << 10);
+- int seg_reg = (vmx_instruction_info >> 15) & 7;
+- int index_reg = (vmx_instruction_info >> 18) & 0xf;
+- bool index_is_valid = !(vmx_instruction_info & (1u << 22));
+- int base_reg = (vmx_instruction_info >> 23) & 0xf;
+- bool base_is_valid = !(vmx_instruction_info & (1u << 27));
+-
+- if (is_reg) {
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+- }
+-
+- /* Addr = segment_base + offset */
+- /* offset = base + [index * scale] + displacement */
+- off = exit_qualification; /* holds the displacement */
+- if (addr_size == 1)
+- off = (gva_t)sign_extend64(off, 31);
+- else if (addr_size == 0)
+- off = (gva_t)sign_extend64(off, 15);
+- if (base_is_valid)
+- off += kvm_register_read(vcpu, base_reg);
+- if (index_is_valid)
+- off += kvm_register_read(vcpu, index_reg)<<scaling;
+- vmx_get_segment(vcpu, &s, seg_reg);
+-
+- /*
+- * The effective address, i.e. @off, of a memory operand is truncated
+- * based on the address size of the instruction. Note that this is
+- * the *effective address*, i.e. the address prior to accounting for
+- * the segment's base.
+- */
+- if (addr_size == 1) /* 32 bit */
+- off &= 0xffffffff;
+- else if (addr_size == 0) /* 16 bit */
+- off &= 0xffff;
+-
+- /* Checks for #GP/#SS exceptions. */
+- exn = false;
+- if (is_long_mode(vcpu)) {
+- /*
+- * The virtual/linear address is never truncated in 64-bit
+- * mode, e.g. a 32-bit address size can yield a 64-bit virtual
+- * address when using FS/GS with a non-zero base.
+- */
+- *ret = s.base + off;
+-
+- /* Long mode: #GP(0)/#SS(0) if the memory address is in a
+- * non-canonical form. This is the only check on the memory
+- * destination for long mode!
+- */
+- exn = is_noncanonical_address(*ret, vcpu);
+- } else if (is_protmode(vcpu)) {
+- /*
+- * When not in long mode, the virtual/linear address is
+- * unconditionally truncated to 32 bits regardless of the
+- * address size.
+- */
+- *ret = (s.base + off) & 0xffffffff;
+-
+- /* Protected mode: apply checks for segment validity in the
+- * following order:
+- * - segment type check (#GP(0) may be thrown)
+- * - usability check (#GP(0)/#SS(0))
+- * - limit check (#GP(0)/#SS(0))
+- */
+- if (wr)
+- /* #GP(0) if the destination operand is located in a
+- * read-only data segment or any code segment.
+- */
+- exn = ((s.type & 0xa) == 0 || (s.type & 8));
+- else
+- /* #GP(0) if the source operand is located in an
+- * execute-only code segment
+- */
+- exn = ((s.type & 0xa) == 8);
+- if (exn) {
+- kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
+- return 1;
+- }
+- /* Protected mode: #GP(0)/#SS(0) if the segment is unusable.
+- */
+- exn = (s.unusable != 0);
+-
+- /*
+- * Protected mode: #GP(0)/#SS(0) if the memory operand is
+- * outside the segment limit. All CPUs that support VMX ignore
+- * limit checks for flat segments, i.e. segments with base==0,
+- * limit==0xffffffff and of type expand-up data or code.
+- */
+- if (!(s.base == 0 && s.limit == 0xffffffff &&
+- ((s.type & 8) || !(s.type & 4))))
+- exn = exn || (off + sizeof(u64) > s.limit);
+- }
+- if (exn) {
+- kvm_queue_exception_e(vcpu,
+- seg_reg == VCPU_SREG_SS ?
+- SS_VECTOR : GP_VECTOR,
+- 0);
+- return 1;
+- }
+-
+- return 0;
+-}
+-
+-static int nested_vmx_get_vmptr(struct kvm_vcpu *vcpu, gpa_t *vmpointer)
+-{
+- gva_t gva;
+- struct x86_exception e;
+-
+- if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
+- vmcs_read32(VMX_INSTRUCTION_INFO), false, &gva))
+- return 1;
+-
+- if (kvm_read_guest_virt(vcpu, gva, vmpointer, sizeof(*vmpointer), &e)) {
+- kvm_inject_page_fault(vcpu, &e);
+- return 1;
+- }
+-
+- return 0;
+-}
+-
+-/*
+- * Allocate a shadow VMCS and associate it with the currently loaded
+- * VMCS, unless such a shadow VMCS already exists. The newly allocated
+- * VMCS is also VMCLEARed, so that it is ready for use.
+- */
+-static struct vmcs *alloc_shadow_vmcs(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct loaded_vmcs *loaded_vmcs = vmx->loaded_vmcs;
+-
+- /*
+- * We should allocate a shadow vmcs for vmcs01 only when L1
+- * executes VMXON and free it when L1 executes VMXOFF.
+- * As it is invalid to execute VMXON twice, we shouldn't reach
+- * here when vmcs01 already have an allocated shadow vmcs.
+- */
+- WARN_ON(loaded_vmcs == &vmx->vmcs01 && loaded_vmcs->shadow_vmcs);
+-
+- if (!loaded_vmcs->shadow_vmcs) {
+- loaded_vmcs->shadow_vmcs = alloc_vmcs(true);
+- if (loaded_vmcs->shadow_vmcs)
+- vmcs_clear(loaded_vmcs->shadow_vmcs);
+- }
+- return loaded_vmcs->shadow_vmcs;
+-}
+-
+-static int enter_vmx_operation(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int r;
+-
+- r = alloc_loaded_vmcs(&vmx->nested.vmcs02);
+- if (r < 0)
+- goto out_vmcs02;
+-
+- vmx->nested.cached_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
+- if (!vmx->nested.cached_vmcs12)
+- goto out_cached_vmcs12;
+-
+- vmx->nested.cached_shadow_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
+- if (!vmx->nested.cached_shadow_vmcs12)
+- goto out_cached_shadow_vmcs12;
+-
+- if (enable_shadow_vmcs && !alloc_shadow_vmcs(vcpu))
+- goto out_shadow_vmcs;
+-
+- hrtimer_init(&vmx->nested.preemption_timer, CLOCK_MONOTONIC,
+- HRTIMER_MODE_REL_PINNED);
+- vmx->nested.preemption_timer.function = vmx_preemption_timer_fn;
+-
+- vmx->nested.vpid02 = allocate_vpid();
+-
+- vmx->nested.vmxon = true;
+- return 0;
+-
+-out_shadow_vmcs:
+- kfree(vmx->nested.cached_shadow_vmcs12);
+-
+-out_cached_shadow_vmcs12:
+- kfree(vmx->nested.cached_vmcs12);
+-
+-out_cached_vmcs12:
+- free_loaded_vmcs(&vmx->nested.vmcs02);
+-
+-out_vmcs02:
+- return -ENOMEM;
+-}
+-
+-/*
+- * Emulate the VMXON instruction.
+- * Currently, we just remember that VMX is active, and do not save or even
+- * inspect the argument to VMXON (the so-called "VMXON pointer") because we
+- * do not currently need to store anything in that guest-allocated memory
+- * region. Consequently, VMCLEAR and VMPTRLD also do not verify that the their
+- * argument is different from the VMXON pointer (which the spec says they do).
+- */
+-static int handle_vmon(struct kvm_vcpu *vcpu)
+-{
+- int ret;
+- gpa_t vmptr;
+- struct page *page;
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- const u64 VMXON_NEEDED_FEATURES = FEATURE_CONTROL_LOCKED
+- | FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
+-
+- /*
+- * The Intel VMX Instruction Reference lists a bunch of bits that are
+- * prerequisite to running VMXON, most notably cr4.VMXE must be set to
+- * 1 (see vmx_set_cr4() for when we allow the guest to set this).
+- * Otherwise, we should fail with #UD. But most faulting conditions
+- * have already been checked by hardware, prior to the VM-exit for
+- * VMXON. We do test guest cr4.VMXE because processor CR4 always has
+- * that bit set to 1 in non-root mode.
+- */
+- if (!kvm_read_cr4_bits(vcpu, X86_CR4_VMXE)) {
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+- }
+-
+- /* CPL=0 must be checked manually. */
+- if (vmx_get_cpl(vcpu)) {
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+-
+- if (vmx->nested.vmxon) {
+- nested_vmx_failValid(vcpu, VMXERR_VMXON_IN_VMX_ROOT_OPERATION);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- if ((vmx->msr_ia32_feature_control & VMXON_NEEDED_FEATURES)
+- != VMXON_NEEDED_FEATURES) {
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+-
+- if (nested_vmx_get_vmptr(vcpu, &vmptr))
+- return 1;
+-
+- /*
+- * SDM 3: 24.11.5
+- * The first 4 bytes of VMXON region contain the supported
+- * VMCS revision identifier
+- *
+- * Note - IA32_VMX_BASIC[48] will never be 1 for the nested case;
+- * which replaces physical address width with 32
+- */
+- if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
+- nested_vmx_failInvalid(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- page = kvm_vcpu_gpa_to_page(vcpu, vmptr);
+- if (is_error_page(page)) {
+- nested_vmx_failInvalid(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- if (*(u32 *)kmap(page) != VMCS12_REVISION) {
+- kunmap(page);
+- kvm_release_page_clean(page);
+- nested_vmx_failInvalid(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- kunmap(page);
+- kvm_release_page_clean(page);
+-
+- vmx->nested.vmxon_ptr = vmptr;
+- ret = enter_vmx_operation(vcpu);
+- if (ret)
+- return ret;
+-
+- nested_vmx_succeed(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-/*
+- * Intel's VMX Instruction Reference specifies a common set of prerequisites
+- * for running VMX instructions (except VMXON, whose prerequisites are
+- * slightly different). It also specifies what exception to inject otherwise.
+- * Note that many of these exceptions have priority over VM exits, so they
+- * don't have to be checked again here.
+- */
+-static int nested_vmx_check_permission(struct kvm_vcpu *vcpu)
+-{
+- if (!to_vmx(vcpu)->nested.vmxon) {
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 0;
+- }
+-
+- if (vmx_get_cpl(vcpu)) {
+- kvm_inject_gp(vcpu, 0);
+- return 0;
+- }
+-
+- return 1;
+-}
+-
+-static void vmx_disable_shadow_vmcs(struct vcpu_vmx *vmx)
+-{
+- vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL, SECONDARY_EXEC_SHADOW_VMCS);
+- vmcs_write64(VMCS_LINK_POINTER, -1ull);
+- vmx->nested.sync_shadow_vmcs = false;
+-}
+-
+-static inline void nested_release_vmcs12(struct vcpu_vmx *vmx)
+-{
+- if (vmx->nested.current_vmptr == -1ull)
+- return;
+-
+- if (enable_shadow_vmcs) {
+- /* copy to memory all shadowed fields in case
+- they were modified */
+- copy_shadow_to_vmcs12(vmx);
+- vmx_disable_shadow_vmcs(vmx);
+- }
+- vmx->nested.posted_intr_nv = -1;
+-
+- /* Flush VMCS12 to guest memory */
+- kvm_vcpu_write_guest_page(&vmx->vcpu,
+- vmx->nested.current_vmptr >> PAGE_SHIFT,
+- vmx->nested.cached_vmcs12, 0, VMCS12_SIZE);
+-
+- vmx->nested.current_vmptr = -1ull;
+-}
+-
+-/*
+- * Free whatever needs to be freed from vmx->nested when L1 goes down, or
+- * just stops using VMX.
+- */
+-static void free_nested(struct vcpu_vmx *vmx)
+-{
+- if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
+- return;
+-
+- kvm_clear_request(KVM_REQ_GET_VMCS12_PAGES, &vmx->vcpu);
+-
+- hrtimer_cancel(&vmx->nested.preemption_timer);
+- vmx->nested.vmxon = false;
+- vmx->nested.smm.vmxon = false;
+- free_vpid(vmx->nested.vpid02);
+- vmx->nested.posted_intr_nv = -1;
+- vmx->nested.current_vmptr = -1ull;
+- if (enable_shadow_vmcs) {
+- vmx_disable_shadow_vmcs(vmx);
+- vmcs_clear(vmx->vmcs01.shadow_vmcs);
+- free_vmcs(vmx->vmcs01.shadow_vmcs);
+- vmx->vmcs01.shadow_vmcs = NULL;
+- }
+- kfree(vmx->nested.cached_vmcs12);
+- kfree(vmx->nested.cached_shadow_vmcs12);
+- /* Unpin physical memory we referred to in the vmcs02 */
+- if (vmx->nested.apic_access_page) {
+- kvm_release_page_dirty(vmx->nested.apic_access_page);
+- vmx->nested.apic_access_page = NULL;
+- }
+- if (vmx->nested.virtual_apic_page) {
+- kvm_release_page_dirty(vmx->nested.virtual_apic_page);
+- vmx->nested.virtual_apic_page = NULL;
+- }
+- if (vmx->nested.pi_desc_page) {
+- kunmap(vmx->nested.pi_desc_page);
+- kvm_release_page_dirty(vmx->nested.pi_desc_page);
+- vmx->nested.pi_desc_page = NULL;
+- vmx->nested.pi_desc = NULL;
+- }
+-
+- free_loaded_vmcs(&vmx->nested.vmcs02);
+-}
+-
+-/* Emulate the VMXOFF instruction */
+-static int handle_vmoff(struct kvm_vcpu *vcpu)
+-{
+- if (!nested_vmx_check_permission(vcpu))
+- return 1;
+- free_nested(to_vmx(vcpu));
+- nested_vmx_succeed(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-/* Emulate the VMCLEAR instruction */
+-static int handle_vmclear(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 zero = 0;
+- gpa_t vmptr;
+-
+- if (!nested_vmx_check_permission(vcpu))
+- return 1;
+-
+- if (nested_vmx_get_vmptr(vcpu, &vmptr))
+- return 1;
+-
+- if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
+- nested_vmx_failValid(vcpu, VMXERR_VMCLEAR_INVALID_ADDRESS);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- if (vmptr == vmx->nested.vmxon_ptr) {
+- nested_vmx_failValid(vcpu, VMXERR_VMCLEAR_VMXON_POINTER);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- if (vmptr == vmx->nested.current_vmptr)
+- nested_release_vmcs12(vmx);
+-
+- kvm_vcpu_write_guest(vcpu,
+- vmptr + offsetof(struct vmcs12, launch_state),
+- &zero, sizeof(zero));
+-
+- nested_vmx_succeed(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch);
+-
+-/* Emulate the VMLAUNCH instruction */
+-static int handle_vmlaunch(struct kvm_vcpu *vcpu)
+-{
+- return nested_vmx_run(vcpu, true);
+-}
+-
+-/* Emulate the VMRESUME instruction */
+-static int handle_vmresume(struct kvm_vcpu *vcpu)
+-{
+-
+- return nested_vmx_run(vcpu, false);
+-}
+-
+-/*
+- * Read a vmcs12 field. Since these can have varying lengths and we return
+- * one type, we chose the biggest type (u64) and zero-extend the return value
+- * to that size. Note that the caller, handle_vmread, might need to use only
+- * some of the bits we return here (e.g., on 32-bit guests, only 32 bits of
+- * 64-bit fields are to be returned).
+- */
+-static inline int vmcs12_read_any(struct vmcs12 *vmcs12,
+- unsigned long field, u64 *ret)
+-{
+- short offset = vmcs_field_to_offset(field);
+- char *p;
+-
+- if (offset < 0)
+- return offset;
+-
+- p = (char *)vmcs12 + offset;
+-
+- switch (vmcs_field_width(field)) {
+- case VMCS_FIELD_WIDTH_NATURAL_WIDTH:
+- *ret = *((natural_width *)p);
+- return 0;
+- case VMCS_FIELD_WIDTH_U16:
+- *ret = *((u16 *)p);
+- return 0;
+- case VMCS_FIELD_WIDTH_U32:
+- *ret = *((u32 *)p);
+- return 0;
+- case VMCS_FIELD_WIDTH_U64:
+- *ret = *((u64 *)p);
+- return 0;
+- default:
+- WARN_ON(1);
+- return -ENOENT;
+- }
+-}
+-
+-
+-static inline int vmcs12_write_any(struct vmcs12 *vmcs12,
+- unsigned long field, u64 field_value){
+- short offset = vmcs_field_to_offset(field);
+- char *p = (char *)vmcs12 + offset;
+- if (offset < 0)
+- return offset;
+-
+- switch (vmcs_field_width(field)) {
+- case VMCS_FIELD_WIDTH_U16:
+- *(u16 *)p = field_value;
+- return 0;
+- case VMCS_FIELD_WIDTH_U32:
+- *(u32 *)p = field_value;
+- return 0;
+- case VMCS_FIELD_WIDTH_U64:
+- *(u64 *)p = field_value;
+- return 0;
+- case VMCS_FIELD_WIDTH_NATURAL_WIDTH:
+- *(natural_width *)p = field_value;
+- return 0;
+- default:
+- WARN_ON(1);
+- return -ENOENT;
+- }
+-
+-}
+-
+-/*
+- * Copy the writable VMCS shadow fields back to the VMCS12, in case
+- * they have been modified by the L1 guest. Note that the "read-only"
+- * VM-exit information fields are actually writable if the vCPU is
+- * configured to support "VMWRITE to any supported field in the VMCS."
+- */
+-static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
+-{
+- const u16 *fields[] = {
+- shadow_read_write_fields,
+- shadow_read_only_fields
+- };
+- const int max_fields[] = {
+- max_shadow_read_write_fields,
+- max_shadow_read_only_fields
+- };
+- int i, q;
+- unsigned long field;
+- u64 field_value;
+- struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
+-
+- if (WARN_ON(!shadow_vmcs))
+- return;
+-
+- preempt_disable();
+-
+- vmcs_load(shadow_vmcs);
+-
+- for (q = 0; q < ARRAY_SIZE(fields); q++) {
+- for (i = 0; i < max_fields[q]; i++) {
+- field = fields[q][i];
+- field_value = __vmcs_readl(field);
+- vmcs12_write_any(get_vmcs12(&vmx->vcpu), field, field_value);
+- }
+- /*
+- * Skip the VM-exit information fields if they are read-only.
+- */
+- if (!nested_cpu_has_vmwrite_any_field(&vmx->vcpu))
+- break;
+- }
+-
+- vmcs_clear(shadow_vmcs);
+- vmcs_load(vmx->loaded_vmcs->vmcs);
+-
+- preempt_enable();
+-}
+-
+-static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
+-{
+- const u16 *fields[] = {
+- shadow_read_write_fields,
+- shadow_read_only_fields
+- };
+- const int max_fields[] = {
+- max_shadow_read_write_fields,
+- max_shadow_read_only_fields
+- };
+- int i, q;
+- unsigned long field;
+- u64 field_value = 0;
+- struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
+-
+- if (WARN_ON(!shadow_vmcs))
+- return;
+-
+- vmcs_load(shadow_vmcs);
+-
+- for (q = 0; q < ARRAY_SIZE(fields); q++) {
+- for (i = 0; i < max_fields[q]; i++) {
+- field = fields[q][i];
+- vmcs12_read_any(get_vmcs12(&vmx->vcpu), field, &field_value);
+- __vmcs_writel(field, field_value);
+- }
+- }
+-
+- vmcs_clear(shadow_vmcs);
+- vmcs_load(vmx->loaded_vmcs->vmcs);
+-}
+-
+-/*
+- * VMX instructions which assume a current vmcs12 (i.e., that VMPTRLD was
+- * used before) all generate the same failure when it is missing.
+- */
+-static int nested_vmx_check_vmcs12(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- if (vmx->nested.current_vmptr == -1ull) {
+- nested_vmx_failInvalid(vcpu);
+- return 0;
+- }
+- return 1;
+-}
+-
+-static int handle_vmread(struct kvm_vcpu *vcpu)
+-{
+- unsigned long field;
+- u64 field_value;
+- unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- u32 vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+- gva_t gva = 0;
+- struct vmcs12 *vmcs12;
+- struct x86_exception e;
+-
+- if (!nested_vmx_check_permission(vcpu))
+- return 1;
+-
+- if (!nested_vmx_check_vmcs12(vcpu))
+- return kvm_skip_emulated_instruction(vcpu);
+-
+- if (!is_guest_mode(vcpu))
+- vmcs12 = get_vmcs12(vcpu);
+- else {
+- /*
+- * When vmcs->vmcs_link_pointer is -1ull, any VMREAD
+- * to shadowed-field sets the ALU flags for VMfailInvalid.
+- */
+- if (get_vmcs12(vcpu)->vmcs_link_pointer == -1ull) {
+- nested_vmx_failInvalid(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- vmcs12 = get_shadow_vmcs12(vcpu);
+- }
+-
+- /* Decode instruction info and find the field to read */
+- field = kvm_register_readl(vcpu, (((vmx_instruction_info) >> 28) & 0xf));
+- /* Read the field, zero-extended to a u64 field_value */
+- if (vmcs12_read_any(vmcs12, field, &field_value) < 0) {
+- nested_vmx_failValid(vcpu, VMXERR_UNSUPPORTED_VMCS_COMPONENT);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- /*
+- * Now copy part of this value to register or memory, as requested.
+- * Note that the number of bits actually copied is 32 or 64 depending
+- * on the guest's mode (32 or 64 bit), not on the given field's length.
+- */
+- if (vmx_instruction_info & (1u << 10)) {
+- kvm_register_writel(vcpu, (((vmx_instruction_info) >> 3) & 0xf),
+- field_value);
+- } else {
+- if (get_vmx_mem_address(vcpu, exit_qualification,
+- vmx_instruction_info, true, &gva))
+- return 1;
+- /* _system ok, nested_vmx_check_permission has verified cpl=0 */
+- if (kvm_write_guest_virt_system(vcpu, gva, &field_value,
+- (is_long_mode(vcpu) ? 8 : 4),
+- &e)) {
+- kvm_inject_page_fault(vcpu, &e);
+- return 1;
+- }
+- }
+-
+- nested_vmx_succeed(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-
+-static int handle_vmwrite(struct kvm_vcpu *vcpu)
+-{
+- unsigned long field;
+- gva_t gva;
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- u32 vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+-
+- /* The value to write might be 32 or 64 bits, depending on L1's long
+- * mode, and eventually we need to write that into a field of several
+- * possible lengths. The code below first zero-extends the value to 64
+- * bit (field_value), and then copies only the appropriate number of
+- * bits into the vmcs12 field.
+- */
+- u64 field_value = 0;
+- struct x86_exception e;
+- struct vmcs12 *vmcs12;
+-
+- if (!nested_vmx_check_permission(vcpu))
+- return 1;
+-
+- if (!nested_vmx_check_vmcs12(vcpu))
+- return kvm_skip_emulated_instruction(vcpu);
+-
+- if (vmx_instruction_info & (1u << 10))
+- field_value = kvm_register_readl(vcpu,
+- (((vmx_instruction_info) >> 3) & 0xf));
+- else {
+- if (get_vmx_mem_address(vcpu, exit_qualification,
+- vmx_instruction_info, false, &gva))
+- return 1;
+- if (kvm_read_guest_virt(vcpu, gva, &field_value,
+- (is_64_bit_mode(vcpu) ? 8 : 4), &e)) {
+- kvm_inject_page_fault(vcpu, &e);
+- return 1;
+- }
+- }
+-
+-
+- field = kvm_register_readl(vcpu, (((vmx_instruction_info) >> 28) & 0xf));
+- /*
+- * If the vCPU supports "VMWRITE to any supported field in the
+- * VMCS," then the "read-only" fields are actually read/write.
+- */
+- if (vmcs_field_readonly(field) &&
+- !nested_cpu_has_vmwrite_any_field(vcpu)) {
+- nested_vmx_failValid(vcpu,
+- VMXERR_VMWRITE_READ_ONLY_VMCS_COMPONENT);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- if (!is_guest_mode(vcpu))
+- vmcs12 = get_vmcs12(vcpu);
+- else {
+- /*
+- * When vmcs->vmcs_link_pointer is -1ull, any VMWRITE
+- * to shadowed-field sets the ALU flags for VMfailInvalid.
+- */
+- if (get_vmcs12(vcpu)->vmcs_link_pointer == -1ull) {
+- nested_vmx_failInvalid(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- vmcs12 = get_shadow_vmcs12(vcpu);
+-
+- }
+-
+- if (vmcs12_write_any(vmcs12, field, field_value) < 0) {
+- nested_vmx_failValid(vcpu, VMXERR_UNSUPPORTED_VMCS_COMPONENT);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- /*
+- * Do not track vmcs12 dirty-state if in guest-mode
+- * as we actually dirty shadow vmcs12 instead of vmcs12.
+- */
+- if (!is_guest_mode(vcpu)) {
+- switch (field) {
+-#define SHADOW_FIELD_RW(x) case x:
+-#include "vmx_shadow_fields.h"
+- /*
+- * The fields that can be updated by L1 without a vmexit are
+- * always updated in the vmcs02, the others go down the slow
+- * path of prepare_vmcs02.
+- */
+- break;
+- default:
+- vmx->nested.dirty_vmcs12 = true;
+- break;
+- }
+- }
+-
+- nested_vmx_succeed(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static void set_current_vmptr(struct vcpu_vmx *vmx, gpa_t vmptr)
+-{
+- vmx->nested.current_vmptr = vmptr;
+- if (enable_shadow_vmcs) {
+- vmcs_set_bits(SECONDARY_VM_EXEC_CONTROL,
+- SECONDARY_EXEC_SHADOW_VMCS);
+- vmcs_write64(VMCS_LINK_POINTER,
+- __pa(vmx->vmcs01.shadow_vmcs));
+- vmx->nested.sync_shadow_vmcs = true;
+- }
+- vmx->nested.dirty_vmcs12 = true;
+-}
+-
+-/* Emulate the VMPTRLD instruction */
+-static int handle_vmptrld(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- gpa_t vmptr;
+-
+- if (!nested_vmx_check_permission(vcpu))
+- return 1;
+-
+- if (nested_vmx_get_vmptr(vcpu, &vmptr))
+- return 1;
+-
+- if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
+- nested_vmx_failValid(vcpu, VMXERR_VMPTRLD_INVALID_ADDRESS);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- if (vmptr == vmx->nested.vmxon_ptr) {
+- nested_vmx_failValid(vcpu, VMXERR_VMPTRLD_VMXON_POINTER);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- if (vmx->nested.current_vmptr != vmptr) {
+- struct vmcs12 *new_vmcs12;
+- struct page *page;
+- page = kvm_vcpu_gpa_to_page(vcpu, vmptr);
+- if (is_error_page(page)) {
+- nested_vmx_failInvalid(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- new_vmcs12 = kmap(page);
+- if (new_vmcs12->hdr.revision_id != VMCS12_REVISION ||
+- (new_vmcs12->hdr.shadow_vmcs &&
+- !nested_cpu_has_vmx_shadow_vmcs(vcpu))) {
+- kunmap(page);
+- kvm_release_page_clean(page);
+- nested_vmx_failValid(vcpu,
+- VMXERR_VMPTRLD_INCORRECT_VMCS_REVISION_ID);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- nested_release_vmcs12(vmx);
+- /*
+- * Load VMCS12 from guest memory since it is not already
+- * cached.
+- */
+- memcpy(vmx->nested.cached_vmcs12, new_vmcs12, VMCS12_SIZE);
+- kunmap(page);
+- kvm_release_page_clean(page);
+-
+- set_current_vmptr(vmx, vmptr);
+- }
+-
+- nested_vmx_succeed(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-/* Emulate the VMPTRST instruction */
+-static int handle_vmptrst(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qual = vmcs_readl(EXIT_QUALIFICATION);
+- u32 instr_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+- gpa_t current_vmptr = to_vmx(vcpu)->nested.current_vmptr;
+- struct x86_exception e;
+- gva_t gva;
+-
+- if (!nested_vmx_check_permission(vcpu))
+- return 1;
+-
+- if (get_vmx_mem_address(vcpu, exit_qual, instr_info, true, &gva))
+- return 1;
+- /* *_system ok, nested_vmx_check_permission has verified cpl=0 */
+- if (kvm_write_guest_virt_system(vcpu, gva, (void *)¤t_vmptr,
+- sizeof(gpa_t), &e)) {
+- kvm_inject_page_fault(vcpu, &e);
+- return 1;
+- }
+- nested_vmx_succeed(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-/* Emulate the INVEPT instruction */
+-static int handle_invept(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 vmx_instruction_info, types;
+- unsigned long type;
+- gva_t gva;
+- struct x86_exception e;
+- struct {
+- u64 eptp, gpa;
+- } operand;
+-
+- if (!(vmx->nested.msrs.secondary_ctls_high &
+- SECONDARY_EXEC_ENABLE_EPT) ||
+- !(vmx->nested.msrs.ept_caps & VMX_EPT_INVEPT_BIT)) {
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+- }
+-
+- if (!nested_vmx_check_permission(vcpu))
+- return 1;
+-
+- vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+- type = kvm_register_readl(vcpu, (vmx_instruction_info >> 28) & 0xf);
+-
+- types = (vmx->nested.msrs.ept_caps >> VMX_EPT_EXTENT_SHIFT) & 6;
+-
+- if (type >= 32 || !(types & (1 << type))) {
+- nested_vmx_failValid(vcpu,
+- VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- /* According to the Intel VMX instruction reference, the memory
+- * operand is read even if it isn't needed (e.g., for type==global)
+- */
+- if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
+- vmx_instruction_info, false, &gva))
+- return 1;
+- if (kvm_read_guest_virt(vcpu, gva, &operand, sizeof(operand), &e)) {
+- kvm_inject_page_fault(vcpu, &e);
+- return 1;
+- }
+-
+- switch (type) {
+- case VMX_EPT_EXTENT_GLOBAL:
+- /*
+- * TODO: track mappings and invalidate
+- * single context requests appropriately
+- */
+- case VMX_EPT_EXTENT_CONTEXT:
+- kvm_mmu_sync_roots(vcpu);
+- kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
+- nested_vmx_succeed(vcpu);
+- break;
+- default:
+- BUG_ON(1);
+- break;
+- }
+-
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static int handle_invvpid(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 vmx_instruction_info;
+- unsigned long type, types;
+- gva_t gva;
+- struct x86_exception e;
+- struct {
+- u64 vpid;
+- u64 gla;
+- } operand;
+-
+- if (!(vmx->nested.msrs.secondary_ctls_high &
+- SECONDARY_EXEC_ENABLE_VPID) ||
+- !(vmx->nested.msrs.vpid_caps & VMX_VPID_INVVPID_BIT)) {
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+- }
+-
+- if (!nested_vmx_check_permission(vcpu))
+- return 1;
+-
+- vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+- type = kvm_register_readl(vcpu, (vmx_instruction_info >> 28) & 0xf);
+-
+- types = (vmx->nested.msrs.vpid_caps &
+- VMX_VPID_EXTENT_SUPPORTED_MASK) >> 8;
+-
+- if (type >= 32 || !(types & (1 << type))) {
+- nested_vmx_failValid(vcpu,
+- VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- /* according to the intel vmx instruction reference, the memory
+- * operand is read even if it isn't needed (e.g., for type==global)
+- */
+- if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
+- vmx_instruction_info, false, &gva))
+- return 1;
+- if (kvm_read_guest_virt(vcpu, gva, &operand, sizeof(operand), &e)) {
+- kvm_inject_page_fault(vcpu, &e);
+- return 1;
+- }
+- if (operand.vpid >> 16) {
+- nested_vmx_failValid(vcpu,
+- VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- switch (type) {
+- case VMX_VPID_EXTENT_INDIVIDUAL_ADDR:
+- if (!operand.vpid ||
+- is_noncanonical_address(operand.gla, vcpu)) {
+- nested_vmx_failValid(vcpu,
+- VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- if (cpu_has_vmx_invvpid_individual_addr() &&
+- vmx->nested.vpid02) {
+- __invvpid(VMX_VPID_EXTENT_INDIVIDUAL_ADDR,
+- vmx->nested.vpid02, operand.gla);
+- } else
+- __vmx_flush_tlb(vcpu, vmx->nested.vpid02, true);
+- break;
+- case VMX_VPID_EXTENT_SINGLE_CONTEXT:
+- case VMX_VPID_EXTENT_SINGLE_NON_GLOBAL:
+- if (!operand.vpid) {
+- nested_vmx_failValid(vcpu,
+- VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+- __vmx_flush_tlb(vcpu, vmx->nested.vpid02, true);
+- break;
+- case VMX_VPID_EXTENT_ALL_CONTEXT:
+- __vmx_flush_tlb(vcpu, vmx->nested.vpid02, true);
+- break;
+- default:
+- WARN_ON_ONCE(1);
+- return kvm_skip_emulated_instruction(vcpu);
+- }
+-
+- nested_vmx_succeed(vcpu);
+-
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-static int handle_invpcid(struct kvm_vcpu *vcpu)
+-{
+- u32 vmx_instruction_info;
+- unsigned long type;
+- bool pcid_enabled;
+- gva_t gva;
+- struct x86_exception e;
+- unsigned i;
+- unsigned long roots_to_free = 0;
+- struct {
+- u64 pcid;
+- u64 gla;
+- } operand;
+-
+- if (!guest_cpuid_has(vcpu, X86_FEATURE_INVPCID)) {
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+- }
+-
+- vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+- type = kvm_register_readl(vcpu, (vmx_instruction_info >> 28) & 0xf);
+-
+- if (type > 3) {
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+-
+- /* According to the Intel instruction reference, the memory operand
+- * is read even if it isn't needed (e.g., for type==all)
+- */
+- if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
+- vmx_instruction_info, false, &gva))
+- return 1;
+-
+- if (kvm_read_guest_virt(vcpu, gva, &operand, sizeof(operand), &e)) {
+- kvm_inject_page_fault(vcpu, &e);
+- return 1;
+- }
+-
+- if (operand.pcid >> 12 != 0) {
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+-
+- pcid_enabled = kvm_read_cr4_bits(vcpu, X86_CR4_PCIDE);
+-
+- switch (type) {
+- case INVPCID_TYPE_INDIV_ADDR:
+- if ((!pcid_enabled && (operand.pcid != 0)) ||
+- is_noncanonical_address(operand.gla, vcpu)) {
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+- kvm_mmu_invpcid_gva(vcpu, operand.gla, operand.pcid);
+- return kvm_skip_emulated_instruction(vcpu);
+-
+- case INVPCID_TYPE_SINGLE_CTXT:
+- if (!pcid_enabled && (operand.pcid != 0)) {
+- kvm_inject_gp(vcpu, 0);
+- return 1;
+- }
+-
+- if (kvm_get_active_pcid(vcpu) == operand.pcid) {
+- kvm_mmu_sync_roots(vcpu);
+- kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
+- }
+-
+- for (i = 0; i < KVM_MMU_NUM_PREV_ROOTS; i++)
+- if (kvm_get_pcid(vcpu, vcpu->arch.mmu.prev_roots[i].cr3)
+- == operand.pcid)
+- roots_to_free |= KVM_MMU_ROOT_PREVIOUS(i);
+-
+- kvm_mmu_free_roots(vcpu, roots_to_free);
+- /*
+- * If neither the current cr3 nor any of the prev_roots use the
+- * given PCID, then nothing needs to be done here because a
+- * resync will happen anyway before switching to any other CR3.
+- */
+-
+- return kvm_skip_emulated_instruction(vcpu);
+-
+- case INVPCID_TYPE_ALL_NON_GLOBAL:
+- /*
+- * Currently, KVM doesn't mark global entries in the shadow
+- * page tables, so a non-global flush just degenerates to a
+- * global flush. If needed, we could optimize this later by
+- * keeping track of global entries in shadow page tables.
+- */
+-
+- /* fall-through */
+- case INVPCID_TYPE_ALL_INCL_GLOBAL:
+- kvm_mmu_unload(vcpu);
+- return kvm_skip_emulated_instruction(vcpu);
+-
+- default:
+- BUG(); /* We have already checked above that type <= 3 */
+- }
+-}
+-
+-static int handle_pml_full(struct kvm_vcpu *vcpu)
+-{
+- unsigned long exit_qualification;
+-
+- trace_kvm_pml_full(vcpu->vcpu_id);
+-
+- exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+-
+- /*
+- * PML buffer FULL happened while executing iret from NMI,
+- * "blocked by NMI" bit has to be set before next VM entry.
+- */
+- if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
+- enable_vnmi &&
+- (exit_qualification & INTR_INFO_UNBLOCK_NMI))
+- vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+- GUEST_INTR_STATE_NMI);
+-
+- /*
+- * PML buffer already flushed at beginning of VMEXIT. Nothing to do
+- * here.., and there's no userspace involvement needed for PML.
+- */
+- return 1;
+-}
+-
+-static int handle_preemption_timer(struct kvm_vcpu *vcpu)
+-{
+- if (!to_vmx(vcpu)->req_immediate_exit)
+- kvm_lapic_expired_hv_timer(vcpu);
+- return 1;
+-}
+-
+-static bool valid_ept_address(struct kvm_vcpu *vcpu, u64 address)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int maxphyaddr = cpuid_maxphyaddr(vcpu);
+-
+- /* Check for memory type validity */
+- switch (address & VMX_EPTP_MT_MASK) {
+- case VMX_EPTP_MT_UC:
+- if (!(vmx->nested.msrs.ept_caps & VMX_EPTP_UC_BIT))
+- return false;
+- break;
+- case VMX_EPTP_MT_WB:
+- if (!(vmx->nested.msrs.ept_caps & VMX_EPTP_WB_BIT))
+- return false;
+- break;
+- default:
+- return false;
+- }
+-
+- /* only 4 levels page-walk length are valid */
+- if ((address & VMX_EPTP_PWL_MASK) != VMX_EPTP_PWL_4)
+- return false;
+-
+- /* Reserved bits should not be set */
+- if (address >> maxphyaddr || ((address >> 7) & 0x1f))
+- return false;
+-
+- /* AD, if set, should be supported */
+- if (address & VMX_EPTP_AD_ENABLE_BIT) {
+- if (!(vmx->nested.msrs.ept_caps & VMX_EPT_AD_BIT))
+- return false;
+- }
+-
+- return true;
+-}
+-
+-static int nested_vmx_eptp_switching(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- u32 index = vcpu->arch.regs[VCPU_REGS_RCX];
+- u64 address;
+- bool accessed_dirty;
+- struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
+-
+- if (!nested_cpu_has_eptp_switching(vmcs12) ||
+- !nested_cpu_has_ept(vmcs12))
+- return 1;
+-
+- if (index >= VMFUNC_EPTP_ENTRIES)
+- return 1;
+-
+-
+- if (kvm_vcpu_read_guest_page(vcpu, vmcs12->eptp_list_address >> PAGE_SHIFT,
+- &address, index * 8, 8))
+- return 1;
+-
+- accessed_dirty = !!(address & VMX_EPTP_AD_ENABLE_BIT);
+-
+- /*
+- * If the (L2) guest does a vmfunc to the currently
+- * active ept pointer, we don't have to do anything else
+- */
+- if (vmcs12->ept_pointer != address) {
+- if (!valid_ept_address(vcpu, address))
+- return 1;
+-
+- kvm_mmu_unload(vcpu);
+- mmu->ept_ad = accessed_dirty;
+- mmu->base_role.ad_disabled = !accessed_dirty;
+- vmcs12->ept_pointer = address;
+- /*
+- * TODO: Check what's the correct approach in case
+- * mmu reload fails. Currently, we just let the next
+- * reload potentially fail
+- */
+- kvm_mmu_reload(vcpu);
+- }
+-
+- return 0;
+-}
+-
+-static int handle_vmfunc(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct vmcs12 *vmcs12;
+- u32 function = vcpu->arch.regs[VCPU_REGS_RAX];
+-
+- /*
+- * VMFUNC is only supported for nested guests, but we always enable the
+- * secondary control for simplicity; for non-nested mode, fake that we
+- * didn't by injecting #UD.
+- */
+- if (!is_guest_mode(vcpu)) {
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+- }
+-
+- vmcs12 = get_vmcs12(vcpu);
+- if ((vmcs12->vm_function_control & (1 << function)) == 0)
+- goto fail;
+-
+- switch (function) {
+- case 0:
+- if (nested_vmx_eptp_switching(vcpu, vmcs12))
+- goto fail;
+- break;
+- default:
+- goto fail;
+- }
+- return kvm_skip_emulated_instruction(vcpu);
+-
+-fail:
+- nested_vmx_vmexit(vcpu, vmx->exit_reason,
+- vmcs_read32(VM_EXIT_INTR_INFO),
+- vmcs_readl(EXIT_QUALIFICATION));
+- return 1;
+-}
+-
+-static int handle_encls(struct kvm_vcpu *vcpu)
+-{
+- /*
+- * SGX virtualization is not yet supported. There is no software
+- * enable bit for SGX, so we have to trap ENCLS and inject a #UD
+- * to prevent the guest from executing ENCLS.
+- */
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+-}
+-
+-/*
+- * The exit handlers return 1 if the exit was handled fully and guest execution
+- * may resume. Otherwise they set the kvm_run parameter to indicate what needs
+- * to be done to userspace and return 0.
+- */
+-static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
+- [EXIT_REASON_EXCEPTION_NMI] = handle_exception,
+- [EXIT_REASON_EXTERNAL_INTERRUPT] = handle_external_interrupt,
+- [EXIT_REASON_TRIPLE_FAULT] = handle_triple_fault,
+- [EXIT_REASON_NMI_WINDOW] = handle_nmi_window,
+- [EXIT_REASON_IO_INSTRUCTION] = handle_io,
+- [EXIT_REASON_CR_ACCESS] = handle_cr,
+- [EXIT_REASON_DR_ACCESS] = handle_dr,
+- [EXIT_REASON_CPUID] = handle_cpuid,
+- [EXIT_REASON_MSR_READ] = handle_rdmsr,
+- [EXIT_REASON_MSR_WRITE] = handle_wrmsr,
+- [EXIT_REASON_PENDING_INTERRUPT] = handle_interrupt_window,
+- [EXIT_REASON_HLT] = handle_halt,
+- [EXIT_REASON_INVD] = handle_invd,
+- [EXIT_REASON_INVLPG] = handle_invlpg,
+- [EXIT_REASON_RDPMC] = handle_rdpmc,
+- [EXIT_REASON_VMCALL] = handle_vmcall,
+- [EXIT_REASON_VMCLEAR] = handle_vmclear,
+- [EXIT_REASON_VMLAUNCH] = handle_vmlaunch,
+- [EXIT_REASON_VMPTRLD] = handle_vmptrld,
+- [EXIT_REASON_VMPTRST] = handle_vmptrst,
+- [EXIT_REASON_VMREAD] = handle_vmread,
+- [EXIT_REASON_VMRESUME] = handle_vmresume,
+- [EXIT_REASON_VMWRITE] = handle_vmwrite,
+- [EXIT_REASON_VMOFF] = handle_vmoff,
+- [EXIT_REASON_VMON] = handle_vmon,
+- [EXIT_REASON_TPR_BELOW_THRESHOLD] = handle_tpr_below_threshold,
+- [EXIT_REASON_APIC_ACCESS] = handle_apic_access,
+- [EXIT_REASON_APIC_WRITE] = handle_apic_write,
+- [EXIT_REASON_EOI_INDUCED] = handle_apic_eoi_induced,
+- [EXIT_REASON_WBINVD] = handle_wbinvd,
+- [EXIT_REASON_XSETBV] = handle_xsetbv,
+- [EXIT_REASON_TASK_SWITCH] = handle_task_switch,
+- [EXIT_REASON_MCE_DURING_VMENTRY] = handle_machine_check,
+- [EXIT_REASON_GDTR_IDTR] = handle_desc,
+- [EXIT_REASON_LDTR_TR] = handle_desc,
+- [EXIT_REASON_EPT_VIOLATION] = handle_ept_violation,
+- [EXIT_REASON_EPT_MISCONFIG] = handle_ept_misconfig,
+- [EXIT_REASON_PAUSE_INSTRUCTION] = handle_pause,
+- [EXIT_REASON_MWAIT_INSTRUCTION] = handle_mwait,
+- [EXIT_REASON_MONITOR_TRAP_FLAG] = handle_monitor_trap,
+- [EXIT_REASON_MONITOR_INSTRUCTION] = handle_monitor,
+- [EXIT_REASON_INVEPT] = handle_invept,
+- [EXIT_REASON_INVVPID] = handle_invvpid,
+- [EXIT_REASON_RDRAND] = handle_invalid_op,
+- [EXIT_REASON_RDSEED] = handle_invalid_op,
+- [EXIT_REASON_XSAVES] = handle_xsaves,
+- [EXIT_REASON_XRSTORS] = handle_xrstors,
+- [EXIT_REASON_PML_FULL] = handle_pml_full,
+- [EXIT_REASON_INVPCID] = handle_invpcid,
+- [EXIT_REASON_VMFUNC] = handle_vmfunc,
+- [EXIT_REASON_PREEMPTION_TIMER] = handle_preemption_timer,
+- [EXIT_REASON_ENCLS] = handle_encls,
+-};
+-
+-static const int kvm_vmx_max_exit_handlers =
+- ARRAY_SIZE(kvm_vmx_exit_handlers);
+-
+-/*
+- * Return true if an IO instruction with the specified port and size should cause
+- * a VM-exit into L1.
+- */
+-bool nested_vmx_check_io_bitmaps(struct kvm_vcpu *vcpu, unsigned int port,
+- int size)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- gpa_t bitmap, last_bitmap;
+- u8 b;
+-
+- last_bitmap = (gpa_t)-1;
+- b = -1;
+-
+- while (size > 0) {
+- if (port < 0x8000)
+- bitmap = vmcs12->io_bitmap_a;
+- else if (port < 0x10000)
+- bitmap = vmcs12->io_bitmap_b;
+- else
+- return true;
+- bitmap += (port & 0x7fff) / 8;
+-
+- if (last_bitmap != bitmap)
+- if (kvm_vcpu_read_guest(vcpu, bitmap, &b, 1))
+- return true;
+- if (b & (1 << (port & 7)))
+- return true;
+-
+- port++;
+- size--;
+- last_bitmap = bitmap;
+- }
+-
+- return false;
+-}
+-
+-/*
+- * Return 1 if we should exit from L2 to L1 to handle an MSR access access,
+- * rather than handle it ourselves in L0. I.e., check whether L1 expressed
+- * disinterest in the current event (read or write a specific MSR) by using an
+- * MSR bitmap. This may be the case even when L0 doesn't use MSR bitmaps.
+- */
+-static bool nested_vmx_exit_handled_msr(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12, u32 exit_reason)
+-{
+- u32 msr_index = vcpu->arch.regs[VCPU_REGS_RCX];
+- gpa_t bitmap;
+-
+- if (!nested_cpu_has(vmcs12, CPU_BASED_USE_MSR_BITMAPS))
+- return true;
+-
+- /*
+- * The MSR_BITMAP page is divided into four 1024-byte bitmaps,
+- * for the four combinations of read/write and low/high MSR numbers.
+- * First we need to figure out which of the four to use:
+- */
+- bitmap = vmcs12->msr_bitmap;
+- if (exit_reason == EXIT_REASON_MSR_WRITE)
+- bitmap += 2048;
+- if (msr_index >= 0xc0000000) {
+- msr_index -= 0xc0000000;
+- bitmap += 1024;
+- }
+-
+- /* Then read the msr_index'th bit from this bitmap: */
+- if (msr_index < 1024*8) {
+- unsigned char b;
+- if (kvm_vcpu_read_guest(vcpu, bitmap + msr_index/8, &b, 1))
+- return true;
+- return 1 & (b >> (msr_index & 7));
+- } else
+- return true; /* let L1 handle the wrong parameter */
+-}
+-
+-/*
+- * Return 1 if we should exit from L2 to L1 to handle a CR access exit,
+- * rather than handle it ourselves in L0. I.e., check if L1 wanted to
+- * intercept (via guest_host_mask etc.) the current event.
+- */
+-static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+- int cr = exit_qualification & 15;
+- int reg;
+- unsigned long val;
+-
+- switch ((exit_qualification >> 4) & 3) {
+- case 0: /* mov to cr */
+- reg = (exit_qualification >> 8) & 15;
+- val = kvm_register_readl(vcpu, reg);
+- switch (cr) {
+- case 0:
+- if (vmcs12->cr0_guest_host_mask &
+- (val ^ vmcs12->cr0_read_shadow))
+- return true;
+- break;
+- case 3:
+- if ((vmcs12->cr3_target_count >= 1 &&
+- vmcs12->cr3_target_value0 == val) ||
+- (vmcs12->cr3_target_count >= 2 &&
+- vmcs12->cr3_target_value1 == val) ||
+- (vmcs12->cr3_target_count >= 3 &&
+- vmcs12->cr3_target_value2 == val) ||
+- (vmcs12->cr3_target_count >= 4 &&
+- vmcs12->cr3_target_value3 == val))
+- return false;
+- if (nested_cpu_has(vmcs12, CPU_BASED_CR3_LOAD_EXITING))
+- return true;
+- break;
+- case 4:
+- if (vmcs12->cr4_guest_host_mask &
+- (vmcs12->cr4_read_shadow ^ val))
+- return true;
+- break;
+- case 8:
+- if (nested_cpu_has(vmcs12, CPU_BASED_CR8_LOAD_EXITING))
+- return true;
+- break;
+- }
+- break;
+- case 2: /* clts */
+- if ((vmcs12->cr0_guest_host_mask & X86_CR0_TS) &&
+- (vmcs12->cr0_read_shadow & X86_CR0_TS))
+- return true;
+- break;
+- case 1: /* mov from cr */
+- switch (cr) {
+- case 3:
+- if (vmcs12->cpu_based_vm_exec_control &
+- CPU_BASED_CR3_STORE_EXITING)
+- return true;
+- break;
+- case 8:
+- if (vmcs12->cpu_based_vm_exec_control &
+- CPU_BASED_CR8_STORE_EXITING)
+- return true;
+- break;
+- }
+- break;
+- case 3: /* lmsw */
+- /*
+- * lmsw can change bits 1..3 of cr0, and only set bit 0 of
+- * cr0. Other attempted changes are ignored, with no exit.
+- */
+- val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f;
+- if (vmcs12->cr0_guest_host_mask & 0xe &
+- (val ^ vmcs12->cr0_read_shadow))
+- return true;
+- if ((vmcs12->cr0_guest_host_mask & 0x1) &&
+- !(vmcs12->cr0_read_shadow & 0x1) &&
+- (val & 0x1))
+- return true;
+- break;
+- }
+- return false;
+-}
+-
+-static bool nested_vmx_exit_handled_vmcs_access(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12, gpa_t bitmap)
+-{
+- u32 vmx_instruction_info;
+- unsigned long field;
+- u8 b;
+-
+- if (!nested_cpu_has_shadow_vmcs(vmcs12))
+- return true;
+-
+- /* Decode instruction info and find the field to access */
+- vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+- field = kvm_register_read(vcpu, (((vmx_instruction_info) >> 28) & 0xf));
+-
+- /* Out-of-range fields always cause a VM exit from L2 to L1 */
+- if (field >> 15)
+- return true;
+-
+- if (kvm_vcpu_read_guest(vcpu, bitmap + field/8, &b, 1))
+- return true;
+-
+- return 1 & (b >> (field & 7));
+-}
+-
+-/*
+- * Return 1 if we should exit from L2 to L1 to handle an exit, or 0 if we
+- * should handle it ourselves in L0 (and then continue L2). Only call this
+- * when in is_guest_mode (L2).
+- */
+-static bool nested_vmx_exit_reflected(struct kvm_vcpu *vcpu, u32 exit_reason)
+-{
+- u32 intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+-
+- if (vmx->nested.nested_run_pending)
+- return false;
+-
+- if (unlikely(vmx->fail)) {
+- pr_info_ratelimited("%s failed vm entry %x\n", __func__,
+- vmcs_read32(VM_INSTRUCTION_ERROR));
+- return true;
+- }
+-
+- /*
+- * The host physical addresses of some pages of guest memory
+- * are loaded into the vmcs02 (e.g. vmcs12's Virtual APIC
+- * Page). The CPU may write to these pages via their host
+- * physical address while L2 is running, bypassing any
+- * address-translation-based dirty tracking (e.g. EPT write
+- * protection).
+- *
+- * Mark them dirty on every exit from L2 to prevent them from
+- * getting out of sync with dirty tracking.
+- */
+- nested_mark_vmcs12_pages_dirty(vcpu);
+-
+- trace_kvm_nested_vmexit(kvm_rip_read(vcpu), exit_reason,
+- vmcs_readl(EXIT_QUALIFICATION),
+- vmx->idt_vectoring_info,
+- intr_info,
+- vmcs_read32(VM_EXIT_INTR_ERROR_CODE),
+- KVM_ISA_VMX);
+-
+- switch ((u16)exit_reason) {
+- case EXIT_REASON_EXCEPTION_NMI:
+- if (is_nmi(intr_info))
+- return false;
+- else if (is_page_fault(intr_info))
+- return !vmx->vcpu.arch.apf.host_apf_reason && enable_ept;
+- else if (is_no_device(intr_info) &&
+- !(vmcs12->guest_cr0 & X86_CR0_TS))
+- return false;
+- else if (is_debug(intr_info) &&
+- vcpu->guest_debug &
+- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
+- return false;
+- else if (is_breakpoint(intr_info) &&
+- vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
+- return false;
+- return vmcs12->exception_bitmap &
+- (1u << (intr_info & INTR_INFO_VECTOR_MASK));
+- case EXIT_REASON_EXTERNAL_INTERRUPT:
+- return false;
+- case EXIT_REASON_TRIPLE_FAULT:
+- return true;
+- case EXIT_REASON_PENDING_INTERRUPT:
+- return nested_cpu_has(vmcs12, CPU_BASED_VIRTUAL_INTR_PENDING);
+- case EXIT_REASON_NMI_WINDOW:
+- return nested_cpu_has(vmcs12, CPU_BASED_VIRTUAL_NMI_PENDING);
+- case EXIT_REASON_TASK_SWITCH:
+- return true;
+- case EXIT_REASON_CPUID:
+- return true;
+- case EXIT_REASON_HLT:
+- return nested_cpu_has(vmcs12, CPU_BASED_HLT_EXITING);
+- case EXIT_REASON_INVD:
+- return true;
+- case EXIT_REASON_INVLPG:
+- return nested_cpu_has(vmcs12, CPU_BASED_INVLPG_EXITING);
+- case EXIT_REASON_RDPMC:
+- return nested_cpu_has(vmcs12, CPU_BASED_RDPMC_EXITING);
+- case EXIT_REASON_RDRAND:
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_RDRAND_EXITING);
+- case EXIT_REASON_RDSEED:
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_RDSEED_EXITING);
+- case EXIT_REASON_RDTSC: case EXIT_REASON_RDTSCP:
+- return nested_cpu_has(vmcs12, CPU_BASED_RDTSC_EXITING);
+- case EXIT_REASON_VMREAD:
+- return nested_vmx_exit_handled_vmcs_access(vcpu, vmcs12,
+- vmcs12->vmread_bitmap);
+- case EXIT_REASON_VMWRITE:
+- return nested_vmx_exit_handled_vmcs_access(vcpu, vmcs12,
+- vmcs12->vmwrite_bitmap);
+- case EXIT_REASON_VMCALL: case EXIT_REASON_VMCLEAR:
+- case EXIT_REASON_VMLAUNCH: case EXIT_REASON_VMPTRLD:
+- case EXIT_REASON_VMPTRST: case EXIT_REASON_VMRESUME:
+- case EXIT_REASON_VMOFF: case EXIT_REASON_VMON:
+- case EXIT_REASON_INVEPT: case EXIT_REASON_INVVPID:
+- /*
+- * VMX instructions trap unconditionally. This allows L1 to
+- * emulate them for its L2 guest, i.e., allows 3-level nesting!
+- */
+- return true;
+- case EXIT_REASON_CR_ACCESS:
+- return nested_vmx_exit_handled_cr(vcpu, vmcs12);
+- case EXIT_REASON_DR_ACCESS:
+- return nested_cpu_has(vmcs12, CPU_BASED_MOV_DR_EXITING);
+- case EXIT_REASON_IO_INSTRUCTION:
+- return nested_vmx_exit_handled_io(vcpu, vmcs12);
+- case EXIT_REASON_GDTR_IDTR: case EXIT_REASON_LDTR_TR:
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_DESC);
+- case EXIT_REASON_MSR_READ:
+- case EXIT_REASON_MSR_WRITE:
+- return nested_vmx_exit_handled_msr(vcpu, vmcs12, exit_reason);
+- case EXIT_REASON_INVALID_STATE:
+- return true;
+- case EXIT_REASON_MWAIT_INSTRUCTION:
+- return nested_cpu_has(vmcs12, CPU_BASED_MWAIT_EXITING);
+- case EXIT_REASON_MONITOR_TRAP_FLAG:
+- return nested_cpu_has(vmcs12, CPU_BASED_MONITOR_TRAP_FLAG);
+- case EXIT_REASON_MONITOR_INSTRUCTION:
+- return nested_cpu_has(vmcs12, CPU_BASED_MONITOR_EXITING);
+- case EXIT_REASON_PAUSE_INSTRUCTION:
+- return nested_cpu_has(vmcs12, CPU_BASED_PAUSE_EXITING) ||
+- nested_cpu_has2(vmcs12,
+- SECONDARY_EXEC_PAUSE_LOOP_EXITING);
+- case EXIT_REASON_MCE_DURING_VMENTRY:
+- return false;
+- case EXIT_REASON_TPR_BELOW_THRESHOLD:
+- return nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW);
+- case EXIT_REASON_APIC_ACCESS:
+- case EXIT_REASON_APIC_WRITE:
+- case EXIT_REASON_EOI_INDUCED:
+- /*
+- * The controls for "virtualize APIC accesses," "APIC-
+- * register virtualization," and "virtual-interrupt
+- * delivery" only come from vmcs12.
+- */
+- return true;
+- case EXIT_REASON_EPT_VIOLATION:
+- /*
+- * L0 always deals with the EPT violation. If nested EPT is
+- * used, and the nested mmu code discovers that the address is
+- * missing in the guest EPT table (EPT12), the EPT violation
+- * will be injected with nested_ept_inject_page_fault()
+- */
+- return false;
+- case EXIT_REASON_EPT_MISCONFIG:
+- /*
+- * L2 never uses directly L1's EPT, but rather L0's own EPT
+- * table (shadow on EPT) or a merged EPT table that L0 built
+- * (EPT on EPT). So any problems with the structure of the
+- * table is L0's fault.
+- */
+- return false;
+- case EXIT_REASON_INVPCID:
+- return
+- nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_INVPCID) &&
+- nested_cpu_has(vmcs12, CPU_BASED_INVLPG_EXITING);
+- case EXIT_REASON_WBINVD:
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_WBINVD_EXITING);
+- case EXIT_REASON_XSETBV:
+- return true;
+- case EXIT_REASON_XSAVES: case EXIT_REASON_XRSTORS:
+- /*
+- * This should never happen, since it is not possible to
+- * set XSS to a non-zero value---neither in L1 nor in L2.
+- * If if it were, XSS would have to be checked against
+- * the XSS exit bitmap in vmcs12.
+- */
+- return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES);
+- case EXIT_REASON_PREEMPTION_TIMER:
+- return false;
+- case EXIT_REASON_PML_FULL:
+- /* We emulate PML support to L1. */
+- return false;
+- case EXIT_REASON_VMFUNC:
+- /* VM functions are emulated through L2->L0 vmexits. */
+- return false;
+- case EXIT_REASON_ENCLS:
+- /* SGX is never exposed to L1 */
+- return false;
+- default:
+- return true;
+- }
+-}
+-
+-static int nested_vmx_reflect_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason)
+-{
+- u32 exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+-
+- /*
+- * At this point, the exit interruption info in exit_intr_info
+- * is only valid for EXCEPTION_NMI exits. For EXTERNAL_INTERRUPT
+- * we need to query the in-kernel LAPIC.
+- */
+- WARN_ON(exit_reason == EXIT_REASON_EXTERNAL_INTERRUPT);
+- if ((exit_intr_info &
+- (INTR_INFO_VALID_MASK | INTR_INFO_DELIVER_CODE_MASK)) ==
+- (INTR_INFO_VALID_MASK | INTR_INFO_DELIVER_CODE_MASK)) {
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- vmcs12->vm_exit_intr_error_code =
+- vmcs_read32(VM_EXIT_INTR_ERROR_CODE);
+- }
+-
+- nested_vmx_vmexit(vcpu, exit_reason, exit_intr_info,
+- vmcs_readl(EXIT_QUALIFICATION));
+- return 1;
+-}
+-
+-static void vmx_get_exit_info(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2)
+-{
+- *info1 = vmcs_readl(EXIT_QUALIFICATION);
+- *info2 = vmcs_read32(VM_EXIT_INTR_INFO);
+-}
+-
+-static void vmx_destroy_pml_buffer(struct vcpu_vmx *vmx)
+-{
+- if (vmx->pml_pg) {
+- __free_page(vmx->pml_pg);
+- vmx->pml_pg = NULL;
+- }
+-}
+-
+-static void vmx_flush_pml_buffer(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u64 *pml_buf;
+- u16 pml_idx;
+-
+- pml_idx = vmcs_read16(GUEST_PML_INDEX);
+-
+- /* Do nothing if PML buffer is empty */
+- if (pml_idx == (PML_ENTITY_NUM - 1))
+- return;
+-
+- /* PML index always points to next available PML buffer entity */
+- if (pml_idx >= PML_ENTITY_NUM)
+- pml_idx = 0;
+- else
+- pml_idx++;
+-
+- pml_buf = page_address(vmx->pml_pg);
+- for (; pml_idx < PML_ENTITY_NUM; pml_idx++) {
+- u64 gpa;
+-
+- gpa = pml_buf[pml_idx];
+- WARN_ON(gpa & (PAGE_SIZE - 1));
+- kvm_vcpu_mark_page_dirty(vcpu, gpa >> PAGE_SHIFT);
+- }
+-
+- /* reset PML index */
+- vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
+-}
+-
+-/*
+- * Flush all vcpus' PML buffer and update logged GPAs to dirty_bitmap.
+- * Called before reporting dirty_bitmap to userspace.
+- */
+-static void kvm_flush_pml_buffers(struct kvm *kvm)
+-{
+- int i;
+- struct kvm_vcpu *vcpu;
+- /*
+- * We only need to kick vcpu out of guest mode here, as PML buffer
+- * is flushed at beginning of all VMEXITs, and it's obvious that only
+- * vcpus running in guest are possible to have unflushed GPAs in PML
+- * buffer.
+- */
+- kvm_for_each_vcpu(i, vcpu, kvm)
+- kvm_vcpu_kick(vcpu);
+-}
+-
+-static void vmx_dump_sel(char *name, uint32_t sel)
+-{
+- pr_err("%s sel=0x%04x, attr=0x%05x, limit=0x%08x, base=0x%016lx\n",
+- name, vmcs_read16(sel),
+- vmcs_read32(sel + GUEST_ES_AR_BYTES - GUEST_ES_SELECTOR),
+- vmcs_read32(sel + GUEST_ES_LIMIT - GUEST_ES_SELECTOR),
+- vmcs_readl(sel + GUEST_ES_BASE - GUEST_ES_SELECTOR));
+-}
+-
+-static void vmx_dump_dtsel(char *name, uint32_t limit)
+-{
+- pr_err("%s limit=0x%08x, base=0x%016lx\n",
+- name, vmcs_read32(limit),
+- vmcs_readl(limit + GUEST_GDTR_BASE - GUEST_GDTR_LIMIT));
+-}
+-
+-static void dump_vmcs(void)
+-{
+- u32 vmentry_ctl = vmcs_read32(VM_ENTRY_CONTROLS);
+- u32 vmexit_ctl = vmcs_read32(VM_EXIT_CONTROLS);
+- u32 cpu_based_exec_ctrl = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
+- u32 pin_based_exec_ctrl = vmcs_read32(PIN_BASED_VM_EXEC_CONTROL);
+- u32 secondary_exec_control = 0;
+- unsigned long cr4 = vmcs_readl(GUEST_CR4);
+- u64 efer = vmcs_read64(GUEST_IA32_EFER);
+- int i, n;
+-
+- if (cpu_has_secondary_exec_ctrls())
+- secondary_exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
+-
+- pr_err("*** Guest State ***\n");
+- pr_err("CR0: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n",
+- vmcs_readl(GUEST_CR0), vmcs_readl(CR0_READ_SHADOW),
+- vmcs_readl(CR0_GUEST_HOST_MASK));
+- pr_err("CR4: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n",
+- cr4, vmcs_readl(CR4_READ_SHADOW), vmcs_readl(CR4_GUEST_HOST_MASK));
+- pr_err("CR3 = 0x%016lx\n", vmcs_readl(GUEST_CR3));
+- if ((secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT) &&
+- (cr4 & X86_CR4_PAE) && !(efer & EFER_LMA))
+- {
+- pr_err("PDPTR0 = 0x%016llx PDPTR1 = 0x%016llx\n",
+- vmcs_read64(GUEST_PDPTR0), vmcs_read64(GUEST_PDPTR1));
+- pr_err("PDPTR2 = 0x%016llx PDPTR3 = 0x%016llx\n",
+- vmcs_read64(GUEST_PDPTR2), vmcs_read64(GUEST_PDPTR3));
+- }
+- pr_err("RSP = 0x%016lx RIP = 0x%016lx\n",
+- vmcs_readl(GUEST_RSP), vmcs_readl(GUEST_RIP));
+- pr_err("RFLAGS=0x%08lx DR7 = 0x%016lx\n",
+- vmcs_readl(GUEST_RFLAGS), vmcs_readl(GUEST_DR7));
+- pr_err("Sysenter RSP=%016lx CS:RIP=%04x:%016lx\n",
+- vmcs_readl(GUEST_SYSENTER_ESP),
+- vmcs_read32(GUEST_SYSENTER_CS), vmcs_readl(GUEST_SYSENTER_EIP));
+- vmx_dump_sel("CS: ", GUEST_CS_SELECTOR);
+- vmx_dump_sel("DS: ", GUEST_DS_SELECTOR);
+- vmx_dump_sel("SS: ", GUEST_SS_SELECTOR);
+- vmx_dump_sel("ES: ", GUEST_ES_SELECTOR);
+- vmx_dump_sel("FS: ", GUEST_FS_SELECTOR);
+- vmx_dump_sel("GS: ", GUEST_GS_SELECTOR);
+- vmx_dump_dtsel("GDTR:", GUEST_GDTR_LIMIT);
+- vmx_dump_sel("LDTR:", GUEST_LDTR_SELECTOR);
+- vmx_dump_dtsel("IDTR:", GUEST_IDTR_LIMIT);
+- vmx_dump_sel("TR: ", GUEST_TR_SELECTOR);
+- if ((vmexit_ctl & (VM_EXIT_SAVE_IA32_PAT | VM_EXIT_SAVE_IA32_EFER)) ||
+- (vmentry_ctl & (VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_IA32_EFER)))
+- pr_err("EFER = 0x%016llx PAT = 0x%016llx\n",
+- efer, vmcs_read64(GUEST_IA32_PAT));
+- pr_err("DebugCtl = 0x%016llx DebugExceptions = 0x%016lx\n",
+- vmcs_read64(GUEST_IA32_DEBUGCTL),
+- vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS));
+- if (cpu_has_load_perf_global_ctrl &&
+- vmentry_ctl & VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL)
+- pr_err("PerfGlobCtl = 0x%016llx\n",
+- vmcs_read64(GUEST_IA32_PERF_GLOBAL_CTRL));
+- if (vmentry_ctl & VM_ENTRY_LOAD_BNDCFGS)
+- pr_err("BndCfgS = 0x%016llx\n", vmcs_read64(GUEST_BNDCFGS));
+- pr_err("Interruptibility = %08x ActivityState = %08x\n",
+- vmcs_read32(GUEST_INTERRUPTIBILITY_INFO),
+- vmcs_read32(GUEST_ACTIVITY_STATE));
+- if (secondary_exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY)
+- pr_err("InterruptStatus = %04x\n",
+- vmcs_read16(GUEST_INTR_STATUS));
+-
+- pr_err("*** Host State ***\n");
+- pr_err("RIP = 0x%016lx RSP = 0x%016lx\n",
+- vmcs_readl(HOST_RIP), vmcs_readl(HOST_RSP));
+- pr_err("CS=%04x SS=%04x DS=%04x ES=%04x FS=%04x GS=%04x TR=%04x\n",
+- vmcs_read16(HOST_CS_SELECTOR), vmcs_read16(HOST_SS_SELECTOR),
+- vmcs_read16(HOST_DS_SELECTOR), vmcs_read16(HOST_ES_SELECTOR),
+- vmcs_read16(HOST_FS_SELECTOR), vmcs_read16(HOST_GS_SELECTOR),
+- vmcs_read16(HOST_TR_SELECTOR));
+- pr_err("FSBase=%016lx GSBase=%016lx TRBase=%016lx\n",
+- vmcs_readl(HOST_FS_BASE), vmcs_readl(HOST_GS_BASE),
+- vmcs_readl(HOST_TR_BASE));
+- pr_err("GDTBase=%016lx IDTBase=%016lx\n",
+- vmcs_readl(HOST_GDTR_BASE), vmcs_readl(HOST_IDTR_BASE));
+- pr_err("CR0=%016lx CR3=%016lx CR4=%016lx\n",
+- vmcs_readl(HOST_CR0), vmcs_readl(HOST_CR3),
+- vmcs_readl(HOST_CR4));
+- pr_err("Sysenter RSP=%016lx CS:RIP=%04x:%016lx\n",
+- vmcs_readl(HOST_IA32_SYSENTER_ESP),
+- vmcs_read32(HOST_IA32_SYSENTER_CS),
+- vmcs_readl(HOST_IA32_SYSENTER_EIP));
+- if (vmexit_ctl & (VM_EXIT_LOAD_IA32_PAT | VM_EXIT_LOAD_IA32_EFER))
+- pr_err("EFER = 0x%016llx PAT = 0x%016llx\n",
+- vmcs_read64(HOST_IA32_EFER),
+- vmcs_read64(HOST_IA32_PAT));
+- if (cpu_has_load_perf_global_ctrl &&
+- vmexit_ctl & VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL)
+- pr_err("PerfGlobCtl = 0x%016llx\n",
+- vmcs_read64(HOST_IA32_PERF_GLOBAL_CTRL));
+-
+- pr_err("*** Control State ***\n");
+- pr_err("PinBased=%08x CPUBased=%08x SecondaryExec=%08x\n",
+- pin_based_exec_ctrl, cpu_based_exec_ctrl, secondary_exec_control);
+- pr_err("EntryControls=%08x ExitControls=%08x\n", vmentry_ctl, vmexit_ctl);
+- pr_err("ExceptionBitmap=%08x PFECmask=%08x PFECmatch=%08x\n",
+- vmcs_read32(EXCEPTION_BITMAP),
+- vmcs_read32(PAGE_FAULT_ERROR_CODE_MASK),
+- vmcs_read32(PAGE_FAULT_ERROR_CODE_MATCH));
+- pr_err("VMEntry: intr_info=%08x errcode=%08x ilen=%08x\n",
+- vmcs_read32(VM_ENTRY_INTR_INFO_FIELD),
+- vmcs_read32(VM_ENTRY_EXCEPTION_ERROR_CODE),
+- vmcs_read32(VM_ENTRY_INSTRUCTION_LEN));
+- pr_err("VMExit: intr_info=%08x errcode=%08x ilen=%08x\n",
+- vmcs_read32(VM_EXIT_INTR_INFO),
+- vmcs_read32(VM_EXIT_INTR_ERROR_CODE),
+- vmcs_read32(VM_EXIT_INSTRUCTION_LEN));
+- pr_err(" reason=%08x qualification=%016lx\n",
+- vmcs_read32(VM_EXIT_REASON), vmcs_readl(EXIT_QUALIFICATION));
+- pr_err("IDTVectoring: info=%08x errcode=%08x\n",
+- vmcs_read32(IDT_VECTORING_INFO_FIELD),
+- vmcs_read32(IDT_VECTORING_ERROR_CODE));
+- pr_err("TSC Offset = 0x%016llx\n", vmcs_read64(TSC_OFFSET));
+- if (secondary_exec_control & SECONDARY_EXEC_TSC_SCALING)
+- pr_err("TSC Multiplier = 0x%016llx\n",
+- vmcs_read64(TSC_MULTIPLIER));
+- if (cpu_based_exec_ctrl & CPU_BASED_TPR_SHADOW)
+- pr_err("TPR Threshold = 0x%02x\n", vmcs_read32(TPR_THRESHOLD));
+- if (pin_based_exec_ctrl & PIN_BASED_POSTED_INTR)
+- pr_err("PostedIntrVec = 0x%02x\n", vmcs_read16(POSTED_INTR_NV));
+- if ((secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT))
+- pr_err("EPT pointer = 0x%016llx\n", vmcs_read64(EPT_POINTER));
+- n = vmcs_read32(CR3_TARGET_COUNT);
+- for (i = 0; i + 1 < n; i += 4)
+- pr_err("CR3 target%u=%016lx target%u=%016lx\n",
+- i, vmcs_readl(CR3_TARGET_VALUE0 + i * 2),
+- i + 1, vmcs_readl(CR3_TARGET_VALUE0 + i * 2 + 2));
+- if (i < n)
+- pr_err("CR3 target%u=%016lx\n",
+- i, vmcs_readl(CR3_TARGET_VALUE0 + i * 2));
+- if (secondary_exec_control & SECONDARY_EXEC_PAUSE_LOOP_EXITING)
+- pr_err("PLE Gap=%08x Window=%08x\n",
+- vmcs_read32(PLE_GAP), vmcs_read32(PLE_WINDOW));
+- if (secondary_exec_control & SECONDARY_EXEC_ENABLE_VPID)
+- pr_err("Virtual processor ID = 0x%04x\n",
+- vmcs_read16(VIRTUAL_PROCESSOR_ID));
+-}
+-
+-/*
+- * The guest has exited. See if we can fix it or if we need userspace
+- * assistance.
+- */
+-static int vmx_handle_exit(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 exit_reason = vmx->exit_reason;
+- u32 vectoring_info = vmx->idt_vectoring_info;
+-
+- trace_kvm_exit(exit_reason, vcpu, KVM_ISA_VMX);
+-
+- /*
+- * Flush logged GPAs PML buffer, this will make dirty_bitmap more
+- * updated. Another good is, in kvm_vm_ioctl_get_dirty_log, before
+- * querying dirty_bitmap, we only need to kick all vcpus out of guest
+- * mode as if vcpus is in root mode, the PML buffer must has been
+- * flushed already.
+- */
+- if (enable_pml)
+- vmx_flush_pml_buffer(vcpu);
+-
+- /* If guest state is invalid, start emulating */
+- if (vmx->emulation_required)
+- return handle_invalid_guest_state(vcpu);
+-
+- if (is_guest_mode(vcpu) && nested_vmx_exit_reflected(vcpu, exit_reason))
+- return nested_vmx_reflect_vmexit(vcpu, exit_reason);
+-
+- if (exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY) {
+- dump_vmcs();
+- vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
+- vcpu->run->fail_entry.hardware_entry_failure_reason
+- = exit_reason;
+- return 0;
+- }
+-
+- if (unlikely(vmx->fail)) {
+- vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
+- vcpu->run->fail_entry.hardware_entry_failure_reason
+- = vmcs_read32(VM_INSTRUCTION_ERROR);
+- return 0;
+- }
+-
+- /*
+- * Note:
+- * Do not try to fix EXIT_REASON_EPT_MISCONFIG if it caused by
+- * delivery event since it indicates guest is accessing MMIO.
+- * The vm-exit can be triggered again after return to guest that
+- * will cause infinite loop.
+- */
+- if ((vectoring_info & VECTORING_INFO_VALID_MASK) &&
+- (exit_reason != EXIT_REASON_EXCEPTION_NMI &&
+- exit_reason != EXIT_REASON_EPT_VIOLATION &&
+- exit_reason != EXIT_REASON_PML_FULL &&
+- exit_reason != EXIT_REASON_APIC_ACCESS &&
+- exit_reason != EXIT_REASON_TASK_SWITCH)) {
+- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+- vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV;
+- vcpu->run->internal.ndata = 3;
+- vcpu->run->internal.data[0] = vectoring_info;
+- vcpu->run->internal.data[1] = exit_reason;
+- vcpu->run->internal.data[2] = vcpu->arch.exit_qualification;
+- if (exit_reason == EXIT_REASON_EPT_MISCONFIG) {
+- vcpu->run->internal.ndata++;
+- vcpu->run->internal.data[3] =
+- vmcs_read64(GUEST_PHYSICAL_ADDRESS);
+- }
+- return 0;
+- }
+-
+- if (unlikely(!enable_vnmi &&
+- vmx->loaded_vmcs->soft_vnmi_blocked)) {
+- if (vmx_interrupt_allowed(vcpu)) {
+- vmx->loaded_vmcs->soft_vnmi_blocked = 0;
+- } else if (vmx->loaded_vmcs->vnmi_blocked_time > 1000000000LL &&
+- vcpu->arch.nmi_pending) {
+- /*
+- * This CPU don't support us in finding the end of an
+- * NMI-blocked window if the guest runs with IRQs
+- * disabled. So we pull the trigger after 1 s of
+- * futile waiting, but inform the user about this.
+- */
+- printk(KERN_WARNING "%s: Breaking out of NMI-blocked "
+- "state on VCPU %d after 1 s timeout\n",
+- __func__, vcpu->vcpu_id);
+- vmx->loaded_vmcs->soft_vnmi_blocked = 0;
+- }
+- }
+-
+- if (exit_reason < kvm_vmx_max_exit_handlers
+- && kvm_vmx_exit_handlers[exit_reason])
+- return kvm_vmx_exit_handlers[exit_reason](vcpu);
+- else {
+- vcpu_unimpl(vcpu, "vmx: unexpected exit reason 0x%x\n",
+- exit_reason);
+- kvm_queue_exception(vcpu, UD_VECTOR);
+- return 1;
+- }
+-}
+-
+-/*
+- * Software based L1D cache flush which is used when microcode providing
+- * the cache control MSR is not loaded.
+- *
+- * The L1D cache is 32 KiB on Nehalem and later microarchitectures, but to
+- * flush it is required to read in 64 KiB because the replacement algorithm
+- * is not exactly LRU. This could be sized at runtime via topology
+- * information but as all relevant affected CPUs have 32KiB L1D cache size
+- * there is no point in doing so.
+- */
+-static void vmx_l1d_flush(struct kvm_vcpu *vcpu)
+-{
+- int size = PAGE_SIZE << L1D_CACHE_ORDER;
+-
+- /*
+- * This code is only executed when the the flush mode is 'cond' or
+- * 'always'
+- */
+- if (static_branch_likely(&vmx_l1d_flush_cond)) {
+- bool flush_l1d;
+-
+- /*
+- * Clear the per-vcpu flush bit, it gets set again
+- * either from vcpu_run() or from one of the unsafe
+- * VMEXIT handlers.
+- */
+- flush_l1d = vcpu->arch.l1tf_flush_l1d;
+- vcpu->arch.l1tf_flush_l1d = false;
+-
+- /*
+- * Clear the per-cpu flush bit, it gets set again from
+- * the interrupt handlers.
+- */
+- flush_l1d |= kvm_get_cpu_l1tf_flush_l1d();
+- kvm_clear_cpu_l1tf_flush_l1d();
+-
+- if (!flush_l1d)
+- return;
+- }
+-
+- vcpu->stat.l1d_flush++;
+-
+- if (static_cpu_has(X86_FEATURE_FLUSH_L1D)) {
+- wrmsrl(MSR_IA32_FLUSH_CMD, L1D_FLUSH);
+- return;
+- }
+-
+- asm volatile(
+- /* First ensure the pages are in the TLB */
+- "xorl %%eax, %%eax\n"
+- ".Lpopulate_tlb:\n\t"
+- "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t"
+- "addl $4096, %%eax\n\t"
+- "cmpl %%eax, %[size]\n\t"
+- "jne .Lpopulate_tlb\n\t"
+- "xorl %%eax, %%eax\n\t"
+- "cpuid\n\t"
+- /* Now fill the cache */
+- "xorl %%eax, %%eax\n"
+- ".Lfill_cache:\n"
+- "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t"
+- "addl $64, %%eax\n\t"
+- "cmpl %%eax, %[size]\n\t"
+- "jne .Lfill_cache\n\t"
+- "lfence\n"
+- :: [flush_pages] "r" (vmx_l1d_flush_pages),
+- [size] "r" (size)
+- : "eax", "ebx", "ecx", "edx");
+-}
+-
+-static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+-
+- if (is_guest_mode(vcpu) &&
+- nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
+- return;
+-
+- if (irr == -1 || tpr < irr) {
+- vmcs_write32(TPR_THRESHOLD, 0);
+- return;
+- }
+-
+- vmcs_write32(TPR_THRESHOLD, irr);
+-}
+-
+-static void vmx_set_virtual_apic_mode(struct kvm_vcpu *vcpu)
+-{
+- u32 sec_exec_control;
+-
+- if (!lapic_in_kernel(vcpu))
+- return;
+-
+- if (!flexpriority_enabled &&
+- !cpu_has_vmx_virtualize_x2apic_mode())
+- return;
+-
+- /* Postpone execution until vmcs01 is the current VMCS. */
+- if (is_guest_mode(vcpu)) {
+- to_vmx(vcpu)->nested.change_vmcs01_virtual_apic_mode = true;
+- return;
+- }
+-
+- sec_exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
+- sec_exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE);
+-
+- switch (kvm_get_apic_mode(vcpu)) {
+- case LAPIC_MODE_INVALID:
+- WARN_ONCE(true, "Invalid local APIC state");
+- case LAPIC_MODE_DISABLED:
+- break;
+- case LAPIC_MODE_XAPIC:
+- if (flexpriority_enabled) {
+- sec_exec_control |=
+- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+- vmx_flush_tlb(vcpu, true);
+- }
+- break;
+- case LAPIC_MODE_X2APIC:
+- if (cpu_has_vmx_virtualize_x2apic_mode())
+- sec_exec_control |=
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
+- break;
+- }
+- vmcs_write32(SECONDARY_VM_EXEC_CONTROL, sec_exec_control);
+-
+- vmx_update_msr_bitmap(vcpu);
+-}
+-
+-static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa)
+-{
+- if (!is_guest_mode(vcpu)) {
+- vmcs_write64(APIC_ACCESS_ADDR, hpa);
+- vmx_flush_tlb(vcpu, true);
+- }
+-}
+-
+-static void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)
+-{
+- u16 status;
+- u8 old;
+-
+- if (max_isr == -1)
+- max_isr = 0;
+-
+- status = vmcs_read16(GUEST_INTR_STATUS);
+- old = status >> 8;
+- if (max_isr != old) {
+- status &= 0xff;
+- status |= max_isr << 8;
+- vmcs_write16(GUEST_INTR_STATUS, status);
+- }
+-}
+-
+-static void vmx_set_rvi(int vector)
+-{
+- u16 status;
+- u8 old;
+-
+- if (vector == -1)
+- vector = 0;
+-
+- status = vmcs_read16(GUEST_INTR_STATUS);
+- old = (u8)status & 0xff;
+- if ((u8)vector != old) {
+- status &= ~0xff;
+- status |= (u8)vector;
+- vmcs_write16(GUEST_INTR_STATUS, status);
+- }
+-}
+-
+-static void vmx_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr)
+-{
+- /*
+- * When running L2, updating RVI is only relevant when
+- * vmcs12 virtual-interrupt-delivery enabled.
+- * However, it can be enabled only when L1 also
+- * intercepts external-interrupts and in that case
+- * we should not update vmcs02 RVI but instead intercept
+- * interrupt. Therefore, do nothing when running L2.
+- */
+- if (!is_guest_mode(vcpu))
+- vmx_set_rvi(max_irr);
+-}
+-
+-static int vmx_sync_pir_to_irr(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int max_irr;
+- bool max_irr_updated;
+-
+- WARN_ON(!vcpu->arch.apicv_active);
+- if (pi_test_on(&vmx->pi_desc)) {
+- pi_clear_on(&vmx->pi_desc);
+- /*
+- * IOMMU can write to PIR.ON, so the barrier matters even on UP.
+- * But on x86 this is just a compiler barrier anyway.
+- */
+- smp_mb__after_atomic();
+- max_irr_updated =
+- kvm_apic_update_irr(vcpu, vmx->pi_desc.pir, &max_irr);
+-
+- /*
+- * If we are running L2 and L1 has a new pending interrupt
+- * which can be injected, we should re-evaluate
+- * what should be done with this new L1 interrupt.
+- * If L1 intercepts external-interrupts, we should
+- * exit from L2 to L1. Otherwise, interrupt should be
+- * delivered directly to L2.
+- */
+- if (is_guest_mode(vcpu) && max_irr_updated) {
+- if (nested_exit_on_intr(vcpu))
+- kvm_vcpu_exiting_guest_mode(vcpu);
+- else
+- kvm_make_request(KVM_REQ_EVENT, vcpu);
+- }
+- } else {
+- max_irr = kvm_lapic_find_highest_irr(vcpu);
+- }
+- vmx_hwapic_irr_update(vcpu, max_irr);
+- return max_irr;
+-}
+-
+-static u8 vmx_has_apicv_interrupt(struct kvm_vcpu *vcpu)
+-{
+- u8 rvi = vmx_get_rvi();
+- u8 vppr = kvm_lapic_get_reg(vcpu->arch.apic, APIC_PROCPRI);
+-
+- return ((rvi & 0xf0) > (vppr & 0xf0));
+-}
+-
+-static bool vmx_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
+-{
+- return pi_test_on(vcpu_to_pi_desc(vcpu));
+-}
+-
+-static void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
+-{
+- if (!kvm_vcpu_apicv_active(vcpu))
+- return;
+-
+- vmcs_write64(EOI_EXIT_BITMAP0, eoi_exit_bitmap[0]);
+- vmcs_write64(EOI_EXIT_BITMAP1, eoi_exit_bitmap[1]);
+- vmcs_write64(EOI_EXIT_BITMAP2, eoi_exit_bitmap[2]);
+- vmcs_write64(EOI_EXIT_BITMAP3, eoi_exit_bitmap[3]);
+-}
+-
+-static void vmx_apicv_post_state_restore(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- pi_clear_on(&vmx->pi_desc);
+- memset(vmx->pi_desc.pir, 0, sizeof(vmx->pi_desc.pir));
+-}
+-
+-static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
+-{
+- if (vmx->exit_reason != EXIT_REASON_EXCEPTION_NMI)
+- return;
+-
+- vmx->exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+-
+- /* if exit due to PF check for async PF */
+- if (is_page_fault(vmx->exit_intr_info))
+- vmx->vcpu.arch.apf.host_apf_reason = kvm_read_and_reset_pf_reason();
+-
+- /* Handle machine checks before interrupts are enabled */
+- if (is_machine_check(vmx->exit_intr_info))
+- kvm_machine_check();
+-
+- /* We need to handle NMIs before interrupts are enabled */
+- if (is_nmi(vmx->exit_intr_info)) {
+- kvm_before_interrupt(&vmx->vcpu);
+- asm("int $2");
+- kvm_after_interrupt(&vmx->vcpu);
+- }
+-}
+-
+-static void vmx_handle_external_intr(struct kvm_vcpu *vcpu)
+-{
+- u32 exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+-
+- if ((exit_intr_info & (INTR_INFO_VALID_MASK | INTR_INFO_INTR_TYPE_MASK))
+- == (INTR_INFO_VALID_MASK | INTR_TYPE_EXT_INTR)) {
+- unsigned int vector;
+- unsigned long entry;
+- gate_desc *desc;
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-#ifdef CONFIG_X86_64
+- unsigned long tmp;
+-#endif
+-
+- vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
+- desc = (gate_desc *)vmx->host_idt_base + vector;
+- entry = gate_offset(desc);
+- asm volatile(
+-#ifdef CONFIG_X86_64
+- "mov %%" _ASM_SP ", %[sp]\n\t"
+- "and $0xfffffffffffffff0, %%" _ASM_SP "\n\t"
+- "push $%c[ss]\n\t"
+- "push %[sp]\n\t"
+-#endif
+- "pushf\n\t"
+- __ASM_SIZE(push) " $%c[cs]\n\t"
+- CALL_NOSPEC
+- :
+-#ifdef CONFIG_X86_64
+- [sp]"=&r"(tmp),
+-#endif
+- ASM_CALL_CONSTRAINT
+- :
+- THUNK_TARGET(entry),
+- [ss]"i"(__KERNEL_DS),
+- [cs]"i"(__KERNEL_CS)
+- );
+- }
+-}
+-STACK_FRAME_NON_STANDARD(vmx_handle_external_intr);
+-
+-static bool vmx_has_emulated_msr(int index)
+-{
+- switch (index) {
+- case MSR_IA32_SMBASE:
+- /*
+- * We cannot do SMM unless we can run the guest in big
+- * real mode.
+- */
+- return enable_unrestricted_guest || emulate_invalid_guest_state;
+- case MSR_AMD64_VIRT_SPEC_CTRL:
+- /* This is AMD only. */
+- return false;
+- default:
+- return true;
+- }
+-}
+-
+-static bool vmx_mpx_supported(void)
+-{
+- return (vmcs_config.vmexit_ctrl & VM_EXIT_CLEAR_BNDCFGS) &&
+- (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_BNDCFGS);
+-}
+-
+-static bool vmx_xsaves_supported(void)
+-{
+- return vmcs_config.cpu_based_2nd_exec_ctrl &
+- SECONDARY_EXEC_XSAVES;
+-}
+-
+-static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
+-{
+- u32 exit_intr_info;
+- bool unblock_nmi;
+- u8 vector;
+- bool idtv_info_valid;
+-
+- idtv_info_valid = vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+-
+- if (enable_vnmi) {
+- if (vmx->loaded_vmcs->nmi_known_unmasked)
+- return;
+- /*
+- * Can't use vmx->exit_intr_info since we're not sure what
+- * the exit reason is.
+- */
+- exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+- unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
+- vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
+- /*
+- * SDM 3: 27.7.1.2 (September 2008)
+- * Re-set bit "block by NMI" before VM entry if vmexit caused by
+- * a guest IRET fault.
+- * SDM 3: 23.2.2 (September 2008)
+- * Bit 12 is undefined in any of the following cases:
+- * If the VM exit sets the valid bit in the IDT-vectoring
+- * information field.
+- * If the VM exit is due to a double fault.
+- */
+- if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
+- vector != DF_VECTOR && !idtv_info_valid)
+- vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
+- GUEST_INTR_STATE_NMI);
+- else
+- vmx->loaded_vmcs->nmi_known_unmasked =
+- !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
+- & GUEST_INTR_STATE_NMI);
+- } else if (unlikely(vmx->loaded_vmcs->soft_vnmi_blocked))
+- vmx->loaded_vmcs->vnmi_blocked_time +=
+- ktime_to_ns(ktime_sub(ktime_get(),
+- vmx->loaded_vmcs->entry_time));
+-}
+-
+-static void __vmx_complete_interrupts(struct kvm_vcpu *vcpu,
+- u32 idt_vectoring_info,
+- int instr_len_field,
+- int error_code_field)
+-{
+- u8 vector;
+- int type;
+- bool idtv_info_valid;
+-
+- idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
+-
+- vcpu->arch.nmi_injected = false;
+- kvm_clear_exception_queue(vcpu);
+- kvm_clear_interrupt_queue(vcpu);
+-
+- if (!idtv_info_valid)
+- return;
+-
+- kvm_make_request(KVM_REQ_EVENT, vcpu);
+-
+- vector = idt_vectoring_info & VECTORING_INFO_VECTOR_MASK;
+- type = idt_vectoring_info & VECTORING_INFO_TYPE_MASK;
+-
+- switch (type) {
+- case INTR_TYPE_NMI_INTR:
+- vcpu->arch.nmi_injected = true;
+- /*
+- * SDM 3: 27.7.1.2 (September 2008)
+- * Clear bit "block by NMI" before VM entry if a NMI
+- * delivery faulted.
+- */
+- vmx_set_nmi_mask(vcpu, false);
+- break;
+- case INTR_TYPE_SOFT_EXCEPTION:
+- vcpu->arch.event_exit_inst_len = vmcs_read32(instr_len_field);
+- /* fall through */
+- case INTR_TYPE_HARD_EXCEPTION:
+- if (idt_vectoring_info & VECTORING_INFO_DELIVER_CODE_MASK) {
+- u32 err = vmcs_read32(error_code_field);
+- kvm_requeue_exception_e(vcpu, vector, err);
+- } else
+- kvm_requeue_exception(vcpu, vector);
+- break;
+- case INTR_TYPE_SOFT_INTR:
+- vcpu->arch.event_exit_inst_len = vmcs_read32(instr_len_field);
+- /* fall through */
+- case INTR_TYPE_EXT_INTR:
+- kvm_queue_interrupt(vcpu, vector, type == INTR_TYPE_SOFT_INTR);
+- break;
+- default:
+- break;
+- }
+-}
+-
+-static void vmx_complete_interrupts(struct vcpu_vmx *vmx)
+-{
+- __vmx_complete_interrupts(&vmx->vcpu, vmx->idt_vectoring_info,
+- VM_EXIT_INSTRUCTION_LEN,
+- IDT_VECTORING_ERROR_CODE);
+-}
+-
+-static void vmx_cancel_injection(struct kvm_vcpu *vcpu)
+-{
+- __vmx_complete_interrupts(vcpu,
+- vmcs_read32(VM_ENTRY_INTR_INFO_FIELD),
+- VM_ENTRY_INSTRUCTION_LEN,
+- VM_ENTRY_EXCEPTION_ERROR_CODE);
+-
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0);
+-}
+-
+-static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx)
+-{
+- int i, nr_msrs;
+- struct perf_guest_switch_msr *msrs;
+-
+- msrs = perf_guest_get_msrs(&nr_msrs);
+-
+- if (!msrs)
+- return;
+-
+- for (i = 0; i < nr_msrs; i++)
+- if (msrs[i].host == msrs[i].guest)
+- clear_atomic_switch_msr(vmx, msrs[i].msr);
+- else
+- add_atomic_switch_msr(vmx, msrs[i].msr, msrs[i].guest,
+- msrs[i].host, false);
+-}
+-
+-static void vmx_arm_hv_timer(struct vcpu_vmx *vmx, u32 val)
+-{
+- vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, val);
+- if (!vmx->loaded_vmcs->hv_timer_armed)
+- vmcs_set_bits(PIN_BASED_VM_EXEC_CONTROL,
+- PIN_BASED_VMX_PREEMPTION_TIMER);
+- vmx->loaded_vmcs->hv_timer_armed = true;
+-}
+-
+-static void vmx_update_hv_timer(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u64 tscl;
+- u32 delta_tsc;
+-
+- if (vmx->req_immediate_exit) {
+- vmx_arm_hv_timer(vmx, 0);
+- return;
+- }
+-
+- if (vmx->hv_deadline_tsc != -1) {
+- tscl = rdtsc();
+- if (vmx->hv_deadline_tsc > tscl)
+- /* set_hv_timer ensures the delta fits in 32-bits */
+- delta_tsc = (u32)((vmx->hv_deadline_tsc - tscl) >>
+- cpu_preemption_timer_multi);
+- else
+- delta_tsc = 0;
+-
+- vmx_arm_hv_timer(vmx, delta_tsc);
+- return;
+- }
+-
+- if (vmx->loaded_vmcs->hv_timer_armed)
+- vmcs_clear_bits(PIN_BASED_VM_EXEC_CONTROL,
+- PIN_BASED_VMX_PREEMPTION_TIMER);
+- vmx->loaded_vmcs->hv_timer_armed = false;
+-}
+-
+-u64 __always_inline vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx)
+-{
+- u64 guestval, hostval = this_cpu_read(x86_spec_ctrl_current);
+-
+- if (!cpu_feature_enabled(X86_FEATURE_MSR_SPEC_CTRL))
+- return 0;
+-
+- guestval = __rdmsr(MSR_IA32_SPEC_CTRL);
+-
+- /*
+- *
+- * For legacy IBRS, the IBRS bit always needs to be written after
+- * transitioning from a less privileged predictor mode, regardless of
+- * whether the guest/host values differ.
+- */
+- if (cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS) ||
+- guestval != hostval)
+- native_wrmsrl(MSR_IA32_SPEC_CTRL, hostval);
+-
+- barrier_nospec();
+-
+- return guestval;
+-}
+-
+-static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long cr3, cr4, evmcs_rsp;
+- u64 spec_ctrl;
+-
+- /* Record the guest's net vcpu time for enforced NMI injections. */
+- if (unlikely(!enable_vnmi &&
+- vmx->loaded_vmcs->soft_vnmi_blocked))
+- vmx->loaded_vmcs->entry_time = ktime_get();
+-
+- /* Don't enter VMX if guest state is invalid, let the exit handler
+- start emulation until we arrive back to a valid state */
+- if (vmx->emulation_required)
+- return;
+-
+- if (vmx->ple_window_dirty) {
+- vmx->ple_window_dirty = false;
+- vmcs_write32(PLE_WINDOW, vmx->ple_window);
+- }
+-
+- if (vmx->nested.sync_shadow_vmcs) {
+- copy_vmcs12_to_shadow(vmx);
+- vmx->nested.sync_shadow_vmcs = false;
+- }
+-
+- if (test_bit(VCPU_REGS_RSP, (unsigned long *)&vcpu->arch.regs_dirty))
+- vmcs_writel(GUEST_RSP, vcpu->arch.regs[VCPU_REGS_RSP]);
+- if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
+- vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
+-
+- cr3 = __get_current_cr3_fast();
+- if (unlikely(cr3 != vmx->loaded_vmcs->host_state.cr3)) {
+- vmcs_writel(HOST_CR3, cr3);
+- vmx->loaded_vmcs->host_state.cr3 = cr3;
+- }
+-
+- cr4 = cr4_read_shadow();
+- if (unlikely(cr4 != vmx->loaded_vmcs->host_state.cr4)) {
+- vmcs_writel(HOST_CR4, cr4);
+- vmx->loaded_vmcs->host_state.cr4 = cr4;
+- }
+-
+- /* When single-stepping over STI and MOV SS, we must clear the
+- * corresponding interruptibility bits in the guest state. Otherwise
+- * vmentry fails as it then expects bit 14 (BS) in pending debug
+- * exceptions being set, but that's not correct for the guest debugging
+- * case. */
+- if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
+- vmx_set_interrupt_shadow(vcpu, 0);
+-
+- kvm_load_guest_xcr0(vcpu);
+-
+- if (static_cpu_has(X86_FEATURE_PKU) &&
+- kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
+- vcpu->arch.pkru != vmx->host_pkru)
+- __write_pkru(vcpu->arch.pkru);
+-
+- atomic_switch_perf_msrs(vmx);
+-
+- vmx_update_hv_timer(vcpu);
+-
+- /*
+- * If this vCPU has touched SPEC_CTRL, restore the guest's value if
+- * it's non-zero. Since vmentry is serialising on affected CPUs, there
+- * is no need to worry about the conditional branch over the wrmsr
+- * being speculatively taken.
+- */
+- x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
+-
+- vmx->__launched = vmx->loaded_vmcs->launched;
+-
+- evmcs_rsp = static_branch_unlikely(&enable_evmcs) ?
+- (unsigned long)¤t_evmcs->host_rsp : 0;
+-
+- /* L1D Flush includes CPU buffer clear to mitigate MDS */
+- if (static_branch_unlikely(&vmx_l1d_should_flush))
+- vmx_l1d_flush(vcpu);
+- else if (static_branch_unlikely(&mds_user_clear))
+- mds_clear_cpu_buffers();
+- else if (static_branch_unlikely(&mmio_stale_data_clear) &&
+- kvm_arch_has_assigned_device(vcpu->kvm))
+- mds_clear_cpu_buffers();
+-
+- vmx_disable_fb_clear(vmx);
+-
+- asm volatile (
+- /* Store host registers */
+- "push %%" _ASM_DX "; push %%" _ASM_BP ";"
+- "push %%" _ASM_CX " \n\t" /* placeholder for guest rcx */
+- "push %%" _ASM_CX " \n\t"
+- "cmp %%" _ASM_SP ", %c[host_rsp](%%" _ASM_CX ") \n\t"
+- "je 1f \n\t"
+- "mov %%" _ASM_SP ", %c[host_rsp](%%" _ASM_CX ") \n\t"
+- /* Avoid VMWRITE when Enlightened VMCS is in use */
+- "test %%" _ASM_SI ", %%" _ASM_SI " \n\t"
+- "jz 2f \n\t"
+- "mov %%" _ASM_SP ", (%%" _ASM_SI ") \n\t"
+- "jmp 1f \n\t"
+- "2: \n\t"
+- __ex(ASM_VMX_VMWRITE_RSP_RDX) "\n\t"
+- "1: \n\t"
+- /* Reload cr2 if changed */
+- "mov %c[cr2](%%" _ASM_CX "), %%" _ASM_AX " \n\t"
+- "mov %%cr2, %%" _ASM_DX " \n\t"
+- "cmp %%" _ASM_AX ", %%" _ASM_DX " \n\t"
+- "je 3f \n\t"
+- "mov %%" _ASM_AX", %%cr2 \n\t"
+- "3: \n\t"
+- /* Check if vmlaunch of vmresume is needed */
+- "cmpb $0, %c[launched](%%" _ASM_CX ") \n\t"
+- /* Load guest registers. Don't clobber flags. */
+- "mov %c[rax](%%" _ASM_CX "), %%" _ASM_AX " \n\t"
+- "mov %c[rbx](%%" _ASM_CX "), %%" _ASM_BX " \n\t"
+- "mov %c[rdx](%%" _ASM_CX "), %%" _ASM_DX " \n\t"
+- "mov %c[rsi](%%" _ASM_CX "), %%" _ASM_SI " \n\t"
+- "mov %c[rdi](%%" _ASM_CX "), %%" _ASM_DI " \n\t"
+- "mov %c[rbp](%%" _ASM_CX "), %%" _ASM_BP " \n\t"
+-#ifdef CONFIG_X86_64
+- "mov %c[r8](%%" _ASM_CX "), %%r8 \n\t"
+- "mov %c[r9](%%" _ASM_CX "), %%r9 \n\t"
+- "mov %c[r10](%%" _ASM_CX "), %%r10 \n\t"
+- "mov %c[r11](%%" _ASM_CX "), %%r11 \n\t"
+- "mov %c[r12](%%" _ASM_CX "), %%r12 \n\t"
+- "mov %c[r13](%%" _ASM_CX "), %%r13 \n\t"
+- "mov %c[r14](%%" _ASM_CX "), %%r14 \n\t"
+- "mov %c[r15](%%" _ASM_CX "), %%r15 \n\t"
+-#endif
+- /* Load guest RCX. This kills the vmx_vcpu pointer! */
+- "mov %c[rcx](%%" _ASM_CX "), %%" _ASM_CX " \n\t"
+-
+- /* Enter guest mode */
+- "jne 1f \n\t"
+- __ex(ASM_VMX_VMLAUNCH) "\n\t"
+- "jmp 2f \n\t"
+- "1: " __ex(ASM_VMX_VMRESUME) "\n\t"
+- "2: "
+-
+- /* Save guest's RCX to the stack placeholder (see above) */
+- "mov %%" _ASM_CX ", %c[wordsize](%%" _ASM_SP ") \n\t"
+-
+- /* Load host's RCX, i.e. the vmx_vcpu pointer */
+- "pop %%" _ASM_CX " \n\t"
+-
+- /* Set vmx->fail based on EFLAGS.{CF,ZF} */
+- "setbe %c[fail](%%" _ASM_CX ")\n\t"
+-
+- /* Save all guest registers, including RCX from the stack */
+- "mov %%" _ASM_AX ", %c[rax](%%" _ASM_CX ") \n\t"
+- "mov %%" _ASM_BX ", %c[rbx](%%" _ASM_CX ") \n\t"
+- __ASM_SIZE(pop) " %c[rcx](%%" _ASM_CX ") \n\t"
+- "mov %%" _ASM_DX ", %c[rdx](%%" _ASM_CX ") \n\t"
+- "mov %%" _ASM_SI ", %c[rsi](%%" _ASM_CX ") \n\t"
+- "mov %%" _ASM_DI ", %c[rdi](%%" _ASM_CX ") \n\t"
+- "mov %%" _ASM_BP ", %c[rbp](%%" _ASM_CX ") \n\t"
+-#ifdef CONFIG_X86_64
+- "mov %%r8, %c[r8](%%" _ASM_CX ") \n\t"
+- "mov %%r9, %c[r9](%%" _ASM_CX ") \n\t"
+- "mov %%r10, %c[r10](%%" _ASM_CX ") \n\t"
+- "mov %%r11, %c[r11](%%" _ASM_CX ") \n\t"
+- "mov %%r12, %c[r12](%%" _ASM_CX ") \n\t"
+- "mov %%r13, %c[r13](%%" _ASM_CX ") \n\t"
+- "mov %%r14, %c[r14](%%" _ASM_CX ") \n\t"
+- "mov %%r15, %c[r15](%%" _ASM_CX ") \n\t"
+-
+- /*
+- * Clear all general purpose registers (except RSP, which is loaded by
+- * the CPU during VM-Exit) to prevent speculative use of the guest's
+- * values, even those that are saved/loaded via the stack. In theory,
+- * an L1 cache miss when restoring registers could lead to speculative
+- * execution with the guest's values. Zeroing XORs are dirt cheap,
+- * i.e. the extra paranoia is essentially free.
+- */
+- "xor %%r8d, %%r8d \n\t"
+- "xor %%r9d, %%r9d \n\t"
+- "xor %%r10d, %%r10d \n\t"
+- "xor %%r11d, %%r11d \n\t"
+- "xor %%r12d, %%r12d \n\t"
+- "xor %%r13d, %%r13d \n\t"
+- "xor %%r14d, %%r14d \n\t"
+- "xor %%r15d, %%r15d \n\t"
+-#endif
+- "mov %%cr2, %%" _ASM_AX " \n\t"
+- "mov %%" _ASM_AX ", %c[cr2](%%" _ASM_CX ") \n\t"
+-
+- "xor %%eax, %%eax \n\t"
+- "xor %%ebx, %%ebx \n\t"
+- "xor %%ecx, %%ecx \n\t"
+- "xor %%edx, %%edx \n\t"
+- "xor %%esi, %%esi \n\t"
+- "xor %%edi, %%edi \n\t"
+- "xor %%ebp, %%ebp \n\t"
+- "pop %%" _ASM_BP "; pop %%" _ASM_DX " \n\t"
+- ".pushsection .rodata \n\t"
+- ".global vmx_return \n\t"
+- "vmx_return: " _ASM_PTR " 2b \n\t"
+- ".popsection"
+- : "=c"((int){0}), "=d"((int){0}), "=S"((int){0})
+- : "c"(vmx), "d"((unsigned long)HOST_RSP), "S"(evmcs_rsp),
+- [launched]"i"(offsetof(struct vcpu_vmx, __launched)),
+- [fail]"i"(offsetof(struct vcpu_vmx, fail)),
+- [host_rsp]"i"(offsetof(struct vcpu_vmx, host_rsp)),
+- [rax]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RAX])),
+- [rbx]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RBX])),
+- [rcx]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RCX])),
+- [rdx]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RDX])),
+- [rsi]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RSI])),
+- [rdi]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RDI])),
+- [rbp]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RBP])),
+-#ifdef CONFIG_X86_64
+- [r8]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R8])),
+- [r9]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R9])),
+- [r10]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R10])),
+- [r11]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R11])),
+- [r12]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R12])),
+- [r13]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R13])),
+- [r14]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R14])),
+- [r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
+-#endif
+- [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
+- [wordsize]"i"(sizeof(ulong))
+- : "cc", "memory"
+-#ifdef CONFIG_X86_64
+- , "rax", "rbx", "rdi"
+- , "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
+-#else
+- , "eax", "ebx", "edi"
+-#endif
+- );
+-
+- /*
+- * IMPORTANT: RSB filling and SPEC_CTRL handling must be done before
+- * the first unbalanced RET after vmexit!
+- *
+- * For retpoline or IBRS, RSB filling is needed to prevent poisoned RSB
+- * entries and (in some cases) RSB underflow.
+- *
+- * eIBRS has its own protection against poisoned RSB, so it doesn't
+- * need the RSB filling sequence. But it does need to be enabled, and a
+- * single call to retire, before the first unbalanced RET.
+- *
+- * So no RETs before vmx_spec_ctrl_restore_host() below.
+- */
+- vmexit_fill_RSB();
+-
+- /* Save this for below */
+- spec_ctrl = vmx_spec_ctrl_restore_host(vmx);
+-
+- vmx_enable_fb_clear(vmx);
+-
+- /*
+- * We do not use IBRS in the kernel. If this vCPU has used the
+- * SPEC_CTRL MSR it may have left it on; save the value and
+- * turn it off. This is much more efficient than blindly adding
+- * it to the atomic save/restore list. Especially as the former
+- * (Saving guest MSRs on vmexit) doesn't even exist in KVM.
+- *
+- * For non-nested case:
+- * If the L01 MSR bitmap does not intercept the MSR, then we need to
+- * save it.
+- *
+- * For nested case:
+- * If the L02 MSR bitmap does not intercept the MSR, then we need to
+- * save it.
+- */
+- if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)))
+- vmx->spec_ctrl = spec_ctrl;
+-
+- /* All fields are clean at this point */
+- if (static_branch_unlikely(&enable_evmcs))
+- current_evmcs->hv_clean_fields |=
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL;
+-
+- /* MSR_IA32_DEBUGCTLMSR is zeroed on vmexit. Restore it if needed */
+- if (vmx->host_debugctlmsr)
+- update_debugctlmsr(vmx->host_debugctlmsr);
+-
+-#ifndef CONFIG_X86_64
+- /*
+- * The sysexit path does not restore ds/es, so we must set them to
+- * a reasonable value ourselves.
+- *
+- * We can't defer this to vmx_prepare_switch_to_host() since that
+- * function may be executed in interrupt context, which saves and
+- * restore segments around it, nullifying its effect.
+- */
+- loadsegment(ds, __USER_DS);
+- loadsegment(es, __USER_DS);
+-#endif
+-
+- vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
+- | (1 << VCPU_EXREG_RFLAGS)
+- | (1 << VCPU_EXREG_PDPTR)
+- | (1 << VCPU_EXREG_SEGMENTS)
+- | (1 << VCPU_EXREG_CR3));
+- vcpu->arch.regs_dirty = 0;
+-
+- /*
+- * eager fpu is enabled if PKEY is supported and CR4 is switched
+- * back on host, so it is safe to read guest PKRU from current
+- * XSAVE.
+- */
+- if (static_cpu_has(X86_FEATURE_PKU) &&
+- kvm_read_cr4_bits(vcpu, X86_CR4_PKE)) {
+- vcpu->arch.pkru = __read_pkru();
+- if (vcpu->arch.pkru != vmx->host_pkru)
+- __write_pkru(vmx->host_pkru);
+- }
+-
+- kvm_put_guest_xcr0(vcpu);
+-
+- vmx->nested.nested_run_pending = 0;
+- vmx->idt_vectoring_info = 0;
+-
+- vmx->exit_reason = vmx->fail ? 0xdead : vmcs_read32(VM_EXIT_REASON);
+- if ((u16)vmx->exit_reason == EXIT_REASON_MCE_DURING_VMENTRY)
+- kvm_machine_check();
+-
+- if (vmx->fail || (vmx->exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY))
+- return;
+-
+- vmx->loaded_vmcs->launched = 1;
+- vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
+-
+- vmx_complete_atomic_exit(vmx);
+- vmx_recover_nmi_blocking(vmx);
+- vmx_complete_interrupts(vmx);
+-}
+-STACK_FRAME_NON_STANDARD(vmx_vcpu_run);
+-
+-static struct kvm *vmx_vm_alloc(void)
+-{
+- struct kvm_vmx *kvm_vmx = vzalloc(sizeof(struct kvm_vmx));
+-
+- if (!kvm_vmx)
+- return NULL;
+-
+- return &kvm_vmx->kvm;
+-}
+-
+-static void vmx_vm_free(struct kvm *kvm)
+-{
+- vfree(to_kvm_vmx(kvm));
+-}
+-
+-static void vmx_switch_vmcs(struct kvm_vcpu *vcpu, struct loaded_vmcs *vmcs)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int cpu;
+-
+- if (vmx->loaded_vmcs == vmcs)
+- return;
+-
+- cpu = get_cpu();
+- vmx_vcpu_put(vcpu);
+- vmx->loaded_vmcs = vmcs;
+- vmx_vcpu_load(vcpu, cpu);
+- put_cpu();
+-}
+-
+-/*
+- * Ensure that the current vmcs of the logical processor is the
+- * vmcs01 of the vcpu before calling free_nested().
+- */
+-static void vmx_free_vcpu_nested(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- vcpu_load(vcpu);
+- vmx_switch_vmcs(vcpu, &vmx->vmcs01);
+- free_nested(vmx);
+- vcpu_put(vcpu);
+-}
+-
+-static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (enable_pml)
+- vmx_destroy_pml_buffer(vmx);
+- free_vpid(vmx->vpid);
+- leave_guest_mode(vcpu);
+- vmx_free_vcpu_nested(vcpu);
+- free_loaded_vmcs(vmx->loaded_vmcs);
+- kfree(vmx->guest_msrs);
+- kvm_vcpu_uninit(vcpu);
+- kmem_cache_free(kvm_vcpu_cache, vmx);
+-}
+-
+-static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
+-{
+- int err;
+- struct vcpu_vmx *vmx = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
+- unsigned long *msr_bitmap;
+- int cpu;
+-
+- if (!vmx)
+- return ERR_PTR(-ENOMEM);
+-
+- vmx->vpid = allocate_vpid();
+-
+- err = kvm_vcpu_init(&vmx->vcpu, kvm, id);
+- if (err)
+- goto free_vcpu;
+-
+- err = -ENOMEM;
+-
+- /*
+- * If PML is turned on, failure on enabling PML just results in failure
+- * of creating the vcpu, therefore we can simplify PML logic (by
+- * avoiding dealing with cases, such as enabling PML partially on vcpus
+- * for the guest, etc.
+- */
+- if (enable_pml) {
+- vmx->pml_pg = alloc_page(GFP_KERNEL | __GFP_ZERO);
+- if (!vmx->pml_pg)
+- goto uninit_vcpu;
+- }
+-
+- vmx->guest_msrs = kmalloc(PAGE_SIZE, GFP_KERNEL);
+- BUILD_BUG_ON(ARRAY_SIZE(vmx_msr_index) * sizeof(vmx->guest_msrs[0])
+- > PAGE_SIZE);
+-
+- if (!vmx->guest_msrs)
+- goto free_pml;
+-
+- err = alloc_loaded_vmcs(&vmx->vmcs01);
+- if (err < 0)
+- goto free_msrs;
+-
+- msr_bitmap = vmx->vmcs01.msr_bitmap;
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_FS_BASE, MSR_TYPE_RW);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_GS_BASE, MSR_TYPE_RW);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_KERNEL_GS_BASE, MSR_TYPE_RW);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_CS, MSR_TYPE_RW);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_ESP, MSR_TYPE_RW);
+- vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_EIP, MSR_TYPE_RW);
+- vmx->msr_bitmap_mode = 0;
+-
+- vmx->loaded_vmcs = &vmx->vmcs01;
+- cpu = get_cpu();
+- vmx_vcpu_load(&vmx->vcpu, cpu);
+- vmx->vcpu.cpu = cpu;
+- vmx_vcpu_setup(vmx);
+- vmx_vcpu_put(&vmx->vcpu);
+- put_cpu();
+- if (cpu_need_virtualize_apic_accesses(&vmx->vcpu)) {
+- err = alloc_apic_access_page(kvm);
+- if (err)
+- goto free_vmcs;
+- }
+-
+- if (enable_ept && !enable_unrestricted_guest) {
+- err = init_rmode_identity_map(kvm);
+- if (err)
+- goto free_vmcs;
+- }
+-
+- if (nested)
+- nested_vmx_setup_ctls_msrs(&vmx->nested.msrs,
+- kvm_vcpu_apicv_active(&vmx->vcpu));
+-
+- vmx->nested.posted_intr_nv = -1;
+- vmx->nested.current_vmptr = -1ull;
+-
+- vmx->msr_ia32_feature_control_valid_bits = FEATURE_CONTROL_LOCKED;
+-
+- /*
+- * Enforce invariant: pi_desc.nv is always either POSTED_INTR_VECTOR
+- * or POSTED_INTR_WAKEUP_VECTOR.
+- */
+- vmx->pi_desc.nv = POSTED_INTR_VECTOR;
+- vmx->pi_desc.sn = 1;
+-
+- return &vmx->vcpu;
+-
+-free_vmcs:
+- free_loaded_vmcs(vmx->loaded_vmcs);
+-free_msrs:
+- kfree(vmx->guest_msrs);
+-free_pml:
+- vmx_destroy_pml_buffer(vmx);
+-uninit_vcpu:
+- kvm_vcpu_uninit(&vmx->vcpu);
+-free_vcpu:
+- free_vpid(vmx->vpid);
+- kmem_cache_free(kvm_vcpu_cache, vmx);
+- return ERR_PTR(err);
+-}
+-
+-#define L1TF_MSG_SMT "L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
+-#define L1TF_MSG_L1D "L1TF CPU bug present and virtualization mitigation disabled, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
+-
+-static int vmx_vm_init(struct kvm *kvm)
+-{
+- spin_lock_init(&to_kvm_vmx(kvm)->ept_pointer_lock);
+-
+- if (!ple_gap)
+- kvm->arch.pause_in_guest = true;
+-
+- if (boot_cpu_has(X86_BUG_L1TF) && enable_ept) {
+- switch (l1tf_mitigation) {
+- case L1TF_MITIGATION_OFF:
+- case L1TF_MITIGATION_FLUSH_NOWARN:
+- /* 'I explicitly don't care' is set */
+- break;
+- case L1TF_MITIGATION_FLUSH:
+- case L1TF_MITIGATION_FLUSH_NOSMT:
+- case L1TF_MITIGATION_FULL:
+- /*
+- * Warn upon starting the first VM in a potentially
+- * insecure environment.
+- */
+- if (sched_smt_active())
+- pr_warn_once(L1TF_MSG_SMT);
+- if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER)
+- pr_warn_once(L1TF_MSG_L1D);
+- break;
+- case L1TF_MITIGATION_FULL_FORCE:
+- /* Flush is enforced */
+- break;
+- }
+- }
+- return 0;
+-}
+-
+-static void __init vmx_check_processor_compat(void *rtn)
+-{
+- struct vmcs_config vmcs_conf;
+-
+- *(int *)rtn = 0;
+- if (setup_vmcs_config(&vmcs_conf) < 0)
+- *(int *)rtn = -EIO;
+- nested_vmx_setup_ctls_msrs(&vmcs_conf.nested, enable_apicv);
+- if (memcmp(&vmcs_config, &vmcs_conf, sizeof(struct vmcs_config)) != 0) {
+- printk(KERN_ERR "kvm: CPU %d feature inconsistency!\n",
+- smp_processor_id());
+- *(int *)rtn = -EIO;
+- }
+-}
+-
+-static u64 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
+-{
+- u8 cache;
+- u64 ipat = 0;
+-
+- /* For VT-d and EPT combination
+- * 1. MMIO: always map as UC
+- * 2. EPT with VT-d:
+- * a. VT-d without snooping control feature: can't guarantee the
+- * result, try to trust guest.
+- * b. VT-d with snooping control feature: snooping control feature of
+- * VT-d engine can guarantee the cache correctness. Just set it
+- * to WB to keep consistent with host. So the same as item 3.
+- * 3. EPT without VT-d: always map as WB and set IPAT=1 to keep
+- * consistent with host MTRR
+- */
+- if (is_mmio) {
+- cache = MTRR_TYPE_UNCACHABLE;
+- goto exit;
+- }
+-
+- if (!kvm_arch_has_noncoherent_dma(vcpu->kvm)) {
+- ipat = VMX_EPT_IPAT_BIT;
+- cache = MTRR_TYPE_WRBACK;
+- goto exit;
+- }
+-
+- if (kvm_read_cr0(vcpu) & X86_CR0_CD) {
+- ipat = VMX_EPT_IPAT_BIT;
+- if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
+- cache = MTRR_TYPE_WRBACK;
+- else
+- cache = MTRR_TYPE_UNCACHABLE;
+- goto exit;
+- }
+-
+- cache = kvm_mtrr_get_guest_memory_type(vcpu, gfn);
+-
+-exit:
+- return (cache << VMX_EPT_MT_EPTE_SHIFT) | ipat;
+-}
+-
+-static int vmx_get_lpage_level(void)
+-{
+- if (enable_ept && !cpu_has_vmx_ept_1g_page())
+- return PT_DIRECTORY_LEVEL;
+- else
+- /* For shadow and EPT supported 1GB page */
+- return PT_PDPE_LEVEL;
+-}
+-
+-static void vmcs_set_secondary_exec_control(u32 new_ctl)
+-{
+- /*
+- * These bits in the secondary execution controls field
+- * are dynamic, the others are mostly based on the hypervisor
+- * architecture and the guest's CPUID. Do not touch the
+- * dynamic bits.
+- */
+- u32 mask =
+- SECONDARY_EXEC_SHADOW_VMCS |
+- SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
+- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+- SECONDARY_EXEC_DESC;
+-
+- u32 cur_ctl = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
+-
+- vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
+- (new_ctl & ~mask) | (cur_ctl & mask));
+-}
+-
+-/*
+- * Generate MSR_IA32_VMX_CR{0,4}_FIXED1 according to CPUID. Only set bits
+- * (indicating "allowed-1") if they are supported in the guest's CPUID.
+- */
+-static void nested_vmx_cr_fixed1_bits_update(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct kvm_cpuid_entry2 *entry;
+-
+- vmx->nested.msrs.cr0_fixed1 = 0xffffffff;
+- vmx->nested.msrs.cr4_fixed1 = X86_CR4_PCE;
+-
+-#define cr4_fixed1_update(_cr4_mask, _reg, _cpuid_mask) do { \
+- if (entry && (entry->_reg & (_cpuid_mask))) \
+- vmx->nested.msrs.cr4_fixed1 |= (_cr4_mask); \
+-} while (0)
+-
+- entry = kvm_find_cpuid_entry(vcpu, 0x1, 0);
+- cr4_fixed1_update(X86_CR4_VME, edx, bit(X86_FEATURE_VME));
+- cr4_fixed1_update(X86_CR4_PVI, edx, bit(X86_FEATURE_VME));
+- cr4_fixed1_update(X86_CR4_TSD, edx, bit(X86_FEATURE_TSC));
+- cr4_fixed1_update(X86_CR4_DE, edx, bit(X86_FEATURE_DE));
+- cr4_fixed1_update(X86_CR4_PSE, edx, bit(X86_FEATURE_PSE));
+- cr4_fixed1_update(X86_CR4_PAE, edx, bit(X86_FEATURE_PAE));
+- cr4_fixed1_update(X86_CR4_MCE, edx, bit(X86_FEATURE_MCE));
+- cr4_fixed1_update(X86_CR4_PGE, edx, bit(X86_FEATURE_PGE));
+- cr4_fixed1_update(X86_CR4_OSFXSR, edx, bit(X86_FEATURE_FXSR));
+- cr4_fixed1_update(X86_CR4_OSXMMEXCPT, edx, bit(X86_FEATURE_XMM));
+- cr4_fixed1_update(X86_CR4_VMXE, ecx, bit(X86_FEATURE_VMX));
+- cr4_fixed1_update(X86_CR4_SMXE, ecx, bit(X86_FEATURE_SMX));
+- cr4_fixed1_update(X86_CR4_PCIDE, ecx, bit(X86_FEATURE_PCID));
+- cr4_fixed1_update(X86_CR4_OSXSAVE, ecx, bit(X86_FEATURE_XSAVE));
+-
+- entry = kvm_find_cpuid_entry(vcpu, 0x7, 0);
+- cr4_fixed1_update(X86_CR4_FSGSBASE, ebx, bit(X86_FEATURE_FSGSBASE));
+- cr4_fixed1_update(X86_CR4_SMEP, ebx, bit(X86_FEATURE_SMEP));
+- cr4_fixed1_update(X86_CR4_SMAP, ebx, bit(X86_FEATURE_SMAP));
+- cr4_fixed1_update(X86_CR4_PKE, ecx, bit(X86_FEATURE_PKU));
+- cr4_fixed1_update(X86_CR4_UMIP, ecx, bit(X86_FEATURE_UMIP));
+-
+-#undef cr4_fixed1_update
+-}
+-
+-static void nested_vmx_entry_exit_ctls_update(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (kvm_mpx_supported()) {
+- bool mpx_enabled = guest_cpuid_has(vcpu, X86_FEATURE_MPX);
+-
+- if (mpx_enabled) {
+- vmx->nested.msrs.entry_ctls_high |= VM_ENTRY_LOAD_BNDCFGS;
+- vmx->nested.msrs.exit_ctls_high |= VM_EXIT_CLEAR_BNDCFGS;
+- } else {
+- vmx->nested.msrs.entry_ctls_high &= ~VM_ENTRY_LOAD_BNDCFGS;
+- vmx->nested.msrs.exit_ctls_high &= ~VM_EXIT_CLEAR_BNDCFGS;
+- }
+- }
+-}
+-
+-static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (cpu_has_secondary_exec_ctrls()) {
+- vmx_compute_secondary_exec_control(vmx);
+- vmcs_set_secondary_exec_control(vmx->secondary_exec_control);
+- }
+-
+- if (nested_vmx_allowed(vcpu))
+- to_vmx(vcpu)->msr_ia32_feature_control_valid_bits |=
+- FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
+- else
+- to_vmx(vcpu)->msr_ia32_feature_control_valid_bits &=
+- ~FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
+-
+- if (nested_vmx_allowed(vcpu)) {
+- nested_vmx_cr_fixed1_bits_update(vcpu);
+- nested_vmx_entry_exit_ctls_update(vcpu);
+- }
+-}
+-
+-static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
+-{
+- if (func == 1 && nested)
+- entry->ecx |= bit(X86_FEATURE_VMX);
+-}
+-
+-static void nested_ept_inject_page_fault(struct kvm_vcpu *vcpu,
+- struct x86_exception *fault)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 exit_reason;
+- unsigned long exit_qualification = vcpu->arch.exit_qualification;
+-
+- if (vmx->nested.pml_full) {
+- exit_reason = EXIT_REASON_PML_FULL;
+- vmx->nested.pml_full = false;
+- exit_qualification &= INTR_INFO_UNBLOCK_NMI;
+- } else if (fault->error_code & PFERR_RSVD_MASK)
+- exit_reason = EXIT_REASON_EPT_MISCONFIG;
+- else
+- exit_reason = EXIT_REASON_EPT_VIOLATION;
+-
+- nested_vmx_vmexit(vcpu, exit_reason, 0, exit_qualification);
+- vmcs12->guest_physical_address = fault->address;
+-}
+-
+-static bool nested_ept_ad_enabled(struct kvm_vcpu *vcpu)
+-{
+- return nested_ept_get_cr3(vcpu) & VMX_EPTP_AD_ENABLE_BIT;
+-}
+-
+-/* Callbacks for nested_ept_init_mmu_context: */
+-
+-static unsigned long nested_ept_get_cr3(struct kvm_vcpu *vcpu)
+-{
+- /* return the page table to be shadowed - in our case, EPT12 */
+- return get_vmcs12(vcpu)->ept_pointer;
+-}
+-
+-static int nested_ept_init_mmu_context(struct kvm_vcpu *vcpu)
+-{
+- WARN_ON(mmu_is_nested(vcpu));
+- if (!valid_ept_address(vcpu, nested_ept_get_cr3(vcpu)))
+- return 1;
+-
+- kvm_init_shadow_ept_mmu(vcpu,
+- to_vmx(vcpu)->nested.msrs.ept_caps &
+- VMX_EPT_EXECUTE_ONLY_BIT,
+- nested_ept_ad_enabled(vcpu),
+- nested_ept_get_cr3(vcpu));
+- vcpu->arch.mmu.set_cr3 = vmx_set_cr3;
+- vcpu->arch.mmu.get_cr3 = nested_ept_get_cr3;
+- vcpu->arch.mmu.inject_page_fault = nested_ept_inject_page_fault;
+-
+- vcpu->arch.walk_mmu = &vcpu->arch.nested_mmu;
+- return 0;
+-}
+-
+-static void nested_ept_uninit_mmu_context(struct kvm_vcpu *vcpu)
+-{
+- vcpu->arch.walk_mmu = &vcpu->arch.mmu;
+-}
+-
+-static bool nested_vmx_is_page_fault_vmexit(struct vmcs12 *vmcs12,
+- u16 error_code)
+-{
+- bool inequality, bit;
+-
+- bit = (vmcs12->exception_bitmap & (1u << PF_VECTOR)) != 0;
+- inequality =
+- (error_code & vmcs12->page_fault_error_code_mask) !=
+- vmcs12->page_fault_error_code_match;
+- return inequality ^ bit;
+-}
+-
+-static void vmx_inject_page_fault_nested(struct kvm_vcpu *vcpu,
+- struct x86_exception *fault)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+-
+- WARN_ON(!is_guest_mode(vcpu));
+-
+- if (nested_vmx_is_page_fault_vmexit(vmcs12, fault->error_code) &&
+- !to_vmx(vcpu)->nested.nested_run_pending) {
+- vmcs12->vm_exit_intr_error_code = fault->error_code;
+- nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
+- PF_VECTOR | INTR_TYPE_HARD_EXCEPTION |
+- INTR_INFO_DELIVER_CODE_MASK | INTR_INFO_VALID_MASK,
+- fault->address);
+- } else {
+- kvm_inject_page_fault(vcpu, fault);
+- }
+-}
+-
+-static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12);
+-
+-static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct page *page;
+- u64 hpa;
+-
+- if (nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+- /*
+- * Translate L1 physical address to host physical
+- * address for vmcs02. Keep the page pinned, so this
+- * physical address remains valid. We keep a reference
+- * to it so we can release it later.
+- */
+- if (vmx->nested.apic_access_page) { /* shouldn't happen */
+- kvm_release_page_dirty(vmx->nested.apic_access_page);
+- vmx->nested.apic_access_page = NULL;
+- }
+- page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->apic_access_addr);
+- /*
+- * If translation failed, no matter: This feature asks
+- * to exit when accessing the given address, and if it
+- * can never be accessed, this feature won't do
+- * anything anyway.
+- */
+- if (!is_error_page(page)) {
+- vmx->nested.apic_access_page = page;
+- hpa = page_to_phys(vmx->nested.apic_access_page);
+- vmcs_write64(APIC_ACCESS_ADDR, hpa);
+- } else {
+- vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL,
+- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES);
+- }
+- }
+-
+- if (nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW)) {
+- if (vmx->nested.virtual_apic_page) { /* shouldn't happen */
+- kvm_release_page_dirty(vmx->nested.virtual_apic_page);
+- vmx->nested.virtual_apic_page = NULL;
+- }
+- page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->virtual_apic_page_addr);
+-
+- /*
+- * If translation failed, VM entry will fail because
+- * prepare_vmcs02 set VIRTUAL_APIC_PAGE_ADDR to -1ull.
+- * Failing the vm entry is _not_ what the processor
+- * does but it's basically the only possibility we
+- * have. We could still enter the guest if CR8 load
+- * exits are enabled, CR8 store exits are enabled, and
+- * virtualize APIC access is disabled; in this case
+- * the processor would never use the TPR shadow and we
+- * could simply clear the bit from the execution
+- * control. But such a configuration is useless, so
+- * let's keep the code simple.
+- */
+- if (!is_error_page(page)) {
+- vmx->nested.virtual_apic_page = page;
+- hpa = page_to_phys(vmx->nested.virtual_apic_page);
+- vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, hpa);
+- }
+- }
+-
+- if (nested_cpu_has_posted_intr(vmcs12)) {
+- if (vmx->nested.pi_desc_page) { /* shouldn't happen */
+- kunmap(vmx->nested.pi_desc_page);
+- kvm_release_page_dirty(vmx->nested.pi_desc_page);
+- vmx->nested.pi_desc_page = NULL;
+- vmx->nested.pi_desc = NULL;
+- vmcs_write64(POSTED_INTR_DESC_ADDR, -1ull);
+- }
+- page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->posted_intr_desc_addr);
+- if (is_error_page(page))
+- return;
+- vmx->nested.pi_desc_page = page;
+- vmx->nested.pi_desc = kmap(vmx->nested.pi_desc_page);
+- vmx->nested.pi_desc =
+- (struct pi_desc *)((void *)vmx->nested.pi_desc +
+- (unsigned long)(vmcs12->posted_intr_desc_addr &
+- (PAGE_SIZE - 1)));
+- vmcs_write64(POSTED_INTR_DESC_ADDR,
+- page_to_phys(vmx->nested.pi_desc_page) +
+- (unsigned long)(vmcs12->posted_intr_desc_addr &
+- (PAGE_SIZE - 1)));
+- }
+- if (nested_vmx_prepare_msr_bitmap(vcpu, vmcs12))
+- vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL,
+- CPU_BASED_USE_MSR_BITMAPS);
+- else
+- vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
+- CPU_BASED_USE_MSR_BITMAPS);
+-}
+-
+-static void vmx_start_preemption_timer(struct kvm_vcpu *vcpu)
+-{
+- u64 preemption_timeout = get_vmcs12(vcpu)->vmx_preemption_timer_value;
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- /*
+- * A timer value of zero is architecturally guaranteed to cause
+- * a VMExit prior to executing any instructions in the guest.
+- */
+- if (preemption_timeout == 0) {
+- vmx_preemption_timer_fn(&vmx->nested.preemption_timer);
+- return;
+- }
+-
+- if (vcpu->arch.virtual_tsc_khz == 0)
+- return;
+-
+- preemption_timeout <<= VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE;
+- preemption_timeout *= 1000000;
+- do_div(preemption_timeout, vcpu->arch.virtual_tsc_khz);
+- hrtimer_start(&vmx->nested.preemption_timer,
+- ns_to_ktime(preemption_timeout), HRTIMER_MODE_REL);
+-}
+-
+-static int nested_vmx_check_io_bitmap_controls(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- if (!nested_cpu_has(vmcs12, CPU_BASED_USE_IO_BITMAPS))
+- return 0;
+-
+- if (!page_address_valid(vcpu, vmcs12->io_bitmap_a) ||
+- !page_address_valid(vcpu, vmcs12->io_bitmap_b))
+- return -EINVAL;
+-
+- return 0;
+-}
+-
+-static int nested_vmx_check_msr_bitmap_controls(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- if (!nested_cpu_has(vmcs12, CPU_BASED_USE_MSR_BITMAPS))
+- return 0;
+-
+- if (!page_address_valid(vcpu, vmcs12->msr_bitmap))
+- return -EINVAL;
+-
+- return 0;
+-}
+-
+-static int nested_vmx_check_tpr_shadow_controls(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- if (!nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
+- return 0;
+-
+- if (!page_address_valid(vcpu, vmcs12->virtual_apic_page_addr))
+- return -EINVAL;
+-
+- return 0;
+-}
+-
+-static inline void enable_x2apic_msr_intercepts(unsigned long *msr_bitmap) {
+- int msr;
+-
+- for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
+- unsigned word = msr / BITS_PER_LONG;
+-
+- msr_bitmap[word] = ~0;
+- msr_bitmap[word + (0x800 / sizeof(long))] = ~0;
+- }
+-}
+-
+-/*
+- * Merge L0's and L1's MSR bitmap, return false to indicate that
+- * we do not use the hardware.
+- */
+-static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- int msr;
+- struct page *page;
+- unsigned long *msr_bitmap_l1;
+- unsigned long *msr_bitmap_l0 = to_vmx(vcpu)->nested.vmcs02.msr_bitmap;
+- /*
+- * pred_cmd & spec_ctrl are trying to verify two things:
+- *
+- * 1. L0 gave a permission to L1 to actually passthrough the MSR. This
+- * ensures that we do not accidentally generate an L02 MSR bitmap
+- * from the L12 MSR bitmap that is too permissive.
+- * 2. That L1 or L2s have actually used the MSR. This avoids
+- * unnecessarily merging of the bitmap if the MSR is unused. This
+- * works properly because we only update the L01 MSR bitmap lazily.
+- * So even if L0 should pass L1 these MSRs, the L01 bitmap is only
+- * updated to reflect this when L1 (or its L2s) actually write to
+- * the MSR.
+- */
+- bool pred_cmd = !msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD);
+- bool spec_ctrl = !msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL);
+-
+- /* Nothing to do if the MSR bitmap is not in use. */
+- if (!cpu_has_vmx_msr_bitmap() ||
+- !nested_cpu_has(vmcs12, CPU_BASED_USE_MSR_BITMAPS))
+- return false;
+-
+- if (!nested_cpu_has_virt_x2apic_mode(vmcs12) &&
+- !pred_cmd && !spec_ctrl)
+- return false;
+-
+- page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->msr_bitmap);
+- if (is_error_page(page))
+- return false;
+-
+- msr_bitmap_l1 = (unsigned long *)kmap(page);
+-
+- /*
+- * To keep the control flow simple, pay eight 8-byte writes (sixteen
+- * 4-byte writes on 32-bit systems) up front to enable intercepts for
+- * the x2APIC MSR range and selectively disable them below.
+- */
+- enable_x2apic_msr_intercepts(msr_bitmap_l0);
+-
+- if (nested_cpu_has_virt_x2apic_mode(vmcs12)) {
+- if (nested_cpu_has_apic_reg_virt(vmcs12)) {
+- /*
+- * L0 need not intercept reads for MSRs between 0x800
+- * and 0x8ff, it just lets the processor take the value
+- * from the virtual-APIC page; take those 256 bits
+- * directly from the L1 bitmap.
+- */
+- for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
+- unsigned word = msr / BITS_PER_LONG;
+-
+- msr_bitmap_l0[word] = msr_bitmap_l1[word];
+- }
+- }
+-
+- nested_vmx_disable_intercept_for_msr(
+- msr_bitmap_l1, msr_bitmap_l0,
+- X2APIC_MSR(APIC_TASKPRI),
+- MSR_TYPE_R | MSR_TYPE_W);
+-
+- if (nested_cpu_has_vid(vmcs12)) {
+- nested_vmx_disable_intercept_for_msr(
+- msr_bitmap_l1, msr_bitmap_l0,
+- X2APIC_MSR(APIC_EOI),
+- MSR_TYPE_W);
+- nested_vmx_disable_intercept_for_msr(
+- msr_bitmap_l1, msr_bitmap_l0,
+- X2APIC_MSR(APIC_SELF_IPI),
+- MSR_TYPE_W);
+- }
+- }
+-
+- if (spec_ctrl)
+- nested_vmx_disable_intercept_for_msr(
+- msr_bitmap_l1, msr_bitmap_l0,
+- MSR_IA32_SPEC_CTRL,
+- MSR_TYPE_R | MSR_TYPE_W);
+-
+- if (pred_cmd)
+- nested_vmx_disable_intercept_for_msr(
+- msr_bitmap_l1, msr_bitmap_l0,
+- MSR_IA32_PRED_CMD,
+- MSR_TYPE_W);
+-
+- kunmap(page);
+- kvm_release_page_clean(page);
+-
+- return true;
+-}
+-
+-static void nested_cache_shadow_vmcs12(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- struct vmcs12 *shadow;
+- struct page *page;
+-
+- if (!nested_cpu_has_shadow_vmcs(vmcs12) ||
+- vmcs12->vmcs_link_pointer == -1ull)
+- return;
+-
+- shadow = get_shadow_vmcs12(vcpu);
+- page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->vmcs_link_pointer);
+-
+- memcpy(shadow, kmap(page), VMCS12_SIZE);
+-
+- kunmap(page);
+- kvm_release_page_clean(page);
+-}
+-
+-static void nested_flush_cached_shadow_vmcs12(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (!nested_cpu_has_shadow_vmcs(vmcs12) ||
+- vmcs12->vmcs_link_pointer == -1ull)
+- return;
+-
+- kvm_write_guest(vmx->vcpu.kvm, vmcs12->vmcs_link_pointer,
+- get_shadow_vmcs12(vcpu), VMCS12_SIZE);
+-}
+-
+-static int nested_vmx_check_apic_access_controls(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- if (nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES) &&
+- !page_address_valid(vcpu, vmcs12->apic_access_addr))
+- return -EINVAL;
+- else
+- return 0;
+-}
+-
+-static int nested_vmx_check_apicv_controls(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- if (!nested_cpu_has_virt_x2apic_mode(vmcs12) &&
+- !nested_cpu_has_apic_reg_virt(vmcs12) &&
+- !nested_cpu_has_vid(vmcs12) &&
+- !nested_cpu_has_posted_intr(vmcs12))
+- return 0;
+-
+- /*
+- * If virtualize x2apic mode is enabled,
+- * virtualize apic access must be disabled.
+- */
+- if (nested_cpu_has_virt_x2apic_mode(vmcs12) &&
+- nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES))
+- return -EINVAL;
+-
+- /*
+- * If virtual interrupt delivery is enabled,
+- * we must exit on external interrupts.
+- */
+- if (nested_cpu_has_vid(vmcs12) &&
+- !nested_exit_on_intr(vcpu))
+- return -EINVAL;
+-
+- /*
+- * bits 15:8 should be zero in posted_intr_nv,
+- * the descriptor address has been already checked
+- * in nested_get_vmcs12_pages.
+- *
+- * bits 5:0 of posted_intr_desc_addr should be zero.
+- */
+- if (nested_cpu_has_posted_intr(vmcs12) &&
+- (!nested_cpu_has_vid(vmcs12) ||
+- !nested_exit_intr_ack_set(vcpu) ||
+- (vmcs12->posted_intr_nv & 0xff00) ||
+- (vmcs12->posted_intr_desc_addr & 0x3f) ||
+- (vmcs12->posted_intr_desc_addr >> cpuid_maxphyaddr(vcpu))))
+- return -EINVAL;
+-
+- /* tpr shadow is needed by all apicv features. */
+- if (!nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
+- return -EINVAL;
+-
+- return 0;
+-}
+-
+-static int nested_vmx_check_msr_switch(struct kvm_vcpu *vcpu,
+- unsigned long count_field,
+- unsigned long addr_field)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- int maxphyaddr;
+- u64 count, addr;
+-
+- if (vmcs12_read_any(vmcs12, count_field, &count) ||
+- vmcs12_read_any(vmcs12, addr_field, &addr)) {
+- WARN_ON(1);
+- return -EINVAL;
+- }
+- if (count == 0)
+- return 0;
+- maxphyaddr = cpuid_maxphyaddr(vcpu);
+- if (!IS_ALIGNED(addr, 16) || addr >> maxphyaddr ||
+- (addr + count * sizeof(struct vmx_msr_entry) - 1) >> maxphyaddr) {
+- pr_debug_ratelimited(
+- "nVMX: invalid MSR switch (0x%lx, %d, %llu, 0x%08llx)",
+- addr_field, maxphyaddr, count, addr);
+- return -EINVAL;
+- }
+- return 0;
+-}
+-
+-static int nested_vmx_check_msr_switch_controls(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- if (vmcs12->vm_exit_msr_load_count == 0 &&
+- vmcs12->vm_exit_msr_store_count == 0 &&
+- vmcs12->vm_entry_msr_load_count == 0)
+- return 0; /* Fast path */
+- if (nested_vmx_check_msr_switch(vcpu, VM_EXIT_MSR_LOAD_COUNT,
+- VM_EXIT_MSR_LOAD_ADDR) ||
+- nested_vmx_check_msr_switch(vcpu, VM_EXIT_MSR_STORE_COUNT,
+- VM_EXIT_MSR_STORE_ADDR) ||
+- nested_vmx_check_msr_switch(vcpu, VM_ENTRY_MSR_LOAD_COUNT,
+- VM_ENTRY_MSR_LOAD_ADDR))
+- return -EINVAL;
+- return 0;
+-}
+-
+-static int nested_vmx_check_pml_controls(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- u64 address = vmcs12->pml_address;
+- int maxphyaddr = cpuid_maxphyaddr(vcpu);
+-
+- if (nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_PML)) {
+- if (!nested_cpu_has_ept(vmcs12) ||
+- !IS_ALIGNED(address, 4096) ||
+- address >> maxphyaddr)
+- return -EINVAL;
+- }
+-
+- return 0;
+-}
+-
+-static int nested_vmx_check_shadow_vmcs_controls(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- if (!nested_cpu_has_shadow_vmcs(vmcs12))
+- return 0;
+-
+- if (!page_address_valid(vcpu, vmcs12->vmread_bitmap) ||
+- !page_address_valid(vcpu, vmcs12->vmwrite_bitmap))
+- return -EINVAL;
+-
+- return 0;
+-}
+-
+-static int nested_vmx_msr_check_common(struct kvm_vcpu *vcpu,
+- struct vmx_msr_entry *e)
+-{
+- /* x2APIC MSR accesses are not allowed */
+- if (vcpu->arch.apic_base & X2APIC_ENABLE && e->index >> 8 == 0x8)
+- return -EINVAL;
+- if (e->index == MSR_IA32_UCODE_WRITE || /* SDM Table 35-2 */
+- e->index == MSR_IA32_UCODE_REV)
+- return -EINVAL;
+- if (e->reserved != 0)
+- return -EINVAL;
+- return 0;
+-}
+-
+-static int nested_vmx_load_msr_check(struct kvm_vcpu *vcpu,
+- struct vmx_msr_entry *e)
+-{
+- if (e->index == MSR_FS_BASE ||
+- e->index == MSR_GS_BASE ||
+- e->index == MSR_IA32_SMM_MONITOR_CTL || /* SMM is not supported */
+- nested_vmx_msr_check_common(vcpu, e))
+- return -EINVAL;
+- return 0;
+-}
+-
+-static int nested_vmx_store_msr_check(struct kvm_vcpu *vcpu,
+- struct vmx_msr_entry *e)
+-{
+- if (e->index == MSR_IA32_SMBASE || /* SMM is not supported */
+- nested_vmx_msr_check_common(vcpu, e))
+- return -EINVAL;
+- return 0;
+-}
+-
+-/*
+- * Load guest's/host's msr at nested entry/exit.
+- * return 0 for success, entry index for failure.
+- */
+-static u32 nested_vmx_load_msr(struct kvm_vcpu *vcpu, u64 gpa, u32 count)
+-{
+- u32 i;
+- struct vmx_msr_entry e;
+- struct msr_data msr;
+-
+- msr.host_initiated = false;
+- for (i = 0; i < count; i++) {
+- if (kvm_vcpu_read_guest(vcpu, gpa + i * sizeof(e),
+- &e, sizeof(e))) {
+- pr_debug_ratelimited(
+- "%s cannot read MSR entry (%u, 0x%08llx)\n",
+- __func__, i, gpa + i * sizeof(e));
+- goto fail;
+- }
+- if (nested_vmx_load_msr_check(vcpu, &e)) {
+- pr_debug_ratelimited(
+- "%s check failed (%u, 0x%x, 0x%x)\n",
+- __func__, i, e.index, e.reserved);
+- goto fail;
+- }
+- msr.index = e.index;
+- msr.data = e.value;
+- if (kvm_set_msr(vcpu, &msr)) {
+- pr_debug_ratelimited(
+- "%s cannot write MSR (%u, 0x%x, 0x%llx)\n",
+- __func__, i, e.index, e.value);
+- goto fail;
+- }
+- }
+- return 0;
+-fail:
+- return i + 1;
+-}
+-
+-static int nested_vmx_store_msr(struct kvm_vcpu *vcpu, u64 gpa, u32 count)
+-{
+- u32 i;
+- struct vmx_msr_entry e;
+-
+- for (i = 0; i < count; i++) {
+- struct msr_data msr_info;
+- if (kvm_vcpu_read_guest(vcpu,
+- gpa + i * sizeof(e),
+- &e, 2 * sizeof(u32))) {
+- pr_debug_ratelimited(
+- "%s cannot read MSR entry (%u, 0x%08llx)\n",
+- __func__, i, gpa + i * sizeof(e));
+- return -EINVAL;
+- }
+- if (nested_vmx_store_msr_check(vcpu, &e)) {
+- pr_debug_ratelimited(
+- "%s check failed (%u, 0x%x, 0x%x)\n",
+- __func__, i, e.index, e.reserved);
+- return -EINVAL;
+- }
+- msr_info.host_initiated = false;
+- msr_info.index = e.index;
+- if (kvm_get_msr(vcpu, &msr_info)) {
+- pr_debug_ratelimited(
+- "%s cannot read MSR (%u, 0x%x)\n",
+- __func__, i, e.index);
+- return -EINVAL;
+- }
+- if (kvm_vcpu_write_guest(vcpu,
+- gpa + i * sizeof(e) +
+- offsetof(struct vmx_msr_entry, value),
+- &msr_info.data, sizeof(msr_info.data))) {
+- pr_debug_ratelimited(
+- "%s cannot write MSR (%u, 0x%x, 0x%llx)\n",
+- __func__, i, e.index, msr_info.data);
+- return -EINVAL;
+- }
+- }
+- return 0;
+-}
+-
+-static bool nested_cr3_valid(struct kvm_vcpu *vcpu, unsigned long val)
+-{
+- unsigned long invalid_mask;
+-
+- invalid_mask = (~0ULL) << cpuid_maxphyaddr(vcpu);
+- return (val & invalid_mask) == 0;
+-}
+-
+-/*
+- * Load guest's/host's cr3 at nested entry/exit. nested_ept is true if we are
+- * emulating VM entry into a guest with EPT enabled.
+- * Returns 0 on success, 1 on failure. Invalid state exit qualification code
+- * is assigned to entry_failure_code on failure.
+- */
+-static int nested_vmx_load_cr3(struct kvm_vcpu *vcpu, unsigned long cr3, bool nested_ept,
+- u32 *entry_failure_code)
+-{
+- if (cr3 != kvm_read_cr3(vcpu) || (!nested_ept && pdptrs_changed(vcpu))) {
+- if (!nested_cr3_valid(vcpu, cr3)) {
+- *entry_failure_code = ENTRY_FAIL_DEFAULT;
+- return 1;
+- }
+-
+- /*
+- * If PAE paging and EPT are both on, CR3 is not used by the CPU and
+- * must not be dereferenced.
+- */
+- if (is_pae_paging(vcpu) && !nested_ept) {
+- if (!load_pdptrs(vcpu, vcpu->arch.walk_mmu, cr3)) {
+- *entry_failure_code = ENTRY_FAIL_PDPTE;
+- return 1;
+- }
+- }
+- }
+-
+- if (!nested_ept)
+- kvm_mmu_new_cr3(vcpu, cr3, false);
+-
+- vcpu->arch.cr3 = cr3;
+- __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
+-
+- kvm_init_mmu(vcpu, false);
+-
+- return 0;
+-}
+-
+-static void prepare_vmcs02_full(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- vmcs_write16(GUEST_ES_SELECTOR, vmcs12->guest_es_selector);
+- vmcs_write16(GUEST_SS_SELECTOR, vmcs12->guest_ss_selector);
+- vmcs_write16(GUEST_DS_SELECTOR, vmcs12->guest_ds_selector);
+- vmcs_write16(GUEST_FS_SELECTOR, vmcs12->guest_fs_selector);
+- vmcs_write16(GUEST_GS_SELECTOR, vmcs12->guest_gs_selector);
+- vmcs_write16(GUEST_LDTR_SELECTOR, vmcs12->guest_ldtr_selector);
+- vmcs_write16(GUEST_TR_SELECTOR, vmcs12->guest_tr_selector);
+- vmcs_write32(GUEST_ES_LIMIT, vmcs12->guest_es_limit);
+- vmcs_write32(GUEST_SS_LIMIT, vmcs12->guest_ss_limit);
+- vmcs_write32(GUEST_DS_LIMIT, vmcs12->guest_ds_limit);
+- vmcs_write32(GUEST_FS_LIMIT, vmcs12->guest_fs_limit);
+- vmcs_write32(GUEST_GS_LIMIT, vmcs12->guest_gs_limit);
+- vmcs_write32(GUEST_LDTR_LIMIT, vmcs12->guest_ldtr_limit);
+- vmcs_write32(GUEST_TR_LIMIT, vmcs12->guest_tr_limit);
+- vmcs_write32(GUEST_GDTR_LIMIT, vmcs12->guest_gdtr_limit);
+- vmcs_write32(GUEST_IDTR_LIMIT, vmcs12->guest_idtr_limit);
+- vmcs_write32(GUEST_ES_AR_BYTES, vmcs12->guest_es_ar_bytes);
+- vmcs_write32(GUEST_SS_AR_BYTES, vmcs12->guest_ss_ar_bytes);
+- vmcs_write32(GUEST_DS_AR_BYTES, vmcs12->guest_ds_ar_bytes);
+- vmcs_write32(GUEST_FS_AR_BYTES, vmcs12->guest_fs_ar_bytes);
+- vmcs_write32(GUEST_GS_AR_BYTES, vmcs12->guest_gs_ar_bytes);
+- vmcs_write32(GUEST_LDTR_AR_BYTES, vmcs12->guest_ldtr_ar_bytes);
+- vmcs_write32(GUEST_TR_AR_BYTES, vmcs12->guest_tr_ar_bytes);
+- vmcs_writel(GUEST_SS_BASE, vmcs12->guest_ss_base);
+- vmcs_writel(GUEST_DS_BASE, vmcs12->guest_ds_base);
+- vmcs_writel(GUEST_FS_BASE, vmcs12->guest_fs_base);
+- vmcs_writel(GUEST_GS_BASE, vmcs12->guest_gs_base);
+- vmcs_writel(GUEST_LDTR_BASE, vmcs12->guest_ldtr_base);
+- vmcs_writel(GUEST_TR_BASE, vmcs12->guest_tr_base);
+- vmcs_writel(GUEST_GDTR_BASE, vmcs12->guest_gdtr_base);
+- vmcs_writel(GUEST_IDTR_BASE, vmcs12->guest_idtr_base);
+-
+- vmcs_write32(GUEST_SYSENTER_CS, vmcs12->guest_sysenter_cs);
+- vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS,
+- vmcs12->guest_pending_dbg_exceptions);
+- vmcs_writel(GUEST_SYSENTER_ESP, vmcs12->guest_sysenter_esp);
+- vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->guest_sysenter_eip);
+-
+- if (nested_cpu_has_xsaves(vmcs12))
+- vmcs_write64(XSS_EXIT_BITMAP, vmcs12->xss_exit_bitmap);
+- vmcs_write64(VMCS_LINK_POINTER, -1ull);
+-
+- if (cpu_has_vmx_posted_intr())
+- vmcs_write16(POSTED_INTR_NV, POSTED_INTR_NESTED_VECTOR);
+-
+- /*
+- * Whether page-faults are trapped is determined by a combination of
+- * 3 settings: PFEC_MASK, PFEC_MATCH and EXCEPTION_BITMAP.PF.
+- * If enable_ept, L0 doesn't care about page faults and we should
+- * set all of these to L1's desires. However, if !enable_ept, L0 does
+- * care about (at least some) page faults, and because it is not easy
+- * (if at all possible?) to merge L0 and L1's desires, we simply ask
+- * to exit on each and every L2 page fault. This is done by setting
+- * MASK=MATCH=0 and (see below) EB.PF=1.
+- * Note that below we don't need special code to set EB.PF beyond the
+- * "or"ing of the EB of vmcs01 and vmcs12, because when enable_ept,
+- * vmcs01's EB.PF is 0 so the "or" will take vmcs12's value, and when
+- * !enable_ept, EB.PF is 1, so the "or" will always be 1.
+- */
+- vmcs_write32(PAGE_FAULT_ERROR_CODE_MASK,
+- enable_ept ? vmcs12->page_fault_error_code_mask : 0);
+- vmcs_write32(PAGE_FAULT_ERROR_CODE_MATCH,
+- enable_ept ? vmcs12->page_fault_error_code_match : 0);
+-
+- /* All VMFUNCs are currently emulated through L0 vmexits. */
+- if (cpu_has_vmx_vmfunc())
+- vmcs_write64(VM_FUNCTION_CONTROL, 0);
+-
+- if (cpu_has_vmx_apicv()) {
+- vmcs_write64(EOI_EXIT_BITMAP0, vmcs12->eoi_exit_bitmap0);
+- vmcs_write64(EOI_EXIT_BITMAP1, vmcs12->eoi_exit_bitmap1);
+- vmcs_write64(EOI_EXIT_BITMAP2, vmcs12->eoi_exit_bitmap2);
+- vmcs_write64(EOI_EXIT_BITMAP3, vmcs12->eoi_exit_bitmap3);
+- }
+-
+- /*
+- * Set host-state according to L0's settings (vmcs12 is irrelevant here)
+- * Some constant fields are set here by vmx_set_constant_host_state().
+- * Other fields are different per CPU, and will be set later when
+- * vmx_vcpu_load() is called, and when vmx_prepare_switch_to_guest()
+- * is called.
+- */
+- vmx_set_constant_host_state(vmx);
+-
+- /*
+- * Set the MSR load/store lists to match L0's settings.
+- */
+- vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
+- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr);
+- vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host.val));
+- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr);
+- vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest.val));
+-
+- set_cr4_guest_host_mask(vmx);
+-
+- if (kvm_mpx_supported() && vmx->nested.nested_run_pending &&
+- (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))
+- vmcs_write64(GUEST_BNDCFGS, vmcs12->guest_bndcfgs);
+-
+- if (enable_vpid) {
+- if (nested_cpu_has_vpid(vmcs12) && vmx->nested.vpid02)
+- vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->nested.vpid02);
+- else
+- vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
+- }
+-
+- /*
+- * L1 may access the L2's PDPTR, so save them to construct vmcs12
+- */
+- if (enable_ept) {
+- vmcs_write64(GUEST_PDPTR0, vmcs12->guest_pdptr0);
+- vmcs_write64(GUEST_PDPTR1, vmcs12->guest_pdptr1);
+- vmcs_write64(GUEST_PDPTR2, vmcs12->guest_pdptr2);
+- vmcs_write64(GUEST_PDPTR3, vmcs12->guest_pdptr3);
+- }
+-
+- if (cpu_has_vmx_msr_bitmap())
+- vmcs_write64(MSR_BITMAP, __pa(vmx->nested.vmcs02.msr_bitmap));
+-}
+-
+-/*
+- * prepare_vmcs02 is called when the L1 guest hypervisor runs its nested
+- * L2 guest. L1 has a vmcs for L2 (vmcs12), and this function "merges" it
+- * with L0's requirements for its guest (a.k.a. vmcs01), so we can run the L2
+- * guest in a way that will both be appropriate to L1's requests, and our
+- * needs. In addition to modifying the active vmcs (which is vmcs02), this
+- * function also has additional necessary side-effects, like setting various
+- * vcpu->arch fields.
+- * Returns 0 on success, 1 on failure. Invalid state exit qualification code
+- * is assigned to entry_failure_code on failure.
+- */
+-static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
+- u32 *entry_failure_code)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 exec_control, vmcs12_exec_ctrl;
+-
+- if (vmx->nested.dirty_vmcs12) {
+- prepare_vmcs02_full(vcpu, vmcs12);
+- vmx->nested.dirty_vmcs12 = false;
+- }
+-
+- /*
+- * First, the fields that are shadowed. This must be kept in sync
+- * with vmx_shadow_fields.h.
+- */
+-
+- vmcs_write16(GUEST_CS_SELECTOR, vmcs12->guest_cs_selector);
+- vmcs_write32(GUEST_CS_LIMIT, vmcs12->guest_cs_limit);
+- vmcs_write32(GUEST_CS_AR_BYTES, vmcs12->guest_cs_ar_bytes);
+- vmcs_writel(GUEST_ES_BASE, vmcs12->guest_es_base);
+- vmcs_writel(GUEST_CS_BASE, vmcs12->guest_cs_base);
+-
+- if (vmx->nested.nested_run_pending &&
+- (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS)) {
+- kvm_set_dr(vcpu, 7, vmcs12->guest_dr7);
+- vmcs_write64(GUEST_IA32_DEBUGCTL, vmcs12->guest_ia32_debugctl);
+- } else {
+- kvm_set_dr(vcpu, 7, vcpu->arch.dr7);
+- vmcs_write64(GUEST_IA32_DEBUGCTL, vmx->nested.vmcs01_debugctl);
+- }
+- if (kvm_mpx_supported() && (!vmx->nested.nested_run_pending ||
+- !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS)))
+- vmcs_write64(GUEST_BNDCFGS, vmx->nested.vmcs01_guest_bndcfgs);
+- if (vmx->nested.nested_run_pending) {
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD,
+- vmcs12->vm_entry_intr_info_field);
+- vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE,
+- vmcs12->vm_entry_exception_error_code);
+- vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
+- vmcs12->vm_entry_instruction_len);
+- vmcs_write32(GUEST_INTERRUPTIBILITY_INFO,
+- vmcs12->guest_interruptibility_info);
+- vmx->loaded_vmcs->nmi_known_unmasked =
+- !(vmcs12->guest_interruptibility_info & GUEST_INTR_STATE_NMI);
+- } else {
+- vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0);
+- }
+- vmx_set_rflags(vcpu, vmcs12->guest_rflags);
+-
+- exec_control = vmcs12->pin_based_vm_exec_control;
+-
+- /* Preemption timer setting is computed directly in vmx_vcpu_run. */
+- exec_control |= vmcs_config.pin_based_exec_ctrl;
+- exec_control &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
+- vmx->loaded_vmcs->hv_timer_armed = false;
+-
+- /* Posted interrupts setting is only taken from vmcs12. */
+- if (nested_cpu_has_posted_intr(vmcs12)) {
+- vmx->nested.posted_intr_nv = vmcs12->posted_intr_nv;
+- vmx->nested.pi_pending = false;
+- } else {
+- exec_control &= ~PIN_BASED_POSTED_INTR;
+- }
+-
+- vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, exec_control);
+-
+- vmx->nested.preemption_timer_expired = false;
+- if (nested_cpu_has_preemption_timer(vmcs12))
+- vmx_start_preemption_timer(vcpu);
+-
+- if (cpu_has_secondary_exec_ctrls()) {
+- exec_control = vmx->secondary_exec_control;
+-
+- /* Take the following fields only from vmcs12 */
+- exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+- SECONDARY_EXEC_ENABLE_INVPCID |
+- SECONDARY_EXEC_RDTSCP |
+- SECONDARY_EXEC_XSAVES |
+- SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
+- SECONDARY_EXEC_APIC_REGISTER_VIRT |
+- SECONDARY_EXEC_ENABLE_VMFUNC);
+- if (nested_cpu_has(vmcs12,
+- CPU_BASED_ACTIVATE_SECONDARY_CONTROLS)) {
+- vmcs12_exec_ctrl = vmcs12->secondary_vm_exec_control &
+- ~SECONDARY_EXEC_ENABLE_PML;
+- exec_control |= vmcs12_exec_ctrl;
+- }
+-
+- /* VMCS shadowing for L2 is emulated for now */
+- exec_control &= ~SECONDARY_EXEC_SHADOW_VMCS;
+-
+- if (exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY)
+- vmcs_write16(GUEST_INTR_STATUS,
+- vmcs12->guest_intr_status);
+-
+- /*
+- * Write an illegal value to APIC_ACCESS_ADDR. Later,
+- * nested_get_vmcs12_pages will either fix it up or
+- * remove the VM execution control.
+- */
+- if (exec_control & SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)
+- vmcs_write64(APIC_ACCESS_ADDR, -1ull);
+-
+- if (exec_control & SECONDARY_EXEC_ENCLS_EXITING)
+- vmcs_write64(ENCLS_EXITING_BITMAP, -1ull);
+-
+- vmcs_write32(SECONDARY_VM_EXEC_CONTROL, exec_control);
+- }
+-
+- /*
+- * HOST_RSP is normally set correctly in vmx_vcpu_run() just before
+- * entry, but only if the current (host) sp changed from the value
+- * we wrote last (vmx->host_rsp). This cache is no longer relevant
+- * if we switch vmcs, and rather than hold a separate cache per vmcs,
+- * here we just force the write to happen on entry.
+- */
+- vmx->host_rsp = 0;
+-
+- exec_control = vmx_exec_control(vmx); /* L0's desires */
+- exec_control &= ~CPU_BASED_VIRTUAL_INTR_PENDING;
+- exec_control &= ~CPU_BASED_VIRTUAL_NMI_PENDING;
+- exec_control &= ~CPU_BASED_TPR_SHADOW;
+- exec_control |= vmcs12->cpu_based_vm_exec_control;
+-
+- /*
+- * Write an illegal value to VIRTUAL_APIC_PAGE_ADDR. Later, if
+- * nested_get_vmcs12_pages can't fix it up, the illegal value
+- * will result in a VM entry failure.
+- */
+- if (exec_control & CPU_BASED_TPR_SHADOW) {
+- vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, -1ull);
+- vmcs_write32(TPR_THRESHOLD, vmcs12->tpr_threshold);
+- } else {
+-#ifdef CONFIG_X86_64
+- exec_control |= CPU_BASED_CR8_LOAD_EXITING |
+- CPU_BASED_CR8_STORE_EXITING;
+-#endif
+- }
+-
+- /*
+- * A vmexit (to either L1 hypervisor or L0 userspace) is always needed
+- * for I/O port accesses.
+- */
+- exec_control &= ~CPU_BASED_USE_IO_BITMAPS;
+- exec_control |= CPU_BASED_UNCOND_IO_EXITING;
+-
+- vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, exec_control);
+-
+- /* EXCEPTION_BITMAP and CR0_GUEST_HOST_MASK should basically be the
+- * bitwise-or of what L1 wants to trap for L2, and what we want to
+- * trap. Note that CR0.TS also needs updating - we do this later.
+- */
+- update_exception_bitmap(vcpu);
+- vcpu->arch.cr0_guest_owned_bits &= ~vmcs12->cr0_guest_host_mask;
+- vmcs_writel(CR0_GUEST_HOST_MASK, ~vcpu->arch.cr0_guest_owned_bits);
+-
+- /* L2->L1 exit controls are emulated - the hardware exit is to L0 so
+- * we should use its exit controls. Note that VM_EXIT_LOAD_IA32_EFER
+- * bits are further modified by vmx_set_efer() below.
+- */
+- vmcs_write32(VM_EXIT_CONTROLS, vmcs_config.vmexit_ctrl);
+-
+- /* vmcs12's VM_ENTRY_LOAD_IA32_EFER and VM_ENTRY_IA32E_MODE are
+- * emulated by vmx_set_efer(), below.
+- */
+- vm_entry_controls_init(vmx,
+- (vmcs12->vm_entry_controls & ~VM_ENTRY_LOAD_IA32_EFER &
+- ~VM_ENTRY_IA32E_MODE) |
+- (vmcs_config.vmentry_ctrl & ~VM_ENTRY_IA32E_MODE));
+-
+- if (vmx->nested.nested_run_pending &&
+- (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT)) {
+- vmcs_write64(GUEST_IA32_PAT, vmcs12->guest_ia32_pat);
+- vcpu->arch.pat = vmcs12->guest_ia32_pat;
+- } else if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
+- vmcs_write64(GUEST_IA32_PAT, vmx->vcpu.arch.pat);
+- }
+-
+- vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset);
+-
+- if (kvm_has_tsc_control)
+- decache_tsc_multiplier(vmx);
+-
+- if (enable_vpid) {
+- /*
+- * There is no direct mapping between vpid02 and vpid12, the
+- * vpid02 is per-vCPU for L0 and reused while the value of
+- * vpid12 is changed w/ one invvpid during nested vmentry.
+- * The vpid12 is allocated by L1 for L2, so it will not
+- * influence global bitmap(for vpid01 and vpid02 allocation)
+- * even if spawn a lot of nested vCPUs.
+- */
+- if (nested_cpu_has_vpid(vmcs12) && vmx->nested.vpid02) {
+- if (vmcs12->virtual_processor_id != vmx->nested.last_vpid) {
+- vmx->nested.last_vpid = vmcs12->virtual_processor_id;
+- __vmx_flush_tlb(vcpu, vmx->nested.vpid02, true);
+- }
+- } else {
+- vmx_flush_tlb(vcpu, true);
+- }
+- }
+-
+- if (enable_pml) {
+- /*
+- * Conceptually we want to copy the PML address and index from
+- * vmcs01 here, and then back to vmcs01 on nested vmexit. But,
+- * since we always flush the log on each vmexit, this happens
+- * to be equivalent to simply resetting the fields in vmcs02.
+- */
+- ASSERT(vmx->pml_pg);
+- vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
+- vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
+- }
+-
+- if (nested_cpu_has_ept(vmcs12)) {
+- if (nested_ept_init_mmu_context(vcpu)) {
+- *entry_failure_code = ENTRY_FAIL_DEFAULT;
+- return 1;
+- }
+- } else if (nested_cpu_has2(vmcs12,
+- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+- vmx_flush_tlb(vcpu, true);
+- }
+-
+- /*
+- * This sets GUEST_CR0 to vmcs12->guest_cr0, possibly modifying those
+- * bits which we consider mandatory enabled.
+- * The CR0_READ_SHADOW is what L2 should have expected to read given
+- * the specifications by L1; It's not enough to take
+- * vmcs12->cr0_read_shadow because on our cr0_guest_host_mask we we
+- * have more bits than L1 expected.
+- */
+- vmx_set_cr0(vcpu, vmcs12->guest_cr0);
+- vmcs_writel(CR0_READ_SHADOW, nested_read_cr0(vmcs12));
+-
+- vmx_set_cr4(vcpu, vmcs12->guest_cr4);
+- vmcs_writel(CR4_READ_SHADOW, nested_read_cr4(vmcs12));
+-
+- if (vmx->nested.nested_run_pending &&
+- (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_EFER))
+- vcpu->arch.efer = vmcs12->guest_ia32_efer;
+- else if (vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE)
+- vcpu->arch.efer |= (EFER_LMA | EFER_LME);
+- else
+- vcpu->arch.efer &= ~(EFER_LMA | EFER_LME);
+- /* Note: modifies VM_ENTRY/EXIT_CONTROLS and GUEST/HOST_IA32_EFER */
+- vmx_set_efer(vcpu, vcpu->arch.efer);
+-
+- /*
+- * Guest state is invalid and unrestricted guest is disabled,
+- * which means L1 attempted VMEntry to L2 with invalid state.
+- * Fail the VMEntry.
+- */
+- if (vmx->emulation_required) {
+- *entry_failure_code = ENTRY_FAIL_DEFAULT;
+- return 1;
+- }
+-
+- /* Shadow page tables on either EPT or shadow page tables. */
+- if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_cpu_has_ept(vmcs12),
+- entry_failure_code))
+- return 1;
+-
+- if (!enable_ept)
+- vcpu->arch.walk_mmu->inject_page_fault = vmx_inject_page_fault_nested;
+-
+- kvm_register_write(vcpu, VCPU_REGS_RSP, vmcs12->guest_rsp);
+- kvm_register_write(vcpu, VCPU_REGS_RIP, vmcs12->guest_rip);
+- return 0;
+-}
+-
+-static int nested_vmx_check_nmi_controls(struct vmcs12 *vmcs12)
+-{
+- if (!nested_cpu_has_nmi_exiting(vmcs12) &&
+- nested_cpu_has_virtual_nmis(vmcs12))
+- return -EINVAL;
+-
+- if (!nested_cpu_has_virtual_nmis(vmcs12) &&
+- nested_cpu_has(vmcs12, CPU_BASED_VIRTUAL_NMI_PENDING))
+- return -EINVAL;
+-
+- return 0;
+-}
+-
+-static int check_vmentry_prereqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- if (vmcs12->guest_activity_state != GUEST_ACTIVITY_ACTIVE &&
+- vmcs12->guest_activity_state != GUEST_ACTIVITY_HLT)
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_cpu_has_vpid(vmcs12) && !vmcs12->virtual_processor_id)
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_vmx_check_io_bitmap_controls(vcpu, vmcs12))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_vmx_check_msr_bitmap_controls(vcpu, vmcs12))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_vmx_check_apic_access_controls(vcpu, vmcs12))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_vmx_check_tpr_shadow_controls(vcpu, vmcs12))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_vmx_check_apicv_controls(vcpu, vmcs12))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_vmx_check_msr_switch_controls(vcpu, vmcs12))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_vmx_check_pml_controls(vcpu, vmcs12))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_vmx_check_shadow_vmcs_controls(vcpu, vmcs12))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (!vmx_control_verify(vmcs12->cpu_based_vm_exec_control,
+- vmx->nested.msrs.procbased_ctls_low,
+- vmx->nested.msrs.procbased_ctls_high) ||
+- (nested_cpu_has(vmcs12, CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) &&
+- !vmx_control_verify(vmcs12->secondary_vm_exec_control,
+- vmx->nested.msrs.secondary_ctls_low,
+- vmx->nested.msrs.secondary_ctls_high)) ||
+- !vmx_control_verify(vmcs12->pin_based_vm_exec_control,
+- vmx->nested.msrs.pinbased_ctls_low,
+- vmx->nested.msrs.pinbased_ctls_high) ||
+- !vmx_control_verify(vmcs12->vm_exit_controls,
+- vmx->nested.msrs.exit_ctls_low,
+- vmx->nested.msrs.exit_ctls_high) ||
+- !vmx_control_verify(vmcs12->vm_entry_controls,
+- vmx->nested.msrs.entry_ctls_low,
+- vmx->nested.msrs.entry_ctls_high))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_vmx_check_nmi_controls(vmcs12))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_cpu_has_vmfunc(vmcs12)) {
+- if (vmcs12->vm_function_control &
+- ~vmx->nested.msrs.vmfunc_controls)
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (nested_cpu_has_eptp_switching(vmcs12)) {
+- if (!nested_cpu_has_ept(vmcs12) ||
+- !page_address_valid(vcpu, vmcs12->eptp_list_address))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+- }
+- }
+-
+- if (vmcs12->cr3_target_count > nested_cpu_vmx_misc_cr3_count(vcpu))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- if (!nested_host_cr0_valid(vcpu, vmcs12->host_cr0) ||
+- !nested_host_cr4_valid(vcpu, vmcs12->host_cr4) ||
+- !nested_cr3_valid(vcpu, vmcs12->host_cr3))
+- return VMXERR_ENTRY_INVALID_HOST_STATE_FIELD;
+-
+- /*
+- * From the Intel SDM, volume 3:
+- * Fields relevant to VM-entry event injection must be set properly.
+- * These fields are the VM-entry interruption-information field, the
+- * VM-entry exception error code, and the VM-entry instruction length.
+- */
+- if (vmcs12->vm_entry_intr_info_field & INTR_INFO_VALID_MASK) {
+- u32 intr_info = vmcs12->vm_entry_intr_info_field;
+- u8 vector = intr_info & INTR_INFO_VECTOR_MASK;
+- u32 intr_type = intr_info & INTR_INFO_INTR_TYPE_MASK;
+- bool has_error_code = intr_info & INTR_INFO_DELIVER_CODE_MASK;
+- bool should_have_error_code;
+- bool urg = nested_cpu_has2(vmcs12,
+- SECONDARY_EXEC_UNRESTRICTED_GUEST);
+- bool prot_mode = !urg || vmcs12->guest_cr0 & X86_CR0_PE;
+-
+- /* VM-entry interruption-info field: interruption type */
+- if (intr_type == INTR_TYPE_RESERVED ||
+- (intr_type == INTR_TYPE_OTHER_EVENT &&
+- !nested_cpu_supports_monitor_trap_flag(vcpu)))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- /* VM-entry interruption-info field: vector */
+- if ((intr_type == INTR_TYPE_NMI_INTR && vector != NMI_VECTOR) ||
+- (intr_type == INTR_TYPE_HARD_EXCEPTION && vector > 31) ||
+- (intr_type == INTR_TYPE_OTHER_EVENT && vector != 0))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- /* VM-entry interruption-info field: deliver error code */
+- should_have_error_code =
+- intr_type == INTR_TYPE_HARD_EXCEPTION && prot_mode &&
+- x86_exception_has_error_code(vector);
+- if (has_error_code != should_have_error_code)
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- /* VM-entry exception error code */
+- if (has_error_code &&
+- vmcs12->vm_entry_exception_error_code & GENMASK(31, 16))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- /* VM-entry interruption-info field: reserved bits */
+- if (intr_info & INTR_INFO_RESVD_BITS_MASK)
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+-
+- /* VM-entry instruction length */
+- switch (intr_type) {
+- case INTR_TYPE_SOFT_EXCEPTION:
+- case INTR_TYPE_SOFT_INTR:
+- case INTR_TYPE_PRIV_SW_EXCEPTION:
+- if ((vmcs12->vm_entry_instruction_len > 15) ||
+- (vmcs12->vm_entry_instruction_len == 0 &&
+- !nested_cpu_has_zero_length_injection(vcpu)))
+- return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+- }
+- }
+-
+- return 0;
+-}
+-
+-static int nested_vmx_check_vmcs_link_ptr(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- int r;
+- struct page *page;
+- struct vmcs12 *shadow;
+-
+- if (vmcs12->vmcs_link_pointer == -1ull)
+- return 0;
+-
+- if (!page_address_valid(vcpu, vmcs12->vmcs_link_pointer))
+- return -EINVAL;
+-
+- page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->vmcs_link_pointer);
+- if (is_error_page(page))
+- return -EINVAL;
+-
+- r = 0;
+- shadow = kmap(page);
+- if (shadow->hdr.revision_id != VMCS12_REVISION ||
+- shadow->hdr.shadow_vmcs != nested_cpu_has_shadow_vmcs(vmcs12))
+- r = -EINVAL;
+- kunmap(page);
+- kvm_release_page_clean(page);
+- return r;
+-}
+-
+-static int check_vmentry_postreqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
+- u32 *exit_qual)
+-{
+- bool ia32e;
+-
+- *exit_qual = ENTRY_FAIL_DEFAULT;
+-
+- if (!nested_guest_cr0_valid(vcpu, vmcs12->guest_cr0) ||
+- !nested_guest_cr4_valid(vcpu, vmcs12->guest_cr4))
+- return 1;
+-
+- if (nested_vmx_check_vmcs_link_ptr(vcpu, vmcs12)) {
+- *exit_qual = ENTRY_FAIL_VMCS_LINK_PTR;
+- return 1;
+- }
+-
+- /*
+- * If the load IA32_EFER VM-entry control is 1, the following checks
+- * are performed on the field for the IA32_EFER MSR:
+- * - Bits reserved in the IA32_EFER MSR must be 0.
+- * - Bit 10 (corresponding to IA32_EFER.LMA) must equal the value of
+- * the IA-32e mode guest VM-exit control. It must also be identical
+- * to bit 8 (LME) if bit 31 in the CR0 field (corresponding to
+- * CR0.PG) is 1.
+- */
+- if (to_vmx(vcpu)->nested.nested_run_pending &&
+- (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_EFER)) {
+- ia32e = (vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE) != 0;
+- if (!kvm_valid_efer(vcpu, vmcs12->guest_ia32_efer) ||
+- ia32e != !!(vmcs12->guest_ia32_efer & EFER_LMA) ||
+- ((vmcs12->guest_cr0 & X86_CR0_PG) &&
+- ia32e != !!(vmcs12->guest_ia32_efer & EFER_LME)))
+- return 1;
+- }
+-
+- /*
+- * If the load IA32_EFER VM-exit control is 1, bits reserved in the
+- * IA32_EFER MSR must be 0 in the field for that register. In addition,
+- * the values of the LMA and LME bits in the field must each be that of
+- * the host address-space size VM-exit control.
+- */
+- if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_EFER) {
+- ia32e = (vmcs12->vm_exit_controls &
+- VM_EXIT_HOST_ADDR_SPACE_SIZE) != 0;
+- if (!kvm_valid_efer(vcpu, vmcs12->host_ia32_efer) ||
+- ia32e != !!(vmcs12->host_ia32_efer & EFER_LMA) ||
+- ia32e != !!(vmcs12->host_ia32_efer & EFER_LME))
+- return 1;
+- }
+-
+- if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS) &&
+- (is_noncanonical_address(vmcs12->guest_bndcfgs & PAGE_MASK, vcpu) ||
+- (vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD)))
+- return 1;
+-
+- return 0;
+-}
+-
+-/*
+- * If exit_qual is NULL, this is being called from state restore (either RSM
+- * or KVM_SET_NESTED_STATE). Otherwise it's called from vmlaunch/vmresume.
+- */
+-static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, u32 *exit_qual)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- bool from_vmentry = !!exit_qual;
+- u32 dummy_exit_qual;
+- bool evaluate_pending_interrupts;
+- int r = 0;
+-
+- evaluate_pending_interrupts = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
+- (CPU_BASED_VIRTUAL_INTR_PENDING | CPU_BASED_VIRTUAL_NMI_PENDING);
+- if (likely(!evaluate_pending_interrupts) && kvm_vcpu_apicv_active(vcpu))
+- evaluate_pending_interrupts |= vmx_has_apicv_interrupt(vcpu);
+-
+- enter_guest_mode(vcpu);
+-
+- if (!(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS))
+- vmx->nested.vmcs01_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL);
+- if (kvm_mpx_supported() &&
+- !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))
+- vmx->nested.vmcs01_guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS);
+-
+- vmx_switch_vmcs(vcpu, &vmx->nested.vmcs02);
+- vmx_segment_cache_clear(vmx);
+-
+- if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
+- vcpu->arch.tsc_offset += vmcs12->tsc_offset;
+-
+- r = EXIT_REASON_INVALID_STATE;
+- if (prepare_vmcs02(vcpu, vmcs12, from_vmentry ? exit_qual : &dummy_exit_qual))
+- goto fail;
+-
+- if (from_vmentry) {
+- nested_get_vmcs12_pages(vcpu);
+-
+- r = EXIT_REASON_MSR_LOAD_FAIL;
+- *exit_qual = nested_vmx_load_msr(vcpu,
+- vmcs12->vm_entry_msr_load_addr,
+- vmcs12->vm_entry_msr_load_count);
+- if (*exit_qual)
+- goto fail;
+- } else {
+- /*
+- * The MMU is not initialized to point at the right entities yet and
+- * "get pages" would need to read data from the guest (i.e. we will
+- * need to perform gpa to hpa translation). Request a call
+- * to nested_get_vmcs12_pages before the next VM-entry. The MSRs
+- * have already been set at vmentry time and should not be reset.
+- */
+- kvm_make_request(KVM_REQ_GET_VMCS12_PAGES, vcpu);
+- }
+-
+- /*
+- * If L1 had a pending IRQ/NMI until it executed
+- * VMLAUNCH/VMRESUME which wasn't delivered because it was
+- * disallowed (e.g. interrupts disabled), L0 needs to
+- * evaluate if this pending event should cause an exit from L2
+- * to L1 or delivered directly to L2 (e.g. In case L1 don't
+- * intercept EXTERNAL_INTERRUPT).
+- *
+- * Usually this would be handled by the processor noticing an
+- * IRQ/NMI window request, or checking RVI during evaluation of
+- * pending virtual interrupts. However, this setting was done
+- * on VMCS01 and now VMCS02 is active instead. Thus, we force L0
+- * to perform pending event evaluation by requesting a KVM_REQ_EVENT.
+- */
+- if (unlikely(evaluate_pending_interrupts))
+- kvm_make_request(KVM_REQ_EVENT, vcpu);
+-
+- /*
+- * Note no nested_vmx_succeed or nested_vmx_fail here. At this point
+- * we are no longer running L1, and VMLAUNCH/VMRESUME has not yet
+- * returned as far as L1 is concerned. It will only return (and set
+- * the success flag) when L2 exits (see nested_vmx_vmexit()).
+- */
+- return 0;
+-
+-fail:
+- if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
+- vcpu->arch.tsc_offset -= vmcs12->tsc_offset;
+- leave_guest_mode(vcpu);
+- vmx_switch_vmcs(vcpu, &vmx->vmcs01);
+- return r;
+-}
+-
+-/*
+- * nested_vmx_run() handles a nested entry, i.e., a VMLAUNCH or VMRESUME on L1
+- * for running an L2 nested guest.
+- */
+-static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
+-{
+- struct vmcs12 *vmcs12;
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- u32 interrupt_shadow = vmx_get_interrupt_shadow(vcpu);
+- u32 exit_qual;
+- int ret;
+-
+- if (!nested_vmx_check_permission(vcpu))
+- return 1;
+-
+- if (!nested_vmx_check_vmcs12(vcpu))
+- goto out;
+-
+- vmcs12 = get_vmcs12(vcpu);
+-
+- /*
+- * Can't VMLAUNCH or VMRESUME a shadow VMCS. Despite the fact
+- * that there *is* a valid VMCS pointer, RFLAGS.CF is set
+- * rather than RFLAGS.ZF, and no error number is stored to the
+- * VM-instruction error field.
+- */
+- if (vmcs12->hdr.shadow_vmcs) {
+- nested_vmx_failInvalid(vcpu);
+- goto out;
+- }
+-
+- if (enable_shadow_vmcs)
+- copy_shadow_to_vmcs12(vmx);
+-
+- /*
+- * The nested entry process starts with enforcing various prerequisites
+- * on vmcs12 as required by the Intel SDM, and act appropriately when
+- * they fail: As the SDM explains, some conditions should cause the
+- * instruction to fail, while others will cause the instruction to seem
+- * to succeed, but return an EXIT_REASON_INVALID_STATE.
+- * To speed up the normal (success) code path, we should avoid checking
+- * for misconfigurations which will anyway be caught by the processor
+- * when using the merged vmcs02.
+- */
+- if (interrupt_shadow & KVM_X86_SHADOW_INT_MOV_SS) {
+- nested_vmx_failValid(vcpu,
+- VMXERR_ENTRY_EVENTS_BLOCKED_BY_MOV_SS);
+- goto out;
+- }
+-
+- if (vmcs12->launch_state == launch) {
+- nested_vmx_failValid(vcpu,
+- launch ? VMXERR_VMLAUNCH_NONCLEAR_VMCS
+- : VMXERR_VMRESUME_NONLAUNCHED_VMCS);
+- goto out;
+- }
+-
+- ret = check_vmentry_prereqs(vcpu, vmcs12);
+- if (ret) {
+- nested_vmx_failValid(vcpu, ret);
+- goto out;
+- }
+-
+- /*
+- * After this point, the trap flag no longer triggers a singlestep trap
+- * on the vm entry instructions; don't call kvm_skip_emulated_instruction.
+- * This is not 100% correct; for performance reasons, we delegate most
+- * of the checks on host state to the processor. If those fail,
+- * the singlestep trap is missed.
+- */
+- skip_emulated_instruction(vcpu);
+-
+- ret = check_vmentry_postreqs(vcpu, vmcs12, &exit_qual);
+- if (ret) {
+- nested_vmx_entry_failure(vcpu, vmcs12,
+- EXIT_REASON_INVALID_STATE, exit_qual);
+- return 1;
+- }
+-
+- /*
+- * We're finally done with prerequisite checking, and can start with
+- * the nested entry.
+- */
+-
+- vmx->nested.nested_run_pending = 1;
+- ret = enter_vmx_non_root_mode(vcpu, &exit_qual);
+- if (ret) {
+- nested_vmx_entry_failure(vcpu, vmcs12, ret, exit_qual);
+- vmx->nested.nested_run_pending = 0;
+- return 1;
+- }
+-
+- /* Hide L1D cache contents from the nested guest. */
+- vmx->vcpu.arch.l1tf_flush_l1d = true;
+-
+- /*
+- * Must happen outside of enter_vmx_non_root_mode() as it will
+- * also be used as part of restoring nVMX state for
+- * snapshot restore (migration).
+- *
+- * In this flow, it is assumed that vmcs12 cache was
+- * trasferred as part of captured nVMX state and should
+- * therefore not be read from guest memory (which may not
+- * exist on destination host yet).
+- */
+- nested_cache_shadow_vmcs12(vcpu, vmcs12);
+-
+- /*
+- * If we're entering a halted L2 vcpu and the L2 vcpu won't be
+- * awakened by event injection or by an NMI-window VM-exit or
+- * by an interrupt-window VM-exit, halt the vcpu.
+- */
+- if ((vmcs12->guest_activity_state == GUEST_ACTIVITY_HLT) &&
+- !(vmcs12->vm_entry_intr_info_field & INTR_INFO_VALID_MASK) &&
+- !(vmcs12->cpu_based_vm_exec_control & CPU_BASED_VIRTUAL_NMI_PENDING) &&
+- !((vmcs12->cpu_based_vm_exec_control & CPU_BASED_VIRTUAL_INTR_PENDING) &&
+- (vmcs12->guest_rflags & X86_EFLAGS_IF))) {
+- vmx->nested.nested_run_pending = 0;
+- return kvm_vcpu_halt(vcpu);
+- }
+- return 1;
+-
+-out:
+- return kvm_skip_emulated_instruction(vcpu);
+-}
+-
+-/*
+- * On a nested exit from L2 to L1, vmcs12.guest_cr0 might not be up-to-date
+- * because L2 may have changed some cr0 bits directly (CRO_GUEST_HOST_MASK).
+- * This function returns the new value we should put in vmcs12.guest_cr0.
+- * It's not enough to just return the vmcs02 GUEST_CR0. Rather,
+- * 1. Bits that neither L0 nor L1 trapped, were set directly by L2 and are now
+- * available in vmcs02 GUEST_CR0. (Note: It's enough to check that L0
+- * didn't trap the bit, because if L1 did, so would L0).
+- * 2. Bits that L1 asked to trap (and therefore L0 also did) could not have
+- * been modified by L2, and L1 knows it. So just leave the old value of
+- * the bit from vmcs12.guest_cr0. Note that the bit from vmcs02 GUEST_CR0
+- * isn't relevant, because if L0 traps this bit it can set it to anything.
+- * 3. Bits that L1 didn't trap, but L0 did. L1 believes the guest could have
+- * changed these bits, and therefore they need to be updated, but L0
+- * didn't necessarily allow them to be changed in GUEST_CR0 - and rather
+- * put them in vmcs02 CR0_READ_SHADOW. So take these bits from there.
+- */
+-static inline unsigned long
+-vmcs12_guest_cr0(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
+-{
+- return
+- /*1*/ (vmcs_readl(GUEST_CR0) & vcpu->arch.cr0_guest_owned_bits) |
+- /*2*/ (vmcs12->guest_cr0 & vmcs12->cr0_guest_host_mask) |
+- /*3*/ (vmcs_readl(CR0_READ_SHADOW) & ~(vmcs12->cr0_guest_host_mask |
+- vcpu->arch.cr0_guest_owned_bits));
+-}
+-
+-static inline unsigned long
+-vmcs12_guest_cr4(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
+-{
+- return
+- /*1*/ (vmcs_readl(GUEST_CR4) & vcpu->arch.cr4_guest_owned_bits) |
+- /*2*/ (vmcs12->guest_cr4 & vmcs12->cr4_guest_host_mask) |
+- /*3*/ (vmcs_readl(CR4_READ_SHADOW) & ~(vmcs12->cr4_guest_host_mask |
+- vcpu->arch.cr4_guest_owned_bits));
+-}
+-
+-static void vmcs12_save_pending_event(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- u32 idt_vectoring;
+- unsigned int nr;
+-
+- if (vcpu->arch.exception.injected) {
+- nr = vcpu->arch.exception.nr;
+- idt_vectoring = nr | VECTORING_INFO_VALID_MASK;
+-
+- if (kvm_exception_is_soft(nr)) {
+- vmcs12->vm_exit_instruction_len =
+- vcpu->arch.event_exit_inst_len;
+- idt_vectoring |= INTR_TYPE_SOFT_EXCEPTION;
+- } else
+- idt_vectoring |= INTR_TYPE_HARD_EXCEPTION;
+-
+- if (vcpu->arch.exception.has_error_code) {
+- idt_vectoring |= VECTORING_INFO_DELIVER_CODE_MASK;
+- vmcs12->idt_vectoring_error_code =
+- vcpu->arch.exception.error_code;
+- }
+-
+- vmcs12->idt_vectoring_info_field = idt_vectoring;
+- } else if (vcpu->arch.nmi_injected) {
+- vmcs12->idt_vectoring_info_field =
+- INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK | NMI_VECTOR;
+- } else if (vcpu->arch.interrupt.injected) {
+- nr = vcpu->arch.interrupt.nr;
+- idt_vectoring = nr | VECTORING_INFO_VALID_MASK;
+-
+- if (vcpu->arch.interrupt.soft) {
+- idt_vectoring |= INTR_TYPE_SOFT_INTR;
+- vmcs12->vm_entry_instruction_len =
+- vcpu->arch.event_exit_inst_len;
+- } else
+- idt_vectoring |= INTR_TYPE_EXT_INTR;
+-
+- vmcs12->idt_vectoring_info_field = idt_vectoring;
+- }
+-}
+-
+-static int vmx_check_nested_events(struct kvm_vcpu *vcpu)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- unsigned long exit_qual;
+- bool block_nested_events =
+- vmx->nested.nested_run_pending || kvm_event_needs_reinjection(vcpu);
+-
+- if (vcpu->arch.exception.pending &&
+- nested_vmx_check_exception(vcpu, &exit_qual)) {
+- if (block_nested_events)
+- return -EBUSY;
+- nested_vmx_inject_exception_vmexit(vcpu, exit_qual);
+- return 0;
+- }
+-
+- if (nested_cpu_has_preemption_timer(get_vmcs12(vcpu)) &&
+- vmx->nested.preemption_timer_expired) {
+- if (block_nested_events)
+- return -EBUSY;
+- nested_vmx_vmexit(vcpu, EXIT_REASON_PREEMPTION_TIMER, 0, 0);
+- return 0;
+- }
+-
+- if (vcpu->arch.nmi_pending && nested_exit_on_nmi(vcpu)) {
+- if (block_nested_events)
+- return -EBUSY;
+- nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
+- NMI_VECTOR | INTR_TYPE_NMI_INTR |
+- INTR_INFO_VALID_MASK, 0);
+- /*
+- * The NMI-triggered VM exit counts as injection:
+- * clear this one and block further NMIs.
+- */
+- vcpu->arch.nmi_pending = 0;
+- vmx_set_nmi_mask(vcpu, true);
+- return 0;
+- }
+-
+- if (kvm_cpu_has_interrupt(vcpu) && nested_exit_on_intr(vcpu)) {
+- if (block_nested_events)
+- return -EBUSY;
+- nested_vmx_vmexit(vcpu, EXIT_REASON_EXTERNAL_INTERRUPT, 0, 0);
+- return 0;
+- }
+-
+- vmx_complete_nested_posted_interrupt(vcpu);
+- return 0;
+-}
+-
+-static void vmx_request_immediate_exit(struct kvm_vcpu *vcpu)
+-{
+- to_vmx(vcpu)->req_immediate_exit = true;
+-}
+-
+-static u32 vmx_get_preemption_timer_value(struct kvm_vcpu *vcpu)
+-{
+- ktime_t remaining =
+- hrtimer_get_remaining(&to_vmx(vcpu)->nested.preemption_timer);
+- u64 value;
+-
+- if (ktime_to_ns(remaining) <= 0)
+- return 0;
+-
+- value = ktime_to_ns(remaining) * vcpu->arch.virtual_tsc_khz;
+- do_div(value, 1000000);
+- return value >> VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE;
+-}
+-
+-/*
+- * Update the guest state fields of vmcs12 to reflect changes that
+- * occurred while L2 was running. (The "IA-32e mode guest" bit of the
+- * VM-entry controls is also updated, since this is really a guest
+- * state bit.)
+- */
+-static void sync_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
+-{
+- vmcs12->guest_cr0 = vmcs12_guest_cr0(vcpu, vmcs12);
+- vmcs12->guest_cr4 = vmcs12_guest_cr4(vcpu, vmcs12);
+-
+- vmcs12->guest_rsp = kvm_register_read(vcpu, VCPU_REGS_RSP);
+- vmcs12->guest_rip = kvm_register_read(vcpu, VCPU_REGS_RIP);
+- vmcs12->guest_rflags = vmcs_readl(GUEST_RFLAGS);
+-
+- vmcs12->guest_es_selector = vmcs_read16(GUEST_ES_SELECTOR);
+- vmcs12->guest_cs_selector = vmcs_read16(GUEST_CS_SELECTOR);
+- vmcs12->guest_ss_selector = vmcs_read16(GUEST_SS_SELECTOR);
+- vmcs12->guest_ds_selector = vmcs_read16(GUEST_DS_SELECTOR);
+- vmcs12->guest_fs_selector = vmcs_read16(GUEST_FS_SELECTOR);
+- vmcs12->guest_gs_selector = vmcs_read16(GUEST_GS_SELECTOR);
+- vmcs12->guest_ldtr_selector = vmcs_read16(GUEST_LDTR_SELECTOR);
+- vmcs12->guest_tr_selector = vmcs_read16(GUEST_TR_SELECTOR);
+- vmcs12->guest_es_limit = vmcs_read32(GUEST_ES_LIMIT);
+- vmcs12->guest_cs_limit = vmcs_read32(GUEST_CS_LIMIT);
+- vmcs12->guest_ss_limit = vmcs_read32(GUEST_SS_LIMIT);
+- vmcs12->guest_ds_limit = vmcs_read32(GUEST_DS_LIMIT);
+- vmcs12->guest_fs_limit = vmcs_read32(GUEST_FS_LIMIT);
+- vmcs12->guest_gs_limit = vmcs_read32(GUEST_GS_LIMIT);
+- vmcs12->guest_ldtr_limit = vmcs_read32(GUEST_LDTR_LIMIT);
+- vmcs12->guest_tr_limit = vmcs_read32(GUEST_TR_LIMIT);
+- vmcs12->guest_gdtr_limit = vmcs_read32(GUEST_GDTR_LIMIT);
+- vmcs12->guest_idtr_limit = vmcs_read32(GUEST_IDTR_LIMIT);
+- vmcs12->guest_es_ar_bytes = vmcs_read32(GUEST_ES_AR_BYTES);
+- vmcs12->guest_cs_ar_bytes = vmcs_read32(GUEST_CS_AR_BYTES);
+- vmcs12->guest_ss_ar_bytes = vmcs_read32(GUEST_SS_AR_BYTES);
+- vmcs12->guest_ds_ar_bytes = vmcs_read32(GUEST_DS_AR_BYTES);
+- vmcs12->guest_fs_ar_bytes = vmcs_read32(GUEST_FS_AR_BYTES);
+- vmcs12->guest_gs_ar_bytes = vmcs_read32(GUEST_GS_AR_BYTES);
+- vmcs12->guest_ldtr_ar_bytes = vmcs_read32(GUEST_LDTR_AR_BYTES);
+- vmcs12->guest_tr_ar_bytes = vmcs_read32(GUEST_TR_AR_BYTES);
+- vmcs12->guest_es_base = vmcs_readl(GUEST_ES_BASE);
+- vmcs12->guest_cs_base = vmcs_readl(GUEST_CS_BASE);
+- vmcs12->guest_ss_base = vmcs_readl(GUEST_SS_BASE);
+- vmcs12->guest_ds_base = vmcs_readl(GUEST_DS_BASE);
+- vmcs12->guest_fs_base = vmcs_readl(GUEST_FS_BASE);
+- vmcs12->guest_gs_base = vmcs_readl(GUEST_GS_BASE);
+- vmcs12->guest_ldtr_base = vmcs_readl(GUEST_LDTR_BASE);
+- vmcs12->guest_tr_base = vmcs_readl(GUEST_TR_BASE);
+- vmcs12->guest_gdtr_base = vmcs_readl(GUEST_GDTR_BASE);
+- vmcs12->guest_idtr_base = vmcs_readl(GUEST_IDTR_BASE);
+-
+- vmcs12->guest_interruptibility_info =
+- vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
+- vmcs12->guest_pending_dbg_exceptions =
+- vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS);
+- if (vcpu->arch.mp_state == KVM_MP_STATE_HALTED)
+- vmcs12->guest_activity_state = GUEST_ACTIVITY_HLT;
+- else
+- vmcs12->guest_activity_state = GUEST_ACTIVITY_ACTIVE;
+-
+- if (nested_cpu_has_preemption_timer(vmcs12)) {
+- if (vmcs12->vm_exit_controls &
+- VM_EXIT_SAVE_VMX_PREEMPTION_TIMER)
+- vmcs12->vmx_preemption_timer_value =
+- vmx_get_preemption_timer_value(vcpu);
+- hrtimer_cancel(&to_vmx(vcpu)->nested.preemption_timer);
+- }
+-
+- /*
+- * In some cases (usually, nested EPT), L2 is allowed to change its
+- * own CR3 without exiting. If it has changed it, we must keep it.
+- * Of course, if L0 is using shadow page tables, GUEST_CR3 was defined
+- * by L0, not L1 or L2, so we mustn't unconditionally copy it to vmcs12.
+- *
+- * Additionally, restore L2's PDPTR to vmcs12.
+- */
+- if (enable_ept) {
+- vmcs12->guest_cr3 = vmcs_readl(GUEST_CR3);
+- vmcs12->guest_pdptr0 = vmcs_read64(GUEST_PDPTR0);
+- vmcs12->guest_pdptr1 = vmcs_read64(GUEST_PDPTR1);
+- vmcs12->guest_pdptr2 = vmcs_read64(GUEST_PDPTR2);
+- vmcs12->guest_pdptr3 = vmcs_read64(GUEST_PDPTR3);
+- }
+-
+- vmcs12->guest_linear_address = vmcs_readl(GUEST_LINEAR_ADDRESS);
+-
+- if (nested_cpu_has_vid(vmcs12))
+- vmcs12->guest_intr_status = vmcs_read16(GUEST_INTR_STATUS);
+-
+- vmcs12->vm_entry_controls =
+- (vmcs12->vm_entry_controls & ~VM_ENTRY_IA32E_MODE) |
+- (vm_entry_controls_get(to_vmx(vcpu)) & VM_ENTRY_IA32E_MODE);
+-
+- if (vmcs12->vm_exit_controls & VM_EXIT_SAVE_DEBUG_CONTROLS) {
+- kvm_get_dr(vcpu, 7, (unsigned long *)&vmcs12->guest_dr7);
+- vmcs12->guest_ia32_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL);
+- }
+-
+- /* TODO: These cannot have changed unless we have MSR bitmaps and
+- * the relevant bit asks not to trap the change */
+- if (vmcs12->vm_exit_controls & VM_EXIT_SAVE_IA32_PAT)
+- vmcs12->guest_ia32_pat = vmcs_read64(GUEST_IA32_PAT);
+- if (vmcs12->vm_exit_controls & VM_EXIT_SAVE_IA32_EFER)
+- vmcs12->guest_ia32_efer = vcpu->arch.efer;
+- vmcs12->guest_sysenter_cs = vmcs_read32(GUEST_SYSENTER_CS);
+- vmcs12->guest_sysenter_esp = vmcs_readl(GUEST_SYSENTER_ESP);
+- vmcs12->guest_sysenter_eip = vmcs_readl(GUEST_SYSENTER_EIP);
+- if (kvm_mpx_supported())
+- vmcs12->guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS);
+-}
+-
+-/*
+- * prepare_vmcs12 is part of what we need to do when the nested L2 guest exits
+- * and we want to prepare to run its L1 parent. L1 keeps a vmcs for L2 (vmcs12),
+- * and this function updates it to reflect the changes to the guest state while
+- * L2 was running (and perhaps made some exits which were handled directly by L0
+- * without going back to L1), and to reflect the exit reason.
+- * Note that we do not have to copy here all VMCS fields, just those that
+- * could have changed by the L2 guest or the exit - i.e., the guest-state and
+- * exit-information fields only. Other fields are modified by L1 with VMWRITE,
+- * which already writes to vmcs12 directly.
+- */
+-static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
+- u32 exit_reason, u32 exit_intr_info,
+- unsigned long exit_qualification)
+-{
+- /* update guest state fields: */
+- sync_vmcs12(vcpu, vmcs12);
+-
+- /* update exit information fields: */
+-
+- vmcs12->vm_exit_reason = exit_reason;
+- vmcs12->exit_qualification = exit_qualification;
+- vmcs12->vm_exit_intr_info = exit_intr_info;
+-
+- vmcs12->idt_vectoring_info_field = 0;
+- vmcs12->vm_exit_instruction_len = vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
+- vmcs12->vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
+-
+- if (!(vmcs12->vm_exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY)) {
+- vmcs12->launch_state = 1;
+-
+- /* vm_entry_intr_info_field is cleared on exit. Emulate this
+- * instead of reading the real value. */
+- vmcs12->vm_entry_intr_info_field &= ~INTR_INFO_VALID_MASK;
+-
+- /*
+- * Transfer the event that L0 or L1 may wanted to inject into
+- * L2 to IDT_VECTORING_INFO_FIELD.
+- */
+- vmcs12_save_pending_event(vcpu, vmcs12);
+- }
+-}
+-
+-/*
+- * A part of what we need to when the nested L2 guest exits and we want to
+- * run its L1 parent, is to reset L1's guest state to the host state specified
+- * in vmcs12.
+- * This function is to be called not only on normal nested exit, but also on
+- * a nested entry failure, as explained in Intel's spec, 3B.23.7 ("VM-Entry
+- * Failures During or After Loading Guest State").
+- * This function should be called when the active VMCS is L1's (vmcs01).
+- */
+-static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12)
+-{
+- struct kvm_segment seg;
+- u32 entry_failure_code;
+-
+- if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_EFER)
+- vcpu->arch.efer = vmcs12->host_ia32_efer;
+- else if (vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE)
+- vcpu->arch.efer |= (EFER_LMA | EFER_LME);
+- else
+- vcpu->arch.efer &= ~(EFER_LMA | EFER_LME);
+- vmx_set_efer(vcpu, vcpu->arch.efer);
+-
+- kvm_register_write(vcpu, VCPU_REGS_RSP, vmcs12->host_rsp);
+- kvm_register_write(vcpu, VCPU_REGS_RIP, vmcs12->host_rip);
+- vmx_set_rflags(vcpu, X86_EFLAGS_FIXED);
+- /*
+- * Note that calling vmx_set_cr0 is important, even if cr0 hasn't
+- * actually changed, because vmx_set_cr0 refers to efer set above.
+- *
+- * CR0_GUEST_HOST_MASK is already set in the original vmcs01
+- * (KVM doesn't change it);
+- */
+- vcpu->arch.cr0_guest_owned_bits = X86_CR0_TS;
+- vmx_set_cr0(vcpu, vmcs12->host_cr0);
+-
+- /* Same as above - no reason to call set_cr4_guest_host_mask(). */
+- vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
+- vmx_set_cr4(vcpu, vmcs12->host_cr4);
+-
+- nested_ept_uninit_mmu_context(vcpu);
+-
+- /*
+- * Only PDPTE load can fail as the value of cr3 was checked on entry and
+- * couldn't have changed.
+- */
+- if (nested_vmx_load_cr3(vcpu, vmcs12->host_cr3, false, &entry_failure_code))
+- nested_vmx_abort(vcpu, VMX_ABORT_LOAD_HOST_PDPTE_FAIL);
+-
+- if (!enable_ept)
+- vcpu->arch.walk_mmu->inject_page_fault = kvm_inject_page_fault;
+-
+- /*
+- * If vmcs01 don't use VPID, CPU flushes TLB on every
+- * VMEntry/VMExit. Thus, no need to flush TLB.
+- *
+- * If vmcs12 uses VPID, TLB entries populated by L2 are
+- * tagged with vmx->nested.vpid02 while L1 entries are tagged
+- * with vmx->vpid. Thus, no need to flush TLB.
+- *
+- * Therefore, flush TLB only in case vmcs01 uses VPID and
+- * vmcs12 don't use VPID as in this case L1 & L2 TLB entries
+- * are both tagged with vmx->vpid.
+- */
+- if (enable_vpid &&
+- !(nested_cpu_has_vpid(vmcs12) && to_vmx(vcpu)->nested.vpid02)) {
+- vmx_flush_tlb(vcpu, true);
+- }
+-
+- vmcs_write32(GUEST_SYSENTER_CS, vmcs12->host_ia32_sysenter_cs);
+- vmcs_writel(GUEST_SYSENTER_ESP, vmcs12->host_ia32_sysenter_esp);
+- vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->host_ia32_sysenter_eip);
+- vmcs_writel(GUEST_IDTR_BASE, vmcs12->host_idtr_base);
+- vmcs_writel(GUEST_GDTR_BASE, vmcs12->host_gdtr_base);
+- vmcs_write32(GUEST_IDTR_LIMIT, 0xFFFF);
+- vmcs_write32(GUEST_GDTR_LIMIT, 0xFFFF);
+-
+- /* If not VM_EXIT_CLEAR_BNDCFGS, the L2 value propagates to L1. */
+- if (vmcs12->vm_exit_controls & VM_EXIT_CLEAR_BNDCFGS)
+- vmcs_write64(GUEST_BNDCFGS, 0);
+-
+- if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_PAT) {
+- vmcs_write64(GUEST_IA32_PAT, vmcs12->host_ia32_pat);
+- vcpu->arch.pat = vmcs12->host_ia32_pat;
+- }
+- if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL)
+- vmcs_write64(GUEST_IA32_PERF_GLOBAL_CTRL,
+- vmcs12->host_ia32_perf_global_ctrl);
+-
+- /* Set L1 segment info according to Intel SDM
+- 27.5.2 Loading Host Segment and Descriptor-Table Registers */
+- seg = (struct kvm_segment) {
+- .base = 0,
+- .limit = 0xFFFFFFFF,
+- .selector = vmcs12->host_cs_selector,
+- .type = 11,
+- .present = 1,
+- .s = 1,
+- .g = 1
+- };
+- if (vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE)
+- seg.l = 1;
+- else
+- seg.db = 1;
+- vmx_set_segment(vcpu, &seg, VCPU_SREG_CS);
+- seg = (struct kvm_segment) {
+- .base = 0,
+- .limit = 0xFFFFFFFF,
+- .type = 3,
+- .present = 1,
+- .s = 1,
+- .db = 1,
+- .g = 1
+- };
+- seg.selector = vmcs12->host_ds_selector;
+- vmx_set_segment(vcpu, &seg, VCPU_SREG_DS);
+- seg.selector = vmcs12->host_es_selector;
+- vmx_set_segment(vcpu, &seg, VCPU_SREG_ES);
+- seg.selector = vmcs12->host_ss_selector;
+- vmx_set_segment(vcpu, &seg, VCPU_SREG_SS);
+- seg.selector = vmcs12->host_fs_selector;
+- seg.base = vmcs12->host_fs_base;
+- vmx_set_segment(vcpu, &seg, VCPU_SREG_FS);
+- seg.selector = vmcs12->host_gs_selector;
+- seg.base = vmcs12->host_gs_base;
+- vmx_set_segment(vcpu, &seg, VCPU_SREG_GS);
+- seg = (struct kvm_segment) {
+- .base = vmcs12->host_tr_base,
+- .limit = 0x67,
+- .selector = vmcs12->host_tr_selector,
+- .type = 11,
+- .present = 1
+- };
+- vmx_set_segment(vcpu, &seg, VCPU_SREG_TR);
+-
+- kvm_set_dr(vcpu, 7, 0x400);
+- vmcs_write64(GUEST_IA32_DEBUGCTL, 0);
+-
+- if (cpu_has_vmx_msr_bitmap())
+- vmx_update_msr_bitmap(vcpu);
+-
+- if (nested_vmx_load_msr(vcpu, vmcs12->vm_exit_msr_load_addr,
+- vmcs12->vm_exit_msr_load_count))
+- nested_vmx_abort(vcpu, VMX_ABORT_LOAD_HOST_MSR_FAIL);
+-}
+-
+-static inline u64 nested_vmx_get_vmcs01_guest_efer(struct vcpu_vmx *vmx)
+-{
+- struct shared_msr_entry *efer_msr;
+- unsigned int i;
+-
+- if (vm_entry_controls_get(vmx) & VM_ENTRY_LOAD_IA32_EFER)
+- return vmcs_read64(GUEST_IA32_EFER);
+-
+- if (cpu_has_load_ia32_efer)
+- return host_efer;
+-
+- for (i = 0; i < vmx->msr_autoload.guest.nr; ++i) {
+- if (vmx->msr_autoload.guest.val[i].index == MSR_EFER)
+- return vmx->msr_autoload.guest.val[i].value;
+- }
+-
+- efer_msr = find_msr_entry(vmx, MSR_EFER);
+- if (efer_msr)
+- return efer_msr->data;
+-
+- return host_efer;
+-}
+-
+-static void nested_vmx_restore_host_state(struct kvm_vcpu *vcpu)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct vmx_msr_entry g, h;
+- struct msr_data msr;
+- gpa_t gpa;
+- u32 i, j;
+-
+- vcpu->arch.pat = vmcs_read64(GUEST_IA32_PAT);
+-
+- if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) {
+- /*
+- * L1's host DR7 is lost if KVM_GUESTDBG_USE_HW_BP is set
+- * as vmcs01.GUEST_DR7 contains a userspace defined value
+- * and vcpu->arch.dr7 is not squirreled away before the
+- * nested VMENTER (not worth adding a variable in nested_vmx).
+- */
+- if (vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP)
+- kvm_set_dr(vcpu, 7, DR7_FIXED_1);
+- else
+- WARN_ON(kvm_set_dr(vcpu, 7, vmcs_readl(GUEST_DR7)));
+- }
+-
+- /*
+- * Note that calling vmx_set_{efer,cr0,cr4} is important as they
+- * handle a variety of side effects to KVM's software model.
+- */
+- vmx_set_efer(vcpu, nested_vmx_get_vmcs01_guest_efer(vmx));
+-
+- vcpu->arch.cr0_guest_owned_bits = X86_CR0_TS;
+- vmx_set_cr0(vcpu, vmcs_readl(CR0_READ_SHADOW));
+-
+- vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
+- vmx_set_cr4(vcpu, vmcs_readl(CR4_READ_SHADOW));
+-
+- nested_ept_uninit_mmu_context(vcpu);
+- vcpu->arch.cr3 = vmcs_readl(GUEST_CR3);
+- __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
+-
+- /*
+- * Use ept_save_pdptrs(vcpu) to load the MMU's cached PDPTRs
+- * from vmcs01 (if necessary). The PDPTRs are not loaded on
+- * VMFail, like everything else we just need to ensure our
+- * software model is up-to-date.
+- */
+- ept_save_pdptrs(vcpu);
+-
+- kvm_mmu_reset_context(vcpu);
+-
+- if (cpu_has_vmx_msr_bitmap())
+- vmx_update_msr_bitmap(vcpu);
+-
+- /*
+- * This nasty bit of open coding is a compromise between blindly
+- * loading L1's MSRs using the exit load lists (incorrect emulation
+- * of VMFail), leaving the nested VM's MSRs in the software model
+- * (incorrect behavior) and snapshotting the modified MSRs (too
+- * expensive since the lists are unbound by hardware). For each
+- * MSR that was (prematurely) loaded from the nested VMEntry load
+- * list, reload it from the exit load list if it exists and differs
+- * from the guest value. The intent is to stuff host state as
+- * silently as possible, not to fully process the exit load list.
+- */
+- msr.host_initiated = false;
+- for (i = 0; i < vmcs12->vm_entry_msr_load_count; i++) {
+- gpa = vmcs12->vm_entry_msr_load_addr + (i * sizeof(g));
+- if (kvm_vcpu_read_guest(vcpu, gpa, &g, sizeof(g))) {
+- pr_debug_ratelimited(
+- "%s read MSR index failed (%u, 0x%08llx)\n",
+- __func__, i, gpa);
+- goto vmabort;
+- }
+-
+- for (j = 0; j < vmcs12->vm_exit_msr_load_count; j++) {
+- gpa = vmcs12->vm_exit_msr_load_addr + (j * sizeof(h));
+- if (kvm_vcpu_read_guest(vcpu, gpa, &h, sizeof(h))) {
+- pr_debug_ratelimited(
+- "%s read MSR failed (%u, 0x%08llx)\n",
+- __func__, j, gpa);
+- goto vmabort;
+- }
+- if (h.index != g.index)
+- continue;
+- if (h.value == g.value)
+- break;
+-
+- if (nested_vmx_load_msr_check(vcpu, &h)) {
+- pr_debug_ratelimited(
+- "%s check failed (%u, 0x%x, 0x%x)\n",
+- __func__, j, h.index, h.reserved);
+- goto vmabort;
+- }
+-
+- msr.index = h.index;
+- msr.data = h.value;
+- if (kvm_set_msr(vcpu, &msr)) {
+- pr_debug_ratelimited(
+- "%s WRMSR failed (%u, 0x%x, 0x%llx)\n",
+- __func__, j, h.index, h.value);
+- goto vmabort;
+- }
+- }
+- }
+-
+- return;
+-
+-vmabort:
+- nested_vmx_abort(vcpu, VMX_ABORT_LOAD_HOST_MSR_FAIL);
+-}
+-
+-/*
+- * Emulate an exit from nested guest (L2) to L1, i.e., prepare to run L1
+- * and modify vmcs12 to make it see what it would expect to see there if
+- * L2 was its real guest. Must only be called when in L2 (is_guest_mode())
+- */
+-static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+- u32 exit_intr_info,
+- unsigned long exit_qualification)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+-
+- /* trying to cancel vmlaunch/vmresume is a bug */
+- WARN_ON_ONCE(vmx->nested.nested_run_pending);
+-
+- /*
+- * The only expected VM-instruction error is "VM entry with
+- * invalid control field(s)." Anything else indicates a
+- * problem with L0.
+- */
+- WARN_ON_ONCE(vmx->fail && (vmcs_read32(VM_INSTRUCTION_ERROR) !=
+- VMXERR_ENTRY_INVALID_CONTROL_FIELD));
+-
+- leave_guest_mode(vcpu);
+-
+- if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
+- vcpu->arch.tsc_offset -= vmcs12->tsc_offset;
+-
+- if (likely(!vmx->fail)) {
+- if (exit_reason == -1)
+- sync_vmcs12(vcpu, vmcs12);
+- else
+- prepare_vmcs12(vcpu, vmcs12, exit_reason, exit_intr_info,
+- exit_qualification);
+-
+- /*
+- * Must happen outside of sync_vmcs12() as it will
+- * also be used to capture vmcs12 cache as part of
+- * capturing nVMX state for snapshot (migration).
+- *
+- * Otherwise, this flush will dirty guest memory at a
+- * point it is already assumed by user-space to be
+- * immutable.
+- */
+- nested_flush_cached_shadow_vmcs12(vcpu, vmcs12);
+-
+- if (nested_vmx_store_msr(vcpu, vmcs12->vm_exit_msr_store_addr,
+- vmcs12->vm_exit_msr_store_count))
+- nested_vmx_abort(vcpu, VMX_ABORT_SAVE_GUEST_MSR_FAIL);
+- }
+-
+- /*
+- * Drop events/exceptions that were queued for re-injection to L2
+- * (picked up via vmx_complete_interrupts()), as well as exceptions
+- * that were pending for L2. Note, this must NOT be hoisted above
+- * prepare_vmcs12(), events/exceptions queued for re-injection need to
+- * be captured in vmcs12 (see vmcs12_save_pending_event()).
+- */
+- vcpu->arch.nmi_injected = false;
+- kvm_clear_exception_queue(vcpu);
+- kvm_clear_interrupt_queue(vcpu);
+-
+- vmx_switch_vmcs(vcpu, &vmx->vmcs01);
+- vm_entry_controls_reset_shadow(vmx);
+- vm_exit_controls_reset_shadow(vmx);
+- vmx_segment_cache_clear(vmx);
+-
+- /* Update any VMCS fields that might have changed while L2 ran */
+- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr);
+- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr);
+- vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset);
+-
+- if (kvm_has_tsc_control)
+- decache_tsc_multiplier(vmx);
+-
+- if (vmx->nested.change_vmcs01_virtual_apic_mode) {
+- vmx->nested.change_vmcs01_virtual_apic_mode = false;
+- vmx_set_virtual_apic_mode(vcpu);
+- } else if (!nested_cpu_has_ept(vmcs12) &&
+- nested_cpu_has2(vmcs12,
+- SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+- vmx_flush_tlb(vcpu, true);
+- }
+-
+- /* This is needed for same reason as it was needed in prepare_vmcs02 */
+- vmx->host_rsp = 0;
+-
+- /* Unpin physical memory we referred to in vmcs02 */
+- if (vmx->nested.apic_access_page) {
+- kvm_release_page_dirty(vmx->nested.apic_access_page);
+- vmx->nested.apic_access_page = NULL;
+- }
+- if (vmx->nested.virtual_apic_page) {
+- kvm_release_page_dirty(vmx->nested.virtual_apic_page);
+- vmx->nested.virtual_apic_page = NULL;
+- }
+- if (vmx->nested.pi_desc_page) {
+- kunmap(vmx->nested.pi_desc_page);
+- kvm_release_page_dirty(vmx->nested.pi_desc_page);
+- vmx->nested.pi_desc_page = NULL;
+- vmx->nested.pi_desc = NULL;
+- }
+-
+- /*
+- * We are now running in L2, mmu_notifier will force to reload the
+- * page's hpa for L2 vmcs. Need to reload it for L1 before entering L1.
+- */
+- kvm_make_request(KVM_REQ_APIC_PAGE_RELOAD, vcpu);
+-
+- if (enable_shadow_vmcs && exit_reason != -1)
+- vmx->nested.sync_shadow_vmcs = true;
+-
+- /* in case we halted in L2 */
+- vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
+-
+- if (likely(!vmx->fail)) {
+- if (exit_reason == EXIT_REASON_EXTERNAL_INTERRUPT &&
+- nested_exit_intr_ack_set(vcpu)) {
+- int irq = kvm_cpu_get_interrupt(vcpu);
+- WARN_ON(irq < 0);
+- vmcs12->vm_exit_intr_info = irq |
+- INTR_INFO_VALID_MASK | INTR_TYPE_EXT_INTR;
+- }
+-
+- if (exit_reason != -1)
+- trace_kvm_nested_vmexit_inject(vmcs12->vm_exit_reason,
+- vmcs12->exit_qualification,
+- vmcs12->idt_vectoring_info_field,
+- vmcs12->vm_exit_intr_info,
+- vmcs12->vm_exit_intr_error_code,
+- KVM_ISA_VMX);
+-
+- load_vmcs12_host_state(vcpu, vmcs12);
+-
+- return;
+- }
+-
+- /*
+- * After an early L2 VM-entry failure, we're now back
+- * in L1 which thinks it just finished a VMLAUNCH or
+- * VMRESUME instruction, so we need to set the failure
+- * flag and the VM-instruction error field of the VMCS
+- * accordingly.
+- */
+- nested_vmx_failValid(vcpu, VMXERR_ENTRY_INVALID_CONTROL_FIELD);
+-
+- /*
+- * Restore L1's host state to KVM's software model. We're here
+- * because a consistency check was caught by hardware, which
+- * means some amount of guest state has been propagated to KVM's
+- * model and needs to be unwound to the host's state.
+- */
+- nested_vmx_restore_host_state(vcpu);
+-
+- /*
+- * The emulated instruction was already skipped in
+- * nested_vmx_run, but the updated RIP was never
+- * written back to the vmcs01.
+- */
+- skip_emulated_instruction(vcpu);
+- vmx->fail = 0;
+-}
+-
+-/*
+- * Forcibly leave nested mode in order to be able to reset the VCPU later on.
+- */
+-static void vmx_leave_nested(struct kvm_vcpu *vcpu)
+-{
+- if (is_guest_mode(vcpu)) {
+- to_vmx(vcpu)->nested.nested_run_pending = 0;
+- nested_vmx_vmexit(vcpu, -1, 0, 0);
+- }
+- free_nested(to_vmx(vcpu));
+-}
+-
+-/*
+- * L1's failure to enter L2 is a subset of a normal exit, as explained in
+- * 23.7 "VM-entry failures during or after loading guest state" (this also
+- * lists the acceptable exit-reason and exit-qualification parameters).
+- * It should only be called before L2 actually succeeded to run, and when
+- * vmcs01 is current (it doesn't leave_guest_mode() or switch vmcss).
+- */
+-static void nested_vmx_entry_failure(struct kvm_vcpu *vcpu,
+- struct vmcs12 *vmcs12,
+- u32 reason, unsigned long qualification)
+-{
+- load_vmcs12_host_state(vcpu, vmcs12);
+- vmcs12->vm_exit_reason = reason | VMX_EXIT_REASONS_FAILED_VMENTRY;
+- vmcs12->exit_qualification = qualification;
+- nested_vmx_succeed(vcpu);
+- if (enable_shadow_vmcs)
+- to_vmx(vcpu)->nested.sync_shadow_vmcs = true;
+-}
+-
+-static int vmx_check_intercept_io(struct kvm_vcpu *vcpu,
+- struct x86_instruction_info *info)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- unsigned short port;
+- bool intercept;
+- int size;
+-
+- if (info->intercept == x86_intercept_in ||
+- info->intercept == x86_intercept_ins) {
+- port = info->src_val;
+- size = info->dst_bytes;
+- } else {
+- port = info->dst_val;
+- size = info->src_bytes;
+- }
+-
+- /*
+- * If the 'use IO bitmaps' VM-execution control is 0, IO instruction
+- * VM-exits depend on the 'unconditional IO exiting' VM-execution
+- * control.
+- *
+- * Otherwise, IO instruction VM-exits are controlled by the IO bitmaps.
+- */
+- if (!nested_cpu_has(vmcs12, CPU_BASED_USE_IO_BITMAPS))
+- intercept = nested_cpu_has(vmcs12,
+- CPU_BASED_UNCOND_IO_EXITING);
+- else
+- intercept = nested_vmx_check_io_bitmaps(vcpu, port, size);
+-
+- /* FIXME: produce nested vmexit and return X86EMUL_INTERCEPTED. */
+- return intercept ? X86EMUL_UNHANDLEABLE : X86EMUL_CONTINUE;
+-}
+-
+-static int vmx_check_intercept(struct kvm_vcpu *vcpu,
+- struct x86_instruction_info *info,
+- enum x86_intercept_stage stage)
+-{
+- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+- struct x86_emulate_ctxt *ctxt = &vcpu->arch.emulate_ctxt;
+-
+- switch (info->intercept) {
+- /*
+- * RDPID causes #UD if disabled through secondary execution controls.
+- * Because it is marked as EmulateOnUD, we need to intercept it here.
+- */
+- case x86_intercept_rdtscp:
+- if (!nested_cpu_has2(vmcs12, SECONDARY_EXEC_RDTSCP)) {
+- ctxt->exception.vector = UD_VECTOR;
+- ctxt->exception.error_code_valid = false;
+- return X86EMUL_PROPAGATE_FAULT;
+- }
+- break;
+-
+- case x86_intercept_in:
+- case x86_intercept_ins:
+- case x86_intercept_out:
+- case x86_intercept_outs:
+- return vmx_check_intercept_io(vcpu, info);
+-
+- case x86_intercept_lgdt:
+- case x86_intercept_lidt:
+- case x86_intercept_lldt:
+- case x86_intercept_ltr:
+- case x86_intercept_sgdt:
+- case x86_intercept_sidt:
+- case x86_intercept_sldt:
+- case x86_intercept_str:
+- if (!nested_cpu_has2(vmcs12, SECONDARY_EXEC_DESC))
+- return X86EMUL_CONTINUE;
+-
+- /* FIXME: produce nested vmexit and return X86EMUL_INTERCEPTED. */
+- break;
+-
+- /* TODO: check more intercepts... */
+- default:
+- break;
+- }
+-
+- return X86EMUL_UNHANDLEABLE;
+-}
+-
+-#ifdef CONFIG_X86_64
+-/* (a << shift) / divisor, return 1 if overflow otherwise 0 */
+-static inline int u64_shl_div_u64(u64 a, unsigned int shift,
+- u64 divisor, u64 *result)
+-{
+- u64 low = a << shift, high = a >> (64 - shift);
+-
+- /* To avoid the overflow on divq */
+- if (high >= divisor)
+- return 1;
+-
+- /* Low hold the result, high hold rem which is discarded */
+- asm("divq %2\n\t" : "=a" (low), "=d" (high) :
+- "rm" (divisor), "0" (low), "1" (high));
+- *result = low;
+-
+- return 0;
+-}
+-
+-static int vmx_set_hv_timer(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc)
+-{
+- struct vcpu_vmx *vmx;
+- u64 tscl, guest_tscl, delta_tsc, lapic_timer_advance_cycles;
+-
+- if (kvm_mwait_in_guest(vcpu->kvm))
+- return -EOPNOTSUPP;
+-
+- vmx = to_vmx(vcpu);
+- tscl = rdtsc();
+- guest_tscl = kvm_read_l1_tsc(vcpu, tscl);
+- delta_tsc = max(guest_deadline_tsc, guest_tscl) - guest_tscl;
+- lapic_timer_advance_cycles = nsec_to_cycles(vcpu, lapic_timer_advance_ns);
+-
+- if (delta_tsc > lapic_timer_advance_cycles)
+- delta_tsc -= lapic_timer_advance_cycles;
+- else
+- delta_tsc = 0;
+-
+- /* Convert to host delta tsc if tsc scaling is enabled */
+- if (vcpu->arch.tsc_scaling_ratio != kvm_default_tsc_scaling_ratio &&
+- u64_shl_div_u64(delta_tsc,
+- kvm_tsc_scaling_ratio_frac_bits,
+- vcpu->arch.tsc_scaling_ratio,
+- &delta_tsc))
+- return -ERANGE;
+-
+- /*
+- * If the delta tsc can't fit in the 32 bit after the multi shift,
+- * we can't use the preemption timer.
+- * It's possible that it fits on later vmentries, but checking
+- * on every vmentry is costly so we just use an hrtimer.
+- */
+- if (delta_tsc >> (cpu_preemption_timer_multi + 32))
+- return -ERANGE;
+-
+- vmx->hv_deadline_tsc = tscl + delta_tsc;
+- return delta_tsc == 0;
+-}
+-
+-static void vmx_cancel_hv_timer(struct kvm_vcpu *vcpu)
+-{
+- to_vmx(vcpu)->hv_deadline_tsc = -1;
+-}
+-#endif
+-
+-static void vmx_sched_in(struct kvm_vcpu *vcpu, int cpu)
+-{
+- if (!kvm_pause_in_guest(vcpu->kvm))
+- shrink_ple_window(vcpu);
+-}
+-
+-static void vmx_slot_enable_log_dirty(struct kvm *kvm,
+- struct kvm_memory_slot *slot)
+-{
+- kvm_mmu_slot_leaf_clear_dirty(kvm, slot);
+- kvm_mmu_slot_largepage_remove_write_access(kvm, slot);
+-}
+-
+-static void vmx_slot_disable_log_dirty(struct kvm *kvm,
+- struct kvm_memory_slot *slot)
+-{
+- kvm_mmu_slot_set_dirty(kvm, slot);
+-}
+-
+-static void vmx_flush_log_dirty(struct kvm *kvm)
+-{
+- kvm_flush_pml_buffers(kvm);
+-}
+-
+-static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu, gpa_t gpa)
+-{
+- struct vmcs12 *vmcs12;
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct page *page = NULL;
+- u64 *pml_address;
+-
+- if (is_guest_mode(vcpu)) {
+- WARN_ON_ONCE(vmx->nested.pml_full);
+-
+- /*
+- * Check if PML is enabled for the nested guest.
+- * Whether eptp bit 6 is set is already checked
+- * as part of A/D emulation.
+- */
+- vmcs12 = get_vmcs12(vcpu);
+- if (!nested_cpu_has_pml(vmcs12))
+- return 0;
+-
+- if (vmcs12->guest_pml_index >= PML_ENTITY_NUM) {
+- vmx->nested.pml_full = true;
+- return 1;
+- }
+-
+- gpa &= ~0xFFFull;
+-
+- page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->pml_address);
+- if (is_error_page(page))
+- return 0;
+-
+- pml_address = kmap(page);
+- pml_address[vmcs12->guest_pml_index--] = gpa;
+- kunmap(page);
+- kvm_release_page_clean(page);
+- }
+-
+- return 0;
+-}
+-
+-static void vmx_enable_log_dirty_pt_masked(struct kvm *kvm,
+- struct kvm_memory_slot *memslot,
+- gfn_t offset, unsigned long mask)
+-{
+- kvm_mmu_clear_dirty_pt_masked(kvm, memslot, offset, mask);
+-}
+-
+-static void __pi_post_block(struct kvm_vcpu *vcpu)
+-{
+- struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+- struct pi_desc old, new;
+- unsigned int dest;
+-
+- do {
+- old.control = new.control = pi_desc->control;
+- WARN(old.nv != POSTED_INTR_WAKEUP_VECTOR,
+- "Wakeup handler not enabled while the VCPU is blocked\n");
+-
+- dest = cpu_physical_id(vcpu->cpu);
+-
+- if (x2apic_enabled())
+- new.ndst = dest;
+- else
+- new.ndst = (dest << 8) & 0xFF00;
+-
+- /* set 'NV' to 'notification vector' */
+- new.nv = POSTED_INTR_VECTOR;
+- } while (cmpxchg64(&pi_desc->control, old.control,
+- new.control) != old.control);
+-
+- if (!WARN_ON_ONCE(vcpu->pre_pcpu == -1)) {
+- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+- list_del(&vcpu->blocked_vcpu_list);
+- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+- vcpu->pre_pcpu = -1;
+- }
+-}
+-
+-/*
+- * This routine does the following things for vCPU which is going
+- * to be blocked if VT-d PI is enabled.
+- * - Store the vCPU to the wakeup list, so when interrupts happen
+- * we can find the right vCPU to wake up.
+- * - Change the Posted-interrupt descriptor as below:
+- * 'NDST' <-- vcpu->pre_pcpu
+- * 'NV' <-- POSTED_INTR_WAKEUP_VECTOR
+- * - If 'ON' is set during this process, which means at least one
+- * interrupt is posted for this vCPU, we cannot block it, in
+- * this case, return 1, otherwise, return 0.
+- *
+- */
+-static int pi_pre_block(struct kvm_vcpu *vcpu)
+-{
+- unsigned int dest;
+- struct pi_desc old, new;
+- struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+-
+- if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
+- !irq_remapping_cap(IRQ_POSTING_CAP) ||
+- !kvm_vcpu_apicv_active(vcpu))
+- return 0;
+-
+- WARN_ON(irqs_disabled());
+- local_irq_disable();
+- if (!WARN_ON_ONCE(vcpu->pre_pcpu != -1)) {
+- vcpu->pre_pcpu = vcpu->cpu;
+- spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+- list_add_tail(&vcpu->blocked_vcpu_list,
+- &per_cpu(blocked_vcpu_on_cpu,
+- vcpu->pre_pcpu));
+- spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+- }
+-
+- do {
+- old.control = new.control = pi_desc->control;
+-
+- WARN((pi_desc->sn == 1),
+- "Warning: SN field of posted-interrupts "
+- "is set before blocking\n");
+-
+- /*
+- * Since vCPU can be preempted during this process,
+- * vcpu->cpu could be different with pre_pcpu, we
+- * need to set pre_pcpu as the destination of wakeup
+- * notification event, then we can find the right vCPU
+- * to wakeup in wakeup handler if interrupts happen
+- * when the vCPU is in blocked state.
+- */
+- dest = cpu_physical_id(vcpu->pre_pcpu);
+-
+- if (x2apic_enabled())
+- new.ndst = dest;
+- else
+- new.ndst = (dest << 8) & 0xFF00;
+-
+- /* set 'NV' to 'wakeup vector' */
+- new.nv = POSTED_INTR_WAKEUP_VECTOR;
+- } while (cmpxchg64(&pi_desc->control, old.control,
+- new.control) != old.control);
+-
+- /* We should not block the vCPU if an interrupt is posted for it. */
+- if (pi_test_on(pi_desc) == 1)
+- __pi_post_block(vcpu);
+-
+- local_irq_enable();
+- return (vcpu->pre_pcpu == -1);
+-}
+-
+-static int vmx_pre_block(struct kvm_vcpu *vcpu)
+-{
+- if (pi_pre_block(vcpu))
+- return 1;
+-
+- if (kvm_lapic_hv_timer_in_use(vcpu))
+- kvm_lapic_switch_to_sw_timer(vcpu);
+-
+- return 0;
+-}
+-
+-static void pi_post_block(struct kvm_vcpu *vcpu)
+-{
+- if (vcpu->pre_pcpu == -1)
+- return;
+-
+- WARN_ON(irqs_disabled());
+- local_irq_disable();
+- __pi_post_block(vcpu);
+- local_irq_enable();
+-}
+-
+-static void vmx_post_block(struct kvm_vcpu *vcpu)
+-{
+- if (kvm_x86_ops->set_hv_timer)
+- kvm_lapic_switch_to_hv_timer(vcpu);
+-
+- pi_post_block(vcpu);
+-}
+-
+-/*
+- * vmx_update_pi_irte - set IRTE for Posted-Interrupts
+- *
+- * @kvm: kvm
+- * @host_irq: host irq of the interrupt
+- * @guest_irq: gsi of the interrupt
+- * @set: set or unset PI
+- * returns 0 on success, < 0 on failure
+- */
+-static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
+- uint32_t guest_irq, bool set)
+-{
+- struct kvm_kernel_irq_routing_entry *e;
+- struct kvm_irq_routing_table *irq_rt;
+- struct kvm_lapic_irq irq;
+- struct kvm_vcpu *vcpu;
+- struct vcpu_data vcpu_info;
+- int idx, ret = 0;
+-
+- if (!kvm_arch_has_assigned_device(kvm) ||
+- !irq_remapping_cap(IRQ_POSTING_CAP) ||
+- !kvm_vcpu_apicv_active(kvm->vcpus[0]))
+- return 0;
+-
+- idx = srcu_read_lock(&kvm->irq_srcu);
+- irq_rt = srcu_dereference(kvm->irq_routing, &kvm->irq_srcu);
+- if (guest_irq >= irq_rt->nr_rt_entries ||
+- hlist_empty(&irq_rt->map[guest_irq])) {
+- pr_warn_once("no route for guest_irq %u/%u (broken user space?)\n",
+- guest_irq, irq_rt->nr_rt_entries);
+- goto out;
+- }
+-
+- hlist_for_each_entry(e, &irq_rt->map[guest_irq], link) {
+- if (e->type != KVM_IRQ_ROUTING_MSI)
+- continue;
+- /*
+- * VT-d PI cannot support posting multicast/broadcast
+- * interrupts to a vCPU, we still use interrupt remapping
+- * for these kind of interrupts.
+- *
+- * For lowest-priority interrupts, we only support
+- * those with single CPU as the destination, e.g. user
+- * configures the interrupts via /proc/irq or uses
+- * irqbalance to make the interrupts single-CPU.
+- *
+- * We will support full lowest-priority interrupt later.
+- */
+-
+- kvm_set_msi_irq(kvm, e, &irq);
+- if (!kvm_intr_is_single_vcpu(kvm, &irq, &vcpu)) {
+- /*
+- * Make sure the IRTE is in remapped mode if
+- * we don't handle it in posted mode.
+- */
+- ret = irq_set_vcpu_affinity(host_irq, NULL);
+- if (ret < 0) {
+- printk(KERN_INFO
+- "failed to back to remapped mode, irq: %u\n",
+- host_irq);
+- goto out;
+- }
+-
+- continue;
+- }
+-
+- vcpu_info.pi_desc_addr = __pa(vcpu_to_pi_desc(vcpu));
+- vcpu_info.vector = irq.vector;
+-
+- trace_kvm_pi_irte_update(host_irq, vcpu->vcpu_id, e->gsi,
+- vcpu_info.vector, vcpu_info.pi_desc_addr, set);
+-
+- if (set)
+- ret = irq_set_vcpu_affinity(host_irq, &vcpu_info);
+- else
+- ret = irq_set_vcpu_affinity(host_irq, NULL);
+-
+- if (ret < 0) {
+- printk(KERN_INFO "%s: failed to update PI IRTE\n",
+- __func__);
+- goto out;
+- }
+- }
+-
+- ret = 0;
+-out:
+- srcu_read_unlock(&kvm->irq_srcu, idx);
+- return ret;
+-}
+-
+-static void vmx_setup_mce(struct kvm_vcpu *vcpu)
+-{
+- if (vcpu->arch.mcg_cap & MCG_LMCE_P)
+- to_vmx(vcpu)->msr_ia32_feature_control_valid_bits |=
+- FEATURE_CONTROL_LMCE;
+- else
+- to_vmx(vcpu)->msr_ia32_feature_control_valid_bits &=
+- ~FEATURE_CONTROL_LMCE;
+-}
+-
+-static int vmx_smi_allowed(struct kvm_vcpu *vcpu)
+-{
+- /* we need a nested vmexit to enter SMM, postpone if run is pending */
+- if (to_vmx(vcpu)->nested.nested_run_pending)
+- return 0;
+- return 1;
+-}
+-
+-static int vmx_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+-
+- vmx->nested.smm.guest_mode = is_guest_mode(vcpu);
+- if (vmx->nested.smm.guest_mode)
+- nested_vmx_vmexit(vcpu, -1, 0, 0);
+-
+- vmx->nested.smm.vmxon = vmx->nested.vmxon;
+- vmx->nested.vmxon = false;
+- vmx_clear_hlt(vcpu);
+- return 0;
+-}
+-
+-static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, u64 smbase)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- int ret;
+-
+- if (vmx->nested.smm.vmxon) {
+- vmx->nested.vmxon = true;
+- vmx->nested.smm.vmxon = false;
+- }
+-
+- if (vmx->nested.smm.guest_mode) {
+- vcpu->arch.hflags &= ~HF_SMM_MASK;
+- ret = enter_vmx_non_root_mode(vcpu, NULL);
+- vcpu->arch.hflags |= HF_SMM_MASK;
+- if (ret)
+- return ret;
+-
+- vmx->nested.smm.guest_mode = false;
+- }
+- return 0;
+-}
+-
+-static int enable_smi_window(struct kvm_vcpu *vcpu)
+-{
+- return 0;
+-}
+-
+-static int vmx_get_nested_state(struct kvm_vcpu *vcpu,
+- struct kvm_nested_state __user *user_kvm_nested_state,
+- u32 user_data_size)
+-{
+- struct vcpu_vmx *vmx;
+- struct vmcs12 *vmcs12;
+- struct kvm_nested_state kvm_state = {
+- .flags = 0,
+- .format = 0,
+- .size = sizeof(kvm_state),
+- .vmx.vmxon_pa = -1ull,
+- .vmx.vmcs_pa = -1ull,
+- };
+-
+- if (!vcpu)
+- return kvm_state.size + 2 * VMCS12_SIZE;
+-
+- vmx = to_vmx(vcpu);
+- vmcs12 = get_vmcs12(vcpu);
+- if (nested_vmx_allowed(vcpu) &&
+- (vmx->nested.vmxon || vmx->nested.smm.vmxon)) {
+- kvm_state.vmx.vmxon_pa = vmx->nested.vmxon_ptr;
+- kvm_state.vmx.vmcs_pa = vmx->nested.current_vmptr;
+-
+- if (vmx->nested.current_vmptr != -1ull) {
+- kvm_state.size += VMCS12_SIZE;
+-
+- if (is_guest_mode(vcpu) &&
+- nested_cpu_has_shadow_vmcs(vmcs12) &&
+- vmcs12->vmcs_link_pointer != -1ull)
+- kvm_state.size += VMCS12_SIZE;
+- }
+-
+- if (vmx->nested.smm.vmxon)
+- kvm_state.vmx.smm.flags |= KVM_STATE_NESTED_SMM_VMXON;
+-
+- if (vmx->nested.smm.guest_mode)
+- kvm_state.vmx.smm.flags |= KVM_STATE_NESTED_SMM_GUEST_MODE;
+-
+- if (is_guest_mode(vcpu)) {
+- kvm_state.flags |= KVM_STATE_NESTED_GUEST_MODE;
+-
+- if (vmx->nested.nested_run_pending)
+- kvm_state.flags |= KVM_STATE_NESTED_RUN_PENDING;
+- }
+- }
+-
+- if (user_data_size < kvm_state.size)
+- goto out;
+-
+- if (copy_to_user(user_kvm_nested_state, &kvm_state, sizeof(kvm_state)))
+- return -EFAULT;
+-
+- if (vmx->nested.current_vmptr == -1ull)
+- goto out;
+-
+- /*
+- * When running L2, the authoritative vmcs12 state is in the
+- * vmcs02. When running L1, the authoritative vmcs12 state is
+- * in the shadow vmcs linked to vmcs01, unless
+- * sync_shadow_vmcs is set, in which case, the authoritative
+- * vmcs12 state is in the vmcs12 already.
+- */
+- if (is_guest_mode(vcpu))
+- sync_vmcs12(vcpu, vmcs12);
+- else if (enable_shadow_vmcs && !vmx->nested.sync_shadow_vmcs)
+- copy_shadow_to_vmcs12(vmx);
+-
+- /*
+- * Copy over the full allocated size of vmcs12 rather than just the size
+- * of the struct.
+- */
+- if (copy_to_user(user_kvm_nested_state->data, vmcs12, VMCS12_SIZE))
+- return -EFAULT;
+-
+- if (nested_cpu_has_shadow_vmcs(vmcs12) &&
+- vmcs12->vmcs_link_pointer != -1ull) {
+- if (copy_to_user(user_kvm_nested_state->data + VMCS12_SIZE,
+- get_shadow_vmcs12(vcpu), VMCS12_SIZE))
+- return -EFAULT;
+- }
+-
+-out:
+- return kvm_state.size;
+-}
+-
+-static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
+- struct kvm_nested_state __user *user_kvm_nested_state,
+- struct kvm_nested_state *kvm_state)
+-{
+- struct vcpu_vmx *vmx = to_vmx(vcpu);
+- struct vmcs12 *vmcs12;
+- u32 exit_qual;
+- int ret;
+-
+- if (kvm_state->format != 0)
+- return -EINVAL;
+-
+- if (!nested_vmx_allowed(vcpu))
+- return kvm_state->vmx.vmxon_pa == -1ull ? 0 : -EINVAL;
+-
+- if (kvm_state->vmx.vmxon_pa == -1ull) {
+- if (kvm_state->vmx.smm.flags)
+- return -EINVAL;
+-
+- if (kvm_state->vmx.vmcs_pa != -1ull)
+- return -EINVAL;
+-
+- vmx_leave_nested(vcpu);
+- return 0;
+- }
+-
+- if (!page_address_valid(vcpu, kvm_state->vmx.vmxon_pa))
+- return -EINVAL;
+-
+- if ((kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_GUEST_MODE) &&
+- (kvm_state->flags & KVM_STATE_NESTED_GUEST_MODE))
+- return -EINVAL;
+-
+- if (kvm_state->vmx.smm.flags &
+- ~(KVM_STATE_NESTED_SMM_GUEST_MODE | KVM_STATE_NESTED_SMM_VMXON))
+- return -EINVAL;
+-
+- /*
+- * SMM temporarily disables VMX, so we cannot be in guest mode,
+- * nor can VMLAUNCH/VMRESUME be pending. Outside SMM, SMM flags
+- * must be zero.
+- */
+- if (is_smm(vcpu) ? kvm_state->flags : kvm_state->vmx.smm.flags)
+- return -EINVAL;
+-
+- if ((kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_GUEST_MODE) &&
+- !(kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_VMXON))
+- return -EINVAL;
+-
+- vmx_leave_nested(vcpu);
+- if (kvm_state->vmx.vmxon_pa == -1ull)
+- return 0;
+-
+- vmx->nested.vmxon_ptr = kvm_state->vmx.vmxon_pa;
+- ret = enter_vmx_operation(vcpu);
+- if (ret)
+- return ret;
+-
+- /* Empty 'VMXON' state is permitted */
+- if (kvm_state->size < sizeof(*kvm_state) + sizeof(*vmcs12))
+- return 0;
+-
+- if (kvm_state->vmx.vmcs_pa == kvm_state->vmx.vmxon_pa ||
+- !page_address_valid(vcpu, kvm_state->vmx.vmcs_pa))
+- return -EINVAL;
+-
+- set_current_vmptr(vmx, kvm_state->vmx.vmcs_pa);
+-
+- if (kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_VMXON) {
+- vmx->nested.smm.vmxon = true;
+- vmx->nested.vmxon = false;
+-
+- if (kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_GUEST_MODE)
+- vmx->nested.smm.guest_mode = true;
+- }
+-
+- vmcs12 = get_vmcs12(vcpu);
+- if (copy_from_user(vmcs12, user_kvm_nested_state->data, sizeof(*vmcs12)))
+- return -EFAULT;
+-
+- if (vmcs12->hdr.revision_id != VMCS12_REVISION)
+- return -EINVAL;
+-
+- if (!(kvm_state->flags & KVM_STATE_NESTED_GUEST_MODE))
+- return 0;
+-
+- vmx->nested.nested_run_pending =
+- !!(kvm_state->flags & KVM_STATE_NESTED_RUN_PENDING);
+-
+- if (nested_cpu_has_shadow_vmcs(vmcs12) &&
+- vmcs12->vmcs_link_pointer != -1ull) {
+- struct vmcs12 *shadow_vmcs12 = get_shadow_vmcs12(vcpu);
+- if (kvm_state->size < sizeof(*kvm_state) + 2 * sizeof(*vmcs12))
+- return -EINVAL;
+-
+- if (copy_from_user(shadow_vmcs12,
+- user_kvm_nested_state->data + VMCS12_SIZE,
+- sizeof(*vmcs12)))
+- return -EFAULT;
+-
+- if (shadow_vmcs12->hdr.revision_id != VMCS12_REVISION ||
+- !shadow_vmcs12->hdr.shadow_vmcs)
+- return -EINVAL;
+- }
+-
+- if (check_vmentry_prereqs(vcpu, vmcs12) ||
+- check_vmentry_postreqs(vcpu, vmcs12, &exit_qual))
+- return -EINVAL;
+-
+- vmx->nested.dirty_vmcs12 = true;
+- ret = enter_vmx_non_root_mode(vcpu, NULL);
+- if (ret)
+- return -EINVAL;
+-
+- return 0;
+-}
+-
+-static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
+- .cpu_has_kvm_support = cpu_has_kvm_support,
+- .disabled_by_bios = vmx_disabled_by_bios,
+- .hardware_setup = hardware_setup,
+- .hardware_unsetup = hardware_unsetup,
+- .check_processor_compatibility = vmx_check_processor_compat,
+- .hardware_enable = hardware_enable,
+- .hardware_disable = hardware_disable,
+- .cpu_has_accelerated_tpr = report_flexpriority,
+- .has_emulated_msr = vmx_has_emulated_msr,
+-
+- .vm_init = vmx_vm_init,
+- .vm_alloc = vmx_vm_alloc,
+- .vm_free = vmx_vm_free,
+-
+- .vcpu_create = vmx_create_vcpu,
+- .vcpu_free = vmx_free_vcpu,
+- .vcpu_reset = vmx_vcpu_reset,
+-
+- .prepare_guest_switch = vmx_prepare_switch_to_guest,
+- .vcpu_load = vmx_vcpu_load,
+- .vcpu_put = vmx_vcpu_put,
+-
+- .update_bp_intercept = update_exception_bitmap,
+- .get_msr_feature = vmx_get_msr_feature,
+- .get_msr = vmx_get_msr,
+- .set_msr = vmx_set_msr,
+- .get_segment_base = vmx_get_segment_base,
+- .get_segment = vmx_get_segment,
+- .set_segment = vmx_set_segment,
+- .get_cpl = vmx_get_cpl,
+- .get_cs_db_l_bits = vmx_get_cs_db_l_bits,
+- .decache_cr0_guest_bits = vmx_decache_cr0_guest_bits,
+- .decache_cr3 = vmx_decache_cr3,
+- .decache_cr4_guest_bits = vmx_decache_cr4_guest_bits,
+- .set_cr0 = vmx_set_cr0,
+- .set_cr3 = vmx_set_cr3,
+- .set_cr4 = vmx_set_cr4,
+- .set_efer = vmx_set_efer,
+- .get_idt = vmx_get_idt,
+- .set_idt = vmx_set_idt,
+- .get_gdt = vmx_get_gdt,
+- .set_gdt = vmx_set_gdt,
+- .get_dr6 = vmx_get_dr6,
+- .set_dr6 = vmx_set_dr6,
+- .set_dr7 = vmx_set_dr7,
+- .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs,
+- .cache_reg = vmx_cache_reg,
+- .get_rflags = vmx_get_rflags,
+- .set_rflags = vmx_set_rflags,
+-
+- .tlb_flush = vmx_flush_tlb,
+- .tlb_flush_gva = vmx_flush_tlb_gva,
+-
+- .run = vmx_vcpu_run,
+- .handle_exit = vmx_handle_exit,
+- .skip_emulated_instruction = skip_emulated_instruction,
+- .set_interrupt_shadow = vmx_set_interrupt_shadow,
+- .get_interrupt_shadow = vmx_get_interrupt_shadow,
+- .patch_hypercall = vmx_patch_hypercall,
+- .set_irq = vmx_inject_irq,
+- .set_nmi = vmx_inject_nmi,
+- .queue_exception = vmx_queue_exception,
+- .cancel_injection = vmx_cancel_injection,
+- .interrupt_allowed = vmx_interrupt_allowed,
+- .nmi_allowed = vmx_nmi_allowed,
+- .get_nmi_mask = vmx_get_nmi_mask,
+- .set_nmi_mask = vmx_set_nmi_mask,
+- .enable_nmi_window = enable_nmi_window,
+- .enable_irq_window = enable_irq_window,
+- .update_cr8_intercept = update_cr8_intercept,
+- .set_virtual_apic_mode = vmx_set_virtual_apic_mode,
+- .set_apic_access_page_addr = vmx_set_apic_access_page_addr,
+- .get_enable_apicv = vmx_get_enable_apicv,
+- .refresh_apicv_exec_ctrl = vmx_refresh_apicv_exec_ctrl,
+- .load_eoi_exitmap = vmx_load_eoi_exitmap,
+- .apicv_post_state_restore = vmx_apicv_post_state_restore,
+- .hwapic_irr_update = vmx_hwapic_irr_update,
+- .hwapic_isr_update = vmx_hwapic_isr_update,
+- .guest_apic_has_interrupt = vmx_guest_apic_has_interrupt,
+- .sync_pir_to_irr = vmx_sync_pir_to_irr,
+- .deliver_posted_interrupt = vmx_deliver_posted_interrupt,
+- .dy_apicv_has_pending_interrupt = vmx_dy_apicv_has_pending_interrupt,
+-
+- .set_tss_addr = vmx_set_tss_addr,
+- .set_identity_map_addr = vmx_set_identity_map_addr,
+- .get_tdp_level = get_ept_level,
+- .get_mt_mask = vmx_get_mt_mask,
+-
+- .get_exit_info = vmx_get_exit_info,
+-
+- .get_lpage_level = vmx_get_lpage_level,
+-
+- .cpuid_update = vmx_cpuid_update,
+-
+- .rdtscp_supported = vmx_rdtscp_supported,
+- .invpcid_supported = vmx_invpcid_supported,
+-
+- .set_supported_cpuid = vmx_set_supported_cpuid,
+-
+- .has_wbinvd_exit = cpu_has_vmx_wbinvd_exit,
+-
+- .read_l1_tsc_offset = vmx_read_l1_tsc_offset,
+- .write_l1_tsc_offset = vmx_write_l1_tsc_offset,
+-
+- .set_tdp_cr3 = vmx_set_cr3,
+-
+- .check_intercept = vmx_check_intercept,
+- .handle_external_intr = vmx_handle_external_intr,
+- .mpx_supported = vmx_mpx_supported,
+- .xsaves_supported = vmx_xsaves_supported,
+- .umip_emulated = vmx_umip_emulated,
+-
+- .check_nested_events = vmx_check_nested_events,
+- .request_immediate_exit = vmx_request_immediate_exit,
+-
+- .sched_in = vmx_sched_in,
+-
+- .slot_enable_log_dirty = vmx_slot_enable_log_dirty,
+- .slot_disable_log_dirty = vmx_slot_disable_log_dirty,
+- .flush_log_dirty = vmx_flush_log_dirty,
+- .enable_log_dirty_pt_masked = vmx_enable_log_dirty_pt_masked,
+- .write_log_dirty = vmx_write_pml_buffer,
+-
+- .pre_block = vmx_pre_block,
+- .post_block = vmx_post_block,
+-
+- .pmu_ops = &intel_pmu_ops,
+-
+- .update_pi_irte = vmx_update_pi_irte,
+-
+-#ifdef CONFIG_X86_64
+- .set_hv_timer = vmx_set_hv_timer,
+- .cancel_hv_timer = vmx_cancel_hv_timer,
+-#endif
+-
+- .setup_mce = vmx_setup_mce,
+-
+- .get_nested_state = vmx_get_nested_state,
+- .set_nested_state = vmx_set_nested_state,
+- .get_vmcs12_pages = nested_get_vmcs12_pages,
+-
+- .smi_allowed = vmx_smi_allowed,
+- .pre_enter_smm = vmx_pre_enter_smm,
+- .pre_leave_smm = vmx_pre_leave_smm,
+- .enable_smi_window = enable_smi_window,
+-};
+-
+-static void vmx_cleanup_l1d_flush(void)
+-{
+- if (vmx_l1d_flush_pages) {
+- free_pages((unsigned long)vmx_l1d_flush_pages, L1D_CACHE_ORDER);
+- vmx_l1d_flush_pages = NULL;
+- }
+- /* Restore state so sysfs ignores VMX */
+- l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
+-}
+-
+-static void vmx_exit(void)
+-{
+-#ifdef CONFIG_KEXEC_CORE
+- RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL);
+- synchronize_rcu();
+-#endif
+-
+- kvm_exit();
+-
+-#if IS_ENABLED(CONFIG_HYPERV)
+- if (static_branch_unlikely(&enable_evmcs)) {
+- int cpu;
+- struct hv_vp_assist_page *vp_ap;
+- /*
+- * Reset everything to support using non-enlightened VMCS
+- * access later (e.g. when we reload the module with
+- * enlightened_vmcs=0)
+- */
+- for_each_online_cpu(cpu) {
+- vp_ap = hv_get_vp_assist_page(cpu);
+-
+- if (!vp_ap)
+- continue;
+-
+- vp_ap->current_nested_vmcs = 0;
+- vp_ap->enlighten_vmentry = 0;
+- }
+-
+- static_branch_disable(&enable_evmcs);
+- }
+-#endif
+- vmx_cleanup_l1d_flush();
+-}
+-module_exit(vmx_exit);
+-
+-static int __init vmx_init(void)
+-{
+- int r, cpu;
+-
+-#if IS_ENABLED(CONFIG_HYPERV)
+- /*
+- * Enlightened VMCS usage should be recommended and the host needs
+- * to support eVMCS v1 or above. We can also disable eVMCS support
+- * with module parameter.
+- */
+- if (enlightened_vmcs &&
+- ms_hyperv.hints & HV_X64_ENLIGHTENED_VMCS_RECOMMENDED &&
+- (ms_hyperv.nested_features & HV_X64_ENLIGHTENED_VMCS_VERSION) >=
+- KVM_EVMCS_VERSION) {
+- int cpu;
+-
+- /* Check that we have assist pages on all online CPUs */
+- for_each_online_cpu(cpu) {
+- if (!hv_get_vp_assist_page(cpu)) {
+- enlightened_vmcs = false;
+- break;
+- }
+- }
+-
+- if (enlightened_vmcs) {
+- pr_info("KVM: vmx: using Hyper-V Enlightened VMCS\n");
+- static_branch_enable(&enable_evmcs);
+- }
+- } else {
+- enlightened_vmcs = false;
+- }
+-#endif
+-
+- r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx),
+- __alignof__(struct vcpu_vmx), THIS_MODULE);
+- if (r)
+- return r;
+-
+- /*
+- * Must be called after kvm_init() so enable_ept is properly set
+- * up. Hand the parameter mitigation value in which was stored in
+- * the pre module init parser. If no parameter was given, it will
+- * contain 'auto' which will be turned into the default 'cond'
+- * mitigation mode.
+- */
+- if (boot_cpu_has(X86_BUG_L1TF)) {
+- r = vmx_setup_l1d_flush(vmentry_l1d_flush_param);
+- if (r) {
+- vmx_exit();
+- return r;
+- }
+- }
+-
+- vmx_setup_fb_clear_ctrl();
+-
+- for_each_possible_cpu(cpu) {
+- INIT_LIST_HEAD(&per_cpu(loaded_vmcss_on_cpu, cpu));
+-
+- INIT_LIST_HEAD(&per_cpu(blocked_vcpu_on_cpu, cpu));
+- spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
+- }
+-
+-#ifdef CONFIG_KEXEC_CORE
+- rcu_assign_pointer(crash_vmclear_loaded_vmcss,
+- crash_vmclear_local_loaded_vmcss);
+-#endif
+- vmx_check_vmcs12_offsets();
+-
+- return 0;
+-}
+-module_init(vmx_init);
+diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
+new file mode 100644
+index 0000000000000..611f9e60f8154
+--- /dev/null
++++ b/arch/x86/kvm/vmx/pmu_intel.c
+@@ -0,0 +1,374 @@
++/*
++ * KVM PMU support for Intel CPUs
++ *
++ * Copyright 2011 Red Hat, Inc. and/or its affiliates.
++ *
++ * Authors:
++ * Avi Kivity <avi@redhat.com>
++ * Gleb Natapov <gleb@redhat.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2. See
++ * the COPYING file in the top-level directory.
++ *
++ */
++#include <linux/types.h>
++#include <linux/kvm_host.h>
++#include <linux/perf_event.h>
++#include <asm/perf_event.h>
++#include "x86.h"
++#include "cpuid.h"
++#include "lapic.h"
++#include "pmu.h"
++
++static struct kvm_event_hw_type_mapping intel_arch_events[] = {
++ /* Index must match CPUID 0x0A.EBX bit vector */
++ [0] = { 0x3c, 0x00, PERF_COUNT_HW_CPU_CYCLES },
++ [1] = { 0xc0, 0x00, PERF_COUNT_HW_INSTRUCTIONS },
++ [2] = { 0x3c, 0x01, PERF_COUNT_HW_BUS_CYCLES },
++ [3] = { 0x2e, 0x4f, PERF_COUNT_HW_CACHE_REFERENCES },
++ [4] = { 0x2e, 0x41, PERF_COUNT_HW_CACHE_MISSES },
++ [5] = { 0xc4, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS },
++ [6] = { 0xc5, 0x00, PERF_COUNT_HW_BRANCH_MISSES },
++ [7] = { 0x00, 0x03, PERF_COUNT_HW_REF_CPU_CYCLES },
++};
++
++/* mapping between fixed pmc index and intel_arch_events array */
++static int fixed_pmc_events[] = {1, 0, 7};
++
++static void reprogram_fixed_counters(struct kvm_pmu *pmu, u64 data)
++{
++ int i;
++
++ for (i = 0; i < pmu->nr_arch_fixed_counters; i++) {
++ u8 new_ctrl = fixed_ctrl_field(data, i);
++ u8 old_ctrl = fixed_ctrl_field(pmu->fixed_ctr_ctrl, i);
++ struct kvm_pmc *pmc;
++
++ pmc = get_fixed_pmc(pmu, MSR_CORE_PERF_FIXED_CTR0 + i);
++
++ if (old_ctrl == new_ctrl)
++ continue;
++
++ reprogram_fixed_counter(pmc, new_ctrl, i);
++ }
++
++ pmu->fixed_ctr_ctrl = data;
++}
++
++/* function is called when global control register has been updated. */
++static void global_ctrl_changed(struct kvm_pmu *pmu, u64 data)
++{
++ int bit;
++ u64 diff = pmu->global_ctrl ^ data;
++
++ pmu->global_ctrl = data;
++
++ for_each_set_bit(bit, (unsigned long *)&diff, X86_PMC_IDX_MAX)
++ reprogram_counter(pmu, bit);
++}
++
++static unsigned intel_find_arch_event(struct kvm_pmu *pmu,
++ u8 event_select,
++ u8 unit_mask)
++{
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(intel_arch_events); i++)
++ if (intel_arch_events[i].eventsel == event_select
++ && intel_arch_events[i].unit_mask == unit_mask
++ && (pmu->available_event_types & (1 << i)))
++ break;
++
++ if (i == ARRAY_SIZE(intel_arch_events))
++ return PERF_COUNT_HW_MAX;
++
++ return intel_arch_events[i].event_type;
++}
++
++static unsigned intel_find_fixed_event(int idx)
++{
++ u32 event;
++ size_t size = ARRAY_SIZE(fixed_pmc_events);
++
++ if (idx >= size)
++ return PERF_COUNT_HW_MAX;
++
++ event = fixed_pmc_events[array_index_nospec(idx, size)];
++ return intel_arch_events[event].event_type;
++}
++
++/* check if a PMC is enabled by comparing it with globl_ctrl bits. */
++static bool intel_pmc_is_enabled(struct kvm_pmc *pmc)
++{
++ struct kvm_pmu *pmu = pmc_to_pmu(pmc);
++
++ return test_bit(pmc->idx, (unsigned long *)&pmu->global_ctrl);
++}
++
++static struct kvm_pmc *intel_pmc_idx_to_pmc(struct kvm_pmu *pmu, int pmc_idx)
++{
++ if (pmc_idx < INTEL_PMC_IDX_FIXED)
++ return get_gp_pmc(pmu, MSR_P6_EVNTSEL0 + pmc_idx,
++ MSR_P6_EVNTSEL0);
++ else {
++ u32 idx = pmc_idx - INTEL_PMC_IDX_FIXED;
++
++ return get_fixed_pmc(pmu, idx + MSR_CORE_PERF_FIXED_CTR0);
++ }
++}
++
++/* returns 0 if idx's corresponding MSR exists; otherwise returns 1. */
++static int intel_is_valid_msr_idx(struct kvm_vcpu *vcpu, unsigned idx)
++{
++ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
++ bool fixed = idx & (1u << 30);
++
++ idx &= ~(3u << 30);
++
++ return (!fixed && idx >= pmu->nr_arch_gp_counters) ||
++ (fixed && idx >= pmu->nr_arch_fixed_counters);
++}
++
++static struct kvm_pmc *intel_msr_idx_to_pmc(struct kvm_vcpu *vcpu,
++ unsigned idx, u64 *mask)
++{
++ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
++ bool fixed = idx & (1u << 30);
++ struct kvm_pmc *counters;
++ unsigned int num_counters;
++
++ idx &= ~(3u << 30);
++ if (fixed) {
++ counters = pmu->fixed_counters;
++ num_counters = pmu->nr_arch_fixed_counters;
++ } else {
++ counters = pmu->gp_counters;
++ num_counters = pmu->nr_arch_gp_counters;
++ }
++ if (idx >= num_counters)
++ return NULL;
++ *mask &= pmu->counter_bitmask[fixed ? KVM_PMC_FIXED : KVM_PMC_GP];
++ return &counters[array_index_nospec(idx, num_counters)];
++}
++
++static bool intel_is_valid_msr(struct kvm_vcpu *vcpu, u32 msr)
++{
++ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
++ int ret;
++
++ switch (msr) {
++ case MSR_CORE_PERF_FIXED_CTR_CTRL:
++ case MSR_CORE_PERF_GLOBAL_STATUS:
++ case MSR_CORE_PERF_GLOBAL_CTRL:
++ case MSR_CORE_PERF_GLOBAL_OVF_CTRL:
++ ret = pmu->version > 1;
++ break;
++ default:
++ ret = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0) ||
++ get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0) ||
++ get_fixed_pmc(pmu, msr);
++ break;
++ }
++
++ return ret;
++}
++
++static int intel_pmu_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *data)
++{
++ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
++ struct kvm_pmc *pmc;
++
++ switch (msr) {
++ case MSR_CORE_PERF_FIXED_CTR_CTRL:
++ *data = pmu->fixed_ctr_ctrl;
++ return 0;
++ case MSR_CORE_PERF_GLOBAL_STATUS:
++ *data = pmu->global_status;
++ return 0;
++ case MSR_CORE_PERF_GLOBAL_CTRL:
++ *data = pmu->global_ctrl;
++ return 0;
++ case MSR_CORE_PERF_GLOBAL_OVF_CTRL:
++ *data = pmu->global_ovf_ctrl;
++ return 0;
++ default:
++ if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0))) {
++ u64 val = pmc_read_counter(pmc);
++ *data = val & pmu->counter_bitmask[KVM_PMC_GP];
++ return 0;
++ } else if ((pmc = get_fixed_pmc(pmu, msr))) {
++ u64 val = pmc_read_counter(pmc);
++ *data = val & pmu->counter_bitmask[KVM_PMC_FIXED];
++ return 0;
++ } else if ((pmc = get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0))) {
++ *data = pmc->eventsel;
++ return 0;
++ }
++ }
++
++ return 1;
++}
++
++static int intel_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
++{
++ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
++ struct kvm_pmc *pmc;
++ u32 msr = msr_info->index;
++ u64 data = msr_info->data;
++
++ switch (msr) {
++ case MSR_CORE_PERF_FIXED_CTR_CTRL:
++ if (pmu->fixed_ctr_ctrl == data)
++ return 0;
++ if (!(data & 0xfffffffffffff444ull)) {
++ reprogram_fixed_counters(pmu, data);
++ return 0;
++ }
++ break;
++ case MSR_CORE_PERF_GLOBAL_STATUS:
++ if (msr_info->host_initiated) {
++ pmu->global_status = data;
++ return 0;
++ }
++ break; /* RO MSR */
++ case MSR_CORE_PERF_GLOBAL_CTRL:
++ if (pmu->global_ctrl == data)
++ return 0;
++ if (!(data & pmu->global_ctrl_mask)) {
++ global_ctrl_changed(pmu, data);
++ return 0;
++ }
++ break;
++ case MSR_CORE_PERF_GLOBAL_OVF_CTRL:
++ if (!(data & (pmu->global_ctrl_mask & ~(3ull<<62)))) {
++ if (!msr_info->host_initiated)
++ pmu->global_status &= ~data;
++ pmu->global_ovf_ctrl = data;
++ return 0;
++ }
++ break;
++ default:
++ if ((pmc = get_gp_pmc(pmu, msr, MSR_IA32_PERFCTR0))) {
++ if (msr_info->host_initiated)
++ pmc->counter = data;
++ else
++ pmc->counter = (s32)data;
++ return 0;
++ } else if ((pmc = get_fixed_pmc(pmu, msr))) {
++ pmc->counter = data;
++ return 0;
++ } else if ((pmc = get_gp_pmc(pmu, msr, MSR_P6_EVNTSEL0))) {
++ if (data == pmc->eventsel)
++ return 0;
++ if (!(data & pmu->reserved_bits)) {
++ reprogram_gp_counter(pmc, data);
++ return 0;
++ }
++ }
++ }
++
++ return 1;
++}
++
++static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
++{
++ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
++ struct kvm_cpuid_entry2 *entry;
++ union cpuid10_eax eax;
++ union cpuid10_edx edx;
++
++ pmu->nr_arch_gp_counters = 0;
++ pmu->nr_arch_fixed_counters = 0;
++ pmu->counter_bitmask[KVM_PMC_GP] = 0;
++ pmu->counter_bitmask[KVM_PMC_FIXED] = 0;
++ pmu->version = 0;
++ pmu->reserved_bits = 0xffffffff00200000ull;
++
++ entry = kvm_find_cpuid_entry(vcpu, 0xa, 0);
++ if (!entry)
++ return;
++ eax.full = entry->eax;
++ edx.full = entry->edx;
++
++ pmu->version = eax.split.version_id;
++ if (!pmu->version)
++ return;
++
++ pmu->nr_arch_gp_counters = min_t(int, eax.split.num_counters,
++ INTEL_PMC_MAX_GENERIC);
++ pmu->counter_bitmask[KVM_PMC_GP] = ((u64)1 << eax.split.bit_width) - 1;
++ pmu->available_event_types = ~entry->ebx &
++ ((1ull << eax.split.mask_length) - 1);
++
++ if (pmu->version == 1) {
++ pmu->nr_arch_fixed_counters = 0;
++ } else {
++ pmu->nr_arch_fixed_counters =
++ min_t(int, edx.split.num_counters_fixed,
++ INTEL_PMC_MAX_FIXED);
++ pmu->counter_bitmask[KVM_PMC_FIXED] =
++ ((u64)1 << edx.split.bit_width_fixed) - 1;
++ }
++
++ pmu->global_ctrl = ((1ull << pmu->nr_arch_gp_counters) - 1) |
++ (((1ull << pmu->nr_arch_fixed_counters) - 1) << INTEL_PMC_IDX_FIXED);
++ pmu->global_ctrl_mask = ~pmu->global_ctrl;
++
++ entry = kvm_find_cpuid_entry(vcpu, 7, 0);
++ if (entry &&
++ (boot_cpu_has(X86_FEATURE_HLE) || boot_cpu_has(X86_FEATURE_RTM)) &&
++ (entry->ebx & (X86_FEATURE_HLE|X86_FEATURE_RTM)))
++ pmu->reserved_bits ^= HSW_IN_TX|HSW_IN_TX_CHECKPOINTED;
++}
++
++static void intel_pmu_init(struct kvm_vcpu *vcpu)
++{
++ int i;
++ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
++
++ for (i = 0; i < INTEL_PMC_MAX_GENERIC; i++) {
++ pmu->gp_counters[i].type = KVM_PMC_GP;
++ pmu->gp_counters[i].vcpu = vcpu;
++ pmu->gp_counters[i].idx = i;
++ }
++
++ for (i = 0; i < INTEL_PMC_MAX_FIXED; i++) {
++ pmu->fixed_counters[i].type = KVM_PMC_FIXED;
++ pmu->fixed_counters[i].vcpu = vcpu;
++ pmu->fixed_counters[i].idx = i + INTEL_PMC_IDX_FIXED;
++ }
++}
++
++static void intel_pmu_reset(struct kvm_vcpu *vcpu)
++{
++ struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
++ int i;
++
++ for (i = 0; i < INTEL_PMC_MAX_GENERIC; i++) {
++ struct kvm_pmc *pmc = &pmu->gp_counters[i];
++
++ pmc_stop_counter(pmc);
++ pmc->counter = pmc->eventsel = 0;
++ }
++
++ for (i = 0; i < INTEL_PMC_MAX_FIXED; i++)
++ pmc_stop_counter(&pmu->fixed_counters[i]);
++
++ pmu->fixed_ctr_ctrl = pmu->global_ctrl = pmu->global_status =
++ pmu->global_ovf_ctrl = 0;
++}
++
++struct kvm_pmu_ops intel_pmu_ops = {
++ .find_arch_event = intel_find_arch_event,
++ .find_fixed_event = intel_find_fixed_event,
++ .pmc_is_enabled = intel_pmc_is_enabled,
++ .pmc_idx_to_pmc = intel_pmc_idx_to_pmc,
++ .msr_idx_to_pmc = intel_msr_idx_to_pmc,
++ .is_valid_msr_idx = intel_is_valid_msr_idx,
++ .is_valid_msr = intel_is_valid_msr,
++ .get_msr = intel_pmu_get_msr,
++ .set_msr = intel_pmu_set_msr,
++ .refresh = intel_pmu_refresh,
++ .init = intel_pmu_init,
++ .reset = intel_pmu_reset,
++};
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+new file mode 100644
+index 0000000000000..ec821a5d131a0
+--- /dev/null
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -0,0 +1,14764 @@
++/*
++ * Kernel-based Virtual Machine driver for Linux
++ *
++ * This module enables machines with Intel VT-x extensions to run virtual
++ * machines without emulation or binary translation.
++ *
++ * Copyright (C) 2006 Qumranet, Inc.
++ * Copyright 2010 Red Hat, Inc. and/or its affiliates.
++ *
++ * Authors:
++ * Avi Kivity <avi@qumranet.com>
++ * Yaniv Kamay <yaniv@qumranet.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2. See
++ * the COPYING file in the top-level directory.
++ *
++ */
++
++#include "irq.h"
++#include "mmu.h"
++#include "cpuid.h"
++#include "lapic.h"
++
++#include <linux/kvm_host.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/highmem.h>
++#include <linux/sched.h>
++#include <linux/sched/smt.h>
++#include <linux/moduleparam.h>
++#include <linux/mod_devicetable.h>
++#include <linux/trace_events.h>
++#include <linux/slab.h>
++#include <linux/tboot.h>
++#include <linux/hrtimer.h>
++#include <linux/frame.h>
++#include <linux/nospec.h>
++#include "kvm_cache_regs.h"
++#include "x86.h"
++
++#include <asm/asm.h>
++#include <asm/cpu.h>
++#include <asm/cpu_device_id.h>
++#include <asm/io.h>
++#include <asm/desc.h>
++#include <asm/vmx.h>
++#include <asm/virtext.h>
++#include <asm/mce.h>
++#include <asm/fpu/internal.h>
++#include <asm/perf_event.h>
++#include <asm/debugreg.h>
++#include <asm/kexec.h>
++#include <asm/apic.h>
++#include <asm/irq_remapping.h>
++#include <asm/mmu_context.h>
++#include <asm/spec-ctrl.h>
++#include <asm/mshyperv.h>
++
++#include "trace.h"
++#include "pmu.h"
++#include "vmx_evmcs.h"
++
++#define __ex(x) __kvm_handle_fault_on_reboot(x)
++#define __ex_clear(x, reg) \
++ ____kvm_handle_fault_on_reboot(x, "xor " reg " , " reg)
++
++MODULE_AUTHOR("Qumranet");
++MODULE_LICENSE("GPL");
++
++static const struct x86_cpu_id vmx_cpu_id[] = {
++ X86_FEATURE_MATCH(X86_FEATURE_VMX),
++ {}
++};
++MODULE_DEVICE_TABLE(x86cpu, vmx_cpu_id);
++
++static bool __read_mostly enable_vpid = 1;
++module_param_named(vpid, enable_vpid, bool, 0444);
++
++static bool __read_mostly enable_vnmi = 1;
++module_param_named(vnmi, enable_vnmi, bool, S_IRUGO);
++
++static bool __read_mostly flexpriority_enabled = 1;
++module_param_named(flexpriority, flexpriority_enabled, bool, S_IRUGO);
++
++static bool __read_mostly enable_ept = 1;
++module_param_named(ept, enable_ept, bool, S_IRUGO);
++
++static bool __read_mostly enable_unrestricted_guest = 1;
++module_param_named(unrestricted_guest,
++ enable_unrestricted_guest, bool, S_IRUGO);
++
++static bool __read_mostly enable_ept_ad_bits = 1;
++module_param_named(eptad, enable_ept_ad_bits, bool, S_IRUGO);
++
++static bool __read_mostly emulate_invalid_guest_state = true;
++module_param(emulate_invalid_guest_state, bool, S_IRUGO);
++
++static bool __read_mostly fasteoi = 1;
++module_param(fasteoi, bool, S_IRUGO);
++
++static bool __read_mostly enable_apicv = 1;
++module_param(enable_apicv, bool, S_IRUGO);
++
++static bool __read_mostly enable_shadow_vmcs = 1;
++module_param_named(enable_shadow_vmcs, enable_shadow_vmcs, bool, S_IRUGO);
++/*
++ * If nested=1, nested virtualization is supported, i.e., guests may use
++ * VMX and be a hypervisor for its own guests. If nested=0, guests may not
++ * use VMX instructions.
++ */
++static bool __read_mostly nested = 0;
++module_param(nested, bool, S_IRUGO);
++
++static u64 __read_mostly host_xss;
++
++static bool __read_mostly enable_pml = 1;
++module_param_named(pml, enable_pml, bool, S_IRUGO);
++
++#define MSR_TYPE_R 1
++#define MSR_TYPE_W 2
++#define MSR_TYPE_RW 3
++
++#define MSR_BITMAP_MODE_X2APIC 1
++#define MSR_BITMAP_MODE_X2APIC_APICV 2
++
++#define KVM_VMX_TSC_MULTIPLIER_MAX 0xffffffffffffffffULL
++
++/* Guest_tsc -> host_tsc conversion requires 64-bit division. */
++static int __read_mostly cpu_preemption_timer_multi;
++static bool __read_mostly enable_preemption_timer = 1;
++#ifdef CONFIG_X86_64
++module_param_named(preemption_timer, enable_preemption_timer, bool, S_IRUGO);
++#endif
++
++#define KVM_GUEST_CR0_MASK (X86_CR0_NW | X86_CR0_CD)
++#define KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR0_NE
++#define KVM_VM_CR0_ALWAYS_ON \
++ (KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST | \
++ X86_CR0_WP | X86_CR0_PG | X86_CR0_PE)
++#define KVM_CR4_GUEST_OWNED_BITS \
++ (X86_CR4_PVI | X86_CR4_DE | X86_CR4_PCE | X86_CR4_OSFXSR \
++ | X86_CR4_OSXMMEXCPT | X86_CR4_LA57 | X86_CR4_TSD)
++
++#define KVM_VM_CR4_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR4_VMXE
++#define KVM_PMODE_VM_CR4_ALWAYS_ON (X86_CR4_PAE | X86_CR4_VMXE)
++#define KVM_RMODE_VM_CR4_ALWAYS_ON (X86_CR4_VME | X86_CR4_PAE | X86_CR4_VMXE)
++
++#define RMODE_GUEST_OWNED_EFLAGS_BITS (~(X86_EFLAGS_IOPL | X86_EFLAGS_VM))
++
++#define VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE 5
++
++/*
++ * Hyper-V requires all of these, so mark them as supported even though
++ * they are just treated the same as all-context.
++ */
++#define VMX_VPID_EXTENT_SUPPORTED_MASK \
++ (VMX_VPID_EXTENT_INDIVIDUAL_ADDR_BIT | \
++ VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT | \
++ VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT | \
++ VMX_VPID_EXTENT_SINGLE_NON_GLOBAL_BIT)
++
++/*
++ * These 2 parameters are used to config the controls for Pause-Loop Exiting:
++ * ple_gap: upper bound on the amount of time between two successive
++ * executions of PAUSE in a loop. Also indicate if ple enabled.
++ * According to test, this time is usually smaller than 128 cycles.
++ * ple_window: upper bound on the amount of time a guest is allowed to execute
++ * in a PAUSE loop. Tests indicate that most spinlocks are held for
++ * less than 2^12 cycles
++ * Time is measured based on a counter that runs at the same rate as the TSC,
++ * refer SDM volume 3b section 21.6.13 & 22.1.3.
++ */
++static unsigned int ple_gap = KVM_DEFAULT_PLE_GAP;
++module_param(ple_gap, uint, 0444);
++
++static unsigned int ple_window = KVM_VMX_DEFAULT_PLE_WINDOW;
++module_param(ple_window, uint, 0444);
++
++/* Default doubles per-vcpu window every exit. */
++static unsigned int ple_window_grow = KVM_DEFAULT_PLE_WINDOW_GROW;
++module_param(ple_window_grow, uint, 0444);
++
++/* Default resets per-vcpu window every exit to ple_window. */
++static unsigned int ple_window_shrink = KVM_DEFAULT_PLE_WINDOW_SHRINK;
++module_param(ple_window_shrink, uint, 0444);
++
++/* Default is to compute the maximum so we can never overflow. */
++static unsigned int ple_window_max = KVM_VMX_DEFAULT_PLE_WINDOW_MAX;
++module_param(ple_window_max, uint, 0444);
++
++extern const ulong vmx_return;
++
++static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush);
++static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_cond);
++static DEFINE_MUTEX(vmx_l1d_flush_mutex);
++
++/* Storage for pre module init parameter parsing */
++static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param = VMENTER_L1D_FLUSH_AUTO;
++
++static const struct {
++ const char *option;
++ bool for_parse;
++} vmentry_l1d_param[] = {
++ [VMENTER_L1D_FLUSH_AUTO] = {"auto", true},
++ [VMENTER_L1D_FLUSH_NEVER] = {"never", true},
++ [VMENTER_L1D_FLUSH_COND] = {"cond", true},
++ [VMENTER_L1D_FLUSH_ALWAYS] = {"always", true},
++ [VMENTER_L1D_FLUSH_EPT_DISABLED] = {"EPT disabled", false},
++ [VMENTER_L1D_FLUSH_NOT_REQUIRED] = {"not required", false},
++};
++
++#define L1D_CACHE_ORDER 4
++static void *vmx_l1d_flush_pages;
++
++/* Control for disabling CPU Fill buffer clear */
++static bool __read_mostly vmx_fb_clear_ctrl_available;
++
++static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf)
++{
++ struct page *page;
++ unsigned int i;
++
++ if (!enable_ept) {
++ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_EPT_DISABLED;
++ return 0;
++ }
++
++ if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) {
++ u64 msr;
++
++ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, msr);
++ if (msr & ARCH_CAP_SKIP_VMENTRY_L1DFLUSH) {
++ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED;
++ return 0;
++ }
++ }
++
++ /* If set to auto use the default l1tf mitigation method */
++ if (l1tf == VMENTER_L1D_FLUSH_AUTO) {
++ switch (l1tf_mitigation) {
++ case L1TF_MITIGATION_OFF:
++ l1tf = VMENTER_L1D_FLUSH_NEVER;
++ break;
++ case L1TF_MITIGATION_FLUSH_NOWARN:
++ case L1TF_MITIGATION_FLUSH:
++ case L1TF_MITIGATION_FLUSH_NOSMT:
++ l1tf = VMENTER_L1D_FLUSH_COND;
++ break;
++ case L1TF_MITIGATION_FULL:
++ case L1TF_MITIGATION_FULL_FORCE:
++ l1tf = VMENTER_L1D_FLUSH_ALWAYS;
++ break;
++ }
++ } else if (l1tf_mitigation == L1TF_MITIGATION_FULL_FORCE) {
++ l1tf = VMENTER_L1D_FLUSH_ALWAYS;
++ }
++
++ if (l1tf != VMENTER_L1D_FLUSH_NEVER && !vmx_l1d_flush_pages &&
++ !boot_cpu_has(X86_FEATURE_FLUSH_L1D)) {
++ page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER);
++ if (!page)
++ return -ENOMEM;
++ vmx_l1d_flush_pages = page_address(page);
++
++ /*
++ * Initialize each page with a different pattern in
++ * order to protect against KSM in the nested
++ * virtualization case.
++ */
++ for (i = 0; i < 1u << L1D_CACHE_ORDER; ++i) {
++ memset(vmx_l1d_flush_pages + i * PAGE_SIZE, i + 1,
++ PAGE_SIZE);
++ }
++ }
++
++ l1tf_vmx_mitigation = l1tf;
++
++ if (l1tf != VMENTER_L1D_FLUSH_NEVER)
++ static_branch_enable(&vmx_l1d_should_flush);
++ else
++ static_branch_disable(&vmx_l1d_should_flush);
++
++ if (l1tf == VMENTER_L1D_FLUSH_COND)
++ static_branch_enable(&vmx_l1d_flush_cond);
++ else
++ static_branch_disable(&vmx_l1d_flush_cond);
++ return 0;
++}
++
++static int vmentry_l1d_flush_parse(const char *s)
++{
++ unsigned int i;
++
++ if (s) {
++ for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
++ if (vmentry_l1d_param[i].for_parse &&
++ sysfs_streq(s, vmentry_l1d_param[i].option))
++ return i;
++ }
++ }
++ return -EINVAL;
++}
++
++static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp)
++{
++ int l1tf, ret;
++
++ l1tf = vmentry_l1d_flush_parse(s);
++ if (l1tf < 0)
++ return l1tf;
++
++ if (!boot_cpu_has(X86_BUG_L1TF))
++ return 0;
++
++ /*
++ * Has vmx_init() run already? If not then this is the pre init
++ * parameter parsing. In that case just store the value and let
++ * vmx_init() do the proper setup after enable_ept has been
++ * established.
++ */
++ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO) {
++ vmentry_l1d_flush_param = l1tf;
++ return 0;
++ }
++
++ mutex_lock(&vmx_l1d_flush_mutex);
++ ret = vmx_setup_l1d_flush(l1tf);
++ mutex_unlock(&vmx_l1d_flush_mutex);
++ return ret;
++}
++
++static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp)
++{
++ if (WARN_ON_ONCE(l1tf_vmx_mitigation >= ARRAY_SIZE(vmentry_l1d_param)))
++ return sprintf(s, "???\n");
++
++ return sprintf(s, "%s\n", vmentry_l1d_param[l1tf_vmx_mitigation].option);
++}
++
++static const struct kernel_param_ops vmentry_l1d_flush_ops = {
++ .set = vmentry_l1d_flush_set,
++ .get = vmentry_l1d_flush_get,
++};
++module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, NULL, 0644);
++
++enum ept_pointers_status {
++ EPT_POINTERS_CHECK = 0,
++ EPT_POINTERS_MATCH = 1,
++ EPT_POINTERS_MISMATCH = 2
++};
++
++struct kvm_vmx {
++ struct kvm kvm;
++
++ unsigned int tss_addr;
++ bool ept_identity_pagetable_done;
++ gpa_t ept_identity_map_addr;
++
++ enum ept_pointers_status ept_pointers_match;
++ spinlock_t ept_pointer_lock;
++};
++
++#define NR_AUTOLOAD_MSRS 8
++
++struct vmcs_hdr {
++ u32 revision_id:31;
++ u32 shadow_vmcs:1;
++};
++
++struct vmcs {
++ struct vmcs_hdr hdr;
++ u32 abort;
++ char data[0];
++};
++
++/*
++ * vmcs_host_state tracks registers that are loaded from the VMCS on VMEXIT
++ * and whose values change infrequently, but are not constant. I.e. this is
++ * used as a write-through cache of the corresponding VMCS fields.
++ */
++struct vmcs_host_state {
++ unsigned long cr3; /* May not match real cr3 */
++ unsigned long cr4; /* May not match real cr4 */
++ unsigned long gs_base;
++ unsigned long fs_base;
++
++ u16 fs_sel, gs_sel, ldt_sel;
++#ifdef CONFIG_X86_64
++ u16 ds_sel, es_sel;
++#endif
++};
++
++/*
++ * Track a VMCS that may be loaded on a certain CPU. If it is (cpu!=-1), also
++ * remember whether it was VMLAUNCHed, and maintain a linked list of all VMCSs
++ * loaded on this CPU (so we can clear them if the CPU goes down).
++ */
++struct loaded_vmcs {
++ struct vmcs *vmcs;
++ struct vmcs *shadow_vmcs;
++ int cpu;
++ bool launched;
++ bool nmi_known_unmasked;
++ bool hv_timer_armed;
++ /* Support for vnmi-less CPUs */
++ int soft_vnmi_blocked;
++ ktime_t entry_time;
++ s64 vnmi_blocked_time;
++ unsigned long *msr_bitmap;
++ struct list_head loaded_vmcss_on_cpu_link;
++ struct vmcs_host_state host_state;
++};
++
++struct shared_msr_entry {
++ unsigned index;
++ u64 data;
++ u64 mask;
++};
++
++/*
++ * struct vmcs12 describes the state that our guest hypervisor (L1) keeps for a
++ * single nested guest (L2), hence the name vmcs12. Any VMX implementation has
++ * a VMCS structure, and vmcs12 is our emulated VMX's VMCS. This structure is
++ * stored in guest memory specified by VMPTRLD, but is opaque to the guest,
++ * which must access it using VMREAD/VMWRITE/VMCLEAR instructions.
++ * More than one of these structures may exist, if L1 runs multiple L2 guests.
++ * nested_vmx_run() will use the data here to build the vmcs02: a VMCS for the
++ * underlying hardware which will be used to run L2.
++ * This structure is packed to ensure that its layout is identical across
++ * machines (necessary for live migration).
++ *
++ * IMPORTANT: Changing the layout of existing fields in this structure
++ * will break save/restore compatibility with older kvm releases. When
++ * adding new fields, either use space in the reserved padding* arrays
++ * or add the new fields to the end of the structure.
++ */
++typedef u64 natural_width;
++struct __packed vmcs12 {
++ /* According to the Intel spec, a VMCS region must start with the
++ * following two fields. Then follow implementation-specific data.
++ */
++ struct vmcs_hdr hdr;
++ u32 abort;
++
++ u32 launch_state; /* set to 0 by VMCLEAR, to 1 by VMLAUNCH */
++ u32 padding[7]; /* room for future expansion */
++
++ u64 io_bitmap_a;
++ u64 io_bitmap_b;
++ u64 msr_bitmap;
++ u64 vm_exit_msr_store_addr;
++ u64 vm_exit_msr_load_addr;
++ u64 vm_entry_msr_load_addr;
++ u64 tsc_offset;
++ u64 virtual_apic_page_addr;
++ u64 apic_access_addr;
++ u64 posted_intr_desc_addr;
++ u64 ept_pointer;
++ u64 eoi_exit_bitmap0;
++ u64 eoi_exit_bitmap1;
++ u64 eoi_exit_bitmap2;
++ u64 eoi_exit_bitmap3;
++ u64 xss_exit_bitmap;
++ u64 guest_physical_address;
++ u64 vmcs_link_pointer;
++ u64 guest_ia32_debugctl;
++ u64 guest_ia32_pat;
++ u64 guest_ia32_efer;
++ u64 guest_ia32_perf_global_ctrl;
++ u64 guest_pdptr0;
++ u64 guest_pdptr1;
++ u64 guest_pdptr2;
++ u64 guest_pdptr3;
++ u64 guest_bndcfgs;
++ u64 host_ia32_pat;
++ u64 host_ia32_efer;
++ u64 host_ia32_perf_global_ctrl;
++ u64 vmread_bitmap;
++ u64 vmwrite_bitmap;
++ u64 vm_function_control;
++ u64 eptp_list_address;
++ u64 pml_address;
++ u64 padding64[3]; /* room for future expansion */
++ /*
++ * To allow migration of L1 (complete with its L2 guests) between
++ * machines of different natural widths (32 or 64 bit), we cannot have
++ * unsigned long fields with no explict size. We use u64 (aliased
++ * natural_width) instead. Luckily, x86 is little-endian.
++ */
++ natural_width cr0_guest_host_mask;
++ natural_width cr4_guest_host_mask;
++ natural_width cr0_read_shadow;
++ natural_width cr4_read_shadow;
++ natural_width cr3_target_value0;
++ natural_width cr3_target_value1;
++ natural_width cr3_target_value2;
++ natural_width cr3_target_value3;
++ natural_width exit_qualification;
++ natural_width guest_linear_address;
++ natural_width guest_cr0;
++ natural_width guest_cr3;
++ natural_width guest_cr4;
++ natural_width guest_es_base;
++ natural_width guest_cs_base;
++ natural_width guest_ss_base;
++ natural_width guest_ds_base;
++ natural_width guest_fs_base;
++ natural_width guest_gs_base;
++ natural_width guest_ldtr_base;
++ natural_width guest_tr_base;
++ natural_width guest_gdtr_base;
++ natural_width guest_idtr_base;
++ natural_width guest_dr7;
++ natural_width guest_rsp;
++ natural_width guest_rip;
++ natural_width guest_rflags;
++ natural_width guest_pending_dbg_exceptions;
++ natural_width guest_sysenter_esp;
++ natural_width guest_sysenter_eip;
++ natural_width host_cr0;
++ natural_width host_cr3;
++ natural_width host_cr4;
++ natural_width host_fs_base;
++ natural_width host_gs_base;
++ natural_width host_tr_base;
++ natural_width host_gdtr_base;
++ natural_width host_idtr_base;
++ natural_width host_ia32_sysenter_esp;
++ natural_width host_ia32_sysenter_eip;
++ natural_width host_rsp;
++ natural_width host_rip;
++ natural_width paddingl[8]; /* room for future expansion */
++ u32 pin_based_vm_exec_control;
++ u32 cpu_based_vm_exec_control;
++ u32 exception_bitmap;
++ u32 page_fault_error_code_mask;
++ u32 page_fault_error_code_match;
++ u32 cr3_target_count;
++ u32 vm_exit_controls;
++ u32 vm_exit_msr_store_count;
++ u32 vm_exit_msr_load_count;
++ u32 vm_entry_controls;
++ u32 vm_entry_msr_load_count;
++ u32 vm_entry_intr_info_field;
++ u32 vm_entry_exception_error_code;
++ u32 vm_entry_instruction_len;
++ u32 tpr_threshold;
++ u32 secondary_vm_exec_control;
++ u32 vm_instruction_error;
++ u32 vm_exit_reason;
++ u32 vm_exit_intr_info;
++ u32 vm_exit_intr_error_code;
++ u32 idt_vectoring_info_field;
++ u32 idt_vectoring_error_code;
++ u32 vm_exit_instruction_len;
++ u32 vmx_instruction_info;
++ u32 guest_es_limit;
++ u32 guest_cs_limit;
++ u32 guest_ss_limit;
++ u32 guest_ds_limit;
++ u32 guest_fs_limit;
++ u32 guest_gs_limit;
++ u32 guest_ldtr_limit;
++ u32 guest_tr_limit;
++ u32 guest_gdtr_limit;
++ u32 guest_idtr_limit;
++ u32 guest_es_ar_bytes;
++ u32 guest_cs_ar_bytes;
++ u32 guest_ss_ar_bytes;
++ u32 guest_ds_ar_bytes;
++ u32 guest_fs_ar_bytes;
++ u32 guest_gs_ar_bytes;
++ u32 guest_ldtr_ar_bytes;
++ u32 guest_tr_ar_bytes;
++ u32 guest_interruptibility_info;
++ u32 guest_activity_state;
++ u32 guest_sysenter_cs;
++ u32 host_ia32_sysenter_cs;
++ u32 vmx_preemption_timer_value;
++ u32 padding32[7]; /* room for future expansion */
++ u16 virtual_processor_id;
++ u16 posted_intr_nv;
++ u16 guest_es_selector;
++ u16 guest_cs_selector;
++ u16 guest_ss_selector;
++ u16 guest_ds_selector;
++ u16 guest_fs_selector;
++ u16 guest_gs_selector;
++ u16 guest_ldtr_selector;
++ u16 guest_tr_selector;
++ u16 guest_intr_status;
++ u16 host_es_selector;
++ u16 host_cs_selector;
++ u16 host_ss_selector;
++ u16 host_ds_selector;
++ u16 host_fs_selector;
++ u16 host_gs_selector;
++ u16 host_tr_selector;
++ u16 guest_pml_index;
++};
++
++/*
++ * For save/restore compatibility, the vmcs12 field offsets must not change.
++ */
++#define CHECK_OFFSET(field, loc) \
++ BUILD_BUG_ON_MSG(offsetof(struct vmcs12, field) != (loc), \
++ "Offset of " #field " in struct vmcs12 has changed.")
++
++static inline void vmx_check_vmcs12_offsets(void) {
++ CHECK_OFFSET(hdr, 0);
++ CHECK_OFFSET(abort, 4);
++ CHECK_OFFSET(launch_state, 8);
++ CHECK_OFFSET(io_bitmap_a, 40);
++ CHECK_OFFSET(io_bitmap_b, 48);
++ CHECK_OFFSET(msr_bitmap, 56);
++ CHECK_OFFSET(vm_exit_msr_store_addr, 64);
++ CHECK_OFFSET(vm_exit_msr_load_addr, 72);
++ CHECK_OFFSET(vm_entry_msr_load_addr, 80);
++ CHECK_OFFSET(tsc_offset, 88);
++ CHECK_OFFSET(virtual_apic_page_addr, 96);
++ CHECK_OFFSET(apic_access_addr, 104);
++ CHECK_OFFSET(posted_intr_desc_addr, 112);
++ CHECK_OFFSET(ept_pointer, 120);
++ CHECK_OFFSET(eoi_exit_bitmap0, 128);
++ CHECK_OFFSET(eoi_exit_bitmap1, 136);
++ CHECK_OFFSET(eoi_exit_bitmap2, 144);
++ CHECK_OFFSET(eoi_exit_bitmap3, 152);
++ CHECK_OFFSET(xss_exit_bitmap, 160);
++ CHECK_OFFSET(guest_physical_address, 168);
++ CHECK_OFFSET(vmcs_link_pointer, 176);
++ CHECK_OFFSET(guest_ia32_debugctl, 184);
++ CHECK_OFFSET(guest_ia32_pat, 192);
++ CHECK_OFFSET(guest_ia32_efer, 200);
++ CHECK_OFFSET(guest_ia32_perf_global_ctrl, 208);
++ CHECK_OFFSET(guest_pdptr0, 216);
++ CHECK_OFFSET(guest_pdptr1, 224);
++ CHECK_OFFSET(guest_pdptr2, 232);
++ CHECK_OFFSET(guest_pdptr3, 240);
++ CHECK_OFFSET(guest_bndcfgs, 248);
++ CHECK_OFFSET(host_ia32_pat, 256);
++ CHECK_OFFSET(host_ia32_efer, 264);
++ CHECK_OFFSET(host_ia32_perf_global_ctrl, 272);
++ CHECK_OFFSET(vmread_bitmap, 280);
++ CHECK_OFFSET(vmwrite_bitmap, 288);
++ CHECK_OFFSET(vm_function_control, 296);
++ CHECK_OFFSET(eptp_list_address, 304);
++ CHECK_OFFSET(pml_address, 312);
++ CHECK_OFFSET(cr0_guest_host_mask, 344);
++ CHECK_OFFSET(cr4_guest_host_mask, 352);
++ CHECK_OFFSET(cr0_read_shadow, 360);
++ CHECK_OFFSET(cr4_read_shadow, 368);
++ CHECK_OFFSET(cr3_target_value0, 376);
++ CHECK_OFFSET(cr3_target_value1, 384);
++ CHECK_OFFSET(cr3_target_value2, 392);
++ CHECK_OFFSET(cr3_target_value3, 400);
++ CHECK_OFFSET(exit_qualification, 408);
++ CHECK_OFFSET(guest_linear_address, 416);
++ CHECK_OFFSET(guest_cr0, 424);
++ CHECK_OFFSET(guest_cr3, 432);
++ CHECK_OFFSET(guest_cr4, 440);
++ CHECK_OFFSET(guest_es_base, 448);
++ CHECK_OFFSET(guest_cs_base, 456);
++ CHECK_OFFSET(guest_ss_base, 464);
++ CHECK_OFFSET(guest_ds_base, 472);
++ CHECK_OFFSET(guest_fs_base, 480);
++ CHECK_OFFSET(guest_gs_base, 488);
++ CHECK_OFFSET(guest_ldtr_base, 496);
++ CHECK_OFFSET(guest_tr_base, 504);
++ CHECK_OFFSET(guest_gdtr_base, 512);
++ CHECK_OFFSET(guest_idtr_base, 520);
++ CHECK_OFFSET(guest_dr7, 528);
++ CHECK_OFFSET(guest_rsp, 536);
++ CHECK_OFFSET(guest_rip, 544);
++ CHECK_OFFSET(guest_rflags, 552);
++ CHECK_OFFSET(guest_pending_dbg_exceptions, 560);
++ CHECK_OFFSET(guest_sysenter_esp, 568);
++ CHECK_OFFSET(guest_sysenter_eip, 576);
++ CHECK_OFFSET(host_cr0, 584);
++ CHECK_OFFSET(host_cr3, 592);
++ CHECK_OFFSET(host_cr4, 600);
++ CHECK_OFFSET(host_fs_base, 608);
++ CHECK_OFFSET(host_gs_base, 616);
++ CHECK_OFFSET(host_tr_base, 624);
++ CHECK_OFFSET(host_gdtr_base, 632);
++ CHECK_OFFSET(host_idtr_base, 640);
++ CHECK_OFFSET(host_ia32_sysenter_esp, 648);
++ CHECK_OFFSET(host_ia32_sysenter_eip, 656);
++ CHECK_OFFSET(host_rsp, 664);
++ CHECK_OFFSET(host_rip, 672);
++ CHECK_OFFSET(pin_based_vm_exec_control, 744);
++ CHECK_OFFSET(cpu_based_vm_exec_control, 748);
++ CHECK_OFFSET(exception_bitmap, 752);
++ CHECK_OFFSET(page_fault_error_code_mask, 756);
++ CHECK_OFFSET(page_fault_error_code_match, 760);
++ CHECK_OFFSET(cr3_target_count, 764);
++ CHECK_OFFSET(vm_exit_controls, 768);
++ CHECK_OFFSET(vm_exit_msr_store_count, 772);
++ CHECK_OFFSET(vm_exit_msr_load_count, 776);
++ CHECK_OFFSET(vm_entry_controls, 780);
++ CHECK_OFFSET(vm_entry_msr_load_count, 784);
++ CHECK_OFFSET(vm_entry_intr_info_field, 788);
++ CHECK_OFFSET(vm_entry_exception_error_code, 792);
++ CHECK_OFFSET(vm_entry_instruction_len, 796);
++ CHECK_OFFSET(tpr_threshold, 800);
++ CHECK_OFFSET(secondary_vm_exec_control, 804);
++ CHECK_OFFSET(vm_instruction_error, 808);
++ CHECK_OFFSET(vm_exit_reason, 812);
++ CHECK_OFFSET(vm_exit_intr_info, 816);
++ CHECK_OFFSET(vm_exit_intr_error_code, 820);
++ CHECK_OFFSET(idt_vectoring_info_field, 824);
++ CHECK_OFFSET(idt_vectoring_error_code, 828);
++ CHECK_OFFSET(vm_exit_instruction_len, 832);
++ CHECK_OFFSET(vmx_instruction_info, 836);
++ CHECK_OFFSET(guest_es_limit, 840);
++ CHECK_OFFSET(guest_cs_limit, 844);
++ CHECK_OFFSET(guest_ss_limit, 848);
++ CHECK_OFFSET(guest_ds_limit, 852);
++ CHECK_OFFSET(guest_fs_limit, 856);
++ CHECK_OFFSET(guest_gs_limit, 860);
++ CHECK_OFFSET(guest_ldtr_limit, 864);
++ CHECK_OFFSET(guest_tr_limit, 868);
++ CHECK_OFFSET(guest_gdtr_limit, 872);
++ CHECK_OFFSET(guest_idtr_limit, 876);
++ CHECK_OFFSET(guest_es_ar_bytes, 880);
++ CHECK_OFFSET(guest_cs_ar_bytes, 884);
++ CHECK_OFFSET(guest_ss_ar_bytes, 888);
++ CHECK_OFFSET(guest_ds_ar_bytes, 892);
++ CHECK_OFFSET(guest_fs_ar_bytes, 896);
++ CHECK_OFFSET(guest_gs_ar_bytes, 900);
++ CHECK_OFFSET(guest_ldtr_ar_bytes, 904);
++ CHECK_OFFSET(guest_tr_ar_bytes, 908);
++ CHECK_OFFSET(guest_interruptibility_info, 912);
++ CHECK_OFFSET(guest_activity_state, 916);
++ CHECK_OFFSET(guest_sysenter_cs, 920);
++ CHECK_OFFSET(host_ia32_sysenter_cs, 924);
++ CHECK_OFFSET(vmx_preemption_timer_value, 928);
++ CHECK_OFFSET(virtual_processor_id, 960);
++ CHECK_OFFSET(posted_intr_nv, 962);
++ CHECK_OFFSET(guest_es_selector, 964);
++ CHECK_OFFSET(guest_cs_selector, 966);
++ CHECK_OFFSET(guest_ss_selector, 968);
++ CHECK_OFFSET(guest_ds_selector, 970);
++ CHECK_OFFSET(guest_fs_selector, 972);
++ CHECK_OFFSET(guest_gs_selector, 974);
++ CHECK_OFFSET(guest_ldtr_selector, 976);
++ CHECK_OFFSET(guest_tr_selector, 978);
++ CHECK_OFFSET(guest_intr_status, 980);
++ CHECK_OFFSET(host_es_selector, 982);
++ CHECK_OFFSET(host_cs_selector, 984);
++ CHECK_OFFSET(host_ss_selector, 986);
++ CHECK_OFFSET(host_ds_selector, 988);
++ CHECK_OFFSET(host_fs_selector, 990);
++ CHECK_OFFSET(host_gs_selector, 992);
++ CHECK_OFFSET(host_tr_selector, 994);
++ CHECK_OFFSET(guest_pml_index, 996);
++}
++
++/*
++ * VMCS12_REVISION is an arbitrary id that should be changed if the content or
++ * layout of struct vmcs12 is changed. MSR_IA32_VMX_BASIC returns this id, and
++ * VMPTRLD verifies that the VMCS region that L1 is loading contains this id.
++ *
++ * IMPORTANT: Changing this value will break save/restore compatibility with
++ * older kvm releases.
++ */
++#define VMCS12_REVISION 0x11e57ed0
++
++/*
++ * VMCS12_SIZE is the number of bytes L1 should allocate for the VMXON region
++ * and any VMCS region. Although only sizeof(struct vmcs12) are used by the
++ * current implementation, 4K are reserved to avoid future complications.
++ */
++#define VMCS12_SIZE 0x1000
++
++/*
++ * VMCS12_MAX_FIELD_INDEX is the highest index value used in any
++ * supported VMCS12 field encoding.
++ */
++#define VMCS12_MAX_FIELD_INDEX 0x17
++
++struct nested_vmx_msrs {
++ /*
++ * We only store the "true" versions of the VMX capability MSRs. We
++ * generate the "non-true" versions by setting the must-be-1 bits
++ * according to the SDM.
++ */
++ u32 procbased_ctls_low;
++ u32 procbased_ctls_high;
++ u32 secondary_ctls_low;
++ u32 secondary_ctls_high;
++ u32 pinbased_ctls_low;
++ u32 pinbased_ctls_high;
++ u32 exit_ctls_low;
++ u32 exit_ctls_high;
++ u32 entry_ctls_low;
++ u32 entry_ctls_high;
++ u32 misc_low;
++ u32 misc_high;
++ u32 ept_caps;
++ u32 vpid_caps;
++ u64 basic;
++ u64 cr0_fixed0;
++ u64 cr0_fixed1;
++ u64 cr4_fixed0;
++ u64 cr4_fixed1;
++ u64 vmcs_enum;
++ u64 vmfunc_controls;
++};
++
++/*
++ * The nested_vmx structure is part of vcpu_vmx, and holds information we need
++ * for correct emulation of VMX (i.e., nested VMX) on this vcpu.
++ */
++struct nested_vmx {
++ /* Has the level1 guest done vmxon? */
++ bool vmxon;
++ gpa_t vmxon_ptr;
++ bool pml_full;
++
++ /* The guest-physical address of the current VMCS L1 keeps for L2 */
++ gpa_t current_vmptr;
++ /*
++ * Cache of the guest's VMCS, existing outside of guest memory.
++ * Loaded from guest memory during VMPTRLD. Flushed to guest
++ * memory during VMCLEAR and VMPTRLD.
++ */
++ struct vmcs12 *cached_vmcs12;
++ /*
++ * Cache of the guest's shadow VMCS, existing outside of guest
++ * memory. Loaded from guest memory during VM entry. Flushed
++ * to guest memory during VM exit.
++ */
++ struct vmcs12 *cached_shadow_vmcs12;
++ /*
++ * Indicates if the shadow vmcs must be updated with the
++ * data hold by vmcs12
++ */
++ bool sync_shadow_vmcs;
++ bool dirty_vmcs12;
++
++ bool change_vmcs01_virtual_apic_mode;
++
++ /* L2 must run next, and mustn't decide to exit to L1. */
++ bool nested_run_pending;
++
++ struct loaded_vmcs vmcs02;
++
++ /*
++ * Guest pages referred to in the vmcs02 with host-physical
++ * pointers, so we must keep them pinned while L2 runs.
++ */
++ struct page *apic_access_page;
++ struct page *virtual_apic_page;
++ struct page *pi_desc_page;
++ struct pi_desc *pi_desc;
++ bool pi_pending;
++ u16 posted_intr_nv;
++
++ struct hrtimer preemption_timer;
++ bool preemption_timer_expired;
++
++ /* to migrate it to L2 if VM_ENTRY_LOAD_DEBUG_CONTROLS is off */
++ u64 vmcs01_debugctl;
++ u64 vmcs01_guest_bndcfgs;
++
++ u16 vpid02;
++ u16 last_vpid;
++
++ struct nested_vmx_msrs msrs;
++
++ /* SMM related state */
++ struct {
++ /* in VMX operation on SMM entry? */
++ bool vmxon;
++ /* in guest mode on SMM entry? */
++ bool guest_mode;
++ } smm;
++};
++
++#define POSTED_INTR_ON 0
++#define POSTED_INTR_SN 1
++
++/* Posted-Interrupt Descriptor */
++struct pi_desc {
++ u32 pir[8]; /* Posted interrupt requested */
++ union {
++ struct {
++ /* bit 256 - Outstanding Notification */
++ u16 on : 1,
++ /* bit 257 - Suppress Notification */
++ sn : 1,
++ /* bit 271:258 - Reserved */
++ rsvd_1 : 14;
++ /* bit 279:272 - Notification Vector */
++ u8 nv;
++ /* bit 287:280 - Reserved */
++ u8 rsvd_2;
++ /* bit 319:288 - Notification Destination */
++ u32 ndst;
++ };
++ u64 control;
++ };
++ u32 rsvd[6];
++} __aligned(64);
++
++static bool pi_test_and_set_on(struct pi_desc *pi_desc)
++{
++ return test_and_set_bit(POSTED_INTR_ON,
++ (unsigned long *)&pi_desc->control);
++}
++
++static bool pi_test_and_clear_on(struct pi_desc *pi_desc)
++{
++ return test_and_clear_bit(POSTED_INTR_ON,
++ (unsigned long *)&pi_desc->control);
++}
++
++static int pi_test_and_set_pir(int vector, struct pi_desc *pi_desc)
++{
++ return test_and_set_bit(vector, (unsigned long *)pi_desc->pir);
++}
++
++static inline void pi_clear_sn(struct pi_desc *pi_desc)
++{
++ return clear_bit(POSTED_INTR_SN,
++ (unsigned long *)&pi_desc->control);
++}
++
++static inline void pi_set_sn(struct pi_desc *pi_desc)
++{
++ return set_bit(POSTED_INTR_SN,
++ (unsigned long *)&pi_desc->control);
++}
++
++static inline void pi_clear_on(struct pi_desc *pi_desc)
++{
++ clear_bit(POSTED_INTR_ON,
++ (unsigned long *)&pi_desc->control);
++}
++
++static inline int pi_test_on(struct pi_desc *pi_desc)
++{
++ return test_bit(POSTED_INTR_ON,
++ (unsigned long *)&pi_desc->control);
++}
++
++static inline int pi_test_sn(struct pi_desc *pi_desc)
++{
++ return test_bit(POSTED_INTR_SN,
++ (unsigned long *)&pi_desc->control);
++}
++
++struct vmx_msrs {
++ unsigned int nr;
++ struct vmx_msr_entry val[NR_AUTOLOAD_MSRS];
++};
++
++struct vcpu_vmx {
++ struct kvm_vcpu vcpu;
++ unsigned long host_rsp;
++ u8 fail;
++ u8 msr_bitmap_mode;
++ u32 exit_intr_info;
++ u32 idt_vectoring_info;
++ ulong rflags;
++ struct shared_msr_entry *guest_msrs;
++ int nmsrs;
++ int save_nmsrs;
++ bool guest_msrs_dirty;
++ unsigned long host_idt_base;
++#ifdef CONFIG_X86_64
++ u64 msr_host_kernel_gs_base;
++ u64 msr_guest_kernel_gs_base;
++#endif
++
++ u64 spec_ctrl;
++
++ u32 vm_entry_controls_shadow;
++ u32 vm_exit_controls_shadow;
++ u32 secondary_exec_control;
++
++ /*
++ * loaded_vmcs points to the VMCS currently used in this vcpu. For a
++ * non-nested (L1) guest, it always points to vmcs01. For a nested
++ * guest (L2), it points to a different VMCS. loaded_cpu_state points
++ * to the VMCS whose state is loaded into the CPU registers that only
++ * need to be switched when transitioning to/from the kernel; a NULL
++ * value indicates that host state is loaded.
++ */
++ struct loaded_vmcs vmcs01;
++ struct loaded_vmcs *loaded_vmcs;
++ struct loaded_vmcs *loaded_cpu_state;
++ bool __launched; /* temporary, used in vmx_vcpu_run */
++ struct msr_autoload {
++ struct vmx_msrs guest;
++ struct vmx_msrs host;
++ } msr_autoload;
++
++ struct {
++ int vm86_active;
++ ulong save_rflags;
++ struct kvm_segment segs[8];
++ } rmode;
++ struct {
++ u32 bitmask; /* 4 bits per segment (1 bit per field) */
++ struct kvm_save_segment {
++ u16 selector;
++ unsigned long base;
++ u32 limit;
++ u32 ar;
++ } seg[8];
++ } segment_cache;
++ int vpid;
++ bool emulation_required;
++
++ u32 exit_reason;
++
++ /* Posted interrupt descriptor */
++ struct pi_desc pi_desc;
++
++ /* Support for a guest hypervisor (nested VMX) */
++ struct nested_vmx nested;
++
++ /* Dynamic PLE window. */
++ int ple_window;
++ bool ple_window_dirty;
++
++ bool req_immediate_exit;
++
++ /* Support for PML */
++#define PML_ENTITY_NUM 512
++ struct page *pml_pg;
++
++ /* apic deadline value in host tsc */
++ u64 hv_deadline_tsc;
++
++ u64 current_tsc_ratio;
++
++ u32 host_pkru;
++
++ unsigned long host_debugctlmsr;
++
++ /*
++ * Only bits masked by msr_ia32_feature_control_valid_bits can be set in
++ * msr_ia32_feature_control. FEATURE_CONTROL_LOCKED is always included
++ * in msr_ia32_feature_control_valid_bits.
++ */
++ u64 msr_ia32_feature_control;
++ u64 msr_ia32_feature_control_valid_bits;
++ u64 ept_pointer;
++ u64 msr_ia32_mcu_opt_ctrl;
++ bool disable_fb_clear;
++};
++
++enum segment_cache_field {
++ SEG_FIELD_SEL = 0,
++ SEG_FIELD_BASE = 1,
++ SEG_FIELD_LIMIT = 2,
++ SEG_FIELD_AR = 3,
++
++ SEG_FIELD_NR = 4
++};
++
++static inline struct kvm_vmx *to_kvm_vmx(struct kvm *kvm)
++{
++ return container_of(kvm, struct kvm_vmx, kvm);
++}
++
++static inline struct vcpu_vmx *to_vmx(struct kvm_vcpu *vcpu)
++{
++ return container_of(vcpu, struct vcpu_vmx, vcpu);
++}
++
++static struct pi_desc *vcpu_to_pi_desc(struct kvm_vcpu *vcpu)
++{
++ return &(to_vmx(vcpu)->pi_desc);
++}
++
++#define ROL16(val, n) ((u16)(((u16)(val) << (n)) | ((u16)(val) >> (16 - (n)))))
++#define VMCS12_OFFSET(x) offsetof(struct vmcs12, x)
++#define FIELD(number, name) [ROL16(number, 6)] = VMCS12_OFFSET(name)
++#define FIELD64(number, name) \
++ FIELD(number, name), \
++ [ROL16(number##_HIGH, 6)] = VMCS12_OFFSET(name) + sizeof(u32)
++
++
++static u16 shadow_read_only_fields[] = {
++#define SHADOW_FIELD_RO(x) x,
++#include "vmx_shadow_fields.h"
++};
++static int max_shadow_read_only_fields =
++ ARRAY_SIZE(shadow_read_only_fields);
++
++static u16 shadow_read_write_fields[] = {
++#define SHADOW_FIELD_RW(x) x,
++#include "vmx_shadow_fields.h"
++};
++static int max_shadow_read_write_fields =
++ ARRAY_SIZE(shadow_read_write_fields);
++
++static const unsigned short vmcs_field_to_offset_table[] = {
++ FIELD(VIRTUAL_PROCESSOR_ID, virtual_processor_id),
++ FIELD(POSTED_INTR_NV, posted_intr_nv),
++ FIELD(GUEST_ES_SELECTOR, guest_es_selector),
++ FIELD(GUEST_CS_SELECTOR, guest_cs_selector),
++ FIELD(GUEST_SS_SELECTOR, guest_ss_selector),
++ FIELD(GUEST_DS_SELECTOR, guest_ds_selector),
++ FIELD(GUEST_FS_SELECTOR, guest_fs_selector),
++ FIELD(GUEST_GS_SELECTOR, guest_gs_selector),
++ FIELD(GUEST_LDTR_SELECTOR, guest_ldtr_selector),
++ FIELD(GUEST_TR_SELECTOR, guest_tr_selector),
++ FIELD(GUEST_INTR_STATUS, guest_intr_status),
++ FIELD(GUEST_PML_INDEX, guest_pml_index),
++ FIELD(HOST_ES_SELECTOR, host_es_selector),
++ FIELD(HOST_CS_SELECTOR, host_cs_selector),
++ FIELD(HOST_SS_SELECTOR, host_ss_selector),
++ FIELD(HOST_DS_SELECTOR, host_ds_selector),
++ FIELD(HOST_FS_SELECTOR, host_fs_selector),
++ FIELD(HOST_GS_SELECTOR, host_gs_selector),
++ FIELD(HOST_TR_SELECTOR, host_tr_selector),
++ FIELD64(IO_BITMAP_A, io_bitmap_a),
++ FIELD64(IO_BITMAP_B, io_bitmap_b),
++ FIELD64(MSR_BITMAP, msr_bitmap),
++ FIELD64(VM_EXIT_MSR_STORE_ADDR, vm_exit_msr_store_addr),
++ FIELD64(VM_EXIT_MSR_LOAD_ADDR, vm_exit_msr_load_addr),
++ FIELD64(VM_ENTRY_MSR_LOAD_ADDR, vm_entry_msr_load_addr),
++ FIELD64(PML_ADDRESS, pml_address),
++ FIELD64(TSC_OFFSET, tsc_offset),
++ FIELD64(VIRTUAL_APIC_PAGE_ADDR, virtual_apic_page_addr),
++ FIELD64(APIC_ACCESS_ADDR, apic_access_addr),
++ FIELD64(POSTED_INTR_DESC_ADDR, posted_intr_desc_addr),
++ FIELD64(VM_FUNCTION_CONTROL, vm_function_control),
++ FIELD64(EPT_POINTER, ept_pointer),
++ FIELD64(EOI_EXIT_BITMAP0, eoi_exit_bitmap0),
++ FIELD64(EOI_EXIT_BITMAP1, eoi_exit_bitmap1),
++ FIELD64(EOI_EXIT_BITMAP2, eoi_exit_bitmap2),
++ FIELD64(EOI_EXIT_BITMAP3, eoi_exit_bitmap3),
++ FIELD64(EPTP_LIST_ADDRESS, eptp_list_address),
++ FIELD64(VMREAD_BITMAP, vmread_bitmap),
++ FIELD64(VMWRITE_BITMAP, vmwrite_bitmap),
++ FIELD64(XSS_EXIT_BITMAP, xss_exit_bitmap),
++ FIELD64(GUEST_PHYSICAL_ADDRESS, guest_physical_address),
++ FIELD64(VMCS_LINK_POINTER, vmcs_link_pointer),
++ FIELD64(GUEST_IA32_DEBUGCTL, guest_ia32_debugctl),
++ FIELD64(GUEST_IA32_PAT, guest_ia32_pat),
++ FIELD64(GUEST_IA32_EFER, guest_ia32_efer),
++ FIELD64(GUEST_IA32_PERF_GLOBAL_CTRL, guest_ia32_perf_global_ctrl),
++ FIELD64(GUEST_PDPTR0, guest_pdptr0),
++ FIELD64(GUEST_PDPTR1, guest_pdptr1),
++ FIELD64(GUEST_PDPTR2, guest_pdptr2),
++ FIELD64(GUEST_PDPTR3, guest_pdptr3),
++ FIELD64(GUEST_BNDCFGS, guest_bndcfgs),
++ FIELD64(HOST_IA32_PAT, host_ia32_pat),
++ FIELD64(HOST_IA32_EFER, host_ia32_efer),
++ FIELD64(HOST_IA32_PERF_GLOBAL_CTRL, host_ia32_perf_global_ctrl),
++ FIELD(PIN_BASED_VM_EXEC_CONTROL, pin_based_vm_exec_control),
++ FIELD(CPU_BASED_VM_EXEC_CONTROL, cpu_based_vm_exec_control),
++ FIELD(EXCEPTION_BITMAP, exception_bitmap),
++ FIELD(PAGE_FAULT_ERROR_CODE_MASK, page_fault_error_code_mask),
++ FIELD(PAGE_FAULT_ERROR_CODE_MATCH, page_fault_error_code_match),
++ FIELD(CR3_TARGET_COUNT, cr3_target_count),
++ FIELD(VM_EXIT_CONTROLS, vm_exit_controls),
++ FIELD(VM_EXIT_MSR_STORE_COUNT, vm_exit_msr_store_count),
++ FIELD(VM_EXIT_MSR_LOAD_COUNT, vm_exit_msr_load_count),
++ FIELD(VM_ENTRY_CONTROLS, vm_entry_controls),
++ FIELD(VM_ENTRY_MSR_LOAD_COUNT, vm_entry_msr_load_count),
++ FIELD(VM_ENTRY_INTR_INFO_FIELD, vm_entry_intr_info_field),
++ FIELD(VM_ENTRY_EXCEPTION_ERROR_CODE, vm_entry_exception_error_code),
++ FIELD(VM_ENTRY_INSTRUCTION_LEN, vm_entry_instruction_len),
++ FIELD(TPR_THRESHOLD, tpr_threshold),
++ FIELD(SECONDARY_VM_EXEC_CONTROL, secondary_vm_exec_control),
++ FIELD(VM_INSTRUCTION_ERROR, vm_instruction_error),
++ FIELD(VM_EXIT_REASON, vm_exit_reason),
++ FIELD(VM_EXIT_INTR_INFO, vm_exit_intr_info),
++ FIELD(VM_EXIT_INTR_ERROR_CODE, vm_exit_intr_error_code),
++ FIELD(IDT_VECTORING_INFO_FIELD, idt_vectoring_info_field),
++ FIELD(IDT_VECTORING_ERROR_CODE, idt_vectoring_error_code),
++ FIELD(VM_EXIT_INSTRUCTION_LEN, vm_exit_instruction_len),
++ FIELD(VMX_INSTRUCTION_INFO, vmx_instruction_info),
++ FIELD(GUEST_ES_LIMIT, guest_es_limit),
++ FIELD(GUEST_CS_LIMIT, guest_cs_limit),
++ FIELD(GUEST_SS_LIMIT, guest_ss_limit),
++ FIELD(GUEST_DS_LIMIT, guest_ds_limit),
++ FIELD(GUEST_FS_LIMIT, guest_fs_limit),
++ FIELD(GUEST_GS_LIMIT, guest_gs_limit),
++ FIELD(GUEST_LDTR_LIMIT, guest_ldtr_limit),
++ FIELD(GUEST_TR_LIMIT, guest_tr_limit),
++ FIELD(GUEST_GDTR_LIMIT, guest_gdtr_limit),
++ FIELD(GUEST_IDTR_LIMIT, guest_idtr_limit),
++ FIELD(GUEST_ES_AR_BYTES, guest_es_ar_bytes),
++ FIELD(GUEST_CS_AR_BYTES, guest_cs_ar_bytes),
++ FIELD(GUEST_SS_AR_BYTES, guest_ss_ar_bytes),
++ FIELD(GUEST_DS_AR_BYTES, guest_ds_ar_bytes),
++ FIELD(GUEST_FS_AR_BYTES, guest_fs_ar_bytes),
++ FIELD(GUEST_GS_AR_BYTES, guest_gs_ar_bytes),
++ FIELD(GUEST_LDTR_AR_BYTES, guest_ldtr_ar_bytes),
++ FIELD(GUEST_TR_AR_BYTES, guest_tr_ar_bytes),
++ FIELD(GUEST_INTERRUPTIBILITY_INFO, guest_interruptibility_info),
++ FIELD(GUEST_ACTIVITY_STATE, guest_activity_state),
++ FIELD(GUEST_SYSENTER_CS, guest_sysenter_cs),
++ FIELD(HOST_IA32_SYSENTER_CS, host_ia32_sysenter_cs),
++ FIELD(VMX_PREEMPTION_TIMER_VALUE, vmx_preemption_timer_value),
++ FIELD(CR0_GUEST_HOST_MASK, cr0_guest_host_mask),
++ FIELD(CR4_GUEST_HOST_MASK, cr4_guest_host_mask),
++ FIELD(CR0_READ_SHADOW, cr0_read_shadow),
++ FIELD(CR4_READ_SHADOW, cr4_read_shadow),
++ FIELD(CR3_TARGET_VALUE0, cr3_target_value0),
++ FIELD(CR3_TARGET_VALUE1, cr3_target_value1),
++ FIELD(CR3_TARGET_VALUE2, cr3_target_value2),
++ FIELD(CR3_TARGET_VALUE3, cr3_target_value3),
++ FIELD(EXIT_QUALIFICATION, exit_qualification),
++ FIELD(GUEST_LINEAR_ADDRESS, guest_linear_address),
++ FIELD(GUEST_CR0, guest_cr0),
++ FIELD(GUEST_CR3, guest_cr3),
++ FIELD(GUEST_CR4, guest_cr4),
++ FIELD(GUEST_ES_BASE, guest_es_base),
++ FIELD(GUEST_CS_BASE, guest_cs_base),
++ FIELD(GUEST_SS_BASE, guest_ss_base),
++ FIELD(GUEST_DS_BASE, guest_ds_base),
++ FIELD(GUEST_FS_BASE, guest_fs_base),
++ FIELD(GUEST_GS_BASE, guest_gs_base),
++ FIELD(GUEST_LDTR_BASE, guest_ldtr_base),
++ FIELD(GUEST_TR_BASE, guest_tr_base),
++ FIELD(GUEST_GDTR_BASE, guest_gdtr_base),
++ FIELD(GUEST_IDTR_BASE, guest_idtr_base),
++ FIELD(GUEST_DR7, guest_dr7),
++ FIELD(GUEST_RSP, guest_rsp),
++ FIELD(GUEST_RIP, guest_rip),
++ FIELD(GUEST_RFLAGS, guest_rflags),
++ FIELD(GUEST_PENDING_DBG_EXCEPTIONS, guest_pending_dbg_exceptions),
++ FIELD(GUEST_SYSENTER_ESP, guest_sysenter_esp),
++ FIELD(GUEST_SYSENTER_EIP, guest_sysenter_eip),
++ FIELD(HOST_CR0, host_cr0),
++ FIELD(HOST_CR3, host_cr3),
++ FIELD(HOST_CR4, host_cr4),
++ FIELD(HOST_FS_BASE, host_fs_base),
++ FIELD(HOST_GS_BASE, host_gs_base),
++ FIELD(HOST_TR_BASE, host_tr_base),
++ FIELD(HOST_GDTR_BASE, host_gdtr_base),
++ FIELD(HOST_IDTR_BASE, host_idtr_base),
++ FIELD(HOST_IA32_SYSENTER_ESP, host_ia32_sysenter_esp),
++ FIELD(HOST_IA32_SYSENTER_EIP, host_ia32_sysenter_eip),
++ FIELD(HOST_RSP, host_rsp),
++ FIELD(HOST_RIP, host_rip),
++};
++
++static inline short vmcs_field_to_offset(unsigned long field)
++{
++ const size_t size = ARRAY_SIZE(vmcs_field_to_offset_table);
++ unsigned short offset;
++ unsigned index;
++
++ if (field >> 15)
++ return -ENOENT;
++
++ index = ROL16(field, 6);
++ if (index >= size)
++ return -ENOENT;
++
++ index = array_index_nospec(index, size);
++ offset = vmcs_field_to_offset_table[index];
++ if (offset == 0)
++ return -ENOENT;
++ return offset;
++}
++
++static inline struct vmcs12 *get_vmcs12(struct kvm_vcpu *vcpu)
++{
++ return to_vmx(vcpu)->nested.cached_vmcs12;
++}
++
++static inline struct vmcs12 *get_shadow_vmcs12(struct kvm_vcpu *vcpu)
++{
++ return to_vmx(vcpu)->nested.cached_shadow_vmcs12;
++}
++
++static bool nested_ept_ad_enabled(struct kvm_vcpu *vcpu);
++static unsigned long nested_ept_get_cr3(struct kvm_vcpu *vcpu);
++static u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa);
++static bool vmx_xsaves_supported(void);
++static void vmx_set_segment(struct kvm_vcpu *vcpu,
++ struct kvm_segment *var, int seg);
++static void vmx_get_segment(struct kvm_vcpu *vcpu,
++ struct kvm_segment *var, int seg);
++static bool guest_state_valid(struct kvm_vcpu *vcpu);
++static u32 vmx_segment_access_rights(struct kvm_segment *var);
++static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx);
++static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu);
++static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked);
++static bool nested_vmx_is_page_fault_vmexit(struct vmcs12 *vmcs12,
++ u16 error_code);
++static void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu);
++static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
++ u32 msr, int type);
++
++static DEFINE_PER_CPU(struct vmcs *, vmxarea);
++static DEFINE_PER_CPU(struct vmcs *, current_vmcs);
++/*
++ * We maintain a per-CPU linked-list of VMCS loaded on that CPU. This is needed
++ * when a CPU is brought down, and we need to VMCLEAR all VMCSs loaded on it.
++ */
++static DEFINE_PER_CPU(struct list_head, loaded_vmcss_on_cpu);
++
++/*
++ * We maintian a per-CPU linked-list of vCPU, so in wakeup_handler() we
++ * can find which vCPU should be waken up.
++ */
++static DEFINE_PER_CPU(struct list_head, blocked_vcpu_on_cpu);
++static DEFINE_PER_CPU(spinlock_t, blocked_vcpu_on_cpu_lock);
++
++enum {
++ VMX_VMREAD_BITMAP,
++ VMX_VMWRITE_BITMAP,
++ VMX_BITMAP_NR
++};
++
++static unsigned long *vmx_bitmap[VMX_BITMAP_NR];
++
++#define vmx_vmread_bitmap (vmx_bitmap[VMX_VMREAD_BITMAP])
++#define vmx_vmwrite_bitmap (vmx_bitmap[VMX_VMWRITE_BITMAP])
++
++static bool cpu_has_load_ia32_efer;
++static bool cpu_has_load_perf_global_ctrl;
++
++static DECLARE_BITMAP(vmx_vpid_bitmap, VMX_NR_VPIDS);
++static DEFINE_SPINLOCK(vmx_vpid_lock);
++
++static struct vmcs_config {
++ int size;
++ int order;
++ u32 basic_cap;
++ u32 revision_id;
++ u32 pin_based_exec_ctrl;
++ u32 cpu_based_exec_ctrl;
++ u32 cpu_based_2nd_exec_ctrl;
++ u32 vmexit_ctrl;
++ u32 vmentry_ctrl;
++ struct nested_vmx_msrs nested;
++} vmcs_config;
++
++static struct vmx_capability {
++ u32 ept;
++ u32 vpid;
++} vmx_capability;
++
++#define VMX_SEGMENT_FIELD(seg) \
++ [VCPU_SREG_##seg] = { \
++ .selector = GUEST_##seg##_SELECTOR, \
++ .base = GUEST_##seg##_BASE, \
++ .limit = GUEST_##seg##_LIMIT, \
++ .ar_bytes = GUEST_##seg##_AR_BYTES, \
++ }
++
++static const struct kvm_vmx_segment_field {
++ unsigned selector;
++ unsigned base;
++ unsigned limit;
++ unsigned ar_bytes;
++} kvm_vmx_segment_fields[] = {
++ VMX_SEGMENT_FIELD(CS),
++ VMX_SEGMENT_FIELD(DS),
++ VMX_SEGMENT_FIELD(ES),
++ VMX_SEGMENT_FIELD(FS),
++ VMX_SEGMENT_FIELD(GS),
++ VMX_SEGMENT_FIELD(SS),
++ VMX_SEGMENT_FIELD(TR),
++ VMX_SEGMENT_FIELD(LDTR),
++};
++
++static u64 host_efer;
++
++static void ept_save_pdptrs(struct kvm_vcpu *vcpu);
++
++/*
++ * Keep MSR_STAR at the end, as setup_msrs() will try to optimize it
++ * away by decrementing the array size.
++ */
++static const u32 vmx_msr_index[] = {
++#ifdef CONFIG_X86_64
++ MSR_SYSCALL_MASK, MSR_LSTAR, MSR_CSTAR,
++#endif
++ MSR_EFER, MSR_TSC_AUX, MSR_STAR,
++};
++
++DEFINE_STATIC_KEY_FALSE(enable_evmcs);
++
++#define current_evmcs ((struct hv_enlightened_vmcs *)this_cpu_read(current_vmcs))
++
++#define KVM_EVMCS_VERSION 1
++
++#if IS_ENABLED(CONFIG_HYPERV)
++static bool __read_mostly enlightened_vmcs = true;
++module_param(enlightened_vmcs, bool, 0444);
++
++static inline void evmcs_write64(unsigned long field, u64 value)
++{
++ u16 clean_field;
++ int offset = get_evmcs_offset(field, &clean_field);
++
++ if (offset < 0)
++ return;
++
++ *(u64 *)((char *)current_evmcs + offset) = value;
++
++ current_evmcs->hv_clean_fields &= ~clean_field;
++}
++
++static inline void evmcs_write32(unsigned long field, u32 value)
++{
++ u16 clean_field;
++ int offset = get_evmcs_offset(field, &clean_field);
++
++ if (offset < 0)
++ return;
++
++ *(u32 *)((char *)current_evmcs + offset) = value;
++ current_evmcs->hv_clean_fields &= ~clean_field;
++}
++
++static inline void evmcs_write16(unsigned long field, u16 value)
++{
++ u16 clean_field;
++ int offset = get_evmcs_offset(field, &clean_field);
++
++ if (offset < 0)
++ return;
++
++ *(u16 *)((char *)current_evmcs + offset) = value;
++ current_evmcs->hv_clean_fields &= ~clean_field;
++}
++
++static inline u64 evmcs_read64(unsigned long field)
++{
++ int offset = get_evmcs_offset(field, NULL);
++
++ if (offset < 0)
++ return 0;
++
++ return *(u64 *)((char *)current_evmcs + offset);
++}
++
++static inline u32 evmcs_read32(unsigned long field)
++{
++ int offset = get_evmcs_offset(field, NULL);
++
++ if (offset < 0)
++ return 0;
++
++ return *(u32 *)((char *)current_evmcs + offset);
++}
++
++static inline u16 evmcs_read16(unsigned long field)
++{
++ int offset = get_evmcs_offset(field, NULL);
++
++ if (offset < 0)
++ return 0;
++
++ return *(u16 *)((char *)current_evmcs + offset);
++}
++
++static inline void evmcs_touch_msr_bitmap(void)
++{
++ if (unlikely(!current_evmcs))
++ return;
++
++ if (current_evmcs->hv_enlightenments_control.msr_bitmap)
++ current_evmcs->hv_clean_fields &=
++ ~HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP;
++}
++
++static void evmcs_load(u64 phys_addr)
++{
++ struct hv_vp_assist_page *vp_ap =
++ hv_get_vp_assist_page(smp_processor_id());
++
++ vp_ap->current_nested_vmcs = phys_addr;
++ vp_ap->enlighten_vmentry = 1;
++}
++
++static void evmcs_sanitize_exec_ctrls(struct vmcs_config *vmcs_conf)
++{
++ /*
++ * Enlightened VMCSv1 doesn't support these:
++ *
++ * POSTED_INTR_NV = 0x00000002,
++ * GUEST_INTR_STATUS = 0x00000810,
++ * APIC_ACCESS_ADDR = 0x00002014,
++ * POSTED_INTR_DESC_ADDR = 0x00002016,
++ * EOI_EXIT_BITMAP0 = 0x0000201c,
++ * EOI_EXIT_BITMAP1 = 0x0000201e,
++ * EOI_EXIT_BITMAP2 = 0x00002020,
++ * EOI_EXIT_BITMAP3 = 0x00002022,
++ */
++ vmcs_conf->pin_based_exec_ctrl &= ~PIN_BASED_POSTED_INTR;
++ vmcs_conf->cpu_based_2nd_exec_ctrl &=
++ ~SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY;
++ vmcs_conf->cpu_based_2nd_exec_ctrl &=
++ ~SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
++ vmcs_conf->cpu_based_2nd_exec_ctrl &=
++ ~SECONDARY_EXEC_APIC_REGISTER_VIRT;
++
++ /*
++ * GUEST_PML_INDEX = 0x00000812,
++ * PML_ADDRESS = 0x0000200e,
++ */
++ vmcs_conf->cpu_based_2nd_exec_ctrl &= ~SECONDARY_EXEC_ENABLE_PML;
++
++ /* VM_FUNCTION_CONTROL = 0x00002018, */
++ vmcs_conf->cpu_based_2nd_exec_ctrl &= ~SECONDARY_EXEC_ENABLE_VMFUNC;
++
++ /*
++ * EPTP_LIST_ADDRESS = 0x00002024,
++ * VMREAD_BITMAP = 0x00002026,
++ * VMWRITE_BITMAP = 0x00002028,
++ */
++ vmcs_conf->cpu_based_2nd_exec_ctrl &= ~SECONDARY_EXEC_SHADOW_VMCS;
++
++ /*
++ * TSC_MULTIPLIER = 0x00002032,
++ */
++ vmcs_conf->cpu_based_2nd_exec_ctrl &= ~SECONDARY_EXEC_TSC_SCALING;
++
++ /*
++ * PLE_GAP = 0x00004020,
++ * PLE_WINDOW = 0x00004022,
++ */
++ vmcs_conf->cpu_based_2nd_exec_ctrl &= ~SECONDARY_EXEC_PAUSE_LOOP_EXITING;
++
++ /*
++ * VMX_PREEMPTION_TIMER_VALUE = 0x0000482E,
++ */
++ vmcs_conf->pin_based_exec_ctrl &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
++
++ /*
++ * GUEST_IA32_PERF_GLOBAL_CTRL = 0x00002808,
++ * HOST_IA32_PERF_GLOBAL_CTRL = 0x00002c04,
++ */
++ vmcs_conf->vmexit_ctrl &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
++ vmcs_conf->vmentry_ctrl &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
++
++ /*
++ * Currently unsupported in KVM:
++ * GUEST_IA32_RTIT_CTL = 0x00002814,
++ */
++}
++
++/* check_ept_pointer() should be under protection of ept_pointer_lock. */
++static void check_ept_pointer_match(struct kvm *kvm)
++{
++ struct kvm_vcpu *vcpu;
++ u64 tmp_eptp = INVALID_PAGE;
++ int i;
++
++ kvm_for_each_vcpu(i, vcpu, kvm) {
++ if (!VALID_PAGE(tmp_eptp)) {
++ tmp_eptp = to_vmx(vcpu)->ept_pointer;
++ } else if (tmp_eptp != to_vmx(vcpu)->ept_pointer) {
++ to_kvm_vmx(kvm)->ept_pointers_match
++ = EPT_POINTERS_MISMATCH;
++ return;
++ }
++ }
++
++ to_kvm_vmx(kvm)->ept_pointers_match = EPT_POINTERS_MATCH;
++}
++
++static int vmx_hv_remote_flush_tlb(struct kvm *kvm)
++{
++ int ret;
++
++ spin_lock(&to_kvm_vmx(kvm)->ept_pointer_lock);
++
++ if (to_kvm_vmx(kvm)->ept_pointers_match == EPT_POINTERS_CHECK)
++ check_ept_pointer_match(kvm);
++
++ if (to_kvm_vmx(kvm)->ept_pointers_match != EPT_POINTERS_MATCH) {
++ ret = -ENOTSUPP;
++ goto out;
++ }
++
++ /*
++ * FLUSH_GUEST_PHYSICAL_ADDRESS_SPACE hypercall needs the address of the
++ * base of EPT PML4 table, strip off EPT configuration information.
++ */
++ ret = hyperv_flush_guest_mapping(
++ to_vmx(kvm_get_vcpu(kvm, 0))->ept_pointer & PAGE_MASK);
++
++out:
++ spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock);
++ return ret;
++}
++#else /* !IS_ENABLED(CONFIG_HYPERV) */
++static inline void evmcs_write64(unsigned long field, u64 value) {}
++static inline void evmcs_write32(unsigned long field, u32 value) {}
++static inline void evmcs_write16(unsigned long field, u16 value) {}
++static inline u64 evmcs_read64(unsigned long field) { return 0; }
++static inline u32 evmcs_read32(unsigned long field) { return 0; }
++static inline u16 evmcs_read16(unsigned long field) { return 0; }
++static inline void evmcs_load(u64 phys_addr) {}
++static inline void evmcs_sanitize_exec_ctrls(struct vmcs_config *vmcs_conf) {}
++static inline void evmcs_touch_msr_bitmap(void) {}
++#endif /* IS_ENABLED(CONFIG_HYPERV) */
++
++static inline bool is_exception_n(u32 intr_info, u8 vector)
++{
++ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VECTOR_MASK |
++ INTR_INFO_VALID_MASK)) ==
++ (INTR_TYPE_HARD_EXCEPTION | vector | INTR_INFO_VALID_MASK);
++}
++
++static inline bool is_debug(u32 intr_info)
++{
++ return is_exception_n(intr_info, DB_VECTOR);
++}
++
++static inline bool is_breakpoint(u32 intr_info)
++{
++ return is_exception_n(intr_info, BP_VECTOR);
++}
++
++static inline bool is_page_fault(u32 intr_info)
++{
++ return is_exception_n(intr_info, PF_VECTOR);
++}
++
++static inline bool is_no_device(u32 intr_info)
++{
++ return is_exception_n(intr_info, NM_VECTOR);
++}
++
++static inline bool is_invalid_opcode(u32 intr_info)
++{
++ return is_exception_n(intr_info, UD_VECTOR);
++}
++
++static inline bool is_gp_fault(u32 intr_info)
++{
++ return is_exception_n(intr_info, GP_VECTOR);
++}
++
++static inline bool is_external_interrupt(u32 intr_info)
++{
++ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
++ == (INTR_TYPE_EXT_INTR | INTR_INFO_VALID_MASK);
++}
++
++static inline bool is_machine_check(u32 intr_info)
++{
++ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VECTOR_MASK |
++ INTR_INFO_VALID_MASK)) ==
++ (INTR_TYPE_HARD_EXCEPTION | MC_VECTOR | INTR_INFO_VALID_MASK);
++}
++
++/* Undocumented: icebp/int1 */
++static inline bool is_icebp(u32 intr_info)
++{
++ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
++ == (INTR_TYPE_PRIV_SW_EXCEPTION | INTR_INFO_VALID_MASK);
++}
++
++static inline bool cpu_has_vmx_msr_bitmap(void)
++{
++ return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS;
++}
++
++static inline bool cpu_has_vmx_tpr_shadow(void)
++{
++ return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_TPR_SHADOW;
++}
++
++static inline bool cpu_need_tpr_shadow(struct kvm_vcpu *vcpu)
++{
++ return cpu_has_vmx_tpr_shadow() && lapic_in_kernel(vcpu);
++}
++
++static inline bool cpu_has_secondary_exec_ctrls(void)
++{
++ return vmcs_config.cpu_based_exec_ctrl &
++ CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
++}
++
++static inline bool cpu_has_vmx_virtualize_apic_accesses(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
++}
++
++static inline bool cpu_has_vmx_virtualize_x2apic_mode(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
++}
++
++static inline bool cpu_has_vmx_apic_register_virt(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_APIC_REGISTER_VIRT;
++}
++
++static inline bool cpu_has_vmx_virtual_intr_delivery(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY;
++}
++
++static inline bool cpu_has_vmx_encls_vmexit(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_ENCLS_EXITING;
++}
++
++/*
++ * Comment's format: document - errata name - stepping - processor name.
++ * Refer from
++ * https://www.virtualbox.org/svn/vbox/trunk/src/VBox/VMM/VMMR0/HMR0.cpp
++ */
++static u32 vmx_preemption_cpu_tfms[] = {
++/* 323344.pdf - BA86 - D0 - Xeon 7500 Series */
++0x000206E6,
++/* 323056.pdf - AAX65 - C2 - Xeon L3406 */
++/* 322814.pdf - AAT59 - C2 - i7-600, i5-500, i5-400 and i3-300 Mobile */
++/* 322911.pdf - AAU65 - C2 - i5-600, i3-500 Desktop and Pentium G6950 */
++0x00020652,
++/* 322911.pdf - AAU65 - K0 - i5-600, i3-500 Desktop and Pentium G6950 */
++0x00020655,
++/* 322373.pdf - AAO95 - B1 - Xeon 3400 Series */
++/* 322166.pdf - AAN92 - B1 - i7-800 and i5-700 Desktop */
++/*
++ * 320767.pdf - AAP86 - B1 -
++ * i7-900 Mobile Extreme, i7-800 and i7-700 Mobile
++ */
++0x000106E5,
++/* 321333.pdf - AAM126 - C0 - Xeon 3500 */
++0x000106A0,
++/* 321333.pdf - AAM126 - C1 - Xeon 3500 */
++0x000106A1,
++/* 320836.pdf - AAJ124 - C0 - i7-900 Desktop Extreme and i7-900 Desktop */
++0x000106A4,
++ /* 321333.pdf - AAM126 - D0 - Xeon 3500 */
++ /* 321324.pdf - AAK139 - D0 - Xeon 5500 */
++ /* 320836.pdf - AAJ124 - D0 - i7-900 Extreme and i7-900 Desktop */
++0x000106A5,
++};
++
++static inline bool cpu_has_broken_vmx_preemption_timer(void)
++{
++ u32 eax = cpuid_eax(0x00000001), i;
++
++ /* Clear the reserved bits */
++ eax &= ~(0x3U << 14 | 0xfU << 28);
++ for (i = 0; i < ARRAY_SIZE(vmx_preemption_cpu_tfms); i++)
++ if (eax == vmx_preemption_cpu_tfms[i])
++ return true;
++
++ return false;
++}
++
++static inline bool cpu_has_vmx_preemption_timer(void)
++{
++ return vmcs_config.pin_based_exec_ctrl &
++ PIN_BASED_VMX_PREEMPTION_TIMER;
++}
++
++static inline bool cpu_has_vmx_posted_intr(void)
++{
++ return IS_ENABLED(CONFIG_X86_LOCAL_APIC) &&
++ vmcs_config.pin_based_exec_ctrl & PIN_BASED_POSTED_INTR;
++}
++
++static inline bool cpu_has_vmx_apicv(void)
++{
++ return cpu_has_vmx_apic_register_virt() &&
++ cpu_has_vmx_virtual_intr_delivery() &&
++ cpu_has_vmx_posted_intr();
++}
++
++static inline bool cpu_has_vmx_flexpriority(void)
++{
++ return cpu_has_vmx_tpr_shadow() &&
++ cpu_has_vmx_virtualize_apic_accesses();
++}
++
++static inline bool cpu_has_vmx_ept_execute_only(void)
++{
++ return vmx_capability.ept & VMX_EPT_EXECUTE_ONLY_BIT;
++}
++
++static inline bool cpu_has_vmx_ept_2m_page(void)
++{
++ return vmx_capability.ept & VMX_EPT_2MB_PAGE_BIT;
++}
++
++static inline bool cpu_has_vmx_ept_1g_page(void)
++{
++ return vmx_capability.ept & VMX_EPT_1GB_PAGE_BIT;
++}
++
++static inline bool cpu_has_vmx_ept_4levels(void)
++{
++ return vmx_capability.ept & VMX_EPT_PAGE_WALK_4_BIT;
++}
++
++static inline bool cpu_has_vmx_ept_mt_wb(void)
++{
++ return vmx_capability.ept & VMX_EPTP_WB_BIT;
++}
++
++static inline bool cpu_has_vmx_ept_5levels(void)
++{
++ return vmx_capability.ept & VMX_EPT_PAGE_WALK_5_BIT;
++}
++
++static inline bool cpu_has_vmx_ept_ad_bits(void)
++{
++ return vmx_capability.ept & VMX_EPT_AD_BIT;
++}
++
++static inline bool cpu_has_vmx_invept_context(void)
++{
++ return vmx_capability.ept & VMX_EPT_EXTENT_CONTEXT_BIT;
++}
++
++static inline bool cpu_has_vmx_invept_global(void)
++{
++ return vmx_capability.ept & VMX_EPT_EXTENT_GLOBAL_BIT;
++}
++
++static inline bool cpu_has_vmx_invvpid_individual_addr(void)
++{
++ return vmx_capability.vpid & VMX_VPID_EXTENT_INDIVIDUAL_ADDR_BIT;
++}
++
++static inline bool cpu_has_vmx_invvpid_single(void)
++{
++ return vmx_capability.vpid & VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT;
++}
++
++static inline bool cpu_has_vmx_invvpid_global(void)
++{
++ return vmx_capability.vpid & VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT;
++}
++
++static inline bool cpu_has_vmx_invvpid(void)
++{
++ return vmx_capability.vpid & VMX_VPID_INVVPID_BIT;
++}
++
++static inline bool cpu_has_vmx_ept(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_ENABLE_EPT;
++}
++
++static inline bool cpu_has_vmx_unrestricted_guest(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_UNRESTRICTED_GUEST;
++}
++
++static inline bool cpu_has_vmx_ple(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_PAUSE_LOOP_EXITING;
++}
++
++static inline bool cpu_has_vmx_basic_inout(void)
++{
++ return (((u64)vmcs_config.basic_cap << 32) & VMX_BASIC_INOUT);
++}
++
++static inline bool cpu_need_virtualize_apic_accesses(struct kvm_vcpu *vcpu)
++{
++ return flexpriority_enabled && lapic_in_kernel(vcpu);
++}
++
++static inline bool cpu_has_vmx_vpid(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_ENABLE_VPID;
++}
++
++static inline bool cpu_has_vmx_rdtscp(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_RDTSCP;
++}
++
++static inline bool cpu_has_vmx_invpcid(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_ENABLE_INVPCID;
++}
++
++static inline bool cpu_has_virtual_nmis(void)
++{
++ return vmcs_config.pin_based_exec_ctrl & PIN_BASED_VIRTUAL_NMIS;
++}
++
++static inline bool cpu_has_vmx_wbinvd_exit(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_WBINVD_EXITING;
++}
++
++static inline bool cpu_has_vmx_shadow_vmcs(void)
++{
++ u64 vmx_msr;
++ rdmsrl(MSR_IA32_VMX_MISC, vmx_msr);
++ /* check if the cpu supports writing r/o exit information fields */
++ if (!(vmx_msr & MSR_IA32_VMX_MISC_VMWRITE_SHADOW_RO_FIELDS))
++ return false;
++
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_SHADOW_VMCS;
++}
++
++static inline bool cpu_has_vmx_pml(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl & SECONDARY_EXEC_ENABLE_PML;
++}
++
++static inline bool cpu_has_vmx_tsc_scaling(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_TSC_SCALING;
++}
++
++static inline bool cpu_has_vmx_vmfunc(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_ENABLE_VMFUNC;
++}
++
++static bool vmx_umip_emulated(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_DESC;
++}
++
++static inline bool report_flexpriority(void)
++{
++ return flexpriority_enabled;
++}
++
++static inline unsigned nested_cpu_vmx_misc_cr3_count(struct kvm_vcpu *vcpu)
++{
++ return vmx_misc_cr3_count(to_vmx(vcpu)->nested.msrs.misc_low);
++}
++
++/*
++ * Do the virtual VMX capability MSRs specify that L1 can use VMWRITE
++ * to modify any valid field of the VMCS, or are the VM-exit
++ * information fields read-only?
++ */
++static inline bool nested_cpu_has_vmwrite_any_field(struct kvm_vcpu *vcpu)
++{
++ return to_vmx(vcpu)->nested.msrs.misc_low &
++ MSR_IA32_VMX_MISC_VMWRITE_SHADOW_RO_FIELDS;
++}
++
++static inline bool nested_cpu_has_zero_length_injection(struct kvm_vcpu *vcpu)
++{
++ return to_vmx(vcpu)->nested.msrs.misc_low & VMX_MISC_ZERO_LEN_INS;
++}
++
++static inline bool nested_cpu_supports_monitor_trap_flag(struct kvm_vcpu *vcpu)
++{
++ return to_vmx(vcpu)->nested.msrs.procbased_ctls_high &
++ CPU_BASED_MONITOR_TRAP_FLAG;
++}
++
++static inline bool nested_cpu_has_vmx_shadow_vmcs(struct kvm_vcpu *vcpu)
++{
++ return to_vmx(vcpu)->nested.msrs.secondary_ctls_high &
++ SECONDARY_EXEC_SHADOW_VMCS;
++}
++
++static inline bool nested_cpu_has(struct vmcs12 *vmcs12, u32 bit)
++{
++ return vmcs12->cpu_based_vm_exec_control & bit;
++}
++
++static inline bool nested_cpu_has2(struct vmcs12 *vmcs12, u32 bit)
++{
++ return (vmcs12->cpu_based_vm_exec_control &
++ CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) &&
++ (vmcs12->secondary_vm_exec_control & bit);
++}
++
++static inline bool nested_cpu_has_preemption_timer(struct vmcs12 *vmcs12)
++{
++ return vmcs12->pin_based_vm_exec_control &
++ PIN_BASED_VMX_PREEMPTION_TIMER;
++}
++
++static inline bool nested_cpu_has_nmi_exiting(struct vmcs12 *vmcs12)
++{
++ return vmcs12->pin_based_vm_exec_control & PIN_BASED_NMI_EXITING;
++}
++
++static inline bool nested_cpu_has_virtual_nmis(struct vmcs12 *vmcs12)
++{
++ return vmcs12->pin_based_vm_exec_control & PIN_BASED_VIRTUAL_NMIS;
++}
++
++static inline int nested_cpu_has_ept(struct vmcs12 *vmcs12)
++{
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_EPT);
++}
++
++static inline bool nested_cpu_has_xsaves(struct vmcs12 *vmcs12)
++{
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES);
++}
++
++static inline bool nested_cpu_has_pml(struct vmcs12 *vmcs12)
++{
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_PML);
++}
++
++static inline bool nested_cpu_has_virt_x2apic_mode(struct vmcs12 *vmcs12)
++{
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE);
++}
++
++static inline bool nested_cpu_has_vpid(struct vmcs12 *vmcs12)
++{
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_VPID);
++}
++
++static inline bool nested_cpu_has_apic_reg_virt(struct vmcs12 *vmcs12)
++{
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_APIC_REGISTER_VIRT);
++}
++
++static inline bool nested_cpu_has_vid(struct vmcs12 *vmcs12)
++{
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
++}
++
++static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12)
++{
++ return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR;
++}
++
++static inline bool nested_cpu_has_vmfunc(struct vmcs12 *vmcs12)
++{
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_VMFUNC);
++}
++
++static inline bool nested_cpu_has_eptp_switching(struct vmcs12 *vmcs12)
++{
++ return nested_cpu_has_vmfunc(vmcs12) &&
++ (vmcs12->vm_function_control &
++ VMX_VMFUNC_EPTP_SWITCHING);
++}
++
++static inline bool nested_cpu_has_shadow_vmcs(struct vmcs12 *vmcs12)
++{
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_SHADOW_VMCS);
++}
++
++static inline bool nested_cpu_has_save_preemption_timer(struct vmcs12 *vmcs12)
++{
++ return vmcs12->vm_exit_controls &
++ VM_EXIT_SAVE_VMX_PREEMPTION_TIMER;
++}
++
++static inline bool is_nmi(u32 intr_info)
++{
++ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
++ == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
++}
++
++static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
++ u32 exit_intr_info,
++ unsigned long exit_qualification);
++static void nested_vmx_entry_failure(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12,
++ u32 reason, unsigned long qualification);
++
++static int __find_msr_index(struct vcpu_vmx *vmx, u32 msr)
++{
++ int i;
++
++ for (i = 0; i < vmx->nmsrs; ++i)
++ if (vmx_msr_index[vmx->guest_msrs[i].index] == msr)
++ return i;
++ return -1;
++}
++
++static inline void __invvpid(unsigned long ext, u16 vpid, gva_t gva)
++{
++ struct {
++ u64 vpid : 16;
++ u64 rsvd : 48;
++ u64 gva;
++ } operand = { vpid, 0, gva };
++ bool error;
++
++ asm volatile (__ex(ASM_VMX_INVVPID) CC_SET(na)
++ : CC_OUT(na) (error) : "a"(&operand), "c"(ext)
++ : "memory");
++ BUG_ON(error);
++}
++
++static inline void __invept(unsigned long ext, u64 eptp, gpa_t gpa)
++{
++ struct {
++ u64 eptp, gpa;
++ } operand = {eptp, gpa};
++ bool error;
++
++ asm volatile (__ex(ASM_VMX_INVEPT) CC_SET(na)
++ : CC_OUT(na) (error) : "a" (&operand), "c" (ext)
++ : "memory");
++ BUG_ON(error);
++}
++
++static void vmx_setup_fb_clear_ctrl(void)
++{
++ u64 msr;
++
++ if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES) &&
++ !boot_cpu_has_bug(X86_BUG_MDS) &&
++ !boot_cpu_has_bug(X86_BUG_TAA)) {
++ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, msr);
++ if (msr & ARCH_CAP_FB_CLEAR_CTRL)
++ vmx_fb_clear_ctrl_available = true;
++ }
++}
++
++static __always_inline void vmx_disable_fb_clear(struct vcpu_vmx *vmx)
++{
++ u64 msr;
++
++ if (!vmx->disable_fb_clear)
++ return;
++
++ msr = __rdmsr(MSR_IA32_MCU_OPT_CTRL);
++ msr |= FB_CLEAR_DIS;
++ native_wrmsrl(MSR_IA32_MCU_OPT_CTRL, msr);
++ /* Cache the MSR value to avoid reading it later */
++ vmx->msr_ia32_mcu_opt_ctrl = msr;
++}
++
++static __always_inline void vmx_enable_fb_clear(struct vcpu_vmx *vmx)
++{
++ if (!vmx->disable_fb_clear)
++ return;
++
++ vmx->msr_ia32_mcu_opt_ctrl &= ~FB_CLEAR_DIS;
++ native_wrmsrl(MSR_IA32_MCU_OPT_CTRL, vmx->msr_ia32_mcu_opt_ctrl);
++}
++
++static void vmx_update_fb_clear_dis(struct kvm_vcpu *vcpu, struct vcpu_vmx *vmx)
++{
++ vmx->disable_fb_clear = vmx_fb_clear_ctrl_available;
++
++ /*
++ * If guest will not execute VERW, there is no need to set FB_CLEAR_DIS
++ * at VMEntry. Skip the MSR read/write when a guest has no use case to
++ * execute VERW.
++ */
++ if ((vcpu->arch.arch_capabilities & ARCH_CAP_FB_CLEAR) ||
++ ((vcpu->arch.arch_capabilities & ARCH_CAP_MDS_NO) &&
++ (vcpu->arch.arch_capabilities & ARCH_CAP_TAA_NO) &&
++ (vcpu->arch.arch_capabilities & ARCH_CAP_PSDP_NO) &&
++ (vcpu->arch.arch_capabilities & ARCH_CAP_FBSDP_NO) &&
++ (vcpu->arch.arch_capabilities & ARCH_CAP_SBDR_SSDP_NO)))
++ vmx->disable_fb_clear = false;
++}
++
++static struct shared_msr_entry *find_msr_entry(struct vcpu_vmx *vmx, u32 msr)
++{
++ int i;
++
++ i = __find_msr_index(vmx, msr);
++ if (i >= 0)
++ return &vmx->guest_msrs[i];
++ return NULL;
++}
++
++static void vmcs_clear(struct vmcs *vmcs)
++{
++ u64 phys_addr = __pa(vmcs);
++ bool error;
++
++ asm volatile (__ex(ASM_VMX_VMCLEAR_RAX) CC_SET(na)
++ : CC_OUT(na) (error) : "a"(&phys_addr), "m"(phys_addr)
++ : "memory");
++ if (unlikely(error))
++ printk(KERN_ERR "kvm: vmclear fail: %p/%llx\n",
++ vmcs, phys_addr);
++}
++
++static inline void loaded_vmcs_init(struct loaded_vmcs *loaded_vmcs)
++{
++ vmcs_clear(loaded_vmcs->vmcs);
++ if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched)
++ vmcs_clear(loaded_vmcs->shadow_vmcs);
++ loaded_vmcs->cpu = -1;
++ loaded_vmcs->launched = 0;
++}
++
++static void vmcs_load(struct vmcs *vmcs)
++{
++ u64 phys_addr = __pa(vmcs);
++ bool error;
++
++ if (static_branch_unlikely(&enable_evmcs))
++ return evmcs_load(phys_addr);
++
++ asm volatile (__ex(ASM_VMX_VMPTRLD_RAX) CC_SET(na)
++ : CC_OUT(na) (error) : "a"(&phys_addr), "m"(phys_addr)
++ : "memory");
++ if (unlikely(error))
++ printk(KERN_ERR "kvm: vmptrld %p/%llx failed\n",
++ vmcs, phys_addr);
++}
++
++#ifdef CONFIG_KEXEC_CORE
++static void crash_vmclear_local_loaded_vmcss(void)
++{
++ int cpu = raw_smp_processor_id();
++ struct loaded_vmcs *v;
++
++ list_for_each_entry(v, &per_cpu(loaded_vmcss_on_cpu, cpu),
++ loaded_vmcss_on_cpu_link)
++ vmcs_clear(v->vmcs);
++}
++#endif /* CONFIG_KEXEC_CORE */
++
++static void __loaded_vmcs_clear(void *arg)
++{
++ struct loaded_vmcs *loaded_vmcs = arg;
++ int cpu = raw_smp_processor_id();
++
++ if (loaded_vmcs->cpu != cpu)
++ return; /* vcpu migration can race with cpu offline */
++ if (per_cpu(current_vmcs, cpu) == loaded_vmcs->vmcs)
++ per_cpu(current_vmcs, cpu) = NULL;
++
++ vmcs_clear(loaded_vmcs->vmcs);
++ if (loaded_vmcs->shadow_vmcs && loaded_vmcs->launched)
++ vmcs_clear(loaded_vmcs->shadow_vmcs);
++
++ list_del(&loaded_vmcs->loaded_vmcss_on_cpu_link);
++
++ /*
++ * Ensure all writes to loaded_vmcs, including deleting it from its
++ * current percpu list, complete before setting loaded_vmcs->vcpu to
++ * -1, otherwise a different cpu can see vcpu == -1 first and add
++ * loaded_vmcs to its percpu list before it's deleted from this cpu's
++ * list. Pairs with the smp_rmb() in vmx_vcpu_load_vmcs().
++ */
++ smp_wmb();
++
++ loaded_vmcs->cpu = -1;
++ loaded_vmcs->launched = 0;
++}
++
++static void loaded_vmcs_clear(struct loaded_vmcs *loaded_vmcs)
++{
++ int cpu = loaded_vmcs->cpu;
++
++ if (cpu != -1)
++ smp_call_function_single(cpu,
++ __loaded_vmcs_clear, loaded_vmcs, 1);
++}
++
++static inline bool vpid_sync_vcpu_addr(int vpid, gva_t addr)
++{
++ if (vpid == 0)
++ return true;
++
++ if (cpu_has_vmx_invvpid_individual_addr()) {
++ __invvpid(VMX_VPID_EXTENT_INDIVIDUAL_ADDR, vpid, addr);
++ return true;
++ }
++
++ return false;
++}
++
++static inline void vpid_sync_vcpu_single(int vpid)
++{
++ if (vpid == 0)
++ return;
++
++ if (cpu_has_vmx_invvpid_single())
++ __invvpid(VMX_VPID_EXTENT_SINGLE_CONTEXT, vpid, 0);
++}
++
++static inline void vpid_sync_vcpu_global(void)
++{
++ if (cpu_has_vmx_invvpid_global())
++ __invvpid(VMX_VPID_EXTENT_ALL_CONTEXT, 0, 0);
++}
++
++static inline void vpid_sync_context(int vpid)
++{
++ if (cpu_has_vmx_invvpid_single())
++ vpid_sync_vcpu_single(vpid);
++ else
++ vpid_sync_vcpu_global();
++}
++
++static inline void ept_sync_global(void)
++{
++ __invept(VMX_EPT_EXTENT_GLOBAL, 0, 0);
++}
++
++static inline void ept_sync_context(u64 eptp)
++{
++ if (cpu_has_vmx_invept_context())
++ __invept(VMX_EPT_EXTENT_CONTEXT, eptp, 0);
++ else
++ ept_sync_global();
++}
++
++static __always_inline void vmcs_check16(unsigned long field)
++{
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6001) == 0x2000,
++ "16-bit accessor invalid for 64-bit field");
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6001) == 0x2001,
++ "16-bit accessor invalid for 64-bit high field");
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x4000,
++ "16-bit accessor invalid for 32-bit high field");
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x6000,
++ "16-bit accessor invalid for natural width field");
++}
++
++static __always_inline void vmcs_check32(unsigned long field)
++{
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0,
++ "32-bit accessor invalid for 16-bit field");
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x6000,
++ "32-bit accessor invalid for natural width field");
++}
++
++static __always_inline void vmcs_check64(unsigned long field)
++{
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0,
++ "64-bit accessor invalid for 16-bit field");
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6001) == 0x2001,
++ "64-bit accessor invalid for 64-bit high field");
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x4000,
++ "64-bit accessor invalid for 32-bit field");
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x6000,
++ "64-bit accessor invalid for natural width field");
++}
++
++static __always_inline void vmcs_checkl(unsigned long field)
++{
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0,
++ "Natural width accessor invalid for 16-bit field");
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6001) == 0x2000,
++ "Natural width accessor invalid for 64-bit field");
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6001) == 0x2001,
++ "Natural width accessor invalid for 64-bit high field");
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x4000,
++ "Natural width accessor invalid for 32-bit field");
++}
++
++static __always_inline unsigned long __vmcs_readl(unsigned long field)
++{
++ unsigned long value;
++
++ asm volatile (__ex_clear(ASM_VMX_VMREAD_RDX_RAX, "%0")
++ : "=a"(value) : "d"(field) : "cc");
++ return value;
++}
++
++static __always_inline u16 vmcs_read16(unsigned long field)
++{
++ vmcs_check16(field);
++ if (static_branch_unlikely(&enable_evmcs))
++ return evmcs_read16(field);
++ return __vmcs_readl(field);
++}
++
++static __always_inline u32 vmcs_read32(unsigned long field)
++{
++ vmcs_check32(field);
++ if (static_branch_unlikely(&enable_evmcs))
++ return evmcs_read32(field);
++ return __vmcs_readl(field);
++}
++
++static __always_inline u64 vmcs_read64(unsigned long field)
++{
++ vmcs_check64(field);
++ if (static_branch_unlikely(&enable_evmcs))
++ return evmcs_read64(field);
++#ifdef CONFIG_X86_64
++ return __vmcs_readl(field);
++#else
++ return __vmcs_readl(field) | ((u64)__vmcs_readl(field+1) << 32);
++#endif
++}
++
++static __always_inline unsigned long vmcs_readl(unsigned long field)
++{
++ vmcs_checkl(field);
++ if (static_branch_unlikely(&enable_evmcs))
++ return evmcs_read64(field);
++ return __vmcs_readl(field);
++}
++
++static noinline void vmwrite_error(unsigned long field, unsigned long value)
++{
++ printk(KERN_ERR "vmwrite error: reg %lx value %lx (err %d)\n",
++ field, value, vmcs_read32(VM_INSTRUCTION_ERROR));
++ dump_stack();
++}
++
++static __always_inline void __vmcs_writel(unsigned long field, unsigned long value)
++{
++ bool error;
++
++ asm volatile (__ex(ASM_VMX_VMWRITE_RAX_RDX) CC_SET(na)
++ : CC_OUT(na) (error) : "a"(value), "d"(field));
++ if (unlikely(error))
++ vmwrite_error(field, value);
++}
++
++static __always_inline void vmcs_write16(unsigned long field, u16 value)
++{
++ vmcs_check16(field);
++ if (static_branch_unlikely(&enable_evmcs))
++ return evmcs_write16(field, value);
++
++ __vmcs_writel(field, value);
++}
++
++static __always_inline void vmcs_write32(unsigned long field, u32 value)
++{
++ vmcs_check32(field);
++ if (static_branch_unlikely(&enable_evmcs))
++ return evmcs_write32(field, value);
++
++ __vmcs_writel(field, value);
++}
++
++static __always_inline void vmcs_write64(unsigned long field, u64 value)
++{
++ vmcs_check64(field);
++ if (static_branch_unlikely(&enable_evmcs))
++ return evmcs_write64(field, value);
++
++ __vmcs_writel(field, value);
++#ifndef CONFIG_X86_64
++ asm volatile ("");
++ __vmcs_writel(field+1, value >> 32);
++#endif
++}
++
++static __always_inline void vmcs_writel(unsigned long field, unsigned long value)
++{
++ vmcs_checkl(field);
++ if (static_branch_unlikely(&enable_evmcs))
++ return evmcs_write64(field, value);
++
++ __vmcs_writel(field, value);
++}
++
++static __always_inline void vmcs_clear_bits(unsigned long field, u32 mask)
++{
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x2000,
++ "vmcs_clear_bits does not support 64-bit fields");
++ if (static_branch_unlikely(&enable_evmcs))
++ return evmcs_write32(field, evmcs_read32(field) & ~mask);
++
++ __vmcs_writel(field, __vmcs_readl(field) & ~mask);
++}
++
++static __always_inline void vmcs_set_bits(unsigned long field, u32 mask)
++{
++ BUILD_BUG_ON_MSG(__builtin_constant_p(field) && ((field) & 0x6000) == 0x2000,
++ "vmcs_set_bits does not support 64-bit fields");
++ if (static_branch_unlikely(&enable_evmcs))
++ return evmcs_write32(field, evmcs_read32(field) | mask);
++
++ __vmcs_writel(field, __vmcs_readl(field) | mask);
++}
++
++static inline void vm_entry_controls_reset_shadow(struct vcpu_vmx *vmx)
++{
++ vmx->vm_entry_controls_shadow = vmcs_read32(VM_ENTRY_CONTROLS);
++}
++
++static inline void vm_entry_controls_init(struct vcpu_vmx *vmx, u32 val)
++{
++ vmcs_write32(VM_ENTRY_CONTROLS, val);
++ vmx->vm_entry_controls_shadow = val;
++}
++
++static inline void vm_entry_controls_set(struct vcpu_vmx *vmx, u32 val)
++{
++ if (vmx->vm_entry_controls_shadow != val)
++ vm_entry_controls_init(vmx, val);
++}
++
++static inline u32 vm_entry_controls_get(struct vcpu_vmx *vmx)
++{
++ return vmx->vm_entry_controls_shadow;
++}
++
++
++static inline void vm_entry_controls_setbit(struct vcpu_vmx *vmx, u32 val)
++{
++ vm_entry_controls_set(vmx, vm_entry_controls_get(vmx) | val);
++}
++
++static inline void vm_entry_controls_clearbit(struct vcpu_vmx *vmx, u32 val)
++{
++ vm_entry_controls_set(vmx, vm_entry_controls_get(vmx) & ~val);
++}
++
++static inline void vm_exit_controls_reset_shadow(struct vcpu_vmx *vmx)
++{
++ vmx->vm_exit_controls_shadow = vmcs_read32(VM_EXIT_CONTROLS);
++}
++
++static inline void vm_exit_controls_init(struct vcpu_vmx *vmx, u32 val)
++{
++ vmcs_write32(VM_EXIT_CONTROLS, val);
++ vmx->vm_exit_controls_shadow = val;
++}
++
++static inline void vm_exit_controls_set(struct vcpu_vmx *vmx, u32 val)
++{
++ if (vmx->vm_exit_controls_shadow != val)
++ vm_exit_controls_init(vmx, val);
++}
++
++static inline u32 vm_exit_controls_get(struct vcpu_vmx *vmx)
++{
++ return vmx->vm_exit_controls_shadow;
++}
++
++
++static inline void vm_exit_controls_setbit(struct vcpu_vmx *vmx, u32 val)
++{
++ vm_exit_controls_set(vmx, vm_exit_controls_get(vmx) | val);
++}
++
++static inline void vm_exit_controls_clearbit(struct vcpu_vmx *vmx, u32 val)
++{
++ vm_exit_controls_set(vmx, vm_exit_controls_get(vmx) & ~val);
++}
++
++static void vmx_segment_cache_clear(struct vcpu_vmx *vmx)
++{
++ vmx->segment_cache.bitmask = 0;
++}
++
++static bool vmx_segment_cache_test_set(struct vcpu_vmx *vmx, unsigned seg,
++ unsigned field)
++{
++ bool ret;
++ u32 mask = 1 << (seg * SEG_FIELD_NR + field);
++
++ if (!(vmx->vcpu.arch.regs_avail & (1 << VCPU_EXREG_SEGMENTS))) {
++ vmx->vcpu.arch.regs_avail |= (1 << VCPU_EXREG_SEGMENTS);
++ vmx->segment_cache.bitmask = 0;
++ }
++ ret = vmx->segment_cache.bitmask & mask;
++ vmx->segment_cache.bitmask |= mask;
++ return ret;
++}
++
++static u16 vmx_read_guest_seg_selector(struct vcpu_vmx *vmx, unsigned seg)
++{
++ u16 *p = &vmx->segment_cache.seg[seg].selector;
++
++ if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_SEL))
++ *p = vmcs_read16(kvm_vmx_segment_fields[seg].selector);
++ return *p;
++}
++
++static ulong vmx_read_guest_seg_base(struct vcpu_vmx *vmx, unsigned seg)
++{
++ ulong *p = &vmx->segment_cache.seg[seg].base;
++
++ if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_BASE))
++ *p = vmcs_readl(kvm_vmx_segment_fields[seg].base);
++ return *p;
++}
++
++static u32 vmx_read_guest_seg_limit(struct vcpu_vmx *vmx, unsigned seg)
++{
++ u32 *p = &vmx->segment_cache.seg[seg].limit;
++
++ if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_LIMIT))
++ *p = vmcs_read32(kvm_vmx_segment_fields[seg].limit);
++ return *p;
++}
++
++static u32 vmx_read_guest_seg_ar(struct vcpu_vmx *vmx, unsigned seg)
++{
++ u32 *p = &vmx->segment_cache.seg[seg].ar;
++
++ if (!vmx_segment_cache_test_set(vmx, seg, SEG_FIELD_AR))
++ *p = vmcs_read32(kvm_vmx_segment_fields[seg].ar_bytes);
++ return *p;
++}
++
++static void update_exception_bitmap(struct kvm_vcpu *vcpu)
++{
++ u32 eb;
++
++ eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
++ (1u << DB_VECTOR) | (1u << AC_VECTOR);
++ /*
++ * Guest access to VMware backdoor ports could legitimately
++ * trigger #GP because of TSS I/O permission bitmap.
++ * We intercept those #GP and allow access to them anyway
++ * as VMware does.
++ */
++ if (enable_vmware_backdoor)
++ eb |= (1u << GP_VECTOR);
++ if ((vcpu->guest_debug &
++ (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
++ (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP))
++ eb |= 1u << BP_VECTOR;
++ if (to_vmx(vcpu)->rmode.vm86_active)
++ eb = ~0;
++ if (enable_ept)
++ eb &= ~(1u << PF_VECTOR); /* bypass_guest_pf = 0 */
++
++ /* When we are running a nested L2 guest and L1 specified for it a
++ * certain exception bitmap, we must trap the same exceptions and pass
++ * them to L1. When running L2, we will only handle the exceptions
++ * specified above if L1 did not want them.
++ */
++ if (is_guest_mode(vcpu))
++ eb |= get_vmcs12(vcpu)->exception_bitmap;
++
++ vmcs_write32(EXCEPTION_BITMAP, eb);
++}
++
++/*
++ * Check if MSR is intercepted for currently loaded MSR bitmap.
++ */
++static bool msr_write_intercepted(struct kvm_vcpu *vcpu, u32 msr)
++{
++ unsigned long *msr_bitmap;
++ int f = sizeof(unsigned long);
++
++ if (!cpu_has_vmx_msr_bitmap())
++ return true;
++
++ msr_bitmap = to_vmx(vcpu)->loaded_vmcs->msr_bitmap;
++
++ if (msr <= 0x1fff) {
++ return !!test_bit(msr, msr_bitmap + 0x800 / f);
++ } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
++ msr &= 0x1fff;
++ return !!test_bit(msr, msr_bitmap + 0xc00 / f);
++ }
++
++ return true;
++}
++
++/*
++ * Check if MSR is intercepted for L01 MSR bitmap.
++ */
++static bool msr_write_intercepted_l01(struct kvm_vcpu *vcpu, u32 msr)
++{
++ unsigned long *msr_bitmap;
++ int f = sizeof(unsigned long);
++
++ if (!cpu_has_vmx_msr_bitmap())
++ return true;
++
++ msr_bitmap = to_vmx(vcpu)->vmcs01.msr_bitmap;
++
++ if (msr <= 0x1fff) {
++ return !!test_bit(msr, msr_bitmap + 0x800 / f);
++ } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
++ msr &= 0x1fff;
++ return !!test_bit(msr, msr_bitmap + 0xc00 / f);
++ }
++
++ return true;
++}
++
++static void clear_atomic_switch_msr_special(struct vcpu_vmx *vmx,
++ unsigned long entry, unsigned long exit)
++{
++ vm_entry_controls_clearbit(vmx, entry);
++ vm_exit_controls_clearbit(vmx, exit);
++}
++
++static int find_msr(struct vmx_msrs *m, unsigned int msr)
++{
++ unsigned int i;
++
++ for (i = 0; i < m->nr; ++i) {
++ if (m->val[i].index == msr)
++ return i;
++ }
++ return -ENOENT;
++}
++
++static void clear_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr)
++{
++ int i;
++ struct msr_autoload *m = &vmx->msr_autoload;
++
++ switch (msr) {
++ case MSR_EFER:
++ if (cpu_has_load_ia32_efer) {
++ clear_atomic_switch_msr_special(vmx,
++ VM_ENTRY_LOAD_IA32_EFER,
++ VM_EXIT_LOAD_IA32_EFER);
++ return;
++ }
++ break;
++ case MSR_CORE_PERF_GLOBAL_CTRL:
++ if (cpu_has_load_perf_global_ctrl) {
++ clear_atomic_switch_msr_special(vmx,
++ VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL,
++ VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL);
++ return;
++ }
++ break;
++ }
++ i = find_msr(&m->guest, msr);
++ if (i < 0)
++ goto skip_guest;
++ --m->guest.nr;
++ m->guest.val[i] = m->guest.val[m->guest.nr];
++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
++
++skip_guest:
++ i = find_msr(&m->host, msr);
++ if (i < 0)
++ return;
++
++ --m->host.nr;
++ m->host.val[i] = m->host.val[m->host.nr];
++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
++}
++
++static void add_atomic_switch_msr_special(struct vcpu_vmx *vmx,
++ unsigned long entry, unsigned long exit,
++ unsigned long guest_val_vmcs, unsigned long host_val_vmcs,
++ u64 guest_val, u64 host_val)
++{
++ vmcs_write64(guest_val_vmcs, guest_val);
++ vmcs_write64(host_val_vmcs, host_val);
++ vm_entry_controls_setbit(vmx, entry);
++ vm_exit_controls_setbit(vmx, exit);
++}
++
++static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
++ u64 guest_val, u64 host_val, bool entry_only)
++{
++ int i, j = 0;
++ struct msr_autoload *m = &vmx->msr_autoload;
++
++ switch (msr) {
++ case MSR_EFER:
++ if (cpu_has_load_ia32_efer) {
++ add_atomic_switch_msr_special(vmx,
++ VM_ENTRY_LOAD_IA32_EFER,
++ VM_EXIT_LOAD_IA32_EFER,
++ GUEST_IA32_EFER,
++ HOST_IA32_EFER,
++ guest_val, host_val);
++ return;
++ }
++ break;
++ case MSR_CORE_PERF_GLOBAL_CTRL:
++ if (cpu_has_load_perf_global_ctrl) {
++ add_atomic_switch_msr_special(vmx,
++ VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL,
++ VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL,
++ GUEST_IA32_PERF_GLOBAL_CTRL,
++ HOST_IA32_PERF_GLOBAL_CTRL,
++ guest_val, host_val);
++ return;
++ }
++ break;
++ case MSR_IA32_PEBS_ENABLE:
++ /* PEBS needs a quiescent period after being disabled (to write
++ * a record). Disabling PEBS through VMX MSR swapping doesn't
++ * provide that period, so a CPU could write host's record into
++ * guest's memory.
++ */
++ wrmsrl(MSR_IA32_PEBS_ENABLE, 0);
++ }
++
++ i = find_msr(&m->guest, msr);
++ if (!entry_only)
++ j = find_msr(&m->host, msr);
++
++ if ((i < 0 && m->guest.nr == NR_AUTOLOAD_MSRS) ||
++ (j < 0 && m->host.nr == NR_AUTOLOAD_MSRS)) {
++ printk_once(KERN_WARNING "Not enough msr switch entries. "
++ "Can't add msr %x\n", msr);
++ return;
++ }
++ if (i < 0) {
++ i = m->guest.nr++;
++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr);
++ }
++ m->guest.val[i].index = msr;
++ m->guest.val[i].value = guest_val;
++
++ if (entry_only)
++ return;
++
++ if (j < 0) {
++ j = m->host.nr++;
++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr);
++ }
++ m->host.val[j].index = msr;
++ m->host.val[j].value = host_val;
++}
++
++static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset)
++{
++ u64 guest_efer = vmx->vcpu.arch.efer;
++ u64 ignore_bits = 0;
++
++ /* Shadow paging assumes NX to be available. */
++ if (!enable_ept)
++ guest_efer |= EFER_NX;
++
++ /*
++ * LMA and LME handled by hardware; SCE meaningless outside long mode.
++ */
++ ignore_bits |= EFER_SCE;
++#ifdef CONFIG_X86_64
++ ignore_bits |= EFER_LMA | EFER_LME;
++ /* SCE is meaningful only in long mode on Intel */
++ if (guest_efer & EFER_LMA)
++ ignore_bits &= ~(u64)EFER_SCE;
++#endif
++
++ clear_atomic_switch_msr(vmx, MSR_EFER);
++
++ /*
++ * On EPT, we can't emulate NX, so we must switch EFER atomically.
++ * On CPUs that support "load IA32_EFER", always switch EFER
++ * atomically, since it's faster than switching it manually.
++ */
++ if (cpu_has_load_ia32_efer ||
++ (enable_ept && ((vmx->vcpu.arch.efer ^ host_efer) & EFER_NX))) {
++ if (!(guest_efer & EFER_LMA))
++ guest_efer &= ~EFER_LME;
++ if (guest_efer != host_efer)
++ add_atomic_switch_msr(vmx, MSR_EFER,
++ guest_efer, host_efer, false);
++ return false;
++ } else {
++ guest_efer &= ~ignore_bits;
++ guest_efer |= host_efer & ignore_bits;
++
++ vmx->guest_msrs[efer_offset].data = guest_efer;
++ vmx->guest_msrs[efer_offset].mask = ~ignore_bits;
++
++ return true;
++ }
++}
++
++#ifdef CONFIG_X86_32
++/*
++ * On 32-bit kernels, VM exits still load the FS and GS bases from the
++ * VMCS rather than the segment table. KVM uses this helper to figure
++ * out the current bases to poke them into the VMCS before entry.
++ */
++static unsigned long segment_base(u16 selector)
++{
++ struct desc_struct *table;
++ unsigned long v;
++
++ if (!(selector & ~SEGMENT_RPL_MASK))
++ return 0;
++
++ table = get_current_gdt_ro();
++
++ if ((selector & SEGMENT_TI_MASK) == SEGMENT_LDT) {
++ u16 ldt_selector = kvm_read_ldt();
++
++ if (!(ldt_selector & ~SEGMENT_RPL_MASK))
++ return 0;
++
++ table = (struct desc_struct *)segment_base(ldt_selector);
++ }
++ v = get_desc_base(&table[selector >> 3]);
++ return v;
++}
++#endif
++
++static void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct vmcs_host_state *host_state;
++#ifdef CONFIG_X86_64
++ int cpu = raw_smp_processor_id();
++#endif
++ unsigned long fs_base, gs_base;
++ u16 fs_sel, gs_sel;
++ int i;
++
++ vmx->req_immediate_exit = false;
++
++ /*
++ * Note that guest MSRs to be saved/restored can also be changed
++ * when guest state is loaded. This happens when guest transitions
++ * to/from long-mode by setting MSR_EFER.LMA.
++ */
++ if (!vmx->loaded_cpu_state || vmx->guest_msrs_dirty) {
++ vmx->guest_msrs_dirty = false;
++ for (i = 0; i < vmx->save_nmsrs; ++i)
++ kvm_set_shared_msr(vmx->guest_msrs[i].index,
++ vmx->guest_msrs[i].data,
++ vmx->guest_msrs[i].mask);
++
++ }
++
++ if (vmx->loaded_cpu_state)
++ return;
++
++ vmx->loaded_cpu_state = vmx->loaded_vmcs;
++ host_state = &vmx->loaded_cpu_state->host_state;
++
++ /*
++ * Set host fs and gs selectors. Unfortunately, 22.2.3 does not
++ * allow segment selectors with cpl > 0 or ti == 1.
++ */
++ host_state->ldt_sel = kvm_read_ldt();
++
++#ifdef CONFIG_X86_64
++ savesegment(ds, host_state->ds_sel);
++ savesegment(es, host_state->es_sel);
++
++ gs_base = cpu_kernelmode_gs_base(cpu);
++ if (likely(is_64bit_mm(current->mm))) {
++ save_fsgs_for_kvm();
++ fs_sel = current->thread.fsindex;
++ gs_sel = current->thread.gsindex;
++ fs_base = current->thread.fsbase;
++ vmx->msr_host_kernel_gs_base = current->thread.gsbase;
++ } else {
++ savesegment(fs, fs_sel);
++ savesegment(gs, gs_sel);
++ fs_base = read_msr(MSR_FS_BASE);
++ vmx->msr_host_kernel_gs_base = read_msr(MSR_KERNEL_GS_BASE);
++ }
++
++ wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
++#else
++ savesegment(fs, fs_sel);
++ savesegment(gs, gs_sel);
++ fs_base = segment_base(fs_sel);
++ gs_base = segment_base(gs_sel);
++#endif
++
++ if (unlikely(fs_sel != host_state->fs_sel)) {
++ if (!(fs_sel & 7))
++ vmcs_write16(HOST_FS_SELECTOR, fs_sel);
++ else
++ vmcs_write16(HOST_FS_SELECTOR, 0);
++ host_state->fs_sel = fs_sel;
++ }
++ if (unlikely(gs_sel != host_state->gs_sel)) {
++ if (!(gs_sel & 7))
++ vmcs_write16(HOST_GS_SELECTOR, gs_sel);
++ else
++ vmcs_write16(HOST_GS_SELECTOR, 0);
++ host_state->gs_sel = gs_sel;
++ }
++ if (unlikely(fs_base != host_state->fs_base)) {
++ vmcs_writel(HOST_FS_BASE, fs_base);
++ host_state->fs_base = fs_base;
++ }
++ if (unlikely(gs_base != host_state->gs_base)) {
++ vmcs_writel(HOST_GS_BASE, gs_base);
++ host_state->gs_base = gs_base;
++ }
++}
++
++static void vmx_prepare_switch_to_host(struct vcpu_vmx *vmx)
++{
++ struct vmcs_host_state *host_state;
++
++ if (!vmx->loaded_cpu_state)
++ return;
++
++ WARN_ON_ONCE(vmx->loaded_cpu_state != vmx->loaded_vmcs);
++ host_state = &vmx->loaded_cpu_state->host_state;
++
++ ++vmx->vcpu.stat.host_state_reload;
++ vmx->loaded_cpu_state = NULL;
++
++#ifdef CONFIG_X86_64
++ rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
++#endif
++ if (host_state->ldt_sel || (host_state->gs_sel & 7)) {
++ kvm_load_ldt(host_state->ldt_sel);
++#ifdef CONFIG_X86_64
++ load_gs_index(host_state->gs_sel);
++#else
++ loadsegment(gs, host_state->gs_sel);
++#endif
++ }
++ if (host_state->fs_sel & 7)
++ loadsegment(fs, host_state->fs_sel);
++#ifdef CONFIG_X86_64
++ if (unlikely(host_state->ds_sel | host_state->es_sel)) {
++ loadsegment(ds, host_state->ds_sel);
++ loadsegment(es, host_state->es_sel);
++ }
++#endif
++ invalidate_tss_limit();
++#ifdef CONFIG_X86_64
++ wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
++#endif
++ load_fixmap_gdt(raw_smp_processor_id());
++}
++
++#ifdef CONFIG_X86_64
++static u64 vmx_read_guest_kernel_gs_base(struct vcpu_vmx *vmx)
++{
++ preempt_disable();
++ if (vmx->loaded_cpu_state)
++ rdmsrl(MSR_KERNEL_GS_BASE, vmx->msr_guest_kernel_gs_base);
++ preempt_enable();
++ return vmx->msr_guest_kernel_gs_base;
++}
++
++static void vmx_write_guest_kernel_gs_base(struct vcpu_vmx *vmx, u64 data)
++{
++ preempt_disable();
++ if (vmx->loaded_cpu_state)
++ wrmsrl(MSR_KERNEL_GS_BASE, data);
++ preempt_enable();
++ vmx->msr_guest_kernel_gs_base = data;
++}
++#endif
++
++static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
++{
++ struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
++ struct pi_desc old, new;
++ unsigned int dest;
++
++ /*
++ * In case of hot-plug or hot-unplug, we may have to undo
++ * vmx_vcpu_pi_put even if there is no assigned device. And we
++ * always keep PI.NDST up to date for simplicity: it makes the
++ * code easier, and CPU migration is not a fast path.
++ */
++ if (!pi_test_sn(pi_desc) && vcpu->cpu == cpu)
++ return;
++
++ /*
++ * First handle the simple case where no cmpxchg is necessary; just
++ * allow posting non-urgent interrupts.
++ *
++ * If the 'nv' field is POSTED_INTR_WAKEUP_VECTOR, do not change
++ * PI.NDST: pi_post_block will do it for us and the wakeup_handler
++ * expects the VCPU to be on the blocked_vcpu_list that matches
++ * PI.NDST.
++ */
++ if (pi_desc->nv == POSTED_INTR_WAKEUP_VECTOR ||
++ vcpu->cpu == cpu) {
++ pi_clear_sn(pi_desc);
++ return;
++ }
++
++ /* The full case. */
++ do {
++ old.control = new.control = pi_desc->control;
++
++ dest = cpu_physical_id(cpu);
++
++ if (x2apic_enabled())
++ new.ndst = dest;
++ else
++ new.ndst = (dest << 8) & 0xFF00;
++
++ new.sn = 0;
++ } while (cmpxchg64(&pi_desc->control, old.control,
++ new.control) != old.control);
++}
++
++static void decache_tsc_multiplier(struct vcpu_vmx *vmx)
++{
++ vmx->current_tsc_ratio = vmx->vcpu.arch.tsc_scaling_ratio;
++ vmcs_write64(TSC_MULTIPLIER, vmx->current_tsc_ratio);
++}
++
++/*
++ * Switches to specified vcpu, until a matching vcpu_put(), but assumes
++ * vcpu mutex is already taken.
++ */
++static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ bool already_loaded = vmx->loaded_vmcs->cpu == cpu;
++
++ if (!already_loaded) {
++ loaded_vmcs_clear(vmx->loaded_vmcs);
++ local_irq_disable();
++
++ /*
++ * Ensure loaded_vmcs->cpu is read before adding loaded_vmcs to
++ * this cpu's percpu list, otherwise it may not yet be deleted
++ * from its previous cpu's percpu list. Pairs with the
++ * smb_wmb() in __loaded_vmcs_clear().
++ */
++ smp_rmb();
++
++ list_add(&vmx->loaded_vmcs->loaded_vmcss_on_cpu_link,
++ &per_cpu(loaded_vmcss_on_cpu, cpu));
++ local_irq_enable();
++ }
++
++ if (per_cpu(current_vmcs, cpu) != vmx->loaded_vmcs->vmcs) {
++ per_cpu(current_vmcs, cpu) = vmx->loaded_vmcs->vmcs;
++ vmcs_load(vmx->loaded_vmcs->vmcs);
++ indirect_branch_prediction_barrier();
++ }
++
++ if (!already_loaded) {
++ void *gdt = get_current_gdt_ro();
++ unsigned long sysenter_esp;
++
++ kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
++
++ /*
++ * Linux uses per-cpu TSS and GDT, so set these when switching
++ * processors. See 22.2.4.
++ */
++ vmcs_writel(HOST_TR_BASE,
++ (unsigned long)&get_cpu_entry_area(cpu)->tss.x86_tss);
++ vmcs_writel(HOST_GDTR_BASE, (unsigned long)gdt); /* 22.2.4 */
++
++ /*
++ * VM exits change the host TR limit to 0x67 after a VM
++ * exit. This is okay, since 0x67 covers everything except
++ * the IO bitmap and have have code to handle the IO bitmap
++ * being lost after a VM exit.
++ */
++ BUILD_BUG_ON(IO_BITMAP_OFFSET - 1 != 0x67);
++
++ rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
++ vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
++
++ vmx->loaded_vmcs->cpu = cpu;
++ }
++
++ /* Setup TSC multiplier */
++ if (kvm_has_tsc_control &&
++ vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio)
++ decache_tsc_multiplier(vmx);
++
++ vmx_vcpu_pi_load(vcpu, cpu);
++ vmx->host_pkru = read_pkru();
++ vmx->host_debugctlmsr = get_debugctlmsr();
++}
++
++static void vmx_vcpu_pi_put(struct kvm_vcpu *vcpu)
++{
++ struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
++
++ if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
++ !irq_remapping_cap(IRQ_POSTING_CAP) ||
++ !kvm_vcpu_apicv_active(vcpu))
++ return;
++
++ /* Set SN when the vCPU is preempted */
++ if (vcpu->preempted)
++ pi_set_sn(pi_desc);
++}
++
++static void vmx_vcpu_put(struct kvm_vcpu *vcpu)
++{
++ vmx_vcpu_pi_put(vcpu);
++
++ vmx_prepare_switch_to_host(to_vmx(vcpu));
++}
++
++static bool emulation_required(struct kvm_vcpu *vcpu)
++{
++ return emulate_invalid_guest_state && !guest_state_valid(vcpu);
++}
++
++static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu);
++
++/*
++ * Return the cr0 value that a nested guest would read. This is a combination
++ * of the real cr0 used to run the guest (guest_cr0), and the bits shadowed by
++ * its hypervisor (cr0_read_shadow).
++ */
++static inline unsigned long nested_read_cr0(struct vmcs12 *fields)
++{
++ return (fields->guest_cr0 & ~fields->cr0_guest_host_mask) |
++ (fields->cr0_read_shadow & fields->cr0_guest_host_mask);
++}
++static inline unsigned long nested_read_cr4(struct vmcs12 *fields)
++{
++ return (fields->guest_cr4 & ~fields->cr4_guest_host_mask) |
++ (fields->cr4_read_shadow & fields->cr4_guest_host_mask);
++}
++
++static unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu)
++{
++ unsigned long rflags, save_rflags;
++
++ if (!test_bit(VCPU_EXREG_RFLAGS, (ulong *)&vcpu->arch.regs_avail)) {
++ __set_bit(VCPU_EXREG_RFLAGS, (ulong *)&vcpu->arch.regs_avail);
++ rflags = vmcs_readl(GUEST_RFLAGS);
++ if (to_vmx(vcpu)->rmode.vm86_active) {
++ rflags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
++ save_rflags = to_vmx(vcpu)->rmode.save_rflags;
++ rflags |= save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
++ }
++ to_vmx(vcpu)->rflags = rflags;
++ }
++ return to_vmx(vcpu)->rflags;
++}
++
++static void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
++{
++ unsigned long old_rflags = vmx_get_rflags(vcpu);
++
++ __set_bit(VCPU_EXREG_RFLAGS, (ulong *)&vcpu->arch.regs_avail);
++ to_vmx(vcpu)->rflags = rflags;
++ if (to_vmx(vcpu)->rmode.vm86_active) {
++ to_vmx(vcpu)->rmode.save_rflags = rflags;
++ rflags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
++ }
++ vmcs_writel(GUEST_RFLAGS, rflags);
++
++ if ((old_rflags ^ to_vmx(vcpu)->rflags) & X86_EFLAGS_VM)
++ to_vmx(vcpu)->emulation_required = emulation_required(vcpu);
++}
++
++static u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu)
++{
++ u32 interruptibility = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
++ int ret = 0;
++
++ if (interruptibility & GUEST_INTR_STATE_STI)
++ ret |= KVM_X86_SHADOW_INT_STI;
++ if (interruptibility & GUEST_INTR_STATE_MOV_SS)
++ ret |= KVM_X86_SHADOW_INT_MOV_SS;
++
++ return ret;
++}
++
++static void vmx_set_interrupt_shadow(struct kvm_vcpu *vcpu, int mask)
++{
++ u32 interruptibility_old = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
++ u32 interruptibility = interruptibility_old;
++
++ interruptibility &= ~(GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS);
++
++ if (mask & KVM_X86_SHADOW_INT_MOV_SS)
++ interruptibility |= GUEST_INTR_STATE_MOV_SS;
++ else if (mask & KVM_X86_SHADOW_INT_STI)
++ interruptibility |= GUEST_INTR_STATE_STI;
++
++ if ((interruptibility != interruptibility_old))
++ vmcs_write32(GUEST_INTERRUPTIBILITY_INFO, interruptibility);
++}
++
++static void skip_emulated_instruction(struct kvm_vcpu *vcpu)
++{
++ unsigned long rip;
++
++ rip = kvm_rip_read(vcpu);
++ rip += vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
++ kvm_rip_write(vcpu, rip);
++
++ /* skipping an emulated instruction also counts */
++ vmx_set_interrupt_shadow(vcpu, 0);
++}
++
++static void nested_vmx_inject_exception_vmexit(struct kvm_vcpu *vcpu,
++ unsigned long exit_qual)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ unsigned int nr = vcpu->arch.exception.nr;
++ u32 intr_info = nr | INTR_INFO_VALID_MASK;
++
++ if (vcpu->arch.exception.has_error_code) {
++ vmcs12->vm_exit_intr_error_code = vcpu->arch.exception.error_code;
++ intr_info |= INTR_INFO_DELIVER_CODE_MASK;
++ }
++
++ if (kvm_exception_is_soft(nr))
++ intr_info |= INTR_TYPE_SOFT_EXCEPTION;
++ else
++ intr_info |= INTR_TYPE_HARD_EXCEPTION;
++
++ if (!(vmcs12->idt_vectoring_info_field & VECTORING_INFO_VALID_MASK) &&
++ vmx_get_nmi_mask(vcpu))
++ intr_info |= INTR_INFO_UNBLOCK_NMI;
++
++ nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI, intr_info, exit_qual);
++}
++
++/*
++ * KVM wants to inject page-faults which it got to the guest. This function
++ * checks whether in a nested guest, we need to inject them to L1 or L2.
++ */
++static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned long *exit_qual)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ unsigned int nr = vcpu->arch.exception.nr;
++
++ if (nr == PF_VECTOR) {
++ if (vcpu->arch.exception.nested_apf) {
++ *exit_qual = vcpu->arch.apf.nested_apf_token;
++ return 1;
++ }
++ /*
++ * FIXME: we must not write CR2 when L1 intercepts an L2 #PF exception.
++ * The fix is to add the ancillary datum (CR2 or DR6) to structs
++ * kvm_queued_exception and kvm_vcpu_events, so that CR2 and DR6
++ * can be written only when inject_pending_event runs. This should be
++ * conditional on a new capability---if the capability is disabled,
++ * kvm_multiple_exception would write the ancillary information to
++ * CR2 or DR6, for backwards ABI-compatibility.
++ */
++ if (nested_vmx_is_page_fault_vmexit(vmcs12,
++ vcpu->arch.exception.error_code)) {
++ *exit_qual = vcpu->arch.cr2;
++ return 1;
++ }
++ } else {
++ if (vmcs12->exception_bitmap & (1u << nr)) {
++ if (nr == DB_VECTOR) {
++ *exit_qual = vcpu->arch.dr6;
++ *exit_qual &= ~(DR6_FIXED_1 | DR6_BT);
++ *exit_qual ^= DR6_RTM;
++ } else {
++ *exit_qual = 0;
++ }
++ return 1;
++ }
++ }
++
++ return 0;
++}
++
++static void vmx_clear_hlt(struct kvm_vcpu *vcpu)
++{
++ /*
++ * Ensure that we clear the HLT state in the VMCS. We don't need to
++ * explicitly skip the instruction because if the HLT state is set,
++ * then the instruction is already executing and RIP has already been
++ * advanced.
++ */
++ if (kvm_hlt_in_guest(vcpu->kvm) &&
++ vmcs_read32(GUEST_ACTIVITY_STATE) == GUEST_ACTIVITY_HLT)
++ vmcs_write32(GUEST_ACTIVITY_STATE, GUEST_ACTIVITY_ACTIVE);
++}
++
++static void vmx_queue_exception(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned nr = vcpu->arch.exception.nr;
++ bool has_error_code = vcpu->arch.exception.has_error_code;
++ u32 error_code = vcpu->arch.exception.error_code;
++ u32 intr_info = nr | INTR_INFO_VALID_MASK;
++
++ if (has_error_code) {
++ vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE, error_code);
++ intr_info |= INTR_INFO_DELIVER_CODE_MASK;
++ }
++
++ if (vmx->rmode.vm86_active) {
++ int inc_eip = 0;
++ if (kvm_exception_is_soft(nr))
++ inc_eip = vcpu->arch.event_exit_inst_len;
++ if (kvm_inject_realmode_interrupt(vcpu, nr, inc_eip) != EMULATE_DONE)
++ kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
++ return;
++ }
++
++ WARN_ON_ONCE(vmx->emulation_required);
++
++ if (kvm_exception_is_soft(nr)) {
++ vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
++ vmx->vcpu.arch.event_exit_inst_len);
++ intr_info |= INTR_TYPE_SOFT_EXCEPTION;
++ } else
++ intr_info |= INTR_TYPE_HARD_EXCEPTION;
++
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, intr_info);
++
++ vmx_clear_hlt(vcpu);
++}
++
++static bool vmx_rdtscp_supported(void)
++{
++ return cpu_has_vmx_rdtscp();
++}
++
++static bool vmx_invpcid_supported(void)
++{
++ return cpu_has_vmx_invpcid();
++}
++
++/*
++ * Swap MSR entry in host/guest MSR entry array.
++ */
++static void move_msr_up(struct vcpu_vmx *vmx, int from, int to)
++{
++ struct shared_msr_entry tmp;
++
++ tmp = vmx->guest_msrs[to];
++ vmx->guest_msrs[to] = vmx->guest_msrs[from];
++ vmx->guest_msrs[from] = tmp;
++}
++
++/*
++ * Set up the vmcs to automatically save and restore system
++ * msrs. Don't touch the 64-bit msrs if the guest is in legacy
++ * mode, as fiddling with msrs is very expensive.
++ */
++static void setup_msrs(struct vcpu_vmx *vmx)
++{
++ int save_nmsrs, index;
++
++ save_nmsrs = 0;
++#ifdef CONFIG_X86_64
++ if (is_long_mode(&vmx->vcpu)) {
++ index = __find_msr_index(vmx, MSR_SYSCALL_MASK);
++ if (index >= 0)
++ move_msr_up(vmx, index, save_nmsrs++);
++ index = __find_msr_index(vmx, MSR_LSTAR);
++ if (index >= 0)
++ move_msr_up(vmx, index, save_nmsrs++);
++ index = __find_msr_index(vmx, MSR_CSTAR);
++ if (index >= 0)
++ move_msr_up(vmx, index, save_nmsrs++);
++ /*
++ * MSR_STAR is only needed on long mode guests, and only
++ * if efer.sce is enabled.
++ */
++ index = __find_msr_index(vmx, MSR_STAR);
++ if ((index >= 0) && (vmx->vcpu.arch.efer & EFER_SCE))
++ move_msr_up(vmx, index, save_nmsrs++);
++ }
++#endif
++ index = __find_msr_index(vmx, MSR_EFER);
++ if (index >= 0 && update_transition_efer(vmx, index))
++ move_msr_up(vmx, index, save_nmsrs++);
++ index = __find_msr_index(vmx, MSR_TSC_AUX);
++ if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
++ move_msr_up(vmx, index, save_nmsrs++);
++
++ vmx->save_nmsrs = save_nmsrs;
++ vmx->guest_msrs_dirty = true;
++
++ if (cpu_has_vmx_msr_bitmap())
++ vmx_update_msr_bitmap(&vmx->vcpu);
++}
++
++static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++
++ if (is_guest_mode(vcpu) &&
++ (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING))
++ return vcpu->arch.tsc_offset - vmcs12->tsc_offset;
++
++ return vcpu->arch.tsc_offset;
++}
++
++static u64 vmx_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
++{
++ u64 active_offset = offset;
++ if (is_guest_mode(vcpu)) {
++ /*
++ * We're here if L1 chose not to trap WRMSR to TSC. According
++ * to the spec, this should set L1's TSC; The offset that L1
++ * set for L2 remains unchanged, and still needs to be added
++ * to the newly set TSC to get L2's TSC.
++ */
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ if (nested_cpu_has(vmcs12, CPU_BASED_USE_TSC_OFFSETING))
++ active_offset += vmcs12->tsc_offset;
++ } else {
++ trace_kvm_write_tsc_offset(vcpu->vcpu_id,
++ vmcs_read64(TSC_OFFSET), offset);
++ }
++
++ vmcs_write64(TSC_OFFSET, active_offset);
++ return active_offset;
++}
++
++/*
++ * nested_vmx_allowed() checks whether a guest should be allowed to use VMX
++ * instructions and MSRs (i.e., nested VMX). Nested VMX is disabled for
++ * all guests if the "nested" module option is off, and can also be disabled
++ * for a single guest by disabling its VMX cpuid bit.
++ */
++static inline bool nested_vmx_allowed(struct kvm_vcpu *vcpu)
++{
++ return nested && guest_cpuid_has(vcpu, X86_FEATURE_VMX);
++}
++
++/*
++ * nested_vmx_setup_ctls_msrs() sets up variables containing the values to be
++ * returned for the various VMX controls MSRs when nested VMX is enabled.
++ * The same values should also be used to verify that vmcs12 control fields are
++ * valid during nested entry from L1 to L2.
++ * Each of these control msrs has a low and high 32-bit half: A low bit is on
++ * if the corresponding bit in the (32-bit) control field *must* be on, and a
++ * bit in the high half is on if the corresponding bit in the control field
++ * may be on. See also vmx_control_verify().
++ */
++static void nested_vmx_setup_ctls_msrs(struct nested_vmx_msrs *msrs, bool apicv)
++{
++ if (!nested) {
++ memset(msrs, 0, sizeof(*msrs));
++ return;
++ }
++
++ /*
++ * Note that as a general rule, the high half of the MSRs (bits in
++ * the control fields which may be 1) should be initialized by the
++ * intersection of the underlying hardware's MSR (i.e., features which
++ * can be supported) and the list of features we want to expose -
++ * because they are known to be properly supported in our code.
++ * Also, usually, the low half of the MSRs (bits which must be 1) can
++ * be set to 0, meaning that L1 may turn off any of these bits. The
++ * reason is that if one of these bits is necessary, it will appear
++ * in vmcs01 and prepare_vmcs02, when it bitwise-or's the control
++ * fields of vmcs01 and vmcs02, will turn these bits off - and
++ * nested_vmx_exit_reflected() will not pass related exits to L1.
++ * These rules have exceptions below.
++ */
++
++ /* pin-based controls */
++ rdmsr(MSR_IA32_VMX_PINBASED_CTLS,
++ msrs->pinbased_ctls_low,
++ msrs->pinbased_ctls_high);
++ msrs->pinbased_ctls_low |=
++ PIN_BASED_ALWAYSON_WITHOUT_TRUE_MSR;
++ msrs->pinbased_ctls_high &=
++ PIN_BASED_EXT_INTR_MASK |
++ PIN_BASED_NMI_EXITING |
++ PIN_BASED_VIRTUAL_NMIS |
++ (apicv ? PIN_BASED_POSTED_INTR : 0);
++ msrs->pinbased_ctls_high |=
++ PIN_BASED_ALWAYSON_WITHOUT_TRUE_MSR |
++ PIN_BASED_VMX_PREEMPTION_TIMER;
++
++ /* exit controls */
++ rdmsr(MSR_IA32_VMX_EXIT_CTLS,
++ msrs->exit_ctls_low,
++ msrs->exit_ctls_high);
++ msrs->exit_ctls_low =
++ VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR;
++
++ msrs->exit_ctls_high &=
++#ifdef CONFIG_X86_64
++ VM_EXIT_HOST_ADDR_SPACE_SIZE |
++#endif
++ VM_EXIT_LOAD_IA32_PAT | VM_EXIT_SAVE_IA32_PAT;
++ msrs->exit_ctls_high |=
++ VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR |
++ VM_EXIT_LOAD_IA32_EFER | VM_EXIT_SAVE_IA32_EFER |
++ VM_EXIT_SAVE_VMX_PREEMPTION_TIMER | VM_EXIT_ACK_INTR_ON_EXIT;
++
++ /* We support free control of debug control saving. */
++ msrs->exit_ctls_low &= ~VM_EXIT_SAVE_DEBUG_CONTROLS;
++
++ /* entry controls */
++ rdmsr(MSR_IA32_VMX_ENTRY_CTLS,
++ msrs->entry_ctls_low,
++ msrs->entry_ctls_high);
++ msrs->entry_ctls_low =
++ VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR;
++ msrs->entry_ctls_high &=
++#ifdef CONFIG_X86_64
++ VM_ENTRY_IA32E_MODE |
++#endif
++ VM_ENTRY_LOAD_IA32_PAT;
++ msrs->entry_ctls_high |=
++ (VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR | VM_ENTRY_LOAD_IA32_EFER);
++
++ /* We support free control of debug control loading. */
++ msrs->entry_ctls_low &= ~VM_ENTRY_LOAD_DEBUG_CONTROLS;
++
++ /* cpu-based controls */
++ rdmsr(MSR_IA32_VMX_PROCBASED_CTLS,
++ msrs->procbased_ctls_low,
++ msrs->procbased_ctls_high);
++ msrs->procbased_ctls_low =
++ CPU_BASED_ALWAYSON_WITHOUT_TRUE_MSR;
++ msrs->procbased_ctls_high &=
++ CPU_BASED_VIRTUAL_INTR_PENDING |
++ CPU_BASED_VIRTUAL_NMI_PENDING | CPU_BASED_USE_TSC_OFFSETING |
++ CPU_BASED_HLT_EXITING | CPU_BASED_INVLPG_EXITING |
++ CPU_BASED_MWAIT_EXITING | CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_CR3_STORE_EXITING |
++#ifdef CONFIG_X86_64
++ CPU_BASED_CR8_LOAD_EXITING | CPU_BASED_CR8_STORE_EXITING |
++#endif
++ CPU_BASED_MOV_DR_EXITING | CPU_BASED_UNCOND_IO_EXITING |
++ CPU_BASED_USE_IO_BITMAPS | CPU_BASED_MONITOR_TRAP_FLAG |
++ CPU_BASED_MONITOR_EXITING | CPU_BASED_RDPMC_EXITING |
++ CPU_BASED_RDTSC_EXITING | CPU_BASED_PAUSE_EXITING |
++ CPU_BASED_TPR_SHADOW | CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
++ /*
++ * We can allow some features even when not supported by the
++ * hardware. For example, L1 can specify an MSR bitmap - and we
++ * can use it to avoid exits to L1 - even when L0 runs L2
++ * without MSR bitmaps.
++ */
++ msrs->procbased_ctls_high |=
++ CPU_BASED_ALWAYSON_WITHOUT_TRUE_MSR |
++ CPU_BASED_USE_MSR_BITMAPS;
++
++ /* We support free control of CR3 access interception. */
++ msrs->procbased_ctls_low &=
++ ~(CPU_BASED_CR3_LOAD_EXITING | CPU_BASED_CR3_STORE_EXITING);
++
++ /*
++ * secondary cpu-based controls. Do not include those that
++ * depend on CPUID bits, they are added later by vmx_cpuid_update.
++ */
++ if (msrs->procbased_ctls_high & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS)
++ rdmsr(MSR_IA32_VMX_PROCBASED_CTLS2,
++ msrs->secondary_ctls_low,
++ msrs->secondary_ctls_high);
++
++ msrs->secondary_ctls_low = 0;
++ msrs->secondary_ctls_high &=
++ SECONDARY_EXEC_DESC |
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
++ SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
++ SECONDARY_EXEC_WBINVD_EXITING;
++
++ /*
++ * We can emulate "VMCS shadowing," even if the hardware
++ * doesn't support it.
++ */
++ msrs->secondary_ctls_high |=
++ SECONDARY_EXEC_SHADOW_VMCS;
++
++ if (enable_ept) {
++ /* nested EPT: emulate EPT also to L1 */
++ msrs->secondary_ctls_high |=
++ SECONDARY_EXEC_ENABLE_EPT;
++ msrs->ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
++ VMX_EPTP_WB_BIT | VMX_EPT_INVEPT_BIT;
++ if (cpu_has_vmx_ept_execute_only())
++ msrs->ept_caps |=
++ VMX_EPT_EXECUTE_ONLY_BIT;
++ msrs->ept_caps &= vmx_capability.ept;
++ msrs->ept_caps |= VMX_EPT_EXTENT_GLOBAL_BIT |
++ VMX_EPT_EXTENT_CONTEXT_BIT | VMX_EPT_2MB_PAGE_BIT |
++ VMX_EPT_1GB_PAGE_BIT;
++ if (enable_ept_ad_bits) {
++ msrs->secondary_ctls_high |=
++ SECONDARY_EXEC_ENABLE_PML;
++ msrs->ept_caps |= VMX_EPT_AD_BIT;
++ }
++ }
++
++ if (cpu_has_vmx_vmfunc()) {
++ msrs->secondary_ctls_high |=
++ SECONDARY_EXEC_ENABLE_VMFUNC;
++ /*
++ * Advertise EPTP switching unconditionally
++ * since we emulate it
++ */
++ if (enable_ept)
++ msrs->vmfunc_controls =
++ VMX_VMFUNC_EPTP_SWITCHING;
++ }
++
++ /*
++ * Old versions of KVM use the single-context version without
++ * checking for support, so declare that it is supported even
++ * though it is treated as global context. The alternative is
++ * not failing the single-context invvpid, and it is worse.
++ */
++ if (enable_vpid) {
++ msrs->secondary_ctls_high |=
++ SECONDARY_EXEC_ENABLE_VPID;
++ msrs->vpid_caps = VMX_VPID_INVVPID_BIT |
++ VMX_VPID_EXTENT_SUPPORTED_MASK;
++ }
++
++ if (enable_unrestricted_guest)
++ msrs->secondary_ctls_high |=
++ SECONDARY_EXEC_UNRESTRICTED_GUEST;
++
++ if (flexpriority_enabled)
++ msrs->secondary_ctls_high |=
++ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
++
++ /* miscellaneous data */
++ rdmsr(MSR_IA32_VMX_MISC,
++ msrs->misc_low,
++ msrs->misc_high);
++ msrs->misc_low &= VMX_MISC_SAVE_EFER_LMA;
++ msrs->misc_low |=
++ MSR_IA32_VMX_MISC_VMWRITE_SHADOW_RO_FIELDS |
++ VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE |
++ VMX_MISC_ACTIVITY_HLT;
++ msrs->misc_high = 0;
++
++ /*
++ * This MSR reports some information about VMX support. We
++ * should return information about the VMX we emulate for the
++ * guest, and the VMCS structure we give it - not about the
++ * VMX support of the underlying hardware.
++ */
++ msrs->basic =
++ VMCS12_REVISION |
++ VMX_BASIC_TRUE_CTLS |
++ ((u64)VMCS12_SIZE << VMX_BASIC_VMCS_SIZE_SHIFT) |
++ (VMX_BASIC_MEM_TYPE_WB << VMX_BASIC_MEM_TYPE_SHIFT);
++
++ if (cpu_has_vmx_basic_inout())
++ msrs->basic |= VMX_BASIC_INOUT;
++
++ /*
++ * These MSRs specify bits which the guest must keep fixed on
++ * while L1 is in VMXON mode (in L1's root mode, or running an L2).
++ * We picked the standard core2 setting.
++ */
++#define VMXON_CR0_ALWAYSON (X86_CR0_PE | X86_CR0_PG | X86_CR0_NE)
++#define VMXON_CR4_ALWAYSON X86_CR4_VMXE
++ msrs->cr0_fixed0 = VMXON_CR0_ALWAYSON;
++ msrs->cr4_fixed0 = VMXON_CR4_ALWAYSON;
++
++ /* These MSRs specify bits which the guest must keep fixed off. */
++ rdmsrl(MSR_IA32_VMX_CR0_FIXED1, msrs->cr0_fixed1);
++ rdmsrl(MSR_IA32_VMX_CR4_FIXED1, msrs->cr4_fixed1);
++
++ /* highest index: VMX_PREEMPTION_TIMER_VALUE */
++ msrs->vmcs_enum = VMCS12_MAX_FIELD_INDEX << 1;
++}
++
++/*
++ * if fixed0[i] == 1: val[i] must be 1
++ * if fixed1[i] == 0: val[i] must be 0
++ */
++static inline bool fixed_bits_valid(u64 val, u64 fixed0, u64 fixed1)
++{
++ return ((val & fixed1) | fixed0) == val;
++}
++
++static inline bool vmx_control_verify(u32 control, u32 low, u32 high)
++{
++ return fixed_bits_valid(control, low, high);
++}
++
++static inline u64 vmx_control_msr(u32 low, u32 high)
++{
++ return low | ((u64)high << 32);
++}
++
++static bool is_bitwise_subset(u64 superset, u64 subset, u64 mask)
++{
++ superset &= mask;
++ subset &= mask;
++
++ return (superset | subset) == superset;
++}
++
++static int vmx_restore_vmx_basic(struct vcpu_vmx *vmx, u64 data)
++{
++ const u64 feature_and_reserved =
++ /* feature (except bit 48; see below) */
++ BIT_ULL(49) | BIT_ULL(54) | BIT_ULL(55) |
++ /* reserved */
++ BIT_ULL(31) | GENMASK_ULL(47, 45) | GENMASK_ULL(63, 56);
++ u64 vmx_basic = vmx->nested.msrs.basic;
++
++ if (!is_bitwise_subset(vmx_basic, data, feature_and_reserved))
++ return -EINVAL;
++
++ /*
++ * KVM does not emulate a version of VMX that constrains physical
++ * addresses of VMX structures (e.g. VMCS) to 32-bits.
++ */
++ if (data & BIT_ULL(48))
++ return -EINVAL;
++
++ if (vmx_basic_vmcs_revision_id(vmx_basic) !=
++ vmx_basic_vmcs_revision_id(data))
++ return -EINVAL;
++
++ if (vmx_basic_vmcs_size(vmx_basic) > vmx_basic_vmcs_size(data))
++ return -EINVAL;
++
++ vmx->nested.msrs.basic = data;
++ return 0;
++}
++
++static int
++vmx_restore_control_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data)
++{
++ u64 supported;
++ u32 *lowp, *highp;
++
++ switch (msr_index) {
++ case MSR_IA32_VMX_TRUE_PINBASED_CTLS:
++ lowp = &vmx->nested.msrs.pinbased_ctls_low;
++ highp = &vmx->nested.msrs.pinbased_ctls_high;
++ break;
++ case MSR_IA32_VMX_TRUE_PROCBASED_CTLS:
++ lowp = &vmx->nested.msrs.procbased_ctls_low;
++ highp = &vmx->nested.msrs.procbased_ctls_high;
++ break;
++ case MSR_IA32_VMX_TRUE_EXIT_CTLS:
++ lowp = &vmx->nested.msrs.exit_ctls_low;
++ highp = &vmx->nested.msrs.exit_ctls_high;
++ break;
++ case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
++ lowp = &vmx->nested.msrs.entry_ctls_low;
++ highp = &vmx->nested.msrs.entry_ctls_high;
++ break;
++ case MSR_IA32_VMX_PROCBASED_CTLS2:
++ lowp = &vmx->nested.msrs.secondary_ctls_low;
++ highp = &vmx->nested.msrs.secondary_ctls_high;
++ break;
++ default:
++ BUG();
++ }
++
++ supported = vmx_control_msr(*lowp, *highp);
++
++ /* Check must-be-1 bits are still 1. */
++ if (!is_bitwise_subset(data, supported, GENMASK_ULL(31, 0)))
++ return -EINVAL;
++
++ /* Check must-be-0 bits are still 0. */
++ if (!is_bitwise_subset(supported, data, GENMASK_ULL(63, 32)))
++ return -EINVAL;
++
++ *lowp = data;
++ *highp = data >> 32;
++ return 0;
++}
++
++static int vmx_restore_vmx_misc(struct vcpu_vmx *vmx, u64 data)
++{
++ const u64 feature_and_reserved_bits =
++ /* feature */
++ BIT_ULL(5) | GENMASK_ULL(8, 6) | BIT_ULL(14) | BIT_ULL(15) |
++ BIT_ULL(28) | BIT_ULL(29) | BIT_ULL(30) |
++ /* reserved */
++ GENMASK_ULL(13, 9) | BIT_ULL(31);
++ u64 vmx_misc;
++
++ vmx_misc = vmx_control_msr(vmx->nested.msrs.misc_low,
++ vmx->nested.msrs.misc_high);
++
++ if (!is_bitwise_subset(vmx_misc, data, feature_and_reserved_bits))
++ return -EINVAL;
++
++ if ((vmx->nested.msrs.pinbased_ctls_high &
++ PIN_BASED_VMX_PREEMPTION_TIMER) &&
++ vmx_misc_preemption_timer_rate(data) !=
++ vmx_misc_preemption_timer_rate(vmx_misc))
++ return -EINVAL;
++
++ if (vmx_misc_cr3_count(data) > vmx_misc_cr3_count(vmx_misc))
++ return -EINVAL;
++
++ if (vmx_misc_max_msr(data) > vmx_misc_max_msr(vmx_misc))
++ return -EINVAL;
++
++ if (vmx_misc_mseg_revid(data) != vmx_misc_mseg_revid(vmx_misc))
++ return -EINVAL;
++
++ vmx->nested.msrs.misc_low = data;
++ vmx->nested.msrs.misc_high = data >> 32;
++
++ /*
++ * If L1 has read-only VM-exit information fields, use the
++ * less permissive vmx_vmwrite_bitmap to specify write
++ * permissions for the shadow VMCS.
++ */
++ if (enable_shadow_vmcs && !nested_cpu_has_vmwrite_any_field(&vmx->vcpu))
++ vmcs_write64(VMWRITE_BITMAP, __pa(vmx_vmwrite_bitmap));
++
++ return 0;
++}
++
++static int vmx_restore_vmx_ept_vpid_cap(struct vcpu_vmx *vmx, u64 data)
++{
++ u64 vmx_ept_vpid_cap;
++
++ vmx_ept_vpid_cap = vmx_control_msr(vmx->nested.msrs.ept_caps,
++ vmx->nested.msrs.vpid_caps);
++
++ /* Every bit is either reserved or a feature bit. */
++ if (!is_bitwise_subset(vmx_ept_vpid_cap, data, -1ULL))
++ return -EINVAL;
++
++ vmx->nested.msrs.ept_caps = data;
++ vmx->nested.msrs.vpid_caps = data >> 32;
++ return 0;
++}
++
++static int vmx_restore_fixed0_msr(struct vcpu_vmx *vmx, u32 msr_index, u64 data)
++{
++ u64 *msr;
++
++ switch (msr_index) {
++ case MSR_IA32_VMX_CR0_FIXED0:
++ msr = &vmx->nested.msrs.cr0_fixed0;
++ break;
++ case MSR_IA32_VMX_CR4_FIXED0:
++ msr = &vmx->nested.msrs.cr4_fixed0;
++ break;
++ default:
++ BUG();
++ }
++
++ /*
++ * 1 bits (which indicates bits which "must-be-1" during VMX operation)
++ * must be 1 in the restored value.
++ */
++ if (!is_bitwise_subset(data, *msr, -1ULL))
++ return -EINVAL;
++
++ *msr = data;
++ return 0;
++}
++
++/*
++ * Called when userspace is restoring VMX MSRs.
++ *
++ * Returns 0 on success, non-0 otherwise.
++ */
++static int vmx_set_vmx_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ /*
++ * Don't allow changes to the VMX capability MSRs while the vCPU
++ * is in VMX operation.
++ */
++ if (vmx->nested.vmxon)
++ return -EBUSY;
++
++ switch (msr_index) {
++ case MSR_IA32_VMX_BASIC:
++ return vmx_restore_vmx_basic(vmx, data);
++ case MSR_IA32_VMX_PINBASED_CTLS:
++ case MSR_IA32_VMX_PROCBASED_CTLS:
++ case MSR_IA32_VMX_EXIT_CTLS:
++ case MSR_IA32_VMX_ENTRY_CTLS:
++ /*
++ * The "non-true" VMX capability MSRs are generated from the
++ * "true" MSRs, so we do not support restoring them directly.
++ *
++ * If userspace wants to emulate VMX_BASIC[55]=0, userspace
++ * should restore the "true" MSRs with the must-be-1 bits
++ * set according to the SDM Vol 3. A.2 "RESERVED CONTROLS AND
++ * DEFAULT SETTINGS".
++ */
++ return -EINVAL;
++ case MSR_IA32_VMX_TRUE_PINBASED_CTLS:
++ case MSR_IA32_VMX_TRUE_PROCBASED_CTLS:
++ case MSR_IA32_VMX_TRUE_EXIT_CTLS:
++ case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
++ case MSR_IA32_VMX_PROCBASED_CTLS2:
++ return vmx_restore_control_msr(vmx, msr_index, data);
++ case MSR_IA32_VMX_MISC:
++ return vmx_restore_vmx_misc(vmx, data);
++ case MSR_IA32_VMX_CR0_FIXED0:
++ case MSR_IA32_VMX_CR4_FIXED0:
++ return vmx_restore_fixed0_msr(vmx, msr_index, data);
++ case MSR_IA32_VMX_CR0_FIXED1:
++ case MSR_IA32_VMX_CR4_FIXED1:
++ /*
++ * These MSRs are generated based on the vCPU's CPUID, so we
++ * do not support restoring them directly.
++ */
++ return -EINVAL;
++ case MSR_IA32_VMX_EPT_VPID_CAP:
++ return vmx_restore_vmx_ept_vpid_cap(vmx, data);
++ case MSR_IA32_VMX_VMCS_ENUM:
++ vmx->nested.msrs.vmcs_enum = data;
++ return 0;
++ default:
++ /*
++ * The rest of the VMX capability MSRs do not support restore.
++ */
++ return -EINVAL;
++ }
++}
++
++/* Returns 0 on success, non-0 otherwise. */
++static int vmx_get_vmx_msr(struct nested_vmx_msrs *msrs, u32 msr_index, u64 *pdata)
++{
++ switch (msr_index) {
++ case MSR_IA32_VMX_BASIC:
++ *pdata = msrs->basic;
++ break;
++ case MSR_IA32_VMX_TRUE_PINBASED_CTLS:
++ case MSR_IA32_VMX_PINBASED_CTLS:
++ *pdata = vmx_control_msr(
++ msrs->pinbased_ctls_low,
++ msrs->pinbased_ctls_high);
++ if (msr_index == MSR_IA32_VMX_PINBASED_CTLS)
++ *pdata |= PIN_BASED_ALWAYSON_WITHOUT_TRUE_MSR;
++ break;
++ case MSR_IA32_VMX_TRUE_PROCBASED_CTLS:
++ case MSR_IA32_VMX_PROCBASED_CTLS:
++ *pdata = vmx_control_msr(
++ msrs->procbased_ctls_low,
++ msrs->procbased_ctls_high);
++ if (msr_index == MSR_IA32_VMX_PROCBASED_CTLS)
++ *pdata |= CPU_BASED_ALWAYSON_WITHOUT_TRUE_MSR;
++ break;
++ case MSR_IA32_VMX_TRUE_EXIT_CTLS:
++ case MSR_IA32_VMX_EXIT_CTLS:
++ *pdata = vmx_control_msr(
++ msrs->exit_ctls_low,
++ msrs->exit_ctls_high);
++ if (msr_index == MSR_IA32_VMX_EXIT_CTLS)
++ *pdata |= VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR;
++ break;
++ case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
++ case MSR_IA32_VMX_ENTRY_CTLS:
++ *pdata = vmx_control_msr(
++ msrs->entry_ctls_low,
++ msrs->entry_ctls_high);
++ if (msr_index == MSR_IA32_VMX_ENTRY_CTLS)
++ *pdata |= VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR;
++ break;
++ case MSR_IA32_VMX_MISC:
++ *pdata = vmx_control_msr(
++ msrs->misc_low,
++ msrs->misc_high);
++ break;
++ case MSR_IA32_VMX_CR0_FIXED0:
++ *pdata = msrs->cr0_fixed0;
++ break;
++ case MSR_IA32_VMX_CR0_FIXED1:
++ *pdata = msrs->cr0_fixed1;
++ break;
++ case MSR_IA32_VMX_CR4_FIXED0:
++ *pdata = msrs->cr4_fixed0;
++ break;
++ case MSR_IA32_VMX_CR4_FIXED1:
++ *pdata = msrs->cr4_fixed1;
++ break;
++ case MSR_IA32_VMX_VMCS_ENUM:
++ *pdata = msrs->vmcs_enum;
++ break;
++ case MSR_IA32_VMX_PROCBASED_CTLS2:
++ *pdata = vmx_control_msr(
++ msrs->secondary_ctls_low,
++ msrs->secondary_ctls_high);
++ break;
++ case MSR_IA32_VMX_EPT_VPID_CAP:
++ *pdata = msrs->ept_caps |
++ ((u64)msrs->vpid_caps << 32);
++ break;
++ case MSR_IA32_VMX_VMFUNC:
++ *pdata = msrs->vmfunc_controls;
++ break;
++ default:
++ return 1;
++ }
++
++ return 0;
++}
++
++static inline bool vmx_feature_control_msr_valid(struct kvm_vcpu *vcpu,
++ uint64_t val)
++{
++ uint64_t valid_bits = to_vmx(vcpu)->msr_ia32_feature_control_valid_bits;
++
++ return !(val & ~valid_bits);
++}
++
++static int vmx_get_msr_feature(struct kvm_msr_entry *msr)
++{
++ switch (msr->index) {
++ case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
++ if (!nested)
++ return 1;
++ return vmx_get_vmx_msr(&vmcs_config.nested, msr->index, &msr->data);
++ default:
++ return 1;
++ }
++
++ return 0;
++}
++
++/*
++ * Reads an msr value (of 'msr_index') into 'pdata'.
++ * Returns 0 on success, non-0 otherwise.
++ * Assumes vcpu_load() was already called.
++ */
++static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct shared_msr_entry *msr;
++
++ switch (msr_info->index) {
++#ifdef CONFIG_X86_64
++ case MSR_FS_BASE:
++ msr_info->data = vmcs_readl(GUEST_FS_BASE);
++ break;
++ case MSR_GS_BASE:
++ msr_info->data = vmcs_readl(GUEST_GS_BASE);
++ break;
++ case MSR_KERNEL_GS_BASE:
++ msr_info->data = vmx_read_guest_kernel_gs_base(vmx);
++ break;
++#endif
++ case MSR_EFER:
++ return kvm_get_msr_common(vcpu, msr_info);
++ case MSR_IA32_SPEC_CTRL:
++ if (!msr_info->host_initiated &&
++ !guest_has_spec_ctrl_msr(vcpu))
++ return 1;
++
++ msr_info->data = to_vmx(vcpu)->spec_ctrl;
++ break;
++ case MSR_IA32_SYSENTER_CS:
++ msr_info->data = vmcs_read32(GUEST_SYSENTER_CS);
++ break;
++ case MSR_IA32_SYSENTER_EIP:
++ msr_info->data = vmcs_readl(GUEST_SYSENTER_EIP);
++ break;
++ case MSR_IA32_SYSENTER_ESP:
++ msr_info->data = vmcs_readl(GUEST_SYSENTER_ESP);
++ break;
++ case MSR_IA32_BNDCFGS:
++ if (!kvm_mpx_supported() ||
++ (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_MPX)))
++ return 1;
++ msr_info->data = vmcs_read64(GUEST_BNDCFGS);
++ break;
++ case MSR_IA32_MCG_EXT_CTL:
++ if (!msr_info->host_initiated &&
++ !(vmx->msr_ia32_feature_control &
++ FEATURE_CONTROL_LMCE))
++ return 1;
++ msr_info->data = vcpu->arch.mcg_ext_ctl;
++ break;
++ case MSR_IA32_FEATURE_CONTROL:
++ msr_info->data = vmx->msr_ia32_feature_control;
++ break;
++ case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
++ if (!nested_vmx_allowed(vcpu))
++ return 1;
++ return vmx_get_vmx_msr(&vmx->nested.msrs, msr_info->index,
++ &msr_info->data);
++ case MSR_IA32_XSS:
++ if (!vmx_xsaves_supported() ||
++ (!msr_info->host_initiated &&
++ !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))))
++ return 1;
++ msr_info->data = vcpu->arch.ia32_xss;
++ break;
++ case MSR_TSC_AUX:
++ if (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
++ return 1;
++ /* Otherwise falls through */
++ default:
++ msr = find_msr_entry(vmx, msr_info->index);
++ if (msr) {
++ msr_info->data = msr->data;
++ break;
++ }
++ return kvm_get_msr_common(vcpu, msr_info);
++ }
++
++ return 0;
++}
++
++static void vmx_leave_nested(struct kvm_vcpu *vcpu);
++
++/*
++ * Writes msr value into into the appropriate "register".
++ * Returns 0 on success, non-0 otherwise.
++ * Assumes vcpu_load() was already called.
++ */
++static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct shared_msr_entry *msr;
++ int ret = 0;
++ u32 msr_index = msr_info->index;
++ u64 data = msr_info->data;
++
++ switch (msr_index) {
++ case MSR_EFER:
++ ret = kvm_set_msr_common(vcpu, msr_info);
++ break;
++#ifdef CONFIG_X86_64
++ case MSR_FS_BASE:
++ vmx_segment_cache_clear(vmx);
++ vmcs_writel(GUEST_FS_BASE, data);
++ break;
++ case MSR_GS_BASE:
++ vmx_segment_cache_clear(vmx);
++ vmcs_writel(GUEST_GS_BASE, data);
++ break;
++ case MSR_KERNEL_GS_BASE:
++ vmx_write_guest_kernel_gs_base(vmx, data);
++ break;
++#endif
++ case MSR_IA32_SYSENTER_CS:
++ vmcs_write32(GUEST_SYSENTER_CS, data);
++ break;
++ case MSR_IA32_SYSENTER_EIP:
++ vmcs_writel(GUEST_SYSENTER_EIP, data);
++ break;
++ case MSR_IA32_SYSENTER_ESP:
++ vmcs_writel(GUEST_SYSENTER_ESP, data);
++ break;
++ case MSR_IA32_BNDCFGS:
++ if (!kvm_mpx_supported() ||
++ (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_MPX)))
++ return 1;
++ if (is_noncanonical_address(data & PAGE_MASK, vcpu) ||
++ (data & MSR_IA32_BNDCFGS_RSVD))
++ return 1;
++ vmcs_write64(GUEST_BNDCFGS, data);
++ break;
++ case MSR_IA32_SPEC_CTRL:
++ if (!msr_info->host_initiated &&
++ !guest_has_spec_ctrl_msr(vcpu))
++ return 1;
++
++ /* The STIBP bit doesn't fault even if it's not advertised */
++ if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD))
++ return 1;
++
++ vmx->spec_ctrl = data;
++
++ if (!data)
++ break;
++
++ /*
++ * For non-nested:
++ * When it's written (to non-zero) for the first time, pass
++ * it through.
++ *
++ * For nested:
++ * The handling of the MSR bitmap for L2 guests is done in
++ * nested_vmx_merge_msr_bitmap. We should not touch the
++ * vmcs02.msr_bitmap here since it gets completely overwritten
++ * in the merging. We update the vmcs01 here for L1 as well
++ * since it will end up touching the MSR anyway now.
++ */
++ vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap,
++ MSR_IA32_SPEC_CTRL,
++ MSR_TYPE_RW);
++ break;
++ case MSR_IA32_PRED_CMD:
++ if (!msr_info->host_initiated &&
++ !guest_has_pred_cmd_msr(vcpu))
++ return 1;
++
++ if (data & ~PRED_CMD_IBPB)
++ return 1;
++
++ if (!data)
++ break;
++
++ wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB);
++
++ /*
++ * For non-nested:
++ * When it's written (to non-zero) for the first time, pass
++ * it through.
++ *
++ * For nested:
++ * The handling of the MSR bitmap for L2 guests is done in
++ * nested_vmx_merge_msr_bitmap. We should not touch the
++ * vmcs02.msr_bitmap here since it gets completely overwritten
++ * in the merging.
++ */
++ vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD,
++ MSR_TYPE_W);
++ break;
++ case MSR_IA32_CR_PAT:
++ if (!kvm_pat_valid(data))
++ return 1;
++
++ if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
++ vmcs_write64(GUEST_IA32_PAT, data);
++ vcpu->arch.pat = data;
++ break;
++ }
++ ret = kvm_set_msr_common(vcpu, msr_info);
++ break;
++ case MSR_IA32_TSC_ADJUST:
++ ret = kvm_set_msr_common(vcpu, msr_info);
++ break;
++ case MSR_IA32_MCG_EXT_CTL:
++ if ((!msr_info->host_initiated &&
++ !(to_vmx(vcpu)->msr_ia32_feature_control &
++ FEATURE_CONTROL_LMCE)) ||
++ (data & ~MCG_EXT_CTL_LMCE_EN))
++ return 1;
++ vcpu->arch.mcg_ext_ctl = data;
++ break;
++ case MSR_IA32_FEATURE_CONTROL:
++ if (!vmx_feature_control_msr_valid(vcpu, data) ||
++ (to_vmx(vcpu)->msr_ia32_feature_control &
++ FEATURE_CONTROL_LOCKED && !msr_info->host_initiated))
++ return 1;
++ vmx->msr_ia32_feature_control = data;
++ if (msr_info->host_initiated && data == 0)
++ vmx_leave_nested(vcpu);
++ break;
++ case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC:
++ if (!msr_info->host_initiated)
++ return 1; /* they are read-only */
++ if (!nested_vmx_allowed(vcpu))
++ return 1;
++ return vmx_set_vmx_msr(vcpu, msr_index, data);
++ case MSR_IA32_XSS:
++ if (!vmx_xsaves_supported() ||
++ (!msr_info->host_initiated &&
++ !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))))
++ return 1;
++ /*
++ * The only supported bit as of Skylake is bit 8, but
++ * it is not supported on KVM.
++ */
++ if (data != 0)
++ return 1;
++ vcpu->arch.ia32_xss = data;
++ if (vcpu->arch.ia32_xss != host_xss)
++ add_atomic_switch_msr(vmx, MSR_IA32_XSS,
++ vcpu->arch.ia32_xss, host_xss, false);
++ else
++ clear_atomic_switch_msr(vmx, MSR_IA32_XSS);
++ break;
++ case MSR_TSC_AUX:
++ if (!msr_info->host_initiated &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP))
++ return 1;
++ /* Check reserved bit, higher 32 bits should be zero */
++ if ((data >> 32) != 0)
++ return 1;
++ /* Otherwise falls through */
++ default:
++ msr = find_msr_entry(vmx, msr_index);
++ if (msr) {
++ u64 old_msr_data = msr->data;
++ msr->data = data;
++ if (msr - vmx->guest_msrs < vmx->save_nmsrs) {
++ preempt_disable();
++ ret = kvm_set_shared_msr(msr->index, msr->data,
++ msr->mask);
++ preempt_enable();
++ if (ret)
++ msr->data = old_msr_data;
++ }
++ break;
++ }
++ ret = kvm_set_msr_common(vcpu, msr_info);
++ }
++
++ /* FB_CLEAR may have changed, also update the FB_CLEAR_DIS behavior */
++ if (msr_index == MSR_IA32_ARCH_CAPABILITIES)
++ vmx_update_fb_clear_dis(vcpu, vmx);
++
++ return ret;
++}
++
++static void vmx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
++{
++ __set_bit(reg, (unsigned long *)&vcpu->arch.regs_avail);
++ switch (reg) {
++ case VCPU_REGS_RSP:
++ vcpu->arch.regs[VCPU_REGS_RSP] = vmcs_readl(GUEST_RSP);
++ break;
++ case VCPU_REGS_RIP:
++ vcpu->arch.regs[VCPU_REGS_RIP] = vmcs_readl(GUEST_RIP);
++ break;
++ case VCPU_EXREG_PDPTR:
++ if (enable_ept)
++ ept_save_pdptrs(vcpu);
++ break;
++ default:
++ break;
++ }
++}
++
++static __init int cpu_has_kvm_support(void)
++{
++ return cpu_has_vmx();
++}
++
++static __init int vmx_disabled_by_bios(void)
++{
++ u64 msr;
++
++ rdmsrl(MSR_IA32_FEATURE_CONTROL, msr);
++ if (msr & FEATURE_CONTROL_LOCKED) {
++ /* launched w/ TXT and VMX disabled */
++ if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX)
++ && tboot_enabled())
++ return 1;
++ /* launched w/o TXT and VMX only enabled w/ TXT */
++ if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
++ && (msr & FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX)
++ && !tboot_enabled()) {
++ printk(KERN_WARNING "kvm: disable TXT in the BIOS or "
++ "activate TXT before enabling KVM\n");
++ return 1;
++ }
++ /* launched w/o TXT and VMX disabled */
++ if (!(msr & FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX)
++ && !tboot_enabled())
++ return 1;
++ }
++
++ return 0;
++}
++
++static void kvm_cpu_vmxon(u64 addr)
++{
++ cr4_set_bits(X86_CR4_VMXE);
++ intel_pt_handle_vmx(1);
++
++ asm volatile (ASM_VMX_VMXON_RAX
++ : : "a"(&addr), "m"(addr)
++ : "memory", "cc");
++}
++
++static int hardware_enable(void)
++{
++ int cpu = raw_smp_processor_id();
++ u64 phys_addr = __pa(per_cpu(vmxarea, cpu));
++ u64 old, test_bits;
++
++ if (cr4_read_shadow() & X86_CR4_VMXE)
++ return -EBUSY;
++
++ /*
++ * This can happen if we hot-added a CPU but failed to allocate
++ * VP assist page for it.
++ */
++ if (static_branch_unlikely(&enable_evmcs) &&
++ !hv_get_vp_assist_page(cpu))
++ return -EFAULT;
++
++ rdmsrl(MSR_IA32_FEATURE_CONTROL, old);
++
++ test_bits = FEATURE_CONTROL_LOCKED;
++ test_bits |= FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
++ if (tboot_enabled())
++ test_bits |= FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX;
++
++ if ((old & test_bits) != test_bits) {
++ /* enable and lock */
++ wrmsrl(MSR_IA32_FEATURE_CONTROL, old | test_bits);
++ }
++ kvm_cpu_vmxon(phys_addr);
++ if (enable_ept)
++ ept_sync_global();
++
++ return 0;
++}
++
++static void vmclear_local_loaded_vmcss(void)
++{
++ int cpu = raw_smp_processor_id();
++ struct loaded_vmcs *v, *n;
++
++ list_for_each_entry_safe(v, n, &per_cpu(loaded_vmcss_on_cpu, cpu),
++ loaded_vmcss_on_cpu_link)
++ __loaded_vmcs_clear(v);
++}
++
++
++/* Just like cpu_vmxoff(), but with the __kvm_handle_fault_on_reboot()
++ * tricks.
++ */
++static void kvm_cpu_vmxoff(void)
++{
++ asm volatile (__ex(ASM_VMX_VMXOFF) : : : "cc");
++
++ intel_pt_handle_vmx(0);
++ cr4_clear_bits(X86_CR4_VMXE);
++}
++
++static void hardware_disable(void)
++{
++ vmclear_local_loaded_vmcss();
++ kvm_cpu_vmxoff();
++}
++
++static __init int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt,
++ u32 msr, u32 *result)
++{
++ u32 vmx_msr_low, vmx_msr_high;
++ u32 ctl = ctl_min | ctl_opt;
++
++ rdmsr(msr, vmx_msr_low, vmx_msr_high);
++
++ ctl &= vmx_msr_high; /* bit == 0 in high word ==> must be zero */
++ ctl |= vmx_msr_low; /* bit == 1 in low word ==> must be one */
++
++ /* Ensure minimum (required) set of control bits are supported. */
++ if (ctl_min & ~ctl)
++ return -EIO;
++
++ *result = ctl;
++ return 0;
++}
++
++static __init bool allow_1_setting(u32 msr, u32 ctl)
++{
++ u32 vmx_msr_low, vmx_msr_high;
++
++ rdmsr(msr, vmx_msr_low, vmx_msr_high);
++ return vmx_msr_high & ctl;
++}
++
++static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf)
++{
++ u32 vmx_msr_low, vmx_msr_high;
++ u32 min, opt, min2, opt2;
++ u32 _pin_based_exec_control = 0;
++ u32 _cpu_based_exec_control = 0;
++ u32 _cpu_based_2nd_exec_control = 0;
++ u32 _vmexit_control = 0;
++ u32 _vmentry_control = 0;
++
++ memset(vmcs_conf, 0, sizeof(*vmcs_conf));
++ min = CPU_BASED_HLT_EXITING |
++#ifdef CONFIG_X86_64
++ CPU_BASED_CR8_LOAD_EXITING |
++ CPU_BASED_CR8_STORE_EXITING |
++#endif
++ CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_CR3_STORE_EXITING |
++ CPU_BASED_UNCOND_IO_EXITING |
++ CPU_BASED_MOV_DR_EXITING |
++ CPU_BASED_USE_TSC_OFFSETING |
++ CPU_BASED_MWAIT_EXITING |
++ CPU_BASED_MONITOR_EXITING |
++ CPU_BASED_INVLPG_EXITING |
++ CPU_BASED_RDPMC_EXITING;
++
++ opt = CPU_BASED_TPR_SHADOW |
++ CPU_BASED_USE_MSR_BITMAPS |
++ CPU_BASED_ACTIVATE_SECONDARY_CONTROLS;
++ if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PROCBASED_CTLS,
++ &_cpu_based_exec_control) < 0)
++ return -EIO;
++#ifdef CONFIG_X86_64
++ if ((_cpu_based_exec_control & CPU_BASED_TPR_SHADOW))
++ _cpu_based_exec_control &= ~CPU_BASED_CR8_LOAD_EXITING &
++ ~CPU_BASED_CR8_STORE_EXITING;
++#endif
++ if (_cpu_based_exec_control & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) {
++ min2 = 0;
++ opt2 = SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
++ SECONDARY_EXEC_WBINVD_EXITING |
++ SECONDARY_EXEC_ENABLE_VPID |
++ SECONDARY_EXEC_ENABLE_EPT |
++ SECONDARY_EXEC_UNRESTRICTED_GUEST |
++ SECONDARY_EXEC_PAUSE_LOOP_EXITING |
++ SECONDARY_EXEC_DESC |
++ SECONDARY_EXEC_RDTSCP |
++ SECONDARY_EXEC_ENABLE_INVPCID |
++ SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
++ SECONDARY_EXEC_SHADOW_VMCS |
++ SECONDARY_EXEC_XSAVES |
++ SECONDARY_EXEC_RDSEED_EXITING |
++ SECONDARY_EXEC_RDRAND_EXITING |
++ SECONDARY_EXEC_ENABLE_PML |
++ SECONDARY_EXEC_TSC_SCALING |
++ SECONDARY_EXEC_ENABLE_VMFUNC |
++ SECONDARY_EXEC_ENCLS_EXITING;
++ if (adjust_vmx_controls(min2, opt2,
++ MSR_IA32_VMX_PROCBASED_CTLS2,
++ &_cpu_based_2nd_exec_control) < 0)
++ return -EIO;
++ }
++#ifndef CONFIG_X86_64
++ if (!(_cpu_based_2nd_exec_control &
++ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES))
++ _cpu_based_exec_control &= ~CPU_BASED_TPR_SHADOW;
++#endif
++
++ if (!(_cpu_based_exec_control & CPU_BASED_TPR_SHADOW))
++ _cpu_based_2nd_exec_control &= ~(
++ SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
++
++ rdmsr_safe(MSR_IA32_VMX_EPT_VPID_CAP,
++ &vmx_capability.ept, &vmx_capability.vpid);
++
++ if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) {
++ /* CR3 accesses and invlpg don't need to cause VM Exits when EPT
++ enabled */
++ _cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_CR3_STORE_EXITING |
++ CPU_BASED_INVLPG_EXITING);
++ } else if (vmx_capability.ept) {
++ vmx_capability.ept = 0;
++ pr_warn_once("EPT CAP should not exist if not support "
++ "1-setting enable EPT VM-execution control\n");
++ }
++ if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_VPID) &&
++ vmx_capability.vpid) {
++ vmx_capability.vpid = 0;
++ pr_warn_once("VPID CAP should not exist if not support "
++ "1-setting enable VPID VM-execution control\n");
++ }
++
++ min = VM_EXIT_SAVE_DEBUG_CONTROLS | VM_EXIT_ACK_INTR_ON_EXIT;
++#ifdef CONFIG_X86_64
++ min |= VM_EXIT_HOST_ADDR_SPACE_SIZE;
++#endif
++ opt = VM_EXIT_SAVE_IA32_PAT | VM_EXIT_LOAD_IA32_PAT |
++ VM_EXIT_CLEAR_BNDCFGS;
++ if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_EXIT_CTLS,
++ &_vmexit_control) < 0)
++ return -EIO;
++
++ min = PIN_BASED_EXT_INTR_MASK | PIN_BASED_NMI_EXITING;
++ opt = PIN_BASED_VIRTUAL_NMIS | PIN_BASED_POSTED_INTR |
++ PIN_BASED_VMX_PREEMPTION_TIMER;
++ if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PINBASED_CTLS,
++ &_pin_based_exec_control) < 0)
++ return -EIO;
++
++ if (cpu_has_broken_vmx_preemption_timer())
++ _pin_based_exec_control &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
++ if (!(_cpu_based_2nd_exec_control &
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY))
++ _pin_based_exec_control &= ~PIN_BASED_POSTED_INTR;
++
++ min = VM_ENTRY_LOAD_DEBUG_CONTROLS;
++ opt = VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_BNDCFGS;
++ if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_ENTRY_CTLS,
++ &_vmentry_control) < 0)
++ return -EIO;
++
++ rdmsr(MSR_IA32_VMX_BASIC, vmx_msr_low, vmx_msr_high);
++
++ /* IA-32 SDM Vol 3B: VMCS size is never greater than 4kB. */
++ if ((vmx_msr_high & 0x1fff) > PAGE_SIZE)
++ return -EIO;
++
++#ifdef CONFIG_X86_64
++ /* IA-32 SDM Vol 3B: 64-bit CPUs always have VMX_BASIC_MSR[48]==0. */
++ if (vmx_msr_high & (1u<<16))
++ return -EIO;
++#endif
++
++ /* Require Write-Back (WB) memory type for VMCS accesses. */
++ if (((vmx_msr_high >> 18) & 15) != 6)
++ return -EIO;
++
++ vmcs_conf->size = vmx_msr_high & 0x1fff;
++ vmcs_conf->order = get_order(vmcs_conf->size);
++ vmcs_conf->basic_cap = vmx_msr_high & ~0x1fff;
++
++ vmcs_conf->revision_id = vmx_msr_low;
++
++ vmcs_conf->pin_based_exec_ctrl = _pin_based_exec_control;
++ vmcs_conf->cpu_based_exec_ctrl = _cpu_based_exec_control;
++ vmcs_conf->cpu_based_2nd_exec_ctrl = _cpu_based_2nd_exec_control;
++ vmcs_conf->vmexit_ctrl = _vmexit_control;
++ vmcs_conf->vmentry_ctrl = _vmentry_control;
++
++ if (static_branch_unlikely(&enable_evmcs))
++ evmcs_sanitize_exec_ctrls(vmcs_conf);
++
++ cpu_has_load_ia32_efer =
++ allow_1_setting(MSR_IA32_VMX_ENTRY_CTLS,
++ VM_ENTRY_LOAD_IA32_EFER)
++ && allow_1_setting(MSR_IA32_VMX_EXIT_CTLS,
++ VM_EXIT_LOAD_IA32_EFER);
++
++ cpu_has_load_perf_global_ctrl =
++ allow_1_setting(MSR_IA32_VMX_ENTRY_CTLS,
++ VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL)
++ && allow_1_setting(MSR_IA32_VMX_EXIT_CTLS,
++ VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL);
++
++ /*
++ * Some cpus support VM_ENTRY_(LOAD|SAVE)_IA32_PERF_GLOBAL_CTRL
++ * but due to errata below it can't be used. Workaround is to use
++ * msr load mechanism to switch IA32_PERF_GLOBAL_CTRL.
++ *
++ * VM Exit May Incorrectly Clear IA32_PERF_GLOBAL_CTRL [34:32]
++ *
++ * AAK155 (model 26)
++ * AAP115 (model 30)
++ * AAT100 (model 37)
++ * BC86,AAY89,BD102 (model 44)
++ * BA97 (model 46)
++ *
++ */
++ if (cpu_has_load_perf_global_ctrl && boot_cpu_data.x86 == 0x6) {
++ switch (boot_cpu_data.x86_model) {
++ case 26:
++ case 30:
++ case 37:
++ case 44:
++ case 46:
++ cpu_has_load_perf_global_ctrl = false;
++ printk_once(KERN_WARNING"kvm: VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL "
++ "does not work properly. Using workaround\n");
++ break;
++ default:
++ break;
++ }
++ }
++
++ return 0;
++}
++
++static struct vmcs *alloc_vmcs_cpu(bool shadow, int cpu)
++{
++ int node = cpu_to_node(cpu);
++ struct page *pages;
++ struct vmcs *vmcs;
++
++ pages = __alloc_pages_node(node, GFP_KERNEL, vmcs_config.order);
++ if (!pages)
++ return NULL;
++ vmcs = page_address(pages);
++ memset(vmcs, 0, vmcs_config.size);
++
++ /* KVM supports Enlightened VMCS v1 only */
++ if (static_branch_unlikely(&enable_evmcs))
++ vmcs->hdr.revision_id = KVM_EVMCS_VERSION;
++ else
++ vmcs->hdr.revision_id = vmcs_config.revision_id;
++
++ if (shadow)
++ vmcs->hdr.shadow_vmcs = 1;
++ return vmcs;
++}
++
++static void free_vmcs(struct vmcs *vmcs)
++{
++ free_pages((unsigned long)vmcs, vmcs_config.order);
++}
++
++/*
++ * Free a VMCS, but before that VMCLEAR it on the CPU where it was last loaded
++ */
++static void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
++{
++ if (!loaded_vmcs->vmcs)
++ return;
++ loaded_vmcs_clear(loaded_vmcs);
++ free_vmcs(loaded_vmcs->vmcs);
++ loaded_vmcs->vmcs = NULL;
++ if (loaded_vmcs->msr_bitmap)
++ free_page((unsigned long)loaded_vmcs->msr_bitmap);
++ WARN_ON(loaded_vmcs->shadow_vmcs != NULL);
++}
++
++static struct vmcs *alloc_vmcs(bool shadow)
++{
++ return alloc_vmcs_cpu(shadow, raw_smp_processor_id());
++}
++
++static int alloc_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
++{
++ loaded_vmcs->vmcs = alloc_vmcs(false);
++ if (!loaded_vmcs->vmcs)
++ return -ENOMEM;
++
++ loaded_vmcs->shadow_vmcs = NULL;
++ loaded_vmcs_init(loaded_vmcs);
++
++ if (cpu_has_vmx_msr_bitmap()) {
++ loaded_vmcs->msr_bitmap = (unsigned long *)__get_free_page(GFP_KERNEL);
++ if (!loaded_vmcs->msr_bitmap)
++ goto out_vmcs;
++ memset(loaded_vmcs->msr_bitmap, 0xff, PAGE_SIZE);
++
++ if (IS_ENABLED(CONFIG_HYPERV) &&
++ static_branch_unlikely(&enable_evmcs) &&
++ (ms_hyperv.nested_features & HV_X64_NESTED_MSR_BITMAP)) {
++ struct hv_enlightened_vmcs *evmcs =
++ (struct hv_enlightened_vmcs *)loaded_vmcs->vmcs;
++
++ evmcs->hv_enlightenments_control.msr_bitmap = 1;
++ }
++ }
++
++ memset(&loaded_vmcs->host_state, 0, sizeof(struct vmcs_host_state));
++
++ return 0;
++
++out_vmcs:
++ free_loaded_vmcs(loaded_vmcs);
++ return -ENOMEM;
++}
++
++static void free_kvm_area(void)
++{
++ int cpu;
++
++ for_each_possible_cpu(cpu) {
++ free_vmcs(per_cpu(vmxarea, cpu));
++ per_cpu(vmxarea, cpu) = NULL;
++ }
++}
++
++enum vmcs_field_width {
++ VMCS_FIELD_WIDTH_U16 = 0,
++ VMCS_FIELD_WIDTH_U64 = 1,
++ VMCS_FIELD_WIDTH_U32 = 2,
++ VMCS_FIELD_WIDTH_NATURAL_WIDTH = 3
++};
++
++static inline int vmcs_field_width(unsigned long field)
++{
++ if (0x1 & field) /* the *_HIGH fields are all 32 bit */
++ return VMCS_FIELD_WIDTH_U32;
++ return (field >> 13) & 0x3 ;
++}
++
++static inline int vmcs_field_readonly(unsigned long field)
++{
++ return (((field >> 10) & 0x3) == 1);
++}
++
++static void init_vmcs_shadow_fields(void)
++{
++ int i, j;
++
++ for (i = j = 0; i < max_shadow_read_only_fields; i++) {
++ u16 field = shadow_read_only_fields[i];
++ if (vmcs_field_width(field) == VMCS_FIELD_WIDTH_U64 &&
++ (i + 1 == max_shadow_read_only_fields ||
++ shadow_read_only_fields[i + 1] != field + 1))
++ pr_err("Missing field from shadow_read_only_field %x\n",
++ field + 1);
++
++ clear_bit(field, vmx_vmread_bitmap);
++#ifdef CONFIG_X86_64
++ if (field & 1)
++ continue;
++#endif
++ if (j < i)
++ shadow_read_only_fields[j] = field;
++ j++;
++ }
++ max_shadow_read_only_fields = j;
++
++ for (i = j = 0; i < max_shadow_read_write_fields; i++) {
++ u16 field = shadow_read_write_fields[i];
++ if (vmcs_field_width(field) == VMCS_FIELD_WIDTH_U64 &&
++ (i + 1 == max_shadow_read_write_fields ||
++ shadow_read_write_fields[i + 1] != field + 1))
++ pr_err("Missing field from shadow_read_write_field %x\n",
++ field + 1);
++
++ /*
++ * PML and the preemption timer can be emulated, but the
++ * processor cannot vmwrite to fields that don't exist
++ * on bare metal.
++ */
++ switch (field) {
++ case GUEST_PML_INDEX:
++ if (!cpu_has_vmx_pml())
++ continue;
++ break;
++ case VMX_PREEMPTION_TIMER_VALUE:
++ if (!cpu_has_vmx_preemption_timer())
++ continue;
++ break;
++ case GUEST_INTR_STATUS:
++ if (!cpu_has_vmx_apicv())
++ continue;
++ break;
++ default:
++ break;
++ }
++
++ clear_bit(field, vmx_vmwrite_bitmap);
++ clear_bit(field, vmx_vmread_bitmap);
++#ifdef CONFIG_X86_64
++ if (field & 1)
++ continue;
++#endif
++ if (j < i)
++ shadow_read_write_fields[j] = field;
++ j++;
++ }
++ max_shadow_read_write_fields = j;
++}
++
++static __init int alloc_kvm_area(void)
++{
++ int cpu;
++
++ for_each_possible_cpu(cpu) {
++ struct vmcs *vmcs;
++
++ vmcs = alloc_vmcs_cpu(false, cpu);
++ if (!vmcs) {
++ free_kvm_area();
++ return -ENOMEM;
++ }
++
++ /*
++ * When eVMCS is enabled, alloc_vmcs_cpu() sets
++ * vmcs->revision_id to KVM_EVMCS_VERSION instead of
++ * revision_id reported by MSR_IA32_VMX_BASIC.
++ *
++ * However, even though not explictly documented by
++ * TLFS, VMXArea passed as VMXON argument should
++ * still be marked with revision_id reported by
++ * physical CPU.
++ */
++ if (static_branch_unlikely(&enable_evmcs))
++ vmcs->hdr.revision_id = vmcs_config.revision_id;
++
++ per_cpu(vmxarea, cpu) = vmcs;
++ }
++ return 0;
++}
++
++static void fix_pmode_seg(struct kvm_vcpu *vcpu, int seg,
++ struct kvm_segment *save)
++{
++ if (!emulate_invalid_guest_state) {
++ /*
++ * CS and SS RPL should be equal during guest entry according
++ * to VMX spec, but in reality it is not always so. Since vcpu
++ * is in the middle of the transition from real mode to
++ * protected mode it is safe to assume that RPL 0 is a good
++ * default value.
++ */
++ if (seg == VCPU_SREG_CS || seg == VCPU_SREG_SS)
++ save->selector &= ~SEGMENT_RPL_MASK;
++ save->dpl = save->selector & SEGMENT_RPL_MASK;
++ save->s = 1;
++ }
++ vmx_set_segment(vcpu, save, seg);
++}
++
++static void enter_pmode(struct kvm_vcpu *vcpu)
++{
++ unsigned long flags;
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ /*
++ * Update real mode segment cache. It may be not up-to-date if sement
++ * register was written while vcpu was in a guest mode.
++ */
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_ES], VCPU_SREG_ES);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_DS], VCPU_SREG_DS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_FS], VCPU_SREG_FS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_GS], VCPU_SREG_GS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_SS], VCPU_SREG_SS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_CS], VCPU_SREG_CS);
++
++ vmx->rmode.vm86_active = 0;
++
++ vmx_segment_cache_clear(vmx);
++
++ vmx_set_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_TR], VCPU_SREG_TR);
++
++ flags = vmcs_readl(GUEST_RFLAGS);
++ flags &= RMODE_GUEST_OWNED_EFLAGS_BITS;
++ flags |= vmx->rmode.save_rflags & ~RMODE_GUEST_OWNED_EFLAGS_BITS;
++ vmcs_writel(GUEST_RFLAGS, flags);
++
++ vmcs_writel(GUEST_CR4, (vmcs_readl(GUEST_CR4) & ~X86_CR4_VME) |
++ (vmcs_readl(CR4_READ_SHADOW) & X86_CR4_VME));
++
++ update_exception_bitmap(vcpu);
++
++ fix_pmode_seg(vcpu, VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]);
++ fix_pmode_seg(vcpu, VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]);
++ fix_pmode_seg(vcpu, VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]);
++ fix_pmode_seg(vcpu, VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]);
++ fix_pmode_seg(vcpu, VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]);
++ fix_pmode_seg(vcpu, VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]);
++}
++
++static void fix_rmode_seg(int seg, struct kvm_segment *save)
++{
++ const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
++ struct kvm_segment var = *save;
++
++ var.dpl = 0x3;
++ if (seg == VCPU_SREG_CS)
++ var.type = 0x3;
++
++ if (!emulate_invalid_guest_state) {
++ var.selector = var.base >> 4;
++ var.base = var.base & 0xffff0;
++ var.limit = 0xffff;
++ var.g = 0;
++ var.db = 0;
++ var.present = 1;
++ var.s = 1;
++ var.l = 0;
++ var.unusable = 0;
++ var.type = 0x3;
++ var.avl = 0;
++ if (save->base & 0xf)
++ printk_once(KERN_WARNING "kvm: segment base is not "
++ "paragraph aligned when entering "
++ "protected mode (seg=%d)", seg);
++ }
++
++ vmcs_write16(sf->selector, var.selector);
++ vmcs_writel(sf->base, var.base);
++ vmcs_write32(sf->limit, var.limit);
++ vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(&var));
++}
++
++static void enter_rmode(struct kvm_vcpu *vcpu)
++{
++ unsigned long flags;
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct kvm_vmx *kvm_vmx = to_kvm_vmx(vcpu->kvm);
++
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_TR], VCPU_SREG_TR);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_ES], VCPU_SREG_ES);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_DS], VCPU_SREG_DS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_FS], VCPU_SREG_FS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_GS], VCPU_SREG_GS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_SS], VCPU_SREG_SS);
++ vmx_get_segment(vcpu, &vmx->rmode.segs[VCPU_SREG_CS], VCPU_SREG_CS);
++
++ vmx->rmode.vm86_active = 1;
++
++ /*
++ * Very old userspace does not call KVM_SET_TSS_ADDR before entering
++ * vcpu. Warn the user that an update is overdue.
++ */
++ if (!kvm_vmx->tss_addr)
++ printk_once(KERN_WARNING "kvm: KVM_SET_TSS_ADDR need to be "
++ "called before entering vcpu\n");
++
++ vmx_segment_cache_clear(vmx);
++
++ vmcs_writel(GUEST_TR_BASE, kvm_vmx->tss_addr);
++ vmcs_write32(GUEST_TR_LIMIT, RMODE_TSS_SIZE - 1);
++ vmcs_write32(GUEST_TR_AR_BYTES, 0x008b);
++
++ flags = vmcs_readl(GUEST_RFLAGS);
++ vmx->rmode.save_rflags = flags;
++
++ flags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
++
++ vmcs_writel(GUEST_RFLAGS, flags);
++ vmcs_writel(GUEST_CR4, vmcs_readl(GUEST_CR4) | X86_CR4_VME);
++ update_exception_bitmap(vcpu);
++
++ fix_rmode_seg(VCPU_SREG_SS, &vmx->rmode.segs[VCPU_SREG_SS]);
++ fix_rmode_seg(VCPU_SREG_CS, &vmx->rmode.segs[VCPU_SREG_CS]);
++ fix_rmode_seg(VCPU_SREG_ES, &vmx->rmode.segs[VCPU_SREG_ES]);
++ fix_rmode_seg(VCPU_SREG_DS, &vmx->rmode.segs[VCPU_SREG_DS]);
++ fix_rmode_seg(VCPU_SREG_GS, &vmx->rmode.segs[VCPU_SREG_GS]);
++ fix_rmode_seg(VCPU_SREG_FS, &vmx->rmode.segs[VCPU_SREG_FS]);
++
++ kvm_mmu_reset_context(vcpu);
++}
++
++static void vmx_set_efer(struct kvm_vcpu *vcpu, u64 efer)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct shared_msr_entry *msr = find_msr_entry(vmx, MSR_EFER);
++
++ if (!msr)
++ return;
++
++ vcpu->arch.efer = efer;
++ if (efer & EFER_LMA) {
++ vm_entry_controls_setbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
++ msr->data = efer;
++ } else {
++ vm_entry_controls_clearbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
++
++ msr->data = efer & ~EFER_LME;
++ }
++ setup_msrs(vmx);
++}
++
++#ifdef CONFIG_X86_64
++
++static void enter_lmode(struct kvm_vcpu *vcpu)
++{
++ u32 guest_tr_ar;
++
++ vmx_segment_cache_clear(to_vmx(vcpu));
++
++ guest_tr_ar = vmcs_read32(GUEST_TR_AR_BYTES);
++ if ((guest_tr_ar & VMX_AR_TYPE_MASK) != VMX_AR_TYPE_BUSY_64_TSS) {
++ pr_debug_ratelimited("%s: tss fixup for long mode. \n",
++ __func__);
++ vmcs_write32(GUEST_TR_AR_BYTES,
++ (guest_tr_ar & ~VMX_AR_TYPE_MASK)
++ | VMX_AR_TYPE_BUSY_64_TSS);
++ }
++ vmx_set_efer(vcpu, vcpu->arch.efer | EFER_LMA);
++}
++
++static void exit_lmode(struct kvm_vcpu *vcpu)
++{
++ vm_entry_controls_clearbit(to_vmx(vcpu), VM_ENTRY_IA32E_MODE);
++ vmx_set_efer(vcpu, vcpu->arch.efer & ~EFER_LMA);
++}
++
++#endif
++
++static inline void __vmx_flush_tlb(struct kvm_vcpu *vcpu, int vpid,
++ bool invalidate_gpa)
++{
++ if (enable_ept && (invalidate_gpa || !enable_vpid)) {
++ if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
++ return;
++ ept_sync_context(construct_eptp(vcpu, vcpu->arch.mmu.root_hpa));
++ } else {
++ vpid_sync_context(vpid);
++ }
++}
++
++static void vmx_flush_tlb(struct kvm_vcpu *vcpu, bool invalidate_gpa)
++{
++ __vmx_flush_tlb(vcpu, to_vmx(vcpu)->vpid, invalidate_gpa);
++}
++
++static void vmx_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t addr)
++{
++ int vpid = to_vmx(vcpu)->vpid;
++
++ if (!vpid_sync_vcpu_addr(vpid, addr))
++ vpid_sync_context(vpid);
++
++ /*
++ * If VPIDs are not supported or enabled, then the above is a no-op.
++ * But we don't really need a TLB flush in that case anyway, because
++ * each VM entry/exit includes an implicit flush when VPID is 0.
++ */
++}
++
++static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
++{
++ ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits;
++
++ vcpu->arch.cr0 &= ~cr0_guest_owned_bits;
++ vcpu->arch.cr0 |= vmcs_readl(GUEST_CR0) & cr0_guest_owned_bits;
++}
++
++static void vmx_decache_cr3(struct kvm_vcpu *vcpu)
++{
++ if (enable_unrestricted_guest || (enable_ept && is_paging(vcpu)))
++ vcpu->arch.cr3 = vmcs_readl(GUEST_CR3);
++ __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
++}
++
++static void vmx_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
++{
++ ulong cr4_guest_owned_bits = vcpu->arch.cr4_guest_owned_bits;
++
++ vcpu->arch.cr4 &= ~cr4_guest_owned_bits;
++ vcpu->arch.cr4 |= vmcs_readl(GUEST_CR4) & cr4_guest_owned_bits;
++}
++
++static void ept_load_pdptrs(struct kvm_vcpu *vcpu)
++{
++ struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
++
++ if (!test_bit(VCPU_EXREG_PDPTR,
++ (unsigned long *)&vcpu->arch.regs_dirty))
++ return;
++
++ if (is_pae_paging(vcpu)) {
++ vmcs_write64(GUEST_PDPTR0, mmu->pdptrs[0]);
++ vmcs_write64(GUEST_PDPTR1, mmu->pdptrs[1]);
++ vmcs_write64(GUEST_PDPTR2, mmu->pdptrs[2]);
++ vmcs_write64(GUEST_PDPTR3, mmu->pdptrs[3]);
++ }
++}
++
++static void ept_save_pdptrs(struct kvm_vcpu *vcpu)
++{
++ struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
++
++ if (is_pae_paging(vcpu)) {
++ mmu->pdptrs[0] = vmcs_read64(GUEST_PDPTR0);
++ mmu->pdptrs[1] = vmcs_read64(GUEST_PDPTR1);
++ mmu->pdptrs[2] = vmcs_read64(GUEST_PDPTR2);
++ mmu->pdptrs[3] = vmcs_read64(GUEST_PDPTR3);
++ }
++
++ __set_bit(VCPU_EXREG_PDPTR,
++ (unsigned long *)&vcpu->arch.regs_avail);
++ __set_bit(VCPU_EXREG_PDPTR,
++ (unsigned long *)&vcpu->arch.regs_dirty);
++}
++
++static bool nested_guest_cr0_valid(struct kvm_vcpu *vcpu, unsigned long val)
++{
++ u64 fixed0 = to_vmx(vcpu)->nested.msrs.cr0_fixed0;
++ u64 fixed1 = to_vmx(vcpu)->nested.msrs.cr0_fixed1;
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++
++ if (to_vmx(vcpu)->nested.msrs.secondary_ctls_high &
++ SECONDARY_EXEC_UNRESTRICTED_GUEST &&
++ nested_cpu_has2(vmcs12, SECONDARY_EXEC_UNRESTRICTED_GUEST))
++ fixed0 &= ~(X86_CR0_PE | X86_CR0_PG);
++
++ return fixed_bits_valid(val, fixed0, fixed1);
++}
++
++static bool nested_host_cr0_valid(struct kvm_vcpu *vcpu, unsigned long val)
++{
++ u64 fixed0 = to_vmx(vcpu)->nested.msrs.cr0_fixed0;
++ u64 fixed1 = to_vmx(vcpu)->nested.msrs.cr0_fixed1;
++
++ return fixed_bits_valid(val, fixed0, fixed1);
++}
++
++static bool nested_cr4_valid(struct kvm_vcpu *vcpu, unsigned long val)
++{
++ u64 fixed0 = to_vmx(vcpu)->nested.msrs.cr4_fixed0;
++ u64 fixed1 = to_vmx(vcpu)->nested.msrs.cr4_fixed1;
++
++ return fixed_bits_valid(val, fixed0, fixed1);
++}
++
++/* No difference in the restrictions on guest and host CR4 in VMX operation. */
++#define nested_guest_cr4_valid nested_cr4_valid
++#define nested_host_cr4_valid nested_cr4_valid
++
++static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4);
++
++static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
++ unsigned long cr0,
++ struct kvm_vcpu *vcpu)
++{
++ if (!test_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail))
++ vmx_decache_cr3(vcpu);
++ if (!(cr0 & X86_CR0_PG)) {
++ /* From paging/starting to nonpaging */
++ vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
++ vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) |
++ (CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_CR3_STORE_EXITING));
++ vcpu->arch.cr0 = cr0;
++ vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
++ } else if (!is_paging(vcpu)) {
++ /* From nonpaging to paging */
++ vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
++ vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
++ ~(CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_CR3_STORE_EXITING));
++ vcpu->arch.cr0 = cr0;
++ vmx_set_cr4(vcpu, kvm_read_cr4(vcpu));
++ }
++
++ if (!(cr0 & X86_CR0_WP))
++ *hw_cr0 &= ~X86_CR0_WP;
++}
++
++static void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long hw_cr0;
++
++ hw_cr0 = (cr0 & ~KVM_GUEST_CR0_MASK);
++ if (enable_unrestricted_guest)
++ hw_cr0 |= KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST;
++ else {
++ hw_cr0 |= KVM_VM_CR0_ALWAYS_ON;
++
++ if (vmx->rmode.vm86_active && (cr0 & X86_CR0_PE))
++ enter_pmode(vcpu);
++
++ if (!vmx->rmode.vm86_active && !(cr0 & X86_CR0_PE))
++ enter_rmode(vcpu);
++ }
++
++#ifdef CONFIG_X86_64
++ if (vcpu->arch.efer & EFER_LME) {
++ if (!is_paging(vcpu) && (cr0 & X86_CR0_PG))
++ enter_lmode(vcpu);
++ if (is_paging(vcpu) && !(cr0 & X86_CR0_PG))
++ exit_lmode(vcpu);
++ }
++#endif
++
++ if (enable_ept && !enable_unrestricted_guest)
++ ept_update_paging_mode_cr0(&hw_cr0, cr0, vcpu);
++
++ vmcs_writel(CR0_READ_SHADOW, cr0);
++ vmcs_writel(GUEST_CR0, hw_cr0);
++ vcpu->arch.cr0 = cr0;
++
++ /* depends on vcpu->arch.cr0 to be set to a new value */
++ vmx->emulation_required = emulation_required(vcpu);
++}
++
++static int get_ept_level(struct kvm_vcpu *vcpu)
++{
++ /* Nested EPT currently only supports 4-level walks. */
++ if (is_guest_mode(vcpu) && nested_cpu_has_ept(get_vmcs12(vcpu)))
++ return 4;
++ if (cpu_has_vmx_ept_5levels() && (cpuid_maxphyaddr(vcpu) > 48))
++ return 5;
++ return 4;
++}
++
++static u64 construct_eptp(struct kvm_vcpu *vcpu, unsigned long root_hpa)
++{
++ u64 eptp = VMX_EPTP_MT_WB;
++
++ eptp |= (get_ept_level(vcpu) == 5) ? VMX_EPTP_PWL_5 : VMX_EPTP_PWL_4;
++
++ if (enable_ept_ad_bits &&
++ (!is_guest_mode(vcpu) || nested_ept_ad_enabled(vcpu)))
++ eptp |= VMX_EPTP_AD_ENABLE_BIT;
++ eptp |= (root_hpa & PAGE_MASK);
++
++ return eptp;
++}
++
++static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
++{
++ struct kvm *kvm = vcpu->kvm;
++ unsigned long guest_cr3;
++ u64 eptp;
++
++ guest_cr3 = cr3;
++ if (enable_ept) {
++ eptp = construct_eptp(vcpu, cr3);
++ vmcs_write64(EPT_POINTER, eptp);
++
++ if (kvm_x86_ops->tlb_remote_flush) {
++ spin_lock(&to_kvm_vmx(kvm)->ept_pointer_lock);
++ to_vmx(vcpu)->ept_pointer = eptp;
++ to_kvm_vmx(kvm)->ept_pointers_match
++ = EPT_POINTERS_CHECK;
++ spin_unlock(&to_kvm_vmx(kvm)->ept_pointer_lock);
++ }
++
++ if (enable_unrestricted_guest || is_paging(vcpu) ||
++ is_guest_mode(vcpu))
++ guest_cr3 = kvm_read_cr3(vcpu);
++ else
++ guest_cr3 = to_kvm_vmx(kvm)->ept_identity_map_addr;
++ ept_load_pdptrs(vcpu);
++ }
++
++ vmcs_writel(GUEST_CR3, guest_cr3);
++}
++
++static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
++{
++ /*
++ * Pass through host's Machine Check Enable value to hw_cr4, which
++ * is in force while we are in guest mode. Do not let guests control
++ * this bit, even if host CR4.MCE == 0.
++ */
++ unsigned long hw_cr4;
++
++ hw_cr4 = (cr4_read_shadow() & X86_CR4_MCE) | (cr4 & ~X86_CR4_MCE);
++ if (enable_unrestricted_guest)
++ hw_cr4 |= KVM_VM_CR4_ALWAYS_ON_UNRESTRICTED_GUEST;
++ else if (to_vmx(vcpu)->rmode.vm86_active)
++ hw_cr4 |= KVM_RMODE_VM_CR4_ALWAYS_ON;
++ else
++ hw_cr4 |= KVM_PMODE_VM_CR4_ALWAYS_ON;
++
++ if (!boot_cpu_has(X86_FEATURE_UMIP) && vmx_umip_emulated()) {
++ if (cr4 & X86_CR4_UMIP) {
++ vmcs_set_bits(SECONDARY_VM_EXEC_CONTROL,
++ SECONDARY_EXEC_DESC);
++ hw_cr4 &= ~X86_CR4_UMIP;
++ } else if (!is_guest_mode(vcpu) ||
++ !nested_cpu_has2(get_vmcs12(vcpu), SECONDARY_EXEC_DESC))
++ vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL,
++ SECONDARY_EXEC_DESC);
++ }
++
++ if (cr4 & X86_CR4_VMXE) {
++ /*
++ * To use VMXON (and later other VMX instructions), a guest
++ * must first be able to turn on cr4.VMXE (see handle_vmon()).
++ * So basically the check on whether to allow nested VMX
++ * is here. We operate under the default treatment of SMM,
++ * so VMX cannot be enabled under SMM.
++ */
++ if (!nested_vmx_allowed(vcpu) || is_smm(vcpu))
++ return 1;
++ }
++
++ if (to_vmx(vcpu)->nested.vmxon && !nested_cr4_valid(vcpu, cr4))
++ return 1;
++
++ vcpu->arch.cr4 = cr4;
++
++ if (!enable_unrestricted_guest) {
++ if (enable_ept) {
++ if (!is_paging(vcpu)) {
++ hw_cr4 &= ~X86_CR4_PAE;
++ hw_cr4 |= X86_CR4_PSE;
++ } else if (!(cr4 & X86_CR4_PAE)) {
++ hw_cr4 &= ~X86_CR4_PAE;
++ }
++ }
++
++ /*
++ * SMEP/SMAP/PKU is disabled if CPU is in non-paging mode in
++ * hardware. To emulate this behavior, SMEP/SMAP/PKU needs
++ * to be manually disabled when guest switches to non-paging
++ * mode.
++ *
++ * If !enable_unrestricted_guest, the CPU is always running
++ * with CR0.PG=1 and CR4 needs to be modified.
++ * If enable_unrestricted_guest, the CPU automatically
++ * disables SMEP/SMAP/PKU when the guest sets CR0.PG=0.
++ */
++ if (!is_paging(vcpu))
++ hw_cr4 &= ~(X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE);
++ }
++
++ vmcs_writel(CR4_READ_SHADOW, cr4);
++ vmcs_writel(GUEST_CR4, hw_cr4);
++ return 0;
++}
++
++static void vmx_get_segment(struct kvm_vcpu *vcpu,
++ struct kvm_segment *var, int seg)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 ar;
++
++ if (vmx->rmode.vm86_active && seg != VCPU_SREG_LDTR) {
++ *var = vmx->rmode.segs[seg];
++ if (seg == VCPU_SREG_TR
++ || var->selector == vmx_read_guest_seg_selector(vmx, seg))
++ return;
++ var->base = vmx_read_guest_seg_base(vmx, seg);
++ var->selector = vmx_read_guest_seg_selector(vmx, seg);
++ return;
++ }
++ var->base = vmx_read_guest_seg_base(vmx, seg);
++ var->limit = vmx_read_guest_seg_limit(vmx, seg);
++ var->selector = vmx_read_guest_seg_selector(vmx, seg);
++ ar = vmx_read_guest_seg_ar(vmx, seg);
++ var->unusable = (ar >> 16) & 1;
++ var->type = ar & 15;
++ var->s = (ar >> 4) & 1;
++ var->dpl = (ar >> 5) & 3;
++ /*
++ * Some userspaces do not preserve unusable property. Since usable
++ * segment has to be present according to VMX spec we can use present
++ * property to amend userspace bug by making unusable segment always
++ * nonpresent. vmx_segment_access_rights() already marks nonpresent
++ * segment as unusable.
++ */
++ var->present = !var->unusable;
++ var->avl = (ar >> 12) & 1;
++ var->l = (ar >> 13) & 1;
++ var->db = (ar >> 14) & 1;
++ var->g = (ar >> 15) & 1;
++}
++
++static u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg)
++{
++ struct kvm_segment s;
++
++ if (to_vmx(vcpu)->rmode.vm86_active) {
++ vmx_get_segment(vcpu, &s, seg);
++ return s.base;
++ }
++ return vmx_read_guest_seg_base(to_vmx(vcpu), seg);
++}
++
++static int vmx_get_cpl(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (unlikely(vmx->rmode.vm86_active))
++ return 0;
++ else {
++ int ar = vmx_read_guest_seg_ar(vmx, VCPU_SREG_SS);
++ return VMX_AR_DPL(ar);
++ }
++}
++
++static u32 vmx_segment_access_rights(struct kvm_segment *var)
++{
++ u32 ar;
++
++ ar = var->type & 15;
++ ar |= (var->s & 1) << 4;
++ ar |= (var->dpl & 3) << 5;
++ ar |= (var->present & 1) << 7;
++ ar |= (var->avl & 1) << 12;
++ ar |= (var->l & 1) << 13;
++ ar |= (var->db & 1) << 14;
++ ar |= (var->g & 1) << 15;
++ ar |= (var->unusable || !var->present) << 16;
++
++ return ar;
++}
++
++static void vmx_set_segment(struct kvm_vcpu *vcpu,
++ struct kvm_segment *var, int seg)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
++
++ vmx_segment_cache_clear(vmx);
++
++ if (vmx->rmode.vm86_active && seg != VCPU_SREG_LDTR) {
++ vmx->rmode.segs[seg] = *var;
++ if (seg == VCPU_SREG_TR)
++ vmcs_write16(sf->selector, var->selector);
++ else if (var->s)
++ fix_rmode_seg(seg, &vmx->rmode.segs[seg]);
++ goto out;
++ }
++
++ vmcs_writel(sf->base, var->base);
++ vmcs_write32(sf->limit, var->limit);
++ vmcs_write16(sf->selector, var->selector);
++
++ /*
++ * Fix the "Accessed" bit in AR field of segment registers for older
++ * qemu binaries.
++ * IA32 arch specifies that at the time of processor reset the
++ * "Accessed" bit in the AR field of segment registers is 1. And qemu
++ * is setting it to 0 in the userland code. This causes invalid guest
++ * state vmexit when "unrestricted guest" mode is turned on.
++ * Fix for this setup issue in cpu_reset is being pushed in the qemu
++ * tree. Newer qemu binaries with that qemu fix would not need this
++ * kvm hack.
++ */
++ if (enable_unrestricted_guest && (seg != VCPU_SREG_LDTR))
++ var->type |= 0x1; /* Accessed */
++
++ vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(var));
++
++out:
++ vmx->emulation_required = emulation_required(vcpu);
++}
++
++static void vmx_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
++{
++ u32 ar = vmx_read_guest_seg_ar(to_vmx(vcpu), VCPU_SREG_CS);
++
++ *db = (ar >> 14) & 1;
++ *l = (ar >> 13) & 1;
++}
++
++static void vmx_get_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
++{
++ dt->size = vmcs_read32(GUEST_IDTR_LIMIT);
++ dt->address = vmcs_readl(GUEST_IDTR_BASE);
++}
++
++static void vmx_set_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
++{
++ vmcs_write32(GUEST_IDTR_LIMIT, dt->size);
++ vmcs_writel(GUEST_IDTR_BASE, dt->address);
++}
++
++static void vmx_get_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
++{
++ dt->size = vmcs_read32(GUEST_GDTR_LIMIT);
++ dt->address = vmcs_readl(GUEST_GDTR_BASE);
++}
++
++static void vmx_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt)
++{
++ vmcs_write32(GUEST_GDTR_LIMIT, dt->size);
++ vmcs_writel(GUEST_GDTR_BASE, dt->address);
++}
++
++static bool rmode_segment_valid(struct kvm_vcpu *vcpu, int seg)
++{
++ struct kvm_segment var;
++ u32 ar;
++
++ vmx_get_segment(vcpu, &var, seg);
++ var.dpl = 0x3;
++ if (seg == VCPU_SREG_CS)
++ var.type = 0x3;
++ ar = vmx_segment_access_rights(&var);
++
++ if (var.base != (var.selector << 4))
++ return false;
++ if (var.limit != 0xffff)
++ return false;
++ if (ar != 0xf3)
++ return false;
++
++ return true;
++}
++
++static bool code_segment_valid(struct kvm_vcpu *vcpu)
++{
++ struct kvm_segment cs;
++ unsigned int cs_rpl;
++
++ vmx_get_segment(vcpu, &cs, VCPU_SREG_CS);
++ cs_rpl = cs.selector & SEGMENT_RPL_MASK;
++
++ if (cs.unusable)
++ return false;
++ if (~cs.type & (VMX_AR_TYPE_CODE_MASK|VMX_AR_TYPE_ACCESSES_MASK))
++ return false;
++ if (!cs.s)
++ return false;
++ if (cs.type & VMX_AR_TYPE_WRITEABLE_MASK) {
++ if (cs.dpl > cs_rpl)
++ return false;
++ } else {
++ if (cs.dpl != cs_rpl)
++ return false;
++ }
++ if (!cs.present)
++ return false;
++
++ /* TODO: Add Reserved field check, this'll require a new member in the kvm_segment_field structure */
++ return true;
++}
++
++static bool stack_segment_valid(struct kvm_vcpu *vcpu)
++{
++ struct kvm_segment ss;
++ unsigned int ss_rpl;
++
++ vmx_get_segment(vcpu, &ss, VCPU_SREG_SS);
++ ss_rpl = ss.selector & SEGMENT_RPL_MASK;
++
++ if (ss.unusable)
++ return true;
++ if (ss.type != 3 && ss.type != 7)
++ return false;
++ if (!ss.s)
++ return false;
++ if (ss.dpl != ss_rpl) /* DPL != RPL */
++ return false;
++ if (!ss.present)
++ return false;
++
++ return true;
++}
++
++static bool data_segment_valid(struct kvm_vcpu *vcpu, int seg)
++{
++ struct kvm_segment var;
++ unsigned int rpl;
++
++ vmx_get_segment(vcpu, &var, seg);
++ rpl = var.selector & SEGMENT_RPL_MASK;
++
++ if (var.unusable)
++ return true;
++ if (!var.s)
++ return false;
++ if (!var.present)
++ return false;
++ if (~var.type & (VMX_AR_TYPE_CODE_MASK|VMX_AR_TYPE_WRITEABLE_MASK)) {
++ if (var.dpl < rpl) /* DPL < RPL */
++ return false;
++ }
++
++ /* TODO: Add other members to kvm_segment_field to allow checking for other access
++ * rights flags
++ */
++ return true;
++}
++
++static bool tr_valid(struct kvm_vcpu *vcpu)
++{
++ struct kvm_segment tr;
++
++ vmx_get_segment(vcpu, &tr, VCPU_SREG_TR);
++
++ if (tr.unusable)
++ return false;
++ if (tr.selector & SEGMENT_TI_MASK) /* TI = 1 */
++ return false;
++ if (tr.type != 3 && tr.type != 11) /* TODO: Check if guest is in IA32e mode */
++ return false;
++ if (!tr.present)
++ return false;
++
++ return true;
++}
++
++static bool ldtr_valid(struct kvm_vcpu *vcpu)
++{
++ struct kvm_segment ldtr;
++
++ vmx_get_segment(vcpu, &ldtr, VCPU_SREG_LDTR);
++
++ if (ldtr.unusable)
++ return true;
++ if (ldtr.selector & SEGMENT_TI_MASK) /* TI = 1 */
++ return false;
++ if (ldtr.type != 2)
++ return false;
++ if (!ldtr.present)
++ return false;
++
++ return true;
++}
++
++static bool cs_ss_rpl_check(struct kvm_vcpu *vcpu)
++{
++ struct kvm_segment cs, ss;
++
++ vmx_get_segment(vcpu, &cs, VCPU_SREG_CS);
++ vmx_get_segment(vcpu, &ss, VCPU_SREG_SS);
++
++ return ((cs.selector & SEGMENT_RPL_MASK) ==
++ (ss.selector & SEGMENT_RPL_MASK));
++}
++
++static bool nested_vmx_check_io_bitmaps(struct kvm_vcpu *vcpu,
++ unsigned int port, int size);
++static bool nested_vmx_exit_handled_io(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ unsigned long exit_qualification;
++ unsigned short port;
++ int size;
++
++ if (!nested_cpu_has(vmcs12, CPU_BASED_USE_IO_BITMAPS))
++ return nested_cpu_has(vmcs12, CPU_BASED_UNCOND_IO_EXITING);
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++
++ port = exit_qualification >> 16;
++ size = (exit_qualification & 7) + 1;
++
++ return nested_vmx_check_io_bitmaps(vcpu, port, size);
++}
++
++/*
++ * Check if guest state is valid. Returns true if valid, false if
++ * not.
++ * We assume that registers are always usable
++ */
++static bool guest_state_valid(struct kvm_vcpu *vcpu)
++{
++ if (enable_unrestricted_guest)
++ return true;
++
++ /* real mode guest state checks */
++ if (!is_protmode(vcpu) || (vmx_get_rflags(vcpu) & X86_EFLAGS_VM)) {
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_CS))
++ return false;
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_SS))
++ return false;
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_DS))
++ return false;
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_ES))
++ return false;
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_FS))
++ return false;
++ if (!rmode_segment_valid(vcpu, VCPU_SREG_GS))
++ return false;
++ } else {
++ /* protected mode guest state checks */
++ if (!cs_ss_rpl_check(vcpu))
++ return false;
++ if (!code_segment_valid(vcpu))
++ return false;
++ if (!stack_segment_valid(vcpu))
++ return false;
++ if (!data_segment_valid(vcpu, VCPU_SREG_DS))
++ return false;
++ if (!data_segment_valid(vcpu, VCPU_SREG_ES))
++ return false;
++ if (!data_segment_valid(vcpu, VCPU_SREG_FS))
++ return false;
++ if (!data_segment_valid(vcpu, VCPU_SREG_GS))
++ return false;
++ if (!tr_valid(vcpu))
++ return false;
++ if (!ldtr_valid(vcpu))
++ return false;
++ }
++ /* TODO:
++ * - Add checks on RIP
++ * - Add checks on RFLAGS
++ */
++
++ return true;
++}
++
++static bool page_address_valid(struct kvm_vcpu *vcpu, gpa_t gpa)
++{
++ return PAGE_ALIGNED(gpa) && !(gpa >> cpuid_maxphyaddr(vcpu));
++}
++
++static int init_rmode_tss(struct kvm *kvm)
++{
++ gfn_t fn;
++ u16 data = 0;
++ int idx, r;
++
++ idx = srcu_read_lock(&kvm->srcu);
++ fn = to_kvm_vmx(kvm)->tss_addr >> PAGE_SHIFT;
++ r = kvm_clear_guest_page(kvm, fn, 0, PAGE_SIZE);
++ if (r < 0)
++ goto out;
++ data = TSS_BASE_SIZE + TSS_REDIRECTION_SIZE;
++ r = kvm_write_guest_page(kvm, fn++, &data,
++ TSS_IOPB_BASE_OFFSET, sizeof(u16));
++ if (r < 0)
++ goto out;
++ r = kvm_clear_guest_page(kvm, fn++, 0, PAGE_SIZE);
++ if (r < 0)
++ goto out;
++ r = kvm_clear_guest_page(kvm, fn, 0, PAGE_SIZE);
++ if (r < 0)
++ goto out;
++ data = ~0;
++ r = kvm_write_guest_page(kvm, fn, &data,
++ RMODE_TSS_SIZE - 2 * PAGE_SIZE - 1,
++ sizeof(u8));
++out:
++ srcu_read_unlock(&kvm->srcu, idx);
++ return r;
++}
++
++static int init_rmode_identity_map(struct kvm *kvm)
++{
++ struct kvm_vmx *kvm_vmx = to_kvm_vmx(kvm);
++ int i, idx, r = 0;
++ kvm_pfn_t identity_map_pfn;
++ u32 tmp;
++
++ /* Protect kvm_vmx->ept_identity_pagetable_done. */
++ mutex_lock(&kvm->slots_lock);
++
++ if (likely(kvm_vmx->ept_identity_pagetable_done))
++ goto out2;
++
++ if (!kvm_vmx->ept_identity_map_addr)
++ kvm_vmx->ept_identity_map_addr = VMX_EPT_IDENTITY_PAGETABLE_ADDR;
++ identity_map_pfn = kvm_vmx->ept_identity_map_addr >> PAGE_SHIFT;
++
++ r = __x86_set_memory_region(kvm, IDENTITY_PAGETABLE_PRIVATE_MEMSLOT,
++ kvm_vmx->ept_identity_map_addr, PAGE_SIZE);
++ if (r < 0)
++ goto out2;
++
++ idx = srcu_read_lock(&kvm->srcu);
++ r = kvm_clear_guest_page(kvm, identity_map_pfn, 0, PAGE_SIZE);
++ if (r < 0)
++ goto out;
++ /* Set up identity-mapping pagetable for EPT in real mode */
++ for (i = 0; i < PT32_ENT_PER_PAGE; i++) {
++ tmp = (i << 22) + (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER |
++ _PAGE_ACCESSED | _PAGE_DIRTY | _PAGE_PSE);
++ r = kvm_write_guest_page(kvm, identity_map_pfn,
++ &tmp, i * sizeof(tmp), sizeof(tmp));
++ if (r < 0)
++ goto out;
++ }
++ kvm_vmx->ept_identity_pagetable_done = true;
++
++out:
++ srcu_read_unlock(&kvm->srcu, idx);
++
++out2:
++ mutex_unlock(&kvm->slots_lock);
++ return r;
++}
++
++static void seg_setup(int seg)
++{
++ const struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
++ unsigned int ar;
++
++ vmcs_write16(sf->selector, 0);
++ vmcs_writel(sf->base, 0);
++ vmcs_write32(sf->limit, 0xffff);
++ ar = 0x93;
++ if (seg == VCPU_SREG_CS)
++ ar |= 0x08; /* code segment */
++
++ vmcs_write32(sf->ar_bytes, ar);
++}
++
++static int alloc_apic_access_page(struct kvm *kvm)
++{
++ struct page *page;
++ int r = 0;
++
++ mutex_lock(&kvm->slots_lock);
++ if (kvm->arch.apic_access_page_done)
++ goto out;
++ r = __x86_set_memory_region(kvm, APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
++ APIC_DEFAULT_PHYS_BASE, PAGE_SIZE);
++ if (r)
++ goto out;
++
++ page = gfn_to_page(kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT);
++ if (is_error_page(page)) {
++ r = -EFAULT;
++ goto out;
++ }
++
++ /*
++ * Do not pin the page in memory, so that memory hot-unplug
++ * is able to migrate it.
++ */
++ put_page(page);
++ kvm->arch.apic_access_page_done = true;
++out:
++ mutex_unlock(&kvm->slots_lock);
++ return r;
++}
++
++static int allocate_vpid(void)
++{
++ int vpid;
++
++ if (!enable_vpid)
++ return 0;
++ spin_lock(&vmx_vpid_lock);
++ vpid = find_first_zero_bit(vmx_vpid_bitmap, VMX_NR_VPIDS);
++ if (vpid < VMX_NR_VPIDS)
++ __set_bit(vpid, vmx_vpid_bitmap);
++ else
++ vpid = 0;
++ spin_unlock(&vmx_vpid_lock);
++ return vpid;
++}
++
++static void free_vpid(int vpid)
++{
++ if (!enable_vpid || vpid == 0)
++ return;
++ spin_lock(&vmx_vpid_lock);
++ __clear_bit(vpid, vmx_vpid_bitmap);
++ spin_unlock(&vmx_vpid_lock);
++}
++
++static __always_inline void vmx_disable_intercept_for_msr(unsigned long *msr_bitmap,
++ u32 msr, int type)
++{
++ int f = sizeof(unsigned long);
++
++ if (!cpu_has_vmx_msr_bitmap())
++ return;
++
++ if (static_branch_unlikely(&enable_evmcs))
++ evmcs_touch_msr_bitmap();
++
++ /*
++ * See Intel PRM Vol. 3, 20.6.9 (MSR-Bitmap Address). Early manuals
++ * have the write-low and read-high bitmap offsets the wrong way round.
++ * We can control MSRs 0x00000000-0x00001fff and 0xc0000000-0xc0001fff.
++ */
++ if (msr <= 0x1fff) {
++ if (type & MSR_TYPE_R)
++ /* read-low */
++ __clear_bit(msr, msr_bitmap + 0x000 / f);
++
++ if (type & MSR_TYPE_W)
++ /* write-low */
++ __clear_bit(msr, msr_bitmap + 0x800 / f);
++
++ } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
++ msr &= 0x1fff;
++ if (type & MSR_TYPE_R)
++ /* read-high */
++ __clear_bit(msr, msr_bitmap + 0x400 / f);
++
++ if (type & MSR_TYPE_W)
++ /* write-high */
++ __clear_bit(msr, msr_bitmap + 0xc00 / f);
++
++ }
++}
++
++static __always_inline void vmx_enable_intercept_for_msr(unsigned long *msr_bitmap,
++ u32 msr, int type)
++{
++ int f = sizeof(unsigned long);
++
++ if (!cpu_has_vmx_msr_bitmap())
++ return;
++
++ if (static_branch_unlikely(&enable_evmcs))
++ evmcs_touch_msr_bitmap();
++
++ /*
++ * See Intel PRM Vol. 3, 20.6.9 (MSR-Bitmap Address). Early manuals
++ * have the write-low and read-high bitmap offsets the wrong way round.
++ * We can control MSRs 0x00000000-0x00001fff and 0xc0000000-0xc0001fff.
++ */
++ if (msr <= 0x1fff) {
++ if (type & MSR_TYPE_R)
++ /* read-low */
++ __set_bit(msr, msr_bitmap + 0x000 / f);
++
++ if (type & MSR_TYPE_W)
++ /* write-low */
++ __set_bit(msr, msr_bitmap + 0x800 / f);
++
++ } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
++ msr &= 0x1fff;
++ if (type & MSR_TYPE_R)
++ /* read-high */
++ __set_bit(msr, msr_bitmap + 0x400 / f);
++
++ if (type & MSR_TYPE_W)
++ /* write-high */
++ __set_bit(msr, msr_bitmap + 0xc00 / f);
++
++ }
++}
++
++static __always_inline void vmx_set_intercept_for_msr(unsigned long *msr_bitmap,
++ u32 msr, int type, bool value)
++{
++ if (value)
++ vmx_enable_intercept_for_msr(msr_bitmap, msr, type);
++ else
++ vmx_disable_intercept_for_msr(msr_bitmap, msr, type);
++}
++
++/*
++ * If a msr is allowed by L0, we should check whether it is allowed by L1.
++ * The corresponding bit will be cleared unless both of L0 and L1 allow it.
++ */
++static void nested_vmx_disable_intercept_for_msr(unsigned long *msr_bitmap_l1,
++ unsigned long *msr_bitmap_nested,
++ u32 msr, int type)
++{
++ int f = sizeof(unsigned long);
++
++ /*
++ * See Intel PRM Vol. 3, 20.6.9 (MSR-Bitmap Address). Early manuals
++ * have the write-low and read-high bitmap offsets the wrong way round.
++ * We can control MSRs 0x00000000-0x00001fff and 0xc0000000-0xc0001fff.
++ */
++ if (msr <= 0x1fff) {
++ if (type & MSR_TYPE_R &&
++ !test_bit(msr, msr_bitmap_l1 + 0x000 / f))
++ /* read-low */
++ __clear_bit(msr, msr_bitmap_nested + 0x000 / f);
++
++ if (type & MSR_TYPE_W &&
++ !test_bit(msr, msr_bitmap_l1 + 0x800 / f))
++ /* write-low */
++ __clear_bit(msr, msr_bitmap_nested + 0x800 / f);
++
++ } else if ((msr >= 0xc0000000) && (msr <= 0xc0001fff)) {
++ msr &= 0x1fff;
++ if (type & MSR_TYPE_R &&
++ !test_bit(msr, msr_bitmap_l1 + 0x400 / f))
++ /* read-high */
++ __clear_bit(msr, msr_bitmap_nested + 0x400 / f);
++
++ if (type & MSR_TYPE_W &&
++ !test_bit(msr, msr_bitmap_l1 + 0xc00 / f))
++ /* write-high */
++ __clear_bit(msr, msr_bitmap_nested + 0xc00 / f);
++
++ }
++}
++
++static u8 vmx_msr_bitmap_mode(struct kvm_vcpu *vcpu)
++{
++ u8 mode = 0;
++
++ if (cpu_has_secondary_exec_ctrls() &&
++ (vmcs_read32(SECONDARY_VM_EXEC_CONTROL) &
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE)) {
++ mode |= MSR_BITMAP_MODE_X2APIC;
++ if (enable_apicv && kvm_vcpu_apicv_active(vcpu))
++ mode |= MSR_BITMAP_MODE_X2APIC_APICV;
++ }
++
++ return mode;
++}
++
++#define X2APIC_MSR(r) (APIC_BASE_MSR + ((r) >> 4))
++
++static void vmx_update_msr_bitmap_x2apic(unsigned long *msr_bitmap,
++ u8 mode)
++{
++ int msr;
++
++ for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
++ unsigned word = msr / BITS_PER_LONG;
++ msr_bitmap[word] = (mode & MSR_BITMAP_MODE_X2APIC_APICV) ? 0 : ~0;
++ msr_bitmap[word + (0x800 / sizeof(long))] = ~0;
++ }
++
++ if (mode & MSR_BITMAP_MODE_X2APIC) {
++ /*
++ * TPR reads and writes can be virtualized even if virtual interrupt
++ * delivery is not in use.
++ */
++ vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_TASKPRI), MSR_TYPE_RW);
++ if (mode & MSR_BITMAP_MODE_X2APIC_APICV) {
++ vmx_enable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_TMCCT), MSR_TYPE_R);
++ vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_EOI), MSR_TYPE_W);
++ vmx_disable_intercept_for_msr(msr_bitmap, X2APIC_MSR(APIC_SELF_IPI), MSR_TYPE_W);
++ }
++ }
++}
++
++static void vmx_update_msr_bitmap(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long *msr_bitmap = vmx->vmcs01.msr_bitmap;
++ u8 mode = vmx_msr_bitmap_mode(vcpu);
++ u8 changed = mode ^ vmx->msr_bitmap_mode;
++
++ if (!changed)
++ return;
++
++ if (changed & (MSR_BITMAP_MODE_X2APIC | MSR_BITMAP_MODE_X2APIC_APICV))
++ vmx_update_msr_bitmap_x2apic(msr_bitmap, mode);
++
++ vmx->msr_bitmap_mode = mode;
++}
++
++static bool vmx_get_enable_apicv(struct kvm_vcpu *vcpu)
++{
++ return enable_apicv;
++}
++
++static void nested_mark_vmcs12_pages_dirty(struct kvm_vcpu *vcpu)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ gfn_t gfn;
++
++ /*
++ * Don't need to mark the APIC access page dirty; it is never
++ * written to by the CPU during APIC virtualization.
++ */
++
++ if (nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW)) {
++ gfn = vmcs12->virtual_apic_page_addr >> PAGE_SHIFT;
++ kvm_vcpu_mark_page_dirty(vcpu, gfn);
++ }
++
++ if (nested_cpu_has_posted_intr(vmcs12)) {
++ gfn = vmcs12->posted_intr_desc_addr >> PAGE_SHIFT;
++ kvm_vcpu_mark_page_dirty(vcpu, gfn);
++ }
++}
++
++
++static void vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int max_irr;
++ void *vapic_page;
++ u16 status;
++
++ if (!vmx->nested.pi_desc || !vmx->nested.pi_pending)
++ return;
++
++ vmx->nested.pi_pending = false;
++ if (!pi_test_and_clear_on(vmx->nested.pi_desc))
++ return;
++
++ max_irr = find_last_bit((unsigned long *)vmx->nested.pi_desc->pir, 256);
++ if (max_irr != 256) {
++ vapic_page = kmap(vmx->nested.virtual_apic_page);
++ __kvm_apic_update_irr(vmx->nested.pi_desc->pir,
++ vapic_page, &max_irr);
++ kunmap(vmx->nested.virtual_apic_page);
++
++ status = vmcs_read16(GUEST_INTR_STATUS);
++ if ((u8)max_irr > ((u8)status & 0xff)) {
++ status &= ~0xff;
++ status |= (u8)max_irr;
++ vmcs_write16(GUEST_INTR_STATUS, status);
++ }
++ }
++
++ nested_mark_vmcs12_pages_dirty(vcpu);
++}
++
++static u8 vmx_get_rvi(void)
++{
++ return vmcs_read16(GUEST_INTR_STATUS) & 0xff;
++}
++
++static bool vmx_guest_apic_has_interrupt(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ void *vapic_page;
++ u32 vppr;
++ int rvi;
++
++ if (WARN_ON_ONCE(!is_guest_mode(vcpu)) ||
++ !nested_cpu_has_vid(get_vmcs12(vcpu)) ||
++ WARN_ON_ONCE(!vmx->nested.virtual_apic_page))
++ return false;
++
++ rvi = vmx_get_rvi();
++
++ vapic_page = kmap(vmx->nested.virtual_apic_page);
++ vppr = *((u32 *)(vapic_page + APIC_PROCPRI));
++ kunmap(vmx->nested.virtual_apic_page);
++
++ return ((rvi & 0xf0) > (vppr & 0xf0));
++}
++
++static inline bool kvm_vcpu_trigger_posted_interrupt(struct kvm_vcpu *vcpu,
++ bool nested)
++{
++#ifdef CONFIG_SMP
++ int pi_vec = nested ? POSTED_INTR_NESTED_VECTOR : POSTED_INTR_VECTOR;
++
++ if (vcpu->mode == IN_GUEST_MODE) {
++ /*
++ * The vector of interrupt to be delivered to vcpu had
++ * been set in PIR before this function.
++ *
++ * Following cases will be reached in this block, and
++ * we always send a notification event in all cases as
++ * explained below.
++ *
++ * Case 1: vcpu keeps in non-root mode. Sending a
++ * notification event posts the interrupt to vcpu.
++ *
++ * Case 2: vcpu exits to root mode and is still
++ * runnable. PIR will be synced to vIRR before the
++ * next vcpu entry. Sending a notification event in
++ * this case has no effect, as vcpu is not in root
++ * mode.
++ *
++ * Case 3: vcpu exits to root mode and is blocked.
++ * vcpu_block() has already synced PIR to vIRR and
++ * never blocks vcpu if vIRR is not cleared. Therefore,
++ * a blocked vcpu here does not wait for any requested
++ * interrupts in PIR, and sending a notification event
++ * which has no effect is safe here.
++ */
++
++ apic->send_IPI_mask(get_cpu_mask(vcpu->cpu), pi_vec);
++ return true;
++ }
++#endif
++ return false;
++}
++
++static int vmx_deliver_nested_posted_interrupt(struct kvm_vcpu *vcpu,
++ int vector)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (is_guest_mode(vcpu) &&
++ vector == vmx->nested.posted_intr_nv) {
++ /*
++ * If a posted intr is not recognized by hardware,
++ * we will accomplish it in the next vmentry.
++ */
++ vmx->nested.pi_pending = true;
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
++ /* the PIR and ON have been set by L1. */
++ if (!kvm_vcpu_trigger_posted_interrupt(vcpu, true))
++ kvm_vcpu_kick(vcpu);
++ return 0;
++ }
++ return -1;
++}
++/*
++ * Send interrupt to vcpu via posted interrupt way.
++ * 1. If target vcpu is running(non-root mode), send posted interrupt
++ * notification to vcpu and hardware will sync PIR to vIRR atomically.
++ * 2. If target vcpu isn't running(root mode), kick it to pick up the
++ * interrupt from PIR in next vmentry.
++ */
++static int vmx_deliver_posted_interrupt(struct kvm_vcpu *vcpu, int vector)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int r;
++
++ r = vmx_deliver_nested_posted_interrupt(vcpu, vector);
++ if (!r)
++ return 0;
++
++ if (!vcpu->arch.apicv_active)
++ return -1;
++
++ if (pi_test_and_set_pir(vector, &vmx->pi_desc))
++ return 0;
++
++ /* If a previous notification has sent the IPI, nothing to do. */
++ if (pi_test_and_set_on(&vmx->pi_desc))
++ return 0;
++
++ if (!kvm_vcpu_trigger_posted_interrupt(vcpu, false))
++ kvm_vcpu_kick(vcpu);
++
++ return 0;
++}
++
++/*
++ * Set up the vmcs's constant host-state fields, i.e., host-state fields that
++ * will not change in the lifetime of the guest.
++ * Note that host-state that does change is set elsewhere. E.g., host-state
++ * that is set differently for each CPU is set in vmx_vcpu_load(), not here.
++ */
++static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
++{
++ u32 low32, high32;
++ unsigned long tmpl;
++ struct desc_ptr dt;
++ unsigned long cr0, cr3, cr4;
++
++ cr0 = read_cr0();
++ WARN_ON(cr0 & X86_CR0_TS);
++ vmcs_writel(HOST_CR0, cr0); /* 22.2.3 */
++
++ /*
++ * Save the most likely value for this task's CR3 in the VMCS.
++ * We can't use __get_current_cr3_fast() because we're not atomic.
++ */
++ cr3 = __read_cr3();
++ vmcs_writel(HOST_CR3, cr3); /* 22.2.3 FIXME: shadow tables */
++ vmx->loaded_vmcs->host_state.cr3 = cr3;
++
++ /* Save the most likely value for this task's CR4 in the VMCS. */
++ cr4 = cr4_read_shadow();
++ vmcs_writel(HOST_CR4, cr4); /* 22.2.3, 22.2.5 */
++ vmx->loaded_vmcs->host_state.cr4 = cr4;
++
++ vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */
++#ifdef CONFIG_X86_64
++ /*
++ * Load null selectors, so we can avoid reloading them in
++ * vmx_prepare_switch_to_host(), in case userspace uses
++ * the null selectors too (the expected case).
++ */
++ vmcs_write16(HOST_DS_SELECTOR, 0);
++ vmcs_write16(HOST_ES_SELECTOR, 0);
++#else
++ vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
++ vmcs_write16(HOST_ES_SELECTOR, __KERNEL_DS); /* 22.2.4 */
++#endif
++ vmcs_write16(HOST_SS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
++ vmcs_write16(HOST_TR_SELECTOR, GDT_ENTRY_TSS*8); /* 22.2.4 */
++
++ store_idt(&dt);
++ vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
++ vmx->host_idt_base = dt.address;
++
++ vmcs_writel(HOST_RIP, vmx_return); /* 22.2.5 */
++
++ rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
++ vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
++ rdmsrl(MSR_IA32_SYSENTER_EIP, tmpl);
++ vmcs_writel(HOST_IA32_SYSENTER_EIP, tmpl); /* 22.2.3 */
++
++ if (vmcs_config.vmexit_ctrl & VM_EXIT_LOAD_IA32_PAT) {
++ rdmsr(MSR_IA32_CR_PAT, low32, high32);
++ vmcs_write64(HOST_IA32_PAT, low32 | ((u64) high32 << 32));
++ }
++}
++
++static void set_cr4_guest_host_mask(struct vcpu_vmx *vmx)
++{
++ BUILD_BUG_ON(KVM_CR4_GUEST_OWNED_BITS & ~KVM_POSSIBLE_CR4_GUEST_BITS);
++
++ vmx->vcpu.arch.cr4_guest_owned_bits = KVM_CR4_GUEST_OWNED_BITS;
++ if (enable_ept)
++ vmx->vcpu.arch.cr4_guest_owned_bits |= X86_CR4_PGE;
++ if (is_guest_mode(&vmx->vcpu))
++ vmx->vcpu.arch.cr4_guest_owned_bits &=
++ ~get_vmcs12(&vmx->vcpu)->cr4_guest_host_mask;
++ vmcs_writel(CR4_GUEST_HOST_MASK, ~vmx->vcpu.arch.cr4_guest_owned_bits);
++}
++
++static u32 vmx_pin_based_exec_ctrl(struct vcpu_vmx *vmx)
++{
++ u32 pin_based_exec_ctrl = vmcs_config.pin_based_exec_ctrl;
++
++ if (!kvm_vcpu_apicv_active(&vmx->vcpu))
++ pin_based_exec_ctrl &= ~PIN_BASED_POSTED_INTR;
++
++ if (!enable_vnmi)
++ pin_based_exec_ctrl &= ~PIN_BASED_VIRTUAL_NMIS;
++
++ /* Enable the preemption timer dynamically */
++ pin_based_exec_ctrl &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
++ return pin_based_exec_ctrl;
++}
++
++static void vmx_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, vmx_pin_based_exec_ctrl(vmx));
++ if (cpu_has_secondary_exec_ctrls()) {
++ if (kvm_vcpu_apicv_active(vcpu))
++ vmcs_set_bits(SECONDARY_VM_EXEC_CONTROL,
++ SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
++ else
++ vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL,
++ SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
++ }
++
++ if (cpu_has_vmx_msr_bitmap())
++ vmx_update_msr_bitmap(vcpu);
++}
++
++static u32 vmx_exec_control(struct vcpu_vmx *vmx)
++{
++ u32 exec_control = vmcs_config.cpu_based_exec_ctrl;
++
++ if (vmx->vcpu.arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)
++ exec_control &= ~CPU_BASED_MOV_DR_EXITING;
++
++ if (!cpu_need_tpr_shadow(&vmx->vcpu)) {
++ exec_control &= ~CPU_BASED_TPR_SHADOW;
++#ifdef CONFIG_X86_64
++ exec_control |= CPU_BASED_CR8_STORE_EXITING |
++ CPU_BASED_CR8_LOAD_EXITING;
++#endif
++ }
++ if (!enable_ept)
++ exec_control |= CPU_BASED_CR3_STORE_EXITING |
++ CPU_BASED_CR3_LOAD_EXITING |
++ CPU_BASED_INVLPG_EXITING;
++ if (kvm_mwait_in_guest(vmx->vcpu.kvm))
++ exec_control &= ~(CPU_BASED_MWAIT_EXITING |
++ CPU_BASED_MONITOR_EXITING);
++ if (kvm_hlt_in_guest(vmx->vcpu.kvm))
++ exec_control &= ~CPU_BASED_HLT_EXITING;
++ return exec_control;
++}
++
++static bool vmx_rdrand_supported(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_RDRAND_EXITING;
++}
++
++static bool vmx_rdseed_supported(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_RDSEED_EXITING;
++}
++
++static void vmx_compute_secondary_exec_control(struct vcpu_vmx *vmx)
++{
++ struct kvm_vcpu *vcpu = &vmx->vcpu;
++
++ u32 exec_control = vmcs_config.cpu_based_2nd_exec_ctrl;
++
++ if (!cpu_need_virtualize_apic_accesses(vcpu))
++ exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
++ if (vmx->vpid == 0)
++ exec_control &= ~SECONDARY_EXEC_ENABLE_VPID;
++ if (!enable_ept) {
++ exec_control &= ~SECONDARY_EXEC_ENABLE_EPT;
++ enable_unrestricted_guest = 0;
++ }
++ if (!enable_unrestricted_guest)
++ exec_control &= ~SECONDARY_EXEC_UNRESTRICTED_GUEST;
++ if (kvm_pause_in_guest(vmx->vcpu.kvm))
++ exec_control &= ~SECONDARY_EXEC_PAUSE_LOOP_EXITING;
++ if (!kvm_vcpu_apicv_active(vcpu))
++ exec_control &= ~(SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY);
++ exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
++
++ /* SECONDARY_EXEC_DESC is enabled/disabled on writes to CR4.UMIP,
++ * in vmx_set_cr4. */
++ exec_control &= ~SECONDARY_EXEC_DESC;
++
++ /* SECONDARY_EXEC_SHADOW_VMCS is enabled when L1 executes VMPTRLD
++ (handle_vmptrld).
++ We can NOT enable shadow_vmcs here because we don't have yet
++ a current VMCS12
++ */
++ exec_control &= ~SECONDARY_EXEC_SHADOW_VMCS;
++
++ if (!enable_pml)
++ exec_control &= ~SECONDARY_EXEC_ENABLE_PML;
++
++ if (vmx_xsaves_supported()) {
++ /* Exposing XSAVES only when XSAVE is exposed */
++ bool xsaves_enabled =
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVES);
++
++ if (!xsaves_enabled)
++ exec_control &= ~SECONDARY_EXEC_XSAVES;
++
++ if (nested) {
++ if (xsaves_enabled)
++ vmx->nested.msrs.secondary_ctls_high |=
++ SECONDARY_EXEC_XSAVES;
++ else
++ vmx->nested.msrs.secondary_ctls_high &=
++ ~SECONDARY_EXEC_XSAVES;
++ }
++ }
++
++ if (vmx_rdtscp_supported()) {
++ bool rdtscp_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP);
++ if (!rdtscp_enabled)
++ exec_control &= ~SECONDARY_EXEC_RDTSCP;
++
++ if (nested) {
++ if (rdtscp_enabled)
++ vmx->nested.msrs.secondary_ctls_high |=
++ SECONDARY_EXEC_RDTSCP;
++ else
++ vmx->nested.msrs.secondary_ctls_high &=
++ ~SECONDARY_EXEC_RDTSCP;
++ }
++ }
++
++ if (vmx_invpcid_supported()) {
++ /* Exposing INVPCID only when PCID is exposed */
++ bool invpcid_enabled =
++ guest_cpuid_has(vcpu, X86_FEATURE_INVPCID) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_PCID);
++
++ if (!invpcid_enabled) {
++ exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
++ guest_cpuid_clear(vcpu, X86_FEATURE_INVPCID);
++ }
++
++ if (nested) {
++ if (invpcid_enabled)
++ vmx->nested.msrs.secondary_ctls_high |=
++ SECONDARY_EXEC_ENABLE_INVPCID;
++ else
++ vmx->nested.msrs.secondary_ctls_high &=
++ ~SECONDARY_EXEC_ENABLE_INVPCID;
++ }
++ }
++
++ if (vmx_rdrand_supported()) {
++ bool rdrand_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDRAND);
++ if (rdrand_enabled)
++ exec_control &= ~SECONDARY_EXEC_RDRAND_EXITING;
++
++ if (nested) {
++ if (rdrand_enabled)
++ vmx->nested.msrs.secondary_ctls_high |=
++ SECONDARY_EXEC_RDRAND_EXITING;
++ else
++ vmx->nested.msrs.secondary_ctls_high &=
++ ~SECONDARY_EXEC_RDRAND_EXITING;
++ }
++ }
++
++ if (vmx_rdseed_supported()) {
++ bool rdseed_enabled = guest_cpuid_has(vcpu, X86_FEATURE_RDSEED);
++ if (rdseed_enabled)
++ exec_control &= ~SECONDARY_EXEC_RDSEED_EXITING;
++
++ if (nested) {
++ if (rdseed_enabled)
++ vmx->nested.msrs.secondary_ctls_high |=
++ SECONDARY_EXEC_RDSEED_EXITING;
++ else
++ vmx->nested.msrs.secondary_ctls_high &=
++ ~SECONDARY_EXEC_RDSEED_EXITING;
++ }
++ }
++
++ vmx->secondary_exec_control = exec_control;
++}
++
++static void ept_set_mmio_spte_mask(void)
++{
++ /*
++ * EPT Misconfigurations can be generated if the value of bits 2:0
++ * of an EPT paging-structure entry is 110b (write/execute).
++ */
++ kvm_mmu_set_mmio_spte_mask(VMX_EPT_RWX_MASK,
++ VMX_EPT_MISCONFIG_WX_VALUE);
++}
++
++#define VMX_XSS_EXIT_BITMAP 0
++/*
++ * Sets up the vmcs for emulated real mode.
++ */
++static void vmx_vcpu_setup(struct vcpu_vmx *vmx)
++{
++ int i;
++
++ if (enable_shadow_vmcs) {
++ /*
++ * At vCPU creation, "VMWRITE to any supported field
++ * in the VMCS" is supported, so use the more
++ * permissive vmx_vmread_bitmap to specify both read
++ * and write permissions for the shadow VMCS.
++ */
++ vmcs_write64(VMREAD_BITMAP, __pa(vmx_vmread_bitmap));
++ vmcs_write64(VMWRITE_BITMAP, __pa(vmx_vmread_bitmap));
++ }
++ if (cpu_has_vmx_msr_bitmap())
++ vmcs_write64(MSR_BITMAP, __pa(vmx->vmcs01.msr_bitmap));
++
++ vmcs_write64(VMCS_LINK_POINTER, -1ull); /* 22.3.1.5 */
++
++ /* Control */
++ vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, vmx_pin_based_exec_ctrl(vmx));
++ vmx->hv_deadline_tsc = -1;
++
++ vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, vmx_exec_control(vmx));
++
++ if (cpu_has_secondary_exec_ctrls()) {
++ vmx_compute_secondary_exec_control(vmx);
++ vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
++ vmx->secondary_exec_control);
++ }
++
++ if (kvm_vcpu_apicv_active(&vmx->vcpu)) {
++ vmcs_write64(EOI_EXIT_BITMAP0, 0);
++ vmcs_write64(EOI_EXIT_BITMAP1, 0);
++ vmcs_write64(EOI_EXIT_BITMAP2, 0);
++ vmcs_write64(EOI_EXIT_BITMAP3, 0);
++
++ vmcs_write16(GUEST_INTR_STATUS, 0);
++
++ vmcs_write16(POSTED_INTR_NV, POSTED_INTR_VECTOR);
++ vmcs_write64(POSTED_INTR_DESC_ADDR, __pa((&vmx->pi_desc)));
++ }
++
++ if (!kvm_pause_in_guest(vmx->vcpu.kvm)) {
++ vmcs_write32(PLE_GAP, ple_gap);
++ vmx->ple_window = ple_window;
++ vmx->ple_window_dirty = true;
++ }
++
++ vmcs_write32(PAGE_FAULT_ERROR_CODE_MASK, 0);
++ vmcs_write32(PAGE_FAULT_ERROR_CODE_MATCH, 0);
++ vmcs_write32(CR3_TARGET_COUNT, 0); /* 22.2.1 */
++
++ vmcs_write16(HOST_FS_SELECTOR, 0); /* 22.2.4 */
++ vmcs_write16(HOST_GS_SELECTOR, 0); /* 22.2.4 */
++ vmx_set_constant_host_state(vmx);
++ vmcs_writel(HOST_FS_BASE, 0); /* 22.2.4 */
++ vmcs_writel(HOST_GS_BASE, 0); /* 22.2.4 */
++
++ if (cpu_has_vmx_vmfunc())
++ vmcs_write64(VM_FUNCTION_CONTROL, 0);
++
++ vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
++ vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host.val));
++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
++ vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest.val));
++
++ if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT)
++ vmcs_write64(GUEST_IA32_PAT, vmx->vcpu.arch.pat);
++
++ for (i = 0; i < ARRAY_SIZE(vmx_msr_index); ++i) {
++ u32 index = vmx_msr_index[i];
++ u32 data_low, data_high;
++ int j = vmx->nmsrs;
++
++ if (rdmsr_safe(index, &data_low, &data_high) < 0)
++ continue;
++ if (wrmsr_safe(index, data_low, data_high) < 0)
++ continue;
++ vmx->guest_msrs[j].index = i;
++ vmx->guest_msrs[j].data = 0;
++ vmx->guest_msrs[j].mask = -1ull;
++ ++vmx->nmsrs;
++ }
++
++ vm_exit_controls_init(vmx, vmcs_config.vmexit_ctrl);
++
++ /* 22.2.1, 20.8.1 */
++ vm_entry_controls_init(vmx, vmcs_config.vmentry_ctrl);
++
++ vmx->vcpu.arch.cr0_guest_owned_bits = X86_CR0_TS;
++ vmcs_writel(CR0_GUEST_HOST_MASK, ~X86_CR0_TS);
++
++ set_cr4_guest_host_mask(vmx);
++
++ if (vmx_xsaves_supported())
++ vmcs_write64(XSS_EXIT_BITMAP, VMX_XSS_EXIT_BITMAP);
++
++ if (enable_pml) {
++ ASSERT(vmx->pml_pg);
++ vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
++ vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
++ }
++
++ if (cpu_has_vmx_encls_vmexit())
++ vmcs_write64(ENCLS_EXITING_BITMAP, -1ull);
++}
++
++static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct msr_data apic_base_msr;
++ u64 cr0;
++
++ vmx->rmode.vm86_active = 0;
++ vmx->spec_ctrl = 0;
++
++ vcpu->arch.microcode_version = 0x100000000ULL;
++ vmx->vcpu.arch.regs[VCPU_REGS_RDX] = get_rdx_init_val();
++ kvm_set_cr8(vcpu, 0);
++
++ if (!init_event) {
++ apic_base_msr.data = APIC_DEFAULT_PHYS_BASE |
++ MSR_IA32_APICBASE_ENABLE;
++ if (kvm_vcpu_is_reset_bsp(vcpu))
++ apic_base_msr.data |= MSR_IA32_APICBASE_BSP;
++ apic_base_msr.host_initiated = true;
++ kvm_set_apic_base(vcpu, &apic_base_msr);
++ }
++
++ vmx_segment_cache_clear(vmx);
++
++ seg_setup(VCPU_SREG_CS);
++ vmcs_write16(GUEST_CS_SELECTOR, 0xf000);
++ vmcs_writel(GUEST_CS_BASE, 0xffff0000ul);
++
++ seg_setup(VCPU_SREG_DS);
++ seg_setup(VCPU_SREG_ES);
++ seg_setup(VCPU_SREG_FS);
++ seg_setup(VCPU_SREG_GS);
++ seg_setup(VCPU_SREG_SS);
++
++ vmcs_write16(GUEST_TR_SELECTOR, 0);
++ vmcs_writel(GUEST_TR_BASE, 0);
++ vmcs_write32(GUEST_TR_LIMIT, 0xffff);
++ vmcs_write32(GUEST_TR_AR_BYTES, 0x008b);
++
++ vmcs_write16(GUEST_LDTR_SELECTOR, 0);
++ vmcs_writel(GUEST_LDTR_BASE, 0);
++ vmcs_write32(GUEST_LDTR_LIMIT, 0xffff);
++ vmcs_write32(GUEST_LDTR_AR_BYTES, 0x00082);
++
++ if (!init_event) {
++ vmcs_write32(GUEST_SYSENTER_CS, 0);
++ vmcs_writel(GUEST_SYSENTER_ESP, 0);
++ vmcs_writel(GUEST_SYSENTER_EIP, 0);
++ vmcs_write64(GUEST_IA32_DEBUGCTL, 0);
++ }
++
++ kvm_set_rflags(vcpu, X86_EFLAGS_FIXED);
++ kvm_rip_write(vcpu, 0xfff0);
++
++ vmcs_writel(GUEST_GDTR_BASE, 0);
++ vmcs_write32(GUEST_GDTR_LIMIT, 0xffff);
++
++ vmcs_writel(GUEST_IDTR_BASE, 0);
++ vmcs_write32(GUEST_IDTR_LIMIT, 0xffff);
++
++ vmcs_write32(GUEST_ACTIVITY_STATE, GUEST_ACTIVITY_ACTIVE);
++ vmcs_write32(GUEST_INTERRUPTIBILITY_INFO, 0);
++ vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS, 0);
++ if (kvm_mpx_supported())
++ vmcs_write64(GUEST_BNDCFGS, 0);
++
++ setup_msrs(vmx);
++
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0); /* 22.2.1 */
++
++ if (cpu_has_vmx_tpr_shadow() && !init_event) {
++ vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, 0);
++ if (cpu_need_tpr_shadow(vcpu))
++ vmcs_write64(VIRTUAL_APIC_PAGE_ADDR,
++ __pa(vcpu->arch.apic->regs));
++ vmcs_write32(TPR_THRESHOLD, 0);
++ }
++
++ kvm_make_request(KVM_REQ_APIC_PAGE_RELOAD, vcpu);
++
++ if (vmx->vpid != 0)
++ vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
++
++ cr0 = X86_CR0_NW | X86_CR0_CD | X86_CR0_ET;
++ vmx->vcpu.arch.cr0 = cr0;
++ vmx_set_cr0(vcpu, cr0); /* enter rmode */
++ vmx_set_cr4(vcpu, 0);
++ vmx_set_efer(vcpu, 0);
++
++ update_exception_bitmap(vcpu);
++
++ vpid_sync_context(vmx->vpid);
++ if (init_event)
++ vmx_clear_hlt(vcpu);
++
++ vmx_update_fb_clear_dis(vcpu, vmx);
++}
++
++/*
++ * In nested virtualization, check if L1 asked to exit on external interrupts.
++ * For most existing hypervisors, this will always return true.
++ */
++static bool nested_exit_on_intr(struct kvm_vcpu *vcpu)
++{
++ return get_vmcs12(vcpu)->pin_based_vm_exec_control &
++ PIN_BASED_EXT_INTR_MASK;
++}
++
++/*
++ * In nested virtualization, check if L1 has set
++ * VM_EXIT_ACK_INTR_ON_EXIT
++ */
++static bool nested_exit_intr_ack_set(struct kvm_vcpu *vcpu)
++{
++ return get_vmcs12(vcpu)->vm_exit_controls &
++ VM_EXIT_ACK_INTR_ON_EXIT;
++}
++
++static bool nested_exit_on_nmi(struct kvm_vcpu *vcpu)
++{
++ return nested_cpu_has_nmi_exiting(get_vmcs12(vcpu));
++}
++
++static void enable_irq_window(struct kvm_vcpu *vcpu)
++{
++ vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL,
++ CPU_BASED_VIRTUAL_INTR_PENDING);
++}
++
++static void enable_nmi_window(struct kvm_vcpu *vcpu)
++{
++ if (!enable_vnmi ||
++ vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_STI) {
++ enable_irq_window(vcpu);
++ return;
++ }
++
++ vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL,
++ CPU_BASED_VIRTUAL_NMI_PENDING);
++}
++
++static void vmx_inject_irq(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ uint32_t intr;
++ int irq = vcpu->arch.interrupt.nr;
++
++ trace_kvm_inj_virq(irq);
++
++ ++vcpu->stat.irq_injections;
++ if (vmx->rmode.vm86_active) {
++ int inc_eip = 0;
++ if (vcpu->arch.interrupt.soft)
++ inc_eip = vcpu->arch.event_exit_inst_len;
++ if (kvm_inject_realmode_interrupt(vcpu, irq, inc_eip) != EMULATE_DONE)
++ kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
++ return;
++ }
++ intr = irq | INTR_INFO_VALID_MASK;
++ if (vcpu->arch.interrupt.soft) {
++ intr |= INTR_TYPE_SOFT_INTR;
++ vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
++ vmx->vcpu.arch.event_exit_inst_len);
++ } else
++ intr |= INTR_TYPE_EXT_INTR;
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, intr);
++
++ vmx_clear_hlt(vcpu);
++}
++
++static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (!enable_vnmi) {
++ /*
++ * Tracking the NMI-blocked state in software is built upon
++ * finding the next open IRQ window. This, in turn, depends on
++ * well-behaving guests: They have to keep IRQs disabled at
++ * least as long as the NMI handler runs. Otherwise we may
++ * cause NMI nesting, maybe breaking the guest. But as this is
++ * highly unlikely, we can live with the residual risk.
++ */
++ vmx->loaded_vmcs->soft_vnmi_blocked = 1;
++ vmx->loaded_vmcs->vnmi_blocked_time = 0;
++ }
++
++ ++vcpu->stat.nmi_injections;
++ vmx->loaded_vmcs->nmi_known_unmasked = false;
++
++ if (vmx->rmode.vm86_active) {
++ if (kvm_inject_realmode_interrupt(vcpu, NMI_VECTOR, 0) != EMULATE_DONE)
++ kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
++ return;
++ }
++
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD,
++ INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK | NMI_VECTOR);
++
++ vmx_clear_hlt(vcpu);
++}
++
++static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ bool masked;
++
++ if (!enable_vnmi)
++ return vmx->loaded_vmcs->soft_vnmi_blocked;
++ if (vmx->loaded_vmcs->nmi_known_unmasked)
++ return false;
++ masked = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_NMI;
++ vmx->loaded_vmcs->nmi_known_unmasked = !masked;
++ return masked;
++}
++
++static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (!enable_vnmi) {
++ if (vmx->loaded_vmcs->soft_vnmi_blocked != masked) {
++ vmx->loaded_vmcs->soft_vnmi_blocked = masked;
++ vmx->loaded_vmcs->vnmi_blocked_time = 0;
++ }
++ } else {
++ vmx->loaded_vmcs->nmi_known_unmasked = !masked;
++ if (masked)
++ vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++ GUEST_INTR_STATE_NMI);
++ else
++ vmcs_clear_bits(GUEST_INTERRUPTIBILITY_INFO,
++ GUEST_INTR_STATE_NMI);
++ }
++}
++
++static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
++{
++ if (to_vmx(vcpu)->nested.nested_run_pending)
++ return 0;
++
++ if (!enable_vnmi &&
++ to_vmx(vcpu)->loaded_vmcs->soft_vnmi_blocked)
++ return 0;
++
++ return !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
++ (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_STI
++ | GUEST_INTR_STATE_NMI));
++}
++
++static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu)
++{
++ if (to_vmx(vcpu)->nested.nested_run_pending)
++ return false;
++
++ if (is_guest_mode(vcpu) && nested_exit_on_intr(vcpu))
++ return true;
++
++ return (vmcs_readl(GUEST_RFLAGS) & X86_EFLAGS_IF) &&
++ !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
++ (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS));
++}
++
++static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr)
++{
++ int ret;
++
++ if (enable_unrestricted_guest)
++ return 0;
++
++ ret = x86_set_memory_region(kvm, TSS_PRIVATE_MEMSLOT, addr,
++ PAGE_SIZE * 3);
++ if (ret)
++ return ret;
++ to_kvm_vmx(kvm)->tss_addr = addr;
++ return init_rmode_tss(kvm);
++}
++
++static int vmx_set_identity_map_addr(struct kvm *kvm, u64 ident_addr)
++{
++ to_kvm_vmx(kvm)->ept_identity_map_addr = ident_addr;
++ return 0;
++}
++
++static bool rmode_exception(struct kvm_vcpu *vcpu, int vec)
++{
++ switch (vec) {
++ case BP_VECTOR:
++ /*
++ * Update instruction length as we may reinject the exception
++ * from user space while in guest debugging mode.
++ */
++ to_vmx(vcpu)->vcpu.arch.event_exit_inst_len =
++ vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
++ if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
++ return false;
++ /* fall through */
++ case DB_VECTOR:
++ if (vcpu->guest_debug &
++ (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
++ return false;
++ /* fall through */
++ case DE_VECTOR:
++ case OF_VECTOR:
++ case BR_VECTOR:
++ case UD_VECTOR:
++ case DF_VECTOR:
++ case SS_VECTOR:
++ case GP_VECTOR:
++ case MF_VECTOR:
++ return true;
++ break;
++ }
++ return false;
++}
++
++static int handle_rmode_exception(struct kvm_vcpu *vcpu,
++ int vec, u32 err_code)
++{
++ /*
++ * Instruction with address size override prefix opcode 0x67
++ * Cause the #SS fault with 0 error code in VM86 mode.
++ */
++ if (((vec == GP_VECTOR) || (vec == SS_VECTOR)) && err_code == 0) {
++ if (kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE) {
++ if (vcpu->arch.halt_request) {
++ vcpu->arch.halt_request = 0;
++ return kvm_vcpu_halt(vcpu);
++ }
++ return 1;
++ }
++ return 0;
++ }
++
++ /*
++ * Forward all other exceptions that are valid in real mode.
++ * FIXME: Breaks guest debugging in real mode, needs to be fixed with
++ * the required debugging infrastructure rework.
++ */
++ kvm_queue_exception(vcpu, vec);
++ return 1;
++}
++
++/*
++ * Trigger machine check on the host. We assume all the MSRs are already set up
++ * by the CPU and that we still run on the same CPU as the MCE occurred on.
++ * We pass a fake environment to the machine check handler because we want
++ * the guest to be always treated like user space, no matter what context
++ * it used internally.
++ */
++static void kvm_machine_check(void)
++{
++#if defined(CONFIG_X86_MCE)
++ struct pt_regs regs = {
++ .cs = 3, /* Fake ring 3 no matter what the guest ran on */
++ .flags = X86_EFLAGS_IF,
++ };
++
++ do_machine_check(®s, 0);
++#endif
++}
++
++static int handle_machine_check(struct kvm_vcpu *vcpu)
++{
++ /* already handled by vcpu_run */
++ return 1;
++}
++
++static int handle_exception(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct kvm_run *kvm_run = vcpu->run;
++ u32 intr_info, ex_no, error_code;
++ unsigned long cr2, rip, dr6;
++ u32 vect_info;
++ enum emulation_result er;
++
++ vect_info = vmx->idt_vectoring_info;
++ intr_info = vmx->exit_intr_info;
++
++ if (is_machine_check(intr_info))
++ return handle_machine_check(vcpu);
++
++ if (is_nmi(intr_info))
++ return 1; /* already handled by vmx_vcpu_run() */
++
++ if (is_invalid_opcode(intr_info))
++ return handle_ud(vcpu);
++
++ error_code = 0;
++ if (intr_info & INTR_INFO_DELIVER_CODE_MASK)
++ error_code = vmcs_read32(VM_EXIT_INTR_ERROR_CODE);
++
++ if (!vmx->rmode.vm86_active && is_gp_fault(intr_info)) {
++ WARN_ON_ONCE(!enable_vmware_backdoor);
++ er = kvm_emulate_instruction(vcpu,
++ EMULTYPE_VMWARE | EMULTYPE_NO_UD_ON_FAIL);
++ if (er == EMULATE_USER_EXIT)
++ return 0;
++ else if (er != EMULATE_DONE)
++ kvm_queue_exception_e(vcpu, GP_VECTOR, error_code);
++ return 1;
++ }
++
++ /*
++ * The #PF with PFEC.RSVD = 1 indicates the guest is accessing
++ * MMIO, it is better to report an internal error.
++ * See the comments in vmx_handle_exit.
++ */
++ if ((vect_info & VECTORING_INFO_VALID_MASK) &&
++ !(is_page_fault(intr_info) && !(error_code & PFERR_RSVD_MASK))) {
++ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
++ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_SIMUL_EX;
++ vcpu->run->internal.ndata = 3;
++ vcpu->run->internal.data[0] = vect_info;
++ vcpu->run->internal.data[1] = intr_info;
++ vcpu->run->internal.data[2] = error_code;
++ return 0;
++ }
++
++ if (is_page_fault(intr_info)) {
++ cr2 = vmcs_readl(EXIT_QUALIFICATION);
++ /* EPT won't cause page fault directly */
++ WARN_ON_ONCE(!vcpu->arch.apf.host_apf_reason && enable_ept);
++ return kvm_handle_page_fault(vcpu, error_code, cr2, NULL, 0);
++ }
++
++ ex_no = intr_info & INTR_INFO_VECTOR_MASK;
++
++ if (vmx->rmode.vm86_active && rmode_exception(vcpu, ex_no))
++ return handle_rmode_exception(vcpu, ex_no, error_code);
++
++ switch (ex_no) {
++ case AC_VECTOR:
++ kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
++ return 1;
++ case DB_VECTOR:
++ dr6 = vmcs_readl(EXIT_QUALIFICATION);
++ if (!(vcpu->guest_debug &
++ (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))) {
++ vcpu->arch.dr6 &= ~15;
++ vcpu->arch.dr6 |= dr6 | DR6_RTM;
++ if (is_icebp(intr_info))
++ skip_emulated_instruction(vcpu);
++
++ kvm_queue_exception(vcpu, DB_VECTOR);
++ return 1;
++ }
++ kvm_run->debug.arch.dr6 = dr6 | DR6_FIXED_1;
++ kvm_run->debug.arch.dr7 = vmcs_readl(GUEST_DR7);
++ /* fall through */
++ case BP_VECTOR:
++ /*
++ * Update instruction length as we may reinject #BP from
++ * user space while in guest debugging mode. Reading it for
++ * #DB as well causes no harm, it is not used in that case.
++ */
++ vmx->vcpu.arch.event_exit_inst_len =
++ vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
++ kvm_run->exit_reason = KVM_EXIT_DEBUG;
++ rip = kvm_rip_read(vcpu);
++ kvm_run->debug.arch.pc = vmcs_readl(GUEST_CS_BASE) + rip;
++ kvm_run->debug.arch.exception = ex_no;
++ break;
++ default:
++ kvm_run->exit_reason = KVM_EXIT_EXCEPTION;
++ kvm_run->ex.exception = ex_no;
++ kvm_run->ex.error_code = error_code;
++ break;
++ }
++ return 0;
++}
++
++static int handle_external_interrupt(struct kvm_vcpu *vcpu)
++{
++ ++vcpu->stat.irq_exits;
++ return 1;
++}
++
++static int handle_triple_fault(struct kvm_vcpu *vcpu)
++{
++ vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
++ vcpu->mmio_needed = 0;
++ return 0;
++}
++
++static int handle_io(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification;
++ int size, in, string;
++ unsigned port;
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ string = (exit_qualification & 16) != 0;
++
++ ++vcpu->stat.io_exits;
++
++ if (string)
++ return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
++
++ port = exit_qualification >> 16;
++ size = (exit_qualification & 7) + 1;
++ in = (exit_qualification & 8) != 0;
++
++ return kvm_fast_pio(vcpu, size, port, in);
++}
++
++static void
++vmx_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall)
++{
++ /*
++ * Patch in the VMCALL instruction:
++ */
++ hypercall[0] = 0x0f;
++ hypercall[1] = 0x01;
++ hypercall[2] = 0xc1;
++}
++
++/* called to set cr0 as appropriate for a mov-to-cr0 exit. */
++static int handle_set_cr0(struct kvm_vcpu *vcpu, unsigned long val)
++{
++ if (is_guest_mode(vcpu)) {
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ unsigned long orig_val = val;
++
++ /*
++ * We get here when L2 changed cr0 in a way that did not change
++ * any of L1's shadowed bits (see nested_vmx_exit_handled_cr),
++ * but did change L0 shadowed bits. So we first calculate the
++ * effective cr0 value that L1 would like to write into the
++ * hardware. It consists of the L2-owned bits from the new
++ * value combined with the L1-owned bits from L1's guest_cr0.
++ */
++ val = (val & ~vmcs12->cr0_guest_host_mask) |
++ (vmcs12->guest_cr0 & vmcs12->cr0_guest_host_mask);
++
++ if (!nested_guest_cr0_valid(vcpu, val))
++ return 1;
++
++ if (kvm_set_cr0(vcpu, val))
++ return 1;
++ vmcs_writel(CR0_READ_SHADOW, orig_val);
++ return 0;
++ } else {
++ if (to_vmx(vcpu)->nested.vmxon &&
++ !nested_host_cr0_valid(vcpu, val))
++ return 1;
++
++ return kvm_set_cr0(vcpu, val);
++ }
++}
++
++static int handle_set_cr4(struct kvm_vcpu *vcpu, unsigned long val)
++{
++ if (is_guest_mode(vcpu)) {
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ unsigned long orig_val = val;
++
++ /* analogously to handle_set_cr0 */
++ val = (val & ~vmcs12->cr4_guest_host_mask) |
++ (vmcs12->guest_cr4 & vmcs12->cr4_guest_host_mask);
++ if (kvm_set_cr4(vcpu, val))
++ return 1;
++ vmcs_writel(CR4_READ_SHADOW, orig_val);
++ return 0;
++ } else
++ return kvm_set_cr4(vcpu, val);
++}
++
++static int handle_desc(struct kvm_vcpu *vcpu)
++{
++ WARN_ON(!(vcpu->arch.cr4 & X86_CR4_UMIP));
++ return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
++}
++
++static int handle_cr(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification, val;
++ int cr;
++ int reg;
++ int err;
++ int ret;
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ cr = exit_qualification & 15;
++ reg = (exit_qualification >> 8) & 15;
++ switch ((exit_qualification >> 4) & 3) {
++ case 0: /* mov to cr */
++ val = kvm_register_readl(vcpu, reg);
++ trace_kvm_cr_write(cr, val);
++ switch (cr) {
++ case 0:
++ err = handle_set_cr0(vcpu, val);
++ return kvm_complete_insn_gp(vcpu, err);
++ case 3:
++ WARN_ON_ONCE(enable_unrestricted_guest);
++ err = kvm_set_cr3(vcpu, val);
++ return kvm_complete_insn_gp(vcpu, err);
++ case 4:
++ err = handle_set_cr4(vcpu, val);
++ return kvm_complete_insn_gp(vcpu, err);
++ case 8: {
++ u8 cr8_prev = kvm_get_cr8(vcpu);
++ u8 cr8 = (u8)val;
++ err = kvm_set_cr8(vcpu, cr8);
++ ret = kvm_complete_insn_gp(vcpu, err);
++ if (lapic_in_kernel(vcpu))
++ return ret;
++ if (cr8_prev <= cr8)
++ return ret;
++ /*
++ * TODO: we might be squashing a
++ * KVM_GUESTDBG_SINGLESTEP-triggered
++ * KVM_EXIT_DEBUG here.
++ */
++ vcpu->run->exit_reason = KVM_EXIT_SET_TPR;
++ return 0;
++ }
++ }
++ break;
++ case 2: /* clts */
++ WARN_ONCE(1, "Guest should always own CR0.TS");
++ vmx_set_cr0(vcpu, kvm_read_cr0_bits(vcpu, ~X86_CR0_TS));
++ trace_kvm_cr_write(0, kvm_read_cr0(vcpu));
++ return kvm_skip_emulated_instruction(vcpu);
++ case 1: /*mov from cr*/
++ switch (cr) {
++ case 3:
++ WARN_ON_ONCE(enable_unrestricted_guest);
++ val = kvm_read_cr3(vcpu);
++ kvm_register_write(vcpu, reg, val);
++ trace_kvm_cr_read(cr, val);
++ return kvm_skip_emulated_instruction(vcpu);
++ case 8:
++ val = kvm_get_cr8(vcpu);
++ kvm_register_write(vcpu, reg, val);
++ trace_kvm_cr_read(cr, val);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ break;
++ case 3: /* lmsw */
++ val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f;
++ trace_kvm_cr_write(0, (kvm_read_cr0(vcpu) & ~0xful) | val);
++ kvm_lmsw(vcpu, val);
++
++ return kvm_skip_emulated_instruction(vcpu);
++ default:
++ break;
++ }
++ vcpu->run->exit_reason = 0;
++ vcpu_unimpl(vcpu, "unhandled control register: op %d cr %d\n",
++ (int)(exit_qualification >> 4) & 3, cr);
++ return 0;
++}
++
++static int handle_dr(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification;
++ int dr, dr7, reg;
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ dr = exit_qualification & DEBUG_REG_ACCESS_NUM;
++
++ /* First, if DR does not exist, trigger UD */
++ if (!kvm_require_dr(vcpu, dr))
++ return 1;
++
++ /* Do not handle if the CPL > 0, will trigger GP on re-entry */
++ if (!kvm_require_cpl(vcpu, 0))
++ return 1;
++ dr7 = vmcs_readl(GUEST_DR7);
++ if (dr7 & DR7_GD) {
++ /*
++ * As the vm-exit takes precedence over the debug trap, we
++ * need to emulate the latter, either for the host or the
++ * guest debugging itself.
++ */
++ if (vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) {
++ vcpu->run->debug.arch.dr6 = vcpu->arch.dr6;
++ vcpu->run->debug.arch.dr7 = dr7;
++ vcpu->run->debug.arch.pc = kvm_get_linear_rip(vcpu);
++ vcpu->run->debug.arch.exception = DB_VECTOR;
++ vcpu->run->exit_reason = KVM_EXIT_DEBUG;
++ return 0;
++ } else {
++ vcpu->arch.dr6 &= ~15;
++ vcpu->arch.dr6 |= DR6_BD | DR6_RTM;
++ kvm_queue_exception(vcpu, DB_VECTOR);
++ return 1;
++ }
++ }
++
++ if (vcpu->guest_debug == 0) {
++ vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
++ CPU_BASED_MOV_DR_EXITING);
++
++ /*
++ * No more DR vmexits; force a reload of the debug registers
++ * and reenter on this instruction. The next vmexit will
++ * retrieve the full state of the debug registers.
++ */
++ vcpu->arch.switch_db_regs |= KVM_DEBUGREG_WONT_EXIT;
++ return 1;
++ }
++
++ reg = DEBUG_REG_ACCESS_REG(exit_qualification);
++ if (exit_qualification & TYPE_MOV_FROM_DR) {
++ unsigned long val;
++
++ if (kvm_get_dr(vcpu, dr, &val))
++ return 1;
++ kvm_register_write(vcpu, reg, val);
++ } else
++ if (kvm_set_dr(vcpu, dr, kvm_register_readl(vcpu, reg)))
++ return 1;
++
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static u64 vmx_get_dr6(struct kvm_vcpu *vcpu)
++{
++ return vcpu->arch.dr6;
++}
++
++static void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val)
++{
++}
++
++static void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu)
++{
++ get_debugreg(vcpu->arch.db[0], 0);
++ get_debugreg(vcpu->arch.db[1], 1);
++ get_debugreg(vcpu->arch.db[2], 2);
++ get_debugreg(vcpu->arch.db[3], 3);
++ get_debugreg(vcpu->arch.dr6, 6);
++ vcpu->arch.dr7 = vmcs_readl(GUEST_DR7);
++
++ vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_WONT_EXIT;
++ vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL, CPU_BASED_MOV_DR_EXITING);
++}
++
++static void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val)
++{
++ vmcs_writel(GUEST_DR7, val);
++}
++
++static int handle_cpuid(struct kvm_vcpu *vcpu)
++{
++ return kvm_emulate_cpuid(vcpu);
++}
++
++static int handle_rdmsr(struct kvm_vcpu *vcpu)
++{
++ u32 ecx = vcpu->arch.regs[VCPU_REGS_RCX];
++ struct msr_data msr_info;
++
++ msr_info.index = ecx;
++ msr_info.host_initiated = false;
++ if (vmx_get_msr(vcpu, &msr_info)) {
++ trace_kvm_msr_read_ex(ecx);
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++
++ trace_kvm_msr_read(ecx, msr_info.data);
++
++ /* FIXME: handling of bits 32:63 of rax, rdx */
++ vcpu->arch.regs[VCPU_REGS_RAX] = msr_info.data & -1u;
++ vcpu->arch.regs[VCPU_REGS_RDX] = (msr_info.data >> 32) & -1u;
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static int handle_wrmsr(struct kvm_vcpu *vcpu)
++{
++ struct msr_data msr;
++ u32 ecx = vcpu->arch.regs[VCPU_REGS_RCX];
++ u64 data = (vcpu->arch.regs[VCPU_REGS_RAX] & -1u)
++ | ((u64)(vcpu->arch.regs[VCPU_REGS_RDX] & -1u) << 32);
++
++ msr.data = data;
++ msr.index = ecx;
++ msr.host_initiated = false;
++ if (kvm_set_msr(vcpu, &msr) != 0) {
++ trace_kvm_msr_write_ex(ecx, data);
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++
++ trace_kvm_msr_write(ecx, data);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static int handle_tpr_below_threshold(struct kvm_vcpu *vcpu)
++{
++ kvm_apic_update_ppr(vcpu);
++ return 1;
++}
++
++static int handle_interrupt_window(struct kvm_vcpu *vcpu)
++{
++ vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
++ CPU_BASED_VIRTUAL_INTR_PENDING);
++
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
++
++ ++vcpu->stat.irq_window_exits;
++ return 1;
++}
++
++static int handle_halt(struct kvm_vcpu *vcpu)
++{
++ return kvm_emulate_halt(vcpu);
++}
++
++static int handle_vmcall(struct kvm_vcpu *vcpu)
++{
++ return kvm_emulate_hypercall(vcpu);
++}
++
++static int handle_invd(struct kvm_vcpu *vcpu)
++{
++ return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
++}
++
++static int handle_invlpg(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++
++ kvm_mmu_invlpg(vcpu, exit_qualification);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static int handle_rdpmc(struct kvm_vcpu *vcpu)
++{
++ int err;
++
++ err = kvm_rdpmc(vcpu);
++ return kvm_complete_insn_gp(vcpu, err);
++}
++
++static int handle_wbinvd(struct kvm_vcpu *vcpu)
++{
++ return kvm_emulate_wbinvd(vcpu);
++}
++
++static int handle_xsetbv(struct kvm_vcpu *vcpu)
++{
++ u64 new_bv = kvm_read_edx_eax(vcpu);
++ u32 index = kvm_register_read(vcpu, VCPU_REGS_RCX);
++
++ if (kvm_set_xcr(vcpu, index, new_bv) == 0)
++ return kvm_skip_emulated_instruction(vcpu);
++ return 1;
++}
++
++static int handle_xsaves(struct kvm_vcpu *vcpu)
++{
++ kvm_skip_emulated_instruction(vcpu);
++ WARN(1, "this should never happen\n");
++ return 1;
++}
++
++static int handle_xrstors(struct kvm_vcpu *vcpu)
++{
++ kvm_skip_emulated_instruction(vcpu);
++ WARN(1, "this should never happen\n");
++ return 1;
++}
++
++static int handle_apic_access(struct kvm_vcpu *vcpu)
++{
++ if (likely(fasteoi)) {
++ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ int access_type, offset;
++
++ access_type = exit_qualification & APIC_ACCESS_TYPE;
++ offset = exit_qualification & APIC_ACCESS_OFFSET;
++ /*
++ * Sane guest uses MOV to write EOI, with written value
++ * not cared. So make a short-circuit here by avoiding
++ * heavy instruction emulation.
++ */
++ if ((access_type == TYPE_LINEAR_APIC_INST_WRITE) &&
++ (offset == APIC_EOI)) {
++ kvm_lapic_set_eoi(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ }
++ return kvm_emulate_instruction(vcpu, 0) == EMULATE_DONE;
++}
++
++static int handle_apic_eoi_induced(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ int vector = exit_qualification & 0xff;
++
++ /* EOI-induced VM exit is trap-like and thus no need to adjust IP */
++ kvm_apic_set_eoi_accelerated(vcpu, vector);
++ return 1;
++}
++
++static int handle_apic_write(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ u32 offset = exit_qualification & 0xfff;
++
++ /* APIC-write VM exit is trap-like and thus no need to adjust IP */
++ kvm_apic_write_nodecode(vcpu, offset);
++ return 1;
++}
++
++static int handle_task_switch(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long exit_qualification;
++ bool has_error_code = false;
++ u32 error_code = 0;
++ u16 tss_selector;
++ int reason, type, idt_v, idt_index;
++
++ idt_v = (vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK);
++ idt_index = (vmx->idt_vectoring_info & VECTORING_INFO_VECTOR_MASK);
++ type = (vmx->idt_vectoring_info & VECTORING_INFO_TYPE_MASK);
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++
++ reason = (u32)exit_qualification >> 30;
++ if (reason == TASK_SWITCH_GATE && idt_v) {
++ switch (type) {
++ case INTR_TYPE_NMI_INTR:
++ vcpu->arch.nmi_injected = false;
++ vmx_set_nmi_mask(vcpu, true);
++ break;
++ case INTR_TYPE_EXT_INTR:
++ case INTR_TYPE_SOFT_INTR:
++ kvm_clear_interrupt_queue(vcpu);
++ break;
++ case INTR_TYPE_HARD_EXCEPTION:
++ if (vmx->idt_vectoring_info &
++ VECTORING_INFO_DELIVER_CODE_MASK) {
++ has_error_code = true;
++ error_code =
++ vmcs_read32(IDT_VECTORING_ERROR_CODE);
++ }
++ /* fall through */
++ case INTR_TYPE_SOFT_EXCEPTION:
++ kvm_clear_exception_queue(vcpu);
++ break;
++ default:
++ break;
++ }
++ }
++ tss_selector = exit_qualification;
++
++ if (!idt_v || (type != INTR_TYPE_HARD_EXCEPTION &&
++ type != INTR_TYPE_EXT_INTR &&
++ type != INTR_TYPE_NMI_INTR))
++ skip_emulated_instruction(vcpu);
++
++ if (kvm_task_switch(vcpu, tss_selector,
++ type == INTR_TYPE_SOFT_INTR ? idt_index : -1, reason,
++ has_error_code, error_code) == EMULATE_FAIL) {
++ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
++ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
++ vcpu->run->internal.ndata = 0;
++ return 0;
++ }
++
++ /*
++ * TODO: What about debug traps on tss switch?
++ * Are we supposed to inject them and update dr6?
++ */
++
++ return 1;
++}
++
++static int handle_ept_violation(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification;
++ gpa_t gpa;
++ u64 error_code;
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++
++ /*
++ * EPT violation happened while executing iret from NMI,
++ * "blocked by NMI" bit has to be set before next VM entry.
++ * There are errata that may cause this bit to not be set:
++ * AAK134, BY25.
++ */
++ if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++ enable_vnmi &&
++ (exit_qualification & INTR_INFO_UNBLOCK_NMI))
++ vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
++
++ gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
++ trace_kvm_page_fault(gpa, exit_qualification);
++
++ /* Is it a read fault? */
++ error_code = (exit_qualification & EPT_VIOLATION_ACC_READ)
++ ? PFERR_USER_MASK : 0;
++ /* Is it a write fault? */
++ error_code |= (exit_qualification & EPT_VIOLATION_ACC_WRITE)
++ ? PFERR_WRITE_MASK : 0;
++ /* Is it a fetch fault? */
++ error_code |= (exit_qualification & EPT_VIOLATION_ACC_INSTR)
++ ? PFERR_FETCH_MASK : 0;
++ /* ept page table entry is present? */
++ error_code |= (exit_qualification &
++ (EPT_VIOLATION_READABLE | EPT_VIOLATION_WRITABLE |
++ EPT_VIOLATION_EXECUTABLE))
++ ? PFERR_PRESENT_MASK : 0;
++
++ error_code |= (exit_qualification & 0x100) != 0 ?
++ PFERR_GUEST_FINAL_MASK : PFERR_GUEST_PAGE_MASK;
++
++ vcpu->arch.exit_qualification = exit_qualification;
++ return kvm_mmu_page_fault(vcpu, gpa, error_code, NULL, 0);
++}
++
++static int handle_ept_misconfig(struct kvm_vcpu *vcpu)
++{
++ gpa_t gpa;
++
++ /*
++ * A nested guest cannot optimize MMIO vmexits, because we have an
++ * nGPA here instead of the required GPA.
++ */
++ gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
++ if (!is_guest_mode(vcpu) &&
++ !kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, gpa, 0, NULL)) {
++ trace_kvm_fast_mmio(gpa);
++ /*
++ * Doing kvm_skip_emulated_instruction() depends on undefined
++ * behavior: Intel's manual doesn't mandate
++ * VM_EXIT_INSTRUCTION_LEN to be set in VMCS when EPT MISCONFIG
++ * occurs and while on real hardware it was observed to be set,
++ * other hypervisors (namely Hyper-V) don't set it, we end up
++ * advancing IP with some random value. Disable fast mmio when
++ * running nested and keep it for real hardware in hope that
++ * VM_EXIT_INSTRUCTION_LEN will always be set correctly.
++ */
++ if (!static_cpu_has(X86_FEATURE_HYPERVISOR))
++ return kvm_skip_emulated_instruction(vcpu);
++ else
++ return kvm_emulate_instruction(vcpu, EMULTYPE_SKIP) ==
++ EMULATE_DONE;
++ }
++
++ return kvm_mmu_page_fault(vcpu, gpa, PFERR_RSVD_MASK, NULL, 0);
++}
++
++static int handle_nmi_window(struct kvm_vcpu *vcpu)
++{
++ WARN_ON_ONCE(!enable_vnmi);
++ vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
++ CPU_BASED_VIRTUAL_NMI_PENDING);
++ ++vcpu->stat.nmi_window_exits;
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
++
++ return 1;
++}
++
++static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ enum emulation_result err = EMULATE_DONE;
++ int ret = 1;
++ u32 cpu_exec_ctrl;
++ bool intr_window_requested;
++ unsigned count = 130;
++
++ /*
++ * We should never reach the point where we are emulating L2
++ * due to invalid guest state as that means we incorrectly
++ * allowed a nested VMEntry with an invalid vmcs12.
++ */
++ WARN_ON_ONCE(vmx->emulation_required && vmx->nested.nested_run_pending);
++
++ cpu_exec_ctrl = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
++ intr_window_requested = cpu_exec_ctrl & CPU_BASED_VIRTUAL_INTR_PENDING;
++
++ while (vmx->emulation_required && count-- != 0) {
++ if (intr_window_requested && vmx_interrupt_allowed(vcpu))
++ return handle_interrupt_window(&vmx->vcpu);
++
++ if (kvm_test_request(KVM_REQ_EVENT, vcpu))
++ return 1;
++
++ err = kvm_emulate_instruction(vcpu, 0);
++
++ if (err == EMULATE_USER_EXIT) {
++ ++vcpu->stat.mmio_exits;
++ ret = 0;
++ goto out;
++ }
++
++ if (err != EMULATE_DONE)
++ goto emulation_error;
++
++ if (vmx->emulation_required && !vmx->rmode.vm86_active &&
++ vcpu->arch.exception.pending)
++ goto emulation_error;
++
++ if (vcpu->arch.halt_request) {
++ vcpu->arch.halt_request = 0;
++ ret = kvm_vcpu_halt(vcpu);
++ goto out;
++ }
++
++ if (signal_pending(current))
++ goto out;
++ if (need_resched())
++ schedule();
++ }
++
++out:
++ return ret;
++
++emulation_error:
++ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
++ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
++ vcpu->run->internal.ndata = 0;
++ return 0;
++}
++
++static void grow_ple_window(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int old = vmx->ple_window;
++
++ vmx->ple_window = __grow_ple_window(old, ple_window,
++ ple_window_grow,
++ ple_window_max);
++
++ if (vmx->ple_window != old)
++ vmx->ple_window_dirty = true;
++
++ trace_kvm_ple_window_grow(vcpu->vcpu_id, vmx->ple_window, old);
++}
++
++static void shrink_ple_window(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int old = vmx->ple_window;
++
++ vmx->ple_window = __shrink_ple_window(old, ple_window,
++ ple_window_shrink,
++ ple_window);
++
++ if (vmx->ple_window != old)
++ vmx->ple_window_dirty = true;
++
++ trace_kvm_ple_window_shrink(vcpu->vcpu_id, vmx->ple_window, old);
++}
++
++/*
++ * Handler for POSTED_INTERRUPT_WAKEUP_VECTOR.
++ */
++static void wakeup_handler(void)
++{
++ struct kvm_vcpu *vcpu;
++ int cpu = smp_processor_id();
++
++ spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
++ list_for_each_entry(vcpu, &per_cpu(blocked_vcpu_on_cpu, cpu),
++ blocked_vcpu_list) {
++ struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
++
++ if (pi_test_on(pi_desc) == 1)
++ kvm_vcpu_kick(vcpu);
++ }
++ spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
++}
++
++static void vmx_enable_tdp(void)
++{
++ kvm_mmu_set_mask_ptes(VMX_EPT_READABLE_MASK,
++ enable_ept_ad_bits ? VMX_EPT_ACCESS_BIT : 0ull,
++ enable_ept_ad_bits ? VMX_EPT_DIRTY_BIT : 0ull,
++ 0ull, VMX_EPT_EXECUTABLE_MASK,
++ cpu_has_vmx_ept_execute_only() ? 0ull : VMX_EPT_READABLE_MASK,
++ VMX_EPT_RWX_MASK, 0ull);
++
++ ept_set_mmio_spte_mask();
++ kvm_enable_tdp();
++}
++
++static __init int hardware_setup(void)
++{
++ unsigned long host_bndcfgs;
++ int r = -ENOMEM, i;
++
++ rdmsrl_safe(MSR_EFER, &host_efer);
++
++ for (i = 0; i < ARRAY_SIZE(vmx_msr_index); ++i)
++ kvm_define_shared_msr(i, vmx_msr_index[i]);
++
++ for (i = 0; i < VMX_BITMAP_NR; i++) {
++ vmx_bitmap[i] = (unsigned long *)__get_free_page(GFP_KERNEL);
++ if (!vmx_bitmap[i])
++ goto out;
++ }
++
++ memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE);
++ memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE);
++
++ if (setup_vmcs_config(&vmcs_config) < 0) {
++ r = -EIO;
++ goto out;
++ }
++
++ if (boot_cpu_has(X86_FEATURE_NX))
++ kvm_enable_efer_bits(EFER_NX);
++
++ if (boot_cpu_has(X86_FEATURE_MPX)) {
++ rdmsrl(MSR_IA32_BNDCFGS, host_bndcfgs);
++ WARN_ONCE(host_bndcfgs, "KVM: BNDCFGS in host will be lost");
++ }
++
++ if (boot_cpu_has(X86_FEATURE_XSAVES))
++ rdmsrl(MSR_IA32_XSS, host_xss);
++
++ if (!cpu_has_vmx_vpid() || !cpu_has_vmx_invvpid() ||
++ !(cpu_has_vmx_invvpid_single() || cpu_has_vmx_invvpid_global()))
++ enable_vpid = 0;
++
++ if (!cpu_has_vmx_ept() ||
++ !cpu_has_vmx_ept_4levels() ||
++ !cpu_has_vmx_ept_mt_wb() ||
++ !cpu_has_vmx_invept_global())
++ enable_ept = 0;
++
++ if (!cpu_has_vmx_ept_ad_bits() || !enable_ept)
++ enable_ept_ad_bits = 0;
++
++ if (!cpu_has_vmx_unrestricted_guest() || !enable_ept)
++ enable_unrestricted_guest = 0;
++
++ if (!cpu_has_vmx_flexpriority())
++ flexpriority_enabled = 0;
++
++ if (!cpu_has_virtual_nmis())
++ enable_vnmi = 0;
++
++ /*
++ * set_apic_access_page_addr() is used to reload apic access
++ * page upon invalidation. No need to do anything if not
++ * using the APIC_ACCESS_ADDR VMCS field.
++ */
++ if (!flexpriority_enabled)
++ kvm_x86_ops->set_apic_access_page_addr = NULL;
++
++ if (!cpu_has_vmx_tpr_shadow())
++ kvm_x86_ops->update_cr8_intercept = NULL;
++
++ if (enable_ept && !cpu_has_vmx_ept_2m_page())
++ kvm_disable_largepages();
++
++#if IS_ENABLED(CONFIG_HYPERV)
++ if (ms_hyperv.nested_features & HV_X64_NESTED_GUEST_MAPPING_FLUSH
++ && enable_ept)
++ kvm_x86_ops->tlb_remote_flush = vmx_hv_remote_flush_tlb;
++#endif
++
++ if (!cpu_has_vmx_ple()) {
++ ple_gap = 0;
++ ple_window = 0;
++ ple_window_grow = 0;
++ ple_window_max = 0;
++ ple_window_shrink = 0;
++ }
++
++ if (!cpu_has_vmx_apicv()) {
++ enable_apicv = 0;
++ kvm_x86_ops->sync_pir_to_irr = NULL;
++ }
++
++ if (cpu_has_vmx_tsc_scaling()) {
++ kvm_has_tsc_control = true;
++ kvm_max_tsc_scaling_ratio = KVM_VMX_TSC_MULTIPLIER_MAX;
++ kvm_tsc_scaling_ratio_frac_bits = 48;
++ }
++
++ set_bit(0, vmx_vpid_bitmap); /* 0 is reserved for host */
++
++ if (enable_ept)
++ vmx_enable_tdp();
++ else
++ kvm_disable_tdp();
++
++ if (!nested) {
++ kvm_x86_ops->get_nested_state = NULL;
++ kvm_x86_ops->set_nested_state = NULL;
++ }
++
++ /*
++ * Only enable PML when hardware supports PML feature, and both EPT
++ * and EPT A/D bit features are enabled -- PML depends on them to work.
++ */
++ if (!enable_ept || !enable_ept_ad_bits || !cpu_has_vmx_pml())
++ enable_pml = 0;
++
++ if (!enable_pml) {
++ kvm_x86_ops->slot_enable_log_dirty = NULL;
++ kvm_x86_ops->slot_disable_log_dirty = NULL;
++ kvm_x86_ops->flush_log_dirty = NULL;
++ kvm_x86_ops->enable_log_dirty_pt_masked = NULL;
++ }
++
++ if (!cpu_has_vmx_preemption_timer())
++ kvm_x86_ops->request_immediate_exit = __kvm_request_immediate_exit;
++
++ if (cpu_has_vmx_preemption_timer() && enable_preemption_timer) {
++ u64 vmx_msr;
++
++ rdmsrl(MSR_IA32_VMX_MISC, vmx_msr);
++ cpu_preemption_timer_multi =
++ vmx_msr & VMX_MISC_PREEMPTION_TIMER_RATE_MASK;
++ } else {
++ kvm_x86_ops->set_hv_timer = NULL;
++ kvm_x86_ops->cancel_hv_timer = NULL;
++ }
++
++ if (!cpu_has_vmx_shadow_vmcs())
++ enable_shadow_vmcs = 0;
++ if (enable_shadow_vmcs)
++ init_vmcs_shadow_fields();
++
++ kvm_set_posted_intr_wakeup_handler(wakeup_handler);
++ nested_vmx_setup_ctls_msrs(&vmcs_config.nested, enable_apicv);
++
++ kvm_mce_cap_supported |= MCG_LMCE_P;
++
++ r = alloc_kvm_area();
++ if (r)
++ goto out;
++ return 0;
++
++out:
++ for (i = 0; i < VMX_BITMAP_NR; i++)
++ free_page((unsigned long)vmx_bitmap[i]);
++
++ return r;
++}
++
++static __exit void hardware_unsetup(void)
++{
++ int i;
++
++ for (i = 0; i < VMX_BITMAP_NR; i++)
++ free_page((unsigned long)vmx_bitmap[i]);
++
++ free_kvm_area();
++}
++
++/*
++ * Indicate a busy-waiting vcpu in spinlock. We do not enable the PAUSE
++ * exiting, so only get here on cpu with PAUSE-Loop-Exiting.
++ */
++static int handle_pause(struct kvm_vcpu *vcpu)
++{
++ if (!kvm_pause_in_guest(vcpu->kvm))
++ grow_ple_window(vcpu);
++
++ /*
++ * Intel sdm vol3 ch-25.1.3 says: The "PAUSE-loop exiting"
++ * VM-execution control is ignored if CPL > 0. OTOH, KVM
++ * never set PAUSE_EXITING and just set PLE if supported,
++ * so the vcpu must be CPL=0 if it gets a PAUSE exit.
++ */
++ kvm_vcpu_on_spin(vcpu, true);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static int handle_nop(struct kvm_vcpu *vcpu)
++{
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static int handle_mwait(struct kvm_vcpu *vcpu)
++{
++ printk_once(KERN_WARNING "kvm: MWAIT instruction emulated as NOP!\n");
++ return handle_nop(vcpu);
++}
++
++static int handle_invalid_op(struct kvm_vcpu *vcpu)
++{
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++}
++
++static int handle_monitor_trap(struct kvm_vcpu *vcpu)
++{
++ return 1;
++}
++
++static int handle_monitor(struct kvm_vcpu *vcpu)
++{
++ printk_once(KERN_WARNING "kvm: MONITOR instruction emulated as NOP!\n");
++ return handle_nop(vcpu);
++}
++
++/*
++ * The following 3 functions, nested_vmx_succeed()/failValid()/failInvalid(),
++ * set the success or error code of an emulated VMX instruction, as specified
++ * by Vol 2B, VMX Instruction Reference, "Conventions".
++ */
++static void nested_vmx_succeed(struct kvm_vcpu *vcpu)
++{
++ vmx_set_rflags(vcpu, vmx_get_rflags(vcpu)
++ & ~(X86_EFLAGS_CF | X86_EFLAGS_PF | X86_EFLAGS_AF |
++ X86_EFLAGS_ZF | X86_EFLAGS_SF | X86_EFLAGS_OF));
++}
++
++static void nested_vmx_failInvalid(struct kvm_vcpu *vcpu)
++{
++ vmx_set_rflags(vcpu, (vmx_get_rflags(vcpu)
++ & ~(X86_EFLAGS_PF | X86_EFLAGS_AF | X86_EFLAGS_ZF |
++ X86_EFLAGS_SF | X86_EFLAGS_OF))
++ | X86_EFLAGS_CF);
++}
++
++static void nested_vmx_failValid(struct kvm_vcpu *vcpu,
++ u32 vm_instruction_error)
++{
++ if (to_vmx(vcpu)->nested.current_vmptr == -1ull) {
++ /*
++ * failValid writes the error number to the current VMCS, which
++ * can't be done there isn't a current VMCS.
++ */
++ nested_vmx_failInvalid(vcpu);
++ return;
++ }
++ vmx_set_rflags(vcpu, (vmx_get_rflags(vcpu)
++ & ~(X86_EFLAGS_CF | X86_EFLAGS_PF | X86_EFLAGS_AF |
++ X86_EFLAGS_SF | X86_EFLAGS_OF))
++ | X86_EFLAGS_ZF);
++ get_vmcs12(vcpu)->vm_instruction_error = vm_instruction_error;
++ /*
++ * We don't need to force a shadow sync because
++ * VM_INSTRUCTION_ERROR is not shadowed
++ */
++}
++
++static void nested_vmx_abort(struct kvm_vcpu *vcpu, u32 indicator)
++{
++ /* TODO: not to reset guest simply here. */
++ kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
++ pr_debug_ratelimited("kvm: nested vmx abort, indicator %d\n", indicator);
++}
++
++static enum hrtimer_restart vmx_preemption_timer_fn(struct hrtimer *timer)
++{
++ struct vcpu_vmx *vmx =
++ container_of(timer, struct vcpu_vmx, nested.preemption_timer);
++
++ vmx->nested.preemption_timer_expired = true;
++ kvm_make_request(KVM_REQ_EVENT, &vmx->vcpu);
++ kvm_vcpu_kick(&vmx->vcpu);
++
++ return HRTIMER_NORESTART;
++}
++
++/*
++ * Decode the memory-address operand of a vmx instruction, as recorded on an
++ * exit caused by such an instruction (run by a guest hypervisor).
++ * On success, returns 0. When the operand is invalid, returns 1 and throws
++ * #UD or #GP.
++ */
++static int get_vmx_mem_address(struct kvm_vcpu *vcpu,
++ unsigned long exit_qualification,
++ u32 vmx_instruction_info, bool wr, gva_t *ret)
++{
++ gva_t off;
++ bool exn;
++ struct kvm_segment s;
++
++ /*
++ * According to Vol. 3B, "Information for VM Exits Due to Instruction
++ * Execution", on an exit, vmx_instruction_info holds most of the
++ * addressing components of the operand. Only the displacement part
++ * is put in exit_qualification (see 3B, "Basic VM-Exit Information").
++ * For how an actual address is calculated from all these components,
++ * refer to Vol. 1, "Operand Addressing".
++ */
++ int scaling = vmx_instruction_info & 3;
++ int addr_size = (vmx_instruction_info >> 7) & 7;
++ bool is_reg = vmx_instruction_info & (1u << 10);
++ int seg_reg = (vmx_instruction_info >> 15) & 7;
++ int index_reg = (vmx_instruction_info >> 18) & 0xf;
++ bool index_is_valid = !(vmx_instruction_info & (1u << 22));
++ int base_reg = (vmx_instruction_info >> 23) & 0xf;
++ bool base_is_valid = !(vmx_instruction_info & (1u << 27));
++
++ if (is_reg) {
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++ }
++
++ /* Addr = segment_base + offset */
++ /* offset = base + [index * scale] + displacement */
++ off = exit_qualification; /* holds the displacement */
++ if (addr_size == 1)
++ off = (gva_t)sign_extend64(off, 31);
++ else if (addr_size == 0)
++ off = (gva_t)sign_extend64(off, 15);
++ if (base_is_valid)
++ off += kvm_register_read(vcpu, base_reg);
++ if (index_is_valid)
++ off += kvm_register_read(vcpu, index_reg)<<scaling;
++ vmx_get_segment(vcpu, &s, seg_reg);
++
++ /*
++ * The effective address, i.e. @off, of a memory operand is truncated
++ * based on the address size of the instruction. Note that this is
++ * the *effective address*, i.e. the address prior to accounting for
++ * the segment's base.
++ */
++ if (addr_size == 1) /* 32 bit */
++ off &= 0xffffffff;
++ else if (addr_size == 0) /* 16 bit */
++ off &= 0xffff;
++
++ /* Checks for #GP/#SS exceptions. */
++ exn = false;
++ if (is_long_mode(vcpu)) {
++ /*
++ * The virtual/linear address is never truncated in 64-bit
++ * mode, e.g. a 32-bit address size can yield a 64-bit virtual
++ * address when using FS/GS with a non-zero base.
++ */
++ *ret = s.base + off;
++
++ /* Long mode: #GP(0)/#SS(0) if the memory address is in a
++ * non-canonical form. This is the only check on the memory
++ * destination for long mode!
++ */
++ exn = is_noncanonical_address(*ret, vcpu);
++ } else if (is_protmode(vcpu)) {
++ /*
++ * When not in long mode, the virtual/linear address is
++ * unconditionally truncated to 32 bits regardless of the
++ * address size.
++ */
++ *ret = (s.base + off) & 0xffffffff;
++
++ /* Protected mode: apply checks for segment validity in the
++ * following order:
++ * - segment type check (#GP(0) may be thrown)
++ * - usability check (#GP(0)/#SS(0))
++ * - limit check (#GP(0)/#SS(0))
++ */
++ if (wr)
++ /* #GP(0) if the destination operand is located in a
++ * read-only data segment or any code segment.
++ */
++ exn = ((s.type & 0xa) == 0 || (s.type & 8));
++ else
++ /* #GP(0) if the source operand is located in an
++ * execute-only code segment
++ */
++ exn = ((s.type & 0xa) == 8);
++ if (exn) {
++ kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
++ return 1;
++ }
++ /* Protected mode: #GP(0)/#SS(0) if the segment is unusable.
++ */
++ exn = (s.unusable != 0);
++
++ /*
++ * Protected mode: #GP(0)/#SS(0) if the memory operand is
++ * outside the segment limit. All CPUs that support VMX ignore
++ * limit checks for flat segments, i.e. segments with base==0,
++ * limit==0xffffffff and of type expand-up data or code.
++ */
++ if (!(s.base == 0 && s.limit == 0xffffffff &&
++ ((s.type & 8) || !(s.type & 4))))
++ exn = exn || (off + sizeof(u64) > s.limit);
++ }
++ if (exn) {
++ kvm_queue_exception_e(vcpu,
++ seg_reg == VCPU_SREG_SS ?
++ SS_VECTOR : GP_VECTOR,
++ 0);
++ return 1;
++ }
++
++ return 0;
++}
++
++static int nested_vmx_get_vmptr(struct kvm_vcpu *vcpu, gpa_t *vmpointer)
++{
++ gva_t gva;
++ struct x86_exception e;
++
++ if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
++ vmcs_read32(VMX_INSTRUCTION_INFO), false, &gva))
++ return 1;
++
++ if (kvm_read_guest_virt(vcpu, gva, vmpointer, sizeof(*vmpointer), &e)) {
++ kvm_inject_page_fault(vcpu, &e);
++ return 1;
++ }
++
++ return 0;
++}
++
++/*
++ * Allocate a shadow VMCS and associate it with the currently loaded
++ * VMCS, unless such a shadow VMCS already exists. The newly allocated
++ * VMCS is also VMCLEARed, so that it is ready for use.
++ */
++static struct vmcs *alloc_shadow_vmcs(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct loaded_vmcs *loaded_vmcs = vmx->loaded_vmcs;
++
++ /*
++ * We should allocate a shadow vmcs for vmcs01 only when L1
++ * executes VMXON and free it when L1 executes VMXOFF.
++ * As it is invalid to execute VMXON twice, we shouldn't reach
++ * here when vmcs01 already have an allocated shadow vmcs.
++ */
++ WARN_ON(loaded_vmcs == &vmx->vmcs01 && loaded_vmcs->shadow_vmcs);
++
++ if (!loaded_vmcs->shadow_vmcs) {
++ loaded_vmcs->shadow_vmcs = alloc_vmcs(true);
++ if (loaded_vmcs->shadow_vmcs)
++ vmcs_clear(loaded_vmcs->shadow_vmcs);
++ }
++ return loaded_vmcs->shadow_vmcs;
++}
++
++static int enter_vmx_operation(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int r;
++
++ r = alloc_loaded_vmcs(&vmx->nested.vmcs02);
++ if (r < 0)
++ goto out_vmcs02;
++
++ vmx->nested.cached_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
++ if (!vmx->nested.cached_vmcs12)
++ goto out_cached_vmcs12;
++
++ vmx->nested.cached_shadow_vmcs12 = kzalloc(VMCS12_SIZE, GFP_KERNEL);
++ if (!vmx->nested.cached_shadow_vmcs12)
++ goto out_cached_shadow_vmcs12;
++
++ if (enable_shadow_vmcs && !alloc_shadow_vmcs(vcpu))
++ goto out_shadow_vmcs;
++
++ hrtimer_init(&vmx->nested.preemption_timer, CLOCK_MONOTONIC,
++ HRTIMER_MODE_REL_PINNED);
++ vmx->nested.preemption_timer.function = vmx_preemption_timer_fn;
++
++ vmx->nested.vpid02 = allocate_vpid();
++
++ vmx->nested.vmxon = true;
++ return 0;
++
++out_shadow_vmcs:
++ kfree(vmx->nested.cached_shadow_vmcs12);
++
++out_cached_shadow_vmcs12:
++ kfree(vmx->nested.cached_vmcs12);
++
++out_cached_vmcs12:
++ free_loaded_vmcs(&vmx->nested.vmcs02);
++
++out_vmcs02:
++ return -ENOMEM;
++}
++
++/*
++ * Emulate the VMXON instruction.
++ * Currently, we just remember that VMX is active, and do not save or even
++ * inspect the argument to VMXON (the so-called "VMXON pointer") because we
++ * do not currently need to store anything in that guest-allocated memory
++ * region. Consequently, VMCLEAR and VMPTRLD also do not verify that the their
++ * argument is different from the VMXON pointer (which the spec says they do).
++ */
++static int handle_vmon(struct kvm_vcpu *vcpu)
++{
++ int ret;
++ gpa_t vmptr;
++ struct page *page;
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ const u64 VMXON_NEEDED_FEATURES = FEATURE_CONTROL_LOCKED
++ | FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
++
++ /*
++ * The Intel VMX Instruction Reference lists a bunch of bits that are
++ * prerequisite to running VMXON, most notably cr4.VMXE must be set to
++ * 1 (see vmx_set_cr4() for when we allow the guest to set this).
++ * Otherwise, we should fail with #UD. But most faulting conditions
++ * have already been checked by hardware, prior to the VM-exit for
++ * VMXON. We do test guest cr4.VMXE because processor CR4 always has
++ * that bit set to 1 in non-root mode.
++ */
++ if (!kvm_read_cr4_bits(vcpu, X86_CR4_VMXE)) {
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++ }
++
++ /* CPL=0 must be checked manually. */
++ if (vmx_get_cpl(vcpu)) {
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++
++ if (vmx->nested.vmxon) {
++ nested_vmx_failValid(vcpu, VMXERR_VMXON_IN_VMX_ROOT_OPERATION);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ if ((vmx->msr_ia32_feature_control & VMXON_NEEDED_FEATURES)
++ != VMXON_NEEDED_FEATURES) {
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++
++ if (nested_vmx_get_vmptr(vcpu, &vmptr))
++ return 1;
++
++ /*
++ * SDM 3: 24.11.5
++ * The first 4 bytes of VMXON region contain the supported
++ * VMCS revision identifier
++ *
++ * Note - IA32_VMX_BASIC[48] will never be 1 for the nested case;
++ * which replaces physical address width with 32
++ */
++ if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
++ nested_vmx_failInvalid(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ page = kvm_vcpu_gpa_to_page(vcpu, vmptr);
++ if (is_error_page(page)) {
++ nested_vmx_failInvalid(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ if (*(u32 *)kmap(page) != VMCS12_REVISION) {
++ kunmap(page);
++ kvm_release_page_clean(page);
++ nested_vmx_failInvalid(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ kunmap(page);
++ kvm_release_page_clean(page);
++
++ vmx->nested.vmxon_ptr = vmptr;
++ ret = enter_vmx_operation(vcpu);
++ if (ret)
++ return ret;
++
++ nested_vmx_succeed(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++/*
++ * Intel's VMX Instruction Reference specifies a common set of prerequisites
++ * for running VMX instructions (except VMXON, whose prerequisites are
++ * slightly different). It also specifies what exception to inject otherwise.
++ * Note that many of these exceptions have priority over VM exits, so they
++ * don't have to be checked again here.
++ */
++static int nested_vmx_check_permission(struct kvm_vcpu *vcpu)
++{
++ if (!to_vmx(vcpu)->nested.vmxon) {
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 0;
++ }
++
++ if (vmx_get_cpl(vcpu)) {
++ kvm_inject_gp(vcpu, 0);
++ return 0;
++ }
++
++ return 1;
++}
++
++static void vmx_disable_shadow_vmcs(struct vcpu_vmx *vmx)
++{
++ vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL, SECONDARY_EXEC_SHADOW_VMCS);
++ vmcs_write64(VMCS_LINK_POINTER, -1ull);
++ vmx->nested.sync_shadow_vmcs = false;
++}
++
++static inline void nested_release_vmcs12(struct vcpu_vmx *vmx)
++{
++ if (vmx->nested.current_vmptr == -1ull)
++ return;
++
++ if (enable_shadow_vmcs) {
++ /* copy to memory all shadowed fields in case
++ they were modified */
++ copy_shadow_to_vmcs12(vmx);
++ vmx_disable_shadow_vmcs(vmx);
++ }
++ vmx->nested.posted_intr_nv = -1;
++
++ /* Flush VMCS12 to guest memory */
++ kvm_vcpu_write_guest_page(&vmx->vcpu,
++ vmx->nested.current_vmptr >> PAGE_SHIFT,
++ vmx->nested.cached_vmcs12, 0, VMCS12_SIZE);
++
++ vmx->nested.current_vmptr = -1ull;
++}
++
++/*
++ * Free whatever needs to be freed from vmx->nested when L1 goes down, or
++ * just stops using VMX.
++ */
++static void free_nested(struct vcpu_vmx *vmx)
++{
++ if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
++ return;
++
++ kvm_clear_request(KVM_REQ_GET_VMCS12_PAGES, &vmx->vcpu);
++
++ hrtimer_cancel(&vmx->nested.preemption_timer);
++ vmx->nested.vmxon = false;
++ vmx->nested.smm.vmxon = false;
++ free_vpid(vmx->nested.vpid02);
++ vmx->nested.posted_intr_nv = -1;
++ vmx->nested.current_vmptr = -1ull;
++ if (enable_shadow_vmcs) {
++ vmx_disable_shadow_vmcs(vmx);
++ vmcs_clear(vmx->vmcs01.shadow_vmcs);
++ free_vmcs(vmx->vmcs01.shadow_vmcs);
++ vmx->vmcs01.shadow_vmcs = NULL;
++ }
++ kfree(vmx->nested.cached_vmcs12);
++ kfree(vmx->nested.cached_shadow_vmcs12);
++ /* Unpin physical memory we referred to in the vmcs02 */
++ if (vmx->nested.apic_access_page) {
++ kvm_release_page_dirty(vmx->nested.apic_access_page);
++ vmx->nested.apic_access_page = NULL;
++ }
++ if (vmx->nested.virtual_apic_page) {
++ kvm_release_page_dirty(vmx->nested.virtual_apic_page);
++ vmx->nested.virtual_apic_page = NULL;
++ }
++ if (vmx->nested.pi_desc_page) {
++ kunmap(vmx->nested.pi_desc_page);
++ kvm_release_page_dirty(vmx->nested.pi_desc_page);
++ vmx->nested.pi_desc_page = NULL;
++ vmx->nested.pi_desc = NULL;
++ }
++
++ free_loaded_vmcs(&vmx->nested.vmcs02);
++}
++
++/* Emulate the VMXOFF instruction */
++static int handle_vmoff(struct kvm_vcpu *vcpu)
++{
++ if (!nested_vmx_check_permission(vcpu))
++ return 1;
++ free_nested(to_vmx(vcpu));
++ nested_vmx_succeed(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++/* Emulate the VMCLEAR instruction */
++static int handle_vmclear(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 zero = 0;
++ gpa_t vmptr;
++
++ if (!nested_vmx_check_permission(vcpu))
++ return 1;
++
++ if (nested_vmx_get_vmptr(vcpu, &vmptr))
++ return 1;
++
++ if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
++ nested_vmx_failValid(vcpu, VMXERR_VMCLEAR_INVALID_ADDRESS);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ if (vmptr == vmx->nested.vmxon_ptr) {
++ nested_vmx_failValid(vcpu, VMXERR_VMCLEAR_VMXON_POINTER);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ if (vmptr == vmx->nested.current_vmptr)
++ nested_release_vmcs12(vmx);
++
++ kvm_vcpu_write_guest(vcpu,
++ vmptr + offsetof(struct vmcs12, launch_state),
++ &zero, sizeof(zero));
++
++ nested_vmx_succeed(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch);
++
++/* Emulate the VMLAUNCH instruction */
++static int handle_vmlaunch(struct kvm_vcpu *vcpu)
++{
++ return nested_vmx_run(vcpu, true);
++}
++
++/* Emulate the VMRESUME instruction */
++static int handle_vmresume(struct kvm_vcpu *vcpu)
++{
++
++ return nested_vmx_run(vcpu, false);
++}
++
++/*
++ * Read a vmcs12 field. Since these can have varying lengths and we return
++ * one type, we chose the biggest type (u64) and zero-extend the return value
++ * to that size. Note that the caller, handle_vmread, might need to use only
++ * some of the bits we return here (e.g., on 32-bit guests, only 32 bits of
++ * 64-bit fields are to be returned).
++ */
++static inline int vmcs12_read_any(struct vmcs12 *vmcs12,
++ unsigned long field, u64 *ret)
++{
++ short offset = vmcs_field_to_offset(field);
++ char *p;
++
++ if (offset < 0)
++ return offset;
++
++ p = (char *)vmcs12 + offset;
++
++ switch (vmcs_field_width(field)) {
++ case VMCS_FIELD_WIDTH_NATURAL_WIDTH:
++ *ret = *((natural_width *)p);
++ return 0;
++ case VMCS_FIELD_WIDTH_U16:
++ *ret = *((u16 *)p);
++ return 0;
++ case VMCS_FIELD_WIDTH_U32:
++ *ret = *((u32 *)p);
++ return 0;
++ case VMCS_FIELD_WIDTH_U64:
++ *ret = *((u64 *)p);
++ return 0;
++ default:
++ WARN_ON(1);
++ return -ENOENT;
++ }
++}
++
++
++static inline int vmcs12_write_any(struct vmcs12 *vmcs12,
++ unsigned long field, u64 field_value){
++ short offset = vmcs_field_to_offset(field);
++ char *p = (char *)vmcs12 + offset;
++ if (offset < 0)
++ return offset;
++
++ switch (vmcs_field_width(field)) {
++ case VMCS_FIELD_WIDTH_U16:
++ *(u16 *)p = field_value;
++ return 0;
++ case VMCS_FIELD_WIDTH_U32:
++ *(u32 *)p = field_value;
++ return 0;
++ case VMCS_FIELD_WIDTH_U64:
++ *(u64 *)p = field_value;
++ return 0;
++ case VMCS_FIELD_WIDTH_NATURAL_WIDTH:
++ *(natural_width *)p = field_value;
++ return 0;
++ default:
++ WARN_ON(1);
++ return -ENOENT;
++ }
++
++}
++
++/*
++ * Copy the writable VMCS shadow fields back to the VMCS12, in case
++ * they have been modified by the L1 guest. Note that the "read-only"
++ * VM-exit information fields are actually writable if the vCPU is
++ * configured to support "VMWRITE to any supported field in the VMCS."
++ */
++static void copy_shadow_to_vmcs12(struct vcpu_vmx *vmx)
++{
++ const u16 *fields[] = {
++ shadow_read_write_fields,
++ shadow_read_only_fields
++ };
++ const int max_fields[] = {
++ max_shadow_read_write_fields,
++ max_shadow_read_only_fields
++ };
++ int i, q;
++ unsigned long field;
++ u64 field_value;
++ struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
++
++ if (WARN_ON(!shadow_vmcs))
++ return;
++
++ preempt_disable();
++
++ vmcs_load(shadow_vmcs);
++
++ for (q = 0; q < ARRAY_SIZE(fields); q++) {
++ for (i = 0; i < max_fields[q]; i++) {
++ field = fields[q][i];
++ field_value = __vmcs_readl(field);
++ vmcs12_write_any(get_vmcs12(&vmx->vcpu), field, field_value);
++ }
++ /*
++ * Skip the VM-exit information fields if they are read-only.
++ */
++ if (!nested_cpu_has_vmwrite_any_field(&vmx->vcpu))
++ break;
++ }
++
++ vmcs_clear(shadow_vmcs);
++ vmcs_load(vmx->loaded_vmcs->vmcs);
++
++ preempt_enable();
++}
++
++static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
++{
++ const u16 *fields[] = {
++ shadow_read_write_fields,
++ shadow_read_only_fields
++ };
++ const int max_fields[] = {
++ max_shadow_read_write_fields,
++ max_shadow_read_only_fields
++ };
++ int i, q;
++ unsigned long field;
++ u64 field_value = 0;
++ struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
++
++ if (WARN_ON(!shadow_vmcs))
++ return;
++
++ vmcs_load(shadow_vmcs);
++
++ for (q = 0; q < ARRAY_SIZE(fields); q++) {
++ for (i = 0; i < max_fields[q]; i++) {
++ field = fields[q][i];
++ vmcs12_read_any(get_vmcs12(&vmx->vcpu), field, &field_value);
++ __vmcs_writel(field, field_value);
++ }
++ }
++
++ vmcs_clear(shadow_vmcs);
++ vmcs_load(vmx->loaded_vmcs->vmcs);
++}
++
++/*
++ * VMX instructions which assume a current vmcs12 (i.e., that VMPTRLD was
++ * used before) all generate the same failure when it is missing.
++ */
++static int nested_vmx_check_vmcs12(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ if (vmx->nested.current_vmptr == -1ull) {
++ nested_vmx_failInvalid(vcpu);
++ return 0;
++ }
++ return 1;
++}
++
++static int handle_vmread(struct kvm_vcpu *vcpu)
++{
++ unsigned long field;
++ u64 field_value;
++ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ u32 vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
++ gva_t gva = 0;
++ struct vmcs12 *vmcs12;
++ struct x86_exception e;
++
++ if (!nested_vmx_check_permission(vcpu))
++ return 1;
++
++ if (!nested_vmx_check_vmcs12(vcpu))
++ return kvm_skip_emulated_instruction(vcpu);
++
++ if (!is_guest_mode(vcpu))
++ vmcs12 = get_vmcs12(vcpu);
++ else {
++ /*
++ * When vmcs->vmcs_link_pointer is -1ull, any VMREAD
++ * to shadowed-field sets the ALU flags for VMfailInvalid.
++ */
++ if (get_vmcs12(vcpu)->vmcs_link_pointer == -1ull) {
++ nested_vmx_failInvalid(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ vmcs12 = get_shadow_vmcs12(vcpu);
++ }
++
++ /* Decode instruction info and find the field to read */
++ field = kvm_register_readl(vcpu, (((vmx_instruction_info) >> 28) & 0xf));
++ /* Read the field, zero-extended to a u64 field_value */
++ if (vmcs12_read_any(vmcs12, field, &field_value) < 0) {
++ nested_vmx_failValid(vcpu, VMXERR_UNSUPPORTED_VMCS_COMPONENT);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ /*
++ * Now copy part of this value to register or memory, as requested.
++ * Note that the number of bits actually copied is 32 or 64 depending
++ * on the guest's mode (32 or 64 bit), not on the given field's length.
++ */
++ if (vmx_instruction_info & (1u << 10)) {
++ kvm_register_writel(vcpu, (((vmx_instruction_info) >> 3) & 0xf),
++ field_value);
++ } else {
++ if (get_vmx_mem_address(vcpu, exit_qualification,
++ vmx_instruction_info, true, &gva))
++ return 1;
++ /* _system ok, nested_vmx_check_permission has verified cpl=0 */
++ if (kvm_write_guest_virt_system(vcpu, gva, &field_value,
++ (is_long_mode(vcpu) ? 8 : 4),
++ &e)) {
++ kvm_inject_page_fault(vcpu, &e);
++ return 1;
++ }
++ }
++
++ nested_vmx_succeed(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++
++static int handle_vmwrite(struct kvm_vcpu *vcpu)
++{
++ unsigned long field;
++ gva_t gva;
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ u32 vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
++
++ /* The value to write might be 32 or 64 bits, depending on L1's long
++ * mode, and eventually we need to write that into a field of several
++ * possible lengths. The code below first zero-extends the value to 64
++ * bit (field_value), and then copies only the appropriate number of
++ * bits into the vmcs12 field.
++ */
++ u64 field_value = 0;
++ struct x86_exception e;
++ struct vmcs12 *vmcs12;
++
++ if (!nested_vmx_check_permission(vcpu))
++ return 1;
++
++ if (!nested_vmx_check_vmcs12(vcpu))
++ return kvm_skip_emulated_instruction(vcpu);
++
++ if (vmx_instruction_info & (1u << 10))
++ field_value = kvm_register_readl(vcpu,
++ (((vmx_instruction_info) >> 3) & 0xf));
++ else {
++ if (get_vmx_mem_address(vcpu, exit_qualification,
++ vmx_instruction_info, false, &gva))
++ return 1;
++ if (kvm_read_guest_virt(vcpu, gva, &field_value,
++ (is_64_bit_mode(vcpu) ? 8 : 4), &e)) {
++ kvm_inject_page_fault(vcpu, &e);
++ return 1;
++ }
++ }
++
++
++ field = kvm_register_readl(vcpu, (((vmx_instruction_info) >> 28) & 0xf));
++ /*
++ * If the vCPU supports "VMWRITE to any supported field in the
++ * VMCS," then the "read-only" fields are actually read/write.
++ */
++ if (vmcs_field_readonly(field) &&
++ !nested_cpu_has_vmwrite_any_field(vcpu)) {
++ nested_vmx_failValid(vcpu,
++ VMXERR_VMWRITE_READ_ONLY_VMCS_COMPONENT);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ if (!is_guest_mode(vcpu))
++ vmcs12 = get_vmcs12(vcpu);
++ else {
++ /*
++ * When vmcs->vmcs_link_pointer is -1ull, any VMWRITE
++ * to shadowed-field sets the ALU flags for VMfailInvalid.
++ */
++ if (get_vmcs12(vcpu)->vmcs_link_pointer == -1ull) {
++ nested_vmx_failInvalid(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ vmcs12 = get_shadow_vmcs12(vcpu);
++
++ }
++
++ if (vmcs12_write_any(vmcs12, field, field_value) < 0) {
++ nested_vmx_failValid(vcpu, VMXERR_UNSUPPORTED_VMCS_COMPONENT);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ /*
++ * Do not track vmcs12 dirty-state if in guest-mode
++ * as we actually dirty shadow vmcs12 instead of vmcs12.
++ */
++ if (!is_guest_mode(vcpu)) {
++ switch (field) {
++#define SHADOW_FIELD_RW(x) case x:
++#include "vmx_shadow_fields.h"
++ /*
++ * The fields that can be updated by L1 without a vmexit are
++ * always updated in the vmcs02, the others go down the slow
++ * path of prepare_vmcs02.
++ */
++ break;
++ default:
++ vmx->nested.dirty_vmcs12 = true;
++ break;
++ }
++ }
++
++ nested_vmx_succeed(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static void set_current_vmptr(struct vcpu_vmx *vmx, gpa_t vmptr)
++{
++ vmx->nested.current_vmptr = vmptr;
++ if (enable_shadow_vmcs) {
++ vmcs_set_bits(SECONDARY_VM_EXEC_CONTROL,
++ SECONDARY_EXEC_SHADOW_VMCS);
++ vmcs_write64(VMCS_LINK_POINTER,
++ __pa(vmx->vmcs01.shadow_vmcs));
++ vmx->nested.sync_shadow_vmcs = true;
++ }
++ vmx->nested.dirty_vmcs12 = true;
++}
++
++/* Emulate the VMPTRLD instruction */
++static int handle_vmptrld(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ gpa_t vmptr;
++
++ if (!nested_vmx_check_permission(vcpu))
++ return 1;
++
++ if (nested_vmx_get_vmptr(vcpu, &vmptr))
++ return 1;
++
++ if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
++ nested_vmx_failValid(vcpu, VMXERR_VMPTRLD_INVALID_ADDRESS);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ if (vmptr == vmx->nested.vmxon_ptr) {
++ nested_vmx_failValid(vcpu, VMXERR_VMPTRLD_VMXON_POINTER);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ if (vmx->nested.current_vmptr != vmptr) {
++ struct vmcs12 *new_vmcs12;
++ struct page *page;
++ page = kvm_vcpu_gpa_to_page(vcpu, vmptr);
++ if (is_error_page(page)) {
++ nested_vmx_failInvalid(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ new_vmcs12 = kmap(page);
++ if (new_vmcs12->hdr.revision_id != VMCS12_REVISION ||
++ (new_vmcs12->hdr.shadow_vmcs &&
++ !nested_cpu_has_vmx_shadow_vmcs(vcpu))) {
++ kunmap(page);
++ kvm_release_page_clean(page);
++ nested_vmx_failValid(vcpu,
++ VMXERR_VMPTRLD_INCORRECT_VMCS_REVISION_ID);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ nested_release_vmcs12(vmx);
++ /*
++ * Load VMCS12 from guest memory since it is not already
++ * cached.
++ */
++ memcpy(vmx->nested.cached_vmcs12, new_vmcs12, VMCS12_SIZE);
++ kunmap(page);
++ kvm_release_page_clean(page);
++
++ set_current_vmptr(vmx, vmptr);
++ }
++
++ nested_vmx_succeed(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++/* Emulate the VMPTRST instruction */
++static int handle_vmptrst(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qual = vmcs_readl(EXIT_QUALIFICATION);
++ u32 instr_info = vmcs_read32(VMX_INSTRUCTION_INFO);
++ gpa_t current_vmptr = to_vmx(vcpu)->nested.current_vmptr;
++ struct x86_exception e;
++ gva_t gva;
++
++ if (!nested_vmx_check_permission(vcpu))
++ return 1;
++
++ if (get_vmx_mem_address(vcpu, exit_qual, instr_info, true, &gva))
++ return 1;
++ /* *_system ok, nested_vmx_check_permission has verified cpl=0 */
++ if (kvm_write_guest_virt_system(vcpu, gva, (void *)¤t_vmptr,
++ sizeof(gpa_t), &e)) {
++ kvm_inject_page_fault(vcpu, &e);
++ return 1;
++ }
++ nested_vmx_succeed(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++/* Emulate the INVEPT instruction */
++static int handle_invept(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 vmx_instruction_info, types;
++ unsigned long type;
++ gva_t gva;
++ struct x86_exception e;
++ struct {
++ u64 eptp, gpa;
++ } operand;
++
++ if (!(vmx->nested.msrs.secondary_ctls_high &
++ SECONDARY_EXEC_ENABLE_EPT) ||
++ !(vmx->nested.msrs.ept_caps & VMX_EPT_INVEPT_BIT)) {
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++ }
++
++ if (!nested_vmx_check_permission(vcpu))
++ return 1;
++
++ vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
++ type = kvm_register_readl(vcpu, (vmx_instruction_info >> 28) & 0xf);
++
++ types = (vmx->nested.msrs.ept_caps >> VMX_EPT_EXTENT_SHIFT) & 6;
++
++ if (type >= 32 || !(types & (1 << type))) {
++ nested_vmx_failValid(vcpu,
++ VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ /* According to the Intel VMX instruction reference, the memory
++ * operand is read even if it isn't needed (e.g., for type==global)
++ */
++ if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
++ vmx_instruction_info, false, &gva))
++ return 1;
++ if (kvm_read_guest_virt(vcpu, gva, &operand, sizeof(operand), &e)) {
++ kvm_inject_page_fault(vcpu, &e);
++ return 1;
++ }
++
++ switch (type) {
++ case VMX_EPT_EXTENT_GLOBAL:
++ /*
++ * TODO: track mappings and invalidate
++ * single context requests appropriately
++ */
++ case VMX_EPT_EXTENT_CONTEXT:
++ kvm_mmu_sync_roots(vcpu);
++ kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
++ nested_vmx_succeed(vcpu);
++ break;
++ default:
++ BUG_ON(1);
++ break;
++ }
++
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static int handle_invvpid(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 vmx_instruction_info;
++ unsigned long type, types;
++ gva_t gva;
++ struct x86_exception e;
++ struct {
++ u64 vpid;
++ u64 gla;
++ } operand;
++
++ if (!(vmx->nested.msrs.secondary_ctls_high &
++ SECONDARY_EXEC_ENABLE_VPID) ||
++ !(vmx->nested.msrs.vpid_caps & VMX_VPID_INVVPID_BIT)) {
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++ }
++
++ if (!nested_vmx_check_permission(vcpu))
++ return 1;
++
++ vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
++ type = kvm_register_readl(vcpu, (vmx_instruction_info >> 28) & 0xf);
++
++ types = (vmx->nested.msrs.vpid_caps &
++ VMX_VPID_EXTENT_SUPPORTED_MASK) >> 8;
++
++ if (type >= 32 || !(types & (1 << type))) {
++ nested_vmx_failValid(vcpu,
++ VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ /* according to the intel vmx instruction reference, the memory
++ * operand is read even if it isn't needed (e.g., for type==global)
++ */
++ if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
++ vmx_instruction_info, false, &gva))
++ return 1;
++ if (kvm_read_guest_virt(vcpu, gva, &operand, sizeof(operand), &e)) {
++ kvm_inject_page_fault(vcpu, &e);
++ return 1;
++ }
++ if (operand.vpid >> 16) {
++ nested_vmx_failValid(vcpu,
++ VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ switch (type) {
++ case VMX_VPID_EXTENT_INDIVIDUAL_ADDR:
++ if (!operand.vpid ||
++ is_noncanonical_address(operand.gla, vcpu)) {
++ nested_vmx_failValid(vcpu,
++ VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ if (cpu_has_vmx_invvpid_individual_addr() &&
++ vmx->nested.vpid02) {
++ __invvpid(VMX_VPID_EXTENT_INDIVIDUAL_ADDR,
++ vmx->nested.vpid02, operand.gla);
++ } else
++ __vmx_flush_tlb(vcpu, vmx->nested.vpid02, true);
++ break;
++ case VMX_VPID_EXTENT_SINGLE_CONTEXT:
++ case VMX_VPID_EXTENT_SINGLE_NON_GLOBAL:
++ if (!operand.vpid) {
++ nested_vmx_failValid(vcpu,
++ VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++ __vmx_flush_tlb(vcpu, vmx->nested.vpid02, true);
++ break;
++ case VMX_VPID_EXTENT_ALL_CONTEXT:
++ __vmx_flush_tlb(vcpu, vmx->nested.vpid02, true);
++ break;
++ default:
++ WARN_ON_ONCE(1);
++ return kvm_skip_emulated_instruction(vcpu);
++ }
++
++ nested_vmx_succeed(vcpu);
++
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++static int handle_invpcid(struct kvm_vcpu *vcpu)
++{
++ u32 vmx_instruction_info;
++ unsigned long type;
++ bool pcid_enabled;
++ gva_t gva;
++ struct x86_exception e;
++ unsigned i;
++ unsigned long roots_to_free = 0;
++ struct {
++ u64 pcid;
++ u64 gla;
++ } operand;
++
++ if (!guest_cpuid_has(vcpu, X86_FEATURE_INVPCID)) {
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++ }
++
++ vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
++ type = kvm_register_readl(vcpu, (vmx_instruction_info >> 28) & 0xf);
++
++ if (type > 3) {
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++
++ /* According to the Intel instruction reference, the memory operand
++ * is read even if it isn't needed (e.g., for type==all)
++ */
++ if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
++ vmx_instruction_info, false, &gva))
++ return 1;
++
++ if (kvm_read_guest_virt(vcpu, gva, &operand, sizeof(operand), &e)) {
++ kvm_inject_page_fault(vcpu, &e);
++ return 1;
++ }
++
++ if (operand.pcid >> 12 != 0) {
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++
++ pcid_enabled = kvm_read_cr4_bits(vcpu, X86_CR4_PCIDE);
++
++ switch (type) {
++ case INVPCID_TYPE_INDIV_ADDR:
++ if ((!pcid_enabled && (operand.pcid != 0)) ||
++ is_noncanonical_address(operand.gla, vcpu)) {
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++ kvm_mmu_invpcid_gva(vcpu, operand.gla, operand.pcid);
++ return kvm_skip_emulated_instruction(vcpu);
++
++ case INVPCID_TYPE_SINGLE_CTXT:
++ if (!pcid_enabled && (operand.pcid != 0)) {
++ kvm_inject_gp(vcpu, 0);
++ return 1;
++ }
++
++ if (kvm_get_active_pcid(vcpu) == operand.pcid) {
++ kvm_mmu_sync_roots(vcpu);
++ kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
++ }
++
++ for (i = 0; i < KVM_MMU_NUM_PREV_ROOTS; i++)
++ if (kvm_get_pcid(vcpu, vcpu->arch.mmu.prev_roots[i].cr3)
++ == operand.pcid)
++ roots_to_free |= KVM_MMU_ROOT_PREVIOUS(i);
++
++ kvm_mmu_free_roots(vcpu, roots_to_free);
++ /*
++ * If neither the current cr3 nor any of the prev_roots use the
++ * given PCID, then nothing needs to be done here because a
++ * resync will happen anyway before switching to any other CR3.
++ */
++
++ return kvm_skip_emulated_instruction(vcpu);
++
++ case INVPCID_TYPE_ALL_NON_GLOBAL:
++ /*
++ * Currently, KVM doesn't mark global entries in the shadow
++ * page tables, so a non-global flush just degenerates to a
++ * global flush. If needed, we could optimize this later by
++ * keeping track of global entries in shadow page tables.
++ */
++
++ /* fall-through */
++ case INVPCID_TYPE_ALL_INCL_GLOBAL:
++ kvm_mmu_unload(vcpu);
++ return kvm_skip_emulated_instruction(vcpu);
++
++ default:
++ BUG(); /* We have already checked above that type <= 3 */
++ }
++}
++
++static int handle_pml_full(struct kvm_vcpu *vcpu)
++{
++ unsigned long exit_qualification;
++
++ trace_kvm_pml_full(vcpu->vcpu_id);
++
++ exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++
++ /*
++ * PML buffer FULL happened while executing iret from NMI,
++ * "blocked by NMI" bit has to be set before next VM entry.
++ */
++ if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
++ enable_vnmi &&
++ (exit_qualification & INTR_INFO_UNBLOCK_NMI))
++ vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++ GUEST_INTR_STATE_NMI);
++
++ /*
++ * PML buffer already flushed at beginning of VMEXIT. Nothing to do
++ * here.., and there's no userspace involvement needed for PML.
++ */
++ return 1;
++}
++
++static int handle_preemption_timer(struct kvm_vcpu *vcpu)
++{
++ if (!to_vmx(vcpu)->req_immediate_exit)
++ kvm_lapic_expired_hv_timer(vcpu);
++ return 1;
++}
++
++static bool valid_ept_address(struct kvm_vcpu *vcpu, u64 address)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int maxphyaddr = cpuid_maxphyaddr(vcpu);
++
++ /* Check for memory type validity */
++ switch (address & VMX_EPTP_MT_MASK) {
++ case VMX_EPTP_MT_UC:
++ if (!(vmx->nested.msrs.ept_caps & VMX_EPTP_UC_BIT))
++ return false;
++ break;
++ case VMX_EPTP_MT_WB:
++ if (!(vmx->nested.msrs.ept_caps & VMX_EPTP_WB_BIT))
++ return false;
++ break;
++ default:
++ return false;
++ }
++
++ /* only 4 levels page-walk length are valid */
++ if ((address & VMX_EPTP_PWL_MASK) != VMX_EPTP_PWL_4)
++ return false;
++
++ /* Reserved bits should not be set */
++ if (address >> maxphyaddr || ((address >> 7) & 0x1f))
++ return false;
++
++ /* AD, if set, should be supported */
++ if (address & VMX_EPTP_AD_ENABLE_BIT) {
++ if (!(vmx->nested.msrs.ept_caps & VMX_EPT_AD_BIT))
++ return false;
++ }
++
++ return true;
++}
++
++static int nested_vmx_eptp_switching(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ u32 index = vcpu->arch.regs[VCPU_REGS_RCX];
++ u64 address;
++ bool accessed_dirty;
++ struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
++
++ if (!nested_cpu_has_eptp_switching(vmcs12) ||
++ !nested_cpu_has_ept(vmcs12))
++ return 1;
++
++ if (index >= VMFUNC_EPTP_ENTRIES)
++ return 1;
++
++
++ if (kvm_vcpu_read_guest_page(vcpu, vmcs12->eptp_list_address >> PAGE_SHIFT,
++ &address, index * 8, 8))
++ return 1;
++
++ accessed_dirty = !!(address & VMX_EPTP_AD_ENABLE_BIT);
++
++ /*
++ * If the (L2) guest does a vmfunc to the currently
++ * active ept pointer, we don't have to do anything else
++ */
++ if (vmcs12->ept_pointer != address) {
++ if (!valid_ept_address(vcpu, address))
++ return 1;
++
++ kvm_mmu_unload(vcpu);
++ mmu->ept_ad = accessed_dirty;
++ mmu->base_role.ad_disabled = !accessed_dirty;
++ vmcs12->ept_pointer = address;
++ /*
++ * TODO: Check what's the correct approach in case
++ * mmu reload fails. Currently, we just let the next
++ * reload potentially fail
++ */
++ kvm_mmu_reload(vcpu);
++ }
++
++ return 0;
++}
++
++static int handle_vmfunc(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct vmcs12 *vmcs12;
++ u32 function = vcpu->arch.regs[VCPU_REGS_RAX];
++
++ /*
++ * VMFUNC is only supported for nested guests, but we always enable the
++ * secondary control for simplicity; for non-nested mode, fake that we
++ * didn't by injecting #UD.
++ */
++ if (!is_guest_mode(vcpu)) {
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++ }
++
++ vmcs12 = get_vmcs12(vcpu);
++ if ((vmcs12->vm_function_control & (1 << function)) == 0)
++ goto fail;
++
++ switch (function) {
++ case 0:
++ if (nested_vmx_eptp_switching(vcpu, vmcs12))
++ goto fail;
++ break;
++ default:
++ goto fail;
++ }
++ return kvm_skip_emulated_instruction(vcpu);
++
++fail:
++ nested_vmx_vmexit(vcpu, vmx->exit_reason,
++ vmcs_read32(VM_EXIT_INTR_INFO),
++ vmcs_readl(EXIT_QUALIFICATION));
++ return 1;
++}
++
++static int handle_encls(struct kvm_vcpu *vcpu)
++{
++ /*
++ * SGX virtualization is not yet supported. There is no software
++ * enable bit for SGX, so we have to trap ENCLS and inject a #UD
++ * to prevent the guest from executing ENCLS.
++ */
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++}
++
++/*
++ * The exit handlers return 1 if the exit was handled fully and guest execution
++ * may resume. Otherwise they set the kvm_run parameter to indicate what needs
++ * to be done to userspace and return 0.
++ */
++static int (*const kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
++ [EXIT_REASON_EXCEPTION_NMI] = handle_exception,
++ [EXIT_REASON_EXTERNAL_INTERRUPT] = handle_external_interrupt,
++ [EXIT_REASON_TRIPLE_FAULT] = handle_triple_fault,
++ [EXIT_REASON_NMI_WINDOW] = handle_nmi_window,
++ [EXIT_REASON_IO_INSTRUCTION] = handle_io,
++ [EXIT_REASON_CR_ACCESS] = handle_cr,
++ [EXIT_REASON_DR_ACCESS] = handle_dr,
++ [EXIT_REASON_CPUID] = handle_cpuid,
++ [EXIT_REASON_MSR_READ] = handle_rdmsr,
++ [EXIT_REASON_MSR_WRITE] = handle_wrmsr,
++ [EXIT_REASON_PENDING_INTERRUPT] = handle_interrupt_window,
++ [EXIT_REASON_HLT] = handle_halt,
++ [EXIT_REASON_INVD] = handle_invd,
++ [EXIT_REASON_INVLPG] = handle_invlpg,
++ [EXIT_REASON_RDPMC] = handle_rdpmc,
++ [EXIT_REASON_VMCALL] = handle_vmcall,
++ [EXIT_REASON_VMCLEAR] = handle_vmclear,
++ [EXIT_REASON_VMLAUNCH] = handle_vmlaunch,
++ [EXIT_REASON_VMPTRLD] = handle_vmptrld,
++ [EXIT_REASON_VMPTRST] = handle_vmptrst,
++ [EXIT_REASON_VMREAD] = handle_vmread,
++ [EXIT_REASON_VMRESUME] = handle_vmresume,
++ [EXIT_REASON_VMWRITE] = handle_vmwrite,
++ [EXIT_REASON_VMOFF] = handle_vmoff,
++ [EXIT_REASON_VMON] = handle_vmon,
++ [EXIT_REASON_TPR_BELOW_THRESHOLD] = handle_tpr_below_threshold,
++ [EXIT_REASON_APIC_ACCESS] = handle_apic_access,
++ [EXIT_REASON_APIC_WRITE] = handle_apic_write,
++ [EXIT_REASON_EOI_INDUCED] = handle_apic_eoi_induced,
++ [EXIT_REASON_WBINVD] = handle_wbinvd,
++ [EXIT_REASON_XSETBV] = handle_xsetbv,
++ [EXIT_REASON_TASK_SWITCH] = handle_task_switch,
++ [EXIT_REASON_MCE_DURING_VMENTRY] = handle_machine_check,
++ [EXIT_REASON_GDTR_IDTR] = handle_desc,
++ [EXIT_REASON_LDTR_TR] = handle_desc,
++ [EXIT_REASON_EPT_VIOLATION] = handle_ept_violation,
++ [EXIT_REASON_EPT_MISCONFIG] = handle_ept_misconfig,
++ [EXIT_REASON_PAUSE_INSTRUCTION] = handle_pause,
++ [EXIT_REASON_MWAIT_INSTRUCTION] = handle_mwait,
++ [EXIT_REASON_MONITOR_TRAP_FLAG] = handle_monitor_trap,
++ [EXIT_REASON_MONITOR_INSTRUCTION] = handle_monitor,
++ [EXIT_REASON_INVEPT] = handle_invept,
++ [EXIT_REASON_INVVPID] = handle_invvpid,
++ [EXIT_REASON_RDRAND] = handle_invalid_op,
++ [EXIT_REASON_RDSEED] = handle_invalid_op,
++ [EXIT_REASON_XSAVES] = handle_xsaves,
++ [EXIT_REASON_XRSTORS] = handle_xrstors,
++ [EXIT_REASON_PML_FULL] = handle_pml_full,
++ [EXIT_REASON_INVPCID] = handle_invpcid,
++ [EXIT_REASON_VMFUNC] = handle_vmfunc,
++ [EXIT_REASON_PREEMPTION_TIMER] = handle_preemption_timer,
++ [EXIT_REASON_ENCLS] = handle_encls,
++};
++
++static const int kvm_vmx_max_exit_handlers =
++ ARRAY_SIZE(kvm_vmx_exit_handlers);
++
++/*
++ * Return true if an IO instruction with the specified port and size should cause
++ * a VM-exit into L1.
++ */
++bool nested_vmx_check_io_bitmaps(struct kvm_vcpu *vcpu, unsigned int port,
++ int size)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ gpa_t bitmap, last_bitmap;
++ u8 b;
++
++ last_bitmap = (gpa_t)-1;
++ b = -1;
++
++ while (size > 0) {
++ if (port < 0x8000)
++ bitmap = vmcs12->io_bitmap_a;
++ else if (port < 0x10000)
++ bitmap = vmcs12->io_bitmap_b;
++ else
++ return true;
++ bitmap += (port & 0x7fff) / 8;
++
++ if (last_bitmap != bitmap)
++ if (kvm_vcpu_read_guest(vcpu, bitmap, &b, 1))
++ return true;
++ if (b & (1 << (port & 7)))
++ return true;
++
++ port++;
++ size--;
++ last_bitmap = bitmap;
++ }
++
++ return false;
++}
++
++/*
++ * Return 1 if we should exit from L2 to L1 to handle an MSR access access,
++ * rather than handle it ourselves in L0. I.e., check whether L1 expressed
++ * disinterest in the current event (read or write a specific MSR) by using an
++ * MSR bitmap. This may be the case even when L0 doesn't use MSR bitmaps.
++ */
++static bool nested_vmx_exit_handled_msr(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12, u32 exit_reason)
++{
++ u32 msr_index = vcpu->arch.regs[VCPU_REGS_RCX];
++ gpa_t bitmap;
++
++ if (!nested_cpu_has(vmcs12, CPU_BASED_USE_MSR_BITMAPS))
++ return true;
++
++ /*
++ * The MSR_BITMAP page is divided into four 1024-byte bitmaps,
++ * for the four combinations of read/write and low/high MSR numbers.
++ * First we need to figure out which of the four to use:
++ */
++ bitmap = vmcs12->msr_bitmap;
++ if (exit_reason == EXIT_REASON_MSR_WRITE)
++ bitmap += 2048;
++ if (msr_index >= 0xc0000000) {
++ msr_index -= 0xc0000000;
++ bitmap += 1024;
++ }
++
++ /* Then read the msr_index'th bit from this bitmap: */
++ if (msr_index < 1024*8) {
++ unsigned char b;
++ if (kvm_vcpu_read_guest(vcpu, bitmap + msr_index/8, &b, 1))
++ return true;
++ return 1 & (b >> (msr_index & 7));
++ } else
++ return true; /* let L1 handle the wrong parameter */
++}
++
++/*
++ * Return 1 if we should exit from L2 to L1 to handle a CR access exit,
++ * rather than handle it ourselves in L0. I.e., check if L1 wanted to
++ * intercept (via guest_host_mask etc.) the current event.
++ */
++static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
++ int cr = exit_qualification & 15;
++ int reg;
++ unsigned long val;
++
++ switch ((exit_qualification >> 4) & 3) {
++ case 0: /* mov to cr */
++ reg = (exit_qualification >> 8) & 15;
++ val = kvm_register_readl(vcpu, reg);
++ switch (cr) {
++ case 0:
++ if (vmcs12->cr0_guest_host_mask &
++ (val ^ vmcs12->cr0_read_shadow))
++ return true;
++ break;
++ case 3:
++ if ((vmcs12->cr3_target_count >= 1 &&
++ vmcs12->cr3_target_value0 == val) ||
++ (vmcs12->cr3_target_count >= 2 &&
++ vmcs12->cr3_target_value1 == val) ||
++ (vmcs12->cr3_target_count >= 3 &&
++ vmcs12->cr3_target_value2 == val) ||
++ (vmcs12->cr3_target_count >= 4 &&
++ vmcs12->cr3_target_value3 == val))
++ return false;
++ if (nested_cpu_has(vmcs12, CPU_BASED_CR3_LOAD_EXITING))
++ return true;
++ break;
++ case 4:
++ if (vmcs12->cr4_guest_host_mask &
++ (vmcs12->cr4_read_shadow ^ val))
++ return true;
++ break;
++ case 8:
++ if (nested_cpu_has(vmcs12, CPU_BASED_CR8_LOAD_EXITING))
++ return true;
++ break;
++ }
++ break;
++ case 2: /* clts */
++ if ((vmcs12->cr0_guest_host_mask & X86_CR0_TS) &&
++ (vmcs12->cr0_read_shadow & X86_CR0_TS))
++ return true;
++ break;
++ case 1: /* mov from cr */
++ switch (cr) {
++ case 3:
++ if (vmcs12->cpu_based_vm_exec_control &
++ CPU_BASED_CR3_STORE_EXITING)
++ return true;
++ break;
++ case 8:
++ if (vmcs12->cpu_based_vm_exec_control &
++ CPU_BASED_CR8_STORE_EXITING)
++ return true;
++ break;
++ }
++ break;
++ case 3: /* lmsw */
++ /*
++ * lmsw can change bits 1..3 of cr0, and only set bit 0 of
++ * cr0. Other attempted changes are ignored, with no exit.
++ */
++ val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f;
++ if (vmcs12->cr0_guest_host_mask & 0xe &
++ (val ^ vmcs12->cr0_read_shadow))
++ return true;
++ if ((vmcs12->cr0_guest_host_mask & 0x1) &&
++ !(vmcs12->cr0_read_shadow & 0x1) &&
++ (val & 0x1))
++ return true;
++ break;
++ }
++ return false;
++}
++
++static bool nested_vmx_exit_handled_vmcs_access(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12, gpa_t bitmap)
++{
++ u32 vmx_instruction_info;
++ unsigned long field;
++ u8 b;
++
++ if (!nested_cpu_has_shadow_vmcs(vmcs12))
++ return true;
++
++ /* Decode instruction info and find the field to access */
++ vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
++ field = kvm_register_read(vcpu, (((vmx_instruction_info) >> 28) & 0xf));
++
++ /* Out-of-range fields always cause a VM exit from L2 to L1 */
++ if (field >> 15)
++ return true;
++
++ if (kvm_vcpu_read_guest(vcpu, bitmap + field/8, &b, 1))
++ return true;
++
++ return 1 & (b >> (field & 7));
++}
++
++/*
++ * Return 1 if we should exit from L2 to L1 to handle an exit, or 0 if we
++ * should handle it ourselves in L0 (and then continue L2). Only call this
++ * when in is_guest_mode (L2).
++ */
++static bool nested_vmx_exit_reflected(struct kvm_vcpu *vcpu, u32 exit_reason)
++{
++ u32 intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++
++ if (vmx->nested.nested_run_pending)
++ return false;
++
++ if (unlikely(vmx->fail)) {
++ pr_info_ratelimited("%s failed vm entry %x\n", __func__,
++ vmcs_read32(VM_INSTRUCTION_ERROR));
++ return true;
++ }
++
++ /*
++ * The host physical addresses of some pages of guest memory
++ * are loaded into the vmcs02 (e.g. vmcs12's Virtual APIC
++ * Page). The CPU may write to these pages via their host
++ * physical address while L2 is running, bypassing any
++ * address-translation-based dirty tracking (e.g. EPT write
++ * protection).
++ *
++ * Mark them dirty on every exit from L2 to prevent them from
++ * getting out of sync with dirty tracking.
++ */
++ nested_mark_vmcs12_pages_dirty(vcpu);
++
++ trace_kvm_nested_vmexit(kvm_rip_read(vcpu), exit_reason,
++ vmcs_readl(EXIT_QUALIFICATION),
++ vmx->idt_vectoring_info,
++ intr_info,
++ vmcs_read32(VM_EXIT_INTR_ERROR_CODE),
++ KVM_ISA_VMX);
++
++ switch ((u16)exit_reason) {
++ case EXIT_REASON_EXCEPTION_NMI:
++ if (is_nmi(intr_info))
++ return false;
++ else if (is_page_fault(intr_info))
++ return !vmx->vcpu.arch.apf.host_apf_reason && enable_ept;
++ else if (is_no_device(intr_info) &&
++ !(vmcs12->guest_cr0 & X86_CR0_TS))
++ return false;
++ else if (is_debug(intr_info) &&
++ vcpu->guest_debug &
++ (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
++ return false;
++ else if (is_breakpoint(intr_info) &&
++ vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
++ return false;
++ return vmcs12->exception_bitmap &
++ (1u << (intr_info & INTR_INFO_VECTOR_MASK));
++ case EXIT_REASON_EXTERNAL_INTERRUPT:
++ return false;
++ case EXIT_REASON_TRIPLE_FAULT:
++ return true;
++ case EXIT_REASON_PENDING_INTERRUPT:
++ return nested_cpu_has(vmcs12, CPU_BASED_VIRTUAL_INTR_PENDING);
++ case EXIT_REASON_NMI_WINDOW:
++ return nested_cpu_has(vmcs12, CPU_BASED_VIRTUAL_NMI_PENDING);
++ case EXIT_REASON_TASK_SWITCH:
++ return true;
++ case EXIT_REASON_CPUID:
++ return true;
++ case EXIT_REASON_HLT:
++ return nested_cpu_has(vmcs12, CPU_BASED_HLT_EXITING);
++ case EXIT_REASON_INVD:
++ return true;
++ case EXIT_REASON_INVLPG:
++ return nested_cpu_has(vmcs12, CPU_BASED_INVLPG_EXITING);
++ case EXIT_REASON_RDPMC:
++ return nested_cpu_has(vmcs12, CPU_BASED_RDPMC_EXITING);
++ case EXIT_REASON_RDRAND:
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_RDRAND_EXITING);
++ case EXIT_REASON_RDSEED:
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_RDSEED_EXITING);
++ case EXIT_REASON_RDTSC: case EXIT_REASON_RDTSCP:
++ return nested_cpu_has(vmcs12, CPU_BASED_RDTSC_EXITING);
++ case EXIT_REASON_VMREAD:
++ return nested_vmx_exit_handled_vmcs_access(vcpu, vmcs12,
++ vmcs12->vmread_bitmap);
++ case EXIT_REASON_VMWRITE:
++ return nested_vmx_exit_handled_vmcs_access(vcpu, vmcs12,
++ vmcs12->vmwrite_bitmap);
++ case EXIT_REASON_VMCALL: case EXIT_REASON_VMCLEAR:
++ case EXIT_REASON_VMLAUNCH: case EXIT_REASON_VMPTRLD:
++ case EXIT_REASON_VMPTRST: case EXIT_REASON_VMRESUME:
++ case EXIT_REASON_VMOFF: case EXIT_REASON_VMON:
++ case EXIT_REASON_INVEPT: case EXIT_REASON_INVVPID:
++ /*
++ * VMX instructions trap unconditionally. This allows L1 to
++ * emulate them for its L2 guest, i.e., allows 3-level nesting!
++ */
++ return true;
++ case EXIT_REASON_CR_ACCESS:
++ return nested_vmx_exit_handled_cr(vcpu, vmcs12);
++ case EXIT_REASON_DR_ACCESS:
++ return nested_cpu_has(vmcs12, CPU_BASED_MOV_DR_EXITING);
++ case EXIT_REASON_IO_INSTRUCTION:
++ return nested_vmx_exit_handled_io(vcpu, vmcs12);
++ case EXIT_REASON_GDTR_IDTR: case EXIT_REASON_LDTR_TR:
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_DESC);
++ case EXIT_REASON_MSR_READ:
++ case EXIT_REASON_MSR_WRITE:
++ return nested_vmx_exit_handled_msr(vcpu, vmcs12, exit_reason);
++ case EXIT_REASON_INVALID_STATE:
++ return true;
++ case EXIT_REASON_MWAIT_INSTRUCTION:
++ return nested_cpu_has(vmcs12, CPU_BASED_MWAIT_EXITING);
++ case EXIT_REASON_MONITOR_TRAP_FLAG:
++ return nested_cpu_has(vmcs12, CPU_BASED_MONITOR_TRAP_FLAG);
++ case EXIT_REASON_MONITOR_INSTRUCTION:
++ return nested_cpu_has(vmcs12, CPU_BASED_MONITOR_EXITING);
++ case EXIT_REASON_PAUSE_INSTRUCTION:
++ return nested_cpu_has(vmcs12, CPU_BASED_PAUSE_EXITING) ||
++ nested_cpu_has2(vmcs12,
++ SECONDARY_EXEC_PAUSE_LOOP_EXITING);
++ case EXIT_REASON_MCE_DURING_VMENTRY:
++ return false;
++ case EXIT_REASON_TPR_BELOW_THRESHOLD:
++ return nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW);
++ case EXIT_REASON_APIC_ACCESS:
++ case EXIT_REASON_APIC_WRITE:
++ case EXIT_REASON_EOI_INDUCED:
++ /*
++ * The controls for "virtualize APIC accesses," "APIC-
++ * register virtualization," and "virtual-interrupt
++ * delivery" only come from vmcs12.
++ */
++ return true;
++ case EXIT_REASON_EPT_VIOLATION:
++ /*
++ * L0 always deals with the EPT violation. If nested EPT is
++ * used, and the nested mmu code discovers that the address is
++ * missing in the guest EPT table (EPT12), the EPT violation
++ * will be injected with nested_ept_inject_page_fault()
++ */
++ return false;
++ case EXIT_REASON_EPT_MISCONFIG:
++ /*
++ * L2 never uses directly L1's EPT, but rather L0's own EPT
++ * table (shadow on EPT) or a merged EPT table that L0 built
++ * (EPT on EPT). So any problems with the structure of the
++ * table is L0's fault.
++ */
++ return false;
++ case EXIT_REASON_INVPCID:
++ return
++ nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_INVPCID) &&
++ nested_cpu_has(vmcs12, CPU_BASED_INVLPG_EXITING);
++ case EXIT_REASON_WBINVD:
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_WBINVD_EXITING);
++ case EXIT_REASON_XSETBV:
++ return true;
++ case EXIT_REASON_XSAVES: case EXIT_REASON_XRSTORS:
++ /*
++ * This should never happen, since it is not possible to
++ * set XSS to a non-zero value---neither in L1 nor in L2.
++ * If if it were, XSS would have to be checked against
++ * the XSS exit bitmap in vmcs12.
++ */
++ return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES);
++ case EXIT_REASON_PREEMPTION_TIMER:
++ return false;
++ case EXIT_REASON_PML_FULL:
++ /* We emulate PML support to L1. */
++ return false;
++ case EXIT_REASON_VMFUNC:
++ /* VM functions are emulated through L2->L0 vmexits. */
++ return false;
++ case EXIT_REASON_ENCLS:
++ /* SGX is never exposed to L1 */
++ return false;
++ default:
++ return true;
++ }
++}
++
++static int nested_vmx_reflect_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason)
++{
++ u32 exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++
++ /*
++ * At this point, the exit interruption info in exit_intr_info
++ * is only valid for EXCEPTION_NMI exits. For EXTERNAL_INTERRUPT
++ * we need to query the in-kernel LAPIC.
++ */
++ WARN_ON(exit_reason == EXIT_REASON_EXTERNAL_INTERRUPT);
++ if ((exit_intr_info &
++ (INTR_INFO_VALID_MASK | INTR_INFO_DELIVER_CODE_MASK)) ==
++ (INTR_INFO_VALID_MASK | INTR_INFO_DELIVER_CODE_MASK)) {
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ vmcs12->vm_exit_intr_error_code =
++ vmcs_read32(VM_EXIT_INTR_ERROR_CODE);
++ }
++
++ nested_vmx_vmexit(vcpu, exit_reason, exit_intr_info,
++ vmcs_readl(EXIT_QUALIFICATION));
++ return 1;
++}
++
++static void vmx_get_exit_info(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2)
++{
++ *info1 = vmcs_readl(EXIT_QUALIFICATION);
++ *info2 = vmcs_read32(VM_EXIT_INTR_INFO);
++}
++
++static void vmx_destroy_pml_buffer(struct vcpu_vmx *vmx)
++{
++ if (vmx->pml_pg) {
++ __free_page(vmx->pml_pg);
++ vmx->pml_pg = NULL;
++ }
++}
++
++static void vmx_flush_pml_buffer(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u64 *pml_buf;
++ u16 pml_idx;
++
++ pml_idx = vmcs_read16(GUEST_PML_INDEX);
++
++ /* Do nothing if PML buffer is empty */
++ if (pml_idx == (PML_ENTITY_NUM - 1))
++ return;
++
++ /* PML index always points to next available PML buffer entity */
++ if (pml_idx >= PML_ENTITY_NUM)
++ pml_idx = 0;
++ else
++ pml_idx++;
++
++ pml_buf = page_address(vmx->pml_pg);
++ for (; pml_idx < PML_ENTITY_NUM; pml_idx++) {
++ u64 gpa;
++
++ gpa = pml_buf[pml_idx];
++ WARN_ON(gpa & (PAGE_SIZE - 1));
++ kvm_vcpu_mark_page_dirty(vcpu, gpa >> PAGE_SHIFT);
++ }
++
++ /* reset PML index */
++ vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
++}
++
++/*
++ * Flush all vcpus' PML buffer and update logged GPAs to dirty_bitmap.
++ * Called before reporting dirty_bitmap to userspace.
++ */
++static void kvm_flush_pml_buffers(struct kvm *kvm)
++{
++ int i;
++ struct kvm_vcpu *vcpu;
++ /*
++ * We only need to kick vcpu out of guest mode here, as PML buffer
++ * is flushed at beginning of all VMEXITs, and it's obvious that only
++ * vcpus running in guest are possible to have unflushed GPAs in PML
++ * buffer.
++ */
++ kvm_for_each_vcpu(i, vcpu, kvm)
++ kvm_vcpu_kick(vcpu);
++}
++
++static void vmx_dump_sel(char *name, uint32_t sel)
++{
++ pr_err("%s sel=0x%04x, attr=0x%05x, limit=0x%08x, base=0x%016lx\n",
++ name, vmcs_read16(sel),
++ vmcs_read32(sel + GUEST_ES_AR_BYTES - GUEST_ES_SELECTOR),
++ vmcs_read32(sel + GUEST_ES_LIMIT - GUEST_ES_SELECTOR),
++ vmcs_readl(sel + GUEST_ES_BASE - GUEST_ES_SELECTOR));
++}
++
++static void vmx_dump_dtsel(char *name, uint32_t limit)
++{
++ pr_err("%s limit=0x%08x, base=0x%016lx\n",
++ name, vmcs_read32(limit),
++ vmcs_readl(limit + GUEST_GDTR_BASE - GUEST_GDTR_LIMIT));
++}
++
++static void dump_vmcs(void)
++{
++ u32 vmentry_ctl = vmcs_read32(VM_ENTRY_CONTROLS);
++ u32 vmexit_ctl = vmcs_read32(VM_EXIT_CONTROLS);
++ u32 cpu_based_exec_ctrl = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL);
++ u32 pin_based_exec_ctrl = vmcs_read32(PIN_BASED_VM_EXEC_CONTROL);
++ u32 secondary_exec_control = 0;
++ unsigned long cr4 = vmcs_readl(GUEST_CR4);
++ u64 efer = vmcs_read64(GUEST_IA32_EFER);
++ int i, n;
++
++ if (cpu_has_secondary_exec_ctrls())
++ secondary_exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
++
++ pr_err("*** Guest State ***\n");
++ pr_err("CR0: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n",
++ vmcs_readl(GUEST_CR0), vmcs_readl(CR0_READ_SHADOW),
++ vmcs_readl(CR0_GUEST_HOST_MASK));
++ pr_err("CR4: actual=0x%016lx, shadow=0x%016lx, gh_mask=%016lx\n",
++ cr4, vmcs_readl(CR4_READ_SHADOW), vmcs_readl(CR4_GUEST_HOST_MASK));
++ pr_err("CR3 = 0x%016lx\n", vmcs_readl(GUEST_CR3));
++ if ((secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT) &&
++ (cr4 & X86_CR4_PAE) && !(efer & EFER_LMA))
++ {
++ pr_err("PDPTR0 = 0x%016llx PDPTR1 = 0x%016llx\n",
++ vmcs_read64(GUEST_PDPTR0), vmcs_read64(GUEST_PDPTR1));
++ pr_err("PDPTR2 = 0x%016llx PDPTR3 = 0x%016llx\n",
++ vmcs_read64(GUEST_PDPTR2), vmcs_read64(GUEST_PDPTR3));
++ }
++ pr_err("RSP = 0x%016lx RIP = 0x%016lx\n",
++ vmcs_readl(GUEST_RSP), vmcs_readl(GUEST_RIP));
++ pr_err("RFLAGS=0x%08lx DR7 = 0x%016lx\n",
++ vmcs_readl(GUEST_RFLAGS), vmcs_readl(GUEST_DR7));
++ pr_err("Sysenter RSP=%016lx CS:RIP=%04x:%016lx\n",
++ vmcs_readl(GUEST_SYSENTER_ESP),
++ vmcs_read32(GUEST_SYSENTER_CS), vmcs_readl(GUEST_SYSENTER_EIP));
++ vmx_dump_sel("CS: ", GUEST_CS_SELECTOR);
++ vmx_dump_sel("DS: ", GUEST_DS_SELECTOR);
++ vmx_dump_sel("SS: ", GUEST_SS_SELECTOR);
++ vmx_dump_sel("ES: ", GUEST_ES_SELECTOR);
++ vmx_dump_sel("FS: ", GUEST_FS_SELECTOR);
++ vmx_dump_sel("GS: ", GUEST_GS_SELECTOR);
++ vmx_dump_dtsel("GDTR:", GUEST_GDTR_LIMIT);
++ vmx_dump_sel("LDTR:", GUEST_LDTR_SELECTOR);
++ vmx_dump_dtsel("IDTR:", GUEST_IDTR_LIMIT);
++ vmx_dump_sel("TR: ", GUEST_TR_SELECTOR);
++ if ((vmexit_ctl & (VM_EXIT_SAVE_IA32_PAT | VM_EXIT_SAVE_IA32_EFER)) ||
++ (vmentry_ctl & (VM_ENTRY_LOAD_IA32_PAT | VM_ENTRY_LOAD_IA32_EFER)))
++ pr_err("EFER = 0x%016llx PAT = 0x%016llx\n",
++ efer, vmcs_read64(GUEST_IA32_PAT));
++ pr_err("DebugCtl = 0x%016llx DebugExceptions = 0x%016lx\n",
++ vmcs_read64(GUEST_IA32_DEBUGCTL),
++ vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS));
++ if (cpu_has_load_perf_global_ctrl &&
++ vmentry_ctl & VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL)
++ pr_err("PerfGlobCtl = 0x%016llx\n",
++ vmcs_read64(GUEST_IA32_PERF_GLOBAL_CTRL));
++ if (vmentry_ctl & VM_ENTRY_LOAD_BNDCFGS)
++ pr_err("BndCfgS = 0x%016llx\n", vmcs_read64(GUEST_BNDCFGS));
++ pr_err("Interruptibility = %08x ActivityState = %08x\n",
++ vmcs_read32(GUEST_INTERRUPTIBILITY_INFO),
++ vmcs_read32(GUEST_ACTIVITY_STATE));
++ if (secondary_exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY)
++ pr_err("InterruptStatus = %04x\n",
++ vmcs_read16(GUEST_INTR_STATUS));
++
++ pr_err("*** Host State ***\n");
++ pr_err("RIP = 0x%016lx RSP = 0x%016lx\n",
++ vmcs_readl(HOST_RIP), vmcs_readl(HOST_RSP));
++ pr_err("CS=%04x SS=%04x DS=%04x ES=%04x FS=%04x GS=%04x TR=%04x\n",
++ vmcs_read16(HOST_CS_SELECTOR), vmcs_read16(HOST_SS_SELECTOR),
++ vmcs_read16(HOST_DS_SELECTOR), vmcs_read16(HOST_ES_SELECTOR),
++ vmcs_read16(HOST_FS_SELECTOR), vmcs_read16(HOST_GS_SELECTOR),
++ vmcs_read16(HOST_TR_SELECTOR));
++ pr_err("FSBase=%016lx GSBase=%016lx TRBase=%016lx\n",
++ vmcs_readl(HOST_FS_BASE), vmcs_readl(HOST_GS_BASE),
++ vmcs_readl(HOST_TR_BASE));
++ pr_err("GDTBase=%016lx IDTBase=%016lx\n",
++ vmcs_readl(HOST_GDTR_BASE), vmcs_readl(HOST_IDTR_BASE));
++ pr_err("CR0=%016lx CR3=%016lx CR4=%016lx\n",
++ vmcs_readl(HOST_CR0), vmcs_readl(HOST_CR3),
++ vmcs_readl(HOST_CR4));
++ pr_err("Sysenter RSP=%016lx CS:RIP=%04x:%016lx\n",
++ vmcs_readl(HOST_IA32_SYSENTER_ESP),
++ vmcs_read32(HOST_IA32_SYSENTER_CS),
++ vmcs_readl(HOST_IA32_SYSENTER_EIP));
++ if (vmexit_ctl & (VM_EXIT_LOAD_IA32_PAT | VM_EXIT_LOAD_IA32_EFER))
++ pr_err("EFER = 0x%016llx PAT = 0x%016llx\n",
++ vmcs_read64(HOST_IA32_EFER),
++ vmcs_read64(HOST_IA32_PAT));
++ if (cpu_has_load_perf_global_ctrl &&
++ vmexit_ctl & VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL)
++ pr_err("PerfGlobCtl = 0x%016llx\n",
++ vmcs_read64(HOST_IA32_PERF_GLOBAL_CTRL));
++
++ pr_err("*** Control State ***\n");
++ pr_err("PinBased=%08x CPUBased=%08x SecondaryExec=%08x\n",
++ pin_based_exec_ctrl, cpu_based_exec_ctrl, secondary_exec_control);
++ pr_err("EntryControls=%08x ExitControls=%08x\n", vmentry_ctl, vmexit_ctl);
++ pr_err("ExceptionBitmap=%08x PFECmask=%08x PFECmatch=%08x\n",
++ vmcs_read32(EXCEPTION_BITMAP),
++ vmcs_read32(PAGE_FAULT_ERROR_CODE_MASK),
++ vmcs_read32(PAGE_FAULT_ERROR_CODE_MATCH));
++ pr_err("VMEntry: intr_info=%08x errcode=%08x ilen=%08x\n",
++ vmcs_read32(VM_ENTRY_INTR_INFO_FIELD),
++ vmcs_read32(VM_ENTRY_EXCEPTION_ERROR_CODE),
++ vmcs_read32(VM_ENTRY_INSTRUCTION_LEN));
++ pr_err("VMExit: intr_info=%08x errcode=%08x ilen=%08x\n",
++ vmcs_read32(VM_EXIT_INTR_INFO),
++ vmcs_read32(VM_EXIT_INTR_ERROR_CODE),
++ vmcs_read32(VM_EXIT_INSTRUCTION_LEN));
++ pr_err(" reason=%08x qualification=%016lx\n",
++ vmcs_read32(VM_EXIT_REASON), vmcs_readl(EXIT_QUALIFICATION));
++ pr_err("IDTVectoring: info=%08x errcode=%08x\n",
++ vmcs_read32(IDT_VECTORING_INFO_FIELD),
++ vmcs_read32(IDT_VECTORING_ERROR_CODE));
++ pr_err("TSC Offset = 0x%016llx\n", vmcs_read64(TSC_OFFSET));
++ if (secondary_exec_control & SECONDARY_EXEC_TSC_SCALING)
++ pr_err("TSC Multiplier = 0x%016llx\n",
++ vmcs_read64(TSC_MULTIPLIER));
++ if (cpu_based_exec_ctrl & CPU_BASED_TPR_SHADOW)
++ pr_err("TPR Threshold = 0x%02x\n", vmcs_read32(TPR_THRESHOLD));
++ if (pin_based_exec_ctrl & PIN_BASED_POSTED_INTR)
++ pr_err("PostedIntrVec = 0x%02x\n", vmcs_read16(POSTED_INTR_NV));
++ if ((secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT))
++ pr_err("EPT pointer = 0x%016llx\n", vmcs_read64(EPT_POINTER));
++ n = vmcs_read32(CR3_TARGET_COUNT);
++ for (i = 0; i + 1 < n; i += 4)
++ pr_err("CR3 target%u=%016lx target%u=%016lx\n",
++ i, vmcs_readl(CR3_TARGET_VALUE0 + i * 2),
++ i + 1, vmcs_readl(CR3_TARGET_VALUE0 + i * 2 + 2));
++ if (i < n)
++ pr_err("CR3 target%u=%016lx\n",
++ i, vmcs_readl(CR3_TARGET_VALUE0 + i * 2));
++ if (secondary_exec_control & SECONDARY_EXEC_PAUSE_LOOP_EXITING)
++ pr_err("PLE Gap=%08x Window=%08x\n",
++ vmcs_read32(PLE_GAP), vmcs_read32(PLE_WINDOW));
++ if (secondary_exec_control & SECONDARY_EXEC_ENABLE_VPID)
++ pr_err("Virtual processor ID = 0x%04x\n",
++ vmcs_read16(VIRTUAL_PROCESSOR_ID));
++}
++
++/*
++ * The guest has exited. See if we can fix it or if we need userspace
++ * assistance.
++ */
++static int vmx_handle_exit(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 exit_reason = vmx->exit_reason;
++ u32 vectoring_info = vmx->idt_vectoring_info;
++
++ trace_kvm_exit(exit_reason, vcpu, KVM_ISA_VMX);
++
++ /*
++ * Flush logged GPAs PML buffer, this will make dirty_bitmap more
++ * updated. Another good is, in kvm_vm_ioctl_get_dirty_log, before
++ * querying dirty_bitmap, we only need to kick all vcpus out of guest
++ * mode as if vcpus is in root mode, the PML buffer must has been
++ * flushed already.
++ */
++ if (enable_pml)
++ vmx_flush_pml_buffer(vcpu);
++
++ /* If guest state is invalid, start emulating */
++ if (vmx->emulation_required)
++ return handle_invalid_guest_state(vcpu);
++
++ if (is_guest_mode(vcpu) && nested_vmx_exit_reflected(vcpu, exit_reason))
++ return nested_vmx_reflect_vmexit(vcpu, exit_reason);
++
++ if (exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY) {
++ dump_vmcs();
++ vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
++ vcpu->run->fail_entry.hardware_entry_failure_reason
++ = exit_reason;
++ return 0;
++ }
++
++ if (unlikely(vmx->fail)) {
++ vcpu->run->exit_reason = KVM_EXIT_FAIL_ENTRY;
++ vcpu->run->fail_entry.hardware_entry_failure_reason
++ = vmcs_read32(VM_INSTRUCTION_ERROR);
++ return 0;
++ }
++
++ /*
++ * Note:
++ * Do not try to fix EXIT_REASON_EPT_MISCONFIG if it caused by
++ * delivery event since it indicates guest is accessing MMIO.
++ * The vm-exit can be triggered again after return to guest that
++ * will cause infinite loop.
++ */
++ if ((vectoring_info & VECTORING_INFO_VALID_MASK) &&
++ (exit_reason != EXIT_REASON_EXCEPTION_NMI &&
++ exit_reason != EXIT_REASON_EPT_VIOLATION &&
++ exit_reason != EXIT_REASON_PML_FULL &&
++ exit_reason != EXIT_REASON_APIC_ACCESS &&
++ exit_reason != EXIT_REASON_TASK_SWITCH)) {
++ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
++ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV;
++ vcpu->run->internal.ndata = 3;
++ vcpu->run->internal.data[0] = vectoring_info;
++ vcpu->run->internal.data[1] = exit_reason;
++ vcpu->run->internal.data[2] = vcpu->arch.exit_qualification;
++ if (exit_reason == EXIT_REASON_EPT_MISCONFIG) {
++ vcpu->run->internal.ndata++;
++ vcpu->run->internal.data[3] =
++ vmcs_read64(GUEST_PHYSICAL_ADDRESS);
++ }
++ return 0;
++ }
++
++ if (unlikely(!enable_vnmi &&
++ vmx->loaded_vmcs->soft_vnmi_blocked)) {
++ if (vmx_interrupt_allowed(vcpu)) {
++ vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++ } else if (vmx->loaded_vmcs->vnmi_blocked_time > 1000000000LL &&
++ vcpu->arch.nmi_pending) {
++ /*
++ * This CPU don't support us in finding the end of an
++ * NMI-blocked window if the guest runs with IRQs
++ * disabled. So we pull the trigger after 1 s of
++ * futile waiting, but inform the user about this.
++ */
++ printk(KERN_WARNING "%s: Breaking out of NMI-blocked "
++ "state on VCPU %d after 1 s timeout\n",
++ __func__, vcpu->vcpu_id);
++ vmx->loaded_vmcs->soft_vnmi_blocked = 0;
++ }
++ }
++
++ if (exit_reason < kvm_vmx_max_exit_handlers
++ && kvm_vmx_exit_handlers[exit_reason])
++ return kvm_vmx_exit_handlers[exit_reason](vcpu);
++ else {
++ vcpu_unimpl(vcpu, "vmx: unexpected exit reason 0x%x\n",
++ exit_reason);
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++ }
++}
++
++/*
++ * Software based L1D cache flush which is used when microcode providing
++ * the cache control MSR is not loaded.
++ *
++ * The L1D cache is 32 KiB on Nehalem and later microarchitectures, but to
++ * flush it is required to read in 64 KiB because the replacement algorithm
++ * is not exactly LRU. This could be sized at runtime via topology
++ * information but as all relevant affected CPUs have 32KiB L1D cache size
++ * there is no point in doing so.
++ */
++static void vmx_l1d_flush(struct kvm_vcpu *vcpu)
++{
++ int size = PAGE_SIZE << L1D_CACHE_ORDER;
++
++ /*
++ * This code is only executed when the the flush mode is 'cond' or
++ * 'always'
++ */
++ if (static_branch_likely(&vmx_l1d_flush_cond)) {
++ bool flush_l1d;
++
++ /*
++ * Clear the per-vcpu flush bit, it gets set again
++ * either from vcpu_run() or from one of the unsafe
++ * VMEXIT handlers.
++ */
++ flush_l1d = vcpu->arch.l1tf_flush_l1d;
++ vcpu->arch.l1tf_flush_l1d = false;
++
++ /*
++ * Clear the per-cpu flush bit, it gets set again from
++ * the interrupt handlers.
++ */
++ flush_l1d |= kvm_get_cpu_l1tf_flush_l1d();
++ kvm_clear_cpu_l1tf_flush_l1d();
++
++ if (!flush_l1d)
++ return;
++ }
++
++ vcpu->stat.l1d_flush++;
++
++ if (static_cpu_has(X86_FEATURE_FLUSH_L1D)) {
++ wrmsrl(MSR_IA32_FLUSH_CMD, L1D_FLUSH);
++ return;
++ }
++
++ asm volatile(
++ /* First ensure the pages are in the TLB */
++ "xorl %%eax, %%eax\n"
++ ".Lpopulate_tlb:\n\t"
++ "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t"
++ "addl $4096, %%eax\n\t"
++ "cmpl %%eax, %[size]\n\t"
++ "jne .Lpopulate_tlb\n\t"
++ "xorl %%eax, %%eax\n\t"
++ "cpuid\n\t"
++ /* Now fill the cache */
++ "xorl %%eax, %%eax\n"
++ ".Lfill_cache:\n"
++ "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t"
++ "addl $64, %%eax\n\t"
++ "cmpl %%eax, %[size]\n\t"
++ "jne .Lfill_cache\n\t"
++ "lfence\n"
++ :: [flush_pages] "r" (vmx_l1d_flush_pages),
++ [size] "r" (size)
++ : "eax", "ebx", "ecx", "edx");
++}
++
++static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++
++ if (is_guest_mode(vcpu) &&
++ nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
++ return;
++
++ if (irr == -1 || tpr < irr) {
++ vmcs_write32(TPR_THRESHOLD, 0);
++ return;
++ }
++
++ vmcs_write32(TPR_THRESHOLD, irr);
++}
++
++static void vmx_set_virtual_apic_mode(struct kvm_vcpu *vcpu)
++{
++ u32 sec_exec_control;
++
++ if (!lapic_in_kernel(vcpu))
++ return;
++
++ if (!flexpriority_enabled &&
++ !cpu_has_vmx_virtualize_x2apic_mode())
++ return;
++
++ /* Postpone execution until vmcs01 is the current VMCS. */
++ if (is_guest_mode(vcpu)) {
++ to_vmx(vcpu)->nested.change_vmcs01_virtual_apic_mode = true;
++ return;
++ }
++
++ sec_exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
++ sec_exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE);
++
++ switch (kvm_get_apic_mode(vcpu)) {
++ case LAPIC_MODE_INVALID:
++ WARN_ONCE(true, "Invalid local APIC state");
++ case LAPIC_MODE_DISABLED:
++ break;
++ case LAPIC_MODE_XAPIC:
++ if (flexpriority_enabled) {
++ sec_exec_control |=
++ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
++ vmx_flush_tlb(vcpu, true);
++ }
++ break;
++ case LAPIC_MODE_X2APIC:
++ if (cpu_has_vmx_virtualize_x2apic_mode())
++ sec_exec_control |=
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
++ break;
++ }
++ vmcs_write32(SECONDARY_VM_EXEC_CONTROL, sec_exec_control);
++
++ vmx_update_msr_bitmap(vcpu);
++}
++
++static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa)
++{
++ if (!is_guest_mode(vcpu)) {
++ vmcs_write64(APIC_ACCESS_ADDR, hpa);
++ vmx_flush_tlb(vcpu, true);
++ }
++}
++
++static void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)
++{
++ u16 status;
++ u8 old;
++
++ if (max_isr == -1)
++ max_isr = 0;
++
++ status = vmcs_read16(GUEST_INTR_STATUS);
++ old = status >> 8;
++ if (max_isr != old) {
++ status &= 0xff;
++ status |= max_isr << 8;
++ vmcs_write16(GUEST_INTR_STATUS, status);
++ }
++}
++
++static void vmx_set_rvi(int vector)
++{
++ u16 status;
++ u8 old;
++
++ if (vector == -1)
++ vector = 0;
++
++ status = vmcs_read16(GUEST_INTR_STATUS);
++ old = (u8)status & 0xff;
++ if ((u8)vector != old) {
++ status &= ~0xff;
++ status |= (u8)vector;
++ vmcs_write16(GUEST_INTR_STATUS, status);
++ }
++}
++
++static void vmx_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr)
++{
++ /*
++ * When running L2, updating RVI is only relevant when
++ * vmcs12 virtual-interrupt-delivery enabled.
++ * However, it can be enabled only when L1 also
++ * intercepts external-interrupts and in that case
++ * we should not update vmcs02 RVI but instead intercept
++ * interrupt. Therefore, do nothing when running L2.
++ */
++ if (!is_guest_mode(vcpu))
++ vmx_set_rvi(max_irr);
++}
++
++static int vmx_sync_pir_to_irr(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int max_irr;
++ bool max_irr_updated;
++
++ WARN_ON(!vcpu->arch.apicv_active);
++ if (pi_test_on(&vmx->pi_desc)) {
++ pi_clear_on(&vmx->pi_desc);
++ /*
++ * IOMMU can write to PIR.ON, so the barrier matters even on UP.
++ * But on x86 this is just a compiler barrier anyway.
++ */
++ smp_mb__after_atomic();
++ max_irr_updated =
++ kvm_apic_update_irr(vcpu, vmx->pi_desc.pir, &max_irr);
++
++ /*
++ * If we are running L2 and L1 has a new pending interrupt
++ * which can be injected, we should re-evaluate
++ * what should be done with this new L1 interrupt.
++ * If L1 intercepts external-interrupts, we should
++ * exit from L2 to L1. Otherwise, interrupt should be
++ * delivered directly to L2.
++ */
++ if (is_guest_mode(vcpu) && max_irr_updated) {
++ if (nested_exit_on_intr(vcpu))
++ kvm_vcpu_exiting_guest_mode(vcpu);
++ else
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
++ }
++ } else {
++ max_irr = kvm_lapic_find_highest_irr(vcpu);
++ }
++ vmx_hwapic_irr_update(vcpu, max_irr);
++ return max_irr;
++}
++
++static u8 vmx_has_apicv_interrupt(struct kvm_vcpu *vcpu)
++{
++ u8 rvi = vmx_get_rvi();
++ u8 vppr = kvm_lapic_get_reg(vcpu->arch.apic, APIC_PROCPRI);
++
++ return ((rvi & 0xf0) > (vppr & 0xf0));
++}
++
++static bool vmx_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
++{
++ return pi_test_on(vcpu_to_pi_desc(vcpu));
++}
++
++static void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
++{
++ if (!kvm_vcpu_apicv_active(vcpu))
++ return;
++
++ vmcs_write64(EOI_EXIT_BITMAP0, eoi_exit_bitmap[0]);
++ vmcs_write64(EOI_EXIT_BITMAP1, eoi_exit_bitmap[1]);
++ vmcs_write64(EOI_EXIT_BITMAP2, eoi_exit_bitmap[2]);
++ vmcs_write64(EOI_EXIT_BITMAP3, eoi_exit_bitmap[3]);
++}
++
++static void vmx_apicv_post_state_restore(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ pi_clear_on(&vmx->pi_desc);
++ memset(vmx->pi_desc.pir, 0, sizeof(vmx->pi_desc.pir));
++}
++
++static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
++{
++ if (vmx->exit_reason != EXIT_REASON_EXCEPTION_NMI)
++ return;
++
++ vmx->exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++
++ /* if exit due to PF check for async PF */
++ if (is_page_fault(vmx->exit_intr_info))
++ vmx->vcpu.arch.apf.host_apf_reason = kvm_read_and_reset_pf_reason();
++
++ /* Handle machine checks before interrupts are enabled */
++ if (is_machine_check(vmx->exit_intr_info))
++ kvm_machine_check();
++
++ /* We need to handle NMIs before interrupts are enabled */
++ if (is_nmi(vmx->exit_intr_info)) {
++ kvm_before_interrupt(&vmx->vcpu);
++ asm("int $2");
++ kvm_after_interrupt(&vmx->vcpu);
++ }
++}
++
++static void vmx_handle_external_intr(struct kvm_vcpu *vcpu)
++{
++ u32 exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++
++ if ((exit_intr_info & (INTR_INFO_VALID_MASK | INTR_INFO_INTR_TYPE_MASK))
++ == (INTR_INFO_VALID_MASK | INTR_TYPE_EXT_INTR)) {
++ unsigned int vector;
++ unsigned long entry;
++ gate_desc *desc;
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++#ifdef CONFIG_X86_64
++ unsigned long tmp;
++#endif
++
++ vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
++ desc = (gate_desc *)vmx->host_idt_base + vector;
++ entry = gate_offset(desc);
++ asm volatile(
++#ifdef CONFIG_X86_64
++ "mov %%" _ASM_SP ", %[sp]\n\t"
++ "and $0xfffffffffffffff0, %%" _ASM_SP "\n\t"
++ "push $%c[ss]\n\t"
++ "push %[sp]\n\t"
++#endif
++ "pushf\n\t"
++ __ASM_SIZE(push) " $%c[cs]\n\t"
++ CALL_NOSPEC
++ :
++#ifdef CONFIG_X86_64
++ [sp]"=&r"(tmp),
++#endif
++ ASM_CALL_CONSTRAINT
++ :
++ THUNK_TARGET(entry),
++ [ss]"i"(__KERNEL_DS),
++ [cs]"i"(__KERNEL_CS)
++ );
++ }
++}
++STACK_FRAME_NON_STANDARD(vmx_handle_external_intr);
++
++static bool vmx_has_emulated_msr(int index)
++{
++ switch (index) {
++ case MSR_IA32_SMBASE:
++ /*
++ * We cannot do SMM unless we can run the guest in big
++ * real mode.
++ */
++ return enable_unrestricted_guest || emulate_invalid_guest_state;
++ case MSR_AMD64_VIRT_SPEC_CTRL:
++ /* This is AMD only. */
++ return false;
++ default:
++ return true;
++ }
++}
++
++static bool vmx_mpx_supported(void)
++{
++ return (vmcs_config.vmexit_ctrl & VM_EXIT_CLEAR_BNDCFGS) &&
++ (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_BNDCFGS);
++}
++
++static bool vmx_xsaves_supported(void)
++{
++ return vmcs_config.cpu_based_2nd_exec_ctrl &
++ SECONDARY_EXEC_XSAVES;
++}
++
++static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
++{
++ u32 exit_intr_info;
++ bool unblock_nmi;
++ u8 vector;
++ bool idtv_info_valid;
++
++ idtv_info_valid = vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK;
++
++ if (enable_vnmi) {
++ if (vmx->loaded_vmcs->nmi_known_unmasked)
++ return;
++ /*
++ * Can't use vmx->exit_intr_info since we're not sure what
++ * the exit reason is.
++ */
++ exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
++ unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
++ vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
++ /*
++ * SDM 3: 27.7.1.2 (September 2008)
++ * Re-set bit "block by NMI" before VM entry if vmexit caused by
++ * a guest IRET fault.
++ * SDM 3: 23.2.2 (September 2008)
++ * Bit 12 is undefined in any of the following cases:
++ * If the VM exit sets the valid bit in the IDT-vectoring
++ * information field.
++ * If the VM exit is due to a double fault.
++ */
++ if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
++ vector != DF_VECTOR && !idtv_info_valid)
++ vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
++ GUEST_INTR_STATE_NMI);
++ else
++ vmx->loaded_vmcs->nmi_known_unmasked =
++ !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
++ & GUEST_INTR_STATE_NMI);
++ } else if (unlikely(vmx->loaded_vmcs->soft_vnmi_blocked))
++ vmx->loaded_vmcs->vnmi_blocked_time +=
++ ktime_to_ns(ktime_sub(ktime_get(),
++ vmx->loaded_vmcs->entry_time));
++}
++
++static void __vmx_complete_interrupts(struct kvm_vcpu *vcpu,
++ u32 idt_vectoring_info,
++ int instr_len_field,
++ int error_code_field)
++{
++ u8 vector;
++ int type;
++ bool idtv_info_valid;
++
++ idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
++
++ vcpu->arch.nmi_injected = false;
++ kvm_clear_exception_queue(vcpu);
++ kvm_clear_interrupt_queue(vcpu);
++
++ if (!idtv_info_valid)
++ return;
++
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
++
++ vector = idt_vectoring_info & VECTORING_INFO_VECTOR_MASK;
++ type = idt_vectoring_info & VECTORING_INFO_TYPE_MASK;
++
++ switch (type) {
++ case INTR_TYPE_NMI_INTR:
++ vcpu->arch.nmi_injected = true;
++ /*
++ * SDM 3: 27.7.1.2 (September 2008)
++ * Clear bit "block by NMI" before VM entry if a NMI
++ * delivery faulted.
++ */
++ vmx_set_nmi_mask(vcpu, false);
++ break;
++ case INTR_TYPE_SOFT_EXCEPTION:
++ vcpu->arch.event_exit_inst_len = vmcs_read32(instr_len_field);
++ /* fall through */
++ case INTR_TYPE_HARD_EXCEPTION:
++ if (idt_vectoring_info & VECTORING_INFO_DELIVER_CODE_MASK) {
++ u32 err = vmcs_read32(error_code_field);
++ kvm_requeue_exception_e(vcpu, vector, err);
++ } else
++ kvm_requeue_exception(vcpu, vector);
++ break;
++ case INTR_TYPE_SOFT_INTR:
++ vcpu->arch.event_exit_inst_len = vmcs_read32(instr_len_field);
++ /* fall through */
++ case INTR_TYPE_EXT_INTR:
++ kvm_queue_interrupt(vcpu, vector, type == INTR_TYPE_SOFT_INTR);
++ break;
++ default:
++ break;
++ }
++}
++
++static void vmx_complete_interrupts(struct vcpu_vmx *vmx)
++{
++ __vmx_complete_interrupts(&vmx->vcpu, vmx->idt_vectoring_info,
++ VM_EXIT_INSTRUCTION_LEN,
++ IDT_VECTORING_ERROR_CODE);
++}
++
++static void vmx_cancel_injection(struct kvm_vcpu *vcpu)
++{
++ __vmx_complete_interrupts(vcpu,
++ vmcs_read32(VM_ENTRY_INTR_INFO_FIELD),
++ VM_ENTRY_INSTRUCTION_LEN,
++ VM_ENTRY_EXCEPTION_ERROR_CODE);
++
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0);
++}
++
++static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx)
++{
++ int i, nr_msrs;
++ struct perf_guest_switch_msr *msrs;
++
++ msrs = perf_guest_get_msrs(&nr_msrs);
++
++ if (!msrs)
++ return;
++
++ for (i = 0; i < nr_msrs; i++)
++ if (msrs[i].host == msrs[i].guest)
++ clear_atomic_switch_msr(vmx, msrs[i].msr);
++ else
++ add_atomic_switch_msr(vmx, msrs[i].msr, msrs[i].guest,
++ msrs[i].host, false);
++}
++
++static void vmx_arm_hv_timer(struct vcpu_vmx *vmx, u32 val)
++{
++ vmcs_write32(VMX_PREEMPTION_TIMER_VALUE, val);
++ if (!vmx->loaded_vmcs->hv_timer_armed)
++ vmcs_set_bits(PIN_BASED_VM_EXEC_CONTROL,
++ PIN_BASED_VMX_PREEMPTION_TIMER);
++ vmx->loaded_vmcs->hv_timer_armed = true;
++}
++
++static void vmx_update_hv_timer(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u64 tscl;
++ u32 delta_tsc;
++
++ if (vmx->req_immediate_exit) {
++ vmx_arm_hv_timer(vmx, 0);
++ return;
++ }
++
++ if (vmx->hv_deadline_tsc != -1) {
++ tscl = rdtsc();
++ if (vmx->hv_deadline_tsc > tscl)
++ /* set_hv_timer ensures the delta fits in 32-bits */
++ delta_tsc = (u32)((vmx->hv_deadline_tsc - tscl) >>
++ cpu_preemption_timer_multi);
++ else
++ delta_tsc = 0;
++
++ vmx_arm_hv_timer(vmx, delta_tsc);
++ return;
++ }
++
++ if (vmx->loaded_vmcs->hv_timer_armed)
++ vmcs_clear_bits(PIN_BASED_VM_EXEC_CONTROL,
++ PIN_BASED_VMX_PREEMPTION_TIMER);
++ vmx->loaded_vmcs->hv_timer_armed = false;
++}
++
++u64 __always_inline vmx_spec_ctrl_restore_host(struct vcpu_vmx *vmx)
++{
++ u64 guestval, hostval = this_cpu_read(x86_spec_ctrl_current);
++
++ if (!cpu_feature_enabled(X86_FEATURE_MSR_SPEC_CTRL))
++ return 0;
++
++ guestval = __rdmsr(MSR_IA32_SPEC_CTRL);
++
++ /*
++ *
++ * For legacy IBRS, the IBRS bit always needs to be written after
++ * transitioning from a less privileged predictor mode, regardless of
++ * whether the guest/host values differ.
++ */
++ if (cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS) ||
++ guestval != hostval)
++ native_wrmsrl(MSR_IA32_SPEC_CTRL, hostval);
++
++ barrier_nospec();
++
++ return guestval;
++}
++
++static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long cr3, cr4, evmcs_rsp;
++ u64 spec_ctrl;
++
++ /* Record the guest's net vcpu time for enforced NMI injections. */
++ if (unlikely(!enable_vnmi &&
++ vmx->loaded_vmcs->soft_vnmi_blocked))
++ vmx->loaded_vmcs->entry_time = ktime_get();
++
++ /* Don't enter VMX if guest state is invalid, let the exit handler
++ start emulation until we arrive back to a valid state */
++ if (vmx->emulation_required)
++ return;
++
++ if (vmx->ple_window_dirty) {
++ vmx->ple_window_dirty = false;
++ vmcs_write32(PLE_WINDOW, vmx->ple_window);
++ }
++
++ if (vmx->nested.sync_shadow_vmcs) {
++ copy_vmcs12_to_shadow(vmx);
++ vmx->nested.sync_shadow_vmcs = false;
++ }
++
++ if (test_bit(VCPU_REGS_RSP, (unsigned long *)&vcpu->arch.regs_dirty))
++ vmcs_writel(GUEST_RSP, vcpu->arch.regs[VCPU_REGS_RSP]);
++ if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
++ vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
++
++ cr3 = __get_current_cr3_fast();
++ if (unlikely(cr3 != vmx->loaded_vmcs->host_state.cr3)) {
++ vmcs_writel(HOST_CR3, cr3);
++ vmx->loaded_vmcs->host_state.cr3 = cr3;
++ }
++
++ cr4 = cr4_read_shadow();
++ if (unlikely(cr4 != vmx->loaded_vmcs->host_state.cr4)) {
++ vmcs_writel(HOST_CR4, cr4);
++ vmx->loaded_vmcs->host_state.cr4 = cr4;
++ }
++
++ /* When single-stepping over STI and MOV SS, we must clear the
++ * corresponding interruptibility bits in the guest state. Otherwise
++ * vmentry fails as it then expects bit 14 (BS) in pending debug
++ * exceptions being set, but that's not correct for the guest debugging
++ * case. */
++ if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
++ vmx_set_interrupt_shadow(vcpu, 0);
++
++ kvm_load_guest_xcr0(vcpu);
++
++ if (static_cpu_has(X86_FEATURE_PKU) &&
++ kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
++ vcpu->arch.pkru != vmx->host_pkru)
++ __write_pkru(vcpu->arch.pkru);
++
++ atomic_switch_perf_msrs(vmx);
++
++ vmx_update_hv_timer(vcpu);
++
++ /*
++ * If this vCPU has touched SPEC_CTRL, restore the guest's value if
++ * it's non-zero. Since vmentry is serialising on affected CPUs, there
++ * is no need to worry about the conditional branch over the wrmsr
++ * being speculatively taken.
++ */
++ x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0);
++
++ vmx->__launched = vmx->loaded_vmcs->launched;
++
++ evmcs_rsp = static_branch_unlikely(&enable_evmcs) ?
++ (unsigned long)¤t_evmcs->host_rsp : 0;
++
++ /* L1D Flush includes CPU buffer clear to mitigate MDS */
++ if (static_branch_unlikely(&vmx_l1d_should_flush))
++ vmx_l1d_flush(vcpu);
++ else if (static_branch_unlikely(&mds_user_clear))
++ mds_clear_cpu_buffers();
++ else if (static_branch_unlikely(&mmio_stale_data_clear) &&
++ kvm_arch_has_assigned_device(vcpu->kvm))
++ mds_clear_cpu_buffers();
++
++ vmx_disable_fb_clear(vmx);
++
++ asm volatile (
++ /* Store host registers */
++ "push %%" _ASM_DX "; push %%" _ASM_BP ";"
++ "push %%" _ASM_CX " \n\t" /* placeholder for guest rcx */
++ "push %%" _ASM_CX " \n\t"
++ "cmp %%" _ASM_SP ", %c[host_rsp](%%" _ASM_CX ") \n\t"
++ "je 1f \n\t"
++ "mov %%" _ASM_SP ", %c[host_rsp](%%" _ASM_CX ") \n\t"
++ /* Avoid VMWRITE when Enlightened VMCS is in use */
++ "test %%" _ASM_SI ", %%" _ASM_SI " \n\t"
++ "jz 2f \n\t"
++ "mov %%" _ASM_SP ", (%%" _ASM_SI ") \n\t"
++ "jmp 1f \n\t"
++ "2: \n\t"
++ __ex(ASM_VMX_VMWRITE_RSP_RDX) "\n\t"
++ "1: \n\t"
++ /* Reload cr2 if changed */
++ "mov %c[cr2](%%" _ASM_CX "), %%" _ASM_AX " \n\t"
++ "mov %%cr2, %%" _ASM_DX " \n\t"
++ "cmp %%" _ASM_AX ", %%" _ASM_DX " \n\t"
++ "je 3f \n\t"
++ "mov %%" _ASM_AX", %%cr2 \n\t"
++ "3: \n\t"
++ /* Check if vmlaunch of vmresume is needed */
++ "cmpb $0, %c[launched](%%" _ASM_CX ") \n\t"
++ /* Load guest registers. Don't clobber flags. */
++ "mov %c[rax](%%" _ASM_CX "), %%" _ASM_AX " \n\t"
++ "mov %c[rbx](%%" _ASM_CX "), %%" _ASM_BX " \n\t"
++ "mov %c[rdx](%%" _ASM_CX "), %%" _ASM_DX " \n\t"
++ "mov %c[rsi](%%" _ASM_CX "), %%" _ASM_SI " \n\t"
++ "mov %c[rdi](%%" _ASM_CX "), %%" _ASM_DI " \n\t"
++ "mov %c[rbp](%%" _ASM_CX "), %%" _ASM_BP " \n\t"
++#ifdef CONFIG_X86_64
++ "mov %c[r8](%%" _ASM_CX "), %%r8 \n\t"
++ "mov %c[r9](%%" _ASM_CX "), %%r9 \n\t"
++ "mov %c[r10](%%" _ASM_CX "), %%r10 \n\t"
++ "mov %c[r11](%%" _ASM_CX "), %%r11 \n\t"
++ "mov %c[r12](%%" _ASM_CX "), %%r12 \n\t"
++ "mov %c[r13](%%" _ASM_CX "), %%r13 \n\t"
++ "mov %c[r14](%%" _ASM_CX "), %%r14 \n\t"
++ "mov %c[r15](%%" _ASM_CX "), %%r15 \n\t"
++#endif
++ /* Load guest RCX. This kills the vmx_vcpu pointer! */
++ "mov %c[rcx](%%" _ASM_CX "), %%" _ASM_CX " \n\t"
++
++ /* Enter guest mode */
++ "jne 1f \n\t"
++ __ex(ASM_VMX_VMLAUNCH) "\n\t"
++ "jmp 2f \n\t"
++ "1: " __ex(ASM_VMX_VMRESUME) "\n\t"
++ "2: "
++
++ /* Save guest's RCX to the stack placeholder (see above) */
++ "mov %%" _ASM_CX ", %c[wordsize](%%" _ASM_SP ") \n\t"
++
++ /* Load host's RCX, i.e. the vmx_vcpu pointer */
++ "pop %%" _ASM_CX " \n\t"
++
++ /* Set vmx->fail based on EFLAGS.{CF,ZF} */
++ "setbe %c[fail](%%" _ASM_CX ")\n\t"
++
++ /* Save all guest registers, including RCX from the stack */
++ "mov %%" _ASM_AX ", %c[rax](%%" _ASM_CX ") \n\t"
++ "mov %%" _ASM_BX ", %c[rbx](%%" _ASM_CX ") \n\t"
++ __ASM_SIZE(pop) " %c[rcx](%%" _ASM_CX ") \n\t"
++ "mov %%" _ASM_DX ", %c[rdx](%%" _ASM_CX ") \n\t"
++ "mov %%" _ASM_SI ", %c[rsi](%%" _ASM_CX ") \n\t"
++ "mov %%" _ASM_DI ", %c[rdi](%%" _ASM_CX ") \n\t"
++ "mov %%" _ASM_BP ", %c[rbp](%%" _ASM_CX ") \n\t"
++#ifdef CONFIG_X86_64
++ "mov %%r8, %c[r8](%%" _ASM_CX ") \n\t"
++ "mov %%r9, %c[r9](%%" _ASM_CX ") \n\t"
++ "mov %%r10, %c[r10](%%" _ASM_CX ") \n\t"
++ "mov %%r11, %c[r11](%%" _ASM_CX ") \n\t"
++ "mov %%r12, %c[r12](%%" _ASM_CX ") \n\t"
++ "mov %%r13, %c[r13](%%" _ASM_CX ") \n\t"
++ "mov %%r14, %c[r14](%%" _ASM_CX ") \n\t"
++ "mov %%r15, %c[r15](%%" _ASM_CX ") \n\t"
++
++ /*
++ * Clear all general purpose registers (except RSP, which is loaded by
++ * the CPU during VM-Exit) to prevent speculative use of the guest's
++ * values, even those that are saved/loaded via the stack. In theory,
++ * an L1 cache miss when restoring registers could lead to speculative
++ * execution with the guest's values. Zeroing XORs are dirt cheap,
++ * i.e. the extra paranoia is essentially free.
++ */
++ "xor %%r8d, %%r8d \n\t"
++ "xor %%r9d, %%r9d \n\t"
++ "xor %%r10d, %%r10d \n\t"
++ "xor %%r11d, %%r11d \n\t"
++ "xor %%r12d, %%r12d \n\t"
++ "xor %%r13d, %%r13d \n\t"
++ "xor %%r14d, %%r14d \n\t"
++ "xor %%r15d, %%r15d \n\t"
++#endif
++ "mov %%cr2, %%" _ASM_AX " \n\t"
++ "mov %%" _ASM_AX ", %c[cr2](%%" _ASM_CX ") \n\t"
++
++ "xor %%eax, %%eax \n\t"
++ "xor %%ebx, %%ebx \n\t"
++ "xor %%ecx, %%ecx \n\t"
++ "xor %%edx, %%edx \n\t"
++ "xor %%esi, %%esi \n\t"
++ "xor %%edi, %%edi \n\t"
++ "xor %%ebp, %%ebp \n\t"
++ "pop %%" _ASM_BP "; pop %%" _ASM_DX " \n\t"
++ ".pushsection .rodata \n\t"
++ ".global vmx_return \n\t"
++ "vmx_return: " _ASM_PTR " 2b \n\t"
++ ".popsection"
++ : "=c"((int){0}), "=d"((int){0}), "=S"((int){0})
++ : "c"(vmx), "d"((unsigned long)HOST_RSP), "S"(evmcs_rsp),
++ [launched]"i"(offsetof(struct vcpu_vmx, __launched)),
++ [fail]"i"(offsetof(struct vcpu_vmx, fail)),
++ [host_rsp]"i"(offsetof(struct vcpu_vmx, host_rsp)),
++ [rax]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RAX])),
++ [rbx]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RBX])),
++ [rcx]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RCX])),
++ [rdx]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RDX])),
++ [rsi]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RSI])),
++ [rdi]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RDI])),
++ [rbp]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_RBP])),
++#ifdef CONFIG_X86_64
++ [r8]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R8])),
++ [r9]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R9])),
++ [r10]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R10])),
++ [r11]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R11])),
++ [r12]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R12])),
++ [r13]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R13])),
++ [r14]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R14])),
++ [r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
++#endif
++ [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
++ [wordsize]"i"(sizeof(ulong))
++ : "cc", "memory"
++#ifdef CONFIG_X86_64
++ , "rax", "rbx", "rdi"
++ , "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
++#else
++ , "eax", "ebx", "edi"
++#endif
++ );
++
++ /*
++ * IMPORTANT: RSB filling and SPEC_CTRL handling must be done before
++ * the first unbalanced RET after vmexit!
++ *
++ * For retpoline or IBRS, RSB filling is needed to prevent poisoned RSB
++ * entries and (in some cases) RSB underflow.
++ *
++ * eIBRS has its own protection against poisoned RSB, so it doesn't
++ * need the RSB filling sequence. But it does need to be enabled, and a
++ * single call to retire, before the first unbalanced RET.
++ *
++ * So no RETs before vmx_spec_ctrl_restore_host() below.
++ */
++ vmexit_fill_RSB();
++
++ /* Save this for below */
++ spec_ctrl = vmx_spec_ctrl_restore_host(vmx);
++
++ vmx_enable_fb_clear(vmx);
++
++ /*
++ * We do not use IBRS in the kernel. If this vCPU has used the
++ * SPEC_CTRL MSR it may have left it on; save the value and
++ * turn it off. This is much more efficient than blindly adding
++ * it to the atomic save/restore list. Especially as the former
++ * (Saving guest MSRs on vmexit) doesn't even exist in KVM.
++ *
++ * For non-nested case:
++ * If the L01 MSR bitmap does not intercept the MSR, then we need to
++ * save it.
++ *
++ * For nested case:
++ * If the L02 MSR bitmap does not intercept the MSR, then we need to
++ * save it.
++ */
++ if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)))
++ vmx->spec_ctrl = spec_ctrl;
++
++ /* All fields are clean at this point */
++ if (static_branch_unlikely(&enable_evmcs))
++ current_evmcs->hv_clean_fields |=
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL;
++
++ /* MSR_IA32_DEBUGCTLMSR is zeroed on vmexit. Restore it if needed */
++ if (vmx->host_debugctlmsr)
++ update_debugctlmsr(vmx->host_debugctlmsr);
++
++#ifndef CONFIG_X86_64
++ /*
++ * The sysexit path does not restore ds/es, so we must set them to
++ * a reasonable value ourselves.
++ *
++ * We can't defer this to vmx_prepare_switch_to_host() since that
++ * function may be executed in interrupt context, which saves and
++ * restore segments around it, nullifying its effect.
++ */
++ loadsegment(ds, __USER_DS);
++ loadsegment(es, __USER_DS);
++#endif
++
++ vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
++ | (1 << VCPU_EXREG_RFLAGS)
++ | (1 << VCPU_EXREG_PDPTR)
++ | (1 << VCPU_EXREG_SEGMENTS)
++ | (1 << VCPU_EXREG_CR3));
++ vcpu->arch.regs_dirty = 0;
++
++ /*
++ * eager fpu is enabled if PKEY is supported and CR4 is switched
++ * back on host, so it is safe to read guest PKRU from current
++ * XSAVE.
++ */
++ if (static_cpu_has(X86_FEATURE_PKU) &&
++ kvm_read_cr4_bits(vcpu, X86_CR4_PKE)) {
++ vcpu->arch.pkru = __read_pkru();
++ if (vcpu->arch.pkru != vmx->host_pkru)
++ __write_pkru(vmx->host_pkru);
++ }
++
++ kvm_put_guest_xcr0(vcpu);
++
++ vmx->nested.nested_run_pending = 0;
++ vmx->idt_vectoring_info = 0;
++
++ vmx->exit_reason = vmx->fail ? 0xdead : vmcs_read32(VM_EXIT_REASON);
++ if ((u16)vmx->exit_reason == EXIT_REASON_MCE_DURING_VMENTRY)
++ kvm_machine_check();
++
++ if (vmx->fail || (vmx->exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY))
++ return;
++
++ vmx->loaded_vmcs->launched = 1;
++ vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
++
++ vmx_complete_atomic_exit(vmx);
++ vmx_recover_nmi_blocking(vmx);
++ vmx_complete_interrupts(vmx);
++}
++STACK_FRAME_NON_STANDARD(vmx_vcpu_run);
++
++static struct kvm *vmx_vm_alloc(void)
++{
++ struct kvm_vmx *kvm_vmx = vzalloc(sizeof(struct kvm_vmx));
++
++ if (!kvm_vmx)
++ return NULL;
++
++ return &kvm_vmx->kvm;
++}
++
++static void vmx_vm_free(struct kvm *kvm)
++{
++ vfree(to_kvm_vmx(kvm));
++}
++
++static void vmx_switch_vmcs(struct kvm_vcpu *vcpu, struct loaded_vmcs *vmcs)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int cpu;
++
++ if (vmx->loaded_vmcs == vmcs)
++ return;
++
++ cpu = get_cpu();
++ vmx_vcpu_put(vcpu);
++ vmx->loaded_vmcs = vmcs;
++ vmx_vcpu_load(vcpu, cpu);
++ put_cpu();
++}
++
++/*
++ * Ensure that the current vmcs of the logical processor is the
++ * vmcs01 of the vcpu before calling free_nested().
++ */
++static void vmx_free_vcpu_nested(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ vcpu_load(vcpu);
++ vmx_switch_vmcs(vcpu, &vmx->vmcs01);
++ free_nested(vmx);
++ vcpu_put(vcpu);
++}
++
++static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (enable_pml)
++ vmx_destroy_pml_buffer(vmx);
++ free_vpid(vmx->vpid);
++ leave_guest_mode(vcpu);
++ vmx_free_vcpu_nested(vcpu);
++ free_loaded_vmcs(vmx->loaded_vmcs);
++ kfree(vmx->guest_msrs);
++ kvm_vcpu_uninit(vcpu);
++ kmem_cache_free(kvm_vcpu_cache, vmx);
++}
++
++static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
++{
++ int err;
++ struct vcpu_vmx *vmx = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL);
++ unsigned long *msr_bitmap;
++ int cpu;
++
++ if (!vmx)
++ return ERR_PTR(-ENOMEM);
++
++ vmx->vpid = allocate_vpid();
++
++ err = kvm_vcpu_init(&vmx->vcpu, kvm, id);
++ if (err)
++ goto free_vcpu;
++
++ err = -ENOMEM;
++
++ /*
++ * If PML is turned on, failure on enabling PML just results in failure
++ * of creating the vcpu, therefore we can simplify PML logic (by
++ * avoiding dealing with cases, such as enabling PML partially on vcpus
++ * for the guest, etc.
++ */
++ if (enable_pml) {
++ vmx->pml_pg = alloc_page(GFP_KERNEL | __GFP_ZERO);
++ if (!vmx->pml_pg)
++ goto uninit_vcpu;
++ }
++
++ vmx->guest_msrs = kmalloc(PAGE_SIZE, GFP_KERNEL);
++ BUILD_BUG_ON(ARRAY_SIZE(vmx_msr_index) * sizeof(vmx->guest_msrs[0])
++ > PAGE_SIZE);
++
++ if (!vmx->guest_msrs)
++ goto free_pml;
++
++ err = alloc_loaded_vmcs(&vmx->vmcs01);
++ if (err < 0)
++ goto free_msrs;
++
++ msr_bitmap = vmx->vmcs01.msr_bitmap;
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_FS_BASE, MSR_TYPE_RW);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_GS_BASE, MSR_TYPE_RW);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_KERNEL_GS_BASE, MSR_TYPE_RW);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_CS, MSR_TYPE_RW);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_ESP, MSR_TYPE_RW);
++ vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_SYSENTER_EIP, MSR_TYPE_RW);
++ vmx->msr_bitmap_mode = 0;
++
++ vmx->loaded_vmcs = &vmx->vmcs01;
++ cpu = get_cpu();
++ vmx_vcpu_load(&vmx->vcpu, cpu);
++ vmx->vcpu.cpu = cpu;
++ vmx_vcpu_setup(vmx);
++ vmx_vcpu_put(&vmx->vcpu);
++ put_cpu();
++ if (cpu_need_virtualize_apic_accesses(&vmx->vcpu)) {
++ err = alloc_apic_access_page(kvm);
++ if (err)
++ goto free_vmcs;
++ }
++
++ if (enable_ept && !enable_unrestricted_guest) {
++ err = init_rmode_identity_map(kvm);
++ if (err)
++ goto free_vmcs;
++ }
++
++ if (nested)
++ nested_vmx_setup_ctls_msrs(&vmx->nested.msrs,
++ kvm_vcpu_apicv_active(&vmx->vcpu));
++
++ vmx->nested.posted_intr_nv = -1;
++ vmx->nested.current_vmptr = -1ull;
++
++ vmx->msr_ia32_feature_control_valid_bits = FEATURE_CONTROL_LOCKED;
++
++ /*
++ * Enforce invariant: pi_desc.nv is always either POSTED_INTR_VECTOR
++ * or POSTED_INTR_WAKEUP_VECTOR.
++ */
++ vmx->pi_desc.nv = POSTED_INTR_VECTOR;
++ vmx->pi_desc.sn = 1;
++
++ return &vmx->vcpu;
++
++free_vmcs:
++ free_loaded_vmcs(vmx->loaded_vmcs);
++free_msrs:
++ kfree(vmx->guest_msrs);
++free_pml:
++ vmx_destroy_pml_buffer(vmx);
++uninit_vcpu:
++ kvm_vcpu_uninit(&vmx->vcpu);
++free_vcpu:
++ free_vpid(vmx->vpid);
++ kmem_cache_free(kvm_vcpu_cache, vmx);
++ return ERR_PTR(err);
++}
++
++#define L1TF_MSG_SMT "L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
++#define L1TF_MSG_L1D "L1TF CPU bug present and virtualization mitigation disabled, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.\n"
++
++static int vmx_vm_init(struct kvm *kvm)
++{
++ spin_lock_init(&to_kvm_vmx(kvm)->ept_pointer_lock);
++
++ if (!ple_gap)
++ kvm->arch.pause_in_guest = true;
++
++ if (boot_cpu_has(X86_BUG_L1TF) && enable_ept) {
++ switch (l1tf_mitigation) {
++ case L1TF_MITIGATION_OFF:
++ case L1TF_MITIGATION_FLUSH_NOWARN:
++ /* 'I explicitly don't care' is set */
++ break;
++ case L1TF_MITIGATION_FLUSH:
++ case L1TF_MITIGATION_FLUSH_NOSMT:
++ case L1TF_MITIGATION_FULL:
++ /*
++ * Warn upon starting the first VM in a potentially
++ * insecure environment.
++ */
++ if (sched_smt_active())
++ pr_warn_once(L1TF_MSG_SMT);
++ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER)
++ pr_warn_once(L1TF_MSG_L1D);
++ break;
++ case L1TF_MITIGATION_FULL_FORCE:
++ /* Flush is enforced */
++ break;
++ }
++ }
++ return 0;
++}
++
++static void __init vmx_check_processor_compat(void *rtn)
++{
++ struct vmcs_config vmcs_conf;
++
++ *(int *)rtn = 0;
++ if (setup_vmcs_config(&vmcs_conf) < 0)
++ *(int *)rtn = -EIO;
++ nested_vmx_setup_ctls_msrs(&vmcs_conf.nested, enable_apicv);
++ if (memcmp(&vmcs_config, &vmcs_conf, sizeof(struct vmcs_config)) != 0) {
++ printk(KERN_ERR "kvm: CPU %d feature inconsistency!\n",
++ smp_processor_id());
++ *(int *)rtn = -EIO;
++ }
++}
++
++static u64 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
++{
++ u8 cache;
++ u64 ipat = 0;
++
++ /* For VT-d and EPT combination
++ * 1. MMIO: always map as UC
++ * 2. EPT with VT-d:
++ * a. VT-d without snooping control feature: can't guarantee the
++ * result, try to trust guest.
++ * b. VT-d with snooping control feature: snooping control feature of
++ * VT-d engine can guarantee the cache correctness. Just set it
++ * to WB to keep consistent with host. So the same as item 3.
++ * 3. EPT without VT-d: always map as WB and set IPAT=1 to keep
++ * consistent with host MTRR
++ */
++ if (is_mmio) {
++ cache = MTRR_TYPE_UNCACHABLE;
++ goto exit;
++ }
++
++ if (!kvm_arch_has_noncoherent_dma(vcpu->kvm)) {
++ ipat = VMX_EPT_IPAT_BIT;
++ cache = MTRR_TYPE_WRBACK;
++ goto exit;
++ }
++
++ if (kvm_read_cr0(vcpu) & X86_CR0_CD) {
++ ipat = VMX_EPT_IPAT_BIT;
++ if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
++ cache = MTRR_TYPE_WRBACK;
++ else
++ cache = MTRR_TYPE_UNCACHABLE;
++ goto exit;
++ }
++
++ cache = kvm_mtrr_get_guest_memory_type(vcpu, gfn);
++
++exit:
++ return (cache << VMX_EPT_MT_EPTE_SHIFT) | ipat;
++}
++
++static int vmx_get_lpage_level(void)
++{
++ if (enable_ept && !cpu_has_vmx_ept_1g_page())
++ return PT_DIRECTORY_LEVEL;
++ else
++ /* For shadow and EPT supported 1GB page */
++ return PT_PDPE_LEVEL;
++}
++
++static void vmcs_set_secondary_exec_control(u32 new_ctl)
++{
++ /*
++ * These bits in the secondary execution controls field
++ * are dynamic, the others are mostly based on the hypervisor
++ * architecture and the guest's CPUID. Do not touch the
++ * dynamic bits.
++ */
++ u32 mask =
++ SECONDARY_EXEC_SHADOW_VMCS |
++ SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
++ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
++ SECONDARY_EXEC_DESC;
++
++ u32 cur_ctl = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
++
++ vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
++ (new_ctl & ~mask) | (cur_ctl & mask));
++}
++
++/*
++ * Generate MSR_IA32_VMX_CR{0,4}_FIXED1 according to CPUID. Only set bits
++ * (indicating "allowed-1") if they are supported in the guest's CPUID.
++ */
++static void nested_vmx_cr_fixed1_bits_update(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct kvm_cpuid_entry2 *entry;
++
++ vmx->nested.msrs.cr0_fixed1 = 0xffffffff;
++ vmx->nested.msrs.cr4_fixed1 = X86_CR4_PCE;
++
++#define cr4_fixed1_update(_cr4_mask, _reg, _cpuid_mask) do { \
++ if (entry && (entry->_reg & (_cpuid_mask))) \
++ vmx->nested.msrs.cr4_fixed1 |= (_cr4_mask); \
++} while (0)
++
++ entry = kvm_find_cpuid_entry(vcpu, 0x1, 0);
++ cr4_fixed1_update(X86_CR4_VME, edx, bit(X86_FEATURE_VME));
++ cr4_fixed1_update(X86_CR4_PVI, edx, bit(X86_FEATURE_VME));
++ cr4_fixed1_update(X86_CR4_TSD, edx, bit(X86_FEATURE_TSC));
++ cr4_fixed1_update(X86_CR4_DE, edx, bit(X86_FEATURE_DE));
++ cr4_fixed1_update(X86_CR4_PSE, edx, bit(X86_FEATURE_PSE));
++ cr4_fixed1_update(X86_CR4_PAE, edx, bit(X86_FEATURE_PAE));
++ cr4_fixed1_update(X86_CR4_MCE, edx, bit(X86_FEATURE_MCE));
++ cr4_fixed1_update(X86_CR4_PGE, edx, bit(X86_FEATURE_PGE));
++ cr4_fixed1_update(X86_CR4_OSFXSR, edx, bit(X86_FEATURE_FXSR));
++ cr4_fixed1_update(X86_CR4_OSXMMEXCPT, edx, bit(X86_FEATURE_XMM));
++ cr4_fixed1_update(X86_CR4_VMXE, ecx, bit(X86_FEATURE_VMX));
++ cr4_fixed1_update(X86_CR4_SMXE, ecx, bit(X86_FEATURE_SMX));
++ cr4_fixed1_update(X86_CR4_PCIDE, ecx, bit(X86_FEATURE_PCID));
++ cr4_fixed1_update(X86_CR4_OSXSAVE, ecx, bit(X86_FEATURE_XSAVE));
++
++ entry = kvm_find_cpuid_entry(vcpu, 0x7, 0);
++ cr4_fixed1_update(X86_CR4_FSGSBASE, ebx, bit(X86_FEATURE_FSGSBASE));
++ cr4_fixed1_update(X86_CR4_SMEP, ebx, bit(X86_FEATURE_SMEP));
++ cr4_fixed1_update(X86_CR4_SMAP, ebx, bit(X86_FEATURE_SMAP));
++ cr4_fixed1_update(X86_CR4_PKE, ecx, bit(X86_FEATURE_PKU));
++ cr4_fixed1_update(X86_CR4_UMIP, ecx, bit(X86_FEATURE_UMIP));
++
++#undef cr4_fixed1_update
++}
++
++static void nested_vmx_entry_exit_ctls_update(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (kvm_mpx_supported()) {
++ bool mpx_enabled = guest_cpuid_has(vcpu, X86_FEATURE_MPX);
++
++ if (mpx_enabled) {
++ vmx->nested.msrs.entry_ctls_high |= VM_ENTRY_LOAD_BNDCFGS;
++ vmx->nested.msrs.exit_ctls_high |= VM_EXIT_CLEAR_BNDCFGS;
++ } else {
++ vmx->nested.msrs.entry_ctls_high &= ~VM_ENTRY_LOAD_BNDCFGS;
++ vmx->nested.msrs.exit_ctls_high &= ~VM_EXIT_CLEAR_BNDCFGS;
++ }
++ }
++}
++
++static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (cpu_has_secondary_exec_ctrls()) {
++ vmx_compute_secondary_exec_control(vmx);
++ vmcs_set_secondary_exec_control(vmx->secondary_exec_control);
++ }
++
++ if (nested_vmx_allowed(vcpu))
++ to_vmx(vcpu)->msr_ia32_feature_control_valid_bits |=
++ FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
++ else
++ to_vmx(vcpu)->msr_ia32_feature_control_valid_bits &=
++ ~FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
++
++ if (nested_vmx_allowed(vcpu)) {
++ nested_vmx_cr_fixed1_bits_update(vcpu);
++ nested_vmx_entry_exit_ctls_update(vcpu);
++ }
++}
++
++static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
++{
++ if (func == 1 && nested)
++ entry->ecx |= bit(X86_FEATURE_VMX);
++}
++
++static void nested_ept_inject_page_fault(struct kvm_vcpu *vcpu,
++ struct x86_exception *fault)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 exit_reason;
++ unsigned long exit_qualification = vcpu->arch.exit_qualification;
++
++ if (vmx->nested.pml_full) {
++ exit_reason = EXIT_REASON_PML_FULL;
++ vmx->nested.pml_full = false;
++ exit_qualification &= INTR_INFO_UNBLOCK_NMI;
++ } else if (fault->error_code & PFERR_RSVD_MASK)
++ exit_reason = EXIT_REASON_EPT_MISCONFIG;
++ else
++ exit_reason = EXIT_REASON_EPT_VIOLATION;
++
++ nested_vmx_vmexit(vcpu, exit_reason, 0, exit_qualification);
++ vmcs12->guest_physical_address = fault->address;
++}
++
++static bool nested_ept_ad_enabled(struct kvm_vcpu *vcpu)
++{
++ return nested_ept_get_cr3(vcpu) & VMX_EPTP_AD_ENABLE_BIT;
++}
++
++/* Callbacks for nested_ept_init_mmu_context: */
++
++static unsigned long nested_ept_get_cr3(struct kvm_vcpu *vcpu)
++{
++ /* return the page table to be shadowed - in our case, EPT12 */
++ return get_vmcs12(vcpu)->ept_pointer;
++}
++
++static int nested_ept_init_mmu_context(struct kvm_vcpu *vcpu)
++{
++ WARN_ON(mmu_is_nested(vcpu));
++ if (!valid_ept_address(vcpu, nested_ept_get_cr3(vcpu)))
++ return 1;
++
++ kvm_init_shadow_ept_mmu(vcpu,
++ to_vmx(vcpu)->nested.msrs.ept_caps &
++ VMX_EPT_EXECUTE_ONLY_BIT,
++ nested_ept_ad_enabled(vcpu),
++ nested_ept_get_cr3(vcpu));
++ vcpu->arch.mmu.set_cr3 = vmx_set_cr3;
++ vcpu->arch.mmu.get_cr3 = nested_ept_get_cr3;
++ vcpu->arch.mmu.inject_page_fault = nested_ept_inject_page_fault;
++
++ vcpu->arch.walk_mmu = &vcpu->arch.nested_mmu;
++ return 0;
++}
++
++static void nested_ept_uninit_mmu_context(struct kvm_vcpu *vcpu)
++{
++ vcpu->arch.walk_mmu = &vcpu->arch.mmu;
++}
++
++static bool nested_vmx_is_page_fault_vmexit(struct vmcs12 *vmcs12,
++ u16 error_code)
++{
++ bool inequality, bit;
++
++ bit = (vmcs12->exception_bitmap & (1u << PF_VECTOR)) != 0;
++ inequality =
++ (error_code & vmcs12->page_fault_error_code_mask) !=
++ vmcs12->page_fault_error_code_match;
++ return inequality ^ bit;
++}
++
++static void vmx_inject_page_fault_nested(struct kvm_vcpu *vcpu,
++ struct x86_exception *fault)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++
++ WARN_ON(!is_guest_mode(vcpu));
++
++ if (nested_vmx_is_page_fault_vmexit(vmcs12, fault->error_code) &&
++ !to_vmx(vcpu)->nested.nested_run_pending) {
++ vmcs12->vm_exit_intr_error_code = fault->error_code;
++ nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
++ PF_VECTOR | INTR_TYPE_HARD_EXCEPTION |
++ INTR_INFO_DELIVER_CODE_MASK | INTR_INFO_VALID_MASK,
++ fault->address);
++ } else {
++ kvm_inject_page_fault(vcpu, fault);
++ }
++}
++
++static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12);
++
++static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct page *page;
++ u64 hpa;
++
++ if (nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
++ /*
++ * Translate L1 physical address to host physical
++ * address for vmcs02. Keep the page pinned, so this
++ * physical address remains valid. We keep a reference
++ * to it so we can release it later.
++ */
++ if (vmx->nested.apic_access_page) { /* shouldn't happen */
++ kvm_release_page_dirty(vmx->nested.apic_access_page);
++ vmx->nested.apic_access_page = NULL;
++ }
++ page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->apic_access_addr);
++ /*
++ * If translation failed, no matter: This feature asks
++ * to exit when accessing the given address, and if it
++ * can never be accessed, this feature won't do
++ * anything anyway.
++ */
++ if (!is_error_page(page)) {
++ vmx->nested.apic_access_page = page;
++ hpa = page_to_phys(vmx->nested.apic_access_page);
++ vmcs_write64(APIC_ACCESS_ADDR, hpa);
++ } else {
++ vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL,
++ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES);
++ }
++ }
++
++ if (nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW)) {
++ if (vmx->nested.virtual_apic_page) { /* shouldn't happen */
++ kvm_release_page_dirty(vmx->nested.virtual_apic_page);
++ vmx->nested.virtual_apic_page = NULL;
++ }
++ page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->virtual_apic_page_addr);
++
++ /*
++ * If translation failed, VM entry will fail because
++ * prepare_vmcs02 set VIRTUAL_APIC_PAGE_ADDR to -1ull.
++ * Failing the vm entry is _not_ what the processor
++ * does but it's basically the only possibility we
++ * have. We could still enter the guest if CR8 load
++ * exits are enabled, CR8 store exits are enabled, and
++ * virtualize APIC access is disabled; in this case
++ * the processor would never use the TPR shadow and we
++ * could simply clear the bit from the execution
++ * control. But such a configuration is useless, so
++ * let's keep the code simple.
++ */
++ if (!is_error_page(page)) {
++ vmx->nested.virtual_apic_page = page;
++ hpa = page_to_phys(vmx->nested.virtual_apic_page);
++ vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, hpa);
++ }
++ }
++
++ if (nested_cpu_has_posted_intr(vmcs12)) {
++ if (vmx->nested.pi_desc_page) { /* shouldn't happen */
++ kunmap(vmx->nested.pi_desc_page);
++ kvm_release_page_dirty(vmx->nested.pi_desc_page);
++ vmx->nested.pi_desc_page = NULL;
++ vmx->nested.pi_desc = NULL;
++ vmcs_write64(POSTED_INTR_DESC_ADDR, -1ull);
++ }
++ page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->posted_intr_desc_addr);
++ if (is_error_page(page))
++ return;
++ vmx->nested.pi_desc_page = page;
++ vmx->nested.pi_desc = kmap(vmx->nested.pi_desc_page);
++ vmx->nested.pi_desc =
++ (struct pi_desc *)((void *)vmx->nested.pi_desc +
++ (unsigned long)(vmcs12->posted_intr_desc_addr &
++ (PAGE_SIZE - 1)));
++ vmcs_write64(POSTED_INTR_DESC_ADDR,
++ page_to_phys(vmx->nested.pi_desc_page) +
++ (unsigned long)(vmcs12->posted_intr_desc_addr &
++ (PAGE_SIZE - 1)));
++ }
++ if (nested_vmx_prepare_msr_bitmap(vcpu, vmcs12))
++ vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL,
++ CPU_BASED_USE_MSR_BITMAPS);
++ else
++ vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
++ CPU_BASED_USE_MSR_BITMAPS);
++}
++
++static void vmx_start_preemption_timer(struct kvm_vcpu *vcpu)
++{
++ u64 preemption_timeout = get_vmcs12(vcpu)->vmx_preemption_timer_value;
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ /*
++ * A timer value of zero is architecturally guaranteed to cause
++ * a VMExit prior to executing any instructions in the guest.
++ */
++ if (preemption_timeout == 0) {
++ vmx_preemption_timer_fn(&vmx->nested.preemption_timer);
++ return;
++ }
++
++ if (vcpu->arch.virtual_tsc_khz == 0)
++ return;
++
++ preemption_timeout <<= VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE;
++ preemption_timeout *= 1000000;
++ do_div(preemption_timeout, vcpu->arch.virtual_tsc_khz);
++ hrtimer_start(&vmx->nested.preemption_timer,
++ ns_to_ktime(preemption_timeout), HRTIMER_MODE_REL);
++}
++
++static int nested_vmx_check_io_bitmap_controls(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ if (!nested_cpu_has(vmcs12, CPU_BASED_USE_IO_BITMAPS))
++ return 0;
++
++ if (!page_address_valid(vcpu, vmcs12->io_bitmap_a) ||
++ !page_address_valid(vcpu, vmcs12->io_bitmap_b))
++ return -EINVAL;
++
++ return 0;
++}
++
++static int nested_vmx_check_msr_bitmap_controls(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ if (!nested_cpu_has(vmcs12, CPU_BASED_USE_MSR_BITMAPS))
++ return 0;
++
++ if (!page_address_valid(vcpu, vmcs12->msr_bitmap))
++ return -EINVAL;
++
++ return 0;
++}
++
++static int nested_vmx_check_tpr_shadow_controls(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ if (!nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
++ return 0;
++
++ if (!page_address_valid(vcpu, vmcs12->virtual_apic_page_addr))
++ return -EINVAL;
++
++ return 0;
++}
++
++static inline void enable_x2apic_msr_intercepts(unsigned long *msr_bitmap) {
++ int msr;
++
++ for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
++ unsigned word = msr / BITS_PER_LONG;
++
++ msr_bitmap[word] = ~0;
++ msr_bitmap[word + (0x800 / sizeof(long))] = ~0;
++ }
++}
++
++/*
++ * Merge L0's and L1's MSR bitmap, return false to indicate that
++ * we do not use the hardware.
++ */
++static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ int msr;
++ struct page *page;
++ unsigned long *msr_bitmap_l1;
++ unsigned long *msr_bitmap_l0 = to_vmx(vcpu)->nested.vmcs02.msr_bitmap;
++ /*
++ * pred_cmd & spec_ctrl are trying to verify two things:
++ *
++ * 1. L0 gave a permission to L1 to actually passthrough the MSR. This
++ * ensures that we do not accidentally generate an L02 MSR bitmap
++ * from the L12 MSR bitmap that is too permissive.
++ * 2. That L1 or L2s have actually used the MSR. This avoids
++ * unnecessarily merging of the bitmap if the MSR is unused. This
++ * works properly because we only update the L01 MSR bitmap lazily.
++ * So even if L0 should pass L1 these MSRs, the L01 bitmap is only
++ * updated to reflect this when L1 (or its L2s) actually write to
++ * the MSR.
++ */
++ bool pred_cmd = !msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD);
++ bool spec_ctrl = !msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL);
++
++ /* Nothing to do if the MSR bitmap is not in use. */
++ if (!cpu_has_vmx_msr_bitmap() ||
++ !nested_cpu_has(vmcs12, CPU_BASED_USE_MSR_BITMAPS))
++ return false;
++
++ if (!nested_cpu_has_virt_x2apic_mode(vmcs12) &&
++ !pred_cmd && !spec_ctrl)
++ return false;
++
++ page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->msr_bitmap);
++ if (is_error_page(page))
++ return false;
++
++ msr_bitmap_l1 = (unsigned long *)kmap(page);
++
++ /*
++ * To keep the control flow simple, pay eight 8-byte writes (sixteen
++ * 4-byte writes on 32-bit systems) up front to enable intercepts for
++ * the x2APIC MSR range and selectively disable them below.
++ */
++ enable_x2apic_msr_intercepts(msr_bitmap_l0);
++
++ if (nested_cpu_has_virt_x2apic_mode(vmcs12)) {
++ if (nested_cpu_has_apic_reg_virt(vmcs12)) {
++ /*
++ * L0 need not intercept reads for MSRs between 0x800
++ * and 0x8ff, it just lets the processor take the value
++ * from the virtual-APIC page; take those 256 bits
++ * directly from the L1 bitmap.
++ */
++ for (msr = 0x800; msr <= 0x8ff; msr += BITS_PER_LONG) {
++ unsigned word = msr / BITS_PER_LONG;
++
++ msr_bitmap_l0[word] = msr_bitmap_l1[word];
++ }
++ }
++
++ nested_vmx_disable_intercept_for_msr(
++ msr_bitmap_l1, msr_bitmap_l0,
++ X2APIC_MSR(APIC_TASKPRI),
++ MSR_TYPE_R | MSR_TYPE_W);
++
++ if (nested_cpu_has_vid(vmcs12)) {
++ nested_vmx_disable_intercept_for_msr(
++ msr_bitmap_l1, msr_bitmap_l0,
++ X2APIC_MSR(APIC_EOI),
++ MSR_TYPE_W);
++ nested_vmx_disable_intercept_for_msr(
++ msr_bitmap_l1, msr_bitmap_l0,
++ X2APIC_MSR(APIC_SELF_IPI),
++ MSR_TYPE_W);
++ }
++ }
++
++ if (spec_ctrl)
++ nested_vmx_disable_intercept_for_msr(
++ msr_bitmap_l1, msr_bitmap_l0,
++ MSR_IA32_SPEC_CTRL,
++ MSR_TYPE_R | MSR_TYPE_W);
++
++ if (pred_cmd)
++ nested_vmx_disable_intercept_for_msr(
++ msr_bitmap_l1, msr_bitmap_l0,
++ MSR_IA32_PRED_CMD,
++ MSR_TYPE_W);
++
++ kunmap(page);
++ kvm_release_page_clean(page);
++
++ return true;
++}
++
++static void nested_cache_shadow_vmcs12(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ struct vmcs12 *shadow;
++ struct page *page;
++
++ if (!nested_cpu_has_shadow_vmcs(vmcs12) ||
++ vmcs12->vmcs_link_pointer == -1ull)
++ return;
++
++ shadow = get_shadow_vmcs12(vcpu);
++ page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->vmcs_link_pointer);
++
++ memcpy(shadow, kmap(page), VMCS12_SIZE);
++
++ kunmap(page);
++ kvm_release_page_clean(page);
++}
++
++static void nested_flush_cached_shadow_vmcs12(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (!nested_cpu_has_shadow_vmcs(vmcs12) ||
++ vmcs12->vmcs_link_pointer == -1ull)
++ return;
++
++ kvm_write_guest(vmx->vcpu.kvm, vmcs12->vmcs_link_pointer,
++ get_shadow_vmcs12(vcpu), VMCS12_SIZE);
++}
++
++static int nested_vmx_check_apic_access_controls(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ if (nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES) &&
++ !page_address_valid(vcpu, vmcs12->apic_access_addr))
++ return -EINVAL;
++ else
++ return 0;
++}
++
++static int nested_vmx_check_apicv_controls(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ if (!nested_cpu_has_virt_x2apic_mode(vmcs12) &&
++ !nested_cpu_has_apic_reg_virt(vmcs12) &&
++ !nested_cpu_has_vid(vmcs12) &&
++ !nested_cpu_has_posted_intr(vmcs12))
++ return 0;
++
++ /*
++ * If virtualize x2apic mode is enabled,
++ * virtualize apic access must be disabled.
++ */
++ if (nested_cpu_has_virt_x2apic_mode(vmcs12) &&
++ nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES))
++ return -EINVAL;
++
++ /*
++ * If virtual interrupt delivery is enabled,
++ * we must exit on external interrupts.
++ */
++ if (nested_cpu_has_vid(vmcs12) &&
++ !nested_exit_on_intr(vcpu))
++ return -EINVAL;
++
++ /*
++ * bits 15:8 should be zero in posted_intr_nv,
++ * the descriptor address has been already checked
++ * in nested_get_vmcs12_pages.
++ *
++ * bits 5:0 of posted_intr_desc_addr should be zero.
++ */
++ if (nested_cpu_has_posted_intr(vmcs12) &&
++ (!nested_cpu_has_vid(vmcs12) ||
++ !nested_exit_intr_ack_set(vcpu) ||
++ (vmcs12->posted_intr_nv & 0xff00) ||
++ (vmcs12->posted_intr_desc_addr & 0x3f) ||
++ (vmcs12->posted_intr_desc_addr >> cpuid_maxphyaddr(vcpu))))
++ return -EINVAL;
++
++ /* tpr shadow is needed by all apicv features. */
++ if (!nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
++ return -EINVAL;
++
++ return 0;
++}
++
++static int nested_vmx_check_msr_switch(struct kvm_vcpu *vcpu,
++ unsigned long count_field,
++ unsigned long addr_field)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ int maxphyaddr;
++ u64 count, addr;
++
++ if (vmcs12_read_any(vmcs12, count_field, &count) ||
++ vmcs12_read_any(vmcs12, addr_field, &addr)) {
++ WARN_ON(1);
++ return -EINVAL;
++ }
++ if (count == 0)
++ return 0;
++ maxphyaddr = cpuid_maxphyaddr(vcpu);
++ if (!IS_ALIGNED(addr, 16) || addr >> maxphyaddr ||
++ (addr + count * sizeof(struct vmx_msr_entry) - 1) >> maxphyaddr) {
++ pr_debug_ratelimited(
++ "nVMX: invalid MSR switch (0x%lx, %d, %llu, 0x%08llx)",
++ addr_field, maxphyaddr, count, addr);
++ return -EINVAL;
++ }
++ return 0;
++}
++
++static int nested_vmx_check_msr_switch_controls(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ if (vmcs12->vm_exit_msr_load_count == 0 &&
++ vmcs12->vm_exit_msr_store_count == 0 &&
++ vmcs12->vm_entry_msr_load_count == 0)
++ return 0; /* Fast path */
++ if (nested_vmx_check_msr_switch(vcpu, VM_EXIT_MSR_LOAD_COUNT,
++ VM_EXIT_MSR_LOAD_ADDR) ||
++ nested_vmx_check_msr_switch(vcpu, VM_EXIT_MSR_STORE_COUNT,
++ VM_EXIT_MSR_STORE_ADDR) ||
++ nested_vmx_check_msr_switch(vcpu, VM_ENTRY_MSR_LOAD_COUNT,
++ VM_ENTRY_MSR_LOAD_ADDR))
++ return -EINVAL;
++ return 0;
++}
++
++static int nested_vmx_check_pml_controls(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ u64 address = vmcs12->pml_address;
++ int maxphyaddr = cpuid_maxphyaddr(vcpu);
++
++ if (nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_PML)) {
++ if (!nested_cpu_has_ept(vmcs12) ||
++ !IS_ALIGNED(address, 4096) ||
++ address >> maxphyaddr)
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++static int nested_vmx_check_shadow_vmcs_controls(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ if (!nested_cpu_has_shadow_vmcs(vmcs12))
++ return 0;
++
++ if (!page_address_valid(vcpu, vmcs12->vmread_bitmap) ||
++ !page_address_valid(vcpu, vmcs12->vmwrite_bitmap))
++ return -EINVAL;
++
++ return 0;
++}
++
++static int nested_vmx_msr_check_common(struct kvm_vcpu *vcpu,
++ struct vmx_msr_entry *e)
++{
++ /* x2APIC MSR accesses are not allowed */
++ if (vcpu->arch.apic_base & X2APIC_ENABLE && e->index >> 8 == 0x8)
++ return -EINVAL;
++ if (e->index == MSR_IA32_UCODE_WRITE || /* SDM Table 35-2 */
++ e->index == MSR_IA32_UCODE_REV)
++ return -EINVAL;
++ if (e->reserved != 0)
++ return -EINVAL;
++ return 0;
++}
++
++static int nested_vmx_load_msr_check(struct kvm_vcpu *vcpu,
++ struct vmx_msr_entry *e)
++{
++ if (e->index == MSR_FS_BASE ||
++ e->index == MSR_GS_BASE ||
++ e->index == MSR_IA32_SMM_MONITOR_CTL || /* SMM is not supported */
++ nested_vmx_msr_check_common(vcpu, e))
++ return -EINVAL;
++ return 0;
++}
++
++static int nested_vmx_store_msr_check(struct kvm_vcpu *vcpu,
++ struct vmx_msr_entry *e)
++{
++ if (e->index == MSR_IA32_SMBASE || /* SMM is not supported */
++ nested_vmx_msr_check_common(vcpu, e))
++ return -EINVAL;
++ return 0;
++}
++
++/*
++ * Load guest's/host's msr at nested entry/exit.
++ * return 0 for success, entry index for failure.
++ */
++static u32 nested_vmx_load_msr(struct kvm_vcpu *vcpu, u64 gpa, u32 count)
++{
++ u32 i;
++ struct vmx_msr_entry e;
++ struct msr_data msr;
++
++ msr.host_initiated = false;
++ for (i = 0; i < count; i++) {
++ if (kvm_vcpu_read_guest(vcpu, gpa + i * sizeof(e),
++ &e, sizeof(e))) {
++ pr_debug_ratelimited(
++ "%s cannot read MSR entry (%u, 0x%08llx)\n",
++ __func__, i, gpa + i * sizeof(e));
++ goto fail;
++ }
++ if (nested_vmx_load_msr_check(vcpu, &e)) {
++ pr_debug_ratelimited(
++ "%s check failed (%u, 0x%x, 0x%x)\n",
++ __func__, i, e.index, e.reserved);
++ goto fail;
++ }
++ msr.index = e.index;
++ msr.data = e.value;
++ if (kvm_set_msr(vcpu, &msr)) {
++ pr_debug_ratelimited(
++ "%s cannot write MSR (%u, 0x%x, 0x%llx)\n",
++ __func__, i, e.index, e.value);
++ goto fail;
++ }
++ }
++ return 0;
++fail:
++ return i + 1;
++}
++
++static int nested_vmx_store_msr(struct kvm_vcpu *vcpu, u64 gpa, u32 count)
++{
++ u32 i;
++ struct vmx_msr_entry e;
++
++ for (i = 0; i < count; i++) {
++ struct msr_data msr_info;
++ if (kvm_vcpu_read_guest(vcpu,
++ gpa + i * sizeof(e),
++ &e, 2 * sizeof(u32))) {
++ pr_debug_ratelimited(
++ "%s cannot read MSR entry (%u, 0x%08llx)\n",
++ __func__, i, gpa + i * sizeof(e));
++ return -EINVAL;
++ }
++ if (nested_vmx_store_msr_check(vcpu, &e)) {
++ pr_debug_ratelimited(
++ "%s check failed (%u, 0x%x, 0x%x)\n",
++ __func__, i, e.index, e.reserved);
++ return -EINVAL;
++ }
++ msr_info.host_initiated = false;
++ msr_info.index = e.index;
++ if (kvm_get_msr(vcpu, &msr_info)) {
++ pr_debug_ratelimited(
++ "%s cannot read MSR (%u, 0x%x)\n",
++ __func__, i, e.index);
++ return -EINVAL;
++ }
++ if (kvm_vcpu_write_guest(vcpu,
++ gpa + i * sizeof(e) +
++ offsetof(struct vmx_msr_entry, value),
++ &msr_info.data, sizeof(msr_info.data))) {
++ pr_debug_ratelimited(
++ "%s cannot write MSR (%u, 0x%x, 0x%llx)\n",
++ __func__, i, e.index, msr_info.data);
++ return -EINVAL;
++ }
++ }
++ return 0;
++}
++
++static bool nested_cr3_valid(struct kvm_vcpu *vcpu, unsigned long val)
++{
++ unsigned long invalid_mask;
++
++ invalid_mask = (~0ULL) << cpuid_maxphyaddr(vcpu);
++ return (val & invalid_mask) == 0;
++}
++
++/*
++ * Load guest's/host's cr3 at nested entry/exit. nested_ept is true if we are
++ * emulating VM entry into a guest with EPT enabled.
++ * Returns 0 on success, 1 on failure. Invalid state exit qualification code
++ * is assigned to entry_failure_code on failure.
++ */
++static int nested_vmx_load_cr3(struct kvm_vcpu *vcpu, unsigned long cr3, bool nested_ept,
++ u32 *entry_failure_code)
++{
++ if (cr3 != kvm_read_cr3(vcpu) || (!nested_ept && pdptrs_changed(vcpu))) {
++ if (!nested_cr3_valid(vcpu, cr3)) {
++ *entry_failure_code = ENTRY_FAIL_DEFAULT;
++ return 1;
++ }
++
++ /*
++ * If PAE paging and EPT are both on, CR3 is not used by the CPU and
++ * must not be dereferenced.
++ */
++ if (is_pae_paging(vcpu) && !nested_ept) {
++ if (!load_pdptrs(vcpu, vcpu->arch.walk_mmu, cr3)) {
++ *entry_failure_code = ENTRY_FAIL_PDPTE;
++ return 1;
++ }
++ }
++ }
++
++ if (!nested_ept)
++ kvm_mmu_new_cr3(vcpu, cr3, false);
++
++ vcpu->arch.cr3 = cr3;
++ __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
++
++ kvm_init_mmu(vcpu, false);
++
++ return 0;
++}
++
++static void prepare_vmcs02_full(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ vmcs_write16(GUEST_ES_SELECTOR, vmcs12->guest_es_selector);
++ vmcs_write16(GUEST_SS_SELECTOR, vmcs12->guest_ss_selector);
++ vmcs_write16(GUEST_DS_SELECTOR, vmcs12->guest_ds_selector);
++ vmcs_write16(GUEST_FS_SELECTOR, vmcs12->guest_fs_selector);
++ vmcs_write16(GUEST_GS_SELECTOR, vmcs12->guest_gs_selector);
++ vmcs_write16(GUEST_LDTR_SELECTOR, vmcs12->guest_ldtr_selector);
++ vmcs_write16(GUEST_TR_SELECTOR, vmcs12->guest_tr_selector);
++ vmcs_write32(GUEST_ES_LIMIT, vmcs12->guest_es_limit);
++ vmcs_write32(GUEST_SS_LIMIT, vmcs12->guest_ss_limit);
++ vmcs_write32(GUEST_DS_LIMIT, vmcs12->guest_ds_limit);
++ vmcs_write32(GUEST_FS_LIMIT, vmcs12->guest_fs_limit);
++ vmcs_write32(GUEST_GS_LIMIT, vmcs12->guest_gs_limit);
++ vmcs_write32(GUEST_LDTR_LIMIT, vmcs12->guest_ldtr_limit);
++ vmcs_write32(GUEST_TR_LIMIT, vmcs12->guest_tr_limit);
++ vmcs_write32(GUEST_GDTR_LIMIT, vmcs12->guest_gdtr_limit);
++ vmcs_write32(GUEST_IDTR_LIMIT, vmcs12->guest_idtr_limit);
++ vmcs_write32(GUEST_ES_AR_BYTES, vmcs12->guest_es_ar_bytes);
++ vmcs_write32(GUEST_SS_AR_BYTES, vmcs12->guest_ss_ar_bytes);
++ vmcs_write32(GUEST_DS_AR_BYTES, vmcs12->guest_ds_ar_bytes);
++ vmcs_write32(GUEST_FS_AR_BYTES, vmcs12->guest_fs_ar_bytes);
++ vmcs_write32(GUEST_GS_AR_BYTES, vmcs12->guest_gs_ar_bytes);
++ vmcs_write32(GUEST_LDTR_AR_BYTES, vmcs12->guest_ldtr_ar_bytes);
++ vmcs_write32(GUEST_TR_AR_BYTES, vmcs12->guest_tr_ar_bytes);
++ vmcs_writel(GUEST_SS_BASE, vmcs12->guest_ss_base);
++ vmcs_writel(GUEST_DS_BASE, vmcs12->guest_ds_base);
++ vmcs_writel(GUEST_FS_BASE, vmcs12->guest_fs_base);
++ vmcs_writel(GUEST_GS_BASE, vmcs12->guest_gs_base);
++ vmcs_writel(GUEST_LDTR_BASE, vmcs12->guest_ldtr_base);
++ vmcs_writel(GUEST_TR_BASE, vmcs12->guest_tr_base);
++ vmcs_writel(GUEST_GDTR_BASE, vmcs12->guest_gdtr_base);
++ vmcs_writel(GUEST_IDTR_BASE, vmcs12->guest_idtr_base);
++
++ vmcs_write32(GUEST_SYSENTER_CS, vmcs12->guest_sysenter_cs);
++ vmcs_writel(GUEST_PENDING_DBG_EXCEPTIONS,
++ vmcs12->guest_pending_dbg_exceptions);
++ vmcs_writel(GUEST_SYSENTER_ESP, vmcs12->guest_sysenter_esp);
++ vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->guest_sysenter_eip);
++
++ if (nested_cpu_has_xsaves(vmcs12))
++ vmcs_write64(XSS_EXIT_BITMAP, vmcs12->xss_exit_bitmap);
++ vmcs_write64(VMCS_LINK_POINTER, -1ull);
++
++ if (cpu_has_vmx_posted_intr())
++ vmcs_write16(POSTED_INTR_NV, POSTED_INTR_NESTED_VECTOR);
++
++ /*
++ * Whether page-faults are trapped is determined by a combination of
++ * 3 settings: PFEC_MASK, PFEC_MATCH and EXCEPTION_BITMAP.PF.
++ * If enable_ept, L0 doesn't care about page faults and we should
++ * set all of these to L1's desires. However, if !enable_ept, L0 does
++ * care about (at least some) page faults, and because it is not easy
++ * (if at all possible?) to merge L0 and L1's desires, we simply ask
++ * to exit on each and every L2 page fault. This is done by setting
++ * MASK=MATCH=0 and (see below) EB.PF=1.
++ * Note that below we don't need special code to set EB.PF beyond the
++ * "or"ing of the EB of vmcs01 and vmcs12, because when enable_ept,
++ * vmcs01's EB.PF is 0 so the "or" will take vmcs12's value, and when
++ * !enable_ept, EB.PF is 1, so the "or" will always be 1.
++ */
++ vmcs_write32(PAGE_FAULT_ERROR_CODE_MASK,
++ enable_ept ? vmcs12->page_fault_error_code_mask : 0);
++ vmcs_write32(PAGE_FAULT_ERROR_CODE_MATCH,
++ enable_ept ? vmcs12->page_fault_error_code_match : 0);
++
++ /* All VMFUNCs are currently emulated through L0 vmexits. */
++ if (cpu_has_vmx_vmfunc())
++ vmcs_write64(VM_FUNCTION_CONTROL, 0);
++
++ if (cpu_has_vmx_apicv()) {
++ vmcs_write64(EOI_EXIT_BITMAP0, vmcs12->eoi_exit_bitmap0);
++ vmcs_write64(EOI_EXIT_BITMAP1, vmcs12->eoi_exit_bitmap1);
++ vmcs_write64(EOI_EXIT_BITMAP2, vmcs12->eoi_exit_bitmap2);
++ vmcs_write64(EOI_EXIT_BITMAP3, vmcs12->eoi_exit_bitmap3);
++ }
++
++ /*
++ * Set host-state according to L0's settings (vmcs12 is irrelevant here)
++ * Some constant fields are set here by vmx_set_constant_host_state().
++ * Other fields are different per CPU, and will be set later when
++ * vmx_vcpu_load() is called, and when vmx_prepare_switch_to_guest()
++ * is called.
++ */
++ vmx_set_constant_host_state(vmx);
++
++ /*
++ * Set the MSR load/store lists to match L0's settings.
++ */
++ vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr);
++ vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host.val));
++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr);
++ vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest.val));
++
++ set_cr4_guest_host_mask(vmx);
++
++ if (kvm_mpx_supported() && vmx->nested.nested_run_pending &&
++ (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))
++ vmcs_write64(GUEST_BNDCFGS, vmcs12->guest_bndcfgs);
++
++ if (enable_vpid) {
++ if (nested_cpu_has_vpid(vmcs12) && vmx->nested.vpid02)
++ vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->nested.vpid02);
++ else
++ vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
++ }
++
++ /*
++ * L1 may access the L2's PDPTR, so save them to construct vmcs12
++ */
++ if (enable_ept) {
++ vmcs_write64(GUEST_PDPTR0, vmcs12->guest_pdptr0);
++ vmcs_write64(GUEST_PDPTR1, vmcs12->guest_pdptr1);
++ vmcs_write64(GUEST_PDPTR2, vmcs12->guest_pdptr2);
++ vmcs_write64(GUEST_PDPTR3, vmcs12->guest_pdptr3);
++ }
++
++ if (cpu_has_vmx_msr_bitmap())
++ vmcs_write64(MSR_BITMAP, __pa(vmx->nested.vmcs02.msr_bitmap));
++}
++
++/*
++ * prepare_vmcs02 is called when the L1 guest hypervisor runs its nested
++ * L2 guest. L1 has a vmcs for L2 (vmcs12), and this function "merges" it
++ * with L0's requirements for its guest (a.k.a. vmcs01), so we can run the L2
++ * guest in a way that will both be appropriate to L1's requests, and our
++ * needs. In addition to modifying the active vmcs (which is vmcs02), this
++ * function also has additional necessary side-effects, like setting various
++ * vcpu->arch fields.
++ * Returns 0 on success, 1 on failure. Invalid state exit qualification code
++ * is assigned to entry_failure_code on failure.
++ */
++static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
++ u32 *entry_failure_code)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 exec_control, vmcs12_exec_ctrl;
++
++ if (vmx->nested.dirty_vmcs12) {
++ prepare_vmcs02_full(vcpu, vmcs12);
++ vmx->nested.dirty_vmcs12 = false;
++ }
++
++ /*
++ * First, the fields that are shadowed. This must be kept in sync
++ * with vmx_shadow_fields.h.
++ */
++
++ vmcs_write16(GUEST_CS_SELECTOR, vmcs12->guest_cs_selector);
++ vmcs_write32(GUEST_CS_LIMIT, vmcs12->guest_cs_limit);
++ vmcs_write32(GUEST_CS_AR_BYTES, vmcs12->guest_cs_ar_bytes);
++ vmcs_writel(GUEST_ES_BASE, vmcs12->guest_es_base);
++ vmcs_writel(GUEST_CS_BASE, vmcs12->guest_cs_base);
++
++ if (vmx->nested.nested_run_pending &&
++ (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS)) {
++ kvm_set_dr(vcpu, 7, vmcs12->guest_dr7);
++ vmcs_write64(GUEST_IA32_DEBUGCTL, vmcs12->guest_ia32_debugctl);
++ } else {
++ kvm_set_dr(vcpu, 7, vcpu->arch.dr7);
++ vmcs_write64(GUEST_IA32_DEBUGCTL, vmx->nested.vmcs01_debugctl);
++ }
++ if (kvm_mpx_supported() && (!vmx->nested.nested_run_pending ||
++ !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS)))
++ vmcs_write64(GUEST_BNDCFGS, vmx->nested.vmcs01_guest_bndcfgs);
++ if (vmx->nested.nested_run_pending) {
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD,
++ vmcs12->vm_entry_intr_info_field);
++ vmcs_write32(VM_ENTRY_EXCEPTION_ERROR_CODE,
++ vmcs12->vm_entry_exception_error_code);
++ vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
++ vmcs12->vm_entry_instruction_len);
++ vmcs_write32(GUEST_INTERRUPTIBILITY_INFO,
++ vmcs12->guest_interruptibility_info);
++ vmx->loaded_vmcs->nmi_known_unmasked =
++ !(vmcs12->guest_interruptibility_info & GUEST_INTR_STATE_NMI);
++ } else {
++ vmcs_write32(VM_ENTRY_INTR_INFO_FIELD, 0);
++ }
++ vmx_set_rflags(vcpu, vmcs12->guest_rflags);
++
++ exec_control = vmcs12->pin_based_vm_exec_control;
++
++ /* Preemption timer setting is computed directly in vmx_vcpu_run. */
++ exec_control |= vmcs_config.pin_based_exec_ctrl;
++ exec_control &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
++ vmx->loaded_vmcs->hv_timer_armed = false;
++
++ /* Posted interrupts setting is only taken from vmcs12. */
++ if (nested_cpu_has_posted_intr(vmcs12)) {
++ vmx->nested.posted_intr_nv = vmcs12->posted_intr_nv;
++ vmx->nested.pi_pending = false;
++ } else {
++ exec_control &= ~PIN_BASED_POSTED_INTR;
++ }
++
++ vmcs_write32(PIN_BASED_VM_EXEC_CONTROL, exec_control);
++
++ vmx->nested.preemption_timer_expired = false;
++ if (nested_cpu_has_preemption_timer(vmcs12))
++ vmx_start_preemption_timer(vcpu);
++
++ if (cpu_has_secondary_exec_ctrls()) {
++ exec_control = vmx->secondary_exec_control;
++
++ /* Take the following fields only from vmcs12 */
++ exec_control &= ~(SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
++ SECONDARY_EXEC_ENABLE_INVPCID |
++ SECONDARY_EXEC_RDTSCP |
++ SECONDARY_EXEC_XSAVES |
++ SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
++ SECONDARY_EXEC_APIC_REGISTER_VIRT |
++ SECONDARY_EXEC_ENABLE_VMFUNC);
++ if (nested_cpu_has(vmcs12,
++ CPU_BASED_ACTIVATE_SECONDARY_CONTROLS)) {
++ vmcs12_exec_ctrl = vmcs12->secondary_vm_exec_control &
++ ~SECONDARY_EXEC_ENABLE_PML;
++ exec_control |= vmcs12_exec_ctrl;
++ }
++
++ /* VMCS shadowing for L2 is emulated for now */
++ exec_control &= ~SECONDARY_EXEC_SHADOW_VMCS;
++
++ if (exec_control & SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY)
++ vmcs_write16(GUEST_INTR_STATUS,
++ vmcs12->guest_intr_status);
++
++ /*
++ * Write an illegal value to APIC_ACCESS_ADDR. Later,
++ * nested_get_vmcs12_pages will either fix it up or
++ * remove the VM execution control.
++ */
++ if (exec_control & SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)
++ vmcs_write64(APIC_ACCESS_ADDR, -1ull);
++
++ if (exec_control & SECONDARY_EXEC_ENCLS_EXITING)
++ vmcs_write64(ENCLS_EXITING_BITMAP, -1ull);
++
++ vmcs_write32(SECONDARY_VM_EXEC_CONTROL, exec_control);
++ }
++
++ /*
++ * HOST_RSP is normally set correctly in vmx_vcpu_run() just before
++ * entry, but only if the current (host) sp changed from the value
++ * we wrote last (vmx->host_rsp). This cache is no longer relevant
++ * if we switch vmcs, and rather than hold a separate cache per vmcs,
++ * here we just force the write to happen on entry.
++ */
++ vmx->host_rsp = 0;
++
++ exec_control = vmx_exec_control(vmx); /* L0's desires */
++ exec_control &= ~CPU_BASED_VIRTUAL_INTR_PENDING;
++ exec_control &= ~CPU_BASED_VIRTUAL_NMI_PENDING;
++ exec_control &= ~CPU_BASED_TPR_SHADOW;
++ exec_control |= vmcs12->cpu_based_vm_exec_control;
++
++ /*
++ * Write an illegal value to VIRTUAL_APIC_PAGE_ADDR. Later, if
++ * nested_get_vmcs12_pages can't fix it up, the illegal value
++ * will result in a VM entry failure.
++ */
++ if (exec_control & CPU_BASED_TPR_SHADOW) {
++ vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, -1ull);
++ vmcs_write32(TPR_THRESHOLD, vmcs12->tpr_threshold);
++ } else {
++#ifdef CONFIG_X86_64
++ exec_control |= CPU_BASED_CR8_LOAD_EXITING |
++ CPU_BASED_CR8_STORE_EXITING;
++#endif
++ }
++
++ /*
++ * A vmexit (to either L1 hypervisor or L0 userspace) is always needed
++ * for I/O port accesses.
++ */
++ exec_control &= ~CPU_BASED_USE_IO_BITMAPS;
++ exec_control |= CPU_BASED_UNCOND_IO_EXITING;
++
++ vmcs_write32(CPU_BASED_VM_EXEC_CONTROL, exec_control);
++
++ /* EXCEPTION_BITMAP and CR0_GUEST_HOST_MASK should basically be the
++ * bitwise-or of what L1 wants to trap for L2, and what we want to
++ * trap. Note that CR0.TS also needs updating - we do this later.
++ */
++ update_exception_bitmap(vcpu);
++ vcpu->arch.cr0_guest_owned_bits &= ~vmcs12->cr0_guest_host_mask;
++ vmcs_writel(CR0_GUEST_HOST_MASK, ~vcpu->arch.cr0_guest_owned_bits);
++
++ /* L2->L1 exit controls are emulated - the hardware exit is to L0 so
++ * we should use its exit controls. Note that VM_EXIT_LOAD_IA32_EFER
++ * bits are further modified by vmx_set_efer() below.
++ */
++ vmcs_write32(VM_EXIT_CONTROLS, vmcs_config.vmexit_ctrl);
++
++ /* vmcs12's VM_ENTRY_LOAD_IA32_EFER and VM_ENTRY_IA32E_MODE are
++ * emulated by vmx_set_efer(), below.
++ */
++ vm_entry_controls_init(vmx,
++ (vmcs12->vm_entry_controls & ~VM_ENTRY_LOAD_IA32_EFER &
++ ~VM_ENTRY_IA32E_MODE) |
++ (vmcs_config.vmentry_ctrl & ~VM_ENTRY_IA32E_MODE));
++
++ if (vmx->nested.nested_run_pending &&
++ (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT)) {
++ vmcs_write64(GUEST_IA32_PAT, vmcs12->guest_ia32_pat);
++ vcpu->arch.pat = vmcs12->guest_ia32_pat;
++ } else if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
++ vmcs_write64(GUEST_IA32_PAT, vmx->vcpu.arch.pat);
++ }
++
++ vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset);
++
++ if (kvm_has_tsc_control)
++ decache_tsc_multiplier(vmx);
++
++ if (enable_vpid) {
++ /*
++ * There is no direct mapping between vpid02 and vpid12, the
++ * vpid02 is per-vCPU for L0 and reused while the value of
++ * vpid12 is changed w/ one invvpid during nested vmentry.
++ * The vpid12 is allocated by L1 for L2, so it will not
++ * influence global bitmap(for vpid01 and vpid02 allocation)
++ * even if spawn a lot of nested vCPUs.
++ */
++ if (nested_cpu_has_vpid(vmcs12) && vmx->nested.vpid02) {
++ if (vmcs12->virtual_processor_id != vmx->nested.last_vpid) {
++ vmx->nested.last_vpid = vmcs12->virtual_processor_id;
++ __vmx_flush_tlb(vcpu, vmx->nested.vpid02, true);
++ }
++ } else {
++ vmx_flush_tlb(vcpu, true);
++ }
++ }
++
++ if (enable_pml) {
++ /*
++ * Conceptually we want to copy the PML address and index from
++ * vmcs01 here, and then back to vmcs01 on nested vmexit. But,
++ * since we always flush the log on each vmexit, this happens
++ * to be equivalent to simply resetting the fields in vmcs02.
++ */
++ ASSERT(vmx->pml_pg);
++ vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
++ vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
++ }
++
++ if (nested_cpu_has_ept(vmcs12)) {
++ if (nested_ept_init_mmu_context(vcpu)) {
++ *entry_failure_code = ENTRY_FAIL_DEFAULT;
++ return 1;
++ }
++ } else if (nested_cpu_has2(vmcs12,
++ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
++ vmx_flush_tlb(vcpu, true);
++ }
++
++ /*
++ * This sets GUEST_CR0 to vmcs12->guest_cr0, possibly modifying those
++ * bits which we consider mandatory enabled.
++ * The CR0_READ_SHADOW is what L2 should have expected to read given
++ * the specifications by L1; It's not enough to take
++ * vmcs12->cr0_read_shadow because on our cr0_guest_host_mask we we
++ * have more bits than L1 expected.
++ */
++ vmx_set_cr0(vcpu, vmcs12->guest_cr0);
++ vmcs_writel(CR0_READ_SHADOW, nested_read_cr0(vmcs12));
++
++ vmx_set_cr4(vcpu, vmcs12->guest_cr4);
++ vmcs_writel(CR4_READ_SHADOW, nested_read_cr4(vmcs12));
++
++ if (vmx->nested.nested_run_pending &&
++ (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_EFER))
++ vcpu->arch.efer = vmcs12->guest_ia32_efer;
++ else if (vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE)
++ vcpu->arch.efer |= (EFER_LMA | EFER_LME);
++ else
++ vcpu->arch.efer &= ~(EFER_LMA | EFER_LME);
++ /* Note: modifies VM_ENTRY/EXIT_CONTROLS and GUEST/HOST_IA32_EFER */
++ vmx_set_efer(vcpu, vcpu->arch.efer);
++
++ /*
++ * Guest state is invalid and unrestricted guest is disabled,
++ * which means L1 attempted VMEntry to L2 with invalid state.
++ * Fail the VMEntry.
++ */
++ if (vmx->emulation_required) {
++ *entry_failure_code = ENTRY_FAIL_DEFAULT;
++ return 1;
++ }
++
++ /* Shadow page tables on either EPT or shadow page tables. */
++ if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_cpu_has_ept(vmcs12),
++ entry_failure_code))
++ return 1;
++
++ if (!enable_ept)
++ vcpu->arch.walk_mmu->inject_page_fault = vmx_inject_page_fault_nested;
++
++ kvm_register_write(vcpu, VCPU_REGS_RSP, vmcs12->guest_rsp);
++ kvm_register_write(vcpu, VCPU_REGS_RIP, vmcs12->guest_rip);
++ return 0;
++}
++
++static int nested_vmx_check_nmi_controls(struct vmcs12 *vmcs12)
++{
++ if (!nested_cpu_has_nmi_exiting(vmcs12) &&
++ nested_cpu_has_virtual_nmis(vmcs12))
++ return -EINVAL;
++
++ if (!nested_cpu_has_virtual_nmis(vmcs12) &&
++ nested_cpu_has(vmcs12, CPU_BASED_VIRTUAL_NMI_PENDING))
++ return -EINVAL;
++
++ return 0;
++}
++
++static int check_vmentry_prereqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ if (vmcs12->guest_activity_state != GUEST_ACTIVITY_ACTIVE &&
++ vmcs12->guest_activity_state != GUEST_ACTIVITY_HLT)
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_cpu_has_vpid(vmcs12) && !vmcs12->virtual_processor_id)
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_vmx_check_io_bitmap_controls(vcpu, vmcs12))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_vmx_check_msr_bitmap_controls(vcpu, vmcs12))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_vmx_check_apic_access_controls(vcpu, vmcs12))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_vmx_check_tpr_shadow_controls(vcpu, vmcs12))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_vmx_check_apicv_controls(vcpu, vmcs12))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_vmx_check_msr_switch_controls(vcpu, vmcs12))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (!nested_cpu_has_preemption_timer(vmcs12) &&
++ nested_cpu_has_save_preemption_timer(vmcs12))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_vmx_check_pml_controls(vcpu, vmcs12))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_vmx_check_shadow_vmcs_controls(vcpu, vmcs12))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (!vmx_control_verify(vmcs12->cpu_based_vm_exec_control,
++ vmx->nested.msrs.procbased_ctls_low,
++ vmx->nested.msrs.procbased_ctls_high) ||
++ (nested_cpu_has(vmcs12, CPU_BASED_ACTIVATE_SECONDARY_CONTROLS) &&
++ !vmx_control_verify(vmcs12->secondary_vm_exec_control,
++ vmx->nested.msrs.secondary_ctls_low,
++ vmx->nested.msrs.secondary_ctls_high)) ||
++ !vmx_control_verify(vmcs12->pin_based_vm_exec_control,
++ vmx->nested.msrs.pinbased_ctls_low,
++ vmx->nested.msrs.pinbased_ctls_high) ||
++ !vmx_control_verify(vmcs12->vm_exit_controls,
++ vmx->nested.msrs.exit_ctls_low,
++ vmx->nested.msrs.exit_ctls_high) ||
++ !vmx_control_verify(vmcs12->vm_entry_controls,
++ vmx->nested.msrs.entry_ctls_low,
++ vmx->nested.msrs.entry_ctls_high))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_vmx_check_nmi_controls(vmcs12))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_cpu_has_vmfunc(vmcs12)) {
++ if (vmcs12->vm_function_control &
++ ~vmx->nested.msrs.vmfunc_controls)
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (nested_cpu_has_eptp_switching(vmcs12)) {
++ if (!nested_cpu_has_ept(vmcs12) ||
++ !page_address_valid(vcpu, vmcs12->eptp_list_address))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++ }
++ }
++
++ if (vmcs12->cr3_target_count > nested_cpu_vmx_misc_cr3_count(vcpu))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ if (!nested_host_cr0_valid(vcpu, vmcs12->host_cr0) ||
++ !nested_host_cr4_valid(vcpu, vmcs12->host_cr4) ||
++ !nested_cr3_valid(vcpu, vmcs12->host_cr3))
++ return VMXERR_ENTRY_INVALID_HOST_STATE_FIELD;
++
++ /*
++ * From the Intel SDM, volume 3:
++ * Fields relevant to VM-entry event injection must be set properly.
++ * These fields are the VM-entry interruption-information field, the
++ * VM-entry exception error code, and the VM-entry instruction length.
++ */
++ if (vmcs12->vm_entry_intr_info_field & INTR_INFO_VALID_MASK) {
++ u32 intr_info = vmcs12->vm_entry_intr_info_field;
++ u8 vector = intr_info & INTR_INFO_VECTOR_MASK;
++ u32 intr_type = intr_info & INTR_INFO_INTR_TYPE_MASK;
++ bool has_error_code = intr_info & INTR_INFO_DELIVER_CODE_MASK;
++ bool should_have_error_code;
++ bool urg = nested_cpu_has2(vmcs12,
++ SECONDARY_EXEC_UNRESTRICTED_GUEST);
++ bool prot_mode = !urg || vmcs12->guest_cr0 & X86_CR0_PE;
++
++ /* VM-entry interruption-info field: interruption type */
++ if (intr_type == INTR_TYPE_RESERVED ||
++ (intr_type == INTR_TYPE_OTHER_EVENT &&
++ !nested_cpu_supports_monitor_trap_flag(vcpu)))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ /* VM-entry interruption-info field: vector */
++ if ((intr_type == INTR_TYPE_NMI_INTR && vector != NMI_VECTOR) ||
++ (intr_type == INTR_TYPE_HARD_EXCEPTION && vector > 31) ||
++ (intr_type == INTR_TYPE_OTHER_EVENT && vector != 0))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ /* VM-entry interruption-info field: deliver error code */
++ should_have_error_code =
++ intr_type == INTR_TYPE_HARD_EXCEPTION && prot_mode &&
++ x86_exception_has_error_code(vector);
++ if (has_error_code != should_have_error_code)
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ /* VM-entry exception error code */
++ if (has_error_code &&
++ vmcs12->vm_entry_exception_error_code & GENMASK(31, 16))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ /* VM-entry interruption-info field: reserved bits */
++ if (intr_info & INTR_INFO_RESVD_BITS_MASK)
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++
++ /* VM-entry instruction length */
++ switch (intr_type) {
++ case INTR_TYPE_SOFT_EXCEPTION:
++ case INTR_TYPE_SOFT_INTR:
++ case INTR_TYPE_PRIV_SW_EXCEPTION:
++ if ((vmcs12->vm_entry_instruction_len > 15) ||
++ (vmcs12->vm_entry_instruction_len == 0 &&
++ !nested_cpu_has_zero_length_injection(vcpu)))
++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
++ }
++ }
++
++ return 0;
++}
++
++static int nested_vmx_check_vmcs_link_ptr(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ int r;
++ struct page *page;
++ struct vmcs12 *shadow;
++
++ if (vmcs12->vmcs_link_pointer == -1ull)
++ return 0;
++
++ if (!page_address_valid(vcpu, vmcs12->vmcs_link_pointer))
++ return -EINVAL;
++
++ page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->vmcs_link_pointer);
++ if (is_error_page(page))
++ return -EINVAL;
++
++ r = 0;
++ shadow = kmap(page);
++ if (shadow->hdr.revision_id != VMCS12_REVISION ||
++ shadow->hdr.shadow_vmcs != nested_cpu_has_shadow_vmcs(vmcs12))
++ r = -EINVAL;
++ kunmap(page);
++ kvm_release_page_clean(page);
++ return r;
++}
++
++static int check_vmentry_postreqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
++ u32 *exit_qual)
++{
++ bool ia32e;
++
++ *exit_qual = ENTRY_FAIL_DEFAULT;
++
++ if (!nested_guest_cr0_valid(vcpu, vmcs12->guest_cr0) ||
++ !nested_guest_cr4_valid(vcpu, vmcs12->guest_cr4))
++ return 1;
++
++ if (nested_vmx_check_vmcs_link_ptr(vcpu, vmcs12)) {
++ *exit_qual = ENTRY_FAIL_VMCS_LINK_PTR;
++ return 1;
++ }
++
++ /*
++ * If the load IA32_EFER VM-entry control is 1, the following checks
++ * are performed on the field for the IA32_EFER MSR:
++ * - Bits reserved in the IA32_EFER MSR must be 0.
++ * - Bit 10 (corresponding to IA32_EFER.LMA) must equal the value of
++ * the IA-32e mode guest VM-exit control. It must also be identical
++ * to bit 8 (LME) if bit 31 in the CR0 field (corresponding to
++ * CR0.PG) is 1.
++ */
++ if (to_vmx(vcpu)->nested.nested_run_pending &&
++ (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_EFER)) {
++ ia32e = (vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE) != 0;
++ if (!kvm_valid_efer(vcpu, vmcs12->guest_ia32_efer) ||
++ ia32e != !!(vmcs12->guest_ia32_efer & EFER_LMA) ||
++ ((vmcs12->guest_cr0 & X86_CR0_PG) &&
++ ia32e != !!(vmcs12->guest_ia32_efer & EFER_LME)))
++ return 1;
++ }
++
++ /*
++ * If the load IA32_EFER VM-exit control is 1, bits reserved in the
++ * IA32_EFER MSR must be 0 in the field for that register. In addition,
++ * the values of the LMA and LME bits in the field must each be that of
++ * the host address-space size VM-exit control.
++ */
++ if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_EFER) {
++ ia32e = (vmcs12->vm_exit_controls &
++ VM_EXIT_HOST_ADDR_SPACE_SIZE) != 0;
++ if (!kvm_valid_efer(vcpu, vmcs12->host_ia32_efer) ||
++ ia32e != !!(vmcs12->host_ia32_efer & EFER_LMA) ||
++ ia32e != !!(vmcs12->host_ia32_efer & EFER_LME))
++ return 1;
++ }
++
++ if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS) &&
++ (is_noncanonical_address(vmcs12->guest_bndcfgs & PAGE_MASK, vcpu) ||
++ (vmcs12->guest_bndcfgs & MSR_IA32_BNDCFGS_RSVD)))
++ return 1;
++
++ return 0;
++}
++
++/*
++ * If exit_qual is NULL, this is being called from state restore (either RSM
++ * or KVM_SET_NESTED_STATE). Otherwise it's called from vmlaunch/vmresume.
++ */
++static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, u32 *exit_qual)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ bool from_vmentry = !!exit_qual;
++ u32 dummy_exit_qual;
++ bool evaluate_pending_interrupts;
++ int r = 0;
++
++ evaluate_pending_interrupts = vmcs_read32(CPU_BASED_VM_EXEC_CONTROL) &
++ (CPU_BASED_VIRTUAL_INTR_PENDING | CPU_BASED_VIRTUAL_NMI_PENDING);
++ if (likely(!evaluate_pending_interrupts) && kvm_vcpu_apicv_active(vcpu))
++ evaluate_pending_interrupts |= vmx_has_apicv_interrupt(vcpu);
++
++ enter_guest_mode(vcpu);
++
++ if (!(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS))
++ vmx->nested.vmcs01_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL);
++ if (kvm_mpx_supported() &&
++ !(vmcs12->vm_entry_controls & VM_ENTRY_LOAD_BNDCFGS))
++ vmx->nested.vmcs01_guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS);
++
++ vmx_switch_vmcs(vcpu, &vmx->nested.vmcs02);
++ vmx_segment_cache_clear(vmx);
++
++ if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
++ vcpu->arch.tsc_offset += vmcs12->tsc_offset;
++
++ r = EXIT_REASON_INVALID_STATE;
++ if (prepare_vmcs02(vcpu, vmcs12, from_vmentry ? exit_qual : &dummy_exit_qual))
++ goto fail;
++
++ if (from_vmentry) {
++ nested_get_vmcs12_pages(vcpu);
++
++ r = EXIT_REASON_MSR_LOAD_FAIL;
++ *exit_qual = nested_vmx_load_msr(vcpu,
++ vmcs12->vm_entry_msr_load_addr,
++ vmcs12->vm_entry_msr_load_count);
++ if (*exit_qual)
++ goto fail;
++ } else {
++ /*
++ * The MMU is not initialized to point at the right entities yet and
++ * "get pages" would need to read data from the guest (i.e. we will
++ * need to perform gpa to hpa translation). Request a call
++ * to nested_get_vmcs12_pages before the next VM-entry. The MSRs
++ * have already been set at vmentry time and should not be reset.
++ */
++ kvm_make_request(KVM_REQ_GET_VMCS12_PAGES, vcpu);
++ }
++
++ /*
++ * If L1 had a pending IRQ/NMI until it executed
++ * VMLAUNCH/VMRESUME which wasn't delivered because it was
++ * disallowed (e.g. interrupts disabled), L0 needs to
++ * evaluate if this pending event should cause an exit from L2
++ * to L1 or delivered directly to L2 (e.g. In case L1 don't
++ * intercept EXTERNAL_INTERRUPT).
++ *
++ * Usually this would be handled by the processor noticing an
++ * IRQ/NMI window request, or checking RVI during evaluation of
++ * pending virtual interrupts. However, this setting was done
++ * on VMCS01 and now VMCS02 is active instead. Thus, we force L0
++ * to perform pending event evaluation by requesting a KVM_REQ_EVENT.
++ */
++ if (unlikely(evaluate_pending_interrupts))
++ kvm_make_request(KVM_REQ_EVENT, vcpu);
++
++ /*
++ * Note no nested_vmx_succeed or nested_vmx_fail here. At this point
++ * we are no longer running L1, and VMLAUNCH/VMRESUME has not yet
++ * returned as far as L1 is concerned. It will only return (and set
++ * the success flag) when L2 exits (see nested_vmx_vmexit()).
++ */
++ return 0;
++
++fail:
++ if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
++ vcpu->arch.tsc_offset -= vmcs12->tsc_offset;
++ leave_guest_mode(vcpu);
++ vmx_switch_vmcs(vcpu, &vmx->vmcs01);
++ return r;
++}
++
++/*
++ * nested_vmx_run() handles a nested entry, i.e., a VMLAUNCH or VMRESUME on L1
++ * for running an L2 nested guest.
++ */
++static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
++{
++ struct vmcs12 *vmcs12;
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ u32 interrupt_shadow = vmx_get_interrupt_shadow(vcpu);
++ u32 exit_qual;
++ int ret;
++
++ if (!nested_vmx_check_permission(vcpu))
++ return 1;
++
++ if (!nested_vmx_check_vmcs12(vcpu))
++ goto out;
++
++ vmcs12 = get_vmcs12(vcpu);
++
++ /*
++ * Can't VMLAUNCH or VMRESUME a shadow VMCS. Despite the fact
++ * that there *is* a valid VMCS pointer, RFLAGS.CF is set
++ * rather than RFLAGS.ZF, and no error number is stored to the
++ * VM-instruction error field.
++ */
++ if (vmcs12->hdr.shadow_vmcs) {
++ nested_vmx_failInvalid(vcpu);
++ goto out;
++ }
++
++ if (enable_shadow_vmcs)
++ copy_shadow_to_vmcs12(vmx);
++
++ /*
++ * The nested entry process starts with enforcing various prerequisites
++ * on vmcs12 as required by the Intel SDM, and act appropriately when
++ * they fail: As the SDM explains, some conditions should cause the
++ * instruction to fail, while others will cause the instruction to seem
++ * to succeed, but return an EXIT_REASON_INVALID_STATE.
++ * To speed up the normal (success) code path, we should avoid checking
++ * for misconfigurations which will anyway be caught by the processor
++ * when using the merged vmcs02.
++ */
++ if (interrupt_shadow & KVM_X86_SHADOW_INT_MOV_SS) {
++ nested_vmx_failValid(vcpu,
++ VMXERR_ENTRY_EVENTS_BLOCKED_BY_MOV_SS);
++ goto out;
++ }
++
++ if (vmcs12->launch_state == launch) {
++ nested_vmx_failValid(vcpu,
++ launch ? VMXERR_VMLAUNCH_NONCLEAR_VMCS
++ : VMXERR_VMRESUME_NONLAUNCHED_VMCS);
++ goto out;
++ }
++
++ ret = check_vmentry_prereqs(vcpu, vmcs12);
++ if (ret) {
++ nested_vmx_failValid(vcpu, ret);
++ goto out;
++ }
++
++ /*
++ * After this point, the trap flag no longer triggers a singlestep trap
++ * on the vm entry instructions; don't call kvm_skip_emulated_instruction.
++ * This is not 100% correct; for performance reasons, we delegate most
++ * of the checks on host state to the processor. If those fail,
++ * the singlestep trap is missed.
++ */
++ skip_emulated_instruction(vcpu);
++
++ ret = check_vmentry_postreqs(vcpu, vmcs12, &exit_qual);
++ if (ret) {
++ nested_vmx_entry_failure(vcpu, vmcs12,
++ EXIT_REASON_INVALID_STATE, exit_qual);
++ return 1;
++ }
++
++ /*
++ * We're finally done with prerequisite checking, and can start with
++ * the nested entry.
++ */
++
++ vmx->nested.nested_run_pending = 1;
++ ret = enter_vmx_non_root_mode(vcpu, &exit_qual);
++ if (ret) {
++ nested_vmx_entry_failure(vcpu, vmcs12, ret, exit_qual);
++ vmx->nested.nested_run_pending = 0;
++ return 1;
++ }
++
++ /* Hide L1D cache contents from the nested guest. */
++ vmx->vcpu.arch.l1tf_flush_l1d = true;
++
++ /*
++ * Must happen outside of enter_vmx_non_root_mode() as it will
++ * also be used as part of restoring nVMX state for
++ * snapshot restore (migration).
++ *
++ * In this flow, it is assumed that vmcs12 cache was
++ * trasferred as part of captured nVMX state and should
++ * therefore not be read from guest memory (which may not
++ * exist on destination host yet).
++ */
++ nested_cache_shadow_vmcs12(vcpu, vmcs12);
++
++ /*
++ * If we're entering a halted L2 vcpu and the L2 vcpu won't be
++ * awakened by event injection or by an NMI-window VM-exit or
++ * by an interrupt-window VM-exit, halt the vcpu.
++ */
++ if ((vmcs12->guest_activity_state == GUEST_ACTIVITY_HLT) &&
++ !(vmcs12->vm_entry_intr_info_field & INTR_INFO_VALID_MASK) &&
++ !(vmcs12->cpu_based_vm_exec_control & CPU_BASED_VIRTUAL_NMI_PENDING) &&
++ !((vmcs12->cpu_based_vm_exec_control & CPU_BASED_VIRTUAL_INTR_PENDING) &&
++ (vmcs12->guest_rflags & X86_EFLAGS_IF))) {
++ vmx->nested.nested_run_pending = 0;
++ return kvm_vcpu_halt(vcpu);
++ }
++ return 1;
++
++out:
++ return kvm_skip_emulated_instruction(vcpu);
++}
++
++/*
++ * On a nested exit from L2 to L1, vmcs12.guest_cr0 might not be up-to-date
++ * because L2 may have changed some cr0 bits directly (CRO_GUEST_HOST_MASK).
++ * This function returns the new value we should put in vmcs12.guest_cr0.
++ * It's not enough to just return the vmcs02 GUEST_CR0. Rather,
++ * 1. Bits that neither L0 nor L1 trapped, were set directly by L2 and are now
++ * available in vmcs02 GUEST_CR0. (Note: It's enough to check that L0
++ * didn't trap the bit, because if L1 did, so would L0).
++ * 2. Bits that L1 asked to trap (and therefore L0 also did) could not have
++ * been modified by L2, and L1 knows it. So just leave the old value of
++ * the bit from vmcs12.guest_cr0. Note that the bit from vmcs02 GUEST_CR0
++ * isn't relevant, because if L0 traps this bit it can set it to anything.
++ * 3. Bits that L1 didn't trap, but L0 did. L1 believes the guest could have
++ * changed these bits, and therefore they need to be updated, but L0
++ * didn't necessarily allow them to be changed in GUEST_CR0 - and rather
++ * put them in vmcs02 CR0_READ_SHADOW. So take these bits from there.
++ */
++static inline unsigned long
++vmcs12_guest_cr0(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
++{
++ return
++ /*1*/ (vmcs_readl(GUEST_CR0) & vcpu->arch.cr0_guest_owned_bits) |
++ /*2*/ (vmcs12->guest_cr0 & vmcs12->cr0_guest_host_mask) |
++ /*3*/ (vmcs_readl(CR0_READ_SHADOW) & ~(vmcs12->cr0_guest_host_mask |
++ vcpu->arch.cr0_guest_owned_bits));
++}
++
++static inline unsigned long
++vmcs12_guest_cr4(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
++{
++ return
++ /*1*/ (vmcs_readl(GUEST_CR4) & vcpu->arch.cr4_guest_owned_bits) |
++ /*2*/ (vmcs12->guest_cr4 & vmcs12->cr4_guest_host_mask) |
++ /*3*/ (vmcs_readl(CR4_READ_SHADOW) & ~(vmcs12->cr4_guest_host_mask |
++ vcpu->arch.cr4_guest_owned_bits));
++}
++
++static void vmcs12_save_pending_event(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ u32 idt_vectoring;
++ unsigned int nr;
++
++ if (vcpu->arch.exception.injected) {
++ nr = vcpu->arch.exception.nr;
++ idt_vectoring = nr | VECTORING_INFO_VALID_MASK;
++
++ if (kvm_exception_is_soft(nr)) {
++ vmcs12->vm_exit_instruction_len =
++ vcpu->arch.event_exit_inst_len;
++ idt_vectoring |= INTR_TYPE_SOFT_EXCEPTION;
++ } else
++ idt_vectoring |= INTR_TYPE_HARD_EXCEPTION;
++
++ if (vcpu->arch.exception.has_error_code) {
++ idt_vectoring |= VECTORING_INFO_DELIVER_CODE_MASK;
++ vmcs12->idt_vectoring_error_code =
++ vcpu->arch.exception.error_code;
++ }
++
++ vmcs12->idt_vectoring_info_field = idt_vectoring;
++ } else if (vcpu->arch.nmi_injected) {
++ vmcs12->idt_vectoring_info_field =
++ INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK | NMI_VECTOR;
++ } else if (vcpu->arch.interrupt.injected) {
++ nr = vcpu->arch.interrupt.nr;
++ idt_vectoring = nr | VECTORING_INFO_VALID_MASK;
++
++ if (vcpu->arch.interrupt.soft) {
++ idt_vectoring |= INTR_TYPE_SOFT_INTR;
++ vmcs12->vm_entry_instruction_len =
++ vcpu->arch.event_exit_inst_len;
++ } else
++ idt_vectoring |= INTR_TYPE_EXT_INTR;
++
++ vmcs12->idt_vectoring_info_field = idt_vectoring;
++ }
++}
++
++static int vmx_check_nested_events(struct kvm_vcpu *vcpu)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long exit_qual;
++ bool block_nested_events =
++ vmx->nested.nested_run_pending || kvm_event_needs_reinjection(vcpu);
++
++ if (vcpu->arch.exception.pending &&
++ nested_vmx_check_exception(vcpu, &exit_qual)) {
++ if (block_nested_events)
++ return -EBUSY;
++ nested_vmx_inject_exception_vmexit(vcpu, exit_qual);
++ return 0;
++ }
++
++ if (nested_cpu_has_preemption_timer(get_vmcs12(vcpu)) &&
++ vmx->nested.preemption_timer_expired) {
++ if (block_nested_events)
++ return -EBUSY;
++ nested_vmx_vmexit(vcpu, EXIT_REASON_PREEMPTION_TIMER, 0, 0);
++ return 0;
++ }
++
++ if (vcpu->arch.nmi_pending && nested_exit_on_nmi(vcpu)) {
++ if (block_nested_events)
++ return -EBUSY;
++ nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
++ NMI_VECTOR | INTR_TYPE_NMI_INTR |
++ INTR_INFO_VALID_MASK, 0);
++ /*
++ * The NMI-triggered VM exit counts as injection:
++ * clear this one and block further NMIs.
++ */
++ vcpu->arch.nmi_pending = 0;
++ vmx_set_nmi_mask(vcpu, true);
++ return 0;
++ }
++
++ if (kvm_cpu_has_interrupt(vcpu) && nested_exit_on_intr(vcpu)) {
++ if (block_nested_events)
++ return -EBUSY;
++ nested_vmx_vmexit(vcpu, EXIT_REASON_EXTERNAL_INTERRUPT, 0, 0);
++ return 0;
++ }
++
++ vmx_complete_nested_posted_interrupt(vcpu);
++ return 0;
++}
++
++static void vmx_request_immediate_exit(struct kvm_vcpu *vcpu)
++{
++ to_vmx(vcpu)->req_immediate_exit = true;
++}
++
++static u32 vmx_get_preemption_timer_value(struct kvm_vcpu *vcpu)
++{
++ ktime_t remaining =
++ hrtimer_get_remaining(&to_vmx(vcpu)->nested.preemption_timer);
++ u64 value;
++
++ if (ktime_to_ns(remaining) <= 0)
++ return 0;
++
++ value = ktime_to_ns(remaining) * vcpu->arch.virtual_tsc_khz;
++ do_div(value, 1000000);
++ return value >> VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE;
++}
++
++/*
++ * Update the guest state fields of vmcs12 to reflect changes that
++ * occurred while L2 was running. (The "IA-32e mode guest" bit of the
++ * VM-entry controls is also updated, since this is really a guest
++ * state bit.)
++ */
++static void sync_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
++{
++ vmcs12->guest_cr0 = vmcs12_guest_cr0(vcpu, vmcs12);
++ vmcs12->guest_cr4 = vmcs12_guest_cr4(vcpu, vmcs12);
++
++ vmcs12->guest_rsp = kvm_register_read(vcpu, VCPU_REGS_RSP);
++ vmcs12->guest_rip = kvm_register_read(vcpu, VCPU_REGS_RIP);
++ vmcs12->guest_rflags = vmcs_readl(GUEST_RFLAGS);
++
++ vmcs12->guest_es_selector = vmcs_read16(GUEST_ES_SELECTOR);
++ vmcs12->guest_cs_selector = vmcs_read16(GUEST_CS_SELECTOR);
++ vmcs12->guest_ss_selector = vmcs_read16(GUEST_SS_SELECTOR);
++ vmcs12->guest_ds_selector = vmcs_read16(GUEST_DS_SELECTOR);
++ vmcs12->guest_fs_selector = vmcs_read16(GUEST_FS_SELECTOR);
++ vmcs12->guest_gs_selector = vmcs_read16(GUEST_GS_SELECTOR);
++ vmcs12->guest_ldtr_selector = vmcs_read16(GUEST_LDTR_SELECTOR);
++ vmcs12->guest_tr_selector = vmcs_read16(GUEST_TR_SELECTOR);
++ vmcs12->guest_es_limit = vmcs_read32(GUEST_ES_LIMIT);
++ vmcs12->guest_cs_limit = vmcs_read32(GUEST_CS_LIMIT);
++ vmcs12->guest_ss_limit = vmcs_read32(GUEST_SS_LIMIT);
++ vmcs12->guest_ds_limit = vmcs_read32(GUEST_DS_LIMIT);
++ vmcs12->guest_fs_limit = vmcs_read32(GUEST_FS_LIMIT);
++ vmcs12->guest_gs_limit = vmcs_read32(GUEST_GS_LIMIT);
++ vmcs12->guest_ldtr_limit = vmcs_read32(GUEST_LDTR_LIMIT);
++ vmcs12->guest_tr_limit = vmcs_read32(GUEST_TR_LIMIT);
++ vmcs12->guest_gdtr_limit = vmcs_read32(GUEST_GDTR_LIMIT);
++ vmcs12->guest_idtr_limit = vmcs_read32(GUEST_IDTR_LIMIT);
++ vmcs12->guest_es_ar_bytes = vmcs_read32(GUEST_ES_AR_BYTES);
++ vmcs12->guest_cs_ar_bytes = vmcs_read32(GUEST_CS_AR_BYTES);
++ vmcs12->guest_ss_ar_bytes = vmcs_read32(GUEST_SS_AR_BYTES);
++ vmcs12->guest_ds_ar_bytes = vmcs_read32(GUEST_DS_AR_BYTES);
++ vmcs12->guest_fs_ar_bytes = vmcs_read32(GUEST_FS_AR_BYTES);
++ vmcs12->guest_gs_ar_bytes = vmcs_read32(GUEST_GS_AR_BYTES);
++ vmcs12->guest_ldtr_ar_bytes = vmcs_read32(GUEST_LDTR_AR_BYTES);
++ vmcs12->guest_tr_ar_bytes = vmcs_read32(GUEST_TR_AR_BYTES);
++ vmcs12->guest_es_base = vmcs_readl(GUEST_ES_BASE);
++ vmcs12->guest_cs_base = vmcs_readl(GUEST_CS_BASE);
++ vmcs12->guest_ss_base = vmcs_readl(GUEST_SS_BASE);
++ vmcs12->guest_ds_base = vmcs_readl(GUEST_DS_BASE);
++ vmcs12->guest_fs_base = vmcs_readl(GUEST_FS_BASE);
++ vmcs12->guest_gs_base = vmcs_readl(GUEST_GS_BASE);
++ vmcs12->guest_ldtr_base = vmcs_readl(GUEST_LDTR_BASE);
++ vmcs12->guest_tr_base = vmcs_readl(GUEST_TR_BASE);
++ vmcs12->guest_gdtr_base = vmcs_readl(GUEST_GDTR_BASE);
++ vmcs12->guest_idtr_base = vmcs_readl(GUEST_IDTR_BASE);
++
++ vmcs12->guest_interruptibility_info =
++ vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
++ vmcs12->guest_pending_dbg_exceptions =
++ vmcs_readl(GUEST_PENDING_DBG_EXCEPTIONS);
++ if (vcpu->arch.mp_state == KVM_MP_STATE_HALTED)
++ vmcs12->guest_activity_state = GUEST_ACTIVITY_HLT;
++ else
++ vmcs12->guest_activity_state = GUEST_ACTIVITY_ACTIVE;
++
++ if (nested_cpu_has_preemption_timer(vmcs12)) {
++ if (vmcs12->vm_exit_controls &
++ VM_EXIT_SAVE_VMX_PREEMPTION_TIMER)
++ vmcs12->vmx_preemption_timer_value =
++ vmx_get_preemption_timer_value(vcpu);
++ hrtimer_cancel(&to_vmx(vcpu)->nested.preemption_timer);
++ }
++
++ /*
++ * In some cases (usually, nested EPT), L2 is allowed to change its
++ * own CR3 without exiting. If it has changed it, we must keep it.
++ * Of course, if L0 is using shadow page tables, GUEST_CR3 was defined
++ * by L0, not L1 or L2, so we mustn't unconditionally copy it to vmcs12.
++ *
++ * Additionally, restore L2's PDPTR to vmcs12.
++ */
++ if (enable_ept) {
++ vmcs12->guest_cr3 = vmcs_readl(GUEST_CR3);
++ vmcs12->guest_pdptr0 = vmcs_read64(GUEST_PDPTR0);
++ vmcs12->guest_pdptr1 = vmcs_read64(GUEST_PDPTR1);
++ vmcs12->guest_pdptr2 = vmcs_read64(GUEST_PDPTR2);
++ vmcs12->guest_pdptr3 = vmcs_read64(GUEST_PDPTR3);
++ }
++
++ vmcs12->guest_linear_address = vmcs_readl(GUEST_LINEAR_ADDRESS);
++
++ if (nested_cpu_has_vid(vmcs12))
++ vmcs12->guest_intr_status = vmcs_read16(GUEST_INTR_STATUS);
++
++ vmcs12->vm_entry_controls =
++ (vmcs12->vm_entry_controls & ~VM_ENTRY_IA32E_MODE) |
++ (vm_entry_controls_get(to_vmx(vcpu)) & VM_ENTRY_IA32E_MODE);
++
++ if (vmcs12->vm_exit_controls & VM_EXIT_SAVE_DEBUG_CONTROLS) {
++ kvm_get_dr(vcpu, 7, (unsigned long *)&vmcs12->guest_dr7);
++ vmcs12->guest_ia32_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL);
++ }
++
++ /* TODO: These cannot have changed unless we have MSR bitmaps and
++ * the relevant bit asks not to trap the change */
++ if (vmcs12->vm_exit_controls & VM_EXIT_SAVE_IA32_PAT)
++ vmcs12->guest_ia32_pat = vmcs_read64(GUEST_IA32_PAT);
++ if (vmcs12->vm_exit_controls & VM_EXIT_SAVE_IA32_EFER)
++ vmcs12->guest_ia32_efer = vcpu->arch.efer;
++ vmcs12->guest_sysenter_cs = vmcs_read32(GUEST_SYSENTER_CS);
++ vmcs12->guest_sysenter_esp = vmcs_readl(GUEST_SYSENTER_ESP);
++ vmcs12->guest_sysenter_eip = vmcs_readl(GUEST_SYSENTER_EIP);
++ if (kvm_mpx_supported())
++ vmcs12->guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS);
++}
++
++/*
++ * prepare_vmcs12 is part of what we need to do when the nested L2 guest exits
++ * and we want to prepare to run its L1 parent. L1 keeps a vmcs for L2 (vmcs12),
++ * and this function updates it to reflect the changes to the guest state while
++ * L2 was running (and perhaps made some exits which were handled directly by L0
++ * without going back to L1), and to reflect the exit reason.
++ * Note that we do not have to copy here all VMCS fields, just those that
++ * could have changed by the L2 guest or the exit - i.e., the guest-state and
++ * exit-information fields only. Other fields are modified by L1 with VMWRITE,
++ * which already writes to vmcs12 directly.
++ */
++static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
++ u32 exit_reason, u32 exit_intr_info,
++ unsigned long exit_qualification)
++{
++ /* update guest state fields: */
++ sync_vmcs12(vcpu, vmcs12);
++
++ /* update exit information fields: */
++
++ vmcs12->vm_exit_reason = exit_reason;
++ vmcs12->exit_qualification = exit_qualification;
++ vmcs12->vm_exit_intr_info = exit_intr_info;
++
++ vmcs12->idt_vectoring_info_field = 0;
++ vmcs12->vm_exit_instruction_len = vmcs_read32(VM_EXIT_INSTRUCTION_LEN);
++ vmcs12->vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO);
++
++ if (!(vmcs12->vm_exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY)) {
++ vmcs12->launch_state = 1;
++
++ /* vm_entry_intr_info_field is cleared on exit. Emulate this
++ * instead of reading the real value. */
++ vmcs12->vm_entry_intr_info_field &= ~INTR_INFO_VALID_MASK;
++
++ /*
++ * Transfer the event that L0 or L1 may wanted to inject into
++ * L2 to IDT_VECTORING_INFO_FIELD.
++ */
++ vmcs12_save_pending_event(vcpu, vmcs12);
++ }
++}
++
++/*
++ * A part of what we need to when the nested L2 guest exits and we want to
++ * run its L1 parent, is to reset L1's guest state to the host state specified
++ * in vmcs12.
++ * This function is to be called not only on normal nested exit, but also on
++ * a nested entry failure, as explained in Intel's spec, 3B.23.7 ("VM-Entry
++ * Failures During or After Loading Guest State").
++ * This function should be called when the active VMCS is L1's (vmcs01).
++ */
++static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12)
++{
++ struct kvm_segment seg;
++ u32 entry_failure_code;
++
++ if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_EFER)
++ vcpu->arch.efer = vmcs12->host_ia32_efer;
++ else if (vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE)
++ vcpu->arch.efer |= (EFER_LMA | EFER_LME);
++ else
++ vcpu->arch.efer &= ~(EFER_LMA | EFER_LME);
++ vmx_set_efer(vcpu, vcpu->arch.efer);
++
++ kvm_register_write(vcpu, VCPU_REGS_RSP, vmcs12->host_rsp);
++ kvm_register_write(vcpu, VCPU_REGS_RIP, vmcs12->host_rip);
++ vmx_set_rflags(vcpu, X86_EFLAGS_FIXED);
++ /*
++ * Note that calling vmx_set_cr0 is important, even if cr0 hasn't
++ * actually changed, because vmx_set_cr0 refers to efer set above.
++ *
++ * CR0_GUEST_HOST_MASK is already set in the original vmcs01
++ * (KVM doesn't change it);
++ */
++ vcpu->arch.cr0_guest_owned_bits = X86_CR0_TS;
++ vmx_set_cr0(vcpu, vmcs12->host_cr0);
++
++ /* Same as above - no reason to call set_cr4_guest_host_mask(). */
++ vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
++ vmx_set_cr4(vcpu, vmcs12->host_cr4);
++
++ nested_ept_uninit_mmu_context(vcpu);
++
++ /*
++ * Only PDPTE load can fail as the value of cr3 was checked on entry and
++ * couldn't have changed.
++ */
++ if (nested_vmx_load_cr3(vcpu, vmcs12->host_cr3, false, &entry_failure_code))
++ nested_vmx_abort(vcpu, VMX_ABORT_LOAD_HOST_PDPTE_FAIL);
++
++ if (!enable_ept)
++ vcpu->arch.walk_mmu->inject_page_fault = kvm_inject_page_fault;
++
++ /*
++ * If vmcs01 don't use VPID, CPU flushes TLB on every
++ * VMEntry/VMExit. Thus, no need to flush TLB.
++ *
++ * If vmcs12 uses VPID, TLB entries populated by L2 are
++ * tagged with vmx->nested.vpid02 while L1 entries are tagged
++ * with vmx->vpid. Thus, no need to flush TLB.
++ *
++ * Therefore, flush TLB only in case vmcs01 uses VPID and
++ * vmcs12 don't use VPID as in this case L1 & L2 TLB entries
++ * are both tagged with vmx->vpid.
++ */
++ if (enable_vpid &&
++ !(nested_cpu_has_vpid(vmcs12) && to_vmx(vcpu)->nested.vpid02)) {
++ vmx_flush_tlb(vcpu, true);
++ }
++
++ vmcs_write32(GUEST_SYSENTER_CS, vmcs12->host_ia32_sysenter_cs);
++ vmcs_writel(GUEST_SYSENTER_ESP, vmcs12->host_ia32_sysenter_esp);
++ vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->host_ia32_sysenter_eip);
++ vmcs_writel(GUEST_IDTR_BASE, vmcs12->host_idtr_base);
++ vmcs_writel(GUEST_GDTR_BASE, vmcs12->host_gdtr_base);
++ vmcs_write32(GUEST_IDTR_LIMIT, 0xFFFF);
++ vmcs_write32(GUEST_GDTR_LIMIT, 0xFFFF);
++
++ /* If not VM_EXIT_CLEAR_BNDCFGS, the L2 value propagates to L1. */
++ if (vmcs12->vm_exit_controls & VM_EXIT_CLEAR_BNDCFGS)
++ vmcs_write64(GUEST_BNDCFGS, 0);
++
++ if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_PAT) {
++ vmcs_write64(GUEST_IA32_PAT, vmcs12->host_ia32_pat);
++ vcpu->arch.pat = vmcs12->host_ia32_pat;
++ }
++ if (vmcs12->vm_exit_controls & VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL)
++ vmcs_write64(GUEST_IA32_PERF_GLOBAL_CTRL,
++ vmcs12->host_ia32_perf_global_ctrl);
++
++ /* Set L1 segment info according to Intel SDM
++ 27.5.2 Loading Host Segment and Descriptor-Table Registers */
++ seg = (struct kvm_segment) {
++ .base = 0,
++ .limit = 0xFFFFFFFF,
++ .selector = vmcs12->host_cs_selector,
++ .type = 11,
++ .present = 1,
++ .s = 1,
++ .g = 1
++ };
++ if (vmcs12->vm_exit_controls & VM_EXIT_HOST_ADDR_SPACE_SIZE)
++ seg.l = 1;
++ else
++ seg.db = 1;
++ vmx_set_segment(vcpu, &seg, VCPU_SREG_CS);
++ seg = (struct kvm_segment) {
++ .base = 0,
++ .limit = 0xFFFFFFFF,
++ .type = 3,
++ .present = 1,
++ .s = 1,
++ .db = 1,
++ .g = 1
++ };
++ seg.selector = vmcs12->host_ds_selector;
++ vmx_set_segment(vcpu, &seg, VCPU_SREG_DS);
++ seg.selector = vmcs12->host_es_selector;
++ vmx_set_segment(vcpu, &seg, VCPU_SREG_ES);
++ seg.selector = vmcs12->host_ss_selector;
++ vmx_set_segment(vcpu, &seg, VCPU_SREG_SS);
++ seg.selector = vmcs12->host_fs_selector;
++ seg.base = vmcs12->host_fs_base;
++ vmx_set_segment(vcpu, &seg, VCPU_SREG_FS);
++ seg.selector = vmcs12->host_gs_selector;
++ seg.base = vmcs12->host_gs_base;
++ vmx_set_segment(vcpu, &seg, VCPU_SREG_GS);
++ seg = (struct kvm_segment) {
++ .base = vmcs12->host_tr_base,
++ .limit = 0x67,
++ .selector = vmcs12->host_tr_selector,
++ .type = 11,
++ .present = 1
++ };
++ vmx_set_segment(vcpu, &seg, VCPU_SREG_TR);
++
++ kvm_set_dr(vcpu, 7, 0x400);
++ vmcs_write64(GUEST_IA32_DEBUGCTL, 0);
++
++ if (cpu_has_vmx_msr_bitmap())
++ vmx_update_msr_bitmap(vcpu);
++
++ if (nested_vmx_load_msr(vcpu, vmcs12->vm_exit_msr_load_addr,
++ vmcs12->vm_exit_msr_load_count))
++ nested_vmx_abort(vcpu, VMX_ABORT_LOAD_HOST_MSR_FAIL);
++}
++
++static inline u64 nested_vmx_get_vmcs01_guest_efer(struct vcpu_vmx *vmx)
++{
++ struct shared_msr_entry *efer_msr;
++ unsigned int i;
++
++ if (vm_entry_controls_get(vmx) & VM_ENTRY_LOAD_IA32_EFER)
++ return vmcs_read64(GUEST_IA32_EFER);
++
++ if (cpu_has_load_ia32_efer)
++ return host_efer;
++
++ for (i = 0; i < vmx->msr_autoload.guest.nr; ++i) {
++ if (vmx->msr_autoload.guest.val[i].index == MSR_EFER)
++ return vmx->msr_autoload.guest.val[i].value;
++ }
++
++ efer_msr = find_msr_entry(vmx, MSR_EFER);
++ if (efer_msr)
++ return efer_msr->data;
++
++ return host_efer;
++}
++
++static void nested_vmx_restore_host_state(struct kvm_vcpu *vcpu)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct vmx_msr_entry g, h;
++ struct msr_data msr;
++ gpa_t gpa;
++ u32 i, j;
++
++ vcpu->arch.pat = vmcs_read64(GUEST_IA32_PAT);
++
++ if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) {
++ /*
++ * L1's host DR7 is lost if KVM_GUESTDBG_USE_HW_BP is set
++ * as vmcs01.GUEST_DR7 contains a userspace defined value
++ * and vcpu->arch.dr7 is not squirreled away before the
++ * nested VMENTER (not worth adding a variable in nested_vmx).
++ */
++ if (vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP)
++ kvm_set_dr(vcpu, 7, DR7_FIXED_1);
++ else
++ WARN_ON(kvm_set_dr(vcpu, 7, vmcs_readl(GUEST_DR7)));
++ }
++
++ /*
++ * Note that calling vmx_set_{efer,cr0,cr4} is important as they
++ * handle a variety of side effects to KVM's software model.
++ */
++ vmx_set_efer(vcpu, nested_vmx_get_vmcs01_guest_efer(vmx));
++
++ vcpu->arch.cr0_guest_owned_bits = X86_CR0_TS;
++ vmx_set_cr0(vcpu, vmcs_readl(CR0_READ_SHADOW));
++
++ vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
++ vmx_set_cr4(vcpu, vmcs_readl(CR4_READ_SHADOW));
++
++ nested_ept_uninit_mmu_context(vcpu);
++ vcpu->arch.cr3 = vmcs_readl(GUEST_CR3);
++ __set_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail);
++
++ /*
++ * Use ept_save_pdptrs(vcpu) to load the MMU's cached PDPTRs
++ * from vmcs01 (if necessary). The PDPTRs are not loaded on
++ * VMFail, like everything else we just need to ensure our
++ * software model is up-to-date.
++ */
++ ept_save_pdptrs(vcpu);
++
++ kvm_mmu_reset_context(vcpu);
++
++ if (cpu_has_vmx_msr_bitmap())
++ vmx_update_msr_bitmap(vcpu);
++
++ /*
++ * This nasty bit of open coding is a compromise between blindly
++ * loading L1's MSRs using the exit load lists (incorrect emulation
++ * of VMFail), leaving the nested VM's MSRs in the software model
++ * (incorrect behavior) and snapshotting the modified MSRs (too
++ * expensive since the lists are unbound by hardware). For each
++ * MSR that was (prematurely) loaded from the nested VMEntry load
++ * list, reload it from the exit load list if it exists and differs
++ * from the guest value. The intent is to stuff host state as
++ * silently as possible, not to fully process the exit load list.
++ */
++ msr.host_initiated = false;
++ for (i = 0; i < vmcs12->vm_entry_msr_load_count; i++) {
++ gpa = vmcs12->vm_entry_msr_load_addr + (i * sizeof(g));
++ if (kvm_vcpu_read_guest(vcpu, gpa, &g, sizeof(g))) {
++ pr_debug_ratelimited(
++ "%s read MSR index failed (%u, 0x%08llx)\n",
++ __func__, i, gpa);
++ goto vmabort;
++ }
++
++ for (j = 0; j < vmcs12->vm_exit_msr_load_count; j++) {
++ gpa = vmcs12->vm_exit_msr_load_addr + (j * sizeof(h));
++ if (kvm_vcpu_read_guest(vcpu, gpa, &h, sizeof(h))) {
++ pr_debug_ratelimited(
++ "%s read MSR failed (%u, 0x%08llx)\n",
++ __func__, j, gpa);
++ goto vmabort;
++ }
++ if (h.index != g.index)
++ continue;
++ if (h.value == g.value)
++ break;
++
++ if (nested_vmx_load_msr_check(vcpu, &h)) {
++ pr_debug_ratelimited(
++ "%s check failed (%u, 0x%x, 0x%x)\n",
++ __func__, j, h.index, h.reserved);
++ goto vmabort;
++ }
++
++ msr.index = h.index;
++ msr.data = h.value;
++ if (kvm_set_msr(vcpu, &msr)) {
++ pr_debug_ratelimited(
++ "%s WRMSR failed (%u, 0x%x, 0x%llx)\n",
++ __func__, j, h.index, h.value);
++ goto vmabort;
++ }
++ }
++ }
++
++ return;
++
++vmabort:
++ nested_vmx_abort(vcpu, VMX_ABORT_LOAD_HOST_MSR_FAIL);
++}
++
++/*
++ * Emulate an exit from nested guest (L2) to L1, i.e., prepare to run L1
++ * and modify vmcs12 to make it see what it would expect to see there if
++ * L2 was its real guest. Must only be called when in L2 (is_guest_mode())
++ */
++static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
++ u32 exit_intr_info,
++ unsigned long exit_qualification)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++
++ /* trying to cancel vmlaunch/vmresume is a bug */
++ WARN_ON_ONCE(vmx->nested.nested_run_pending);
++
++ /*
++ * The only expected VM-instruction error is "VM entry with
++ * invalid control field(s)." Anything else indicates a
++ * problem with L0.
++ */
++ WARN_ON_ONCE(vmx->fail && (vmcs_read32(VM_INSTRUCTION_ERROR) !=
++ VMXERR_ENTRY_INVALID_CONTROL_FIELD));
++
++ leave_guest_mode(vcpu);
++
++ if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
++ vcpu->arch.tsc_offset -= vmcs12->tsc_offset;
++
++ if (likely(!vmx->fail)) {
++ if (exit_reason == -1)
++ sync_vmcs12(vcpu, vmcs12);
++ else
++ prepare_vmcs12(vcpu, vmcs12, exit_reason, exit_intr_info,
++ exit_qualification);
++
++ /*
++ * Must happen outside of sync_vmcs12() as it will
++ * also be used to capture vmcs12 cache as part of
++ * capturing nVMX state for snapshot (migration).
++ *
++ * Otherwise, this flush will dirty guest memory at a
++ * point it is already assumed by user-space to be
++ * immutable.
++ */
++ nested_flush_cached_shadow_vmcs12(vcpu, vmcs12);
++
++ if (nested_vmx_store_msr(vcpu, vmcs12->vm_exit_msr_store_addr,
++ vmcs12->vm_exit_msr_store_count))
++ nested_vmx_abort(vcpu, VMX_ABORT_SAVE_GUEST_MSR_FAIL);
++ }
++
++ /*
++ * Drop events/exceptions that were queued for re-injection to L2
++ * (picked up via vmx_complete_interrupts()), as well as exceptions
++ * that were pending for L2. Note, this must NOT be hoisted above
++ * prepare_vmcs12(), events/exceptions queued for re-injection need to
++ * be captured in vmcs12 (see vmcs12_save_pending_event()).
++ */
++ vcpu->arch.nmi_injected = false;
++ kvm_clear_exception_queue(vcpu);
++ kvm_clear_interrupt_queue(vcpu);
++
++ vmx_switch_vmcs(vcpu, &vmx->vmcs01);
++ vm_entry_controls_reset_shadow(vmx);
++ vm_exit_controls_reset_shadow(vmx);
++ vmx_segment_cache_clear(vmx);
++
++ /* Update any VMCS fields that might have changed while L2 ran */
++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr);
++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr);
++ vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset);
++
++ if (kvm_has_tsc_control)
++ decache_tsc_multiplier(vmx);
++
++ if (vmx->nested.change_vmcs01_virtual_apic_mode) {
++ vmx->nested.change_vmcs01_virtual_apic_mode = false;
++ vmx_set_virtual_apic_mode(vcpu);
++ } else if (!nested_cpu_has_ept(vmcs12) &&
++ nested_cpu_has2(vmcs12,
++ SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
++ vmx_flush_tlb(vcpu, true);
++ }
++
++ /* This is needed for same reason as it was needed in prepare_vmcs02 */
++ vmx->host_rsp = 0;
++
++ /* Unpin physical memory we referred to in vmcs02 */
++ if (vmx->nested.apic_access_page) {
++ kvm_release_page_dirty(vmx->nested.apic_access_page);
++ vmx->nested.apic_access_page = NULL;
++ }
++ if (vmx->nested.virtual_apic_page) {
++ kvm_release_page_dirty(vmx->nested.virtual_apic_page);
++ vmx->nested.virtual_apic_page = NULL;
++ }
++ if (vmx->nested.pi_desc_page) {
++ kunmap(vmx->nested.pi_desc_page);
++ kvm_release_page_dirty(vmx->nested.pi_desc_page);
++ vmx->nested.pi_desc_page = NULL;
++ vmx->nested.pi_desc = NULL;
++ }
++
++ /*
++ * We are now running in L2, mmu_notifier will force to reload the
++ * page's hpa for L2 vmcs. Need to reload it for L1 before entering L1.
++ */
++ kvm_make_request(KVM_REQ_APIC_PAGE_RELOAD, vcpu);
++
++ if (enable_shadow_vmcs && exit_reason != -1)
++ vmx->nested.sync_shadow_vmcs = true;
++
++ /* in case we halted in L2 */
++ vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
++
++ if (likely(!vmx->fail)) {
++ if (exit_reason == EXIT_REASON_EXTERNAL_INTERRUPT &&
++ nested_exit_intr_ack_set(vcpu)) {
++ int irq = kvm_cpu_get_interrupt(vcpu);
++ WARN_ON(irq < 0);
++ vmcs12->vm_exit_intr_info = irq |
++ INTR_INFO_VALID_MASK | INTR_TYPE_EXT_INTR;
++ }
++
++ if (exit_reason != -1)
++ trace_kvm_nested_vmexit_inject(vmcs12->vm_exit_reason,
++ vmcs12->exit_qualification,
++ vmcs12->idt_vectoring_info_field,
++ vmcs12->vm_exit_intr_info,
++ vmcs12->vm_exit_intr_error_code,
++ KVM_ISA_VMX);
++
++ load_vmcs12_host_state(vcpu, vmcs12);
++
++ return;
++ }
++
++ /*
++ * After an early L2 VM-entry failure, we're now back
++ * in L1 which thinks it just finished a VMLAUNCH or
++ * VMRESUME instruction, so we need to set the failure
++ * flag and the VM-instruction error field of the VMCS
++ * accordingly.
++ */
++ nested_vmx_failValid(vcpu, VMXERR_ENTRY_INVALID_CONTROL_FIELD);
++
++ /*
++ * Restore L1's host state to KVM's software model. We're here
++ * because a consistency check was caught by hardware, which
++ * means some amount of guest state has been propagated to KVM's
++ * model and needs to be unwound to the host's state.
++ */
++ nested_vmx_restore_host_state(vcpu);
++
++ /*
++ * The emulated instruction was already skipped in
++ * nested_vmx_run, but the updated RIP was never
++ * written back to the vmcs01.
++ */
++ skip_emulated_instruction(vcpu);
++ vmx->fail = 0;
++}
++
++/*
++ * Forcibly leave nested mode in order to be able to reset the VCPU later on.
++ */
++static void vmx_leave_nested(struct kvm_vcpu *vcpu)
++{
++ if (is_guest_mode(vcpu)) {
++ to_vmx(vcpu)->nested.nested_run_pending = 0;
++ nested_vmx_vmexit(vcpu, -1, 0, 0);
++ }
++ free_nested(to_vmx(vcpu));
++}
++
++/*
++ * L1's failure to enter L2 is a subset of a normal exit, as explained in
++ * 23.7 "VM-entry failures during or after loading guest state" (this also
++ * lists the acceptable exit-reason and exit-qualification parameters).
++ * It should only be called before L2 actually succeeded to run, and when
++ * vmcs01 is current (it doesn't leave_guest_mode() or switch vmcss).
++ */
++static void nested_vmx_entry_failure(struct kvm_vcpu *vcpu,
++ struct vmcs12 *vmcs12,
++ u32 reason, unsigned long qualification)
++{
++ load_vmcs12_host_state(vcpu, vmcs12);
++ vmcs12->vm_exit_reason = reason | VMX_EXIT_REASONS_FAILED_VMENTRY;
++ vmcs12->exit_qualification = qualification;
++ nested_vmx_succeed(vcpu);
++ if (enable_shadow_vmcs)
++ to_vmx(vcpu)->nested.sync_shadow_vmcs = true;
++}
++
++static int vmx_check_intercept_io(struct kvm_vcpu *vcpu,
++ struct x86_instruction_info *info)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ unsigned short port;
++ bool intercept;
++ int size;
++
++ if (info->intercept == x86_intercept_in ||
++ info->intercept == x86_intercept_ins) {
++ port = info->src_val;
++ size = info->dst_bytes;
++ } else {
++ port = info->dst_val;
++ size = info->src_bytes;
++ }
++
++ /*
++ * If the 'use IO bitmaps' VM-execution control is 0, IO instruction
++ * VM-exits depend on the 'unconditional IO exiting' VM-execution
++ * control.
++ *
++ * Otherwise, IO instruction VM-exits are controlled by the IO bitmaps.
++ */
++ if (!nested_cpu_has(vmcs12, CPU_BASED_USE_IO_BITMAPS))
++ intercept = nested_cpu_has(vmcs12,
++ CPU_BASED_UNCOND_IO_EXITING);
++ else
++ intercept = nested_vmx_check_io_bitmaps(vcpu, port, size);
++
++ /* FIXME: produce nested vmexit and return X86EMUL_INTERCEPTED. */
++ return intercept ? X86EMUL_UNHANDLEABLE : X86EMUL_CONTINUE;
++}
++
++static int vmx_check_intercept(struct kvm_vcpu *vcpu,
++ struct x86_instruction_info *info,
++ enum x86_intercept_stage stage)
++{
++ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++ struct x86_emulate_ctxt *ctxt = &vcpu->arch.emulate_ctxt;
++
++ switch (info->intercept) {
++ /*
++ * RDPID causes #UD if disabled through secondary execution controls.
++ * Because it is marked as EmulateOnUD, we need to intercept it here.
++ */
++ case x86_intercept_rdtscp:
++ if (!nested_cpu_has2(vmcs12, SECONDARY_EXEC_RDTSCP)) {
++ ctxt->exception.vector = UD_VECTOR;
++ ctxt->exception.error_code_valid = false;
++ return X86EMUL_PROPAGATE_FAULT;
++ }
++ break;
++
++ case x86_intercept_in:
++ case x86_intercept_ins:
++ case x86_intercept_out:
++ case x86_intercept_outs:
++ return vmx_check_intercept_io(vcpu, info);
++
++ case x86_intercept_lgdt:
++ case x86_intercept_lidt:
++ case x86_intercept_lldt:
++ case x86_intercept_ltr:
++ case x86_intercept_sgdt:
++ case x86_intercept_sidt:
++ case x86_intercept_sldt:
++ case x86_intercept_str:
++ if (!nested_cpu_has2(vmcs12, SECONDARY_EXEC_DESC))
++ return X86EMUL_CONTINUE;
++
++ /* FIXME: produce nested vmexit and return X86EMUL_INTERCEPTED. */
++ break;
++
++ /* TODO: check more intercepts... */
++ default:
++ break;
++ }
++
++ return X86EMUL_UNHANDLEABLE;
++}
++
++#ifdef CONFIG_X86_64
++/* (a << shift) / divisor, return 1 if overflow otherwise 0 */
++static inline int u64_shl_div_u64(u64 a, unsigned int shift,
++ u64 divisor, u64 *result)
++{
++ u64 low = a << shift, high = a >> (64 - shift);
++
++ /* To avoid the overflow on divq */
++ if (high >= divisor)
++ return 1;
++
++ /* Low hold the result, high hold rem which is discarded */
++ asm("divq %2\n\t" : "=a" (low), "=d" (high) :
++ "rm" (divisor), "0" (low), "1" (high));
++ *result = low;
++
++ return 0;
++}
++
++static int vmx_set_hv_timer(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc)
++{
++ struct vcpu_vmx *vmx;
++ u64 tscl, guest_tscl, delta_tsc, lapic_timer_advance_cycles;
++
++ if (kvm_mwait_in_guest(vcpu->kvm))
++ return -EOPNOTSUPP;
++
++ vmx = to_vmx(vcpu);
++ tscl = rdtsc();
++ guest_tscl = kvm_read_l1_tsc(vcpu, tscl);
++ delta_tsc = max(guest_deadline_tsc, guest_tscl) - guest_tscl;
++ lapic_timer_advance_cycles = nsec_to_cycles(vcpu, lapic_timer_advance_ns);
++
++ if (delta_tsc > lapic_timer_advance_cycles)
++ delta_tsc -= lapic_timer_advance_cycles;
++ else
++ delta_tsc = 0;
++
++ /* Convert to host delta tsc if tsc scaling is enabled */
++ if (vcpu->arch.tsc_scaling_ratio != kvm_default_tsc_scaling_ratio &&
++ u64_shl_div_u64(delta_tsc,
++ kvm_tsc_scaling_ratio_frac_bits,
++ vcpu->arch.tsc_scaling_ratio,
++ &delta_tsc))
++ return -ERANGE;
++
++ /*
++ * If the delta tsc can't fit in the 32 bit after the multi shift,
++ * we can't use the preemption timer.
++ * It's possible that it fits on later vmentries, but checking
++ * on every vmentry is costly so we just use an hrtimer.
++ */
++ if (delta_tsc >> (cpu_preemption_timer_multi + 32))
++ return -ERANGE;
++
++ vmx->hv_deadline_tsc = tscl + delta_tsc;
++ return delta_tsc == 0;
++}
++
++static void vmx_cancel_hv_timer(struct kvm_vcpu *vcpu)
++{
++ to_vmx(vcpu)->hv_deadline_tsc = -1;
++}
++#endif
++
++static void vmx_sched_in(struct kvm_vcpu *vcpu, int cpu)
++{
++ if (!kvm_pause_in_guest(vcpu->kvm))
++ shrink_ple_window(vcpu);
++}
++
++static void vmx_slot_enable_log_dirty(struct kvm *kvm,
++ struct kvm_memory_slot *slot)
++{
++ kvm_mmu_slot_leaf_clear_dirty(kvm, slot);
++ kvm_mmu_slot_largepage_remove_write_access(kvm, slot);
++}
++
++static void vmx_slot_disable_log_dirty(struct kvm *kvm,
++ struct kvm_memory_slot *slot)
++{
++ kvm_mmu_slot_set_dirty(kvm, slot);
++}
++
++static void vmx_flush_log_dirty(struct kvm *kvm)
++{
++ kvm_flush_pml_buffers(kvm);
++}
++
++static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu, gpa_t gpa)
++{
++ struct vmcs12 *vmcs12;
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct page *page = NULL;
++ u64 *pml_address;
++
++ if (is_guest_mode(vcpu)) {
++ WARN_ON_ONCE(vmx->nested.pml_full);
++
++ /*
++ * Check if PML is enabled for the nested guest.
++ * Whether eptp bit 6 is set is already checked
++ * as part of A/D emulation.
++ */
++ vmcs12 = get_vmcs12(vcpu);
++ if (!nested_cpu_has_pml(vmcs12))
++ return 0;
++
++ if (vmcs12->guest_pml_index >= PML_ENTITY_NUM) {
++ vmx->nested.pml_full = true;
++ return 1;
++ }
++
++ gpa &= ~0xFFFull;
++
++ page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->pml_address);
++ if (is_error_page(page))
++ return 0;
++
++ pml_address = kmap(page);
++ pml_address[vmcs12->guest_pml_index--] = gpa;
++ kunmap(page);
++ kvm_release_page_clean(page);
++ }
++
++ return 0;
++}
++
++static void vmx_enable_log_dirty_pt_masked(struct kvm *kvm,
++ struct kvm_memory_slot *memslot,
++ gfn_t offset, unsigned long mask)
++{
++ kvm_mmu_clear_dirty_pt_masked(kvm, memslot, offset, mask);
++}
++
++static void __pi_post_block(struct kvm_vcpu *vcpu)
++{
++ struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
++ struct pi_desc old, new;
++ unsigned int dest;
++
++ do {
++ old.control = new.control = pi_desc->control;
++ WARN(old.nv != POSTED_INTR_WAKEUP_VECTOR,
++ "Wakeup handler not enabled while the VCPU is blocked\n");
++
++ dest = cpu_physical_id(vcpu->cpu);
++
++ if (x2apic_enabled())
++ new.ndst = dest;
++ else
++ new.ndst = (dest << 8) & 0xFF00;
++
++ /* set 'NV' to 'notification vector' */
++ new.nv = POSTED_INTR_VECTOR;
++ } while (cmpxchg64(&pi_desc->control, old.control,
++ new.control) != old.control);
++
++ if (!WARN_ON_ONCE(vcpu->pre_pcpu == -1)) {
++ spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
++ list_del(&vcpu->blocked_vcpu_list);
++ spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
++ vcpu->pre_pcpu = -1;
++ }
++}
++
++/*
++ * This routine does the following things for vCPU which is going
++ * to be blocked if VT-d PI is enabled.
++ * - Store the vCPU to the wakeup list, so when interrupts happen
++ * we can find the right vCPU to wake up.
++ * - Change the Posted-interrupt descriptor as below:
++ * 'NDST' <-- vcpu->pre_pcpu
++ * 'NV' <-- POSTED_INTR_WAKEUP_VECTOR
++ * - If 'ON' is set during this process, which means at least one
++ * interrupt is posted for this vCPU, we cannot block it, in
++ * this case, return 1, otherwise, return 0.
++ *
++ */
++static int pi_pre_block(struct kvm_vcpu *vcpu)
++{
++ unsigned int dest;
++ struct pi_desc old, new;
++ struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
++
++ if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
++ !irq_remapping_cap(IRQ_POSTING_CAP) ||
++ !kvm_vcpu_apicv_active(vcpu))
++ return 0;
++
++ WARN_ON(irqs_disabled());
++ local_irq_disable();
++ if (!WARN_ON_ONCE(vcpu->pre_pcpu != -1)) {
++ vcpu->pre_pcpu = vcpu->cpu;
++ spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
++ list_add_tail(&vcpu->blocked_vcpu_list,
++ &per_cpu(blocked_vcpu_on_cpu,
++ vcpu->pre_pcpu));
++ spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
++ }
++
++ do {
++ old.control = new.control = pi_desc->control;
++
++ WARN((pi_desc->sn == 1),
++ "Warning: SN field of posted-interrupts "
++ "is set before blocking\n");
++
++ /*
++ * Since vCPU can be preempted during this process,
++ * vcpu->cpu could be different with pre_pcpu, we
++ * need to set pre_pcpu as the destination of wakeup
++ * notification event, then we can find the right vCPU
++ * to wakeup in wakeup handler if interrupts happen
++ * when the vCPU is in blocked state.
++ */
++ dest = cpu_physical_id(vcpu->pre_pcpu);
++
++ if (x2apic_enabled())
++ new.ndst = dest;
++ else
++ new.ndst = (dest << 8) & 0xFF00;
++
++ /* set 'NV' to 'wakeup vector' */
++ new.nv = POSTED_INTR_WAKEUP_VECTOR;
++ } while (cmpxchg64(&pi_desc->control, old.control,
++ new.control) != old.control);
++
++ /* We should not block the vCPU if an interrupt is posted for it. */
++ if (pi_test_on(pi_desc) == 1)
++ __pi_post_block(vcpu);
++
++ local_irq_enable();
++ return (vcpu->pre_pcpu == -1);
++}
++
++static int vmx_pre_block(struct kvm_vcpu *vcpu)
++{
++ if (pi_pre_block(vcpu))
++ return 1;
++
++ if (kvm_lapic_hv_timer_in_use(vcpu))
++ kvm_lapic_switch_to_sw_timer(vcpu);
++
++ return 0;
++}
++
++static void pi_post_block(struct kvm_vcpu *vcpu)
++{
++ if (vcpu->pre_pcpu == -1)
++ return;
++
++ WARN_ON(irqs_disabled());
++ local_irq_disable();
++ __pi_post_block(vcpu);
++ local_irq_enable();
++}
++
++static void vmx_post_block(struct kvm_vcpu *vcpu)
++{
++ if (kvm_x86_ops->set_hv_timer)
++ kvm_lapic_switch_to_hv_timer(vcpu);
++
++ pi_post_block(vcpu);
++}
++
++/*
++ * vmx_update_pi_irte - set IRTE for Posted-Interrupts
++ *
++ * @kvm: kvm
++ * @host_irq: host irq of the interrupt
++ * @guest_irq: gsi of the interrupt
++ * @set: set or unset PI
++ * returns 0 on success, < 0 on failure
++ */
++static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
++ uint32_t guest_irq, bool set)
++{
++ struct kvm_kernel_irq_routing_entry *e;
++ struct kvm_irq_routing_table *irq_rt;
++ struct kvm_lapic_irq irq;
++ struct kvm_vcpu *vcpu;
++ struct vcpu_data vcpu_info;
++ int idx, ret = 0;
++
++ if (!kvm_arch_has_assigned_device(kvm) ||
++ !irq_remapping_cap(IRQ_POSTING_CAP) ||
++ !kvm_vcpu_apicv_active(kvm->vcpus[0]))
++ return 0;
++
++ idx = srcu_read_lock(&kvm->irq_srcu);
++ irq_rt = srcu_dereference(kvm->irq_routing, &kvm->irq_srcu);
++ if (guest_irq >= irq_rt->nr_rt_entries ||
++ hlist_empty(&irq_rt->map[guest_irq])) {
++ pr_warn_once("no route for guest_irq %u/%u (broken user space?)\n",
++ guest_irq, irq_rt->nr_rt_entries);
++ goto out;
++ }
++
++ hlist_for_each_entry(e, &irq_rt->map[guest_irq], link) {
++ if (e->type != KVM_IRQ_ROUTING_MSI)
++ continue;
++ /*
++ * VT-d PI cannot support posting multicast/broadcast
++ * interrupts to a vCPU, we still use interrupt remapping
++ * for these kind of interrupts.
++ *
++ * For lowest-priority interrupts, we only support
++ * those with single CPU as the destination, e.g. user
++ * configures the interrupts via /proc/irq or uses
++ * irqbalance to make the interrupts single-CPU.
++ *
++ * We will support full lowest-priority interrupt later.
++ */
++
++ kvm_set_msi_irq(kvm, e, &irq);
++ if (!kvm_intr_is_single_vcpu(kvm, &irq, &vcpu)) {
++ /*
++ * Make sure the IRTE is in remapped mode if
++ * we don't handle it in posted mode.
++ */
++ ret = irq_set_vcpu_affinity(host_irq, NULL);
++ if (ret < 0) {
++ printk(KERN_INFO
++ "failed to back to remapped mode, irq: %u\n",
++ host_irq);
++ goto out;
++ }
++
++ continue;
++ }
++
++ vcpu_info.pi_desc_addr = __pa(vcpu_to_pi_desc(vcpu));
++ vcpu_info.vector = irq.vector;
++
++ trace_kvm_pi_irte_update(host_irq, vcpu->vcpu_id, e->gsi,
++ vcpu_info.vector, vcpu_info.pi_desc_addr, set);
++
++ if (set)
++ ret = irq_set_vcpu_affinity(host_irq, &vcpu_info);
++ else
++ ret = irq_set_vcpu_affinity(host_irq, NULL);
++
++ if (ret < 0) {
++ printk(KERN_INFO "%s: failed to update PI IRTE\n",
++ __func__);
++ goto out;
++ }
++ }
++
++ ret = 0;
++out:
++ srcu_read_unlock(&kvm->irq_srcu, idx);
++ return ret;
++}
++
++static void vmx_setup_mce(struct kvm_vcpu *vcpu)
++{
++ if (vcpu->arch.mcg_cap & MCG_LMCE_P)
++ to_vmx(vcpu)->msr_ia32_feature_control_valid_bits |=
++ FEATURE_CONTROL_LMCE;
++ else
++ to_vmx(vcpu)->msr_ia32_feature_control_valid_bits &=
++ ~FEATURE_CONTROL_LMCE;
++}
++
++static int vmx_smi_allowed(struct kvm_vcpu *vcpu)
++{
++ /* we need a nested vmexit to enter SMM, postpone if run is pending */
++ if (to_vmx(vcpu)->nested.nested_run_pending)
++ return 0;
++ return 1;
++}
++
++static int vmx_pre_enter_smm(struct kvm_vcpu *vcpu, char *smstate)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++
++ vmx->nested.smm.guest_mode = is_guest_mode(vcpu);
++ if (vmx->nested.smm.guest_mode)
++ nested_vmx_vmexit(vcpu, -1, 0, 0);
++
++ vmx->nested.smm.vmxon = vmx->nested.vmxon;
++ vmx->nested.vmxon = false;
++ vmx_clear_hlt(vcpu);
++ return 0;
++}
++
++static int vmx_pre_leave_smm(struct kvm_vcpu *vcpu, u64 smbase)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ int ret;
++
++ if (vmx->nested.smm.vmxon) {
++ vmx->nested.vmxon = true;
++ vmx->nested.smm.vmxon = false;
++ }
++
++ if (vmx->nested.smm.guest_mode) {
++ vcpu->arch.hflags &= ~HF_SMM_MASK;
++ ret = enter_vmx_non_root_mode(vcpu, NULL);
++ vcpu->arch.hflags |= HF_SMM_MASK;
++ if (ret)
++ return ret;
++
++ vmx->nested.smm.guest_mode = false;
++ }
++ return 0;
++}
++
++static int enable_smi_window(struct kvm_vcpu *vcpu)
++{
++ return 0;
++}
++
++static int vmx_get_nested_state(struct kvm_vcpu *vcpu,
++ struct kvm_nested_state __user *user_kvm_nested_state,
++ u32 user_data_size)
++{
++ struct vcpu_vmx *vmx;
++ struct vmcs12 *vmcs12;
++ struct kvm_nested_state kvm_state = {
++ .flags = 0,
++ .format = 0,
++ .size = sizeof(kvm_state),
++ .vmx.vmxon_pa = -1ull,
++ .vmx.vmcs_pa = -1ull,
++ };
++
++ if (!vcpu)
++ return kvm_state.size + 2 * VMCS12_SIZE;
++
++ vmx = to_vmx(vcpu);
++ vmcs12 = get_vmcs12(vcpu);
++ if (nested_vmx_allowed(vcpu) &&
++ (vmx->nested.vmxon || vmx->nested.smm.vmxon)) {
++ kvm_state.vmx.vmxon_pa = vmx->nested.vmxon_ptr;
++ kvm_state.vmx.vmcs_pa = vmx->nested.current_vmptr;
++
++ if (vmx->nested.current_vmptr != -1ull) {
++ kvm_state.size += VMCS12_SIZE;
++
++ if (is_guest_mode(vcpu) &&
++ nested_cpu_has_shadow_vmcs(vmcs12) &&
++ vmcs12->vmcs_link_pointer != -1ull)
++ kvm_state.size += VMCS12_SIZE;
++ }
++
++ if (vmx->nested.smm.vmxon)
++ kvm_state.vmx.smm.flags |= KVM_STATE_NESTED_SMM_VMXON;
++
++ if (vmx->nested.smm.guest_mode)
++ kvm_state.vmx.smm.flags |= KVM_STATE_NESTED_SMM_GUEST_MODE;
++
++ if (is_guest_mode(vcpu)) {
++ kvm_state.flags |= KVM_STATE_NESTED_GUEST_MODE;
++
++ if (vmx->nested.nested_run_pending)
++ kvm_state.flags |= KVM_STATE_NESTED_RUN_PENDING;
++ }
++ }
++
++ if (user_data_size < kvm_state.size)
++ goto out;
++
++ if (copy_to_user(user_kvm_nested_state, &kvm_state, sizeof(kvm_state)))
++ return -EFAULT;
++
++ if (vmx->nested.current_vmptr == -1ull)
++ goto out;
++
++ /*
++ * When running L2, the authoritative vmcs12 state is in the
++ * vmcs02. When running L1, the authoritative vmcs12 state is
++ * in the shadow vmcs linked to vmcs01, unless
++ * sync_shadow_vmcs is set, in which case, the authoritative
++ * vmcs12 state is in the vmcs12 already.
++ */
++ if (is_guest_mode(vcpu))
++ sync_vmcs12(vcpu, vmcs12);
++ else if (enable_shadow_vmcs && !vmx->nested.sync_shadow_vmcs)
++ copy_shadow_to_vmcs12(vmx);
++
++ /*
++ * Copy over the full allocated size of vmcs12 rather than just the size
++ * of the struct.
++ */
++ if (copy_to_user(user_kvm_nested_state->data, vmcs12, VMCS12_SIZE))
++ return -EFAULT;
++
++ if (nested_cpu_has_shadow_vmcs(vmcs12) &&
++ vmcs12->vmcs_link_pointer != -1ull) {
++ if (copy_to_user(user_kvm_nested_state->data + VMCS12_SIZE,
++ get_shadow_vmcs12(vcpu), VMCS12_SIZE))
++ return -EFAULT;
++ }
++
++out:
++ return kvm_state.size;
++}
++
++static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
++ struct kvm_nested_state __user *user_kvm_nested_state,
++ struct kvm_nested_state *kvm_state)
++{
++ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct vmcs12 *vmcs12;
++ u32 exit_qual;
++ int ret;
++
++ if (kvm_state->format != 0)
++ return -EINVAL;
++
++ if (!nested_vmx_allowed(vcpu))
++ return kvm_state->vmx.vmxon_pa == -1ull ? 0 : -EINVAL;
++
++ if (kvm_state->vmx.vmxon_pa == -1ull) {
++ if (kvm_state->vmx.smm.flags)
++ return -EINVAL;
++
++ if (kvm_state->vmx.vmcs_pa != -1ull)
++ return -EINVAL;
++
++ vmx_leave_nested(vcpu);
++ return 0;
++ }
++
++ if (!page_address_valid(vcpu, kvm_state->vmx.vmxon_pa))
++ return -EINVAL;
++
++ if ((kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_GUEST_MODE) &&
++ (kvm_state->flags & KVM_STATE_NESTED_GUEST_MODE))
++ return -EINVAL;
++
++ if (kvm_state->vmx.smm.flags &
++ ~(KVM_STATE_NESTED_SMM_GUEST_MODE | KVM_STATE_NESTED_SMM_VMXON))
++ return -EINVAL;
++
++ /*
++ * SMM temporarily disables VMX, so we cannot be in guest mode,
++ * nor can VMLAUNCH/VMRESUME be pending. Outside SMM, SMM flags
++ * must be zero.
++ */
++ if (is_smm(vcpu) ? kvm_state->flags : kvm_state->vmx.smm.flags)
++ return -EINVAL;
++
++ if ((kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_GUEST_MODE) &&
++ !(kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_VMXON))
++ return -EINVAL;
++
++ vmx_leave_nested(vcpu);
++ if (kvm_state->vmx.vmxon_pa == -1ull)
++ return 0;
++
++ vmx->nested.vmxon_ptr = kvm_state->vmx.vmxon_pa;
++ ret = enter_vmx_operation(vcpu);
++ if (ret)
++ return ret;
++
++ /* Empty 'VMXON' state is permitted */
++ if (kvm_state->size < sizeof(*kvm_state) + sizeof(*vmcs12))
++ return 0;
++
++ if (kvm_state->vmx.vmcs_pa == kvm_state->vmx.vmxon_pa ||
++ !page_address_valid(vcpu, kvm_state->vmx.vmcs_pa))
++ return -EINVAL;
++
++ set_current_vmptr(vmx, kvm_state->vmx.vmcs_pa);
++
++ if (kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_VMXON) {
++ vmx->nested.smm.vmxon = true;
++ vmx->nested.vmxon = false;
++
++ if (kvm_state->vmx.smm.flags & KVM_STATE_NESTED_SMM_GUEST_MODE)
++ vmx->nested.smm.guest_mode = true;
++ }
++
++ vmcs12 = get_vmcs12(vcpu);
++ if (copy_from_user(vmcs12, user_kvm_nested_state->data, sizeof(*vmcs12)))
++ return -EFAULT;
++
++ if (vmcs12->hdr.revision_id != VMCS12_REVISION)
++ return -EINVAL;
++
++ if (!(kvm_state->flags & KVM_STATE_NESTED_GUEST_MODE))
++ return 0;
++
++ vmx->nested.nested_run_pending =
++ !!(kvm_state->flags & KVM_STATE_NESTED_RUN_PENDING);
++
++ if (nested_cpu_has_shadow_vmcs(vmcs12) &&
++ vmcs12->vmcs_link_pointer != -1ull) {
++ struct vmcs12 *shadow_vmcs12 = get_shadow_vmcs12(vcpu);
++ if (kvm_state->size < sizeof(*kvm_state) + 2 * sizeof(*vmcs12))
++ return -EINVAL;
++
++ if (copy_from_user(shadow_vmcs12,
++ user_kvm_nested_state->data + VMCS12_SIZE,
++ sizeof(*vmcs12)))
++ return -EFAULT;
++
++ if (shadow_vmcs12->hdr.revision_id != VMCS12_REVISION ||
++ !shadow_vmcs12->hdr.shadow_vmcs)
++ return -EINVAL;
++ }
++
++ if (check_vmentry_prereqs(vcpu, vmcs12) ||
++ check_vmentry_postreqs(vcpu, vmcs12, &exit_qual))
++ return -EINVAL;
++
++ vmx->nested.dirty_vmcs12 = true;
++ ret = enter_vmx_non_root_mode(vcpu, NULL);
++ if (ret)
++ return -EINVAL;
++
++ return 0;
++}
++
++static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
++ .cpu_has_kvm_support = cpu_has_kvm_support,
++ .disabled_by_bios = vmx_disabled_by_bios,
++ .hardware_setup = hardware_setup,
++ .hardware_unsetup = hardware_unsetup,
++ .check_processor_compatibility = vmx_check_processor_compat,
++ .hardware_enable = hardware_enable,
++ .hardware_disable = hardware_disable,
++ .cpu_has_accelerated_tpr = report_flexpriority,
++ .has_emulated_msr = vmx_has_emulated_msr,
++
++ .vm_init = vmx_vm_init,
++ .vm_alloc = vmx_vm_alloc,
++ .vm_free = vmx_vm_free,
++
++ .vcpu_create = vmx_create_vcpu,
++ .vcpu_free = vmx_free_vcpu,
++ .vcpu_reset = vmx_vcpu_reset,
++
++ .prepare_guest_switch = vmx_prepare_switch_to_guest,
++ .vcpu_load = vmx_vcpu_load,
++ .vcpu_put = vmx_vcpu_put,
++
++ .update_bp_intercept = update_exception_bitmap,
++ .get_msr_feature = vmx_get_msr_feature,
++ .get_msr = vmx_get_msr,
++ .set_msr = vmx_set_msr,
++ .get_segment_base = vmx_get_segment_base,
++ .get_segment = vmx_get_segment,
++ .set_segment = vmx_set_segment,
++ .get_cpl = vmx_get_cpl,
++ .get_cs_db_l_bits = vmx_get_cs_db_l_bits,
++ .decache_cr0_guest_bits = vmx_decache_cr0_guest_bits,
++ .decache_cr3 = vmx_decache_cr3,
++ .decache_cr4_guest_bits = vmx_decache_cr4_guest_bits,
++ .set_cr0 = vmx_set_cr0,
++ .set_cr3 = vmx_set_cr3,
++ .set_cr4 = vmx_set_cr4,
++ .set_efer = vmx_set_efer,
++ .get_idt = vmx_get_idt,
++ .set_idt = vmx_set_idt,
++ .get_gdt = vmx_get_gdt,
++ .set_gdt = vmx_set_gdt,
++ .get_dr6 = vmx_get_dr6,
++ .set_dr6 = vmx_set_dr6,
++ .set_dr7 = vmx_set_dr7,
++ .sync_dirty_debug_regs = vmx_sync_dirty_debug_regs,
++ .cache_reg = vmx_cache_reg,
++ .get_rflags = vmx_get_rflags,
++ .set_rflags = vmx_set_rflags,
++
++ .tlb_flush = vmx_flush_tlb,
++ .tlb_flush_gva = vmx_flush_tlb_gva,
++
++ .run = vmx_vcpu_run,
++ .handle_exit = vmx_handle_exit,
++ .skip_emulated_instruction = skip_emulated_instruction,
++ .set_interrupt_shadow = vmx_set_interrupt_shadow,
++ .get_interrupt_shadow = vmx_get_interrupt_shadow,
++ .patch_hypercall = vmx_patch_hypercall,
++ .set_irq = vmx_inject_irq,
++ .set_nmi = vmx_inject_nmi,
++ .queue_exception = vmx_queue_exception,
++ .cancel_injection = vmx_cancel_injection,
++ .interrupt_allowed = vmx_interrupt_allowed,
++ .nmi_allowed = vmx_nmi_allowed,
++ .get_nmi_mask = vmx_get_nmi_mask,
++ .set_nmi_mask = vmx_set_nmi_mask,
++ .enable_nmi_window = enable_nmi_window,
++ .enable_irq_window = enable_irq_window,
++ .update_cr8_intercept = update_cr8_intercept,
++ .set_virtual_apic_mode = vmx_set_virtual_apic_mode,
++ .set_apic_access_page_addr = vmx_set_apic_access_page_addr,
++ .get_enable_apicv = vmx_get_enable_apicv,
++ .refresh_apicv_exec_ctrl = vmx_refresh_apicv_exec_ctrl,
++ .load_eoi_exitmap = vmx_load_eoi_exitmap,
++ .apicv_post_state_restore = vmx_apicv_post_state_restore,
++ .hwapic_irr_update = vmx_hwapic_irr_update,
++ .hwapic_isr_update = vmx_hwapic_isr_update,
++ .guest_apic_has_interrupt = vmx_guest_apic_has_interrupt,
++ .sync_pir_to_irr = vmx_sync_pir_to_irr,
++ .deliver_posted_interrupt = vmx_deliver_posted_interrupt,
++ .dy_apicv_has_pending_interrupt = vmx_dy_apicv_has_pending_interrupt,
++
++ .set_tss_addr = vmx_set_tss_addr,
++ .set_identity_map_addr = vmx_set_identity_map_addr,
++ .get_tdp_level = get_ept_level,
++ .get_mt_mask = vmx_get_mt_mask,
++
++ .get_exit_info = vmx_get_exit_info,
++
++ .get_lpage_level = vmx_get_lpage_level,
++
++ .cpuid_update = vmx_cpuid_update,
++
++ .rdtscp_supported = vmx_rdtscp_supported,
++ .invpcid_supported = vmx_invpcid_supported,
++
++ .set_supported_cpuid = vmx_set_supported_cpuid,
++
++ .has_wbinvd_exit = cpu_has_vmx_wbinvd_exit,
++
++ .read_l1_tsc_offset = vmx_read_l1_tsc_offset,
++ .write_l1_tsc_offset = vmx_write_l1_tsc_offset,
++
++ .set_tdp_cr3 = vmx_set_cr3,
++
++ .check_intercept = vmx_check_intercept,
++ .handle_external_intr = vmx_handle_external_intr,
++ .mpx_supported = vmx_mpx_supported,
++ .xsaves_supported = vmx_xsaves_supported,
++ .umip_emulated = vmx_umip_emulated,
++
++ .check_nested_events = vmx_check_nested_events,
++ .request_immediate_exit = vmx_request_immediate_exit,
++
++ .sched_in = vmx_sched_in,
++
++ .slot_enable_log_dirty = vmx_slot_enable_log_dirty,
++ .slot_disable_log_dirty = vmx_slot_disable_log_dirty,
++ .flush_log_dirty = vmx_flush_log_dirty,
++ .enable_log_dirty_pt_masked = vmx_enable_log_dirty_pt_masked,
++ .write_log_dirty = vmx_write_pml_buffer,
++
++ .pre_block = vmx_pre_block,
++ .post_block = vmx_post_block,
++
++ .pmu_ops = &intel_pmu_ops,
++
++ .update_pi_irte = vmx_update_pi_irte,
++
++#ifdef CONFIG_X86_64
++ .set_hv_timer = vmx_set_hv_timer,
++ .cancel_hv_timer = vmx_cancel_hv_timer,
++#endif
++
++ .setup_mce = vmx_setup_mce,
++
++ .get_nested_state = vmx_get_nested_state,
++ .set_nested_state = vmx_set_nested_state,
++ .get_vmcs12_pages = nested_get_vmcs12_pages,
++
++ .smi_allowed = vmx_smi_allowed,
++ .pre_enter_smm = vmx_pre_enter_smm,
++ .pre_leave_smm = vmx_pre_leave_smm,
++ .enable_smi_window = enable_smi_window,
++};
++
++static void vmx_cleanup_l1d_flush(void)
++{
++ if (vmx_l1d_flush_pages) {
++ free_pages((unsigned long)vmx_l1d_flush_pages, L1D_CACHE_ORDER);
++ vmx_l1d_flush_pages = NULL;
++ }
++ /* Restore state so sysfs ignores VMX */
++ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO;
++}
++
++static void vmx_exit(void)
++{
++#ifdef CONFIG_KEXEC_CORE
++ RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL);
++ synchronize_rcu();
++#endif
++
++ kvm_exit();
++
++#if IS_ENABLED(CONFIG_HYPERV)
++ if (static_branch_unlikely(&enable_evmcs)) {
++ int cpu;
++ struct hv_vp_assist_page *vp_ap;
++ /*
++ * Reset everything to support using non-enlightened VMCS
++ * access later (e.g. when we reload the module with
++ * enlightened_vmcs=0)
++ */
++ for_each_online_cpu(cpu) {
++ vp_ap = hv_get_vp_assist_page(cpu);
++
++ if (!vp_ap)
++ continue;
++
++ vp_ap->current_nested_vmcs = 0;
++ vp_ap->enlighten_vmentry = 0;
++ }
++
++ static_branch_disable(&enable_evmcs);
++ }
++#endif
++ vmx_cleanup_l1d_flush();
++}
++module_exit(vmx_exit);
++
++static int __init vmx_init(void)
++{
++ int r, cpu;
++
++#if IS_ENABLED(CONFIG_HYPERV)
++ /*
++ * Enlightened VMCS usage should be recommended and the host needs
++ * to support eVMCS v1 or above. We can also disable eVMCS support
++ * with module parameter.
++ */
++ if (enlightened_vmcs &&
++ ms_hyperv.hints & HV_X64_ENLIGHTENED_VMCS_RECOMMENDED &&
++ (ms_hyperv.nested_features & HV_X64_ENLIGHTENED_VMCS_VERSION) >=
++ KVM_EVMCS_VERSION) {
++ int cpu;
++
++ /* Check that we have assist pages on all online CPUs */
++ for_each_online_cpu(cpu) {
++ if (!hv_get_vp_assist_page(cpu)) {
++ enlightened_vmcs = false;
++ break;
++ }
++ }
++
++ if (enlightened_vmcs) {
++ pr_info("KVM: vmx: using Hyper-V Enlightened VMCS\n");
++ static_branch_enable(&enable_evmcs);
++ }
++ } else {
++ enlightened_vmcs = false;
++ }
++#endif
++
++ r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx),
++ __alignof__(struct vcpu_vmx), THIS_MODULE);
++ if (r)
++ return r;
++
++ /*
++ * Must be called after kvm_init() so enable_ept is properly set
++ * up. Hand the parameter mitigation value in which was stored in
++ * the pre module init parser. If no parameter was given, it will
++ * contain 'auto' which will be turned into the default 'cond'
++ * mitigation mode.
++ */
++ if (boot_cpu_has(X86_BUG_L1TF)) {
++ r = vmx_setup_l1d_flush(vmentry_l1d_flush_param);
++ if (r) {
++ vmx_exit();
++ return r;
++ }
++ }
++
++ vmx_setup_fb_clear_ctrl();
++
++ for_each_possible_cpu(cpu) {
++ INIT_LIST_HEAD(&per_cpu(loaded_vmcss_on_cpu, cpu));
++
++ INIT_LIST_HEAD(&per_cpu(blocked_vcpu_on_cpu, cpu));
++ spin_lock_init(&per_cpu(blocked_vcpu_on_cpu_lock, cpu));
++ }
++
++#ifdef CONFIG_KEXEC_CORE
++ rcu_assign_pointer(crash_vmclear_loaded_vmcss,
++ crash_vmclear_local_loaded_vmcss);
++#endif
++ vmx_check_vmcs12_offsets();
++
++ return 0;
++}
++module_init(vmx_init);
+diff --git a/arch/x86/kvm/vmx/vmx_evmcs.h b/arch/x86/kvm/vmx/vmx_evmcs.h
+new file mode 100644
+index 0000000000000..210a884090ad6
+--- /dev/null
++++ b/arch/x86/kvm/vmx/vmx_evmcs.h
+@@ -0,0 +1,324 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __KVM_X86_VMX_EVMCS_H
++#define __KVM_X86_VMX_EVMCS_H
++
++#include <asm/hyperv-tlfs.h>
++
++#define ROL16(val, n) ((u16)(((u16)(val) << (n)) | ((u16)(val) >> (16 - (n)))))
++#define EVMCS1_OFFSET(x) offsetof(struct hv_enlightened_vmcs, x)
++#define EVMCS1_FIELD(number, name, clean_field)[ROL16(number, 6)] = \
++ {EVMCS1_OFFSET(name), clean_field}
++
++struct evmcs_field {
++ u16 offset;
++ u16 clean_field;
++};
++
++static const struct evmcs_field vmcs_field_to_evmcs_1[] = {
++ /* 64 bit rw */
++ EVMCS1_FIELD(GUEST_RIP, guest_rip,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++ EVMCS1_FIELD(GUEST_RSP, guest_rsp,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_BASIC),
++ EVMCS1_FIELD(GUEST_RFLAGS, guest_rflags,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_BASIC),
++ EVMCS1_FIELD(HOST_IA32_PAT, host_ia32_pat,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_IA32_EFER, host_ia32_efer,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_CR0, host_cr0,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_CR3, host_cr3,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_CR4, host_cr4,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_IA32_SYSENTER_ESP, host_ia32_sysenter_esp,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_IA32_SYSENTER_EIP, host_ia32_sysenter_eip,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_RIP, host_rip,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(IO_BITMAP_A, io_bitmap_a,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_IO_BITMAP),
++ EVMCS1_FIELD(IO_BITMAP_B, io_bitmap_b,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_IO_BITMAP),
++ EVMCS1_FIELD(MSR_BITMAP, msr_bitmap,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP),
++ EVMCS1_FIELD(GUEST_ES_BASE, guest_es_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_CS_BASE, guest_cs_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_SS_BASE, guest_ss_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_DS_BASE, guest_ds_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_FS_BASE, guest_fs_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_GS_BASE, guest_gs_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_LDTR_BASE, guest_ldtr_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_TR_BASE, guest_tr_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_GDTR_BASE, guest_gdtr_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_IDTR_BASE, guest_idtr_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(TSC_OFFSET, tsc_offset,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP2),
++ EVMCS1_FIELD(VIRTUAL_APIC_PAGE_ADDR, virtual_apic_page_addr,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP2),
++ EVMCS1_FIELD(VMCS_LINK_POINTER, vmcs_link_pointer,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(GUEST_IA32_DEBUGCTL, guest_ia32_debugctl,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(GUEST_IA32_PAT, guest_ia32_pat,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(GUEST_IA32_EFER, guest_ia32_efer,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(GUEST_PDPTR0, guest_pdptr0,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(GUEST_PDPTR1, guest_pdptr1,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(GUEST_PDPTR2, guest_pdptr2,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(GUEST_PDPTR3, guest_pdptr3,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(GUEST_PENDING_DBG_EXCEPTIONS, guest_pending_dbg_exceptions,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(GUEST_SYSENTER_ESP, guest_sysenter_esp,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(GUEST_SYSENTER_EIP, guest_sysenter_eip,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(CR0_GUEST_HOST_MASK, cr0_guest_host_mask,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
++ EVMCS1_FIELD(CR4_GUEST_HOST_MASK, cr4_guest_host_mask,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
++ EVMCS1_FIELD(CR0_READ_SHADOW, cr0_read_shadow,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
++ EVMCS1_FIELD(CR4_READ_SHADOW, cr4_read_shadow,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
++ EVMCS1_FIELD(GUEST_CR0, guest_cr0,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
++ EVMCS1_FIELD(GUEST_CR3, guest_cr3,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
++ EVMCS1_FIELD(GUEST_CR4, guest_cr4,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
++ EVMCS1_FIELD(GUEST_DR7, guest_dr7,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
++ EVMCS1_FIELD(HOST_FS_BASE, host_fs_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
++ EVMCS1_FIELD(HOST_GS_BASE, host_gs_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
++ EVMCS1_FIELD(HOST_TR_BASE, host_tr_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
++ EVMCS1_FIELD(HOST_GDTR_BASE, host_gdtr_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
++ EVMCS1_FIELD(HOST_IDTR_BASE, host_idtr_base,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
++ EVMCS1_FIELD(HOST_RSP, host_rsp,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
++ EVMCS1_FIELD(EPT_POINTER, ept_pointer,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_XLAT),
++ EVMCS1_FIELD(GUEST_BNDCFGS, guest_bndcfgs,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(XSS_EXIT_BITMAP, xss_exit_bitmap,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP2),
++
++ /* 64 bit read only */
++ EVMCS1_FIELD(GUEST_PHYSICAL_ADDRESS, guest_physical_address,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++ EVMCS1_FIELD(EXIT_QUALIFICATION, exit_qualification,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++ /*
++ * Not defined in KVM:
++ *
++ * EVMCS1_FIELD(0x00006402, exit_io_instruction_ecx,
++ * HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE);
++ * EVMCS1_FIELD(0x00006404, exit_io_instruction_esi,
++ * HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE);
++ * EVMCS1_FIELD(0x00006406, exit_io_instruction_esi,
++ * HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE);
++ * EVMCS1_FIELD(0x00006408, exit_io_instruction_eip,
++ * HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE);
++ */
++ EVMCS1_FIELD(GUEST_LINEAR_ADDRESS, guest_linear_address,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++
++ /*
++ * No mask defined in the spec as Hyper-V doesn't currently support
++ * these. Future proof by resetting the whole clean field mask on
++ * access.
++ */
++ EVMCS1_FIELD(VM_EXIT_MSR_STORE_ADDR, vm_exit_msr_store_addr,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++ EVMCS1_FIELD(VM_EXIT_MSR_LOAD_ADDR, vm_exit_msr_load_addr,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++ EVMCS1_FIELD(VM_ENTRY_MSR_LOAD_ADDR, vm_entry_msr_load_addr,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++ EVMCS1_FIELD(CR3_TARGET_VALUE0, cr3_target_value0,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++ EVMCS1_FIELD(CR3_TARGET_VALUE1, cr3_target_value1,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++ EVMCS1_FIELD(CR3_TARGET_VALUE2, cr3_target_value2,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++ EVMCS1_FIELD(CR3_TARGET_VALUE3, cr3_target_value3,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++
++ /* 32 bit rw */
++ EVMCS1_FIELD(TPR_THRESHOLD, tpr_threshold,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++ EVMCS1_FIELD(GUEST_INTERRUPTIBILITY_INFO, guest_interruptibility_info,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_BASIC),
++ EVMCS1_FIELD(CPU_BASED_VM_EXEC_CONTROL, cpu_based_vm_exec_control,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_PROC),
++ EVMCS1_FIELD(EXCEPTION_BITMAP, exception_bitmap,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_EXCPN),
++ EVMCS1_FIELD(VM_ENTRY_CONTROLS, vm_entry_controls,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_ENTRY),
++ EVMCS1_FIELD(VM_ENTRY_INTR_INFO_FIELD, vm_entry_intr_info_field,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_EVENT),
++ EVMCS1_FIELD(VM_ENTRY_EXCEPTION_ERROR_CODE,
++ vm_entry_exception_error_code,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_EVENT),
++ EVMCS1_FIELD(VM_ENTRY_INSTRUCTION_LEN, vm_entry_instruction_len,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_EVENT),
++ EVMCS1_FIELD(HOST_IA32_SYSENTER_CS, host_ia32_sysenter_cs,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(PIN_BASED_VM_EXEC_CONTROL, pin_based_vm_exec_control,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP1),
++ EVMCS1_FIELD(VM_EXIT_CONTROLS, vm_exit_controls,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP1),
++ EVMCS1_FIELD(SECONDARY_VM_EXEC_CONTROL, secondary_vm_exec_control,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP1),
++ EVMCS1_FIELD(GUEST_ES_LIMIT, guest_es_limit,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_CS_LIMIT, guest_cs_limit,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_SS_LIMIT, guest_ss_limit,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_DS_LIMIT, guest_ds_limit,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_FS_LIMIT, guest_fs_limit,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_GS_LIMIT, guest_gs_limit,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_LDTR_LIMIT, guest_ldtr_limit,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_TR_LIMIT, guest_tr_limit,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_GDTR_LIMIT, guest_gdtr_limit,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_IDTR_LIMIT, guest_idtr_limit,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_ES_AR_BYTES, guest_es_ar_bytes,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_CS_AR_BYTES, guest_cs_ar_bytes,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_SS_AR_BYTES, guest_ss_ar_bytes,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_DS_AR_BYTES, guest_ds_ar_bytes,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_FS_AR_BYTES, guest_fs_ar_bytes,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_GS_AR_BYTES, guest_gs_ar_bytes,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_LDTR_AR_BYTES, guest_ldtr_ar_bytes,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_TR_AR_BYTES, guest_tr_ar_bytes,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_ACTIVITY_STATE, guest_activity_state,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++ EVMCS1_FIELD(GUEST_SYSENTER_CS, guest_sysenter_cs,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
++
++ /* 32 bit read only */
++ EVMCS1_FIELD(VM_INSTRUCTION_ERROR, vm_instruction_error,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++ EVMCS1_FIELD(VM_EXIT_REASON, vm_exit_reason,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++ EVMCS1_FIELD(VM_EXIT_INTR_INFO, vm_exit_intr_info,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++ EVMCS1_FIELD(VM_EXIT_INTR_ERROR_CODE, vm_exit_intr_error_code,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++ EVMCS1_FIELD(IDT_VECTORING_INFO_FIELD, idt_vectoring_info_field,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++ EVMCS1_FIELD(IDT_VECTORING_ERROR_CODE, idt_vectoring_error_code,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++ EVMCS1_FIELD(VM_EXIT_INSTRUCTION_LEN, vm_exit_instruction_len,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++ EVMCS1_FIELD(VMX_INSTRUCTION_INFO, vmx_instruction_info,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
++
++ /* No mask defined in the spec (not used) */
++ EVMCS1_FIELD(PAGE_FAULT_ERROR_CODE_MASK, page_fault_error_code_mask,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++ EVMCS1_FIELD(PAGE_FAULT_ERROR_CODE_MATCH, page_fault_error_code_match,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++ EVMCS1_FIELD(CR3_TARGET_COUNT, cr3_target_count,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++ EVMCS1_FIELD(VM_EXIT_MSR_STORE_COUNT, vm_exit_msr_store_count,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++ EVMCS1_FIELD(VM_EXIT_MSR_LOAD_COUNT, vm_exit_msr_load_count,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++ EVMCS1_FIELD(VM_ENTRY_MSR_LOAD_COUNT, vm_entry_msr_load_count,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
++
++ /* 16 bit rw */
++ EVMCS1_FIELD(HOST_ES_SELECTOR, host_es_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_CS_SELECTOR, host_cs_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_SS_SELECTOR, host_ss_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_DS_SELECTOR, host_ds_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_FS_SELECTOR, host_fs_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_GS_SELECTOR, host_gs_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(HOST_TR_SELECTOR, host_tr_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
++ EVMCS1_FIELD(GUEST_ES_SELECTOR, guest_es_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_CS_SELECTOR, guest_cs_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_SS_SELECTOR, guest_ss_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_DS_SELECTOR, guest_ds_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_FS_SELECTOR, guest_fs_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_GS_SELECTOR, guest_gs_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_LDTR_SELECTOR, guest_ldtr_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(GUEST_TR_SELECTOR, guest_tr_selector,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
++ EVMCS1_FIELD(VIRTUAL_PROCESSOR_ID, virtual_processor_id,
++ HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_XLAT),
++};
++
++static __always_inline int get_evmcs_offset(unsigned long field,
++ u16 *clean_field)
++{
++ unsigned int index = ROL16(field, 6);
++ const struct evmcs_field *evmcs_field;
++
++ if (unlikely(index >= ARRAY_SIZE(vmcs_field_to_evmcs_1))) {
++ WARN_ONCE(1, "KVM: accessing unsupported EVMCS field %lx\n",
++ field);
++ return -ENOENT;
++ }
++
++ evmcs_field = &vmcs_field_to_evmcs_1[index];
++
++ if (clean_field)
++ *clean_field = evmcs_field->clean_field;
++
++ return evmcs_field->offset;
++}
++
++#undef ROL16
++
++#endif /* __KVM_X86_VMX_EVMCS_H */
+diff --git a/arch/x86/kvm/vmx/vmx_shadow_fields.h b/arch/x86/kvm/vmx/vmx_shadow_fields.h
+new file mode 100644
+index 0000000000000..cd0c75f6d037a
+--- /dev/null
++++ b/arch/x86/kvm/vmx/vmx_shadow_fields.h
+@@ -0,0 +1,77 @@
++#ifndef SHADOW_FIELD_RO
++#define SHADOW_FIELD_RO(x)
++#endif
++#ifndef SHADOW_FIELD_RW
++#define SHADOW_FIELD_RW(x)
++#endif
++
++/*
++ * We do NOT shadow fields that are modified when L0
++ * traps and emulates any vmx instruction (e.g. VMPTRLD,
++ * VMXON...) executed by L1.
++ * For example, VM_INSTRUCTION_ERROR is read
++ * by L1 if a vmx instruction fails (part of the error path).
++ * Note the code assumes this logic. If for some reason
++ * we start shadowing these fields then we need to
++ * force a shadow sync when L0 emulates vmx instructions
++ * (e.g. force a sync if VM_INSTRUCTION_ERROR is modified
++ * by nested_vmx_failValid)
++ *
++ * When adding or removing fields here, note that shadowed
++ * fields must always be synced by prepare_vmcs02, not just
++ * prepare_vmcs02_full.
++ */
++
++/*
++ * Keeping the fields ordered by size is an attempt at improving
++ * branch prediction in vmcs_read_any and vmcs_write_any.
++ */
++
++/* 16-bits */
++SHADOW_FIELD_RW(GUEST_CS_SELECTOR)
++SHADOW_FIELD_RW(GUEST_INTR_STATUS)
++SHADOW_FIELD_RW(GUEST_PML_INDEX)
++SHADOW_FIELD_RW(HOST_FS_SELECTOR)
++SHADOW_FIELD_RW(HOST_GS_SELECTOR)
++
++/* 32-bits */
++SHADOW_FIELD_RO(VM_EXIT_REASON)
++SHADOW_FIELD_RO(VM_EXIT_INTR_INFO)
++SHADOW_FIELD_RO(VM_EXIT_INSTRUCTION_LEN)
++SHADOW_FIELD_RO(IDT_VECTORING_INFO_FIELD)
++SHADOW_FIELD_RO(IDT_VECTORING_ERROR_CODE)
++SHADOW_FIELD_RO(VM_EXIT_INTR_ERROR_CODE)
++SHADOW_FIELD_RW(CPU_BASED_VM_EXEC_CONTROL)
++SHADOW_FIELD_RW(EXCEPTION_BITMAP)
++SHADOW_FIELD_RW(VM_ENTRY_EXCEPTION_ERROR_CODE)
++SHADOW_FIELD_RW(VM_ENTRY_INTR_INFO_FIELD)
++SHADOW_FIELD_RW(VM_ENTRY_INSTRUCTION_LEN)
++SHADOW_FIELD_RW(TPR_THRESHOLD)
++SHADOW_FIELD_RW(GUEST_CS_LIMIT)
++SHADOW_FIELD_RW(GUEST_CS_AR_BYTES)
++SHADOW_FIELD_RW(GUEST_INTERRUPTIBILITY_INFO)
++SHADOW_FIELD_RW(VMX_PREEMPTION_TIMER_VALUE)
++
++/* Natural width */
++SHADOW_FIELD_RO(EXIT_QUALIFICATION)
++SHADOW_FIELD_RO(GUEST_LINEAR_ADDRESS)
++SHADOW_FIELD_RW(GUEST_RIP)
++SHADOW_FIELD_RW(GUEST_RSP)
++SHADOW_FIELD_RW(GUEST_CR0)
++SHADOW_FIELD_RW(GUEST_CR3)
++SHADOW_FIELD_RW(GUEST_CR4)
++SHADOW_FIELD_RW(GUEST_RFLAGS)
++SHADOW_FIELD_RW(GUEST_CS_BASE)
++SHADOW_FIELD_RW(GUEST_ES_BASE)
++SHADOW_FIELD_RW(CR0_GUEST_HOST_MASK)
++SHADOW_FIELD_RW(CR0_READ_SHADOW)
++SHADOW_FIELD_RW(CR4_READ_SHADOW)
++SHADOW_FIELD_RW(HOST_FS_BASE)
++SHADOW_FIELD_RW(HOST_GS_BASE)
++
++/* 64-bit */
++SHADOW_FIELD_RO(GUEST_PHYSICAL_ADDRESS)
++SHADOW_FIELD_RO(GUEST_PHYSICAL_ADDRESS_HIGH)
++
++#undef SHADOW_FIELD_RO
++#undef SHADOW_FIELD_RW
+diff --git a/arch/x86/kvm/vmx_evmcs.h b/arch/x86/kvm/vmx_evmcs.h
+deleted file mode 100644
+index 210a884090ad6..0000000000000
+--- a/arch/x86/kvm/vmx_evmcs.h
++++ /dev/null
+@@ -1,324 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef __KVM_X86_VMX_EVMCS_H
+-#define __KVM_X86_VMX_EVMCS_H
+-
+-#include <asm/hyperv-tlfs.h>
+-
+-#define ROL16(val, n) ((u16)(((u16)(val) << (n)) | ((u16)(val) >> (16 - (n)))))
+-#define EVMCS1_OFFSET(x) offsetof(struct hv_enlightened_vmcs, x)
+-#define EVMCS1_FIELD(number, name, clean_field)[ROL16(number, 6)] = \
+- {EVMCS1_OFFSET(name), clean_field}
+-
+-struct evmcs_field {
+- u16 offset;
+- u16 clean_field;
+-};
+-
+-static const struct evmcs_field vmcs_field_to_evmcs_1[] = {
+- /* 64 bit rw */
+- EVMCS1_FIELD(GUEST_RIP, guest_rip,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+- EVMCS1_FIELD(GUEST_RSP, guest_rsp,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_BASIC),
+- EVMCS1_FIELD(GUEST_RFLAGS, guest_rflags,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_BASIC),
+- EVMCS1_FIELD(HOST_IA32_PAT, host_ia32_pat,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_IA32_EFER, host_ia32_efer,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_CR0, host_cr0,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_CR3, host_cr3,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_CR4, host_cr4,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_IA32_SYSENTER_ESP, host_ia32_sysenter_esp,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_IA32_SYSENTER_EIP, host_ia32_sysenter_eip,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_RIP, host_rip,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(IO_BITMAP_A, io_bitmap_a,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_IO_BITMAP),
+- EVMCS1_FIELD(IO_BITMAP_B, io_bitmap_b,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_IO_BITMAP),
+- EVMCS1_FIELD(MSR_BITMAP, msr_bitmap,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP),
+- EVMCS1_FIELD(GUEST_ES_BASE, guest_es_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_CS_BASE, guest_cs_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_SS_BASE, guest_ss_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_DS_BASE, guest_ds_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_FS_BASE, guest_fs_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_GS_BASE, guest_gs_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_LDTR_BASE, guest_ldtr_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_TR_BASE, guest_tr_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_GDTR_BASE, guest_gdtr_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_IDTR_BASE, guest_idtr_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(TSC_OFFSET, tsc_offset,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP2),
+- EVMCS1_FIELD(VIRTUAL_APIC_PAGE_ADDR, virtual_apic_page_addr,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP2),
+- EVMCS1_FIELD(VMCS_LINK_POINTER, vmcs_link_pointer,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(GUEST_IA32_DEBUGCTL, guest_ia32_debugctl,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(GUEST_IA32_PAT, guest_ia32_pat,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(GUEST_IA32_EFER, guest_ia32_efer,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(GUEST_PDPTR0, guest_pdptr0,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(GUEST_PDPTR1, guest_pdptr1,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(GUEST_PDPTR2, guest_pdptr2,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(GUEST_PDPTR3, guest_pdptr3,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(GUEST_PENDING_DBG_EXCEPTIONS, guest_pending_dbg_exceptions,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(GUEST_SYSENTER_ESP, guest_sysenter_esp,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(GUEST_SYSENTER_EIP, guest_sysenter_eip,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(CR0_GUEST_HOST_MASK, cr0_guest_host_mask,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
+- EVMCS1_FIELD(CR4_GUEST_HOST_MASK, cr4_guest_host_mask,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
+- EVMCS1_FIELD(CR0_READ_SHADOW, cr0_read_shadow,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
+- EVMCS1_FIELD(CR4_READ_SHADOW, cr4_read_shadow,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
+- EVMCS1_FIELD(GUEST_CR0, guest_cr0,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
+- EVMCS1_FIELD(GUEST_CR3, guest_cr3,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
+- EVMCS1_FIELD(GUEST_CR4, guest_cr4,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
+- EVMCS1_FIELD(GUEST_DR7, guest_dr7,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CRDR),
+- EVMCS1_FIELD(HOST_FS_BASE, host_fs_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
+- EVMCS1_FIELD(HOST_GS_BASE, host_gs_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
+- EVMCS1_FIELD(HOST_TR_BASE, host_tr_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
+- EVMCS1_FIELD(HOST_GDTR_BASE, host_gdtr_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
+- EVMCS1_FIELD(HOST_IDTR_BASE, host_idtr_base,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
+- EVMCS1_FIELD(HOST_RSP, host_rsp,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_POINTER),
+- EVMCS1_FIELD(EPT_POINTER, ept_pointer,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_XLAT),
+- EVMCS1_FIELD(GUEST_BNDCFGS, guest_bndcfgs,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(XSS_EXIT_BITMAP, xss_exit_bitmap,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP2),
+-
+- /* 64 bit read only */
+- EVMCS1_FIELD(GUEST_PHYSICAL_ADDRESS, guest_physical_address,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+- EVMCS1_FIELD(EXIT_QUALIFICATION, exit_qualification,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+- /*
+- * Not defined in KVM:
+- *
+- * EVMCS1_FIELD(0x00006402, exit_io_instruction_ecx,
+- * HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE);
+- * EVMCS1_FIELD(0x00006404, exit_io_instruction_esi,
+- * HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE);
+- * EVMCS1_FIELD(0x00006406, exit_io_instruction_esi,
+- * HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE);
+- * EVMCS1_FIELD(0x00006408, exit_io_instruction_eip,
+- * HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE);
+- */
+- EVMCS1_FIELD(GUEST_LINEAR_ADDRESS, guest_linear_address,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+-
+- /*
+- * No mask defined in the spec as Hyper-V doesn't currently support
+- * these. Future proof by resetting the whole clean field mask on
+- * access.
+- */
+- EVMCS1_FIELD(VM_EXIT_MSR_STORE_ADDR, vm_exit_msr_store_addr,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+- EVMCS1_FIELD(VM_EXIT_MSR_LOAD_ADDR, vm_exit_msr_load_addr,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+- EVMCS1_FIELD(VM_ENTRY_MSR_LOAD_ADDR, vm_entry_msr_load_addr,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+- EVMCS1_FIELD(CR3_TARGET_VALUE0, cr3_target_value0,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+- EVMCS1_FIELD(CR3_TARGET_VALUE1, cr3_target_value1,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+- EVMCS1_FIELD(CR3_TARGET_VALUE2, cr3_target_value2,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+- EVMCS1_FIELD(CR3_TARGET_VALUE3, cr3_target_value3,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+-
+- /* 32 bit rw */
+- EVMCS1_FIELD(TPR_THRESHOLD, tpr_threshold,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+- EVMCS1_FIELD(GUEST_INTERRUPTIBILITY_INFO, guest_interruptibility_info,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_BASIC),
+- EVMCS1_FIELD(CPU_BASED_VM_EXEC_CONTROL, cpu_based_vm_exec_control,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_PROC),
+- EVMCS1_FIELD(EXCEPTION_BITMAP, exception_bitmap,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_EXCPN),
+- EVMCS1_FIELD(VM_ENTRY_CONTROLS, vm_entry_controls,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_ENTRY),
+- EVMCS1_FIELD(VM_ENTRY_INTR_INFO_FIELD, vm_entry_intr_info_field,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_EVENT),
+- EVMCS1_FIELD(VM_ENTRY_EXCEPTION_ERROR_CODE,
+- vm_entry_exception_error_code,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_EVENT),
+- EVMCS1_FIELD(VM_ENTRY_INSTRUCTION_LEN, vm_entry_instruction_len,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_EVENT),
+- EVMCS1_FIELD(HOST_IA32_SYSENTER_CS, host_ia32_sysenter_cs,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(PIN_BASED_VM_EXEC_CONTROL, pin_based_vm_exec_control,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP1),
+- EVMCS1_FIELD(VM_EXIT_CONTROLS, vm_exit_controls,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP1),
+- EVMCS1_FIELD(SECONDARY_VM_EXEC_CONTROL, secondary_vm_exec_control,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_GRP1),
+- EVMCS1_FIELD(GUEST_ES_LIMIT, guest_es_limit,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_CS_LIMIT, guest_cs_limit,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_SS_LIMIT, guest_ss_limit,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_DS_LIMIT, guest_ds_limit,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_FS_LIMIT, guest_fs_limit,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_GS_LIMIT, guest_gs_limit,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_LDTR_LIMIT, guest_ldtr_limit,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_TR_LIMIT, guest_tr_limit,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_GDTR_LIMIT, guest_gdtr_limit,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_IDTR_LIMIT, guest_idtr_limit,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_ES_AR_BYTES, guest_es_ar_bytes,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_CS_AR_BYTES, guest_cs_ar_bytes,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_SS_AR_BYTES, guest_ss_ar_bytes,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_DS_AR_BYTES, guest_ds_ar_bytes,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_FS_AR_BYTES, guest_fs_ar_bytes,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_GS_AR_BYTES, guest_gs_ar_bytes,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_LDTR_AR_BYTES, guest_ldtr_ar_bytes,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_TR_AR_BYTES, guest_tr_ar_bytes,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_ACTIVITY_STATE, guest_activity_state,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+- EVMCS1_FIELD(GUEST_SYSENTER_CS, guest_sysenter_cs,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP1),
+-
+- /* 32 bit read only */
+- EVMCS1_FIELD(VM_INSTRUCTION_ERROR, vm_instruction_error,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+- EVMCS1_FIELD(VM_EXIT_REASON, vm_exit_reason,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+- EVMCS1_FIELD(VM_EXIT_INTR_INFO, vm_exit_intr_info,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+- EVMCS1_FIELD(VM_EXIT_INTR_ERROR_CODE, vm_exit_intr_error_code,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+- EVMCS1_FIELD(IDT_VECTORING_INFO_FIELD, idt_vectoring_info_field,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+- EVMCS1_FIELD(IDT_VECTORING_ERROR_CODE, idt_vectoring_error_code,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+- EVMCS1_FIELD(VM_EXIT_INSTRUCTION_LEN, vm_exit_instruction_len,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+- EVMCS1_FIELD(VMX_INSTRUCTION_INFO, vmx_instruction_info,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_NONE),
+-
+- /* No mask defined in the spec (not used) */
+- EVMCS1_FIELD(PAGE_FAULT_ERROR_CODE_MASK, page_fault_error_code_mask,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+- EVMCS1_FIELD(PAGE_FAULT_ERROR_CODE_MATCH, page_fault_error_code_match,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+- EVMCS1_FIELD(CR3_TARGET_COUNT, cr3_target_count,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+- EVMCS1_FIELD(VM_EXIT_MSR_STORE_COUNT, vm_exit_msr_store_count,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+- EVMCS1_FIELD(VM_EXIT_MSR_LOAD_COUNT, vm_exit_msr_load_count,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+- EVMCS1_FIELD(VM_ENTRY_MSR_LOAD_COUNT, vm_entry_msr_load_count,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_ALL),
+-
+- /* 16 bit rw */
+- EVMCS1_FIELD(HOST_ES_SELECTOR, host_es_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_CS_SELECTOR, host_cs_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_SS_SELECTOR, host_ss_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_DS_SELECTOR, host_ds_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_FS_SELECTOR, host_fs_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_GS_SELECTOR, host_gs_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(HOST_TR_SELECTOR, host_tr_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_HOST_GRP1),
+- EVMCS1_FIELD(GUEST_ES_SELECTOR, guest_es_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_CS_SELECTOR, guest_cs_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_SS_SELECTOR, guest_ss_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_DS_SELECTOR, guest_ds_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_FS_SELECTOR, guest_fs_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_GS_SELECTOR, guest_gs_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_LDTR_SELECTOR, guest_ldtr_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(GUEST_TR_SELECTOR, guest_tr_selector,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2),
+- EVMCS1_FIELD(VIRTUAL_PROCESSOR_ID, virtual_processor_id,
+- HV_VMX_ENLIGHTENED_CLEAN_FIELD_CONTROL_XLAT),
+-};
+-
+-static __always_inline int get_evmcs_offset(unsigned long field,
+- u16 *clean_field)
+-{
+- unsigned int index = ROL16(field, 6);
+- const struct evmcs_field *evmcs_field;
+-
+- if (unlikely(index >= ARRAY_SIZE(vmcs_field_to_evmcs_1))) {
+- WARN_ONCE(1, "KVM: accessing unsupported EVMCS field %lx\n",
+- field);
+- return -ENOENT;
+- }
+-
+- evmcs_field = &vmcs_field_to_evmcs_1[index];
+-
+- if (clean_field)
+- *clean_field = evmcs_field->clean_field;
+-
+- return evmcs_field->offset;
+-}
+-
+-#undef ROL16
+-
+-#endif /* __KVM_X86_VMX_EVMCS_H */
+diff --git a/arch/x86/kvm/vmx_shadow_fields.h b/arch/x86/kvm/vmx_shadow_fields.h
+deleted file mode 100644
+index cd0c75f6d037a..0000000000000
+--- a/arch/x86/kvm/vmx_shadow_fields.h
++++ /dev/null
+@@ -1,77 +0,0 @@
+-#ifndef SHADOW_FIELD_RO
+-#define SHADOW_FIELD_RO(x)
+-#endif
+-#ifndef SHADOW_FIELD_RW
+-#define SHADOW_FIELD_RW(x)
+-#endif
+-
+-/*
+- * We do NOT shadow fields that are modified when L0
+- * traps and emulates any vmx instruction (e.g. VMPTRLD,
+- * VMXON...) executed by L1.
+- * For example, VM_INSTRUCTION_ERROR is read
+- * by L1 if a vmx instruction fails (part of the error path).
+- * Note the code assumes this logic. If for some reason
+- * we start shadowing these fields then we need to
+- * force a shadow sync when L0 emulates vmx instructions
+- * (e.g. force a sync if VM_INSTRUCTION_ERROR is modified
+- * by nested_vmx_failValid)
+- *
+- * When adding or removing fields here, note that shadowed
+- * fields must always be synced by prepare_vmcs02, not just
+- * prepare_vmcs02_full.
+- */
+-
+-/*
+- * Keeping the fields ordered by size is an attempt at improving
+- * branch prediction in vmcs_read_any and vmcs_write_any.
+- */
+-
+-/* 16-bits */
+-SHADOW_FIELD_RW(GUEST_CS_SELECTOR)
+-SHADOW_FIELD_RW(GUEST_INTR_STATUS)
+-SHADOW_FIELD_RW(GUEST_PML_INDEX)
+-SHADOW_FIELD_RW(HOST_FS_SELECTOR)
+-SHADOW_FIELD_RW(HOST_GS_SELECTOR)
+-
+-/* 32-bits */
+-SHADOW_FIELD_RO(VM_EXIT_REASON)
+-SHADOW_FIELD_RO(VM_EXIT_INTR_INFO)
+-SHADOW_FIELD_RO(VM_EXIT_INSTRUCTION_LEN)
+-SHADOW_FIELD_RO(IDT_VECTORING_INFO_FIELD)
+-SHADOW_FIELD_RO(IDT_VECTORING_ERROR_CODE)
+-SHADOW_FIELD_RO(VM_EXIT_INTR_ERROR_CODE)
+-SHADOW_FIELD_RW(CPU_BASED_VM_EXEC_CONTROL)
+-SHADOW_FIELD_RW(EXCEPTION_BITMAP)
+-SHADOW_FIELD_RW(VM_ENTRY_EXCEPTION_ERROR_CODE)
+-SHADOW_FIELD_RW(VM_ENTRY_INTR_INFO_FIELD)
+-SHADOW_FIELD_RW(VM_ENTRY_INSTRUCTION_LEN)
+-SHADOW_FIELD_RW(TPR_THRESHOLD)
+-SHADOW_FIELD_RW(GUEST_CS_LIMIT)
+-SHADOW_FIELD_RW(GUEST_CS_AR_BYTES)
+-SHADOW_FIELD_RW(GUEST_INTERRUPTIBILITY_INFO)
+-SHADOW_FIELD_RW(VMX_PREEMPTION_TIMER_VALUE)
+-
+-/* Natural width */
+-SHADOW_FIELD_RO(EXIT_QUALIFICATION)
+-SHADOW_FIELD_RO(GUEST_LINEAR_ADDRESS)
+-SHADOW_FIELD_RW(GUEST_RIP)
+-SHADOW_FIELD_RW(GUEST_RSP)
+-SHADOW_FIELD_RW(GUEST_CR0)
+-SHADOW_FIELD_RW(GUEST_CR3)
+-SHADOW_FIELD_RW(GUEST_CR4)
+-SHADOW_FIELD_RW(GUEST_RFLAGS)
+-SHADOW_FIELD_RW(GUEST_CS_BASE)
+-SHADOW_FIELD_RW(GUEST_ES_BASE)
+-SHADOW_FIELD_RW(CR0_GUEST_HOST_MASK)
+-SHADOW_FIELD_RW(CR0_READ_SHADOW)
+-SHADOW_FIELD_RW(CR4_READ_SHADOW)
+-SHADOW_FIELD_RW(HOST_FS_BASE)
+-SHADOW_FIELD_RW(HOST_GS_BASE)
+-
+-/* 64-bit */
+-SHADOW_FIELD_RO(GUEST_PHYSICAL_ADDRESS)
+-SHADOW_FIELD_RO(GUEST_PHYSICAL_ADDRESS_HIGH)
+-
+-#undef SHADOW_FIELD_RO
+-#undef SHADOW_FIELD_RW
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 8fe615df8e5b6..ff7ec9b507e33 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3637,12 +3637,11 @@ static void kvm_vcpu_ioctl_x86_get_debugregs(struct kvm_vcpu *vcpu,
+ {
+ unsigned long val;
+
++ memset(dbgregs, 0, sizeof(*dbgregs));
+ memcpy(dbgregs->db, vcpu->arch.db, sizeof(vcpu->arch.db));
+ kvm_get_dr(vcpu, 6, &val);
+ dbgregs->dr6 = val;
+ dbgregs->dr7 = vcpu->arch.dr7;
+- dbgregs->flags = 0;
+- memset(&dbgregs->reserved, 0, sizeof(dbgregs->reserved));
+ }
+
+ static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 6d110a1c090dd..4a7da8f744e03 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -3112,7 +3112,7 @@ int sata_down_spd_limit(struct ata_link *link, u32 spd_limit)
+ */
+ if (spd > 1)
+ mask &= (1 << (spd - 1)) - 1;
+- else
++ else if (link->sata_spd)
+ return -EINVAL;
+
+ /* were we already at the bottom? */
+diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
+index d3fb350dc9eea..bf4db708f0bd3 100644
+--- a/drivers/bus/sunxi-rsb.c
++++ b/drivers/bus/sunxi-rsb.c
+@@ -783,7 +783,13 @@ static int __init sunxi_rsb_init(void)
+ return ret;
+ }
+
+- return platform_driver_register(&sunxi_rsb_driver);
++ ret = platform_driver_register(&sunxi_rsb_driver);
++ if (ret) {
++ bus_unregister(&sunxi_rsb_bus);
++ return ret;
++ }
++
++ return 0;
+ }
+ module_init(sunxi_rsb_init);
+
+diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
+index bf03455b6fc20..0d628aa11be5c 100644
+--- a/drivers/firewire/core-cdev.c
++++ b/drivers/firewire/core-cdev.c
+@@ -831,8 +831,10 @@ static int ioctl_send_response(struct client *client, union ioctl_arg *arg)
+
+ r = container_of(resource, struct inbound_transaction_resource,
+ resource);
+- if (is_fcp_request(r->request))
++ if (is_fcp_request(r->request)) {
++ kfree(r->data);
+ goto out;
++ }
+
+ if (a->length != fw_get_response_length(r->request)) {
+ ret = -EINVAL;
+diff --git a/drivers/firmware/efi/memattr.c b/drivers/firmware/efi/memattr.c
+index e0889922cc6d7..a1ef30fca360d 100644
+--- a/drivers/firmware/efi/memattr.c
++++ b/drivers/firmware/efi/memattr.c
+@@ -35,7 +35,7 @@ int __init efi_memattr_init(void)
+ return -ENOMEM;
+ }
+
+- if (tbl->version > 1) {
++ if (tbl->version > 2) {
+ pr_warn("Unexpected EFI Memory Attributes table version %d\n",
+ tbl->version);
+ goto unmap;
+diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
+index e76ad020a5420..61ab462fd94cf 100644
+--- a/drivers/i2c/busses/i2c-rk3x.c
++++ b/drivers/i2c/busses/i2c-rk3x.c
+@@ -82,7 +82,7 @@ enum {
+ #define DEFAULT_SCL_RATE (100 * 1000) /* Hz */
+
+ /**
+- * struct i2c_spec_values:
++ * struct i2c_spec_values - I2C specification values for various modes
+ * @min_hold_start_ns: min hold time (repeated) START condition
+ * @min_low_ns: min LOW period of the SCL clock
+ * @min_high_ns: min HIGH period of the SCL cloc
+@@ -138,7 +138,7 @@ static const struct i2c_spec_values fast_mode_plus_spec = {
+ };
+
+ /**
+- * struct rk3x_i2c_calced_timings:
++ * struct rk3x_i2c_calced_timings - calculated V1 timings
+ * @div_low: Divider output for low
+ * @div_high: Divider output for high
+ * @tuning: Used to adjust setup/hold data time,
+@@ -161,7 +161,7 @@ enum rk3x_i2c_state {
+ };
+
+ /**
+- * struct rk3x_i2c_soc_data:
++ * struct rk3x_i2c_soc_data - SOC-specific data
+ * @grf_offset: offset inside the grf regmap for setting the i2c type
+ * @calc_timings: Callback function for i2c timing information calculated
+ */
+@@ -241,7 +241,8 @@ static inline void rk3x_i2c_clean_ipd(struct rk3x_i2c *i2c)
+ }
+
+ /**
+- * Generate a START condition, which triggers a REG_INT_START interrupt.
++ * rk3x_i2c_start - Generate a START condition, which triggers a REG_INT_START interrupt.
++ * @i2c: target controller data
+ */
+ static void rk3x_i2c_start(struct rk3x_i2c *i2c)
+ {
+@@ -260,8 +261,8 @@ static void rk3x_i2c_start(struct rk3x_i2c *i2c)
+ }
+
+ /**
+- * Generate a STOP condition, which triggers a REG_INT_STOP interrupt.
+- *
++ * rk3x_i2c_stop - Generate a STOP condition, which triggers a REG_INT_STOP interrupt.
++ * @i2c: target controller data
+ * @error: Error code to return in rk3x_i2c_xfer
+ */
+ static void rk3x_i2c_stop(struct rk3x_i2c *i2c, int error)
+@@ -300,7 +301,8 @@ static void rk3x_i2c_stop(struct rk3x_i2c *i2c, int error)
+ }
+
+ /**
+- * Setup a read according to i2c->msg
++ * rk3x_i2c_prepare_read - Setup a read according to i2c->msg
++ * @i2c: target controller data
+ */
+ static void rk3x_i2c_prepare_read(struct rk3x_i2c *i2c)
+ {
+@@ -331,7 +333,8 @@ static void rk3x_i2c_prepare_read(struct rk3x_i2c *i2c)
+ }
+
+ /**
+- * Fill the transmit buffer with data from i2c->msg
++ * rk3x_i2c_fill_transmit_buf - Fill the transmit buffer with data from i2c->msg
++ * @i2c: target controller data
+ */
+ static void rk3x_i2c_fill_transmit_buf(struct rk3x_i2c *i2c)
+ {
+@@ -534,11 +537,10 @@ out:
+ }
+
+ /**
+- * Get timing values of I2C specification
+- *
++ * rk3x_i2c_get_spec - Get timing values of I2C specification
+ * @speed: Desired SCL frequency
+ *
+- * Returns: Matched i2c spec values.
++ * Return: Matched i2c_spec_values.
+ */
+ static const struct i2c_spec_values *rk3x_i2c_get_spec(unsigned int speed)
+ {
+@@ -551,13 +553,12 @@ static const struct i2c_spec_values *rk3x_i2c_get_spec(unsigned int speed)
+ }
+
+ /**
+- * Calculate divider values for desired SCL frequency
+- *
++ * rk3x_i2c_v0_calc_timings - Calculate divider values for desired SCL frequency
+ * @clk_rate: I2C input clock rate
+ * @t: Known I2C timing information
+ * @t_calc: Caculated rk3x private timings that would be written into regs
+ *
+- * Returns: 0 on success, -EINVAL if the goal SCL rate is too slow. In that case
++ * Return: %0 on success, -%EINVAL if the goal SCL rate is too slow. In that case
+ * a best-effort divider value is returned in divs. If the target rate is
+ * too high, we silently use the highest possible rate.
+ */
+@@ -712,13 +713,12 @@ static int rk3x_i2c_v0_calc_timings(unsigned long clk_rate,
+ }
+
+ /**
+- * Calculate timing values for desired SCL frequency
+- *
++ * rk3x_i2c_v1_calc_timings - Calculate timing values for desired SCL frequency
+ * @clk_rate: I2C input clock rate
+ * @t: Known I2C timing information
+ * @t_calc: Caculated rk3x private timings that would be written into regs
+ *
+- * Returns: 0 on success, -EINVAL if the goal SCL rate is too slow. In that case
++ * Return: %0 on success, -%EINVAL if the goal SCL rate is too slow. In that case
+ * a best-effort divider value is returned in divs. If the target rate is
+ * too high, we silently use the highest possible rate.
+ * The following formulas are v1's method to calculate timings.
+@@ -962,14 +962,14 @@ static int rk3x_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long
+ }
+
+ /**
+- * Setup I2C registers for an I2C operation specified by msgs, num.
+- *
+- * Must be called with i2c->lock held.
+- *
++ * rk3x_i2c_setup - Setup I2C registers for an I2C operation specified by msgs, num.
++ * @i2c: target controller data
+ * @msgs: I2C msgs to process
+ * @num: Number of msgs
+ *
+- * returns: Number of I2C msgs processed or negative in case of error
++ * Must be called with i2c->lock held.
++ *
++ * Return: Number of I2C msgs processed or negative in case of error
+ */
+ static int rk3x_i2c_setup(struct rk3x_i2c *i2c, struct i2c_msg *msgs, int num)
+ {
+diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
+index 32d5438d45194..d8506a83ba085 100644
+--- a/drivers/iio/accel/hid-sensor-accel-3d.c
++++ b/drivers/iio/accel/hid-sensor-accel-3d.c
+@@ -292,6 +292,7 @@ static int accel_3d_capture_sample(struct hid_sensor_hub_device *hsdev,
+ hid_sensor_convert_timestamp(
+ &accel_state->common_attributes,
+ *(int64_t *)raw_data);
++ ret = 0;
+ break;
+ default:
+ break;
+diff --git a/drivers/iio/adc/berlin2-adc.c b/drivers/iio/adc/berlin2-adc.c
+index 72d8fa94ab31c..86fdfea329799 100644
+--- a/drivers/iio/adc/berlin2-adc.c
++++ b/drivers/iio/adc/berlin2-adc.c
+@@ -289,8 +289,10 @@ static int berlin2_adc_probe(struct platform_device *pdev)
+ int ret;
+
+ indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*priv));
+- if (!indio_dev)
++ if (!indio_dev) {
++ of_node_put(parent_np);
+ return -ENOMEM;
++ }
+
+ priv = iio_priv(indio_dev);
+ platform_set_drvdata(pdev, indio_dev);
+diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
+index 1c492a7f45875..bb90b22b809cc 100644
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -1099,6 +1099,7 @@ static const struct of_device_id stm32_dfsdm_adc_match[] = {
+ },
+ {}
+ };
++MODULE_DEVICE_TABLE(of, stm32_dfsdm_adc_match);
+
+ static int stm32_dfsdm_adc_probe(struct platform_device *pdev)
+ {
+diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c
+index 765aaee157e28..3007cfbf84918 100644
+--- a/drivers/iio/adc/twl6030-gpadc.c
++++ b/drivers/iio/adc/twl6030-gpadc.c
+@@ -71,6 +71,18 @@
+ #define TWL6030_GPADCS BIT(1)
+ #define TWL6030_GPADCR BIT(0)
+
++#define USB_VBUS_CTRL_SET 0x04
++#define USB_ID_CTRL_SET 0x06
++
++#define TWL6030_MISC1 0xE4
++#define VBUS_MEAS 0x01
++#define ID_MEAS 0x01
++
++#define VAC_MEAS 0x04
++#define VBAT_MEAS 0x02
++#define BB_MEAS 0x01
++
++
+ /**
+ * struct twl6030_chnl_calib - channel calibration
+ * @gain: slope coefficient for ideal curve
+@@ -943,6 +955,26 @@ static int twl6030_gpadc_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++ ret = twl_i2c_write_u8(TWL_MODULE_USB, VBUS_MEAS, USB_VBUS_CTRL_SET);
++ if (ret < 0) {
++ dev_err(dev, "failed to wire up inputs\n");
++ return ret;
++ }
++
++ ret = twl_i2c_write_u8(TWL_MODULE_USB, ID_MEAS, USB_ID_CTRL_SET);
++ if (ret < 0) {
++ dev_err(dev, "failed to wire up inputs\n");
++ return ret;
++ }
++
++ ret = twl_i2c_write_u8(TWL6030_MODULE_ID0,
++ VBAT_MEAS | BB_MEAS | VAC_MEAS,
++ TWL6030_MISC1);
++ if (ret < 0) {
++ dev_err(dev, "failed to wire up inputs\n");
++ return ret;
++ }
++
+ indio_dev->name = DRIVER_NAME;
+ indio_dev->dev.parent = dev;
+ indio_dev->info = &twl6030_gpadc_iio_info;
+diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
+index be31faf6cc620..071d39c614b21 100644
+--- a/drivers/infiniband/hw/hfi1/file_ops.c
++++ b/drivers/infiniband/hw/hfi1/file_ops.c
+@@ -1361,12 +1361,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg,
+ addr = arg + offsetof(struct hfi1_tid_info, tidcnt);
+ if (copy_to_user((void __user *)addr, &tinfo.tidcnt,
+ sizeof(tinfo.tidcnt)))
+- return -EFAULT;
++ ret = -EFAULT;
+
+ addr = arg + offsetof(struct hfi1_tid_info, length);
+- if (copy_to_user((void __user *)addr, &tinfo.length,
++ if (!ret && copy_to_user((void __user *)addr, &tinfo.length,
+ sizeof(tinfo.length)))
+ ret = -EFAULT;
++
++ if (ret)
++ hfi1_user_exp_rcv_invalid(fd, &tinfo);
+ }
+
+ return ret;
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index ee0b0a7237ad8..b2ab20c16cc77 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -71,25 +71,84 @@ static inline void i8042_write_command(int val)
+
+ #include <linux/dmi.h>
+
+-static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
++#define SERIO_QUIRK_NOKBD BIT(0)
++#define SERIO_QUIRK_NOAUX BIT(1)
++#define SERIO_QUIRK_NOMUX BIT(2)
++#define SERIO_QUIRK_FORCEMUX BIT(3)
++#define SERIO_QUIRK_UNLOCK BIT(4)
++#define SERIO_QUIRK_PROBE_DEFER BIT(5)
++#define SERIO_QUIRK_RESET_ALWAYS BIT(6)
++#define SERIO_QUIRK_RESET_NEVER BIT(7)
++#define SERIO_QUIRK_DIECT BIT(8)
++#define SERIO_QUIRK_DUMBKBD BIT(9)
++#define SERIO_QUIRK_NOLOOP BIT(10)
++#define SERIO_QUIRK_NOTIMEOUT BIT(11)
++#define SERIO_QUIRK_KBDRESET BIT(12)
++#define SERIO_QUIRK_DRITEK BIT(13)
++#define SERIO_QUIRK_NOPNP BIT(14)
++
++/* Quirk table for different mainboards. Options similar or identical to i8042
++ * module parameters.
++ * ORDERING IS IMPORTANT! The first match will be apllied and the rest ignored.
++ * This allows entries to overwrite vendor wide quirks on a per device basis.
++ * Where this is irrelevant, entries are sorted case sensitive by DMI_SYS_VENDOR
++ * and/or DMI_BOARD_VENDOR to make it easier to avoid dublicate entries.
++ */
++static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = {
+ {
+- /*
+- * Arima-Rioworks HDAMB -
+- * AUX LOOP command does not raise AUX IRQ
+- */
+ .matches = {
+- DMI_MATCH(DMI_BOARD_VENDOR, "RIOWORKS"),
+- DMI_MATCH(DMI_BOARD_NAME, "HDAMB"),
+- DMI_MATCH(DMI_BOARD_VERSION, "Rev E"),
++ DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* ASUS G1S */
+ .matches = {
+- DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer Inc."),
+- DMI_MATCH(DMI_BOARD_NAME, "G1S"),
+- DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X750LN"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
++ },
++ {
++ /* Asus X450LCP */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X450LCP"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_NEVER)
++ },
++ {
++ /* ASUS ZenBook UX425UA */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX425UA"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_PROBE_DEFER | SERIO_QUIRK_RESET_NEVER)
++ },
++ {
++ /* ASUS ZenBook UM325UA */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_PROBE_DEFER | SERIO_QUIRK_RESET_NEVER)
++ },
++ /*
++ * On some Asus laptops, just running self tests cause problems.
++ */
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_CHASSIS_TYPE, "10"), /* Notebook */
++ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_NEVER)
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
++ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_NEVER)
+ },
+ {
+ /* ASUS P65UP5 - AUX LOOP command does not raise AUX IRQ */
+@@ -98,585 +157,681 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "P/I-P65UP5"),
+ DMI_MATCH(DMI_BOARD_VERSION, "REV 2.X"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
++ /* ASUS G1S */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "X750LN"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer Inc."),
++ DMI_MATCH(DMI_BOARD_NAME, "G1S"),
++ DMI_MATCH(DMI_BOARD_VERSION, "1.0"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Compaq"),
+- DMI_MATCH(DMI_PRODUCT_NAME , "ProLiant"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "8500"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1360"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
++ /* Acer Aspire 5710 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Compaq"),
+- DMI_MATCH(DMI_PRODUCT_NAME , "ProLiant"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "DL760"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5710"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Dell Embedded Box PC 3000 */
++ /* Acer Aspire 7738 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Embedded Box PC 3000"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* OQO Model 01 */
++ /* Acer Aspire 5536 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "OQO"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "ZEPTO"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "00"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5536"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* ULI EV4873 - AUX LOOP does not work properly */
++ /*
++ * Acer Aspire 5738z
++ * Touchpad stops working in mux mode when dis- + re-enabled
++ * with the touchpad enable/disable toggle hotkey
++ */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "ULI"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "EV4873"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "5a"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Microsoft Virtual Machine */
++ /* Acer Aspire One 150 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Virtual Machine"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "VS2005R2"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "AOA150"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+- /* Medion MAM 2070 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "MAM 2070"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "5a"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A114-31"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+- /* Medion Akoya E7225 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Medion"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Akoya E7225"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A314-31"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+- /* Blue FB5601 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "blue"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "FB5601"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "M606"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A315-31"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+- /* Gigabyte M912 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "M912"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "01"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-132"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+- /* Gigabyte M1022M netbook */
+ .matches = {
+- DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co.,Ltd."),
+- DMI_MATCH(DMI_BOARD_NAME, "M1022E"),
+- DMI_MATCH(DMI_BOARD_VERSION, "1.02"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-332"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+- /* Gigabyte Spring Peak - defines wrong chassis type */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Spring Peak"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-432"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+- /* Gigabyte T1005 - defines wrong chassis type ("Other") */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "T1005"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate Spin B118-RN"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
++ /*
++ * Some Wistron based laptops need us to explicitly enable the 'Dritek
++ * keyboard extension' to make their extra keys start generating scancodes.
++ * Originally, this was just confined to older laptops, but a few Acer laptops
++ * have turned up in 2007 that also need this again.
++ */
+ {
+- /* Gigabyte T1005M/P - defines wrong chassis type ("Other") */
++ /* Acer Aspire 5100 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "T1005M/P"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5100"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_DRITEK)
+ },
+ {
++ /* Acer Aspire 5610 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "Rev 1"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5610"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_DRITEK)
+ },
+ {
++ /* Acer Aspire 5630 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "PEGATRON CORPORATION"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "C15B"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5630"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_DRITEK)
+ },
+ {
++ /* Acer Aspire 5650 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "ByteSpeed LLC"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "ByteSpeed Laptop C15B"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5650"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_DRITEK)
+ },
+- { }
+-};
+-
+-/*
+- * Some Fujitsu notebooks are having trouble with touchpads if
+- * active multiplexing mode is activated. Luckily they don't have
+- * external PS/2 ports so we can safely disable it.
+- * ... apparently some Toshibas don't like MUX mode either and
+- * die horrible death on reboot.
+- */
+-static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ {
+- /* Fujitsu Lifebook P7010/P7010D */
++ /* Acer Aspire 5680 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "P7010"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5680"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_DRITEK)
+ },
+ {
+- /* Fujitsu Lifebook P7010 */
++ /* Acer Aspire 5720 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "0000000000"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5720"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_DRITEK)
+ },
+ {
+- /* Fujitsu Lifebook P5020D */
++ /* Acer Aspire 9110 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook P Series"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 9110"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_DRITEK)
+ },
+ {
+- /* Fujitsu Lifebook S2000 */
++ /* Acer TravelMate 660 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S Series"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 660"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_DRITEK)
+ },
+ {
+- /* Fujitsu Lifebook S6230 */
++ /* Acer TravelMate 2490 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S6230"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 2490"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_DRITEK)
+ },
+ {
+- /* Fujitsu Lifebook T725 laptop */
++ /* Acer TravelMate 4280 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_DRITEK)
+ },
+ {
+- /* Fujitsu Lifebook U745 */
++ /* Amoi M636/A737 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U745"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Amoi Electronics CO.,LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "M636/A737 platform"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Fujitsu T70H */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "FMVLT70H"),
++ DMI_MATCH(DMI_SYS_VENDOR, "ByteSpeed LLC"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ByteSpeed Laptop C15B"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Fujitsu-Siemens Lifebook T3010 */
++ /* Compal HEL80I */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T3010"),
++ DMI_MATCH(DMI_SYS_VENDOR, "COMPAL"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HEL80I"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Fujitsu-Siemens Lifebook E4010 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E4010"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Compaq"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "8500"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Fujitsu-Siemens Amilo Pro 2010 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pro V2010"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Compaq"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "DL760"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Fujitsu-Siemens Amilo Pro 2030 */
++ /* Advent 4211 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "AMILO PRO V2030"),
++ DMI_MATCH(DMI_SYS_VENDOR, "DIXONSXP"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Advent 4211"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+- /*
+- * No data is coming from the touchscreen unless KBC
+- * is in legacy mode.
+- */
+- /* Panasonic CF-29 */
++ /* Dell Embedded Box PC 3000 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Matsushita"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "CF-29"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Embedded Box PC 3000"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /*
+- * HP Pavilion DV4017EA -
+- * errors on MUX ports are reported without raising AUXDATA
+- * causing "spurious NAK" messages.
+- */
++ /* Dell XPS M1530 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EA032EA#ABF)"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "XPS M1530"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /*
+- * HP Pavilion ZT1000 -
+- * like DV4017EA does not raise AUXERR for errors on MUX ports.
+- */
++ /* Dell Vostro 1510 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion Notebook PC"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "HP Pavilion Notebook ZT1000"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro1510"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /*
+- * HP Pavilion DV4270ca -
+- * like DV4017EA does not raise AUXERR for errors on MUX ports.
+- */
++ /* Dell Vostro V13 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EH476UA#ABL)"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_NOTIMEOUT)
+ },
+ {
++ /* Dell Vostro 1320 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P10"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1320"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
++ /* Dell Vostro 1520 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "EQUIUM A110"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1520"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
++ /* Dell Vostro 1720 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
++ },
++ {
++ /* Entroware Proteus */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Entroware"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Proteus"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS)
+ },
++ /*
++ * Some Fujitsu notebooks are having trouble with touchpads if
++ * active multiplexing mode is activated. Luckily they don't have
++ * external PS/2 ports so we can safely disable it.
++ * ... apparently some Toshibas don't like MUX mode either and
++ * die horrible death on reboot.
++ */
+ {
++ /* Fujitsu Lifebook P7010/P7010D */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P7010"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Sharp Actius MM20 */
++ /* Fujitsu Lifebook P5020D */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "SHARP"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "PC-MM20 Series"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook P Series"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Sony Vaio FS-115b */
++ /* Fujitsu Lifebook S2000 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FS115B"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S Series"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /*
+- * Sony Vaio FZ-240E -
+- * reset and GET ID commands issued via KBD port are
+- * sometimes being delivered to AUX3.
+- */
++ /* Fujitsu Lifebook S6230 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FZ240E"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S6230"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /*
+- * Most (all?) VAIOs do not have external PS/2 ports nor
+- * they implement active multiplexing properly, and
+- * MUX discovery usually messes up keyboard/touchpad.
+- */
++ /* Fujitsu Lifebook T725 laptop */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+- DMI_MATCH(DMI_BOARD_NAME, "VAIO"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_NOTIMEOUT)
+ },
+ {
+- /* Amoi M636/A737 */
++ /* Fujitsu Lifebook U745 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Amoi Electronics CO.,LTD."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "M636/A737 platform"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U745"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Lenovo 3000 n100 */
++ /* Fujitsu T70H */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "076804U"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "FMVLT70H"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Lenovo XiaoXin Air 12 */
++ /* Fujitsu A544 laptop */
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "80UN"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOTIMEOUT)
+ },
+ {
++ /* Fujitsu AH544 laptop */
++ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1360"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOTIMEOUT)
++ },
++ {
++ /* Fujitsu U574 laptop */
++ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOTIMEOUT)
++ },
++ {
++ /* Fujitsu UH554 laptop */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK UH544"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOTIMEOUT)
++ },
++ {
++ /* Fujitsu Lifebook P7010 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "0000000000"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
++ },
++ {
++ /* Fujitsu-Siemens Lifebook T3010 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T3010"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Acer Aspire 5710 */
++ /* Fujitsu-Siemens Lifebook E4010 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5710"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E4010"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Acer Aspire 7738 */
++ /* Fujitsu-Siemens Amilo Pro 2010 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pro V2010"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Gericom Bellagio */
++ /* Fujitsu-Siemens Amilo Pro 2030 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "N34AS6"),
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO PRO V2030"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* IBM 2656 */
++ /* Gigabyte M912 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "IBM"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "2656"),
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "M912"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "01"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Dell XPS M1530 */
++ /* Gigabyte Spring Peak - defines wrong chassis type */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "XPS M1530"),
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Spring Peak"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Compal HEL80I */
++ /* Gigabyte T1005 - defines wrong chassis type ("Other") */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "COMPAL"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "HEL80I"),
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "T1005"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Dell Vostro 1510 */
++ /* Gigabyte T1005M/P - defines wrong chassis type ("Other") */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Vostro1510"),
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "T1005M/P"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
++ /*
++ * Some laptops need keyboard reset before probing for the trackpad to get
++ * it detected, initialised & finally work.
++ */
+ {
+- /* Acer Aspire 5536 */
++ /* Gigabyte P35 v2 - Elantech touchpad */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5536"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_KBDRESET)
+ },
+- {
+- /* Dell Vostro V13 */
++ {
++ /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X3"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_KBDRESET)
+ },
+ {
+- /* Newer HP Pavilion dv4 models */
++ /* Gigabyte P34 - Elantech touchpad */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_KBDRESET)
+ },
+ {
+- /* Asus X450LCP */
++ /* Gigabyte P57 - Elantech touchpad */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "X450LCP"),
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P57"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_KBDRESET)
+ },
+ {
+- /* Avatar AVIU-145A6 */
++ /* Gericom Bellagio */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "N34AS6"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* TUXEDO BU1406 */
++ /* Gigabyte M1022M netbook */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co.,Ltd."),
++ DMI_MATCH(DMI_BOARD_NAME, "M1022E"),
++ DMI_MATCH(DMI_BOARD_VERSION, "1.02"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Lenovo LaVie Z */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo LaVie Z"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Rev 1"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+ /*
+- * Acer Aspire 5738z
+- * Touchpad stops working in mux mode when dis- + re-enabled
+- * with the touchpad enable/disable toggle hotkey
++ * HP Pavilion DV4017EA -
++ * errors on MUX ports are reported without raising AUXDATA
++ * causing "spurious NAK" messages.
+ */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EA032EA#ABF)"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Entroware Proteus */
++ /*
++ * HP Pavilion ZT1000 -
++ * like DV4017EA does not raise AUXERR for errors on MUX ports.
++ */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Entroware"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Proteus"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion Notebook PC"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "HP Pavilion Notebook ZT1000"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+- { }
+-};
+-
+-static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = {
+ {
+ /*
+- * Sony Vaio VGN-CS series require MUX or the touch sensor
+- * buttons will disturb touchpad operation
++ * HP Pavilion DV4270ca -
++ * like DV4017EA does not raise AUXERR for errors on MUX ports.
+ */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EH476UA#ABL)"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+- { }
+-};
+-
+-/*
+- * On some Asus laptops, just running self tests cause problems.
+- */
+-static const struct dmi_system_id i8042_dmi_noselftest_table[] = {
+ {
++ /* Newer HP Pavilion dv4 models */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+- DMI_MATCH(DMI_CHASSIS_TYPE, "10"), /* Notebook */
+- },
+- }, {
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+- DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_NOTIMEOUT)
+ },
+- { }
+-};
+-static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ {
+- /* MSI Wind U-100 */
++ /* IBM 2656 */
+ .matches = {
+- DMI_MATCH(DMI_BOARD_NAME, "U-100"),
+- DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
++ DMI_MATCH(DMI_SYS_VENDOR, "IBM"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "2656"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* LG Electronics X110 */
++ /* Avatar AVIU-145A6 */
+ .matches = {
+- DMI_MATCH(DMI_BOARD_NAME, "X110"),
+- DMI_MATCH(DMI_BOARD_VENDOR, "LG Electronics Inc."),
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Acer Aspire One 150 */
++ /* Intel MBO Desktop D845PESV */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "AOA150"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_BOARD_NAME, "D845PESV"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOPNP)
+ },
+ {
++ /*
++ * Intel NUC D54250WYK - does not have i8042 controller but
++ * declares PS/2 devices in DSDT.
++ */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A114-31"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_BOARD_NAME, "D54250WYK"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOPNP)
+ },
+ {
++ /* Lenovo 3000 n100 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A314-31"),
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "076804U"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
++ /* Lenovo XiaoXin Air 12 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A315-31"),
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "80UN"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
++ /* Lenovo LaVie Z */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-132"),
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo LaVie Z"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
++ /* Lenovo Ideapad U455 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-332"),
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "20046"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
++ /* Lenovo ThinkPad L460 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-432"),
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L460"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
++ /* Lenovo ThinkPad Twist S230u */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate Spin B118-RN"),
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+- /* Advent 4211 */
++ /* LG Electronics X110 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "DIXONSXP"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Advent 4211"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "LG Electronics Inc."),
++ DMI_MATCH(DMI_BOARD_NAME, "X110"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+ /* Medion Akoya Mini E1210 */
+@@ -684,6 +839,7 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "E1210"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+ /* Medion Akoya E1222 */
+@@ -691,48 +847,62 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "E122X"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
+ {
+- /* Mivvy M310 */
++ /* MSI Wind U-100 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "VIOOO"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "N10"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
++ DMI_MATCH(DMI_BOARD_NAME, "U-100"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Dell Vostro 1320 */
++ /*
++ * No data is coming from the touchscreen unless KBC
++ * is in legacy mode.
++ */
++ /* Panasonic CF-29 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1320"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Matsushita"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "CF-29"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Dell Vostro 1520 */
++ /* Medion Akoya E7225 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1520"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Medion"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Akoya E7225"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Dell Vostro 1720 */
++ /* Microsoft Virtual Machine */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Virtual Machine"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "VS2005R2"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Lenovo Ideapad U455 */
++ /* Medion MAM 2070 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "20046"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "MAM 2070"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "5a"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Lenovo ThinkPad L460 */
++ /* TUXEDO BU1406 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L460"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+ /* Clevo P650RS, 650RP6, Sager NP8152-S, and others */
+@@ -740,282 +910,318 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
++ },
++ {
++ /* OQO Model 01 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "OQO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ZEPTO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "00"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Lenovo ThinkPad Twist S230u */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
++ DMI_MATCH(DMI_SYS_VENDOR, "PEGATRON CORPORATION"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "C15B"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* Entroware Proteus */
++ /* Acer Aspire 5 A515 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Entroware"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Proteus"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "PK"),
++ DMI_MATCH(DMI_BOARD_NAME, "Grumpy_PK"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOPNP)
+ },
+- { }
+-};
+-
+-#ifdef CONFIG_PNP
+-static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = {
+ {
+- /* Intel MBO Desktop D845PESV */
++ /* ULI EV4873 - AUX LOOP does not work properly */
+ .matches = {
+- DMI_MATCH(DMI_BOARD_NAME, "D845PESV"),
+- DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_SYS_VENDOR, "ULI"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "EV4873"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "5a"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+ /*
+- * Intel NUC D54250WYK - does not have i8042 controller but
+- * declares PS/2 devices in DSDT.
++ * Arima-Rioworks HDAMB -
++ * AUX LOOP command does not raise AUX IRQ
+ */
+ .matches = {
+- DMI_MATCH(DMI_BOARD_NAME, "D54250WYK"),
+- DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "RIOWORKS"),
++ DMI_MATCH(DMI_BOARD_NAME, "HDAMB"),
++ DMI_MATCH(DMI_BOARD_VERSION, "Rev E"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+ {
+- /* MSI Wind U-100 */
++ /* Sharp Actius MM20 */
+ .matches = {
+- DMI_MATCH(DMI_BOARD_NAME, "U-100"),
+- DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
++ DMI_MATCH(DMI_SYS_VENDOR, "SHARP"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "PC-MM20 Series"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Acer Aspire 5 A515 */
++ /*
++ * Sony Vaio FZ-240E -
++ * reset and GET ID commands issued via KBD port are
++ * sometimes being delivered to AUX3.
++ */
+ .matches = {
+- DMI_MATCH(DMI_BOARD_NAME, "Grumpy_PK"),
+- DMI_MATCH(DMI_BOARD_VENDOR, "PK"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FZ240E"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+- { }
+-};
+-
+-static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
+ {
++ /*
++ * Most (all?) VAIOs do not have external PS/2 ports nor
++ * they implement active multiplexing properly, and
++ * MUX discovery usually messes up keyboard/touchpad.
++ */
+ .matches = {
+- DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
++ DMI_MATCH(DMI_BOARD_NAME, "VAIO"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
++ /* Sony Vaio FS-115b */
+ .matches = {
+- DMI_MATCH(DMI_CHASSIS_TYPE, "9"), /* Laptop */
++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FS115B"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
++ /*
++ * Sony Vaio VGN-CS series require MUX or the touch sensor
++ * buttons will disturb touchpad operation
++ */
+ .matches = {
+- DMI_MATCH(DMI_CHASSIS_TYPE, "10"), /* Notebook */
++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_FORCEMUX)
+ },
+ {
+ .matches = {
+- DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P10"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+- { }
+-};
+-#endif
+-
+-static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
+ {
+- /* Dell Vostro V13 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "EQUIUM A110"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
+ {
+- /* Newer HP Pavilion dv4 models */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
++ /*
++ * A lot of modern Clevo barebones have touchpad and/or keyboard issues
++ * after suspend fixable with nomux + reset + noloop + nopnp. Luckily,
++ * none of them have an external PS/2 port so this can safely be set for
++ * all of them. These two are based on a Clevo design, but have the
++ * board_name changed.
++ */
+ {
+- /* Fujitsu A544 laptop */
+- /* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "AURA1501"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Fujitsu AH544 laptop */
+- /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "TUXEDO"),
++ DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Fujitsu Lifebook T725 laptop */
++ /* Mivvy M310 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"),
++ DMI_MATCH(DMI_SYS_VENDOR, "VIOOO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "N10"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS)
+ },
++ /*
++ * Some laptops need keyboard reset before probing for the trackpad to get
++ * it detected, initialised & finally work.
++ */
+ {
+- /* Fujitsu U574 laptop */
+- /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
++ /* Schenker XMG C504 - Elantech touchpad */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"),
++ DMI_MATCH(DMI_SYS_VENDOR, "XMG"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "C504"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_KBDRESET)
+ },
+ {
+- /* Fujitsu UH554 laptop */
++ /* Blue FB5601 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK UH544"),
++ DMI_MATCH(DMI_SYS_VENDOR, "blue"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "FB5601"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "M606"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOLOOP)
+ },
+- { }
+-};
+-
+-/*
+- * Some Wistron based laptops need us to explicitly enable the 'Dritek
+- * keyboard extension' to make their extra keys start generating scancodes.
+- * Originally, this was just confined to older laptops, but a few Acer laptops
+- * have turned up in 2007 that also need this again.
+- */
+-static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = {
++ /*
++ * A lot of modern Clevo barebones have touchpad and/or keyboard issues
++ * after suspend fixable with nomux + reset + noloop + nopnp. Luckily,
++ * none of them have an external PS/2 port so this can safely be set for
++ * all of them.
++ * Clevo barebones come with board_vendor and/or system_vendor set to
++ * either the very generic string "Notebook" and/or a different value
++ * for each individual reseller. The only somewhat universal way to
++ * identify them is by board_name.
++ */
+ {
+- /* Acer Aspire 5100 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5100"),
++ DMI_MATCH(DMI_BOARD_NAME, "LAPQC71A"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Acer Aspire 5610 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5610"),
++ DMI_MATCH(DMI_BOARD_NAME, "LAPQC71B"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Acer Aspire 5630 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5630"),
++ DMI_MATCH(DMI_BOARD_NAME, "N140CU"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Acer Aspire 5650 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5650"),
++ DMI_MATCH(DMI_BOARD_NAME, "N141CU"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Acer Aspire 5680 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5680"),
++ DMI_MATCH(DMI_BOARD_NAME, "NH5xAx"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Acer Aspire 5720 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5720"),
++ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
++ /*
++ * At least one modern Clevo barebone has the touchpad connected both
++ * via PS/2 and i2c interface. This causes a race condition between the
++ * psmouse and i2c-hid driver. Since the full capability of the touchpad
++ * is available via the i2c interface and the device has no external
++ * PS/2 port, it is safe to just ignore all ps2 mouses here to avoid
++ * this issue. The known affected device is the
++ * TUXEDO InfinityBook S17 Gen6 / Clevo NS70MU which comes with one of
++ * the two different dmi strings below. NS50MU is not a typo!
++ */
+ {
+- /* Acer Aspire 9110 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 9110"),
++ DMI_MATCH(DMI_BOARD_NAME, "NS50MU"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOAUX | SERIO_QUIRK_NOMUX |
++ SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP |
++ SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Acer TravelMate 660 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 660"),
++ DMI_MATCH(DMI_BOARD_NAME, "NS50_70MU"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOAUX | SERIO_QUIRK_NOMUX |
++ SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP |
++ SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Acer TravelMate 2490 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 2490"),
++ DMI_MATCH(DMI_BOARD_NAME, "NJ50_70CU"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Acer TravelMate 4280 */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"),
++ DMI_MATCH(DMI_BOARD_NAME, "PB50_70DFx,DDx"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+- { }
+-};
+-
+-/*
+- * Some laptops need keyboard reset before probing for the trackpad to get
+- * it detected, initialised & finally work.
+- */
+-static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
+ {
+- /* Gigabyte P35 v2 - Elantech touchpad */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"),
++ DMI_MATCH(DMI_BOARD_NAME, "PCX0DX"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+- {
+- /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */
++ {
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "X3"),
++ DMI_MATCH(DMI_BOARD_NAME, "X170SM"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
+ {
+- /* Gigabyte P34 - Elantech touchpad */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
++ DMI_MATCH(DMI_BOARD_NAME, "X170KM-G"),
+ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
++ { }
++};
++
++#ifdef CONFIG_PNP
++static const struct dmi_system_id i8042_dmi_laptop_table[] __initconst = {
+ {
+- /* Gigabyte P57 - Elantech touchpad */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "P57"),
++ DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
+ },
+ },
+ {
+- /* Schenker XMG C504 - Elantech touchpad */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "XMG"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "C504"),
++ DMI_MATCH(DMI_CHASSIS_TYPE, "9"), /* Laptop */
+ },
+ },
+- { }
+-};
+-
+-static const struct dmi_system_id i8042_dmi_probe_defer_table[] __initconst = {
+ {
+- /* ASUS ZenBook UX425UA */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX425UA"),
++ DMI_MATCH(DMI_CHASSIS_TYPE, "10"), /* Notebook */
+ },
+ },
+ {
+- /* ASUS ZenBook UM325UA */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+- DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"),
++ DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
+ },
+ },
+ { }
+ };
++#endif
+
+ #endif /* CONFIG_X86 */
+
+@@ -1170,11 +1376,6 @@ static int __init i8042_pnp_init(void)
+ bool pnp_data_busted = false;
+ int err;
+
+-#ifdef CONFIG_X86
+- if (dmi_check_system(i8042_dmi_nopnp_table))
+- i8042_nopnp = true;
+-#endif
+-
+ if (i8042_nopnp) {
+ pr_info("PNP detection disabled\n");
+ return 0;
+@@ -1278,6 +1479,59 @@ static inline int i8042_pnp_init(void) { return 0; }
+ static inline void i8042_pnp_exit(void) { }
+ #endif /* CONFIG_PNP */
+
++
++#ifdef CONFIG_X86
++static void __init i8042_check_quirks(void)
++{
++ const struct dmi_system_id *device_quirk_info;
++ uintptr_t quirks;
++
++ device_quirk_info = dmi_first_match(i8042_dmi_quirk_table);
++ if (!device_quirk_info)
++ return;
++
++ quirks = (uintptr_t)device_quirk_info->driver_data;
++
++ if (quirks & SERIO_QUIRK_NOKBD)
++ i8042_nokbd = true;
++ if (quirks & SERIO_QUIRK_NOAUX)
++ i8042_noaux = true;
++ if (quirks & SERIO_QUIRK_NOMUX)
++ i8042_nomux = true;
++ if (quirks & SERIO_QUIRK_FORCEMUX)
++ i8042_nomux = false;
++ if (quirks & SERIO_QUIRK_UNLOCK)
++ i8042_unlock = true;
++ if (quirks & SERIO_QUIRK_PROBE_DEFER)
++ i8042_probe_defer = true;
++ /* Honor module parameter when value is not default */
++ if (i8042_reset == I8042_RESET_DEFAULT) {
++ if (quirks & SERIO_QUIRK_RESET_ALWAYS)
++ i8042_reset = I8042_RESET_ALWAYS;
++ if (quirks & SERIO_QUIRK_RESET_NEVER)
++ i8042_reset = I8042_RESET_NEVER;
++ }
++ if (quirks & SERIO_QUIRK_DIECT)
++ i8042_direct = true;
++ if (quirks & SERIO_QUIRK_DUMBKBD)
++ i8042_dumbkbd = true;
++ if (quirks & SERIO_QUIRK_NOLOOP)
++ i8042_noloop = true;
++ if (quirks & SERIO_QUIRK_NOTIMEOUT)
++ i8042_notimeout = true;
++ if (quirks & SERIO_QUIRK_KBDRESET)
++ i8042_kbdreset = true;
++ if (quirks & SERIO_QUIRK_DRITEK)
++ i8042_dritek = true;
++#ifdef CONFIG_PNP
++ if (quirks & SERIO_QUIRK_NOPNP)
++ i8042_nopnp = true;
++#endif
++}
++#else
++static inline void i8042_check_quirks(void) {}
++#endif
++
+ static int __init i8042_platform_init(void)
+ {
+ int retval;
+@@ -1300,45 +1554,17 @@ static int __init i8042_platform_init(void)
+ i8042_kbd_irq = I8042_MAP_IRQ(1);
+ i8042_aux_irq = I8042_MAP_IRQ(12);
+
+- retval = i8042_pnp_init();
+- if (retval)
+- return retval;
+-
+ #if defined(__ia64__)
+- i8042_reset = I8042_RESET_ALWAYS;
++ i8042_reset = I8042_RESET_ALWAYS;
+ #endif
+
+-#ifdef CONFIG_X86
+- /* Honor module parameter when value is not default */
+- if (i8042_reset == I8042_RESET_DEFAULT) {
+- if (dmi_check_system(i8042_dmi_reset_table))
+- i8042_reset = I8042_RESET_ALWAYS;
+-
+- if (dmi_check_system(i8042_dmi_noselftest_table))
+- i8042_reset = I8042_RESET_NEVER;
+- }
+-
+- if (dmi_check_system(i8042_dmi_noloop_table))
+- i8042_noloop = true;
+-
+- if (dmi_check_system(i8042_dmi_nomux_table))
+- i8042_nomux = true;
+-
+- if (dmi_check_system(i8042_dmi_forcemux_table))
+- i8042_nomux = false;
+-
+- if (dmi_check_system(i8042_dmi_notimeout_table))
+- i8042_notimeout = true;
+-
+- if (dmi_check_system(i8042_dmi_dritek_table))
+- i8042_dritek = true;
+-
+- if (dmi_check_system(i8042_dmi_kbdreset_table))
+- i8042_kbdreset = true;
++ i8042_check_quirks();
+
+- if (dmi_check_system(i8042_dmi_probe_defer_table))
+- i8042_probe_defer = true;
++ retval = i8042_pnp_init();
++ if (retval)
++ return retval;
+
++#ifdef CONFIG_X86
+ /*
+ * A20 was already enabled during early kernel init. But some buggy
+ * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
+diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
+index 8aebdc4ff623a..dd73e8e83c726 100644
+--- a/drivers/mmc/core/sdio_bus.c
++++ b/drivers/mmc/core/sdio_bus.c
+@@ -267,6 +267,12 @@ static void sdio_release_func(struct device *dev)
+ if (!(func->card->quirks & MMC_QUIRK_NONSTD_SDIO))
+ sdio_free_func_cis(func);
+
++ /*
++ * We have now removed the link to the tuples in the
++ * card structure, so remove the reference.
++ */
++ put_device(&func->card->dev);
++
+ kfree(func->info);
+ kfree(func->tmpbuf);
+ kfree(func);
+@@ -297,6 +303,12 @@ struct sdio_func *sdio_alloc_func(struct mmc_card *card)
+
+ device_initialize(&func->dev);
+
++ /*
++ * We may link to tuples in the card structure,
++ * we need make sure we have a reference to it.
++ */
++ get_device(&func->card->dev);
++
+ func->dev.parent = &card->dev;
+ func->dev.bus = &sdio_bus_type;
+ func->dev.release = sdio_release_func;
+@@ -350,10 +362,9 @@ int sdio_add_func(struct sdio_func *func)
+ */
+ void sdio_remove_func(struct sdio_func *func)
+ {
+- if (!sdio_func_present(func))
+- return;
++ if (sdio_func_present(func))
++ device_del(&func->dev);
+
+- device_del(&func->dev);
+ of_node_put(func->dev.of_node);
+ put_device(&func->dev);
+ }
+diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
+index dca72444b3122..f741eb24c3de8 100644
+--- a/drivers/mmc/core/sdio_cis.c
++++ b/drivers/mmc/core/sdio_cis.c
+@@ -387,12 +387,6 @@ int sdio_read_func_cis(struct sdio_func *func)
+ if (ret)
+ return ret;
+
+- /*
+- * Since we've linked to tuples in the card structure,
+- * we must make sure we have a reference to it.
+- */
+- get_device(&func->card->dev);
+-
+ /*
+ * Vendor/device id is optional for function CIS, so
+ * copy it from the card structure as needed.
+@@ -418,11 +412,5 @@ void sdio_free_func_cis(struct sdio_func *func)
+ }
+
+ func->tuples = NULL;
+-
+- /*
+- * We have now removed the link to the tuples in the
+- * card structure, so remove the reference.
+- */
+- put_device(&func->card->dev);
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/bgmac-bcma.c b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+index 77de92eb08b21..b880c0b964beb 100644
+--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+@@ -228,12 +228,12 @@ static int bgmac_probe(struct bcma_device *core)
+ bgmac->feature_flags |= BGMAC_FEAT_CLKCTLST;
+ bgmac->feature_flags |= BGMAC_FEAT_FLW_CTRL1;
+ bgmac->feature_flags |= BGMAC_FEAT_SW_TYPE_PHY;
+- if (ci->pkg == BCMA_PKG_ID_BCM47188 ||
+- ci->pkg == BCMA_PKG_ID_BCM47186) {
++ if ((ci->id == BCMA_CHIP_ID_BCM5357 && ci->pkg == BCMA_PKG_ID_BCM47186) ||
++ (ci->id == BCMA_CHIP_ID_BCM53572 && ci->pkg == BCMA_PKG_ID_BCM47188)) {
+ bgmac->feature_flags |= BGMAC_FEAT_SW_TYPE_RGMII;
+ bgmac->feature_flags |= BGMAC_FEAT_IOST_ATTACHED;
+ }
+- if (ci->pkg == BCMA_PKG_ID_BCM5358)
++ if (ci->id == BCMA_CHIP_ID_BCM5357 && ci->pkg == BCMA_PKG_ID_BCM5358)
+ bgmac->feature_flags |= BGMAC_FEAT_SW_TYPE_EPHYRMII;
+ break;
+ case BCMA_CHIP_ID_BCM53573:
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index dc106212259a5..d79281c6d915d 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -6118,10 +6118,14 @@ int bnxt_reserve_rings(struct bnxt *bp)
+ netdev_err(bp->dev, "ring reservation/IRQ init failure rc: %d\n", rc);
+ return rc;
+ }
+- if (tcs && (bp->tx_nr_rings_per_tc * tcs != bp->tx_nr_rings)) {
++ if (tcs && (bp->tx_nr_rings_per_tc * tcs !=
++ bp->tx_nr_rings - bp->tx_nr_rings_xdp)) {
+ netdev_err(bp->dev, "tx ring reservation failure\n");
+ netdev_reset_tc(bp->dev);
+- bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
++ if (bp->tx_nr_rings_xdp)
++ bp->tx_nr_rings_per_tc = bp->tx_nr_rings_xdp;
++ else
++ bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
+ return -ENOMEM;
+ }
+ bp->num_stat_ctxs = bp->cp_nr_rings;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 8a5baaf403ae8..795f8fe2570e4 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -2671,7 +2671,7 @@ static int i40e_change_mtu(struct net_device *netdev, int new_mtu)
+ struct i40e_pf *pf = vsi->back;
+
+ if (i40e_enabled_xdp_vsi(vsi)) {
+- int frame_size = new_mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN;
++ int frame_size = new_mtu + I40E_PACKET_HDR_PAD;
+
+ if (frame_size > i40e_max_xdp_frame_size(vsi))
+ return -EINVAL;
+@@ -11834,6 +11834,8 @@ static int i40e_ndo_bridge_setlink(struct net_device *dev,
+ }
+
+ br_spec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC);
++ if (!br_spec)
++ return -EINVAL;
+
+ nla_for_each_nested(attr, br_spec, rem) {
+ __u16 mode;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
+index e436fa160c7d6..59165c0560d74 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
+@@ -520,9 +520,9 @@ int dwmac5_flex_pps_config(void __iomem *ioaddr, int index,
+ return 0;
+ }
+
+- val |= PPSCMDx(index, 0x2);
+ val |= TRGTMODSELx(index, 0x2);
+ val |= PPSEN0;
++ writel(val, ioaddr + MAC_PPS_CONTROL);
+
+ writel(cfg->start.tv_sec, ioaddr + MAC_PPSx_TARGET_TIME_SEC(index));
+
+@@ -547,6 +547,7 @@ int dwmac5_flex_pps_config(void __iomem *ioaddr, int index,
+ writel(period - 1, ioaddr + MAC_PPSx_WIDTH(index));
+
+ /* Finally, activate it */
++ val |= PPSCMDx(index, 0x2);
+ writel(val, ioaddr + MAC_PPS_CONTROL);
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+index 9e040eb629ed2..f57761a03622b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -518,7 +518,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
+ dma_cfg->mixed_burst = of_property_read_bool(np, "snps,mixed-burst");
+
+ plat->force_thresh_dma_mode = of_property_read_bool(np, "snps,force_thresh_dma_mode");
+- if (plat->force_thresh_dma_mode) {
++ if (plat->force_thresh_dma_mode && plat->force_sf_dma_mode) {
+ plat->force_sf_dma_mode = 0;
+ pr_warn("force_sf_dma_mode is ignored if force_thresh_dma_mode is set.");
+ }
+diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c
+index 7ceebbc4bcc21..75546829b86be 100644
+--- a/drivers/net/phy/meson-gxl.c
++++ b/drivers/net/phy/meson-gxl.c
+@@ -246,11 +246,26 @@ static struct phy_driver meson_gxl_phy[] = {
+ .config_intr = meson_gxl_config_intr,
+ .suspend = genphy_suspend,
+ .resume = genphy_resume,
++ .read_mmd = genphy_read_mmd_unsupported,
++ .write_mmd = genphy_write_mmd_unsupported,
++ }, {
++ PHY_ID_MATCH_EXACT(0x01803301),
++ .name = "Meson G12A Internal PHY",
++ .features = PHY_BASIC_FEATURES,
++ .flags = PHY_IS_INTERNAL,
++ .soft_reset = genphy_soft_reset,
++ .ack_interrupt = meson_gxl_ack_interrupt,
++ .config_intr = meson_gxl_config_intr,
++ .suspend = genphy_suspend,
++ .resume = genphy_resume,
++ .read_mmd = genphy_read_mmd_unsupported,
++ .write_mmd = genphy_write_mmd_unsupported,
+ },
+ };
+
+ static struct mdio_device_id __maybe_unused meson_gxl_tbl[] = {
+ { 0x01814400, 0xfffffff0 },
++ { PHY_ID_MATCH_VENDOR(0x01803301) },
+ { }
+ };
+
+diff --git a/drivers/net/usb/kalmia.c b/drivers/net/usb/kalmia.c
+index 0cc6993c279a2..93ee909c79395 100644
+--- a/drivers/net/usb/kalmia.c
++++ b/drivers/net/usb/kalmia.c
+@@ -69,8 +69,8 @@ kalmia_send_init_packet(struct usbnet *dev, u8 *init_msg, u8 init_msg_len,
+ init_msg, init_msg_len, &act_len, KALMIA_USB_TIMEOUT);
+ if (status != 0) {
+ netdev_err(dev->net,
+- "Error sending init packet. Status %i, length %i\n",
+- status, act_len);
++ "Error sending init packet. Status %i\n",
++ status);
+ return status;
+ }
+ else if (act_len != init_msg_len) {
+@@ -87,8 +87,8 @@ kalmia_send_init_packet(struct usbnet *dev, u8 *init_msg, u8 init_msg_len,
+
+ if (status != 0)
+ netdev_err(dev->net,
+- "Error receiving init result. Status %i, length %i\n",
+- status, act_len);
++ "Error receiving init result. Status %i\n",
++ status);
+ else if (act_len != expected_len)
+ netdev_err(dev->net, "Unexpected init result length: %i\n",
+ act_len);
+diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c
+index 6fe59373cba9b..8bab7306e5a68 100644
+--- a/drivers/net/usb/plusb.c
++++ b/drivers/net/usb/plusb.c
+@@ -69,9 +69,7 @@
+ static inline int
+ pl_vendor_req(struct usbnet *dev, u8 req, u8 val, u8 index)
+ {
+- return usbnet_read_cmd(dev, req,
+- USB_DIR_IN | USB_TYPE_VENDOR |
+- USB_RECIP_DEVICE,
++ return usbnet_write_cmd(dev, req, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ val, index, NULL, 0);
+ }
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 77e4d184bc995..68d128b895abd 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -1325,8 +1325,10 @@ nvmet_fc_ls_create_association(struct nvmet_fc_tgtport *tgtport,
+ else {
+ queue = nvmet_fc_alloc_target_queue(iod->assoc, 0,
+ be16_to_cpu(rqst->assoc_cmd.sqsize));
+- if (!queue)
++ if (!queue) {
+ ret = VERR_QUEUE_ALLOC_FAIL;
++ nvmet_fc_tgt_a_put(iod->assoc);
++ }
+ }
+ }
+
+diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed.c b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
+index 8dec302dc067a..a95289b5e6bf2 100644
+--- a/drivers/pinctrl/aspeed/pinctrl-aspeed.c
++++ b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
+@@ -295,7 +295,7 @@ static int aspeed_disable_sig(const struct aspeed_sig_expr **exprs,
+ int ret = 0;
+
+ if (!exprs)
+- return true;
++ return -EINVAL;
+
+ while (*exprs && !ret) {
+ ret = aspeed_sig_expr_disable(*exprs, maps);
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
+index f9eb37bb39051..b786d9797f404 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.c
++++ b/drivers/pinctrl/intel/pinctrl-intel.c
+@@ -116,7 +116,7 @@ struct intel_pinctrl {
+ #define padgroup_offset(g, p) ((p) - (g)->base)
+
+ static struct intel_community *intel_get_community(struct intel_pinctrl *pctrl,
+- unsigned pin)
++ unsigned int pin)
+ {
+ struct intel_community *community;
+ int i;
+@@ -134,7 +134,7 @@ static struct intel_community *intel_get_community(struct intel_pinctrl *pctrl,
+
+ static const struct intel_padgroup *
+ intel_community_get_padgroup(const struct intel_community *community,
+- unsigned pin)
++ unsigned int pin)
+ {
+ int i;
+
+@@ -148,11 +148,11 @@ intel_community_get_padgroup(const struct intel_community *community,
+ return NULL;
+ }
+
+-static void __iomem *intel_get_padcfg(struct intel_pinctrl *pctrl, unsigned pin,
+- unsigned reg)
++static void __iomem *intel_get_padcfg(struct intel_pinctrl *pctrl,
++ unsigned int pin, unsigned int reg)
+ {
+ const struct intel_community *community;
+- unsigned padno;
++ unsigned int padno;
+ size_t nregs;
+
+ community = intel_get_community(pctrl, pin);
+@@ -168,11 +168,11 @@ static void __iomem *intel_get_padcfg(struct intel_pinctrl *pctrl, unsigned pin,
+ return community->pad_regs + reg + padno * nregs * 4;
+ }
+
+-static bool intel_pad_owned_by_host(struct intel_pinctrl *pctrl, unsigned pin)
++static bool intel_pad_owned_by_host(struct intel_pinctrl *pctrl, unsigned int pin)
+ {
+ const struct intel_community *community;
+ const struct intel_padgroup *padgrp;
+- unsigned gpp, offset, gpp_offset;
++ unsigned int gpp, offset, gpp_offset;
+ void __iomem *padown;
+
+ community = intel_get_community(pctrl, pin);
+@@ -193,11 +193,11 @@ static bool intel_pad_owned_by_host(struct intel_pinctrl *pctrl, unsigned pin)
+ return !(readl(padown) & PADOWN_MASK(gpp_offset));
+ }
+
+-static bool intel_pad_acpi_mode(struct intel_pinctrl *pctrl, unsigned pin)
++static bool intel_pad_acpi_mode(struct intel_pinctrl *pctrl, unsigned int pin)
+ {
+ const struct intel_community *community;
+ const struct intel_padgroup *padgrp;
+- unsigned offset, gpp_offset;
++ unsigned int offset, gpp_offset;
+ void __iomem *hostown;
+
+ community = intel_get_community(pctrl, pin);
+@@ -217,11 +217,11 @@ static bool intel_pad_acpi_mode(struct intel_pinctrl *pctrl, unsigned pin)
+ return !(readl(hostown) & BIT(gpp_offset));
+ }
+
+-static bool intel_pad_locked(struct intel_pinctrl *pctrl, unsigned pin)
++static bool intel_pad_locked(struct intel_pinctrl *pctrl, unsigned int pin)
+ {
+ struct intel_community *community;
+ const struct intel_padgroup *padgrp;
+- unsigned offset, gpp_offset;
++ unsigned int offset, gpp_offset;
+ u32 value;
+
+ community = intel_get_community(pctrl, pin);
+@@ -254,7 +254,7 @@ static bool intel_pad_locked(struct intel_pinctrl *pctrl, unsigned pin)
+ return false;
+ }
+
+-static bool intel_pad_usable(struct intel_pinctrl *pctrl, unsigned pin)
++static bool intel_pad_usable(struct intel_pinctrl *pctrl, unsigned int pin)
+ {
+ return intel_pad_owned_by_host(pctrl, pin) &&
+ !intel_pad_locked(pctrl, pin);
+@@ -268,15 +268,15 @@ static int intel_get_groups_count(struct pinctrl_dev *pctldev)
+ }
+
+ static const char *intel_get_group_name(struct pinctrl_dev *pctldev,
+- unsigned group)
++ unsigned int group)
+ {
+ struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+
+ return pctrl->soc->groups[group].name;
+ }
+
+-static int intel_get_group_pins(struct pinctrl_dev *pctldev, unsigned group,
+- const unsigned **pins, unsigned *npins)
++static int intel_get_group_pins(struct pinctrl_dev *pctldev, unsigned int group,
++ const unsigned int **pins, unsigned int *npins)
+ {
+ struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+
+@@ -286,7 +286,7 @@ static int intel_get_group_pins(struct pinctrl_dev *pctldev, unsigned group,
+ }
+
+ static void intel_pin_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s,
+- unsigned pin)
++ unsigned int pin)
+ {
+ struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+ void __iomem *padcfg;
+@@ -345,7 +345,7 @@ static int intel_get_functions_count(struct pinctrl_dev *pctldev)
+ }
+
+ static const char *intel_get_function_name(struct pinctrl_dev *pctldev,
+- unsigned function)
++ unsigned int function)
+ {
+ struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+
+@@ -353,9 +353,9 @@ static const char *intel_get_function_name(struct pinctrl_dev *pctldev,
+ }
+
+ static int intel_get_function_groups(struct pinctrl_dev *pctldev,
+- unsigned function,
++ unsigned int function,
+ const char * const **groups,
+- unsigned * const ngroups)
++ unsigned int * const ngroups)
+ {
+ struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+
+@@ -364,8 +364,8 @@ static int intel_get_function_groups(struct pinctrl_dev *pctldev,
+ return 0;
+ }
+
+-static int intel_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned function,
+- unsigned group)
++static int intel_pinmux_set_mux(struct pinctrl_dev *pctldev,
++ unsigned int function, unsigned int group)
+ {
+ struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+ const struct intel_pingroup *grp = &pctrl->soc->groups[group];
+@@ -447,7 +447,7 @@ static void intel_gpio_set_gpio_mode(void __iomem *padcfg0)
+
+ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+ struct pinctrl_gpio_range *range,
+- unsigned pin)
++ unsigned int pin)
+ {
+ struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+ void __iomem *padcfg0;
+@@ -485,7 +485,7 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+
+ static int intel_gpio_set_direction(struct pinctrl_dev *pctldev,
+ struct pinctrl_gpio_range *range,
+- unsigned pin, bool input)
++ unsigned int pin, bool input)
+ {
+ struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+ void __iomem *padcfg0;
+@@ -510,7 +510,7 @@ static const struct pinmux_ops intel_pinmux_ops = {
+ .gpio_set_direction = intel_gpio_set_direction,
+ };
+
+-static int intel_config_get(struct pinctrl_dev *pctldev, unsigned pin,
++static int intel_config_get(struct pinctrl_dev *pctldev, unsigned int pin,
+ unsigned long *config)
+ {
+ struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+@@ -599,11 +599,11 @@ static int intel_config_get(struct pinctrl_dev *pctldev, unsigned pin,
+ return 0;
+ }
+
+-static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned pin,
++static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin,
+ unsigned long config)
+ {
+- unsigned param = pinconf_to_config_param(config);
+- unsigned arg = pinconf_to_config_argument(config);
++ unsigned int param = pinconf_to_config_param(config);
++ unsigned int arg = pinconf_to_config_argument(config);
+ const struct intel_community *community;
+ void __iomem *padcfg1;
+ unsigned long flags;
+@@ -685,8 +685,8 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned pin,
+ return ret;
+ }
+
+-static int intel_config_set_debounce(struct intel_pinctrl *pctrl, unsigned pin,
+- unsigned debounce)
++static int intel_config_set_debounce(struct intel_pinctrl *pctrl,
++ unsigned int pin, unsigned int debounce)
+ {
+ void __iomem *padcfg0, *padcfg2;
+ unsigned long flags;
+@@ -732,8 +732,8 @@ exit_unlock:
+ return ret;
+ }
+
+-static int intel_config_set(struct pinctrl_dev *pctldev, unsigned pin,
+- unsigned long *configs, unsigned nconfigs)
++static int intel_config_set(struct pinctrl_dev *pctldev, unsigned int pin,
++ unsigned long *configs, unsigned int nconfigs)
+ {
+ struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+ int i, ret;
+@@ -790,7 +790,7 @@ static const struct pinctrl_desc intel_pinctrl_desc = {
+ * automatically translated to pinctrl pin number. This function can be
+ * used to find out the corresponding pinctrl pin.
+ */
+-static int intel_gpio_to_pin(struct intel_pinctrl *pctrl, unsigned offset,
++static int intel_gpio_to_pin(struct intel_pinctrl *pctrl, unsigned int offset,
+ const struct intel_community **community,
+ const struct intel_padgroup **padgrp)
+ {
+@@ -824,7 +824,7 @@ static int intel_gpio_to_pin(struct intel_pinctrl *pctrl, unsigned offset,
+ return -EINVAL;
+ }
+
+-static int intel_gpio_get(struct gpio_chip *chip, unsigned offset)
++static int intel_gpio_get(struct gpio_chip *chip, unsigned int offset)
+ {
+ struct intel_pinctrl *pctrl = gpiochip_get_data(chip);
+ void __iomem *reg;
+@@ -846,7 +846,8 @@ static int intel_gpio_get(struct gpio_chip *chip, unsigned offset)
+ return !!(padcfg0 & PADCFG0_GPIORXSTATE);
+ }
+
+-static void intel_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
++static void intel_gpio_set(struct gpio_chip *chip, unsigned int offset,
++ int value)
+ {
+ struct intel_pinctrl *pctrl = gpiochip_get_data(chip);
+ unsigned long flags;
+@@ -895,12 +896,12 @@ static int intel_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+ return !!(padcfg0 & PADCFG0_GPIOTXDIS);
+ }
+
+-static int intel_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
++static int intel_gpio_direction_input(struct gpio_chip *chip, unsigned int offset)
+ {
+ return pinctrl_gpio_direction_input(chip->base + offset);
+ }
+
+-static int intel_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
++static int intel_gpio_direction_output(struct gpio_chip *chip, unsigned int offset,
+ int value)
+ {
+ intel_gpio_set(chip, offset, value);
+@@ -929,7 +930,7 @@ static void intel_gpio_irq_ack(struct irq_data *d)
+
+ pin = intel_gpio_to_pin(pctrl, irqd_to_hwirq(d), &community, &padgrp);
+ if (pin >= 0) {
+- unsigned gpp, gpp_offset, is_offset;
++ unsigned int gpp, gpp_offset, is_offset;
+
+ gpp = padgrp->reg_num;
+ gpp_offset = padgroup_offset(padgrp, pin);
+@@ -951,7 +952,7 @@ static void intel_gpio_irq_enable(struct irq_data *d)
+
+ pin = intel_gpio_to_pin(pctrl, irqd_to_hwirq(d), &community, &padgrp);
+ if (pin >= 0) {
+- unsigned gpp, gpp_offset, is_offset;
++ unsigned int gpp, gpp_offset, is_offset;
+ unsigned long flags;
+ u32 value;
+
+@@ -980,7 +981,7 @@ static void intel_gpio_irq_mask_unmask(struct irq_data *d, bool mask)
+
+ pin = intel_gpio_to_pin(pctrl, irqd_to_hwirq(d), &community, &padgrp);
+ if (pin >= 0) {
+- unsigned gpp, gpp_offset;
++ unsigned int gpp, gpp_offset;
+ unsigned long flags;
+ void __iomem *reg;
+ u32 value;
+@@ -1011,11 +1012,11 @@ static void intel_gpio_irq_unmask(struct irq_data *d)
+ intel_gpio_irq_mask_unmask(d, false);
+ }
+
+-static int intel_gpio_irq_type(struct irq_data *d, unsigned type)
++static int intel_gpio_irq_type(struct irq_data *d, unsigned int type)
+ {
+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+ struct intel_pinctrl *pctrl = gpiochip_get_data(gc);
+- unsigned pin = intel_gpio_to_pin(pctrl, irqd_to_hwirq(d), NULL, NULL);
++ unsigned int pin = intel_gpio_to_pin(pctrl, irqd_to_hwirq(d), NULL, NULL);
+ unsigned long flags;
+ void __iomem *reg;
+ u32 value;
+@@ -1072,7 +1073,7 @@ static int intel_gpio_irq_wake(struct irq_data *d, unsigned int on)
+ {
+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+ struct intel_pinctrl *pctrl = gpiochip_get_data(gc);
+- unsigned pin = intel_gpio_to_pin(pctrl, irqd_to_hwirq(d), NULL, NULL);
++ unsigned int pin = intel_gpio_to_pin(pctrl, irqd_to_hwirq(d), NULL, NULL);
+
+ if (on)
+ enable_irq_wake(pctrl->irq);
+@@ -1167,7 +1168,7 @@ static int intel_gpio_add_pin_ranges(struct intel_pinctrl *pctrl,
+ static unsigned intel_gpio_ngpio(const struct intel_pinctrl *pctrl)
+ {
+ const struct intel_community *community;
+- unsigned ngpio = 0;
++ unsigned int ngpio = 0;
+ int i, j;
+
+ for (i = 0; i < pctrl->ncommunities; i++) {
+@@ -1243,8 +1244,8 @@ static int intel_pinctrl_add_padgroups(struct intel_pinctrl *pctrl,
+ struct intel_community *community)
+ {
+ struct intel_padgroup *gpps;
+- unsigned npins = community->npins;
+- unsigned padown_num = 0;
++ unsigned int npins = community->npins;
++ unsigned int padown_num = 0;
+ size_t ngpps, i;
+
+ if (community->gpps)
+@@ -1260,7 +1261,7 @@ static int intel_pinctrl_add_padgroups(struct intel_pinctrl *pctrl,
+ if (community->gpps) {
+ gpps[i] = community->gpps[i];
+ } else {
+- unsigned gpp_size = community->gpp_size;
++ unsigned int gpp_size = community->gpp_size;
+
+ gpps[i].reg_num = i;
+ gpps[i].base = community->pin_base + i * gpp_size;
+@@ -1431,7 +1432,13 @@ int intel_pinctrl_probe(struct platform_device *pdev,
+ EXPORT_SYMBOL_GPL(intel_pinctrl_probe);
+
+ #ifdef CONFIG_PM_SLEEP
+-static bool intel_pinctrl_should_save(struct intel_pinctrl *pctrl, unsigned pin)
++static bool __intel_gpio_is_direct_irq(u32 value)
++{
++ return (value & PADCFG0_GPIROUTIOXAPIC) && (value & PADCFG0_GPIOTXDIS) &&
++ (__intel_gpio_get_gpio_mode(value) == PADCFG0_PMODE_GPIO);
++}
++
++static bool intel_pinctrl_should_save(struct intel_pinctrl *pctrl, unsigned int pin)
+ {
+ const struct pin_desc *pd = pin_desc_get(pctrl->pctldev, pin);
+ u32 value;
+@@ -1464,8 +1471,7 @@ static bool intel_pinctrl_should_save(struct intel_pinctrl *pctrl, unsigned pin)
+ * See https://bugzilla.kernel.org/show_bug.cgi?id=214749.
+ */
+ value = readl(intel_get_padcfg(pctrl, pin, PADCFG0));
+- if ((value & PADCFG0_GPIROUTIOXAPIC) && (value & PADCFG0_GPIOTXDIS) &&
+- (__intel_gpio_get_gpio_mode(value) == PADCFG0_PMODE_GPIO))
++ if (__intel_gpio_is_direct_irq(value))
+ return true;
+
+ return false;
+@@ -1502,7 +1508,7 @@ int intel_pinctrl_suspend(struct device *dev)
+ for (i = 0; i < pctrl->ncommunities; i++) {
+ struct intel_community *community = &pctrl->communities[i];
+ void __iomem *base;
+- unsigned gpp;
++ unsigned int gpp;
+
+ base = community->regs + community->ie_offset;
+ for (gpp = 0; gpp < community->ngpps; gpp++)
+@@ -1520,7 +1526,7 @@ static void intel_gpio_irq_init(struct intel_pinctrl *pctrl)
+ for (i = 0; i < pctrl->ncommunities; i++) {
+ const struct intel_community *community;
+ void __iomem *base;
+- unsigned gpp;
++ unsigned int gpp;
+
+ community = &pctrl->communities[i];
+ base = community->regs;
+@@ -1550,7 +1556,12 @@ int intel_pinctrl_resume(struct device *dev)
+ void __iomem *padcfg;
+ u32 val;
+
+- if (!intel_pinctrl_should_save(pctrl, desc->number))
++ if (!(intel_pinctrl_should_save(pctrl, desc->number) ||
++ /*
++ * If the firmware mangled the register contents too much,
++ * check the saved value for the Direct IRQ mode.
++ */
++ __intel_gpio_is_direct_irq(pads[i].padcfg0)))
+ continue;
+
+ padcfg = intel_get_padcfg(pctrl, desc->number, PADCFG0);
+@@ -1584,7 +1595,7 @@ int intel_pinctrl_resume(struct device *dev)
+ for (i = 0; i < pctrl->ncommunities; i++) {
+ struct intel_community *community = &pctrl->communities[i];
+ void __iomem *base;
+- unsigned gpp;
++ unsigned int gpp;
+
+ base = community->regs + community->ie_offset;
+ for (gpp = 0; gpp < community->ngpps; gpp++) {
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.h b/drivers/pinctrl/intel/pinctrl-intel.h
+index 1785abf157e4b..737a545b448f0 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.h
++++ b/drivers/pinctrl/intel/pinctrl-intel.h
+@@ -25,10 +25,10 @@ struct device;
+ */
+ struct intel_pingroup {
+ const char *name;
+- const unsigned *pins;
++ const unsigned int *pins;
+ size_t npins;
+ unsigned short mode;
+- const unsigned *modes;
++ const unsigned int *modes;
+ };
+
+ /**
+@@ -56,11 +56,11 @@ struct intel_function {
+ * to specify them.
+ */
+ struct intel_padgroup {
+- unsigned reg_num;
+- unsigned base;
+- unsigned size;
++ unsigned int reg_num;
++ unsigned int base;
++ unsigned int size;
+ int gpio_base;
+- unsigned padown_num;
++ unsigned int padown_num;
+ };
+
+ /**
+@@ -96,17 +96,17 @@ struct intel_padgroup {
+ * pass custom @gpps and @ngpps instead.
+ */
+ struct intel_community {
+- unsigned barno;
+- unsigned padown_offset;
+- unsigned padcfglock_offset;
+- unsigned hostown_offset;
+- unsigned is_offset;
+- unsigned ie_offset;
+- unsigned pin_base;
+- unsigned gpp_size;
+- unsigned gpp_num_padown_regs;
++ unsigned int barno;
++ unsigned int padown_offset;
++ unsigned int padcfglock_offset;
++ unsigned int hostown_offset;
++ unsigned int is_offset;
++ unsigned int ie_offset;
++ unsigned int pin_base;
++ unsigned int gpp_size;
++ unsigned int gpp_num_padown_regs;
+ size_t npins;
+- unsigned features;
++ unsigned int features;
+ const struct intel_padgroup *gpps;
+ size_t ngpps;
+ /* Reserved for the core driver */
+diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
+index 2b50030ad97e0..4143cafbf7e73 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -345,6 +345,8 @@ static int pcs_set_mux(struct pinctrl_dev *pctldev, unsigned fselector,
+ if (!pcs->fmask)
+ return 0;
+ function = pinmux_generic_get_function(pctldev, fselector);
++ if (!function)
++ return -EINVAL;
+ func = function->data;
+ if (!func)
+ return -EINVAL;
+diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
+index 7212e3a13fe6b..33fb111e2e19d 100644
+--- a/drivers/scsi/iscsi_tcp.c
++++ b/drivers/scsi/iscsi_tcp.c
+@@ -775,7 +775,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,
+ enum iscsi_host_param param, char *buf)
+ {
+ struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(shost);
+- struct iscsi_session *session = tcp_sw_host->session;
++ struct iscsi_session *session;
+ struct iscsi_conn *conn;
+ struct iscsi_tcp_conn *tcp_conn;
+ struct iscsi_sw_tcp_conn *tcp_sw_conn;
+@@ -784,6 +784,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,
+
+ switch (param) {
+ case ISCSI_HOST_PARAM_IPADDRESS:
++ session = tcp_sw_host->session;
+ if (!session)
+ return -ENOTCONN;
+
+@@ -872,12 +873,14 @@ iscsi_sw_tcp_session_create(struct iscsi_endpoint *ep, uint16_t cmds_max,
+ if (!cls_session)
+ goto remove_host;
+ session = cls_session->dd_data;
+- tcp_sw_host = iscsi_host_priv(shost);
+- tcp_sw_host->session = session;
+
+ shost->can_queue = session->scsi_cmds_max;
+ if (iscsi_tcp_r2tpool_alloc(session))
+ goto remove_session;
++
++ /* We are now fully setup so expose the session to sysfs. */
++ tcp_sw_host = iscsi_host_priv(shost);
++ tcp_sw_host->session = session;
+ return cls_session;
+
+ remove_session:
+diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
+index 6d1179a7f043d..bba24eaea2ce4 100644
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -95,8 +95,8 @@ static bool __target_check_io_state(struct se_cmd *se_cmd,
+ {
+ struct se_session *sess = se_cmd->se_sess;
+
+- assert_spin_locked(&sess->sess_cmd_lock);
+- WARN_ON_ONCE(!irqs_disabled());
++ lockdep_assert_held(&sess->sess_cmd_lock);
++
+ /*
+ * If command already reached CMD_T_COMPLETE state within
+ * target_complete_cmd() or CMD_T_FABRIC_STOP due to shutdown,
+diff --git a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
+index 9ec27ac1856bf..1adcef95f7b95 100644
+--- a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
++++ b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
+@@ -52,11 +52,13 @@ static int int340x_thermal_get_trip_temp(struct thermal_zone_device *zone,
+ int trip, int *temp)
+ {
+ struct int34x_thermal_zone *d = zone->devdata;
+- int i;
++ int i, ret = 0;
+
+ if (d->override_ops && d->override_ops->get_trip_temp)
+ return d->override_ops->get_trip_temp(zone, trip, temp);
+
++ mutex_lock(&d->trip_mutex);
++
+ if (trip < d->aux_trip_nr)
+ *temp = d->aux_trips[trip];
+ else if (trip == d->crt_trip_id)
+@@ -74,10 +76,12 @@ static int int340x_thermal_get_trip_temp(struct thermal_zone_device *zone,
+ }
+ }
+ if (i == INT340X_THERMAL_MAX_ACT_TRIP_COUNT)
+- return -EINVAL;
++ ret = -EINVAL;
+ }
+
+- return 0;
++ mutex_unlock(&d->trip_mutex);
++
++ return ret;
+ }
+
+ static int int340x_thermal_get_trip_type(struct thermal_zone_device *zone,
+@@ -85,11 +89,13 @@ static int int340x_thermal_get_trip_type(struct thermal_zone_device *zone,
+ enum thermal_trip_type *type)
+ {
+ struct int34x_thermal_zone *d = zone->devdata;
+- int i;
++ int i, ret = 0;
+
+ if (d->override_ops && d->override_ops->get_trip_type)
+ return d->override_ops->get_trip_type(zone, trip, type);
+
++ mutex_lock(&d->trip_mutex);
++
+ if (trip < d->aux_trip_nr)
+ *type = THERMAL_TRIP_PASSIVE;
+ else if (trip == d->crt_trip_id)
+@@ -107,10 +113,12 @@ static int int340x_thermal_get_trip_type(struct thermal_zone_device *zone,
+ }
+ }
+ if (i == INT340X_THERMAL_MAX_ACT_TRIP_COUNT)
+- return -EINVAL;
++ ret = -EINVAL;
+ }
+
+- return 0;
++ mutex_unlock(&d->trip_mutex);
++
++ return ret;
+ }
+
+ static int int340x_thermal_set_trip_temp(struct thermal_zone_device *zone,
+@@ -182,6 +190,8 @@ int int340x_thermal_read_trips(struct int34x_thermal_zone *int34x_zone)
+ int trip_cnt = int34x_zone->aux_trip_nr;
+ int i;
+
++ mutex_lock(&int34x_zone->trip_mutex);
++
+ int34x_zone->crt_trip_id = -1;
+ if (!int340x_thermal_get_trip_config(int34x_zone->adev->handle, "_CRT",
+ &int34x_zone->crt_temp))
+@@ -209,6 +219,8 @@ int int340x_thermal_read_trips(struct int34x_thermal_zone *int34x_zone)
+ int34x_zone->act_trips[i].valid = true;
+ }
+
++ mutex_unlock(&int34x_zone->trip_mutex);
++
+ return trip_cnt;
+ }
+ EXPORT_SYMBOL_GPL(int340x_thermal_read_trips);
+@@ -232,6 +244,8 @@ struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *adev,
+ if (!int34x_thermal_zone)
+ return ERR_PTR(-ENOMEM);
+
++ mutex_init(&int34x_thermal_zone->trip_mutex);
++
+ int34x_thermal_zone->adev = adev;
+ int34x_thermal_zone->override_ops = override_ops;
+
+@@ -274,6 +288,7 @@ err_thermal_zone:
+ acpi_lpat_free_conversion_table(int34x_thermal_zone->lpat_table);
+ kfree(int34x_thermal_zone->aux_trips);
+ err_trip_alloc:
++ mutex_destroy(&int34x_thermal_zone->trip_mutex);
+ kfree(int34x_thermal_zone);
+ return ERR_PTR(ret);
+ }
+@@ -285,6 +300,7 @@ void int340x_thermal_zone_remove(struct int34x_thermal_zone
+ thermal_zone_device_unregister(int34x_thermal_zone->zone);
+ acpi_lpat_free_conversion_table(int34x_thermal_zone->lpat_table);
+ kfree(int34x_thermal_zone->aux_trips);
++ mutex_destroy(&int34x_thermal_zone->trip_mutex);
+ kfree(int34x_thermal_zone);
+ }
+ EXPORT_SYMBOL_GPL(int340x_thermal_zone_remove);
+diff --git a/drivers/thermal/int340x_thermal/int340x_thermal_zone.h b/drivers/thermal/int340x_thermal/int340x_thermal_zone.h
+index 5f3ba4775c5cd..e74648e330c71 100644
+--- a/drivers/thermal/int340x_thermal/int340x_thermal_zone.h
++++ b/drivers/thermal/int340x_thermal/int340x_thermal_zone.h
+@@ -41,6 +41,7 @@ struct int34x_thermal_zone {
+ struct thermal_zone_device_ops *override_ops;
+ void *priv_data;
+ struct acpi_lpat_conversion_table *lpat_table;
++ struct mutex trip_mutex;
+ };
+
+ struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *,
+diff --git a/drivers/tty/serial/8250/8250_dma.c b/drivers/tty/serial/8250/8250_dma.c
+index bfa1a857f3ffa..c8b17070faf4e 100644
+--- a/drivers/tty/serial/8250/8250_dma.c
++++ b/drivers/tty/serial/8250/8250_dma.c
+@@ -48,19 +48,39 @@ static void __dma_rx_complete(void *param)
+ struct uart_8250_dma *dma = p->dma;
+ struct tty_port *tty_port = &p->port.state->port;
+ struct dma_tx_state state;
++ enum dma_status dma_status;
+ int count;
+
+- dma->rx_running = 0;
+- dmaengine_tx_status(dma->rxchan, dma->rx_cookie, &state);
++ /*
++ * New DMA Rx can be started during the completion handler before it
++ * could acquire port's lock and it might still be ongoing. Don't to
++ * anything in such case.
++ */
++ dma_status = dmaengine_tx_status(dma->rxchan, dma->rx_cookie, &state);
++ if (dma_status == DMA_IN_PROGRESS)
++ return;
+
+ count = dma->rx_size - state.residue;
+
+ tty_insert_flip_string(tty_port, dma->rx_buf, count);
+ p->port.icount.rx += count;
++ dma->rx_running = 0;
+
+ tty_flip_buffer_push(tty_port);
+ }
+
++static void dma_rx_complete(void *param)
++{
++ struct uart_8250_port *p = param;
++ struct uart_8250_dma *dma = p->dma;
++ unsigned long flags;
++
++ spin_lock_irqsave(&p->port.lock, flags);
++ if (dma->rx_running)
++ __dma_rx_complete(p);
++ spin_unlock_irqrestore(&p->port.lock, flags);
++}
++
+ int serial8250_tx_dma(struct uart_8250_port *p)
+ {
+ struct uart_8250_dma *dma = p->dma;
+@@ -126,7 +146,7 @@ int serial8250_rx_dma(struct uart_8250_port *p)
+ return -EBUSY;
+
+ dma->rx_running = 1;
+- desc->callback = __dma_rx_complete;
++ desc->callback = dma_rx_complete;
+ desc->callback_param = p;
+
+ dma->rx_cookie = dmaengine_submit(desc);
+diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
+index 2fb509d57e88c..03fe692d940b8 100644
+--- a/drivers/tty/vt/vc_screen.c
++++ b/drivers/tty/vt/vc_screen.c
+@@ -247,10 +247,6 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+
+ uni_mode = use_unicode(inode);
+ attr = use_attributes(inode);
+- ret = -ENXIO;
+- vc = vcs_vc(inode, &viewed);
+- if (!vc)
+- goto unlock_out;
+
+ ret = -EINVAL;
+ if (pos < 0)
+@@ -270,6 +266,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+ ssize_t orig_count;
+ long p = pos;
+
++ ret = -ENXIO;
++ vc = vcs_vc(inode, &viewed);
++ if (!vc)
++ goto unlock_out;
++
+ /* Check whether we are above size each round,
+ * as copy_to_user at the end of this loop
+ * could sleep.
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 35a11f7bcb658..1346c600ebedf 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -527,6 +527,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* DJI CineSSD */
+ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* Alcor Link AK9563 SC Reader used in 2022 Lenovo ThinkPads */
++ { USB_DEVICE(0x2ce3, 0x9563), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* DELL USB GEN2 */
+ { USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME },
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 9d5320562e81f..58e1bc3a77d80 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -85,7 +85,7 @@ static inline void dwc3_qcom_clrbits(void __iomem *base, u32 offset, u32 val)
+ readl(base + offset);
+ }
+
+-static void dwc3_qcom_vbus_overrride_enable(struct dwc3_qcom *qcom, bool enable)
++static void dwc3_qcom_vbus_override_enable(struct dwc3_qcom *qcom, bool enable)
+ {
+ if (enable) {
+ dwc3_qcom_setbits(qcom->qscratch_base, QSCRATCH_SS_PHY_CTRL,
+@@ -106,7 +106,7 @@ static int dwc3_qcom_vbus_notifier(struct notifier_block *nb,
+ struct dwc3_qcom *qcom = container_of(nb, struct dwc3_qcom, vbus_nb);
+
+ /* enable vbus override for device mode */
+- dwc3_qcom_vbus_overrride_enable(qcom, event);
++ dwc3_qcom_vbus_override_enable(qcom, event);
+ qcom->mode = event ? USB_DR_MODE_PERIPHERAL : USB_DR_MODE_HOST;
+
+ return NOTIFY_DONE;
+@@ -118,7 +118,7 @@ static int dwc3_qcom_host_notifier(struct notifier_block *nb,
+ struct dwc3_qcom *qcom = container_of(nb, struct dwc3_qcom, host_nb);
+
+ /* disable vbus override in host mode */
+- dwc3_qcom_vbus_overrride_enable(qcom, !event);
++ dwc3_qcom_vbus_override_enable(qcom, !event);
+ qcom->mode = event ? USB_DR_MODE_HOST : USB_DR_MODE_PERIPHERAL;
+
+ return NOTIFY_DONE;
+@@ -512,8 +512,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ qcom->mode = usb_get_dr_mode(&qcom->dwc3->dev);
+
+ /* enable vbus override for device mode */
+- if (qcom->mode == USB_DR_MODE_PERIPHERAL)
+- dwc3_qcom_vbus_overrride_enable(qcom, true);
++ if (qcom->mode != USB_DR_MODE_HOST)
++ dwc3_qcom_vbus_override_enable(qcom, true);
+
+ /* register extcon to override sw_vbus on Vbus change later */
+ ret = dwc3_qcom_register_extcon(qcom);
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 48bdb2a3972bc..f9f324f76a723 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -271,8 +271,10 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
+ struct usb_request *req = ffs->ep0req;
+ int ret;
+
+- if (!req)
++ if (!req) {
++ spin_unlock_irq(&ffs->ev.waitq.lock);
+ return -EINVAL;
++ }
+
+ req->zero = len < le16_to_cpu(ffs->ev.setup.wLength);
+
+diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
+index 2ae3fab36a80e..7387f52cb58d1 100644
+--- a/drivers/usb/typec/altmodes/displayport.c
++++ b/drivers/usb/typec/altmodes/displayport.c
+@@ -526,10 +526,10 @@ static int dp_altmode_probe(struct typec_altmode *alt)
+ /* FIXME: Port can only be DFP_U. */
+
+ /* Make sure we have compatiple pin configurations */
+- if (!(DP_CAP_DFP_D_PIN_ASSIGN(port->vdo) &
+- DP_CAP_UFP_D_PIN_ASSIGN(alt->vdo)) &&
+- !(DP_CAP_UFP_D_PIN_ASSIGN(port->vdo) &
+- DP_CAP_DFP_D_PIN_ASSIGN(alt->vdo)))
++ if (!(DP_CAP_PIN_ASSIGN_DFP_D(port->vdo) &
++ DP_CAP_PIN_ASSIGN_UFP_D(alt->vdo)) &&
++ !(DP_CAP_PIN_ASSIGN_UFP_D(port->vdo) &
++ DP_CAP_PIN_ASSIGN_DFP_D(alt->vdo)))
+ return -ENODEV;
+
+ ret = sysfs_create_group(&alt->dev.kobj, &dp_altmode_group);
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 9fcd583b78351..dea5275254ef1 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -2475,9 +2475,12 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font,
+ h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres))
+ return -EINVAL;
+
++ if (font->width > 32 || font->height > 32)
++ return -EINVAL;
++
+ /* Make sure drawing engine can handle the font */
+- if (!(info->pixmap.blit_x & (1 << (font->width - 1))) ||
+- !(info->pixmap.blit_y & (1 << (font->height - 1))))
++ if (!(info->pixmap.blit_x & BIT(font->width - 1)) ||
++ !(info->pixmap.blit_y & BIT(font->height - 1)))
+ return -EINVAL;
+
+ /* Make sure driver can handle the font length */
+diff --git a/drivers/watchdog/diag288_wdt.c b/drivers/watchdog/diag288_wdt.c
+index 806a04a676b7e..561797c3b2028 100644
+--- a/drivers/watchdog/diag288_wdt.c
++++ b/drivers/watchdog/diag288_wdt.c
+@@ -88,7 +88,7 @@ static int __diag288(unsigned int func, unsigned int timeout,
+ "1:\n"
+ EX_TABLE(0b, 1b)
+ : "+d" (err) : "d"(__func), "d"(__timeout),
+- "d"(__action), "d"(__len) : "1", "cc");
++ "d"(__action), "d"(__len) : "1", "cc", "memory");
+ return err;
+ }
+
+@@ -274,12 +274,21 @@ static int __init diag288_init(void)
+ char ebc_begin[] = {
+ 194, 197, 199, 201, 213
+ };
++ char *ebc_cmd;
+
+ watchdog_set_nowayout(&wdt_dev, nowayout_info);
+
+ if (MACHINE_IS_VM) {
+- if (__diag288_vm(WDT_FUNC_INIT, 15,
+- ebc_begin, sizeof(ebc_begin)) != 0) {
++ ebc_cmd = kmalloc(sizeof(ebc_begin), GFP_KERNEL);
++ if (!ebc_cmd) {
++ pr_err("The watchdog cannot be initialized\n");
++ return -ENOMEM;
++ }
++ memcpy(ebc_cmd, ebc_begin, sizeof(ebc_begin));
++ ret = __diag288_vm(WDT_FUNC_INIT, 15,
++ ebc_cmd, sizeof(ebc_begin));
++ kfree(ebc_cmd);
++ if (ret != 0) {
+ pr_err("The watchdog cannot be initialized\n");
+ return -EINVAL;
+ }
+diff --git a/fs/aio.c b/fs/aio.c
+index 9635c29b83da1..1bd934eccbf6c 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -332,6 +332,9 @@ static int aio_ring_mremap(struct vm_area_struct *vma)
+ spin_lock(&mm->ioctx_lock);
+ rcu_read_lock();
+ table = rcu_dereference(mm->ioctx_table);
++ if (!table)
++ goto out_unlock;
++
+ for (i = 0; i < table->nr; i++) {
+ struct kioctx *ctx;
+
+@@ -345,6 +348,7 @@ static int aio_ring_mremap(struct vm_area_struct *vma)
+ }
+ }
+
++out_unlock:
+ rcu_read_unlock();
+ spin_unlock(&mm->ioctx_lock);
+ return res;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 2b4d33b58a68a..0294f519c29ee 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -1418,7 +1418,7 @@ again:
+ goto out;
+ }
+
+- while (1) {
++ while (search_start < search_end) {
+ l = path->nodes[0];
+ slot = path->slots[0];
+ if (slot >= btrfs_header_nritems(l)) {
+@@ -1441,6 +1441,9 @@ again:
+ if (key.type != BTRFS_DEV_EXTENT_KEY)
+ goto next;
+
++ if (key.offset > search_end)
++ break;
++
+ if (key.offset > search_start) {
+ hole_size = key.offset - search_start;
+
+@@ -1515,6 +1518,7 @@ next:
+ else
+ ret = 0;
+
++ ASSERT(max_hole_start + max_hole_size <= search_end);
+ out:
+ btrfs_free_path(path);
+ *start = max_hole_start;
+diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
+index 9b96d79eea6c8..708aa1b92036b 100644
+--- a/fs/nilfs2/ioctl.c
++++ b/fs/nilfs2/ioctl.c
+@@ -1135,7 +1135,14 @@ static int nilfs_ioctl_set_alloc_range(struct inode *inode, void __user *argp)
+
+ minseg = range[0] + segbytes - 1;
+ do_div(minseg, segbytes);
++
++ if (range[1] < 4096)
++ goto out;
++
+ maxseg = NILFS_SB2_OFFSET_BYTES(range[1]);
++ if (maxseg < segbytes)
++ goto out;
++
+ do_div(maxseg, segbytes);
+ maxseg--;
+
+diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
+index 5e4d7d19102c5..2961b5ceb4a7c 100644
+--- a/fs/nilfs2/super.c
++++ b/fs/nilfs2/super.c
+@@ -410,6 +410,15 @@ int nilfs_resize_fs(struct super_block *sb, __u64 newsize)
+ if (newsize > devsize)
+ goto out;
+
++ /*
++ * Prevent underflow in second superblock position calculation.
++ * The exact minimum size check is done in nilfs_sufile_resize().
++ */
++ if (newsize < 4096) {
++ ret = -ENOSPC;
++ goto out;
++ }
++
+ /*
+ * Write lock is required to protect some functions depending
+ * on the number of segments, the number of reserved segments,
+diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
+index 74ef3d313686f..6541e29a8b200 100644
+--- a/fs/nilfs2/the_nilfs.c
++++ b/fs/nilfs2/the_nilfs.c
+@@ -517,9 +517,15 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs,
+ {
+ struct nilfs_super_block **sbp = nilfs->ns_sbp;
+ struct buffer_head **sbh = nilfs->ns_sbh;
+- u64 sb2off = NILFS_SB2_OFFSET_BYTES(nilfs->ns_bdev->bd_inode->i_size);
++ u64 sb2off, devsize = nilfs->ns_bdev->bd_inode->i_size;
+ int valid[2], swp = 0;
+
++ if (devsize < NILFS_SEG_MIN_BLOCKS * NILFS_MIN_BLOCK_SIZE + 4096) {
++ nilfs_msg(sb, KERN_ERR, "device size too small");
++ return -EINVAL;
++ }
++ sb2off = NILFS_SB2_OFFSET_BYTES(devsize);
++
+ sbp[0] = nilfs_read_super_block(sb, NILFS_SB_OFFSET_BYTES, blocksize,
+ &sbh[0]);
+ sbp[1] = nilfs_read_super_block(sb, sb2off, blocksize, &sbh[1]);
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index dc63d4c6029e1..2f2afc3c6fc67 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -701,9 +701,7 @@ static int smaps_hugetlb_range(pte_t *pte, unsigned long hmask,
+ page = device_private_entry_to_page(swpent);
+ }
+ if (page) {
+- int mapcount = page_mapcount(page);
+-
+- if (mapcount >= 2)
++ if (page_mapcount(page) >= 2 || hugetlb_pmd_shared(pte))
+ mss->shared_hugetlb += huge_page_size(hstate_vma(vma));
+ else
+ mss->private_hugetlb += huge_page_size(hstate_vma(vma));
+diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h
+index 10e93345b6153..75886e6d9c97b 100644
+--- a/fs/squashfs/squashfs_fs.h
++++ b/fs/squashfs/squashfs_fs.h
+@@ -196,7 +196,7 @@ static inline int squashfs_block_size(__le32 raw)
+ #define SQUASHFS_ID_BLOCK_BYTES(A) (SQUASHFS_ID_BLOCKS(A) *\
+ sizeof(u64))
+ /* xattr id lookup table defines */
+-#define SQUASHFS_XATTR_BYTES(A) ((A) * sizeof(struct squashfs_xattr_id))
++#define SQUASHFS_XATTR_BYTES(A) (((u64) (A)) * sizeof(struct squashfs_xattr_id))
+
+ #define SQUASHFS_XATTR_BLOCK(A) (SQUASHFS_XATTR_BYTES(A) / \
+ SQUASHFS_METADATA_SIZE)
+diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
+index 5234c19a0eabc..7ec30a11273ea 100644
+--- a/fs/squashfs/squashfs_fs_sb.h
++++ b/fs/squashfs/squashfs_fs_sb.h
+@@ -76,7 +76,7 @@ struct squashfs_sb_info {
+ long long bytes_used;
+ unsigned int inodes;
+ unsigned int fragments;
+- int xattr_ids;
++ unsigned int xattr_ids;
+ unsigned int ids;
+ };
+ #endif
+diff --git a/fs/squashfs/xattr.h b/fs/squashfs/xattr.h
+index 86b0a0073e51f..f360f27e38f37 100644
+--- a/fs/squashfs/xattr.h
++++ b/fs/squashfs/xattr.h
+@@ -23,12 +23,12 @@
+
+ #ifdef CONFIG_SQUASHFS_XATTR
+ extern __le64 *squashfs_read_xattr_id_table(struct super_block *, u64,
+- u64 *, int *);
++ u64 *, unsigned int *);
+ extern int squashfs_xattr_lookup(struct super_block *, unsigned int, int *,
+ unsigned int *, unsigned long long *);
+ #else
+ static inline __le64 *squashfs_read_xattr_id_table(struct super_block *sb,
+- u64 start, u64 *xattr_table_start, int *xattr_ids)
++ u64 start, u64 *xattr_table_start, unsigned int *xattr_ids)
+ {
+ struct squashfs_xattr_id_table *id_table;
+
+diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c
+index 7f718d2bf3579..fe266b3e95f8f 100644
+--- a/fs/squashfs/xattr_id.c
++++ b/fs/squashfs/xattr_id.c
+@@ -69,7 +69,7 @@ int squashfs_xattr_lookup(struct super_block *sb, unsigned int index,
+ * Read uncompressed xattr id lookup table indexes from disk into memory
+ */
+ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
+- u64 *xattr_table_start, int *xattr_ids)
++ u64 *xattr_table_start, unsigned int *xattr_ids)
+ {
+ struct squashfs_sb_info *msblk = sb->s_fs_info;
+ unsigned int len, indexes;
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index cb7dc38e9c779..354d320c3fd68 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -7,6 +7,7 @@
+ #include <linux/fs.h>
+ #include <linux/hugetlb_inline.h>
+ #include <linux/cgroup.h>
++#include <linux/page_ref.h>
+ #include <linux/list.h>
+ #include <linux/kref.h>
+ #include <asm/pgtable.h>
+@@ -404,7 +405,10 @@ static inline struct hstate *hstate_sizelog(int page_size_log)
+ if (!page_size_log)
+ return &default_hstate;
+
+- return size_to_hstate(1UL << page_size_log);
++ if (page_size_log < BITS_PER_LONG)
++ return size_to_hstate(1UL << page_size_log);
++
++ return NULL;
+ }
+
+ static inline struct hstate *hstate_vma(struct vm_area_struct *vma)
+@@ -626,4 +630,16 @@ static inline spinlock_t *huge_pte_lock(struct hstate *h,
+ return ptl;
+ }
+
++#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
++static inline bool hugetlb_pmd_shared(pte_t *pte)
++{
++ return page_count(virt_to_page(pte)) > 1;
++}
++#else
++static inline bool hugetlb_pmd_shared(pte_t *pte)
++{
++ return false;
++}
++#endif
++
+ #endif /* _LINUX_HUGETLB_H */
+diff --git a/include/linux/phy.h b/include/linux/phy.h
+index 42766e7179d38..86a3792c568c2 100644
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -667,6 +667,10 @@ struct phy_driver {
+ #define PHY_ANY_ID "MATCH ANY PHY"
+ #define PHY_ANY_UID 0xffffffff
+
++#define PHY_ID_MATCH_EXACT(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 0)
++#define PHY_ID_MATCH_MODEL(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 4)
++#define PHY_ID_MATCH_VENDOR(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 10)
++
+ /* A Structure for boards to register fixups with the PHY Lib */
+ struct phy_fixup {
+ struct list_head list;
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 30315a03b4abd..9eb656683281f 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -2134,6 +2134,19 @@ static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
+ sk_mem_charge(sk, skb->truesize);
+ }
+
++static inline struct sk_buff *skb_clone_and_charge_r(struct sk_buff *skb, struct sock *sk)
++{
++ skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
++ if (skb) {
++ if (sk_rmem_schedule(sk, skb, skb->truesize)) {
++ skb_set_owner_r(skb, sk);
++ return skb;
++ }
++ __kfree_skb(skb);
++ }
++ return NULL;
++}
++
+ void sk_reset_timer(struct sock *sk, struct timer_list *timer,
+ unsigned long expires);
+
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index e44e737e90a35..35088e830bff8 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -571,7 +571,8 @@ static int queue_pages_hugetlb(pte_t *pte, unsigned long hmask,
+ goto unlock;
+ /* With MPOL_MF_MOVE, we migrate only unshared hugepage. */
+ if (flags & (MPOL_MF_MOVE_ALL) ||
+- (flags & MPOL_MF_MOVE && page_mapcount(page) == 1))
++ (flags & MPOL_MF_MOVE && page_mapcount(page) == 1 &&
++ !hugetlb_pmd_shared(pte)))
+ isolate_huge_page(page, qp->pagelist);
+ unlock:
+ spin_unlock(ptl);
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 057e6907bf7b9..f3b2d694a155a 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -1008,6 +1008,7 @@ start_over:
+ goto check_out;
+ pr_debug("scan_swap_map of si %d failed to find offset\n",
+ si->type);
++ cond_resched();
+
+ spin_lock(&swap_avail_lock);
+ nextsi:
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 32d0b8f14aabb..dea7132f38138 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4235,7 +4235,6 @@ static int bpf_fib_set_fwd_params(struct bpf_fib_lookup *params,
+ memcpy(params->smac, dev->dev_addr, ETH_ALEN);
+ params->h_vlan_TCI = 0;
+ params->h_vlan_proto = 0;
+- params->ifindex = dev->ifindex;
+
+ return 0;
+ }
+@@ -4333,6 +4332,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
+ params->ipv4_dst = nh->nh_gw;
+
+ params->rt_metric = res.fi->fib_priority;
++ params->ifindex = dev->ifindex;
+
+ /* xdp and cls_bpf programs are run in RCU-bh so
+ * rcu_read_lock_bh is not needed here
+@@ -4447,6 +4447,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
+
+ dev = f6i->fib6_nh.nh_dev;
+ params->rt_metric = f6i->fib6_metric;
++ params->ifindex = dev->ifindex;
+
+ /* xdp and cls_bpf programs are run in RCU-bh so rcu_read_lock_bh is
+ * not needed here. Can not use __ipv6_neigh_lookup_noref here
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 72803e1ea10a8..b2a26e41f932f 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -541,11 +541,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
+ *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash), NULL);
+ /* Clone pktoptions received with SYN, if we own the req */
+ if (*own_req && ireq->pktopts) {
+- newnp->pktoptions = skb_clone(ireq->pktopts, GFP_ATOMIC);
++ newnp->pktoptions = skb_clone_and_charge_r(ireq->pktopts, newsk);
+ consume_skb(ireq->pktopts);
+ ireq->pktopts = NULL;
+- if (newnp->pktoptions)
+- skb_set_owner_r(newnp->pktoptions, newsk);
+ }
+
+ return newsk;
+@@ -605,7 +603,7 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+ --ANK (980728)
+ */
+ if (np->rxopt.all)
+- opt_skb = skb_clone(skb, GFP_ATOMIC);
++ opt_skb = skb_clone_and_charge_r(skb, sk);
+
+ if (sk->sk_state == DCCP_OPEN) { /* Fast path */
+ if (dccp_rcv_established(sk, skb, dccp_hdr(skb), skb->len))
+@@ -669,7 +667,6 @@ ipv6_pktoptions:
+ np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
+ if (ipv6_opt_accepted(sk, opt_skb,
+ &DCCP_SKB_CB(opt_skb)->header.h6)) {
+- skb_set_owner_r(opt_skb, sk);
+ memmove(IP6CB(opt_skb),
+ &DCCP_SKB_CB(opt_skb)->header.h6,
+ sizeof(struct inet6_skb_parm));
+diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
+index 727f958dd8695..45ece6a898bf3 100644
+--- a/net/ipv6/datagram.c
++++ b/net/ipv6/datagram.c
+@@ -54,7 +54,7 @@ static void ip6_datagram_flow_key_init(struct flowi6 *fl6, struct sock *sk)
+ fl6->flowi6_mark = sk->sk_mark;
+ fl6->fl6_dport = inet->inet_dport;
+ fl6->fl6_sport = inet->inet_sport;
+- fl6->flowlabel = np->flow_label;
++ fl6->flowlabel = ip6_make_flowinfo(np->tclass, np->flow_label);
+ fl6->flowi6_uid = sk->sk_uid;
+
+ if (!fl6->flowi6_oif)
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index babf69b2403ba..f69c1b83403b7 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -257,6 +257,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
+ fl6.flowi6_proto = IPPROTO_TCP;
+ fl6.daddr = sk->sk_v6_daddr;
+ fl6.saddr = saddr ? *saddr : np->saddr;
++ fl6.flowlabel = ip6_make_flowinfo(np->tclass, np->flow_label);
+ fl6.flowi6_oif = sk->sk_bound_dev_if;
+ fl6.flowi6_mark = sk->sk_mark;
+ fl6.fl6_dport = usin->sin6_port;
+@@ -1268,14 +1269,11 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
+
+ /* Clone pktoptions received with SYN, if we own the req */
+ if (ireq->pktopts) {
+- newnp->pktoptions = skb_clone(ireq->pktopts,
+- sk_gfp_mask(sk, GFP_ATOMIC));
++ newnp->pktoptions = skb_clone_and_charge_r(ireq->pktopts, newsk);
+ consume_skb(ireq->pktopts);
+ ireq->pktopts = NULL;
+- if (newnp->pktoptions) {
++ if (newnp->pktoptions)
+ tcp_v6_restore_cb(newnp->pktoptions);
+- skb_set_owner_r(newnp->pktoptions, newsk);
+- }
+ }
+ } else {
+ if (!req_unhash && found_dup_sk) {
+@@ -1343,7 +1341,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+ --ANK (980728)
+ */
+ if (np->rxopt.all)
+- opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
++ opt_skb = skb_clone_and_charge_r(skb, sk);
+
+ if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+ struct dst_entry *dst;
+@@ -1425,7 +1423,6 @@ ipv6_pktoptions:
+ if (np->repflow)
+ np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
+ if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
+- skb_set_owner_r(opt_skb, sk);
+ tcp_v6_restore_cb(opt_skb);
+ opt_skb = xchg(&np->pktoptions, opt_skb);
+ } else {
+diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
+index ea1745cb93edb..40b3e6a52f926 100644
+--- a/net/mpls/af_mpls.c
++++ b/net/mpls/af_mpls.c
+@@ -1375,6 +1375,7 @@ static int mpls_dev_sysctl_register(struct net_device *dev,
+ free:
+ kfree(table);
+ out:
++ mdev->sysctl = NULL;
+ return -ENOBUFS;
+ }
+
+@@ -1384,6 +1385,9 @@ static void mpls_dev_sysctl_unregister(struct net_device *dev,
+ struct net *net = dev_net(dev);
+ struct ctl_table *table;
+
++ if (!mdev->sysctl)
++ return;
++
+ table = mdev->sysctl->ctl_table_arg;
+ unregister_net_sysctl_table(mdev->sysctl);
+ kfree(table);
+diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c
+index b97ab1198b03f..a0e30bf4a845c 100644
+--- a/net/netfilter/nft_tproxy.c
++++ b/net/netfilter/nft_tproxy.c
+@@ -289,6 +289,13 @@ static int nft_tproxy_dump(struct sk_buff *skb,
+ return 0;
+ }
+
++static int nft_tproxy_validate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr,
++ const struct nft_data **data)
++{
++ return nft_chain_validate_hooks(ctx->chain, 1 << NF_INET_PRE_ROUTING);
++}
++
+ static struct nft_expr_type nft_tproxy_type;
+ static const struct nft_expr_ops nft_tproxy_ops = {
+ .type = &nft_tproxy_type,
+@@ -296,6 +303,7 @@ static const struct nft_expr_ops nft_tproxy_ops = {
+ .eval = nft_tproxy_eval,
+ .init = nft_tproxy_init,
+ .dump = nft_tproxy_dump,
++ .validate = nft_tproxy_validate,
+ };
+
+ static struct nft_expr_type nft_tproxy_type __read_mostly = {
+diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
+index 43910e50752cb..a5d819fa7c899 100644
+--- a/net/netrom/af_netrom.c
++++ b/net/netrom/af_netrom.c
+@@ -403,6 +403,11 @@ static int nr_listen(struct socket *sock, int backlog)
+ struct sock *sk = sock->sk;
+
+ lock_sock(sk);
++ if (sock->state != SS_UNCONNECTED) {
++ release_sock(sk);
++ return -EINVAL;
++ }
++
+ if (sk->sk_state != TCP_LISTEN) {
+ memset(&nr_sk(sk)->user_addr, 0, AX25_ADDR_LEN);
+ sk->sk_max_ack_backlog = backlog;
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index fbc5752472689..0551915519d9f 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -934,14 +934,14 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ key = kzalloc(sizeof(*key), GFP_KERNEL);
+ if (!key) {
+ error = -ENOMEM;
+- goto err_kfree_key;
++ goto err_kfree_flow;
+ }
+
+ ovs_match_init(&match, key, false, &mask);
+ error = ovs_nla_get_match(net, &match, a[OVS_FLOW_ATTR_KEY],
+ a[OVS_FLOW_ATTR_MASK], log);
+ if (error)
+- goto err_kfree_flow;
++ goto err_kfree_key;
+
+ ovs_flow_mask_key(&new_flow->key, key, true, &mask);
+
+@@ -949,14 +949,14 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ error = ovs_nla_get_identifier(&new_flow->id, a[OVS_FLOW_ATTR_UFID],
+ key, log);
+ if (error)
+- goto err_kfree_flow;
++ goto err_kfree_key;
+
+ /* Validate actions. */
+ error = ovs_nla_copy_actions(net, a[OVS_FLOW_ATTR_ACTIONS],
+ &new_flow->key, &acts, log);
+ if (error) {
+ OVS_NLERR(log, "Flow actions may not be safe on all matching packets.");
+- goto err_kfree_flow;
++ goto err_kfree_key;
+ }
+
+ reply = ovs_flow_cmd_alloc_info(acts, &new_flow->id, info, false,
+@@ -1056,10 +1056,10 @@ err_unlock_ovs:
+ kfree_skb(reply);
+ err_kfree_acts:
+ ovs_nla_free_flow_actions(acts);
+-err_kfree_flow:
+- ovs_flow_free(new_flow, false);
+ err_kfree_key:
+ kfree(key);
++err_kfree_flow:
++ ovs_flow_free(new_flow, false);
+ error:
+ return error;
+ }
+diff --git a/net/rds/message.c b/net/rds/message.c
+index 4b00b1152a5f0..309b54cc62ae3 100644
+--- a/net/rds/message.c
++++ b/net/rds/message.c
+@@ -104,9 +104,9 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs,
+ spin_lock_irqsave(&q->lock, flags);
+ head = &q->zcookie_head;
+ if (!list_empty(head)) {
+- info = list_entry(head, struct rds_msg_zcopy_info,
+- rs_zcookie_next);
+- if (info && rds_zcookie_add(info, cookie)) {
++ info = list_first_entry(head, struct rds_msg_zcopy_info,
++ rs_zcookie_next);
++ if (rds_zcookie_add(info, cookie)) {
+ spin_unlock_irqrestore(&q->lock, flags);
+ kfree(rds_info_from_znotifier(znotif));
+ /* caller invokes rds_wake_sk_sleep() */
+diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
+index 03a1ee221112e..4edd127bb8928 100644
+--- a/net/rose/af_rose.c
++++ b/net/rose/af_rose.c
+@@ -490,6 +490,12 @@ static int rose_listen(struct socket *sock, int backlog)
+ {
+ struct sock *sk = sock->sk;
+
++ lock_sock(sk);
++ if (sock->state != SS_UNCONNECTED) {
++ release_sock(sk);
++ return -EINVAL;
++ }
++
+ if (sk->sk_state != TCP_LISTEN) {
+ struct rose_sock *rose = rose_sk(sk);
+
+@@ -499,8 +505,10 @@ static int rose_listen(struct socket *sock, int backlog)
+ memset(rose->dest_digis, 0, AX25_ADDR_LEN * ROSE_MAX_DIGIS);
+ sk->sk_max_ack_backlog = backlog;
+ sk->sk_state = TCP_LISTEN;
++ release_sock(sk);
+ return 0;
+ }
++ release_sock(sk);
+
+ return -EOPNOTSUPP;
+ }
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 77d8adb27ec76..9d0328bb30ca1 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -497,6 +497,12 @@ static int x25_listen(struct socket *sock, int backlog)
+ int rc = -EOPNOTSUPP;
+
+ lock_sock(sk);
++ if (sock->state != SS_UNCONNECTED) {
++ rc = -EINVAL;
++ release_sock(sk);
++ return rc;
++ }
++
+ if (sk->sk_state != TCP_LISTEN) {
+ memset(&x25_sk(sk)->dest_addr, 0, X25_ADDR_LEN);
+ sk->sk_max_ack_backlog = backlog;
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index b1a8ee8cf17e8..69f88d3abf50f 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -1106,6 +1106,7 @@ static const struct hda_device_id snd_hda_id_conexant[] = {
+ HDA_CODEC_ENTRY(0x14f11f86, "CX8070", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f12008, "CX8200", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f120d0, "CX11970", patch_conexant_auto),
++ HDA_CODEC_ENTRY(0x14f120d1, "SN6180", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f15045, "CX20549 (Venice)", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f15047, "CX20551 (Waikiki)", patch_conexant_auto),
+ HDA_CODEC_ENTRY(0x14f15051, "CX20561 (Hermosa)", patch_conexant_auto),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9670db6ad1e1b..9cedb78bffe76 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -771,7 +771,7 @@ do_sku:
+ alc_setup_gpio(codec, 0x02);
+ break;
+ case 7:
+- alc_setup_gpio(codec, 0x03);
++ alc_setup_gpio(codec, 0x04);
+ break;
+ case 5:
+ default:
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index 937155b1fae0f..9e2252eee626e 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -834,6 +834,9 @@ static int add_secret_dac_path(struct hda_codec *codec)
+ return 0;
+ nums = snd_hda_get_connections(codec, spec->gen.mixer_nid, conn,
+ ARRAY_SIZE(conn) - 1);
++ if (nums < 0)
++ return nums;
++
+ for (i = 0; i < nums; i++) {
+ if (get_wcaps_type(get_wcaps(codec, conn[i])) == AC_WID_AUD_OUT)
+ return 0;
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index a80684bdc30d6..46f5362096710 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -508,12 +508,11 @@ int lx_buffer_ask(struct lx6464es *chip, u32 pipe, int is_capture,
+ dev_dbg(chip->card->dev,
+ "CMD_08_ASK_BUFFERS: needed %d, freed %d\n",
+ *r_needed, *r_freed);
+- for (i = 0; i < MAX_STREAM_BUFFER; ++i) {
+- for (i = 0; i != chip->rmh.stat_len; ++i)
+- dev_dbg(chip->card->dev,
+- " stat[%d]: %x, %x\n", i,
+- chip->rmh.stat[i],
+- chip->rmh.stat[i] & MASK_DATA_SIZE);
++ for (i = 0; i < MAX_STREAM_BUFFER && i < chip->rmh.stat_len;
++ ++i) {
++ dev_dbg(chip->card->dev, " stat[%d]: %x, %x\n", i,
++ chip->rmh.stat[i],
++ chip->rmh.stat[i] & MASK_DATA_SIZE);
+ }
+ }
+
+diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c
+index deaad703a7dbf..a4826a7d0a98c 100644
+--- a/sound/soc/codecs/cs42l56.c
++++ b/sound/soc/codecs/cs42l56.c
+@@ -1204,18 +1204,12 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
+ if (pdata) {
+ cs42l56->pdata = *pdata;
+ } else {
+- pdata = devm_kzalloc(&i2c_client->dev, sizeof(*pdata),
+- GFP_KERNEL);
+- if (!pdata)
+- return -ENOMEM;
+-
+ if (i2c_client->dev.of_node) {
+ ret = cs42l56_handle_of_data(i2c_client,
+ &cs42l56->pdata);
+ if (ret != 0)
+ return ret;
+ }
+- cs42l56->pdata = *pdata;
+ }
+
+ if (cs42l56->pdata.gpio_nreset) {
+diff --git a/sound/synth/emux/emux_nrpn.c b/sound/synth/emux/emux_nrpn.c
+index 9729a15b6ae6a..f4aa2706aeb61 100644
+--- a/sound/synth/emux/emux_nrpn.c
++++ b/sound/synth/emux/emux_nrpn.c
+@@ -363,6 +363,9 @@ int
+ snd_emux_xg_control(struct snd_emux_port *port, struct snd_midi_channel *chan,
+ int param)
+ {
++ if (param >= ARRAY_SIZE(chan->control))
++ return -EINVAL;
++
+ return send_converted_effect(xg_effects, ARRAY_SIZE(xg_effects),
+ port, chan, param,
+ chan->control[param],
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index ee03552b41167..7ead9d2aa6b8a 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -519,14 +519,14 @@ sysctl_set()
+ local value=$1; shift
+
+ SYSCTL_ORIG[$key]=$(sysctl -n $key)
+- sysctl -qw $key=$value
++ sysctl -qw $key="$value"
+ }
+
+ sysctl_restore()
+ {
+ local key=$1; shift
+
+- sysctl -qw $key=${SYSCTL_ORIG["$key"]}
++ sysctl -qw $key="${SYSCTL_ORIG[$key]}"
+ }
+
+ forwarding_enable()
+diff --git a/tools/virtio/linux/bug.h b/tools/virtio/linux/bug.h
+index b14c2c3b6b857..74aef964f5099 100644
+--- a/tools/virtio/linux/bug.h
++++ b/tools/virtio/linux/bug.h
+@@ -1,11 +1,9 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef BUG_H
+-#define BUG_H
++#ifndef _LINUX_BUG_H
++#define _LINUX_BUG_H
+
+ #define BUG_ON(__BUG_ON_cond) assert(!(__BUG_ON_cond))
+
+-#define BUILD_BUG_ON(x)
+-
+ #define BUG() abort()
+
+-#endif /* BUG_H */
++#endif /* _LINUX_BUG_H */
+diff --git a/tools/virtio/linux/build_bug.h b/tools/virtio/linux/build_bug.h
+new file mode 100644
+index 0000000000000..cdbb75e28a604
+--- /dev/null
++++ b/tools/virtio/linux/build_bug.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _LINUX_BUILD_BUG_H
++#define _LINUX_BUILD_BUG_H
++
++#define BUILD_BUG_ON(x)
++
++#endif /* _LINUX_BUILD_BUG_H */
+diff --git a/tools/virtio/linux/cpumask.h b/tools/virtio/linux/cpumask.h
+new file mode 100644
+index 0000000000000..307da69d6b26c
+--- /dev/null
++++ b/tools/virtio/linux/cpumask.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _LINUX_CPUMASK_H
++#define _LINUX_CPUMASK_H
++
++#include <linux/kernel.h>
++
++#endif /* _LINUX_CPUMASK_H */
+diff --git a/tools/virtio/linux/gfp.h b/tools/virtio/linux/gfp.h
+new file mode 100644
+index 0000000000000..43d146f236f14
+--- /dev/null
++++ b/tools/virtio/linux/gfp.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __LINUX_GFP_H
++#define __LINUX_GFP_H
++
++#include <linux/topology.h>
++
++#endif
+diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
+index 7ef45a4a3cba7..0dc38fe2a4f16 100644
+--- a/tools/virtio/linux/kernel.h
++++ b/tools/virtio/linux/kernel.h
+@@ -10,6 +10,7 @@
+ #include <stdarg.h>
+
+ #include <linux/compiler.h>
++#include <linux/log2.h>
+ #include <linux/types.h>
+ #include <linux/printk.h>
+ #include <linux/bug.h>
+diff --git a/tools/virtio/linux/kmsan.h b/tools/virtio/linux/kmsan.h
+new file mode 100644
+index 0000000000000..272b5aa285d5a
+--- /dev/null
++++ b/tools/virtio/linux/kmsan.h
+@@ -0,0 +1,12 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _LINUX_KMSAN_H
++#define _LINUX_KMSAN_H
++
++#include <linux/gfp.h>
++
++inline void kmsan_handle_dma(struct page *page, size_t offset, size_t size,
++ enum dma_data_direction dir)
++{
++}
++
++#endif /* _LINUX_KMSAN_H */
+diff --git a/tools/virtio/linux/scatterlist.h b/tools/virtio/linux/scatterlist.h
+index 369ee308b6686..74d9e1825748e 100644
+--- a/tools/virtio/linux/scatterlist.h
++++ b/tools/virtio/linux/scatterlist.h
+@@ -2,6 +2,7 @@
+ #ifndef SCATTERLIST_H
+ #define SCATTERLIST_H
+ #include <linux/kernel.h>
++#include <linux/bug.h>
+
+ struct scatterlist {
+ unsigned long page_link;
+diff --git a/tools/virtio/linux/topology.h b/tools/virtio/linux/topology.h
+new file mode 100644
+index 0000000000000..910794afb993a
+--- /dev/null
++++ b/tools/virtio/linux/topology.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _LINUX_TOPOLOGY_H
++#define _LINUX_TOPOLOGY_H
++
++#include <linux/cpumask.h>
++
++#endif /* _LINUX_TOPOLOGY_H */
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-02-24 3:15 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2023-02-24 3:15 UTC (permalink / raw
To: gentoo-commits
commit: 2b653b5b8ac4e120eda7b1e6daa5c185a939de8c
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 24 03:14:24 2023 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Fri Feb 24 03:14:24 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2b653b5b
Linux patch 1000: fix filename typo
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
1000_linux_4.19.1.patch => 1000_linux-4.19.1.patch | 0
1 file changed, 0 insertions(+), 0 deletions(-)
diff --git a/1000_linux_4.19.1.patch b/1000_linux-4.19.1.patch
similarity index 100%
rename from 1000_linux_4.19.1.patch
rename to 1000_linux-4.19.1.patch
^ permalink raw reply [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-02-24 3:19 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2023-02-24 3:19 UTC (permalink / raw
To: gentoo-commits
commit: 5274ccbf212b5b18ecbb8b5bf48cb21fb556872e
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Fri Feb 24 03:16:34 2023 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Fri Feb 24 03:18:40 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5274ccbf
0000_README: fix typo
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/0000_README b/0000_README
index a6113983..1b1ba3c6 100644
--- a/0000_README
+++ b/0000_README
@@ -319,10 +319,14 @@ Patch: 1068_linux-4.19.69.patch
From: https://www.kernel.org
Desc: Linux 4.19.69
-Patch: 1070_linux-4.19.70.patch
+Patch: 1069_linux-4.19.70.patch
From: https://www.kernel.org
Desc: Linux 4.19.70
+Patch: 1070_linux-4.19.71.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.71
+
Patch: 1071_linux-4.19.72.patch
From: https://www.kernel.org
Desc: Linux 4.19.72
@@ -1047,10 +1051,6 @@ Patch: 1251_linux-4.19.252.patch
From: https://www.kernel.org
Desc: Linux 4.19.252
-Patch: 1251_linux-4.19.252.patch
-From: https://www.kernel.org
-Desc: Linux 4.19.252
-
Patch: 1252_linux-4.19.253.patch
From: https://www.kernel.org
Desc: Linux 4.19.253
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-02-25 11:41 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-02-25 11:41 UTC (permalink / raw
To: gentoo-commits
commit: 9e07b6e5552666d6fb297532cae9d95fb0bf6cd1
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 25 11:41:28 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Feb 25 11:41:28 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9e07b6e5
Linux patch 4.19.274
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1273_linux-4.19.274.patch | 884 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 888 insertions(+)
diff --git a/0000_README b/0000_README
index 1b1ba3c6..1e25b5d8 100644
--- a/0000_README
+++ b/0000_README
@@ -1135,6 +1135,10 @@ Patch: 1272_linux-4.19.273.patch
From: https://www.kernel.org
Desc: Linux 4.19.273
+Patch: 1273_linux-4.19.274.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.274
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1273_linux-4.19.274.patch b/1273_linux-4.19.274.patch
new file mode 100644
index 00000000..1ac5070f
--- /dev/null
+++ b/1273_linux-4.19.274.patch
@@ -0,0 +1,884 @@
+diff --git a/Makefile b/Makefile
+index bbc26e110a13d..273379e3f477e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 273
++SUBLEVEL = 274
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi
+new file mode 100644
+index 0000000000000..437dab3fc0176
+--- /dev/null
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi
+@@ -0,0 +1,44 @@
++// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0-or-later
++/*
++ * QorIQ FMan v3 10g port #2 device tree stub [ controller @ offset 0x400000 ]
++ *
++ * Copyright 2022 Sean Anderson <sean.anderson@seco.com>
++ * Copyright 2012 - 2015 Freescale Semiconductor Inc.
++ */
++
++fman@400000 {
++ fman0_rx_0x08: port@88000 {
++ cell-index = <0x8>;
++ compatible = "fsl,fman-v3-port-rx";
++ reg = <0x88000 0x1000>;
++ fsl,fman-10g-port;
++ };
++
++ fman0_tx_0x28: port@a8000 {
++ cell-index = <0x28>;
++ compatible = "fsl,fman-v3-port-tx";
++ reg = <0xa8000 0x1000>;
++ fsl,fman-10g-port;
++ };
++
++ ethernet@e0000 {
++ cell-index = <0>;
++ compatible = "fsl,fman-memac";
++ reg = <0xe0000 0x1000>;
++ fsl,fman-ports = <&fman0_rx_0x08 &fman0_tx_0x28>;
++ ptp-timer = <&ptp_timer0>;
++ pcsphy-handle = <&pcsphy0>;
++ };
++
++ mdio@e1000 {
++ #address-cells = <1>;
++ #size-cells = <0>;
++ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
++ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
++
++ pcsphy0: ethernet-phy@0 {
++ reg = <0x0>;
++ };
++ };
++};
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi
+new file mode 100644
+index 0000000000000..ad116b17850a8
+--- /dev/null
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi
+@@ -0,0 +1,44 @@
++// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0-or-later
++/*
++ * QorIQ FMan v3 10g port #3 device tree stub [ controller @ offset 0x400000 ]
++ *
++ * Copyright 2022 Sean Anderson <sean.anderson@seco.com>
++ * Copyright 2012 - 2015 Freescale Semiconductor Inc.
++ */
++
++fman@400000 {
++ fman0_rx_0x09: port@89000 {
++ cell-index = <0x9>;
++ compatible = "fsl,fman-v3-port-rx";
++ reg = <0x89000 0x1000>;
++ fsl,fman-10g-port;
++ };
++
++ fman0_tx_0x29: port@a9000 {
++ cell-index = <0x29>;
++ compatible = "fsl,fman-v3-port-tx";
++ reg = <0xa9000 0x1000>;
++ fsl,fman-10g-port;
++ };
++
++ ethernet@e2000 {
++ cell-index = <1>;
++ compatible = "fsl,fman-memac";
++ reg = <0xe2000 0x1000>;
++ fsl,fman-ports = <&fman0_rx_0x09 &fman0_tx_0x29>;
++ ptp-timer = <&ptp_timer0>;
++ pcsphy-handle = <&pcsphy1>;
++ };
++
++ mdio@e3000 {
++ #address-cells = <1>;
++ #size-cells = <0>;
++ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
++ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
++
++ pcsphy1: ethernet-phy@0 {
++ reg = <0x0>;
++ };
++ };
++};
+diff --git a/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi b/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi
+index a97296c64eb22..fda6c9213d9eb 100644
+--- a/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi
++++ b/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi
+@@ -631,8 +631,8 @@
+ /include/ "qoriq-bman1.dtsi"
+
+ /include/ "qoriq-fman3-0.dtsi"
+-/include/ "qoriq-fman3-0-1g-0.dtsi"
+-/include/ "qoriq-fman3-0-1g-1.dtsi"
++/include/ "qoriq-fman3-0-10g-2.dtsi"
++/include/ "qoriq-fman3-0-10g-3.dtsi"
+ /include/ "qoriq-fman3-0-1g-2.dtsi"
+ /include/ "qoriq-fman3-0-1g-3.dtsi"
+ /include/ "qoriq-fman3-0-1g-4.dtsi"
+@@ -681,3 +681,19 @@
+ interrupts = <16 2 1 9>;
+ };
+ };
++
++&fman0_rx_0x08 {
++ /delete-property/ fsl,fman-10g-port;
++};
++
++&fman0_tx_0x28 {
++ /delete-property/ fsl,fman-10g-port;
++};
++
++&fman0_rx_0x09 {
++ /delete-property/ fsl,fman-10g-port;
++};
++
++&fman0_tx_0x29 {
++ /delete-property/ fsl,fman-10g-port;
++};
+diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
+index 40b32b4d1d98b..afbc648befecc 100644
+--- a/drivers/gpu/drm/i915/gvt/gtt.c
++++ b/drivers/gpu/drm/i915/gvt/gtt.c
+@@ -1155,10 +1155,8 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
+ for_each_shadow_entry(sub_spt, &sub_se, sub_index) {
+ ret = intel_gvt_hypervisor_dma_map_guest_page(vgpu,
+ start_gfn + sub_index, PAGE_SIZE, &dma_addr);
+- if (ret) {
+- ppgtt_invalidate_spt(spt);
+- return ret;
+- }
++ if (ret)
++ goto err;
+ sub_se.val64 = se->val64;
+
+ /* Copy the PAT field from PDE. */
+@@ -1177,6 +1175,17 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
+ ops->set_pfn(se, sub_spt->shadow_page.mfn);
+ ppgtt_set_shadow_entry(spt, se, index);
+ return 0;
++err:
++ /* Cancel the existing addess mappings of DMA addr. */
++ for_each_present_shadow_entry(sub_spt, &sub_se, sub_index) {
++ gvt_vdbg_mm("invalidate 4K entry\n");
++ ppgtt_invalidate_pte(sub_spt, &sub_se);
++ }
++ /* Release the new allocated spt. */
++ trace_spt_change(sub_spt->vgpu->id, "release", sub_spt,
++ sub_spt->guest_page.gfn, sub_spt->shadow_page.type);
++ ppgtt_free_spt(sub_spt);
++ return ret;
+ }
+
+ static int split_64KB_gtt_entry(struct intel_vgpu *vgpu,
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index 2764fdd7e84b3..233bbfeaa771e 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -518,6 +518,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev,
+ u8 cmd_no, int channel)
+ {
+ struct kvaser_cmd *cmd;
++ size_t cmd_len;
+ int err;
+
+ cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL);
+@@ -525,6 +526,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev,
+ return -ENOMEM;
+
+ cmd->header.cmd_no = cmd_no;
++ cmd_len = kvaser_usb_hydra_cmd_size(cmd);
+ if (channel < 0) {
+ kvaser_usb_hydra_set_cmd_dest_he
+ (cmd, KVASER_USB_HYDRA_HE_ADDRESS_ILLEGAL);
+@@ -541,7 +543,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev,
+ kvaser_usb_hydra_set_cmd_transid
+ (cmd, kvaser_usb_hydra_get_next_transid(dev));
+
+- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd));
++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len);
+ if (err)
+ goto end;
+
+@@ -557,6 +559,7 @@ kvaser_usb_hydra_send_simple_cmd_async(struct kvaser_usb_net_priv *priv,
+ {
+ struct kvaser_cmd *cmd;
+ struct kvaser_usb *dev = priv->dev;
++ size_t cmd_len;
+ int err;
+
+ cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_ATOMIC);
+@@ -564,14 +567,14 @@ kvaser_usb_hydra_send_simple_cmd_async(struct kvaser_usb_net_priv *priv,
+ return -ENOMEM;
+
+ cmd->header.cmd_no = cmd_no;
++ cmd_len = kvaser_usb_hydra_cmd_size(cmd);
+
+ kvaser_usb_hydra_set_cmd_dest_he
+ (cmd, dev->card_data.hydra.channel_to_he[priv->channel]);
+ kvaser_usb_hydra_set_cmd_transid
+ (cmd, kvaser_usb_hydra_get_next_transid(dev));
+
+- err = kvaser_usb_send_cmd_async(priv, cmd,
+- kvaser_usb_hydra_cmd_size(cmd));
++ err = kvaser_usb_send_cmd_async(priv, cmd, cmd_len);
+ if (err)
+ kfree(cmd);
+
+@@ -715,6 +718,7 @@ static int kvaser_usb_hydra_get_single_capability(struct kvaser_usb *dev,
+ {
+ struct kvaser_usb_dev_card_data *card_data = &dev->card_data;
+ struct kvaser_cmd *cmd;
++ size_t cmd_len;
+ u32 value = 0;
+ u32 mask = 0;
+ u16 cap_cmd_res;
+@@ -726,13 +730,14 @@ static int kvaser_usb_hydra_get_single_capability(struct kvaser_usb *dev,
+ return -ENOMEM;
+
+ cmd->header.cmd_no = CMD_GET_CAPABILITIES_REQ;
++ cmd_len = kvaser_usb_hydra_cmd_size(cmd);
+ cmd->cap_req.cap_cmd = cpu_to_le16(cap_cmd_req);
+
+ kvaser_usb_hydra_set_cmd_dest_he(cmd, card_data->hydra.sysdbg_he);
+ kvaser_usb_hydra_set_cmd_transid
+ (cmd, kvaser_usb_hydra_get_next_transid(dev));
+
+- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd));
++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len);
+ if (err)
+ goto end;
+
+@@ -1555,6 +1560,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv,
+ struct kvaser_usb *dev = priv->dev;
+ struct kvaser_usb_net_hydra_priv *hydra = priv->sub_priv;
+ struct kvaser_cmd *cmd;
++ size_t cmd_len;
+ int err;
+
+ if (!hydra)
+@@ -1565,6 +1571,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv,
+ return -ENOMEM;
+
+ cmd->header.cmd_no = CMD_GET_BUSPARAMS_REQ;
++ cmd_len = kvaser_usb_hydra_cmd_size(cmd);
+ kvaser_usb_hydra_set_cmd_dest_he
+ (cmd, dev->card_data.hydra.channel_to_he[priv->channel]);
+ kvaser_usb_hydra_set_cmd_transid
+@@ -1574,7 +1581,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv,
+
+ reinit_completion(&priv->get_busparams_comp);
+
+- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd));
++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len);
+ if (err)
+ return err;
+
+@@ -1601,6 +1608,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev,
+ struct kvaser_cmd *cmd;
+ struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
+ struct kvaser_usb *dev = priv->dev;
++ size_t cmd_len;
+ int err;
+
+ cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL);
+@@ -1608,6 +1616,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev,
+ return -ENOMEM;
+
+ cmd->header.cmd_no = CMD_SET_BUSPARAMS_REQ;
++ cmd_len = kvaser_usb_hydra_cmd_size(cmd);
+ memcpy(&cmd->set_busparams_req.busparams_nominal, busparams,
+ sizeof(cmd->set_busparams_req.busparams_nominal));
+
+@@ -1616,7 +1625,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev,
+ kvaser_usb_hydra_set_cmd_transid
+ (cmd, kvaser_usb_hydra_get_next_transid(dev));
+
+- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd));
++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len);
+
+ kfree(cmd);
+
+@@ -1629,6 +1638,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev,
+ struct kvaser_cmd *cmd;
+ struct kvaser_usb_net_priv *priv = netdev_priv(netdev);
+ struct kvaser_usb *dev = priv->dev;
++ size_t cmd_len;
+ int err;
+
+ cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL);
+@@ -1636,6 +1646,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev,
+ return -ENOMEM;
+
+ cmd->header.cmd_no = CMD_SET_BUSPARAMS_FD_REQ;
++ cmd_len = kvaser_usb_hydra_cmd_size(cmd);
+ memcpy(&cmd->set_busparams_req.busparams_data, busparams,
+ sizeof(cmd->set_busparams_req.busparams_data));
+
+@@ -1653,7 +1664,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev,
+ kvaser_usb_hydra_set_cmd_transid
+ (cmd, kvaser_usb_hydra_get_next_transid(dev));
+
+- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd));
++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len);
+
+ kfree(cmd);
+
+@@ -1781,6 +1792,7 @@ static int kvaser_usb_hydra_get_software_info(struct kvaser_usb *dev)
+ static int kvaser_usb_hydra_get_software_details(struct kvaser_usb *dev)
+ {
+ struct kvaser_cmd *cmd;
++ size_t cmd_len;
+ int err;
+ u32 flags;
+ struct kvaser_usb_dev_card_data *card_data = &dev->card_data;
+@@ -1790,6 +1802,7 @@ static int kvaser_usb_hydra_get_software_details(struct kvaser_usb *dev)
+ return -ENOMEM;
+
+ cmd->header.cmd_no = CMD_GET_SOFTWARE_DETAILS_REQ;
++ cmd_len = kvaser_usb_hydra_cmd_size(cmd);
+ cmd->sw_detail_req.use_ext_cmd = 1;
+ kvaser_usb_hydra_set_cmd_dest_he
+ (cmd, KVASER_USB_HYDRA_HE_ADDRESS_ILLEGAL);
+@@ -1797,7 +1810,7 @@ static int kvaser_usb_hydra_get_software_details(struct kvaser_usb *dev)
+ kvaser_usb_hydra_set_cmd_transid
+ (cmd, kvaser_usb_hydra_get_next_transid(dev));
+
+- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd));
++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len);
+ if (err)
+ goto end;
+
+@@ -1913,6 +1926,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv)
+ {
+ struct kvaser_usb *dev = priv->dev;
+ struct kvaser_cmd *cmd;
++ size_t cmd_len;
+ int err;
+
+ if ((priv->can.ctrlmode &
+@@ -1928,6 +1942,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv)
+ return -ENOMEM;
+
+ cmd->header.cmd_no = CMD_SET_DRIVERMODE_REQ;
++ cmd_len = kvaser_usb_hydra_cmd_size(cmd);
+ kvaser_usb_hydra_set_cmd_dest_he
+ (cmd, dev->card_data.hydra.channel_to_he[priv->channel]);
+ kvaser_usb_hydra_set_cmd_transid
+@@ -1937,7 +1952,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv)
+ else
+ cmd->set_ctrlmode.mode = KVASER_USB_HYDRA_CTRLMODE_NORMAL;
+
+- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd));
++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len);
+ kfree(cmd);
+
+ return err;
+diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
+index 0773d81072aa1..a484dc6ad30d7 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
++++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
+@@ -58,6 +58,7 @@ static struct memory_type_mapping mem_type_mapping_tbl[] = {
+ };
+
+ static const struct of_device_id mwifiex_sdio_of_match_table[] = {
++ { .compatible = "marvell,sd8787" },
+ { .compatible = "marvell,sd8897" },
+ { .compatible = "marvell,sd8997" },
+ { }
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index c3c8382dd0ba2..e5aac9694ade2 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -4375,12 +4375,9 @@ void rtl8xxxu_gen1_report_connect(struct rtl8xxxu_priv *priv,
+ void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv,
+ u8 macid, bool connect)
+ {
+-#ifdef RTL8XXXU_GEN2_REPORT_CONNECT
+ /*
+- * Barry Day reports this causes issues with 8192eu and 8723bu
+- * devices reconnecting. The reason for this is unclear, but
+- * until it is better understood, leave the code in place but
+- * disabled, so it is not lost.
++ * The firmware turns on the rate control when it knows it's
++ * connected to a network.
+ */
+ struct h2c_cmd h2c;
+
+@@ -4393,7 +4390,6 @@ void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv,
+ h2c.media_status_rpt.parm &= ~BIT(0);
+
+ rtl8xxxu_gen2_h2c_cmd(priv, &h2c, sizeof(h2c.media_status_rpt));
+-#endif
+ }
+
+ void rtl8xxxu_gen1_init_aggregation(struct rtl8xxxu_priv *priv)
+diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c
+index 9212a026a1f12..74722ce7206c2 100644
+--- a/fs/ext4/sysfs.c
++++ b/fs/ext4/sysfs.c
+@@ -349,6 +349,11 @@ static void ext4_sb_release(struct kobject *kobj)
+ complete(&sbi->s_kobj_unregister);
+ }
+
++static void ext4_feat_release(struct kobject *kobj)
++{
++ kfree(kobj);
++}
++
+ static const struct sysfs_ops ext4_attr_ops = {
+ .show = ext4_attr_show,
+ .store = ext4_attr_store,
+@@ -363,7 +368,7 @@ static struct kobj_type ext4_sb_ktype = {
+ static struct kobj_type ext4_feat_ktype = {
+ .default_attrs = ext4_feat_attrs,
+ .sysfs_ops = &ext4_attr_ops,
+- .release = (void (*)(struct kobject *))kfree,
++ .release = ext4_feat_release,
+ };
+
+ static struct kobject *ext4_root;
+diff --git a/include/linux/nospec.h b/include/linux/nospec.h
+index 0c5ef54fd4162..207ef2a20e485 100644
+--- a/include/linux/nospec.h
++++ b/include/linux/nospec.h
+@@ -9,6 +9,10 @@
+
+ struct task_struct;
+
++#ifndef barrier_nospec
++# define barrier_nospec() do { } while (0)
++#endif
++
+ /**
+ * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise
+ * @index: array element index
+diff --git a/include/linux/random.h b/include/linux/random.h
+index 3feafab498ad9..ed75fb2b0ca94 100644
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -19,14 +19,14 @@ void add_input_randomness(unsigned int type, unsigned int code,
+ void add_interrupt_randomness(int irq) __latent_entropy;
+ void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy);
+
+-#if defined(LATENT_ENTROPY_PLUGIN) && !defined(__CHECKER__)
+ static inline void add_latent_entropy(void)
+ {
++#if defined(LATENT_ENTROPY_PLUGIN) && !defined(__CHECKER__)
+ add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy));
+-}
+ #else
+-static inline void add_latent_entropy(void) { }
++ add_device_randomness(NULL, 0);
+ #endif
++}
+
+ void get_random_bytes(void *buf, size_t len);
+ size_t __must_check get_random_bytes_arch(void *buf, size_t len);
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index cbbd0168f50c5..24e16538e4d71 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -32,6 +32,7 @@
+ #include <linux/kallsyms.h>
+ #include <linux/rcupdate.h>
+ #include <linux/perf_event.h>
++#include <linux/nospec.h>
+
+ #include <asm/barrier.h>
+ #include <asm/unaligned.h>
+@@ -1373,9 +1374,7 @@ out:
+ * reuse preexisting logic from Spectre v1 mitigation that
+ * happens to produce the required code on x86 for v4 as well.
+ */
+-#ifdef CONFIG_X86
+ barrier_nospec();
+-#endif
+ CONT;
+ #define LDST(SIZEOP, SIZE) \
+ STX_MEM_##SIZEOP: \
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index 6a2ba39889bd0..56af8a97cf2d0 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -476,11 +476,35 @@ u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval)
+ }
+ EXPORT_SYMBOL_GPL(alarm_forward);
+
+-u64 alarm_forward_now(struct alarm *alarm, ktime_t interval)
++static u64 __alarm_forward_now(struct alarm *alarm, ktime_t interval, bool throttle)
+ {
+ struct alarm_base *base = &alarm_bases[alarm->type];
++ ktime_t now = base->gettime();
++
++ if (IS_ENABLED(CONFIG_HIGH_RES_TIMERS) && throttle) {
++ /*
++ * Same issue as with posix_timer_fn(). Timers which are
++ * periodic but the signal is ignored can starve the system
++ * with a very small interval. The real fix which was
++ * promised in the context of posix_timer_fn() never
++ * materialized, but someone should really work on it.
++ *
++ * To prevent DOS fake @now to be 1 jiffie out which keeps
++ * the overrun accounting correct but creates an
++ * inconsistency vs. timer_gettime(2).
++ */
++ ktime_t kj = NSEC_PER_SEC / HZ;
++
++ if (interval < kj)
++ now = ktime_add(now, kj);
++ }
++
++ return alarm_forward(alarm, now, interval);
++}
+
+- return alarm_forward(alarm, base->gettime(), interval);
++u64 alarm_forward_now(struct alarm *alarm, ktime_t interval)
++{
++ return __alarm_forward_now(alarm, interval, false);
+ }
+ EXPORT_SYMBOL_GPL(alarm_forward_now);
+
+@@ -554,9 +578,10 @@ static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm,
+ if (posix_timer_event(ptr, si_private) && ptr->it_interval) {
+ /*
+ * Handle ignored signals and rearm the timer. This will go
+- * away once we handle ignored signals proper.
++ * away once we handle ignored signals proper. Ensure that
++ * small intervals cannot starve the system.
+ */
+- ptr->it_overrun += alarm_forward_now(alarm, ptr->it_interval);
++ ptr->it_overrun += __alarm_forward_now(alarm, ptr->it_interval, true);
+ ++ptr->it_requeue_pending;
+ ptr->it_active = 1;
+ result = ALARMTIMER_RESTART;
+diff --git a/lib/usercopy.c b/lib/usercopy.c
+index 3744b2a8e591c..1e99c1baf4ff5 100644
+--- a/lib/usercopy.c
++++ b/lib/usercopy.c
+@@ -1,5 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include <linux/uaccess.h>
++#include <linux/nospec.h>
+
+ /* out-of-line parts */
+
+@@ -9,6 +10,12 @@ unsigned long _copy_from_user(void *to, const void __user *from, unsigned long n
+ unsigned long res = n;
+ might_fault();
+ if (likely(access_ok(VERIFY_READ, from, n))) {
++ /*
++ * Ensure that bad access_ok() speculation will not
++ * lead to nasty side effects *after* the copy is
++ * finished:
++ */
++ barrier_nospec();
+ kasan_check_write(to, n);
+ res = raw_copy_from_user(to, from, n);
+ }
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 2c2532196ef60..c5e5e978d3ede 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -627,6 +627,26 @@ struct mesh_csa_settings {
+ struct cfg80211_csa_settings settings;
+ };
+
++/**
++ * struct mesh_table
++ *
++ * @known_gates: list of known mesh gates and their mpaths by the station. The
++ * gate's mpath may or may not be resolved and active.
++ * @gates_lock: protects updates to known_gates
++ * @rhead: the rhashtable containing struct mesh_paths, keyed by dest addr
++ * @walk_head: linked list containing all mesh_path objects
++ * @walk_lock: lock protecting walk_head
++ * @entries: number of entries in the table
++ */
++struct mesh_table {
++ struct hlist_head known_gates;
++ spinlock_t gates_lock;
++ struct rhashtable rhead;
++ struct hlist_head walk_head;
++ spinlock_t walk_lock;
++ atomic_t entries; /* Up to MAX_MESH_NEIGHBOURS */
++};
++
+ struct ieee80211_if_mesh {
+ struct timer_list housekeeping_timer;
+ struct timer_list mesh_path_timer;
+@@ -701,8 +721,8 @@ struct ieee80211_if_mesh {
+ /* offset from skb->data while building IE */
+ int meshconf_offset;
+
+- struct mesh_table *mesh_paths;
+- struct mesh_table *mpp_paths; /* Store paths for MPP&MAP */
++ struct mesh_table mesh_paths;
++ struct mesh_table mpp_paths; /* Store paths for MPP&MAP */
+ int mesh_paths_generation;
+ int mpp_paths_generation;
+ };
+diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
+index e84103b405341..e60444039e766 100644
+--- a/net/mac80211/mesh.h
++++ b/net/mac80211/mesh.h
+@@ -128,26 +128,6 @@ struct mesh_path {
+ bool is_gate;
+ };
+
+-/**
+- * struct mesh_table
+- *
+- * @known_gates: list of known mesh gates and their mpaths by the station. The
+- * gate's mpath may or may not be resolved and active.
+- * @gates_lock: protects updates to known_gates
+- * @rhead: the rhashtable containing struct mesh_paths, keyed by dest addr
+- * @walk_head: linked list containging all mesh_path objects
+- * @walk_lock: lock protecting walk_head
+- * @entries: number of entries in the table
+- */
+-struct mesh_table {
+- struct hlist_head known_gates;
+- spinlock_t gates_lock;
+- struct rhashtable rhead;
+- struct hlist_head walk_head;
+- spinlock_t walk_lock;
+- atomic_t entries; /* Up to MAX_MESH_NEIGHBOURS */
+-};
+-
+ /* Recent multicast cache */
+ /* RMC_BUCKETS must be a power of 2, maximum 256 */
+ #define RMC_BUCKETS 256
+@@ -300,7 +280,7 @@ int mesh_path_error_tx(struct ieee80211_sub_if_data *sdata,
+ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta);
+ void mesh_path_flush_pending(struct mesh_path *mpath);
+ void mesh_path_tx_pending(struct mesh_path *mpath);
+-int mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata);
++void mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata);
+ void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata);
+ int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr);
+ void mesh_path_timer(struct timer_list *t);
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index 71ebdc85755c9..8efb2bf08bf48 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -50,32 +50,24 @@ static void mesh_path_rht_free(void *ptr, void *tblptr)
+ mesh_path_free_rcu(tbl, mpath);
+ }
+
+-static struct mesh_table *mesh_table_alloc(void)
++static void mesh_table_init(struct mesh_table *tbl)
+ {
+- struct mesh_table *newtbl;
++ INIT_HLIST_HEAD(&tbl->known_gates);
++ INIT_HLIST_HEAD(&tbl->walk_head);
++ atomic_set(&tbl->entries, 0);
++ spin_lock_init(&tbl->gates_lock);
++ spin_lock_init(&tbl->walk_lock);
+
+- newtbl = kmalloc(sizeof(struct mesh_table), GFP_ATOMIC);
+- if (!newtbl)
+- return NULL;
+-
+- INIT_HLIST_HEAD(&newtbl->known_gates);
+- INIT_HLIST_HEAD(&newtbl->walk_head);
+- atomic_set(&newtbl->entries, 0);
+- spin_lock_init(&newtbl->gates_lock);
+- spin_lock_init(&newtbl->walk_lock);
+- if (rhashtable_init(&newtbl->rhead, &mesh_rht_params)) {
+- kfree(newtbl);
+- return NULL;
+- }
+-
+- return newtbl;
++ /* rhashtable_init() may fail only in case of wrong
++ * mesh_rht_params
++ */
++ WARN_ON(rhashtable_init(&tbl->rhead, &mesh_rht_params));
+ }
+
+ static void mesh_table_free(struct mesh_table *tbl)
+ {
+ rhashtable_free_and_destroy(&tbl->rhead,
+ mesh_path_rht_free, tbl);
+- kfree(tbl);
+ }
+
+ /**
+@@ -243,13 +235,13 @@ static struct mesh_path *mpath_lookup(struct mesh_table *tbl, const u8 *dst,
+ struct mesh_path *
+ mesh_path_lookup(struct ieee80211_sub_if_data *sdata, const u8 *dst)
+ {
+- return mpath_lookup(sdata->u.mesh.mesh_paths, dst, sdata);
++ return mpath_lookup(&sdata->u.mesh.mesh_paths, dst, sdata);
+ }
+
+ struct mesh_path *
+ mpp_path_lookup(struct ieee80211_sub_if_data *sdata, const u8 *dst)
+ {
+- return mpath_lookup(sdata->u.mesh.mpp_paths, dst, sdata);
++ return mpath_lookup(&sdata->u.mesh.mpp_paths, dst, sdata);
+ }
+
+ static struct mesh_path *
+@@ -286,7 +278,7 @@ __mesh_path_lookup_by_idx(struct mesh_table *tbl, int idx)
+ struct mesh_path *
+ mesh_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx)
+ {
+- return __mesh_path_lookup_by_idx(sdata->u.mesh.mesh_paths, idx);
++ return __mesh_path_lookup_by_idx(&sdata->u.mesh.mesh_paths, idx);
+ }
+
+ /**
+@@ -301,7 +293,7 @@ mesh_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx)
+ struct mesh_path *
+ mpp_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx)
+ {
+- return __mesh_path_lookup_by_idx(sdata->u.mesh.mpp_paths, idx);
++ return __mesh_path_lookup_by_idx(&sdata->u.mesh.mpp_paths, idx);
+ }
+
+ /**
+@@ -314,7 +306,7 @@ int mesh_path_add_gate(struct mesh_path *mpath)
+ int err;
+
+ rcu_read_lock();
+- tbl = mpath->sdata->u.mesh.mesh_paths;
++ tbl = &mpath->sdata->u.mesh.mesh_paths;
+
+ spin_lock_bh(&mpath->state_lock);
+ if (mpath->is_gate) {
+@@ -424,7 +416,7 @@ struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata,
+ if (!new_mpath)
+ return ERR_PTR(-ENOMEM);
+
+- tbl = sdata->u.mesh.mesh_paths;
++ tbl = &sdata->u.mesh.mesh_paths;
+ spin_lock_bh(&tbl->walk_lock);
+ do {
+ ret = rhashtable_lookup_insert_fast(&tbl->rhead,
+@@ -473,7 +465,7 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
+ return -ENOMEM;
+
+ memcpy(new_mpath->mpp, mpp, ETH_ALEN);
+- tbl = sdata->u.mesh.mpp_paths;
++ tbl = &sdata->u.mesh.mpp_paths;
+
+ spin_lock_bh(&tbl->walk_lock);
+ ret = rhashtable_lookup_insert_fast(&tbl->rhead,
+@@ -502,7 +494,7 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
+ void mesh_plink_broken(struct sta_info *sta)
+ {
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+- struct mesh_table *tbl = sdata->u.mesh.mesh_paths;
++ struct mesh_table *tbl = &sdata->u.mesh.mesh_paths;
+ static const u8 bcast[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+ struct mesh_path *mpath;
+
+@@ -561,7 +553,7 @@ static void __mesh_path_del(struct mesh_table *tbl, struct mesh_path *mpath)
+ void mesh_path_flush_by_nexthop(struct sta_info *sta)
+ {
+ struct ieee80211_sub_if_data *sdata = sta->sdata;
+- struct mesh_table *tbl = sdata->u.mesh.mesh_paths;
++ struct mesh_table *tbl = &sdata->u.mesh.mesh_paths;
+ struct mesh_path *mpath;
+ struct hlist_node *n;
+
+@@ -576,7 +568,7 @@ void mesh_path_flush_by_nexthop(struct sta_info *sta)
+ static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata,
+ const u8 *proxy)
+ {
+- struct mesh_table *tbl = sdata->u.mesh.mpp_paths;
++ struct mesh_table *tbl = &sdata->u.mesh.mpp_paths;
+ struct mesh_path *mpath;
+ struct hlist_node *n;
+
+@@ -610,8 +602,8 @@ static void table_flush_by_iface(struct mesh_table *tbl)
+ */
+ void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata)
+ {
+- table_flush_by_iface(sdata->u.mesh.mesh_paths);
+- table_flush_by_iface(sdata->u.mesh.mpp_paths);
++ table_flush_by_iface(&sdata->u.mesh.mesh_paths);
++ table_flush_by_iface(&sdata->u.mesh.mpp_paths);
+ }
+
+ /**
+@@ -657,7 +649,7 @@ int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr)
+ /* flush relevant mpp entries first */
+ mpp_flush_by_proxy(sdata, addr);
+
+- err = table_path_del(sdata->u.mesh.mesh_paths, sdata, addr);
++ err = table_path_del(&sdata->u.mesh.mesh_paths, sdata, addr);
+ sdata->u.mesh.mesh_paths_generation++;
+ return err;
+ }
+@@ -695,7 +687,7 @@ int mesh_path_send_to_gates(struct mesh_path *mpath)
+ struct mesh_path *gate;
+ bool copy = false;
+
+- tbl = sdata->u.mesh.mesh_paths;
++ tbl = &sdata->u.mesh.mesh_paths;
+
+ rcu_read_lock();
+ hlist_for_each_entry_rcu(gate, &tbl->known_gates, gate_list) {
+@@ -775,29 +767,10 @@ void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop)
+ mesh_path_tx_pending(mpath);
+ }
+
+-int mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata)
++void mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata)
+ {
+- struct mesh_table *tbl_path, *tbl_mpp;
+- int ret;
+-
+- tbl_path = mesh_table_alloc();
+- if (!tbl_path)
+- return -ENOMEM;
+-
+- tbl_mpp = mesh_table_alloc();
+- if (!tbl_mpp) {
+- ret = -ENOMEM;
+- goto free_path;
+- }
+-
+- sdata->u.mesh.mesh_paths = tbl_path;
+- sdata->u.mesh.mpp_paths = tbl_mpp;
+-
+- return 0;
+-
+-free_path:
+- mesh_table_free(tbl_path);
+- return ret;
++ mesh_table_init(&sdata->u.mesh.mesh_paths);
++ mesh_table_init(&sdata->u.mesh.mpp_paths);
+ }
+
+ static
+@@ -819,12 +792,12 @@ void mesh_path_tbl_expire(struct ieee80211_sub_if_data *sdata,
+
+ void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
+ {
+- mesh_path_tbl_expire(sdata, sdata->u.mesh.mesh_paths);
+- mesh_path_tbl_expire(sdata, sdata->u.mesh.mpp_paths);
++ mesh_path_tbl_expire(sdata, &sdata->u.mesh.mesh_paths);
++ mesh_path_tbl_expire(sdata, &sdata->u.mesh.mpp_paths);
+ }
+
+ void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata)
+ {
+- mesh_table_free(sdata->u.mesh.mesh_paths);
+- mesh_table_free(sdata->u.mesh.mpp_paths);
++ mesh_table_free(&sdata->u.mesh.mesh_paths);
++ mesh_table_free(&sdata->u.mesh.mpp_paths);
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-03-03 12:31 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-03-03 12:31 UTC (permalink / raw
To: gentoo-commits
commit: ba431c4cbfeb81a4b5568c4c44f0caaa7d5c874e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 3 12:31:35 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Mar 3 12:31:35 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ba431c4c
Linux patch 4.19.275
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1274_linux-4.19.275.patch | 216 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 220 insertions(+)
diff --git a/0000_README b/0000_README
index 1e25b5d8..188ac85d 100644
--- a/0000_README
+++ b/0000_README
@@ -1139,6 +1139,10 @@ Patch: 1273_linux-4.19.274.patch
From: https://www.kernel.org
Desc: Linux 4.19.274
+Patch: 1274_linux-4.19.275.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.275
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1274_linux-4.19.275.patch b/1274_linux-4.19.275.patch
new file mode 100644
index 00000000..cb62ce29
--- /dev/null
+++ b/1274_linux-4.19.275.patch
@@ -0,0 +1,216 @@
+diff --git a/Makefile b/Makefile
+index 273379e3f477e..684987d4984bc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 274
++SUBLEVEL = 275
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
+index e442bf7427ae1..402b5e0fd616c 100644
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -1172,6 +1172,7 @@
+ clock-names = "dp", "pclk";
+ phys = <&edp_phy>;
+ phy-names = "dp";
++ power-domains = <&power RK3288_PD_VIO>;
+ resets = <&cru SRST_EDP>;
+ reset-names = "dp";
+ rockchip,grf = <&grf>;
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 58a756ca14d85..c2863eec0f241 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3442,8 +3442,8 @@ void acpi_nfit_shutdown(void *data)
+
+ mutex_lock(&acpi_desc->init_mutex);
+ set_bit(ARS_CANCEL, &acpi_desc->scrub_flags);
+- cancel_delayed_work_sync(&acpi_desc->dwork);
+ mutex_unlock(&acpi_desc->init_mutex);
++ cancel_delayed_work_sync(&acpi_desc->dwork);
+
+ /*
+ * Bounce the nvdimm bus lock to make sure any in-flight
+diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
+index 29c51762336d7..e18d4116d9abc 100644
+--- a/drivers/dma/sh/rcar-dmac.c
++++ b/drivers/dma/sh/rcar-dmac.c
+@@ -1816,7 +1816,10 @@ static int rcar_dmac_probe(struct platform_device *pdev)
+ dmac->dev = &pdev->dev;
+ platform_set_drvdata(pdev, dmac);
+ dmac->dev->dma_parms = &dmac->parms;
+- dma_set_max_seg_size(dmac->dev, RCAR_DMATCR_MASK);
++ ret = dma_set_max_seg_size(dmac->dev, RCAR_DMATCR_MASK);
++ if (ret)
++ return ret;
++
+ ret = dma_set_mask_and_coherent(dmac->dev, DMA_BIT_MASK(40));
+ if (ret)
+ return ret;
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+index dab823aac95e1..2619a7a9f27cf 100644
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+@@ -215,16 +215,11 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd,
+ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
+ {
+ int pinned;
+- unsigned int npages;
++ unsigned int npages = tidbuf->npages;
+ unsigned long vaddr = tidbuf->vaddr;
+ struct page **pages = NULL;
+ struct hfi1_devdata *dd = fd->uctxt->dd;
+
+- /* Get the number of pages the user buffer spans */
+- npages = num_user_pages(vaddr, tidbuf->length);
+- if (!npages)
+- return -EINVAL;
+-
+ if (npages > fd->uctxt->expected_count) {
+ dd_dev_err(dd, "Expected buffer too big\n");
+ return -EINVAL;
+@@ -258,7 +253,6 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
+ return pinned;
+ }
+ tidbuf->pages = pages;
+- tidbuf->npages = npages;
+ fd->tid_n_pinned += pinned;
+ return pinned;
+ }
+@@ -334,6 +328,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,
+
+ tidbuf->vaddr = tinfo->vaddr;
+ tidbuf->length = tinfo->length;
++ tidbuf->npages = num_user_pages(tidbuf->vaddr, tidbuf->length);
+ tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets),
+ GFP_KERNEL);
+ if (!tidbuf->psets) {
+diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
+index 03fe692d940b8..5b5e800ab1549 100644
+--- a/drivers/tty/vt/vc_screen.c
++++ b/drivers/tty/vt/vc_screen.c
+@@ -266,10 +266,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+ ssize_t orig_count;
+ long p = pos;
+
+- ret = -ENXIO;
+ vc = vcs_vc(inode, &viewed);
+- if (!vc)
+- goto unlock_out;
++ if (!vc) {
++ ret = -ENXIO;
++ break;
++ }
+
+ /* Check whether we are above size each round,
+ * as copy_to_user at the end of this loop
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index af9fe76745c36..619e807838660 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2345,9 +2345,8 @@ static int usb_enumerate_device_otg(struct usb_device *udev)
+ * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal)
+ * @udev: newly addressed device (in ADDRESS state)
+ *
+- * This is only called by usb_new_device() and usb_authorize_device()
+- * and FIXME -- all comments that apply to them apply here wrt to
+- * environment.
++ * This is only called by usb_new_device() -- all comments that apply there
++ * apply here wrt to environment.
+ *
+ * If the device is WUSB and not authorized, we don't attempt to read
+ * the string descriptors, as they will be errored out by the device
+diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
+index b93b18ba89df6..7e88fdfe3cf5c 100644
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -888,11 +888,7 @@ read_descriptors(struct file *filp, struct kobject *kobj,
+ size_t srclen, n;
+ int cfgno;
+ void *src;
+- int retval;
+
+- retval = usb_lock_device_interruptible(udev);
+- if (retval < 0)
+- return -EINTR;
+ /* The binary attribute begins with the device descriptor.
+ * Following that are the raw descriptor entries for all the
+ * configurations (config plus subsidiary descriptors).
+@@ -917,7 +913,6 @@ read_descriptors(struct file *filp, struct kobject *kobj,
+ off -= srclen;
+ }
+ }
+- usb_unlock_device(udev);
+ return count - nleft;
+ }
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 48b66656dca8e..17cfa0fd6175b 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -402,6 +402,8 @@ static void option_instat_callback(struct urb *urb);
+ #define LONGCHEER_VENDOR_ID 0x1c9e
+
+ /* 4G Systems products */
++/* This one was sold as the VW and Skoda "Carstick LTE" */
++#define FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE 0x7605
+ /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick *
+ * It seems to contain a Qualcomm QSC6240/6290 chipset */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603
+@@ -1976,6 +1978,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(2) },
+ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
++ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE),
++ .driver_info = RSVD(0) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+ .driver_info = NCTRL(0) | NCTRL(1) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100),
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 80d248e88761d..1f535cd990d3c 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -6826,10 +6826,10 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg)
+ /*
+ * Check that we don't overflow at later allocations, we request
+ * clone_sources_count + 1 items, and compare to unsigned long inside
+- * access_ok.
++ * access_ok. Also set an upper limit for allocation size so this can't
++ * easily exhaust memory. Max number of clone sources is about 200K.
+ */
+- if (arg->clone_sources_count >
+- ULONG_MAX / sizeof(struct clone_root) - 1) {
++ if (arg->clone_sources_count > SZ_8M / sizeof(struct clone_root)) {
+ ret = -EINVAL;
+ goto out;
+ }
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index 348b8cb0bc24c..cab0b239f96a1 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -1022,6 +1022,7 @@ static void caif_sock_destructor(struct sock *sk)
+ return;
+ }
+ sk_stream_kill_queues(&cf_sk->sk);
++ WARN_ON(sk->sk_forward_alloc);
+ caif_free_client(&cf_sk->layer);
+ }
+
+diff --git a/net/core/stream.c b/net/core/stream.c
+index 58755528d39e1..23e6669d3f8d2 100644
+--- a/net/core/stream.c
++++ b/net/core/stream.c
+@@ -209,7 +209,6 @@ void sk_stream_kill_queues(struct sock *sk)
+ sk_mem_reclaim(sk);
+
+ WARN_ON(sk->sk_wmem_queued);
+- WARN_ON(sk->sk_forward_alloc);
+
+ /* It is _impossible_ for the backlog to contain anything
+ * when we get here. All user references to this socket
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-03-11 16:01 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-03-11 16:01 UTC (permalink / raw
To: gentoo-commits
commit: d70163942d7b0fbdd8d112fffffd6cc5f7785190
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Mar 11 16:01:06 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Mar 11 16:01:06 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d7016394
Linux patch 4.19.276
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1275_linux-4.19.276.patch | 8204 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 8208 insertions(+)
diff --git a/0000_README b/0000_README
index 188ac85d..c7c15e36 100644
--- a/0000_README
+++ b/0000_README
@@ -1143,6 +1143,10 @@ Patch: 1274_linux-4.19.275.patch
From: https://www.kernel.org
Desc: Linux 4.19.275
+Patch: 1275_linux-4.19.276.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.276
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1275_linux-4.19.276.patch b/1275_linux-4.19.276.patch
new file mode 100644
index 00000000..f1b104bc
--- /dev/null
+++ b/1275_linux-4.19.276.patch
@@ -0,0 +1,8204 @@
+diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst
+index 7e061ed449aaa..0fba3758d0da8 100644
+--- a/Documentation/admin-guide/hw-vuln/spectre.rst
++++ b/Documentation/admin-guide/hw-vuln/spectre.rst
+@@ -479,8 +479,16 @@ Spectre variant 2
+ On Intel Skylake-era systems the mitigation covers most, but not all,
+ cases. See :ref:`[3] <spec_ref3>` for more details.
+
+- On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced
+- IBRS on x86), retpoline is automatically disabled at run time.
++ On CPUs with hardware mitigation for Spectre variant 2 (e.g. IBRS
++ or enhanced IBRS on x86), retpoline is automatically disabled at run time.
++
++ Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at
++ boot, by setting the IBRS bit, and they're automatically protected against
++ Spectre v2 variant attacks, including cross-thread branch target injections
++ on SMT systems (STIBP). In other words, eIBRS enables STIBP too.
++
++ Legacy IBRS systems clear the IBRS bit on exit to userspace and
++ therefore explicitly enable STIBP for that
+
+ The retpoline mitigation is turned on by default on vulnerable
+ CPUs. It can be forced on or off by the administrator
+@@ -504,9 +512,12 @@ Spectre variant 2
+ For Spectre variant 2 mitigation, individual user programs
+ can be compiled with return trampolines for indirect branches.
+ This protects them from consuming poisoned entries in the branch
+- target buffer left by malicious software. Alternatively, the
+- programs can disable their indirect branch speculation via prctl()
+- (See :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
++ target buffer left by malicious software.
++
++ On legacy IBRS systems, at return to userspace, implicit STIBP is disabled
++ because the kernel clears the IBRS bit. In this case, the userspace programs
++ can disable indirect branch speculation via prctl() (See
++ :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`).
+ On x86, this will turn on STIBP to guard against attacks from the
+ sibling thread when the user program is running, and use IBPB to
+ flush the branch target buffer when switching to/from the program.
+diff --git a/Documentation/dev-tools/gdb-kernel-debugging.rst b/Documentation/dev-tools/gdb-kernel-debugging.rst
+index 19df79286f000..afe4bc206486c 100644
+--- a/Documentation/dev-tools/gdb-kernel-debugging.rst
++++ b/Documentation/dev-tools/gdb-kernel-debugging.rst
+@@ -39,6 +39,10 @@ Setup
+ this mode. In this case, you should build the kernel with
+ CONFIG_RANDOMIZE_BASE disabled if the architecture supports KASLR.
+
++- Build the gdb scripts (required on kernels v5.1 and above)::
++
++ make scripts_gdb
++
+ - Enable the gdb stub of QEMU/KVM, either
+
+ - at VM startup time by appending "-s" to the QEMU command line
+diff --git a/Makefile b/Makefile
+index 684987d4984bc..7f6669dae46b9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 275
++SUBLEVEL = 276
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -88,10 +88,17 @@ endif
+
+ # If the user is running make -s (silent mode), suppress echoing of
+ # commands
++# make-4.0 (and later) keep single letter options in the 1st word of MAKEFLAGS.
+
+-ifneq ($(findstring s,$(filter-out --%,$(MAKEFLAGS))),)
+- quiet=silent_
+- tools_silent=s
++ifeq ($(filter 3.%,$(MAKE_VERSION)),)
++silence:=$(findstring s,$(firstword -$(MAKEFLAGS)))
++else
++silence:=$(findstring s,$(filter-out --%,$(MAKEFLAGS)))
++endif
++
++ifeq ($(silence),s)
++quiet=silent_
++tools_silent=s
+ endif
+
+ export quiet Q KBUILD_VERBOSE
+diff --git a/arch/alpha/kernel/traps.c b/arch/alpha/kernel/traps.c
+index 22f5c27b96b7c..e2c96f309881c 100644
+--- a/arch/alpha/kernel/traps.c
++++ b/arch/alpha/kernel/traps.c
+@@ -235,7 +235,21 @@ do_entIF(unsigned long type, struct pt_regs *regs)
+ {
+ int signo, code;
+
+- if ((regs->ps & ~IPL_MAX) == 0) {
++ if (type == 3) { /* FEN fault */
++ /* Irritating users can call PAL_clrfen to disable the
++ FPU for the process. The kernel will then trap in
++ do_switch_stack and undo_switch_stack when we try
++ to save and restore the FP registers.
++
++ Given that GCC by default generates code that uses the
++ FP registers, PAL_clrfen is not useful except for DoS
++ attacks. So turn the bleeding FPU back on and be done
++ with it. */
++ current_thread_info()->pcb.flags |= 1;
++ __reload_thread(¤t_thread_info()->pcb);
++ return;
++ }
++ if (!user_mode(regs)) {
+ if (type == 1) {
+ const unsigned int *data
+ = (const unsigned int *) regs->pc;
+@@ -368,20 +382,6 @@ do_entIF(unsigned long type, struct pt_regs *regs)
+ }
+ break;
+
+- case 3: /* FEN fault */
+- /* Irritating users can call PAL_clrfen to disable the
+- FPU for the process. The kernel will then trap in
+- do_switch_stack and undo_switch_stack when we try
+- to save and restore the FP registers.
+-
+- Given that GCC by default generates code that uses the
+- FP registers, PAL_clrfen is not useful except for DoS
+- attacks. So turn the bleeding FPU back on and be done
+- with it. */
+- current_thread_info()->pcb.flags |= 1;
+- __reload_thread(¤t_thread_info()->pcb);
+- return;
+-
+ case 5: /* illoc */
+ default: /* unexpected instruction-fault type */
+ ;
+diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts
+index 29df4cfa9165f..e398604b2ce0f 100644
+--- a/arch/arm/boot/dts/exynos3250-rinato.dts
++++ b/arch/arm/boot/dts/exynos3250-rinato.dts
+@@ -237,7 +237,7 @@
+ i80-if-timings {
+ cs-setup = <0>;
+ wr-setup = <0>;
+- wr-act = <1>;
++ wr-active = <1>;
+ wr-hold = <0>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi
+index 021d9fc1b4923..27a1a89526655 100644
+--- a/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi
++++ b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi
+@@ -10,7 +10,7 @@
+ / {
+ thermal-zones {
+ cpu_thermal: cpu-thermal {
+- thermal-sensors = <&tmu 0>;
++ thermal-sensors = <&tmu>;
+ polling-delay-passive = <0>;
+ polling-delay = <0>;
+ trips {
+diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi
+index 6085e92ac2d73..3f7488833745d 100644
+--- a/arch/arm/boot/dts/exynos4.dtsi
++++ b/arch/arm/boot/dts/exynos4.dtsi
+@@ -611,7 +611,7 @@
+ status = "disabled";
+
+ hdmi_i2c_phy: hdmiphy@38 {
+- compatible = "exynos4210-hdmiphy";
++ compatible = "samsung,exynos4210-hdmiphy";
+ reg = <0x38>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/exynos5410-odroidxu.dts b/arch/arm/boot/dts/exynos5410-odroidxu.dts
+index 840a854ee8385..8a7c98f8d4eb6 100644
+--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
+@@ -113,7 +113,6 @@
+ };
+
+ &cpu0_thermal {
+- thermal-sensors = <&tmu_cpu0 0>;
+ polling-delay-passive = <0>;
+ polling-delay = <0>;
+
+diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi
+index aaff158807613..99e2e0b0b9cd4 100644
+--- a/arch/arm/boot/dts/exynos5420.dtsi
++++ b/arch/arm/boot/dts/exynos5420.dtsi
+@@ -530,7 +530,7 @@
+ };
+
+ mipi_phy: mipi-video-phy {
+- compatible = "samsung,s5pv210-mipi-video-phy";
++ compatible = "samsung,exynos5420-mipi-video-phy";
+ syscon = <&pmu_system_controller>;
+ #phy-cells = <1>;
+ };
+diff --git a/arch/arm/boot/dts/spear320-hmi.dts b/arch/arm/boot/dts/spear320-hmi.dts
+index 0d0da1f65f0e6..1e54748799a6b 100644
+--- a/arch/arm/boot/dts/spear320-hmi.dts
++++ b/arch/arm/boot/dts/spear320-hmi.dts
+@@ -248,7 +248,7 @@
+ irq-trigger = <0x1>;
+
+ stmpegpio: stmpe-gpio {
+- compatible = "stmpe,gpio";
++ compatible = "st,stmpe-gpio";
+ reg = <0>;
+ gpio-controller;
+ #gpio-cells = <2>;
+diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
+index 14be73ca107a5..965a41572283e 100644
+--- a/arch/arm/mach-imx/mmdc.c
++++ b/arch/arm/mach-imx/mmdc.c
+@@ -105,6 +105,7 @@ struct mmdc_pmu {
+ cpumask_t cpu;
+ struct hrtimer hrtimer;
+ unsigned int active_events;
++ int id;
+ struct device *dev;
+ struct perf_event *mmdc_events[MMDC_NUM_COUNTERS];
+ struct hlist_node node;
+@@ -445,8 +446,6 @@ static enum hrtimer_restart mmdc_pmu_timer_handler(struct hrtimer *hrtimer)
+ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc,
+ void __iomem *mmdc_base, struct device *dev)
+ {
+- int mmdc_num;
+-
+ *pmu_mmdc = (struct mmdc_pmu) {
+ .pmu = (struct pmu) {
+ .task_ctx_nr = perf_invalid_context,
+@@ -463,15 +462,16 @@ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc,
+ .active_events = 0,
+ };
+
+- mmdc_num = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL);
++ pmu_mmdc->id = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL);
+
+- return mmdc_num;
++ return pmu_mmdc->id;
+ }
+
+ static int imx_mmdc_remove(struct platform_device *pdev)
+ {
+ struct mmdc_pmu *pmu_mmdc = platform_get_drvdata(pdev);
+
++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id);
+ cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
+ perf_pmu_unregister(&pmu_mmdc->pmu);
+ iounmap(pmu_mmdc->mmdc_base);
+@@ -485,7 +485,6 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
+ {
+ struct mmdc_pmu *pmu_mmdc;
+ char *name;
+- int mmdc_num;
+ int ret;
+ const struct of_device_id *of_id =
+ of_match_device(imx_mmdc_dt_ids, &pdev->dev);
+@@ -508,14 +507,14 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
+ cpuhp_mmdc_state = ret;
+ }
+
+- mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev);
+- pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;
+- if (mmdc_num == 0)
+- name = "mmdc";
+- else
+- name = devm_kasprintf(&pdev->dev,
+- GFP_KERNEL, "mmdc%d", mmdc_num);
++ ret = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev);
++ if (ret < 0)
++ goto pmu_free;
+
++ name = devm_kasprintf(&pdev->dev,
++ GFP_KERNEL, "mmdc%d", ret);
++
++ pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;
+ pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data;
+
+ hrtimer_init(&pmu_mmdc->hrtimer, CLOCK_MONOTONIC,
+@@ -536,6 +535,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
+
+ pmu_register_err:
+ pr_warn("MMDC Perf PMU failed (%d), disabled\n", ret);
++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id);
+ cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
+ hrtimer_cancel(&pmu_mmdc->hrtimer);
+ pmu_free:
+diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c
+index 4447210c9b0d8..291bc376d30e8 100644
+--- a/arch/arm/mach-omap1/timer.c
++++ b/arch/arm/mach-omap1/timer.c
+@@ -165,7 +165,7 @@ err_free_pdata:
+ kfree(pdata);
+
+ err_free_pdev:
+- platform_device_unregister(pdev);
++ platform_device_put(pdev);
+
+ return ret;
+ }
+diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
+index c4ba848e8af62..d98aa78b9be91 100644
+--- a/arch/arm/mach-omap2/timer.c
++++ b/arch/arm/mach-omap2/timer.c
+@@ -701,6 +701,7 @@ static void __init realtime_counter_init(void)
+ }
+
+ rate = clk_get_rate(sys_clk);
++ clk_put(sys_clk);
+
+ if (soc_is_dra7xx()) {
+ /*
+diff --git a/arch/arm/mach-zynq/slcr.c b/arch/arm/mach-zynq/slcr.c
+index f0292a30e6f69..6b75ef7be3fda 100644
+--- a/arch/arm/mach-zynq/slcr.c
++++ b/arch/arm/mach-zynq/slcr.c
+@@ -222,6 +222,7 @@ int __init zynq_early_slcr_init(void)
+ zynq_slcr_regmap = syscon_regmap_lookup_by_compatible("xlnx,zynq-slcr");
+ if (IS_ERR(zynq_slcr_regmap)) {
+ pr_err("%s: failed to find zynq-slcr\n", __func__);
++ of_node_put(np);
+ return -ENODEV;
+ }
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+index 90e9cbcc891f2..d5f2f7593c67e 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi
+@@ -47,6 +47,7 @@
+ reg = <0x0 0x0>;
+ enable-method = "psci";
+ next-level-cache = <&l2>;
++ clocks = <&scpi_dvfs 0>;
+ };
+
+ cpu1: cpu@1 {
+@@ -55,6 +56,7 @@
+ reg = <0x0 0x1>;
+ enable-method = "psci";
+ next-level-cache = <&l2>;
++ clocks = <&scpi_dvfs 0>;
+ };
+
+ cpu2: cpu@2 {
+@@ -63,6 +65,7 @@
+ reg = <0x0 0x2>;
+ enable-method = "psci";
+ next-level-cache = <&l2>;
++ clocks = <&scpi_dvfs 0>;
+ };
+
+ cpu3: cpu@3 {
+@@ -71,6 +74,7 @@
+ reg = <0x0 0x3>;
+ enable-method = "psci";
+ next-level-cache = <&l2>;
++ clocks = <&scpi_dvfs 0>;
+ };
+
+ l2: l2-cache0 {
+@@ -151,6 +155,28 @@
+ #clock-cells = <0>;
+ };
+
++ scpi {
++ compatible = "arm,scpi-pre-1.0";
++ mboxes = <&mailbox 1 &mailbox 2>;
++ shmem = <&cpu_scp_lpri &cpu_scp_hpri>;
++
++ scpi_clocks: clocks {
++ compatible = "arm,scpi-clocks";
++
++ scpi_dvfs: clocks-0 {
++ compatible = "arm,scpi-dvfs-clocks";
++ #clock-cells = <1>;
++ clock-indices = <0>;
++ clock-output-names = "vcpu";
++ };
++ };
++
++ scpi_sensors: sensors {
++ compatible = "amlogic,meson-gxbb-scpi-sensors", "arm,scpi-sensors";
++ #thermal-sensor-cells = <1>;
++ };
++ };
++
+ soc {
+ compatible = "simple-bus";
+ #address-cells = <2>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+index a127657526c7f..c167023ca1db7 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+@@ -150,7 +150,7 @@
+ reg = <0x14 0x10>;
+ };
+
+- eth_mac: eth_mac@34 {
++ eth_mac: eth-mac@34 {
+ reg = <0x34 0x10>;
+ };
+
+@@ -167,7 +167,7 @@
+ scpi_clocks: clocks {
+ compatible = "arm,scpi-clocks";
+
+- scpi_dvfs: scpi_clocks@0 {
++ scpi_dvfs: clocks-0 {
+ compatible = "arm,scpi-dvfs-clocks";
+ #clock-cells = <1>;
+ clock-indices = <0>;
+@@ -423,7 +423,7 @@
+ #size-cells = <2>;
+ ranges = <0x0 0x0 0x0 0xc8834000 0x0 0x2000>;
+
+- hwrng: rng {
++ hwrng: rng@0 {
+ compatible = "amlogic,meson-rng";
+ reg = <0x0 0x0 0x0 0x4>;
+ };
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+index 5d7724b3a6123..f999a92d174b7 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+@@ -636,7 +636,7 @@
+ };
+ };
+
+- eth-phy-mux {
++ eth-phy-mux@55c {
+ compatible = "mdio-mux-mmioreg", "mdio-mux";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+index 2bcee994898a2..5cb0470ede723 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -380,6 +380,7 @@
+ pwm: pwm@11006000 {
+ compatible = "mediatek,mt7622-pwm";
+ reg = <0 0x11006000 0 0x1000>;
++ #pwm-cells = <2>;
+ interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_LOW>;
+ clocks = <&topckgen CLK_TOP_PWM_SEL>,
+ <&pericfg CLK_PERI_PWM_PD>,
+diff --git a/arch/m68k/68000/entry.S b/arch/m68k/68000/entry.S
+index 259b3661b6141..94abf3d8afc52 100644
+--- a/arch/m68k/68000/entry.S
++++ b/arch/m68k/68000/entry.S
+@@ -47,6 +47,8 @@ do_trace:
+ jbsr syscall_trace_enter
+ RESTORE_SWITCH_STACK
+ addql #4,%sp
++ addql #1,%d0
++ jeq ret_from_exception
+ movel %sp@(PT_OFF_ORIG_D0),%d1
+ movel #-ENOSYS,%d0
+ cmpl #NR_syscalls,%d1
+diff --git a/arch/m68k/Kconfig.devices b/arch/m68k/Kconfig.devices
+index 3e9b0b826f8a1..6fb693bb0771c 100644
+--- a/arch/m68k/Kconfig.devices
++++ b/arch/m68k/Kconfig.devices
+@@ -19,6 +19,7 @@ config HEARTBEAT
+ # We have a dedicated heartbeat LED. :-)
+ config PROC_HARDWARE
+ bool "/proc/hardware support"
++ depends on PROC_FS
+ help
+ Say Y here to support the /proc/hardware file, which gives you
+ access to information about the machine you're running on,
+diff --git a/arch/m68k/coldfire/entry.S b/arch/m68k/coldfire/entry.S
+index 52d312d5b4d4f..fb3b065677459 100644
+--- a/arch/m68k/coldfire/entry.S
++++ b/arch/m68k/coldfire/entry.S
+@@ -92,6 +92,8 @@ ENTRY(system_call)
+ jbsr syscall_trace_enter
+ RESTORE_SWITCH_STACK
+ addql #4,%sp
++ addql #1,%d0
++ jeq ret_from_exception
+ movel %d3,%a0
+ jbsr %a0@
+ movel %d0,%sp@(PT_OFF_D0) /* save the return value */
+diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S
+index 97cd3ea5f10b8..9a66657773beb 100644
+--- a/arch/m68k/kernel/entry.S
++++ b/arch/m68k/kernel/entry.S
+@@ -160,9 +160,12 @@ do_trace_entry:
+ jbsr syscall_trace
+ RESTORE_SWITCH_STACK
+ addql #4,%sp
++ addql #1,%d0 | optimization for cmpil #-1,%d0
++ jeq ret_from_syscall
+ movel %sp@(PT_OFF_ORIG_D0),%d0
+ cmpl #NR_syscalls,%d0
+ jcs syscall
++ jra ret_from_syscall
+ badsys:
+ movel #-ENOSYS,%sp@(PT_OFF_D0)
+ jra ret_from_syscall
+diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
+index 6cf8ffb5367ec..94d8c945ea8eb 100644
+--- a/arch/mips/include/asm/syscall.h
++++ b/arch/mips/include/asm/syscall.h
+@@ -38,7 +38,7 @@ static inline bool mips_syscall_is_indirect(struct task_struct *task,
+ static inline long syscall_get_nr(struct task_struct *task,
+ struct pt_regs *regs)
+ {
+- return current_thread_info()->syscall;
++ return task_thread_info(task)->syscall;
+ }
+
+ static inline void mips_syscall_update_nr(struct task_struct *task,
+diff --git a/arch/mips/include/asm/vpe.h b/arch/mips/include/asm/vpe.h
+index 80e70dbd1f641..012731546cf60 100644
+--- a/arch/mips/include/asm/vpe.h
++++ b/arch/mips/include/asm/vpe.h
+@@ -104,7 +104,6 @@ struct vpe_control {
+ struct list_head tc_list; /* Thread contexts */
+ };
+
+-extern unsigned long physical_memsize;
+ extern struct vpe_control vpecontrol;
+ extern const struct file_operations vpe_fops;
+
+diff --git a/arch/mips/kernel/vpe-mt.c b/arch/mips/kernel/vpe-mt.c
+index 9fd7cd48ea1d2..496ed8f362f62 100644
+--- a/arch/mips/kernel/vpe-mt.c
++++ b/arch/mips/kernel/vpe-mt.c
+@@ -92,12 +92,11 @@ int vpe_run(struct vpe *v)
+ write_tc_c0_tchalt(read_tc_c0_tchalt() & ~TCHALT_H);
+
+ /*
+- * The sde-kit passes 'memsize' to __start in $a3, so set something
+- * here... Or set $a3 to zero and define DFLT_STACK_SIZE and
+- * DFLT_HEAP_SIZE when you compile your program
++ * We don't pass the memsize here, so VPE programs need to be
++ * compiled with DFLT_STACK_SIZE and DFLT_HEAP_SIZE defined.
+ */
++ mttgpr(7, 0);
+ mttgpr(6, v->ntcs);
+- mttgpr(7, physical_memsize);
+
+ /* set up VPE1 */
+ /*
+diff --git a/arch/mips/lantiq/prom.c b/arch/mips/lantiq/prom.c
+index dceab67e481a8..02cf9b27b7859 100644
+--- a/arch/mips/lantiq/prom.c
++++ b/arch/mips/lantiq/prom.c
+@@ -24,12 +24,6 @@
+ DEFINE_SPINLOCK(ebu_lock);
+ EXPORT_SYMBOL_GPL(ebu_lock);
+
+-/*
+- * This is needed by the VPE loader code, just set it to 0 and assume
+- * that the firmware hardcodes this value to something useful.
+- */
+-unsigned long physical_memsize = 0L;
+-
+ /*
+ * this struct is filled by the soc specific detection code and holds
+ * information about the specific soc type, revision and name
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 5987ae0d8fbbb..9b33cd4e0e177 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -109,7 +109,7 @@ aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mlittle-endian
+
+ ifeq ($(HAS_BIARCH),y)
+ KBUILD_CFLAGS += -m$(BITS)
+-KBUILD_AFLAGS += -m$(BITS) -Wl,-a$(BITS)
++KBUILD_AFLAGS += -m$(BITS)
+ KBUILD_LDFLAGS += -m elf$(BITS)$(LDEMULATION)
+ KBUILD_ARFLAGS += --target=elf$(BITS)-$(GNUTARGET)
+ endif
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index a3f08a380c992..7c7648e6f1c22 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -54,10 +54,10 @@ struct rtas_t rtas = {
+ EXPORT_SYMBOL(rtas);
+
+ DEFINE_SPINLOCK(rtas_data_buf_lock);
+-EXPORT_SYMBOL(rtas_data_buf_lock);
++EXPORT_SYMBOL_GPL(rtas_data_buf_lock);
+
+-char rtas_data_buf[RTAS_DATA_BUF_SIZE] __cacheline_aligned;
+-EXPORT_SYMBOL(rtas_data_buf);
++char rtas_data_buf[RTAS_DATA_BUF_SIZE] __aligned(SZ_4K);
++EXPORT_SYMBOL_GPL(rtas_data_buf);
+
+ unsigned long rtas_rmo_buf;
+
+@@ -66,7 +66,7 @@ unsigned long rtas_rmo_buf;
+ * This is done like this so rtas_flash can be a module.
+ */
+ void (*rtas_flash_term_hook)(int);
+-EXPORT_SYMBOL(rtas_flash_term_hook);
++EXPORT_SYMBOL_GPL(rtas_flash_term_hook);
+
+ /* RTAS use home made raw locking instead of spin_lock_irqsave
+ * because those can be called from within really nasty contexts
+@@ -314,7 +314,7 @@ void rtas_progress(char *s, unsigned short hex)
+
+ spin_unlock(&progress_lock);
+ }
+-EXPORT_SYMBOL(rtas_progress); /* needed by rtas_flash module */
++EXPORT_SYMBOL_GPL(rtas_progress); /* needed by rtas_flash module */
+
+ int rtas_token(const char *service)
+ {
+@@ -324,7 +324,7 @@ int rtas_token(const char *service)
+ tokp = of_get_property(rtas.dev, service, NULL);
+ return tokp ? be32_to_cpu(*tokp) : RTAS_UNKNOWN_SERVICE;
+ }
+-EXPORT_SYMBOL(rtas_token);
++EXPORT_SYMBOL_GPL(rtas_token);
+
+ int rtas_service_present(const char *service)
+ {
+@@ -484,7 +484,7 @@ int rtas_call(int token, int nargs, int nret, int *outputs, ...)
+ }
+ return ret;
+ }
+-EXPORT_SYMBOL(rtas_call);
++EXPORT_SYMBOL_GPL(rtas_call);
+
+ /* For RTAS_BUSY (-2), delay for 1 millisecond. For an extended busy status
+ * code of 990n, perform the hinted delay of 10^n (last digit) milliseconds.
+@@ -519,7 +519,7 @@ unsigned int rtas_busy_delay(int status)
+
+ return ms;
+ }
+-EXPORT_SYMBOL(rtas_busy_delay);
++EXPORT_SYMBOL_GPL(rtas_busy_delay);
+
+ static int rtas_error_rc(int rtas_rc)
+ {
+@@ -565,7 +565,7 @@ int rtas_get_power_level(int powerdomain, int *level)
+ return rtas_error_rc(rc);
+ return rc;
+ }
+-EXPORT_SYMBOL(rtas_get_power_level);
++EXPORT_SYMBOL_GPL(rtas_get_power_level);
+
+ int rtas_set_power_level(int powerdomain, int level, int *setlevel)
+ {
+@@ -583,7 +583,7 @@ int rtas_set_power_level(int powerdomain, int level, int *setlevel)
+ return rtas_error_rc(rc);
+ return rc;
+ }
+-EXPORT_SYMBOL(rtas_set_power_level);
++EXPORT_SYMBOL_GPL(rtas_set_power_level);
+
+ int rtas_get_sensor(int sensor, int index, int *state)
+ {
+@@ -601,7 +601,7 @@ int rtas_get_sensor(int sensor, int index, int *state)
+ return rtas_error_rc(rc);
+ return rc;
+ }
+-EXPORT_SYMBOL(rtas_get_sensor);
++EXPORT_SYMBOL_GPL(rtas_get_sensor);
+
+ int rtas_get_sensor_fast(int sensor, int index, int *state)
+ {
+@@ -662,7 +662,7 @@ int rtas_set_indicator(int indicator, int index, int new_value)
+ return rtas_error_rc(rc);
+ return rc;
+ }
+-EXPORT_SYMBOL(rtas_set_indicator);
++EXPORT_SYMBOL_GPL(rtas_set_indicator);
+
+ /*
+ * Ignoring RTAS extended delay
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index ecd211c5f24a5..cd3e5ed7d77c5 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -3123,7 +3123,8 @@ static void pnv_ioda_setup_pe_res(struct pnv_ioda_pe *pe,
+ int index;
+ int64_t rc;
+
+- if (!res || !res->flags || res->start > res->end)
++ if (!res || !res->flags || res->start > res->end ||
++ res->flags & IORESOURCE_UNSET)
+ return;
+
+ if (res->flags & IORESOURCE_IO) {
+diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
+index 7c872dc01bdb0..d1b338b7dbded 100644
+--- a/arch/powerpc/platforms/pseries/lparcfg.c
++++ b/arch/powerpc/platforms/pseries/lparcfg.c
+@@ -291,6 +291,7 @@ static void parse_mpp_x_data(struct seq_file *m)
+ */
+ static void parse_system_parameter_string(struct seq_file *m)
+ {
++ const s32 token = rtas_token("ibm,get-system-parameter");
+ int call_status;
+
+ unsigned char *local_buffer = kmalloc(SPLPAR_MAXLENGTH, GFP_KERNEL);
+@@ -300,16 +301,15 @@ static void parse_system_parameter_string(struct seq_file *m)
+ return;
+ }
+
+- spin_lock(&rtas_data_buf_lock);
+- memset(rtas_data_buf, 0, SPLPAR_MAXLENGTH);
+- call_status = rtas_call(rtas_token("ibm,get-system-parameter"), 3, 1,
+- NULL,
+- SPLPAR_CHARACTERISTICS_TOKEN,
+- __pa(rtas_data_buf),
+- RTAS_DATA_BUF_SIZE);
+- memcpy(local_buffer, rtas_data_buf, SPLPAR_MAXLENGTH);
+- local_buffer[SPLPAR_MAXLENGTH - 1] = '\0';
+- spin_unlock(&rtas_data_buf_lock);
++ do {
++ spin_lock(&rtas_data_buf_lock);
++ memset(rtas_data_buf, 0, SPLPAR_MAXLENGTH);
++ call_status = rtas_call(token, 3, 1, NULL, SPLPAR_CHARACTERISTICS_TOKEN,
++ __pa(rtas_data_buf), RTAS_DATA_BUF_SIZE);
++ memcpy(local_buffer, rtas_data_buf, SPLPAR_MAXLENGTH);
++ local_buffer[SPLPAR_MAXLENGTH - 1] = '\0';
++ spin_unlock(&rtas_data_buf_lock);
++ } while (rtas_busy_delay(call_status));
+
+ if (call_status != 0) {
+ printk(KERN_INFO
+diff --git a/arch/riscv/kernel/time.c b/arch/riscv/kernel/time.c
+index 15f4ab40e2221..50bb7e0d44ba3 100644
+--- a/arch/riscv/kernel/time.c
++++ b/arch/riscv/kernel/time.c
+@@ -13,6 +13,7 @@
+ */
+
+ #include <linux/of_clk.h>
++#include <linux/clockchips.h>
+ #include <linux/clocksource.h>
+ #include <linux/delay.h>
+ #include <asm/sbi.h>
+@@ -33,4 +34,6 @@ void __init time_init(void)
+
+ of_clk_init(NULL);
+ timer_probe();
++
++ tick_setup_hrtimer_broadcast();
+ }
+diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
+index 7c0a095e9c5f6..b52ca21be3674 100644
+--- a/arch/s390/kernel/kprobes.c
++++ b/arch/s390/kernel/kprobes.c
+@@ -254,6 +254,7 @@ static void pop_kprobe(struct kprobe_ctlblk *kcb)
+ {
+ __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp);
+ kcb->kprobe_status = kcb->prev_kprobe.status;
++ kcb->prev_kprobe.kp = NULL;
+ }
+ NOKPROBE_SYMBOL(pop_kprobe);
+
+@@ -508,12 +509,11 @@ static int post_kprobe_handler(struct pt_regs *regs)
+ if (!p)
+ return 0;
+
++ resume_execution(p, regs);
+ if (kcb->kprobe_status != KPROBE_REENTER && p->post_handler) {
+ kcb->kprobe_status = KPROBE_HIT_SSDONE;
+ p->post_handler(p, regs, 0);
+ }
+-
+- resume_execution(p, regs);
+ pop_kprobe(kcb);
+ preempt_enable_no_resched();
+
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index bfd6c01a68f07..f54f5bfd83ad4 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -909,6 +909,7 @@ void __init setup_arch(char **cmdline_p)
+ if (IS_ENABLED(CONFIG_EXPOLINE_AUTO))
+ nospec_auto_detect();
+
++ jump_label_init();
+ parse_early_param();
+ #ifdef CONFIG_CRASH_DUMP
+ /* Deactivate elfcorehdr= kernel parameter */
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index 160a05c6ce881..04c3e56da0f2b 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -153,5 +153,6 @@ SECTIONS
+ DISCARDS
+ /DISCARD/ : {
+ *(.eh_frame)
++ *(.interp)
+ }
+ }
+diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c
+index 7be06475809b8..a40739ea3805e 100644
+--- a/arch/s390/mm/maccess.c
++++ b/arch/s390/mm/maccess.c
+@@ -58,13 +58,19 @@ static notrace long s390_kernel_write_odd(void *dst, const void *src, size_t siz
+ */
+ void notrace s390_kernel_write(void *dst, const void *src, size_t size)
+ {
++ unsigned long flags;
+ long copied;
+
+- while (size) {
+- copied = s390_kernel_write_odd(dst, src, size);
+- dst += copied;
+- src += copied;
+- size -= copied;
++ flags = arch_local_save_flags();
++ if (!(flags & PSW_MASK_DAT)) {
++ memcpy(dst, src, size);
++ } else {
++ while (size) {
++ copied = s390_kernel_write_odd(dst, src, size);
++ dst += copied;
++ src += copied;
++ size -= copied;
++ }
+ }
+ }
+
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index 1f1a7583fa905..426accab2a88b 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -329,7 +329,7 @@ config FORCE_MAX_ZONEORDER
+ This config option is actually maximum order plus one. For example,
+ a value of 13 means that the largest free memory block is 2^12 pages.
+
+-if SPARC64
++if SPARC64 || COMPILE_TEST
+ source "kernel/power/Kconfig"
+ endif
+
+diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
+index 50ee3bb5a63a9..b0b124025b486 100644
+--- a/arch/um/drivers/vector_kern.c
++++ b/arch/um/drivers/vector_kern.c
+@@ -741,6 +741,7 @@ static int vector_config(char *str, char **error_out)
+
+ if (parsed == NULL) {
+ *error_out = "vector_config failed to parse parameters";
++ kfree(params);
+ return -EINVAL;
+ }
+
+diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
+index 91a06cef50c1b..8e915e3813f6a 100644
+--- a/arch/x86/include/asm/microcode.h
++++ b/arch/x86/include/asm/microcode.h
+@@ -130,7 +130,7 @@ static inline unsigned int x86_cpuid_family(void)
+ int __init microcode_init(void);
+ extern void __init load_ucode_bsp(void);
+ extern void load_ucode_ap(void);
+-void reload_early_microcode(void);
++void reload_early_microcode(unsigned int cpu);
+ extern bool get_builtin_firmware(struct cpio_data *cd, const char *name);
+ extern bool initrd_gone;
+ void microcode_bsp_resume(void);
+@@ -138,7 +138,7 @@ void microcode_bsp_resume(void);
+ static inline int __init microcode_init(void) { return 0; };
+ static inline void __init load_ucode_bsp(void) { }
+ static inline void load_ucode_ap(void) { }
+-static inline void reload_early_microcode(void) { }
++static inline void reload_early_microcode(unsigned int cpu) { }
+ static inline void microcode_bsp_resume(void) { }
+ static inline bool
+ get_builtin_firmware(struct cpio_data *cd, const char *name) { return false; }
+diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h
+index 5c524d4f71cd7..a645b25ee442a 100644
+--- a/arch/x86/include/asm/microcode_amd.h
++++ b/arch/x86/include/asm/microcode_amd.h
+@@ -47,12 +47,12 @@ struct microcode_amd {
+ extern void __init load_ucode_amd_bsp(unsigned int family);
+ extern void load_ucode_amd_ap(unsigned int family);
+ extern int __init save_microcode_in_initrd_amd(unsigned int family);
+-void reload_ucode_amd(void);
++void reload_ucode_amd(unsigned int cpu);
+ #else
+ static inline void __init load_ucode_amd_bsp(unsigned int family) {}
+ static inline void load_ucode_amd_ap(unsigned int family) {}
+ static inline int __init
+ save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; }
+-void reload_ucode_amd(void) {}
++static inline void reload_ucode_amd(unsigned int cpu) {}
+ #endif
+ #endif /* _ASM_X86_MICROCODE_AMD_H */
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 0bd07699dba38..847f3f5820d21 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -50,6 +50,10 @@
+ #define SPEC_CTRL_RRSBA_DIS_S_SHIFT 6 /* Disable RRSBA behavior */
+ #define SPEC_CTRL_RRSBA_DIS_S BIT(SPEC_CTRL_RRSBA_DIS_S_SHIFT)
+
++/* A mask for bits which the kernel toggles when controlling mitigations */
++#define SPEC_CTRL_MITIGATIONS_MASK (SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD \
++ | SPEC_CTRL_RRSBA_DIS_S)
++
+ #define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */
+ #define PRED_CMD_IBPB BIT(0) /* Indirect Branch Prediction Barrier */
+
+diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
+index a671a1145906d..9177b4354c3f5 100644
+--- a/arch/x86/include/asm/reboot.h
++++ b/arch/x86/include/asm/reboot.h
+@@ -25,6 +25,8 @@ void __noreturn machine_real_restart(unsigned int type);
+ #define MRR_BIOS 0
+ #define MRR_APM 1
+
++void cpu_emergency_disable_virtualization(void);
++
+ typedef void (*nmi_shootdown_cb)(int, struct pt_regs*);
+ void nmi_shootdown_cpus(nmi_shootdown_cb callback);
+ void run_crash_ipi_callback(struct pt_regs *regs);
+diff --git a/arch/x86/include/asm/virtext.h b/arch/x86/include/asm/virtext.h
+index 0116b2ee9e64f..4699acd602af4 100644
+--- a/arch/x86/include/asm/virtext.h
++++ b/arch/x86/include/asm/virtext.h
+@@ -114,7 +114,21 @@ static inline void cpu_svm_disable(void)
+
+ wrmsrl(MSR_VM_HSAVE_PA, 0);
+ rdmsrl(MSR_EFER, efer);
+- wrmsrl(MSR_EFER, efer & ~EFER_SVME);
++ if (efer & EFER_SVME) {
++ /*
++ * Force GIF=1 prior to disabling SVM to ensure INIT and NMI
++ * aren't blocked, e.g. if a fatal error occurred between CLGI
++ * and STGI. Note, STGI may #UD if SVM is disabled from NMI
++ * context between reading EFER and executing STGI. In that
++ * case, GIF must already be set, otherwise the NMI would have
++ * been blocked, so just eat the fault.
++ */
++ asm_volatile_goto("1: stgi\n\t"
++ _ASM_EXTABLE(1b, %l[fault])
++ ::: "memory" : fault);
++fault:
++ wrmsrl(MSR_EFER, efer & ~EFER_SVME);
++ }
+ }
+
+ /** Makes sure SVM is disabled, if it is supported on the CPU
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index e298ec9d5d536..680fa070e18be 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -135,9 +135,17 @@ void __init check_bugs(void)
+ * have unknown values. AMD64_LS_CFG MSR is cached in the early AMD
+ * init code as it is not enumerated and depends on the family.
+ */
+- if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
++ if (cpu_feature_enabled(X86_FEATURE_MSR_SPEC_CTRL)) {
+ rdmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+
++ /*
++ * Previously running kernel (kexec), may have some controls
++ * turned ON. Clear them and let the mitigations setup below
++ * rediscover them based on configuration.
++ */
++ x86_spec_ctrl_base &= ~SPEC_CTRL_MITIGATIONS_MASK;
++ }
++
+ /* Select the proper CPU mitigations before patching alternatives: */
+ spectre_v1_select_mitigation();
+ spectre_v2_select_mitigation();
+@@ -975,14 +983,18 @@ spectre_v2_parse_user_cmdline(void)
+ return SPECTRE_V2_USER_CMD_AUTO;
+ }
+
+-static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
++static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode)
+ {
+- return mode == SPECTRE_V2_IBRS ||
+- mode == SPECTRE_V2_EIBRS ||
++ return mode == SPECTRE_V2_EIBRS ||
+ mode == SPECTRE_V2_EIBRS_RETPOLINE ||
+ mode == SPECTRE_V2_EIBRS_LFENCE;
+ }
+
++static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
++{
++ return spectre_v2_in_eibrs_mode(mode) || mode == SPECTRE_V2_IBRS;
++}
++
+ static void __init
+ spectre_v2_user_select_mitigation(void)
+ {
+@@ -1045,12 +1057,19 @@ spectre_v2_user_select_mitigation(void)
+ }
+
+ /*
+- * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible,
+- * STIBP is not required.
++ * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP
++ * is not required.
++ *
++ * Enhanced IBRS also protects against cross-thread branch target
++ * injection in user-mode as the IBRS bit remains always set which
++ * implicitly enables cross-thread protections. However, in legacy IBRS
++ * mode, the IBRS bit is set only on kernel entry and cleared on return
++ * to userspace. This disables the implicit cross-thread protection,
++ * so allow for STIBP to be selected in that case.
+ */
+ if (!boot_cpu_has(X86_FEATURE_STIBP) ||
+ !smt_possible ||
+- spectre_v2_in_ibrs_mode(spectre_v2_enabled))
++ spectre_v2_in_eibrs_mode(spectre_v2_enabled))
+ return;
+
+ /*
+@@ -2102,7 +2121,7 @@ static ssize_t mmio_stale_data_show_state(char *buf)
+
+ static char *stibp_state(void)
+ {
+- if (spectre_v2_in_ibrs_mode(spectre_v2_enabled))
++ if (spectre_v2_in_eibrs_mode(spectre_v2_enabled))
+ return "";
+
+ switch (spectre_v2_user_stibp) {
+diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
+index 8396c77e93230..b33e4fe9de197 100644
+--- a/arch/x86/kernel/cpu/microcode/amd.c
++++ b/arch/x86/kernel/cpu/microcode/amd.c
+@@ -54,7 +54,9 @@ struct cont_desc {
+ };
+
+ static u32 ucode_new_rev;
+-static u8 amd_ucode_patch[PATCH_MAX_SIZE];
++
++/* One blob per node. */
++static u8 amd_ucode_patch[MAX_NUMNODES][PATCH_MAX_SIZE];
+
+ /*
+ * Microcode patch container file is prepended to the initrd in cpio
+@@ -210,7 +212,7 @@ apply_microcode_early_amd(u32 cpuid_1_eax, void *ucode, size_t size, bool save_p
+ patch = (u8 (*)[PATCH_MAX_SIZE])__pa_nodebug(&amd_ucode_patch);
+ #else
+ new_rev = &ucode_new_rev;
+- patch = &amd_ucode_patch;
++ patch = &amd_ucode_patch[0];
+ #endif
+
+ desc.cpuid_1_eax = cpuid_1_eax;
+@@ -329,8 +331,7 @@ void load_ucode_amd_ap(unsigned int cpuid_1_eax)
+ apply_microcode_early_amd(cpuid_1_eax, cp.data, cp.size, false);
+ }
+
+-static enum ucode_state
+-load_microcode_amd(bool save, u8 family, const u8 *data, size_t size);
++static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size);
+
+ int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax)
+ {
+@@ -348,19 +349,19 @@ int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax)
+ if (!desc.mc)
+ return -EINVAL;
+
+- ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size);
++ ret = load_microcode_amd(x86_family(cpuid_1_eax), desc.data, desc.size);
+ if (ret > UCODE_UPDATED)
+ return -EINVAL;
+
+ return 0;
+ }
+
+-void reload_ucode_amd(void)
++void reload_ucode_amd(unsigned int cpu)
+ {
+- struct microcode_amd *mc;
+ u32 rev, dummy;
++ struct microcode_amd *mc;
+
+- mc = (struct microcode_amd *)amd_ucode_patch;
++ mc = (struct microcode_amd *)amd_ucode_patch[cpu_to_node(cpu)];
+
+ rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
+
+@@ -698,9 +699,10 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data,
+ return UCODE_OK;
+ }
+
+-static enum ucode_state
+-load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
++static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size)
+ {
++ struct cpuinfo_x86 *c;
++ unsigned int nid, cpu;
+ struct ucode_patch *p;
+ enum ucode_state ret;
+
+@@ -713,22 +715,22 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
+ return ret;
+ }
+
+- p = find_patch(0);
+- if (!p) {
+- return ret;
+- } else {
+- if (boot_cpu_data.microcode >= p->patch_id)
+- return ret;
++ for_each_node(nid) {
++ cpu = cpumask_first(cpumask_of_node(nid));
++ c = &cpu_data(cpu);
+
+- ret = UCODE_NEW;
+- }
++ p = find_patch(cpu);
++ if (!p)
++ continue;
+
+- /* save BSP's matching patch for early load */
+- if (!save)
+- return ret;
++ if (c->microcode >= p->patch_id)
++ continue;
+
+- memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
+- memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), PATCH_MAX_SIZE));
++ ret = UCODE_NEW;
++
++ memset(&amd_ucode_patch[nid], 0, PATCH_MAX_SIZE);
++ memcpy(&amd_ucode_patch[nid], p->data, min_t(u32, ksize(p->data), PATCH_MAX_SIZE));
++ }
+
+ return ret;
+ }
+@@ -754,12 +756,11 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device,
+ {
+ char fw_name[36] = "amd-ucode/microcode_amd.bin";
+ struct cpuinfo_x86 *c = &cpu_data(cpu);
+- bool bsp = c->cpu_index == boot_cpu_data.cpu_index;
+ enum ucode_state ret = UCODE_NFOUND;
+ const struct firmware *fw;
+
+ /* reload ucode container only on the boot cpu */
+- if (!refresh_fw || !bsp)
++ if (!refresh_fw)
+ return UCODE_OK;
+
+ if (c->x86 >= 0x15)
+@@ -776,7 +777,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device,
+ goto fw_release;
+ }
+
+- ret = load_microcode_amd(bsp, c->x86, fw->data, fw->size);
++ ret = load_microcode_amd(c->x86, fw->data, fw->size);
+
+ fw_release:
+ release_firmware(fw);
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index 985ef98c8ba23..963b989710f98 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -326,7 +326,7 @@ struct cpio_data find_microcode_in_initrd(const char *path, bool use_pa)
+ #endif
+ }
+
+-void reload_early_microcode(void)
++void reload_early_microcode(unsigned int cpu)
+ {
+ int vendor, family;
+
+@@ -340,7 +340,7 @@ void reload_early_microcode(void)
+ break;
+ case X86_VENDOR_AMD:
+ if (family >= 0x10)
+- reload_ucode_amd();
++ reload_ucode_amd(cpu);
+ break;
+ default:
+ break;
+@@ -783,7 +783,7 @@ void microcode_bsp_resume(void)
+ if (uci->valid && uci->mc)
+ microcode_ops->apply_microcode(cpu);
+ else if (!uci->mc)
+- reload_early_microcode();
++ reload_early_microcode(cpu);
+ }
+
+ static struct syscore_ops mc_syscore_ops = {
+diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
+index 91b3483e5085f..e40bb50c5c4f5 100644
+--- a/arch/x86/kernel/crash.c
++++ b/arch/x86/kernel/crash.c
+@@ -35,7 +35,6 @@
+ #include <linux/kdebug.h>
+ #include <asm/cpu.h>
+ #include <asm/reboot.h>
+-#include <asm/virtext.h>
+ #include <asm/intel_pt.h>
+
+ /* Used while preparing memory map entries for second kernel */
+@@ -86,15 +85,6 @@ static void kdump_nmi_callback(int cpu, struct pt_regs *regs)
+ */
+ cpu_crash_vmclear_loaded_vmcss();
+
+- /* Disable VMX or SVM if needed.
+- *
+- * We need to disable virtualization on all CPUs.
+- * Having VMX or SVM enabled on any CPU may break rebooting
+- * after the kdump kernel has finished its task.
+- */
+- cpu_emergency_vmxoff();
+- cpu_emergency_svm_disable();
+-
+ /*
+ * Disable Intel PT to stop its logging
+ */
+@@ -153,12 +143,7 @@ void native_machine_crash_shutdown(struct pt_regs *regs)
+ */
+ cpu_crash_vmclear_loaded_vmcss();
+
+- /* Booting kdump kernel with VMX or SVM enabled won't work,
+- * because (among other limitations) we can't disable paging
+- * with the virt flags.
+- */
+- cpu_emergency_vmxoff();
+- cpu_emergency_svm_disable();
++ cpu_emergency_disable_virtualization();
+
+ /*
+ * Disable Intel PT to stop its logging
+diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
+index 544bd41a514c6..36b5a493e5b45 100644
+--- a/arch/x86/kernel/kprobes/opt.c
++++ b/arch/x86/kernel/kprobes/opt.c
+@@ -56,8 +56,8 @@ unsigned long __recover_optprobed_insn(kprobe_opcode_t *buf, unsigned long addr)
+ /* This function only handles jump-optimized kprobe */
+ if (kp && kprobe_optimized(kp)) {
+ op = container_of(kp, struct optimized_kprobe, kp);
+- /* If op->list is not empty, op is under optimizing */
+- if (list_empty(&op->list))
++ /* If op is optimized or under unoptimizing */
++ if (list_empty(&op->list) || optprobe_queued_unopt(op))
+ goto found;
+ }
+ }
+@@ -328,7 +328,7 @@ int arch_check_optimized_kprobe(struct optimized_kprobe *op)
+
+ for (i = 1; i < op->optinsn.size; i++) {
+ p = get_kprobe(op->kp.addr + i);
+- if (p && !kprobe_disabled(p))
++ if (p && !kprobe_disarmed(p))
+ return -EEXIST;
+ }
+
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index b0f3a996df15f..444b8a691c14b 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -536,33 +536,29 @@ static inline void kb_wait(void)
+ }
+ }
+
+-static void vmxoff_nmi(int cpu, struct pt_regs *regs)
+-{
+- cpu_emergency_vmxoff();
+-}
++static inline void nmi_shootdown_cpus_on_restart(void);
+
+-/* Use NMIs as IPIs to tell all CPUs to disable virtualization */
+-static void emergency_vmx_disable_all(void)
++static void emergency_reboot_disable_virtualization(void)
+ {
+ /* Just make sure we won't change CPUs while doing this */
+ local_irq_disable();
+
+ /*
+- * Disable VMX on all CPUs before rebooting, otherwise we risk hanging
+- * the machine, because the CPU blocks INIT when it's in VMX root.
++ * Disable virtualization on all CPUs before rebooting to avoid hanging
++ * the system, as VMX and SVM block INIT when running in the host.
+ *
+ * We can't take any locks and we may be on an inconsistent state, so
+- * use NMIs as IPIs to tell the other CPUs to exit VMX root and halt.
++ * use NMIs as IPIs to tell the other CPUs to disable VMX/SVM and halt.
+ *
+- * Do the NMI shootdown even if VMX if off on _this_ CPU, as that
+- * doesn't prevent a different CPU from being in VMX root operation.
++ * Do the NMI shootdown even if virtualization is off on _this_ CPU, as
++ * other CPUs may have virtualization enabled.
+ */
+- if (cpu_has_vmx()) {
+- /* Safely force _this_ CPU out of VMX root operation. */
+- __cpu_emergency_vmxoff();
++ if (cpu_has_vmx() || cpu_has_svm(NULL)) {
++ /* Safely force _this_ CPU out of VMX/SVM operation. */
++ cpu_emergency_disable_virtualization();
+
+- /* Halt and exit VMX root operation on the other CPUs. */
+- nmi_shootdown_cpus(vmxoff_nmi);
++ /* Disable VMX/SVM and halt on other CPUs. */
++ nmi_shootdown_cpus_on_restart();
+
+ }
+ }
+@@ -599,7 +595,7 @@ static void native_machine_emergency_restart(void)
+ unsigned short mode;
+
+ if (reboot_emergency)
+- emergency_vmx_disable_all();
++ emergency_reboot_disable_virtualization();
+
+ tboot_shutdown(TB_SHUTDOWN_REBOOT);
+
+@@ -804,6 +800,17 @@ void machine_crash_shutdown(struct pt_regs *regs)
+ /* This is the CPU performing the emergency shutdown work. */
+ int crashing_cpu = -1;
+
++/*
++ * Disable virtualization, i.e. VMX or SVM, to ensure INIT is recognized during
++ * reboot. VMX blocks INIT if the CPU is post-VMXON, and SVM blocks INIT if
++ * GIF=0, i.e. if the crash occurred between CLGI and STGI.
++ */
++void cpu_emergency_disable_virtualization(void)
++{
++ cpu_emergency_vmxoff();
++ cpu_emergency_svm_disable();
++}
++
+ #if defined(CONFIG_SMP)
+
+ static nmi_shootdown_cb shootdown_callback;
+@@ -826,7 +833,14 @@ static int crash_nmi_callback(unsigned int val, struct pt_regs *regs)
+ return NMI_HANDLED;
+ local_irq_disable();
+
+- shootdown_callback(cpu, regs);
++ if (shootdown_callback)
++ shootdown_callback(cpu, regs);
++
++ /*
++ * Prepare the CPU for reboot _after_ invoking the callback so that the
++ * callback can safely use virtualization instructions, e.g. VMCLEAR.
++ */
++ cpu_emergency_disable_virtualization();
+
+ atomic_dec(&waiting_for_crash_ipi);
+ /* Assume hlt works */
+@@ -842,18 +856,32 @@ static void smp_send_nmi_allbutself(void)
+ apic->send_IPI_allbutself(NMI_VECTOR);
+ }
+
+-/*
+- * Halt all other CPUs, calling the specified function on each of them
++/**
++ * nmi_shootdown_cpus - Stop other CPUs via NMI
++ * @callback: Optional callback to be invoked from the NMI handler
++ *
++ * The NMI handler on the remote CPUs invokes @callback, if not
++ * NULL, first and then disables virtualization to ensure that
++ * INIT is recognized during reboot.
+ *
+- * This function can be used to halt all other CPUs on crash
+- * or emergency reboot time. The function passed as parameter
+- * will be called inside a NMI handler on all CPUs.
++ * nmi_shootdown_cpus() can only be invoked once. After the first
++ * invocation all other CPUs are stuck in crash_nmi_callback() and
++ * cannot respond to a second NMI.
+ */
+ void nmi_shootdown_cpus(nmi_shootdown_cb callback)
+ {
+ unsigned long msecs;
++
+ local_irq_disable();
+
++ /*
++ * Avoid certain doom if a shootdown already occurred; re-registering
++ * the NMI handler will cause list corruption, modifying the callback
++ * will do who knows what, etc...
++ */
++ if (WARN_ON_ONCE(crash_ipi_issued))
++ return;
++
+ /* Make a note of crashing cpu. Will be used in NMI callback. */
+ crashing_cpu = safe_smp_processor_id();
+
+@@ -881,7 +909,17 @@ void nmi_shootdown_cpus(nmi_shootdown_cb callback)
+ msecs--;
+ }
+
+- /* Leave the nmi callback set */
++ /*
++ * Leave the nmi callback set, shootdown is a one-time thing. Clearing
++ * the callback could result in a NULL pointer dereference if a CPU
++ * (finally) responds after the timeout expires.
++ */
++}
++
++static inline void nmi_shootdown_cpus_on_restart(void)
++{
++ if (!crash_ipi_issued)
++ nmi_shootdown_cpus(NULL);
+ }
+
+ /*
+@@ -911,6 +949,8 @@ void nmi_shootdown_cpus(nmi_shootdown_cb callback)
+ /* No other CPUs to shoot down */
+ }
+
++static inline void nmi_shootdown_cpus_on_restart(void) { }
++
+ void run_crash_ipi_callback(struct pt_regs *regs)
+ {
+ }
+diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
+index b2b87b91f3361..c94ed0b37bcd4 100644
+--- a/arch/x86/kernel/smp.c
++++ b/arch/x86/kernel/smp.c
+@@ -33,7 +33,7 @@
+ #include <asm/mce.h>
+ #include <asm/trace/irq_vectors.h>
+ #include <asm/kexec.h>
+-#include <asm/virtext.h>
++#include <asm/reboot.h>
+
+ /*
+ * Some notes on x86 processor bugs affecting SMP operation:
+@@ -163,7 +163,7 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs)
+ if (raw_smp_processor_id() == atomic_read(&stopping_cpu))
+ return NMI_HANDLED;
+
+- cpu_emergency_vmxoff();
++ cpu_emergency_disable_virtualization();
+ stop_this_cpu(NULL);
+
+ return NMI_HANDLED;
+@@ -176,7 +176,7 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs)
+ asmlinkage __visible void smp_reboot_interrupt(void)
+ {
+ ipi_entering_ack_irq();
+- cpu_emergency_vmxoff();
++ cpu_emergency_disable_virtualization();
+ stop_this_cpu(NULL);
+ irq_exit();
+ }
+diff --git a/arch/x86/kernel/sysfb_efi.c b/arch/x86/kernel/sysfb_efi.c
+index 897da526e40e6..dd8d7636c5420 100644
+--- a/arch/x86/kernel/sysfb_efi.c
++++ b/arch/x86/kernel/sysfb_efi.c
+@@ -265,6 +265,14 @@ static const struct dmi_system_id efifb_dmi_swap_width_height[] __initconst = {
+ "Lenovo ideapad D330-10IGM"),
+ },
+ },
++ {
++ /* Lenovo IdeaPad Duet 3 10IGL5 with 1200x1920 portrait screen */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
++ "IdeaPad Duet 3 10IGL5"),
++ },
++ },
+ {},
+ };
+
+diff --git a/arch/x86/um/vdso/um_vdso.c b/arch/x86/um/vdso/um_vdso.c
+index 7c441b59d3752..be99ff25c5039 100644
+--- a/arch/x86/um/vdso/um_vdso.c
++++ b/arch/x86/um/vdso/um_vdso.c
+@@ -20,8 +20,10 @@ int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
+ {
+ long ret;
+
+- asm("syscall" : "=a" (ret) :
+- "0" (__NR_clock_gettime), "D" (clock), "S" (ts) : "memory");
++ asm("syscall"
++ : "=a" (ret)
++ : "0" (__NR_clock_gettime), "D" (clock), "S" (ts)
++ : "rcx", "r11", "memory");
+
+ return ret;
+ }
+@@ -32,8 +34,10 @@ int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
+ {
+ long ret;
+
+- asm("syscall" : "=a" (ret) :
+- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
++ asm("syscall"
++ : "=a" (ret)
++ : "0" (__NR_gettimeofday), "D" (tv), "S" (tz)
++ : "rcx", "r11", "memory");
+
+ return ret;
+ }
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index 2e22a3f7466a8..469e30a6d3cde 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -444,6 +444,7 @@ int bio_integrity_clone(struct bio *bio, struct bio *bio_src,
+
+ bip->bip_vcnt = bip_src->bip_vcnt;
+ bip->bip_iter = bip_src->bip_iter;
++ bip->bip_flags = bip_src->bip_flags & ~BIP_BLOCK_INTEGRITY;
+
+ return 0;
+ }
+diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
+index d89a757cbde0f..dfa0a21a1fe46 100644
+--- a/block/blk-mq-sched.c
++++ b/block/blk-mq-sched.c
+@@ -51,8 +51,7 @@ void blk_mq_sched_assign_ioc(struct request *rq, struct bio *bio)
+ }
+
+ /*
+- * Mark a hardware queue as needing a restart. For shared queues, maintain
+- * a count of how many hardware queues are marked for restart.
++ * Mark a hardware queue as needing a restart.
+ */
+ void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx)
+ {
+diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
+index 812476e468213..444a3c630924d 100644
+--- a/crypto/rsa-pkcs1pad.c
++++ b/crypto/rsa-pkcs1pad.c
+@@ -216,16 +216,14 @@ static void pkcs1pad_encrypt_sign_complete_cb(
+ struct crypto_async_request *child_async_req, int err)
+ {
+ struct akcipher_request *req = child_async_req->data;
+- struct crypto_async_request async_req;
+
+ if (err == -EINPROGRESS)
+- return;
++ goto out;
++
++ err = pkcs1pad_encrypt_sign_complete(req, err);
+
+- async_req.data = req->base.data;
+- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
+- async_req.flags = child_async_req->flags;
+- req->base.complete(&async_req,
+- pkcs1pad_encrypt_sign_complete(req, err));
++out:
++ akcipher_request_complete(req, err);
+ }
+
+ static int pkcs1pad_encrypt(struct akcipher_request *req)
+@@ -334,15 +332,14 @@ static void pkcs1pad_decrypt_complete_cb(
+ struct crypto_async_request *child_async_req, int err)
+ {
+ struct akcipher_request *req = child_async_req->data;
+- struct crypto_async_request async_req;
+
+ if (err == -EINPROGRESS)
+- return;
++ goto out;
++
++ err = pkcs1pad_decrypt_complete(req, err);
+
+- async_req.data = req->base.data;
+- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
+- async_req.flags = child_async_req->flags;
+- req->base.complete(&async_req, pkcs1pad_decrypt_complete(req, err));
++out:
++ akcipher_request_complete(req, err);
+ }
+
+ static int pkcs1pad_decrypt(struct akcipher_request *req)
+@@ -500,15 +497,14 @@ static void pkcs1pad_verify_complete_cb(
+ struct crypto_async_request *child_async_req, int err)
+ {
+ struct akcipher_request *req = child_async_req->data;
+- struct crypto_async_request async_req;
+
+ if (err == -EINPROGRESS)
+- return;
++ goto out;
+
+- async_req.data = req->base.data;
+- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req));
+- async_req.flags = child_async_req->flags;
+- req->base.complete(&async_req, pkcs1pad_verify_complete(req, err));
++ err = pkcs1pad_verify_complete(req, err);
++
++out:
++ akcipher_request_complete(req, err);
+ }
+
+ /*
+diff --git a/crypto/seqiv.c b/crypto/seqiv.c
+index 39dbf2f7e5f5c..ca68608ab14e1 100644
+--- a/crypto/seqiv.c
++++ b/crypto/seqiv.c
+@@ -30,7 +30,7 @@ static void seqiv_aead_encrypt_complete2(struct aead_request *req, int err)
+ struct aead_request *subreq = aead_request_ctx(req);
+ struct crypto_aead *geniv;
+
+- if (err == -EINPROGRESS)
++ if (err == -EINPROGRESS || err == -EBUSY)
+ return;
+
+ if (err)
+diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile
+index 71f6f2624debc..8ce51f0f40ce5 100644
+--- a/drivers/acpi/acpica/Makefile
++++ b/drivers/acpi/acpica/Makefile
+@@ -3,7 +3,7 @@
+ # Makefile for ACPICA Core interpreter
+ #
+
+-ccflags-y := -Os -D_LINUX -DBUILDING_ACPICA
++ccflags-y := -D_LINUX -DBUILDING_ACPICA
+ ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT
+
+ # use acpi.o to put all files here into acpi.o modparam namespace
+diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c
+index 24f9b61aa4049..b081177c421aa 100644
+--- a/drivers/acpi/acpica/hwvalid.c
++++ b/drivers/acpi/acpica/hwvalid.c
+@@ -23,8 +23,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width);
+ *
+ * The table is used to implement the Microsoft port access rules that
+ * first appeared in Windows XP. Some ports are always illegal, and some
+- * ports are only illegal if the BIOS calls _OSI with a win_XP string or
+- * later (meaning that the BIOS itelf is post-XP.)
++ * ports are only illegal if the BIOS calls _OSI with nothing newer than
++ * the specific _OSI strings.
+ *
+ * This provides ACPICA with the desired port protections and
+ * Microsoft compatibility.
+@@ -145,7 +145,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+
+ /* Port illegality may depend on the _OSI calls made by the BIOS */
+
+- if (acpi_gbl_osi_data >= port_info->osi_dependency) {
++ if (port_info->osi_dependency == ACPI_ALWAYS_ILLEGAL ||
++ acpi_gbl_osi_data == port_info->osi_dependency) {
+ ACPI_DEBUG_PRINT((ACPI_DB_VALUES,
+ "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)\n",
+ ACPI_FORMAT_UINT64(address),
+diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c
+index ff2ab8fbec384..8de80bf7802b4 100644
+--- a/drivers/acpi/acpica/nsrepair.c
++++ b/drivers/acpi/acpica/nsrepair.c
+@@ -181,8 +181,9 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,
+ * Try to fix if there was no return object. Warning if failed to fix.
+ */
+ if (!return_object) {
+- if (expected_btypes && (!(expected_btypes & ACPI_RTYPE_NONE))) {
+- if (package_index != ACPI_NOT_PACKAGE_ELEMENT) {
++ if (expected_btypes) {
++ if (!(expected_btypes & ACPI_RTYPE_NONE) &&
++ package_index != ACPI_NOT_PACKAGE_ELEMENT) {
+ ACPI_WARN_PREDEFINED((AE_INFO,
+ info->full_pathname,
+ ACPI_WARN_ALWAYS,
+@@ -196,14 +197,15 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,
+ if (ACPI_SUCCESS(status)) {
+ return (AE_OK); /* Repair was successful */
+ }
+- } else {
++ }
++
++ if (expected_btypes != ACPI_RTYPE_NONE) {
+ ACPI_WARN_PREDEFINED((AE_INFO,
+ info->full_pathname,
+ ACPI_WARN_ALWAYS,
+ "Missing expected return value"));
++ return (AE_AML_NO_RETURN_VALUE);
+ }
+-
+- return (AE_AML_NO_RETURN_VALUE);
+ }
+ }
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index c0c533206e02d..88f4040d6c1f2 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -478,7 +478,7 @@ static int extract_package(struct acpi_battery *battery,
+ u8 *ptr = (u8 *)battery + offsets[i].offset;
+ if (element->type == ACPI_TYPE_STRING ||
+ element->type == ACPI_TYPE_BUFFER)
+- strncpy(ptr, element->string.pointer, 32);
++ strscpy(ptr, element->string.pointer, 32);
+ else if (element->type == ACPI_TYPE_INTEGER) {
+ strncpy(ptr, (u8 *)&element->integer.value,
+ sizeof(u64));
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 0ec74ab2a3995..b4f16073ef432 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -300,7 +300,7 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ .ident = "Lenovo Ideapad Z570",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "102434U"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Ideapad Z570"),
+ },
+ },
+ {
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 9f1265ce2e365..6edd642b7ab62 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -4381,8 +4381,7 @@ static void rbd_dev_release(struct device *dev)
+ module_put(THIS_MODULE);
+ }
+
+-static struct rbd_device *__rbd_dev_create(struct rbd_client *rbdc,
+- struct rbd_spec *spec)
++static struct rbd_device *__rbd_dev_create(struct rbd_spec *spec)
+ {
+ struct rbd_device *rbd_dev;
+
+@@ -4421,9 +4420,6 @@ static struct rbd_device *__rbd_dev_create(struct rbd_client *rbdc,
+ rbd_dev->dev.parent = &rbd_root_dev;
+ device_initialize(&rbd_dev->dev);
+
+- rbd_dev->rbd_client = rbdc;
+- rbd_dev->spec = spec;
+-
+ return rbd_dev;
+ }
+
+@@ -4436,12 +4432,10 @@ static struct rbd_device *rbd_dev_create(struct rbd_client *rbdc,
+ {
+ struct rbd_device *rbd_dev;
+
+- rbd_dev = __rbd_dev_create(rbdc, spec);
++ rbd_dev = __rbd_dev_create(spec);
+ if (!rbd_dev)
+ return NULL;
+
+- rbd_dev->opts = opts;
+-
+ /* get an id and fill in device name */
+ rbd_dev->dev_id = ida_simple_get(&rbd_dev_id_ida, 0,
+ minor_to_rbd_dev_id(1 << MINORBITS),
+@@ -4458,6 +4452,10 @@ static struct rbd_device *rbd_dev_create(struct rbd_client *rbdc,
+ /* we have a ref from do_rbd_add() */
+ __module_get(THIS_MODULE);
+
++ rbd_dev->rbd_client = rbdc;
++ rbd_dev->spec = spec;
++ rbd_dev->opts = opts;
++
+ dout("%s rbd_dev %p dev_id %d\n", __func__, rbd_dev, rbd_dev->dev_id);
+ return rbd_dev;
+
+@@ -5618,7 +5616,7 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth)
+ goto out_err;
+ }
+
+- parent = __rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec);
++ parent = __rbd_dev_create(rbd_dev->parent_spec);
+ if (!parent) {
+ ret = -ENOMEM;
+ goto out_err;
+@@ -5628,8 +5626,8 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth)
+ * Images related by parent/child relationships always share
+ * rbd_client and spec/parent_spec, so bump their refcounts.
+ */
+- __rbd_get_client(rbd_dev->rbd_client);
+- rbd_spec_get(rbd_dev->parent_spec);
++ parent->rbd_client = __rbd_get_client(rbd_dev->rbd_client);
++ parent->spec = rbd_spec_get(rbd_dev->parent_spec);
+
+ ret = rbd_dev_image_probe(parent, depth);
+ if (ret < 0)
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 53ac3a0e741d7..a8d68ac9d0dea 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -244,6 +244,17 @@ static bool clk_core_is_enabled(struct clk_core *core)
+ }
+ }
+
++ /*
++ * This could be called with the enable lock held, or from atomic
++ * context. If the parent isn't enabled already, we can't do
++ * anything here. We can also assume this clock isn't enabled.
++ */
++ if ((core->flags & CLK_OPS_PARENT_ENABLE) && core->parent)
++ if (!clk_core_is_enabled(core->parent)) {
++ ret = false;
++ goto done;
++ }
++
+ ret = core->ops->is_enabled(core->hw);
+ done:
+ if (core->dev)
+diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
+index cd00afb5786e8..2c70a64cc8317 100644
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -529,7 +529,6 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev,
+ {
+ struct skcipher_request *req;
+ struct scatterlist *dst;
+- dma_addr_t addr;
+
+ req = skcipher_request_cast(pd_uinfo->async_req);
+
+@@ -538,8 +537,8 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev,
+ req->cryptlen, req->dst);
+ } else {
+ dst = pd_uinfo->dest_va;
+- addr = dma_map_page(dev->core_dev->device, sg_page(dst),
+- dst->offset, dst->length, DMA_FROM_DEVICE);
++ dma_unmap_page(dev->core_dev->device, pd->dest, dst->length,
++ DMA_FROM_DEVICE);
+ }
+
+ if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) {
+@@ -564,10 +563,9 @@ static void crypto4xx_ahash_done(struct crypto4xx_device *dev,
+ struct ahash_request *ahash_req;
+
+ ahash_req = ahash_request_cast(pd_uinfo->async_req);
+- ctx = crypto_tfm_ctx(ahash_req->base.tfm);
++ ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(ahash_req));
+
+- crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo,
+- crypto_tfm_ctx(ahash_req->base.tfm));
++ crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, ctx);
+ crypto4xx_ret_sg_desc(dev, pd_uinfo);
+
+ if (pd_uinfo->state & PD_ENTRY_BUSY)
+diff --git a/drivers/firmware/google/framebuffer-coreboot.c b/drivers/firmware/google/framebuffer-coreboot.c
+index b8b49c0671574..58b1dae60c193 100644
+--- a/drivers/firmware/google/framebuffer-coreboot.c
++++ b/drivers/firmware/google/framebuffer-coreboot.c
+@@ -51,9 +51,7 @@ static int framebuffer_probe(struct coreboot_device *dev)
+ fb->green_mask_pos == formats[i].green.offset &&
+ fb->green_mask_size == formats[i].green.length &&
+ fb->blue_mask_pos == formats[i].blue.offset &&
+- fb->blue_mask_size == formats[i].blue.length &&
+- fb->reserved_mask_pos == formats[i].transp.offset &&
+- fb->reserved_mask_size == formats[i].transp.length)
++ fb->blue_mask_size == formats[i].blue.length)
+ pdata.format = formats[i].name;
+ }
+ if (!pdata.format)
+diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
+index f7692999df475..01865b3e0a5f5 100644
+--- a/drivers/gpio/gpio-vf610.c
++++ b/drivers/gpio/gpio-vf610.c
+@@ -279,7 +279,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
+ gc = &port->gc;
+ gc->of_node = np;
+ gc->parent = dev;
+- gc->label = "vf610-gpio";
++ gc->label = dev_name(dev);
+ gc->ngpio = VF610_GPIO_PER_PORT;
+ gc->base = of_alias_get_id(np, "gpio") * VF610_GPIO_PER_PORT;
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 57678e6dcdc4c..98d51bc204172 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -773,12 +773,14 @@ static int dm_resume(void *handle)
+ list_for_each_entry(connector, &ddev->mode_config.connector_list, head) {
+ aconnector = to_amdgpu_dm_connector(connector);
+
++ if (!aconnector->dc_link)
++ continue;
++
+ /*
+ * this is the case when traversing through already created
+ * MST connectors, should be skipped
+ */
+- if (aconnector->dc_link &&
+- aconnector->dc_link->type == dc_connection_mst_branch)
++ if (aconnector->dc_link->type == dc_connection_mst_branch)
+ continue;
+
+ mutex_lock(&aconnector->hpd_lock);
+diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
+index 07e3a8aaa0e4b..dfc0ada99b5c5 100644
+--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
++++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c
+@@ -437,7 +437,11 @@ static int __init stdpxxxx_ge_b850v3_init(void)
+ if (ret)
+ return ret;
+
+- return i2c_add_driver(&stdp2690_ge_b850v3_fw_driver);
++ ret = i2c_add_driver(&stdp2690_ge_b850v3_fw_driver);
++ if (ret)
++ i2c_del_driver(&stdp4028_ge_b850v3_fw_driver);
++
++ return ret;
+ }
+ module_init(stdpxxxx_ge_b850v3_init);
+
+diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c
+index c8c9daecd00da..81923442b42d0 100644
+--- a/drivers/gpu/drm/drm_mipi_dsi.c
++++ b/drivers/gpu/drm/drm_mipi_dsi.c
+@@ -1096,6 +1096,58 @@ int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi,
+ }
+ EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness);
+
++/**
++ * mipi_dsi_dcs_set_display_brightness_large() - sets the 16-bit brightness value
++ * of the display
++ * @dsi: DSI peripheral device
++ * @brightness: brightness value
++ *
++ * Return: 0 on success or a negative error code on failure.
++ */
++int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi,
++ u16 brightness)
++{
++ u8 payload[2] = { brightness >> 8, brightness & 0xff };
++ ssize_t err;
++
++ err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_DISPLAY_BRIGHTNESS,
++ payload, sizeof(payload));
++ if (err < 0)
++ return err;
++
++ return 0;
++}
++EXPORT_SYMBOL(mipi_dsi_dcs_set_display_brightness_large);
++
++/**
++ * mipi_dsi_dcs_get_display_brightness_large() - gets the current 16-bit
++ * brightness value of the display
++ * @dsi: DSI peripheral device
++ * @brightness: brightness value
++ *
++ * Return: 0 on success or a negative error code on failure.
++ */
++int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi,
++ u16 *brightness)
++{
++ u8 brightness_be[2];
++ ssize_t err;
++
++ err = mipi_dsi_dcs_read(dsi, MIPI_DCS_GET_DISPLAY_BRIGHTNESS,
++ brightness_be, sizeof(brightness_be));
++ if (err <= 0) {
++ if (err == 0)
++ err = -ENODATA;
++
++ return err;
++ }
++
++ *brightness = (brightness_be[0] << 8) | brightness_be[1];
++
++ return 0;
++}
++EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness_large);
++
+ static int mipi_dsi_drv_probe(struct device *dev)
+ {
+ struct mipi_dsi_driver *drv = to_mipi_dsi_driver(dev->driver);
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+index d143217636071..eeb1277794dbf 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -425,6 +425,7 @@ static int mtk_drm_bind(struct device *dev)
+ err_deinit:
+ mtk_drm_kms_deinit(drm);
+ err_free:
++ private->drm = NULL;
+ drm_dev_put(drm);
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+index 259b7b0de1d22..b09a37a38e0ae 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+@@ -148,8 +148,6 @@ static int mtk_drm_gem_object_mmap(struct drm_gem_object *obj,
+
+ ret = dma_mmap_attrs(priv->dma_dev, vma, mtk_gem->cookie,
+ mtk_gem->dma_addr, obj->size, mtk_gem->dma_attrs);
+- if (ret)
+- drm_gem_vm_close(vma);
+
+ return ret;
+ }
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index 3c3b7f7013e87..2efdc3c9f2916 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -1477,6 +1477,8 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
+ }
+
+ pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL);
++ if (!pstates)
++ return -ENOMEM;
+
+ dpu_crtc = to_dpu_crtc(crtc);
+ cstate = to_dpu_crtc_state(state);
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 56cfa0a03fd5b..059578faa1c6d 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -1883,6 +1883,9 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi)
+
+ /* setup workqueue */
+ msm_host->workqueue = alloc_ordered_workqueue("dsi_drm_work", 0);
++ if (!msm_host->workqueue)
++ return -ENOMEM;
++
+ INIT_WORK(&msm_host->err_work, dsi_err_worker);
+ INIT_WORK(&msm_host->hpd_work, dsi_hpd_worker);
+
+diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c
+index e03f08757b252..b75067854b4d7 100644
+--- a/drivers/gpu/drm/msm/hdmi/hdmi.c
++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c
+@@ -254,6 +254,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev)
+ pm_runtime_enable(&pdev->dev);
+
+ hdmi->workq = alloc_ordered_workqueue("msm_hdmi", 0);
++ if (!hdmi->workq) {
++ ret = -ENOMEM;
++ goto fail;
++ }
+
+ hdmi->i2c = msm_hdmi_i2c_init(hdmi);
+ if (IS_ERR(hdmi->i2c)) {
+diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c
+index 6c11be79574e5..ef79c3661acb4 100644
+--- a/drivers/gpu/drm/msm/msm_fence.c
++++ b/drivers/gpu/drm/msm/msm_fence.c
+@@ -31,7 +31,7 @@ msm_fence_context_alloc(struct drm_device *dev, const char *name)
+ return ERR_PTR(-ENOMEM);
+
+ fctx->dev = dev;
+- strncpy(fctx->name, name, sizeof(fctx->name));
++ strscpy(fctx->name, name, sizeof(fctx->name));
+ fctx->context = dma_fence_context_alloc(1);
+ init_waitqueue_head(&fctx->event);
+ spin_lock_init(&fctx->spinlock);
+diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig
+index 3ed6849d63cba..1a2805c7a0eb7 100644
+--- a/drivers/gpu/drm/mxsfb/Kconfig
++++ b/drivers/gpu/drm/mxsfb/Kconfig
+@@ -7,6 +7,7 @@ config DRM_MXSFB
+ tristate "i.MX23/i.MX28/i.MX6SX MXSFB LCD controller"
+ depends on DRM && OF
+ depends on COMMON_CLK
++ depends on ARCH_MXS || ARCH_MXC || COMPILE_TEST
+ select DRM_MXS
+ select DRM_KMS_HELPER
+ select DRM_KMS_CMA_HELPER
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 79aef5c063fae..5f1b503def551 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -2188,11 +2188,12 @@ int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder, int fe_idx)
+
+ /*
+ * On DCE32 any encoder can drive any block so usually just use crtc id,
+- * but Apple thinks different at least on iMac10,1, so there use linkb,
++ * but Apple thinks different at least on iMac10,1 and iMac11,2, so there use linkb,
+ * otherwise the internal eDP panel will stay dark.
+ */
+ if (ASIC_IS_DCE32(rdev)) {
+- if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1"))
++ if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1") ||
++ dmi_match(DMI_PRODUCT_NAME, "iMac11,2"))
+ enc_idx = (dig->linkb) ? 1 : 0;
+ else
+ enc_idx = radeon_crtc->crtc_id;
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index cc1c07963116c..bcca0dd67fd15 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -1015,6 +1015,7 @@ void radeon_atombios_fini(struct radeon_device *rdev)
+ {
+ if (rdev->mode_info.atom_context) {
+ kfree(rdev->mode_info.atom_context->scratch);
++ kfree(rdev->mode_info.atom_context->iio);
+ }
+ kfree(rdev->mode_info.atom_context);
+ rdev->mode_info.atom_context = NULL;
+diff --git a/drivers/gpu/drm/vc4/vc4_dpi.c b/drivers/gpu/drm/vc4/vc4_dpi.c
+index f185812970da7..0a0c239ed5c81 100644
+--- a/drivers/gpu/drm/vc4/vc4_dpi.c
++++ b/drivers/gpu/drm/vc4/vc4_dpi.c
+@@ -186,35 +186,45 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder)
+ }
+ drm_connector_list_iter_end(&conn_iter);
+
+- if (connector && connector->display_info.num_bus_formats) {
+- u32 bus_format = connector->display_info.bus_formats[0];
+-
+- switch (bus_format) {
+- case MEDIA_BUS_FMT_RGB888_1X24:
+- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB,
+- DPI_FORMAT);
+- break;
+- case MEDIA_BUS_FMT_BGR888_1X24:
+- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB,
+- DPI_FORMAT);
+- dpi_c |= VC4_SET_FIELD(DPI_ORDER_BGR, DPI_ORDER);
+- break;
+- case MEDIA_BUS_FMT_RGB666_1X24_CPADHI:
+- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_2,
+- DPI_FORMAT);
+- break;
+- case MEDIA_BUS_FMT_RGB666_1X18:
+- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_1,
+- DPI_FORMAT);
+- break;
+- case MEDIA_BUS_FMT_RGB565_1X16:
+- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_3,
+- DPI_FORMAT);
+- break;
+- default:
+- DRM_ERROR("Unknown media bus format %d\n", bus_format);
+- break;
++ if (connector) {
++ if (connector->display_info.num_bus_formats) {
++ u32 bus_format = connector->display_info.bus_formats[0];
++
++ switch (bus_format) {
++ case MEDIA_BUS_FMT_RGB888_1X24:
++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB,
++ DPI_FORMAT);
++ break;
++ case MEDIA_BUS_FMT_BGR888_1X24:
++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB,
++ DPI_FORMAT);
++ dpi_c |= VC4_SET_FIELD(DPI_ORDER_BGR,
++ DPI_ORDER);
++ break;
++ case MEDIA_BUS_FMT_RGB666_1X24_CPADHI:
++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_2,
++ DPI_FORMAT);
++ break;
++ case MEDIA_BUS_FMT_RGB666_1X18:
++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_1,
++ DPI_FORMAT);
++ break;
++ case MEDIA_BUS_FMT_RGB565_1X16:
++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_1,
++ DPI_FORMAT);
++ break;
++ default:
++ DRM_ERROR("Unknown media bus format %d\n",
++ bus_format);
++ break;
++ }
+ }
++
++ if (connector->display_info.bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE)
++ dpi_c |= DPI_PIXEL_CLK_INVERT;
++
++ if (connector->display_info.bus_flags & DRM_BUS_FLAG_DE_LOW)
++ dpi_c |= DPI_OUTPUT_ENABLE_INVERT;
+ } else {
+ /* Default to 24bit if no connector found. */
+ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB, DPI_FORMAT);
+diff --git a/drivers/gpu/host1x/hw/syncpt_hw.c b/drivers/gpu/host1x/hw/syncpt_hw.c
+index a23bb3352d029..b40a537884dde 100644
+--- a/drivers/gpu/host1x/hw/syncpt_hw.c
++++ b/drivers/gpu/host1x/hw/syncpt_hw.c
+@@ -113,9 +113,6 @@ static void syncpt_assign_to_channel(struct host1x_syncpt *sp,
+ #if HOST1X_HW >= 6
+ struct host1x *host = sp->host;
+
+- if (!host->hv_regs)
+- return;
+-
+ host1x_sync_writel(host,
+ HOST1X_SYNC_SYNCPT_CH_APP_CH(ch ? ch->id : 0xff),
+ HOST1X_SYNC_SYNCPT_CH_APP(sp->id));
+diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
+index 0a7d4395d427b..f6e74ff7ef75d 100644
+--- a/drivers/gpu/ipu-v3/ipu-common.c
++++ b/drivers/gpu/ipu-v3/ipu-common.c
+@@ -1238,6 +1238,7 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base)
+ pdev = platform_device_alloc(reg->name, id++);
+ if (!pdev) {
+ ret = -ENOMEM;
++ of_node_put(of_node);
+ goto err_register;
+ }
+
+diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
+index 800b2364e29ea..4dddf3ce32d73 100644
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -84,6 +84,7 @@ struct asus_kbd_leds {
+ struct hid_device *hdev;
+ struct work_struct work;
+ unsigned int brightness;
++ spinlock_t lock;
+ bool removed;
+ };
+
+@@ -313,24 +314,42 @@ static int asus_kbd_get_functions(struct hid_device *hdev,
+ return ret;
+ }
+
++static void asus_schedule_work(struct asus_kbd_leds *led)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&led->lock, flags);
++ if (!led->removed)
++ schedule_work(&led->work);
++ spin_unlock_irqrestore(&led->lock, flags);
++}
++
+ static void asus_kbd_backlight_set(struct led_classdev *led_cdev,
+ enum led_brightness brightness)
+ {
+ struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
+ cdev);
+- if (led->brightness == brightness)
+- return;
++ unsigned long flags;
+
++ spin_lock_irqsave(&led->lock, flags);
+ led->brightness = brightness;
+- schedule_work(&led->work);
++ spin_unlock_irqrestore(&led->lock, flags);
++
++ asus_schedule_work(led);
+ }
+
+ static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev)
+ {
+ struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds,
+ cdev);
++ enum led_brightness brightness;
++ unsigned long flags;
++
++ spin_lock_irqsave(&led->lock, flags);
++ brightness = led->brightness;
++ spin_unlock_irqrestore(&led->lock, flags);
+
+- return led->brightness;
++ return brightness;
+ }
+
+ static void asus_kbd_backlight_work(struct work_struct *work)
+@@ -338,11 +357,11 @@ static void asus_kbd_backlight_work(struct work_struct *work)
+ struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work);
+ u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, 0x00 };
+ int ret;
++ unsigned long flags;
+
+- if (led->removed)
+- return;
+-
++ spin_lock_irqsave(&led->lock, flags);
+ buf[4] = led->brightness;
++ spin_unlock_irqrestore(&led->lock, flags);
+
+ ret = asus_kbd_set_report(led->hdev, buf, sizeof(buf));
+ if (ret < 0)
+@@ -383,6 +402,7 @@ static int asus_kbd_register_leds(struct hid_device *hdev)
+ drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set;
+ drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get;
+ INIT_WORK(&drvdata->kbd_backlight->work, asus_kbd_backlight_work);
++ spin_lock_init(&drvdata->kbd_backlight->lock);
+
+ ret = devm_led_classdev_register(&hdev->dev, &drvdata->kbd_backlight->cdev);
+ if (ret < 0) {
+@@ -692,9 +712,13 @@ err_stop_hw:
+ static void asus_remove(struct hid_device *hdev)
+ {
+ struct asus_drvdata *drvdata = hid_get_drvdata(hdev);
++ unsigned long flags;
+
+ if (drvdata->kbd_backlight) {
++ spin_lock_irqsave(&drvdata->kbd_backlight->lock, flags);
+ drvdata->kbd_backlight->removed = true;
++ spin_unlock_irqrestore(&drvdata->kbd_backlight->lock, flags);
++
+ cancel_work_sync(&drvdata->kbd_backlight->work);
+ }
+
+diff --git a/drivers/hwmon/ltc2945.c b/drivers/hwmon/ltc2945.c
+index 1b92e4f6e2349..efabe514ec560 100644
+--- a/drivers/hwmon/ltc2945.c
++++ b/drivers/hwmon/ltc2945.c
+@@ -257,6 +257,8 @@ static ssize_t ltc2945_set_value(struct device *dev,
+
+ /* convert to register value, then clamp and write result */
+ regval = ltc2945_val_to_reg(dev, reg, val);
++ if (regval < 0)
++ return regval;
+ if (is_power_reg(reg)) {
+ regval = clamp_val(regval, 0, 0xffffff);
+ regbuf[0] = regval >> 16;
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index e57b0c5119ce4..ec68dace3cf93 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -125,6 +125,12 @@ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+ if (err)
+ return err;
+
++ if (MLXREG_FAN_GET_FAULT(regval, tacho->mask)) {
++ /* FAN is broken - return zero for FAN speed. */
++ *val = 0;
++ return 0;
++ }
++
+ *val = MLXREG_FAN_GET_RPM(regval, fan->divider,
+ fan->samples);
+ break;
+diff --git a/drivers/iio/accel/mma9551_core.c b/drivers/iio/accel/mma9551_core.c
+index c34c5ce8123b0..19b4fbc682e63 100644
+--- a/drivers/iio/accel/mma9551_core.c
++++ b/drivers/iio/accel/mma9551_core.c
+@@ -304,9 +304,12 @@ int mma9551_read_config_word(struct i2c_client *client, u8 app_id,
+
+ ret = mma9551_transfer(client, app_id, MMA9551_CMD_READ_CONFIG,
+ reg, NULL, 0, (u8 *)&v, 2);
++ if (ret < 0)
++ return ret;
++
+ *val = be16_to_cpu(v);
+
+- return ret;
++ return 0;
+ }
+ EXPORT_SYMBOL(mma9551_read_config_word);
+
+@@ -362,9 +365,12 @@ int mma9551_read_status_word(struct i2c_client *client, u8 app_id,
+
+ ret = mma9551_transfer(client, app_id, MMA9551_CMD_READ_STATUS,
+ reg, NULL, 0, (u8 *)&v, 2);
++ if (ret < 0)
++ return ret;
++
+ *val = be16_to_cpu(v);
+
+- return ret;
++ return 0;
+ }
+ EXPORT_SYMBOL(mma9551_read_status_word);
+
+diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
+index b536768234b7c..fe6c9e1870414 100644
+--- a/drivers/input/touchscreen/ads7846.c
++++ b/drivers/input/touchscreen/ads7846.c
+@@ -790,14 +790,8 @@ static void ads7846_report_state(struct ads7846 *ts)
+ if (x == MAX_12BIT)
+ x = 0;
+
+- if (ts->model == 7843) {
++ if (ts->model == 7843 || ts->model == 7845) {
+ Rt = ts->pressure_max / 2;
+- } else if (ts->model == 7845) {
+- if (get_pendown_state(ts))
+- Rt = ts->pressure_max / 2;
+- else
+- Rt = 0;
+- dev_vdbg(&ts->spi->dev, "x/y: %d/%d, PD %d\n", x, y, Rt);
+ } else if (likely(x && z1)) {
+ /* compute touch pressure resistance using equation #2 */
+ Rt = z2;
+@@ -1374,8 +1368,9 @@ static int ads7846_probe(struct spi_device *spi)
+ pdata->y_min ? : 0,
+ pdata->y_max ? : MAX_12BIT,
+ 0, 0);
+- input_set_abs_params(input_dev, ABS_PRESSURE,
+- pdata->pressure_min, pdata->pressure_max, 0, 0);
++ if (ts->model != 7845)
++ input_set_abs_params(input_dev, ABS_PRESSURE,
++ pdata->pressure_min, pdata->pressure_max, 0, 0);
+
+ ads7846_setup_spi_msg(ts, pdata);
+
+diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
+index ede02dc2bcd0b..1819bb1d27230 100644
+--- a/drivers/irqchip/irq-alpine-msi.c
++++ b/drivers/irqchip/irq-alpine-msi.c
+@@ -199,6 +199,7 @@ static int alpine_msix_init_domains(struct alpine_msix_data *priv,
+ }
+
+ gic_domain = irq_find_host(gic_node);
++ of_node_put(gic_node);
+ if (!gic_domain) {
+ pr_err("Failed to find the GIC domain\n");
+ return -ENXIO;
+diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
+index 8968e5e93fcb8..fefafe1af1167 100644
+--- a/drivers/irqchip/irq-bcm7120-l2.c
++++ b/drivers/irqchip/irq-bcm7120-l2.c
+@@ -271,7 +271,8 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn,
+ flags |= IRQ_GC_BE_IO;
+
+ ret = irq_alloc_domain_generic_chips(data->domain, IRQS_PER_WORD, 1,
+- dn->full_name, handle_level_irq, clr, 0, flags);
++ dn->full_name, handle_level_irq, clr,
++ IRQ_LEVEL, flags);
+ if (ret) {
+ pr_err("failed to allocate generic irq chip\n");
+ goto out_free_domain;
+diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
+index 83364fedbf0ab..3f1ae63233cb4 100644
+--- a/drivers/irqchip/irq-brcmstb-l2.c
++++ b/drivers/irqchip/irq-brcmstb-l2.c
+@@ -169,6 +169,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
+ *init_params)
+ {
+ unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
++ unsigned int set = 0;
+ struct brcmstb_l2_intc_data *data;
+ struct irq_chip_type *ct;
+ int ret;
+@@ -216,9 +217,12 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
+ if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN))
+ flags |= IRQ_GC_BE_IO;
+
++ if (init_params->handler == handle_level_irq)
++ set |= IRQ_LEVEL;
++
+ /* Allocate a single Generic IRQ chip for this node */
+ ret = irq_alloc_domain_generic_chips(data->domain, 32, 1,
+- np->full_name, init_params->handler, clr, 0, flags);
++ np->full_name, init_params->handler, clr, set, flags);
+ if (ret) {
+ pr_err("failed to allocate generic irq chip\n");
+ goto out_free_domain;
+diff --git a/drivers/irqchip/irq-mvebu-gicp.c b/drivers/irqchip/irq-mvebu-gicp.c
+index 3be5c5dba1dab..5caec411059f5 100644
+--- a/drivers/irqchip/irq-mvebu-gicp.c
++++ b/drivers/irqchip/irq-mvebu-gicp.c
+@@ -223,6 +223,7 @@ static int mvebu_gicp_probe(struct platform_device *pdev)
+ }
+
+ parent_domain = irq_find_host(irq_parent_dn);
++ of_node_put(irq_parent_dn);
+ if (!parent_domain) {
+ dev_err(&pdev->dev, "failed to find parent IRQ domain\n");
+ return -ENODEV;
+diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
+index df7bc45bc0ced..b3371812a2158 100644
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -1905,6 +1905,7 @@ static void process_deferred_bios(struct work_struct *ws)
+
+ else
+ commit_needed = process_bio(cache, bio) || commit_needed;
++ cond_resched();
+ }
+
+ if (commit_needed)
+@@ -1927,6 +1928,7 @@ static void requeue_deferred_bios(struct cache *cache)
+ while ((bio = bio_list_pop(&bios))) {
+ bio->bi_status = BLK_STS_DM_REQUEUE;
+ bio_endio(bio);
++ cond_resched();
+ }
+ }
+
+@@ -1967,6 +1969,8 @@ static void check_migrations(struct work_struct *ws)
+ r = mg_start(cache, op, NULL);
+ if (r)
+ break;
++
++ cond_resched();
+ }
+ }
+
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index 2fcf62fb2844f..1f1614af5e979 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -301,8 +301,11 @@ static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc)
+ */
+ bio_for_each_segment(bvec, bio, iter) {
+ if (bio_iter_len(bio, iter) > corrupt_bio_byte) {
+- char *segment = (page_address(bio_iter_page(bio, iter))
+- + bio_iter_offset(bio, iter));
++ char *segment;
++ struct page *page = bio_iter_page(bio, iter);
++ if (unlikely(page == ZERO_PAGE(0)))
++ break;
++ segment = (page_address(page) + bio_iter_offset(bio, iter));
+ segment[corrupt_bio_byte] = fc->corrupt_bio_value;
+ DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
+ "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n",
+@@ -364,9 +367,11 @@ static int flakey_map(struct dm_target *ti, struct bio *bio)
+ /*
+ * Corrupt matching writes.
+ */
+- if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == WRITE)) {
+- if (all_corrupt_bio_flags_match(bio, fc))
+- corrupt_bio_data(bio, fc);
++ if (fc->corrupt_bio_byte) {
++ if (fc->corrupt_bio_rw == WRITE) {
++ if (all_corrupt_bio_flags_match(bio, fc))
++ corrupt_bio_data(bio, fc);
++ }
+ goto map_bio;
+ }
+
+@@ -397,13 +402,14 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio,
+ }
+
+ if (!*error && pb->bio_submitted && (bio_data_dir(bio) == READ)) {
+- if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
+- all_corrupt_bio_flags_match(bio, fc)) {
+- /*
+- * Corrupt successful matching READs while in down state.
+- */
+- corrupt_bio_data(bio, fc);
+-
++ if (fc->corrupt_bio_byte) {
++ if ((fc->corrupt_bio_rw == READ) &&
++ all_corrupt_bio_flags_match(bio, fc)) {
++ /*
++ * Corrupt successful matching READs while in down state.
++ */
++ corrupt_bio_data(bio, fc);
++ }
+ } else if (!test_bit(DROP_WRITES, &fc->flags) &&
+ !test_bit(ERROR_WRITES, &fc->flags)) {
+ /*
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 386cb33953783..969ea013c74e4 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2222,6 +2222,7 @@ static void process_thin_deferred_bios(struct thin_c *tc)
+ throttle_work_update(&pool->throttle);
+ dm_pool_issue_prefetches(pool->pmd);
+ }
++ cond_resched();
+ }
+ blk_finish_plug(&plug);
+ }
+@@ -2305,6 +2306,7 @@ static void process_thin_deferred_cells(struct thin_c *tc)
+ else
+ pool->process_cell(tc, cell);
+ }
++ cond_resched();
+ } while (!list_empty(&cells));
+ }
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 324d1dd58e2bc..3d9a77f4e20f8 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -279,7 +279,6 @@ out_free_rq_tio_cache:
+
+ static void local_exit(void)
+ {
+- flush_scheduled_work();
+ destroy_workqueue(deferred_remove_workqueue);
+
+ kmem_cache_destroy(_rq_cache);
+diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
+index 1f71c14c8aab4..4f906d25ce5ca 100644
+--- a/drivers/media/i2c/ov7670.c
++++ b/drivers/media/i2c/ov7670.c
+@@ -1750,7 +1750,7 @@ static int ov7670_parse_dt(struct device *dev,
+
+ if (bus_cfg.bus_type != V4L2_MBUS_PARALLEL) {
+ dev_err(dev, "Unsupported media bus type\n");
+- return ret;
++ return -EINVAL;
+ }
+ info->mbus_config = bus_cfg.bus.parallel.flags;
+
+diff --git a/drivers/media/i2c/ov772x.c b/drivers/media/i2c/ov772x.c
+index 4eae5f2f7d318..11deaec9afbfb 100644
+--- a/drivers/media/i2c/ov772x.c
++++ b/drivers/media/i2c/ov772x.c
+@@ -1424,7 +1424,7 @@ static int ov772x_probe(struct i2c_client *client,
+ priv->subdev.ctrl_handler = &priv->hdl;
+ if (priv->hdl.error) {
+ ret = priv->hdl.error;
+- goto error_mutex_destroy;
++ goto error_ctrl_free;
+ }
+
+ priv->clk = clk_get(&client->dev, NULL);
+@@ -1473,7 +1473,6 @@ error_clk_put:
+ clk_put(priv->clk);
+ error_ctrl_free:
+ v4l2_ctrl_handler_free(&priv->hdl);
+-error_mutex_destroy:
+ mutex_destroy(&priv->lock);
+
+ return ret;
+diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+index cdf4d07343a71..070ddb52c8231 100644
+--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+@@ -1860,6 +1860,9 @@ static void cio2_pci_remove(struct pci_dev *pci_dev)
+ v4l2_device_unregister(&cio2->v4l2_dev);
+ media_device_cleanup(&cio2->media_dev);
+ mutex_destroy(&cio2->lock);
++
++ pm_runtime_forbid(&pci_dev->dev);
++ pm_runtime_get_noresume(&pci_dev->dev);
+ }
+
+ static int __maybe_unused cio2_runtime_suspend(struct device *dev)
+diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
+index 00e52f0b8251b..b559cc179d708 100644
+--- a/drivers/media/platform/omap3isp/isp.c
++++ b/drivers/media/platform/omap3isp/isp.c
+@@ -2247,7 +2247,16 @@ static int isp_probe(struct platform_device *pdev)
+
+ /* Regulators */
+ isp->isp_csiphy1.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy1");
++ if (IS_ERR(isp->isp_csiphy1.vdd)) {
++ ret = PTR_ERR(isp->isp_csiphy1.vdd);
++ goto error;
++ }
++
+ isp->isp_csiphy2.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy2");
++ if (IS_ERR(isp->isp_csiphy2.vdd)) {
++ ret = PTR_ERR(isp->isp_csiphy2.vdd);
++ goto error;
++ }
+
+ /* Clocks
+ *
+diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
+index 71b8c9bbf6c40..8cf2a5c0575ab 100644
+--- a/drivers/media/rc/ene_ir.c
++++ b/drivers/media/rc/ene_ir.c
+@@ -1116,6 +1116,8 @@ static void ene_remove(struct pnp_dev *pnp_dev)
+ struct ene_device *dev = pnp_get_drvdata(pnp_dev);
+ unsigned long flags;
+
++ rc_unregister_device(dev->rdev);
++ del_timer_sync(&dev->tx_sim_timer);
+ spin_lock_irqsave(&dev->hw_lock, flags);
+ ene_rx_disable(dev);
+ ene_rx_restore_hw_buffer(dev);
+@@ -1123,7 +1125,6 @@ static void ene_remove(struct pnp_dev *pnp_dev)
+
+ free_irq(dev->irq, dev);
+ release_region(dev->hw_io, ENE_IO_SIZE);
+- rc_unregister_device(dev->rdev);
+ kfree(dev);
+ }
+
+diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
+index 3071d9bc77f48..2df3d730ea768 100644
+--- a/drivers/media/usb/siano/smsusb.c
++++ b/drivers/media/usb/siano/smsusb.c
+@@ -190,6 +190,7 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev)
+
+ for (i = 0; i < MAX_URBS; i++) {
+ usb_kill_urb(&dev->surbs[i].urb);
++ cancel_work_sync(&dev->surbs[i].wq);
+
+ if (dev->surbs[i].cb) {
+ smscore_putbuffer(dev->coredev, dev->surbs[i].cb);
+diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
+index cb6046481aed3..84b1339c2c6e3 100644
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -11,6 +11,7 @@
+ *
+ */
+
++#include <asm/barrier.h>
+ #include <linux/kernel.h>
+ #include <linux/list.h>
+ #include <linux/module.h>
+@@ -1280,17 +1281,12 @@ static void uvc_ctrl_send_slave_event(struct uvc_video_chain *chain,
+ uvc_ctrl_send_event(chain, handle, ctrl, mapping, val, changes);
+ }
+
+-static void uvc_ctrl_status_event_work(struct work_struct *work)
++void uvc_ctrl_status_event(struct uvc_video_chain *chain,
++ struct uvc_control *ctrl, const u8 *data)
+ {
+- struct uvc_device *dev = container_of(work, struct uvc_device,
+- async_ctrl.work);
+- struct uvc_ctrl_work *w = &dev->async_ctrl;
+- struct uvc_video_chain *chain = w->chain;
+ struct uvc_control_mapping *mapping;
+- struct uvc_control *ctrl = w->ctrl;
+ struct uvc_fh *handle;
+ unsigned int i;
+- int ret;
+
+ mutex_lock(&chain->ctrl_mutex);
+
+@@ -1298,7 +1294,7 @@ static void uvc_ctrl_status_event_work(struct work_struct *work)
+ ctrl->handle = NULL;
+
+ list_for_each_entry(mapping, &ctrl->info.mappings, list) {
+- s32 value = __uvc_ctrl_get_value(mapping, w->data);
++ s32 value = __uvc_ctrl_get_value(mapping, data);
+
+ /*
+ * handle may be NULL here if the device sends auto-update
+@@ -1317,6 +1313,20 @@ static void uvc_ctrl_status_event_work(struct work_struct *work)
+ }
+
+ mutex_unlock(&chain->ctrl_mutex);
++}
++
++static void uvc_ctrl_status_event_work(struct work_struct *work)
++{
++ struct uvc_device *dev = container_of(work, struct uvc_device,
++ async_ctrl.work);
++ struct uvc_ctrl_work *w = &dev->async_ctrl;
++ int ret;
++
++ uvc_ctrl_status_event(w->chain, w->ctrl, w->data);
++
++ /* The barrier is needed to synchronize with uvc_status_stop(). */
++ if (smp_load_acquire(&dev->flush_status))
++ return;
+
+ /* Resubmit the URB. */
+ w->urb->interval = dev->int_ep->desc.bInterval;
+@@ -1326,8 +1336,8 @@ static void uvc_ctrl_status_event_work(struct work_struct *work)
+ ret);
+ }
+
+-bool uvc_ctrl_status_event(struct urb *urb, struct uvc_video_chain *chain,
+- struct uvc_control *ctrl, const u8 *data)
++bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain,
++ struct uvc_control *ctrl, const u8 *data)
+ {
+ struct uvc_device *dev = chain->dev;
+ struct uvc_ctrl_work *w = &dev->async_ctrl;
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 998ce712978ae..775d677206484 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -1033,10 +1033,8 @@ static int uvc_parse_vendor_control(struct uvc_device *dev,
+ + n;
+ memcpy(unit->extension.bmControls, &buffer[23+p], 2*n);
+
+- if (buffer[24+p+2*n] != 0)
+- usb_string(udev, buffer[24+p+2*n], unit->name,
+- sizeof(unit->name));
+- else
++ if (buffer[24+p+2*n] == 0 ||
++ usb_string(udev, buffer[24+p+2*n], unit->name, sizeof(unit->name)) < 0)
+ sprintf(unit->name, "Extension %u", buffer[3]);
+
+ list_add_tail(&unit->list, &dev->entities);
+@@ -1161,15 +1159,15 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
+ memcpy(term->media.bmTransportModes, &buffer[10+n], p);
+ }
+
+- if (buffer[7] != 0)
+- usb_string(udev, buffer[7], term->name,
+- sizeof(term->name));
+- else if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA)
+- sprintf(term->name, "Camera %u", buffer[3]);
+- else if (UVC_ENTITY_TYPE(term) == UVC_ITT_MEDIA_TRANSPORT_INPUT)
+- sprintf(term->name, "Media %u", buffer[3]);
+- else
+- sprintf(term->name, "Input %u", buffer[3]);
++ if (buffer[7] == 0 ||
++ usb_string(udev, buffer[7], term->name, sizeof(term->name)) < 0) {
++ if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA)
++ sprintf(term->name, "Camera %u", buffer[3]);
++ if (UVC_ENTITY_TYPE(term) == UVC_ITT_MEDIA_TRANSPORT_INPUT)
++ sprintf(term->name, "Media %u", buffer[3]);
++ else
++ sprintf(term->name, "Input %u", buffer[3]);
++ }
+
+ list_add_tail(&term->list, &dev->entities);
+ break;
+@@ -1201,10 +1199,8 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
+
+ memcpy(term->baSourceID, &buffer[7], 1);
+
+- if (buffer[8] != 0)
+- usb_string(udev, buffer[8], term->name,
+- sizeof(term->name));
+- else
++ if (buffer[8] == 0 ||
++ usb_string(udev, buffer[8], term->name, sizeof(term->name)) < 0)
+ sprintf(term->name, "Output %u", buffer[3]);
+
+ list_add_tail(&term->list, &dev->entities);
+@@ -1226,10 +1222,8 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
+
+ memcpy(unit->baSourceID, &buffer[5], p);
+
+- if (buffer[5+p] != 0)
+- usb_string(udev, buffer[5+p], unit->name,
+- sizeof(unit->name));
+- else
++ if (buffer[5+p] == 0 ||
++ usb_string(udev, buffer[5+p], unit->name, sizeof(unit->name)) < 0)
+ sprintf(unit->name, "Selector %u", buffer[3]);
+
+ list_add_tail(&unit->list, &dev->entities);
+@@ -1259,10 +1253,8 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
+ if (dev->uvc_version >= 0x0110)
+ unit->processing.bmVideoStandards = buffer[9+n];
+
+- if (buffer[8+n] != 0)
+- usb_string(udev, buffer[8+n], unit->name,
+- sizeof(unit->name));
+- else
++ if (buffer[8+n] == 0 ||
++ usb_string(udev, buffer[8+n], unit->name, sizeof(unit->name)) < 0)
+ sprintf(unit->name, "Processing %u", buffer[3]);
+
+ list_add_tail(&unit->list, &dev->entities);
+@@ -1290,10 +1282,8 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
+ unit->extension.bmControls = (u8 *)unit + sizeof(*unit);
+ memcpy(unit->extension.bmControls, &buffer[23+p], n);
+
+- if (buffer[23+p+n] != 0)
+- usb_string(udev, buffer[23+p+n], unit->name,
+- sizeof(unit->name));
+- else
++ if (buffer[23+p+n] == 0 ||
++ usb_string(udev, buffer[23+p+n], unit->name, sizeof(unit->name)) < 0)
+ sprintf(unit->name, "Extension %u", buffer[3]);
+
+ list_add_tail(&unit->list, &dev->entities);
+diff --git a/drivers/media/usb/uvc/uvc_entity.c b/drivers/media/usb/uvc/uvc_entity.c
+index f2457953f27c6..0d5aaaa7e2d96 100644
+--- a/drivers/media/usb/uvc/uvc_entity.c
++++ b/drivers/media/usb/uvc/uvc_entity.c
+@@ -42,7 +42,7 @@ static int uvc_mc_create_links(struct uvc_video_chain *chain,
+ continue;
+
+ remote = uvc_entity_by_id(chain->dev, entity->baSourceID[i]);
+- if (remote == NULL)
++ if (remote == NULL || remote->num_pads == 0)
+ return -EINVAL;
+
+ source = (UVC_ENTITY_TYPE(remote) == UVC_TT_STREAMING)
+diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c
+index 883e4cab45e79..141ac1ffb42ee 100644
+--- a/drivers/media/usb/uvc/uvc_status.c
++++ b/drivers/media/usb/uvc/uvc_status.c
+@@ -11,6 +11,7 @@
+ *
+ */
+
++#include <asm/barrier.h>
+ #include <linux/kernel.h>
+ #include <linux/input.h>
+ #include <linux/slab.h>
+@@ -184,7 +185,8 @@ static bool uvc_event_control(struct urb *urb,
+
+ switch (status->bAttribute) {
+ case UVC_CTRL_VALUE_CHANGE:
+- return uvc_ctrl_status_event(urb, chain, ctrl, status->bValue);
++ return uvc_ctrl_status_event_async(urb, chain, ctrl,
++ status->bValue);
+
+ case UVC_CTRL_INFO_CHANGE:
+ case UVC_CTRL_FAILURE_CHANGE:
+@@ -314,5 +316,41 @@ int uvc_status_start(struct uvc_device *dev, gfp_t flags)
+
+ void uvc_status_stop(struct uvc_device *dev)
+ {
++ struct uvc_ctrl_work *w = &dev->async_ctrl;
++
++ /*
++ * Prevent the asynchronous control handler from requeing the URB. The
++ * barrier is needed so the flush_status change is visible to other
++ * CPUs running the asynchronous handler before usb_kill_urb() is
++ * called below.
++ */
++ smp_store_release(&dev->flush_status, true);
++
++ /*
++ * Cancel any pending asynchronous work. If any status event was queued,
++ * process it synchronously.
++ */
++ if (cancel_work_sync(&w->work))
++ uvc_ctrl_status_event(w->chain, w->ctrl, w->data);
++
++ /* Kill the urb. */
+ usb_kill_urb(dev->int_urb);
++
++ /*
++ * The URB completion handler may have queued asynchronous work. This
++ * won't resubmit the URB as flush_status is set, but it needs to be
++ * cancelled before returning or it could then race with a future
++ * uvc_status_start() call.
++ */
++ if (cancel_work_sync(&w->work))
++ uvc_ctrl_status_event(w->chain, w->ctrl, w->data);
++
++ /*
++ * From this point, there are no events on the queue and the status URB
++ * is dead. No events will be queued until uvc_status_start() is called.
++ * The barrier is needed to make sure that flush_status is visible to
++ * uvc_ctrl_status_event_work() when uvc_status_start() will be called
++ * again.
++ */
++ smp_store_release(&dev->flush_status, false);
+ }
+diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
+index b431f06d5a1f5..1c0249df52566 100644
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -1278,7 +1278,9 @@ static void uvc_video_decode_meta(struct uvc_streaming *stream,
+ if (has_scr)
+ memcpy(stream->clock.last_scr, scr, 6);
+
+- memcpy(&meta->length, mem, length);
++ meta->length = mem[0];
++ meta->flags = mem[1];
++ memcpy(meta->buf, &mem[2], length - 2);
+ meta_buf->bytesused += length + sizeof(meta->ns) + sizeof(meta->sof);
+
+ uvc_trace(UVC_TRACE_FRAME,
+diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
+index 839ba3cc53119..e8b06164b27ac 100644
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -603,6 +603,7 @@ struct uvc_device {
+ /* Status Interrupt Endpoint */
+ struct usb_host_endpoint *int_ep;
+ struct urb *int_urb;
++ bool flush_status;
+ u8 *status;
+ struct input_dev *input;
+ char input_phys[64];
+@@ -768,7 +769,9 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
+ int uvc_ctrl_init_device(struct uvc_device *dev);
+ void uvc_ctrl_cleanup_device(struct uvc_device *dev);
+ int uvc_ctrl_restore_values(struct uvc_device *dev);
+-bool uvc_ctrl_status_event(struct urb *urb, struct uvc_video_chain *chain,
++bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain,
++ struct uvc_control *ctrl, const u8 *data);
++void uvc_ctrl_status_event(struct uvc_video_chain *chain,
+ struct uvc_control *ctrl, const u8 *data);
+
+ int uvc_ctrl_begin(struct uvc_video_chain *chain);
+diff --git a/drivers/mfd/pcf50633-adc.c b/drivers/mfd/pcf50633-adc.c
+index c1984b0d1b652..a4a765055ee6b 100644
+--- a/drivers/mfd/pcf50633-adc.c
++++ b/drivers/mfd/pcf50633-adc.c
+@@ -140,6 +140,7 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg,
+ void *callback_param)
+ {
+ struct pcf50633_adc_request *req;
++ int ret;
+
+ /* req is freed when the result is ready, in interrupt handler */
+ req = kmalloc(sizeof(*req), GFP_KERNEL);
+@@ -151,7 +152,11 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg,
+ req->callback = callback;
+ req->callback_param = callback_param;
+
+- return adc_enqueue_request(pcf, req);
++ ret = adc_enqueue_request(pcf, req);
++ if (ret)
++ kfree(req);
++
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(pcf50633_adc_async_read);
+
+diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
+index 198e030e5b3d5..14f3e05643fc3 100644
+--- a/drivers/misc/mei/bus-fixup.c
++++ b/drivers/misc/mei/bus-fixup.c
+@@ -174,7 +174,7 @@ static int mei_fwver(struct mei_cl_device *cldev)
+ ret = __mei_cl_send(cldev->cl, buf, sizeof(struct mkhi_msg_hdr),
+ MEI_CL_IO_TX_BLOCKING);
+ if (ret < 0) {
+- dev_err(&cldev->dev, "Could not send ReqFWVersion cmd\n");
++ dev_err(&cldev->dev, "Could not send ReqFWVersion cmd ret = %d\n", ret);
+ return ret;
+ }
+
+@@ -186,7 +186,7 @@ static int mei_fwver(struct mei_cl_device *cldev)
+ * Should be at least one version block,
+ * error out if nothing found
+ */
+- dev_err(&cldev->dev, "Could not read FW version\n");
++ dev_err(&cldev->dev, "Could not read FW version ret = %d\n", bytes_recv);
+ return -EIO;
+ }
+
+@@ -335,7 +335,7 @@ static int mei_nfc_if_version(struct mei_cl *cl,
+ ret = __mei_cl_send(cl, (u8 *)&cmd, sizeof(struct mei_nfc_cmd),
+ MEI_CL_IO_TX_BLOCKING);
+ if (ret < 0) {
+- dev_err(bus->dev, "Could not send IF version cmd\n");
++ dev_err(bus->dev, "Could not send IF version cmd ret = %d\n", ret);
+ return ret;
+ }
+
+@@ -350,7 +350,7 @@ static int mei_nfc_if_version(struct mei_cl *cl,
+ ret = 0;
+ bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length, 0, 0);
+ if (bytes_recv < 0 || (size_t)bytes_recv < if_version_length) {
+- dev_err(bus->dev, "Could not read IF version\n");
++ dev_err(bus->dev, "Could not read IF version ret = %d\n", bytes_recv);
+ ret = -EIO;
+ goto err;
+ }
+diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
+index 88075e420f907..fe7bfcdf7c69c 100644
+--- a/drivers/mtd/nand/raw/sunxi_nand.c
++++ b/drivers/mtd/nand/raw/sunxi_nand.c
+@@ -1670,7 +1670,7 @@ static int sunxi_nand_ooblayout_free(struct mtd_info *mtd, int section,
+ if (section < ecc->steps)
+ oobregion->length = 4;
+ else
+- oobregion->offset = mtd->oobsize - oobregion->offset;
++ oobregion->length = mtd->oobsize - oobregion->offset;
+
+ return 0;
+ }
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index 1ea3a4977c618..3d0241f8f3ec7 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -480,6 +480,7 @@ static int uif_init(struct ubi_device *ubi)
+ err = ubi_add_volume(ubi, ubi->volumes[i]);
+ if (err) {
+ ubi_err(ubi, "cannot add volume %d", i);
++ ubi->volumes[i] = NULL;
+ goto out_volumes;
+ }
+ }
+@@ -656,6 +657,12 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
+ ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size);
+ ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size);
+
++ if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset + UBI_VID_HDR_SIZE) >
++ ubi->vid_hdr_alsize)) {
++ ubi_err(ubi, "VID header offset %d too large.", ubi->vid_hdr_offset);
++ return -EINVAL;
++ }
++
+ dbg_gen("min_io_size %d", ubi->min_io_size);
+ dbg_gen("max_write_size %d", ubi->max_write_size);
+ dbg_gen("hdrs_min_io_size %d", ubi->hdrs_min_io_size);
+diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
+index 9f6ffd340a3ef..c5dec58846ce8 100644
+--- a/drivers/mtd/ubi/vmt.c
++++ b/drivers/mtd/ubi/vmt.c
+@@ -477,7 +477,7 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
+ for (i = 0; i < -pebs; i++) {
+ err = ubi_eba_unmap_leb(ubi, vol, reserved_pebs + i);
+ if (err)
+- goto out_acc;
++ goto out_free;
+ }
+ spin_lock(&ubi->volumes_lock);
+ ubi->rsvd_pebs += pebs;
+@@ -525,8 +525,10 @@ out_acc:
+ ubi->avail_pebs += pebs;
+ spin_unlock(&ubi->volumes_lock);
+ }
++ return err;
++
+ out_free:
+- kfree(new_eba_tbl);
++ ubi_eba_destroy_table(new_eba_tbl);
+ return err;
+ }
+
+@@ -593,6 +595,7 @@ int ubi_add_volume(struct ubi_device *ubi, struct ubi_volume *vol)
+ if (err) {
+ ubi_err(ubi, "cannot add character device for volume %d, error %d",
+ vol_id, err);
++ vol_release(&vol->dev);
+ return err;
+ }
+
+@@ -603,15 +606,14 @@ int ubi_add_volume(struct ubi_device *ubi, struct ubi_volume *vol)
+ vol->dev.groups = volume_dev_groups;
+ dev_set_name(&vol->dev, "%s_%d", ubi->ubi_name, vol->vol_id);
+ err = device_register(&vol->dev);
+- if (err)
+- goto out_cdev;
++ if (err) {
++ cdev_del(&vol->cdev);
++ put_device(&vol->dev);
++ return err;
++ }
+
+ self_check_volumes(ubi);
+ return err;
+-
+-out_cdev:
+- cdev_del(&vol->cdev);
+- return err;
+ }
+
+ /**
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index ac336164f6253..7f0847ee53f28 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -865,8 +865,11 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+
+ err = do_sync_erase(ubi, e1, vol_id, lnum, 0);
+ if (err) {
+- if (e2)
++ if (e2) {
++ spin_lock(&ubi->wl_lock);
+ wl_entry_destroy(ubi, e2);
++ spin_unlock(&ubi->wl_lock);
++ }
+ goto out_ro;
+ }
+
+@@ -948,11 +951,11 @@ out_error:
+ spin_lock(&ubi->wl_lock);
+ ubi->move_from = ubi->move_to = NULL;
+ ubi->move_to_put = ubi->wl_scheduled = 0;
++ wl_entry_destroy(ubi, e1);
++ wl_entry_destroy(ubi, e2);
+ spin_unlock(&ubi->wl_lock);
+
+ ubi_free_vid_buf(vidb);
+- wl_entry_destroy(ubi, e1);
+- wl_entry_destroy(ubi, e2);
+
+ out_ro:
+ ubi_ro_mode(ubi);
+@@ -1096,14 +1099,18 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)
+ /* Re-schedule the LEB for erasure */
+ err1 = schedule_erase(ubi, e, vol_id, lnum, 0, false);
+ if (err1) {
++ spin_lock(&ubi->wl_lock);
+ wl_entry_destroy(ubi, e);
++ spin_unlock(&ubi->wl_lock);
+ err = err1;
+ goto out_ro;
+ }
+ return err;
+ }
+
++ spin_lock(&ubi->wl_lock);
+ wl_entry_destroy(ubi, e);
++ spin_unlock(&ubi->wl_lock);
+ if (err != -EIO)
+ /*
+ * If this is not %-EIO, we have no idea what to do. Scheduling
+@@ -1219,6 +1226,18 @@ int ubi_wl_put_peb(struct ubi_device *ubi, int vol_id, int lnum,
+ retry:
+ spin_lock(&ubi->wl_lock);
+ e = ubi->lookuptbl[pnum];
++ if (!e) {
++ /*
++ * This wl entry has been removed for some errors by other
++ * process (eg. wear leveling worker), corresponding process
++ * (except __erase_worker, which cannot concurrent with
++ * ubi_wl_put_peb) will set ubi ro_mode at the same time,
++ * just ignore this wl entry.
++ */
++ spin_unlock(&ubi->wl_lock);
++ up_read(&ubi->fm_protect);
++ return 0;
++ }
+ if (e == ubi->move_from) {
+ /*
+ * User is putting the physical eraseblock which was selected to
+diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
+index ffdee5aeb8a93..d46599871919d 100644
+--- a/drivers/net/can/usb/esd_usb2.c
++++ b/drivers/net/can/usb/esd_usb2.c
+@@ -290,7 +290,6 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,
+ cf->data[2] |= CAN_ERR_PROT_STUFF;
+ break;
+ default:
+- cf->data[3] = ecc & SJA1000_ECC_SEG;
+ break;
+ }
+
+@@ -298,6 +297,9 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,
+ if (!(ecc & SJA1000_ECC_DIR))
+ cf->data[2] |= CAN_ERR_PROT_TX;
+
++ /* Bit stream position in CAN frame as the error was detected */
++ cf->data[3] = ecc & SJA1000_ECC_SEG;
++
+ if (priv->can.state == CAN_STATE_ERROR_WARNING ||
+ priv->can.state == CAN_STATE_ERROR_PASSIVE) {
+ cf->data[1] = (txerr > rxerr) ?
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 96ef2dd46c78c..84bcb3ce00f73 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1825,6 +1825,14 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring,
+ __func__, p_index, ring->c_index,
+ ring->read_ptr, dma_length_status);
+
++ if (unlikely(len > RX_BUF_LENGTH)) {
++ netif_err(priv, rx_status, dev, "oversized packet\n");
++ dev->stats.rx_length_errors++;
++ dev->stats.rx_errors++;
++ dev_kfree_skb_any(skb);
++ goto next;
++ }
++
+ if (unlikely(!(dma_flag & DMA_EOP) || !(dma_flag & DMA_SOP))) {
+ netif_err(priv, rx_status, dev,
+ "dropping fragmented packet!\n");
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+index ef9f932f02263..5a2feadd80f08 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+@@ -564,7 +564,7 @@ static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer,
+ } else {
+ cur_string = mlx5_tracer_message_get(tracer, tracer_event);
+ if (!cur_string) {
+- pr_debug("%s Got string event for unknown string tdsm: %d\n",
++ pr_debug("%s Got string event for unknown string tmsn: %d\n",
+ __func__, tracer_event->string_event.tmsn);
+ return -1;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index 9c3653e06886a..fc880c02459db 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -164,7 +164,8 @@ static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr)
+ fp = list_entry(dev->priv.free_list.next, struct fw_page, list);
+ n = find_first_bit(&fp->bitmask, 8 * sizeof(fp->bitmask));
+ if (n >= MLX5_NUM_4K_IN_PAGE) {
+- mlx5_core_warn(dev, "alloc 4k bug\n");
++ mlx5_core_warn(dev, "alloc 4k bug: fw page = 0x%llx, n = %u, bitmask: %lu, max num of 4K pages: %d\n",
++ fp->addr, n, fp->bitmask, MLX5_NUM_4K_IN_PAGE);
+ return -ENOENT;
+ }
+ clear_bit(n, &fp->bitmask);
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index 8a18a33b5b59f..e23d58f83dd6f 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -244,11 +244,11 @@ static inline void ath9k_skb_queue_complete(struct hif_device_usb *hif_dev,
+ ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
+ skb, txok);
+ if (txok) {
+- TX_STAT_INC(skb_success);
+- TX_STAT_ADD(skb_success_bytes, ln);
++ TX_STAT_INC(hif_dev, skb_success);
++ TX_STAT_ADD(hif_dev, skb_success_bytes, ln);
+ }
+ else
+- TX_STAT_INC(skb_failed);
++ TX_STAT_INC(hif_dev, skb_failed);
+ }
+ }
+
+@@ -302,7 +302,7 @@ static void hif_usb_tx_cb(struct urb *urb)
+ hif_dev->tx.tx_buf_cnt++;
+ if (!(hif_dev->tx.flags & HIF_USB_TX_STOP))
+ __hif_usb_tx(hif_dev); /* Check for pending SKBs */
+- TX_STAT_INC(buf_completed);
++ TX_STAT_INC(hif_dev, buf_completed);
+ spin_unlock(&hif_dev->tx.tx_lock);
+ }
+
+@@ -353,7 +353,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
+ tx_buf->len += tx_buf->offset;
+
+ __skb_queue_tail(&tx_buf->skb_queue, nskb);
+- TX_STAT_INC(skb_queued);
++ TX_STAT_INC(hif_dev, skb_queued);
+ }
+
+ usb_fill_bulk_urb(tx_buf->urb, hif_dev->udev,
+@@ -368,11 +368,10 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
+ __skb_queue_head_init(&tx_buf->skb_queue);
+ list_move_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
+ hif_dev->tx.tx_buf_cnt++;
++ } else {
++ TX_STAT_INC(hif_dev, buf_queued);
+ }
+
+- if (!ret)
+- TX_STAT_INC(buf_queued);
+-
+ return ret;
+ }
+
+@@ -515,7 +514,7 @@ static void hif_usb_sta_drain(void *hif_handle, u8 idx)
+ ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
+ skb, false);
+ hif_dev->tx.tx_skb_cnt--;
+- TX_STAT_INC(skb_failed);
++ TX_STAT_INC(hif_dev, skb_failed);
+ }
+ }
+
+@@ -562,11 +561,11 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ memcpy(ptr, skb->data, rx_remain_len);
+
+ rx_pkt_len += rx_remain_len;
+- hif_dev->rx_remain_len = 0;
+ skb_put(remain_skb, rx_pkt_len);
+
+ skb_pool[pool_index++] = remain_skb;
+-
++ hif_dev->remain_skb = NULL;
++ hif_dev->rx_remain_len = 0;
+ } else {
+ index = rx_remain_len;
+ }
+@@ -585,16 +584,21 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ pkt_len = get_unaligned_le16(ptr + index);
+ pkt_tag = get_unaligned_le16(ptr + index + 2);
+
++ /* It is supposed that if we have an invalid pkt_tag or
++ * pkt_len then the whole input SKB is considered invalid
++ * and dropped; the associated packets already in skb_pool
++ * are dropped, too.
++ */
+ if (pkt_tag != ATH_USB_RX_STREAM_MODE_TAG) {
+- RX_STAT_INC(skb_dropped);
+- return;
++ RX_STAT_INC(hif_dev, skb_dropped);
++ goto invalid_pkt;
+ }
+
+ if (pkt_len > 2 * MAX_RX_BUF_SIZE) {
+ dev_err(&hif_dev->udev->dev,
+ "ath9k_htc: invalid pkt_len (%x)\n", pkt_len);
+- RX_STAT_INC(skb_dropped);
+- return;
++ RX_STAT_INC(hif_dev, skb_dropped);
++ goto invalid_pkt;
+ }
+
+ pad_len = 4 - (pkt_len & 0x3);
+@@ -606,11 +610,6 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+
+ if (index > MAX_RX_BUF_SIZE) {
+ spin_lock(&hif_dev->rx_lock);
+- hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE;
+- hif_dev->rx_transfer_len =
+- MAX_RX_BUF_SIZE - chk_idx - 4;
+- hif_dev->rx_pad_len = pad_len;
+-
+ nskb = __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC);
+ if (!nskb) {
+ dev_err(&hif_dev->udev->dev,
+@@ -618,8 +617,14 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ spin_unlock(&hif_dev->rx_lock);
+ goto err;
+ }
++
++ hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE;
++ hif_dev->rx_transfer_len =
++ MAX_RX_BUF_SIZE - chk_idx - 4;
++ hif_dev->rx_pad_len = pad_len;
++
+ skb_reserve(nskb, 32);
+- RX_STAT_INC(skb_allocated);
++ RX_STAT_INC(hif_dev, skb_allocated);
+
+ memcpy(nskb->data, &(skb->data[chk_idx+4]),
+ hif_dev->rx_transfer_len);
+@@ -640,7 +645,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ goto err;
+ }
+ skb_reserve(nskb, 32);
+- RX_STAT_INC(skb_allocated);
++ RX_STAT_INC(hif_dev, skb_allocated);
+
+ memcpy(nskb->data, &(skb->data[chk_idx+4]), pkt_len);
+ skb_put(nskb, pkt_len);
+@@ -650,11 +655,18 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+
+ err:
+ for (i = 0; i < pool_index; i++) {
+- RX_STAT_ADD(skb_completed_bytes, skb_pool[i]->len);
++ RX_STAT_ADD(hif_dev, skb_completed_bytes, skb_pool[i]->len);
+ ath9k_htc_rx_msg(hif_dev->htc_handle, skb_pool[i],
+ skb_pool[i]->len, USB_WLAN_RX_PIPE);
+- RX_STAT_INC(skb_completed);
++ RX_STAT_INC(hif_dev, skb_completed);
+ }
++ return;
++invalid_pkt:
++ for (i = 0; i < pool_index; i++) {
++ dev_kfree_skb_any(skb_pool[i]);
++ RX_STAT_INC(hif_dev, skb_dropped);
++ }
++ return;
+ }
+
+ static void ath9k_hif_usb_rx_cb(struct urb *urb)
+diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
+index 81107100e3682..232e93dfbc831 100644
+--- a/drivers/net/wireless/ath/ath9k/htc.h
++++ b/drivers/net/wireless/ath/ath9k/htc.h
+@@ -325,14 +325,18 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb)
+ }
+
+ #ifdef CONFIG_ATH9K_HTC_DEBUGFS
+-#define __STAT_SAFE(expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0)
+-#define TX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
+-#define TX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a)
+-#define RX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++)
+-#define RX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a)
+-#define CAB_STAT_INC priv->debug.tx_stats.cab_queued++
+-
+-#define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++)
++#define __STAT_SAFE(hif_dev, expr) do { ((hif_dev)->htc_handle->drv_priv ? (expr) : 0); } while (0)
++#define CAB_STAT_INC(priv) do { ((priv)->debug.tx_stats.cab_queued++); } while (0)
++#define TX_QSTAT_INC(priv, q) do { ((priv)->debug.tx_stats.queue_stats[q]++); } while (0)
++
++#define TX_STAT_INC(hif_dev, c) \
++ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c++)
++#define TX_STAT_ADD(hif_dev, c, a) \
++ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c += a)
++#define RX_STAT_INC(hif_dev, c) \
++ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c++)
++#define RX_STAT_ADD(hif_dev, c, a) \
++ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c += a)
+
+ void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
+ struct ath_rx_status *rs);
+@@ -372,13 +376,13 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
+ struct ethtool_stats *stats, u64 *data);
+ #else
+
+-#define TX_STAT_INC(c) do { } while (0)
+-#define TX_STAT_ADD(c, a) do { } while (0)
+-#define RX_STAT_INC(c) do { } while (0)
+-#define RX_STAT_ADD(c, a) do { } while (0)
+-#define CAB_STAT_INC do { } while (0)
++#define TX_STAT_INC(hif_dev, c) do { } while (0)
++#define TX_STAT_ADD(hif_dev, c, a) do { } while (0)
++#define RX_STAT_INC(hif_dev, c) do { } while (0)
++#define RX_STAT_ADD(hif_dev, c, a) do { } while (0)
+
+-#define TX_QSTAT_INC(c) do { } while (0)
++#define CAB_STAT_INC(priv)
++#define TX_QSTAT_INC(priv, c)
+
+ static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
+ struct ath_rx_status *rs)
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index 3cd3f3ca1000d..979ac31a77a07 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -106,20 +106,20 @@ static inline enum htc_endpoint_id get_htc_epid(struct ath9k_htc_priv *priv,
+
+ switch (qnum) {
+ case 0:
+- TX_QSTAT_INC(IEEE80211_AC_VO);
++ TX_QSTAT_INC(priv, IEEE80211_AC_VO);
+ epid = priv->data_vo_ep;
+ break;
+ case 1:
+- TX_QSTAT_INC(IEEE80211_AC_VI);
++ TX_QSTAT_INC(priv, IEEE80211_AC_VI);
+ epid = priv->data_vi_ep;
+ break;
+ case 2:
+- TX_QSTAT_INC(IEEE80211_AC_BE);
++ TX_QSTAT_INC(priv, IEEE80211_AC_BE);
+ epid = priv->data_be_ep;
+ break;
+ case 3:
+ default:
+- TX_QSTAT_INC(IEEE80211_AC_BK);
++ TX_QSTAT_INC(priv, IEEE80211_AC_BK);
+ epid = priv->data_bk_ep;
+ break;
+ }
+@@ -323,7 +323,7 @@ static void ath9k_htc_tx_data(struct ath9k_htc_priv *priv,
+ memcpy(tx_fhdr, (u8 *) &tx_hdr, sizeof(tx_hdr));
+
+ if (is_cab) {
+- CAB_STAT_INC;
++ CAB_STAT_INC(priv);
+ tx_ctl->epid = priv->cab_ep;
+ return;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index 6d69cf69fd86e..6331c98088e03 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -394,7 +394,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,
+ * HTC Messages are handled directly here and the obtained SKB
+ * is freed.
+ *
+- * Service messages (Data, WMI) passed to the corresponding
++ * Service messages (Data, WMI) are passed to the corresponding
+ * endpoint RX handlers, which have to free the SKB.
+ */
+ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
+@@ -481,6 +481,8 @@ invalid:
+ if (endpoint->ep_callbacks.rx)
+ endpoint->ep_callbacks.rx(endpoint->ep_callbacks.priv,
+ skb, epid);
++ else
++ goto invalid;
+ }
+ }
+
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
+index 066677bb83eb0..e4ea6f5cc78ab 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.c
++++ b/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -338,6 +338,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+ if (!time_left) {
+ ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
+ wmi_cmd_to_name(cmd_id));
++ wmi->last_seq_id = 0;
+ mutex_unlock(&wmi->op_mutex);
+ kfree_skb(skb);
+ return -ETIMEDOUT;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+index 8510d207ee87d..3626ea9be92af 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -273,6 +273,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
+ err);
+ goto done;
+ }
++ buf[sizeof(buf) - 1] = '\0';
+ ptr = (char *)buf;
+ strsep(&ptr, "\n");
+
+@@ -289,15 +290,17 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
+ if (err) {
+ brcmf_dbg(TRACE, "retrieving clmver failed, %d\n", err);
+ } else {
++ buf[sizeof(buf) - 1] = '\0';
+ clmver = (char *)buf;
+- /* store CLM version for adding it to revinfo debugfs file */
+- memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
+
+ /* Replace all newline/linefeed characters with space
+ * character
+ */
+ strreplace(clmver, '\n', ' ');
+
++ /* store CLM version for adding it to revinfo debugfs file */
++ memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
++
+ brcmf_dbg(INFO, "CLM version = %s\n", clmver);
+ }
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+index 31bf2eb47b49f..6fd155187263f 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -313,6 +313,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
+ brcmf_err("%s: failed to expand headroom\n",
+ brcmf_ifname(ifp));
+ atomic_inc(&drvr->bus_if->stats.pktcow_failed);
++ dev_kfree_skb(skb);
+ goto done;
+ }
+ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+index 768a99c15c08b..e81e892ddacc5 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -339,8 +339,11 @@ brcmf_msgbuf_alloc_pktid(struct device *dev,
+ count++;
+ } while (count < pktids->array_size);
+
+- if (count == pktids->array_size)
++ if (count == pktids->array_size) {
++ dma_unmap_single(dev, *physaddr, skb->len - data_offset,
++ pktids->direction);
+ return -ENOMEM;
++ }
+
+ array[*idx].data_offset = data_offset;
+ array[*idx].physaddr = *physaddr;
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+index a3a470976a5c7..68c4ce352b006 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+@@ -2308,10 +2308,11 @@ static int ipw2100_alloc_skb(struct ipw2100_priv *priv,
+ return -ENOMEM;
+
+ packet->rxp = (struct ipw2100_rx *)packet->skb->data;
+- packet->dma_addr = pci_map_single(priv->pci_dev, packet->skb->data,
++ packet->dma_addr = dma_map_single(&priv->pci_dev->dev,
++ packet->skb->data,
+ sizeof(struct ipw2100_rx),
+- PCI_DMA_FROMDEVICE);
+- if (pci_dma_mapping_error(priv->pci_dev, packet->dma_addr)) {
++ DMA_FROM_DEVICE);
++ if (dma_mapping_error(&priv->pci_dev->dev, packet->dma_addr)) {
+ dev_kfree_skb(packet->skb);
+ return -ENOMEM;
+ }
+@@ -2492,9 +2493,8 @@ static void isr_rx(struct ipw2100_priv *priv, int i,
+ return;
+ }
+
+- pci_unmap_single(priv->pci_dev,
+- packet->dma_addr,
+- sizeof(struct ipw2100_rx), PCI_DMA_FROMDEVICE);
++ dma_unmap_single(&priv->pci_dev->dev, packet->dma_addr,
++ sizeof(struct ipw2100_rx), DMA_FROM_DEVICE);
+
+ skb_put(packet->skb, status->frame_size);
+
+@@ -2576,8 +2576,8 @@ static void isr_rx_monitor(struct ipw2100_priv *priv, int i,
+ return;
+ }
+
+- pci_unmap_single(priv->pci_dev, packet->dma_addr,
+- sizeof(struct ipw2100_rx), PCI_DMA_FROMDEVICE);
++ dma_unmap_single(&priv->pci_dev->dev, packet->dma_addr,
++ sizeof(struct ipw2100_rx), DMA_FROM_DEVICE);
+ memmove(packet->skb->data + sizeof(struct ipw_rt_hdr),
+ packet->skb->data, status->frame_size);
+
+@@ -2702,9 +2702,9 @@ static void __ipw2100_rx_process(struct ipw2100_priv *priv)
+
+ /* Sync the DMA for the RX buffer so CPU is sure to get
+ * the correct values */
+- pci_dma_sync_single_for_cpu(priv->pci_dev, packet->dma_addr,
+- sizeof(struct ipw2100_rx),
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_cpu(&priv->pci_dev->dev, packet->dma_addr,
++ sizeof(struct ipw2100_rx),
++ DMA_FROM_DEVICE);
+
+ if (unlikely(ipw2100_corruption_check(priv, i))) {
+ ipw2100_corruption_detected(priv, i);
+@@ -2936,9 +2936,8 @@ static int __ipw2100_tx_process(struct ipw2100_priv *priv)
+ (packet->index + 1 + i) % txq->entries,
+ tbd->host_addr, tbd->buf_length);
+
+- pci_unmap_single(priv->pci_dev,
+- tbd->host_addr,
+- tbd->buf_length, PCI_DMA_TODEVICE);
++ dma_unmap_single(&priv->pci_dev->dev, tbd->host_addr,
++ tbd->buf_length, DMA_TO_DEVICE);
+ }
+
+ libipw_txb_free(packet->info.d_struct.txb);
+@@ -3178,15 +3177,13 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv)
+ tbd->buf_length = packet->info.d_struct.txb->
+ fragments[i]->len - LIBIPW_3ADDR_LEN;
+
+- tbd->host_addr = pci_map_single(priv->pci_dev,
++ tbd->host_addr = dma_map_single(&priv->pci_dev->dev,
+ packet->info.d_struct.
+- txb->fragments[i]->
+- data +
++ txb->fragments[i]->data +
+ LIBIPW_3ADDR_LEN,
+ tbd->buf_length,
+- PCI_DMA_TODEVICE);
+- if (pci_dma_mapping_error(priv->pci_dev,
+- tbd->host_addr)) {
++ DMA_TO_DEVICE);
++ if (dma_mapping_error(&priv->pci_dev->dev, tbd->host_addr)) {
+ IPW_DEBUG_TX("dma mapping error\n");
+ break;
+ }
+@@ -3195,10 +3192,10 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv)
+ txq->next, tbd->host_addr,
+ tbd->buf_length);
+
+- pci_dma_sync_single_for_device(priv->pci_dev,
+- tbd->host_addr,
+- tbd->buf_length,
+- PCI_DMA_TODEVICE);
++ dma_sync_single_for_device(&priv->pci_dev->dev,
++ tbd->host_addr,
++ tbd->buf_length,
++ DMA_TO_DEVICE);
+
+ txq->next++;
+ txq->next %= txq->entries;
+@@ -3453,9 +3450,9 @@ static int ipw2100_msg_allocate(struct ipw2100_priv *priv)
+ return -ENOMEM;
+
+ for (i = 0; i < IPW_COMMAND_POOL_SIZE; i++) {
+- v = pci_zalloc_consistent(priv->pci_dev,
+- sizeof(struct ipw2100_cmd_header),
+- &p);
++ v = dma_alloc_coherent(&priv->pci_dev->dev,
++ sizeof(struct ipw2100_cmd_header), &p,
++ GFP_KERNEL);
+ if (!v) {
+ printk(KERN_ERR DRV_NAME ": "
+ "%s: PCI alloc failed for msg "
+@@ -3474,11 +3471,10 @@ static int ipw2100_msg_allocate(struct ipw2100_priv *priv)
+ return 0;
+
+ for (j = 0; j < i; j++) {
+- pci_free_consistent(priv->pci_dev,
+- sizeof(struct ipw2100_cmd_header),
+- priv->msg_buffers[j].info.c_struct.cmd,
+- priv->msg_buffers[j].info.c_struct.
+- cmd_phys);
++ dma_free_coherent(&priv->pci_dev->dev,
++ sizeof(struct ipw2100_cmd_header),
++ priv->msg_buffers[j].info.c_struct.cmd,
++ priv->msg_buffers[j].info.c_struct.cmd_phys);
+ }
+
+ kfree(priv->msg_buffers);
+@@ -3509,11 +3505,10 @@ static void ipw2100_msg_free(struct ipw2100_priv *priv)
+ return;
+
+ for (i = 0; i < IPW_COMMAND_POOL_SIZE; i++) {
+- pci_free_consistent(priv->pci_dev,
+- sizeof(struct ipw2100_cmd_header),
+- priv->msg_buffers[i].info.c_struct.cmd,
+- priv->msg_buffers[i].info.c_struct.
+- cmd_phys);
++ dma_free_coherent(&priv->pci_dev->dev,
++ sizeof(struct ipw2100_cmd_header),
++ priv->msg_buffers[i].info.c_struct.cmd,
++ priv->msg_buffers[i].info.c_struct.cmd_phys);
+ }
+
+ kfree(priv->msg_buffers);
+@@ -4336,7 +4331,8 @@ static int status_queue_allocate(struct ipw2100_priv *priv, int entries)
+ IPW_DEBUG_INFO("enter\n");
+
+ q->size = entries * sizeof(struct ipw2100_status);
+- q->drv = pci_zalloc_consistent(priv->pci_dev, q->size, &q->nic);
++ q->drv = dma_alloc_coherent(&priv->pci_dev->dev, q->size, &q->nic,
++ GFP_KERNEL);
+ if (!q->drv) {
+ IPW_DEBUG_WARNING("Can not allocate status queue.\n");
+ return -ENOMEM;
+@@ -4352,9 +4348,10 @@ static void status_queue_free(struct ipw2100_priv *priv)
+ IPW_DEBUG_INFO("enter\n");
+
+ if (priv->status_queue.drv) {
+- pci_free_consistent(priv->pci_dev, priv->status_queue.size,
+- priv->status_queue.drv,
+- priv->status_queue.nic);
++ dma_free_coherent(&priv->pci_dev->dev,
++ priv->status_queue.size,
++ priv->status_queue.drv,
++ priv->status_queue.nic);
+ priv->status_queue.drv = NULL;
+ }
+
+@@ -4370,7 +4367,8 @@ static int bd_queue_allocate(struct ipw2100_priv *priv,
+
+ q->entries = entries;
+ q->size = entries * sizeof(struct ipw2100_bd);
+- q->drv = pci_zalloc_consistent(priv->pci_dev, q->size, &q->nic);
++ q->drv = dma_alloc_coherent(&priv->pci_dev->dev, q->size, &q->nic,
++ GFP_KERNEL);
+ if (!q->drv) {
+ IPW_DEBUG_INFO
+ ("can't allocate shared memory for buffer descriptors\n");
+@@ -4390,7 +4388,8 @@ static void bd_queue_free(struct ipw2100_priv *priv, struct ipw2100_bd_queue *q)
+ return;
+
+ if (q->drv) {
+- pci_free_consistent(priv->pci_dev, q->size, q->drv, q->nic);
++ dma_free_coherent(&priv->pci_dev->dev, q->size, q->drv,
++ q->nic);
+ q->drv = NULL;
+ }
+
+@@ -4450,9 +4449,9 @@ static int ipw2100_tx_allocate(struct ipw2100_priv *priv)
+ }
+
+ for (i = 0; i < TX_PENDED_QUEUE_LENGTH; i++) {
+- v = pci_alloc_consistent(priv->pci_dev,
+- sizeof(struct ipw2100_data_header),
+- &p);
++ v = dma_alloc_coherent(&priv->pci_dev->dev,
++ sizeof(struct ipw2100_data_header), &p,
++ GFP_KERNEL);
+ if (!v) {
+ printk(KERN_ERR DRV_NAME
+ ": %s: PCI alloc failed for tx " "buffers.\n",
+@@ -4472,11 +4471,10 @@ static int ipw2100_tx_allocate(struct ipw2100_priv *priv)
+ return 0;
+
+ for (j = 0; j < i; j++) {
+- pci_free_consistent(priv->pci_dev,
+- sizeof(struct ipw2100_data_header),
+- priv->tx_buffers[j].info.d_struct.data,
+- priv->tx_buffers[j].info.d_struct.
+- data_phys);
++ dma_free_coherent(&priv->pci_dev->dev,
++ sizeof(struct ipw2100_data_header),
++ priv->tx_buffers[j].info.d_struct.data,
++ priv->tx_buffers[j].info.d_struct.data_phys);
+ }
+
+ kfree(priv->tx_buffers);
+@@ -4553,12 +4551,10 @@ static void ipw2100_tx_free(struct ipw2100_priv *priv)
+ priv->tx_buffers[i].info.d_struct.txb = NULL;
+ }
+ if (priv->tx_buffers[i].info.d_struct.data)
+- pci_free_consistent(priv->pci_dev,
+- sizeof(struct ipw2100_data_header),
+- priv->tx_buffers[i].info.d_struct.
+- data,
+- priv->tx_buffers[i].info.d_struct.
+- data_phys);
++ dma_free_coherent(&priv->pci_dev->dev,
++ sizeof(struct ipw2100_data_header),
++ priv->tx_buffers[i].info.d_struct.data,
++ priv->tx_buffers[i].info.d_struct.data_phys);
+ }
+
+ kfree(priv->tx_buffers);
+@@ -4621,9 +4617,10 @@ static int ipw2100_rx_allocate(struct ipw2100_priv *priv)
+ return 0;
+
+ for (j = 0; j < i; j++) {
+- pci_unmap_single(priv->pci_dev, priv->rx_buffers[j].dma_addr,
++ dma_unmap_single(&priv->pci_dev->dev,
++ priv->rx_buffers[j].dma_addr,
+ sizeof(struct ipw2100_rx_packet),
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ dev_kfree_skb(priv->rx_buffers[j].skb);
+ }
+
+@@ -4675,10 +4672,10 @@ static void ipw2100_rx_free(struct ipw2100_priv *priv)
+
+ for (i = 0; i < RX_QUEUE_LENGTH; i++) {
+ if (priv->rx_buffers[i].rxp) {
+- pci_unmap_single(priv->pci_dev,
++ dma_unmap_single(&priv->pci_dev->dev,
+ priv->rx_buffers[i].dma_addr,
+ sizeof(struct ipw2100_rx),
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ dev_kfree_skb(priv->rx_buffers[i].skb);
+ }
+ }
+@@ -6214,7 +6211,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
+ pci_set_master(pci_dev);
+ pci_set_drvdata(pci_dev, priv);
+
+- err = pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32));
++ err = dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(32));
+ if (err) {
+ printk(KERN_WARNING DRV_NAME
+ "Error calling pci_set_dma_mask.\n");
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+index 04aee2fdba375..c6f2cc3083aef 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+@@ -3456,9 +3456,10 @@ static void ipw_rx_queue_reset(struct ipw_priv *priv,
+ /* In the reset function, these buffers may have been allocated
+ * to an SKB, so we need to unmap and free potential storage */
+ if (rxq->pool[i].skb != NULL) {
+- pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
+- IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
+- dev_kfree_skb(rxq->pool[i].skb);
++ dma_unmap_single(&priv->pci_dev->dev,
++ rxq->pool[i].dma_addr,
++ IPW_RX_BUF_SIZE, DMA_FROM_DEVICE);
++ dev_kfree_skb_irq(rxq->pool[i].skb);
+ rxq->pool[i].skb = NULL;
+ }
+ list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
+@@ -3790,7 +3791,8 @@ static int ipw_queue_tx_init(struct ipw_priv *priv,
+ }
+
+ q->bd =
+- pci_alloc_consistent(dev, sizeof(q->bd[0]) * count, &q->q.dma_addr);
++ dma_alloc_coherent(&dev->dev, sizeof(q->bd[0]) * count,
++ &q->q.dma_addr, GFP_KERNEL);
+ if (!q->bd) {
+ IPW_ERROR("pci_alloc_consistent(%zd) failed\n",
+ sizeof(q->bd[0]) * count);
+@@ -3832,9 +3834,10 @@ static void ipw_queue_tx_free_tfd(struct ipw_priv *priv,
+
+ /* unmap chunks if any */
+ for (i = 0; i < le32_to_cpu(bd->u.data.num_chunks); i++) {
+- pci_unmap_single(dev, le32_to_cpu(bd->u.data.chunk_ptr[i]),
++ dma_unmap_single(&dev->dev,
++ le32_to_cpu(bd->u.data.chunk_ptr[i]),
+ le16_to_cpu(bd->u.data.chunk_len[i]),
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ if (txq->txb[txq->q.last_used]) {
+ libipw_txb_free(txq->txb[txq->q.last_used]);
+ txq->txb[txq->q.last_used] = NULL;
+@@ -3866,8 +3869,8 @@ static void ipw_queue_tx_free(struct ipw_priv *priv, struct clx2_tx_queue *txq)
+ }
+
+ /* free buffers belonging to queue itself */
+- pci_free_consistent(dev, sizeof(txq->bd[0]) * q->n_bd, txq->bd,
+- q->dma_addr);
++ dma_free_coherent(&dev->dev, sizeof(txq->bd[0]) * q->n_bd, txq->bd,
++ q->dma_addr);
+ kfree(txq->txb);
+
+ /* 0 fill whole structure */
+@@ -5212,8 +5215,8 @@ static void ipw_rx_queue_replenish(void *data)
+ list_del(element);
+
+ rxb->dma_addr =
+- pci_map_single(priv->pci_dev, rxb->skb->data,
+- IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
++ dma_map_single(&priv->pci_dev->dev, rxb->skb->data,
++ IPW_RX_BUF_SIZE, DMA_FROM_DEVICE);
+
+ list_add_tail(&rxb->list, &rxq->rx_free);
+ rxq->free_count++;
+@@ -5246,8 +5249,9 @@ static void ipw_rx_queue_free(struct ipw_priv *priv, struct ipw_rx_queue *rxq)
+
+ for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
+ if (rxq->pool[i].skb != NULL) {
+- pci_unmap_single(priv->pci_dev, rxq->pool[i].dma_addr,
+- IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
++ dma_unmap_single(&priv->pci_dev->dev,
++ rxq->pool[i].dma_addr,
++ IPW_RX_BUF_SIZE, DMA_FROM_DEVICE);
+ dev_kfree_skb(rxq->pool[i].skb);
+ }
+ }
+@@ -8285,9 +8289,8 @@ static void ipw_rx(struct ipw_priv *priv)
+ }
+ priv->rxq->queue[i] = NULL;
+
+- pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->dma_addr,
+- IPW_RX_BUF_SIZE,
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_cpu(&priv->pci_dev->dev, rxb->dma_addr,
++ IPW_RX_BUF_SIZE, DMA_FROM_DEVICE);
+
+ pkt = (struct ipw_rx_packet *)rxb->skb->data;
+ IPW_DEBUG_RX("Packet: type=%02X seq=%02X bits=%02X\n",
+@@ -8439,8 +8442,8 @@ static void ipw_rx(struct ipw_priv *priv)
+ rxb->skb = NULL;
+ }
+
+- pci_unmap_single(priv->pci_dev, rxb->dma_addr,
+- IPW_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
++ dma_unmap_single(&priv->pci_dev->dev, rxb->dma_addr,
++ IPW_RX_BUF_SIZE, DMA_FROM_DEVICE);
+ list_add_tail(&rxb->list, &priv->rxq->rx_used);
+
+ i = (i + 1) % RX_QUEUE_SIZE;
+@@ -10239,11 +10242,10 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct libipw_txb *txb,
+ txb->fragments[i]->len - hdr_len);
+
+ tfd->u.data.chunk_ptr[i] =
+- cpu_to_le32(pci_map_single
+- (priv->pci_dev,
+- txb->fragments[i]->data + hdr_len,
+- txb->fragments[i]->len - hdr_len,
+- PCI_DMA_TODEVICE));
++ cpu_to_le32(dma_map_single(&priv->pci_dev->dev,
++ txb->fragments[i]->data + hdr_len,
++ txb->fragments[i]->len - hdr_len,
++ DMA_TO_DEVICE));
+ tfd->u.data.chunk_len[i] =
+ cpu_to_le16(txb->fragments[i]->len - hdr_len);
+ }
+@@ -10273,10 +10275,10 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct libipw_txb *txb,
+ dev_kfree_skb_any(txb->fragments[i]);
+ txb->fragments[i] = skb;
+ tfd->u.data.chunk_ptr[i] =
+- cpu_to_le32(pci_map_single
+- (priv->pci_dev, skb->data,
+- remaining_bytes,
+- PCI_DMA_TODEVICE));
++ cpu_to_le32(dma_map_single(&priv->pci_dev->dev,
++ skb->data,
++ remaining_bytes,
++ DMA_TO_DEVICE));
+
+ le32_add_cpu(&tfd->u.data.num_chunks, 1);
+ }
+@@ -11429,9 +11431,14 @@ static int ipw_wdev_init(struct net_device *dev)
+ set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
+
+ /* With that information in place, we can now register the wiphy... */
+- if (wiphy_register(wdev->wiphy))
+- rc = -EIO;
++ rc = wiphy_register(wdev->wiphy);
++ if (rc)
++ goto out;
++
++ return 0;
+ out:
++ kfree(priv->ieee->a_band.channels);
++ kfree(priv->ieee->bg_band.channels);
+ return rc;
+ }
+
+@@ -11649,9 +11656,9 @@ static int ipw_pci_probe(struct pci_dev *pdev,
+
+ pci_set_master(pdev);
+
+- err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
++ err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+ if (!err)
+- err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
++ err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+ if (err) {
+ printk(KERN_WARNING DRV_NAME ": No suitable DMA available.\n");
+ goto out_pci_disable_device;
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index b536ec20eaccb..d51a23815e186 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3400,10 +3400,12 @@ static DEVICE_ATTR(dump_errors, 0200, NULL, il3945_dump_error_log);
+ *
+ *****************************************************************************/
+
+-static void
++static int
+ il3945_setup_deferred_work(struct il_priv *il)
+ {
+ il->workqueue = create_singlethread_workqueue(DRV_NAME);
++ if (!il->workqueue)
++ return -ENOMEM;
+
+ init_waitqueue_head(&il->wait_command_queue);
+
+@@ -3422,6 +3424,8 @@ il3945_setup_deferred_work(struct il_priv *il)
+ tasklet_init(&il->irq_tasklet,
+ il3945_irq_tasklet,
+ (unsigned long)il);
++
++ return 0;
+ }
+
+ static void
+@@ -3743,7 +3747,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ }
+
+ il_set_rxon_channel(il, &il->bands[NL80211_BAND_2GHZ].channels[5]);
+- il3945_setup_deferred_work(il);
++ err = il3945_setup_deferred_work(il);
++ if (err)
++ goto out_remove_sysfs;
++
+ il3945_setup_handlers(il);
+ il_power_initialize(il);
+
+@@ -3755,7 +3762,7 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ err = il3945_setup_mac(il);
+ if (err)
+- goto out_remove_sysfs;
++ goto out_destroy_workqueue;
+
+ err = il_dbgfs_register(il, DRV_NAME);
+ if (err)
+@@ -3767,9 +3774,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ return 0;
+
+-out_remove_sysfs:
++out_destroy_workqueue:
+ destroy_workqueue(il->workqueue);
+ il->workqueue = NULL;
++out_remove_sysfs:
+ sysfs_remove_group(&pdev->dev.kobj, &il3945_attribute_group);
+ out_release_irq:
+ free_irq(il->pci_dev->irq, il);
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index 6fc51c74cdb86..4970c19df582e 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -6236,10 +6236,12 @@ out:
+ mutex_unlock(&il->mutex);
+ }
+
+-static void
++static int
+ il4965_setup_deferred_work(struct il_priv *il)
+ {
+ il->workqueue = create_singlethread_workqueue(DRV_NAME);
++ if (!il->workqueue)
++ return -ENOMEM;
+
+ init_waitqueue_head(&il->wait_command_queue);
+
+@@ -6260,6 +6262,8 @@ il4965_setup_deferred_work(struct il_priv *il)
+ tasklet_init(&il->irq_tasklet,
+ il4965_irq_tasklet,
+ (unsigned long)il);
++
++ return 0;
+ }
+
+ static void
+@@ -6649,7 +6653,10 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ goto out_disable_msi;
+ }
+
+- il4965_setup_deferred_work(il);
++ err = il4965_setup_deferred_work(il);
++ if (err)
++ goto out_free_irq;
++
+ il4965_setup_handlers(il);
+
+ /*********************************************
+@@ -6687,6 +6694,7 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ out_destroy_workqueue:
+ destroy_workqueue(il->workqueue);
+ il->workqueue = NULL;
++out_free_irq:
+ free_irq(il->pci_dev->irq, il);
+ out_disable_msi:
+ pci_disable_msi(il->pci_dev);
+diff --git a/drivers/net/wireless/intersil/orinoco/hw.c b/drivers/net/wireless/intersil/orinoco/hw.c
+index 61af5a28f269f..af49aa421e47f 100644
+--- a/drivers/net/wireless/intersil/orinoco/hw.c
++++ b/drivers/net/wireless/intersil/orinoco/hw.c
+@@ -931,6 +931,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv)
+ err = hermes_write_wordrec(hw, USER_BAP,
+ HERMES_RID_CNFAUTHENTICATION_AGERE,
+ auth_flag);
++ if (err)
++ return err;
+ }
+ err = hermes_write_wordrec(hw, USER_BAP,
+ HERMES_RID_CNFWEPENABLED_AGERE,
+diff --git a/drivers/net/wireless/marvell/libertas/cmdresp.c b/drivers/net/wireless/marvell/libertas/cmdresp.c
+index b73d083813985..5908f07d62ed7 100644
+--- a/drivers/net/wireless/marvell/libertas/cmdresp.c
++++ b/drivers/net/wireless/marvell/libertas/cmdresp.c
+@@ -48,7 +48,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv,
+
+ /* Free Tx and Rx packets */
+ spin_lock_irqsave(&priv->driver_lock, flags);
+- kfree_skb(priv->currenttxskb);
++ dev_kfree_skb_irq(priv->currenttxskb);
+ priv->currenttxskb = NULL;
+ priv->tx_pending_len = 0;
+ spin_unlock_irqrestore(&priv->driver_lock, flags);
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index d75763410cdc1..885abbd665e6e 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -633,7 +633,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
+ priv->resp_len[i] = (recvlength - MESSAGE_HEADER_LEN);
+ memcpy(priv->resp_buf[i], recvbuff + MESSAGE_HEADER_LEN,
+ priv->resp_len[i]);
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ lbs_notify_command_response(priv, i);
+
+ spin_unlock_irqrestore(&priv->driver_lock, flags);
+diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c
+index f22e1c220cba1..997c246b971e7 100644
+--- a/drivers/net/wireless/marvell/libertas/main.c
++++ b/drivers/net/wireless/marvell/libertas/main.c
+@@ -216,7 +216,7 @@ int lbs_stop_iface(struct lbs_private *priv)
+
+ spin_lock_irqsave(&priv->driver_lock, flags);
+ priv->iface_running = false;
+- kfree_skb(priv->currenttxskb);
++ dev_kfree_skb_irq(priv->currenttxskb);
+ priv->currenttxskb = NULL;
+ priv->tx_pending_len = 0;
+ spin_unlock_irqrestore(&priv->driver_lock, flags);
+@@ -869,6 +869,7 @@ static int lbs_init_adapter(struct lbs_private *priv)
+ ret = kfifo_alloc(&priv->event_fifo, sizeof(u32) * 16, GFP_KERNEL);
+ if (ret) {
+ pr_err("Out of memory allocating event FIFO buffer\n");
++ lbs_free_cmd_buffer(priv);
+ goto out;
+ }
+
+diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+index 60941c319b421..5e7edc0309751 100644
+--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+@@ -616,7 +616,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
+ spin_lock_irqsave(&priv->driver_lock, flags);
+ memcpy(priv->cmd_resp_buff, recvbuff + MESSAGE_HEADER_LEN,
+ recvlength - MESSAGE_HEADER_LEN);
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ lbtf_cmd_response_rx(priv);
+ spin_unlock_irqrestore(&priv->driver_lock, flags);
+ }
+diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c
+index 5dcc305cc8127..452ac56cdc923 100644
+--- a/drivers/net/wireless/marvell/mwifiex/11n.c
++++ b/drivers/net/wireless/marvell/mwifiex/11n.c
+@@ -901,7 +901,7 @@ mwifiex_send_delba_txbastream_tbl(struct mwifiex_private *priv, u8 tid)
+ */
+ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter)
+ {
+- u8 i;
++ u8 i, j;
+ u32 tx_win_size;
+ struct mwifiex_private *priv;
+
+@@ -932,8 +932,8 @@ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter)
+ if (tx_win_size != priv->add_ba_param.tx_win_size) {
+ if (!priv->media_connected)
+ continue;
+- for (i = 0; i < MAX_NUM_TID; i++)
+- mwifiex_send_delba_txbastream_tbl(priv, i);
++ for (j = 0; j < MAX_NUM_TID; j++)
++ mwifiex_send_delba_txbastream_tbl(priv, j);
+ }
+ }
+ }
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
+index 837a1b9d189df..eb8f046ae20d8 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
+@@ -1679,6 +1679,11 @@ static void rtl8192e_enable_rf(struct rtl8xxxu_priv *priv)
+ val8 = rtl8xxxu_read8(priv, REG_PAD_CTRL1);
+ val8 &= ~BIT(0);
+ rtl8xxxu_write8(priv, REG_PAD_CTRL1, val8);
++
++ /*
++ * Fix transmission failure of rtl8192e.
++ */
++ rtl8xxxu_write8(priv, REG_TXPAUSE, 0x00);
+ }
+
+ struct rtl8xxxu_fileops rtl8192eu_fops = {
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index e5aac9694ade2..9c811fe303584 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -5101,7 +5101,7 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv,
+ pending = priv->rx_urb_pending_count;
+ } else {
+ skb = (struct sk_buff *)rx_urb->urb.context;
+- dev_kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+ usb_free_urb(&rx_urb->urb);
+ }
+
+@@ -5500,7 +5500,6 @@ static int rtl8xxxu_config(struct ieee80211_hw *hw, u32 changed)
+ {
+ struct rtl8xxxu_priv *priv = hw->priv;
+ struct device *dev = &priv->udev->dev;
+- u16 val16;
+ int ret = 0, channel;
+ bool ht40;
+
+@@ -5510,14 +5509,6 @@ static int rtl8xxxu_config(struct ieee80211_hw *hw, u32 changed)
+ __func__, hw->conf.chandef.chan->hw_value,
+ changed, hw->conf.chandef.width);
+
+- if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
+- val16 = ((hw->conf.long_frame_max_tx_count <<
+- RETRY_LIMIT_LONG_SHIFT) & RETRY_LIMIT_LONG_MASK) |
+- ((hw->conf.short_frame_max_tx_count <<
+- RETRY_LIMIT_SHORT_SHIFT) & RETRY_LIMIT_SHORT_MASK);
+- rtl8xxxu_write16(priv, REG_RETRY_LIMIT, val16);
+- }
+-
+ if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+ switch (hw->conf.chandef.width) {
+ case NL80211_CHAN_WIDTH_20_NOHT:
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+index 176deb2b53868..502ac10cf251b 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+@@ -1608,7 +1608,7 @@ static void _rtl8821ae_phy_txpower_by_rate_configuration(struct ieee80211_hw *hw
+ }
+
+ /* string is in decimal */
+-static bool _rtl8812ae_get_integer_from_string(char *str, u8 *pint)
++static bool _rtl8812ae_get_integer_from_string(const char *str, u8 *pint)
+ {
+ u16 i = 0;
+ *pint = 0;
+@@ -1626,18 +1626,6 @@ static bool _rtl8812ae_get_integer_from_string(char *str, u8 *pint)
+ return true;
+ }
+
+-static bool _rtl8812ae_eq_n_byte(u8 *str1, u8 *str2, u32 num)
+-{
+- if (num == 0)
+- return false;
+- while (num > 0) {
+- num--;
+- if (str1[num] != str2[num])
+- return false;
+- }
+- return true;
+-}
+-
+ static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw,
+ u8 band, u8 channel)
+ {
+@@ -1664,10 +1652,11 @@ static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw,
+ return channel_index;
+ }
+
+-static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregulation,
+- u8 *pband, u8 *pbandwidth,
+- u8 *prate_section, u8 *prf_path,
+- u8 *pchannel, u8 *ppower_limit)
++static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw,
++ const char *pregulation,
++ const char *pband, const char *pbandwidth,
++ const char *prate_section, const char *prf_path,
++ const char *pchannel, const char *ppower_limit)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_phy *rtlphy = &rtlpriv->phy;
+@@ -1675,8 +1664,8 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul
+ u8 channel_index;
+ s8 power_limit = 0, prev_power_limit, ret;
+
+- if (!_rtl8812ae_get_integer_from_string((char *)pchannel, &channel) ||
+- !_rtl8812ae_get_integer_from_string((char *)ppower_limit,
++ if (!_rtl8812ae_get_integer_from_string(pchannel, &channel) ||
++ !_rtl8812ae_get_integer_from_string(ppower_limit,
+ &power_limit)) {
+ RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+ "Illegal index of pwr_lmt table [chnl %d][val %d]\n",
+@@ -1686,42 +1675,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul
+ power_limit = power_limit > MAX_POWER_INDEX ?
+ MAX_POWER_INDEX : power_limit;
+
+- if (_rtl8812ae_eq_n_byte(pregulation, (u8 *)("FCC"), 3))
++ if (strcmp(pregulation, "FCC") == 0)
+ regulation = 0;
+- else if (_rtl8812ae_eq_n_byte(pregulation, (u8 *)("MKK"), 3))
++ else if (strcmp(pregulation, "MKK") == 0)
+ regulation = 1;
+- else if (_rtl8812ae_eq_n_byte(pregulation, (u8 *)("ETSI"), 4))
++ else if (strcmp(pregulation, "ETSI") == 0)
+ regulation = 2;
+- else if (_rtl8812ae_eq_n_byte(pregulation, (u8 *)("WW13"), 4))
++ else if (strcmp(pregulation, "WW13") == 0)
+ regulation = 3;
+
+- if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("CCK"), 3))
++ if (strcmp(prate_section, "CCK") == 0)
+ rate_section = 0;
+- else if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("OFDM"), 4))
++ else if (strcmp(prate_section, "OFDM") == 0)
+ rate_section = 1;
+- else if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("HT"), 2) &&
+- _rtl8812ae_eq_n_byte(prf_path, (u8 *)("1T"), 2))
++ else if (strcmp(prate_section, "HT") == 0 &&
++ strcmp(prf_path, "1T") == 0)
+ rate_section = 2;
+- else if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("HT"), 2) &&
+- _rtl8812ae_eq_n_byte(prf_path, (u8 *)("2T"), 2))
++ else if (strcmp(prate_section, "HT") == 0 &&
++ strcmp(prf_path, "2T") == 0)
+ rate_section = 3;
+- else if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("VHT"), 3) &&
+- _rtl8812ae_eq_n_byte(prf_path, (u8 *)("1T"), 2))
++ else if (strcmp(prate_section, "VHT") == 0 &&
++ strcmp(prf_path, "1T") == 0)
+ rate_section = 4;
+- else if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("VHT"), 3) &&
+- _rtl8812ae_eq_n_byte(prf_path, (u8 *)("2T"), 2))
++ else if (strcmp(prate_section, "VHT") == 0 &&
++ strcmp(prf_path, "2T") == 0)
+ rate_section = 5;
+
+- if (_rtl8812ae_eq_n_byte(pbandwidth, (u8 *)("20M"), 3))
++ if (strcmp(pbandwidth, "20M") == 0)
+ bandwidth = 0;
+- else if (_rtl8812ae_eq_n_byte(pbandwidth, (u8 *)("40M"), 3))
++ else if (strcmp(pbandwidth, "40M") == 0)
+ bandwidth = 1;
+- else if (_rtl8812ae_eq_n_byte(pbandwidth, (u8 *)("80M"), 3))
++ else if (strcmp(pbandwidth, "80M") == 0)
+ bandwidth = 2;
+- else if (_rtl8812ae_eq_n_byte(pbandwidth, (u8 *)("160M"), 4))
++ else if (strcmp(pbandwidth, "160M") == 0)
+ bandwidth = 3;
+
+- if (_rtl8812ae_eq_n_byte(pband, (u8 *)("2.4G"), 4)) {
++ if (strcmp(pband, "2.4G") == 0) {
+ ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw,
+ BAND_ON_2_4G,
+ channel);
+@@ -1745,7 +1734,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul
+ regulation, bandwidth, rate_section, channel_index,
+ rtlphy->txpwr_limit_2_4g[regulation][bandwidth]
+ [rate_section][channel_index][RF90_PATH_A]);
+- } else if (_rtl8812ae_eq_n_byte(pband, (u8 *)("5G"), 2)) {
++ } else if (strcmp(pband, "5G") == 0) {
+ ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw,
+ BAND_ON_5G,
+ channel);
+@@ -1776,10 +1765,10 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul
+ }
+
+ static void _rtl8812ae_phy_config_bb_txpwr_lmt(struct ieee80211_hw *hw,
+- u8 *regulation, u8 *band,
+- u8 *bandwidth, u8 *rate_section,
+- u8 *rf_path, u8 *channel,
+- u8 *power_limit)
++ const char *regulation, const char *band,
++ const char *bandwidth, const char *rate_section,
++ const char *rf_path, const char *channel,
++ const char *power_limit)
+ {
+ _rtl8812ae_phy_set_txpower_limit(hw, regulation, band, bandwidth,
+ rate_section, rf_path, channel,
+@@ -1792,7 +1781,7 @@ static void _rtl8821ae_phy_read_and_config_txpwr_lmt(struct ieee80211_hw *hw)
+ struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
+ u32 i = 0;
+ u32 array_len;
+- u8 **array;
++ const char **array;
+
+ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE) {
+ array_len = RTL8812AE_TXPWR_LMT_ARRAY_LEN;
+@@ -1806,13 +1795,13 @@ static void _rtl8821ae_phy_read_and_config_txpwr_lmt(struct ieee80211_hw *hw)
+ "\n");
+
+ for (i = 0; i < array_len; i += 7) {
+- u8 *regulation = array[i];
+- u8 *band = array[i+1];
+- u8 *bandwidth = array[i+2];
+- u8 *rate = array[i+3];
+- u8 *rf_path = array[i+4];
+- u8 *chnl = array[i+5];
+- u8 *val = array[i+6];
++ const char *regulation = array[i];
++ const char *band = array[i+1];
++ const char *bandwidth = array[i+2];
++ const char *rate = array[i+3];
++ const char *rf_path = array[i+4];
++ const char *chnl = array[i+5];
++ const char *val = array[i+6];
+
+ _rtl8812ae_phy_config_bb_txpwr_lmt(hw, regulation, band,
+ bandwidth, rate, rf_path,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
+index ac44fd5d05977..e1e7fa990132a 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c
+@@ -2917,7 +2917,7 @@ u32 RTL8821AE_AGC_TAB_1TARRAYLEN = ARRAY_SIZE(RTL8821AE_AGC_TAB_ARRAY);
+ * TXPWR_LMT.TXT
+ ******************************************************************************/
+
+-u8 *RTL8812AE_TXPWR_LMT[] = {
++const char *RTL8812AE_TXPWR_LMT[] = {
+ "FCC", "2.4G", "20M", "CCK", "1T", "01", "36",
+ "ETSI", "2.4G", "20M", "CCK", "1T", "01", "32",
+ "MKK", "2.4G", "20M", "CCK", "1T", "01", "32",
+@@ -3486,7 +3486,7 @@ u8 *RTL8812AE_TXPWR_LMT[] = {
+
+ u32 RTL8812AE_TXPWR_LMT_ARRAY_LEN = ARRAY_SIZE(RTL8812AE_TXPWR_LMT);
+
+-u8 *RTL8821AE_TXPWR_LMT[] = {
++const char *RTL8821AE_TXPWR_LMT[] = {
+ "FCC", "2.4G", "20M", "CCK", "1T", "01", "32",
+ "ETSI", "2.4G", "20M", "CCK", "1T", "01", "32",
+ "MKK", "2.4G", "20M", "CCK", "1T", "01", "32",
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.h b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.h
+index 36c2388b60bca..f8550a0122e80 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.h
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.h
+@@ -52,7 +52,7 @@ extern u32 RTL8821AE_AGC_TAB_ARRAY[];
+ extern u32 RTL8812AE_AGC_TAB_1TARRAYLEN;
+ extern u32 RTL8812AE_AGC_TAB_ARRAY[];
+ extern u32 RTL8812AE_TXPWR_LMT_ARRAY_LEN;
+-extern u8 *RTL8812AE_TXPWR_LMT[];
++extern const char *RTL8812AE_TXPWR_LMT[];
+ extern u32 RTL8821AE_TXPWR_LMT_ARRAY_LEN;
+-extern u8 *RTL8821AE_TXPWR_LMT[];
++extern const char *RTL8821AE_TXPWR_LMT[];
+ #endif
+diff --git a/drivers/net/wireless/rsi/rsi_91x_coex.c b/drivers/net/wireless/rsi/rsi_91x_coex.c
+index c8ba148f8c6cf..acf4d8cb4b479 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_coex.c
++++ b/drivers/net/wireless/rsi/rsi_91x_coex.c
+@@ -160,6 +160,7 @@ int rsi_coex_attach(struct rsi_common *common)
+ rsi_coex_scheduler_thread,
+ "Coex-Tx-Thread")) {
+ rsi_dbg(ERR_ZONE, "%s: Unable to init tx thrd\n", __func__);
++ kfree(coex_cb);
+ return -EINVAL;
+ }
+ return 0;
+diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
+index f33ece9370473..cfde9b94b4b60 100644
+--- a/drivers/net/wireless/wl3501_cs.c
++++ b/drivers/net/wireless/wl3501_cs.c
+@@ -1329,7 +1329,7 @@ static netdev_tx_t wl3501_hard_start_xmit(struct sk_buff *skb,
+ } else {
+ ++dev->stats.tx_packets;
+ dev->stats.tx_bytes += skb->len;
+- kfree_skb(skb);
++ dev_kfree_skb_irq(skb);
+
+ if (this->tx_buffer_cnt < 2)
+ netif_stop_queue(dev);
+diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c
+index cdf9e915c974b..f702aa9c7cf5b 100644
+--- a/drivers/nfc/st-nci/se.c
++++ b/drivers/nfc/st-nci/se.c
+@@ -676,6 +676,12 @@ int st_nci_se_io(struct nci_dev *ndev, u32 se_idx,
+ ST_NCI_EVT_TRANSMIT_DATA, apdu,
+ apdu_length);
+ default:
++ /* Need to free cb_context here as at the moment we can't
++ * clearly indicate to the caller if the callback function
++ * would be called (and free it) or not. In both cases a
++ * negative value may be returned to the caller.
++ */
++ kfree(cb_context);
+ return -ENODEV;
+ }
+ }
+diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c
+index 52e209950c436..8a96354796c76 100644
+--- a/drivers/nfc/st21nfca/se.c
++++ b/drivers/nfc/st21nfca/se.c
+@@ -247,6 +247,12 @@ int st21nfca_hci_se_io(struct nfc_hci_dev *hdev, u32 se_idx,
+ ST21NFCA_EVT_TRANSMIT_DATA,
+ apdu, apdu_length);
+ default:
++ /* Need to free cb_context here as at the moment we can't
++ * clearly indicate to the caller if the callback function
++ * would be called (and free it) or not. In both cases a
++ * negative value may be returned to the caller.
++ */
++ kfree(cb_context);
+ return -ENODEV;
+ }
+ }
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index f494e76faaa01..afa6acb58eec8 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5153,6 +5153,7 @@ static void quirk_no_flr(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1487, quirk_no_flr);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x148c, quirk_no_flr);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x149c, quirk_no_flr);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x7901, quirk_no_flr);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_no_flr);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_no_flr);
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c b/drivers/phy/rockchip/phy-rockchip-typec.c
+index 76a4b58ec7717..ca4b80d0d8b78 100644
+--- a/drivers/phy/rockchip/phy-rockchip-typec.c
++++ b/drivers/phy/rockchip/phy-rockchip-typec.c
+@@ -817,9 +817,8 @@ static int tcphy_get_mode(struct rockchip_typec_phy *tcphy)
+ struct extcon_dev *edev = tcphy->extcon;
+ union extcon_property_value property;
+ unsigned int id;
+- bool ufp, dp;
+ u8 mode;
+- int ret;
++ int ret, ufp, dp;
+
+ if (!edev)
+ return MODE_DFP_USB;
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index 9e2f3738bf3ec..89d88e447d44f 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -1022,8 +1022,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
+
+ pin_desc[i].number = i;
+ /* Pin naming convention: P(bank_name)(bank_pin_number). */
+- pin_desc[i].name = kasprintf(GFP_KERNEL, "P%c%d",
+- bank + 'A', line);
++ pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d",
++ bank + 'A', line);
+
+ group->name = group_names[i] = pin_desc[i].name;
+ group->pin = pin_desc[i].number;
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index fad0e132ead84..ad01cc5798232 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -1782,7 +1782,7 @@ static int at91_gpio_probe(struct platform_device *pdev)
+ }
+
+ for (i = 0; i < chip->ngpio; i++)
+- names[i] = kasprintf(GFP_KERNEL, "pio%c%d", alias_idx + 'A', i);
++ names[i] = devm_kasprintf(&pdev->dev, GFP_KERNEL, "pio%c%d", alias_idx + 'A', i);
+
+ chip->names = (const char *const *)names;
+
+diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
+index dc405d7aa1b78..fb7f2282635e8 100644
+--- a/drivers/pinctrl/pinctrl-rockchip.c
++++ b/drivers/pinctrl/pinctrl-rockchip.c
+@@ -70,7 +70,7 @@ enum rockchip_pinctrl_type {
+ RK3399,
+ };
+
+-/**
++/*
+ * Encode variants of iomux registers into a type variable
+ */
+ #define IOMUX_GPIO_ONLY BIT(0)
+@@ -80,6 +80,7 @@ enum rockchip_pinctrl_type {
+ #define IOMUX_WIDTH_3BIT BIT(4)
+
+ /**
++ * struct rockchip_iomux
+ * @type: iomux variant using IOMUX_* constants
+ * @offset: if initialized to -1 it will be autocalculated, by specifying
+ * an initial offset value the relevant source offset can be reset
+@@ -90,7 +91,7 @@ struct rockchip_iomux {
+ int offset;
+ };
+
+-/**
++/*
+ * enum type index corresponding to rockchip_perpin_drv_list arrays index.
+ */
+ enum rockchip_pin_drv_type {
+@@ -102,7 +103,7 @@ enum rockchip_pin_drv_type {
+ DRV_TYPE_MAX
+ };
+
+-/**
++/*
+ * enum type index corresponding to rockchip_pull_list arrays index.
+ */
+ enum rockchip_pin_pull_type {
+@@ -112,6 +113,7 @@ enum rockchip_pin_pull_type {
+ };
+
+ /**
++ * struct rockchip_drv
+ * @drv_type: drive strength variant using rockchip_perpin_drv_type
+ * @offset: if initialized to -1 it will be autocalculated, by specifying
+ * an initial offset value the relevant source offset can be reset
+@@ -125,8 +127,9 @@ struct rockchip_drv {
+ };
+
+ /**
++ * struct rockchip_pin_bank
+ * @reg_base: register base of the gpio bank
+- * @reg_pull: optional separate register for additional pull settings
++ * @regmap_pull: optional separate register for additional pull settings
+ * @clk: clock of the gpio bank
+ * @irq: interrupt of the gpio bank
+ * @saved_masks: Saved content of GPIO_INTEN at suspend time.
+@@ -144,6 +147,8 @@ struct rockchip_drv {
+ * @gpio_chip: gpiolib chip
+ * @grange: gpio range
+ * @slock: spinlock for the gpio bank
++ * @toggle_edge_mode: bit mask to toggle (falling/rising) edge mode
++ * @recalced_mask: bit mask to indicate a need to recalulate the mask
+ * @route_mask: bits describing the routing pins of per bank
+ */
+ struct rockchip_pin_bank {
+@@ -312,6 +317,7 @@ struct rockchip_mux_recalced_data {
+ * @bank_num: bank number.
+ * @pin: index at register or used to calc index.
+ * @func: the min pin.
++ * @route_location: the mux route location (same, pmu, grf).
+ * @route_offset: the max pin.
+ * @route_val: the register offset.
+ */
+@@ -323,8 +329,6 @@ struct rockchip_mux_route_data {
+ u32 route_val;
+ };
+
+-/**
+- */
+ struct rockchip_pin_ctrl {
+ struct rockchip_pin_bank *pin_banks;
+ u32 nr_banks;
+@@ -362,9 +366,7 @@ struct rockchip_pin_config {
+ * @name: name of the pin group, used to lookup the group.
+ * @pins: the pins included in this group.
+ * @npins: number of pins included in this group.
+- * @func: the mux function number to be programmed when selected.
+- * @configs: the config values to be set for each pin
+- * @nconfigs: number of configs for each pin
++ * @data: local pin configuration
+ */
+ struct rockchip_pin_group {
+ const char *name;
+@@ -377,7 +379,7 @@ struct rockchip_pin_group {
+ * struct rockchip_pmx_func: represent a pin function.
+ * @name: name of the pin function, used to lookup the function.
+ * @groups: one or more names of pin groups that provide this function.
+- * @num_groups: number of groups included in @groups.
++ * @ngroups: number of groups included in @groups.
+ */
+ struct rockchip_pmx_func {
+ const char *name;
+@@ -2502,6 +2504,7 @@ static int rockchip_pinctrl_parse_groups(struct device_node *np,
+ np_config = of_find_node_by_phandle(be32_to_cpup(phandle));
+ ret = pinconf_generic_parse_dt_config(np_config, NULL,
+ &grp->data[j].configs, &grp->data[j].nconfigs);
++ of_node_put(np_config);
+ if (ret)
+ return ret;
+ }
+diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
+index 60c8375c3c816..0a63fac54fd93 100644
+--- a/drivers/powercap/powercap_sys.c
++++ b/drivers/powercap/powercap_sys.c
+@@ -542,9 +542,6 @@ struct powercap_zone *powercap_register_zone(
+ power_zone->name = kstrdup(name, GFP_KERNEL);
+ if (!power_zone->name)
+ goto err_name_alloc;
+- dev_set_name(&power_zone->dev, "%s:%x",
+- dev_name(power_zone->dev.parent),
+- power_zone->id);
+ power_zone->constraints = kcalloc(nr_constraints,
+ sizeof(*power_zone->constraints),
+ GFP_KERNEL);
+@@ -567,9 +564,16 @@ struct powercap_zone *powercap_register_zone(
+ power_zone->dev_attr_groups[0] = &power_zone->dev_zone_attr_group;
+ power_zone->dev_attr_groups[1] = NULL;
+ power_zone->dev.groups = power_zone->dev_attr_groups;
++ dev_set_name(&power_zone->dev, "%s:%x",
++ dev_name(power_zone->dev.parent),
++ power_zone->id);
+ result = device_register(&power_zone->dev);
+- if (result)
+- goto err_dev_ret;
++ if (result) {
++ put_device(&power_zone->dev);
++ mutex_unlock(&control_type->lock);
++
++ return ERR_PTR(result);
++ }
+
+ control_type->nr_zones++;
+ mutex_unlock(&control_type->lock);
+diff --git a/drivers/pwm/pwm-stm32-lp.c b/drivers/pwm/pwm-stm32-lp.c
+index e92a140074221..7c8c2bb8f6a28 100644
+--- a/drivers/pwm/pwm-stm32-lp.c
++++ b/drivers/pwm/pwm-stm32-lp.c
+@@ -126,7 +126,7 @@ static int stm32_pwm_lp_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+
+ /* ensure CMP & ARR registers are properly written */
+ ret = regmap_read_poll_timeout(priv->regmap, STM32_LPTIM_ISR, val,
+- (val & STM32_LPTIM_CMPOK_ARROK),
++ (val & STM32_LPTIM_CMPOK_ARROK) == STM32_LPTIM_CMPOK_ARROK,
+ 100, 1000);
+ if (ret) {
+ dev_err(priv->chip.dev, "ARR/CMP registers write issue\n");
+diff --git a/drivers/regulator/max77802-regulator.c b/drivers/regulator/max77802-regulator.c
+index c30cf5c9f2de3..ef314de7c2c01 100644
+--- a/drivers/regulator/max77802-regulator.c
++++ b/drivers/regulator/max77802-regulator.c
+@@ -97,9 +97,11 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev)
+ {
+ unsigned int val = MAX77802_OFF_PWRREQ;
+ struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
+- int id = rdev_get_id(rdev);
++ unsigned int id = rdev_get_id(rdev);
+ int shift = max77802_get_opmode_shift(id);
+
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
++ return -EINVAL;
+ max77802->opmode[id] = val;
+ return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
+ rdev->desc->enable_mask, val << shift);
+@@ -113,7 +115,7 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev)
+ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
+ {
+ struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
+- int id = rdev_get_id(rdev);
++ unsigned int id = rdev_get_id(rdev);
+ unsigned int val;
+ int shift = max77802_get_opmode_shift(id);
+
+@@ -130,6 +132,9 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
+ return -EINVAL;
+ }
+
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
++ return -EINVAL;
++
+ max77802->opmode[id] = val;
+ return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
+ rdev->desc->enable_mask, val << shift);
+@@ -138,8 +143,10 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode)
+ static unsigned max77802_get_mode(struct regulator_dev *rdev)
+ {
+ struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
+- int id = rdev_get_id(rdev);
++ unsigned int id = rdev_get_id(rdev);
+
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
++ return -EINVAL;
+ return max77802_map_mode(max77802->opmode[id]);
+ }
+
+@@ -163,10 +170,13 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev,
+ unsigned int mode)
+ {
+ struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
+- int id = rdev_get_id(rdev);
++ unsigned int id = rdev_get_id(rdev);
+ unsigned int val;
+ int shift = max77802_get_opmode_shift(id);
+
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
++ return -EINVAL;
++
+ /*
+ * If the regulator has been disabled for suspend
+ * then is invalid to try setting a suspend mode.
+@@ -212,9 +222,11 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev,
+ static int max77802_enable(struct regulator_dev *rdev)
+ {
+ struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev);
+- int id = rdev_get_id(rdev);
++ unsigned int id = rdev_get_id(rdev);
+ int shift = max77802_get_opmode_shift(id);
+
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode)))
++ return -EINVAL;
+ if (max77802->opmode[id] == MAX77802_OFF_PWRREQ)
+ max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
+
+@@ -543,7 +555,7 @@ static int max77802_pmic_probe(struct platform_device *pdev)
+
+ for (i = 0; i < MAX77802_REG_MAX; i++) {
+ struct regulator_dev *rdev;
+- int id = regulators[i].id;
++ unsigned int id = regulators[i].id;
+ int shift = max77802_get_opmode_shift(id);
+ int ret;
+
+@@ -561,10 +573,12 @@ static int max77802_pmic_probe(struct platform_device *pdev)
+ * the hardware reports OFF as the regulator operating mode.
+ * Default to operating mode NORMAL in that case.
+ */
+- if (val == MAX77802_STATUS_OFF)
+- max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
+- else
+- max77802->opmode[id] = val;
++ if (id < ARRAY_SIZE(max77802->opmode)) {
++ if (val == MAX77802_STATUS_OFF)
++ max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
++ else
++ max77802->opmode[id] = val;
++ }
+
+ rdev = devm_regulator_register(&pdev->dev,
+ ®ulators[i], &config);
+diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
+index 4818df3f8ec91..24c0c82b08a5d 100644
+--- a/drivers/regulator/s5m8767.c
++++ b/drivers/regulator/s5m8767.c
+@@ -922,10 +922,14 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
+
+ for (i = 0; i < pdata->num_regulators; i++) {
+ const struct sec_voltage_desc *desc;
+- int id = pdata->regulators[i].id;
++ unsigned int id = pdata->regulators[i].id;
+ int enable_reg, enable_val;
+ struct regulator_dev *rdev;
+
++ BUILD_BUG_ON(ARRAY_SIZE(regulators) != ARRAY_SIZE(reg_voltage_map));
++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(regulators)))
++ continue;
++
+ desc = reg_voltage_map[id];
+ if (desc) {
+ regulators[id].n_voltages =
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index c10230ad90b29..940f099c2092f 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -929,6 +929,7 @@ static void qcom_glink_handle_intent(struct qcom_glink *glink,
+ spin_unlock_irqrestore(&glink->idr_lock, flags);
+ if (!channel) {
+ dev_err(glink->dev, "intents for non-existing channel\n");
++ qcom_glink_rx_advance(glink, ALIGN(msglen, 8));
+ return;
+ }
+
+diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
+index e03104b734fc9..a5455b2a3cbe9 100644
+--- a/drivers/rtc/rtc-pm8xxx.c
++++ b/drivers/rtc/rtc-pm8xxx.c
+@@ -229,7 +229,6 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
+ {
+ int rc, i;
+ u8 value[NUM_8_BIT_RTC_REGS];
+- unsigned int ctrl_reg;
+ unsigned long secs, irq_flags;
+ struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+ const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
+@@ -241,6 +240,11 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
+ secs >>= 8;
+ }
+
++ rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl,
++ regs->alarm_en, 0);
++ if (rc)
++ return rc;
++
+ spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
+
+ rc = regmap_bulk_write(rtc_dd->regmap, regs->alarm_rw, value,
+@@ -250,19 +254,11 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
+ goto rtc_rw_fail;
+ }
+
+- rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);
+- if (rc)
+- goto rtc_rw_fail;
+-
+- if (alarm->enabled)
+- ctrl_reg |= regs->alarm_en;
+- else
+- ctrl_reg &= ~regs->alarm_en;
+-
+- rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);
+- if (rc) {
+- dev_err(dev, "Write to RTC alarm control register failed\n");
+- goto rtc_rw_fail;
++ if (alarm->enabled) {
++ rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl,
++ regs->alarm_en, regs->alarm_en);
++ if (rc)
++ goto rtc_rw_fail;
+ }
+
+ dev_dbg(dev, "Alarm Set for h:r:s=%d:%d:%d, d/m/y=%d/%d/%d\n",
+diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c
+index cdd4ab683be98..4de4bbca1f925 100644
+--- a/drivers/scsi/aic94xx/aic94xx_task.c
++++ b/drivers/scsi/aic94xx/aic94xx_task.c
+@@ -68,6 +68,9 @@ static int asd_map_scatterlist(struct sas_task *task,
+ dma_addr_t dma = pci_map_single(asd_ha->pcidev, p,
+ task->total_xfer_len,
+ task->data_dir);
++ if (dma_mapping_error(&asd_ha->pcidev->dev, dma))
++ return -ENOMEM;
++
+ sg_arr[0].bus_addr = cpu_to_le64((u64)dma);
+ sg_arr[0].size = cpu_to_le32(task->total_xfer_len);
+ sg_arr[0].flags |= ASD_SG_EL_LIST_EOL;
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 5989c868bfe08..921ecaf33c9b4 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -1531,23 +1531,22 @@ static void ipr_process_ccn(struct ipr_cmnd *ipr_cmd)
+ }
+
+ /**
+- * strip_and_pad_whitespace - Strip and pad trailing whitespace.
+- * @i: index into buffer
+- * @buf: string to modify
++ * strip_whitespace - Strip and pad trailing whitespace.
++ * @i: size of buffer
++ * @buf: string to modify
+ *
+- * This function will strip all trailing whitespace, pad the end
+- * of the string with a single space, and NULL terminate the string.
++ * This function will strip all trailing whitespace and
++ * NUL terminate the string.
+ *
+- * Return value:
+- * new length of string
+ **/
+-static int strip_and_pad_whitespace(int i, char *buf)
++static void strip_whitespace(int i, char *buf)
+ {
++ if (i < 1)
++ return;
++ i--;
+ while (i && buf[i] == ' ')
+ i--;
+- buf[i+1] = ' ';
+- buf[i+2] = '\0';
+- return i + 2;
++ buf[i+1] = '\0';
+ }
+
+ /**
+@@ -1562,19 +1561,21 @@ static int strip_and_pad_whitespace(int i, char *buf)
+ static void ipr_log_vpd_compact(char *prefix, struct ipr_hostrcb *hostrcb,
+ struct ipr_vpd *vpd)
+ {
+- char buffer[IPR_VENDOR_ID_LEN + IPR_PROD_ID_LEN + IPR_SERIAL_NUM_LEN + 3];
+- int i = 0;
++ char vendor_id[IPR_VENDOR_ID_LEN + 1];
++ char product_id[IPR_PROD_ID_LEN + 1];
++ char sn[IPR_SERIAL_NUM_LEN + 1];
+
+- memcpy(buffer, vpd->vpids.vendor_id, IPR_VENDOR_ID_LEN);
+- i = strip_and_pad_whitespace(IPR_VENDOR_ID_LEN - 1, buffer);
++ memcpy(vendor_id, vpd->vpids.vendor_id, IPR_VENDOR_ID_LEN);
++ strip_whitespace(IPR_VENDOR_ID_LEN, vendor_id);
+
+- memcpy(&buffer[i], vpd->vpids.product_id, IPR_PROD_ID_LEN);
+- i = strip_and_pad_whitespace(i + IPR_PROD_ID_LEN - 1, buffer);
++ memcpy(product_id, vpd->vpids.product_id, IPR_PROD_ID_LEN);
++ strip_whitespace(IPR_PROD_ID_LEN, product_id);
+
+- memcpy(&buffer[i], vpd->sn, IPR_SERIAL_NUM_LEN);
+- buffer[IPR_SERIAL_NUM_LEN + i] = '\0';
++ memcpy(sn, vpd->sn, IPR_SERIAL_NUM_LEN);
++ strip_whitespace(IPR_SERIAL_NUM_LEN, sn);
+
+- ipr_hcam_err(hostrcb, "%s VPID/SN: %s\n", prefix, buffer);
++ ipr_hcam_err(hostrcb, "%s VPID/SN: %s %s %s\n", prefix,
++ vendor_id, product_id, sn);
+ }
+
+ /**
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 207af1d5ed292..7863ad1390f8a 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -6149,9 +6149,12 @@ qla2x00_do_dpc(void *data)
+ }
+ }
+ loop_resync_check:
+- if (test_and_clear_bit(LOOP_RESYNC_NEEDED,
++ if (!qla2x00_reset_active(base_vha) &&
++ test_and_clear_bit(LOOP_RESYNC_NEEDED,
+ &base_vha->dpc_flags)) {
+-
++ /*
++ * Allow abort_isp to complete before moving on to scanning.
++ */
+ ql_dbg(ql_dbg_dpc, base_vha, 0x400f,
+ "Loop resync scheduled.\n");
+
+@@ -6384,7 +6387,7 @@ qla2x00_timer(struct timer_list *t)
+
+ /* if the loop has been down for 4 minutes, reinit adapter */
+ if (atomic_dec_and_test(&vha->loop_down_timer) != 0) {
+- if (!(vha->device_flags & DFLG_NO_CABLE)) {
++ if (!(vha->device_flags & DFLG_NO_CABLE) && !vha->vp_idx) {
+ ql_log(ql_log_warn, vha, 0x6009,
+ "Loop down - aborting ISP.\n");
+
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index e79d9f60a5282..f50a675dc4b86 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -449,8 +449,8 @@ int ses_match_host(struct enclosure_device *edev, void *data)
+ }
+ #endif /* 0 */
+
+-static void ses_process_descriptor(struct enclosure_component *ecomp,
+- unsigned char *desc)
++static int ses_process_descriptor(struct enclosure_component *ecomp,
++ unsigned char *desc, int max_desc_len)
+ {
+ int eip = desc[0] & 0x10;
+ int invalid = desc[0] & 0x80;
+@@ -461,22 +461,32 @@ static void ses_process_descriptor(struct enclosure_component *ecomp,
+ unsigned char *d;
+
+ if (invalid)
+- return;
++ return 0;
+
+ switch (proto) {
+ case SCSI_PROTOCOL_FCP:
+ if (eip) {
++ if (max_desc_len <= 7)
++ return 1;
+ d = desc + 4;
+ slot = d[3];
+ }
+ break;
+ case SCSI_PROTOCOL_SAS:
++
+ if (eip) {
++ if (max_desc_len <= 27)
++ return 1;
+ d = desc + 4;
+ slot = d[3];
+ d = desc + 8;
+- } else
++ } else {
++ if (max_desc_len <= 23)
++ return 1;
+ d = desc + 4;
++ }
++
++
+ /* only take the phy0 addr */
+ addr = (u64)d[12] << 56 |
+ (u64)d[13] << 48 |
+@@ -493,6 +503,8 @@ static void ses_process_descriptor(struct enclosure_component *ecomp,
+ }
+ ecomp->slot = slot;
+ scomp->addr = addr;
++
++ return 0;
+ }
+
+ struct efd {
+@@ -565,7 +577,7 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
+ /* skip past overall descriptor */
+ desc_ptr += len + 4;
+ }
+- if (ses_dev->page10)
++ if (ses_dev->page10 && ses_dev->page10_len > 9)
+ addl_desc_ptr = ses_dev->page10 + 8;
+ type_ptr = ses_dev->page1_types;
+ components = 0;
+@@ -573,17 +585,22 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
+ for (j = 0; j < type_ptr[1]; j++) {
+ char *name = NULL;
+ struct enclosure_component *ecomp;
++ int max_desc_len;
+
+ if (desc_ptr) {
+- if (desc_ptr >= buf + page7_len) {
++ if (desc_ptr + 3 >= buf + page7_len) {
+ desc_ptr = NULL;
+ } else {
+ len = (desc_ptr[2] << 8) + desc_ptr[3];
+ desc_ptr += 4;
+- /* Add trailing zero - pushes into
+- * reserved space */
+- desc_ptr[len] = '\0';
+- name = desc_ptr;
++ if (desc_ptr + len > buf + page7_len)
++ desc_ptr = NULL;
++ else {
++ /* Add trailing zero - pushes into
++ * reserved space */
++ desc_ptr[len] = '\0';
++ name = desc_ptr;
++ }
+ }
+ }
+ if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
+@@ -599,10 +616,14 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
+ ecomp = &edev->component[components++];
+
+ if (!IS_ERR(ecomp)) {
+- if (addl_desc_ptr)
+- ses_process_descriptor(
+- ecomp,
+- addl_desc_ptr);
++ if (addl_desc_ptr) {
++ max_desc_len = ses_dev->page10_len -
++ (addl_desc_ptr - ses_dev->page10);
++ if (ses_process_descriptor(ecomp,
++ addl_desc_ptr,
++ max_desc_len))
++ addl_desc_ptr = NULL;
++ }
+ if (create)
+ enclosure_component_register(
+ ecomp);
+@@ -619,9 +640,11 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
+ /* these elements are optional */
+ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT ||
+ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT ||
+- type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS))
++ type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) {
+ addl_desc_ptr += addl_desc_ptr[1] + 2;
+-
++ if (addl_desc_ptr + 1 >= ses_dev->page10 + ses_dev->page10_len)
++ addl_desc_ptr = NULL;
++ }
+ }
+ }
+ kfree(buf);
+@@ -720,6 +743,12 @@ static int ses_intf_add(struct device *cdev,
+ type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE)
+ components += type_ptr[1];
+ }
++
++ if (components == 0) {
++ sdev_printk(KERN_WARNING, sdev, "enclosure has no enumerated components\n");
++ goto err_free;
++ }
++
+ ses_dev->page1 = buf;
+ ses_dev->page1_len = len;
+ buf = NULL;
+@@ -843,7 +872,8 @@ static void ses_intf_remove_enclosure(struct scsi_device *sdev)
+ kfree(ses_dev->page2);
+ kfree(ses_dev);
+
+- kfree(edev->component[0].scratch);
++ if (edev->components)
++ kfree(edev->component[0].scratch);
+
+ put_device(&edev->edev);
+ enclosure_unregister(edev);
+diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
+index 2ad7b3f3666be..d4692f54492f4 100644
+--- a/drivers/spi/spi-bcm63xx-hsspi.c
++++ b/drivers/spi/spi-bcm63xx-hsspi.c
+@@ -20,6 +20,8 @@
+ #include <linux/spi/spi.h>
+ #include <linux/mutex.h>
+ #include <linux/of.h>
++#include <linux/reset.h>
++#include <linux/pm_runtime.h>
+
+ #define HSSPI_GLOBAL_CTRL_REG 0x0
+ #define GLOBAL_CTRL_CS_POLARITY_SHIFT 0
+@@ -161,6 +163,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)
+ int step_size = HSSPI_BUFFER_LEN;
+ const u8 *tx = t->tx_buf;
+ u8 *rx = t->rx_buf;
++ u32 val = 0;
+
+ bcm63xx_hsspi_set_clk(bs, spi, t->speed_hz);
+ bcm63xx_hsspi_set_cs(bs, spi->chip_select, true);
+@@ -176,11 +179,16 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t)
+ step_size -= HSSPI_OPCODE_LEN;
+
+ if ((opcode == HSSPI_OP_READ && t->rx_nbits == SPI_NBITS_DUAL) ||
+- (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL))
++ (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL)) {
+ opcode |= HSSPI_OP_MULTIBIT;
+
+- __raw_writel(1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT |
+- 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT | 0xff,
++ if (t->rx_nbits == SPI_NBITS_DUAL)
++ val |= 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT;
++ if (t->tx_nbits == SPI_NBITS_DUAL)
++ val |= 1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT;
++ }
++
++ __raw_writel(val | 0xff,
+ bs->regs + HSSPI_PROFILE_MODE_CTRL_REG(chip_select));
+
+ while (pending > 0) {
+@@ -432,13 +440,17 @@ static int bcm63xx_hsspi_probe(struct platform_device *pdev)
+ if (ret)
+ goto out_put_master;
+
++ pm_runtime_enable(&pdev->dev);
++
+ /* register and we are done */
+ ret = devm_spi_register_master(dev, master);
+ if (ret)
+- goto out_put_master;
++ goto out_pm_disable;
+
+ return 0;
+
++out_pm_disable:
++ pm_runtime_disable(&pdev->dev);
+ out_put_master:
+ spi_master_put(master);
+ out_disable_pll_clk:
+diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
+index dffefcde0628f..351fa43c1ee3c 100644
+--- a/drivers/thermal/intel_powerclamp.c
++++ b/drivers/thermal/intel_powerclamp.c
+@@ -72,6 +72,7 @@
+
+ static unsigned int target_mwait;
+ static struct dentry *debug_dir;
++static bool poll_pkg_cstate_enable;
+
+ /* user selected target */
+ static unsigned int set_target_ratio;
+@@ -280,6 +281,9 @@ static unsigned int get_compensation(int ratio)
+ {
+ unsigned int comp = 0;
+
++ if (!poll_pkg_cstate_enable)
++ return 0;
++
+ /* we only use compensation if all adjacent ones are good */
+ if (ratio == 1 &&
+ cal_data[ratio].confidence >= CONFIDENCE_OK &&
+@@ -552,7 +556,8 @@ static int start_power_clamp(void)
+ control_cpu = cpumask_first(cpu_online_mask);
+
+ clamping = true;
+- schedule_delayed_work(&poll_pkg_cstate_work, 0);
++ if (poll_pkg_cstate_enable)
++ schedule_delayed_work(&poll_pkg_cstate_work, 0);
+
+ /* start one kthread worker per online cpu */
+ for_each_online_cpu(cpu) {
+@@ -621,11 +626,15 @@ static int powerclamp_get_max_state(struct thermal_cooling_device *cdev,
+ static int powerclamp_get_cur_state(struct thermal_cooling_device *cdev,
+ unsigned long *state)
+ {
+- if (true == clamping)
+- *state = pkg_cstate_ratio_cur;
+- else
++ if (clamping) {
++ if (poll_pkg_cstate_enable)
++ *state = pkg_cstate_ratio_cur;
++ else
++ *state = set_target_ratio;
++ } else {
+ /* to save power, do not poll idle ratio while not clamping */
+ *state = -1; /* indicates invalid state */
++ }
+
+ return 0;
+ }
+@@ -770,6 +779,9 @@ static int __init powerclamp_init(void)
+ goto exit_unregister;
+ }
+
++ if (topology_max_packages() == 1)
++ poll_pkg_cstate_enable = true;
++
+ cooling_dev = thermal_cooling_device_register("intel_powerclamp", NULL,
+ &powerclamp_cooling_ops);
+ if (IS_ERR(cooling_dev)) {
+diff --git a/drivers/thermal/intel_quark_dts_thermal.c b/drivers/thermal/intel_quark_dts_thermal.c
+index 5d33b350da1c6..ad92d8f0add19 100644
+--- a/drivers/thermal/intel_quark_dts_thermal.c
++++ b/drivers/thermal/intel_quark_dts_thermal.c
+@@ -440,22 +440,14 @@ MODULE_DEVICE_TABLE(x86cpu, qrk_thermal_ids);
+
+ static int __init intel_quark_thermal_init(void)
+ {
+- int err = 0;
+-
+ if (!x86_match_cpu(qrk_thermal_ids) || !iosf_mbi_available())
+ return -ENODEV;
+
+ soc_dts = alloc_soc_dts();
+- if (IS_ERR(soc_dts)) {
+- err = PTR_ERR(soc_dts);
+- goto err_free;
+- }
++ if (IS_ERR(soc_dts))
++ return PTR_ERR(soc_dts);
+
+ return 0;
+-
+-err_free:
+- free_soc_dts(soc_dts);
+- return err;
+ }
+
+ static void __exit intel_quark_thermal_exit(void)
+diff --git a/drivers/thermal/intel_soc_dts_iosf.c b/drivers/thermal/intel_soc_dts_iosf.c
+index e0813dfaa2783..435a093998000 100644
+--- a/drivers/thermal/intel_soc_dts_iosf.c
++++ b/drivers/thermal/intel_soc_dts_iosf.c
+@@ -405,7 +405,7 @@ struct intel_soc_dts_sensors *intel_soc_dts_iosf_init(
+ {
+ struct intel_soc_dts_sensors *sensors;
+ bool notification;
+- u32 tj_max;
++ int tj_max;
+ int ret;
+ int i;
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 069d02354c825..6ea1d23623e51 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1195,12 +1195,32 @@ static void lpuart_break_ctl(struct uart_port *port, int break_state)
+
+ static void lpuart32_break_ctl(struct uart_port *port, int break_state)
+ {
+- unsigned long temp;
++ unsigned long temp, modem;
++ struct tty_struct *tty;
++ unsigned int cflag = 0;
++
++ tty = tty_port_tty_get(&port->state->port);
++ if (tty) {
++ cflag = tty->termios.c_cflag;
++ tty_kref_put(tty);
++ }
+
+ temp = lpuart32_read(port, UARTCTRL) & ~UARTCTRL_SBK;
++ modem = lpuart32_read(port, UARTMODIR);
+
+- if (break_state != 0)
++ if (break_state != 0) {
+ temp |= UARTCTRL_SBK;
++ /*
++ * LPUART CTS has higher priority than SBK, need to disable CTS before
++ * asserting SBK to avoid any interference if flow control is enabled.
++ */
++ if (cflag & CRTSCTS && modem & UARTMODIR_TXCTSE)
++ lpuart32_write(port, modem & ~UARTMODIR_TXCTSE, UARTMODIR);
++ } else {
++ /* Re-enable the CTS when break off. */
++ if (cflag & CRTSCTS && !(modem & UARTMODIR_TXCTSE))
++ lpuart32_write(port, modem | UARTMODIR_TXCTSE, UARTMODIR);
++ }
+
+ lpuart32_write(port, temp, UARTCTRL);
+ }
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index b6f42d0ee6269..d3e6b66155536 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1155,14 +1155,16 @@ static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
+ {
+ struct tty_struct *tty;
+
+- if (driver->ops->lookup)
++ if (driver->ops->lookup) {
+ if (!file)
+ tty = ERR_PTR(-EIO);
+ else
+ tty = driver->ops->lookup(driver, file, idx);
+- else
++ } else {
++ if (idx >= driver->num)
++ return ERR_PTR(-EINVAL);
+ tty = driver->ttys[idx];
+-
++ }
+ if (!IS_ERR(tty))
+ tty_kref_get(tty);
+ return tty;
+diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
+index 5b5e800ab1549..28bc9c70de3ec 100644
+--- a/drivers/tty/vt/vc_screen.c
++++ b/drivers/tty/vt/vc_screen.c
+@@ -278,10 +278,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+ */
+ size = vcs_size(inode);
+ if (size < 0) {
+- if (read)
+- break;
+ ret = size;
+- goto unlock_out;
++ break;
+ }
+ if (pos >= size)
+ break;
+diff --git a/drivers/usb/host/xhci-mvebu.c b/drivers/usb/host/xhci-mvebu.c
+index 32e1585687885..fc9d6189c310f 100644
+--- a/drivers/usb/host/xhci-mvebu.c
++++ b/drivers/usb/host/xhci-mvebu.c
+@@ -31,7 +31,7 @@ static void xhci_mvebu_mbus_config(void __iomem *base,
+
+ /* Program each DRAM CS in a seperate window */
+ for (win = 0; win < dram->num_cs; win++) {
+- const struct mbus_dram_window *cs = dram->cs + win;
++ const struct mbus_dram_window *cs = &dram->cs[win];
+
+ writel(((cs->size - 1) & 0xffff0000) | (cs->mbus_attr << 8) |
+ (dram->mbus_dram_target_id << 4) | 1,
+diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
+index 54679679c825d..16b63f2cd661e 100644
+--- a/drivers/usb/storage/ene_ub6250.c
++++ b/drivers/usb/storage/ene_ub6250.c
+@@ -937,7 +937,7 @@ static int ms_lib_process_bootblock(struct us_data *us, u16 PhyBlock, u8 *PageDa
+ struct ms_lib_type_extdat ExtraData;
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+
+- PageBuffer = kmalloc(MS_BYTES_PER_PAGE, GFP_KERNEL);
++ PageBuffer = kzalloc(MS_BYTES_PER_PAGE * 2, GFP_KERNEL);
+ if (PageBuffer == NULL)
+ return (u32)-1;
+
+diff --git a/drivers/watchdog/at91sam9_wdt.c b/drivers/watchdog/at91sam9_wdt.c
+index f4050a229eb58..aaa3c5a8c4570 100644
+--- a/drivers/watchdog/at91sam9_wdt.c
++++ b/drivers/watchdog/at91sam9_wdt.c
+@@ -206,10 +206,9 @@ static int at91_wdt_init(struct platform_device *pdev, struct at91wdt *wdt)
+ "min heartbeat and max heartbeat might be too close for the system to handle it correctly\n");
+
+ if ((tmp & AT91_WDT_WDFIEN) && wdt->irq) {
+- err = request_irq(wdt->irq, wdt_interrupt,
+- IRQF_SHARED | IRQF_IRQPOLL |
+- IRQF_NO_SUSPEND,
+- pdev->name, wdt);
++ err = devm_request_irq(dev, wdt->irq, wdt_interrupt,
++ IRQF_SHARED | IRQF_IRQPOLL | IRQF_NO_SUSPEND,
++ pdev->name, wdt);
+ if (err)
+ return err;
+ }
+diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c
+index 4d02f26156f9c..b7b9d562da137 100644
+--- a/drivers/watchdog/pcwd_usb.c
++++ b/drivers/watchdog/pcwd_usb.c
+@@ -329,7 +329,8 @@ static int usb_pcwd_set_heartbeat(struct usb_pcwd_private *usb_pcwd, int t)
+ static int usb_pcwd_get_temperature(struct usb_pcwd_private *usb_pcwd,
+ int *temperature)
+ {
+- unsigned char msb, lsb;
++ unsigned char msb = 0x00;
++ unsigned char lsb = 0x00;
+
+ usb_pcwd_send_command(usb_pcwd, CMD_READ_TEMP, &msb, &lsb);
+
+@@ -345,7 +346,8 @@ static int usb_pcwd_get_temperature(struct usb_pcwd_private *usb_pcwd,
+ static int usb_pcwd_get_timeleft(struct usb_pcwd_private *usb_pcwd,
+ int *time_left)
+ {
+- unsigned char msb, lsb;
++ unsigned char msb = 0x00;
++ unsigned char lsb = 0x00;
+
+ /* Read the time that's left before rebooting */
+ /* Note: if the board is not yet armed then we will read 0xFFFF */
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index 8fe59b7d8eec8..808896c9e1c20 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -989,8 +989,8 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ if (wdd->id == 0) {
+ misc_deregister(&watchdog_miscdev);
+ old_wd_data = NULL;
+- put_device(&wd_data->dev);
+ }
++ put_device(&wd_data->dev);
+ return err;
+ }
+
+diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
+index 591cd5c704323..ea1d8cfab4302 100644
+--- a/fs/cifs/smbdirect.c
++++ b/fs/cifs/smbdirect.c
+@@ -1887,6 +1887,7 @@ static struct smbd_connection *_smbd_get_connection(
+
+ allocate_mr_failed:
+ /* At this point, need to a full transport shutdown */
++ server->smbd_conn = info;
+ smbd_destroy(server);
+ return NULL;
+
+@@ -2453,6 +2454,7 @@ static int allocate_mr_list(struct smbd_connection *info)
+ atomic_set(&info->mr_ready_count, 0);
+ atomic_set(&info->mr_used_count, 0);
+ init_waitqueue_head(&info->wait_for_mr_cleanup);
++ INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work);
+ /* Allocate more MRs (2x) than hardware responder_resources */
+ for (i = 0; i < info->responder_resources * 2; i++) {
+ smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL);
+@@ -2481,13 +2483,13 @@ static int allocate_mr_list(struct smbd_connection *info)
+ list_add_tail(&smbdirect_mr->list, &info->mr_list);
+ atomic_inc(&info->mr_ready_count);
+ }
+- INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work);
+ return 0;
+
+ out:
+ kfree(smbdirect_mr);
+
+ list_for_each_entry_safe(smbdirect_mr, tmp, &info->mr_list, list) {
++ list_del(&smbdirect_mr->list);
+ ib_dereg_mr(smbdirect_mr->mr);
+ kfree(smbdirect_mr->sgl);
+ kfree(smbdirect_mr);
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 0772941bbe925..23334cfeac552 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1436,6 +1436,13 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,
+ uid_t owner[2] = { i_uid_read(inode), i_gid_read(inode) };
+ int err;
+
++ if (inode->i_sb->s_root == NULL) {
++ ext4_warning(inode->i_sb,
++ "refuse to create EA inode when umounting");
++ WARN_ON(1);
++ return ERR_PTR(-EINVAL);
++ }
++
+ /*
+ * Let the next inode be the goal, so we try and allocate the EA inode
+ * in the same group, or nearby one.
+@@ -2583,9 +2590,8 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode,
+
+ is = kzalloc(sizeof(struct ext4_xattr_ibody_find), GFP_NOFS);
+ bs = kzalloc(sizeof(struct ext4_xattr_block_find), GFP_NOFS);
+- buffer = kvmalloc(value_size, GFP_NOFS);
+ b_entry_name = kmalloc(entry->e_name_len + 1, GFP_NOFS);
+- if (!is || !bs || !buffer || !b_entry_name) {
++ if (!is || !bs || !b_entry_name) {
+ error = -ENOMEM;
+ goto out;
+ }
+@@ -2597,12 +2603,18 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode,
+
+ /* Save the entry name and the entry value */
+ if (entry->e_value_inum) {
++ buffer = kvmalloc(value_size, GFP_NOFS);
++ if (!buffer) {
++ error = -ENOMEM;
++ goto out;
++ }
++
+ error = ext4_xattr_inode_get(inode, entry, buffer, value_size);
+ if (error)
+ goto out;
+ } else {
+ size_t value_offs = le16_to_cpu(entry->e_value_offs);
+- memcpy(buffer, (void *)IFIRST(header) + value_offs, value_size);
++ buffer = (void *)IFIRST(header) + value_offs;
+ }
+
+ memcpy(b_entry_name, entry->e_name, entry->e_name_len);
+@@ -2617,25 +2629,26 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode,
+ if (error)
+ goto out;
+
+- /* Remove the chosen entry from the inode */
+- error = ext4_xattr_ibody_set(handle, inode, &i, is);
+- if (error)
+- goto out;
+-
+ i.value = buffer;
+ i.value_len = value_size;
+ error = ext4_xattr_block_find(inode, &i, bs);
+ if (error)
+ goto out;
+
+- /* Add entry which was removed from the inode into the block */
++ /* Move ea entry from the inode into the block */
+ error = ext4_xattr_block_set(handle, inode, &i, bs);
+ if (error)
+ goto out;
+- error = 0;
++
++ /* Remove the chosen entry from the inode */
++ i.value = NULL;
++ i.value_len = 0;
++ error = ext4_xattr_ibody_set(handle, inode, &i, is);
++
+ out:
+ kfree(b_entry_name);
+- kvfree(buffer);
++ if (entry->e_value_inum && buffer)
++ kvfree(buffer);
+ if (is)
+ brelse(is->iloc.bh);
+ if (bs)
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index c63f5e32630ee..56b2dadd623b2 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -464,7 +464,7 @@ int f2fs_submit_page_bio(struct f2fs_io_info *fio)
+ }
+
+ if (fio->io_wbc && !is_read_io(fio->op))
+- wbc_account_io(fio->io_wbc, page, PAGE_SIZE);
++ wbc_account_io(fio->io_wbc, fio->page, PAGE_SIZE);
+
+ bio_set_op_attrs(bio, fio->op, fio->op_flags);
+
+@@ -533,7 +533,7 @@ alloc_new:
+ }
+
+ if (fio->io_wbc)
+- wbc_account_io(fio->io_wbc, bio_page, PAGE_SIZE);
++ wbc_account_io(fio->io_wbc, fio->page, PAGE_SIZE);
+
+ io->last_block_in_bio = fio->new_blkaddr;
+ f2fs_trace_ios(fio, 0);
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index 6bf78cf63ea2e..7ad78aa9c7b85 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -408,18 +408,17 @@ static int f2fs_move_inline_dirents(struct inode *dir, struct page *ipage,
+
+ dentry_blk = page_address(page);
+
++ /*
++ * Start by zeroing the full block, to ensure that all unused space is
++ * zeroed and no uninitialized memory is leaked to disk.
++ */
++ memset(dentry_blk, 0, F2FS_BLKSIZE);
++
+ make_dentry_ptr_inline(dir, &src, inline_dentry);
+ make_dentry_ptr_block(dir, &dst, dentry_blk);
+
+ /* copy data from inline dentry block to new dentry block */
+ memcpy(dst.bitmap, src.bitmap, src.nr_bitmap);
+- memset(dst.bitmap + src.nr_bitmap, 0, dst.nr_bitmap - src.nr_bitmap);
+- /*
+- * we do not need to zero out remainder part of dentry and filename
+- * field, since we have used bitmap for marking the usage status of
+- * them, besides, we can also ignore copying/zeroing reserved space
+- * of dentry block, because them haven't been used so far.
+- */
+ memcpy(dst.dentry, src.dentry, SIZE_OF_DIR_ENTRY * src.max);
+ memcpy(dst.filename, src.filename, src.max * F2FS_SLOT_LEN);
+
+diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
+index 31e8270d0b266..c5390421cca29 100644
+--- a/fs/gfs2/aops.c
++++ b/fs/gfs2/aops.c
+@@ -179,7 +179,6 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w
+ {
+ struct inode *inode = page->mapping->host;
+ struct gfs2_inode *ip = GFS2_I(inode);
+- struct gfs2_sbd *sdp = GFS2_SB(inode);
+
+ if (PageChecked(page)) {
+ ClearPageChecked(page);
+@@ -187,7 +186,7 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w
+ create_empty_buffers(page, inode->i_sb->s_blocksize,
+ BIT(BH_Dirty)|BIT(BH_Uptodate));
+ }
+- gfs2_page_add_databufs(ip, page, 0, sdp->sd_vfs->s_blocksize);
++ gfs2_page_add_databufs(ip, page, 0, PAGE_SIZE);
+ }
+ return gfs2_write_full_page(page, gfs2_get_block_noalloc, wbc);
+ }
+diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
+index c0a73a6ffb28b..397e02a566970 100644
+--- a/fs/hfs/bnode.c
++++ b/fs/hfs/bnode.c
+@@ -281,6 +281,7 @@ static struct hfs_bnode *__hfs_bnode_create(struct hfs_btree *tree, u32 cnid)
+ tree->node_hash[hash] = node;
+ tree->node_hash_cnt++;
+ } else {
++ hfs_bnode_get(node2);
+ spin_unlock(&tree->hash_lock);
+ kfree(node);
+ wait_event(node2->lock_wq, !test_bit(HFS_BNODE_NEW, &node2->flags));
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index eb4535eba95d9..3b1356b10a472 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -294,11 +294,11 @@ static void hfsplus_put_super(struct super_block *sb)
+ hfsplus_sync_fs(sb, 1);
+ }
+
++ iput(sbi->alloc_file);
++ iput(sbi->hidden_dir);
+ hfs_btree_close(sbi->attr_tree);
+ hfs_btree_close(sbi->cat_tree);
+ hfs_btree_close(sbi->ext_tree);
+- iput(sbi->alloc_file);
+- iput(sbi->hidden_dir);
+ kfree(sbi->s_vhdr_buf);
+ kfree(sbi->s_backup_vhdr_buf);
+ unload_nls(sbi->nls);
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index f06796cad9aa8..3ad0a33e0443b 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -206,7 +206,8 @@ int dbMount(struct inode *ipbmap)
+ bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth);
+ bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart);
+ bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size);
+- if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG) {
++ if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG ||
++ bmp->db_agl2size < 0) {
+ err = -EINVAL;
+ goto err_release_metapage;
+ }
+diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
+index f4cf1c0793c6a..cf81b5bc3e156 100644
+--- a/fs/nfsd/nfs4layouts.c
++++ b/fs/nfsd/nfs4layouts.c
+@@ -322,11 +322,11 @@ nfsd4_recall_file_layout(struct nfs4_layout_stateid *ls)
+ if (ls->ls_recalled)
+ goto out_unlock;
+
+- ls->ls_recalled = true;
+- atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls);
+ if (list_empty(&ls->ls_layouts))
+ goto out_unlock;
+
++ ls->ls_recalled = true;
++ atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls);
+ trace_nfsd_layout_recall(&ls->ls_stid.sc_stateid);
+
+ refcount_inc(&ls->ls_stid.sc_count);
+diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
+index 1565dd8e8856e..fbbc30f201731 100644
+--- a/fs/ocfs2/move_extents.c
++++ b/fs/ocfs2/move_extents.c
+@@ -115,14 +115,6 @@ static int __ocfs2_move_extent(handle_t *handle,
+ */
+ replace_rec.e_flags = ext_flags & ~OCFS2_EXT_REFCOUNTED;
+
+- ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode),
+- context->et.et_root_bh,
+- OCFS2_JOURNAL_ACCESS_WRITE);
+- if (ret) {
+- mlog_errno(ret);
+- goto out;
+- }
+-
+ ret = ocfs2_split_extent(handle, &context->et, path, index,
+ &replace_rec, context->meta_ac,
+ &context->dealloc);
+@@ -131,8 +123,6 @@ static int __ocfs2_move_extent(handle_t *handle,
+ goto out;
+ }
+
+- ocfs2_journal_dirty(handle, context->et.et_root_bh);
+-
+ context->new_phys_cpos = new_p_cpos;
+
+ /*
+@@ -454,7 +444,7 @@ static int ocfs2_find_victim_alloc_group(struct inode *inode,
+ bg = (struct ocfs2_group_desc *)gd_bh->b_data;
+
+ if (vict_blkno < (le64_to_cpu(bg->bg_blkno) +
+- le16_to_cpu(bg->bg_bits))) {
++ (le16_to_cpu(bg->bg_bits) << bits_per_unit))) {
+
+ *ret_bh = gd_bh;
+ *vict_bit = (vict_blkno - blkno) >>
+@@ -569,6 +559,7 @@ static void ocfs2_probe_alloc_group(struct inode *inode, struct buffer_head *bh,
+ last_free_bits++;
+
+ if (last_free_bits == move_len) {
++ i -= move_len;
+ *goal_bit = i;
+ *phys_cpos = base_cpos + i;
+ break;
+@@ -1040,18 +1031,19 @@ int ocfs2_ioctl_move_extents(struct file *filp, void __user *argp)
+
+ context->range = ⦥
+
++ /*
++ * ok, the default theshold for the defragmentation
++ * is 1M, since our maximum clustersize was 1M also.
++ * any thought?
++ */
++ if (!range.me_threshold)
++ range.me_threshold = 1024 * 1024;
++
++ if (range.me_threshold > i_size_read(inode))
++ range.me_threshold = i_size_read(inode);
++
+ if (range.me_flags & OCFS2_MOVE_EXT_FL_AUTO_DEFRAG) {
+ context->auto_defrag = 1;
+- /*
+- * ok, the default theshold for the defragmentation
+- * is 1M, since our maximum clustersize was 1M also.
+- * any thought?
+- */
+- if (!range.me_threshold)
+- range.me_threshold = 1024 * 1024;
+-
+- if (range.me_threshold > i_size_read(inode))
+- range.me_threshold = i_size_read(inode);
+
+ if (range.me_flags & OCFS2_MOVE_EXT_FL_PART_DEFRAG)
+ context->partial = 1;
+diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c
+index 7ef22baf9d150..30c7bd63c2ad1 100644
+--- a/fs/ubifs/budget.c
++++ b/fs/ubifs/budget.c
+@@ -224,11 +224,10 @@ long long ubifs_calc_available(const struct ubifs_info *c, int min_idx_lebs)
+ subtract_lebs += 1;
+
+ /*
+- * The GC journal head LEB is not really accessible. And since
+- * different write types go to different heads, we may count only on
+- * one head's space.
++ * Since different write types go to different heads, we should
++ * reserve one leb for each head.
+ */
+- subtract_lebs += c->jhead_cnt - 1;
++ subtract_lebs += c->jhead_cnt;
+
+ /* We also reserve one LEB for deletions, which bypass budgeting */
+ subtract_lebs += 1;
+@@ -415,7 +414,7 @@ static int calc_dd_growth(const struct ubifs_info *c,
+ dd_growth = req->dirtied_page ? c->bi.page_budget : 0;
+
+ if (req->dirtied_ino)
+- dd_growth += c->bi.inode_budget << (req->dirtied_ino - 1);
++ dd_growth += c->bi.inode_budget * req->dirtied_ino;
+ if (req->mod_dent)
+ dd_growth += c->bi.dent_budget;
+ dd_growth += req->dirtied_ino_d;
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index 111905ddbfc2e..3b93b14e00412 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -1141,7 +1141,6 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry,
+ int err, sz_change, len = strlen(symname);
+ struct fscrypt_str disk_link;
+ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1,
+- .new_ino_d = ALIGN(len, 8),
+ .dirtied_ino = 1 };
+ struct fscrypt_name nm;
+
+@@ -1157,6 +1156,7 @@ static int ubifs_symlink(struct inode *dir, struct dentry *dentry,
+ * Budget request settings: new inode, new direntry and changing parent
+ * directory inode.
+ */
++ req.new_ino_d = ALIGN(disk_link.len - 1, 8);
+ err = ubifs_budget_space(c, &req);
+ if (err)
+ return err;
+@@ -1309,9 +1309,13 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
+ old_dentry, old_inode->i_ino, old_dir->i_ino,
+ new_dentry, new_dir->i_ino, flags);
+
+- if (unlink)
++ if (unlink) {
+ ubifs_assert(c, inode_is_locked(new_inode));
+
++ /* Budget for old inode's data when its nlink > 1. */
++ req.dirtied_ino_d = ALIGN(ubifs_inode(new_inode)->data_len, 8);
++ }
++
+ if (unlink && is_dir) {
+ err = ubifs_check_dir_empty(new_inode);
+ if (err)
+@@ -1549,6 +1553,10 @@ static int ubifs_xrename(struct inode *old_dir, struct dentry *old_dentry,
+ return err;
+ }
+
++ err = ubifs_budget_space(c, &req);
++ if (err)
++ goto out;
++
+ lock_4_inodes(old_dir, new_dir, NULL, NULL);
+
+ time = current_time(old_dir);
+@@ -1574,6 +1582,7 @@ static int ubifs_xrename(struct inode *old_dir, struct dentry *old_dentry,
+ unlock_4_inodes(old_dir, new_dir, NULL, NULL);
+ ubifs_release_budget(c, &req);
+
++out:
+ fscrypt_free_filename(&fst_nm);
+ fscrypt_free_filename(&snd_nm);
+ return err;
+diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
+index 3dbb5ac630e42..ae836e8bb2933 100644
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -1043,7 +1043,7 @@ static int ubifs_writepage(struct page *page, struct writeback_control *wbc)
+ if (page->index >= synced_i_size >> PAGE_SHIFT) {
+ err = inode->i_sb->s_op->write_inode(inode, NULL);
+ if (err)
+- goto out_unlock;
++ goto out_redirty;
+ /*
+ * The inode has been written, but the write-buffer has
+ * not been synchronized, so in case of an unclean
+@@ -1071,11 +1071,17 @@ static int ubifs_writepage(struct page *page, struct writeback_control *wbc)
+ if (i_size > synced_i_size) {
+ err = inode->i_sb->s_op->write_inode(inode, NULL);
+ if (err)
+- goto out_unlock;
++ goto out_redirty;
+ }
+
+ return do_writepage(page, len);
+-
++out_redirty:
++ /*
++ * redirty_page_for_writepage() won't call ubifs_dirty_inode() because
++ * it passes I_DIRTY_PAGES flag while calling __mark_inode_dirty(), so
++ * there is no need to do space budget for dirty inode.
++ */
++ redirty_page_for_writepage(wbc, page);
+ out_unlock:
+ unlock_page(page);
+ return err;
+diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
+index f15ac37956e7a..4665c4d7d76ac 100644
+--- a/fs/ubifs/tnc.c
++++ b/fs/ubifs/tnc.c
+@@ -279,11 +279,18 @@ static struct ubifs_znode *dirty_cow_znode(struct ubifs_info *c,
+ if (zbr->len) {
+ err = insert_old_idx(c, zbr->lnum, zbr->offs);
+ if (unlikely(err))
+- return ERR_PTR(err);
++ /*
++ * Obsolete znodes will be freed by tnc_destroy_cnext()
++ * or free_obsolete_znodes(), copied up znodes should
++ * be added back to tnc and freed by
++ * ubifs_destroy_tnc_subtree().
++ */
++ goto out;
+ err = add_idx_dirt(c, zbr->lnum, zbr->len);
+ } else
+ err = 0;
+
++out:
+ zbr->znode = zn;
+ zbr->lnum = 0;
+ zbr->offs = 0;
+@@ -3046,6 +3053,21 @@ static void tnc_destroy_cnext(struct ubifs_info *c)
+ cnext = cnext->cnext;
+ if (ubifs_zn_obsolete(znode))
+ kfree(znode);
++ else if (!ubifs_zn_cow(znode)) {
++ /*
++ * Don't forget to update clean znode count after
++ * committing failed, because ubifs will check this
++ * count while closing tnc. Non-obsolete znode could
++ * be re-dirtied during committing process, so dirty
++ * flag is untrustable. The flag 'COW_ZNODE' is set
++ * for each dirty znode before committing, and it is
++ * cleared as long as the znode become clean, so we
++ * can statistic clean znode count according to this
++ * flag.
++ */
++ atomic_long_inc(&c->clean_zn_cnt);
++ atomic_long_inc(&ubifs_clean_zn_cnt);
++ }
+ } while (cnext && cnext != c->cnext);
+ }
+
+diff --git a/fs/udf/file.c b/fs/udf/file.c
+index cd31e4f6d6da9..88b7fb8e9998c 100644
+--- a/fs/udf/file.c
++++ b/fs/udf/file.c
+@@ -148,26 +148,24 @@ static ssize_t udf_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ goto out;
+
+ down_write(&iinfo->i_data_sem);
+- if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
+- loff_t end = iocb->ki_pos + iov_iter_count(from);
+-
+- if (inode->i_sb->s_blocksize <
+- (udf_file_entry_alloc_offset(inode) + end)) {
+- err = udf_expand_file_adinicb(inode);
+- if (err) {
+- inode_unlock(inode);
+- udf_debug("udf_expand_adinicb: err=%d\n", err);
+- return err;
+- }
+- } else {
+- iinfo->i_lenAlloc = max(end, inode->i_size);
+- up_write(&iinfo->i_data_sem);
++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB &&
++ inode->i_sb->s_blocksize < (udf_file_entry_alloc_offset(inode) +
++ iocb->ki_pos + iov_iter_count(from))) {
++ err = udf_expand_file_adinicb(inode);
++ if (err) {
++ inode_unlock(inode);
++ udf_debug("udf_expand_adinicb: err=%d\n", err);
++ return err;
+ }
+ } else
+ up_write(&iinfo->i_data_sem);
+
+ retval = __generic_file_write_iter(iocb, from);
+ out:
++ down_write(&iinfo->i_data_sem);
++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB && retval > 0)
++ iinfo->i_lenAlloc = inode->i_size;
++ up_write(&iinfo->i_data_sem);
+ inode_unlock(inode);
+
+ if (retval > 0) {
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 55a86120e756f..af1180104e560 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -521,8 +521,10 @@ static int udf_do_extend_file(struct inode *inode,
+ }
+
+ if (fake) {
+- udf_add_aext(inode, last_pos, &last_ext->extLocation,
+- last_ext->extLength, 1);
++ err = udf_add_aext(inode, last_pos, &last_ext->extLocation,
++ last_ext->extLength, 1);
++ if (err < 0)
++ goto out_err;
+ count++;
+ } else {
+ struct kernel_lb_addr tmploc;
+@@ -556,7 +558,7 @@ static int udf_do_extend_file(struct inode *inode,
+ err = udf_add_aext(inode, last_pos, &last_ext->extLocation,
+ last_ext->extLength, 1);
+ if (err)
+- return err;
++ goto out_err;
+ count++;
+ }
+ if (new_block_bytes) {
+@@ -565,7 +567,7 @@ static int udf_do_extend_file(struct inode *inode,
+ err = udf_add_aext(inode, last_pos, &last_ext->extLocation,
+ last_ext->extLength, 1);
+ if (err)
+- return err;
++ goto out_err;
+ count++;
+ }
+
+@@ -579,6 +581,11 @@ out:
+ return -EIO;
+
+ return count;
++out_err:
++ /* Remove extents we've created so far */
++ udf_clear_extent_cache(inode);
++ udf_truncate_extents(inode);
++ return err;
+ }
+
+ /* Extend the final block of the file to final_block_len bytes */
+@@ -793,19 +800,17 @@ static sector_t inode_getblk(struct inode *inode, sector_t block,
+ c = 0;
+ offset = 0;
+ count += ret;
+- /* We are not covered by a preallocated extent? */
+- if ((laarr[0].extLength & UDF_EXTENT_FLAG_MASK) !=
+- EXT_NOT_RECORDED_ALLOCATED) {
+- /* Is there any real extent? - otherwise we overwrite
+- * the fake one... */
+- if (count)
+- c = !c;
+- laarr[c].extLength = EXT_NOT_RECORDED_NOT_ALLOCATED |
+- inode->i_sb->s_blocksize;
+- memset(&laarr[c].extLocation, 0x00,
+- sizeof(struct kernel_lb_addr));
+- count++;
+- }
++ /*
++ * Is there any real extent? - otherwise we overwrite the fake
++ * one...
++ */
++ if (count)
++ c = !c;
++ laarr[c].extLength = EXT_NOT_RECORDED_NOT_ALLOCATED |
++ inode->i_sb->s_blocksize;
++ memset(&laarr[c].extLocation, 0x00,
++ sizeof(struct kernel_lb_addr));
++ count++;
+ endnum = c + 1;
+ lastblock = 1;
+ } else {
+@@ -1082,23 +1087,8 @@ static void udf_merge_extents(struct inode *inode, struct kernel_long_ad *laarr,
+ blocksize - 1) >> blocksize_bits)))) {
+
+ if (((li->extLength & UDF_EXTENT_LENGTH_MASK) +
+- (lip1->extLength & UDF_EXTENT_LENGTH_MASK) +
+- blocksize - 1) & ~UDF_EXTENT_LENGTH_MASK) {
+- lip1->extLength = (lip1->extLength -
+- (li->extLength &
+- UDF_EXTENT_LENGTH_MASK) +
+- UDF_EXTENT_LENGTH_MASK) &
+- ~(blocksize - 1);
+- li->extLength = (li->extLength &
+- UDF_EXTENT_FLAG_MASK) +
+- (UDF_EXTENT_LENGTH_MASK + 1) -
+- blocksize;
+- lip1->extLocation.logicalBlockNum =
+- li->extLocation.logicalBlockNum +
+- ((li->extLength &
+- UDF_EXTENT_LENGTH_MASK) >>
+- blocksize_bits);
+- } else {
++ (lip1->extLength & UDF_EXTENT_LENGTH_MASK) +
++ blocksize - 1) <= UDF_EXTENT_LENGTH_MASK) {
+ li->extLength = lip1->extLength +
+ (((li->extLength &
+ UDF_EXTENT_LENGTH_MASK) +
+diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
+index d12e507e9eb2a..aa58173b468fb 100644
+--- a/fs/udf/udf_sb.h
++++ b/fs/udf/udf_sb.h
+@@ -57,6 +57,8 @@
+ #define MF_DUPLICATE_MD 0x01
+ #define MF_MIRROR_FE_LOADED 0x02
+
++#define EFSCORRUPTED EUCLEAN
++
+ struct udf_meta_data {
+ __u32 s_meta_file_loc;
+ __u32 s_mirror_file_loc;
+diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
+index e5f641cdab5a4..f9f85a466cb8a 100644
+--- a/include/drm/drm_connector.h
++++ b/include/drm/drm_connector.h
+@@ -329,19 +329,47 @@ struct drm_display_info {
+
+ #define DRM_BUS_FLAG_DE_LOW (1<<0)
+ #define DRM_BUS_FLAG_DE_HIGH (1<<1)
+-/* drive data on pos. edge */
++
++/*
++ * Don't use those two flags directly, use the DRM_BUS_FLAG_PIXDATA_DRIVE_*
++ * and DRM_BUS_FLAG_PIXDATA_SAMPLE_* variants to qualify the flags explicitly.
++ * The DRM_BUS_FLAG_PIXDATA_SAMPLE_* flags are defined as the opposite of the
++ * DRM_BUS_FLAG_PIXDATA_DRIVE_* flags to make code simpler, as signals are
++ * usually to be sampled on the opposite edge of the driving edge.
++ */
+ #define DRM_BUS_FLAG_PIXDATA_POSEDGE (1<<2)
+-/* drive data on neg. edge */
+ #define DRM_BUS_FLAG_PIXDATA_NEGEDGE (1<<3)
++
++/* Drive data on rising edge */
++#define DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE DRM_BUS_FLAG_PIXDATA_POSEDGE
++/* Drive data on falling edge */
++#define DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE DRM_BUS_FLAG_PIXDATA_NEGEDGE
++/* Sample data on rising edge */
++#define DRM_BUS_FLAG_PIXDATA_SAMPLE_POSEDGE DRM_BUS_FLAG_PIXDATA_NEGEDGE
++/* Sample data on falling edge */
++#define DRM_BUS_FLAG_PIXDATA_SAMPLE_NEGEDGE DRM_BUS_FLAG_PIXDATA_POSEDGE
++
+ /* data is transmitted MSB to LSB on the bus */
+ #define DRM_BUS_FLAG_DATA_MSB_TO_LSB (1<<4)
+ /* data is transmitted LSB to MSB on the bus */
+ #define DRM_BUS_FLAG_DATA_LSB_TO_MSB (1<<5)
+-/* drive sync on pos. edge */
++
++/*
++ * Similarly to the DRM_BUS_FLAG_PIXDATA_* flags, don't use these two flags
++ * directly, use one of the DRM_BUS_FLAG_SYNC_(DRIVE|SAMPLE)_* instead.
++ */
+ #define DRM_BUS_FLAG_SYNC_POSEDGE (1<<6)
+-/* drive sync on neg. edge */
+ #define DRM_BUS_FLAG_SYNC_NEGEDGE (1<<7)
+
++/* Drive sync on rising edge */
++#define DRM_BUS_FLAG_SYNC_DRIVE_POSEDGE DRM_BUS_FLAG_SYNC_POSEDGE
++/* Drive sync on falling edge */
++#define DRM_BUS_FLAG_SYNC_DRIVE_NEGEDGE DRM_BUS_FLAG_SYNC_NEGEDGE
++/* Sample sync on rising edge */
++#define DRM_BUS_FLAG_SYNC_SAMPLE_POSEDGE DRM_BUS_FLAG_SYNC_NEGEDGE
++/* Sample sync on falling edge */
++#define DRM_BUS_FLAG_SYNC_SAMPLE_NEGEDGE DRM_BUS_FLAG_SYNC_POSEDGE
++
+ /**
+ * @bus_flags: Additional information (like pixel signal polarity) for
+ * the pixel data on the bus, using DRM_BUS_FLAGS\_ defines.
+diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h
+index 4fef19064b0f1..689f615471ab1 100644
+--- a/include/drm/drm_mipi_dsi.h
++++ b/include/drm/drm_mipi_dsi.h
+@@ -274,6 +274,10 @@ int mipi_dsi_dcs_set_display_brightness(struct mipi_dsi_device *dsi,
+ u16 brightness);
+ int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi,
+ u16 *brightness);
++int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi,
++ u16 brightness);
++int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi,
++ u16 *brightness);
+
+ /**
+ * struct mipi_dsi_driver - DSI driver
+diff --git a/include/linux/ima.h b/include/linux/ima.h
+index 97914a2833d10..edd6d9195ce12 100644
+--- a/include/linux/ima.h
++++ b/include/linux/ima.h
+@@ -19,7 +19,8 @@ struct linux_binprm;
+ extern int ima_bprm_check(struct linux_binprm *bprm);
+ extern int ima_file_check(struct file *file, int mask);
+ extern void ima_file_free(struct file *file);
+-extern int ima_file_mmap(struct file *file, unsigned long prot);
++extern int ima_file_mmap(struct file *file, unsigned long reqprot,
++ unsigned long prot, unsigned long flags);
+ extern int ima_load_data(enum kernel_load_data_id id);
+ extern int ima_read_file(struct file *file, enum kernel_read_file_id id);
+ extern int ima_post_read_file(struct file *file, void *buf, loff_t size,
+@@ -46,7 +47,8 @@ static inline void ima_file_free(struct file *file)
+ return;
+ }
+
+-static inline int ima_file_mmap(struct file *file, unsigned long prot)
++static inline int ima_file_mmap(struct file *file, unsigned long reqprot,
++ unsigned long prot, unsigned long flags)
+ {
+ return 0;
+ }
+diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h
+index 7ee2bb43b251a..f7f20cf1bd3b1 100644
+--- a/include/linux/kernel_stat.h
++++ b/include/linux/kernel_stat.h
+@@ -73,7 +73,7 @@ extern unsigned int kstat_irqs_usr(unsigned int irq);
+ /*
+ * Number of interrupts per cpu, since bootup
+ */
+-static inline unsigned int kstat_cpu_irqs_sum(unsigned int cpu)
++static inline unsigned long kstat_cpu_irqs_sum(unsigned int cpu)
+ {
+ return kstat_cpu(cpu).irqs_sum;
+ }
+diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
+index 304e7a0f6b165..08875d2d5649b 100644
+--- a/include/linux/kprobes.h
++++ b/include/linux/kprobes.h
+@@ -331,6 +331,8 @@ extern int proc_kprobes_optimization_handler(struct ctl_table *table,
+ size_t *length, loff_t *ppos);
+ #endif
+ extern void wait_for_kprobe_optimizer(void);
++bool optprobe_queued_unopt(struct optimized_kprobe *op);
++bool kprobe_disarmed(struct kprobe *p);
+ #else
+ static inline void wait_for_kprobe_optimizer(void) { }
+ #endif /* CONFIG_OPTPROBES */
+diff --git a/include/uapi/linux/usb/video.h b/include/uapi/linux/usb/video.h
+index ff6cc6cb4227c..0c5087c39a9fe 100644
+--- a/include/uapi/linux/usb/video.h
++++ b/include/uapi/linux/usb/video.h
+@@ -179,6 +179,36 @@
+ #define UVC_CONTROL_CAP_AUTOUPDATE (1 << 3)
+ #define UVC_CONTROL_CAP_ASYNCHRONOUS (1 << 4)
+
++/* 3.9.2.6 Color Matching Descriptor Values */
++enum uvc_color_primaries_values {
++ UVC_COLOR_PRIMARIES_UNSPECIFIED,
++ UVC_COLOR_PRIMARIES_BT_709_SRGB,
++ UVC_COLOR_PRIMARIES_BT_470_2_M,
++ UVC_COLOR_PRIMARIES_BT_470_2_B_G,
++ UVC_COLOR_PRIMARIES_SMPTE_170M,
++ UVC_COLOR_PRIMARIES_SMPTE_240M,
++};
++
++enum uvc_transfer_characteristics_values {
++ UVC_TRANSFER_CHARACTERISTICS_UNSPECIFIED,
++ UVC_TRANSFER_CHARACTERISTICS_BT_709,
++ UVC_TRANSFER_CHARACTERISTICS_BT_470_2_M,
++ UVC_TRANSFER_CHARACTERISTICS_BT_470_2_B_G,
++ UVC_TRANSFER_CHARACTERISTICS_SMPTE_170M,
++ UVC_TRANSFER_CHARACTERISTICS_SMPTE_240M,
++ UVC_TRANSFER_CHARACTERISTICS_LINEAR,
++ UVC_TRANSFER_CHARACTERISTICS_SRGB,
++};
++
++enum uvc_matrix_coefficients {
++ UVC_MATRIX_COEFFICIENTS_UNSPECIFIED,
++ UVC_MATRIX_COEFFICIENTS_BT_709,
++ UVC_MATRIX_COEFFICIENTS_FCC,
++ UVC_MATRIX_COEFFICIENTS_BT_470_2_B_G,
++ UVC_MATRIX_COEFFICIENTS_SMPTE_170M,
++ UVC_MATRIX_COEFFICIENTS_SMPTE_240M,
++};
++
+ /* ------------------------------------------------------------------------
+ * UVC structures
+ */
+diff --git a/include/uapi/linux/uvcvideo.h b/include/uapi/linux/uvcvideo.h
+index f80f05b3c423f..2140923661934 100644
+--- a/include/uapi/linux/uvcvideo.h
++++ b/include/uapi/linux/uvcvideo.h
+@@ -86,7 +86,7 @@ struct uvc_xu_control_query {
+ * struct. The first two fields are added by the driver, they can be used for
+ * clock synchronisation. The rest is an exact copy of a UVC payload header.
+ * Only complete objects with complete buffers are included. Therefore it's
+- * always sizeof(meta->ts) + sizeof(meta->sof) + meta->length bytes large.
++ * always sizeof(meta->ns) + sizeof(meta->sof) + meta->length bytes large.
+ */
+ struct uvc_meta_buf {
+ __u64 ns;
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index 1e42fc2ad4d57..3ebe231a5eda1 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -494,6 +494,9 @@ void irq_domain_disassociate(struct irq_domain *domain, unsigned int irq)
+ return;
+
+ hwirq = irq_data->hwirq;
++
++ mutex_lock(&irq_domain_mutex);
++
+ irq_set_status_flags(irq, IRQ_NOREQUEST);
+
+ /* remove chip and handler */
+@@ -513,10 +516,12 @@ void irq_domain_disassociate(struct irq_domain *domain, unsigned int irq)
+
+ /* Clear reverse map for this hwirq */
+ irq_domain_clear_mapping(domain, hwirq);
++
++ mutex_unlock(&irq_domain_mutex);
+ }
+
+-int irq_domain_associate(struct irq_domain *domain, unsigned int virq,
+- irq_hw_number_t hwirq)
++static int irq_domain_associate_locked(struct irq_domain *domain, unsigned int virq,
++ irq_hw_number_t hwirq)
+ {
+ struct irq_data *irq_data = irq_get_irq_data(virq);
+ int ret;
+@@ -529,7 +534,6 @@ int irq_domain_associate(struct irq_domain *domain, unsigned int virq,
+ if (WARN(irq_data->domain, "error: virq%i is already associated", virq))
+ return -EINVAL;
+
+- mutex_lock(&irq_domain_mutex);
+ irq_data->hwirq = hwirq;
+ irq_data->domain = domain;
+ if (domain->ops->map) {
+@@ -546,7 +550,6 @@ int irq_domain_associate(struct irq_domain *domain, unsigned int virq,
+ }
+ irq_data->domain = NULL;
+ irq_data->hwirq = 0;
+- mutex_unlock(&irq_domain_mutex);
+ return ret;
+ }
+
+@@ -557,12 +560,23 @@ int irq_domain_associate(struct irq_domain *domain, unsigned int virq,
+
+ domain->mapcount++;
+ irq_domain_set_mapping(domain, hwirq, irq_data);
+- mutex_unlock(&irq_domain_mutex);
+
+ irq_clear_status_flags(virq, IRQ_NOREQUEST);
+
+ return 0;
+ }
++
++int irq_domain_associate(struct irq_domain *domain, unsigned int virq,
++ irq_hw_number_t hwirq)
++{
++ int ret;
++
++ mutex_lock(&irq_domain_mutex);
++ ret = irq_domain_associate_locked(domain, virq, hwirq);
++ mutex_unlock(&irq_domain_mutex);
++
++ return ret;
++}
+ EXPORT_SYMBOL_GPL(irq_domain_associate);
+
+ void irq_domain_associate_many(struct irq_domain *domain, unsigned int irq_base,
+@@ -818,13 +832,8 @@ unsigned int irq_create_fwspec_mapping(struct irq_fwspec *fwspec)
+ }
+
+ irq_data = irq_get_irq_data(virq);
+- if (!irq_data) {
+- if (irq_domain_is_hierarchy(domain))
+- irq_domain_free_irqs(virq, 1);
+- else
+- irq_dispose_mapping(virq);
++ if (WARN_ON(!irq_data))
+ return 0;
+- }
+
+ /* Store trigger type */
+ irqd_set_trigger_type(irq_data, type);
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 33aba4e2e3e39..e1fb6453e8e95 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -418,8 +418,8 @@ static inline int kprobe_optready(struct kprobe *p)
+ return 0;
+ }
+
+-/* Return true(!0) if the kprobe is disarmed. Note: p must be on hash list */
+-static inline int kprobe_disarmed(struct kprobe *p)
++/* Return true if the kprobe is disarmed. Note: p must be on hash list */
++bool kprobe_disarmed(struct kprobe *p)
+ {
+ struct optimized_kprobe *op;
+
+@@ -626,7 +626,7 @@ void wait_for_kprobe_optimizer(void)
+ mutex_unlock(&kprobe_mutex);
+ }
+
+-static bool optprobe_queued_unopt(struct optimized_kprobe *op)
++bool optprobe_queued_unopt(struct optimized_kprobe *op)
+ {
+ struct optimized_kprobe *_op;
+
+diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
+index 72770a551c24d..fa6ae9ed2e1df 100644
+--- a/kernel/rcu/tree_exp.h
++++ b/kernel/rcu/tree_exp.h
+@@ -577,7 +577,9 @@ static void synchronize_sched_expedited_wait(struct rcu_state *rsp)
+ mask = leaf_node_cpu_bit(rnp, cpu);
+ if (!(rnp->expmask & mask))
+ continue;
++ preempt_disable(); // For smp_processor_id() in dump_cpu_task().
+ dump_cpu_task(cpu);
++ preempt_enable();
+ }
+ }
+ jiffies_stall = 3 * rcu_jiffies_till_stall_check() + 3;
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index 32ee24f5142ab..8512f06f0ebef 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -1838,6 +1838,7 @@ SYSCALL_DEFINE2(nanosleep, struct __kernel_timespec __user *, rqtp,
+ if (!timespec64_valid(&tu))
+ return -EINVAL;
+
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE;
+ current->restart_block.nanosleep.rmtp = rmtp;
+ return hrtimer_nanosleep(&tu, HRTIMER_MODE_REL, CLOCK_MONOTONIC);
+@@ -1858,6 +1859,7 @@ COMPAT_SYSCALL_DEFINE2(nanosleep, struct compat_timespec __user *, rqtp,
+ if (!timespec64_valid(&tu))
+ return -EINVAL;
+
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE;
+ current->restart_block.nanosleep.compat_rmtp = rmtp;
+ return hrtimer_nanosleep(&tu, HRTIMER_MODE_REL, CLOCK_MONOTONIC);
+diff --git a/kernel/time/posix-stubs.c b/kernel/time/posix-stubs.c
+index 2c6847d5d69ba..362c159fb3f88 100644
+--- a/kernel/time/posix-stubs.c
++++ b/kernel/time/posix-stubs.c
+@@ -144,6 +144,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,
+ return -EINVAL;
+ if (flags & TIMER_ABSTIME)
+ rmtp = NULL;
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE;
+ current->restart_block.nanosleep.rmtp = rmtp;
+ return hrtimer_nanosleep(&t, flags & TIMER_ABSTIME ?
+@@ -230,6 +231,7 @@ COMPAT_SYSCALL_DEFINE4(clock_nanosleep, clockid_t, which_clock, int, flags,
+ return -EINVAL;
+ if (flags & TIMER_ABSTIME)
+ rmtp = NULL;
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE;
+ current->restart_block.nanosleep.compat_rmtp = rmtp;
+ return hrtimer_nanosleep(&t, flags & TIMER_ABSTIME ?
+diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
+index 48758108e055c..1234868b3b03e 100644
+--- a/kernel/time/posix-timers.c
++++ b/kernel/time/posix-timers.c
+@@ -1225,6 +1225,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags,
+ return -EINVAL;
+ if (flags & TIMER_ABSTIME)
+ rmtp = NULL;
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE;
+ current->restart_block.nanosleep.rmtp = rmtp;
+
+@@ -1252,6 +1253,7 @@ COMPAT_SYSCALL_DEFINE4(clock_nanosleep, clockid_t, which_clock, int, flags,
+ return -EINVAL;
+ if (flags & TIMER_ABSTIME)
+ rmtp = NULL;
++ current->restart_block.fn = do_no_restart_syscall;
+ current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE;
+ current->restart_block.nanosleep.compat_rmtp = rmtp;
+
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 5e5b0c067f611..bef3d01b8ff61 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -4685,11 +4685,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);
+ */
+ void ring_buffer_free_read_page(struct ring_buffer *buffer, int cpu, void *data)
+ {
+- struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
++ struct ring_buffer_per_cpu *cpu_buffer;
+ struct buffer_data_page *bpage = data;
+ struct page *page = virt_to_page(bpage);
+ unsigned long flags;
+
++ if (!buffer || !buffer->buffers || !buffer->buffers[cpu])
++ return;
++
++ cpu_buffer = buffer->buffers[cpu];
++
+ /* If the page is still in use someplace else, we can't reuse it */
+ if (page_ref_count(page) > 1)
+ goto out;
+diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
+index eead4b3394668..4f73db248009e 100644
+--- a/lib/mpi/mpicoder.c
++++ b/lib/mpi/mpicoder.c
+@@ -397,7 +397,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)
+
+ while (sg_miter_next(&miter)) {
+ buff = miter.addr;
+- len = miter.length;
++ len = min_t(unsigned, miter.length, nbytes);
++ nbytes -= len;
+
+ for (x = 0; x < len; x++) {
+ a <<= 8;
+diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
+index 119103bfa82ee..4bbb8683d4518 100644
+--- a/net/9p/trans_rdma.c
++++ b/net/9p/trans_rdma.c
+@@ -400,6 +400,7 @@ post_recv(struct p9_client *client, struct p9_rdma_context *c)
+ struct p9_trans_rdma *rdma = client->trans;
+ struct ib_recv_wr wr;
+ struct ib_sge sge;
++ int ret;
+
+ c->busa = ib_dma_map_single(rdma->cm_id->device,
+ c->rc.sdata, client->msize,
+@@ -417,7 +418,12 @@ post_recv(struct p9_client *client, struct p9_rdma_context *c)
+ wr.wr_cqe = &c->cqe;
+ wr.sg_list = &sge;
+ wr.num_sge = 1;
+- return ib_post_recv(rdma->qp, &wr, NULL);
++
++ ret = ib_post_recv(rdma->qp, &wr, NULL);
++ if (ret)
++ ib_dma_unmap_single(rdma->cm_id->device, c->busa,
++ client->msize, DMA_FROM_DEVICE);
++ return ret;
+
+ error:
+ p9_debug(P9_DEBUG_ERROR, "EIO\n");
+@@ -514,7 +520,7 @@ dont_need_post_recv:
+
+ if (down_interruptible(&rdma->sq_sem)) {
+ err = -EINTR;
+- goto send_error;
++ goto dma_unmap;
+ }
+
+ /* Mark request as `sent' *before* we actually send it,
+@@ -524,11 +530,14 @@ dont_need_post_recv:
+ req->status = REQ_STATUS_SENT;
+ err = ib_post_send(rdma->qp, &wr, NULL);
+ if (err)
+- goto send_error;
++ goto dma_unmap;
+
+ /* Success */
+ return 0;
+
++dma_unmap:
++ ib_dma_unmap_single(rdma->cm_id->device, c->busa,
++ c->req->tc.size, DMA_TO_DEVICE);
+ /* Handle errors that happened during or while preparing the send: */
+ send_error:
+ req->status = REQ_STATUS_ERROR;
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index 6459c2356ff9f..08b96aeaff464 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -389,19 +389,24 @@ out:
+ return ret;
+ }
+
+-static int xen_9pfs_front_probe(struct xenbus_device *dev,
+- const struct xenbus_device_id *id)
++static int xen_9pfs_front_init(struct xenbus_device *dev)
+ {
+ int ret, i;
+ struct xenbus_transaction xbt;
+- struct xen_9pfs_front_priv *priv = NULL;
+- char *versions;
++ struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
++ char *versions, *v;
+ unsigned int max_rings, max_ring_order, len = 0;
+
+ versions = xenbus_read(XBT_NIL, dev->otherend, "versions", &len);
+ if (IS_ERR(versions))
+ return PTR_ERR(versions);
+- if (strcmp(versions, "1")) {
++ for (v = versions; *v; v++) {
++ if (simple_strtoul(v, &v, 10) == 1) {
++ v = NULL;
++ break;
++ }
++ }
++ if (v) {
+ kfree(versions);
+ return -EINVAL;
+ }
+@@ -414,11 +419,6 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev,
+ if (max_ring_order < XEN_9PFS_RING_ORDER)
+ return -EINVAL;
+
+- priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+- if (!priv)
+- return -ENOMEM;
+-
+- priv->dev = dev;
+ priv->num_rings = XEN_9PFS_NUM_RINGS;
+ priv->rings = kcalloc(priv->num_rings, sizeof(*priv->rings),
+ GFP_KERNEL);
+@@ -476,23 +476,35 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev,
+ goto error;
+ }
+
+- write_lock(&xen_9pfs_lock);
+- list_add_tail(&priv->list, &xen_9pfs_devs);
+- write_unlock(&xen_9pfs_lock);
+- dev_set_drvdata(&dev->dev, priv);
+- xenbus_switch_state(dev, XenbusStateInitialised);
+-
+ return 0;
+
+ error_xenbus:
+ xenbus_transaction_end(xbt, 1);
+ xenbus_dev_fatal(dev, ret, "writing xenstore");
+ error:
+- dev_set_drvdata(&dev->dev, NULL);
+ xen_9pfs_front_free(priv);
+ return ret;
+ }
+
++static int xen_9pfs_front_probe(struct xenbus_device *dev,
++ const struct xenbus_device_id *id)
++{
++ struct xen_9pfs_front_priv *priv = NULL;
++
++ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++ if (!priv)
++ return -ENOMEM;
++
++ priv->dev = dev;
++ dev_set_drvdata(&dev->dev, priv);
++
++ write_lock(&xen_9pfs_lock);
++ list_add_tail(&priv->list, &xen_9pfs_devs);
++ write_unlock(&xen_9pfs_lock);
++
++ return 0;
++}
++
+ static int xen_9pfs_front_resume(struct xenbus_device *dev)
+ {
+ dev_warn(&dev->dev, "suspend/resume unsupported\n");
+@@ -511,6 +523,8 @@ static void xen_9pfs_front_changed(struct xenbus_device *dev,
+ break;
+
+ case XenbusStateInitWait:
++ if (!xen_9pfs_front_init(dev))
++ xenbus_switch_state(dev, XenbusStateInitialised);
+ break;
+
+ case XenbusStateConnected:
+diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
+index 3ba0c6df73ce9..6908817a5a703 100644
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -881,10 +881,6 @@ static int hci_sock_release(struct socket *sock)
+ }
+
+ sock_orphan(sk);
+-
+- skb_queue_purge(&sk->sk_receive_queue);
+- skb_queue_purge(&sk->sk_write_queue);
+-
+ release_sock(sk);
+ sock_put(sk);
+ return 0;
+@@ -1985,6 +1981,12 @@ done:
+ return err;
+ }
+
++static void hci_sock_destruct(struct sock *sk)
++{
++ skb_queue_purge(&sk->sk_receive_queue);
++ skb_queue_purge(&sk->sk_write_queue);
++}
++
+ static const struct proto_ops hci_sock_ops = {
+ .family = PF_BLUETOOTH,
+ .owner = THIS_MODULE,
+@@ -2035,6 +2037,7 @@ static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
+
+ sock->state = SS_UNCONNECTED;
+ sk->sk_state = BT_OPEN;
++ sk->sk_destruct = hci_sock_destruct;
+
+ bt_sock_link(&hci_sk_list, sk);
+ return 0;
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index fd95631205a6a..0e034925e3601 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -2517,14 +2517,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+ if (IS_ERR(skb))
+ return PTR_ERR(skb);
+
+- /* Channel lock is released before requesting new skb and then
+- * reacquired thus we need to recheck channel state.
+- */
+- if (chan->state != BT_CONNECTED) {
+- kfree_skb(skb);
+- return -ENOTCONN;
+- }
+-
+ l2cap_do_send(chan, skb);
+ return len;
+ }
+@@ -2568,14 +2560,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+ if (IS_ERR(skb))
+ return PTR_ERR(skb);
+
+- /* Channel lock is released before requesting new skb and then
+- * reacquired thus we need to recheck channel state.
+- */
+- if (chan->state != BT_CONNECTED) {
+- kfree_skb(skb);
+- return -ENOTCONN;
+- }
+-
+ l2cap_do_send(chan, skb);
+ err = len;
+ break;
+@@ -2596,14 +2580,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+ */
+ err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
+
+- /* The channel could have been closed while segmenting,
+- * check that it is still connected.
+- */
+- if (chan->state != BT_CONNECTED) {
+- __skb_queue_purge(&seg_queue);
+- err = -ENOTCONN;
+- }
+-
+ if (err)
+ break;
+
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index d938311c58a8d..1c6d01a27e0e8 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1414,6 +1414,14 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
+ if (!skb)
+ return ERR_PTR(err);
+
++ /* Channel lock is released before requesting new skb and then
++ * reacquired thus we need to recheck channel state.
++ */
++ if (chan->state != BT_CONNECTED) {
++ kfree_skb(skb);
++ return ERR_PTR(-ENOTCONN);
++ }
++
+ skb->priority = sk->sk_priority;
+
+ bt_cb(skb)->l2cap.chan = chan;
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 880b096eef8a6..b778f35965433 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2794,8 +2794,10 @@ void __dev_kfree_skb_any(struct sk_buff *skb, enum skb_free_reason reason)
+ {
+ if (in_irq() || irqs_disabled())
+ __dev_kfree_skb_irq(skb, reason);
++ else if (unlikely(reason == SKB_REASON_DROPPED))
++ kfree_skb(skb);
+ else
+- dev_kfree_skb(skb);
++ consume_skb(skb);
+ }
+ EXPORT_SYMBOL(__dev_kfree_skb_any);
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 457f619a34610..0f9085220ecf9 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -934,6 +934,7 @@ int inet_csk_listen_start(struct sock *sk, int backlog)
+ * It is OK, because this socket enters to hash table only
+ * after validation is complete.
+ */
++ err = -EADDRINUSE;
+ inet_sk_state_store(sk, TCP_LISTEN);
+ if (!sk->sk_prot->get_port(sk, inet->inet_num)) {
+ inet->inet_sport = htons(inet->inet_num);
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index d64522af9c3a8..5a272d09b8248 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -756,17 +756,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+ u32 index;
+
+ if (port) {
+- head = &hinfo->bhash[inet_bhashfn(net, port,
+- hinfo->bhash_size)];
+- tb = inet_csk(sk)->icsk_bind_hash;
+- spin_lock_bh(&head->lock);
+- if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
+- inet_ehash_nolisten(sk, NULL, NULL);
+- spin_unlock_bh(&head->lock);
+- return 0;
+- }
+- spin_unlock(&head->lock);
+- /* No definite answer... Walk to established hash table */
++ local_bh_disable();
+ ret = check_established(death_row, sk, port, NULL);
+ local_bh_enable();
+ return ret;
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 0fc238d79b03a..bae0199a943bd 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -582,6 +582,9 @@ EXPORT_SYMBOL(tcp_create_openreq_child);
+ * validation and inside tcp_v4_reqsk_send_ack(). Can we do better?
+ *
+ * We don't need to initialize tmp_opt.sack_ok as we don't use the results
++ *
++ * Note: If @fastopen is true, this can be called from process context.
++ * Otherwise, this is from BH context.
+ */
+
+ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
+@@ -734,7 +737,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
+ &tcp_rsk(req)->last_oow_ack_time))
+ req->rsk_ops->send_ack(sk, skb, req);
+ if (paws_reject)
+- __NET_INC_STATS(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
++ NET_INC_STATS(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
+ return NULL;
+ }
+
+@@ -753,7 +756,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
+ * "fourth, check the SYN bit"
+ */
+ if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
+- __TCP_INC_STATS(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
++ TCP_INC_STATS(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
+ goto embryonic_reset;
+ }
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 3a907ba7f7634..5e28be07cad88 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2047,7 +2047,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,
+
+ static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
+ {
+- u16 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate);
++ u32 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate);
+
+ if (rate == STA_STATS_RATE_INVALID)
+ return -EINVAL;
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 2850a638401d5..58bba2e2691fa 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -2056,12 +2056,15 @@ ctnetlink_create_conntrack(struct net *net,
+
+ err = nf_conntrack_hash_check_insert(ct);
+ if (err < 0)
+- goto err2;
++ goto err3;
+
+ rcu_read_unlock();
+
+ return ct;
+
++err3:
++ if (ct->master)
++ nf_ct_put(ct->master);
+ err2:
+ rcu_read_unlock();
+ err1:
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index 8953b03d5a529..2c5443ce449c3 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -1460,7 +1460,11 @@ static int nfc_se_io(struct nfc_dev *dev, u32 se_idx,
+ rc = dev->ops->se_io(dev, se_idx, apdu,
+ apdu_length, cb, cb_context);
+
++ device_unlock(&dev->dev);
++ return rc;
++
+ error:
++ kfree(cb_context);
+ device_unlock(&dev->dev);
+ return rc;
+ }
+diff --git a/net/rds/message.c b/net/rds/message.c
+index 309b54cc62ae3..29f67ad483ea6 100644
+--- a/net/rds/message.c
++++ b/net/rds/message.c
+@@ -118,7 +118,7 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs,
+ ck = &info->zcookies;
+ memset(ck, 0, sizeof(*ck));
+ WARN_ON(!rds_zcookie_add(info, cookie));
+- list_add_tail(&q->zcookie_head, &info->rs_zcookie_next);
++ list_add_tail(&info->rs_zcookie_next, &q->zcookie_head);
+
+ spin_unlock_irqrestore(&q->lock, flags);
+ /* caller invokes rds_wake_sk_sleep() */
+diff --git a/net/sched/Kconfig b/net/sched/Kconfig
+index e957413883111..4547022ed7f4e 100644
+--- a/net/sched/Kconfig
++++ b/net/sched/Kconfig
+@@ -458,17 +458,6 @@ config NET_CLS_BASIC
+ To compile this code as a module, choose M here: the
+ module will be called cls_basic.
+
+-config NET_CLS_TCINDEX
+- tristate "Traffic-Control Index (TCINDEX)"
+- select NET_CLS
+- ---help---
+- Say Y here if you want to be able to classify packets based on
+- traffic control indices. You will want this feature if you want
+- to implement Differentiated Services together with DSMARK.
+-
+- To compile this code as a module, choose M here: the
+- module will be called cls_tcindex.
+-
+ config NET_CLS_ROUTE4
+ tristate "Routing decision (ROUTE)"
+ depends on INET
+diff --git a/net/sched/Makefile b/net/sched/Makefile
+index f0403f49edcbd..5eed580cdb422 100644
+--- a/net/sched/Makefile
++++ b/net/sched/Makefile
+@@ -62,7 +62,6 @@ obj-$(CONFIG_NET_CLS_U32) += cls_u32.o
+ obj-$(CONFIG_NET_CLS_ROUTE4) += cls_route.o
+ obj-$(CONFIG_NET_CLS_FW) += cls_fw.o
+ obj-$(CONFIG_NET_CLS_RSVP) += cls_rsvp.o
+-obj-$(CONFIG_NET_CLS_TCINDEX) += cls_tcindex.o
+ obj-$(CONFIG_NET_CLS_RSVP6) += cls_rsvp6.o
+ obj-$(CONFIG_NET_CLS_BASIC) += cls_basic.o
+ obj-$(CONFIG_NET_CLS_FLOW) += cls_flow.o
+diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
+deleted file mode 100644
+index 4070197f95439..0000000000000
+--- a/net/sched/cls_tcindex.c
++++ /dev/null
+@@ -1,698 +0,0 @@
+-/*
+- * net/sched/cls_tcindex.c Packet classifier for skb->tc_index
+- *
+- * Written 1998,1999 by Werner Almesberger, EPFL ICA
+- */
+-
+-#include <linux/module.h>
+-#include <linux/types.h>
+-#include <linux/kernel.h>
+-#include <linux/skbuff.h>
+-#include <linux/errno.h>
+-#include <linux/slab.h>
+-#include <net/act_api.h>
+-#include <net/netlink.h>
+-#include <net/pkt_cls.h>
+-#include <net/sch_generic.h>
+-
+-/*
+- * Passing parameters to the root seems to be done more awkwardly than really
+- * necessary. At least, u32 doesn't seem to use such dirty hacks. To be
+- * verified. FIXME.
+- */
+-
+-#define PERFECT_HASH_THRESHOLD 64 /* use perfect hash if not bigger */
+-#define DEFAULT_HASH_SIZE 64 /* optimized for diffserv */
+-
+-
+-struct tcindex_filter_result {
+- struct tcf_exts exts;
+- struct tcf_result res;
+- struct rcu_work rwork;
+-};
+-
+-struct tcindex_filter {
+- u16 key;
+- struct tcindex_filter_result result;
+- struct tcindex_filter __rcu *next;
+- struct rcu_work rwork;
+-};
+-
+-
+-struct tcindex_data {
+- struct tcindex_filter_result *perfect; /* perfect hash; NULL if none */
+- struct tcindex_filter __rcu **h; /* imperfect hash; */
+- struct tcf_proto *tp;
+- u16 mask; /* AND key with mask */
+- u32 shift; /* shift ANDed key to the right */
+- u32 hash; /* hash table size; 0 if undefined */
+- u32 alloc_hash; /* allocated size */
+- u32 fall_through; /* 0: only classify if explicit match */
+- struct rcu_work rwork;
+-};
+-
+-static inline int tcindex_filter_is_set(struct tcindex_filter_result *r)
+-{
+- return tcf_exts_has_actions(&r->exts) || r->res.classid;
+-}
+-
+-static struct tcindex_filter_result *tcindex_lookup(struct tcindex_data *p,
+- u16 key)
+-{
+- if (p->perfect) {
+- struct tcindex_filter_result *f = p->perfect + key;
+-
+- return tcindex_filter_is_set(f) ? f : NULL;
+- } else if (p->h) {
+- struct tcindex_filter __rcu **fp;
+- struct tcindex_filter *f;
+-
+- fp = &p->h[key % p->hash];
+- for (f = rcu_dereference_bh_rtnl(*fp);
+- f;
+- fp = &f->next, f = rcu_dereference_bh_rtnl(*fp))
+- if (f->key == key)
+- return &f->result;
+- }
+-
+- return NULL;
+-}
+-
+-
+-static int tcindex_classify(struct sk_buff *skb, const struct tcf_proto *tp,
+- struct tcf_result *res)
+-{
+- struct tcindex_data *p = rcu_dereference_bh(tp->root);
+- struct tcindex_filter_result *f;
+- int key = (skb->tc_index & p->mask) >> p->shift;
+-
+- pr_debug("tcindex_classify(skb %p,tp %p,res %p),p %p\n",
+- skb, tp, res, p);
+-
+- f = tcindex_lookup(p, key);
+- if (!f) {
+- struct Qdisc *q = tcf_block_q(tp->chain->block);
+-
+- if (!p->fall_through)
+- return -1;
+- res->classid = TC_H_MAKE(TC_H_MAJ(q->handle), key);
+- res->class = 0;
+- pr_debug("alg 0x%x\n", res->classid);
+- return 0;
+- }
+- *res = f->res;
+- pr_debug("map 0x%x\n", res->classid);
+-
+- return tcf_exts_exec(skb, &f->exts, res);
+-}
+-
+-
+-static void *tcindex_get(struct tcf_proto *tp, u32 handle)
+-{
+- struct tcindex_data *p = rtnl_dereference(tp->root);
+- struct tcindex_filter_result *r;
+-
+- pr_debug("tcindex_get(tp %p,handle 0x%08x)\n", tp, handle);
+- if (p->perfect && handle >= p->alloc_hash)
+- return NULL;
+- r = tcindex_lookup(p, handle);
+- return r && tcindex_filter_is_set(r) ? r : NULL;
+-}
+-
+-static int tcindex_init(struct tcf_proto *tp)
+-{
+- struct tcindex_data *p;
+-
+- pr_debug("tcindex_init(tp %p)\n", tp);
+- p = kzalloc(sizeof(struct tcindex_data), GFP_KERNEL);
+- if (!p)
+- return -ENOMEM;
+-
+- p->mask = 0xffff;
+- p->hash = DEFAULT_HASH_SIZE;
+- p->fall_through = 1;
+-
+- rcu_assign_pointer(tp->root, p);
+- return 0;
+-}
+-
+-static void __tcindex_destroy_rexts(struct tcindex_filter_result *r)
+-{
+- tcf_exts_destroy(&r->exts);
+- tcf_exts_put_net(&r->exts);
+-}
+-
+-static void tcindex_destroy_rexts_work(struct work_struct *work)
+-{
+- struct tcindex_filter_result *r;
+-
+- r = container_of(to_rcu_work(work),
+- struct tcindex_filter_result,
+- rwork);
+- rtnl_lock();
+- __tcindex_destroy_rexts(r);
+- rtnl_unlock();
+-}
+-
+-static void __tcindex_destroy_fexts(struct tcindex_filter *f)
+-{
+- tcf_exts_destroy(&f->result.exts);
+- tcf_exts_put_net(&f->result.exts);
+- kfree(f);
+-}
+-
+-static void tcindex_destroy_fexts_work(struct work_struct *work)
+-{
+- struct tcindex_filter *f = container_of(to_rcu_work(work),
+- struct tcindex_filter,
+- rwork);
+-
+- rtnl_lock();
+- __tcindex_destroy_fexts(f);
+- rtnl_unlock();
+-}
+-
+-static int tcindex_delete(struct tcf_proto *tp, void *arg, bool *last,
+- struct netlink_ext_ack *extack)
+-{
+- struct tcindex_data *p = rtnl_dereference(tp->root);
+- struct tcindex_filter_result *r = arg;
+- struct tcindex_filter __rcu **walk;
+- struct tcindex_filter *f = NULL;
+-
+- pr_debug("tcindex_delete(tp %p,arg %p),p %p\n", tp, arg, p);
+- if (p->perfect) {
+- if (!r->res.class)
+- return -ENOENT;
+- } else {
+- int i;
+-
+- for (i = 0; i < p->hash; i++) {
+- walk = p->h + i;
+- for (f = rtnl_dereference(*walk); f;
+- walk = &f->next, f = rtnl_dereference(*walk)) {
+- if (&f->result == r)
+- goto found;
+- }
+- }
+- return -ENOENT;
+-
+-found:
+- rcu_assign_pointer(*walk, rtnl_dereference(f->next));
+- }
+- tcf_unbind_filter(tp, &r->res);
+- /* all classifiers are required to call tcf_exts_destroy() after rcu
+- * grace period, since converted-to-rcu actions are relying on that
+- * in cleanup() callback
+- */
+- if (f) {
+- if (tcf_exts_get_net(&f->result.exts))
+- tcf_queue_work(&f->rwork, tcindex_destroy_fexts_work);
+- else
+- __tcindex_destroy_fexts(f);
+- } else {
+- if (tcf_exts_get_net(&r->exts))
+- tcf_queue_work(&r->rwork, tcindex_destroy_rexts_work);
+- else
+- __tcindex_destroy_rexts(r);
+- }
+-
+- *last = false;
+- return 0;
+-}
+-
+-static void tcindex_destroy_work(struct work_struct *work)
+-{
+- struct tcindex_data *p = container_of(to_rcu_work(work),
+- struct tcindex_data,
+- rwork);
+-
+- kfree(p->perfect);
+- kfree(p->h);
+- kfree(p);
+-}
+-
+-static inline int
+-valid_perfect_hash(struct tcindex_data *p)
+-{
+- return p->hash > (p->mask >> p->shift);
+-}
+-
+-static const struct nla_policy tcindex_policy[TCA_TCINDEX_MAX + 1] = {
+- [TCA_TCINDEX_HASH] = { .type = NLA_U32 },
+- [TCA_TCINDEX_MASK] = { .type = NLA_U16 },
+- [TCA_TCINDEX_SHIFT] = { .type = NLA_U32 },
+- [TCA_TCINDEX_FALL_THROUGH] = { .type = NLA_U32 },
+- [TCA_TCINDEX_CLASSID] = { .type = NLA_U32 },
+-};
+-
+-static int tcindex_filter_result_init(struct tcindex_filter_result *r)
+-{
+- memset(r, 0, sizeof(*r));
+- return tcf_exts_init(&r->exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
+-}
+-
+-static void tcindex_partial_destroy_work(struct work_struct *work)
+-{
+- struct tcindex_data *p = container_of(to_rcu_work(work),
+- struct tcindex_data,
+- rwork);
+-
+- kfree(p->perfect);
+- kfree(p);
+-}
+-
+-static void tcindex_free_perfect_hash(struct tcindex_data *cp)
+-{
+- int i;
+-
+- for (i = 0; i < cp->hash; i++)
+- tcf_exts_destroy(&cp->perfect[i].exts);
+- kfree(cp->perfect);
+-}
+-
+-static int tcindex_alloc_perfect_hash(struct net *net, struct tcindex_data *cp)
+-{
+- int i, err = 0;
+-
+- cp->perfect = kcalloc(cp->hash, sizeof(struct tcindex_filter_result),
+- GFP_KERNEL | __GFP_NOWARN);
+- if (!cp->perfect)
+- return -ENOMEM;
+-
+- for (i = 0; i < cp->hash; i++) {
+- err = tcf_exts_init(&cp->perfect[i].exts,
+- TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
+- if (err < 0)
+- goto errout;
+-#ifdef CONFIG_NET_CLS_ACT
+- cp->perfect[i].exts.net = net;
+-#endif
+- }
+-
+- return 0;
+-
+-errout:
+- tcindex_free_perfect_hash(cp);
+- return err;
+-}
+-
+-static int
+-tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+- u32 handle, struct tcindex_data *p,
+- struct tcindex_filter_result *r, struct nlattr **tb,
+- struct nlattr *est, bool ovr, struct netlink_ext_ack *extack)
+-{
+- struct tcindex_filter_result new_filter_result, *old_r = r;
+- struct tcindex_data *cp = NULL, *oldp;
+- struct tcindex_filter *f = NULL; /* make gcc behave */
+- struct tcf_result cr = {};
+- int err, balloc = 0;
+- struct tcf_exts e;
+-
+- err = tcf_exts_init(&e, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
+- if (err < 0)
+- return err;
+- err = tcf_exts_validate(net, tp, tb, est, &e, ovr, extack);
+- if (err < 0)
+- goto errout;
+-
+- err = -ENOMEM;
+- /* tcindex_data attributes must look atomic to classifier/lookup so
+- * allocate new tcindex data and RCU assign it onto root. Keeping
+- * perfect hash and hash pointers from old data.
+- */
+- cp = kzalloc(sizeof(*cp), GFP_KERNEL);
+- if (!cp)
+- goto errout;
+-
+- cp->mask = p->mask;
+- cp->shift = p->shift;
+- cp->hash = p->hash;
+- cp->alloc_hash = p->alloc_hash;
+- cp->fall_through = p->fall_through;
+- cp->tp = tp;
+-
+- if (tb[TCA_TCINDEX_HASH])
+- cp->hash = nla_get_u32(tb[TCA_TCINDEX_HASH]);
+-
+- if (tb[TCA_TCINDEX_MASK])
+- cp->mask = nla_get_u16(tb[TCA_TCINDEX_MASK]);
+-
+- if (tb[TCA_TCINDEX_SHIFT]) {
+- cp->shift = nla_get_u32(tb[TCA_TCINDEX_SHIFT]);
+- if (cp->shift > 16) {
+- err = -EINVAL;
+- goto errout;
+- }
+- }
+- if (!cp->hash) {
+- /* Hash not specified, use perfect hash if the upper limit
+- * of the hashing index is below the threshold.
+- */
+- if ((cp->mask >> cp->shift) < PERFECT_HASH_THRESHOLD)
+- cp->hash = (cp->mask >> cp->shift) + 1;
+- else
+- cp->hash = DEFAULT_HASH_SIZE;
+- }
+-
+- if (p->perfect) {
+- int i;
+-
+- if (tcindex_alloc_perfect_hash(net, cp) < 0)
+- goto errout;
+- cp->alloc_hash = cp->hash;
+- for (i = 0; i < min(cp->hash, p->hash); i++)
+- cp->perfect[i].res = p->perfect[i].res;
+- balloc = 1;
+- }
+- cp->h = p->h;
+-
+- err = tcindex_filter_result_init(&new_filter_result);
+- if (err < 0)
+- goto errout_alloc;
+- if (old_r)
+- cr = r->res;
+-
+- err = -EBUSY;
+-
+- /* Hash already allocated, make sure that we still meet the
+- * requirements for the allocated hash.
+- */
+- if (cp->perfect) {
+- if (!valid_perfect_hash(cp) ||
+- cp->hash > cp->alloc_hash)
+- goto errout_alloc;
+- } else if (cp->h && cp->hash != cp->alloc_hash) {
+- goto errout_alloc;
+- }
+-
+- err = -EINVAL;
+- if (tb[TCA_TCINDEX_FALL_THROUGH])
+- cp->fall_through = nla_get_u32(tb[TCA_TCINDEX_FALL_THROUGH]);
+-
+- if (!cp->perfect && !cp->h)
+- cp->alloc_hash = cp->hash;
+-
+- /* Note: this could be as restrictive as if (handle & ~(mask >> shift))
+- * but then, we'd fail handles that may become valid after some future
+- * mask change. While this is extremely unlikely to ever matter,
+- * the check below is safer (and also more backwards-compatible).
+- */
+- if (cp->perfect || valid_perfect_hash(cp))
+- if (handle >= cp->alloc_hash)
+- goto errout_alloc;
+-
+-
+- err = -ENOMEM;
+- if (!cp->perfect && !cp->h) {
+- if (valid_perfect_hash(cp)) {
+- if (tcindex_alloc_perfect_hash(net, cp) < 0)
+- goto errout_alloc;
+- balloc = 1;
+- } else {
+- struct tcindex_filter __rcu **hash;
+-
+- hash = kcalloc(cp->hash,
+- sizeof(struct tcindex_filter *),
+- GFP_KERNEL);
+-
+- if (!hash)
+- goto errout_alloc;
+-
+- cp->h = hash;
+- balloc = 2;
+- }
+- }
+-
+- if (cp->perfect)
+- r = cp->perfect + handle;
+- else
+- r = tcindex_lookup(cp, handle) ? : &new_filter_result;
+-
+- if (r == &new_filter_result) {
+- f = kzalloc(sizeof(*f), GFP_KERNEL);
+- if (!f)
+- goto errout_alloc;
+- f->key = handle;
+- f->next = NULL;
+- err = tcindex_filter_result_init(&f->result);
+- if (err < 0) {
+- kfree(f);
+- goto errout_alloc;
+- }
+- }
+-
+- if (tb[TCA_TCINDEX_CLASSID]) {
+- cr.classid = nla_get_u32(tb[TCA_TCINDEX_CLASSID]);
+- tcf_bind_filter(tp, &cr, base);
+- }
+-
+- if (old_r && old_r != r) {
+- err = tcindex_filter_result_init(old_r);
+- if (err < 0) {
+- kfree(f);
+- goto errout_alloc;
+- }
+- }
+-
+- oldp = p;
+- r->res = cr;
+- tcf_exts_change(&r->exts, &e);
+-
+- rcu_assign_pointer(tp->root, cp);
+-
+- if (r == &new_filter_result) {
+- struct tcindex_filter *nfp;
+- struct tcindex_filter __rcu **fp;
+-
+- f->result.res = r->res;
+- tcf_exts_change(&f->result.exts, &r->exts);
+-
+- fp = cp->h + (handle % cp->hash);
+- for (nfp = rtnl_dereference(*fp);
+- nfp;
+- fp = &nfp->next, nfp = rtnl_dereference(*fp))
+- ; /* nothing */
+-
+- rcu_assign_pointer(*fp, f);
+- } else {
+- tcf_exts_destroy(&new_filter_result.exts);
+- }
+-
+- if (oldp)
+- tcf_queue_work(&oldp->rwork, tcindex_partial_destroy_work);
+- return 0;
+-
+-errout_alloc:
+- if (balloc == 1)
+- tcindex_free_perfect_hash(cp);
+- else if (balloc == 2)
+- kfree(cp->h);
+- tcf_exts_destroy(&new_filter_result.exts);
+-errout:
+- kfree(cp);
+- tcf_exts_destroy(&e);
+- return err;
+-}
+-
+-static int
+-tcindex_change(struct net *net, struct sk_buff *in_skb,
+- struct tcf_proto *tp, unsigned long base, u32 handle,
+- struct nlattr **tca, void **arg, bool ovr,
+- struct netlink_ext_ack *extack)
+-{
+- struct nlattr *opt = tca[TCA_OPTIONS];
+- struct nlattr *tb[TCA_TCINDEX_MAX + 1];
+- struct tcindex_data *p = rtnl_dereference(tp->root);
+- struct tcindex_filter_result *r = *arg;
+- int err;
+-
+- pr_debug("tcindex_change(tp %p,handle 0x%08x,tca %p,arg %p),opt %p,"
+- "p %p,r %p,*arg %p\n",
+- tp, handle, tca, arg, opt, p, r, arg ? *arg : NULL);
+-
+- if (!opt)
+- return 0;
+-
+- err = nla_parse_nested(tb, TCA_TCINDEX_MAX, opt, tcindex_policy, NULL);
+- if (err < 0)
+- return err;
+-
+- return tcindex_set_parms(net, tp, base, handle, p, r, tb,
+- tca[TCA_RATE], ovr, extack);
+-}
+-
+-static void tcindex_walk(struct tcf_proto *tp, struct tcf_walker *walker)
+-{
+- struct tcindex_data *p = rtnl_dereference(tp->root);
+- struct tcindex_filter *f, *next;
+- int i;
+-
+- pr_debug("tcindex_walk(tp %p,walker %p),p %p\n", tp, walker, p);
+- if (p->perfect) {
+- for (i = 0; i < p->hash; i++) {
+- if (!p->perfect[i].res.class)
+- continue;
+- if (walker->count >= walker->skip) {
+- if (walker->fn(tp, p->perfect + i, walker) < 0) {
+- walker->stop = 1;
+- return;
+- }
+- }
+- walker->count++;
+- }
+- }
+- if (!p->h)
+- return;
+- for (i = 0; i < p->hash; i++) {
+- for (f = rtnl_dereference(p->h[i]); f; f = next) {
+- next = rtnl_dereference(f->next);
+- if (walker->count >= walker->skip) {
+- if (walker->fn(tp, &f->result, walker) < 0) {
+- walker->stop = 1;
+- return;
+- }
+- }
+- walker->count++;
+- }
+- }
+-}
+-
+-static void tcindex_destroy(struct tcf_proto *tp,
+- struct netlink_ext_ack *extack)
+-{
+- struct tcindex_data *p = rtnl_dereference(tp->root);
+- int i;
+-
+- pr_debug("tcindex_destroy(tp %p),p %p\n", tp, p);
+-
+- if (p->perfect) {
+- for (i = 0; i < p->hash; i++) {
+- struct tcindex_filter_result *r = p->perfect + i;
+-
+- tcf_unbind_filter(tp, &r->res);
+- if (tcf_exts_get_net(&r->exts))
+- tcf_queue_work(&r->rwork,
+- tcindex_destroy_rexts_work);
+- else
+- __tcindex_destroy_rexts(r);
+- }
+- }
+-
+- for (i = 0; p->h && i < p->hash; i++) {
+- struct tcindex_filter *f, *next;
+- bool last;
+-
+- for (f = rtnl_dereference(p->h[i]); f; f = next) {
+- next = rtnl_dereference(f->next);
+- tcindex_delete(tp, &f->result, &last, NULL);
+- }
+- }
+-
+- tcf_queue_work(&p->rwork, tcindex_destroy_work);
+-}
+-
+-
+-static int tcindex_dump(struct net *net, struct tcf_proto *tp, void *fh,
+- struct sk_buff *skb, struct tcmsg *t)
+-{
+- struct tcindex_data *p = rtnl_dereference(tp->root);
+- struct tcindex_filter_result *r = fh;
+- struct nlattr *nest;
+-
+- pr_debug("tcindex_dump(tp %p,fh %p,skb %p,t %p),p %p,r %p\n",
+- tp, fh, skb, t, p, r);
+- pr_debug("p->perfect %p p->h %p\n", p->perfect, p->h);
+-
+- nest = nla_nest_start(skb, TCA_OPTIONS);
+- if (nest == NULL)
+- goto nla_put_failure;
+-
+- if (!fh) {
+- t->tcm_handle = ~0; /* whatever ... */
+- if (nla_put_u32(skb, TCA_TCINDEX_HASH, p->hash) ||
+- nla_put_u16(skb, TCA_TCINDEX_MASK, p->mask) ||
+- nla_put_u32(skb, TCA_TCINDEX_SHIFT, p->shift) ||
+- nla_put_u32(skb, TCA_TCINDEX_FALL_THROUGH, p->fall_through))
+- goto nla_put_failure;
+- nla_nest_end(skb, nest);
+- } else {
+- if (p->perfect) {
+- t->tcm_handle = r - p->perfect;
+- } else {
+- struct tcindex_filter *f;
+- struct tcindex_filter __rcu **fp;
+- int i;
+-
+- t->tcm_handle = 0;
+- for (i = 0; !t->tcm_handle && i < p->hash; i++) {
+- fp = &p->h[i];
+- for (f = rtnl_dereference(*fp);
+- !t->tcm_handle && f;
+- fp = &f->next, f = rtnl_dereference(*fp)) {
+- if (&f->result == r)
+- t->tcm_handle = f->key;
+- }
+- }
+- }
+- pr_debug("handle = %d\n", t->tcm_handle);
+- if (r->res.class &&
+- nla_put_u32(skb, TCA_TCINDEX_CLASSID, r->res.classid))
+- goto nla_put_failure;
+-
+- if (tcf_exts_dump(skb, &r->exts) < 0)
+- goto nla_put_failure;
+- nla_nest_end(skb, nest);
+-
+- if (tcf_exts_dump_stats(skb, &r->exts) < 0)
+- goto nla_put_failure;
+- }
+-
+- return skb->len;
+-
+-nla_put_failure:
+- nla_nest_cancel(skb, nest);
+- return -1;
+-}
+-
+-static void tcindex_bind_class(void *fh, u32 classid, unsigned long cl,
+- void *q, unsigned long base)
+-{
+- struct tcindex_filter_result *r = fh;
+-
+- if (r && r->res.classid == classid) {
+- if (cl)
+- __tcf_bind_filter(q, &r->res, base);
+- else
+- __tcf_unbind_filter(q, &r->res);
+- }
+-}
+-
+-static struct tcf_proto_ops cls_tcindex_ops __read_mostly = {
+- .kind = "tcindex",
+- .classify = tcindex_classify,
+- .init = tcindex_init,
+- .destroy = tcindex_destroy,
+- .get = tcindex_get,
+- .change = tcindex_change,
+- .delete = tcindex_delete,
+- .walk = tcindex_walk,
+- .dump = tcindex_dump,
+- .bind_class = tcindex_bind_class,
+- .owner = THIS_MODULE,
+-};
+-
+-static int __init init_tcindex(void)
+-{
+- return register_tcf_proto_ops(&cls_tcindex_ops);
+-}
+-
+-static void __exit exit_tcindex(void)
+-{
+- unregister_tcf_proto_ops(&cls_tcindex_ops);
+-}
+-
+-module_init(init_tcindex)
+-module_exit(exit_tcindex)
+-MODULE_LICENSE("GPL");
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index 9d8b106deb0b7..501c0ec503287 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -269,6 +269,15 @@ void cfg80211_conn_work(struct work_struct *work)
+ rtnl_unlock();
+ }
+
++static void cfg80211_step_auth_next(struct cfg80211_conn *conn,
++ struct cfg80211_bss *bss)
++{
++ memcpy(conn->bssid, bss->bssid, ETH_ALEN);
++ conn->params.bssid = conn->bssid;
++ conn->params.channel = bss->channel;
++ conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
++}
++
+ /* Returned bss is reference counted and must be cleaned up appropriately. */
+ static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
+ {
+@@ -286,10 +295,7 @@ static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
+ if (!bss)
+ return NULL;
+
+- memcpy(wdev->conn->bssid, bss->bssid, ETH_ALEN);
+- wdev->conn->params.bssid = wdev->conn->bssid;
+- wdev->conn->params.channel = bss->channel;
+- wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
++ cfg80211_step_auth_next(wdev->conn, bss);
+ schedule_work(&rdev->conn_work);
+
+ return bss;
+@@ -568,7 +574,12 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
+ wdev->conn->params.ssid_len = wdev->ssid_len;
+
+ /* see if we have the bss already */
+- bss = cfg80211_get_conn_bss(wdev);
++ bss = cfg80211_get_bss(wdev->wiphy, wdev->conn->params.channel,
++ wdev->conn->params.bssid,
++ wdev->conn->params.ssid,
++ wdev->conn->params.ssid_len,
++ wdev->conn_bss_type,
++ IEEE80211_PRIVACY(wdev->conn->params.privacy));
+
+ if (prev_bssid) {
+ memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN);
+@@ -579,6 +590,7 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
+ if (bss) {
+ enum nl80211_timeout_reason treason;
+
++ cfg80211_step_auth_next(wdev->conn, bss);
+ err = cfg80211_conn_do_work(wdev, &treason);
+ cfg80211_put_bss(wdev->wiphy, bss);
+ } else {
+@@ -1207,6 +1219,15 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
+ } else {
+ if (WARN_ON(connkeys))
+ return -EINVAL;
++
++ /* connect can point to wdev->wext.connect which
++ * can hold key data from a previous connection
++ */
++ connect->key = NULL;
++ connect->key_len = 0;
++ connect->key_idx = 0;
++ connect->crypto.cipher_group = 0;
++ connect->crypto.n_ciphers_pairwise = 0;
+ }
+
+ wdev->connect_keys = connkeys;
+diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
+index 2d31921fbda4a..c85aab3bd398b 100644
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -323,7 +323,9 @@ out:
+ /**
+ * ima_file_mmap - based on policy, collect/store measurement.
+ * @file: pointer to the file to be measured (May be NULL)
+- * @prot: contains the protection that will be applied by the kernel.
++ * @reqprot: protection requested by the application
++ * @prot: protection that will be applied by the kernel
++ * @flags: operational flags
+ *
+ * Measure files being mmapped executable based on the ima_must_measure()
+ * policy decision.
+@@ -331,7 +333,8 @@ out:
+ * On success return 0. On integrity appraisal error, assuming the file
+ * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
+ */
+-int ima_file_mmap(struct file *file, unsigned long prot)
++int ima_file_mmap(struct file *file, unsigned long reqprot,
++ unsigned long prot, unsigned long flags)
+ {
+ u32 secid;
+
+diff --git a/security/security.c b/security/security.c
+index fc1410550b79f..21c27424a44be 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -926,12 +926,13 @@ static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
+ int security_mmap_file(struct file *file, unsigned long prot,
+ unsigned long flags)
+ {
++ unsigned long prot_adj = mmap_prot(file, prot);
+ int ret;
+- ret = call_int_hook(mmap_file, 0, file, prot,
+- mmap_prot(file, prot), flags);
++
++ ret = call_int_hook(mmap_file, 0, file, prot, prot_adj, flags);
+ if (ret)
+ return ret;
+- return ima_file_mmap(file, prot);
++ return ima_file_mmap(file, prot, prot_adj, flags);
+ }
+
+ int security_mmap_addr(unsigned long addr)
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 23f00ba993cb7..ca8a37388d565 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -1917,7 +1917,7 @@ static int dspio_set_uint_param_no_source(struct hda_codec *codec, int mod_id,
+ static int dspio_alloc_dma_chan(struct hda_codec *codec, unsigned int *dma_chan)
+ {
+ int status = 0;
+- unsigned int size = sizeof(dma_chan);
++ unsigned int size = sizeof(*dma_chan);
+
+ codec_dbg(codec, " dspio_alloc_dma_chan() -- begin\n");
+ status = dspio_scp(codec, MASTERCONTROL, 0x20,
+diff --git a/sound/pci/ice1712/aureon.c b/sound/pci/ice1712/aureon.c
+index c9411dfff5a4d..3473f1040d92d 100644
+--- a/sound/pci/ice1712/aureon.c
++++ b/sound/pci/ice1712/aureon.c
+@@ -1906,6 +1906,7 @@ static int aureon_add_controls(struct snd_ice1712 *ice)
+ unsigned char id;
+ snd_ice1712_save_gpio_status(ice);
+ id = aureon_cs8415_get(ice, CS8415_ID);
++ snd_ice1712_restore_gpio_status(ice);
+ if (id != 0x41)
+ dev_info(ice->card->dev,
+ "No CS8415 chip. Skipping CS8415 controls.\n");
+@@ -1923,7 +1924,6 @@ static int aureon_add_controls(struct snd_ice1712 *ice)
+ kctl->id.device = ice->pcm->device;
+ }
+ }
+- snd_ice1712_restore_gpio_status(ice);
+ }
+
+ return 0;
+diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c
+index 255cc45905b81..51f75523b691a 100644
+--- a/sound/soc/kirkwood/kirkwood-dma.c
++++ b/sound/soc/kirkwood/kirkwood-dma.c
+@@ -90,7 +90,7 @@ kirkwood_dma_conf_mbus_windows(void __iomem *base, int win,
+
+ /* try to find matching cs for current dma address */
+ for (i = 0; i < dram->num_cs; i++) {
+- const struct mbus_dram_window *cs = dram->cs + i;
++ const struct mbus_dram_window *cs = &dram->cs[i];
+ if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) {
+ writel(cs->base & 0xffff0000,
+ base + KIRKWOOD_AUDIO_WIN_BASE_REG(win));
+diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
+index 409d082e80d15..7745a3e9044f3 100644
+--- a/sound/soc/soc-compress.c
++++ b/sound/soc/soc-compress.c
+@@ -944,7 +944,7 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num)
+ rtd->fe_compr = 1;
+ if (rtd->dai_link->dpcm_playback)
+ be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd;
+- else if (rtd->dai_link->dpcm_capture)
++ if (rtd->dai_link->dpcm_capture)
+ be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd;
+ memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops));
+ } else {
+diff --git a/tools/iio/iio_utils.c b/tools/iio/iio_utils.c
+index d60a252577f0b..d174487b2f226 100644
+--- a/tools/iio/iio_utils.c
++++ b/tools/iio/iio_utils.c
+@@ -265,6 +265,7 @@ int iioutils_get_param_float(float *output, const char *param_name,
+ if (fscanf(sysfsfp, "%f", output) != 1)
+ ret = errno ? -errno : -ENODATA;
+
++ fclose(sysfsfp);
+ break;
+ }
+ error_free_filename:
+@@ -345,9 +346,9 @@ int build_channel_array(const char *device_dir,
+ }
+
+ sysfsfp = fopen(filename, "r");
++ free(filename);
+ if (!sysfsfp) {
+ ret = -errno;
+- free(filename);
+ goto error_close_dir;
+ }
+
+@@ -357,7 +358,6 @@ int build_channel_array(const char *device_dir,
+ if (fclose(sysfsfp))
+ perror("build_channel_array(): Failed to close file");
+
+- free(filename);
+ goto error_close_dir;
+ }
+ if (ret == 1)
+@@ -365,11 +365,9 @@ int build_channel_array(const char *device_dir,
+
+ if (fclose(sysfsfp)) {
+ ret = -errno;
+- free(filename);
+ goto error_close_dir;
+ }
+
+- free(filename);
+ }
+
+ *ci_array = malloc(sizeof(**ci_array) * (*counter));
+@@ -395,9 +393,9 @@ int build_channel_array(const char *device_dir,
+ }
+
+ sysfsfp = fopen(filename, "r");
++ free(filename);
+ if (!sysfsfp) {
+ ret = -errno;
+- free(filename);
+ count--;
+ goto error_cleanup_array;
+ }
+@@ -405,20 +403,17 @@ int build_channel_array(const char *device_dir,
+ errno = 0;
+ if (fscanf(sysfsfp, "%i", ¤t_enabled) != 1) {
+ ret = errno ? -errno : -ENODATA;
+- free(filename);
+ count--;
+ goto error_cleanup_array;
+ }
+
+ if (fclose(sysfsfp)) {
+ ret = -errno;
+- free(filename);
+ count--;
+ goto error_cleanup_array;
+ }
+
+ if (!current_enabled) {
+- free(filename);
+ count--;
+ continue;
+ }
+@@ -429,7 +424,6 @@ int build_channel_array(const char *device_dir,
+ strlen(ent->d_name) -
+ strlen("_en"));
+ if (!current->name) {
+- free(filename);
+ ret = -ENOMEM;
+ count--;
+ goto error_cleanup_array;
+@@ -439,7 +433,6 @@ int build_channel_array(const char *device_dir,
+ ret = iioutils_break_up_name(current->name,
+ ¤t->generic_name);
+ if (ret) {
+- free(filename);
+ free(current->name);
+ count--;
+ goto error_cleanup_array;
+@@ -450,17 +443,16 @@ int build_channel_array(const char *device_dir,
+ scan_el_dir,
+ current->name);
+ if (ret < 0) {
+- free(filename);
+ ret = -ENOMEM;
+ goto error_cleanup_array;
+ }
+
+ sysfsfp = fopen(filename, "r");
++ free(filename);
+ if (!sysfsfp) {
+ ret = -errno;
+- fprintf(stderr, "failed to open %s\n",
+- filename);
+- free(filename);
++ fprintf(stderr, "failed to open %s/%s_index\n",
++ scan_el_dir, current->name);
+ goto error_cleanup_array;
+ }
+
+@@ -470,17 +462,14 @@ int build_channel_array(const char *device_dir,
+ if (fclose(sysfsfp))
+ perror("build_channel_array(): Failed to close file");
+
+- free(filename);
+ goto error_cleanup_array;
+ }
+
+ if (fclose(sysfsfp)) {
+ ret = -errno;
+- free(filename);
+ goto error_cleanup_array;
+ }
+
+- free(filename);
+ /* Find the scale */
+ ret = iioutils_get_param_float(¤t->scale,
+ "scale",
+diff --git a/tools/lib/bpf/nlattr.c b/tools/lib/bpf/nlattr.c
+index 4719434278b20..ac979b4290559 100644
+--- a/tools/lib/bpf/nlattr.c
++++ b/tools/lib/bpf/nlattr.c
+@@ -170,7 +170,7 @@ int nla_dump_errormsg(struct nlmsghdr *nlh)
+ hlen += nlmsg_len(&err->msg);
+
+ attr = (struct nlattr *) ((void *) err + hlen);
+- alen = nlh->nlmsg_len - hlen;
++ alen = (void *)nlh + nlh->nlmsg_len - (void *)attr;
+
+ if (nla_parse(tb, NLMSGERR_ATTR_MAX, attr, alen, extack_policy) != 0) {
+ fprintf(stderr,
+diff --git a/tools/perf/perf-completion.sh b/tools/perf/perf-completion.sh
+index fdf75d45efff7..978249d7868c2 100644
+--- a/tools/perf/perf-completion.sh
++++ b/tools/perf/perf-completion.sh
+@@ -165,7 +165,12 @@ __perf_main ()
+
+ local cur1=${COMP_WORDS[COMP_CWORD]}
+ local raw_evts=$($cmd list --raw-dump)
+- local arr s tmp result
++ local arr s tmp result cpu_evts
++
++ # aarch64 doesn't have /sys/bus/event_source/devices/cpu/events
++ if [[ `uname -m` != aarch64 ]]; then
++ cpu_evts=$(ls /sys/bus/event_source/devices/cpu/events)
++ fi
+
+ if [[ "$cur1" == */* && ${cur1#*/} =~ ^[A-Z] ]]; then
+ OLD_IFS="$IFS"
+@@ -183,9 +188,9 @@ __perf_main ()
+ fi
+ done
+
+- evts=${result}" "$(ls /sys/bus/event_source/devices/cpu/events)
++ evts=${result}" "${cpu_evts}
+ else
+- evts=${raw_evts}" "$(ls /sys/bus/event_source/devices/cpu/events)
++ evts=${raw_evts}" "${cpu_evts}
+ fi
+
+ if [[ "$cur1" == , ]]; then
+diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c
+index 46ec9a1bb94cc..1ff4788bcb4e5 100644
+--- a/tools/perf/util/llvm-utils.c
++++ b/tools/perf/util/llvm-utils.c
+@@ -521,14 +521,37 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
+
+ pr_debug("llvm compiling command template: %s\n", template);
+
++ /*
++ * Below, substitute control characters for values that can cause the
++ * echo to misbehave, then substitute the values back.
++ */
+ err = -ENOMEM;
+- if (asprintf(&command_echo, "echo -n \"%s\"", template) < 0)
++ if (asprintf(&command_echo, "echo -n \a%s\a", template) < 0)
+ goto errout;
+
++#define SWAP_CHAR(a, b) do { if (*p == a) *p = b; } while (0)
++ for (char *p = command_echo; *p; p++) {
++ SWAP_CHAR('<', '\001');
++ SWAP_CHAR('>', '\002');
++ SWAP_CHAR('"', '\003');
++ SWAP_CHAR('\'', '\004');
++ SWAP_CHAR('|', '\005');
++ SWAP_CHAR('&', '\006');
++ SWAP_CHAR('\a', '"');
++ }
+ err = read_from_pipe(command_echo, (void **) &command_out, NULL);
+ if (err)
+ goto errout;
+
++ for (char *p = command_out; *p; p++) {
++ SWAP_CHAR('\001', '<');
++ SWAP_CHAR('\002', '>');
++ SWAP_CHAR('\003', '"');
++ SWAP_CHAR('\004', '\'');
++ SWAP_CHAR('\005', '|');
++ SWAP_CHAR('\006', '&');
++ }
++#undef SWAP_CHAR
+ pr_debug("llvm compiling command : %s\n", command_out);
+
+ err = read_from_pipe(template, &obj_buf, &obj_buf_sz);
+diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
+index a0b53309c5d8f..128a7fe45a1e3 100755
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -172,6 +172,7 @@ my $store_failures;
+ my $store_successes;
+ my $test_name;
+ my $timeout;
++my $run_timeout;
+ my $connect_timeout;
+ my $config_bisect_exec;
+ my $booted_timeout;
+@@ -330,6 +331,7 @@ my %option_map = (
+ "STORE_SUCCESSES" => \$store_successes,
+ "TEST_NAME" => \$test_name,
+ "TIMEOUT" => \$timeout,
++ "RUN_TIMEOUT" => \$run_timeout,
+ "CONNECT_TIMEOUT" => \$connect_timeout,
+ "CONFIG_BISECT_EXEC" => \$config_bisect_exec,
+ "BOOTED_TIMEOUT" => \$booted_timeout,
+@@ -1419,7 +1421,8 @@ sub reboot {
+
+ # Still need to wait for the reboot to finish
+ wait_for_monitor($time, $reboot_success_line);
+-
++ }
++ if ($powercycle || $time) {
+ end_monitor;
+ }
+ }
+@@ -1749,6 +1752,14 @@ sub run_command {
+ $command =~ s/\$SSH_USER/$ssh_user/g;
+ $command =~ s/\$MACHINE/$machine/g;
+
++ if (!defined($timeout)) {
++ $timeout = $run_timeout;
++ }
++
++ if (!defined($timeout)) {
++ $timeout = -1; # tell wait_for_input to wait indefinitely
++ }
++
+ doprint("$command ... ");
+ $start_time = time;
+
+@@ -1777,13 +1788,10 @@ sub run_command {
+
+ while (1) {
+ my $fp = \*CMD;
+- if (defined($timeout)) {
+- doprint "timeout = $timeout\n";
+- }
+ my $line = wait_for_input($fp, $timeout);
+ if (!defined($line)) {
+ my $now = time;
+- if (defined($timeout) && (($now - $start_time) >= $timeout)) {
++ if ($timeout >= 0 && (($now - $start_time) >= $timeout)) {
+ doprint "Hit timeout of $timeout, killing process\n";
+ $hit_timeout = 1;
+ kill 9, $pid;
+@@ -1988,6 +1996,11 @@ sub wait_for_input
+ $time = $timeout;
+ }
+
++ if ($time < 0) {
++ # Negative number means wait indefinitely
++ undef $time;
++ }
++
+ $rin = '';
+ vec($rin, fileno($fp), 1) = 1;
+ vec($rin, fileno(\*STDIN), 1) = 1;
+@@ -4243,6 +4256,9 @@ sub send_email {
+ }
+
+ sub cancel_test {
++ if ($monitor_cnt) {
++ end_monitor;
++ }
+ if ($email_when_canceled) {
+ send_email("KTEST: Your [$test_type] test was cancelled",
+ "Your test started at $script_start_time was cancelled: sig int");
+diff --git a/tools/testing/ktest/sample.conf b/tools/testing/ktest/sample.conf
+index 6ca6ca0ce695a..b487e34bbf45b 100644
+--- a/tools/testing/ktest/sample.conf
++++ b/tools/testing/ktest/sample.conf
+@@ -775,6 +775,11 @@
+ # is issued instead of a reboot.
+ # CONNECT_TIMEOUT = 25
+
++# The timeout in seconds for how long to wait for any running command
++# to timeout. If not defined, it will let it go indefinitely.
++# (default undefined)
++#RUN_TIMEOUT = 600
++
+ # In between tests, a reboot of the box may occur, and this
+ # is the time to wait for the console after it stops producing
+ # output. Some machines may not produce a large lag on reboot
+diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
+index 79d614f1fe8e4..d620223a3f0f6 100644
+--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
+@@ -49,7 +49,7 @@ test_event_enabled() {
+
+ while [ $check_times -ne 0 ]; do
+ e=`cat $EVENT_ENABLE`
+- if [ "$e" == $val ]; then
++ if [ "$e" = $val ]; then
+ return 0
+ fi
+ sleep $SLEEP_TIME
+diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
+index a5ba149761bf9..f34e14e34d0d4 100755
+--- a/tools/testing/selftests/net/fib_tests.sh
++++ b/tools/testing/selftests/net/fib_tests.sh
+@@ -1379,6 +1379,8 @@ EOF
+ ################################################################################
+ # main
+
++trap cleanup EXIT
++
+ while getopts :t:pPhv o
+ do
+ case $o in
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-03-13 11:35 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2023-03-13 11:35 UTC (permalink / raw
To: gentoo-commits
commit: bded971e6822d8a0004ead76364115084dd49f11
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 13 10:46:18 2023 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Mon Mar 13 10:46:18 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bded971e
Linux patch 4.19.277
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 ++
1276_linux-4.19.277.patch | 104 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 108 insertions(+)
diff --git a/0000_README b/0000_README
index c7c15e36..217fc5fd 100644
--- a/0000_README
+++ b/0000_README
@@ -1147,6 +1147,10 @@ Patch: 1275_linux-4.19.276.patch
From: https://www.kernel.org
Desc: Linux 4.19.276
+Patch: 1276_linux-4.19.277.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.277
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1276_linux-4.19.277.patch b/1276_linux-4.19.277.patch
new file mode 100644
index 00000000..8ebb4fbb
--- /dev/null
+++ b/1276_linux-4.19.277.patch
@@ -0,0 +1,104 @@
+diff --git a/Makefile b/Makefile
+index 7f6669dae46b9..e00f4bbcd737c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 276
++SUBLEVEL = 277
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_dm.c b/drivers/staging/rtl8192e/rtl8192e/rtl_dm.c
+index 9bf95bd0ad13f..ca2113823387a 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_dm.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_dm.c
+@@ -193,7 +193,6 @@ static void _rtl92e_dm_init_fsync(struct net_device *dev);
+ static void _rtl92e_dm_deinit_fsync(struct net_device *dev);
+
+ static void _rtl92e_dm_check_txrateandretrycount(struct net_device *dev);
+-static void _rtl92e_dm_check_ac_dc_power(struct net_device *dev);
+ static void _rtl92e_dm_check_fsync(struct net_device *dev);
+ static void _rtl92e_dm_check_rf_ctrl_gpio(void *data);
+ static void _rtl92e_dm_fsync_timer_callback(struct timer_list *t);
+@@ -246,8 +245,6 @@ void rtl92e_dm_watchdog(struct net_device *dev)
+ if (priv->being_init_adapter)
+ return;
+
+- _rtl92e_dm_check_ac_dc_power(dev);
+-
+ _rtl92e_dm_check_txrateandretrycount(dev);
+ _rtl92e_dm_check_edca_turbo(dev);
+
+@@ -265,30 +262,6 @@ void rtl92e_dm_watchdog(struct net_device *dev)
+ _rtl92e_dm_cts_to_self(dev);
+ }
+
+-static void _rtl92e_dm_check_ac_dc_power(struct net_device *dev)
+-{
+- struct r8192_priv *priv = rtllib_priv(dev);
+- static char const ac_dc_script[] = "/etc/acpi/wireless-rtl-ac-dc-power.sh";
+- char *argv[] = {(char *)ac_dc_script, DRV_NAME, NULL};
+- static char *envp[] = {"HOME=/",
+- "TERM=linux",
+- "PATH=/usr/bin:/bin",
+- NULL};
+-
+- if (priv->ResetProgress == RESET_TYPE_SILENT) {
+- RT_TRACE((COMP_INIT | COMP_POWER | COMP_RF),
+- "GPIOChangeRFWorkItemCallBack(): Silent Reset!!!!!!!\n");
+- return;
+- }
+-
+- if (priv->rtllib->state != RTLLIB_LINKED)
+- return;
+- call_usermodehelper(ac_dc_script, argv, envp, UMH_WAIT_PROC);
+-
+- return;
+-};
+-
+-
+ void rtl92e_init_adaptive_rate(struct net_device *dev)
+ {
+
+@@ -1809,10 +1782,6 @@ static void _rtl92e_dm_check_rf_ctrl_gpio(void *data)
+ u8 tmp1byte;
+ enum rt_rf_power_state eRfPowerStateToSet;
+ bool bActuallySet = false;
+- char *argv[3];
+- static char const RadioPowerPath[] = "/etc/acpi/events/RadioPower.sh";
+- static char *envp[] = {"HOME=/", "TERM=linux", "PATH=/usr/bin:/bin",
+- NULL};
+
+ bActuallySet = false;
+
+@@ -1844,14 +1813,6 @@ static void _rtl92e_dm_check_rf_ctrl_gpio(void *data)
+ mdelay(1000);
+ priv->bHwRfOffAction = 1;
+ rtl92e_set_rf_state(dev, eRfPowerStateToSet, RF_CHANGE_BY_HW);
+- if (priv->bHwRadioOff)
+- argv[1] = "RFOFF";
+- else
+- argv[1] = "RFON";
+-
+- argv[0] = (char *)RadioPowerPath;
+- argv[2] = NULL;
+- call_usermodehelper(RadioPowerPath, argv, envp, UMH_WAIT_PROC);
+ }
+ }
+
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index 501c0ec503287..ebc73faa8fb18 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -1226,8 +1226,6 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
+ connect->key = NULL;
+ connect->key_len = 0;
+ connect->key_idx = 0;
+- connect->crypto.cipher_group = 0;
+- connect->crypto.n_ciphers_pairwise = 0;
+ }
+
+ wdev->connect_keys = connkeys;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-03-17 10:46 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-03-17 10:46 UTC (permalink / raw
To: gentoo-commits
commit: 528ea2240ee8582f8fa0ec2509721622f9150555
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Mar 17 10:46:33 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Mar 17 10:46:33 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=528ea224
Linux patch 4.19.278
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1277_linux-4.19.278.patch | 840 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 844 insertions(+)
diff --git a/0000_README b/0000_README
index 217fc5fd..1f79849a 100644
--- a/0000_README
+++ b/0000_README
@@ -1151,6 +1151,10 @@ Patch: 1276_linux-4.19.277.patch
From: https://www.kernel.org
Desc: Linux 4.19.277
+Patch: 1277_linux-4.19.278.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.278
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1277_linux-4.19.278.patch b/1277_linux-4.19.278.patch
new file mode 100644
index 00000000..63a633f5
--- /dev/null
+++ b/1277_linux-4.19.278.patch
@@ -0,0 +1,840 @@
+diff --git a/Makefile b/Makefile
+index e00f4bbcd737c..a8104c8024a4d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 277
++SUBLEVEL = 278
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
+index 47632fa8c24e0..b169dc9a9ac17 100644
+--- a/arch/alpha/kernel/module.c
++++ b/arch/alpha/kernel/module.c
+@@ -158,10 +158,8 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
+ base = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr;
+ symtab = (Elf64_Sym *)sechdrs[symindex].sh_addr;
+
+- /* The small sections were sorted to the end of the segment.
+- The following should definitely cover them. */
+- gp = (u64)me->core_layout.base + me->core_layout.size - 0x8000;
+ got = sechdrs[me->arch.gotsecindex].sh_addr;
++ gp = got + 0x8000;
+
+ for (i = 0; i < n; i++) {
+ unsigned long r_sym = ELF64_R_SYM (rela[i].r_info);
+diff --git a/arch/mips/include/asm/mach-rc32434/pci.h b/arch/mips/include/asm/mach-rc32434/pci.h
+index 6f40d1515580b..1ff8a987025c8 100644
+--- a/arch/mips/include/asm/mach-rc32434/pci.h
++++ b/arch/mips/include/asm/mach-rc32434/pci.h
+@@ -377,7 +377,7 @@ struct pci_msu {
+ PCI_CFG04_STAT_SSE | \
+ PCI_CFG04_STAT_PE)
+
+-#define KORINA_CNFG1 ((KORINA_STAT<<16)|KORINA_CMD)
++#define KORINA_CNFG1 (KORINA_STAT | KORINA_CMD)
+
+ #define KORINA_REVID 0
+ #define KORINA_CLASS_CODE 0
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index e017f64e09d60..c8979f8cbce54 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -199,6 +199,15 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
+ return;
+ }
+ #endif
++ /*
++ * Work around Erratum 1386. The XSAVES instruction malfunctions in
++ * certain circumstances on Zen1/2 uarch, and not all parts have had
++ * updated microcode at the time of writing (March 2023).
++ *
++ * Affected parts all have no supervisor XSAVE states, meaning that
++ * the XSAVEC instruction (which works fine) is equivalent.
++ */
++ clear_cpu_cap(c, X86_FEATURE_XSAVES);
+ }
+
+ static void init_amd_k7(struct cpuinfo_x86 *c)
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 3b8218dd9bb14..979d130b24c42 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -1083,7 +1083,7 @@ int intel_ring_pin(struct intel_ring *ring,
+ if (unlikely(ret))
+ return ret;
+
+- if (i915_vma_is_map_and_fenceable(vma))
++ if (i915_vma_is_map_and_fenceable(vma) && !HAS_LLC(vma->vm->i915))
+ addr = (void __force *)i915_vma_pin_iomap(vma);
+ else
+ addr = i915_gem_object_pin_map(vma->obj, map);
+@@ -1118,7 +1118,7 @@ void intel_ring_unpin(struct intel_ring *ring)
+ /* Discard any unused bytes beyond that submitted to hw. */
+ intel_ring_reset(ring, ring->tail);
+
+- if (i915_vma_is_map_and_fenceable(ring->vma))
++ if (i915_vma_is_map_and_fenceable(ring->vma) && !HAS_LLC(ring->vma->vm->i915))
+ i915_vma_unpin_iomap(ring->vma);
+ else
+ i915_gem_object_unpin_map(ring->vma->obj);
+diff --git a/drivers/macintosh/windfarm_lm75_sensor.c b/drivers/macintosh/windfarm_lm75_sensor.c
+index f48ad2445ed60..f5b1ac8347db7 100644
+--- a/drivers/macintosh/windfarm_lm75_sensor.c
++++ b/drivers/macintosh/windfarm_lm75_sensor.c
+@@ -35,8 +35,8 @@
+ #endif
+
+ struct wf_lm75_sensor {
+- int ds1775 : 1;
+- int inited : 1;
++ unsigned int ds1775 : 1;
++ unsigned int inited : 1;
+ struct i2c_client *i2c;
+ struct wf_sensor sens;
+ };
+diff --git a/drivers/macintosh/windfarm_smu_sensors.c b/drivers/macintosh/windfarm_smu_sensors.c
+index 172fd267dcf60..0f4017a8189e5 100644
+--- a/drivers/macintosh/windfarm_smu_sensors.c
++++ b/drivers/macintosh/windfarm_smu_sensors.c
+@@ -275,8 +275,8 @@ struct smu_cpu_power_sensor {
+ struct list_head link;
+ struct wf_sensor *volts;
+ struct wf_sensor *amps;
+- int fake_volts : 1;
+- int quadratic : 1;
++ unsigned int fake_volts : 1;
++ unsigned int quadratic : 1;
+ struct wf_sensor sens;
+ };
+ #define to_smu_cpu_power(c) container_of(c, struct smu_cpu_power_sensor, sens)
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index aa9c0b7ee7a22..31b26b18e5251 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -2447,7 +2447,7 @@ static int ov5640_init_controls(struct ov5640_dev *sensor)
+ /* Auto/manual gain */
+ ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_AUTOGAIN,
+ 0, 1, 1, 1);
+- ctrls->gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_GAIN,
++ ctrls->gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_ANALOGUE_GAIN,
+ 0, 1023, 1, 0);
+
+ ctrls->saturation = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_SATURATION,
+diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
+index 7f143387b9ffc..64d16b195fc0a 100644
+--- a/drivers/nfc/fdp/i2c.c
++++ b/drivers/nfc/fdp/i2c.c
+@@ -263,6 +263,9 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev,
+ len, sizeof(**fw_vsc_cfg),
+ GFP_KERNEL);
+
++ if (!*fw_vsc_cfg)
++ goto alloc_err;
++
+ r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME,
+ *fw_vsc_cfg, len);
+
+@@ -276,6 +279,7 @@ vsc_read_err:
+ *fw_vsc_cfg = NULL;
+ }
+
++alloc_err:
+ dev_dbg(dev, "Clock type: %d, clock frequency: %d, VSC: %s",
+ *clock_type, *clock_freq, *fw_vsc_cfg != NULL ? "yes" : "no");
+ }
+diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
+index b3d6ea92b4f7c..2ffc2e15d822b 100644
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -178,6 +178,7 @@ void scsi_remove_host(struct Scsi_Host *shost)
+ scsi_forget_host(shost);
+ mutex_unlock(&shost->scan_mutex);
+ scsi_proc_host_rm(shost);
++ scsi_proc_hostdir_rm(shost->hostt);
+
+ spin_lock_irqsave(shost->host_lock, flags);
+ if (scsi_host_set_state(shost, SHOST_DEL))
+@@ -329,6 +330,7 @@ static void scsi_host_dev_release(struct device *dev)
+ struct Scsi_Host *shost = dev_to_shost(dev);
+ struct device *parent = dev->parent;
+
++ /* In case scsi_remove_host() has not been called. */
+ scsi_proc_hostdir_rm(shost->hostt);
+
+ /* Wait for functions invoked through call_rcu(&shost->rcu, ...) */
+diff --git a/drivers/staging/mt7621-spi/spi-mt7621.c b/drivers/staging/mt7621-spi/spi-mt7621.c
+index b73823830e3a7..75ed48f60c8c7 100644
+--- a/drivers/staging/mt7621-spi/spi-mt7621.c
++++ b/drivers/staging/mt7621-spi/spi-mt7621.c
+@@ -442,9 +442,11 @@ static int mt7621_spi_probe(struct platform_device *pdev)
+ return PTR_ERR(base);
+
+ clk = devm_clk_get(&pdev->dev, NULL);
+- if (IS_ERR(clk))
+- return dev_err_probe(&pdev->dev, PTR_ERR(clk),
+- "unable to get SYS clock\n");
++ if (IS_ERR(clk)) {
++ dev_err(&pdev->dev, "unable to get SYS clock, err=%d\n",
++ status);
++ return PTR_ERR(clk);
++ }
+
+ status = clk_prepare_enable(clk);
+ if (status)
+diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c
+index 6f3f245f3a803..6b52ace1463c2 100644
+--- a/fs/ext4/fsmap.c
++++ b/fs/ext4/fsmap.c
+@@ -486,6 +486,8 @@ static int ext4_getfsmap_datadev(struct super_block *sb,
+ keys[0].fmr_physical = bofs;
+ if (keys[1].fmr_physical >= eofs)
+ keys[1].fmr_physical = eofs - 1;
++ if (keys[1].fmr_physical < keys[0].fmr_physical)
++ return 0;
+ start_fsb = keys[0].fmr_physical;
+ end_fsb = keys[1].fmr_physical;
+
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index b1c6b9398eef5..07bb69cd20236 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -157,7 +157,6 @@ int ext4_find_inline_data_nolock(struct inode *inode)
+ (void *)ext4_raw_inode(&is.iloc));
+ EXT4_I(inode)->i_inline_size = EXT4_MIN_INLINE_DATA_SIZE +
+ le32_to_cpu(is.s.here->e_value_size);
+- ext4_set_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
+ }
+ out:
+ brelse(is.iloc.bh);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 3c7bbdaa425a7..6e7989b04d2bf 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4865,8 +4865,13 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
+
+ if (EXT4_INODE_HAS_XATTR_SPACE(inode) &&
+ *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
++ int err;
++
+ ext4_set_inode_state(inode, EXT4_STATE_XATTR);
+- return ext4_find_inline_data_nolock(inode);
++ err = ext4_find_inline_data_nolock(inode);
++ if (!err && ext4_has_inline_data(inode))
++ ext4_set_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
++ return err;
+ } else
+ EXT4_I(inode)->i_inline_off = 0;
+ return 0;
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index fd0353017d897..b930e8d559d41 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -178,6 +178,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ ei_bl->i_flags = 0;
+ inode_set_iversion(inode_bl, 1);
+ i_size_write(inode_bl, 0);
++ EXT4_I(inode_bl)->i_disksize = inode_bl->i_size;
+ inode_bl->i_mode = S_IFREG;
+ if (ext4_has_feature_extents(sb)) {
+ ext4_set_inode_flag(inode_bl, EXT4_INODE_EXTENTS);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 2c68591102bd4..db9bba3473b57 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1419,11 +1419,10 @@ static struct buffer_head *__ext4_find_entry(struct inode *dir,
+ int has_inline_data = 1;
+ ret = ext4_find_inline_entry(dir, fname, res_dir,
+ &has_inline_data);
+- if (has_inline_data) {
+- if (inlined)
+- *inlined = 1;
++ if (inlined)
++ *inlined = has_inline_data;
++ if (has_inline_data)
+ goto cleanup_and_exit;
+- }
+ }
+
+ if ((namelen <= 2) && (name[0] == '.') &&
+@@ -3515,7 +3514,8 @@ static void ext4_resetent(handle_t *handle, struct ext4_renament *ent,
+ * so the old->de may no longer valid and need to find it again
+ * before reset old inode info.
+ */
+- old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, NULL);
++ old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de,
++ &old.inlined);
+ if (IS_ERR(old.bh))
+ retval = PTR_ERR(old.bh);
+ if (!old.bh)
+@@ -3677,7 +3677,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ return retval;
+ }
+
+- old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, NULL);
++ old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de,
++ &old.inlined);
+ if (IS_ERR(old.bh))
+ return PTR_ERR(old.bh);
+ /*
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 23334cfeac552..2a70b7556e419 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -2823,6 +2823,9 @@ shift:
+ (void *)header, total_ino);
+ EXT4_I(inode)->i_extra_isize = new_extra_isize;
+
++ if (ext4_has_inline_data(inode))
++ error = ext4_find_inline_data_nolock(inode);
++
+ cleanup:
+ if (error && (mnt_count != le16_to_cpu(sbi->s_es->s_mnt_count))) {
+ ext4_warning(inode->i_sb, "Unable to expand inode %lu. Delete some EAs or run e2fsck.",
+diff --git a/fs/file.c b/fs/file.c
+index d6ca500a10536..928ba7b8df1e9 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -627,6 +627,7 @@ int __close_fd(struct files_struct *files, unsigned fd)
+ fdt = files_fdtable(files);
+ if (fd >= fdt->max_fds)
+ goto out_unlock;
++ fd = array_index_nospec(fd, fdt->max_fds);
+ file = fdt->fd[fd];
+ if (!file)
+ goto out_unlock;
+diff --git a/fs/udf/directory.c b/fs/udf/directory.c
+index d9523013096f9..73720320f0ab7 100644
+--- a/fs/udf/directory.c
++++ b/fs/udf/directory.c
+@@ -34,7 +34,7 @@ struct fileIdentDesc *udf_fileident_read(struct inode *dir, loff_t *nf_pos,
+ fibh->soffset = fibh->eoffset;
+
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
+- fi = udf_get_fileident(iinfo->i_ext.i_data -
++ fi = udf_get_fileident(iinfo->i_data -
+ (iinfo->i_efe ?
+ sizeof(struct extendedFileEntry) :
+ sizeof(struct fileEntry)),
+diff --git a/fs/udf/file.c b/fs/udf/file.c
+index 88b7fb8e9998c..8fff7ffc33a81 100644
+--- a/fs/udf/file.c
++++ b/fs/udf/file.c
+@@ -50,7 +50,7 @@ static void __udf_adinicb_readpage(struct page *page)
+ * So just sample it once and use the same value everywhere.
+ */
+ kaddr = kmap_atomic(page);
+- memcpy(kaddr, iinfo->i_ext.i_data + iinfo->i_lenEAttr, isize);
++ memcpy(kaddr, iinfo->i_data + iinfo->i_lenEAttr, isize);
+ memset(kaddr + isize, 0, PAGE_SIZE - isize);
+ flush_dcache_page(page);
+ SetPageUptodate(page);
+@@ -76,8 +76,7 @@ static int udf_adinicb_writepage(struct page *page,
+ BUG_ON(!PageLocked(page));
+
+ kaddr = kmap_atomic(page);
+- memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr,
+- i_size_read(inode));
++ memcpy(iinfo->i_data + iinfo->i_lenEAttr, kaddr, i_size_read(inode));
+ SetPageUptodate(page);
+ kunmap_atomic(kaddr);
+ mark_inode_dirty(inode);
+@@ -213,7 +212,7 @@ long udf_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ return put_user(UDF_I(inode)->i_lenEAttr, (int __user *)arg);
+ case UDF_GETEABLOCK:
+ return copy_to_user((char __user *)arg,
+- UDF_I(inode)->i_ext.i_data,
++ UDF_I(inode)->i_data,
+ UDF_I(inode)->i_lenEAttr) ? -EFAULT : 0;
+ default:
+ return -ENOIOCTLCMD;
+diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c
+index f8e5872f7cc27..cdaa86e077b29 100644
+--- a/fs/udf/ialloc.c
++++ b/fs/udf/ialloc.c
+@@ -67,16 +67,16 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode)
+ iinfo->i_efe = 1;
+ if (UDF_VERS_USE_EXTENDED_FE > sbi->s_udfrev)
+ sbi->s_udfrev = UDF_VERS_USE_EXTENDED_FE;
+- iinfo->i_ext.i_data = kzalloc(inode->i_sb->s_blocksize -
+- sizeof(struct extendedFileEntry),
+- GFP_KERNEL);
++ iinfo->i_data = kzalloc(inode->i_sb->s_blocksize -
++ sizeof(struct extendedFileEntry),
++ GFP_KERNEL);
+ } else {
+ iinfo->i_efe = 0;
+- iinfo->i_ext.i_data = kzalloc(inode->i_sb->s_blocksize -
+- sizeof(struct fileEntry),
+- GFP_KERNEL);
++ iinfo->i_data = kzalloc(inode->i_sb->s_blocksize -
++ sizeof(struct fileEntry),
++ GFP_KERNEL);
+ }
+- if (!iinfo->i_ext.i_data) {
++ if (!iinfo->i_data) {
+ iput(inode);
+ return ERR_PTR(-ENOMEM);
+ }
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index af1180104e560..77421e65623a1 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -150,8 +150,8 @@ void udf_evict_inode(struct inode *inode)
+ truncate_inode_pages_final(&inode->i_data);
+ invalidate_inode_buffers(inode);
+ clear_inode(inode);
+- kfree(iinfo->i_ext.i_data);
+- iinfo->i_ext.i_data = NULL;
++ kfree(iinfo->i_data);
++ iinfo->i_data = NULL;
+ udf_clear_extent_cache(inode);
+ if (want_delete) {
+ udf_free_inode(inode);
+@@ -278,14 +278,14 @@ int udf_expand_file_adinicb(struct inode *inode)
+ kaddr = kmap_atomic(page);
+ memset(kaddr + iinfo->i_lenAlloc, 0x00,
+ PAGE_SIZE - iinfo->i_lenAlloc);
+- memcpy(kaddr, iinfo->i_ext.i_data + iinfo->i_lenEAttr,
++ memcpy(kaddr, iinfo->i_data + iinfo->i_lenEAttr,
+ iinfo->i_lenAlloc);
+ flush_dcache_page(page);
+ SetPageUptodate(page);
+ kunmap_atomic(kaddr);
+ }
+ down_write(&iinfo->i_data_sem);
+- memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0x00,
++ memset(iinfo->i_data + iinfo->i_lenEAttr, 0x00,
+ iinfo->i_lenAlloc);
+ iinfo->i_lenAlloc = 0;
+ if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_USE_SHORT_AD))
+@@ -303,8 +303,7 @@ int udf_expand_file_adinicb(struct inode *inode)
+ lock_page(page);
+ down_write(&iinfo->i_data_sem);
+ kaddr = kmap_atomic(page);
+- memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr,
+- inode->i_size);
++ memcpy(iinfo->i_data + iinfo->i_lenEAttr, kaddr, inode->i_size);
+ kunmap_atomic(kaddr);
+ unlock_page(page);
+ iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB;
+@@ -392,8 +391,7 @@ struct buffer_head *udf_expand_dir_adinicb(struct inode *inode,
+ }
+ mark_buffer_dirty_inode(dbh, inode);
+
+- memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0,
+- iinfo->i_lenAlloc);
++ memset(iinfo->i_data + iinfo->i_lenEAttr, 0, iinfo->i_lenAlloc);
+ iinfo->i_lenAlloc = 0;
+ eloc.logicalBlockNum = *block;
+ eloc.partitionReferenceNum =
+@@ -1241,7 +1239,7 @@ set_size:
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
+ down_write(&iinfo->i_data_sem);
+ udf_clear_extent_cache(inode);
+- memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr + newsize,
++ memset(iinfo->i_data + iinfo->i_lenEAttr + newsize,
+ 0x00, bsize - newsize -
+ udf_file_entry_alloc_offset(inode));
+ iinfo->i_lenAlloc = newsize;
+@@ -1377,6 +1375,7 @@ reread:
+ ret = -EIO;
+ goto out;
+ }
++ iinfo->i_hidden = hidden_inode;
+ iinfo->i_unique = 0;
+ iinfo->i_lenEAttr = 0;
+ iinfo->i_lenExtents = 0;
+@@ -1390,7 +1389,7 @@ reread:
+ sizeof(struct extendedFileEntry));
+ if (ret)
+ goto out;
+- memcpy(iinfo->i_ext.i_data,
++ memcpy(iinfo->i_data,
+ bh->b_data + sizeof(struct extendedFileEntry),
+ bs - sizeof(struct extendedFileEntry));
+ } else if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_FE)) {
+@@ -1399,7 +1398,7 @@ reread:
+ ret = udf_alloc_i_data(inode, bs - sizeof(struct fileEntry));
+ if (ret)
+ goto out;
+- memcpy(iinfo->i_ext.i_data,
++ memcpy(iinfo->i_data,
+ bh->b_data + sizeof(struct fileEntry),
+ bs - sizeof(struct fileEntry));
+ } else if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_USE)) {
+@@ -1412,7 +1411,7 @@ reread:
+ sizeof(struct unallocSpaceEntry));
+ if (ret)
+ goto out;
+- memcpy(iinfo->i_ext.i_data,
++ memcpy(iinfo->i_data,
+ bh->b_data + sizeof(struct unallocSpaceEntry),
+ bs - sizeof(struct unallocSpaceEntry));
+ return 0;
+@@ -1470,6 +1469,8 @@ reread:
+ iinfo->i_lenEAttr = le32_to_cpu(fe->lengthExtendedAttr);
+ iinfo->i_lenAlloc = le32_to_cpu(fe->lengthAllocDescs);
+ iinfo->i_checkpoint = le32_to_cpu(fe->checkpoint);
++ iinfo->i_streamdir = 0;
++ iinfo->i_lenStreams = 0;
+ } else {
+ inode->i_blocks = le64_to_cpu(efe->logicalBlocksRecorded) <<
+ (inode->i_sb->s_blocksize_bits - 9);
+@@ -1483,6 +1484,16 @@ reread:
+ iinfo->i_lenEAttr = le32_to_cpu(efe->lengthExtendedAttr);
+ iinfo->i_lenAlloc = le32_to_cpu(efe->lengthAllocDescs);
+ iinfo->i_checkpoint = le32_to_cpu(efe->checkpoint);
++
++ /* Named streams */
++ iinfo->i_streamdir = (efe->streamDirectoryICB.extLength != 0);
++ iinfo->i_locStreamdir =
++ lelb_to_cpu(efe->streamDirectoryICB.extLocation);
++ iinfo->i_lenStreams = le64_to_cpu(efe->objectSize);
++ if (iinfo->i_lenStreams >= inode->i_size)
++ iinfo->i_lenStreams -= inode->i_size;
++ else
++ iinfo->i_lenStreams = 0;
+ }
+ inode->i_generation = iinfo->i_unique;
+
+@@ -1579,8 +1590,8 @@ out:
+ static int udf_alloc_i_data(struct inode *inode, size_t size)
+ {
+ struct udf_inode_info *iinfo = UDF_I(inode);
+- iinfo->i_ext.i_data = kmalloc(size, GFP_KERNEL);
+- if (!iinfo->i_ext.i_data)
++ iinfo->i_data = kmalloc(size, GFP_KERNEL);
++ if (!iinfo->i_data)
+ return -ENOMEM;
+ return 0;
+ }
+@@ -1654,7 +1665,7 @@ static int udf_update_inode(struct inode *inode, int do_sync)
+
+ use->lengthAllocDescs = cpu_to_le32(iinfo->i_lenAlloc);
+ memcpy(bh->b_data + sizeof(struct unallocSpaceEntry),
+- iinfo->i_ext.i_data, inode->i_sb->s_blocksize -
++ iinfo->i_data, inode->i_sb->s_blocksize -
+ sizeof(struct unallocSpaceEntry));
+ use->descTag.tagIdent = cpu_to_le16(TAG_IDENT_USE);
+ crclen = sizeof(struct unallocSpaceEntry);
+@@ -1684,8 +1695,12 @@ static int udf_update_inode(struct inode *inode, int do_sync)
+
+ if (S_ISDIR(inode->i_mode) && inode->i_nlink > 0)
+ fe->fileLinkCount = cpu_to_le16(inode->i_nlink - 1);
+- else
+- fe->fileLinkCount = cpu_to_le16(inode->i_nlink);
++ else {
++ if (iinfo->i_hidden)
++ fe->fileLinkCount = cpu_to_le16(0);
++ else
++ fe->fileLinkCount = cpu_to_le16(inode->i_nlink);
++ }
+
+ fe->informationLength = cpu_to_le64(inode->i_size);
+
+@@ -1723,7 +1738,7 @@ static int udf_update_inode(struct inode *inode, int do_sync)
+
+ if (iinfo->i_efe == 0) {
+ memcpy(bh->b_data + sizeof(struct fileEntry),
+- iinfo->i_ext.i_data,
++ iinfo->i_data,
+ inode->i_sb->s_blocksize - sizeof(struct fileEntry));
+ fe->logicalBlocksRecorded = cpu_to_le64(lb_recorded);
+
+@@ -1742,12 +1757,22 @@ static int udf_update_inode(struct inode *inode, int do_sync)
+ crclen = sizeof(struct fileEntry);
+ } else {
+ memcpy(bh->b_data + sizeof(struct extendedFileEntry),
+- iinfo->i_ext.i_data,
++ iinfo->i_data,
+ inode->i_sb->s_blocksize -
+ sizeof(struct extendedFileEntry));
+- efe->objectSize = cpu_to_le64(inode->i_size);
++ efe->objectSize =
++ cpu_to_le64(inode->i_size + iinfo->i_lenStreams);
+ efe->logicalBlocksRecorded = cpu_to_le64(lb_recorded);
+
++ if (iinfo->i_streamdir) {
++ struct long_ad *icb_lad = &efe->streamDirectoryICB;
++
++ icb_lad->extLocation =
++ cpu_to_lelb(iinfo->i_locStreamdir);
++ icb_lad->extLength =
++ cpu_to_le32(inode->i_sb->s_blocksize);
++ }
++
+ udf_adjust_time(iinfo, inode->i_atime);
+ udf_adjust_time(iinfo, inode->i_mtime);
+ udf_adjust_time(iinfo, inode->i_ctime);
+@@ -1846,8 +1871,13 @@ struct inode *__udf_iget(struct super_block *sb, struct kernel_lb_addr *ino,
+ if (!inode)
+ return ERR_PTR(-ENOMEM);
+
+- if (!(inode->i_state & I_NEW))
++ if (!(inode->i_state & I_NEW)) {
++ if (UDF_I(inode)->i_hidden != hidden_inode) {
++ iput(inode);
++ return ERR_PTR(-EFSCORRUPTED);
++ }
+ return inode;
++ }
+
+ memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct kernel_lb_addr));
+ err = udf_read_inode(inode, hidden_inode);
+@@ -2028,7 +2058,7 @@ void udf_write_aext(struct inode *inode, struct extent_position *epos,
+ struct udf_inode_info *iinfo = UDF_I(inode);
+
+ if (!epos->bh)
+- ptr = iinfo->i_ext.i_data + epos->offset -
++ ptr = iinfo->i_data + epos->offset -
+ udf_file_entry_alloc_offset(inode) +
+ iinfo->i_lenEAttr;
+ else
+@@ -2120,7 +2150,7 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos,
+ if (!epos->bh) {
+ if (!epos->offset)
+ epos->offset = udf_file_entry_alloc_offset(inode);
+- ptr = iinfo->i_ext.i_data + epos->offset -
++ ptr = iinfo->i_data + epos->offset -
+ udf_file_entry_alloc_offset(inode) +
+ iinfo->i_lenEAttr;
+ alen = udf_file_entry_alloc_offset(inode) +
+diff --git a/fs/udf/misc.c b/fs/udf/misc.c
+index 853bcff51043f..1614d308d0f06 100644
+--- a/fs/udf/misc.c
++++ b/fs/udf/misc.c
+@@ -52,9 +52,9 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
+ uint16_t crclen;
+ struct udf_inode_info *iinfo = UDF_I(inode);
+
+- ea = iinfo->i_ext.i_data;
++ ea = iinfo->i_data;
+ if (iinfo->i_lenEAttr) {
+- ad = iinfo->i_ext.i_data + iinfo->i_lenEAttr;
++ ad = iinfo->i_data + iinfo->i_lenEAttr;
+ } else {
+ ad = ea;
+ size += sizeof(struct extendedAttrHeaderDesc);
+@@ -153,7 +153,7 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type,
+ uint32_t offset;
+ struct udf_inode_info *iinfo = UDF_I(inode);
+
+- ea = iinfo->i_ext.i_data;
++ ea = iinfo->i_data;
+
+ if (iinfo->i_lenEAttr) {
+ struct extendedAttrHeaderDesc *eahd;
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index ef251622da137..05dd1f45ba90b 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -478,8 +478,7 @@ add:
+ if (dinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
+ block = dinfo->i_location.logicalBlockNum;
+ fi = (struct fileIdentDesc *)
+- (dinfo->i_ext.i_data +
+- fibh->soffset -
++ (dinfo->i_data + fibh->soffset -
+ udf_ext0_offset(dir) +
+ dinfo->i_lenEAttr);
+ } else {
+@@ -962,7 +961,7 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry,
+ mark_buffer_dirty_inode(epos.bh, inode);
+ ea = epos.bh->b_data + udf_ext0_offset(inode);
+ } else
+- ea = iinfo->i_ext.i_data + iinfo->i_lenEAttr;
++ ea = iinfo->i_data + iinfo->i_lenEAttr;
+
+ eoffset = sb->s_blocksize - udf_ext0_offset(inode);
+ pc = (struct pathComponent *)ea;
+@@ -1142,7 +1141,7 @@ static int udf_rename(struct inode *old_dir, struct dentry *old_dentry,
+ retval = -EIO;
+ if (old_iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
+ dir_fi = udf_get_fileident(
+- old_iinfo->i_ext.i_data -
++ old_iinfo->i_data -
+ (old_iinfo->i_efe ?
+ sizeof(struct extendedFileEntry) :
+ sizeof(struct fileEntry)),
+diff --git a/fs/udf/partition.c b/fs/udf/partition.c
+index 090baff83990a..4cbf40575965e 100644
+--- a/fs/udf/partition.c
++++ b/fs/udf/partition.c
+@@ -65,7 +65,7 @@ uint32_t udf_get_pblock_virt15(struct super_block *sb, uint32_t block,
+ }
+
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
+- loc = le32_to_cpu(((__le32 *)(iinfo->i_ext.i_data +
++ loc = le32_to_cpu(((__le32 *)(iinfo->i_data +
+ vdata->s_start_offset))[block]);
+ goto translate;
+ }
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index b7fb7cd35d89a..bce48a07790cb 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -146,9 +146,12 @@ static struct inode *udf_alloc_inode(struct super_block *sb)
+
+ ei->i_unique = 0;
+ ei->i_lenExtents = 0;
++ ei->i_lenStreams = 0;
+ ei->i_next_alloc_block = 0;
+ ei->i_next_alloc_goal = 0;
+ ei->i_strat4096 = 0;
++ ei->i_streamdir = 0;
++ ei->i_hidden = 0;
+ init_rwsem(&ei->i_data_sem);
+ ei->cached_extent.lstart = -1;
+ spin_lock_init(&ei->i_extent_cache_lock);
+@@ -172,7 +175,7 @@ static void init_once(void *foo)
+ {
+ struct udf_inode_info *ei = (struct udf_inode_info *)foo;
+
+- ei->i_ext.i_data = NULL;
++ ei->i_data = NULL;
+ inode_init_once(&ei->vfs_inode);
+ }
+
+@@ -572,6 +575,11 @@ static int udf_parse_options(char *options, struct udf_options *uopt,
+ if (!remount) {
+ if (uopt->nls_map)
+ unload_nls(uopt->nls_map);
++ /*
++ * load_nls() failure is handled later in
++ * udf_fill_super() after all options are
++ * parsed.
++ */
+ uopt->nls_map = load_nls(args[0].from);
+ uopt->flags |= (1 << UDF_FLAG_NLS_MAP);
+ }
+@@ -1200,7 +1208,7 @@ static int udf_load_vat(struct super_block *sb, int p_index, int type1_index)
+ vat20 = (struct virtualAllocationTable20 *)bh->b_data;
+ } else {
+ vat20 = (struct virtualAllocationTable20 *)
+- vati->i_ext.i_data;
++ vati->i_data;
+ }
+
+ map->s_type_specific.s_virtual.s_start_offset =
+diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
+index 6023c97c6da2f..aef3e4d9014d2 100644
+--- a/fs/udf/symlink.c
++++ b/fs/udf/symlink.c
+@@ -122,7 +122,7 @@ static int udf_symlink_filler(struct file *file, struct page *page)
+
+ down_read(&iinfo->i_data_sem);
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
+- symlink = iinfo->i_ext.i_data + iinfo->i_lenEAttr;
++ symlink = iinfo->i_data + iinfo->i_lenEAttr;
+ } else {
+ bh = sb_bread(inode->i_sb, pos);
+
+diff --git a/fs/udf/udf_i.h b/fs/udf/udf_i.h
+index 2ef0e212f08a3..b77bf713a1b68 100644
+--- a/fs/udf/udf_i.h
++++ b/fs/udf/udf_i.h
+@@ -42,12 +42,12 @@ struct udf_inode_info {
+ unsigned i_efe : 1; /* extendedFileEntry */
+ unsigned i_use : 1; /* unallocSpaceEntry */
+ unsigned i_strat4096 : 1;
+- unsigned reserved : 26;
+- union {
+- struct short_ad *i_sad;
+- struct long_ad *i_lad;
+- __u8 *i_data;
+- } i_ext;
++ unsigned i_streamdir : 1;
++ unsigned i_hidden : 1; /* hidden system inode */
++ unsigned reserved : 24;
++ __u8 *i_data;
++ struct kernel_lb_addr i_locStreamdir;
++ __u64 i_lenStreams;
+ struct rw_semaphore i_data_sem;
+ struct udf_ext_cache cached_extent;
+ /* Spinlock for protecting extent cache */
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 1658e9f8d8032..78c1cd4dfdc07 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -3097,6 +3097,8 @@
+
+ #define PCI_VENDOR_ID_3COM_2 0xa727
+
++#define PCI_VENDOR_ID_SOLIDRUN 0xd063
++
+ #define PCI_VENDOR_ID_DIGIUM 0xd161
+ #define PCI_DEVICE_ID_DIGIUM_HFC4S 0xb410
+
+diff --git a/net/caif/caif_usb.c b/net/caif/caif_usb.c
+index 76d49a1bc6f68..609c5793f45a0 100644
+--- a/net/caif/caif_usb.c
++++ b/net/caif/caif_usb.c
+@@ -135,6 +135,9 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what,
+ struct usb_device *usbdev;
+ int res;
+
++ if (what == NETDEV_UNREGISTER && dev->reg_state >= NETREG_UNREGISTERED)
++ return 0;
++
+ /* Check whether we have a NCM device, and find its VID/PID. */
+ if (!(dev->dev.parent && dev->dev.parent->driver &&
+ strcmp(dev->dev.parent->driver->name, "cdc_ncm") == 0))
+diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
+index 7858fa9ea103b..87744eb8d0c42 100644
+--- a/net/ipv6/ila/ila_xlat.c
++++ b/net/ipv6/ila/ila_xlat.c
+@@ -480,6 +480,7 @@ int ila_xlat_nl_cmd_get_mapping(struct sk_buff *skb, struct genl_info *info)
+
+ rcu_read_lock();
+
++ ret = -ESRCH;
+ ila = ila_lookup_by_params(&xp, ilan);
+ if (ila) {
+ ret = ila_dump_info(ila,
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index 2c5443ce449c3..f705800b22488 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -1464,8 +1464,8 @@ static int nfc_se_io(struct nfc_dev *dev, u32 se_idx,
+ return rc;
+
+ error:
+- kfree(cb_context);
+ device_unlock(&dev->dev);
++ kfree(cb_context);
+ return rc;
+ }
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 8266452c143b4..c83eaa7183696 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -388,7 +388,7 @@ static int tipc_sk_sock_err(struct socket *sock, long *timeout)
+ rc_ = tipc_sk_sock_err((sock_), timeo_); \
+ if (rc_) \
+ break; \
+- prepare_to_wait(sk_sleep(sk_), &wait_, TASK_INTERRUPTIBLE); \
++ add_wait_queue(sk_sleep(sk_), &wait_); \
+ release_sock(sk_); \
+ *(timeo_) = wait_woken(&wait_, TASK_INTERRUPTIBLE, *(timeo_)); \
+ sched_annotate_sleep(); \
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index 64fac0ad32d6b..97f59fa3e0ed9 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -541,7 +541,9 @@ targets += $(call intermediate_targets, .asn1.o, .asn1.c .asn1.h) \
+
+ PHONY += $(subdir-ym)
+ $(subdir-ym):
+- $(Q)$(MAKE) $(build)=$@ need-builtin=$(if $(findstring $@,$(subdir-obj-y)),1)
++ $(Q)$(MAKE) $(build)=$@ \
++ need-builtin=$(if $(filter $@/built-in.a, $(subdir-obj-y)),1) \
++ need-modorder=$(if $(need-modorder),$(if $(filter $@/modules.order, $(modorder)),1))
+
+ # Add FORCE to the prequisites of a target to force it to be always rebuilt.
+ # ---------------------------------------------------------------------------
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-03-22 14:16 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2023-03-22 14:16 UTC (permalink / raw
To: gentoo-commits
commit: 4d25837b83819e2aa447856c2fc41bfb5b2b1067
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Mar 22 12:51:50 2023 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Mar 22 12:51:50 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4d25837b
Linux patch 4.19.279
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1278_linux-4.19.279.patch | 802 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 806 insertions(+)
diff --git a/0000_README b/0000_README
index 1f79849a..be4133f5 100644
--- a/0000_README
+++ b/0000_README
@@ -1155,6 +1155,10 @@ Patch: 1277_linux-4.19.278.patch
From: https://www.kernel.org
Desc: Linux 4.19.278
+Patch: 1278_linux-4.19.279.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.279
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1278_linux-4.19.279.patch b/1278_linux-4.19.279.patch
new file mode 100644
index 00000000..43d16b4b
--- /dev/null
+++ b/1278_linux-4.19.279.patch
@@ -0,0 +1,802 @@
+diff --git a/Makefile b/Makefile
+index a8104c8024a4d..d6c4a53bf5053 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 278
++SUBLEVEL = 279
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
+index 650d5a6cafc70..832c899b7b73b 100644
+--- a/arch/x86/mm/mem_encrypt_identity.c
++++ b/arch/x86/mm/mem_encrypt_identity.c
+@@ -563,7 +563,8 @@ void __init sme_enable(struct boot_params *bp)
+ cmdline_ptr = (const char *)((u64)bp->hdr.cmd_line_ptr |
+ ((u64)bp->ext_cmd_line_ptr << 32));
+
+- cmdline_find_option(cmdline_ptr, cmdline_arg, buffer, sizeof(buffer));
++ if (cmdline_find_option(cmdline_ptr, cmdline_arg, buffer, sizeof(buffer)) < 0)
++ return;
+
+ if (!strncmp(buffer, cmdline_on, sizeof(buffer)))
+ sme_me_mask = me_mask;
+diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
+index 6b7b0d8a2acbc..d2e9ffd2255f4 100644
+--- a/drivers/block/sunvdc.c
++++ b/drivers/block/sunvdc.c
+@@ -947,6 +947,8 @@ static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+ print_version();
+
+ hp = mdesc_grab();
++ if (!hp)
++ return -ENODEV;
+
+ err = -ENODEV;
+ if ((vdev->dev_no << PARTITION_SHIFT) & ~(u64)MINORMASK) {
+diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
+index 292056bbb30e9..ffe81449ce246 100644
+--- a/drivers/clk/Kconfig
++++ b/drivers/clk/Kconfig
+@@ -63,7 +63,7 @@ config COMMON_CLK_RK808
+ config COMMON_CLK_HI655X
+ tristate "Clock driver for Hi655x" if EXPERT
+ depends on (MFD_HI655X_PMIC || COMPILE_TEST)
+- depends on REGMAP
++ select REGMAP
+ default MFD_HI655X_PMIC
+ ---help---
+ This driver supports the hi655x PMIC clock. This
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+index 892077377339a..8f23192b67095 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+@@ -529,16 +529,13 @@ static struct kfd_event_waiter *alloc_event_waiters(uint32_t num_events)
+ struct kfd_event_waiter *event_waiters;
+ uint32_t i;
+
+- event_waiters = kmalloc_array(num_events,
+- sizeof(struct kfd_event_waiter),
+- GFP_KERNEL);
++ event_waiters = kcalloc(num_events, sizeof(struct kfd_event_waiter),
++ GFP_KERNEL);
+ if (!event_waiters)
+ return NULL;
+
+- for (i = 0; (event_waiters) && (i < num_events) ; i++) {
++ for (i = 0; i < num_events; i++)
+ init_wait(&event_waiters[i].wait);
+- event_waiters[i].activated = false;
+- }
+
+ return event_waiters;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 979d130b24c42..16eec72f0fede 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -1132,10 +1132,11 @@ static struct i915_vma *
+ intel_ring_create_vma(struct drm_i915_private *dev_priv, int size)
+ {
+ struct i915_address_space *vm = &dev_priv->ggtt.vm;
+- struct drm_i915_gem_object *obj;
++ struct drm_i915_gem_object *obj = NULL;
+ struct i915_vma *vma;
+
+- obj = i915_gem_object_create_stolen(dev_priv, size);
++ if (!HAS_LLC(dev_priv))
++ obj = i915_gem_object_create_stolen(dev_priv, size);
+ if (!obj)
+ obj = i915_gem_object_create_internal(dev_priv, size);
+ if (IS_ERR(obj))
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 8cc79d0d11fb2..c8d687f795caa 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -258,6 +258,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
+ {
+ struct hid_report *report;
+ struct hid_field *field;
++ unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE;
+ unsigned int usages;
+ unsigned int offset;
+ unsigned int i;
+@@ -288,8 +289,11 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
+ offset = report->size;
+ report->size += parser->global.report_size * parser->global.report_count;
+
++ if (parser->device->ll_driver->max_buffer_size)
++ max_buffer_size = parser->device->ll_driver->max_buffer_size;
++
+ /* Total size check: Allow for possible report index byte */
+- if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) {
++ if (report->size > (max_buffer_size - 1) << 3) {
+ hid_err(parser->device, "report is too long\n");
+ return -1;
+ }
+@@ -1567,6 +1571,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
+ struct hid_report_enum *report_enum = hid->report_enum + type;
+ struct hid_report *report;
+ struct hid_driver *hdrv;
++ int max_buffer_size = HID_MAX_BUFFER_SIZE;
+ unsigned int a;
+ u32 rsize, csize = size;
+ u8 *cdata = data;
+@@ -1583,10 +1588,13 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
+
+ rsize = hid_compute_report_size(report);
+
+- if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE)
+- rsize = HID_MAX_BUFFER_SIZE - 1;
+- else if (rsize > HID_MAX_BUFFER_SIZE)
+- rsize = HID_MAX_BUFFER_SIZE;
++ if (hid->ll_driver->max_buffer_size)
++ max_buffer_size = hid->ll_driver->max_buffer_size;
++
++ if (report_enum->numbered && rsize >= max_buffer_size)
++ rsize = max_buffer_size - 1;
++ else if (rsize > max_buffer_size)
++ rsize = max_buffer_size;
+
+ if (csize < rsize) {
+ dbg_hid("report %d is too short, (%d < %d)\n", report->id,
+diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
+index e128b9ce156df..44df81d56d9ca 100644
+--- a/drivers/hid/uhid.c
++++ b/drivers/hid/uhid.c
+@@ -398,6 +398,7 @@ struct hid_ll_driver uhid_hid_driver = {
+ .parse = uhid_hid_parse,
+ .raw_request = uhid_hid_raw_request,
+ .output_report = uhid_hid_output_report,
++ .max_buffer_size = UHID_DATA_MAX,
+ };
+ EXPORT_SYMBOL_GPL(uhid_hid_driver);
+
+diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c
+index 0a87c5b512862..2db2665dcd4dc 100644
+--- a/drivers/hwmon/adt7475.c
++++ b/drivers/hwmon/adt7475.c
+@@ -485,10 +485,10 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *attr,
+ val = (temp - val) / 1000;
+
+ if (sattr->index != 1) {
+- data->temp[HYSTERSIS][sattr->index] &= 0xF0;
++ data->temp[HYSTERSIS][sattr->index] &= 0x0F;
+ data->temp[HYSTERSIS][sattr->index] |= (val & 0xF) << 4;
+ } else {
+- data->temp[HYSTERSIS][sattr->index] &= 0x0F;
++ data->temp[HYSTERSIS][sattr->index] &= 0xF0;
+ data->temp[HYSTERSIS][sattr->index] |= (val & 0xF);
+ }
+
+@@ -554,11 +554,11 @@ static ssize_t show_temp_st(struct device *dev, struct device_attribute *attr,
+ val = data->enh_acoustics[0] & 0xf;
+ break;
+ case 1:
+- val = (data->enh_acoustics[1] >> 4) & 0xf;
++ val = data->enh_acoustics[1] & 0xf;
+ break;
+ case 2:
+ default:
+- val = data->enh_acoustics[1] & 0xf;
++ val = (data->enh_acoustics[1] >> 4) & 0xf;
+ break;
+ }
+
+diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c
+index a3cd91f232679..2dd19a4203052 100644
+--- a/drivers/hwmon/xgene-hwmon.c
++++ b/drivers/hwmon/xgene-hwmon.c
+@@ -780,6 +780,7 @@ static int xgene_hwmon_remove(struct platform_device *pdev)
+ {
+ struct xgene_hwmon_dev *ctx = platform_get_drvdata(pdev);
+
++ cancel_work_sync(&ctx->workq);
+ hwmon_device_unregister(ctx->hwmon_dev);
+ kfifo_free(&ctx->async_msg_fifo);
+ if (acpi_disabled)
+diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c
+index d9a9644306096..9e6827dedab30 100644
+--- a/drivers/media/i2c/m5mols/m5mols_core.c
++++ b/drivers/media/i2c/m5mols/m5mols_core.c
+@@ -492,7 +492,7 @@ static enum m5mols_restype __find_restype(u32 code)
+ do {
+ if (code == m5mols_default_ffmt[type].code)
+ return type;
+- } while (type++ != SIZE_DEFAULT_FFMT);
++ } while (++type != SIZE_DEFAULT_FFMT);
+
+ return 0;
+ }
+diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
+index d40bab3d9f4af..fb435a8d37213 100644
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -1857,7 +1857,6 @@ static void atmci_tasklet_func(unsigned long priv)
+ atmci_writel(host, ATMCI_IER, ATMCI_NOTBUSY);
+ state = STATE_WAITING_NOTBUSY;
+ } else if (host->mrq->stop) {
+- atmci_writel(host, ATMCI_IER, ATMCI_CMDRDY);
+ atmci_send_stop_cmd(host, data);
+ state = STATE_SENDING_STOP;
+ } else {
+@@ -1890,8 +1889,6 @@ static void atmci_tasklet_func(unsigned long priv)
+ * command to send.
+ */
+ if (host->mrq->stop) {
+- atmci_writel(host, ATMCI_IER,
+- ATMCI_CMDRDY);
+ atmci_send_stop_cmd(host, data);
+ state = STATE_SENDING_STOP;
+ } else {
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+index e50fc8f714dcf..7e5beb4136014 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -4062,6 +4062,11 @@ static int qed_init_wfq_param(struct qed_hwfn *p_hwfn,
+
+ num_vports = p_hwfn->qm_info.num_vports;
+
++ if (num_vports < 2) {
++ DP_NOTICE(p_hwfn, "Unexpected num_vports: %d\n", num_vports);
++ return -EINVAL;
++ }
++
+ /* Accounting for the vports which are configured for WFQ explicitly */
+ for (i = 0; i < num_vports; i++) {
+ u32 tmp_speed;
+diff --git a/drivers/net/ethernet/sun/ldmvsw.c b/drivers/net/ethernet/sun/ldmvsw.c
+index 644e42c181ee6..1c9522ad31787 100644
+--- a/drivers/net/ethernet/sun/ldmvsw.c
++++ b/drivers/net/ethernet/sun/ldmvsw.c
+@@ -291,6 +291,9 @@ static int vsw_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+
+ hp = mdesc_grab();
+
++ if (!hp)
++ return -ENODEV;
++
+ rmac = mdesc_get_property(hp, vdev->mp, remote_macaddr_prop, &len);
+ err = -ENODEV;
+ if (!rmac) {
+diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
+index 590172818b922..3a1f0653cfb76 100644
+--- a/drivers/net/ethernet/sun/sunvnet.c
++++ b/drivers/net/ethernet/sun/sunvnet.c
+@@ -432,6 +432,9 @@ static int vnet_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+
+ hp = mdesc_grab();
+
++ if (!hp)
++ return -ENODEV;
++
+ vp = vnet_find_parent(hp, vdev->mp, vdev);
+ if (IS_ERR(vp)) {
+ pr_err("Cannot find port parent vnet\n");
+diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
+index c328208388da7..fd7c9f5ff99eb 100644
+--- a/drivers/net/phy/smsc.c
++++ b/drivers/net/phy/smsc.c
+@@ -112,8 +112,11 @@ static int lan911x_config_init(struct phy_device *phydev)
+ static int lan87xx_read_status(struct phy_device *phydev)
+ {
+ struct smsc_phy_priv *priv = phydev->priv;
++ int err;
+
+- int err = genphy_read_status(phydev);
++ err = genphy_read_status(phydev);
++ if (err)
++ return err;
+
+ if (!phydev->link && priv->energy_enable) {
+ int i;
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index 8b9fd4e071f3d..313a4b0edc6b3 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -2213,6 +2213,13 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ size = (rx_cmd_a & RX_CMD_A_LEN) - RXW_PADDING;
+ align_count = (4 - ((size + RXW_PADDING) % 4)) % 4;
+
++ if (unlikely(size > skb->len)) {
++ netif_dbg(dev, rx_err, dev->net,
++ "size err rx_cmd_a=0x%08x\n",
++ rx_cmd_a);
++ return 0;
++ }
++
+ if (unlikely(rx_cmd_a & RX_CMD_A_RED)) {
+ netif_dbg(dev, rx_err, dev->net,
+ "Error rx_cmd_a=0x%08x\n", rx_cmd_a);
+diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c
+index c7da364b63584..a2d61d8240246 100644
+--- a/drivers/nfc/pn533/usb.c
++++ b/drivers/nfc/pn533/usb.c
+@@ -187,6 +187,7 @@ static int pn533_usb_send_frame(struct pn533 *dev,
+ print_hex_dump_debug("PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
+ out->data, out->len, false);
+
++ arg.phy = phy;
+ init_completion(&arg.done);
+ cntx = phy->out_urb->context;
+ phy->out_urb->context = &arg;
+diff --git a/drivers/nfc/st-nci/ndlc.c b/drivers/nfc/st-nci/ndlc.c
+index f26d938d240f0..12d73f9dbe9f3 100644
+--- a/drivers/nfc/st-nci/ndlc.c
++++ b/drivers/nfc/st-nci/ndlc.c
+@@ -297,13 +297,15 @@ EXPORT_SYMBOL(ndlc_probe);
+
+ void ndlc_remove(struct llt_ndlc *ndlc)
+ {
+- st_nci_remove(ndlc->ndev);
+-
+ /* cancel timers */
+ del_timer_sync(&ndlc->t1_timer);
+ del_timer_sync(&ndlc->t2_timer);
+ ndlc->t2_active = false;
+ ndlc->t1_active = false;
++ /* cancel work */
++ cancel_work_sync(&ndlc->sm_work);
++
++ st_nci_remove(ndlc->ndev);
+
+ skb_queue_purge(&ndlc->rcv_q);
+ skb_queue_purge(&ndlc->send_q);
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index 80b5aae1bdc9b..aff18a3f002f9 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -528,8 +528,10 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status)
+
+ void nvmet_req_complete(struct nvmet_req *req, u16 status)
+ {
++ struct nvmet_sq *sq = req->sq;
++
+ __nvmet_req_complete(req, status);
+- percpu_ref_put(&req->sq->ref);
++ percpu_ref_put(&sq->ref);
+ }
+ EXPORT_SYMBOL_GPL(nvmet_req_complete);
+
+diff --git a/drivers/tty/serial/8250/8250_em.c b/drivers/tty/serial/8250/8250_em.c
+index 2a76e22d2ec04..5670c8a267d87 100644
+--- a/drivers/tty/serial/8250/8250_em.c
++++ b/drivers/tty/serial/8250/8250_em.c
+@@ -102,8 +102,8 @@ static int serial8250_em_probe(struct platform_device *pdev)
+ memset(&up, 0, sizeof(up));
+ up.port.mapbase = regs->start;
+ up.port.irq = irq->start;
+- up.port.type = PORT_UNKNOWN;
+- up.port.flags = UPF_BOOT_AUTOCONF | UPF_FIXED_PORT | UPF_IOREMAP;
++ up.port.type = PORT_16750;
++ up.port.flags = UPF_FIXED_PORT | UPF_IOREMAP | UPF_FIXED_TYPE;
+ up.port.dev = &pdev->dev;
+ up.port.private_data = priv;
+
+diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c
+index 9530ed46f4358..e606fc7287947 100644
+--- a/drivers/video/fbdev/stifb.c
++++ b/drivers/video/fbdev/stifb.c
+@@ -921,6 +921,28 @@ SETUP_HCRX(struct stifb_info *fb)
+
+ /* ------------------- driver specific functions --------------------------- */
+
++static int
++stifb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
++{
++ struct stifb_info *fb = container_of(info, struct stifb_info, info);
++
++ if (var->xres != fb->info.var.xres ||
++ var->yres != fb->info.var.yres ||
++ var->bits_per_pixel != fb->info.var.bits_per_pixel)
++ return -EINVAL;
++
++ var->xres_virtual = var->xres;
++ var->yres_virtual = var->yres;
++ var->xoffset = 0;
++ var->yoffset = 0;
++ var->grayscale = fb->info.var.grayscale;
++ var->red.length = fb->info.var.red.length;
++ var->green.length = fb->info.var.green.length;
++ var->blue.length = fb->info.var.blue.length;
++
++ return 0;
++}
++
+ static int
+ stifb_setcolreg(u_int regno, u_int red, u_int green,
+ u_int blue, u_int transp, struct fb_info *info)
+@@ -1103,6 +1125,7 @@ stifb_init_display(struct stifb_info *fb)
+
+ static struct fb_ops stifb_ops = {
+ .owner = THIS_MODULE,
++ .fb_check_var = stifb_check_var,
+ .fb_setcolreg = stifb_setcolreg,
+ .fb_blank = stifb_blank,
+ .fb_fillrect = cfb_fillrect,
+@@ -1122,6 +1145,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ struct stifb_info *fb;
+ struct fb_info *info;
+ unsigned long sti_rom_address;
++ char modestr[32];
+ char *dev_name;
+ int bpp, xres, yres;
+
+@@ -1300,6 +1324,9 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
+ info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA;
+ info->pseudo_palette = &fb->pseudo_palette;
+
++ scnprintf(modestr, sizeof(modestr), "%dx%d-%d", xres, yres, bpp);
++ fb_find_mode(&info->var, info, modestr, NULL, 0, NULL, bpp);
++
+ /* This has to be done !!! */
+ if (fb_alloc_cmap(&info->cmap, NR_PALETTE, 0))
+ goto out_err1;
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 6e7989b04d2bf..e844d91c461b0 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4947,13 +4947,6 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
+ goto bad_inode;
+ raw_inode = ext4_raw_inode(&iloc);
+
+- if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) {
+- ext4_error_inode(inode, function, line, 0,
+- "iget: root inode unallocated");
+- ret = -EFSCORRUPTED;
+- goto bad_inode;
+- }
+-
+ if ((flags & EXT4_IGET_HANDLE) &&
+ (raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) {
+ ret = -ESTALE;
+@@ -5024,11 +5017,16 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
+ * NeilBrown 1999oct15
+ */
+ if (inode->i_nlink == 0) {
+- if ((inode->i_mode == 0 ||
++ if ((inode->i_mode == 0 || flags & EXT4_IGET_SPECIAL ||
+ !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) &&
+ ino != EXT4_BOOT_LOADER_INO) {
+- /* this inode is deleted */
+- ret = -ESTALE;
++ /* this inode is deleted or unallocated */
++ if (flags & EXT4_IGET_SPECIAL) {
++ ext4_error_inode(inode, function, line, 0,
++ "iget: special inode unallocated");
++ ret = -EFSCORRUPTED;
++ } else
++ ret = -ESTALE;
+ goto bad_inode;
+ }
+ /* The only unlinked inodes we let through here have
+diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
+index 3de933354a08b..bf910f2664690 100644
+--- a/fs/ext4/page-io.c
++++ b/fs/ext4/page-io.c
+@@ -388,7 +388,8 @@ static int io_submit_init_bio(struct ext4_io_submit *io,
+
+ static int io_submit_add_bh(struct ext4_io_submit *io,
+ struct inode *inode,
+- struct page *page,
++ struct page *pagecache_page,
++ struct page *bounce_page,
+ struct buffer_head *bh)
+ {
+ int ret;
+@@ -403,10 +404,11 @@ submit_and_retry:
+ return ret;
+ io->io_bio->bi_write_hint = inode->i_write_hint;
+ }
+- ret = bio_add_page(io->io_bio, page, bh->b_size, bh_offset(bh));
++ ret = bio_add_page(io->io_bio, bounce_page ?: pagecache_page,
++ bh->b_size, bh_offset(bh));
+ if (ret != bh->b_size)
+ goto submit_and_retry;
+- wbc_account_io(io->io_wbc, page, bh->b_size);
++ wbc_account_io(io->io_wbc, pagecache_page, bh->b_size);
+ io->io_next_block++;
+ return 0;
+ }
+@@ -514,8 +516,7 @@ int ext4_bio_write_page(struct ext4_io_submit *io,
+ do {
+ if (!buffer_async_write(bh))
+ continue;
+- ret = io_submit_add_bh(io, inode,
+- data_page ? data_page : page, bh);
++ ret = io_submit_add_bh(io, inode, page, data_page, bh);
+ if (ret) {
+ /*
+ * We only get here on ENOMEM. Not much else
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 2a70b7556e419..a91b02091b160 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -384,6 +384,17 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,
+ struct inode *inode;
+ int err;
+
++ /*
++ * We have to check for this corruption early as otherwise
++ * iget_locked() could wait indefinitely for the state of our
++ * parent inode.
++ */
++ if (parent->i_ino == ea_ino) {
++ ext4_error(parent->i_sb,
++ "Parent and EA inode have the same ino %lu", ea_ino);
++ return -EFSCORRUPTED;
++ }
++
+ inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_NORMAL);
+ if (IS_ERR(inode)) {
+ err = PTR_ERR(inode);
+diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
+index 3047872fdac9b..bf3d8a4516a52 100644
+--- a/fs/jffs2/file.c
++++ b/fs/jffs2/file.c
+@@ -137,19 +137,18 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+ struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
+ pgoff_t index = pos >> PAGE_SHIFT;
+- uint32_t pageofs = index << PAGE_SHIFT;
+ int ret = 0;
+
+ jffs2_dbg(1, "%s()\n", __func__);
+
+- if (pageofs > inode->i_size) {
+- /* Make new hole frag from old EOF to new page */
++ if (pos > inode->i_size) {
++ /* Make new hole frag from old EOF to new position */
+ struct jffs2_raw_inode ri;
+ struct jffs2_full_dnode *fn;
+ uint32_t alloc_len;
+
+- jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new page\n",
+- (unsigned int)inode->i_size, pageofs);
++ jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new position\n",
++ (unsigned int)inode->i_size, (uint32_t)pos);
+
+ ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len,
+ ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
+@@ -169,10 +168,10 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ ri.mode = cpu_to_jemode(inode->i_mode);
+ ri.uid = cpu_to_je16(i_uid_read(inode));
+ ri.gid = cpu_to_je16(i_gid_read(inode));
+- ri.isize = cpu_to_je32(max((uint32_t)inode->i_size, pageofs));
++ ri.isize = cpu_to_je32((uint32_t)pos);
+ ri.atime = ri.ctime = ri.mtime = cpu_to_je32(JFFS2_NOW());
+ ri.offset = cpu_to_je32(inode->i_size);
+- ri.dsize = cpu_to_je32(pageofs - inode->i_size);
++ ri.dsize = cpu_to_je32((uint32_t)pos - inode->i_size);
+ ri.csize = cpu_to_je32(0);
+ ri.compr = JFFS2_COMPR_ZERO;
+ ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8));
+@@ -202,7 +201,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
+ goto out_err;
+ }
+ jffs2_complete_reservation(c);
+- inode->i_size = pageofs;
++ inode->i_size = pos;
+ mutex_unlock(&f->sem);
+ }
+
+diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
+index 011e391497f4e..cd70dbeeab226 100644
+--- a/fs/sysfs/file.c
++++ b/fs/sysfs/file.c
+@@ -599,7 +599,7 @@ int sysfs_emit_at(char *buf, int at, const char *fmt, ...)
+ va_list args;
+ int len;
+
+- if (WARN(!buf || offset_in_page(buf) || at < 0 || at >= PAGE_SIZE,
++ if (WARN(!buf || at < 0 || at >= PAGE_SIZE,
+ "invalid sysfs_emit_at: buf:%p at:%d\n", buf, at))
+ return 0;
+
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index c51ebce2197e0..79c6c3b4e0044 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -799,6 +799,7 @@ struct hid_driver {
+ * @raw_request: send raw report request to device (e.g. feature report)
+ * @output_report: send output report to device
+ * @idle: send idle request to device
++ * @max_buffer_size: over-ride maximum data buffer size (default: HID_MAX_BUFFER_SIZE)
+ */
+ struct hid_ll_driver {
+ int (*start)(struct hid_device *hdev);
+@@ -823,6 +824,8 @@ struct hid_ll_driver {
+ int (*output_report) (struct hid_device *hdev, __u8 *buf, size_t len);
+
+ int (*idle)(struct hid_device *hdev, int report, int idle, int reqtype);
++
++ unsigned int max_buffer_size;
+ };
+
+ extern struct hid_ll_driver i2c_hid_ll_driver;
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 8d48b352ee74f..4d0f48e74755d 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -260,9 +260,11 @@ struct hh_cache {
+ * relationship HH alignment <= LL alignment.
+ */
+ #define LL_RESERVED_SPACE(dev) \
+- ((((dev)->hard_header_len+(dev)->needed_headroom)&~(HH_DATA_MOD - 1)) + HH_DATA_MOD)
++ ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom)) \
++ & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD)
+ #define LL_RESERVED_SPACE_EXTRA(dev,extra) \
+- ((((dev)->hard_header_len+(dev)->needed_headroom+(extra))&~(HH_DATA_MOD - 1)) + HH_DATA_MOD)
++ ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom) + (extra)) \
++ & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD)
+
+ struct header_ops {
+ int (*create) (struct sk_buff *skb, struct net_device *dev,
+diff --git a/include/linux/sh_intc.h b/include/linux/sh_intc.h
+index c255273b02810..37ad81058d6ae 100644
+--- a/include/linux/sh_intc.h
++++ b/include/linux/sh_intc.h
+@@ -97,7 +97,10 @@ struct intc_hw_desc {
+ unsigned int nr_subgroups;
+ };
+
+-#define _INTC_ARRAY(a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a)
++#define _INTC_SIZEOF_OR_ZERO(a) (_Generic(a, \
++ typeof(NULL): 0, \
++ default: sizeof(a)))
++#define _INTC_ARRAY(a) a, _INTC_SIZEOF_OR_ZERO(a)/sizeof(*a)
+
+ #define INTC_HW_DESC(vectors, groups, mask_regs, \
+ prio_regs, sense_regs, ack_regs) \
+diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
+index 4251cbfdb3c8c..bff2f76aeff72 100644
+--- a/include/linux/tracepoint.h
++++ b/include/linux/tracepoint.h
+@@ -233,12 +233,11 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
+ * not add unwanted padding between the beginning of the section and the
+ * structure. Force alignment to the same alignment as the section start.
+ *
+- * When lockdep is enabled, we make sure to always do the RCU portions of
+- * the tracepoint code, regardless of whether tracing is on. However,
+- * don't check if the condition is false, due to interaction with idle
+- * instrumentation. This lets us find RCU issues triggered with tracepoints
+- * even when this tracepoint is off. This code has no purpose other than
+- * poking RCU a bit.
++ * When lockdep is enabled, we make sure to always test if RCU is
++ * "watching" regardless if the tracepoint is enabled or not. Tracepoints
++ * require RCU to be active, and it should always warn at the tracepoint
++ * site if it is not watching, as it will need to be active when the
++ * tracepoint is enabled.
+ */
+ #define __DECLARE_TRACE(name, proto, args, cond, data_proto, data_args) \
+ extern struct tracepoint __tracepoint_##name; \
+@@ -250,9 +249,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
+ TP_ARGS(data_args), \
+ TP_CONDITION(cond), 0); \
+ if (IS_ENABLED(CONFIG_LOCKDEP) && (cond)) { \
+- rcu_read_lock_sched_notrace(); \
+- rcu_dereference_sched(__tracepoint_##name.funcs);\
+- rcu_read_unlock_sched_notrace(); \
++ WARN_ON_ONCE(!rcu_is_watching()); \
+ } \
+ } \
+ __DECLARE_TRACE_RCU(name, PARAMS(proto), PARAMS(args), \
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 9c77955664362..5c0463dbe16ee 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1581,7 +1581,8 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end)
+ key.flags = end; /* overload flags, as it is unsigned long */
+
+ for (pg = ftrace_pages_start; pg; pg = pg->next) {
+- if (end < pg->records[0].ip ||
++ if (pg->index == 0 ||
++ end < pg->records[0].ip ||
+ start >= (pg->records[pg->index - 1].ip + MCOUNT_INSN_SIZE))
+ continue;
+ rec = bsearch(&key, pg->records, pg->index,
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index a56ee4ba2afbd..455cf41aedbbc 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -1764,6 +1764,9 @@ static const char *hist_field_name(struct hist_field *field,
+ {
+ const char *field_name = "";
+
++ if (WARN_ON_ONCE(!field))
++ return field_name;
++
+ if (level > 1)
+ return field_name;
+
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 1885a2fbad862..9aa48b4c40960 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -557,6 +557,9 @@ static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt,
+ cfg->fc_scope = RT_SCOPE_UNIVERSE;
+ }
+
++ if (!cfg->fc_table)
++ cfg->fc_table = RT_TABLE_MAIN;
++
+ if (cmd == SIOCDELRT)
+ return 0;
+
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 30e93b4f831f6..9c2381cf675d6 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -609,10 +609,10 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, u8 proto)
+ else if (skb->protocol == htons(ETH_P_IP))
+ df = inner_iph->frag_off & htons(IP_DF);
+ headroom += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len;
+- if (headroom > dev->needed_headroom)
+- dev->needed_headroom = headroom;
++ if (headroom > READ_ONCE(dev->needed_headroom))
++ WRITE_ONCE(dev->needed_headroom, headroom);
+
+- if (skb_cow_head(skb, dev->needed_headroom)) {
++ if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) {
+ ip_rt_put(rt);
+ goto tx_dropped;
+ }
+@@ -777,10 +777,10 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+
+ max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
+ + rt->dst.header_len + ip_encap_hlen(&tunnel->encap);
+- if (max_headroom > dev->needed_headroom)
+- dev->needed_headroom = max_headroom;
++ if (max_headroom > READ_ONCE(dev->needed_headroom))
++ WRITE_ONCE(dev->needed_headroom, max_headroom);
+
+- if (skb_cow_head(skb, dev->needed_headroom)) {
++ if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) {
+ ip_rt_put(rt);
+ dev->stats.tx_dropped++;
+ kfree_skb(skb);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 8962864223b43..9299de0da3514 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3307,7 +3307,7 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst,
+ th->window = htons(min(req->rsk_rcv_wnd, 65535U));
+ tcp_options_write((__be32 *)(th + 1), NULL, &opts);
+ th->doff = (tcp_header_size >> 2);
+- __TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
++ TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
+
+ #ifdef CONFIG_TCP_MD5SIG
+ /* Okay, we have all we need - do the md5 hash if needed */
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 75a1ec2605fca..48a658b541d75 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1206,8 +1206,8 @@ route_lookup:
+ */
+ max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr)
+ + dst->header_len + t->hlen;
+- if (max_headroom > dev->needed_headroom)
+- dev->needed_headroom = max_headroom;
++ if (max_headroom > READ_ONCE(dev->needed_headroom))
++ WRITE_ONCE(dev->needed_headroom, max_headroom);
+
+ err = ip6_tnl_encap(skb, t, &proto, fl6);
+ if (err)
+diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
+index eb502c6290c2a..aacaa5119b456 100644
+--- a/net/iucv/iucv.c
++++ b/net/iucv/iucv.c
+@@ -119,7 +119,7 @@ struct iucv_irq_data {
+ u16 ippathid;
+ u8 ipflags1;
+ u8 iptype;
+- u32 res2[8];
++ u32 res2[9];
+ };
+
+ struct iucv_irq_list {
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-04-05 11:41 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-04-05 11:41 UTC (permalink / raw
To: gentoo-commits
commit: 2f4ea79030128ddc0910fc37e001983cd09fff9a
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 5 11:40:49 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 5 11:40:49 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2f4ea790
Linux patch 4.19.280
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1279_linux-4.19.280.patch | 35831 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 35835 insertions(+)
diff --git a/0000_README b/0000_README
index be4133f5..8e42df41 100644
--- a/0000_README
+++ b/0000_README
@@ -1159,6 +1159,10 @@ Patch: 1278_linux-4.19.279.patch
From: https://www.kernel.org
Desc: Linux 4.19.279
+Patch: 1279_linux-4.19.280.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.280
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1279_linux-4.19.280.patch b/1279_linux-4.19.280.patch
new file mode 100644
index 00000000..19bf4a27
--- /dev/null
+++ b/1279_linux-4.19.280.patch
@@ -0,0 +1,35831 @@
+diff --git a/Documentation/networking/00-INDEX b/Documentation/networking/00-INDEX
+index 02a323c432612..2a9dbac38b4e9 100644
+--- a/Documentation/networking/00-INDEX
++++ b/Documentation/networking/00-INDEX
+@@ -94,8 +94,8 @@ gianfar.txt
+ - Gianfar Ethernet Driver.
+ i40e.txt
+ - README for the Intel Ethernet Controller XL710 Driver (i40e).
+-i40evf.txt
+- - Short note on the Driver for the Intel(R) XL710 X710 Virtual Function
++iavf.txt
++ - README for the Intel Ethernet Adaptive Virtual Function Driver (iavf).
+ ieee802154.txt
+ - Linux IEEE 802.15.4 implementation, API and drivers
+ igb.txt
+diff --git a/Documentation/networking/i40evf.txt b/Documentation/networking/i40evf.txt
+deleted file mode 100644
+index e9b3035b95d05..0000000000000
+--- a/Documentation/networking/i40evf.txt
++++ /dev/null
+@@ -1,54 +0,0 @@
+-Linux* Base Driver for Intel(R) Network Connection
+-==================================================
+-
+-Intel Ethernet Adaptive Virtual Function Linux driver.
+-Copyright(c) 2013-2017 Intel Corporation.
+-
+-Contents
+-========
+-
+-- Identifying Your Adapter
+-- Known Issues/Troubleshooting
+-- Support
+-
+-This file describes the i40evf Linux* Base Driver.
+-
+-The i40evf driver supports the below mentioned virtual function
+-devices and can only be activated on kernels running the i40e or
+-newer Physical Function (PF) driver compiled with CONFIG_PCI_IOV.
+-The i40evf driver requires CONFIG_PCI_MSI to be enabled.
+-
+-The guest OS loading the i40evf driver must support MSI-X interrupts.
+-
+-Supported Hardware
+-==================
+-Intel XL710 X710 Virtual Function
+-Intel Ethernet Adaptive Virtual Function
+-Intel X722 Virtual Function
+-
+-Identifying Your Adapter
+-========================
+-
+-For more information on how to identify your adapter, go to the
+-Adapter & Driver ID Guide at:
+-
+- http://support.intel.com/support/go/network/adapter/idguide.htm
+-
+-Known Issues/Troubleshooting
+-============================
+-
+-
+-Support
+-=======
+-
+-For general information, go to the Intel support website at:
+-
+- http://support.intel.com
+-
+-or the Intel Wired Networking project hosted by Sourceforge at:
+-
+- http://sourceforge.net/projects/e1000
+-
+-If an issue is identified with the released source code on the supported
+-kernel with a supported adapter, email the specific information related
+-to the issue to e1000-devel@lists.sf.net
+diff --git a/Documentation/networking/iavf.txt b/Documentation/networking/iavf.txt
+new file mode 100644
+index 0000000000000..cc902a2369d69
+--- /dev/null
++++ b/Documentation/networking/iavf.txt
+@@ -0,0 +1,56 @@
++Linux* Base Driver for Intel(R) Network Connection
++==================================================
++
++Intel Ethernet Adaptive Virtual Function Linux driver.
++Copyright(c) 2013-2018 Intel Corporation.
++
++Contents
++========
++
++- Identifying Your Adapter
++- Known Issues/Troubleshooting
++- Support
++
++This file describes the iavf Linux* Base Driver. This driver
++was formerly called i40evf.
++
++The iavf driver supports the below mentioned virtual function
++devices and can only be activated on kernels running the i40e or
++newer Physical Function (PF) driver compiled with CONFIG_PCI_IOV.
++The iavf driver requires CONFIG_PCI_MSI to be enabled.
++
++The guest OS loading the iavf driver must support MSI-X interrupts.
++
++Supported Hardware
++==================
++Intel XL710 X710 Virtual Function
++Intel X722 Virtual Function
++Intel Ethernet Adaptive Virtual Function
++
++Identifying Your Adapter
++========================
++
++For more information on how to identify your adapter, go to the
++Adapter & Driver ID Guide at:
++
++ https://www.intel.com/content/www/us/en/support/articles/000005584/network-and-i-o/ethernet-products.html
++
++
++Known Issues/Troubleshooting
++============================
++
++
++Support
++=======
++
++For general information, go to the Intel support website at:
++
++ http://support.intel.com
++
++or the Intel Wired Networking project hosted by Sourceforge at:
++
++ http://sourceforge.net/projects/e1000
++
++If an issue is identified with the released source code on the supported
++kernel with a supported adapter, email the specific information related
++to the issue to e1000-devel@lists.sf.net
+diff --git a/MAINTAINERS b/MAINTAINERS
+index af0f322cf2f7c..a8015db6b37eb 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -7377,7 +7377,7 @@ F: Documentation/networking/ixgb.txt
+ F: Documentation/networking/ixgbe.txt
+ F: Documentation/networking/ixgbevf.txt
+ F: Documentation/networking/i40e.txt
+-F: Documentation/networking/i40evf.txt
++F: Documentation/networking/iavf.txt
+ F: Documentation/networking/ice.txt
+ F: drivers/net/ethernet/intel/
+ F: drivers/net/ethernet/intel/*/
+diff --git a/Makefile b/Makefile
+index d6c4a53bf5053..c70637ed93cd1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 279
++SUBLEVEL = 280
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/m68k/kernel/traps.c b/arch/m68k/kernel/traps.c
+index 9b70a7f5e7058..35f706d836c50 100644
+--- a/arch/m68k/kernel/traps.c
++++ b/arch/m68k/kernel/traps.c
+@@ -30,6 +30,7 @@
+ #include <linux/init.h>
+ #include <linux/ptrace.h>
+ #include <linux/kallsyms.h>
++#include <linux/extable.h>
+
+ #include <asm/setup.h>
+ #include <asm/fpu.h>
+@@ -550,7 +551,8 @@ static inline void bus_error030 (struct frame *fp)
+ errorcode |= 2;
+
+ if (mmusr & (MMU_I | MMU_WP)) {
+- if (ssw & 4) {
++ /* We might have an exception table for this PC */
++ if (ssw & 4 && !search_exception_tables(fp->ptregs.pc)) {
+ pr_err("Data %s fault at %#010lx in %s (pc=%#lx)\n",
+ ssw & RW ? "read" : "write",
+ fp->un.fmtb.daddr,
+diff --git a/arch/riscv/include/uapi/asm/setup.h b/arch/riscv/include/uapi/asm/setup.h
+new file mode 100644
+index 0000000000000..66b13a5228808
+--- /dev/null
++++ b/arch/riscv/include/uapi/asm/setup.h
+@@ -0,0 +1,8 @@
++/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
++
++#ifndef _UAPI_ASM_RISCV_SETUP_H
++#define _UAPI_ASM_RISCV_SETUP_H
++
++#define COMMAND_LINE_SIZE 1024
++
++#endif /* _UAPI_ASM_RISCV_SETUP_H */
+diff --git a/arch/s390/lib/uaccess.c b/arch/s390/lib/uaccess.c
+index 0267405ab7c69..fcfd78f99cb4b 100644
+--- a/arch/s390/lib/uaccess.c
++++ b/arch/s390/lib/uaccess.c
+@@ -339,7 +339,7 @@ static inline unsigned long clear_user_mvcos(void __user *to, unsigned long size
+ "4: slgr %0,%0\n"
+ "5:\n"
+ EX_TABLE(0b,2b) EX_TABLE(3b,5b)
+- : "+a" (size), "+a" (to), "+a" (tmp1), "=a" (tmp2)
++ : "+&a" (size), "+&a" (to), "+a" (tmp1), "=&a" (tmp2)
+ : "a" (empty_zero_page), "d" (reg0) : "cc", "memory");
+ return size;
+ }
+diff --git a/arch/sh/include/asm/processor_32.h b/arch/sh/include/asm/processor_32.h
+index 95100d8a0b7b4..fc94603724b86 100644
+--- a/arch/sh/include/asm/processor_32.h
++++ b/arch/sh/include/asm/processor_32.h
+@@ -57,6 +57,7 @@
+ #define SR_FD 0x00008000
+ #define SR_MD 0x40000000
+
++#define SR_USER_MASK 0x00000303 // M, Q, S, T bits
+ /*
+ * DSP structure and data
+ */
+diff --git a/arch/sh/kernel/signal_32.c b/arch/sh/kernel/signal_32.c
+index c46c0020ff55e..ce93ae78c3002 100644
+--- a/arch/sh/kernel/signal_32.c
++++ b/arch/sh/kernel/signal_32.c
+@@ -116,6 +116,7 @@ static int
+ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_p)
+ {
+ unsigned int err = 0;
++ unsigned int sr = regs->sr & ~SR_USER_MASK;
+
+ #define COPY(x) err |= __get_user(regs->x, &sc->sc_##x)
+ COPY(regs[1]);
+@@ -131,6 +132,8 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_p
+ COPY(sr); COPY(pc);
+ #undef COPY
+
++ regs->sr = (regs->sr & SR_USER_MASK) | sr;
++
+ #ifdef CONFIG_SH_FPU
+ if (boot_cpu_data.flags & CPU_HAS_FPU) {
+ int owned_fp;
+diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
+index bc06f5919839c..3380322df98e0 100644
+--- a/drivers/atm/idt77252.c
++++ b/drivers/atm/idt77252.c
+@@ -2915,6 +2915,7 @@ close_card_oam(struct idt77252_dev *card)
+
+ recycle_rx_pool_skb(card, &vc->rcv.rx_pool);
+ }
++ kfree(vc);
+ }
+ }
+ }
+@@ -2958,6 +2959,15 @@ open_card_ubr0(struct idt77252_dev *card)
+ return 0;
+ }
+
++static void
++close_card_ubr0(struct idt77252_dev *card)
++{
++ struct vc_map *vc = card->vcs[0];
++
++ free_scq(card, vc->scq);
++ kfree(vc);
++}
++
+ static int
+ idt77252_dev_open(struct idt77252_dev *card)
+ {
+@@ -3007,6 +3017,7 @@ static void idt77252_dev_close(struct atm_dev *dev)
+ struct idt77252_dev *card = dev->dev_data;
+ u32 conf;
+
++ close_card_ubr0(card);
+ close_card_oam(card);
+
+ conf = SAR_CFG_RXPTH | /* enable receive path */
+diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c
+index 874172aa8e417..a698b1f6394b2 100644
+--- a/drivers/bluetooth/btqcomsmd.c
++++ b/drivers/bluetooth/btqcomsmd.c
+@@ -146,6 +146,21 @@ static int btqcomsmd_setup(struct hci_dev *hdev)
+ return 0;
+ }
+
++static int btqcomsmd_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
++{
++ int ret;
++
++ ret = qca_set_bdaddr_rome(hdev, bdaddr);
++ if (ret)
++ return ret;
++
++ /* The firmware stops responding for a while after setting the bdaddr,
++ * causing timeouts for subsequent commands. Sleep a bit to avoid this.
++ */
++ usleep_range(1000, 10000);
++ return 0;
++}
++
+ static int btqcomsmd_probe(struct platform_device *pdev)
+ {
+ struct btqcomsmd *btq;
+@@ -195,7 +210,7 @@ static int btqcomsmd_probe(struct platform_device *pdev)
+ hdev->close = btqcomsmd_close;
+ hdev->send = btqcomsmd_send;
+ hdev->setup = btqcomsmd_setup;
+- hdev->set_bdaddr = qca_set_bdaddr_rome;
++ hdev->set_bdaddr = btqcomsmd_set_bdaddr;
+
+ ret = hci_register_dev(hdev);
+ if (ret < 0)
+diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
+index 20142bc77554c..bd55bf7a9914c 100644
+--- a/drivers/bluetooth/btsdio.c
++++ b/drivers/bluetooth/btsdio.c
+@@ -353,6 +353,7 @@ static void btsdio_remove(struct sdio_func *func)
+
+ BT_DBG("func %p", func);
+
++ cancel_work_sync(&data->work);
+ if (!data)
+ return;
+
+diff --git a/drivers/bus/imx-weim.c b/drivers/bus/imx-weim.c
+index 6a94aa6a22c27..1a0f977904b68 100644
+--- a/drivers/bus/imx-weim.c
++++ b/drivers/bus/imx-weim.c
+@@ -146,8 +146,8 @@ static int __init weim_parse_dt(struct platform_device *pdev,
+ const struct of_device_id *of_id = of_match_device(weim_id_table,
+ &pdev->dev);
+ const struct imx_weim_devtype *devtype = of_id->data;
++ int ret = 0, have_child = 0;
+ struct device_node *child;
+- int ret, have_child = 0;
+
+ if (devtype == &imx50_weim_devtype) {
+ ret = imx_weim_gpr_setup(pdev);
+diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
+index e8cd66705ad7a..5ccbbb3eb68e1 100644
+--- a/drivers/firmware/arm_scmi/driver.c
++++ b/drivers/firmware/arm_scmi/driver.c
+@@ -705,6 +705,39 @@ static int scmi_remove(struct platform_device *pdev)
+ return ret;
+ }
+
++static int scmi_mailbox_chan_validate(struct device *cdev)
++{
++ int num_mb, num_sh, ret = 0;
++ struct device_node *np = cdev->of_node;
++
++ num_mb = of_count_phandle_with_args(np, "mboxes", "#mbox-cells");
++ num_sh = of_count_phandle_with_args(np, "shmem", NULL);
++ /* Bail out if mboxes and shmem descriptors are inconsistent */
++ if (num_mb <= 0 || num_sh > 2 || num_mb != num_sh) {
++ dev_warn(cdev, "Invalid channel descriptor for '%s'\n",
++ of_node_full_name(np));
++ return -EINVAL;
++ }
++
++ if (num_sh > 1) {
++ struct device_node *np_tx, *np_rx;
++
++ np_tx = of_parse_phandle(np, "shmem", 0);
++ np_rx = of_parse_phandle(np, "shmem", 1);
++ /* SCMI Tx and Rx shared mem areas have to be distinct */
++ if (!np_tx || !np_rx || np_tx == np_rx) {
++ dev_warn(cdev, "Invalid shmem descriptor for '%s'\n",
++ of_node_full_name(np));
++ ret = -EINVAL;
++ }
++
++ of_node_put(np_tx);
++ of_node_put(np_rx);
++ }
++
++ return ret;
++}
++
+ static inline int
+ scmi_mbox_chan_setup(struct scmi_info *info, struct device *dev, int prot_id)
+ {
+@@ -720,6 +753,10 @@ scmi_mbox_chan_setup(struct scmi_info *info, struct device *dev, int prot_id)
+ goto idr_alloc;
+ }
+
++ ret = scmi_mailbox_chan_validate(dev);
++ if (ret)
++ return ret;
++
+ cinfo = devm_kzalloc(info->dev, sizeof(*cinfo), GFP_KERNEL);
+ if (!cinfo)
+ return -ENOMEM;
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+index f21529e635e3d..a9506a390f98d 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+@@ -91,7 +91,15 @@ static void *etnaviv_gem_prime_vmap_impl(struct etnaviv_gem_object *etnaviv_obj)
+ static int etnaviv_gem_prime_mmap_obj(struct etnaviv_gem_object *etnaviv_obj,
+ struct vm_area_struct *vma)
+ {
+- return dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0);
++ int ret;
++
++ ret = dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0);
++ if (!ret) {
++ /* Drop the reference acquired by drm_gem_mmap_obj(). */
++ drm_gem_object_put(&etnaviv_obj->base);
++ }
++
++ return ret;
+ }
+
+ static const struct etnaviv_gem_ops etnaviv_gem_prime_ops = {
+diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
+index f8499cb95fec8..4e4e151760db2 100644
+--- a/drivers/hwmon/it87.c
++++ b/drivers/hwmon/it87.c
+@@ -495,6 +495,8 @@ static const struct it87_devices it87_devices[] = {
+ #define has_pwm_freq2(data) ((data)->features & FEAT_PWM_FREQ2)
+ #define has_six_temp(data) ((data)->features & FEAT_SIX_TEMP)
+ #define has_vin3_5v(data) ((data)->features & FEAT_VIN3_5V)
++#define has_scaling(data) ((data)->features & (FEAT_12MV_ADC | \
++ FEAT_10_9MV_ADC))
+
+ struct it87_sio_data {
+ int sioaddr;
+@@ -3107,7 +3109,7 @@ static int it87_probe(struct platform_device *pdev)
+ "Detected broken BIOS defaults, disabling PWM interface\n");
+
+ /* Starting with IT8721F, we handle scaling of internal voltages */
+- if (has_12mv_adc(data)) {
++ if (has_scaling(data)) {
+ if (sio_data->internal & BIT(0))
+ data->in_scaled |= BIT(3); /* in3 is AVCC */
+ if (sio_data->internal & BIT(1))
+diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
+index 06c4c767af322..90c510d166516 100644
+--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
+@@ -508,10 +508,14 @@ disable:
+ static irqreturn_t lpi2c_imx_isr(int irq, void *dev_id)
+ {
+ struct lpi2c_imx_struct *lpi2c_imx = dev_id;
++ unsigned int enabled;
+ unsigned int temp;
+
++ enabled = readl(lpi2c_imx->base + LPI2C_MIER);
++
+ lpi2c_imx_intctrl(lpi2c_imx, 0);
+ temp = readl(lpi2c_imx->base + LPI2C_MSR);
++ temp &= enabled;
+
+ if (temp & MSR_RDF)
+ lpi2c_imx_read_rxfifo(lpi2c_imx);
+diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c
+index a7ac746018ad0..7a746f4135351 100644
+--- a/drivers/i2c/busses/i2c-xgene-slimpro.c
++++ b/drivers/i2c/busses/i2c-xgene-slimpro.c
+@@ -321,6 +321,9 @@ static int slimpro_i2c_blkwr(struct slimpro_i2c_dev *ctx, u32 chip,
+ u32 msg[3];
+ int rc;
+
++ if (writelen > I2C_SMBUS_BLOCK_MAX)
++ return -EINVAL;
++
+ memcpy(ctx->dma_buffer, data, writelen);
+ paddr = dma_map_single(ctx->dev, ctx->dma_buffer, writelen,
+ DMA_TO_DEVICE);
+diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
+index dd80ff6cc4273..b53da63602352 100644
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -855,8 +855,8 @@ static void alps_process_packet_v6(struct psmouse *psmouse)
+ x = y = z = 0;
+
+ /* Divide 4 since trackpoint's speed is too fast */
+- input_report_rel(dev2, REL_X, (char)x / 4);
+- input_report_rel(dev2, REL_Y, -((char)y / 4));
++ input_report_rel(dev2, REL_X, (s8)x / 4);
++ input_report_rel(dev2, REL_Y, -((s8)y / 4));
+
+ psmouse_report_standard_buttons(dev2, packet[3]);
+
+@@ -1107,8 +1107,8 @@ static void alps_process_trackstick_packet_v7(struct psmouse *psmouse)
+ ((packet[3] & 0x20) << 1);
+ z = (packet[5] & 0x3f) | ((packet[3] & 0x80) >> 1);
+
+- input_report_rel(dev2, REL_X, (char)x);
+- input_report_rel(dev2, REL_Y, -((char)y));
++ input_report_rel(dev2, REL_X, (s8)x);
++ input_report_rel(dev2, REL_Y, -((s8)y));
+ input_report_abs(dev2, ABS_PRESSURE, z);
+
+ psmouse_report_standard_buttons(dev2, packet[1]);
+@@ -2297,20 +2297,20 @@ static int alps_get_v3_v7_resolution(struct psmouse *psmouse, int reg_pitch)
+ if (reg < 0)
+ return reg;
+
+- x_pitch = (char)(reg << 4) >> 4; /* sign extend lower 4 bits */
++ x_pitch = (s8)(reg << 4) >> 4; /* sign extend lower 4 bits */
+ x_pitch = 50 + 2 * x_pitch; /* In 0.1 mm units */
+
+- y_pitch = (char)reg >> 4; /* sign extend upper 4 bits */
++ y_pitch = (s8)reg >> 4; /* sign extend upper 4 bits */
+ y_pitch = 36 + 2 * y_pitch; /* In 0.1 mm units */
+
+ reg = alps_command_mode_read_reg(psmouse, reg_pitch + 1);
+ if (reg < 0)
+ return reg;
+
+- x_electrode = (char)(reg << 4) >> 4; /* sign extend lower 4 bits */
++ x_electrode = (s8)(reg << 4) >> 4; /* sign extend lower 4 bits */
+ x_electrode = 17 + x_electrode;
+
+- y_electrode = (char)reg >> 4; /* sign extend upper 4 bits */
++ y_electrode = (s8)reg >> 4; /* sign extend upper 4 bits */
+ y_electrode = 13 + y_electrode;
+
+ x_phys = x_pitch * (x_electrode - 1); /* In 0.1 mm units */
+diff --git a/drivers/input/mouse/focaltech.c b/drivers/input/mouse/focaltech.c
+index a7d39689bbfb6..4bd48b81ed980 100644
+--- a/drivers/input/mouse/focaltech.c
++++ b/drivers/input/mouse/focaltech.c
+@@ -206,8 +206,8 @@ static void focaltech_process_rel_packet(struct psmouse *psmouse,
+ state->pressed = packet[0] >> 7;
+ finger1 = ((packet[0] >> 4) & 0x7) - 1;
+ if (finger1 < FOC_MAX_FINGERS) {
+- state->fingers[finger1].x += (char)packet[1];
+- state->fingers[finger1].y += (char)packet[2];
++ state->fingers[finger1].x += (s8)packet[1];
++ state->fingers[finger1].y += (s8)packet[2];
+ } else {
+ psmouse_err(psmouse, "First finger in rel packet invalid: %d\n",
+ finger1);
+@@ -222,8 +222,8 @@ static void focaltech_process_rel_packet(struct psmouse *psmouse,
+ */
+ finger2 = ((packet[3] >> 4) & 0x7) - 1;
+ if (finger2 < FOC_MAX_FINGERS) {
+- state->fingers[finger2].x += (char)packet[4];
+- state->fingers[finger2].y += (char)packet[5];
++ state->fingers[finger2].x += (s8)packet[4];
++ state->fingers[finger2].y += (s8)packet[5];
+ }
+ }
+
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index e38c713e882e3..908bf07688275 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1661,6 +1661,7 @@ pop_from_list:
+ io = crypt_io_from_node(rb_first(&write_tree));
+ rb_erase(&io->rb_node, &write_tree);
+ kcryptd_io_write(io);
++ cond_resched();
+ } while (!RB_EMPTY_ROOT(&write_tree));
+ blk_finish_plug(&plug);
+ }
+diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
+index 3d59f3e208c50..0eb48e739f7ea 100644
+--- a/drivers/md/dm-stats.c
++++ b/drivers/md/dm-stats.c
+@@ -188,7 +188,7 @@ static int dm_stat_in_flight(struct dm_stat_shared *shared)
+ atomic_read(&shared->in_flight[WRITE]);
+ }
+
+-void dm_stats_init(struct dm_stats *stats)
++int dm_stats_init(struct dm_stats *stats)
+ {
+ int cpu;
+ struct dm_stats_last_position *last;
+@@ -196,11 +196,16 @@ void dm_stats_init(struct dm_stats *stats)
+ mutex_init(&stats->mutex);
+ INIT_LIST_HEAD(&stats->list);
+ stats->last = alloc_percpu(struct dm_stats_last_position);
++ if (!stats->last)
++ return -ENOMEM;
++
+ for_each_possible_cpu(cpu) {
+ last = per_cpu_ptr(stats->last, cpu);
+ last->last_sector = (sector_t)ULLONG_MAX;
+ last->last_rw = UINT_MAX;
+ }
++
++ return 0;
+ }
+
+ void dm_stats_cleanup(struct dm_stats *stats)
+diff --git a/drivers/md/dm-stats.h b/drivers/md/dm-stats.h
+index 2ddfae678f320..dcac11fce03bb 100644
+--- a/drivers/md/dm-stats.h
++++ b/drivers/md/dm-stats.h
+@@ -22,7 +22,7 @@ struct dm_stats_aux {
+ unsigned long long duration_ns;
+ };
+
+-void dm_stats_init(struct dm_stats *st);
++int dm_stats_init(struct dm_stats *st);
+ void dm_stats_cleanup(struct dm_stats *st);
+
+ struct mapped_device;
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 969ea013c74e4..a1bbf00e60e5f 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -3365,6 +3365,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ pt->low_water_blocks = low_water_blocks;
+ pt->adjusted_pf = pt->requested_pf = pf;
+ ti->num_flush_bios = 1;
++ ti->limit_swap_bios = true;
+
+ /*
+ * Only need to enable discards if the pool should pass
+@@ -4245,6 +4246,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ goto bad;
+
+ ti->num_flush_bios = 1;
++ ti->limit_swap_bios = true;
+ ti->flush_supported = true;
+ ti->per_io_data_size = sizeof(struct dm_thin_endio_hook);
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 3d9a77f4e20f8..9a9b2adcf39e3 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2021,7 +2021,9 @@ static struct mapped_device *alloc_dev(int minor)
+ bio_set_dev(&md->flush_bio, md->bdev);
+ md->flush_bio.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC;
+
+- dm_stats_init(&md->stats);
++ r = dm_stats_init(&md->stats);
++ if (r < 0)
++ goto bad;
+
+ /* Populate the mapping, nobody knows we exist yet */
+ spin_lock(&_minor_lock);
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 89d4dcc5253e5..f8c111b369928 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2991,6 +2991,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
+ err = kstrtouint(buf, 10, (unsigned int *)&slot);
+ if (err < 0)
+ return err;
++ if (slot < 0)
++ /* overflow */
++ return -ENOSPC;
+ }
+ if (rdev->mddev->pers && slot == -1) {
+ /* Setting 'slot' on an active array requires also
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index be064bcfd70a6..6b310f7235801 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2237,9 +2237,14 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+ * If this is the upstream port for this switch, enable
+ * forwarding of unknown unicasts and multicasts.
+ */
+- reg = MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP |
+- MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP |
++ reg = MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP |
+ MV88E6XXX_PORT_CTL0_STATE_FORWARDING;
++ /* Forward any IPv4 IGMP or IPv6 MLD frames received
++ * by a USER port to the CPU port to allow snooping.
++ */
++ if (dsa_is_user_port(ds, port))
++ reg |= MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP;
++
+ err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_CTL0, reg);
+ if (err)
+ return err;
+diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
+index 1ab613eb57964..b542aba6f0e86 100644
+--- a/drivers/net/ethernet/intel/Kconfig
++++ b/drivers/net/ethernet/intel/Kconfig
+@@ -235,20 +235,27 @@ config I40E_DCB
+
+ If unsure, say N.
+
++# this is here to allow seamless migration from I40EVF --> IAVF name
++# so that CONFIG_IAVF symbol will always mirror the state of CONFIG_I40EVF
++config IAVF
++ tristate
+ config I40EVF
+ tristate "Intel(R) Ethernet Adaptive Virtual Function support"
++ select IAVF
+ depends on PCI_MSI
+ ---help---
+ This driver supports virtual functions for Intel XL710,
+- X710, X722, and all devices advertising support for Intel
+- Ethernet Adaptive Virtual Function devices. For more
++ X710, X722, XXV710, and all devices advertising support for
++ Intel Ethernet Adaptive Virtual Function devices. For more
+ information on how to identify your adapter, go to the Adapter
+ & Driver ID Guide that can be located at:
+
+- <http://support.intel.com>
++ <https://support.intel.com>
++
++ This driver was formerly named i40evf.
+
+ To compile this driver as a module, choose M here. The module
+- will be called i40evf. MSI-X interrupt support is required
++ will be called iavf. MSI-X interrupt support is required
+ for this driver to work correctly.
+
+ config ICE
+diff --git a/drivers/net/ethernet/intel/Makefile b/drivers/net/ethernet/intel/Makefile
+index 807a4f8c7e4ef..b91153df6ee8d 100644
+--- a/drivers/net/ethernet/intel/Makefile
++++ b/drivers/net/ethernet/intel/Makefile
+@@ -12,6 +12,6 @@ obj-$(CONFIG_IXGBE) += ixgbe/
+ obj-$(CONFIG_IXGBEVF) += ixgbevf/
+ obj-$(CONFIG_I40E) += i40e/
+ obj-$(CONFIG_IXGB) += ixgb/
+-obj-$(CONFIG_I40EVF) += i40evf/
++obj-$(CONFIG_IAVF) += iavf/
+ obj-$(CONFIG_FM10K) += fm10k/
+ obj-$(CONFIG_ICE) += ice/
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.c b/drivers/net/ethernet/intel/i40e/i40e_diag.c
+index ef4d3762bf371..ca229b0efeb65 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_diag.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.c
+@@ -44,7 +44,7 @@ static i40e_status i40e_diag_reg_pattern_test(struct i40e_hw *hw,
+ return 0;
+ }
+
+-struct i40e_diag_reg_test_info i40e_reg_list[] = {
++const struct i40e_diag_reg_test_info i40e_reg_list[] = {
+ /* offset mask elements stride */
+ {I40E_QTX_CTL(0), 0x0000FFBF, 1,
+ I40E_QTX_CTL(1) - I40E_QTX_CTL(0)},
+@@ -78,27 +78,28 @@ i40e_status i40e_diag_reg_test(struct i40e_hw *hw)
+ {
+ i40e_status ret_code = 0;
+ u32 reg, mask;
++ u32 elements;
+ u32 i, j;
+
+ for (i = 0; i40e_reg_list[i].offset != 0 &&
+ !ret_code; i++) {
+
++ elements = i40e_reg_list[i].elements;
+ /* set actual reg range for dynamically allocated resources */
+ if (i40e_reg_list[i].offset == I40E_QTX_CTL(0) &&
+ hw->func_caps.num_tx_qp != 0)
+- i40e_reg_list[i].elements = hw->func_caps.num_tx_qp;
++ elements = hw->func_caps.num_tx_qp;
+ if ((i40e_reg_list[i].offset == I40E_PFINT_ITRN(0, 0) ||
+ i40e_reg_list[i].offset == I40E_PFINT_ITRN(1, 0) ||
+ i40e_reg_list[i].offset == I40E_PFINT_ITRN(2, 0) ||
+ i40e_reg_list[i].offset == I40E_QINT_TQCTL(0) ||
+ i40e_reg_list[i].offset == I40E_QINT_RQCTL(0)) &&
+ hw->func_caps.num_msix_vectors != 0)
+- i40e_reg_list[i].elements =
+- hw->func_caps.num_msix_vectors - 1;
++ elements = hw->func_caps.num_msix_vectors - 1;
+
+ /* test register access */
+ mask = i40e_reg_list[i].mask;
+- for (j = 0; j < i40e_reg_list[i].elements && !ret_code; j++) {
++ for (j = 0; j < elements && !ret_code; j++) {
+ reg = i40e_reg_list[i].offset +
+ (j * i40e_reg_list[i].stride);
+ ret_code = i40e_diag_reg_pattern_test(hw, reg, mask);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.h b/drivers/net/ethernet/intel/i40e/i40e_diag.h
+index c3340f320a18c..1db7c6d572311 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_diag.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.h
+@@ -20,7 +20,7 @@ struct i40e_diag_reg_test_info {
+ u32 stride; /* bytes between each element */
+ };
+
+-extern struct i40e_diag_reg_test_info i40e_reg_list[];
++extern const struct i40e_diag_reg_test_info i40e_reg_list[];
+
+ i40e_status i40e_diag_reg_test(struct i40e_hw *hw);
+ i40e_status i40e_diag_eeprom_test(struct i40e_hw *hw);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 240083201dbf4..1527c67b487b2 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2595,7 +2595,7 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
+ !is_multicast_ether_addr(addr) && vf->pf_set_mac &&
+ !ether_addr_equal(addr, vf->default_lan_addr.addr)) {
+ dev_err(&pf->pdev->dev,
+- "VF attempting to override administratively set MAC address, reload the VF driver to resume normal operation\n");
++ "VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation\n");
+ return -EPERM;
+ }
+ }
+@@ -4019,9 +4019,11 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+ mac, vf_id);
+ }
+
+- /* Force the VF driver stop so it has to reload with new MAC address */
++ /* Force the VF interface down so it has to bring up with new MAC
++ * address
++ */
+ i40e_vc_disable_vf(vf);
+- dev_info(&pf->pdev->dev, "Reload the VF driver to make this change effective.\n");
++ dev_info(&pf->pdev->dev, "Bring down and up the VF interface to make this change effective.\n");
+
+ error_param:
+ return ret;
+diff --git a/drivers/net/ethernet/intel/i40evf/Makefile b/drivers/net/ethernet/intel/i40evf/Makefile
+deleted file mode 100644
+index 3c5c6e9622805..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/Makefile
++++ /dev/null
+@@ -1,16 +0,0 @@
+-# SPDX-License-Identifier: GPL-2.0
+-# Copyright(c) 2013 - 2018 Intel Corporation.
+-
+-#
+-## Makefile for the Intel(R) 40GbE VF driver
+-#
+-#
+-
+-ccflags-y += -I$(src)
+-subdir-ccflags-y += -I$(src)
+-
+-obj-$(CONFIG_I40EVF) += i40evf.o
+-
+-i40evf-objs := i40evf_main.o i40evf_ethtool.o i40evf_virtchnl.o \
+- i40e_txrx.o i40e_common.o i40e_adminq.o i40evf_client.o
+-
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_adminq.c b/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
+deleted file mode 100644
+index 21a0dbf6ccf61..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
++++ /dev/null
+@@ -1,967 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#include "i40e_status.h"
+-#include "i40e_type.h"
+-#include "i40e_register.h"
+-#include "i40e_adminq.h"
+-#include "i40e_prototype.h"
+-
+-/**
+- * i40e_is_nvm_update_op - return true if this is an NVM update operation
+- * @desc: API request descriptor
+- **/
+-static inline bool i40e_is_nvm_update_op(struct i40e_aq_desc *desc)
+-{
+- return (desc->opcode == i40e_aqc_opc_nvm_erase) ||
+- (desc->opcode == i40e_aqc_opc_nvm_update);
+-}
+-
+-/**
+- * i40e_adminq_init_regs - Initialize AdminQ registers
+- * @hw: pointer to the hardware structure
+- *
+- * This assumes the alloc_asq and alloc_arq functions have already been called
+- **/
+-static void i40e_adminq_init_regs(struct i40e_hw *hw)
+-{
+- /* set head and tail registers in our local struct */
+- if (i40e_is_vf(hw)) {
+- hw->aq.asq.tail = I40E_VF_ATQT1;
+- hw->aq.asq.head = I40E_VF_ATQH1;
+- hw->aq.asq.len = I40E_VF_ATQLEN1;
+- hw->aq.asq.bal = I40E_VF_ATQBAL1;
+- hw->aq.asq.bah = I40E_VF_ATQBAH1;
+- hw->aq.arq.tail = I40E_VF_ARQT1;
+- hw->aq.arq.head = I40E_VF_ARQH1;
+- hw->aq.arq.len = I40E_VF_ARQLEN1;
+- hw->aq.arq.bal = I40E_VF_ARQBAL1;
+- hw->aq.arq.bah = I40E_VF_ARQBAH1;
+- }
+-}
+-
+-/**
+- * i40e_alloc_adminq_asq_ring - Allocate Admin Queue send rings
+- * @hw: pointer to the hardware structure
+- **/
+-static i40e_status i40e_alloc_adminq_asq_ring(struct i40e_hw *hw)
+-{
+- i40e_status ret_code;
+-
+- ret_code = i40e_allocate_dma_mem(hw, &hw->aq.asq.desc_buf,
+- i40e_mem_atq_ring,
+- (hw->aq.num_asq_entries *
+- sizeof(struct i40e_aq_desc)),
+- I40E_ADMINQ_DESC_ALIGNMENT);
+- if (ret_code)
+- return ret_code;
+-
+- ret_code = i40e_allocate_virt_mem(hw, &hw->aq.asq.cmd_buf,
+- (hw->aq.num_asq_entries *
+- sizeof(struct i40e_asq_cmd_details)));
+- if (ret_code) {
+- i40e_free_dma_mem(hw, &hw->aq.asq.desc_buf);
+- return ret_code;
+- }
+-
+- return ret_code;
+-}
+-
+-/**
+- * i40e_alloc_adminq_arq_ring - Allocate Admin Queue receive rings
+- * @hw: pointer to the hardware structure
+- **/
+-static i40e_status i40e_alloc_adminq_arq_ring(struct i40e_hw *hw)
+-{
+- i40e_status ret_code;
+-
+- ret_code = i40e_allocate_dma_mem(hw, &hw->aq.arq.desc_buf,
+- i40e_mem_arq_ring,
+- (hw->aq.num_arq_entries *
+- sizeof(struct i40e_aq_desc)),
+- I40E_ADMINQ_DESC_ALIGNMENT);
+-
+- return ret_code;
+-}
+-
+-/**
+- * i40e_free_adminq_asq - Free Admin Queue send rings
+- * @hw: pointer to the hardware structure
+- *
+- * This assumes the posted send buffers have already been cleaned
+- * and de-allocated
+- **/
+-static void i40e_free_adminq_asq(struct i40e_hw *hw)
+-{
+- i40e_free_dma_mem(hw, &hw->aq.asq.desc_buf);
+-}
+-
+-/**
+- * i40e_free_adminq_arq - Free Admin Queue receive rings
+- * @hw: pointer to the hardware structure
+- *
+- * This assumes the posted receive buffers have already been cleaned
+- * and de-allocated
+- **/
+-static void i40e_free_adminq_arq(struct i40e_hw *hw)
+-{
+- i40e_free_dma_mem(hw, &hw->aq.arq.desc_buf);
+-}
+-
+-/**
+- * i40e_alloc_arq_bufs - Allocate pre-posted buffers for the receive queue
+- * @hw: pointer to the hardware structure
+- **/
+-static i40e_status i40e_alloc_arq_bufs(struct i40e_hw *hw)
+-{
+- i40e_status ret_code;
+- struct i40e_aq_desc *desc;
+- struct i40e_dma_mem *bi;
+- int i;
+-
+- /* We'll be allocating the buffer info memory first, then we can
+- * allocate the mapped buffers for the event processing
+- */
+-
+- /* buffer_info structures do not need alignment */
+- ret_code = i40e_allocate_virt_mem(hw, &hw->aq.arq.dma_head,
+- (hw->aq.num_arq_entries * sizeof(struct i40e_dma_mem)));
+- if (ret_code)
+- goto alloc_arq_bufs;
+- hw->aq.arq.r.arq_bi = (struct i40e_dma_mem *)hw->aq.arq.dma_head.va;
+-
+- /* allocate the mapped buffers */
+- for (i = 0; i < hw->aq.num_arq_entries; i++) {
+- bi = &hw->aq.arq.r.arq_bi[i];
+- ret_code = i40e_allocate_dma_mem(hw, bi,
+- i40e_mem_arq_buf,
+- hw->aq.arq_buf_size,
+- I40E_ADMINQ_DESC_ALIGNMENT);
+- if (ret_code)
+- goto unwind_alloc_arq_bufs;
+-
+- /* now configure the descriptors for use */
+- desc = I40E_ADMINQ_DESC(hw->aq.arq, i);
+-
+- desc->flags = cpu_to_le16(I40E_AQ_FLAG_BUF);
+- if (hw->aq.arq_buf_size > I40E_AQ_LARGE_BUF)
+- desc->flags |= cpu_to_le16(I40E_AQ_FLAG_LB);
+- desc->opcode = 0;
+- /* This is in accordance with Admin queue design, there is no
+- * register for buffer size configuration
+- */
+- desc->datalen = cpu_to_le16((u16)bi->size);
+- desc->retval = 0;
+- desc->cookie_high = 0;
+- desc->cookie_low = 0;
+- desc->params.external.addr_high =
+- cpu_to_le32(upper_32_bits(bi->pa));
+- desc->params.external.addr_low =
+- cpu_to_le32(lower_32_bits(bi->pa));
+- desc->params.external.param0 = 0;
+- desc->params.external.param1 = 0;
+- }
+-
+-alloc_arq_bufs:
+- return ret_code;
+-
+-unwind_alloc_arq_bufs:
+- /* don't try to free the one that failed... */
+- i--;
+- for (; i >= 0; i--)
+- i40e_free_dma_mem(hw, &hw->aq.arq.r.arq_bi[i]);
+- i40e_free_virt_mem(hw, &hw->aq.arq.dma_head);
+-
+- return ret_code;
+-}
+-
+-/**
+- * i40e_alloc_asq_bufs - Allocate empty buffer structs for the send queue
+- * @hw: pointer to the hardware structure
+- **/
+-static i40e_status i40e_alloc_asq_bufs(struct i40e_hw *hw)
+-{
+- i40e_status ret_code;
+- struct i40e_dma_mem *bi;
+- int i;
+-
+- /* No mapped memory needed yet, just the buffer info structures */
+- ret_code = i40e_allocate_virt_mem(hw, &hw->aq.asq.dma_head,
+- (hw->aq.num_asq_entries * sizeof(struct i40e_dma_mem)));
+- if (ret_code)
+- goto alloc_asq_bufs;
+- hw->aq.asq.r.asq_bi = (struct i40e_dma_mem *)hw->aq.asq.dma_head.va;
+-
+- /* allocate the mapped buffers */
+- for (i = 0; i < hw->aq.num_asq_entries; i++) {
+- bi = &hw->aq.asq.r.asq_bi[i];
+- ret_code = i40e_allocate_dma_mem(hw, bi,
+- i40e_mem_asq_buf,
+- hw->aq.asq_buf_size,
+- I40E_ADMINQ_DESC_ALIGNMENT);
+- if (ret_code)
+- goto unwind_alloc_asq_bufs;
+- }
+-alloc_asq_bufs:
+- return ret_code;
+-
+-unwind_alloc_asq_bufs:
+- /* don't try to free the one that failed... */
+- i--;
+- for (; i >= 0; i--)
+- i40e_free_dma_mem(hw, &hw->aq.asq.r.asq_bi[i]);
+- i40e_free_virt_mem(hw, &hw->aq.asq.dma_head);
+-
+- return ret_code;
+-}
+-
+-/**
+- * i40e_free_arq_bufs - Free receive queue buffer info elements
+- * @hw: pointer to the hardware structure
+- **/
+-static void i40e_free_arq_bufs(struct i40e_hw *hw)
+-{
+- int i;
+-
+- /* free descriptors */
+- for (i = 0; i < hw->aq.num_arq_entries; i++)
+- i40e_free_dma_mem(hw, &hw->aq.arq.r.arq_bi[i]);
+-
+- /* free the descriptor memory */
+- i40e_free_dma_mem(hw, &hw->aq.arq.desc_buf);
+-
+- /* free the dma header */
+- i40e_free_virt_mem(hw, &hw->aq.arq.dma_head);
+-}
+-
+-/**
+- * i40e_free_asq_bufs - Free send queue buffer info elements
+- * @hw: pointer to the hardware structure
+- **/
+-static void i40e_free_asq_bufs(struct i40e_hw *hw)
+-{
+- int i;
+-
+- /* only unmap if the address is non-NULL */
+- for (i = 0; i < hw->aq.num_asq_entries; i++)
+- if (hw->aq.asq.r.asq_bi[i].pa)
+- i40e_free_dma_mem(hw, &hw->aq.asq.r.asq_bi[i]);
+-
+- /* free the buffer info list */
+- i40e_free_virt_mem(hw, &hw->aq.asq.cmd_buf);
+-
+- /* free the descriptor memory */
+- i40e_free_dma_mem(hw, &hw->aq.asq.desc_buf);
+-
+- /* free the dma header */
+- i40e_free_virt_mem(hw, &hw->aq.asq.dma_head);
+-}
+-
+-/**
+- * i40e_config_asq_regs - configure ASQ registers
+- * @hw: pointer to the hardware structure
+- *
+- * Configure base address and length registers for the transmit queue
+- **/
+-static i40e_status i40e_config_asq_regs(struct i40e_hw *hw)
+-{
+- i40e_status ret_code = 0;
+- u32 reg = 0;
+-
+- /* Clear Head and Tail */
+- wr32(hw, hw->aq.asq.head, 0);
+- wr32(hw, hw->aq.asq.tail, 0);
+-
+- /* set starting point */
+- wr32(hw, hw->aq.asq.len, (hw->aq.num_asq_entries |
+- I40E_VF_ATQLEN1_ATQENABLE_MASK));
+- wr32(hw, hw->aq.asq.bal, lower_32_bits(hw->aq.asq.desc_buf.pa));
+- wr32(hw, hw->aq.asq.bah, upper_32_bits(hw->aq.asq.desc_buf.pa));
+-
+- /* Check one register to verify that config was applied */
+- reg = rd32(hw, hw->aq.asq.bal);
+- if (reg != lower_32_bits(hw->aq.asq.desc_buf.pa))
+- ret_code = I40E_ERR_ADMIN_QUEUE_ERROR;
+-
+- return ret_code;
+-}
+-
+-/**
+- * i40e_config_arq_regs - ARQ register configuration
+- * @hw: pointer to the hardware structure
+- *
+- * Configure base address and length registers for the receive (event queue)
+- **/
+-static i40e_status i40e_config_arq_regs(struct i40e_hw *hw)
+-{
+- i40e_status ret_code = 0;
+- u32 reg = 0;
+-
+- /* Clear Head and Tail */
+- wr32(hw, hw->aq.arq.head, 0);
+- wr32(hw, hw->aq.arq.tail, 0);
+-
+- /* set starting point */
+- wr32(hw, hw->aq.arq.len, (hw->aq.num_arq_entries |
+- I40E_VF_ARQLEN1_ARQENABLE_MASK));
+- wr32(hw, hw->aq.arq.bal, lower_32_bits(hw->aq.arq.desc_buf.pa));
+- wr32(hw, hw->aq.arq.bah, upper_32_bits(hw->aq.arq.desc_buf.pa));
+-
+- /* Update tail in the HW to post pre-allocated buffers */
+- wr32(hw, hw->aq.arq.tail, hw->aq.num_arq_entries - 1);
+-
+- /* Check one register to verify that config was applied */
+- reg = rd32(hw, hw->aq.arq.bal);
+- if (reg != lower_32_bits(hw->aq.arq.desc_buf.pa))
+- ret_code = I40E_ERR_ADMIN_QUEUE_ERROR;
+-
+- return ret_code;
+-}
+-
+-/**
+- * i40e_init_asq - main initialization routine for ASQ
+- * @hw: pointer to the hardware structure
+- *
+- * This is the main initialization routine for the Admin Send Queue
+- * Prior to calling this function, drivers *MUST* set the following fields
+- * in the hw->aq structure:
+- * - hw->aq.num_asq_entries
+- * - hw->aq.arq_buf_size
+- *
+- * Do *NOT* hold the lock when calling this as the memory allocation routines
+- * called are not going to be atomic context safe
+- **/
+-static i40e_status i40e_init_asq(struct i40e_hw *hw)
+-{
+- i40e_status ret_code = 0;
+-
+- if (hw->aq.asq.count > 0) {
+- /* queue already initialized */
+- ret_code = I40E_ERR_NOT_READY;
+- goto init_adminq_exit;
+- }
+-
+- /* verify input for valid configuration */
+- if ((hw->aq.num_asq_entries == 0) ||
+- (hw->aq.asq_buf_size == 0)) {
+- ret_code = I40E_ERR_CONFIG;
+- goto init_adminq_exit;
+- }
+-
+- hw->aq.asq.next_to_use = 0;
+- hw->aq.asq.next_to_clean = 0;
+-
+- /* allocate the ring memory */
+- ret_code = i40e_alloc_adminq_asq_ring(hw);
+- if (ret_code)
+- goto init_adminq_exit;
+-
+- /* allocate buffers in the rings */
+- ret_code = i40e_alloc_asq_bufs(hw);
+- if (ret_code)
+- goto init_adminq_free_rings;
+-
+- /* initialize base registers */
+- ret_code = i40e_config_asq_regs(hw);
+- if (ret_code)
+- goto init_adminq_free_rings;
+-
+- /* success! */
+- hw->aq.asq.count = hw->aq.num_asq_entries;
+- goto init_adminq_exit;
+-
+-init_adminq_free_rings:
+- i40e_free_adminq_asq(hw);
+-
+-init_adminq_exit:
+- return ret_code;
+-}
+-
+-/**
+- * i40e_init_arq - initialize ARQ
+- * @hw: pointer to the hardware structure
+- *
+- * The main initialization routine for the Admin Receive (Event) Queue.
+- * Prior to calling this function, drivers *MUST* set the following fields
+- * in the hw->aq structure:
+- * - hw->aq.num_asq_entries
+- * - hw->aq.arq_buf_size
+- *
+- * Do *NOT* hold the lock when calling this as the memory allocation routines
+- * called are not going to be atomic context safe
+- **/
+-static i40e_status i40e_init_arq(struct i40e_hw *hw)
+-{
+- i40e_status ret_code = 0;
+-
+- if (hw->aq.arq.count > 0) {
+- /* queue already initialized */
+- ret_code = I40E_ERR_NOT_READY;
+- goto init_adminq_exit;
+- }
+-
+- /* verify input for valid configuration */
+- if ((hw->aq.num_arq_entries == 0) ||
+- (hw->aq.arq_buf_size == 0)) {
+- ret_code = I40E_ERR_CONFIG;
+- goto init_adminq_exit;
+- }
+-
+- hw->aq.arq.next_to_use = 0;
+- hw->aq.arq.next_to_clean = 0;
+-
+- /* allocate the ring memory */
+- ret_code = i40e_alloc_adminq_arq_ring(hw);
+- if (ret_code)
+- goto init_adminq_exit;
+-
+- /* allocate buffers in the rings */
+- ret_code = i40e_alloc_arq_bufs(hw);
+- if (ret_code)
+- goto init_adminq_free_rings;
+-
+- /* initialize base registers */
+- ret_code = i40e_config_arq_regs(hw);
+- if (ret_code)
+- goto init_adminq_free_rings;
+-
+- /* success! */
+- hw->aq.arq.count = hw->aq.num_arq_entries;
+- goto init_adminq_exit;
+-
+-init_adminq_free_rings:
+- i40e_free_adminq_arq(hw);
+-
+-init_adminq_exit:
+- return ret_code;
+-}
+-
+-/**
+- * i40e_shutdown_asq - shutdown the ASQ
+- * @hw: pointer to the hardware structure
+- *
+- * The main shutdown routine for the Admin Send Queue
+- **/
+-static i40e_status i40e_shutdown_asq(struct i40e_hw *hw)
+-{
+- i40e_status ret_code = 0;
+-
+- mutex_lock(&hw->aq.asq_mutex);
+-
+- if (hw->aq.asq.count == 0) {
+- ret_code = I40E_ERR_NOT_READY;
+- goto shutdown_asq_out;
+- }
+-
+- /* Stop firmware AdminQ processing */
+- wr32(hw, hw->aq.asq.head, 0);
+- wr32(hw, hw->aq.asq.tail, 0);
+- wr32(hw, hw->aq.asq.len, 0);
+- wr32(hw, hw->aq.asq.bal, 0);
+- wr32(hw, hw->aq.asq.bah, 0);
+-
+- hw->aq.asq.count = 0; /* to indicate uninitialized queue */
+-
+- /* free ring buffers */
+- i40e_free_asq_bufs(hw);
+-
+-shutdown_asq_out:
+- mutex_unlock(&hw->aq.asq_mutex);
+- return ret_code;
+-}
+-
+-/**
+- * i40e_shutdown_arq - shutdown ARQ
+- * @hw: pointer to the hardware structure
+- *
+- * The main shutdown routine for the Admin Receive Queue
+- **/
+-static i40e_status i40e_shutdown_arq(struct i40e_hw *hw)
+-{
+- i40e_status ret_code = 0;
+-
+- mutex_lock(&hw->aq.arq_mutex);
+-
+- if (hw->aq.arq.count == 0) {
+- ret_code = I40E_ERR_NOT_READY;
+- goto shutdown_arq_out;
+- }
+-
+- /* Stop firmware AdminQ processing */
+- wr32(hw, hw->aq.arq.head, 0);
+- wr32(hw, hw->aq.arq.tail, 0);
+- wr32(hw, hw->aq.arq.len, 0);
+- wr32(hw, hw->aq.arq.bal, 0);
+- wr32(hw, hw->aq.arq.bah, 0);
+-
+- hw->aq.arq.count = 0; /* to indicate uninitialized queue */
+-
+- /* free ring buffers */
+- i40e_free_arq_bufs(hw);
+-
+-shutdown_arq_out:
+- mutex_unlock(&hw->aq.arq_mutex);
+- return ret_code;
+-}
+-
+-/**
+- * i40evf_init_adminq - main initialization routine for Admin Queue
+- * @hw: pointer to the hardware structure
+- *
+- * Prior to calling this function, drivers *MUST* set the following fields
+- * in the hw->aq structure:
+- * - hw->aq.num_asq_entries
+- * - hw->aq.num_arq_entries
+- * - hw->aq.arq_buf_size
+- * - hw->aq.asq_buf_size
+- **/
+-i40e_status i40evf_init_adminq(struct i40e_hw *hw)
+-{
+- i40e_status ret_code;
+-
+- /* verify input for valid configuration */
+- if ((hw->aq.num_arq_entries == 0) ||
+- (hw->aq.num_asq_entries == 0) ||
+- (hw->aq.arq_buf_size == 0) ||
+- (hw->aq.asq_buf_size == 0)) {
+- ret_code = I40E_ERR_CONFIG;
+- goto init_adminq_exit;
+- }
+-
+- /* Set up register offsets */
+- i40e_adminq_init_regs(hw);
+-
+- /* setup ASQ command write back timeout */
+- hw->aq.asq_cmd_timeout = I40E_ASQ_CMD_TIMEOUT;
+-
+- /* allocate the ASQ */
+- ret_code = i40e_init_asq(hw);
+- if (ret_code)
+- goto init_adminq_destroy_locks;
+-
+- /* allocate the ARQ */
+- ret_code = i40e_init_arq(hw);
+- if (ret_code)
+- goto init_adminq_free_asq;
+-
+- /* success! */
+- goto init_adminq_exit;
+-
+-init_adminq_free_asq:
+- i40e_shutdown_asq(hw);
+-init_adminq_destroy_locks:
+-
+-init_adminq_exit:
+- return ret_code;
+-}
+-
+-/**
+- * i40evf_shutdown_adminq - shutdown routine for the Admin Queue
+- * @hw: pointer to the hardware structure
+- **/
+-i40e_status i40evf_shutdown_adminq(struct i40e_hw *hw)
+-{
+- i40e_status ret_code = 0;
+-
+- if (i40evf_check_asq_alive(hw))
+- i40evf_aq_queue_shutdown(hw, true);
+-
+- i40e_shutdown_asq(hw);
+- i40e_shutdown_arq(hw);
+-
+- if (hw->nvm_buff.va)
+- i40e_free_virt_mem(hw, &hw->nvm_buff);
+-
+- return ret_code;
+-}
+-
+-/**
+- * i40e_clean_asq - cleans Admin send queue
+- * @hw: pointer to the hardware structure
+- *
+- * returns the number of free desc
+- **/
+-static u16 i40e_clean_asq(struct i40e_hw *hw)
+-{
+- struct i40e_adminq_ring *asq = &(hw->aq.asq);
+- struct i40e_asq_cmd_details *details;
+- u16 ntc = asq->next_to_clean;
+- struct i40e_aq_desc desc_cb;
+- struct i40e_aq_desc *desc;
+-
+- desc = I40E_ADMINQ_DESC(*asq, ntc);
+- details = I40E_ADMINQ_DETAILS(*asq, ntc);
+- while (rd32(hw, hw->aq.asq.head) != ntc) {
+- i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
+- "ntc %d head %d.\n", ntc, rd32(hw, hw->aq.asq.head));
+-
+- if (details->callback) {
+- I40E_ADMINQ_CALLBACK cb_func =
+- (I40E_ADMINQ_CALLBACK)details->callback;
+- desc_cb = *desc;
+- cb_func(hw, &desc_cb);
+- }
+- memset((void *)desc, 0, sizeof(struct i40e_aq_desc));
+- memset((void *)details, 0,
+- sizeof(struct i40e_asq_cmd_details));
+- ntc++;
+- if (ntc == asq->count)
+- ntc = 0;
+- desc = I40E_ADMINQ_DESC(*asq, ntc);
+- details = I40E_ADMINQ_DETAILS(*asq, ntc);
+- }
+-
+- asq->next_to_clean = ntc;
+-
+- return I40E_DESC_UNUSED(asq);
+-}
+-
+-/**
+- * i40evf_asq_done - check if FW has processed the Admin Send Queue
+- * @hw: pointer to the hw struct
+- *
+- * Returns true if the firmware has processed all descriptors on the
+- * admin send queue. Returns false if there are still requests pending.
+- **/
+-bool i40evf_asq_done(struct i40e_hw *hw)
+-{
+- /* AQ designers suggest use of head for better
+- * timing reliability than DD bit
+- */
+- return rd32(hw, hw->aq.asq.head) == hw->aq.asq.next_to_use;
+-
+-}
+-
+-/**
+- * i40evf_asq_send_command - send command to Admin Queue
+- * @hw: pointer to the hw struct
+- * @desc: prefilled descriptor describing the command (non DMA mem)
+- * @buff: buffer to use for indirect commands
+- * @buff_size: size of buffer for indirect commands
+- * @cmd_details: pointer to command details structure
+- *
+- * This is the main send command driver routine for the Admin Queue send
+- * queue. It runs the queue, cleans the queue, etc
+- **/
+-i40e_status i40evf_asq_send_command(struct i40e_hw *hw,
+- struct i40e_aq_desc *desc,
+- void *buff, /* can be NULL */
+- u16 buff_size,
+- struct i40e_asq_cmd_details *cmd_details)
+-{
+- i40e_status status = 0;
+- struct i40e_dma_mem *dma_buff = NULL;
+- struct i40e_asq_cmd_details *details;
+- struct i40e_aq_desc *desc_on_ring;
+- bool cmd_completed = false;
+- u16 retval = 0;
+- u32 val = 0;
+-
+- mutex_lock(&hw->aq.asq_mutex);
+-
+- if (hw->aq.asq.count == 0) {
+- i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
+- "AQTX: Admin queue not initialized.\n");
+- status = I40E_ERR_QUEUE_EMPTY;
+- goto asq_send_command_error;
+- }
+-
+- hw->aq.asq_last_status = I40E_AQ_RC_OK;
+-
+- val = rd32(hw, hw->aq.asq.head);
+- if (val >= hw->aq.num_asq_entries) {
+- i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
+- "AQTX: head overrun at %d\n", val);
+- status = I40E_ERR_QUEUE_EMPTY;
+- goto asq_send_command_error;
+- }
+-
+- details = I40E_ADMINQ_DETAILS(hw->aq.asq, hw->aq.asq.next_to_use);
+- if (cmd_details) {
+- *details = *cmd_details;
+-
+- /* If the cmd_details are defined copy the cookie. The
+- * cpu_to_le32 is not needed here because the data is ignored
+- * by the FW, only used by the driver
+- */
+- if (details->cookie) {
+- desc->cookie_high =
+- cpu_to_le32(upper_32_bits(details->cookie));
+- desc->cookie_low =
+- cpu_to_le32(lower_32_bits(details->cookie));
+- }
+- } else {
+- memset(details, 0, sizeof(struct i40e_asq_cmd_details));
+- }
+-
+- /* clear requested flags and then set additional flags if defined */
+- desc->flags &= ~cpu_to_le16(details->flags_dis);
+- desc->flags |= cpu_to_le16(details->flags_ena);
+-
+- if (buff_size > hw->aq.asq_buf_size) {
+- i40e_debug(hw,
+- I40E_DEBUG_AQ_MESSAGE,
+- "AQTX: Invalid buffer size: %d.\n",
+- buff_size);
+- status = I40E_ERR_INVALID_SIZE;
+- goto asq_send_command_error;
+- }
+-
+- if (details->postpone && !details->async) {
+- i40e_debug(hw,
+- I40E_DEBUG_AQ_MESSAGE,
+- "AQTX: Async flag not set along with postpone flag");
+- status = I40E_ERR_PARAM;
+- goto asq_send_command_error;
+- }
+-
+- /* call clean and check queue available function to reclaim the
+- * descriptors that were processed by FW, the function returns the
+- * number of desc available
+- */
+- /* the clean function called here could be called in a separate thread
+- * in case of asynchronous completions
+- */
+- if (i40e_clean_asq(hw) == 0) {
+- i40e_debug(hw,
+- I40E_DEBUG_AQ_MESSAGE,
+- "AQTX: Error queue is full.\n");
+- status = I40E_ERR_ADMIN_QUEUE_FULL;
+- goto asq_send_command_error;
+- }
+-
+- /* initialize the temp desc pointer with the right desc */
+- desc_on_ring = I40E_ADMINQ_DESC(hw->aq.asq, hw->aq.asq.next_to_use);
+-
+- /* if the desc is available copy the temp desc to the right place */
+- *desc_on_ring = *desc;
+-
+- /* if buff is not NULL assume indirect command */
+- if (buff != NULL) {
+- dma_buff = &(hw->aq.asq.r.asq_bi[hw->aq.asq.next_to_use]);
+- /* copy the user buff into the respective DMA buff */
+- memcpy(dma_buff->va, buff, buff_size);
+- desc_on_ring->datalen = cpu_to_le16(buff_size);
+-
+- /* Update the address values in the desc with the pa value
+- * for respective buffer
+- */
+- desc_on_ring->params.external.addr_high =
+- cpu_to_le32(upper_32_bits(dma_buff->pa));
+- desc_on_ring->params.external.addr_low =
+- cpu_to_le32(lower_32_bits(dma_buff->pa));
+- }
+-
+- /* bump the tail */
+- i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE, "AQTX: desc and buffer:\n");
+- i40evf_debug_aq(hw, I40E_DEBUG_AQ_COMMAND, (void *)desc_on_ring,
+- buff, buff_size);
+- (hw->aq.asq.next_to_use)++;
+- if (hw->aq.asq.next_to_use == hw->aq.asq.count)
+- hw->aq.asq.next_to_use = 0;
+- if (!details->postpone)
+- wr32(hw, hw->aq.asq.tail, hw->aq.asq.next_to_use);
+-
+- /* if cmd_details are not defined or async flag is not set,
+- * we need to wait for desc write back
+- */
+- if (!details->async && !details->postpone) {
+- u32 total_delay = 0;
+-
+- do {
+- /* AQ designers suggest use of head for better
+- * timing reliability than DD bit
+- */
+- if (i40evf_asq_done(hw))
+- break;
+- udelay(50);
+- total_delay += 50;
+- } while (total_delay < hw->aq.asq_cmd_timeout);
+- }
+-
+- /* if ready, copy the desc back to temp */
+- if (i40evf_asq_done(hw)) {
+- *desc = *desc_on_ring;
+- if (buff != NULL)
+- memcpy(buff, dma_buff->va, buff_size);
+- retval = le16_to_cpu(desc->retval);
+- if (retval != 0) {
+- i40e_debug(hw,
+- I40E_DEBUG_AQ_MESSAGE,
+- "AQTX: Command completed with error 0x%X.\n",
+- retval);
+-
+- /* strip off FW internal code */
+- retval &= 0xff;
+- }
+- cmd_completed = true;
+- if ((enum i40e_admin_queue_err)retval == I40E_AQ_RC_OK)
+- status = 0;
+- else if ((enum i40e_admin_queue_err)retval == I40E_AQ_RC_EBUSY)
+- status = I40E_ERR_NOT_READY;
+- else
+- status = I40E_ERR_ADMIN_QUEUE_ERROR;
+- hw->aq.asq_last_status = (enum i40e_admin_queue_err)retval;
+- }
+-
+- i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
+- "AQTX: desc and buffer writeback:\n");
+- i40evf_debug_aq(hw, I40E_DEBUG_AQ_COMMAND, (void *)desc, buff,
+- buff_size);
+-
+- /* save writeback aq if requested */
+- if (details->wb_desc)
+- *details->wb_desc = *desc_on_ring;
+-
+- /* update the error if time out occurred */
+- if ((!cmd_completed) &&
+- (!details->async && !details->postpone)) {
+- if (rd32(hw, hw->aq.asq.len) & I40E_VF_ATQLEN1_ATQCRIT_MASK) {
+- i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
+- "AQTX: AQ Critical error.\n");
+- status = I40E_ERR_ADMIN_QUEUE_CRITICAL_ERROR;
+- } else {
+- i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
+- "AQTX: Writeback timeout.\n");
+- status = I40E_ERR_ADMIN_QUEUE_TIMEOUT;
+- }
+- }
+-
+-asq_send_command_error:
+- mutex_unlock(&hw->aq.asq_mutex);
+- return status;
+-}
+-
+-/**
+- * i40evf_fill_default_direct_cmd_desc - AQ descriptor helper function
+- * @desc: pointer to the temp descriptor (non DMA mem)
+- * @opcode: the opcode can be used to decide which flags to turn off or on
+- *
+- * Fill the desc with default values
+- **/
+-void i40evf_fill_default_direct_cmd_desc(struct i40e_aq_desc *desc,
+- u16 opcode)
+-{
+- /* zero out the desc */
+- memset((void *)desc, 0, sizeof(struct i40e_aq_desc));
+- desc->opcode = cpu_to_le16(opcode);
+- desc->flags = cpu_to_le16(I40E_AQ_FLAG_SI);
+-}
+-
+-/**
+- * i40evf_clean_arq_element
+- * @hw: pointer to the hw struct
+- * @e: event info from the receive descriptor, includes any buffers
+- * @pending: number of events that could be left to process
+- *
+- * This function cleans one Admin Receive Queue element and returns
+- * the contents through e. It can also return how many events are
+- * left to process through 'pending'
+- **/
+-i40e_status i40evf_clean_arq_element(struct i40e_hw *hw,
+- struct i40e_arq_event_info *e,
+- u16 *pending)
+-{
+- i40e_status ret_code = 0;
+- u16 ntc = hw->aq.arq.next_to_clean;
+- struct i40e_aq_desc *desc;
+- struct i40e_dma_mem *bi;
+- u16 desc_idx;
+- u16 datalen;
+- u16 flags;
+- u16 ntu;
+-
+- /* pre-clean the event info */
+- memset(&e->desc, 0, sizeof(e->desc));
+-
+- /* take the lock before we start messing with the ring */
+- mutex_lock(&hw->aq.arq_mutex);
+-
+- if (hw->aq.arq.count == 0) {
+- i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
+- "AQRX: Admin queue not initialized.\n");
+- ret_code = I40E_ERR_QUEUE_EMPTY;
+- goto clean_arq_element_err;
+- }
+-
+- /* set next_to_use to head */
+- ntu = rd32(hw, hw->aq.arq.head) & I40E_VF_ARQH1_ARQH_MASK;
+- if (ntu == ntc) {
+- /* nothing to do - shouldn't need to update ring's values */
+- ret_code = I40E_ERR_ADMIN_QUEUE_NO_WORK;
+- goto clean_arq_element_out;
+- }
+-
+- /* now clean the next descriptor */
+- desc = I40E_ADMINQ_DESC(hw->aq.arq, ntc);
+- desc_idx = ntc;
+-
+- hw->aq.arq_last_status =
+- (enum i40e_admin_queue_err)le16_to_cpu(desc->retval);
+- flags = le16_to_cpu(desc->flags);
+- if (flags & I40E_AQ_FLAG_ERR) {
+- ret_code = I40E_ERR_ADMIN_QUEUE_ERROR;
+- i40e_debug(hw,
+- I40E_DEBUG_AQ_MESSAGE,
+- "AQRX: Event received with error 0x%X.\n",
+- hw->aq.arq_last_status);
+- }
+-
+- e->desc = *desc;
+- datalen = le16_to_cpu(desc->datalen);
+- e->msg_len = min(datalen, e->buf_len);
+- if (e->msg_buf != NULL && (e->msg_len != 0))
+- memcpy(e->msg_buf, hw->aq.arq.r.arq_bi[desc_idx].va,
+- e->msg_len);
+-
+- i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE, "AQRX: desc and buffer:\n");
+- i40evf_debug_aq(hw, I40E_DEBUG_AQ_COMMAND, (void *)desc, e->msg_buf,
+- hw->aq.arq_buf_size);
+-
+- /* Restore the original datalen and buffer address in the desc,
+- * FW updates datalen to indicate the event message
+- * size
+- */
+- bi = &hw->aq.arq.r.arq_bi[ntc];
+- memset((void *)desc, 0, sizeof(struct i40e_aq_desc));
+-
+- desc->flags = cpu_to_le16(I40E_AQ_FLAG_BUF);
+- if (hw->aq.arq_buf_size > I40E_AQ_LARGE_BUF)
+- desc->flags |= cpu_to_le16(I40E_AQ_FLAG_LB);
+- desc->datalen = cpu_to_le16((u16)bi->size);
+- desc->params.external.addr_high = cpu_to_le32(upper_32_bits(bi->pa));
+- desc->params.external.addr_low = cpu_to_le32(lower_32_bits(bi->pa));
+-
+- /* set tail = the last cleaned desc index. */
+- wr32(hw, hw->aq.arq.tail, ntc);
+- /* ntc is updated to tail + 1 */
+- ntc++;
+- if (ntc == hw->aq.num_arq_entries)
+- ntc = 0;
+- hw->aq.arq.next_to_clean = ntc;
+- hw->aq.arq.next_to_use = ntu;
+-
+-clean_arq_element_out:
+- /* Set pending if needed, unlock and return */
+- if (pending != NULL)
+- *pending = (ntc > ntu ? hw->aq.arq.count : 0) + (ntu - ntc);
+-
+-clean_arq_element_err:
+- mutex_unlock(&hw->aq.arq_mutex);
+-
+- return ret_code;
+-}
+-
+-void i40evf_resume_aq(struct i40e_hw *hw)
+-{
+- /* Registers are reset after PF reset */
+- hw->aq.asq.next_to_use = 0;
+- hw->aq.asq.next_to_clean = 0;
+-
+- i40e_config_asq_regs(hw);
+-
+- hw->aq.arq.next_to_use = 0;
+- hw->aq.arq.next_to_clean = 0;
+-
+- i40e_config_arq_regs(hw);
+-}
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_adminq.h b/drivers/net/ethernet/intel/i40evf/i40e_adminq.h
+deleted file mode 100644
+index 1f264b9b6805e..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_adminq.h
++++ /dev/null
+@@ -1,136 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_ADMINQ_H_
+-#define _I40E_ADMINQ_H_
+-
+-#include "i40e_osdep.h"
+-#include "i40e_status.h"
+-#include "i40e_adminq_cmd.h"
+-
+-#define I40E_ADMINQ_DESC(R, i) \
+- (&(((struct i40e_aq_desc *)((R).desc_buf.va))[i]))
+-
+-#define I40E_ADMINQ_DESC_ALIGNMENT 4096
+-
+-struct i40e_adminq_ring {
+- struct i40e_virt_mem dma_head; /* space for dma structures */
+- struct i40e_dma_mem desc_buf; /* descriptor ring memory */
+- struct i40e_virt_mem cmd_buf; /* command buffer memory */
+-
+- union {
+- struct i40e_dma_mem *asq_bi;
+- struct i40e_dma_mem *arq_bi;
+- } r;
+-
+- u16 count; /* Number of descriptors */
+- u16 rx_buf_len; /* Admin Receive Queue buffer length */
+-
+- /* used for interrupt processing */
+- u16 next_to_use;
+- u16 next_to_clean;
+-
+- /* used for queue tracking */
+- u32 head;
+- u32 tail;
+- u32 len;
+- u32 bah;
+- u32 bal;
+-};
+-
+-/* ASQ transaction details */
+-struct i40e_asq_cmd_details {
+- void *callback; /* cast from type I40E_ADMINQ_CALLBACK */
+- u64 cookie;
+- u16 flags_ena;
+- u16 flags_dis;
+- bool async;
+- bool postpone;
+- struct i40e_aq_desc *wb_desc;
+-};
+-
+-#define I40E_ADMINQ_DETAILS(R, i) \
+- (&(((struct i40e_asq_cmd_details *)((R).cmd_buf.va))[i]))
+-
+-/* ARQ event information */
+-struct i40e_arq_event_info {
+- struct i40e_aq_desc desc;
+- u16 msg_len;
+- u16 buf_len;
+- u8 *msg_buf;
+-};
+-
+-/* Admin Queue information */
+-struct i40e_adminq_info {
+- struct i40e_adminq_ring arq; /* receive queue */
+- struct i40e_adminq_ring asq; /* send queue */
+- u32 asq_cmd_timeout; /* send queue cmd write back timeout*/
+- u16 num_arq_entries; /* receive queue depth */
+- u16 num_asq_entries; /* send queue depth */
+- u16 arq_buf_size; /* receive queue buffer size */
+- u16 asq_buf_size; /* send queue buffer size */
+- u16 fw_maj_ver; /* firmware major version */
+- u16 fw_min_ver; /* firmware minor version */
+- u32 fw_build; /* firmware build number */
+- u16 api_maj_ver; /* api major version */
+- u16 api_min_ver; /* api minor version */
+-
+- struct mutex asq_mutex; /* Send queue lock */
+- struct mutex arq_mutex; /* Receive queue lock */
+-
+- /* last status values on send and receive queues */
+- enum i40e_admin_queue_err asq_last_status;
+- enum i40e_admin_queue_err arq_last_status;
+-};
+-
+-/**
+- * i40e_aq_rc_to_posix - convert errors to user-land codes
+- * aq_ret: AdminQ handler error code can override aq_rc
+- * aq_rc: AdminQ firmware error code to convert
+- **/
+-static inline int i40e_aq_rc_to_posix(int aq_ret, int aq_rc)
+-{
+- int aq_to_posix[] = {
+- 0, /* I40E_AQ_RC_OK */
+- -EPERM, /* I40E_AQ_RC_EPERM */
+- -ENOENT, /* I40E_AQ_RC_ENOENT */
+- -ESRCH, /* I40E_AQ_RC_ESRCH */
+- -EINTR, /* I40E_AQ_RC_EINTR */
+- -EIO, /* I40E_AQ_RC_EIO */
+- -ENXIO, /* I40E_AQ_RC_ENXIO */
+- -E2BIG, /* I40E_AQ_RC_E2BIG */
+- -EAGAIN, /* I40E_AQ_RC_EAGAIN */
+- -ENOMEM, /* I40E_AQ_RC_ENOMEM */
+- -EACCES, /* I40E_AQ_RC_EACCES */
+- -EFAULT, /* I40E_AQ_RC_EFAULT */
+- -EBUSY, /* I40E_AQ_RC_EBUSY */
+- -EEXIST, /* I40E_AQ_RC_EEXIST */
+- -EINVAL, /* I40E_AQ_RC_EINVAL */
+- -ENOTTY, /* I40E_AQ_RC_ENOTTY */
+- -ENOSPC, /* I40E_AQ_RC_ENOSPC */
+- -ENOSYS, /* I40E_AQ_RC_ENOSYS */
+- -ERANGE, /* I40E_AQ_RC_ERANGE */
+- -EPIPE, /* I40E_AQ_RC_EFLUSHED */
+- -ESPIPE, /* I40E_AQ_RC_BAD_ADDR */
+- -EROFS, /* I40E_AQ_RC_EMODE */
+- -EFBIG, /* I40E_AQ_RC_EFBIG */
+- };
+-
+- /* aq_rc is invalid if AQ timed out */
+- if (aq_ret == I40E_ERR_ADMIN_QUEUE_TIMEOUT)
+- return -EAGAIN;
+-
+- if (!((u32)aq_rc < (sizeof(aq_to_posix) / sizeof((aq_to_posix)[0]))))
+- return -ERANGE;
+-
+- return aq_to_posix[aq_rc];
+-}
+-
+-/* general information */
+-#define I40E_AQ_LARGE_BUF 512
+-#define I40E_ASQ_CMD_TIMEOUT 250000 /* usecs */
+-
+-void i40evf_fill_default_direct_cmd_desc(struct i40e_aq_desc *desc,
+- u16 opcode);
+-
+-#endif /* _I40E_ADMINQ_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_adminq_cmd.h b/drivers/net/ethernet/intel/i40evf/i40e_adminq_cmd.h
+deleted file mode 100644
+index 5fd8529465d48..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_adminq_cmd.h
++++ /dev/null
+@@ -1,2717 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_ADMINQ_CMD_H_
+-#define _I40E_ADMINQ_CMD_H_
+-
+-/* This header file defines the i40e Admin Queue commands and is shared between
+- * i40e Firmware and Software.
+- *
+- * This file needs to comply with the Linux Kernel coding style.
+- */
+-
+-#define I40E_FW_API_VERSION_MAJOR 0x0001
+-#define I40E_FW_API_VERSION_MINOR_X722 0x0005
+-#define I40E_FW_API_VERSION_MINOR_X710 0x0007
+-
+-#define I40E_FW_MINOR_VERSION(_h) ((_h)->mac.type == I40E_MAC_XL710 ? \
+- I40E_FW_API_VERSION_MINOR_X710 : \
+- I40E_FW_API_VERSION_MINOR_X722)
+-
+-/* API version 1.7 implements additional link and PHY-specific APIs */
+-#define I40E_MINOR_VER_GET_LINK_INFO_XL710 0x0007
+-
+-struct i40e_aq_desc {
+- __le16 flags;
+- __le16 opcode;
+- __le16 datalen;
+- __le16 retval;
+- __le32 cookie_high;
+- __le32 cookie_low;
+- union {
+- struct {
+- __le32 param0;
+- __le32 param1;
+- __le32 param2;
+- __le32 param3;
+- } internal;
+- struct {
+- __le32 param0;
+- __le32 param1;
+- __le32 addr_high;
+- __le32 addr_low;
+- } external;
+- u8 raw[16];
+- } params;
+-};
+-
+-/* Flags sub-structure
+- * |0 |1 |2 |3 |4 |5 |6 |7 |8 |9 |10 |11 |12 |13 |14 |15 |
+- * |DD |CMP|ERR|VFE| * * RESERVED * * |LB |RD |VFC|BUF|SI |EI |FE |
+- */
+-
+-/* command flags and offsets*/
+-#define I40E_AQ_FLAG_DD_SHIFT 0
+-#define I40E_AQ_FLAG_CMP_SHIFT 1
+-#define I40E_AQ_FLAG_ERR_SHIFT 2
+-#define I40E_AQ_FLAG_VFE_SHIFT 3
+-#define I40E_AQ_FLAG_LB_SHIFT 9
+-#define I40E_AQ_FLAG_RD_SHIFT 10
+-#define I40E_AQ_FLAG_VFC_SHIFT 11
+-#define I40E_AQ_FLAG_BUF_SHIFT 12
+-#define I40E_AQ_FLAG_SI_SHIFT 13
+-#define I40E_AQ_FLAG_EI_SHIFT 14
+-#define I40E_AQ_FLAG_FE_SHIFT 15
+-
+-#define I40E_AQ_FLAG_DD BIT(I40E_AQ_FLAG_DD_SHIFT) /* 0x1 */
+-#define I40E_AQ_FLAG_CMP BIT(I40E_AQ_FLAG_CMP_SHIFT) /* 0x2 */
+-#define I40E_AQ_FLAG_ERR BIT(I40E_AQ_FLAG_ERR_SHIFT) /* 0x4 */
+-#define I40E_AQ_FLAG_VFE BIT(I40E_AQ_FLAG_VFE_SHIFT) /* 0x8 */
+-#define I40E_AQ_FLAG_LB BIT(I40E_AQ_FLAG_LB_SHIFT) /* 0x200 */
+-#define I40E_AQ_FLAG_RD BIT(I40E_AQ_FLAG_RD_SHIFT) /* 0x400 */
+-#define I40E_AQ_FLAG_VFC BIT(I40E_AQ_FLAG_VFC_SHIFT) /* 0x800 */
+-#define I40E_AQ_FLAG_BUF BIT(I40E_AQ_FLAG_BUF_SHIFT) /* 0x1000 */
+-#define I40E_AQ_FLAG_SI BIT(I40E_AQ_FLAG_SI_SHIFT) /* 0x2000 */
+-#define I40E_AQ_FLAG_EI BIT(I40E_AQ_FLAG_EI_SHIFT) /* 0x4000 */
+-#define I40E_AQ_FLAG_FE BIT(I40E_AQ_FLAG_FE_SHIFT) /* 0x8000 */
+-
+-/* error codes */
+-enum i40e_admin_queue_err {
+- I40E_AQ_RC_OK = 0, /* success */
+- I40E_AQ_RC_EPERM = 1, /* Operation not permitted */
+- I40E_AQ_RC_ENOENT = 2, /* No such element */
+- I40E_AQ_RC_ESRCH = 3, /* Bad opcode */
+- I40E_AQ_RC_EINTR = 4, /* operation interrupted */
+- I40E_AQ_RC_EIO = 5, /* I/O error */
+- I40E_AQ_RC_ENXIO = 6, /* No such resource */
+- I40E_AQ_RC_E2BIG = 7, /* Arg too long */
+- I40E_AQ_RC_EAGAIN = 8, /* Try again */
+- I40E_AQ_RC_ENOMEM = 9, /* Out of memory */
+- I40E_AQ_RC_EACCES = 10, /* Permission denied */
+- I40E_AQ_RC_EFAULT = 11, /* Bad address */
+- I40E_AQ_RC_EBUSY = 12, /* Device or resource busy */
+- I40E_AQ_RC_EEXIST = 13, /* object already exists */
+- I40E_AQ_RC_EINVAL = 14, /* Invalid argument */
+- I40E_AQ_RC_ENOTTY = 15, /* Not a typewriter */
+- I40E_AQ_RC_ENOSPC = 16, /* No space left or alloc failure */
+- I40E_AQ_RC_ENOSYS = 17, /* Function not implemented */
+- I40E_AQ_RC_ERANGE = 18, /* Parameter out of range */
+- I40E_AQ_RC_EFLUSHED = 19, /* Cmd flushed due to prev cmd error */
+- I40E_AQ_RC_BAD_ADDR = 20, /* Descriptor contains a bad pointer */
+- I40E_AQ_RC_EMODE = 21, /* Op not allowed in current dev mode */
+- I40E_AQ_RC_EFBIG = 22, /* File too large */
+-};
+-
+-/* Admin Queue command opcodes */
+-enum i40e_admin_queue_opc {
+- /* aq commands */
+- i40e_aqc_opc_get_version = 0x0001,
+- i40e_aqc_opc_driver_version = 0x0002,
+- i40e_aqc_opc_queue_shutdown = 0x0003,
+- i40e_aqc_opc_set_pf_context = 0x0004,
+-
+- /* resource ownership */
+- i40e_aqc_opc_request_resource = 0x0008,
+- i40e_aqc_opc_release_resource = 0x0009,
+-
+- i40e_aqc_opc_list_func_capabilities = 0x000A,
+- i40e_aqc_opc_list_dev_capabilities = 0x000B,
+-
+- /* Proxy commands */
+- i40e_aqc_opc_set_proxy_config = 0x0104,
+- i40e_aqc_opc_set_ns_proxy_table_entry = 0x0105,
+-
+- /* LAA */
+- i40e_aqc_opc_mac_address_read = 0x0107,
+- i40e_aqc_opc_mac_address_write = 0x0108,
+-
+- /* PXE */
+- i40e_aqc_opc_clear_pxe_mode = 0x0110,
+-
+- /* WoL commands */
+- i40e_aqc_opc_set_wol_filter = 0x0120,
+- i40e_aqc_opc_get_wake_reason = 0x0121,
+-
+- /* internal switch commands */
+- i40e_aqc_opc_get_switch_config = 0x0200,
+- i40e_aqc_opc_add_statistics = 0x0201,
+- i40e_aqc_opc_remove_statistics = 0x0202,
+- i40e_aqc_opc_set_port_parameters = 0x0203,
+- i40e_aqc_opc_get_switch_resource_alloc = 0x0204,
+- i40e_aqc_opc_set_switch_config = 0x0205,
+- i40e_aqc_opc_rx_ctl_reg_read = 0x0206,
+- i40e_aqc_opc_rx_ctl_reg_write = 0x0207,
+-
+- i40e_aqc_opc_add_vsi = 0x0210,
+- i40e_aqc_opc_update_vsi_parameters = 0x0211,
+- i40e_aqc_opc_get_vsi_parameters = 0x0212,
+-
+- i40e_aqc_opc_add_pv = 0x0220,
+- i40e_aqc_opc_update_pv_parameters = 0x0221,
+- i40e_aqc_opc_get_pv_parameters = 0x0222,
+-
+- i40e_aqc_opc_add_veb = 0x0230,
+- i40e_aqc_opc_update_veb_parameters = 0x0231,
+- i40e_aqc_opc_get_veb_parameters = 0x0232,
+-
+- i40e_aqc_opc_delete_element = 0x0243,
+-
+- i40e_aqc_opc_add_macvlan = 0x0250,
+- i40e_aqc_opc_remove_macvlan = 0x0251,
+- i40e_aqc_opc_add_vlan = 0x0252,
+- i40e_aqc_opc_remove_vlan = 0x0253,
+- i40e_aqc_opc_set_vsi_promiscuous_modes = 0x0254,
+- i40e_aqc_opc_add_tag = 0x0255,
+- i40e_aqc_opc_remove_tag = 0x0256,
+- i40e_aqc_opc_add_multicast_etag = 0x0257,
+- i40e_aqc_opc_remove_multicast_etag = 0x0258,
+- i40e_aqc_opc_update_tag = 0x0259,
+- i40e_aqc_opc_add_control_packet_filter = 0x025A,
+- i40e_aqc_opc_remove_control_packet_filter = 0x025B,
+- i40e_aqc_opc_add_cloud_filters = 0x025C,
+- i40e_aqc_opc_remove_cloud_filters = 0x025D,
+- i40e_aqc_opc_clear_wol_switch_filters = 0x025E,
+-
+- i40e_aqc_opc_add_mirror_rule = 0x0260,
+- i40e_aqc_opc_delete_mirror_rule = 0x0261,
+-
+- /* Dynamic Device Personalization */
+- i40e_aqc_opc_write_personalization_profile = 0x0270,
+- i40e_aqc_opc_get_personalization_profile_list = 0x0271,
+-
+- /* DCB commands */
+- i40e_aqc_opc_dcb_ignore_pfc = 0x0301,
+- i40e_aqc_opc_dcb_updated = 0x0302,
+- i40e_aqc_opc_set_dcb_parameters = 0x0303,
+-
+- /* TX scheduler */
+- i40e_aqc_opc_configure_vsi_bw_limit = 0x0400,
+- i40e_aqc_opc_configure_vsi_ets_sla_bw_limit = 0x0406,
+- i40e_aqc_opc_configure_vsi_tc_bw = 0x0407,
+- i40e_aqc_opc_query_vsi_bw_config = 0x0408,
+- i40e_aqc_opc_query_vsi_ets_sla_config = 0x040A,
+- i40e_aqc_opc_configure_switching_comp_bw_limit = 0x0410,
+-
+- i40e_aqc_opc_enable_switching_comp_ets = 0x0413,
+- i40e_aqc_opc_modify_switching_comp_ets = 0x0414,
+- i40e_aqc_opc_disable_switching_comp_ets = 0x0415,
+- i40e_aqc_opc_configure_switching_comp_ets_bw_limit = 0x0416,
+- i40e_aqc_opc_configure_switching_comp_bw_config = 0x0417,
+- i40e_aqc_opc_query_switching_comp_ets_config = 0x0418,
+- i40e_aqc_opc_query_port_ets_config = 0x0419,
+- i40e_aqc_opc_query_switching_comp_bw_config = 0x041A,
+- i40e_aqc_opc_suspend_port_tx = 0x041B,
+- i40e_aqc_opc_resume_port_tx = 0x041C,
+- i40e_aqc_opc_configure_partition_bw = 0x041D,
+- /* hmc */
+- i40e_aqc_opc_query_hmc_resource_profile = 0x0500,
+- i40e_aqc_opc_set_hmc_resource_profile = 0x0501,
+-
+- /* phy commands*/
+- i40e_aqc_opc_get_phy_abilities = 0x0600,
+- i40e_aqc_opc_set_phy_config = 0x0601,
+- i40e_aqc_opc_set_mac_config = 0x0603,
+- i40e_aqc_opc_set_link_restart_an = 0x0605,
+- i40e_aqc_opc_get_link_status = 0x0607,
+- i40e_aqc_opc_set_phy_int_mask = 0x0613,
+- i40e_aqc_opc_get_local_advt_reg = 0x0614,
+- i40e_aqc_opc_set_local_advt_reg = 0x0615,
+- i40e_aqc_opc_get_partner_advt = 0x0616,
+- i40e_aqc_opc_set_lb_modes = 0x0618,
+- i40e_aqc_opc_get_phy_wol_caps = 0x0621,
+- i40e_aqc_opc_set_phy_debug = 0x0622,
+- i40e_aqc_opc_upload_ext_phy_fm = 0x0625,
+- i40e_aqc_opc_run_phy_activity = 0x0626,
+- i40e_aqc_opc_set_phy_register = 0x0628,
+- i40e_aqc_opc_get_phy_register = 0x0629,
+-
+- /* NVM commands */
+- i40e_aqc_opc_nvm_read = 0x0701,
+- i40e_aqc_opc_nvm_erase = 0x0702,
+- i40e_aqc_opc_nvm_update = 0x0703,
+- i40e_aqc_opc_nvm_config_read = 0x0704,
+- i40e_aqc_opc_nvm_config_write = 0x0705,
+- i40e_aqc_opc_oem_post_update = 0x0720,
+- i40e_aqc_opc_thermal_sensor = 0x0721,
+-
+- /* virtualization commands */
+- i40e_aqc_opc_send_msg_to_pf = 0x0801,
+- i40e_aqc_opc_send_msg_to_vf = 0x0802,
+- i40e_aqc_opc_send_msg_to_peer = 0x0803,
+-
+- /* alternate structure */
+- i40e_aqc_opc_alternate_write = 0x0900,
+- i40e_aqc_opc_alternate_write_indirect = 0x0901,
+- i40e_aqc_opc_alternate_read = 0x0902,
+- i40e_aqc_opc_alternate_read_indirect = 0x0903,
+- i40e_aqc_opc_alternate_write_done = 0x0904,
+- i40e_aqc_opc_alternate_set_mode = 0x0905,
+- i40e_aqc_opc_alternate_clear_port = 0x0906,
+-
+- /* LLDP commands */
+- i40e_aqc_opc_lldp_get_mib = 0x0A00,
+- i40e_aqc_opc_lldp_update_mib = 0x0A01,
+- i40e_aqc_opc_lldp_add_tlv = 0x0A02,
+- i40e_aqc_opc_lldp_update_tlv = 0x0A03,
+- i40e_aqc_opc_lldp_delete_tlv = 0x0A04,
+- i40e_aqc_opc_lldp_stop = 0x0A05,
+- i40e_aqc_opc_lldp_start = 0x0A06,
+-
+- /* Tunnel commands */
+- i40e_aqc_opc_add_udp_tunnel = 0x0B00,
+- i40e_aqc_opc_del_udp_tunnel = 0x0B01,
+- i40e_aqc_opc_set_rss_key = 0x0B02,
+- i40e_aqc_opc_set_rss_lut = 0x0B03,
+- i40e_aqc_opc_get_rss_key = 0x0B04,
+- i40e_aqc_opc_get_rss_lut = 0x0B05,
+-
+- /* Async Events */
+- i40e_aqc_opc_event_lan_overflow = 0x1001,
+-
+- /* OEM commands */
+- i40e_aqc_opc_oem_parameter_change = 0xFE00,
+- i40e_aqc_opc_oem_device_status_change = 0xFE01,
+- i40e_aqc_opc_oem_ocsd_initialize = 0xFE02,
+- i40e_aqc_opc_oem_ocbb_initialize = 0xFE03,
+-
+- /* debug commands */
+- i40e_aqc_opc_debug_read_reg = 0xFF03,
+- i40e_aqc_opc_debug_write_reg = 0xFF04,
+- i40e_aqc_opc_debug_modify_reg = 0xFF07,
+- i40e_aqc_opc_debug_dump_internals = 0xFF08,
+-};
+-
+-/* command structures and indirect data structures */
+-
+-/* Structure naming conventions:
+- * - no suffix for direct command descriptor structures
+- * - _data for indirect sent data
+- * - _resp for indirect return data (data which is both will use _data)
+- * - _completion for direct return data
+- * - _element_ for repeated elements (may also be _data or _resp)
+- *
+- * Command structures are expected to overlay the params.raw member of the basic
+- * descriptor, and as such cannot exceed 16 bytes in length.
+- */
+-
+-/* This macro is used to generate a compilation error if a structure
+- * is not exactly the correct length. It gives a divide by zero error if the
+- * structure is not of the correct size, otherwise it creates an enum that is
+- * never used.
+- */
+-#define I40E_CHECK_STRUCT_LEN(n, X) enum i40e_static_assert_enum_##X \
+- { i40e_static_assert_##X = (n)/((sizeof(struct X) == (n)) ? 1 : 0) }
+-
+-/* This macro is used extensively to ensure that command structures are 16
+- * bytes in length as they have to map to the raw array of that size.
+- */
+-#define I40E_CHECK_CMD_LENGTH(X) I40E_CHECK_STRUCT_LEN(16, X)
+-
+-/* internal (0x00XX) commands */
+-
+-/* Get version (direct 0x0001) */
+-struct i40e_aqc_get_version {
+- __le32 rom_ver;
+- __le32 fw_build;
+- __le16 fw_major;
+- __le16 fw_minor;
+- __le16 api_major;
+- __le16 api_minor;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_get_version);
+-
+-/* Send driver version (indirect 0x0002) */
+-struct i40e_aqc_driver_version {
+- u8 driver_major_ver;
+- u8 driver_minor_ver;
+- u8 driver_build_ver;
+- u8 driver_subbuild_ver;
+- u8 reserved[4];
+- __le32 address_high;
+- __le32 address_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_driver_version);
+-
+-/* Queue Shutdown (direct 0x0003) */
+-struct i40e_aqc_queue_shutdown {
+- __le32 driver_unloading;
+-#define I40E_AQ_DRIVER_UNLOADING 0x1
+- u8 reserved[12];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_queue_shutdown);
+-
+-/* Set PF context (0x0004, direct) */
+-struct i40e_aqc_set_pf_context {
+- u8 pf_id;
+- u8 reserved[15];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_set_pf_context);
+-
+-/* Request resource ownership (direct 0x0008)
+- * Release resource ownership (direct 0x0009)
+- */
+-#define I40E_AQ_RESOURCE_NVM 1
+-#define I40E_AQ_RESOURCE_SDP 2
+-#define I40E_AQ_RESOURCE_ACCESS_READ 1
+-#define I40E_AQ_RESOURCE_ACCESS_WRITE 2
+-#define I40E_AQ_RESOURCE_NVM_READ_TIMEOUT 3000
+-#define I40E_AQ_RESOURCE_NVM_WRITE_TIMEOUT 180000
+-
+-struct i40e_aqc_request_resource {
+- __le16 resource_id;
+- __le16 access_type;
+- __le32 timeout;
+- __le32 resource_number;
+- u8 reserved[4];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_request_resource);
+-
+-/* Get function capabilities (indirect 0x000A)
+- * Get device capabilities (indirect 0x000B)
+- */
+-struct i40e_aqc_list_capabilites {
+- u8 command_flags;
+-#define I40E_AQ_LIST_CAP_PF_INDEX_EN 1
+- u8 pf_index;
+- u8 reserved[2];
+- __le32 count;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_list_capabilites);
+-
+-struct i40e_aqc_list_capabilities_element_resp {
+- __le16 id;
+- u8 major_rev;
+- u8 minor_rev;
+- __le32 number;
+- __le32 logical_id;
+- __le32 phys_id;
+- u8 reserved[16];
+-};
+-
+-/* list of caps */
+-
+-#define I40E_AQ_CAP_ID_SWITCH_MODE 0x0001
+-#define I40E_AQ_CAP_ID_MNG_MODE 0x0002
+-#define I40E_AQ_CAP_ID_NPAR_ACTIVE 0x0003
+-#define I40E_AQ_CAP_ID_OS2BMC_CAP 0x0004
+-#define I40E_AQ_CAP_ID_FUNCTIONS_VALID 0x0005
+-#define I40E_AQ_CAP_ID_ALTERNATE_RAM 0x0006
+-#define I40E_AQ_CAP_ID_WOL_AND_PROXY 0x0008
+-#define I40E_AQ_CAP_ID_SRIOV 0x0012
+-#define I40E_AQ_CAP_ID_VF 0x0013
+-#define I40E_AQ_CAP_ID_VMDQ 0x0014
+-#define I40E_AQ_CAP_ID_8021QBG 0x0015
+-#define I40E_AQ_CAP_ID_8021QBR 0x0016
+-#define I40E_AQ_CAP_ID_VSI 0x0017
+-#define I40E_AQ_CAP_ID_DCB 0x0018
+-#define I40E_AQ_CAP_ID_FCOE 0x0021
+-#define I40E_AQ_CAP_ID_ISCSI 0x0022
+-#define I40E_AQ_CAP_ID_RSS 0x0040
+-#define I40E_AQ_CAP_ID_RXQ 0x0041
+-#define I40E_AQ_CAP_ID_TXQ 0x0042
+-#define I40E_AQ_CAP_ID_MSIX 0x0043
+-#define I40E_AQ_CAP_ID_VF_MSIX 0x0044
+-#define I40E_AQ_CAP_ID_FLOW_DIRECTOR 0x0045
+-#define I40E_AQ_CAP_ID_1588 0x0046
+-#define I40E_AQ_CAP_ID_IWARP 0x0051
+-#define I40E_AQ_CAP_ID_LED 0x0061
+-#define I40E_AQ_CAP_ID_SDP 0x0062
+-#define I40E_AQ_CAP_ID_MDIO 0x0063
+-#define I40E_AQ_CAP_ID_WSR_PROT 0x0064
+-#define I40E_AQ_CAP_ID_NVM_MGMT 0x0080
+-#define I40E_AQ_CAP_ID_FLEX10 0x00F1
+-#define I40E_AQ_CAP_ID_CEM 0x00F2
+-
+-/* Set CPPM Configuration (direct 0x0103) */
+-struct i40e_aqc_cppm_configuration {
+- __le16 command_flags;
+-#define I40E_AQ_CPPM_EN_LTRC 0x0800
+-#define I40E_AQ_CPPM_EN_DMCTH 0x1000
+-#define I40E_AQ_CPPM_EN_DMCTLX 0x2000
+-#define I40E_AQ_CPPM_EN_HPTC 0x4000
+-#define I40E_AQ_CPPM_EN_DMARC 0x8000
+- __le16 ttlx;
+- __le32 dmacr;
+- __le16 dmcth;
+- u8 hptc;
+- u8 reserved;
+- __le32 pfltrc;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_cppm_configuration);
+-
+-/* Set ARP Proxy command / response (indirect 0x0104) */
+-struct i40e_aqc_arp_proxy_data {
+- __le16 command_flags;
+-#define I40E_AQ_ARP_INIT_IPV4 0x0800
+-#define I40E_AQ_ARP_UNSUP_CTL 0x1000
+-#define I40E_AQ_ARP_ENA 0x2000
+-#define I40E_AQ_ARP_ADD_IPV4 0x4000
+-#define I40E_AQ_ARP_DEL_IPV4 0x8000
+- __le16 table_id;
+- __le32 enabled_offloads;
+-#define I40E_AQ_ARP_DIRECTED_OFFLOAD_ENABLE 0x00000020
+-#define I40E_AQ_ARP_OFFLOAD_ENABLE 0x00000800
+- __le32 ip_addr;
+- u8 mac_addr[6];
+- u8 reserved[2];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x14, i40e_aqc_arp_proxy_data);
+-
+-/* Set NS Proxy Table Entry Command (indirect 0x0105) */
+-struct i40e_aqc_ns_proxy_data {
+- __le16 table_idx_mac_addr_0;
+- __le16 table_idx_mac_addr_1;
+- __le16 table_idx_ipv6_0;
+- __le16 table_idx_ipv6_1;
+- __le16 control;
+-#define I40E_AQ_NS_PROXY_ADD_0 0x0001
+-#define I40E_AQ_NS_PROXY_DEL_0 0x0002
+-#define I40E_AQ_NS_PROXY_ADD_1 0x0004
+-#define I40E_AQ_NS_PROXY_DEL_1 0x0008
+-#define I40E_AQ_NS_PROXY_ADD_IPV6_0 0x0010
+-#define I40E_AQ_NS_PROXY_DEL_IPV6_0 0x0020
+-#define I40E_AQ_NS_PROXY_ADD_IPV6_1 0x0040
+-#define I40E_AQ_NS_PROXY_DEL_IPV6_1 0x0080
+-#define I40E_AQ_NS_PROXY_COMMAND_SEQ 0x0100
+-#define I40E_AQ_NS_PROXY_INIT_IPV6_TBL 0x0200
+-#define I40E_AQ_NS_PROXY_INIT_MAC_TBL 0x0400
+-#define I40E_AQ_NS_PROXY_OFFLOAD_ENABLE 0x0800
+-#define I40E_AQ_NS_PROXY_DIRECTED_OFFLOAD_ENABLE 0x1000
+- u8 mac_addr_0[6];
+- u8 mac_addr_1[6];
+- u8 local_mac_addr[6];
+- u8 ipv6_addr_0[16]; /* Warning! spec specifies BE byte order */
+- u8 ipv6_addr_1[16];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x3c, i40e_aqc_ns_proxy_data);
+-
+-/* Manage LAA Command (0x0106) - obsolete */
+-struct i40e_aqc_mng_laa {
+- __le16 command_flags;
+-#define I40E_AQ_LAA_FLAG_WR 0x8000
+- u8 reserved[2];
+- __le32 sal;
+- __le16 sah;
+- u8 reserved2[6];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_mng_laa);
+-
+-/* Manage MAC Address Read Command (indirect 0x0107) */
+-struct i40e_aqc_mac_address_read {
+- __le16 command_flags;
+-#define I40E_AQC_LAN_ADDR_VALID 0x10
+-#define I40E_AQC_SAN_ADDR_VALID 0x20
+-#define I40E_AQC_PORT_ADDR_VALID 0x40
+-#define I40E_AQC_WOL_ADDR_VALID 0x80
+-#define I40E_AQC_MC_MAG_EN_VALID 0x100
+-#define I40E_AQC_ADDR_VALID_MASK 0x3F0
+- u8 reserved[6];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_mac_address_read);
+-
+-struct i40e_aqc_mac_address_read_data {
+- u8 pf_lan_mac[6];
+- u8 pf_san_mac[6];
+- u8 port_mac[6];
+- u8 pf_wol_mac[6];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(24, i40e_aqc_mac_address_read_data);
+-
+-/* Manage MAC Address Write Command (0x0108) */
+-struct i40e_aqc_mac_address_write {
+- __le16 command_flags;
+-#define I40E_AQC_WRITE_TYPE_LAA_ONLY 0x0000
+-#define I40E_AQC_WRITE_TYPE_LAA_WOL 0x4000
+-#define I40E_AQC_WRITE_TYPE_PORT 0x8000
+-#define I40E_AQC_WRITE_TYPE_UPDATE_MC_MAG 0xC000
+-#define I40E_AQC_WRITE_TYPE_MASK 0xC000
+-
+- __le16 mac_sah;
+- __le32 mac_sal;
+- u8 reserved[8];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_mac_address_write);
+-
+-/* PXE commands (0x011x) */
+-
+-/* Clear PXE Command and response (direct 0x0110) */
+-struct i40e_aqc_clear_pxe {
+- u8 rx_cnt;
+- u8 reserved[15];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_clear_pxe);
+-
+-/* Set WoL Filter (0x0120) */
+-
+-struct i40e_aqc_set_wol_filter {
+- __le16 filter_index;
+-#define I40E_AQC_MAX_NUM_WOL_FILTERS 8
+-#define I40E_AQC_SET_WOL_FILTER_TYPE_MAGIC_SHIFT 15
+-#define I40E_AQC_SET_WOL_FILTER_TYPE_MAGIC_MASK (0x1 << \
+- I40E_AQC_SET_WOL_FILTER_TYPE_MAGIC_SHIFT)
+-
+-#define I40E_AQC_SET_WOL_FILTER_INDEX_SHIFT 0
+-#define I40E_AQC_SET_WOL_FILTER_INDEX_MASK (0x7 << \
+- I40E_AQC_SET_WOL_FILTER_INDEX_SHIFT)
+- __le16 cmd_flags;
+-#define I40E_AQC_SET_WOL_FILTER 0x8000
+-#define I40E_AQC_SET_WOL_FILTER_NO_TCO_WOL 0x4000
+-#define I40E_AQC_SET_WOL_FILTER_WOL_PRESERVE_ON_PFR 0x2000
+-#define I40E_AQC_SET_WOL_FILTER_ACTION_CLEAR 0
+-#define I40E_AQC_SET_WOL_FILTER_ACTION_SET 1
+- __le16 valid_flags;
+-#define I40E_AQC_SET_WOL_FILTER_ACTION_VALID 0x8000
+-#define I40E_AQC_SET_WOL_FILTER_NO_TCO_ACTION_VALID 0x4000
+- u8 reserved[2];
+- __le32 address_high;
+- __le32 address_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_set_wol_filter);
+-
+-struct i40e_aqc_set_wol_filter_data {
+- u8 filter[128];
+- u8 mask[16];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x90, i40e_aqc_set_wol_filter_data);
+-
+-/* Get Wake Reason (0x0121) */
+-
+-struct i40e_aqc_get_wake_reason_completion {
+- u8 reserved_1[2];
+- __le16 wake_reason;
+-#define I40E_AQC_GET_WAKE_UP_REASON_WOL_REASON_MATCHED_INDEX_SHIFT 0
+-#define I40E_AQC_GET_WAKE_UP_REASON_WOL_REASON_MATCHED_INDEX_MASK (0xFF << \
+- I40E_AQC_GET_WAKE_UP_REASON_WOL_REASON_MATCHED_INDEX_SHIFT)
+-#define I40E_AQC_GET_WAKE_UP_REASON_WOL_REASON_RESERVED_SHIFT 8
+-#define I40E_AQC_GET_WAKE_UP_REASON_WOL_REASON_RESERVED_MASK (0xFF << \
+- I40E_AQC_GET_WAKE_UP_REASON_WOL_REASON_RESERVED_SHIFT)
+- u8 reserved_2[12];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_get_wake_reason_completion);
+-
+-/* Switch configuration commands (0x02xx) */
+-
+-/* Used by many indirect commands that only pass an seid and a buffer in the
+- * command
+- */
+-struct i40e_aqc_switch_seid {
+- __le16 seid;
+- u8 reserved[6];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_switch_seid);
+-
+-/* Get Switch Configuration command (indirect 0x0200)
+- * uses i40e_aqc_switch_seid for the descriptor
+- */
+-struct i40e_aqc_get_switch_config_header_resp {
+- __le16 num_reported;
+- __le16 num_total;
+- u8 reserved[12];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_get_switch_config_header_resp);
+-
+-struct i40e_aqc_switch_config_element_resp {
+- u8 element_type;
+-#define I40E_AQ_SW_ELEM_TYPE_MAC 1
+-#define I40E_AQ_SW_ELEM_TYPE_PF 2
+-#define I40E_AQ_SW_ELEM_TYPE_VF 3
+-#define I40E_AQ_SW_ELEM_TYPE_EMP 4
+-#define I40E_AQ_SW_ELEM_TYPE_BMC 5
+-#define I40E_AQ_SW_ELEM_TYPE_PV 16
+-#define I40E_AQ_SW_ELEM_TYPE_VEB 17
+-#define I40E_AQ_SW_ELEM_TYPE_PA 18
+-#define I40E_AQ_SW_ELEM_TYPE_VSI 19
+- u8 revision;
+-#define I40E_AQ_SW_ELEM_REV_1 1
+- __le16 seid;
+- __le16 uplink_seid;
+- __le16 downlink_seid;
+- u8 reserved[3];
+- u8 connection_type;
+-#define I40E_AQ_CONN_TYPE_REGULAR 0x1
+-#define I40E_AQ_CONN_TYPE_DEFAULT 0x2
+-#define I40E_AQ_CONN_TYPE_CASCADED 0x3
+- __le16 scheduler_id;
+- __le16 element_info;
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x10, i40e_aqc_switch_config_element_resp);
+-
+-/* Get Switch Configuration (indirect 0x0200)
+- * an array of elements are returned in the response buffer
+- * the first in the array is the header, remainder are elements
+- */
+-struct i40e_aqc_get_switch_config_resp {
+- struct i40e_aqc_get_switch_config_header_resp header;
+- struct i40e_aqc_switch_config_element_resp element[1];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x20, i40e_aqc_get_switch_config_resp);
+-
+-/* Add Statistics (direct 0x0201)
+- * Remove Statistics (direct 0x0202)
+- */
+-struct i40e_aqc_add_remove_statistics {
+- __le16 seid;
+- __le16 vlan;
+- __le16 stat_index;
+- u8 reserved[10];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_remove_statistics);
+-
+-/* Set Port Parameters command (direct 0x0203) */
+-struct i40e_aqc_set_port_parameters {
+- __le16 command_flags;
+-#define I40E_AQ_SET_P_PARAMS_SAVE_BAD_PACKETS 1
+-#define I40E_AQ_SET_P_PARAMS_PAD_SHORT_PACKETS 2 /* must set! */
+-#define I40E_AQ_SET_P_PARAMS_DOUBLE_VLAN_ENA 4
+- __le16 bad_frame_vsi;
+-#define I40E_AQ_SET_P_PARAMS_BFRAME_SEID_SHIFT 0x0
+-#define I40E_AQ_SET_P_PARAMS_BFRAME_SEID_MASK 0x3FF
+- __le16 default_seid; /* reserved for command */
+- u8 reserved[10];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_set_port_parameters);
+-
+-/* Get Switch Resource Allocation (indirect 0x0204) */
+-struct i40e_aqc_get_switch_resource_alloc {
+- u8 num_entries; /* reserved for command */
+- u8 reserved[7];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_get_switch_resource_alloc);
+-
+-/* expect an array of these structs in the response buffer */
+-struct i40e_aqc_switch_resource_alloc_element_resp {
+- u8 resource_type;
+-#define I40E_AQ_RESOURCE_TYPE_VEB 0x0
+-#define I40E_AQ_RESOURCE_TYPE_VSI 0x1
+-#define I40E_AQ_RESOURCE_TYPE_MACADDR 0x2
+-#define I40E_AQ_RESOURCE_TYPE_STAG 0x3
+-#define I40E_AQ_RESOURCE_TYPE_ETAG 0x4
+-#define I40E_AQ_RESOURCE_TYPE_MULTICAST_HASH 0x5
+-#define I40E_AQ_RESOURCE_TYPE_UNICAST_HASH 0x6
+-#define I40E_AQ_RESOURCE_TYPE_VLAN 0x7
+-#define I40E_AQ_RESOURCE_TYPE_VSI_LIST_ENTRY 0x8
+-#define I40E_AQ_RESOURCE_TYPE_ETAG_LIST_ENTRY 0x9
+-#define I40E_AQ_RESOURCE_TYPE_VLAN_STAT_POOL 0xA
+-#define I40E_AQ_RESOURCE_TYPE_MIRROR_RULE 0xB
+-#define I40E_AQ_RESOURCE_TYPE_QUEUE_SETS 0xC
+-#define I40E_AQ_RESOURCE_TYPE_VLAN_FILTERS 0xD
+-#define I40E_AQ_RESOURCE_TYPE_INNER_MAC_FILTERS 0xF
+-#define I40E_AQ_RESOURCE_TYPE_IP_FILTERS 0x10
+-#define I40E_AQ_RESOURCE_TYPE_GRE_VN_KEYS 0x11
+-#define I40E_AQ_RESOURCE_TYPE_VN2_KEYS 0x12
+-#define I40E_AQ_RESOURCE_TYPE_TUNNEL_PORTS 0x13
+- u8 reserved1;
+- __le16 guaranteed;
+- __le16 total;
+- __le16 used;
+- __le16 total_unalloced;
+- u8 reserved2[6];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x10, i40e_aqc_switch_resource_alloc_element_resp);
+-
+-/* Set Switch Configuration (direct 0x0205) */
+-struct i40e_aqc_set_switch_config {
+- __le16 flags;
+-/* flags used for both fields below */
+-#define I40E_AQ_SET_SWITCH_CFG_PROMISC 0x0001
+-#define I40E_AQ_SET_SWITCH_CFG_L2_FILTER 0x0002
+- __le16 valid_flags;
+- /* The ethertype in switch_tag is dropped on ingress and used
+- * internally by the switch. Set this to zero for the default
+- * of 0x88a8 (802.1ad). Should be zero for firmware API
+- * versions lower than 1.7.
+- */
+- __le16 switch_tag;
+- /* The ethertypes in first_tag and second_tag are used to
+- * match the outer and inner VLAN tags (respectively) when HW
+- * double VLAN tagging is enabled via the set port parameters
+- * AQ command. Otherwise these are both ignored. Set them to
+- * zero for their defaults of 0x8100 (802.1Q). Should be zero
+- * for firmware API versions lower than 1.7.
+- */
+- __le16 first_tag;
+- __le16 second_tag;
+- u8 reserved[6];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_set_switch_config);
+-
+-/* Read Receive control registers (direct 0x0206)
+- * Write Receive control registers (direct 0x0207)
+- * used for accessing Rx control registers that can be
+- * slow and need special handling when under high Rx load
+- */
+-struct i40e_aqc_rx_ctl_reg_read_write {
+- __le32 reserved1;
+- __le32 address;
+- __le32 reserved2;
+- __le32 value;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_rx_ctl_reg_read_write);
+-
+-/* Add VSI (indirect 0x0210)
+- * this indirect command uses struct i40e_aqc_vsi_properties_data
+- * as the indirect buffer (128 bytes)
+- *
+- * Update VSI (indirect 0x211)
+- * uses the same data structure as Add VSI
+- *
+- * Get VSI (indirect 0x0212)
+- * uses the same completion and data structure as Add VSI
+- */
+-struct i40e_aqc_add_get_update_vsi {
+- __le16 uplink_seid;
+- u8 connection_type;
+-#define I40E_AQ_VSI_CONN_TYPE_NORMAL 0x1
+-#define I40E_AQ_VSI_CONN_TYPE_DEFAULT 0x2
+-#define I40E_AQ_VSI_CONN_TYPE_CASCADED 0x3
+- u8 reserved1;
+- u8 vf_id;
+- u8 reserved2;
+- __le16 vsi_flags;
+-#define I40E_AQ_VSI_TYPE_SHIFT 0x0
+-#define I40E_AQ_VSI_TYPE_MASK (0x3 << I40E_AQ_VSI_TYPE_SHIFT)
+-#define I40E_AQ_VSI_TYPE_VF 0x0
+-#define I40E_AQ_VSI_TYPE_VMDQ2 0x1
+-#define I40E_AQ_VSI_TYPE_PF 0x2
+-#define I40E_AQ_VSI_TYPE_EMP_MNG 0x3
+-#define I40E_AQ_VSI_FLAG_CASCADED_PV 0x4
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_get_update_vsi);
+-
+-struct i40e_aqc_add_get_update_vsi_completion {
+- __le16 seid;
+- __le16 vsi_number;
+- __le16 vsi_used;
+- __le16 vsi_free;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_get_update_vsi_completion);
+-
+-struct i40e_aqc_vsi_properties_data {
+- /* first 96 byte are written by SW */
+- __le16 valid_sections;
+-#define I40E_AQ_VSI_PROP_SWITCH_VALID 0x0001
+-#define I40E_AQ_VSI_PROP_SECURITY_VALID 0x0002
+-#define I40E_AQ_VSI_PROP_VLAN_VALID 0x0004
+-#define I40E_AQ_VSI_PROP_CAS_PV_VALID 0x0008
+-#define I40E_AQ_VSI_PROP_INGRESS_UP_VALID 0x0010
+-#define I40E_AQ_VSI_PROP_EGRESS_UP_VALID 0x0020
+-#define I40E_AQ_VSI_PROP_QUEUE_MAP_VALID 0x0040
+-#define I40E_AQ_VSI_PROP_QUEUE_OPT_VALID 0x0080
+-#define I40E_AQ_VSI_PROP_OUTER_UP_VALID 0x0100
+-#define I40E_AQ_VSI_PROP_SCHED_VALID 0x0200
+- /* switch section */
+- __le16 switch_id; /* 12bit id combined with flags below */
+-#define I40E_AQ_VSI_SW_ID_SHIFT 0x0000
+-#define I40E_AQ_VSI_SW_ID_MASK (0xFFF << I40E_AQ_VSI_SW_ID_SHIFT)
+-#define I40E_AQ_VSI_SW_ID_FLAG_NOT_STAG 0x1000
+-#define I40E_AQ_VSI_SW_ID_FLAG_ALLOW_LB 0x2000
+-#define I40E_AQ_VSI_SW_ID_FLAG_LOCAL_LB 0x4000
+- u8 sw_reserved[2];
+- /* security section */
+- u8 sec_flags;
+-#define I40E_AQ_VSI_SEC_FLAG_ALLOW_DEST_OVRD 0x01
+-#define I40E_AQ_VSI_SEC_FLAG_ENABLE_VLAN_CHK 0x02
+-#define I40E_AQ_VSI_SEC_FLAG_ENABLE_MAC_CHK 0x04
+- u8 sec_reserved;
+- /* VLAN section */
+- __le16 pvid; /* VLANS include priority bits */
+- __le16 fcoe_pvid;
+- u8 port_vlan_flags;
+-#define I40E_AQ_VSI_PVLAN_MODE_SHIFT 0x00
+-#define I40E_AQ_VSI_PVLAN_MODE_MASK (0x03 << \
+- I40E_AQ_VSI_PVLAN_MODE_SHIFT)
+-#define I40E_AQ_VSI_PVLAN_MODE_TAGGED 0x01
+-#define I40E_AQ_VSI_PVLAN_MODE_UNTAGGED 0x02
+-#define I40E_AQ_VSI_PVLAN_MODE_ALL 0x03
+-#define I40E_AQ_VSI_PVLAN_INSERT_PVID 0x04
+-#define I40E_AQ_VSI_PVLAN_EMOD_SHIFT 0x03
+-#define I40E_AQ_VSI_PVLAN_EMOD_MASK (0x3 << \
+- I40E_AQ_VSI_PVLAN_EMOD_SHIFT)
+-#define I40E_AQ_VSI_PVLAN_EMOD_STR_BOTH 0x0
+-#define I40E_AQ_VSI_PVLAN_EMOD_STR_UP 0x08
+-#define I40E_AQ_VSI_PVLAN_EMOD_STR 0x10
+-#define I40E_AQ_VSI_PVLAN_EMOD_NOTHING 0x18
+- u8 pvlan_reserved[3];
+- /* ingress egress up sections */
+- __le32 ingress_table; /* bitmap, 3 bits per up */
+-#define I40E_AQ_VSI_UP_TABLE_UP0_SHIFT 0
+-#define I40E_AQ_VSI_UP_TABLE_UP0_MASK (0x7 << \
+- I40E_AQ_VSI_UP_TABLE_UP0_SHIFT)
+-#define I40E_AQ_VSI_UP_TABLE_UP1_SHIFT 3
+-#define I40E_AQ_VSI_UP_TABLE_UP1_MASK (0x7 << \
+- I40E_AQ_VSI_UP_TABLE_UP1_SHIFT)
+-#define I40E_AQ_VSI_UP_TABLE_UP2_SHIFT 6
+-#define I40E_AQ_VSI_UP_TABLE_UP2_MASK (0x7 << \
+- I40E_AQ_VSI_UP_TABLE_UP2_SHIFT)
+-#define I40E_AQ_VSI_UP_TABLE_UP3_SHIFT 9
+-#define I40E_AQ_VSI_UP_TABLE_UP3_MASK (0x7 << \
+- I40E_AQ_VSI_UP_TABLE_UP3_SHIFT)
+-#define I40E_AQ_VSI_UP_TABLE_UP4_SHIFT 12
+-#define I40E_AQ_VSI_UP_TABLE_UP4_MASK (0x7 << \
+- I40E_AQ_VSI_UP_TABLE_UP4_SHIFT)
+-#define I40E_AQ_VSI_UP_TABLE_UP5_SHIFT 15
+-#define I40E_AQ_VSI_UP_TABLE_UP5_MASK (0x7 << \
+- I40E_AQ_VSI_UP_TABLE_UP5_SHIFT)
+-#define I40E_AQ_VSI_UP_TABLE_UP6_SHIFT 18
+-#define I40E_AQ_VSI_UP_TABLE_UP6_MASK (0x7 << \
+- I40E_AQ_VSI_UP_TABLE_UP6_SHIFT)
+-#define I40E_AQ_VSI_UP_TABLE_UP7_SHIFT 21
+-#define I40E_AQ_VSI_UP_TABLE_UP7_MASK (0x7 << \
+- I40E_AQ_VSI_UP_TABLE_UP7_SHIFT)
+- __le32 egress_table; /* same defines as for ingress table */
+- /* cascaded PV section */
+- __le16 cas_pv_tag;
+- u8 cas_pv_flags;
+-#define I40E_AQ_VSI_CAS_PV_TAGX_SHIFT 0x00
+-#define I40E_AQ_VSI_CAS_PV_TAGX_MASK (0x03 << \
+- I40E_AQ_VSI_CAS_PV_TAGX_SHIFT)
+-#define I40E_AQ_VSI_CAS_PV_TAGX_LEAVE 0x00
+-#define I40E_AQ_VSI_CAS_PV_TAGX_REMOVE 0x01
+-#define I40E_AQ_VSI_CAS_PV_TAGX_COPY 0x02
+-#define I40E_AQ_VSI_CAS_PV_INSERT_TAG 0x10
+-#define I40E_AQ_VSI_CAS_PV_ETAG_PRUNE 0x20
+-#define I40E_AQ_VSI_CAS_PV_ACCEPT_HOST_TAG 0x40
+- u8 cas_pv_reserved;
+- /* queue mapping section */
+- __le16 mapping_flags;
+-#define I40E_AQ_VSI_QUE_MAP_CONTIG 0x0
+-#define I40E_AQ_VSI_QUE_MAP_NONCONTIG 0x1
+- __le16 queue_mapping[16];
+-#define I40E_AQ_VSI_QUEUE_SHIFT 0x0
+-#define I40E_AQ_VSI_QUEUE_MASK (0x7FF << I40E_AQ_VSI_QUEUE_SHIFT)
+- __le16 tc_mapping[8];
+-#define I40E_AQ_VSI_TC_QUE_OFFSET_SHIFT 0
+-#define I40E_AQ_VSI_TC_QUE_OFFSET_MASK (0x1FF << \
+- I40E_AQ_VSI_TC_QUE_OFFSET_SHIFT)
+-#define I40E_AQ_VSI_TC_QUE_NUMBER_SHIFT 9
+-#define I40E_AQ_VSI_TC_QUE_NUMBER_MASK (0x7 << \
+- I40E_AQ_VSI_TC_QUE_NUMBER_SHIFT)
+- /* queueing option section */
+- u8 queueing_opt_flags;
+-#define I40E_AQ_VSI_QUE_OPT_MULTICAST_UDP_ENA 0x04
+-#define I40E_AQ_VSI_QUE_OPT_UNICAST_UDP_ENA 0x08
+-#define I40E_AQ_VSI_QUE_OPT_TCP_ENA 0x10
+-#define I40E_AQ_VSI_QUE_OPT_FCOE_ENA 0x20
+-#define I40E_AQ_VSI_QUE_OPT_RSS_LUT_PF 0x00
+-#define I40E_AQ_VSI_QUE_OPT_RSS_LUT_VSI 0x40
+- u8 queueing_opt_reserved[3];
+- /* scheduler section */
+- u8 up_enable_bits;
+- u8 sched_reserved;
+- /* outer up section */
+- __le32 outer_up_table; /* same structure and defines as ingress tbl */
+- u8 cmd_reserved[8];
+- /* last 32 bytes are written by FW */
+- __le16 qs_handle[8];
+-#define I40E_AQ_VSI_QS_HANDLE_INVALID 0xFFFF
+- __le16 stat_counter_idx;
+- __le16 sched_id;
+- u8 resp_reserved[12];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(128, i40e_aqc_vsi_properties_data);
+-
+-/* Add Port Virtualizer (direct 0x0220)
+- * also used for update PV (direct 0x0221) but only flags are used
+- * (IS_CTRL_PORT only works on add PV)
+- */
+-struct i40e_aqc_add_update_pv {
+- __le16 command_flags;
+-#define I40E_AQC_PV_FLAG_PV_TYPE 0x1
+-#define I40E_AQC_PV_FLAG_FWD_UNKNOWN_STAG_EN 0x2
+-#define I40E_AQC_PV_FLAG_FWD_UNKNOWN_ETAG_EN 0x4
+-#define I40E_AQC_PV_FLAG_IS_CTRL_PORT 0x8
+- __le16 uplink_seid;
+- __le16 connected_seid;
+- u8 reserved[10];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_update_pv);
+-
+-struct i40e_aqc_add_update_pv_completion {
+- /* reserved for update; for add also encodes error if rc == ENOSPC */
+- __le16 pv_seid;
+-#define I40E_AQC_PV_ERR_FLAG_NO_PV 0x1
+-#define I40E_AQC_PV_ERR_FLAG_NO_SCHED 0x2
+-#define I40E_AQC_PV_ERR_FLAG_NO_COUNTER 0x4
+-#define I40E_AQC_PV_ERR_FLAG_NO_ENTRY 0x8
+- u8 reserved[14];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_update_pv_completion);
+-
+-/* Get PV Params (direct 0x0222)
+- * uses i40e_aqc_switch_seid for the descriptor
+- */
+-
+-struct i40e_aqc_get_pv_params_completion {
+- __le16 seid;
+- __le16 default_stag;
+- __le16 pv_flags; /* same flags as add_pv */
+-#define I40E_AQC_GET_PV_PV_TYPE 0x1
+-#define I40E_AQC_GET_PV_FRWD_UNKNOWN_STAG 0x2
+-#define I40E_AQC_GET_PV_FRWD_UNKNOWN_ETAG 0x4
+- u8 reserved[8];
+- __le16 default_port_seid;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_get_pv_params_completion);
+-
+-/* Add VEB (direct 0x0230) */
+-struct i40e_aqc_add_veb {
+- __le16 uplink_seid;
+- __le16 downlink_seid;
+- __le16 veb_flags;
+-#define I40E_AQC_ADD_VEB_FLOATING 0x1
+-#define I40E_AQC_ADD_VEB_PORT_TYPE_SHIFT 1
+-#define I40E_AQC_ADD_VEB_PORT_TYPE_MASK (0x3 << \
+- I40E_AQC_ADD_VEB_PORT_TYPE_SHIFT)
+-#define I40E_AQC_ADD_VEB_PORT_TYPE_DEFAULT 0x2
+-#define I40E_AQC_ADD_VEB_PORT_TYPE_DATA 0x4
+-#define I40E_AQC_ADD_VEB_ENABLE_L2_FILTER 0x8 /* deprecated */
+-#define I40E_AQC_ADD_VEB_ENABLE_DISABLE_STATS 0x10
+- u8 enable_tcs;
+- u8 reserved[9];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_veb);
+-
+-struct i40e_aqc_add_veb_completion {
+- u8 reserved[6];
+- __le16 switch_seid;
+- /* also encodes error if rc == ENOSPC; codes are the same as add_pv */
+- __le16 veb_seid;
+-#define I40E_AQC_VEB_ERR_FLAG_NO_VEB 0x1
+-#define I40E_AQC_VEB_ERR_FLAG_NO_SCHED 0x2
+-#define I40E_AQC_VEB_ERR_FLAG_NO_COUNTER 0x4
+-#define I40E_AQC_VEB_ERR_FLAG_NO_ENTRY 0x8
+- __le16 statistic_index;
+- __le16 vebs_used;
+- __le16 vebs_free;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_veb_completion);
+-
+-/* Get VEB Parameters (direct 0x0232)
+- * uses i40e_aqc_switch_seid for the descriptor
+- */
+-struct i40e_aqc_get_veb_parameters_completion {
+- __le16 seid;
+- __le16 switch_id;
+- __le16 veb_flags; /* only the first/last flags from 0x0230 is valid */
+- __le16 statistic_index;
+- __le16 vebs_used;
+- __le16 vebs_free;
+- u8 reserved[4];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_get_veb_parameters_completion);
+-
+-/* Delete Element (direct 0x0243)
+- * uses the generic i40e_aqc_switch_seid
+- */
+-
+-/* Add MAC-VLAN (indirect 0x0250) */
+-
+-/* used for the command for most vlan commands */
+-struct i40e_aqc_macvlan {
+- __le16 num_addresses;
+- __le16 seid[3];
+-#define I40E_AQC_MACVLAN_CMD_SEID_NUM_SHIFT 0
+-#define I40E_AQC_MACVLAN_CMD_SEID_NUM_MASK (0x3FF << \
+- I40E_AQC_MACVLAN_CMD_SEID_NUM_SHIFT)
+-#define I40E_AQC_MACVLAN_CMD_SEID_VALID 0x8000
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_macvlan);
+-
+-/* indirect data for command and response */
+-struct i40e_aqc_add_macvlan_element_data {
+- u8 mac_addr[6];
+- __le16 vlan_tag;
+- __le16 flags;
+-#define I40E_AQC_MACVLAN_ADD_PERFECT_MATCH 0x0001
+-#define I40E_AQC_MACVLAN_ADD_HASH_MATCH 0x0002
+-#define I40E_AQC_MACVLAN_ADD_IGNORE_VLAN 0x0004
+-#define I40E_AQC_MACVLAN_ADD_TO_QUEUE 0x0008
+-#define I40E_AQC_MACVLAN_ADD_USE_SHARED_MAC 0x0010
+- __le16 queue_number;
+-#define I40E_AQC_MACVLAN_CMD_QUEUE_SHIFT 0
+-#define I40E_AQC_MACVLAN_CMD_QUEUE_MASK (0x7FF << \
+- I40E_AQC_MACVLAN_CMD_SEID_NUM_SHIFT)
+- /* response section */
+- u8 match_method;
+-#define I40E_AQC_MM_PERFECT_MATCH 0x01
+-#define I40E_AQC_MM_HASH_MATCH 0x02
+-#define I40E_AQC_MM_ERR_NO_RES 0xFF
+- u8 reserved1[3];
+-};
+-
+-struct i40e_aqc_add_remove_macvlan_completion {
+- __le16 perfect_mac_used;
+- __le16 perfect_mac_free;
+- __le16 unicast_hash_free;
+- __le16 multicast_hash_free;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_remove_macvlan_completion);
+-
+-/* Remove MAC-VLAN (indirect 0x0251)
+- * uses i40e_aqc_macvlan for the descriptor
+- * data points to an array of num_addresses of elements
+- */
+-
+-struct i40e_aqc_remove_macvlan_element_data {
+- u8 mac_addr[6];
+- __le16 vlan_tag;
+- u8 flags;
+-#define I40E_AQC_MACVLAN_DEL_PERFECT_MATCH 0x01
+-#define I40E_AQC_MACVLAN_DEL_HASH_MATCH 0x02
+-#define I40E_AQC_MACVLAN_DEL_IGNORE_VLAN 0x08
+-#define I40E_AQC_MACVLAN_DEL_ALL_VSIS 0x10
+- u8 reserved[3];
+- /* reply section */
+- u8 error_code;
+-#define I40E_AQC_REMOVE_MACVLAN_SUCCESS 0x0
+-#define I40E_AQC_REMOVE_MACVLAN_FAIL 0xFF
+- u8 reply_reserved[3];
+-};
+-
+-/* Add VLAN (indirect 0x0252)
+- * Remove VLAN (indirect 0x0253)
+- * use the generic i40e_aqc_macvlan for the command
+- */
+-struct i40e_aqc_add_remove_vlan_element_data {
+- __le16 vlan_tag;
+- u8 vlan_flags;
+-/* flags for add VLAN */
+-#define I40E_AQC_ADD_VLAN_LOCAL 0x1
+-#define I40E_AQC_ADD_PVLAN_TYPE_SHIFT 1
+-#define I40E_AQC_ADD_PVLAN_TYPE_MASK (0x3 << I40E_AQC_ADD_PVLAN_TYPE_SHIFT)
+-#define I40E_AQC_ADD_PVLAN_TYPE_REGULAR 0x0
+-#define I40E_AQC_ADD_PVLAN_TYPE_PRIMARY 0x2
+-#define I40E_AQC_ADD_PVLAN_TYPE_SECONDARY 0x4
+-#define I40E_AQC_VLAN_PTYPE_SHIFT 3
+-#define I40E_AQC_VLAN_PTYPE_MASK (0x3 << I40E_AQC_VLAN_PTYPE_SHIFT)
+-#define I40E_AQC_VLAN_PTYPE_REGULAR_VSI 0x0
+-#define I40E_AQC_VLAN_PTYPE_PROMISC_VSI 0x8
+-#define I40E_AQC_VLAN_PTYPE_COMMUNITY_VSI 0x10
+-#define I40E_AQC_VLAN_PTYPE_ISOLATED_VSI 0x18
+-/* flags for remove VLAN */
+-#define I40E_AQC_REMOVE_VLAN_ALL 0x1
+- u8 reserved;
+- u8 result;
+-/* flags for add VLAN */
+-#define I40E_AQC_ADD_VLAN_SUCCESS 0x0
+-#define I40E_AQC_ADD_VLAN_FAIL_REQUEST 0xFE
+-#define I40E_AQC_ADD_VLAN_FAIL_RESOURCE 0xFF
+-/* flags for remove VLAN */
+-#define I40E_AQC_REMOVE_VLAN_SUCCESS 0x0
+-#define I40E_AQC_REMOVE_VLAN_FAIL 0xFF
+- u8 reserved1[3];
+-};
+-
+-struct i40e_aqc_add_remove_vlan_completion {
+- u8 reserved[4];
+- __le16 vlans_used;
+- __le16 vlans_free;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-/* Set VSI Promiscuous Modes (direct 0x0254) */
+-struct i40e_aqc_set_vsi_promiscuous_modes {
+- __le16 promiscuous_flags;
+- __le16 valid_flags;
+-/* flags used for both fields above */
+-#define I40E_AQC_SET_VSI_PROMISC_UNICAST 0x01
+-#define I40E_AQC_SET_VSI_PROMISC_MULTICAST 0x02
+-#define I40E_AQC_SET_VSI_PROMISC_BROADCAST 0x04
+-#define I40E_AQC_SET_VSI_DEFAULT 0x08
+-#define I40E_AQC_SET_VSI_PROMISC_VLAN 0x10
+-#define I40E_AQC_SET_VSI_PROMISC_TX 0x8000
+- __le16 seid;
+-#define I40E_AQC_VSI_PROM_CMD_SEID_MASK 0x3FF
+- __le16 vlan_tag;
+-#define I40E_AQC_SET_VSI_VLAN_MASK 0x0FFF
+-#define I40E_AQC_SET_VSI_VLAN_VALID 0x8000
+- u8 reserved[8];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_set_vsi_promiscuous_modes);
+-
+-/* Add S/E-tag command (direct 0x0255)
+- * Uses generic i40e_aqc_add_remove_tag_completion for completion
+- */
+-struct i40e_aqc_add_tag {
+- __le16 flags;
+-#define I40E_AQC_ADD_TAG_FLAG_TO_QUEUE 0x0001
+- __le16 seid;
+-#define I40E_AQC_ADD_TAG_CMD_SEID_NUM_SHIFT 0
+-#define I40E_AQC_ADD_TAG_CMD_SEID_NUM_MASK (0x3FF << \
+- I40E_AQC_ADD_TAG_CMD_SEID_NUM_SHIFT)
+- __le16 tag;
+- __le16 queue_number;
+- u8 reserved[8];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_tag);
+-
+-struct i40e_aqc_add_remove_tag_completion {
+- u8 reserved[12];
+- __le16 tags_used;
+- __le16 tags_free;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_remove_tag_completion);
+-
+-/* Remove S/E-tag command (direct 0x0256)
+- * Uses generic i40e_aqc_add_remove_tag_completion for completion
+- */
+-struct i40e_aqc_remove_tag {
+- __le16 seid;
+-#define I40E_AQC_REMOVE_TAG_CMD_SEID_NUM_SHIFT 0
+-#define I40E_AQC_REMOVE_TAG_CMD_SEID_NUM_MASK (0x3FF << \
+- I40E_AQC_REMOVE_TAG_CMD_SEID_NUM_SHIFT)
+- __le16 tag;
+- u8 reserved[12];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_remove_tag);
+-
+-/* Add multicast E-Tag (direct 0x0257)
+- * del multicast E-Tag (direct 0x0258) only uses pv_seid and etag fields
+- * and no external data
+- */
+-struct i40e_aqc_add_remove_mcast_etag {
+- __le16 pv_seid;
+- __le16 etag;
+- u8 num_unicast_etags;
+- u8 reserved[3];
+- __le32 addr_high; /* address of array of 2-byte s-tags */
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_remove_mcast_etag);
+-
+-struct i40e_aqc_add_remove_mcast_etag_completion {
+- u8 reserved[4];
+- __le16 mcast_etags_used;
+- __le16 mcast_etags_free;
+- __le32 addr_high;
+- __le32 addr_low;
+-
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_remove_mcast_etag_completion);
+-
+-/* Update S/E-Tag (direct 0x0259) */
+-struct i40e_aqc_update_tag {
+- __le16 seid;
+-#define I40E_AQC_UPDATE_TAG_CMD_SEID_NUM_SHIFT 0
+-#define I40E_AQC_UPDATE_TAG_CMD_SEID_NUM_MASK (0x3FF << \
+- I40E_AQC_UPDATE_TAG_CMD_SEID_NUM_SHIFT)
+- __le16 old_tag;
+- __le16 new_tag;
+- u8 reserved[10];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_update_tag);
+-
+-struct i40e_aqc_update_tag_completion {
+- u8 reserved[12];
+- __le16 tags_used;
+- __le16 tags_free;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_update_tag_completion);
+-
+-/* Add Control Packet filter (direct 0x025A)
+- * Remove Control Packet filter (direct 0x025B)
+- * uses the i40e_aqc_add_oveb_cloud,
+- * and the generic direct completion structure
+- */
+-struct i40e_aqc_add_remove_control_packet_filter {
+- u8 mac[6];
+- __le16 etype;
+- __le16 flags;
+-#define I40E_AQC_ADD_CONTROL_PACKET_FLAGS_IGNORE_MAC 0x0001
+-#define I40E_AQC_ADD_CONTROL_PACKET_FLAGS_DROP 0x0002
+-#define I40E_AQC_ADD_CONTROL_PACKET_FLAGS_TO_QUEUE 0x0004
+-#define I40E_AQC_ADD_CONTROL_PACKET_FLAGS_TX 0x0008
+-#define I40E_AQC_ADD_CONTROL_PACKET_FLAGS_RX 0x0000
+- __le16 seid;
+-#define I40E_AQC_ADD_CONTROL_PACKET_CMD_SEID_NUM_SHIFT 0
+-#define I40E_AQC_ADD_CONTROL_PACKET_CMD_SEID_NUM_MASK (0x3FF << \
+- I40E_AQC_ADD_CONTROL_PACKET_CMD_SEID_NUM_SHIFT)
+- __le16 queue;
+- u8 reserved[2];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_remove_control_packet_filter);
+-
+-struct i40e_aqc_add_remove_control_packet_filter_completion {
+- __le16 mac_etype_used;
+- __le16 etype_used;
+- __le16 mac_etype_free;
+- __le16 etype_free;
+- u8 reserved[8];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_remove_control_packet_filter_completion);
+-
+-/* Add Cloud filters (indirect 0x025C)
+- * Remove Cloud filters (indirect 0x025D)
+- * uses the i40e_aqc_add_remove_cloud_filters,
+- * and the generic indirect completion structure
+- */
+-struct i40e_aqc_add_remove_cloud_filters {
+- u8 num_filters;
+- u8 reserved;
+- __le16 seid;
+-#define I40E_AQC_ADD_CLOUD_CMD_SEID_NUM_SHIFT 0
+-#define I40E_AQC_ADD_CLOUD_CMD_SEID_NUM_MASK (0x3FF << \
+- I40E_AQC_ADD_CLOUD_CMD_SEID_NUM_SHIFT)
+- u8 big_buffer_flag;
+-#define I40E_AQC_ADD_CLOUD_CMD_BB 1
+- u8 reserved2[3];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_remove_cloud_filters);
+-
+-struct i40e_aqc_cloud_filters_element_data {
+- u8 outer_mac[6];
+- u8 inner_mac[6];
+- __le16 inner_vlan;
+- union {
+- struct {
+- u8 reserved[12];
+- u8 data[4];
+- } v4;
+- struct {
+- u8 data[16];
+- } v6;
+- struct {
+- __le16 data[8];
+- } raw_v6;
+- } ipaddr;
+- __le16 flags;
+-#define I40E_AQC_ADD_CLOUD_FILTER_SHIFT 0
+-#define I40E_AQC_ADD_CLOUD_FILTER_MASK (0x3F << \
+- I40E_AQC_ADD_CLOUD_FILTER_SHIFT)
+-/* 0x0000 reserved */
+-#define I40E_AQC_ADD_CLOUD_FILTER_OIP 0x0001
+-/* 0x0002 reserved */
+-#define I40E_AQC_ADD_CLOUD_FILTER_IMAC_IVLAN 0x0003
+-#define I40E_AQC_ADD_CLOUD_FILTER_IMAC_IVLAN_TEN_ID 0x0004
+-/* 0x0005 reserved */
+-#define I40E_AQC_ADD_CLOUD_FILTER_IMAC_TEN_ID 0x0006
+-/* 0x0007 reserved */
+-/* 0x0008 reserved */
+-#define I40E_AQC_ADD_CLOUD_FILTER_OMAC 0x0009
+-#define I40E_AQC_ADD_CLOUD_FILTER_IMAC 0x000A
+-#define I40E_AQC_ADD_CLOUD_FILTER_OMAC_TEN_ID_IMAC 0x000B
+-#define I40E_AQC_ADD_CLOUD_FILTER_IIP 0x000C
+-/* 0x0010 to 0x0017 is for custom filters */
+-#define I40E_AQC_ADD_CLOUD_FILTER_IP_PORT 0x0010 /* Dest IP + L4 Port */
+-#define I40E_AQC_ADD_CLOUD_FILTER_MAC_PORT 0x0011 /* Dest MAC + L4 Port */
+-#define I40E_AQC_ADD_CLOUD_FILTER_MAC_VLAN_PORT 0x0012 /* Dest MAC + VLAN + L4 Port */
+-
+-#define I40E_AQC_ADD_CLOUD_FLAGS_TO_QUEUE 0x0080
+-#define I40E_AQC_ADD_CLOUD_VNK_SHIFT 6
+-#define I40E_AQC_ADD_CLOUD_VNK_MASK 0x00C0
+-#define I40E_AQC_ADD_CLOUD_FLAGS_IPV4 0
+-#define I40E_AQC_ADD_CLOUD_FLAGS_IPV6 0x0100
+-
+-#define I40E_AQC_ADD_CLOUD_TNL_TYPE_SHIFT 9
+-#define I40E_AQC_ADD_CLOUD_TNL_TYPE_MASK 0x1E00
+-#define I40E_AQC_ADD_CLOUD_TNL_TYPE_VXLAN 0
+-#define I40E_AQC_ADD_CLOUD_TNL_TYPE_NVGRE_OMAC 1
+-#define I40E_AQC_ADD_CLOUD_TNL_TYPE_GENEVE 2
+-#define I40E_AQC_ADD_CLOUD_TNL_TYPE_IP 3
+-#define I40E_AQC_ADD_CLOUD_TNL_TYPE_RESERVED 4
+-#define I40E_AQC_ADD_CLOUD_TNL_TYPE_VXLAN_GPE 5
+-
+-#define I40E_AQC_ADD_CLOUD_FLAGS_SHARED_OUTER_MAC 0x2000
+-#define I40E_AQC_ADD_CLOUD_FLAGS_SHARED_INNER_MAC 0x4000
+-#define I40E_AQC_ADD_CLOUD_FLAGS_SHARED_OUTER_IP 0x8000
+-
+- __le32 tenant_id;
+- u8 reserved[4];
+- __le16 queue_number;
+-#define I40E_AQC_ADD_CLOUD_QUEUE_SHIFT 0
+-#define I40E_AQC_ADD_CLOUD_QUEUE_MASK (0x7FF << \
+- I40E_AQC_ADD_CLOUD_QUEUE_SHIFT)
+- u8 reserved2[14];
+- /* response section */
+- u8 allocation_result;
+-#define I40E_AQC_ADD_CLOUD_FILTER_SUCCESS 0x0
+-#define I40E_AQC_ADD_CLOUD_FILTER_FAIL 0xFF
+- u8 response_reserved[7];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x40, i40e_aqc_cloud_filters_element_data);
+-
+-/* i40e_aqc_cloud_filters_element_bb is used when
+- * I40E_AQC_ADD_CLOUD_CMD_BB flag is set.
+- */
+-struct i40e_aqc_cloud_filters_element_bb {
+- struct i40e_aqc_cloud_filters_element_data element;
+- u16 general_fields[32];
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X10_WORD0 0
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X10_WORD1 1
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X10_WORD2 2
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X11_WORD0 3
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X11_WORD1 4
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X11_WORD2 5
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X12_WORD0 6
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X12_WORD1 7
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X12_WORD2 8
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X13_WORD0 9
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X13_WORD1 10
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X13_WORD2 11
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X14_WORD0 12
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X14_WORD1 13
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X14_WORD2 14
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X16_WORD0 15
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X16_WORD1 16
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X16_WORD2 17
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X16_WORD3 18
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X16_WORD4 19
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X16_WORD5 20
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X16_WORD6 21
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X16_WORD7 22
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X17_WORD0 23
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X17_WORD1 24
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X17_WORD2 25
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X17_WORD3 26
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X17_WORD4 27
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X17_WORD5 28
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X17_WORD6 29
+-#define I40E_AQC_ADD_CLOUD_FV_FLU_0X17_WORD7 30
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x80, i40e_aqc_cloud_filters_element_bb);
+-
+-struct i40e_aqc_remove_cloud_filters_completion {
+- __le16 perfect_ovlan_used;
+- __le16 perfect_ovlan_free;
+- __le16 vlan_used;
+- __le16 vlan_free;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_remove_cloud_filters_completion);
+-
+-/* Replace filter Command 0x025F
+- * uses the i40e_aqc_replace_cloud_filters,
+- * and the generic indirect completion structure
+- */
+-struct i40e_filter_data {
+- u8 filter_type;
+- u8 input[3];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(4, i40e_filter_data);
+-
+-struct i40e_aqc_replace_cloud_filters_cmd {
+- u8 valid_flags;
+-#define I40E_AQC_REPLACE_L1_FILTER 0x0
+-#define I40E_AQC_REPLACE_CLOUD_FILTER 0x1
+-#define I40E_AQC_GET_CLOUD_FILTERS 0x2
+-#define I40E_AQC_MIRROR_CLOUD_FILTER 0x4
+-#define I40E_AQC_HIGH_PRIORITY_CLOUD_FILTER 0x8
+- u8 old_filter_type;
+- u8 new_filter_type;
+- u8 tr_bit;
+- u8 reserved[4];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_replace_cloud_filters_cmd);
+-
+-struct i40e_aqc_replace_cloud_filters_cmd_buf {
+- u8 data[32];
+-/* Filter type INPUT codes*/
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_ENTRIES_MAX 3
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_VALIDATED BIT(7)
+-
+-/* Field Vector offsets */
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_FV_MAC_DA 0
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_FV_STAG_ETH 6
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_FV_STAG 7
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_FV_VLAN 8
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_FV_STAG_OVLAN 9
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_FV_STAG_IVLAN 10
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_FV_TUNNLE_KEY 11
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_FV_IMAC 12
+-/* big FLU */
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_FV_IP_DA 14
+-/* big FLU */
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_FV_OIP_DA 15
+-
+-#define I40E_AQC_REPLACE_CLOUD_CMD_INPUT_FV_INNER_VLAN 37
+- struct i40e_filter_data filters[8];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x40, i40e_aqc_replace_cloud_filters_cmd_buf);
+-
+-/* Add Mirror Rule (indirect or direct 0x0260)
+- * Delete Mirror Rule (indirect or direct 0x0261)
+- * note: some rule types (4,5) do not use an external buffer.
+- * take care to set the flags correctly.
+- */
+-struct i40e_aqc_add_delete_mirror_rule {
+- __le16 seid;
+- __le16 rule_type;
+-#define I40E_AQC_MIRROR_RULE_TYPE_SHIFT 0
+-#define I40E_AQC_MIRROR_RULE_TYPE_MASK (0x7 << \
+- I40E_AQC_MIRROR_RULE_TYPE_SHIFT)
+-#define I40E_AQC_MIRROR_RULE_TYPE_VPORT_INGRESS 1
+-#define I40E_AQC_MIRROR_RULE_TYPE_VPORT_EGRESS 2
+-#define I40E_AQC_MIRROR_RULE_TYPE_VLAN 3
+-#define I40E_AQC_MIRROR_RULE_TYPE_ALL_INGRESS 4
+-#define I40E_AQC_MIRROR_RULE_TYPE_ALL_EGRESS 5
+- __le16 num_entries;
+- __le16 destination; /* VSI for add, rule id for delete */
+- __le32 addr_high; /* address of array of 2-byte VSI or VLAN ids */
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_delete_mirror_rule);
+-
+-struct i40e_aqc_add_delete_mirror_rule_completion {
+- u8 reserved[2];
+- __le16 rule_id; /* only used on add */
+- __le16 mirror_rules_used;
+- __le16 mirror_rules_free;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_delete_mirror_rule_completion);
+-
+-/* Dynamic Device Personalization */
+-struct i40e_aqc_write_personalization_profile {
+- u8 flags;
+- u8 reserved[3];
+- __le32 profile_track_id;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_write_personalization_profile);
+-
+-struct i40e_aqc_write_ddp_resp {
+- __le32 error_offset;
+- __le32 error_info;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-struct i40e_aqc_get_applied_profiles {
+- u8 flags;
+-#define I40E_AQC_GET_DDP_GET_CONF 0x1
+-#define I40E_AQC_GET_DDP_GET_RDPU_CONF 0x2
+- u8 rsv[3];
+- __le32 reserved;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_get_applied_profiles);
+-
+-/* DCB 0x03xx*/
+-
+-/* PFC Ignore (direct 0x0301)
+- * the command and response use the same descriptor structure
+- */
+-struct i40e_aqc_pfc_ignore {
+- u8 tc_bitmap;
+- u8 command_flags; /* unused on response */
+-#define I40E_AQC_PFC_IGNORE_SET 0x80
+-#define I40E_AQC_PFC_IGNORE_CLEAR 0x0
+- u8 reserved[14];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_pfc_ignore);
+-
+-/* DCB Update (direct 0x0302) uses the i40e_aq_desc structure
+- * with no parameters
+- */
+-
+-/* TX scheduler 0x04xx */
+-
+-/* Almost all the indirect commands use
+- * this generic struct to pass the SEID in param0
+- */
+-struct i40e_aqc_tx_sched_ind {
+- __le16 vsi_seid;
+- u8 reserved[6];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_tx_sched_ind);
+-
+-/* Several commands respond with a set of queue set handles */
+-struct i40e_aqc_qs_handles_resp {
+- __le16 qs_handles[8];
+-};
+-
+-/* Configure VSI BW limits (direct 0x0400) */
+-struct i40e_aqc_configure_vsi_bw_limit {
+- __le16 vsi_seid;
+- u8 reserved[2];
+- __le16 credit;
+- u8 reserved1[2];
+- u8 max_credit; /* 0-3, limit = 2^max */
+- u8 reserved2[7];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_configure_vsi_bw_limit);
+-
+-/* Configure VSI Bandwidth Limit per Traffic Type (indirect 0x0406)
+- * responds with i40e_aqc_qs_handles_resp
+- */
+-struct i40e_aqc_configure_vsi_ets_sla_bw_data {
+- u8 tc_valid_bits;
+- u8 reserved[15];
+- __le16 tc_bw_credits[8]; /* FW writesback QS handles here */
+-
+- /* 4 bits per tc 0-7, 4th bit is reserved, limit = 2^max */
+- __le16 tc_bw_max[2];
+- u8 reserved1[28];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x40, i40e_aqc_configure_vsi_ets_sla_bw_data);
+-
+-/* Configure VSI Bandwidth Allocation per Traffic Type (indirect 0x0407)
+- * responds with i40e_aqc_qs_handles_resp
+- */
+-struct i40e_aqc_configure_vsi_tc_bw_data {
+- u8 tc_valid_bits;
+- u8 reserved[3];
+- u8 tc_bw_credits[8];
+- u8 reserved1[4];
+- __le16 qs_handles[8];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x20, i40e_aqc_configure_vsi_tc_bw_data);
+-
+-/* Query vsi bw configuration (indirect 0x0408) */
+-struct i40e_aqc_query_vsi_bw_config_resp {
+- u8 tc_valid_bits;
+- u8 tc_suspended_bits;
+- u8 reserved[14];
+- __le16 qs_handles[8];
+- u8 reserved1[4];
+- __le16 port_bw_limit;
+- u8 reserved2[2];
+- u8 max_bw; /* 0-3, limit = 2^max */
+- u8 reserved3[23];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x40, i40e_aqc_query_vsi_bw_config_resp);
+-
+-/* Query VSI Bandwidth Allocation per Traffic Type (indirect 0x040A) */
+-struct i40e_aqc_query_vsi_ets_sla_config_resp {
+- u8 tc_valid_bits;
+- u8 reserved[3];
+- u8 share_credits[8];
+- __le16 credits[8];
+-
+- /* 4 bits per tc 0-7, 4th bit is reserved, limit = 2^max */
+- __le16 tc_bw_max[2];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x20, i40e_aqc_query_vsi_ets_sla_config_resp);
+-
+-/* Configure Switching Component Bandwidth Limit (direct 0x0410) */
+-struct i40e_aqc_configure_switching_comp_bw_limit {
+- __le16 seid;
+- u8 reserved[2];
+- __le16 credit;
+- u8 reserved1[2];
+- u8 max_bw; /* 0-3, limit = 2^max */
+- u8 reserved2[7];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_configure_switching_comp_bw_limit);
+-
+-/* Enable Physical Port ETS (indirect 0x0413)
+- * Modify Physical Port ETS (indirect 0x0414)
+- * Disable Physical Port ETS (indirect 0x0415)
+- */
+-struct i40e_aqc_configure_switching_comp_ets_data {
+- u8 reserved[4];
+- u8 tc_valid_bits;
+- u8 seepage;
+-#define I40E_AQ_ETS_SEEPAGE_EN_MASK 0x1
+- u8 tc_strict_priority_flags;
+- u8 reserved1[17];
+- u8 tc_bw_share_credits[8];
+- u8 reserved2[96];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x80, i40e_aqc_configure_switching_comp_ets_data);
+-
+-/* Configure Switching Component Bandwidth Limits per Tc (indirect 0x0416) */
+-struct i40e_aqc_configure_switching_comp_ets_bw_limit_data {
+- u8 tc_valid_bits;
+- u8 reserved[15];
+- __le16 tc_bw_credit[8];
+-
+- /* 4 bits per tc 0-7, 4th bit is reserved, limit = 2^max */
+- __le16 tc_bw_max[2];
+- u8 reserved1[28];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x40,
+- i40e_aqc_configure_switching_comp_ets_bw_limit_data);
+-
+-/* Configure Switching Component Bandwidth Allocation per Tc
+- * (indirect 0x0417)
+- */
+-struct i40e_aqc_configure_switching_comp_bw_config_data {
+- u8 tc_valid_bits;
+- u8 reserved[2];
+- u8 absolute_credits; /* bool */
+- u8 tc_bw_share_credits[8];
+- u8 reserved1[20];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x20, i40e_aqc_configure_switching_comp_bw_config_data);
+-
+-/* Query Switching Component Configuration (indirect 0x0418) */
+-struct i40e_aqc_query_switching_comp_ets_config_resp {
+- u8 tc_valid_bits;
+- u8 reserved[35];
+- __le16 port_bw_limit;
+- u8 reserved1[2];
+- u8 tc_bw_max; /* 0-3, limit = 2^max */
+- u8 reserved2[23];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x40, i40e_aqc_query_switching_comp_ets_config_resp);
+-
+-/* Query PhysicalPort ETS Configuration (indirect 0x0419) */
+-struct i40e_aqc_query_port_ets_config_resp {
+- u8 reserved[4];
+- u8 tc_valid_bits;
+- u8 reserved1;
+- u8 tc_strict_priority_bits;
+- u8 reserved2;
+- u8 tc_bw_share_credits[8];
+- __le16 tc_bw_limits[8];
+-
+- /* 4 bits per tc 0-7, 4th bit reserved, limit = 2^max */
+- __le16 tc_bw_max[2];
+- u8 reserved3[32];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x44, i40e_aqc_query_port_ets_config_resp);
+-
+-/* Query Switching Component Bandwidth Allocation per Traffic Type
+- * (indirect 0x041A)
+- */
+-struct i40e_aqc_query_switching_comp_bw_config_resp {
+- u8 tc_valid_bits;
+- u8 reserved[2];
+- u8 absolute_credits_enable; /* bool */
+- u8 tc_bw_share_credits[8];
+- __le16 tc_bw_limits[8];
+-
+- /* 4 bits per tc 0-7, 4th bit is reserved, limit = 2^max */
+- __le16 tc_bw_max[2];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x20, i40e_aqc_query_switching_comp_bw_config_resp);
+-
+-/* Suspend/resume port TX traffic
+- * (direct 0x041B and 0x041C) uses the generic SEID struct
+- */
+-
+-/* Configure partition BW
+- * (indirect 0x041D)
+- */
+-struct i40e_aqc_configure_partition_bw_data {
+- __le16 pf_valid_bits;
+- u8 min_bw[16]; /* guaranteed bandwidth */
+- u8 max_bw[16]; /* bandwidth limit */
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x22, i40e_aqc_configure_partition_bw_data);
+-
+-/* Get and set the active HMC resource profile and status.
+- * (direct 0x0500) and (direct 0x0501)
+- */
+-struct i40e_aq_get_set_hmc_resource_profile {
+- u8 pm_profile;
+- u8 pe_vf_enabled;
+- u8 reserved[14];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aq_get_set_hmc_resource_profile);
+-
+-enum i40e_aq_hmc_profile {
+- /* I40E_HMC_PROFILE_NO_CHANGE = 0, reserved */
+- I40E_HMC_PROFILE_DEFAULT = 1,
+- I40E_HMC_PROFILE_FAVOR_VF = 2,
+- I40E_HMC_PROFILE_EQUAL = 3,
+-};
+-
+-/* Get PHY Abilities (indirect 0x0600) uses the generic indirect struct */
+-
+-/* set in param0 for get phy abilities to report qualified modules */
+-#define I40E_AQ_PHY_REPORT_QUALIFIED_MODULES 0x0001
+-#define I40E_AQ_PHY_REPORT_INITIAL_VALUES 0x0002
+-
+-enum i40e_aq_phy_type {
+- I40E_PHY_TYPE_SGMII = 0x0,
+- I40E_PHY_TYPE_1000BASE_KX = 0x1,
+- I40E_PHY_TYPE_10GBASE_KX4 = 0x2,
+- I40E_PHY_TYPE_10GBASE_KR = 0x3,
+- I40E_PHY_TYPE_40GBASE_KR4 = 0x4,
+- I40E_PHY_TYPE_XAUI = 0x5,
+- I40E_PHY_TYPE_XFI = 0x6,
+- I40E_PHY_TYPE_SFI = 0x7,
+- I40E_PHY_TYPE_XLAUI = 0x8,
+- I40E_PHY_TYPE_XLPPI = 0x9,
+- I40E_PHY_TYPE_40GBASE_CR4_CU = 0xA,
+- I40E_PHY_TYPE_10GBASE_CR1_CU = 0xB,
+- I40E_PHY_TYPE_10GBASE_AOC = 0xC,
+- I40E_PHY_TYPE_40GBASE_AOC = 0xD,
+- I40E_PHY_TYPE_UNRECOGNIZED = 0xE,
+- I40E_PHY_TYPE_UNSUPPORTED = 0xF,
+- I40E_PHY_TYPE_100BASE_TX = 0x11,
+- I40E_PHY_TYPE_1000BASE_T = 0x12,
+- I40E_PHY_TYPE_10GBASE_T = 0x13,
+- I40E_PHY_TYPE_10GBASE_SR = 0x14,
+- I40E_PHY_TYPE_10GBASE_LR = 0x15,
+- I40E_PHY_TYPE_10GBASE_SFPP_CU = 0x16,
+- I40E_PHY_TYPE_10GBASE_CR1 = 0x17,
+- I40E_PHY_TYPE_40GBASE_CR4 = 0x18,
+- I40E_PHY_TYPE_40GBASE_SR4 = 0x19,
+- I40E_PHY_TYPE_40GBASE_LR4 = 0x1A,
+- I40E_PHY_TYPE_1000BASE_SX = 0x1B,
+- I40E_PHY_TYPE_1000BASE_LX = 0x1C,
+- I40E_PHY_TYPE_1000BASE_T_OPTICAL = 0x1D,
+- I40E_PHY_TYPE_20GBASE_KR2 = 0x1E,
+- I40E_PHY_TYPE_25GBASE_KR = 0x1F,
+- I40E_PHY_TYPE_25GBASE_CR = 0x20,
+- I40E_PHY_TYPE_25GBASE_SR = 0x21,
+- I40E_PHY_TYPE_25GBASE_LR = 0x22,
+- I40E_PHY_TYPE_25GBASE_AOC = 0x23,
+- I40E_PHY_TYPE_25GBASE_ACC = 0x24,
+- I40E_PHY_TYPE_MAX,
+- I40E_PHY_TYPE_NOT_SUPPORTED_HIGH_TEMP = 0xFD,
+- I40E_PHY_TYPE_EMPTY = 0xFE,
+- I40E_PHY_TYPE_DEFAULT = 0xFF,
+-};
+-
+-#define I40E_LINK_SPEED_100MB_SHIFT 0x1
+-#define I40E_LINK_SPEED_1000MB_SHIFT 0x2
+-#define I40E_LINK_SPEED_10GB_SHIFT 0x3
+-#define I40E_LINK_SPEED_40GB_SHIFT 0x4
+-#define I40E_LINK_SPEED_20GB_SHIFT 0x5
+-#define I40E_LINK_SPEED_25GB_SHIFT 0x6
+-
+-enum i40e_aq_link_speed {
+- I40E_LINK_SPEED_UNKNOWN = 0,
+- I40E_LINK_SPEED_100MB = BIT(I40E_LINK_SPEED_100MB_SHIFT),
+- I40E_LINK_SPEED_1GB = BIT(I40E_LINK_SPEED_1000MB_SHIFT),
+- I40E_LINK_SPEED_10GB = BIT(I40E_LINK_SPEED_10GB_SHIFT),
+- I40E_LINK_SPEED_40GB = BIT(I40E_LINK_SPEED_40GB_SHIFT),
+- I40E_LINK_SPEED_20GB = BIT(I40E_LINK_SPEED_20GB_SHIFT),
+- I40E_LINK_SPEED_25GB = BIT(I40E_LINK_SPEED_25GB_SHIFT),
+-};
+-
+-struct i40e_aqc_module_desc {
+- u8 oui[3];
+- u8 reserved1;
+- u8 part_number[16];
+- u8 revision[4];
+- u8 reserved2[8];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x20, i40e_aqc_module_desc);
+-
+-struct i40e_aq_get_phy_abilities_resp {
+- __le32 phy_type; /* bitmap using the above enum for offsets */
+- u8 link_speed; /* bitmap using the above enum bit patterns */
+- u8 abilities;
+-#define I40E_AQ_PHY_FLAG_PAUSE_TX 0x01
+-#define I40E_AQ_PHY_FLAG_PAUSE_RX 0x02
+-#define I40E_AQ_PHY_FLAG_LOW_POWER 0x04
+-#define I40E_AQ_PHY_LINK_ENABLED 0x08
+-#define I40E_AQ_PHY_AN_ENABLED 0x10
+-#define I40E_AQ_PHY_FLAG_MODULE_QUAL 0x20
+-#define I40E_AQ_PHY_FEC_ABILITY_KR 0x40
+-#define I40E_AQ_PHY_FEC_ABILITY_RS 0x80
+- __le16 eee_capability;
+-#define I40E_AQ_EEE_100BASE_TX 0x0002
+-#define I40E_AQ_EEE_1000BASE_T 0x0004
+-#define I40E_AQ_EEE_10GBASE_T 0x0008
+-#define I40E_AQ_EEE_1000BASE_KX 0x0010
+-#define I40E_AQ_EEE_10GBASE_KX4 0x0020
+-#define I40E_AQ_EEE_10GBASE_KR 0x0040
+- __le32 eeer_val;
+- u8 d3_lpan;
+-#define I40E_AQ_SET_PHY_D3_LPAN_ENA 0x01
+- u8 phy_type_ext;
+-#define I40E_AQ_PHY_TYPE_EXT_25G_KR 0X01
+-#define I40E_AQ_PHY_TYPE_EXT_25G_CR 0X02
+-#define I40E_AQ_PHY_TYPE_EXT_25G_SR 0x04
+-#define I40E_AQ_PHY_TYPE_EXT_25G_LR 0x08
+-#define I40E_AQ_PHY_TYPE_EXT_25G_AOC 0x10
+-#define I40E_AQ_PHY_TYPE_EXT_25G_ACC 0x20
+- u8 fec_cfg_curr_mod_ext_info;
+-#define I40E_AQ_ENABLE_FEC_KR 0x01
+-#define I40E_AQ_ENABLE_FEC_RS 0x02
+-#define I40E_AQ_REQUEST_FEC_KR 0x04
+-#define I40E_AQ_REQUEST_FEC_RS 0x08
+-#define I40E_AQ_ENABLE_FEC_AUTO 0x10
+-#define I40E_AQ_FEC
+-#define I40E_AQ_MODULE_TYPE_EXT_MASK 0xE0
+-#define I40E_AQ_MODULE_TYPE_EXT_SHIFT 5
+-
+- u8 ext_comp_code;
+- u8 phy_id[4];
+- u8 module_type[3];
+- u8 qualified_module_count;
+-#define I40E_AQ_PHY_MAX_QMS 16
+- struct i40e_aqc_module_desc qualified_module[I40E_AQ_PHY_MAX_QMS];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x218, i40e_aq_get_phy_abilities_resp);
+-
+-/* Set PHY Config (direct 0x0601) */
+-struct i40e_aq_set_phy_config { /* same bits as above in all */
+- __le32 phy_type;
+- u8 link_speed;
+- u8 abilities;
+-/* bits 0-2 use the values from get_phy_abilities_resp */
+-#define I40E_AQ_PHY_ENABLE_LINK 0x08
+-#define I40E_AQ_PHY_ENABLE_AN 0x10
+-#define I40E_AQ_PHY_ENABLE_ATOMIC_LINK 0x20
+- __le16 eee_capability;
+- __le32 eeer;
+- u8 low_power_ctrl;
+- u8 phy_type_ext;
+-#define I40E_AQ_PHY_TYPE_EXT_25G_KR 0X01
+-#define I40E_AQ_PHY_TYPE_EXT_25G_CR 0X02
+-#define I40E_AQ_PHY_TYPE_EXT_25G_SR 0x04
+-#define I40E_AQ_PHY_TYPE_EXT_25G_LR 0x08
+- u8 fec_config;
+-#define I40E_AQ_SET_FEC_ABILITY_KR BIT(0)
+-#define I40E_AQ_SET_FEC_ABILITY_RS BIT(1)
+-#define I40E_AQ_SET_FEC_REQUEST_KR BIT(2)
+-#define I40E_AQ_SET_FEC_REQUEST_RS BIT(3)
+-#define I40E_AQ_SET_FEC_AUTO BIT(4)
+-#define I40E_AQ_PHY_FEC_CONFIG_SHIFT 0x0
+-#define I40E_AQ_PHY_FEC_CONFIG_MASK (0x1F << I40E_AQ_PHY_FEC_CONFIG_SHIFT)
+- u8 reserved;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aq_set_phy_config);
+-
+-/* Set MAC Config command data structure (direct 0x0603) */
+-struct i40e_aq_set_mac_config {
+- __le16 max_frame_size;
+- u8 params;
+-#define I40E_AQ_SET_MAC_CONFIG_CRC_EN 0x04
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_MASK 0x78
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_SHIFT 3
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_NONE 0x0
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_1B_13TX 0xF
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_1DW_9TX 0x9
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_1DW_4TX 0x8
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_3DW_7TX 0x7
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_2DW_3TX 0x6
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_1DW_1TX 0x5
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_3DW_2TX 0x4
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_7DW_3TX 0x3
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_4DW_1TX 0x2
+-#define I40E_AQ_SET_MAC_CONFIG_PACING_9DW_1TX 0x1
+- u8 tx_timer_priority; /* bitmap */
+- __le16 tx_timer_value;
+- __le16 fc_refresh_threshold;
+- u8 reserved[8];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aq_set_mac_config);
+-
+-/* Restart Auto-Negotiation (direct 0x605) */
+-struct i40e_aqc_set_link_restart_an {
+- u8 command;
+-#define I40E_AQ_PHY_RESTART_AN 0x02
+-#define I40E_AQ_PHY_LINK_ENABLE 0x04
+- u8 reserved[15];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_set_link_restart_an);
+-
+-/* Get Link Status cmd & response data structure (direct 0x0607) */
+-struct i40e_aqc_get_link_status {
+- __le16 command_flags; /* only field set on command */
+-#define I40E_AQ_LSE_MASK 0x3
+-#define I40E_AQ_LSE_NOP 0x0
+-#define I40E_AQ_LSE_DISABLE 0x2
+-#define I40E_AQ_LSE_ENABLE 0x3
+-/* only response uses this flag */
+-#define I40E_AQ_LSE_IS_ENABLED 0x1
+- u8 phy_type; /* i40e_aq_phy_type */
+- u8 link_speed; /* i40e_aq_link_speed */
+- u8 link_info;
+-#define I40E_AQ_LINK_UP 0x01 /* obsolete */
+-#define I40E_AQ_LINK_UP_FUNCTION 0x01
+-#define I40E_AQ_LINK_FAULT 0x02
+-#define I40E_AQ_LINK_FAULT_TX 0x04
+-#define I40E_AQ_LINK_FAULT_RX 0x08
+-#define I40E_AQ_LINK_FAULT_REMOTE 0x10
+-#define I40E_AQ_LINK_UP_PORT 0x20
+-#define I40E_AQ_MEDIA_AVAILABLE 0x40
+-#define I40E_AQ_SIGNAL_DETECT 0x80
+- u8 an_info;
+-#define I40E_AQ_AN_COMPLETED 0x01
+-#define I40E_AQ_LP_AN_ABILITY 0x02
+-#define I40E_AQ_PD_FAULT 0x04
+-#define I40E_AQ_FEC_EN 0x08
+-#define I40E_AQ_PHY_LOW_POWER 0x10
+-#define I40E_AQ_LINK_PAUSE_TX 0x20
+-#define I40E_AQ_LINK_PAUSE_RX 0x40
+-#define I40E_AQ_QUALIFIED_MODULE 0x80
+- u8 ext_info;
+-#define I40E_AQ_LINK_PHY_TEMP_ALARM 0x01
+-#define I40E_AQ_LINK_XCESSIVE_ERRORS 0x02
+-#define I40E_AQ_LINK_TX_SHIFT 0x02
+-#define I40E_AQ_LINK_TX_MASK (0x03 << I40E_AQ_LINK_TX_SHIFT)
+-#define I40E_AQ_LINK_TX_ACTIVE 0x00
+-#define I40E_AQ_LINK_TX_DRAINED 0x01
+-#define I40E_AQ_LINK_TX_FLUSHED 0x03
+-#define I40E_AQ_LINK_FORCED_40G 0x10
+-/* 25G Error Codes */
+-#define I40E_AQ_25G_NO_ERR 0X00
+-#define I40E_AQ_25G_NOT_PRESENT 0X01
+-#define I40E_AQ_25G_NVM_CRC_ERR 0X02
+-#define I40E_AQ_25G_SBUS_UCODE_ERR 0X03
+-#define I40E_AQ_25G_SERDES_UCODE_ERR 0X04
+-#define I40E_AQ_25G_NIMB_UCODE_ERR 0X05
+- u8 loopback; /* use defines from i40e_aqc_set_lb_mode */
+-/* Since firmware API 1.7 loopback field keeps power class info as well */
+-#define I40E_AQ_LOOPBACK_MASK 0x07
+-#define I40E_AQ_PWR_CLASS_SHIFT_LB 6
+-#define I40E_AQ_PWR_CLASS_MASK_LB (0x03 << I40E_AQ_PWR_CLASS_SHIFT_LB)
+- __le16 max_frame_size;
+- u8 config;
+-#define I40E_AQ_CONFIG_FEC_KR_ENA 0x01
+-#define I40E_AQ_CONFIG_FEC_RS_ENA 0x02
+-#define I40E_AQ_CONFIG_CRC_ENA 0x04
+-#define I40E_AQ_CONFIG_PACING_MASK 0x78
+- union {
+- struct {
+- u8 power_desc;
+-#define I40E_AQ_LINK_POWER_CLASS_1 0x00
+-#define I40E_AQ_LINK_POWER_CLASS_2 0x01
+-#define I40E_AQ_LINK_POWER_CLASS_3 0x02
+-#define I40E_AQ_LINK_POWER_CLASS_4 0x03
+-#define I40E_AQ_PWR_CLASS_MASK 0x03
+- u8 reserved[4];
+- };
+- struct {
+- u8 link_type[4];
+- u8 link_type_ext;
+- };
+- };
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_get_link_status);
+-
+-/* Set event mask command (direct 0x613) */
+-struct i40e_aqc_set_phy_int_mask {
+- u8 reserved[8];
+- __le16 event_mask;
+-#define I40E_AQ_EVENT_LINK_UPDOWN 0x0002
+-#define I40E_AQ_EVENT_MEDIA_NA 0x0004
+-#define I40E_AQ_EVENT_LINK_FAULT 0x0008
+-#define I40E_AQ_EVENT_PHY_TEMP_ALARM 0x0010
+-#define I40E_AQ_EVENT_EXCESSIVE_ERRORS 0x0020
+-#define I40E_AQ_EVENT_SIGNAL_DETECT 0x0040
+-#define I40E_AQ_EVENT_AN_COMPLETED 0x0080
+-#define I40E_AQ_EVENT_MODULE_QUAL_FAIL 0x0100
+-#define I40E_AQ_EVENT_PORT_TX_SUSPENDED 0x0200
+- u8 reserved1[6];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_set_phy_int_mask);
+-
+-/* Get Local AN advt register (direct 0x0614)
+- * Set Local AN advt register (direct 0x0615)
+- * Get Link Partner AN advt register (direct 0x0616)
+- */
+-struct i40e_aqc_an_advt_reg {
+- __le32 local_an_reg0;
+- __le16 local_an_reg1;
+- u8 reserved[10];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_an_advt_reg);
+-
+-/* Set Loopback mode (0x0618) */
+-struct i40e_aqc_set_lb_mode {
+- __le16 lb_mode;
+-#define I40E_AQ_LB_PHY_LOCAL 0x01
+-#define I40E_AQ_LB_PHY_REMOTE 0x02
+-#define I40E_AQ_LB_MAC_LOCAL 0x04
+- u8 reserved[14];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_set_lb_mode);
+-
+-/* Set PHY Debug command (0x0622) */
+-struct i40e_aqc_set_phy_debug {
+- u8 command_flags;
+-#define I40E_AQ_PHY_DEBUG_RESET_INTERNAL 0x02
+-#define I40E_AQ_PHY_DEBUG_RESET_EXTERNAL_SHIFT 2
+-#define I40E_AQ_PHY_DEBUG_RESET_EXTERNAL_MASK (0x03 << \
+- I40E_AQ_PHY_DEBUG_RESET_EXTERNAL_SHIFT)
+-#define I40E_AQ_PHY_DEBUG_RESET_EXTERNAL_NONE 0x00
+-#define I40E_AQ_PHY_DEBUG_RESET_EXTERNAL_HARD 0x01
+-#define I40E_AQ_PHY_DEBUG_RESET_EXTERNAL_SOFT 0x02
+-#define I40E_AQ_PHY_DEBUG_DISABLE_LINK_FW 0x10
+- u8 reserved[15];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_set_phy_debug);
+-
+-enum i40e_aq_phy_reg_type {
+- I40E_AQC_PHY_REG_INTERNAL = 0x1,
+- I40E_AQC_PHY_REG_EXERNAL_BASET = 0x2,
+- I40E_AQC_PHY_REG_EXERNAL_MODULE = 0x3
+-};
+-
+-/* Run PHY Activity (0x0626) */
+-struct i40e_aqc_run_phy_activity {
+- __le16 activity_id;
+- u8 flags;
+- u8 reserved1;
+- __le32 control;
+- __le32 data;
+- u8 reserved2[4];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_run_phy_activity);
+-
+-/* Set PHY Register command (0x0628) */
+-/* Get PHY Register command (0x0629) */
+-struct i40e_aqc_phy_register_access {
+- u8 phy_interface;
+-#define I40E_AQ_PHY_REG_ACCESS_INTERNAL 0
+-#define I40E_AQ_PHY_REG_ACCESS_EXTERNAL 1
+-#define I40E_AQ_PHY_REG_ACCESS_EXTERNAL_MODULE 2
+- u8 dev_address;
+- u8 reserved1[2];
+- __le32 reg_address;
+- __le32 reg_value;
+- u8 reserved2[4];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_phy_register_access);
+-
+-/* NVM Read command (indirect 0x0701)
+- * NVM Erase commands (direct 0x0702)
+- * NVM Update commands (indirect 0x0703)
+- */
+-struct i40e_aqc_nvm_update {
+- u8 command_flags;
+-#define I40E_AQ_NVM_LAST_CMD 0x01
+-#define I40E_AQ_NVM_REARRANGE_TO_FLAT 0x20
+-#define I40E_AQ_NVM_REARRANGE_TO_STRUCT 0x40
+-#define I40E_AQ_NVM_FLASH_ONLY 0x80
+-#define I40E_AQ_NVM_PRESERVATION_FLAGS_SHIFT 1
+-#define I40E_AQ_NVM_PRESERVATION_FLAGS_MASK 0x03
+-#define I40E_AQ_NVM_PRESERVATION_FLAGS_SELECTED 0x03
+-#define I40E_AQ_NVM_PRESERVATION_FLAGS_ALL 0x01
+- u8 module_pointer;
+- __le16 length;
+- __le32 offset;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_nvm_update);
+-
+-/* NVM Config Read (indirect 0x0704) */
+-struct i40e_aqc_nvm_config_read {
+- __le16 cmd_flags;
+-#define I40E_AQ_ANVM_SINGLE_OR_MULTIPLE_FEATURES_MASK 1
+-#define I40E_AQ_ANVM_READ_SINGLE_FEATURE 0
+-#define I40E_AQ_ANVM_READ_MULTIPLE_FEATURES 1
+- __le16 element_count;
+- __le16 element_id; /* Feature/field ID */
+- __le16 element_id_msw; /* MSWord of field ID */
+- __le32 address_high;
+- __le32 address_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_nvm_config_read);
+-
+-/* NVM Config Write (indirect 0x0705) */
+-struct i40e_aqc_nvm_config_write {
+- __le16 cmd_flags;
+- __le16 element_count;
+- u8 reserved[4];
+- __le32 address_high;
+- __le32 address_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_nvm_config_write);
+-
+-/* Used for 0x0704 as well as for 0x0705 commands */
+-#define I40E_AQ_ANVM_FEATURE_OR_IMMEDIATE_SHIFT 1
+-#define I40E_AQ_ANVM_FEATURE_OR_IMMEDIATE_MASK \
+- BIT(I40E_AQ_ANVM_FEATURE_OR_IMMEDIATE_SHIFT)
+-#define I40E_AQ_ANVM_FEATURE 0
+-#define I40E_AQ_ANVM_IMMEDIATE_FIELD BIT(FEATURE_OR_IMMEDIATE_SHIFT)
+-struct i40e_aqc_nvm_config_data_feature {
+- __le16 feature_id;
+-#define I40E_AQ_ANVM_FEATURE_OPTION_OEM_ONLY 0x01
+-#define I40E_AQ_ANVM_FEATURE_OPTION_DWORD_MAP 0x08
+-#define I40E_AQ_ANVM_FEATURE_OPTION_POR_CSR 0x10
+- __le16 feature_options;
+- __le16 feature_selection;
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x6, i40e_aqc_nvm_config_data_feature);
+-
+-struct i40e_aqc_nvm_config_data_immediate_field {
+- __le32 field_id;
+- __le32 field_value;
+- __le16 field_options;
+- __le16 reserved;
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0xc, i40e_aqc_nvm_config_data_immediate_field);
+-
+-/* OEM Post Update (indirect 0x0720)
+- * no command data struct used
+- */
+- struct i40e_aqc_nvm_oem_post_update {
+-#define I40E_AQ_NVM_OEM_POST_UPDATE_EXTERNAL_DATA 0x01
+- u8 sel_data;
+- u8 reserved[7];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x8, i40e_aqc_nvm_oem_post_update);
+-
+-struct i40e_aqc_nvm_oem_post_update_buffer {
+- u8 str_len;
+- u8 dev_addr;
+- __le16 eeprom_addr;
+- u8 data[36];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x28, i40e_aqc_nvm_oem_post_update_buffer);
+-
+-/* Thermal Sensor (indirect 0x0721)
+- * read or set thermal sensor configs and values
+- * takes a sensor and command specific data buffer, not detailed here
+- */
+-struct i40e_aqc_thermal_sensor {
+- u8 sensor_action;
+-#define I40E_AQ_THERMAL_SENSOR_READ_CONFIG 0
+-#define I40E_AQ_THERMAL_SENSOR_SET_CONFIG 1
+-#define I40E_AQ_THERMAL_SENSOR_READ_TEMP 2
+- u8 reserved[7];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_thermal_sensor);
+-
+-/* Send to PF command (indirect 0x0801) id is only used by PF
+- * Send to VF command (indirect 0x0802) id is only used by PF
+- * Send to Peer PF command (indirect 0x0803)
+- */
+-struct i40e_aqc_pf_vf_message {
+- __le32 id;
+- u8 reserved[4];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_pf_vf_message);
+-
+-/* Alternate structure */
+-
+-/* Direct write (direct 0x0900)
+- * Direct read (direct 0x0902)
+- */
+-struct i40e_aqc_alternate_write {
+- __le32 address0;
+- __le32 data0;
+- __le32 address1;
+- __le32 data1;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_alternate_write);
+-
+-/* Indirect write (indirect 0x0901)
+- * Indirect read (indirect 0x0903)
+- */
+-
+-struct i40e_aqc_alternate_ind_write {
+- __le32 address;
+- __le32 length;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_alternate_ind_write);
+-
+-/* Done alternate write (direct 0x0904)
+- * uses i40e_aq_desc
+- */
+-struct i40e_aqc_alternate_write_done {
+- __le16 cmd_flags;
+-#define I40E_AQ_ALTERNATE_MODE_BIOS_MASK 1
+-#define I40E_AQ_ALTERNATE_MODE_BIOS_LEGACY 0
+-#define I40E_AQ_ALTERNATE_MODE_BIOS_UEFI 1
+-#define I40E_AQ_ALTERNATE_RESET_NEEDED 2
+- u8 reserved[14];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_alternate_write_done);
+-
+-/* Set OEM mode (direct 0x0905) */
+-struct i40e_aqc_alternate_set_mode {
+- __le32 mode;
+-#define I40E_AQ_ALTERNATE_MODE_NONE 0
+-#define I40E_AQ_ALTERNATE_MODE_OEM 1
+- u8 reserved[12];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_alternate_set_mode);
+-
+-/* Clear port Alternate RAM (direct 0x0906) uses i40e_aq_desc */
+-
+-/* async events 0x10xx */
+-
+-/* Lan Queue Overflow Event (direct, 0x1001) */
+-struct i40e_aqc_lan_overflow {
+- __le32 prtdcb_rupto;
+- __le32 otx_ctl;
+- u8 reserved[8];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_lan_overflow);
+-
+-/* Get LLDP MIB (indirect 0x0A00) */
+-struct i40e_aqc_lldp_get_mib {
+- u8 type;
+- u8 reserved1;
+-#define I40E_AQ_LLDP_MIB_TYPE_MASK 0x3
+-#define I40E_AQ_LLDP_MIB_LOCAL 0x0
+-#define I40E_AQ_LLDP_MIB_REMOTE 0x1
+-#define I40E_AQ_LLDP_MIB_LOCAL_AND_REMOTE 0x2
+-#define I40E_AQ_LLDP_BRIDGE_TYPE_MASK 0xC
+-#define I40E_AQ_LLDP_BRIDGE_TYPE_SHIFT 0x2
+-#define I40E_AQ_LLDP_BRIDGE_TYPE_NEAREST_BRIDGE 0x0
+-#define I40E_AQ_LLDP_BRIDGE_TYPE_NON_TPMR 0x1
+-#define I40E_AQ_LLDP_TX_SHIFT 0x4
+-#define I40E_AQ_LLDP_TX_MASK (0x03 << I40E_AQ_LLDP_TX_SHIFT)
+-/* TX pause flags use I40E_AQ_LINK_TX_* above */
+- __le16 local_len;
+- __le16 remote_len;
+- u8 reserved2[2];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_lldp_get_mib);
+-
+-/* Configure LLDP MIB Change Event (direct 0x0A01)
+- * also used for the event (with type in the command field)
+- */
+-struct i40e_aqc_lldp_update_mib {
+- u8 command;
+-#define I40E_AQ_LLDP_MIB_UPDATE_ENABLE 0x0
+-#define I40E_AQ_LLDP_MIB_UPDATE_DISABLE 0x1
+- u8 reserved[7];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_lldp_update_mib);
+-
+-/* Add LLDP TLV (indirect 0x0A02)
+- * Delete LLDP TLV (indirect 0x0A04)
+- */
+-struct i40e_aqc_lldp_add_tlv {
+- u8 type; /* only nearest bridge and non-TPMR from 0x0A00 */
+- u8 reserved1[1];
+- __le16 len;
+- u8 reserved2[4];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_lldp_add_tlv);
+-
+-/* Update LLDP TLV (indirect 0x0A03) */
+-struct i40e_aqc_lldp_update_tlv {
+- u8 type; /* only nearest bridge and non-TPMR from 0x0A00 */
+- u8 reserved;
+- __le16 old_len;
+- __le16 new_offset;
+- __le16 new_len;
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_lldp_update_tlv);
+-
+-/* Stop LLDP (direct 0x0A05) */
+-struct i40e_aqc_lldp_stop {
+- u8 command;
+-#define I40E_AQ_LLDP_AGENT_STOP 0x0
+-#define I40E_AQ_LLDP_AGENT_SHUTDOWN 0x1
+- u8 reserved[15];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_lldp_stop);
+-
+-/* Start LLDP (direct 0x0A06) */
+-
+-struct i40e_aqc_lldp_start {
+- u8 command;
+-#define I40E_AQ_LLDP_AGENT_START 0x1
+- u8 reserved[15];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_lldp_start);
+-
+-/* Set DCB (direct 0x0303) */
+-struct i40e_aqc_set_dcb_parameters {
+- u8 command;
+-#define I40E_AQ_DCB_SET_AGENT 0x1
+-#define I40E_DCB_VALID 0x1
+- u8 valid_flags;
+- u8 reserved[14];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_set_dcb_parameters);
+-
+-/* Apply MIB changes (0x0A07)
+- * uses the generic struc as it contains no data
+- */
+-
+-/* Add Udp Tunnel command and completion (direct 0x0B00) */
+-struct i40e_aqc_add_udp_tunnel {
+- __le16 udp_port;
+- u8 reserved0[3];
+- u8 protocol_type;
+-#define I40E_AQC_TUNNEL_TYPE_VXLAN 0x00
+-#define I40E_AQC_TUNNEL_TYPE_NGE 0x01
+-#define I40E_AQC_TUNNEL_TYPE_TEREDO 0x10
+-#define I40E_AQC_TUNNEL_TYPE_VXLAN_GPE 0x11
+- u8 reserved1[10];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_udp_tunnel);
+-
+-struct i40e_aqc_add_udp_tunnel_completion {
+- __le16 udp_port;
+- u8 filter_entry_index;
+- u8 multiple_pfs;
+-#define I40E_AQC_SINGLE_PF 0x0
+-#define I40E_AQC_MULTIPLE_PFS 0x1
+- u8 total_filters;
+- u8 reserved[11];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_add_udp_tunnel_completion);
+-
+-/* remove UDP Tunnel command (0x0B01) */
+-struct i40e_aqc_remove_udp_tunnel {
+- u8 reserved[2];
+- u8 index; /* 0 to 15 */
+- u8 reserved2[13];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_remove_udp_tunnel);
+-
+-struct i40e_aqc_del_udp_tunnel_completion {
+- __le16 udp_port;
+- u8 index; /* 0 to 15 */
+- u8 multiple_pfs;
+- u8 total_filters_used;
+- u8 reserved1[11];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_del_udp_tunnel_completion);
+-
+-struct i40e_aqc_get_set_rss_key {
+-#define I40E_AQC_SET_RSS_KEY_VSI_VALID BIT(15)
+-#define I40E_AQC_SET_RSS_KEY_VSI_ID_SHIFT 0
+-#define I40E_AQC_SET_RSS_KEY_VSI_ID_MASK (0x3FF << \
+- I40E_AQC_SET_RSS_KEY_VSI_ID_SHIFT)
+- __le16 vsi_id;
+- u8 reserved[6];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_get_set_rss_key);
+-
+-struct i40e_aqc_get_set_rss_key_data {
+- u8 standard_rss_key[0x28];
+- u8 extended_hash_key[0xc];
+-};
+-
+-I40E_CHECK_STRUCT_LEN(0x34, i40e_aqc_get_set_rss_key_data);
+-
+-struct i40e_aqc_get_set_rss_lut {
+-#define I40E_AQC_SET_RSS_LUT_VSI_VALID BIT(15)
+-#define I40E_AQC_SET_RSS_LUT_VSI_ID_SHIFT 0
+-#define I40E_AQC_SET_RSS_LUT_VSI_ID_MASK (0x3FF << \
+- I40E_AQC_SET_RSS_LUT_VSI_ID_SHIFT)
+- __le16 vsi_id;
+-#define I40E_AQC_SET_RSS_LUT_TABLE_TYPE_SHIFT 0
+-#define I40E_AQC_SET_RSS_LUT_TABLE_TYPE_MASK \
+- BIT(I40E_AQC_SET_RSS_LUT_TABLE_TYPE_SHIFT)
+-
+-#define I40E_AQC_SET_RSS_LUT_TABLE_TYPE_VSI 0
+-#define I40E_AQC_SET_RSS_LUT_TABLE_TYPE_PF 1
+- __le16 flags;
+- u8 reserved[4];
+- __le32 addr_high;
+- __le32 addr_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_get_set_rss_lut);
+-
+-/* tunnel key structure 0x0B10 */
+-
+-struct i40e_aqc_tunnel_key_structure_A0 {
+- __le16 key1_off;
+- __le16 key1_len;
+- __le16 key2_off;
+- __le16 key2_len;
+- __le16 flags;
+-#define I40E_AQC_TUNNEL_KEY_STRUCT_OVERRIDE 0x01
+-/* response flags */
+-#define I40E_AQC_TUNNEL_KEY_STRUCT_SUCCESS 0x01
+-#define I40E_AQC_TUNNEL_KEY_STRUCT_MODIFIED 0x02
+-#define I40E_AQC_TUNNEL_KEY_STRUCT_OVERRIDDEN 0x03
+- u8 resreved[6];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_tunnel_key_structure_A0);
+-
+-struct i40e_aqc_tunnel_key_structure {
+- u8 key1_off;
+- u8 key2_off;
+- u8 key1_len; /* 0 to 15 */
+- u8 key2_len; /* 0 to 15 */
+- u8 flags;
+-#define I40E_AQC_TUNNEL_KEY_STRUCT_OVERRIDE 0x01
+-/* response flags */
+-#define I40E_AQC_TUNNEL_KEY_STRUCT_SUCCESS 0x01
+-#define I40E_AQC_TUNNEL_KEY_STRUCT_MODIFIED 0x02
+-#define I40E_AQC_TUNNEL_KEY_STRUCT_OVERRIDDEN 0x03
+- u8 network_key_index;
+-#define I40E_AQC_NETWORK_KEY_INDEX_VXLAN 0x0
+-#define I40E_AQC_NETWORK_KEY_INDEX_NGE 0x1
+-#define I40E_AQC_NETWORK_KEY_INDEX_FLEX_MAC_IN_UDP 0x2
+-#define I40E_AQC_NETWORK_KEY_INDEX_GRE 0x3
+- u8 reserved[10];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_tunnel_key_structure);
+-
+-/* OEM mode commands (direct 0xFE0x) */
+-struct i40e_aqc_oem_param_change {
+- __le32 param_type;
+-#define I40E_AQ_OEM_PARAM_TYPE_PF_CTL 0
+-#define I40E_AQ_OEM_PARAM_TYPE_BW_CTL 1
+-#define I40E_AQ_OEM_PARAM_MAC 2
+- __le32 param_value1;
+- __le16 param_value2;
+- u8 reserved[6];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_oem_param_change);
+-
+-struct i40e_aqc_oem_state_change {
+- __le32 state;
+-#define I40E_AQ_OEM_STATE_LINK_DOWN 0x0
+-#define I40E_AQ_OEM_STATE_LINK_UP 0x1
+- u8 reserved[12];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_oem_state_change);
+-
+-/* Initialize OCSD (0xFE02, direct) */
+-struct i40e_aqc_opc_oem_ocsd_initialize {
+- u8 type_status;
+- u8 reserved1[3];
+- __le32 ocsd_memory_block_addr_high;
+- __le32 ocsd_memory_block_addr_low;
+- __le32 requested_update_interval;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_opc_oem_ocsd_initialize);
+-
+-/* Initialize OCBB (0xFE03, direct) */
+-struct i40e_aqc_opc_oem_ocbb_initialize {
+- u8 type_status;
+- u8 reserved1[3];
+- __le32 ocbb_memory_block_addr_high;
+- __le32 ocbb_memory_block_addr_low;
+- u8 reserved2[4];
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_opc_oem_ocbb_initialize);
+-
+-/* debug commands */
+-
+-/* get device id (0xFF00) uses the generic structure */
+-
+-/* set test more (0xFF01, internal) */
+-
+-struct i40e_acq_set_test_mode {
+- u8 mode;
+-#define I40E_AQ_TEST_PARTIAL 0
+-#define I40E_AQ_TEST_FULL 1
+-#define I40E_AQ_TEST_NVM 2
+- u8 reserved[3];
+- u8 command;
+-#define I40E_AQ_TEST_OPEN 0
+-#define I40E_AQ_TEST_CLOSE 1
+-#define I40E_AQ_TEST_INC 2
+- u8 reserved2[3];
+- __le32 address_high;
+- __le32 address_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_acq_set_test_mode);
+-
+-/* Debug Read Register command (0xFF03)
+- * Debug Write Register command (0xFF04)
+- */
+-struct i40e_aqc_debug_reg_read_write {
+- __le32 reserved;
+- __le32 address;
+- __le32 value_high;
+- __le32 value_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_debug_reg_read_write);
+-
+-/* Scatter/gather Reg Read (indirect 0xFF05)
+- * Scatter/gather Reg Write (indirect 0xFF06)
+- */
+-
+-/* i40e_aq_desc is used for the command */
+-struct i40e_aqc_debug_reg_sg_element_data {
+- __le32 address;
+- __le32 value;
+-};
+-
+-/* Debug Modify register (direct 0xFF07) */
+-struct i40e_aqc_debug_modify_reg {
+- __le32 address;
+- __le32 value;
+- __le32 clear_mask;
+- __le32 set_mask;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_debug_modify_reg);
+-
+-/* dump internal data (0xFF08, indirect) */
+-
+-#define I40E_AQ_CLUSTER_ID_AUX 0
+-#define I40E_AQ_CLUSTER_ID_SWITCH_FLU 1
+-#define I40E_AQ_CLUSTER_ID_TXSCHED 2
+-#define I40E_AQ_CLUSTER_ID_HMC 3
+-#define I40E_AQ_CLUSTER_ID_MAC0 4
+-#define I40E_AQ_CLUSTER_ID_MAC1 5
+-#define I40E_AQ_CLUSTER_ID_MAC2 6
+-#define I40E_AQ_CLUSTER_ID_MAC3 7
+-#define I40E_AQ_CLUSTER_ID_DCB 8
+-#define I40E_AQ_CLUSTER_ID_EMP_MEM 9
+-#define I40E_AQ_CLUSTER_ID_PKT_BUF 10
+-#define I40E_AQ_CLUSTER_ID_ALTRAM 11
+-
+-struct i40e_aqc_debug_dump_internals {
+- u8 cluster_id;
+- u8 table_id;
+- __le16 data_size;
+- __le32 idx;
+- __le32 address_high;
+- __le32 address_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_debug_dump_internals);
+-
+-struct i40e_aqc_debug_modify_internals {
+- u8 cluster_id;
+- u8 cluster_specific_params[7];
+- __le32 address_high;
+- __le32 address_low;
+-};
+-
+-I40E_CHECK_CMD_LENGTH(i40e_aqc_debug_modify_internals);
+-
+-#endif /* _I40E_ADMINQ_CMD_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_alloc.h b/drivers/net/ethernet/intel/i40evf/i40e_alloc.h
+deleted file mode 100644
+index cb8689222c8b7..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_alloc.h
++++ /dev/null
+@@ -1,35 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_ALLOC_H_
+-#define _I40E_ALLOC_H_
+-
+-struct i40e_hw;
+-
+-/* Memory allocation types */
+-enum i40e_memory_type {
+- i40e_mem_arq_buf = 0, /* ARQ indirect command buffer */
+- i40e_mem_asq_buf = 1,
+- i40e_mem_atq_buf = 2, /* ATQ indirect command buffer */
+- i40e_mem_arq_ring = 3, /* ARQ descriptor ring */
+- i40e_mem_atq_ring = 4, /* ATQ descriptor ring */
+- i40e_mem_pd = 5, /* Page Descriptor */
+- i40e_mem_bp = 6, /* Backing Page - 4KB */
+- i40e_mem_bp_jumbo = 7, /* Backing Page - > 4KB */
+- i40e_mem_reserved
+-};
+-
+-/* prototype for functions used for dynamic memory allocation */
+-i40e_status i40e_allocate_dma_mem(struct i40e_hw *hw,
+- struct i40e_dma_mem *mem,
+- enum i40e_memory_type type,
+- u64 size, u32 alignment);
+-i40e_status i40e_free_dma_mem(struct i40e_hw *hw,
+- struct i40e_dma_mem *mem);
+-i40e_status i40e_allocate_virt_mem(struct i40e_hw *hw,
+- struct i40e_virt_mem *mem,
+- u32 size);
+-i40e_status i40e_free_virt_mem(struct i40e_hw *hw,
+- struct i40e_virt_mem *mem);
+-
+-#endif /* _I40E_ALLOC_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_common.c b/drivers/net/ethernet/intel/i40evf/i40e_common.c
+deleted file mode 100644
+index eea280ba411ee..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_common.c
++++ /dev/null
+@@ -1,1320 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#include "i40e_type.h"
+-#include "i40e_adminq.h"
+-#include "i40e_prototype.h"
+-#include <linux/avf/virtchnl.h>
+-
+-/**
+- * i40e_set_mac_type - Sets MAC type
+- * @hw: pointer to the HW structure
+- *
+- * This function sets the mac type of the adapter based on the
+- * vendor ID and device ID stored in the hw structure.
+- **/
+-i40e_status i40e_set_mac_type(struct i40e_hw *hw)
+-{
+- i40e_status status = 0;
+-
+- if (hw->vendor_id == PCI_VENDOR_ID_INTEL) {
+- switch (hw->device_id) {
+- case I40E_DEV_ID_SFP_XL710:
+- case I40E_DEV_ID_QEMU:
+- case I40E_DEV_ID_KX_B:
+- case I40E_DEV_ID_KX_C:
+- case I40E_DEV_ID_QSFP_A:
+- case I40E_DEV_ID_QSFP_B:
+- case I40E_DEV_ID_QSFP_C:
+- case I40E_DEV_ID_10G_BASE_T:
+- case I40E_DEV_ID_10G_BASE_T4:
+- case I40E_DEV_ID_20G_KR2:
+- case I40E_DEV_ID_20G_KR2_A:
+- case I40E_DEV_ID_25G_B:
+- case I40E_DEV_ID_25G_SFP28:
+- hw->mac.type = I40E_MAC_XL710;
+- break;
+- case I40E_DEV_ID_SFP_X722:
+- case I40E_DEV_ID_1G_BASE_T_X722:
+- case I40E_DEV_ID_10G_BASE_T_X722:
+- case I40E_DEV_ID_SFP_I_X722:
+- hw->mac.type = I40E_MAC_X722;
+- break;
+- case I40E_DEV_ID_X722_VF:
+- hw->mac.type = I40E_MAC_X722_VF;
+- break;
+- case I40E_DEV_ID_VF:
+- case I40E_DEV_ID_VF_HV:
+- case I40E_DEV_ID_ADAPTIVE_VF:
+- hw->mac.type = I40E_MAC_VF;
+- break;
+- default:
+- hw->mac.type = I40E_MAC_GENERIC;
+- break;
+- }
+- } else {
+- status = I40E_ERR_DEVICE_NOT_SUPPORTED;
+- }
+-
+- hw_dbg(hw, "i40e_set_mac_type found mac: %d, returns: %d\n",
+- hw->mac.type, status);
+- return status;
+-}
+-
+-/**
+- * i40evf_aq_str - convert AQ err code to a string
+- * @hw: pointer to the HW structure
+- * @aq_err: the AQ error code to convert
+- **/
+-const char *i40evf_aq_str(struct i40e_hw *hw, enum i40e_admin_queue_err aq_err)
+-{
+- switch (aq_err) {
+- case I40E_AQ_RC_OK:
+- return "OK";
+- case I40E_AQ_RC_EPERM:
+- return "I40E_AQ_RC_EPERM";
+- case I40E_AQ_RC_ENOENT:
+- return "I40E_AQ_RC_ENOENT";
+- case I40E_AQ_RC_ESRCH:
+- return "I40E_AQ_RC_ESRCH";
+- case I40E_AQ_RC_EINTR:
+- return "I40E_AQ_RC_EINTR";
+- case I40E_AQ_RC_EIO:
+- return "I40E_AQ_RC_EIO";
+- case I40E_AQ_RC_ENXIO:
+- return "I40E_AQ_RC_ENXIO";
+- case I40E_AQ_RC_E2BIG:
+- return "I40E_AQ_RC_E2BIG";
+- case I40E_AQ_RC_EAGAIN:
+- return "I40E_AQ_RC_EAGAIN";
+- case I40E_AQ_RC_ENOMEM:
+- return "I40E_AQ_RC_ENOMEM";
+- case I40E_AQ_RC_EACCES:
+- return "I40E_AQ_RC_EACCES";
+- case I40E_AQ_RC_EFAULT:
+- return "I40E_AQ_RC_EFAULT";
+- case I40E_AQ_RC_EBUSY:
+- return "I40E_AQ_RC_EBUSY";
+- case I40E_AQ_RC_EEXIST:
+- return "I40E_AQ_RC_EEXIST";
+- case I40E_AQ_RC_EINVAL:
+- return "I40E_AQ_RC_EINVAL";
+- case I40E_AQ_RC_ENOTTY:
+- return "I40E_AQ_RC_ENOTTY";
+- case I40E_AQ_RC_ENOSPC:
+- return "I40E_AQ_RC_ENOSPC";
+- case I40E_AQ_RC_ENOSYS:
+- return "I40E_AQ_RC_ENOSYS";
+- case I40E_AQ_RC_ERANGE:
+- return "I40E_AQ_RC_ERANGE";
+- case I40E_AQ_RC_EFLUSHED:
+- return "I40E_AQ_RC_EFLUSHED";
+- case I40E_AQ_RC_BAD_ADDR:
+- return "I40E_AQ_RC_BAD_ADDR";
+- case I40E_AQ_RC_EMODE:
+- return "I40E_AQ_RC_EMODE";
+- case I40E_AQ_RC_EFBIG:
+- return "I40E_AQ_RC_EFBIG";
+- }
+-
+- snprintf(hw->err_str, sizeof(hw->err_str), "%d", aq_err);
+- return hw->err_str;
+-}
+-
+-/**
+- * i40evf_stat_str - convert status err code to a string
+- * @hw: pointer to the HW structure
+- * @stat_err: the status error code to convert
+- **/
+-const char *i40evf_stat_str(struct i40e_hw *hw, i40e_status stat_err)
+-{
+- switch (stat_err) {
+- case 0:
+- return "OK";
+- case I40E_ERR_NVM:
+- return "I40E_ERR_NVM";
+- case I40E_ERR_NVM_CHECKSUM:
+- return "I40E_ERR_NVM_CHECKSUM";
+- case I40E_ERR_PHY:
+- return "I40E_ERR_PHY";
+- case I40E_ERR_CONFIG:
+- return "I40E_ERR_CONFIG";
+- case I40E_ERR_PARAM:
+- return "I40E_ERR_PARAM";
+- case I40E_ERR_MAC_TYPE:
+- return "I40E_ERR_MAC_TYPE";
+- case I40E_ERR_UNKNOWN_PHY:
+- return "I40E_ERR_UNKNOWN_PHY";
+- case I40E_ERR_LINK_SETUP:
+- return "I40E_ERR_LINK_SETUP";
+- case I40E_ERR_ADAPTER_STOPPED:
+- return "I40E_ERR_ADAPTER_STOPPED";
+- case I40E_ERR_INVALID_MAC_ADDR:
+- return "I40E_ERR_INVALID_MAC_ADDR";
+- case I40E_ERR_DEVICE_NOT_SUPPORTED:
+- return "I40E_ERR_DEVICE_NOT_SUPPORTED";
+- case I40E_ERR_MASTER_REQUESTS_PENDING:
+- return "I40E_ERR_MASTER_REQUESTS_PENDING";
+- case I40E_ERR_INVALID_LINK_SETTINGS:
+- return "I40E_ERR_INVALID_LINK_SETTINGS";
+- case I40E_ERR_AUTONEG_NOT_COMPLETE:
+- return "I40E_ERR_AUTONEG_NOT_COMPLETE";
+- case I40E_ERR_RESET_FAILED:
+- return "I40E_ERR_RESET_FAILED";
+- case I40E_ERR_SWFW_SYNC:
+- return "I40E_ERR_SWFW_SYNC";
+- case I40E_ERR_NO_AVAILABLE_VSI:
+- return "I40E_ERR_NO_AVAILABLE_VSI";
+- case I40E_ERR_NO_MEMORY:
+- return "I40E_ERR_NO_MEMORY";
+- case I40E_ERR_BAD_PTR:
+- return "I40E_ERR_BAD_PTR";
+- case I40E_ERR_RING_FULL:
+- return "I40E_ERR_RING_FULL";
+- case I40E_ERR_INVALID_PD_ID:
+- return "I40E_ERR_INVALID_PD_ID";
+- case I40E_ERR_INVALID_QP_ID:
+- return "I40E_ERR_INVALID_QP_ID";
+- case I40E_ERR_INVALID_CQ_ID:
+- return "I40E_ERR_INVALID_CQ_ID";
+- case I40E_ERR_INVALID_CEQ_ID:
+- return "I40E_ERR_INVALID_CEQ_ID";
+- case I40E_ERR_INVALID_AEQ_ID:
+- return "I40E_ERR_INVALID_AEQ_ID";
+- case I40E_ERR_INVALID_SIZE:
+- return "I40E_ERR_INVALID_SIZE";
+- case I40E_ERR_INVALID_ARP_INDEX:
+- return "I40E_ERR_INVALID_ARP_INDEX";
+- case I40E_ERR_INVALID_FPM_FUNC_ID:
+- return "I40E_ERR_INVALID_FPM_FUNC_ID";
+- case I40E_ERR_QP_INVALID_MSG_SIZE:
+- return "I40E_ERR_QP_INVALID_MSG_SIZE";
+- case I40E_ERR_QP_TOOMANY_WRS_POSTED:
+- return "I40E_ERR_QP_TOOMANY_WRS_POSTED";
+- case I40E_ERR_INVALID_FRAG_COUNT:
+- return "I40E_ERR_INVALID_FRAG_COUNT";
+- case I40E_ERR_QUEUE_EMPTY:
+- return "I40E_ERR_QUEUE_EMPTY";
+- case I40E_ERR_INVALID_ALIGNMENT:
+- return "I40E_ERR_INVALID_ALIGNMENT";
+- case I40E_ERR_FLUSHED_QUEUE:
+- return "I40E_ERR_FLUSHED_QUEUE";
+- case I40E_ERR_INVALID_PUSH_PAGE_INDEX:
+- return "I40E_ERR_INVALID_PUSH_PAGE_INDEX";
+- case I40E_ERR_INVALID_IMM_DATA_SIZE:
+- return "I40E_ERR_INVALID_IMM_DATA_SIZE";
+- case I40E_ERR_TIMEOUT:
+- return "I40E_ERR_TIMEOUT";
+- case I40E_ERR_OPCODE_MISMATCH:
+- return "I40E_ERR_OPCODE_MISMATCH";
+- case I40E_ERR_CQP_COMPL_ERROR:
+- return "I40E_ERR_CQP_COMPL_ERROR";
+- case I40E_ERR_INVALID_VF_ID:
+- return "I40E_ERR_INVALID_VF_ID";
+- case I40E_ERR_INVALID_HMCFN_ID:
+- return "I40E_ERR_INVALID_HMCFN_ID";
+- case I40E_ERR_BACKING_PAGE_ERROR:
+- return "I40E_ERR_BACKING_PAGE_ERROR";
+- case I40E_ERR_NO_PBLCHUNKS_AVAILABLE:
+- return "I40E_ERR_NO_PBLCHUNKS_AVAILABLE";
+- case I40E_ERR_INVALID_PBLE_INDEX:
+- return "I40E_ERR_INVALID_PBLE_INDEX";
+- case I40E_ERR_INVALID_SD_INDEX:
+- return "I40E_ERR_INVALID_SD_INDEX";
+- case I40E_ERR_INVALID_PAGE_DESC_INDEX:
+- return "I40E_ERR_INVALID_PAGE_DESC_INDEX";
+- case I40E_ERR_INVALID_SD_TYPE:
+- return "I40E_ERR_INVALID_SD_TYPE";
+- case I40E_ERR_MEMCPY_FAILED:
+- return "I40E_ERR_MEMCPY_FAILED";
+- case I40E_ERR_INVALID_HMC_OBJ_INDEX:
+- return "I40E_ERR_INVALID_HMC_OBJ_INDEX";
+- case I40E_ERR_INVALID_HMC_OBJ_COUNT:
+- return "I40E_ERR_INVALID_HMC_OBJ_COUNT";
+- case I40E_ERR_INVALID_SRQ_ARM_LIMIT:
+- return "I40E_ERR_INVALID_SRQ_ARM_LIMIT";
+- case I40E_ERR_SRQ_ENABLED:
+- return "I40E_ERR_SRQ_ENABLED";
+- case I40E_ERR_ADMIN_QUEUE_ERROR:
+- return "I40E_ERR_ADMIN_QUEUE_ERROR";
+- case I40E_ERR_ADMIN_QUEUE_TIMEOUT:
+- return "I40E_ERR_ADMIN_QUEUE_TIMEOUT";
+- case I40E_ERR_BUF_TOO_SHORT:
+- return "I40E_ERR_BUF_TOO_SHORT";
+- case I40E_ERR_ADMIN_QUEUE_FULL:
+- return "I40E_ERR_ADMIN_QUEUE_FULL";
+- case I40E_ERR_ADMIN_QUEUE_NO_WORK:
+- return "I40E_ERR_ADMIN_QUEUE_NO_WORK";
+- case I40E_ERR_BAD_IWARP_CQE:
+- return "I40E_ERR_BAD_IWARP_CQE";
+- case I40E_ERR_NVM_BLANK_MODE:
+- return "I40E_ERR_NVM_BLANK_MODE";
+- case I40E_ERR_NOT_IMPLEMENTED:
+- return "I40E_ERR_NOT_IMPLEMENTED";
+- case I40E_ERR_PE_DOORBELL_NOT_ENABLED:
+- return "I40E_ERR_PE_DOORBELL_NOT_ENABLED";
+- case I40E_ERR_DIAG_TEST_FAILED:
+- return "I40E_ERR_DIAG_TEST_FAILED";
+- case I40E_ERR_NOT_READY:
+- return "I40E_ERR_NOT_READY";
+- case I40E_NOT_SUPPORTED:
+- return "I40E_NOT_SUPPORTED";
+- case I40E_ERR_FIRMWARE_API_VERSION:
+- return "I40E_ERR_FIRMWARE_API_VERSION";
+- case I40E_ERR_ADMIN_QUEUE_CRITICAL_ERROR:
+- return "I40E_ERR_ADMIN_QUEUE_CRITICAL_ERROR";
+- }
+-
+- snprintf(hw->err_str, sizeof(hw->err_str), "%d", stat_err);
+- return hw->err_str;
+-}
+-
+-/**
+- * i40evf_debug_aq
+- * @hw: debug mask related to admin queue
+- * @mask: debug mask
+- * @desc: pointer to admin queue descriptor
+- * @buffer: pointer to command buffer
+- * @buf_len: max length of buffer
+- *
+- * Dumps debug log about adminq command with descriptor contents.
+- **/
+-void i40evf_debug_aq(struct i40e_hw *hw, enum i40e_debug_mask mask, void *desc,
+- void *buffer, u16 buf_len)
+-{
+- struct i40e_aq_desc *aq_desc = (struct i40e_aq_desc *)desc;
+- u8 *buf = (u8 *)buffer;
+-
+- if ((!(mask & hw->debug_mask)) || (desc == NULL))
+- return;
+-
+- i40e_debug(hw, mask,
+- "AQ CMD: opcode 0x%04X, flags 0x%04X, datalen 0x%04X, retval 0x%04X\n",
+- le16_to_cpu(aq_desc->opcode),
+- le16_to_cpu(aq_desc->flags),
+- le16_to_cpu(aq_desc->datalen),
+- le16_to_cpu(aq_desc->retval));
+- i40e_debug(hw, mask, "\tcookie (h,l) 0x%08X 0x%08X\n",
+- le32_to_cpu(aq_desc->cookie_high),
+- le32_to_cpu(aq_desc->cookie_low));
+- i40e_debug(hw, mask, "\tparam (0,1) 0x%08X 0x%08X\n",
+- le32_to_cpu(aq_desc->params.internal.param0),
+- le32_to_cpu(aq_desc->params.internal.param1));
+- i40e_debug(hw, mask, "\taddr (h,l) 0x%08X 0x%08X\n",
+- le32_to_cpu(aq_desc->params.external.addr_high),
+- le32_to_cpu(aq_desc->params.external.addr_low));
+-
+- if ((buffer != NULL) && (aq_desc->datalen != 0)) {
+- u16 len = le16_to_cpu(aq_desc->datalen);
+-
+- i40e_debug(hw, mask, "AQ CMD Buffer:\n");
+- if (buf_len < len)
+- len = buf_len;
+- /* write the full 16-byte chunks */
+- if (hw->debug_mask & mask) {
+- char prefix[27];
+-
+- snprintf(prefix, sizeof(prefix),
+- "i40evf %02x:%02x.%x: \t0x",
+- hw->bus.bus_id,
+- hw->bus.device,
+- hw->bus.func);
+-
+- print_hex_dump(KERN_INFO, prefix, DUMP_PREFIX_OFFSET,
+- 16, 1, buf, len, false);
+- }
+- }
+-}
+-
+-/**
+- * i40evf_check_asq_alive
+- * @hw: pointer to the hw struct
+- *
+- * Returns true if Queue is enabled else false.
+- **/
+-bool i40evf_check_asq_alive(struct i40e_hw *hw)
+-{
+- if (hw->aq.asq.len)
+- return !!(rd32(hw, hw->aq.asq.len) &
+- I40E_VF_ATQLEN1_ATQENABLE_MASK);
+- else
+- return false;
+-}
+-
+-/**
+- * i40evf_aq_queue_shutdown
+- * @hw: pointer to the hw struct
+- * @unloading: is the driver unloading itself
+- *
+- * Tell the Firmware that we're shutting down the AdminQ and whether
+- * or not the driver is unloading as well.
+- **/
+-i40e_status i40evf_aq_queue_shutdown(struct i40e_hw *hw,
+- bool unloading)
+-{
+- struct i40e_aq_desc desc;
+- struct i40e_aqc_queue_shutdown *cmd =
+- (struct i40e_aqc_queue_shutdown *)&desc.params.raw;
+- i40e_status status;
+-
+- i40evf_fill_default_direct_cmd_desc(&desc,
+- i40e_aqc_opc_queue_shutdown);
+-
+- if (unloading)
+- cmd->driver_unloading = cpu_to_le32(I40E_AQ_DRIVER_UNLOADING);
+- status = i40evf_asq_send_command(hw, &desc, NULL, 0, NULL);
+-
+- return status;
+-}
+-
+-/**
+- * i40e_aq_get_set_rss_lut
+- * @hw: pointer to the hardware structure
+- * @vsi_id: vsi fw index
+- * @pf_lut: for PF table set true, for VSI table set false
+- * @lut: pointer to the lut buffer provided by the caller
+- * @lut_size: size of the lut buffer
+- * @set: set true to set the table, false to get the table
+- *
+- * Internal function to get or set RSS look up table
+- **/
+-static i40e_status i40e_aq_get_set_rss_lut(struct i40e_hw *hw,
+- u16 vsi_id, bool pf_lut,
+- u8 *lut, u16 lut_size,
+- bool set)
+-{
+- i40e_status status;
+- struct i40e_aq_desc desc;
+- struct i40e_aqc_get_set_rss_lut *cmd_resp =
+- (struct i40e_aqc_get_set_rss_lut *)&desc.params.raw;
+-
+- if (set)
+- i40evf_fill_default_direct_cmd_desc(&desc,
+- i40e_aqc_opc_set_rss_lut);
+- else
+- i40evf_fill_default_direct_cmd_desc(&desc,
+- i40e_aqc_opc_get_rss_lut);
+-
+- /* Indirect command */
+- desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_BUF);
+- desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_RD);
+-
+- cmd_resp->vsi_id =
+- cpu_to_le16((u16)((vsi_id <<
+- I40E_AQC_SET_RSS_LUT_VSI_ID_SHIFT) &
+- I40E_AQC_SET_RSS_LUT_VSI_ID_MASK));
+- cmd_resp->vsi_id |= cpu_to_le16((u16)I40E_AQC_SET_RSS_LUT_VSI_VALID);
+-
+- if (pf_lut)
+- cmd_resp->flags |= cpu_to_le16((u16)
+- ((I40E_AQC_SET_RSS_LUT_TABLE_TYPE_PF <<
+- I40E_AQC_SET_RSS_LUT_TABLE_TYPE_SHIFT) &
+- I40E_AQC_SET_RSS_LUT_TABLE_TYPE_MASK));
+- else
+- cmd_resp->flags |= cpu_to_le16((u16)
+- ((I40E_AQC_SET_RSS_LUT_TABLE_TYPE_VSI <<
+- I40E_AQC_SET_RSS_LUT_TABLE_TYPE_SHIFT) &
+- I40E_AQC_SET_RSS_LUT_TABLE_TYPE_MASK));
+-
+- status = i40evf_asq_send_command(hw, &desc, lut, lut_size, NULL);
+-
+- return status;
+-}
+-
+-/**
+- * i40evf_aq_get_rss_lut
+- * @hw: pointer to the hardware structure
+- * @vsi_id: vsi fw index
+- * @pf_lut: for PF table set true, for VSI table set false
+- * @lut: pointer to the lut buffer provided by the caller
+- * @lut_size: size of the lut buffer
+- *
+- * get the RSS lookup table, PF or VSI type
+- **/
+-i40e_status i40evf_aq_get_rss_lut(struct i40e_hw *hw, u16 vsi_id,
+- bool pf_lut, u8 *lut, u16 lut_size)
+-{
+- return i40e_aq_get_set_rss_lut(hw, vsi_id, pf_lut, lut, lut_size,
+- false);
+-}
+-
+-/**
+- * i40evf_aq_set_rss_lut
+- * @hw: pointer to the hardware structure
+- * @vsi_id: vsi fw index
+- * @pf_lut: for PF table set true, for VSI table set false
+- * @lut: pointer to the lut buffer provided by the caller
+- * @lut_size: size of the lut buffer
+- *
+- * set the RSS lookup table, PF or VSI type
+- **/
+-i40e_status i40evf_aq_set_rss_lut(struct i40e_hw *hw, u16 vsi_id,
+- bool pf_lut, u8 *lut, u16 lut_size)
+-{
+- return i40e_aq_get_set_rss_lut(hw, vsi_id, pf_lut, lut, lut_size, true);
+-}
+-
+-/**
+- * i40e_aq_get_set_rss_key
+- * @hw: pointer to the hw struct
+- * @vsi_id: vsi fw index
+- * @key: pointer to key info struct
+- * @set: set true to set the key, false to get the key
+- *
+- * get the RSS key per VSI
+- **/
+-static i40e_status i40e_aq_get_set_rss_key(struct i40e_hw *hw,
+- u16 vsi_id,
+- struct i40e_aqc_get_set_rss_key_data *key,
+- bool set)
+-{
+- i40e_status status;
+- struct i40e_aq_desc desc;
+- struct i40e_aqc_get_set_rss_key *cmd_resp =
+- (struct i40e_aqc_get_set_rss_key *)&desc.params.raw;
+- u16 key_size = sizeof(struct i40e_aqc_get_set_rss_key_data);
+-
+- if (set)
+- i40evf_fill_default_direct_cmd_desc(&desc,
+- i40e_aqc_opc_set_rss_key);
+- else
+- i40evf_fill_default_direct_cmd_desc(&desc,
+- i40e_aqc_opc_get_rss_key);
+-
+- /* Indirect command */
+- desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_BUF);
+- desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_RD);
+-
+- cmd_resp->vsi_id =
+- cpu_to_le16((u16)((vsi_id <<
+- I40E_AQC_SET_RSS_KEY_VSI_ID_SHIFT) &
+- I40E_AQC_SET_RSS_KEY_VSI_ID_MASK));
+- cmd_resp->vsi_id |= cpu_to_le16((u16)I40E_AQC_SET_RSS_KEY_VSI_VALID);
+-
+- status = i40evf_asq_send_command(hw, &desc, key, key_size, NULL);
+-
+- return status;
+-}
+-
+-/**
+- * i40evf_aq_get_rss_key
+- * @hw: pointer to the hw struct
+- * @vsi_id: vsi fw index
+- * @key: pointer to key info struct
+- *
+- **/
+-i40e_status i40evf_aq_get_rss_key(struct i40e_hw *hw,
+- u16 vsi_id,
+- struct i40e_aqc_get_set_rss_key_data *key)
+-{
+- return i40e_aq_get_set_rss_key(hw, vsi_id, key, false);
+-}
+-
+-/**
+- * i40evf_aq_set_rss_key
+- * @hw: pointer to the hw struct
+- * @vsi_id: vsi fw index
+- * @key: pointer to key info struct
+- *
+- * set the RSS key per VSI
+- **/
+-i40e_status i40evf_aq_set_rss_key(struct i40e_hw *hw,
+- u16 vsi_id,
+- struct i40e_aqc_get_set_rss_key_data *key)
+-{
+- return i40e_aq_get_set_rss_key(hw, vsi_id, key, true);
+-}
+-
+-
+-/* The i40evf_ptype_lookup table is used to convert from the 8-bit ptype in the
+- * hardware to a bit-field that can be used by SW to more easily determine the
+- * packet type.
+- *
+- * Macros are used to shorten the table lines and make this table human
+- * readable.
+- *
+- * We store the PTYPE in the top byte of the bit field - this is just so that
+- * we can check that the table doesn't have a row missing, as the index into
+- * the table should be the PTYPE.
+- *
+- * Typical work flow:
+- *
+- * IF NOT i40evf_ptype_lookup[ptype].known
+- * THEN
+- * Packet is unknown
+- * ELSE IF i40evf_ptype_lookup[ptype].outer_ip == I40E_RX_PTYPE_OUTER_IP
+- * Use the rest of the fields to look at the tunnels, inner protocols, etc
+- * ELSE
+- * Use the enum i40e_rx_l2_ptype to decode the packet type
+- * ENDIF
+- */
+-
+-/* macro to make the table lines short */
+-#define I40E_PTT(PTYPE, OUTER_IP, OUTER_IP_VER, OUTER_FRAG, T, TE, TEF, I, PL)\
+- { PTYPE, \
+- 1, \
+- I40E_RX_PTYPE_OUTER_##OUTER_IP, \
+- I40E_RX_PTYPE_OUTER_##OUTER_IP_VER, \
+- I40E_RX_PTYPE_##OUTER_FRAG, \
+- I40E_RX_PTYPE_TUNNEL_##T, \
+- I40E_RX_PTYPE_TUNNEL_END_##TE, \
+- I40E_RX_PTYPE_##TEF, \
+- I40E_RX_PTYPE_INNER_PROT_##I, \
+- I40E_RX_PTYPE_PAYLOAD_LAYER_##PL }
+-
+-#define I40E_PTT_UNUSED_ENTRY(PTYPE) \
+- { PTYPE, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
+-
+-/* shorter macros makes the table fit but are terse */
+-#define I40E_RX_PTYPE_NOF I40E_RX_PTYPE_NOT_FRAG
+-#define I40E_RX_PTYPE_FRG I40E_RX_PTYPE_FRAG
+-#define I40E_RX_PTYPE_INNER_PROT_TS I40E_RX_PTYPE_INNER_PROT_TIMESYNC
+-
+-/* Lookup table mapping the HW PTYPE to the bit field for decoding */
+-struct i40e_rx_ptype_decoded i40evf_ptype_lookup[] = {
+- /* L2 Packet types */
+- I40E_PTT_UNUSED_ENTRY(0),
+- I40E_PTT(1, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2),
+- I40E_PTT(2, L2, NONE, NOF, NONE, NONE, NOF, TS, PAY2),
+- I40E_PTT(3, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2),
+- I40E_PTT_UNUSED_ENTRY(4),
+- I40E_PTT_UNUSED_ENTRY(5),
+- I40E_PTT(6, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2),
+- I40E_PTT(7, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2),
+- I40E_PTT_UNUSED_ENTRY(8),
+- I40E_PTT_UNUSED_ENTRY(9),
+- I40E_PTT(10, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2),
+- I40E_PTT(11, L2, NONE, NOF, NONE, NONE, NOF, NONE, NONE),
+- I40E_PTT(12, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(13, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(14, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(15, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(16, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(17, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(18, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(19, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(20, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(21, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
+-
+- /* Non Tunneled IPv4 */
+- I40E_PTT(22, IP, IPV4, FRG, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(23, IP, IPV4, NOF, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(24, IP, IPV4, NOF, NONE, NONE, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(25),
+- I40E_PTT(26, IP, IPV4, NOF, NONE, NONE, NOF, TCP, PAY4),
+- I40E_PTT(27, IP, IPV4, NOF, NONE, NONE, NOF, SCTP, PAY4),
+- I40E_PTT(28, IP, IPV4, NOF, NONE, NONE, NOF, ICMP, PAY4),
+-
+- /* IPv4 --> IPv4 */
+- I40E_PTT(29, IP, IPV4, NOF, IP_IP, IPV4, FRG, NONE, PAY3),
+- I40E_PTT(30, IP, IPV4, NOF, IP_IP, IPV4, NOF, NONE, PAY3),
+- I40E_PTT(31, IP, IPV4, NOF, IP_IP, IPV4, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(32),
+- I40E_PTT(33, IP, IPV4, NOF, IP_IP, IPV4, NOF, TCP, PAY4),
+- I40E_PTT(34, IP, IPV4, NOF, IP_IP, IPV4, NOF, SCTP, PAY4),
+- I40E_PTT(35, IP, IPV4, NOF, IP_IP, IPV4, NOF, ICMP, PAY4),
+-
+- /* IPv4 --> IPv6 */
+- I40E_PTT(36, IP, IPV4, NOF, IP_IP, IPV6, FRG, NONE, PAY3),
+- I40E_PTT(37, IP, IPV4, NOF, IP_IP, IPV6, NOF, NONE, PAY3),
+- I40E_PTT(38, IP, IPV4, NOF, IP_IP, IPV6, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(39),
+- I40E_PTT(40, IP, IPV4, NOF, IP_IP, IPV6, NOF, TCP, PAY4),
+- I40E_PTT(41, IP, IPV4, NOF, IP_IP, IPV6, NOF, SCTP, PAY4),
+- I40E_PTT(42, IP, IPV4, NOF, IP_IP, IPV6, NOF, ICMP, PAY4),
+-
+- /* IPv4 --> GRE/NAT */
+- I40E_PTT(43, IP, IPV4, NOF, IP_GRENAT, NONE, NOF, NONE, PAY3),
+-
+- /* IPv4 --> GRE/NAT --> IPv4 */
+- I40E_PTT(44, IP, IPV4, NOF, IP_GRENAT, IPV4, FRG, NONE, PAY3),
+- I40E_PTT(45, IP, IPV4, NOF, IP_GRENAT, IPV4, NOF, NONE, PAY3),
+- I40E_PTT(46, IP, IPV4, NOF, IP_GRENAT, IPV4, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(47),
+- I40E_PTT(48, IP, IPV4, NOF, IP_GRENAT, IPV4, NOF, TCP, PAY4),
+- I40E_PTT(49, IP, IPV4, NOF, IP_GRENAT, IPV4, NOF, SCTP, PAY4),
+- I40E_PTT(50, IP, IPV4, NOF, IP_GRENAT, IPV4, NOF, ICMP, PAY4),
+-
+- /* IPv4 --> GRE/NAT --> IPv6 */
+- I40E_PTT(51, IP, IPV4, NOF, IP_GRENAT, IPV6, FRG, NONE, PAY3),
+- I40E_PTT(52, IP, IPV4, NOF, IP_GRENAT, IPV6, NOF, NONE, PAY3),
+- I40E_PTT(53, IP, IPV4, NOF, IP_GRENAT, IPV6, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(54),
+- I40E_PTT(55, IP, IPV4, NOF, IP_GRENAT, IPV6, NOF, TCP, PAY4),
+- I40E_PTT(56, IP, IPV4, NOF, IP_GRENAT, IPV6, NOF, SCTP, PAY4),
+- I40E_PTT(57, IP, IPV4, NOF, IP_GRENAT, IPV6, NOF, ICMP, PAY4),
+-
+- /* IPv4 --> GRE/NAT --> MAC */
+- I40E_PTT(58, IP, IPV4, NOF, IP_GRENAT_MAC, NONE, NOF, NONE, PAY3),
+-
+- /* IPv4 --> GRE/NAT --> MAC --> IPv4 */
+- I40E_PTT(59, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, FRG, NONE, PAY3),
+- I40E_PTT(60, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, NOF, NONE, PAY3),
+- I40E_PTT(61, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(62),
+- I40E_PTT(63, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, NOF, TCP, PAY4),
+- I40E_PTT(64, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, NOF, SCTP, PAY4),
+- I40E_PTT(65, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, NOF, ICMP, PAY4),
+-
+- /* IPv4 --> GRE/NAT -> MAC --> IPv6 */
+- I40E_PTT(66, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, FRG, NONE, PAY3),
+- I40E_PTT(67, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, NOF, NONE, PAY3),
+- I40E_PTT(68, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(69),
+- I40E_PTT(70, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, NOF, TCP, PAY4),
+- I40E_PTT(71, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, NOF, SCTP, PAY4),
+- I40E_PTT(72, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, NOF, ICMP, PAY4),
+-
+- /* IPv4 --> GRE/NAT --> MAC/VLAN */
+- I40E_PTT(73, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, NONE, NOF, NONE, PAY3),
+-
+- /* IPv4 ---> GRE/NAT -> MAC/VLAN --> IPv4 */
+- I40E_PTT(74, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, FRG, NONE, PAY3),
+- I40E_PTT(75, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, NONE, PAY3),
+- I40E_PTT(76, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(77),
+- I40E_PTT(78, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, TCP, PAY4),
+- I40E_PTT(79, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, SCTP, PAY4),
+- I40E_PTT(80, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, ICMP, PAY4),
+-
+- /* IPv4 -> GRE/NAT -> MAC/VLAN --> IPv6 */
+- I40E_PTT(81, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, FRG, NONE, PAY3),
+- I40E_PTT(82, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, NONE, PAY3),
+- I40E_PTT(83, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(84),
+- I40E_PTT(85, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, TCP, PAY4),
+- I40E_PTT(86, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, SCTP, PAY4),
+- I40E_PTT(87, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, ICMP, PAY4),
+-
+- /* Non Tunneled IPv6 */
+- I40E_PTT(88, IP, IPV6, FRG, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(89, IP, IPV6, NOF, NONE, NONE, NOF, NONE, PAY3),
+- I40E_PTT(90, IP, IPV6, NOF, NONE, NONE, NOF, UDP, PAY3),
+- I40E_PTT_UNUSED_ENTRY(91),
+- I40E_PTT(92, IP, IPV6, NOF, NONE, NONE, NOF, TCP, PAY4),
+- I40E_PTT(93, IP, IPV6, NOF, NONE, NONE, NOF, SCTP, PAY4),
+- I40E_PTT(94, IP, IPV6, NOF, NONE, NONE, NOF, ICMP, PAY4),
+-
+- /* IPv6 --> IPv4 */
+- I40E_PTT(95, IP, IPV6, NOF, IP_IP, IPV4, FRG, NONE, PAY3),
+- I40E_PTT(96, IP, IPV6, NOF, IP_IP, IPV4, NOF, NONE, PAY3),
+- I40E_PTT(97, IP, IPV6, NOF, IP_IP, IPV4, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(98),
+- I40E_PTT(99, IP, IPV6, NOF, IP_IP, IPV4, NOF, TCP, PAY4),
+- I40E_PTT(100, IP, IPV6, NOF, IP_IP, IPV4, NOF, SCTP, PAY4),
+- I40E_PTT(101, IP, IPV6, NOF, IP_IP, IPV4, NOF, ICMP, PAY4),
+-
+- /* IPv6 --> IPv6 */
+- I40E_PTT(102, IP, IPV6, NOF, IP_IP, IPV6, FRG, NONE, PAY3),
+- I40E_PTT(103, IP, IPV6, NOF, IP_IP, IPV6, NOF, NONE, PAY3),
+- I40E_PTT(104, IP, IPV6, NOF, IP_IP, IPV6, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(105),
+- I40E_PTT(106, IP, IPV6, NOF, IP_IP, IPV6, NOF, TCP, PAY4),
+- I40E_PTT(107, IP, IPV6, NOF, IP_IP, IPV6, NOF, SCTP, PAY4),
+- I40E_PTT(108, IP, IPV6, NOF, IP_IP, IPV6, NOF, ICMP, PAY4),
+-
+- /* IPv6 --> GRE/NAT */
+- I40E_PTT(109, IP, IPV6, NOF, IP_GRENAT, NONE, NOF, NONE, PAY3),
+-
+- /* IPv6 --> GRE/NAT -> IPv4 */
+- I40E_PTT(110, IP, IPV6, NOF, IP_GRENAT, IPV4, FRG, NONE, PAY3),
+- I40E_PTT(111, IP, IPV6, NOF, IP_GRENAT, IPV4, NOF, NONE, PAY3),
+- I40E_PTT(112, IP, IPV6, NOF, IP_GRENAT, IPV4, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(113),
+- I40E_PTT(114, IP, IPV6, NOF, IP_GRENAT, IPV4, NOF, TCP, PAY4),
+- I40E_PTT(115, IP, IPV6, NOF, IP_GRENAT, IPV4, NOF, SCTP, PAY4),
+- I40E_PTT(116, IP, IPV6, NOF, IP_GRENAT, IPV4, NOF, ICMP, PAY4),
+-
+- /* IPv6 --> GRE/NAT -> IPv6 */
+- I40E_PTT(117, IP, IPV6, NOF, IP_GRENAT, IPV6, FRG, NONE, PAY3),
+- I40E_PTT(118, IP, IPV6, NOF, IP_GRENAT, IPV6, NOF, NONE, PAY3),
+- I40E_PTT(119, IP, IPV6, NOF, IP_GRENAT, IPV6, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(120),
+- I40E_PTT(121, IP, IPV6, NOF, IP_GRENAT, IPV6, NOF, TCP, PAY4),
+- I40E_PTT(122, IP, IPV6, NOF, IP_GRENAT, IPV6, NOF, SCTP, PAY4),
+- I40E_PTT(123, IP, IPV6, NOF, IP_GRENAT, IPV6, NOF, ICMP, PAY4),
+-
+- /* IPv6 --> GRE/NAT -> MAC */
+- I40E_PTT(124, IP, IPV6, NOF, IP_GRENAT_MAC, NONE, NOF, NONE, PAY3),
+-
+- /* IPv6 --> GRE/NAT -> MAC -> IPv4 */
+- I40E_PTT(125, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, FRG, NONE, PAY3),
+- I40E_PTT(126, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, NOF, NONE, PAY3),
+- I40E_PTT(127, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(128),
+- I40E_PTT(129, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, NOF, TCP, PAY4),
+- I40E_PTT(130, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, NOF, SCTP, PAY4),
+- I40E_PTT(131, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, NOF, ICMP, PAY4),
+-
+- /* IPv6 --> GRE/NAT -> MAC -> IPv6 */
+- I40E_PTT(132, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, FRG, NONE, PAY3),
+- I40E_PTT(133, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, NOF, NONE, PAY3),
+- I40E_PTT(134, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(135),
+- I40E_PTT(136, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, NOF, TCP, PAY4),
+- I40E_PTT(137, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, NOF, SCTP, PAY4),
+- I40E_PTT(138, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, NOF, ICMP, PAY4),
+-
+- /* IPv6 --> GRE/NAT -> MAC/VLAN */
+- I40E_PTT(139, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, NONE, NOF, NONE, PAY3),
+-
+- /* IPv6 --> GRE/NAT -> MAC/VLAN --> IPv4 */
+- I40E_PTT(140, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, FRG, NONE, PAY3),
+- I40E_PTT(141, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, NONE, PAY3),
+- I40E_PTT(142, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(143),
+- I40E_PTT(144, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, TCP, PAY4),
+- I40E_PTT(145, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, SCTP, PAY4),
+- I40E_PTT(146, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, ICMP, PAY4),
+-
+- /* IPv6 --> GRE/NAT -> MAC/VLAN --> IPv6 */
+- I40E_PTT(147, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, FRG, NONE, PAY3),
+- I40E_PTT(148, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, NONE, PAY3),
+- I40E_PTT(149, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, UDP, PAY4),
+- I40E_PTT_UNUSED_ENTRY(150),
+- I40E_PTT(151, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, TCP, PAY4),
+- I40E_PTT(152, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, SCTP, PAY4),
+- I40E_PTT(153, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, ICMP, PAY4),
+-
+- /* unused entries */
+- I40E_PTT_UNUSED_ENTRY(154),
+- I40E_PTT_UNUSED_ENTRY(155),
+- I40E_PTT_UNUSED_ENTRY(156),
+- I40E_PTT_UNUSED_ENTRY(157),
+- I40E_PTT_UNUSED_ENTRY(158),
+- I40E_PTT_UNUSED_ENTRY(159),
+-
+- I40E_PTT_UNUSED_ENTRY(160),
+- I40E_PTT_UNUSED_ENTRY(161),
+- I40E_PTT_UNUSED_ENTRY(162),
+- I40E_PTT_UNUSED_ENTRY(163),
+- I40E_PTT_UNUSED_ENTRY(164),
+- I40E_PTT_UNUSED_ENTRY(165),
+- I40E_PTT_UNUSED_ENTRY(166),
+- I40E_PTT_UNUSED_ENTRY(167),
+- I40E_PTT_UNUSED_ENTRY(168),
+- I40E_PTT_UNUSED_ENTRY(169),
+-
+- I40E_PTT_UNUSED_ENTRY(170),
+- I40E_PTT_UNUSED_ENTRY(171),
+- I40E_PTT_UNUSED_ENTRY(172),
+- I40E_PTT_UNUSED_ENTRY(173),
+- I40E_PTT_UNUSED_ENTRY(174),
+- I40E_PTT_UNUSED_ENTRY(175),
+- I40E_PTT_UNUSED_ENTRY(176),
+- I40E_PTT_UNUSED_ENTRY(177),
+- I40E_PTT_UNUSED_ENTRY(178),
+- I40E_PTT_UNUSED_ENTRY(179),
+-
+- I40E_PTT_UNUSED_ENTRY(180),
+- I40E_PTT_UNUSED_ENTRY(181),
+- I40E_PTT_UNUSED_ENTRY(182),
+- I40E_PTT_UNUSED_ENTRY(183),
+- I40E_PTT_UNUSED_ENTRY(184),
+- I40E_PTT_UNUSED_ENTRY(185),
+- I40E_PTT_UNUSED_ENTRY(186),
+- I40E_PTT_UNUSED_ENTRY(187),
+- I40E_PTT_UNUSED_ENTRY(188),
+- I40E_PTT_UNUSED_ENTRY(189),
+-
+- I40E_PTT_UNUSED_ENTRY(190),
+- I40E_PTT_UNUSED_ENTRY(191),
+- I40E_PTT_UNUSED_ENTRY(192),
+- I40E_PTT_UNUSED_ENTRY(193),
+- I40E_PTT_UNUSED_ENTRY(194),
+- I40E_PTT_UNUSED_ENTRY(195),
+- I40E_PTT_UNUSED_ENTRY(196),
+- I40E_PTT_UNUSED_ENTRY(197),
+- I40E_PTT_UNUSED_ENTRY(198),
+- I40E_PTT_UNUSED_ENTRY(199),
+-
+- I40E_PTT_UNUSED_ENTRY(200),
+- I40E_PTT_UNUSED_ENTRY(201),
+- I40E_PTT_UNUSED_ENTRY(202),
+- I40E_PTT_UNUSED_ENTRY(203),
+- I40E_PTT_UNUSED_ENTRY(204),
+- I40E_PTT_UNUSED_ENTRY(205),
+- I40E_PTT_UNUSED_ENTRY(206),
+- I40E_PTT_UNUSED_ENTRY(207),
+- I40E_PTT_UNUSED_ENTRY(208),
+- I40E_PTT_UNUSED_ENTRY(209),
+-
+- I40E_PTT_UNUSED_ENTRY(210),
+- I40E_PTT_UNUSED_ENTRY(211),
+- I40E_PTT_UNUSED_ENTRY(212),
+- I40E_PTT_UNUSED_ENTRY(213),
+- I40E_PTT_UNUSED_ENTRY(214),
+- I40E_PTT_UNUSED_ENTRY(215),
+- I40E_PTT_UNUSED_ENTRY(216),
+- I40E_PTT_UNUSED_ENTRY(217),
+- I40E_PTT_UNUSED_ENTRY(218),
+- I40E_PTT_UNUSED_ENTRY(219),
+-
+- I40E_PTT_UNUSED_ENTRY(220),
+- I40E_PTT_UNUSED_ENTRY(221),
+- I40E_PTT_UNUSED_ENTRY(222),
+- I40E_PTT_UNUSED_ENTRY(223),
+- I40E_PTT_UNUSED_ENTRY(224),
+- I40E_PTT_UNUSED_ENTRY(225),
+- I40E_PTT_UNUSED_ENTRY(226),
+- I40E_PTT_UNUSED_ENTRY(227),
+- I40E_PTT_UNUSED_ENTRY(228),
+- I40E_PTT_UNUSED_ENTRY(229),
+-
+- I40E_PTT_UNUSED_ENTRY(230),
+- I40E_PTT_UNUSED_ENTRY(231),
+- I40E_PTT_UNUSED_ENTRY(232),
+- I40E_PTT_UNUSED_ENTRY(233),
+- I40E_PTT_UNUSED_ENTRY(234),
+- I40E_PTT_UNUSED_ENTRY(235),
+- I40E_PTT_UNUSED_ENTRY(236),
+- I40E_PTT_UNUSED_ENTRY(237),
+- I40E_PTT_UNUSED_ENTRY(238),
+- I40E_PTT_UNUSED_ENTRY(239),
+-
+- I40E_PTT_UNUSED_ENTRY(240),
+- I40E_PTT_UNUSED_ENTRY(241),
+- I40E_PTT_UNUSED_ENTRY(242),
+- I40E_PTT_UNUSED_ENTRY(243),
+- I40E_PTT_UNUSED_ENTRY(244),
+- I40E_PTT_UNUSED_ENTRY(245),
+- I40E_PTT_UNUSED_ENTRY(246),
+- I40E_PTT_UNUSED_ENTRY(247),
+- I40E_PTT_UNUSED_ENTRY(248),
+- I40E_PTT_UNUSED_ENTRY(249),
+-
+- I40E_PTT_UNUSED_ENTRY(250),
+- I40E_PTT_UNUSED_ENTRY(251),
+- I40E_PTT_UNUSED_ENTRY(252),
+- I40E_PTT_UNUSED_ENTRY(253),
+- I40E_PTT_UNUSED_ENTRY(254),
+- I40E_PTT_UNUSED_ENTRY(255)
+-};
+-
+-/**
+- * i40evf_aq_rx_ctl_read_register - use FW to read from an Rx control register
+- * @hw: pointer to the hw struct
+- * @reg_addr: register address
+- * @reg_val: ptr to register value
+- * @cmd_details: pointer to command details structure or NULL
+- *
+- * Use the firmware to read the Rx control register,
+- * especially useful if the Rx unit is under heavy pressure
+- **/
+-i40e_status i40evf_aq_rx_ctl_read_register(struct i40e_hw *hw,
+- u32 reg_addr, u32 *reg_val,
+- struct i40e_asq_cmd_details *cmd_details)
+-{
+- struct i40e_aq_desc desc;
+- struct i40e_aqc_rx_ctl_reg_read_write *cmd_resp =
+- (struct i40e_aqc_rx_ctl_reg_read_write *)&desc.params.raw;
+- i40e_status status;
+-
+- if (!reg_val)
+- return I40E_ERR_PARAM;
+-
+- i40evf_fill_default_direct_cmd_desc(&desc,
+- i40e_aqc_opc_rx_ctl_reg_read);
+-
+- cmd_resp->address = cpu_to_le32(reg_addr);
+-
+- status = i40evf_asq_send_command(hw, &desc, NULL, 0, cmd_details);
+-
+- if (status == 0)
+- *reg_val = le32_to_cpu(cmd_resp->value);
+-
+- return status;
+-}
+-
+-/**
+- * i40evf_read_rx_ctl - read from an Rx control register
+- * @hw: pointer to the hw struct
+- * @reg_addr: register address
+- **/
+-u32 i40evf_read_rx_ctl(struct i40e_hw *hw, u32 reg_addr)
+-{
+- i40e_status status = 0;
+- bool use_register;
+- int retry = 5;
+- u32 val = 0;
+-
+- use_register = (((hw->aq.api_maj_ver == 1) &&
+- (hw->aq.api_min_ver < 5)) ||
+- (hw->mac.type == I40E_MAC_X722));
+- if (!use_register) {
+-do_retry:
+- status = i40evf_aq_rx_ctl_read_register(hw, reg_addr,
+- &val, NULL);
+- if (hw->aq.asq_last_status == I40E_AQ_RC_EAGAIN && retry) {
+- usleep_range(1000, 2000);
+- retry--;
+- goto do_retry;
+- }
+- }
+-
+- /* if the AQ access failed, try the old-fashioned way */
+- if (status || use_register)
+- val = rd32(hw, reg_addr);
+-
+- return val;
+-}
+-
+-/**
+- * i40evf_aq_rx_ctl_write_register
+- * @hw: pointer to the hw struct
+- * @reg_addr: register address
+- * @reg_val: register value
+- * @cmd_details: pointer to command details structure or NULL
+- *
+- * Use the firmware to write to an Rx control register,
+- * especially useful if the Rx unit is under heavy pressure
+- **/
+-i40e_status i40evf_aq_rx_ctl_write_register(struct i40e_hw *hw,
+- u32 reg_addr, u32 reg_val,
+- struct i40e_asq_cmd_details *cmd_details)
+-{
+- struct i40e_aq_desc desc;
+- struct i40e_aqc_rx_ctl_reg_read_write *cmd =
+- (struct i40e_aqc_rx_ctl_reg_read_write *)&desc.params.raw;
+- i40e_status status;
+-
+- i40evf_fill_default_direct_cmd_desc(&desc,
+- i40e_aqc_opc_rx_ctl_reg_write);
+-
+- cmd->address = cpu_to_le32(reg_addr);
+- cmd->value = cpu_to_le32(reg_val);
+-
+- status = i40evf_asq_send_command(hw, &desc, NULL, 0, cmd_details);
+-
+- return status;
+-}
+-
+-/**
+- * i40evf_write_rx_ctl - write to an Rx control register
+- * @hw: pointer to the hw struct
+- * @reg_addr: register address
+- * @reg_val: register value
+- **/
+-void i40evf_write_rx_ctl(struct i40e_hw *hw, u32 reg_addr, u32 reg_val)
+-{
+- i40e_status status = 0;
+- bool use_register;
+- int retry = 5;
+-
+- use_register = (((hw->aq.api_maj_ver == 1) &&
+- (hw->aq.api_min_ver < 5)) ||
+- (hw->mac.type == I40E_MAC_X722));
+- if (!use_register) {
+-do_retry:
+- status = i40evf_aq_rx_ctl_write_register(hw, reg_addr,
+- reg_val, NULL);
+- if (hw->aq.asq_last_status == I40E_AQ_RC_EAGAIN && retry) {
+- usleep_range(1000, 2000);
+- retry--;
+- goto do_retry;
+- }
+- }
+-
+- /* if the AQ access failed, try the old-fashioned way */
+- if (status || use_register)
+- wr32(hw, reg_addr, reg_val);
+-}
+-
+-/**
+- * i40e_aq_send_msg_to_pf
+- * @hw: pointer to the hardware structure
+- * @v_opcode: opcodes for VF-PF communication
+- * @v_retval: return error code
+- * @msg: pointer to the msg buffer
+- * @msglen: msg length
+- * @cmd_details: pointer to command details
+- *
+- * Send message to PF driver using admin queue. By default, this message
+- * is sent asynchronously, i.e. i40evf_asq_send_command() does not wait for
+- * completion before returning.
+- **/
+-i40e_status i40e_aq_send_msg_to_pf(struct i40e_hw *hw,
+- enum virtchnl_ops v_opcode,
+- i40e_status v_retval,
+- u8 *msg, u16 msglen,
+- struct i40e_asq_cmd_details *cmd_details)
+-{
+- struct i40e_aq_desc desc;
+- struct i40e_asq_cmd_details details;
+- i40e_status status;
+-
+- i40evf_fill_default_direct_cmd_desc(&desc, i40e_aqc_opc_send_msg_to_pf);
+- desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_SI);
+- desc.cookie_high = cpu_to_le32(v_opcode);
+- desc.cookie_low = cpu_to_le32(v_retval);
+- if (msglen) {
+- desc.flags |= cpu_to_le16((u16)(I40E_AQ_FLAG_BUF
+- | I40E_AQ_FLAG_RD));
+- if (msglen > I40E_AQ_LARGE_BUF)
+- desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_LB);
+- desc.datalen = cpu_to_le16(msglen);
+- }
+- if (!cmd_details) {
+- memset(&details, 0, sizeof(details));
+- details.async = true;
+- cmd_details = &details;
+- }
+- status = i40evf_asq_send_command(hw, &desc, msg, msglen, cmd_details);
+- return status;
+-}
+-
+-/**
+- * i40e_vf_parse_hw_config
+- * @hw: pointer to the hardware structure
+- * @msg: pointer to the virtual channel VF resource structure
+- *
+- * Given a VF resource message from the PF, populate the hw struct
+- * with appropriate information.
+- **/
+-void i40e_vf_parse_hw_config(struct i40e_hw *hw,
+- struct virtchnl_vf_resource *msg)
+-{
+- struct virtchnl_vsi_resource *vsi_res;
+- int i;
+-
+- vsi_res = &msg->vsi_res[0];
+-
+- hw->dev_caps.num_vsis = msg->num_vsis;
+- hw->dev_caps.num_rx_qp = msg->num_queue_pairs;
+- hw->dev_caps.num_tx_qp = msg->num_queue_pairs;
+- hw->dev_caps.num_msix_vectors_vf = msg->max_vectors;
+- hw->dev_caps.dcb = msg->vf_cap_flags &
+- VIRTCHNL_VF_OFFLOAD_L2;
+- hw->dev_caps.fcoe = 0;
+- for (i = 0; i < msg->num_vsis; i++) {
+- if (vsi_res->vsi_type == VIRTCHNL_VSI_SRIOV) {
+- ether_addr_copy(hw->mac.perm_addr,
+- vsi_res->default_mac_addr);
+- ether_addr_copy(hw->mac.addr,
+- vsi_res->default_mac_addr);
+- }
+- vsi_res++;
+- }
+-}
+-
+-/**
+- * i40e_vf_reset
+- * @hw: pointer to the hardware structure
+- *
+- * Send a VF_RESET message to the PF. Does not wait for response from PF
+- * as none will be forthcoming. Immediately after calling this function,
+- * the admin queue should be shut down and (optionally) reinitialized.
+- **/
+-i40e_status i40e_vf_reset(struct i40e_hw *hw)
+-{
+- return i40e_aq_send_msg_to_pf(hw, VIRTCHNL_OP_RESET_VF,
+- 0, NULL, 0, NULL);
+-}
+-
+-/**
+- * i40evf_aq_write_ddp - Write dynamic device personalization (ddp)
+- * @hw: pointer to the hw struct
+- * @buff: command buffer (size in bytes = buff_size)
+- * @buff_size: buffer size in bytes
+- * @track_id: package tracking id
+- * @error_offset: returns error offset
+- * @error_info: returns error information
+- * @cmd_details: pointer to command details structure or NULL
+- **/
+-enum
+-i40e_status_code i40evf_aq_write_ddp(struct i40e_hw *hw, void *buff,
+- u16 buff_size, u32 track_id,
+- u32 *error_offset, u32 *error_info,
+- struct i40e_asq_cmd_details *cmd_details)
+-{
+- struct i40e_aq_desc desc;
+- struct i40e_aqc_write_personalization_profile *cmd =
+- (struct i40e_aqc_write_personalization_profile *)
+- &desc.params.raw;
+- struct i40e_aqc_write_ddp_resp *resp;
+- i40e_status status;
+-
+- i40evf_fill_default_direct_cmd_desc(&desc,
+- i40e_aqc_opc_write_personalization_profile);
+-
+- desc.flags |= cpu_to_le16(I40E_AQ_FLAG_BUF | I40E_AQ_FLAG_RD);
+- if (buff_size > I40E_AQ_LARGE_BUF)
+- desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_LB);
+-
+- desc.datalen = cpu_to_le16(buff_size);
+-
+- cmd->profile_track_id = cpu_to_le32(track_id);
+-
+- status = i40evf_asq_send_command(hw, &desc, buff, buff_size, cmd_details);
+- if (!status) {
+- resp = (struct i40e_aqc_write_ddp_resp *)&desc.params.raw;
+- if (error_offset)
+- *error_offset = le32_to_cpu(resp->error_offset);
+- if (error_info)
+- *error_info = le32_to_cpu(resp->error_info);
+- }
+-
+- return status;
+-}
+-
+-/**
+- * i40evf_aq_get_ddp_list - Read dynamic device personalization (ddp)
+- * @hw: pointer to the hw struct
+- * @buff: command buffer (size in bytes = buff_size)
+- * @buff_size: buffer size in bytes
+- * @flags: AdminQ command flags
+- * @cmd_details: pointer to command details structure or NULL
+- **/
+-enum
+-i40e_status_code i40evf_aq_get_ddp_list(struct i40e_hw *hw, void *buff,
+- u16 buff_size, u8 flags,
+- struct i40e_asq_cmd_details *cmd_details)
+-{
+- struct i40e_aq_desc desc;
+- struct i40e_aqc_get_applied_profiles *cmd =
+- (struct i40e_aqc_get_applied_profiles *)&desc.params.raw;
+- i40e_status status;
+-
+- i40evf_fill_default_direct_cmd_desc(&desc,
+- i40e_aqc_opc_get_personalization_profile_list);
+-
+- desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_BUF);
+- if (buff_size > I40E_AQ_LARGE_BUF)
+- desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_LB);
+- desc.datalen = cpu_to_le16(buff_size);
+-
+- cmd->flags = flags;
+-
+- status = i40evf_asq_send_command(hw, &desc, buff, buff_size, cmd_details);
+-
+- return status;
+-}
+-
+-/**
+- * i40evf_find_segment_in_package
+- * @segment_type: the segment type to search for (i.e., SEGMENT_TYPE_I40E)
+- * @pkg_hdr: pointer to the package header to be searched
+- *
+- * This function searches a package file for a particular segment type. On
+- * success it returns a pointer to the segment header, otherwise it will
+- * return NULL.
+- **/
+-struct i40e_generic_seg_header *
+-i40evf_find_segment_in_package(u32 segment_type,
+- struct i40e_package_header *pkg_hdr)
+-{
+- struct i40e_generic_seg_header *segment;
+- u32 i;
+-
+- /* Search all package segments for the requested segment type */
+- for (i = 0; i < pkg_hdr->segment_count; i++) {
+- segment =
+- (struct i40e_generic_seg_header *)((u8 *)pkg_hdr +
+- pkg_hdr->segment_offset[i]);
+-
+- if (segment->type == segment_type)
+- return segment;
+- }
+-
+- return NULL;
+-}
+-
+-/**
+- * i40evf_write_profile
+- * @hw: pointer to the hardware structure
+- * @profile: pointer to the profile segment of the package to be downloaded
+- * @track_id: package tracking id
+- *
+- * Handles the download of a complete package.
+- */
+-enum i40e_status_code
+-i40evf_write_profile(struct i40e_hw *hw, struct i40e_profile_segment *profile,
+- u32 track_id)
+-{
+- i40e_status status = 0;
+- struct i40e_section_table *sec_tbl;
+- struct i40e_profile_section_header *sec = NULL;
+- u32 dev_cnt;
+- u32 vendor_dev_id;
+- u32 *nvm;
+- u32 section_size = 0;
+- u32 offset = 0, info = 0;
+- u32 i;
+-
+- dev_cnt = profile->device_table_count;
+-
+- for (i = 0; i < dev_cnt; i++) {
+- vendor_dev_id = profile->device_table[i].vendor_dev_id;
+- if ((vendor_dev_id >> 16) == PCI_VENDOR_ID_INTEL)
+- if (hw->device_id == (vendor_dev_id & 0xFFFF))
+- break;
+- }
+- if (i == dev_cnt) {
+- i40e_debug(hw, I40E_DEBUG_PACKAGE, "Device doesn't support DDP");
+- return I40E_ERR_DEVICE_NOT_SUPPORTED;
+- }
+-
+- nvm = (u32 *)&profile->device_table[dev_cnt];
+- sec_tbl = (struct i40e_section_table *)&nvm[nvm[0] + 1];
+-
+- for (i = 0; i < sec_tbl->section_count; i++) {
+- sec = (struct i40e_profile_section_header *)((u8 *)profile +
+- sec_tbl->section_offset[i]);
+-
+- /* Skip 'AQ', 'note' and 'name' sections */
+- if (sec->section.type != SECTION_TYPE_MMIO)
+- continue;
+-
+- section_size = sec->section.size +
+- sizeof(struct i40e_profile_section_header);
+-
+- /* Write profile */
+- status = i40evf_aq_write_ddp(hw, (void *)sec, (u16)section_size,
+- track_id, &offset, &info, NULL);
+- if (status) {
+- i40e_debug(hw, I40E_DEBUG_PACKAGE,
+- "Failed to write profile: offset %d, info %d",
+- offset, info);
+- break;
+- }
+- }
+- return status;
+-}
+-
+-/**
+- * i40evf_add_pinfo_to_list
+- * @hw: pointer to the hardware structure
+- * @profile: pointer to the profile segment of the package
+- * @profile_info_sec: buffer for information section
+- * @track_id: package tracking id
+- *
+- * Register a profile to the list of loaded profiles.
+- */
+-enum i40e_status_code
+-i40evf_add_pinfo_to_list(struct i40e_hw *hw,
+- struct i40e_profile_segment *profile,
+- u8 *profile_info_sec, u32 track_id)
+-{
+- i40e_status status = 0;
+- struct i40e_profile_section_header *sec = NULL;
+- struct i40e_profile_info *pinfo;
+- u32 offset = 0, info = 0;
+-
+- sec = (struct i40e_profile_section_header *)profile_info_sec;
+- sec->tbl_size = 1;
+- sec->data_end = sizeof(struct i40e_profile_section_header) +
+- sizeof(struct i40e_profile_info);
+- sec->section.type = SECTION_TYPE_INFO;
+- sec->section.offset = sizeof(struct i40e_profile_section_header);
+- sec->section.size = sizeof(struct i40e_profile_info);
+- pinfo = (struct i40e_profile_info *)(profile_info_sec +
+- sec->section.offset);
+- pinfo->track_id = track_id;
+- pinfo->version = profile->version;
+- pinfo->op = I40E_DDP_ADD_TRACKID;
+- memcpy(pinfo->name, profile->name, I40E_DDP_NAME_SIZE);
+-
+- status = i40evf_aq_write_ddp(hw, (void *)sec, sec->data_end,
+- track_id, &offset, &info, NULL);
+- return status;
+-}
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_devids.h b/drivers/net/ethernet/intel/i40evf/i40e_devids.h
+deleted file mode 100644
+index f300bf271824a..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_devids.h
++++ /dev/null
+@@ -1,34 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_DEVIDS_H_
+-#define _I40E_DEVIDS_H_
+-
+-/* Device IDs */
+-#define I40E_DEV_ID_SFP_XL710 0x1572
+-#define I40E_DEV_ID_QEMU 0x1574
+-#define I40E_DEV_ID_KX_B 0x1580
+-#define I40E_DEV_ID_KX_C 0x1581
+-#define I40E_DEV_ID_QSFP_A 0x1583
+-#define I40E_DEV_ID_QSFP_B 0x1584
+-#define I40E_DEV_ID_QSFP_C 0x1585
+-#define I40E_DEV_ID_10G_BASE_T 0x1586
+-#define I40E_DEV_ID_20G_KR2 0x1587
+-#define I40E_DEV_ID_20G_KR2_A 0x1588
+-#define I40E_DEV_ID_10G_BASE_T4 0x1589
+-#define I40E_DEV_ID_25G_B 0x158A
+-#define I40E_DEV_ID_25G_SFP28 0x158B
+-#define I40E_DEV_ID_VF 0x154C
+-#define I40E_DEV_ID_VF_HV 0x1571
+-#define I40E_DEV_ID_ADAPTIVE_VF 0x1889
+-#define I40E_DEV_ID_SFP_X722 0x37D0
+-#define I40E_DEV_ID_1G_BASE_T_X722 0x37D1
+-#define I40E_DEV_ID_10G_BASE_T_X722 0x37D2
+-#define I40E_DEV_ID_SFP_I_X722 0x37D3
+-#define I40E_DEV_ID_X722_VF 0x37CD
+-
+-#define i40e_is_40G_device(d) ((d) == I40E_DEV_ID_QSFP_A || \
+- (d) == I40E_DEV_ID_QSFP_B || \
+- (d) == I40E_DEV_ID_QSFP_C)
+-
+-#endif /* _I40E_DEVIDS_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_hmc.h b/drivers/net/ethernet/intel/i40evf/i40e_hmc.h
+deleted file mode 100644
+index 1c78de838857b..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_hmc.h
++++ /dev/null
+@@ -1,215 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_HMC_H_
+-#define _I40E_HMC_H_
+-
+-#define I40E_HMC_MAX_BP_COUNT 512
+-
+-/* forward-declare the HW struct for the compiler */
+-struct i40e_hw;
+-
+-#define I40E_HMC_INFO_SIGNATURE 0x484D5347 /* HMSG */
+-#define I40E_HMC_PD_CNT_IN_SD 512
+-#define I40E_HMC_DIRECT_BP_SIZE 0x200000 /* 2M */
+-#define I40E_HMC_PAGED_BP_SIZE 4096
+-#define I40E_HMC_PD_BP_BUF_ALIGNMENT 4096
+-#define I40E_FIRST_VF_FPM_ID 16
+-
+-struct i40e_hmc_obj_info {
+- u64 base; /* base addr in FPM */
+- u32 max_cnt; /* max count available for this hmc func */
+- u32 cnt; /* count of objects driver actually wants to create */
+- u64 size; /* size in bytes of one object */
+-};
+-
+-enum i40e_sd_entry_type {
+- I40E_SD_TYPE_INVALID = 0,
+- I40E_SD_TYPE_PAGED = 1,
+- I40E_SD_TYPE_DIRECT = 2
+-};
+-
+-struct i40e_hmc_bp {
+- enum i40e_sd_entry_type entry_type;
+- struct i40e_dma_mem addr; /* populate to be used by hw */
+- u32 sd_pd_index;
+- u32 ref_cnt;
+-};
+-
+-struct i40e_hmc_pd_entry {
+- struct i40e_hmc_bp bp;
+- u32 sd_index;
+- bool rsrc_pg;
+- bool valid;
+-};
+-
+-struct i40e_hmc_pd_table {
+- struct i40e_dma_mem pd_page_addr; /* populate to be used by hw */
+- struct i40e_hmc_pd_entry *pd_entry; /* [512] for sw book keeping */
+- struct i40e_virt_mem pd_entry_virt_mem; /* virt mem for pd_entry */
+-
+- u32 ref_cnt;
+- u32 sd_index;
+-};
+-
+-struct i40e_hmc_sd_entry {
+- enum i40e_sd_entry_type entry_type;
+- bool valid;
+-
+- union {
+- struct i40e_hmc_pd_table pd_table;
+- struct i40e_hmc_bp bp;
+- } u;
+-};
+-
+-struct i40e_hmc_sd_table {
+- struct i40e_virt_mem addr; /* used to track sd_entry allocations */
+- u32 sd_cnt;
+- u32 ref_cnt;
+- struct i40e_hmc_sd_entry *sd_entry; /* (sd_cnt*512) entries max */
+-};
+-
+-struct i40e_hmc_info {
+- u32 signature;
+- /* equals to pci func num for PF and dynamically allocated for VFs */
+- u8 hmc_fn_id;
+- u16 first_sd_index; /* index of the first available SD */
+-
+- /* hmc objects */
+- struct i40e_hmc_obj_info *hmc_obj;
+- struct i40e_virt_mem hmc_obj_virt_mem;
+- struct i40e_hmc_sd_table sd_table;
+-};
+-
+-#define I40E_INC_SD_REFCNT(sd_table) ((sd_table)->ref_cnt++)
+-#define I40E_INC_PD_REFCNT(pd_table) ((pd_table)->ref_cnt++)
+-#define I40E_INC_BP_REFCNT(bp) ((bp)->ref_cnt++)
+-
+-#define I40E_DEC_SD_REFCNT(sd_table) ((sd_table)->ref_cnt--)
+-#define I40E_DEC_PD_REFCNT(pd_table) ((pd_table)->ref_cnt--)
+-#define I40E_DEC_BP_REFCNT(bp) ((bp)->ref_cnt--)
+-
+-/**
+- * I40E_SET_PF_SD_ENTRY - marks the sd entry as valid in the hardware
+- * @hw: pointer to our hw struct
+- * @pa: pointer to physical address
+- * @sd_index: segment descriptor index
+- * @type: if sd entry is direct or paged
+- **/
+-#define I40E_SET_PF_SD_ENTRY(hw, pa, sd_index, type) \
+-{ \
+- u32 val1, val2, val3; \
+- val1 = (u32)(upper_32_bits(pa)); \
+- val2 = (u32)(pa) | (I40E_HMC_MAX_BP_COUNT << \
+- I40E_PFHMC_SDDATALOW_PMSDBPCOUNT_SHIFT) | \
+- ((((type) == I40E_SD_TYPE_PAGED) ? 0 : 1) << \
+- I40E_PFHMC_SDDATALOW_PMSDTYPE_SHIFT) | \
+- BIT(I40E_PFHMC_SDDATALOW_PMSDVALID_SHIFT); \
+- val3 = (sd_index) | BIT_ULL(I40E_PFHMC_SDCMD_PMSDWR_SHIFT); \
+- wr32((hw), I40E_PFHMC_SDDATAHIGH, val1); \
+- wr32((hw), I40E_PFHMC_SDDATALOW, val2); \
+- wr32((hw), I40E_PFHMC_SDCMD, val3); \
+-}
+-
+-/**
+- * I40E_CLEAR_PF_SD_ENTRY - marks the sd entry as invalid in the hardware
+- * @hw: pointer to our hw struct
+- * @sd_index: segment descriptor index
+- * @type: if sd entry is direct or paged
+- **/
+-#define I40E_CLEAR_PF_SD_ENTRY(hw, sd_index, type) \
+-{ \
+- u32 val2, val3; \
+- val2 = (I40E_HMC_MAX_BP_COUNT << \
+- I40E_PFHMC_SDDATALOW_PMSDBPCOUNT_SHIFT) | \
+- ((((type) == I40E_SD_TYPE_PAGED) ? 0 : 1) << \
+- I40E_PFHMC_SDDATALOW_PMSDTYPE_SHIFT); \
+- val3 = (sd_index) | BIT_ULL(I40E_PFHMC_SDCMD_PMSDWR_SHIFT); \
+- wr32((hw), I40E_PFHMC_SDDATAHIGH, 0); \
+- wr32((hw), I40E_PFHMC_SDDATALOW, val2); \
+- wr32((hw), I40E_PFHMC_SDCMD, val3); \
+-}
+-
+-/**
+- * I40E_INVALIDATE_PF_HMC_PD - Invalidates the pd cache in the hardware
+- * @hw: pointer to our hw struct
+- * @sd_idx: segment descriptor index
+- * @pd_idx: page descriptor index
+- **/
+-#define I40E_INVALIDATE_PF_HMC_PD(hw, sd_idx, pd_idx) \
+- wr32((hw), I40E_PFHMC_PDINV, \
+- (((sd_idx) << I40E_PFHMC_PDINV_PMSDIDX_SHIFT) | \
+- ((pd_idx) << I40E_PFHMC_PDINV_PMPDIDX_SHIFT)))
+-
+-/**
+- * I40E_FIND_SD_INDEX_LIMIT - finds segment descriptor index limit
+- * @hmc_info: pointer to the HMC configuration information structure
+- * @type: type of HMC resources we're searching
+- * @index: starting index for the object
+- * @cnt: number of objects we're trying to create
+- * @sd_idx: pointer to return index of the segment descriptor in question
+- * @sd_limit: pointer to return the maximum number of segment descriptors
+- *
+- * This function calculates the segment descriptor index and index limit
+- * for the resource defined by i40e_hmc_rsrc_type.
+- **/
+-#define I40E_FIND_SD_INDEX_LIMIT(hmc_info, type, index, cnt, sd_idx, sd_limit)\
+-{ \
+- u64 fpm_addr, fpm_limit; \
+- fpm_addr = (hmc_info)->hmc_obj[(type)].base + \
+- (hmc_info)->hmc_obj[(type)].size * (index); \
+- fpm_limit = fpm_addr + (hmc_info)->hmc_obj[(type)].size * (cnt);\
+- *(sd_idx) = (u32)(fpm_addr / I40E_HMC_DIRECT_BP_SIZE); \
+- *(sd_limit) = (u32)((fpm_limit - 1) / I40E_HMC_DIRECT_BP_SIZE); \
+- /* add one more to the limit to correct our range */ \
+- *(sd_limit) += 1; \
+-}
+-
+-/**
+- * I40E_FIND_PD_INDEX_LIMIT - finds page descriptor index limit
+- * @hmc_info: pointer to the HMC configuration information struct
+- * @type: HMC resource type we're examining
+- * @idx: starting index for the object
+- * @cnt: number of objects we're trying to create
+- * @pd_index: pointer to return page descriptor index
+- * @pd_limit: pointer to return page descriptor index limit
+- *
+- * Calculates the page descriptor index and index limit for the resource
+- * defined by i40e_hmc_rsrc_type.
+- **/
+-#define I40E_FIND_PD_INDEX_LIMIT(hmc_info, type, idx, cnt, pd_index, pd_limit)\
+-{ \
+- u64 fpm_adr, fpm_limit; \
+- fpm_adr = (hmc_info)->hmc_obj[(type)].base + \
+- (hmc_info)->hmc_obj[(type)].size * (idx); \
+- fpm_limit = fpm_adr + (hmc_info)->hmc_obj[(type)].size * (cnt); \
+- *(pd_index) = (u32)(fpm_adr / I40E_HMC_PAGED_BP_SIZE); \
+- *(pd_limit) = (u32)((fpm_limit - 1) / I40E_HMC_PAGED_BP_SIZE); \
+- /* add one more to the limit to correct our range */ \
+- *(pd_limit) += 1; \
+-}
+-i40e_status i40e_add_sd_table_entry(struct i40e_hw *hw,
+- struct i40e_hmc_info *hmc_info,
+- u32 sd_index,
+- enum i40e_sd_entry_type type,
+- u64 direct_mode_sz);
+-
+-i40e_status i40e_add_pd_table_entry(struct i40e_hw *hw,
+- struct i40e_hmc_info *hmc_info,
+- u32 pd_index,
+- struct i40e_dma_mem *rsrc_pg);
+-i40e_status i40e_remove_pd_bp(struct i40e_hw *hw,
+- struct i40e_hmc_info *hmc_info,
+- u32 idx);
+-i40e_status i40e_prep_remove_sd_bp(struct i40e_hmc_info *hmc_info,
+- u32 idx);
+-i40e_status i40e_remove_sd_bp_new(struct i40e_hw *hw,
+- struct i40e_hmc_info *hmc_info,
+- u32 idx, bool is_pf);
+-i40e_status i40e_prep_remove_pd_page(struct i40e_hmc_info *hmc_info,
+- u32 idx);
+-i40e_status i40e_remove_pd_page_new(struct i40e_hw *hw,
+- struct i40e_hmc_info *hmc_info,
+- u32 idx, bool is_pf);
+-
+-#endif /* _I40E_HMC_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_lan_hmc.h b/drivers/net/ethernet/intel/i40evf/i40e_lan_hmc.h
+deleted file mode 100644
+index 82b00f70a6320..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_lan_hmc.h
++++ /dev/null
+@@ -1,158 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_LAN_HMC_H_
+-#define _I40E_LAN_HMC_H_
+-
+-/* forward-declare the HW struct for the compiler */
+-struct i40e_hw;
+-
+-/* HMC element context information */
+-
+-/* Rx queue context data
+- *
+- * The sizes of the variables may be larger than needed due to crossing byte
+- * boundaries. If we do not have the width of the variable set to the correct
+- * size then we could end up shifting bits off the top of the variable when the
+- * variable is at the top of a byte and crosses over into the next byte.
+- */
+-struct i40e_hmc_obj_rxq {
+- u16 head;
+- u16 cpuid; /* bigger than needed, see above for reason */
+- u64 base;
+- u16 qlen;
+-#define I40E_RXQ_CTX_DBUFF_SHIFT 7
+- u16 dbuff; /* bigger than needed, see above for reason */
+-#define I40E_RXQ_CTX_HBUFF_SHIFT 6
+- u16 hbuff; /* bigger than needed, see above for reason */
+- u8 dtype;
+- u8 dsize;
+- u8 crcstrip;
+- u8 fc_ena;
+- u8 l2tsel;
+- u8 hsplit_0;
+- u8 hsplit_1;
+- u8 showiv;
+- u32 rxmax; /* bigger than needed, see above for reason */
+- u8 tphrdesc_ena;
+- u8 tphwdesc_ena;
+- u8 tphdata_ena;
+- u8 tphhead_ena;
+- u16 lrxqthresh; /* bigger than needed, see above for reason */
+- u8 prefena; /* NOTE: normally must be set to 1 at init */
+-};
+-
+-/* Tx queue context data
+-*
+-* The sizes of the variables may be larger than needed due to crossing byte
+-* boundaries. If we do not have the width of the variable set to the correct
+-* size then we could end up shifting bits off the top of the variable when the
+-* variable is at the top of a byte and crosses over into the next byte.
+-*/
+-struct i40e_hmc_obj_txq {
+- u16 head;
+- u8 new_context;
+- u64 base;
+- u8 fc_ena;
+- u8 timesync_ena;
+- u8 fd_ena;
+- u8 alt_vlan_ena;
+- u16 thead_wb;
+- u8 cpuid;
+- u8 head_wb_ena;
+- u16 qlen;
+- u8 tphrdesc_ena;
+- u8 tphrpacket_ena;
+- u8 tphwdesc_ena;
+- u64 head_wb_addr;
+- u32 crc;
+- u16 rdylist;
+- u8 rdylist_act;
+-};
+-
+-/* for hsplit_0 field of Rx HMC context */
+-enum i40e_hmc_obj_rx_hsplit_0 {
+- I40E_HMC_OBJ_RX_HSPLIT_0_NO_SPLIT = 0,
+- I40E_HMC_OBJ_RX_HSPLIT_0_SPLIT_L2 = 1,
+- I40E_HMC_OBJ_RX_HSPLIT_0_SPLIT_IP = 2,
+- I40E_HMC_OBJ_RX_HSPLIT_0_SPLIT_TCP_UDP = 4,
+- I40E_HMC_OBJ_RX_HSPLIT_0_SPLIT_SCTP = 8,
+-};
+-
+-/* fcoe_cntx and fcoe_filt are for debugging purpose only */
+-struct i40e_hmc_obj_fcoe_cntx {
+- u32 rsv[32];
+-};
+-
+-struct i40e_hmc_obj_fcoe_filt {
+- u32 rsv[8];
+-};
+-
+-/* Context sizes for LAN objects */
+-enum i40e_hmc_lan_object_size {
+- I40E_HMC_LAN_OBJ_SZ_8 = 0x3,
+- I40E_HMC_LAN_OBJ_SZ_16 = 0x4,
+- I40E_HMC_LAN_OBJ_SZ_32 = 0x5,
+- I40E_HMC_LAN_OBJ_SZ_64 = 0x6,
+- I40E_HMC_LAN_OBJ_SZ_128 = 0x7,
+- I40E_HMC_LAN_OBJ_SZ_256 = 0x8,
+- I40E_HMC_LAN_OBJ_SZ_512 = 0x9,
+-};
+-
+-#define I40E_HMC_L2OBJ_BASE_ALIGNMENT 512
+-#define I40E_HMC_OBJ_SIZE_TXQ 128
+-#define I40E_HMC_OBJ_SIZE_RXQ 32
+-#define I40E_HMC_OBJ_SIZE_FCOE_CNTX 128
+-#define I40E_HMC_OBJ_SIZE_FCOE_FILT 64
+-
+-enum i40e_hmc_lan_rsrc_type {
+- I40E_HMC_LAN_FULL = 0,
+- I40E_HMC_LAN_TX = 1,
+- I40E_HMC_LAN_RX = 2,
+- I40E_HMC_FCOE_CTX = 3,
+- I40E_HMC_FCOE_FILT = 4,
+- I40E_HMC_LAN_MAX = 5
+-};
+-
+-enum i40e_hmc_model {
+- I40E_HMC_MODEL_DIRECT_PREFERRED = 0,
+- I40E_HMC_MODEL_DIRECT_ONLY = 1,
+- I40E_HMC_MODEL_PAGED_ONLY = 2,
+- I40E_HMC_MODEL_UNKNOWN,
+-};
+-
+-struct i40e_hmc_lan_create_obj_info {
+- struct i40e_hmc_info *hmc_info;
+- u32 rsrc_type;
+- u32 start_idx;
+- u32 count;
+- enum i40e_sd_entry_type entry_type;
+- u64 direct_mode_sz;
+-};
+-
+-struct i40e_hmc_lan_delete_obj_info {
+- struct i40e_hmc_info *hmc_info;
+- u32 rsrc_type;
+- u32 start_idx;
+- u32 count;
+-};
+-
+-i40e_status i40e_init_lan_hmc(struct i40e_hw *hw, u32 txq_num,
+- u32 rxq_num, u32 fcoe_cntx_num,
+- u32 fcoe_filt_num);
+-i40e_status i40e_configure_lan_hmc(struct i40e_hw *hw,
+- enum i40e_hmc_model model);
+-i40e_status i40e_shutdown_lan_hmc(struct i40e_hw *hw);
+-
+-i40e_status i40e_clear_lan_tx_queue_context(struct i40e_hw *hw,
+- u16 queue);
+-i40e_status i40e_set_lan_tx_queue_context(struct i40e_hw *hw,
+- u16 queue,
+- struct i40e_hmc_obj_txq *s);
+-i40e_status i40e_clear_lan_rx_queue_context(struct i40e_hw *hw,
+- u16 queue);
+-i40e_status i40e_set_lan_rx_queue_context(struct i40e_hw *hw,
+- u16 queue,
+- struct i40e_hmc_obj_rxq *s);
+-
+-#endif /* _I40E_LAN_HMC_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_osdep.h b/drivers/net/ethernet/intel/i40evf/i40e_osdep.h
+deleted file mode 100644
+index 3ddddb46455b2..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_osdep.h
++++ /dev/null
+@@ -1,52 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_OSDEP_H_
+-#define _I40E_OSDEP_H_
+-
+-#include <linux/types.h>
+-#include <linux/if_ether.h>
+-#include <linux/if_vlan.h>
+-#include <linux/tcp.h>
+-#include <linux/pci.h>
+-
+-/* get readq/writeq support for 32 bit kernels, use the low-first version */
+-#include <linux/io-64-nonatomic-lo-hi.h>
+-
+-/* File to be the magic between shared code and
+- * actual OS primitives
+- */
+-
+-#define hw_dbg(hw, S, A...) do {} while (0)
+-
+-#define wr32(a, reg, value) writel((value), ((a)->hw_addr + (reg)))
+-#define rd32(a, reg) readl((a)->hw_addr + (reg))
+-
+-#define wr64(a, reg, value) writeq((value), ((a)->hw_addr + (reg)))
+-#define rd64(a, reg) readq((a)->hw_addr + (reg))
+-#define i40e_flush(a) readl((a)->hw_addr + I40E_VFGEN_RSTAT)
+-
+-/* memory allocation tracking */
+-struct i40e_dma_mem {
+- void *va;
+- dma_addr_t pa;
+- u32 size;
+-};
+-
+-#define i40e_allocate_dma_mem(h, m, unused, s, a) \
+- i40evf_allocate_dma_mem_d(h, m, s, a)
+-#define i40e_free_dma_mem(h, m) i40evf_free_dma_mem_d(h, m)
+-
+-struct i40e_virt_mem {
+- void *va;
+- u32 size;
+-};
+-#define i40e_allocate_virt_mem(h, m, s) i40evf_allocate_virt_mem_d(h, m, s)
+-#define i40e_free_virt_mem(h, m) i40evf_free_virt_mem_d(h, m)
+-
+-#define i40e_debug(h, m, s, ...) i40evf_debug_d(h, m, s, ##__VA_ARGS__)
+-extern void i40evf_debug_d(void *hw, u32 mask, char *fmt_str, ...)
+- __attribute__ ((format(gnu_printf, 3, 4)));
+-
+-typedef enum i40e_status_code i40e_status;
+-#endif /* _I40E_OSDEP_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_prototype.h b/drivers/net/ethernet/intel/i40evf/i40e_prototype.h
+deleted file mode 100644
+index a358f4b9d5aa6..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_prototype.h
++++ /dev/null
+@@ -1,130 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_PROTOTYPE_H_
+-#define _I40E_PROTOTYPE_H_
+-
+-#include "i40e_type.h"
+-#include "i40e_alloc.h"
+-#include <linux/avf/virtchnl.h>
+-
+-/* Prototypes for shared code functions that are not in
+- * the standard function pointer structures. These are
+- * mostly because they are needed even before the init
+- * has happened and will assist in the early SW and FW
+- * setup.
+- */
+-
+-/* adminq functions */
+-i40e_status i40evf_init_adminq(struct i40e_hw *hw);
+-i40e_status i40evf_shutdown_adminq(struct i40e_hw *hw);
+-void i40e_adminq_init_ring_data(struct i40e_hw *hw);
+-i40e_status i40evf_clean_arq_element(struct i40e_hw *hw,
+- struct i40e_arq_event_info *e,
+- u16 *events_pending);
+-i40e_status i40evf_asq_send_command(struct i40e_hw *hw,
+- struct i40e_aq_desc *desc,
+- void *buff, /* can be NULL */
+- u16 buff_size,
+- struct i40e_asq_cmd_details *cmd_details);
+-bool i40evf_asq_done(struct i40e_hw *hw);
+-
+-/* debug function for adminq */
+-void i40evf_debug_aq(struct i40e_hw *hw, enum i40e_debug_mask mask,
+- void *desc, void *buffer, u16 buf_len);
+-
+-void i40e_idle_aq(struct i40e_hw *hw);
+-void i40evf_resume_aq(struct i40e_hw *hw);
+-bool i40evf_check_asq_alive(struct i40e_hw *hw);
+-i40e_status i40evf_aq_queue_shutdown(struct i40e_hw *hw, bool unloading);
+-const char *i40evf_aq_str(struct i40e_hw *hw, enum i40e_admin_queue_err aq_err);
+-const char *i40evf_stat_str(struct i40e_hw *hw, i40e_status stat_err);
+-
+-i40e_status i40evf_aq_get_rss_lut(struct i40e_hw *hw, u16 seid,
+- bool pf_lut, u8 *lut, u16 lut_size);
+-i40e_status i40evf_aq_set_rss_lut(struct i40e_hw *hw, u16 seid,
+- bool pf_lut, u8 *lut, u16 lut_size);
+-i40e_status i40evf_aq_get_rss_key(struct i40e_hw *hw,
+- u16 seid,
+- struct i40e_aqc_get_set_rss_key_data *key);
+-i40e_status i40evf_aq_set_rss_key(struct i40e_hw *hw,
+- u16 seid,
+- struct i40e_aqc_get_set_rss_key_data *key);
+-
+-i40e_status i40e_set_mac_type(struct i40e_hw *hw);
+-
+-extern struct i40e_rx_ptype_decoded i40evf_ptype_lookup[];
+-
+-static inline struct i40e_rx_ptype_decoded decode_rx_desc_ptype(u8 ptype)
+-{
+- return i40evf_ptype_lookup[ptype];
+-}
+-
+-/* prototype for functions used for SW locks */
+-
+-/* i40e_common for VF drivers*/
+-void i40e_vf_parse_hw_config(struct i40e_hw *hw,
+- struct virtchnl_vf_resource *msg);
+-i40e_status i40e_vf_reset(struct i40e_hw *hw);
+-i40e_status i40e_aq_send_msg_to_pf(struct i40e_hw *hw,
+- enum virtchnl_ops v_opcode,
+- i40e_status v_retval,
+- u8 *msg, u16 msglen,
+- struct i40e_asq_cmd_details *cmd_details);
+-i40e_status i40e_set_filter_control(struct i40e_hw *hw,
+- struct i40e_filter_control_settings *settings);
+-i40e_status i40e_aq_add_rem_control_packet_filter(struct i40e_hw *hw,
+- u8 *mac_addr, u16 ethtype, u16 flags,
+- u16 vsi_seid, u16 queue, bool is_add,
+- struct i40e_control_filter_stats *stats,
+- struct i40e_asq_cmd_details *cmd_details);
+-void i40e_add_filter_to_drop_tx_flow_control_frames(struct i40e_hw *hw,
+- u16 vsi_seid);
+-i40e_status i40evf_aq_rx_ctl_read_register(struct i40e_hw *hw,
+- u32 reg_addr, u32 *reg_val,
+- struct i40e_asq_cmd_details *cmd_details);
+-u32 i40evf_read_rx_ctl(struct i40e_hw *hw, u32 reg_addr);
+-i40e_status i40evf_aq_rx_ctl_write_register(struct i40e_hw *hw,
+- u32 reg_addr, u32 reg_val,
+- struct i40e_asq_cmd_details *cmd_details);
+-void i40evf_write_rx_ctl(struct i40e_hw *hw, u32 reg_addr, u32 reg_val);
+-i40e_status i40e_aq_set_phy_register(struct i40e_hw *hw,
+- u8 phy_select, u8 dev_addr,
+- u32 reg_addr, u32 reg_val,
+- struct i40e_asq_cmd_details *cmd_details);
+-i40e_status i40e_aq_get_phy_register(struct i40e_hw *hw,
+- u8 phy_select, u8 dev_addr,
+- u32 reg_addr, u32 *reg_val,
+- struct i40e_asq_cmd_details *cmd_details);
+-
+-i40e_status i40e_read_phy_register(struct i40e_hw *hw, u8 page,
+- u16 reg, u8 phy_addr, u16 *value);
+-i40e_status i40e_write_phy_register(struct i40e_hw *hw, u8 page,
+- u16 reg, u8 phy_addr, u16 value);
+-i40e_status i40e_read_phy_register(struct i40e_hw *hw, u8 page, u16 reg,
+- u8 phy_addr, u16 *value);
+-i40e_status i40e_write_phy_register(struct i40e_hw *hw, u8 page, u16 reg,
+- u8 phy_addr, u16 value);
+-u8 i40e_get_phy_address(struct i40e_hw *hw, u8 dev_num);
+-i40e_status i40e_blink_phy_link_led(struct i40e_hw *hw,
+- u32 time, u32 interval);
+-i40e_status i40evf_aq_write_ddp(struct i40e_hw *hw, void *buff,
+- u16 buff_size, u32 track_id,
+- u32 *error_offset, u32 *error_info,
+- struct i40e_asq_cmd_details *
+- cmd_details);
+-i40e_status i40evf_aq_get_ddp_list(struct i40e_hw *hw, void *buff,
+- u16 buff_size, u8 flags,
+- struct i40e_asq_cmd_details *
+- cmd_details);
+-struct i40e_generic_seg_header *
+-i40evf_find_segment_in_package(u32 segment_type,
+- struct i40e_package_header *pkg_header);
+-enum i40e_status_code
+-i40evf_write_profile(struct i40e_hw *hw, struct i40e_profile_segment *i40e_seg,
+- u32 track_id);
+-enum i40e_status_code
+-i40evf_add_pinfo_to_list(struct i40e_hw *hw,
+- struct i40e_profile_segment *profile,
+- u8 *profile_info_sec, u32 track_id);
+-#endif /* _I40E_PROTOTYPE_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_register.h b/drivers/net/ethernet/intel/i40evf/i40e_register.h
+deleted file mode 100644
+index 49e1f57d99cc6..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_register.h
++++ /dev/null
+@@ -1,313 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_REGISTER_H_
+-#define _I40E_REGISTER_H_
+-
+-#define I40E_VFMSIX_PBA1(_i) (0x00002000 + ((_i) * 4)) /* _i=0...19 */ /* Reset: VFLR */
+-#define I40E_VFMSIX_PBA1_MAX_INDEX 19
+-#define I40E_VFMSIX_PBA1_PENBIT_SHIFT 0
+-#define I40E_VFMSIX_PBA1_PENBIT_MASK I40E_MASK(0xFFFFFFFF, I40E_VFMSIX_PBA1_PENBIT_SHIFT)
+-#define I40E_VFMSIX_TADD1(_i) (0x00002100 + ((_i) * 16)) /* _i=0...639 */ /* Reset: VFLR */
+-#define I40E_VFMSIX_TADD1_MAX_INDEX 639
+-#define I40E_VFMSIX_TADD1_MSIXTADD10_SHIFT 0
+-#define I40E_VFMSIX_TADD1_MSIXTADD10_MASK I40E_MASK(0x3, I40E_VFMSIX_TADD1_MSIXTADD10_SHIFT)
+-#define I40E_VFMSIX_TADD1_MSIXTADD_SHIFT 2
+-#define I40E_VFMSIX_TADD1_MSIXTADD_MASK I40E_MASK(0x3FFFFFFF, I40E_VFMSIX_TADD1_MSIXTADD_SHIFT)
+-#define I40E_VFMSIX_TMSG1(_i) (0x00002108 + ((_i) * 16)) /* _i=0...639 */ /* Reset: VFLR */
+-#define I40E_VFMSIX_TMSG1_MAX_INDEX 639
+-#define I40E_VFMSIX_TMSG1_MSIXTMSG_SHIFT 0
+-#define I40E_VFMSIX_TMSG1_MSIXTMSG_MASK I40E_MASK(0xFFFFFFFF, I40E_VFMSIX_TMSG1_MSIXTMSG_SHIFT)
+-#define I40E_VFMSIX_TUADD1(_i) (0x00002104 + ((_i) * 16)) /* _i=0...639 */ /* Reset: VFLR */
+-#define I40E_VFMSIX_TUADD1_MAX_INDEX 639
+-#define I40E_VFMSIX_TUADD1_MSIXTUADD_SHIFT 0
+-#define I40E_VFMSIX_TUADD1_MSIXTUADD_MASK I40E_MASK(0xFFFFFFFF, I40E_VFMSIX_TUADD1_MSIXTUADD_SHIFT)
+-#define I40E_VFMSIX_TVCTRL1(_i) (0x0000210C + ((_i) * 16)) /* _i=0...639 */ /* Reset: VFLR */
+-#define I40E_VFMSIX_TVCTRL1_MAX_INDEX 639
+-#define I40E_VFMSIX_TVCTRL1_MASK_SHIFT 0
+-#define I40E_VFMSIX_TVCTRL1_MASK_MASK I40E_MASK(0x1, I40E_VFMSIX_TVCTRL1_MASK_SHIFT)
+-#define I40E_VF_ARQBAH1 0x00006000 /* Reset: EMPR */
+-#define I40E_VF_ARQBAH1_ARQBAH_SHIFT 0
+-#define I40E_VF_ARQBAH1_ARQBAH_MASK I40E_MASK(0xFFFFFFFF, I40E_VF_ARQBAH1_ARQBAH_SHIFT)
+-#define I40E_VF_ARQBAL1 0x00006C00 /* Reset: EMPR */
+-#define I40E_VF_ARQBAL1_ARQBAL_SHIFT 0
+-#define I40E_VF_ARQBAL1_ARQBAL_MASK I40E_MASK(0xFFFFFFFF, I40E_VF_ARQBAL1_ARQBAL_SHIFT)
+-#define I40E_VF_ARQH1 0x00007400 /* Reset: EMPR */
+-#define I40E_VF_ARQH1_ARQH_SHIFT 0
+-#define I40E_VF_ARQH1_ARQH_MASK I40E_MASK(0x3FF, I40E_VF_ARQH1_ARQH_SHIFT)
+-#define I40E_VF_ARQLEN1 0x00008000 /* Reset: EMPR */
+-#define I40E_VF_ARQLEN1_ARQLEN_SHIFT 0
+-#define I40E_VF_ARQLEN1_ARQLEN_MASK I40E_MASK(0x3FF, I40E_VF_ARQLEN1_ARQLEN_SHIFT)
+-#define I40E_VF_ARQLEN1_ARQVFE_SHIFT 28
+-#define I40E_VF_ARQLEN1_ARQVFE_MASK I40E_MASK(0x1, I40E_VF_ARQLEN1_ARQVFE_SHIFT)
+-#define I40E_VF_ARQLEN1_ARQOVFL_SHIFT 29
+-#define I40E_VF_ARQLEN1_ARQOVFL_MASK I40E_MASK(0x1, I40E_VF_ARQLEN1_ARQOVFL_SHIFT)
+-#define I40E_VF_ARQLEN1_ARQCRIT_SHIFT 30
+-#define I40E_VF_ARQLEN1_ARQCRIT_MASK I40E_MASK(0x1, I40E_VF_ARQLEN1_ARQCRIT_SHIFT)
+-#define I40E_VF_ARQLEN1_ARQENABLE_SHIFT 31
+-#define I40E_VF_ARQLEN1_ARQENABLE_MASK I40E_MASK(0x1, I40E_VF_ARQLEN1_ARQENABLE_SHIFT)
+-#define I40E_VF_ARQT1 0x00007000 /* Reset: EMPR */
+-#define I40E_VF_ARQT1_ARQT_SHIFT 0
+-#define I40E_VF_ARQT1_ARQT_MASK I40E_MASK(0x3FF, I40E_VF_ARQT1_ARQT_SHIFT)
+-#define I40E_VF_ATQBAH1 0x00007800 /* Reset: EMPR */
+-#define I40E_VF_ATQBAH1_ATQBAH_SHIFT 0
+-#define I40E_VF_ATQBAH1_ATQBAH_MASK I40E_MASK(0xFFFFFFFF, I40E_VF_ATQBAH1_ATQBAH_SHIFT)
+-#define I40E_VF_ATQBAL1 0x00007C00 /* Reset: EMPR */
+-#define I40E_VF_ATQBAL1_ATQBAL_SHIFT 0
+-#define I40E_VF_ATQBAL1_ATQBAL_MASK I40E_MASK(0xFFFFFFFF, I40E_VF_ATQBAL1_ATQBAL_SHIFT)
+-#define I40E_VF_ATQH1 0x00006400 /* Reset: EMPR */
+-#define I40E_VF_ATQH1_ATQH_SHIFT 0
+-#define I40E_VF_ATQH1_ATQH_MASK I40E_MASK(0x3FF, I40E_VF_ATQH1_ATQH_SHIFT)
+-#define I40E_VF_ATQLEN1 0x00006800 /* Reset: EMPR */
+-#define I40E_VF_ATQLEN1_ATQLEN_SHIFT 0
+-#define I40E_VF_ATQLEN1_ATQLEN_MASK I40E_MASK(0x3FF, I40E_VF_ATQLEN1_ATQLEN_SHIFT)
+-#define I40E_VF_ATQLEN1_ATQVFE_SHIFT 28
+-#define I40E_VF_ATQLEN1_ATQVFE_MASK I40E_MASK(0x1, I40E_VF_ATQLEN1_ATQVFE_SHIFT)
+-#define I40E_VF_ATQLEN1_ATQOVFL_SHIFT 29
+-#define I40E_VF_ATQLEN1_ATQOVFL_MASK I40E_MASK(0x1, I40E_VF_ATQLEN1_ATQOVFL_SHIFT)
+-#define I40E_VF_ATQLEN1_ATQCRIT_SHIFT 30
+-#define I40E_VF_ATQLEN1_ATQCRIT_MASK I40E_MASK(0x1, I40E_VF_ATQLEN1_ATQCRIT_SHIFT)
+-#define I40E_VF_ATQLEN1_ATQENABLE_SHIFT 31
+-#define I40E_VF_ATQLEN1_ATQENABLE_MASK I40E_MASK(0x1, I40E_VF_ATQLEN1_ATQENABLE_SHIFT)
+-#define I40E_VF_ATQT1 0x00008400 /* Reset: EMPR */
+-#define I40E_VF_ATQT1_ATQT_SHIFT 0
+-#define I40E_VF_ATQT1_ATQT_MASK I40E_MASK(0x3FF, I40E_VF_ATQT1_ATQT_SHIFT)
+-#define I40E_VFGEN_RSTAT 0x00008800 /* Reset: VFR */
+-#define I40E_VFGEN_RSTAT_VFR_STATE_SHIFT 0
+-#define I40E_VFGEN_RSTAT_VFR_STATE_MASK I40E_MASK(0x3, I40E_VFGEN_RSTAT_VFR_STATE_SHIFT)
+-#define I40E_VFINT_DYN_CTL01 0x00005C00 /* Reset: VFR */
+-#define I40E_VFINT_DYN_CTL01_INTENA_SHIFT 0
+-#define I40E_VFINT_DYN_CTL01_INTENA_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTL01_INTENA_SHIFT)
+-#define I40E_VFINT_DYN_CTL01_CLEARPBA_SHIFT 1
+-#define I40E_VFINT_DYN_CTL01_CLEARPBA_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTL01_CLEARPBA_SHIFT)
+-#define I40E_VFINT_DYN_CTL01_SWINT_TRIG_SHIFT 2
+-#define I40E_VFINT_DYN_CTL01_SWINT_TRIG_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTL01_SWINT_TRIG_SHIFT)
+-#define I40E_VFINT_DYN_CTL01_ITR_INDX_SHIFT 3
+-#define I40E_VFINT_DYN_CTL01_ITR_INDX_MASK I40E_MASK(0x3, I40E_VFINT_DYN_CTL01_ITR_INDX_SHIFT)
+-#define I40E_VFINT_DYN_CTL01_INTERVAL_SHIFT 5
+-#define I40E_VFINT_DYN_CTL01_INTERVAL_MASK I40E_MASK(0xFFF, I40E_VFINT_DYN_CTL01_INTERVAL_SHIFT)
+-#define I40E_VFINT_DYN_CTL01_SW_ITR_INDX_ENA_SHIFT 24
+-#define I40E_VFINT_DYN_CTL01_SW_ITR_INDX_ENA_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTL01_SW_ITR_INDX_ENA_SHIFT)
+-#define I40E_VFINT_DYN_CTL01_SW_ITR_INDX_SHIFT 25
+-#define I40E_VFINT_DYN_CTL01_SW_ITR_INDX_MASK I40E_MASK(0x3, I40E_VFINT_DYN_CTL01_SW_ITR_INDX_SHIFT)
+-#define I40E_VFINT_DYN_CTL01_INTENA_MSK_SHIFT 31
+-#define I40E_VFINT_DYN_CTL01_INTENA_MSK_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTL01_INTENA_MSK_SHIFT)
+-#define I40E_VFINT_DYN_CTLN1(_INTVF) (0x00003800 + ((_INTVF) * 4)) /* _i=0...15 */ /* Reset: VFR */
+-#define I40E_VFINT_DYN_CTLN1_MAX_INDEX 15
+-#define I40E_VFINT_DYN_CTLN1_INTENA_SHIFT 0
+-#define I40E_VFINT_DYN_CTLN1_INTENA_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN1_INTENA_SHIFT)
+-#define I40E_VFINT_DYN_CTLN1_CLEARPBA_SHIFT 1
+-#define I40E_VFINT_DYN_CTLN1_CLEARPBA_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN1_CLEARPBA_SHIFT)
+-#define I40E_VFINT_DYN_CTLN1_SWINT_TRIG_SHIFT 2
+-#define I40E_VFINT_DYN_CTLN1_SWINT_TRIG_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN1_SWINT_TRIG_SHIFT)
+-#define I40E_VFINT_DYN_CTLN1_ITR_INDX_SHIFT 3
+-#define I40E_VFINT_DYN_CTLN1_ITR_INDX_MASK I40E_MASK(0x3, I40E_VFINT_DYN_CTLN1_ITR_INDX_SHIFT)
+-#define I40E_VFINT_DYN_CTLN1_INTERVAL_SHIFT 5
+-#define I40E_VFINT_DYN_CTLN1_INTERVAL_MASK I40E_MASK(0xFFF, I40E_VFINT_DYN_CTLN1_INTERVAL_SHIFT)
+-#define I40E_VFINT_DYN_CTLN1_SW_ITR_INDX_ENA_SHIFT 24
+-#define I40E_VFINT_DYN_CTLN1_SW_ITR_INDX_ENA_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN1_SW_ITR_INDX_ENA_SHIFT)
+-#define I40E_VFINT_DYN_CTLN1_SW_ITR_INDX_SHIFT 25
+-#define I40E_VFINT_DYN_CTLN1_SW_ITR_INDX_MASK I40E_MASK(0x3, I40E_VFINT_DYN_CTLN1_SW_ITR_INDX_SHIFT)
+-#define I40E_VFINT_DYN_CTLN1_INTENA_MSK_SHIFT 31
+-#define I40E_VFINT_DYN_CTLN1_INTENA_MSK_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN1_INTENA_MSK_SHIFT)
+-#define I40E_VFINT_ICR0_ENA1 0x00005000 /* Reset: CORER */
+-#define I40E_VFINT_ICR0_ENA1_LINK_STAT_CHANGE_SHIFT 25
+-#define I40E_VFINT_ICR0_ENA1_LINK_STAT_CHANGE_MASK I40E_MASK(0x1, I40E_VFINT_ICR0_ENA1_LINK_STAT_CHANGE_SHIFT)
+-#define I40E_VFINT_ICR0_ENA1_ADMINQ_SHIFT 30
+-#define I40E_VFINT_ICR0_ENA1_ADMINQ_MASK I40E_MASK(0x1, I40E_VFINT_ICR0_ENA1_ADMINQ_SHIFT)
+-#define I40E_VFINT_ICR0_ENA1_RSVD_SHIFT 31
+-#define I40E_VFINT_ICR0_ENA1_RSVD_MASK I40E_MASK(0x1, I40E_VFINT_ICR0_ENA1_RSVD_SHIFT)
+-#define I40E_VFINT_ICR01 0x00004800 /* Reset: CORER */
+-#define I40E_VFINT_ICR01_INTEVENT_SHIFT 0
+-#define I40E_VFINT_ICR01_INTEVENT_MASK I40E_MASK(0x1, I40E_VFINT_ICR01_INTEVENT_SHIFT)
+-#define I40E_VFINT_ICR01_QUEUE_0_SHIFT 1
+-#define I40E_VFINT_ICR01_QUEUE_0_MASK I40E_MASK(0x1, I40E_VFINT_ICR01_QUEUE_0_SHIFT)
+-#define I40E_VFINT_ICR01_QUEUE_1_SHIFT 2
+-#define I40E_VFINT_ICR01_QUEUE_1_MASK I40E_MASK(0x1, I40E_VFINT_ICR01_QUEUE_1_SHIFT)
+-#define I40E_VFINT_ICR01_QUEUE_2_SHIFT 3
+-#define I40E_VFINT_ICR01_QUEUE_2_MASK I40E_MASK(0x1, I40E_VFINT_ICR01_QUEUE_2_SHIFT)
+-#define I40E_VFINT_ICR01_QUEUE_3_SHIFT 4
+-#define I40E_VFINT_ICR01_QUEUE_3_MASK I40E_MASK(0x1, I40E_VFINT_ICR01_QUEUE_3_SHIFT)
+-#define I40E_VFINT_ICR01_LINK_STAT_CHANGE_SHIFT 25
+-#define I40E_VFINT_ICR01_LINK_STAT_CHANGE_MASK I40E_MASK(0x1, I40E_VFINT_ICR01_LINK_STAT_CHANGE_SHIFT)
+-#define I40E_VFINT_ICR01_ADMINQ_SHIFT 30
+-#define I40E_VFINT_ICR01_ADMINQ_MASK I40E_MASK(0x1, I40E_VFINT_ICR01_ADMINQ_SHIFT)
+-#define I40E_VFINT_ICR01_SWINT_SHIFT 31
+-#define I40E_VFINT_ICR01_SWINT_MASK I40E_MASK(0x1, I40E_VFINT_ICR01_SWINT_SHIFT)
+-#define I40E_VFINT_ITR01(_i) (0x00004C00 + ((_i) * 4)) /* _i=0...2 */ /* Reset: VFR */
+-#define I40E_VFINT_ITR01_MAX_INDEX 2
+-#define I40E_VFINT_ITR01_INTERVAL_SHIFT 0
+-#define I40E_VFINT_ITR01_INTERVAL_MASK I40E_MASK(0xFFF, I40E_VFINT_ITR01_INTERVAL_SHIFT)
+-#define I40E_VFINT_ITRN1(_i, _INTVF) (0x00002800 + ((_i) * 64 + (_INTVF) * 4)) /* _i=0...2, _INTVF=0...15 */ /* Reset: VFR */
+-#define I40E_VFINT_ITRN1_MAX_INDEX 2
+-#define I40E_VFINT_ITRN1_INTERVAL_SHIFT 0
+-#define I40E_VFINT_ITRN1_INTERVAL_MASK I40E_MASK(0xFFF, I40E_VFINT_ITRN1_INTERVAL_SHIFT)
+-#define I40E_VFINT_STAT_CTL01 0x00005400 /* Reset: CORER */
+-#define I40E_VFINT_STAT_CTL01_OTHER_ITR_INDX_SHIFT 2
+-#define I40E_VFINT_STAT_CTL01_OTHER_ITR_INDX_MASK I40E_MASK(0x3, I40E_VFINT_STAT_CTL01_OTHER_ITR_INDX_SHIFT)
+-#define I40E_QRX_TAIL1(_Q) (0x00002000 + ((_Q) * 4)) /* _i=0...15 */ /* Reset: CORER */
+-#define I40E_QRX_TAIL1_MAX_INDEX 15
+-#define I40E_QRX_TAIL1_TAIL_SHIFT 0
+-#define I40E_QRX_TAIL1_TAIL_MASK I40E_MASK(0x1FFF, I40E_QRX_TAIL1_TAIL_SHIFT)
+-#define I40E_QTX_TAIL1(_Q) (0x00000000 + ((_Q) * 4)) /* _i=0...15 */ /* Reset: PFR */
+-#define I40E_QTX_TAIL1_MAX_INDEX 15
+-#define I40E_QTX_TAIL1_TAIL_SHIFT 0
+-#define I40E_QTX_TAIL1_TAIL_MASK I40E_MASK(0x1FFF, I40E_QTX_TAIL1_TAIL_SHIFT)
+-#define I40E_VFMSIX_PBA 0x00002000 /* Reset: VFLR */
+-#define I40E_VFMSIX_PBA_PENBIT_SHIFT 0
+-#define I40E_VFMSIX_PBA_PENBIT_MASK I40E_MASK(0xFFFFFFFF, I40E_VFMSIX_PBA_PENBIT_SHIFT)
+-#define I40E_VFMSIX_TADD(_i) (0x00000000 + ((_i) * 16)) /* _i=0...16 */ /* Reset: VFLR */
+-#define I40E_VFMSIX_TADD_MAX_INDEX 16
+-#define I40E_VFMSIX_TADD_MSIXTADD10_SHIFT 0
+-#define I40E_VFMSIX_TADD_MSIXTADD10_MASK I40E_MASK(0x3, I40E_VFMSIX_TADD_MSIXTADD10_SHIFT)
+-#define I40E_VFMSIX_TADD_MSIXTADD_SHIFT 2
+-#define I40E_VFMSIX_TADD_MSIXTADD_MASK I40E_MASK(0x3FFFFFFF, I40E_VFMSIX_TADD_MSIXTADD_SHIFT)
+-#define I40E_VFMSIX_TMSG(_i) (0x00000008 + ((_i) * 16)) /* _i=0...16 */ /* Reset: VFLR */
+-#define I40E_VFMSIX_TMSG_MAX_INDEX 16
+-#define I40E_VFMSIX_TMSG_MSIXTMSG_SHIFT 0
+-#define I40E_VFMSIX_TMSG_MSIXTMSG_MASK I40E_MASK(0xFFFFFFFF, I40E_VFMSIX_TMSG_MSIXTMSG_SHIFT)
+-#define I40E_VFMSIX_TUADD(_i) (0x00000004 + ((_i) * 16)) /* _i=0...16 */ /* Reset: VFLR */
+-#define I40E_VFMSIX_TUADD_MAX_INDEX 16
+-#define I40E_VFMSIX_TUADD_MSIXTUADD_SHIFT 0
+-#define I40E_VFMSIX_TUADD_MSIXTUADD_MASK I40E_MASK(0xFFFFFFFF, I40E_VFMSIX_TUADD_MSIXTUADD_SHIFT)
+-#define I40E_VFMSIX_TVCTRL(_i) (0x0000000C + ((_i) * 16)) /* _i=0...16 */ /* Reset: VFLR */
+-#define I40E_VFMSIX_TVCTRL_MAX_INDEX 16
+-#define I40E_VFMSIX_TVCTRL_MASK_SHIFT 0
+-#define I40E_VFMSIX_TVCTRL_MASK_MASK I40E_MASK(0x1, I40E_VFMSIX_TVCTRL_MASK_SHIFT)
+-#define I40E_VFCM_PE_ERRDATA 0x0000DC00 /* Reset: VFR */
+-#define I40E_VFCM_PE_ERRDATA_ERROR_CODE_SHIFT 0
+-#define I40E_VFCM_PE_ERRDATA_ERROR_CODE_MASK I40E_MASK(0xF, I40E_VFCM_PE_ERRDATA_ERROR_CODE_SHIFT)
+-#define I40E_VFCM_PE_ERRDATA_Q_TYPE_SHIFT 4
+-#define I40E_VFCM_PE_ERRDATA_Q_TYPE_MASK I40E_MASK(0x7, I40E_VFCM_PE_ERRDATA_Q_TYPE_SHIFT)
+-#define I40E_VFCM_PE_ERRDATA_Q_NUM_SHIFT 8
+-#define I40E_VFCM_PE_ERRDATA_Q_NUM_MASK I40E_MASK(0x3FFFF, I40E_VFCM_PE_ERRDATA_Q_NUM_SHIFT)
+-#define I40E_VFCM_PE_ERRINFO 0x0000D800 /* Reset: VFR */
+-#define I40E_VFCM_PE_ERRINFO_ERROR_VALID_SHIFT 0
+-#define I40E_VFCM_PE_ERRINFO_ERROR_VALID_MASK I40E_MASK(0x1, I40E_VFCM_PE_ERRINFO_ERROR_VALID_SHIFT)
+-#define I40E_VFCM_PE_ERRINFO_ERROR_INST_SHIFT 4
+-#define I40E_VFCM_PE_ERRINFO_ERROR_INST_MASK I40E_MASK(0x7, I40E_VFCM_PE_ERRINFO_ERROR_INST_SHIFT)
+-#define I40E_VFCM_PE_ERRINFO_DBL_ERROR_CNT_SHIFT 8
+-#define I40E_VFCM_PE_ERRINFO_DBL_ERROR_CNT_MASK I40E_MASK(0xFF, I40E_VFCM_PE_ERRINFO_DBL_ERROR_CNT_SHIFT)
+-#define I40E_VFCM_PE_ERRINFO_RLU_ERROR_CNT_SHIFT 16
+-#define I40E_VFCM_PE_ERRINFO_RLU_ERROR_CNT_MASK I40E_MASK(0xFF, I40E_VFCM_PE_ERRINFO_RLU_ERROR_CNT_SHIFT)
+-#define I40E_VFCM_PE_ERRINFO_RLS_ERROR_CNT_SHIFT 24
+-#define I40E_VFCM_PE_ERRINFO_RLS_ERROR_CNT_MASK I40E_MASK(0xFF, I40E_VFCM_PE_ERRINFO_RLS_ERROR_CNT_SHIFT)
+-#define I40E_VFQF_HENA(_i) (0x0000C400 + ((_i) * 4)) /* _i=0...1 */ /* Reset: CORER */
+-#define I40E_VFQF_HENA_MAX_INDEX 1
+-#define I40E_VFQF_HENA_PTYPE_ENA_SHIFT 0
+-#define I40E_VFQF_HENA_PTYPE_ENA_MASK I40E_MASK(0xFFFFFFFF, I40E_VFQF_HENA_PTYPE_ENA_SHIFT)
+-#define I40E_VFQF_HKEY(_i) (0x0000CC00 + ((_i) * 4)) /* _i=0...12 */ /* Reset: CORER */
+-#define I40E_VFQF_HKEY_MAX_INDEX 12
+-#define I40E_VFQF_HKEY_KEY_0_SHIFT 0
+-#define I40E_VFQF_HKEY_KEY_0_MASK I40E_MASK(0xFF, I40E_VFQF_HKEY_KEY_0_SHIFT)
+-#define I40E_VFQF_HKEY_KEY_1_SHIFT 8
+-#define I40E_VFQF_HKEY_KEY_1_MASK I40E_MASK(0xFF, I40E_VFQF_HKEY_KEY_1_SHIFT)
+-#define I40E_VFQF_HKEY_KEY_2_SHIFT 16
+-#define I40E_VFQF_HKEY_KEY_2_MASK I40E_MASK(0xFF, I40E_VFQF_HKEY_KEY_2_SHIFT)
+-#define I40E_VFQF_HKEY_KEY_3_SHIFT 24
+-#define I40E_VFQF_HKEY_KEY_3_MASK I40E_MASK(0xFF, I40E_VFQF_HKEY_KEY_3_SHIFT)
+-#define I40E_VFQF_HLUT(_i) (0x0000D000 + ((_i) * 4)) /* _i=0...15 */ /* Reset: CORER */
+-#define I40E_VFQF_HLUT_MAX_INDEX 15
+-#define I40E_VFQF_HLUT_LUT0_SHIFT 0
+-#define I40E_VFQF_HLUT_LUT0_MASK I40E_MASK(0xF, I40E_VFQF_HLUT_LUT0_SHIFT)
+-#define I40E_VFQF_HLUT_LUT1_SHIFT 8
+-#define I40E_VFQF_HLUT_LUT1_MASK I40E_MASK(0xF, I40E_VFQF_HLUT_LUT1_SHIFT)
+-#define I40E_VFQF_HLUT_LUT2_SHIFT 16
+-#define I40E_VFQF_HLUT_LUT2_MASK I40E_MASK(0xF, I40E_VFQF_HLUT_LUT2_SHIFT)
+-#define I40E_VFQF_HLUT_LUT3_SHIFT 24
+-#define I40E_VFQF_HLUT_LUT3_MASK I40E_MASK(0xF, I40E_VFQF_HLUT_LUT3_SHIFT)
+-#define I40E_VFQF_HREGION(_i) (0x0000D400 + ((_i) * 4)) /* _i=0...7 */ /* Reset: CORER */
+-#define I40E_VFQF_HREGION_MAX_INDEX 7
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_0_SHIFT 0
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_0_MASK I40E_MASK(0x1, I40E_VFQF_HREGION_OVERRIDE_ENA_0_SHIFT)
+-#define I40E_VFQF_HREGION_REGION_0_SHIFT 1
+-#define I40E_VFQF_HREGION_REGION_0_MASK I40E_MASK(0x7, I40E_VFQF_HREGION_REGION_0_SHIFT)
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_1_SHIFT 4
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_1_MASK I40E_MASK(0x1, I40E_VFQF_HREGION_OVERRIDE_ENA_1_SHIFT)
+-#define I40E_VFQF_HREGION_REGION_1_SHIFT 5
+-#define I40E_VFQF_HREGION_REGION_1_MASK I40E_MASK(0x7, I40E_VFQF_HREGION_REGION_1_SHIFT)
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_2_SHIFT 8
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_2_MASK I40E_MASK(0x1, I40E_VFQF_HREGION_OVERRIDE_ENA_2_SHIFT)
+-#define I40E_VFQF_HREGION_REGION_2_SHIFT 9
+-#define I40E_VFQF_HREGION_REGION_2_MASK I40E_MASK(0x7, I40E_VFQF_HREGION_REGION_2_SHIFT)
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_3_SHIFT 12
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_3_MASK I40E_MASK(0x1, I40E_VFQF_HREGION_OVERRIDE_ENA_3_SHIFT)
+-#define I40E_VFQF_HREGION_REGION_3_SHIFT 13
+-#define I40E_VFQF_HREGION_REGION_3_MASK I40E_MASK(0x7, I40E_VFQF_HREGION_REGION_3_SHIFT)
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_4_SHIFT 16
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_4_MASK I40E_MASK(0x1, I40E_VFQF_HREGION_OVERRIDE_ENA_4_SHIFT)
+-#define I40E_VFQF_HREGION_REGION_4_SHIFT 17
+-#define I40E_VFQF_HREGION_REGION_4_MASK I40E_MASK(0x7, I40E_VFQF_HREGION_REGION_4_SHIFT)
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_5_SHIFT 20
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_5_MASK I40E_MASK(0x1, I40E_VFQF_HREGION_OVERRIDE_ENA_5_SHIFT)
+-#define I40E_VFQF_HREGION_REGION_5_SHIFT 21
+-#define I40E_VFQF_HREGION_REGION_5_MASK I40E_MASK(0x7, I40E_VFQF_HREGION_REGION_5_SHIFT)
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_6_SHIFT 24
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_6_MASK I40E_MASK(0x1, I40E_VFQF_HREGION_OVERRIDE_ENA_6_SHIFT)
+-#define I40E_VFQF_HREGION_REGION_6_SHIFT 25
+-#define I40E_VFQF_HREGION_REGION_6_MASK I40E_MASK(0x7, I40E_VFQF_HREGION_REGION_6_SHIFT)
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_7_SHIFT 28
+-#define I40E_VFQF_HREGION_OVERRIDE_ENA_7_MASK I40E_MASK(0x1, I40E_VFQF_HREGION_OVERRIDE_ENA_7_SHIFT)
+-#define I40E_VFQF_HREGION_REGION_7_SHIFT 29
+-#define I40E_VFQF_HREGION_REGION_7_MASK I40E_MASK(0x7, I40E_VFQF_HREGION_REGION_7_SHIFT)
+-#define I40E_VFINT_DYN_CTL01_WB_ON_ITR_SHIFT 30
+-#define I40E_VFINT_DYN_CTL01_WB_ON_ITR_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTL01_WB_ON_ITR_SHIFT)
+-#define I40E_VFINT_DYN_CTLN1_WB_ON_ITR_SHIFT 30
+-#define I40E_VFINT_DYN_CTLN1_WB_ON_ITR_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN1_WB_ON_ITR_SHIFT)
+-#define I40E_VFPE_AEQALLOC1 0x0000A400 /* Reset: VFR */
+-#define I40E_VFPE_AEQALLOC1_AECOUNT_SHIFT 0
+-#define I40E_VFPE_AEQALLOC1_AECOUNT_MASK I40E_MASK(0xFFFFFFFF, I40E_VFPE_AEQALLOC1_AECOUNT_SHIFT)
+-#define I40E_VFPE_CCQPHIGH1 0x00009800 /* Reset: VFR */
+-#define I40E_VFPE_CCQPHIGH1_PECCQPHIGH_SHIFT 0
+-#define I40E_VFPE_CCQPHIGH1_PECCQPHIGH_MASK I40E_MASK(0xFFFFFFFF, I40E_VFPE_CCQPHIGH1_PECCQPHIGH_SHIFT)
+-#define I40E_VFPE_CCQPLOW1 0x0000AC00 /* Reset: VFR */
+-#define I40E_VFPE_CCQPLOW1_PECCQPLOW_SHIFT 0
+-#define I40E_VFPE_CCQPLOW1_PECCQPLOW_MASK I40E_MASK(0xFFFFFFFF, I40E_VFPE_CCQPLOW1_PECCQPLOW_SHIFT)
+-#define I40E_VFPE_CCQPSTATUS1 0x0000B800 /* Reset: VFR */
+-#define I40E_VFPE_CCQPSTATUS1_CCQP_DONE_SHIFT 0
+-#define I40E_VFPE_CCQPSTATUS1_CCQP_DONE_MASK I40E_MASK(0x1, I40E_VFPE_CCQPSTATUS1_CCQP_DONE_SHIFT)
+-#define I40E_VFPE_CCQPSTATUS1_HMC_PROFILE_SHIFT 4
+-#define I40E_VFPE_CCQPSTATUS1_HMC_PROFILE_MASK I40E_MASK(0x7, I40E_VFPE_CCQPSTATUS1_HMC_PROFILE_SHIFT)
+-#define I40E_VFPE_CCQPSTATUS1_RDMA_EN_VFS_SHIFT 16
+-#define I40E_VFPE_CCQPSTATUS1_RDMA_EN_VFS_MASK I40E_MASK(0x3F, I40E_VFPE_CCQPSTATUS1_RDMA_EN_VFS_SHIFT)
+-#define I40E_VFPE_CCQPSTATUS1_CCQP_ERR_SHIFT 31
+-#define I40E_VFPE_CCQPSTATUS1_CCQP_ERR_MASK I40E_MASK(0x1, I40E_VFPE_CCQPSTATUS1_CCQP_ERR_SHIFT)
+-#define I40E_VFPE_CQACK1 0x0000B000 /* Reset: VFR */
+-#define I40E_VFPE_CQACK1_PECQID_SHIFT 0
+-#define I40E_VFPE_CQACK1_PECQID_MASK I40E_MASK(0x1FFFF, I40E_VFPE_CQACK1_PECQID_SHIFT)
+-#define I40E_VFPE_CQARM1 0x0000B400 /* Reset: VFR */
+-#define I40E_VFPE_CQARM1_PECQID_SHIFT 0
+-#define I40E_VFPE_CQARM1_PECQID_MASK I40E_MASK(0x1FFFF, I40E_VFPE_CQARM1_PECQID_SHIFT)
+-#define I40E_VFPE_CQPDB1 0x0000BC00 /* Reset: VFR */
+-#define I40E_VFPE_CQPDB1_WQHEAD_SHIFT 0
+-#define I40E_VFPE_CQPDB1_WQHEAD_MASK I40E_MASK(0x7FF, I40E_VFPE_CQPDB1_WQHEAD_SHIFT)
+-#define I40E_VFPE_CQPERRCODES1 0x00009C00 /* Reset: VFR */
+-#define I40E_VFPE_CQPERRCODES1_CQP_MINOR_CODE_SHIFT 0
+-#define I40E_VFPE_CQPERRCODES1_CQP_MINOR_CODE_MASK I40E_MASK(0xFFFF, I40E_VFPE_CQPERRCODES1_CQP_MINOR_CODE_SHIFT)
+-#define I40E_VFPE_CQPERRCODES1_CQP_MAJOR_CODE_SHIFT 16
+-#define I40E_VFPE_CQPERRCODES1_CQP_MAJOR_CODE_MASK I40E_MASK(0xFFFF, I40E_VFPE_CQPERRCODES1_CQP_MAJOR_CODE_SHIFT)
+-#define I40E_VFPE_CQPTAIL1 0x0000A000 /* Reset: VFR */
+-#define I40E_VFPE_CQPTAIL1_WQTAIL_SHIFT 0
+-#define I40E_VFPE_CQPTAIL1_WQTAIL_MASK I40E_MASK(0x7FF, I40E_VFPE_CQPTAIL1_WQTAIL_SHIFT)
+-#define I40E_VFPE_CQPTAIL1_CQP_OP_ERR_SHIFT 31
+-#define I40E_VFPE_CQPTAIL1_CQP_OP_ERR_MASK I40E_MASK(0x1, I40E_VFPE_CQPTAIL1_CQP_OP_ERR_SHIFT)
+-#define I40E_VFPE_IPCONFIG01 0x00008C00 /* Reset: VFR */
+-#define I40E_VFPE_IPCONFIG01_PEIPID_SHIFT 0
+-#define I40E_VFPE_IPCONFIG01_PEIPID_MASK I40E_MASK(0xFFFF, I40E_VFPE_IPCONFIG01_PEIPID_SHIFT)
+-#define I40E_VFPE_IPCONFIG01_USEENTIREIDRANGE_SHIFT 16
+-#define I40E_VFPE_IPCONFIG01_USEENTIREIDRANGE_MASK I40E_MASK(0x1, I40E_VFPE_IPCONFIG01_USEENTIREIDRANGE_SHIFT)
+-#define I40E_VFPE_MRTEIDXMASK1 0x00009000 /* Reset: VFR */
+-#define I40E_VFPE_MRTEIDXMASK1_MRTEIDXMASKBITS_SHIFT 0
+-#define I40E_VFPE_MRTEIDXMASK1_MRTEIDXMASKBITS_MASK I40E_MASK(0x1F, I40E_VFPE_MRTEIDXMASK1_MRTEIDXMASKBITS_SHIFT)
+-#define I40E_VFPE_RCVUNEXPECTEDERROR1 0x00009400 /* Reset: VFR */
+-#define I40E_VFPE_RCVUNEXPECTEDERROR1_TCP_RX_UNEXP_ERR_SHIFT 0
+-#define I40E_VFPE_RCVUNEXPECTEDERROR1_TCP_RX_UNEXP_ERR_MASK I40E_MASK(0xFFFFFF, I40E_VFPE_RCVUNEXPECTEDERROR1_TCP_RX_UNEXP_ERR_SHIFT)
+-#define I40E_VFPE_TCPNOWTIMER1 0x0000A800 /* Reset: VFR */
+-#define I40E_VFPE_TCPNOWTIMER1_TCP_NOW_SHIFT 0
+-#define I40E_VFPE_TCPNOWTIMER1_TCP_NOW_MASK I40E_MASK(0xFFFFFFFF, I40E_VFPE_TCPNOWTIMER1_TCP_NOW_SHIFT)
+-#define I40E_VFPE_WQEALLOC1 0x0000C000 /* Reset: VFR */
+-#define I40E_VFPE_WQEALLOC1_PEQPID_SHIFT 0
+-#define I40E_VFPE_WQEALLOC1_PEQPID_MASK I40E_MASK(0x3FFFF, I40E_VFPE_WQEALLOC1_PEQPID_SHIFT)
+-#define I40E_VFPE_WQEALLOC1_WQE_DESC_INDEX_SHIFT 20
+-#define I40E_VFPE_WQEALLOC1_WQE_DESC_INDEX_MASK I40E_MASK(0xFFF, I40E_VFPE_WQEALLOC1_WQE_DESC_INDEX_SHIFT)
+-#endif /* _I40E_REGISTER_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_status.h b/drivers/net/ethernet/intel/i40evf/i40e_status.h
+deleted file mode 100644
+index 77be0702d07c8..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_status.h
++++ /dev/null
+@@ -1,78 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_STATUS_H_
+-#define _I40E_STATUS_H_
+-
+-/* Error Codes */
+-enum i40e_status_code {
+- I40E_SUCCESS = 0,
+- I40E_ERR_NVM = -1,
+- I40E_ERR_NVM_CHECKSUM = -2,
+- I40E_ERR_PHY = -3,
+- I40E_ERR_CONFIG = -4,
+- I40E_ERR_PARAM = -5,
+- I40E_ERR_MAC_TYPE = -6,
+- I40E_ERR_UNKNOWN_PHY = -7,
+- I40E_ERR_LINK_SETUP = -8,
+- I40E_ERR_ADAPTER_STOPPED = -9,
+- I40E_ERR_INVALID_MAC_ADDR = -10,
+- I40E_ERR_DEVICE_NOT_SUPPORTED = -11,
+- I40E_ERR_MASTER_REQUESTS_PENDING = -12,
+- I40E_ERR_INVALID_LINK_SETTINGS = -13,
+- I40E_ERR_AUTONEG_NOT_COMPLETE = -14,
+- I40E_ERR_RESET_FAILED = -15,
+- I40E_ERR_SWFW_SYNC = -16,
+- I40E_ERR_NO_AVAILABLE_VSI = -17,
+- I40E_ERR_NO_MEMORY = -18,
+- I40E_ERR_BAD_PTR = -19,
+- I40E_ERR_RING_FULL = -20,
+- I40E_ERR_INVALID_PD_ID = -21,
+- I40E_ERR_INVALID_QP_ID = -22,
+- I40E_ERR_INVALID_CQ_ID = -23,
+- I40E_ERR_INVALID_CEQ_ID = -24,
+- I40E_ERR_INVALID_AEQ_ID = -25,
+- I40E_ERR_INVALID_SIZE = -26,
+- I40E_ERR_INVALID_ARP_INDEX = -27,
+- I40E_ERR_INVALID_FPM_FUNC_ID = -28,
+- I40E_ERR_QP_INVALID_MSG_SIZE = -29,
+- I40E_ERR_QP_TOOMANY_WRS_POSTED = -30,
+- I40E_ERR_INVALID_FRAG_COUNT = -31,
+- I40E_ERR_QUEUE_EMPTY = -32,
+- I40E_ERR_INVALID_ALIGNMENT = -33,
+- I40E_ERR_FLUSHED_QUEUE = -34,
+- I40E_ERR_INVALID_PUSH_PAGE_INDEX = -35,
+- I40E_ERR_INVALID_IMM_DATA_SIZE = -36,
+- I40E_ERR_TIMEOUT = -37,
+- I40E_ERR_OPCODE_MISMATCH = -38,
+- I40E_ERR_CQP_COMPL_ERROR = -39,
+- I40E_ERR_INVALID_VF_ID = -40,
+- I40E_ERR_INVALID_HMCFN_ID = -41,
+- I40E_ERR_BACKING_PAGE_ERROR = -42,
+- I40E_ERR_NO_PBLCHUNKS_AVAILABLE = -43,
+- I40E_ERR_INVALID_PBLE_INDEX = -44,
+- I40E_ERR_INVALID_SD_INDEX = -45,
+- I40E_ERR_INVALID_PAGE_DESC_INDEX = -46,
+- I40E_ERR_INVALID_SD_TYPE = -47,
+- I40E_ERR_MEMCPY_FAILED = -48,
+- I40E_ERR_INVALID_HMC_OBJ_INDEX = -49,
+- I40E_ERR_INVALID_HMC_OBJ_COUNT = -50,
+- I40E_ERR_INVALID_SRQ_ARM_LIMIT = -51,
+- I40E_ERR_SRQ_ENABLED = -52,
+- I40E_ERR_ADMIN_QUEUE_ERROR = -53,
+- I40E_ERR_ADMIN_QUEUE_TIMEOUT = -54,
+- I40E_ERR_BUF_TOO_SHORT = -55,
+- I40E_ERR_ADMIN_QUEUE_FULL = -56,
+- I40E_ERR_ADMIN_QUEUE_NO_WORK = -57,
+- I40E_ERR_BAD_IWARP_CQE = -58,
+- I40E_ERR_NVM_BLANK_MODE = -59,
+- I40E_ERR_NOT_IMPLEMENTED = -60,
+- I40E_ERR_PE_DOORBELL_NOT_ENABLED = -61,
+- I40E_ERR_DIAG_TEST_FAILED = -62,
+- I40E_ERR_NOT_READY = -63,
+- I40E_NOT_SUPPORTED = -64,
+- I40E_ERR_FIRMWARE_API_VERSION = -65,
+- I40E_ERR_ADMIN_QUEUE_CRITICAL_ERROR = -66,
+-};
+-
+-#endif /* _I40E_STATUS_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_trace.h b/drivers/net/ethernet/intel/i40evf/i40e_trace.h
+deleted file mode 100644
+index d7a4e68820a89..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_trace.h
++++ /dev/null
+@@ -1,209 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-/* Modeled on trace-events-sample.h */
+-
+-/* The trace subsystem name for i40evf will be "i40evf".
+- *
+- * This file is named i40e_trace.h.
+- *
+- * Since this include file's name is different from the trace
+- * subsystem name, we'll have to define TRACE_INCLUDE_FILE at the end
+- * of this file.
+- */
+-#undef TRACE_SYSTEM
+-#define TRACE_SYSTEM i40evf
+-
+-/* See trace-events-sample.h for a detailed description of why this
+- * guard clause is different from most normal include files.
+- */
+-#if !defined(_I40E_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ)
+-#define _I40E_TRACE_H_
+-
+-#include <linux/tracepoint.h>
+-
+-/**
+- * i40e_trace() macro enables shared code to refer to trace points
+- * like:
+- *
+- * trace_i40e{,vf}_example(args...)
+- *
+- * ... as:
+- *
+- * i40e_trace(example, args...)
+- *
+- * ... to resolve to the PF or VF version of the tracepoint without
+- * ifdefs, and to allow tracepoints to be disabled entirely at build
+- * time.
+- *
+- * Trace point should always be referred to in the driver via this
+- * macro.
+- *
+- * Similarly, i40e_trace_enabled(trace_name) wraps references to
+- * trace_i40e{,vf}_<trace_name>_enabled() functions.
+- */
+-#define _I40E_TRACE_NAME(trace_name) (trace_ ## i40evf ## _ ## trace_name)
+-#define I40E_TRACE_NAME(trace_name) _I40E_TRACE_NAME(trace_name)
+-
+-#define i40e_trace(trace_name, args...) I40E_TRACE_NAME(trace_name)(args)
+-
+-#define i40e_trace_enabled(trace_name) I40E_TRACE_NAME(trace_name##_enabled)()
+-
+-/* Events common to PF and VF. Corresponding versions will be defined
+- * for both, named trace_i40e_* and trace_i40evf_*. The i40e_trace()
+- * macro above will select the right trace point name for the driver
+- * being built from shared code.
+- */
+-
+-/* Events related to a vsi & ring */
+-DECLARE_EVENT_CLASS(
+- i40evf_tx_template,
+-
+- TP_PROTO(struct i40e_ring *ring,
+- struct i40e_tx_desc *desc,
+- struct i40e_tx_buffer *buf),
+-
+- TP_ARGS(ring, desc, buf),
+-
+- /* The convention here is to make the first fields in the
+- * TP_STRUCT match the TP_PROTO exactly. This enables the use
+- * of the args struct generated by the tplist tool (from the
+- * bcc-tools package) to be used for those fields. To access
+- * fields other than the tracepoint args will require the
+- * tplist output to be adjusted.
+- */
+- TP_STRUCT__entry(
+- __field(void*, ring)
+- __field(void*, desc)
+- __field(void*, buf)
+- __string(devname, ring->netdev->name)
+- ),
+-
+- TP_fast_assign(
+- __entry->ring = ring;
+- __entry->desc = desc;
+- __entry->buf = buf;
+- __assign_str(devname, ring->netdev->name);
+- ),
+-
+- TP_printk(
+- "netdev: %s ring: %p desc: %p buf %p",
+- __get_str(devname), __entry->ring,
+- __entry->desc, __entry->buf)
+-);
+-
+-DEFINE_EVENT(
+- i40evf_tx_template, i40evf_clean_tx_irq,
+- TP_PROTO(struct i40e_ring *ring,
+- struct i40e_tx_desc *desc,
+- struct i40e_tx_buffer *buf),
+-
+- TP_ARGS(ring, desc, buf));
+-
+-DEFINE_EVENT(
+- i40evf_tx_template, i40evf_clean_tx_irq_unmap,
+- TP_PROTO(struct i40e_ring *ring,
+- struct i40e_tx_desc *desc,
+- struct i40e_tx_buffer *buf),
+-
+- TP_ARGS(ring, desc, buf));
+-
+-DECLARE_EVENT_CLASS(
+- i40evf_rx_template,
+-
+- TP_PROTO(struct i40e_ring *ring,
+- union i40e_32byte_rx_desc *desc,
+- struct sk_buff *skb),
+-
+- TP_ARGS(ring, desc, skb),
+-
+- TP_STRUCT__entry(
+- __field(void*, ring)
+- __field(void*, desc)
+- __field(void*, skb)
+- __string(devname, ring->netdev->name)
+- ),
+-
+- TP_fast_assign(
+- __entry->ring = ring;
+- __entry->desc = desc;
+- __entry->skb = skb;
+- __assign_str(devname, ring->netdev->name);
+- ),
+-
+- TP_printk(
+- "netdev: %s ring: %p desc: %p skb %p",
+- __get_str(devname), __entry->ring,
+- __entry->desc, __entry->skb)
+-);
+-
+-DEFINE_EVENT(
+- i40evf_rx_template, i40evf_clean_rx_irq,
+- TP_PROTO(struct i40e_ring *ring,
+- union i40e_32byte_rx_desc *desc,
+- struct sk_buff *skb),
+-
+- TP_ARGS(ring, desc, skb));
+-
+-DEFINE_EVENT(
+- i40evf_rx_template, i40evf_clean_rx_irq_rx,
+- TP_PROTO(struct i40e_ring *ring,
+- union i40e_32byte_rx_desc *desc,
+- struct sk_buff *skb),
+-
+- TP_ARGS(ring, desc, skb));
+-
+-DECLARE_EVENT_CLASS(
+- i40evf_xmit_template,
+-
+- TP_PROTO(struct sk_buff *skb,
+- struct i40e_ring *ring),
+-
+- TP_ARGS(skb, ring),
+-
+- TP_STRUCT__entry(
+- __field(void*, skb)
+- __field(void*, ring)
+- __string(devname, ring->netdev->name)
+- ),
+-
+- TP_fast_assign(
+- __entry->skb = skb;
+- __entry->ring = ring;
+- __assign_str(devname, ring->netdev->name);
+- ),
+-
+- TP_printk(
+- "netdev: %s skb: %p ring: %p",
+- __get_str(devname), __entry->skb,
+- __entry->ring)
+-);
+-
+-DEFINE_EVENT(
+- i40evf_xmit_template, i40evf_xmit_frame_ring,
+- TP_PROTO(struct sk_buff *skb,
+- struct i40e_ring *ring),
+-
+- TP_ARGS(skb, ring));
+-
+-DEFINE_EVENT(
+- i40evf_xmit_template, i40evf_xmit_frame_ring_drop,
+- TP_PROTO(struct sk_buff *skb,
+- struct i40e_ring *ring),
+-
+- TP_ARGS(skb, ring));
+-
+-/* Events unique to the VF. */
+-
+-#endif /* _I40E_TRACE_H_ */
+-/* This must be outside ifdef _I40E_TRACE_H */
+-
+-/* This trace include file is not located in the .../include/trace
+- * with the kernel tracepoint definitions, because we're a loadable
+- * module.
+- */
+-#undef TRACE_INCLUDE_PATH
+-#define TRACE_INCLUDE_PATH .
+-#undef TRACE_INCLUDE_FILE
+-#define TRACE_INCLUDE_FILE i40e_trace
+-#include <trace/define_trace.h>
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+deleted file mode 100644
+index 1bf9734ae9cf0..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
++++ /dev/null
+@@ -1,2513 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#include <linux/prefetch.h>
+-#include <net/busy_poll.h>
+-
+-#include "i40evf.h"
+-#include "i40e_trace.h"
+-#include "i40e_prototype.h"
+-
+-static inline __le64 build_ctob(u32 td_cmd, u32 td_offset, unsigned int size,
+- u32 td_tag)
+-{
+- return cpu_to_le64(I40E_TX_DESC_DTYPE_DATA |
+- ((u64)td_cmd << I40E_TXD_QW1_CMD_SHIFT) |
+- ((u64)td_offset << I40E_TXD_QW1_OFFSET_SHIFT) |
+- ((u64)size << I40E_TXD_QW1_TX_BUF_SZ_SHIFT) |
+- ((u64)td_tag << I40E_TXD_QW1_L2TAG1_SHIFT));
+-}
+-
+-#define I40E_TXD_CMD (I40E_TX_DESC_CMD_EOP | I40E_TX_DESC_CMD_RS)
+-
+-/**
+- * i40e_unmap_and_free_tx_resource - Release a Tx buffer
+- * @ring: the ring that owns the buffer
+- * @tx_buffer: the buffer to free
+- **/
+-static void i40e_unmap_and_free_tx_resource(struct i40e_ring *ring,
+- struct i40e_tx_buffer *tx_buffer)
+-{
+- if (tx_buffer->skb) {
+- if (tx_buffer->tx_flags & I40E_TX_FLAGS_FD_SB)
+- kfree(tx_buffer->raw_buf);
+- else
+- dev_kfree_skb_any(tx_buffer->skb);
+- if (dma_unmap_len(tx_buffer, len))
+- dma_unmap_single(ring->dev,
+- dma_unmap_addr(tx_buffer, dma),
+- dma_unmap_len(tx_buffer, len),
+- DMA_TO_DEVICE);
+- } else if (dma_unmap_len(tx_buffer, len)) {
+- dma_unmap_page(ring->dev,
+- dma_unmap_addr(tx_buffer, dma),
+- dma_unmap_len(tx_buffer, len),
+- DMA_TO_DEVICE);
+- }
+-
+- tx_buffer->next_to_watch = NULL;
+- tx_buffer->skb = NULL;
+- dma_unmap_len_set(tx_buffer, len, 0);
+- /* tx_buffer must be completely set up in the transmit path */
+-}
+-
+-/**
+- * i40evf_clean_tx_ring - Free any empty Tx buffers
+- * @tx_ring: ring to be cleaned
+- **/
+-void i40evf_clean_tx_ring(struct i40e_ring *tx_ring)
+-{
+- unsigned long bi_size;
+- u16 i;
+-
+- /* ring already cleared, nothing to do */
+- if (!tx_ring->tx_bi)
+- return;
+-
+- /* Free all the Tx ring sk_buffs */
+- for (i = 0; i < tx_ring->count; i++)
+- i40e_unmap_and_free_tx_resource(tx_ring, &tx_ring->tx_bi[i]);
+-
+- bi_size = sizeof(struct i40e_tx_buffer) * tx_ring->count;
+- memset(tx_ring->tx_bi, 0, bi_size);
+-
+- /* Zero out the descriptor ring */
+- memset(tx_ring->desc, 0, tx_ring->size);
+-
+- tx_ring->next_to_use = 0;
+- tx_ring->next_to_clean = 0;
+-
+- if (!tx_ring->netdev)
+- return;
+-
+- /* cleanup Tx queue statistics */
+- netdev_tx_reset_queue(txring_txq(tx_ring));
+-}
+-
+-/**
+- * i40evf_free_tx_resources - Free Tx resources per queue
+- * @tx_ring: Tx descriptor ring for a specific queue
+- *
+- * Free all transmit software resources
+- **/
+-void i40evf_free_tx_resources(struct i40e_ring *tx_ring)
+-{
+- i40evf_clean_tx_ring(tx_ring);
+- kfree(tx_ring->tx_bi);
+- tx_ring->tx_bi = NULL;
+-
+- if (tx_ring->desc) {
+- dma_free_coherent(tx_ring->dev, tx_ring->size,
+- tx_ring->desc, tx_ring->dma);
+- tx_ring->desc = NULL;
+- }
+-}
+-
+-/**
+- * i40evf_get_tx_pending - how many Tx descriptors not processed
+- * @ring: the ring of descriptors
+- * @in_sw: is tx_pending being checked in SW or HW
+- *
+- * Since there is no access to the ring head register
+- * in XL710, we need to use our local copies
+- **/
+-u32 i40evf_get_tx_pending(struct i40e_ring *ring, bool in_sw)
+-{
+- u32 head, tail;
+-
+- /* underlying hardware might not allow access and/or always return
+- * 0 for the head/tail registers so just use the cached values
+- */
+- head = ring->next_to_clean;
+- tail = ring->next_to_use;
+-
+- if (head != tail)
+- return (head < tail) ?
+- tail - head : (tail + ring->count - head);
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_detect_recover_hung - Function to detect and recover hung_queues
+- * @vsi: pointer to vsi struct with tx queues
+- *
+- * VSI has netdev and netdev has TX queues. This function is to check each of
+- * those TX queues if they are hung, trigger recovery by issuing SW interrupt.
+- **/
+-void i40evf_detect_recover_hung(struct i40e_vsi *vsi)
+-{
+- struct i40e_ring *tx_ring = NULL;
+- struct net_device *netdev;
+- unsigned int i;
+- int packets;
+-
+- if (!vsi)
+- return;
+-
+- if (test_bit(__I40E_VSI_DOWN, vsi->state))
+- return;
+-
+- netdev = vsi->netdev;
+- if (!netdev)
+- return;
+-
+- if (!netif_carrier_ok(netdev))
+- return;
+-
+- for (i = 0; i < vsi->back->num_active_queues; i++) {
+- tx_ring = &vsi->back->tx_rings[i];
+- if (tx_ring && tx_ring->desc) {
+- /* If packet counter has not changed the queue is
+- * likely stalled, so force an interrupt for this
+- * queue.
+- *
+- * prev_pkt_ctr would be negative if there was no
+- * pending work.
+- */
+- packets = tx_ring->stats.packets & INT_MAX;
+- if (tx_ring->tx_stats.prev_pkt_ctr == packets) {
+- i40evf_force_wb(vsi, tx_ring->q_vector);
+- continue;
+- }
+-
+- /* Memory barrier between read of packet count and call
+- * to i40evf_get_tx_pending()
+- */
+- smp_rmb();
+- tx_ring->tx_stats.prev_pkt_ctr =
+- i40evf_get_tx_pending(tx_ring, true) ? packets : -1;
+- }
+- }
+-}
+-
+-#define WB_STRIDE 4
+-
+-/**
+- * i40e_clean_tx_irq - Reclaim resources after transmit completes
+- * @vsi: the VSI we care about
+- * @tx_ring: Tx ring to clean
+- * @napi_budget: Used to determine if we are in netpoll
+- *
+- * Returns true if there's any budget left (e.g. the clean is finished)
+- **/
+-static bool i40e_clean_tx_irq(struct i40e_vsi *vsi,
+- struct i40e_ring *tx_ring, int napi_budget)
+-{
+- u16 i = tx_ring->next_to_clean;
+- struct i40e_tx_buffer *tx_buf;
+- struct i40e_tx_desc *tx_desc;
+- unsigned int total_bytes = 0, total_packets = 0;
+- unsigned int budget = vsi->work_limit;
+-
+- tx_buf = &tx_ring->tx_bi[i];
+- tx_desc = I40E_TX_DESC(tx_ring, i);
+- i -= tx_ring->count;
+-
+- do {
+- struct i40e_tx_desc *eop_desc = tx_buf->next_to_watch;
+-
+- /* if next_to_watch is not set then there is no work pending */
+- if (!eop_desc)
+- break;
+-
+- /* prevent any other reads prior to eop_desc */
+- smp_rmb();
+-
+- i40e_trace(clean_tx_irq, tx_ring, tx_desc, tx_buf);
+- /* if the descriptor isn't done, no work yet to do */
+- if (!(eop_desc->cmd_type_offset_bsz &
+- cpu_to_le64(I40E_TX_DESC_DTYPE_DESC_DONE)))
+- break;
+-
+- /* clear next_to_watch to prevent false hangs */
+- tx_buf->next_to_watch = NULL;
+-
+- /* update the statistics for this packet */
+- total_bytes += tx_buf->bytecount;
+- total_packets += tx_buf->gso_segs;
+-
+- /* free the skb */
+- napi_consume_skb(tx_buf->skb, napi_budget);
+-
+- /* unmap skb header data */
+- dma_unmap_single(tx_ring->dev,
+- dma_unmap_addr(tx_buf, dma),
+- dma_unmap_len(tx_buf, len),
+- DMA_TO_DEVICE);
+-
+- /* clear tx_buffer data */
+- tx_buf->skb = NULL;
+- dma_unmap_len_set(tx_buf, len, 0);
+-
+- /* unmap remaining buffers */
+- while (tx_desc != eop_desc) {
+- i40e_trace(clean_tx_irq_unmap,
+- tx_ring, tx_desc, tx_buf);
+-
+- tx_buf++;
+- tx_desc++;
+- i++;
+- if (unlikely(!i)) {
+- i -= tx_ring->count;
+- tx_buf = tx_ring->tx_bi;
+- tx_desc = I40E_TX_DESC(tx_ring, 0);
+- }
+-
+- /* unmap any remaining paged data */
+- if (dma_unmap_len(tx_buf, len)) {
+- dma_unmap_page(tx_ring->dev,
+- dma_unmap_addr(tx_buf, dma),
+- dma_unmap_len(tx_buf, len),
+- DMA_TO_DEVICE);
+- dma_unmap_len_set(tx_buf, len, 0);
+- }
+- }
+-
+- /* move us one more past the eop_desc for start of next pkt */
+- tx_buf++;
+- tx_desc++;
+- i++;
+- if (unlikely(!i)) {
+- i -= tx_ring->count;
+- tx_buf = tx_ring->tx_bi;
+- tx_desc = I40E_TX_DESC(tx_ring, 0);
+- }
+-
+- prefetch(tx_desc);
+-
+- /* update budget accounting */
+- budget--;
+- } while (likely(budget));
+-
+- i += tx_ring->count;
+- tx_ring->next_to_clean = i;
+- u64_stats_update_begin(&tx_ring->syncp);
+- tx_ring->stats.bytes += total_bytes;
+- tx_ring->stats.packets += total_packets;
+- u64_stats_update_end(&tx_ring->syncp);
+- tx_ring->q_vector->tx.total_bytes += total_bytes;
+- tx_ring->q_vector->tx.total_packets += total_packets;
+-
+- if (tx_ring->flags & I40E_TXR_FLAGS_WB_ON_ITR) {
+- /* check to see if there are < 4 descriptors
+- * waiting to be written back, then kick the hardware to force
+- * them to be written back in case we stay in NAPI.
+- * In this mode on X722 we do not enable Interrupt.
+- */
+- unsigned int j = i40evf_get_tx_pending(tx_ring, false);
+-
+- if (budget &&
+- ((j / WB_STRIDE) == 0) && (j > 0) &&
+- !test_bit(__I40E_VSI_DOWN, vsi->state) &&
+- (I40E_DESC_UNUSED(tx_ring) != tx_ring->count))
+- tx_ring->arm_wb = true;
+- }
+-
+- /* notify netdev of completed buffers */
+- netdev_tx_completed_queue(txring_txq(tx_ring),
+- total_packets, total_bytes);
+-
+-#define TX_WAKE_THRESHOLD ((s16)(DESC_NEEDED * 2))
+- if (unlikely(total_packets && netif_carrier_ok(tx_ring->netdev) &&
+- (I40E_DESC_UNUSED(tx_ring) >= TX_WAKE_THRESHOLD))) {
+- /* Make sure that anybody stopping the queue after this
+- * sees the new next_to_clean.
+- */
+- smp_mb();
+- if (__netif_subqueue_stopped(tx_ring->netdev,
+- tx_ring->queue_index) &&
+- !test_bit(__I40E_VSI_DOWN, vsi->state)) {
+- netif_wake_subqueue(tx_ring->netdev,
+- tx_ring->queue_index);
+- ++tx_ring->tx_stats.restart_queue;
+- }
+- }
+-
+- return !!budget;
+-}
+-
+-/**
+- * i40evf_enable_wb_on_itr - Arm hardware to do a wb, interrupts are not enabled
+- * @vsi: the VSI we care about
+- * @q_vector: the vector on which to enable writeback
+- *
+- **/
+-static void i40e_enable_wb_on_itr(struct i40e_vsi *vsi,
+- struct i40e_q_vector *q_vector)
+-{
+- u16 flags = q_vector->tx.ring[0].flags;
+- u32 val;
+-
+- if (!(flags & I40E_TXR_FLAGS_WB_ON_ITR))
+- return;
+-
+- if (q_vector->arm_wb_state)
+- return;
+-
+- val = I40E_VFINT_DYN_CTLN1_WB_ON_ITR_MASK |
+- I40E_VFINT_DYN_CTLN1_ITR_INDX_MASK; /* set noitr */
+-
+- wr32(&vsi->back->hw,
+- I40E_VFINT_DYN_CTLN1(q_vector->reg_idx), val);
+- q_vector->arm_wb_state = true;
+-}
+-
+-/**
+- * i40evf_force_wb - Issue SW Interrupt so HW does a wb
+- * @vsi: the VSI we care about
+- * @q_vector: the vector on which to force writeback
+- *
+- **/
+-void i40evf_force_wb(struct i40e_vsi *vsi, struct i40e_q_vector *q_vector)
+-{
+- u32 val = I40E_VFINT_DYN_CTLN1_INTENA_MASK |
+- I40E_VFINT_DYN_CTLN1_ITR_INDX_MASK | /* set noitr */
+- I40E_VFINT_DYN_CTLN1_SWINT_TRIG_MASK |
+- I40E_VFINT_DYN_CTLN1_SW_ITR_INDX_ENA_MASK
+- /* allow 00 to be written to the index */;
+-
+- wr32(&vsi->back->hw,
+- I40E_VFINT_DYN_CTLN1(q_vector->reg_idx),
+- val);
+-}
+-
+-static inline bool i40e_container_is_rx(struct i40e_q_vector *q_vector,
+- struct i40e_ring_container *rc)
+-{
+- return &q_vector->rx == rc;
+-}
+-
+-static inline unsigned int i40e_itr_divisor(struct i40e_q_vector *q_vector)
+-{
+- unsigned int divisor;
+-
+- switch (q_vector->adapter->link_speed) {
+- case I40E_LINK_SPEED_40GB:
+- divisor = I40E_ITR_ADAPTIVE_MIN_INC * 1024;
+- break;
+- case I40E_LINK_SPEED_25GB:
+- case I40E_LINK_SPEED_20GB:
+- divisor = I40E_ITR_ADAPTIVE_MIN_INC * 512;
+- break;
+- default:
+- case I40E_LINK_SPEED_10GB:
+- divisor = I40E_ITR_ADAPTIVE_MIN_INC * 256;
+- break;
+- case I40E_LINK_SPEED_1GB:
+- case I40E_LINK_SPEED_100MB:
+- divisor = I40E_ITR_ADAPTIVE_MIN_INC * 32;
+- break;
+- }
+-
+- return divisor;
+-}
+-
+-/**
+- * i40e_update_itr - update the dynamic ITR value based on statistics
+- * @q_vector: structure containing interrupt and ring information
+- * @rc: structure containing ring performance data
+- *
+- * Stores a new ITR value based on packets and byte
+- * counts during the last interrupt. The advantage of per interrupt
+- * computation is faster updates and more accurate ITR for the current
+- * traffic pattern. Constants in this function were computed
+- * based on theoretical maximum wire speed and thresholds were set based
+- * on testing data as well as attempting to minimize response time
+- * while increasing bulk throughput.
+- **/
+-static void i40e_update_itr(struct i40e_q_vector *q_vector,
+- struct i40e_ring_container *rc)
+-{
+- unsigned int avg_wire_size, packets, bytes, itr;
+- unsigned long next_update = jiffies;
+-
+- /* If we don't have any rings just leave ourselves set for maximum
+- * possible latency so we take ourselves out of the equation.
+- */
+- if (!rc->ring || !ITR_IS_DYNAMIC(rc->ring->itr_setting))
+- return;
+-
+- /* For Rx we want to push the delay up and default to low latency.
+- * for Tx we want to pull the delay down and default to high latency.
+- */
+- itr = i40e_container_is_rx(q_vector, rc) ?
+- I40E_ITR_ADAPTIVE_MIN_USECS | I40E_ITR_ADAPTIVE_LATENCY :
+- I40E_ITR_ADAPTIVE_MAX_USECS | I40E_ITR_ADAPTIVE_LATENCY;
+-
+- /* If we didn't update within up to 1 - 2 jiffies we can assume
+- * that either packets are coming in so slow there hasn't been
+- * any work, or that there is so much work that NAPI is dealing
+- * with interrupt moderation and we don't need to do anything.
+- */
+- if (time_after(next_update, rc->next_update))
+- goto clear_counts;
+-
+- /* If itr_countdown is set it means we programmed an ITR within
+- * the last 4 interrupt cycles. This has a side effect of us
+- * potentially firing an early interrupt. In order to work around
+- * this we need to throw out any data received for a few
+- * interrupts following the update.
+- */
+- if (q_vector->itr_countdown) {
+- itr = rc->target_itr;
+- goto clear_counts;
+- }
+-
+- packets = rc->total_packets;
+- bytes = rc->total_bytes;
+-
+- if (i40e_container_is_rx(q_vector, rc)) {
+- /* If Rx there are 1 to 4 packets and bytes are less than
+- * 9000 assume insufficient data to use bulk rate limiting
+- * approach unless Tx is already in bulk rate limiting. We
+- * are likely latency driven.
+- */
+- if (packets && packets < 4 && bytes < 9000 &&
+- (q_vector->tx.target_itr & I40E_ITR_ADAPTIVE_LATENCY)) {
+- itr = I40E_ITR_ADAPTIVE_LATENCY;
+- goto adjust_by_size;
+- }
+- } else if (packets < 4) {
+- /* If we have Tx and Rx ITR maxed and Tx ITR is running in
+- * bulk mode and we are receiving 4 or fewer packets just
+- * reset the ITR_ADAPTIVE_LATENCY bit for latency mode so
+- * that the Rx can relax.
+- */
+- if (rc->target_itr == I40E_ITR_ADAPTIVE_MAX_USECS &&
+- (q_vector->rx.target_itr & I40E_ITR_MASK) ==
+- I40E_ITR_ADAPTIVE_MAX_USECS)
+- goto clear_counts;
+- } else if (packets > 32) {
+- /* If we have processed over 32 packets in a single interrupt
+- * for Tx assume we need to switch over to "bulk" mode.
+- */
+- rc->target_itr &= ~I40E_ITR_ADAPTIVE_LATENCY;
+- }
+-
+- /* We have no packets to actually measure against. This means
+- * either one of the other queues on this vector is active or
+- * we are a Tx queue doing TSO with too high of an interrupt rate.
+- *
+- * Between 4 and 56 we can assume that our current interrupt delay
+- * is only slightly too low. As such we should increase it by a small
+- * fixed amount.
+- */
+- if (packets < 56) {
+- itr = rc->target_itr + I40E_ITR_ADAPTIVE_MIN_INC;
+- if ((itr & I40E_ITR_MASK) > I40E_ITR_ADAPTIVE_MAX_USECS) {
+- itr &= I40E_ITR_ADAPTIVE_LATENCY;
+- itr += I40E_ITR_ADAPTIVE_MAX_USECS;
+- }
+- goto clear_counts;
+- }
+-
+- if (packets <= 256) {
+- itr = min(q_vector->tx.current_itr, q_vector->rx.current_itr);
+- itr &= I40E_ITR_MASK;
+-
+- /* Between 56 and 112 is our "goldilocks" zone where we are
+- * working out "just right". Just report that our current
+- * ITR is good for us.
+- */
+- if (packets <= 112)
+- goto clear_counts;
+-
+- /* If packet count is 128 or greater we are likely looking
+- * at a slight overrun of the delay we want. Try halving
+- * our delay to see if that will cut the number of packets
+- * in half per interrupt.
+- */
+- itr /= 2;
+- itr &= I40E_ITR_MASK;
+- if (itr < I40E_ITR_ADAPTIVE_MIN_USECS)
+- itr = I40E_ITR_ADAPTIVE_MIN_USECS;
+-
+- goto clear_counts;
+- }
+-
+- /* The paths below assume we are dealing with a bulk ITR since
+- * number of packets is greater than 256. We are just going to have
+- * to compute a value and try to bring the count under control,
+- * though for smaller packet sizes there isn't much we can do as
+- * NAPI polling will likely be kicking in sooner rather than later.
+- */
+- itr = I40E_ITR_ADAPTIVE_BULK;
+-
+-adjust_by_size:
+- /* If packet counts are 256 or greater we can assume we have a gross
+- * overestimation of what the rate should be. Instead of trying to fine
+- * tune it just use the formula below to try and dial in an exact value
+- * give the current packet size of the frame.
+- */
+- avg_wire_size = bytes / packets;
+-
+- /* The following is a crude approximation of:
+- * wmem_default / (size + overhead) = desired_pkts_per_int
+- * rate / bits_per_byte / (size + ethernet overhead) = pkt_rate
+- * (desired_pkt_rate / pkt_rate) * usecs_per_sec = ITR value
+- *
+- * Assuming wmem_default is 212992 and overhead is 640 bytes per
+- * packet, (256 skb, 64 headroom, 320 shared info), we can reduce the
+- * formula down to
+- *
+- * (170 * (size + 24)) / (size + 640) = ITR
+- *
+- * We first do some math on the packet size and then finally bitshift
+- * by 8 after rounding up. We also have to account for PCIe link speed
+- * difference as ITR scales based on this.
+- */
+- if (avg_wire_size <= 60) {
+- /* Start at 250k ints/sec */
+- avg_wire_size = 4096;
+- } else if (avg_wire_size <= 380) {
+- /* 250K ints/sec to 60K ints/sec */
+- avg_wire_size *= 40;
+- avg_wire_size += 1696;
+- } else if (avg_wire_size <= 1084) {
+- /* 60K ints/sec to 36K ints/sec */
+- avg_wire_size *= 15;
+- avg_wire_size += 11452;
+- } else if (avg_wire_size <= 1980) {
+- /* 36K ints/sec to 30K ints/sec */
+- avg_wire_size *= 5;
+- avg_wire_size += 22420;
+- } else {
+- /* plateau at a limit of 30K ints/sec */
+- avg_wire_size = 32256;
+- }
+-
+- /* If we are in low latency mode halve our delay which doubles the
+- * rate to somewhere between 100K to 16K ints/sec
+- */
+- if (itr & I40E_ITR_ADAPTIVE_LATENCY)
+- avg_wire_size /= 2;
+-
+- /* Resultant value is 256 times larger than it needs to be. This
+- * gives us room to adjust the value as needed to either increase
+- * or decrease the value based on link speeds of 10G, 2.5G, 1G, etc.
+- *
+- * Use addition as we have already recorded the new latency flag
+- * for the ITR value.
+- */
+- itr += DIV_ROUND_UP(avg_wire_size, i40e_itr_divisor(q_vector)) *
+- I40E_ITR_ADAPTIVE_MIN_INC;
+-
+- if ((itr & I40E_ITR_MASK) > I40E_ITR_ADAPTIVE_MAX_USECS) {
+- itr &= I40E_ITR_ADAPTIVE_LATENCY;
+- itr += I40E_ITR_ADAPTIVE_MAX_USECS;
+- }
+-
+-clear_counts:
+- /* write back value */
+- rc->target_itr = itr;
+-
+- /* next update should occur within next jiffy */
+- rc->next_update = next_update + 1;
+-
+- rc->total_bytes = 0;
+- rc->total_packets = 0;
+-}
+-
+-/**
+- * i40evf_setup_tx_descriptors - Allocate the Tx descriptors
+- * @tx_ring: the tx ring to set up
+- *
+- * Return 0 on success, negative on error
+- **/
+-int i40evf_setup_tx_descriptors(struct i40e_ring *tx_ring)
+-{
+- struct device *dev = tx_ring->dev;
+- int bi_size;
+-
+- if (!dev)
+- return -ENOMEM;
+-
+- /* warn if we are about to overwrite the pointer */
+- WARN_ON(tx_ring->tx_bi);
+- bi_size = sizeof(struct i40e_tx_buffer) * tx_ring->count;
+- tx_ring->tx_bi = kzalloc(bi_size, GFP_KERNEL);
+- if (!tx_ring->tx_bi)
+- goto err;
+-
+- /* round up to nearest 4K */
+- tx_ring->size = tx_ring->count * sizeof(struct i40e_tx_desc);
+- tx_ring->size = ALIGN(tx_ring->size, 4096);
+- tx_ring->desc = dma_alloc_coherent(dev, tx_ring->size,
+- &tx_ring->dma, GFP_KERNEL);
+- if (!tx_ring->desc) {
+- dev_info(dev, "Unable to allocate memory for the Tx descriptor ring, size=%d\n",
+- tx_ring->size);
+- goto err;
+- }
+-
+- tx_ring->next_to_use = 0;
+- tx_ring->next_to_clean = 0;
+- tx_ring->tx_stats.prev_pkt_ctr = -1;
+- return 0;
+-
+-err:
+- kfree(tx_ring->tx_bi);
+- tx_ring->tx_bi = NULL;
+- return -ENOMEM;
+-}
+-
+-/**
+- * i40evf_clean_rx_ring - Free Rx buffers
+- * @rx_ring: ring to be cleaned
+- **/
+-void i40evf_clean_rx_ring(struct i40e_ring *rx_ring)
+-{
+- unsigned long bi_size;
+- u16 i;
+-
+- /* ring already cleared, nothing to do */
+- if (!rx_ring->rx_bi)
+- return;
+-
+- if (rx_ring->skb) {
+- dev_kfree_skb(rx_ring->skb);
+- rx_ring->skb = NULL;
+- }
+-
+- /* Free all the Rx ring sk_buffs */
+- for (i = 0; i < rx_ring->count; i++) {
+- struct i40e_rx_buffer *rx_bi = &rx_ring->rx_bi[i];
+-
+- if (!rx_bi->page)
+- continue;
+-
+- /* Invalidate cache lines that may have been written to by
+- * device so that we avoid corrupting memory.
+- */
+- dma_sync_single_range_for_cpu(rx_ring->dev,
+- rx_bi->dma,
+- rx_bi->page_offset,
+- rx_ring->rx_buf_len,
+- DMA_FROM_DEVICE);
+-
+- /* free resources associated with mapping */
+- dma_unmap_page_attrs(rx_ring->dev, rx_bi->dma,
+- i40e_rx_pg_size(rx_ring),
+- DMA_FROM_DEVICE,
+- I40E_RX_DMA_ATTR);
+-
+- __page_frag_cache_drain(rx_bi->page, rx_bi->pagecnt_bias);
+-
+- rx_bi->page = NULL;
+- rx_bi->page_offset = 0;
+- }
+-
+- bi_size = sizeof(struct i40e_rx_buffer) * rx_ring->count;
+- memset(rx_ring->rx_bi, 0, bi_size);
+-
+- /* Zero out the descriptor ring */
+- memset(rx_ring->desc, 0, rx_ring->size);
+-
+- rx_ring->next_to_alloc = 0;
+- rx_ring->next_to_clean = 0;
+- rx_ring->next_to_use = 0;
+-}
+-
+-/**
+- * i40evf_free_rx_resources - Free Rx resources
+- * @rx_ring: ring to clean the resources from
+- *
+- * Free all receive software resources
+- **/
+-void i40evf_free_rx_resources(struct i40e_ring *rx_ring)
+-{
+- i40evf_clean_rx_ring(rx_ring);
+- kfree(rx_ring->rx_bi);
+- rx_ring->rx_bi = NULL;
+-
+- if (rx_ring->desc) {
+- dma_free_coherent(rx_ring->dev, rx_ring->size,
+- rx_ring->desc, rx_ring->dma);
+- rx_ring->desc = NULL;
+- }
+-}
+-
+-/**
+- * i40evf_setup_rx_descriptors - Allocate Rx descriptors
+- * @rx_ring: Rx descriptor ring (for a specific queue) to setup
+- *
+- * Returns 0 on success, negative on failure
+- **/
+-int i40evf_setup_rx_descriptors(struct i40e_ring *rx_ring)
+-{
+- struct device *dev = rx_ring->dev;
+- int bi_size;
+-
+- /* warn if we are about to overwrite the pointer */
+- WARN_ON(rx_ring->rx_bi);
+- bi_size = sizeof(struct i40e_rx_buffer) * rx_ring->count;
+- rx_ring->rx_bi = kzalloc(bi_size, GFP_KERNEL);
+- if (!rx_ring->rx_bi)
+- goto err;
+-
+- u64_stats_init(&rx_ring->syncp);
+-
+- /* Round up to nearest 4K */
+- rx_ring->size = rx_ring->count * sizeof(union i40e_32byte_rx_desc);
+- rx_ring->size = ALIGN(rx_ring->size, 4096);
+- rx_ring->desc = dma_alloc_coherent(dev, rx_ring->size,
+- &rx_ring->dma, GFP_KERNEL);
+-
+- if (!rx_ring->desc) {
+- dev_info(dev, "Unable to allocate memory for the Rx descriptor ring, size=%d\n",
+- rx_ring->size);
+- goto err;
+- }
+-
+- rx_ring->next_to_alloc = 0;
+- rx_ring->next_to_clean = 0;
+- rx_ring->next_to_use = 0;
+-
+- return 0;
+-err:
+- kfree(rx_ring->rx_bi);
+- rx_ring->rx_bi = NULL;
+- return -ENOMEM;
+-}
+-
+-/**
+- * i40e_release_rx_desc - Store the new tail and head values
+- * @rx_ring: ring to bump
+- * @val: new head index
+- **/
+-static inline void i40e_release_rx_desc(struct i40e_ring *rx_ring, u32 val)
+-{
+- rx_ring->next_to_use = val;
+-
+- /* update next to alloc since we have filled the ring */
+- rx_ring->next_to_alloc = val;
+-
+- /* Force memory writes to complete before letting h/w
+- * know there are new descriptors to fetch. (Only
+- * applicable for weak-ordered memory model archs,
+- * such as IA-64).
+- */
+- wmb();
+- writel(val, rx_ring->tail);
+-}
+-
+-/**
+- * i40e_rx_offset - Return expected offset into page to access data
+- * @rx_ring: Ring we are requesting offset of
+- *
+- * Returns the offset value for ring into the data buffer.
+- */
+-static inline unsigned int i40e_rx_offset(struct i40e_ring *rx_ring)
+-{
+- return ring_uses_build_skb(rx_ring) ? I40E_SKB_PAD : 0;
+-}
+-
+-/**
+- * i40e_alloc_mapped_page - recycle or make a new page
+- * @rx_ring: ring to use
+- * @bi: rx_buffer struct to modify
+- *
+- * Returns true if the page was successfully allocated or
+- * reused.
+- **/
+-static bool i40e_alloc_mapped_page(struct i40e_ring *rx_ring,
+- struct i40e_rx_buffer *bi)
+-{
+- struct page *page = bi->page;
+- dma_addr_t dma;
+-
+- /* since we are recycling buffers we should seldom need to alloc */
+- if (likely(page)) {
+- rx_ring->rx_stats.page_reuse_count++;
+- return true;
+- }
+-
+- /* alloc new page for storage */
+- page = dev_alloc_pages(i40e_rx_pg_order(rx_ring));
+- if (unlikely(!page)) {
+- rx_ring->rx_stats.alloc_page_failed++;
+- return false;
+- }
+-
+- /* map page for use */
+- dma = dma_map_page_attrs(rx_ring->dev, page, 0,
+- i40e_rx_pg_size(rx_ring),
+- DMA_FROM_DEVICE,
+- I40E_RX_DMA_ATTR);
+-
+- /* if mapping failed free memory back to system since
+- * there isn't much point in holding memory we can't use
+- */
+- if (dma_mapping_error(rx_ring->dev, dma)) {
+- __free_pages(page, i40e_rx_pg_order(rx_ring));
+- rx_ring->rx_stats.alloc_page_failed++;
+- return false;
+- }
+-
+- bi->dma = dma;
+- bi->page = page;
+- bi->page_offset = i40e_rx_offset(rx_ring);
+-
+- /* initialize pagecnt_bias to 1 representing we fully own page */
+- bi->pagecnt_bias = 1;
+-
+- return true;
+-}
+-
+-/**
+- * i40e_receive_skb - Send a completed packet up the stack
+- * @rx_ring: rx ring in play
+- * @skb: packet to send up
+- * @vlan_tag: vlan tag for packet
+- **/
+-static void i40e_receive_skb(struct i40e_ring *rx_ring,
+- struct sk_buff *skb, u16 vlan_tag)
+-{
+- struct i40e_q_vector *q_vector = rx_ring->q_vector;
+-
+- if ((rx_ring->netdev->features & NETIF_F_HW_VLAN_CTAG_RX) &&
+- (vlan_tag & VLAN_VID_MASK))
+- __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_tag);
+-
+- napi_gro_receive(&q_vector->napi, skb);
+-}
+-
+-/**
+- * i40evf_alloc_rx_buffers - Replace used receive buffers
+- * @rx_ring: ring to place buffers on
+- * @cleaned_count: number of buffers to replace
+- *
+- * Returns false if all allocations were successful, true if any fail
+- **/
+-bool i40evf_alloc_rx_buffers(struct i40e_ring *rx_ring, u16 cleaned_count)
+-{
+- u16 ntu = rx_ring->next_to_use;
+- union i40e_rx_desc *rx_desc;
+- struct i40e_rx_buffer *bi;
+-
+- /* do nothing if no valid netdev defined */
+- if (!rx_ring->netdev || !cleaned_count)
+- return false;
+-
+- rx_desc = I40E_RX_DESC(rx_ring, ntu);
+- bi = &rx_ring->rx_bi[ntu];
+-
+- do {
+- if (!i40e_alloc_mapped_page(rx_ring, bi))
+- goto no_buffers;
+-
+- /* sync the buffer for use by the device */
+- dma_sync_single_range_for_device(rx_ring->dev, bi->dma,
+- bi->page_offset,
+- rx_ring->rx_buf_len,
+- DMA_FROM_DEVICE);
+-
+- /* Refresh the desc even if buffer_addrs didn't change
+- * because each write-back erases this info.
+- */
+- rx_desc->read.pkt_addr = cpu_to_le64(bi->dma + bi->page_offset);
+-
+- rx_desc++;
+- bi++;
+- ntu++;
+- if (unlikely(ntu == rx_ring->count)) {
+- rx_desc = I40E_RX_DESC(rx_ring, 0);
+- bi = rx_ring->rx_bi;
+- ntu = 0;
+- }
+-
+- /* clear the status bits for the next_to_use descriptor */
+- rx_desc->wb.qword1.status_error_len = 0;
+-
+- cleaned_count--;
+- } while (cleaned_count);
+-
+- if (rx_ring->next_to_use != ntu)
+- i40e_release_rx_desc(rx_ring, ntu);
+-
+- return false;
+-
+-no_buffers:
+- if (rx_ring->next_to_use != ntu)
+- i40e_release_rx_desc(rx_ring, ntu);
+-
+- /* make sure to come back via polling to try again after
+- * allocation failure
+- */
+- return true;
+-}
+-
+-/**
+- * i40e_rx_checksum - Indicate in skb if hw indicated a good cksum
+- * @vsi: the VSI we care about
+- * @skb: skb currently being received and modified
+- * @rx_desc: the receive descriptor
+- **/
+-static inline void i40e_rx_checksum(struct i40e_vsi *vsi,
+- struct sk_buff *skb,
+- union i40e_rx_desc *rx_desc)
+-{
+- struct i40e_rx_ptype_decoded decoded;
+- u32 rx_error, rx_status;
+- bool ipv4, ipv6;
+- u8 ptype;
+- u64 qword;
+-
+- qword = le64_to_cpu(rx_desc->wb.qword1.status_error_len);
+- ptype = (qword & I40E_RXD_QW1_PTYPE_MASK) >> I40E_RXD_QW1_PTYPE_SHIFT;
+- rx_error = (qword & I40E_RXD_QW1_ERROR_MASK) >>
+- I40E_RXD_QW1_ERROR_SHIFT;
+- rx_status = (qword & I40E_RXD_QW1_STATUS_MASK) >>
+- I40E_RXD_QW1_STATUS_SHIFT;
+- decoded = decode_rx_desc_ptype(ptype);
+-
+- skb->ip_summed = CHECKSUM_NONE;
+-
+- skb_checksum_none_assert(skb);
+-
+- /* Rx csum enabled and ip headers found? */
+- if (!(vsi->netdev->features & NETIF_F_RXCSUM))
+- return;
+-
+- /* did the hardware decode the packet and checksum? */
+- if (!(rx_status & BIT(I40E_RX_DESC_STATUS_L3L4P_SHIFT)))
+- return;
+-
+- /* both known and outer_ip must be set for the below code to work */
+- if (!(decoded.known && decoded.outer_ip))
+- return;
+-
+- ipv4 = (decoded.outer_ip == I40E_RX_PTYPE_OUTER_IP) &&
+- (decoded.outer_ip_ver == I40E_RX_PTYPE_OUTER_IPV4);
+- ipv6 = (decoded.outer_ip == I40E_RX_PTYPE_OUTER_IP) &&
+- (decoded.outer_ip_ver == I40E_RX_PTYPE_OUTER_IPV6);
+-
+- if (ipv4 &&
+- (rx_error & (BIT(I40E_RX_DESC_ERROR_IPE_SHIFT) |
+- BIT(I40E_RX_DESC_ERROR_EIPE_SHIFT))))
+- goto checksum_fail;
+-
+- /* likely incorrect csum if alternate IP extension headers found */
+- if (ipv6 &&
+- rx_status & BIT(I40E_RX_DESC_STATUS_IPV6EXADD_SHIFT))
+- /* don't increment checksum err here, non-fatal err */
+- return;
+-
+- /* there was some L4 error, count error and punt packet to the stack */
+- if (rx_error & BIT(I40E_RX_DESC_ERROR_L4E_SHIFT))
+- goto checksum_fail;
+-
+- /* handle packets that were not able to be checksummed due
+- * to arrival speed, in this case the stack can compute
+- * the csum.
+- */
+- if (rx_error & BIT(I40E_RX_DESC_ERROR_PPRS_SHIFT))
+- return;
+-
+- /* Only report checksum unnecessary for TCP, UDP, or SCTP */
+- switch (decoded.inner_prot) {
+- case I40E_RX_PTYPE_INNER_PROT_TCP:
+- case I40E_RX_PTYPE_INNER_PROT_UDP:
+- case I40E_RX_PTYPE_INNER_PROT_SCTP:
+- skb->ip_summed = CHECKSUM_UNNECESSARY;
+- /* fall though */
+- default:
+- break;
+- }
+-
+- return;
+-
+-checksum_fail:
+- vsi->back->hw_csum_rx_error++;
+-}
+-
+-/**
+- * i40e_ptype_to_htype - get a hash type
+- * @ptype: the ptype value from the descriptor
+- *
+- * Returns a hash type to be used by skb_set_hash
+- **/
+-static inline int i40e_ptype_to_htype(u8 ptype)
+-{
+- struct i40e_rx_ptype_decoded decoded = decode_rx_desc_ptype(ptype);
+-
+- if (!decoded.known)
+- return PKT_HASH_TYPE_NONE;
+-
+- if (decoded.outer_ip == I40E_RX_PTYPE_OUTER_IP &&
+- decoded.payload_layer == I40E_RX_PTYPE_PAYLOAD_LAYER_PAY4)
+- return PKT_HASH_TYPE_L4;
+- else if (decoded.outer_ip == I40E_RX_PTYPE_OUTER_IP &&
+- decoded.payload_layer == I40E_RX_PTYPE_PAYLOAD_LAYER_PAY3)
+- return PKT_HASH_TYPE_L3;
+- else
+- return PKT_HASH_TYPE_L2;
+-}
+-
+-/**
+- * i40e_rx_hash - set the hash value in the skb
+- * @ring: descriptor ring
+- * @rx_desc: specific descriptor
+- * @skb: skb currently being received and modified
+- * @rx_ptype: Rx packet type
+- **/
+-static inline void i40e_rx_hash(struct i40e_ring *ring,
+- union i40e_rx_desc *rx_desc,
+- struct sk_buff *skb,
+- u8 rx_ptype)
+-{
+- u32 hash;
+- const __le64 rss_mask =
+- cpu_to_le64((u64)I40E_RX_DESC_FLTSTAT_RSS_HASH <<
+- I40E_RX_DESC_STATUS_FLTSTAT_SHIFT);
+-
+- if (ring->netdev->features & NETIF_F_RXHASH)
+- return;
+-
+- if ((rx_desc->wb.qword1.status_error_len & rss_mask) == rss_mask) {
+- hash = le32_to_cpu(rx_desc->wb.qword0.hi_dword.rss);
+- skb_set_hash(skb, hash, i40e_ptype_to_htype(rx_ptype));
+- }
+-}
+-
+-/**
+- * i40evf_process_skb_fields - Populate skb header fields from Rx descriptor
+- * @rx_ring: rx descriptor ring packet is being transacted on
+- * @rx_desc: pointer to the EOP Rx descriptor
+- * @skb: pointer to current skb being populated
+- * @rx_ptype: the packet type decoded by hardware
+- *
+- * This function checks the ring, descriptor, and packet information in
+- * order to populate the hash, checksum, VLAN, protocol, and
+- * other fields within the skb.
+- **/
+-static inline
+-void i40evf_process_skb_fields(struct i40e_ring *rx_ring,
+- union i40e_rx_desc *rx_desc, struct sk_buff *skb,
+- u8 rx_ptype)
+-{
+- i40e_rx_hash(rx_ring, rx_desc, skb, rx_ptype);
+-
+- i40e_rx_checksum(rx_ring->vsi, skb, rx_desc);
+-
+- skb_record_rx_queue(skb, rx_ring->queue_index);
+-
+- /* modifies the skb - consumes the enet header */
+- skb->protocol = eth_type_trans(skb, rx_ring->netdev);
+-}
+-
+-/**
+- * i40e_cleanup_headers - Correct empty headers
+- * @rx_ring: rx descriptor ring packet is being transacted on
+- * @skb: pointer to current skb being fixed
+- *
+- * Also address the case where we are pulling data in on pages only
+- * and as such no data is present in the skb header.
+- *
+- * In addition if skb is not at least 60 bytes we need to pad it so that
+- * it is large enough to qualify as a valid Ethernet frame.
+- *
+- * Returns true if an error was encountered and skb was freed.
+- **/
+-static bool i40e_cleanup_headers(struct i40e_ring *rx_ring, struct sk_buff *skb)
+-{
+- /* if eth_skb_pad returns an error the skb was freed */
+- if (eth_skb_pad(skb))
+- return true;
+-
+- return false;
+-}
+-
+-/**
+- * i40e_reuse_rx_page - page flip buffer and store it back on the ring
+- * @rx_ring: rx descriptor ring to store buffers on
+- * @old_buff: donor buffer to have page reused
+- *
+- * Synchronizes page for reuse by the adapter
+- **/
+-static void i40e_reuse_rx_page(struct i40e_ring *rx_ring,
+- struct i40e_rx_buffer *old_buff)
+-{
+- struct i40e_rx_buffer *new_buff;
+- u16 nta = rx_ring->next_to_alloc;
+-
+- new_buff = &rx_ring->rx_bi[nta];
+-
+- /* update, and store next to alloc */
+- nta++;
+- rx_ring->next_to_alloc = (nta < rx_ring->count) ? nta : 0;
+-
+- /* transfer page from old buffer to new buffer */
+- new_buff->dma = old_buff->dma;
+- new_buff->page = old_buff->page;
+- new_buff->page_offset = old_buff->page_offset;
+- new_buff->pagecnt_bias = old_buff->pagecnt_bias;
+-}
+-
+-/**
+- * i40e_page_is_reusable - check if any reuse is possible
+- * @page: page struct to check
+- *
+- * A page is not reusable if it was allocated under low memory
+- * conditions, or it's not in the same NUMA node as this CPU.
+- */
+-static inline bool i40e_page_is_reusable(struct page *page)
+-{
+- return (page_to_nid(page) == numa_mem_id()) &&
+- !page_is_pfmemalloc(page);
+-}
+-
+-/**
+- * i40e_can_reuse_rx_page - Determine if this page can be reused by
+- * the adapter for another receive
+- *
+- * @rx_buffer: buffer containing the page
+- *
+- * If page is reusable, rx_buffer->page_offset is adjusted to point to
+- * an unused region in the page.
+- *
+- * For small pages, @truesize will be a constant value, half the size
+- * of the memory at page. We'll attempt to alternate between high and
+- * low halves of the page, with one half ready for use by the hardware
+- * and the other half being consumed by the stack. We use the page
+- * ref count to determine whether the stack has finished consuming the
+- * portion of this page that was passed up with a previous packet. If
+- * the page ref count is >1, we'll assume the "other" half page is
+- * still busy, and this page cannot be reused.
+- *
+- * For larger pages, @truesize will be the actual space used by the
+- * received packet (adjusted upward to an even multiple of the cache
+- * line size). This will advance through the page by the amount
+- * actually consumed by the received packets while there is still
+- * space for a buffer. Each region of larger pages will be used at
+- * most once, after which the page will not be reused.
+- *
+- * In either case, if the page is reusable its refcount is increased.
+- **/
+-static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer)
+-{
+- unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;
+- struct page *page = rx_buffer->page;
+-
+- /* Is any reuse possible? */
+- if (unlikely(!i40e_page_is_reusable(page)))
+- return false;
+-
+-#if (PAGE_SIZE < 8192)
+- /* if we are only owner of page we can reuse it */
+- if (unlikely((page_count(page) - pagecnt_bias) > 1))
+- return false;
+-#else
+-#define I40E_LAST_OFFSET \
+- (SKB_WITH_OVERHEAD(PAGE_SIZE) - I40E_RXBUFFER_2048)
+- if (rx_buffer->page_offset > I40E_LAST_OFFSET)
+- return false;
+-#endif
+-
+- /* If we have drained the page fragment pool we need to update
+- * the pagecnt_bias and page count so that we fully restock the
+- * number of references the driver holds.
+- */
+- if (unlikely(!pagecnt_bias)) {
+- page_ref_add(page, USHRT_MAX);
+- rx_buffer->pagecnt_bias = USHRT_MAX;
+- }
+-
+- return true;
+-}
+-
+-/**
+- * i40e_add_rx_frag - Add contents of Rx buffer to sk_buff
+- * @rx_ring: rx descriptor ring to transact packets on
+- * @rx_buffer: buffer containing page to add
+- * @skb: sk_buff to place the data into
+- * @size: packet length from rx_desc
+- *
+- * This function will add the data contained in rx_buffer->page to the skb.
+- * It will just attach the page as a frag to the skb.
+- *
+- * The function will then update the page offset.
+- **/
+-static void i40e_add_rx_frag(struct i40e_ring *rx_ring,
+- struct i40e_rx_buffer *rx_buffer,
+- struct sk_buff *skb,
+- unsigned int size)
+-{
+-#if (PAGE_SIZE < 8192)
+- unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
+-#else
+- unsigned int truesize = SKB_DATA_ALIGN(size + i40e_rx_offset(rx_ring));
+-#endif
+-
+- skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, rx_buffer->page,
+- rx_buffer->page_offset, size, truesize);
+-
+- /* page is being used so we must update the page offset */
+-#if (PAGE_SIZE < 8192)
+- rx_buffer->page_offset ^= truesize;
+-#else
+- rx_buffer->page_offset += truesize;
+-#endif
+-}
+-
+-/**
+- * i40e_get_rx_buffer - Fetch Rx buffer and synchronize data for use
+- * @rx_ring: rx descriptor ring to transact packets on
+- * @size: size of buffer to add to skb
+- *
+- * This function will pull an Rx buffer from the ring and synchronize it
+- * for use by the CPU.
+- */
+-static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring,
+- const unsigned int size)
+-{
+- struct i40e_rx_buffer *rx_buffer;
+-
+- rx_buffer = &rx_ring->rx_bi[rx_ring->next_to_clean];
+- prefetchw(rx_buffer->page);
+-
+- /* we are reusing so sync this buffer for CPU use */
+- dma_sync_single_range_for_cpu(rx_ring->dev,
+- rx_buffer->dma,
+- rx_buffer->page_offset,
+- size,
+- DMA_FROM_DEVICE);
+-
+- /* We have pulled a buffer for use, so decrement pagecnt_bias */
+- rx_buffer->pagecnt_bias--;
+-
+- return rx_buffer;
+-}
+-
+-/**
+- * i40e_construct_skb - Allocate skb and populate it
+- * @rx_ring: rx descriptor ring to transact packets on
+- * @rx_buffer: rx buffer to pull data from
+- * @size: size of buffer to add to skb
+- *
+- * This function allocates an skb. It then populates it with the page
+- * data from the current receive descriptor, taking care to set up the
+- * skb correctly.
+- */
+-static struct sk_buff *i40e_construct_skb(struct i40e_ring *rx_ring,
+- struct i40e_rx_buffer *rx_buffer,
+- unsigned int size)
+-{
+- void *va;
+-#if (PAGE_SIZE < 8192)
+- unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
+-#else
+- unsigned int truesize = SKB_DATA_ALIGN(size);
+-#endif
+- unsigned int headlen;
+- struct sk_buff *skb;
+-
+- /* prefetch first cache line of first page */
+- va = page_address(rx_buffer->page) + rx_buffer->page_offset;
+- prefetch(va);
+-#if L1_CACHE_BYTES < 128
+- prefetch(va + L1_CACHE_BYTES);
+-#endif
+-
+- /* allocate a skb to store the frags */
+- skb = __napi_alloc_skb(&rx_ring->q_vector->napi,
+- I40E_RX_HDR_SIZE,
+- GFP_ATOMIC | __GFP_NOWARN);
+- if (unlikely(!skb))
+- return NULL;
+-
+- /* Determine available headroom for copy */
+- headlen = size;
+- if (headlen > I40E_RX_HDR_SIZE)
+- headlen = eth_get_headlen(va, I40E_RX_HDR_SIZE);
+-
+- /* align pull length to size of long to optimize memcpy performance */
+- memcpy(__skb_put(skb, headlen), va, ALIGN(headlen, sizeof(long)));
+-
+- /* update all of the pointers */
+- size -= headlen;
+- if (size) {
+- skb_add_rx_frag(skb, 0, rx_buffer->page,
+- rx_buffer->page_offset + headlen,
+- size, truesize);
+-
+- /* buffer is used by skb, update page_offset */
+-#if (PAGE_SIZE < 8192)
+- rx_buffer->page_offset ^= truesize;
+-#else
+- rx_buffer->page_offset += truesize;
+-#endif
+- } else {
+- /* buffer is unused, reset bias back to rx_buffer */
+- rx_buffer->pagecnt_bias++;
+- }
+-
+- return skb;
+-}
+-
+-/**
+- * i40e_build_skb - Build skb around an existing buffer
+- * @rx_ring: Rx descriptor ring to transact packets on
+- * @rx_buffer: Rx buffer to pull data from
+- * @size: size of buffer to add to skb
+- *
+- * This function builds an skb around an existing Rx buffer, taking care
+- * to set up the skb correctly and avoid any memcpy overhead.
+- */
+-static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
+- struct i40e_rx_buffer *rx_buffer,
+- unsigned int size)
+-{
+- void *va;
+-#if (PAGE_SIZE < 8192)
+- unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
+-#else
+- unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
+- SKB_DATA_ALIGN(I40E_SKB_PAD + size);
+-#endif
+- struct sk_buff *skb;
+-
+- /* prefetch first cache line of first page */
+- va = page_address(rx_buffer->page) + rx_buffer->page_offset;
+- prefetch(va);
+-#if L1_CACHE_BYTES < 128
+- prefetch(va + L1_CACHE_BYTES);
+-#endif
+- /* build an skb around the page buffer */
+- skb = build_skb(va - I40E_SKB_PAD, truesize);
+- if (unlikely(!skb))
+- return NULL;
+-
+- /* update pointers within the skb to store the data */
+- skb_reserve(skb, I40E_SKB_PAD);
+- __skb_put(skb, size);
+-
+- /* buffer is used by skb, update page_offset */
+-#if (PAGE_SIZE < 8192)
+- rx_buffer->page_offset ^= truesize;
+-#else
+- rx_buffer->page_offset += truesize;
+-#endif
+-
+- return skb;
+-}
+-
+-/**
+- * i40e_put_rx_buffer - Clean up used buffer and either recycle or free
+- * @rx_ring: rx descriptor ring to transact packets on
+- * @rx_buffer: rx buffer to pull data from
+- *
+- * This function will clean up the contents of the rx_buffer. It will
+- * either recycle the buffer or unmap it and free the associated resources.
+- */
+-static void i40e_put_rx_buffer(struct i40e_ring *rx_ring,
+- struct i40e_rx_buffer *rx_buffer)
+-{
+- if (i40e_can_reuse_rx_page(rx_buffer)) {
+- /* hand second half of page back to the ring */
+- i40e_reuse_rx_page(rx_ring, rx_buffer);
+- rx_ring->rx_stats.page_reuse_count++;
+- } else {
+- /* we are not reusing the buffer so unmap it */
+- dma_unmap_page_attrs(rx_ring->dev, rx_buffer->dma,
+- i40e_rx_pg_size(rx_ring),
+- DMA_FROM_DEVICE, I40E_RX_DMA_ATTR);
+- __page_frag_cache_drain(rx_buffer->page,
+- rx_buffer->pagecnt_bias);
+- }
+-
+- /* clear contents of buffer_info */
+- rx_buffer->page = NULL;
+-}
+-
+-/**
+- * i40e_is_non_eop - process handling of non-EOP buffers
+- * @rx_ring: Rx ring being processed
+- * @rx_desc: Rx descriptor for current buffer
+- * @skb: Current socket buffer containing buffer in progress
+- *
+- * This function updates next to clean. If the buffer is an EOP buffer
+- * this function exits returning false, otherwise it will place the
+- * sk_buff in the next buffer to be chained and return true indicating
+- * that this is in fact a non-EOP buffer.
+- **/
+-static bool i40e_is_non_eop(struct i40e_ring *rx_ring,
+- union i40e_rx_desc *rx_desc,
+- struct sk_buff *skb)
+-{
+- u32 ntc = rx_ring->next_to_clean + 1;
+-
+- /* fetch, update, and store next to clean */
+- ntc = (ntc < rx_ring->count) ? ntc : 0;
+- rx_ring->next_to_clean = ntc;
+-
+- prefetch(I40E_RX_DESC(rx_ring, ntc));
+-
+- /* if we are the last buffer then there is nothing else to do */
+-#define I40E_RXD_EOF BIT(I40E_RX_DESC_STATUS_EOF_SHIFT)
+- if (likely(i40e_test_staterr(rx_desc, I40E_RXD_EOF)))
+- return false;
+-
+- rx_ring->rx_stats.non_eop_descs++;
+-
+- return true;
+-}
+-
+-/**
+- * i40e_clean_rx_irq - Clean completed descriptors from Rx ring - bounce buf
+- * @rx_ring: rx descriptor ring to transact packets on
+- * @budget: Total limit on number of packets to process
+- *
+- * This function provides a "bounce buffer" approach to Rx interrupt
+- * processing. The advantage to this is that on systems that have
+- * expensive overhead for IOMMU access this provides a means of avoiding
+- * it by maintaining the mapping of the page to the system.
+- *
+- * Returns amount of work completed
+- **/
+-static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
+-{
+- unsigned int total_rx_bytes = 0, total_rx_packets = 0;
+- struct sk_buff *skb = rx_ring->skb;
+- u16 cleaned_count = I40E_DESC_UNUSED(rx_ring);
+- bool failure = false;
+-
+- while (likely(total_rx_packets < (unsigned int)budget)) {
+- struct i40e_rx_buffer *rx_buffer;
+- union i40e_rx_desc *rx_desc;
+- unsigned int size;
+- u16 vlan_tag;
+- u8 rx_ptype;
+- u64 qword;
+-
+- /* return some buffers to hardware, one at a time is too slow */
+- if (cleaned_count >= I40E_RX_BUFFER_WRITE) {
+- failure = failure ||
+- i40evf_alloc_rx_buffers(rx_ring, cleaned_count);
+- cleaned_count = 0;
+- }
+-
+- rx_desc = I40E_RX_DESC(rx_ring, rx_ring->next_to_clean);
+-
+- /* status_error_len will always be zero for unused descriptors
+- * because it's cleared in cleanup, and overlaps with hdr_addr
+- * which is always zero because packet split isn't used, if the
+- * hardware wrote DD then the length will be non-zero
+- */
+- qword = le64_to_cpu(rx_desc->wb.qword1.status_error_len);
+-
+- /* This memory barrier is needed to keep us from reading
+- * any other fields out of the rx_desc until we have
+- * verified the descriptor has been written back.
+- */
+- dma_rmb();
+-
+- size = (qword & I40E_RXD_QW1_LENGTH_PBUF_MASK) >>
+- I40E_RXD_QW1_LENGTH_PBUF_SHIFT;
+- if (!size)
+- break;
+-
+- i40e_trace(clean_rx_irq, rx_ring, rx_desc, skb);
+- rx_buffer = i40e_get_rx_buffer(rx_ring, size);
+-
+- /* retrieve a buffer from the ring */
+- if (skb)
+- i40e_add_rx_frag(rx_ring, rx_buffer, skb, size);
+- else if (ring_uses_build_skb(rx_ring))
+- skb = i40e_build_skb(rx_ring, rx_buffer, size);
+- else
+- skb = i40e_construct_skb(rx_ring, rx_buffer, size);
+-
+- /* exit if we failed to retrieve a buffer */
+- if (!skb) {
+- rx_ring->rx_stats.alloc_buff_failed++;
+- rx_buffer->pagecnt_bias++;
+- break;
+- }
+-
+- i40e_put_rx_buffer(rx_ring, rx_buffer);
+- cleaned_count++;
+-
+- if (i40e_is_non_eop(rx_ring, rx_desc, skb))
+- continue;
+-
+- /* ERR_MASK will only have valid bits if EOP set, and
+- * what we are doing here is actually checking
+- * I40E_RX_DESC_ERROR_RXE_SHIFT, since it is the zeroth bit in
+- * the error field
+- */
+- if (unlikely(i40e_test_staterr(rx_desc, BIT(I40E_RXD_QW1_ERROR_SHIFT)))) {
+- dev_kfree_skb_any(skb);
+- skb = NULL;
+- continue;
+- }
+-
+- if (i40e_cleanup_headers(rx_ring, skb)) {
+- skb = NULL;
+- continue;
+- }
+-
+- /* probably a little skewed due to removing CRC */
+- total_rx_bytes += skb->len;
+-
+- qword = le64_to_cpu(rx_desc->wb.qword1.status_error_len);
+- rx_ptype = (qword & I40E_RXD_QW1_PTYPE_MASK) >>
+- I40E_RXD_QW1_PTYPE_SHIFT;
+-
+- /* populate checksum, VLAN, and protocol */
+- i40evf_process_skb_fields(rx_ring, rx_desc, skb, rx_ptype);
+-
+-
+- vlan_tag = (qword & BIT(I40E_RX_DESC_STATUS_L2TAG1P_SHIFT)) ?
+- le16_to_cpu(rx_desc->wb.qword0.lo_dword.l2tag1) : 0;
+-
+- i40e_trace(clean_rx_irq_rx, rx_ring, rx_desc, skb);
+- i40e_receive_skb(rx_ring, skb, vlan_tag);
+- skb = NULL;
+-
+- /* update budget accounting */
+- total_rx_packets++;
+- }
+-
+- rx_ring->skb = skb;
+-
+- u64_stats_update_begin(&rx_ring->syncp);
+- rx_ring->stats.packets += total_rx_packets;
+- rx_ring->stats.bytes += total_rx_bytes;
+- u64_stats_update_end(&rx_ring->syncp);
+- rx_ring->q_vector->rx.total_packets += total_rx_packets;
+- rx_ring->q_vector->rx.total_bytes += total_rx_bytes;
+-
+- /* guarantee a trip back through this routine if there was a failure */
+- return failure ? budget : (int)total_rx_packets;
+-}
+-
+-static inline u32 i40e_buildreg_itr(const int type, u16 itr)
+-{
+- u32 val;
+-
+- /* We don't bother with setting the CLEARPBA bit as the data sheet
+- * points out doing so is "meaningless since it was already
+- * auto-cleared". The auto-clearing happens when the interrupt is
+- * asserted.
+- *
+- * Hardware errata 28 for also indicates that writing to a
+- * xxINT_DYN_CTLx CSR with INTENA_MSK (bit 31) set to 0 will clear
+- * an event in the PBA anyway so we need to rely on the automask
+- * to hold pending events for us until the interrupt is re-enabled
+- *
+- * The itr value is reported in microseconds, and the register
+- * value is recorded in 2 microsecond units. For this reason we
+- * only need to shift by the interval shift - 1 instead of the
+- * full value.
+- */
+- itr &= I40E_ITR_MASK;
+-
+- val = I40E_VFINT_DYN_CTLN1_INTENA_MASK |
+- (type << I40E_VFINT_DYN_CTLN1_ITR_INDX_SHIFT) |
+- (itr << (I40E_VFINT_DYN_CTLN1_INTERVAL_SHIFT - 1));
+-
+- return val;
+-}
+-
+-/* a small macro to shorten up some long lines */
+-#define INTREG I40E_VFINT_DYN_CTLN1
+-
+-/* The act of updating the ITR will cause it to immediately trigger. In order
+- * to prevent this from throwing off adaptive update statistics we defer the
+- * update so that it can only happen so often. So after either Tx or Rx are
+- * updated we make the adaptive scheme wait until either the ITR completely
+- * expires via the next_update expiration or we have been through at least
+- * 3 interrupts.
+- */
+-#define ITR_COUNTDOWN_START 3
+-
+-/**
+- * i40e_update_enable_itr - Update itr and re-enable MSIX interrupt
+- * @vsi: the VSI we care about
+- * @q_vector: q_vector for which itr is being updated and interrupt enabled
+- *
+- **/
+-static inline void i40e_update_enable_itr(struct i40e_vsi *vsi,
+- struct i40e_q_vector *q_vector)
+-{
+- struct i40e_hw *hw = &vsi->back->hw;
+- u32 intval;
+-
+- /* These will do nothing if dynamic updates are not enabled */
+- i40e_update_itr(q_vector, &q_vector->tx);
+- i40e_update_itr(q_vector, &q_vector->rx);
+-
+- /* This block of logic allows us to get away with only updating
+- * one ITR value with each interrupt. The idea is to perform a
+- * pseudo-lazy update with the following criteria.
+- *
+- * 1. Rx is given higher priority than Tx if both are in same state
+- * 2. If we must reduce an ITR that is given highest priority.
+- * 3. We then give priority to increasing ITR based on amount.
+- */
+- if (q_vector->rx.target_itr < q_vector->rx.current_itr) {
+- /* Rx ITR needs to be reduced, this is highest priority */
+- intval = i40e_buildreg_itr(I40E_RX_ITR,
+- q_vector->rx.target_itr);
+- q_vector->rx.current_itr = q_vector->rx.target_itr;
+- q_vector->itr_countdown = ITR_COUNTDOWN_START;
+- } else if ((q_vector->tx.target_itr < q_vector->tx.current_itr) ||
+- ((q_vector->rx.target_itr - q_vector->rx.current_itr) <
+- (q_vector->tx.target_itr - q_vector->tx.current_itr))) {
+- /* Tx ITR needs to be reduced, this is second priority
+- * Tx ITR needs to be increased more than Rx, fourth priority
+- */
+- intval = i40e_buildreg_itr(I40E_TX_ITR,
+- q_vector->tx.target_itr);
+- q_vector->tx.current_itr = q_vector->tx.target_itr;
+- q_vector->itr_countdown = ITR_COUNTDOWN_START;
+- } else if (q_vector->rx.current_itr != q_vector->rx.target_itr) {
+- /* Rx ITR needs to be increased, third priority */
+- intval = i40e_buildreg_itr(I40E_RX_ITR,
+- q_vector->rx.target_itr);
+- q_vector->rx.current_itr = q_vector->rx.target_itr;
+- q_vector->itr_countdown = ITR_COUNTDOWN_START;
+- } else {
+- /* No ITR update, lowest priority */
+- intval = i40e_buildreg_itr(I40E_ITR_NONE, 0);
+- if (q_vector->itr_countdown)
+- q_vector->itr_countdown--;
+- }
+-
+- if (!test_bit(__I40E_VSI_DOWN, vsi->state))
+- wr32(hw, INTREG(q_vector->reg_idx), intval);
+-}
+-
+-/**
+- * i40evf_napi_poll - NAPI polling Rx/Tx cleanup routine
+- * @napi: napi struct with our devices info in it
+- * @budget: amount of work driver is allowed to do this pass, in packets
+- *
+- * This function will clean all queues associated with a q_vector.
+- *
+- * Returns the amount of work done
+- **/
+-int i40evf_napi_poll(struct napi_struct *napi, int budget)
+-{
+- struct i40e_q_vector *q_vector =
+- container_of(napi, struct i40e_q_vector, napi);
+- struct i40e_vsi *vsi = q_vector->vsi;
+- struct i40e_ring *ring;
+- bool clean_complete = true;
+- bool arm_wb = false;
+- int budget_per_ring;
+- int work_done = 0;
+-
+- if (test_bit(__I40E_VSI_DOWN, vsi->state)) {
+- napi_complete(napi);
+- return 0;
+- }
+-
+- /* Since the actual Tx work is minimal, we can give the Tx a larger
+- * budget and be more aggressive about cleaning up the Tx descriptors.
+- */
+- i40e_for_each_ring(ring, q_vector->tx) {
+- if (!i40e_clean_tx_irq(vsi, ring, budget)) {
+- clean_complete = false;
+- continue;
+- }
+- arm_wb |= ring->arm_wb;
+- ring->arm_wb = false;
+- }
+-
+- /* Handle case where we are called by netpoll with a budget of 0 */
+- if (budget <= 0)
+- goto tx_only;
+-
+- /* We attempt to distribute budget to each Rx queue fairly, but don't
+- * allow the budget to go below 1 because that would exit polling early.
+- */
+- budget_per_ring = max(budget/q_vector->num_ringpairs, 1);
+-
+- i40e_for_each_ring(ring, q_vector->rx) {
+- int cleaned = i40e_clean_rx_irq(ring, budget_per_ring);
+-
+- work_done += cleaned;
+- /* if we clean as many as budgeted, we must not be done */
+- if (cleaned >= budget_per_ring)
+- clean_complete = false;
+- }
+-
+- /* If work not completed, return budget and polling will return */
+- if (!clean_complete) {
+- int cpu_id = smp_processor_id();
+-
+- /* It is possible that the interrupt affinity has changed but,
+- * if the cpu is pegged at 100%, polling will never exit while
+- * traffic continues and the interrupt will be stuck on this
+- * cpu. We check to make sure affinity is correct before we
+- * continue to poll, otherwise we must stop polling so the
+- * interrupt can move to the correct cpu.
+- */
+- if (!cpumask_test_cpu(cpu_id, &q_vector->affinity_mask)) {
+- /* Tell napi that we are done polling */
+- napi_complete_done(napi, work_done);
+-
+- /* Force an interrupt */
+- i40evf_force_wb(vsi, q_vector);
+-
+- /* Return budget-1 so that polling stops */
+- return budget - 1;
+- }
+-tx_only:
+- if (arm_wb) {
+- q_vector->tx.ring[0].tx_stats.tx_force_wb++;
+- i40e_enable_wb_on_itr(vsi, q_vector);
+- }
+- return budget;
+- }
+-
+- if (vsi->back->flags & I40E_TXR_FLAGS_WB_ON_ITR)
+- q_vector->arm_wb_state = false;
+-
+- /* Work is done so exit the polling mode and re-enable the interrupt */
+- napi_complete_done(napi, work_done);
+-
+- i40e_update_enable_itr(vsi, q_vector);
+-
+- return min(work_done, budget - 1);
+-}
+-
+-/**
+- * i40evf_tx_prepare_vlan_flags - prepare generic TX VLAN tagging flags for HW
+- * @skb: send buffer
+- * @tx_ring: ring to send buffer on
+- * @flags: the tx flags to be set
+- *
+- * Checks the skb and set up correspondingly several generic transmit flags
+- * related to VLAN tagging for the HW, such as VLAN, DCB, etc.
+- *
+- * Returns error code indicate the frame should be dropped upon error and the
+- * otherwise returns 0 to indicate the flags has been set properly.
+- **/
+-static inline int i40evf_tx_prepare_vlan_flags(struct sk_buff *skb,
+- struct i40e_ring *tx_ring,
+- u32 *flags)
+-{
+- __be16 protocol = skb->protocol;
+- u32 tx_flags = 0;
+-
+- if (protocol == htons(ETH_P_8021Q) &&
+- !(tx_ring->netdev->features & NETIF_F_HW_VLAN_CTAG_TX)) {
+- /* When HW VLAN acceleration is turned off by the user the
+- * stack sets the protocol to 8021q so that the driver
+- * can take any steps required to support the SW only
+- * VLAN handling. In our case the driver doesn't need
+- * to take any further steps so just set the protocol
+- * to the encapsulated ethertype.
+- */
+- skb->protocol = vlan_get_protocol(skb);
+- goto out;
+- }
+-
+- /* if we have a HW VLAN tag being added, default to the HW one */
+- if (skb_vlan_tag_present(skb)) {
+- tx_flags |= skb_vlan_tag_get(skb) << I40E_TX_FLAGS_VLAN_SHIFT;
+- tx_flags |= I40E_TX_FLAGS_HW_VLAN;
+- /* else if it is a SW VLAN, check the next protocol and store the tag */
+- } else if (protocol == htons(ETH_P_8021Q)) {
+- struct vlan_hdr *vhdr, _vhdr;
+-
+- vhdr = skb_header_pointer(skb, ETH_HLEN, sizeof(_vhdr), &_vhdr);
+- if (!vhdr)
+- return -EINVAL;
+-
+- protocol = vhdr->h_vlan_encapsulated_proto;
+- tx_flags |= ntohs(vhdr->h_vlan_TCI) << I40E_TX_FLAGS_VLAN_SHIFT;
+- tx_flags |= I40E_TX_FLAGS_SW_VLAN;
+- }
+-
+-out:
+- *flags = tx_flags;
+- return 0;
+-}
+-
+-/**
+- * i40e_tso - set up the tso context descriptor
+- * @first: pointer to first Tx buffer for xmit
+- * @hdr_len: ptr to the size of the packet header
+- * @cd_type_cmd_tso_mss: Quad Word 1
+- *
+- * Returns 0 if no TSO can happen, 1 if tso is going, or error
+- **/
+-static int i40e_tso(struct i40e_tx_buffer *first, u8 *hdr_len,
+- u64 *cd_type_cmd_tso_mss)
+-{
+- struct sk_buff *skb = first->skb;
+- u64 cd_cmd, cd_tso_len, cd_mss;
+- union {
+- struct iphdr *v4;
+- struct ipv6hdr *v6;
+- unsigned char *hdr;
+- } ip;
+- union {
+- struct tcphdr *tcp;
+- struct udphdr *udp;
+- unsigned char *hdr;
+- } l4;
+- u32 paylen, l4_offset;
+- u16 gso_segs, gso_size;
+- int err;
+-
+- if (skb->ip_summed != CHECKSUM_PARTIAL)
+- return 0;
+-
+- if (!skb_is_gso(skb))
+- return 0;
+-
+- err = skb_cow_head(skb, 0);
+- if (err < 0)
+- return err;
+-
+- ip.hdr = skb_network_header(skb);
+- l4.hdr = skb_transport_header(skb);
+-
+- /* initialize outer IP header fields */
+- if (ip.v4->version == 4) {
+- ip.v4->tot_len = 0;
+- ip.v4->check = 0;
+- } else {
+- ip.v6->payload_len = 0;
+- }
+-
+- if (skb_shinfo(skb)->gso_type & (SKB_GSO_GRE |
+- SKB_GSO_GRE_CSUM |
+- SKB_GSO_IPXIP4 |
+- SKB_GSO_IPXIP6 |
+- SKB_GSO_UDP_TUNNEL |
+- SKB_GSO_UDP_TUNNEL_CSUM)) {
+- if (!(skb_shinfo(skb)->gso_type & SKB_GSO_PARTIAL) &&
+- (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM)) {
+- l4.udp->len = 0;
+-
+- /* determine offset of outer transport header */
+- l4_offset = l4.hdr - skb->data;
+-
+- /* remove payload length from outer checksum */
+- paylen = skb->len - l4_offset;
+- csum_replace_by_diff(&l4.udp->check,
+- (__force __wsum)htonl(paylen));
+- }
+-
+- /* reset pointers to inner headers */
+- ip.hdr = skb_inner_network_header(skb);
+- l4.hdr = skb_inner_transport_header(skb);
+-
+- /* initialize inner IP header fields */
+- if (ip.v4->version == 4) {
+- ip.v4->tot_len = 0;
+- ip.v4->check = 0;
+- } else {
+- ip.v6->payload_len = 0;
+- }
+- }
+-
+- /* determine offset of inner transport header */
+- l4_offset = l4.hdr - skb->data;
+-
+- /* remove payload length from inner checksum */
+- paylen = skb->len - l4_offset;
+- csum_replace_by_diff(&l4.tcp->check, (__force __wsum)htonl(paylen));
+-
+- /* compute length of segmentation header */
+- *hdr_len = (l4.tcp->doff * 4) + l4_offset;
+-
+- /* pull values out of skb_shinfo */
+- gso_size = skb_shinfo(skb)->gso_size;
+- gso_segs = skb_shinfo(skb)->gso_segs;
+-
+- /* update GSO size and bytecount with header size */
+- first->gso_segs = gso_segs;
+- first->bytecount += (first->gso_segs - 1) * *hdr_len;
+-
+- /* find the field values */
+- cd_cmd = I40E_TX_CTX_DESC_TSO;
+- cd_tso_len = skb->len - *hdr_len;
+- cd_mss = gso_size;
+- *cd_type_cmd_tso_mss |= (cd_cmd << I40E_TXD_CTX_QW1_CMD_SHIFT) |
+- (cd_tso_len << I40E_TXD_CTX_QW1_TSO_LEN_SHIFT) |
+- (cd_mss << I40E_TXD_CTX_QW1_MSS_SHIFT);
+- return 1;
+-}
+-
+-/**
+- * i40e_tx_enable_csum - Enable Tx checksum offloads
+- * @skb: send buffer
+- * @tx_flags: pointer to Tx flags currently set
+- * @td_cmd: Tx descriptor command bits to set
+- * @td_offset: Tx descriptor header offsets to set
+- * @tx_ring: Tx descriptor ring
+- * @cd_tunneling: ptr to context desc bits
+- **/
+-static int i40e_tx_enable_csum(struct sk_buff *skb, u32 *tx_flags,
+- u32 *td_cmd, u32 *td_offset,
+- struct i40e_ring *tx_ring,
+- u32 *cd_tunneling)
+-{
+- union {
+- struct iphdr *v4;
+- struct ipv6hdr *v6;
+- unsigned char *hdr;
+- } ip;
+- union {
+- struct tcphdr *tcp;
+- struct udphdr *udp;
+- unsigned char *hdr;
+- } l4;
+- unsigned char *exthdr;
+- u32 offset, cmd = 0;
+- __be16 frag_off;
+- u8 l4_proto = 0;
+-
+- if (skb->ip_summed != CHECKSUM_PARTIAL)
+- return 0;
+-
+- ip.hdr = skb_network_header(skb);
+- l4.hdr = skb_transport_header(skb);
+-
+- /* compute outer L2 header size */
+- offset = ((ip.hdr - skb->data) / 2) << I40E_TX_DESC_LENGTH_MACLEN_SHIFT;
+-
+- if (skb->encapsulation) {
+- u32 tunnel = 0;
+- /* define outer network header type */
+- if (*tx_flags & I40E_TX_FLAGS_IPV4) {
+- tunnel |= (*tx_flags & I40E_TX_FLAGS_TSO) ?
+- I40E_TX_CTX_EXT_IP_IPV4 :
+- I40E_TX_CTX_EXT_IP_IPV4_NO_CSUM;
+-
+- l4_proto = ip.v4->protocol;
+- } else if (*tx_flags & I40E_TX_FLAGS_IPV6) {
+- tunnel |= I40E_TX_CTX_EXT_IP_IPV6;
+-
+- exthdr = ip.hdr + sizeof(*ip.v6);
+- l4_proto = ip.v6->nexthdr;
+- if (l4.hdr != exthdr)
+- ipv6_skip_exthdr(skb, exthdr - skb->data,
+- &l4_proto, &frag_off);
+- }
+-
+- /* define outer transport */
+- switch (l4_proto) {
+- case IPPROTO_UDP:
+- tunnel |= I40E_TXD_CTX_UDP_TUNNELING;
+- *tx_flags |= I40E_TX_FLAGS_VXLAN_TUNNEL;
+- break;
+- case IPPROTO_GRE:
+- tunnel |= I40E_TXD_CTX_GRE_TUNNELING;
+- *tx_flags |= I40E_TX_FLAGS_VXLAN_TUNNEL;
+- break;
+- case IPPROTO_IPIP:
+- case IPPROTO_IPV6:
+- *tx_flags |= I40E_TX_FLAGS_VXLAN_TUNNEL;
+- l4.hdr = skb_inner_network_header(skb);
+- break;
+- default:
+- if (*tx_flags & I40E_TX_FLAGS_TSO)
+- return -1;
+-
+- skb_checksum_help(skb);
+- return 0;
+- }
+-
+- /* compute outer L3 header size */
+- tunnel |= ((l4.hdr - ip.hdr) / 4) <<
+- I40E_TXD_CTX_QW0_EXT_IPLEN_SHIFT;
+-
+- /* switch IP header pointer from outer to inner header */
+- ip.hdr = skb_inner_network_header(skb);
+-
+- /* compute tunnel header size */
+- tunnel |= ((ip.hdr - l4.hdr) / 2) <<
+- I40E_TXD_CTX_QW0_NATLEN_SHIFT;
+-
+- /* indicate if we need to offload outer UDP header */
+- if ((*tx_flags & I40E_TX_FLAGS_TSO) &&
+- !(skb_shinfo(skb)->gso_type & SKB_GSO_PARTIAL) &&
+- (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM))
+- tunnel |= I40E_TXD_CTX_QW0_L4T_CS_MASK;
+-
+- /* record tunnel offload values */
+- *cd_tunneling |= tunnel;
+-
+- /* switch L4 header pointer from outer to inner */
+- l4.hdr = skb_inner_transport_header(skb);
+- l4_proto = 0;
+-
+- /* reset type as we transition from outer to inner headers */
+- *tx_flags &= ~(I40E_TX_FLAGS_IPV4 | I40E_TX_FLAGS_IPV6);
+- if (ip.v4->version == 4)
+- *tx_flags |= I40E_TX_FLAGS_IPV4;
+- if (ip.v6->version == 6)
+- *tx_flags |= I40E_TX_FLAGS_IPV6;
+- }
+-
+- /* Enable IP checksum offloads */
+- if (*tx_flags & I40E_TX_FLAGS_IPV4) {
+- l4_proto = ip.v4->protocol;
+- /* the stack computes the IP header already, the only time we
+- * need the hardware to recompute it is in the case of TSO.
+- */
+- cmd |= (*tx_flags & I40E_TX_FLAGS_TSO) ?
+- I40E_TX_DESC_CMD_IIPT_IPV4_CSUM :
+- I40E_TX_DESC_CMD_IIPT_IPV4;
+- } else if (*tx_flags & I40E_TX_FLAGS_IPV6) {
+- cmd |= I40E_TX_DESC_CMD_IIPT_IPV6;
+-
+- exthdr = ip.hdr + sizeof(*ip.v6);
+- l4_proto = ip.v6->nexthdr;
+- if (l4.hdr != exthdr)
+- ipv6_skip_exthdr(skb, exthdr - skb->data,
+- &l4_proto, &frag_off);
+- }
+-
+- /* compute inner L3 header size */
+- offset |= ((l4.hdr - ip.hdr) / 4) << I40E_TX_DESC_LENGTH_IPLEN_SHIFT;
+-
+- /* Enable L4 checksum offloads */
+- switch (l4_proto) {
+- case IPPROTO_TCP:
+- /* enable checksum offloads */
+- cmd |= I40E_TX_DESC_CMD_L4T_EOFT_TCP;
+- offset |= l4.tcp->doff << I40E_TX_DESC_LENGTH_L4_FC_LEN_SHIFT;
+- break;
+- case IPPROTO_SCTP:
+- /* enable SCTP checksum offload */
+- cmd |= I40E_TX_DESC_CMD_L4T_EOFT_SCTP;
+- offset |= (sizeof(struct sctphdr) >> 2) <<
+- I40E_TX_DESC_LENGTH_L4_FC_LEN_SHIFT;
+- break;
+- case IPPROTO_UDP:
+- /* enable UDP checksum offload */
+- cmd |= I40E_TX_DESC_CMD_L4T_EOFT_UDP;
+- offset |= (sizeof(struct udphdr) >> 2) <<
+- I40E_TX_DESC_LENGTH_L4_FC_LEN_SHIFT;
+- break;
+- default:
+- if (*tx_flags & I40E_TX_FLAGS_TSO)
+- return -1;
+- skb_checksum_help(skb);
+- return 0;
+- }
+-
+- *td_cmd |= cmd;
+- *td_offset |= offset;
+-
+- return 1;
+-}
+-
+-/**
+- * i40e_create_tx_ctx Build the Tx context descriptor
+- * @tx_ring: ring to create the descriptor on
+- * @cd_type_cmd_tso_mss: Quad Word 1
+- * @cd_tunneling: Quad Word 0 - bits 0-31
+- * @cd_l2tag2: Quad Word 0 - bits 32-63
+- **/
+-static void i40e_create_tx_ctx(struct i40e_ring *tx_ring,
+- const u64 cd_type_cmd_tso_mss,
+- const u32 cd_tunneling, const u32 cd_l2tag2)
+-{
+- struct i40e_tx_context_desc *context_desc;
+- int i = tx_ring->next_to_use;
+-
+- if ((cd_type_cmd_tso_mss == I40E_TX_DESC_DTYPE_CONTEXT) &&
+- !cd_tunneling && !cd_l2tag2)
+- return;
+-
+- /* grab the next descriptor */
+- context_desc = I40E_TX_CTXTDESC(tx_ring, i);
+-
+- i++;
+- tx_ring->next_to_use = (i < tx_ring->count) ? i : 0;
+-
+- /* cpu_to_le32 and assign to struct fields */
+- context_desc->tunneling_params = cpu_to_le32(cd_tunneling);
+- context_desc->l2tag2 = cpu_to_le16(cd_l2tag2);
+- context_desc->rsvd = cpu_to_le16(0);
+- context_desc->type_cmd_tso_mss = cpu_to_le64(cd_type_cmd_tso_mss);
+-}
+-
+-/**
+- * __i40evf_chk_linearize - Check if there are more than 8 buffers per packet
+- * @skb: send buffer
+- *
+- * Note: Our HW can't DMA more than 8 buffers to build a packet on the wire
+- * and so we need to figure out the cases where we need to linearize the skb.
+- *
+- * For TSO we need to count the TSO header and segment payload separately.
+- * As such we need to check cases where we have 7 fragments or more as we
+- * can potentially require 9 DMA transactions, 1 for the TSO header, 1 for
+- * the segment payload in the first descriptor, and another 7 for the
+- * fragments.
+- **/
+-bool __i40evf_chk_linearize(struct sk_buff *skb)
+-{
+- const struct skb_frag_struct *frag, *stale;
+- int nr_frags, sum;
+-
+- /* no need to check if number of frags is less than 7 */
+- nr_frags = skb_shinfo(skb)->nr_frags;
+- if (nr_frags < (I40E_MAX_BUFFER_TXD - 1))
+- return false;
+-
+- /* We need to walk through the list and validate that each group
+- * of 6 fragments totals at least gso_size.
+- */
+- nr_frags -= I40E_MAX_BUFFER_TXD - 2;
+- frag = &skb_shinfo(skb)->frags[0];
+-
+- /* Initialize size to the negative value of gso_size minus 1. We
+- * use this as the worst case scenerio in which the frag ahead
+- * of us only provides one byte which is why we are limited to 6
+- * descriptors for a single transmit as the header and previous
+- * fragment are already consuming 2 descriptors.
+- */
+- sum = 1 - skb_shinfo(skb)->gso_size;
+-
+- /* Add size of frags 0 through 4 to create our initial sum */
+- sum += skb_frag_size(frag++);
+- sum += skb_frag_size(frag++);
+- sum += skb_frag_size(frag++);
+- sum += skb_frag_size(frag++);
+- sum += skb_frag_size(frag++);
+-
+- /* Walk through fragments adding latest fragment, testing it, and
+- * then removing stale fragments from the sum.
+- */
+- for (stale = &skb_shinfo(skb)->frags[0];; stale++) {
+- int stale_size = skb_frag_size(stale);
+-
+- sum += skb_frag_size(frag++);
+-
+- /* The stale fragment may present us with a smaller
+- * descriptor than the actual fragment size. To account
+- * for that we need to remove all the data on the front and
+- * figure out what the remainder would be in the last
+- * descriptor associated with the fragment.
+- */
+- if (stale_size > I40E_MAX_DATA_PER_TXD) {
+- int align_pad = -(stale->page_offset) &
+- (I40E_MAX_READ_REQ_SIZE - 1);
+-
+- sum -= align_pad;
+- stale_size -= align_pad;
+-
+- do {
+- sum -= I40E_MAX_DATA_PER_TXD_ALIGNED;
+- stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED;
+- } while (stale_size > I40E_MAX_DATA_PER_TXD);
+- }
+-
+- /* if sum is negative we failed to make sufficient progress */
+- if (sum < 0)
+- return true;
+-
+- if (!nr_frags--)
+- break;
+-
+- sum -= stale_size;
+- }
+-
+- return false;
+-}
+-
+-/**
+- * __i40evf_maybe_stop_tx - 2nd level check for tx stop conditions
+- * @tx_ring: the ring to be checked
+- * @size: the size buffer we want to assure is available
+- *
+- * Returns -EBUSY if a stop is needed, else 0
+- **/
+-int __i40evf_maybe_stop_tx(struct i40e_ring *tx_ring, int size)
+-{
+- netif_stop_subqueue(tx_ring->netdev, tx_ring->queue_index);
+- /* Memory barrier before checking head and tail */
+- smp_mb();
+-
+- /* Check again in a case another CPU has just made room available. */
+- if (likely(I40E_DESC_UNUSED(tx_ring) < size))
+- return -EBUSY;
+-
+- /* A reprieve! - use start_queue because it doesn't call schedule */
+- netif_start_subqueue(tx_ring->netdev, tx_ring->queue_index);
+- ++tx_ring->tx_stats.restart_queue;
+- return 0;
+-}
+-
+-/**
+- * i40evf_tx_map - Build the Tx descriptor
+- * @tx_ring: ring to send buffer on
+- * @skb: send buffer
+- * @first: first buffer info buffer to use
+- * @tx_flags: collected send information
+- * @hdr_len: size of the packet header
+- * @td_cmd: the command field in the descriptor
+- * @td_offset: offset for checksum or crc
+- **/
+-static inline void i40evf_tx_map(struct i40e_ring *tx_ring, struct sk_buff *skb,
+- struct i40e_tx_buffer *first, u32 tx_flags,
+- const u8 hdr_len, u32 td_cmd, u32 td_offset)
+-{
+- unsigned int data_len = skb->data_len;
+- unsigned int size = skb_headlen(skb);
+- struct skb_frag_struct *frag;
+- struct i40e_tx_buffer *tx_bi;
+- struct i40e_tx_desc *tx_desc;
+- u16 i = tx_ring->next_to_use;
+- u32 td_tag = 0;
+- dma_addr_t dma;
+-
+- if (tx_flags & I40E_TX_FLAGS_HW_VLAN) {
+- td_cmd |= I40E_TX_DESC_CMD_IL2TAG1;
+- td_tag = (tx_flags & I40E_TX_FLAGS_VLAN_MASK) >>
+- I40E_TX_FLAGS_VLAN_SHIFT;
+- }
+-
+- first->tx_flags = tx_flags;
+-
+- dma = dma_map_single(tx_ring->dev, skb->data, size, DMA_TO_DEVICE);
+-
+- tx_desc = I40E_TX_DESC(tx_ring, i);
+- tx_bi = first;
+-
+- for (frag = &skb_shinfo(skb)->frags[0];; frag++) {
+- unsigned int max_data = I40E_MAX_DATA_PER_TXD_ALIGNED;
+-
+- if (dma_mapping_error(tx_ring->dev, dma))
+- goto dma_error;
+-
+- /* record length, and DMA address */
+- dma_unmap_len_set(tx_bi, len, size);
+- dma_unmap_addr_set(tx_bi, dma, dma);
+-
+- /* align size to end of page */
+- max_data += -dma & (I40E_MAX_READ_REQ_SIZE - 1);
+- tx_desc->buffer_addr = cpu_to_le64(dma);
+-
+- while (unlikely(size > I40E_MAX_DATA_PER_TXD)) {
+- tx_desc->cmd_type_offset_bsz =
+- build_ctob(td_cmd, td_offset,
+- max_data, td_tag);
+-
+- tx_desc++;
+- i++;
+-
+- if (i == tx_ring->count) {
+- tx_desc = I40E_TX_DESC(tx_ring, 0);
+- i = 0;
+- }
+-
+- dma += max_data;
+- size -= max_data;
+-
+- max_data = I40E_MAX_DATA_PER_TXD_ALIGNED;
+- tx_desc->buffer_addr = cpu_to_le64(dma);
+- }
+-
+- if (likely(!data_len))
+- break;
+-
+- tx_desc->cmd_type_offset_bsz = build_ctob(td_cmd, td_offset,
+- size, td_tag);
+-
+- tx_desc++;
+- i++;
+-
+- if (i == tx_ring->count) {
+- tx_desc = I40E_TX_DESC(tx_ring, 0);
+- i = 0;
+- }
+-
+- size = skb_frag_size(frag);
+- data_len -= size;
+-
+- dma = skb_frag_dma_map(tx_ring->dev, frag, 0, size,
+- DMA_TO_DEVICE);
+-
+- tx_bi = &tx_ring->tx_bi[i];
+- }
+-
+- netdev_tx_sent_queue(txring_txq(tx_ring), first->bytecount);
+-
+- i++;
+- if (i == tx_ring->count)
+- i = 0;
+-
+- tx_ring->next_to_use = i;
+-
+- i40e_maybe_stop_tx(tx_ring, DESC_NEEDED);
+-
+- /* write last descriptor with RS and EOP bits */
+- td_cmd |= I40E_TXD_CMD;
+- tx_desc->cmd_type_offset_bsz =
+- build_ctob(td_cmd, td_offset, size, td_tag);
+-
+- /* Force memory writes to complete before letting h/w know there
+- * are new descriptors to fetch.
+- *
+- * We also use this memory barrier to make certain all of the
+- * status bits have been updated before next_to_watch is written.
+- */
+- wmb();
+-
+- /* set next_to_watch value indicating a packet is present */
+- first->next_to_watch = tx_desc;
+-
+- /* notify HW of packet */
+- if (netif_xmit_stopped(txring_txq(tx_ring)) || !skb->xmit_more) {
+- writel(i, tx_ring->tail);
+-
+- /* we need this if more than one processor can write to our tail
+- * at a time, it synchronizes IO on IA64/Altix systems
+- */
+- mmiowb();
+- }
+-
+- return;
+-
+-dma_error:
+- dev_info(tx_ring->dev, "TX DMA map failed\n");
+-
+- /* clear dma mappings for failed tx_bi map */
+- for (;;) {
+- tx_bi = &tx_ring->tx_bi[i];
+- i40e_unmap_and_free_tx_resource(tx_ring, tx_bi);
+- if (tx_bi == first)
+- break;
+- if (i == 0)
+- i = tx_ring->count;
+- i--;
+- }
+-
+- tx_ring->next_to_use = i;
+-}
+-
+-/**
+- * i40e_xmit_frame_ring - Sends buffer on Tx ring
+- * @skb: send buffer
+- * @tx_ring: ring to send buffer on
+- *
+- * Returns NETDEV_TX_OK if sent, else an error code
+- **/
+-static netdev_tx_t i40e_xmit_frame_ring(struct sk_buff *skb,
+- struct i40e_ring *tx_ring)
+-{
+- u64 cd_type_cmd_tso_mss = I40E_TX_DESC_DTYPE_CONTEXT;
+- u32 cd_tunneling = 0, cd_l2tag2 = 0;
+- struct i40e_tx_buffer *first;
+- u32 td_offset = 0;
+- u32 tx_flags = 0;
+- __be16 protocol;
+- u32 td_cmd = 0;
+- u8 hdr_len = 0;
+- int tso, count;
+-
+- /* prefetch the data, we'll need it later */
+- prefetch(skb->data);
+-
+- i40e_trace(xmit_frame_ring, skb, tx_ring);
+-
+- count = i40e_xmit_descriptor_count(skb);
+- if (i40e_chk_linearize(skb, count)) {
+- if (__skb_linearize(skb)) {
+- dev_kfree_skb_any(skb);
+- return NETDEV_TX_OK;
+- }
+- count = i40e_txd_use_count(skb->len);
+- tx_ring->tx_stats.tx_linearize++;
+- }
+-
+- /* need: 1 descriptor per page * PAGE_SIZE/I40E_MAX_DATA_PER_TXD,
+- * + 1 desc for skb_head_len/I40E_MAX_DATA_PER_TXD,
+- * + 4 desc gap to avoid the cache line where head is,
+- * + 1 desc for context descriptor,
+- * otherwise try next time
+- */
+- if (i40e_maybe_stop_tx(tx_ring, count + 4 + 1)) {
+- tx_ring->tx_stats.tx_busy++;
+- return NETDEV_TX_BUSY;
+- }
+-
+- /* record the location of the first descriptor for this packet */
+- first = &tx_ring->tx_bi[tx_ring->next_to_use];
+- first->skb = skb;
+- first->bytecount = skb->len;
+- first->gso_segs = 1;
+-
+- /* prepare the xmit flags */
+- if (i40evf_tx_prepare_vlan_flags(skb, tx_ring, &tx_flags))
+- goto out_drop;
+-
+- /* obtain protocol of skb */
+- protocol = vlan_get_protocol(skb);
+-
+- /* setup IPv4/IPv6 offloads */
+- if (protocol == htons(ETH_P_IP))
+- tx_flags |= I40E_TX_FLAGS_IPV4;
+- else if (protocol == htons(ETH_P_IPV6))
+- tx_flags |= I40E_TX_FLAGS_IPV6;
+-
+- tso = i40e_tso(first, &hdr_len, &cd_type_cmd_tso_mss);
+-
+- if (tso < 0)
+- goto out_drop;
+- else if (tso)
+- tx_flags |= I40E_TX_FLAGS_TSO;
+-
+- /* Always offload the checksum, since it's in the data descriptor */
+- tso = i40e_tx_enable_csum(skb, &tx_flags, &td_cmd, &td_offset,
+- tx_ring, &cd_tunneling);
+- if (tso < 0)
+- goto out_drop;
+-
+- skb_tx_timestamp(skb);
+-
+- /* always enable CRC insertion offload */
+- td_cmd |= I40E_TX_DESC_CMD_ICRC;
+-
+- i40e_create_tx_ctx(tx_ring, cd_type_cmd_tso_mss,
+- cd_tunneling, cd_l2tag2);
+-
+- i40evf_tx_map(tx_ring, skb, first, tx_flags, hdr_len,
+- td_cmd, td_offset);
+-
+- return NETDEV_TX_OK;
+-
+-out_drop:
+- i40e_trace(xmit_frame_ring_drop, first->skb, tx_ring);
+- dev_kfree_skb_any(first->skb);
+- first->skb = NULL;
+- return NETDEV_TX_OK;
+-}
+-
+-/**
+- * i40evf_xmit_frame - Selects the correct VSI and Tx queue to send buffer
+- * @skb: send buffer
+- * @netdev: network interface device structure
+- *
+- * Returns NETDEV_TX_OK if sent, else an error code
+- **/
+-netdev_tx_t i40evf_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- struct i40e_ring *tx_ring = &adapter->tx_rings[skb->queue_mapping];
+-
+- /* hardware can't handle really short frames, hardware padding works
+- * beyond this point
+- */
+- if (unlikely(skb->len < I40E_MIN_TX_LEN)) {
+- if (skb_pad(skb, I40E_MIN_TX_LEN - skb->len))
+- return NETDEV_TX_OK;
+- skb->len = I40E_MIN_TX_LEN;
+- skb_set_tail_pointer(skb, I40E_MIN_TX_LEN);
+- }
+-
+- return i40e_xmit_frame_ring(skb, tx_ring);
+-}
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.h b/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
+deleted file mode 100644
+index 3b5a63b3236eb..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
++++ /dev/null
+@@ -1,524 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_TXRX_H_
+-#define _I40E_TXRX_H_
+-
+-/* Interrupt Throttling and Rate Limiting Goodies */
+-#define I40E_DEFAULT_IRQ_WORK 256
+-
+-/* The datasheet for the X710 and XL710 indicate that the maximum value for
+- * the ITR is 8160usec which is then called out as 0xFF0 with a 2usec
+- * resolution. 8160 is 0x1FE0 when written out in hex. So instead of storing
+- * the register value which is divided by 2 lets use the actual values and
+- * avoid an excessive amount of translation.
+- */
+-#define I40E_ITR_DYNAMIC 0x8000 /* use top bit as a flag */
+-#define I40E_ITR_MASK 0x1FFE /* mask for ITR register value */
+-#define I40E_MIN_ITR 2 /* reg uses 2 usec resolution */
+-#define I40E_ITR_100K 10 /* all values below must be even */
+-#define I40E_ITR_50K 20
+-#define I40E_ITR_20K 50
+-#define I40E_ITR_18K 60
+-#define I40E_ITR_8K 122
+-#define I40E_MAX_ITR 8160 /* maximum value as per datasheet */
+-#define ITR_TO_REG(setting) ((setting) & ~I40E_ITR_DYNAMIC)
+-#define ITR_REG_ALIGN(setting) __ALIGN_MASK(setting, ~I40E_ITR_MASK)
+-#define ITR_IS_DYNAMIC(setting) (!!((setting) & I40E_ITR_DYNAMIC))
+-
+-#define I40E_ITR_RX_DEF (I40E_ITR_20K | I40E_ITR_DYNAMIC)
+-#define I40E_ITR_TX_DEF (I40E_ITR_20K | I40E_ITR_DYNAMIC)
+-
+-/* 0x40 is the enable bit for interrupt rate limiting, and must be set if
+- * the value of the rate limit is non-zero
+- */
+-#define INTRL_ENA BIT(6)
+-#define I40E_MAX_INTRL 0x3B /* reg uses 4 usec resolution */
+-#define INTRL_REG_TO_USEC(intrl) ((intrl & ~INTRL_ENA) << 2)
+-#define INTRL_USEC_TO_REG(set) ((set) ? ((set) >> 2) | INTRL_ENA : 0)
+-#define I40E_INTRL_8K 125 /* 8000 ints/sec */
+-#define I40E_INTRL_62K 16 /* 62500 ints/sec */
+-#define I40E_INTRL_83K 12 /* 83333 ints/sec */
+-
+-#define I40E_QUEUE_END_OF_LIST 0x7FF
+-
+-/* this enum matches hardware bits and is meant to be used by DYN_CTLN
+- * registers and QINT registers or more generally anywhere in the manual
+- * mentioning ITR_INDX, ITR_NONE cannot be used as an index 'n' into any
+- * register but instead is a special value meaning "don't update" ITR0/1/2.
+- */
+-enum i40e_dyn_idx_t {
+- I40E_IDX_ITR0 = 0,
+- I40E_IDX_ITR1 = 1,
+- I40E_IDX_ITR2 = 2,
+- I40E_ITR_NONE = 3 /* ITR_NONE must not be used as an index */
+-};
+-
+-/* these are indexes into ITRN registers */
+-#define I40E_RX_ITR I40E_IDX_ITR0
+-#define I40E_TX_ITR I40E_IDX_ITR1
+-#define I40E_PE_ITR I40E_IDX_ITR2
+-
+-/* Supported RSS offloads */
+-#define I40E_DEFAULT_RSS_HENA ( \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_UDP) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_SCTP) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_TCP) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_OTHER) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_FRAG_IPV4) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_UDP) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_TCP) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_SCTP) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_OTHER) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_FRAG_IPV6) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_L2_PAYLOAD))
+-
+-#define I40E_DEFAULT_RSS_HENA_EXPANDED (I40E_DEFAULT_RSS_HENA | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV4_UDP) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV4_UDP) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_TCP_SYN_NO_ACK) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV6_UDP) | \
+- BIT_ULL(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV6_UDP))
+-
+-/* Supported Rx Buffer Sizes (a multiple of 128) */
+-#define I40E_RXBUFFER_256 256
+-#define I40E_RXBUFFER_1536 1536 /* 128B aligned standard Ethernet frame */
+-#define I40E_RXBUFFER_2048 2048
+-#define I40E_RXBUFFER_3072 3072 /* Used for large frames w/ padding */
+-#define I40E_MAX_RXBUFFER 9728 /* largest size for single descriptor */
+-
+-/* NOTE: netdev_alloc_skb reserves up to 64 bytes, NET_IP_ALIGN means we
+- * reserve 2 more, and skb_shared_info adds an additional 384 bytes more,
+- * this adds up to 512 bytes of extra data meaning the smallest allocation
+- * we could have is 1K.
+- * i.e. RXBUFFER_256 --> 960 byte skb (size-1024 slab)
+- * i.e. RXBUFFER_512 --> 1216 byte skb (size-2048 slab)
+- */
+-#define I40E_RX_HDR_SIZE I40E_RXBUFFER_256
+-#define I40E_PACKET_HDR_PAD (ETH_HLEN + ETH_FCS_LEN + (VLAN_HLEN * 2))
+-#define i40e_rx_desc i40e_32byte_rx_desc
+-
+-#define I40E_RX_DMA_ATTR \
+- (DMA_ATTR_SKIP_CPU_SYNC | DMA_ATTR_WEAK_ORDERING)
+-
+-/* Attempt to maximize the headroom available for incoming frames. We
+- * use a 2K buffer for receives and need 1536/1534 to store the data for
+- * the frame. This leaves us with 512 bytes of room. From that we need
+- * to deduct the space needed for the shared info and the padding needed
+- * to IP align the frame.
+- *
+- * Note: For cache line sizes 256 or larger this value is going to end
+- * up negative. In these cases we should fall back to the legacy
+- * receive path.
+- */
+-#if (PAGE_SIZE < 8192)
+-#define I40E_2K_TOO_SMALL_WITH_PADDING \
+-((NET_SKB_PAD + I40E_RXBUFFER_1536) > SKB_WITH_OVERHEAD(I40E_RXBUFFER_2048))
+-
+-static inline int i40e_compute_pad(int rx_buf_len)
+-{
+- int page_size, pad_size;
+-
+- page_size = ALIGN(rx_buf_len, PAGE_SIZE / 2);
+- pad_size = SKB_WITH_OVERHEAD(page_size) - rx_buf_len;
+-
+- return pad_size;
+-}
+-
+-static inline int i40e_skb_pad(void)
+-{
+- int rx_buf_len;
+-
+- /* If a 2K buffer cannot handle a standard Ethernet frame then
+- * optimize padding for a 3K buffer instead of a 1.5K buffer.
+- *
+- * For a 3K buffer we need to add enough padding to allow for
+- * tailroom due to NET_IP_ALIGN possibly shifting us out of
+- * cache-line alignment.
+- */
+- if (I40E_2K_TOO_SMALL_WITH_PADDING)
+- rx_buf_len = I40E_RXBUFFER_3072 + SKB_DATA_ALIGN(NET_IP_ALIGN);
+- else
+- rx_buf_len = I40E_RXBUFFER_1536;
+-
+- /* if needed make room for NET_IP_ALIGN */
+- rx_buf_len -= NET_IP_ALIGN;
+-
+- return i40e_compute_pad(rx_buf_len);
+-}
+-
+-#define I40E_SKB_PAD i40e_skb_pad()
+-#else
+-#define I40E_2K_TOO_SMALL_WITH_PADDING false
+-#define I40E_SKB_PAD (NET_SKB_PAD + NET_IP_ALIGN)
+-#endif
+-
+-/**
+- * i40e_test_staterr - tests bits in Rx descriptor status and error fields
+- * @rx_desc: pointer to receive descriptor (in le64 format)
+- * @stat_err_bits: value to mask
+- *
+- * This function does some fast chicanery in order to return the
+- * value of the mask which is really only used for boolean tests.
+- * The status_error_len doesn't need to be shifted because it begins
+- * at offset zero.
+- */
+-static inline bool i40e_test_staterr(union i40e_rx_desc *rx_desc,
+- const u64 stat_err_bits)
+-{
+- return !!(rx_desc->wb.qword1.status_error_len &
+- cpu_to_le64(stat_err_bits));
+-}
+-
+-/* How many Rx Buffers do we bundle into one write to the hardware ? */
+-#define I40E_RX_BUFFER_WRITE 32 /* Must be power of 2 */
+-#define I40E_RX_INCREMENT(r, i) \
+- do { \
+- (i)++; \
+- if ((i) == (r)->count) \
+- i = 0; \
+- r->next_to_clean = i; \
+- } while (0)
+-
+-#define I40E_RX_NEXT_DESC(r, i, n) \
+- do { \
+- (i)++; \
+- if ((i) == (r)->count) \
+- i = 0; \
+- (n) = I40E_RX_DESC((r), (i)); \
+- } while (0)
+-
+-#define I40E_RX_NEXT_DESC_PREFETCH(r, i, n) \
+- do { \
+- I40E_RX_NEXT_DESC((r), (i), (n)); \
+- prefetch((n)); \
+- } while (0)
+-
+-#define I40E_MAX_BUFFER_TXD 8
+-#define I40E_MIN_TX_LEN 17
+-
+-/* The size limit for a transmit buffer in a descriptor is (16K - 1).
+- * In order to align with the read requests we will align the value to
+- * the nearest 4K which represents our maximum read request size.
+- */
+-#define I40E_MAX_READ_REQ_SIZE 4096
+-#define I40E_MAX_DATA_PER_TXD (16 * 1024 - 1)
+-#define I40E_MAX_DATA_PER_TXD_ALIGNED \
+- (I40E_MAX_DATA_PER_TXD & ~(I40E_MAX_READ_REQ_SIZE - 1))
+-
+-/**
+- * i40e_txd_use_count - estimate the number of descriptors needed for Tx
+- * @size: transmit request size in bytes
+- *
+- * Due to hardware alignment restrictions (4K alignment), we need to
+- * assume that we can have no more than 12K of data per descriptor, even
+- * though each descriptor can take up to 16K - 1 bytes of aligned memory.
+- * Thus, we need to divide by 12K. But division is slow! Instead,
+- * we decompose the operation into shifts and one relatively cheap
+- * multiply operation.
+- *
+- * To divide by 12K, we first divide by 4K, then divide by 3:
+- * To divide by 4K, shift right by 12 bits
+- * To divide by 3, multiply by 85, then divide by 256
+- * (Divide by 256 is done by shifting right by 8 bits)
+- * Finally, we add one to round up. Because 256 isn't an exact multiple of
+- * 3, we'll underestimate near each multiple of 12K. This is actually more
+- * accurate as we have 4K - 1 of wiggle room that we can fit into the last
+- * segment. For our purposes this is accurate out to 1M which is orders of
+- * magnitude greater than our largest possible GSO size.
+- *
+- * This would then be implemented as:
+- * return (((size >> 12) * 85) >> 8) + 1;
+- *
+- * Since multiplication and division are commutative, we can reorder
+- * operations into:
+- * return ((size * 85) >> 20) + 1;
+- */
+-static inline unsigned int i40e_txd_use_count(unsigned int size)
+-{
+- return ((size * 85) >> 20) + 1;
+-}
+-
+-/* Tx Descriptors needed, worst case */
+-#define DESC_NEEDED (MAX_SKB_FRAGS + 6)
+-#define I40E_MIN_DESC_PENDING 4
+-
+-#define I40E_TX_FLAGS_HW_VLAN BIT(1)
+-#define I40E_TX_FLAGS_SW_VLAN BIT(2)
+-#define I40E_TX_FLAGS_TSO BIT(3)
+-#define I40E_TX_FLAGS_IPV4 BIT(4)
+-#define I40E_TX_FLAGS_IPV6 BIT(5)
+-#define I40E_TX_FLAGS_FCCRC BIT(6)
+-#define I40E_TX_FLAGS_FSO BIT(7)
+-#define I40E_TX_FLAGS_FD_SB BIT(9)
+-#define I40E_TX_FLAGS_VXLAN_TUNNEL BIT(10)
+-#define I40E_TX_FLAGS_VLAN_MASK 0xffff0000
+-#define I40E_TX_FLAGS_VLAN_PRIO_MASK 0xe0000000
+-#define I40E_TX_FLAGS_VLAN_PRIO_SHIFT 29
+-#define I40E_TX_FLAGS_VLAN_SHIFT 16
+-
+-struct i40e_tx_buffer {
+- struct i40e_tx_desc *next_to_watch;
+- union {
+- struct sk_buff *skb;
+- void *raw_buf;
+- };
+- unsigned int bytecount;
+- unsigned short gso_segs;
+-
+- DEFINE_DMA_UNMAP_ADDR(dma);
+- DEFINE_DMA_UNMAP_LEN(len);
+- u32 tx_flags;
+-};
+-
+-struct i40e_rx_buffer {
+- dma_addr_t dma;
+- struct page *page;
+-#if (BITS_PER_LONG > 32) || (PAGE_SIZE >= 65536)
+- __u32 page_offset;
+-#else
+- __u16 page_offset;
+-#endif
+- __u16 pagecnt_bias;
+-};
+-
+-struct i40e_queue_stats {
+- u64 packets;
+- u64 bytes;
+-};
+-
+-struct i40e_tx_queue_stats {
+- u64 restart_queue;
+- u64 tx_busy;
+- u64 tx_done_old;
+- u64 tx_linearize;
+- u64 tx_force_wb;
+- int prev_pkt_ctr;
+- u64 tx_lost_interrupt;
+-};
+-
+-struct i40e_rx_queue_stats {
+- u64 non_eop_descs;
+- u64 alloc_page_failed;
+- u64 alloc_buff_failed;
+- u64 page_reuse_count;
+- u64 realloc_count;
+-};
+-
+-enum i40e_ring_state_t {
+- __I40E_TX_FDIR_INIT_DONE,
+- __I40E_TX_XPS_INIT_DONE,
+- __I40E_RING_STATE_NBITS /* must be last */
+-};
+-
+-/* some useful defines for virtchannel interface, which
+- * is the only remaining user of header split
+- */
+-#define I40E_RX_DTYPE_NO_SPLIT 0
+-#define I40E_RX_DTYPE_HEADER_SPLIT 1
+-#define I40E_RX_DTYPE_SPLIT_ALWAYS 2
+-#define I40E_RX_SPLIT_L2 0x1
+-#define I40E_RX_SPLIT_IP 0x2
+-#define I40E_RX_SPLIT_TCP_UDP 0x4
+-#define I40E_RX_SPLIT_SCTP 0x8
+-
+-/* struct that defines a descriptor ring, associated with a VSI */
+-struct i40e_ring {
+- struct i40e_ring *next; /* pointer to next ring in q_vector */
+- void *desc; /* Descriptor ring memory */
+- struct device *dev; /* Used for DMA mapping */
+- struct net_device *netdev; /* netdev ring maps to */
+- union {
+- struct i40e_tx_buffer *tx_bi;
+- struct i40e_rx_buffer *rx_bi;
+- };
+- DECLARE_BITMAP(state, __I40E_RING_STATE_NBITS);
+- u16 queue_index; /* Queue number of ring */
+- u8 dcb_tc; /* Traffic class of ring */
+- u8 __iomem *tail;
+-
+- /* high bit set means dynamic, use accessors routines to read/write.
+- * hardware only supports 2us resolution for the ITR registers.
+- * these values always store the USER setting, and must be converted
+- * before programming to a register.
+- */
+- u16 itr_setting;
+-
+- u16 count; /* Number of descriptors */
+- u16 reg_idx; /* HW register index of the ring */
+- u16 rx_buf_len;
+-
+- /* used in interrupt processing */
+- u16 next_to_use;
+- u16 next_to_clean;
+-
+- u8 atr_sample_rate;
+- u8 atr_count;
+-
+- bool ring_active; /* is ring online or not */
+- bool arm_wb; /* do something to arm write back */
+- u8 packet_stride;
+-
+- u16 flags;
+-#define I40E_TXR_FLAGS_WB_ON_ITR BIT(0)
+-#define I40E_RXR_FLAGS_BUILD_SKB_ENABLED BIT(1)
+-
+- /* stats structs */
+- struct i40e_queue_stats stats;
+- struct u64_stats_sync syncp;
+- union {
+- struct i40e_tx_queue_stats tx_stats;
+- struct i40e_rx_queue_stats rx_stats;
+- };
+-
+- unsigned int size; /* length of descriptor ring in bytes */
+- dma_addr_t dma; /* physical address of ring */
+-
+- struct i40e_vsi *vsi; /* Backreference to associated VSI */
+- struct i40e_q_vector *q_vector; /* Backreference to associated vector */
+-
+- struct rcu_head rcu; /* to avoid race on free */
+- u16 next_to_alloc;
+- struct sk_buff *skb; /* When i40evf_clean_rx_ring_irq() must
+- * return before it sees the EOP for
+- * the current packet, we save that skb
+- * here and resume receiving this
+- * packet the next time
+- * i40evf_clean_rx_ring_irq() is called
+- * for this ring.
+- */
+-} ____cacheline_internodealigned_in_smp;
+-
+-static inline bool ring_uses_build_skb(struct i40e_ring *ring)
+-{
+- return !!(ring->flags & I40E_RXR_FLAGS_BUILD_SKB_ENABLED);
+-}
+-
+-static inline void set_ring_build_skb_enabled(struct i40e_ring *ring)
+-{
+- ring->flags |= I40E_RXR_FLAGS_BUILD_SKB_ENABLED;
+-}
+-
+-static inline void clear_ring_build_skb_enabled(struct i40e_ring *ring)
+-{
+- ring->flags &= ~I40E_RXR_FLAGS_BUILD_SKB_ENABLED;
+-}
+-
+-#define I40E_ITR_ADAPTIVE_MIN_INC 0x0002
+-#define I40E_ITR_ADAPTIVE_MIN_USECS 0x0002
+-#define I40E_ITR_ADAPTIVE_MAX_USECS 0x007e
+-#define I40E_ITR_ADAPTIVE_LATENCY 0x8000
+-#define I40E_ITR_ADAPTIVE_BULK 0x0000
+-#define ITR_IS_BULK(x) (!((x) & I40E_ITR_ADAPTIVE_LATENCY))
+-
+-struct i40e_ring_container {
+- struct i40e_ring *ring; /* pointer to linked list of ring(s) */
+- unsigned long next_update; /* jiffies value of next update */
+- unsigned int total_bytes; /* total bytes processed this int */
+- unsigned int total_packets; /* total packets processed this int */
+- u16 count;
+- u16 target_itr; /* target ITR setting for ring(s) */
+- u16 current_itr; /* current ITR setting for ring(s) */
+-};
+-
+-/* iterator for handling rings in ring container */
+-#define i40e_for_each_ring(pos, head) \
+- for (pos = (head).ring; pos != NULL; pos = pos->next)
+-
+-static inline unsigned int i40e_rx_pg_order(struct i40e_ring *ring)
+-{
+-#if (PAGE_SIZE < 8192)
+- if (ring->rx_buf_len > (PAGE_SIZE / 2))
+- return 1;
+-#endif
+- return 0;
+-}
+-
+-#define i40e_rx_pg_size(_ring) (PAGE_SIZE << i40e_rx_pg_order(_ring))
+-
+-bool i40evf_alloc_rx_buffers(struct i40e_ring *rxr, u16 cleaned_count);
+-netdev_tx_t i40evf_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
+-void i40evf_clean_tx_ring(struct i40e_ring *tx_ring);
+-void i40evf_clean_rx_ring(struct i40e_ring *rx_ring);
+-int i40evf_setup_tx_descriptors(struct i40e_ring *tx_ring);
+-int i40evf_setup_rx_descriptors(struct i40e_ring *rx_ring);
+-void i40evf_free_tx_resources(struct i40e_ring *tx_ring);
+-void i40evf_free_rx_resources(struct i40e_ring *rx_ring);
+-int i40evf_napi_poll(struct napi_struct *napi, int budget);
+-void i40evf_force_wb(struct i40e_vsi *vsi, struct i40e_q_vector *q_vector);
+-u32 i40evf_get_tx_pending(struct i40e_ring *ring, bool in_sw);
+-void i40evf_detect_recover_hung(struct i40e_vsi *vsi);
+-int __i40evf_maybe_stop_tx(struct i40e_ring *tx_ring, int size);
+-bool __i40evf_chk_linearize(struct sk_buff *skb);
+-
+-/**
+- * i40e_xmit_descriptor_count - calculate number of Tx descriptors needed
+- * @skb: send buffer
+- * @tx_ring: ring to send buffer on
+- *
+- * Returns number of data descriptors needed for this skb. Returns 0 to indicate
+- * there is not enough descriptors available in this ring since we need at least
+- * one descriptor.
+- **/
+-static inline int i40e_xmit_descriptor_count(struct sk_buff *skb)
+-{
+- const struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[0];
+- unsigned int nr_frags = skb_shinfo(skb)->nr_frags;
+- int count = 0, size = skb_headlen(skb);
+-
+- for (;;) {
+- count += i40e_txd_use_count(size);
+-
+- if (!nr_frags--)
+- break;
+-
+- size = skb_frag_size(frag++);
+- }
+-
+- return count;
+-}
+-
+-/**
+- * i40e_maybe_stop_tx - 1st level check for Tx stop conditions
+- * @tx_ring: the ring to be checked
+- * @size: the size buffer we want to assure is available
+- *
+- * Returns 0 if stop is not needed
+- **/
+-static inline int i40e_maybe_stop_tx(struct i40e_ring *tx_ring, int size)
+-{
+- if (likely(I40E_DESC_UNUSED(tx_ring) >= size))
+- return 0;
+- return __i40evf_maybe_stop_tx(tx_ring, size);
+-}
+-
+-/**
+- * i40e_chk_linearize - Check if there are more than 8 fragments per packet
+- * @skb: send buffer
+- * @count: number of buffers used
+- *
+- * Note: Our HW can't scatter-gather more than 8 fragments to build
+- * a packet on the wire and so we need to figure out the cases where we
+- * need to linearize the skb.
+- **/
+-static inline bool i40e_chk_linearize(struct sk_buff *skb, int count)
+-{
+- /* Both TSO and single send will work if count is less than 8 */
+- if (likely(count < I40E_MAX_BUFFER_TXD))
+- return false;
+-
+- if (skb_is_gso(skb))
+- return __i40evf_chk_linearize(skb);
+-
+- /* we can support up to 8 data buffers for a single send */
+- return count != I40E_MAX_BUFFER_TXD;
+-}
+-/**
+- * @ring: Tx ring to find the netdev equivalent of
+- **/
+-static inline struct netdev_queue *txring_txq(const struct i40e_ring *ring)
+-{
+- return netdev_get_tx_queue(ring->netdev, ring->queue_index);
+-}
+-#endif /* _I40E_TXRX_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_type.h b/drivers/net/ethernet/intel/i40evf/i40e_type.h
+deleted file mode 100644
+index 094387db3c110..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40e_type.h
++++ /dev/null
+@@ -1,1496 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40E_TYPE_H_
+-#define _I40E_TYPE_H_
+-
+-#include "i40e_status.h"
+-#include "i40e_osdep.h"
+-#include "i40e_register.h"
+-#include "i40e_adminq.h"
+-#include "i40e_hmc.h"
+-#include "i40e_lan_hmc.h"
+-#include "i40e_devids.h"
+-
+-/* I40E_MASK is a macro used on 32 bit registers */
+-#define I40E_MASK(mask, shift) ((u32)(mask) << (shift))
+-
+-#define I40E_MAX_VSI_QP 16
+-#define I40E_MAX_VF_VSI 3
+-#define I40E_MAX_CHAINED_RX_BUFFERS 5
+-#define I40E_MAX_PF_UDP_OFFLOAD_PORTS 16
+-
+-/* Max default timeout in ms, */
+-#define I40E_MAX_NVM_TIMEOUT 18000
+-
+-/* Max timeout in ms for the phy to respond */
+-#define I40E_MAX_PHY_TIMEOUT 500
+-
+-/* Switch from ms to the 1usec global time (this is the GTIME resolution) */
+-#define I40E_MS_TO_GTIME(time) ((time) * 1000)
+-
+-/* forward declaration */
+-struct i40e_hw;
+-typedef void (*I40E_ADMINQ_CALLBACK)(struct i40e_hw *, struct i40e_aq_desc *);
+-
+-/* Data type manipulation macros. */
+-
+-#define I40E_DESC_UNUSED(R) \
+- ((((R)->next_to_clean > (R)->next_to_use) ? 0 : (R)->count) + \
+- (R)->next_to_clean - (R)->next_to_use - 1)
+-
+-/* bitfields for Tx queue mapping in QTX_CTL */
+-#define I40E_QTX_CTL_VF_QUEUE 0x0
+-#define I40E_QTX_CTL_VM_QUEUE 0x1
+-#define I40E_QTX_CTL_PF_QUEUE 0x2
+-
+-/* debug masks - set these bits in hw->debug_mask to control output */
+-enum i40e_debug_mask {
+- I40E_DEBUG_INIT = 0x00000001,
+- I40E_DEBUG_RELEASE = 0x00000002,
+-
+- I40E_DEBUG_LINK = 0x00000010,
+- I40E_DEBUG_PHY = 0x00000020,
+- I40E_DEBUG_HMC = 0x00000040,
+- I40E_DEBUG_NVM = 0x00000080,
+- I40E_DEBUG_LAN = 0x00000100,
+- I40E_DEBUG_FLOW = 0x00000200,
+- I40E_DEBUG_DCB = 0x00000400,
+- I40E_DEBUG_DIAG = 0x00000800,
+- I40E_DEBUG_FD = 0x00001000,
+- I40E_DEBUG_PACKAGE = 0x00002000,
+-
+- I40E_DEBUG_AQ_MESSAGE = 0x01000000,
+- I40E_DEBUG_AQ_DESCRIPTOR = 0x02000000,
+- I40E_DEBUG_AQ_DESC_BUFFER = 0x04000000,
+- I40E_DEBUG_AQ_COMMAND = 0x06000000,
+- I40E_DEBUG_AQ = 0x0F000000,
+-
+- I40E_DEBUG_USER = 0xF0000000,
+-
+- I40E_DEBUG_ALL = 0xFFFFFFFF
+-};
+-
+-/* These are structs for managing the hardware information and the operations.
+- * The structures of function pointers are filled out at init time when we
+- * know for sure exactly which hardware we're working with. This gives us the
+- * flexibility of using the same main driver code but adapting to slightly
+- * different hardware needs as new parts are developed. For this architecture,
+- * the Firmware and AdminQ are intended to insulate the driver from most of the
+- * future changes, but these structures will also do part of the job.
+- */
+-enum i40e_mac_type {
+- I40E_MAC_UNKNOWN = 0,
+- I40E_MAC_XL710,
+- I40E_MAC_VF,
+- I40E_MAC_X722,
+- I40E_MAC_X722_VF,
+- I40E_MAC_GENERIC,
+-};
+-
+-enum i40e_media_type {
+- I40E_MEDIA_TYPE_UNKNOWN = 0,
+- I40E_MEDIA_TYPE_FIBER,
+- I40E_MEDIA_TYPE_BASET,
+- I40E_MEDIA_TYPE_BACKPLANE,
+- I40E_MEDIA_TYPE_CX4,
+- I40E_MEDIA_TYPE_DA,
+- I40E_MEDIA_TYPE_VIRTUAL
+-};
+-
+-enum i40e_fc_mode {
+- I40E_FC_NONE = 0,
+- I40E_FC_RX_PAUSE,
+- I40E_FC_TX_PAUSE,
+- I40E_FC_FULL,
+- I40E_FC_PFC,
+- I40E_FC_DEFAULT
+-};
+-
+-enum i40e_set_fc_aq_failures {
+- I40E_SET_FC_AQ_FAIL_NONE = 0,
+- I40E_SET_FC_AQ_FAIL_GET = 1,
+- I40E_SET_FC_AQ_FAIL_SET = 2,
+- I40E_SET_FC_AQ_FAIL_UPDATE = 4,
+- I40E_SET_FC_AQ_FAIL_SET_UPDATE = 6
+-};
+-
+-enum i40e_vsi_type {
+- I40E_VSI_MAIN = 0,
+- I40E_VSI_VMDQ1 = 1,
+- I40E_VSI_VMDQ2 = 2,
+- I40E_VSI_CTRL = 3,
+- I40E_VSI_FCOE = 4,
+- I40E_VSI_MIRROR = 5,
+- I40E_VSI_SRIOV = 6,
+- I40E_VSI_FDIR = 7,
+- I40E_VSI_TYPE_UNKNOWN
+-};
+-
+-enum i40e_queue_type {
+- I40E_QUEUE_TYPE_RX = 0,
+- I40E_QUEUE_TYPE_TX,
+- I40E_QUEUE_TYPE_PE_CEQ,
+- I40E_QUEUE_TYPE_UNKNOWN
+-};
+-
+-struct i40e_link_status {
+- enum i40e_aq_phy_type phy_type;
+- enum i40e_aq_link_speed link_speed;
+- u8 link_info;
+- u8 an_info;
+- u8 req_fec_info;
+- u8 fec_info;
+- u8 ext_info;
+- u8 loopback;
+- /* is Link Status Event notification to SW enabled */
+- bool lse_enable;
+- u16 max_frame_size;
+- bool crc_enable;
+- u8 pacing;
+- u8 requested_speeds;
+- u8 module_type[3];
+- /* 1st byte: module identifier */
+-#define I40E_MODULE_TYPE_SFP 0x03
+-#define I40E_MODULE_TYPE_QSFP 0x0D
+- /* 2nd byte: ethernet compliance codes for 10/40G */
+-#define I40E_MODULE_TYPE_40G_ACTIVE 0x01
+-#define I40E_MODULE_TYPE_40G_LR4 0x02
+-#define I40E_MODULE_TYPE_40G_SR4 0x04
+-#define I40E_MODULE_TYPE_40G_CR4 0x08
+-#define I40E_MODULE_TYPE_10G_BASE_SR 0x10
+-#define I40E_MODULE_TYPE_10G_BASE_LR 0x20
+-#define I40E_MODULE_TYPE_10G_BASE_LRM 0x40
+-#define I40E_MODULE_TYPE_10G_BASE_ER 0x80
+- /* 3rd byte: ethernet compliance codes for 1G */
+-#define I40E_MODULE_TYPE_1000BASE_SX 0x01
+-#define I40E_MODULE_TYPE_1000BASE_LX 0x02
+-#define I40E_MODULE_TYPE_1000BASE_CX 0x04
+-#define I40E_MODULE_TYPE_1000BASE_T 0x08
+-};
+-
+-struct i40e_phy_info {
+- struct i40e_link_status link_info;
+- struct i40e_link_status link_info_old;
+- bool get_link_info;
+- enum i40e_media_type media_type;
+- /* all the phy types the NVM is capable of */
+- u64 phy_types;
+-};
+-
+-#define I40E_CAP_PHY_TYPE_SGMII BIT_ULL(I40E_PHY_TYPE_SGMII)
+-#define I40E_CAP_PHY_TYPE_1000BASE_KX BIT_ULL(I40E_PHY_TYPE_1000BASE_KX)
+-#define I40E_CAP_PHY_TYPE_10GBASE_KX4 BIT_ULL(I40E_PHY_TYPE_10GBASE_KX4)
+-#define I40E_CAP_PHY_TYPE_10GBASE_KR BIT_ULL(I40E_PHY_TYPE_10GBASE_KR)
+-#define I40E_CAP_PHY_TYPE_40GBASE_KR4 BIT_ULL(I40E_PHY_TYPE_40GBASE_KR4)
+-#define I40E_CAP_PHY_TYPE_XAUI BIT_ULL(I40E_PHY_TYPE_XAUI)
+-#define I40E_CAP_PHY_TYPE_XFI BIT_ULL(I40E_PHY_TYPE_XFI)
+-#define I40E_CAP_PHY_TYPE_SFI BIT_ULL(I40E_PHY_TYPE_SFI)
+-#define I40E_CAP_PHY_TYPE_XLAUI BIT_ULL(I40E_PHY_TYPE_XLAUI)
+-#define I40E_CAP_PHY_TYPE_XLPPI BIT_ULL(I40E_PHY_TYPE_XLPPI)
+-#define I40E_CAP_PHY_TYPE_40GBASE_CR4_CU BIT_ULL(I40E_PHY_TYPE_40GBASE_CR4_CU)
+-#define I40E_CAP_PHY_TYPE_10GBASE_CR1_CU BIT_ULL(I40E_PHY_TYPE_10GBASE_CR1_CU)
+-#define I40E_CAP_PHY_TYPE_10GBASE_AOC BIT_ULL(I40E_PHY_TYPE_10GBASE_AOC)
+-#define I40E_CAP_PHY_TYPE_40GBASE_AOC BIT_ULL(I40E_PHY_TYPE_40GBASE_AOC)
+-#define I40E_CAP_PHY_TYPE_100BASE_TX BIT_ULL(I40E_PHY_TYPE_100BASE_TX)
+-#define I40E_CAP_PHY_TYPE_1000BASE_T BIT_ULL(I40E_PHY_TYPE_1000BASE_T)
+-#define I40E_CAP_PHY_TYPE_10GBASE_T BIT_ULL(I40E_PHY_TYPE_10GBASE_T)
+-#define I40E_CAP_PHY_TYPE_10GBASE_SR BIT_ULL(I40E_PHY_TYPE_10GBASE_SR)
+-#define I40E_CAP_PHY_TYPE_10GBASE_LR BIT_ULL(I40E_PHY_TYPE_10GBASE_LR)
+-#define I40E_CAP_PHY_TYPE_10GBASE_SFPP_CU BIT_ULL(I40E_PHY_TYPE_10GBASE_SFPP_CU)
+-#define I40E_CAP_PHY_TYPE_10GBASE_CR1 BIT_ULL(I40E_PHY_TYPE_10GBASE_CR1)
+-#define I40E_CAP_PHY_TYPE_40GBASE_CR4 BIT_ULL(I40E_PHY_TYPE_40GBASE_CR4)
+-#define I40E_CAP_PHY_TYPE_40GBASE_SR4 BIT_ULL(I40E_PHY_TYPE_40GBASE_SR4)
+-#define I40E_CAP_PHY_TYPE_40GBASE_LR4 BIT_ULL(I40E_PHY_TYPE_40GBASE_LR4)
+-#define I40E_CAP_PHY_TYPE_1000BASE_SX BIT_ULL(I40E_PHY_TYPE_1000BASE_SX)
+-#define I40E_CAP_PHY_TYPE_1000BASE_LX BIT_ULL(I40E_PHY_TYPE_1000BASE_LX)
+-#define I40E_CAP_PHY_TYPE_1000BASE_T_OPTICAL \
+- BIT_ULL(I40E_PHY_TYPE_1000BASE_T_OPTICAL)
+-#define I40E_CAP_PHY_TYPE_20GBASE_KR2 BIT_ULL(I40E_PHY_TYPE_20GBASE_KR2)
+-/* Defining the macro I40E_TYPE_OFFSET to implement a bit shift for some
+- * PHY types. There is an unused bit (31) in the I40E_CAP_PHY_TYPE_* bit
+- * fields but no corresponding gap in the i40e_aq_phy_type enumeration. So,
+- * a shift is needed to adjust for this with values larger than 31. The
+- * only affected values are I40E_PHY_TYPE_25GBASE_*.
+- */
+-#define I40E_PHY_TYPE_OFFSET 1
+-#define I40E_CAP_PHY_TYPE_25GBASE_KR BIT_ULL(I40E_PHY_TYPE_25GBASE_KR + \
+- I40E_PHY_TYPE_OFFSET)
+-#define I40E_CAP_PHY_TYPE_25GBASE_CR BIT_ULL(I40E_PHY_TYPE_25GBASE_CR + \
+- I40E_PHY_TYPE_OFFSET)
+-#define I40E_CAP_PHY_TYPE_25GBASE_SR BIT_ULL(I40E_PHY_TYPE_25GBASE_SR + \
+- I40E_PHY_TYPE_OFFSET)
+-#define I40E_CAP_PHY_TYPE_25GBASE_LR BIT_ULL(I40E_PHY_TYPE_25GBASE_LR + \
+- I40E_PHY_TYPE_OFFSET)
+-#define I40E_HW_CAP_MAX_GPIO 30
+-/* Capabilities of a PF or a VF or the whole device */
+-struct i40e_hw_capabilities {
+- u32 switch_mode;
+-#define I40E_NVM_IMAGE_TYPE_EVB 0x0
+-#define I40E_NVM_IMAGE_TYPE_CLOUD 0x2
+-#define I40E_NVM_IMAGE_TYPE_UDP_CLOUD 0x3
+-
+- u32 management_mode;
+- u32 mng_protocols_over_mctp;
+-#define I40E_MNG_PROTOCOL_PLDM 0x2
+-#define I40E_MNG_PROTOCOL_OEM_COMMANDS 0x4
+-#define I40E_MNG_PROTOCOL_NCSI 0x8
+- u32 npar_enable;
+- u32 os2bmc;
+- u32 valid_functions;
+- bool sr_iov_1_1;
+- bool vmdq;
+- bool evb_802_1_qbg; /* Edge Virtual Bridging */
+- bool evb_802_1_qbh; /* Bridge Port Extension */
+- bool dcb;
+- bool fcoe;
+- bool iscsi; /* Indicates iSCSI enabled */
+- bool flex10_enable;
+- bool flex10_capable;
+- u32 flex10_mode;
+-#define I40E_FLEX10_MODE_UNKNOWN 0x0
+-#define I40E_FLEX10_MODE_DCC 0x1
+-#define I40E_FLEX10_MODE_DCI 0x2
+-
+- u32 flex10_status;
+-#define I40E_FLEX10_STATUS_DCC_ERROR 0x1
+-#define I40E_FLEX10_STATUS_VC_MODE 0x2
+-
+- bool sec_rev_disabled;
+- bool update_disabled;
+-#define I40E_NVM_MGMT_SEC_REV_DISABLED 0x1
+-#define I40E_NVM_MGMT_UPDATE_DISABLED 0x2
+-
+- bool mgmt_cem;
+- bool ieee_1588;
+- bool iwarp;
+- bool fd;
+- u32 fd_filters_guaranteed;
+- u32 fd_filters_best_effort;
+- bool rss;
+- u32 rss_table_size;
+- u32 rss_table_entry_width;
+- bool led[I40E_HW_CAP_MAX_GPIO];
+- bool sdp[I40E_HW_CAP_MAX_GPIO];
+- u32 nvm_image_type;
+- u32 num_flow_director_filters;
+- u32 num_vfs;
+- u32 vf_base_id;
+- u32 num_vsis;
+- u32 num_rx_qp;
+- u32 num_tx_qp;
+- u32 base_queue;
+- u32 num_msix_vectors;
+- u32 num_msix_vectors_vf;
+- u32 led_pin_num;
+- u32 sdp_pin_num;
+- u32 mdio_port_num;
+- u32 mdio_port_mode;
+- u8 rx_buf_chain_len;
+- u32 enabled_tcmap;
+- u32 maxtc;
+- u64 wr_csr_prot;
+-};
+-
+-struct i40e_mac_info {
+- enum i40e_mac_type type;
+- u8 addr[ETH_ALEN];
+- u8 perm_addr[ETH_ALEN];
+- u8 san_addr[ETH_ALEN];
+- u16 max_fcoeq;
+-};
+-
+-enum i40e_aq_resources_ids {
+- I40E_NVM_RESOURCE_ID = 1
+-};
+-
+-enum i40e_aq_resource_access_type {
+- I40E_RESOURCE_READ = 1,
+- I40E_RESOURCE_WRITE
+-};
+-
+-struct i40e_nvm_info {
+- u64 hw_semaphore_timeout; /* usec global time (GTIME resolution) */
+- u32 timeout; /* [ms] */
+- u16 sr_size; /* Shadow RAM size in words */
+- bool blank_nvm_mode; /* is NVM empty (no FW present)*/
+- u16 version; /* NVM package version */
+- u32 eetrack; /* NVM data version */
+- u32 oem_ver; /* OEM version info */
+-};
+-
+-/* definitions used in NVM update support */
+-
+-enum i40e_nvmupd_cmd {
+- I40E_NVMUPD_INVALID,
+- I40E_NVMUPD_READ_CON,
+- I40E_NVMUPD_READ_SNT,
+- I40E_NVMUPD_READ_LCB,
+- I40E_NVMUPD_READ_SA,
+- I40E_NVMUPD_WRITE_ERA,
+- I40E_NVMUPD_WRITE_CON,
+- I40E_NVMUPD_WRITE_SNT,
+- I40E_NVMUPD_WRITE_LCB,
+- I40E_NVMUPD_WRITE_SA,
+- I40E_NVMUPD_CSUM_CON,
+- I40E_NVMUPD_CSUM_SA,
+- I40E_NVMUPD_CSUM_LCB,
+- I40E_NVMUPD_STATUS,
+- I40E_NVMUPD_EXEC_AQ,
+- I40E_NVMUPD_GET_AQ_RESULT,
+- I40E_NVMUPD_GET_AQ_EVENT,
+-};
+-
+-enum i40e_nvmupd_state {
+- I40E_NVMUPD_STATE_INIT,
+- I40E_NVMUPD_STATE_READING,
+- I40E_NVMUPD_STATE_WRITING,
+- I40E_NVMUPD_STATE_INIT_WAIT,
+- I40E_NVMUPD_STATE_WRITE_WAIT,
+- I40E_NVMUPD_STATE_ERROR
+-};
+-
+-/* nvm_access definition and its masks/shifts need to be accessible to
+- * application, core driver, and shared code. Where is the right file?
+- */
+-#define I40E_NVM_READ 0xB
+-#define I40E_NVM_WRITE 0xC
+-
+-#define I40E_NVM_MOD_PNT_MASK 0xFF
+-
+-#define I40E_NVM_TRANS_SHIFT 8
+-#define I40E_NVM_TRANS_MASK (0xf << I40E_NVM_TRANS_SHIFT)
+-#define I40E_NVM_PRESERVATION_FLAGS_SHIFT 12
+-#define I40E_NVM_PRESERVATION_FLAGS_MASK \
+- (0x3 << I40E_NVM_PRESERVATION_FLAGS_SHIFT)
+-#define I40E_NVM_PRESERVATION_FLAGS_SELECTED 0x01
+-#define I40E_NVM_PRESERVATION_FLAGS_ALL 0x02
+-#define I40E_NVM_CON 0x0
+-#define I40E_NVM_SNT 0x1
+-#define I40E_NVM_LCB 0x2
+-#define I40E_NVM_SA (I40E_NVM_SNT | I40E_NVM_LCB)
+-#define I40E_NVM_ERA 0x4
+-#define I40E_NVM_CSUM 0x8
+-#define I40E_NVM_AQE 0xe
+-#define I40E_NVM_EXEC 0xf
+-
+-#define I40E_NVM_ADAPT_SHIFT 16
+-#define I40E_NVM_ADAPT_MASK (0xffff << I40E_NVM_ADAPT_SHIFT)
+-
+-#define I40E_NVMUPD_MAX_DATA 4096
+-#define I40E_NVMUPD_IFACE_TIMEOUT 2 /* seconds */
+-
+-struct i40e_nvm_access {
+- u32 command;
+- u32 config;
+- u32 offset; /* in bytes */
+- u32 data_size; /* in bytes */
+- u8 data[1];
+-};
+-
+-/* (Q)SFP module access definitions */
+-#define I40E_I2C_EEPROM_DEV_ADDR 0xA0
+-#define I40E_I2C_EEPROM_DEV_ADDR2 0xA2
+-#define I40E_MODULE_TYPE_ADDR 0x00
+-#define I40E_MODULE_REVISION_ADDR 0x01
+-#define I40E_MODULE_SFF_8472_COMP 0x5E
+-#define I40E_MODULE_SFF_8472_SWAP 0x5C
+-#define I40E_MODULE_SFF_ADDR_MODE 0x04
+-#define I40E_MODULE_TYPE_QSFP_PLUS 0x0D
+-#define I40E_MODULE_TYPE_QSFP28 0x11
+-#define I40E_MODULE_QSFP_MAX_LEN 640
+-
+-/* PCI bus types */
+-enum i40e_bus_type {
+- i40e_bus_type_unknown = 0,
+- i40e_bus_type_pci,
+- i40e_bus_type_pcix,
+- i40e_bus_type_pci_express,
+- i40e_bus_type_reserved
+-};
+-
+-/* PCI bus speeds */
+-enum i40e_bus_speed {
+- i40e_bus_speed_unknown = 0,
+- i40e_bus_speed_33 = 33,
+- i40e_bus_speed_66 = 66,
+- i40e_bus_speed_100 = 100,
+- i40e_bus_speed_120 = 120,
+- i40e_bus_speed_133 = 133,
+- i40e_bus_speed_2500 = 2500,
+- i40e_bus_speed_5000 = 5000,
+- i40e_bus_speed_8000 = 8000,
+- i40e_bus_speed_reserved
+-};
+-
+-/* PCI bus widths */
+-enum i40e_bus_width {
+- i40e_bus_width_unknown = 0,
+- i40e_bus_width_pcie_x1 = 1,
+- i40e_bus_width_pcie_x2 = 2,
+- i40e_bus_width_pcie_x4 = 4,
+- i40e_bus_width_pcie_x8 = 8,
+- i40e_bus_width_32 = 32,
+- i40e_bus_width_64 = 64,
+- i40e_bus_width_reserved
+-};
+-
+-/* Bus parameters */
+-struct i40e_bus_info {
+- enum i40e_bus_speed speed;
+- enum i40e_bus_width width;
+- enum i40e_bus_type type;
+-
+- u16 func;
+- u16 device;
+- u16 lan_id;
+- u16 bus_id;
+-};
+-
+-/* Flow control (FC) parameters */
+-struct i40e_fc_info {
+- enum i40e_fc_mode current_mode; /* FC mode in effect */
+- enum i40e_fc_mode requested_mode; /* FC mode requested by caller */
+-};
+-
+-#define I40E_MAX_TRAFFIC_CLASS 8
+-#define I40E_MAX_USER_PRIORITY 8
+-#define I40E_DCBX_MAX_APPS 32
+-#define I40E_LLDPDU_SIZE 1500
+-
+-/* IEEE 802.1Qaz ETS Configuration data */
+-struct i40e_ieee_ets_config {
+- u8 willing;
+- u8 cbs;
+- u8 maxtcs;
+- u8 prioritytable[I40E_MAX_TRAFFIC_CLASS];
+- u8 tcbwtable[I40E_MAX_TRAFFIC_CLASS];
+- u8 tsatable[I40E_MAX_TRAFFIC_CLASS];
+-};
+-
+-/* IEEE 802.1Qaz ETS Recommendation data */
+-struct i40e_ieee_ets_recommend {
+- u8 prioritytable[I40E_MAX_TRAFFIC_CLASS];
+- u8 tcbwtable[I40E_MAX_TRAFFIC_CLASS];
+- u8 tsatable[I40E_MAX_TRAFFIC_CLASS];
+-};
+-
+-/* IEEE 802.1Qaz PFC Configuration data */
+-struct i40e_ieee_pfc_config {
+- u8 willing;
+- u8 mbc;
+- u8 pfccap;
+- u8 pfcenable;
+-};
+-
+-/* IEEE 802.1Qaz Application Priority data */
+-struct i40e_ieee_app_priority_table {
+- u8 priority;
+- u8 selector;
+- u16 protocolid;
+-};
+-
+-struct i40e_dcbx_config {
+- u32 numapps;
+- u32 tlv_status; /* CEE mode TLV status */
+- struct i40e_ieee_ets_config etscfg;
+- struct i40e_ieee_ets_recommend etsrec;
+- struct i40e_ieee_pfc_config pfc;
+- struct i40e_ieee_app_priority_table app[I40E_DCBX_MAX_APPS];
+-};
+-
+-/* Port hardware description */
+-struct i40e_hw {
+- u8 __iomem *hw_addr;
+- void *back;
+-
+- /* subsystem structs */
+- struct i40e_phy_info phy;
+- struct i40e_mac_info mac;
+- struct i40e_bus_info bus;
+- struct i40e_nvm_info nvm;
+- struct i40e_fc_info fc;
+-
+- /* pci info */
+- u16 device_id;
+- u16 vendor_id;
+- u16 subsystem_device_id;
+- u16 subsystem_vendor_id;
+- u8 revision_id;
+- u8 port;
+- bool adapter_stopped;
+-
+- /* capabilities for entire device and PCI func */
+- struct i40e_hw_capabilities dev_caps;
+- struct i40e_hw_capabilities func_caps;
+-
+- /* Flow Director shared filter space */
+- u16 fdir_shared_filter_count;
+-
+- /* device profile info */
+- u8 pf_id;
+- u16 main_vsi_seid;
+-
+- /* for multi-function MACs */
+- u16 partition_id;
+- u16 num_partitions;
+- u16 num_ports;
+-
+- /* Closest numa node to the device */
+- u16 numa_node;
+-
+- /* Admin Queue info */
+- struct i40e_adminq_info aq;
+-
+- /* state of nvm update process */
+- enum i40e_nvmupd_state nvmupd_state;
+- struct i40e_aq_desc nvm_wb_desc;
+- struct i40e_aq_desc nvm_aq_event_desc;
+- struct i40e_virt_mem nvm_buff;
+- bool nvm_release_on_done;
+- u16 nvm_wait_opcode;
+-
+- /* HMC info */
+- struct i40e_hmc_info hmc; /* HMC info struct */
+-
+- /* LLDP/DCBX Status */
+- u16 dcbx_status;
+-
+-#define I40E_HW_FLAG_802_1AD_CAPABLE BIT_ULL(1)
+-#define I40E_HW_FLAG_AQ_PHY_ACCESS_CAPABLE BIT_ULL(2)
+-
+- /* DCBX info */
+- struct i40e_dcbx_config local_dcbx_config; /* Oper/Local Cfg */
+- struct i40e_dcbx_config remote_dcbx_config; /* Peer Cfg */
+- struct i40e_dcbx_config desired_dcbx_config; /* CEE Desired Cfg */
+-
+- /* Used in set switch config AQ command */
+- u16 switch_tag;
+- u16 first_tag;
+- u16 second_tag;
+-
+- /* debug mask */
+- u32 debug_mask;
+- char err_str[16];
+-};
+-
+-static inline bool i40e_is_vf(struct i40e_hw *hw)
+-{
+- return (hw->mac.type == I40E_MAC_VF ||
+- hw->mac.type == I40E_MAC_X722_VF);
+-}
+-
+-struct i40e_driver_version {
+- u8 major_version;
+- u8 minor_version;
+- u8 build_version;
+- u8 subbuild_version;
+- u8 driver_string[32];
+-};
+-
+-/* RX Descriptors */
+-union i40e_16byte_rx_desc {
+- struct {
+- __le64 pkt_addr; /* Packet buffer address */
+- __le64 hdr_addr; /* Header buffer address */
+- } read;
+- struct {
+- struct {
+- struct {
+- union {
+- __le16 mirroring_status;
+- __le16 fcoe_ctx_id;
+- } mirr_fcoe;
+- __le16 l2tag1;
+- } lo_dword;
+- union {
+- __le32 rss; /* RSS Hash */
+- __le32 fd_id; /* Flow director filter id */
+- __le32 fcoe_param; /* FCoE DDP Context id */
+- } hi_dword;
+- } qword0;
+- struct {
+- /* ext status/error/pktype/length */
+- __le64 status_error_len;
+- } qword1;
+- } wb; /* writeback */
+-};
+-
+-union i40e_32byte_rx_desc {
+- struct {
+- __le64 pkt_addr; /* Packet buffer address */
+- __le64 hdr_addr; /* Header buffer address */
+- /* bit 0 of hdr_buffer_addr is DD bit */
+- __le64 rsvd1;
+- __le64 rsvd2;
+- } read;
+- struct {
+- struct {
+- struct {
+- union {
+- __le16 mirroring_status;
+- __le16 fcoe_ctx_id;
+- } mirr_fcoe;
+- __le16 l2tag1;
+- } lo_dword;
+- union {
+- __le32 rss; /* RSS Hash */
+- __le32 fcoe_param; /* FCoE DDP Context id */
+- /* Flow director filter id in case of
+- * Programming status desc WB
+- */
+- __le32 fd_id;
+- } hi_dword;
+- } qword0;
+- struct {
+- /* status/error/pktype/length */
+- __le64 status_error_len;
+- } qword1;
+- struct {
+- __le16 ext_status; /* extended status */
+- __le16 rsvd;
+- __le16 l2tag2_1;
+- __le16 l2tag2_2;
+- } qword2;
+- struct {
+- union {
+- __le32 flex_bytes_lo;
+- __le32 pe_status;
+- } lo_dword;
+- union {
+- __le32 flex_bytes_hi;
+- __le32 fd_id;
+- } hi_dword;
+- } qword3;
+- } wb; /* writeback */
+-};
+-
+-enum i40e_rx_desc_status_bits {
+- /* Note: These are predefined bit offsets */
+- I40E_RX_DESC_STATUS_DD_SHIFT = 0,
+- I40E_RX_DESC_STATUS_EOF_SHIFT = 1,
+- I40E_RX_DESC_STATUS_L2TAG1P_SHIFT = 2,
+- I40E_RX_DESC_STATUS_L3L4P_SHIFT = 3,
+- I40E_RX_DESC_STATUS_CRCP_SHIFT = 4,
+- I40E_RX_DESC_STATUS_TSYNINDX_SHIFT = 5, /* 2 BITS */
+- I40E_RX_DESC_STATUS_TSYNVALID_SHIFT = 7,
+- /* Note: Bit 8 is reserved in X710 and XL710 */
+- I40E_RX_DESC_STATUS_EXT_UDP_0_SHIFT = 8,
+- I40E_RX_DESC_STATUS_UMBCAST_SHIFT = 9, /* 2 BITS */
+- I40E_RX_DESC_STATUS_FLM_SHIFT = 11,
+- I40E_RX_DESC_STATUS_FLTSTAT_SHIFT = 12, /* 2 BITS */
+- I40E_RX_DESC_STATUS_LPBK_SHIFT = 14,
+- I40E_RX_DESC_STATUS_IPV6EXADD_SHIFT = 15,
+- I40E_RX_DESC_STATUS_RESERVED_SHIFT = 16, /* 2 BITS */
+- /* Note: For non-tunnel packets INT_UDP_0 is the right status for
+- * UDP header
+- */
+- I40E_RX_DESC_STATUS_INT_UDP_0_SHIFT = 18,
+- I40E_RX_DESC_STATUS_LAST /* this entry must be last!!! */
+-};
+-
+-#define I40E_RXD_QW1_STATUS_SHIFT 0
+-#define I40E_RXD_QW1_STATUS_MASK ((BIT(I40E_RX_DESC_STATUS_LAST) - 1) \
+- << I40E_RXD_QW1_STATUS_SHIFT)
+-
+-#define I40E_RXD_QW1_STATUS_TSYNINDX_SHIFT I40E_RX_DESC_STATUS_TSYNINDX_SHIFT
+-#define I40E_RXD_QW1_STATUS_TSYNINDX_MASK (0x3UL << \
+- I40E_RXD_QW1_STATUS_TSYNINDX_SHIFT)
+-
+-#define I40E_RXD_QW1_STATUS_TSYNVALID_SHIFT I40E_RX_DESC_STATUS_TSYNVALID_SHIFT
+-#define I40E_RXD_QW1_STATUS_TSYNVALID_MASK \
+- BIT_ULL(I40E_RXD_QW1_STATUS_TSYNVALID_SHIFT)
+-
+-enum i40e_rx_desc_fltstat_values {
+- I40E_RX_DESC_FLTSTAT_NO_DATA = 0,
+- I40E_RX_DESC_FLTSTAT_RSV_FD_ID = 1, /* 16byte desc? FD_ID : RSV */
+- I40E_RX_DESC_FLTSTAT_RSV = 2,
+- I40E_RX_DESC_FLTSTAT_RSS_HASH = 3,
+-};
+-
+-#define I40E_RXD_QW1_ERROR_SHIFT 19
+-#define I40E_RXD_QW1_ERROR_MASK (0xFFUL << I40E_RXD_QW1_ERROR_SHIFT)
+-
+-enum i40e_rx_desc_error_bits {
+- /* Note: These are predefined bit offsets */
+- I40E_RX_DESC_ERROR_RXE_SHIFT = 0,
+- I40E_RX_DESC_ERROR_RECIPE_SHIFT = 1,
+- I40E_RX_DESC_ERROR_HBO_SHIFT = 2,
+- I40E_RX_DESC_ERROR_L3L4E_SHIFT = 3, /* 3 BITS */
+- I40E_RX_DESC_ERROR_IPE_SHIFT = 3,
+- I40E_RX_DESC_ERROR_L4E_SHIFT = 4,
+- I40E_RX_DESC_ERROR_EIPE_SHIFT = 5,
+- I40E_RX_DESC_ERROR_OVERSIZE_SHIFT = 6,
+- I40E_RX_DESC_ERROR_PPRS_SHIFT = 7
+-};
+-
+-enum i40e_rx_desc_error_l3l4e_fcoe_masks {
+- I40E_RX_DESC_ERROR_L3L4E_NONE = 0,
+- I40E_RX_DESC_ERROR_L3L4E_PROT = 1,
+- I40E_RX_DESC_ERROR_L3L4E_FC = 2,
+- I40E_RX_DESC_ERROR_L3L4E_DMAC_ERR = 3,
+- I40E_RX_DESC_ERROR_L3L4E_DMAC_WARN = 4
+-};
+-
+-#define I40E_RXD_QW1_PTYPE_SHIFT 30
+-#define I40E_RXD_QW1_PTYPE_MASK (0xFFULL << I40E_RXD_QW1_PTYPE_SHIFT)
+-
+-/* Packet type non-ip values */
+-enum i40e_rx_l2_ptype {
+- I40E_RX_PTYPE_L2_RESERVED = 0,
+- I40E_RX_PTYPE_L2_MAC_PAY2 = 1,
+- I40E_RX_PTYPE_L2_TIMESYNC_PAY2 = 2,
+- I40E_RX_PTYPE_L2_FIP_PAY2 = 3,
+- I40E_RX_PTYPE_L2_OUI_PAY2 = 4,
+- I40E_RX_PTYPE_L2_MACCNTRL_PAY2 = 5,
+- I40E_RX_PTYPE_L2_LLDP_PAY2 = 6,
+- I40E_RX_PTYPE_L2_ECP_PAY2 = 7,
+- I40E_RX_PTYPE_L2_EVB_PAY2 = 8,
+- I40E_RX_PTYPE_L2_QCN_PAY2 = 9,
+- I40E_RX_PTYPE_L2_EAPOL_PAY2 = 10,
+- I40E_RX_PTYPE_L2_ARP = 11,
+- I40E_RX_PTYPE_L2_FCOE_PAY3 = 12,
+- I40E_RX_PTYPE_L2_FCOE_FCDATA_PAY3 = 13,
+- I40E_RX_PTYPE_L2_FCOE_FCRDY_PAY3 = 14,
+- I40E_RX_PTYPE_L2_FCOE_FCRSP_PAY3 = 15,
+- I40E_RX_PTYPE_L2_FCOE_FCOTHER_PA = 16,
+- I40E_RX_PTYPE_L2_FCOE_VFT_PAY3 = 17,
+- I40E_RX_PTYPE_L2_FCOE_VFT_FCDATA = 18,
+- I40E_RX_PTYPE_L2_FCOE_VFT_FCRDY = 19,
+- I40E_RX_PTYPE_L2_FCOE_VFT_FCRSP = 20,
+- I40E_RX_PTYPE_L2_FCOE_VFT_FCOTHER = 21,
+- I40E_RX_PTYPE_GRENAT4_MAC_PAY3 = 58,
+- I40E_RX_PTYPE_GRENAT4_MACVLAN_IPV6_ICMP_PAY4 = 87,
+- I40E_RX_PTYPE_GRENAT6_MAC_PAY3 = 124,
+- I40E_RX_PTYPE_GRENAT6_MACVLAN_IPV6_ICMP_PAY4 = 153
+-};
+-
+-struct i40e_rx_ptype_decoded {
+- u32 ptype:8;
+- u32 known:1;
+- u32 outer_ip:1;
+- u32 outer_ip_ver:1;
+- u32 outer_frag:1;
+- u32 tunnel_type:3;
+- u32 tunnel_end_prot:2;
+- u32 tunnel_end_frag:1;
+- u32 inner_prot:4;
+- u32 payload_layer:3;
+-};
+-
+-enum i40e_rx_ptype_outer_ip {
+- I40E_RX_PTYPE_OUTER_L2 = 0,
+- I40E_RX_PTYPE_OUTER_IP = 1
+-};
+-
+-enum i40e_rx_ptype_outer_ip_ver {
+- I40E_RX_PTYPE_OUTER_NONE = 0,
+- I40E_RX_PTYPE_OUTER_IPV4 = 0,
+- I40E_RX_PTYPE_OUTER_IPV6 = 1
+-};
+-
+-enum i40e_rx_ptype_outer_fragmented {
+- I40E_RX_PTYPE_NOT_FRAG = 0,
+- I40E_RX_PTYPE_FRAG = 1
+-};
+-
+-enum i40e_rx_ptype_tunnel_type {
+- I40E_RX_PTYPE_TUNNEL_NONE = 0,
+- I40E_RX_PTYPE_TUNNEL_IP_IP = 1,
+- I40E_RX_PTYPE_TUNNEL_IP_GRENAT = 2,
+- I40E_RX_PTYPE_TUNNEL_IP_GRENAT_MAC = 3,
+- I40E_RX_PTYPE_TUNNEL_IP_GRENAT_MAC_VLAN = 4,
+-};
+-
+-enum i40e_rx_ptype_tunnel_end_prot {
+- I40E_RX_PTYPE_TUNNEL_END_NONE = 0,
+- I40E_RX_PTYPE_TUNNEL_END_IPV4 = 1,
+- I40E_RX_PTYPE_TUNNEL_END_IPV6 = 2,
+-};
+-
+-enum i40e_rx_ptype_inner_prot {
+- I40E_RX_PTYPE_INNER_PROT_NONE = 0,
+- I40E_RX_PTYPE_INNER_PROT_UDP = 1,
+- I40E_RX_PTYPE_INNER_PROT_TCP = 2,
+- I40E_RX_PTYPE_INNER_PROT_SCTP = 3,
+- I40E_RX_PTYPE_INNER_PROT_ICMP = 4,
+- I40E_RX_PTYPE_INNER_PROT_TIMESYNC = 5
+-};
+-
+-enum i40e_rx_ptype_payload_layer {
+- I40E_RX_PTYPE_PAYLOAD_LAYER_NONE = 0,
+- I40E_RX_PTYPE_PAYLOAD_LAYER_PAY2 = 1,
+- I40E_RX_PTYPE_PAYLOAD_LAYER_PAY3 = 2,
+- I40E_RX_PTYPE_PAYLOAD_LAYER_PAY4 = 3,
+-};
+-
+-#define I40E_RXD_QW1_LENGTH_PBUF_SHIFT 38
+-#define I40E_RXD_QW1_LENGTH_PBUF_MASK (0x3FFFULL << \
+- I40E_RXD_QW1_LENGTH_PBUF_SHIFT)
+-
+-#define I40E_RXD_QW1_LENGTH_HBUF_SHIFT 52
+-#define I40E_RXD_QW1_LENGTH_HBUF_MASK (0x7FFULL << \
+- I40E_RXD_QW1_LENGTH_HBUF_SHIFT)
+-
+-#define I40E_RXD_QW1_LENGTH_SPH_SHIFT 63
+-#define I40E_RXD_QW1_LENGTH_SPH_MASK BIT_ULL(I40E_RXD_QW1_LENGTH_SPH_SHIFT)
+-
+-enum i40e_rx_desc_ext_status_bits {
+- /* Note: These are predefined bit offsets */
+- I40E_RX_DESC_EXT_STATUS_L2TAG2P_SHIFT = 0,
+- I40E_RX_DESC_EXT_STATUS_L2TAG3P_SHIFT = 1,
+- I40E_RX_DESC_EXT_STATUS_FLEXBL_SHIFT = 2, /* 2 BITS */
+- I40E_RX_DESC_EXT_STATUS_FLEXBH_SHIFT = 4, /* 2 BITS */
+- I40E_RX_DESC_EXT_STATUS_FDLONGB_SHIFT = 9,
+- I40E_RX_DESC_EXT_STATUS_FCOELONGB_SHIFT = 10,
+- I40E_RX_DESC_EXT_STATUS_PELONGB_SHIFT = 11,
+-};
+-
+-enum i40e_rx_desc_pe_status_bits {
+- /* Note: These are predefined bit offsets */
+- I40E_RX_DESC_PE_STATUS_QPID_SHIFT = 0, /* 18 BITS */
+- I40E_RX_DESC_PE_STATUS_L4PORT_SHIFT = 0, /* 16 BITS */
+- I40E_RX_DESC_PE_STATUS_IPINDEX_SHIFT = 16, /* 8 BITS */
+- I40E_RX_DESC_PE_STATUS_QPIDHIT_SHIFT = 24,
+- I40E_RX_DESC_PE_STATUS_APBVTHIT_SHIFT = 25,
+- I40E_RX_DESC_PE_STATUS_PORTV_SHIFT = 26,
+- I40E_RX_DESC_PE_STATUS_URG_SHIFT = 27,
+- I40E_RX_DESC_PE_STATUS_IPFRAG_SHIFT = 28,
+- I40E_RX_DESC_PE_STATUS_IPOPT_SHIFT = 29
+-};
+-
+-#define I40E_RX_PROG_STATUS_DESC_LENGTH_SHIFT 38
+-#define I40E_RX_PROG_STATUS_DESC_LENGTH 0x2000000
+-
+-#define I40E_RX_PROG_STATUS_DESC_QW1_PROGID_SHIFT 2
+-#define I40E_RX_PROG_STATUS_DESC_QW1_PROGID_MASK (0x7UL << \
+- I40E_RX_PROG_STATUS_DESC_QW1_PROGID_SHIFT)
+-
+-#define I40E_RX_PROG_STATUS_DESC_QW1_ERROR_SHIFT 19
+-#define I40E_RX_PROG_STATUS_DESC_QW1_ERROR_MASK (0x3FUL << \
+- I40E_RX_PROG_STATUS_DESC_QW1_ERROR_SHIFT)
+-
+-enum i40e_rx_prog_status_desc_status_bits {
+- /* Note: These are predefined bit offsets */
+- I40E_RX_PROG_STATUS_DESC_DD_SHIFT = 0,
+- I40E_RX_PROG_STATUS_DESC_PROG_ID_SHIFT = 2 /* 3 BITS */
+-};
+-
+-enum i40e_rx_prog_status_desc_prog_id_masks {
+- I40E_RX_PROG_STATUS_DESC_FD_FILTER_STATUS = 1,
+- I40E_RX_PROG_STATUS_DESC_FCOE_CTXT_PROG_STATUS = 2,
+- I40E_RX_PROG_STATUS_DESC_FCOE_CTXT_INVL_STATUS = 4,
+-};
+-
+-enum i40e_rx_prog_status_desc_error_bits {
+- /* Note: These are predefined bit offsets */
+- I40E_RX_PROG_STATUS_DESC_FD_TBL_FULL_SHIFT = 0,
+- I40E_RX_PROG_STATUS_DESC_NO_FD_ENTRY_SHIFT = 1,
+- I40E_RX_PROG_STATUS_DESC_FCOE_TBL_FULL_SHIFT = 2,
+- I40E_RX_PROG_STATUS_DESC_FCOE_CONFLICT_SHIFT = 3
+-};
+-
+-/* TX Descriptor */
+-struct i40e_tx_desc {
+- __le64 buffer_addr; /* Address of descriptor's data buf */
+- __le64 cmd_type_offset_bsz;
+-};
+-
+-#define I40E_TXD_QW1_DTYPE_SHIFT 0
+-#define I40E_TXD_QW1_DTYPE_MASK (0xFUL << I40E_TXD_QW1_DTYPE_SHIFT)
+-
+-enum i40e_tx_desc_dtype_value {
+- I40E_TX_DESC_DTYPE_DATA = 0x0,
+- I40E_TX_DESC_DTYPE_NOP = 0x1, /* same as Context desc */
+- I40E_TX_DESC_DTYPE_CONTEXT = 0x1,
+- I40E_TX_DESC_DTYPE_FCOE_CTX = 0x2,
+- I40E_TX_DESC_DTYPE_FILTER_PROG = 0x8,
+- I40E_TX_DESC_DTYPE_DDP_CTX = 0x9,
+- I40E_TX_DESC_DTYPE_FLEX_DATA = 0xB,
+- I40E_TX_DESC_DTYPE_FLEX_CTX_1 = 0xC,
+- I40E_TX_DESC_DTYPE_FLEX_CTX_2 = 0xD,
+- I40E_TX_DESC_DTYPE_DESC_DONE = 0xF
+-};
+-
+-#define I40E_TXD_QW1_CMD_SHIFT 4
+-#define I40E_TXD_QW1_CMD_MASK (0x3FFUL << I40E_TXD_QW1_CMD_SHIFT)
+-
+-enum i40e_tx_desc_cmd_bits {
+- I40E_TX_DESC_CMD_EOP = 0x0001,
+- I40E_TX_DESC_CMD_RS = 0x0002,
+- I40E_TX_DESC_CMD_ICRC = 0x0004,
+- I40E_TX_DESC_CMD_IL2TAG1 = 0x0008,
+- I40E_TX_DESC_CMD_DUMMY = 0x0010,
+- I40E_TX_DESC_CMD_IIPT_NONIP = 0x0000, /* 2 BITS */
+- I40E_TX_DESC_CMD_IIPT_IPV6 = 0x0020, /* 2 BITS */
+- I40E_TX_DESC_CMD_IIPT_IPV4 = 0x0040, /* 2 BITS */
+- I40E_TX_DESC_CMD_IIPT_IPV4_CSUM = 0x0060, /* 2 BITS */
+- I40E_TX_DESC_CMD_FCOET = 0x0080,
+- I40E_TX_DESC_CMD_L4T_EOFT_UNK = 0x0000, /* 2 BITS */
+- I40E_TX_DESC_CMD_L4T_EOFT_TCP = 0x0100, /* 2 BITS */
+- I40E_TX_DESC_CMD_L4T_EOFT_SCTP = 0x0200, /* 2 BITS */
+- I40E_TX_DESC_CMD_L4T_EOFT_UDP = 0x0300, /* 2 BITS */
+- I40E_TX_DESC_CMD_L4T_EOFT_EOF_N = 0x0000, /* 2 BITS */
+- I40E_TX_DESC_CMD_L4T_EOFT_EOF_T = 0x0100, /* 2 BITS */
+- I40E_TX_DESC_CMD_L4T_EOFT_EOF_NI = 0x0200, /* 2 BITS */
+- I40E_TX_DESC_CMD_L4T_EOFT_EOF_A = 0x0300, /* 2 BITS */
+-};
+-
+-#define I40E_TXD_QW1_OFFSET_SHIFT 16
+-#define I40E_TXD_QW1_OFFSET_MASK (0x3FFFFULL << \
+- I40E_TXD_QW1_OFFSET_SHIFT)
+-
+-enum i40e_tx_desc_length_fields {
+- /* Note: These are predefined bit offsets */
+- I40E_TX_DESC_LENGTH_MACLEN_SHIFT = 0, /* 7 BITS */
+- I40E_TX_DESC_LENGTH_IPLEN_SHIFT = 7, /* 7 BITS */
+- I40E_TX_DESC_LENGTH_L4_FC_LEN_SHIFT = 14 /* 4 BITS */
+-};
+-
+-#define I40E_TXD_QW1_TX_BUF_SZ_SHIFT 34
+-#define I40E_TXD_QW1_TX_BUF_SZ_MASK (0x3FFFULL << \
+- I40E_TXD_QW1_TX_BUF_SZ_SHIFT)
+-
+-#define I40E_TXD_QW1_L2TAG1_SHIFT 48
+-#define I40E_TXD_QW1_L2TAG1_MASK (0xFFFFULL << I40E_TXD_QW1_L2TAG1_SHIFT)
+-
+-/* Context descriptors */
+-struct i40e_tx_context_desc {
+- __le32 tunneling_params;
+- __le16 l2tag2;
+- __le16 rsvd;
+- __le64 type_cmd_tso_mss;
+-};
+-
+-#define I40E_TXD_CTX_QW1_DTYPE_SHIFT 0
+-#define I40E_TXD_CTX_QW1_DTYPE_MASK (0xFUL << I40E_TXD_CTX_QW1_DTYPE_SHIFT)
+-
+-#define I40E_TXD_CTX_QW1_CMD_SHIFT 4
+-#define I40E_TXD_CTX_QW1_CMD_MASK (0xFFFFUL << I40E_TXD_CTX_QW1_CMD_SHIFT)
+-
+-enum i40e_tx_ctx_desc_cmd_bits {
+- I40E_TX_CTX_DESC_TSO = 0x01,
+- I40E_TX_CTX_DESC_TSYN = 0x02,
+- I40E_TX_CTX_DESC_IL2TAG2 = 0x04,
+- I40E_TX_CTX_DESC_IL2TAG2_IL2H = 0x08,
+- I40E_TX_CTX_DESC_SWTCH_NOTAG = 0x00,
+- I40E_TX_CTX_DESC_SWTCH_UPLINK = 0x10,
+- I40E_TX_CTX_DESC_SWTCH_LOCAL = 0x20,
+- I40E_TX_CTX_DESC_SWTCH_VSI = 0x30,
+- I40E_TX_CTX_DESC_SWPE = 0x40
+-};
+-
+-#define I40E_TXD_CTX_QW1_TSO_LEN_SHIFT 30
+-#define I40E_TXD_CTX_QW1_TSO_LEN_MASK (0x3FFFFULL << \
+- I40E_TXD_CTX_QW1_TSO_LEN_SHIFT)
+-
+-#define I40E_TXD_CTX_QW1_MSS_SHIFT 50
+-#define I40E_TXD_CTX_QW1_MSS_MASK (0x3FFFULL << \
+- I40E_TXD_CTX_QW1_MSS_SHIFT)
+-
+-#define I40E_TXD_CTX_QW1_VSI_SHIFT 50
+-#define I40E_TXD_CTX_QW1_VSI_MASK (0x1FFULL << I40E_TXD_CTX_QW1_VSI_SHIFT)
+-
+-#define I40E_TXD_CTX_QW0_EXT_IP_SHIFT 0
+-#define I40E_TXD_CTX_QW0_EXT_IP_MASK (0x3ULL << \
+- I40E_TXD_CTX_QW0_EXT_IP_SHIFT)
+-
+-enum i40e_tx_ctx_desc_eipt_offload {
+- I40E_TX_CTX_EXT_IP_NONE = 0x0,
+- I40E_TX_CTX_EXT_IP_IPV6 = 0x1,
+- I40E_TX_CTX_EXT_IP_IPV4_NO_CSUM = 0x2,
+- I40E_TX_CTX_EXT_IP_IPV4 = 0x3
+-};
+-
+-#define I40E_TXD_CTX_QW0_EXT_IPLEN_SHIFT 2
+-#define I40E_TXD_CTX_QW0_EXT_IPLEN_MASK (0x3FULL << \
+- I40E_TXD_CTX_QW0_EXT_IPLEN_SHIFT)
+-
+-#define I40E_TXD_CTX_QW0_NATT_SHIFT 9
+-#define I40E_TXD_CTX_QW0_NATT_MASK (0x3ULL << I40E_TXD_CTX_QW0_NATT_SHIFT)
+-
+-#define I40E_TXD_CTX_UDP_TUNNELING BIT_ULL(I40E_TXD_CTX_QW0_NATT_SHIFT)
+-#define I40E_TXD_CTX_GRE_TUNNELING (0x2ULL << I40E_TXD_CTX_QW0_NATT_SHIFT)
+-
+-#define I40E_TXD_CTX_QW0_EIP_NOINC_SHIFT 11
+-#define I40E_TXD_CTX_QW0_EIP_NOINC_MASK \
+- BIT_ULL(I40E_TXD_CTX_QW0_EIP_NOINC_SHIFT)
+-
+-#define I40E_TXD_CTX_EIP_NOINC_IPID_CONST I40E_TXD_CTX_QW0_EIP_NOINC_MASK
+-
+-#define I40E_TXD_CTX_QW0_NATLEN_SHIFT 12
+-#define I40E_TXD_CTX_QW0_NATLEN_MASK (0X7FULL << \
+- I40E_TXD_CTX_QW0_NATLEN_SHIFT)
+-
+-#define I40E_TXD_CTX_QW0_DECTTL_SHIFT 19
+-#define I40E_TXD_CTX_QW0_DECTTL_MASK (0xFULL << \
+- I40E_TXD_CTX_QW0_DECTTL_SHIFT)
+-
+-#define I40E_TXD_CTX_QW0_L4T_CS_SHIFT 23
+-#define I40E_TXD_CTX_QW0_L4T_CS_MASK BIT_ULL(I40E_TXD_CTX_QW0_L4T_CS_SHIFT)
+-struct i40e_filter_program_desc {
+- __le32 qindex_flex_ptype_vsi;
+- __le32 rsvd;
+- __le32 dtype_cmd_cntindex;
+- __le32 fd_id;
+-};
+-#define I40E_TXD_FLTR_QW0_QINDEX_SHIFT 0
+-#define I40E_TXD_FLTR_QW0_QINDEX_MASK (0x7FFUL << \
+- I40E_TXD_FLTR_QW0_QINDEX_SHIFT)
+-#define I40E_TXD_FLTR_QW0_FLEXOFF_SHIFT 11
+-#define I40E_TXD_FLTR_QW0_FLEXOFF_MASK (0x7UL << \
+- I40E_TXD_FLTR_QW0_FLEXOFF_SHIFT)
+-#define I40E_TXD_FLTR_QW0_PCTYPE_SHIFT 17
+-#define I40E_TXD_FLTR_QW0_PCTYPE_MASK (0x3FUL << \
+- I40E_TXD_FLTR_QW0_PCTYPE_SHIFT)
+-
+-/* Packet Classifier Types for filters */
+-enum i40e_filter_pctype {
+- /* Note: Values 0-28 are reserved for future use.
+- * Value 29, 30, 32 are not supported on XL710 and X710.
+- */
+- I40E_FILTER_PCTYPE_NONF_UNICAST_IPV4_UDP = 29,
+- I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV4_UDP = 30,
+- I40E_FILTER_PCTYPE_NONF_IPV4_UDP = 31,
+- I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK = 32,
+- I40E_FILTER_PCTYPE_NONF_IPV4_TCP = 33,
+- I40E_FILTER_PCTYPE_NONF_IPV4_SCTP = 34,
+- I40E_FILTER_PCTYPE_NONF_IPV4_OTHER = 35,
+- I40E_FILTER_PCTYPE_FRAG_IPV4 = 36,
+- /* Note: Values 37-38 are reserved for future use.
+- * Value 39, 40, 42 are not supported on XL710 and X710.
+- */
+- I40E_FILTER_PCTYPE_NONF_UNICAST_IPV6_UDP = 39,
+- I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV6_UDP = 40,
+- I40E_FILTER_PCTYPE_NONF_IPV6_UDP = 41,
+- I40E_FILTER_PCTYPE_NONF_IPV6_TCP_SYN_NO_ACK = 42,
+- I40E_FILTER_PCTYPE_NONF_IPV6_TCP = 43,
+- I40E_FILTER_PCTYPE_NONF_IPV6_SCTP = 44,
+- I40E_FILTER_PCTYPE_NONF_IPV6_OTHER = 45,
+- I40E_FILTER_PCTYPE_FRAG_IPV6 = 46,
+- /* Note: Value 47 is reserved for future use */
+- I40E_FILTER_PCTYPE_FCOE_OX = 48,
+- I40E_FILTER_PCTYPE_FCOE_RX = 49,
+- I40E_FILTER_PCTYPE_FCOE_OTHER = 50,
+- /* Note: Values 51-62 are reserved for future use */
+- I40E_FILTER_PCTYPE_L2_PAYLOAD = 63,
+-};
+-
+-enum i40e_filter_program_desc_dest {
+- I40E_FILTER_PROGRAM_DESC_DEST_DROP_PACKET = 0x0,
+- I40E_FILTER_PROGRAM_DESC_DEST_DIRECT_PACKET_QINDEX = 0x1,
+- I40E_FILTER_PROGRAM_DESC_DEST_DIRECT_PACKET_OTHER = 0x2,
+-};
+-
+-enum i40e_filter_program_desc_fd_status {
+- I40E_FILTER_PROGRAM_DESC_FD_STATUS_NONE = 0x0,
+- I40E_FILTER_PROGRAM_DESC_FD_STATUS_FD_ID = 0x1,
+- I40E_FILTER_PROGRAM_DESC_FD_STATUS_FD_ID_4FLEX_BYTES = 0x2,
+- I40E_FILTER_PROGRAM_DESC_FD_STATUS_8FLEX_BYTES = 0x3,
+-};
+-
+-#define I40E_TXD_FLTR_QW0_DEST_VSI_SHIFT 23
+-#define I40E_TXD_FLTR_QW0_DEST_VSI_MASK (0x1FFUL << \
+- I40E_TXD_FLTR_QW0_DEST_VSI_SHIFT)
+-
+-#define I40E_TXD_FLTR_QW1_CMD_SHIFT 4
+-#define I40E_TXD_FLTR_QW1_CMD_MASK (0xFFFFULL << \
+- I40E_TXD_FLTR_QW1_CMD_SHIFT)
+-
+-#define I40E_TXD_FLTR_QW1_PCMD_SHIFT (0x0ULL + I40E_TXD_FLTR_QW1_CMD_SHIFT)
+-#define I40E_TXD_FLTR_QW1_PCMD_MASK (0x7ULL << I40E_TXD_FLTR_QW1_PCMD_SHIFT)
+-
+-enum i40e_filter_program_desc_pcmd {
+- I40E_FILTER_PROGRAM_DESC_PCMD_ADD_UPDATE = 0x1,
+- I40E_FILTER_PROGRAM_DESC_PCMD_REMOVE = 0x2,
+-};
+-
+-#define I40E_TXD_FLTR_QW1_DEST_SHIFT (0x3ULL + I40E_TXD_FLTR_QW1_CMD_SHIFT)
+-#define I40E_TXD_FLTR_QW1_DEST_MASK (0x3ULL << I40E_TXD_FLTR_QW1_DEST_SHIFT)
+-
+-#define I40E_TXD_FLTR_QW1_CNT_ENA_SHIFT (0x7ULL + I40E_TXD_FLTR_QW1_CMD_SHIFT)
+-#define I40E_TXD_FLTR_QW1_CNT_ENA_MASK BIT_ULL(I40E_TXD_FLTR_QW1_CNT_ENA_SHIFT)
+-
+-#define I40E_TXD_FLTR_QW1_FD_STATUS_SHIFT (0x9ULL + \
+- I40E_TXD_FLTR_QW1_CMD_SHIFT)
+-#define I40E_TXD_FLTR_QW1_FD_STATUS_MASK (0x3ULL << \
+- I40E_TXD_FLTR_QW1_FD_STATUS_SHIFT)
+-
+-#define I40E_TXD_FLTR_QW1_CNTINDEX_SHIFT 20
+-#define I40E_TXD_FLTR_QW1_CNTINDEX_MASK (0x1FFUL << \
+- I40E_TXD_FLTR_QW1_CNTINDEX_SHIFT)
+-
+-enum i40e_filter_type {
+- I40E_FLOW_DIRECTOR_FLTR = 0,
+- I40E_PE_QUAD_HASH_FLTR = 1,
+- I40E_ETHERTYPE_FLTR,
+- I40E_FCOE_CTX_FLTR,
+- I40E_MAC_VLAN_FLTR,
+- I40E_HASH_FLTR
+-};
+-
+-struct i40e_vsi_context {
+- u16 seid;
+- u16 uplink_seid;
+- u16 vsi_number;
+- u16 vsis_allocated;
+- u16 vsis_unallocated;
+- u16 flags;
+- u8 pf_num;
+- u8 vf_num;
+- u8 connection_type;
+- struct i40e_aqc_vsi_properties_data info;
+-};
+-
+-struct i40e_veb_context {
+- u16 seid;
+- u16 uplink_seid;
+- u16 veb_number;
+- u16 vebs_allocated;
+- u16 vebs_unallocated;
+- u16 flags;
+- struct i40e_aqc_get_veb_parameters_completion info;
+-};
+-
+-/* Statistics collected by each port, VSI, VEB, and S-channel */
+-struct i40e_eth_stats {
+- u64 rx_bytes; /* gorc */
+- u64 rx_unicast; /* uprc */
+- u64 rx_multicast; /* mprc */
+- u64 rx_broadcast; /* bprc */
+- u64 rx_discards; /* rdpc */
+- u64 rx_unknown_protocol; /* rupp */
+- u64 tx_bytes; /* gotc */
+- u64 tx_unicast; /* uptc */
+- u64 tx_multicast; /* mptc */
+- u64 tx_broadcast; /* bptc */
+- u64 tx_discards; /* tdpc */
+- u64 tx_errors; /* tepc */
+-};
+-
+-/* Statistics collected per VEB per TC */
+-struct i40e_veb_tc_stats {
+- u64 tc_rx_packets[I40E_MAX_TRAFFIC_CLASS];
+- u64 tc_rx_bytes[I40E_MAX_TRAFFIC_CLASS];
+- u64 tc_tx_packets[I40E_MAX_TRAFFIC_CLASS];
+- u64 tc_tx_bytes[I40E_MAX_TRAFFIC_CLASS];
+-};
+-
+-/* Statistics collected by the MAC */
+-struct i40e_hw_port_stats {
+- /* eth stats collected by the port */
+- struct i40e_eth_stats eth;
+-
+- /* additional port specific stats */
+- u64 tx_dropped_link_down; /* tdold */
+- u64 crc_errors; /* crcerrs */
+- u64 illegal_bytes; /* illerrc */
+- u64 error_bytes; /* errbc */
+- u64 mac_local_faults; /* mlfc */
+- u64 mac_remote_faults; /* mrfc */
+- u64 rx_length_errors; /* rlec */
+- u64 link_xon_rx; /* lxonrxc */
+- u64 link_xoff_rx; /* lxoffrxc */
+- u64 priority_xon_rx[8]; /* pxonrxc[8] */
+- u64 priority_xoff_rx[8]; /* pxoffrxc[8] */
+- u64 link_xon_tx; /* lxontxc */
+- u64 link_xoff_tx; /* lxofftxc */
+- u64 priority_xon_tx[8]; /* pxontxc[8] */
+- u64 priority_xoff_tx[8]; /* pxofftxc[8] */
+- u64 priority_xon_2_xoff[8]; /* pxon2offc[8] */
+- u64 rx_size_64; /* prc64 */
+- u64 rx_size_127; /* prc127 */
+- u64 rx_size_255; /* prc255 */
+- u64 rx_size_511; /* prc511 */
+- u64 rx_size_1023; /* prc1023 */
+- u64 rx_size_1522; /* prc1522 */
+- u64 rx_size_big; /* prc9522 */
+- u64 rx_undersize; /* ruc */
+- u64 rx_fragments; /* rfc */
+- u64 rx_oversize; /* roc */
+- u64 rx_jabber; /* rjc */
+- u64 tx_size_64; /* ptc64 */
+- u64 tx_size_127; /* ptc127 */
+- u64 tx_size_255; /* ptc255 */
+- u64 tx_size_511; /* ptc511 */
+- u64 tx_size_1023; /* ptc1023 */
+- u64 tx_size_1522; /* ptc1522 */
+- u64 tx_size_big; /* ptc9522 */
+- u64 mac_short_packet_dropped; /* mspdc */
+- u64 checksum_error; /* xec */
+- /* flow director stats */
+- u64 fd_atr_match;
+- u64 fd_sb_match;
+- u64 fd_atr_tunnel_match;
+- u32 fd_atr_status;
+- u32 fd_sb_status;
+- /* EEE LPI */
+- u32 tx_lpi_status;
+- u32 rx_lpi_status;
+- u64 tx_lpi_count; /* etlpic */
+- u64 rx_lpi_count; /* erlpic */
+-};
+-
+-/* Checksum and Shadow RAM pointers */
+-#define I40E_SR_NVM_CONTROL_WORD 0x00
+-#define I40E_EMP_MODULE_PTR 0x0F
+-#define I40E_SR_EMP_MODULE_PTR 0x48
+-#define I40E_NVM_OEM_VER_OFF 0x83
+-#define I40E_SR_NVM_DEV_STARTER_VERSION 0x18
+-#define I40E_SR_NVM_WAKE_ON_LAN 0x19
+-#define I40E_SR_ALTERNATE_SAN_MAC_ADDRESS_PTR 0x27
+-#define I40E_SR_NVM_EETRACK_LO 0x2D
+-#define I40E_SR_NVM_EETRACK_HI 0x2E
+-#define I40E_SR_VPD_PTR 0x2F
+-#define I40E_SR_PCIE_ALT_AUTO_LOAD_PTR 0x3E
+-#define I40E_SR_SW_CHECKSUM_WORD 0x3F
+-
+-/* Auxiliary field, mask and shift definition for Shadow RAM and NVM Flash */
+-#define I40E_SR_VPD_MODULE_MAX_SIZE 1024
+-#define I40E_SR_PCIE_ALT_MODULE_MAX_SIZE 1024
+-#define I40E_SR_CONTROL_WORD_1_SHIFT 0x06
+-#define I40E_SR_CONTROL_WORD_1_MASK (0x03 << I40E_SR_CONTROL_WORD_1_SHIFT)
+-#define I40E_SR_CONTROL_WORD_1_NVM_BANK_VALID BIT(5)
+-#define I40E_SR_NVM_MAP_STRUCTURE_TYPE BIT(12)
+-#define I40E_PTR_TYPE BIT(15)
+-
+-/* Shadow RAM related */
+-#define I40E_SR_SECTOR_SIZE_IN_WORDS 0x800
+-#define I40E_SR_WORDS_IN_1KB 512
+-/* Checksum should be calculated such that after adding all the words,
+- * including the checksum word itself, the sum should be 0xBABA.
+- */
+-#define I40E_SR_SW_CHECKSUM_BASE 0xBABA
+-
+-#define I40E_SRRD_SRCTL_ATTEMPTS 100000
+-
+-enum i40e_switch_element_types {
+- I40E_SWITCH_ELEMENT_TYPE_MAC = 1,
+- I40E_SWITCH_ELEMENT_TYPE_PF = 2,
+- I40E_SWITCH_ELEMENT_TYPE_VF = 3,
+- I40E_SWITCH_ELEMENT_TYPE_EMP = 4,
+- I40E_SWITCH_ELEMENT_TYPE_BMC = 6,
+- I40E_SWITCH_ELEMENT_TYPE_PE = 16,
+- I40E_SWITCH_ELEMENT_TYPE_VEB = 17,
+- I40E_SWITCH_ELEMENT_TYPE_PA = 18,
+- I40E_SWITCH_ELEMENT_TYPE_VSI = 19,
+-};
+-
+-/* Supported EtherType filters */
+-enum i40e_ether_type_index {
+- I40E_ETHER_TYPE_1588 = 0,
+- I40E_ETHER_TYPE_FIP = 1,
+- I40E_ETHER_TYPE_OUI_EXTENDED = 2,
+- I40E_ETHER_TYPE_MAC_CONTROL = 3,
+- I40E_ETHER_TYPE_LLDP = 4,
+- I40E_ETHER_TYPE_EVB_PROTOCOL1 = 5,
+- I40E_ETHER_TYPE_EVB_PROTOCOL2 = 6,
+- I40E_ETHER_TYPE_QCN_CNM = 7,
+- I40E_ETHER_TYPE_8021X = 8,
+- I40E_ETHER_TYPE_ARP = 9,
+- I40E_ETHER_TYPE_RSV1 = 10,
+- I40E_ETHER_TYPE_RSV2 = 11,
+-};
+-
+-/* Filter context base size is 1K */
+-#define I40E_HASH_FILTER_BASE_SIZE 1024
+-/* Supported Hash filter values */
+-enum i40e_hash_filter_size {
+- I40E_HASH_FILTER_SIZE_1K = 0,
+- I40E_HASH_FILTER_SIZE_2K = 1,
+- I40E_HASH_FILTER_SIZE_4K = 2,
+- I40E_HASH_FILTER_SIZE_8K = 3,
+- I40E_HASH_FILTER_SIZE_16K = 4,
+- I40E_HASH_FILTER_SIZE_32K = 5,
+- I40E_HASH_FILTER_SIZE_64K = 6,
+- I40E_HASH_FILTER_SIZE_128K = 7,
+- I40E_HASH_FILTER_SIZE_256K = 8,
+- I40E_HASH_FILTER_SIZE_512K = 9,
+- I40E_HASH_FILTER_SIZE_1M = 10,
+-};
+-
+-/* DMA context base size is 0.5K */
+-#define I40E_DMA_CNTX_BASE_SIZE 512
+-/* Supported DMA context values */
+-enum i40e_dma_cntx_size {
+- I40E_DMA_CNTX_SIZE_512 = 0,
+- I40E_DMA_CNTX_SIZE_1K = 1,
+- I40E_DMA_CNTX_SIZE_2K = 2,
+- I40E_DMA_CNTX_SIZE_4K = 3,
+- I40E_DMA_CNTX_SIZE_8K = 4,
+- I40E_DMA_CNTX_SIZE_16K = 5,
+- I40E_DMA_CNTX_SIZE_32K = 6,
+- I40E_DMA_CNTX_SIZE_64K = 7,
+- I40E_DMA_CNTX_SIZE_128K = 8,
+- I40E_DMA_CNTX_SIZE_256K = 9,
+-};
+-
+-/* Supported Hash look up table (LUT) sizes */
+-enum i40e_hash_lut_size {
+- I40E_HASH_LUT_SIZE_128 = 0,
+- I40E_HASH_LUT_SIZE_512 = 1,
+-};
+-
+-/* Structure to hold a per PF filter control settings */
+-struct i40e_filter_control_settings {
+- /* number of PE Quad Hash filter buckets */
+- enum i40e_hash_filter_size pe_filt_num;
+- /* number of PE Quad Hash contexts */
+- enum i40e_dma_cntx_size pe_cntx_num;
+- /* number of FCoE filter buckets */
+- enum i40e_hash_filter_size fcoe_filt_num;
+- /* number of FCoE DDP contexts */
+- enum i40e_dma_cntx_size fcoe_cntx_num;
+- /* size of the Hash LUT */
+- enum i40e_hash_lut_size hash_lut_size;
+- /* enable FDIR filters for PF and its VFs */
+- bool enable_fdir;
+- /* enable Ethertype filters for PF and its VFs */
+- bool enable_ethtype;
+- /* enable MAC/VLAN filters for PF and its VFs */
+- bool enable_macvlan;
+-};
+-
+-/* Structure to hold device level control filter counts */
+-struct i40e_control_filter_stats {
+- u16 mac_etype_used; /* Used perfect match MAC/EtherType filters */
+- u16 etype_used; /* Used perfect EtherType filters */
+- u16 mac_etype_free; /* Un-used perfect match MAC/EtherType filters */
+- u16 etype_free; /* Un-used perfect EtherType filters */
+-};
+-
+-enum i40e_reset_type {
+- I40E_RESET_POR = 0,
+- I40E_RESET_CORER = 1,
+- I40E_RESET_GLOBR = 2,
+- I40E_RESET_EMPR = 3,
+-};
+-
+-/* IEEE 802.1AB LLDP Agent Variables from NVM */
+-#define I40E_NVM_LLDP_CFG_PTR 0x06
+-#define I40E_SR_LLDP_CFG_PTR 0x31
+-
+-/* RSS Hash Table Size */
+-#define I40E_PFQF_CTL_0_HASHLUTSIZE_512 0x00010000
+-
+-/* INPUT SET MASK for RSS, flow director and flexible payload */
+-#define I40E_FD_INSET_L3_SRC_SHIFT 47
+-#define I40E_FD_INSET_L3_SRC_WORD_MASK (0x3ULL << \
+- I40E_FD_INSET_L3_SRC_SHIFT)
+-#define I40E_FD_INSET_L3_DST_SHIFT 35
+-#define I40E_FD_INSET_L3_DST_WORD_MASK (0x3ULL << \
+- I40E_FD_INSET_L3_DST_SHIFT)
+-#define I40E_FD_INSET_L4_SRC_SHIFT 34
+-#define I40E_FD_INSET_L4_SRC_WORD_MASK (0x1ULL << \
+- I40E_FD_INSET_L4_SRC_SHIFT)
+-#define I40E_FD_INSET_L4_DST_SHIFT 33
+-#define I40E_FD_INSET_L4_DST_WORD_MASK (0x1ULL << \
+- I40E_FD_INSET_L4_DST_SHIFT)
+-#define I40E_FD_INSET_VERIFY_TAG_SHIFT 31
+-#define I40E_FD_INSET_VERIFY_TAG_WORD_MASK (0x3ULL << \
+- I40E_FD_INSET_VERIFY_TAG_SHIFT)
+-
+-#define I40E_FD_INSET_FLEX_WORD50_SHIFT 17
+-#define I40E_FD_INSET_FLEX_WORD50_MASK (0x1ULL << \
+- I40E_FD_INSET_FLEX_WORD50_SHIFT)
+-#define I40E_FD_INSET_FLEX_WORD51_SHIFT 16
+-#define I40E_FD_INSET_FLEX_WORD51_MASK (0x1ULL << \
+- I40E_FD_INSET_FLEX_WORD51_SHIFT)
+-#define I40E_FD_INSET_FLEX_WORD52_SHIFT 15
+-#define I40E_FD_INSET_FLEX_WORD52_MASK (0x1ULL << \
+- I40E_FD_INSET_FLEX_WORD52_SHIFT)
+-#define I40E_FD_INSET_FLEX_WORD53_SHIFT 14
+-#define I40E_FD_INSET_FLEX_WORD53_MASK (0x1ULL << \
+- I40E_FD_INSET_FLEX_WORD53_SHIFT)
+-#define I40E_FD_INSET_FLEX_WORD54_SHIFT 13
+-#define I40E_FD_INSET_FLEX_WORD54_MASK (0x1ULL << \
+- I40E_FD_INSET_FLEX_WORD54_SHIFT)
+-#define I40E_FD_INSET_FLEX_WORD55_SHIFT 12
+-#define I40E_FD_INSET_FLEX_WORD55_MASK (0x1ULL << \
+- I40E_FD_INSET_FLEX_WORD55_SHIFT)
+-#define I40E_FD_INSET_FLEX_WORD56_SHIFT 11
+-#define I40E_FD_INSET_FLEX_WORD56_MASK (0x1ULL << \
+- I40E_FD_INSET_FLEX_WORD56_SHIFT)
+-#define I40E_FD_INSET_FLEX_WORD57_SHIFT 10
+-#define I40E_FD_INSET_FLEX_WORD57_MASK (0x1ULL << \
+- I40E_FD_INSET_FLEX_WORD57_SHIFT)
+-
+-/* Version format for Dynamic Device Personalization(DDP) */
+-struct i40e_ddp_version {
+- u8 major;
+- u8 minor;
+- u8 update;
+- u8 draft;
+-};
+-
+-#define I40E_DDP_NAME_SIZE 32
+-
+-/* Package header */
+-struct i40e_package_header {
+- struct i40e_ddp_version version;
+- u32 segment_count;
+- u32 segment_offset[1];
+-};
+-
+-/* Generic segment header */
+-struct i40e_generic_seg_header {
+-#define SEGMENT_TYPE_METADATA 0x00000001
+-#define SEGMENT_TYPE_NOTES 0x00000002
+-#define SEGMENT_TYPE_I40E 0x00000011
+-#define SEGMENT_TYPE_X722 0x00000012
+- u32 type;
+- struct i40e_ddp_version version;
+- u32 size;
+- char name[I40E_DDP_NAME_SIZE];
+-};
+-
+-struct i40e_metadata_segment {
+- struct i40e_generic_seg_header header;
+- struct i40e_ddp_version version;
+- u32 track_id;
+- char name[I40E_DDP_NAME_SIZE];
+-};
+-
+-struct i40e_device_id_entry {
+- u32 vendor_dev_id;
+- u32 sub_vendor_dev_id;
+-};
+-
+-struct i40e_profile_segment {
+- struct i40e_generic_seg_header header;
+- struct i40e_ddp_version version;
+- char name[I40E_DDP_NAME_SIZE];
+- u32 device_table_count;
+- struct i40e_device_id_entry device_table[1];
+-};
+-
+-struct i40e_section_table {
+- u32 section_count;
+- u32 section_offset[1];
+-};
+-
+-struct i40e_profile_section_header {
+- u16 tbl_size;
+- u16 data_end;
+- struct {
+-#define SECTION_TYPE_INFO 0x00000010
+-#define SECTION_TYPE_MMIO 0x00000800
+-#define SECTION_TYPE_AQ 0x00000801
+-#define SECTION_TYPE_NOTE 0x80000000
+-#define SECTION_TYPE_NAME 0x80000001
+- u32 type;
+- u32 offset;
+- u32 size;
+- } section;
+-};
+-
+-struct i40e_profile_info {
+- u32 track_id;
+- struct i40e_ddp_version version;
+- u8 op;
+-#define I40E_DDP_ADD_TRACKID 0x01
+-#define I40E_DDP_REMOVE_TRACKID 0x02
+- u8 reserved[7];
+- u8 name[I40E_DDP_NAME_SIZE];
+-};
+-#endif /* _I40E_TYPE_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf.h b/drivers/net/ethernet/intel/i40evf/i40evf.h
+deleted file mode 100644
+index 96e537a350004..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40evf.h
++++ /dev/null
+@@ -1,427 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40EVF_H_
+-#define _I40EVF_H_
+-
+-#include <linux/module.h>
+-#include <linux/pci.h>
+-#include <linux/aer.h>
+-#include <linux/netdevice.h>
+-#include <linux/vmalloc.h>
+-#include <linux/interrupt.h>
+-#include <linux/ethtool.h>
+-#include <linux/if_vlan.h>
+-#include <linux/ip.h>
+-#include <linux/tcp.h>
+-#include <linux/sctp.h>
+-#include <linux/ipv6.h>
+-#include <linux/kernel.h>
+-#include <linux/bitops.h>
+-#include <linux/timer.h>
+-#include <linux/workqueue.h>
+-#include <linux/wait.h>
+-#include <linux/delay.h>
+-#include <linux/gfp.h>
+-#include <linux/skbuff.h>
+-#include <linux/dma-mapping.h>
+-#include <linux/etherdevice.h>
+-#include <linux/socket.h>
+-#include <linux/jiffies.h>
+-#include <net/ip6_checksum.h>
+-#include <net/pkt_cls.h>
+-#include <net/udp.h>
+-#include <net/tc_act/tc_gact.h>
+-#include <net/tc_act/tc_mirred.h>
+-
+-#include "i40e_type.h"
+-#include <linux/avf/virtchnl.h>
+-#include "i40e_txrx.h"
+-
+-#define DEFAULT_DEBUG_LEVEL_SHIFT 3
+-#define PFX "i40evf: "
+-
+-/* VSI state flags shared with common code */
+-enum i40evf_vsi_state_t {
+- __I40E_VSI_DOWN,
+- /* This must be last as it determines the size of the BITMAP */
+- __I40E_VSI_STATE_SIZE__,
+-};
+-
+-/* dummy struct to make common code less painful */
+-struct i40e_vsi {
+- struct i40evf_adapter *back;
+- struct net_device *netdev;
+- unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
+- u16 seid;
+- u16 id;
+- DECLARE_BITMAP(state, __I40E_VSI_STATE_SIZE__);
+- int base_vector;
+- u16 work_limit;
+- u16 qs_handle;
+- void *priv; /* client driver data reference. */
+-};
+-
+-/* How many Rx Buffers do we bundle into one write to the hardware ? */
+-#define I40EVF_RX_BUFFER_WRITE 16 /* Must be power of 2 */
+-#define I40EVF_DEFAULT_TXD 512
+-#define I40EVF_DEFAULT_RXD 512
+-#define I40EVF_MAX_TXD 4096
+-#define I40EVF_MIN_TXD 64
+-#define I40EVF_MAX_RXD 4096
+-#define I40EVF_MIN_RXD 64
+-#define I40EVF_REQ_DESCRIPTOR_MULTIPLE 32
+-#define I40EVF_MAX_AQ_BUF_SIZE 4096
+-#define I40EVF_AQ_LEN 32
+-#define I40EVF_AQ_MAX_ERR 20 /* times to try before resetting AQ */
+-
+-#define MAXIMUM_ETHERNET_VLAN_SIZE (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)
+-
+-#define I40E_RX_DESC(R, i) (&(((union i40e_32byte_rx_desc *)((R)->desc))[i]))
+-#define I40E_TX_DESC(R, i) (&(((struct i40e_tx_desc *)((R)->desc))[i]))
+-#define I40E_TX_CTXTDESC(R, i) \
+- (&(((struct i40e_tx_context_desc *)((R)->desc))[i]))
+-#define I40EVF_MAX_REQ_QUEUES 4
+-
+-#define I40EVF_HKEY_ARRAY_SIZE ((I40E_VFQF_HKEY_MAX_INDEX + 1) * 4)
+-#define I40EVF_HLUT_ARRAY_SIZE ((I40E_VFQF_HLUT_MAX_INDEX + 1) * 4)
+-#define I40EVF_MBPS_DIVISOR 125000 /* divisor to convert to Mbps */
+-
+-/* MAX_MSIX_Q_VECTORS of these are allocated,
+- * but we only use one per queue-specific vector.
+- */
+-struct i40e_q_vector {
+- struct i40evf_adapter *adapter;
+- struct i40e_vsi *vsi;
+- struct napi_struct napi;
+- struct i40e_ring_container rx;
+- struct i40e_ring_container tx;
+- u32 ring_mask;
+- u8 itr_countdown; /* when 0 should adjust adaptive ITR */
+- u8 num_ringpairs; /* total number of ring pairs in vector */
+- u16 v_idx; /* index in the vsi->q_vector array. */
+- u16 reg_idx; /* register index of the interrupt */
+- char name[IFNAMSIZ + 15];
+- bool arm_wb_state;
+- cpumask_t affinity_mask;
+- struct irq_affinity_notify affinity_notify;
+-};
+-
+-/* Helper macros to switch between ints/sec and what the register uses.
+- * And yes, it's the same math going both ways. The lowest value
+- * supported by all of the i40e hardware is 8.
+- */
+-#define EITR_INTS_PER_SEC_TO_REG(_eitr) \
+- ((_eitr) ? (1000000000 / ((_eitr) * 256)) : 8)
+-#define EITR_REG_TO_INTS_PER_SEC EITR_INTS_PER_SEC_TO_REG
+-
+-#define I40EVF_DESC_UNUSED(R) \
+- ((((R)->next_to_clean > (R)->next_to_use) ? 0 : (R)->count) + \
+- (R)->next_to_clean - (R)->next_to_use - 1)
+-
+-#define I40EVF_RX_DESC_ADV(R, i) \
+- (&(((union i40e_adv_rx_desc *)((R).desc))[i]))
+-#define I40EVF_TX_DESC_ADV(R, i) \
+- (&(((union i40e_adv_tx_desc *)((R).desc))[i]))
+-#define I40EVF_TX_CTXTDESC_ADV(R, i) \
+- (&(((struct i40e_adv_tx_context_desc *)((R).desc))[i]))
+-
+-#define OTHER_VECTOR 1
+-#define NONQ_VECS (OTHER_VECTOR)
+-
+-#define MIN_MSIX_Q_VECTORS 1
+-#define MIN_MSIX_COUNT (MIN_MSIX_Q_VECTORS + NONQ_VECS)
+-
+-#define I40EVF_QUEUE_END_OF_LIST 0x7FF
+-#define I40EVF_FREE_VECTOR 0x7FFF
+-struct i40evf_mac_filter {
+- struct list_head list;
+- u8 macaddr[ETH_ALEN];
+- bool remove; /* filter needs to be removed */
+- bool add; /* filter needs to be added */
+-};
+-
+-struct i40evf_vlan_filter {
+- struct list_head list;
+- u16 vlan;
+- bool remove; /* filter needs to be removed */
+- bool add; /* filter needs to be added */
+-};
+-
+-#define I40EVF_MAX_TRAFFIC_CLASS 4
+-/* State of traffic class creation */
+-enum i40evf_tc_state_t {
+- __I40EVF_TC_INVALID, /* no traffic class, default state */
+- __I40EVF_TC_RUNNING, /* traffic classes have been created */
+-};
+-
+-/* channel info */
+-struct i40evf_channel_config {
+- struct virtchnl_channel_info ch_info[I40EVF_MAX_TRAFFIC_CLASS];
+- enum i40evf_tc_state_t state;
+- u8 total_qps;
+-};
+-
+-/* State of cloud filter */
+-enum i40evf_cloud_filter_state_t {
+- __I40EVF_CF_INVALID, /* cloud filter not added */
+- __I40EVF_CF_ADD_PENDING, /* cloud filter pending add by the PF */
+- __I40EVF_CF_DEL_PENDING, /* cloud filter pending del by the PF */
+- __I40EVF_CF_ACTIVE, /* cloud filter is active */
+-};
+-
+-/* Driver state. The order of these is important! */
+-enum i40evf_state_t {
+- __I40EVF_STARTUP, /* driver loaded, probe complete */
+- __I40EVF_REMOVE, /* driver is being unloaded */
+- __I40EVF_INIT_VERSION_CHECK, /* aq msg sent, awaiting reply */
+- __I40EVF_INIT_GET_RESOURCES, /* aq msg sent, awaiting reply */
+- __I40EVF_INIT_SW, /* got resources, setting up structs */
+- __I40EVF_RESETTING, /* in reset */
+- /* Below here, watchdog is running */
+- __I40EVF_DOWN, /* ready, can be opened */
+- __I40EVF_DOWN_PENDING, /* descending, waiting for watchdog */
+- __I40EVF_TESTING, /* in ethtool self-test */
+- __I40EVF_RUNNING, /* opened, working */
+-};
+-
+-enum i40evf_critical_section_t {
+- __I40EVF_IN_CRITICAL_TASK, /* cannot be interrupted */
+- __I40EVF_IN_CLIENT_TASK,
+- __I40EVF_IN_REMOVE_TASK, /* device being removed */
+-};
+-
+-#define I40EVF_CLOUD_FIELD_OMAC 0x01
+-#define I40EVF_CLOUD_FIELD_IMAC 0x02
+-#define I40EVF_CLOUD_FIELD_IVLAN 0x04
+-#define I40EVF_CLOUD_FIELD_TEN_ID 0x08
+-#define I40EVF_CLOUD_FIELD_IIP 0x10
+-
+-#define I40EVF_CF_FLAGS_OMAC I40EVF_CLOUD_FIELD_OMAC
+-#define I40EVF_CF_FLAGS_IMAC I40EVF_CLOUD_FIELD_IMAC
+-#define I40EVF_CF_FLAGS_IMAC_IVLAN (I40EVF_CLOUD_FIELD_IMAC |\
+- I40EVF_CLOUD_FIELD_IVLAN)
+-#define I40EVF_CF_FLAGS_IMAC_TEN_ID (I40EVF_CLOUD_FIELD_IMAC |\
+- I40EVF_CLOUD_FIELD_TEN_ID)
+-#define I40EVF_CF_FLAGS_OMAC_TEN_ID_IMAC (I40EVF_CLOUD_FIELD_OMAC |\
+- I40EVF_CLOUD_FIELD_IMAC |\
+- I40EVF_CLOUD_FIELD_TEN_ID)
+-#define I40EVF_CF_FLAGS_IMAC_IVLAN_TEN_ID (I40EVF_CLOUD_FIELD_IMAC |\
+- I40EVF_CLOUD_FIELD_IVLAN |\
+- I40EVF_CLOUD_FIELD_TEN_ID)
+-#define I40EVF_CF_FLAGS_IIP I40E_CLOUD_FIELD_IIP
+-
+-/* bookkeeping of cloud filters */
+-struct i40evf_cloud_filter {
+- enum i40evf_cloud_filter_state_t state;
+- struct list_head list;
+- struct virtchnl_filter f;
+- unsigned long cookie;
+- bool del; /* filter needs to be deleted */
+- bool add; /* filter needs to be added */
+-};
+-
+-/* board specific private data structure */
+-struct i40evf_adapter {
+- struct timer_list watchdog_timer;
+- struct work_struct reset_task;
+- struct work_struct adminq_task;
+- struct delayed_work client_task;
+- struct delayed_work init_task;
+- wait_queue_head_t down_waitqueue;
+- struct i40e_q_vector *q_vectors;
+- struct list_head vlan_filter_list;
+- struct list_head mac_filter_list;
+- /* Lock to protect accesses to MAC and VLAN lists */
+- spinlock_t mac_vlan_list_lock;
+- char misc_vector_name[IFNAMSIZ + 9];
+- int num_active_queues;
+- int num_req_queues;
+-
+- /* TX */
+- struct i40e_ring *tx_rings;
+- u32 tx_timeout_count;
+- u32 tx_desc_count;
+-
+- /* RX */
+- struct i40e_ring *rx_rings;
+- u64 hw_csum_rx_error;
+- u32 rx_desc_count;
+- int num_msix_vectors;
+- int num_iwarp_msix;
+- int iwarp_base_vector;
+- u32 client_pending;
+- struct i40e_client_instance *cinst;
+- struct msix_entry *msix_entries;
+-
+- u32 flags;
+-#define I40EVF_FLAG_RX_CSUM_ENABLED BIT(0)
+-#define I40EVF_FLAG_PF_COMMS_FAILED BIT(3)
+-#define I40EVF_FLAG_RESET_PENDING BIT(4)
+-#define I40EVF_FLAG_RESET_NEEDED BIT(5)
+-#define I40EVF_FLAG_WB_ON_ITR_CAPABLE BIT(6)
+-#define I40EVF_FLAG_ADDR_SET_BY_PF BIT(8)
+-#define I40EVF_FLAG_SERVICE_CLIENT_REQUESTED BIT(9)
+-#define I40EVF_FLAG_CLIENT_NEEDS_OPEN BIT(10)
+-#define I40EVF_FLAG_CLIENT_NEEDS_CLOSE BIT(11)
+-#define I40EVF_FLAG_CLIENT_NEEDS_L2_PARAMS BIT(12)
+-#define I40EVF_FLAG_PROMISC_ON BIT(13)
+-#define I40EVF_FLAG_ALLMULTI_ON BIT(14)
+-#define I40EVF_FLAG_LEGACY_RX BIT(15)
+-#define I40EVF_FLAG_REINIT_ITR_NEEDED BIT(16)
+-#define I40EVF_FLAG_QUEUES_DISABLED BIT(17)
+-/* duplicates for common code */
+-#define I40E_FLAG_DCB_ENABLED 0
+-#define I40E_FLAG_RX_CSUM_ENABLED I40EVF_FLAG_RX_CSUM_ENABLED
+-#define I40E_FLAG_LEGACY_RX I40EVF_FLAG_LEGACY_RX
+- /* flags for admin queue service task */
+- u32 aq_required;
+-#define I40EVF_FLAG_AQ_ENABLE_QUEUES BIT(0)
+-#define I40EVF_FLAG_AQ_DISABLE_QUEUES BIT(1)
+-#define I40EVF_FLAG_AQ_ADD_MAC_FILTER BIT(2)
+-#define I40EVF_FLAG_AQ_ADD_VLAN_FILTER BIT(3)
+-#define I40EVF_FLAG_AQ_DEL_MAC_FILTER BIT(4)
+-#define I40EVF_FLAG_AQ_DEL_VLAN_FILTER BIT(5)
+-#define I40EVF_FLAG_AQ_CONFIGURE_QUEUES BIT(6)
+-#define I40EVF_FLAG_AQ_MAP_VECTORS BIT(7)
+-#define I40EVF_FLAG_AQ_HANDLE_RESET BIT(8)
+-#define I40EVF_FLAG_AQ_CONFIGURE_RSS BIT(9) /* direct AQ config */
+-#define I40EVF_FLAG_AQ_GET_CONFIG BIT(10)
+-/* Newer style, RSS done by the PF so we can ignore hardware vagaries. */
+-#define I40EVF_FLAG_AQ_GET_HENA BIT(11)
+-#define I40EVF_FLAG_AQ_SET_HENA BIT(12)
+-#define I40EVF_FLAG_AQ_SET_RSS_KEY BIT(13)
+-#define I40EVF_FLAG_AQ_SET_RSS_LUT BIT(14)
+-#define I40EVF_FLAG_AQ_REQUEST_PROMISC BIT(15)
+-#define I40EVF_FLAG_AQ_RELEASE_PROMISC BIT(16)
+-#define I40EVF_FLAG_AQ_REQUEST_ALLMULTI BIT(17)
+-#define I40EVF_FLAG_AQ_RELEASE_ALLMULTI BIT(18)
+-#define I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING BIT(19)
+-#define I40EVF_FLAG_AQ_DISABLE_VLAN_STRIPPING BIT(20)
+-#define I40EVF_FLAG_AQ_ENABLE_CHANNELS BIT(21)
+-#define I40EVF_FLAG_AQ_DISABLE_CHANNELS BIT(22)
+-#define I40EVF_FLAG_AQ_ADD_CLOUD_FILTER BIT(23)
+-#define I40EVF_FLAG_AQ_DEL_CLOUD_FILTER BIT(24)
+-
+- /* OS defined structs */
+- struct net_device *netdev;
+- struct pci_dev *pdev;
+-
+- struct i40e_hw hw; /* defined in i40e_type.h */
+-
+- enum i40evf_state_t state;
+- unsigned long crit_section;
+-
+- struct work_struct watchdog_task;
+- bool netdev_registered;
+- bool link_up;
+- enum virtchnl_link_speed link_speed;
+- enum virtchnl_ops current_op;
+-#define CLIENT_ALLOWED(_a) ((_a)->vf_res ? \
+- (_a)->vf_res->vf_cap_flags & \
+- VIRTCHNL_VF_OFFLOAD_IWARP : \
+- 0)
+-#define CLIENT_ENABLED(_a) ((_a)->cinst)
+-/* RSS by the PF should be preferred over RSS via other methods. */
+-#define RSS_PF(_a) ((_a)->vf_res->vf_cap_flags & \
+- VIRTCHNL_VF_OFFLOAD_RSS_PF)
+-#define RSS_AQ(_a) ((_a)->vf_res->vf_cap_flags & \
+- VIRTCHNL_VF_OFFLOAD_RSS_AQ)
+-#define RSS_REG(_a) (!((_a)->vf_res->vf_cap_flags & \
+- (VIRTCHNL_VF_OFFLOAD_RSS_AQ | \
+- VIRTCHNL_VF_OFFLOAD_RSS_PF)))
+-#define VLAN_ALLOWED(_a) ((_a)->vf_res->vf_cap_flags & \
+- VIRTCHNL_VF_OFFLOAD_VLAN)
+- struct virtchnl_vf_resource *vf_res; /* incl. all VSIs */
+- struct virtchnl_vsi_resource *vsi_res; /* our LAN VSI */
+- struct virtchnl_version_info pf_version;
+-#define PF_IS_V11(_a) (((_a)->pf_version.major == 1) && \
+- ((_a)->pf_version.minor == 1))
+- u16 msg_enable;
+- struct i40e_eth_stats current_stats;
+- struct i40e_vsi vsi;
+- u32 aq_wait_count;
+- /* RSS stuff */
+- u64 hena;
+- u16 rss_key_size;
+- u16 rss_lut_size;
+- u8 *rss_key;
+- u8 *rss_lut;
+- /* ADQ related members */
+- struct i40evf_channel_config ch_config;
+- u8 num_tc;
+- struct list_head cloud_filter_list;
+- /* lock to protest access to the cloud filter list */
+- spinlock_t cloud_filter_list_lock;
+- u16 num_cloud_filters;
+-};
+-
+-
+-/* Ethtool Private Flags */
+-
+-/* lan device */
+-struct i40e_device {
+- struct list_head list;
+- struct i40evf_adapter *vf;
+-};
+-
+-/* needed by i40evf_ethtool.c */
+-extern char i40evf_driver_name[];
+-extern const char i40evf_driver_version[];
+-
+-int i40evf_up(struct i40evf_adapter *adapter);
+-void i40evf_down(struct i40evf_adapter *adapter);
+-int i40evf_process_config(struct i40evf_adapter *adapter);
+-void i40evf_schedule_reset(struct i40evf_adapter *adapter);
+-void i40evf_reset(struct i40evf_adapter *adapter);
+-void i40evf_set_ethtool_ops(struct net_device *netdev);
+-void i40evf_update_stats(struct i40evf_adapter *adapter);
+-void i40evf_reset_interrupt_capability(struct i40evf_adapter *adapter);
+-int i40evf_init_interrupt_scheme(struct i40evf_adapter *adapter);
+-void i40evf_irq_enable_queues(struct i40evf_adapter *adapter, u32 mask);
+-void i40evf_free_all_tx_resources(struct i40evf_adapter *adapter);
+-void i40evf_free_all_rx_resources(struct i40evf_adapter *adapter);
+-
+-void i40e_napi_add_all(struct i40evf_adapter *adapter);
+-void i40e_napi_del_all(struct i40evf_adapter *adapter);
+-
+-int i40evf_send_api_ver(struct i40evf_adapter *adapter);
+-int i40evf_verify_api_ver(struct i40evf_adapter *adapter);
+-int i40evf_send_vf_config_msg(struct i40evf_adapter *adapter);
+-int i40evf_get_vf_config(struct i40evf_adapter *adapter);
+-void i40evf_irq_enable(struct i40evf_adapter *adapter, bool flush);
+-void i40evf_configure_queues(struct i40evf_adapter *adapter);
+-void i40evf_deconfigure_queues(struct i40evf_adapter *adapter);
+-void i40evf_enable_queues(struct i40evf_adapter *adapter);
+-void i40evf_disable_queues(struct i40evf_adapter *adapter);
+-void i40evf_map_queues(struct i40evf_adapter *adapter);
+-int i40evf_request_queues(struct i40evf_adapter *adapter, int num);
+-void i40evf_add_ether_addrs(struct i40evf_adapter *adapter);
+-void i40evf_del_ether_addrs(struct i40evf_adapter *adapter);
+-void i40evf_add_vlans(struct i40evf_adapter *adapter);
+-void i40evf_del_vlans(struct i40evf_adapter *adapter);
+-void i40evf_set_promiscuous(struct i40evf_adapter *adapter, int flags);
+-void i40evf_request_stats(struct i40evf_adapter *adapter);
+-void i40evf_request_reset(struct i40evf_adapter *adapter);
+-void i40evf_get_hena(struct i40evf_adapter *adapter);
+-void i40evf_set_hena(struct i40evf_adapter *adapter);
+-void i40evf_set_rss_key(struct i40evf_adapter *adapter);
+-void i40evf_set_rss_lut(struct i40evf_adapter *adapter);
+-void i40evf_enable_vlan_stripping(struct i40evf_adapter *adapter);
+-void i40evf_disable_vlan_stripping(struct i40evf_adapter *adapter);
+-void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
+- enum virtchnl_ops v_opcode,
+- i40e_status v_retval, u8 *msg, u16 msglen);
+-int i40evf_config_rss(struct i40evf_adapter *adapter);
+-int i40evf_lan_add_device(struct i40evf_adapter *adapter);
+-int i40evf_lan_del_device(struct i40evf_adapter *adapter);
+-void i40evf_client_subtask(struct i40evf_adapter *adapter);
+-void i40evf_notify_client_message(struct i40e_vsi *vsi, u8 *msg, u16 len);
+-void i40evf_notify_client_l2_params(struct i40e_vsi *vsi);
+-void i40evf_notify_client_open(struct i40e_vsi *vsi);
+-void i40evf_notify_client_close(struct i40e_vsi *vsi, bool reset);
+-void i40evf_enable_channels(struct i40evf_adapter *adapter);
+-void i40evf_disable_channels(struct i40evf_adapter *adapter);
+-void i40evf_add_cloud_filter(struct i40evf_adapter *adapter);
+-void i40evf_del_cloud_filter(struct i40evf_adapter *adapter);
+-#endif /* _I40EVF_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_client.c b/drivers/net/ethernet/intel/i40evf/i40evf_client.c
+deleted file mode 100644
+index 3cc9d60d0d72e..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_client.c
++++ /dev/null
+@@ -1,579 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#include <linux/list.h>
+-#include <linux/errno.h>
+-
+-#include "i40evf.h"
+-#include "i40e_prototype.h"
+-#include "i40evf_client.h"
+-
+-static
+-const char i40evf_client_interface_version_str[] = I40EVF_CLIENT_VERSION_STR;
+-static struct i40e_client *vf_registered_client;
+-static LIST_HEAD(i40evf_devices);
+-static DEFINE_MUTEX(i40evf_device_mutex);
+-
+-static u32 i40evf_client_virtchnl_send(struct i40e_info *ldev,
+- struct i40e_client *client,
+- u8 *msg, u16 len);
+-
+-static int i40evf_client_setup_qvlist(struct i40e_info *ldev,
+- struct i40e_client *client,
+- struct i40e_qvlist_info *qvlist_info);
+-
+-static struct i40e_ops i40evf_lan_ops = {
+- .virtchnl_send = i40evf_client_virtchnl_send,
+- .setup_qvlist = i40evf_client_setup_qvlist,
+-};
+-
+-/**
+- * i40evf_client_get_params - retrieve relevant client parameters
+- * @vsi: VSI with parameters
+- * @params: client param struct
+- **/
+-static
+-void i40evf_client_get_params(struct i40e_vsi *vsi, struct i40e_params *params)
+-{
+- int i;
+-
+- memset(params, 0, sizeof(struct i40e_params));
+- params->mtu = vsi->netdev->mtu;
+- params->link_up = vsi->back->link_up;
+-
+- for (i = 0; i < I40E_MAX_USER_PRIORITY; i++) {
+- params->qos.prio_qos[i].tc = 0;
+- params->qos.prio_qos[i].qs_handle = vsi->qs_handle;
+- }
+-}
+-
+-/**
+- * i40evf_notify_client_message - call the client message receive callback
+- * @vsi: the VSI associated with this client
+- * @msg: message buffer
+- * @len: length of message
+- *
+- * If there is a client to this VSI, call the client
+- **/
+-void i40evf_notify_client_message(struct i40e_vsi *vsi, u8 *msg, u16 len)
+-{
+- struct i40e_client_instance *cinst;
+-
+- if (!vsi)
+- return;
+-
+- cinst = vsi->back->cinst;
+- if (!cinst || !cinst->client || !cinst->client->ops ||
+- !cinst->client->ops->virtchnl_receive) {
+- dev_dbg(&vsi->back->pdev->dev,
+- "Cannot locate client instance virtchnl_receive function\n");
+- return;
+- }
+- cinst->client->ops->virtchnl_receive(&cinst->lan_info, cinst->client,
+- msg, len);
+-}
+-
+-/**
+- * i40evf_notify_client_l2_params - call the client notify callback
+- * @vsi: the VSI with l2 param changes
+- *
+- * If there is a client to this VSI, call the client
+- **/
+-void i40evf_notify_client_l2_params(struct i40e_vsi *vsi)
+-{
+- struct i40e_client_instance *cinst;
+- struct i40e_params params;
+-
+- if (!vsi)
+- return;
+-
+- cinst = vsi->back->cinst;
+-
+- if (!cinst || !cinst->client || !cinst->client->ops ||
+- !cinst->client->ops->l2_param_change) {
+- dev_dbg(&vsi->back->pdev->dev,
+- "Cannot locate client instance l2_param_change function\n");
+- return;
+- }
+- i40evf_client_get_params(vsi, ¶ms);
+- cinst->lan_info.params = params;
+- cinst->client->ops->l2_param_change(&cinst->lan_info, cinst->client,
+- ¶ms);
+-}
+-
+-/**
+- * i40evf_notify_client_open - call the client open callback
+- * @vsi: the VSI with netdev opened
+- *
+- * If there is a client to this netdev, call the client with open
+- **/
+-void i40evf_notify_client_open(struct i40e_vsi *vsi)
+-{
+- struct i40evf_adapter *adapter = vsi->back;
+- struct i40e_client_instance *cinst = adapter->cinst;
+- int ret;
+-
+- if (!cinst || !cinst->client || !cinst->client->ops ||
+- !cinst->client->ops->open) {
+- dev_dbg(&vsi->back->pdev->dev,
+- "Cannot locate client instance open function\n");
+- return;
+- }
+- if (!(test_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state))) {
+- ret = cinst->client->ops->open(&cinst->lan_info, cinst->client);
+- if (!ret)
+- set_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state);
+- }
+-}
+-
+-/**
+- * i40evf_client_release_qvlist - send a message to the PF to release iwarp qv map
+- * @ldev: pointer to L2 context.
+- *
+- * Return 0 on success or < 0 on error
+- **/
+-static int i40evf_client_release_qvlist(struct i40e_info *ldev)
+-{
+- struct i40evf_adapter *adapter = ldev->vf;
+- i40e_status err;
+-
+- if (adapter->aq_required)
+- return -EAGAIN;
+-
+- err = i40e_aq_send_msg_to_pf(&adapter->hw,
+- VIRTCHNL_OP_RELEASE_IWARP_IRQ_MAP,
+- I40E_SUCCESS, NULL, 0, NULL);
+-
+- if (err)
+- dev_err(&adapter->pdev->dev,
+- "Unable to send iWarp vector release message to PF, error %d, aq status %d\n",
+- err, adapter->hw.aq.asq_last_status);
+-
+- return err;
+-}
+-
+-/**
+- * i40evf_notify_client_close - call the client close callback
+- * @vsi: the VSI with netdev closed
+- * @reset: true when close called due to reset pending
+- *
+- * If there is a client to this netdev, call the client with close
+- **/
+-void i40evf_notify_client_close(struct i40e_vsi *vsi, bool reset)
+-{
+- struct i40evf_adapter *adapter = vsi->back;
+- struct i40e_client_instance *cinst = adapter->cinst;
+-
+- if (!cinst || !cinst->client || !cinst->client->ops ||
+- !cinst->client->ops->close) {
+- dev_dbg(&vsi->back->pdev->dev,
+- "Cannot locate client instance close function\n");
+- return;
+- }
+- cinst->client->ops->close(&cinst->lan_info, cinst->client, reset);
+- i40evf_client_release_qvlist(&cinst->lan_info);
+- clear_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state);
+-}
+-
+-/**
+- * i40evf_client_add_instance - add a client instance to the instance list
+- * @adapter: pointer to the board struct
+- *
+- * Returns cinst ptr on success, NULL on failure
+- **/
+-static struct i40e_client_instance *
+-i40evf_client_add_instance(struct i40evf_adapter *adapter)
+-{
+- struct i40e_client_instance *cinst = NULL;
+- struct i40e_vsi *vsi = &adapter->vsi;
+- struct netdev_hw_addr *mac = NULL;
+- struct i40e_params params;
+-
+- if (!vf_registered_client)
+- goto out;
+-
+- if (adapter->cinst) {
+- cinst = adapter->cinst;
+- goto out;
+- }
+-
+- cinst = kzalloc(sizeof(*cinst), GFP_KERNEL);
+- if (!cinst)
+- goto out;
+-
+- cinst->lan_info.vf = (void *)adapter;
+- cinst->lan_info.netdev = vsi->netdev;
+- cinst->lan_info.pcidev = adapter->pdev;
+- cinst->lan_info.fid = 0;
+- cinst->lan_info.ftype = I40E_CLIENT_FTYPE_VF;
+- cinst->lan_info.hw_addr = adapter->hw.hw_addr;
+- cinst->lan_info.ops = &i40evf_lan_ops;
+- cinst->lan_info.version.major = I40EVF_CLIENT_VERSION_MAJOR;
+- cinst->lan_info.version.minor = I40EVF_CLIENT_VERSION_MINOR;
+- cinst->lan_info.version.build = I40EVF_CLIENT_VERSION_BUILD;
+- i40evf_client_get_params(vsi, ¶ms);
+- cinst->lan_info.params = params;
+- set_bit(__I40E_CLIENT_INSTANCE_NONE, &cinst->state);
+-
+- cinst->lan_info.msix_count = adapter->num_iwarp_msix;
+- cinst->lan_info.msix_entries =
+- &adapter->msix_entries[adapter->iwarp_base_vector];
+-
+- mac = list_first_entry(&cinst->lan_info.netdev->dev_addrs.list,
+- struct netdev_hw_addr, list);
+- if (mac)
+- ether_addr_copy(cinst->lan_info.lanmac, mac->addr);
+- else
+- dev_err(&adapter->pdev->dev, "MAC address list is empty!\n");
+-
+- cinst->client = vf_registered_client;
+- adapter->cinst = cinst;
+-out:
+- return cinst;
+-}
+-
+-/**
+- * i40evf_client_del_instance - removes a client instance from the list
+- * @adapter: pointer to the board struct
+- *
+- **/
+-static
+-void i40evf_client_del_instance(struct i40evf_adapter *adapter)
+-{
+- kfree(adapter->cinst);
+- adapter->cinst = NULL;
+-}
+-
+-/**
+- * i40evf_client_subtask - client maintenance work
+- * @adapter: board private structure
+- **/
+-void i40evf_client_subtask(struct i40evf_adapter *adapter)
+-{
+- struct i40e_client *client = vf_registered_client;
+- struct i40e_client_instance *cinst;
+- int ret = 0;
+-
+- if (adapter->state < __I40EVF_DOWN)
+- return;
+-
+- /* first check client is registered */
+- if (!client)
+- return;
+-
+- /* Add the client instance to the instance list */
+- cinst = i40evf_client_add_instance(adapter);
+- if (!cinst)
+- return;
+-
+- dev_info(&adapter->pdev->dev, "Added instance of Client %s\n",
+- client->name);
+-
+- if (!test_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state)) {
+- /* Send an Open request to the client */
+-
+- if (client->ops && client->ops->open)
+- ret = client->ops->open(&cinst->lan_info, client);
+- if (!ret)
+- set_bit(__I40E_CLIENT_INSTANCE_OPENED,
+- &cinst->state);
+- else
+- /* remove client instance */
+- i40evf_client_del_instance(adapter);
+- }
+-}
+-
+-/**
+- * i40evf_lan_add_device - add a lan device struct to the list of lan devices
+- * @adapter: pointer to the board struct
+- *
+- * Returns 0 on success or none 0 on error
+- **/
+-int i40evf_lan_add_device(struct i40evf_adapter *adapter)
+-{
+- struct i40e_device *ldev;
+- int ret = 0;
+-
+- mutex_lock(&i40evf_device_mutex);
+- list_for_each_entry(ldev, &i40evf_devices, list) {
+- if (ldev->vf == adapter) {
+- ret = -EEXIST;
+- goto out;
+- }
+- }
+- ldev = kzalloc(sizeof(*ldev), GFP_KERNEL);
+- if (!ldev) {
+- ret = -ENOMEM;
+- goto out;
+- }
+- ldev->vf = adapter;
+- INIT_LIST_HEAD(&ldev->list);
+- list_add(&ldev->list, &i40evf_devices);
+- dev_info(&adapter->pdev->dev, "Added LAN device bus=0x%02x dev=0x%02x func=0x%02x\n",
+- adapter->hw.bus.bus_id, adapter->hw.bus.device,
+- adapter->hw.bus.func);
+-
+- /* Since in some cases register may have happened before a device gets
+- * added, we can schedule a subtask to go initiate the clients.
+- */
+- adapter->flags |= I40EVF_FLAG_SERVICE_CLIENT_REQUESTED;
+-
+-out:
+- mutex_unlock(&i40evf_device_mutex);
+- return ret;
+-}
+-
+-/**
+- * i40evf_lan_del_device - removes a lan device from the device list
+- * @adapter: pointer to the board struct
+- *
+- * Returns 0 on success or non-0 on error
+- **/
+-int i40evf_lan_del_device(struct i40evf_adapter *adapter)
+-{
+- struct i40e_device *ldev, *tmp;
+- int ret = -ENODEV;
+-
+- mutex_lock(&i40evf_device_mutex);
+- list_for_each_entry_safe(ldev, tmp, &i40evf_devices, list) {
+- if (ldev->vf == adapter) {
+- dev_info(&adapter->pdev->dev,
+- "Deleted LAN device bus=0x%02x dev=0x%02x func=0x%02x\n",
+- adapter->hw.bus.bus_id, adapter->hw.bus.device,
+- adapter->hw.bus.func);
+- list_del(&ldev->list);
+- kfree(ldev);
+- ret = 0;
+- break;
+- }
+- }
+-
+- mutex_unlock(&i40evf_device_mutex);
+- return ret;
+-}
+-
+-/**
+- * i40evf_client_release - release client specific resources
+- * @client: pointer to the registered client
+- *
+- **/
+-static void i40evf_client_release(struct i40e_client *client)
+-{
+- struct i40e_client_instance *cinst;
+- struct i40e_device *ldev;
+- struct i40evf_adapter *adapter;
+-
+- mutex_lock(&i40evf_device_mutex);
+- list_for_each_entry(ldev, &i40evf_devices, list) {
+- adapter = ldev->vf;
+- cinst = adapter->cinst;
+- if (!cinst)
+- continue;
+- if (test_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state)) {
+- if (client->ops && client->ops->close)
+- client->ops->close(&cinst->lan_info, client,
+- false);
+- i40evf_client_release_qvlist(&cinst->lan_info);
+- clear_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state);
+-
+- dev_warn(&adapter->pdev->dev,
+- "Client %s instance closed\n", client->name);
+- }
+- /* delete the client instance */
+- i40evf_client_del_instance(adapter);
+- dev_info(&adapter->pdev->dev, "Deleted client instance of Client %s\n",
+- client->name);
+- }
+- mutex_unlock(&i40evf_device_mutex);
+-}
+-
+-/**
+- * i40evf_client_prepare - prepare client specific resources
+- * @client: pointer to the registered client
+- *
+- **/
+-static void i40evf_client_prepare(struct i40e_client *client)
+-{
+- struct i40e_device *ldev;
+- struct i40evf_adapter *adapter;
+-
+- mutex_lock(&i40evf_device_mutex);
+- list_for_each_entry(ldev, &i40evf_devices, list) {
+- adapter = ldev->vf;
+- /* Signal the watchdog to service the client */
+- adapter->flags |= I40EVF_FLAG_SERVICE_CLIENT_REQUESTED;
+- }
+- mutex_unlock(&i40evf_device_mutex);
+-}
+-
+-/**
+- * i40evf_client_virtchnl_send - send a message to the PF instance
+- * @ldev: pointer to L2 context.
+- * @client: Client pointer.
+- * @msg: pointer to message buffer
+- * @len: message length
+- *
+- * Return 0 on success or < 0 on error
+- **/
+-static u32 i40evf_client_virtchnl_send(struct i40e_info *ldev,
+- struct i40e_client *client,
+- u8 *msg, u16 len)
+-{
+- struct i40evf_adapter *adapter = ldev->vf;
+- i40e_status err;
+-
+- if (adapter->aq_required)
+- return -EAGAIN;
+-
+- err = i40e_aq_send_msg_to_pf(&adapter->hw, VIRTCHNL_OP_IWARP,
+- I40E_SUCCESS, msg, len, NULL);
+- if (err)
+- dev_err(&adapter->pdev->dev, "Unable to send iWarp message to PF, error %d, aq status %d\n",
+- err, adapter->hw.aq.asq_last_status);
+-
+- return err;
+-}
+-
+-/**
+- * i40evf_client_setup_qvlist - send a message to the PF to setup iwarp qv map
+- * @ldev: pointer to L2 context.
+- * @client: Client pointer.
+- * @qvlist_info: queue and vector list
+- *
+- * Return 0 on success or < 0 on error
+- **/
+-static int i40evf_client_setup_qvlist(struct i40e_info *ldev,
+- struct i40e_client *client,
+- struct i40e_qvlist_info *qvlist_info)
+-{
+- struct virtchnl_iwarp_qvlist_info *v_qvlist_info;
+- struct i40evf_adapter *adapter = ldev->vf;
+- struct i40e_qv_info *qv_info;
+- i40e_status err;
+- u32 v_idx, i;
+- u32 msg_size;
+-
+- if (adapter->aq_required)
+- return -EAGAIN;
+-
+- /* A quick check on whether the vectors belong to the client */
+- for (i = 0; i < qvlist_info->num_vectors; i++) {
+- qv_info = &qvlist_info->qv_info[i];
+- if (!qv_info)
+- continue;
+- v_idx = qv_info->v_idx;
+- if ((v_idx >=
+- (adapter->iwarp_base_vector + adapter->num_iwarp_msix)) ||
+- (v_idx < adapter->iwarp_base_vector))
+- return -EINVAL;
+- }
+-
+- v_qvlist_info = (struct virtchnl_iwarp_qvlist_info *)qvlist_info;
+- msg_size = sizeof(struct virtchnl_iwarp_qvlist_info) +
+- (sizeof(struct virtchnl_iwarp_qv_info) *
+- (v_qvlist_info->num_vectors - 1));
+-
+- adapter->client_pending |= BIT(VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP);
+- err = i40e_aq_send_msg_to_pf(&adapter->hw,
+- VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP,
+- I40E_SUCCESS, (u8 *)v_qvlist_info, msg_size, NULL);
+-
+- if (err) {
+- dev_err(&adapter->pdev->dev,
+- "Unable to send iWarp vector config message to PF, error %d, aq status %d\n",
+- err, adapter->hw.aq.asq_last_status);
+- goto out;
+- }
+-
+- err = -EBUSY;
+- for (i = 0; i < 5; i++) {
+- msleep(100);
+- if (!(adapter->client_pending &
+- BIT(VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP))) {
+- err = 0;
+- break;
+- }
+- }
+-out:
+- return err;
+-}
+-
+-/**
+- * i40evf_register_client - Register a i40e client driver with the L2 driver
+- * @client: pointer to the i40e_client struct
+- *
+- * Returns 0 on success or non-0 on error
+- **/
+-int i40evf_register_client(struct i40e_client *client)
+-{
+- int ret = 0;
+-
+- if (!client) {
+- ret = -EIO;
+- goto out;
+- }
+-
+- if (strlen(client->name) == 0) {
+- pr_info("i40evf: Failed to register client with no name\n");
+- ret = -EIO;
+- goto out;
+- }
+-
+- if (vf_registered_client) {
+- pr_info("i40evf: Client %s has already been registered!\n",
+- client->name);
+- ret = -EEXIST;
+- goto out;
+- }
+-
+- if ((client->version.major != I40EVF_CLIENT_VERSION_MAJOR) ||
+- (client->version.minor != I40EVF_CLIENT_VERSION_MINOR)) {
+- pr_info("i40evf: Failed to register client %s due to mismatched client interface version\n",
+- client->name);
+- pr_info("Client is using version: %02d.%02d.%02d while LAN driver supports %s\n",
+- client->version.major, client->version.minor,
+- client->version.build,
+- i40evf_client_interface_version_str);
+- ret = -EIO;
+- goto out;
+- }
+-
+- vf_registered_client = client;
+-
+- i40evf_client_prepare(client);
+-
+- pr_info("i40evf: Registered client %s with return code %d\n",
+- client->name, ret);
+-out:
+- return ret;
+-}
+-EXPORT_SYMBOL(i40evf_register_client);
+-
+-/**
+- * i40evf_unregister_client - Unregister a i40e client driver with the L2 driver
+- * @client: pointer to the i40e_client struct
+- *
+- * Returns 0 on success or non-0 on error
+- **/
+-int i40evf_unregister_client(struct i40e_client *client)
+-{
+- int ret = 0;
+-
+- /* When a unregister request comes through we would have to send
+- * a close for each of the client instances that were opened.
+- * client_release function is called to handle this.
+- */
+- i40evf_client_release(client);
+-
+- if (vf_registered_client != client) {
+- pr_info("i40evf: Client %s has not been registered\n",
+- client->name);
+- ret = -ENODEV;
+- goto out;
+- }
+- vf_registered_client = NULL;
+- pr_info("i40evf: Unregistered client %s\n", client->name);
+-out:
+- return ret;
+-}
+-EXPORT_SYMBOL(i40evf_unregister_client);
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_client.h b/drivers/net/ethernet/intel/i40evf/i40evf_client.h
+deleted file mode 100644
+index 5585f362048a7..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_client.h
++++ /dev/null
+@@ -1,169 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#ifndef _I40EVF_CLIENT_H_
+-#define _I40EVF_CLIENT_H_
+-
+-#define I40EVF_CLIENT_STR_LENGTH 10
+-
+-/* Client interface version should be updated anytime there is a change in the
+- * existing APIs or data structures.
+- */
+-#define I40EVF_CLIENT_VERSION_MAJOR 0
+-#define I40EVF_CLIENT_VERSION_MINOR 01
+-#define I40EVF_CLIENT_VERSION_BUILD 00
+-#define I40EVF_CLIENT_VERSION_STR \
+- __stringify(I40EVF_CLIENT_VERSION_MAJOR) "." \
+- __stringify(I40EVF_CLIENT_VERSION_MINOR) "." \
+- __stringify(I40EVF_CLIENT_VERSION_BUILD)
+-
+-struct i40e_client_version {
+- u8 major;
+- u8 minor;
+- u8 build;
+- u8 rsvd;
+-};
+-
+-enum i40e_client_state {
+- __I40E_CLIENT_NULL,
+- __I40E_CLIENT_REGISTERED
+-};
+-
+-enum i40e_client_instance_state {
+- __I40E_CLIENT_INSTANCE_NONE,
+- __I40E_CLIENT_INSTANCE_OPENED,
+-};
+-
+-struct i40e_ops;
+-struct i40e_client;
+-
+-/* HW does not define a type value for AEQ; only for RX/TX and CEQ.
+- * In order for us to keep the interface simple, SW will define a
+- * unique type value for AEQ.
+- */
+-#define I40E_QUEUE_TYPE_PE_AEQ 0x80
+-#define I40E_QUEUE_INVALID_IDX 0xFFFF
+-
+-struct i40e_qv_info {
+- u32 v_idx; /* msix_vector */
+- u16 ceq_idx;
+- u16 aeq_idx;
+- u8 itr_idx;
+-};
+-
+-struct i40e_qvlist_info {
+- u32 num_vectors;
+- struct i40e_qv_info qv_info[1];
+-};
+-
+-#define I40E_CLIENT_MSIX_ALL 0xFFFFFFFF
+-
+-/* set of LAN parameters useful for clients managed by LAN */
+-
+-/* Struct to hold per priority info */
+-struct i40e_prio_qos_params {
+- u16 qs_handle; /* qs handle for prio */
+- u8 tc; /* TC mapped to prio */
+- u8 reserved;
+-};
+-
+-#define I40E_CLIENT_MAX_USER_PRIORITY 8
+-/* Struct to hold Client QoS */
+-struct i40e_qos_params {
+- struct i40e_prio_qos_params prio_qos[I40E_CLIENT_MAX_USER_PRIORITY];
+-};
+-
+-struct i40e_params {
+- struct i40e_qos_params qos;
+- u16 mtu;
+- u16 link_up; /* boolean */
+-};
+-
+-/* Structure to hold LAN device info for a client device */
+-struct i40e_info {
+- struct i40e_client_version version;
+- u8 lanmac[6];
+- struct net_device *netdev;
+- struct pci_dev *pcidev;
+- u8 __iomem *hw_addr;
+- u8 fid; /* function id, PF id or VF id */
+-#define I40E_CLIENT_FTYPE_PF 0
+-#define I40E_CLIENT_FTYPE_VF 1
+- u8 ftype; /* function type, PF or VF */
+- void *vf; /* cast to i40evf_adapter */
+-
+- /* All L2 params that could change during the life span of the device
+- * and needs to be communicated to the client when they change
+- */
+- struct i40e_params params;
+- struct i40e_ops *ops;
+-
+- u16 msix_count; /* number of msix vectors*/
+- /* Array down below will be dynamically allocated based on msix_count */
+- struct msix_entry *msix_entries;
+- u16 itr_index; /* Which ITR index the PE driver is suppose to use */
+-};
+-
+-struct i40e_ops {
+- /* setup_q_vector_list enables queues with a particular vector */
+- int (*setup_qvlist)(struct i40e_info *ldev, struct i40e_client *client,
+- struct i40e_qvlist_info *qv_info);
+-
+- u32 (*virtchnl_send)(struct i40e_info *ldev, struct i40e_client *client,
+- u8 *msg, u16 len);
+-
+- /* If the PE Engine is unresponsive, RDMA driver can request a reset.*/
+- void (*request_reset)(struct i40e_info *ldev,
+- struct i40e_client *client);
+-};
+-
+-struct i40e_client_ops {
+- /* Should be called from register_client() or whenever the driver is
+- * ready to create a specific client instance.
+- */
+- int (*open)(struct i40e_info *ldev, struct i40e_client *client);
+-
+- /* Should be closed when netdev is unavailable or when unregister
+- * call comes in. If the close happens due to a reset, set the reset
+- * bit to true.
+- */
+- void (*close)(struct i40e_info *ldev, struct i40e_client *client,
+- bool reset);
+-
+- /* called when some l2 managed parameters changes - mss */
+- void (*l2_param_change)(struct i40e_info *ldev,
+- struct i40e_client *client,
+- struct i40e_params *params);
+-
+- /* called when a message is received from the PF */
+- int (*virtchnl_receive)(struct i40e_info *ldev,
+- struct i40e_client *client,
+- u8 *msg, u16 len);
+-};
+-
+-/* Client device */
+-struct i40e_client_instance {
+- struct list_head list;
+- struct i40e_info lan_info;
+- struct i40e_client *client;
+- unsigned long state;
+-};
+-
+-struct i40e_client {
+- struct list_head list; /* list of registered clients */
+- char name[I40EVF_CLIENT_STR_LENGTH];
+- struct i40e_client_version version;
+- unsigned long state; /* client state */
+- atomic_t ref_cnt; /* Count of all the client devices of this kind */
+- u32 flags;
+-#define I40E_CLIENT_FLAGS_LAUNCH_ON_PROBE BIT(0)
+-#define I40E_TX_FLAGS_NOTIFY_OTHER_EVENTS BIT(2)
+- u8 type;
+-#define I40E_CLIENT_IWARP 0
+- struct i40e_client_ops *ops; /* client ops provided by the client */
+-};
+-
+-/* used by clients */
+-int i40evf_register_client(struct i40e_client *client);
+-int i40evf_unregister_client(struct i40e_client *client);
+-#endif /* _I40EVF_CLIENT_H_ */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_ethtool.c b/drivers/net/ethernet/intel/i40evf/i40evf_ethtool.c
+deleted file mode 100644
+index 69efe0aec76a4..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_ethtool.c
++++ /dev/null
+@@ -1,820 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-/* ethtool support for i40evf */
+-#include "i40evf.h"
+-
+-#include <linux/uaccess.h>
+-
+-struct i40evf_stats {
+- char stat_string[ETH_GSTRING_LEN];
+- int stat_offset;
+-};
+-
+-#define I40EVF_STAT(_name, _stat) { \
+- .stat_string = _name, \
+- .stat_offset = offsetof(struct i40evf_adapter, _stat) \
+-}
+-
+-/* All stats are u64, so we don't need to track the size of the field. */
+-static const struct i40evf_stats i40evf_gstrings_stats[] = {
+- I40EVF_STAT("rx_bytes", current_stats.rx_bytes),
+- I40EVF_STAT("rx_unicast", current_stats.rx_unicast),
+- I40EVF_STAT("rx_multicast", current_stats.rx_multicast),
+- I40EVF_STAT("rx_broadcast", current_stats.rx_broadcast),
+- I40EVF_STAT("rx_discards", current_stats.rx_discards),
+- I40EVF_STAT("rx_unknown_protocol", current_stats.rx_unknown_protocol),
+- I40EVF_STAT("tx_bytes", current_stats.tx_bytes),
+- I40EVF_STAT("tx_unicast", current_stats.tx_unicast),
+- I40EVF_STAT("tx_multicast", current_stats.tx_multicast),
+- I40EVF_STAT("tx_broadcast", current_stats.tx_broadcast),
+- I40EVF_STAT("tx_discards", current_stats.tx_discards),
+- I40EVF_STAT("tx_errors", current_stats.tx_errors),
+-};
+-
+-#define I40EVF_GLOBAL_STATS_LEN ARRAY_SIZE(i40evf_gstrings_stats)
+-#define I40EVF_QUEUE_STATS_LEN(_dev) \
+- (((struct i40evf_adapter *)\
+- netdev_priv(_dev))->num_active_queues \
+- * 2 * (sizeof(struct i40e_queue_stats) / sizeof(u64)))
+-#define I40EVF_STATS_LEN(_dev) \
+- (I40EVF_GLOBAL_STATS_LEN + I40EVF_QUEUE_STATS_LEN(_dev))
+-
+-/* For now we have one and only one private flag and it is only defined
+- * when we have support for the SKIP_CPU_SYNC DMA attribute. Instead
+- * of leaving all this code sitting around empty we will strip it unless
+- * our one private flag is actually available.
+- */
+-struct i40evf_priv_flags {
+- char flag_string[ETH_GSTRING_LEN];
+- u32 flag;
+- bool read_only;
+-};
+-
+-#define I40EVF_PRIV_FLAG(_name, _flag, _read_only) { \
+- .flag_string = _name, \
+- .flag = _flag, \
+- .read_only = _read_only, \
+-}
+-
+-static const struct i40evf_priv_flags i40evf_gstrings_priv_flags[] = {
+- I40EVF_PRIV_FLAG("legacy-rx", I40EVF_FLAG_LEGACY_RX, 0),
+-};
+-
+-#define I40EVF_PRIV_FLAGS_STR_LEN ARRAY_SIZE(i40evf_gstrings_priv_flags)
+-
+-/**
+- * i40evf_get_link_ksettings - Get Link Speed and Duplex settings
+- * @netdev: network interface device structure
+- * @cmd: ethtool command
+- *
+- * Reports speed/duplex settings. Because this is a VF, we don't know what
+- * kind of link we really have, so we fake it.
+- **/
+-static int i40evf_get_link_ksettings(struct net_device *netdev,
+- struct ethtool_link_ksettings *cmd)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- ethtool_link_ksettings_zero_link_mode(cmd, supported);
+- cmd->base.autoneg = AUTONEG_DISABLE;
+- cmd->base.port = PORT_NONE;
+- /* Set speed and duplex */
+- switch (adapter->link_speed) {
+- case I40E_LINK_SPEED_40GB:
+- cmd->base.speed = SPEED_40000;
+- break;
+- case I40E_LINK_SPEED_25GB:
+-#ifdef SPEED_25000
+- cmd->base.speed = SPEED_25000;
+-#else
+- netdev_info(netdev,
+- "Speed is 25G, display not supported by this version of ethtool.\n");
+-#endif
+- break;
+- case I40E_LINK_SPEED_20GB:
+- cmd->base.speed = SPEED_20000;
+- break;
+- case I40E_LINK_SPEED_10GB:
+- cmd->base.speed = SPEED_10000;
+- break;
+- case I40E_LINK_SPEED_1GB:
+- cmd->base.speed = SPEED_1000;
+- break;
+- case I40E_LINK_SPEED_100MB:
+- cmd->base.speed = SPEED_100;
+- break;
+- default:
+- break;
+- }
+- cmd->base.duplex = DUPLEX_FULL;
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_get_sset_count - Get length of string set
+- * @netdev: network interface device structure
+- * @sset: id of string set
+- *
+- * Reports size of string table. This driver only supports
+- * strings for statistics.
+- **/
+-static int i40evf_get_sset_count(struct net_device *netdev, int sset)
+-{
+- if (sset == ETH_SS_STATS)
+- return I40EVF_STATS_LEN(netdev);
+- else if (sset == ETH_SS_PRIV_FLAGS)
+- return I40EVF_PRIV_FLAGS_STR_LEN;
+- else
+- return -EINVAL;
+-}
+-
+-/**
+- * i40evf_get_ethtool_stats - report device statistics
+- * @netdev: network interface device structure
+- * @stats: ethtool statistics structure
+- * @data: pointer to data buffer
+- *
+- * All statistics are added to the data buffer as an array of u64.
+- **/
+-static void i40evf_get_ethtool_stats(struct net_device *netdev,
+- struct ethtool_stats *stats, u64 *data)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- unsigned int i, j;
+- char *p;
+-
+- for (i = 0; i < I40EVF_GLOBAL_STATS_LEN; i++) {
+- p = (char *)adapter + i40evf_gstrings_stats[i].stat_offset;
+- data[i] = *(u64 *)p;
+- }
+- for (j = 0; j < adapter->num_active_queues; j++) {
+- data[i++] = adapter->tx_rings[j].stats.packets;
+- data[i++] = adapter->tx_rings[j].stats.bytes;
+- }
+- for (j = 0; j < adapter->num_active_queues; j++) {
+- data[i++] = adapter->rx_rings[j].stats.packets;
+- data[i++] = adapter->rx_rings[j].stats.bytes;
+- }
+-}
+-
+-/**
+- * i40evf_get_strings - Get string set
+- * @netdev: network interface device structure
+- * @sset: id of string set
+- * @data: buffer for string data
+- *
+- * Builds stats string table.
+- **/
+-static void i40evf_get_strings(struct net_device *netdev, u32 sset, u8 *data)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- u8 *p = data;
+- int i;
+-
+- if (sset == ETH_SS_STATS) {
+- for (i = 0; i < (int)I40EVF_GLOBAL_STATS_LEN; i++) {
+- memcpy(p, i40evf_gstrings_stats[i].stat_string,
+- ETH_GSTRING_LEN);
+- p += ETH_GSTRING_LEN;
+- }
+- for (i = 0; i < adapter->num_active_queues; i++) {
+- snprintf(p, ETH_GSTRING_LEN, "tx-%u.packets", i);
+- p += ETH_GSTRING_LEN;
+- snprintf(p, ETH_GSTRING_LEN, "tx-%u.bytes", i);
+- p += ETH_GSTRING_LEN;
+- }
+- for (i = 0; i < adapter->num_active_queues; i++) {
+- snprintf(p, ETH_GSTRING_LEN, "rx-%u.packets", i);
+- p += ETH_GSTRING_LEN;
+- snprintf(p, ETH_GSTRING_LEN, "rx-%u.bytes", i);
+- p += ETH_GSTRING_LEN;
+- }
+- } else if (sset == ETH_SS_PRIV_FLAGS) {
+- for (i = 0; i < I40EVF_PRIV_FLAGS_STR_LEN; i++) {
+- snprintf(p, ETH_GSTRING_LEN, "%s",
+- i40evf_gstrings_priv_flags[i].flag_string);
+- p += ETH_GSTRING_LEN;
+- }
+- }
+-}
+-
+-/**
+- * i40evf_get_priv_flags - report device private flags
+- * @netdev: network interface device structure
+- *
+- * The get string set count and the string set should be matched for each
+- * flag returned. Add new strings for each flag to the i40e_gstrings_priv_flags
+- * array.
+- *
+- * Returns a u32 bitmap of flags.
+- **/
+-static u32 i40evf_get_priv_flags(struct net_device *netdev)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- u32 i, ret_flags = 0;
+-
+- for (i = 0; i < I40EVF_PRIV_FLAGS_STR_LEN; i++) {
+- const struct i40evf_priv_flags *priv_flags;
+-
+- priv_flags = &i40evf_gstrings_priv_flags[i];
+-
+- if (priv_flags->flag & adapter->flags)
+- ret_flags |= BIT(i);
+- }
+-
+- return ret_flags;
+-}
+-
+-/**
+- * i40evf_set_priv_flags - set private flags
+- * @netdev: network interface device structure
+- * @flags: bit flags to be set
+- **/
+-static int i40evf_set_priv_flags(struct net_device *netdev, u32 flags)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- u32 orig_flags, new_flags, changed_flags;
+- u32 i;
+-
+- orig_flags = READ_ONCE(adapter->flags);
+- new_flags = orig_flags;
+-
+- for (i = 0; i < I40EVF_PRIV_FLAGS_STR_LEN; i++) {
+- const struct i40evf_priv_flags *priv_flags;
+-
+- priv_flags = &i40evf_gstrings_priv_flags[i];
+-
+- if (flags & BIT(i))
+- new_flags |= priv_flags->flag;
+- else
+- new_flags &= ~(priv_flags->flag);
+-
+- if (priv_flags->read_only &&
+- ((orig_flags ^ new_flags) & ~BIT(i)))
+- return -EOPNOTSUPP;
+- }
+-
+- /* Before we finalize any flag changes, any checks which we need to
+- * perform to determine if the new flags will be supported should go
+- * here...
+- */
+-
+- /* Compare and exchange the new flags into place. If we failed, that
+- * is if cmpxchg returns anything but the old value, this means
+- * something else must have modified the flags variable since we
+- * copied it. We'll just punt with an error and log something in the
+- * message buffer.
+- */
+- if (cmpxchg(&adapter->flags, orig_flags, new_flags) != orig_flags) {
+- dev_warn(&adapter->pdev->dev,
+- "Unable to update adapter->flags as it was modified by another thread...\n");
+- return -EAGAIN;
+- }
+-
+- changed_flags = orig_flags ^ new_flags;
+-
+- /* Process any additional changes needed as a result of flag changes.
+- * The changed_flags value reflects the list of bits that were changed
+- * in the code above.
+- */
+-
+- /* issue a reset to force legacy-rx change to take effect */
+- if (changed_flags & I40EVF_FLAG_LEGACY_RX) {
+- if (netif_running(netdev)) {
+- adapter->flags |= I40EVF_FLAG_RESET_NEEDED;
+- schedule_work(&adapter->reset_task);
+- }
+- }
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_get_msglevel - Get debug message level
+- * @netdev: network interface device structure
+- *
+- * Returns current debug message level.
+- **/
+-static u32 i40evf_get_msglevel(struct net_device *netdev)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- return adapter->msg_enable;
+-}
+-
+-/**
+- * i40evf_set_msglevel - Set debug message level
+- * @netdev: network interface device structure
+- * @data: message level
+- *
+- * Set current debug message level. Higher values cause the driver to
+- * be noisier.
+- **/
+-static void i40evf_set_msglevel(struct net_device *netdev, u32 data)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- if (I40E_DEBUG_USER & data)
+- adapter->hw.debug_mask = data;
+- adapter->msg_enable = data;
+-}
+-
+-/**
+- * i40evf_get_drvinfo - Get driver info
+- * @netdev: network interface device structure
+- * @drvinfo: ethool driver info structure
+- *
+- * Returns information about the driver and device for display to the user.
+- **/
+-static void i40evf_get_drvinfo(struct net_device *netdev,
+- struct ethtool_drvinfo *drvinfo)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- strlcpy(drvinfo->driver, i40evf_driver_name, 32);
+- strlcpy(drvinfo->version, i40evf_driver_version, 32);
+- strlcpy(drvinfo->fw_version, "N/A", 4);
+- strlcpy(drvinfo->bus_info, pci_name(adapter->pdev), 32);
+- drvinfo->n_priv_flags = I40EVF_PRIV_FLAGS_STR_LEN;
+-}
+-
+-/**
+- * i40evf_get_ringparam - Get ring parameters
+- * @netdev: network interface device structure
+- * @ring: ethtool ringparam structure
+- *
+- * Returns current ring parameters. TX and RX rings are reported separately,
+- * but the number of rings is not reported.
+- **/
+-static void i40evf_get_ringparam(struct net_device *netdev,
+- struct ethtool_ringparam *ring)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- ring->rx_max_pending = I40EVF_MAX_RXD;
+- ring->tx_max_pending = I40EVF_MAX_TXD;
+- ring->rx_pending = adapter->rx_desc_count;
+- ring->tx_pending = adapter->tx_desc_count;
+-}
+-
+-/**
+- * i40evf_set_ringparam - Set ring parameters
+- * @netdev: network interface device structure
+- * @ring: ethtool ringparam structure
+- *
+- * Sets ring parameters. TX and RX rings are controlled separately, but the
+- * number of rings is not specified, so all rings get the same settings.
+- **/
+-static int i40evf_set_ringparam(struct net_device *netdev,
+- struct ethtool_ringparam *ring)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- u32 new_rx_count, new_tx_count;
+-
+- if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
+- return -EINVAL;
+-
+- new_tx_count = clamp_t(u32, ring->tx_pending,
+- I40EVF_MIN_TXD,
+- I40EVF_MAX_TXD);
+- new_tx_count = ALIGN(new_tx_count, I40EVF_REQ_DESCRIPTOR_MULTIPLE);
+-
+- new_rx_count = clamp_t(u32, ring->rx_pending,
+- I40EVF_MIN_RXD,
+- I40EVF_MAX_RXD);
+- new_rx_count = ALIGN(new_rx_count, I40EVF_REQ_DESCRIPTOR_MULTIPLE);
+-
+- /* if nothing to do return success */
+- if ((new_tx_count == adapter->tx_desc_count) &&
+- (new_rx_count == adapter->rx_desc_count))
+- return 0;
+-
+- adapter->tx_desc_count = new_tx_count;
+- adapter->rx_desc_count = new_rx_count;
+-
+- if (netif_running(netdev)) {
+- adapter->flags |= I40EVF_FLAG_RESET_NEEDED;
+- schedule_work(&adapter->reset_task);
+- }
+-
+- return 0;
+-}
+-
+-/**
+- * __i40evf_get_coalesce - get per-queue coalesce settings
+- * @netdev: the netdev to check
+- * @ec: ethtool coalesce data structure
+- * @queue: which queue to pick
+- *
+- * Gets the per-queue settings for coalescence. Specifically Rx and Tx usecs
+- * are per queue. If queue is <0 then we default to queue 0 as the
+- * representative value.
+- **/
+-static int __i40evf_get_coalesce(struct net_device *netdev,
+- struct ethtool_coalesce *ec,
+- int queue)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- struct i40e_vsi *vsi = &adapter->vsi;
+- struct i40e_ring *rx_ring, *tx_ring;
+-
+- ec->tx_max_coalesced_frames = vsi->work_limit;
+- ec->rx_max_coalesced_frames = vsi->work_limit;
+-
+- /* Rx and Tx usecs per queue value. If user doesn't specify the
+- * queue, return queue 0's value to represent.
+- */
+- if (queue < 0)
+- queue = 0;
+- else if (queue >= adapter->num_active_queues)
+- return -EINVAL;
+-
+- rx_ring = &adapter->rx_rings[queue];
+- tx_ring = &adapter->tx_rings[queue];
+-
+- if (ITR_IS_DYNAMIC(rx_ring->itr_setting))
+- ec->use_adaptive_rx_coalesce = 1;
+-
+- if (ITR_IS_DYNAMIC(tx_ring->itr_setting))
+- ec->use_adaptive_tx_coalesce = 1;
+-
+- ec->rx_coalesce_usecs = rx_ring->itr_setting & ~I40E_ITR_DYNAMIC;
+- ec->tx_coalesce_usecs = tx_ring->itr_setting & ~I40E_ITR_DYNAMIC;
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_get_coalesce - Get interrupt coalescing settings
+- * @netdev: network interface device structure
+- * @ec: ethtool coalesce structure
+- *
+- * Returns current coalescing settings. This is referred to elsewhere in the
+- * driver as Interrupt Throttle Rate, as this is how the hardware describes
+- * this functionality. Note that if per-queue settings have been modified this
+- * only represents the settings of queue 0.
+- **/
+-static int i40evf_get_coalesce(struct net_device *netdev,
+- struct ethtool_coalesce *ec)
+-{
+- return __i40evf_get_coalesce(netdev, ec, -1);
+-}
+-
+-/**
+- * i40evf_get_per_queue_coalesce - get coalesce values for specific queue
+- * @netdev: netdev to read
+- * @ec: coalesce settings from ethtool
+- * @queue: the queue to read
+- *
+- * Read specific queue's coalesce settings.
+- **/
+-static int i40evf_get_per_queue_coalesce(struct net_device *netdev,
+- u32 queue,
+- struct ethtool_coalesce *ec)
+-{
+- return __i40evf_get_coalesce(netdev, ec, queue);
+-}
+-
+-/**
+- * i40evf_set_itr_per_queue - set ITR values for specific queue
+- * @adapter: the VF adapter struct to set values for
+- * @ec: coalesce settings from ethtool
+- * @queue: the queue to modify
+- *
+- * Change the ITR settings for a specific queue.
+- **/
+-static void i40evf_set_itr_per_queue(struct i40evf_adapter *adapter,
+- struct ethtool_coalesce *ec,
+- int queue)
+-{
+- struct i40e_ring *rx_ring = &adapter->rx_rings[queue];
+- struct i40e_ring *tx_ring = &adapter->tx_rings[queue];
+- struct i40e_q_vector *q_vector;
+-
+- rx_ring->itr_setting = ITR_REG_ALIGN(ec->rx_coalesce_usecs);
+- tx_ring->itr_setting = ITR_REG_ALIGN(ec->tx_coalesce_usecs);
+-
+- rx_ring->itr_setting |= I40E_ITR_DYNAMIC;
+- if (!ec->use_adaptive_rx_coalesce)
+- rx_ring->itr_setting ^= I40E_ITR_DYNAMIC;
+-
+- tx_ring->itr_setting |= I40E_ITR_DYNAMIC;
+- if (!ec->use_adaptive_tx_coalesce)
+- tx_ring->itr_setting ^= I40E_ITR_DYNAMIC;
+-
+- q_vector = rx_ring->q_vector;
+- q_vector->rx.target_itr = ITR_TO_REG(rx_ring->itr_setting);
+-
+- q_vector = tx_ring->q_vector;
+- q_vector->tx.target_itr = ITR_TO_REG(tx_ring->itr_setting);
+-
+- /* The interrupt handler itself will take care of programming
+- * the Tx and Rx ITR values based on the values we have entered
+- * into the q_vector, no need to write the values now.
+- */
+-}
+-
+-/**
+- * __i40evf_set_coalesce - set coalesce settings for particular queue
+- * @netdev: the netdev to change
+- * @ec: ethtool coalesce settings
+- * @queue: the queue to change
+- *
+- * Sets the coalesce settings for a particular queue.
+- **/
+-static int __i40evf_set_coalesce(struct net_device *netdev,
+- struct ethtool_coalesce *ec,
+- int queue)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- struct i40e_vsi *vsi = &adapter->vsi;
+- int i;
+-
+- if (ec->tx_max_coalesced_frames_irq || ec->rx_max_coalesced_frames_irq)
+- vsi->work_limit = ec->tx_max_coalesced_frames_irq;
+-
+- if (ec->rx_coalesce_usecs == 0) {
+- if (ec->use_adaptive_rx_coalesce)
+- netif_info(adapter, drv, netdev, "rx-usecs=0, need to disable adaptive-rx for a complete disable\n");
+- } else if ((ec->rx_coalesce_usecs < I40E_MIN_ITR) ||
+- (ec->rx_coalesce_usecs > I40E_MAX_ITR)) {
+- netif_info(adapter, drv, netdev, "Invalid value, rx-usecs range is 0-8160\n");
+- return -EINVAL;
+- }
+-
+- else
+- if (ec->tx_coalesce_usecs == 0) {
+- if (ec->use_adaptive_tx_coalesce)
+- netif_info(adapter, drv, netdev, "tx-usecs=0, need to disable adaptive-tx for a complete disable\n");
+- } else if ((ec->tx_coalesce_usecs < I40E_MIN_ITR) ||
+- (ec->tx_coalesce_usecs > I40E_MAX_ITR)) {
+- netif_info(adapter, drv, netdev, "Invalid value, tx-usecs range is 0-8160\n");
+- return -EINVAL;
+- }
+-
+- /* Rx and Tx usecs has per queue value. If user doesn't specify the
+- * queue, apply to all queues.
+- */
+- if (queue < 0) {
+- for (i = 0; i < adapter->num_active_queues; i++)
+- i40evf_set_itr_per_queue(adapter, ec, i);
+- } else if (queue < adapter->num_active_queues) {
+- i40evf_set_itr_per_queue(adapter, ec, queue);
+- } else {
+- netif_info(adapter, drv, netdev, "Invalid queue value, queue range is 0 - %d\n",
+- adapter->num_active_queues - 1);
+- return -EINVAL;
+- }
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_set_coalesce - Set interrupt coalescing settings
+- * @netdev: network interface device structure
+- * @ec: ethtool coalesce structure
+- *
+- * Change current coalescing settings for every queue.
+- **/
+-static int i40evf_set_coalesce(struct net_device *netdev,
+- struct ethtool_coalesce *ec)
+-{
+- return __i40evf_set_coalesce(netdev, ec, -1);
+-}
+-
+-/**
+- * i40evf_set_per_queue_coalesce - set specific queue's coalesce settings
+- * @netdev: the netdev to change
+- * @ec: ethtool's coalesce settings
+- * @queue: the queue to modify
+- *
+- * Modifies a specific queue's coalesce settings.
+- */
+-static int i40evf_set_per_queue_coalesce(struct net_device *netdev,
+- u32 queue,
+- struct ethtool_coalesce *ec)
+-{
+- return __i40evf_set_coalesce(netdev, ec, queue);
+-}
+-
+-/**
+- * i40evf_get_rxnfc - command to get RX flow classification rules
+- * @netdev: network interface device structure
+- * @cmd: ethtool rxnfc command
+- * @rule_locs: pointer to store rule locations
+- *
+- * Returns Success if the command is supported.
+- **/
+-static int i40evf_get_rxnfc(struct net_device *netdev,
+- struct ethtool_rxnfc *cmd,
+- u32 *rule_locs)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- int ret = -EOPNOTSUPP;
+-
+- switch (cmd->cmd) {
+- case ETHTOOL_GRXRINGS:
+- cmd->data = adapter->num_active_queues;
+- ret = 0;
+- break;
+- case ETHTOOL_GRXFH:
+- netdev_info(netdev,
+- "RSS hash info is not available to vf, use pf.\n");
+- break;
+- default:
+- break;
+- }
+-
+- return ret;
+-}
+-/**
+- * i40evf_get_channels: get the number of channels supported by the device
+- * @netdev: network interface device structure
+- * @ch: channel information structure
+- *
+- * For the purposes of our device, we only use combined channels, i.e. a tx/rx
+- * queue pair. Report one extra channel to match our "other" MSI-X vector.
+- **/
+-static void i40evf_get_channels(struct net_device *netdev,
+- struct ethtool_channels *ch)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- /* Report maximum channels */
+- ch->max_combined = I40EVF_MAX_REQ_QUEUES;
+-
+- ch->max_other = NONQ_VECS;
+- ch->other_count = NONQ_VECS;
+-
+- ch->combined_count = adapter->num_active_queues;
+-}
+-
+-/**
+- * i40evf_set_channels: set the new channel count
+- * @netdev: network interface device structure
+- * @ch: channel information structure
+- *
+- * Negotiate a new number of channels with the PF then do a reset. During
+- * reset we'll realloc queues and fix the RSS table. Returns 0 on success,
+- * negative on failure.
+- **/
+-static int i40evf_set_channels(struct net_device *netdev,
+- struct ethtool_channels *ch)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- int num_req = ch->combined_count;
+-
+- if (num_req != adapter->num_active_queues &&
+- !(adapter->vf_res->vf_cap_flags &
+- VIRTCHNL_VF_OFFLOAD_REQ_QUEUES)) {
+- dev_info(&adapter->pdev->dev, "PF is not capable of queue negotiation.\n");
+- return -EINVAL;
+- }
+-
+- if ((adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
+- adapter->num_tc) {
+- dev_info(&adapter->pdev->dev, "Cannot set channels since ADq is enabled.\n");
+- return -EINVAL;
+- }
+-
+- /* All of these should have already been checked by ethtool before this
+- * even gets to us, but just to be sure.
+- */
+- if (num_req <= 0 || num_req > I40EVF_MAX_REQ_QUEUES)
+- return -EINVAL;
+-
+- if (ch->rx_count || ch->tx_count || ch->other_count != NONQ_VECS)
+- return -EINVAL;
+-
+- adapter->num_req_queues = num_req;
+- return i40evf_request_queues(adapter, num_req);
+-}
+-
+-/**
+- * i40evf_get_rxfh_key_size - get the RSS hash key size
+- * @netdev: network interface device structure
+- *
+- * Returns the table size.
+- **/
+-static u32 i40evf_get_rxfh_key_size(struct net_device *netdev)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- return adapter->rss_key_size;
+-}
+-
+-/**
+- * i40evf_get_rxfh_indir_size - get the rx flow hash indirection table size
+- * @netdev: network interface device structure
+- *
+- * Returns the table size.
+- **/
+-static u32 i40evf_get_rxfh_indir_size(struct net_device *netdev)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- return adapter->rss_lut_size;
+-}
+-
+-/**
+- * i40evf_get_rxfh - get the rx flow hash indirection table
+- * @netdev: network interface device structure
+- * @indir: indirection table
+- * @key: hash key
+- * @hfunc: hash function in use
+- *
+- * Reads the indirection table directly from the hardware. Always returns 0.
+- **/
+-static int i40evf_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,
+- u8 *hfunc)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- u16 i;
+-
+- if (hfunc)
+- *hfunc = ETH_RSS_HASH_TOP;
+- if (!indir)
+- return 0;
+-
+- memcpy(key, adapter->rss_key, adapter->rss_key_size);
+-
+- /* Each 32 bits pointed by 'indir' is stored with a lut entry */
+- for (i = 0; i < adapter->rss_lut_size; i++)
+- indir[i] = (u32)adapter->rss_lut[i];
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_set_rxfh - set the rx flow hash indirection table
+- * @netdev: network interface device structure
+- * @indir: indirection table
+- * @key: hash key
+- * @hfunc: hash function to use
+- *
+- * Returns -EINVAL if the table specifies an inavlid queue id, otherwise
+- * returns 0 after programming the table.
+- **/
+-static int i40evf_set_rxfh(struct net_device *netdev, const u32 *indir,
+- const u8 *key, const u8 hfunc)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- u16 i;
+-
+- /* We do not allow change in unsupported parameters */
+- if (key ||
+- (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP))
+- return -EOPNOTSUPP;
+- if (!indir)
+- return 0;
+-
+- if (key) {
+- memcpy(adapter->rss_key, key, adapter->rss_key_size);
+- }
+-
+- /* Each 32 bits pointed by 'indir' is stored with a lut entry */
+- for (i = 0; i < adapter->rss_lut_size; i++)
+- adapter->rss_lut[i] = (u8)(indir[i]);
+-
+- return i40evf_config_rss(adapter);
+-}
+-
+-static const struct ethtool_ops i40evf_ethtool_ops = {
+- .get_drvinfo = i40evf_get_drvinfo,
+- .get_link = ethtool_op_get_link,
+- .get_ringparam = i40evf_get_ringparam,
+- .set_ringparam = i40evf_set_ringparam,
+- .get_strings = i40evf_get_strings,
+- .get_ethtool_stats = i40evf_get_ethtool_stats,
+- .get_sset_count = i40evf_get_sset_count,
+- .get_priv_flags = i40evf_get_priv_flags,
+- .set_priv_flags = i40evf_set_priv_flags,
+- .get_msglevel = i40evf_get_msglevel,
+- .set_msglevel = i40evf_set_msglevel,
+- .get_coalesce = i40evf_get_coalesce,
+- .set_coalesce = i40evf_set_coalesce,
+- .get_per_queue_coalesce = i40evf_get_per_queue_coalesce,
+- .set_per_queue_coalesce = i40evf_set_per_queue_coalesce,
+- .get_rxnfc = i40evf_get_rxnfc,
+- .get_rxfh_indir_size = i40evf_get_rxfh_indir_size,
+- .get_rxfh = i40evf_get_rxfh,
+- .set_rxfh = i40evf_set_rxfh,
+- .get_channels = i40evf_get_channels,
+- .set_channels = i40evf_set_channels,
+- .get_rxfh_key_size = i40evf_get_rxfh_key_size,
+- .get_link_ksettings = i40evf_get_link_ksettings,
+-};
+-
+-/**
+- * i40evf_set_ethtool_ops - Initialize ethtool ops struct
+- * @netdev: network interface device structure
+- *
+- * Sets ethtool ops struct in our netdev so that ethtool can call
+- * our functions.
+- **/
+-void i40evf_set_ethtool_ops(struct net_device *netdev)
+-{
+- netdev->ethtool_ops = &i40evf_ethtool_ops;
+-}
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+deleted file mode 100644
+index 5a6e579e9e653..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
++++ /dev/null
+@@ -1,3989 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#include "i40evf.h"
+-#include "i40e_prototype.h"
+-#include "i40evf_client.h"
+-/* All i40evf tracepoints are defined by the include below, which must
+- * be included exactly once across the whole kernel with
+- * CREATE_TRACE_POINTS defined
+- */
+-#define CREATE_TRACE_POINTS
+-#include "i40e_trace.h"
+-
+-static int i40evf_setup_all_tx_resources(struct i40evf_adapter *adapter);
+-static int i40evf_setup_all_rx_resources(struct i40evf_adapter *adapter);
+-static int i40evf_close(struct net_device *netdev);
+-
+-char i40evf_driver_name[] = "i40evf";
+-static const char i40evf_driver_string[] =
+- "Intel(R) 40-10 Gigabit Virtual Function Network Driver";
+-
+-#define DRV_KERN "-k"
+-
+-#define DRV_VERSION_MAJOR 3
+-#define DRV_VERSION_MINOR 2
+-#define DRV_VERSION_BUILD 2
+-#define DRV_VERSION __stringify(DRV_VERSION_MAJOR) "." \
+- __stringify(DRV_VERSION_MINOR) "." \
+- __stringify(DRV_VERSION_BUILD) \
+- DRV_KERN
+-const char i40evf_driver_version[] = DRV_VERSION;
+-static const char i40evf_copyright[] =
+- "Copyright (c) 2013 - 2015 Intel Corporation.";
+-
+-/* i40evf_pci_tbl - PCI Device ID Table
+- *
+- * Wildcard entries (PCI_ANY_ID) should come last
+- * Last entry must be all 0s
+- *
+- * { Vendor ID, Device ID, SubVendor ID, SubDevice ID,
+- * Class, Class Mask, private data (not used) }
+- */
+-static const struct pci_device_id i40evf_pci_tbl[] = {
+- {PCI_VDEVICE(INTEL, I40E_DEV_ID_VF), 0},
+- {PCI_VDEVICE(INTEL, I40E_DEV_ID_VF_HV), 0},
+- {PCI_VDEVICE(INTEL, I40E_DEV_ID_X722_VF), 0},
+- {PCI_VDEVICE(INTEL, I40E_DEV_ID_ADAPTIVE_VF), 0},
+- /* required last entry */
+- {0, }
+-};
+-
+-MODULE_DEVICE_TABLE(pci, i40evf_pci_tbl);
+-
+-MODULE_AUTHOR("Intel Corporation, <linux.nics@intel.com>");
+-MODULE_DESCRIPTION("Intel(R) XL710 X710 Virtual Function Network Driver");
+-MODULE_LICENSE("GPL");
+-MODULE_VERSION(DRV_VERSION);
+-
+-static struct workqueue_struct *i40evf_wq;
+-
+-/**
+- * i40evf_allocate_dma_mem_d - OS specific memory alloc for shared code
+- * @hw: pointer to the HW structure
+- * @mem: ptr to mem struct to fill out
+- * @size: size of memory requested
+- * @alignment: what to align the allocation to
+- **/
+-i40e_status i40evf_allocate_dma_mem_d(struct i40e_hw *hw,
+- struct i40e_dma_mem *mem,
+- u64 size, u32 alignment)
+-{
+- struct i40evf_adapter *adapter = (struct i40evf_adapter *)hw->back;
+-
+- if (!mem)
+- return I40E_ERR_PARAM;
+-
+- mem->size = ALIGN(size, alignment);
+- mem->va = dma_alloc_coherent(&adapter->pdev->dev, mem->size,
+- (dma_addr_t *)&mem->pa, GFP_KERNEL);
+- if (mem->va)
+- return 0;
+- else
+- return I40E_ERR_NO_MEMORY;
+-}
+-
+-/**
+- * i40evf_free_dma_mem_d - OS specific memory free for shared code
+- * @hw: pointer to the HW structure
+- * @mem: ptr to mem struct to free
+- **/
+-i40e_status i40evf_free_dma_mem_d(struct i40e_hw *hw, struct i40e_dma_mem *mem)
+-{
+- struct i40evf_adapter *adapter = (struct i40evf_adapter *)hw->back;
+-
+- if (!mem || !mem->va)
+- return I40E_ERR_PARAM;
+- dma_free_coherent(&adapter->pdev->dev, mem->size,
+- mem->va, (dma_addr_t)mem->pa);
+- return 0;
+-}
+-
+-/**
+- * i40evf_allocate_virt_mem_d - OS specific memory alloc for shared code
+- * @hw: pointer to the HW structure
+- * @mem: ptr to mem struct to fill out
+- * @size: size of memory requested
+- **/
+-i40e_status i40evf_allocate_virt_mem_d(struct i40e_hw *hw,
+- struct i40e_virt_mem *mem, u32 size)
+-{
+- if (!mem)
+- return I40E_ERR_PARAM;
+-
+- mem->size = size;
+- mem->va = kzalloc(size, GFP_KERNEL);
+-
+- if (mem->va)
+- return 0;
+- else
+- return I40E_ERR_NO_MEMORY;
+-}
+-
+-/**
+- * i40evf_free_virt_mem_d - OS specific memory free for shared code
+- * @hw: pointer to the HW structure
+- * @mem: ptr to mem struct to free
+- **/
+-i40e_status i40evf_free_virt_mem_d(struct i40e_hw *hw,
+- struct i40e_virt_mem *mem)
+-{
+- if (!mem)
+- return I40E_ERR_PARAM;
+-
+- /* it's ok to kfree a NULL pointer */
+- kfree(mem->va);
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_debug_d - OS dependent version of debug printing
+- * @hw: pointer to the HW structure
+- * @mask: debug level mask
+- * @fmt_str: printf-type format description
+- **/
+-void i40evf_debug_d(void *hw, u32 mask, char *fmt_str, ...)
+-{
+- char buf[512];
+- va_list argptr;
+-
+- if (!(mask & ((struct i40e_hw *)hw)->debug_mask))
+- return;
+-
+- va_start(argptr, fmt_str);
+- vsnprintf(buf, sizeof(buf), fmt_str, argptr);
+- va_end(argptr);
+-
+- /* the debug string is already formatted with a newline */
+- pr_info("%s", buf);
+-}
+-
+-/**
+- * i40evf_schedule_reset - Set the flags and schedule a reset event
+- * @adapter: board private structure
+- **/
+-void i40evf_schedule_reset(struct i40evf_adapter *adapter)
+-{
+- if (!(adapter->flags &
+- (I40EVF_FLAG_RESET_PENDING | I40EVF_FLAG_RESET_NEEDED))) {
+- adapter->flags |= I40EVF_FLAG_RESET_NEEDED;
+- schedule_work(&adapter->reset_task);
+- }
+-}
+-
+-/**
+- * i40evf_tx_timeout - Respond to a Tx Hang
+- * @netdev: network interface device structure
+- **/
+-static void i40evf_tx_timeout(struct net_device *netdev)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- adapter->tx_timeout_count++;
+- i40evf_schedule_reset(adapter);
+-}
+-
+-/**
+- * i40evf_misc_irq_disable - Mask off interrupt generation on the NIC
+- * @adapter: board private structure
+- **/
+-static void i40evf_misc_irq_disable(struct i40evf_adapter *adapter)
+-{
+- struct i40e_hw *hw = &adapter->hw;
+-
+- if (!adapter->msix_entries)
+- return;
+-
+- wr32(hw, I40E_VFINT_DYN_CTL01, 0);
+-
+- /* read flush */
+- rd32(hw, I40E_VFGEN_RSTAT);
+-
+- synchronize_irq(adapter->msix_entries[0].vector);
+-}
+-
+-/**
+- * i40evf_misc_irq_enable - Enable default interrupt generation settings
+- * @adapter: board private structure
+- **/
+-static void i40evf_misc_irq_enable(struct i40evf_adapter *adapter)
+-{
+- struct i40e_hw *hw = &adapter->hw;
+-
+- wr32(hw, I40E_VFINT_DYN_CTL01, I40E_VFINT_DYN_CTL01_INTENA_MASK |
+- I40E_VFINT_DYN_CTL01_ITR_INDX_MASK);
+- wr32(hw, I40E_VFINT_ICR0_ENA1, I40E_VFINT_ICR0_ENA1_ADMINQ_MASK);
+-
+- /* read flush */
+- rd32(hw, I40E_VFGEN_RSTAT);
+-}
+-
+-/**
+- * i40evf_irq_disable - Mask off interrupt generation on the NIC
+- * @adapter: board private structure
+- **/
+-static void i40evf_irq_disable(struct i40evf_adapter *adapter)
+-{
+- int i;
+- struct i40e_hw *hw = &adapter->hw;
+-
+- if (!adapter->msix_entries)
+- return;
+-
+- for (i = 1; i < adapter->num_msix_vectors; i++) {
+- wr32(hw, I40E_VFINT_DYN_CTLN1(i - 1), 0);
+- synchronize_irq(adapter->msix_entries[i].vector);
+- }
+- /* read flush */
+- rd32(hw, I40E_VFGEN_RSTAT);
+-}
+-
+-/**
+- * i40evf_irq_enable_queues - Enable interrupt for specified queues
+- * @adapter: board private structure
+- * @mask: bitmap of queues to enable
+- **/
+-void i40evf_irq_enable_queues(struct i40evf_adapter *adapter, u32 mask)
+-{
+- struct i40e_hw *hw = &adapter->hw;
+- int i;
+-
+- for (i = 1; i < adapter->num_msix_vectors; i++) {
+- if (mask & BIT(i - 1)) {
+- wr32(hw, I40E_VFINT_DYN_CTLN1(i - 1),
+- I40E_VFINT_DYN_CTLN1_INTENA_MASK |
+- I40E_VFINT_DYN_CTLN1_ITR_INDX_MASK);
+- }
+- }
+-}
+-
+-/**
+- * i40evf_irq_enable - Enable default interrupt generation settings
+- * @adapter: board private structure
+- * @flush: boolean value whether to run rd32()
+- **/
+-void i40evf_irq_enable(struct i40evf_adapter *adapter, bool flush)
+-{
+- struct i40e_hw *hw = &adapter->hw;
+-
+- i40evf_misc_irq_enable(adapter);
+- i40evf_irq_enable_queues(adapter, ~0);
+-
+- if (flush)
+- rd32(hw, I40E_VFGEN_RSTAT);
+-}
+-
+-/**
+- * i40evf_msix_aq - Interrupt handler for vector 0
+- * @irq: interrupt number
+- * @data: pointer to netdev
+- **/
+-static irqreturn_t i40evf_msix_aq(int irq, void *data)
+-{
+- struct net_device *netdev = data;
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- struct i40e_hw *hw = &adapter->hw;
+-
+- /* handle non-queue interrupts, these reads clear the registers */
+- rd32(hw, I40E_VFINT_ICR01);
+- rd32(hw, I40E_VFINT_ICR0_ENA1);
+-
+- /* schedule work on the private workqueue */
+- schedule_work(&adapter->adminq_task);
+-
+- return IRQ_HANDLED;
+-}
+-
+-/**
+- * i40evf_msix_clean_rings - MSIX mode Interrupt Handler
+- * @irq: interrupt number
+- * @data: pointer to a q_vector
+- **/
+-static irqreturn_t i40evf_msix_clean_rings(int irq, void *data)
+-{
+- struct i40e_q_vector *q_vector = data;
+-
+- if (!q_vector->tx.ring && !q_vector->rx.ring)
+- return IRQ_HANDLED;
+-
+- napi_schedule_irqoff(&q_vector->napi);
+-
+- return IRQ_HANDLED;
+-}
+-
+-/**
+- * i40evf_map_vector_to_rxq - associate irqs with rx queues
+- * @adapter: board private structure
+- * @v_idx: interrupt number
+- * @r_idx: queue number
+- **/
+-static void
+-i40evf_map_vector_to_rxq(struct i40evf_adapter *adapter, int v_idx, int r_idx)
+-{
+- struct i40e_q_vector *q_vector = &adapter->q_vectors[v_idx];
+- struct i40e_ring *rx_ring = &adapter->rx_rings[r_idx];
+- struct i40e_hw *hw = &adapter->hw;
+-
+- rx_ring->q_vector = q_vector;
+- rx_ring->next = q_vector->rx.ring;
+- rx_ring->vsi = &adapter->vsi;
+- q_vector->rx.ring = rx_ring;
+- q_vector->rx.count++;
+- q_vector->rx.next_update = jiffies + 1;
+- q_vector->rx.target_itr = ITR_TO_REG(rx_ring->itr_setting);
+- q_vector->ring_mask |= BIT(r_idx);
+- wr32(hw, I40E_VFINT_ITRN1(I40E_RX_ITR, q_vector->reg_idx),
+- q_vector->rx.current_itr);
+- q_vector->rx.current_itr = q_vector->rx.target_itr;
+-}
+-
+-/**
+- * i40evf_map_vector_to_txq - associate irqs with tx queues
+- * @adapter: board private structure
+- * @v_idx: interrupt number
+- * @t_idx: queue number
+- **/
+-static void
+-i40evf_map_vector_to_txq(struct i40evf_adapter *adapter, int v_idx, int t_idx)
+-{
+- struct i40e_q_vector *q_vector = &adapter->q_vectors[v_idx];
+- struct i40e_ring *tx_ring = &adapter->tx_rings[t_idx];
+- struct i40e_hw *hw = &adapter->hw;
+-
+- tx_ring->q_vector = q_vector;
+- tx_ring->next = q_vector->tx.ring;
+- tx_ring->vsi = &adapter->vsi;
+- q_vector->tx.ring = tx_ring;
+- q_vector->tx.count++;
+- q_vector->tx.next_update = jiffies + 1;
+- q_vector->tx.target_itr = ITR_TO_REG(tx_ring->itr_setting);
+- q_vector->num_ringpairs++;
+- wr32(hw, I40E_VFINT_ITRN1(I40E_TX_ITR, q_vector->reg_idx),
+- q_vector->tx.target_itr);
+- q_vector->tx.current_itr = q_vector->tx.target_itr;
+-}
+-
+-/**
+- * i40evf_map_rings_to_vectors - Maps descriptor rings to vectors
+- * @adapter: board private structure to initialize
+- *
+- * This function maps descriptor rings to the queue-specific vectors
+- * we were allotted through the MSI-X enabling code. Ideally, we'd have
+- * one vector per ring/queue, but on a constrained vector budget, we
+- * group the rings as "efficiently" as possible. You would add new
+- * mapping configurations in here.
+- **/
+-static void i40evf_map_rings_to_vectors(struct i40evf_adapter *adapter)
+-{
+- int rings_remaining = adapter->num_active_queues;
+- int ridx = 0, vidx = 0;
+- int q_vectors;
+-
+- q_vectors = adapter->num_msix_vectors - NONQ_VECS;
+-
+- for (; ridx < rings_remaining; ridx++) {
+- i40evf_map_vector_to_rxq(adapter, vidx, ridx);
+- i40evf_map_vector_to_txq(adapter, vidx, ridx);
+-
+- /* In the case where we have more queues than vectors, continue
+- * round-robin on vectors until all queues are mapped.
+- */
+- if (++vidx >= q_vectors)
+- vidx = 0;
+- }
+-
+- adapter->aq_required |= I40EVF_FLAG_AQ_MAP_VECTORS;
+-}
+-
+-/**
+- * i40evf_irq_affinity_notify - Callback for affinity changes
+- * @notify: context as to what irq was changed
+- * @mask: the new affinity mask
+- *
+- * This is a callback function used by the irq_set_affinity_notifier function
+- * so that we may register to receive changes to the irq affinity masks.
+- **/
+-static void i40evf_irq_affinity_notify(struct irq_affinity_notify *notify,
+- const cpumask_t *mask)
+-{
+- struct i40e_q_vector *q_vector =
+- container_of(notify, struct i40e_q_vector, affinity_notify);
+-
+- cpumask_copy(&q_vector->affinity_mask, mask);
+-}
+-
+-/**
+- * i40evf_irq_affinity_release - Callback for affinity notifier release
+- * @ref: internal core kernel usage
+- *
+- * This is a callback function used by the irq_set_affinity_notifier function
+- * to inform the current notification subscriber that they will no longer
+- * receive notifications.
+- **/
+-static void i40evf_irq_affinity_release(struct kref *ref) {}
+-
+-/**
+- * i40evf_request_traffic_irqs - Initialize MSI-X interrupts
+- * @adapter: board private structure
+- * @basename: device basename
+- *
+- * Allocates MSI-X vectors for tx and rx handling, and requests
+- * interrupts from the kernel.
+- **/
+-static int
+-i40evf_request_traffic_irqs(struct i40evf_adapter *adapter, char *basename)
+-{
+- unsigned int vector, q_vectors;
+- unsigned int rx_int_idx = 0, tx_int_idx = 0;
+- int irq_num, err;
+- int cpu;
+-
+- i40evf_irq_disable(adapter);
+- /* Decrement for Other and TCP Timer vectors */
+- q_vectors = adapter->num_msix_vectors - NONQ_VECS;
+-
+- for (vector = 0; vector < q_vectors; vector++) {
+- struct i40e_q_vector *q_vector = &adapter->q_vectors[vector];
+- irq_num = adapter->msix_entries[vector + NONQ_VECS].vector;
+-
+- if (q_vector->tx.ring && q_vector->rx.ring) {
+- snprintf(q_vector->name, sizeof(q_vector->name),
+- "i40evf-%s-TxRx-%d", basename, rx_int_idx++);
+- tx_int_idx++;
+- } else if (q_vector->rx.ring) {
+- snprintf(q_vector->name, sizeof(q_vector->name),
+- "i40evf-%s-rx-%d", basename, rx_int_idx++);
+- } else if (q_vector->tx.ring) {
+- snprintf(q_vector->name, sizeof(q_vector->name),
+- "i40evf-%s-tx-%d", basename, tx_int_idx++);
+- } else {
+- /* skip this unused q_vector */
+- continue;
+- }
+- err = request_irq(irq_num,
+- i40evf_msix_clean_rings,
+- 0,
+- q_vector->name,
+- q_vector);
+- if (err) {
+- dev_info(&adapter->pdev->dev,
+- "Request_irq failed, error: %d\n", err);
+- goto free_queue_irqs;
+- }
+- /* register for affinity change notifications */
+- q_vector->affinity_notify.notify = i40evf_irq_affinity_notify;
+- q_vector->affinity_notify.release =
+- i40evf_irq_affinity_release;
+- irq_set_affinity_notifier(irq_num, &q_vector->affinity_notify);
+- /* Spread the IRQ affinity hints across online CPUs. Note that
+- * get_cpu_mask returns a mask with a permanent lifetime so
+- * it's safe to use as a hint for irq_set_affinity_hint.
+- */
+- cpu = cpumask_local_spread(q_vector->v_idx, -1);
+- irq_set_affinity_hint(irq_num, get_cpu_mask(cpu));
+- }
+-
+- return 0;
+-
+-free_queue_irqs:
+- while (vector) {
+- vector--;
+- irq_num = adapter->msix_entries[vector + NONQ_VECS].vector;
+- irq_set_affinity_notifier(irq_num, NULL);
+- irq_set_affinity_hint(irq_num, NULL);
+- free_irq(irq_num, &adapter->q_vectors[vector]);
+- }
+- return err;
+-}
+-
+-/**
+- * i40evf_request_misc_irq - Initialize MSI-X interrupts
+- * @adapter: board private structure
+- *
+- * Allocates MSI-X vector 0 and requests interrupts from the kernel. This
+- * vector is only for the admin queue, and stays active even when the netdev
+- * is closed.
+- **/
+-static int i40evf_request_misc_irq(struct i40evf_adapter *adapter)
+-{
+- struct net_device *netdev = adapter->netdev;
+- int err;
+-
+- snprintf(adapter->misc_vector_name,
+- sizeof(adapter->misc_vector_name) - 1, "i40evf-%s:mbx",
+- dev_name(&adapter->pdev->dev));
+- err = request_irq(adapter->msix_entries[0].vector,
+- &i40evf_msix_aq, 0,
+- adapter->misc_vector_name, netdev);
+- if (err) {
+- dev_err(&adapter->pdev->dev,
+- "request_irq for %s failed: %d\n",
+- adapter->misc_vector_name, err);
+- free_irq(adapter->msix_entries[0].vector, netdev);
+- }
+- return err;
+-}
+-
+-/**
+- * i40evf_free_traffic_irqs - Free MSI-X interrupts
+- * @adapter: board private structure
+- *
+- * Frees all MSI-X vectors other than 0.
+- **/
+-static void i40evf_free_traffic_irqs(struct i40evf_adapter *adapter)
+-{
+- int vector, irq_num, q_vectors;
+-
+- if (!adapter->msix_entries)
+- return;
+-
+- q_vectors = adapter->num_msix_vectors - NONQ_VECS;
+-
+- for (vector = 0; vector < q_vectors; vector++) {
+- irq_num = adapter->msix_entries[vector + NONQ_VECS].vector;
+- irq_set_affinity_notifier(irq_num, NULL);
+- irq_set_affinity_hint(irq_num, NULL);
+- free_irq(irq_num, &adapter->q_vectors[vector]);
+- }
+-}
+-
+-/**
+- * i40evf_free_misc_irq - Free MSI-X miscellaneous vector
+- * @adapter: board private structure
+- *
+- * Frees MSI-X vector 0.
+- **/
+-static void i40evf_free_misc_irq(struct i40evf_adapter *adapter)
+-{
+- struct net_device *netdev = adapter->netdev;
+-
+- if (!adapter->msix_entries)
+- return;
+-
+- free_irq(adapter->msix_entries[0].vector, netdev);
+-}
+-
+-/**
+- * i40evf_configure_tx - Configure Transmit Unit after Reset
+- * @adapter: board private structure
+- *
+- * Configure the Tx unit of the MAC after a reset.
+- **/
+-static void i40evf_configure_tx(struct i40evf_adapter *adapter)
+-{
+- struct i40e_hw *hw = &adapter->hw;
+- int i;
+-
+- for (i = 0; i < adapter->num_active_queues; i++)
+- adapter->tx_rings[i].tail = hw->hw_addr + I40E_QTX_TAIL1(i);
+-}
+-
+-/**
+- * i40evf_configure_rx - Configure Receive Unit after Reset
+- * @adapter: board private structure
+- *
+- * Configure the Rx unit of the MAC after a reset.
+- **/
+-static void i40evf_configure_rx(struct i40evf_adapter *adapter)
+-{
+- unsigned int rx_buf_len = I40E_RXBUFFER_2048;
+- struct i40e_hw *hw = &adapter->hw;
+- int i;
+-
+- /* Legacy Rx will always default to a 2048 buffer size. */
+-#if (PAGE_SIZE < 8192)
+- if (!(adapter->flags & I40EVF_FLAG_LEGACY_RX)) {
+- struct net_device *netdev = adapter->netdev;
+-
+- /* For jumbo frames on systems with 4K pages we have to use
+- * an order 1 page, so we might as well increase the size
+- * of our Rx buffer to make better use of the available space
+- */
+- rx_buf_len = I40E_RXBUFFER_3072;
+-
+- /* We use a 1536 buffer size for configurations with
+- * standard Ethernet mtu. On x86 this gives us enough room
+- * for shared info and 192 bytes of padding.
+- */
+- if (!I40E_2K_TOO_SMALL_WITH_PADDING &&
+- (netdev->mtu <= ETH_DATA_LEN))
+- rx_buf_len = I40E_RXBUFFER_1536 - NET_IP_ALIGN;
+- }
+-#endif
+-
+- for (i = 0; i < adapter->num_active_queues; i++) {
+- adapter->rx_rings[i].tail = hw->hw_addr + I40E_QRX_TAIL1(i);
+- adapter->rx_rings[i].rx_buf_len = rx_buf_len;
+-
+- if (adapter->flags & I40EVF_FLAG_LEGACY_RX)
+- clear_ring_build_skb_enabled(&adapter->rx_rings[i]);
+- else
+- set_ring_build_skb_enabled(&adapter->rx_rings[i]);
+- }
+-}
+-
+-/**
+- * i40evf_find_vlan - Search filter list for specific vlan filter
+- * @adapter: board private structure
+- * @vlan: vlan tag
+- *
+- * Returns ptr to the filter object or NULL. Must be called while holding the
+- * mac_vlan_list_lock.
+- **/
+-static struct
+-i40evf_vlan_filter *i40evf_find_vlan(struct i40evf_adapter *adapter, u16 vlan)
+-{
+- struct i40evf_vlan_filter *f;
+-
+- list_for_each_entry(f, &adapter->vlan_filter_list, list) {
+- if (vlan == f->vlan)
+- return f;
+- }
+- return NULL;
+-}
+-
+-/**
+- * i40evf_add_vlan - Add a vlan filter to the list
+- * @adapter: board private structure
+- * @vlan: VLAN tag
+- *
+- * Returns ptr to the filter object or NULL when no memory available.
+- **/
+-static struct
+-i40evf_vlan_filter *i40evf_add_vlan(struct i40evf_adapter *adapter, u16 vlan)
+-{
+- struct i40evf_vlan_filter *f = NULL;
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+-
+- f = i40evf_find_vlan(adapter, vlan);
+- if (!f) {
+- f = kzalloc(sizeof(*f), GFP_KERNEL);
+- if (!f)
+- goto clearout;
+-
+- f->vlan = vlan;
+-
+- INIT_LIST_HEAD(&f->list);
+- list_add(&f->list, &adapter->vlan_filter_list);
+- f->add = true;
+- adapter->aq_required |= I40EVF_FLAG_AQ_ADD_VLAN_FILTER;
+- }
+-
+-clearout:
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+- return f;
+-}
+-
+-/**
+- * i40evf_del_vlan - Remove a vlan filter from the list
+- * @adapter: board private structure
+- * @vlan: VLAN tag
+- **/
+-static void i40evf_del_vlan(struct i40evf_adapter *adapter, u16 vlan)
+-{
+- struct i40evf_vlan_filter *f;
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+-
+- f = i40evf_find_vlan(adapter, vlan);
+- if (f) {
+- f->remove = true;
+- adapter->aq_required |= I40EVF_FLAG_AQ_DEL_VLAN_FILTER;
+- }
+-
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-}
+-
+-/**
+- * i40evf_vlan_rx_add_vid - Add a VLAN filter to a device
+- * @netdev: network device struct
+- * @proto: unused protocol data
+- * @vid: VLAN tag
+- **/
+-static int i40evf_vlan_rx_add_vid(struct net_device *netdev,
+- __always_unused __be16 proto, u16 vid)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- if (!VLAN_ALLOWED(adapter))
+- return -EIO;
+- if (i40evf_add_vlan(adapter, vid) == NULL)
+- return -ENOMEM;
+- return 0;
+-}
+-
+-/**
+- * i40evf_vlan_rx_kill_vid - Remove a VLAN filter from a device
+- * @netdev: network device struct
+- * @proto: unused protocol data
+- * @vid: VLAN tag
+- **/
+-static int i40evf_vlan_rx_kill_vid(struct net_device *netdev,
+- __always_unused __be16 proto, u16 vid)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- if (VLAN_ALLOWED(adapter)) {
+- i40evf_del_vlan(adapter, vid);
+- return 0;
+- }
+- return -EIO;
+-}
+-
+-/**
+- * i40evf_find_filter - Search filter list for specific mac filter
+- * @adapter: board private structure
+- * @macaddr: the MAC address
+- *
+- * Returns ptr to the filter object or NULL. Must be called while holding the
+- * mac_vlan_list_lock.
+- **/
+-static struct
+-i40evf_mac_filter *i40evf_find_filter(struct i40evf_adapter *adapter,
+- const u8 *macaddr)
+-{
+- struct i40evf_mac_filter *f;
+-
+- if (!macaddr)
+- return NULL;
+-
+- list_for_each_entry(f, &adapter->mac_filter_list, list) {
+- if (ether_addr_equal(macaddr, f->macaddr))
+- return f;
+- }
+- return NULL;
+-}
+-
+-/**
+- * i40e_add_filter - Add a mac filter to the filter list
+- * @adapter: board private structure
+- * @macaddr: the MAC address
+- *
+- * Returns ptr to the filter object or NULL when no memory available.
+- **/
+-static struct
+-i40evf_mac_filter *i40evf_add_filter(struct i40evf_adapter *adapter,
+- const u8 *macaddr)
+-{
+- struct i40evf_mac_filter *f;
+-
+- if (!macaddr)
+- return NULL;
+-
+- f = i40evf_find_filter(adapter, macaddr);
+- if (!f) {
+- f = kzalloc(sizeof(*f), GFP_ATOMIC);
+- if (!f)
+- return f;
+-
+- ether_addr_copy(f->macaddr, macaddr);
+-
+- list_add_tail(&f->list, &adapter->mac_filter_list);
+- f->add = true;
+- adapter->aq_required |= I40EVF_FLAG_AQ_ADD_MAC_FILTER;
+- } else {
+- f->remove = false;
+- }
+-
+- return f;
+-}
+-
+-/**
+- * i40evf_set_mac - NDO callback to set port mac address
+- * @netdev: network interface device structure
+- * @p: pointer to an address structure
+- *
+- * Returns 0 on success, negative on failure
+- **/
+-static int i40evf_set_mac(struct net_device *netdev, void *p)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- struct i40e_hw *hw = &adapter->hw;
+- struct i40evf_mac_filter *f;
+- struct sockaddr *addr = p;
+-
+- if (!is_valid_ether_addr(addr->sa_data))
+- return -EADDRNOTAVAIL;
+-
+- if (ether_addr_equal(netdev->dev_addr, addr->sa_data))
+- return 0;
+-
+- if (adapter->flags & I40EVF_FLAG_ADDR_SET_BY_PF)
+- return -EPERM;
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+-
+- f = i40evf_find_filter(adapter, hw->mac.addr);
+- if (f) {
+- f->remove = true;
+- adapter->aq_required |= I40EVF_FLAG_AQ_DEL_MAC_FILTER;
+- }
+-
+- f = i40evf_add_filter(adapter, addr->sa_data);
+-
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-
+- if (f) {
+- ether_addr_copy(hw->mac.addr, addr->sa_data);
+- ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr);
+- }
+-
+- return (f == NULL) ? -ENOMEM : 0;
+-}
+-
+-/**
+- * i40evf_addr_sync - Callback for dev_(mc|uc)_sync to add address
+- * @netdev: the netdevice
+- * @addr: address to add
+- *
+- * Called by __dev_(mc|uc)_sync when an address needs to be added. We call
+- * __dev_(uc|mc)_sync from .set_rx_mode and guarantee to hold the hash lock.
+- */
+-static int i40evf_addr_sync(struct net_device *netdev, const u8 *addr)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- if (i40evf_add_filter(adapter, addr))
+- return 0;
+- else
+- return -ENOMEM;
+-}
+-
+-/**
+- * i40evf_addr_unsync - Callback for dev_(mc|uc)_sync to remove address
+- * @netdev: the netdevice
+- * @addr: address to add
+- *
+- * Called by __dev_(mc|uc)_sync when an address needs to be removed. We call
+- * __dev_(uc|mc)_sync from .set_rx_mode and guarantee to hold the hash lock.
+- */
+-static int i40evf_addr_unsync(struct net_device *netdev, const u8 *addr)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- struct i40evf_mac_filter *f;
+-
+- /* Under some circumstances, we might receive a request to delete
+- * our own device address from our uc list. Because we store the
+- * device address in the VSI's MAC/VLAN filter list, we need to ignore
+- * such requests and not delete our device address from this list.
+- */
+- if (ether_addr_equal(addr, netdev->dev_addr))
+- return 0;
+-
+- f = i40evf_find_filter(adapter, addr);
+- if (f) {
+- f->remove = true;
+- adapter->aq_required |= I40EVF_FLAG_AQ_DEL_MAC_FILTER;
+- }
+- return 0;
+-}
+-
+-/**
+- * i40evf_set_rx_mode - NDO callback to set the netdev filters
+- * @netdev: network interface device structure
+- **/
+-static void i40evf_set_rx_mode(struct net_device *netdev)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+- __dev_uc_sync(netdev, i40evf_addr_sync, i40evf_addr_unsync);
+- __dev_mc_sync(netdev, i40evf_addr_sync, i40evf_addr_unsync);
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-
+- if (netdev->flags & IFF_PROMISC &&
+- !(adapter->flags & I40EVF_FLAG_PROMISC_ON))
+- adapter->aq_required |= I40EVF_FLAG_AQ_REQUEST_PROMISC;
+- else if (!(netdev->flags & IFF_PROMISC) &&
+- adapter->flags & I40EVF_FLAG_PROMISC_ON)
+- adapter->aq_required |= I40EVF_FLAG_AQ_RELEASE_PROMISC;
+-
+- if (netdev->flags & IFF_ALLMULTI &&
+- !(adapter->flags & I40EVF_FLAG_ALLMULTI_ON))
+- adapter->aq_required |= I40EVF_FLAG_AQ_REQUEST_ALLMULTI;
+- else if (!(netdev->flags & IFF_ALLMULTI) &&
+- adapter->flags & I40EVF_FLAG_ALLMULTI_ON)
+- adapter->aq_required |= I40EVF_FLAG_AQ_RELEASE_ALLMULTI;
+-}
+-
+-/**
+- * i40evf_napi_enable_all - enable NAPI on all queue vectors
+- * @adapter: board private structure
+- **/
+-static void i40evf_napi_enable_all(struct i40evf_adapter *adapter)
+-{
+- int q_idx;
+- struct i40e_q_vector *q_vector;
+- int q_vectors = adapter->num_msix_vectors - NONQ_VECS;
+-
+- for (q_idx = 0; q_idx < q_vectors; q_idx++) {
+- struct napi_struct *napi;
+-
+- q_vector = &adapter->q_vectors[q_idx];
+- napi = &q_vector->napi;
+- napi_enable(napi);
+- }
+-}
+-
+-/**
+- * i40evf_napi_disable_all - disable NAPI on all queue vectors
+- * @adapter: board private structure
+- **/
+-static void i40evf_napi_disable_all(struct i40evf_adapter *adapter)
+-{
+- int q_idx;
+- struct i40e_q_vector *q_vector;
+- int q_vectors = adapter->num_msix_vectors - NONQ_VECS;
+-
+- for (q_idx = 0; q_idx < q_vectors; q_idx++) {
+- q_vector = &adapter->q_vectors[q_idx];
+- napi_disable(&q_vector->napi);
+- }
+-}
+-
+-/**
+- * i40evf_configure - set up transmit and receive data structures
+- * @adapter: board private structure
+- **/
+-static void i40evf_configure(struct i40evf_adapter *adapter)
+-{
+- struct net_device *netdev = adapter->netdev;
+- int i;
+-
+- i40evf_set_rx_mode(netdev);
+-
+- i40evf_configure_tx(adapter);
+- i40evf_configure_rx(adapter);
+- adapter->aq_required |= I40EVF_FLAG_AQ_CONFIGURE_QUEUES;
+-
+- for (i = 0; i < adapter->num_active_queues; i++) {
+- struct i40e_ring *ring = &adapter->rx_rings[i];
+-
+- i40evf_alloc_rx_buffers(ring, I40E_DESC_UNUSED(ring));
+- }
+-}
+-
+-/**
+- * i40evf_up_complete - Finish the last steps of bringing up a connection
+- * @adapter: board private structure
+- *
+- * Expects to be called while holding the __I40EVF_IN_CRITICAL_TASK bit lock.
+- **/
+-static void i40evf_up_complete(struct i40evf_adapter *adapter)
+-{
+- adapter->state = __I40EVF_RUNNING;
+- clear_bit(__I40E_VSI_DOWN, adapter->vsi.state);
+-
+- i40evf_napi_enable_all(adapter);
+-
+- adapter->aq_required |= I40EVF_FLAG_AQ_ENABLE_QUEUES;
+- if (CLIENT_ENABLED(adapter))
+- adapter->flags |= I40EVF_FLAG_CLIENT_NEEDS_OPEN;
+- mod_timer_pending(&adapter->watchdog_timer, jiffies + 1);
+-}
+-
+-/**
+- * i40e_down - Shutdown the connection processing
+- * @adapter: board private structure
+- *
+- * Expects to be called while holding the __I40EVF_IN_CRITICAL_TASK bit lock.
+- **/
+-void i40evf_down(struct i40evf_adapter *adapter)
+-{
+- struct net_device *netdev = adapter->netdev;
+- struct i40evf_vlan_filter *vlf;
+- struct i40evf_mac_filter *f;
+- struct i40evf_cloud_filter *cf;
+-
+- if (adapter->state <= __I40EVF_DOWN_PENDING)
+- return;
+-
+- netif_carrier_off(netdev);
+- netif_tx_disable(netdev);
+- adapter->link_up = false;
+- i40evf_napi_disable_all(adapter);
+- i40evf_irq_disable(adapter);
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+-
+- /* clear the sync flag on all filters */
+- __dev_uc_unsync(adapter->netdev, NULL);
+- __dev_mc_unsync(adapter->netdev, NULL);
+-
+- /* remove all MAC filters */
+- list_for_each_entry(f, &adapter->mac_filter_list, list) {
+- f->remove = true;
+- }
+-
+- /* remove all VLAN filters */
+- list_for_each_entry(vlf, &adapter->vlan_filter_list, list) {
+- vlf->remove = true;
+- }
+-
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-
+- /* remove all cloud filters */
+- spin_lock_bh(&adapter->cloud_filter_list_lock);
+- list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+- cf->del = true;
+- }
+- spin_unlock_bh(&adapter->cloud_filter_list_lock);
+-
+- if (!(adapter->flags & I40EVF_FLAG_PF_COMMS_FAILED) &&
+- adapter->state != __I40EVF_RESETTING) {
+- /* cancel any current operation */
+- adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+- /* Schedule operations to close down the HW. Don't wait
+- * here for this to complete. The watchdog is still running
+- * and it will take care of this.
+- */
+- adapter->aq_required = I40EVF_FLAG_AQ_DEL_MAC_FILTER;
+- adapter->aq_required |= I40EVF_FLAG_AQ_DEL_VLAN_FILTER;
+- adapter->aq_required |= I40EVF_FLAG_AQ_DEL_CLOUD_FILTER;
+- adapter->aq_required |= I40EVF_FLAG_AQ_DISABLE_QUEUES;
+- }
+-
+- mod_timer_pending(&adapter->watchdog_timer, jiffies + 1);
+-}
+-
+-/**
+- * i40evf_acquire_msix_vectors - Setup the MSIX capability
+- * @adapter: board private structure
+- * @vectors: number of vectors to request
+- *
+- * Work with the OS to set up the MSIX vectors needed.
+- *
+- * Returns 0 on success, negative on failure
+- **/
+-static int
+-i40evf_acquire_msix_vectors(struct i40evf_adapter *adapter, int vectors)
+-{
+- int err, vector_threshold;
+-
+- /* We'll want at least 3 (vector_threshold):
+- * 0) Other (Admin Queue and link, mostly)
+- * 1) TxQ[0] Cleanup
+- * 2) RxQ[0] Cleanup
+- */
+- vector_threshold = MIN_MSIX_COUNT;
+-
+- /* The more we get, the more we will assign to Tx/Rx Cleanup
+- * for the separate queues...where Rx Cleanup >= Tx Cleanup.
+- * Right now, we simply care about how many we'll get; we'll
+- * set them up later while requesting irq's.
+- */
+- err = pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
+- vector_threshold, vectors);
+- if (err < 0) {
+- dev_err(&adapter->pdev->dev, "Unable to allocate MSI-X interrupts\n");
+- kfree(adapter->msix_entries);
+- adapter->msix_entries = NULL;
+- return err;
+- }
+-
+- /* Adjust for only the vectors we'll use, which is minimum
+- * of max_msix_q_vectors + NONQ_VECS, or the number of
+- * vectors we were allocated.
+- */
+- adapter->num_msix_vectors = err;
+- return 0;
+-}
+-
+-/**
+- * i40evf_free_queues - Free memory for all rings
+- * @adapter: board private structure to initialize
+- *
+- * Free all of the memory associated with queue pairs.
+- **/
+-static void i40evf_free_queues(struct i40evf_adapter *adapter)
+-{
+- if (!adapter->vsi_res)
+- return;
+- adapter->num_active_queues = 0;
+- kfree(adapter->tx_rings);
+- adapter->tx_rings = NULL;
+- kfree(adapter->rx_rings);
+- adapter->rx_rings = NULL;
+-}
+-
+-/**
+- * i40evf_alloc_queues - Allocate memory for all rings
+- * @adapter: board private structure to initialize
+- *
+- * We allocate one ring per queue at run-time since we don't know the
+- * number of queues at compile-time. The polling_netdev array is
+- * intended for Multiqueue, but should work fine with a single queue.
+- **/
+-static int i40evf_alloc_queues(struct i40evf_adapter *adapter)
+-{
+- int i, num_active_queues;
+-
+- /* If we're in reset reallocating queues we don't actually know yet for
+- * certain the PF gave us the number of queues we asked for but we'll
+- * assume it did. Once basic reset is finished we'll confirm once we
+- * start negotiating config with PF.
+- */
+- if (adapter->num_req_queues)
+- num_active_queues = adapter->num_req_queues;
+- else if ((adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
+- adapter->num_tc)
+- num_active_queues = adapter->ch_config.total_qps;
+- else
+- num_active_queues = min_t(int,
+- adapter->vsi_res->num_queue_pairs,
+- (int)(num_online_cpus()));
+-
+-
+- adapter->tx_rings = kcalloc(num_active_queues,
+- sizeof(struct i40e_ring), GFP_KERNEL);
+- if (!adapter->tx_rings)
+- goto err_out;
+- adapter->rx_rings = kcalloc(num_active_queues,
+- sizeof(struct i40e_ring), GFP_KERNEL);
+- if (!adapter->rx_rings)
+- goto err_out;
+-
+- for (i = 0; i < num_active_queues; i++) {
+- struct i40e_ring *tx_ring;
+- struct i40e_ring *rx_ring;
+-
+- tx_ring = &adapter->tx_rings[i];
+-
+- tx_ring->queue_index = i;
+- tx_ring->netdev = adapter->netdev;
+- tx_ring->dev = &adapter->pdev->dev;
+- tx_ring->count = adapter->tx_desc_count;
+- tx_ring->itr_setting = I40E_ITR_TX_DEF;
+- if (adapter->flags & I40EVF_FLAG_WB_ON_ITR_CAPABLE)
+- tx_ring->flags |= I40E_TXR_FLAGS_WB_ON_ITR;
+-
+- rx_ring = &adapter->rx_rings[i];
+- rx_ring->queue_index = i;
+- rx_ring->netdev = adapter->netdev;
+- rx_ring->dev = &adapter->pdev->dev;
+- rx_ring->count = adapter->rx_desc_count;
+- rx_ring->itr_setting = I40E_ITR_RX_DEF;
+- }
+-
+- adapter->num_active_queues = num_active_queues;
+-
+- return 0;
+-
+-err_out:
+- i40evf_free_queues(adapter);
+- return -ENOMEM;
+-}
+-
+-/**
+- * i40evf_set_interrupt_capability - set MSI-X or FAIL if not supported
+- * @adapter: board private structure to initialize
+- *
+- * Attempt to configure the interrupts using the best available
+- * capabilities of the hardware and the kernel.
+- **/
+-static int i40evf_set_interrupt_capability(struct i40evf_adapter *adapter)
+-{
+- int vector, v_budget;
+- int pairs = 0;
+- int err = 0;
+-
+- if (!adapter->vsi_res) {
+- err = -EIO;
+- goto out;
+- }
+- pairs = adapter->num_active_queues;
+-
+- /* It's easy to be greedy for MSI-X vectors, but it really doesn't do
+- * us much good if we have more vectors than CPUs. However, we already
+- * limit the total number of queues by the number of CPUs so we do not
+- * need any further limiting here.
+- */
+- v_budget = min_t(int, pairs + NONQ_VECS,
+- (int)adapter->vf_res->max_vectors);
+-
+- adapter->msix_entries = kcalloc(v_budget,
+- sizeof(struct msix_entry), GFP_KERNEL);
+- if (!adapter->msix_entries) {
+- err = -ENOMEM;
+- goto out;
+- }
+-
+- for (vector = 0; vector < v_budget; vector++)
+- adapter->msix_entries[vector].entry = vector;
+-
+- err = i40evf_acquire_msix_vectors(adapter, v_budget);
+-
+-out:
+- netif_set_real_num_rx_queues(adapter->netdev, pairs);
+- netif_set_real_num_tx_queues(adapter->netdev, pairs);
+- return err;
+-}
+-
+-/**
+- * i40e_config_rss_aq - Configure RSS keys and lut by using AQ commands
+- * @adapter: board private structure
+- *
+- * Return 0 on success, negative on failure
+- **/
+-static int i40evf_config_rss_aq(struct i40evf_adapter *adapter)
+-{
+- struct i40e_aqc_get_set_rss_key_data *rss_key =
+- (struct i40e_aqc_get_set_rss_key_data *)adapter->rss_key;
+- struct i40e_hw *hw = &adapter->hw;
+- int ret = 0;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot configure RSS, command %d pending\n",
+- adapter->current_op);
+- return -EBUSY;
+- }
+-
+- ret = i40evf_aq_set_rss_key(hw, adapter->vsi.id, rss_key);
+- if (ret) {
+- dev_err(&adapter->pdev->dev, "Cannot set RSS key, err %s aq_err %s\n",
+- i40evf_stat_str(hw, ret),
+- i40evf_aq_str(hw, hw->aq.asq_last_status));
+- return ret;
+-
+- }
+-
+- ret = i40evf_aq_set_rss_lut(hw, adapter->vsi.id, false,
+- adapter->rss_lut, adapter->rss_lut_size);
+- if (ret) {
+- dev_err(&adapter->pdev->dev, "Cannot set RSS lut, err %s aq_err %s\n",
+- i40evf_stat_str(hw, ret),
+- i40evf_aq_str(hw, hw->aq.asq_last_status));
+- }
+-
+- return ret;
+-
+-}
+-
+-/**
+- * i40evf_config_rss_reg - Configure RSS keys and lut by writing registers
+- * @adapter: board private structure
+- *
+- * Returns 0 on success, negative on failure
+- **/
+-static int i40evf_config_rss_reg(struct i40evf_adapter *adapter)
+-{
+- struct i40e_hw *hw = &adapter->hw;
+- u32 *dw;
+- u16 i;
+-
+- dw = (u32 *)adapter->rss_key;
+- for (i = 0; i <= adapter->rss_key_size / 4; i++)
+- wr32(hw, I40E_VFQF_HKEY(i), dw[i]);
+-
+- dw = (u32 *)adapter->rss_lut;
+- for (i = 0; i <= adapter->rss_lut_size / 4; i++)
+- wr32(hw, I40E_VFQF_HLUT(i), dw[i]);
+-
+- i40e_flush(hw);
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_config_rss - Configure RSS keys and lut
+- * @adapter: board private structure
+- *
+- * Returns 0 on success, negative on failure
+- **/
+-int i40evf_config_rss(struct i40evf_adapter *adapter)
+-{
+-
+- if (RSS_PF(adapter)) {
+- adapter->aq_required |= I40EVF_FLAG_AQ_SET_RSS_LUT |
+- I40EVF_FLAG_AQ_SET_RSS_KEY;
+- return 0;
+- } else if (RSS_AQ(adapter)) {
+- return i40evf_config_rss_aq(adapter);
+- } else {
+- return i40evf_config_rss_reg(adapter);
+- }
+-}
+-
+-/**
+- * i40evf_fill_rss_lut - Fill the lut with default values
+- * @adapter: board private structure
+- **/
+-static void i40evf_fill_rss_lut(struct i40evf_adapter *adapter)
+-{
+- u16 i;
+-
+- for (i = 0; i < adapter->rss_lut_size; i++)
+- adapter->rss_lut[i] = i % adapter->num_active_queues;
+-}
+-
+-/**
+- * i40evf_init_rss - Prepare for RSS
+- * @adapter: board private structure
+- *
+- * Return 0 on success, negative on failure
+- **/
+-static int i40evf_init_rss(struct i40evf_adapter *adapter)
+-{
+- struct i40e_hw *hw = &adapter->hw;
+- int ret;
+-
+- if (!RSS_PF(adapter)) {
+- /* Enable PCTYPES for RSS, TCP/UDP with IPv4/IPv6 */
+- if (adapter->vf_res->vf_cap_flags &
+- VIRTCHNL_VF_OFFLOAD_RSS_PCTYPE_V2)
+- adapter->hena = I40E_DEFAULT_RSS_HENA_EXPANDED;
+- else
+- adapter->hena = I40E_DEFAULT_RSS_HENA;
+-
+- wr32(hw, I40E_VFQF_HENA(0), (u32)adapter->hena);
+- wr32(hw, I40E_VFQF_HENA(1), (u32)(adapter->hena >> 32));
+- }
+-
+- i40evf_fill_rss_lut(adapter);
+-
+- netdev_rss_key_fill((void *)adapter->rss_key, adapter->rss_key_size);
+- ret = i40evf_config_rss(adapter);
+-
+- return ret;
+-}
+-
+-/**
+- * i40evf_alloc_q_vectors - Allocate memory for interrupt vectors
+- * @adapter: board private structure to initialize
+- *
+- * We allocate one q_vector per queue interrupt. If allocation fails we
+- * return -ENOMEM.
+- **/
+-static int i40evf_alloc_q_vectors(struct i40evf_adapter *adapter)
+-{
+- int q_idx = 0, num_q_vectors;
+- struct i40e_q_vector *q_vector;
+-
+- num_q_vectors = adapter->num_msix_vectors - NONQ_VECS;
+- adapter->q_vectors = kcalloc(num_q_vectors, sizeof(*q_vector),
+- GFP_KERNEL);
+- if (!adapter->q_vectors)
+- return -ENOMEM;
+-
+- for (q_idx = 0; q_idx < num_q_vectors; q_idx++) {
+- q_vector = &adapter->q_vectors[q_idx];
+- q_vector->adapter = adapter;
+- q_vector->vsi = &adapter->vsi;
+- q_vector->v_idx = q_idx;
+- q_vector->reg_idx = q_idx;
+- cpumask_copy(&q_vector->affinity_mask, cpu_possible_mask);
+- netif_napi_add(adapter->netdev, &q_vector->napi,
+- i40evf_napi_poll, NAPI_POLL_WEIGHT);
+- }
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_free_q_vectors - Free memory allocated for interrupt vectors
+- * @adapter: board private structure to initialize
+- *
+- * This function frees the memory allocated to the q_vectors. In addition if
+- * NAPI is enabled it will delete any references to the NAPI struct prior
+- * to freeing the q_vector.
+- **/
+-static void i40evf_free_q_vectors(struct i40evf_adapter *adapter)
+-{
+- int q_idx, num_q_vectors;
+- int napi_vectors;
+-
+- if (!adapter->q_vectors)
+- return;
+-
+- num_q_vectors = adapter->num_msix_vectors - NONQ_VECS;
+- napi_vectors = adapter->num_active_queues;
+-
+- for (q_idx = 0; q_idx < num_q_vectors; q_idx++) {
+- struct i40e_q_vector *q_vector = &adapter->q_vectors[q_idx];
+- if (q_idx < napi_vectors)
+- netif_napi_del(&q_vector->napi);
+- }
+- kfree(adapter->q_vectors);
+- adapter->q_vectors = NULL;
+-}
+-
+-/**
+- * i40evf_reset_interrupt_capability - Reset MSIX setup
+- * @adapter: board private structure
+- *
+- **/
+-void i40evf_reset_interrupt_capability(struct i40evf_adapter *adapter)
+-{
+- if (!adapter->msix_entries)
+- return;
+-
+- pci_disable_msix(adapter->pdev);
+- kfree(adapter->msix_entries);
+- adapter->msix_entries = NULL;
+-}
+-
+-/**
+- * i40evf_init_interrupt_scheme - Determine if MSIX is supported and init
+- * @adapter: board private structure to initialize
+- *
+- **/
+-int i40evf_init_interrupt_scheme(struct i40evf_adapter *adapter)
+-{
+- int err;
+-
+- err = i40evf_alloc_queues(adapter);
+- if (err) {
+- dev_err(&adapter->pdev->dev,
+- "Unable to allocate memory for queues\n");
+- goto err_alloc_queues;
+- }
+-
+- rtnl_lock();
+- err = i40evf_set_interrupt_capability(adapter);
+- rtnl_unlock();
+- if (err) {
+- dev_err(&adapter->pdev->dev,
+- "Unable to setup interrupt capabilities\n");
+- goto err_set_interrupt;
+- }
+-
+- err = i40evf_alloc_q_vectors(adapter);
+- if (err) {
+- dev_err(&adapter->pdev->dev,
+- "Unable to allocate memory for queue vectors\n");
+- goto err_alloc_q_vectors;
+- }
+-
+- /* If we've made it so far while ADq flag being ON, then we haven't
+- * bailed out anywhere in middle. And ADq isn't just enabled but actual
+- * resources have been allocated in the reset path.
+- * Now we can truly claim that ADq is enabled.
+- */
+- if ((adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
+- adapter->num_tc)
+- dev_info(&adapter->pdev->dev, "ADq Enabled, %u TCs created",
+- adapter->num_tc);
+-
+- dev_info(&adapter->pdev->dev, "Multiqueue %s: Queue pair count = %u",
+- (adapter->num_active_queues > 1) ? "Enabled" : "Disabled",
+- adapter->num_active_queues);
+-
+- return 0;
+-err_alloc_q_vectors:
+- i40evf_reset_interrupt_capability(adapter);
+-err_set_interrupt:
+- i40evf_free_queues(adapter);
+-err_alloc_queues:
+- return err;
+-}
+-
+-/**
+- * i40evf_free_rss - Free memory used by RSS structs
+- * @adapter: board private structure
+- **/
+-static void i40evf_free_rss(struct i40evf_adapter *adapter)
+-{
+- kfree(adapter->rss_key);
+- adapter->rss_key = NULL;
+-
+- kfree(adapter->rss_lut);
+- adapter->rss_lut = NULL;
+-}
+-
+-/**
+- * i40evf_reinit_interrupt_scheme - Reallocate queues and vectors
+- * @adapter: board private structure
+- *
+- * Returns 0 on success, negative on failure
+- **/
+-static int i40evf_reinit_interrupt_scheme(struct i40evf_adapter *adapter)
+-{
+- struct net_device *netdev = adapter->netdev;
+- int err;
+-
+- if (netif_running(netdev))
+- i40evf_free_traffic_irqs(adapter);
+- i40evf_free_misc_irq(adapter);
+- i40evf_reset_interrupt_capability(adapter);
+- i40evf_free_q_vectors(adapter);
+- i40evf_free_queues(adapter);
+-
+- err = i40evf_init_interrupt_scheme(adapter);
+- if (err)
+- goto err;
+-
+- netif_tx_stop_all_queues(netdev);
+-
+- err = i40evf_request_misc_irq(adapter);
+- if (err)
+- goto err;
+-
+- set_bit(__I40E_VSI_DOWN, adapter->vsi.state);
+-
+- i40evf_map_rings_to_vectors(adapter);
+-
+- if (RSS_AQ(adapter))
+- adapter->aq_required |= I40EVF_FLAG_AQ_CONFIGURE_RSS;
+- else
+- err = i40evf_init_rss(adapter);
+-err:
+- return err;
+-}
+-
+-/**
+- * i40evf_watchdog_timer - Periodic call-back timer
+- * @data: pointer to adapter disguised as unsigned long
+- **/
+-static void i40evf_watchdog_timer(struct timer_list *t)
+-{
+- struct i40evf_adapter *adapter = from_timer(adapter, t,
+- watchdog_timer);
+-
+- schedule_work(&adapter->watchdog_task);
+- /* timer will be rescheduled in watchdog task */
+-}
+-
+-/**
+- * i40evf_watchdog_task - Periodic call-back task
+- * @work: pointer to work_struct
+- **/
+-static void i40evf_watchdog_task(struct work_struct *work)
+-{
+- struct i40evf_adapter *adapter = container_of(work,
+- struct i40evf_adapter,
+- watchdog_task);
+- struct i40e_hw *hw = &adapter->hw;
+- u32 reg_val;
+-
+- if (test_and_set_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section))
+- goto restart_watchdog;
+-
+- if (adapter->flags & I40EVF_FLAG_PF_COMMS_FAILED) {
+- reg_val = rd32(hw, I40E_VFGEN_RSTAT) &
+- I40E_VFGEN_RSTAT_VFR_STATE_MASK;
+- if ((reg_val == VIRTCHNL_VFR_VFACTIVE) ||
+- (reg_val == VIRTCHNL_VFR_COMPLETED)) {
+- /* A chance for redemption! */
+- dev_err(&adapter->pdev->dev, "Hardware came out of reset. Attempting reinit.\n");
+- adapter->state = __I40EVF_STARTUP;
+- adapter->flags &= ~I40EVF_FLAG_PF_COMMS_FAILED;
+- schedule_delayed_work(&adapter->init_task, 10);
+- clear_bit(__I40EVF_IN_CRITICAL_TASK,
+- &adapter->crit_section);
+- /* Don't reschedule the watchdog, since we've restarted
+- * the init task. When init_task contacts the PF and
+- * gets everything set up again, it'll restart the
+- * watchdog for us. Down, boy. Sit. Stay. Woof.
+- */
+- return;
+- }
+- adapter->aq_required = 0;
+- adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+- goto watchdog_done;
+- }
+-
+- if ((adapter->state < __I40EVF_DOWN) ||
+- (adapter->flags & I40EVF_FLAG_RESET_PENDING))
+- goto watchdog_done;
+-
+- /* check for reset */
+- reg_val = rd32(hw, I40E_VF_ARQLEN1) & I40E_VF_ARQLEN1_ARQENABLE_MASK;
+- if (!(adapter->flags & I40EVF_FLAG_RESET_PENDING) && !reg_val) {
+- adapter->state = __I40EVF_RESETTING;
+- adapter->flags |= I40EVF_FLAG_RESET_PENDING;
+- dev_err(&adapter->pdev->dev, "Hardware reset detected\n");
+- schedule_work(&adapter->reset_task);
+- adapter->aq_required = 0;
+- adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+- goto watchdog_done;
+- }
+-
+- /* Process admin queue tasks. After init, everything gets done
+- * here so we don't race on the admin queue.
+- */
+- if (adapter->current_op) {
+- if (!i40evf_asq_done(hw)) {
+- dev_dbg(&adapter->pdev->dev, "Admin queue timeout\n");
+- i40evf_send_api_ver(adapter);
+- }
+- goto watchdog_done;
+- }
+- if (adapter->aq_required & I40EVF_FLAG_AQ_GET_CONFIG) {
+- i40evf_send_vf_config_msg(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_DISABLE_QUEUES) {
+- i40evf_disable_queues(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_MAP_VECTORS) {
+- i40evf_map_queues(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_ADD_MAC_FILTER) {
+- i40evf_add_ether_addrs(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_ADD_VLAN_FILTER) {
+- i40evf_add_vlans(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_DEL_MAC_FILTER) {
+- i40evf_del_ether_addrs(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_DEL_VLAN_FILTER) {
+- i40evf_del_vlans(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING) {
+- i40evf_enable_vlan_stripping(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_DISABLE_VLAN_STRIPPING) {
+- i40evf_disable_vlan_stripping(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_CONFIGURE_QUEUES) {
+- i40evf_configure_queues(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_ENABLE_QUEUES) {
+- i40evf_enable_queues(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_CONFIGURE_RSS) {
+- /* This message goes straight to the firmware, not the
+- * PF, so we don't have to set current_op as we will
+- * not get a response through the ARQ.
+- */
+- i40evf_init_rss(adapter);
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_CONFIGURE_RSS;
+- goto watchdog_done;
+- }
+- if (adapter->aq_required & I40EVF_FLAG_AQ_GET_HENA) {
+- i40evf_get_hena(adapter);
+- goto watchdog_done;
+- }
+- if (adapter->aq_required & I40EVF_FLAG_AQ_SET_HENA) {
+- i40evf_set_hena(adapter);
+- goto watchdog_done;
+- }
+- if (adapter->aq_required & I40EVF_FLAG_AQ_SET_RSS_KEY) {
+- i40evf_set_rss_key(adapter);
+- goto watchdog_done;
+- }
+- if (adapter->aq_required & I40EVF_FLAG_AQ_SET_RSS_LUT) {
+- i40evf_set_rss_lut(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_REQUEST_PROMISC) {
+- i40evf_set_promiscuous(adapter, FLAG_VF_UNICAST_PROMISC |
+- FLAG_VF_MULTICAST_PROMISC);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_REQUEST_ALLMULTI) {
+- i40evf_set_promiscuous(adapter, FLAG_VF_MULTICAST_PROMISC);
+- goto watchdog_done;
+- }
+-
+- if ((adapter->aq_required & I40EVF_FLAG_AQ_RELEASE_PROMISC) &&
+- (adapter->aq_required & I40EVF_FLAG_AQ_RELEASE_ALLMULTI)) {
+- i40evf_set_promiscuous(adapter, 0);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_ENABLE_CHANNELS) {
+- i40evf_enable_channels(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_DISABLE_CHANNELS) {
+- i40evf_disable_channels(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_ADD_CLOUD_FILTER) {
+- i40evf_add_cloud_filter(adapter);
+- goto watchdog_done;
+- }
+-
+- if (adapter->aq_required & I40EVF_FLAG_AQ_DEL_CLOUD_FILTER) {
+- i40evf_del_cloud_filter(adapter);
+- goto watchdog_done;
+- }
+-
+- schedule_delayed_work(&adapter->client_task, msecs_to_jiffies(5));
+-
+- if (adapter->state == __I40EVF_RUNNING)
+- i40evf_request_stats(adapter);
+-watchdog_done:
+- if (adapter->state == __I40EVF_RUNNING)
+- i40evf_detect_recover_hung(&adapter->vsi);
+- clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
+-restart_watchdog:
+- if (adapter->state == __I40EVF_REMOVE)
+- return;
+- if (adapter->aq_required)
+- mod_timer(&adapter->watchdog_timer,
+- jiffies + msecs_to_jiffies(20));
+- else
+- mod_timer(&adapter->watchdog_timer, jiffies + (HZ * 2));
+- schedule_work(&adapter->adminq_task);
+-}
+-
+-static void i40evf_disable_vf(struct i40evf_adapter *adapter)
+-{
+- struct i40evf_mac_filter *f, *ftmp;
+- struct i40evf_vlan_filter *fv, *fvtmp;
+- struct i40evf_cloud_filter *cf, *cftmp;
+-
+- adapter->flags |= I40EVF_FLAG_PF_COMMS_FAILED;
+-
+- /* We don't use netif_running() because it may be true prior to
+- * ndo_open() returning, so we can't assume it means all our open
+- * tasks have finished, since we're not holding the rtnl_lock here.
+- */
+- if (adapter->state == __I40EVF_RUNNING) {
+- set_bit(__I40E_VSI_DOWN, adapter->vsi.state);
+- netif_carrier_off(adapter->netdev);
+- netif_tx_disable(adapter->netdev);
+- adapter->link_up = false;
+- i40evf_napi_disable_all(adapter);
+- i40evf_irq_disable(adapter);
+- i40evf_free_traffic_irqs(adapter);
+- i40evf_free_all_tx_resources(adapter);
+- i40evf_free_all_rx_resources(adapter);
+- }
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+-
+- /* Delete all of the filters */
+- list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
+- list_del(&f->list);
+- kfree(f);
+- }
+-
+- list_for_each_entry_safe(fv, fvtmp, &adapter->vlan_filter_list, list) {
+- list_del(&fv->list);
+- kfree(fv);
+- }
+-
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-
+- spin_lock_bh(&adapter->cloud_filter_list_lock);
+- list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list, list) {
+- list_del(&cf->list);
+- kfree(cf);
+- adapter->num_cloud_filters--;
+- }
+- spin_unlock_bh(&adapter->cloud_filter_list_lock);
+-
+- i40evf_free_misc_irq(adapter);
+- i40evf_reset_interrupt_capability(adapter);
+- i40evf_free_queues(adapter);
+- i40evf_free_q_vectors(adapter);
+- kfree(adapter->vf_res);
+- i40evf_shutdown_adminq(&adapter->hw);
+- adapter->netdev->flags &= ~IFF_UP;
+- clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
+- adapter->flags &= ~I40EVF_FLAG_RESET_PENDING;
+- adapter->state = __I40EVF_DOWN;
+- wake_up(&adapter->down_waitqueue);
+- dev_info(&adapter->pdev->dev, "Reset task did not complete, VF disabled\n");
+-}
+-
+-#define I40EVF_RESET_WAIT_MS 10
+-#define I40EVF_RESET_WAIT_COUNT 500
+-/**
+- * i40evf_reset_task - Call-back task to handle hardware reset
+- * @work: pointer to work_struct
+- *
+- * During reset we need to shut down and reinitialize the admin queue
+- * before we can use it to communicate with the PF again. We also clear
+- * and reinit the rings because that context is lost as well.
+- **/
+-static void i40evf_reset_task(struct work_struct *work)
+-{
+- struct i40evf_adapter *adapter = container_of(work,
+- struct i40evf_adapter,
+- reset_task);
+- struct virtchnl_vf_resource *vfres = adapter->vf_res;
+- struct net_device *netdev = adapter->netdev;
+- struct i40e_hw *hw = &adapter->hw;
+- struct i40evf_vlan_filter *vlf;
+- struct i40evf_cloud_filter *cf;
+- struct i40evf_mac_filter *f;
+- u32 reg_val;
+- int i = 0, err;
+- bool running;
+-
+- /* When device is being removed it doesn't make sense to run the reset
+- * task, just return in such a case.
+- */
+- if (test_bit(__I40EVF_IN_REMOVE_TASK, &adapter->crit_section))
+- return;
+-
+- while (test_and_set_bit(__I40EVF_IN_CLIENT_TASK,
+- &adapter->crit_section))
+- usleep_range(500, 1000);
+- if (CLIENT_ENABLED(adapter)) {
+- adapter->flags &= ~(I40EVF_FLAG_CLIENT_NEEDS_OPEN |
+- I40EVF_FLAG_CLIENT_NEEDS_CLOSE |
+- I40EVF_FLAG_CLIENT_NEEDS_L2_PARAMS |
+- I40EVF_FLAG_SERVICE_CLIENT_REQUESTED);
+- cancel_delayed_work_sync(&adapter->client_task);
+- i40evf_notify_client_close(&adapter->vsi, true);
+- }
+- i40evf_misc_irq_disable(adapter);
+- if (adapter->flags & I40EVF_FLAG_RESET_NEEDED) {
+- adapter->flags &= ~I40EVF_FLAG_RESET_NEEDED;
+- /* Restart the AQ here. If we have been reset but didn't
+- * detect it, or if the PF had to reinit, our AQ will be hosed.
+- */
+- i40evf_shutdown_adminq(hw);
+- i40evf_init_adminq(hw);
+- i40evf_request_reset(adapter);
+- }
+- adapter->flags |= I40EVF_FLAG_RESET_PENDING;
+-
+- /* poll until we see the reset actually happen */
+- for (i = 0; i < I40EVF_RESET_WAIT_COUNT; i++) {
+- reg_val = rd32(hw, I40E_VF_ARQLEN1) &
+- I40E_VF_ARQLEN1_ARQENABLE_MASK;
+- if (!reg_val)
+- break;
+- usleep_range(5000, 10000);
+- }
+- if (i == I40EVF_RESET_WAIT_COUNT) {
+- dev_info(&adapter->pdev->dev, "Never saw reset\n");
+- goto continue_reset; /* act like the reset happened */
+- }
+-
+- /* wait until the reset is complete and the PF is responding to us */
+- for (i = 0; i < I40EVF_RESET_WAIT_COUNT; i++) {
+- /* sleep first to make sure a minimum wait time is met */
+- msleep(I40EVF_RESET_WAIT_MS);
+-
+- reg_val = rd32(hw, I40E_VFGEN_RSTAT) &
+- I40E_VFGEN_RSTAT_VFR_STATE_MASK;
+- if (reg_val == VIRTCHNL_VFR_VFACTIVE)
+- break;
+- }
+-
+- pci_set_master(adapter->pdev);
+-
+- if (i == I40EVF_RESET_WAIT_COUNT) {
+- dev_err(&adapter->pdev->dev, "Reset never finished (%x)\n",
+- reg_val);
+- i40evf_disable_vf(adapter);
+- clear_bit(__I40EVF_IN_CLIENT_TASK, &adapter->crit_section);
+- return; /* Do not attempt to reinit. It's dead, Jim. */
+- }
+-
+-continue_reset:
+- /* We don't use netif_running() because it may be true prior to
+- * ndo_open() returning, so we can't assume it means all our open
+- * tasks have finished, since we're not holding the rtnl_lock here.
+- */
+- running = ((adapter->state == __I40EVF_RUNNING) ||
+- (adapter->state == __I40EVF_RESETTING));
+-
+- if (running) {
+- netif_carrier_off(netdev);
+- netif_tx_stop_all_queues(netdev);
+- adapter->link_up = false;
+- i40evf_napi_disable_all(adapter);
+- }
+- i40evf_irq_disable(adapter);
+-
+- adapter->state = __I40EVF_RESETTING;
+- adapter->flags &= ~I40EVF_FLAG_RESET_PENDING;
+-
+- /* free the Tx/Rx rings and descriptors, might be better to just
+- * re-use them sometime in the future
+- */
+- i40evf_free_all_rx_resources(adapter);
+- i40evf_free_all_tx_resources(adapter);
+-
+- adapter->flags |= I40EVF_FLAG_QUEUES_DISABLED;
+- /* kill and reinit the admin queue */
+- i40evf_shutdown_adminq(hw);
+- adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+- err = i40evf_init_adminq(hw);
+- if (err)
+- dev_info(&adapter->pdev->dev, "Failed to init adminq: %d\n",
+- err);
+- adapter->aq_required = 0;
+-
+- if (adapter->flags & I40EVF_FLAG_REINIT_ITR_NEEDED) {
+- err = i40evf_reinit_interrupt_scheme(adapter);
+- if (err)
+- goto reset_err;
+- }
+-
+- adapter->aq_required |= I40EVF_FLAG_AQ_GET_CONFIG;
+- adapter->aq_required |= I40EVF_FLAG_AQ_MAP_VECTORS;
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+-
+- /* re-add all MAC filters */
+- list_for_each_entry(f, &adapter->mac_filter_list, list) {
+- f->add = true;
+- }
+- /* re-add all VLAN filters */
+- list_for_each_entry(vlf, &adapter->vlan_filter_list, list) {
+- vlf->add = true;
+- }
+-
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-
+- /* check if TCs are running and re-add all cloud filters */
+- spin_lock_bh(&adapter->cloud_filter_list_lock);
+- if ((vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
+- adapter->num_tc) {
+- list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+- cf->add = true;
+- }
+- }
+- spin_unlock_bh(&adapter->cloud_filter_list_lock);
+-
+- adapter->aq_required |= I40EVF_FLAG_AQ_ADD_MAC_FILTER;
+- adapter->aq_required |= I40EVF_FLAG_AQ_ADD_VLAN_FILTER;
+- adapter->aq_required |= I40EVF_FLAG_AQ_ADD_CLOUD_FILTER;
+- i40evf_misc_irq_enable(adapter);
+-
+- mod_timer(&adapter->watchdog_timer, jiffies + 2);
+-
+- /* We were running when the reset started, so we need to restore some
+- * state here.
+- */
+- if (running) {
+- /* allocate transmit descriptors */
+- err = i40evf_setup_all_tx_resources(adapter);
+- if (err)
+- goto reset_err;
+-
+- /* allocate receive descriptors */
+- err = i40evf_setup_all_rx_resources(adapter);
+- if (err)
+- goto reset_err;
+-
+- if (adapter->flags & I40EVF_FLAG_REINIT_ITR_NEEDED) {
+- err = i40evf_request_traffic_irqs(adapter,
+- netdev->name);
+- if (err)
+- goto reset_err;
+-
+- adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
+- }
+-
+- i40evf_configure(adapter);
+-
+- i40evf_up_complete(adapter);
+-
+- i40evf_irq_enable(adapter, true);
+- } else {
+- adapter->state = __I40EVF_DOWN;
+- wake_up(&adapter->down_waitqueue);
+- }
+- clear_bit(__I40EVF_IN_CLIENT_TASK, &adapter->crit_section);
+- clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
+-
+- return;
+-reset_err:
+- clear_bit(__I40EVF_IN_CLIENT_TASK, &adapter->crit_section);
+- clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
+- dev_err(&adapter->pdev->dev, "failed to allocate resources during reinit\n");
+- i40evf_close(netdev);
+-}
+-
+-/**
+- * i40evf_adminq_task - worker thread to clean the admin queue
+- * @work: pointer to work_struct containing our data
+- **/
+-static void i40evf_adminq_task(struct work_struct *work)
+-{
+- struct i40evf_adapter *adapter =
+- container_of(work, struct i40evf_adapter, adminq_task);
+- struct i40e_hw *hw = &adapter->hw;
+- struct i40e_arq_event_info event;
+- enum virtchnl_ops v_op;
+- i40e_status ret, v_ret;
+- u32 val, oldval;
+- u16 pending;
+-
+- if (adapter->flags & I40EVF_FLAG_PF_COMMS_FAILED)
+- goto out;
+-
+- event.buf_len = I40EVF_MAX_AQ_BUF_SIZE;
+- event.msg_buf = kzalloc(event.buf_len, GFP_KERNEL);
+- if (!event.msg_buf)
+- goto out;
+-
+- do {
+- ret = i40evf_clean_arq_element(hw, &event, &pending);
+- v_op = (enum virtchnl_ops)le32_to_cpu(event.desc.cookie_high);
+- v_ret = (i40e_status)le32_to_cpu(event.desc.cookie_low);
+-
+- if (ret || !v_op)
+- break; /* No event to process or error cleaning ARQ */
+-
+- i40evf_virtchnl_completion(adapter, v_op, v_ret, event.msg_buf,
+- event.msg_len);
+- if (pending != 0)
+- memset(event.msg_buf, 0, I40EVF_MAX_AQ_BUF_SIZE);
+- } while (pending);
+-
+- if ((adapter->flags &
+- (I40EVF_FLAG_RESET_PENDING | I40EVF_FLAG_RESET_NEEDED)) ||
+- adapter->state == __I40EVF_RESETTING)
+- goto freedom;
+-
+- /* check for error indications */
+- val = rd32(hw, hw->aq.arq.len);
+- if (val == 0xdeadbeef || val == 0xffffffff) /* device in reset */
+- goto freedom;
+- oldval = val;
+- if (val & I40E_VF_ARQLEN1_ARQVFE_MASK) {
+- dev_info(&adapter->pdev->dev, "ARQ VF Error detected\n");
+- val &= ~I40E_VF_ARQLEN1_ARQVFE_MASK;
+- }
+- if (val & I40E_VF_ARQLEN1_ARQOVFL_MASK) {
+- dev_info(&adapter->pdev->dev, "ARQ Overflow Error detected\n");
+- val &= ~I40E_VF_ARQLEN1_ARQOVFL_MASK;
+- }
+- if (val & I40E_VF_ARQLEN1_ARQCRIT_MASK) {
+- dev_info(&adapter->pdev->dev, "ARQ Critical Error detected\n");
+- val &= ~I40E_VF_ARQLEN1_ARQCRIT_MASK;
+- }
+- if (oldval != val)
+- wr32(hw, hw->aq.arq.len, val);
+-
+- val = rd32(hw, hw->aq.asq.len);
+- oldval = val;
+- if (val & I40E_VF_ATQLEN1_ATQVFE_MASK) {
+- dev_info(&adapter->pdev->dev, "ASQ VF Error detected\n");
+- val &= ~I40E_VF_ATQLEN1_ATQVFE_MASK;
+- }
+- if (val & I40E_VF_ATQLEN1_ATQOVFL_MASK) {
+- dev_info(&adapter->pdev->dev, "ASQ Overflow Error detected\n");
+- val &= ~I40E_VF_ATQLEN1_ATQOVFL_MASK;
+- }
+- if (val & I40E_VF_ATQLEN1_ATQCRIT_MASK) {
+- dev_info(&adapter->pdev->dev, "ASQ Critical Error detected\n");
+- val &= ~I40E_VF_ATQLEN1_ATQCRIT_MASK;
+- }
+- if (oldval != val)
+- wr32(hw, hw->aq.asq.len, val);
+-
+-freedom:
+- kfree(event.msg_buf);
+-out:
+- /* re-enable Admin queue interrupt cause */
+- i40evf_misc_irq_enable(adapter);
+-}
+-
+-/**
+- * i40evf_client_task - worker thread to perform client work
+- * @work: pointer to work_struct containing our data
+- *
+- * This task handles client interactions. Because client calls can be
+- * reentrant, we can't handle them in the watchdog.
+- **/
+-static void i40evf_client_task(struct work_struct *work)
+-{
+- struct i40evf_adapter *adapter =
+- container_of(work, struct i40evf_adapter, client_task.work);
+-
+- /* If we can't get the client bit, just give up. We'll be rescheduled
+- * later.
+- */
+-
+- if (test_and_set_bit(__I40EVF_IN_CLIENT_TASK, &adapter->crit_section))
+- return;
+-
+- if (adapter->flags & I40EVF_FLAG_SERVICE_CLIENT_REQUESTED) {
+- i40evf_client_subtask(adapter);
+- adapter->flags &= ~I40EVF_FLAG_SERVICE_CLIENT_REQUESTED;
+- goto out;
+- }
+- if (adapter->flags & I40EVF_FLAG_CLIENT_NEEDS_L2_PARAMS) {
+- i40evf_notify_client_l2_params(&adapter->vsi);
+- adapter->flags &= ~I40EVF_FLAG_CLIENT_NEEDS_L2_PARAMS;
+- goto out;
+- }
+- if (adapter->flags & I40EVF_FLAG_CLIENT_NEEDS_CLOSE) {
+- i40evf_notify_client_close(&adapter->vsi, false);
+- adapter->flags &= ~I40EVF_FLAG_CLIENT_NEEDS_CLOSE;
+- goto out;
+- }
+- if (adapter->flags & I40EVF_FLAG_CLIENT_NEEDS_OPEN) {
+- i40evf_notify_client_open(&adapter->vsi);
+- adapter->flags &= ~I40EVF_FLAG_CLIENT_NEEDS_OPEN;
+- }
+-out:
+- clear_bit(__I40EVF_IN_CLIENT_TASK, &adapter->crit_section);
+-}
+-
+-/**
+- * i40evf_free_all_tx_resources - Free Tx Resources for All Queues
+- * @adapter: board private structure
+- *
+- * Free all transmit software resources
+- **/
+-void i40evf_free_all_tx_resources(struct i40evf_adapter *adapter)
+-{
+- int i;
+-
+- if (!adapter->tx_rings)
+- return;
+-
+- for (i = 0; i < adapter->num_active_queues; i++)
+- if (adapter->tx_rings[i].desc)
+- i40evf_free_tx_resources(&adapter->tx_rings[i]);
+-}
+-
+-/**
+- * i40evf_setup_all_tx_resources - allocate all queues Tx resources
+- * @adapter: board private structure
+- *
+- * If this function returns with an error, then it's possible one or
+- * more of the rings is populated (while the rest are not). It is the
+- * callers duty to clean those orphaned rings.
+- *
+- * Return 0 on success, negative on failure
+- **/
+-static int i40evf_setup_all_tx_resources(struct i40evf_adapter *adapter)
+-{
+- int i, err = 0;
+-
+- for (i = 0; i < adapter->num_active_queues; i++) {
+- adapter->tx_rings[i].count = adapter->tx_desc_count;
+- err = i40evf_setup_tx_descriptors(&adapter->tx_rings[i]);
+- if (!err)
+- continue;
+- dev_err(&adapter->pdev->dev,
+- "Allocation for Tx Queue %u failed\n", i);
+- break;
+- }
+-
+- return err;
+-}
+-
+-/**
+- * i40evf_setup_all_rx_resources - allocate all queues Rx resources
+- * @adapter: board private structure
+- *
+- * If this function returns with an error, then it's possible one or
+- * more of the rings is populated (while the rest are not). It is the
+- * callers duty to clean those orphaned rings.
+- *
+- * Return 0 on success, negative on failure
+- **/
+-static int i40evf_setup_all_rx_resources(struct i40evf_adapter *adapter)
+-{
+- int i, err = 0;
+-
+- for (i = 0; i < adapter->num_active_queues; i++) {
+- adapter->rx_rings[i].count = adapter->rx_desc_count;
+- err = i40evf_setup_rx_descriptors(&adapter->rx_rings[i]);
+- if (!err)
+- continue;
+- dev_err(&adapter->pdev->dev,
+- "Allocation for Rx Queue %u failed\n", i);
+- break;
+- }
+- return err;
+-}
+-
+-/**
+- * i40evf_free_all_rx_resources - Free Rx Resources for All Queues
+- * @adapter: board private structure
+- *
+- * Free all receive software resources
+- **/
+-void i40evf_free_all_rx_resources(struct i40evf_adapter *adapter)
+-{
+- int i;
+-
+- if (!adapter->rx_rings)
+- return;
+-
+- for (i = 0; i < adapter->num_active_queues; i++)
+- if (adapter->rx_rings[i].desc)
+- i40evf_free_rx_resources(&adapter->rx_rings[i]);
+-}
+-
+-/**
+- * i40evf_validate_tx_bandwidth - validate the max Tx bandwidth
+- * @adapter: board private structure
+- * @max_tx_rate: max Tx bw for a tc
+- **/
+-static int i40evf_validate_tx_bandwidth(struct i40evf_adapter *adapter,
+- u64 max_tx_rate)
+-{
+- int speed = 0, ret = 0;
+-
+- switch (adapter->link_speed) {
+- case I40E_LINK_SPEED_40GB:
+- speed = 40000;
+- break;
+- case I40E_LINK_SPEED_25GB:
+- speed = 25000;
+- break;
+- case I40E_LINK_SPEED_20GB:
+- speed = 20000;
+- break;
+- case I40E_LINK_SPEED_10GB:
+- speed = 10000;
+- break;
+- case I40E_LINK_SPEED_1GB:
+- speed = 1000;
+- break;
+- case I40E_LINK_SPEED_100MB:
+- speed = 100;
+- break;
+- default:
+- break;
+- }
+-
+- if (max_tx_rate > speed) {
+- dev_err(&adapter->pdev->dev,
+- "Invalid tx rate specified\n");
+- ret = -EINVAL;
+- }
+-
+- return ret;
+-}
+-
+-/**
+- * i40evf_validate_channel_config - validate queue mapping info
+- * @adapter: board private structure
+- * @mqprio_qopt: queue parameters
+- *
+- * This function validates if the config provided by the user to
+- * configure queue channels is valid or not. Returns 0 on a valid
+- * config.
+- **/
+-static int i40evf_validate_ch_config(struct i40evf_adapter *adapter,
+- struct tc_mqprio_qopt_offload *mqprio_qopt)
+-{
+- u64 total_max_rate = 0;
+- int i, num_qps = 0;
+- u64 tx_rate = 0;
+- int ret = 0;
+-
+- if (mqprio_qopt->qopt.num_tc > I40EVF_MAX_TRAFFIC_CLASS ||
+- mqprio_qopt->qopt.num_tc < 1)
+- return -EINVAL;
+-
+- for (i = 0; i <= mqprio_qopt->qopt.num_tc - 1; i++) {
+- if (!mqprio_qopt->qopt.count[i] ||
+- mqprio_qopt->qopt.offset[i] != num_qps)
+- return -EINVAL;
+- if (mqprio_qopt->min_rate[i]) {
+- dev_err(&adapter->pdev->dev,
+- "Invalid min tx rate (greater than 0) specified\n");
+- return -EINVAL;
+- }
+- /*convert to Mbps */
+- tx_rate = div_u64(mqprio_qopt->max_rate[i],
+- I40EVF_MBPS_DIVISOR);
+- total_max_rate += tx_rate;
+- num_qps += mqprio_qopt->qopt.count[i];
+- }
+- if (num_qps > I40EVF_MAX_REQ_QUEUES)
+- return -EINVAL;
+-
+- ret = i40evf_validate_tx_bandwidth(adapter, total_max_rate);
+- return ret;
+-}
+-
+-/**
+- * i40evf_del_all_cloud_filters - delete all cloud filters
+- * on the traffic classes
+- **/
+-static void i40evf_del_all_cloud_filters(struct i40evf_adapter *adapter)
+-{
+- struct i40evf_cloud_filter *cf, *cftmp;
+-
+- spin_lock_bh(&adapter->cloud_filter_list_lock);
+- list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list,
+- list) {
+- list_del(&cf->list);
+- kfree(cf);
+- adapter->num_cloud_filters--;
+- }
+- spin_unlock_bh(&adapter->cloud_filter_list_lock);
+-}
+-
+-/**
+- * __i40evf_setup_tc - configure multiple traffic classes
+- * @netdev: network interface device structure
+- * @type_date: tc offload data
+- *
+- * This function processes the config information provided by the
+- * user to configure traffic classes/queue channels and packages the
+- * information to request the PF to setup traffic classes.
+- *
+- * Returns 0 on success.
+- **/
+-static int __i40evf_setup_tc(struct net_device *netdev, void *type_data)
+-{
+- struct tc_mqprio_qopt_offload *mqprio_qopt = type_data;
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- struct virtchnl_vf_resource *vfres = adapter->vf_res;
+- u8 num_tc = 0, total_qps = 0;
+- int ret = 0, netdev_tc = 0;
+- u64 max_tx_rate;
+- u16 mode;
+- int i;
+-
+- num_tc = mqprio_qopt->qopt.num_tc;
+- mode = mqprio_qopt->mode;
+-
+- /* delete queue_channel */
+- if (!mqprio_qopt->qopt.hw) {
+- if (adapter->ch_config.state == __I40EVF_TC_RUNNING) {
+- /* reset the tc configuration */
+- netdev_reset_tc(netdev);
+- adapter->num_tc = 0;
+- netif_tx_stop_all_queues(netdev);
+- netif_tx_disable(netdev);
+- i40evf_del_all_cloud_filters(adapter);
+- adapter->aq_required = I40EVF_FLAG_AQ_DISABLE_CHANNELS;
+- goto exit;
+- } else {
+- return -EINVAL;
+- }
+- }
+-
+- /* add queue channel */
+- if (mode == TC_MQPRIO_MODE_CHANNEL) {
+- if (!(vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ)) {
+- dev_err(&adapter->pdev->dev, "ADq not supported\n");
+- return -EOPNOTSUPP;
+- }
+- if (adapter->ch_config.state != __I40EVF_TC_INVALID) {
+- dev_err(&adapter->pdev->dev, "TC configuration already exists\n");
+- return -EINVAL;
+- }
+-
+- ret = i40evf_validate_ch_config(adapter, mqprio_qopt);
+- if (ret)
+- return ret;
+- /* Return if same TC config is requested */
+- if (adapter->num_tc == num_tc)
+- return 0;
+- adapter->num_tc = num_tc;
+-
+- for (i = 0; i < I40EVF_MAX_TRAFFIC_CLASS; i++) {
+- if (i < num_tc) {
+- adapter->ch_config.ch_info[i].count =
+- mqprio_qopt->qopt.count[i];
+- adapter->ch_config.ch_info[i].offset =
+- mqprio_qopt->qopt.offset[i];
+- total_qps += mqprio_qopt->qopt.count[i];
+- max_tx_rate = mqprio_qopt->max_rate[i];
+- /* convert to Mbps */
+- max_tx_rate = div_u64(max_tx_rate,
+- I40EVF_MBPS_DIVISOR);
+- adapter->ch_config.ch_info[i].max_tx_rate =
+- max_tx_rate;
+- } else {
+- adapter->ch_config.ch_info[i].count = 1;
+- adapter->ch_config.ch_info[i].offset = 0;
+- }
+- }
+- adapter->ch_config.total_qps = total_qps;
+- netif_tx_stop_all_queues(netdev);
+- netif_tx_disable(netdev);
+- adapter->aq_required |= I40EVF_FLAG_AQ_ENABLE_CHANNELS;
+- netdev_reset_tc(netdev);
+- /* Report the tc mapping up the stack */
+- netdev_set_num_tc(adapter->netdev, num_tc);
+- for (i = 0; i < I40EVF_MAX_TRAFFIC_CLASS; i++) {
+- u16 qcount = mqprio_qopt->qopt.count[i];
+- u16 qoffset = mqprio_qopt->qopt.offset[i];
+-
+- if (i < num_tc)
+- netdev_set_tc_queue(netdev, netdev_tc++, qcount,
+- qoffset);
+- }
+- }
+-exit:
+- return ret;
+-}
+-
+-/**
+- * i40evf_parse_cls_flower - Parse tc flower filters provided by kernel
+- * @adapter: board private structure
+- * @cls_flower: pointer to struct tc_cls_flower_offload
+- * @filter: pointer to cloud filter structure
+- */
+-static int i40evf_parse_cls_flower(struct i40evf_adapter *adapter,
+- struct tc_cls_flower_offload *f,
+- struct i40evf_cloud_filter *filter)
+-{
+- u16 n_proto_mask = 0;
+- u16 n_proto_key = 0;
+- u8 field_flags = 0;
+- u16 addr_type = 0;
+- u16 n_proto = 0;
+- int i = 0;
+- struct virtchnl_filter *vf = &filter->f;
+-
+- if (f->dissector->used_keys &
+- ~(BIT(FLOW_DISSECTOR_KEY_CONTROL) |
+- BIT(FLOW_DISSECTOR_KEY_BASIC) |
+- BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
+- BIT(FLOW_DISSECTOR_KEY_VLAN) |
+- BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
+- BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
+- BIT(FLOW_DISSECTOR_KEY_PORTS) |
+- BIT(FLOW_DISSECTOR_KEY_ENC_KEYID))) {
+- dev_err(&adapter->pdev->dev, "Unsupported key used: 0x%x\n",
+- f->dissector->used_keys);
+- return -EOPNOTSUPP;
+- }
+-
+- if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ENC_KEYID)) {
+- struct flow_dissector_key_keyid *mask =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_ENC_KEYID,
+- f->mask);
+-
+- if (mask->keyid != 0)
+- field_flags |= I40EVF_CLOUD_FIELD_TEN_ID;
+- }
+-
+- if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
+- struct flow_dissector_key_basic *key =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_BASIC,
+- f->key);
+-
+- struct flow_dissector_key_basic *mask =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_BASIC,
+- f->mask);
+- n_proto_key = ntohs(key->n_proto);
+- n_proto_mask = ntohs(mask->n_proto);
+-
+- if (n_proto_key == ETH_P_ALL) {
+- n_proto_key = 0;
+- n_proto_mask = 0;
+- }
+- n_proto = n_proto_key & n_proto_mask;
+- if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6)
+- return -EINVAL;
+- if (n_proto == ETH_P_IPV6) {
+- /* specify flow type as TCP IPv6 */
+- vf->flow_type = VIRTCHNL_TCP_V6_FLOW;
+- }
+-
+- if (key->ip_proto != IPPROTO_TCP) {
+- dev_info(&adapter->pdev->dev, "Only TCP transport is supported\n");
+- return -EINVAL;
+- }
+- }
+-
+- if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+- struct flow_dissector_key_eth_addrs *key =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_ETH_ADDRS,
+- f->key);
+-
+- struct flow_dissector_key_eth_addrs *mask =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_ETH_ADDRS,
+- f->mask);
+- /* use is_broadcast and is_zero to check for all 0xf or 0 */
+- if (!is_zero_ether_addr(mask->dst)) {
+- if (is_broadcast_ether_addr(mask->dst)) {
+- field_flags |= I40EVF_CLOUD_FIELD_OMAC;
+- } else {
+- dev_err(&adapter->pdev->dev, "Bad ether dest mask %pM\n",
+- mask->dst);
+- return I40E_ERR_CONFIG;
+- }
+- }
+-
+- if (!is_zero_ether_addr(mask->src)) {
+- if (is_broadcast_ether_addr(mask->src)) {
+- field_flags |= I40EVF_CLOUD_FIELD_IMAC;
+- } else {
+- dev_err(&adapter->pdev->dev, "Bad ether src mask %pM\n",
+- mask->src);
+- return I40E_ERR_CONFIG;
+- }
+- }
+-
+- if (!is_zero_ether_addr(key->dst))
+- if (is_valid_ether_addr(key->dst) ||
+- is_multicast_ether_addr(key->dst)) {
+- /* set the mask if a valid dst_mac address */
+- for (i = 0; i < ETH_ALEN; i++)
+- vf->mask.tcp_spec.dst_mac[i] |= 0xff;
+- ether_addr_copy(vf->data.tcp_spec.dst_mac,
+- key->dst);
+- }
+-
+- if (!is_zero_ether_addr(key->src))
+- if (is_valid_ether_addr(key->src) ||
+- is_multicast_ether_addr(key->src)) {
+- /* set the mask if a valid dst_mac address */
+- for (i = 0; i < ETH_ALEN; i++)
+- vf->mask.tcp_spec.src_mac[i] |= 0xff;
+- ether_addr_copy(vf->data.tcp_spec.src_mac,
+- key->src);
+- }
+- }
+-
+- if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_VLAN)) {
+- struct flow_dissector_key_vlan *key =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_VLAN,
+- f->key);
+- struct flow_dissector_key_vlan *mask =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_VLAN,
+- f->mask);
+-
+- if (mask->vlan_id) {
+- if (mask->vlan_id == VLAN_VID_MASK) {
+- field_flags |= I40EVF_CLOUD_FIELD_IVLAN;
+- } else {
+- dev_err(&adapter->pdev->dev, "Bad vlan mask %u\n",
+- mask->vlan_id);
+- return I40E_ERR_CONFIG;
+- }
+- }
+- vf->mask.tcp_spec.vlan_id |= cpu_to_be16(0xffff);
+- vf->data.tcp_spec.vlan_id = cpu_to_be16(key->vlan_id);
+- }
+-
+- if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CONTROL)) {
+- struct flow_dissector_key_control *key =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_CONTROL,
+- f->key);
+-
+- addr_type = key->addr_type;
+- }
+-
+- if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) {
+- struct flow_dissector_key_ipv4_addrs *key =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_IPV4_ADDRS,
+- f->key);
+- struct flow_dissector_key_ipv4_addrs *mask =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_IPV4_ADDRS,
+- f->mask);
+-
+- if (mask->dst) {
+- if (mask->dst == cpu_to_be32(0xffffffff)) {
+- field_flags |= I40EVF_CLOUD_FIELD_IIP;
+- } else {
+- dev_err(&adapter->pdev->dev, "Bad ip dst mask 0x%08x\n",
+- be32_to_cpu(mask->dst));
+- return I40E_ERR_CONFIG;
+- }
+- }
+-
+- if (mask->src) {
+- if (mask->src == cpu_to_be32(0xffffffff)) {
+- field_flags |= I40EVF_CLOUD_FIELD_IIP;
+- } else {
+- dev_err(&adapter->pdev->dev, "Bad ip src mask 0x%08x\n",
+- be32_to_cpu(mask->dst));
+- return I40E_ERR_CONFIG;
+- }
+- }
+-
+- if (field_flags & I40EVF_CLOUD_FIELD_TEN_ID) {
+- dev_info(&adapter->pdev->dev, "Tenant id not allowed for ip filter\n");
+- return I40E_ERR_CONFIG;
+- }
+- if (key->dst) {
+- vf->mask.tcp_spec.dst_ip[0] |= cpu_to_be32(0xffffffff);
+- vf->data.tcp_spec.dst_ip[0] = key->dst;
+- }
+- if (key->src) {
+- vf->mask.tcp_spec.src_ip[0] |= cpu_to_be32(0xffffffff);
+- vf->data.tcp_spec.src_ip[0] = key->src;
+- }
+- }
+-
+- if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) {
+- struct flow_dissector_key_ipv6_addrs *key =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_IPV6_ADDRS,
+- f->key);
+- struct flow_dissector_key_ipv6_addrs *mask =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_IPV6_ADDRS,
+- f->mask);
+-
+- /* validate mask, make sure it is not IPV6_ADDR_ANY */
+- if (ipv6_addr_any(&mask->dst)) {
+- dev_err(&adapter->pdev->dev, "Bad ipv6 dst mask 0x%02x\n",
+- IPV6_ADDR_ANY);
+- return I40E_ERR_CONFIG;
+- }
+-
+- /* src and dest IPv6 address should not be LOOPBACK
+- * (0:0:0:0:0:0:0:1) which can be represented as ::1
+- */
+- if (ipv6_addr_loopback(&key->dst) ||
+- ipv6_addr_loopback(&key->src)) {
+- dev_err(&adapter->pdev->dev,
+- "ipv6 addr should not be loopback\n");
+- return I40E_ERR_CONFIG;
+- }
+- if (!ipv6_addr_any(&mask->dst) || !ipv6_addr_any(&mask->src))
+- field_flags |= I40EVF_CLOUD_FIELD_IIP;
+-
+- for (i = 0; i < 4; i++)
+- vf->mask.tcp_spec.dst_ip[i] |= cpu_to_be32(0xffffffff);
+- memcpy(&vf->data.tcp_spec.dst_ip, &key->dst.s6_addr32,
+- sizeof(vf->data.tcp_spec.dst_ip));
+- for (i = 0; i < 4; i++)
+- vf->mask.tcp_spec.src_ip[i] |= cpu_to_be32(0xffffffff);
+- memcpy(&vf->data.tcp_spec.src_ip, &key->src.s6_addr32,
+- sizeof(vf->data.tcp_spec.src_ip));
+- }
+- if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_PORTS)) {
+- struct flow_dissector_key_ports *key =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_PORTS,
+- f->key);
+- struct flow_dissector_key_ports *mask =
+- skb_flow_dissector_target(f->dissector,
+- FLOW_DISSECTOR_KEY_PORTS,
+- f->mask);
+-
+- if (mask->src) {
+- if (mask->src == cpu_to_be16(0xffff)) {
+- field_flags |= I40EVF_CLOUD_FIELD_IIP;
+- } else {
+- dev_err(&adapter->pdev->dev, "Bad src port mask %u\n",
+- be16_to_cpu(mask->src));
+- return I40E_ERR_CONFIG;
+- }
+- }
+-
+- if (mask->dst) {
+- if (mask->dst == cpu_to_be16(0xffff)) {
+- field_flags |= I40EVF_CLOUD_FIELD_IIP;
+- } else {
+- dev_err(&adapter->pdev->dev, "Bad dst port mask %u\n",
+- be16_to_cpu(mask->dst));
+- return I40E_ERR_CONFIG;
+- }
+- }
+- if (key->dst) {
+- vf->mask.tcp_spec.dst_port |= cpu_to_be16(0xffff);
+- vf->data.tcp_spec.dst_port = key->dst;
+- }
+-
+- if (key->src) {
+- vf->mask.tcp_spec.src_port |= cpu_to_be16(0xffff);
+- vf->data.tcp_spec.src_port = key->src;
+- }
+- }
+- vf->field_flags = field_flags;
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_handle_tclass - Forward to a traffic class on the device
+- * @adapter: board private structure
+- * @tc: traffic class index on the device
+- * @filter: pointer to cloud filter structure
+- */
+-static int i40evf_handle_tclass(struct i40evf_adapter *adapter, u32 tc,
+- struct i40evf_cloud_filter *filter)
+-{
+- if (tc == 0)
+- return 0;
+- if (tc < adapter->num_tc) {
+- if (!filter->f.data.tcp_spec.dst_port) {
+- dev_err(&adapter->pdev->dev,
+- "Specify destination port to redirect to traffic class other than TC0\n");
+- return -EINVAL;
+- }
+- }
+- /* redirect to a traffic class on the same device */
+- filter->f.action = VIRTCHNL_ACTION_TC_REDIRECT;
+- filter->f.action_meta = tc;
+- return 0;
+-}
+-
+-/**
+- * i40evf_configure_clsflower - Add tc flower filters
+- * @adapter: board private structure
+- * @cls_flower: Pointer to struct tc_cls_flower_offload
+- */
+-static int i40evf_configure_clsflower(struct i40evf_adapter *adapter,
+- struct tc_cls_flower_offload *cls_flower)
+-{
+- int tc = tc_classid_to_hwtc(adapter->netdev, cls_flower->classid);
+- struct i40evf_cloud_filter *filter = NULL;
+- int err = -EINVAL, count = 50;
+-
+- if (tc < 0) {
+- dev_err(&adapter->pdev->dev, "Invalid traffic class\n");
+- return -EINVAL;
+- }
+-
+- filter = kzalloc(sizeof(*filter), GFP_KERNEL);
+- if (!filter)
+- return -ENOMEM;
+-
+- while (test_and_set_bit(__I40EVF_IN_CRITICAL_TASK,
+- &adapter->crit_section)) {
+- if (--count == 0)
+- goto err;
+- udelay(1);
+- }
+-
+- filter->cookie = cls_flower->cookie;
+-
+- /* set the mask to all zeroes to begin with */
+- memset(&filter->f.mask.tcp_spec, 0, sizeof(struct virtchnl_l4_spec));
+- /* start out with flow type and eth type IPv4 to begin with */
+- filter->f.flow_type = VIRTCHNL_TCP_V4_FLOW;
+- err = i40evf_parse_cls_flower(adapter, cls_flower, filter);
+- if (err < 0)
+- goto err;
+-
+- err = i40evf_handle_tclass(adapter, tc, filter);
+- if (err < 0)
+- goto err;
+-
+- /* add filter to the list */
+- spin_lock_bh(&adapter->cloud_filter_list_lock);
+- list_add_tail(&filter->list, &adapter->cloud_filter_list);
+- adapter->num_cloud_filters++;
+- filter->add = true;
+- adapter->aq_required |= I40EVF_FLAG_AQ_ADD_CLOUD_FILTER;
+- spin_unlock_bh(&adapter->cloud_filter_list_lock);
+-err:
+- if (err)
+- kfree(filter);
+-
+- clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
+- return err;
+-}
+-
+-/* i40evf_find_cf - Find the cloud filter in the list
+- * @adapter: Board private structure
+- * @cookie: filter specific cookie
+- *
+- * Returns ptr to the filter object or NULL. Must be called while holding the
+- * cloud_filter_list_lock.
+- */
+-static struct i40evf_cloud_filter *i40evf_find_cf(struct i40evf_adapter *adapter,
+- unsigned long *cookie)
+-{
+- struct i40evf_cloud_filter *filter = NULL;
+-
+- if (!cookie)
+- return NULL;
+-
+- list_for_each_entry(filter, &adapter->cloud_filter_list, list) {
+- if (!memcmp(cookie, &filter->cookie, sizeof(filter->cookie)))
+- return filter;
+- }
+- return NULL;
+-}
+-
+-/**
+- * i40evf_delete_clsflower - Remove tc flower filters
+- * @adapter: board private structure
+- * @cls_flower: Pointer to struct tc_cls_flower_offload
+- */
+-static int i40evf_delete_clsflower(struct i40evf_adapter *adapter,
+- struct tc_cls_flower_offload *cls_flower)
+-{
+- struct i40evf_cloud_filter *filter = NULL;
+- int err = 0;
+-
+- spin_lock_bh(&adapter->cloud_filter_list_lock);
+- filter = i40evf_find_cf(adapter, &cls_flower->cookie);
+- if (filter) {
+- filter->del = true;
+- adapter->aq_required |= I40EVF_FLAG_AQ_DEL_CLOUD_FILTER;
+- } else {
+- err = -EINVAL;
+- }
+- spin_unlock_bh(&adapter->cloud_filter_list_lock);
+-
+- return err;
+-}
+-
+-/**
+- * i40evf_setup_tc_cls_flower - flower classifier offloads
+- * @netdev: net device to configure
+- * @type_data: offload data
+- */
+-static int i40evf_setup_tc_cls_flower(struct i40evf_adapter *adapter,
+- struct tc_cls_flower_offload *cls_flower)
+-{
+- if (cls_flower->common.chain_index)
+- return -EOPNOTSUPP;
+-
+- switch (cls_flower->command) {
+- case TC_CLSFLOWER_REPLACE:
+- return i40evf_configure_clsflower(adapter, cls_flower);
+- case TC_CLSFLOWER_DESTROY:
+- return i40evf_delete_clsflower(adapter, cls_flower);
+- case TC_CLSFLOWER_STATS:
+- return -EOPNOTSUPP;
+- default:
+- return -EOPNOTSUPP;
+- }
+-}
+-
+-/**
+- * i40evf_setup_tc_block_cb - block callback for tc
+- * @type: type of offload
+- * @type_data: offload data
+- * @cb_priv:
+- *
+- * This function is the block callback for traffic classes
+- **/
+-static int i40evf_setup_tc_block_cb(enum tc_setup_type type, void *type_data,
+- void *cb_priv)
+-{
+- switch (type) {
+- case TC_SETUP_CLSFLOWER:
+- return i40evf_setup_tc_cls_flower(cb_priv, type_data);
+- default:
+- return -EOPNOTSUPP;
+- }
+-}
+-
+-/**
+- * i40evf_setup_tc_block - register callbacks for tc
+- * @netdev: network interface device structure
+- * @f: tc offload data
+- *
+- * This function registers block callbacks for tc
+- * offloads
+- **/
+-static int i40evf_setup_tc_block(struct net_device *dev,
+- struct tc_block_offload *f)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(dev);
+-
+- if (f->binder_type != TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
+- return -EOPNOTSUPP;
+-
+- switch (f->command) {
+- case TC_BLOCK_BIND:
+- return tcf_block_cb_register(f->block, i40evf_setup_tc_block_cb,
+- adapter, adapter, f->extack);
+- case TC_BLOCK_UNBIND:
+- tcf_block_cb_unregister(f->block, i40evf_setup_tc_block_cb,
+- adapter);
+- return 0;
+- default:
+- return -EOPNOTSUPP;
+- }
+-}
+-
+-/**
+- * i40evf_setup_tc - configure multiple traffic classes
+- * @netdev: network interface device structure
+- * @type: type of offload
+- * @type_date: tc offload data
+- *
+- * This function is the callback to ndo_setup_tc in the
+- * netdev_ops.
+- *
+- * Returns 0 on success
+- **/
+-static int i40evf_setup_tc(struct net_device *netdev, enum tc_setup_type type,
+- void *type_data)
+-{
+- switch (type) {
+- case TC_SETUP_QDISC_MQPRIO:
+- return __i40evf_setup_tc(netdev, type_data);
+- case TC_SETUP_BLOCK:
+- return i40evf_setup_tc_block(netdev, type_data);
+- default:
+- return -EOPNOTSUPP;
+- }
+-}
+-
+-/**
+- * i40evf_open - Called when a network interface is made active
+- * @netdev: network interface device structure
+- *
+- * Returns 0 on success, negative value on failure
+- *
+- * The open entry point is called when a network interface is made
+- * active by the system (IFF_UP). At this point all resources needed
+- * for transmit and receive operations are allocated, the interrupt
+- * handler is registered with the OS, the watchdog timer is started,
+- * and the stack is notified that the interface is ready.
+- **/
+-static int i40evf_open(struct net_device *netdev)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- int err;
+-
+- if (adapter->flags & I40EVF_FLAG_PF_COMMS_FAILED) {
+- dev_err(&adapter->pdev->dev, "Unable to open device due to PF driver failure.\n");
+- return -EIO;
+- }
+-
+- while (test_and_set_bit(__I40EVF_IN_CRITICAL_TASK,
+- &adapter->crit_section))
+- usleep_range(500, 1000);
+-
+- if (adapter->state != __I40EVF_DOWN) {
+- err = -EBUSY;
+- goto err_unlock;
+- }
+-
+- /* allocate transmit descriptors */
+- err = i40evf_setup_all_tx_resources(adapter);
+- if (err)
+- goto err_setup_tx;
+-
+- /* allocate receive descriptors */
+- err = i40evf_setup_all_rx_resources(adapter);
+- if (err)
+- goto err_setup_rx;
+-
+- /* clear any pending interrupts, may auto mask */
+- err = i40evf_request_traffic_irqs(adapter, netdev->name);
+- if (err)
+- goto err_req_irq;
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+-
+- i40evf_add_filter(adapter, adapter->hw.mac.addr);
+-
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-
+- i40evf_configure(adapter);
+-
+- i40evf_up_complete(adapter);
+-
+- i40evf_irq_enable(adapter, true);
+-
+- clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
+-
+- return 0;
+-
+-err_req_irq:
+- i40evf_down(adapter);
+- i40evf_free_traffic_irqs(adapter);
+-err_setup_rx:
+- i40evf_free_all_rx_resources(adapter);
+-err_setup_tx:
+- i40evf_free_all_tx_resources(adapter);
+-err_unlock:
+- clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
+-
+- return err;
+-}
+-
+-/**
+- * i40evf_close - Disables a network interface
+- * @netdev: network interface device structure
+- *
+- * Returns 0, this is not allowed to fail
+- *
+- * The close entry point is called when an interface is de-activated
+- * by the OS. The hardware is still under the drivers control, but
+- * needs to be disabled. All IRQs except vector 0 (reserved for admin queue)
+- * are freed, along with all transmit and receive resources.
+- **/
+-static int i40evf_close(struct net_device *netdev)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- int status;
+-
+- if (adapter->state <= __I40EVF_DOWN_PENDING)
+- return 0;
+-
+- while (test_and_set_bit(__I40EVF_IN_CRITICAL_TASK,
+- &adapter->crit_section))
+- usleep_range(500, 1000);
+-
+- set_bit(__I40E_VSI_DOWN, adapter->vsi.state);
+- if (CLIENT_ENABLED(adapter))
+- adapter->flags |= I40EVF_FLAG_CLIENT_NEEDS_CLOSE;
+-
+- i40evf_down(adapter);
+- adapter->state = __I40EVF_DOWN_PENDING;
+- i40evf_free_traffic_irqs(adapter);
+-
+- clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
+-
+- /* We explicitly don't free resources here because the hardware is
+- * still active and can DMA into memory. Resources are cleared in
+- * i40evf_virtchnl_completion() after we get confirmation from the PF
+- * driver that the rings have been stopped.
+- *
+- * Also, we wait for state to transition to __I40EVF_DOWN before
+- * returning. State change occurs in i40evf_virtchnl_completion() after
+- * VF resources are released (which occurs after PF driver processes and
+- * responds to admin queue commands).
+- */
+-
+- status = wait_event_timeout(adapter->down_waitqueue,
+- adapter->state == __I40EVF_DOWN,
+- msecs_to_jiffies(200));
+- if (!status)
+- netdev_warn(netdev, "Device resources not yet released\n");
+- return 0;
+-}
+-
+-/**
+- * i40evf_change_mtu - Change the Maximum Transfer Unit
+- * @netdev: network interface device structure
+- * @new_mtu: new value for maximum frame size
+- *
+- * Returns 0 on success, negative on failure
+- **/
+-static int i40evf_change_mtu(struct net_device *netdev, int new_mtu)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- netdev->mtu = new_mtu;
+- if (CLIENT_ENABLED(adapter)) {
+- i40evf_notify_client_l2_params(&adapter->vsi);
+- adapter->flags |= I40EVF_FLAG_SERVICE_CLIENT_REQUESTED;
+- }
+- adapter->flags |= I40EVF_FLAG_RESET_NEEDED;
+- schedule_work(&adapter->reset_task);
+-
+- return 0;
+-}
+-
+-/**
+- * i40e_set_features - set the netdev feature flags
+- * @netdev: ptr to the netdev being adjusted
+- * @features: the feature set that the stack is suggesting
+- * Note: expects to be called while under rtnl_lock()
+- **/
+-static int i40evf_set_features(struct net_device *netdev,
+- netdev_features_t features)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- /* Don't allow changing VLAN_RX flag when adapter is not capable
+- * of VLAN offload
+- */
+- if (!VLAN_ALLOWED(adapter)) {
+- if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX)
+- return -EINVAL;
+- } else if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX) {
+- if (features & NETIF_F_HW_VLAN_CTAG_RX)
+- adapter->aq_required |=
+- I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING;
+- else
+- adapter->aq_required |=
+- I40EVF_FLAG_AQ_DISABLE_VLAN_STRIPPING;
+- }
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_features_check - Validate encapsulated packet conforms to limits
+- * @skb: skb buff
+- * @dev: This physical port's netdev
+- * @features: Offload features that the stack believes apply
+- **/
+-static netdev_features_t i40evf_features_check(struct sk_buff *skb,
+- struct net_device *dev,
+- netdev_features_t features)
+-{
+- size_t len;
+-
+- /* No point in doing any of this if neither checksum nor GSO are
+- * being requested for this frame. We can rule out both by just
+- * checking for CHECKSUM_PARTIAL
+- */
+- if (skb->ip_summed != CHECKSUM_PARTIAL)
+- return features;
+-
+- /* We cannot support GSO if the MSS is going to be less than
+- * 64 bytes. If it is then we need to drop support for GSO.
+- */
+- if (skb_is_gso(skb) && (skb_shinfo(skb)->gso_size < 64))
+- features &= ~NETIF_F_GSO_MASK;
+-
+- /* MACLEN can support at most 63 words */
+- len = skb_network_header(skb) - skb->data;
+- if (len & ~(63 * 2))
+- goto out_err;
+-
+- /* IPLEN and EIPLEN can support at most 127 dwords */
+- len = skb_transport_header(skb) - skb_network_header(skb);
+- if (len & ~(127 * 4))
+- goto out_err;
+-
+- if (skb->encapsulation) {
+- /* L4TUNLEN can support 127 words */
+- len = skb_inner_network_header(skb) - skb_transport_header(skb);
+- if (len & ~(127 * 2))
+- goto out_err;
+-
+- /* IPLEN can support at most 127 dwords */
+- len = skb_inner_transport_header(skb) -
+- skb_inner_network_header(skb);
+- if (len & ~(127 * 4))
+- goto out_err;
+- }
+-
+- /* No need to validate L4LEN as TCP is the only protocol with a
+- * a flexible value and we support all possible values supported
+- * by TCP, which is at most 15 dwords
+- */
+-
+- return features;
+-out_err:
+- return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
+-}
+-
+-/**
+- * i40evf_fix_features - fix up the netdev feature bits
+- * @netdev: our net device
+- * @features: desired feature bits
+- *
+- * Returns fixed-up features bits
+- **/
+-static netdev_features_t i40evf_fix_features(struct net_device *netdev,
+- netdev_features_t features)
+-{
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- if (adapter->vf_res &&
+- !(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN))
+- features &= ~(NETIF_F_HW_VLAN_CTAG_TX |
+- NETIF_F_HW_VLAN_CTAG_RX |
+- NETIF_F_HW_VLAN_CTAG_FILTER);
+-
+- return features;
+-}
+-
+-static const struct net_device_ops i40evf_netdev_ops = {
+- .ndo_open = i40evf_open,
+- .ndo_stop = i40evf_close,
+- .ndo_start_xmit = i40evf_xmit_frame,
+- .ndo_set_rx_mode = i40evf_set_rx_mode,
+- .ndo_validate_addr = eth_validate_addr,
+- .ndo_set_mac_address = i40evf_set_mac,
+- .ndo_change_mtu = i40evf_change_mtu,
+- .ndo_tx_timeout = i40evf_tx_timeout,
+- .ndo_vlan_rx_add_vid = i40evf_vlan_rx_add_vid,
+- .ndo_vlan_rx_kill_vid = i40evf_vlan_rx_kill_vid,
+- .ndo_features_check = i40evf_features_check,
+- .ndo_fix_features = i40evf_fix_features,
+- .ndo_set_features = i40evf_set_features,
+- .ndo_setup_tc = i40evf_setup_tc,
+-};
+-
+-/**
+- * i40evf_check_reset_complete - check that VF reset is complete
+- * @hw: pointer to hw struct
+- *
+- * Returns 0 if device is ready to use, or -EBUSY if it's in reset.
+- **/
+-static int i40evf_check_reset_complete(struct i40e_hw *hw)
+-{
+- u32 rstat;
+- int i;
+-
+- for (i = 0; i < 100; i++) {
+- rstat = rd32(hw, I40E_VFGEN_RSTAT) &
+- I40E_VFGEN_RSTAT_VFR_STATE_MASK;
+- if ((rstat == VIRTCHNL_VFR_VFACTIVE) ||
+- (rstat == VIRTCHNL_VFR_COMPLETED))
+- return 0;
+- usleep_range(10, 20);
+- }
+- return -EBUSY;
+-}
+-
+-/**
+- * i40evf_process_config - Process the config information we got from the PF
+- * @adapter: board private structure
+- *
+- * Verify that we have a valid config struct, and set up our netdev features
+- * and our VSI struct.
+- **/
+-int i40evf_process_config(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_vf_resource *vfres = adapter->vf_res;
+- int i, num_req_queues = adapter->num_req_queues;
+- struct net_device *netdev = adapter->netdev;
+- struct i40e_vsi *vsi = &adapter->vsi;
+- netdev_features_t hw_enc_features;
+- netdev_features_t hw_features;
+-
+- /* got VF config message back from PF, now we can parse it */
+- for (i = 0; i < vfres->num_vsis; i++) {
+- if (vfres->vsi_res[i].vsi_type == VIRTCHNL_VSI_SRIOV)
+- adapter->vsi_res = &vfres->vsi_res[i];
+- }
+- if (!adapter->vsi_res) {
+- dev_err(&adapter->pdev->dev, "No LAN VSI found\n");
+- return -ENODEV;
+- }
+-
+- if (num_req_queues &&
+- num_req_queues != adapter->vsi_res->num_queue_pairs) {
+- /* Problem. The PF gave us fewer queues than what we had
+- * negotiated in our request. Need a reset to see if we can't
+- * get back to a working state.
+- */
+- dev_err(&adapter->pdev->dev,
+- "Requested %d queues, but PF only gave us %d.\n",
+- num_req_queues,
+- adapter->vsi_res->num_queue_pairs);
+- adapter->flags |= I40EVF_FLAG_REINIT_ITR_NEEDED;
+- adapter->num_req_queues = adapter->vsi_res->num_queue_pairs;
+- i40evf_schedule_reset(adapter);
+- return -ENODEV;
+- }
+- adapter->num_req_queues = 0;
+-
+- hw_enc_features = NETIF_F_SG |
+- NETIF_F_IP_CSUM |
+- NETIF_F_IPV6_CSUM |
+- NETIF_F_HIGHDMA |
+- NETIF_F_SOFT_FEATURES |
+- NETIF_F_TSO |
+- NETIF_F_TSO_ECN |
+- NETIF_F_TSO6 |
+- NETIF_F_SCTP_CRC |
+- NETIF_F_RXHASH |
+- NETIF_F_RXCSUM |
+- 0;
+-
+- /* advertise to stack only if offloads for encapsulated packets is
+- * supported
+- */
+- if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ENCAP) {
+- hw_enc_features |= NETIF_F_GSO_UDP_TUNNEL |
+- NETIF_F_GSO_GRE |
+- NETIF_F_GSO_GRE_CSUM |
+- NETIF_F_GSO_IPXIP4 |
+- NETIF_F_GSO_IPXIP6 |
+- NETIF_F_GSO_UDP_TUNNEL_CSUM |
+- NETIF_F_GSO_PARTIAL |
+- 0;
+-
+- if (!(vfres->vf_cap_flags &
+- VIRTCHNL_VF_OFFLOAD_ENCAP_CSUM))
+- netdev->gso_partial_features |=
+- NETIF_F_GSO_UDP_TUNNEL_CSUM;
+-
+- netdev->gso_partial_features |= NETIF_F_GSO_GRE_CSUM;
+- netdev->hw_enc_features |= NETIF_F_TSO_MANGLEID;
+- netdev->hw_enc_features |= hw_enc_features;
+- }
+- /* record features VLANs can make use of */
+- netdev->vlan_features |= hw_enc_features | NETIF_F_TSO_MANGLEID;
+-
+- /* Write features and hw_features separately to avoid polluting
+- * with, or dropping, features that are set when we registered.
+- */
+- hw_features = hw_enc_features;
+-
+- /* Enable VLAN features if supported */
+- if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)
+- hw_features |= (NETIF_F_HW_VLAN_CTAG_TX |
+- NETIF_F_HW_VLAN_CTAG_RX);
+- /* Enable cloud filter if ADQ is supported */
+- if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ)
+- hw_features |= NETIF_F_HW_TC;
+-
+- netdev->hw_features |= hw_features;
+-
+- netdev->features |= hw_features;
+-
+- if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)
+- netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+-
+- netdev->priv_flags |= IFF_UNICAST_FLT;
+-
+- /* Do not turn on offloads when they are requested to be turned off.
+- * TSO needs minimum 576 bytes to work correctly.
+- */
+- if (netdev->wanted_features) {
+- if (!(netdev->wanted_features & NETIF_F_TSO) ||
+- netdev->mtu < 576)
+- netdev->features &= ~NETIF_F_TSO;
+- if (!(netdev->wanted_features & NETIF_F_TSO6) ||
+- netdev->mtu < 576)
+- netdev->features &= ~NETIF_F_TSO6;
+- if (!(netdev->wanted_features & NETIF_F_TSO_ECN))
+- netdev->features &= ~NETIF_F_TSO_ECN;
+- if (!(netdev->wanted_features & NETIF_F_GRO))
+- netdev->features &= ~NETIF_F_GRO;
+- if (!(netdev->wanted_features & NETIF_F_GSO))
+- netdev->features &= ~NETIF_F_GSO;
+- }
+-
+- adapter->vsi.id = adapter->vsi_res->vsi_id;
+-
+- adapter->vsi.back = adapter;
+- adapter->vsi.base_vector = 1;
+- adapter->vsi.work_limit = I40E_DEFAULT_IRQ_WORK;
+- vsi->netdev = adapter->netdev;
+- vsi->qs_handle = adapter->vsi_res->qset_handle;
+- if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_RSS_PF) {
+- adapter->rss_key_size = vfres->rss_key_size;
+- adapter->rss_lut_size = vfres->rss_lut_size;
+- } else {
+- adapter->rss_key_size = I40EVF_HKEY_ARRAY_SIZE;
+- adapter->rss_lut_size = I40EVF_HLUT_ARRAY_SIZE;
+- }
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_init_task - worker thread to perform delayed initialization
+- * @work: pointer to work_struct containing our data
+- *
+- * This task completes the work that was begun in probe. Due to the nature
+- * of VF-PF communications, we may need to wait tens of milliseconds to get
+- * responses back from the PF. Rather than busy-wait in probe and bog down the
+- * whole system, we'll do it in a task so we can sleep.
+- * This task only runs during driver init. Once we've established
+- * communications with the PF driver and set up our netdev, the watchdog
+- * takes over.
+- **/
+-static void i40evf_init_task(struct work_struct *work)
+-{
+- struct i40evf_adapter *adapter = container_of(work,
+- struct i40evf_adapter,
+- init_task.work);
+- struct net_device *netdev = adapter->netdev;
+- struct i40e_hw *hw = &adapter->hw;
+- struct pci_dev *pdev = adapter->pdev;
+- int err, bufsz;
+-
+- switch (adapter->state) {
+- case __I40EVF_STARTUP:
+- /* driver loaded, probe complete */
+- adapter->flags &= ~I40EVF_FLAG_PF_COMMS_FAILED;
+- adapter->flags &= ~I40EVF_FLAG_RESET_PENDING;
+- err = i40e_set_mac_type(hw);
+- if (err) {
+- dev_err(&pdev->dev, "Failed to set MAC type (%d)\n",
+- err);
+- goto err;
+- }
+- err = i40evf_check_reset_complete(hw);
+- if (err) {
+- dev_info(&pdev->dev, "Device is still in reset (%d), retrying\n",
+- err);
+- goto err;
+- }
+- hw->aq.num_arq_entries = I40EVF_AQ_LEN;
+- hw->aq.num_asq_entries = I40EVF_AQ_LEN;
+- hw->aq.arq_buf_size = I40EVF_MAX_AQ_BUF_SIZE;
+- hw->aq.asq_buf_size = I40EVF_MAX_AQ_BUF_SIZE;
+-
+- err = i40evf_init_adminq(hw);
+- if (err) {
+- dev_err(&pdev->dev, "Failed to init Admin Queue (%d)\n",
+- err);
+- goto err;
+- }
+- err = i40evf_send_api_ver(adapter);
+- if (err) {
+- dev_err(&pdev->dev, "Unable to send to PF (%d)\n", err);
+- i40evf_shutdown_adminq(hw);
+- goto err;
+- }
+- adapter->state = __I40EVF_INIT_VERSION_CHECK;
+- goto restart;
+- case __I40EVF_INIT_VERSION_CHECK:
+- if (!i40evf_asq_done(hw)) {
+- dev_err(&pdev->dev, "Admin queue command never completed\n");
+- i40evf_shutdown_adminq(hw);
+- adapter->state = __I40EVF_STARTUP;
+- goto err;
+- }
+-
+- /* aq msg sent, awaiting reply */
+- err = i40evf_verify_api_ver(adapter);
+- if (err) {
+- if (err == I40E_ERR_ADMIN_QUEUE_NO_WORK)
+- err = i40evf_send_api_ver(adapter);
+- else
+- dev_err(&pdev->dev, "Unsupported PF API version %d.%d, expected %d.%d\n",
+- adapter->pf_version.major,
+- adapter->pf_version.minor,
+- VIRTCHNL_VERSION_MAJOR,
+- VIRTCHNL_VERSION_MINOR);
+- goto err;
+- }
+- err = i40evf_send_vf_config_msg(adapter);
+- if (err) {
+- dev_err(&pdev->dev, "Unable to send config request (%d)\n",
+- err);
+- goto err;
+- }
+- adapter->state = __I40EVF_INIT_GET_RESOURCES;
+- goto restart;
+- case __I40EVF_INIT_GET_RESOURCES:
+- /* aq msg sent, awaiting reply */
+- if (!adapter->vf_res) {
+- bufsz = sizeof(struct virtchnl_vf_resource) +
+- (I40E_MAX_VF_VSI *
+- sizeof(struct virtchnl_vsi_resource));
+- adapter->vf_res = kzalloc(bufsz, GFP_KERNEL);
+- if (!adapter->vf_res)
+- goto err;
+- }
+- err = i40evf_get_vf_config(adapter);
+- if (err == I40E_ERR_ADMIN_QUEUE_NO_WORK) {
+- err = i40evf_send_vf_config_msg(adapter);
+- goto err;
+- } else if (err == I40E_ERR_PARAM) {
+- /* We only get ERR_PARAM if the device is in a very bad
+- * state or if we've been disabled for previous bad
+- * behavior. Either way, we're done now.
+- */
+- i40evf_shutdown_adminq(hw);
+- dev_err(&pdev->dev, "Unable to get VF config due to PF error condition, not retrying\n");
+- return;
+- }
+- if (err) {
+- dev_err(&pdev->dev, "Unable to get VF config (%d)\n",
+- err);
+- goto err_alloc;
+- }
+- adapter->state = __I40EVF_INIT_SW;
+- break;
+- default:
+- goto err_alloc;
+- }
+-
+- if (i40evf_process_config(adapter))
+- goto err_alloc;
+- adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+-
+- adapter->flags |= I40EVF_FLAG_RX_CSUM_ENABLED;
+-
+- netdev->netdev_ops = &i40evf_netdev_ops;
+- i40evf_set_ethtool_ops(netdev);
+- netdev->watchdog_timeo = 5 * HZ;
+-
+- /* MTU range: 68 - 9710 */
+- netdev->min_mtu = ETH_MIN_MTU;
+- netdev->max_mtu = I40E_MAX_RXBUFFER - I40E_PACKET_HDR_PAD;
+-
+- if (!is_valid_ether_addr(adapter->hw.mac.addr)) {
+- dev_info(&pdev->dev, "Invalid MAC address %pM, using random\n",
+- adapter->hw.mac.addr);
+- eth_hw_addr_random(netdev);
+- ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr);
+- } else {
+- adapter->flags |= I40EVF_FLAG_ADDR_SET_BY_PF;
+- ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr);
+- ether_addr_copy(netdev->perm_addr, adapter->hw.mac.addr);
+- }
+-
+- timer_setup(&adapter->watchdog_timer, i40evf_watchdog_timer, 0);
+- mod_timer(&adapter->watchdog_timer, jiffies + 1);
+-
+- adapter->tx_desc_count = I40EVF_DEFAULT_TXD;
+- adapter->rx_desc_count = I40EVF_DEFAULT_RXD;
+- err = i40evf_init_interrupt_scheme(adapter);
+- if (err)
+- goto err_sw_init;
+- i40evf_map_rings_to_vectors(adapter);
+- if (adapter->vf_res->vf_cap_flags &
+- VIRTCHNL_VF_OFFLOAD_WB_ON_ITR)
+- adapter->flags |= I40EVF_FLAG_WB_ON_ITR_CAPABLE;
+-
+- err = i40evf_request_misc_irq(adapter);
+- if (err)
+- goto err_sw_init;
+-
+- netif_carrier_off(netdev);
+- adapter->link_up = false;
+-
+- if (!adapter->netdev_registered) {
+- err = register_netdev(netdev);
+- if (err)
+- goto err_register;
+- }
+-
+- adapter->netdev_registered = true;
+-
+- netif_tx_stop_all_queues(netdev);
+- if (CLIENT_ALLOWED(adapter)) {
+- err = i40evf_lan_add_device(adapter);
+- if (err)
+- dev_info(&pdev->dev, "Failed to add VF to client API service list: %d\n",
+- err);
+- }
+-
+- dev_info(&pdev->dev, "MAC address: %pM\n", adapter->hw.mac.addr);
+- if (netdev->features & NETIF_F_GRO)
+- dev_info(&pdev->dev, "GRO is enabled\n");
+-
+- adapter->state = __I40EVF_DOWN;
+- set_bit(__I40E_VSI_DOWN, adapter->vsi.state);
+- i40evf_misc_irq_enable(adapter);
+- wake_up(&adapter->down_waitqueue);
+-
+- adapter->rss_key = kzalloc(adapter->rss_key_size, GFP_KERNEL);
+- adapter->rss_lut = kzalloc(adapter->rss_lut_size, GFP_KERNEL);
+- if (!adapter->rss_key || !adapter->rss_lut)
+- goto err_mem;
+-
+- if (RSS_AQ(adapter)) {
+- adapter->aq_required |= I40EVF_FLAG_AQ_CONFIGURE_RSS;
+- mod_timer_pending(&adapter->watchdog_timer, jiffies + 1);
+- } else {
+- i40evf_init_rss(adapter);
+- }
+- return;
+-restart:
+- schedule_delayed_work(&adapter->init_task, msecs_to_jiffies(30));
+- return;
+-err_mem:
+- i40evf_free_rss(adapter);
+-err_register:
+- i40evf_free_misc_irq(adapter);
+-err_sw_init:
+- i40evf_reset_interrupt_capability(adapter);
+-err_alloc:
+- kfree(adapter->vf_res);
+- adapter->vf_res = NULL;
+-err:
+- /* Things went into the weeds, so try again later */
+- if (++adapter->aq_wait_count > I40EVF_AQ_MAX_ERR) {
+- dev_err(&pdev->dev, "Failed to communicate with PF; waiting before retry\n");
+- adapter->flags |= I40EVF_FLAG_PF_COMMS_FAILED;
+- i40evf_shutdown_adminq(hw);
+- adapter->state = __I40EVF_STARTUP;
+- schedule_delayed_work(&adapter->init_task, HZ * 5);
+- return;
+- }
+- schedule_delayed_work(&adapter->init_task, HZ);
+-}
+-
+-/**
+- * i40evf_shutdown - Shutdown the device in preparation for a reboot
+- * @pdev: pci device structure
+- **/
+-static void i40evf_shutdown(struct pci_dev *pdev)
+-{
+- struct net_device *netdev = pci_get_drvdata(pdev);
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+-
+- netif_device_detach(netdev);
+-
+- if (netif_running(netdev))
+- i40evf_close(netdev);
+-
+- /* Prevent the watchdog from running. */
+- adapter->state = __I40EVF_REMOVE;
+- adapter->aq_required = 0;
+-
+-#ifdef CONFIG_PM
+- pci_save_state(pdev);
+-
+-#endif
+- pci_disable_device(pdev);
+-}
+-
+-/**
+- * i40evf_probe - Device Initialization Routine
+- * @pdev: PCI device information struct
+- * @ent: entry in i40evf_pci_tbl
+- *
+- * Returns 0 on success, negative on failure
+- *
+- * i40evf_probe initializes an adapter identified by a pci_dev structure.
+- * The OS initialization, configuring of the adapter private structure,
+- * and a hardware reset occur.
+- **/
+-static int i40evf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+-{
+- struct net_device *netdev;
+- struct i40evf_adapter *adapter = NULL;
+- struct i40e_hw *hw = NULL;
+- int err;
+-
+- err = pci_enable_device(pdev);
+- if (err)
+- return err;
+-
+- err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
+- if (err) {
+- err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+- if (err) {
+- dev_err(&pdev->dev,
+- "DMA configuration failed: 0x%x\n", err);
+- goto err_dma;
+- }
+- }
+-
+- err = pci_request_regions(pdev, i40evf_driver_name);
+- if (err) {
+- dev_err(&pdev->dev,
+- "pci_request_regions failed 0x%x\n", err);
+- goto err_pci_reg;
+- }
+-
+- pci_enable_pcie_error_reporting(pdev);
+-
+- pci_set_master(pdev);
+-
+- netdev = alloc_etherdev_mq(sizeof(struct i40evf_adapter),
+- I40EVF_MAX_REQ_QUEUES);
+- if (!netdev) {
+- err = -ENOMEM;
+- goto err_alloc_etherdev;
+- }
+-
+- SET_NETDEV_DEV(netdev, &pdev->dev);
+-
+- pci_set_drvdata(pdev, netdev);
+- adapter = netdev_priv(netdev);
+-
+- adapter->netdev = netdev;
+- adapter->pdev = pdev;
+-
+- hw = &adapter->hw;
+- hw->back = adapter;
+-
+- adapter->msg_enable = BIT(DEFAULT_DEBUG_LEVEL_SHIFT) - 1;
+- adapter->state = __I40EVF_STARTUP;
+-
+- /* Call save state here because it relies on the adapter struct. */
+- pci_save_state(pdev);
+-
+- hw->hw_addr = ioremap(pci_resource_start(pdev, 0),
+- pci_resource_len(pdev, 0));
+- if (!hw->hw_addr) {
+- err = -EIO;
+- goto err_ioremap;
+- }
+- hw->vendor_id = pdev->vendor;
+- hw->device_id = pdev->device;
+- pci_read_config_byte(pdev, PCI_REVISION_ID, &hw->revision_id);
+- hw->subsystem_vendor_id = pdev->subsystem_vendor;
+- hw->subsystem_device_id = pdev->subsystem_device;
+- hw->bus.device = PCI_SLOT(pdev->devfn);
+- hw->bus.func = PCI_FUNC(pdev->devfn);
+- hw->bus.bus_id = pdev->bus->number;
+-
+- /* set up the locks for the AQ, do this only once in probe
+- * and destroy them only once in remove
+- */
+- mutex_init(&hw->aq.asq_mutex);
+- mutex_init(&hw->aq.arq_mutex);
+-
+- spin_lock_init(&adapter->mac_vlan_list_lock);
+- spin_lock_init(&adapter->cloud_filter_list_lock);
+-
+- INIT_LIST_HEAD(&adapter->mac_filter_list);
+- INIT_LIST_HEAD(&adapter->vlan_filter_list);
+- INIT_LIST_HEAD(&adapter->cloud_filter_list);
+-
+- INIT_WORK(&adapter->reset_task, i40evf_reset_task);
+- INIT_WORK(&adapter->adminq_task, i40evf_adminq_task);
+- INIT_WORK(&adapter->watchdog_task, i40evf_watchdog_task);
+- INIT_DELAYED_WORK(&adapter->client_task, i40evf_client_task);
+- INIT_DELAYED_WORK(&adapter->init_task, i40evf_init_task);
+- schedule_delayed_work(&adapter->init_task,
+- msecs_to_jiffies(5 * (pdev->devfn & 0x07)));
+-
+- /* Setup the wait queue for indicating transition to down status */
+- init_waitqueue_head(&adapter->down_waitqueue);
+-
+- return 0;
+-
+-err_ioremap:
+- free_netdev(netdev);
+-err_alloc_etherdev:
+- pci_disable_pcie_error_reporting(pdev);
+- pci_release_regions(pdev);
+-err_pci_reg:
+-err_dma:
+- pci_disable_device(pdev);
+- return err;
+-}
+-
+-#ifdef CONFIG_PM
+-/**
+- * i40evf_suspend - Power management suspend routine
+- * @pdev: PCI device information struct
+- * @state: unused
+- *
+- * Called when the system (VM) is entering sleep/suspend.
+- **/
+-static int i40evf_suspend(struct pci_dev *pdev, pm_message_t state)
+-{
+- struct net_device *netdev = pci_get_drvdata(pdev);
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- int retval = 0;
+-
+- netif_device_detach(netdev);
+-
+- while (test_and_set_bit(__I40EVF_IN_CRITICAL_TASK,
+- &adapter->crit_section))
+- usleep_range(500, 1000);
+-
+- if (netif_running(netdev)) {
+- rtnl_lock();
+- i40evf_down(adapter);
+- rtnl_unlock();
+- }
+- i40evf_free_misc_irq(adapter);
+- i40evf_reset_interrupt_capability(adapter);
+-
+- clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
+-
+- retval = pci_save_state(pdev);
+- if (retval)
+- return retval;
+-
+- pci_disable_device(pdev);
+-
+- return 0;
+-}
+-
+-/**
+- * i40evf_resume - Power management resume routine
+- * @pdev: PCI device information struct
+- *
+- * Called when the system (VM) is resumed from sleep/suspend.
+- **/
+-static int i40evf_resume(struct pci_dev *pdev)
+-{
+- struct i40evf_adapter *adapter = pci_get_drvdata(pdev);
+- struct net_device *netdev = adapter->netdev;
+- u32 err;
+-
+- pci_set_power_state(pdev, PCI_D0);
+- pci_restore_state(pdev);
+- /* pci_restore_state clears dev->state_saved so call
+- * pci_save_state to restore it.
+- */
+- pci_save_state(pdev);
+-
+- err = pci_enable_device_mem(pdev);
+- if (err) {
+- dev_err(&pdev->dev, "Cannot enable PCI device from suspend.\n");
+- return err;
+- }
+- pci_set_master(pdev);
+-
+- rtnl_lock();
+- err = i40evf_set_interrupt_capability(adapter);
+- if (err) {
+- rtnl_unlock();
+- dev_err(&pdev->dev, "Cannot enable MSI-X interrupts.\n");
+- return err;
+- }
+- err = i40evf_request_misc_irq(adapter);
+- rtnl_unlock();
+- if (err) {
+- dev_err(&pdev->dev, "Cannot get interrupt vector.\n");
+- return err;
+- }
+-
+- schedule_work(&adapter->reset_task);
+-
+- netif_device_attach(netdev);
+-
+- return err;
+-}
+-
+-#endif /* CONFIG_PM */
+-/**
+- * i40evf_remove - Device Removal Routine
+- * @pdev: PCI device information struct
+- *
+- * i40evf_remove is called by the PCI subsystem to alert the driver
+- * that it should release a PCI device. The could be caused by a
+- * Hot-Plug event, or because the driver is going to be removed from
+- * memory.
+- **/
+-static void i40evf_remove(struct pci_dev *pdev)
+-{
+- struct net_device *netdev = pci_get_drvdata(pdev);
+- struct i40evf_adapter *adapter = netdev_priv(netdev);
+- struct i40evf_vlan_filter *vlf, *vlftmp;
+- struct i40evf_mac_filter *f, *ftmp;
+- struct i40evf_cloud_filter *cf, *cftmp;
+- struct i40e_hw *hw = &adapter->hw;
+- int err;
+- /* Indicate we are in remove and not to run reset_task */
+- set_bit(__I40EVF_IN_REMOVE_TASK, &adapter->crit_section);
+- cancel_delayed_work_sync(&adapter->init_task);
+- cancel_work_sync(&adapter->reset_task);
+- cancel_delayed_work_sync(&adapter->client_task);
+- if (adapter->netdev_registered) {
+- unregister_netdev(netdev);
+- adapter->netdev_registered = false;
+- }
+- if (CLIENT_ALLOWED(adapter)) {
+- err = i40evf_lan_del_device(adapter);
+- if (err)
+- dev_warn(&pdev->dev, "Failed to delete client device: %d\n",
+- err);
+- }
+-
+- /* Shut down all the garbage mashers on the detention level */
+- adapter->state = __I40EVF_REMOVE;
+- adapter->aq_required = 0;
+- adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
+- i40evf_request_reset(adapter);
+- msleep(50);
+- /* If the FW isn't responding, kick it once, but only once. */
+- if (!i40evf_asq_done(hw)) {
+- i40evf_request_reset(adapter);
+- msleep(50);
+- }
+- i40evf_free_all_tx_resources(adapter);
+- i40evf_free_all_rx_resources(adapter);
+- i40evf_misc_irq_disable(adapter);
+- i40evf_free_misc_irq(adapter);
+- i40evf_reset_interrupt_capability(adapter);
+- i40evf_free_q_vectors(adapter);
+-
+- if (adapter->watchdog_timer.function)
+- del_timer_sync(&adapter->watchdog_timer);
+-
+- cancel_work_sync(&adapter->adminq_task);
+-
+- i40evf_free_rss(adapter);
+-
+- if (hw->aq.asq.count)
+- i40evf_shutdown_adminq(hw);
+-
+- /* destroy the locks only once, here */
+- mutex_destroy(&hw->aq.arq_mutex);
+- mutex_destroy(&hw->aq.asq_mutex);
+-
+- iounmap(hw->hw_addr);
+- pci_release_regions(pdev);
+- i40evf_free_all_tx_resources(adapter);
+- i40evf_free_all_rx_resources(adapter);
+- i40evf_free_queues(adapter);
+- kfree(adapter->vf_res);
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+- /* If we got removed before an up/down sequence, we've got a filter
+- * hanging out there that we need to get rid of.
+- */
+- list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
+- list_del(&f->list);
+- kfree(f);
+- }
+- list_for_each_entry_safe(vlf, vlftmp, &adapter->vlan_filter_list,
+- list) {
+- list_del(&vlf->list);
+- kfree(vlf);
+- }
+-
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-
+- spin_lock_bh(&adapter->cloud_filter_list_lock);
+- list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list, list) {
+- list_del(&cf->list);
+- kfree(cf);
+- }
+- spin_unlock_bh(&adapter->cloud_filter_list_lock);
+-
+- free_netdev(netdev);
+-
+- pci_disable_pcie_error_reporting(pdev);
+-
+- pci_disable_device(pdev);
+-}
+-
+-static struct pci_driver i40evf_driver = {
+- .name = i40evf_driver_name,
+- .id_table = i40evf_pci_tbl,
+- .probe = i40evf_probe,
+- .remove = i40evf_remove,
+-#ifdef CONFIG_PM
+- .suspend = i40evf_suspend,
+- .resume = i40evf_resume,
+-#endif
+- .shutdown = i40evf_shutdown,
+-};
+-
+-/**
+- * i40e_init_module - Driver Registration Routine
+- *
+- * i40e_init_module is the first routine called when the driver is
+- * loaded. All it does is register with the PCI subsystem.
+- **/
+-static int __init i40evf_init_module(void)
+-{
+- int ret;
+-
+- pr_info("i40evf: %s - version %s\n", i40evf_driver_string,
+- i40evf_driver_version);
+-
+- pr_info("%s\n", i40evf_copyright);
+-
+- i40evf_wq = alloc_workqueue("%s", WQ_UNBOUND | WQ_MEM_RECLAIM, 1,
+- i40evf_driver_name);
+- if (!i40evf_wq) {
+- pr_err("%s: Failed to create workqueue\n", i40evf_driver_name);
+- return -ENOMEM;
+- }
+- ret = pci_register_driver(&i40evf_driver);
+- return ret;
+-}
+-
+-module_init(i40evf_init_module);
+-
+-/**
+- * i40e_exit_module - Driver Exit Cleanup Routine
+- *
+- * i40e_exit_module is called just before the driver is removed
+- * from memory.
+- **/
+-static void __exit i40evf_exit_module(void)
+-{
+- pci_unregister_driver(&i40evf_driver);
+- destroy_workqueue(i40evf_wq);
+-}
+-
+-module_exit(i40evf_exit_module);
+-
+-/* i40evf_main.c */
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
+deleted file mode 100644
+index 94dabc9d89f73..0000000000000
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
++++ /dev/null
+@@ -1,1458 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/* Copyright(c) 2013 - 2018 Intel Corporation. */
+-
+-#include "i40evf.h"
+-#include "i40e_prototype.h"
+-#include "i40evf_client.h"
+-
+-/* busy wait delay in msec */
+-#define I40EVF_BUSY_WAIT_DELAY 10
+-#define I40EVF_BUSY_WAIT_COUNT 50
+-
+-/**
+- * i40evf_send_pf_msg
+- * @adapter: adapter structure
+- * @op: virtual channel opcode
+- * @msg: pointer to message buffer
+- * @len: message length
+- *
+- * Send message to PF and print status if failure.
+- **/
+-static int i40evf_send_pf_msg(struct i40evf_adapter *adapter,
+- enum virtchnl_ops op, u8 *msg, u16 len)
+-{
+- struct i40e_hw *hw = &adapter->hw;
+- i40e_status err;
+-
+- if (adapter->flags & I40EVF_FLAG_PF_COMMS_FAILED)
+- return 0; /* nothing to see here, move along */
+-
+- err = i40e_aq_send_msg_to_pf(hw, op, 0, msg, len, NULL);
+- if (err)
+- dev_dbg(&adapter->pdev->dev, "Unable to send opcode %d to PF, err %s, aq_err %s\n",
+- op, i40evf_stat_str(hw, err),
+- i40evf_aq_str(hw, hw->aq.asq_last_status));
+- return err;
+-}
+-
+-/**
+- * i40evf_send_api_ver
+- * @adapter: adapter structure
+- *
+- * Send API version admin queue message to the PF. The reply is not checked
+- * in this function. Returns 0 if the message was successfully
+- * sent, or one of the I40E_ADMIN_QUEUE_ERROR_ statuses if not.
+- **/
+-int i40evf_send_api_ver(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_version_info vvi;
+-
+- vvi.major = VIRTCHNL_VERSION_MAJOR;
+- vvi.minor = VIRTCHNL_VERSION_MINOR;
+-
+- return i40evf_send_pf_msg(adapter, VIRTCHNL_OP_VERSION, (u8 *)&vvi,
+- sizeof(vvi));
+-}
+-
+-/**
+- * i40evf_verify_api_ver
+- * @adapter: adapter structure
+- *
+- * Compare API versions with the PF. Must be called after admin queue is
+- * initialized. Returns 0 if API versions match, -EIO if they do not,
+- * I40E_ERR_ADMIN_QUEUE_NO_WORK if the admin queue is empty, and any errors
+- * from the firmware are propagated.
+- **/
+-int i40evf_verify_api_ver(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_version_info *pf_vvi;
+- struct i40e_hw *hw = &adapter->hw;
+- struct i40e_arq_event_info event;
+- enum virtchnl_ops op;
+- i40e_status err;
+-
+- event.buf_len = I40EVF_MAX_AQ_BUF_SIZE;
+- event.msg_buf = kzalloc(event.buf_len, GFP_KERNEL);
+- if (!event.msg_buf) {
+- err = -ENOMEM;
+- goto out;
+- }
+-
+- while (1) {
+- err = i40evf_clean_arq_element(hw, &event, NULL);
+- /* When the AQ is empty, i40evf_clean_arq_element will return
+- * nonzero and this loop will terminate.
+- */
+- if (err)
+- goto out_alloc;
+- op =
+- (enum virtchnl_ops)le32_to_cpu(event.desc.cookie_high);
+- if (op == VIRTCHNL_OP_VERSION)
+- break;
+- }
+-
+-
+- err = (i40e_status)le32_to_cpu(event.desc.cookie_low);
+- if (err)
+- goto out_alloc;
+-
+- if (op != VIRTCHNL_OP_VERSION) {
+- dev_info(&adapter->pdev->dev, "Invalid reply type %d from PF\n",
+- op);
+- err = -EIO;
+- goto out_alloc;
+- }
+-
+- pf_vvi = (struct virtchnl_version_info *)event.msg_buf;
+- adapter->pf_version = *pf_vvi;
+-
+- if ((pf_vvi->major > VIRTCHNL_VERSION_MAJOR) ||
+- ((pf_vvi->major == VIRTCHNL_VERSION_MAJOR) &&
+- (pf_vvi->minor > VIRTCHNL_VERSION_MINOR)))
+- err = -EIO;
+-
+-out_alloc:
+- kfree(event.msg_buf);
+-out:
+- return err;
+-}
+-
+-/**
+- * i40evf_send_vf_config_msg
+- * @adapter: adapter structure
+- *
+- * Send VF configuration request admin queue message to the PF. The reply
+- * is not checked in this function. Returns 0 if the message was
+- * successfully sent, or one of the I40E_ADMIN_QUEUE_ERROR_ statuses if not.
+- **/
+-int i40evf_send_vf_config_msg(struct i40evf_adapter *adapter)
+-{
+- u32 caps;
+-
+- caps = VIRTCHNL_VF_OFFLOAD_L2 |
+- VIRTCHNL_VF_OFFLOAD_RSS_PF |
+- VIRTCHNL_VF_OFFLOAD_RSS_AQ |
+- VIRTCHNL_VF_OFFLOAD_RSS_REG |
+- VIRTCHNL_VF_OFFLOAD_VLAN |
+- VIRTCHNL_VF_OFFLOAD_WB_ON_ITR |
+- VIRTCHNL_VF_OFFLOAD_RSS_PCTYPE_V2 |
+- VIRTCHNL_VF_OFFLOAD_ENCAP |
+- VIRTCHNL_VF_OFFLOAD_ENCAP_CSUM |
+- VIRTCHNL_VF_OFFLOAD_REQ_QUEUES |
+- VIRTCHNL_VF_OFFLOAD_ADQ;
+-
+- adapter->current_op = VIRTCHNL_OP_GET_VF_RESOURCES;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_GET_CONFIG;
+- if (PF_IS_V11(adapter))
+- return i40evf_send_pf_msg(adapter,
+- VIRTCHNL_OP_GET_VF_RESOURCES,
+- (u8 *)&caps, sizeof(caps));
+- else
+- return i40evf_send_pf_msg(adapter,
+- VIRTCHNL_OP_GET_VF_RESOURCES,
+- NULL, 0);
+-}
+-
+-/**
+- * i40evf_validate_num_queues
+- * @adapter: adapter structure
+- *
+- * Validate that the number of queues the PF has sent in
+- * VIRTCHNL_OP_GET_VF_RESOURCES is not larger than the VF can handle.
+- **/
+-static void i40evf_validate_num_queues(struct i40evf_adapter *adapter)
+-{
+- if (adapter->vf_res->num_queue_pairs > I40EVF_MAX_REQ_QUEUES) {
+- struct virtchnl_vsi_resource *vsi_res;
+- int i;
+-
+- dev_info(&adapter->pdev->dev, "Received %d queues, but can only have a max of %d\n",
+- adapter->vf_res->num_queue_pairs,
+- I40EVF_MAX_REQ_QUEUES);
+- dev_info(&adapter->pdev->dev, "Fixing by reducing queues to %d\n",
+- I40EVF_MAX_REQ_QUEUES);
+- adapter->vf_res->num_queue_pairs = I40EVF_MAX_REQ_QUEUES;
+- for (i = 0; i < adapter->vf_res->num_vsis; i++) {
+- vsi_res = &adapter->vf_res->vsi_res[i];
+- vsi_res->num_queue_pairs = I40EVF_MAX_REQ_QUEUES;
+- }
+- }
+-}
+-
+-/**
+- * i40evf_get_vf_config
+- * @adapter: private adapter structure
+- *
+- * Get VF configuration from PF and populate hw structure. Must be called after
+- * admin queue is initialized. Busy waits until response is received from PF,
+- * with maximum timeout. Response from PF is returned in the buffer for further
+- * processing by the caller.
+- **/
+-int i40evf_get_vf_config(struct i40evf_adapter *adapter)
+-{
+- struct i40e_hw *hw = &adapter->hw;
+- struct i40e_arq_event_info event;
+- enum virtchnl_ops op;
+- i40e_status err;
+- u16 len;
+-
+- len = sizeof(struct virtchnl_vf_resource) +
+- I40E_MAX_VF_VSI * sizeof(struct virtchnl_vsi_resource);
+- event.buf_len = len;
+- event.msg_buf = kzalloc(event.buf_len, GFP_KERNEL);
+- if (!event.msg_buf) {
+- err = -ENOMEM;
+- goto out;
+- }
+-
+- while (1) {
+- /* When the AQ is empty, i40evf_clean_arq_element will return
+- * nonzero and this loop will terminate.
+- */
+- err = i40evf_clean_arq_element(hw, &event, NULL);
+- if (err)
+- goto out_alloc;
+- op =
+- (enum virtchnl_ops)le32_to_cpu(event.desc.cookie_high);
+- if (op == VIRTCHNL_OP_GET_VF_RESOURCES)
+- break;
+- }
+-
+- err = (i40e_status)le32_to_cpu(event.desc.cookie_low);
+- memcpy(adapter->vf_res, event.msg_buf, min(event.msg_len, len));
+-
+- /* some PFs send more queues than we should have so validate that
+- * we aren't getting too many queues
+- */
+- if (!err)
+- i40evf_validate_num_queues(adapter);
+- i40e_vf_parse_hw_config(hw, adapter->vf_res);
+-out_alloc:
+- kfree(event.msg_buf);
+-out:
+- return err;
+-}
+-
+-/**
+- * i40evf_configure_queues
+- * @adapter: adapter structure
+- *
+- * Request that the PF set up our (previously allocated) queues.
+- **/
+-void i40evf_configure_queues(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_vsi_queue_config_info *vqci;
+- struct virtchnl_queue_pair_info *vqpi;
+- int pairs = adapter->num_active_queues;
+- int i, len, max_frame = I40E_MAX_RXBUFFER;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot configure queues, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_CONFIG_VSI_QUEUES;
+- len = sizeof(struct virtchnl_vsi_queue_config_info) +
+- (sizeof(struct virtchnl_queue_pair_info) * pairs);
+- vqci = kzalloc(len, GFP_KERNEL);
+- if (!vqci)
+- return;
+-
+- /* Limit maximum frame size when jumbo frames is not enabled */
+- if (!(adapter->flags & I40EVF_FLAG_LEGACY_RX) &&
+- (adapter->netdev->mtu <= ETH_DATA_LEN))
+- max_frame = I40E_RXBUFFER_1536 - NET_IP_ALIGN;
+-
+- vqci->vsi_id = adapter->vsi_res->vsi_id;
+- vqci->num_queue_pairs = pairs;
+- vqpi = vqci->qpair;
+- /* Size check is not needed here - HW max is 16 queue pairs, and we
+- * can fit info for 31 of them into the AQ buffer before it overflows.
+- */
+- for (i = 0; i < pairs; i++) {
+- vqpi->txq.vsi_id = vqci->vsi_id;
+- vqpi->txq.queue_id = i;
+- vqpi->txq.ring_len = adapter->tx_rings[i].count;
+- vqpi->txq.dma_ring_addr = adapter->tx_rings[i].dma;
+- vqpi->rxq.vsi_id = vqci->vsi_id;
+- vqpi->rxq.queue_id = i;
+- vqpi->rxq.ring_len = adapter->rx_rings[i].count;
+- vqpi->rxq.dma_ring_addr = adapter->rx_rings[i].dma;
+- vqpi->rxq.max_pkt_size = max_frame;
+- vqpi->rxq.databuffer_size =
+- ALIGN(adapter->rx_rings[i].rx_buf_len,
+- BIT_ULL(I40E_RXQ_CTX_DBUFF_SHIFT));
+- vqpi++;
+- }
+-
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_CONFIGURE_QUEUES;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_CONFIG_VSI_QUEUES,
+- (u8 *)vqci, len);
+- kfree(vqci);
+-}
+-
+-/**
+- * i40evf_enable_queues
+- * @adapter: adapter structure
+- *
+- * Request that the PF enable all of our queues.
+- **/
+-void i40evf_enable_queues(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_queue_select vqs;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot enable queues, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_ENABLE_QUEUES;
+- vqs.vsi_id = adapter->vsi_res->vsi_id;
+- vqs.tx_queues = BIT(adapter->num_active_queues) - 1;
+- vqs.rx_queues = vqs.tx_queues;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_ENABLE_QUEUES;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_ENABLE_QUEUES,
+- (u8 *)&vqs, sizeof(vqs));
+-}
+-
+-/**
+- * i40evf_disable_queues
+- * @adapter: adapter structure
+- *
+- * Request that the PF disable all of our queues.
+- **/
+-void i40evf_disable_queues(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_queue_select vqs;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot disable queues, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_DISABLE_QUEUES;
+- vqs.vsi_id = adapter->vsi_res->vsi_id;
+- vqs.tx_queues = BIT(adapter->num_active_queues) - 1;
+- vqs.rx_queues = vqs.tx_queues;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_DISABLE_QUEUES;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_DISABLE_QUEUES,
+- (u8 *)&vqs, sizeof(vqs));
+-}
+-
+-/**
+- * i40evf_map_queues
+- * @adapter: adapter structure
+- *
+- * Request that the PF map queues to interrupt vectors. Misc causes, including
+- * admin queue, are always mapped to vector 0.
+- **/
+-void i40evf_map_queues(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_irq_map_info *vimi;
+- struct virtchnl_vector_map *vecmap;
+- int v_idx, q_vectors, len;
+- struct i40e_q_vector *q_vector;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot map queues to vectors, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_CONFIG_IRQ_MAP;
+-
+- q_vectors = adapter->num_msix_vectors - NONQ_VECS;
+-
+- len = sizeof(struct virtchnl_irq_map_info) +
+- (adapter->num_msix_vectors *
+- sizeof(struct virtchnl_vector_map));
+- vimi = kzalloc(len, GFP_KERNEL);
+- if (!vimi)
+- return;
+-
+- vimi->num_vectors = adapter->num_msix_vectors;
+- /* Queue vectors first */
+- for (v_idx = 0; v_idx < q_vectors; v_idx++) {
+- q_vector = &adapter->q_vectors[v_idx];
+- vecmap = &vimi->vecmap[v_idx];
+-
+- vecmap->vsi_id = adapter->vsi_res->vsi_id;
+- vecmap->vector_id = v_idx + NONQ_VECS;
+- vecmap->txq_map = q_vector->ring_mask;
+- vecmap->rxq_map = q_vector->ring_mask;
+- vecmap->rxitr_idx = I40E_RX_ITR;
+- vecmap->txitr_idx = I40E_TX_ITR;
+- }
+- /* Misc vector last - this is only for AdminQ messages */
+- vecmap = &vimi->vecmap[v_idx];
+- vecmap->vsi_id = adapter->vsi_res->vsi_id;
+- vecmap->vector_id = 0;
+- vecmap->txq_map = 0;
+- vecmap->rxq_map = 0;
+-
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_MAP_VECTORS;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_CONFIG_IRQ_MAP,
+- (u8 *)vimi, len);
+- kfree(vimi);
+-}
+-
+-/**
+- * i40evf_request_queues
+- * @adapter: adapter structure
+- * @num: number of requested queues
+- *
+- * We get a default number of queues from the PF. This enables us to request a
+- * different number. Returns 0 on success, negative on failure
+- **/
+-int i40evf_request_queues(struct i40evf_adapter *adapter, int num)
+-{
+- struct virtchnl_vf_res_request vfres;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot request queues, command %d pending\n",
+- adapter->current_op);
+- return -EBUSY;
+- }
+-
+- vfres.num_queue_pairs = num;
+-
+- adapter->current_op = VIRTCHNL_OP_REQUEST_QUEUES;
+- adapter->flags |= I40EVF_FLAG_REINIT_ITR_NEEDED;
+- return i40evf_send_pf_msg(adapter, VIRTCHNL_OP_REQUEST_QUEUES,
+- (u8 *)&vfres, sizeof(vfres));
+-}
+-
+-/**
+- * i40evf_add_ether_addrs
+- * @adapter: adapter structure
+- *
+- * Request that the PF add one or more addresses to our filters.
+- **/
+-void i40evf_add_ether_addrs(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_ether_addr_list *veal;
+- int len, i = 0, count = 0;
+- struct i40evf_mac_filter *f;
+- bool more = false;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot add filters, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+-
+- list_for_each_entry(f, &adapter->mac_filter_list, list) {
+- if (f->add)
+- count++;
+- }
+- if (!count) {
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_ADD_MAC_FILTER;
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_ADD_ETH_ADDR;
+-
+- len = sizeof(struct virtchnl_ether_addr_list) +
+- (count * sizeof(struct virtchnl_ether_addr));
+- if (len > I40EVF_MAX_AQ_BUF_SIZE) {
+- dev_warn(&adapter->pdev->dev, "Too many add MAC changes in one request\n");
+- count = (I40EVF_MAX_AQ_BUF_SIZE -
+- sizeof(struct virtchnl_ether_addr_list)) /
+- sizeof(struct virtchnl_ether_addr);
+- len = sizeof(struct virtchnl_ether_addr_list) +
+- (count * sizeof(struct virtchnl_ether_addr));
+- more = true;
+- }
+-
+- veal = kzalloc(len, GFP_ATOMIC);
+- if (!veal) {
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+- return;
+- }
+-
+- veal->vsi_id = adapter->vsi_res->vsi_id;
+- veal->num_elements = count;
+- list_for_each_entry(f, &adapter->mac_filter_list, list) {
+- if (f->add) {
+- ether_addr_copy(veal->list[i].addr, f->macaddr);
+- i++;
+- f->add = false;
+- if (i == count)
+- break;
+- }
+- }
+- if (!more)
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_ADD_MAC_FILTER;
+-
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_ADD_ETH_ADDR,
+- (u8 *)veal, len);
+- kfree(veal);
+-}
+-
+-/**
+- * i40evf_del_ether_addrs
+- * @adapter: adapter structure
+- *
+- * Request that the PF remove one or more addresses from our filters.
+- **/
+-void i40evf_del_ether_addrs(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_ether_addr_list *veal;
+- struct i40evf_mac_filter *f, *ftmp;
+- int len, i = 0, count = 0;
+- bool more = false;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot remove filters, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+-
+- list_for_each_entry(f, &adapter->mac_filter_list, list) {
+- if (f->remove)
+- count++;
+- }
+- if (!count) {
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_DEL_MAC_FILTER;
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_DEL_ETH_ADDR;
+-
+- len = sizeof(struct virtchnl_ether_addr_list) +
+- (count * sizeof(struct virtchnl_ether_addr));
+- if (len > I40EVF_MAX_AQ_BUF_SIZE) {
+- dev_warn(&adapter->pdev->dev, "Too many delete MAC changes in one request\n");
+- count = (I40EVF_MAX_AQ_BUF_SIZE -
+- sizeof(struct virtchnl_ether_addr_list)) /
+- sizeof(struct virtchnl_ether_addr);
+- len = sizeof(struct virtchnl_ether_addr_list) +
+- (count * sizeof(struct virtchnl_ether_addr));
+- more = true;
+- }
+- veal = kzalloc(len, GFP_ATOMIC);
+- if (!veal) {
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+- return;
+- }
+-
+- veal->vsi_id = adapter->vsi_res->vsi_id;
+- veal->num_elements = count;
+- list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
+- if (f->remove) {
+- ether_addr_copy(veal->list[i].addr, f->macaddr);
+- i++;
+- list_del(&f->list);
+- kfree(f);
+- if (i == count)
+- break;
+- }
+- }
+- if (!more)
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_DEL_MAC_FILTER;
+-
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_DEL_ETH_ADDR,
+- (u8 *)veal, len);
+- kfree(veal);
+-}
+-
+-/**
+- * i40evf_add_vlans
+- * @adapter: adapter structure
+- *
+- * Request that the PF add one or more VLAN filters to our VSI.
+- **/
+-void i40evf_add_vlans(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_vlan_filter_list *vvfl;
+- int len, i = 0, count = 0;
+- struct i40evf_vlan_filter *f;
+- bool more = false;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot add VLANs, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+-
+- list_for_each_entry(f, &adapter->vlan_filter_list, list) {
+- if (f->add)
+- count++;
+- }
+- if (!count) {
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_ADD_VLAN_FILTER;
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_ADD_VLAN;
+-
+- len = sizeof(struct virtchnl_vlan_filter_list) +
+- (count * sizeof(u16));
+- if (len > I40EVF_MAX_AQ_BUF_SIZE) {
+- dev_warn(&adapter->pdev->dev, "Too many add VLAN changes in one request\n");
+- count = (I40EVF_MAX_AQ_BUF_SIZE -
+- sizeof(struct virtchnl_vlan_filter_list)) /
+- sizeof(u16);
+- len = sizeof(struct virtchnl_vlan_filter_list) +
+- (count * sizeof(u16));
+- more = true;
+- }
+- vvfl = kzalloc(len, GFP_ATOMIC);
+- if (!vvfl) {
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+- return;
+- }
+-
+- vvfl->vsi_id = adapter->vsi_res->vsi_id;
+- vvfl->num_elements = count;
+- list_for_each_entry(f, &adapter->vlan_filter_list, list) {
+- if (f->add) {
+- vvfl->vlan_id[i] = f->vlan;
+- i++;
+- f->add = false;
+- if (i == count)
+- break;
+- }
+- }
+- if (!more)
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_ADD_VLAN_FILTER;
+-
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_ADD_VLAN, (u8 *)vvfl, len);
+- kfree(vvfl);
+-}
+-
+-/**
+- * i40evf_del_vlans
+- * @adapter: adapter structure
+- *
+- * Request that the PF remove one or more VLAN filters from our VSI.
+- **/
+-void i40evf_del_vlans(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_vlan_filter_list *vvfl;
+- struct i40evf_vlan_filter *f, *ftmp;
+- int len, i = 0, count = 0;
+- bool more = false;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot remove VLANs, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+-
+- spin_lock_bh(&adapter->mac_vlan_list_lock);
+-
+- list_for_each_entry(f, &adapter->vlan_filter_list, list) {
+- if (f->remove)
+- count++;
+- }
+- if (!count) {
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_DEL_VLAN_FILTER;
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_DEL_VLAN;
+-
+- len = sizeof(struct virtchnl_vlan_filter_list) +
+- (count * sizeof(u16));
+- if (len > I40EVF_MAX_AQ_BUF_SIZE) {
+- dev_warn(&adapter->pdev->dev, "Too many delete VLAN changes in one request\n");
+- count = (I40EVF_MAX_AQ_BUF_SIZE -
+- sizeof(struct virtchnl_vlan_filter_list)) /
+- sizeof(u16);
+- len = sizeof(struct virtchnl_vlan_filter_list) +
+- (count * sizeof(u16));
+- more = true;
+- }
+- vvfl = kzalloc(len, GFP_ATOMIC);
+- if (!vvfl) {
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+- return;
+- }
+-
+- vvfl->vsi_id = adapter->vsi_res->vsi_id;
+- vvfl->num_elements = count;
+- list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) {
+- if (f->remove) {
+- vvfl->vlan_id[i] = f->vlan;
+- i++;
+- list_del(&f->list);
+- kfree(f);
+- if (i == count)
+- break;
+- }
+- }
+- if (!more)
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_DEL_VLAN_FILTER;
+-
+- spin_unlock_bh(&adapter->mac_vlan_list_lock);
+-
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_DEL_VLAN, (u8 *)vvfl, len);
+- kfree(vvfl);
+-}
+-
+-/**
+- * i40evf_set_promiscuous
+- * @adapter: adapter structure
+- * @flags: bitmask to control unicast/multicast promiscuous.
+- *
+- * Request that the PF enable promiscuous mode for our VSI.
+- **/
+-void i40evf_set_promiscuous(struct i40evf_adapter *adapter, int flags)
+-{
+- struct virtchnl_promisc_info vpi;
+- int promisc_all;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot set promiscuous mode, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+-
+- promisc_all = FLAG_VF_UNICAST_PROMISC |
+- FLAG_VF_MULTICAST_PROMISC;
+- if ((flags & promisc_all) == promisc_all) {
+- adapter->flags |= I40EVF_FLAG_PROMISC_ON;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_REQUEST_PROMISC;
+- dev_info(&adapter->pdev->dev, "Entering promiscuous mode\n");
+- }
+-
+- if (flags & FLAG_VF_MULTICAST_PROMISC) {
+- adapter->flags |= I40EVF_FLAG_ALLMULTI_ON;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_REQUEST_ALLMULTI;
+- dev_info(&adapter->pdev->dev, "Entering multicast promiscuous mode\n");
+- }
+-
+- if (!flags) {
+- adapter->flags &= ~(I40EVF_FLAG_PROMISC_ON |
+- I40EVF_FLAG_ALLMULTI_ON);
+- adapter->aq_required &= ~(I40EVF_FLAG_AQ_RELEASE_PROMISC |
+- I40EVF_FLAG_AQ_RELEASE_ALLMULTI);
+- dev_info(&adapter->pdev->dev, "Leaving promiscuous mode\n");
+- }
+-
+- adapter->current_op = VIRTCHNL_OP_CONFIG_PROMISCUOUS_MODE;
+- vpi.vsi_id = adapter->vsi_res->vsi_id;
+- vpi.flags = flags;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_CONFIG_PROMISCUOUS_MODE,
+- (u8 *)&vpi, sizeof(vpi));
+-}
+-
+-/**
+- * i40evf_request_stats
+- * @adapter: adapter structure
+- *
+- * Request VSI statistics from PF.
+- **/
+-void i40evf_request_stats(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_queue_select vqs;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* no error message, this isn't crucial */
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_GET_STATS;
+- vqs.vsi_id = adapter->vsi_res->vsi_id;
+- /* queue maps are ignored for this message - only the vsi is used */
+- if (i40evf_send_pf_msg(adapter, VIRTCHNL_OP_GET_STATS,
+- (u8 *)&vqs, sizeof(vqs)))
+- /* if the request failed, don't lock out others */
+- adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+-}
+-
+-/**
+- * i40evf_get_hena
+- * @adapter: adapter structure
+- *
+- * Request hash enable capabilities from PF
+- **/
+-void i40evf_get_hena(struct i40evf_adapter *adapter)
+-{
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot get RSS hash capabilities, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_GET_RSS_HENA_CAPS;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_GET_HENA;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_GET_RSS_HENA_CAPS,
+- NULL, 0);
+-}
+-
+-/**
+- * i40evf_set_hena
+- * @adapter: adapter structure
+- *
+- * Request the PF to set our RSS hash capabilities
+- **/
+-void i40evf_set_hena(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_rss_hena vrh;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot set RSS hash enable, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- vrh.hena = adapter->hena;
+- adapter->current_op = VIRTCHNL_OP_SET_RSS_HENA;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_SET_HENA;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_SET_RSS_HENA,
+- (u8 *)&vrh, sizeof(vrh));
+-}
+-
+-/**
+- * i40evf_set_rss_key
+- * @adapter: adapter structure
+- *
+- * Request the PF to set our RSS hash key
+- **/
+-void i40evf_set_rss_key(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_rss_key *vrk;
+- int len;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot set RSS key, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- len = sizeof(struct virtchnl_rss_key) +
+- (adapter->rss_key_size * sizeof(u8)) - 1;
+- vrk = kzalloc(len, GFP_KERNEL);
+- if (!vrk)
+- return;
+- vrk->vsi_id = adapter->vsi.id;
+- vrk->key_len = adapter->rss_key_size;
+- memcpy(vrk->key, adapter->rss_key, adapter->rss_key_size);
+-
+- adapter->current_op = VIRTCHNL_OP_CONFIG_RSS_KEY;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_SET_RSS_KEY;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_CONFIG_RSS_KEY,
+- (u8 *)vrk, len);
+- kfree(vrk);
+-}
+-
+-/**
+- * i40evf_set_rss_lut
+- * @adapter: adapter structure
+- *
+- * Request the PF to set our RSS lookup table
+- **/
+-void i40evf_set_rss_lut(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_rss_lut *vrl;
+- int len;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot set RSS LUT, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- len = sizeof(struct virtchnl_rss_lut) +
+- (adapter->rss_lut_size * sizeof(u8)) - 1;
+- vrl = kzalloc(len, GFP_KERNEL);
+- if (!vrl)
+- return;
+- vrl->vsi_id = adapter->vsi.id;
+- vrl->lut_entries = adapter->rss_lut_size;
+- memcpy(vrl->lut, adapter->rss_lut, adapter->rss_lut_size);
+- adapter->current_op = VIRTCHNL_OP_CONFIG_RSS_LUT;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_SET_RSS_LUT;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_CONFIG_RSS_LUT,
+- (u8 *)vrl, len);
+- kfree(vrl);
+-}
+-
+-/**
+- * i40evf_enable_vlan_stripping
+- * @adapter: adapter structure
+- *
+- * Request VLAN header stripping to be enabled
+- **/
+-void i40evf_enable_vlan_stripping(struct i40evf_adapter *adapter)
+-{
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot enable stripping, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_ENABLE_VLAN_STRIPPING;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_ENABLE_VLAN_STRIPPING,
+- NULL, 0);
+-}
+-
+-/**
+- * i40evf_disable_vlan_stripping
+- * @adapter: adapter structure
+- *
+- * Request VLAN header stripping to be disabled
+- **/
+-void i40evf_disable_vlan_stripping(struct i40evf_adapter *adapter)
+-{
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot disable stripping, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_DISABLE_VLAN_STRIPPING;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_DISABLE_VLAN_STRIPPING;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_DISABLE_VLAN_STRIPPING,
+- NULL, 0);
+-}
+-
+-/**
+- * i40evf_print_link_message - print link up or down
+- * @adapter: adapter structure
+- *
+- * Log a message telling the world of our wonderous link status
+- */
+-static void i40evf_print_link_message(struct i40evf_adapter *adapter)
+-{
+- struct net_device *netdev = adapter->netdev;
+- char *speed = "Unknown ";
+-
+- if (!adapter->link_up) {
+- netdev_info(netdev, "NIC Link is Down\n");
+- return;
+- }
+-
+- switch (adapter->link_speed) {
+- case I40E_LINK_SPEED_40GB:
+- speed = "40 G";
+- break;
+- case I40E_LINK_SPEED_25GB:
+- speed = "25 G";
+- break;
+- case I40E_LINK_SPEED_20GB:
+- speed = "20 G";
+- break;
+- case I40E_LINK_SPEED_10GB:
+- speed = "10 G";
+- break;
+- case I40E_LINK_SPEED_1GB:
+- speed = "1000 M";
+- break;
+- case I40E_LINK_SPEED_100MB:
+- speed = "100 M";
+- break;
+- default:
+- break;
+- }
+-
+- netdev_info(netdev, "NIC Link is Up %sbps Full Duplex\n", speed);
+-}
+-
+-/**
+- * i40evf_enable_channel
+- * @adapter: adapter structure
+- *
+- * Request that the PF enable channels as specified by
+- * the user via tc tool.
+- **/
+-void i40evf_enable_channels(struct i40evf_adapter *adapter)
+-{
+- struct virtchnl_tc_info *vti = NULL;
+- u16 len;
+- int i;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot configure mqprio, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+-
+- len = (adapter->num_tc * sizeof(struct virtchnl_channel_info)) +
+- sizeof(struct virtchnl_tc_info);
+-
+- vti = kzalloc(len, GFP_KERNEL);
+- if (!vti)
+- return;
+- vti->num_tc = adapter->num_tc;
+- for (i = 0; i < vti->num_tc; i++) {
+- vti->list[i].count = adapter->ch_config.ch_info[i].count;
+- vti->list[i].offset = adapter->ch_config.ch_info[i].offset;
+- vti->list[i].pad = 0;
+- vti->list[i].max_tx_rate =
+- adapter->ch_config.ch_info[i].max_tx_rate;
+- }
+-
+- adapter->ch_config.state = __I40EVF_TC_RUNNING;
+- adapter->flags |= I40EVF_FLAG_REINIT_ITR_NEEDED;
+- adapter->current_op = VIRTCHNL_OP_ENABLE_CHANNELS;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_ENABLE_CHANNELS;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_ENABLE_CHANNELS,
+- (u8 *)vti, len);
+- kfree(vti);
+-}
+-
+-/**
+- * i40evf_disable_channel
+- * @adapter: adapter structure
+- *
+- * Request that the PF disable channels that are configured
+- **/
+-void i40evf_disable_channels(struct i40evf_adapter *adapter)
+-{
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot configure mqprio, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+-
+- adapter->ch_config.state = __I40EVF_TC_INVALID;
+- adapter->flags |= I40EVF_FLAG_REINIT_ITR_NEEDED;
+- adapter->current_op = VIRTCHNL_OP_DISABLE_CHANNELS;
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_DISABLE_CHANNELS;
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_DISABLE_CHANNELS,
+- NULL, 0);
+-}
+-
+-/**
+- * i40evf_print_cloud_filter
+- * @adapter: adapter structure
+- * @f: cloud filter to print
+- *
+- * Print the cloud filter
+- **/
+-static void i40evf_print_cloud_filter(struct i40evf_adapter *adapter,
+- struct virtchnl_filter *f)
+-{
+- switch (f->flow_type) {
+- case VIRTCHNL_TCP_V4_FLOW:
+- dev_info(&adapter->pdev->dev, "dst_mac: %pM src_mac: %pM vlan_id: %hu dst_ip: %pI4 src_ip %pI4 dst_port %hu src_port %hu\n",
+- &f->data.tcp_spec.dst_mac,
+- &f->data.tcp_spec.src_mac,
+- ntohs(f->data.tcp_spec.vlan_id),
+- &f->data.tcp_spec.dst_ip[0],
+- &f->data.tcp_spec.src_ip[0],
+- ntohs(f->data.tcp_spec.dst_port),
+- ntohs(f->data.tcp_spec.src_port));
+- break;
+- case VIRTCHNL_TCP_V6_FLOW:
+- dev_info(&adapter->pdev->dev, "dst_mac: %pM src_mac: %pM vlan_id: %hu dst_ip: %pI6 src_ip %pI6 dst_port %hu src_port %hu\n",
+- &f->data.tcp_spec.dst_mac,
+- &f->data.tcp_spec.src_mac,
+- ntohs(f->data.tcp_spec.vlan_id),
+- &f->data.tcp_spec.dst_ip,
+- &f->data.tcp_spec.src_ip,
+- ntohs(f->data.tcp_spec.dst_port),
+- ntohs(f->data.tcp_spec.src_port));
+- break;
+- }
+-}
+-
+-/**
+- * i40evf_add_cloud_filter
+- * @adapter: adapter structure
+- *
+- * Request that the PF add cloud filters as specified
+- * by the user via tc tool.
+- **/
+-void i40evf_add_cloud_filter(struct i40evf_adapter *adapter)
+-{
+- struct i40evf_cloud_filter *cf;
+- struct virtchnl_filter *f;
+- int len = 0, count = 0;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot add cloud filter, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+- if (cf->add) {
+- count++;
+- break;
+- }
+- }
+- if (!count) {
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_ADD_CLOUD_FILTER;
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_ADD_CLOUD_FILTER;
+-
+- len = sizeof(struct virtchnl_filter);
+- f = kzalloc(len, GFP_KERNEL);
+- if (!f)
+- return;
+-
+- list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+- if (cf->add) {
+- memcpy(f, &cf->f, sizeof(struct virtchnl_filter));
+- cf->add = false;
+- cf->state = __I40EVF_CF_ADD_PENDING;
+- i40evf_send_pf_msg(adapter,
+- VIRTCHNL_OP_ADD_CLOUD_FILTER,
+- (u8 *)f, len);
+- }
+- }
+- kfree(f);
+-}
+-
+-/**
+- * i40evf_del_cloud_filter
+- * @adapter: adapter structure
+- *
+- * Request that the PF delete cloud filters as specified
+- * by the user via tc tool.
+- **/
+-void i40evf_del_cloud_filter(struct i40evf_adapter *adapter)
+-{
+- struct i40evf_cloud_filter *cf, *cftmp;
+- struct virtchnl_filter *f;
+- int len = 0, count = 0;
+-
+- if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+- /* bail because we already have a command pending */
+- dev_err(&adapter->pdev->dev, "Cannot remove cloud filter, command %d pending\n",
+- adapter->current_op);
+- return;
+- }
+- list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+- if (cf->del) {
+- count++;
+- break;
+- }
+- }
+- if (!count) {
+- adapter->aq_required &= ~I40EVF_FLAG_AQ_DEL_CLOUD_FILTER;
+- return;
+- }
+- adapter->current_op = VIRTCHNL_OP_DEL_CLOUD_FILTER;
+-
+- len = sizeof(struct virtchnl_filter);
+- f = kzalloc(len, GFP_KERNEL);
+- if (!f)
+- return;
+-
+- list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list, list) {
+- if (cf->del) {
+- memcpy(f, &cf->f, sizeof(struct virtchnl_filter));
+- cf->del = false;
+- cf->state = __I40EVF_CF_DEL_PENDING;
+- i40evf_send_pf_msg(adapter,
+- VIRTCHNL_OP_DEL_CLOUD_FILTER,
+- (u8 *)f, len);
+- }
+- }
+- kfree(f);
+-}
+-
+-/**
+- * i40evf_request_reset
+- * @adapter: adapter structure
+- *
+- * Request that the PF reset this VF. No response is expected.
+- **/
+-void i40evf_request_reset(struct i40evf_adapter *adapter)
+-{
+- /* Don't check CURRENT_OP - this is always higher priority */
+- i40evf_send_pf_msg(adapter, VIRTCHNL_OP_RESET_VF, NULL, 0);
+- adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+-}
+-
+-/**
+- * i40evf_virtchnl_completion
+- * @adapter: adapter structure
+- * @v_opcode: opcode sent by PF
+- * @v_retval: retval sent by PF
+- * @msg: message sent by PF
+- * @msglen: message length
+- *
+- * Asynchronous completion function for admin queue messages. Rather than busy
+- * wait, we fire off our requests and assume that no errors will be returned.
+- * This function handles the reply messages.
+- **/
+-void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
+- enum virtchnl_ops v_opcode,
+- i40e_status v_retval,
+- u8 *msg, u16 msglen)
+-{
+- struct net_device *netdev = adapter->netdev;
+-
+- if (v_opcode == VIRTCHNL_OP_EVENT) {
+- struct virtchnl_pf_event *vpe =
+- (struct virtchnl_pf_event *)msg;
+- bool link_up = vpe->event_data.link_event.link_status;
+- switch (vpe->event) {
+- case VIRTCHNL_EVENT_LINK_CHANGE:
+- adapter->link_speed =
+- vpe->event_data.link_event.link_speed;
+-
+- /* we've already got the right link status, bail */
+- if (adapter->link_up == link_up)
+- break;
+-
+- if (link_up) {
+- /* If we get link up message and start queues
+- * before our queues are configured it will
+- * trigger a TX hang. In that case, just ignore
+- * the link status message,we'll get another one
+- * after we enable queues and actually prepared
+- * to send traffic.
+- */
+- if (adapter->state != __I40EVF_RUNNING)
+- break;
+-
+- /* For ADq enabled VF, we reconfigure VSIs and
+- * re-allocate queues. Hence wait till all
+- * queues are enabled.
+- */
+- if (adapter->flags &
+- I40EVF_FLAG_QUEUES_DISABLED)
+- break;
+- }
+-
+- adapter->link_up = link_up;
+- if (link_up) {
+- netif_tx_start_all_queues(netdev);
+- netif_carrier_on(netdev);
+- } else {
+- netif_tx_stop_all_queues(netdev);
+- netif_carrier_off(netdev);
+- }
+- i40evf_print_link_message(adapter);
+- break;
+- case VIRTCHNL_EVENT_RESET_IMPENDING:
+- dev_info(&adapter->pdev->dev, "Reset warning received from the PF\n");
+- if (!(adapter->flags & I40EVF_FLAG_RESET_PENDING)) {
+- adapter->flags |= I40EVF_FLAG_RESET_PENDING;
+- dev_info(&adapter->pdev->dev, "Scheduling reset task\n");
+- schedule_work(&adapter->reset_task);
+- }
+- break;
+- default:
+- dev_err(&adapter->pdev->dev, "Unknown event %d from PF\n",
+- vpe->event);
+- break;
+- }
+- return;
+- }
+- if (v_retval) {
+- switch (v_opcode) {
+- case VIRTCHNL_OP_ADD_VLAN:
+- dev_err(&adapter->pdev->dev, "Failed to add VLAN filter, error %s\n",
+- i40evf_stat_str(&adapter->hw, v_retval));
+- break;
+- case VIRTCHNL_OP_ADD_ETH_ADDR:
+- dev_err(&adapter->pdev->dev, "Failed to add MAC filter, error %s\n",
+- i40evf_stat_str(&adapter->hw, v_retval));
+- break;
+- case VIRTCHNL_OP_DEL_VLAN:
+- dev_err(&adapter->pdev->dev, "Failed to delete VLAN filter, error %s\n",
+- i40evf_stat_str(&adapter->hw, v_retval));
+- break;
+- case VIRTCHNL_OP_DEL_ETH_ADDR:
+- dev_err(&adapter->pdev->dev, "Failed to delete MAC filter, error %s\n",
+- i40evf_stat_str(&adapter->hw, v_retval));
+- break;
+- case VIRTCHNL_OP_ENABLE_CHANNELS:
+- dev_err(&adapter->pdev->dev, "Failed to configure queue channels, error %s\n",
+- i40evf_stat_str(&adapter->hw, v_retval));
+- adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
+- adapter->ch_config.state = __I40EVF_TC_INVALID;
+- netdev_reset_tc(netdev);
+- netif_tx_start_all_queues(netdev);
+- break;
+- case VIRTCHNL_OP_DISABLE_CHANNELS:
+- dev_err(&adapter->pdev->dev, "Failed to disable queue channels, error %s\n",
+- i40evf_stat_str(&adapter->hw, v_retval));
+- adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
+- adapter->ch_config.state = __I40EVF_TC_RUNNING;
+- netif_tx_start_all_queues(netdev);
+- break;
+- case VIRTCHNL_OP_ADD_CLOUD_FILTER: {
+- struct i40evf_cloud_filter *cf, *cftmp;
+-
+- list_for_each_entry_safe(cf, cftmp,
+- &adapter->cloud_filter_list,
+- list) {
+- if (cf->state == __I40EVF_CF_ADD_PENDING) {
+- cf->state = __I40EVF_CF_INVALID;
+- dev_info(&adapter->pdev->dev, "Failed to add cloud filter, error %s\n",
+- i40evf_stat_str(&adapter->hw,
+- v_retval));
+- i40evf_print_cloud_filter(adapter,
+- &cf->f);
+- list_del(&cf->list);
+- kfree(cf);
+- adapter->num_cloud_filters--;
+- }
+- }
+- }
+- break;
+- case VIRTCHNL_OP_DEL_CLOUD_FILTER: {
+- struct i40evf_cloud_filter *cf;
+-
+- list_for_each_entry(cf, &adapter->cloud_filter_list,
+- list) {
+- if (cf->state == __I40EVF_CF_DEL_PENDING) {
+- cf->state = __I40EVF_CF_ACTIVE;
+- dev_info(&adapter->pdev->dev, "Failed to del cloud filter, error %s\n",
+- i40evf_stat_str(&adapter->hw,
+- v_retval));
+- i40evf_print_cloud_filter(adapter,
+- &cf->f);
+- }
+- }
+- }
+- break;
+- default:
+- dev_err(&adapter->pdev->dev, "PF returned error %d (%s) to our request %d\n",
+- v_retval,
+- i40evf_stat_str(&adapter->hw, v_retval),
+- v_opcode);
+- }
+- }
+- switch (v_opcode) {
+- case VIRTCHNL_OP_GET_STATS: {
+- struct i40e_eth_stats *stats =
+- (struct i40e_eth_stats *)msg;
+- netdev->stats.rx_packets = stats->rx_unicast +
+- stats->rx_multicast +
+- stats->rx_broadcast;
+- netdev->stats.tx_packets = stats->tx_unicast +
+- stats->tx_multicast +
+- stats->tx_broadcast;
+- netdev->stats.rx_bytes = stats->rx_bytes;
+- netdev->stats.tx_bytes = stats->tx_bytes;
+- netdev->stats.tx_errors = stats->tx_errors;
+- netdev->stats.rx_dropped = stats->rx_discards;
+- netdev->stats.tx_dropped = stats->tx_discards;
+- adapter->current_stats = *stats;
+- }
+- break;
+- case VIRTCHNL_OP_GET_VF_RESOURCES: {
+- u16 len = sizeof(struct virtchnl_vf_resource) +
+- I40E_MAX_VF_VSI *
+- sizeof(struct virtchnl_vsi_resource);
+- memcpy(adapter->vf_res, msg, min(msglen, len));
+- i40evf_validate_num_queues(adapter);
+- i40e_vf_parse_hw_config(&adapter->hw, adapter->vf_res);
+- /* restore current mac address */
+- ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr);
+- i40evf_process_config(adapter);
+- }
+- break;
+- case VIRTCHNL_OP_ENABLE_QUEUES:
+- /* enable transmits */
+- i40evf_irq_enable(adapter, true);
+- adapter->flags &= ~I40EVF_FLAG_QUEUES_DISABLED;
+- break;
+- case VIRTCHNL_OP_DISABLE_QUEUES:
+- i40evf_free_all_tx_resources(adapter);
+- i40evf_free_all_rx_resources(adapter);
+- if (adapter->state == __I40EVF_DOWN_PENDING) {
+- adapter->state = __I40EVF_DOWN;
+- wake_up(&adapter->down_waitqueue);
+- }
+- break;
+- case VIRTCHNL_OP_VERSION:
+- case VIRTCHNL_OP_CONFIG_IRQ_MAP:
+- /* Don't display an error if we get these out of sequence.
+- * If the firmware needed to get kicked, we'll get these and
+- * it's no problem.
+- */
+- if (v_opcode != adapter->current_op)
+- return;
+- break;
+- case VIRTCHNL_OP_IWARP:
+- /* Gobble zero-length replies from the PF. They indicate that
+- * a previous message was received OK, and the client doesn't
+- * care about that.
+- */
+- if (msglen && CLIENT_ENABLED(adapter))
+- i40evf_notify_client_message(&adapter->vsi,
+- msg, msglen);
+- break;
+-
+- case VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP:
+- adapter->client_pending &=
+- ~(BIT(VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP));
+- break;
+- case VIRTCHNL_OP_GET_RSS_HENA_CAPS: {
+- struct virtchnl_rss_hena *vrh = (struct virtchnl_rss_hena *)msg;
+- if (msglen == sizeof(*vrh))
+- adapter->hena = vrh->hena;
+- else
+- dev_warn(&adapter->pdev->dev,
+- "Invalid message %d from PF\n", v_opcode);
+- }
+- break;
+- case VIRTCHNL_OP_REQUEST_QUEUES: {
+- struct virtchnl_vf_res_request *vfres =
+- (struct virtchnl_vf_res_request *)msg;
+- if (vfres->num_queue_pairs != adapter->num_req_queues) {
+- dev_info(&adapter->pdev->dev,
+- "Requested %d queues, PF can support %d\n",
+- adapter->num_req_queues,
+- vfres->num_queue_pairs);
+- adapter->num_req_queues = 0;
+- adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
+- }
+- }
+- break;
+- case VIRTCHNL_OP_ADD_CLOUD_FILTER: {
+- struct i40evf_cloud_filter *cf;
+-
+- list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+- if (cf->state == __I40EVF_CF_ADD_PENDING)
+- cf->state = __I40EVF_CF_ACTIVE;
+- }
+- }
+- break;
+- case VIRTCHNL_OP_DEL_CLOUD_FILTER: {
+- struct i40evf_cloud_filter *cf, *cftmp;
+-
+- list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list,
+- list) {
+- if (cf->state == __I40EVF_CF_DEL_PENDING) {
+- cf->state = __I40EVF_CF_INVALID;
+- list_del(&cf->list);
+- kfree(cf);
+- adapter->num_cloud_filters--;
+- }
+- }
+- }
+- break;
+- default:
+- if (adapter->current_op && (v_opcode != adapter->current_op))
+- dev_warn(&adapter->pdev->dev, "Expected response %d from PF, received %d\n",
+- adapter->current_op, v_opcode);
+- break;
+- } /* switch v_opcode */
+- adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+-}
+diff --git a/drivers/net/ethernet/intel/iavf/Makefile b/drivers/net/ethernet/intel/iavf/Makefile
+new file mode 100644
+index 0000000000000..1b050d9d5f493
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/Makefile
+@@ -0,0 +1,15 @@
++# SPDX-License-Identifier: GPL-2.0
++# Copyright(c) 2013 - 2018 Intel Corporation.
++#
++# Makefile for the Intel(R) Ethernet Adaptive Virtual Function (iavf)
++# driver
++#
++#
++
++ccflags-y += -I$(src)
++subdir-ccflags-y += -I$(src)
++
++obj-$(CONFIG_IAVF) += iavf.o
++
++iavf-objs := i40evf_main.o i40evf_ethtool.o i40evf_virtchnl.o \
++ i40e_txrx.o i40e_common.o i40e_adminq.o i40evf_client.o
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_adminq.c b/drivers/net/ethernet/intel/iavf/i40e_adminq.c
+new file mode 100644
+index 0000000000000..32e0e2d9cdc53
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_adminq.c
+@@ -0,0 +1,940 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#include "i40e_status.h"
++#include "i40e_type.h"
++#include "i40e_register.h"
++#include "i40e_adminq.h"
++#include "i40e_prototype.h"
++
++/**
++ * i40e_adminq_init_regs - Initialize AdminQ registers
++ * @hw: pointer to the hardware structure
++ *
++ * This assumes the alloc_asq and alloc_arq functions have already been called
++ **/
++static void i40e_adminq_init_regs(struct i40e_hw *hw)
++{
++ /* set head and tail registers in our local struct */
++ if (i40e_is_vf(hw)) {
++ hw->aq.asq.tail = I40E_VF_ATQT1;
++ hw->aq.asq.head = I40E_VF_ATQH1;
++ hw->aq.asq.len = I40E_VF_ATQLEN1;
++ hw->aq.asq.bal = I40E_VF_ATQBAL1;
++ hw->aq.asq.bah = I40E_VF_ATQBAH1;
++ hw->aq.arq.tail = I40E_VF_ARQT1;
++ hw->aq.arq.head = I40E_VF_ARQH1;
++ hw->aq.arq.len = I40E_VF_ARQLEN1;
++ hw->aq.arq.bal = I40E_VF_ARQBAL1;
++ hw->aq.arq.bah = I40E_VF_ARQBAH1;
++ }
++}
++
++/**
++ * i40e_alloc_adminq_asq_ring - Allocate Admin Queue send rings
++ * @hw: pointer to the hardware structure
++ **/
++static i40e_status i40e_alloc_adminq_asq_ring(struct i40e_hw *hw)
++{
++ i40e_status ret_code;
++
++ ret_code = i40e_allocate_dma_mem(hw, &hw->aq.asq.desc_buf,
++ i40e_mem_atq_ring,
++ (hw->aq.num_asq_entries *
++ sizeof(struct i40e_aq_desc)),
++ I40E_ADMINQ_DESC_ALIGNMENT);
++ if (ret_code)
++ return ret_code;
++
++ ret_code = i40e_allocate_virt_mem(hw, &hw->aq.asq.cmd_buf,
++ (hw->aq.num_asq_entries *
++ sizeof(struct i40e_asq_cmd_details)));
++ if (ret_code) {
++ i40e_free_dma_mem(hw, &hw->aq.asq.desc_buf);
++ return ret_code;
++ }
++
++ return ret_code;
++}
++
++/**
++ * i40e_alloc_adminq_arq_ring - Allocate Admin Queue receive rings
++ * @hw: pointer to the hardware structure
++ **/
++static i40e_status i40e_alloc_adminq_arq_ring(struct i40e_hw *hw)
++{
++ i40e_status ret_code;
++
++ ret_code = i40e_allocate_dma_mem(hw, &hw->aq.arq.desc_buf,
++ i40e_mem_arq_ring,
++ (hw->aq.num_arq_entries *
++ sizeof(struct i40e_aq_desc)),
++ I40E_ADMINQ_DESC_ALIGNMENT);
++
++ return ret_code;
++}
++
++/**
++ * i40e_free_adminq_asq - Free Admin Queue send rings
++ * @hw: pointer to the hardware structure
++ *
++ * This assumes the posted send buffers have already been cleaned
++ * and de-allocated
++ **/
++static void i40e_free_adminq_asq(struct i40e_hw *hw)
++{
++ i40e_free_dma_mem(hw, &hw->aq.asq.desc_buf);
++}
++
++/**
++ * i40e_free_adminq_arq - Free Admin Queue receive rings
++ * @hw: pointer to the hardware structure
++ *
++ * This assumes the posted receive buffers have already been cleaned
++ * and de-allocated
++ **/
++static void i40e_free_adminq_arq(struct i40e_hw *hw)
++{
++ i40e_free_dma_mem(hw, &hw->aq.arq.desc_buf);
++}
++
++/**
++ * i40e_alloc_arq_bufs - Allocate pre-posted buffers for the receive queue
++ * @hw: pointer to the hardware structure
++ **/
++static i40e_status i40e_alloc_arq_bufs(struct i40e_hw *hw)
++{
++ i40e_status ret_code;
++ struct i40e_aq_desc *desc;
++ struct i40e_dma_mem *bi;
++ int i;
++
++ /* We'll be allocating the buffer info memory first, then we can
++ * allocate the mapped buffers for the event processing
++ */
++
++ /* buffer_info structures do not need alignment */
++ ret_code = i40e_allocate_virt_mem(hw, &hw->aq.arq.dma_head,
++ (hw->aq.num_arq_entries * sizeof(struct i40e_dma_mem)));
++ if (ret_code)
++ goto alloc_arq_bufs;
++ hw->aq.arq.r.arq_bi = (struct i40e_dma_mem *)hw->aq.arq.dma_head.va;
++
++ /* allocate the mapped buffers */
++ for (i = 0; i < hw->aq.num_arq_entries; i++) {
++ bi = &hw->aq.arq.r.arq_bi[i];
++ ret_code = i40e_allocate_dma_mem(hw, bi,
++ i40e_mem_arq_buf,
++ hw->aq.arq_buf_size,
++ I40E_ADMINQ_DESC_ALIGNMENT);
++ if (ret_code)
++ goto unwind_alloc_arq_bufs;
++
++ /* now configure the descriptors for use */
++ desc = I40E_ADMINQ_DESC(hw->aq.arq, i);
++
++ desc->flags = cpu_to_le16(I40E_AQ_FLAG_BUF);
++ if (hw->aq.arq_buf_size > I40E_AQ_LARGE_BUF)
++ desc->flags |= cpu_to_le16(I40E_AQ_FLAG_LB);
++ desc->opcode = 0;
++ /* This is in accordance with Admin queue design, there is no
++ * register for buffer size configuration
++ */
++ desc->datalen = cpu_to_le16((u16)bi->size);
++ desc->retval = 0;
++ desc->cookie_high = 0;
++ desc->cookie_low = 0;
++ desc->params.external.addr_high =
++ cpu_to_le32(upper_32_bits(bi->pa));
++ desc->params.external.addr_low =
++ cpu_to_le32(lower_32_bits(bi->pa));
++ desc->params.external.param0 = 0;
++ desc->params.external.param1 = 0;
++ }
++
++alloc_arq_bufs:
++ return ret_code;
++
++unwind_alloc_arq_bufs:
++ /* don't try to free the one that failed... */
++ i--;
++ for (; i >= 0; i--)
++ i40e_free_dma_mem(hw, &hw->aq.arq.r.arq_bi[i]);
++ i40e_free_virt_mem(hw, &hw->aq.arq.dma_head);
++
++ return ret_code;
++}
++
++/**
++ * i40e_alloc_asq_bufs - Allocate empty buffer structs for the send queue
++ * @hw: pointer to the hardware structure
++ **/
++static i40e_status i40e_alloc_asq_bufs(struct i40e_hw *hw)
++{
++ i40e_status ret_code;
++ struct i40e_dma_mem *bi;
++ int i;
++
++ /* No mapped memory needed yet, just the buffer info structures */
++ ret_code = i40e_allocate_virt_mem(hw, &hw->aq.asq.dma_head,
++ (hw->aq.num_asq_entries * sizeof(struct i40e_dma_mem)));
++ if (ret_code)
++ goto alloc_asq_bufs;
++ hw->aq.asq.r.asq_bi = (struct i40e_dma_mem *)hw->aq.asq.dma_head.va;
++
++ /* allocate the mapped buffers */
++ for (i = 0; i < hw->aq.num_asq_entries; i++) {
++ bi = &hw->aq.asq.r.asq_bi[i];
++ ret_code = i40e_allocate_dma_mem(hw, bi,
++ i40e_mem_asq_buf,
++ hw->aq.asq_buf_size,
++ I40E_ADMINQ_DESC_ALIGNMENT);
++ if (ret_code)
++ goto unwind_alloc_asq_bufs;
++ }
++alloc_asq_bufs:
++ return ret_code;
++
++unwind_alloc_asq_bufs:
++ /* don't try to free the one that failed... */
++ i--;
++ for (; i >= 0; i--)
++ i40e_free_dma_mem(hw, &hw->aq.asq.r.asq_bi[i]);
++ i40e_free_virt_mem(hw, &hw->aq.asq.dma_head);
++
++ return ret_code;
++}
++
++/**
++ * i40e_free_arq_bufs - Free receive queue buffer info elements
++ * @hw: pointer to the hardware structure
++ **/
++static void i40e_free_arq_bufs(struct i40e_hw *hw)
++{
++ int i;
++
++ /* free descriptors */
++ for (i = 0; i < hw->aq.num_arq_entries; i++)
++ i40e_free_dma_mem(hw, &hw->aq.arq.r.arq_bi[i]);
++
++ /* free the descriptor memory */
++ i40e_free_dma_mem(hw, &hw->aq.arq.desc_buf);
++
++ /* free the dma header */
++ i40e_free_virt_mem(hw, &hw->aq.arq.dma_head);
++}
++
++/**
++ * i40e_free_asq_bufs - Free send queue buffer info elements
++ * @hw: pointer to the hardware structure
++ **/
++static void i40e_free_asq_bufs(struct i40e_hw *hw)
++{
++ int i;
++
++ /* only unmap if the address is non-NULL */
++ for (i = 0; i < hw->aq.num_asq_entries; i++)
++ if (hw->aq.asq.r.asq_bi[i].pa)
++ i40e_free_dma_mem(hw, &hw->aq.asq.r.asq_bi[i]);
++
++ /* free the buffer info list */
++ i40e_free_virt_mem(hw, &hw->aq.asq.cmd_buf);
++
++ /* free the descriptor memory */
++ i40e_free_dma_mem(hw, &hw->aq.asq.desc_buf);
++
++ /* free the dma header */
++ i40e_free_virt_mem(hw, &hw->aq.asq.dma_head);
++}
++
++/**
++ * i40e_config_asq_regs - configure ASQ registers
++ * @hw: pointer to the hardware structure
++ *
++ * Configure base address and length registers for the transmit queue
++ **/
++static i40e_status i40e_config_asq_regs(struct i40e_hw *hw)
++{
++ i40e_status ret_code = 0;
++ u32 reg = 0;
++
++ /* Clear Head and Tail */
++ wr32(hw, hw->aq.asq.head, 0);
++ wr32(hw, hw->aq.asq.tail, 0);
++
++ /* set starting point */
++ wr32(hw, hw->aq.asq.len, (hw->aq.num_asq_entries |
++ I40E_VF_ATQLEN1_ATQENABLE_MASK));
++ wr32(hw, hw->aq.asq.bal, lower_32_bits(hw->aq.asq.desc_buf.pa));
++ wr32(hw, hw->aq.asq.bah, upper_32_bits(hw->aq.asq.desc_buf.pa));
++
++ /* Check one register to verify that config was applied */
++ reg = rd32(hw, hw->aq.asq.bal);
++ if (reg != lower_32_bits(hw->aq.asq.desc_buf.pa))
++ ret_code = I40E_ERR_ADMIN_QUEUE_ERROR;
++
++ return ret_code;
++}
++
++/**
++ * i40e_config_arq_regs - ARQ register configuration
++ * @hw: pointer to the hardware structure
++ *
++ * Configure base address and length registers for the receive (event queue)
++ **/
++static i40e_status i40e_config_arq_regs(struct i40e_hw *hw)
++{
++ i40e_status ret_code = 0;
++ u32 reg = 0;
++
++ /* Clear Head and Tail */
++ wr32(hw, hw->aq.arq.head, 0);
++ wr32(hw, hw->aq.arq.tail, 0);
++
++ /* set starting point */
++ wr32(hw, hw->aq.arq.len, (hw->aq.num_arq_entries |
++ I40E_VF_ARQLEN1_ARQENABLE_MASK));
++ wr32(hw, hw->aq.arq.bal, lower_32_bits(hw->aq.arq.desc_buf.pa));
++ wr32(hw, hw->aq.arq.bah, upper_32_bits(hw->aq.arq.desc_buf.pa));
++
++ /* Update tail in the HW to post pre-allocated buffers */
++ wr32(hw, hw->aq.arq.tail, hw->aq.num_arq_entries - 1);
++
++ /* Check one register to verify that config was applied */
++ reg = rd32(hw, hw->aq.arq.bal);
++ if (reg != lower_32_bits(hw->aq.arq.desc_buf.pa))
++ ret_code = I40E_ERR_ADMIN_QUEUE_ERROR;
++
++ return ret_code;
++}
++
++/**
++ * i40e_init_asq - main initialization routine for ASQ
++ * @hw: pointer to the hardware structure
++ *
++ * This is the main initialization routine for the Admin Send Queue
++ * Prior to calling this function, drivers *MUST* set the following fields
++ * in the hw->aq structure:
++ * - hw->aq.num_asq_entries
++ * - hw->aq.arq_buf_size
++ *
++ * Do *NOT* hold the lock when calling this as the memory allocation routines
++ * called are not going to be atomic context safe
++ **/
++static i40e_status i40e_init_asq(struct i40e_hw *hw)
++{
++ i40e_status ret_code = 0;
++
++ if (hw->aq.asq.count > 0) {
++ /* queue already initialized */
++ ret_code = I40E_ERR_NOT_READY;
++ goto init_adminq_exit;
++ }
++
++ /* verify input for valid configuration */
++ if ((hw->aq.num_asq_entries == 0) ||
++ (hw->aq.asq_buf_size == 0)) {
++ ret_code = I40E_ERR_CONFIG;
++ goto init_adminq_exit;
++ }
++
++ hw->aq.asq.next_to_use = 0;
++ hw->aq.asq.next_to_clean = 0;
++
++ /* allocate the ring memory */
++ ret_code = i40e_alloc_adminq_asq_ring(hw);
++ if (ret_code)
++ goto init_adminq_exit;
++
++ /* allocate buffers in the rings */
++ ret_code = i40e_alloc_asq_bufs(hw);
++ if (ret_code)
++ goto init_adminq_free_rings;
++
++ /* initialize base registers */
++ ret_code = i40e_config_asq_regs(hw);
++ if (ret_code)
++ goto init_adminq_free_rings;
++
++ /* success! */
++ hw->aq.asq.count = hw->aq.num_asq_entries;
++ goto init_adminq_exit;
++
++init_adminq_free_rings:
++ i40e_free_adminq_asq(hw);
++
++init_adminq_exit:
++ return ret_code;
++}
++
++/**
++ * i40e_init_arq - initialize ARQ
++ * @hw: pointer to the hardware structure
++ *
++ * The main initialization routine for the Admin Receive (Event) Queue.
++ * Prior to calling this function, drivers *MUST* set the following fields
++ * in the hw->aq structure:
++ * - hw->aq.num_asq_entries
++ * - hw->aq.arq_buf_size
++ *
++ * Do *NOT* hold the lock when calling this as the memory allocation routines
++ * called are not going to be atomic context safe
++ **/
++static i40e_status i40e_init_arq(struct i40e_hw *hw)
++{
++ i40e_status ret_code = 0;
++
++ if (hw->aq.arq.count > 0) {
++ /* queue already initialized */
++ ret_code = I40E_ERR_NOT_READY;
++ goto init_adminq_exit;
++ }
++
++ /* verify input for valid configuration */
++ if ((hw->aq.num_arq_entries == 0) ||
++ (hw->aq.arq_buf_size == 0)) {
++ ret_code = I40E_ERR_CONFIG;
++ goto init_adminq_exit;
++ }
++
++ hw->aq.arq.next_to_use = 0;
++ hw->aq.arq.next_to_clean = 0;
++
++ /* allocate the ring memory */
++ ret_code = i40e_alloc_adminq_arq_ring(hw);
++ if (ret_code)
++ goto init_adminq_exit;
++
++ /* allocate buffers in the rings */
++ ret_code = i40e_alloc_arq_bufs(hw);
++ if (ret_code)
++ goto init_adminq_free_rings;
++
++ /* initialize base registers */
++ ret_code = i40e_config_arq_regs(hw);
++ if (ret_code)
++ goto init_adminq_free_rings;
++
++ /* success! */
++ hw->aq.arq.count = hw->aq.num_arq_entries;
++ goto init_adminq_exit;
++
++init_adminq_free_rings:
++ i40e_free_adminq_arq(hw);
++
++init_adminq_exit:
++ return ret_code;
++}
++
++/**
++ * i40e_shutdown_asq - shutdown the ASQ
++ * @hw: pointer to the hardware structure
++ *
++ * The main shutdown routine for the Admin Send Queue
++ **/
++static i40e_status i40e_shutdown_asq(struct i40e_hw *hw)
++{
++ i40e_status ret_code = 0;
++
++ mutex_lock(&hw->aq.asq_mutex);
++
++ if (hw->aq.asq.count == 0) {
++ ret_code = I40E_ERR_NOT_READY;
++ goto shutdown_asq_out;
++ }
++
++ /* Stop firmware AdminQ processing */
++ wr32(hw, hw->aq.asq.head, 0);
++ wr32(hw, hw->aq.asq.tail, 0);
++ wr32(hw, hw->aq.asq.len, 0);
++ wr32(hw, hw->aq.asq.bal, 0);
++ wr32(hw, hw->aq.asq.bah, 0);
++
++ hw->aq.asq.count = 0; /* to indicate uninitialized queue */
++
++ /* free ring buffers */
++ i40e_free_asq_bufs(hw);
++
++shutdown_asq_out:
++ mutex_unlock(&hw->aq.asq_mutex);
++ return ret_code;
++}
++
++/**
++ * i40e_shutdown_arq - shutdown ARQ
++ * @hw: pointer to the hardware structure
++ *
++ * The main shutdown routine for the Admin Receive Queue
++ **/
++static i40e_status i40e_shutdown_arq(struct i40e_hw *hw)
++{
++ i40e_status ret_code = 0;
++
++ mutex_lock(&hw->aq.arq_mutex);
++
++ if (hw->aq.arq.count == 0) {
++ ret_code = I40E_ERR_NOT_READY;
++ goto shutdown_arq_out;
++ }
++
++ /* Stop firmware AdminQ processing */
++ wr32(hw, hw->aq.arq.head, 0);
++ wr32(hw, hw->aq.arq.tail, 0);
++ wr32(hw, hw->aq.arq.len, 0);
++ wr32(hw, hw->aq.arq.bal, 0);
++ wr32(hw, hw->aq.arq.bah, 0);
++
++ hw->aq.arq.count = 0; /* to indicate uninitialized queue */
++
++ /* free ring buffers */
++ i40e_free_arq_bufs(hw);
++
++shutdown_arq_out:
++ mutex_unlock(&hw->aq.arq_mutex);
++ return ret_code;
++}
++
++/**
++ * i40evf_init_adminq - main initialization routine for Admin Queue
++ * @hw: pointer to the hardware structure
++ *
++ * Prior to calling this function, drivers *MUST* set the following fields
++ * in the hw->aq structure:
++ * - hw->aq.num_asq_entries
++ * - hw->aq.num_arq_entries
++ * - hw->aq.arq_buf_size
++ * - hw->aq.asq_buf_size
++ **/
++i40e_status i40evf_init_adminq(struct i40e_hw *hw)
++{
++ i40e_status ret_code;
++
++ /* verify input for valid configuration */
++ if ((hw->aq.num_arq_entries == 0) ||
++ (hw->aq.num_asq_entries == 0) ||
++ (hw->aq.arq_buf_size == 0) ||
++ (hw->aq.asq_buf_size == 0)) {
++ ret_code = I40E_ERR_CONFIG;
++ goto init_adminq_exit;
++ }
++
++ /* Set up register offsets */
++ i40e_adminq_init_regs(hw);
++
++ /* setup ASQ command write back timeout */
++ hw->aq.asq_cmd_timeout = I40E_ASQ_CMD_TIMEOUT;
++
++ /* allocate the ASQ */
++ ret_code = i40e_init_asq(hw);
++ if (ret_code)
++ goto init_adminq_destroy_locks;
++
++ /* allocate the ARQ */
++ ret_code = i40e_init_arq(hw);
++ if (ret_code)
++ goto init_adminq_free_asq;
++
++ /* success! */
++ goto init_adminq_exit;
++
++init_adminq_free_asq:
++ i40e_shutdown_asq(hw);
++init_adminq_destroy_locks:
++
++init_adminq_exit:
++ return ret_code;
++}
++
++/**
++ * i40evf_shutdown_adminq - shutdown routine for the Admin Queue
++ * @hw: pointer to the hardware structure
++ **/
++i40e_status i40evf_shutdown_adminq(struct i40e_hw *hw)
++{
++ i40e_status ret_code = 0;
++
++ if (i40evf_check_asq_alive(hw))
++ i40evf_aq_queue_shutdown(hw, true);
++
++ i40e_shutdown_asq(hw);
++ i40e_shutdown_arq(hw);
++
++ return ret_code;
++}
++
++/**
++ * i40e_clean_asq - cleans Admin send queue
++ * @hw: pointer to the hardware structure
++ *
++ * returns the number of free desc
++ **/
++static u16 i40e_clean_asq(struct i40e_hw *hw)
++{
++ struct i40e_adminq_ring *asq = &(hw->aq.asq);
++ struct i40e_asq_cmd_details *details;
++ u16 ntc = asq->next_to_clean;
++ struct i40e_aq_desc desc_cb;
++ struct i40e_aq_desc *desc;
++
++ desc = I40E_ADMINQ_DESC(*asq, ntc);
++ details = I40E_ADMINQ_DETAILS(*asq, ntc);
++ while (rd32(hw, hw->aq.asq.head) != ntc) {
++ i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
++ "ntc %d head %d.\n", ntc, rd32(hw, hw->aq.asq.head));
++
++ if (details->callback) {
++ I40E_ADMINQ_CALLBACK cb_func =
++ (I40E_ADMINQ_CALLBACK)details->callback;
++ desc_cb = *desc;
++ cb_func(hw, &desc_cb);
++ }
++ memset((void *)desc, 0, sizeof(struct i40e_aq_desc));
++ memset((void *)details, 0,
++ sizeof(struct i40e_asq_cmd_details));
++ ntc++;
++ if (ntc == asq->count)
++ ntc = 0;
++ desc = I40E_ADMINQ_DESC(*asq, ntc);
++ details = I40E_ADMINQ_DETAILS(*asq, ntc);
++ }
++
++ asq->next_to_clean = ntc;
++
++ return I40E_DESC_UNUSED(asq);
++}
++
++/**
++ * i40evf_asq_done - check if FW has processed the Admin Send Queue
++ * @hw: pointer to the hw struct
++ *
++ * Returns true if the firmware has processed all descriptors on the
++ * admin send queue. Returns false if there are still requests pending.
++ **/
++bool i40evf_asq_done(struct i40e_hw *hw)
++{
++ /* AQ designers suggest use of head for better
++ * timing reliability than DD bit
++ */
++ return rd32(hw, hw->aq.asq.head) == hw->aq.asq.next_to_use;
++
++}
++
++/**
++ * i40evf_asq_send_command - send command to Admin Queue
++ * @hw: pointer to the hw struct
++ * @desc: prefilled descriptor describing the command (non DMA mem)
++ * @buff: buffer to use for indirect commands
++ * @buff_size: size of buffer for indirect commands
++ * @cmd_details: pointer to command details structure
++ *
++ * This is the main send command driver routine for the Admin Queue send
++ * queue. It runs the queue, cleans the queue, etc
++ **/
++i40e_status i40evf_asq_send_command(struct i40e_hw *hw,
++ struct i40e_aq_desc *desc,
++ void *buff, /* can be NULL */
++ u16 buff_size,
++ struct i40e_asq_cmd_details *cmd_details)
++{
++ i40e_status status = 0;
++ struct i40e_dma_mem *dma_buff = NULL;
++ struct i40e_asq_cmd_details *details;
++ struct i40e_aq_desc *desc_on_ring;
++ bool cmd_completed = false;
++ u16 retval = 0;
++ u32 val = 0;
++
++ mutex_lock(&hw->aq.asq_mutex);
++
++ if (hw->aq.asq.count == 0) {
++ i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
++ "AQTX: Admin queue not initialized.\n");
++ status = I40E_ERR_QUEUE_EMPTY;
++ goto asq_send_command_error;
++ }
++
++ hw->aq.asq_last_status = I40E_AQ_RC_OK;
++
++ val = rd32(hw, hw->aq.asq.head);
++ if (val >= hw->aq.num_asq_entries) {
++ i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
++ "AQTX: head overrun at %d\n", val);
++ status = I40E_ERR_QUEUE_EMPTY;
++ goto asq_send_command_error;
++ }
++
++ details = I40E_ADMINQ_DETAILS(hw->aq.asq, hw->aq.asq.next_to_use);
++ if (cmd_details) {
++ *details = *cmd_details;
++
++ /* If the cmd_details are defined copy the cookie. The
++ * cpu_to_le32 is not needed here because the data is ignored
++ * by the FW, only used by the driver
++ */
++ if (details->cookie) {
++ desc->cookie_high =
++ cpu_to_le32(upper_32_bits(details->cookie));
++ desc->cookie_low =
++ cpu_to_le32(lower_32_bits(details->cookie));
++ }
++ } else {
++ memset(details, 0, sizeof(struct i40e_asq_cmd_details));
++ }
++
++ /* clear requested flags and then set additional flags if defined */
++ desc->flags &= ~cpu_to_le16(details->flags_dis);
++ desc->flags |= cpu_to_le16(details->flags_ena);
++
++ if (buff_size > hw->aq.asq_buf_size) {
++ i40e_debug(hw,
++ I40E_DEBUG_AQ_MESSAGE,
++ "AQTX: Invalid buffer size: %d.\n",
++ buff_size);
++ status = I40E_ERR_INVALID_SIZE;
++ goto asq_send_command_error;
++ }
++
++ if (details->postpone && !details->async) {
++ i40e_debug(hw,
++ I40E_DEBUG_AQ_MESSAGE,
++ "AQTX: Async flag not set along with postpone flag");
++ status = I40E_ERR_PARAM;
++ goto asq_send_command_error;
++ }
++
++ /* call clean and check queue available function to reclaim the
++ * descriptors that were processed by FW, the function returns the
++ * number of desc available
++ */
++ /* the clean function called here could be called in a separate thread
++ * in case of asynchronous completions
++ */
++ if (i40e_clean_asq(hw) == 0) {
++ i40e_debug(hw,
++ I40E_DEBUG_AQ_MESSAGE,
++ "AQTX: Error queue is full.\n");
++ status = I40E_ERR_ADMIN_QUEUE_FULL;
++ goto asq_send_command_error;
++ }
++
++ /* initialize the temp desc pointer with the right desc */
++ desc_on_ring = I40E_ADMINQ_DESC(hw->aq.asq, hw->aq.asq.next_to_use);
++
++ /* if the desc is available copy the temp desc to the right place */
++ *desc_on_ring = *desc;
++
++ /* if buff is not NULL assume indirect command */
++ if (buff != NULL) {
++ dma_buff = &(hw->aq.asq.r.asq_bi[hw->aq.asq.next_to_use]);
++ /* copy the user buff into the respective DMA buff */
++ memcpy(dma_buff->va, buff, buff_size);
++ desc_on_ring->datalen = cpu_to_le16(buff_size);
++
++ /* Update the address values in the desc with the pa value
++ * for respective buffer
++ */
++ desc_on_ring->params.external.addr_high =
++ cpu_to_le32(upper_32_bits(dma_buff->pa));
++ desc_on_ring->params.external.addr_low =
++ cpu_to_le32(lower_32_bits(dma_buff->pa));
++ }
++
++ /* bump the tail */
++ i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE, "AQTX: desc and buffer:\n");
++ i40evf_debug_aq(hw, I40E_DEBUG_AQ_COMMAND, (void *)desc_on_ring,
++ buff, buff_size);
++ (hw->aq.asq.next_to_use)++;
++ if (hw->aq.asq.next_to_use == hw->aq.asq.count)
++ hw->aq.asq.next_to_use = 0;
++ if (!details->postpone)
++ wr32(hw, hw->aq.asq.tail, hw->aq.asq.next_to_use);
++
++ /* if cmd_details are not defined or async flag is not set,
++ * we need to wait for desc write back
++ */
++ if (!details->async && !details->postpone) {
++ u32 total_delay = 0;
++
++ do {
++ /* AQ designers suggest use of head for better
++ * timing reliability than DD bit
++ */
++ if (i40evf_asq_done(hw))
++ break;
++ udelay(50);
++ total_delay += 50;
++ } while (total_delay < hw->aq.asq_cmd_timeout);
++ }
++
++ /* if ready, copy the desc back to temp */
++ if (i40evf_asq_done(hw)) {
++ *desc = *desc_on_ring;
++ if (buff != NULL)
++ memcpy(buff, dma_buff->va, buff_size);
++ retval = le16_to_cpu(desc->retval);
++ if (retval != 0) {
++ i40e_debug(hw,
++ I40E_DEBUG_AQ_MESSAGE,
++ "AQTX: Command completed with error 0x%X.\n",
++ retval);
++
++ /* strip off FW internal code */
++ retval &= 0xff;
++ }
++ cmd_completed = true;
++ if ((enum i40e_admin_queue_err)retval == I40E_AQ_RC_OK)
++ status = 0;
++ else if ((enum i40e_admin_queue_err)retval == I40E_AQ_RC_EBUSY)
++ status = I40E_ERR_NOT_READY;
++ else
++ status = I40E_ERR_ADMIN_QUEUE_ERROR;
++ hw->aq.asq_last_status = (enum i40e_admin_queue_err)retval;
++ }
++
++ i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
++ "AQTX: desc and buffer writeback:\n");
++ i40evf_debug_aq(hw, I40E_DEBUG_AQ_COMMAND, (void *)desc, buff,
++ buff_size);
++
++ /* save writeback aq if requested */
++ if (details->wb_desc)
++ *details->wb_desc = *desc_on_ring;
++
++ /* update the error if time out occurred */
++ if ((!cmd_completed) &&
++ (!details->async && !details->postpone)) {
++ if (rd32(hw, hw->aq.asq.len) & I40E_VF_ATQLEN1_ATQCRIT_MASK) {
++ i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
++ "AQTX: AQ Critical error.\n");
++ status = I40E_ERR_ADMIN_QUEUE_CRITICAL_ERROR;
++ } else {
++ i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
++ "AQTX: Writeback timeout.\n");
++ status = I40E_ERR_ADMIN_QUEUE_TIMEOUT;
++ }
++ }
++
++asq_send_command_error:
++ mutex_unlock(&hw->aq.asq_mutex);
++ return status;
++}
++
++/**
++ * i40evf_fill_default_direct_cmd_desc - AQ descriptor helper function
++ * @desc: pointer to the temp descriptor (non DMA mem)
++ * @opcode: the opcode can be used to decide which flags to turn off or on
++ *
++ * Fill the desc with default values
++ **/
++void i40evf_fill_default_direct_cmd_desc(struct i40e_aq_desc *desc,
++ u16 opcode)
++{
++ /* zero out the desc */
++ memset((void *)desc, 0, sizeof(struct i40e_aq_desc));
++ desc->opcode = cpu_to_le16(opcode);
++ desc->flags = cpu_to_le16(I40E_AQ_FLAG_SI);
++}
++
++/**
++ * i40evf_clean_arq_element
++ * @hw: pointer to the hw struct
++ * @e: event info from the receive descriptor, includes any buffers
++ * @pending: number of events that could be left to process
++ *
++ * This function cleans one Admin Receive Queue element and returns
++ * the contents through e. It can also return how many events are
++ * left to process through 'pending'
++ **/
++i40e_status i40evf_clean_arq_element(struct i40e_hw *hw,
++ struct i40e_arq_event_info *e,
++ u16 *pending)
++{
++ i40e_status ret_code = 0;
++ u16 ntc = hw->aq.arq.next_to_clean;
++ struct i40e_aq_desc *desc;
++ struct i40e_dma_mem *bi;
++ u16 desc_idx;
++ u16 datalen;
++ u16 flags;
++ u16 ntu;
++
++ /* pre-clean the event info */
++ memset(&e->desc, 0, sizeof(e->desc));
++
++ /* take the lock before we start messing with the ring */
++ mutex_lock(&hw->aq.arq_mutex);
++
++ if (hw->aq.arq.count == 0) {
++ i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE,
++ "AQRX: Admin queue not initialized.\n");
++ ret_code = I40E_ERR_QUEUE_EMPTY;
++ goto clean_arq_element_err;
++ }
++
++ /* set next_to_use to head */
++ ntu = rd32(hw, hw->aq.arq.head) & I40E_VF_ARQH1_ARQH_MASK;
++ if (ntu == ntc) {
++ /* nothing to do - shouldn't need to update ring's values */
++ ret_code = I40E_ERR_ADMIN_QUEUE_NO_WORK;
++ goto clean_arq_element_out;
++ }
++
++ /* now clean the next descriptor */
++ desc = I40E_ADMINQ_DESC(hw->aq.arq, ntc);
++ desc_idx = ntc;
++
++ hw->aq.arq_last_status =
++ (enum i40e_admin_queue_err)le16_to_cpu(desc->retval);
++ flags = le16_to_cpu(desc->flags);
++ if (flags & I40E_AQ_FLAG_ERR) {
++ ret_code = I40E_ERR_ADMIN_QUEUE_ERROR;
++ i40e_debug(hw,
++ I40E_DEBUG_AQ_MESSAGE,
++ "AQRX: Event received with error 0x%X.\n",
++ hw->aq.arq_last_status);
++ }
++
++ e->desc = *desc;
++ datalen = le16_to_cpu(desc->datalen);
++ e->msg_len = min(datalen, e->buf_len);
++ if (e->msg_buf != NULL && (e->msg_len != 0))
++ memcpy(e->msg_buf, hw->aq.arq.r.arq_bi[desc_idx].va,
++ e->msg_len);
++
++ i40e_debug(hw, I40E_DEBUG_AQ_MESSAGE, "AQRX: desc and buffer:\n");
++ i40evf_debug_aq(hw, I40E_DEBUG_AQ_COMMAND, (void *)desc, e->msg_buf,
++ hw->aq.arq_buf_size);
++
++ /* Restore the original datalen and buffer address in the desc,
++ * FW updates datalen to indicate the event message
++ * size
++ */
++ bi = &hw->aq.arq.r.arq_bi[ntc];
++ memset((void *)desc, 0, sizeof(struct i40e_aq_desc));
++
++ desc->flags = cpu_to_le16(I40E_AQ_FLAG_BUF);
++ if (hw->aq.arq_buf_size > I40E_AQ_LARGE_BUF)
++ desc->flags |= cpu_to_le16(I40E_AQ_FLAG_LB);
++ desc->datalen = cpu_to_le16((u16)bi->size);
++ desc->params.external.addr_high = cpu_to_le32(upper_32_bits(bi->pa));
++ desc->params.external.addr_low = cpu_to_le32(lower_32_bits(bi->pa));
++
++ /* set tail = the last cleaned desc index. */
++ wr32(hw, hw->aq.arq.tail, ntc);
++ /* ntc is updated to tail + 1 */
++ ntc++;
++ if (ntc == hw->aq.num_arq_entries)
++ ntc = 0;
++ hw->aq.arq.next_to_clean = ntc;
++ hw->aq.arq.next_to_use = ntu;
++
++clean_arq_element_out:
++ /* Set pending if needed, unlock and return */
++ if (pending != NULL)
++ *pending = (ntc > ntu ? hw->aq.arq.count : 0) + (ntu - ntc);
++
++clean_arq_element_err:
++ mutex_unlock(&hw->aq.arq_mutex);
++
++ return ret_code;
++}
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_adminq.h b/drivers/net/ethernet/intel/iavf/i40e_adminq.h
+new file mode 100644
+index 0000000000000..1f264b9b6805e
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_adminq.h
+@@ -0,0 +1,136 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40E_ADMINQ_H_
++#define _I40E_ADMINQ_H_
++
++#include "i40e_osdep.h"
++#include "i40e_status.h"
++#include "i40e_adminq_cmd.h"
++
++#define I40E_ADMINQ_DESC(R, i) \
++ (&(((struct i40e_aq_desc *)((R).desc_buf.va))[i]))
++
++#define I40E_ADMINQ_DESC_ALIGNMENT 4096
++
++struct i40e_adminq_ring {
++ struct i40e_virt_mem dma_head; /* space for dma structures */
++ struct i40e_dma_mem desc_buf; /* descriptor ring memory */
++ struct i40e_virt_mem cmd_buf; /* command buffer memory */
++
++ union {
++ struct i40e_dma_mem *asq_bi;
++ struct i40e_dma_mem *arq_bi;
++ } r;
++
++ u16 count; /* Number of descriptors */
++ u16 rx_buf_len; /* Admin Receive Queue buffer length */
++
++ /* used for interrupt processing */
++ u16 next_to_use;
++ u16 next_to_clean;
++
++ /* used for queue tracking */
++ u32 head;
++ u32 tail;
++ u32 len;
++ u32 bah;
++ u32 bal;
++};
++
++/* ASQ transaction details */
++struct i40e_asq_cmd_details {
++ void *callback; /* cast from type I40E_ADMINQ_CALLBACK */
++ u64 cookie;
++ u16 flags_ena;
++ u16 flags_dis;
++ bool async;
++ bool postpone;
++ struct i40e_aq_desc *wb_desc;
++};
++
++#define I40E_ADMINQ_DETAILS(R, i) \
++ (&(((struct i40e_asq_cmd_details *)((R).cmd_buf.va))[i]))
++
++/* ARQ event information */
++struct i40e_arq_event_info {
++ struct i40e_aq_desc desc;
++ u16 msg_len;
++ u16 buf_len;
++ u8 *msg_buf;
++};
++
++/* Admin Queue information */
++struct i40e_adminq_info {
++ struct i40e_adminq_ring arq; /* receive queue */
++ struct i40e_adminq_ring asq; /* send queue */
++ u32 asq_cmd_timeout; /* send queue cmd write back timeout*/
++ u16 num_arq_entries; /* receive queue depth */
++ u16 num_asq_entries; /* send queue depth */
++ u16 arq_buf_size; /* receive queue buffer size */
++ u16 asq_buf_size; /* send queue buffer size */
++ u16 fw_maj_ver; /* firmware major version */
++ u16 fw_min_ver; /* firmware minor version */
++ u32 fw_build; /* firmware build number */
++ u16 api_maj_ver; /* api major version */
++ u16 api_min_ver; /* api minor version */
++
++ struct mutex asq_mutex; /* Send queue lock */
++ struct mutex arq_mutex; /* Receive queue lock */
++
++ /* last status values on send and receive queues */
++ enum i40e_admin_queue_err asq_last_status;
++ enum i40e_admin_queue_err arq_last_status;
++};
++
++/**
++ * i40e_aq_rc_to_posix - convert errors to user-land codes
++ * aq_ret: AdminQ handler error code can override aq_rc
++ * aq_rc: AdminQ firmware error code to convert
++ **/
++static inline int i40e_aq_rc_to_posix(int aq_ret, int aq_rc)
++{
++ int aq_to_posix[] = {
++ 0, /* I40E_AQ_RC_OK */
++ -EPERM, /* I40E_AQ_RC_EPERM */
++ -ENOENT, /* I40E_AQ_RC_ENOENT */
++ -ESRCH, /* I40E_AQ_RC_ESRCH */
++ -EINTR, /* I40E_AQ_RC_EINTR */
++ -EIO, /* I40E_AQ_RC_EIO */
++ -ENXIO, /* I40E_AQ_RC_ENXIO */
++ -E2BIG, /* I40E_AQ_RC_E2BIG */
++ -EAGAIN, /* I40E_AQ_RC_EAGAIN */
++ -ENOMEM, /* I40E_AQ_RC_ENOMEM */
++ -EACCES, /* I40E_AQ_RC_EACCES */
++ -EFAULT, /* I40E_AQ_RC_EFAULT */
++ -EBUSY, /* I40E_AQ_RC_EBUSY */
++ -EEXIST, /* I40E_AQ_RC_EEXIST */
++ -EINVAL, /* I40E_AQ_RC_EINVAL */
++ -ENOTTY, /* I40E_AQ_RC_ENOTTY */
++ -ENOSPC, /* I40E_AQ_RC_ENOSPC */
++ -ENOSYS, /* I40E_AQ_RC_ENOSYS */
++ -ERANGE, /* I40E_AQ_RC_ERANGE */
++ -EPIPE, /* I40E_AQ_RC_EFLUSHED */
++ -ESPIPE, /* I40E_AQ_RC_BAD_ADDR */
++ -EROFS, /* I40E_AQ_RC_EMODE */
++ -EFBIG, /* I40E_AQ_RC_EFBIG */
++ };
++
++ /* aq_rc is invalid if AQ timed out */
++ if (aq_ret == I40E_ERR_ADMIN_QUEUE_TIMEOUT)
++ return -EAGAIN;
++
++ if (!((u32)aq_rc < (sizeof(aq_to_posix) / sizeof((aq_to_posix)[0]))))
++ return -ERANGE;
++
++ return aq_to_posix[aq_rc];
++}
++
++/* general information */
++#define I40E_AQ_LARGE_BUF 512
++#define I40E_ASQ_CMD_TIMEOUT 250000 /* usecs */
++
++void i40evf_fill_default_direct_cmd_desc(struct i40e_aq_desc *desc,
++ u16 opcode);
++
++#endif /* _I40E_ADMINQ_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_adminq_cmd.h b/drivers/net/ethernet/intel/iavf/i40e_adminq_cmd.h
+new file mode 100644
+index 0000000000000..493bdc5331f7b
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_adminq_cmd.h
+@@ -0,0 +1,528 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40E_ADMINQ_CMD_H_
++#define _I40E_ADMINQ_CMD_H_
++
++/* This header file defines the i40e Admin Queue commands and is shared between
++ * i40e Firmware and Software.
++ *
++ * This file needs to comply with the Linux Kernel coding style.
++ */
++
++#define I40E_FW_API_VERSION_MAJOR 0x0001
++#define I40E_FW_API_VERSION_MINOR_X722 0x0005
++#define I40E_FW_API_VERSION_MINOR_X710 0x0007
++
++#define I40E_FW_MINOR_VERSION(_h) ((_h)->mac.type == I40E_MAC_XL710 ? \
++ I40E_FW_API_VERSION_MINOR_X710 : \
++ I40E_FW_API_VERSION_MINOR_X722)
++
++/* API version 1.7 implements additional link and PHY-specific APIs */
++#define I40E_MINOR_VER_GET_LINK_INFO_XL710 0x0007
++
++struct i40e_aq_desc {
++ __le16 flags;
++ __le16 opcode;
++ __le16 datalen;
++ __le16 retval;
++ __le32 cookie_high;
++ __le32 cookie_low;
++ union {
++ struct {
++ __le32 param0;
++ __le32 param1;
++ __le32 param2;
++ __le32 param3;
++ } internal;
++ struct {
++ __le32 param0;
++ __le32 param1;
++ __le32 addr_high;
++ __le32 addr_low;
++ } external;
++ u8 raw[16];
++ } params;
++};
++
++/* Flags sub-structure
++ * |0 |1 |2 |3 |4 |5 |6 |7 |8 |9 |10 |11 |12 |13 |14 |15 |
++ * |DD |CMP|ERR|VFE| * * RESERVED * * |LB |RD |VFC|BUF|SI |EI |FE |
++ */
++
++/* command flags and offsets*/
++#define I40E_AQ_FLAG_DD_SHIFT 0
++#define I40E_AQ_FLAG_CMP_SHIFT 1
++#define I40E_AQ_FLAG_ERR_SHIFT 2
++#define I40E_AQ_FLAG_VFE_SHIFT 3
++#define I40E_AQ_FLAG_LB_SHIFT 9
++#define I40E_AQ_FLAG_RD_SHIFT 10
++#define I40E_AQ_FLAG_VFC_SHIFT 11
++#define I40E_AQ_FLAG_BUF_SHIFT 12
++#define I40E_AQ_FLAG_SI_SHIFT 13
++#define I40E_AQ_FLAG_EI_SHIFT 14
++#define I40E_AQ_FLAG_FE_SHIFT 15
++
++#define I40E_AQ_FLAG_DD BIT(I40E_AQ_FLAG_DD_SHIFT) /* 0x1 */
++#define I40E_AQ_FLAG_CMP BIT(I40E_AQ_FLAG_CMP_SHIFT) /* 0x2 */
++#define I40E_AQ_FLAG_ERR BIT(I40E_AQ_FLAG_ERR_SHIFT) /* 0x4 */
++#define I40E_AQ_FLAG_VFE BIT(I40E_AQ_FLAG_VFE_SHIFT) /* 0x8 */
++#define I40E_AQ_FLAG_LB BIT(I40E_AQ_FLAG_LB_SHIFT) /* 0x200 */
++#define I40E_AQ_FLAG_RD BIT(I40E_AQ_FLAG_RD_SHIFT) /* 0x400 */
++#define I40E_AQ_FLAG_VFC BIT(I40E_AQ_FLAG_VFC_SHIFT) /* 0x800 */
++#define I40E_AQ_FLAG_BUF BIT(I40E_AQ_FLAG_BUF_SHIFT) /* 0x1000 */
++#define I40E_AQ_FLAG_SI BIT(I40E_AQ_FLAG_SI_SHIFT) /* 0x2000 */
++#define I40E_AQ_FLAG_EI BIT(I40E_AQ_FLAG_EI_SHIFT) /* 0x4000 */
++#define I40E_AQ_FLAG_FE BIT(I40E_AQ_FLAG_FE_SHIFT) /* 0x8000 */
++
++/* error codes */
++enum i40e_admin_queue_err {
++ I40E_AQ_RC_OK = 0, /* success */
++ I40E_AQ_RC_EPERM = 1, /* Operation not permitted */
++ I40E_AQ_RC_ENOENT = 2, /* No such element */
++ I40E_AQ_RC_ESRCH = 3, /* Bad opcode */
++ I40E_AQ_RC_EINTR = 4, /* operation interrupted */
++ I40E_AQ_RC_EIO = 5, /* I/O error */
++ I40E_AQ_RC_ENXIO = 6, /* No such resource */
++ I40E_AQ_RC_E2BIG = 7, /* Arg too long */
++ I40E_AQ_RC_EAGAIN = 8, /* Try again */
++ I40E_AQ_RC_ENOMEM = 9, /* Out of memory */
++ I40E_AQ_RC_EACCES = 10, /* Permission denied */
++ I40E_AQ_RC_EFAULT = 11, /* Bad address */
++ I40E_AQ_RC_EBUSY = 12, /* Device or resource busy */
++ I40E_AQ_RC_EEXIST = 13, /* object already exists */
++ I40E_AQ_RC_EINVAL = 14, /* Invalid argument */
++ I40E_AQ_RC_ENOTTY = 15, /* Not a typewriter */
++ I40E_AQ_RC_ENOSPC = 16, /* No space left or alloc failure */
++ I40E_AQ_RC_ENOSYS = 17, /* Function not implemented */
++ I40E_AQ_RC_ERANGE = 18, /* Parameter out of range */
++ I40E_AQ_RC_EFLUSHED = 19, /* Cmd flushed due to prev cmd error */
++ I40E_AQ_RC_BAD_ADDR = 20, /* Descriptor contains a bad pointer */
++ I40E_AQ_RC_EMODE = 21, /* Op not allowed in current dev mode */
++ I40E_AQ_RC_EFBIG = 22, /* File too large */
++};
++
++/* Admin Queue command opcodes */
++enum i40e_admin_queue_opc {
++ /* aq commands */
++ i40e_aqc_opc_get_version = 0x0001,
++ i40e_aqc_opc_driver_version = 0x0002,
++ i40e_aqc_opc_queue_shutdown = 0x0003,
++ i40e_aqc_opc_set_pf_context = 0x0004,
++
++ /* resource ownership */
++ i40e_aqc_opc_request_resource = 0x0008,
++ i40e_aqc_opc_release_resource = 0x0009,
++
++ i40e_aqc_opc_list_func_capabilities = 0x000A,
++ i40e_aqc_opc_list_dev_capabilities = 0x000B,
++
++ /* Proxy commands */
++ i40e_aqc_opc_set_proxy_config = 0x0104,
++ i40e_aqc_opc_set_ns_proxy_table_entry = 0x0105,
++
++ /* LAA */
++ i40e_aqc_opc_mac_address_read = 0x0107,
++ i40e_aqc_opc_mac_address_write = 0x0108,
++
++ /* PXE */
++ i40e_aqc_opc_clear_pxe_mode = 0x0110,
++
++ /* WoL commands */
++ i40e_aqc_opc_set_wol_filter = 0x0120,
++ i40e_aqc_opc_get_wake_reason = 0x0121,
++
++ /* internal switch commands */
++ i40e_aqc_opc_get_switch_config = 0x0200,
++ i40e_aqc_opc_add_statistics = 0x0201,
++ i40e_aqc_opc_remove_statistics = 0x0202,
++ i40e_aqc_opc_set_port_parameters = 0x0203,
++ i40e_aqc_opc_get_switch_resource_alloc = 0x0204,
++ i40e_aqc_opc_set_switch_config = 0x0205,
++ i40e_aqc_opc_rx_ctl_reg_read = 0x0206,
++ i40e_aqc_opc_rx_ctl_reg_write = 0x0207,
++
++ i40e_aqc_opc_add_vsi = 0x0210,
++ i40e_aqc_opc_update_vsi_parameters = 0x0211,
++ i40e_aqc_opc_get_vsi_parameters = 0x0212,
++
++ i40e_aqc_opc_add_pv = 0x0220,
++ i40e_aqc_opc_update_pv_parameters = 0x0221,
++ i40e_aqc_opc_get_pv_parameters = 0x0222,
++
++ i40e_aqc_opc_add_veb = 0x0230,
++ i40e_aqc_opc_update_veb_parameters = 0x0231,
++ i40e_aqc_opc_get_veb_parameters = 0x0232,
++
++ i40e_aqc_opc_delete_element = 0x0243,
++
++ i40e_aqc_opc_add_macvlan = 0x0250,
++ i40e_aqc_opc_remove_macvlan = 0x0251,
++ i40e_aqc_opc_add_vlan = 0x0252,
++ i40e_aqc_opc_remove_vlan = 0x0253,
++ i40e_aqc_opc_set_vsi_promiscuous_modes = 0x0254,
++ i40e_aqc_opc_add_tag = 0x0255,
++ i40e_aqc_opc_remove_tag = 0x0256,
++ i40e_aqc_opc_add_multicast_etag = 0x0257,
++ i40e_aqc_opc_remove_multicast_etag = 0x0258,
++ i40e_aqc_opc_update_tag = 0x0259,
++ i40e_aqc_opc_add_control_packet_filter = 0x025A,
++ i40e_aqc_opc_remove_control_packet_filter = 0x025B,
++ i40e_aqc_opc_add_cloud_filters = 0x025C,
++ i40e_aqc_opc_remove_cloud_filters = 0x025D,
++ i40e_aqc_opc_clear_wol_switch_filters = 0x025E,
++
++ i40e_aqc_opc_add_mirror_rule = 0x0260,
++ i40e_aqc_opc_delete_mirror_rule = 0x0261,
++
++ /* Dynamic Device Personalization */
++ i40e_aqc_opc_write_personalization_profile = 0x0270,
++ i40e_aqc_opc_get_personalization_profile_list = 0x0271,
++
++ /* DCB commands */
++ i40e_aqc_opc_dcb_ignore_pfc = 0x0301,
++ i40e_aqc_opc_dcb_updated = 0x0302,
++ i40e_aqc_opc_set_dcb_parameters = 0x0303,
++
++ /* TX scheduler */
++ i40e_aqc_opc_configure_vsi_bw_limit = 0x0400,
++ i40e_aqc_opc_configure_vsi_ets_sla_bw_limit = 0x0406,
++ i40e_aqc_opc_configure_vsi_tc_bw = 0x0407,
++ i40e_aqc_opc_query_vsi_bw_config = 0x0408,
++ i40e_aqc_opc_query_vsi_ets_sla_config = 0x040A,
++ i40e_aqc_opc_configure_switching_comp_bw_limit = 0x0410,
++
++ i40e_aqc_opc_enable_switching_comp_ets = 0x0413,
++ i40e_aqc_opc_modify_switching_comp_ets = 0x0414,
++ i40e_aqc_opc_disable_switching_comp_ets = 0x0415,
++ i40e_aqc_opc_configure_switching_comp_ets_bw_limit = 0x0416,
++ i40e_aqc_opc_configure_switching_comp_bw_config = 0x0417,
++ i40e_aqc_opc_query_switching_comp_ets_config = 0x0418,
++ i40e_aqc_opc_query_port_ets_config = 0x0419,
++ i40e_aqc_opc_query_switching_comp_bw_config = 0x041A,
++ i40e_aqc_opc_suspend_port_tx = 0x041B,
++ i40e_aqc_opc_resume_port_tx = 0x041C,
++ i40e_aqc_opc_configure_partition_bw = 0x041D,
++ /* hmc */
++ i40e_aqc_opc_query_hmc_resource_profile = 0x0500,
++ i40e_aqc_opc_set_hmc_resource_profile = 0x0501,
++
++ /* phy commands*/
++ i40e_aqc_opc_get_phy_abilities = 0x0600,
++ i40e_aqc_opc_set_phy_config = 0x0601,
++ i40e_aqc_opc_set_mac_config = 0x0603,
++ i40e_aqc_opc_set_link_restart_an = 0x0605,
++ i40e_aqc_opc_get_link_status = 0x0607,
++ i40e_aqc_opc_set_phy_int_mask = 0x0613,
++ i40e_aqc_opc_get_local_advt_reg = 0x0614,
++ i40e_aqc_opc_set_local_advt_reg = 0x0615,
++ i40e_aqc_opc_get_partner_advt = 0x0616,
++ i40e_aqc_opc_set_lb_modes = 0x0618,
++ i40e_aqc_opc_get_phy_wol_caps = 0x0621,
++ i40e_aqc_opc_set_phy_debug = 0x0622,
++ i40e_aqc_opc_upload_ext_phy_fm = 0x0625,
++ i40e_aqc_opc_run_phy_activity = 0x0626,
++ i40e_aqc_opc_set_phy_register = 0x0628,
++ i40e_aqc_opc_get_phy_register = 0x0629,
++
++ /* NVM commands */
++ i40e_aqc_opc_nvm_read = 0x0701,
++ i40e_aqc_opc_nvm_erase = 0x0702,
++ i40e_aqc_opc_nvm_update = 0x0703,
++ i40e_aqc_opc_nvm_config_read = 0x0704,
++ i40e_aqc_opc_nvm_config_write = 0x0705,
++ i40e_aqc_opc_oem_post_update = 0x0720,
++ i40e_aqc_opc_thermal_sensor = 0x0721,
++
++ /* virtualization commands */
++ i40e_aqc_opc_send_msg_to_pf = 0x0801,
++ i40e_aqc_opc_send_msg_to_vf = 0x0802,
++ i40e_aqc_opc_send_msg_to_peer = 0x0803,
++
++ /* alternate structure */
++ i40e_aqc_opc_alternate_write = 0x0900,
++ i40e_aqc_opc_alternate_write_indirect = 0x0901,
++ i40e_aqc_opc_alternate_read = 0x0902,
++ i40e_aqc_opc_alternate_read_indirect = 0x0903,
++ i40e_aqc_opc_alternate_write_done = 0x0904,
++ i40e_aqc_opc_alternate_set_mode = 0x0905,
++ i40e_aqc_opc_alternate_clear_port = 0x0906,
++
++ /* LLDP commands */
++ i40e_aqc_opc_lldp_get_mib = 0x0A00,
++ i40e_aqc_opc_lldp_update_mib = 0x0A01,
++ i40e_aqc_opc_lldp_add_tlv = 0x0A02,
++ i40e_aqc_opc_lldp_update_tlv = 0x0A03,
++ i40e_aqc_opc_lldp_delete_tlv = 0x0A04,
++ i40e_aqc_opc_lldp_stop = 0x0A05,
++ i40e_aqc_opc_lldp_start = 0x0A06,
++
++ /* Tunnel commands */
++ i40e_aqc_opc_add_udp_tunnel = 0x0B00,
++ i40e_aqc_opc_del_udp_tunnel = 0x0B01,
++ i40e_aqc_opc_set_rss_key = 0x0B02,
++ i40e_aqc_opc_set_rss_lut = 0x0B03,
++ i40e_aqc_opc_get_rss_key = 0x0B04,
++ i40e_aqc_opc_get_rss_lut = 0x0B05,
++
++ /* Async Events */
++ i40e_aqc_opc_event_lan_overflow = 0x1001,
++
++ /* OEM commands */
++ i40e_aqc_opc_oem_parameter_change = 0xFE00,
++ i40e_aqc_opc_oem_device_status_change = 0xFE01,
++ i40e_aqc_opc_oem_ocsd_initialize = 0xFE02,
++ i40e_aqc_opc_oem_ocbb_initialize = 0xFE03,
++
++ /* debug commands */
++ i40e_aqc_opc_debug_read_reg = 0xFF03,
++ i40e_aqc_opc_debug_write_reg = 0xFF04,
++ i40e_aqc_opc_debug_modify_reg = 0xFF07,
++ i40e_aqc_opc_debug_dump_internals = 0xFF08,
++};
++
++/* command structures and indirect data structures */
++
++/* Structure naming conventions:
++ * - no suffix for direct command descriptor structures
++ * - _data for indirect sent data
++ * - _resp for indirect return data (data which is both will use _data)
++ * - _completion for direct return data
++ * - _element_ for repeated elements (may also be _data or _resp)
++ *
++ * Command structures are expected to overlay the params.raw member of the basic
++ * descriptor, and as such cannot exceed 16 bytes in length.
++ */
++
++/* This macro is used to generate a compilation error if a structure
++ * is not exactly the correct length. It gives a divide by zero error if the
++ * structure is not of the correct size, otherwise it creates an enum that is
++ * never used.
++ */
++#define I40E_CHECK_STRUCT_LEN(n, X) enum i40e_static_assert_enum_##X \
++ { i40e_static_assert_##X = (n)/((sizeof(struct X) == (n)) ? 1 : 0) }
++
++/* This macro is used extensively to ensure that command structures are 16
++ * bytes in length as they have to map to the raw array of that size.
++ */
++#define I40E_CHECK_CMD_LENGTH(X) I40E_CHECK_STRUCT_LEN(16, X)
++
++/* Queue Shutdown (direct 0x0003) */
++struct i40e_aqc_queue_shutdown {
++ __le32 driver_unloading;
++#define I40E_AQ_DRIVER_UNLOADING 0x1
++ u8 reserved[12];
++};
++
++I40E_CHECK_CMD_LENGTH(i40e_aqc_queue_shutdown);
++
++struct i40e_aqc_vsi_properties_data {
++ /* first 96 byte are written by SW */
++ __le16 valid_sections;
++#define I40E_AQ_VSI_PROP_SWITCH_VALID 0x0001
++#define I40E_AQ_VSI_PROP_SECURITY_VALID 0x0002
++#define I40E_AQ_VSI_PROP_VLAN_VALID 0x0004
++#define I40E_AQ_VSI_PROP_CAS_PV_VALID 0x0008
++#define I40E_AQ_VSI_PROP_INGRESS_UP_VALID 0x0010
++#define I40E_AQ_VSI_PROP_EGRESS_UP_VALID 0x0020
++#define I40E_AQ_VSI_PROP_QUEUE_MAP_VALID 0x0040
++#define I40E_AQ_VSI_PROP_QUEUE_OPT_VALID 0x0080
++#define I40E_AQ_VSI_PROP_OUTER_UP_VALID 0x0100
++#define I40E_AQ_VSI_PROP_SCHED_VALID 0x0200
++ /* switch section */
++ __le16 switch_id; /* 12bit id combined with flags below */
++#define I40E_AQ_VSI_SW_ID_SHIFT 0x0000
++#define I40E_AQ_VSI_SW_ID_MASK (0xFFF << I40E_AQ_VSI_SW_ID_SHIFT)
++#define I40E_AQ_VSI_SW_ID_FLAG_NOT_STAG 0x1000
++#define I40E_AQ_VSI_SW_ID_FLAG_ALLOW_LB 0x2000
++#define I40E_AQ_VSI_SW_ID_FLAG_LOCAL_LB 0x4000
++ u8 sw_reserved[2];
++ /* security section */
++ u8 sec_flags;
++#define I40E_AQ_VSI_SEC_FLAG_ALLOW_DEST_OVRD 0x01
++#define I40E_AQ_VSI_SEC_FLAG_ENABLE_VLAN_CHK 0x02
++#define I40E_AQ_VSI_SEC_FLAG_ENABLE_MAC_CHK 0x04
++ u8 sec_reserved;
++ /* VLAN section */
++ __le16 pvid; /* VLANS include priority bits */
++ __le16 fcoe_pvid;
++ u8 port_vlan_flags;
++#define I40E_AQ_VSI_PVLAN_MODE_SHIFT 0x00
++#define I40E_AQ_VSI_PVLAN_MODE_MASK (0x03 << \
++ I40E_AQ_VSI_PVLAN_MODE_SHIFT)
++#define I40E_AQ_VSI_PVLAN_MODE_TAGGED 0x01
++#define I40E_AQ_VSI_PVLAN_MODE_UNTAGGED 0x02
++#define I40E_AQ_VSI_PVLAN_MODE_ALL 0x03
++#define I40E_AQ_VSI_PVLAN_INSERT_PVID 0x04
++#define I40E_AQ_VSI_PVLAN_EMOD_SHIFT 0x03
++#define I40E_AQ_VSI_PVLAN_EMOD_MASK (0x3 << \
++ I40E_AQ_VSI_PVLAN_EMOD_SHIFT)
++#define I40E_AQ_VSI_PVLAN_EMOD_STR_BOTH 0x0
++#define I40E_AQ_VSI_PVLAN_EMOD_STR_UP 0x08
++#define I40E_AQ_VSI_PVLAN_EMOD_STR 0x10
++#define I40E_AQ_VSI_PVLAN_EMOD_NOTHING 0x18
++ u8 pvlan_reserved[3];
++ /* ingress egress up sections */
++ __le32 ingress_table; /* bitmap, 3 bits per up */
++#define I40E_AQ_VSI_UP_TABLE_UP0_SHIFT 0
++#define I40E_AQ_VSI_UP_TABLE_UP0_MASK (0x7 << \
++ I40E_AQ_VSI_UP_TABLE_UP0_SHIFT)
++#define I40E_AQ_VSI_UP_TABLE_UP1_SHIFT 3
++#define I40E_AQ_VSI_UP_TABLE_UP1_MASK (0x7 << \
++ I40E_AQ_VSI_UP_TABLE_UP1_SHIFT)
++#define I40E_AQ_VSI_UP_TABLE_UP2_SHIFT 6
++#define I40E_AQ_VSI_UP_TABLE_UP2_MASK (0x7 << \
++ I40E_AQ_VSI_UP_TABLE_UP2_SHIFT)
++#define I40E_AQ_VSI_UP_TABLE_UP3_SHIFT 9
++#define I40E_AQ_VSI_UP_TABLE_UP3_MASK (0x7 << \
++ I40E_AQ_VSI_UP_TABLE_UP3_SHIFT)
++#define I40E_AQ_VSI_UP_TABLE_UP4_SHIFT 12
++#define I40E_AQ_VSI_UP_TABLE_UP4_MASK (0x7 << \
++ I40E_AQ_VSI_UP_TABLE_UP4_SHIFT)
++#define I40E_AQ_VSI_UP_TABLE_UP5_SHIFT 15
++#define I40E_AQ_VSI_UP_TABLE_UP5_MASK (0x7 << \
++ I40E_AQ_VSI_UP_TABLE_UP5_SHIFT)
++#define I40E_AQ_VSI_UP_TABLE_UP6_SHIFT 18
++#define I40E_AQ_VSI_UP_TABLE_UP6_MASK (0x7 << \
++ I40E_AQ_VSI_UP_TABLE_UP6_SHIFT)
++#define I40E_AQ_VSI_UP_TABLE_UP7_SHIFT 21
++#define I40E_AQ_VSI_UP_TABLE_UP7_MASK (0x7 << \
++ I40E_AQ_VSI_UP_TABLE_UP7_SHIFT)
++ __le32 egress_table; /* same defines as for ingress table */
++ /* cascaded PV section */
++ __le16 cas_pv_tag;
++ u8 cas_pv_flags;
++#define I40E_AQ_VSI_CAS_PV_TAGX_SHIFT 0x00
++#define I40E_AQ_VSI_CAS_PV_TAGX_MASK (0x03 << \
++ I40E_AQ_VSI_CAS_PV_TAGX_SHIFT)
++#define I40E_AQ_VSI_CAS_PV_TAGX_LEAVE 0x00
++#define I40E_AQ_VSI_CAS_PV_TAGX_REMOVE 0x01
++#define I40E_AQ_VSI_CAS_PV_TAGX_COPY 0x02
++#define I40E_AQ_VSI_CAS_PV_INSERT_TAG 0x10
++#define I40E_AQ_VSI_CAS_PV_ETAG_PRUNE 0x20
++#define I40E_AQ_VSI_CAS_PV_ACCEPT_HOST_TAG 0x40
++ u8 cas_pv_reserved;
++ /* queue mapping section */
++ __le16 mapping_flags;
++#define I40E_AQ_VSI_QUE_MAP_CONTIG 0x0
++#define I40E_AQ_VSI_QUE_MAP_NONCONTIG 0x1
++ __le16 queue_mapping[16];
++#define I40E_AQ_VSI_QUEUE_SHIFT 0x0
++#define I40E_AQ_VSI_QUEUE_MASK (0x7FF << I40E_AQ_VSI_QUEUE_SHIFT)
++ __le16 tc_mapping[8];
++#define I40E_AQ_VSI_TC_QUE_OFFSET_SHIFT 0
++#define I40E_AQ_VSI_TC_QUE_OFFSET_MASK (0x1FF << \
++ I40E_AQ_VSI_TC_QUE_OFFSET_SHIFT)
++#define I40E_AQ_VSI_TC_QUE_NUMBER_SHIFT 9
++#define I40E_AQ_VSI_TC_QUE_NUMBER_MASK (0x7 << \
++ I40E_AQ_VSI_TC_QUE_NUMBER_SHIFT)
++ /* queueing option section */
++ u8 queueing_opt_flags;
++#define I40E_AQ_VSI_QUE_OPT_MULTICAST_UDP_ENA 0x04
++#define I40E_AQ_VSI_QUE_OPT_UNICAST_UDP_ENA 0x08
++#define I40E_AQ_VSI_QUE_OPT_TCP_ENA 0x10
++#define I40E_AQ_VSI_QUE_OPT_FCOE_ENA 0x20
++#define I40E_AQ_VSI_QUE_OPT_RSS_LUT_PF 0x00
++#define I40E_AQ_VSI_QUE_OPT_RSS_LUT_VSI 0x40
++ u8 queueing_opt_reserved[3];
++ /* scheduler section */
++ u8 up_enable_bits;
++ u8 sched_reserved;
++ /* outer up section */
++ __le32 outer_up_table; /* same structure and defines as ingress tbl */
++ u8 cmd_reserved[8];
++ /* last 32 bytes are written by FW */
++ __le16 qs_handle[8];
++#define I40E_AQ_VSI_QS_HANDLE_INVALID 0xFFFF
++ __le16 stat_counter_idx;
++ __le16 sched_id;
++ u8 resp_reserved[12];
++};
++
++I40E_CHECK_STRUCT_LEN(128, i40e_aqc_vsi_properties_data);
++
++/* Get VEB Parameters (direct 0x0232)
++ * uses i40e_aqc_switch_seid for the descriptor
++ */
++struct i40e_aqc_get_veb_parameters_completion {
++ __le16 seid;
++ __le16 switch_id;
++ __le16 veb_flags; /* only the first/last flags from 0x0230 is valid */
++ __le16 statistic_index;
++ __le16 vebs_used;
++ __le16 vebs_free;
++ u8 reserved[4];
++};
++
++I40E_CHECK_CMD_LENGTH(i40e_aqc_get_veb_parameters_completion);
++
++#define I40E_LINK_SPEED_100MB_SHIFT 0x1
++#define I40E_LINK_SPEED_1000MB_SHIFT 0x2
++#define I40E_LINK_SPEED_10GB_SHIFT 0x3
++#define I40E_LINK_SPEED_40GB_SHIFT 0x4
++#define I40E_LINK_SPEED_20GB_SHIFT 0x5
++#define I40E_LINK_SPEED_25GB_SHIFT 0x6
++
++enum i40e_aq_link_speed {
++ I40E_LINK_SPEED_UNKNOWN = 0,
++ I40E_LINK_SPEED_100MB = BIT(I40E_LINK_SPEED_100MB_SHIFT),
++ I40E_LINK_SPEED_1GB = BIT(I40E_LINK_SPEED_1000MB_SHIFT),
++ I40E_LINK_SPEED_10GB = BIT(I40E_LINK_SPEED_10GB_SHIFT),
++ I40E_LINK_SPEED_40GB = BIT(I40E_LINK_SPEED_40GB_SHIFT),
++ I40E_LINK_SPEED_20GB = BIT(I40E_LINK_SPEED_20GB_SHIFT),
++ I40E_LINK_SPEED_25GB = BIT(I40E_LINK_SPEED_25GB_SHIFT),
++};
++
++/* Send to PF command (indirect 0x0801) id is only used by PF
++ * Send to VF command (indirect 0x0802) id is only used by PF
++ * Send to Peer PF command (indirect 0x0803)
++ */
++struct i40e_aqc_pf_vf_message {
++ __le32 id;
++ u8 reserved[4];
++ __le32 addr_high;
++ __le32 addr_low;
++};
++
++I40E_CHECK_CMD_LENGTH(i40e_aqc_pf_vf_message);
++
++struct i40e_aqc_get_set_rss_key {
++#define I40E_AQC_SET_RSS_KEY_VSI_VALID BIT(15)
++#define I40E_AQC_SET_RSS_KEY_VSI_ID_SHIFT 0
++#define I40E_AQC_SET_RSS_KEY_VSI_ID_MASK (0x3FF << \
++ I40E_AQC_SET_RSS_KEY_VSI_ID_SHIFT)
++ __le16 vsi_id;
++ u8 reserved[6];
++ __le32 addr_high;
++ __le32 addr_low;
++};
++
++I40E_CHECK_CMD_LENGTH(i40e_aqc_get_set_rss_key);
++
++struct i40e_aqc_get_set_rss_key_data {
++ u8 standard_rss_key[0x28];
++ u8 extended_hash_key[0xc];
++};
++
++I40E_CHECK_STRUCT_LEN(0x34, i40e_aqc_get_set_rss_key_data);
++
++struct i40e_aqc_get_set_rss_lut {
++#define I40E_AQC_SET_RSS_LUT_VSI_VALID BIT(15)
++#define I40E_AQC_SET_RSS_LUT_VSI_ID_SHIFT 0
++#define I40E_AQC_SET_RSS_LUT_VSI_ID_MASK (0x3FF << \
++ I40E_AQC_SET_RSS_LUT_VSI_ID_SHIFT)
++ __le16 vsi_id;
++#define I40E_AQC_SET_RSS_LUT_TABLE_TYPE_SHIFT 0
++#define I40E_AQC_SET_RSS_LUT_TABLE_TYPE_MASK \
++ BIT(I40E_AQC_SET_RSS_LUT_TABLE_TYPE_SHIFT)
++
++#define I40E_AQC_SET_RSS_LUT_TABLE_TYPE_VSI 0
++#define I40E_AQC_SET_RSS_LUT_TABLE_TYPE_PF 1
++ __le16 flags;
++ u8 reserved[4];
++ __le32 addr_high;
++ __le32 addr_low;
++};
++
++I40E_CHECK_CMD_LENGTH(i40e_aqc_get_set_rss_lut);
++#endif /* _I40E_ADMINQ_CMD_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_alloc.h b/drivers/net/ethernet/intel/iavf/i40e_alloc.h
+new file mode 100644
+index 0000000000000..cb8689222c8b7
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_alloc.h
+@@ -0,0 +1,35 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40E_ALLOC_H_
++#define _I40E_ALLOC_H_
++
++struct i40e_hw;
++
++/* Memory allocation types */
++enum i40e_memory_type {
++ i40e_mem_arq_buf = 0, /* ARQ indirect command buffer */
++ i40e_mem_asq_buf = 1,
++ i40e_mem_atq_buf = 2, /* ATQ indirect command buffer */
++ i40e_mem_arq_ring = 3, /* ARQ descriptor ring */
++ i40e_mem_atq_ring = 4, /* ATQ descriptor ring */
++ i40e_mem_pd = 5, /* Page Descriptor */
++ i40e_mem_bp = 6, /* Backing Page - 4KB */
++ i40e_mem_bp_jumbo = 7, /* Backing Page - > 4KB */
++ i40e_mem_reserved
++};
++
++/* prototype for functions used for dynamic memory allocation */
++i40e_status i40e_allocate_dma_mem(struct i40e_hw *hw,
++ struct i40e_dma_mem *mem,
++ enum i40e_memory_type type,
++ u64 size, u32 alignment);
++i40e_status i40e_free_dma_mem(struct i40e_hw *hw,
++ struct i40e_dma_mem *mem);
++i40e_status i40e_allocate_virt_mem(struct i40e_hw *hw,
++ struct i40e_virt_mem *mem,
++ u32 size);
++i40e_status i40e_free_virt_mem(struct i40e_hw *hw,
++ struct i40e_virt_mem *mem);
++
++#endif /* _I40E_ALLOC_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_common.c b/drivers/net/ethernet/intel/iavf/i40e_common.c
+new file mode 100644
+index 0000000000000..f34091d96f490
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_common.c
+@@ -0,0 +1,982 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#include "i40e_type.h"
++#include "i40e_adminq.h"
++#include "i40e_prototype.h"
++#include <linux/avf/virtchnl.h>
++
++/**
++ * i40e_set_mac_type - Sets MAC type
++ * @hw: pointer to the HW structure
++ *
++ * This function sets the mac type of the adapter based on the
++ * vendor ID and device ID stored in the hw structure.
++ **/
++i40e_status i40e_set_mac_type(struct i40e_hw *hw)
++{
++ i40e_status status = 0;
++
++ if (hw->vendor_id == PCI_VENDOR_ID_INTEL) {
++ switch (hw->device_id) {
++ case I40E_DEV_ID_SFP_XL710:
++ case I40E_DEV_ID_QEMU:
++ case I40E_DEV_ID_KX_B:
++ case I40E_DEV_ID_KX_C:
++ case I40E_DEV_ID_QSFP_A:
++ case I40E_DEV_ID_QSFP_B:
++ case I40E_DEV_ID_QSFP_C:
++ case I40E_DEV_ID_10G_BASE_T:
++ case I40E_DEV_ID_10G_BASE_T4:
++ case I40E_DEV_ID_20G_KR2:
++ case I40E_DEV_ID_20G_KR2_A:
++ case I40E_DEV_ID_25G_B:
++ case I40E_DEV_ID_25G_SFP28:
++ hw->mac.type = I40E_MAC_XL710;
++ break;
++ case I40E_DEV_ID_SFP_X722:
++ case I40E_DEV_ID_1G_BASE_T_X722:
++ case I40E_DEV_ID_10G_BASE_T_X722:
++ case I40E_DEV_ID_SFP_I_X722:
++ hw->mac.type = I40E_MAC_X722;
++ break;
++ case I40E_DEV_ID_X722_VF:
++ hw->mac.type = I40E_MAC_X722_VF;
++ break;
++ case I40E_DEV_ID_VF:
++ case I40E_DEV_ID_VF_HV:
++ case I40E_DEV_ID_ADAPTIVE_VF:
++ hw->mac.type = I40E_MAC_VF;
++ break;
++ default:
++ hw->mac.type = I40E_MAC_GENERIC;
++ break;
++ }
++ } else {
++ status = I40E_ERR_DEVICE_NOT_SUPPORTED;
++ }
++
++ hw_dbg(hw, "i40e_set_mac_type found mac: %d, returns: %d\n",
++ hw->mac.type, status);
++ return status;
++}
++
++/**
++ * i40evf_aq_str - convert AQ err code to a string
++ * @hw: pointer to the HW structure
++ * @aq_err: the AQ error code to convert
++ **/
++const char *i40evf_aq_str(struct i40e_hw *hw, enum i40e_admin_queue_err aq_err)
++{
++ switch (aq_err) {
++ case I40E_AQ_RC_OK:
++ return "OK";
++ case I40E_AQ_RC_EPERM:
++ return "I40E_AQ_RC_EPERM";
++ case I40E_AQ_RC_ENOENT:
++ return "I40E_AQ_RC_ENOENT";
++ case I40E_AQ_RC_ESRCH:
++ return "I40E_AQ_RC_ESRCH";
++ case I40E_AQ_RC_EINTR:
++ return "I40E_AQ_RC_EINTR";
++ case I40E_AQ_RC_EIO:
++ return "I40E_AQ_RC_EIO";
++ case I40E_AQ_RC_ENXIO:
++ return "I40E_AQ_RC_ENXIO";
++ case I40E_AQ_RC_E2BIG:
++ return "I40E_AQ_RC_E2BIG";
++ case I40E_AQ_RC_EAGAIN:
++ return "I40E_AQ_RC_EAGAIN";
++ case I40E_AQ_RC_ENOMEM:
++ return "I40E_AQ_RC_ENOMEM";
++ case I40E_AQ_RC_EACCES:
++ return "I40E_AQ_RC_EACCES";
++ case I40E_AQ_RC_EFAULT:
++ return "I40E_AQ_RC_EFAULT";
++ case I40E_AQ_RC_EBUSY:
++ return "I40E_AQ_RC_EBUSY";
++ case I40E_AQ_RC_EEXIST:
++ return "I40E_AQ_RC_EEXIST";
++ case I40E_AQ_RC_EINVAL:
++ return "I40E_AQ_RC_EINVAL";
++ case I40E_AQ_RC_ENOTTY:
++ return "I40E_AQ_RC_ENOTTY";
++ case I40E_AQ_RC_ENOSPC:
++ return "I40E_AQ_RC_ENOSPC";
++ case I40E_AQ_RC_ENOSYS:
++ return "I40E_AQ_RC_ENOSYS";
++ case I40E_AQ_RC_ERANGE:
++ return "I40E_AQ_RC_ERANGE";
++ case I40E_AQ_RC_EFLUSHED:
++ return "I40E_AQ_RC_EFLUSHED";
++ case I40E_AQ_RC_BAD_ADDR:
++ return "I40E_AQ_RC_BAD_ADDR";
++ case I40E_AQ_RC_EMODE:
++ return "I40E_AQ_RC_EMODE";
++ case I40E_AQ_RC_EFBIG:
++ return "I40E_AQ_RC_EFBIG";
++ }
++
++ snprintf(hw->err_str, sizeof(hw->err_str), "%d", aq_err);
++ return hw->err_str;
++}
++
++/**
++ * i40evf_stat_str - convert status err code to a string
++ * @hw: pointer to the HW structure
++ * @stat_err: the status error code to convert
++ **/
++const char *i40evf_stat_str(struct i40e_hw *hw, i40e_status stat_err)
++{
++ switch (stat_err) {
++ case 0:
++ return "OK";
++ case I40E_ERR_NVM:
++ return "I40E_ERR_NVM";
++ case I40E_ERR_NVM_CHECKSUM:
++ return "I40E_ERR_NVM_CHECKSUM";
++ case I40E_ERR_PHY:
++ return "I40E_ERR_PHY";
++ case I40E_ERR_CONFIG:
++ return "I40E_ERR_CONFIG";
++ case I40E_ERR_PARAM:
++ return "I40E_ERR_PARAM";
++ case I40E_ERR_MAC_TYPE:
++ return "I40E_ERR_MAC_TYPE";
++ case I40E_ERR_UNKNOWN_PHY:
++ return "I40E_ERR_UNKNOWN_PHY";
++ case I40E_ERR_LINK_SETUP:
++ return "I40E_ERR_LINK_SETUP";
++ case I40E_ERR_ADAPTER_STOPPED:
++ return "I40E_ERR_ADAPTER_STOPPED";
++ case I40E_ERR_INVALID_MAC_ADDR:
++ return "I40E_ERR_INVALID_MAC_ADDR";
++ case I40E_ERR_DEVICE_NOT_SUPPORTED:
++ return "I40E_ERR_DEVICE_NOT_SUPPORTED";
++ case I40E_ERR_MASTER_REQUESTS_PENDING:
++ return "I40E_ERR_MASTER_REQUESTS_PENDING";
++ case I40E_ERR_INVALID_LINK_SETTINGS:
++ return "I40E_ERR_INVALID_LINK_SETTINGS";
++ case I40E_ERR_AUTONEG_NOT_COMPLETE:
++ return "I40E_ERR_AUTONEG_NOT_COMPLETE";
++ case I40E_ERR_RESET_FAILED:
++ return "I40E_ERR_RESET_FAILED";
++ case I40E_ERR_SWFW_SYNC:
++ return "I40E_ERR_SWFW_SYNC";
++ case I40E_ERR_NO_AVAILABLE_VSI:
++ return "I40E_ERR_NO_AVAILABLE_VSI";
++ case I40E_ERR_NO_MEMORY:
++ return "I40E_ERR_NO_MEMORY";
++ case I40E_ERR_BAD_PTR:
++ return "I40E_ERR_BAD_PTR";
++ case I40E_ERR_RING_FULL:
++ return "I40E_ERR_RING_FULL";
++ case I40E_ERR_INVALID_PD_ID:
++ return "I40E_ERR_INVALID_PD_ID";
++ case I40E_ERR_INVALID_QP_ID:
++ return "I40E_ERR_INVALID_QP_ID";
++ case I40E_ERR_INVALID_CQ_ID:
++ return "I40E_ERR_INVALID_CQ_ID";
++ case I40E_ERR_INVALID_CEQ_ID:
++ return "I40E_ERR_INVALID_CEQ_ID";
++ case I40E_ERR_INVALID_AEQ_ID:
++ return "I40E_ERR_INVALID_AEQ_ID";
++ case I40E_ERR_INVALID_SIZE:
++ return "I40E_ERR_INVALID_SIZE";
++ case I40E_ERR_INVALID_ARP_INDEX:
++ return "I40E_ERR_INVALID_ARP_INDEX";
++ case I40E_ERR_INVALID_FPM_FUNC_ID:
++ return "I40E_ERR_INVALID_FPM_FUNC_ID";
++ case I40E_ERR_QP_INVALID_MSG_SIZE:
++ return "I40E_ERR_QP_INVALID_MSG_SIZE";
++ case I40E_ERR_QP_TOOMANY_WRS_POSTED:
++ return "I40E_ERR_QP_TOOMANY_WRS_POSTED";
++ case I40E_ERR_INVALID_FRAG_COUNT:
++ return "I40E_ERR_INVALID_FRAG_COUNT";
++ case I40E_ERR_QUEUE_EMPTY:
++ return "I40E_ERR_QUEUE_EMPTY";
++ case I40E_ERR_INVALID_ALIGNMENT:
++ return "I40E_ERR_INVALID_ALIGNMENT";
++ case I40E_ERR_FLUSHED_QUEUE:
++ return "I40E_ERR_FLUSHED_QUEUE";
++ case I40E_ERR_INVALID_PUSH_PAGE_INDEX:
++ return "I40E_ERR_INVALID_PUSH_PAGE_INDEX";
++ case I40E_ERR_INVALID_IMM_DATA_SIZE:
++ return "I40E_ERR_INVALID_IMM_DATA_SIZE";
++ case I40E_ERR_TIMEOUT:
++ return "I40E_ERR_TIMEOUT";
++ case I40E_ERR_OPCODE_MISMATCH:
++ return "I40E_ERR_OPCODE_MISMATCH";
++ case I40E_ERR_CQP_COMPL_ERROR:
++ return "I40E_ERR_CQP_COMPL_ERROR";
++ case I40E_ERR_INVALID_VF_ID:
++ return "I40E_ERR_INVALID_VF_ID";
++ case I40E_ERR_INVALID_HMCFN_ID:
++ return "I40E_ERR_INVALID_HMCFN_ID";
++ case I40E_ERR_BACKING_PAGE_ERROR:
++ return "I40E_ERR_BACKING_PAGE_ERROR";
++ case I40E_ERR_NO_PBLCHUNKS_AVAILABLE:
++ return "I40E_ERR_NO_PBLCHUNKS_AVAILABLE";
++ case I40E_ERR_INVALID_PBLE_INDEX:
++ return "I40E_ERR_INVALID_PBLE_INDEX";
++ case I40E_ERR_INVALID_SD_INDEX:
++ return "I40E_ERR_INVALID_SD_INDEX";
++ case I40E_ERR_INVALID_PAGE_DESC_INDEX:
++ return "I40E_ERR_INVALID_PAGE_DESC_INDEX";
++ case I40E_ERR_INVALID_SD_TYPE:
++ return "I40E_ERR_INVALID_SD_TYPE";
++ case I40E_ERR_MEMCPY_FAILED:
++ return "I40E_ERR_MEMCPY_FAILED";
++ case I40E_ERR_INVALID_HMC_OBJ_INDEX:
++ return "I40E_ERR_INVALID_HMC_OBJ_INDEX";
++ case I40E_ERR_INVALID_HMC_OBJ_COUNT:
++ return "I40E_ERR_INVALID_HMC_OBJ_COUNT";
++ case I40E_ERR_INVALID_SRQ_ARM_LIMIT:
++ return "I40E_ERR_INVALID_SRQ_ARM_LIMIT";
++ case I40E_ERR_SRQ_ENABLED:
++ return "I40E_ERR_SRQ_ENABLED";
++ case I40E_ERR_ADMIN_QUEUE_ERROR:
++ return "I40E_ERR_ADMIN_QUEUE_ERROR";
++ case I40E_ERR_ADMIN_QUEUE_TIMEOUT:
++ return "I40E_ERR_ADMIN_QUEUE_TIMEOUT";
++ case I40E_ERR_BUF_TOO_SHORT:
++ return "I40E_ERR_BUF_TOO_SHORT";
++ case I40E_ERR_ADMIN_QUEUE_FULL:
++ return "I40E_ERR_ADMIN_QUEUE_FULL";
++ case I40E_ERR_ADMIN_QUEUE_NO_WORK:
++ return "I40E_ERR_ADMIN_QUEUE_NO_WORK";
++ case I40E_ERR_BAD_IWARP_CQE:
++ return "I40E_ERR_BAD_IWARP_CQE";
++ case I40E_ERR_NVM_BLANK_MODE:
++ return "I40E_ERR_NVM_BLANK_MODE";
++ case I40E_ERR_NOT_IMPLEMENTED:
++ return "I40E_ERR_NOT_IMPLEMENTED";
++ case I40E_ERR_PE_DOORBELL_NOT_ENABLED:
++ return "I40E_ERR_PE_DOORBELL_NOT_ENABLED";
++ case I40E_ERR_DIAG_TEST_FAILED:
++ return "I40E_ERR_DIAG_TEST_FAILED";
++ case I40E_ERR_NOT_READY:
++ return "I40E_ERR_NOT_READY";
++ case I40E_NOT_SUPPORTED:
++ return "I40E_NOT_SUPPORTED";
++ case I40E_ERR_FIRMWARE_API_VERSION:
++ return "I40E_ERR_FIRMWARE_API_VERSION";
++ case I40E_ERR_ADMIN_QUEUE_CRITICAL_ERROR:
++ return "I40E_ERR_ADMIN_QUEUE_CRITICAL_ERROR";
++ }
++
++ snprintf(hw->err_str, sizeof(hw->err_str), "%d", stat_err);
++ return hw->err_str;
++}
++
++/**
++ * i40evf_debug_aq
++ * @hw: debug mask related to admin queue
++ * @mask: debug mask
++ * @desc: pointer to admin queue descriptor
++ * @buffer: pointer to command buffer
++ * @buf_len: max length of buffer
++ *
++ * Dumps debug log about adminq command with descriptor contents.
++ **/
++void i40evf_debug_aq(struct i40e_hw *hw, enum i40e_debug_mask mask, void *desc,
++ void *buffer, u16 buf_len)
++{
++ struct i40e_aq_desc *aq_desc = (struct i40e_aq_desc *)desc;
++ u8 *buf = (u8 *)buffer;
++
++ if ((!(mask & hw->debug_mask)) || (desc == NULL))
++ return;
++
++ i40e_debug(hw, mask,
++ "AQ CMD: opcode 0x%04X, flags 0x%04X, datalen 0x%04X, retval 0x%04X\n",
++ le16_to_cpu(aq_desc->opcode),
++ le16_to_cpu(aq_desc->flags),
++ le16_to_cpu(aq_desc->datalen),
++ le16_to_cpu(aq_desc->retval));
++ i40e_debug(hw, mask, "\tcookie (h,l) 0x%08X 0x%08X\n",
++ le32_to_cpu(aq_desc->cookie_high),
++ le32_to_cpu(aq_desc->cookie_low));
++ i40e_debug(hw, mask, "\tparam (0,1) 0x%08X 0x%08X\n",
++ le32_to_cpu(aq_desc->params.internal.param0),
++ le32_to_cpu(aq_desc->params.internal.param1));
++ i40e_debug(hw, mask, "\taddr (h,l) 0x%08X 0x%08X\n",
++ le32_to_cpu(aq_desc->params.external.addr_high),
++ le32_to_cpu(aq_desc->params.external.addr_low));
++
++ if ((buffer != NULL) && (aq_desc->datalen != 0)) {
++ u16 len = le16_to_cpu(aq_desc->datalen);
++
++ i40e_debug(hw, mask, "AQ CMD Buffer:\n");
++ if (buf_len < len)
++ len = buf_len;
++ /* write the full 16-byte chunks */
++ if (hw->debug_mask & mask) {
++ char prefix[27];
++
++ snprintf(prefix, sizeof(prefix),
++ "i40evf %02x:%02x.%x: \t0x",
++ hw->bus.bus_id,
++ hw->bus.device,
++ hw->bus.func);
++
++ print_hex_dump(KERN_INFO, prefix, DUMP_PREFIX_OFFSET,
++ 16, 1, buf, len, false);
++ }
++ }
++}
++
++/**
++ * i40evf_check_asq_alive
++ * @hw: pointer to the hw struct
++ *
++ * Returns true if Queue is enabled else false.
++ **/
++bool i40evf_check_asq_alive(struct i40e_hw *hw)
++{
++ if (hw->aq.asq.len)
++ return !!(rd32(hw, hw->aq.asq.len) &
++ I40E_VF_ATQLEN1_ATQENABLE_MASK);
++ else
++ return false;
++}
++
++/**
++ * i40evf_aq_queue_shutdown
++ * @hw: pointer to the hw struct
++ * @unloading: is the driver unloading itself
++ *
++ * Tell the Firmware that we're shutting down the AdminQ and whether
++ * or not the driver is unloading as well.
++ **/
++i40e_status i40evf_aq_queue_shutdown(struct i40e_hw *hw,
++ bool unloading)
++{
++ struct i40e_aq_desc desc;
++ struct i40e_aqc_queue_shutdown *cmd =
++ (struct i40e_aqc_queue_shutdown *)&desc.params.raw;
++ i40e_status status;
++
++ i40evf_fill_default_direct_cmd_desc(&desc,
++ i40e_aqc_opc_queue_shutdown);
++
++ if (unloading)
++ cmd->driver_unloading = cpu_to_le32(I40E_AQ_DRIVER_UNLOADING);
++ status = i40evf_asq_send_command(hw, &desc, NULL, 0, NULL);
++
++ return status;
++}
++
++/**
++ * i40e_aq_get_set_rss_lut
++ * @hw: pointer to the hardware structure
++ * @vsi_id: vsi fw index
++ * @pf_lut: for PF table set true, for VSI table set false
++ * @lut: pointer to the lut buffer provided by the caller
++ * @lut_size: size of the lut buffer
++ * @set: set true to set the table, false to get the table
++ *
++ * Internal function to get or set RSS look up table
++ **/
++static i40e_status i40e_aq_get_set_rss_lut(struct i40e_hw *hw,
++ u16 vsi_id, bool pf_lut,
++ u8 *lut, u16 lut_size,
++ bool set)
++{
++ i40e_status status;
++ struct i40e_aq_desc desc;
++ struct i40e_aqc_get_set_rss_lut *cmd_resp =
++ (struct i40e_aqc_get_set_rss_lut *)&desc.params.raw;
++
++ if (set)
++ i40evf_fill_default_direct_cmd_desc(&desc,
++ i40e_aqc_opc_set_rss_lut);
++ else
++ i40evf_fill_default_direct_cmd_desc(&desc,
++ i40e_aqc_opc_get_rss_lut);
++
++ /* Indirect command */
++ desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_BUF);
++ desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_RD);
++
++ cmd_resp->vsi_id =
++ cpu_to_le16((u16)((vsi_id <<
++ I40E_AQC_SET_RSS_LUT_VSI_ID_SHIFT) &
++ I40E_AQC_SET_RSS_LUT_VSI_ID_MASK));
++ cmd_resp->vsi_id |= cpu_to_le16((u16)I40E_AQC_SET_RSS_LUT_VSI_VALID);
++
++ if (pf_lut)
++ cmd_resp->flags |= cpu_to_le16((u16)
++ ((I40E_AQC_SET_RSS_LUT_TABLE_TYPE_PF <<
++ I40E_AQC_SET_RSS_LUT_TABLE_TYPE_SHIFT) &
++ I40E_AQC_SET_RSS_LUT_TABLE_TYPE_MASK));
++ else
++ cmd_resp->flags |= cpu_to_le16((u16)
++ ((I40E_AQC_SET_RSS_LUT_TABLE_TYPE_VSI <<
++ I40E_AQC_SET_RSS_LUT_TABLE_TYPE_SHIFT) &
++ I40E_AQC_SET_RSS_LUT_TABLE_TYPE_MASK));
++
++ status = i40evf_asq_send_command(hw, &desc, lut, lut_size, NULL);
++
++ return status;
++}
++
++/**
++ * i40evf_aq_get_rss_lut
++ * @hw: pointer to the hardware structure
++ * @vsi_id: vsi fw index
++ * @pf_lut: for PF table set true, for VSI table set false
++ * @lut: pointer to the lut buffer provided by the caller
++ * @lut_size: size of the lut buffer
++ *
++ * get the RSS lookup table, PF or VSI type
++ **/
++i40e_status i40evf_aq_get_rss_lut(struct i40e_hw *hw, u16 vsi_id,
++ bool pf_lut, u8 *lut, u16 lut_size)
++{
++ return i40e_aq_get_set_rss_lut(hw, vsi_id, pf_lut, lut, lut_size,
++ false);
++}
++
++/**
++ * i40evf_aq_set_rss_lut
++ * @hw: pointer to the hardware structure
++ * @vsi_id: vsi fw index
++ * @pf_lut: for PF table set true, for VSI table set false
++ * @lut: pointer to the lut buffer provided by the caller
++ * @lut_size: size of the lut buffer
++ *
++ * set the RSS lookup table, PF or VSI type
++ **/
++i40e_status i40evf_aq_set_rss_lut(struct i40e_hw *hw, u16 vsi_id,
++ bool pf_lut, u8 *lut, u16 lut_size)
++{
++ return i40e_aq_get_set_rss_lut(hw, vsi_id, pf_lut, lut, lut_size, true);
++}
++
++/**
++ * i40e_aq_get_set_rss_key
++ * @hw: pointer to the hw struct
++ * @vsi_id: vsi fw index
++ * @key: pointer to key info struct
++ * @set: set true to set the key, false to get the key
++ *
++ * get the RSS key per VSI
++ **/
++static i40e_status i40e_aq_get_set_rss_key(struct i40e_hw *hw,
++ u16 vsi_id,
++ struct i40e_aqc_get_set_rss_key_data *key,
++ bool set)
++{
++ i40e_status status;
++ struct i40e_aq_desc desc;
++ struct i40e_aqc_get_set_rss_key *cmd_resp =
++ (struct i40e_aqc_get_set_rss_key *)&desc.params.raw;
++ u16 key_size = sizeof(struct i40e_aqc_get_set_rss_key_data);
++
++ if (set)
++ i40evf_fill_default_direct_cmd_desc(&desc,
++ i40e_aqc_opc_set_rss_key);
++ else
++ i40evf_fill_default_direct_cmd_desc(&desc,
++ i40e_aqc_opc_get_rss_key);
++
++ /* Indirect command */
++ desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_BUF);
++ desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_RD);
++
++ cmd_resp->vsi_id =
++ cpu_to_le16((u16)((vsi_id <<
++ I40E_AQC_SET_RSS_KEY_VSI_ID_SHIFT) &
++ I40E_AQC_SET_RSS_KEY_VSI_ID_MASK));
++ cmd_resp->vsi_id |= cpu_to_le16((u16)I40E_AQC_SET_RSS_KEY_VSI_VALID);
++
++ status = i40evf_asq_send_command(hw, &desc, key, key_size, NULL);
++
++ return status;
++}
++
++/**
++ * i40evf_aq_get_rss_key
++ * @hw: pointer to the hw struct
++ * @vsi_id: vsi fw index
++ * @key: pointer to key info struct
++ *
++ **/
++i40e_status i40evf_aq_get_rss_key(struct i40e_hw *hw,
++ u16 vsi_id,
++ struct i40e_aqc_get_set_rss_key_data *key)
++{
++ return i40e_aq_get_set_rss_key(hw, vsi_id, key, false);
++}
++
++/**
++ * i40evf_aq_set_rss_key
++ * @hw: pointer to the hw struct
++ * @vsi_id: vsi fw index
++ * @key: pointer to key info struct
++ *
++ * set the RSS key per VSI
++ **/
++i40e_status i40evf_aq_set_rss_key(struct i40e_hw *hw,
++ u16 vsi_id,
++ struct i40e_aqc_get_set_rss_key_data *key)
++{
++ return i40e_aq_get_set_rss_key(hw, vsi_id, key, true);
++}
++
++/* The i40evf_ptype_lookup table is used to convert from the 8-bit ptype in the
++ * hardware to a bit-field that can be used by SW to more easily determine the
++ * packet type.
++ *
++ * Macros are used to shorten the table lines and make this table human
++ * readable.
++ *
++ * We store the PTYPE in the top byte of the bit field - this is just so that
++ * we can check that the table doesn't have a row missing, as the index into
++ * the table should be the PTYPE.
++ *
++ * Typical work flow:
++ *
++ * IF NOT i40evf_ptype_lookup[ptype].known
++ * THEN
++ * Packet is unknown
++ * ELSE IF i40evf_ptype_lookup[ptype].outer_ip == I40E_RX_PTYPE_OUTER_IP
++ * Use the rest of the fields to look at the tunnels, inner protocols, etc
++ * ELSE
++ * Use the enum i40e_rx_l2_ptype to decode the packet type
++ * ENDIF
++ */
++
++/* macro to make the table lines short */
++#define I40E_PTT(PTYPE, OUTER_IP, OUTER_IP_VER, OUTER_FRAG, T, TE, TEF, I, PL)\
++ { PTYPE, \
++ 1, \
++ I40E_RX_PTYPE_OUTER_##OUTER_IP, \
++ I40E_RX_PTYPE_OUTER_##OUTER_IP_VER, \
++ I40E_RX_PTYPE_##OUTER_FRAG, \
++ I40E_RX_PTYPE_TUNNEL_##T, \
++ I40E_RX_PTYPE_TUNNEL_END_##TE, \
++ I40E_RX_PTYPE_##TEF, \
++ I40E_RX_PTYPE_INNER_PROT_##I, \
++ I40E_RX_PTYPE_PAYLOAD_LAYER_##PL }
++
++#define I40E_PTT_UNUSED_ENTRY(PTYPE) \
++ { PTYPE, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
++
++/* shorter macros makes the table fit but are terse */
++#define I40E_RX_PTYPE_NOF I40E_RX_PTYPE_NOT_FRAG
++#define I40E_RX_PTYPE_FRG I40E_RX_PTYPE_FRAG
++#define I40E_RX_PTYPE_INNER_PROT_TS I40E_RX_PTYPE_INNER_PROT_TIMESYNC
++
++/* Lookup table mapping the HW PTYPE to the bit field for decoding */
++struct i40e_rx_ptype_decoded i40evf_ptype_lookup[] = {
++ /* L2 Packet types */
++ I40E_PTT_UNUSED_ENTRY(0),
++ I40E_PTT(1, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2),
++ I40E_PTT(2, L2, NONE, NOF, NONE, NONE, NOF, TS, PAY2),
++ I40E_PTT(3, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2),
++ I40E_PTT_UNUSED_ENTRY(4),
++ I40E_PTT_UNUSED_ENTRY(5),
++ I40E_PTT(6, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2),
++ I40E_PTT(7, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2),
++ I40E_PTT_UNUSED_ENTRY(8),
++ I40E_PTT_UNUSED_ENTRY(9),
++ I40E_PTT(10, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY2),
++ I40E_PTT(11, L2, NONE, NOF, NONE, NONE, NOF, NONE, NONE),
++ I40E_PTT(12, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(13, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(14, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(15, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(16, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(17, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(18, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(19, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(20, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(21, L2, NONE, NOF, NONE, NONE, NOF, NONE, PAY3),
++
++ /* Non Tunneled IPv4 */
++ I40E_PTT(22, IP, IPV4, FRG, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(23, IP, IPV4, NOF, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(24, IP, IPV4, NOF, NONE, NONE, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(25),
++ I40E_PTT(26, IP, IPV4, NOF, NONE, NONE, NOF, TCP, PAY4),
++ I40E_PTT(27, IP, IPV4, NOF, NONE, NONE, NOF, SCTP, PAY4),
++ I40E_PTT(28, IP, IPV4, NOF, NONE, NONE, NOF, ICMP, PAY4),
++
++ /* IPv4 --> IPv4 */
++ I40E_PTT(29, IP, IPV4, NOF, IP_IP, IPV4, FRG, NONE, PAY3),
++ I40E_PTT(30, IP, IPV4, NOF, IP_IP, IPV4, NOF, NONE, PAY3),
++ I40E_PTT(31, IP, IPV4, NOF, IP_IP, IPV4, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(32),
++ I40E_PTT(33, IP, IPV4, NOF, IP_IP, IPV4, NOF, TCP, PAY4),
++ I40E_PTT(34, IP, IPV4, NOF, IP_IP, IPV4, NOF, SCTP, PAY4),
++ I40E_PTT(35, IP, IPV4, NOF, IP_IP, IPV4, NOF, ICMP, PAY4),
++
++ /* IPv4 --> IPv6 */
++ I40E_PTT(36, IP, IPV4, NOF, IP_IP, IPV6, FRG, NONE, PAY3),
++ I40E_PTT(37, IP, IPV4, NOF, IP_IP, IPV6, NOF, NONE, PAY3),
++ I40E_PTT(38, IP, IPV4, NOF, IP_IP, IPV6, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(39),
++ I40E_PTT(40, IP, IPV4, NOF, IP_IP, IPV6, NOF, TCP, PAY4),
++ I40E_PTT(41, IP, IPV4, NOF, IP_IP, IPV6, NOF, SCTP, PAY4),
++ I40E_PTT(42, IP, IPV4, NOF, IP_IP, IPV6, NOF, ICMP, PAY4),
++
++ /* IPv4 --> GRE/NAT */
++ I40E_PTT(43, IP, IPV4, NOF, IP_GRENAT, NONE, NOF, NONE, PAY3),
++
++ /* IPv4 --> GRE/NAT --> IPv4 */
++ I40E_PTT(44, IP, IPV4, NOF, IP_GRENAT, IPV4, FRG, NONE, PAY3),
++ I40E_PTT(45, IP, IPV4, NOF, IP_GRENAT, IPV4, NOF, NONE, PAY3),
++ I40E_PTT(46, IP, IPV4, NOF, IP_GRENAT, IPV4, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(47),
++ I40E_PTT(48, IP, IPV4, NOF, IP_GRENAT, IPV4, NOF, TCP, PAY4),
++ I40E_PTT(49, IP, IPV4, NOF, IP_GRENAT, IPV4, NOF, SCTP, PAY4),
++ I40E_PTT(50, IP, IPV4, NOF, IP_GRENAT, IPV4, NOF, ICMP, PAY4),
++
++ /* IPv4 --> GRE/NAT --> IPv6 */
++ I40E_PTT(51, IP, IPV4, NOF, IP_GRENAT, IPV6, FRG, NONE, PAY3),
++ I40E_PTT(52, IP, IPV4, NOF, IP_GRENAT, IPV6, NOF, NONE, PAY3),
++ I40E_PTT(53, IP, IPV4, NOF, IP_GRENAT, IPV6, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(54),
++ I40E_PTT(55, IP, IPV4, NOF, IP_GRENAT, IPV6, NOF, TCP, PAY4),
++ I40E_PTT(56, IP, IPV4, NOF, IP_GRENAT, IPV6, NOF, SCTP, PAY4),
++ I40E_PTT(57, IP, IPV4, NOF, IP_GRENAT, IPV6, NOF, ICMP, PAY4),
++
++ /* IPv4 --> GRE/NAT --> MAC */
++ I40E_PTT(58, IP, IPV4, NOF, IP_GRENAT_MAC, NONE, NOF, NONE, PAY3),
++
++ /* IPv4 --> GRE/NAT --> MAC --> IPv4 */
++ I40E_PTT(59, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, FRG, NONE, PAY3),
++ I40E_PTT(60, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, NOF, NONE, PAY3),
++ I40E_PTT(61, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(62),
++ I40E_PTT(63, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, NOF, TCP, PAY4),
++ I40E_PTT(64, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, NOF, SCTP, PAY4),
++ I40E_PTT(65, IP, IPV4, NOF, IP_GRENAT_MAC, IPV4, NOF, ICMP, PAY4),
++
++ /* IPv4 --> GRE/NAT -> MAC --> IPv6 */
++ I40E_PTT(66, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, FRG, NONE, PAY3),
++ I40E_PTT(67, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, NOF, NONE, PAY3),
++ I40E_PTT(68, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(69),
++ I40E_PTT(70, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, NOF, TCP, PAY4),
++ I40E_PTT(71, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, NOF, SCTP, PAY4),
++ I40E_PTT(72, IP, IPV4, NOF, IP_GRENAT_MAC, IPV6, NOF, ICMP, PAY4),
++
++ /* IPv4 --> GRE/NAT --> MAC/VLAN */
++ I40E_PTT(73, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, NONE, NOF, NONE, PAY3),
++
++ /* IPv4 ---> GRE/NAT -> MAC/VLAN --> IPv4 */
++ I40E_PTT(74, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, FRG, NONE, PAY3),
++ I40E_PTT(75, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, NONE, PAY3),
++ I40E_PTT(76, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(77),
++ I40E_PTT(78, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, TCP, PAY4),
++ I40E_PTT(79, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, SCTP, PAY4),
++ I40E_PTT(80, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, ICMP, PAY4),
++
++ /* IPv4 -> GRE/NAT -> MAC/VLAN --> IPv6 */
++ I40E_PTT(81, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, FRG, NONE, PAY3),
++ I40E_PTT(82, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, NONE, PAY3),
++ I40E_PTT(83, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(84),
++ I40E_PTT(85, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, TCP, PAY4),
++ I40E_PTT(86, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, SCTP, PAY4),
++ I40E_PTT(87, IP, IPV4, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, ICMP, PAY4),
++
++ /* Non Tunneled IPv6 */
++ I40E_PTT(88, IP, IPV6, FRG, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(89, IP, IPV6, NOF, NONE, NONE, NOF, NONE, PAY3),
++ I40E_PTT(90, IP, IPV6, NOF, NONE, NONE, NOF, UDP, PAY3),
++ I40E_PTT_UNUSED_ENTRY(91),
++ I40E_PTT(92, IP, IPV6, NOF, NONE, NONE, NOF, TCP, PAY4),
++ I40E_PTT(93, IP, IPV6, NOF, NONE, NONE, NOF, SCTP, PAY4),
++ I40E_PTT(94, IP, IPV6, NOF, NONE, NONE, NOF, ICMP, PAY4),
++
++ /* IPv6 --> IPv4 */
++ I40E_PTT(95, IP, IPV6, NOF, IP_IP, IPV4, FRG, NONE, PAY3),
++ I40E_PTT(96, IP, IPV6, NOF, IP_IP, IPV4, NOF, NONE, PAY3),
++ I40E_PTT(97, IP, IPV6, NOF, IP_IP, IPV4, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(98),
++ I40E_PTT(99, IP, IPV6, NOF, IP_IP, IPV4, NOF, TCP, PAY4),
++ I40E_PTT(100, IP, IPV6, NOF, IP_IP, IPV4, NOF, SCTP, PAY4),
++ I40E_PTT(101, IP, IPV6, NOF, IP_IP, IPV4, NOF, ICMP, PAY4),
++
++ /* IPv6 --> IPv6 */
++ I40E_PTT(102, IP, IPV6, NOF, IP_IP, IPV6, FRG, NONE, PAY3),
++ I40E_PTT(103, IP, IPV6, NOF, IP_IP, IPV6, NOF, NONE, PAY3),
++ I40E_PTT(104, IP, IPV6, NOF, IP_IP, IPV6, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(105),
++ I40E_PTT(106, IP, IPV6, NOF, IP_IP, IPV6, NOF, TCP, PAY4),
++ I40E_PTT(107, IP, IPV6, NOF, IP_IP, IPV6, NOF, SCTP, PAY4),
++ I40E_PTT(108, IP, IPV6, NOF, IP_IP, IPV6, NOF, ICMP, PAY4),
++
++ /* IPv6 --> GRE/NAT */
++ I40E_PTT(109, IP, IPV6, NOF, IP_GRENAT, NONE, NOF, NONE, PAY3),
++
++ /* IPv6 --> GRE/NAT -> IPv4 */
++ I40E_PTT(110, IP, IPV6, NOF, IP_GRENAT, IPV4, FRG, NONE, PAY3),
++ I40E_PTT(111, IP, IPV6, NOF, IP_GRENAT, IPV4, NOF, NONE, PAY3),
++ I40E_PTT(112, IP, IPV6, NOF, IP_GRENAT, IPV4, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(113),
++ I40E_PTT(114, IP, IPV6, NOF, IP_GRENAT, IPV4, NOF, TCP, PAY4),
++ I40E_PTT(115, IP, IPV6, NOF, IP_GRENAT, IPV4, NOF, SCTP, PAY4),
++ I40E_PTT(116, IP, IPV6, NOF, IP_GRENAT, IPV4, NOF, ICMP, PAY4),
++
++ /* IPv6 --> GRE/NAT -> IPv6 */
++ I40E_PTT(117, IP, IPV6, NOF, IP_GRENAT, IPV6, FRG, NONE, PAY3),
++ I40E_PTT(118, IP, IPV6, NOF, IP_GRENAT, IPV6, NOF, NONE, PAY3),
++ I40E_PTT(119, IP, IPV6, NOF, IP_GRENAT, IPV6, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(120),
++ I40E_PTT(121, IP, IPV6, NOF, IP_GRENAT, IPV6, NOF, TCP, PAY4),
++ I40E_PTT(122, IP, IPV6, NOF, IP_GRENAT, IPV6, NOF, SCTP, PAY4),
++ I40E_PTT(123, IP, IPV6, NOF, IP_GRENAT, IPV6, NOF, ICMP, PAY4),
++
++ /* IPv6 --> GRE/NAT -> MAC */
++ I40E_PTT(124, IP, IPV6, NOF, IP_GRENAT_MAC, NONE, NOF, NONE, PAY3),
++
++ /* IPv6 --> GRE/NAT -> MAC -> IPv4 */
++ I40E_PTT(125, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, FRG, NONE, PAY3),
++ I40E_PTT(126, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, NOF, NONE, PAY3),
++ I40E_PTT(127, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(128),
++ I40E_PTT(129, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, NOF, TCP, PAY4),
++ I40E_PTT(130, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, NOF, SCTP, PAY4),
++ I40E_PTT(131, IP, IPV6, NOF, IP_GRENAT_MAC, IPV4, NOF, ICMP, PAY4),
++
++ /* IPv6 --> GRE/NAT -> MAC -> IPv6 */
++ I40E_PTT(132, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, FRG, NONE, PAY3),
++ I40E_PTT(133, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, NOF, NONE, PAY3),
++ I40E_PTT(134, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(135),
++ I40E_PTT(136, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, NOF, TCP, PAY4),
++ I40E_PTT(137, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, NOF, SCTP, PAY4),
++ I40E_PTT(138, IP, IPV6, NOF, IP_GRENAT_MAC, IPV6, NOF, ICMP, PAY4),
++
++ /* IPv6 --> GRE/NAT -> MAC/VLAN */
++ I40E_PTT(139, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, NONE, NOF, NONE, PAY3),
++
++ /* IPv6 --> GRE/NAT -> MAC/VLAN --> IPv4 */
++ I40E_PTT(140, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, FRG, NONE, PAY3),
++ I40E_PTT(141, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, NONE, PAY3),
++ I40E_PTT(142, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(143),
++ I40E_PTT(144, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, TCP, PAY4),
++ I40E_PTT(145, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, SCTP, PAY4),
++ I40E_PTT(146, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV4, NOF, ICMP, PAY4),
++
++ /* IPv6 --> GRE/NAT -> MAC/VLAN --> IPv6 */
++ I40E_PTT(147, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, FRG, NONE, PAY3),
++ I40E_PTT(148, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, NONE, PAY3),
++ I40E_PTT(149, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, UDP, PAY4),
++ I40E_PTT_UNUSED_ENTRY(150),
++ I40E_PTT(151, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, TCP, PAY4),
++ I40E_PTT(152, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, SCTP, PAY4),
++ I40E_PTT(153, IP, IPV6, NOF, IP_GRENAT_MAC_VLAN, IPV6, NOF, ICMP, PAY4),
++
++ /* unused entries */
++ I40E_PTT_UNUSED_ENTRY(154),
++ I40E_PTT_UNUSED_ENTRY(155),
++ I40E_PTT_UNUSED_ENTRY(156),
++ I40E_PTT_UNUSED_ENTRY(157),
++ I40E_PTT_UNUSED_ENTRY(158),
++ I40E_PTT_UNUSED_ENTRY(159),
++
++ I40E_PTT_UNUSED_ENTRY(160),
++ I40E_PTT_UNUSED_ENTRY(161),
++ I40E_PTT_UNUSED_ENTRY(162),
++ I40E_PTT_UNUSED_ENTRY(163),
++ I40E_PTT_UNUSED_ENTRY(164),
++ I40E_PTT_UNUSED_ENTRY(165),
++ I40E_PTT_UNUSED_ENTRY(166),
++ I40E_PTT_UNUSED_ENTRY(167),
++ I40E_PTT_UNUSED_ENTRY(168),
++ I40E_PTT_UNUSED_ENTRY(169),
++
++ I40E_PTT_UNUSED_ENTRY(170),
++ I40E_PTT_UNUSED_ENTRY(171),
++ I40E_PTT_UNUSED_ENTRY(172),
++ I40E_PTT_UNUSED_ENTRY(173),
++ I40E_PTT_UNUSED_ENTRY(174),
++ I40E_PTT_UNUSED_ENTRY(175),
++ I40E_PTT_UNUSED_ENTRY(176),
++ I40E_PTT_UNUSED_ENTRY(177),
++ I40E_PTT_UNUSED_ENTRY(178),
++ I40E_PTT_UNUSED_ENTRY(179),
++
++ I40E_PTT_UNUSED_ENTRY(180),
++ I40E_PTT_UNUSED_ENTRY(181),
++ I40E_PTT_UNUSED_ENTRY(182),
++ I40E_PTT_UNUSED_ENTRY(183),
++ I40E_PTT_UNUSED_ENTRY(184),
++ I40E_PTT_UNUSED_ENTRY(185),
++ I40E_PTT_UNUSED_ENTRY(186),
++ I40E_PTT_UNUSED_ENTRY(187),
++ I40E_PTT_UNUSED_ENTRY(188),
++ I40E_PTT_UNUSED_ENTRY(189),
++
++ I40E_PTT_UNUSED_ENTRY(190),
++ I40E_PTT_UNUSED_ENTRY(191),
++ I40E_PTT_UNUSED_ENTRY(192),
++ I40E_PTT_UNUSED_ENTRY(193),
++ I40E_PTT_UNUSED_ENTRY(194),
++ I40E_PTT_UNUSED_ENTRY(195),
++ I40E_PTT_UNUSED_ENTRY(196),
++ I40E_PTT_UNUSED_ENTRY(197),
++ I40E_PTT_UNUSED_ENTRY(198),
++ I40E_PTT_UNUSED_ENTRY(199),
++
++ I40E_PTT_UNUSED_ENTRY(200),
++ I40E_PTT_UNUSED_ENTRY(201),
++ I40E_PTT_UNUSED_ENTRY(202),
++ I40E_PTT_UNUSED_ENTRY(203),
++ I40E_PTT_UNUSED_ENTRY(204),
++ I40E_PTT_UNUSED_ENTRY(205),
++ I40E_PTT_UNUSED_ENTRY(206),
++ I40E_PTT_UNUSED_ENTRY(207),
++ I40E_PTT_UNUSED_ENTRY(208),
++ I40E_PTT_UNUSED_ENTRY(209),
++
++ I40E_PTT_UNUSED_ENTRY(210),
++ I40E_PTT_UNUSED_ENTRY(211),
++ I40E_PTT_UNUSED_ENTRY(212),
++ I40E_PTT_UNUSED_ENTRY(213),
++ I40E_PTT_UNUSED_ENTRY(214),
++ I40E_PTT_UNUSED_ENTRY(215),
++ I40E_PTT_UNUSED_ENTRY(216),
++ I40E_PTT_UNUSED_ENTRY(217),
++ I40E_PTT_UNUSED_ENTRY(218),
++ I40E_PTT_UNUSED_ENTRY(219),
++
++ I40E_PTT_UNUSED_ENTRY(220),
++ I40E_PTT_UNUSED_ENTRY(221),
++ I40E_PTT_UNUSED_ENTRY(222),
++ I40E_PTT_UNUSED_ENTRY(223),
++ I40E_PTT_UNUSED_ENTRY(224),
++ I40E_PTT_UNUSED_ENTRY(225),
++ I40E_PTT_UNUSED_ENTRY(226),
++ I40E_PTT_UNUSED_ENTRY(227),
++ I40E_PTT_UNUSED_ENTRY(228),
++ I40E_PTT_UNUSED_ENTRY(229),
++
++ I40E_PTT_UNUSED_ENTRY(230),
++ I40E_PTT_UNUSED_ENTRY(231),
++ I40E_PTT_UNUSED_ENTRY(232),
++ I40E_PTT_UNUSED_ENTRY(233),
++ I40E_PTT_UNUSED_ENTRY(234),
++ I40E_PTT_UNUSED_ENTRY(235),
++ I40E_PTT_UNUSED_ENTRY(236),
++ I40E_PTT_UNUSED_ENTRY(237),
++ I40E_PTT_UNUSED_ENTRY(238),
++ I40E_PTT_UNUSED_ENTRY(239),
++
++ I40E_PTT_UNUSED_ENTRY(240),
++ I40E_PTT_UNUSED_ENTRY(241),
++ I40E_PTT_UNUSED_ENTRY(242),
++ I40E_PTT_UNUSED_ENTRY(243),
++ I40E_PTT_UNUSED_ENTRY(244),
++ I40E_PTT_UNUSED_ENTRY(245),
++ I40E_PTT_UNUSED_ENTRY(246),
++ I40E_PTT_UNUSED_ENTRY(247),
++ I40E_PTT_UNUSED_ENTRY(248),
++ I40E_PTT_UNUSED_ENTRY(249),
++
++ I40E_PTT_UNUSED_ENTRY(250),
++ I40E_PTT_UNUSED_ENTRY(251),
++ I40E_PTT_UNUSED_ENTRY(252),
++ I40E_PTT_UNUSED_ENTRY(253),
++ I40E_PTT_UNUSED_ENTRY(254),
++ I40E_PTT_UNUSED_ENTRY(255)
++};
++
++/**
++ * i40e_aq_send_msg_to_pf
++ * @hw: pointer to the hardware structure
++ * @v_opcode: opcodes for VF-PF communication
++ * @v_retval: return error code
++ * @msg: pointer to the msg buffer
++ * @msglen: msg length
++ * @cmd_details: pointer to command details
++ *
++ * Send message to PF driver using admin queue. By default, this message
++ * is sent asynchronously, i.e. i40evf_asq_send_command() does not wait for
++ * completion before returning.
++ **/
++i40e_status i40e_aq_send_msg_to_pf(struct i40e_hw *hw,
++ enum virtchnl_ops v_opcode,
++ i40e_status v_retval,
++ u8 *msg, u16 msglen,
++ struct i40e_asq_cmd_details *cmd_details)
++{
++ struct i40e_aq_desc desc;
++ struct i40e_asq_cmd_details details;
++ i40e_status status;
++
++ i40evf_fill_default_direct_cmd_desc(&desc, i40e_aqc_opc_send_msg_to_pf);
++ desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_SI);
++ desc.cookie_high = cpu_to_le32(v_opcode);
++ desc.cookie_low = cpu_to_le32(v_retval);
++ if (msglen) {
++ desc.flags |= cpu_to_le16((u16)(I40E_AQ_FLAG_BUF
++ | I40E_AQ_FLAG_RD));
++ if (msglen > I40E_AQ_LARGE_BUF)
++ desc.flags |= cpu_to_le16((u16)I40E_AQ_FLAG_LB);
++ desc.datalen = cpu_to_le16(msglen);
++ }
++ if (!cmd_details) {
++ memset(&details, 0, sizeof(details));
++ details.async = true;
++ cmd_details = &details;
++ }
++ status = i40evf_asq_send_command(hw, &desc, msg, msglen, cmd_details);
++ return status;
++}
++
++/**
++ * i40e_vf_parse_hw_config
++ * @hw: pointer to the hardware structure
++ * @msg: pointer to the virtual channel VF resource structure
++ *
++ * Given a VF resource message from the PF, populate the hw struct
++ * with appropriate information.
++ **/
++void i40e_vf_parse_hw_config(struct i40e_hw *hw,
++ struct virtchnl_vf_resource *msg)
++{
++ struct virtchnl_vsi_resource *vsi_res;
++ int i;
++
++ vsi_res = &msg->vsi_res[0];
++
++ hw->dev_caps.num_vsis = msg->num_vsis;
++ hw->dev_caps.num_rx_qp = msg->num_queue_pairs;
++ hw->dev_caps.num_tx_qp = msg->num_queue_pairs;
++ hw->dev_caps.num_msix_vectors_vf = msg->max_vectors;
++ hw->dev_caps.dcb = msg->vf_cap_flags &
++ VIRTCHNL_VF_OFFLOAD_L2;
++ hw->dev_caps.fcoe = 0;
++ for (i = 0; i < msg->num_vsis; i++) {
++ if (vsi_res->vsi_type == VIRTCHNL_VSI_SRIOV) {
++ ether_addr_copy(hw->mac.perm_addr,
++ vsi_res->default_mac_addr);
++ ether_addr_copy(hw->mac.addr,
++ vsi_res->default_mac_addr);
++ }
++ vsi_res++;
++ }
++}
++
++/**
++ * i40e_vf_reset
++ * @hw: pointer to the hardware structure
++ *
++ * Send a VF_RESET message to the PF. Does not wait for response from PF
++ * as none will be forthcoming. Immediately after calling this function,
++ * the admin queue should be shut down and (optionally) reinitialized.
++ **/
++i40e_status i40e_vf_reset(struct i40e_hw *hw)
++{
++ return i40e_aq_send_msg_to_pf(hw, VIRTCHNL_OP_RESET_VF,
++ 0, NULL, 0, NULL);
++}
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_devids.h b/drivers/net/ethernet/intel/iavf/i40e_devids.h
+new file mode 100644
+index 0000000000000..f300bf271824a
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_devids.h
+@@ -0,0 +1,34 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40E_DEVIDS_H_
++#define _I40E_DEVIDS_H_
++
++/* Device IDs */
++#define I40E_DEV_ID_SFP_XL710 0x1572
++#define I40E_DEV_ID_QEMU 0x1574
++#define I40E_DEV_ID_KX_B 0x1580
++#define I40E_DEV_ID_KX_C 0x1581
++#define I40E_DEV_ID_QSFP_A 0x1583
++#define I40E_DEV_ID_QSFP_B 0x1584
++#define I40E_DEV_ID_QSFP_C 0x1585
++#define I40E_DEV_ID_10G_BASE_T 0x1586
++#define I40E_DEV_ID_20G_KR2 0x1587
++#define I40E_DEV_ID_20G_KR2_A 0x1588
++#define I40E_DEV_ID_10G_BASE_T4 0x1589
++#define I40E_DEV_ID_25G_B 0x158A
++#define I40E_DEV_ID_25G_SFP28 0x158B
++#define I40E_DEV_ID_VF 0x154C
++#define I40E_DEV_ID_VF_HV 0x1571
++#define I40E_DEV_ID_ADAPTIVE_VF 0x1889
++#define I40E_DEV_ID_SFP_X722 0x37D0
++#define I40E_DEV_ID_1G_BASE_T_X722 0x37D1
++#define I40E_DEV_ID_10G_BASE_T_X722 0x37D2
++#define I40E_DEV_ID_SFP_I_X722 0x37D3
++#define I40E_DEV_ID_X722_VF 0x37CD
++
++#define i40e_is_40G_device(d) ((d) == I40E_DEV_ID_QSFP_A || \
++ (d) == I40E_DEV_ID_QSFP_B || \
++ (d) == I40E_DEV_ID_QSFP_C)
++
++#endif /* _I40E_DEVIDS_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_osdep.h b/drivers/net/ethernet/intel/iavf/i40e_osdep.h
+new file mode 100644
+index 0000000000000..3ddddb46455b2
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_osdep.h
+@@ -0,0 +1,52 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40E_OSDEP_H_
++#define _I40E_OSDEP_H_
++
++#include <linux/types.h>
++#include <linux/if_ether.h>
++#include <linux/if_vlan.h>
++#include <linux/tcp.h>
++#include <linux/pci.h>
++
++/* get readq/writeq support for 32 bit kernels, use the low-first version */
++#include <linux/io-64-nonatomic-lo-hi.h>
++
++/* File to be the magic between shared code and
++ * actual OS primitives
++ */
++
++#define hw_dbg(hw, S, A...) do {} while (0)
++
++#define wr32(a, reg, value) writel((value), ((a)->hw_addr + (reg)))
++#define rd32(a, reg) readl((a)->hw_addr + (reg))
++
++#define wr64(a, reg, value) writeq((value), ((a)->hw_addr + (reg)))
++#define rd64(a, reg) readq((a)->hw_addr + (reg))
++#define i40e_flush(a) readl((a)->hw_addr + I40E_VFGEN_RSTAT)
++
++/* memory allocation tracking */
++struct i40e_dma_mem {
++ void *va;
++ dma_addr_t pa;
++ u32 size;
++};
++
++#define i40e_allocate_dma_mem(h, m, unused, s, a) \
++ i40evf_allocate_dma_mem_d(h, m, s, a)
++#define i40e_free_dma_mem(h, m) i40evf_free_dma_mem_d(h, m)
++
++struct i40e_virt_mem {
++ void *va;
++ u32 size;
++};
++#define i40e_allocate_virt_mem(h, m, s) i40evf_allocate_virt_mem_d(h, m, s)
++#define i40e_free_virt_mem(h, m) i40evf_free_virt_mem_d(h, m)
++
++#define i40e_debug(h, m, s, ...) i40evf_debug_d(h, m, s, ##__VA_ARGS__)
++extern void i40evf_debug_d(void *hw, u32 mask, char *fmt_str, ...)
++ __attribute__ ((format(gnu_printf, 3, 4)));
++
++typedef enum i40e_status_code i40e_status;
++#endif /* _I40E_OSDEP_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_prototype.h b/drivers/net/ethernet/intel/iavf/i40e_prototype.h
+new file mode 100644
+index 0000000000000..ef7f74489bfc0
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_prototype.h
+@@ -0,0 +1,71 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40E_PROTOTYPE_H_
++#define _I40E_PROTOTYPE_H_
++
++#include "i40e_type.h"
++#include "i40e_alloc.h"
++#include <linux/avf/virtchnl.h>
++
++/* Prototypes for shared code functions that are not in
++ * the standard function pointer structures. These are
++ * mostly because they are needed even before the init
++ * has happened and will assist in the early SW and FW
++ * setup.
++ */
++
++/* adminq functions */
++i40e_status i40evf_init_adminq(struct i40e_hw *hw);
++i40e_status i40evf_shutdown_adminq(struct i40e_hw *hw);
++void i40e_adminq_init_ring_data(struct i40e_hw *hw);
++i40e_status i40evf_clean_arq_element(struct i40e_hw *hw,
++ struct i40e_arq_event_info *e,
++ u16 *events_pending);
++i40e_status i40evf_asq_send_command(struct i40e_hw *hw,
++ struct i40e_aq_desc *desc,
++ void *buff, /* can be NULL */
++ u16 buff_size,
++ struct i40e_asq_cmd_details *cmd_details);
++bool i40evf_asq_done(struct i40e_hw *hw);
++
++/* debug function for adminq */
++void i40evf_debug_aq(struct i40e_hw *hw, enum i40e_debug_mask mask,
++ void *desc, void *buffer, u16 buf_len);
++
++void i40e_idle_aq(struct i40e_hw *hw);
++void i40evf_resume_aq(struct i40e_hw *hw);
++bool i40evf_check_asq_alive(struct i40e_hw *hw);
++i40e_status i40evf_aq_queue_shutdown(struct i40e_hw *hw, bool unloading);
++const char *i40evf_aq_str(struct i40e_hw *hw, enum i40e_admin_queue_err aq_err);
++const char *i40evf_stat_str(struct i40e_hw *hw, i40e_status stat_err);
++
++i40e_status i40evf_aq_get_rss_lut(struct i40e_hw *hw, u16 seid,
++ bool pf_lut, u8 *lut, u16 lut_size);
++i40e_status i40evf_aq_set_rss_lut(struct i40e_hw *hw, u16 seid,
++ bool pf_lut, u8 *lut, u16 lut_size);
++i40e_status i40evf_aq_get_rss_key(struct i40e_hw *hw,
++ u16 seid,
++ struct i40e_aqc_get_set_rss_key_data *key);
++i40e_status i40evf_aq_set_rss_key(struct i40e_hw *hw,
++ u16 seid,
++ struct i40e_aqc_get_set_rss_key_data *key);
++
++i40e_status i40e_set_mac_type(struct i40e_hw *hw);
++
++extern struct i40e_rx_ptype_decoded i40evf_ptype_lookup[];
++
++static inline struct i40e_rx_ptype_decoded decode_rx_desc_ptype(u8 ptype)
++{
++ return i40evf_ptype_lookup[ptype];
++}
++
++/* i40e_common for VF drivers*/
++void i40e_vf_parse_hw_config(struct i40e_hw *hw,
++ struct virtchnl_vf_resource *msg);
++i40e_status i40e_vf_reset(struct i40e_hw *hw);
++i40e_status i40e_aq_send_msg_to_pf(struct i40e_hw *hw,
++ enum virtchnl_ops v_opcode,
++ i40e_status v_retval, u8 *msg, u16 msglen,
++ struct i40e_asq_cmd_details *cmd_details);
++#endif /* _I40E_PROTOTYPE_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_register.h b/drivers/net/ethernet/intel/iavf/i40e_register.h
+new file mode 100644
+index 0000000000000..20b464ac15420
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_register.h
+@@ -0,0 +1,68 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40E_REGISTER_H_
++#define _I40E_REGISTER_H_
++
++#define I40E_VF_ARQBAH1 0x00006000 /* Reset: EMPR */
++#define I40E_VF_ARQBAL1 0x00006C00 /* Reset: EMPR */
++#define I40E_VF_ARQH1 0x00007400 /* Reset: EMPR */
++#define I40E_VF_ARQH1_ARQH_SHIFT 0
++#define I40E_VF_ARQH1_ARQH_MASK I40E_MASK(0x3FF, I40E_VF_ARQH1_ARQH_SHIFT)
++#define I40E_VF_ARQLEN1 0x00008000 /* Reset: EMPR */
++#define I40E_VF_ARQLEN1_ARQVFE_SHIFT 28
++#define I40E_VF_ARQLEN1_ARQVFE_MASK I40E_MASK(0x1, I40E_VF_ARQLEN1_ARQVFE_SHIFT)
++#define I40E_VF_ARQLEN1_ARQOVFL_SHIFT 29
++#define I40E_VF_ARQLEN1_ARQOVFL_MASK I40E_MASK(0x1, I40E_VF_ARQLEN1_ARQOVFL_SHIFT)
++#define I40E_VF_ARQLEN1_ARQCRIT_SHIFT 30
++#define I40E_VF_ARQLEN1_ARQCRIT_MASK I40E_MASK(0x1, I40E_VF_ARQLEN1_ARQCRIT_SHIFT)
++#define I40E_VF_ARQLEN1_ARQENABLE_SHIFT 31
++#define I40E_VF_ARQLEN1_ARQENABLE_MASK I40E_MASK(0x1, I40E_VF_ARQLEN1_ARQENABLE_SHIFT)
++#define I40E_VF_ARQT1 0x00007000 /* Reset: EMPR */
++#define I40E_VF_ATQBAH1 0x00007800 /* Reset: EMPR */
++#define I40E_VF_ATQBAL1 0x00007C00 /* Reset: EMPR */
++#define I40E_VF_ATQH1 0x00006400 /* Reset: EMPR */
++#define I40E_VF_ATQLEN1 0x00006800 /* Reset: EMPR */
++#define I40E_VF_ATQLEN1_ATQVFE_SHIFT 28
++#define I40E_VF_ATQLEN1_ATQVFE_MASK I40E_MASK(0x1, I40E_VF_ATQLEN1_ATQVFE_SHIFT)
++#define I40E_VF_ATQLEN1_ATQOVFL_SHIFT 29
++#define I40E_VF_ATQLEN1_ATQOVFL_MASK I40E_MASK(0x1, I40E_VF_ATQLEN1_ATQOVFL_SHIFT)
++#define I40E_VF_ATQLEN1_ATQCRIT_SHIFT 30
++#define I40E_VF_ATQLEN1_ATQCRIT_MASK I40E_MASK(0x1, I40E_VF_ATQLEN1_ATQCRIT_SHIFT)
++#define I40E_VF_ATQLEN1_ATQENABLE_SHIFT 31
++#define I40E_VF_ATQLEN1_ATQENABLE_MASK I40E_MASK(0x1, I40E_VF_ATQLEN1_ATQENABLE_SHIFT)
++#define I40E_VF_ATQT1 0x00008400 /* Reset: EMPR */
++#define I40E_VFGEN_RSTAT 0x00008800 /* Reset: VFR */
++#define I40E_VFGEN_RSTAT_VFR_STATE_SHIFT 0
++#define I40E_VFGEN_RSTAT_VFR_STATE_MASK I40E_MASK(0x3, I40E_VFGEN_RSTAT_VFR_STATE_SHIFT)
++#define I40E_VFINT_DYN_CTL01 0x00005C00 /* Reset: VFR */
++#define I40E_VFINT_DYN_CTL01_INTENA_SHIFT 0
++#define I40E_VFINT_DYN_CTL01_INTENA_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTL01_INTENA_SHIFT)
++#define I40E_VFINT_DYN_CTL01_ITR_INDX_SHIFT 3
++#define I40E_VFINT_DYN_CTL01_ITR_INDX_MASK I40E_MASK(0x3, I40E_VFINT_DYN_CTL01_ITR_INDX_SHIFT)
++#define I40E_VFINT_DYN_CTLN1(_INTVF) (0x00003800 + ((_INTVF) * 4)) /* _i=0...15 */ /* Reset: VFR */
++#define I40E_VFINT_DYN_CTLN1_INTENA_SHIFT 0
++#define I40E_VFINT_DYN_CTLN1_INTENA_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN1_INTENA_SHIFT)
++#define I40E_VFINT_DYN_CTLN1_SWINT_TRIG_SHIFT 2
++#define I40E_VFINT_DYN_CTLN1_SWINT_TRIG_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN1_SWINT_TRIG_SHIFT)
++#define I40E_VFINT_DYN_CTLN1_ITR_INDX_SHIFT 3
++#define I40E_VFINT_DYN_CTLN1_ITR_INDX_MASK I40E_MASK(0x3, I40E_VFINT_DYN_CTLN1_ITR_INDX_SHIFT)
++#define I40E_VFINT_DYN_CTLN1_INTERVAL_SHIFT 5
++#define I40E_VFINT_DYN_CTLN1_SW_ITR_INDX_ENA_SHIFT 24
++#define I40E_VFINT_DYN_CTLN1_SW_ITR_INDX_ENA_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN1_SW_ITR_INDX_ENA_SHIFT)
++#define I40E_VFINT_ICR0_ENA1 0x00005000 /* Reset: CORER */
++#define I40E_VFINT_ICR0_ENA1_ADMINQ_SHIFT 30
++#define I40E_VFINT_ICR0_ENA1_ADMINQ_MASK I40E_MASK(0x1, I40E_VFINT_ICR0_ENA1_ADMINQ_SHIFT)
++#define I40E_VFINT_ICR0_ENA1_RSVD_SHIFT 31
++#define I40E_VFINT_ICR01 0x00004800 /* Reset: CORER */
++#define I40E_VFINT_ITRN1(_i, _INTVF) (0x00002800 + ((_i) * 64 + (_INTVF) * 4)) /* _i=0...2, _INTVF=0...15 */ /* Reset: VFR */
++#define I40E_QRX_TAIL1(_Q) (0x00002000 + ((_Q) * 4)) /* _i=0...15 */ /* Reset: CORER */
++#define I40E_QTX_TAIL1(_Q) (0x00000000 + ((_Q) * 4)) /* _i=0...15 */ /* Reset: PFR */
++#define I40E_VFQF_HENA(_i) (0x0000C400 + ((_i) * 4)) /* _i=0...1 */ /* Reset: CORER */
++#define I40E_VFQF_HKEY(_i) (0x0000CC00 + ((_i) * 4)) /* _i=0...12 */ /* Reset: CORER */
++#define I40E_VFQF_HKEY_MAX_INDEX 12
++#define I40E_VFQF_HLUT(_i) (0x0000D000 + ((_i) * 4)) /* _i=0...15 */ /* Reset: CORER */
++#define I40E_VFQF_HLUT_MAX_INDEX 15
++#define I40E_VFINT_DYN_CTLN1_WB_ON_ITR_SHIFT 30
++#define I40E_VFINT_DYN_CTLN1_WB_ON_ITR_MASK I40E_MASK(0x1, I40E_VFINT_DYN_CTLN1_WB_ON_ITR_SHIFT)
++#endif /* _I40E_REGISTER_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_status.h b/drivers/net/ethernet/intel/iavf/i40e_status.h
+new file mode 100644
+index 0000000000000..77be0702d07c8
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_status.h
+@@ -0,0 +1,78 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40E_STATUS_H_
++#define _I40E_STATUS_H_
++
++/* Error Codes */
++enum i40e_status_code {
++ I40E_SUCCESS = 0,
++ I40E_ERR_NVM = -1,
++ I40E_ERR_NVM_CHECKSUM = -2,
++ I40E_ERR_PHY = -3,
++ I40E_ERR_CONFIG = -4,
++ I40E_ERR_PARAM = -5,
++ I40E_ERR_MAC_TYPE = -6,
++ I40E_ERR_UNKNOWN_PHY = -7,
++ I40E_ERR_LINK_SETUP = -8,
++ I40E_ERR_ADAPTER_STOPPED = -9,
++ I40E_ERR_INVALID_MAC_ADDR = -10,
++ I40E_ERR_DEVICE_NOT_SUPPORTED = -11,
++ I40E_ERR_MASTER_REQUESTS_PENDING = -12,
++ I40E_ERR_INVALID_LINK_SETTINGS = -13,
++ I40E_ERR_AUTONEG_NOT_COMPLETE = -14,
++ I40E_ERR_RESET_FAILED = -15,
++ I40E_ERR_SWFW_SYNC = -16,
++ I40E_ERR_NO_AVAILABLE_VSI = -17,
++ I40E_ERR_NO_MEMORY = -18,
++ I40E_ERR_BAD_PTR = -19,
++ I40E_ERR_RING_FULL = -20,
++ I40E_ERR_INVALID_PD_ID = -21,
++ I40E_ERR_INVALID_QP_ID = -22,
++ I40E_ERR_INVALID_CQ_ID = -23,
++ I40E_ERR_INVALID_CEQ_ID = -24,
++ I40E_ERR_INVALID_AEQ_ID = -25,
++ I40E_ERR_INVALID_SIZE = -26,
++ I40E_ERR_INVALID_ARP_INDEX = -27,
++ I40E_ERR_INVALID_FPM_FUNC_ID = -28,
++ I40E_ERR_QP_INVALID_MSG_SIZE = -29,
++ I40E_ERR_QP_TOOMANY_WRS_POSTED = -30,
++ I40E_ERR_INVALID_FRAG_COUNT = -31,
++ I40E_ERR_QUEUE_EMPTY = -32,
++ I40E_ERR_INVALID_ALIGNMENT = -33,
++ I40E_ERR_FLUSHED_QUEUE = -34,
++ I40E_ERR_INVALID_PUSH_PAGE_INDEX = -35,
++ I40E_ERR_INVALID_IMM_DATA_SIZE = -36,
++ I40E_ERR_TIMEOUT = -37,
++ I40E_ERR_OPCODE_MISMATCH = -38,
++ I40E_ERR_CQP_COMPL_ERROR = -39,
++ I40E_ERR_INVALID_VF_ID = -40,
++ I40E_ERR_INVALID_HMCFN_ID = -41,
++ I40E_ERR_BACKING_PAGE_ERROR = -42,
++ I40E_ERR_NO_PBLCHUNKS_AVAILABLE = -43,
++ I40E_ERR_INVALID_PBLE_INDEX = -44,
++ I40E_ERR_INVALID_SD_INDEX = -45,
++ I40E_ERR_INVALID_PAGE_DESC_INDEX = -46,
++ I40E_ERR_INVALID_SD_TYPE = -47,
++ I40E_ERR_MEMCPY_FAILED = -48,
++ I40E_ERR_INVALID_HMC_OBJ_INDEX = -49,
++ I40E_ERR_INVALID_HMC_OBJ_COUNT = -50,
++ I40E_ERR_INVALID_SRQ_ARM_LIMIT = -51,
++ I40E_ERR_SRQ_ENABLED = -52,
++ I40E_ERR_ADMIN_QUEUE_ERROR = -53,
++ I40E_ERR_ADMIN_QUEUE_TIMEOUT = -54,
++ I40E_ERR_BUF_TOO_SHORT = -55,
++ I40E_ERR_ADMIN_QUEUE_FULL = -56,
++ I40E_ERR_ADMIN_QUEUE_NO_WORK = -57,
++ I40E_ERR_BAD_IWARP_CQE = -58,
++ I40E_ERR_NVM_BLANK_MODE = -59,
++ I40E_ERR_NOT_IMPLEMENTED = -60,
++ I40E_ERR_PE_DOORBELL_NOT_ENABLED = -61,
++ I40E_ERR_DIAG_TEST_FAILED = -62,
++ I40E_ERR_NOT_READY = -63,
++ I40E_NOT_SUPPORTED = -64,
++ I40E_ERR_FIRMWARE_API_VERSION = -65,
++ I40E_ERR_ADMIN_QUEUE_CRITICAL_ERROR = -66,
++};
++
++#endif /* _I40E_STATUS_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_trace.h b/drivers/net/ethernet/intel/iavf/i40e_trace.h
+new file mode 100644
+index 0000000000000..d7a4e68820a89
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_trace.h
+@@ -0,0 +1,209 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++/* Modeled on trace-events-sample.h */
++
++/* The trace subsystem name for i40evf will be "i40evf".
++ *
++ * This file is named i40e_trace.h.
++ *
++ * Since this include file's name is different from the trace
++ * subsystem name, we'll have to define TRACE_INCLUDE_FILE at the end
++ * of this file.
++ */
++#undef TRACE_SYSTEM
++#define TRACE_SYSTEM i40evf
++
++/* See trace-events-sample.h for a detailed description of why this
++ * guard clause is different from most normal include files.
++ */
++#if !defined(_I40E_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ)
++#define _I40E_TRACE_H_
++
++#include <linux/tracepoint.h>
++
++/**
++ * i40e_trace() macro enables shared code to refer to trace points
++ * like:
++ *
++ * trace_i40e{,vf}_example(args...)
++ *
++ * ... as:
++ *
++ * i40e_trace(example, args...)
++ *
++ * ... to resolve to the PF or VF version of the tracepoint without
++ * ifdefs, and to allow tracepoints to be disabled entirely at build
++ * time.
++ *
++ * Trace point should always be referred to in the driver via this
++ * macro.
++ *
++ * Similarly, i40e_trace_enabled(trace_name) wraps references to
++ * trace_i40e{,vf}_<trace_name>_enabled() functions.
++ */
++#define _I40E_TRACE_NAME(trace_name) (trace_ ## i40evf ## _ ## trace_name)
++#define I40E_TRACE_NAME(trace_name) _I40E_TRACE_NAME(trace_name)
++
++#define i40e_trace(trace_name, args...) I40E_TRACE_NAME(trace_name)(args)
++
++#define i40e_trace_enabled(trace_name) I40E_TRACE_NAME(trace_name##_enabled)()
++
++/* Events common to PF and VF. Corresponding versions will be defined
++ * for both, named trace_i40e_* and trace_i40evf_*. The i40e_trace()
++ * macro above will select the right trace point name for the driver
++ * being built from shared code.
++ */
++
++/* Events related to a vsi & ring */
++DECLARE_EVENT_CLASS(
++ i40evf_tx_template,
++
++ TP_PROTO(struct i40e_ring *ring,
++ struct i40e_tx_desc *desc,
++ struct i40e_tx_buffer *buf),
++
++ TP_ARGS(ring, desc, buf),
++
++ /* The convention here is to make the first fields in the
++ * TP_STRUCT match the TP_PROTO exactly. This enables the use
++ * of the args struct generated by the tplist tool (from the
++ * bcc-tools package) to be used for those fields. To access
++ * fields other than the tracepoint args will require the
++ * tplist output to be adjusted.
++ */
++ TP_STRUCT__entry(
++ __field(void*, ring)
++ __field(void*, desc)
++ __field(void*, buf)
++ __string(devname, ring->netdev->name)
++ ),
++
++ TP_fast_assign(
++ __entry->ring = ring;
++ __entry->desc = desc;
++ __entry->buf = buf;
++ __assign_str(devname, ring->netdev->name);
++ ),
++
++ TP_printk(
++ "netdev: %s ring: %p desc: %p buf %p",
++ __get_str(devname), __entry->ring,
++ __entry->desc, __entry->buf)
++);
++
++DEFINE_EVENT(
++ i40evf_tx_template, i40evf_clean_tx_irq,
++ TP_PROTO(struct i40e_ring *ring,
++ struct i40e_tx_desc *desc,
++ struct i40e_tx_buffer *buf),
++
++ TP_ARGS(ring, desc, buf));
++
++DEFINE_EVENT(
++ i40evf_tx_template, i40evf_clean_tx_irq_unmap,
++ TP_PROTO(struct i40e_ring *ring,
++ struct i40e_tx_desc *desc,
++ struct i40e_tx_buffer *buf),
++
++ TP_ARGS(ring, desc, buf));
++
++DECLARE_EVENT_CLASS(
++ i40evf_rx_template,
++
++ TP_PROTO(struct i40e_ring *ring,
++ union i40e_32byte_rx_desc *desc,
++ struct sk_buff *skb),
++
++ TP_ARGS(ring, desc, skb),
++
++ TP_STRUCT__entry(
++ __field(void*, ring)
++ __field(void*, desc)
++ __field(void*, skb)
++ __string(devname, ring->netdev->name)
++ ),
++
++ TP_fast_assign(
++ __entry->ring = ring;
++ __entry->desc = desc;
++ __entry->skb = skb;
++ __assign_str(devname, ring->netdev->name);
++ ),
++
++ TP_printk(
++ "netdev: %s ring: %p desc: %p skb %p",
++ __get_str(devname), __entry->ring,
++ __entry->desc, __entry->skb)
++);
++
++DEFINE_EVENT(
++ i40evf_rx_template, i40evf_clean_rx_irq,
++ TP_PROTO(struct i40e_ring *ring,
++ union i40e_32byte_rx_desc *desc,
++ struct sk_buff *skb),
++
++ TP_ARGS(ring, desc, skb));
++
++DEFINE_EVENT(
++ i40evf_rx_template, i40evf_clean_rx_irq_rx,
++ TP_PROTO(struct i40e_ring *ring,
++ union i40e_32byte_rx_desc *desc,
++ struct sk_buff *skb),
++
++ TP_ARGS(ring, desc, skb));
++
++DECLARE_EVENT_CLASS(
++ i40evf_xmit_template,
++
++ TP_PROTO(struct sk_buff *skb,
++ struct i40e_ring *ring),
++
++ TP_ARGS(skb, ring),
++
++ TP_STRUCT__entry(
++ __field(void*, skb)
++ __field(void*, ring)
++ __string(devname, ring->netdev->name)
++ ),
++
++ TP_fast_assign(
++ __entry->skb = skb;
++ __entry->ring = ring;
++ __assign_str(devname, ring->netdev->name);
++ ),
++
++ TP_printk(
++ "netdev: %s skb: %p ring: %p",
++ __get_str(devname), __entry->skb,
++ __entry->ring)
++);
++
++DEFINE_EVENT(
++ i40evf_xmit_template, i40evf_xmit_frame_ring,
++ TP_PROTO(struct sk_buff *skb,
++ struct i40e_ring *ring),
++
++ TP_ARGS(skb, ring));
++
++DEFINE_EVENT(
++ i40evf_xmit_template, i40evf_xmit_frame_ring_drop,
++ TP_PROTO(struct sk_buff *skb,
++ struct i40e_ring *ring),
++
++ TP_ARGS(skb, ring));
++
++/* Events unique to the VF. */
++
++#endif /* _I40E_TRACE_H_ */
++/* This must be outside ifdef _I40E_TRACE_H */
++
++/* This trace include file is not located in the .../include/trace
++ * with the kernel tracepoint definitions, because we're a loadable
++ * module.
++ */
++#undef TRACE_INCLUDE_PATH
++#define TRACE_INCLUDE_PATH .
++#undef TRACE_INCLUDE_FILE
++#define TRACE_INCLUDE_FILE i40e_trace
++#include <trace/define_trace.h>
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_txrx.c b/drivers/net/ethernet/intel/iavf/i40e_txrx.c
+new file mode 100644
+index 0000000000000..d4bd06adc1453
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_txrx.c
+@@ -0,0 +1,2513 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#include <linux/prefetch.h>
++#include <net/busy_poll.h>
++
++#include "i40evf.h"
++#include "i40e_trace.h"
++#include "i40e_prototype.h"
++
++static inline __le64 build_ctob(u32 td_cmd, u32 td_offset, unsigned int size,
++ u32 td_tag)
++{
++ return cpu_to_le64(I40E_TX_DESC_DTYPE_DATA |
++ ((u64)td_cmd << I40E_TXD_QW1_CMD_SHIFT) |
++ ((u64)td_offset << I40E_TXD_QW1_OFFSET_SHIFT) |
++ ((u64)size << I40E_TXD_QW1_TX_BUF_SZ_SHIFT) |
++ ((u64)td_tag << I40E_TXD_QW1_L2TAG1_SHIFT));
++}
++
++#define I40E_TXD_CMD (I40E_TX_DESC_CMD_EOP | I40E_TX_DESC_CMD_RS)
++
++/**
++ * i40e_unmap_and_free_tx_resource - Release a Tx buffer
++ * @ring: the ring that owns the buffer
++ * @tx_buffer: the buffer to free
++ **/
++static void i40e_unmap_and_free_tx_resource(struct i40e_ring *ring,
++ struct i40e_tx_buffer *tx_buffer)
++{
++ if (tx_buffer->skb) {
++ if (tx_buffer->tx_flags & I40E_TX_FLAGS_FD_SB)
++ kfree(tx_buffer->raw_buf);
++ else
++ dev_kfree_skb_any(tx_buffer->skb);
++ if (dma_unmap_len(tx_buffer, len))
++ dma_unmap_single(ring->dev,
++ dma_unmap_addr(tx_buffer, dma),
++ dma_unmap_len(tx_buffer, len),
++ DMA_TO_DEVICE);
++ } else if (dma_unmap_len(tx_buffer, len)) {
++ dma_unmap_page(ring->dev,
++ dma_unmap_addr(tx_buffer, dma),
++ dma_unmap_len(tx_buffer, len),
++ DMA_TO_DEVICE);
++ }
++
++ tx_buffer->next_to_watch = NULL;
++ tx_buffer->skb = NULL;
++ dma_unmap_len_set(tx_buffer, len, 0);
++ /* tx_buffer must be completely set up in the transmit path */
++}
++
++/**
++ * i40evf_clean_tx_ring - Free any empty Tx buffers
++ * @tx_ring: ring to be cleaned
++ **/
++void i40evf_clean_tx_ring(struct i40e_ring *tx_ring)
++{
++ unsigned long bi_size;
++ u16 i;
++
++ /* ring already cleared, nothing to do */
++ if (!tx_ring->tx_bi)
++ return;
++
++ /* Free all the Tx ring sk_buffs */
++ for (i = 0; i < tx_ring->count; i++)
++ i40e_unmap_and_free_tx_resource(tx_ring, &tx_ring->tx_bi[i]);
++
++ bi_size = sizeof(struct i40e_tx_buffer) * tx_ring->count;
++ memset(tx_ring->tx_bi, 0, bi_size);
++
++ /* Zero out the descriptor ring */
++ memset(tx_ring->desc, 0, tx_ring->size);
++
++ tx_ring->next_to_use = 0;
++ tx_ring->next_to_clean = 0;
++
++ if (!tx_ring->netdev)
++ return;
++
++ /* cleanup Tx queue statistics */
++ netdev_tx_reset_queue(txring_txq(tx_ring));
++}
++
++/**
++ * i40evf_free_tx_resources - Free Tx resources per queue
++ * @tx_ring: Tx descriptor ring for a specific queue
++ *
++ * Free all transmit software resources
++ **/
++void i40evf_free_tx_resources(struct i40e_ring *tx_ring)
++{
++ i40evf_clean_tx_ring(tx_ring);
++ kfree(tx_ring->tx_bi);
++ tx_ring->tx_bi = NULL;
++
++ if (tx_ring->desc) {
++ dma_free_coherent(tx_ring->dev, tx_ring->size,
++ tx_ring->desc, tx_ring->dma);
++ tx_ring->desc = NULL;
++ }
++}
++
++/**
++ * i40evf_get_tx_pending - how many Tx descriptors not processed
++ * @ring: the ring of descriptors
++ * @in_sw: is tx_pending being checked in SW or HW
++ *
++ * Since there is no access to the ring head register
++ * in XL710, we need to use our local copies
++ **/
++u32 i40evf_get_tx_pending(struct i40e_ring *ring, bool in_sw)
++{
++ u32 head, tail;
++
++ /* underlying hardware might not allow access and/or always return
++ * 0 for the head/tail registers so just use the cached values
++ */
++ head = ring->next_to_clean;
++ tail = ring->next_to_use;
++
++ if (head != tail)
++ return (head < tail) ?
++ tail - head : (tail + ring->count - head);
++
++ return 0;
++}
++
++/**
++ * i40evf_detect_recover_hung - Function to detect and recover hung_queues
++ * @vsi: pointer to vsi struct with tx queues
++ *
++ * VSI has netdev and netdev has TX queues. This function is to check each of
++ * those TX queues if they are hung, trigger recovery by issuing SW interrupt.
++ **/
++void i40evf_detect_recover_hung(struct i40e_vsi *vsi)
++{
++ struct i40e_ring *tx_ring = NULL;
++ struct net_device *netdev;
++ unsigned int i;
++ int packets;
++
++ if (!vsi)
++ return;
++
++ if (test_bit(__I40E_VSI_DOWN, vsi->state))
++ return;
++
++ netdev = vsi->netdev;
++ if (!netdev)
++ return;
++
++ if (!netif_carrier_ok(netdev))
++ return;
++
++ for (i = 0; i < vsi->back->num_active_queues; i++) {
++ tx_ring = &vsi->back->tx_rings[i];
++ if (tx_ring && tx_ring->desc) {
++ /* If packet counter has not changed the queue is
++ * likely stalled, so force an interrupt for this
++ * queue.
++ *
++ * prev_pkt_ctr would be negative if there was no
++ * pending work.
++ */
++ packets = tx_ring->stats.packets & INT_MAX;
++ if (tx_ring->tx_stats.prev_pkt_ctr == packets) {
++ i40evf_force_wb(vsi, tx_ring->q_vector);
++ continue;
++ }
++
++ /* Memory barrier between read of packet count and call
++ * to i40evf_get_tx_pending()
++ */
++ smp_rmb();
++ tx_ring->tx_stats.prev_pkt_ctr =
++ i40evf_get_tx_pending(tx_ring, true) ? packets : -1;
++ }
++ }
++}
++
++#define WB_STRIDE 4
++
++/**
++ * i40e_clean_tx_irq - Reclaim resources after transmit completes
++ * @vsi: the VSI we care about
++ * @tx_ring: Tx ring to clean
++ * @napi_budget: Used to determine if we are in netpoll
++ *
++ * Returns true if there's any budget left (e.g. the clean is finished)
++ **/
++static bool i40e_clean_tx_irq(struct i40e_vsi *vsi,
++ struct i40e_ring *tx_ring, int napi_budget)
++{
++ u16 i = tx_ring->next_to_clean;
++ struct i40e_tx_buffer *tx_buf;
++ struct i40e_tx_desc *tx_desc;
++ unsigned int total_bytes = 0, total_packets = 0;
++ unsigned int budget = vsi->work_limit;
++
++ tx_buf = &tx_ring->tx_bi[i];
++ tx_desc = I40E_TX_DESC(tx_ring, i);
++ i -= tx_ring->count;
++
++ do {
++ struct i40e_tx_desc *eop_desc = tx_buf->next_to_watch;
++
++ /* if next_to_watch is not set then there is no work pending */
++ if (!eop_desc)
++ break;
++
++ /* prevent any other reads prior to eop_desc */
++ smp_rmb();
++
++ i40e_trace(clean_tx_irq, tx_ring, tx_desc, tx_buf);
++ /* if the descriptor isn't done, no work yet to do */
++ if (!(eop_desc->cmd_type_offset_bsz &
++ cpu_to_le64(I40E_TX_DESC_DTYPE_DESC_DONE)))
++ break;
++
++ /* clear next_to_watch to prevent false hangs */
++ tx_buf->next_to_watch = NULL;
++
++ /* update the statistics for this packet */
++ total_bytes += tx_buf->bytecount;
++ total_packets += tx_buf->gso_segs;
++
++ /* free the skb */
++ napi_consume_skb(tx_buf->skb, napi_budget);
++
++ /* unmap skb header data */
++ dma_unmap_single(tx_ring->dev,
++ dma_unmap_addr(tx_buf, dma),
++ dma_unmap_len(tx_buf, len),
++ DMA_TO_DEVICE);
++
++ /* clear tx_buffer data */
++ tx_buf->skb = NULL;
++ dma_unmap_len_set(tx_buf, len, 0);
++
++ /* unmap remaining buffers */
++ while (tx_desc != eop_desc) {
++ i40e_trace(clean_tx_irq_unmap,
++ tx_ring, tx_desc, tx_buf);
++
++ tx_buf++;
++ tx_desc++;
++ i++;
++ if (unlikely(!i)) {
++ i -= tx_ring->count;
++ tx_buf = tx_ring->tx_bi;
++ tx_desc = I40E_TX_DESC(tx_ring, 0);
++ }
++
++ /* unmap any remaining paged data */
++ if (dma_unmap_len(tx_buf, len)) {
++ dma_unmap_page(tx_ring->dev,
++ dma_unmap_addr(tx_buf, dma),
++ dma_unmap_len(tx_buf, len),
++ DMA_TO_DEVICE);
++ dma_unmap_len_set(tx_buf, len, 0);
++ }
++ }
++
++ /* move us one more past the eop_desc for start of next pkt */
++ tx_buf++;
++ tx_desc++;
++ i++;
++ if (unlikely(!i)) {
++ i -= tx_ring->count;
++ tx_buf = tx_ring->tx_bi;
++ tx_desc = I40E_TX_DESC(tx_ring, 0);
++ }
++
++ prefetch(tx_desc);
++
++ /* update budget accounting */
++ budget--;
++ } while (likely(budget));
++
++ i += tx_ring->count;
++ tx_ring->next_to_clean = i;
++ u64_stats_update_begin(&tx_ring->syncp);
++ tx_ring->stats.bytes += total_bytes;
++ tx_ring->stats.packets += total_packets;
++ u64_stats_update_end(&tx_ring->syncp);
++ tx_ring->q_vector->tx.total_bytes += total_bytes;
++ tx_ring->q_vector->tx.total_packets += total_packets;
++
++ if (tx_ring->flags & I40E_TXR_FLAGS_WB_ON_ITR) {
++ /* check to see if there are < 4 descriptors
++ * waiting to be written back, then kick the hardware to force
++ * them to be written back in case we stay in NAPI.
++ * In this mode on X722 we do not enable Interrupt.
++ */
++ unsigned int j = i40evf_get_tx_pending(tx_ring, false);
++
++ if (budget &&
++ ((j / WB_STRIDE) == 0) && (j > 0) &&
++ !test_bit(__I40E_VSI_DOWN, vsi->state) &&
++ (I40E_DESC_UNUSED(tx_ring) != tx_ring->count))
++ tx_ring->arm_wb = true;
++ }
++
++ /* notify netdev of completed buffers */
++ netdev_tx_completed_queue(txring_txq(tx_ring),
++ total_packets, total_bytes);
++
++#define TX_WAKE_THRESHOLD ((s16)(DESC_NEEDED * 2))
++ if (unlikely(total_packets && netif_carrier_ok(tx_ring->netdev) &&
++ (I40E_DESC_UNUSED(tx_ring) >= TX_WAKE_THRESHOLD))) {
++ /* Make sure that anybody stopping the queue after this
++ * sees the new next_to_clean.
++ */
++ smp_mb();
++ if (__netif_subqueue_stopped(tx_ring->netdev,
++ tx_ring->queue_index) &&
++ !test_bit(__I40E_VSI_DOWN, vsi->state)) {
++ netif_wake_subqueue(tx_ring->netdev,
++ tx_ring->queue_index);
++ ++tx_ring->tx_stats.restart_queue;
++ }
++ }
++
++ return !!budget;
++}
++
++/**
++ * i40evf_enable_wb_on_itr - Arm hardware to do a wb, interrupts are not enabled
++ * @vsi: the VSI we care about
++ * @q_vector: the vector on which to enable writeback
++ *
++ **/
++static void i40e_enable_wb_on_itr(struct i40e_vsi *vsi,
++ struct i40e_q_vector *q_vector)
++{
++ u16 flags = q_vector->tx.ring[0].flags;
++ u32 val;
++
++ if (!(flags & I40E_TXR_FLAGS_WB_ON_ITR))
++ return;
++
++ if (q_vector->arm_wb_state)
++ return;
++
++ val = I40E_VFINT_DYN_CTLN1_WB_ON_ITR_MASK |
++ I40E_VFINT_DYN_CTLN1_ITR_INDX_MASK; /* set noitr */
++
++ wr32(&vsi->back->hw,
++ I40E_VFINT_DYN_CTLN1(q_vector->reg_idx), val);
++ q_vector->arm_wb_state = true;
++}
++
++/**
++ * i40evf_force_wb - Issue SW Interrupt so HW does a wb
++ * @vsi: the VSI we care about
++ * @q_vector: the vector on which to force writeback
++ *
++ **/
++void i40evf_force_wb(struct i40e_vsi *vsi, struct i40e_q_vector *q_vector)
++{
++ u32 val = I40E_VFINT_DYN_CTLN1_INTENA_MASK |
++ I40E_VFINT_DYN_CTLN1_ITR_INDX_MASK | /* set noitr */
++ I40E_VFINT_DYN_CTLN1_SWINT_TRIG_MASK |
++ I40E_VFINT_DYN_CTLN1_SW_ITR_INDX_ENA_MASK
++ /* allow 00 to be written to the index */;
++
++ wr32(&vsi->back->hw,
++ I40E_VFINT_DYN_CTLN1(q_vector->reg_idx),
++ val);
++}
++
++static inline bool i40e_container_is_rx(struct i40e_q_vector *q_vector,
++ struct i40e_ring_container *rc)
++{
++ return &q_vector->rx == rc;
++}
++
++static inline unsigned int i40e_itr_divisor(struct i40e_q_vector *q_vector)
++{
++ unsigned int divisor;
++
++ switch (q_vector->adapter->link_speed) {
++ case I40E_LINK_SPEED_40GB:
++ divisor = I40E_ITR_ADAPTIVE_MIN_INC * 1024;
++ break;
++ case I40E_LINK_SPEED_25GB:
++ case I40E_LINK_SPEED_20GB:
++ divisor = I40E_ITR_ADAPTIVE_MIN_INC * 512;
++ break;
++ default:
++ case I40E_LINK_SPEED_10GB:
++ divisor = I40E_ITR_ADAPTIVE_MIN_INC * 256;
++ break;
++ case I40E_LINK_SPEED_1GB:
++ case I40E_LINK_SPEED_100MB:
++ divisor = I40E_ITR_ADAPTIVE_MIN_INC * 32;
++ break;
++ }
++
++ return divisor;
++}
++
++/**
++ * i40e_update_itr - update the dynamic ITR value based on statistics
++ * @q_vector: structure containing interrupt and ring information
++ * @rc: structure containing ring performance data
++ *
++ * Stores a new ITR value based on packets and byte
++ * counts during the last interrupt. The advantage of per interrupt
++ * computation is faster updates and more accurate ITR for the current
++ * traffic pattern. Constants in this function were computed
++ * based on theoretical maximum wire speed and thresholds were set based
++ * on testing data as well as attempting to minimize response time
++ * while increasing bulk throughput.
++ **/
++static void i40e_update_itr(struct i40e_q_vector *q_vector,
++ struct i40e_ring_container *rc)
++{
++ unsigned int avg_wire_size, packets, bytes, itr;
++ unsigned long next_update = jiffies;
++
++ /* If we don't have any rings just leave ourselves set for maximum
++ * possible latency so we take ourselves out of the equation.
++ */
++ if (!rc->ring || !ITR_IS_DYNAMIC(rc->ring->itr_setting))
++ return;
++
++ /* For Rx we want to push the delay up and default to low latency.
++ * for Tx we want to pull the delay down and default to high latency.
++ */
++ itr = i40e_container_is_rx(q_vector, rc) ?
++ I40E_ITR_ADAPTIVE_MIN_USECS | I40E_ITR_ADAPTIVE_LATENCY :
++ I40E_ITR_ADAPTIVE_MAX_USECS | I40E_ITR_ADAPTIVE_LATENCY;
++
++ /* If we didn't update within up to 1 - 2 jiffies we can assume
++ * that either packets are coming in so slow there hasn't been
++ * any work, or that there is so much work that NAPI is dealing
++ * with interrupt moderation and we don't need to do anything.
++ */
++ if (time_after(next_update, rc->next_update))
++ goto clear_counts;
++
++ /* If itr_countdown is set it means we programmed an ITR within
++ * the last 4 interrupt cycles. This has a side effect of us
++ * potentially firing an early interrupt. In order to work around
++ * this we need to throw out any data received for a few
++ * interrupts following the update.
++ */
++ if (q_vector->itr_countdown) {
++ itr = rc->target_itr;
++ goto clear_counts;
++ }
++
++ packets = rc->total_packets;
++ bytes = rc->total_bytes;
++
++ if (i40e_container_is_rx(q_vector, rc)) {
++ /* If Rx there are 1 to 4 packets and bytes are less than
++ * 9000 assume insufficient data to use bulk rate limiting
++ * approach unless Tx is already in bulk rate limiting. We
++ * are likely latency driven.
++ */
++ if (packets && packets < 4 && bytes < 9000 &&
++ (q_vector->tx.target_itr & I40E_ITR_ADAPTIVE_LATENCY)) {
++ itr = I40E_ITR_ADAPTIVE_LATENCY;
++ goto adjust_by_size;
++ }
++ } else if (packets < 4) {
++ /* If we have Tx and Rx ITR maxed and Tx ITR is running in
++ * bulk mode and we are receiving 4 or fewer packets just
++ * reset the ITR_ADAPTIVE_LATENCY bit for latency mode so
++ * that the Rx can relax.
++ */
++ if (rc->target_itr == I40E_ITR_ADAPTIVE_MAX_USECS &&
++ (q_vector->rx.target_itr & I40E_ITR_MASK) ==
++ I40E_ITR_ADAPTIVE_MAX_USECS)
++ goto clear_counts;
++ } else if (packets > 32) {
++ /* If we have processed over 32 packets in a single interrupt
++ * for Tx assume we need to switch over to "bulk" mode.
++ */
++ rc->target_itr &= ~I40E_ITR_ADAPTIVE_LATENCY;
++ }
++
++ /* We have no packets to actually measure against. This means
++ * either one of the other queues on this vector is active or
++ * we are a Tx queue doing TSO with too high of an interrupt rate.
++ *
++ * Between 4 and 56 we can assume that our current interrupt delay
++ * is only slightly too low. As such we should increase it by a small
++ * fixed amount.
++ */
++ if (packets < 56) {
++ itr = rc->target_itr + I40E_ITR_ADAPTIVE_MIN_INC;
++ if ((itr & I40E_ITR_MASK) > I40E_ITR_ADAPTIVE_MAX_USECS) {
++ itr &= I40E_ITR_ADAPTIVE_LATENCY;
++ itr += I40E_ITR_ADAPTIVE_MAX_USECS;
++ }
++ goto clear_counts;
++ }
++
++ if (packets <= 256) {
++ itr = min(q_vector->tx.current_itr, q_vector->rx.current_itr);
++ itr &= I40E_ITR_MASK;
++
++ /* Between 56 and 112 is our "goldilocks" zone where we are
++ * working out "just right". Just report that our current
++ * ITR is good for us.
++ */
++ if (packets <= 112)
++ goto clear_counts;
++
++ /* If packet count is 128 or greater we are likely looking
++ * at a slight overrun of the delay we want. Try halving
++ * our delay to see if that will cut the number of packets
++ * in half per interrupt.
++ */
++ itr /= 2;
++ itr &= I40E_ITR_MASK;
++ if (itr < I40E_ITR_ADAPTIVE_MIN_USECS)
++ itr = I40E_ITR_ADAPTIVE_MIN_USECS;
++
++ goto clear_counts;
++ }
++
++ /* The paths below assume we are dealing with a bulk ITR since
++ * number of packets is greater than 256. We are just going to have
++ * to compute a value and try to bring the count under control,
++ * though for smaller packet sizes there isn't much we can do as
++ * NAPI polling will likely be kicking in sooner rather than later.
++ */
++ itr = I40E_ITR_ADAPTIVE_BULK;
++
++adjust_by_size:
++ /* If packet counts are 256 or greater we can assume we have a gross
++ * overestimation of what the rate should be. Instead of trying to fine
++ * tune it just use the formula below to try and dial in an exact value
++ * give the current packet size of the frame.
++ */
++ avg_wire_size = bytes / packets;
++
++ /* The following is a crude approximation of:
++ * wmem_default / (size + overhead) = desired_pkts_per_int
++ * rate / bits_per_byte / (size + ethernet overhead) = pkt_rate
++ * (desired_pkt_rate / pkt_rate) * usecs_per_sec = ITR value
++ *
++ * Assuming wmem_default is 212992 and overhead is 640 bytes per
++ * packet, (256 skb, 64 headroom, 320 shared info), we can reduce the
++ * formula down to
++ *
++ * (170 * (size + 24)) / (size + 640) = ITR
++ *
++ * We first do some math on the packet size and then finally bitshift
++ * by 8 after rounding up. We also have to account for PCIe link speed
++ * difference as ITR scales based on this.
++ */
++ if (avg_wire_size <= 60) {
++ /* Start at 250k ints/sec */
++ avg_wire_size = 4096;
++ } else if (avg_wire_size <= 380) {
++ /* 250K ints/sec to 60K ints/sec */
++ avg_wire_size *= 40;
++ avg_wire_size += 1696;
++ } else if (avg_wire_size <= 1084) {
++ /* 60K ints/sec to 36K ints/sec */
++ avg_wire_size *= 15;
++ avg_wire_size += 11452;
++ } else if (avg_wire_size <= 1980) {
++ /* 36K ints/sec to 30K ints/sec */
++ avg_wire_size *= 5;
++ avg_wire_size += 22420;
++ } else {
++ /* plateau at a limit of 30K ints/sec */
++ avg_wire_size = 32256;
++ }
++
++ /* If we are in low latency mode halve our delay which doubles the
++ * rate to somewhere between 100K to 16K ints/sec
++ */
++ if (itr & I40E_ITR_ADAPTIVE_LATENCY)
++ avg_wire_size /= 2;
++
++ /* Resultant value is 256 times larger than it needs to be. This
++ * gives us room to adjust the value as needed to either increase
++ * or decrease the value based on link speeds of 10G, 2.5G, 1G, etc.
++ *
++ * Use addition as we have already recorded the new latency flag
++ * for the ITR value.
++ */
++ itr += DIV_ROUND_UP(avg_wire_size, i40e_itr_divisor(q_vector)) *
++ I40E_ITR_ADAPTIVE_MIN_INC;
++
++ if ((itr & I40E_ITR_MASK) > I40E_ITR_ADAPTIVE_MAX_USECS) {
++ itr &= I40E_ITR_ADAPTIVE_LATENCY;
++ itr += I40E_ITR_ADAPTIVE_MAX_USECS;
++ }
++
++clear_counts:
++ /* write back value */
++ rc->target_itr = itr;
++
++ /* next update should occur within next jiffy */
++ rc->next_update = next_update + 1;
++
++ rc->total_bytes = 0;
++ rc->total_packets = 0;
++}
++
++/**
++ * i40evf_setup_tx_descriptors - Allocate the Tx descriptors
++ * @tx_ring: the tx ring to set up
++ *
++ * Return 0 on success, negative on error
++ **/
++int i40evf_setup_tx_descriptors(struct i40e_ring *tx_ring)
++{
++ struct device *dev = tx_ring->dev;
++ int bi_size;
++
++ if (!dev)
++ return -ENOMEM;
++
++ /* warn if we are about to overwrite the pointer */
++ WARN_ON(tx_ring->tx_bi);
++ bi_size = sizeof(struct i40e_tx_buffer) * tx_ring->count;
++ tx_ring->tx_bi = kzalloc(bi_size, GFP_KERNEL);
++ if (!tx_ring->tx_bi)
++ goto err;
++
++ /* round up to nearest 4K */
++ tx_ring->size = tx_ring->count * sizeof(struct i40e_tx_desc);
++ tx_ring->size = ALIGN(tx_ring->size, 4096);
++ tx_ring->desc = dma_alloc_coherent(dev, tx_ring->size,
++ &tx_ring->dma, GFP_KERNEL);
++ if (!tx_ring->desc) {
++ dev_info(dev, "Unable to allocate memory for the Tx descriptor ring, size=%d\n",
++ tx_ring->size);
++ goto err;
++ }
++
++ tx_ring->next_to_use = 0;
++ tx_ring->next_to_clean = 0;
++ tx_ring->tx_stats.prev_pkt_ctr = -1;
++ return 0;
++
++err:
++ kfree(tx_ring->tx_bi);
++ tx_ring->tx_bi = NULL;
++ return -ENOMEM;
++}
++
++/**
++ * i40evf_clean_rx_ring - Free Rx buffers
++ * @rx_ring: ring to be cleaned
++ **/
++void i40evf_clean_rx_ring(struct i40e_ring *rx_ring)
++{
++ unsigned long bi_size;
++ u16 i;
++
++ /* ring already cleared, nothing to do */
++ if (!rx_ring->rx_bi)
++ return;
++
++ if (rx_ring->skb) {
++ dev_kfree_skb(rx_ring->skb);
++ rx_ring->skb = NULL;
++ }
++
++ /* Free all the Rx ring sk_buffs */
++ for (i = 0; i < rx_ring->count; i++) {
++ struct i40e_rx_buffer *rx_bi = &rx_ring->rx_bi[i];
++
++ if (!rx_bi->page)
++ continue;
++
++ /* Invalidate cache lines that may have been written to by
++ * device so that we avoid corrupting memory.
++ */
++ dma_sync_single_range_for_cpu(rx_ring->dev,
++ rx_bi->dma,
++ rx_bi->page_offset,
++ rx_ring->rx_buf_len,
++ DMA_FROM_DEVICE);
++
++ /* free resources associated with mapping */
++ dma_unmap_page_attrs(rx_ring->dev, rx_bi->dma,
++ i40e_rx_pg_size(rx_ring),
++ DMA_FROM_DEVICE,
++ I40E_RX_DMA_ATTR);
++
++ __page_frag_cache_drain(rx_bi->page, rx_bi->pagecnt_bias);
++
++ rx_bi->page = NULL;
++ rx_bi->page_offset = 0;
++ }
++
++ bi_size = sizeof(struct i40e_rx_buffer) * rx_ring->count;
++ memset(rx_ring->rx_bi, 0, bi_size);
++
++ /* Zero out the descriptor ring */
++ memset(rx_ring->desc, 0, rx_ring->size);
++
++ rx_ring->next_to_alloc = 0;
++ rx_ring->next_to_clean = 0;
++ rx_ring->next_to_use = 0;
++}
++
++/**
++ * i40evf_free_rx_resources - Free Rx resources
++ * @rx_ring: ring to clean the resources from
++ *
++ * Free all receive software resources
++ **/
++void i40evf_free_rx_resources(struct i40e_ring *rx_ring)
++{
++ i40evf_clean_rx_ring(rx_ring);
++ kfree(rx_ring->rx_bi);
++ rx_ring->rx_bi = NULL;
++
++ if (rx_ring->desc) {
++ dma_free_coherent(rx_ring->dev, rx_ring->size,
++ rx_ring->desc, rx_ring->dma);
++ rx_ring->desc = NULL;
++ }
++}
++
++/**
++ * i40evf_setup_rx_descriptors - Allocate Rx descriptors
++ * @rx_ring: Rx descriptor ring (for a specific queue) to setup
++ *
++ * Returns 0 on success, negative on failure
++ **/
++int i40evf_setup_rx_descriptors(struct i40e_ring *rx_ring)
++{
++ struct device *dev = rx_ring->dev;
++ int bi_size;
++
++ /* warn if we are about to overwrite the pointer */
++ WARN_ON(rx_ring->rx_bi);
++ bi_size = sizeof(struct i40e_rx_buffer) * rx_ring->count;
++ rx_ring->rx_bi = kzalloc(bi_size, GFP_KERNEL);
++ if (!rx_ring->rx_bi)
++ goto err;
++
++ u64_stats_init(&rx_ring->syncp);
++
++ /* Round up to nearest 4K */
++ rx_ring->size = rx_ring->count * sizeof(union i40e_32byte_rx_desc);
++ rx_ring->size = ALIGN(rx_ring->size, 4096);
++ rx_ring->desc = dma_alloc_coherent(dev, rx_ring->size,
++ &rx_ring->dma, GFP_KERNEL);
++
++ if (!rx_ring->desc) {
++ dev_info(dev, "Unable to allocate memory for the Rx descriptor ring, size=%d\n",
++ rx_ring->size);
++ goto err;
++ }
++
++ rx_ring->next_to_alloc = 0;
++ rx_ring->next_to_clean = 0;
++ rx_ring->next_to_use = 0;
++
++ return 0;
++err:
++ kfree(rx_ring->rx_bi);
++ rx_ring->rx_bi = NULL;
++ return -ENOMEM;
++}
++
++/**
++ * i40e_release_rx_desc - Store the new tail and head values
++ * @rx_ring: ring to bump
++ * @val: new head index
++ **/
++static inline void i40e_release_rx_desc(struct i40e_ring *rx_ring, u32 val)
++{
++ rx_ring->next_to_use = val;
++
++ /* update next to alloc since we have filled the ring */
++ rx_ring->next_to_alloc = val;
++
++ /* Force memory writes to complete before letting h/w
++ * know there are new descriptors to fetch. (Only
++ * applicable for weak-ordered memory model archs,
++ * such as IA-64).
++ */
++ wmb();
++ writel(val, rx_ring->tail);
++}
++
++/**
++ * i40e_rx_offset - Return expected offset into page to access data
++ * @rx_ring: Ring we are requesting offset of
++ *
++ * Returns the offset value for ring into the data buffer.
++ */
++static inline unsigned int i40e_rx_offset(struct i40e_ring *rx_ring)
++{
++ return ring_uses_build_skb(rx_ring) ? I40E_SKB_PAD : 0;
++}
++
++/**
++ * i40e_alloc_mapped_page - recycle or make a new page
++ * @rx_ring: ring to use
++ * @bi: rx_buffer struct to modify
++ *
++ * Returns true if the page was successfully allocated or
++ * reused.
++ **/
++static bool i40e_alloc_mapped_page(struct i40e_ring *rx_ring,
++ struct i40e_rx_buffer *bi)
++{
++ struct page *page = bi->page;
++ dma_addr_t dma;
++
++ /* since we are recycling buffers we should seldom need to alloc */
++ if (likely(page)) {
++ rx_ring->rx_stats.page_reuse_count++;
++ return true;
++ }
++
++ /* alloc new page for storage */
++ page = dev_alloc_pages(i40e_rx_pg_order(rx_ring));
++ if (unlikely(!page)) {
++ rx_ring->rx_stats.alloc_page_failed++;
++ return false;
++ }
++
++ /* map page for use */
++ dma = dma_map_page_attrs(rx_ring->dev, page, 0,
++ i40e_rx_pg_size(rx_ring),
++ DMA_FROM_DEVICE,
++ I40E_RX_DMA_ATTR);
++
++ /* if mapping failed free memory back to system since
++ * there isn't much point in holding memory we can't use
++ */
++ if (dma_mapping_error(rx_ring->dev, dma)) {
++ __free_pages(page, i40e_rx_pg_order(rx_ring));
++ rx_ring->rx_stats.alloc_page_failed++;
++ return false;
++ }
++
++ bi->dma = dma;
++ bi->page = page;
++ bi->page_offset = i40e_rx_offset(rx_ring);
++
++ /* initialize pagecnt_bias to 1 representing we fully own page */
++ bi->pagecnt_bias = 1;
++
++ return true;
++}
++
++/**
++ * i40e_receive_skb - Send a completed packet up the stack
++ * @rx_ring: rx ring in play
++ * @skb: packet to send up
++ * @vlan_tag: vlan tag for packet
++ **/
++static void i40e_receive_skb(struct i40e_ring *rx_ring,
++ struct sk_buff *skb, u16 vlan_tag)
++{
++ struct i40e_q_vector *q_vector = rx_ring->q_vector;
++
++ if ((rx_ring->netdev->features & NETIF_F_HW_VLAN_CTAG_RX) &&
++ (vlan_tag & VLAN_VID_MASK))
++ __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_tag);
++
++ napi_gro_receive(&q_vector->napi, skb);
++}
++
++/**
++ * i40evf_alloc_rx_buffers - Replace used receive buffers
++ * @rx_ring: ring to place buffers on
++ * @cleaned_count: number of buffers to replace
++ *
++ * Returns false if all allocations were successful, true if any fail
++ **/
++bool i40evf_alloc_rx_buffers(struct i40e_ring *rx_ring, u16 cleaned_count)
++{
++ u16 ntu = rx_ring->next_to_use;
++ union i40e_rx_desc *rx_desc;
++ struct i40e_rx_buffer *bi;
++
++ /* do nothing if no valid netdev defined */
++ if (!rx_ring->netdev || !cleaned_count)
++ return false;
++
++ rx_desc = I40E_RX_DESC(rx_ring, ntu);
++ bi = &rx_ring->rx_bi[ntu];
++
++ do {
++ if (!i40e_alloc_mapped_page(rx_ring, bi))
++ goto no_buffers;
++
++ /* sync the buffer for use by the device */
++ dma_sync_single_range_for_device(rx_ring->dev, bi->dma,
++ bi->page_offset,
++ rx_ring->rx_buf_len,
++ DMA_FROM_DEVICE);
++
++ /* Refresh the desc even if buffer_addrs didn't change
++ * because each write-back erases this info.
++ */
++ rx_desc->read.pkt_addr = cpu_to_le64(bi->dma + bi->page_offset);
++
++ rx_desc++;
++ bi++;
++ ntu++;
++ if (unlikely(ntu == rx_ring->count)) {
++ rx_desc = I40E_RX_DESC(rx_ring, 0);
++ bi = rx_ring->rx_bi;
++ ntu = 0;
++ }
++
++ /* clear the status bits for the next_to_use descriptor */
++ rx_desc->wb.qword1.status_error_len = 0;
++
++ cleaned_count--;
++ } while (cleaned_count);
++
++ if (rx_ring->next_to_use != ntu)
++ i40e_release_rx_desc(rx_ring, ntu);
++
++ return false;
++
++no_buffers:
++ if (rx_ring->next_to_use != ntu)
++ i40e_release_rx_desc(rx_ring, ntu);
++
++ /* make sure to come back via polling to try again after
++ * allocation failure
++ */
++ return true;
++}
++
++/**
++ * i40e_rx_checksum - Indicate in skb if hw indicated a good cksum
++ * @vsi: the VSI we care about
++ * @skb: skb currently being received and modified
++ * @rx_desc: the receive descriptor
++ **/
++static inline void i40e_rx_checksum(struct i40e_vsi *vsi,
++ struct sk_buff *skb,
++ union i40e_rx_desc *rx_desc)
++{
++ struct i40e_rx_ptype_decoded decoded;
++ u32 rx_error, rx_status;
++ bool ipv4, ipv6;
++ u8 ptype;
++ u64 qword;
++
++ qword = le64_to_cpu(rx_desc->wb.qword1.status_error_len);
++ ptype = (qword & I40E_RXD_QW1_PTYPE_MASK) >> I40E_RXD_QW1_PTYPE_SHIFT;
++ rx_error = (qword & I40E_RXD_QW1_ERROR_MASK) >>
++ I40E_RXD_QW1_ERROR_SHIFT;
++ rx_status = (qword & I40E_RXD_QW1_STATUS_MASK) >>
++ I40E_RXD_QW1_STATUS_SHIFT;
++ decoded = decode_rx_desc_ptype(ptype);
++
++ skb->ip_summed = CHECKSUM_NONE;
++
++ skb_checksum_none_assert(skb);
++
++ /* Rx csum enabled and ip headers found? */
++ if (!(vsi->netdev->features & NETIF_F_RXCSUM))
++ return;
++
++ /* did the hardware decode the packet and checksum? */
++ if (!(rx_status & BIT(I40E_RX_DESC_STATUS_L3L4P_SHIFT)))
++ return;
++
++ /* both known and outer_ip must be set for the below code to work */
++ if (!(decoded.known && decoded.outer_ip))
++ return;
++
++ ipv4 = (decoded.outer_ip == I40E_RX_PTYPE_OUTER_IP) &&
++ (decoded.outer_ip_ver == I40E_RX_PTYPE_OUTER_IPV4);
++ ipv6 = (decoded.outer_ip == I40E_RX_PTYPE_OUTER_IP) &&
++ (decoded.outer_ip_ver == I40E_RX_PTYPE_OUTER_IPV6);
++
++ if (ipv4 &&
++ (rx_error & (BIT(I40E_RX_DESC_ERROR_IPE_SHIFT) |
++ BIT(I40E_RX_DESC_ERROR_EIPE_SHIFT))))
++ goto checksum_fail;
++
++ /* likely incorrect csum if alternate IP extension headers found */
++ if (ipv6 &&
++ rx_status & BIT(I40E_RX_DESC_STATUS_IPV6EXADD_SHIFT))
++ /* don't increment checksum err here, non-fatal err */
++ return;
++
++ /* there was some L4 error, count error and punt packet to the stack */
++ if (rx_error & BIT(I40E_RX_DESC_ERROR_L4E_SHIFT))
++ goto checksum_fail;
++
++ /* handle packets that were not able to be checksummed due
++ * to arrival speed, in this case the stack can compute
++ * the csum.
++ */
++ if (rx_error & BIT(I40E_RX_DESC_ERROR_PPRS_SHIFT))
++ return;
++
++ /* Only report checksum unnecessary for TCP, UDP, or SCTP */
++ switch (decoded.inner_prot) {
++ case I40E_RX_PTYPE_INNER_PROT_TCP:
++ case I40E_RX_PTYPE_INNER_PROT_UDP:
++ case I40E_RX_PTYPE_INNER_PROT_SCTP:
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
++ /* fall though */
++ default:
++ break;
++ }
++
++ return;
++
++checksum_fail:
++ vsi->back->hw_csum_rx_error++;
++}
++
++/**
++ * i40e_ptype_to_htype - get a hash type
++ * @ptype: the ptype value from the descriptor
++ *
++ * Returns a hash type to be used by skb_set_hash
++ **/
++static inline int i40e_ptype_to_htype(u8 ptype)
++{
++ struct i40e_rx_ptype_decoded decoded = decode_rx_desc_ptype(ptype);
++
++ if (!decoded.known)
++ return PKT_HASH_TYPE_NONE;
++
++ if (decoded.outer_ip == I40E_RX_PTYPE_OUTER_IP &&
++ decoded.payload_layer == I40E_RX_PTYPE_PAYLOAD_LAYER_PAY4)
++ return PKT_HASH_TYPE_L4;
++ else if (decoded.outer_ip == I40E_RX_PTYPE_OUTER_IP &&
++ decoded.payload_layer == I40E_RX_PTYPE_PAYLOAD_LAYER_PAY3)
++ return PKT_HASH_TYPE_L3;
++ else
++ return PKT_HASH_TYPE_L2;
++}
++
++/**
++ * i40e_rx_hash - set the hash value in the skb
++ * @ring: descriptor ring
++ * @rx_desc: specific descriptor
++ * @skb: skb currently being received and modified
++ * @rx_ptype: Rx packet type
++ **/
++static inline void i40e_rx_hash(struct i40e_ring *ring,
++ union i40e_rx_desc *rx_desc,
++ struct sk_buff *skb,
++ u8 rx_ptype)
++{
++ u32 hash;
++ const __le64 rss_mask =
++ cpu_to_le64((u64)I40E_RX_DESC_FLTSTAT_RSS_HASH <<
++ I40E_RX_DESC_STATUS_FLTSTAT_SHIFT);
++
++ if (!(ring->netdev->features & NETIF_F_RXHASH))
++ return;
++
++ if ((rx_desc->wb.qword1.status_error_len & rss_mask) == rss_mask) {
++ hash = le32_to_cpu(rx_desc->wb.qword0.hi_dword.rss);
++ skb_set_hash(skb, hash, i40e_ptype_to_htype(rx_ptype));
++ }
++}
++
++/**
++ * i40evf_process_skb_fields - Populate skb header fields from Rx descriptor
++ * @rx_ring: rx descriptor ring packet is being transacted on
++ * @rx_desc: pointer to the EOP Rx descriptor
++ * @skb: pointer to current skb being populated
++ * @rx_ptype: the packet type decoded by hardware
++ *
++ * This function checks the ring, descriptor, and packet information in
++ * order to populate the hash, checksum, VLAN, protocol, and
++ * other fields within the skb.
++ **/
++static inline
++void i40evf_process_skb_fields(struct i40e_ring *rx_ring,
++ union i40e_rx_desc *rx_desc, struct sk_buff *skb,
++ u8 rx_ptype)
++{
++ i40e_rx_hash(rx_ring, rx_desc, skb, rx_ptype);
++
++ i40e_rx_checksum(rx_ring->vsi, skb, rx_desc);
++
++ skb_record_rx_queue(skb, rx_ring->queue_index);
++
++ /* modifies the skb - consumes the enet header */
++ skb->protocol = eth_type_trans(skb, rx_ring->netdev);
++}
++
++/**
++ * i40e_cleanup_headers - Correct empty headers
++ * @rx_ring: rx descriptor ring packet is being transacted on
++ * @skb: pointer to current skb being fixed
++ *
++ * Also address the case where we are pulling data in on pages only
++ * and as such no data is present in the skb header.
++ *
++ * In addition if skb is not at least 60 bytes we need to pad it so that
++ * it is large enough to qualify as a valid Ethernet frame.
++ *
++ * Returns true if an error was encountered and skb was freed.
++ **/
++static bool i40e_cleanup_headers(struct i40e_ring *rx_ring, struct sk_buff *skb)
++{
++ /* if eth_skb_pad returns an error the skb was freed */
++ if (eth_skb_pad(skb))
++ return true;
++
++ return false;
++}
++
++/**
++ * i40e_reuse_rx_page - page flip buffer and store it back on the ring
++ * @rx_ring: rx descriptor ring to store buffers on
++ * @old_buff: donor buffer to have page reused
++ *
++ * Synchronizes page for reuse by the adapter
++ **/
++static void i40e_reuse_rx_page(struct i40e_ring *rx_ring,
++ struct i40e_rx_buffer *old_buff)
++{
++ struct i40e_rx_buffer *new_buff;
++ u16 nta = rx_ring->next_to_alloc;
++
++ new_buff = &rx_ring->rx_bi[nta];
++
++ /* update, and store next to alloc */
++ nta++;
++ rx_ring->next_to_alloc = (nta < rx_ring->count) ? nta : 0;
++
++ /* transfer page from old buffer to new buffer */
++ new_buff->dma = old_buff->dma;
++ new_buff->page = old_buff->page;
++ new_buff->page_offset = old_buff->page_offset;
++ new_buff->pagecnt_bias = old_buff->pagecnt_bias;
++}
++
++/**
++ * i40e_page_is_reusable - check if any reuse is possible
++ * @page: page struct to check
++ *
++ * A page is not reusable if it was allocated under low memory
++ * conditions, or it's not in the same NUMA node as this CPU.
++ */
++static inline bool i40e_page_is_reusable(struct page *page)
++{
++ return (page_to_nid(page) == numa_mem_id()) &&
++ !page_is_pfmemalloc(page);
++}
++
++/**
++ * i40e_can_reuse_rx_page - Determine if this page can be reused by
++ * the adapter for another receive
++ *
++ * @rx_buffer: buffer containing the page
++ *
++ * If page is reusable, rx_buffer->page_offset is adjusted to point to
++ * an unused region in the page.
++ *
++ * For small pages, @truesize will be a constant value, half the size
++ * of the memory at page. We'll attempt to alternate between high and
++ * low halves of the page, with one half ready for use by the hardware
++ * and the other half being consumed by the stack. We use the page
++ * ref count to determine whether the stack has finished consuming the
++ * portion of this page that was passed up with a previous packet. If
++ * the page ref count is >1, we'll assume the "other" half page is
++ * still busy, and this page cannot be reused.
++ *
++ * For larger pages, @truesize will be the actual space used by the
++ * received packet (adjusted upward to an even multiple of the cache
++ * line size). This will advance through the page by the amount
++ * actually consumed by the received packets while there is still
++ * space for a buffer. Each region of larger pages will be used at
++ * most once, after which the page will not be reused.
++ *
++ * In either case, if the page is reusable its refcount is increased.
++ **/
++static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer)
++{
++ unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;
++ struct page *page = rx_buffer->page;
++
++ /* Is any reuse possible? */
++ if (unlikely(!i40e_page_is_reusable(page)))
++ return false;
++
++#if (PAGE_SIZE < 8192)
++ /* if we are only owner of page we can reuse it */
++ if (unlikely((page_count(page) - pagecnt_bias) > 1))
++ return false;
++#else
++#define I40E_LAST_OFFSET \
++ (SKB_WITH_OVERHEAD(PAGE_SIZE) - I40E_RXBUFFER_2048)
++ if (rx_buffer->page_offset > I40E_LAST_OFFSET)
++ return false;
++#endif
++
++ /* If we have drained the page fragment pool we need to update
++ * the pagecnt_bias and page count so that we fully restock the
++ * number of references the driver holds.
++ */
++ if (unlikely(!pagecnt_bias)) {
++ page_ref_add(page, USHRT_MAX);
++ rx_buffer->pagecnt_bias = USHRT_MAX;
++ }
++
++ return true;
++}
++
++/**
++ * i40e_add_rx_frag - Add contents of Rx buffer to sk_buff
++ * @rx_ring: rx descriptor ring to transact packets on
++ * @rx_buffer: buffer containing page to add
++ * @skb: sk_buff to place the data into
++ * @size: packet length from rx_desc
++ *
++ * This function will add the data contained in rx_buffer->page to the skb.
++ * It will just attach the page as a frag to the skb.
++ *
++ * The function will then update the page offset.
++ **/
++static void i40e_add_rx_frag(struct i40e_ring *rx_ring,
++ struct i40e_rx_buffer *rx_buffer,
++ struct sk_buff *skb,
++ unsigned int size)
++{
++#if (PAGE_SIZE < 8192)
++ unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
++#else
++ unsigned int truesize = SKB_DATA_ALIGN(size + i40e_rx_offset(rx_ring));
++#endif
++
++ skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, rx_buffer->page,
++ rx_buffer->page_offset, size, truesize);
++
++ /* page is being used so we must update the page offset */
++#if (PAGE_SIZE < 8192)
++ rx_buffer->page_offset ^= truesize;
++#else
++ rx_buffer->page_offset += truesize;
++#endif
++}
++
++/**
++ * i40e_get_rx_buffer - Fetch Rx buffer and synchronize data for use
++ * @rx_ring: rx descriptor ring to transact packets on
++ * @size: size of buffer to add to skb
++ *
++ * This function will pull an Rx buffer from the ring and synchronize it
++ * for use by the CPU.
++ */
++static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring,
++ const unsigned int size)
++{
++ struct i40e_rx_buffer *rx_buffer;
++
++ rx_buffer = &rx_ring->rx_bi[rx_ring->next_to_clean];
++ prefetchw(rx_buffer->page);
++
++ /* we are reusing so sync this buffer for CPU use */
++ dma_sync_single_range_for_cpu(rx_ring->dev,
++ rx_buffer->dma,
++ rx_buffer->page_offset,
++ size,
++ DMA_FROM_DEVICE);
++
++ /* We have pulled a buffer for use, so decrement pagecnt_bias */
++ rx_buffer->pagecnt_bias--;
++
++ return rx_buffer;
++}
++
++/**
++ * i40e_construct_skb - Allocate skb and populate it
++ * @rx_ring: rx descriptor ring to transact packets on
++ * @rx_buffer: rx buffer to pull data from
++ * @size: size of buffer to add to skb
++ *
++ * This function allocates an skb. It then populates it with the page
++ * data from the current receive descriptor, taking care to set up the
++ * skb correctly.
++ */
++static struct sk_buff *i40e_construct_skb(struct i40e_ring *rx_ring,
++ struct i40e_rx_buffer *rx_buffer,
++ unsigned int size)
++{
++ void *va;
++#if (PAGE_SIZE < 8192)
++ unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
++#else
++ unsigned int truesize = SKB_DATA_ALIGN(size);
++#endif
++ unsigned int headlen;
++ struct sk_buff *skb;
++
++ /* prefetch first cache line of first page */
++ va = page_address(rx_buffer->page) + rx_buffer->page_offset;
++ prefetch(va);
++#if L1_CACHE_BYTES < 128
++ prefetch(va + L1_CACHE_BYTES);
++#endif
++
++ /* allocate a skb to store the frags */
++ skb = __napi_alloc_skb(&rx_ring->q_vector->napi,
++ I40E_RX_HDR_SIZE,
++ GFP_ATOMIC | __GFP_NOWARN);
++ if (unlikely(!skb))
++ return NULL;
++
++ /* Determine available headroom for copy */
++ headlen = size;
++ if (headlen > I40E_RX_HDR_SIZE)
++ headlen = eth_get_headlen(va, I40E_RX_HDR_SIZE);
++
++ /* align pull length to size of long to optimize memcpy performance */
++ memcpy(__skb_put(skb, headlen), va, ALIGN(headlen, sizeof(long)));
++
++ /* update all of the pointers */
++ size -= headlen;
++ if (size) {
++ skb_add_rx_frag(skb, 0, rx_buffer->page,
++ rx_buffer->page_offset + headlen,
++ size, truesize);
++
++ /* buffer is used by skb, update page_offset */
++#if (PAGE_SIZE < 8192)
++ rx_buffer->page_offset ^= truesize;
++#else
++ rx_buffer->page_offset += truesize;
++#endif
++ } else {
++ /* buffer is unused, reset bias back to rx_buffer */
++ rx_buffer->pagecnt_bias++;
++ }
++
++ return skb;
++}
++
++/**
++ * i40e_build_skb - Build skb around an existing buffer
++ * @rx_ring: Rx descriptor ring to transact packets on
++ * @rx_buffer: Rx buffer to pull data from
++ * @size: size of buffer to add to skb
++ *
++ * This function builds an skb around an existing Rx buffer, taking care
++ * to set up the skb correctly and avoid any memcpy overhead.
++ */
++static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
++ struct i40e_rx_buffer *rx_buffer,
++ unsigned int size)
++{
++ void *va;
++#if (PAGE_SIZE < 8192)
++ unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
++#else
++ unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
++ SKB_DATA_ALIGN(I40E_SKB_PAD + size);
++#endif
++ struct sk_buff *skb;
++
++ /* prefetch first cache line of first page */
++ va = page_address(rx_buffer->page) + rx_buffer->page_offset;
++ prefetch(va);
++#if L1_CACHE_BYTES < 128
++ prefetch(va + L1_CACHE_BYTES);
++#endif
++ /* build an skb around the page buffer */
++ skb = build_skb(va - I40E_SKB_PAD, truesize);
++ if (unlikely(!skb))
++ return NULL;
++
++ /* update pointers within the skb to store the data */
++ skb_reserve(skb, I40E_SKB_PAD);
++ __skb_put(skb, size);
++
++ /* buffer is used by skb, update page_offset */
++#if (PAGE_SIZE < 8192)
++ rx_buffer->page_offset ^= truesize;
++#else
++ rx_buffer->page_offset += truesize;
++#endif
++
++ return skb;
++}
++
++/**
++ * i40e_put_rx_buffer - Clean up used buffer and either recycle or free
++ * @rx_ring: rx descriptor ring to transact packets on
++ * @rx_buffer: rx buffer to pull data from
++ *
++ * This function will clean up the contents of the rx_buffer. It will
++ * either recycle the buffer or unmap it and free the associated resources.
++ */
++static void i40e_put_rx_buffer(struct i40e_ring *rx_ring,
++ struct i40e_rx_buffer *rx_buffer)
++{
++ if (i40e_can_reuse_rx_page(rx_buffer)) {
++ /* hand second half of page back to the ring */
++ i40e_reuse_rx_page(rx_ring, rx_buffer);
++ rx_ring->rx_stats.page_reuse_count++;
++ } else {
++ /* we are not reusing the buffer so unmap it */
++ dma_unmap_page_attrs(rx_ring->dev, rx_buffer->dma,
++ i40e_rx_pg_size(rx_ring),
++ DMA_FROM_DEVICE, I40E_RX_DMA_ATTR);
++ __page_frag_cache_drain(rx_buffer->page,
++ rx_buffer->pagecnt_bias);
++ }
++
++ /* clear contents of buffer_info */
++ rx_buffer->page = NULL;
++}
++
++/**
++ * i40e_is_non_eop - process handling of non-EOP buffers
++ * @rx_ring: Rx ring being processed
++ * @rx_desc: Rx descriptor for current buffer
++ * @skb: Current socket buffer containing buffer in progress
++ *
++ * This function updates next to clean. If the buffer is an EOP buffer
++ * this function exits returning false, otherwise it will place the
++ * sk_buff in the next buffer to be chained and return true indicating
++ * that this is in fact a non-EOP buffer.
++ **/
++static bool i40e_is_non_eop(struct i40e_ring *rx_ring,
++ union i40e_rx_desc *rx_desc,
++ struct sk_buff *skb)
++{
++ u32 ntc = rx_ring->next_to_clean + 1;
++
++ /* fetch, update, and store next to clean */
++ ntc = (ntc < rx_ring->count) ? ntc : 0;
++ rx_ring->next_to_clean = ntc;
++
++ prefetch(I40E_RX_DESC(rx_ring, ntc));
++
++ /* if we are the last buffer then there is nothing else to do */
++#define I40E_RXD_EOF BIT(I40E_RX_DESC_STATUS_EOF_SHIFT)
++ if (likely(i40e_test_staterr(rx_desc, I40E_RXD_EOF)))
++ return false;
++
++ rx_ring->rx_stats.non_eop_descs++;
++
++ return true;
++}
++
++/**
++ * i40e_clean_rx_irq - Clean completed descriptors from Rx ring - bounce buf
++ * @rx_ring: rx descriptor ring to transact packets on
++ * @budget: Total limit on number of packets to process
++ *
++ * This function provides a "bounce buffer" approach to Rx interrupt
++ * processing. The advantage to this is that on systems that have
++ * expensive overhead for IOMMU access this provides a means of avoiding
++ * it by maintaining the mapping of the page to the system.
++ *
++ * Returns amount of work completed
++ **/
++static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
++{
++ unsigned int total_rx_bytes = 0, total_rx_packets = 0;
++ struct sk_buff *skb = rx_ring->skb;
++ u16 cleaned_count = I40E_DESC_UNUSED(rx_ring);
++ bool failure = false;
++
++ while (likely(total_rx_packets < (unsigned int)budget)) {
++ struct i40e_rx_buffer *rx_buffer;
++ union i40e_rx_desc *rx_desc;
++ unsigned int size;
++ u16 vlan_tag;
++ u8 rx_ptype;
++ u64 qword;
++
++ /* return some buffers to hardware, one at a time is too slow */
++ if (cleaned_count >= I40E_RX_BUFFER_WRITE) {
++ failure = failure ||
++ i40evf_alloc_rx_buffers(rx_ring, cleaned_count);
++ cleaned_count = 0;
++ }
++
++ rx_desc = I40E_RX_DESC(rx_ring, rx_ring->next_to_clean);
++
++ /* status_error_len will always be zero for unused descriptors
++ * because it's cleared in cleanup, and overlaps with hdr_addr
++ * which is always zero because packet split isn't used, if the
++ * hardware wrote DD then the length will be non-zero
++ */
++ qword = le64_to_cpu(rx_desc->wb.qword1.status_error_len);
++
++ /* This memory barrier is needed to keep us from reading
++ * any other fields out of the rx_desc until we have
++ * verified the descriptor has been written back.
++ */
++ dma_rmb();
++
++ size = (qword & I40E_RXD_QW1_LENGTH_PBUF_MASK) >>
++ I40E_RXD_QW1_LENGTH_PBUF_SHIFT;
++ if (!size)
++ break;
++
++ i40e_trace(clean_rx_irq, rx_ring, rx_desc, skb);
++ rx_buffer = i40e_get_rx_buffer(rx_ring, size);
++
++ /* retrieve a buffer from the ring */
++ if (skb)
++ i40e_add_rx_frag(rx_ring, rx_buffer, skb, size);
++ else if (ring_uses_build_skb(rx_ring))
++ skb = i40e_build_skb(rx_ring, rx_buffer, size);
++ else
++ skb = i40e_construct_skb(rx_ring, rx_buffer, size);
++
++ /* exit if we failed to retrieve a buffer */
++ if (!skb) {
++ rx_ring->rx_stats.alloc_buff_failed++;
++ rx_buffer->pagecnt_bias++;
++ break;
++ }
++
++ i40e_put_rx_buffer(rx_ring, rx_buffer);
++ cleaned_count++;
++
++ if (i40e_is_non_eop(rx_ring, rx_desc, skb))
++ continue;
++
++ /* ERR_MASK will only have valid bits if EOP set, and
++ * what we are doing here is actually checking
++ * I40E_RX_DESC_ERROR_RXE_SHIFT, since it is the zeroth bit in
++ * the error field
++ */
++ if (unlikely(i40e_test_staterr(rx_desc, BIT(I40E_RXD_QW1_ERROR_SHIFT)))) {
++ dev_kfree_skb_any(skb);
++ skb = NULL;
++ continue;
++ }
++
++ if (i40e_cleanup_headers(rx_ring, skb)) {
++ skb = NULL;
++ continue;
++ }
++
++ /* probably a little skewed due to removing CRC */
++ total_rx_bytes += skb->len;
++
++ qword = le64_to_cpu(rx_desc->wb.qword1.status_error_len);
++ rx_ptype = (qword & I40E_RXD_QW1_PTYPE_MASK) >>
++ I40E_RXD_QW1_PTYPE_SHIFT;
++
++ /* populate checksum, VLAN, and protocol */
++ i40evf_process_skb_fields(rx_ring, rx_desc, skb, rx_ptype);
++
++
++ vlan_tag = (qword & BIT(I40E_RX_DESC_STATUS_L2TAG1P_SHIFT)) ?
++ le16_to_cpu(rx_desc->wb.qword0.lo_dword.l2tag1) : 0;
++
++ i40e_trace(clean_rx_irq_rx, rx_ring, rx_desc, skb);
++ i40e_receive_skb(rx_ring, skb, vlan_tag);
++ skb = NULL;
++
++ /* update budget accounting */
++ total_rx_packets++;
++ }
++
++ rx_ring->skb = skb;
++
++ u64_stats_update_begin(&rx_ring->syncp);
++ rx_ring->stats.packets += total_rx_packets;
++ rx_ring->stats.bytes += total_rx_bytes;
++ u64_stats_update_end(&rx_ring->syncp);
++ rx_ring->q_vector->rx.total_packets += total_rx_packets;
++ rx_ring->q_vector->rx.total_bytes += total_rx_bytes;
++
++ /* guarantee a trip back through this routine if there was a failure */
++ return failure ? budget : (int)total_rx_packets;
++}
++
++static inline u32 i40e_buildreg_itr(const int type, u16 itr)
++{
++ u32 val;
++
++ /* We don't bother with setting the CLEARPBA bit as the data sheet
++ * points out doing so is "meaningless since it was already
++ * auto-cleared". The auto-clearing happens when the interrupt is
++ * asserted.
++ *
++ * Hardware errata 28 for also indicates that writing to a
++ * xxINT_DYN_CTLx CSR with INTENA_MSK (bit 31) set to 0 will clear
++ * an event in the PBA anyway so we need to rely on the automask
++ * to hold pending events for us until the interrupt is re-enabled
++ *
++ * The itr value is reported in microseconds, and the register
++ * value is recorded in 2 microsecond units. For this reason we
++ * only need to shift by the interval shift - 1 instead of the
++ * full value.
++ */
++ itr &= I40E_ITR_MASK;
++
++ val = I40E_VFINT_DYN_CTLN1_INTENA_MASK |
++ (type << I40E_VFINT_DYN_CTLN1_ITR_INDX_SHIFT) |
++ (itr << (I40E_VFINT_DYN_CTLN1_INTERVAL_SHIFT - 1));
++
++ return val;
++}
++
++/* a small macro to shorten up some long lines */
++#define INTREG I40E_VFINT_DYN_CTLN1
++
++/* The act of updating the ITR will cause it to immediately trigger. In order
++ * to prevent this from throwing off adaptive update statistics we defer the
++ * update so that it can only happen so often. So after either Tx or Rx are
++ * updated we make the adaptive scheme wait until either the ITR completely
++ * expires via the next_update expiration or we have been through at least
++ * 3 interrupts.
++ */
++#define ITR_COUNTDOWN_START 3
++
++/**
++ * i40e_update_enable_itr - Update itr and re-enable MSIX interrupt
++ * @vsi: the VSI we care about
++ * @q_vector: q_vector for which itr is being updated and interrupt enabled
++ *
++ **/
++static inline void i40e_update_enable_itr(struct i40e_vsi *vsi,
++ struct i40e_q_vector *q_vector)
++{
++ struct i40e_hw *hw = &vsi->back->hw;
++ u32 intval;
++
++ /* These will do nothing if dynamic updates are not enabled */
++ i40e_update_itr(q_vector, &q_vector->tx);
++ i40e_update_itr(q_vector, &q_vector->rx);
++
++ /* This block of logic allows us to get away with only updating
++ * one ITR value with each interrupt. The idea is to perform a
++ * pseudo-lazy update with the following criteria.
++ *
++ * 1. Rx is given higher priority than Tx if both are in same state
++ * 2. If we must reduce an ITR that is given highest priority.
++ * 3. We then give priority to increasing ITR based on amount.
++ */
++ if (q_vector->rx.target_itr < q_vector->rx.current_itr) {
++ /* Rx ITR needs to be reduced, this is highest priority */
++ intval = i40e_buildreg_itr(I40E_RX_ITR,
++ q_vector->rx.target_itr);
++ q_vector->rx.current_itr = q_vector->rx.target_itr;
++ q_vector->itr_countdown = ITR_COUNTDOWN_START;
++ } else if ((q_vector->tx.target_itr < q_vector->tx.current_itr) ||
++ ((q_vector->rx.target_itr - q_vector->rx.current_itr) <
++ (q_vector->tx.target_itr - q_vector->tx.current_itr))) {
++ /* Tx ITR needs to be reduced, this is second priority
++ * Tx ITR needs to be increased more than Rx, fourth priority
++ */
++ intval = i40e_buildreg_itr(I40E_TX_ITR,
++ q_vector->tx.target_itr);
++ q_vector->tx.current_itr = q_vector->tx.target_itr;
++ q_vector->itr_countdown = ITR_COUNTDOWN_START;
++ } else if (q_vector->rx.current_itr != q_vector->rx.target_itr) {
++ /* Rx ITR needs to be increased, third priority */
++ intval = i40e_buildreg_itr(I40E_RX_ITR,
++ q_vector->rx.target_itr);
++ q_vector->rx.current_itr = q_vector->rx.target_itr;
++ q_vector->itr_countdown = ITR_COUNTDOWN_START;
++ } else {
++ /* No ITR update, lowest priority */
++ intval = i40e_buildreg_itr(I40E_ITR_NONE, 0);
++ if (q_vector->itr_countdown)
++ q_vector->itr_countdown--;
++ }
++
++ if (!test_bit(__I40E_VSI_DOWN, vsi->state))
++ wr32(hw, INTREG(q_vector->reg_idx), intval);
++}
++
++/**
++ * i40evf_napi_poll - NAPI polling Rx/Tx cleanup routine
++ * @napi: napi struct with our devices info in it
++ * @budget: amount of work driver is allowed to do this pass, in packets
++ *
++ * This function will clean all queues associated with a q_vector.
++ *
++ * Returns the amount of work done
++ **/
++int i40evf_napi_poll(struct napi_struct *napi, int budget)
++{
++ struct i40e_q_vector *q_vector =
++ container_of(napi, struct i40e_q_vector, napi);
++ struct i40e_vsi *vsi = q_vector->vsi;
++ struct i40e_ring *ring;
++ bool clean_complete = true;
++ bool arm_wb = false;
++ int budget_per_ring;
++ int work_done = 0;
++
++ if (test_bit(__I40E_VSI_DOWN, vsi->state)) {
++ napi_complete(napi);
++ return 0;
++ }
++
++ /* Since the actual Tx work is minimal, we can give the Tx a larger
++ * budget and be more aggressive about cleaning up the Tx descriptors.
++ */
++ i40e_for_each_ring(ring, q_vector->tx) {
++ if (!i40e_clean_tx_irq(vsi, ring, budget)) {
++ clean_complete = false;
++ continue;
++ }
++ arm_wb |= ring->arm_wb;
++ ring->arm_wb = false;
++ }
++
++ /* Handle case where we are called by netpoll with a budget of 0 */
++ if (budget <= 0)
++ goto tx_only;
++
++ /* We attempt to distribute budget to each Rx queue fairly, but don't
++ * allow the budget to go below 1 because that would exit polling early.
++ */
++ budget_per_ring = max(budget/q_vector->num_ringpairs, 1);
++
++ i40e_for_each_ring(ring, q_vector->rx) {
++ int cleaned = i40e_clean_rx_irq(ring, budget_per_ring);
++
++ work_done += cleaned;
++ /* if we clean as many as budgeted, we must not be done */
++ if (cleaned >= budget_per_ring)
++ clean_complete = false;
++ }
++
++ /* If work not completed, return budget and polling will return */
++ if (!clean_complete) {
++ int cpu_id = smp_processor_id();
++
++ /* It is possible that the interrupt affinity has changed but,
++ * if the cpu is pegged at 100%, polling will never exit while
++ * traffic continues and the interrupt will be stuck on this
++ * cpu. We check to make sure affinity is correct before we
++ * continue to poll, otherwise we must stop polling so the
++ * interrupt can move to the correct cpu.
++ */
++ if (!cpumask_test_cpu(cpu_id, &q_vector->affinity_mask)) {
++ /* Tell napi that we are done polling */
++ napi_complete_done(napi, work_done);
++
++ /* Force an interrupt */
++ i40evf_force_wb(vsi, q_vector);
++
++ /* Return budget-1 so that polling stops */
++ return budget - 1;
++ }
++tx_only:
++ if (arm_wb) {
++ q_vector->tx.ring[0].tx_stats.tx_force_wb++;
++ i40e_enable_wb_on_itr(vsi, q_vector);
++ }
++ return budget;
++ }
++
++ if (vsi->back->flags & I40E_TXR_FLAGS_WB_ON_ITR)
++ q_vector->arm_wb_state = false;
++
++ /* Work is done so exit the polling mode and re-enable the interrupt */
++ napi_complete_done(napi, work_done);
++
++ i40e_update_enable_itr(vsi, q_vector);
++
++ return min(work_done, budget - 1);
++}
++
++/**
++ * i40evf_tx_prepare_vlan_flags - prepare generic TX VLAN tagging flags for HW
++ * @skb: send buffer
++ * @tx_ring: ring to send buffer on
++ * @flags: the tx flags to be set
++ *
++ * Checks the skb and set up correspondingly several generic transmit flags
++ * related to VLAN tagging for the HW, such as VLAN, DCB, etc.
++ *
++ * Returns error code indicate the frame should be dropped upon error and the
++ * otherwise returns 0 to indicate the flags has been set properly.
++ **/
++static inline int i40evf_tx_prepare_vlan_flags(struct sk_buff *skb,
++ struct i40e_ring *tx_ring,
++ u32 *flags)
++{
++ __be16 protocol = skb->protocol;
++ u32 tx_flags = 0;
++
++ if (protocol == htons(ETH_P_8021Q) &&
++ !(tx_ring->netdev->features & NETIF_F_HW_VLAN_CTAG_TX)) {
++ /* When HW VLAN acceleration is turned off by the user the
++ * stack sets the protocol to 8021q so that the driver
++ * can take any steps required to support the SW only
++ * VLAN handling. In our case the driver doesn't need
++ * to take any further steps so just set the protocol
++ * to the encapsulated ethertype.
++ */
++ skb->protocol = vlan_get_protocol(skb);
++ goto out;
++ }
++
++ /* if we have a HW VLAN tag being added, default to the HW one */
++ if (skb_vlan_tag_present(skb)) {
++ tx_flags |= skb_vlan_tag_get(skb) << I40E_TX_FLAGS_VLAN_SHIFT;
++ tx_flags |= I40E_TX_FLAGS_HW_VLAN;
++ /* else if it is a SW VLAN, check the next protocol and store the tag */
++ } else if (protocol == htons(ETH_P_8021Q)) {
++ struct vlan_hdr *vhdr, _vhdr;
++
++ vhdr = skb_header_pointer(skb, ETH_HLEN, sizeof(_vhdr), &_vhdr);
++ if (!vhdr)
++ return -EINVAL;
++
++ protocol = vhdr->h_vlan_encapsulated_proto;
++ tx_flags |= ntohs(vhdr->h_vlan_TCI) << I40E_TX_FLAGS_VLAN_SHIFT;
++ tx_flags |= I40E_TX_FLAGS_SW_VLAN;
++ }
++
++out:
++ *flags = tx_flags;
++ return 0;
++}
++
++/**
++ * i40e_tso - set up the tso context descriptor
++ * @first: pointer to first Tx buffer for xmit
++ * @hdr_len: ptr to the size of the packet header
++ * @cd_type_cmd_tso_mss: Quad Word 1
++ *
++ * Returns 0 if no TSO can happen, 1 if tso is going, or error
++ **/
++static int i40e_tso(struct i40e_tx_buffer *first, u8 *hdr_len,
++ u64 *cd_type_cmd_tso_mss)
++{
++ struct sk_buff *skb = first->skb;
++ u64 cd_cmd, cd_tso_len, cd_mss;
++ union {
++ struct iphdr *v4;
++ struct ipv6hdr *v6;
++ unsigned char *hdr;
++ } ip;
++ union {
++ struct tcphdr *tcp;
++ struct udphdr *udp;
++ unsigned char *hdr;
++ } l4;
++ u32 paylen, l4_offset;
++ u16 gso_segs, gso_size;
++ int err;
++
++ if (skb->ip_summed != CHECKSUM_PARTIAL)
++ return 0;
++
++ if (!skb_is_gso(skb))
++ return 0;
++
++ err = skb_cow_head(skb, 0);
++ if (err < 0)
++ return err;
++
++ ip.hdr = skb_network_header(skb);
++ l4.hdr = skb_transport_header(skb);
++
++ /* initialize outer IP header fields */
++ if (ip.v4->version == 4) {
++ ip.v4->tot_len = 0;
++ ip.v4->check = 0;
++ } else {
++ ip.v6->payload_len = 0;
++ }
++
++ if (skb_shinfo(skb)->gso_type & (SKB_GSO_GRE |
++ SKB_GSO_GRE_CSUM |
++ SKB_GSO_IPXIP4 |
++ SKB_GSO_IPXIP6 |
++ SKB_GSO_UDP_TUNNEL |
++ SKB_GSO_UDP_TUNNEL_CSUM)) {
++ if (!(skb_shinfo(skb)->gso_type & SKB_GSO_PARTIAL) &&
++ (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM)) {
++ l4.udp->len = 0;
++
++ /* determine offset of outer transport header */
++ l4_offset = l4.hdr - skb->data;
++
++ /* remove payload length from outer checksum */
++ paylen = skb->len - l4_offset;
++ csum_replace_by_diff(&l4.udp->check,
++ (__force __wsum)htonl(paylen));
++ }
++
++ /* reset pointers to inner headers */
++ ip.hdr = skb_inner_network_header(skb);
++ l4.hdr = skb_inner_transport_header(skb);
++
++ /* initialize inner IP header fields */
++ if (ip.v4->version == 4) {
++ ip.v4->tot_len = 0;
++ ip.v4->check = 0;
++ } else {
++ ip.v6->payload_len = 0;
++ }
++ }
++
++ /* determine offset of inner transport header */
++ l4_offset = l4.hdr - skb->data;
++
++ /* remove payload length from inner checksum */
++ paylen = skb->len - l4_offset;
++ csum_replace_by_diff(&l4.tcp->check, (__force __wsum)htonl(paylen));
++
++ /* compute length of segmentation header */
++ *hdr_len = (l4.tcp->doff * 4) + l4_offset;
++
++ /* pull values out of skb_shinfo */
++ gso_size = skb_shinfo(skb)->gso_size;
++ gso_segs = skb_shinfo(skb)->gso_segs;
++
++ /* update GSO size and bytecount with header size */
++ first->gso_segs = gso_segs;
++ first->bytecount += (first->gso_segs - 1) * *hdr_len;
++
++ /* find the field values */
++ cd_cmd = I40E_TX_CTX_DESC_TSO;
++ cd_tso_len = skb->len - *hdr_len;
++ cd_mss = gso_size;
++ *cd_type_cmd_tso_mss |= (cd_cmd << I40E_TXD_CTX_QW1_CMD_SHIFT) |
++ (cd_tso_len << I40E_TXD_CTX_QW1_TSO_LEN_SHIFT) |
++ (cd_mss << I40E_TXD_CTX_QW1_MSS_SHIFT);
++ return 1;
++}
++
++/**
++ * i40e_tx_enable_csum - Enable Tx checksum offloads
++ * @skb: send buffer
++ * @tx_flags: pointer to Tx flags currently set
++ * @td_cmd: Tx descriptor command bits to set
++ * @td_offset: Tx descriptor header offsets to set
++ * @tx_ring: Tx descriptor ring
++ * @cd_tunneling: ptr to context desc bits
++ **/
++static int i40e_tx_enable_csum(struct sk_buff *skb, u32 *tx_flags,
++ u32 *td_cmd, u32 *td_offset,
++ struct i40e_ring *tx_ring,
++ u32 *cd_tunneling)
++{
++ union {
++ struct iphdr *v4;
++ struct ipv6hdr *v6;
++ unsigned char *hdr;
++ } ip;
++ union {
++ struct tcphdr *tcp;
++ struct udphdr *udp;
++ unsigned char *hdr;
++ } l4;
++ unsigned char *exthdr;
++ u32 offset, cmd = 0;
++ __be16 frag_off;
++ u8 l4_proto = 0;
++
++ if (skb->ip_summed != CHECKSUM_PARTIAL)
++ return 0;
++
++ ip.hdr = skb_network_header(skb);
++ l4.hdr = skb_transport_header(skb);
++
++ /* compute outer L2 header size */
++ offset = ((ip.hdr - skb->data) / 2) << I40E_TX_DESC_LENGTH_MACLEN_SHIFT;
++
++ if (skb->encapsulation) {
++ u32 tunnel = 0;
++ /* define outer network header type */
++ if (*tx_flags & I40E_TX_FLAGS_IPV4) {
++ tunnel |= (*tx_flags & I40E_TX_FLAGS_TSO) ?
++ I40E_TX_CTX_EXT_IP_IPV4 :
++ I40E_TX_CTX_EXT_IP_IPV4_NO_CSUM;
++
++ l4_proto = ip.v4->protocol;
++ } else if (*tx_flags & I40E_TX_FLAGS_IPV6) {
++ tunnel |= I40E_TX_CTX_EXT_IP_IPV6;
++
++ exthdr = ip.hdr + sizeof(*ip.v6);
++ l4_proto = ip.v6->nexthdr;
++ if (l4.hdr != exthdr)
++ ipv6_skip_exthdr(skb, exthdr - skb->data,
++ &l4_proto, &frag_off);
++ }
++
++ /* define outer transport */
++ switch (l4_proto) {
++ case IPPROTO_UDP:
++ tunnel |= I40E_TXD_CTX_UDP_TUNNELING;
++ *tx_flags |= I40E_TX_FLAGS_VXLAN_TUNNEL;
++ break;
++ case IPPROTO_GRE:
++ tunnel |= I40E_TXD_CTX_GRE_TUNNELING;
++ *tx_flags |= I40E_TX_FLAGS_VXLAN_TUNNEL;
++ break;
++ case IPPROTO_IPIP:
++ case IPPROTO_IPV6:
++ *tx_flags |= I40E_TX_FLAGS_VXLAN_TUNNEL;
++ l4.hdr = skb_inner_network_header(skb);
++ break;
++ default:
++ if (*tx_flags & I40E_TX_FLAGS_TSO)
++ return -1;
++
++ skb_checksum_help(skb);
++ return 0;
++ }
++
++ /* compute outer L3 header size */
++ tunnel |= ((l4.hdr - ip.hdr) / 4) <<
++ I40E_TXD_CTX_QW0_EXT_IPLEN_SHIFT;
++
++ /* switch IP header pointer from outer to inner header */
++ ip.hdr = skb_inner_network_header(skb);
++
++ /* compute tunnel header size */
++ tunnel |= ((ip.hdr - l4.hdr) / 2) <<
++ I40E_TXD_CTX_QW0_NATLEN_SHIFT;
++
++ /* indicate if we need to offload outer UDP header */
++ if ((*tx_flags & I40E_TX_FLAGS_TSO) &&
++ !(skb_shinfo(skb)->gso_type & SKB_GSO_PARTIAL) &&
++ (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM))
++ tunnel |= I40E_TXD_CTX_QW0_L4T_CS_MASK;
++
++ /* record tunnel offload values */
++ *cd_tunneling |= tunnel;
++
++ /* switch L4 header pointer from outer to inner */
++ l4.hdr = skb_inner_transport_header(skb);
++ l4_proto = 0;
++
++ /* reset type as we transition from outer to inner headers */
++ *tx_flags &= ~(I40E_TX_FLAGS_IPV4 | I40E_TX_FLAGS_IPV6);
++ if (ip.v4->version == 4)
++ *tx_flags |= I40E_TX_FLAGS_IPV4;
++ if (ip.v6->version == 6)
++ *tx_flags |= I40E_TX_FLAGS_IPV6;
++ }
++
++ /* Enable IP checksum offloads */
++ if (*tx_flags & I40E_TX_FLAGS_IPV4) {
++ l4_proto = ip.v4->protocol;
++ /* the stack computes the IP header already, the only time we
++ * need the hardware to recompute it is in the case of TSO.
++ */
++ cmd |= (*tx_flags & I40E_TX_FLAGS_TSO) ?
++ I40E_TX_DESC_CMD_IIPT_IPV4_CSUM :
++ I40E_TX_DESC_CMD_IIPT_IPV4;
++ } else if (*tx_flags & I40E_TX_FLAGS_IPV6) {
++ cmd |= I40E_TX_DESC_CMD_IIPT_IPV6;
++
++ exthdr = ip.hdr + sizeof(*ip.v6);
++ l4_proto = ip.v6->nexthdr;
++ if (l4.hdr != exthdr)
++ ipv6_skip_exthdr(skb, exthdr - skb->data,
++ &l4_proto, &frag_off);
++ }
++
++ /* compute inner L3 header size */
++ offset |= ((l4.hdr - ip.hdr) / 4) << I40E_TX_DESC_LENGTH_IPLEN_SHIFT;
++
++ /* Enable L4 checksum offloads */
++ switch (l4_proto) {
++ case IPPROTO_TCP:
++ /* enable checksum offloads */
++ cmd |= I40E_TX_DESC_CMD_L4T_EOFT_TCP;
++ offset |= l4.tcp->doff << I40E_TX_DESC_LENGTH_L4_FC_LEN_SHIFT;
++ break;
++ case IPPROTO_SCTP:
++ /* enable SCTP checksum offload */
++ cmd |= I40E_TX_DESC_CMD_L4T_EOFT_SCTP;
++ offset |= (sizeof(struct sctphdr) >> 2) <<
++ I40E_TX_DESC_LENGTH_L4_FC_LEN_SHIFT;
++ break;
++ case IPPROTO_UDP:
++ /* enable UDP checksum offload */
++ cmd |= I40E_TX_DESC_CMD_L4T_EOFT_UDP;
++ offset |= (sizeof(struct udphdr) >> 2) <<
++ I40E_TX_DESC_LENGTH_L4_FC_LEN_SHIFT;
++ break;
++ default:
++ if (*tx_flags & I40E_TX_FLAGS_TSO)
++ return -1;
++ skb_checksum_help(skb);
++ return 0;
++ }
++
++ *td_cmd |= cmd;
++ *td_offset |= offset;
++
++ return 1;
++}
++
++/**
++ * i40e_create_tx_ctx Build the Tx context descriptor
++ * @tx_ring: ring to create the descriptor on
++ * @cd_type_cmd_tso_mss: Quad Word 1
++ * @cd_tunneling: Quad Word 0 - bits 0-31
++ * @cd_l2tag2: Quad Word 0 - bits 32-63
++ **/
++static void i40e_create_tx_ctx(struct i40e_ring *tx_ring,
++ const u64 cd_type_cmd_tso_mss,
++ const u32 cd_tunneling, const u32 cd_l2tag2)
++{
++ struct i40e_tx_context_desc *context_desc;
++ int i = tx_ring->next_to_use;
++
++ if ((cd_type_cmd_tso_mss == I40E_TX_DESC_DTYPE_CONTEXT) &&
++ !cd_tunneling && !cd_l2tag2)
++ return;
++
++ /* grab the next descriptor */
++ context_desc = I40E_TX_CTXTDESC(tx_ring, i);
++
++ i++;
++ tx_ring->next_to_use = (i < tx_ring->count) ? i : 0;
++
++ /* cpu_to_le32 and assign to struct fields */
++ context_desc->tunneling_params = cpu_to_le32(cd_tunneling);
++ context_desc->l2tag2 = cpu_to_le16(cd_l2tag2);
++ context_desc->rsvd = cpu_to_le16(0);
++ context_desc->type_cmd_tso_mss = cpu_to_le64(cd_type_cmd_tso_mss);
++}
++
++/**
++ * __i40evf_chk_linearize - Check if there are more than 8 buffers per packet
++ * @skb: send buffer
++ *
++ * Note: Our HW can't DMA more than 8 buffers to build a packet on the wire
++ * and so we need to figure out the cases where we need to linearize the skb.
++ *
++ * For TSO we need to count the TSO header and segment payload separately.
++ * As such we need to check cases where we have 7 fragments or more as we
++ * can potentially require 9 DMA transactions, 1 for the TSO header, 1 for
++ * the segment payload in the first descriptor, and another 7 for the
++ * fragments.
++ **/
++bool __i40evf_chk_linearize(struct sk_buff *skb)
++{
++ const struct skb_frag_struct *frag, *stale;
++ int nr_frags, sum;
++
++ /* no need to check if number of frags is less than 7 */
++ nr_frags = skb_shinfo(skb)->nr_frags;
++ if (nr_frags < (I40E_MAX_BUFFER_TXD - 1))
++ return false;
++
++ /* We need to walk through the list and validate that each group
++ * of 6 fragments totals at least gso_size.
++ */
++ nr_frags -= I40E_MAX_BUFFER_TXD - 2;
++ frag = &skb_shinfo(skb)->frags[0];
++
++ /* Initialize size to the negative value of gso_size minus 1. We
++ * use this as the worst case scenerio in which the frag ahead
++ * of us only provides one byte which is why we are limited to 6
++ * descriptors for a single transmit as the header and previous
++ * fragment are already consuming 2 descriptors.
++ */
++ sum = 1 - skb_shinfo(skb)->gso_size;
++
++ /* Add size of frags 0 through 4 to create our initial sum */
++ sum += skb_frag_size(frag++);
++ sum += skb_frag_size(frag++);
++ sum += skb_frag_size(frag++);
++ sum += skb_frag_size(frag++);
++ sum += skb_frag_size(frag++);
++
++ /* Walk through fragments adding latest fragment, testing it, and
++ * then removing stale fragments from the sum.
++ */
++ for (stale = &skb_shinfo(skb)->frags[0];; stale++) {
++ int stale_size = skb_frag_size(stale);
++
++ sum += skb_frag_size(frag++);
++
++ /* The stale fragment may present us with a smaller
++ * descriptor than the actual fragment size. To account
++ * for that we need to remove all the data on the front and
++ * figure out what the remainder would be in the last
++ * descriptor associated with the fragment.
++ */
++ if (stale_size > I40E_MAX_DATA_PER_TXD) {
++ int align_pad = -(stale->page_offset) &
++ (I40E_MAX_READ_REQ_SIZE - 1);
++
++ sum -= align_pad;
++ stale_size -= align_pad;
++
++ do {
++ sum -= I40E_MAX_DATA_PER_TXD_ALIGNED;
++ stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED;
++ } while (stale_size > I40E_MAX_DATA_PER_TXD);
++ }
++
++ /* if sum is negative we failed to make sufficient progress */
++ if (sum < 0)
++ return true;
++
++ if (!nr_frags--)
++ break;
++
++ sum -= stale_size;
++ }
++
++ return false;
++}
++
++/**
++ * __i40evf_maybe_stop_tx - 2nd level check for tx stop conditions
++ * @tx_ring: the ring to be checked
++ * @size: the size buffer we want to assure is available
++ *
++ * Returns -EBUSY if a stop is needed, else 0
++ **/
++int __i40evf_maybe_stop_tx(struct i40e_ring *tx_ring, int size)
++{
++ netif_stop_subqueue(tx_ring->netdev, tx_ring->queue_index);
++ /* Memory barrier before checking head and tail */
++ smp_mb();
++
++ /* Check again in a case another CPU has just made room available. */
++ if (likely(I40E_DESC_UNUSED(tx_ring) < size))
++ return -EBUSY;
++
++ /* A reprieve! - use start_queue because it doesn't call schedule */
++ netif_start_subqueue(tx_ring->netdev, tx_ring->queue_index);
++ ++tx_ring->tx_stats.restart_queue;
++ return 0;
++}
++
++/**
++ * i40evf_tx_map - Build the Tx descriptor
++ * @tx_ring: ring to send buffer on
++ * @skb: send buffer
++ * @first: first buffer info buffer to use
++ * @tx_flags: collected send information
++ * @hdr_len: size of the packet header
++ * @td_cmd: the command field in the descriptor
++ * @td_offset: offset for checksum or crc
++ **/
++static inline void i40evf_tx_map(struct i40e_ring *tx_ring, struct sk_buff *skb,
++ struct i40e_tx_buffer *first, u32 tx_flags,
++ const u8 hdr_len, u32 td_cmd, u32 td_offset)
++{
++ unsigned int data_len = skb->data_len;
++ unsigned int size = skb_headlen(skb);
++ struct skb_frag_struct *frag;
++ struct i40e_tx_buffer *tx_bi;
++ struct i40e_tx_desc *tx_desc;
++ u16 i = tx_ring->next_to_use;
++ u32 td_tag = 0;
++ dma_addr_t dma;
++
++ if (tx_flags & I40E_TX_FLAGS_HW_VLAN) {
++ td_cmd |= I40E_TX_DESC_CMD_IL2TAG1;
++ td_tag = (tx_flags & I40E_TX_FLAGS_VLAN_MASK) >>
++ I40E_TX_FLAGS_VLAN_SHIFT;
++ }
++
++ first->tx_flags = tx_flags;
++
++ dma = dma_map_single(tx_ring->dev, skb->data, size, DMA_TO_DEVICE);
++
++ tx_desc = I40E_TX_DESC(tx_ring, i);
++ tx_bi = first;
++
++ for (frag = &skb_shinfo(skb)->frags[0];; frag++) {
++ unsigned int max_data = I40E_MAX_DATA_PER_TXD_ALIGNED;
++
++ if (dma_mapping_error(tx_ring->dev, dma))
++ goto dma_error;
++
++ /* record length, and DMA address */
++ dma_unmap_len_set(tx_bi, len, size);
++ dma_unmap_addr_set(tx_bi, dma, dma);
++
++ /* align size to end of page */
++ max_data += -dma & (I40E_MAX_READ_REQ_SIZE - 1);
++ tx_desc->buffer_addr = cpu_to_le64(dma);
++
++ while (unlikely(size > I40E_MAX_DATA_PER_TXD)) {
++ tx_desc->cmd_type_offset_bsz =
++ build_ctob(td_cmd, td_offset,
++ max_data, td_tag);
++
++ tx_desc++;
++ i++;
++
++ if (i == tx_ring->count) {
++ tx_desc = I40E_TX_DESC(tx_ring, 0);
++ i = 0;
++ }
++
++ dma += max_data;
++ size -= max_data;
++
++ max_data = I40E_MAX_DATA_PER_TXD_ALIGNED;
++ tx_desc->buffer_addr = cpu_to_le64(dma);
++ }
++
++ if (likely(!data_len))
++ break;
++
++ tx_desc->cmd_type_offset_bsz = build_ctob(td_cmd, td_offset,
++ size, td_tag);
++
++ tx_desc++;
++ i++;
++
++ if (i == tx_ring->count) {
++ tx_desc = I40E_TX_DESC(tx_ring, 0);
++ i = 0;
++ }
++
++ size = skb_frag_size(frag);
++ data_len -= size;
++
++ dma = skb_frag_dma_map(tx_ring->dev, frag, 0, size,
++ DMA_TO_DEVICE);
++
++ tx_bi = &tx_ring->tx_bi[i];
++ }
++
++ netdev_tx_sent_queue(txring_txq(tx_ring), first->bytecount);
++
++ i++;
++ if (i == tx_ring->count)
++ i = 0;
++
++ tx_ring->next_to_use = i;
++
++ i40e_maybe_stop_tx(tx_ring, DESC_NEEDED);
++
++ /* write last descriptor with RS and EOP bits */
++ td_cmd |= I40E_TXD_CMD;
++ tx_desc->cmd_type_offset_bsz =
++ build_ctob(td_cmd, td_offset, size, td_tag);
++
++ /* Force memory writes to complete before letting h/w know there
++ * are new descriptors to fetch.
++ *
++ * We also use this memory barrier to make certain all of the
++ * status bits have been updated before next_to_watch is written.
++ */
++ wmb();
++
++ /* set next_to_watch value indicating a packet is present */
++ first->next_to_watch = tx_desc;
++
++ /* notify HW of packet */
++ if (netif_xmit_stopped(txring_txq(tx_ring)) || !skb->xmit_more) {
++ writel(i, tx_ring->tail);
++
++ /* we need this if more than one processor can write to our tail
++ * at a time, it synchronizes IO on IA64/Altix systems
++ */
++ mmiowb();
++ }
++
++ return;
++
++dma_error:
++ dev_info(tx_ring->dev, "TX DMA map failed\n");
++
++ /* clear dma mappings for failed tx_bi map */
++ for (;;) {
++ tx_bi = &tx_ring->tx_bi[i];
++ i40e_unmap_and_free_tx_resource(tx_ring, tx_bi);
++ if (tx_bi == first)
++ break;
++ if (i == 0)
++ i = tx_ring->count;
++ i--;
++ }
++
++ tx_ring->next_to_use = i;
++}
++
++/**
++ * i40e_xmit_frame_ring - Sends buffer on Tx ring
++ * @skb: send buffer
++ * @tx_ring: ring to send buffer on
++ *
++ * Returns NETDEV_TX_OK if sent, else an error code
++ **/
++static netdev_tx_t i40e_xmit_frame_ring(struct sk_buff *skb,
++ struct i40e_ring *tx_ring)
++{
++ u64 cd_type_cmd_tso_mss = I40E_TX_DESC_DTYPE_CONTEXT;
++ u32 cd_tunneling = 0, cd_l2tag2 = 0;
++ struct i40e_tx_buffer *first;
++ u32 td_offset = 0;
++ u32 tx_flags = 0;
++ __be16 protocol;
++ u32 td_cmd = 0;
++ u8 hdr_len = 0;
++ int tso, count;
++
++ /* prefetch the data, we'll need it later */
++ prefetch(skb->data);
++
++ i40e_trace(xmit_frame_ring, skb, tx_ring);
++
++ count = i40e_xmit_descriptor_count(skb);
++ if (i40e_chk_linearize(skb, count)) {
++ if (__skb_linearize(skb)) {
++ dev_kfree_skb_any(skb);
++ return NETDEV_TX_OK;
++ }
++ count = i40e_txd_use_count(skb->len);
++ tx_ring->tx_stats.tx_linearize++;
++ }
++
++ /* need: 1 descriptor per page * PAGE_SIZE/I40E_MAX_DATA_PER_TXD,
++ * + 1 desc for skb_head_len/I40E_MAX_DATA_PER_TXD,
++ * + 4 desc gap to avoid the cache line where head is,
++ * + 1 desc for context descriptor,
++ * otherwise try next time
++ */
++ if (i40e_maybe_stop_tx(tx_ring, count + 4 + 1)) {
++ tx_ring->tx_stats.tx_busy++;
++ return NETDEV_TX_BUSY;
++ }
++
++ /* record the location of the first descriptor for this packet */
++ first = &tx_ring->tx_bi[tx_ring->next_to_use];
++ first->skb = skb;
++ first->bytecount = skb->len;
++ first->gso_segs = 1;
++
++ /* prepare the xmit flags */
++ if (i40evf_tx_prepare_vlan_flags(skb, tx_ring, &tx_flags))
++ goto out_drop;
++
++ /* obtain protocol of skb */
++ protocol = vlan_get_protocol(skb);
++
++ /* setup IPv4/IPv6 offloads */
++ if (protocol == htons(ETH_P_IP))
++ tx_flags |= I40E_TX_FLAGS_IPV4;
++ else if (protocol == htons(ETH_P_IPV6))
++ tx_flags |= I40E_TX_FLAGS_IPV6;
++
++ tso = i40e_tso(first, &hdr_len, &cd_type_cmd_tso_mss);
++
++ if (tso < 0)
++ goto out_drop;
++ else if (tso)
++ tx_flags |= I40E_TX_FLAGS_TSO;
++
++ /* Always offload the checksum, since it's in the data descriptor */
++ tso = i40e_tx_enable_csum(skb, &tx_flags, &td_cmd, &td_offset,
++ tx_ring, &cd_tunneling);
++ if (tso < 0)
++ goto out_drop;
++
++ skb_tx_timestamp(skb);
++
++ /* always enable CRC insertion offload */
++ td_cmd |= I40E_TX_DESC_CMD_ICRC;
++
++ i40e_create_tx_ctx(tx_ring, cd_type_cmd_tso_mss,
++ cd_tunneling, cd_l2tag2);
++
++ i40evf_tx_map(tx_ring, skb, first, tx_flags, hdr_len,
++ td_cmd, td_offset);
++
++ return NETDEV_TX_OK;
++
++out_drop:
++ i40e_trace(xmit_frame_ring_drop, first->skb, tx_ring);
++ dev_kfree_skb_any(first->skb);
++ first->skb = NULL;
++ return NETDEV_TX_OK;
++}
++
++/**
++ * i40evf_xmit_frame - Selects the correct VSI and Tx queue to send buffer
++ * @skb: send buffer
++ * @netdev: network interface device structure
++ *
++ * Returns NETDEV_TX_OK if sent, else an error code
++ **/
++netdev_tx_t i40evf_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ struct i40e_ring *tx_ring = &adapter->tx_rings[skb->queue_mapping];
++
++ /* hardware can't handle really short frames, hardware padding works
++ * beyond this point
++ */
++ if (unlikely(skb->len < I40E_MIN_TX_LEN)) {
++ if (skb_pad(skb, I40E_MIN_TX_LEN - skb->len))
++ return NETDEV_TX_OK;
++ skb->len = I40E_MIN_TX_LEN;
++ skb_set_tail_pointer(skb, I40E_MIN_TX_LEN);
++ }
++
++ return i40e_xmit_frame_ring(skb, tx_ring);
++}
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_txrx.h b/drivers/net/ethernet/intel/iavf/i40e_txrx.h
+new file mode 100644
+index 0000000000000..3b5a63b3236eb
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_txrx.h
+@@ -0,0 +1,524 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40E_TXRX_H_
++#define _I40E_TXRX_H_
++
++/* Interrupt Throttling and Rate Limiting Goodies */
++#define I40E_DEFAULT_IRQ_WORK 256
++
++/* The datasheet for the X710 and XL710 indicate that the maximum value for
++ * the ITR is 8160usec which is then called out as 0xFF0 with a 2usec
++ * resolution. 8160 is 0x1FE0 when written out in hex. So instead of storing
++ * the register value which is divided by 2 lets use the actual values and
++ * avoid an excessive amount of translation.
++ */
++#define I40E_ITR_DYNAMIC 0x8000 /* use top bit as a flag */
++#define I40E_ITR_MASK 0x1FFE /* mask for ITR register value */
++#define I40E_MIN_ITR 2 /* reg uses 2 usec resolution */
++#define I40E_ITR_100K 10 /* all values below must be even */
++#define I40E_ITR_50K 20
++#define I40E_ITR_20K 50
++#define I40E_ITR_18K 60
++#define I40E_ITR_8K 122
++#define I40E_MAX_ITR 8160 /* maximum value as per datasheet */
++#define ITR_TO_REG(setting) ((setting) & ~I40E_ITR_DYNAMIC)
++#define ITR_REG_ALIGN(setting) __ALIGN_MASK(setting, ~I40E_ITR_MASK)
++#define ITR_IS_DYNAMIC(setting) (!!((setting) & I40E_ITR_DYNAMIC))
++
++#define I40E_ITR_RX_DEF (I40E_ITR_20K | I40E_ITR_DYNAMIC)
++#define I40E_ITR_TX_DEF (I40E_ITR_20K | I40E_ITR_DYNAMIC)
++
++/* 0x40 is the enable bit for interrupt rate limiting, and must be set if
++ * the value of the rate limit is non-zero
++ */
++#define INTRL_ENA BIT(6)
++#define I40E_MAX_INTRL 0x3B /* reg uses 4 usec resolution */
++#define INTRL_REG_TO_USEC(intrl) ((intrl & ~INTRL_ENA) << 2)
++#define INTRL_USEC_TO_REG(set) ((set) ? ((set) >> 2) | INTRL_ENA : 0)
++#define I40E_INTRL_8K 125 /* 8000 ints/sec */
++#define I40E_INTRL_62K 16 /* 62500 ints/sec */
++#define I40E_INTRL_83K 12 /* 83333 ints/sec */
++
++#define I40E_QUEUE_END_OF_LIST 0x7FF
++
++/* this enum matches hardware bits and is meant to be used by DYN_CTLN
++ * registers and QINT registers or more generally anywhere in the manual
++ * mentioning ITR_INDX, ITR_NONE cannot be used as an index 'n' into any
++ * register but instead is a special value meaning "don't update" ITR0/1/2.
++ */
++enum i40e_dyn_idx_t {
++ I40E_IDX_ITR0 = 0,
++ I40E_IDX_ITR1 = 1,
++ I40E_IDX_ITR2 = 2,
++ I40E_ITR_NONE = 3 /* ITR_NONE must not be used as an index */
++};
++
++/* these are indexes into ITRN registers */
++#define I40E_RX_ITR I40E_IDX_ITR0
++#define I40E_TX_ITR I40E_IDX_ITR1
++#define I40E_PE_ITR I40E_IDX_ITR2
++
++/* Supported RSS offloads */
++#define I40E_DEFAULT_RSS_HENA ( \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_UDP) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_SCTP) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_TCP) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_OTHER) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_FRAG_IPV4) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_UDP) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_TCP) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_SCTP) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_OTHER) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_FRAG_IPV6) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_L2_PAYLOAD))
++
++#define I40E_DEFAULT_RSS_HENA_EXPANDED (I40E_DEFAULT_RSS_HENA | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV4_UDP) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV4_UDP) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_IPV6_TCP_SYN_NO_ACK) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_UNICAST_IPV6_UDP) | \
++ BIT_ULL(I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV6_UDP))
++
++/* Supported Rx Buffer Sizes (a multiple of 128) */
++#define I40E_RXBUFFER_256 256
++#define I40E_RXBUFFER_1536 1536 /* 128B aligned standard Ethernet frame */
++#define I40E_RXBUFFER_2048 2048
++#define I40E_RXBUFFER_3072 3072 /* Used for large frames w/ padding */
++#define I40E_MAX_RXBUFFER 9728 /* largest size for single descriptor */
++
++/* NOTE: netdev_alloc_skb reserves up to 64 bytes, NET_IP_ALIGN means we
++ * reserve 2 more, and skb_shared_info adds an additional 384 bytes more,
++ * this adds up to 512 bytes of extra data meaning the smallest allocation
++ * we could have is 1K.
++ * i.e. RXBUFFER_256 --> 960 byte skb (size-1024 slab)
++ * i.e. RXBUFFER_512 --> 1216 byte skb (size-2048 slab)
++ */
++#define I40E_RX_HDR_SIZE I40E_RXBUFFER_256
++#define I40E_PACKET_HDR_PAD (ETH_HLEN + ETH_FCS_LEN + (VLAN_HLEN * 2))
++#define i40e_rx_desc i40e_32byte_rx_desc
++
++#define I40E_RX_DMA_ATTR \
++ (DMA_ATTR_SKIP_CPU_SYNC | DMA_ATTR_WEAK_ORDERING)
++
++/* Attempt to maximize the headroom available for incoming frames. We
++ * use a 2K buffer for receives and need 1536/1534 to store the data for
++ * the frame. This leaves us with 512 bytes of room. From that we need
++ * to deduct the space needed for the shared info and the padding needed
++ * to IP align the frame.
++ *
++ * Note: For cache line sizes 256 or larger this value is going to end
++ * up negative. In these cases we should fall back to the legacy
++ * receive path.
++ */
++#if (PAGE_SIZE < 8192)
++#define I40E_2K_TOO_SMALL_WITH_PADDING \
++((NET_SKB_PAD + I40E_RXBUFFER_1536) > SKB_WITH_OVERHEAD(I40E_RXBUFFER_2048))
++
++static inline int i40e_compute_pad(int rx_buf_len)
++{
++ int page_size, pad_size;
++
++ page_size = ALIGN(rx_buf_len, PAGE_SIZE / 2);
++ pad_size = SKB_WITH_OVERHEAD(page_size) - rx_buf_len;
++
++ return pad_size;
++}
++
++static inline int i40e_skb_pad(void)
++{
++ int rx_buf_len;
++
++ /* If a 2K buffer cannot handle a standard Ethernet frame then
++ * optimize padding for a 3K buffer instead of a 1.5K buffer.
++ *
++ * For a 3K buffer we need to add enough padding to allow for
++ * tailroom due to NET_IP_ALIGN possibly shifting us out of
++ * cache-line alignment.
++ */
++ if (I40E_2K_TOO_SMALL_WITH_PADDING)
++ rx_buf_len = I40E_RXBUFFER_3072 + SKB_DATA_ALIGN(NET_IP_ALIGN);
++ else
++ rx_buf_len = I40E_RXBUFFER_1536;
++
++ /* if needed make room for NET_IP_ALIGN */
++ rx_buf_len -= NET_IP_ALIGN;
++
++ return i40e_compute_pad(rx_buf_len);
++}
++
++#define I40E_SKB_PAD i40e_skb_pad()
++#else
++#define I40E_2K_TOO_SMALL_WITH_PADDING false
++#define I40E_SKB_PAD (NET_SKB_PAD + NET_IP_ALIGN)
++#endif
++
++/**
++ * i40e_test_staterr - tests bits in Rx descriptor status and error fields
++ * @rx_desc: pointer to receive descriptor (in le64 format)
++ * @stat_err_bits: value to mask
++ *
++ * This function does some fast chicanery in order to return the
++ * value of the mask which is really only used for boolean tests.
++ * The status_error_len doesn't need to be shifted because it begins
++ * at offset zero.
++ */
++static inline bool i40e_test_staterr(union i40e_rx_desc *rx_desc,
++ const u64 stat_err_bits)
++{
++ return !!(rx_desc->wb.qword1.status_error_len &
++ cpu_to_le64(stat_err_bits));
++}
++
++/* How many Rx Buffers do we bundle into one write to the hardware ? */
++#define I40E_RX_BUFFER_WRITE 32 /* Must be power of 2 */
++#define I40E_RX_INCREMENT(r, i) \
++ do { \
++ (i)++; \
++ if ((i) == (r)->count) \
++ i = 0; \
++ r->next_to_clean = i; \
++ } while (0)
++
++#define I40E_RX_NEXT_DESC(r, i, n) \
++ do { \
++ (i)++; \
++ if ((i) == (r)->count) \
++ i = 0; \
++ (n) = I40E_RX_DESC((r), (i)); \
++ } while (0)
++
++#define I40E_RX_NEXT_DESC_PREFETCH(r, i, n) \
++ do { \
++ I40E_RX_NEXT_DESC((r), (i), (n)); \
++ prefetch((n)); \
++ } while (0)
++
++#define I40E_MAX_BUFFER_TXD 8
++#define I40E_MIN_TX_LEN 17
++
++/* The size limit for a transmit buffer in a descriptor is (16K - 1).
++ * In order to align with the read requests we will align the value to
++ * the nearest 4K which represents our maximum read request size.
++ */
++#define I40E_MAX_READ_REQ_SIZE 4096
++#define I40E_MAX_DATA_PER_TXD (16 * 1024 - 1)
++#define I40E_MAX_DATA_PER_TXD_ALIGNED \
++ (I40E_MAX_DATA_PER_TXD & ~(I40E_MAX_READ_REQ_SIZE - 1))
++
++/**
++ * i40e_txd_use_count - estimate the number of descriptors needed for Tx
++ * @size: transmit request size in bytes
++ *
++ * Due to hardware alignment restrictions (4K alignment), we need to
++ * assume that we can have no more than 12K of data per descriptor, even
++ * though each descriptor can take up to 16K - 1 bytes of aligned memory.
++ * Thus, we need to divide by 12K. But division is slow! Instead,
++ * we decompose the operation into shifts and one relatively cheap
++ * multiply operation.
++ *
++ * To divide by 12K, we first divide by 4K, then divide by 3:
++ * To divide by 4K, shift right by 12 bits
++ * To divide by 3, multiply by 85, then divide by 256
++ * (Divide by 256 is done by shifting right by 8 bits)
++ * Finally, we add one to round up. Because 256 isn't an exact multiple of
++ * 3, we'll underestimate near each multiple of 12K. This is actually more
++ * accurate as we have 4K - 1 of wiggle room that we can fit into the last
++ * segment. For our purposes this is accurate out to 1M which is orders of
++ * magnitude greater than our largest possible GSO size.
++ *
++ * This would then be implemented as:
++ * return (((size >> 12) * 85) >> 8) + 1;
++ *
++ * Since multiplication and division are commutative, we can reorder
++ * operations into:
++ * return ((size * 85) >> 20) + 1;
++ */
++static inline unsigned int i40e_txd_use_count(unsigned int size)
++{
++ return ((size * 85) >> 20) + 1;
++}
++
++/* Tx Descriptors needed, worst case */
++#define DESC_NEEDED (MAX_SKB_FRAGS + 6)
++#define I40E_MIN_DESC_PENDING 4
++
++#define I40E_TX_FLAGS_HW_VLAN BIT(1)
++#define I40E_TX_FLAGS_SW_VLAN BIT(2)
++#define I40E_TX_FLAGS_TSO BIT(3)
++#define I40E_TX_FLAGS_IPV4 BIT(4)
++#define I40E_TX_FLAGS_IPV6 BIT(5)
++#define I40E_TX_FLAGS_FCCRC BIT(6)
++#define I40E_TX_FLAGS_FSO BIT(7)
++#define I40E_TX_FLAGS_FD_SB BIT(9)
++#define I40E_TX_FLAGS_VXLAN_TUNNEL BIT(10)
++#define I40E_TX_FLAGS_VLAN_MASK 0xffff0000
++#define I40E_TX_FLAGS_VLAN_PRIO_MASK 0xe0000000
++#define I40E_TX_FLAGS_VLAN_PRIO_SHIFT 29
++#define I40E_TX_FLAGS_VLAN_SHIFT 16
++
++struct i40e_tx_buffer {
++ struct i40e_tx_desc *next_to_watch;
++ union {
++ struct sk_buff *skb;
++ void *raw_buf;
++ };
++ unsigned int bytecount;
++ unsigned short gso_segs;
++
++ DEFINE_DMA_UNMAP_ADDR(dma);
++ DEFINE_DMA_UNMAP_LEN(len);
++ u32 tx_flags;
++};
++
++struct i40e_rx_buffer {
++ dma_addr_t dma;
++ struct page *page;
++#if (BITS_PER_LONG > 32) || (PAGE_SIZE >= 65536)
++ __u32 page_offset;
++#else
++ __u16 page_offset;
++#endif
++ __u16 pagecnt_bias;
++};
++
++struct i40e_queue_stats {
++ u64 packets;
++ u64 bytes;
++};
++
++struct i40e_tx_queue_stats {
++ u64 restart_queue;
++ u64 tx_busy;
++ u64 tx_done_old;
++ u64 tx_linearize;
++ u64 tx_force_wb;
++ int prev_pkt_ctr;
++ u64 tx_lost_interrupt;
++};
++
++struct i40e_rx_queue_stats {
++ u64 non_eop_descs;
++ u64 alloc_page_failed;
++ u64 alloc_buff_failed;
++ u64 page_reuse_count;
++ u64 realloc_count;
++};
++
++enum i40e_ring_state_t {
++ __I40E_TX_FDIR_INIT_DONE,
++ __I40E_TX_XPS_INIT_DONE,
++ __I40E_RING_STATE_NBITS /* must be last */
++};
++
++/* some useful defines for virtchannel interface, which
++ * is the only remaining user of header split
++ */
++#define I40E_RX_DTYPE_NO_SPLIT 0
++#define I40E_RX_DTYPE_HEADER_SPLIT 1
++#define I40E_RX_DTYPE_SPLIT_ALWAYS 2
++#define I40E_RX_SPLIT_L2 0x1
++#define I40E_RX_SPLIT_IP 0x2
++#define I40E_RX_SPLIT_TCP_UDP 0x4
++#define I40E_RX_SPLIT_SCTP 0x8
++
++/* struct that defines a descriptor ring, associated with a VSI */
++struct i40e_ring {
++ struct i40e_ring *next; /* pointer to next ring in q_vector */
++ void *desc; /* Descriptor ring memory */
++ struct device *dev; /* Used for DMA mapping */
++ struct net_device *netdev; /* netdev ring maps to */
++ union {
++ struct i40e_tx_buffer *tx_bi;
++ struct i40e_rx_buffer *rx_bi;
++ };
++ DECLARE_BITMAP(state, __I40E_RING_STATE_NBITS);
++ u16 queue_index; /* Queue number of ring */
++ u8 dcb_tc; /* Traffic class of ring */
++ u8 __iomem *tail;
++
++ /* high bit set means dynamic, use accessors routines to read/write.
++ * hardware only supports 2us resolution for the ITR registers.
++ * these values always store the USER setting, and must be converted
++ * before programming to a register.
++ */
++ u16 itr_setting;
++
++ u16 count; /* Number of descriptors */
++ u16 reg_idx; /* HW register index of the ring */
++ u16 rx_buf_len;
++
++ /* used in interrupt processing */
++ u16 next_to_use;
++ u16 next_to_clean;
++
++ u8 atr_sample_rate;
++ u8 atr_count;
++
++ bool ring_active; /* is ring online or not */
++ bool arm_wb; /* do something to arm write back */
++ u8 packet_stride;
++
++ u16 flags;
++#define I40E_TXR_FLAGS_WB_ON_ITR BIT(0)
++#define I40E_RXR_FLAGS_BUILD_SKB_ENABLED BIT(1)
++
++ /* stats structs */
++ struct i40e_queue_stats stats;
++ struct u64_stats_sync syncp;
++ union {
++ struct i40e_tx_queue_stats tx_stats;
++ struct i40e_rx_queue_stats rx_stats;
++ };
++
++ unsigned int size; /* length of descriptor ring in bytes */
++ dma_addr_t dma; /* physical address of ring */
++
++ struct i40e_vsi *vsi; /* Backreference to associated VSI */
++ struct i40e_q_vector *q_vector; /* Backreference to associated vector */
++
++ struct rcu_head rcu; /* to avoid race on free */
++ u16 next_to_alloc;
++ struct sk_buff *skb; /* When i40evf_clean_rx_ring_irq() must
++ * return before it sees the EOP for
++ * the current packet, we save that skb
++ * here and resume receiving this
++ * packet the next time
++ * i40evf_clean_rx_ring_irq() is called
++ * for this ring.
++ */
++} ____cacheline_internodealigned_in_smp;
++
++static inline bool ring_uses_build_skb(struct i40e_ring *ring)
++{
++ return !!(ring->flags & I40E_RXR_FLAGS_BUILD_SKB_ENABLED);
++}
++
++static inline void set_ring_build_skb_enabled(struct i40e_ring *ring)
++{
++ ring->flags |= I40E_RXR_FLAGS_BUILD_SKB_ENABLED;
++}
++
++static inline void clear_ring_build_skb_enabled(struct i40e_ring *ring)
++{
++ ring->flags &= ~I40E_RXR_FLAGS_BUILD_SKB_ENABLED;
++}
++
++#define I40E_ITR_ADAPTIVE_MIN_INC 0x0002
++#define I40E_ITR_ADAPTIVE_MIN_USECS 0x0002
++#define I40E_ITR_ADAPTIVE_MAX_USECS 0x007e
++#define I40E_ITR_ADAPTIVE_LATENCY 0x8000
++#define I40E_ITR_ADAPTIVE_BULK 0x0000
++#define ITR_IS_BULK(x) (!((x) & I40E_ITR_ADAPTIVE_LATENCY))
++
++struct i40e_ring_container {
++ struct i40e_ring *ring; /* pointer to linked list of ring(s) */
++ unsigned long next_update; /* jiffies value of next update */
++ unsigned int total_bytes; /* total bytes processed this int */
++ unsigned int total_packets; /* total packets processed this int */
++ u16 count;
++ u16 target_itr; /* target ITR setting for ring(s) */
++ u16 current_itr; /* current ITR setting for ring(s) */
++};
++
++/* iterator for handling rings in ring container */
++#define i40e_for_each_ring(pos, head) \
++ for (pos = (head).ring; pos != NULL; pos = pos->next)
++
++static inline unsigned int i40e_rx_pg_order(struct i40e_ring *ring)
++{
++#if (PAGE_SIZE < 8192)
++ if (ring->rx_buf_len > (PAGE_SIZE / 2))
++ return 1;
++#endif
++ return 0;
++}
++
++#define i40e_rx_pg_size(_ring) (PAGE_SIZE << i40e_rx_pg_order(_ring))
++
++bool i40evf_alloc_rx_buffers(struct i40e_ring *rxr, u16 cleaned_count);
++netdev_tx_t i40evf_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
++void i40evf_clean_tx_ring(struct i40e_ring *tx_ring);
++void i40evf_clean_rx_ring(struct i40e_ring *rx_ring);
++int i40evf_setup_tx_descriptors(struct i40e_ring *tx_ring);
++int i40evf_setup_rx_descriptors(struct i40e_ring *rx_ring);
++void i40evf_free_tx_resources(struct i40e_ring *tx_ring);
++void i40evf_free_rx_resources(struct i40e_ring *rx_ring);
++int i40evf_napi_poll(struct napi_struct *napi, int budget);
++void i40evf_force_wb(struct i40e_vsi *vsi, struct i40e_q_vector *q_vector);
++u32 i40evf_get_tx_pending(struct i40e_ring *ring, bool in_sw);
++void i40evf_detect_recover_hung(struct i40e_vsi *vsi);
++int __i40evf_maybe_stop_tx(struct i40e_ring *tx_ring, int size);
++bool __i40evf_chk_linearize(struct sk_buff *skb);
++
++/**
++ * i40e_xmit_descriptor_count - calculate number of Tx descriptors needed
++ * @skb: send buffer
++ * @tx_ring: ring to send buffer on
++ *
++ * Returns number of data descriptors needed for this skb. Returns 0 to indicate
++ * there is not enough descriptors available in this ring since we need at least
++ * one descriptor.
++ **/
++static inline int i40e_xmit_descriptor_count(struct sk_buff *skb)
++{
++ const struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[0];
++ unsigned int nr_frags = skb_shinfo(skb)->nr_frags;
++ int count = 0, size = skb_headlen(skb);
++
++ for (;;) {
++ count += i40e_txd_use_count(size);
++
++ if (!nr_frags--)
++ break;
++
++ size = skb_frag_size(frag++);
++ }
++
++ return count;
++}
++
++/**
++ * i40e_maybe_stop_tx - 1st level check for Tx stop conditions
++ * @tx_ring: the ring to be checked
++ * @size: the size buffer we want to assure is available
++ *
++ * Returns 0 if stop is not needed
++ **/
++static inline int i40e_maybe_stop_tx(struct i40e_ring *tx_ring, int size)
++{
++ if (likely(I40E_DESC_UNUSED(tx_ring) >= size))
++ return 0;
++ return __i40evf_maybe_stop_tx(tx_ring, size);
++}
++
++/**
++ * i40e_chk_linearize - Check if there are more than 8 fragments per packet
++ * @skb: send buffer
++ * @count: number of buffers used
++ *
++ * Note: Our HW can't scatter-gather more than 8 fragments to build
++ * a packet on the wire and so we need to figure out the cases where we
++ * need to linearize the skb.
++ **/
++static inline bool i40e_chk_linearize(struct sk_buff *skb, int count)
++{
++ /* Both TSO and single send will work if count is less than 8 */
++ if (likely(count < I40E_MAX_BUFFER_TXD))
++ return false;
++
++ if (skb_is_gso(skb))
++ return __i40evf_chk_linearize(skb);
++
++ /* we can support up to 8 data buffers for a single send */
++ return count != I40E_MAX_BUFFER_TXD;
++}
++/**
++ * @ring: Tx ring to find the netdev equivalent of
++ **/
++static inline struct netdev_queue *txring_txq(const struct i40e_ring *ring)
++{
++ return netdev_get_tx_queue(ring->netdev, ring->queue_index);
++}
++#endif /* _I40E_TXRX_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40e_type.h b/drivers/net/ethernet/intel/iavf/i40e_type.h
+new file mode 100644
+index 0000000000000..8f1344094bc93
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40e_type.h
+@@ -0,0 +1,719 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40E_TYPE_H_
++#define _I40E_TYPE_H_
++
++#include "i40e_status.h"
++#include "i40e_osdep.h"
++#include "i40e_register.h"
++#include "i40e_adminq.h"
++#include "i40e_devids.h"
++
++#define I40E_RXQ_CTX_DBUFF_SHIFT 7
++
++/* I40E_MASK is a macro used on 32 bit registers */
++#define I40E_MASK(mask, shift) ((u32)(mask) << (shift))
++
++#define I40E_MAX_VSI_QP 16
++#define I40E_MAX_VF_VSI 3
++#define I40E_MAX_CHAINED_RX_BUFFERS 5
++
++/* forward declaration */
++struct i40e_hw;
++typedef void (*I40E_ADMINQ_CALLBACK)(struct i40e_hw *, struct i40e_aq_desc *);
++
++/* Data type manipulation macros. */
++
++#define I40E_DESC_UNUSED(R) \
++ ((((R)->next_to_clean > (R)->next_to_use) ? 0 : (R)->count) + \
++ (R)->next_to_clean - (R)->next_to_use - 1)
++
++/* bitfields for Tx queue mapping in QTX_CTL */
++#define I40E_QTX_CTL_VF_QUEUE 0x0
++#define I40E_QTX_CTL_VM_QUEUE 0x1
++#define I40E_QTX_CTL_PF_QUEUE 0x2
++
++/* debug masks - set these bits in hw->debug_mask to control output */
++enum i40e_debug_mask {
++ I40E_DEBUG_INIT = 0x00000001,
++ I40E_DEBUG_RELEASE = 0x00000002,
++
++ I40E_DEBUG_LINK = 0x00000010,
++ I40E_DEBUG_PHY = 0x00000020,
++ I40E_DEBUG_HMC = 0x00000040,
++ I40E_DEBUG_NVM = 0x00000080,
++ I40E_DEBUG_LAN = 0x00000100,
++ I40E_DEBUG_FLOW = 0x00000200,
++ I40E_DEBUG_DCB = 0x00000400,
++ I40E_DEBUG_DIAG = 0x00000800,
++ I40E_DEBUG_FD = 0x00001000,
++ I40E_DEBUG_PACKAGE = 0x00002000,
++
++ I40E_DEBUG_AQ_MESSAGE = 0x01000000,
++ I40E_DEBUG_AQ_DESCRIPTOR = 0x02000000,
++ I40E_DEBUG_AQ_DESC_BUFFER = 0x04000000,
++ I40E_DEBUG_AQ_COMMAND = 0x06000000,
++ I40E_DEBUG_AQ = 0x0F000000,
++
++ I40E_DEBUG_USER = 0xF0000000,
++
++ I40E_DEBUG_ALL = 0xFFFFFFFF
++};
++
++/* These are structs for managing the hardware information and the operations.
++ * The structures of function pointers are filled out at init time when we
++ * know for sure exactly which hardware we're working with. This gives us the
++ * flexibility of using the same main driver code but adapting to slightly
++ * different hardware needs as new parts are developed. For this architecture,
++ * the Firmware and AdminQ are intended to insulate the driver from most of the
++ * future changes, but these structures will also do part of the job.
++ */
++enum i40e_mac_type {
++ I40E_MAC_UNKNOWN = 0,
++ I40E_MAC_XL710,
++ I40E_MAC_VF,
++ I40E_MAC_X722,
++ I40E_MAC_X722_VF,
++ I40E_MAC_GENERIC,
++};
++
++enum i40e_vsi_type {
++ I40E_VSI_MAIN = 0,
++ I40E_VSI_VMDQ1 = 1,
++ I40E_VSI_VMDQ2 = 2,
++ I40E_VSI_CTRL = 3,
++ I40E_VSI_FCOE = 4,
++ I40E_VSI_MIRROR = 5,
++ I40E_VSI_SRIOV = 6,
++ I40E_VSI_FDIR = 7,
++ I40E_VSI_TYPE_UNKNOWN
++};
++
++enum i40e_queue_type {
++ I40E_QUEUE_TYPE_RX = 0,
++ I40E_QUEUE_TYPE_TX,
++ I40E_QUEUE_TYPE_PE_CEQ,
++ I40E_QUEUE_TYPE_UNKNOWN
++};
++
++#define I40E_HW_CAP_MAX_GPIO 30
++/* Capabilities of a PF or a VF or the whole device */
++struct i40e_hw_capabilities {
++ bool dcb;
++ bool fcoe;
++ u32 num_vsis;
++ u32 num_rx_qp;
++ u32 num_tx_qp;
++ u32 base_queue;
++ u32 num_msix_vectors_vf;
++};
++
++struct i40e_mac_info {
++ enum i40e_mac_type type;
++ u8 addr[ETH_ALEN];
++ u8 perm_addr[ETH_ALEN];
++ u8 san_addr[ETH_ALEN];
++ u16 max_fcoeq;
++};
++
++/* PCI bus types */
++enum i40e_bus_type {
++ i40e_bus_type_unknown = 0,
++ i40e_bus_type_pci,
++ i40e_bus_type_pcix,
++ i40e_bus_type_pci_express,
++ i40e_bus_type_reserved
++};
++
++/* PCI bus speeds */
++enum i40e_bus_speed {
++ i40e_bus_speed_unknown = 0,
++ i40e_bus_speed_33 = 33,
++ i40e_bus_speed_66 = 66,
++ i40e_bus_speed_100 = 100,
++ i40e_bus_speed_120 = 120,
++ i40e_bus_speed_133 = 133,
++ i40e_bus_speed_2500 = 2500,
++ i40e_bus_speed_5000 = 5000,
++ i40e_bus_speed_8000 = 8000,
++ i40e_bus_speed_reserved
++};
++
++/* PCI bus widths */
++enum i40e_bus_width {
++ i40e_bus_width_unknown = 0,
++ i40e_bus_width_pcie_x1 = 1,
++ i40e_bus_width_pcie_x2 = 2,
++ i40e_bus_width_pcie_x4 = 4,
++ i40e_bus_width_pcie_x8 = 8,
++ i40e_bus_width_32 = 32,
++ i40e_bus_width_64 = 64,
++ i40e_bus_width_reserved
++};
++
++/* Bus parameters */
++struct i40e_bus_info {
++ enum i40e_bus_speed speed;
++ enum i40e_bus_width width;
++ enum i40e_bus_type type;
++
++ u16 func;
++ u16 device;
++ u16 lan_id;
++ u16 bus_id;
++};
++
++#define I40E_MAX_TRAFFIC_CLASS 8
++#define I40E_MAX_USER_PRIORITY 8
++/* Port hardware description */
++struct i40e_hw {
++ u8 __iomem *hw_addr;
++ void *back;
++
++ /* subsystem structs */
++ struct i40e_mac_info mac;
++ struct i40e_bus_info bus;
++
++ /* pci info */
++ u16 device_id;
++ u16 vendor_id;
++ u16 subsystem_device_id;
++ u16 subsystem_vendor_id;
++ u8 revision_id;
++
++ /* capabilities for entire device and PCI func */
++ struct i40e_hw_capabilities dev_caps;
++
++ /* Admin Queue info */
++ struct i40e_adminq_info aq;
++
++ /* debug mask */
++ u32 debug_mask;
++ char err_str[16];
++};
++
++static inline bool i40e_is_vf(struct i40e_hw *hw)
++{
++ return (hw->mac.type == I40E_MAC_VF ||
++ hw->mac.type == I40E_MAC_X722_VF);
++}
++
++struct i40e_driver_version {
++ u8 major_version;
++ u8 minor_version;
++ u8 build_version;
++ u8 subbuild_version;
++ u8 driver_string[32];
++};
++
++/* RX Descriptors */
++union i40e_16byte_rx_desc {
++ struct {
++ __le64 pkt_addr; /* Packet buffer address */
++ __le64 hdr_addr; /* Header buffer address */
++ } read;
++ struct {
++ struct {
++ struct {
++ union {
++ __le16 mirroring_status;
++ __le16 fcoe_ctx_id;
++ } mirr_fcoe;
++ __le16 l2tag1;
++ } lo_dword;
++ union {
++ __le32 rss; /* RSS Hash */
++ __le32 fd_id; /* Flow director filter id */
++ __le32 fcoe_param; /* FCoE DDP Context id */
++ } hi_dword;
++ } qword0;
++ struct {
++ /* ext status/error/pktype/length */
++ __le64 status_error_len;
++ } qword1;
++ } wb; /* writeback */
++};
++
++union i40e_32byte_rx_desc {
++ struct {
++ __le64 pkt_addr; /* Packet buffer address */
++ __le64 hdr_addr; /* Header buffer address */
++ /* bit 0 of hdr_buffer_addr is DD bit */
++ __le64 rsvd1;
++ __le64 rsvd2;
++ } read;
++ struct {
++ struct {
++ struct {
++ union {
++ __le16 mirroring_status;
++ __le16 fcoe_ctx_id;
++ } mirr_fcoe;
++ __le16 l2tag1;
++ } lo_dword;
++ union {
++ __le32 rss; /* RSS Hash */
++ __le32 fcoe_param; /* FCoE DDP Context id */
++ /* Flow director filter id in case of
++ * Programming status desc WB
++ */
++ __le32 fd_id;
++ } hi_dword;
++ } qword0;
++ struct {
++ /* status/error/pktype/length */
++ __le64 status_error_len;
++ } qword1;
++ struct {
++ __le16 ext_status; /* extended status */
++ __le16 rsvd;
++ __le16 l2tag2_1;
++ __le16 l2tag2_2;
++ } qword2;
++ struct {
++ union {
++ __le32 flex_bytes_lo;
++ __le32 pe_status;
++ } lo_dword;
++ union {
++ __le32 flex_bytes_hi;
++ __le32 fd_id;
++ } hi_dword;
++ } qword3;
++ } wb; /* writeback */
++};
++
++enum i40e_rx_desc_status_bits {
++ /* Note: These are predefined bit offsets */
++ I40E_RX_DESC_STATUS_DD_SHIFT = 0,
++ I40E_RX_DESC_STATUS_EOF_SHIFT = 1,
++ I40E_RX_DESC_STATUS_L2TAG1P_SHIFT = 2,
++ I40E_RX_DESC_STATUS_L3L4P_SHIFT = 3,
++ I40E_RX_DESC_STATUS_CRCP_SHIFT = 4,
++ I40E_RX_DESC_STATUS_TSYNINDX_SHIFT = 5, /* 2 BITS */
++ I40E_RX_DESC_STATUS_TSYNVALID_SHIFT = 7,
++ /* Note: Bit 8 is reserved in X710 and XL710 */
++ I40E_RX_DESC_STATUS_EXT_UDP_0_SHIFT = 8,
++ I40E_RX_DESC_STATUS_UMBCAST_SHIFT = 9, /* 2 BITS */
++ I40E_RX_DESC_STATUS_FLM_SHIFT = 11,
++ I40E_RX_DESC_STATUS_FLTSTAT_SHIFT = 12, /* 2 BITS */
++ I40E_RX_DESC_STATUS_LPBK_SHIFT = 14,
++ I40E_RX_DESC_STATUS_IPV6EXADD_SHIFT = 15,
++ I40E_RX_DESC_STATUS_RESERVED_SHIFT = 16, /* 2 BITS */
++ /* Note: For non-tunnel packets INT_UDP_0 is the right status for
++ * UDP header
++ */
++ I40E_RX_DESC_STATUS_INT_UDP_0_SHIFT = 18,
++ I40E_RX_DESC_STATUS_LAST /* this entry must be last!!! */
++};
++
++#define I40E_RXD_QW1_STATUS_SHIFT 0
++#define I40E_RXD_QW1_STATUS_MASK ((BIT(I40E_RX_DESC_STATUS_LAST) - 1) \
++ << I40E_RXD_QW1_STATUS_SHIFT)
++
++#define I40E_RXD_QW1_STATUS_TSYNINDX_SHIFT I40E_RX_DESC_STATUS_TSYNINDX_SHIFT
++#define I40E_RXD_QW1_STATUS_TSYNINDX_MASK (0x3UL << \
++ I40E_RXD_QW1_STATUS_TSYNINDX_SHIFT)
++
++#define I40E_RXD_QW1_STATUS_TSYNVALID_SHIFT I40E_RX_DESC_STATUS_TSYNVALID_SHIFT
++#define I40E_RXD_QW1_STATUS_TSYNVALID_MASK \
++ BIT_ULL(I40E_RXD_QW1_STATUS_TSYNVALID_SHIFT)
++
++enum i40e_rx_desc_fltstat_values {
++ I40E_RX_DESC_FLTSTAT_NO_DATA = 0,
++ I40E_RX_DESC_FLTSTAT_RSV_FD_ID = 1, /* 16byte desc? FD_ID : RSV */
++ I40E_RX_DESC_FLTSTAT_RSV = 2,
++ I40E_RX_DESC_FLTSTAT_RSS_HASH = 3,
++};
++
++#define I40E_RXD_QW1_ERROR_SHIFT 19
++#define I40E_RXD_QW1_ERROR_MASK (0xFFUL << I40E_RXD_QW1_ERROR_SHIFT)
++
++enum i40e_rx_desc_error_bits {
++ /* Note: These are predefined bit offsets */
++ I40E_RX_DESC_ERROR_RXE_SHIFT = 0,
++ I40E_RX_DESC_ERROR_RECIPE_SHIFT = 1,
++ I40E_RX_DESC_ERROR_HBO_SHIFT = 2,
++ I40E_RX_DESC_ERROR_L3L4E_SHIFT = 3, /* 3 BITS */
++ I40E_RX_DESC_ERROR_IPE_SHIFT = 3,
++ I40E_RX_DESC_ERROR_L4E_SHIFT = 4,
++ I40E_RX_DESC_ERROR_EIPE_SHIFT = 5,
++ I40E_RX_DESC_ERROR_OVERSIZE_SHIFT = 6,
++ I40E_RX_DESC_ERROR_PPRS_SHIFT = 7
++};
++
++enum i40e_rx_desc_error_l3l4e_fcoe_masks {
++ I40E_RX_DESC_ERROR_L3L4E_NONE = 0,
++ I40E_RX_DESC_ERROR_L3L4E_PROT = 1,
++ I40E_RX_DESC_ERROR_L3L4E_FC = 2,
++ I40E_RX_DESC_ERROR_L3L4E_DMAC_ERR = 3,
++ I40E_RX_DESC_ERROR_L3L4E_DMAC_WARN = 4
++};
++
++#define I40E_RXD_QW1_PTYPE_SHIFT 30
++#define I40E_RXD_QW1_PTYPE_MASK (0xFFULL << I40E_RXD_QW1_PTYPE_SHIFT)
++
++/* Packet type non-ip values */
++enum i40e_rx_l2_ptype {
++ I40E_RX_PTYPE_L2_RESERVED = 0,
++ I40E_RX_PTYPE_L2_MAC_PAY2 = 1,
++ I40E_RX_PTYPE_L2_TIMESYNC_PAY2 = 2,
++ I40E_RX_PTYPE_L2_FIP_PAY2 = 3,
++ I40E_RX_PTYPE_L2_OUI_PAY2 = 4,
++ I40E_RX_PTYPE_L2_MACCNTRL_PAY2 = 5,
++ I40E_RX_PTYPE_L2_LLDP_PAY2 = 6,
++ I40E_RX_PTYPE_L2_ECP_PAY2 = 7,
++ I40E_RX_PTYPE_L2_EVB_PAY2 = 8,
++ I40E_RX_PTYPE_L2_QCN_PAY2 = 9,
++ I40E_RX_PTYPE_L2_EAPOL_PAY2 = 10,
++ I40E_RX_PTYPE_L2_ARP = 11,
++ I40E_RX_PTYPE_L2_FCOE_PAY3 = 12,
++ I40E_RX_PTYPE_L2_FCOE_FCDATA_PAY3 = 13,
++ I40E_RX_PTYPE_L2_FCOE_FCRDY_PAY3 = 14,
++ I40E_RX_PTYPE_L2_FCOE_FCRSP_PAY3 = 15,
++ I40E_RX_PTYPE_L2_FCOE_FCOTHER_PA = 16,
++ I40E_RX_PTYPE_L2_FCOE_VFT_PAY3 = 17,
++ I40E_RX_PTYPE_L2_FCOE_VFT_FCDATA = 18,
++ I40E_RX_PTYPE_L2_FCOE_VFT_FCRDY = 19,
++ I40E_RX_PTYPE_L2_FCOE_VFT_FCRSP = 20,
++ I40E_RX_PTYPE_L2_FCOE_VFT_FCOTHER = 21,
++ I40E_RX_PTYPE_GRENAT4_MAC_PAY3 = 58,
++ I40E_RX_PTYPE_GRENAT4_MACVLAN_IPV6_ICMP_PAY4 = 87,
++ I40E_RX_PTYPE_GRENAT6_MAC_PAY3 = 124,
++ I40E_RX_PTYPE_GRENAT6_MACVLAN_IPV6_ICMP_PAY4 = 153
++};
++
++struct i40e_rx_ptype_decoded {
++ u32 ptype:8;
++ u32 known:1;
++ u32 outer_ip:1;
++ u32 outer_ip_ver:1;
++ u32 outer_frag:1;
++ u32 tunnel_type:3;
++ u32 tunnel_end_prot:2;
++ u32 tunnel_end_frag:1;
++ u32 inner_prot:4;
++ u32 payload_layer:3;
++};
++
++enum i40e_rx_ptype_outer_ip {
++ I40E_RX_PTYPE_OUTER_L2 = 0,
++ I40E_RX_PTYPE_OUTER_IP = 1
++};
++
++enum i40e_rx_ptype_outer_ip_ver {
++ I40E_RX_PTYPE_OUTER_NONE = 0,
++ I40E_RX_PTYPE_OUTER_IPV4 = 0,
++ I40E_RX_PTYPE_OUTER_IPV6 = 1
++};
++
++enum i40e_rx_ptype_outer_fragmented {
++ I40E_RX_PTYPE_NOT_FRAG = 0,
++ I40E_RX_PTYPE_FRAG = 1
++};
++
++enum i40e_rx_ptype_tunnel_type {
++ I40E_RX_PTYPE_TUNNEL_NONE = 0,
++ I40E_RX_PTYPE_TUNNEL_IP_IP = 1,
++ I40E_RX_PTYPE_TUNNEL_IP_GRENAT = 2,
++ I40E_RX_PTYPE_TUNNEL_IP_GRENAT_MAC = 3,
++ I40E_RX_PTYPE_TUNNEL_IP_GRENAT_MAC_VLAN = 4,
++};
++
++enum i40e_rx_ptype_tunnel_end_prot {
++ I40E_RX_PTYPE_TUNNEL_END_NONE = 0,
++ I40E_RX_PTYPE_TUNNEL_END_IPV4 = 1,
++ I40E_RX_PTYPE_TUNNEL_END_IPV6 = 2,
++};
++
++enum i40e_rx_ptype_inner_prot {
++ I40E_RX_PTYPE_INNER_PROT_NONE = 0,
++ I40E_RX_PTYPE_INNER_PROT_UDP = 1,
++ I40E_RX_PTYPE_INNER_PROT_TCP = 2,
++ I40E_RX_PTYPE_INNER_PROT_SCTP = 3,
++ I40E_RX_PTYPE_INNER_PROT_ICMP = 4,
++ I40E_RX_PTYPE_INNER_PROT_TIMESYNC = 5
++};
++
++enum i40e_rx_ptype_payload_layer {
++ I40E_RX_PTYPE_PAYLOAD_LAYER_NONE = 0,
++ I40E_RX_PTYPE_PAYLOAD_LAYER_PAY2 = 1,
++ I40E_RX_PTYPE_PAYLOAD_LAYER_PAY3 = 2,
++ I40E_RX_PTYPE_PAYLOAD_LAYER_PAY4 = 3,
++};
++
++#define I40E_RXD_QW1_LENGTH_PBUF_SHIFT 38
++#define I40E_RXD_QW1_LENGTH_PBUF_MASK (0x3FFFULL << \
++ I40E_RXD_QW1_LENGTH_PBUF_SHIFT)
++
++#define I40E_RXD_QW1_LENGTH_HBUF_SHIFT 52
++#define I40E_RXD_QW1_LENGTH_HBUF_MASK (0x7FFULL << \
++ I40E_RXD_QW1_LENGTH_HBUF_SHIFT)
++
++#define I40E_RXD_QW1_LENGTH_SPH_SHIFT 63
++#define I40E_RXD_QW1_LENGTH_SPH_MASK BIT_ULL(I40E_RXD_QW1_LENGTH_SPH_SHIFT)
++
++enum i40e_rx_desc_ext_status_bits {
++ /* Note: These are predefined bit offsets */
++ I40E_RX_DESC_EXT_STATUS_L2TAG2P_SHIFT = 0,
++ I40E_RX_DESC_EXT_STATUS_L2TAG3P_SHIFT = 1,
++ I40E_RX_DESC_EXT_STATUS_FLEXBL_SHIFT = 2, /* 2 BITS */
++ I40E_RX_DESC_EXT_STATUS_FLEXBH_SHIFT = 4, /* 2 BITS */
++ I40E_RX_DESC_EXT_STATUS_FDLONGB_SHIFT = 9,
++ I40E_RX_DESC_EXT_STATUS_FCOELONGB_SHIFT = 10,
++ I40E_RX_DESC_EXT_STATUS_PELONGB_SHIFT = 11,
++};
++
++enum i40e_rx_desc_pe_status_bits {
++ /* Note: These are predefined bit offsets */
++ I40E_RX_DESC_PE_STATUS_QPID_SHIFT = 0, /* 18 BITS */
++ I40E_RX_DESC_PE_STATUS_L4PORT_SHIFT = 0, /* 16 BITS */
++ I40E_RX_DESC_PE_STATUS_IPINDEX_SHIFT = 16, /* 8 BITS */
++ I40E_RX_DESC_PE_STATUS_QPIDHIT_SHIFT = 24,
++ I40E_RX_DESC_PE_STATUS_APBVTHIT_SHIFT = 25,
++ I40E_RX_DESC_PE_STATUS_PORTV_SHIFT = 26,
++ I40E_RX_DESC_PE_STATUS_URG_SHIFT = 27,
++ I40E_RX_DESC_PE_STATUS_IPFRAG_SHIFT = 28,
++ I40E_RX_DESC_PE_STATUS_IPOPT_SHIFT = 29
++};
++
++#define I40E_RX_PROG_STATUS_DESC_LENGTH_SHIFT 38
++#define I40E_RX_PROG_STATUS_DESC_LENGTH 0x2000000
++
++#define I40E_RX_PROG_STATUS_DESC_QW1_PROGID_SHIFT 2
++#define I40E_RX_PROG_STATUS_DESC_QW1_PROGID_MASK (0x7UL << \
++ I40E_RX_PROG_STATUS_DESC_QW1_PROGID_SHIFT)
++
++#define I40E_RX_PROG_STATUS_DESC_QW1_ERROR_SHIFT 19
++#define I40E_RX_PROG_STATUS_DESC_QW1_ERROR_MASK (0x3FUL << \
++ I40E_RX_PROG_STATUS_DESC_QW1_ERROR_SHIFT)
++
++enum i40e_rx_prog_status_desc_status_bits {
++ /* Note: These are predefined bit offsets */
++ I40E_RX_PROG_STATUS_DESC_DD_SHIFT = 0,
++ I40E_RX_PROG_STATUS_DESC_PROG_ID_SHIFT = 2 /* 3 BITS */
++};
++
++enum i40e_rx_prog_status_desc_prog_id_masks {
++ I40E_RX_PROG_STATUS_DESC_FD_FILTER_STATUS = 1,
++ I40E_RX_PROG_STATUS_DESC_FCOE_CTXT_PROG_STATUS = 2,
++ I40E_RX_PROG_STATUS_DESC_FCOE_CTXT_INVL_STATUS = 4,
++};
++
++enum i40e_rx_prog_status_desc_error_bits {
++ /* Note: These are predefined bit offsets */
++ I40E_RX_PROG_STATUS_DESC_FD_TBL_FULL_SHIFT = 0,
++ I40E_RX_PROG_STATUS_DESC_NO_FD_ENTRY_SHIFT = 1,
++ I40E_RX_PROG_STATUS_DESC_FCOE_TBL_FULL_SHIFT = 2,
++ I40E_RX_PROG_STATUS_DESC_FCOE_CONFLICT_SHIFT = 3
++};
++
++/* TX Descriptor */
++struct i40e_tx_desc {
++ __le64 buffer_addr; /* Address of descriptor's data buf */
++ __le64 cmd_type_offset_bsz;
++};
++
++#define I40E_TXD_QW1_DTYPE_SHIFT 0
++#define I40E_TXD_QW1_DTYPE_MASK (0xFUL << I40E_TXD_QW1_DTYPE_SHIFT)
++
++enum i40e_tx_desc_dtype_value {
++ I40E_TX_DESC_DTYPE_DATA = 0x0,
++ I40E_TX_DESC_DTYPE_NOP = 0x1, /* same as Context desc */
++ I40E_TX_DESC_DTYPE_CONTEXT = 0x1,
++ I40E_TX_DESC_DTYPE_FCOE_CTX = 0x2,
++ I40E_TX_DESC_DTYPE_FILTER_PROG = 0x8,
++ I40E_TX_DESC_DTYPE_DDP_CTX = 0x9,
++ I40E_TX_DESC_DTYPE_FLEX_DATA = 0xB,
++ I40E_TX_DESC_DTYPE_FLEX_CTX_1 = 0xC,
++ I40E_TX_DESC_DTYPE_FLEX_CTX_2 = 0xD,
++ I40E_TX_DESC_DTYPE_DESC_DONE = 0xF
++};
++
++#define I40E_TXD_QW1_CMD_SHIFT 4
++#define I40E_TXD_QW1_CMD_MASK (0x3FFUL << I40E_TXD_QW1_CMD_SHIFT)
++
++enum i40e_tx_desc_cmd_bits {
++ I40E_TX_DESC_CMD_EOP = 0x0001,
++ I40E_TX_DESC_CMD_RS = 0x0002,
++ I40E_TX_DESC_CMD_ICRC = 0x0004,
++ I40E_TX_DESC_CMD_IL2TAG1 = 0x0008,
++ I40E_TX_DESC_CMD_DUMMY = 0x0010,
++ I40E_TX_DESC_CMD_IIPT_NONIP = 0x0000, /* 2 BITS */
++ I40E_TX_DESC_CMD_IIPT_IPV6 = 0x0020, /* 2 BITS */
++ I40E_TX_DESC_CMD_IIPT_IPV4 = 0x0040, /* 2 BITS */
++ I40E_TX_DESC_CMD_IIPT_IPV4_CSUM = 0x0060, /* 2 BITS */
++ I40E_TX_DESC_CMD_FCOET = 0x0080,
++ I40E_TX_DESC_CMD_L4T_EOFT_UNK = 0x0000, /* 2 BITS */
++ I40E_TX_DESC_CMD_L4T_EOFT_TCP = 0x0100, /* 2 BITS */
++ I40E_TX_DESC_CMD_L4T_EOFT_SCTP = 0x0200, /* 2 BITS */
++ I40E_TX_DESC_CMD_L4T_EOFT_UDP = 0x0300, /* 2 BITS */
++ I40E_TX_DESC_CMD_L4T_EOFT_EOF_N = 0x0000, /* 2 BITS */
++ I40E_TX_DESC_CMD_L4T_EOFT_EOF_T = 0x0100, /* 2 BITS */
++ I40E_TX_DESC_CMD_L4T_EOFT_EOF_NI = 0x0200, /* 2 BITS */
++ I40E_TX_DESC_CMD_L4T_EOFT_EOF_A = 0x0300, /* 2 BITS */
++};
++
++#define I40E_TXD_QW1_OFFSET_SHIFT 16
++#define I40E_TXD_QW1_OFFSET_MASK (0x3FFFFULL << \
++ I40E_TXD_QW1_OFFSET_SHIFT)
++
++enum i40e_tx_desc_length_fields {
++ /* Note: These are predefined bit offsets */
++ I40E_TX_DESC_LENGTH_MACLEN_SHIFT = 0, /* 7 BITS */
++ I40E_TX_DESC_LENGTH_IPLEN_SHIFT = 7, /* 7 BITS */
++ I40E_TX_DESC_LENGTH_L4_FC_LEN_SHIFT = 14 /* 4 BITS */
++};
++
++#define I40E_TXD_QW1_TX_BUF_SZ_SHIFT 34
++#define I40E_TXD_QW1_TX_BUF_SZ_MASK (0x3FFFULL << \
++ I40E_TXD_QW1_TX_BUF_SZ_SHIFT)
++
++#define I40E_TXD_QW1_L2TAG1_SHIFT 48
++#define I40E_TXD_QW1_L2TAG1_MASK (0xFFFFULL << I40E_TXD_QW1_L2TAG1_SHIFT)
++
++/* Context descriptors */
++struct i40e_tx_context_desc {
++ __le32 tunneling_params;
++ __le16 l2tag2;
++ __le16 rsvd;
++ __le64 type_cmd_tso_mss;
++};
++
++#define I40E_TXD_CTX_QW1_CMD_SHIFT 4
++#define I40E_TXD_CTX_QW1_CMD_MASK (0xFFFFUL << I40E_TXD_CTX_QW1_CMD_SHIFT)
++
++enum i40e_tx_ctx_desc_cmd_bits {
++ I40E_TX_CTX_DESC_TSO = 0x01,
++ I40E_TX_CTX_DESC_TSYN = 0x02,
++ I40E_TX_CTX_DESC_IL2TAG2 = 0x04,
++ I40E_TX_CTX_DESC_IL2TAG2_IL2H = 0x08,
++ I40E_TX_CTX_DESC_SWTCH_NOTAG = 0x00,
++ I40E_TX_CTX_DESC_SWTCH_UPLINK = 0x10,
++ I40E_TX_CTX_DESC_SWTCH_LOCAL = 0x20,
++ I40E_TX_CTX_DESC_SWTCH_VSI = 0x30,
++ I40E_TX_CTX_DESC_SWPE = 0x40
++};
++
++#define I40E_TXD_CTX_QW1_TSO_LEN_SHIFT 30
++#define I40E_TXD_CTX_QW1_TSO_LEN_MASK (0x3FFFFULL << \
++ I40E_TXD_CTX_QW1_TSO_LEN_SHIFT)
++
++#define I40E_TXD_CTX_QW1_MSS_SHIFT 50
++#define I40E_TXD_CTX_QW1_MSS_MASK (0x3FFFULL << \
++ I40E_TXD_CTX_QW1_MSS_SHIFT)
++
++#define I40E_TXD_CTX_QW1_VSI_SHIFT 50
++#define I40E_TXD_CTX_QW1_VSI_MASK (0x1FFULL << I40E_TXD_CTX_QW1_VSI_SHIFT)
++
++#define I40E_TXD_CTX_QW0_EXT_IP_SHIFT 0
++#define I40E_TXD_CTX_QW0_EXT_IP_MASK (0x3ULL << \
++ I40E_TXD_CTX_QW0_EXT_IP_SHIFT)
++
++enum i40e_tx_ctx_desc_eipt_offload {
++ I40E_TX_CTX_EXT_IP_NONE = 0x0,
++ I40E_TX_CTX_EXT_IP_IPV6 = 0x1,
++ I40E_TX_CTX_EXT_IP_IPV4_NO_CSUM = 0x2,
++ I40E_TX_CTX_EXT_IP_IPV4 = 0x3
++};
++
++#define I40E_TXD_CTX_QW0_EXT_IPLEN_SHIFT 2
++#define I40E_TXD_CTX_QW0_EXT_IPLEN_MASK (0x3FULL << \
++ I40E_TXD_CTX_QW0_EXT_IPLEN_SHIFT)
++
++#define I40E_TXD_CTX_QW0_NATT_SHIFT 9
++#define I40E_TXD_CTX_QW0_NATT_MASK (0x3ULL << I40E_TXD_CTX_QW0_NATT_SHIFT)
++
++#define I40E_TXD_CTX_UDP_TUNNELING BIT_ULL(I40E_TXD_CTX_QW0_NATT_SHIFT)
++#define I40E_TXD_CTX_GRE_TUNNELING (0x2ULL << I40E_TXD_CTX_QW0_NATT_SHIFT)
++
++#define I40E_TXD_CTX_QW0_EIP_NOINC_SHIFT 11
++#define I40E_TXD_CTX_QW0_EIP_NOINC_MASK \
++ BIT_ULL(I40E_TXD_CTX_QW0_EIP_NOINC_SHIFT)
++
++#define I40E_TXD_CTX_EIP_NOINC_IPID_CONST I40E_TXD_CTX_QW0_EIP_NOINC_MASK
++
++#define I40E_TXD_CTX_QW0_NATLEN_SHIFT 12
++#define I40E_TXD_CTX_QW0_NATLEN_MASK (0X7FULL << \
++ I40E_TXD_CTX_QW0_NATLEN_SHIFT)
++
++#define I40E_TXD_CTX_QW0_DECTTL_SHIFT 19
++#define I40E_TXD_CTX_QW0_DECTTL_MASK (0xFULL << \
++ I40E_TXD_CTX_QW0_DECTTL_SHIFT)
++
++#define I40E_TXD_CTX_QW0_L4T_CS_SHIFT 23
++#define I40E_TXD_CTX_QW0_L4T_CS_MASK BIT_ULL(I40E_TXD_CTX_QW0_L4T_CS_SHIFT)
++
++/* Packet Classifier Types for filters */
++enum i40e_filter_pctype {
++ /* Note: Values 0-28 are reserved for future use.
++ * Value 29, 30, 32 are not supported on XL710 and X710.
++ */
++ I40E_FILTER_PCTYPE_NONF_UNICAST_IPV4_UDP = 29,
++ I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV4_UDP = 30,
++ I40E_FILTER_PCTYPE_NONF_IPV4_UDP = 31,
++ I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK = 32,
++ I40E_FILTER_PCTYPE_NONF_IPV4_TCP = 33,
++ I40E_FILTER_PCTYPE_NONF_IPV4_SCTP = 34,
++ I40E_FILTER_PCTYPE_NONF_IPV4_OTHER = 35,
++ I40E_FILTER_PCTYPE_FRAG_IPV4 = 36,
++ /* Note: Values 37-38 are reserved for future use.
++ * Value 39, 40, 42 are not supported on XL710 and X710.
++ */
++ I40E_FILTER_PCTYPE_NONF_UNICAST_IPV6_UDP = 39,
++ I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV6_UDP = 40,
++ I40E_FILTER_PCTYPE_NONF_IPV6_UDP = 41,
++ I40E_FILTER_PCTYPE_NONF_IPV6_TCP_SYN_NO_ACK = 42,
++ I40E_FILTER_PCTYPE_NONF_IPV6_TCP = 43,
++ I40E_FILTER_PCTYPE_NONF_IPV6_SCTP = 44,
++ I40E_FILTER_PCTYPE_NONF_IPV6_OTHER = 45,
++ I40E_FILTER_PCTYPE_FRAG_IPV6 = 46,
++ /* Note: Value 47 is reserved for future use */
++ I40E_FILTER_PCTYPE_FCOE_OX = 48,
++ I40E_FILTER_PCTYPE_FCOE_RX = 49,
++ I40E_FILTER_PCTYPE_FCOE_OTHER = 50,
++ /* Note: Values 51-62 are reserved for future use */
++ I40E_FILTER_PCTYPE_L2_PAYLOAD = 63,
++};
++
++
++struct i40e_vsi_context {
++ u16 seid;
++ u16 uplink_seid;
++ u16 vsi_number;
++ u16 vsis_allocated;
++ u16 vsis_unallocated;
++ u16 flags;
++ u8 pf_num;
++ u8 vf_num;
++ u8 connection_type;
++ struct i40e_aqc_vsi_properties_data info;
++};
++
++struct i40e_veb_context {
++ u16 seid;
++ u16 uplink_seid;
++ u16 veb_number;
++ u16 vebs_allocated;
++ u16 vebs_unallocated;
++ u16 flags;
++ struct i40e_aqc_get_veb_parameters_completion info;
++};
++
++/* Statistics collected by each port, VSI, VEB, and S-channel */
++struct i40e_eth_stats {
++ u64 rx_bytes; /* gorc */
++ u64 rx_unicast; /* uprc */
++ u64 rx_multicast; /* mprc */
++ u64 rx_broadcast; /* bprc */
++ u64 rx_discards; /* rdpc */
++ u64 rx_unknown_protocol; /* rupp */
++ u64 tx_bytes; /* gotc */
++ u64 tx_unicast; /* uptc */
++ u64 tx_multicast; /* mptc */
++ u64 tx_broadcast; /* bptc */
++ u64 tx_discards; /* tdpc */
++ u64 tx_errors; /* tepc */
++};
++#endif /* _I40E_TYPE_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40evf.h b/drivers/net/ethernet/intel/iavf/i40evf.h
+new file mode 100644
+index 0000000000000..96e537a350004
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40evf.h
+@@ -0,0 +1,427 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40EVF_H_
++#define _I40EVF_H_
++
++#include <linux/module.h>
++#include <linux/pci.h>
++#include <linux/aer.h>
++#include <linux/netdevice.h>
++#include <linux/vmalloc.h>
++#include <linux/interrupt.h>
++#include <linux/ethtool.h>
++#include <linux/if_vlan.h>
++#include <linux/ip.h>
++#include <linux/tcp.h>
++#include <linux/sctp.h>
++#include <linux/ipv6.h>
++#include <linux/kernel.h>
++#include <linux/bitops.h>
++#include <linux/timer.h>
++#include <linux/workqueue.h>
++#include <linux/wait.h>
++#include <linux/delay.h>
++#include <linux/gfp.h>
++#include <linux/skbuff.h>
++#include <linux/dma-mapping.h>
++#include <linux/etherdevice.h>
++#include <linux/socket.h>
++#include <linux/jiffies.h>
++#include <net/ip6_checksum.h>
++#include <net/pkt_cls.h>
++#include <net/udp.h>
++#include <net/tc_act/tc_gact.h>
++#include <net/tc_act/tc_mirred.h>
++
++#include "i40e_type.h"
++#include <linux/avf/virtchnl.h>
++#include "i40e_txrx.h"
++
++#define DEFAULT_DEBUG_LEVEL_SHIFT 3
++#define PFX "i40evf: "
++
++/* VSI state flags shared with common code */
++enum i40evf_vsi_state_t {
++ __I40E_VSI_DOWN,
++ /* This must be last as it determines the size of the BITMAP */
++ __I40E_VSI_STATE_SIZE__,
++};
++
++/* dummy struct to make common code less painful */
++struct i40e_vsi {
++ struct i40evf_adapter *back;
++ struct net_device *netdev;
++ unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
++ u16 seid;
++ u16 id;
++ DECLARE_BITMAP(state, __I40E_VSI_STATE_SIZE__);
++ int base_vector;
++ u16 work_limit;
++ u16 qs_handle;
++ void *priv; /* client driver data reference. */
++};
++
++/* How many Rx Buffers do we bundle into one write to the hardware ? */
++#define I40EVF_RX_BUFFER_WRITE 16 /* Must be power of 2 */
++#define I40EVF_DEFAULT_TXD 512
++#define I40EVF_DEFAULT_RXD 512
++#define I40EVF_MAX_TXD 4096
++#define I40EVF_MIN_TXD 64
++#define I40EVF_MAX_RXD 4096
++#define I40EVF_MIN_RXD 64
++#define I40EVF_REQ_DESCRIPTOR_MULTIPLE 32
++#define I40EVF_MAX_AQ_BUF_SIZE 4096
++#define I40EVF_AQ_LEN 32
++#define I40EVF_AQ_MAX_ERR 20 /* times to try before resetting AQ */
++
++#define MAXIMUM_ETHERNET_VLAN_SIZE (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)
++
++#define I40E_RX_DESC(R, i) (&(((union i40e_32byte_rx_desc *)((R)->desc))[i]))
++#define I40E_TX_DESC(R, i) (&(((struct i40e_tx_desc *)((R)->desc))[i]))
++#define I40E_TX_CTXTDESC(R, i) \
++ (&(((struct i40e_tx_context_desc *)((R)->desc))[i]))
++#define I40EVF_MAX_REQ_QUEUES 4
++
++#define I40EVF_HKEY_ARRAY_SIZE ((I40E_VFQF_HKEY_MAX_INDEX + 1) * 4)
++#define I40EVF_HLUT_ARRAY_SIZE ((I40E_VFQF_HLUT_MAX_INDEX + 1) * 4)
++#define I40EVF_MBPS_DIVISOR 125000 /* divisor to convert to Mbps */
++
++/* MAX_MSIX_Q_VECTORS of these are allocated,
++ * but we only use one per queue-specific vector.
++ */
++struct i40e_q_vector {
++ struct i40evf_adapter *adapter;
++ struct i40e_vsi *vsi;
++ struct napi_struct napi;
++ struct i40e_ring_container rx;
++ struct i40e_ring_container tx;
++ u32 ring_mask;
++ u8 itr_countdown; /* when 0 should adjust adaptive ITR */
++ u8 num_ringpairs; /* total number of ring pairs in vector */
++ u16 v_idx; /* index in the vsi->q_vector array. */
++ u16 reg_idx; /* register index of the interrupt */
++ char name[IFNAMSIZ + 15];
++ bool arm_wb_state;
++ cpumask_t affinity_mask;
++ struct irq_affinity_notify affinity_notify;
++};
++
++/* Helper macros to switch between ints/sec and what the register uses.
++ * And yes, it's the same math going both ways. The lowest value
++ * supported by all of the i40e hardware is 8.
++ */
++#define EITR_INTS_PER_SEC_TO_REG(_eitr) \
++ ((_eitr) ? (1000000000 / ((_eitr) * 256)) : 8)
++#define EITR_REG_TO_INTS_PER_SEC EITR_INTS_PER_SEC_TO_REG
++
++#define I40EVF_DESC_UNUSED(R) \
++ ((((R)->next_to_clean > (R)->next_to_use) ? 0 : (R)->count) + \
++ (R)->next_to_clean - (R)->next_to_use - 1)
++
++#define I40EVF_RX_DESC_ADV(R, i) \
++ (&(((union i40e_adv_rx_desc *)((R).desc))[i]))
++#define I40EVF_TX_DESC_ADV(R, i) \
++ (&(((union i40e_adv_tx_desc *)((R).desc))[i]))
++#define I40EVF_TX_CTXTDESC_ADV(R, i) \
++ (&(((struct i40e_adv_tx_context_desc *)((R).desc))[i]))
++
++#define OTHER_VECTOR 1
++#define NONQ_VECS (OTHER_VECTOR)
++
++#define MIN_MSIX_Q_VECTORS 1
++#define MIN_MSIX_COUNT (MIN_MSIX_Q_VECTORS + NONQ_VECS)
++
++#define I40EVF_QUEUE_END_OF_LIST 0x7FF
++#define I40EVF_FREE_VECTOR 0x7FFF
++struct i40evf_mac_filter {
++ struct list_head list;
++ u8 macaddr[ETH_ALEN];
++ bool remove; /* filter needs to be removed */
++ bool add; /* filter needs to be added */
++};
++
++struct i40evf_vlan_filter {
++ struct list_head list;
++ u16 vlan;
++ bool remove; /* filter needs to be removed */
++ bool add; /* filter needs to be added */
++};
++
++#define I40EVF_MAX_TRAFFIC_CLASS 4
++/* State of traffic class creation */
++enum i40evf_tc_state_t {
++ __I40EVF_TC_INVALID, /* no traffic class, default state */
++ __I40EVF_TC_RUNNING, /* traffic classes have been created */
++};
++
++/* channel info */
++struct i40evf_channel_config {
++ struct virtchnl_channel_info ch_info[I40EVF_MAX_TRAFFIC_CLASS];
++ enum i40evf_tc_state_t state;
++ u8 total_qps;
++};
++
++/* State of cloud filter */
++enum i40evf_cloud_filter_state_t {
++ __I40EVF_CF_INVALID, /* cloud filter not added */
++ __I40EVF_CF_ADD_PENDING, /* cloud filter pending add by the PF */
++ __I40EVF_CF_DEL_PENDING, /* cloud filter pending del by the PF */
++ __I40EVF_CF_ACTIVE, /* cloud filter is active */
++};
++
++/* Driver state. The order of these is important! */
++enum i40evf_state_t {
++ __I40EVF_STARTUP, /* driver loaded, probe complete */
++ __I40EVF_REMOVE, /* driver is being unloaded */
++ __I40EVF_INIT_VERSION_CHECK, /* aq msg sent, awaiting reply */
++ __I40EVF_INIT_GET_RESOURCES, /* aq msg sent, awaiting reply */
++ __I40EVF_INIT_SW, /* got resources, setting up structs */
++ __I40EVF_RESETTING, /* in reset */
++ /* Below here, watchdog is running */
++ __I40EVF_DOWN, /* ready, can be opened */
++ __I40EVF_DOWN_PENDING, /* descending, waiting for watchdog */
++ __I40EVF_TESTING, /* in ethtool self-test */
++ __I40EVF_RUNNING, /* opened, working */
++};
++
++enum i40evf_critical_section_t {
++ __I40EVF_IN_CRITICAL_TASK, /* cannot be interrupted */
++ __I40EVF_IN_CLIENT_TASK,
++ __I40EVF_IN_REMOVE_TASK, /* device being removed */
++};
++
++#define I40EVF_CLOUD_FIELD_OMAC 0x01
++#define I40EVF_CLOUD_FIELD_IMAC 0x02
++#define I40EVF_CLOUD_FIELD_IVLAN 0x04
++#define I40EVF_CLOUD_FIELD_TEN_ID 0x08
++#define I40EVF_CLOUD_FIELD_IIP 0x10
++
++#define I40EVF_CF_FLAGS_OMAC I40EVF_CLOUD_FIELD_OMAC
++#define I40EVF_CF_FLAGS_IMAC I40EVF_CLOUD_FIELD_IMAC
++#define I40EVF_CF_FLAGS_IMAC_IVLAN (I40EVF_CLOUD_FIELD_IMAC |\
++ I40EVF_CLOUD_FIELD_IVLAN)
++#define I40EVF_CF_FLAGS_IMAC_TEN_ID (I40EVF_CLOUD_FIELD_IMAC |\
++ I40EVF_CLOUD_FIELD_TEN_ID)
++#define I40EVF_CF_FLAGS_OMAC_TEN_ID_IMAC (I40EVF_CLOUD_FIELD_OMAC |\
++ I40EVF_CLOUD_FIELD_IMAC |\
++ I40EVF_CLOUD_FIELD_TEN_ID)
++#define I40EVF_CF_FLAGS_IMAC_IVLAN_TEN_ID (I40EVF_CLOUD_FIELD_IMAC |\
++ I40EVF_CLOUD_FIELD_IVLAN |\
++ I40EVF_CLOUD_FIELD_TEN_ID)
++#define I40EVF_CF_FLAGS_IIP I40E_CLOUD_FIELD_IIP
++
++/* bookkeeping of cloud filters */
++struct i40evf_cloud_filter {
++ enum i40evf_cloud_filter_state_t state;
++ struct list_head list;
++ struct virtchnl_filter f;
++ unsigned long cookie;
++ bool del; /* filter needs to be deleted */
++ bool add; /* filter needs to be added */
++};
++
++/* board specific private data structure */
++struct i40evf_adapter {
++ struct timer_list watchdog_timer;
++ struct work_struct reset_task;
++ struct work_struct adminq_task;
++ struct delayed_work client_task;
++ struct delayed_work init_task;
++ wait_queue_head_t down_waitqueue;
++ struct i40e_q_vector *q_vectors;
++ struct list_head vlan_filter_list;
++ struct list_head mac_filter_list;
++ /* Lock to protect accesses to MAC and VLAN lists */
++ spinlock_t mac_vlan_list_lock;
++ char misc_vector_name[IFNAMSIZ + 9];
++ int num_active_queues;
++ int num_req_queues;
++
++ /* TX */
++ struct i40e_ring *tx_rings;
++ u32 tx_timeout_count;
++ u32 tx_desc_count;
++
++ /* RX */
++ struct i40e_ring *rx_rings;
++ u64 hw_csum_rx_error;
++ u32 rx_desc_count;
++ int num_msix_vectors;
++ int num_iwarp_msix;
++ int iwarp_base_vector;
++ u32 client_pending;
++ struct i40e_client_instance *cinst;
++ struct msix_entry *msix_entries;
++
++ u32 flags;
++#define I40EVF_FLAG_RX_CSUM_ENABLED BIT(0)
++#define I40EVF_FLAG_PF_COMMS_FAILED BIT(3)
++#define I40EVF_FLAG_RESET_PENDING BIT(4)
++#define I40EVF_FLAG_RESET_NEEDED BIT(5)
++#define I40EVF_FLAG_WB_ON_ITR_CAPABLE BIT(6)
++#define I40EVF_FLAG_ADDR_SET_BY_PF BIT(8)
++#define I40EVF_FLAG_SERVICE_CLIENT_REQUESTED BIT(9)
++#define I40EVF_FLAG_CLIENT_NEEDS_OPEN BIT(10)
++#define I40EVF_FLAG_CLIENT_NEEDS_CLOSE BIT(11)
++#define I40EVF_FLAG_CLIENT_NEEDS_L2_PARAMS BIT(12)
++#define I40EVF_FLAG_PROMISC_ON BIT(13)
++#define I40EVF_FLAG_ALLMULTI_ON BIT(14)
++#define I40EVF_FLAG_LEGACY_RX BIT(15)
++#define I40EVF_FLAG_REINIT_ITR_NEEDED BIT(16)
++#define I40EVF_FLAG_QUEUES_DISABLED BIT(17)
++/* duplicates for common code */
++#define I40E_FLAG_DCB_ENABLED 0
++#define I40E_FLAG_RX_CSUM_ENABLED I40EVF_FLAG_RX_CSUM_ENABLED
++#define I40E_FLAG_LEGACY_RX I40EVF_FLAG_LEGACY_RX
++ /* flags for admin queue service task */
++ u32 aq_required;
++#define I40EVF_FLAG_AQ_ENABLE_QUEUES BIT(0)
++#define I40EVF_FLAG_AQ_DISABLE_QUEUES BIT(1)
++#define I40EVF_FLAG_AQ_ADD_MAC_FILTER BIT(2)
++#define I40EVF_FLAG_AQ_ADD_VLAN_FILTER BIT(3)
++#define I40EVF_FLAG_AQ_DEL_MAC_FILTER BIT(4)
++#define I40EVF_FLAG_AQ_DEL_VLAN_FILTER BIT(5)
++#define I40EVF_FLAG_AQ_CONFIGURE_QUEUES BIT(6)
++#define I40EVF_FLAG_AQ_MAP_VECTORS BIT(7)
++#define I40EVF_FLAG_AQ_HANDLE_RESET BIT(8)
++#define I40EVF_FLAG_AQ_CONFIGURE_RSS BIT(9) /* direct AQ config */
++#define I40EVF_FLAG_AQ_GET_CONFIG BIT(10)
++/* Newer style, RSS done by the PF so we can ignore hardware vagaries. */
++#define I40EVF_FLAG_AQ_GET_HENA BIT(11)
++#define I40EVF_FLAG_AQ_SET_HENA BIT(12)
++#define I40EVF_FLAG_AQ_SET_RSS_KEY BIT(13)
++#define I40EVF_FLAG_AQ_SET_RSS_LUT BIT(14)
++#define I40EVF_FLAG_AQ_REQUEST_PROMISC BIT(15)
++#define I40EVF_FLAG_AQ_RELEASE_PROMISC BIT(16)
++#define I40EVF_FLAG_AQ_REQUEST_ALLMULTI BIT(17)
++#define I40EVF_FLAG_AQ_RELEASE_ALLMULTI BIT(18)
++#define I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING BIT(19)
++#define I40EVF_FLAG_AQ_DISABLE_VLAN_STRIPPING BIT(20)
++#define I40EVF_FLAG_AQ_ENABLE_CHANNELS BIT(21)
++#define I40EVF_FLAG_AQ_DISABLE_CHANNELS BIT(22)
++#define I40EVF_FLAG_AQ_ADD_CLOUD_FILTER BIT(23)
++#define I40EVF_FLAG_AQ_DEL_CLOUD_FILTER BIT(24)
++
++ /* OS defined structs */
++ struct net_device *netdev;
++ struct pci_dev *pdev;
++
++ struct i40e_hw hw; /* defined in i40e_type.h */
++
++ enum i40evf_state_t state;
++ unsigned long crit_section;
++
++ struct work_struct watchdog_task;
++ bool netdev_registered;
++ bool link_up;
++ enum virtchnl_link_speed link_speed;
++ enum virtchnl_ops current_op;
++#define CLIENT_ALLOWED(_a) ((_a)->vf_res ? \
++ (_a)->vf_res->vf_cap_flags & \
++ VIRTCHNL_VF_OFFLOAD_IWARP : \
++ 0)
++#define CLIENT_ENABLED(_a) ((_a)->cinst)
++/* RSS by the PF should be preferred over RSS via other methods. */
++#define RSS_PF(_a) ((_a)->vf_res->vf_cap_flags & \
++ VIRTCHNL_VF_OFFLOAD_RSS_PF)
++#define RSS_AQ(_a) ((_a)->vf_res->vf_cap_flags & \
++ VIRTCHNL_VF_OFFLOAD_RSS_AQ)
++#define RSS_REG(_a) (!((_a)->vf_res->vf_cap_flags & \
++ (VIRTCHNL_VF_OFFLOAD_RSS_AQ | \
++ VIRTCHNL_VF_OFFLOAD_RSS_PF)))
++#define VLAN_ALLOWED(_a) ((_a)->vf_res->vf_cap_flags & \
++ VIRTCHNL_VF_OFFLOAD_VLAN)
++ struct virtchnl_vf_resource *vf_res; /* incl. all VSIs */
++ struct virtchnl_vsi_resource *vsi_res; /* our LAN VSI */
++ struct virtchnl_version_info pf_version;
++#define PF_IS_V11(_a) (((_a)->pf_version.major == 1) && \
++ ((_a)->pf_version.minor == 1))
++ u16 msg_enable;
++ struct i40e_eth_stats current_stats;
++ struct i40e_vsi vsi;
++ u32 aq_wait_count;
++ /* RSS stuff */
++ u64 hena;
++ u16 rss_key_size;
++ u16 rss_lut_size;
++ u8 *rss_key;
++ u8 *rss_lut;
++ /* ADQ related members */
++ struct i40evf_channel_config ch_config;
++ u8 num_tc;
++ struct list_head cloud_filter_list;
++ /* lock to protest access to the cloud filter list */
++ spinlock_t cloud_filter_list_lock;
++ u16 num_cloud_filters;
++};
++
++
++/* Ethtool Private Flags */
++
++/* lan device */
++struct i40e_device {
++ struct list_head list;
++ struct i40evf_adapter *vf;
++};
++
++/* needed by i40evf_ethtool.c */
++extern char i40evf_driver_name[];
++extern const char i40evf_driver_version[];
++
++int i40evf_up(struct i40evf_adapter *adapter);
++void i40evf_down(struct i40evf_adapter *adapter);
++int i40evf_process_config(struct i40evf_adapter *adapter);
++void i40evf_schedule_reset(struct i40evf_adapter *adapter);
++void i40evf_reset(struct i40evf_adapter *adapter);
++void i40evf_set_ethtool_ops(struct net_device *netdev);
++void i40evf_update_stats(struct i40evf_adapter *adapter);
++void i40evf_reset_interrupt_capability(struct i40evf_adapter *adapter);
++int i40evf_init_interrupt_scheme(struct i40evf_adapter *adapter);
++void i40evf_irq_enable_queues(struct i40evf_adapter *adapter, u32 mask);
++void i40evf_free_all_tx_resources(struct i40evf_adapter *adapter);
++void i40evf_free_all_rx_resources(struct i40evf_adapter *adapter);
++
++void i40e_napi_add_all(struct i40evf_adapter *adapter);
++void i40e_napi_del_all(struct i40evf_adapter *adapter);
++
++int i40evf_send_api_ver(struct i40evf_adapter *adapter);
++int i40evf_verify_api_ver(struct i40evf_adapter *adapter);
++int i40evf_send_vf_config_msg(struct i40evf_adapter *adapter);
++int i40evf_get_vf_config(struct i40evf_adapter *adapter);
++void i40evf_irq_enable(struct i40evf_adapter *adapter, bool flush);
++void i40evf_configure_queues(struct i40evf_adapter *adapter);
++void i40evf_deconfigure_queues(struct i40evf_adapter *adapter);
++void i40evf_enable_queues(struct i40evf_adapter *adapter);
++void i40evf_disable_queues(struct i40evf_adapter *adapter);
++void i40evf_map_queues(struct i40evf_adapter *adapter);
++int i40evf_request_queues(struct i40evf_adapter *adapter, int num);
++void i40evf_add_ether_addrs(struct i40evf_adapter *adapter);
++void i40evf_del_ether_addrs(struct i40evf_adapter *adapter);
++void i40evf_add_vlans(struct i40evf_adapter *adapter);
++void i40evf_del_vlans(struct i40evf_adapter *adapter);
++void i40evf_set_promiscuous(struct i40evf_adapter *adapter, int flags);
++void i40evf_request_stats(struct i40evf_adapter *adapter);
++void i40evf_request_reset(struct i40evf_adapter *adapter);
++void i40evf_get_hena(struct i40evf_adapter *adapter);
++void i40evf_set_hena(struct i40evf_adapter *adapter);
++void i40evf_set_rss_key(struct i40evf_adapter *adapter);
++void i40evf_set_rss_lut(struct i40evf_adapter *adapter);
++void i40evf_enable_vlan_stripping(struct i40evf_adapter *adapter);
++void i40evf_disable_vlan_stripping(struct i40evf_adapter *adapter);
++void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
++ enum virtchnl_ops v_opcode,
++ i40e_status v_retval, u8 *msg, u16 msglen);
++int i40evf_config_rss(struct i40evf_adapter *adapter);
++int i40evf_lan_add_device(struct i40evf_adapter *adapter);
++int i40evf_lan_del_device(struct i40evf_adapter *adapter);
++void i40evf_client_subtask(struct i40evf_adapter *adapter);
++void i40evf_notify_client_message(struct i40e_vsi *vsi, u8 *msg, u16 len);
++void i40evf_notify_client_l2_params(struct i40e_vsi *vsi);
++void i40evf_notify_client_open(struct i40e_vsi *vsi);
++void i40evf_notify_client_close(struct i40e_vsi *vsi, bool reset);
++void i40evf_enable_channels(struct i40evf_adapter *adapter);
++void i40evf_disable_channels(struct i40evf_adapter *adapter);
++void i40evf_add_cloud_filter(struct i40evf_adapter *adapter);
++void i40evf_del_cloud_filter(struct i40evf_adapter *adapter);
++#endif /* _I40EVF_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40evf_client.c b/drivers/net/ethernet/intel/iavf/i40evf_client.c
+new file mode 100644
+index 0000000000000..3cc9d60d0d72e
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40evf_client.c
+@@ -0,0 +1,579 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#include <linux/list.h>
++#include <linux/errno.h>
++
++#include "i40evf.h"
++#include "i40e_prototype.h"
++#include "i40evf_client.h"
++
++static
++const char i40evf_client_interface_version_str[] = I40EVF_CLIENT_VERSION_STR;
++static struct i40e_client *vf_registered_client;
++static LIST_HEAD(i40evf_devices);
++static DEFINE_MUTEX(i40evf_device_mutex);
++
++static u32 i40evf_client_virtchnl_send(struct i40e_info *ldev,
++ struct i40e_client *client,
++ u8 *msg, u16 len);
++
++static int i40evf_client_setup_qvlist(struct i40e_info *ldev,
++ struct i40e_client *client,
++ struct i40e_qvlist_info *qvlist_info);
++
++static struct i40e_ops i40evf_lan_ops = {
++ .virtchnl_send = i40evf_client_virtchnl_send,
++ .setup_qvlist = i40evf_client_setup_qvlist,
++};
++
++/**
++ * i40evf_client_get_params - retrieve relevant client parameters
++ * @vsi: VSI with parameters
++ * @params: client param struct
++ **/
++static
++void i40evf_client_get_params(struct i40e_vsi *vsi, struct i40e_params *params)
++{
++ int i;
++
++ memset(params, 0, sizeof(struct i40e_params));
++ params->mtu = vsi->netdev->mtu;
++ params->link_up = vsi->back->link_up;
++
++ for (i = 0; i < I40E_MAX_USER_PRIORITY; i++) {
++ params->qos.prio_qos[i].tc = 0;
++ params->qos.prio_qos[i].qs_handle = vsi->qs_handle;
++ }
++}
++
++/**
++ * i40evf_notify_client_message - call the client message receive callback
++ * @vsi: the VSI associated with this client
++ * @msg: message buffer
++ * @len: length of message
++ *
++ * If there is a client to this VSI, call the client
++ **/
++void i40evf_notify_client_message(struct i40e_vsi *vsi, u8 *msg, u16 len)
++{
++ struct i40e_client_instance *cinst;
++
++ if (!vsi)
++ return;
++
++ cinst = vsi->back->cinst;
++ if (!cinst || !cinst->client || !cinst->client->ops ||
++ !cinst->client->ops->virtchnl_receive) {
++ dev_dbg(&vsi->back->pdev->dev,
++ "Cannot locate client instance virtchnl_receive function\n");
++ return;
++ }
++ cinst->client->ops->virtchnl_receive(&cinst->lan_info, cinst->client,
++ msg, len);
++}
++
++/**
++ * i40evf_notify_client_l2_params - call the client notify callback
++ * @vsi: the VSI with l2 param changes
++ *
++ * If there is a client to this VSI, call the client
++ **/
++void i40evf_notify_client_l2_params(struct i40e_vsi *vsi)
++{
++ struct i40e_client_instance *cinst;
++ struct i40e_params params;
++
++ if (!vsi)
++ return;
++
++ cinst = vsi->back->cinst;
++
++ if (!cinst || !cinst->client || !cinst->client->ops ||
++ !cinst->client->ops->l2_param_change) {
++ dev_dbg(&vsi->back->pdev->dev,
++ "Cannot locate client instance l2_param_change function\n");
++ return;
++ }
++ i40evf_client_get_params(vsi, ¶ms);
++ cinst->lan_info.params = params;
++ cinst->client->ops->l2_param_change(&cinst->lan_info, cinst->client,
++ ¶ms);
++}
++
++/**
++ * i40evf_notify_client_open - call the client open callback
++ * @vsi: the VSI with netdev opened
++ *
++ * If there is a client to this netdev, call the client with open
++ **/
++void i40evf_notify_client_open(struct i40e_vsi *vsi)
++{
++ struct i40evf_adapter *adapter = vsi->back;
++ struct i40e_client_instance *cinst = adapter->cinst;
++ int ret;
++
++ if (!cinst || !cinst->client || !cinst->client->ops ||
++ !cinst->client->ops->open) {
++ dev_dbg(&vsi->back->pdev->dev,
++ "Cannot locate client instance open function\n");
++ return;
++ }
++ if (!(test_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state))) {
++ ret = cinst->client->ops->open(&cinst->lan_info, cinst->client);
++ if (!ret)
++ set_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state);
++ }
++}
++
++/**
++ * i40evf_client_release_qvlist - send a message to the PF to release iwarp qv map
++ * @ldev: pointer to L2 context.
++ *
++ * Return 0 on success or < 0 on error
++ **/
++static int i40evf_client_release_qvlist(struct i40e_info *ldev)
++{
++ struct i40evf_adapter *adapter = ldev->vf;
++ i40e_status err;
++
++ if (adapter->aq_required)
++ return -EAGAIN;
++
++ err = i40e_aq_send_msg_to_pf(&adapter->hw,
++ VIRTCHNL_OP_RELEASE_IWARP_IRQ_MAP,
++ I40E_SUCCESS, NULL, 0, NULL);
++
++ if (err)
++ dev_err(&adapter->pdev->dev,
++ "Unable to send iWarp vector release message to PF, error %d, aq status %d\n",
++ err, adapter->hw.aq.asq_last_status);
++
++ return err;
++}
++
++/**
++ * i40evf_notify_client_close - call the client close callback
++ * @vsi: the VSI with netdev closed
++ * @reset: true when close called due to reset pending
++ *
++ * If there is a client to this netdev, call the client with close
++ **/
++void i40evf_notify_client_close(struct i40e_vsi *vsi, bool reset)
++{
++ struct i40evf_adapter *adapter = vsi->back;
++ struct i40e_client_instance *cinst = adapter->cinst;
++
++ if (!cinst || !cinst->client || !cinst->client->ops ||
++ !cinst->client->ops->close) {
++ dev_dbg(&vsi->back->pdev->dev,
++ "Cannot locate client instance close function\n");
++ return;
++ }
++ cinst->client->ops->close(&cinst->lan_info, cinst->client, reset);
++ i40evf_client_release_qvlist(&cinst->lan_info);
++ clear_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state);
++}
++
++/**
++ * i40evf_client_add_instance - add a client instance to the instance list
++ * @adapter: pointer to the board struct
++ *
++ * Returns cinst ptr on success, NULL on failure
++ **/
++static struct i40e_client_instance *
++i40evf_client_add_instance(struct i40evf_adapter *adapter)
++{
++ struct i40e_client_instance *cinst = NULL;
++ struct i40e_vsi *vsi = &adapter->vsi;
++ struct netdev_hw_addr *mac = NULL;
++ struct i40e_params params;
++
++ if (!vf_registered_client)
++ goto out;
++
++ if (adapter->cinst) {
++ cinst = adapter->cinst;
++ goto out;
++ }
++
++ cinst = kzalloc(sizeof(*cinst), GFP_KERNEL);
++ if (!cinst)
++ goto out;
++
++ cinst->lan_info.vf = (void *)adapter;
++ cinst->lan_info.netdev = vsi->netdev;
++ cinst->lan_info.pcidev = adapter->pdev;
++ cinst->lan_info.fid = 0;
++ cinst->lan_info.ftype = I40E_CLIENT_FTYPE_VF;
++ cinst->lan_info.hw_addr = adapter->hw.hw_addr;
++ cinst->lan_info.ops = &i40evf_lan_ops;
++ cinst->lan_info.version.major = I40EVF_CLIENT_VERSION_MAJOR;
++ cinst->lan_info.version.minor = I40EVF_CLIENT_VERSION_MINOR;
++ cinst->lan_info.version.build = I40EVF_CLIENT_VERSION_BUILD;
++ i40evf_client_get_params(vsi, ¶ms);
++ cinst->lan_info.params = params;
++ set_bit(__I40E_CLIENT_INSTANCE_NONE, &cinst->state);
++
++ cinst->lan_info.msix_count = adapter->num_iwarp_msix;
++ cinst->lan_info.msix_entries =
++ &adapter->msix_entries[adapter->iwarp_base_vector];
++
++ mac = list_first_entry(&cinst->lan_info.netdev->dev_addrs.list,
++ struct netdev_hw_addr, list);
++ if (mac)
++ ether_addr_copy(cinst->lan_info.lanmac, mac->addr);
++ else
++ dev_err(&adapter->pdev->dev, "MAC address list is empty!\n");
++
++ cinst->client = vf_registered_client;
++ adapter->cinst = cinst;
++out:
++ return cinst;
++}
++
++/**
++ * i40evf_client_del_instance - removes a client instance from the list
++ * @adapter: pointer to the board struct
++ *
++ **/
++static
++void i40evf_client_del_instance(struct i40evf_adapter *adapter)
++{
++ kfree(adapter->cinst);
++ adapter->cinst = NULL;
++}
++
++/**
++ * i40evf_client_subtask - client maintenance work
++ * @adapter: board private structure
++ **/
++void i40evf_client_subtask(struct i40evf_adapter *adapter)
++{
++ struct i40e_client *client = vf_registered_client;
++ struct i40e_client_instance *cinst;
++ int ret = 0;
++
++ if (adapter->state < __I40EVF_DOWN)
++ return;
++
++ /* first check client is registered */
++ if (!client)
++ return;
++
++ /* Add the client instance to the instance list */
++ cinst = i40evf_client_add_instance(adapter);
++ if (!cinst)
++ return;
++
++ dev_info(&adapter->pdev->dev, "Added instance of Client %s\n",
++ client->name);
++
++ if (!test_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state)) {
++ /* Send an Open request to the client */
++
++ if (client->ops && client->ops->open)
++ ret = client->ops->open(&cinst->lan_info, client);
++ if (!ret)
++ set_bit(__I40E_CLIENT_INSTANCE_OPENED,
++ &cinst->state);
++ else
++ /* remove client instance */
++ i40evf_client_del_instance(adapter);
++ }
++}
++
++/**
++ * i40evf_lan_add_device - add a lan device struct to the list of lan devices
++ * @adapter: pointer to the board struct
++ *
++ * Returns 0 on success or none 0 on error
++ **/
++int i40evf_lan_add_device(struct i40evf_adapter *adapter)
++{
++ struct i40e_device *ldev;
++ int ret = 0;
++
++ mutex_lock(&i40evf_device_mutex);
++ list_for_each_entry(ldev, &i40evf_devices, list) {
++ if (ldev->vf == adapter) {
++ ret = -EEXIST;
++ goto out;
++ }
++ }
++ ldev = kzalloc(sizeof(*ldev), GFP_KERNEL);
++ if (!ldev) {
++ ret = -ENOMEM;
++ goto out;
++ }
++ ldev->vf = adapter;
++ INIT_LIST_HEAD(&ldev->list);
++ list_add(&ldev->list, &i40evf_devices);
++ dev_info(&adapter->pdev->dev, "Added LAN device bus=0x%02x dev=0x%02x func=0x%02x\n",
++ adapter->hw.bus.bus_id, adapter->hw.bus.device,
++ adapter->hw.bus.func);
++
++ /* Since in some cases register may have happened before a device gets
++ * added, we can schedule a subtask to go initiate the clients.
++ */
++ adapter->flags |= I40EVF_FLAG_SERVICE_CLIENT_REQUESTED;
++
++out:
++ mutex_unlock(&i40evf_device_mutex);
++ return ret;
++}
++
++/**
++ * i40evf_lan_del_device - removes a lan device from the device list
++ * @adapter: pointer to the board struct
++ *
++ * Returns 0 on success or non-0 on error
++ **/
++int i40evf_lan_del_device(struct i40evf_adapter *adapter)
++{
++ struct i40e_device *ldev, *tmp;
++ int ret = -ENODEV;
++
++ mutex_lock(&i40evf_device_mutex);
++ list_for_each_entry_safe(ldev, tmp, &i40evf_devices, list) {
++ if (ldev->vf == adapter) {
++ dev_info(&adapter->pdev->dev,
++ "Deleted LAN device bus=0x%02x dev=0x%02x func=0x%02x\n",
++ adapter->hw.bus.bus_id, adapter->hw.bus.device,
++ adapter->hw.bus.func);
++ list_del(&ldev->list);
++ kfree(ldev);
++ ret = 0;
++ break;
++ }
++ }
++
++ mutex_unlock(&i40evf_device_mutex);
++ return ret;
++}
++
++/**
++ * i40evf_client_release - release client specific resources
++ * @client: pointer to the registered client
++ *
++ **/
++static void i40evf_client_release(struct i40e_client *client)
++{
++ struct i40e_client_instance *cinst;
++ struct i40e_device *ldev;
++ struct i40evf_adapter *adapter;
++
++ mutex_lock(&i40evf_device_mutex);
++ list_for_each_entry(ldev, &i40evf_devices, list) {
++ adapter = ldev->vf;
++ cinst = adapter->cinst;
++ if (!cinst)
++ continue;
++ if (test_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state)) {
++ if (client->ops && client->ops->close)
++ client->ops->close(&cinst->lan_info, client,
++ false);
++ i40evf_client_release_qvlist(&cinst->lan_info);
++ clear_bit(__I40E_CLIENT_INSTANCE_OPENED, &cinst->state);
++
++ dev_warn(&adapter->pdev->dev,
++ "Client %s instance closed\n", client->name);
++ }
++ /* delete the client instance */
++ i40evf_client_del_instance(adapter);
++ dev_info(&adapter->pdev->dev, "Deleted client instance of Client %s\n",
++ client->name);
++ }
++ mutex_unlock(&i40evf_device_mutex);
++}
++
++/**
++ * i40evf_client_prepare - prepare client specific resources
++ * @client: pointer to the registered client
++ *
++ **/
++static void i40evf_client_prepare(struct i40e_client *client)
++{
++ struct i40e_device *ldev;
++ struct i40evf_adapter *adapter;
++
++ mutex_lock(&i40evf_device_mutex);
++ list_for_each_entry(ldev, &i40evf_devices, list) {
++ adapter = ldev->vf;
++ /* Signal the watchdog to service the client */
++ adapter->flags |= I40EVF_FLAG_SERVICE_CLIENT_REQUESTED;
++ }
++ mutex_unlock(&i40evf_device_mutex);
++}
++
++/**
++ * i40evf_client_virtchnl_send - send a message to the PF instance
++ * @ldev: pointer to L2 context.
++ * @client: Client pointer.
++ * @msg: pointer to message buffer
++ * @len: message length
++ *
++ * Return 0 on success or < 0 on error
++ **/
++static u32 i40evf_client_virtchnl_send(struct i40e_info *ldev,
++ struct i40e_client *client,
++ u8 *msg, u16 len)
++{
++ struct i40evf_adapter *adapter = ldev->vf;
++ i40e_status err;
++
++ if (adapter->aq_required)
++ return -EAGAIN;
++
++ err = i40e_aq_send_msg_to_pf(&adapter->hw, VIRTCHNL_OP_IWARP,
++ I40E_SUCCESS, msg, len, NULL);
++ if (err)
++ dev_err(&adapter->pdev->dev, "Unable to send iWarp message to PF, error %d, aq status %d\n",
++ err, adapter->hw.aq.asq_last_status);
++
++ return err;
++}
++
++/**
++ * i40evf_client_setup_qvlist - send a message to the PF to setup iwarp qv map
++ * @ldev: pointer to L2 context.
++ * @client: Client pointer.
++ * @qvlist_info: queue and vector list
++ *
++ * Return 0 on success or < 0 on error
++ **/
++static int i40evf_client_setup_qvlist(struct i40e_info *ldev,
++ struct i40e_client *client,
++ struct i40e_qvlist_info *qvlist_info)
++{
++ struct virtchnl_iwarp_qvlist_info *v_qvlist_info;
++ struct i40evf_adapter *adapter = ldev->vf;
++ struct i40e_qv_info *qv_info;
++ i40e_status err;
++ u32 v_idx, i;
++ u32 msg_size;
++
++ if (adapter->aq_required)
++ return -EAGAIN;
++
++ /* A quick check on whether the vectors belong to the client */
++ for (i = 0; i < qvlist_info->num_vectors; i++) {
++ qv_info = &qvlist_info->qv_info[i];
++ if (!qv_info)
++ continue;
++ v_idx = qv_info->v_idx;
++ if ((v_idx >=
++ (adapter->iwarp_base_vector + adapter->num_iwarp_msix)) ||
++ (v_idx < adapter->iwarp_base_vector))
++ return -EINVAL;
++ }
++
++ v_qvlist_info = (struct virtchnl_iwarp_qvlist_info *)qvlist_info;
++ msg_size = sizeof(struct virtchnl_iwarp_qvlist_info) +
++ (sizeof(struct virtchnl_iwarp_qv_info) *
++ (v_qvlist_info->num_vectors - 1));
++
++ adapter->client_pending |= BIT(VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP);
++ err = i40e_aq_send_msg_to_pf(&adapter->hw,
++ VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP,
++ I40E_SUCCESS, (u8 *)v_qvlist_info, msg_size, NULL);
++
++ if (err) {
++ dev_err(&adapter->pdev->dev,
++ "Unable to send iWarp vector config message to PF, error %d, aq status %d\n",
++ err, adapter->hw.aq.asq_last_status);
++ goto out;
++ }
++
++ err = -EBUSY;
++ for (i = 0; i < 5; i++) {
++ msleep(100);
++ if (!(adapter->client_pending &
++ BIT(VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP))) {
++ err = 0;
++ break;
++ }
++ }
++out:
++ return err;
++}
++
++/**
++ * i40evf_register_client - Register a i40e client driver with the L2 driver
++ * @client: pointer to the i40e_client struct
++ *
++ * Returns 0 on success or non-0 on error
++ **/
++int i40evf_register_client(struct i40e_client *client)
++{
++ int ret = 0;
++
++ if (!client) {
++ ret = -EIO;
++ goto out;
++ }
++
++ if (strlen(client->name) == 0) {
++ pr_info("i40evf: Failed to register client with no name\n");
++ ret = -EIO;
++ goto out;
++ }
++
++ if (vf_registered_client) {
++ pr_info("i40evf: Client %s has already been registered!\n",
++ client->name);
++ ret = -EEXIST;
++ goto out;
++ }
++
++ if ((client->version.major != I40EVF_CLIENT_VERSION_MAJOR) ||
++ (client->version.minor != I40EVF_CLIENT_VERSION_MINOR)) {
++ pr_info("i40evf: Failed to register client %s due to mismatched client interface version\n",
++ client->name);
++ pr_info("Client is using version: %02d.%02d.%02d while LAN driver supports %s\n",
++ client->version.major, client->version.minor,
++ client->version.build,
++ i40evf_client_interface_version_str);
++ ret = -EIO;
++ goto out;
++ }
++
++ vf_registered_client = client;
++
++ i40evf_client_prepare(client);
++
++ pr_info("i40evf: Registered client %s with return code %d\n",
++ client->name, ret);
++out:
++ return ret;
++}
++EXPORT_SYMBOL(i40evf_register_client);
++
++/**
++ * i40evf_unregister_client - Unregister a i40e client driver with the L2 driver
++ * @client: pointer to the i40e_client struct
++ *
++ * Returns 0 on success or non-0 on error
++ **/
++int i40evf_unregister_client(struct i40e_client *client)
++{
++ int ret = 0;
++
++ /* When a unregister request comes through we would have to send
++ * a close for each of the client instances that were opened.
++ * client_release function is called to handle this.
++ */
++ i40evf_client_release(client);
++
++ if (vf_registered_client != client) {
++ pr_info("i40evf: Client %s has not been registered\n",
++ client->name);
++ ret = -ENODEV;
++ goto out;
++ }
++ vf_registered_client = NULL;
++ pr_info("i40evf: Unregistered client %s\n", client->name);
++out:
++ return ret;
++}
++EXPORT_SYMBOL(i40evf_unregister_client);
+diff --git a/drivers/net/ethernet/intel/iavf/i40evf_client.h b/drivers/net/ethernet/intel/iavf/i40evf_client.h
+new file mode 100644
+index 0000000000000..5585f362048a7
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40evf_client.h
+@@ -0,0 +1,169 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#ifndef _I40EVF_CLIENT_H_
++#define _I40EVF_CLIENT_H_
++
++#define I40EVF_CLIENT_STR_LENGTH 10
++
++/* Client interface version should be updated anytime there is a change in the
++ * existing APIs or data structures.
++ */
++#define I40EVF_CLIENT_VERSION_MAJOR 0
++#define I40EVF_CLIENT_VERSION_MINOR 01
++#define I40EVF_CLIENT_VERSION_BUILD 00
++#define I40EVF_CLIENT_VERSION_STR \
++ __stringify(I40EVF_CLIENT_VERSION_MAJOR) "." \
++ __stringify(I40EVF_CLIENT_VERSION_MINOR) "." \
++ __stringify(I40EVF_CLIENT_VERSION_BUILD)
++
++struct i40e_client_version {
++ u8 major;
++ u8 minor;
++ u8 build;
++ u8 rsvd;
++};
++
++enum i40e_client_state {
++ __I40E_CLIENT_NULL,
++ __I40E_CLIENT_REGISTERED
++};
++
++enum i40e_client_instance_state {
++ __I40E_CLIENT_INSTANCE_NONE,
++ __I40E_CLIENT_INSTANCE_OPENED,
++};
++
++struct i40e_ops;
++struct i40e_client;
++
++/* HW does not define a type value for AEQ; only for RX/TX and CEQ.
++ * In order for us to keep the interface simple, SW will define a
++ * unique type value for AEQ.
++ */
++#define I40E_QUEUE_TYPE_PE_AEQ 0x80
++#define I40E_QUEUE_INVALID_IDX 0xFFFF
++
++struct i40e_qv_info {
++ u32 v_idx; /* msix_vector */
++ u16 ceq_idx;
++ u16 aeq_idx;
++ u8 itr_idx;
++};
++
++struct i40e_qvlist_info {
++ u32 num_vectors;
++ struct i40e_qv_info qv_info[1];
++};
++
++#define I40E_CLIENT_MSIX_ALL 0xFFFFFFFF
++
++/* set of LAN parameters useful for clients managed by LAN */
++
++/* Struct to hold per priority info */
++struct i40e_prio_qos_params {
++ u16 qs_handle; /* qs handle for prio */
++ u8 tc; /* TC mapped to prio */
++ u8 reserved;
++};
++
++#define I40E_CLIENT_MAX_USER_PRIORITY 8
++/* Struct to hold Client QoS */
++struct i40e_qos_params {
++ struct i40e_prio_qos_params prio_qos[I40E_CLIENT_MAX_USER_PRIORITY];
++};
++
++struct i40e_params {
++ struct i40e_qos_params qos;
++ u16 mtu;
++ u16 link_up; /* boolean */
++};
++
++/* Structure to hold LAN device info for a client device */
++struct i40e_info {
++ struct i40e_client_version version;
++ u8 lanmac[6];
++ struct net_device *netdev;
++ struct pci_dev *pcidev;
++ u8 __iomem *hw_addr;
++ u8 fid; /* function id, PF id or VF id */
++#define I40E_CLIENT_FTYPE_PF 0
++#define I40E_CLIENT_FTYPE_VF 1
++ u8 ftype; /* function type, PF or VF */
++ void *vf; /* cast to i40evf_adapter */
++
++ /* All L2 params that could change during the life span of the device
++ * and needs to be communicated to the client when they change
++ */
++ struct i40e_params params;
++ struct i40e_ops *ops;
++
++ u16 msix_count; /* number of msix vectors*/
++ /* Array down below will be dynamically allocated based on msix_count */
++ struct msix_entry *msix_entries;
++ u16 itr_index; /* Which ITR index the PE driver is suppose to use */
++};
++
++struct i40e_ops {
++ /* setup_q_vector_list enables queues with a particular vector */
++ int (*setup_qvlist)(struct i40e_info *ldev, struct i40e_client *client,
++ struct i40e_qvlist_info *qv_info);
++
++ u32 (*virtchnl_send)(struct i40e_info *ldev, struct i40e_client *client,
++ u8 *msg, u16 len);
++
++ /* If the PE Engine is unresponsive, RDMA driver can request a reset.*/
++ void (*request_reset)(struct i40e_info *ldev,
++ struct i40e_client *client);
++};
++
++struct i40e_client_ops {
++ /* Should be called from register_client() or whenever the driver is
++ * ready to create a specific client instance.
++ */
++ int (*open)(struct i40e_info *ldev, struct i40e_client *client);
++
++ /* Should be closed when netdev is unavailable or when unregister
++ * call comes in. If the close happens due to a reset, set the reset
++ * bit to true.
++ */
++ void (*close)(struct i40e_info *ldev, struct i40e_client *client,
++ bool reset);
++
++ /* called when some l2 managed parameters changes - mss */
++ void (*l2_param_change)(struct i40e_info *ldev,
++ struct i40e_client *client,
++ struct i40e_params *params);
++
++ /* called when a message is received from the PF */
++ int (*virtchnl_receive)(struct i40e_info *ldev,
++ struct i40e_client *client,
++ u8 *msg, u16 len);
++};
++
++/* Client device */
++struct i40e_client_instance {
++ struct list_head list;
++ struct i40e_info lan_info;
++ struct i40e_client *client;
++ unsigned long state;
++};
++
++struct i40e_client {
++ struct list_head list; /* list of registered clients */
++ char name[I40EVF_CLIENT_STR_LENGTH];
++ struct i40e_client_version version;
++ unsigned long state; /* client state */
++ atomic_t ref_cnt; /* Count of all the client devices of this kind */
++ u32 flags;
++#define I40E_CLIENT_FLAGS_LAUNCH_ON_PROBE BIT(0)
++#define I40E_TX_FLAGS_NOTIFY_OTHER_EVENTS BIT(2)
++ u8 type;
++#define I40E_CLIENT_IWARP 0
++ struct i40e_client_ops *ops; /* client ops provided by the client */
++};
++
++/* used by clients */
++int i40evf_register_client(struct i40e_client *client);
++int i40evf_unregister_client(struct i40e_client *client);
++#endif /* _I40EVF_CLIENT_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/i40evf_ethtool.c b/drivers/net/ethernet/intel/iavf/i40evf_ethtool.c
+new file mode 100644
+index 0000000000000..69efe0aec76a4
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40evf_ethtool.c
+@@ -0,0 +1,820 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++/* ethtool support for i40evf */
++#include "i40evf.h"
++
++#include <linux/uaccess.h>
++
++struct i40evf_stats {
++ char stat_string[ETH_GSTRING_LEN];
++ int stat_offset;
++};
++
++#define I40EVF_STAT(_name, _stat) { \
++ .stat_string = _name, \
++ .stat_offset = offsetof(struct i40evf_adapter, _stat) \
++}
++
++/* All stats are u64, so we don't need to track the size of the field. */
++static const struct i40evf_stats i40evf_gstrings_stats[] = {
++ I40EVF_STAT("rx_bytes", current_stats.rx_bytes),
++ I40EVF_STAT("rx_unicast", current_stats.rx_unicast),
++ I40EVF_STAT("rx_multicast", current_stats.rx_multicast),
++ I40EVF_STAT("rx_broadcast", current_stats.rx_broadcast),
++ I40EVF_STAT("rx_discards", current_stats.rx_discards),
++ I40EVF_STAT("rx_unknown_protocol", current_stats.rx_unknown_protocol),
++ I40EVF_STAT("tx_bytes", current_stats.tx_bytes),
++ I40EVF_STAT("tx_unicast", current_stats.tx_unicast),
++ I40EVF_STAT("tx_multicast", current_stats.tx_multicast),
++ I40EVF_STAT("tx_broadcast", current_stats.tx_broadcast),
++ I40EVF_STAT("tx_discards", current_stats.tx_discards),
++ I40EVF_STAT("tx_errors", current_stats.tx_errors),
++};
++
++#define I40EVF_GLOBAL_STATS_LEN ARRAY_SIZE(i40evf_gstrings_stats)
++#define I40EVF_QUEUE_STATS_LEN(_dev) \
++ (((struct i40evf_adapter *)\
++ netdev_priv(_dev))->num_active_queues \
++ * 2 * (sizeof(struct i40e_queue_stats) / sizeof(u64)))
++#define I40EVF_STATS_LEN(_dev) \
++ (I40EVF_GLOBAL_STATS_LEN + I40EVF_QUEUE_STATS_LEN(_dev))
++
++/* For now we have one and only one private flag and it is only defined
++ * when we have support for the SKIP_CPU_SYNC DMA attribute. Instead
++ * of leaving all this code sitting around empty we will strip it unless
++ * our one private flag is actually available.
++ */
++struct i40evf_priv_flags {
++ char flag_string[ETH_GSTRING_LEN];
++ u32 flag;
++ bool read_only;
++};
++
++#define I40EVF_PRIV_FLAG(_name, _flag, _read_only) { \
++ .flag_string = _name, \
++ .flag = _flag, \
++ .read_only = _read_only, \
++}
++
++static const struct i40evf_priv_flags i40evf_gstrings_priv_flags[] = {
++ I40EVF_PRIV_FLAG("legacy-rx", I40EVF_FLAG_LEGACY_RX, 0),
++};
++
++#define I40EVF_PRIV_FLAGS_STR_LEN ARRAY_SIZE(i40evf_gstrings_priv_flags)
++
++/**
++ * i40evf_get_link_ksettings - Get Link Speed and Duplex settings
++ * @netdev: network interface device structure
++ * @cmd: ethtool command
++ *
++ * Reports speed/duplex settings. Because this is a VF, we don't know what
++ * kind of link we really have, so we fake it.
++ **/
++static int i40evf_get_link_ksettings(struct net_device *netdev,
++ struct ethtool_link_ksettings *cmd)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ ethtool_link_ksettings_zero_link_mode(cmd, supported);
++ cmd->base.autoneg = AUTONEG_DISABLE;
++ cmd->base.port = PORT_NONE;
++ /* Set speed and duplex */
++ switch (adapter->link_speed) {
++ case I40E_LINK_SPEED_40GB:
++ cmd->base.speed = SPEED_40000;
++ break;
++ case I40E_LINK_SPEED_25GB:
++#ifdef SPEED_25000
++ cmd->base.speed = SPEED_25000;
++#else
++ netdev_info(netdev,
++ "Speed is 25G, display not supported by this version of ethtool.\n");
++#endif
++ break;
++ case I40E_LINK_SPEED_20GB:
++ cmd->base.speed = SPEED_20000;
++ break;
++ case I40E_LINK_SPEED_10GB:
++ cmd->base.speed = SPEED_10000;
++ break;
++ case I40E_LINK_SPEED_1GB:
++ cmd->base.speed = SPEED_1000;
++ break;
++ case I40E_LINK_SPEED_100MB:
++ cmd->base.speed = SPEED_100;
++ break;
++ default:
++ break;
++ }
++ cmd->base.duplex = DUPLEX_FULL;
++
++ return 0;
++}
++
++/**
++ * i40evf_get_sset_count - Get length of string set
++ * @netdev: network interface device structure
++ * @sset: id of string set
++ *
++ * Reports size of string table. This driver only supports
++ * strings for statistics.
++ **/
++static int i40evf_get_sset_count(struct net_device *netdev, int sset)
++{
++ if (sset == ETH_SS_STATS)
++ return I40EVF_STATS_LEN(netdev);
++ else if (sset == ETH_SS_PRIV_FLAGS)
++ return I40EVF_PRIV_FLAGS_STR_LEN;
++ else
++ return -EINVAL;
++}
++
++/**
++ * i40evf_get_ethtool_stats - report device statistics
++ * @netdev: network interface device structure
++ * @stats: ethtool statistics structure
++ * @data: pointer to data buffer
++ *
++ * All statistics are added to the data buffer as an array of u64.
++ **/
++static void i40evf_get_ethtool_stats(struct net_device *netdev,
++ struct ethtool_stats *stats, u64 *data)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ unsigned int i, j;
++ char *p;
++
++ for (i = 0; i < I40EVF_GLOBAL_STATS_LEN; i++) {
++ p = (char *)adapter + i40evf_gstrings_stats[i].stat_offset;
++ data[i] = *(u64 *)p;
++ }
++ for (j = 0; j < adapter->num_active_queues; j++) {
++ data[i++] = adapter->tx_rings[j].stats.packets;
++ data[i++] = adapter->tx_rings[j].stats.bytes;
++ }
++ for (j = 0; j < adapter->num_active_queues; j++) {
++ data[i++] = adapter->rx_rings[j].stats.packets;
++ data[i++] = adapter->rx_rings[j].stats.bytes;
++ }
++}
++
++/**
++ * i40evf_get_strings - Get string set
++ * @netdev: network interface device structure
++ * @sset: id of string set
++ * @data: buffer for string data
++ *
++ * Builds stats string table.
++ **/
++static void i40evf_get_strings(struct net_device *netdev, u32 sset, u8 *data)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ u8 *p = data;
++ int i;
++
++ if (sset == ETH_SS_STATS) {
++ for (i = 0; i < (int)I40EVF_GLOBAL_STATS_LEN; i++) {
++ memcpy(p, i40evf_gstrings_stats[i].stat_string,
++ ETH_GSTRING_LEN);
++ p += ETH_GSTRING_LEN;
++ }
++ for (i = 0; i < adapter->num_active_queues; i++) {
++ snprintf(p, ETH_GSTRING_LEN, "tx-%u.packets", i);
++ p += ETH_GSTRING_LEN;
++ snprintf(p, ETH_GSTRING_LEN, "tx-%u.bytes", i);
++ p += ETH_GSTRING_LEN;
++ }
++ for (i = 0; i < adapter->num_active_queues; i++) {
++ snprintf(p, ETH_GSTRING_LEN, "rx-%u.packets", i);
++ p += ETH_GSTRING_LEN;
++ snprintf(p, ETH_GSTRING_LEN, "rx-%u.bytes", i);
++ p += ETH_GSTRING_LEN;
++ }
++ } else if (sset == ETH_SS_PRIV_FLAGS) {
++ for (i = 0; i < I40EVF_PRIV_FLAGS_STR_LEN; i++) {
++ snprintf(p, ETH_GSTRING_LEN, "%s",
++ i40evf_gstrings_priv_flags[i].flag_string);
++ p += ETH_GSTRING_LEN;
++ }
++ }
++}
++
++/**
++ * i40evf_get_priv_flags - report device private flags
++ * @netdev: network interface device structure
++ *
++ * The get string set count and the string set should be matched for each
++ * flag returned. Add new strings for each flag to the i40e_gstrings_priv_flags
++ * array.
++ *
++ * Returns a u32 bitmap of flags.
++ **/
++static u32 i40evf_get_priv_flags(struct net_device *netdev)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ u32 i, ret_flags = 0;
++
++ for (i = 0; i < I40EVF_PRIV_FLAGS_STR_LEN; i++) {
++ const struct i40evf_priv_flags *priv_flags;
++
++ priv_flags = &i40evf_gstrings_priv_flags[i];
++
++ if (priv_flags->flag & adapter->flags)
++ ret_flags |= BIT(i);
++ }
++
++ return ret_flags;
++}
++
++/**
++ * i40evf_set_priv_flags - set private flags
++ * @netdev: network interface device structure
++ * @flags: bit flags to be set
++ **/
++static int i40evf_set_priv_flags(struct net_device *netdev, u32 flags)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ u32 orig_flags, new_flags, changed_flags;
++ u32 i;
++
++ orig_flags = READ_ONCE(adapter->flags);
++ new_flags = orig_flags;
++
++ for (i = 0; i < I40EVF_PRIV_FLAGS_STR_LEN; i++) {
++ const struct i40evf_priv_flags *priv_flags;
++
++ priv_flags = &i40evf_gstrings_priv_flags[i];
++
++ if (flags & BIT(i))
++ new_flags |= priv_flags->flag;
++ else
++ new_flags &= ~(priv_flags->flag);
++
++ if (priv_flags->read_only &&
++ ((orig_flags ^ new_flags) & ~BIT(i)))
++ return -EOPNOTSUPP;
++ }
++
++ /* Before we finalize any flag changes, any checks which we need to
++ * perform to determine if the new flags will be supported should go
++ * here...
++ */
++
++ /* Compare and exchange the new flags into place. If we failed, that
++ * is if cmpxchg returns anything but the old value, this means
++ * something else must have modified the flags variable since we
++ * copied it. We'll just punt with an error and log something in the
++ * message buffer.
++ */
++ if (cmpxchg(&adapter->flags, orig_flags, new_flags) != orig_flags) {
++ dev_warn(&adapter->pdev->dev,
++ "Unable to update adapter->flags as it was modified by another thread...\n");
++ return -EAGAIN;
++ }
++
++ changed_flags = orig_flags ^ new_flags;
++
++ /* Process any additional changes needed as a result of flag changes.
++ * The changed_flags value reflects the list of bits that were changed
++ * in the code above.
++ */
++
++ /* issue a reset to force legacy-rx change to take effect */
++ if (changed_flags & I40EVF_FLAG_LEGACY_RX) {
++ if (netif_running(netdev)) {
++ adapter->flags |= I40EVF_FLAG_RESET_NEEDED;
++ schedule_work(&adapter->reset_task);
++ }
++ }
++
++ return 0;
++}
++
++/**
++ * i40evf_get_msglevel - Get debug message level
++ * @netdev: network interface device structure
++ *
++ * Returns current debug message level.
++ **/
++static u32 i40evf_get_msglevel(struct net_device *netdev)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ return adapter->msg_enable;
++}
++
++/**
++ * i40evf_set_msglevel - Set debug message level
++ * @netdev: network interface device structure
++ * @data: message level
++ *
++ * Set current debug message level. Higher values cause the driver to
++ * be noisier.
++ **/
++static void i40evf_set_msglevel(struct net_device *netdev, u32 data)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ if (I40E_DEBUG_USER & data)
++ adapter->hw.debug_mask = data;
++ adapter->msg_enable = data;
++}
++
++/**
++ * i40evf_get_drvinfo - Get driver info
++ * @netdev: network interface device structure
++ * @drvinfo: ethool driver info structure
++ *
++ * Returns information about the driver and device for display to the user.
++ **/
++static void i40evf_get_drvinfo(struct net_device *netdev,
++ struct ethtool_drvinfo *drvinfo)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ strlcpy(drvinfo->driver, i40evf_driver_name, 32);
++ strlcpy(drvinfo->version, i40evf_driver_version, 32);
++ strlcpy(drvinfo->fw_version, "N/A", 4);
++ strlcpy(drvinfo->bus_info, pci_name(adapter->pdev), 32);
++ drvinfo->n_priv_flags = I40EVF_PRIV_FLAGS_STR_LEN;
++}
++
++/**
++ * i40evf_get_ringparam - Get ring parameters
++ * @netdev: network interface device structure
++ * @ring: ethtool ringparam structure
++ *
++ * Returns current ring parameters. TX and RX rings are reported separately,
++ * but the number of rings is not reported.
++ **/
++static void i40evf_get_ringparam(struct net_device *netdev,
++ struct ethtool_ringparam *ring)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ ring->rx_max_pending = I40EVF_MAX_RXD;
++ ring->tx_max_pending = I40EVF_MAX_TXD;
++ ring->rx_pending = adapter->rx_desc_count;
++ ring->tx_pending = adapter->tx_desc_count;
++}
++
++/**
++ * i40evf_set_ringparam - Set ring parameters
++ * @netdev: network interface device structure
++ * @ring: ethtool ringparam structure
++ *
++ * Sets ring parameters. TX and RX rings are controlled separately, but the
++ * number of rings is not specified, so all rings get the same settings.
++ **/
++static int i40evf_set_ringparam(struct net_device *netdev,
++ struct ethtool_ringparam *ring)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ u32 new_rx_count, new_tx_count;
++
++ if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
++ return -EINVAL;
++
++ new_tx_count = clamp_t(u32, ring->tx_pending,
++ I40EVF_MIN_TXD,
++ I40EVF_MAX_TXD);
++ new_tx_count = ALIGN(new_tx_count, I40EVF_REQ_DESCRIPTOR_MULTIPLE);
++
++ new_rx_count = clamp_t(u32, ring->rx_pending,
++ I40EVF_MIN_RXD,
++ I40EVF_MAX_RXD);
++ new_rx_count = ALIGN(new_rx_count, I40EVF_REQ_DESCRIPTOR_MULTIPLE);
++
++ /* if nothing to do return success */
++ if ((new_tx_count == adapter->tx_desc_count) &&
++ (new_rx_count == adapter->rx_desc_count))
++ return 0;
++
++ adapter->tx_desc_count = new_tx_count;
++ adapter->rx_desc_count = new_rx_count;
++
++ if (netif_running(netdev)) {
++ adapter->flags |= I40EVF_FLAG_RESET_NEEDED;
++ schedule_work(&adapter->reset_task);
++ }
++
++ return 0;
++}
++
++/**
++ * __i40evf_get_coalesce - get per-queue coalesce settings
++ * @netdev: the netdev to check
++ * @ec: ethtool coalesce data structure
++ * @queue: which queue to pick
++ *
++ * Gets the per-queue settings for coalescence. Specifically Rx and Tx usecs
++ * are per queue. If queue is <0 then we default to queue 0 as the
++ * representative value.
++ **/
++static int __i40evf_get_coalesce(struct net_device *netdev,
++ struct ethtool_coalesce *ec,
++ int queue)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ struct i40e_vsi *vsi = &adapter->vsi;
++ struct i40e_ring *rx_ring, *tx_ring;
++
++ ec->tx_max_coalesced_frames = vsi->work_limit;
++ ec->rx_max_coalesced_frames = vsi->work_limit;
++
++ /* Rx and Tx usecs per queue value. If user doesn't specify the
++ * queue, return queue 0's value to represent.
++ */
++ if (queue < 0)
++ queue = 0;
++ else if (queue >= adapter->num_active_queues)
++ return -EINVAL;
++
++ rx_ring = &adapter->rx_rings[queue];
++ tx_ring = &adapter->tx_rings[queue];
++
++ if (ITR_IS_DYNAMIC(rx_ring->itr_setting))
++ ec->use_adaptive_rx_coalesce = 1;
++
++ if (ITR_IS_DYNAMIC(tx_ring->itr_setting))
++ ec->use_adaptive_tx_coalesce = 1;
++
++ ec->rx_coalesce_usecs = rx_ring->itr_setting & ~I40E_ITR_DYNAMIC;
++ ec->tx_coalesce_usecs = tx_ring->itr_setting & ~I40E_ITR_DYNAMIC;
++
++ return 0;
++}
++
++/**
++ * i40evf_get_coalesce - Get interrupt coalescing settings
++ * @netdev: network interface device structure
++ * @ec: ethtool coalesce structure
++ *
++ * Returns current coalescing settings. This is referred to elsewhere in the
++ * driver as Interrupt Throttle Rate, as this is how the hardware describes
++ * this functionality. Note that if per-queue settings have been modified this
++ * only represents the settings of queue 0.
++ **/
++static int i40evf_get_coalesce(struct net_device *netdev,
++ struct ethtool_coalesce *ec)
++{
++ return __i40evf_get_coalesce(netdev, ec, -1);
++}
++
++/**
++ * i40evf_get_per_queue_coalesce - get coalesce values for specific queue
++ * @netdev: netdev to read
++ * @ec: coalesce settings from ethtool
++ * @queue: the queue to read
++ *
++ * Read specific queue's coalesce settings.
++ **/
++static int i40evf_get_per_queue_coalesce(struct net_device *netdev,
++ u32 queue,
++ struct ethtool_coalesce *ec)
++{
++ return __i40evf_get_coalesce(netdev, ec, queue);
++}
++
++/**
++ * i40evf_set_itr_per_queue - set ITR values for specific queue
++ * @adapter: the VF adapter struct to set values for
++ * @ec: coalesce settings from ethtool
++ * @queue: the queue to modify
++ *
++ * Change the ITR settings for a specific queue.
++ **/
++static void i40evf_set_itr_per_queue(struct i40evf_adapter *adapter,
++ struct ethtool_coalesce *ec,
++ int queue)
++{
++ struct i40e_ring *rx_ring = &adapter->rx_rings[queue];
++ struct i40e_ring *tx_ring = &adapter->tx_rings[queue];
++ struct i40e_q_vector *q_vector;
++
++ rx_ring->itr_setting = ITR_REG_ALIGN(ec->rx_coalesce_usecs);
++ tx_ring->itr_setting = ITR_REG_ALIGN(ec->tx_coalesce_usecs);
++
++ rx_ring->itr_setting |= I40E_ITR_DYNAMIC;
++ if (!ec->use_adaptive_rx_coalesce)
++ rx_ring->itr_setting ^= I40E_ITR_DYNAMIC;
++
++ tx_ring->itr_setting |= I40E_ITR_DYNAMIC;
++ if (!ec->use_adaptive_tx_coalesce)
++ tx_ring->itr_setting ^= I40E_ITR_DYNAMIC;
++
++ q_vector = rx_ring->q_vector;
++ q_vector->rx.target_itr = ITR_TO_REG(rx_ring->itr_setting);
++
++ q_vector = tx_ring->q_vector;
++ q_vector->tx.target_itr = ITR_TO_REG(tx_ring->itr_setting);
++
++ /* The interrupt handler itself will take care of programming
++ * the Tx and Rx ITR values based on the values we have entered
++ * into the q_vector, no need to write the values now.
++ */
++}
++
++/**
++ * __i40evf_set_coalesce - set coalesce settings for particular queue
++ * @netdev: the netdev to change
++ * @ec: ethtool coalesce settings
++ * @queue: the queue to change
++ *
++ * Sets the coalesce settings for a particular queue.
++ **/
++static int __i40evf_set_coalesce(struct net_device *netdev,
++ struct ethtool_coalesce *ec,
++ int queue)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ struct i40e_vsi *vsi = &adapter->vsi;
++ int i;
++
++ if (ec->tx_max_coalesced_frames_irq || ec->rx_max_coalesced_frames_irq)
++ vsi->work_limit = ec->tx_max_coalesced_frames_irq;
++
++ if (ec->rx_coalesce_usecs == 0) {
++ if (ec->use_adaptive_rx_coalesce)
++ netif_info(adapter, drv, netdev, "rx-usecs=0, need to disable adaptive-rx for a complete disable\n");
++ } else if ((ec->rx_coalesce_usecs < I40E_MIN_ITR) ||
++ (ec->rx_coalesce_usecs > I40E_MAX_ITR)) {
++ netif_info(adapter, drv, netdev, "Invalid value, rx-usecs range is 0-8160\n");
++ return -EINVAL;
++ }
++
++ else
++ if (ec->tx_coalesce_usecs == 0) {
++ if (ec->use_adaptive_tx_coalesce)
++ netif_info(adapter, drv, netdev, "tx-usecs=0, need to disable adaptive-tx for a complete disable\n");
++ } else if ((ec->tx_coalesce_usecs < I40E_MIN_ITR) ||
++ (ec->tx_coalesce_usecs > I40E_MAX_ITR)) {
++ netif_info(adapter, drv, netdev, "Invalid value, tx-usecs range is 0-8160\n");
++ return -EINVAL;
++ }
++
++ /* Rx and Tx usecs has per queue value. If user doesn't specify the
++ * queue, apply to all queues.
++ */
++ if (queue < 0) {
++ for (i = 0; i < adapter->num_active_queues; i++)
++ i40evf_set_itr_per_queue(adapter, ec, i);
++ } else if (queue < adapter->num_active_queues) {
++ i40evf_set_itr_per_queue(adapter, ec, queue);
++ } else {
++ netif_info(adapter, drv, netdev, "Invalid queue value, queue range is 0 - %d\n",
++ adapter->num_active_queues - 1);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++/**
++ * i40evf_set_coalesce - Set interrupt coalescing settings
++ * @netdev: network interface device structure
++ * @ec: ethtool coalesce structure
++ *
++ * Change current coalescing settings for every queue.
++ **/
++static int i40evf_set_coalesce(struct net_device *netdev,
++ struct ethtool_coalesce *ec)
++{
++ return __i40evf_set_coalesce(netdev, ec, -1);
++}
++
++/**
++ * i40evf_set_per_queue_coalesce - set specific queue's coalesce settings
++ * @netdev: the netdev to change
++ * @ec: ethtool's coalesce settings
++ * @queue: the queue to modify
++ *
++ * Modifies a specific queue's coalesce settings.
++ */
++static int i40evf_set_per_queue_coalesce(struct net_device *netdev,
++ u32 queue,
++ struct ethtool_coalesce *ec)
++{
++ return __i40evf_set_coalesce(netdev, ec, queue);
++}
++
++/**
++ * i40evf_get_rxnfc - command to get RX flow classification rules
++ * @netdev: network interface device structure
++ * @cmd: ethtool rxnfc command
++ * @rule_locs: pointer to store rule locations
++ *
++ * Returns Success if the command is supported.
++ **/
++static int i40evf_get_rxnfc(struct net_device *netdev,
++ struct ethtool_rxnfc *cmd,
++ u32 *rule_locs)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ int ret = -EOPNOTSUPP;
++
++ switch (cmd->cmd) {
++ case ETHTOOL_GRXRINGS:
++ cmd->data = adapter->num_active_queues;
++ ret = 0;
++ break;
++ case ETHTOOL_GRXFH:
++ netdev_info(netdev,
++ "RSS hash info is not available to vf, use pf.\n");
++ break;
++ default:
++ break;
++ }
++
++ return ret;
++}
++/**
++ * i40evf_get_channels: get the number of channels supported by the device
++ * @netdev: network interface device structure
++ * @ch: channel information structure
++ *
++ * For the purposes of our device, we only use combined channels, i.e. a tx/rx
++ * queue pair. Report one extra channel to match our "other" MSI-X vector.
++ **/
++static void i40evf_get_channels(struct net_device *netdev,
++ struct ethtool_channels *ch)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ /* Report maximum channels */
++ ch->max_combined = I40EVF_MAX_REQ_QUEUES;
++
++ ch->max_other = NONQ_VECS;
++ ch->other_count = NONQ_VECS;
++
++ ch->combined_count = adapter->num_active_queues;
++}
++
++/**
++ * i40evf_set_channels: set the new channel count
++ * @netdev: network interface device structure
++ * @ch: channel information structure
++ *
++ * Negotiate a new number of channels with the PF then do a reset. During
++ * reset we'll realloc queues and fix the RSS table. Returns 0 on success,
++ * negative on failure.
++ **/
++static int i40evf_set_channels(struct net_device *netdev,
++ struct ethtool_channels *ch)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ int num_req = ch->combined_count;
++
++ if (num_req != adapter->num_active_queues &&
++ !(adapter->vf_res->vf_cap_flags &
++ VIRTCHNL_VF_OFFLOAD_REQ_QUEUES)) {
++ dev_info(&adapter->pdev->dev, "PF is not capable of queue negotiation.\n");
++ return -EINVAL;
++ }
++
++ if ((adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
++ adapter->num_tc) {
++ dev_info(&adapter->pdev->dev, "Cannot set channels since ADq is enabled.\n");
++ return -EINVAL;
++ }
++
++ /* All of these should have already been checked by ethtool before this
++ * even gets to us, but just to be sure.
++ */
++ if (num_req <= 0 || num_req > I40EVF_MAX_REQ_QUEUES)
++ return -EINVAL;
++
++ if (ch->rx_count || ch->tx_count || ch->other_count != NONQ_VECS)
++ return -EINVAL;
++
++ adapter->num_req_queues = num_req;
++ return i40evf_request_queues(adapter, num_req);
++}
++
++/**
++ * i40evf_get_rxfh_key_size - get the RSS hash key size
++ * @netdev: network interface device structure
++ *
++ * Returns the table size.
++ **/
++static u32 i40evf_get_rxfh_key_size(struct net_device *netdev)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ return adapter->rss_key_size;
++}
++
++/**
++ * i40evf_get_rxfh_indir_size - get the rx flow hash indirection table size
++ * @netdev: network interface device structure
++ *
++ * Returns the table size.
++ **/
++static u32 i40evf_get_rxfh_indir_size(struct net_device *netdev)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ return adapter->rss_lut_size;
++}
++
++/**
++ * i40evf_get_rxfh - get the rx flow hash indirection table
++ * @netdev: network interface device structure
++ * @indir: indirection table
++ * @key: hash key
++ * @hfunc: hash function in use
++ *
++ * Reads the indirection table directly from the hardware. Always returns 0.
++ **/
++static int i40evf_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,
++ u8 *hfunc)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ u16 i;
++
++ if (hfunc)
++ *hfunc = ETH_RSS_HASH_TOP;
++ if (!indir)
++ return 0;
++
++ memcpy(key, adapter->rss_key, adapter->rss_key_size);
++
++ /* Each 32 bits pointed by 'indir' is stored with a lut entry */
++ for (i = 0; i < adapter->rss_lut_size; i++)
++ indir[i] = (u32)adapter->rss_lut[i];
++
++ return 0;
++}
++
++/**
++ * i40evf_set_rxfh - set the rx flow hash indirection table
++ * @netdev: network interface device structure
++ * @indir: indirection table
++ * @key: hash key
++ * @hfunc: hash function to use
++ *
++ * Returns -EINVAL if the table specifies an inavlid queue id, otherwise
++ * returns 0 after programming the table.
++ **/
++static int i40evf_set_rxfh(struct net_device *netdev, const u32 *indir,
++ const u8 *key, const u8 hfunc)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ u16 i;
++
++ /* We do not allow change in unsupported parameters */
++ if (key ||
++ (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP))
++ return -EOPNOTSUPP;
++ if (!indir)
++ return 0;
++
++ if (key) {
++ memcpy(adapter->rss_key, key, adapter->rss_key_size);
++ }
++
++ /* Each 32 bits pointed by 'indir' is stored with a lut entry */
++ for (i = 0; i < adapter->rss_lut_size; i++)
++ adapter->rss_lut[i] = (u8)(indir[i]);
++
++ return i40evf_config_rss(adapter);
++}
++
++static const struct ethtool_ops i40evf_ethtool_ops = {
++ .get_drvinfo = i40evf_get_drvinfo,
++ .get_link = ethtool_op_get_link,
++ .get_ringparam = i40evf_get_ringparam,
++ .set_ringparam = i40evf_set_ringparam,
++ .get_strings = i40evf_get_strings,
++ .get_ethtool_stats = i40evf_get_ethtool_stats,
++ .get_sset_count = i40evf_get_sset_count,
++ .get_priv_flags = i40evf_get_priv_flags,
++ .set_priv_flags = i40evf_set_priv_flags,
++ .get_msglevel = i40evf_get_msglevel,
++ .set_msglevel = i40evf_set_msglevel,
++ .get_coalesce = i40evf_get_coalesce,
++ .set_coalesce = i40evf_set_coalesce,
++ .get_per_queue_coalesce = i40evf_get_per_queue_coalesce,
++ .set_per_queue_coalesce = i40evf_set_per_queue_coalesce,
++ .get_rxnfc = i40evf_get_rxnfc,
++ .get_rxfh_indir_size = i40evf_get_rxfh_indir_size,
++ .get_rxfh = i40evf_get_rxfh,
++ .set_rxfh = i40evf_set_rxfh,
++ .get_channels = i40evf_get_channels,
++ .set_channels = i40evf_set_channels,
++ .get_rxfh_key_size = i40evf_get_rxfh_key_size,
++ .get_link_ksettings = i40evf_get_link_ksettings,
++};
++
++/**
++ * i40evf_set_ethtool_ops - Initialize ethtool ops struct
++ * @netdev: network interface device structure
++ *
++ * Sets ethtool ops struct in our netdev so that ethtool can call
++ * our functions.
++ **/
++void i40evf_set_ethtool_ops(struct net_device *netdev)
++{
++ netdev->ethtool_ops = &i40evf_ethtool_ops;
++}
+diff --git a/drivers/net/ethernet/intel/iavf/i40evf_main.c b/drivers/net/ethernet/intel/iavf/i40evf_main.c
+new file mode 100644
+index 0000000000000..60c2e5df58272
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40evf_main.c
+@@ -0,0 +1,3990 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#include "i40evf.h"
++#include "i40e_prototype.h"
++#include "i40evf_client.h"
++/* All i40evf tracepoints are defined by the include below, which must
++ * be included exactly once across the whole kernel with
++ * CREATE_TRACE_POINTS defined
++ */
++#define CREATE_TRACE_POINTS
++#include "i40e_trace.h"
++
++static int i40evf_setup_all_tx_resources(struct i40evf_adapter *adapter);
++static int i40evf_setup_all_rx_resources(struct i40evf_adapter *adapter);
++static int i40evf_close(struct net_device *netdev);
++
++char i40evf_driver_name[] = "i40evf";
++static const char i40evf_driver_string[] =
++ "Intel(R) Ethernet Adaptive Virtual Function Network Driver";
++
++#define DRV_KERN "-k"
++
++#define DRV_VERSION_MAJOR 3
++#define DRV_VERSION_MINOR 2
++#define DRV_VERSION_BUILD 3
++#define DRV_VERSION __stringify(DRV_VERSION_MAJOR) "." \
++ __stringify(DRV_VERSION_MINOR) "." \
++ __stringify(DRV_VERSION_BUILD) \
++ DRV_KERN
++const char i40evf_driver_version[] = DRV_VERSION;
++static const char i40evf_copyright[] =
++ "Copyright (c) 2013 - 2018 Intel Corporation.";
++
++/* i40evf_pci_tbl - PCI Device ID Table
++ *
++ * Wildcard entries (PCI_ANY_ID) should come last
++ * Last entry must be all 0s
++ *
++ * { Vendor ID, Device ID, SubVendor ID, SubDevice ID,
++ * Class, Class Mask, private data (not used) }
++ */
++static const struct pci_device_id i40evf_pci_tbl[] = {
++ {PCI_VDEVICE(INTEL, I40E_DEV_ID_VF), 0},
++ {PCI_VDEVICE(INTEL, I40E_DEV_ID_VF_HV), 0},
++ {PCI_VDEVICE(INTEL, I40E_DEV_ID_X722_VF), 0},
++ {PCI_VDEVICE(INTEL, I40E_DEV_ID_ADAPTIVE_VF), 0},
++ /* required last entry */
++ {0, }
++};
++
++MODULE_DEVICE_TABLE(pci, i40evf_pci_tbl);
++
++MODULE_ALIAS("i40evf");
++MODULE_AUTHOR("Intel Corporation, <linux.nics@intel.com>");
++MODULE_DESCRIPTION("Intel(R) XL710 X710 Virtual Function Network Driver");
++MODULE_LICENSE("GPL");
++MODULE_VERSION(DRV_VERSION);
++
++static struct workqueue_struct *i40evf_wq;
++
++/**
++ * i40evf_allocate_dma_mem_d - OS specific memory alloc for shared code
++ * @hw: pointer to the HW structure
++ * @mem: ptr to mem struct to fill out
++ * @size: size of memory requested
++ * @alignment: what to align the allocation to
++ **/
++i40e_status i40evf_allocate_dma_mem_d(struct i40e_hw *hw,
++ struct i40e_dma_mem *mem,
++ u64 size, u32 alignment)
++{
++ struct i40evf_adapter *adapter = (struct i40evf_adapter *)hw->back;
++
++ if (!mem)
++ return I40E_ERR_PARAM;
++
++ mem->size = ALIGN(size, alignment);
++ mem->va = dma_alloc_coherent(&adapter->pdev->dev, mem->size,
++ (dma_addr_t *)&mem->pa, GFP_KERNEL);
++ if (mem->va)
++ return 0;
++ else
++ return I40E_ERR_NO_MEMORY;
++}
++
++/**
++ * i40evf_free_dma_mem_d - OS specific memory free for shared code
++ * @hw: pointer to the HW structure
++ * @mem: ptr to mem struct to free
++ **/
++i40e_status i40evf_free_dma_mem_d(struct i40e_hw *hw, struct i40e_dma_mem *mem)
++{
++ struct i40evf_adapter *adapter = (struct i40evf_adapter *)hw->back;
++
++ if (!mem || !mem->va)
++ return I40E_ERR_PARAM;
++ dma_free_coherent(&adapter->pdev->dev, mem->size,
++ mem->va, (dma_addr_t)mem->pa);
++ return 0;
++}
++
++/**
++ * i40evf_allocate_virt_mem_d - OS specific memory alloc for shared code
++ * @hw: pointer to the HW structure
++ * @mem: ptr to mem struct to fill out
++ * @size: size of memory requested
++ **/
++i40e_status i40evf_allocate_virt_mem_d(struct i40e_hw *hw,
++ struct i40e_virt_mem *mem, u32 size)
++{
++ if (!mem)
++ return I40E_ERR_PARAM;
++
++ mem->size = size;
++ mem->va = kzalloc(size, GFP_KERNEL);
++
++ if (mem->va)
++ return 0;
++ else
++ return I40E_ERR_NO_MEMORY;
++}
++
++/**
++ * i40evf_free_virt_mem_d - OS specific memory free for shared code
++ * @hw: pointer to the HW structure
++ * @mem: ptr to mem struct to free
++ **/
++i40e_status i40evf_free_virt_mem_d(struct i40e_hw *hw,
++ struct i40e_virt_mem *mem)
++{
++ if (!mem)
++ return I40E_ERR_PARAM;
++
++ /* it's ok to kfree a NULL pointer */
++ kfree(mem->va);
++
++ return 0;
++}
++
++/**
++ * i40evf_debug_d - OS dependent version of debug printing
++ * @hw: pointer to the HW structure
++ * @mask: debug level mask
++ * @fmt_str: printf-type format description
++ **/
++void i40evf_debug_d(void *hw, u32 mask, char *fmt_str, ...)
++{
++ char buf[512];
++ va_list argptr;
++
++ if (!(mask & ((struct i40e_hw *)hw)->debug_mask))
++ return;
++
++ va_start(argptr, fmt_str);
++ vsnprintf(buf, sizeof(buf), fmt_str, argptr);
++ va_end(argptr);
++
++ /* the debug string is already formatted with a newline */
++ pr_info("%s", buf);
++}
++
++/**
++ * i40evf_schedule_reset - Set the flags and schedule a reset event
++ * @adapter: board private structure
++ **/
++void i40evf_schedule_reset(struct i40evf_adapter *adapter)
++{
++ if (!(adapter->flags &
++ (I40EVF_FLAG_RESET_PENDING | I40EVF_FLAG_RESET_NEEDED))) {
++ adapter->flags |= I40EVF_FLAG_RESET_NEEDED;
++ schedule_work(&adapter->reset_task);
++ }
++}
++
++/**
++ * i40evf_tx_timeout - Respond to a Tx Hang
++ * @netdev: network interface device structure
++ **/
++static void i40evf_tx_timeout(struct net_device *netdev)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ adapter->tx_timeout_count++;
++ i40evf_schedule_reset(adapter);
++}
++
++/**
++ * i40evf_misc_irq_disable - Mask off interrupt generation on the NIC
++ * @adapter: board private structure
++ **/
++static void i40evf_misc_irq_disable(struct i40evf_adapter *adapter)
++{
++ struct i40e_hw *hw = &adapter->hw;
++
++ if (!adapter->msix_entries)
++ return;
++
++ wr32(hw, I40E_VFINT_DYN_CTL01, 0);
++
++ /* read flush */
++ rd32(hw, I40E_VFGEN_RSTAT);
++
++ synchronize_irq(adapter->msix_entries[0].vector);
++}
++
++/**
++ * i40evf_misc_irq_enable - Enable default interrupt generation settings
++ * @adapter: board private structure
++ **/
++static void i40evf_misc_irq_enable(struct i40evf_adapter *adapter)
++{
++ struct i40e_hw *hw = &adapter->hw;
++
++ wr32(hw, I40E_VFINT_DYN_CTL01, I40E_VFINT_DYN_CTL01_INTENA_MASK |
++ I40E_VFINT_DYN_CTL01_ITR_INDX_MASK);
++ wr32(hw, I40E_VFINT_ICR0_ENA1, I40E_VFINT_ICR0_ENA1_ADMINQ_MASK);
++
++ /* read flush */
++ rd32(hw, I40E_VFGEN_RSTAT);
++}
++
++/**
++ * i40evf_irq_disable - Mask off interrupt generation on the NIC
++ * @adapter: board private structure
++ **/
++static void i40evf_irq_disable(struct i40evf_adapter *adapter)
++{
++ int i;
++ struct i40e_hw *hw = &adapter->hw;
++
++ if (!adapter->msix_entries)
++ return;
++
++ for (i = 1; i < adapter->num_msix_vectors; i++) {
++ wr32(hw, I40E_VFINT_DYN_CTLN1(i - 1), 0);
++ synchronize_irq(adapter->msix_entries[i].vector);
++ }
++ /* read flush */
++ rd32(hw, I40E_VFGEN_RSTAT);
++}
++
++/**
++ * i40evf_irq_enable_queues - Enable interrupt for specified queues
++ * @adapter: board private structure
++ * @mask: bitmap of queues to enable
++ **/
++void i40evf_irq_enable_queues(struct i40evf_adapter *adapter, u32 mask)
++{
++ struct i40e_hw *hw = &adapter->hw;
++ int i;
++
++ for (i = 1; i < adapter->num_msix_vectors; i++) {
++ if (mask & BIT(i - 1)) {
++ wr32(hw, I40E_VFINT_DYN_CTLN1(i - 1),
++ I40E_VFINT_DYN_CTLN1_INTENA_MASK |
++ I40E_VFINT_DYN_CTLN1_ITR_INDX_MASK);
++ }
++ }
++}
++
++/**
++ * i40evf_irq_enable - Enable default interrupt generation settings
++ * @adapter: board private structure
++ * @flush: boolean value whether to run rd32()
++ **/
++void i40evf_irq_enable(struct i40evf_adapter *adapter, bool flush)
++{
++ struct i40e_hw *hw = &adapter->hw;
++
++ i40evf_misc_irq_enable(adapter);
++ i40evf_irq_enable_queues(adapter, ~0);
++
++ if (flush)
++ rd32(hw, I40E_VFGEN_RSTAT);
++}
++
++/**
++ * i40evf_msix_aq - Interrupt handler for vector 0
++ * @irq: interrupt number
++ * @data: pointer to netdev
++ **/
++static irqreturn_t i40evf_msix_aq(int irq, void *data)
++{
++ struct net_device *netdev = data;
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ struct i40e_hw *hw = &adapter->hw;
++
++ /* handle non-queue interrupts, these reads clear the registers */
++ rd32(hw, I40E_VFINT_ICR01);
++ rd32(hw, I40E_VFINT_ICR0_ENA1);
++
++ /* schedule work on the private workqueue */
++ schedule_work(&adapter->adminq_task);
++
++ return IRQ_HANDLED;
++}
++
++/**
++ * i40evf_msix_clean_rings - MSIX mode Interrupt Handler
++ * @irq: interrupt number
++ * @data: pointer to a q_vector
++ **/
++static irqreturn_t i40evf_msix_clean_rings(int irq, void *data)
++{
++ struct i40e_q_vector *q_vector = data;
++
++ if (!q_vector->tx.ring && !q_vector->rx.ring)
++ return IRQ_HANDLED;
++
++ napi_schedule_irqoff(&q_vector->napi);
++
++ return IRQ_HANDLED;
++}
++
++/**
++ * i40evf_map_vector_to_rxq - associate irqs with rx queues
++ * @adapter: board private structure
++ * @v_idx: interrupt number
++ * @r_idx: queue number
++ **/
++static void
++i40evf_map_vector_to_rxq(struct i40evf_adapter *adapter, int v_idx, int r_idx)
++{
++ struct i40e_q_vector *q_vector = &adapter->q_vectors[v_idx];
++ struct i40e_ring *rx_ring = &adapter->rx_rings[r_idx];
++ struct i40e_hw *hw = &adapter->hw;
++
++ rx_ring->q_vector = q_vector;
++ rx_ring->next = q_vector->rx.ring;
++ rx_ring->vsi = &adapter->vsi;
++ q_vector->rx.ring = rx_ring;
++ q_vector->rx.count++;
++ q_vector->rx.next_update = jiffies + 1;
++ q_vector->rx.target_itr = ITR_TO_REG(rx_ring->itr_setting);
++ q_vector->ring_mask |= BIT(r_idx);
++ wr32(hw, I40E_VFINT_ITRN1(I40E_RX_ITR, q_vector->reg_idx),
++ q_vector->rx.current_itr);
++ q_vector->rx.current_itr = q_vector->rx.target_itr;
++}
++
++/**
++ * i40evf_map_vector_to_txq - associate irqs with tx queues
++ * @adapter: board private structure
++ * @v_idx: interrupt number
++ * @t_idx: queue number
++ **/
++static void
++i40evf_map_vector_to_txq(struct i40evf_adapter *adapter, int v_idx, int t_idx)
++{
++ struct i40e_q_vector *q_vector = &adapter->q_vectors[v_idx];
++ struct i40e_ring *tx_ring = &adapter->tx_rings[t_idx];
++ struct i40e_hw *hw = &adapter->hw;
++
++ tx_ring->q_vector = q_vector;
++ tx_ring->next = q_vector->tx.ring;
++ tx_ring->vsi = &adapter->vsi;
++ q_vector->tx.ring = tx_ring;
++ q_vector->tx.count++;
++ q_vector->tx.next_update = jiffies + 1;
++ q_vector->tx.target_itr = ITR_TO_REG(tx_ring->itr_setting);
++ q_vector->num_ringpairs++;
++ wr32(hw, I40E_VFINT_ITRN1(I40E_TX_ITR, q_vector->reg_idx),
++ q_vector->tx.target_itr);
++ q_vector->tx.current_itr = q_vector->tx.target_itr;
++}
++
++/**
++ * i40evf_map_rings_to_vectors - Maps descriptor rings to vectors
++ * @adapter: board private structure to initialize
++ *
++ * This function maps descriptor rings to the queue-specific vectors
++ * we were allotted through the MSI-X enabling code. Ideally, we'd have
++ * one vector per ring/queue, but on a constrained vector budget, we
++ * group the rings as "efficiently" as possible. You would add new
++ * mapping configurations in here.
++ **/
++static void i40evf_map_rings_to_vectors(struct i40evf_adapter *adapter)
++{
++ int rings_remaining = adapter->num_active_queues;
++ int ridx = 0, vidx = 0;
++ int q_vectors;
++
++ q_vectors = adapter->num_msix_vectors - NONQ_VECS;
++
++ for (; ridx < rings_remaining; ridx++) {
++ i40evf_map_vector_to_rxq(adapter, vidx, ridx);
++ i40evf_map_vector_to_txq(adapter, vidx, ridx);
++
++ /* In the case where we have more queues than vectors, continue
++ * round-robin on vectors until all queues are mapped.
++ */
++ if (++vidx >= q_vectors)
++ vidx = 0;
++ }
++
++ adapter->aq_required |= I40EVF_FLAG_AQ_MAP_VECTORS;
++}
++
++/**
++ * i40evf_irq_affinity_notify - Callback for affinity changes
++ * @notify: context as to what irq was changed
++ * @mask: the new affinity mask
++ *
++ * This is a callback function used by the irq_set_affinity_notifier function
++ * so that we may register to receive changes to the irq affinity masks.
++ **/
++static void i40evf_irq_affinity_notify(struct irq_affinity_notify *notify,
++ const cpumask_t *mask)
++{
++ struct i40e_q_vector *q_vector =
++ container_of(notify, struct i40e_q_vector, affinity_notify);
++
++ cpumask_copy(&q_vector->affinity_mask, mask);
++}
++
++/**
++ * i40evf_irq_affinity_release - Callback for affinity notifier release
++ * @ref: internal core kernel usage
++ *
++ * This is a callback function used by the irq_set_affinity_notifier function
++ * to inform the current notification subscriber that they will no longer
++ * receive notifications.
++ **/
++static void i40evf_irq_affinity_release(struct kref *ref) {}
++
++/**
++ * i40evf_request_traffic_irqs - Initialize MSI-X interrupts
++ * @adapter: board private structure
++ * @basename: device basename
++ *
++ * Allocates MSI-X vectors for tx and rx handling, and requests
++ * interrupts from the kernel.
++ **/
++static int
++i40evf_request_traffic_irqs(struct i40evf_adapter *adapter, char *basename)
++{
++ unsigned int vector, q_vectors;
++ unsigned int rx_int_idx = 0, tx_int_idx = 0;
++ int irq_num, err;
++ int cpu;
++
++ i40evf_irq_disable(adapter);
++ /* Decrement for Other and TCP Timer vectors */
++ q_vectors = adapter->num_msix_vectors - NONQ_VECS;
++
++ for (vector = 0; vector < q_vectors; vector++) {
++ struct i40e_q_vector *q_vector = &adapter->q_vectors[vector];
++ irq_num = adapter->msix_entries[vector + NONQ_VECS].vector;
++
++ if (q_vector->tx.ring && q_vector->rx.ring) {
++ snprintf(q_vector->name, sizeof(q_vector->name),
++ "i40evf-%s-TxRx-%d", basename, rx_int_idx++);
++ tx_int_idx++;
++ } else if (q_vector->rx.ring) {
++ snprintf(q_vector->name, sizeof(q_vector->name),
++ "i40evf-%s-rx-%d", basename, rx_int_idx++);
++ } else if (q_vector->tx.ring) {
++ snprintf(q_vector->name, sizeof(q_vector->name),
++ "i40evf-%s-tx-%d", basename, tx_int_idx++);
++ } else {
++ /* skip this unused q_vector */
++ continue;
++ }
++ err = request_irq(irq_num,
++ i40evf_msix_clean_rings,
++ 0,
++ q_vector->name,
++ q_vector);
++ if (err) {
++ dev_info(&adapter->pdev->dev,
++ "Request_irq failed, error: %d\n", err);
++ goto free_queue_irqs;
++ }
++ /* register for affinity change notifications */
++ q_vector->affinity_notify.notify = i40evf_irq_affinity_notify;
++ q_vector->affinity_notify.release =
++ i40evf_irq_affinity_release;
++ irq_set_affinity_notifier(irq_num, &q_vector->affinity_notify);
++ /* Spread the IRQ affinity hints across online CPUs. Note that
++ * get_cpu_mask returns a mask with a permanent lifetime so
++ * it's safe to use as a hint for irq_set_affinity_hint.
++ */
++ cpu = cpumask_local_spread(q_vector->v_idx, -1);
++ irq_set_affinity_hint(irq_num, get_cpu_mask(cpu));
++ }
++
++ return 0;
++
++free_queue_irqs:
++ while (vector) {
++ vector--;
++ irq_num = adapter->msix_entries[vector + NONQ_VECS].vector;
++ irq_set_affinity_notifier(irq_num, NULL);
++ irq_set_affinity_hint(irq_num, NULL);
++ free_irq(irq_num, &adapter->q_vectors[vector]);
++ }
++ return err;
++}
++
++/**
++ * i40evf_request_misc_irq - Initialize MSI-X interrupts
++ * @adapter: board private structure
++ *
++ * Allocates MSI-X vector 0 and requests interrupts from the kernel. This
++ * vector is only for the admin queue, and stays active even when the netdev
++ * is closed.
++ **/
++static int i40evf_request_misc_irq(struct i40evf_adapter *adapter)
++{
++ struct net_device *netdev = adapter->netdev;
++ int err;
++
++ snprintf(adapter->misc_vector_name,
++ sizeof(adapter->misc_vector_name) - 1, "i40evf-%s:mbx",
++ dev_name(&adapter->pdev->dev));
++ err = request_irq(adapter->msix_entries[0].vector,
++ &i40evf_msix_aq, 0,
++ adapter->misc_vector_name, netdev);
++ if (err) {
++ dev_err(&adapter->pdev->dev,
++ "request_irq for %s failed: %d\n",
++ adapter->misc_vector_name, err);
++ free_irq(adapter->msix_entries[0].vector, netdev);
++ }
++ return err;
++}
++
++/**
++ * i40evf_free_traffic_irqs - Free MSI-X interrupts
++ * @adapter: board private structure
++ *
++ * Frees all MSI-X vectors other than 0.
++ **/
++static void i40evf_free_traffic_irqs(struct i40evf_adapter *adapter)
++{
++ int vector, irq_num, q_vectors;
++
++ if (!adapter->msix_entries)
++ return;
++
++ q_vectors = adapter->num_msix_vectors - NONQ_VECS;
++
++ for (vector = 0; vector < q_vectors; vector++) {
++ irq_num = adapter->msix_entries[vector + NONQ_VECS].vector;
++ irq_set_affinity_notifier(irq_num, NULL);
++ irq_set_affinity_hint(irq_num, NULL);
++ free_irq(irq_num, &adapter->q_vectors[vector]);
++ }
++}
++
++/**
++ * i40evf_free_misc_irq - Free MSI-X miscellaneous vector
++ * @adapter: board private structure
++ *
++ * Frees MSI-X vector 0.
++ **/
++static void i40evf_free_misc_irq(struct i40evf_adapter *adapter)
++{
++ struct net_device *netdev = adapter->netdev;
++
++ if (!adapter->msix_entries)
++ return;
++
++ free_irq(adapter->msix_entries[0].vector, netdev);
++}
++
++/**
++ * i40evf_configure_tx - Configure Transmit Unit after Reset
++ * @adapter: board private structure
++ *
++ * Configure the Tx unit of the MAC after a reset.
++ **/
++static void i40evf_configure_tx(struct i40evf_adapter *adapter)
++{
++ struct i40e_hw *hw = &adapter->hw;
++ int i;
++
++ for (i = 0; i < adapter->num_active_queues; i++)
++ adapter->tx_rings[i].tail = hw->hw_addr + I40E_QTX_TAIL1(i);
++}
++
++/**
++ * i40evf_configure_rx - Configure Receive Unit after Reset
++ * @adapter: board private structure
++ *
++ * Configure the Rx unit of the MAC after a reset.
++ **/
++static void i40evf_configure_rx(struct i40evf_adapter *adapter)
++{
++ unsigned int rx_buf_len = I40E_RXBUFFER_2048;
++ struct i40e_hw *hw = &adapter->hw;
++ int i;
++
++ /* Legacy Rx will always default to a 2048 buffer size. */
++#if (PAGE_SIZE < 8192)
++ if (!(adapter->flags & I40EVF_FLAG_LEGACY_RX)) {
++ struct net_device *netdev = adapter->netdev;
++
++ /* For jumbo frames on systems with 4K pages we have to use
++ * an order 1 page, so we might as well increase the size
++ * of our Rx buffer to make better use of the available space
++ */
++ rx_buf_len = I40E_RXBUFFER_3072;
++
++ /* We use a 1536 buffer size for configurations with
++ * standard Ethernet mtu. On x86 this gives us enough room
++ * for shared info and 192 bytes of padding.
++ */
++ if (!I40E_2K_TOO_SMALL_WITH_PADDING &&
++ (netdev->mtu <= ETH_DATA_LEN))
++ rx_buf_len = I40E_RXBUFFER_1536 - NET_IP_ALIGN;
++ }
++#endif
++
++ for (i = 0; i < adapter->num_active_queues; i++) {
++ adapter->rx_rings[i].tail = hw->hw_addr + I40E_QRX_TAIL1(i);
++ adapter->rx_rings[i].rx_buf_len = rx_buf_len;
++
++ if (adapter->flags & I40EVF_FLAG_LEGACY_RX)
++ clear_ring_build_skb_enabled(&adapter->rx_rings[i]);
++ else
++ set_ring_build_skb_enabled(&adapter->rx_rings[i]);
++ }
++}
++
++/**
++ * i40evf_find_vlan - Search filter list for specific vlan filter
++ * @adapter: board private structure
++ * @vlan: vlan tag
++ *
++ * Returns ptr to the filter object or NULL. Must be called while holding the
++ * mac_vlan_list_lock.
++ **/
++static struct
++i40evf_vlan_filter *i40evf_find_vlan(struct i40evf_adapter *adapter, u16 vlan)
++{
++ struct i40evf_vlan_filter *f;
++
++ list_for_each_entry(f, &adapter->vlan_filter_list, list) {
++ if (vlan == f->vlan)
++ return f;
++ }
++ return NULL;
++}
++
++/**
++ * i40evf_add_vlan - Add a vlan filter to the list
++ * @adapter: board private structure
++ * @vlan: VLAN tag
++ *
++ * Returns ptr to the filter object or NULL when no memory available.
++ **/
++static struct
++i40evf_vlan_filter *i40evf_add_vlan(struct i40evf_adapter *adapter, u16 vlan)
++{
++ struct i40evf_vlan_filter *f = NULL;
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++
++ f = i40evf_find_vlan(adapter, vlan);
++ if (!f) {
++ f = kzalloc(sizeof(*f), GFP_KERNEL);
++ if (!f)
++ goto clearout;
++
++ f->vlan = vlan;
++
++ INIT_LIST_HEAD(&f->list);
++ list_add(&f->list, &adapter->vlan_filter_list);
++ f->add = true;
++ adapter->aq_required |= I40EVF_FLAG_AQ_ADD_VLAN_FILTER;
++ }
++
++clearout:
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++ return f;
++}
++
++/**
++ * i40evf_del_vlan - Remove a vlan filter from the list
++ * @adapter: board private structure
++ * @vlan: VLAN tag
++ **/
++static void i40evf_del_vlan(struct i40evf_adapter *adapter, u16 vlan)
++{
++ struct i40evf_vlan_filter *f;
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++
++ f = i40evf_find_vlan(adapter, vlan);
++ if (f) {
++ f->remove = true;
++ adapter->aq_required |= I40EVF_FLAG_AQ_DEL_VLAN_FILTER;
++ }
++
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++}
++
++/**
++ * i40evf_vlan_rx_add_vid - Add a VLAN filter to a device
++ * @netdev: network device struct
++ * @proto: unused protocol data
++ * @vid: VLAN tag
++ **/
++static int i40evf_vlan_rx_add_vid(struct net_device *netdev,
++ __always_unused __be16 proto, u16 vid)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ if (!VLAN_ALLOWED(adapter))
++ return -EIO;
++ if (i40evf_add_vlan(adapter, vid) == NULL)
++ return -ENOMEM;
++ return 0;
++}
++
++/**
++ * i40evf_vlan_rx_kill_vid - Remove a VLAN filter from a device
++ * @netdev: network device struct
++ * @proto: unused protocol data
++ * @vid: VLAN tag
++ **/
++static int i40evf_vlan_rx_kill_vid(struct net_device *netdev,
++ __always_unused __be16 proto, u16 vid)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ if (VLAN_ALLOWED(adapter)) {
++ i40evf_del_vlan(adapter, vid);
++ return 0;
++ }
++ return -EIO;
++}
++
++/**
++ * i40evf_find_filter - Search filter list for specific mac filter
++ * @adapter: board private structure
++ * @macaddr: the MAC address
++ *
++ * Returns ptr to the filter object or NULL. Must be called while holding the
++ * mac_vlan_list_lock.
++ **/
++static struct
++i40evf_mac_filter *i40evf_find_filter(struct i40evf_adapter *adapter,
++ const u8 *macaddr)
++{
++ struct i40evf_mac_filter *f;
++
++ if (!macaddr)
++ return NULL;
++
++ list_for_each_entry(f, &adapter->mac_filter_list, list) {
++ if (ether_addr_equal(macaddr, f->macaddr))
++ return f;
++ }
++ return NULL;
++}
++
++/**
++ * i40e_add_filter - Add a mac filter to the filter list
++ * @adapter: board private structure
++ * @macaddr: the MAC address
++ *
++ * Returns ptr to the filter object or NULL when no memory available.
++ **/
++static struct
++i40evf_mac_filter *i40evf_add_filter(struct i40evf_adapter *adapter,
++ const u8 *macaddr)
++{
++ struct i40evf_mac_filter *f;
++
++ if (!macaddr)
++ return NULL;
++
++ f = i40evf_find_filter(adapter, macaddr);
++ if (!f) {
++ f = kzalloc(sizeof(*f), GFP_ATOMIC);
++ if (!f)
++ return f;
++
++ ether_addr_copy(f->macaddr, macaddr);
++
++ list_add_tail(&f->list, &adapter->mac_filter_list);
++ f->add = true;
++ adapter->aq_required |= I40EVF_FLAG_AQ_ADD_MAC_FILTER;
++ } else {
++ f->remove = false;
++ }
++
++ return f;
++}
++
++/**
++ * i40evf_set_mac - NDO callback to set port mac address
++ * @netdev: network interface device structure
++ * @p: pointer to an address structure
++ *
++ * Returns 0 on success, negative on failure
++ **/
++static int i40evf_set_mac(struct net_device *netdev, void *p)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ struct i40e_hw *hw = &adapter->hw;
++ struct i40evf_mac_filter *f;
++ struct sockaddr *addr = p;
++
++ if (!is_valid_ether_addr(addr->sa_data))
++ return -EADDRNOTAVAIL;
++
++ if (ether_addr_equal(netdev->dev_addr, addr->sa_data))
++ return 0;
++
++ if (adapter->flags & I40EVF_FLAG_ADDR_SET_BY_PF)
++ return -EPERM;
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++
++ f = i40evf_find_filter(adapter, hw->mac.addr);
++ if (f) {
++ f->remove = true;
++ adapter->aq_required |= I40EVF_FLAG_AQ_DEL_MAC_FILTER;
++ }
++
++ f = i40evf_add_filter(adapter, addr->sa_data);
++
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++
++ if (f) {
++ ether_addr_copy(hw->mac.addr, addr->sa_data);
++ ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr);
++ }
++
++ return (f == NULL) ? -ENOMEM : 0;
++}
++
++/**
++ * i40evf_addr_sync - Callback for dev_(mc|uc)_sync to add address
++ * @netdev: the netdevice
++ * @addr: address to add
++ *
++ * Called by __dev_(mc|uc)_sync when an address needs to be added. We call
++ * __dev_(uc|mc)_sync from .set_rx_mode and guarantee to hold the hash lock.
++ */
++static int i40evf_addr_sync(struct net_device *netdev, const u8 *addr)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ if (i40evf_add_filter(adapter, addr))
++ return 0;
++ else
++ return -ENOMEM;
++}
++
++/**
++ * i40evf_addr_unsync - Callback for dev_(mc|uc)_sync to remove address
++ * @netdev: the netdevice
++ * @addr: address to add
++ *
++ * Called by __dev_(mc|uc)_sync when an address needs to be removed. We call
++ * __dev_(uc|mc)_sync from .set_rx_mode and guarantee to hold the hash lock.
++ */
++static int i40evf_addr_unsync(struct net_device *netdev, const u8 *addr)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ struct i40evf_mac_filter *f;
++
++ /* Under some circumstances, we might receive a request to delete
++ * our own device address from our uc list. Because we store the
++ * device address in the VSI's MAC/VLAN filter list, we need to ignore
++ * such requests and not delete our device address from this list.
++ */
++ if (ether_addr_equal(addr, netdev->dev_addr))
++ return 0;
++
++ f = i40evf_find_filter(adapter, addr);
++ if (f) {
++ f->remove = true;
++ adapter->aq_required |= I40EVF_FLAG_AQ_DEL_MAC_FILTER;
++ }
++ return 0;
++}
++
++/**
++ * i40evf_set_rx_mode - NDO callback to set the netdev filters
++ * @netdev: network interface device structure
++ **/
++static void i40evf_set_rx_mode(struct net_device *netdev)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++ __dev_uc_sync(netdev, i40evf_addr_sync, i40evf_addr_unsync);
++ __dev_mc_sync(netdev, i40evf_addr_sync, i40evf_addr_unsync);
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++
++ if (netdev->flags & IFF_PROMISC &&
++ !(adapter->flags & I40EVF_FLAG_PROMISC_ON))
++ adapter->aq_required |= I40EVF_FLAG_AQ_REQUEST_PROMISC;
++ else if (!(netdev->flags & IFF_PROMISC) &&
++ adapter->flags & I40EVF_FLAG_PROMISC_ON)
++ adapter->aq_required |= I40EVF_FLAG_AQ_RELEASE_PROMISC;
++
++ if (netdev->flags & IFF_ALLMULTI &&
++ !(adapter->flags & I40EVF_FLAG_ALLMULTI_ON))
++ adapter->aq_required |= I40EVF_FLAG_AQ_REQUEST_ALLMULTI;
++ else if (!(netdev->flags & IFF_ALLMULTI) &&
++ adapter->flags & I40EVF_FLAG_ALLMULTI_ON)
++ adapter->aq_required |= I40EVF_FLAG_AQ_RELEASE_ALLMULTI;
++}
++
++/**
++ * i40evf_napi_enable_all - enable NAPI on all queue vectors
++ * @adapter: board private structure
++ **/
++static void i40evf_napi_enable_all(struct i40evf_adapter *adapter)
++{
++ int q_idx;
++ struct i40e_q_vector *q_vector;
++ int q_vectors = adapter->num_msix_vectors - NONQ_VECS;
++
++ for (q_idx = 0; q_idx < q_vectors; q_idx++) {
++ struct napi_struct *napi;
++
++ q_vector = &adapter->q_vectors[q_idx];
++ napi = &q_vector->napi;
++ napi_enable(napi);
++ }
++}
++
++/**
++ * i40evf_napi_disable_all - disable NAPI on all queue vectors
++ * @adapter: board private structure
++ **/
++static void i40evf_napi_disable_all(struct i40evf_adapter *adapter)
++{
++ int q_idx;
++ struct i40e_q_vector *q_vector;
++ int q_vectors = adapter->num_msix_vectors - NONQ_VECS;
++
++ for (q_idx = 0; q_idx < q_vectors; q_idx++) {
++ q_vector = &adapter->q_vectors[q_idx];
++ napi_disable(&q_vector->napi);
++ }
++}
++
++/**
++ * i40evf_configure - set up transmit and receive data structures
++ * @adapter: board private structure
++ **/
++static void i40evf_configure(struct i40evf_adapter *adapter)
++{
++ struct net_device *netdev = adapter->netdev;
++ int i;
++
++ i40evf_set_rx_mode(netdev);
++
++ i40evf_configure_tx(adapter);
++ i40evf_configure_rx(adapter);
++ adapter->aq_required |= I40EVF_FLAG_AQ_CONFIGURE_QUEUES;
++
++ for (i = 0; i < adapter->num_active_queues; i++) {
++ struct i40e_ring *ring = &adapter->rx_rings[i];
++
++ i40evf_alloc_rx_buffers(ring, I40E_DESC_UNUSED(ring));
++ }
++}
++
++/**
++ * i40evf_up_complete - Finish the last steps of bringing up a connection
++ * @adapter: board private structure
++ *
++ * Expects to be called while holding the __I40EVF_IN_CRITICAL_TASK bit lock.
++ **/
++static void i40evf_up_complete(struct i40evf_adapter *adapter)
++{
++ adapter->state = __I40EVF_RUNNING;
++ clear_bit(__I40E_VSI_DOWN, adapter->vsi.state);
++
++ i40evf_napi_enable_all(adapter);
++
++ adapter->aq_required |= I40EVF_FLAG_AQ_ENABLE_QUEUES;
++ if (CLIENT_ENABLED(adapter))
++ adapter->flags |= I40EVF_FLAG_CLIENT_NEEDS_OPEN;
++ mod_timer_pending(&adapter->watchdog_timer, jiffies + 1);
++}
++
++/**
++ * i40e_down - Shutdown the connection processing
++ * @adapter: board private structure
++ *
++ * Expects to be called while holding the __I40EVF_IN_CRITICAL_TASK bit lock.
++ **/
++void i40evf_down(struct i40evf_adapter *adapter)
++{
++ struct net_device *netdev = adapter->netdev;
++ struct i40evf_vlan_filter *vlf;
++ struct i40evf_mac_filter *f;
++ struct i40evf_cloud_filter *cf;
++
++ if (adapter->state <= __I40EVF_DOWN_PENDING)
++ return;
++
++ netif_carrier_off(netdev);
++ netif_tx_disable(netdev);
++ adapter->link_up = false;
++ i40evf_napi_disable_all(adapter);
++ i40evf_irq_disable(adapter);
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++
++ /* clear the sync flag on all filters */
++ __dev_uc_unsync(adapter->netdev, NULL);
++ __dev_mc_unsync(adapter->netdev, NULL);
++
++ /* remove all MAC filters */
++ list_for_each_entry(f, &adapter->mac_filter_list, list) {
++ f->remove = true;
++ }
++
++ /* remove all VLAN filters */
++ list_for_each_entry(vlf, &adapter->vlan_filter_list, list) {
++ vlf->remove = true;
++ }
++
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++
++ /* remove all cloud filters */
++ spin_lock_bh(&adapter->cloud_filter_list_lock);
++ list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
++ cf->del = true;
++ }
++ spin_unlock_bh(&adapter->cloud_filter_list_lock);
++
++ if (!(adapter->flags & I40EVF_FLAG_PF_COMMS_FAILED) &&
++ adapter->state != __I40EVF_RESETTING) {
++ /* cancel any current operation */
++ adapter->current_op = VIRTCHNL_OP_UNKNOWN;
++ /* Schedule operations to close down the HW. Don't wait
++ * here for this to complete. The watchdog is still running
++ * and it will take care of this.
++ */
++ adapter->aq_required = I40EVF_FLAG_AQ_DEL_MAC_FILTER;
++ adapter->aq_required |= I40EVF_FLAG_AQ_DEL_VLAN_FILTER;
++ adapter->aq_required |= I40EVF_FLAG_AQ_DEL_CLOUD_FILTER;
++ adapter->aq_required |= I40EVF_FLAG_AQ_DISABLE_QUEUES;
++ }
++
++ mod_timer_pending(&adapter->watchdog_timer, jiffies + 1);
++}
++
++/**
++ * i40evf_acquire_msix_vectors - Setup the MSIX capability
++ * @adapter: board private structure
++ * @vectors: number of vectors to request
++ *
++ * Work with the OS to set up the MSIX vectors needed.
++ *
++ * Returns 0 on success, negative on failure
++ **/
++static int
++i40evf_acquire_msix_vectors(struct i40evf_adapter *adapter, int vectors)
++{
++ int err, vector_threshold;
++
++ /* We'll want at least 3 (vector_threshold):
++ * 0) Other (Admin Queue and link, mostly)
++ * 1) TxQ[0] Cleanup
++ * 2) RxQ[0] Cleanup
++ */
++ vector_threshold = MIN_MSIX_COUNT;
++
++ /* The more we get, the more we will assign to Tx/Rx Cleanup
++ * for the separate queues...where Rx Cleanup >= Tx Cleanup.
++ * Right now, we simply care about how many we'll get; we'll
++ * set them up later while requesting irq's.
++ */
++ err = pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
++ vector_threshold, vectors);
++ if (err < 0) {
++ dev_err(&adapter->pdev->dev, "Unable to allocate MSI-X interrupts\n");
++ kfree(adapter->msix_entries);
++ adapter->msix_entries = NULL;
++ return err;
++ }
++
++ /* Adjust for only the vectors we'll use, which is minimum
++ * of max_msix_q_vectors + NONQ_VECS, or the number of
++ * vectors we were allocated.
++ */
++ adapter->num_msix_vectors = err;
++ return 0;
++}
++
++/**
++ * i40evf_free_queues - Free memory for all rings
++ * @adapter: board private structure to initialize
++ *
++ * Free all of the memory associated with queue pairs.
++ **/
++static void i40evf_free_queues(struct i40evf_adapter *adapter)
++{
++ if (!adapter->vsi_res)
++ return;
++ adapter->num_active_queues = 0;
++ kfree(adapter->tx_rings);
++ adapter->tx_rings = NULL;
++ kfree(adapter->rx_rings);
++ adapter->rx_rings = NULL;
++}
++
++/**
++ * i40evf_alloc_queues - Allocate memory for all rings
++ * @adapter: board private structure to initialize
++ *
++ * We allocate one ring per queue at run-time since we don't know the
++ * number of queues at compile-time. The polling_netdev array is
++ * intended for Multiqueue, but should work fine with a single queue.
++ **/
++static int i40evf_alloc_queues(struct i40evf_adapter *adapter)
++{
++ int i, num_active_queues;
++
++ /* If we're in reset reallocating queues we don't actually know yet for
++ * certain the PF gave us the number of queues we asked for but we'll
++ * assume it did. Once basic reset is finished we'll confirm once we
++ * start negotiating config with PF.
++ */
++ if (adapter->num_req_queues)
++ num_active_queues = adapter->num_req_queues;
++ else if ((adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
++ adapter->num_tc)
++ num_active_queues = adapter->ch_config.total_qps;
++ else
++ num_active_queues = min_t(int,
++ adapter->vsi_res->num_queue_pairs,
++ (int)(num_online_cpus()));
++
++
++ adapter->tx_rings = kcalloc(num_active_queues,
++ sizeof(struct i40e_ring), GFP_KERNEL);
++ if (!adapter->tx_rings)
++ goto err_out;
++ adapter->rx_rings = kcalloc(num_active_queues,
++ sizeof(struct i40e_ring), GFP_KERNEL);
++ if (!adapter->rx_rings)
++ goto err_out;
++
++ for (i = 0; i < num_active_queues; i++) {
++ struct i40e_ring *tx_ring;
++ struct i40e_ring *rx_ring;
++
++ tx_ring = &adapter->tx_rings[i];
++
++ tx_ring->queue_index = i;
++ tx_ring->netdev = adapter->netdev;
++ tx_ring->dev = &adapter->pdev->dev;
++ tx_ring->count = adapter->tx_desc_count;
++ tx_ring->itr_setting = I40E_ITR_TX_DEF;
++ if (adapter->flags & I40EVF_FLAG_WB_ON_ITR_CAPABLE)
++ tx_ring->flags |= I40E_TXR_FLAGS_WB_ON_ITR;
++
++ rx_ring = &adapter->rx_rings[i];
++ rx_ring->queue_index = i;
++ rx_ring->netdev = adapter->netdev;
++ rx_ring->dev = &adapter->pdev->dev;
++ rx_ring->count = adapter->rx_desc_count;
++ rx_ring->itr_setting = I40E_ITR_RX_DEF;
++ }
++
++ adapter->num_active_queues = num_active_queues;
++
++ return 0;
++
++err_out:
++ i40evf_free_queues(adapter);
++ return -ENOMEM;
++}
++
++/**
++ * i40evf_set_interrupt_capability - set MSI-X or FAIL if not supported
++ * @adapter: board private structure to initialize
++ *
++ * Attempt to configure the interrupts using the best available
++ * capabilities of the hardware and the kernel.
++ **/
++static int i40evf_set_interrupt_capability(struct i40evf_adapter *adapter)
++{
++ int vector, v_budget;
++ int pairs = 0;
++ int err = 0;
++
++ if (!adapter->vsi_res) {
++ err = -EIO;
++ goto out;
++ }
++ pairs = adapter->num_active_queues;
++
++ /* It's easy to be greedy for MSI-X vectors, but it really doesn't do
++ * us much good if we have more vectors than CPUs. However, we already
++ * limit the total number of queues by the number of CPUs so we do not
++ * need any further limiting here.
++ */
++ v_budget = min_t(int, pairs + NONQ_VECS,
++ (int)adapter->vf_res->max_vectors);
++
++ adapter->msix_entries = kcalloc(v_budget,
++ sizeof(struct msix_entry), GFP_KERNEL);
++ if (!adapter->msix_entries) {
++ err = -ENOMEM;
++ goto out;
++ }
++
++ for (vector = 0; vector < v_budget; vector++)
++ adapter->msix_entries[vector].entry = vector;
++
++ err = i40evf_acquire_msix_vectors(adapter, v_budget);
++
++out:
++ netif_set_real_num_rx_queues(adapter->netdev, pairs);
++ netif_set_real_num_tx_queues(adapter->netdev, pairs);
++ return err;
++}
++
++/**
++ * i40e_config_rss_aq - Configure RSS keys and lut by using AQ commands
++ * @adapter: board private structure
++ *
++ * Return 0 on success, negative on failure
++ **/
++static int i40evf_config_rss_aq(struct i40evf_adapter *adapter)
++{
++ struct i40e_aqc_get_set_rss_key_data *rss_key =
++ (struct i40e_aqc_get_set_rss_key_data *)adapter->rss_key;
++ struct i40e_hw *hw = &adapter->hw;
++ int ret = 0;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot configure RSS, command %d pending\n",
++ adapter->current_op);
++ return -EBUSY;
++ }
++
++ ret = i40evf_aq_set_rss_key(hw, adapter->vsi.id, rss_key);
++ if (ret) {
++ dev_err(&adapter->pdev->dev, "Cannot set RSS key, err %s aq_err %s\n",
++ i40evf_stat_str(hw, ret),
++ i40evf_aq_str(hw, hw->aq.asq_last_status));
++ return ret;
++
++ }
++
++ ret = i40evf_aq_set_rss_lut(hw, adapter->vsi.id, false,
++ adapter->rss_lut, adapter->rss_lut_size);
++ if (ret) {
++ dev_err(&adapter->pdev->dev, "Cannot set RSS lut, err %s aq_err %s\n",
++ i40evf_stat_str(hw, ret),
++ i40evf_aq_str(hw, hw->aq.asq_last_status));
++ }
++
++ return ret;
++
++}
++
++/**
++ * i40evf_config_rss_reg - Configure RSS keys and lut by writing registers
++ * @adapter: board private structure
++ *
++ * Returns 0 on success, negative on failure
++ **/
++static int i40evf_config_rss_reg(struct i40evf_adapter *adapter)
++{
++ struct i40e_hw *hw = &adapter->hw;
++ u32 *dw;
++ u16 i;
++
++ dw = (u32 *)adapter->rss_key;
++ for (i = 0; i <= adapter->rss_key_size / 4; i++)
++ wr32(hw, I40E_VFQF_HKEY(i), dw[i]);
++
++ dw = (u32 *)adapter->rss_lut;
++ for (i = 0; i <= adapter->rss_lut_size / 4; i++)
++ wr32(hw, I40E_VFQF_HLUT(i), dw[i]);
++
++ i40e_flush(hw);
++
++ return 0;
++}
++
++/**
++ * i40evf_config_rss - Configure RSS keys and lut
++ * @adapter: board private structure
++ *
++ * Returns 0 on success, negative on failure
++ **/
++int i40evf_config_rss(struct i40evf_adapter *adapter)
++{
++
++ if (RSS_PF(adapter)) {
++ adapter->aq_required |= I40EVF_FLAG_AQ_SET_RSS_LUT |
++ I40EVF_FLAG_AQ_SET_RSS_KEY;
++ return 0;
++ } else if (RSS_AQ(adapter)) {
++ return i40evf_config_rss_aq(adapter);
++ } else {
++ return i40evf_config_rss_reg(adapter);
++ }
++}
++
++/**
++ * i40evf_fill_rss_lut - Fill the lut with default values
++ * @adapter: board private structure
++ **/
++static void i40evf_fill_rss_lut(struct i40evf_adapter *adapter)
++{
++ u16 i;
++
++ for (i = 0; i < adapter->rss_lut_size; i++)
++ adapter->rss_lut[i] = i % adapter->num_active_queues;
++}
++
++/**
++ * i40evf_init_rss - Prepare for RSS
++ * @adapter: board private structure
++ *
++ * Return 0 on success, negative on failure
++ **/
++static int i40evf_init_rss(struct i40evf_adapter *adapter)
++{
++ struct i40e_hw *hw = &adapter->hw;
++ int ret;
++
++ if (!RSS_PF(adapter)) {
++ /* Enable PCTYPES for RSS, TCP/UDP with IPv4/IPv6 */
++ if (adapter->vf_res->vf_cap_flags &
++ VIRTCHNL_VF_OFFLOAD_RSS_PCTYPE_V2)
++ adapter->hena = I40E_DEFAULT_RSS_HENA_EXPANDED;
++ else
++ adapter->hena = I40E_DEFAULT_RSS_HENA;
++
++ wr32(hw, I40E_VFQF_HENA(0), (u32)adapter->hena);
++ wr32(hw, I40E_VFQF_HENA(1), (u32)(adapter->hena >> 32));
++ }
++
++ i40evf_fill_rss_lut(adapter);
++
++ netdev_rss_key_fill((void *)adapter->rss_key, adapter->rss_key_size);
++ ret = i40evf_config_rss(adapter);
++
++ return ret;
++}
++
++/**
++ * i40evf_alloc_q_vectors - Allocate memory for interrupt vectors
++ * @adapter: board private structure to initialize
++ *
++ * We allocate one q_vector per queue interrupt. If allocation fails we
++ * return -ENOMEM.
++ **/
++static int i40evf_alloc_q_vectors(struct i40evf_adapter *adapter)
++{
++ int q_idx = 0, num_q_vectors;
++ struct i40e_q_vector *q_vector;
++
++ num_q_vectors = adapter->num_msix_vectors - NONQ_VECS;
++ adapter->q_vectors = kcalloc(num_q_vectors, sizeof(*q_vector),
++ GFP_KERNEL);
++ if (!adapter->q_vectors)
++ return -ENOMEM;
++
++ for (q_idx = 0; q_idx < num_q_vectors; q_idx++) {
++ q_vector = &adapter->q_vectors[q_idx];
++ q_vector->adapter = adapter;
++ q_vector->vsi = &adapter->vsi;
++ q_vector->v_idx = q_idx;
++ q_vector->reg_idx = q_idx;
++ cpumask_copy(&q_vector->affinity_mask, cpu_possible_mask);
++ netif_napi_add(adapter->netdev, &q_vector->napi,
++ i40evf_napi_poll, NAPI_POLL_WEIGHT);
++ }
++
++ return 0;
++}
++
++/**
++ * i40evf_free_q_vectors - Free memory allocated for interrupt vectors
++ * @adapter: board private structure to initialize
++ *
++ * This function frees the memory allocated to the q_vectors. In addition if
++ * NAPI is enabled it will delete any references to the NAPI struct prior
++ * to freeing the q_vector.
++ **/
++static void i40evf_free_q_vectors(struct i40evf_adapter *adapter)
++{
++ int q_idx, num_q_vectors;
++ int napi_vectors;
++
++ if (!adapter->q_vectors)
++ return;
++
++ num_q_vectors = adapter->num_msix_vectors - NONQ_VECS;
++ napi_vectors = adapter->num_active_queues;
++
++ for (q_idx = 0; q_idx < num_q_vectors; q_idx++) {
++ struct i40e_q_vector *q_vector = &adapter->q_vectors[q_idx];
++ if (q_idx < napi_vectors)
++ netif_napi_del(&q_vector->napi);
++ }
++ kfree(adapter->q_vectors);
++ adapter->q_vectors = NULL;
++}
++
++/**
++ * i40evf_reset_interrupt_capability - Reset MSIX setup
++ * @adapter: board private structure
++ *
++ **/
++void i40evf_reset_interrupt_capability(struct i40evf_adapter *adapter)
++{
++ if (!adapter->msix_entries)
++ return;
++
++ pci_disable_msix(adapter->pdev);
++ kfree(adapter->msix_entries);
++ adapter->msix_entries = NULL;
++}
++
++/**
++ * i40evf_init_interrupt_scheme - Determine if MSIX is supported and init
++ * @adapter: board private structure to initialize
++ *
++ **/
++int i40evf_init_interrupt_scheme(struct i40evf_adapter *adapter)
++{
++ int err;
++
++ err = i40evf_alloc_queues(adapter);
++ if (err) {
++ dev_err(&adapter->pdev->dev,
++ "Unable to allocate memory for queues\n");
++ goto err_alloc_queues;
++ }
++
++ rtnl_lock();
++ err = i40evf_set_interrupt_capability(adapter);
++ rtnl_unlock();
++ if (err) {
++ dev_err(&adapter->pdev->dev,
++ "Unable to setup interrupt capabilities\n");
++ goto err_set_interrupt;
++ }
++
++ err = i40evf_alloc_q_vectors(adapter);
++ if (err) {
++ dev_err(&adapter->pdev->dev,
++ "Unable to allocate memory for queue vectors\n");
++ goto err_alloc_q_vectors;
++ }
++
++ /* If we've made it so far while ADq flag being ON, then we haven't
++ * bailed out anywhere in middle. And ADq isn't just enabled but actual
++ * resources have been allocated in the reset path.
++ * Now we can truly claim that ADq is enabled.
++ */
++ if ((adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
++ adapter->num_tc)
++ dev_info(&adapter->pdev->dev, "ADq Enabled, %u TCs created",
++ adapter->num_tc);
++
++ dev_info(&adapter->pdev->dev, "Multiqueue %s: Queue pair count = %u",
++ (adapter->num_active_queues > 1) ? "Enabled" : "Disabled",
++ adapter->num_active_queues);
++
++ return 0;
++err_alloc_q_vectors:
++ i40evf_reset_interrupt_capability(adapter);
++err_set_interrupt:
++ i40evf_free_queues(adapter);
++err_alloc_queues:
++ return err;
++}
++
++/**
++ * i40evf_free_rss - Free memory used by RSS structs
++ * @adapter: board private structure
++ **/
++static void i40evf_free_rss(struct i40evf_adapter *adapter)
++{
++ kfree(adapter->rss_key);
++ adapter->rss_key = NULL;
++
++ kfree(adapter->rss_lut);
++ adapter->rss_lut = NULL;
++}
++
++/**
++ * i40evf_reinit_interrupt_scheme - Reallocate queues and vectors
++ * @adapter: board private structure
++ *
++ * Returns 0 on success, negative on failure
++ **/
++static int i40evf_reinit_interrupt_scheme(struct i40evf_adapter *adapter)
++{
++ struct net_device *netdev = adapter->netdev;
++ int err;
++
++ if (netif_running(netdev))
++ i40evf_free_traffic_irqs(adapter);
++ i40evf_free_misc_irq(adapter);
++ i40evf_reset_interrupt_capability(adapter);
++ i40evf_free_q_vectors(adapter);
++ i40evf_free_queues(adapter);
++
++ err = i40evf_init_interrupt_scheme(adapter);
++ if (err)
++ goto err;
++
++ netif_tx_stop_all_queues(netdev);
++
++ err = i40evf_request_misc_irq(adapter);
++ if (err)
++ goto err;
++
++ set_bit(__I40E_VSI_DOWN, adapter->vsi.state);
++
++ i40evf_map_rings_to_vectors(adapter);
++
++ if (RSS_AQ(adapter))
++ adapter->aq_required |= I40EVF_FLAG_AQ_CONFIGURE_RSS;
++ else
++ err = i40evf_init_rss(adapter);
++err:
++ return err;
++}
++
++/**
++ * i40evf_watchdog_timer - Periodic call-back timer
++ * @data: pointer to adapter disguised as unsigned long
++ **/
++static void i40evf_watchdog_timer(struct timer_list *t)
++{
++ struct i40evf_adapter *adapter = from_timer(adapter, t,
++ watchdog_timer);
++
++ schedule_work(&adapter->watchdog_task);
++ /* timer will be rescheduled in watchdog task */
++}
++
++/**
++ * i40evf_watchdog_task - Periodic call-back task
++ * @work: pointer to work_struct
++ **/
++static void i40evf_watchdog_task(struct work_struct *work)
++{
++ struct i40evf_adapter *adapter = container_of(work,
++ struct i40evf_adapter,
++ watchdog_task);
++ struct i40e_hw *hw = &adapter->hw;
++ u32 reg_val;
++
++ if (test_and_set_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section))
++ goto restart_watchdog;
++
++ if (adapter->flags & I40EVF_FLAG_PF_COMMS_FAILED) {
++ reg_val = rd32(hw, I40E_VFGEN_RSTAT) &
++ I40E_VFGEN_RSTAT_VFR_STATE_MASK;
++ if ((reg_val == VIRTCHNL_VFR_VFACTIVE) ||
++ (reg_val == VIRTCHNL_VFR_COMPLETED)) {
++ /* A chance for redemption! */
++ dev_err(&adapter->pdev->dev, "Hardware came out of reset. Attempting reinit.\n");
++ adapter->state = __I40EVF_STARTUP;
++ adapter->flags &= ~I40EVF_FLAG_PF_COMMS_FAILED;
++ schedule_delayed_work(&adapter->init_task, 10);
++ clear_bit(__I40EVF_IN_CRITICAL_TASK,
++ &adapter->crit_section);
++ /* Don't reschedule the watchdog, since we've restarted
++ * the init task. When init_task contacts the PF and
++ * gets everything set up again, it'll restart the
++ * watchdog for us. Down, boy. Sit. Stay. Woof.
++ */
++ return;
++ }
++ adapter->aq_required = 0;
++ adapter->current_op = VIRTCHNL_OP_UNKNOWN;
++ goto watchdog_done;
++ }
++
++ if ((adapter->state < __I40EVF_DOWN) ||
++ (adapter->flags & I40EVF_FLAG_RESET_PENDING))
++ goto watchdog_done;
++
++ /* check for reset */
++ reg_val = rd32(hw, I40E_VF_ARQLEN1) & I40E_VF_ARQLEN1_ARQENABLE_MASK;
++ if (!(adapter->flags & I40EVF_FLAG_RESET_PENDING) && !reg_val) {
++ adapter->state = __I40EVF_RESETTING;
++ adapter->flags |= I40EVF_FLAG_RESET_PENDING;
++ dev_err(&adapter->pdev->dev, "Hardware reset detected\n");
++ schedule_work(&adapter->reset_task);
++ adapter->aq_required = 0;
++ adapter->current_op = VIRTCHNL_OP_UNKNOWN;
++ goto watchdog_done;
++ }
++
++ /* Process admin queue tasks. After init, everything gets done
++ * here so we don't race on the admin queue.
++ */
++ if (adapter->current_op) {
++ if (!i40evf_asq_done(hw)) {
++ dev_dbg(&adapter->pdev->dev, "Admin queue timeout\n");
++ i40evf_send_api_ver(adapter);
++ }
++ goto watchdog_done;
++ }
++ if (adapter->aq_required & I40EVF_FLAG_AQ_GET_CONFIG) {
++ i40evf_send_vf_config_msg(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_DISABLE_QUEUES) {
++ i40evf_disable_queues(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_MAP_VECTORS) {
++ i40evf_map_queues(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_ADD_MAC_FILTER) {
++ i40evf_add_ether_addrs(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_ADD_VLAN_FILTER) {
++ i40evf_add_vlans(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_DEL_MAC_FILTER) {
++ i40evf_del_ether_addrs(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_DEL_VLAN_FILTER) {
++ i40evf_del_vlans(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING) {
++ i40evf_enable_vlan_stripping(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_DISABLE_VLAN_STRIPPING) {
++ i40evf_disable_vlan_stripping(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_CONFIGURE_QUEUES) {
++ i40evf_configure_queues(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_ENABLE_QUEUES) {
++ i40evf_enable_queues(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_CONFIGURE_RSS) {
++ /* This message goes straight to the firmware, not the
++ * PF, so we don't have to set current_op as we will
++ * not get a response through the ARQ.
++ */
++ i40evf_init_rss(adapter);
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_CONFIGURE_RSS;
++ goto watchdog_done;
++ }
++ if (adapter->aq_required & I40EVF_FLAG_AQ_GET_HENA) {
++ i40evf_get_hena(adapter);
++ goto watchdog_done;
++ }
++ if (adapter->aq_required & I40EVF_FLAG_AQ_SET_HENA) {
++ i40evf_set_hena(adapter);
++ goto watchdog_done;
++ }
++ if (adapter->aq_required & I40EVF_FLAG_AQ_SET_RSS_KEY) {
++ i40evf_set_rss_key(adapter);
++ goto watchdog_done;
++ }
++ if (adapter->aq_required & I40EVF_FLAG_AQ_SET_RSS_LUT) {
++ i40evf_set_rss_lut(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_REQUEST_PROMISC) {
++ i40evf_set_promiscuous(adapter, FLAG_VF_UNICAST_PROMISC |
++ FLAG_VF_MULTICAST_PROMISC);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_REQUEST_ALLMULTI) {
++ i40evf_set_promiscuous(adapter, FLAG_VF_MULTICAST_PROMISC);
++ goto watchdog_done;
++ }
++
++ if ((adapter->aq_required & I40EVF_FLAG_AQ_RELEASE_PROMISC) &&
++ (adapter->aq_required & I40EVF_FLAG_AQ_RELEASE_ALLMULTI)) {
++ i40evf_set_promiscuous(adapter, 0);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_ENABLE_CHANNELS) {
++ i40evf_enable_channels(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_DISABLE_CHANNELS) {
++ i40evf_disable_channels(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_ADD_CLOUD_FILTER) {
++ i40evf_add_cloud_filter(adapter);
++ goto watchdog_done;
++ }
++
++ if (adapter->aq_required & I40EVF_FLAG_AQ_DEL_CLOUD_FILTER) {
++ i40evf_del_cloud_filter(adapter);
++ goto watchdog_done;
++ }
++
++ schedule_delayed_work(&adapter->client_task, msecs_to_jiffies(5));
++
++ if (adapter->state == __I40EVF_RUNNING)
++ i40evf_request_stats(adapter);
++watchdog_done:
++ if (adapter->state == __I40EVF_RUNNING)
++ i40evf_detect_recover_hung(&adapter->vsi);
++ clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
++restart_watchdog:
++ if (adapter->state == __I40EVF_REMOVE)
++ return;
++ if (adapter->aq_required)
++ mod_timer(&adapter->watchdog_timer,
++ jiffies + msecs_to_jiffies(20));
++ else
++ mod_timer(&adapter->watchdog_timer, jiffies + (HZ * 2));
++ schedule_work(&adapter->adminq_task);
++}
++
++static void i40evf_disable_vf(struct i40evf_adapter *adapter)
++{
++ struct i40evf_mac_filter *f, *ftmp;
++ struct i40evf_vlan_filter *fv, *fvtmp;
++ struct i40evf_cloud_filter *cf, *cftmp;
++
++ adapter->flags |= I40EVF_FLAG_PF_COMMS_FAILED;
++
++ /* We don't use netif_running() because it may be true prior to
++ * ndo_open() returning, so we can't assume it means all our open
++ * tasks have finished, since we're not holding the rtnl_lock here.
++ */
++ if (adapter->state == __I40EVF_RUNNING) {
++ set_bit(__I40E_VSI_DOWN, adapter->vsi.state);
++ netif_carrier_off(adapter->netdev);
++ netif_tx_disable(adapter->netdev);
++ adapter->link_up = false;
++ i40evf_napi_disable_all(adapter);
++ i40evf_irq_disable(adapter);
++ i40evf_free_traffic_irqs(adapter);
++ i40evf_free_all_tx_resources(adapter);
++ i40evf_free_all_rx_resources(adapter);
++ }
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++
++ /* Delete all of the filters */
++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
++ list_del(&f->list);
++ kfree(f);
++ }
++
++ list_for_each_entry_safe(fv, fvtmp, &adapter->vlan_filter_list, list) {
++ list_del(&fv->list);
++ kfree(fv);
++ }
++
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++
++ spin_lock_bh(&adapter->cloud_filter_list_lock);
++ list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list, list) {
++ list_del(&cf->list);
++ kfree(cf);
++ adapter->num_cloud_filters--;
++ }
++ spin_unlock_bh(&adapter->cloud_filter_list_lock);
++
++ i40evf_free_misc_irq(adapter);
++ i40evf_reset_interrupt_capability(adapter);
++ i40evf_free_queues(adapter);
++ i40evf_free_q_vectors(adapter);
++ kfree(adapter->vf_res);
++ i40evf_shutdown_adminq(&adapter->hw);
++ adapter->netdev->flags &= ~IFF_UP;
++ clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ adapter->flags &= ~I40EVF_FLAG_RESET_PENDING;
++ adapter->state = __I40EVF_DOWN;
++ wake_up(&adapter->down_waitqueue);
++ dev_info(&adapter->pdev->dev, "Reset task did not complete, VF disabled\n");
++}
++
++#define I40EVF_RESET_WAIT_MS 10
++#define I40EVF_RESET_WAIT_COUNT 500
++/**
++ * i40evf_reset_task - Call-back task to handle hardware reset
++ * @work: pointer to work_struct
++ *
++ * During reset we need to shut down and reinitialize the admin queue
++ * before we can use it to communicate with the PF again. We also clear
++ * and reinit the rings because that context is lost as well.
++ **/
++static void i40evf_reset_task(struct work_struct *work)
++{
++ struct i40evf_adapter *adapter = container_of(work,
++ struct i40evf_adapter,
++ reset_task);
++ struct virtchnl_vf_resource *vfres = adapter->vf_res;
++ struct net_device *netdev = adapter->netdev;
++ struct i40e_hw *hw = &adapter->hw;
++ struct i40evf_vlan_filter *vlf;
++ struct i40evf_cloud_filter *cf;
++ struct i40evf_mac_filter *f;
++ u32 reg_val;
++ int i = 0, err;
++ bool running;
++
++ /* When device is being removed it doesn't make sense to run the reset
++ * task, just return in such a case.
++ */
++ if (test_bit(__I40EVF_IN_REMOVE_TASK, &adapter->crit_section))
++ return;
++
++ while (test_and_set_bit(__I40EVF_IN_CLIENT_TASK,
++ &adapter->crit_section))
++ usleep_range(500, 1000);
++ if (CLIENT_ENABLED(adapter)) {
++ adapter->flags &= ~(I40EVF_FLAG_CLIENT_NEEDS_OPEN |
++ I40EVF_FLAG_CLIENT_NEEDS_CLOSE |
++ I40EVF_FLAG_CLIENT_NEEDS_L2_PARAMS |
++ I40EVF_FLAG_SERVICE_CLIENT_REQUESTED);
++ cancel_delayed_work_sync(&adapter->client_task);
++ i40evf_notify_client_close(&adapter->vsi, true);
++ }
++ i40evf_misc_irq_disable(adapter);
++ if (adapter->flags & I40EVF_FLAG_RESET_NEEDED) {
++ adapter->flags &= ~I40EVF_FLAG_RESET_NEEDED;
++ /* Restart the AQ here. If we have been reset but didn't
++ * detect it, or if the PF had to reinit, our AQ will be hosed.
++ */
++ i40evf_shutdown_adminq(hw);
++ i40evf_init_adminq(hw);
++ i40evf_request_reset(adapter);
++ }
++ adapter->flags |= I40EVF_FLAG_RESET_PENDING;
++
++ /* poll until we see the reset actually happen */
++ for (i = 0; i < I40EVF_RESET_WAIT_COUNT; i++) {
++ reg_val = rd32(hw, I40E_VF_ARQLEN1) &
++ I40E_VF_ARQLEN1_ARQENABLE_MASK;
++ if (!reg_val)
++ break;
++ usleep_range(5000, 10000);
++ }
++ if (i == I40EVF_RESET_WAIT_COUNT) {
++ dev_info(&adapter->pdev->dev, "Never saw reset\n");
++ goto continue_reset; /* act like the reset happened */
++ }
++
++ /* wait until the reset is complete and the PF is responding to us */
++ for (i = 0; i < I40EVF_RESET_WAIT_COUNT; i++) {
++ /* sleep first to make sure a minimum wait time is met */
++ msleep(I40EVF_RESET_WAIT_MS);
++
++ reg_val = rd32(hw, I40E_VFGEN_RSTAT) &
++ I40E_VFGEN_RSTAT_VFR_STATE_MASK;
++ if (reg_val == VIRTCHNL_VFR_VFACTIVE)
++ break;
++ }
++
++ pci_set_master(adapter->pdev);
++
++ if (i == I40EVF_RESET_WAIT_COUNT) {
++ dev_err(&adapter->pdev->dev, "Reset never finished (%x)\n",
++ reg_val);
++ i40evf_disable_vf(adapter);
++ clear_bit(__I40EVF_IN_CLIENT_TASK, &adapter->crit_section);
++ return; /* Do not attempt to reinit. It's dead, Jim. */
++ }
++
++continue_reset:
++ /* We don't use netif_running() because it may be true prior to
++ * ndo_open() returning, so we can't assume it means all our open
++ * tasks have finished, since we're not holding the rtnl_lock here.
++ */
++ running = ((adapter->state == __I40EVF_RUNNING) ||
++ (adapter->state == __I40EVF_RESETTING));
++
++ if (running) {
++ netif_carrier_off(netdev);
++ netif_tx_stop_all_queues(netdev);
++ adapter->link_up = false;
++ i40evf_napi_disable_all(adapter);
++ }
++ i40evf_irq_disable(adapter);
++
++ adapter->state = __I40EVF_RESETTING;
++ adapter->flags &= ~I40EVF_FLAG_RESET_PENDING;
++
++ /* free the Tx/Rx rings and descriptors, might be better to just
++ * re-use them sometime in the future
++ */
++ i40evf_free_all_rx_resources(adapter);
++ i40evf_free_all_tx_resources(adapter);
++
++ adapter->flags |= I40EVF_FLAG_QUEUES_DISABLED;
++ /* kill and reinit the admin queue */
++ i40evf_shutdown_adminq(hw);
++ adapter->current_op = VIRTCHNL_OP_UNKNOWN;
++ err = i40evf_init_adminq(hw);
++ if (err)
++ dev_info(&adapter->pdev->dev, "Failed to init adminq: %d\n",
++ err);
++ adapter->aq_required = 0;
++
++ if (adapter->flags & I40EVF_FLAG_REINIT_ITR_NEEDED) {
++ err = i40evf_reinit_interrupt_scheme(adapter);
++ if (err)
++ goto reset_err;
++ }
++
++ adapter->aq_required |= I40EVF_FLAG_AQ_GET_CONFIG;
++ adapter->aq_required |= I40EVF_FLAG_AQ_MAP_VECTORS;
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++
++ /* re-add all MAC filters */
++ list_for_each_entry(f, &adapter->mac_filter_list, list) {
++ f->add = true;
++ }
++ /* re-add all VLAN filters */
++ list_for_each_entry(vlf, &adapter->vlan_filter_list, list) {
++ vlf->add = true;
++ }
++
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++
++ /* check if TCs are running and re-add all cloud filters */
++ spin_lock_bh(&adapter->cloud_filter_list_lock);
++ if ((vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
++ adapter->num_tc) {
++ list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
++ cf->add = true;
++ }
++ }
++ spin_unlock_bh(&adapter->cloud_filter_list_lock);
++
++ adapter->aq_required |= I40EVF_FLAG_AQ_ADD_MAC_FILTER;
++ adapter->aq_required |= I40EVF_FLAG_AQ_ADD_VLAN_FILTER;
++ adapter->aq_required |= I40EVF_FLAG_AQ_ADD_CLOUD_FILTER;
++ i40evf_misc_irq_enable(adapter);
++
++ mod_timer(&adapter->watchdog_timer, jiffies + 2);
++
++ /* We were running when the reset started, so we need to restore some
++ * state here.
++ */
++ if (running) {
++ /* allocate transmit descriptors */
++ err = i40evf_setup_all_tx_resources(adapter);
++ if (err)
++ goto reset_err;
++
++ /* allocate receive descriptors */
++ err = i40evf_setup_all_rx_resources(adapter);
++ if (err)
++ goto reset_err;
++
++ if (adapter->flags & I40EVF_FLAG_REINIT_ITR_NEEDED) {
++ err = i40evf_request_traffic_irqs(adapter,
++ netdev->name);
++ if (err)
++ goto reset_err;
++
++ adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
++ }
++
++ i40evf_configure(adapter);
++
++ i40evf_up_complete(adapter);
++
++ i40evf_irq_enable(adapter, true);
++ } else {
++ adapter->state = __I40EVF_DOWN;
++ wake_up(&adapter->down_waitqueue);
++ }
++ clear_bit(__I40EVF_IN_CLIENT_TASK, &adapter->crit_section);
++ clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
++
++ return;
++reset_err:
++ clear_bit(__I40EVF_IN_CLIENT_TASK, &adapter->crit_section);
++ clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ dev_err(&adapter->pdev->dev, "failed to allocate resources during reinit\n");
++ i40evf_close(netdev);
++}
++
++/**
++ * i40evf_adminq_task - worker thread to clean the admin queue
++ * @work: pointer to work_struct containing our data
++ **/
++static void i40evf_adminq_task(struct work_struct *work)
++{
++ struct i40evf_adapter *adapter =
++ container_of(work, struct i40evf_adapter, adminq_task);
++ struct i40e_hw *hw = &adapter->hw;
++ struct i40e_arq_event_info event;
++ enum virtchnl_ops v_op;
++ i40e_status ret, v_ret;
++ u32 val, oldval;
++ u16 pending;
++
++ if (adapter->flags & I40EVF_FLAG_PF_COMMS_FAILED)
++ goto out;
++
++ event.buf_len = I40EVF_MAX_AQ_BUF_SIZE;
++ event.msg_buf = kzalloc(event.buf_len, GFP_KERNEL);
++ if (!event.msg_buf)
++ goto out;
++
++ do {
++ ret = i40evf_clean_arq_element(hw, &event, &pending);
++ v_op = (enum virtchnl_ops)le32_to_cpu(event.desc.cookie_high);
++ v_ret = (i40e_status)le32_to_cpu(event.desc.cookie_low);
++
++ if (ret || !v_op)
++ break; /* No event to process or error cleaning ARQ */
++
++ i40evf_virtchnl_completion(adapter, v_op, v_ret, event.msg_buf,
++ event.msg_len);
++ if (pending != 0)
++ memset(event.msg_buf, 0, I40EVF_MAX_AQ_BUF_SIZE);
++ } while (pending);
++
++ if ((adapter->flags &
++ (I40EVF_FLAG_RESET_PENDING | I40EVF_FLAG_RESET_NEEDED)) ||
++ adapter->state == __I40EVF_RESETTING)
++ goto freedom;
++
++ /* check for error indications */
++ val = rd32(hw, hw->aq.arq.len);
++ if (val == 0xdeadbeef || val == 0xffffffff) /* device in reset */
++ goto freedom;
++ oldval = val;
++ if (val & I40E_VF_ARQLEN1_ARQVFE_MASK) {
++ dev_info(&adapter->pdev->dev, "ARQ VF Error detected\n");
++ val &= ~I40E_VF_ARQLEN1_ARQVFE_MASK;
++ }
++ if (val & I40E_VF_ARQLEN1_ARQOVFL_MASK) {
++ dev_info(&adapter->pdev->dev, "ARQ Overflow Error detected\n");
++ val &= ~I40E_VF_ARQLEN1_ARQOVFL_MASK;
++ }
++ if (val & I40E_VF_ARQLEN1_ARQCRIT_MASK) {
++ dev_info(&adapter->pdev->dev, "ARQ Critical Error detected\n");
++ val &= ~I40E_VF_ARQLEN1_ARQCRIT_MASK;
++ }
++ if (oldval != val)
++ wr32(hw, hw->aq.arq.len, val);
++
++ val = rd32(hw, hw->aq.asq.len);
++ oldval = val;
++ if (val & I40E_VF_ATQLEN1_ATQVFE_MASK) {
++ dev_info(&adapter->pdev->dev, "ASQ VF Error detected\n");
++ val &= ~I40E_VF_ATQLEN1_ATQVFE_MASK;
++ }
++ if (val & I40E_VF_ATQLEN1_ATQOVFL_MASK) {
++ dev_info(&adapter->pdev->dev, "ASQ Overflow Error detected\n");
++ val &= ~I40E_VF_ATQLEN1_ATQOVFL_MASK;
++ }
++ if (val & I40E_VF_ATQLEN1_ATQCRIT_MASK) {
++ dev_info(&adapter->pdev->dev, "ASQ Critical Error detected\n");
++ val &= ~I40E_VF_ATQLEN1_ATQCRIT_MASK;
++ }
++ if (oldval != val)
++ wr32(hw, hw->aq.asq.len, val);
++
++freedom:
++ kfree(event.msg_buf);
++out:
++ /* re-enable Admin queue interrupt cause */
++ i40evf_misc_irq_enable(adapter);
++}
++
++/**
++ * i40evf_client_task - worker thread to perform client work
++ * @work: pointer to work_struct containing our data
++ *
++ * This task handles client interactions. Because client calls can be
++ * reentrant, we can't handle them in the watchdog.
++ **/
++static void i40evf_client_task(struct work_struct *work)
++{
++ struct i40evf_adapter *adapter =
++ container_of(work, struct i40evf_adapter, client_task.work);
++
++ /* If we can't get the client bit, just give up. We'll be rescheduled
++ * later.
++ */
++
++ if (test_and_set_bit(__I40EVF_IN_CLIENT_TASK, &adapter->crit_section))
++ return;
++
++ if (adapter->flags & I40EVF_FLAG_SERVICE_CLIENT_REQUESTED) {
++ i40evf_client_subtask(adapter);
++ adapter->flags &= ~I40EVF_FLAG_SERVICE_CLIENT_REQUESTED;
++ goto out;
++ }
++ if (adapter->flags & I40EVF_FLAG_CLIENT_NEEDS_L2_PARAMS) {
++ i40evf_notify_client_l2_params(&adapter->vsi);
++ adapter->flags &= ~I40EVF_FLAG_CLIENT_NEEDS_L2_PARAMS;
++ goto out;
++ }
++ if (adapter->flags & I40EVF_FLAG_CLIENT_NEEDS_CLOSE) {
++ i40evf_notify_client_close(&adapter->vsi, false);
++ adapter->flags &= ~I40EVF_FLAG_CLIENT_NEEDS_CLOSE;
++ goto out;
++ }
++ if (adapter->flags & I40EVF_FLAG_CLIENT_NEEDS_OPEN) {
++ i40evf_notify_client_open(&adapter->vsi);
++ adapter->flags &= ~I40EVF_FLAG_CLIENT_NEEDS_OPEN;
++ }
++out:
++ clear_bit(__I40EVF_IN_CLIENT_TASK, &adapter->crit_section);
++}
++
++/**
++ * i40evf_free_all_tx_resources - Free Tx Resources for All Queues
++ * @adapter: board private structure
++ *
++ * Free all transmit software resources
++ **/
++void i40evf_free_all_tx_resources(struct i40evf_adapter *adapter)
++{
++ int i;
++
++ if (!adapter->tx_rings)
++ return;
++
++ for (i = 0; i < adapter->num_active_queues; i++)
++ if (adapter->tx_rings[i].desc)
++ i40evf_free_tx_resources(&adapter->tx_rings[i]);
++}
++
++/**
++ * i40evf_setup_all_tx_resources - allocate all queues Tx resources
++ * @adapter: board private structure
++ *
++ * If this function returns with an error, then it's possible one or
++ * more of the rings is populated (while the rest are not). It is the
++ * callers duty to clean those orphaned rings.
++ *
++ * Return 0 on success, negative on failure
++ **/
++static int i40evf_setup_all_tx_resources(struct i40evf_adapter *adapter)
++{
++ int i, err = 0;
++
++ for (i = 0; i < adapter->num_active_queues; i++) {
++ adapter->tx_rings[i].count = adapter->tx_desc_count;
++ err = i40evf_setup_tx_descriptors(&adapter->tx_rings[i]);
++ if (!err)
++ continue;
++ dev_err(&adapter->pdev->dev,
++ "Allocation for Tx Queue %u failed\n", i);
++ break;
++ }
++
++ return err;
++}
++
++/**
++ * i40evf_setup_all_rx_resources - allocate all queues Rx resources
++ * @adapter: board private structure
++ *
++ * If this function returns with an error, then it's possible one or
++ * more of the rings is populated (while the rest are not). It is the
++ * callers duty to clean those orphaned rings.
++ *
++ * Return 0 on success, negative on failure
++ **/
++static int i40evf_setup_all_rx_resources(struct i40evf_adapter *adapter)
++{
++ int i, err = 0;
++
++ for (i = 0; i < adapter->num_active_queues; i++) {
++ adapter->rx_rings[i].count = adapter->rx_desc_count;
++ err = i40evf_setup_rx_descriptors(&adapter->rx_rings[i]);
++ if (!err)
++ continue;
++ dev_err(&adapter->pdev->dev,
++ "Allocation for Rx Queue %u failed\n", i);
++ break;
++ }
++ return err;
++}
++
++/**
++ * i40evf_free_all_rx_resources - Free Rx Resources for All Queues
++ * @adapter: board private structure
++ *
++ * Free all receive software resources
++ **/
++void i40evf_free_all_rx_resources(struct i40evf_adapter *adapter)
++{
++ int i;
++
++ if (!adapter->rx_rings)
++ return;
++
++ for (i = 0; i < adapter->num_active_queues; i++)
++ if (adapter->rx_rings[i].desc)
++ i40evf_free_rx_resources(&adapter->rx_rings[i]);
++}
++
++/**
++ * i40evf_validate_tx_bandwidth - validate the max Tx bandwidth
++ * @adapter: board private structure
++ * @max_tx_rate: max Tx bw for a tc
++ **/
++static int i40evf_validate_tx_bandwidth(struct i40evf_adapter *adapter,
++ u64 max_tx_rate)
++{
++ int speed = 0, ret = 0;
++
++ switch (adapter->link_speed) {
++ case I40E_LINK_SPEED_40GB:
++ speed = 40000;
++ break;
++ case I40E_LINK_SPEED_25GB:
++ speed = 25000;
++ break;
++ case I40E_LINK_SPEED_20GB:
++ speed = 20000;
++ break;
++ case I40E_LINK_SPEED_10GB:
++ speed = 10000;
++ break;
++ case I40E_LINK_SPEED_1GB:
++ speed = 1000;
++ break;
++ case I40E_LINK_SPEED_100MB:
++ speed = 100;
++ break;
++ default:
++ break;
++ }
++
++ if (max_tx_rate > speed) {
++ dev_err(&adapter->pdev->dev,
++ "Invalid tx rate specified\n");
++ ret = -EINVAL;
++ }
++
++ return ret;
++}
++
++/**
++ * i40evf_validate_channel_config - validate queue mapping info
++ * @adapter: board private structure
++ * @mqprio_qopt: queue parameters
++ *
++ * This function validates if the config provided by the user to
++ * configure queue channels is valid or not. Returns 0 on a valid
++ * config.
++ **/
++static int i40evf_validate_ch_config(struct i40evf_adapter *adapter,
++ struct tc_mqprio_qopt_offload *mqprio_qopt)
++{
++ u64 total_max_rate = 0;
++ int i, num_qps = 0;
++ u64 tx_rate = 0;
++ int ret = 0;
++
++ if (mqprio_qopt->qopt.num_tc > I40EVF_MAX_TRAFFIC_CLASS ||
++ mqprio_qopt->qopt.num_tc < 1)
++ return -EINVAL;
++
++ for (i = 0; i <= mqprio_qopt->qopt.num_tc - 1; i++) {
++ if (!mqprio_qopt->qopt.count[i] ||
++ mqprio_qopt->qopt.offset[i] != num_qps)
++ return -EINVAL;
++ if (mqprio_qopt->min_rate[i]) {
++ dev_err(&adapter->pdev->dev,
++ "Invalid min tx rate (greater than 0) specified\n");
++ return -EINVAL;
++ }
++ /*convert to Mbps */
++ tx_rate = div_u64(mqprio_qopt->max_rate[i],
++ I40EVF_MBPS_DIVISOR);
++ total_max_rate += tx_rate;
++ num_qps += mqprio_qopt->qopt.count[i];
++ }
++ if (num_qps > I40EVF_MAX_REQ_QUEUES)
++ return -EINVAL;
++
++ ret = i40evf_validate_tx_bandwidth(adapter, total_max_rate);
++ return ret;
++}
++
++/**
++ * i40evf_del_all_cloud_filters - delete all cloud filters
++ * on the traffic classes
++ **/
++static void i40evf_del_all_cloud_filters(struct i40evf_adapter *adapter)
++{
++ struct i40evf_cloud_filter *cf, *cftmp;
++
++ spin_lock_bh(&adapter->cloud_filter_list_lock);
++ list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list,
++ list) {
++ list_del(&cf->list);
++ kfree(cf);
++ adapter->num_cloud_filters--;
++ }
++ spin_unlock_bh(&adapter->cloud_filter_list_lock);
++}
++
++/**
++ * __i40evf_setup_tc - configure multiple traffic classes
++ * @netdev: network interface device structure
++ * @type_date: tc offload data
++ *
++ * This function processes the config information provided by the
++ * user to configure traffic classes/queue channels and packages the
++ * information to request the PF to setup traffic classes.
++ *
++ * Returns 0 on success.
++ **/
++static int __i40evf_setup_tc(struct net_device *netdev, void *type_data)
++{
++ struct tc_mqprio_qopt_offload *mqprio_qopt = type_data;
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ struct virtchnl_vf_resource *vfres = adapter->vf_res;
++ u8 num_tc = 0, total_qps = 0;
++ int ret = 0, netdev_tc = 0;
++ u64 max_tx_rate;
++ u16 mode;
++ int i;
++
++ num_tc = mqprio_qopt->qopt.num_tc;
++ mode = mqprio_qopt->mode;
++
++ /* delete queue_channel */
++ if (!mqprio_qopt->qopt.hw) {
++ if (adapter->ch_config.state == __I40EVF_TC_RUNNING) {
++ /* reset the tc configuration */
++ netdev_reset_tc(netdev);
++ adapter->num_tc = 0;
++ netif_tx_stop_all_queues(netdev);
++ netif_tx_disable(netdev);
++ i40evf_del_all_cloud_filters(adapter);
++ adapter->aq_required = I40EVF_FLAG_AQ_DISABLE_CHANNELS;
++ goto exit;
++ } else {
++ return -EINVAL;
++ }
++ }
++
++ /* add queue channel */
++ if (mode == TC_MQPRIO_MODE_CHANNEL) {
++ if (!(vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ)) {
++ dev_err(&adapter->pdev->dev, "ADq not supported\n");
++ return -EOPNOTSUPP;
++ }
++ if (adapter->ch_config.state != __I40EVF_TC_INVALID) {
++ dev_err(&adapter->pdev->dev, "TC configuration already exists\n");
++ return -EINVAL;
++ }
++
++ ret = i40evf_validate_ch_config(adapter, mqprio_qopt);
++ if (ret)
++ return ret;
++ /* Return if same TC config is requested */
++ if (adapter->num_tc == num_tc)
++ return 0;
++ adapter->num_tc = num_tc;
++
++ for (i = 0; i < I40EVF_MAX_TRAFFIC_CLASS; i++) {
++ if (i < num_tc) {
++ adapter->ch_config.ch_info[i].count =
++ mqprio_qopt->qopt.count[i];
++ adapter->ch_config.ch_info[i].offset =
++ mqprio_qopt->qopt.offset[i];
++ total_qps += mqprio_qopt->qopt.count[i];
++ max_tx_rate = mqprio_qopt->max_rate[i];
++ /* convert to Mbps */
++ max_tx_rate = div_u64(max_tx_rate,
++ I40EVF_MBPS_DIVISOR);
++ adapter->ch_config.ch_info[i].max_tx_rate =
++ max_tx_rate;
++ } else {
++ adapter->ch_config.ch_info[i].count = 1;
++ adapter->ch_config.ch_info[i].offset = 0;
++ }
++ }
++ adapter->ch_config.total_qps = total_qps;
++ netif_tx_stop_all_queues(netdev);
++ netif_tx_disable(netdev);
++ adapter->aq_required |= I40EVF_FLAG_AQ_ENABLE_CHANNELS;
++ netdev_reset_tc(netdev);
++ /* Report the tc mapping up the stack */
++ netdev_set_num_tc(adapter->netdev, num_tc);
++ for (i = 0; i < I40EVF_MAX_TRAFFIC_CLASS; i++) {
++ u16 qcount = mqprio_qopt->qopt.count[i];
++ u16 qoffset = mqprio_qopt->qopt.offset[i];
++
++ if (i < num_tc)
++ netdev_set_tc_queue(netdev, netdev_tc++, qcount,
++ qoffset);
++ }
++ }
++exit:
++ return ret;
++}
++
++/**
++ * i40evf_parse_cls_flower - Parse tc flower filters provided by kernel
++ * @adapter: board private structure
++ * @cls_flower: pointer to struct tc_cls_flower_offload
++ * @filter: pointer to cloud filter structure
++ */
++static int i40evf_parse_cls_flower(struct i40evf_adapter *adapter,
++ struct tc_cls_flower_offload *f,
++ struct i40evf_cloud_filter *filter)
++{
++ u16 n_proto_mask = 0;
++ u16 n_proto_key = 0;
++ u8 field_flags = 0;
++ u16 addr_type = 0;
++ u16 n_proto = 0;
++ int i = 0;
++ struct virtchnl_filter *vf = &filter->f;
++
++ if (f->dissector->used_keys &
++ ~(BIT(FLOW_DISSECTOR_KEY_CONTROL) |
++ BIT(FLOW_DISSECTOR_KEY_BASIC) |
++ BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
++ BIT(FLOW_DISSECTOR_KEY_VLAN) |
++ BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
++ BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
++ BIT(FLOW_DISSECTOR_KEY_PORTS) |
++ BIT(FLOW_DISSECTOR_KEY_ENC_KEYID))) {
++ dev_err(&adapter->pdev->dev, "Unsupported key used: 0x%x\n",
++ f->dissector->used_keys);
++ return -EOPNOTSUPP;
++ }
++
++ if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ENC_KEYID)) {
++ struct flow_dissector_key_keyid *mask =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_ENC_KEYID,
++ f->mask);
++
++ if (mask->keyid != 0)
++ field_flags |= I40EVF_CLOUD_FIELD_TEN_ID;
++ }
++
++ if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
++ struct flow_dissector_key_basic *key =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_BASIC,
++ f->key);
++
++ struct flow_dissector_key_basic *mask =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_BASIC,
++ f->mask);
++ n_proto_key = ntohs(key->n_proto);
++ n_proto_mask = ntohs(mask->n_proto);
++
++ if (n_proto_key == ETH_P_ALL) {
++ n_proto_key = 0;
++ n_proto_mask = 0;
++ }
++ n_proto = n_proto_key & n_proto_mask;
++ if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6)
++ return -EINVAL;
++ if (n_proto == ETH_P_IPV6) {
++ /* specify flow type as TCP IPv6 */
++ vf->flow_type = VIRTCHNL_TCP_V6_FLOW;
++ }
++
++ if (key->ip_proto != IPPROTO_TCP) {
++ dev_info(&adapter->pdev->dev, "Only TCP transport is supported\n");
++ return -EINVAL;
++ }
++ }
++
++ if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
++ struct flow_dissector_key_eth_addrs *key =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_ETH_ADDRS,
++ f->key);
++
++ struct flow_dissector_key_eth_addrs *mask =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_ETH_ADDRS,
++ f->mask);
++ /* use is_broadcast and is_zero to check for all 0xf or 0 */
++ if (!is_zero_ether_addr(mask->dst)) {
++ if (is_broadcast_ether_addr(mask->dst)) {
++ field_flags |= I40EVF_CLOUD_FIELD_OMAC;
++ } else {
++ dev_err(&adapter->pdev->dev, "Bad ether dest mask %pM\n",
++ mask->dst);
++ return I40E_ERR_CONFIG;
++ }
++ }
++
++ if (!is_zero_ether_addr(mask->src)) {
++ if (is_broadcast_ether_addr(mask->src)) {
++ field_flags |= I40EVF_CLOUD_FIELD_IMAC;
++ } else {
++ dev_err(&adapter->pdev->dev, "Bad ether src mask %pM\n",
++ mask->src);
++ return I40E_ERR_CONFIG;
++ }
++ }
++
++ if (!is_zero_ether_addr(key->dst))
++ if (is_valid_ether_addr(key->dst) ||
++ is_multicast_ether_addr(key->dst)) {
++ /* set the mask if a valid dst_mac address */
++ for (i = 0; i < ETH_ALEN; i++)
++ vf->mask.tcp_spec.dst_mac[i] |= 0xff;
++ ether_addr_copy(vf->data.tcp_spec.dst_mac,
++ key->dst);
++ }
++
++ if (!is_zero_ether_addr(key->src))
++ if (is_valid_ether_addr(key->src) ||
++ is_multicast_ether_addr(key->src)) {
++ /* set the mask if a valid dst_mac address */
++ for (i = 0; i < ETH_ALEN; i++)
++ vf->mask.tcp_spec.src_mac[i] |= 0xff;
++ ether_addr_copy(vf->data.tcp_spec.src_mac,
++ key->src);
++ }
++ }
++
++ if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_VLAN)) {
++ struct flow_dissector_key_vlan *key =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_VLAN,
++ f->key);
++ struct flow_dissector_key_vlan *mask =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_VLAN,
++ f->mask);
++
++ if (mask->vlan_id) {
++ if (mask->vlan_id == VLAN_VID_MASK) {
++ field_flags |= I40EVF_CLOUD_FIELD_IVLAN;
++ } else {
++ dev_err(&adapter->pdev->dev, "Bad vlan mask %u\n",
++ mask->vlan_id);
++ return I40E_ERR_CONFIG;
++ }
++ }
++ vf->mask.tcp_spec.vlan_id |= cpu_to_be16(0xffff);
++ vf->data.tcp_spec.vlan_id = cpu_to_be16(key->vlan_id);
++ }
++
++ if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CONTROL)) {
++ struct flow_dissector_key_control *key =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_CONTROL,
++ f->key);
++
++ addr_type = key->addr_type;
++ }
++
++ if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) {
++ struct flow_dissector_key_ipv4_addrs *key =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_IPV4_ADDRS,
++ f->key);
++ struct flow_dissector_key_ipv4_addrs *mask =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_IPV4_ADDRS,
++ f->mask);
++
++ if (mask->dst) {
++ if (mask->dst == cpu_to_be32(0xffffffff)) {
++ field_flags |= I40EVF_CLOUD_FIELD_IIP;
++ } else {
++ dev_err(&adapter->pdev->dev, "Bad ip dst mask 0x%08x\n",
++ be32_to_cpu(mask->dst));
++ return I40E_ERR_CONFIG;
++ }
++ }
++
++ if (mask->src) {
++ if (mask->src == cpu_to_be32(0xffffffff)) {
++ field_flags |= I40EVF_CLOUD_FIELD_IIP;
++ } else {
++ dev_err(&adapter->pdev->dev, "Bad ip src mask 0x%08x\n",
++ be32_to_cpu(mask->dst));
++ return I40E_ERR_CONFIG;
++ }
++ }
++
++ if (field_flags & I40EVF_CLOUD_FIELD_TEN_ID) {
++ dev_info(&adapter->pdev->dev, "Tenant id not allowed for ip filter\n");
++ return I40E_ERR_CONFIG;
++ }
++ if (key->dst) {
++ vf->mask.tcp_spec.dst_ip[0] |= cpu_to_be32(0xffffffff);
++ vf->data.tcp_spec.dst_ip[0] = key->dst;
++ }
++ if (key->src) {
++ vf->mask.tcp_spec.src_ip[0] |= cpu_to_be32(0xffffffff);
++ vf->data.tcp_spec.src_ip[0] = key->src;
++ }
++ }
++
++ if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) {
++ struct flow_dissector_key_ipv6_addrs *key =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_IPV6_ADDRS,
++ f->key);
++ struct flow_dissector_key_ipv6_addrs *mask =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_IPV6_ADDRS,
++ f->mask);
++
++ /* validate mask, make sure it is not IPV6_ADDR_ANY */
++ if (ipv6_addr_any(&mask->dst)) {
++ dev_err(&adapter->pdev->dev, "Bad ipv6 dst mask 0x%02x\n",
++ IPV6_ADDR_ANY);
++ return I40E_ERR_CONFIG;
++ }
++
++ /* src and dest IPv6 address should not be LOOPBACK
++ * (0:0:0:0:0:0:0:1) which can be represented as ::1
++ */
++ if (ipv6_addr_loopback(&key->dst) ||
++ ipv6_addr_loopback(&key->src)) {
++ dev_err(&adapter->pdev->dev,
++ "ipv6 addr should not be loopback\n");
++ return I40E_ERR_CONFIG;
++ }
++ if (!ipv6_addr_any(&mask->dst) || !ipv6_addr_any(&mask->src))
++ field_flags |= I40EVF_CLOUD_FIELD_IIP;
++
++ for (i = 0; i < 4; i++)
++ vf->mask.tcp_spec.dst_ip[i] |= cpu_to_be32(0xffffffff);
++ memcpy(&vf->data.tcp_spec.dst_ip, &key->dst.s6_addr32,
++ sizeof(vf->data.tcp_spec.dst_ip));
++ for (i = 0; i < 4; i++)
++ vf->mask.tcp_spec.src_ip[i] |= cpu_to_be32(0xffffffff);
++ memcpy(&vf->data.tcp_spec.src_ip, &key->src.s6_addr32,
++ sizeof(vf->data.tcp_spec.src_ip));
++ }
++ if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_PORTS)) {
++ struct flow_dissector_key_ports *key =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_PORTS,
++ f->key);
++ struct flow_dissector_key_ports *mask =
++ skb_flow_dissector_target(f->dissector,
++ FLOW_DISSECTOR_KEY_PORTS,
++ f->mask);
++
++ if (mask->src) {
++ if (mask->src == cpu_to_be16(0xffff)) {
++ field_flags |= I40EVF_CLOUD_FIELD_IIP;
++ } else {
++ dev_err(&adapter->pdev->dev, "Bad src port mask %u\n",
++ be16_to_cpu(mask->src));
++ return I40E_ERR_CONFIG;
++ }
++ }
++
++ if (mask->dst) {
++ if (mask->dst == cpu_to_be16(0xffff)) {
++ field_flags |= I40EVF_CLOUD_FIELD_IIP;
++ } else {
++ dev_err(&adapter->pdev->dev, "Bad dst port mask %u\n",
++ be16_to_cpu(mask->dst));
++ return I40E_ERR_CONFIG;
++ }
++ }
++ if (key->dst) {
++ vf->mask.tcp_spec.dst_port |= cpu_to_be16(0xffff);
++ vf->data.tcp_spec.dst_port = key->dst;
++ }
++
++ if (key->src) {
++ vf->mask.tcp_spec.src_port |= cpu_to_be16(0xffff);
++ vf->data.tcp_spec.src_port = key->src;
++ }
++ }
++ vf->field_flags = field_flags;
++
++ return 0;
++}
++
++/**
++ * i40evf_handle_tclass - Forward to a traffic class on the device
++ * @adapter: board private structure
++ * @tc: traffic class index on the device
++ * @filter: pointer to cloud filter structure
++ */
++static int i40evf_handle_tclass(struct i40evf_adapter *adapter, u32 tc,
++ struct i40evf_cloud_filter *filter)
++{
++ if (tc == 0)
++ return 0;
++ if (tc < adapter->num_tc) {
++ if (!filter->f.data.tcp_spec.dst_port) {
++ dev_err(&adapter->pdev->dev,
++ "Specify destination port to redirect to traffic class other than TC0\n");
++ return -EINVAL;
++ }
++ }
++ /* redirect to a traffic class on the same device */
++ filter->f.action = VIRTCHNL_ACTION_TC_REDIRECT;
++ filter->f.action_meta = tc;
++ return 0;
++}
++
++/**
++ * i40evf_configure_clsflower - Add tc flower filters
++ * @adapter: board private structure
++ * @cls_flower: Pointer to struct tc_cls_flower_offload
++ */
++static int i40evf_configure_clsflower(struct i40evf_adapter *adapter,
++ struct tc_cls_flower_offload *cls_flower)
++{
++ int tc = tc_classid_to_hwtc(adapter->netdev, cls_flower->classid);
++ struct i40evf_cloud_filter *filter = NULL;
++ int err = -EINVAL, count = 50;
++
++ if (tc < 0) {
++ dev_err(&adapter->pdev->dev, "Invalid traffic class\n");
++ return -EINVAL;
++ }
++
++ filter = kzalloc(sizeof(*filter), GFP_KERNEL);
++ if (!filter)
++ return -ENOMEM;
++
++ while (test_and_set_bit(__I40EVF_IN_CRITICAL_TASK,
++ &adapter->crit_section)) {
++ if (--count == 0)
++ goto err;
++ udelay(1);
++ }
++
++ filter->cookie = cls_flower->cookie;
++
++ /* set the mask to all zeroes to begin with */
++ memset(&filter->f.mask.tcp_spec, 0, sizeof(struct virtchnl_l4_spec));
++ /* start out with flow type and eth type IPv4 to begin with */
++ filter->f.flow_type = VIRTCHNL_TCP_V4_FLOW;
++ err = i40evf_parse_cls_flower(adapter, cls_flower, filter);
++ if (err < 0)
++ goto err;
++
++ err = i40evf_handle_tclass(adapter, tc, filter);
++ if (err < 0)
++ goto err;
++
++ /* add filter to the list */
++ spin_lock_bh(&adapter->cloud_filter_list_lock);
++ list_add_tail(&filter->list, &adapter->cloud_filter_list);
++ adapter->num_cloud_filters++;
++ filter->add = true;
++ adapter->aq_required |= I40EVF_FLAG_AQ_ADD_CLOUD_FILTER;
++ spin_unlock_bh(&adapter->cloud_filter_list_lock);
++err:
++ if (err)
++ kfree(filter);
++
++ clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
++ return err;
++}
++
++/* i40evf_find_cf - Find the cloud filter in the list
++ * @adapter: Board private structure
++ * @cookie: filter specific cookie
++ *
++ * Returns ptr to the filter object or NULL. Must be called while holding the
++ * cloud_filter_list_lock.
++ */
++static struct i40evf_cloud_filter *i40evf_find_cf(struct i40evf_adapter *adapter,
++ unsigned long *cookie)
++{
++ struct i40evf_cloud_filter *filter = NULL;
++
++ if (!cookie)
++ return NULL;
++
++ list_for_each_entry(filter, &adapter->cloud_filter_list, list) {
++ if (!memcmp(cookie, &filter->cookie, sizeof(filter->cookie)))
++ return filter;
++ }
++ return NULL;
++}
++
++/**
++ * i40evf_delete_clsflower - Remove tc flower filters
++ * @adapter: board private structure
++ * @cls_flower: Pointer to struct tc_cls_flower_offload
++ */
++static int i40evf_delete_clsflower(struct i40evf_adapter *adapter,
++ struct tc_cls_flower_offload *cls_flower)
++{
++ struct i40evf_cloud_filter *filter = NULL;
++ int err = 0;
++
++ spin_lock_bh(&adapter->cloud_filter_list_lock);
++ filter = i40evf_find_cf(adapter, &cls_flower->cookie);
++ if (filter) {
++ filter->del = true;
++ adapter->aq_required |= I40EVF_FLAG_AQ_DEL_CLOUD_FILTER;
++ } else {
++ err = -EINVAL;
++ }
++ spin_unlock_bh(&adapter->cloud_filter_list_lock);
++
++ return err;
++}
++
++/**
++ * i40evf_setup_tc_cls_flower - flower classifier offloads
++ * @netdev: net device to configure
++ * @type_data: offload data
++ */
++static int i40evf_setup_tc_cls_flower(struct i40evf_adapter *adapter,
++ struct tc_cls_flower_offload *cls_flower)
++{
++ if (cls_flower->common.chain_index)
++ return -EOPNOTSUPP;
++
++ switch (cls_flower->command) {
++ case TC_CLSFLOWER_REPLACE:
++ return i40evf_configure_clsflower(adapter, cls_flower);
++ case TC_CLSFLOWER_DESTROY:
++ return i40evf_delete_clsflower(adapter, cls_flower);
++ case TC_CLSFLOWER_STATS:
++ return -EOPNOTSUPP;
++ default:
++ return -EOPNOTSUPP;
++ }
++}
++
++/**
++ * i40evf_setup_tc_block_cb - block callback for tc
++ * @type: type of offload
++ * @type_data: offload data
++ * @cb_priv:
++ *
++ * This function is the block callback for traffic classes
++ **/
++static int i40evf_setup_tc_block_cb(enum tc_setup_type type, void *type_data,
++ void *cb_priv)
++{
++ switch (type) {
++ case TC_SETUP_CLSFLOWER:
++ return i40evf_setup_tc_cls_flower(cb_priv, type_data);
++ default:
++ return -EOPNOTSUPP;
++ }
++}
++
++/**
++ * i40evf_setup_tc_block - register callbacks for tc
++ * @netdev: network interface device structure
++ * @f: tc offload data
++ *
++ * This function registers block callbacks for tc
++ * offloads
++ **/
++static int i40evf_setup_tc_block(struct net_device *dev,
++ struct tc_block_offload *f)
++{
++ struct i40evf_adapter *adapter = netdev_priv(dev);
++
++ if (f->binder_type != TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
++ return -EOPNOTSUPP;
++
++ switch (f->command) {
++ case TC_BLOCK_BIND:
++ return tcf_block_cb_register(f->block, i40evf_setup_tc_block_cb,
++ adapter, adapter, f->extack);
++ case TC_BLOCK_UNBIND:
++ tcf_block_cb_unregister(f->block, i40evf_setup_tc_block_cb,
++ adapter);
++ return 0;
++ default:
++ return -EOPNOTSUPP;
++ }
++}
++
++/**
++ * i40evf_setup_tc - configure multiple traffic classes
++ * @netdev: network interface device structure
++ * @type: type of offload
++ * @type_date: tc offload data
++ *
++ * This function is the callback to ndo_setup_tc in the
++ * netdev_ops.
++ *
++ * Returns 0 on success
++ **/
++static int i40evf_setup_tc(struct net_device *netdev, enum tc_setup_type type,
++ void *type_data)
++{
++ switch (type) {
++ case TC_SETUP_QDISC_MQPRIO:
++ return __i40evf_setup_tc(netdev, type_data);
++ case TC_SETUP_BLOCK:
++ return i40evf_setup_tc_block(netdev, type_data);
++ default:
++ return -EOPNOTSUPP;
++ }
++}
++
++/**
++ * i40evf_open - Called when a network interface is made active
++ * @netdev: network interface device structure
++ *
++ * Returns 0 on success, negative value on failure
++ *
++ * The open entry point is called when a network interface is made
++ * active by the system (IFF_UP). At this point all resources needed
++ * for transmit and receive operations are allocated, the interrupt
++ * handler is registered with the OS, the watchdog timer is started,
++ * and the stack is notified that the interface is ready.
++ **/
++static int i40evf_open(struct net_device *netdev)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ int err;
++
++ if (adapter->flags & I40EVF_FLAG_PF_COMMS_FAILED) {
++ dev_err(&adapter->pdev->dev, "Unable to open device due to PF driver failure.\n");
++ return -EIO;
++ }
++
++ while (test_and_set_bit(__I40EVF_IN_CRITICAL_TASK,
++ &adapter->crit_section))
++ usleep_range(500, 1000);
++
++ if (adapter->state != __I40EVF_DOWN) {
++ err = -EBUSY;
++ goto err_unlock;
++ }
++
++ /* allocate transmit descriptors */
++ err = i40evf_setup_all_tx_resources(adapter);
++ if (err)
++ goto err_setup_tx;
++
++ /* allocate receive descriptors */
++ err = i40evf_setup_all_rx_resources(adapter);
++ if (err)
++ goto err_setup_rx;
++
++ /* clear any pending interrupts, may auto mask */
++ err = i40evf_request_traffic_irqs(adapter, netdev->name);
++ if (err)
++ goto err_req_irq;
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++
++ i40evf_add_filter(adapter, adapter->hw.mac.addr);
++
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++
++ i40evf_configure(adapter);
++
++ i40evf_up_complete(adapter);
++
++ i40evf_irq_enable(adapter, true);
++
++ clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
++
++ return 0;
++
++err_req_irq:
++ i40evf_down(adapter);
++ i40evf_free_traffic_irqs(adapter);
++err_setup_rx:
++ i40evf_free_all_rx_resources(adapter);
++err_setup_tx:
++ i40evf_free_all_tx_resources(adapter);
++err_unlock:
++ clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
++
++ return err;
++}
++
++/**
++ * i40evf_close - Disables a network interface
++ * @netdev: network interface device structure
++ *
++ * Returns 0, this is not allowed to fail
++ *
++ * The close entry point is called when an interface is de-activated
++ * by the OS. The hardware is still under the drivers control, but
++ * needs to be disabled. All IRQs except vector 0 (reserved for admin queue)
++ * are freed, along with all transmit and receive resources.
++ **/
++static int i40evf_close(struct net_device *netdev)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ int status;
++
++ if (adapter->state <= __I40EVF_DOWN_PENDING)
++ return 0;
++
++ while (test_and_set_bit(__I40EVF_IN_CRITICAL_TASK,
++ &adapter->crit_section))
++ usleep_range(500, 1000);
++
++ set_bit(__I40E_VSI_DOWN, adapter->vsi.state);
++ if (CLIENT_ENABLED(adapter))
++ adapter->flags |= I40EVF_FLAG_CLIENT_NEEDS_CLOSE;
++
++ i40evf_down(adapter);
++ adapter->state = __I40EVF_DOWN_PENDING;
++ i40evf_free_traffic_irqs(adapter);
++
++ clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
++
++ /* We explicitly don't free resources here because the hardware is
++ * still active and can DMA into memory. Resources are cleared in
++ * i40evf_virtchnl_completion() after we get confirmation from the PF
++ * driver that the rings have been stopped.
++ *
++ * Also, we wait for state to transition to __I40EVF_DOWN before
++ * returning. State change occurs in i40evf_virtchnl_completion() after
++ * VF resources are released (which occurs after PF driver processes and
++ * responds to admin queue commands).
++ */
++
++ status = wait_event_timeout(adapter->down_waitqueue,
++ adapter->state == __I40EVF_DOWN,
++ msecs_to_jiffies(200));
++ if (!status)
++ netdev_warn(netdev, "Device resources not yet released\n");
++ return 0;
++}
++
++/**
++ * i40evf_change_mtu - Change the Maximum Transfer Unit
++ * @netdev: network interface device structure
++ * @new_mtu: new value for maximum frame size
++ *
++ * Returns 0 on success, negative on failure
++ **/
++static int i40evf_change_mtu(struct net_device *netdev, int new_mtu)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ netdev->mtu = new_mtu;
++ if (CLIENT_ENABLED(adapter)) {
++ i40evf_notify_client_l2_params(&adapter->vsi);
++ adapter->flags |= I40EVF_FLAG_SERVICE_CLIENT_REQUESTED;
++ }
++ adapter->flags |= I40EVF_FLAG_RESET_NEEDED;
++ schedule_work(&adapter->reset_task);
++
++ return 0;
++}
++
++/**
++ * i40e_set_features - set the netdev feature flags
++ * @netdev: ptr to the netdev being adjusted
++ * @features: the feature set that the stack is suggesting
++ * Note: expects to be called while under rtnl_lock()
++ **/
++static int i40evf_set_features(struct net_device *netdev,
++ netdev_features_t features)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ /* Don't allow changing VLAN_RX flag when adapter is not capable
++ * of VLAN offload
++ */
++ if (!VLAN_ALLOWED(adapter)) {
++ if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX)
++ return -EINVAL;
++ } else if ((netdev->features ^ features) & NETIF_F_HW_VLAN_CTAG_RX) {
++ if (features & NETIF_F_HW_VLAN_CTAG_RX)
++ adapter->aq_required |=
++ I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING;
++ else
++ adapter->aq_required |=
++ I40EVF_FLAG_AQ_DISABLE_VLAN_STRIPPING;
++ }
++
++ return 0;
++}
++
++/**
++ * i40evf_features_check - Validate encapsulated packet conforms to limits
++ * @skb: skb buff
++ * @dev: This physical port's netdev
++ * @features: Offload features that the stack believes apply
++ **/
++static netdev_features_t i40evf_features_check(struct sk_buff *skb,
++ struct net_device *dev,
++ netdev_features_t features)
++{
++ size_t len;
++
++ /* No point in doing any of this if neither checksum nor GSO are
++ * being requested for this frame. We can rule out both by just
++ * checking for CHECKSUM_PARTIAL
++ */
++ if (skb->ip_summed != CHECKSUM_PARTIAL)
++ return features;
++
++ /* We cannot support GSO if the MSS is going to be less than
++ * 64 bytes. If it is then we need to drop support for GSO.
++ */
++ if (skb_is_gso(skb) && (skb_shinfo(skb)->gso_size < 64))
++ features &= ~NETIF_F_GSO_MASK;
++
++ /* MACLEN can support at most 63 words */
++ len = skb_network_header(skb) - skb->data;
++ if (len & ~(63 * 2))
++ goto out_err;
++
++ /* IPLEN and EIPLEN can support at most 127 dwords */
++ len = skb_transport_header(skb) - skb_network_header(skb);
++ if (len & ~(127 * 4))
++ goto out_err;
++
++ if (skb->encapsulation) {
++ /* L4TUNLEN can support 127 words */
++ len = skb_inner_network_header(skb) - skb_transport_header(skb);
++ if (len & ~(127 * 2))
++ goto out_err;
++
++ /* IPLEN can support at most 127 dwords */
++ len = skb_inner_transport_header(skb) -
++ skb_inner_network_header(skb);
++ if (len & ~(127 * 4))
++ goto out_err;
++ }
++
++ /* No need to validate L4LEN as TCP is the only protocol with a
++ * a flexible value and we support all possible values supported
++ * by TCP, which is at most 15 dwords
++ */
++
++ return features;
++out_err:
++ return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
++}
++
++/**
++ * i40evf_fix_features - fix up the netdev feature bits
++ * @netdev: our net device
++ * @features: desired feature bits
++ *
++ * Returns fixed-up features bits
++ **/
++static netdev_features_t i40evf_fix_features(struct net_device *netdev,
++ netdev_features_t features)
++{
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ if (adapter->vf_res &&
++ !(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN))
++ features &= ~(NETIF_F_HW_VLAN_CTAG_TX |
++ NETIF_F_HW_VLAN_CTAG_RX |
++ NETIF_F_HW_VLAN_CTAG_FILTER);
++
++ return features;
++}
++
++static const struct net_device_ops i40evf_netdev_ops = {
++ .ndo_open = i40evf_open,
++ .ndo_stop = i40evf_close,
++ .ndo_start_xmit = i40evf_xmit_frame,
++ .ndo_set_rx_mode = i40evf_set_rx_mode,
++ .ndo_validate_addr = eth_validate_addr,
++ .ndo_set_mac_address = i40evf_set_mac,
++ .ndo_change_mtu = i40evf_change_mtu,
++ .ndo_tx_timeout = i40evf_tx_timeout,
++ .ndo_vlan_rx_add_vid = i40evf_vlan_rx_add_vid,
++ .ndo_vlan_rx_kill_vid = i40evf_vlan_rx_kill_vid,
++ .ndo_features_check = i40evf_features_check,
++ .ndo_fix_features = i40evf_fix_features,
++ .ndo_set_features = i40evf_set_features,
++ .ndo_setup_tc = i40evf_setup_tc,
++};
++
++/**
++ * i40evf_check_reset_complete - check that VF reset is complete
++ * @hw: pointer to hw struct
++ *
++ * Returns 0 if device is ready to use, or -EBUSY if it's in reset.
++ **/
++static int i40evf_check_reset_complete(struct i40e_hw *hw)
++{
++ u32 rstat;
++ int i;
++
++ for (i = 0; i < 100; i++) {
++ rstat = rd32(hw, I40E_VFGEN_RSTAT) &
++ I40E_VFGEN_RSTAT_VFR_STATE_MASK;
++ if ((rstat == VIRTCHNL_VFR_VFACTIVE) ||
++ (rstat == VIRTCHNL_VFR_COMPLETED))
++ return 0;
++ usleep_range(10, 20);
++ }
++ return -EBUSY;
++}
++
++/**
++ * i40evf_process_config - Process the config information we got from the PF
++ * @adapter: board private structure
++ *
++ * Verify that we have a valid config struct, and set up our netdev features
++ * and our VSI struct.
++ **/
++int i40evf_process_config(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_vf_resource *vfres = adapter->vf_res;
++ int i, num_req_queues = adapter->num_req_queues;
++ struct net_device *netdev = adapter->netdev;
++ struct i40e_vsi *vsi = &adapter->vsi;
++ netdev_features_t hw_enc_features;
++ netdev_features_t hw_features;
++
++ /* got VF config message back from PF, now we can parse it */
++ for (i = 0; i < vfres->num_vsis; i++) {
++ if (vfres->vsi_res[i].vsi_type == VIRTCHNL_VSI_SRIOV)
++ adapter->vsi_res = &vfres->vsi_res[i];
++ }
++ if (!adapter->vsi_res) {
++ dev_err(&adapter->pdev->dev, "No LAN VSI found\n");
++ return -ENODEV;
++ }
++
++ if (num_req_queues &&
++ num_req_queues != adapter->vsi_res->num_queue_pairs) {
++ /* Problem. The PF gave us fewer queues than what we had
++ * negotiated in our request. Need a reset to see if we can't
++ * get back to a working state.
++ */
++ dev_err(&adapter->pdev->dev,
++ "Requested %d queues, but PF only gave us %d.\n",
++ num_req_queues,
++ adapter->vsi_res->num_queue_pairs);
++ adapter->flags |= I40EVF_FLAG_REINIT_ITR_NEEDED;
++ adapter->num_req_queues = adapter->vsi_res->num_queue_pairs;
++ i40evf_schedule_reset(adapter);
++ return -ENODEV;
++ }
++ adapter->num_req_queues = 0;
++
++ hw_enc_features = NETIF_F_SG |
++ NETIF_F_IP_CSUM |
++ NETIF_F_IPV6_CSUM |
++ NETIF_F_HIGHDMA |
++ NETIF_F_SOFT_FEATURES |
++ NETIF_F_TSO |
++ NETIF_F_TSO_ECN |
++ NETIF_F_TSO6 |
++ NETIF_F_SCTP_CRC |
++ NETIF_F_RXHASH |
++ NETIF_F_RXCSUM |
++ 0;
++
++ /* advertise to stack only if offloads for encapsulated packets is
++ * supported
++ */
++ if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ENCAP) {
++ hw_enc_features |= NETIF_F_GSO_UDP_TUNNEL |
++ NETIF_F_GSO_GRE |
++ NETIF_F_GSO_GRE_CSUM |
++ NETIF_F_GSO_IPXIP4 |
++ NETIF_F_GSO_IPXIP6 |
++ NETIF_F_GSO_UDP_TUNNEL_CSUM |
++ NETIF_F_GSO_PARTIAL |
++ 0;
++
++ if (!(vfres->vf_cap_flags &
++ VIRTCHNL_VF_OFFLOAD_ENCAP_CSUM))
++ netdev->gso_partial_features |=
++ NETIF_F_GSO_UDP_TUNNEL_CSUM;
++
++ netdev->gso_partial_features |= NETIF_F_GSO_GRE_CSUM;
++ netdev->hw_enc_features |= NETIF_F_TSO_MANGLEID;
++ netdev->hw_enc_features |= hw_enc_features;
++ }
++ /* record features VLANs can make use of */
++ netdev->vlan_features |= hw_enc_features | NETIF_F_TSO_MANGLEID;
++
++ /* Write features and hw_features separately to avoid polluting
++ * with, or dropping, features that are set when we registered.
++ */
++ hw_features = hw_enc_features;
++
++ /* Enable VLAN features if supported */
++ if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)
++ hw_features |= (NETIF_F_HW_VLAN_CTAG_TX |
++ NETIF_F_HW_VLAN_CTAG_RX);
++ /* Enable cloud filter if ADQ is supported */
++ if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ)
++ hw_features |= NETIF_F_HW_TC;
++
++ netdev->hw_features |= hw_features;
++
++ netdev->features |= hw_features;
++
++ if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)
++ netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
++
++ netdev->priv_flags |= IFF_UNICAST_FLT;
++
++ /* Do not turn on offloads when they are requested to be turned off.
++ * TSO needs minimum 576 bytes to work correctly.
++ */
++ if (netdev->wanted_features) {
++ if (!(netdev->wanted_features & NETIF_F_TSO) ||
++ netdev->mtu < 576)
++ netdev->features &= ~NETIF_F_TSO;
++ if (!(netdev->wanted_features & NETIF_F_TSO6) ||
++ netdev->mtu < 576)
++ netdev->features &= ~NETIF_F_TSO6;
++ if (!(netdev->wanted_features & NETIF_F_TSO_ECN))
++ netdev->features &= ~NETIF_F_TSO_ECN;
++ if (!(netdev->wanted_features & NETIF_F_GRO))
++ netdev->features &= ~NETIF_F_GRO;
++ if (!(netdev->wanted_features & NETIF_F_GSO))
++ netdev->features &= ~NETIF_F_GSO;
++ }
++
++ adapter->vsi.id = adapter->vsi_res->vsi_id;
++
++ adapter->vsi.back = adapter;
++ adapter->vsi.base_vector = 1;
++ adapter->vsi.work_limit = I40E_DEFAULT_IRQ_WORK;
++ vsi->netdev = adapter->netdev;
++ vsi->qs_handle = adapter->vsi_res->qset_handle;
++ if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_RSS_PF) {
++ adapter->rss_key_size = vfres->rss_key_size;
++ adapter->rss_lut_size = vfres->rss_lut_size;
++ } else {
++ adapter->rss_key_size = I40EVF_HKEY_ARRAY_SIZE;
++ adapter->rss_lut_size = I40EVF_HLUT_ARRAY_SIZE;
++ }
++
++ return 0;
++}
++
++/**
++ * i40evf_init_task - worker thread to perform delayed initialization
++ * @work: pointer to work_struct containing our data
++ *
++ * This task completes the work that was begun in probe. Due to the nature
++ * of VF-PF communications, we may need to wait tens of milliseconds to get
++ * responses back from the PF. Rather than busy-wait in probe and bog down the
++ * whole system, we'll do it in a task so we can sleep.
++ * This task only runs during driver init. Once we've established
++ * communications with the PF driver and set up our netdev, the watchdog
++ * takes over.
++ **/
++static void i40evf_init_task(struct work_struct *work)
++{
++ struct i40evf_adapter *adapter = container_of(work,
++ struct i40evf_adapter,
++ init_task.work);
++ struct net_device *netdev = adapter->netdev;
++ struct i40e_hw *hw = &adapter->hw;
++ struct pci_dev *pdev = adapter->pdev;
++ int err, bufsz;
++
++ switch (adapter->state) {
++ case __I40EVF_STARTUP:
++ /* driver loaded, probe complete */
++ adapter->flags &= ~I40EVF_FLAG_PF_COMMS_FAILED;
++ adapter->flags &= ~I40EVF_FLAG_RESET_PENDING;
++ err = i40e_set_mac_type(hw);
++ if (err) {
++ dev_err(&pdev->dev, "Failed to set MAC type (%d)\n",
++ err);
++ goto err;
++ }
++ err = i40evf_check_reset_complete(hw);
++ if (err) {
++ dev_info(&pdev->dev, "Device is still in reset (%d), retrying\n",
++ err);
++ goto err;
++ }
++ hw->aq.num_arq_entries = I40EVF_AQ_LEN;
++ hw->aq.num_asq_entries = I40EVF_AQ_LEN;
++ hw->aq.arq_buf_size = I40EVF_MAX_AQ_BUF_SIZE;
++ hw->aq.asq_buf_size = I40EVF_MAX_AQ_BUF_SIZE;
++
++ err = i40evf_init_adminq(hw);
++ if (err) {
++ dev_err(&pdev->dev, "Failed to init Admin Queue (%d)\n",
++ err);
++ goto err;
++ }
++ err = i40evf_send_api_ver(adapter);
++ if (err) {
++ dev_err(&pdev->dev, "Unable to send to PF (%d)\n", err);
++ i40evf_shutdown_adminq(hw);
++ goto err;
++ }
++ adapter->state = __I40EVF_INIT_VERSION_CHECK;
++ goto restart;
++ case __I40EVF_INIT_VERSION_CHECK:
++ if (!i40evf_asq_done(hw)) {
++ dev_err(&pdev->dev, "Admin queue command never completed\n");
++ i40evf_shutdown_adminq(hw);
++ adapter->state = __I40EVF_STARTUP;
++ goto err;
++ }
++
++ /* aq msg sent, awaiting reply */
++ err = i40evf_verify_api_ver(adapter);
++ if (err) {
++ if (err == I40E_ERR_ADMIN_QUEUE_NO_WORK)
++ err = i40evf_send_api_ver(adapter);
++ else
++ dev_err(&pdev->dev, "Unsupported PF API version %d.%d, expected %d.%d\n",
++ adapter->pf_version.major,
++ adapter->pf_version.minor,
++ VIRTCHNL_VERSION_MAJOR,
++ VIRTCHNL_VERSION_MINOR);
++ goto err;
++ }
++ err = i40evf_send_vf_config_msg(adapter);
++ if (err) {
++ dev_err(&pdev->dev, "Unable to send config request (%d)\n",
++ err);
++ goto err;
++ }
++ adapter->state = __I40EVF_INIT_GET_RESOURCES;
++ goto restart;
++ case __I40EVF_INIT_GET_RESOURCES:
++ /* aq msg sent, awaiting reply */
++ if (!adapter->vf_res) {
++ bufsz = sizeof(struct virtchnl_vf_resource) +
++ (I40E_MAX_VF_VSI *
++ sizeof(struct virtchnl_vsi_resource));
++ adapter->vf_res = kzalloc(bufsz, GFP_KERNEL);
++ if (!adapter->vf_res)
++ goto err;
++ }
++ err = i40evf_get_vf_config(adapter);
++ if (err == I40E_ERR_ADMIN_QUEUE_NO_WORK) {
++ err = i40evf_send_vf_config_msg(adapter);
++ goto err;
++ } else if (err == I40E_ERR_PARAM) {
++ /* We only get ERR_PARAM if the device is in a very bad
++ * state or if we've been disabled for previous bad
++ * behavior. Either way, we're done now.
++ */
++ i40evf_shutdown_adminq(hw);
++ dev_err(&pdev->dev, "Unable to get VF config due to PF error condition, not retrying\n");
++ return;
++ }
++ if (err) {
++ dev_err(&pdev->dev, "Unable to get VF config (%d)\n",
++ err);
++ goto err_alloc;
++ }
++ adapter->state = __I40EVF_INIT_SW;
++ break;
++ default:
++ goto err_alloc;
++ }
++
++ if (i40evf_process_config(adapter))
++ goto err_alloc;
++ adapter->current_op = VIRTCHNL_OP_UNKNOWN;
++
++ adapter->flags |= I40EVF_FLAG_RX_CSUM_ENABLED;
++
++ netdev->netdev_ops = &i40evf_netdev_ops;
++ i40evf_set_ethtool_ops(netdev);
++ netdev->watchdog_timeo = 5 * HZ;
++
++ /* MTU range: 68 - 9710 */
++ netdev->min_mtu = ETH_MIN_MTU;
++ netdev->max_mtu = I40E_MAX_RXBUFFER - I40E_PACKET_HDR_PAD;
++
++ if (!is_valid_ether_addr(adapter->hw.mac.addr)) {
++ dev_info(&pdev->dev, "Invalid MAC address %pM, using random\n",
++ adapter->hw.mac.addr);
++ eth_hw_addr_random(netdev);
++ ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr);
++ } else {
++ adapter->flags |= I40EVF_FLAG_ADDR_SET_BY_PF;
++ ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr);
++ ether_addr_copy(netdev->perm_addr, adapter->hw.mac.addr);
++ }
++
++ timer_setup(&adapter->watchdog_timer, i40evf_watchdog_timer, 0);
++ mod_timer(&adapter->watchdog_timer, jiffies + 1);
++
++ adapter->tx_desc_count = I40EVF_DEFAULT_TXD;
++ adapter->rx_desc_count = I40EVF_DEFAULT_RXD;
++ err = i40evf_init_interrupt_scheme(adapter);
++ if (err)
++ goto err_sw_init;
++ i40evf_map_rings_to_vectors(adapter);
++ if (adapter->vf_res->vf_cap_flags &
++ VIRTCHNL_VF_OFFLOAD_WB_ON_ITR)
++ adapter->flags |= I40EVF_FLAG_WB_ON_ITR_CAPABLE;
++
++ err = i40evf_request_misc_irq(adapter);
++ if (err)
++ goto err_sw_init;
++
++ netif_carrier_off(netdev);
++ adapter->link_up = false;
++
++ if (!adapter->netdev_registered) {
++ err = register_netdev(netdev);
++ if (err)
++ goto err_register;
++ }
++
++ adapter->netdev_registered = true;
++
++ netif_tx_stop_all_queues(netdev);
++ if (CLIENT_ALLOWED(adapter)) {
++ err = i40evf_lan_add_device(adapter);
++ if (err)
++ dev_info(&pdev->dev, "Failed to add VF to client API service list: %d\n",
++ err);
++ }
++
++ dev_info(&pdev->dev, "MAC address: %pM\n", adapter->hw.mac.addr);
++ if (netdev->features & NETIF_F_GRO)
++ dev_info(&pdev->dev, "GRO is enabled\n");
++
++ adapter->state = __I40EVF_DOWN;
++ set_bit(__I40E_VSI_DOWN, adapter->vsi.state);
++ i40evf_misc_irq_enable(adapter);
++ wake_up(&adapter->down_waitqueue);
++
++ adapter->rss_key = kzalloc(adapter->rss_key_size, GFP_KERNEL);
++ adapter->rss_lut = kzalloc(adapter->rss_lut_size, GFP_KERNEL);
++ if (!adapter->rss_key || !adapter->rss_lut)
++ goto err_mem;
++
++ if (RSS_AQ(adapter)) {
++ adapter->aq_required |= I40EVF_FLAG_AQ_CONFIGURE_RSS;
++ mod_timer_pending(&adapter->watchdog_timer, jiffies + 1);
++ } else {
++ i40evf_init_rss(adapter);
++ }
++ return;
++restart:
++ schedule_delayed_work(&adapter->init_task, msecs_to_jiffies(30));
++ return;
++err_mem:
++ i40evf_free_rss(adapter);
++err_register:
++ i40evf_free_misc_irq(adapter);
++err_sw_init:
++ i40evf_reset_interrupt_capability(adapter);
++err_alloc:
++ kfree(adapter->vf_res);
++ adapter->vf_res = NULL;
++err:
++ /* Things went into the weeds, so try again later */
++ if (++adapter->aq_wait_count > I40EVF_AQ_MAX_ERR) {
++ dev_err(&pdev->dev, "Failed to communicate with PF; waiting before retry\n");
++ adapter->flags |= I40EVF_FLAG_PF_COMMS_FAILED;
++ i40evf_shutdown_adminq(hw);
++ adapter->state = __I40EVF_STARTUP;
++ schedule_delayed_work(&adapter->init_task, HZ * 5);
++ return;
++ }
++ schedule_delayed_work(&adapter->init_task, HZ);
++}
++
++/**
++ * i40evf_shutdown - Shutdown the device in preparation for a reboot
++ * @pdev: pci device structure
++ **/
++static void i40evf_shutdown(struct pci_dev *pdev)
++{
++ struct net_device *netdev = pci_get_drvdata(pdev);
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++
++ netif_device_detach(netdev);
++
++ if (netif_running(netdev))
++ i40evf_close(netdev);
++
++ /* Prevent the watchdog from running. */
++ adapter->state = __I40EVF_REMOVE;
++ adapter->aq_required = 0;
++
++#ifdef CONFIG_PM
++ pci_save_state(pdev);
++
++#endif
++ pci_disable_device(pdev);
++}
++
++/**
++ * i40evf_probe - Device Initialization Routine
++ * @pdev: PCI device information struct
++ * @ent: entry in i40evf_pci_tbl
++ *
++ * Returns 0 on success, negative on failure
++ *
++ * i40evf_probe initializes an adapter identified by a pci_dev structure.
++ * The OS initialization, configuring of the adapter private structure,
++ * and a hardware reset occur.
++ **/
++static int i40evf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
++{
++ struct net_device *netdev;
++ struct i40evf_adapter *adapter = NULL;
++ struct i40e_hw *hw = NULL;
++ int err;
++
++ err = pci_enable_device(pdev);
++ if (err)
++ return err;
++
++ err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
++ if (err) {
++ err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
++ if (err) {
++ dev_err(&pdev->dev,
++ "DMA configuration failed: 0x%x\n", err);
++ goto err_dma;
++ }
++ }
++
++ err = pci_request_regions(pdev, i40evf_driver_name);
++ if (err) {
++ dev_err(&pdev->dev,
++ "pci_request_regions failed 0x%x\n", err);
++ goto err_pci_reg;
++ }
++
++ pci_enable_pcie_error_reporting(pdev);
++
++ pci_set_master(pdev);
++
++ netdev = alloc_etherdev_mq(sizeof(struct i40evf_adapter),
++ I40EVF_MAX_REQ_QUEUES);
++ if (!netdev) {
++ err = -ENOMEM;
++ goto err_alloc_etherdev;
++ }
++
++ SET_NETDEV_DEV(netdev, &pdev->dev);
++
++ pci_set_drvdata(pdev, netdev);
++ adapter = netdev_priv(netdev);
++
++ adapter->netdev = netdev;
++ adapter->pdev = pdev;
++
++ hw = &adapter->hw;
++ hw->back = adapter;
++
++ adapter->msg_enable = BIT(DEFAULT_DEBUG_LEVEL_SHIFT) - 1;
++ adapter->state = __I40EVF_STARTUP;
++
++ /* Call save state here because it relies on the adapter struct. */
++ pci_save_state(pdev);
++
++ hw->hw_addr = ioremap(pci_resource_start(pdev, 0),
++ pci_resource_len(pdev, 0));
++ if (!hw->hw_addr) {
++ err = -EIO;
++ goto err_ioremap;
++ }
++ hw->vendor_id = pdev->vendor;
++ hw->device_id = pdev->device;
++ pci_read_config_byte(pdev, PCI_REVISION_ID, &hw->revision_id);
++ hw->subsystem_vendor_id = pdev->subsystem_vendor;
++ hw->subsystem_device_id = pdev->subsystem_device;
++ hw->bus.device = PCI_SLOT(pdev->devfn);
++ hw->bus.func = PCI_FUNC(pdev->devfn);
++ hw->bus.bus_id = pdev->bus->number;
++
++ /* set up the locks for the AQ, do this only once in probe
++ * and destroy them only once in remove
++ */
++ mutex_init(&hw->aq.asq_mutex);
++ mutex_init(&hw->aq.arq_mutex);
++
++ spin_lock_init(&adapter->mac_vlan_list_lock);
++ spin_lock_init(&adapter->cloud_filter_list_lock);
++
++ INIT_LIST_HEAD(&adapter->mac_filter_list);
++ INIT_LIST_HEAD(&adapter->vlan_filter_list);
++ INIT_LIST_HEAD(&adapter->cloud_filter_list);
++
++ INIT_WORK(&adapter->reset_task, i40evf_reset_task);
++ INIT_WORK(&adapter->adminq_task, i40evf_adminq_task);
++ INIT_WORK(&adapter->watchdog_task, i40evf_watchdog_task);
++ INIT_DELAYED_WORK(&adapter->client_task, i40evf_client_task);
++ INIT_DELAYED_WORK(&adapter->init_task, i40evf_init_task);
++ schedule_delayed_work(&adapter->init_task,
++ msecs_to_jiffies(5 * (pdev->devfn & 0x07)));
++
++ /* Setup the wait queue for indicating transition to down status */
++ init_waitqueue_head(&adapter->down_waitqueue);
++
++ return 0;
++
++err_ioremap:
++ free_netdev(netdev);
++err_alloc_etherdev:
++ pci_disable_pcie_error_reporting(pdev);
++ pci_release_regions(pdev);
++err_pci_reg:
++err_dma:
++ pci_disable_device(pdev);
++ return err;
++}
++
++#ifdef CONFIG_PM
++/**
++ * i40evf_suspend - Power management suspend routine
++ * @pdev: PCI device information struct
++ * @state: unused
++ *
++ * Called when the system (VM) is entering sleep/suspend.
++ **/
++static int i40evf_suspend(struct pci_dev *pdev, pm_message_t state)
++{
++ struct net_device *netdev = pci_get_drvdata(pdev);
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ int retval = 0;
++
++ netif_device_detach(netdev);
++
++ while (test_and_set_bit(__I40EVF_IN_CRITICAL_TASK,
++ &adapter->crit_section))
++ usleep_range(500, 1000);
++
++ if (netif_running(netdev)) {
++ rtnl_lock();
++ i40evf_down(adapter);
++ rtnl_unlock();
++ }
++ i40evf_free_misc_irq(adapter);
++ i40evf_reset_interrupt_capability(adapter);
++
++ clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
++
++ retval = pci_save_state(pdev);
++ if (retval)
++ return retval;
++
++ pci_disable_device(pdev);
++
++ return 0;
++}
++
++/**
++ * i40evf_resume - Power management resume routine
++ * @pdev: PCI device information struct
++ *
++ * Called when the system (VM) is resumed from sleep/suspend.
++ **/
++static int i40evf_resume(struct pci_dev *pdev)
++{
++ struct i40evf_adapter *adapter = pci_get_drvdata(pdev);
++ struct net_device *netdev = adapter->netdev;
++ u32 err;
++
++ pci_set_power_state(pdev, PCI_D0);
++ pci_restore_state(pdev);
++ /* pci_restore_state clears dev->state_saved so call
++ * pci_save_state to restore it.
++ */
++ pci_save_state(pdev);
++
++ err = pci_enable_device_mem(pdev);
++ if (err) {
++ dev_err(&pdev->dev, "Cannot enable PCI device from suspend.\n");
++ return err;
++ }
++ pci_set_master(pdev);
++
++ rtnl_lock();
++ err = i40evf_set_interrupt_capability(adapter);
++ if (err) {
++ rtnl_unlock();
++ dev_err(&pdev->dev, "Cannot enable MSI-X interrupts.\n");
++ return err;
++ }
++ err = i40evf_request_misc_irq(adapter);
++ rtnl_unlock();
++ if (err) {
++ dev_err(&pdev->dev, "Cannot get interrupt vector.\n");
++ return err;
++ }
++
++ schedule_work(&adapter->reset_task);
++
++ netif_device_attach(netdev);
++
++ return err;
++}
++
++#endif /* CONFIG_PM */
++/**
++ * i40evf_remove - Device Removal Routine
++ * @pdev: PCI device information struct
++ *
++ * i40evf_remove is called by the PCI subsystem to alert the driver
++ * that it should release a PCI device. The could be caused by a
++ * Hot-Plug event, or because the driver is going to be removed from
++ * memory.
++ **/
++static void i40evf_remove(struct pci_dev *pdev)
++{
++ struct net_device *netdev = pci_get_drvdata(pdev);
++ struct i40evf_adapter *adapter = netdev_priv(netdev);
++ struct i40evf_vlan_filter *vlf, *vlftmp;
++ struct i40evf_mac_filter *f, *ftmp;
++ struct i40evf_cloud_filter *cf, *cftmp;
++ struct i40e_hw *hw = &adapter->hw;
++ int err;
++ /* Indicate we are in remove and not to run reset_task */
++ set_bit(__I40EVF_IN_REMOVE_TASK, &adapter->crit_section);
++ cancel_delayed_work_sync(&adapter->init_task);
++ cancel_work_sync(&adapter->reset_task);
++ cancel_delayed_work_sync(&adapter->client_task);
++ if (adapter->netdev_registered) {
++ unregister_netdev(netdev);
++ adapter->netdev_registered = false;
++ }
++ if (CLIENT_ALLOWED(adapter)) {
++ err = i40evf_lan_del_device(adapter);
++ if (err)
++ dev_warn(&pdev->dev, "Failed to delete client device: %d\n",
++ err);
++ }
++
++ /* Shut down all the garbage mashers on the detention level */
++ adapter->state = __I40EVF_REMOVE;
++ adapter->aq_required = 0;
++ adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
++ i40evf_request_reset(adapter);
++ msleep(50);
++ /* If the FW isn't responding, kick it once, but only once. */
++ if (!i40evf_asq_done(hw)) {
++ i40evf_request_reset(adapter);
++ msleep(50);
++ }
++ i40evf_free_all_tx_resources(adapter);
++ i40evf_free_all_rx_resources(adapter);
++ i40evf_misc_irq_disable(adapter);
++ i40evf_free_misc_irq(adapter);
++ i40evf_reset_interrupt_capability(adapter);
++ i40evf_free_q_vectors(adapter);
++
++ if (adapter->watchdog_timer.function)
++ del_timer_sync(&adapter->watchdog_timer);
++
++ cancel_work_sync(&adapter->adminq_task);
++
++ i40evf_free_rss(adapter);
++
++ if (hw->aq.asq.count)
++ i40evf_shutdown_adminq(hw);
++
++ /* destroy the locks only once, here */
++ mutex_destroy(&hw->aq.arq_mutex);
++ mutex_destroy(&hw->aq.asq_mutex);
++
++ iounmap(hw->hw_addr);
++ pci_release_regions(pdev);
++ i40evf_free_all_tx_resources(adapter);
++ i40evf_free_all_rx_resources(adapter);
++ i40evf_free_queues(adapter);
++ kfree(adapter->vf_res);
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++ /* If we got removed before an up/down sequence, we've got a filter
++ * hanging out there that we need to get rid of.
++ */
++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
++ list_del(&f->list);
++ kfree(f);
++ }
++ list_for_each_entry_safe(vlf, vlftmp, &adapter->vlan_filter_list,
++ list) {
++ list_del(&vlf->list);
++ kfree(vlf);
++ }
++
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++
++ spin_lock_bh(&adapter->cloud_filter_list_lock);
++ list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list, list) {
++ list_del(&cf->list);
++ kfree(cf);
++ }
++ spin_unlock_bh(&adapter->cloud_filter_list_lock);
++
++ free_netdev(netdev);
++
++ pci_disable_pcie_error_reporting(pdev);
++
++ pci_disable_device(pdev);
++}
++
++static struct pci_driver i40evf_driver = {
++ .name = i40evf_driver_name,
++ .id_table = i40evf_pci_tbl,
++ .probe = i40evf_probe,
++ .remove = i40evf_remove,
++#ifdef CONFIG_PM
++ .suspend = i40evf_suspend,
++ .resume = i40evf_resume,
++#endif
++ .shutdown = i40evf_shutdown,
++};
++
++/**
++ * i40e_init_module - Driver Registration Routine
++ *
++ * i40e_init_module is the first routine called when the driver is
++ * loaded. All it does is register with the PCI subsystem.
++ **/
++static int __init i40evf_init_module(void)
++{
++ int ret;
++
++ pr_info("i40evf: %s - version %s\n", i40evf_driver_string,
++ i40evf_driver_version);
++
++ pr_info("%s\n", i40evf_copyright);
++
++ i40evf_wq = alloc_workqueue("%s", WQ_UNBOUND | WQ_MEM_RECLAIM, 1,
++ i40evf_driver_name);
++ if (!i40evf_wq) {
++ pr_err("%s: Failed to create workqueue\n", i40evf_driver_name);
++ return -ENOMEM;
++ }
++ ret = pci_register_driver(&i40evf_driver);
++ return ret;
++}
++
++module_init(i40evf_init_module);
++
++/**
++ * i40e_exit_module - Driver Exit Cleanup Routine
++ *
++ * i40e_exit_module is called just before the driver is removed
++ * from memory.
++ **/
++static void __exit i40evf_exit_module(void)
++{
++ pci_unregister_driver(&i40evf_driver);
++ destroy_workqueue(i40evf_wq);
++}
++
++module_exit(i40evf_exit_module);
++
++/* i40evf_main.c */
+diff --git a/drivers/net/ethernet/intel/iavf/i40evf_virtchnl.c b/drivers/net/ethernet/intel/iavf/i40evf_virtchnl.c
+new file mode 100644
+index 0000000000000..6579dabab78cf
+--- /dev/null
++++ b/drivers/net/ethernet/intel/iavf/i40evf_virtchnl.c
+@@ -0,0 +1,1465 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright(c) 2013 - 2018 Intel Corporation. */
++
++#include "i40evf.h"
++#include "i40e_prototype.h"
++#include "i40evf_client.h"
++
++/* busy wait delay in msec */
++#define I40EVF_BUSY_WAIT_DELAY 10
++#define I40EVF_BUSY_WAIT_COUNT 50
++
++/**
++ * i40evf_send_pf_msg
++ * @adapter: adapter structure
++ * @op: virtual channel opcode
++ * @msg: pointer to message buffer
++ * @len: message length
++ *
++ * Send message to PF and print status if failure.
++ **/
++static int i40evf_send_pf_msg(struct i40evf_adapter *adapter,
++ enum virtchnl_ops op, u8 *msg, u16 len)
++{
++ struct i40e_hw *hw = &adapter->hw;
++ i40e_status err;
++
++ if (adapter->flags & I40EVF_FLAG_PF_COMMS_FAILED)
++ return 0; /* nothing to see here, move along */
++
++ err = i40e_aq_send_msg_to_pf(hw, op, 0, msg, len, NULL);
++ if (err)
++ dev_dbg(&adapter->pdev->dev, "Unable to send opcode %d to PF, err %s, aq_err %s\n",
++ op, i40evf_stat_str(hw, err),
++ i40evf_aq_str(hw, hw->aq.asq_last_status));
++ return err;
++}
++
++/**
++ * i40evf_send_api_ver
++ * @adapter: adapter structure
++ *
++ * Send API version admin queue message to the PF. The reply is not checked
++ * in this function. Returns 0 if the message was successfully
++ * sent, or one of the I40E_ADMIN_QUEUE_ERROR_ statuses if not.
++ **/
++int i40evf_send_api_ver(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_version_info vvi;
++
++ vvi.major = VIRTCHNL_VERSION_MAJOR;
++ vvi.minor = VIRTCHNL_VERSION_MINOR;
++
++ return i40evf_send_pf_msg(adapter, VIRTCHNL_OP_VERSION, (u8 *)&vvi,
++ sizeof(vvi));
++}
++
++/**
++ * i40evf_verify_api_ver
++ * @adapter: adapter structure
++ *
++ * Compare API versions with the PF. Must be called after admin queue is
++ * initialized. Returns 0 if API versions match, -EIO if they do not,
++ * I40E_ERR_ADMIN_QUEUE_NO_WORK if the admin queue is empty, and any errors
++ * from the firmware are propagated.
++ **/
++int i40evf_verify_api_ver(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_version_info *pf_vvi;
++ struct i40e_hw *hw = &adapter->hw;
++ struct i40e_arq_event_info event;
++ enum virtchnl_ops op;
++ i40e_status err;
++
++ event.buf_len = I40EVF_MAX_AQ_BUF_SIZE;
++ event.msg_buf = kzalloc(event.buf_len, GFP_KERNEL);
++ if (!event.msg_buf) {
++ err = -ENOMEM;
++ goto out;
++ }
++
++ while (1) {
++ err = i40evf_clean_arq_element(hw, &event, NULL);
++ /* When the AQ is empty, i40evf_clean_arq_element will return
++ * nonzero and this loop will terminate.
++ */
++ if (err)
++ goto out_alloc;
++ op =
++ (enum virtchnl_ops)le32_to_cpu(event.desc.cookie_high);
++ if (op == VIRTCHNL_OP_VERSION)
++ break;
++ }
++
++
++ err = (i40e_status)le32_to_cpu(event.desc.cookie_low);
++ if (err)
++ goto out_alloc;
++
++ if (op != VIRTCHNL_OP_VERSION) {
++ dev_info(&adapter->pdev->dev, "Invalid reply type %d from PF\n",
++ op);
++ err = -EIO;
++ goto out_alloc;
++ }
++
++ pf_vvi = (struct virtchnl_version_info *)event.msg_buf;
++ adapter->pf_version = *pf_vvi;
++
++ if ((pf_vvi->major > VIRTCHNL_VERSION_MAJOR) ||
++ ((pf_vvi->major == VIRTCHNL_VERSION_MAJOR) &&
++ (pf_vvi->minor > VIRTCHNL_VERSION_MINOR)))
++ err = -EIO;
++
++out_alloc:
++ kfree(event.msg_buf);
++out:
++ return err;
++}
++
++/**
++ * i40evf_send_vf_config_msg
++ * @adapter: adapter structure
++ *
++ * Send VF configuration request admin queue message to the PF. The reply
++ * is not checked in this function. Returns 0 if the message was
++ * successfully sent, or one of the I40E_ADMIN_QUEUE_ERROR_ statuses if not.
++ **/
++int i40evf_send_vf_config_msg(struct i40evf_adapter *adapter)
++{
++ u32 caps;
++
++ caps = VIRTCHNL_VF_OFFLOAD_L2 |
++ VIRTCHNL_VF_OFFLOAD_RSS_PF |
++ VIRTCHNL_VF_OFFLOAD_RSS_AQ |
++ VIRTCHNL_VF_OFFLOAD_RSS_REG |
++ VIRTCHNL_VF_OFFLOAD_VLAN |
++ VIRTCHNL_VF_OFFLOAD_WB_ON_ITR |
++ VIRTCHNL_VF_OFFLOAD_RSS_PCTYPE_V2 |
++ VIRTCHNL_VF_OFFLOAD_ENCAP |
++ VIRTCHNL_VF_OFFLOAD_ENCAP_CSUM |
++ VIRTCHNL_VF_OFFLOAD_REQ_QUEUES |
++ VIRTCHNL_VF_OFFLOAD_ADQ;
++
++ adapter->current_op = VIRTCHNL_OP_GET_VF_RESOURCES;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_GET_CONFIG;
++ if (PF_IS_V11(adapter))
++ return i40evf_send_pf_msg(adapter,
++ VIRTCHNL_OP_GET_VF_RESOURCES,
++ (u8 *)&caps, sizeof(caps));
++ else
++ return i40evf_send_pf_msg(adapter,
++ VIRTCHNL_OP_GET_VF_RESOURCES,
++ NULL, 0);
++}
++
++/**
++ * i40evf_validate_num_queues
++ * @adapter: adapter structure
++ *
++ * Validate that the number of queues the PF has sent in
++ * VIRTCHNL_OP_GET_VF_RESOURCES is not larger than the VF can handle.
++ **/
++static void i40evf_validate_num_queues(struct i40evf_adapter *adapter)
++{
++ if (adapter->vf_res->num_queue_pairs > I40EVF_MAX_REQ_QUEUES) {
++ struct virtchnl_vsi_resource *vsi_res;
++ int i;
++
++ dev_info(&adapter->pdev->dev, "Received %d queues, but can only have a max of %d\n",
++ adapter->vf_res->num_queue_pairs,
++ I40EVF_MAX_REQ_QUEUES);
++ dev_info(&adapter->pdev->dev, "Fixing by reducing queues to %d\n",
++ I40EVF_MAX_REQ_QUEUES);
++ adapter->vf_res->num_queue_pairs = I40EVF_MAX_REQ_QUEUES;
++ for (i = 0; i < adapter->vf_res->num_vsis; i++) {
++ vsi_res = &adapter->vf_res->vsi_res[i];
++ vsi_res->num_queue_pairs = I40EVF_MAX_REQ_QUEUES;
++ }
++ }
++}
++
++/**
++ * i40evf_get_vf_config
++ * @adapter: private adapter structure
++ *
++ * Get VF configuration from PF and populate hw structure. Must be called after
++ * admin queue is initialized. Busy waits until response is received from PF,
++ * with maximum timeout. Response from PF is returned in the buffer for further
++ * processing by the caller.
++ **/
++int i40evf_get_vf_config(struct i40evf_adapter *adapter)
++{
++ struct i40e_hw *hw = &adapter->hw;
++ struct i40e_arq_event_info event;
++ enum virtchnl_ops op;
++ i40e_status err;
++ u16 len;
++
++ len = sizeof(struct virtchnl_vf_resource) +
++ I40E_MAX_VF_VSI * sizeof(struct virtchnl_vsi_resource);
++ event.buf_len = len;
++ event.msg_buf = kzalloc(event.buf_len, GFP_KERNEL);
++ if (!event.msg_buf) {
++ err = -ENOMEM;
++ goto out;
++ }
++
++ while (1) {
++ /* When the AQ is empty, i40evf_clean_arq_element will return
++ * nonzero and this loop will terminate.
++ */
++ err = i40evf_clean_arq_element(hw, &event, NULL);
++ if (err)
++ goto out_alloc;
++ op =
++ (enum virtchnl_ops)le32_to_cpu(event.desc.cookie_high);
++ if (op == VIRTCHNL_OP_GET_VF_RESOURCES)
++ break;
++ }
++
++ err = (i40e_status)le32_to_cpu(event.desc.cookie_low);
++ memcpy(adapter->vf_res, event.msg_buf, min(event.msg_len, len));
++
++ /* some PFs send more queues than we should have so validate that
++ * we aren't getting too many queues
++ */
++ if (!err)
++ i40evf_validate_num_queues(adapter);
++ i40e_vf_parse_hw_config(hw, adapter->vf_res);
++out_alloc:
++ kfree(event.msg_buf);
++out:
++ return err;
++}
++
++/**
++ * i40evf_configure_queues
++ * @adapter: adapter structure
++ *
++ * Request that the PF set up our (previously allocated) queues.
++ **/
++void i40evf_configure_queues(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_vsi_queue_config_info *vqci;
++ struct virtchnl_queue_pair_info *vqpi;
++ int pairs = adapter->num_active_queues;
++ int i, len, max_frame = I40E_MAX_RXBUFFER;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot configure queues, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_CONFIG_VSI_QUEUES;
++ len = sizeof(struct virtchnl_vsi_queue_config_info) +
++ (sizeof(struct virtchnl_queue_pair_info) * pairs);
++ vqci = kzalloc(len, GFP_KERNEL);
++ if (!vqci)
++ return;
++
++ /* Limit maximum frame size when jumbo frames is not enabled */
++ if (!(adapter->flags & I40EVF_FLAG_LEGACY_RX) &&
++ (adapter->netdev->mtu <= ETH_DATA_LEN))
++ max_frame = I40E_RXBUFFER_1536 - NET_IP_ALIGN;
++
++ vqci->vsi_id = adapter->vsi_res->vsi_id;
++ vqci->num_queue_pairs = pairs;
++ vqpi = vqci->qpair;
++ /* Size check is not needed here - HW max is 16 queue pairs, and we
++ * can fit info for 31 of them into the AQ buffer before it overflows.
++ */
++ for (i = 0; i < pairs; i++) {
++ vqpi->txq.vsi_id = vqci->vsi_id;
++ vqpi->txq.queue_id = i;
++ vqpi->txq.ring_len = adapter->tx_rings[i].count;
++ vqpi->txq.dma_ring_addr = adapter->tx_rings[i].dma;
++ vqpi->rxq.vsi_id = vqci->vsi_id;
++ vqpi->rxq.queue_id = i;
++ vqpi->rxq.ring_len = adapter->rx_rings[i].count;
++ vqpi->rxq.dma_ring_addr = adapter->rx_rings[i].dma;
++ vqpi->rxq.max_pkt_size = max_frame;
++ vqpi->rxq.databuffer_size =
++ ALIGN(adapter->rx_rings[i].rx_buf_len,
++ BIT_ULL(I40E_RXQ_CTX_DBUFF_SHIFT));
++ vqpi++;
++ }
++
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_CONFIGURE_QUEUES;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_CONFIG_VSI_QUEUES,
++ (u8 *)vqci, len);
++ kfree(vqci);
++}
++
++/**
++ * i40evf_enable_queues
++ * @adapter: adapter structure
++ *
++ * Request that the PF enable all of our queues.
++ **/
++void i40evf_enable_queues(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_queue_select vqs;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot enable queues, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_ENABLE_QUEUES;
++ vqs.vsi_id = adapter->vsi_res->vsi_id;
++ vqs.tx_queues = BIT(adapter->num_active_queues) - 1;
++ vqs.rx_queues = vqs.tx_queues;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_ENABLE_QUEUES;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_ENABLE_QUEUES,
++ (u8 *)&vqs, sizeof(vqs));
++}
++
++/**
++ * i40evf_disable_queues
++ * @adapter: adapter structure
++ *
++ * Request that the PF disable all of our queues.
++ **/
++void i40evf_disable_queues(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_queue_select vqs;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot disable queues, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_DISABLE_QUEUES;
++ vqs.vsi_id = adapter->vsi_res->vsi_id;
++ vqs.tx_queues = BIT(adapter->num_active_queues) - 1;
++ vqs.rx_queues = vqs.tx_queues;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_DISABLE_QUEUES;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_DISABLE_QUEUES,
++ (u8 *)&vqs, sizeof(vqs));
++}
++
++/**
++ * i40evf_map_queues
++ * @adapter: adapter structure
++ *
++ * Request that the PF map queues to interrupt vectors. Misc causes, including
++ * admin queue, are always mapped to vector 0.
++ **/
++void i40evf_map_queues(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_irq_map_info *vimi;
++ struct virtchnl_vector_map *vecmap;
++ int v_idx, q_vectors, len;
++ struct i40e_q_vector *q_vector;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot map queues to vectors, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_CONFIG_IRQ_MAP;
++
++ q_vectors = adapter->num_msix_vectors - NONQ_VECS;
++
++ len = sizeof(struct virtchnl_irq_map_info) +
++ (adapter->num_msix_vectors *
++ sizeof(struct virtchnl_vector_map));
++ vimi = kzalloc(len, GFP_KERNEL);
++ if (!vimi)
++ return;
++
++ vimi->num_vectors = adapter->num_msix_vectors;
++ /* Queue vectors first */
++ for (v_idx = 0; v_idx < q_vectors; v_idx++) {
++ q_vector = &adapter->q_vectors[v_idx];
++ vecmap = &vimi->vecmap[v_idx];
++
++ vecmap->vsi_id = adapter->vsi_res->vsi_id;
++ vecmap->vector_id = v_idx + NONQ_VECS;
++ vecmap->txq_map = q_vector->ring_mask;
++ vecmap->rxq_map = q_vector->ring_mask;
++ vecmap->rxitr_idx = I40E_RX_ITR;
++ vecmap->txitr_idx = I40E_TX_ITR;
++ }
++ /* Misc vector last - this is only for AdminQ messages */
++ vecmap = &vimi->vecmap[v_idx];
++ vecmap->vsi_id = adapter->vsi_res->vsi_id;
++ vecmap->vector_id = 0;
++ vecmap->txq_map = 0;
++ vecmap->rxq_map = 0;
++
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_MAP_VECTORS;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_CONFIG_IRQ_MAP,
++ (u8 *)vimi, len);
++ kfree(vimi);
++}
++
++/**
++ * i40evf_request_queues
++ * @adapter: adapter structure
++ * @num: number of requested queues
++ *
++ * We get a default number of queues from the PF. This enables us to request a
++ * different number. Returns 0 on success, negative on failure
++ **/
++int i40evf_request_queues(struct i40evf_adapter *adapter, int num)
++{
++ struct virtchnl_vf_res_request vfres;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot request queues, command %d pending\n",
++ adapter->current_op);
++ return -EBUSY;
++ }
++
++ vfres.num_queue_pairs = num;
++
++ adapter->current_op = VIRTCHNL_OP_REQUEST_QUEUES;
++ adapter->flags |= I40EVF_FLAG_REINIT_ITR_NEEDED;
++ return i40evf_send_pf_msg(adapter, VIRTCHNL_OP_REQUEST_QUEUES,
++ (u8 *)&vfres, sizeof(vfres));
++}
++
++/**
++ * i40evf_add_ether_addrs
++ * @adapter: adapter structure
++ *
++ * Request that the PF add one or more addresses to our filters.
++ **/
++void i40evf_add_ether_addrs(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_ether_addr_list *veal;
++ int len, i = 0, count = 0;
++ struct i40evf_mac_filter *f;
++ bool more = false;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot add filters, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++
++ list_for_each_entry(f, &adapter->mac_filter_list, list) {
++ if (f->add)
++ count++;
++ }
++ if (!count) {
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_ADD_MAC_FILTER;
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_ADD_ETH_ADDR;
++
++ len = sizeof(struct virtchnl_ether_addr_list) +
++ (count * sizeof(struct virtchnl_ether_addr));
++ if (len > I40EVF_MAX_AQ_BUF_SIZE) {
++ dev_warn(&adapter->pdev->dev, "Too many add MAC changes in one request\n");
++ count = (I40EVF_MAX_AQ_BUF_SIZE -
++ sizeof(struct virtchnl_ether_addr_list)) /
++ sizeof(struct virtchnl_ether_addr);
++ len = sizeof(struct virtchnl_ether_addr_list) +
++ (count * sizeof(struct virtchnl_ether_addr));
++ more = true;
++ }
++
++ veal = kzalloc(len, GFP_ATOMIC);
++ if (!veal) {
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++ return;
++ }
++
++ veal->vsi_id = adapter->vsi_res->vsi_id;
++ veal->num_elements = count;
++ list_for_each_entry(f, &adapter->mac_filter_list, list) {
++ if (f->add) {
++ ether_addr_copy(veal->list[i].addr, f->macaddr);
++ i++;
++ f->add = false;
++ if (i == count)
++ break;
++ }
++ }
++ if (!more)
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_ADD_MAC_FILTER;
++
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_ADD_ETH_ADDR,
++ (u8 *)veal, len);
++ kfree(veal);
++}
++
++/**
++ * i40evf_del_ether_addrs
++ * @adapter: adapter structure
++ *
++ * Request that the PF remove one or more addresses from our filters.
++ **/
++void i40evf_del_ether_addrs(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_ether_addr_list *veal;
++ struct i40evf_mac_filter *f, *ftmp;
++ int len, i = 0, count = 0;
++ bool more = false;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot remove filters, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++
++ list_for_each_entry(f, &adapter->mac_filter_list, list) {
++ if (f->remove)
++ count++;
++ }
++ if (!count) {
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_DEL_MAC_FILTER;
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_DEL_ETH_ADDR;
++
++ len = sizeof(struct virtchnl_ether_addr_list) +
++ (count * sizeof(struct virtchnl_ether_addr));
++ if (len > I40EVF_MAX_AQ_BUF_SIZE) {
++ dev_warn(&adapter->pdev->dev, "Too many delete MAC changes in one request\n");
++ count = (I40EVF_MAX_AQ_BUF_SIZE -
++ sizeof(struct virtchnl_ether_addr_list)) /
++ sizeof(struct virtchnl_ether_addr);
++ len = sizeof(struct virtchnl_ether_addr_list) +
++ (count * sizeof(struct virtchnl_ether_addr));
++ more = true;
++ }
++ veal = kzalloc(len, GFP_ATOMIC);
++ if (!veal) {
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++ return;
++ }
++
++ veal->vsi_id = adapter->vsi_res->vsi_id;
++ veal->num_elements = count;
++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
++ if (f->remove) {
++ ether_addr_copy(veal->list[i].addr, f->macaddr);
++ i++;
++ list_del(&f->list);
++ kfree(f);
++ if (i == count)
++ break;
++ }
++ }
++ if (!more)
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_DEL_MAC_FILTER;
++
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_DEL_ETH_ADDR,
++ (u8 *)veal, len);
++ kfree(veal);
++}
++
++/**
++ * i40evf_add_vlans
++ * @adapter: adapter structure
++ *
++ * Request that the PF add one or more VLAN filters to our VSI.
++ **/
++void i40evf_add_vlans(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_vlan_filter_list *vvfl;
++ int len, i = 0, count = 0;
++ struct i40evf_vlan_filter *f;
++ bool more = false;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot add VLANs, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++
++ list_for_each_entry(f, &adapter->vlan_filter_list, list) {
++ if (f->add)
++ count++;
++ }
++ if (!count) {
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_ADD_VLAN_FILTER;
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_ADD_VLAN;
++
++ len = sizeof(struct virtchnl_vlan_filter_list) +
++ (count * sizeof(u16));
++ if (len > I40EVF_MAX_AQ_BUF_SIZE) {
++ dev_warn(&adapter->pdev->dev, "Too many add VLAN changes in one request\n");
++ count = (I40EVF_MAX_AQ_BUF_SIZE -
++ sizeof(struct virtchnl_vlan_filter_list)) /
++ sizeof(u16);
++ len = sizeof(struct virtchnl_vlan_filter_list) +
++ (count * sizeof(u16));
++ more = true;
++ }
++ vvfl = kzalloc(len, GFP_ATOMIC);
++ if (!vvfl) {
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++ return;
++ }
++
++ vvfl->vsi_id = adapter->vsi_res->vsi_id;
++ vvfl->num_elements = count;
++ list_for_each_entry(f, &adapter->vlan_filter_list, list) {
++ if (f->add) {
++ vvfl->vlan_id[i] = f->vlan;
++ i++;
++ f->add = false;
++ if (i == count)
++ break;
++ }
++ }
++ if (!more)
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_ADD_VLAN_FILTER;
++
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_ADD_VLAN, (u8 *)vvfl, len);
++ kfree(vvfl);
++}
++
++/**
++ * i40evf_del_vlans
++ * @adapter: adapter structure
++ *
++ * Request that the PF remove one or more VLAN filters from our VSI.
++ **/
++void i40evf_del_vlans(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_vlan_filter_list *vvfl;
++ struct i40evf_vlan_filter *f, *ftmp;
++ int len, i = 0, count = 0;
++ bool more = false;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot remove VLANs, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++
++ list_for_each_entry(f, &adapter->vlan_filter_list, list) {
++ if (f->remove)
++ count++;
++ }
++ if (!count) {
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_DEL_VLAN_FILTER;
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_DEL_VLAN;
++
++ len = sizeof(struct virtchnl_vlan_filter_list) +
++ (count * sizeof(u16));
++ if (len > I40EVF_MAX_AQ_BUF_SIZE) {
++ dev_warn(&adapter->pdev->dev, "Too many delete VLAN changes in one request\n");
++ count = (I40EVF_MAX_AQ_BUF_SIZE -
++ sizeof(struct virtchnl_vlan_filter_list)) /
++ sizeof(u16);
++ len = sizeof(struct virtchnl_vlan_filter_list) +
++ (count * sizeof(u16));
++ more = true;
++ }
++ vvfl = kzalloc(len, GFP_ATOMIC);
++ if (!vvfl) {
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++ return;
++ }
++
++ vvfl->vsi_id = adapter->vsi_res->vsi_id;
++ vvfl->num_elements = count;
++ list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) {
++ if (f->remove) {
++ vvfl->vlan_id[i] = f->vlan;
++ i++;
++ list_del(&f->list);
++ kfree(f);
++ if (i == count)
++ break;
++ }
++ }
++ if (!more)
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_DEL_VLAN_FILTER;
++
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
++
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_DEL_VLAN, (u8 *)vvfl, len);
++ kfree(vvfl);
++}
++
++/**
++ * i40evf_set_promiscuous
++ * @adapter: adapter structure
++ * @flags: bitmask to control unicast/multicast promiscuous.
++ *
++ * Request that the PF enable promiscuous mode for our VSI.
++ **/
++void i40evf_set_promiscuous(struct i40evf_adapter *adapter, int flags)
++{
++ struct virtchnl_promisc_info vpi;
++ int promisc_all;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot set promiscuous mode, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++
++ promisc_all = FLAG_VF_UNICAST_PROMISC |
++ FLAG_VF_MULTICAST_PROMISC;
++ if ((flags & promisc_all) == promisc_all) {
++ adapter->flags |= I40EVF_FLAG_PROMISC_ON;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_REQUEST_PROMISC;
++ dev_info(&adapter->pdev->dev, "Entering promiscuous mode\n");
++ }
++
++ if (flags & FLAG_VF_MULTICAST_PROMISC) {
++ adapter->flags |= I40EVF_FLAG_ALLMULTI_ON;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_REQUEST_ALLMULTI;
++ dev_info(&adapter->pdev->dev, "Entering multicast promiscuous mode\n");
++ }
++
++ if (!flags) {
++ adapter->flags &= ~(I40EVF_FLAG_PROMISC_ON |
++ I40EVF_FLAG_ALLMULTI_ON);
++ adapter->aq_required &= ~(I40EVF_FLAG_AQ_RELEASE_PROMISC |
++ I40EVF_FLAG_AQ_RELEASE_ALLMULTI);
++ dev_info(&adapter->pdev->dev, "Leaving promiscuous mode\n");
++ }
++
++ adapter->current_op = VIRTCHNL_OP_CONFIG_PROMISCUOUS_MODE;
++ vpi.vsi_id = adapter->vsi_res->vsi_id;
++ vpi.flags = flags;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_CONFIG_PROMISCUOUS_MODE,
++ (u8 *)&vpi, sizeof(vpi));
++}
++
++/**
++ * i40evf_request_stats
++ * @adapter: adapter structure
++ *
++ * Request VSI statistics from PF.
++ **/
++void i40evf_request_stats(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_queue_select vqs;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* no error message, this isn't crucial */
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_GET_STATS;
++ vqs.vsi_id = adapter->vsi_res->vsi_id;
++ /* queue maps are ignored for this message - only the vsi is used */
++ if (i40evf_send_pf_msg(adapter, VIRTCHNL_OP_GET_STATS,
++ (u8 *)&vqs, sizeof(vqs)))
++ /* if the request failed, don't lock out others */
++ adapter->current_op = VIRTCHNL_OP_UNKNOWN;
++}
++
++/**
++ * i40evf_get_hena
++ * @adapter: adapter structure
++ *
++ * Request hash enable capabilities from PF
++ **/
++void i40evf_get_hena(struct i40evf_adapter *adapter)
++{
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot get RSS hash capabilities, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_GET_RSS_HENA_CAPS;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_GET_HENA;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_GET_RSS_HENA_CAPS,
++ NULL, 0);
++}
++
++/**
++ * i40evf_set_hena
++ * @adapter: adapter structure
++ *
++ * Request the PF to set our RSS hash capabilities
++ **/
++void i40evf_set_hena(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_rss_hena vrh;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot set RSS hash enable, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ vrh.hena = adapter->hena;
++ adapter->current_op = VIRTCHNL_OP_SET_RSS_HENA;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_SET_HENA;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_SET_RSS_HENA,
++ (u8 *)&vrh, sizeof(vrh));
++}
++
++/**
++ * i40evf_set_rss_key
++ * @adapter: adapter structure
++ *
++ * Request the PF to set our RSS hash key
++ **/
++void i40evf_set_rss_key(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_rss_key *vrk;
++ int len;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot set RSS key, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ len = sizeof(struct virtchnl_rss_key) +
++ (adapter->rss_key_size * sizeof(u8)) - 1;
++ vrk = kzalloc(len, GFP_KERNEL);
++ if (!vrk)
++ return;
++ vrk->vsi_id = adapter->vsi.id;
++ vrk->key_len = adapter->rss_key_size;
++ memcpy(vrk->key, adapter->rss_key, adapter->rss_key_size);
++
++ adapter->current_op = VIRTCHNL_OP_CONFIG_RSS_KEY;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_SET_RSS_KEY;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_CONFIG_RSS_KEY,
++ (u8 *)vrk, len);
++ kfree(vrk);
++}
++
++/**
++ * i40evf_set_rss_lut
++ * @adapter: adapter structure
++ *
++ * Request the PF to set our RSS lookup table
++ **/
++void i40evf_set_rss_lut(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_rss_lut *vrl;
++ int len;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot set RSS LUT, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ len = sizeof(struct virtchnl_rss_lut) +
++ (adapter->rss_lut_size * sizeof(u8)) - 1;
++ vrl = kzalloc(len, GFP_KERNEL);
++ if (!vrl)
++ return;
++ vrl->vsi_id = adapter->vsi.id;
++ vrl->lut_entries = adapter->rss_lut_size;
++ memcpy(vrl->lut, adapter->rss_lut, adapter->rss_lut_size);
++ adapter->current_op = VIRTCHNL_OP_CONFIG_RSS_LUT;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_SET_RSS_LUT;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_CONFIG_RSS_LUT,
++ (u8 *)vrl, len);
++ kfree(vrl);
++}
++
++/**
++ * i40evf_enable_vlan_stripping
++ * @adapter: adapter structure
++ *
++ * Request VLAN header stripping to be enabled
++ **/
++void i40evf_enable_vlan_stripping(struct i40evf_adapter *adapter)
++{
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot enable stripping, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_ENABLE_VLAN_STRIPPING;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_ENABLE_VLAN_STRIPPING,
++ NULL, 0);
++}
++
++/**
++ * i40evf_disable_vlan_stripping
++ * @adapter: adapter structure
++ *
++ * Request VLAN header stripping to be disabled
++ **/
++void i40evf_disable_vlan_stripping(struct i40evf_adapter *adapter)
++{
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot disable stripping, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_DISABLE_VLAN_STRIPPING;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_DISABLE_VLAN_STRIPPING;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_DISABLE_VLAN_STRIPPING,
++ NULL, 0);
++}
++
++/**
++ * i40evf_print_link_message - print link up or down
++ * @adapter: adapter structure
++ *
++ * Log a message telling the world of our wonderous link status
++ */
++static void i40evf_print_link_message(struct i40evf_adapter *adapter)
++{
++ struct net_device *netdev = adapter->netdev;
++ char *speed = "Unknown ";
++
++ if (!adapter->link_up) {
++ netdev_info(netdev, "NIC Link is Down\n");
++ return;
++ }
++
++ switch (adapter->link_speed) {
++ case I40E_LINK_SPEED_40GB:
++ speed = "40 G";
++ break;
++ case I40E_LINK_SPEED_25GB:
++ speed = "25 G";
++ break;
++ case I40E_LINK_SPEED_20GB:
++ speed = "20 G";
++ break;
++ case I40E_LINK_SPEED_10GB:
++ speed = "10 G";
++ break;
++ case I40E_LINK_SPEED_1GB:
++ speed = "1000 M";
++ break;
++ case I40E_LINK_SPEED_100MB:
++ speed = "100 M";
++ break;
++ default:
++ break;
++ }
++
++ netdev_info(netdev, "NIC Link is Up %sbps Full Duplex\n", speed);
++}
++
++/**
++ * i40evf_enable_channel
++ * @adapter: adapter structure
++ *
++ * Request that the PF enable channels as specified by
++ * the user via tc tool.
++ **/
++void i40evf_enable_channels(struct i40evf_adapter *adapter)
++{
++ struct virtchnl_tc_info *vti = NULL;
++ u16 len;
++ int i;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot configure mqprio, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++
++ len = (adapter->num_tc * sizeof(struct virtchnl_channel_info)) +
++ sizeof(struct virtchnl_tc_info);
++
++ vti = kzalloc(len, GFP_KERNEL);
++ if (!vti)
++ return;
++ vti->num_tc = adapter->num_tc;
++ for (i = 0; i < vti->num_tc; i++) {
++ vti->list[i].count = adapter->ch_config.ch_info[i].count;
++ vti->list[i].offset = adapter->ch_config.ch_info[i].offset;
++ vti->list[i].pad = 0;
++ vti->list[i].max_tx_rate =
++ adapter->ch_config.ch_info[i].max_tx_rate;
++ }
++
++ adapter->ch_config.state = __I40EVF_TC_RUNNING;
++ adapter->flags |= I40EVF_FLAG_REINIT_ITR_NEEDED;
++ adapter->current_op = VIRTCHNL_OP_ENABLE_CHANNELS;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_ENABLE_CHANNELS;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_ENABLE_CHANNELS,
++ (u8 *)vti, len);
++ kfree(vti);
++}
++
++/**
++ * i40evf_disable_channel
++ * @adapter: adapter structure
++ *
++ * Request that the PF disable channels that are configured
++ **/
++void i40evf_disable_channels(struct i40evf_adapter *adapter)
++{
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot configure mqprio, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++
++ adapter->ch_config.state = __I40EVF_TC_INVALID;
++ adapter->flags |= I40EVF_FLAG_REINIT_ITR_NEEDED;
++ adapter->current_op = VIRTCHNL_OP_DISABLE_CHANNELS;
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_DISABLE_CHANNELS;
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_DISABLE_CHANNELS,
++ NULL, 0);
++}
++
++/**
++ * i40evf_print_cloud_filter
++ * @adapter: adapter structure
++ * @f: cloud filter to print
++ *
++ * Print the cloud filter
++ **/
++static void i40evf_print_cloud_filter(struct i40evf_adapter *adapter,
++ struct virtchnl_filter *f)
++{
++ switch (f->flow_type) {
++ case VIRTCHNL_TCP_V4_FLOW:
++ dev_info(&adapter->pdev->dev, "dst_mac: %pM src_mac: %pM vlan_id: %hu dst_ip: %pI4 src_ip %pI4 dst_port %hu src_port %hu\n",
++ &f->data.tcp_spec.dst_mac,
++ &f->data.tcp_spec.src_mac,
++ ntohs(f->data.tcp_spec.vlan_id),
++ &f->data.tcp_spec.dst_ip[0],
++ &f->data.tcp_spec.src_ip[0],
++ ntohs(f->data.tcp_spec.dst_port),
++ ntohs(f->data.tcp_spec.src_port));
++ break;
++ case VIRTCHNL_TCP_V6_FLOW:
++ dev_info(&adapter->pdev->dev, "dst_mac: %pM src_mac: %pM vlan_id: %hu dst_ip: %pI6 src_ip %pI6 dst_port %hu src_port %hu\n",
++ &f->data.tcp_spec.dst_mac,
++ &f->data.tcp_spec.src_mac,
++ ntohs(f->data.tcp_spec.vlan_id),
++ &f->data.tcp_spec.dst_ip,
++ &f->data.tcp_spec.src_ip,
++ ntohs(f->data.tcp_spec.dst_port),
++ ntohs(f->data.tcp_spec.src_port));
++ break;
++ }
++}
++
++/**
++ * i40evf_add_cloud_filter
++ * @adapter: adapter structure
++ *
++ * Request that the PF add cloud filters as specified
++ * by the user via tc tool.
++ **/
++void i40evf_add_cloud_filter(struct i40evf_adapter *adapter)
++{
++ struct i40evf_cloud_filter *cf;
++ struct virtchnl_filter *f;
++ int len = 0, count = 0;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot add cloud filter, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
++ if (cf->add) {
++ count++;
++ break;
++ }
++ }
++ if (!count) {
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_ADD_CLOUD_FILTER;
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_ADD_CLOUD_FILTER;
++
++ len = sizeof(struct virtchnl_filter);
++ f = kzalloc(len, GFP_KERNEL);
++ if (!f)
++ return;
++
++ list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
++ if (cf->add) {
++ memcpy(f, &cf->f, sizeof(struct virtchnl_filter));
++ cf->add = false;
++ cf->state = __I40EVF_CF_ADD_PENDING;
++ i40evf_send_pf_msg(adapter,
++ VIRTCHNL_OP_ADD_CLOUD_FILTER,
++ (u8 *)f, len);
++ }
++ }
++ kfree(f);
++}
++
++/**
++ * i40evf_del_cloud_filter
++ * @adapter: adapter structure
++ *
++ * Request that the PF delete cloud filters as specified
++ * by the user via tc tool.
++ **/
++void i40evf_del_cloud_filter(struct i40evf_adapter *adapter)
++{
++ struct i40evf_cloud_filter *cf, *cftmp;
++ struct virtchnl_filter *f;
++ int len = 0, count = 0;
++
++ if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
++ /* bail because we already have a command pending */
++ dev_err(&adapter->pdev->dev, "Cannot remove cloud filter, command %d pending\n",
++ adapter->current_op);
++ return;
++ }
++ list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
++ if (cf->del) {
++ count++;
++ break;
++ }
++ }
++ if (!count) {
++ adapter->aq_required &= ~I40EVF_FLAG_AQ_DEL_CLOUD_FILTER;
++ return;
++ }
++ adapter->current_op = VIRTCHNL_OP_DEL_CLOUD_FILTER;
++
++ len = sizeof(struct virtchnl_filter);
++ f = kzalloc(len, GFP_KERNEL);
++ if (!f)
++ return;
++
++ list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list, list) {
++ if (cf->del) {
++ memcpy(f, &cf->f, sizeof(struct virtchnl_filter));
++ cf->del = false;
++ cf->state = __I40EVF_CF_DEL_PENDING;
++ i40evf_send_pf_msg(adapter,
++ VIRTCHNL_OP_DEL_CLOUD_FILTER,
++ (u8 *)f, len);
++ }
++ }
++ kfree(f);
++}
++
++/**
++ * i40evf_request_reset
++ * @adapter: adapter structure
++ *
++ * Request that the PF reset this VF. No response is expected.
++ **/
++void i40evf_request_reset(struct i40evf_adapter *adapter)
++{
++ /* Don't check CURRENT_OP - this is always higher priority */
++ i40evf_send_pf_msg(adapter, VIRTCHNL_OP_RESET_VF, NULL, 0);
++ adapter->current_op = VIRTCHNL_OP_UNKNOWN;
++}
++
++/**
++ * i40evf_virtchnl_completion
++ * @adapter: adapter structure
++ * @v_opcode: opcode sent by PF
++ * @v_retval: retval sent by PF
++ * @msg: message sent by PF
++ * @msglen: message length
++ *
++ * Asynchronous completion function for admin queue messages. Rather than busy
++ * wait, we fire off our requests and assume that no errors will be returned.
++ * This function handles the reply messages.
++ **/
++void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
++ enum virtchnl_ops v_opcode,
++ i40e_status v_retval,
++ u8 *msg, u16 msglen)
++{
++ struct net_device *netdev = adapter->netdev;
++
++ if (v_opcode == VIRTCHNL_OP_EVENT) {
++ struct virtchnl_pf_event *vpe =
++ (struct virtchnl_pf_event *)msg;
++ bool link_up = vpe->event_data.link_event.link_status;
++ switch (vpe->event) {
++ case VIRTCHNL_EVENT_LINK_CHANGE:
++ adapter->link_speed =
++ vpe->event_data.link_event.link_speed;
++
++ /* we've already got the right link status, bail */
++ if (adapter->link_up == link_up)
++ break;
++
++ if (link_up) {
++ /* If we get link up message and start queues
++ * before our queues are configured it will
++ * trigger a TX hang. In that case, just ignore
++ * the link status message,we'll get another one
++ * after we enable queues and actually prepared
++ * to send traffic.
++ */
++ if (adapter->state != __I40EVF_RUNNING)
++ break;
++
++ /* For ADq enabled VF, we reconfigure VSIs and
++ * re-allocate queues. Hence wait till all
++ * queues are enabled.
++ */
++ if (adapter->flags &
++ I40EVF_FLAG_QUEUES_DISABLED)
++ break;
++ }
++
++ adapter->link_up = link_up;
++ if (link_up) {
++ netif_tx_start_all_queues(netdev);
++ netif_carrier_on(netdev);
++ } else {
++ netif_tx_stop_all_queues(netdev);
++ netif_carrier_off(netdev);
++ }
++ i40evf_print_link_message(adapter);
++ break;
++ case VIRTCHNL_EVENT_RESET_IMPENDING:
++ dev_info(&adapter->pdev->dev, "Reset warning received from the PF\n");
++ if (!(adapter->flags & I40EVF_FLAG_RESET_PENDING)) {
++ adapter->flags |= I40EVF_FLAG_RESET_PENDING;
++ dev_info(&adapter->pdev->dev, "Scheduling reset task\n");
++ schedule_work(&adapter->reset_task);
++ }
++ break;
++ default:
++ dev_err(&adapter->pdev->dev, "Unknown event %d from PF\n",
++ vpe->event);
++ break;
++ }
++ return;
++ }
++ if (v_retval) {
++ switch (v_opcode) {
++ case VIRTCHNL_OP_ADD_VLAN:
++ dev_err(&adapter->pdev->dev, "Failed to add VLAN filter, error %s\n",
++ i40evf_stat_str(&adapter->hw, v_retval));
++ break;
++ case VIRTCHNL_OP_ADD_ETH_ADDR:
++ dev_err(&adapter->pdev->dev, "Failed to add MAC filter, error %s\n",
++ i40evf_stat_str(&adapter->hw, v_retval));
++ break;
++ case VIRTCHNL_OP_DEL_VLAN:
++ dev_err(&adapter->pdev->dev, "Failed to delete VLAN filter, error %s\n",
++ i40evf_stat_str(&adapter->hw, v_retval));
++ break;
++ case VIRTCHNL_OP_DEL_ETH_ADDR:
++ dev_err(&adapter->pdev->dev, "Failed to delete MAC filter, error %s\n",
++ i40evf_stat_str(&adapter->hw, v_retval));
++ break;
++ case VIRTCHNL_OP_ENABLE_CHANNELS:
++ dev_err(&adapter->pdev->dev, "Failed to configure queue channels, error %s\n",
++ i40evf_stat_str(&adapter->hw, v_retval));
++ adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
++ adapter->ch_config.state = __I40EVF_TC_INVALID;
++ netdev_reset_tc(netdev);
++ netif_tx_start_all_queues(netdev);
++ break;
++ case VIRTCHNL_OP_DISABLE_CHANNELS:
++ dev_err(&adapter->pdev->dev, "Failed to disable queue channels, error %s\n",
++ i40evf_stat_str(&adapter->hw, v_retval));
++ adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
++ adapter->ch_config.state = __I40EVF_TC_RUNNING;
++ netif_tx_start_all_queues(netdev);
++ break;
++ case VIRTCHNL_OP_ADD_CLOUD_FILTER: {
++ struct i40evf_cloud_filter *cf, *cftmp;
++
++ list_for_each_entry_safe(cf, cftmp,
++ &adapter->cloud_filter_list,
++ list) {
++ if (cf->state == __I40EVF_CF_ADD_PENDING) {
++ cf->state = __I40EVF_CF_INVALID;
++ dev_info(&adapter->pdev->dev, "Failed to add cloud filter, error %s\n",
++ i40evf_stat_str(&adapter->hw,
++ v_retval));
++ i40evf_print_cloud_filter(adapter,
++ &cf->f);
++ list_del(&cf->list);
++ kfree(cf);
++ adapter->num_cloud_filters--;
++ }
++ }
++ }
++ break;
++ case VIRTCHNL_OP_DEL_CLOUD_FILTER: {
++ struct i40evf_cloud_filter *cf;
++
++ list_for_each_entry(cf, &adapter->cloud_filter_list,
++ list) {
++ if (cf->state == __I40EVF_CF_DEL_PENDING) {
++ cf->state = __I40EVF_CF_ACTIVE;
++ dev_info(&adapter->pdev->dev, "Failed to del cloud filter, error %s\n",
++ i40evf_stat_str(&adapter->hw,
++ v_retval));
++ i40evf_print_cloud_filter(adapter,
++ &cf->f);
++ }
++ }
++ }
++ break;
++ default:
++ dev_err(&adapter->pdev->dev, "PF returned error %d (%s) to our request %d\n",
++ v_retval,
++ i40evf_stat_str(&adapter->hw, v_retval),
++ v_opcode);
++ }
++ }
++ switch (v_opcode) {
++ case VIRTCHNL_OP_GET_STATS: {
++ struct i40e_eth_stats *stats =
++ (struct i40e_eth_stats *)msg;
++ netdev->stats.rx_packets = stats->rx_unicast +
++ stats->rx_multicast +
++ stats->rx_broadcast;
++ netdev->stats.tx_packets = stats->tx_unicast +
++ stats->tx_multicast +
++ stats->tx_broadcast;
++ netdev->stats.rx_bytes = stats->rx_bytes;
++ netdev->stats.tx_bytes = stats->tx_bytes;
++ netdev->stats.tx_errors = stats->tx_errors;
++ netdev->stats.rx_dropped = stats->rx_discards;
++ netdev->stats.tx_dropped = stats->tx_discards;
++ adapter->current_stats = *stats;
++ }
++ break;
++ case VIRTCHNL_OP_GET_VF_RESOURCES: {
++ u16 len = sizeof(struct virtchnl_vf_resource) +
++ I40E_MAX_VF_VSI *
++ sizeof(struct virtchnl_vsi_resource);
++ memcpy(adapter->vf_res, msg, min(msglen, len));
++ i40evf_validate_num_queues(adapter);
++ i40e_vf_parse_hw_config(&adapter->hw, adapter->vf_res);
++ if (is_zero_ether_addr(adapter->hw.mac.addr)) {
++ /* restore current mac address */
++ ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr);
++ } else {
++ /* refresh current mac address if changed */
++ ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr);
++ ether_addr_copy(netdev->perm_addr,
++ adapter->hw.mac.addr);
++ }
++ i40evf_process_config(adapter);
++ }
++ break;
++ case VIRTCHNL_OP_ENABLE_QUEUES:
++ /* enable transmits */
++ i40evf_irq_enable(adapter, true);
++ adapter->flags &= ~I40EVF_FLAG_QUEUES_DISABLED;
++ break;
++ case VIRTCHNL_OP_DISABLE_QUEUES:
++ i40evf_free_all_tx_resources(adapter);
++ i40evf_free_all_rx_resources(adapter);
++ if (adapter->state == __I40EVF_DOWN_PENDING) {
++ adapter->state = __I40EVF_DOWN;
++ wake_up(&adapter->down_waitqueue);
++ }
++ break;
++ case VIRTCHNL_OP_VERSION:
++ case VIRTCHNL_OP_CONFIG_IRQ_MAP:
++ /* Don't display an error if we get these out of sequence.
++ * If the firmware needed to get kicked, we'll get these and
++ * it's no problem.
++ */
++ if (v_opcode != adapter->current_op)
++ return;
++ break;
++ case VIRTCHNL_OP_IWARP:
++ /* Gobble zero-length replies from the PF. They indicate that
++ * a previous message was received OK, and the client doesn't
++ * care about that.
++ */
++ if (msglen && CLIENT_ENABLED(adapter))
++ i40evf_notify_client_message(&adapter->vsi,
++ msg, msglen);
++ break;
++
++ case VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP:
++ adapter->client_pending &=
++ ~(BIT(VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP));
++ break;
++ case VIRTCHNL_OP_GET_RSS_HENA_CAPS: {
++ struct virtchnl_rss_hena *vrh = (struct virtchnl_rss_hena *)msg;
++ if (msglen == sizeof(*vrh))
++ adapter->hena = vrh->hena;
++ else
++ dev_warn(&adapter->pdev->dev,
++ "Invalid message %d from PF\n", v_opcode);
++ }
++ break;
++ case VIRTCHNL_OP_REQUEST_QUEUES: {
++ struct virtchnl_vf_res_request *vfres =
++ (struct virtchnl_vf_res_request *)msg;
++ if (vfres->num_queue_pairs != adapter->num_req_queues) {
++ dev_info(&adapter->pdev->dev,
++ "Requested %d queues, PF can support %d\n",
++ adapter->num_req_queues,
++ vfres->num_queue_pairs);
++ adapter->num_req_queues = 0;
++ adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
++ }
++ }
++ break;
++ case VIRTCHNL_OP_ADD_CLOUD_FILTER: {
++ struct i40evf_cloud_filter *cf;
++
++ list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
++ if (cf->state == __I40EVF_CF_ADD_PENDING)
++ cf->state = __I40EVF_CF_ACTIVE;
++ }
++ }
++ break;
++ case VIRTCHNL_OP_DEL_CLOUD_FILTER: {
++ struct i40evf_cloud_filter *cf, *cftmp;
++
++ list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list,
++ list) {
++ if (cf->state == __I40EVF_CF_DEL_PENDING) {
++ cf->state = __I40EVF_CF_INVALID;
++ list_del(&cf->list);
++ kfree(cf);
++ adapter->num_cloud_filters--;
++ }
++ }
++ }
++ break;
++ default:
++ if (adapter->current_op && (v_opcode != adapter->current_op))
++ dev_warn(&adapter->pdev->dev, "Expected response %d from PF, received %d\n",
++ adapter->current_op, v_opcode);
++ break;
++ } /* switch v_opcode */
++ adapter->current_op = VIRTCHNL_OP_UNKNOWN;
++}
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 87f98170ac937..6f9d563deb6ba 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -3700,9 +3700,7 @@ static void igb_remove(struct pci_dev *pdev)
+ igb_release_hw_control(adapter);
+
+ #ifdef CONFIG_PCI_IOV
+- rtnl_lock();
+ igb_disable_sriov(pdev);
+- rtnl_unlock();
+ #endif
+
+ unregister_netdev(netdev);
+diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
+index df827c2541628..70f5f28bfd9ed 100644
+--- a/drivers/net/ethernet/intel/igbvf/netdev.c
++++ b/drivers/net/ethernet/intel/igbvf/netdev.c
+@@ -1070,7 +1070,7 @@ static int igbvf_request_msix(struct igbvf_adapter *adapter)
+ igbvf_intr_msix_rx, 0, adapter->rx_ring->name,
+ netdev);
+ if (err)
+- goto out;
++ goto free_irq_tx;
+
+ adapter->rx_ring->itr_register = E1000_EITR(vector);
+ adapter->rx_ring->itr_val = adapter->current_itr;
+@@ -1079,10 +1079,14 @@ static int igbvf_request_msix(struct igbvf_adapter *adapter)
+ err = request_irq(adapter->msix_entries[vector].vector,
+ igbvf_msix_other, 0, netdev->name, netdev);
+ if (err)
+- goto out;
++ goto free_irq_rx;
+
+ igbvf_configure_msix(adapter);
+ return 0;
++free_irq_rx:
++ free_irq(adapter->msix_entries[--vector].vector, netdev);
++free_irq_tx:
++ free_irq(adapter->msix_entries[--vector].vector, netdev);
+ out:
+ return err;
+ }
+diff --git a/drivers/net/ethernet/intel/igbvf/vf.c b/drivers/net/ethernet/intel/igbvf/vf.c
+index b8ba3f94c3632..a47a2e3e548cf 100644
+--- a/drivers/net/ethernet/intel/igbvf/vf.c
++++ b/drivers/net/ethernet/intel/igbvf/vf.c
+@@ -1,6 +1,8 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /* Copyright(c) 2009 - 2018 Intel Corporation. */
+
++#include <linux/etherdevice.h>
++
+ #include "vf.h"
+
+ static s32 e1000_check_for_link_vf(struct e1000_hw *hw);
+@@ -131,11 +133,16 @@ static s32 e1000_reset_hw_vf(struct e1000_hw *hw)
+ /* set our "perm_addr" based on info provided by PF */
+ ret_val = mbx->ops.read_posted(hw, msgbuf, 3);
+ if (!ret_val) {
+- if (msgbuf[0] == (E1000_VF_RESET |
+- E1000_VT_MSGTYPE_ACK))
++ switch (msgbuf[0]) {
++ case E1000_VF_RESET | E1000_VT_MSGTYPE_ACK:
+ memcpy(hw->mac.perm_addr, addr, ETH_ALEN);
+- else
++ break;
++ case E1000_VF_RESET | E1000_VT_MSGTYPE_NACK:
++ eth_zero_addr(hw->mac.perm_addr);
++ break;
++ default:
+ ret_val = -E1000_ERR_MAC_INIT;
++ }
+ }
+ }
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index fd13116812006..f1a4b11ce0d19 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -542,6 +542,20 @@ struct mvneta_rx_desc {
+ };
+ #endif
+
++enum mvneta_tx_buf_type {
++ MVNETA_TYPE_SKB,
++ MVNETA_TYPE_XDP_TX,
++ MVNETA_TYPE_XDP_NDO,
++};
++
++struct mvneta_tx_buf {
++ enum mvneta_tx_buf_type type;
++ union {
++ struct xdp_frame *xdpf;
++ struct sk_buff *skb;
++ };
++};
++
+ struct mvneta_tx_queue {
+ /* Number of this TX queue, in the range 0-7 */
+ u8 id;
+@@ -557,8 +571,8 @@ struct mvneta_tx_queue {
+ int tx_stop_threshold;
+ int tx_wake_threshold;
+
+- /* Array of transmitted skb */
+- struct sk_buff **tx_skb;
++ /* Array of transmitted buffers */
++ struct mvneta_tx_buf *buf;
+
+ /* Index of last TX DMA descriptor that was inserted */
+ int txq_put_index;
+@@ -1767,14 +1781,9 @@ static void mvneta_txq_bufs_free(struct mvneta_port *pp,
+ int i;
+
+ for (i = 0; i < num; i++) {
++ struct mvneta_tx_buf *buf = &txq->buf[txq->txq_get_index];
+ struct mvneta_tx_desc *tx_desc = txq->descs +
+ txq->txq_get_index;
+- struct sk_buff *skb = txq->tx_skb[txq->txq_get_index];
+-
+- if (skb) {
+- bytes_compl += skb->len;
+- pkts_compl++;
+- }
+
+ mvneta_txq_inc_get(txq);
+
+@@ -1782,9 +1791,12 @@ static void mvneta_txq_bufs_free(struct mvneta_port *pp,
+ dma_unmap_single(pp->dev->dev.parent,
+ tx_desc->buf_phys_addr,
+ tx_desc->data_size, DMA_TO_DEVICE);
+- if (!skb)
++ if (!buf->skb)
+ continue;
+- dev_kfree_skb_any(skb);
++
++ bytes_compl += buf->skb->len;
++ pkts_compl++;
++ dev_kfree_skb_any(buf->skb);
+ }
+
+ netdev_tx_completed_queue(nq, pkts_compl, bytes_compl);
+@@ -2238,16 +2250,19 @@ static inline void
+ mvneta_tso_put_hdr(struct sk_buff *skb,
+ struct mvneta_port *pp, struct mvneta_tx_queue *txq)
+ {
+- struct mvneta_tx_desc *tx_desc;
+ int hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
++ struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index];
++ struct mvneta_tx_desc *tx_desc;
+
+- txq->tx_skb[txq->txq_put_index] = NULL;
+ tx_desc = mvneta_txq_next_desc_get(txq);
+ tx_desc->data_size = hdr_len;
+ tx_desc->command = mvneta_skb_tx_csum(pp, skb);
+ tx_desc->command |= MVNETA_TXD_F_DESC;
+ tx_desc->buf_phys_addr = txq->tso_hdrs_phys +
+ txq->txq_put_index * TSO_HEADER_SIZE;
++ buf->type = MVNETA_TYPE_SKB;
++ buf->skb = NULL;
++
+ mvneta_txq_inc_put(txq);
+ }
+
+@@ -2256,6 +2271,7 @@ mvneta_tso_put_data(struct net_device *dev, struct mvneta_tx_queue *txq,
+ struct sk_buff *skb, char *data, int size,
+ bool last_tcp, bool is_last)
+ {
++ struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index];
+ struct mvneta_tx_desc *tx_desc;
+
+ tx_desc = mvneta_txq_next_desc_get(txq);
+@@ -2269,7 +2285,8 @@ mvneta_tso_put_data(struct net_device *dev, struct mvneta_tx_queue *txq,
+ }
+
+ tx_desc->command = 0;
+- txq->tx_skb[txq->txq_put_index] = NULL;
++ buf->type = MVNETA_TYPE_SKB;
++ buf->skb = NULL;
+
+ if (last_tcp) {
+ /* last descriptor in the TCP packet */
+@@ -2277,7 +2294,7 @@ mvneta_tso_put_data(struct net_device *dev, struct mvneta_tx_queue *txq,
+
+ /* last descriptor in SKB */
+ if (is_last)
+- txq->tx_skb[txq->txq_put_index] = skb;
++ buf->skb = skb;
+ }
+ mvneta_txq_inc_put(txq);
+ return 0;
+@@ -2362,6 +2379,7 @@ static int mvneta_tx_frag_process(struct mvneta_port *pp, struct sk_buff *skb,
+ int i, nr_frags = skb_shinfo(skb)->nr_frags;
+
+ for (i = 0; i < nr_frags; i++) {
++ struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index];
+ skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+ void *addr = page_address(frag->page.p) + frag->page_offset;
+
+@@ -2381,12 +2399,13 @@ static int mvneta_tx_frag_process(struct mvneta_port *pp, struct sk_buff *skb,
+ if (i == nr_frags - 1) {
+ /* Last descriptor */
+ tx_desc->command = MVNETA_TXD_L_DESC | MVNETA_TXD_Z_PAD;
+- txq->tx_skb[txq->txq_put_index] = skb;
++ buf->skb = skb;
+ } else {
+ /* Descriptor in the middle: Not First, Not Last */
+ tx_desc->command = 0;
+- txq->tx_skb[txq->txq_put_index] = NULL;
++ buf->skb = NULL;
+ }
++ buf->type = MVNETA_TYPE_SKB;
+ mvneta_txq_inc_put(txq);
+ }
+
+@@ -2414,6 +2433,7 @@ static netdev_tx_t mvneta_tx(struct sk_buff *skb, struct net_device *dev)
+ struct mvneta_port *pp = netdev_priv(dev);
+ u16 txq_id = skb_get_queue_mapping(skb);
+ struct mvneta_tx_queue *txq = &pp->txqs[txq_id];
++ struct mvneta_tx_buf *buf = &txq->buf[txq->txq_put_index];
+ struct mvneta_tx_desc *tx_desc;
+ int len = skb->len;
+ int frags = 0;
+@@ -2446,16 +2466,17 @@ static netdev_tx_t mvneta_tx(struct sk_buff *skb, struct net_device *dev)
+ goto out;
+ }
+
++ buf->type = MVNETA_TYPE_SKB;
+ if (frags == 1) {
+ /* First and Last descriptor */
+ tx_cmd |= MVNETA_TXD_FLZ_DESC;
+ tx_desc->command = tx_cmd;
+- txq->tx_skb[txq->txq_put_index] = skb;
++ buf->skb = skb;
+ mvneta_txq_inc_put(txq);
+ } else {
+ /* First but not Last */
+ tx_cmd |= MVNETA_TXD_F_DESC;
+- txq->tx_skb[txq->txq_put_index] = NULL;
++ buf->skb = NULL;
+ mvneta_txq_inc_put(txq);
+ tx_desc->command = tx_cmd;
+ /* Continue with other skb fragments */
+@@ -3000,9 +3021,8 @@ static int mvneta_txq_sw_init(struct mvneta_port *pp,
+
+ txq->last_desc = txq->size - 1;
+
+- txq->tx_skb = kmalloc_array(txq->size, sizeof(*txq->tx_skb),
+- GFP_KERNEL);
+- if (!txq->tx_skb) {
++ txq->buf = kmalloc_array(txq->size, sizeof(*txq->buf), GFP_KERNEL);
++ if (!txq->buf) {
+ dma_free_coherent(pp->dev->dev.parent,
+ txq->size * MVNETA_DESC_ALIGNED_SIZE,
+ txq->descs, txq->descs_phys);
+@@ -3014,7 +3034,7 @@ static int mvneta_txq_sw_init(struct mvneta_port *pp,
+ txq->size * TSO_HEADER_SIZE,
+ &txq->tso_hdrs_phys, GFP_KERNEL);
+ if (!txq->tso_hdrs) {
+- kfree(txq->tx_skb);
++ kfree(txq->buf);
+ dma_free_coherent(pp->dev->dev.parent,
+ txq->size * MVNETA_DESC_ALIGNED_SIZE,
+ txq->descs, txq->descs_phys);
+@@ -3069,7 +3089,7 @@ static void mvneta_txq_sw_deinit(struct mvneta_port *pp,
+ {
+ struct netdev_queue *nq = netdev_get_tx_queue(pp->dev, txq->id);
+
+- kfree(txq->tx_skb);
++ kfree(txq->buf);
+
+ if (txq->tso_hdrs)
+ dma_free_coherent(pp->dev->dev.parent,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+index 722998d685646..6f1f53f91ed8c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+@@ -109,12 +109,14 @@ static int mlx5e_dcbnl_ieee_getets(struct net_device *netdev,
+ if (!MLX5_CAP_GEN(priv->mdev, ets))
+ return -EOPNOTSUPP;
+
+- ets->ets_cap = mlx5_max_tc(priv->mdev) + 1;
+- for (i = 0; i < ets->ets_cap; i++) {
++ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+ err = mlx5_query_port_prio_tc(mdev, i, &ets->prio_tc[i]);
+ if (err)
+ return err;
++ }
+
++ ets->ets_cap = mlx5_max_tc(priv->mdev) + 1;
++ for (i = 0; i < ets->ets_cap; i++) {
+ err = mlx5_query_port_tc_group(mdev, i, &tc_group[i]);
+ if (err)
+ return err;
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index 69282f31d519e..fe54bcab705f8 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -255,7 +255,7 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ */
+
+ laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
+- if (!laddr) {
++ if (dma_mapping_error(lp->device, laddr)) {
+ pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
+ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+@@ -473,7 +473,7 @@ static bool sonic_alloc_rb(struct net_device *dev, struct sonic_local *lp,
+
+ *new_addr = dma_map_single(lp->device, skb_put(*new_skb, SONIC_RBSIZE),
+ SONIC_RBSIZE, DMA_FROM_DEVICE);
+- if (!*new_addr) {
++ if (dma_mapping_error(lp->device, *new_addr)) {
+ dev_kfree_skb(*new_skb);
+ *new_skb = NULL;
+ return false;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+index 402c1c3d84ce2..5c8eaded6b30d 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+@@ -4403,6 +4403,9 @@ qed_iov_configure_min_tx_rate(struct qed_dev *cdev, int vfid, u32 rate)
+ }
+
+ vf = qed_iov_get_vf_info(QED_LEADING_HWFN(cdev), (u16)vfid, true);
++ if (!vf)
++ return -EINVAL;
++
+ vport_id = vf->vport_id;
+
+ return qed_configure_vport_wfq(cdev, vport_id, rate);
+@@ -5142,7 +5145,7 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
+
+ /* Validate that the VF has a configured vport */
+ vf = qed_iov_get_vf_info(hwfn, i, true);
+- if (!vf->vport_instance)
++ if (!vf || !vf->vport_instance)
+ continue;
+
+ memset(¶ms, 0, sizeof(params));
+diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
+index 76a9b37c8680f..3c764c28d5dbc 100644
+--- a/drivers/net/ethernet/qualcomm/emac/emac.c
++++ b/drivers/net/ethernet/qualcomm/emac/emac.c
+@@ -752,9 +752,15 @@ static int emac_remove(struct platform_device *pdev)
+ struct net_device *netdev = dev_get_drvdata(&pdev->dev);
+ struct emac_adapter *adpt = netdev_priv(netdev);
+
++ netif_carrier_off(netdev);
++ netif_tx_disable(netdev);
++
+ unregister_netdev(netdev);
+ netif_napi_del(&adpt->rx_q.napi);
+
++ free_irq(adpt->irq.irq, &adpt->irq);
++ cancel_work_sync(&adpt->work_thread);
++
+ emac_clks_teardown(adpt);
+
+ put_device(&adpt->phydev->mdio.dev);
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+index 75237c81c63d6..572294678faf0 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+@@ -330,15 +330,17 @@ static int gelic_card_init_chain(struct gelic_card *card,
+
+ /* set up the hardware pointers in each descriptor */
+ for (i = 0; i < no; i++, descr++) {
++ dma_addr_t cpu_addr;
++
+ gelic_descr_set_status(descr, GELIC_DESCR_DMA_NOT_IN_USE);
+- descr->bus_addr =
+- dma_map_single(ctodev(card), descr,
+- GELIC_DESCR_SIZE,
+- DMA_BIDIRECTIONAL);
+
+- if (!descr->bus_addr)
++ cpu_addr = dma_map_single(ctodev(card), descr,
++ GELIC_DESCR_SIZE, DMA_BIDIRECTIONAL);
++
++ if (dma_mapping_error(ctodev(card), cpu_addr))
+ goto iommu_error;
+
++ descr->bus_addr = cpu_to_be32(cpu_addr);
+ descr->next = descr + 1;
+ descr->prev = descr - 1;
+ }
+@@ -378,28 +380,30 @@ iommu_error:
+ *
+ * allocates a new rx skb, iommu-maps it and attaches it to the descriptor.
+ * Activate the descriptor state-wise
++ *
++ * Gelic RX sk_buffs must be aligned to GELIC_NET_RXBUF_ALIGN and the length
++ * must be a multiple of GELIC_NET_RXBUF_ALIGN.
+ */
+ static int gelic_descr_prepare_rx(struct gelic_card *card,
+ struct gelic_descr *descr)
+ {
++ static const unsigned int rx_skb_size =
++ ALIGN(GELIC_NET_MAX_FRAME, GELIC_NET_RXBUF_ALIGN) +
++ GELIC_NET_RXBUF_ALIGN - 1;
++ dma_addr_t cpu_addr;
+ int offset;
+- unsigned int bufsize;
+
+ if (gelic_descr_get_status(descr) != GELIC_DESCR_DMA_NOT_IN_USE)
+ dev_info(ctodev(card), "%s: ERROR status\n", __func__);
+- /* we need to round up the buffer size to a multiple of 128 */
+- bufsize = ALIGN(GELIC_NET_MAX_MTU, GELIC_NET_RXBUF_ALIGN);
+
+- /* and we need to have it 128 byte aligned, therefore we allocate a
+- * bit more */
+- descr->skb = dev_alloc_skb(bufsize + GELIC_NET_RXBUF_ALIGN - 1);
++ descr->skb = netdev_alloc_skb(*card->netdev, rx_skb_size);
+ if (!descr->skb) {
+ descr->buf_addr = 0; /* tell DMAC don't touch memory */
+ dev_info(ctodev(card),
+ "%s:allocate skb failed !!\n", __func__);
+ return -ENOMEM;
+ }
+- descr->buf_size = cpu_to_be32(bufsize);
++ descr->buf_size = cpu_to_be32(rx_skb_size);
+ descr->dmac_cmd_status = 0;
+ descr->result_size = 0;
+ descr->valid_size = 0;
+@@ -410,11 +414,10 @@ static int gelic_descr_prepare_rx(struct gelic_card *card,
+ if (offset)
+ skb_reserve(descr->skb, GELIC_NET_RXBUF_ALIGN - offset);
+ /* io-mmu-map the skb */
+- descr->buf_addr = cpu_to_be32(dma_map_single(ctodev(card),
+- descr->skb->data,
+- GELIC_NET_MAX_MTU,
+- DMA_FROM_DEVICE));
+- if (!descr->buf_addr) {
++ cpu_addr = dma_map_single(ctodev(card), descr->skb->data,
++ GELIC_NET_MAX_FRAME, DMA_FROM_DEVICE);
++ descr->buf_addr = cpu_to_be32(cpu_addr);
++ if (dma_mapping_error(ctodev(card), cpu_addr)) {
+ dev_kfree_skb_any(descr->skb);
+ descr->skb = NULL;
+ dev_info(ctodev(card),
+@@ -794,7 +797,7 @@ static int gelic_descr_prepare_tx(struct gelic_card *card,
+
+ buf = dma_map_single(ctodev(card), skb->data, skb->len, DMA_TO_DEVICE);
+
+- if (!buf) {
++ if (dma_mapping_error(ctodev(card), buf)) {
+ dev_err(ctodev(card),
+ "dma map 2 failed (%p, %i). Dropping packet\n",
+ skb->data, skb->len);
+@@ -930,7 +933,7 @@ static void gelic_net_pass_skb_up(struct gelic_descr *descr,
+ data_error = be32_to_cpu(descr->data_error);
+ /* unmap skb buffer */
+ dma_unmap_single(ctodev(card), be32_to_cpu(descr->buf_addr),
+- GELIC_NET_MAX_MTU,
++ GELIC_NET_MAX_FRAME,
+ DMA_FROM_DEVICE);
+
+ skb_put(skb, be32_to_cpu(descr->valid_size)?
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+index fbbf9b54b173b..0e592fc19f6c5 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+@@ -32,8 +32,9 @@
+ #define GELIC_NET_RX_DESCRIPTORS 128 /* num of descriptors */
+ #define GELIC_NET_TX_DESCRIPTORS 128 /* num of descriptors */
+
+-#define GELIC_NET_MAX_MTU VLAN_ETH_FRAME_LEN
+-#define GELIC_NET_MIN_MTU VLAN_ETH_ZLEN
++#define GELIC_NET_MAX_FRAME 2312
++#define GELIC_NET_MAX_MTU 2294
++#define GELIC_NET_MIN_MTU 64
+ #define GELIC_NET_RXBUF_ALIGN 128
+ #define GELIC_CARD_RX_CSUM_DEFAULT 1 /* hw chksum */
+ #define GELIC_NET_WATCHDOG_TIMEOUT 5*HZ
+diff --git a/drivers/net/ethernet/xircom/xirc2ps_cs.c b/drivers/net/ethernet/xircom/xirc2ps_cs.c
+index fd5288ff53b53..e3438cef5f9c6 100644
+--- a/drivers/net/ethernet/xircom/xirc2ps_cs.c
++++ b/drivers/net/ethernet/xircom/xirc2ps_cs.c
+@@ -503,6 +503,11 @@ static void
+ xirc2ps_detach(struct pcmcia_device *link)
+ {
+ struct net_device *dev = link->priv;
++ struct local_info *local = netdev_priv(dev);
++
++ netif_carrier_off(dev);
++ netif_tx_disable(dev);
++ cancel_work_sync(&local->tx_timeout_task);
+
+ dev_dbg(&link->dev, "detach\n");
+
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index 917edb3d04b78..f75faec23cc98 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -1943,10 +1943,9 @@ static int ca8210_skb_tx(
+ struct ca8210_priv *priv
+ )
+ {
+- int status;
+ struct ieee802154_hdr header = { };
+ struct secspec secspec;
+- unsigned int mac_len;
++ int mac_len, status;
+
+ dev_dbg(&priv->spi->dev, "%s called\n", __func__);
+
+@@ -1954,6 +1953,8 @@ static int ca8210_skb_tx(
+ * packet
+ */
+ mac_len = ieee802154_hdr_peek_addrs(skb, &header);
++ if (mac_len < 0)
++ return mac_len;
+
+ secspec.security_level = header.sec.level;
+ secspec.key_id_mode = header.sec.key_id_mode;
+diff --git a/drivers/net/phy/mdio-thunder.c b/drivers/net/phy/mdio-thunder.c
+index c0c922eff760c..959bf342133a7 100644
+--- a/drivers/net/phy/mdio-thunder.c
++++ b/drivers/net/phy/mdio-thunder.c
+@@ -107,6 +107,7 @@ static int thunder_mdiobus_pci_probe(struct pci_dev *pdev,
+ if (i >= ARRAY_SIZE(nexus->buses))
+ break;
+ }
++ fwnode_handle_put(fwn);
+ return 0;
+
+ err_release_regions:
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 5194b2ccd4b75..e61f02f7642ce 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -256,6 +256,9 @@ struct tun_struct {
+ struct tun_prog __rcu *steering_prog;
+ struct tun_prog __rcu *filter_prog;
+ struct ethtool_link_ksettings link_ksettings;
++ /* init args */
++ struct file *file;
++ struct ifreq *ifr;
+ };
+
+ struct veth {
+@@ -281,6 +284,9 @@ void *tun_ptr_to_xdp(void *ptr)
+ }
+ EXPORT_SYMBOL(tun_ptr_to_xdp);
+
++static void tun_flow_init(struct tun_struct *tun);
++static void tun_flow_uninit(struct tun_struct *tun);
++
+ static int tun_napi_receive(struct napi_struct *napi, int budget)
+ {
+ struct tun_file *tfile = container_of(napi, struct tun_file, napi);
+@@ -1038,6 +1044,49 @@ static int check_filter(struct tap_filter *filter, const struct sk_buff *skb)
+
+ static const struct ethtool_ops tun_ethtool_ops;
+
++static int tun_net_init(struct net_device *dev)
++{
++ struct tun_struct *tun = netdev_priv(dev);
++ struct ifreq *ifr = tun->ifr;
++ int err;
++
++ tun->pcpu_stats = netdev_alloc_pcpu_stats(struct tun_pcpu_stats);
++ if (!tun->pcpu_stats)
++ return -ENOMEM;
++
++ spin_lock_init(&tun->lock);
++
++ err = security_tun_dev_alloc_security(&tun->security);
++ if (err < 0) {
++ free_percpu(tun->pcpu_stats);
++ return err;
++ }
++
++ tun_flow_init(tun);
++
++ dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST |
++ TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
++ NETIF_F_HW_VLAN_STAG_TX;
++ dev->features = dev->hw_features | NETIF_F_LLTX;
++ dev->vlan_features = dev->features &
++ ~(NETIF_F_HW_VLAN_CTAG_TX |
++ NETIF_F_HW_VLAN_STAG_TX);
++
++ tun->flags = (tun->flags & ~TUN_FEATURES) |
++ (ifr->ifr_flags & TUN_FEATURES);
++
++ INIT_LIST_HEAD(&tun->disabled);
++ err = tun_attach(tun, tun->file, false, ifr->ifr_flags & IFF_NAPI,
++ ifr->ifr_flags & IFF_NAPI_FRAGS, false);
++ if (err < 0) {
++ tun_flow_uninit(tun);
++ security_tun_dev_free_security(tun->security);
++ free_percpu(tun->pcpu_stats);
++ return err;
++ }
++ return 0;
++}
++
+ /* Net device detach from fd. */
+ static void tun_net_uninit(struct net_device *dev)
+ {
+@@ -1268,6 +1317,7 @@ static int tun_xdp(struct net_device *dev, struct netdev_bpf *xdp)
+ }
+
+ static const struct net_device_ops tun_netdev_ops = {
++ .ndo_init = tun_net_init,
+ .ndo_uninit = tun_net_uninit,
+ .ndo_open = tun_net_open,
+ .ndo_stop = tun_net_close,
+@@ -1347,6 +1397,7 @@ static int tun_xdp_tx(struct net_device *dev, struct xdp_buff *xdp)
+ }
+
+ static const struct net_device_ops tap_netdev_ops = {
++ .ndo_init = tun_net_init,
+ .ndo_uninit = tun_net_uninit,
+ .ndo_open = tun_net_open,
+ .ndo_stop = tun_net_close,
+@@ -1386,7 +1437,7 @@ static void tun_flow_uninit(struct tun_struct *tun)
+ #define MAX_MTU 65535
+
+ /* Initialize net device. */
+-static void tun_net_init(struct net_device *dev)
++static void tun_net_initialize(struct net_device *dev)
+ {
+ struct tun_struct *tun = netdev_priv(dev);
+
+@@ -2658,9 +2709,6 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
+
+ if (!dev)
+ return -ENOMEM;
+- err = dev_get_valid_name(net, dev, name);
+- if (err < 0)
+- goto err_free_dev;
+
+ dev_net_set(dev, net);
+ dev->rtnl_link_ops = &tun_link_ops;
+@@ -2679,41 +2727,16 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
+ tun->rx_batched = 0;
+ RCU_INIT_POINTER(tun->steering_prog, NULL);
+
+- tun->pcpu_stats = netdev_alloc_pcpu_stats(struct tun_pcpu_stats);
+- if (!tun->pcpu_stats) {
+- err = -ENOMEM;
+- goto err_free_dev;
+- }
+-
+- spin_lock_init(&tun->lock);
+-
+- err = security_tun_dev_alloc_security(&tun->security);
+- if (err < 0)
+- goto err_free_stat;
+-
+- tun_net_init(dev);
+- tun_flow_init(tun);
+-
+- dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST |
+- TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
+- NETIF_F_HW_VLAN_STAG_TX;
+- dev->features = dev->hw_features | NETIF_F_LLTX;
+- dev->vlan_features = dev->features &
+- ~(NETIF_F_HW_VLAN_CTAG_TX |
+- NETIF_F_HW_VLAN_STAG_TX);
++ tun->ifr = ifr;
++ tun->file = file;
+
+- tun->flags = (tun->flags & ~TUN_FEATURES) |
+- (ifr->ifr_flags & TUN_FEATURES);
+-
+- INIT_LIST_HEAD(&tun->disabled);
+- err = tun_attach(tun, file, false, ifr->ifr_flags & IFF_NAPI,
+- ifr->ifr_flags & IFF_NAPI_FRAGS, false);
+- if (err < 0)
+- goto err_free_flow;
++ tun_net_initialize(dev);
+
+ err = register_netdevice(tun->dev);
+- if (err < 0)
+- goto err_detach;
++ if (err < 0) {
++ free_netdev(dev);
++ return err;
++ }
+ /* free_netdev() won't check refcnt, to aovid race
+ * with dev_put() we need publish tun after registration.
+ */
+@@ -2732,20 +2755,6 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
+
+ strcpy(ifr->ifr_name, tun->dev->name);
+ return 0;
+-
+-err_detach:
+- tun_detach_all(dev);
+- /* register_netdevice() already called tun_free_netdev() */
+- goto err_free_dev;
+-
+-err_free_flow:
+- tun_flow_uninit(tun);
+- security_tun_dev_free_security(tun->security);
+-err_free_stat:
+- free_percpu(tun->pcpu_stats);
+-err_free_dev:
+- free_netdev(dev);
+- return err;
+ }
+
+ static void tun_get_iff(struct net *net, struct tun_struct *tun,
+diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
+index 41bac861ca99d..72a93dc2df868 100644
+--- a/drivers/net/usb/cdc_mbim.c
++++ b/drivers/net/usb/cdc_mbim.c
+@@ -665,6 +665,11 @@ static const struct usb_device_id mbim_devs[] = {
+ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
+ },
+
++ /* Telit FE990 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1081, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
++ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
++ },
++
+ /* default entry */
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+ .driver_info = (unsigned long)&cdc_mbim_info_zlp,
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 24ce49b311c4c..5417932242e77 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1322,6 +1322,7 @@ static const struct usb_device_id products[] = {
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */
+ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */
+ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */
+ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
+diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
+index 4f29010e1aeff..0850486864135 100644
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -1950,6 +1950,12 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ size = (u16)((header & RX_STS_FL_) >> 16);
+ align_count = (4 - ((size + NET_IP_ALIGN) % 4)) % 4;
+
++ if (unlikely(size > skb->len)) {
++ netif_dbg(dev, rx_err, dev->net,
++ "size err header=0x%08x\n", header);
++ return 0;
++ }
++
+ if (unlikely(header & RX_STS_ES_)) {
+ netif_dbg(dev, rx_err, dev->net,
+ "Error header=0x%08x\n", header);
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 92d30ebdb1112..2b984c5bae24f 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -166,7 +166,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */
+ struct pending_tx_info pending_tx_info[MAX_PENDING_REQS];
+ grant_handle_t grant_tx_handle[MAX_PENDING_REQS];
+
+- struct gnttab_copy tx_copy_ops[MAX_PENDING_REQS];
++ struct gnttab_copy tx_copy_ops[2 * MAX_PENDING_REQS];
+ struct gnttab_map_grant_ref tx_map_ops[MAX_PENDING_REQS];
+ struct gnttab_unmap_grant_ref tx_unmap_ops[MAX_PENDING_REQS];
+ /* passed to gnttab_[un]map_refs with pages under (un)mapping */
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index fc389f2bba7aa..ed644b6824cef 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -327,6 +327,7 @@ static int xenvif_count_requests(struct xenvif_queue *queue,
+ struct xenvif_tx_cb {
+ u16 copy_pending_idx[XEN_NETBK_LEGACY_SLOTS_MAX + 1];
+ u8 copy_count;
++ u32 split_mask;
+ };
+
+ #define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb)
+@@ -354,6 +355,8 @@ static inline struct sk_buff *xenvif_alloc_skb(unsigned int size)
+ struct sk_buff *skb =
+ alloc_skb(size + NET_SKB_PAD + NET_IP_ALIGN,
+ GFP_ATOMIC | __GFP_NOWARN);
++
++ BUILD_BUG_ON(sizeof(*XENVIF_TX_CB(skb)) > sizeof(skb->cb));
+ if (unlikely(skb == NULL))
+ return NULL;
+
+@@ -389,11 +392,13 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
+ nr_slots = shinfo->nr_frags + 1;
+
+ copy_count(skb) = 0;
++ XENVIF_TX_CB(skb)->split_mask = 0;
+
+ /* Create copy ops for exactly data_len bytes into the skb head. */
+ __skb_put(skb, data_len);
+ while (data_len > 0) {
+ int amount = data_len > txp->size ? txp->size : data_len;
++ bool split = false;
+
+ cop->source.u.ref = txp->gref;
+ cop->source.domid = queue->vif->domid;
+@@ -406,6 +411,13 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
+ cop->dest.u.gmfn = virt_to_gfn(skb->data + skb_headlen(skb)
+ - data_len);
+
++ /* Don't cross local page boundary! */
++ if (cop->dest.offset + amount > XEN_PAGE_SIZE) {
++ amount = XEN_PAGE_SIZE - cop->dest.offset;
++ XENVIF_TX_CB(skb)->split_mask |= 1U << copy_count(skb);
++ split = true;
++ }
++
+ cop->len = amount;
+ cop->flags = GNTCOPY_source_gref;
+
+@@ -413,7 +425,8 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
+ pending_idx = queue->pending_ring[index];
+ callback_param(queue, pending_idx).ctx = NULL;
+ copy_pending_idx(skb, copy_count(skb)) = pending_idx;
+- copy_count(skb)++;
++ if (!split)
++ copy_count(skb)++;
+
+ cop++;
+ data_len -= amount;
+@@ -434,7 +447,8 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
+ nr_slots--;
+ } else {
+ /* The copy op partially covered the tx_request.
+- * The remainder will be mapped.
++ * The remainder will be mapped or copied in the next
++ * iteration.
+ */
+ txp->offset += amount;
+ txp->size -= amount;
+@@ -532,6 +546,13 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
+ pending_idx = copy_pending_idx(skb, i);
+
+ newerr = (*gopp_copy)->status;
++
++ /* Split copies need to be handled together. */
++ if (XENVIF_TX_CB(skb)->split_mask & (1U << i)) {
++ (*gopp_copy)++;
++ if (!newerr)
++ newerr = (*gopp_copy)->status;
++ }
+ if (likely(!newerr)) {
+ /* The first frag might still have this slot mapped */
+ if (i < copy_count(skb) - 1 || !sharedslot)
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index 89d88e447d44f..5b883eb49ce92 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -1080,7 +1080,6 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
+ dev_err(dev, "can't add the irq domain\n");
+ return -ENODEV;
+ }
+- atmel_pioctrl->irq_domain->name = "atmel gpio";
+
+ for (i = 0; i < atmel_pioctrl->npins; i++) {
+ int irq = irq_create_mapping(atmel_pioctrl->irq_domain, i);
+diff --git a/drivers/power/supply/da9150-charger.c b/drivers/power/supply/da9150-charger.c
+index 60099815296e7..b2d38eb32288a 100644
+--- a/drivers/power/supply/da9150-charger.c
++++ b/drivers/power/supply/da9150-charger.c
+@@ -666,6 +666,7 @@ static int da9150_charger_remove(struct platform_device *pdev)
+
+ if (!IS_ERR_OR_NULL(charger->usb_phy))
+ usb_unregister_notifier(charger->usb_phy, &charger->otg_nb);
++ cancel_work_sync(&charger->otg_work);
+
+ power_supply_unregister(charger->battery);
+ power_supply_unregister(charger->usb);
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index 4cf7c3348bffe..9be913c19a6e0 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -1050,10 +1050,12 @@ static int alua_activate(struct scsi_device *sdev,
+ rcu_read_unlock();
+ mutex_unlock(&h->init_mutex);
+
+- if (alua_rtpg_queue(pg, sdev, qdata, true))
++ if (alua_rtpg_queue(pg, sdev, qdata, true)) {
+ fn = NULL;
+- else
++ } else {
++ kfree(qdata);
+ err = SCSI_DH_DEV_OFFLINED;
++ }
+ kref_put(&pg->kref, release_port_group);
+ out:
+ if (fn)
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index bdb12bf0d5c75..b400167f9ad42 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -4367,7 +4367,7 @@ int megasas_task_abort_fusion(struct scsi_cmnd *scmd)
+ devhandle = megasas_get_tm_devhandle(scmd->device);
+
+ if (devhandle == (u16)ULONG_MAX) {
+- ret = SUCCESS;
++ ret = FAILED;
+ sdev_printk(KERN_INFO, scmd->device,
+ "task abort issued for invalid devhandle\n");
+ mutex_unlock(&instance->reset_mutex);
+@@ -4440,7 +4440,7 @@ int megasas_reset_target_fusion(struct scsi_cmnd *scmd)
+ devhandle = megasas_get_tm_devhandle(scmd->device);
+
+ if (devhandle == (u16)ULONG_MAX) {
+- ret = SUCCESS;
++ ret = FAILED;
+ sdev_printk(KERN_INFO, scmd->device,
+ "target reset issued for invalid devhandle\n");
+ mutex_unlock(&instance->reset_mutex);
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index 6a2a413cc97e0..d8557a00e1ecf 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -232,6 +232,7 @@ static struct {
+ {"SGI", "RAID5", "*", BLIST_SPARSELUN},
+ {"SGI", "TP9100", "*", BLIST_REPORTLUN2},
+ {"SGI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
++ {"SKhynix", "H28U74301AMR", NULL, BLIST_SKIP_VPD_PAGES},
+ {"IBM", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+ {"SUN", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+ {"DELL", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index abc156cf05f60..b45cd6c98bad7 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -8228,5 +8228,6 @@ EXPORT_SYMBOL_GPL(ufshcd_init);
+ MODULE_AUTHOR("Santosh Yaragnavi <santosh.sy@samsung.com>");
+ MODULE_AUTHOR("Vinayak Holikatti <h.vinayak@samsung.com>");
+ MODULE_DESCRIPTION("Generic UFS host controller driver Core");
++MODULE_SOFTDEP("pre: governor_simpleondemand");
+ MODULE_LICENSE("GPL");
+ MODULE_VERSION(UFSHCD_DRIVER_VERSION);
+diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
+index 29a37b242d30a..01f93de93c8c7 100644
+--- a/drivers/target/iscsi/iscsi_target_parameters.c
++++ b/drivers/target/iscsi/iscsi_target_parameters.c
+@@ -1270,18 +1270,20 @@ static struct iscsi_param *iscsi_check_key(
+ return param;
+
+ if (!(param->phase & phase)) {
+- pr_err("Key \"%s\" may not be negotiated during ",
+- param->name);
++ char *phase_name;
++
+ switch (phase) {
+ case PHASE_SECURITY:
+- pr_debug("Security phase.\n");
++ phase_name = "Security";
+ break;
+ case PHASE_OPERATIONAL:
+- pr_debug("Operational phase.\n");
++ phase_name = "Operational";
+ break;
+ default:
+- pr_debug("Unknown phase.\n");
++ phase_name = "Unknown";
+ }
++ pr_err("Key \"%s\" may not be negotiated during %s phase.\n",
++ param->name, phase_name);
+ return NULL;
+ }
+
+diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
+index 384623c49cfee..d22c7216d68ca 100644
+--- a/drivers/thunderbolt/nhi.c
++++ b/drivers/thunderbolt/nhi.c
+@@ -38,7 +38,7 @@
+
+ #define NHI_MAILBOX_TIMEOUT 500 /* ms */
+
+-static int ring_interrupt_index(struct tb_ring *ring)
++static int ring_interrupt_index(const struct tb_ring *ring)
+ {
+ int bit = ring->hop;
+ if (!ring->is_tx)
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index 47ffb485ff34c..59d85bdd132bd 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -43,6 +43,7 @@ struct xencons_info {
+ int irq;
+ int vtermno;
+ grant_ref_t gntref;
++ spinlock_t ring_lock;
+ };
+
+ static LIST_HEAD(xenconsoles);
+@@ -89,12 +90,15 @@ static int __write_console(struct xencons_info *xencons,
+ XENCONS_RING_IDX cons, prod;
+ struct xencons_interface *intf = xencons->intf;
+ int sent = 0;
++ unsigned long flags;
+
++ spin_lock_irqsave(&xencons->ring_lock, flags);
+ cons = intf->out_cons;
+ prod = intf->out_prod;
+ mb(); /* update queue values before going on */
+
+ if ((prod - cons) > sizeof(intf->out)) {
++ spin_unlock_irqrestore(&xencons->ring_lock, flags);
+ pr_err_once("xencons: Illegal ring page indices");
+ return -EINVAL;
+ }
+@@ -104,6 +108,7 @@ static int __write_console(struct xencons_info *xencons,
+
+ wmb(); /* write ring before updating pointer */
+ intf->out_prod = prod;
++ spin_unlock_irqrestore(&xencons->ring_lock, flags);
+
+ if (sent)
+ notify_daemon(xencons);
+@@ -146,16 +151,19 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len)
+ int recv = 0;
+ struct xencons_info *xencons = vtermno_to_xencons(vtermno);
+ unsigned int eoiflag = 0;
++ unsigned long flags;
+
+ if (xencons == NULL)
+ return -EINVAL;
+ intf = xencons->intf;
+
++ spin_lock_irqsave(&xencons->ring_lock, flags);
+ cons = intf->in_cons;
+ prod = intf->in_prod;
+ mb(); /* get pointers before reading ring */
+
+ if ((prod - cons) > sizeof(intf->in)) {
++ spin_unlock_irqrestore(&xencons->ring_lock, flags);
+ pr_err_once("xencons: Illegal ring page indices");
+ return -EINVAL;
+ }
+@@ -179,10 +187,13 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len)
+ xencons->out_cons = intf->out_cons;
+ xencons->out_cons_same = 0;
+ }
++ if (!recv && xencons->out_cons_same++ > 1) {
++ eoiflag = XEN_EOI_FLAG_SPURIOUS;
++ }
++ spin_unlock_irqrestore(&xencons->ring_lock, flags);
++
+ if (recv) {
+ notify_daemon(xencons);
+- } else if (xencons->out_cons_same++ > 1) {
+- eoiflag = XEN_EOI_FLAG_SPURIOUS;
+ }
+
+ xen_irq_lateeoi(xencons->irq, eoiflag);
+@@ -239,6 +250,7 @@ static int xen_hvm_console_init(void)
+ info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL);
+ if (!info)
+ return -ENOMEM;
++ spin_lock_init(&info->ring_lock);
+ } else if (info->intf != NULL) {
+ /* already configured */
+ return 0;
+@@ -275,6 +287,7 @@ err:
+
+ static int xencons_info_pv_init(struct xencons_info *info, int vtermno)
+ {
++ spin_lock_init(&info->ring_lock);
+ info->evtchn = xen_start_info->console.domU.evtchn;
+ /* GFN == MFN for PV guest */
+ info->intf = gfn_to_virt(xen_start_info->console.domU.mfn);
+@@ -325,6 +338,7 @@ static int xen_initial_domain_console_init(void)
+ info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL);
+ if (!info)
+ return -ENOMEM;
++ spin_lock_init(&info->ring_lock);
+ }
+
+ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
+@@ -482,6 +496,7 @@ static int xencons_probe(struct xenbus_device *dev,
+ info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL);
+ if (!info)
+ return -ENOMEM;
++ spin_lock_init(&info->ring_lock);
+ dev_set_drvdata(&dev->dev, info);
+ info->xbdev = dev;
+ info->vtermno = xenbus_devid_to_vtermno(devid);
+diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h
+index 6a2cc5cd0281d..d0e9f3265f5a0 100644
+--- a/drivers/usb/chipidea/ci.h
++++ b/drivers/usb/chipidea/ci.h
+@@ -202,6 +202,7 @@ struct hw_bank {
+ * @in_lpm: if the core in low power mode
+ * @wakeup_int: if wakeup interrupt occur
+ * @rev: The revision number for controller
++ * @mutex: protect code from concorrent running when doing role switch
+ */
+ struct ci_hdrc {
+ struct device *dev;
+@@ -254,6 +255,7 @@ struct ci_hdrc {
+ bool in_lpm;
+ bool wakeup_int;
+ enum ci_revision rev;
++ struct mutex mutex;
+ };
+
+ static inline struct ci_role_driver *ci_role(struct ci_hdrc *ci)
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index c13f9a153a5c6..3fd1073a345db 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -872,9 +872,16 @@ static ssize_t role_store(struct device *dev,
+ strlen(ci->roles[role]->name)))
+ break;
+
+- if (role == CI_ROLE_END || role == ci->role)
++ if (role == CI_ROLE_END)
+ return -EINVAL;
+
++ mutex_lock(&ci->mutex);
++
++ if (role == ci->role) {
++ mutex_unlock(&ci->mutex);
++ return n;
++ }
++
+ pm_runtime_get_sync(dev);
+ disable_irq(ci->irq);
+ ci_role_stop(ci);
+@@ -883,6 +890,7 @@ static ssize_t role_store(struct device *dev,
+ ci_handle_vbus_change(ci);
+ enable_irq(ci->irq);
+ pm_runtime_put_sync(dev);
++ mutex_unlock(&ci->mutex);
+
+ return (ret == 0) ? n : ret;
+ }
+@@ -921,6 +929,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ spin_lock_init(&ci->lock);
++ mutex_init(&ci->mutex);
+ ci->dev = dev;
+ ci->platdata = dev_get_platdata(dev);
+ ci->imx28_write_fix = !!(ci->platdata->flags &
+diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
+index f25d4827fd49c..a714cf3f0ab7a 100644
+--- a/drivers/usb/chipidea/otg.c
++++ b/drivers/usb/chipidea/otg.c
+@@ -164,8 +164,10 @@ static int hw_wait_vbus_lower_bsv(struct ci_hdrc *ci)
+
+ static void ci_handle_id_switch(struct ci_hdrc *ci)
+ {
+- enum ci_role role = ci_otg_role(ci);
++ enum ci_role role;
+
++ mutex_lock(&ci->mutex);
++ role = ci_otg_role(ci);
+ if (role != ci->role) {
+ dev_dbg(ci->dev, "switching from %s to %s\n",
+ ci_role(ci)->name, ci->roles[role]->name);
+@@ -188,6 +190,7 @@ static void ci_handle_id_switch(struct ci_hdrc *ci)
+ if (role == CI_ROLE_GADGET)
+ ci_handle_vbus_change(ci);
+ }
++ mutex_unlock(&ci->mutex);
+ }
+ /**
+ * ci_otg_work - perform otg (vbus/id) event handle
+diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
+index 168303f21bf45..3136a239e7828 100644
+--- a/drivers/usb/gadget/function/u_audio.c
++++ b/drivers/usb/gadget/function/u_audio.c
+@@ -626,7 +626,7 @@ void g_audio_cleanup(struct g_audio *g_audio)
+ uac = g_audio->uac;
+ card = uac->card;
+ if (card)
+- snd_card_free(card);
++ snd_card_free_when_closed(card);
+
+ kfree(uac->p_prm.ureq);
+ kfree(uac->c_prm.ureq);
+diff --git a/drivers/usb/host/ohci-pxa27x.c b/drivers/usb/host/ohci-pxa27x.c
+index 3e24749597359..7679fb583e416 100644
+--- a/drivers/usb/host/ohci-pxa27x.c
++++ b/drivers/usb/host/ohci-pxa27x.c
+@@ -148,7 +148,7 @@ static int pxa27x_ohci_select_pmm(struct pxa27x_ohci *pxa_ohci, int mode)
+ uhcrhda |= RH_A_NPS;
+ break;
+ case PMM_GLOBAL_MODE:
+- uhcrhda &= ~(RH_A_NPS & RH_A_PSM);
++ uhcrhda &= ~(RH_A_NPS | RH_A_PSM);
+ break;
+ case PMM_PERPORT_MODE:
+ uhcrhda &= ~(RH_A_NPS);
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index d4fa29b623ff9..a4513dd931b27 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -111,6 +111,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_BROKEN_FUA),
+
++/* Reported by: Yaroslav Furman <yaro330@gmail.com> */
++UNUSUAL_DEV(0x152d, 0x0583, 0x0000, 0x9999,
++ "JMicron",
++ "JMS583Gen 2",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_REPORT_OPCODES),
++
+ /* Reported-by: Thinh Nguyen <thinhn@synopsys.com> */
+ UNUSUAL_DEV(0x154b, 0xf00b, 0x0000, 0x9999,
+ "PNY",
+diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c
+index 3872ccef4cb2c..f8e83a9519189 100644
+--- a/drivers/video/fbdev/au1200fb.c
++++ b/drivers/video/fbdev/au1200fb.c
+@@ -1039,6 +1039,9 @@ static int au1200fb_fb_check_var(struct fb_var_screeninfo *var,
+ u32 pixclock;
+ int screen_size, plane;
+
++ if (!var->pixclock)
++ return -EINVAL;
++
+ plane = fbdev->plane;
+
+ /* Make sure that the mode respect all LCD controller and
+diff --git a/drivers/video/fbdev/geode/lxfb_core.c b/drivers/video/fbdev/geode/lxfb_core.c
+index 138da6cb6cbcd..4345246b4c798 100644
+--- a/drivers/video/fbdev/geode/lxfb_core.c
++++ b/drivers/video/fbdev/geode/lxfb_core.c
+@@ -247,6 +247,9 @@ static void get_modedb(struct fb_videomode **modedb, unsigned int *size)
+
+ static int lxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ {
++ if (!var->pixclock)
++ return -EINVAL;
++
+ if (var->xres > 1920 || var->yres > 1440)
+ return -EINVAL;
+
+diff --git a/drivers/video/fbdev/intelfb/intelfbdrv.c b/drivers/video/fbdev/intelfb/intelfbdrv.c
+index d7463a2a5d83f..c97c0c8514809 100644
+--- a/drivers/video/fbdev/intelfb/intelfbdrv.c
++++ b/drivers/video/fbdev/intelfb/intelfbdrv.c
+@@ -1215,6 +1215,9 @@ static int intelfb_check_var(struct fb_var_screeninfo *var,
+
+ dinfo = GET_DINFO(info);
+
++ if (!var->pixclock)
++ return -EINVAL;
++
+ /* update the pitch */
+ if (intelfbhw_validate_mode(dinfo, var) != 0)
+ return -EINVAL;
+diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
+index fbeeed5afe350..aa502b3ba25ae 100644
+--- a/drivers/video/fbdev/nvidia/nvidia.c
++++ b/drivers/video/fbdev/nvidia/nvidia.c
+@@ -766,6 +766,8 @@ static int nvidiafb_check_var(struct fb_var_screeninfo *var,
+ int pitch, err = 0;
+
+ NVTRACE_ENTER();
++ if (!var->pixclock)
++ return -EINVAL;
+
+ var->transp.offset = 0;
+ var->transp.length = 0;
+diff --git a/drivers/video/fbdev/tgafb.c b/drivers/video/fbdev/tgafb.c
+index 65ba9921506e2..9d2912947eef6 100644
+--- a/drivers/video/fbdev/tgafb.c
++++ b/drivers/video/fbdev/tgafb.c
+@@ -166,6 +166,9 @@ tgafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ {
+ struct tga_par *par = (struct tga_par *)info->par;
+
++ if (!var->pixclock)
++ return -EINVAL;
++
+ if (par->tga_type == TGA_TYPE_8PLANE) {
+ if (var->bits_per_pixel != 8)
+ return -EINVAL;
+diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
+index f047e87871a1c..c1d5daa4b351d 100644
+--- a/fs/cifs/cifsfs.h
++++ b/fs/cifs/cifsfs.h
+@@ -121,7 +121,10 @@ extern const struct dentry_operations cifs_ci_dentry_ops;
+ #ifdef CONFIG_CIFS_DFS_UPCALL
+ extern struct vfsmount *cifs_dfs_d_automount(struct path *path);
+ #else
+-#define cifs_dfs_d_automount NULL
++static inline struct vfsmount *cifs_dfs_d_automount(struct path *path)
++{
++ return ERR_PTR(-EREMOTE);
++}
+ #endif
+
+ /* Functions related to symlinks */
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index cb70f0c6aa1b7..d16fd8d1f291f 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -4895,8 +4895,13 @@ CIFSGetDFSRefer(const unsigned int xid, struct cifs_ses *ses,
+ return -ENODEV;
+
+ getDFSRetry:
+- rc = smb_init(SMB_COM_TRANSACTION2, 15, ses->tcon_ipc, (void **) &pSMB,
+- (void **) &pSMBr);
++ /*
++ * Use smb_init_no_reconnect() instead of smb_init() as
++ * CIFSGetDFSRefer() may be called from cifs_reconnect_tcon() and thus
++ * causing an infinite recursion.
++ */
++ rc = smb_init_no_reconnect(SMB_COM_TRANSACTION2, 15, ses->tcon_ipc,
++ (void **)&pSMB, (void **)&pSMBr);
+ if (rc)
+ return rc;
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index f906984eb25b0..118bcb351af91 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -475,7 +475,7 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon)
+ if (rc == -EOPNOTSUPP) {
+ cifs_dbg(FYI,
+ "server does not support query network interfaces\n");
+- goto out;
++ ret_data_len = 0;
+ } else if (rc != 0) {
+ cifs_dbg(VFS, "error %d on ioctl to get interface list\n", rc);
+ goto out;
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index e844d91c461b0..7aaf4dafd3e78 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1428,7 +1428,8 @@ static int ext4_write_end(struct file *file,
+ int inline_data = ext4_has_inline_data(inode);
+
+ trace_ext4_write_end(inode, pos, len, copied);
+- if (inline_data) {
++ if (inline_data &&
++ ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) {
+ ret = ext4_write_inline_data_end(inode, pos, len,
+ copied, page);
+ if (ret < 0) {
+diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
+index c5390421cca29..d9866d89f2fb9 100644
+--- a/fs/gfs2/aops.c
++++ b/fs/gfs2/aops.c
+@@ -480,8 +480,6 @@ int stuffed_readpage(struct gfs2_inode *ip, struct page *page)
+ return error;
+
+ kaddr = kmap_atomic(page);
+- if (dsize > gfs2_max_stuffed_size(ip))
+- dsize = gfs2_max_stuffed_size(ip);
+ memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);
+ memset(kaddr + dsize, 0, PAGE_SIZE - dsize);
+ kunmap_atomic(kaddr);
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 150cec85c416d..ccafd45b63f69 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -72,9 +72,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, struct buffer_head *dibh,
+ void *kaddr = kmap(page);
+ u64 dsize = i_size_read(inode);
+
+- if (dsize > gfs2_max_stuffed_size(ip))
+- dsize = gfs2_max_stuffed_size(ip);
+-
+ memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize);
+ memset(kaddr + dsize, 0, PAGE_SIZE - dsize);
+ kunmap(page);
+diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
+index 20f08f4391c9d..a7a423adf7c8b 100644
+--- a/fs/gfs2/glops.c
++++ b/fs/gfs2/glops.c
+@@ -388,6 +388,9 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
+ ip->i_depth = (u8)depth;
+ ip->i_entries = be32_to_cpu(str->di_entries);
+
++ if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip))
++ goto corrupt;
++
+ if (S_ISREG(ip->i_inode.i_mode))
+ gfs2_set_aops(&ip->i_inode);
+
+diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
+index 708aa1b92036b..dfb2083b8ce1c 100644
+--- a/fs/nilfs2/ioctl.c
++++ b/fs/nilfs2/ioctl.c
+@@ -70,7 +70,7 @@ static int nilfs_ioctl_wrap_copy(struct the_nilfs *nilfs,
+ if (argv->v_index > ~(__u64)0 - argv->v_nmembs)
+ return -EINVAL;
+
+- buf = (void *)__get_free_pages(GFP_NOFS, 0);
++ buf = (void *)get_zeroed_page(GFP_NOFS);
+ if (unlikely(!buf))
+ return -ENOMEM;
+ maxmembs = PAGE_SIZE / argv->v_size;
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
+index b6948813eb063..1353db3f7f48a 100644
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -2003,11 +2003,25 @@ int ocfs2_write_end_nolock(struct address_space *mapping,
+ }
+
+ if (unlikely(copied < len) && wc->w_target_page) {
++ loff_t new_isize;
++
+ if (!PageUptodate(wc->w_target_page))
+ copied = 0;
+
+- ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
+- start+len);
++ new_isize = max_t(loff_t, i_size_read(inode), pos + copied);
++ if (new_isize > page_offset(wc->w_target_page))
++ ocfs2_zero_new_buffers(wc->w_target_page, start+copied,
++ start+len);
++ else {
++ /*
++ * When page is fully beyond new isize (data copy
++ * failed), do not bother zeroing the page. Invalidate
++ * it instead so that writeback does not get confused
++ * put page & buffer dirty bits into inconsistent
++ * state.
++ */
++ block_invalidatepage(wc->w_target_page, 0, PAGE_SIZE);
++ }
+ }
+ if (wc->w_target_page)
+ flush_dcache_page(wc->w_target_page);
+diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
+index 934633a05d209..7f1478c26a33a 100644
+--- a/include/linux/cpuset.h
++++ b/include/linux/cpuset.h
+@@ -40,14 +40,14 @@ static inline bool cpusets_enabled(void)
+
+ static inline void cpuset_inc(void)
+ {
+- static_branch_inc(&cpusets_pre_enable_key);
+- static_branch_inc(&cpusets_enabled_key);
++ static_branch_inc_cpuslocked(&cpusets_pre_enable_key);
++ static_branch_inc_cpuslocked(&cpusets_enabled_key);
+ }
+
+ static inline void cpuset_dec(void)
+ {
+- static_branch_dec(&cpusets_enabled_key);
+- static_branch_dec(&cpusets_pre_enable_key);
++ static_branch_dec_cpuslocked(&cpusets_enabled_key);
++ static_branch_dec_cpuslocked(&cpusets_pre_enable_key);
+ }
+
+ extern int cpuset_init(void);
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 24e16538e4d71..285101772c755 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -603,7 +603,7 @@ static int __init bpf_jit_charge_init(void)
+ {
+ /* Only used as heuristic here to derive limit. */
+ bpf_jit_limit_max = bpf_jit_alloc_exec_limit();
+- bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2,
++ bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 1,
+ PAGE_SIZE), LONG_MAX);
+ return 0;
+ }
+diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
+index 61644976225a9..c0ebb70808b67 100644
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -13,6 +13,7 @@
+ #include <linux/delayacct.h>
+ #include <linux/pid_namespace.h>
+ #include <linux/cgroupstats.h>
++#include <linux/cpu.h>
+
+ #include <trace/events/cgroup.h>
+
+@@ -55,6 +56,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
+ int retval = 0;
+
+ mutex_lock(&cgroup_mutex);
++ get_online_cpus();
+ percpu_down_write(&cgroup_threadgroup_rwsem);
+ for_each_root(root) {
+ struct cgroup *from_cgrp;
+@@ -71,6 +73,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
+ break;
+ }
+ percpu_up_write(&cgroup_threadgroup_rwsem);
++ put_online_cpus();
+ mutex_unlock(&cgroup_mutex);
+
+ return retval;
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index a892a99eb4bfb..a8185cdb8587b 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -55,6 +55,7 @@
+ #include <linux/nsproxy.h>
+ #include <linux/file.h>
+ #include <linux/sched/cputime.h>
++#include <linux/cpu.h>
+ #include <net/sock.h>
+
+ #define CREATE_TRACE_POINTS
+@@ -2209,6 +2210,45 @@ int task_cgroup_path(struct task_struct *task, char *buf, size_t buflen)
+ }
+ EXPORT_SYMBOL_GPL(task_cgroup_path);
+
++/**
++ * cgroup_attach_lock - Lock for ->attach()
++ * @lock_threadgroup: whether to down_write cgroup_threadgroup_rwsem
++ *
++ * cgroup migration sometimes needs to stabilize threadgroups against forks and
++ * exits by write-locking cgroup_threadgroup_rwsem. However, some ->attach()
++ * implementations (e.g. cpuset), also need to disable CPU hotplug.
++ * Unfortunately, letting ->attach() operations acquire cpus_read_lock() can
++ * lead to deadlocks.
++ *
++ * Bringing up a CPU may involve creating and destroying tasks which requires
++ * read-locking threadgroup_rwsem, so threadgroup_rwsem nests inside
++ * cpus_read_lock(). If we call an ->attach() which acquires the cpus lock while
++ * write-locking threadgroup_rwsem, the locking order is reversed and we end up
++ * waiting for an on-going CPU hotplug operation which in turn is waiting for
++ * the threadgroup_rwsem to be released to create new tasks. For more details:
++ *
++ * http://lkml.kernel.org/r/20220711174629.uehfmqegcwn2lqzu@wubuntu
++ *
++ * Resolve the situation by always acquiring cpus_read_lock() before optionally
++ * write-locking cgroup_threadgroup_rwsem. This allows ->attach() to assume that
++ * CPU hotplug is disabled on entry.
++ */
++static void cgroup_attach_lock(void)
++{
++ get_online_cpus();
++ percpu_down_write(&cgroup_threadgroup_rwsem);
++}
++
++/**
++ * cgroup_attach_unlock - Undo cgroup_attach_lock()
++ * @lock_threadgroup: whether to up_write cgroup_threadgroup_rwsem
++ */
++static void cgroup_attach_unlock(void)
++{
++ percpu_up_write(&cgroup_threadgroup_rwsem);
++ put_online_cpus();
++}
++
+ /**
+ * cgroup_migrate_add_task - add a migration target task to a migration context
+ * @task: target task
+@@ -2694,7 +2734,7 @@ struct task_struct *cgroup_procs_write_start(char *buf, bool threadgroup)
+ if (kstrtoint(strstrip(buf), 0, &pid) || pid < 0)
+ return ERR_PTR(-EINVAL);
+
+- percpu_down_write(&cgroup_threadgroup_rwsem);
++ cgroup_attach_lock();
+
+ rcu_read_lock();
+ if (pid) {
+@@ -2725,7 +2765,7 @@ struct task_struct *cgroup_procs_write_start(char *buf, bool threadgroup)
+ goto out_unlock_rcu;
+
+ out_unlock_threadgroup:
+- percpu_up_write(&cgroup_threadgroup_rwsem);
++ cgroup_attach_unlock();
+ out_unlock_rcu:
+ rcu_read_unlock();
+ return tsk;
+@@ -2740,7 +2780,7 @@ void cgroup_procs_write_finish(struct task_struct *task)
+ /* release reference from cgroup_procs_write_start() */
+ put_task_struct(task);
+
+- percpu_up_write(&cgroup_threadgroup_rwsem);
++ cgroup_attach_unlock();
+ for_each_subsys(ss, ssid)
+ if (ss->post_attach)
+ ss->post_attach();
+@@ -2799,7 +2839,7 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
+
+ lockdep_assert_held(&cgroup_mutex);
+
+- percpu_down_write(&cgroup_threadgroup_rwsem);
++ cgroup_attach_lock();
+
+ /* look up all csses currently attached to @cgrp's subtree */
+ spin_lock_irq(&css_set_lock);
+@@ -2830,7 +2870,7 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
+ ret = cgroup_migrate_execute(&mgctx);
+ out_finish:
+ cgroup_migrate_finish(&mgctx);
+- percpu_up_write(&cgroup_threadgroup_rwsem);
++ cgroup_attach_unlock();
+ return ret;
+ }
+
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index dcd5755b1fe2a..c6d412cebc434 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -830,8 +830,8 @@ static void rebuild_sched_domains_locked(void)
+ cpumask_var_t *doms;
+ int ndoms;
+
++ lockdep_assert_cpus_held();
+ lockdep_assert_held(&cpuset_mutex);
+- get_online_cpus();
+
+ /*
+ * We have raced with CPU hotplug. Don't do anything to avoid
+@@ -839,15 +839,13 @@ static void rebuild_sched_domains_locked(void)
+ * Anyways, hotplug work item will rebuild sched domains.
+ */
+ if (!cpumask_equal(top_cpuset.effective_cpus, cpu_active_mask))
+- goto out;
++ return;
+
+ /* Generate domain masks and attrs */
+ ndoms = generate_sched_domains(&doms, &attr);
+
+ /* Have scheduler rebuild the domains */
+ partition_sched_domains(ndoms, doms, attr);
+-out:
+- put_online_cpus();
+ }
+ #else /* !CONFIG_SMP */
+ static void rebuild_sched_domains_locked(void)
+@@ -857,9 +855,11 @@ static void rebuild_sched_domains_locked(void)
+
+ void rebuild_sched_domains(void)
+ {
++ get_online_cpus();
+ mutex_lock(&cpuset_mutex);
+ rebuild_sched_domains_locked();
+ mutex_unlock(&cpuset_mutex);
++ put_online_cpus();
+ }
+
+ /**
+@@ -1528,13 +1528,9 @@ static void cpuset_attach(struct cgroup_taskset *tset)
+ cgroup_taskset_first(tset, &css);
+ cs = css_cs(css);
+
++ lockdep_assert_cpus_held(); /* see cgroup_attach_lock() */
+ mutex_lock(&cpuset_mutex);
+
+- /*
+- * It should hold cpus lock because a cpu offline event can
+- * cause set_cpus_allowed_ptr() failed.
+- */
+- get_online_cpus();
+ /* prepare for attach */
+ if (cs == &top_cpuset)
+ cpumask_copy(cpus_attach, cpu_possible_mask);
+@@ -1553,7 +1549,6 @@ static void cpuset_attach(struct cgroup_taskset *tset)
+ cpuset_change_task_nodemask(task, &cpuset_attach_nodemask_to);
+ cpuset_update_task_spread_flag(cs, task);
+ }
+- put_online_cpus();
+
+ /*
+ * Change mm for all threadgroup leaders. This is expensive and may
+@@ -1617,6 +1612,7 @@ static int cpuset_write_u64(struct cgroup_subsys_state *css, struct cftype *cft,
+ cpuset_filetype_t type = cft->private;
+ int retval = 0;
+
++ get_online_cpus();
+ mutex_lock(&cpuset_mutex);
+ if (!is_cpuset_online(cs)) {
+ retval = -ENODEV;
+@@ -1654,6 +1650,7 @@ static int cpuset_write_u64(struct cgroup_subsys_state *css, struct cftype *cft,
+ }
+ out_unlock:
+ mutex_unlock(&cpuset_mutex);
++ put_online_cpus();
+ return retval;
+ }
+
+@@ -1664,6 +1661,7 @@ static int cpuset_write_s64(struct cgroup_subsys_state *css, struct cftype *cft,
+ cpuset_filetype_t type = cft->private;
+ int retval = -ENODEV;
+
++ get_online_cpus();
+ mutex_lock(&cpuset_mutex);
+ if (!is_cpuset_online(cs))
+ goto out_unlock;
+@@ -1678,6 +1676,7 @@ static int cpuset_write_s64(struct cgroup_subsys_state *css, struct cftype *cft,
+ }
+ out_unlock:
+ mutex_unlock(&cpuset_mutex);
++ put_online_cpus();
+ return retval;
+ }
+
+@@ -1716,6 +1715,7 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of,
+ kernfs_break_active_protection(of->kn);
+ flush_work(&cpuset_hotplug_work);
+
++ get_online_cpus();
+ mutex_lock(&cpuset_mutex);
+ if (!is_cpuset_online(cs))
+ goto out_unlock;
+@@ -1741,6 +1741,7 @@ static ssize_t cpuset_write_resmask(struct kernfs_open_file *of,
+ free_trial_cpuset(trialcs);
+ out_unlock:
+ mutex_unlock(&cpuset_mutex);
++ put_online_cpus();
+ kernfs_unbreak_active_protection(of->kn);
+ css_put(&cs->css);
+ flush_workqueue(cpuset_migrate_mm_wq);
+@@ -1985,6 +1986,7 @@ static int cpuset_css_online(struct cgroup_subsys_state *css)
+ if (!parent)
+ return 0;
+
++ get_online_cpus();
+ mutex_lock(&cpuset_mutex);
+
+ set_bit(CS_ONLINE, &cs->flags);
+@@ -2035,6 +2037,7 @@ static int cpuset_css_online(struct cgroup_subsys_state *css)
+ spin_unlock_irq(&callback_lock);
+ out_unlock:
+ mutex_unlock(&cpuset_mutex);
++ put_online_cpus();
+ return 0;
+ }
+
+@@ -2048,6 +2051,7 @@ static void cpuset_css_offline(struct cgroup_subsys_state *css)
+ {
+ struct cpuset *cs = css_cs(css);
+
++ get_online_cpus();
+ mutex_lock(&cpuset_mutex);
+
+ if (is_sched_load_balance(cs))
+@@ -2057,6 +2061,7 @@ static void cpuset_css_offline(struct cgroup_subsys_state *css)
+ clear_bit(CS_ONLINE, &cs->flags);
+
+ mutex_unlock(&cpuset_mutex);
++ put_online_cpus();
+ }
+
+ static void cpuset_css_free(struct cgroup_subsys_state *css)
+diff --git a/kernel/compat.c b/kernel/compat.c
+index e4548a9e9c52c..5f320b0db8d09 100644
+--- a/kernel/compat.c
++++ b/kernel/compat.c
+@@ -307,7 +307,7 @@ COMPAT_SYSCALL_DEFINE3(sched_getaffinity, compat_pid_t, pid, unsigned int, len,
+ if (len & (sizeof(compat_ulong_t)-1))
+ return -EINVAL;
+
+- if (!alloc_cpumask_var(&mask, GFP_KERNEL))
++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+ return -ENOMEM;
+
+ ret = sched_getaffinity(pid, mask);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 46227cc48124d..8d5a9fa8a951c 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -741,6 +741,9 @@ static inline void dequeue_task(struct rq *rq, struct task_struct *p, int flags)
+
+ void activate_task(struct rq *rq, struct task_struct *p, int flags)
+ {
++ if (task_on_rq_migrating(p))
++ flags |= ENQUEUE_MIGRATED;
++
+ if (task_contributes_to_load(p))
+ rq->nr_uninterruptible--;
+
+@@ -4950,14 +4953,14 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len,
+ if (len & (sizeof(unsigned long)-1))
+ return -EINVAL;
+
+- if (!alloc_cpumask_var(&mask, GFP_KERNEL))
++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+ return -ENOMEM;
+
+ ret = sched_getaffinity(pid, mask);
+ if (ret == 0) {
+ unsigned int retlen = min(len, cpumask_size());
+
+- if (copy_to_user(user_mask_ptr, mask, retlen))
++ if (copy_to_user(user_mask_ptr, cpumask_bits(mask), retlen))
+ ret = -EFAULT;
+ else
+ ret = retlen;
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 84e7efda98daf..eb67f42fb96ba 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -3854,6 +3854,29 @@ static void check_spread(struct cfs_rq *cfs_rq, struct sched_entity *se)
+ #endif
+ }
+
++static inline bool entity_is_long_sleeper(struct sched_entity *se)
++{
++ struct cfs_rq *cfs_rq;
++ u64 sleep_time;
++
++ if (se->exec_start == 0)
++ return false;
++
++ cfs_rq = cfs_rq_of(se);
++
++ sleep_time = rq_clock_task(rq_of(cfs_rq));
++
++ /* Happen while migrating because of clock task divergence */
++ if (sleep_time <= se->exec_start)
++ return false;
++
++ sleep_time -= se->exec_start;
++ if (sleep_time > ((1ULL << 63) / scale_load_down(NICE_0_LOAD)))
++ return true;
++
++ return false;
++}
++
+ static void
+ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
+ {
+@@ -3882,8 +3905,29 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
+ vruntime -= thresh;
+ }
+
+- /* ensure we never gain time by being placed backwards. */
+- se->vruntime = max_vruntime(se->vruntime, vruntime);
++ /*
++ * Pull vruntime of the entity being placed to the base level of
++ * cfs_rq, to prevent boosting it if placed backwards.
++ * However, min_vruntime can advance much faster than real time, with
++ * the extreme being when an entity with the minimal weight always runs
++ * on the cfs_rq. If the waking entity slept for a long time, its
++ * vruntime difference from min_vruntime may overflow s64 and their
++ * comparison may get inversed, so ignore the entity's original
++ * vruntime in that case.
++ * The maximal vruntime speedup is given by the ratio of normal to
++ * minimal weight: scale_load_down(NICE_0_LOAD) / MIN_SHARES.
++ * When placing a migrated waking entity, its exec_start has been set
++ * from a different rq. In order to take into account a possible
++ * divergence between new and prev rq's clocks task because of irq and
++ * stolen time, we take an additional margin.
++ * So, cutting off on the sleep time of
++ * 2^63 / scale_load_down(NICE_0_LOAD) ~ 104 days
++ * should be safe.
++ */
++ if (entity_is_long_sleeper(se))
++ se->vruntime = vruntime;
++ else
++ se->vruntime = max_vruntime(se->vruntime, vruntime);
+ }
+
+ static void check_enqueue_throttle(struct cfs_rq *cfs_rq);
+@@ -3978,6 +4022,9 @@ enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
+
+ if (flags & ENQUEUE_WAKEUP)
+ place_entity(cfs_rq, se, 0);
++ /* Entity has migrated, no longer consider this task hot */
++ if (flags & ENQUEUE_MIGRATED)
++ se->exec_start = 0;
+
+ check_schedstat_required();
+ update_stats_enqueue(cfs_rq, se, flags);
+@@ -6544,9 +6591,6 @@ static void migrate_task_rq_fair(struct task_struct *p, int new_cpu)
+ /* Tell new CPU we are migrated */
+ p->se.avg.last_update_time = 0;
+
+- /* We have migrated, no longer consider this task hot */
+- p->se.exec_start = 0;
+-
+ update_scan_period(p, new_cpu);
+ }
+
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 74e555a22de75..61269cc2fa828 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -935,6 +935,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+
+ cf = op->frames + op->cfsiz * i;
+ err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz);
++ if (err < 0)
++ goto free_op;
+
+ if (op->flags & CAN_FD_FRAME) {
+ if (cf->len > 64)
+@@ -944,12 +946,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ err = -EINVAL;
+ }
+
+- if (err < 0) {
+- if (op->frames != &op->sframe)
+- kfree(op->frames);
+- kfree(op);
+- return err;
+- }
++ if (err < 0)
++ goto free_op;
+
+ if (msg_head->flags & TX_CP_CAN_ID) {
+ /* copy can_id into frame */
+@@ -1020,6 +1018,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ bcm_tx_start_timer(op);
+
+ return msg_head->nframes * op->cfsiz + MHSIZ;
++
++free_op:
++ if (op->frames != &op->sframe)
++ kfree(op->frames);
++ kfree(op);
++ return err;
+ }
+
+ /*
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index c72432ce9bf50..898753328c171 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -603,7 +603,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
+ truncate = true;
+ }
+
+- nhoff = skb_network_header(skb) - skb_mac_header(skb);
++ nhoff = skb_network_offset(skb);
+ if (skb->protocol == htons(ETH_P_IP) &&
+ (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff))
+ truncate = true;
+@@ -612,7 +612,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
+ int thoff;
+
+ if (skb_transport_header_was_set(skb))
+- thoff = skb_transport_header(skb) - skb_mac_header(skb);
++ thoff = skb_transport_offset(skb);
+ else
+ thoff = nhoff + sizeof(struct ipv6hdr);
+ if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff)
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 00601bc4fdfa3..166b7544e54a4 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -961,7 +961,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ truncate = true;
+ }
+
+- nhoff = skb_network_header(skb) - skb_mac_header(skb);
++ nhoff = skb_network_offset(skb);
+ if (skb->protocol == htons(ETH_P_IP) &&
+ (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff))
+ truncate = true;
+@@ -970,7 +970,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ int thoff;
+
+ if (skb_transport_header_was_set(skb))
+- thoff = skb_transport_header(skb) - skb_mac_header(skb);
++ thoff = skb_transport_offset(skb);
+ else
+ thoff = nhoff + sizeof(struct ipv6hdr);
+ if (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff)
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index 0a76ad05e5ae5..2974f7262f882 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -236,6 +236,8 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
+ result = tcf_classify(skb, fl, &res, true);
+ if (!fl || result < 0)
+ goto fallback;
++ if (result == TC_ACT_SHOT)
++ return NULL;
+
+ cl = (void *)res.class;
+ if (!cl) {
+@@ -256,8 +258,6 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
+ case TC_ACT_TRAP:
+ *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+ /* fall through */
+- case TC_ACT_SHOT:
+- return NULL;
+ case TC_ACT_RECLASSIFY:
+ return cbq_reclassify(skb, cl);
+ }
+diff --git a/sound/pci/asihpi/hpi6205.c b/sound/pci/asihpi/hpi6205.c
+index 2864698436a5f..6a49f897c4d91 100644
+--- a/sound/pci/asihpi/hpi6205.c
++++ b/sound/pci/asihpi/hpi6205.c
+@@ -441,7 +441,7 @@ void HPI_6205(struct hpi_message *phm, struct hpi_response *phr)
+ pao = hpi_find_adapter(phm->adapter_index);
+ } else {
+ /* subsys messages don't address an adapter */
+- _HPI_6205(NULL, phm, phr);
++ phr->error = HPI_ERROR_INVALID_OBJ_INDEX;
+ return;
+ }
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index ca8a37388d565..9f0e6bbc523c3 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -3620,8 +3620,10 @@ static int tuning_ctl_set(struct hda_codec *codec, hda_nid_t nid,
+
+ for (i = 0; i < TUNING_CTLS_COUNT; i++)
+ if (nid == ca0132_tuning_ctls[i].nid)
+- break;
++ goto found;
+
++ return -EINVAL;
++found:
+ snd_hda_power_up(codec);
+ dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20,
+ ca0132_tuning_ctls[i].req,
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 69f88d3abf50f..cfa958dc2dd5f 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -952,7 +952,10 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
+- SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_PINCFG_LENOVO_NOTEBOOK),
++ /* NOTE: we'd need to extend the quirk for 17aa:3977 as the same
++ * PCI SSID is used on multiple Lenovo models
++ */
++ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
+@@ -974,6 +977,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = {
+ { .id = CXT_FIXUP_HP_DOCK, .name = "hp-dock" },
+ { .id = CXT_FIXUP_MUTE_LED_GPIO, .name = "mute-led-gpio" },
+ { .id = CXT_FIXUP_HP_MIC_NO_PRESENCE, .name = "hp-mic-fix" },
++ { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" },
+ {}
+ };
+
+diff --git a/sound/usb/format.c b/sound/usb/format.c
+index 01ba7a939ac4b..342d6edb06adf 100644
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -53,8 +53,12 @@ static u64 parse_audio_format_i_type(struct snd_usb_audio *chip,
+ case UAC_VERSION_1:
+ default: {
+ struct uac_format_type_i_discrete_descriptor *fmt = _fmt;
+- if (format >= 64)
+- return 0; /* invalid format */
++ if (format >= 64) {
++ usb_audio_info(chip,
++ "%u:%d: invalid format type 0x%llx is detected, processed as PCM\n",
++ fp->iface, fp->altsetting, format);
++ format = UAC_FORMAT_TYPE_I_PCM;
++ }
+ sample_width = fmt->bBitResolution;
+ sample_bytes = fmt->bSubframeSize;
+ format = 1ULL << format;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-04-20 11:17 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2023-04-20 11:17 UTC (permalink / raw
To: gentoo-commits
commit: 9e58768dd187d71d8ab8699a53e25461b157d5ad
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Thu Apr 20 11:17:36 2023 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Thu Apr 20 11:17:36 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9e58768d
Linux patch 4.19.281
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1280_linux-4.19.281.patch | 1371 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1375 insertions(+)
diff --git a/0000_README b/0000_README
index 8e42df41..4970a0aa 100644
--- a/0000_README
+++ b/0000_README
@@ -1163,6 +1163,10 @@ Patch: 1279_linux-4.19.280.patch
From: https://www.kernel.org
Desc: Linux 4.19.280
+Patch: 1280_linux-4.19.281.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.281
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1280_linux-4.19.281.patch b/1280_linux-4.19.281.patch
new file mode 100644
index 00000000..e541bc45
--- /dev/null
+++ b/1280_linux-4.19.281.patch
@@ -0,0 +1,1371 @@
+diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst
+index 8c0de54b5649b..5aa24f7b78ed9 100644
+--- a/Documentation/sound/hd-audio/models.rst
++++ b/Documentation/sound/hd-audio/models.rst
+@@ -691,7 +691,7 @@ ref
+ no-jd
+ BIOS setup but without jack-detection
+ intel
+- Intel DG45* mobos
++ Intel D*45* mobos
+ dell-m6-amic
+ Dell desktops/laptops with analog mics
+ dell-m6-dmic
+diff --git a/Makefile b/Makefile
+index c70637ed93cd1..5fb104fb2f368 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 280
++SUBLEVEL = 281
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
+index 870e594f95edd..b509afa054701 100644
+--- a/arch/arm64/kvm/guest.c
++++ b/arch/arm64/kvm/guest.c
+@@ -57,9 +57,8 @@ static u64 core_reg_offset_from_id(u64 id)
+ return id & ~(KVM_REG_ARCH_MASK | KVM_REG_SIZE_MASK | KVM_REG_ARM_CORE);
+ }
+
+-static int validate_core_offset(const struct kvm_one_reg *reg)
++static int core_reg_size_from_offset(u64 off)
+ {
+- u64 off = core_reg_offset_from_id(reg->id);
+ int size;
+
+ switch (off) {
+@@ -89,11 +88,24 @@ static int validate_core_offset(const struct kvm_one_reg *reg)
+ return -EINVAL;
+ }
+
+- if (KVM_REG_SIZE(reg->id) == size &&
+- IS_ALIGNED(off, size / sizeof(__u32)))
+- return 0;
++ if (!IS_ALIGNED(off, size / sizeof(__u32)))
++ return -EINVAL;
+
+- return -EINVAL;
++ return size;
++}
++
++static int validate_core_offset(const struct kvm_one_reg *reg)
++{
++ u64 off = core_reg_offset_from_id(reg->id);
++ int size = core_reg_size_from_offset(off);
++
++ if (size < 0)
++ return -EINVAL;
++
++ if (KVM_REG_SIZE(reg->id) != size)
++ return -EINVAL;
++
++ return 0;
+ }
+
+ static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+@@ -200,9 +212,51 @@ int kvm_arch_vcpu_ioctl_set_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs)
+ return -EINVAL;
+ }
+
++static int kvm_arm_copy_core_reg_indices(u64 __user *uindices)
++{
++ unsigned int i;
++ int n = 0;
++
++ for (i = 0; i < sizeof(struct kvm_regs) / sizeof(__u32); i++) {
++ u64 reg = KVM_REG_ARM64 | KVM_REG_ARM_CORE | i;
++ int size = core_reg_size_from_offset(i);
++
++ if (size < 0)
++ continue;
++
++ switch (size) {
++ case sizeof(__u32):
++ reg |= KVM_REG_SIZE_U32;
++ break;
++
++ case sizeof(__u64):
++ reg |= KVM_REG_SIZE_U64;
++ break;
++
++ case sizeof(__uint128_t):
++ reg |= KVM_REG_SIZE_U128;
++ break;
++
++ default:
++ WARN_ON(1);
++ continue;
++ }
++
++ if (uindices) {
++ if (put_user(reg, uindices))
++ return -EFAULT;
++ uindices++;
++ }
++
++ n++;
++ }
++
++ return n;
++}
++
+ static unsigned long num_core_regs(void)
+ {
+- return sizeof(struct kvm_regs) / sizeof(__u32);
++ return kvm_arm_copy_core_reg_indices(NULL);
+ }
+
+ /**
+@@ -276,23 +330,20 @@ unsigned long kvm_arm_num_regs(struct kvm_vcpu *vcpu)
+ */
+ int kvm_arm_copy_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices)
+ {
+- unsigned int i;
+- const u64 core_reg = KVM_REG_ARM64 | KVM_REG_SIZE_U64 | KVM_REG_ARM_CORE;
+ int ret;
+
+- for (i = 0; i < sizeof(struct kvm_regs) / sizeof(__u32); i++) {
+- if (put_user(core_reg | i, uindices))
+- return -EFAULT;
+- uindices++;
+- }
++ ret = kvm_arm_copy_core_reg_indices(uindices);
++ if (ret < 0)
++ return ret;
++ uindices += ret;
+
+ ret = kvm_arm_copy_fw_reg_indices(vcpu, uindices);
+- if (ret)
++ if (ret < 0)
+ return ret;
+ uindices += kvm_arm_get_fw_num_regs(vcpu);
+
+ ret = copy_timer_indices(vcpu, uindices);
+- if (ret)
++ if (ret < 0)
+ return ret;
+ uindices += NUM_TIMER_REGS;
+
+diff --git a/arch/x86/kernel/sysfb_efi.c b/arch/x86/kernel/sysfb_efi.c
+index dd8d7636c5420..5bc0fedb33420 100644
+--- a/arch/x86/kernel/sysfb_efi.c
++++ b/arch/x86/kernel/sysfb_efi.c
+@@ -273,6 +273,14 @@ static const struct dmi_system_id efifb_dmi_swap_width_height[] __initconst = {
+ "IdeaPad Duet 3 10IGL5"),
+ },
+ },
++ {
++ /* Lenovo Yoga Book X91F / X91L */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ /* Non exact match to match F + L versions */
++ DMI_MATCH(DMI_PRODUCT_NAME, "Lenovo YB1-X91"),
++ },
++ },
+ {},
+ };
+
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index ec821a5d131a0..265e70b0eb79e 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -12752,7 +12752,7 @@ static int nested_vmx_check_vmcs_link_ptr(struct kvm_vcpu *vcpu,
+ static int check_vmentry_postreqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
+ u32 *exit_qual)
+ {
+- bool ia32e;
++ bool ia32e = !!(vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE);
+
+ *exit_qual = ENTRY_FAIL_DEFAULT;
+
+@@ -12765,6 +12765,13 @@ static int check_vmentry_postreqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
+ return 1;
+ }
+
++ if ((vmcs12->guest_cr0 & (X86_CR0_PG | X86_CR0_PE)) == X86_CR0_PG)
++ return 1;
++
++ if ((ia32e && !(vmcs12->guest_cr4 & X86_CR4_PAE)) ||
++ (ia32e && !(vmcs12->guest_cr0 & X86_CR0_PG)))
++ return 1;
++
+ /*
+ * If the load IA32_EFER VM-entry control is 1, the following checks
+ * are performed on the field for the IA32_EFER MSR:
+@@ -12776,7 +12783,6 @@ static int check_vmentry_postreqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
+ */
+ if (to_vmx(vcpu)->nested.nested_run_pending &&
+ (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_EFER)) {
+- ia32e = (vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE) != 0;
+ if (!kvm_valid_efer(vcpu, vmcs12->guest_ia32_efer) ||
+ ia32e != !!(vmcs12->guest_ia32_efer & EFER_LMA) ||
+ ((vmcs12->guest_cr0 & X86_CR0_PG) &&
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index 76959a7d88c82..94291e0ddcb7a 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -7,6 +7,7 @@
+ #include <linux/dmi.h>
+ #include <linux/pci.h>
+ #include <linux/vgaarb.h>
++#include <asm/amd_nb.h>
+ #include <asm/hpet.h>
+ #include <asm/pci_x86.h>
+
+@@ -824,3 +825,23 @@ static void rs690_fix_64bit_dma(struct pci_dev *pdev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7910, rs690_fix_64bit_dma);
+
+ #endif
++
++#ifdef CONFIG_AMD_NB
++
++#define AMD_15B8_RCC_DEV2_EPF0_STRAP2 0x10136008
++#define AMD_15B8_RCC_DEV2_EPF0_STRAP2_NO_SOFT_RESET_DEV2_F0_MASK 0x00000080L
++
++static void quirk_clear_strap_no_soft_reset_dev2_f0(struct pci_dev *dev)
++{
++ u32 data;
++
++ if (!amd_smn_read(0, AMD_15B8_RCC_DEV2_EPF0_STRAP2, &data)) {
++ data &= ~AMD_15B8_RCC_DEV2_EPF0_STRAP2_NO_SOFT_RESET_DEV2_F0_MASK;
++ if (amd_smn_write(0, AMD_15B8_RCC_DEV2_EPF0_STRAP2, data))
++ pci_err(dev, "Failed to write data 0x%x\n", data);
++ } else {
++ pci_err(dev, "Failed to read data\n");
++ }
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15b8, quirk_clear_strap_no_soft_reset_dev2_f0);
++#endif
+diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
+index d178650fd524c..411977947adbe 100644
+--- a/crypto/asymmetric_keys/verify_pefile.c
++++ b/crypto/asymmetric_keys/verify_pefile.c
+@@ -139,11 +139,15 @@ static int pefile_strip_sig_wrapper(const void *pebuf,
+ pr_debug("sig wrapper = { %x, %x, %x }\n",
+ wrapper.length, wrapper.revision, wrapper.cert_type);
+
+- /* Both pesign and sbsign round up the length of certificate table
+- * (in optional header data directories) to 8 byte alignment.
++ /* sbsign rounds up the length of certificate table (in optional
++ * header data directories) to 8 byte alignment. However, the PE
++ * specification states that while entries are 8-byte aligned, this is
++ * not included in their length, and as a result, pesign has not
++ * rounded up since 0.110.
+ */
+- if (round_up(wrapper.length, 8) != ctx->sig_len) {
+- pr_debug("Signature wrapper len wrong\n");
++ if (wrapper.length > ctx->sig_len) {
++ pr_debug("Signature wrapper bigger than sig len (%x > %x)\n",
++ ctx->sig_len, wrapper.length);
+ return -ELIBBAD;
+ }
+ if (wrapper.revision != WIN_CERT_REVISION_2_0) {
+diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
+index abb332d15a131..ead75c1062fbc 100644
+--- a/drivers/gpio/gpio-davinci.c
++++ b/drivers/gpio/gpio-davinci.c
+@@ -327,7 +327,7 @@ static struct irq_chip gpio_irqchip = {
+ .irq_enable = gpio_irq_enable,
+ .irq_disable = gpio_irq_disable,
+ .irq_set_type = gpio_irq_type,
+- .flags = IRQCHIP_SET_TYPE_MASKED,
++ .flags = IRQCHIP_SET_TYPE_MASKED | IRQCHIP_SKIP_SET_WAKE,
+ };
+
+ static void gpio_irq_handler(struct irq_desc *desc)
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
+index b7bc08cf90c69..56357322f5941 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x.c
+@@ -143,7 +143,7 @@ static void etm4_enable_hw(void *info)
+ writel_relaxed(config->ss_pe_cmp[i],
+ drvdata->base + TRCSSPCICRn(i));
+ }
+- for (i = 0; i < drvdata->nr_addr_cmp; i++) {
++ for (i = 0; i < drvdata->nr_addr_cmp * 2; i++) {
+ writeq_relaxed(config->addr_val[i],
+ drvdata->base + TRCACVRn(i));
+ writeq_relaxed(config->addr_acc[i],
+diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
+index 90c510d166516..f494b27497005 100644
+--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
+@@ -468,6 +468,8 @@ static int lpi2c_imx_xfer(struct i2c_adapter *adapter,
+ if (num == 1 && msgs[0].len == 0)
+ goto stop;
+
++ lpi2c_imx->rx_buf = NULL;
++ lpi2c_imx->tx_buf = NULL;
+ lpi2c_imx->delivered = 0;
+ lpi2c_imx->msglen = msgs[i].len;
+ init_completion(&lpi2c_imx->complete);
+diff --git a/drivers/iio/dac/cio-dac.c b/drivers/iio/dac/cio-dac.c
+index 6898b0c79013a..9013506973904 100644
+--- a/drivers/iio/dac/cio-dac.c
++++ b/drivers/iio/dac/cio-dac.c
+@@ -74,8 +74,8 @@ static int cio_dac_write_raw(struct iio_dev *indio_dev,
+ if (mask != IIO_CHAN_INFO_RAW)
+ return -EINVAL;
+
+- /* DAC can only accept up to a 16-bit value */
+- if ((unsigned int)val > 65535)
++ /* DAC can only accept up to a 12-bit value */
++ if ((unsigned int)val > 4095)
+ return -EINVAL;
+
+ priv->chan_out_states[chan->channel] = val;
+diff --git a/drivers/mtd/mtdblock.c b/drivers/mtd/mtdblock.c
+index a5b1933c04909..17b3495fe3563 100644
+--- a/drivers/mtd/mtdblock.c
++++ b/drivers/mtd/mtdblock.c
+@@ -164,7 +164,7 @@ static int do_cached_write (struct mtdblk_dev *mtdblk, unsigned long pos,
+ mtdblk->cache_state = STATE_EMPTY;
+ ret = mtd_read(mtd, sect_start, sect_size,
+ &retlen, mtdblk->cache_data);
+- if (ret)
++ if (ret && !mtd_is_bitflip(ret))
+ return ret;
+ if (retlen != sect_size)
+ return -EIO;
+@@ -199,8 +199,12 @@ static int do_cached_read (struct mtdblk_dev *mtdblk, unsigned long pos,
+ pr_debug("mtdblock: read on \"%s\" at 0x%lx, size 0x%x\n",
+ mtd->name, pos, len);
+
+- if (!sect_size)
+- return mtd_read(mtd, pos, len, &retlen, buf);
++ if (!sect_size) {
++ ret = mtd_read(mtd, pos, len, &retlen, buf);
++ if (ret && !mtd_is_bitflip(ret))
++ return ret;
++ return 0;
++ }
+
+ while (len > 0) {
+ unsigned long sect_start = (pos/sect_size)*sect_size;
+@@ -220,7 +224,7 @@ static int do_cached_read (struct mtdblk_dev *mtdblk, unsigned long pos,
+ memcpy (buf, mtdblk->cache_data + offset, size);
+ } else {
+ ret = mtd_read(mtd, pos, size, &retlen, buf);
+- if (ret)
++ if (ret && !mtd_is_bitflip(ret))
+ return ret;
+ if (retlen != size)
+ return -EIO;
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index 3d0241f8f3ec7..3eb14c68cb9b2 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -657,12 +657,6 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
+ ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size);
+ ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size);
+
+- if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset + UBI_VID_HDR_SIZE) >
+- ubi->vid_hdr_alsize)) {
+- ubi_err(ubi, "VID header offset %d too large.", ubi->vid_hdr_offset);
+- return -EINVAL;
+- }
+-
+ dbg_gen("min_io_size %d", ubi->min_io_size);
+ dbg_gen("max_write_size %d", ubi->max_write_size);
+ dbg_gen("hdrs_min_io_size %d", ubi->hdrs_min_io_size);
+@@ -680,6 +674,21 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024)
+ ubi->vid_hdr_aloffset;
+ }
+
++ /*
++ * Memory allocation for VID header is ubi->vid_hdr_alsize
++ * which is described in comments in io.c.
++ * Make sure VID header shift + UBI_VID_HDR_SIZE not exceeds
++ * ubi->vid_hdr_alsize, so that all vid header operations
++ * won't access memory out of bounds.
++ */
++ if ((ubi->vid_hdr_shift + UBI_VID_HDR_SIZE) > ubi->vid_hdr_alsize) {
++ ubi_err(ubi, "Invalid VID header offset %d, VID header shift(%d)"
++ " + VID header size(%zu) > VID header aligned size(%d).",
++ ubi->vid_hdr_offset, ubi->vid_hdr_shift,
++ UBI_VID_HDR_SIZE, ubi->vid_hdr_alsize);
++ return -EINVAL;
++ }
++
+ /* Similar for the data offset */
+ ubi->leb_start = ubi->vid_hdr_offset + UBI_VID_HDR_SIZE;
+ ubi->leb_start = ALIGN(ubi->leb_start, ubi->min_io_size);
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 7f0847ee53f28..83c460f7a8837 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -568,6 +568,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+ * @vol_id: the volume ID that last used this PEB
+ * @lnum: the last used logical eraseblock number for the PEB
+ * @torture: if the physical eraseblock has to be tortured
++ * @nested: denotes whether the work_sem is already held
+ *
+ * This function returns zero in case of success and a %-ENOMEM in case of
+ * failure.
+@@ -1046,8 +1047,6 @@ out_unlock:
+ * __erase_worker - physical eraseblock erase worker function.
+ * @ubi: UBI device description object
+ * @wl_wrk: the work object
+- * @shutdown: non-zero if the worker has to free memory and exit
+- * because the WL sub-system is shutting down
+ *
+ * This function erases a physical eraseblock and perform torture testing if
+ * needed. It also takes care about marking the physical eraseblock bad if
+@@ -1097,7 +1096,7 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)
+ int err1;
+
+ /* Re-schedule the LEB for erasure */
+- err1 = schedule_erase(ubi, e, vol_id, lnum, 0, false);
++ err1 = schedule_erase(ubi, e, vol_id, lnum, 0, true);
+ if (err1) {
+ spin_lock(&ubi->wl_lock);
+ wl_entry_destroy(ubi, e);
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 324d81516832c..d58f5bbb87956 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -707,6 +707,10 @@ static dma_addr_t macb_get_addr(struct macb *bp, struct macb_dma_desc *desc)
+ }
+ #endif
+ addr |= MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, desc->addr));
++#ifdef CONFIG_MACB_USE_HWSTAMP
++ if (bp->hw_dma_cap & HW_DMA_CAP_PTP)
++ addr &= ~GEM_BIT(DMA_RXVALID);
++#endif
+ return addr;
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
+index d344e9d438321..d3030bd967d5a 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
+@@ -629,7 +629,13 @@ int qlcnic_fw_create_ctx(struct qlcnic_adapter *dev)
+ int i, err, ring;
+
+ if (dev->flags & QLCNIC_NEED_FLR) {
+- pci_reset_function(dev->pdev);
++ err = pci_reset_function(dev->pdev);
++ if (err) {
++ dev_err(&dev->pdev->dev,
++ "Adapter reset failed (%d). Please reboot\n",
++ err);
++ return err;
++ }
+ dev->flags &= ~QLCNIC_NEED_FLR;
+ }
+
+diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
+index 605c4d15b88c1..1693a70325c50 100644
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -4505,7 +4505,7 @@ static int niu_alloc_channels(struct niu *np)
+
+ err = niu_rbr_fill(np, rp, GFP_KERNEL);
+ if (err)
+- return err;
++ goto out_err;
+ }
+
+ tx_rings = kcalloc(num_tx_rings, sizeof(struct tx_ring_info),
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index 66b9c5826ec03..a44902b140879 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -774,6 +774,34 @@ static const struct pinconf_ops amd_pinconf_ops = {
+ .pin_config_group_set = amd_pinconf_group_set,
+ };
+
++static void amd_gpio_irq_init(struct amd_gpio *gpio_dev)
++{
++ struct pinctrl_desc *desc = gpio_dev->pctrl->desc;
++ unsigned long flags;
++ u32 pin_reg, mask;
++ int i;
++
++ mask = BIT(WAKE_CNTRL_OFF_S0I3) | BIT(WAKE_CNTRL_OFF_S3) |
++ BIT(INTERRUPT_MASK_OFF) | BIT(INTERRUPT_ENABLE_OFF) |
++ BIT(WAKE_CNTRL_OFF_S4);
++
++ for (i = 0; i < desc->npins; i++) {
++ int pin = desc->pins[i].number;
++ const struct pin_desc *pd = pin_desc_get(gpio_dev->pctrl, pin);
++
++ if (!pd)
++ continue;
++
++ raw_spin_lock_irqsave(&gpio_dev->lock, flags);
++
++ pin_reg = readl(gpio_dev->base + i * 4);
++ pin_reg &= ~mask;
++ writel(pin_reg, gpio_dev->base + i * 4);
++
++ raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
++ }
++}
++
+ #ifdef CONFIG_PM_SLEEP
+ static bool amd_gpio_should_save(struct amd_gpio *gpio_dev, unsigned int pin)
+ {
+@@ -858,6 +886,7 @@ static int amd_gpio_probe(struct platform_device *pdev)
+ int irq_base;
+ struct resource *res;
+ struct amd_gpio *gpio_dev;
++ struct gpio_irq_chip *girq;
+
+ gpio_dev = devm_kzalloc(&pdev->dev,
+ sizeof(struct amd_gpio), GFP_KERNEL);
+@@ -921,6 +950,18 @@ static int amd_gpio_probe(struct platform_device *pdev)
+ return PTR_ERR(gpio_dev->pctrl);
+ }
+
++ /* Disable and mask interrupts */
++ amd_gpio_irq_init(gpio_dev);
++
++ girq = &gpio_dev->gc.irq;
++ girq->chip = &amd_gpio_irqchip;
++ /* This will let us handle the parent IRQ in the driver */
++ girq->parent_handler = NULL;
++ girq->num_parents = 0;
++ girq->parents = NULL;
++ girq->default_type = IRQ_TYPE_NONE;
++ girq->handler = handle_simple_irq;
++
+ ret = gpiochip_add_data(&gpio_dev->gc, gpio_dev);
+ if (ret)
+ return ret;
+@@ -932,19 +973,8 @@ static int amd_gpio_probe(struct platform_device *pdev)
+ goto out2;
+ }
+
+- ret = gpiochip_irqchip_add(&gpio_dev->gc,
+- &amd_gpio_irqchip,
+- 0,
+- handle_simple_irq,
+- IRQ_TYPE_NONE);
+- if (ret) {
+- dev_err(&pdev->dev, "could not add irqchip\n");
+- ret = -ENODEV;
+- goto out2;
+- }
+-
+- ret = devm_request_irq(&pdev->dev, irq_base, amd_gpio_irq_handler, 0,
+- KBUILD_MODNAME, gpio_dev);
++ ret = devm_request_irq(&pdev->dev, irq_base, amd_gpio_irq_handler,
++ IRQF_SHARED, KBUILD_MODNAME, gpio_dev);
+ if (ret)
+ goto out2;
+
+diff --git a/drivers/power/supply/cros_usbpd-charger.c b/drivers/power/supply/cros_usbpd-charger.c
+index 688a16bacfbbd..74b5914abbf7e 100644
+--- a/drivers/power/supply/cros_usbpd-charger.c
++++ b/drivers/power/supply/cros_usbpd-charger.c
+@@ -242,7 +242,7 @@ static int cros_usbpd_charger_get_power_info(struct port_data *port)
+ port->psy_current_max = 0;
+ break;
+ default:
+- dev_err(dev, "Port %d: default case!\n", port->port_number);
++ dev_dbg(dev, "Port %d: default case!\n", port->port_number);
+ port->psy_usb_type = POWER_SUPPLY_USB_TYPE_SDP;
+ }
+
+diff --git a/drivers/pwm/pwm-cros-ec.c b/drivers/pwm/pwm-cros-ec.c
+index 98f6ac6cf6ab4..bedf6298acfbb 100644
+--- a/drivers/pwm/pwm-cros-ec.c
++++ b/drivers/pwm/pwm-cros-ec.c
+@@ -125,6 +125,7 @@ static void cros_ec_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
+
+ state->enabled = (ret > 0);
+ state->period = EC_PWM_MAX_DUTY;
++ state->polarity = PWM_POLARITY_NORMAL;
+
+ /* Note that "disabled" and "duty cycle == 0" are treated the same */
+ state->duty_cycle = ret;
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index f50a675dc4b86..f2ab113d66337 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -519,9 +519,6 @@ static int ses_enclosure_find_by_addr(struct enclosure_device *edev,
+ int i;
+ struct ses_component *scomp;
+
+- if (!edev->component[0].scratch)
+- return 0;
+-
+ for (i = 0; i < edev->components; i++) {
+ scomp = edev->component[i].scratch;
+ if (scomp->addr != efd->addr)
+@@ -612,8 +609,10 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
+ components++,
+ type_ptr[0],
+ name);
+- else
++ else if (components < edev->components)
+ ecomp = &edev->component[components++];
++ else
++ ecomp = ERR_PTR(-EINVAL);
+
+ if (!IS_ERR(ecomp)) {
+ if (addl_desc_ptr) {
+@@ -744,11 +743,6 @@ static int ses_intf_add(struct device *cdev,
+ components += type_ptr[1];
+ }
+
+- if (components == 0) {
+- sdev_printk(KERN_WARNING, sdev, "enclosure has no enumerated components\n");
+- goto err_free;
+- }
+-
+ ses_dev->page1 = buf;
+ ses_dev->page1_len = len;
+ buf = NULL;
+@@ -790,9 +784,11 @@ static int ses_intf_add(struct device *cdev,
+ buf = NULL;
+ }
+ page2_not_supported:
+- scomp = kcalloc(components, sizeof(struct ses_component), GFP_KERNEL);
+- if (!scomp)
+- goto err_free;
++ if (components > 0) {
++ scomp = kcalloc(components, sizeof(struct ses_component), GFP_KERNEL);
++ if (!scomp)
++ goto err_free;
++ }
+
+ edev = enclosure_register(cdev->parent, dev_name(&sdev->sdev_gendev),
+ components, &ses_enclosure_callbacks);
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index ba7f0b44b7107..dfe9ac3b95af2 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -2908,6 +2908,13 @@ static int sci_init_single(struct platform_device *dev,
+ for (i = 0; i < ARRAY_SIZE(sci_port->irqs); ++i)
+ sci_port->irqs[i] = platform_get_irq(dev, i);
+
++ /*
++ * The fourth interrupt on SCI port is transmit end interrupt, so
++ * shuffle the interrupts.
++ */
++ if (p->type == PORT_SCI)
++ swap(sci_port->irqs[SCIx_BRI_IRQ], sci_port->irqs[SCIx_TEI_IRQ]);
++
+ /* The SCI generates several interrupts. They can be muxed together or
+ * connected to different interrupt lines. In the muxed case only one
+ * interrupt resource is specified as there is only one interrupt ID.
+@@ -2973,7 +2980,7 @@ static int sci_init_single(struct platform_device *dev,
+ port->flags = UPF_FIXED_PORT | UPF_BOOT_AUTOCONF | p->flags;
+ port->fifosize = sci_port->params->fifosize;
+
+- if (port->type == PORT_SCI) {
++ if (port->type == PORT_SCI && !dev->dev.of_node) {
+ if (sci_port->reg_size >= 0x20)
+ port->regshift = 2;
+ else
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 7932a65324d2f..c203b2e7b8386 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -121,6 +121,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
+ { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
+ { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
++ { USB_DEVICE(0x10C4, 0x82AA) }, /* Silicon Labs IFS-USB-DATACABLE used with Quint UPS */
+ { USB_DEVICE(0x10C4, 0x82EF) }, /* CESINEL FALCO 6105 AC Power Supply */
+ { USB_DEVICE(0x10C4, 0x82F1) }, /* CESINEL MEDCAL EFD Earth Fault Detector */
+ { USB_DEVICE(0x10C4, 0x82F2) }, /* CESINEL MEDCAL ST Network Analyzer */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 17cfa0fd6175b..8dd94ce7245e1 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1198,6 +1198,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0900, 0xff, 0, 0), /* RM500U-CN */
++ .driver_info = ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
+@@ -1300,6 +1302,14 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990 (PCIe) */
+ .driver_info = RSVD(0) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990 (rmnet) */
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990 (MBIM) */
++ .driver_info = NCTRL(0) | RSVD(1) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990 (RNDIS) */
++ .driver_info = NCTRL(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */
++ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+diff --git a/drivers/watchdog/sbsa_gwdt.c b/drivers/watchdog/sbsa_gwdt.c
+index e8bd9887c5663..1ffb0394c8a17 100644
+--- a/drivers/watchdog/sbsa_gwdt.c
++++ b/drivers/watchdog/sbsa_gwdt.c
+@@ -130,6 +130,7 @@ static int sbsa_gwdt_set_timeout(struct watchdog_device *wdd,
+ struct sbsa_gwdt *gwdt = watchdog_get_drvdata(wdd);
+
+ wdd->timeout = timeout;
++ timeout = clamp_t(unsigned int, timeout, 1, wdd->max_hw_heartbeat_ms / 1000);
+
+ if (action)
+ writel(gwdt->clk * timeout,
+diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
+index 5ac7bf24c507b..2d438318681a5 100644
+--- a/fs/nfs/nfs4_fs.h
++++ b/fs/nfs/nfs4_fs.h
+@@ -190,7 +190,7 @@ struct nfs4_state {
+ unsigned int n_wronly; /* Number of write-only references */
+ unsigned int n_rdwr; /* Number of read/write references */
+ fmode_t state; /* State on the server (R,W, or RW) */
+- atomic_t count;
++ refcount_t count;
+
+ wait_queue_head_t waitq;
+ };
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 250fa88303fad..3651619468d74 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1792,7 +1792,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
+ out:
+ return ERR_PTR(ret);
+ out_return_state:
+- atomic_inc(&state->count);
++ refcount_inc(&state->count);
+ return state;
+ }
+
+@@ -1851,8 +1851,7 @@ _nfs4_opendata_reclaim_to_nfs4_state(struct nfs4_opendata *data)
+ if (!data->rpc_done) {
+ if (data->rpc_status)
+ return ERR_PTR(data->rpc_status);
+- /* cached opens have already been processed */
+- goto update;
++ return nfs4_try_open_cached(data);
+ }
+
+ ret = nfs_refresh_inode(inode, &data->f_attr);
+@@ -1861,10 +1860,11 @@ _nfs4_opendata_reclaim_to_nfs4_state(struct nfs4_opendata *data)
+
+ if (data->o_res.delegation_type != 0)
+ nfs4_opendata_check_deleg(data, state);
+-update:
+- update_open_stateid(state, &data->o_res.stateid, NULL,
+- data->o_arg.fmode);
+- atomic_inc(&state->count);
++
++ if (!update_open_stateid(state, &data->o_res.stateid,
++ NULL, data->o_arg.fmode))
++ return ERR_PTR(-EAGAIN);
++ refcount_inc(&state->count);
+
+ return state;
+ }
+@@ -1902,7 +1902,7 @@ nfs4_opendata_find_nfs4_state(struct nfs4_opendata *data)
+ return ERR_CAST(inode);
+ if (data->state != NULL && data->state->inode == inode) {
+ state = data->state;
+- atomic_inc(&state->count);
++ refcount_inc(&state->count);
+ } else
+ state = nfs4_get_open_state(inode, data->owner);
+ iput(inode);
+@@ -1928,8 +1928,11 @@ _nfs4_opendata_to_nfs4_state(struct nfs4_opendata *data)
+
+ if (data->o_res.delegation_type != 0)
+ nfs4_opendata_check_deleg(data, state);
+- update_open_stateid(state, &data->o_res.stateid, NULL,
+- data->o_arg.fmode);
++ if (!update_open_stateid(state, &data->o_res.stateid,
++ NULL, data->o_arg.fmode)) {
++ nfs4_put_open_state(state);
++ state = ERR_PTR(-EAGAIN);
++ }
+ out:
+ nfs_release_seqid(data->o_arg.seqid);
+ return state;
+@@ -1975,7 +1978,7 @@ static struct nfs4_opendata *nfs4_open_recoverdata_alloc(struct nfs_open_context
+ if (opendata == NULL)
+ return ERR_PTR(-ENOMEM);
+ opendata->state = state;
+- atomic_inc(&state->count);
++ refcount_inc(&state->count);
+ return opendata;
+ }
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index b9fbd01ef4cfe..e5b4c6987c846 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -675,7 +675,7 @@ nfs4_alloc_open_state(void)
+ state = kzalloc(sizeof(*state), GFP_NOFS);
+ if (!state)
+ return NULL;
+- atomic_set(&state->count, 1);
++ refcount_set(&state->count, 1);
+ INIT_LIST_HEAD(&state->lock_states);
+ spin_lock_init(&state->state_lock);
+ seqlock_init(&state->seqlock);
+@@ -709,7 +709,7 @@ __nfs4_find_state_byowner(struct inode *inode, struct nfs4_state_owner *owner)
+ continue;
+ if (!nfs4_valid_open_stateid(state))
+ continue;
+- if (atomic_inc_not_zero(&state->count))
++ if (refcount_inc_not_zero(&state->count))
+ return state;
+ }
+ return NULL;
+@@ -763,7 +763,7 @@ void nfs4_put_open_state(struct nfs4_state *state)
+ struct inode *inode = state->inode;
+ struct nfs4_state_owner *owner = state->owner;
+
+- if (!atomic_dec_and_lock(&state->count, &owner->so_lock))
++ if (!refcount_dec_and_lock(&state->count, &owner->so_lock))
+ return;
+ spin_lock(&inode->i_lock);
+ list_del(&state->inode_states);
+@@ -1596,7 +1596,7 @@ restart:
+ continue;
+ if (state->state == 0)
+ continue;
+- atomic_inc(&state->count);
++ refcount_inc(&state->count);
+ spin_unlock(&sp->so_lock);
+ status = ops->recover_open(sp, state);
+ if (status >= 0) {
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 11914b3585b34..7765a7f9963ce 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -2609,11 +2609,10 @@ static int nilfs_segctor_thread(void *arg)
+ goto loop;
+
+ end_thread:
+- spin_unlock(&sci->sc_state_lock);
+-
+ /* end sync. */
+ sci->sc_task = NULL;
+ wake_up(&sci->sc_wait_task); /* for nilfs_segctor_kill_thread() */
++ spin_unlock(&sci->sc_state_lock);
+ return 0;
+ }
+
+diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
+index 2961b5ceb4a7c..221a54faab526 100644
+--- a/fs/nilfs2/super.c
++++ b/fs/nilfs2/super.c
+@@ -484,6 +484,7 @@ static void nilfs_put_super(struct super_block *sb)
+ up_write(&nilfs->ns_sem);
+ }
+
++ nilfs_sysfs_delete_device_group(nilfs);
+ iput(nilfs->ns_sufile);
+ iput(nilfs->ns_cpfile);
+ iput(nilfs->ns_dat);
+@@ -1110,6 +1111,7 @@ nilfs_fill_super(struct super_block *sb, void *data, int silent)
+ nilfs_put_root(fsroot);
+
+ failed_unload:
++ nilfs_sysfs_delete_device_group(nilfs);
+ iput(nilfs->ns_sufile);
+ iput(nilfs->ns_cpfile);
+ iput(nilfs->ns_dat);
+diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
+index 6541e29a8b200..24f626e7d012a 100644
+--- a/fs/nilfs2/the_nilfs.c
++++ b/fs/nilfs2/the_nilfs.c
+@@ -87,7 +87,6 @@ void destroy_nilfs(struct the_nilfs *nilfs)
+ {
+ might_sleep();
+ if (nilfs_init(nilfs)) {
+- nilfs_sysfs_delete_device_group(nilfs);
+ brelse(nilfs->ns_sbh[0]);
+ brelse(nilfs->ns_sbh[1]);
+ }
+@@ -275,6 +274,10 @@ int load_nilfs(struct the_nilfs *nilfs, struct super_block *sb)
+ goto failed;
+ }
+
++ err = nilfs_sysfs_create_device_group(sb);
++ if (unlikely(err))
++ goto sysfs_error;
++
+ if (valid_fs)
+ goto skip_recovery;
+
+@@ -336,6 +339,9 @@ int load_nilfs(struct the_nilfs *nilfs, struct super_block *sb)
+ goto failed;
+
+ failed_unload:
++ nilfs_sysfs_delete_device_group(nilfs);
++
++ sysfs_error:
+ iput(nilfs->ns_cpfile);
+ iput(nilfs->ns_sufile);
+ iput(nilfs->ns_dat);
+@@ -668,10 +674,6 @@ int init_nilfs(struct the_nilfs *nilfs, struct super_block *sb, char *data)
+ if (err)
+ goto failed_sbh;
+
+- err = nilfs_sysfs_create_device_group(sb);
+- if (err)
+- goto failed_sbh;
+-
+ set_nilfs_init(nilfs);
+ err = 0;
+ out:
+diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
+index dd16e8218db3a..ed35a950ce585 100644
+--- a/include/linux/ftrace.h
++++ b/include/linux/ftrace.h
+@@ -689,7 +689,7 @@ static inline void __ftrace_enabled_restore(int enabled)
+ #define CALLER_ADDR5 ((unsigned long)ftrace_return_address(5))
+ #define CALLER_ADDR6 ((unsigned long)ftrace_return_address(6))
+
+-static inline unsigned long get_lock_parent_ip(void)
++static __always_inline unsigned long get_lock_parent_ip(void)
+ {
+ unsigned long addr = CALLER_ADDR0;
+
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index c6d412cebc434..3067d3e5a51d9 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -1504,7 +1504,9 @@ static void cpuset_cancel_attach(struct cgroup_taskset *tset)
+ cs = css_cs(css);
+
+ mutex_lock(&cpuset_mutex);
+- css_cs(css)->attach_in_progress--;
++ cs->attach_in_progress--;
++ if (!cs->attach_in_progress)
++ wake_up(&cpuset_attach_wq);
+ mutex_unlock(&cpuset_mutex);
+ }
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 668e5492e4c4d..72ed3f3d078fc 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -10431,7 +10431,7 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event)
+ /*
+ * If its not a per-cpu rb, it must be the same task.
+ */
+- if (output_event->cpu == -1 && output_event->ctx != event->ctx)
++ if (output_event->cpu == -1 && output_event->hw.target != event->hw.target)
+ goto out;
+
+ /*
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index bef3d01b8ff61..37fade5101ee2 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2463,6 +2463,10 @@ rb_set_commit_to_write(struct ring_buffer_per_cpu *cpu_buffer)
+ if (RB_WARN_ON(cpu_buffer,
+ rb_is_reader_page(cpu_buffer->tail_page)))
+ return;
++ /*
++ * No need for a memory barrier here, as the update
++ * of the tail_page did it for this page.
++ */
+ local_set(&cpu_buffer->commit_page->page->commit,
+ rb_page_write(cpu_buffer->commit_page));
+ rb_inc_page(cpu_buffer, &cpu_buffer->commit_page);
+@@ -2476,6 +2480,8 @@ rb_set_commit_to_write(struct ring_buffer_per_cpu *cpu_buffer)
+ while (rb_commit_index(cpu_buffer) !=
+ rb_page_write(cpu_buffer->commit_page)) {
+
++ /* Make sure the readers see the content of what is committed. */
++ smp_wmb();
+ local_set(&cpu_buffer->commit_page->page->commit,
+ rb_page_write(cpu_buffer->commit_page));
+ RB_WARN_ON(cpu_buffer,
+@@ -3841,7 +3847,12 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
+
+ /*
+ * Make sure we see any padding after the write update
+- * (see rb_reset_tail())
++ * (see rb_reset_tail()).
++ *
++ * In addition, a writer may be writing on the reader page
++ * if the page has not been fully filled, so the read barrier
++ * is also needed to make sure we see the content of what is
++ * committed by the writer (see rb_set_commit_to_write()).
+ */
+ smp_rmb();
+
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index f3b2d694a155a..a4a80b9765b70 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -620,6 +620,7 @@ static void __del_from_avail_list(struct swap_info_struct *p)
+ {
+ int nid;
+
++ assert_spin_locked(&p->lock);
+ for_each_node(nid)
+ plist_del(&p->avail_lists[nid], &swap_avail_heads[nid]);
+ }
+@@ -2575,8 +2576,8 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
+ spin_unlock(&swap_lock);
+ goto out_dput;
+ }
+- del_from_avail_list(p);
+ spin_lock(&p->lock);
++ del_from_avail_list(p);
+ if (p->prio < 0) {
+ struct swap_info_struct *si = p;
+ int nid;
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index 08b96aeaff464..c87146a496363 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -299,6 +299,10 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
+ write_unlock(&xen_9pfs_lock);
+
+ for (i = 0; i < priv->num_rings; i++) {
++ struct xen_9pfs_dataring *ring = &priv->rings[i];
++
++ cancel_work_sync(&ring->work);
++
+ if (!priv->rings[i].intf)
+ break;
+ if (priv->rings[i].irq > 0)
+diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
+index 0cbd0bca971ff..00dae8e875a2f 100644
+--- a/net/bluetooth/hidp/core.c
++++ b/net/bluetooth/hidp/core.c
+@@ -428,7 +428,7 @@ static void hidp_set_timer(struct hidp_session *session)
+ static void hidp_del_timer(struct hidp_session *session)
+ {
+ if (session->idle_to > 0)
+- del_timer(&session->timer);
++ del_timer_sync(&session->timer);
+ }
+
+ static void hidp_process_report(struct hidp_session *session, int type,
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 0e034925e3601..1a68aad5737e1 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -4350,33 +4350,27 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
+
+ BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
+
+- mutex_lock(&conn->chan_lock);
+-
+- chan = __l2cap_get_chan_by_scid(conn, dcid);
++ chan = l2cap_get_chan_by_scid(conn, dcid);
+ if (!chan) {
+- mutex_unlock(&conn->chan_lock);
+ cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
+ return 0;
+ }
+
+- l2cap_chan_hold(chan);
+- l2cap_chan_lock(chan);
+-
+ rsp.dcid = cpu_to_le16(chan->scid);
+ rsp.scid = cpu_to_le16(chan->dcid);
+ l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
+
+ chan->ops->set_shutdown(chan);
+
++ mutex_lock(&conn->chan_lock);
+ l2cap_chan_del(chan, ECONNRESET);
++ mutex_unlock(&conn->chan_lock);
+
+ chan->ops->close(chan);
+
+ l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
+
+- mutex_unlock(&conn->chan_lock);
+-
+ return 0;
+ }
+
+@@ -4396,33 +4390,27 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
+
+ BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
+
+- mutex_lock(&conn->chan_lock);
+-
+- chan = __l2cap_get_chan_by_scid(conn, scid);
++ chan = l2cap_get_chan_by_scid(conn, scid);
+ if (!chan) {
+ mutex_unlock(&conn->chan_lock);
+ return 0;
+ }
+
+- l2cap_chan_hold(chan);
+- l2cap_chan_lock(chan);
+-
+ if (chan->state != BT_DISCONN) {
+ l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
+- mutex_unlock(&conn->chan_lock);
+ return 0;
+ }
+
++ mutex_lock(&conn->chan_lock);
+ l2cap_chan_del(chan, 0);
++ mutex_unlock(&conn->chan_lock);
+
+ chan->ops->close(chan);
+
+ l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
+
+- mutex_unlock(&conn->chan_lock);
+-
+ return 0;
+ }
+
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index 41e32a958d08d..08f0da9e6a809 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -136,6 +136,20 @@ static void queue_process(struct work_struct *work)
+ }
+ }
+
++static int netif_local_xmit_active(struct net_device *dev)
++{
++ int i;
++
++ for (i = 0; i < dev->num_tx_queues; i++) {
++ struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
++
++ if (READ_ONCE(txq->xmit_lock_owner) == smp_processor_id())
++ return 1;
++ }
++
++ return 0;
++}
++
+ static void poll_one_napi(struct napi_struct *napi)
+ {
+ int work;
+@@ -182,7 +196,10 @@ void netpoll_poll_dev(struct net_device *dev)
+ if (!ni || down_trylock(&ni->dev_lock))
+ return;
+
+- if (!netif_running(dev)) {
++ /* Some drivers will take the same locks in poll and xmit,
++ * we can't poll if local CPU is already in xmit.
++ */
++ if (!netif_running(dev) || netif_local_xmit_active(dev)) {
+ up(&ni->dev_lock);
+ return;
+ }
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index aa179e6461e17..af0ddaa55e431 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -759,6 +759,11 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
+ room = 576;
+ room -= sizeof(struct iphdr) + icmp_param.replyopts.opt.opt.optlen;
+ room -= sizeof(struct icmphdr);
++ /* Guard against tiny mtu. We need to include at least one
++ * IP network header for this message to make any sense.
++ */
++ if (room <= (int)sizeof(struct iphdr))
++ goto ende;
+
+ icmp_param.data_len = skb_in->len - icmp_param.offset;
+ if (icmp_param.data_len > room)
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 70820d049b92a..4f31a781ab370 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1730,8 +1730,13 @@ struct sk_buff *__ip6_make_skb(struct sock *sk,
+ IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
+ if (proto == IPPROTO_ICMPV6) {
+ struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
++ u8 icmp6_type;
+
+- ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
++ if (sk->sk_socket->type == SOCK_RAW && !inet_sk(sk)->hdrincl)
++ icmp6_type = fl6->fl6_icmp_type;
++ else
++ icmp6_type = icmp6_hdr(skb)->icmp6_type;
++ ICMP6MSGOUT_INC_STATS(net, idev, icmp6_type);
+ ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
+ }
+
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 9b0cae403027e..16c98a2a5c363 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1219,9 +1219,11 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ msg->msg_name = &sin;
+ msg->msg_namelen = sizeof(sin);
+ do_udp_sendmsg:
+- if (__ipv6_only_sock(sk))
+- return -ENETUNREACH;
+- return udp_sendmsg(sk, msg, len);
++ err = __ipv6_only_sock(sk) ?
++ -ENETUNREACH : udp_sendmsg(sk, msg, len);
++ msg->msg_name = sin6;
++ msg->msg_namelen = addr_len;
++ return err;
+ }
+ }
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 5e28be07cad88..5c209f72de701 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -969,7 +969,8 @@ static int __must_check __sta_info_destroy_part1(struct sta_info *sta)
+ list_del_rcu(&sta->list);
+ sta->removed = true;
+
+- drv_sta_pre_rcu_remove(local, sta->sdata, sta);
++ if (sta->uploaded)
++ drv_sta_pre_rcu_remove(local, sta->sdata, sta);
+
+ if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+ rcu_access_pointer(sdata->u.vlan.sta) == sta)
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 8901bb7afa2be..355b89579e930 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1953,6 +1953,10 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
+ err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
+ if (err)
+ goto err;
++ if (unlikely(sinfo->sinfo_stream >= asoc->stream.outcnt)) {
++ err = -EINVAL;
++ goto err;
++ }
+ }
+
+ if (sctp_state(asoc, CLOSED)) {
+diff --git a/net/sctp/stream_interleave.c b/net/sctp/stream_interleave.c
+index 0a78cdf864633..3290e6f5b6c6c 100644
+--- a/net/sctp/stream_interleave.c
++++ b/net/sctp/stream_interleave.c
+@@ -1151,7 +1151,8 @@ static void sctp_generate_iftsn(struct sctp_outq *q, __u32 ctsn)
+
+ #define _sctp_walk_ifwdtsn(pos, chunk, end) \
+ for (pos = chunk->subh.ifwdtsn_hdr->skip; \
+- (void *)pos < (void *)chunk->subh.ifwdtsn_hdr->skip + (end); pos++)
++ (void *)pos <= (void *)chunk->subh.ifwdtsn_hdr->skip + (end) - \
++ sizeof(struct sctp_ifwdtsn_skip); pos++)
+
+ #define sctp_walk_ifwdtsn(pos, ch) \
+ _sctp_walk_ifwdtsn((pos), (ch), ntohs((ch)->chunk_hdr->length) - \
+diff --git a/sound/i2c/cs8427.c b/sound/i2c/cs8427.c
+index 8afa2f8884660..ef40501cf8988 100644
+--- a/sound/i2c/cs8427.c
++++ b/sound/i2c/cs8427.c
+@@ -568,10 +568,13 @@ int snd_cs8427_iec958_active(struct snd_i2c_device *cs8427, int active)
+ if (snd_BUG_ON(!cs8427))
+ return -ENXIO;
+ chip = cs8427->private_data;
+- if (active)
++ if (active) {
+ memcpy(chip->playback.pcm_status,
+ chip->playback.def_status, 24);
+- chip->playback.pcm_ctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
++ chip->playback.pcm_ctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
++ } else {
++ chip->playback.pcm_ctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
++ }
+ snd_ctl_notify(cs8427->bus->card,
+ SNDRV_CTL_EVENT_MASK_VALUE | SNDRV_CTL_EVENT_MASK_INFO,
+ &chip->playback.pcm_ctl->id);
+diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
+index 623776b13f8da..54f09fbd786fd 100644
+--- a/sound/pci/emu10k1/emupcm.c
++++ b/sound/pci/emu10k1/emupcm.c
+@@ -1258,7 +1258,7 @@ static int snd_emu10k1_capture_mic_close(struct snd_pcm_substream *substream)
+ {
+ struct snd_emu10k1 *emu = snd_pcm_substream_chip(substream);
+
+- emu->capture_interrupt = NULL;
++ emu->capture_mic_interrupt = NULL;
+ emu->pcm_capture_mic_substream = NULL;
+ return 0;
+ }
+@@ -1366,7 +1366,7 @@ static int snd_emu10k1_capture_efx_close(struct snd_pcm_substream *substream)
+ {
+ struct snd_emu10k1 *emu = snd_pcm_substream_chip(substream);
+
+- emu->capture_interrupt = NULL;
++ emu->capture_efx_interrupt = NULL;
+ emu->pcm_capture_efx_substream = NULL;
+ return 0;
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9cedb78bffe76..546872e724275 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2556,6 +2556,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+ SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
++ SND_PCI_QUIRK(0x1558, 0x3702, "Clevo X370SN[VW]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65d2, "Clevo PB51R[CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 8d09312b2e428..e91df1152612d 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1723,6 +1723,7 @@ static const struct snd_pci_quirk stac925x_fixup_tbl[] = {
+ };
+
+ static const struct hda_pintbl ref92hd73xx_pin_configs[] = {
++ // Port A-H
+ { 0x0a, 0x02214030 },
+ { 0x0b, 0x02a19040 },
+ { 0x0c, 0x01a19020 },
+@@ -1731,9 +1732,12 @@ static const struct hda_pintbl ref92hd73xx_pin_configs[] = {
+ { 0x0f, 0x01014010 },
+ { 0x10, 0x01014020 },
+ { 0x11, 0x01014030 },
++ // CD in
+ { 0x12, 0x02319040 },
++ // Digial Mic ins
+ { 0x13, 0x90a000f0 },
+ { 0x14, 0x90a000f0 },
++ // Digital outs
+ { 0x22, 0x01452050 },
+ { 0x23, 0x01452050 },
+ {}
+@@ -1774,6 +1778,7 @@ static const struct hda_pintbl alienware_m17x_pin_configs[] = {
+ };
+
+ static const struct hda_pintbl intel_dg45id_pin_configs[] = {
++ // Analog outputs
+ { 0x0a, 0x02214230 },
+ { 0x0b, 0x02A19240 },
+ { 0x0c, 0x01013214 },
+@@ -1781,6 +1786,9 @@ static const struct hda_pintbl intel_dg45id_pin_configs[] = {
+ { 0x0e, 0x01A19250 },
+ { 0x0f, 0x01011212 },
+ { 0x10, 0x01016211 },
++ // Digital output
++ { 0x22, 0x01451380 },
++ { 0x23, 0x40f000f0 },
+ {}
+ };
+
+@@ -1971,6 +1979,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = {
+ "DFI LanParty", STAC_92HD73XX_REF),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DFI, 0x3101,
+ "DFI LanParty", STAC_92HD73XX_REF),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x5001,
++ "Intel DP45SG", STAC_92HD73XX_INTEL),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x5002,
+ "Intel DG45ID", STAC_92HD73XX_INTEL),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x5003,
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-04-26 9:35 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2023-04-26 9:35 UTC (permalink / raw
To: gentoo-commits
commit: cde696d925b9817023917301fcf574927a1ae46a
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 26 09:35:04 2023 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Apr 26 09:35:04 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=cde696d9
Linux patch 4.19.282
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1281_linux-4.19.282.patch | 1163 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1167 insertions(+)
diff --git a/0000_README b/0000_README
index 4970a0aa..4cf6104f 100644
--- a/0000_README
+++ b/0000_README
@@ -1167,6 +1167,10 @@ Patch: 1280_linux-4.19.281.patch
From: https://www.kernel.org
Desc: Linux 4.19.281
+Patch: 1281_linux-4.19.282.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.282
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1281_linux-4.19.282.patch b/1281_linux-4.19.282.patch
new file mode 100644
index 00000000..cc01ce33
--- /dev/null
+++ b/1281_linux-4.19.282.patch
@@ -0,0 +1,1163 @@
+diff --git a/Makefile b/Makefile
+index 5fb104fb2f368..6ed7f3fe3a4e8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 281
++SUBLEVEL = 282
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
+index 402b5e0fd616c..4de88ded6d9a1 100644
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -924,7 +924,7 @@
+ status = "disabled";
+ };
+
+- spdif: sound@ff88b0000 {
++ spdif: sound@ff8b0000 {
+ compatible = "rockchip,rk3288-spdif", "rockchip,rk3066-spdif";
+ reg = <0x0 0xff8b0000 0x0 0x10000>;
+ #sound-dai-cells = <0>;
+diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
+index 3ffa2847c110b..c36289a3ad500 100644
+--- a/arch/s390/kernel/ptrace.c
++++ b/arch/s390/kernel/ptrace.c
+@@ -503,9 +503,7 @@ long arch_ptrace(struct task_struct *child, long request,
+ }
+ return 0;
+ case PTRACE_GET_LAST_BREAK:
+- put_user(child->thread.last_break,
+- (unsigned long __user *) data);
+- return 0;
++ return put_user(child->thread.last_break, (unsigned long __user *)data);
+ case PTRACE_ENABLE_TE:
+ if (!MACHINE_HAS_TE)
+ return -EIO;
+@@ -857,9 +855,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+ }
+ return 0;
+ case PTRACE_GET_LAST_BREAK:
+- put_user(child->thread.last_break,
+- (unsigned int __user *) data);
+- return 0;
++ return put_user(child->thread.last_break, (unsigned int __user *)data);
+ }
+ return compat_ptrace_request(child, request, addr, data);
+ }
+diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
+index 2cfa0caef1336..002f7a01af11f 100644
+--- a/arch/x86/purgatory/Makefile
++++ b/arch/x86/purgatory/Makefile
+@@ -25,7 +25,7 @@ KCOV_INSTRUMENT := n
+ # make up the standalone purgatory.ro
+
+ PURGATORY_CFLAGS_REMOVE := -mcmodel=kernel
+-PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss
++PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss -g0
+ PURGATORY_CFLAGS += $(DISABLE_STACKLEAK_PLUGIN) -DDISABLE_BRANCH_PROFILING
+
+ # Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
+@@ -56,6 +56,9 @@ CFLAGS_sha256.o += $(PURGATORY_CFLAGS)
+ CFLAGS_REMOVE_string.o += $(PURGATORY_CFLAGS_REMOVE)
+ CFLAGS_string.o += $(PURGATORY_CFLAGS)
+
++AFLAGS_REMOVE_setup-x86_$(BITS).o += -g -Wa,-gdwarf-2
++AFLAGS_REMOVE_entry64.o += -g -Wa,-gdwarf-2
++
+ $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
+ $(call if_changed,ld)
+
+diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
+index b355899f54cc9..41afb9b8696d2 100644
+--- a/drivers/iio/adc/at91-sama5d2_adc.c
++++ b/drivers/iio/adc/at91-sama5d2_adc.c
+@@ -989,7 +989,7 @@ static struct iio_trigger *at91_adc_allocate_trigger(struct iio_dev *indio,
+ trig = devm_iio_trigger_alloc(&indio->dev, "%s-dev%d-%s", indio->name,
+ indio->id, trigger_name);
+ if (!trig)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ trig->dev.parent = indio->dev.parent;
+ iio_trigger_set_drvdata(trig, indio);
+diff --git a/drivers/iio/counter/104-quad-8.c b/drivers/iio/counter/104-quad-8.c
+index 92be8d0f7735f..92e68cada844c 100644
+--- a/drivers/iio/counter/104-quad-8.c
++++ b/drivers/iio/counter/104-quad-8.c
+@@ -61,10 +61,6 @@ struct quad8_iio {
+
+ #define QUAD8_REG_CHAN_OP 0x11
+ #define QUAD8_REG_INDEX_INPUT_LEVELS 0x16
+-/* Borrow Toggle flip-flop */
+-#define QUAD8_FLAG_BT BIT(0)
+-/* Carry Toggle flip-flop */
+-#define QUAD8_FLAG_CT BIT(1)
+ /* Error flag */
+ #define QUAD8_FLAG_E BIT(4)
+ /* Up/Down flag */
+@@ -97,9 +93,6 @@ static int quad8_read_raw(struct iio_dev *indio_dev,
+ {
+ struct quad8_iio *const priv = iio_priv(indio_dev);
+ const int base_offset = priv->base + 2 * chan->channel;
+- unsigned int flags;
+- unsigned int borrow;
+- unsigned int carry;
+ int i;
+
+ switch (mask) {
+@@ -110,12 +103,7 @@ static int quad8_read_raw(struct iio_dev *indio_dev,
+ return IIO_VAL_INT;
+ }
+
+- flags = inb(base_offset + 1);
+- borrow = flags & QUAD8_FLAG_BT;
+- carry = !!(flags & QUAD8_FLAG_CT);
+-
+- /* Borrow XOR Carry effectively doubles count range */
+- *val = (borrow ^ carry) << 24;
++ *val = 0;
+
+ /* Reset Byte Pointer; transfer Counter to Output Latch */
+ outb(QUAD8_CTR_RLD | QUAD8_RLD_RESET_BP | QUAD8_RLD_CNTR_OUT,
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index b2ab20c16cc77..da2bf8259330e 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -605,6 +605,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = {
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
++ {
++ /* Fujitsu Lifebook A574/H */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "FMVA0501PZ"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
++ },
+ {
+ /* Gigabyte M912 */
+ .matches = {
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index 20ae8652adf44..0849f4d76ff20 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -416,6 +416,7 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
+ return card;
+ err_out:
+ host->card = old_card;
++ kfree_const(card->dev.kobj.name);
+ kfree(card);
+ return NULL;
+ }
+@@ -471,8 +472,10 @@ static void memstick_check(struct work_struct *work)
+ put_device(&card->dev);
+ host->card = NULL;
+ }
+- } else
++ } else {
++ kfree_const(card->dev.kobj.name);
+ kfree(card);
++ }
+ }
+
+ out_power_off:
+diff --git a/drivers/net/dsa/b53/b53_mmap.c b/drivers/net/dsa/b53/b53_mmap.c
+index c628d0980c0b1..1d52cb3e46d52 100644
+--- a/drivers/net/dsa/b53/b53_mmap.c
++++ b/drivers/net/dsa/b53/b53_mmap.c
+@@ -215,6 +215,18 @@ static int b53_mmap_write64(struct b53_device *dev, u8 page, u8 reg,
+ return 0;
+ }
+
++static int b53_mmap_phy_read16(struct b53_device *dev, int addr, int reg,
++ u16 *value)
++{
++ return -EIO;
++}
++
++static int b53_mmap_phy_write16(struct b53_device *dev, int addr, int reg,
++ u16 value)
++{
++ return -EIO;
++}
++
+ static const struct b53_io_ops b53_mmap_ops = {
+ .read8 = b53_mmap_read8,
+ .read16 = b53_mmap_read16,
+@@ -226,6 +238,8 @@ static const struct b53_io_ops b53_mmap_ops = {
+ .write32 = b53_mmap_write32,
+ .write48 = b53_mmap_write48,
+ .write64 = b53_mmap_write64,
++ .phy_read16 = b53_mmap_phy_read16,
++ .phy_write16 = b53_mmap_phy_write16,
+ };
+
+ static int b53_mmap_probe(struct platform_device *pdev)
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 0629f87a20be7..202f734f8733b 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -5230,31 +5230,6 @@ static void e1000_watchdog_task(struct work_struct *work)
+ ew32(TARC(0), tarc0);
+ }
+
+- /* disable TSO for pcie and 10/100 speeds, to avoid
+- * some hardware issues
+- */
+- if (!(adapter->flags & FLAG_TSO_FORCE)) {
+- switch (adapter->link_speed) {
+- case SPEED_10:
+- case SPEED_100:
+- e_info("10/100 speed: disabling TSO\n");
+- netdev->features &= ~NETIF_F_TSO;
+- netdev->features &= ~NETIF_F_TSO6;
+- break;
+- case SPEED_1000:
+- netdev->features |= NETIF_F_TSO;
+- netdev->features |= NETIF_F_TSO6;
+- break;
+- default:
+- /* oops */
+- break;
+- }
+- if (hw->mac.type == e1000_pch_spt) {
+- netdev->features &= ~NETIF_F_TSO;
+- netdev->features &= ~NETIF_F_TSO6;
+- }
+- }
+-
+ /* enable transmits in the hardware, need to do this
+ * after setting TARC(0)
+ */
+@@ -7191,6 +7166,32 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ NETIF_F_RXCSUM |
+ NETIF_F_HW_CSUM);
+
++ /* disable TSO for pcie and 10/100 speeds to avoid
++ * some hardware issues and for i219 to fix transfer
++ * speed being capped at 60%
++ */
++ if (!(adapter->flags & FLAG_TSO_FORCE)) {
++ switch (adapter->link_speed) {
++ case SPEED_10:
++ case SPEED_100:
++ e_info("10/100 speed: disabling TSO\n");
++ netdev->features &= ~NETIF_F_TSO;
++ netdev->features &= ~NETIF_F_TSO6;
++ break;
++ case SPEED_1000:
++ netdev->features |= NETIF_F_TSO;
++ netdev->features |= NETIF_F_TSO6;
++ break;
++ default:
++ /* oops */
++ break;
++ }
++ if (hw->mac.type == e1000_pch_spt) {
++ netdev->features &= ~NETIF_F_TSO;
++ netdev->features &= ~NETIF_F_TSO6;
++ }
++ }
++
+ /* Set user-changeable features (subset of all device features) */
+ netdev->hw_features = netdev->features;
+ netdev->hw_features |= NETIF_F_RXFCS;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 795f8fe2570e4..a908720535ceb 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -9702,8 +9702,11 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
+ pf->hw.aq.asq_last_status));
+ }
+ /* reinit the misc interrupt */
+- if (pf->flags & I40E_FLAG_MSIX_ENABLED)
++ if (pf->flags & I40E_FLAG_MSIX_ENABLED) {
+ ret = i40e_setup_misc_vector(pf);
++ if (ret)
++ goto end_unlock;
++ }
+
+ /* Add a filter to drop all Flow control frames from any VSI from being
+ * transmitted. By doing so we stop a malicious VF from sending out
+@@ -12484,15 +12487,15 @@ static int i40e_add_vsi(struct i40e_vsi *vsi)
+ vsi->id = ctxt.vsi_number;
+ }
+
+- vsi->active_filters = 0;
+- clear_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state);
+ spin_lock_bh(&vsi->mac_filter_hash_lock);
++ vsi->active_filters = 0;
+ /* If macvlan filters already exist, force them to get loaded */
+ hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist) {
+ f->state = I40E_FILTER_NEW;
+ f_count++;
+ }
+ spin_unlock_bh(&vsi->mac_filter_hash_lock);
++ clear_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state);
+
+ if (f_count) {
+ vsi->flags |= I40E_VSI_FLAG_FILTER_CHANGED;
+diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c
+index 0094b92a233ba..31c0d6ee81b16 100644
+--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c
++++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c
+@@ -62,6 +62,8 @@ mlxfw_mfa2_tlv_next(const struct mlxfw_mfa2_file *mfa2_file,
+
+ if (tlv->type == MLXFW_MFA2_TLV_MULTI_PART) {
+ multi = mlxfw_mfa2_tlv_multi_get(mfa2_file, tlv);
++ if (!multi)
++ return NULL;
+ tlv_len = NLA_ALIGN(tlv_len + be16_to_cpu(multi->total_len));
+ }
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 406ef4cc636d4..0cd46735e3950 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -600,8 +600,13 @@ static struct page *xdp_linearize_page(struct receive_queue *rq,
+ int page_off,
+ unsigned int *len)
+ {
+- struct page *page = alloc_page(GFP_ATOMIC);
++ int tailroom = SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++ struct page *page;
+
++ if (page_off + *len + tailroom > PAGE_SIZE)
++ return NULL;
++
++ page = alloc_page(GFP_ATOMIC);
+ if (!page)
+ return NULL;
+
+@@ -609,7 +614,6 @@ static struct page *xdp_linearize_page(struct receive_queue *rq,
+ page_off += *len;
+
+ while (--*num_buf) {
+- int tailroom = SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+ unsigned int buflen;
+ void *buf;
+ int off;
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index ed644b6824cef..d2b79d7c0b881 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -989,10 +989,8 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+
+ /* No crossing a page as the payload mustn't fragment. */
+ if (unlikely((txreq.offset + txreq.size) > XEN_PAGE_SIZE)) {
+- netdev_err(queue->vif->dev,
+- "txreq.offset: %u, size: %u, end: %lu\n",
+- txreq.offset, txreq.size,
+- (unsigned long)(txreq.offset&~XEN_PAGE_MASK) + txreq.size);
++ netdev_err(queue->vif->dev, "Cross page boundary, txreq.offset: %u, size: %u\n",
++ txreq.offset, txreq.size);
+ xenvif_fatal_tx_err(queue->vif);
+ break;
+ }
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 8877a21102f1d..8d1df03386b4f 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3032,7 +3032,7 @@ megasas_fw_crash_buffer_show(struct device *cdev,
+
+ spin_lock_irqsave(&instance->crashdump_lock, flags);
+ buff_offset = instance->fw_crash_buffer_offset;
+- if (!instance->crash_dump_buf &&
++ if (!instance->crash_dump_buf ||
+ !((instance->fw_crash_state == AVAILABLE) ||
+ (instance->fw_crash_state == COPYING))) {
+ dev_err(&instance->pdev->dev,
+diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
+index febe29a9b8b06..acd118da88bfb 100644
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -351,11 +351,18 @@ static int scsi_vpd_inquiry(struct scsi_device *sdev, unsigned char *buffer,
+ if (result)
+ return -EIO;
+
+- /* Sanity check that we got the page back that we asked for */
++ /*
++ * Sanity check that we got the page back that we asked for and that
++ * the page size is not 0.
++ */
+ if (buffer[1] != page)
+ return -EIO;
+
+- return get_unaligned_be16(&buffer[2]) + 4;
++ result = get_unaligned_be16(&buffer[2]);
++ if (!result)
++ return -EIO;
++
++ return result + 4;
+ }
+
+ /**
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 07bb69cd20236..72387e142e28d 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -206,7 +206,7 @@ out:
+ /*
+ * write the buffer to the inline inode.
+ * If 'create' is set, we don't need to do the extra copy in the xattr
+- * value since it is already handled by ext4_xattr_ibody_inline_set.
++ * value since it is already handled by ext4_xattr_ibody_set.
+ * That saves us one memcpy.
+ */
+ static void ext4_write_inline_data(struct inode *inode, struct ext4_iloc *iloc,
+@@ -288,7 +288,7 @@ static int ext4_create_inline_data(handle_t *handle,
+
+ BUG_ON(!is.s.not_found);
+
+- error = ext4_xattr_ibody_inline_set(handle, inode, &i, &is);
++ error = ext4_xattr_ibody_set(handle, inode, &i, &is);
+ if (error) {
+ if (error == -ENOSPC)
+ ext4_clear_inode_state(inode,
+@@ -360,7 +360,7 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode,
+ i.value = value;
+ i.value_len = len;
+
+- error = ext4_xattr_ibody_inline_set(handle, inode, &i, &is);
++ error = ext4_xattr_ibody_set(handle, inode, &i, &is);
+ if (error)
+ goto out;
+
+@@ -433,7 +433,7 @@ static int ext4_destroy_inline_data_nolock(handle_t *handle,
+ if (error)
+ goto out;
+
+- error = ext4_xattr_ibody_inline_set(handle, inode, &i, &is);
++ error = ext4_xattr_ibody_set(handle, inode, &i, &is);
+ if (error)
+ goto out;
+
+@@ -1977,8 +1977,7 @@ int ext4_inline_data_truncate(struct inode *inode, int *has_inline)
+ i.value = value;
+ i.value_len = i_size > EXT4_MIN_INLINE_DATA_SIZE ?
+ i_size - EXT4_MIN_INLINE_DATA_SIZE : 0;
+- err = ext4_xattr_ibody_inline_set(handle, inode,
+- &i, &is);
++ err = ext4_xattr_ibody_set(handle, inode, &i, &is);
+ if (err)
+ goto out_error;
+ }
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index a91b02091b160..1b73a7f8189d2 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -2236,7 +2236,7 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i,
+ return 0;
+ }
+
+-int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode,
++int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
+ struct ext4_xattr_info *i,
+ struct ext4_xattr_ibody_find *is)
+ {
+@@ -2261,30 +2261,6 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode,
+ return 0;
+ }
+
+-static int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
+- struct ext4_xattr_info *i,
+- struct ext4_xattr_ibody_find *is)
+-{
+- struct ext4_xattr_ibody_header *header;
+- struct ext4_xattr_search *s = &is->s;
+- int error;
+-
+- if (EXT4_I(inode)->i_extra_isize == 0)
+- return -ENOSPC;
+- error = ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */);
+- if (error)
+- return error;
+- header = IHDR(inode, ext4_raw_inode(&is->iloc));
+- if (!IS_LAST_ENTRY(s->first)) {
+- header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC);
+- ext4_set_inode_state(inode, EXT4_STATE_XATTR);
+- } else {
+- header->h_magic = cpu_to_le32(0);
+- ext4_clear_inode_state(inode, EXT4_STATE_XATTR);
+- }
+- return 0;
+-}
+-
+ static int ext4_xattr_value_same(struct ext4_xattr_search *s,
+ struct ext4_xattr_info *i)
+ {
+diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
+index 231ef308d10cb..66911f8a11f84 100644
+--- a/fs/ext4/xattr.h
++++ b/fs/ext4/xattr.h
+@@ -199,9 +199,9 @@ extern int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i,
+ extern int ext4_xattr_ibody_get(struct inode *inode, int name_index,
+ const char *name,
+ void *buffer, size_t buffer_size);
+-extern int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode,
+- struct ext4_xattr_info *i,
+- struct ext4_xattr_ibody_find *is);
++extern int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
++ struct ext4_xattr_info *i,
++ struct ext4_xattr_ibody_find *is);
+
+ extern struct mb_cache *ext4_xattr_create_cache(void);
+ extern void ext4_xattr_destroy_cache(struct mb_cache *);
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 7765a7f9963ce..b23ed9a35e5e4 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -435,6 +435,23 @@ static int nilfs_segctor_reset_segment_buffer(struct nilfs_sc_info *sci)
+ return 0;
+ }
+
++/**
++ * nilfs_segctor_zeropad_segsum - zero pad the rest of the segment summary area
++ * @sci: segment constructor object
++ *
++ * nilfs_segctor_zeropad_segsum() zero-fills unallocated space at the end of
++ * the current segment summary block.
++ */
++static void nilfs_segctor_zeropad_segsum(struct nilfs_sc_info *sci)
++{
++ struct nilfs_segsum_pointer *ssp;
++
++ ssp = sci->sc_blk_cnt > 0 ? &sci->sc_binfo_ptr : &sci->sc_finfo_ptr;
++ if (ssp->offset < ssp->bh->b_size)
++ memset(ssp->bh->b_data + ssp->offset, 0,
++ ssp->bh->b_size - ssp->offset);
++}
++
+ static int nilfs_segctor_feed_segment(struct nilfs_sc_info *sci)
+ {
+ sci->sc_nblk_this_inc += sci->sc_curseg->sb_sum.nblocks;
+@@ -443,6 +460,7 @@ static int nilfs_segctor_feed_segment(struct nilfs_sc_info *sci)
+ * The current segment is filled up
+ * (internal code)
+ */
++ nilfs_segctor_zeropad_segsum(sci);
+ sci->sc_curseg = NILFS_NEXT_SEGBUF(sci->sc_curseg);
+ return nilfs_segctor_reset_segment_buffer(sci);
+ }
+@@ -547,6 +565,7 @@ static int nilfs_segctor_add_file_block(struct nilfs_sc_info *sci,
+ goto retry;
+ }
+ if (unlikely(required)) {
++ nilfs_segctor_zeropad_segsum(sci);
+ err = nilfs_segbuf_extend_segsum(segbuf);
+ if (unlikely(err))
+ goto failed;
+@@ -1531,6 +1550,7 @@ static int nilfs_segctor_collect(struct nilfs_sc_info *sci,
+ nadd = min_t(int, nadd << 1, SC_MAX_SEGDELTA);
+ sci->sc_stage = prev_stage;
+ }
++ nilfs_segctor_zeropad_segsum(sci);
+ nilfs_segctor_truncate_segments(sci, sci->sc_curseg, nilfs->ns_sufile);
+ return 0;
+
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 4c2e40882e884..0c883249814cc 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -1040,6 +1040,8 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
+ void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info);
+ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu);
+
++void inet6_cleanup_sock(struct sock *sk);
++void inet6_sock_destruct(struct sock *sk);
+ int inet6_release(struct socket *sock);
+ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len);
+ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
+diff --git a/include/net/udp.h b/include/net/udp.h
+index 618c83bea50da..48d881224524a 100644
+--- a/include/net/udp.h
++++ b/include/net/udp.h
+@@ -254,7 +254,7 @@ static inline int udp_rqueue_get(struct sock *sk)
+ }
+
+ /* net/ipv4/udp.c */
+-void udp_destruct_sock(struct sock *sk);
++void udp_destruct_common(struct sock *sk);
+ void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len);
+ int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb);
+ void udp_skb_destructor(struct sock *sk, struct sk_buff *skb);
+diff --git a/include/net/udplite.h b/include/net/udplite.h
+index 9185e45b997ff..c59ba86668af0 100644
+--- a/include/net/udplite.h
++++ b/include/net/udplite.h
+@@ -24,14 +24,6 @@ static __inline__ int udplite_getfrag(void *from, char *to, int offset,
+ return copy_from_iter_full(to, len, &msg->msg_iter) ? 0 : -EFAULT;
+ }
+
+-/* Designate sk as UDP-Lite socket */
+-static inline int udplite_sk_init(struct sock *sk)
+-{
+- udp_init_sock(sk);
+- udp_sk(sk)->pcflag = UDPLITE_BIT;
+- return 0;
+-}
+-
+ /*
+ * Checksumming routines
+ */
+diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h
+index 52e6456bdb922..098d6dff20bef 100644
+--- a/include/trace/events/f2fs.h
++++ b/include/trace/events/f2fs.h
+@@ -498,7 +498,7 @@ TRACE_EVENT(f2fs_truncate_partial_nodes,
+ TP_STRUCT__entry(
+ __field(dev_t, dev)
+ __field(ino_t, ino)
+- __field(nid_t, nid[3])
++ __array(nid_t, nid, 3)
+ __field(int, depth)
+ __field(int, err)
+ ),
+diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
+index aec3c724665f8..579f39e0d02ec 100644
+--- a/net/dccp/dccp.h
++++ b/net/dccp/dccp.h
+@@ -291,6 +291,7 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
+ const struct dccp_hdr *dh, const unsigned int len);
+
++void dccp_destruct_common(struct sock *sk);
+ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized);
+ void dccp_destroy_sock(struct sock *sk);
+
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index b2a26e41f932f..88732ab4887c6 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -1000,6 +1000,12 @@ static const struct inet_connection_sock_af_ops dccp_ipv6_mapped = {
+ #endif
+ };
+
++static void dccp_v6_sk_destruct(struct sock *sk)
++{
++ dccp_destruct_common(sk);
++ inet6_sock_destruct(sk);
++}
++
+ /* NOTE: A lot of things set to zero explicitly by call to
+ * sk_alloc() so need not be done here.
+ */
+@@ -1012,17 +1018,12 @@ static int dccp_v6_init_sock(struct sock *sk)
+ if (unlikely(!dccp_v6_ctl_sock_initialized))
+ dccp_v6_ctl_sock_initialized = 1;
+ inet_csk(sk)->icsk_af_ops = &dccp_ipv6_af_ops;
++ sk->sk_destruct = dccp_v6_sk_destruct;
+ }
+
+ return err;
+ }
+
+-static void dccp_v6_destroy_sock(struct sock *sk)
+-{
+- dccp_destroy_sock(sk);
+- inet6_destroy_sock(sk);
+-}
+-
+ static struct timewait_sock_ops dccp6_timewait_sock_ops = {
+ .twsk_obj_size = sizeof(struct dccp6_timewait_sock),
+ };
+@@ -1045,7 +1046,7 @@ static struct proto dccp_v6_prot = {
+ .accept = inet_csk_accept,
+ .get_port = inet_csk_get_port,
+ .shutdown = dccp_shutdown,
+- .destroy = dccp_v6_destroy_sock,
++ .destroy = dccp_destroy_sock,
+ .orphan_count = &dccp_orphan_count,
+ .max_header = MAX_DCCP_HEADER,
+ .obj_size = sizeof(struct dccp6_sock),
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c
+index dbbcf50aea35d..673502779933c 100644
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -174,12 +174,18 @@ const char *dccp_packet_name(const int type)
+
+ EXPORT_SYMBOL_GPL(dccp_packet_name);
+
+-static void dccp_sk_destruct(struct sock *sk)
++void dccp_destruct_common(struct sock *sk)
+ {
+ struct dccp_sock *dp = dccp_sk(sk);
+
+ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+ dp->dccps_hc_tx_ccid = NULL;
++}
++EXPORT_SYMBOL_GPL(dccp_destruct_common);
++
++static void dccp_sk_destruct(struct sock *sk)
++{
++ dccp_destruct_common(sk);
+ inet_sock_destruct(sk);
+ }
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index dd3fa0ff84e79..a6048cc7fc35f 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1458,7 +1458,7 @@ drop:
+ }
+ EXPORT_SYMBOL_GPL(__udp_enqueue_schedule_skb);
+
+-void udp_destruct_sock(struct sock *sk)
++void udp_destruct_common(struct sock *sk)
+ {
+ /* reclaim completely the forward allocated memory */
+ struct udp_sock *up = udp_sk(sk);
+@@ -1471,10 +1471,14 @@ void udp_destruct_sock(struct sock *sk)
+ kfree_skb(skb);
+ }
+ udp_rmem_release(sk, total, 0, true);
++}
++EXPORT_SYMBOL_GPL(udp_destruct_common);
+
++static void udp_destruct_sock(struct sock *sk)
++{
++ udp_destruct_common(sk);
+ inet_sock_destruct(sk);
+ }
+-EXPORT_SYMBOL_GPL(udp_destruct_sock);
+
+ int udp_init_sock(struct sock *sk)
+ {
+@@ -1482,7 +1486,6 @@ int udp_init_sock(struct sock *sk)
+ sk->sk_destruct = udp_destruct_sock;
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(udp_init_sock);
+
+ void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len)
+ {
+diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
+index 8545457752fb9..6beab353bc8b2 100644
+--- a/net/ipv4/udplite.c
++++ b/net/ipv4/udplite.c
+@@ -20,6 +20,14 @@
+ struct udp_table udplite_table __read_mostly;
+ EXPORT_SYMBOL(udplite_table);
+
++/* Designate sk as UDP-Lite socket */
++static int udplite_sk_init(struct sock *sk)
++{
++ udp_init_sock(sk);
++ udp_sk(sk)->pcflag = UDPLITE_BIT;
++ return 0;
++}
++
+ static int udplite_rcv(struct sk_buff *skb)
+ {
+ return __udp4_lib_rcv(skb, &udplite_table, IPPROTO_UDPLITE);
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index 5c2351deedc8f..c8f39d61b51e1 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -107,6 +107,13 @@ static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
+ return (struct ipv6_pinfo *)(((u8 *)sk) + offset);
+ }
+
++void inet6_sock_destruct(struct sock *sk)
++{
++ inet6_cleanup_sock(sk);
++ inet_sock_destruct(sk);
++}
++EXPORT_SYMBOL_GPL(inet6_sock_destruct);
++
+ static int inet6_create(struct net *net, struct socket *sock, int protocol,
+ int kern)
+ {
+@@ -199,7 +206,7 @@ lookup_protocol:
+ inet->hdrincl = 1;
+ }
+
+- sk->sk_destruct = inet_sock_destruct;
++ sk->sk_destruct = inet6_sock_destruct;
+ sk->sk_family = PF_INET6;
+ sk->sk_protocol = protocol;
+
+@@ -502,6 +509,12 @@ void inet6_destroy_sock(struct sock *sk)
+ }
+ EXPORT_SYMBOL_GPL(inet6_destroy_sock);
+
++void inet6_cleanup_sock(struct sock *sk)
++{
++ inet6_destroy_sock(sk);
++}
++EXPORT_SYMBOL_GPL(inet6_cleanup_sock);
++
+ /*
+ * This does both peername and sockname.
+ */
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index 4f958d24f9e4a..1c155e610c06d 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -178,9 +178,6 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ if (optlen < sizeof(int))
+ goto e_inval;
+ if (val == PF_INET) {
+- struct ipv6_txoptions *opt;
+- struct sk_buff *pktopt;
+-
+ if (sk->sk_type == SOCK_RAW)
+ break;
+
+@@ -211,7 +208,6 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ break;
+ }
+
+- fl6_free_socklist(sk);
+ __ipv6_sock_mc_close(sk);
+ __ipv6_sock_ac_close(sk);
+
+@@ -246,14 +242,14 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ sk->sk_socket->ops = &inet_dgram_ops;
+ sk->sk_family = PF_INET;
+ }
+- opt = xchg((__force struct ipv6_txoptions **)&np->opt,
+- NULL);
+- if (opt) {
+- atomic_sub(opt->tot_len, &sk->sk_omem_alloc);
+- txopt_put(opt);
+- }
+- pktopt = xchg(&np->pktoptions, NULL);
+- kfree_skb(pktopt);
++
++ /* Disable all options not to allocate memory anymore,
++ * but there is still a race. See the lockless path
++ * in udpv6_sendmsg() and ipv6_local_rxpmtu().
++ */
++ np->rxopt.all = 0;
++
++ inet6_cleanup_sock(sk);
+
+ /*
+ * ... and add it to the refcnt debug socks count
+diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
+index 23ae01715e7b1..5c9be8594483f 100644
+--- a/net/ipv6/ping.c
++++ b/net/ipv6/ping.c
+@@ -27,11 +27,6 @@
+ #include <linux/proc_fs.h>
+ #include <net/ping.h>
+
+-static void ping_v6_destroy(struct sock *sk)
+-{
+- inet6_destroy_sock(sk);
+-}
+-
+ /* Compatibility glue so we can support IPv6 when it's compiled as a module */
+ static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
+ int *addr_len)
+@@ -175,7 +170,6 @@ struct proto pingv6_prot = {
+ .owner = THIS_MODULE,
+ .init = ping_init_sock,
+ .close = ping_close,
+- .destroy = ping_v6_destroy,
+ .connect = ip6_datagram_connect_v6_only,
+ .disconnect = __udp_disconnect,
+ .setsockopt = ipv6_setsockopt,
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 44e9a240d6070..8ed99732e24c9 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -1259,8 +1259,6 @@ static void raw6_destroy(struct sock *sk)
+ lock_sock(sk);
+ ip6_flush_pending_frames(sk);
+ release_sock(sk);
+-
+- inet6_destroy_sock(sk);
+ }
+
+ static int rawv6_init_sk(struct sock *sk)
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index f69c1b83403b7..033cf81f34837 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1792,12 +1792,6 @@ static int tcp_v6_init_sock(struct sock *sk)
+ return 0;
+ }
+
+-static void tcp_v6_destroy_sock(struct sock *sk)
+-{
+- tcp_v4_destroy_sock(sk);
+- inet6_destroy_sock(sk);
+-}
+-
+ #ifdef CONFIG_PROC_FS
+ /* Proc filesystem TCPv6 sock list dumping. */
+ static void get_openreq6(struct seq_file *seq,
+@@ -1990,7 +1984,7 @@ struct proto tcpv6_prot = {
+ .accept = inet_csk_accept,
+ .ioctl = tcp_ioctl,
+ .init = tcp_v6_init_sock,
+- .destroy = tcp_v6_destroy_sock,
++ .destroy = tcp_v4_destroy_sock,
+ .shutdown = tcp_shutdown,
+ .setsockopt = tcp_setsockopt,
+ .getsockopt = tcp_getsockopt,
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 16c98a2a5c363..9274603514e54 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -66,6 +66,19 @@ static bool udp6_lib_exact_dif_match(struct net *net, struct sk_buff *skb)
+ return false;
+ }
+
++static void udpv6_destruct_sock(struct sock *sk)
++{
++ udp_destruct_common(sk);
++ inet6_sock_destruct(sk);
++}
++
++int udpv6_init_sock(struct sock *sk)
++{
++ skb_queue_head_init(&udp_sk(sk)->reader_queue);
++ sk->sk_destruct = udpv6_destruct_sock;
++ return 0;
++}
++
+ static u32 udp6_ehashfn(const struct net *net,
+ const struct in6_addr *laddr,
+ const u16 lport,
+@@ -1490,8 +1503,6 @@ void udpv6_destroy_sock(struct sock *sk)
+ if (encap_destroy)
+ encap_destroy(sk);
+ }
+-
+- inet6_destroy_sock(sk);
+ }
+
+ /*
+@@ -1595,7 +1606,7 @@ struct proto udpv6_prot = {
+ .connect = ip6_datagram_connect,
+ .disconnect = udp_disconnect,
+ .ioctl = udp_ioctl,
+- .init = udp_init_sock,
++ .init = udpv6_init_sock,
+ .destroy = udpv6_destroy_sock,
+ .setsockopt = udpv6_setsockopt,
+ .getsockopt = udpv6_getsockopt,
+diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
+index 7903e21c178b9..e5d067b09ccfa 100644
+--- a/net/ipv6/udp_impl.h
++++ b/net/ipv6/udp_impl.h
+@@ -12,6 +12,7 @@ int __udp6_lib_rcv(struct sk_buff *, struct udp_table *, int);
+ void __udp6_lib_err(struct sk_buff *, struct inet6_skb_parm *, u8, u8, int,
+ __be32, struct udp_table *);
+
++int udpv6_init_sock(struct sock *sk);
+ int udp_v6_get_port(struct sock *sk, unsigned short snum);
+
+ int udpv6_getsockopt(struct sock *sk, int level, int optname,
+diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
+index 5000ad6878e6f..f15b8305d87bf 100644
+--- a/net/ipv6/udplite.c
++++ b/net/ipv6/udplite.c
+@@ -15,6 +15,13 @@
+ #include <linux/proc_fs.h>
+ #include "udp_impl.h"
+
++static int udplitev6_sk_init(struct sock *sk)
++{
++ udpv6_init_sock(sk);
++ udp_sk(sk)->pcflag = UDPLITE_BIT;
++ return 0;
++}
++
+ static int udplitev6_rcv(struct sk_buff *skb)
+ {
+ return __udp6_lib_rcv(skb, &udplite_table, IPPROTO_UDPLITE);
+@@ -40,7 +47,7 @@ struct proto udplitev6_prot = {
+ .connect = ip6_datagram_connect,
+ .disconnect = udp_disconnect,
+ .ioctl = udp_ioctl,
+- .init = udplite_sk_init,
++ .init = udplitev6_sk_init,
+ .destroy = udpv6_destroy_sock,
+ .setsockopt = udpv6_setsockopt,
+ .getsockopt = udpv6_getsockopt,
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index 9dae10d8880cf..f3f0b4b7c3863 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -272,8 +272,6 @@ static void l2tp_ip6_destroy_sock(struct sock *sk)
+
+ if (tunnel)
+ l2tp_tunnel_delete(tunnel);
+-
+- inet6_destroy_sock(sk);
+ }
+
+ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index 20dc1851d4ffe..c2a68f6e427ed 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -433,15 +433,16 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
+ } else
+ weight = 1;
+
+- if (tb[TCA_QFQ_LMAX]) {
++ if (tb[TCA_QFQ_LMAX])
+ lmax = nla_get_u32(tb[TCA_QFQ_LMAX]);
+- if (lmax < QFQ_MIN_LMAX || lmax > (1UL << QFQ_MTU_SHIFT)) {
+- pr_notice("qfq: invalid max length %u\n", lmax);
+- return -EINVAL;
+- }
+- } else
++ else
+ lmax = psched_mtu(qdisc_dev(sch));
+
++ if (lmax < QFQ_MIN_LMAX || lmax > (1UL << QFQ_MTU_SHIFT)) {
++ pr_notice("qfq: invalid max length %u\n", lmax);
++ return -EINVAL;
++ }
++
+ inv_w = ONE_FP / weight;
+ weight = ONE_FP / inv_w;
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 355b89579e930..a68f3d6b72335 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4828,13 +4828,17 @@ static void sctp_destroy_sock(struct sock *sk)
+ }
+
+ /* Triggered when there are no references on the socket anymore */
+-static void sctp_destruct_sock(struct sock *sk)
++static void sctp_destruct_common(struct sock *sk)
+ {
+ struct sctp_sock *sp = sctp_sk(sk);
+
+ /* Free up the HMAC transform. */
+ crypto_free_shash(sp->hmac);
++}
+
++static void sctp_destruct_sock(struct sock *sk)
++{
++ sctp_destruct_common(sk);
+ inet_sock_destruct(sk);
+ }
+
+@@ -8764,7 +8768,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
+ sctp_sk(newsk)->reuse = sp->reuse;
+
+ newsk->sk_shutdown = sk->sk_shutdown;
+- newsk->sk_destruct = sctp_destruct_sock;
++ newsk->sk_destruct = sk->sk_destruct;
+ newsk->sk_family = sk->sk_family;
+ newsk->sk_protocol = IPPROTO_SCTP;
+ newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
+@@ -8984,11 +8988,20 @@ struct proto sctp_prot = {
+
+ #if IS_ENABLED(CONFIG_IPV6)
+
+-#include <net/transp_v6.h>
+-static void sctp_v6_destroy_sock(struct sock *sk)
++static void sctp_v6_destruct_sock(struct sock *sk)
++{
++ sctp_destruct_common(sk);
++ inet6_sock_destruct(sk);
++}
++
++static int sctp_v6_init_sock(struct sock *sk)
+ {
+- sctp_destroy_sock(sk);
+- inet6_destroy_sock(sk);
++ int ret = sctp_init_sock(sk);
++
++ if (!ret)
++ sk->sk_destruct = sctp_v6_destruct_sock;
++
++ return ret;
+ }
+
+ struct proto sctpv6_prot = {
+@@ -8998,8 +9011,8 @@ struct proto sctpv6_prot = {
+ .disconnect = sctp_disconnect,
+ .accept = sctp_accept,
+ .ioctl = sctp_ioctl,
+- .init = sctp_init_sock,
+- .destroy = sctp_v6_destroy_sock,
++ .init = sctp_v6_init_sock,
++ .destroy = sctp_destroy_sock,
+ .shutdown = sctp_shutdown,
+ .setsockopt = sctp_setsockopt,
+ .getsockopt = sctp_getsockopt,
+diff --git a/scripts/asn1_compiler.c b/scripts/asn1_compiler.c
+index c146020fc7838..f14d70768cf4a 100644
+--- a/scripts/asn1_compiler.c
++++ b/scripts/asn1_compiler.c
+@@ -629,7 +629,7 @@ int main(int argc, char **argv)
+ p = strrchr(argv[1], '/');
+ p = p ? p + 1 : argv[1];
+ grammar_name = strdup(p);
+- if (!p) {
++ if (!grammar_name) {
+ perror(NULL);
+ exit(1);
+ }
+diff --git a/tools/testing/selftests/sigaltstack/current_stack_pointer.h b/tools/testing/selftests/sigaltstack/current_stack_pointer.h
+new file mode 100644
+index 0000000000000..ea9bdf3a90b16
+--- /dev/null
++++ b/tools/testing/selftests/sigaltstack/current_stack_pointer.h
+@@ -0,0 +1,23 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++#if __alpha__
++register unsigned long sp asm("$30");
++#elif __arm__ || __aarch64__ || __csky__ || __m68k__ || __mips__ || __riscv
++register unsigned long sp asm("sp");
++#elif __i386__
++register unsigned long sp asm("esp");
++#elif __loongarch64
++register unsigned long sp asm("$sp");
++#elif __ppc__
++register unsigned long sp asm("r1");
++#elif __s390x__
++register unsigned long sp asm("%15");
++#elif __sh__
++register unsigned long sp asm("r15");
++#elif __x86_64__
++register unsigned long sp asm("rsp");
++#elif __XTENSA__
++register unsigned long sp asm("a1");
++#else
++#error "implement current_stack_pointer equivalent"
++#endif
+diff --git a/tools/testing/selftests/sigaltstack/sas.c b/tools/testing/selftests/sigaltstack/sas.c
+index 228c2ae47687d..6069d97bf5063 100644
+--- a/tools/testing/selftests/sigaltstack/sas.c
++++ b/tools/testing/selftests/sigaltstack/sas.c
+@@ -19,6 +19,7 @@
+ #include <errno.h>
+
+ #include "../kselftest.h"
++#include "current_stack_pointer.h"
+
+ #ifndef SS_AUTODISARM
+ #define SS_AUTODISARM (1U << 31)
+@@ -40,12 +41,6 @@ void my_usr1(int sig, siginfo_t *si, void *u)
+ stack_t stk;
+ struct stk_data *p;
+
+-#if __s390x__
+- register unsigned long sp asm("%15");
+-#else
+- register unsigned long sp asm("sp");
+-#endif
+-
+ if (sp < (unsigned long)sstack ||
+ sp >= (unsigned long)sstack + SIGSTKSZ) {
+ ksft_exit_fail_msg("SP is not on sigaltstack\n");
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-05-10 17:59 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-05-10 17:59 UTC (permalink / raw
To: gentoo-commits
commit: 849309bfe8d9e7f0a63d0c3439fe87e3e74eb8aa
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 10 17:59:07 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 10 17:59:07 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=849309bf
netfilter: nf_tables: deactivate anonymous set from preparation phase
Bug: https://bugs.gentoo.org/90606
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
...nf-tables-make-deleted-anon-sets-inactive.patch | 121 +++++++++++++++++++++
2 files changed, 125 insertions(+)
diff --git a/0000_README b/0000_README
index 4cf6104f..a4bd25f7 100644
--- a/0000_README
+++ b/0000_README
@@ -1179,6 +1179,10 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default.
+Patch: 1520_fs-enable-link-security-restrictions-by-default.patch
+From: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=c1592a89942e9678f7d9c8030efa777c0d57edab
+Desc: netfilter: nf_tables: deactivate anonymous set from preparation phase
+
Patch: 1900_fs-increase-BINPRM-BUF-SIZE-to-256.patch
From: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/exec.c?id=6eb3c3d0a52dca337e327ae8868ca1f44a712e02
Desc: exec: increase BINPRM_BUF_SIZE to 256
diff --git a/1520_nf-tables-make-deleted-anon-sets-inactive.patch b/1520_nf-tables-make-deleted-anon-sets-inactive.patch
new file mode 100644
index 00000000..cd75de5c
--- /dev/null
+++ b/1520_nf-tables-make-deleted-anon-sets-inactive.patch
@@ -0,0 +1,121 @@
+From c1592a89942e9678f7d9c8030efa777c0d57edab Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 2 May 2023 10:25:24 +0200
+Subject: netfilter: nf_tables: deactivate anonymous set from preparation phase
+
+Toggle deleted anonymous sets as inactive in the next generation, so
+users cannot perform any update on it. Clear the generation bitmask
+in case the transaction is aborted.
+
+The following KASAN splat shows a set element deletion for a bound
+anonymous set that has been already removed in the same transaction.
+
+[ 64.921510] ==================================================================
+[ 64.923123] BUG: KASAN: wild-memory-access in nf_tables_commit+0xa24/0x1490 [nf_tables]
+[ 64.924745] Write of size 8 at addr dead000000000122 by task test/890
+[ 64.927903] CPU: 3 PID: 890 Comm: test Not tainted 6.3.0+ #253
+[ 64.931120] Call Trace:
+[ 64.932699] <TASK>
+[ 64.934292] dump_stack_lvl+0x33/0x50
+[ 64.935908] ? nf_tables_commit+0xa24/0x1490 [nf_tables]
+[ 64.937551] kasan_report+0xda/0x120
+[ 64.939186] ? nf_tables_commit+0xa24/0x1490 [nf_tables]
+[ 64.940814] nf_tables_commit+0xa24/0x1490 [nf_tables]
+[ 64.942452] ? __kasan_slab_alloc+0x2d/0x60
+[ 64.944070] ? nf_tables_setelem_notify+0x190/0x190 [nf_tables]
+[ 64.945710] ? kasan_set_track+0x21/0x30
+[ 64.947323] nfnetlink_rcv_batch+0x709/0xd90 [nfnetlink]
+[ 64.948898] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink]
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ include/net/netfilter/nf_tables.h | 1 +
+ net/netfilter/nf_tables_api.c | 12 ++++++++++++
+ net/netfilter/nft_dynset.c | 2 +-
+ net/netfilter/nft_lookup.c | 2 +-
+ net/netfilter/nft_objref.c | 2 +-
+ 5 files changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 3ed21d2d56590..2e24ea1d744c2 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -619,6 +619,7 @@ struct nft_set_binding {
+ };
+
+ enum nft_trans_phase;
++void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set);
+ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
+ struct nft_set_binding *binding,
+ enum nft_trans_phase phase);
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 8b6c61a2196cb..59fb8320ab4d7 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -5127,12 +5127,24 @@ static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
+ }
+ }
+
++void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set)
++{
++ if (nft_set_is_anonymous(set))
++ nft_clear(ctx->net, set);
++
++ set->use++;
++}
++EXPORT_SYMBOL_GPL(nf_tables_activate_set);
++
+ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
+ struct nft_set_binding *binding,
+ enum nft_trans_phase phase)
+ {
+ switch (phase) {
+ case NFT_TRANS_PREPARE:
++ if (nft_set_is_anonymous(set))
++ nft_deactivate_next(ctx->net, set);
++
+ set->use--;
+ return;
+ case NFT_TRANS_ABORT:
+diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
+index 274579b1696e0..bd19c7aec92ee 100644
+--- a/net/netfilter/nft_dynset.c
++++ b/net/netfilter/nft_dynset.c
+@@ -342,7 +342,7 @@ static void nft_dynset_activate(const struct nft_ctx *ctx,
+ {
+ struct nft_dynset *priv = nft_expr_priv(expr);
+
+- priv->set->use++;
++ nf_tables_activate_set(ctx, priv->set);
+ }
+
+ static void nft_dynset_destroy(const struct nft_ctx *ctx,
+diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
+index cecf8ab90e58f..03ef4fdaa460b 100644
+--- a/net/netfilter/nft_lookup.c
++++ b/net/netfilter/nft_lookup.c
+@@ -167,7 +167,7 @@ static void nft_lookup_activate(const struct nft_ctx *ctx,
+ {
+ struct nft_lookup *priv = nft_expr_priv(expr);
+
+- priv->set->use++;
++ nf_tables_activate_set(ctx, priv->set);
+ }
+
+ static void nft_lookup_destroy(const struct nft_ctx *ctx,
+diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
+index cb37169608bab..a48dd5b5d45b1 100644
+--- a/net/netfilter/nft_objref.c
++++ b/net/netfilter/nft_objref.c
+@@ -185,7 +185,7 @@ static void nft_objref_map_activate(const struct nft_ctx *ctx,
+ {
+ struct nft_objref_map *priv = nft_expr_priv(expr);
+
+- priv->set->use++;
++ nf_tables_activate_set(ctx, priv->set);
+ }
+
+ static void nft_objref_map_destroy(const struct nft_ctx *ctx,
+--
+cgit
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-05-17 11:01 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-05-17 11:01 UTC (permalink / raw
To: gentoo-commits
commit: 08c547f6bd4fc86ffc82656d5159621a976113ba
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 17 11:01:06 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 17 11:01:06 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=08c547f6
Linux patch 4.19.283
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1282_linux-4.19.283.patch | 8473 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 8477 insertions(+)
diff --git a/0000_README b/0000_README
index a4bd25f7..6d1fb943 100644
--- a/0000_README
+++ b/0000_README
@@ -1171,6 +1171,10 @@ Patch: 1281_linux-4.19.282.patch
From: https://www.kernel.org
Desc: Linux 4.19.282
+Patch: 1282_linux-4.19.283.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.283
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1282_linux-4.19.283.patch b/1282_linux-4.19.283.patch
new file mode 100644
index 00000000..171418c3
--- /dev/null
+++ b/1282_linux-4.19.283.patch
@@ -0,0 +1,8473 @@
+diff --git a/Documentation/media/uapi/v4l/subdev-formats.rst b/Documentation/media/uapi/v4l/subdev-formats.rst
+index 8e73fcfc69000..cc2ad8af51ea0 100644
+--- a/Documentation/media/uapi/v4l/subdev-formats.rst
++++ b/Documentation/media/uapi/v4l/subdev-formats.rst
+@@ -7565,3 +7565,30 @@ formats.
+ - 0x5001
+ - Interleaved raw UYVY and JPEG image format with embedded meta-data
+ used by Samsung S3C73MX camera sensors.
++
++.. _v4l2-mbus-metadata-fmts:
++
++Metadata Formats
++^^^^^^^^^^^^^^^^
++
++This section lists all metadata formats.
++
++The following table lists the existing metadata formats.
++
++.. tabularcolumns:: |p{8.0cm}|p{1.4cm}|p{7.7cm}|
++
++.. flat-table:: Metadata formats
++ :header-rows: 1
++ :stub-columns: 0
++
++ * - Identifier
++ - Code
++ - Comments
++ * .. _MEDIA-BUS-FMT-METADATA-FIXED:
++
++ - MEDIA_BUS_FMT_METADATA_FIXED
++ - 0x7001
++ - This format should be used when the same driver handles
++ both sides of the link and the bus format is a fixed
++ metadata format that is not configurable from userspace.
++ Width and height will be set to 0 for this format.
+diff --git a/Makefile b/Makefile
+index 6ed7f3fe3a4e8..71416fde73483 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 282
++SUBLEVEL = 283
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/exynos4412-itop-elite.dts b/arch/arm/boot/dts/exynos4412-itop-elite.dts
+index 0dedeba89b5f4..d2350561b0510 100644
+--- a/arch/arm/boot/dts/exynos4412-itop-elite.dts
++++ b/arch/arm/boot/dts/exynos4412-itop-elite.dts
+@@ -184,7 +184,7 @@
+ compatible = "wlf,wm8960";
+ reg = <0x1a>;
+ clocks = <&pmu_system_controller 0>;
+- clock-names = "MCLK1";
++ clock-names = "mclk";
+ wlf,shared-lrclk;
+ #sound-dai-cells = <0>;
+ };
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 59527bb1225a9..cb90e7645d08c 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -387,8 +387,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000>,
+- <0x82000000 0 0x40300000 0x40300000 0 0x00d00000>;
++ ranges = <0x81000000 0x0 0x00000000 0x40200000 0x0 0x00100000>,
++ <0x82000000 0x0 0x40300000 0x40300000 0x0 0x00d00000>;
+
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi
+index 020a864623ff4..781ddfdc5f873 100644
+--- a/arch/arm/boot/dts/s5pv210.dtsi
++++ b/arch/arm/boot/dts/s5pv210.dtsi
+@@ -560,7 +560,7 @@
+ interrupts = <29>;
+ clocks = <&clocks CLK_CSIS>,
+ <&clocks SCLK_CSIS>;
+- clock-names = "clk_csis",
++ clock-names = "csis",
+ "sclk_csis";
+ bus-width = <4>;
+ status = "disabled";
+diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h
+index 41b065f1be88c..13630e8078ff4 100644
+--- a/arch/arm64/include/asm/debug-monitors.h
++++ b/arch/arm64/include/asm/debug-monitors.h
+@@ -125,6 +125,7 @@ void user_regs_reset_single_step(struct user_pt_regs *regs,
+ void kernel_enable_single_step(struct pt_regs *regs);
+ void kernel_disable_single_step(void);
+ int kernel_active_single_step(void);
++void kernel_rewind_single_step(struct pt_regs *regs);
+
+ #ifdef CONFIG_HAVE_HW_BREAKPOINT
+ int reinstall_suspended_bps(struct pt_regs *regs);
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index 501e835c65007..f5837937cd932 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -437,6 +437,11 @@ int kernel_active_single_step(void)
+ }
+ NOKPROBE_SYMBOL(kernel_active_single_step);
+
++void kernel_rewind_single_step(struct pt_regs *regs)
++{
++ set_regs_spsr_ss(regs);
++}
++
+ /* ptrace API */
+ void user_enable_single_step(struct task_struct *task)
+ {
+diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
+index 8815b5457dd0b..d7847ef10e9d3 100644
+--- a/arch/arm64/kernel/kgdb.c
++++ b/arch/arm64/kernel/kgdb.c
+@@ -234,6 +234,8 @@ int kgdb_arch_handle_exception(int exception_vector, int signo,
+ */
+ if (!kernel_active_single_step())
+ kernel_enable_single_step(linux_regs);
++ else
++ kernel_rewind_single_step(linux_regs);
+ err = 0;
+ break;
+ default:
+diff --git a/arch/ia64/kernel/salinfo.c b/arch/ia64/kernel/salinfo.c
+index aba1f463a8dd4..b889db4492c8d 100644
+--- a/arch/ia64/kernel/salinfo.c
++++ b/arch/ia64/kernel/salinfo.c
+@@ -580,7 +580,7 @@ static int salinfo_cpu_pre_down(unsigned int cpu)
+ * 'data' contains an integer that corresponds to the feature we're
+ * testing
+ */
+-static int proc_salinfo_show(struct seq_file *m, void *v)
++static int __maybe_unused proc_salinfo_show(struct seq_file *m, void *v)
+ {
+ unsigned long data = (unsigned long)v;
+ seq_puts(m, (sal_platform_features & data) ? "1\n" : "0\n");
+diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
+index e2e40bbd391c6..18a2b105f7f30 100644
+--- a/arch/ia64/mm/contig.c
++++ b/arch/ia64/mm/contig.c
+@@ -82,7 +82,7 @@ skip:
+ return __per_cpu_start + __per_cpu_offset[smp_processor_id()];
+ }
+
+-static inline void
++static inline __init void
+ alloc_per_cpu_data(void)
+ {
+ cpu_data = __alloc_bootmem(PERCPU_PAGE_SIZE * num_possible_cpus(),
+diff --git a/arch/mips/fw/lib/cmdline.c b/arch/mips/fw/lib/cmdline.c
+index 6ecda64ad1842..ed88abc40513b 100644
+--- a/arch/mips/fw/lib/cmdline.c
++++ b/arch/mips/fw/lib/cmdline.c
+@@ -51,7 +51,7 @@ char *fw_getenv(char *envname)
+ {
+ char *result = NULL;
+
+- if (_fw_envp != NULL) {
++ if (_fw_envp != NULL && fw_envp(0) != NULL) {
+ /*
+ * Return a pointer to the given environment variable.
+ * YAMON uses "name", "value" pairs, while U-Boot uses
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index c2c3ce8a0f84e..7b408d67f11e1 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -177,7 +177,6 @@ handler: ;\
+ l.sw PT_GPR28(r1),r28 ;\
+ l.sw PT_GPR29(r1),r29 ;\
+ /* r30 already save */ ;\
+-/* l.sw PT_GPR30(r1),r30*/ ;\
+ l.sw PT_GPR31(r1),r31 ;\
+ TRACE_IRQS_OFF_ENTRY ;\
+ /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\
+@@ -215,9 +214,8 @@ handler: ;\
+ l.sw PT_GPR27(r1),r27 ;\
+ l.sw PT_GPR28(r1),r28 ;\
+ l.sw PT_GPR29(r1),r29 ;\
+- /* r31 already saved */ ;\
+- l.sw PT_GPR30(r1),r30 ;\
+-/* l.sw PT_GPR31(r1),r31 */ ;\
++ /* r30 already saved */ ;\
++ l.sw PT_GPR31(r1),r31 ;\
+ /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\
+ l.addi r30,r0,-1 ;\
+ l.sw PT_ORIG_GPR11(r1),r30 ;\
+diff --git a/arch/parisc/kernel/real2.S b/arch/parisc/kernel/real2.S
+index 2b16d8d6598f1..c37010a135865 100644
+--- a/arch/parisc/kernel/real2.S
++++ b/arch/parisc/kernel/real2.S
+@@ -248,9 +248,6 @@ ENTRY_CFI(real64_call_asm)
+ /* save fn */
+ copy %arg2, %r31
+
+- /* set up the new ap */
+- ldo 64(%arg1), %r29
+-
+ /* load up the arg registers from the saved arg area */
+ /* 32-bit calling convention passes first 4 args in registers */
+ ldd 0*REG_SZ(%arg1), %arg0 /* note overwriting arg0 */
+@@ -262,7 +259,9 @@ ENTRY_CFI(real64_call_asm)
+ ldd 7*REG_SZ(%arg1), %r19
+ ldd 1*REG_SZ(%arg1), %arg1 /* do this one last! */
+
++ /* set up real-mode stack and real-mode ap */
+ tophys_r1 %sp
++ ldo -16(%sp), %r29 /* Reference param save area */
+
+ b,l rfi_virt2real,%r2
+ nop
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 7c7648e6f1c22..2646dd54eb0bb 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -401,7 +401,7 @@ static char *__fetch_rtas_last_error(char *altbuf)
+ buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC);
+ }
+ if (buf)
+- memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
++ memmove(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
+ }
+
+ return buf;
+diff --git a/arch/powerpc/platforms/512x/clock-commonclk.c b/arch/powerpc/platforms/512x/clock-commonclk.c
+index b3097fe6441b9..1019d78e44bb4 100644
+--- a/arch/powerpc/platforms/512x/clock-commonclk.c
++++ b/arch/powerpc/platforms/512x/clock-commonclk.c
+@@ -985,7 +985,7 @@ static void mpc5121_clk_provide_migration_support(void)
+
+ #define NODE_PREP do { \
+ of_address_to_resource(np, 0, &res); \
+- snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \
++ snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \
+ } while (0)
+
+ #define NODE_CHK(clkname, clkitem, regnode, regflag) do { \
+diff --git a/arch/powerpc/platforms/embedded6xx/flipper-pic.c b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
+index db0be007fd063..bfca4d42b00d3 100644
+--- a/arch/powerpc/platforms/embedded6xx/flipper-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
+@@ -149,7 +149,7 @@ static struct irq_domain * __init flipper_pic_init(struct device_node *np)
+ }
+ io_base = ioremap(res.start, resource_size(&res));
+
+- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base);
+
+ __flipper_quiesce(io_base);
+
+diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+index 7b4edf1cb2c8d..bdc7e1a80366f 100644
+--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+@@ -178,7 +178,7 @@ static struct irq_domain *hlwd_pic_init(struct device_node *np)
+ return NULL;
+ }
+
+- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base);
+
+ __hlwd_quiesce(io_base);
+
+diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c
+index 343bffd20fcaf..768231005fb5a 100644
+--- a/arch/powerpc/platforms/embedded6xx/wii.c
++++ b/arch/powerpc/platforms/embedded6xx/wii.c
+@@ -122,8 +122,8 @@ static void __iomem *wii_ioremap_hw_regs(char *name, char *compatible)
+
+ hw_regs = ioremap(res.start, resource_size(&res));
+ if (hw_regs) {
+- pr_info("%s at 0x%08x mapped to 0x%p\n", name,
+- res.start, hw_regs);
++ pr_info("%s at 0x%pa mapped to 0x%p\n", name,
++ &res.start, hw_regs);
+ }
+
+ out_put:
+diff --git a/arch/powerpc/sysdev/tsi108_pci.c b/arch/powerpc/sysdev/tsi108_pci.c
+index 28ff1f53cefc1..6bd50c690006f 100644
+--- a/arch/powerpc/sysdev/tsi108_pci.c
++++ b/arch/powerpc/sysdev/tsi108_pci.c
+@@ -229,9 +229,8 @@ int __init tsi108_setup_pci(struct device_node *dev, u32 cfg_phys, int primary)
+
+ (hose)->ops = &tsi108_direct_pci_ops;
+
+- printk(KERN_INFO "Found tsi108 PCI host bridge at 0x%08x. "
+- "Firmware bus number: %d->%d\n",
+- rsrc.start, hose->first_busno, hose->last_busno);
++ pr_info("Found tsi108 PCI host bridge at 0x%pa. Firmware bus number: %d->%d\n",
++ &rsrc.start, hose->first_busno, hose->last_busno);
+
+ /* Interpret the "ranges" property */
+ /* This also maps the I/O region and sets isa_io/mem_base */
+diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c
+index 4ca78ed71ad2c..c218bae8fe208 100644
+--- a/arch/sh/kernel/cpu/sh4/sq.c
++++ b/arch/sh/kernel/cpu/sh4/sq.c
+@@ -383,7 +383,7 @@ static int __init sq_api_init(void)
+ if (unlikely(!sq_cache))
+ return ret;
+
+- sq_bitmap = kzalloc(size, GFP_KERNEL);
++ sq_bitmap = kcalloc(size, sizeof(long), GFP_KERNEL);
+ if (unlikely(!sq_bitmap))
+ goto out;
+
+diff --git a/arch/sh/kernel/head_32.S b/arch/sh/kernel/head_32.S
+index 4e352c3f79e6b..fb505cda25fc8 100644
+--- a/arch/sh/kernel/head_32.S
++++ b/arch/sh/kernel/head_32.S
+@@ -67,7 +67,7 @@ ENTRY(_stext)
+ ldc r0, r6_bank
+ #endif
+
+-#ifdef CONFIG_OF_FLATTREE
++#ifdef CONFIG_OF_EARLY_FLATTREE
+ mov r4, r12 ! Store device tree blob pointer in r12
+ #endif
+
+@@ -318,7 +318,7 @@ ENTRY(_stext)
+ 10:
+ #endif
+
+-#ifdef CONFIG_OF_FLATTREE
++#ifdef CONFIG_OF_EARLY_FLATTREE
+ mov.l 8f, r0 ! Make flat device tree available early.
+ jsr @r0
+ mov r12, r4
+@@ -349,7 +349,7 @@ ENTRY(stack_start)
+ 5: .long start_kernel
+ 6: .long cpu_init
+ 7: .long init_thread_union
+-#if defined(CONFIG_OF_FLATTREE)
++#if defined(CONFIG_OF_EARLY_FLATTREE)
+ 8: .long sh_fdt_init
+ #endif
+
+diff --git a/arch/sh/kernel/nmi_debug.c b/arch/sh/kernel/nmi_debug.c
+index 730d928f0d124..d37b54f9cec6f 100644
+--- a/arch/sh/kernel/nmi_debug.c
++++ b/arch/sh/kernel/nmi_debug.c
+@@ -52,7 +52,7 @@ static int __init nmi_debug_setup(char *str)
+ register_die_notifier(&nmi_debug_nb);
+
+ if (*str != '=')
+- return 0;
++ return 1;
+
+ for (p = str + 1; *p; p = sep + 1) {
+ sep = strchr(p, ',');
+@@ -73,6 +73,6 @@ static int __init nmi_debug_setup(char *str)
+ break;
+ }
+
+- return 0;
++ return 1;
+ }
+ __setup("nmi_debug", nmi_debug_setup);
+diff --git a/arch/sh/kernel/setup.c b/arch/sh/kernel/setup.c
+index c286cf5da6e77..b2f44eb7ce19b 100644
+--- a/arch/sh/kernel/setup.c
++++ b/arch/sh/kernel/setup.c
+@@ -242,7 +242,7 @@ void __init __weak plat_early_device_setup(void)
+ {
+ }
+
+-#ifdef CONFIG_OF_FLATTREE
++#ifdef CONFIG_OF_EARLY_FLATTREE
+ void __ref sh_fdt_init(phys_addr_t dt_phys)
+ {
+ static int done = 0;
+@@ -329,7 +329,7 @@ void __init setup_arch(char **cmdline_p)
+ /* Let earlyprintk output early console messages */
+ early_platform_driver_probe("earlyprintk", 1, 1);
+
+-#ifdef CONFIG_OF_FLATTREE
++#ifdef CONFIG_OF_EARLY_FLATTREE
+ #ifdef CONFIG_USE_BUILTIN_DTB
+ unflatten_and_copy_device_tree();
+ #else
+diff --git a/arch/sh/math-emu/sfp-util.h b/arch/sh/math-emu/sfp-util.h
+index 784f541344f36..bda50762b3d33 100644
+--- a/arch/sh/math-emu/sfp-util.h
++++ b/arch/sh/math-emu/sfp-util.h
+@@ -67,7 +67,3 @@
+ } while (0)
+
+ #define abort() return 0
+-
+-#define __BYTE_ORDER __LITTLE_ENDIAN
+-
+-
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 926939978c1c3..9318fe7d850e3 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -403,10 +403,9 @@ static unsigned int reserve_eilvt_offset(int offset, unsigned int new)
+ if (vector && !eilvt_entry_is_changeable(vector, new))
+ /* may not change if vectors are different */
+ return rsvd;
+- rsvd = atomic_cmpxchg(&eilvt_offsets[offset], rsvd, new);
+- } while (rsvd != new);
++ } while (!atomic_try_cmpxchg(&eilvt_offsets[offset], &rsvd, new));
+
+- rsvd &= ~APIC_EILVT_MASKED;
++ rsvd = new & ~APIC_EILVT_MASKED;
+ if (rsvd && rsvd != vector)
+ pr_info("LVT offset %d assigned for vector 0x%02x\n",
+ offset, rsvd);
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 677508baf95a0..af59aa9c55233 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2449,17 +2449,21 @@ static int io_apic_get_redir_entries(int ioapic)
+
+ unsigned int arch_dynirq_lower_bound(unsigned int from)
+ {
++ unsigned int ret;
++
+ /*
+ * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use
+ * gsi_top if ioapic_dynirq_base hasn't been initialized yet.
+ */
+- if (!ioapic_initialized)
+- return gsi_top;
++ ret = ioapic_dynirq_base ? : gsi_top;
++
+ /*
+- * For DT enabled machines ioapic_dynirq_base is irrelevant and not
+- * updated. So simply return @from if ioapic_dynirq_base == 0.
++ * For DT enabled machines ioapic_dynirq_base is irrelevant and
++ * always 0. gsi_top can be 0 if there is no IO/APIC registered.
++ * 0 is an invalid interrupt number for dynamic allocations. Return
++ * @from instead.
+ */
+- return ioapic_dynirq_base ? : from;
++ return ret ? : from;
+ }
+
+ #ifdef CONFIG_X86_32
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index 265e70b0eb79e..55e52064c4ec9 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -13878,6 +13878,21 @@ static int vmx_check_intercept(struct kvm_vcpu *vcpu,
+ /* FIXME: produce nested vmexit and return X86EMUL_INTERCEPTED. */
+ break;
+
++ case x86_intercept_pause:
++ /*
++ * PAUSE is a single-byte NOP with a REPE prefix, i.e. collides
++ * with vanilla NOPs in the emulator. Apply the interception
++ * check only to actual PAUSE instructions. Don't check
++ * PAUSE-loop-exiting, software can't expect a given PAUSE to
++ * exit, i.e. KVM is within its rights to allow L2 to execute
++ * the PAUSE.
++ */
++ if ((info->rep_prefix != REPE_PREFIX) ||
++ !nested_cpu_has2(vmcs12, CPU_BASED_PAUSE_EXITING))
++ return X86EMUL_CONTINUE;
++
++ break;
++
+ /* TODO: check more intercepts... */
+ default:
+ break;
+diff --git a/crypto/drbg.c b/crypto/drbg.c
+index c8c56763dfded..0df8cc9bb5637 100644
+--- a/crypto/drbg.c
++++ b/crypto/drbg.c
+@@ -1512,6 +1512,14 @@ static int drbg_prepare_hrng(struct drbg_state *drbg)
+ return 0;
+
+ drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
++ if (IS_ERR(drbg->jent)) {
++ const int err = PTR_ERR(drbg->jent);
++
++ drbg->jent = NULL;
++ if (fips_enabled)
++ return err;
++ pr_info("DRBG: Continuing without Jitter RNG\n");
++ }
+
+ return 0;
+ }
+@@ -1567,14 +1575,6 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
+ if (ret)
+ goto free_everything;
+
+- if (IS_ERR(drbg->jent)) {
+- ret = PTR_ERR(drbg->jent);
+- drbg->jent = NULL;
+- if (fips_enabled || ret != -ENOENT)
+- goto free_everything;
+- pr_info("DRBG: Continuing without Jitter RNG\n");
+- }
+-
+ reseed = false;
+ }
+
+diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
+index ce5b3ffbd6eef..878ed43d87539 100644
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -494,7 +494,8 @@ static const struct attribute_group *cpu_root_attr_groups[] = {
+ bool cpu_is_hotpluggable(unsigned cpu)
+ {
+ struct device *dev = get_cpu_device(cpu);
+- return dev && container_of(dev, struct cpu, dev)->hotpluggable;
++ return dev && container_of(dev, struct cpu, dev)->hotpluggable
++ && tick_nohz_cpu_hotpluggable(cpu);
+ }
+ EXPORT_SYMBOL_GPL(cpu_is_hotpluggable);
+
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index cbb6ef719978f..d1d6a7af7e784 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -1310,7 +1310,7 @@ static void submit_one_flush(struct drbd_device *device, struct issue_flush_cont
+ bio_set_dev(bio, device->ldev->backing_bdev);
+ bio->bi_private = octx;
+ bio->bi_end_io = one_flush_endio;
+- bio->bi_opf = REQ_OP_FLUSH | REQ_PREFLUSH;
++ bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+
+ device->flush_jif = jiffies;
+ set_bit(FLUSH_PENDING, &device->flags);
+diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
+index bd55bf7a9914c..20142bc77554c 100644
+--- a/drivers/bluetooth/btsdio.c
++++ b/drivers/bluetooth/btsdio.c
+@@ -353,7 +353,6 @@ static void btsdio_remove(struct sdio_func *func)
+
+ BT_DBG("func %p", func);
+
+- cancel_work_sync(&data->work);
+ if (!data)
+ return;
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 4265e8d3e71c5..31cfa47d24984 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -536,9 +536,22 @@ struct ipmi_smi {
+ unsigned int waiting_events_count; /* How many events in queue? */
+ char delivering_events;
+ char event_msg_printed;
++
++ /* How many users are waiting for events? */
+ atomic_t event_waiters;
+ unsigned int ticks_to_req_ev;
+- int last_needs_timer;
++
++ /* How many users are waiting for commands? */
++ atomic_t command_waiters;
++
++ /* How many users are waiting for watchdogs? */
++ atomic_t watchdog_waiters;
++
++ /*
++ * Tells what the lower layer has last been asked to watch for,
++ * messages and/or watchdogs. Protected by xmit_msgs_lock.
++ */
++ unsigned int last_watch_mask;
+
+ /*
+ * The event receiver for my BMC, only really used at panic
+@@ -1085,6 +1098,29 @@ static int intf_err_seq(struct ipmi_smi *intf,
+ return rv;
+ }
+
++/* Must be called with xmit_msgs_lock held. */
++static void smi_tell_to_watch(struct ipmi_smi *intf,
++ unsigned int flags,
++ struct ipmi_smi_msg *smi_msg)
++{
++ if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES) {
++ if (!smi_msg)
++ return;
++
++ if (!smi_msg->needs_response)
++ return;
++ }
++
++ if (!intf->handlers->set_need_watch)
++ return;
++
++ if ((intf->last_watch_mask & flags) == flags)
++ return;
++
++ intf->last_watch_mask |= flags;
++ intf->handlers->set_need_watch(intf->send_info,
++ intf->last_watch_mask);
++}
+
+ static void free_user_work(struct work_struct *work)
+ {
+@@ -1164,8 +1200,9 @@ int ipmi_create_user(unsigned int if_num,
+ spin_unlock_irqrestore(&intf->seq_lock, flags);
+ if (handler->ipmi_watchdog_pretimeout) {
+ /* User wants pretimeouts, so make sure to watch for them. */
+- if (atomic_inc_return(&intf->event_waiters) == 1)
+- need_waiter(intf);
++ if (atomic_inc_return(&intf->watchdog_waiters) == 1)
++ smi_tell_to_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG,
++ NULL);
+ }
+ srcu_read_unlock(&ipmi_interfaces_srcu, index);
+ *user = new_user;
+@@ -1239,7 +1276,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
+ user->handler->shutdown(user->handler_data);
+
+ if (user->handler->ipmi_watchdog_pretimeout)
+- atomic_dec(&intf->event_waiters);
++ atomic_dec(&intf->watchdog_waiters);
+
+ if (user->gets_events)
+ atomic_dec(&intf->event_waiters);
+@@ -1597,8 +1634,8 @@ int ipmi_register_for_cmd(struct ipmi_user *user,
+ goto out_unlock;
+ }
+
+- if (atomic_inc_return(&intf->event_waiters) == 1)
+- need_waiter(intf);
++ if (atomic_inc_return(&intf->command_waiters) == 1)
++ smi_tell_to_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS, NULL);
+
+ list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
+
+@@ -1648,7 +1685,7 @@ int ipmi_unregister_for_cmd(struct ipmi_user *user,
+ synchronize_rcu();
+ release_ipmi_user(user, index);
+ while (rcvrs) {
+- atomic_dec(&intf->event_waiters);
++ atomic_dec(&intf->command_waiters);
+ rcvr = rcvrs;
+ rcvrs = rcvr->next;
+ kfree(rcvr);
+@@ -1765,22 +1802,21 @@ static struct ipmi_smi_msg *smi_add_send_msg(struct ipmi_smi *intf,
+ return smi_msg;
+ }
+
+-
+ static void smi_send(struct ipmi_smi *intf,
+ const struct ipmi_smi_handlers *handlers,
+ struct ipmi_smi_msg *smi_msg, int priority)
+ {
+ int run_to_completion = intf->run_to_completion;
++ unsigned long flags = 0;
+
+- if (run_to_completion) {
+- smi_msg = smi_add_send_msg(intf, smi_msg, priority);
+- } else {
+- unsigned long flags;
+-
++ if (!run_to_completion)
+ spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
+- smi_msg = smi_add_send_msg(intf, smi_msg, priority);
++ smi_msg = smi_add_send_msg(intf, smi_msg, priority);
++
++ smi_tell_to_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES, smi_msg);
++
++ if (!run_to_completion)
+ spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
+- }
+
+ if (smi_msg)
+ handlers->sender(intf->send_info, smi_msg);
+@@ -1978,6 +2014,9 @@ static int i_ipmi_req_ipmb(struct ipmi_smi *intf,
+ ipmb_seq, broadcast,
+ source_address, source_lun);
+
++ /* We will be getting a response in the BMC message queue. */
++ smi_msg->needs_response = true;
++
+ /*
+ * Copy the message into the recv message data, so we
+ * can retransmit it later if necessary.
+@@ -2165,6 +2204,7 @@ static int i_ipmi_request(struct ipmi_user *user,
+ goto out;
+ }
+ }
++ smi_msg->needs_response = false;
+
+ rcu_read_lock();
+ if (intf->in_shutdown) {
+@@ -3386,6 +3426,8 @@ int ipmi_add_smi(struct module *owner,
+ INIT_LIST_HEAD(&intf->hp_xmit_msgs);
+ spin_lock_init(&intf->events_lock);
+ atomic_set(&intf->event_waiters, 0);
++ atomic_set(&intf->watchdog_waiters, 0);
++ atomic_set(&intf->command_waiters, 0);
+ intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
+ INIT_LIST_HEAD(&intf->waiting_events);
+ intf->waiting_events_count = 0;
+@@ -4404,6 +4446,9 @@ static void smi_recv_tasklet(unsigned long val)
+ intf->curr_msg = newmsg;
+ }
+ }
++
++ smi_tell_to_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES, newmsg);
++
+ if (!run_to_completion)
+ spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
+ if (newmsg)
+@@ -4531,7 +4576,7 @@ static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent,
+ struct list_head *timeouts,
+ unsigned long timeout_period,
+ int slot, unsigned long *flags,
+- unsigned int *waiting_msgs)
++ unsigned int *watch_mask)
+ {
+ struct ipmi_recv_msg *msg;
+
+@@ -4543,7 +4588,7 @@ static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent,
+
+ if (timeout_period < ent->timeout) {
+ ent->timeout -= timeout_period;
+- (*waiting_msgs)++;
++ *watch_mask |= IPMI_WATCH_MASK_CHECK_MESSAGES;
+ return;
+ }
+
+@@ -4562,7 +4607,7 @@ static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent,
+ struct ipmi_smi_msg *smi_msg;
+ /* More retries, send again. */
+
+- (*waiting_msgs)++;
++ *watch_mask |= IPMI_WATCH_MASK_CHECK_MESSAGES;
+
+ /*
+ * Start with the max timer, set to normal timer after
+@@ -4614,13 +4659,13 @@ static unsigned int ipmi_timeout_handler(struct ipmi_smi *intf,
+ struct ipmi_recv_msg *msg, *msg2;
+ unsigned long flags;
+ int i;
+- unsigned int waiting_msgs = 0;
++ unsigned int watch_mask = 0;
+
+ if (!intf->bmc_registered) {
+ kref_get(&intf->refcount);
+ if (!schedule_work(&intf->bmc_reg_work)) {
+ kref_put(&intf->refcount, intf_free);
+- waiting_msgs++;
++ watch_mask |= IPMI_WATCH_MASK_INTERNAL;
+ }
+ }
+
+@@ -4640,7 +4685,7 @@ static unsigned int ipmi_timeout_handler(struct ipmi_smi *intf,
+ for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
+ check_msg_timeout(intf, &intf->seq_table[i],
+ &timeouts, timeout_period, i,
+- &flags, &waiting_msgs);
++ &flags, &watch_mask);
+ spin_unlock_irqrestore(&intf->seq_lock, flags);
+
+ list_for_each_entry_safe(msg, msg2, &timeouts, link)
+@@ -4671,7 +4716,7 @@ static unsigned int ipmi_timeout_handler(struct ipmi_smi *intf,
+
+ tasklet_schedule(&intf->recv_tasklet);
+
+- return waiting_msgs;
++ return watch_mask;
+ }
+
+ static void ipmi_request_event(struct ipmi_smi *intf)
+@@ -4691,37 +4736,43 @@ static atomic_t stop_operation;
+ static void ipmi_timeout(struct timer_list *unused)
+ {
+ struct ipmi_smi *intf;
+- int nt = 0, index;
++ unsigned int watch_mask = 0;
++ int index;
++ unsigned long flags;
+
+ if (atomic_read(&stop_operation))
+ return;
+
+ index = srcu_read_lock(&ipmi_interfaces_srcu);
+ list_for_each_entry_rcu(intf, &ipmi_interfaces, link) {
+- int lnt = 0;
+-
+ if (atomic_read(&intf->event_waiters)) {
+ intf->ticks_to_req_ev--;
+ if (intf->ticks_to_req_ev == 0) {
+ ipmi_request_event(intf);
+ intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
+ }
+- lnt++;
++ watch_mask |= IPMI_WATCH_MASK_INTERNAL;
+ }
+
+- lnt += ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
++ if (atomic_read(&intf->watchdog_waiters))
++ watch_mask |= IPMI_WATCH_MASK_CHECK_WATCHDOG;
+
+- lnt = !!lnt;
+- if (lnt != intf->last_needs_timer &&
+- intf->handlers->set_need_watch)
+- intf->handlers->set_need_watch(intf->send_info, lnt);
+- intf->last_needs_timer = lnt;
++ if (atomic_read(&intf->command_waiters))
++ watch_mask |= IPMI_WATCH_MASK_CHECK_COMMANDS;
++
++ watch_mask |= ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
+
+- nt += lnt;
++ spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
++ if (watch_mask != intf->last_watch_mask &&
++ intf->handlers->set_need_watch)
++ intf->handlers->set_need_watch(intf->send_info,
++ watch_mask);
++ intf->last_watch_mask = watch_mask;
++ spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
+ }
+ srcu_read_unlock(&ipmi_interfaces_srcu, index);
+
+- if (nt)
++ if (watch_mask)
+ mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
+ }
+
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index a5e1dce042e8e..429fe063e33ff 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -1073,10 +1073,13 @@ static void request_events(void *send_info)
+ atomic_set(&smi_info->req_events, 1);
+ }
+
+-static void set_need_watch(void *send_info, bool enable)
++static void set_need_watch(void *send_info, unsigned int watch_mask)
+ {
+ struct smi_info *smi_info = send_info;
+ unsigned long flags;
++ int enable;
++
++ enable = !!(watch_mask & ~IPMI_WATCH_MASK_INTERNAL);
+
+ atomic_set(&smi_info->need_watch, enable);
+ spin_lock_irqsave(&smi_info->si_lock, flags);
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index fd1a487443f02..34c5b287c4125 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -88,8 +88,14 @@
+ #define SSIF_MSG_JIFFIES ((SSIF_MSG_USEC * 1000) / TICK_NSEC)
+ #define SSIF_MSG_PART_JIFFIES ((SSIF_MSG_PART_USEC * 1000) / TICK_NSEC)
+
++/*
++ * Timeout for the watch, only used for get flag timer.
++ */
++#define SSIF_WATCH_MSG_TIMEOUT msecs_to_jiffies(10)
++#define SSIF_WATCH_WATCHDOG_TIMEOUT msecs_to_jiffies(250)
++
+ enum ssif_intf_state {
+- SSIF_NORMAL,
++ SSIF_IDLE,
+ SSIF_GETTING_FLAGS,
+ SSIF_GETTING_EVENTS,
+ SSIF_CLEARING_FLAGS,
+@@ -97,8 +103,8 @@ enum ssif_intf_state {
+ /* FIXME - add watchdog stuff. */
+ };
+
+-#define SSIF_IDLE(ssif) ((ssif)->ssif_state == SSIF_NORMAL \
+- && (ssif)->curr_msg == NULL)
++#define IS_SSIF_IDLE(ssif) ((ssif)->ssif_state == SSIF_IDLE \
++ && (ssif)->curr_msg == NULL)
+
+ /*
+ * Indexes into stats[] in ssif_info below.
+@@ -268,6 +274,9 @@ struct ssif_info {
+ struct timer_list retry_timer;
+ int retries_left;
+
++ long watch_timeout; /* Timeout for flags check, 0 if off. */
++ struct timer_list watch_timer; /* Flag fetch timer. */
++
+ /* Info from SSIF cmd */
+ unsigned char max_xmit_msg_size;
+ unsigned char max_recv_msg_size;
+@@ -340,9 +349,9 @@ static void return_hosed_msg(struct ssif_info *ssif_info,
+
+ /*
+ * Must be called with the message lock held. This will release the
+- * message lock. Note that the caller will check SSIF_IDLE and start a
+- * new operation, so there is no need to check for new messages to
+- * start in here.
++ * message lock. Note that the caller will check IS_SSIF_IDLE and
++ * start a new operation, so there is no need to check for new
++ * messages to start in here.
+ */
+ static void start_clear_flags(struct ssif_info *ssif_info, unsigned long *flags)
+ {
+@@ -359,7 +368,7 @@ static void start_clear_flags(struct ssif_info *ssif_info, unsigned long *flags)
+
+ if (start_send(ssif_info, msg, 3) != 0) {
+ /* Error, just go to normal state. */
+- ssif_info->ssif_state = SSIF_NORMAL;
++ ssif_info->ssif_state = SSIF_IDLE;
+ }
+ }
+
+@@ -374,7 +383,7 @@ static void start_flag_fetch(struct ssif_info *ssif_info, unsigned long *flags)
+ mb[0] = (IPMI_NETFN_APP_REQUEST << 2);
+ mb[1] = IPMI_GET_MSG_FLAGS_CMD;
+ if (start_send(ssif_info, mb, 2) != 0)
+- ssif_info->ssif_state = SSIF_NORMAL;
++ ssif_info->ssif_state = SSIF_IDLE;
+ }
+
+ static void check_start_send(struct ssif_info *ssif_info, unsigned long *flags,
+@@ -385,7 +394,7 @@ static void check_start_send(struct ssif_info *ssif_info, unsigned long *flags,
+
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+ ssif_info->curr_msg = NULL;
+- ssif_info->ssif_state = SSIF_NORMAL;
++ ssif_info->ssif_state = SSIF_IDLE;
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ ipmi_free_smi_msg(msg);
+ }
+@@ -399,7 +408,7 @@ static void start_event_fetch(struct ssif_info *ssif_info, unsigned long *flags)
+
+ msg = ipmi_alloc_smi_msg();
+ if (!msg) {
+- ssif_info->ssif_state = SSIF_NORMAL;
++ ssif_info->ssif_state = SSIF_IDLE;
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ return;
+ }
+@@ -422,7 +431,7 @@ static void start_recv_msg_fetch(struct ssif_info *ssif_info,
+
+ msg = ipmi_alloc_smi_msg();
+ if (!msg) {
+- ssif_info->ssif_state = SSIF_NORMAL;
++ ssif_info->ssif_state = SSIF_IDLE;
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ return;
+ }
+@@ -440,9 +449,9 @@ static void start_recv_msg_fetch(struct ssif_info *ssif_info,
+
+ /*
+ * Must be called with the message lock held. This will release the
+- * message lock. Note that the caller will check SSIF_IDLE and start a
+- * new operation, so there is no need to check for new messages to
+- * start in here.
++ * message lock. Note that the caller will check IS_SSIF_IDLE and
++ * start a new operation, so there is no need to check for new
++ * messages to start in here.
+ */
+ static void handle_flags(struct ssif_info *ssif_info, unsigned long *flags)
+ {
+@@ -458,7 +467,7 @@ static void handle_flags(struct ssif_info *ssif_info, unsigned long *flags)
+ /* Events available. */
+ start_event_fetch(ssif_info, flags);
+ else {
+- ssif_info->ssif_state = SSIF_NORMAL;
++ ssif_info->ssif_state = SSIF_IDLE;
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ }
+ }
+@@ -558,6 +567,26 @@ static void retry_timeout(struct timer_list *t)
+ start_get(ssif_info);
+ }
+
++static void watch_timeout(struct timer_list *t)
++{
++ struct ssif_info *ssif_info = from_timer(ssif_info, t, watch_timer);
++ unsigned long oflags, *flags;
++
++ if (ssif_info->stopping)
++ return;
++
++ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
++ if (ssif_info->watch_timeout) {
++ mod_timer(&ssif_info->watch_timer,
++ jiffies + ssif_info->watch_timeout);
++ if (IS_SSIF_IDLE(ssif_info)) {
++ start_flag_fetch(ssif_info, flags); /* Releases lock */
++ return;
++ }
++ ssif_info->req_flags = true;
++ }
++ ipmi_ssif_unlock_cond(ssif_info, flags);
++}
+
+ static void ssif_alert(struct i2c_client *client, enum i2c_alert_protocol type,
+ unsigned int data)
+@@ -747,7 +776,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ }
+
+ switch (ssif_info->ssif_state) {
+- case SSIF_NORMAL:
++ case SSIF_IDLE:
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ if (!msg)
+ break;
+@@ -765,16 +794,16 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ * Error fetching flags, or invalid length,
+ * just give up for now.
+ */
+- ssif_info->ssif_state = SSIF_NORMAL;
++ ssif_info->ssif_state = SSIF_IDLE;
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ pr_warn(PFX "Error getting flags: %d %d, %x\n",
+ result, len, (len >= 3) ? data[2] : 0);
+ } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2
+ || data[1] != IPMI_GET_MSG_FLAGS_CMD) {
+ /*
+- * Don't abort here, maybe it was a queued
+- * response to a previous command.
++ * Recv error response, give up.
+ */
++ ssif_info->ssif_state = SSIF_IDLE;
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ pr_warn(PFX "Invalid response getting flags: %x %x\n",
+ data[0], data[1]);
+@@ -796,7 +825,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ pr_warn(PFX "Invalid response clearing flags: %x %x\n",
+ data[0], data[1]);
+ }
+- ssif_info->ssif_state = SSIF_NORMAL;
++ ssif_info->ssif_state = SSIF_IDLE;
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ break;
+
+@@ -872,7 +901,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ }
+
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+- if (SSIF_IDLE(ssif_info) && !ssif_info->stopping) {
++ if (IS_SSIF_IDLE(ssif_info) && !ssif_info->stopping) {
+ if (ssif_info->req_events)
+ start_event_fetch(ssif_info, flags);
+ else if (ssif_info->req_flags)
+@@ -1041,7 +1070,7 @@ static void start_next_msg(struct ssif_info *ssif_info, unsigned long *flags)
+ unsigned long oflags;
+
+ restart:
+- if (!SSIF_IDLE(ssif_info)) {
++ if (!IS_SSIF_IDLE(ssif_info)) {
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ return;
+ }
+@@ -1103,8 +1132,7 @@ static int get_smi_info(void *send_info, struct ipmi_smi_info *data)
+ }
+
+ /*
+- * Instead of having our own timer to periodically check the message
+- * flags, we let the message handler drive us.
++ * Upper layer wants us to request events.
+ */
+ static void request_events(void *send_info)
+ {
+@@ -1115,18 +1143,33 @@ static void request_events(void *send_info)
+ return;
+
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+- /*
+- * Request flags first, not events, because the lower layer
+- * doesn't have a way to send an attention. But make sure
+- * event checking still happens.
+- */
+ ssif_info->req_events = true;
+- if (SSIF_IDLE(ssif_info))
+- start_flag_fetch(ssif_info, flags);
+- else {
+- ssif_info->req_flags = true;
+- ipmi_ssif_unlock_cond(ssif_info, flags);
++ ipmi_ssif_unlock_cond(ssif_info, flags);
++}
++
++/*
++ * Upper layer is changing the flag saying whether we need to request
++ * flags periodically or not.
++ */
++static void ssif_set_need_watch(void *send_info, unsigned int watch_mask)
++{
++ struct ssif_info *ssif_info = (struct ssif_info *) send_info;
++ unsigned long oflags, *flags;
++ long timeout = 0;
++
++ if (watch_mask & IPMI_WATCH_MASK_CHECK_MESSAGES)
++ timeout = SSIF_WATCH_MSG_TIMEOUT;
++ else if (watch_mask & ~IPMI_WATCH_MASK_INTERNAL)
++ timeout = SSIF_WATCH_WATCHDOG_TIMEOUT;
++
++ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
++ if (timeout != ssif_info->watch_timeout) {
++ ssif_info->watch_timeout = timeout;
++ if (ssif_info->watch_timeout)
++ mod_timer(&ssif_info->watch_timer,
++ jiffies + ssif_info->watch_timeout);
+ }
++ ipmi_ssif_unlock_cond(ssif_info, flags);
+ }
+
+ static int ssif_start_processing(void *send_info,
+@@ -1249,10 +1292,11 @@ static void shutdown_ssif(void *send_info)
+ dev_set_drvdata(&ssif_info->client->dev, NULL);
+
+ /* make sure the driver is not looking for flags any more. */
+- while (ssif_info->ssif_state != SSIF_NORMAL)
++ while (ssif_info->ssif_state != SSIF_IDLE)
+ schedule_timeout(1);
+
+ ssif_info->stopping = true;
++ del_timer_sync(&ssif_info->watch_timer);
+ del_timer_sync(&ssif_info->retry_timer);
+ if (ssif_info->thread) {
+ complete(&ssif_info->wake_thread);
+@@ -1630,8 +1674,9 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ }
+
+ spin_lock_init(&ssif_info->lock);
+- ssif_info->ssif_state = SSIF_NORMAL;
++ ssif_info->ssif_state = SSIF_IDLE;
+ timer_setup(&ssif_info->retry_timer, retry_timeout, 0);
++ timer_setup(&ssif_info->watch_timer, watch_timeout, 0);
+
+ for (i = 0; i < SSIF_NUM_STATS; i++)
+ atomic_set(&ssif_info->stats[i], 0);
+@@ -1645,6 +1690,7 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ ssif_info->handlers.get_smi_info = get_smi_info;
+ ssif_info->handlers.sender = sender;
+ ssif_info->handlers.request_events = request_events;
++ ssif_info->handlers.set_need_watch = ssif_set_need_watch;
+
+ {
+ unsigned int thread_num;
+diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c
+index 49819b546134b..5c6760e45a16e 100644
+--- a/drivers/clk/clk-conf.c
++++ b/drivers/clk/clk-conf.c
+@@ -36,9 +36,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier)
+ else
+ return rc;
+ }
+- if (clkspec.np == node && !clk_supplier)
++ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ return 0;
++ }
+ pclk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(pclk)) {
+ if (PTR_ERR(pclk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get parent clock %d for %pOF\n",
+@@ -51,10 +54,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier)
+ if (rc < 0)
+ goto err;
+ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ rc = 0;
+ goto err;
+ }
+ clk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(clk)) {
+ if (PTR_ERR(clk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get assigned clock %d for %pOF\n",
+@@ -96,10 +101,13 @@ static int __set_clk_rates(struct device_node *node, bool clk_supplier)
+ else
+ return rc;
+ }
+- if (clkspec.np == node && !clk_supplier)
++ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ return 0;
++ }
+
+ clk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(clk)) {
+ if (PTR_ERR(clk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get clock %d for %pOF\n",
+diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c
+index 5a628148f3f02..ec9850db5bf9d 100644
+--- a/drivers/clk/rockchip/clk-rk3399.c
++++ b/drivers/clk/rockchip/clk-rk3399.c
+@@ -1267,7 +1267,7 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
+ RK3399_CLKSEL_CON(56), 6, 2, MFLAGS,
+ RK3399_CLKGATE_CON(10), 7, GFLAGS),
+
+- COMPOSITE_NOGATE(SCLK_CIF_OUT, "clk_cifout", mux_clk_cif_p, 0,
++ COMPOSITE_NOGATE(SCLK_CIF_OUT, "clk_cifout", mux_clk_cif_p, CLK_SET_RATE_PARENT,
+ RK3399_CLKSEL_CON(56), 5, 1, MFLAGS, 0, 5, DFLAGS),
+
+ /* gic */
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index a451ecae16692..33ea7abd8cc97 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -223,6 +223,7 @@ struct at_xdmac {
+ int irq;
+ struct clk *clk;
+ u32 save_gim;
++ u32 save_gs;
+ struct dma_pool *at_xdmac_desc_pool;
+ struct at_xdmac_chan chan[0];
+ };
+@@ -1878,6 +1879,7 @@ static int atmel_xdmac_suspend(struct device *dev)
+ }
+ }
+ atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM);
++ atxdmac->save_gs = at_xdmac_read(atxdmac, AT_XDMAC_GS);
+
+ at_xdmac_off(atxdmac);
+ clk_disable_unprepare(atxdmac->clk);
+@@ -1914,7 +1916,8 @@ static int atmel_xdmac_resume(struct device *dev)
+ at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc);
+ at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim);
+ wmb();
+- at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
++ if (atxdmac->save_gs & atchan->mask)
++ at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
+ }
+ }
+ return 0;
+diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
+index dd209e0dd9abb..38a82a3f45167 100644
+--- a/drivers/edac/skx_edac.c
++++ b/drivers/edac/skx_edac.c
+@@ -825,13 +825,13 @@ rir_found:
+ }
+
+ static u8 skx_close_row[] = {
+- 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33
++ 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33, 34
+ };
+ static u8 skx_close_column[] = {
+ 3, 4, 5, 14, 19, 23, 24, 25, 26, 27
+ };
+ static u8 skx_open_row[] = {
+- 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33
++ 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33, 34
+ };
+ static u8 skx_open_column[] = {
+ 3, 4, 5, 6, 7, 8, 9, 10, 11, 12
+@@ -896,12 +896,11 @@ static bool skx_decode(struct decoded_addr *res)
+
+ #ifdef CONFIG_EDAC_DEBUG
+ /*
+- * Debug feature. Make /sys/kernel/debug/skx_edac_test/addr.
+- * Write an address to this file to exercise the address decode
+- * logic in this driver.
++ * Debug feature.
++ * Exercise the address decode logic by writing an address to
++ * /sys/kernel/debug/edac/skx_test/addr.
+ */
+ static struct dentry *skx_test;
+-static u64 skx_fake_addr;
+
+ static int debugfs_u64_set(void *data, u64 val)
+ {
+@@ -912,19 +911,19 @@ static int debugfs_u64_set(void *data, u64 val)
+
+ return 0;
+ }
+-
+ DEFINE_SIMPLE_ATTRIBUTE(fops_u64_wo, NULL, debugfs_u64_set, "%llu\n");
+
+-static struct dentry *mydebugfs_create(const char *name, umode_t mode,
+- struct dentry *parent, u64 *value)
+-{
+- return debugfs_create_file(name, mode, parent, value, &fops_u64_wo);
+-}
+-
+ static void setup_skx_debug(void)
+ {
+- skx_test = debugfs_create_dir("skx_edac_test", NULL);
+- mydebugfs_create("addr", S_IWUSR, skx_test, &skx_fake_addr);
++ skx_test = edac_debugfs_create_dir("skx_test");
++ if (!skx_test)
++ return;
++
++ if (!edac_debugfs_create_file("addr", 0200, skx_test,
++ NULL, &fops_u64_wo)) {
++ debugfs_remove(skx_test);
++ skx_test = NULL;
++ }
+ }
+
+ static void teardown_skx_debug(void)
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index 513908a0c2622..e795bd9c8038e 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -586,8 +586,7 @@ static int qcom_scm_probe(struct platform_device *pdev)
+ static void qcom_scm_shutdown(struct platform_device *pdev)
+ {
+ /* Clean shutdown, disable download mode to allow normal restart */
+- if (download_mode)
+- qcom_scm_set_download_mode(false);
++ qcom_scm_set_download_mode(false);
+ }
+
+ static const struct of_device_id qcom_scm_dt_match[] = {
+diff --git a/drivers/fpga/fpga-bridge.c b/drivers/fpga/fpga-bridge.c
+index c983dac97501b..c7db12192facd 100644
+--- a/drivers/fpga/fpga-bridge.c
++++ b/drivers/fpga/fpga-bridge.c
+@@ -121,7 +121,7 @@ static int fpga_bridge_dev_match(struct device *dev, const void *data)
+ /**
+ * fpga_bridge_get - get an exclusive reference to a fpga bridge
+ * @dev: parent device that fpga bridge was registered with
+- * @info: fpga manager info
++ * @info: fpga image specific information
+ *
+ * Given a device, get an exclusive reference to a fpga bridge.
+ *
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index acbd33fcb73d3..45e6dfa330adc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -950,6 +950,12 @@ struct amdgpu_gfx {
+ /* NGG */
+ struct amdgpu_ngg ngg;
+
++ /* gfx off */
++ bool gfx_off_state; /* true: enabled, false: disabled */
++ struct mutex gfx_off_mutex;
++ uint32_t gfx_off_req_count; /* default 1, enable gfx off: dec 1, disable gfx off: add 1 */
++ struct delayed_work gfx_off_delay_work;
++
+ /* pipe reservation */
+ struct mutex pipe_reserve_mutex;
+ DECLARE_BITMAP (pipe_reserve_bitmap, AMDGPU_MAX_COMPUTE_QUEUES);
+@@ -1776,6 +1782,7 @@ void amdgpu_device_program_register_sequence(struct amdgpu_device *adev,
+ const u32 array_size);
+
+ bool amdgpu_device_is_px(struct drm_device *dev);
++void amdgpu_gfx_off_ctrl(struct amdgpu_device *adev, bool enable);
+ /* atpx handler */
+ #if defined(CONFIG_VGA_SWITCHEROO)
+ void amdgpu_register_atpx_handler(void);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 102b05b8f0c2b..787cbeea8dc55 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -1927,6 +1927,19 @@ static void amdgpu_device_ip_late_init_func_handler(struct work_struct *work)
+ DRM_ERROR("ib ring test failed (%d).\n", r);
+ }
+
++static void amdgpu_device_delay_enable_gfx_off(struct work_struct *work)
++{
++ struct amdgpu_device *adev =
++ container_of(work, struct amdgpu_device, gfx.gfx_off_delay_work.work);
++
++ mutex_lock(&adev->gfx.gfx_off_mutex);
++ if (!adev->gfx.gfx_off_state && !adev->gfx.gfx_off_req_count) {
++ if (!amdgpu_dpm_set_powergating_by_smu(adev, AMD_IP_BLOCK_TYPE_GFX, true))
++ adev->gfx.gfx_off_state = true;
++ }
++ mutex_unlock(&adev->gfx.gfx_off_mutex);
++}
++
+ /**
+ * amdgpu_device_ip_suspend_phase1 - run suspend for hardware IPs (phase 1)
+ *
+@@ -2369,6 +2382,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+ mutex_init(&adev->gfx.gpu_clock_mutex);
+ mutex_init(&adev->srbm_mutex);
+ mutex_init(&adev->gfx.pipe_reserve_mutex);
++ mutex_init(&adev->gfx.gfx_off_mutex);
+ mutex_init(&adev->grbm_idx_mutex);
+ mutex_init(&adev->mn_lock);
+ mutex_init(&adev->virt.vf_errors.lock);
+@@ -2395,7 +2409,10 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+
+ INIT_DELAYED_WORK(&adev->late_init_work,
+ amdgpu_device_ip_late_init_func_handler);
++ INIT_DELAYED_WORK(&adev->gfx.gfx_off_delay_work,
++ amdgpu_device_delay_enable_gfx_off);
+
++ adev->gfx.gfx_off_req_count = 1;
+ adev->pm.ac_power = power_supply_is_system_supplied() > 0 ? true : false;
+
+ /* Registers mapping */
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+index eeaa2e825858b..af42c2464a598 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+@@ -26,6 +26,9 @@
+ #include "amdgpu.h"
+ #include "amdgpu_gfx.h"
+
++/* 0.5 second timeout */
++#define GFX_OFF_DELAY_ENABLE msecs_to_jiffies(500)
++
+ /*
+ * GPU scratch registers helpers function.
+ */
+@@ -340,3 +343,40 @@ void amdgpu_gfx_compute_mqd_sw_fini(struct amdgpu_device *adev)
+ &ring->mqd_gpu_addr,
+ &ring->mqd_ptr);
+ }
++
++/* amdgpu_gfx_off_ctrl - Handle gfx off feature enable/disable
++ *
++ * @adev: amdgpu_device pointer
++ * @bool enable true: enable gfx off feature, false: disable gfx off feature
++ *
++ * 1. gfx off feature will be enabled by gfx ip after gfx cg gp enabled.
++ * 2. other client can send request to disable gfx off feature, the request should be honored.
++ * 3. other client can cancel their request of disable gfx off feature
++ * 4. other client should not send request to enable gfx off feature before disable gfx off feature.
++ */
++
++void amdgpu_gfx_off_ctrl(struct amdgpu_device *adev, bool enable)
++{
++ if (!(adev->powerplay.pp_feature & PP_GFXOFF_MASK))
++ return;
++
++ if (!adev->powerplay.pp_funcs->set_powergating_by_smu)
++ return;
++
++
++ mutex_lock(&adev->gfx.gfx_off_mutex);
++
++ if (!enable)
++ adev->gfx.gfx_off_req_count++;
++ else if (adev->gfx.gfx_off_req_count > 0)
++ adev->gfx.gfx_off_req_count--;
++
++ if (enable && !adev->gfx.gfx_off_state && !adev->gfx.gfx_off_req_count) {
++ schedule_delayed_work(&adev->gfx.gfx_off_delay_work, GFX_OFF_DELAY_ENABLE);
++ } else if (!enable && adev->gfx.gfx_off_state) {
++ if (!amdgpu_dpm_set_powergating_by_smu(adev, AMD_IP_BLOCK_TYPE_GFX, false))
++ adev->gfx.gfx_off_state = false;
++ }
++
++ mutex_unlock(&adev->gfx.gfx_off_mutex);
++}
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+index 0b70410488b66..018f06f154b88 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+@@ -55,6 +55,7 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev,
+ {
+ struct file *filp = fget(fd);
+ struct amdgpu_fpriv *fpriv;
++ struct amdgpu_ctx_mgr *mgr;
+ struct amdgpu_ctx *ctx;
+ uint32_t id;
+ int r;
+@@ -68,14 +69,50 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev,
+ return r;
+ }
+
+- idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id)
++ mgr = &fpriv->ctx_mgr;
++ mutex_lock(&mgr->lock);
++ idr_for_each_entry(&mgr->ctx_handles, ctx, id)
+ amdgpu_ctx_priority_override(ctx, priority);
++ mutex_unlock(&mgr->lock);
+
+ fput(filp);
+
+ return 0;
+ }
+
++static int amdgpu_sched_context_priority_override(struct amdgpu_device *adev,
++ int fd,
++ unsigned ctx_id,
++ enum drm_sched_priority priority)
++{
++ struct file *filp = fget(fd);
++ struct amdgpu_fpriv *fpriv;
++ struct amdgpu_ctx *ctx;
++ int r;
++
++ if (!filp)
++ return -EINVAL;
++
++ r = amdgpu_file_to_fpriv(filp, &fpriv);
++ if (r) {
++ fput(filp);
++ return r;
++ }
++
++ ctx = amdgpu_ctx_get(fpriv, ctx_id);
++
++ if (!ctx) {
++ fput(filp);
++ return -EINVAL;
++ }
++
++ amdgpu_ctx_priority_override(ctx, priority);
++ amdgpu_ctx_put(ctx);
++ fput(filp);
++
++ return 0;
++}
++
+ int amdgpu_sched_ioctl(struct drm_device *dev, void *data,
+ struct drm_file *filp)
+ {
+@@ -85,7 +122,7 @@ int amdgpu_sched_ioctl(struct drm_device *dev, void *data,
+ int r;
+
+ priority = amdgpu_to_sched_priority(args->in.priority);
+- if (args->in.flags || priority == DRM_SCHED_PRIORITY_INVALID)
++ if (priority == DRM_SCHED_PRIORITY_INVALID)
+ return -EINVAL;
+
+ switch (args->in.op) {
+@@ -94,6 +131,12 @@ int amdgpu_sched_ioctl(struct drm_device *dev, void *data,
+ args->in.fd,
+ priority);
+ break;
++ case AMDGPU_SCHED_OP_CONTEXT_PRIORITY_OVERRIDE:
++ r = amdgpu_sched_context_priority_override(adev,
++ args->in.fd,
++ args->in.ctx_id,
++ priority);
++ break;
+ default:
+ DRM_ERROR("Invalid sched op specified: %d\n", args->in.op);
+ r = -EINVAL;
+diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
+index c0b26135dbd5b..f9e0594ee7024 100644
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -459,8 +459,9 @@ retry:
+ */
+ dev->mode_config.delayed_event = true;
+ if (dev->mode_config.poll_enabled)
+- schedule_delayed_work(&dev->mode_config.output_poll_work,
+- 0);
++ mod_delayed_work(system_wq,
++ &dev->mode_config.output_poll_work,
++ 0);
+ }
+
+ /* Re-enable polling in case the global poll config changed. */
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c
+index 7d3e9a129ac74..7acb53a907e5c 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
+@@ -190,8 +190,11 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev)
+ if (ret)
+ return NULL;
+
+- /* Make sure pm runtime is active and reset any previous errors */
+- pm_runtime_set_active(&pdev->dev);
++ /*
++ * Now that we have firmware loaded, and are ready to begin
++ * booting the gpu, go ahead and enable runpm:
++ */
++ pm_runtime_enable(&pdev->dev);
+
+ ret = pm_runtime_get_sync(&pdev->dev);
+ if (ret < 0) {
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index c9f831604558f..6da144c394097 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -725,7 +725,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
+ pm_runtime_set_autosuspend_delay(&pdev->dev,
+ adreno_gpu->info->inactive_period);
+ pm_runtime_use_autosuspend(&pdev->dev);
+- pm_runtime_enable(&pdev->dev);
+
+ return msm_gpu_init(drm, pdev, &adreno_gpu->base, &funcs->base,
+ adreno_gpu->info->name, &adreno_gpu_config);
+diff --git a/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c b/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
+index 58ccf648b70fb..e88a7d95a00ce 100644
+--- a/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
++++ b/drivers/gpu/drm/panel/panel-orisetech-otm8009a.c
+@@ -454,7 +454,7 @@ static int otm8009a_probe(struct mipi_dsi_device *dsi)
+ ctx->panel.funcs = &otm8009a_drm_funcs;
+
+ ctx->bl_dev = devm_backlight_device_register(dev, dev_name(dev),
+- dsi->host->dev, ctx,
++ dev, ctx,
+ &otm8009a_backlight_ops,
+ NULL);
+ if (IS_ERR(ctx->bl_dev)) {
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+index a8db758d523e9..94242fa9e25d1 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+@@ -270,9 +270,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
+ else
+ ret = rockchip_drm_gem_object_mmap_dma(obj, vma);
+
+- if (ret)
+- drm_gem_vm_close(vma);
+-
+ return ret;
+ }
+
+diff --git a/drivers/gpu/drm/vgem/vgem_fence.c b/drivers/gpu/drm/vgem/vgem_fence.c
+index b28876c222b46..04527d8f36236 100644
+--- a/drivers/gpu/drm/vgem/vgem_fence.c
++++ b/drivers/gpu/drm/vgem/vgem_fence.c
+@@ -280,4 +280,5 @@ void vgem_fence_close(struct vgem_file *vfile)
+ {
+ idr_for_each(&vfile->fence_idr, __vgem_fence_idr_fini, vfile);
+ idr_destroy(&vfile->fence_idr);
++ mutex_destroy(&vfile->fence_mutex);
+ }
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index bc4d6474d8f54..da6053deb954a 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -1791,6 +1791,7 @@ static void wacom_map_usage(struct input_dev *input, struct hid_usage *usage,
+ int fmax = field->logical_maximum;
+ unsigned int equivalent_usage = wacom_equivalent_usage(usage->hid);
+ int resolution_code = code;
++ int resolution = hidinput_calc_abs_res(field, resolution_code);
+
+ if (equivalent_usage == HID_DG_TWIST) {
+ resolution_code = ABS_RZ;
+@@ -1813,8 +1814,15 @@ static void wacom_map_usage(struct input_dev *input, struct hid_usage *usage,
+ switch (type) {
+ case EV_ABS:
+ input_set_abs_params(input, code, fmin, fmax, fuzz, 0);
+- input_abs_set_res(input, code,
+- hidinput_calc_abs_res(field, resolution_code));
++
++ /* older tablet may miss physical usage */
++ if ((code == ABS_X || code == ABS_Y) && !resolution) {
++ resolution = WACOM_INTUOS_RES;
++ hid_warn(input,
++ "Wacom usage (%d) missing resolution \n",
++ code);
++ }
++ input_abs_set_res(input, code, resolution);
+ break;
+ case EV_KEY:
+ input_set_capability(input, EV_KEY, code);
+diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
+index cd9c65f3d404f..11321ad482a3a 100644
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -1027,7 +1027,7 @@ omap_i2c_isr(int irq, void *dev_id)
+ u16 stat;
+
+ stat = omap_i2c_read_reg(omap, OMAP_I2C_STAT_REG);
+- mask = omap_i2c_read_reg(omap, OMAP_I2C_IE_REG);
++ mask = omap_i2c_read_reg(omap, OMAP_I2C_IE_REG) & ~OMAP_I2C_STAT_NACK;
+
+ if (stat & mask)
+ ret = IRQ_WAKE_THREAD;
+diff --git a/drivers/iio/adc/palmas_gpadc.c b/drivers/iio/adc/palmas_gpadc.c
+index 7dcd4213d38a0..6b76622b4fbfa 100644
+--- a/drivers/iio/adc/palmas_gpadc.c
++++ b/drivers/iio/adc/palmas_gpadc.c
+@@ -633,7 +633,7 @@ out:
+
+ static int palmas_gpadc_remove(struct platform_device *pdev)
+ {
+- struct iio_dev *indio_dev = dev_to_iio_dev(&pdev->dev);
++ struct iio_dev *indio_dev = dev_get_drvdata(&pdev->dev);
+ struct palmas_gpadc *adc = iio_priv(indio_dev);
+
+ if (adc->wakeup1_enable || adc->wakeup2_enable)
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
+index e1c7996c018ef..513a297b4ff0e 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
+@@ -175,7 +175,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ goto unlock;
+ }
+ __mmu_int_rb_insert(mnode, &handler->root);
+- list_add(&mnode->list, &handler->lru_list);
++ list_add_tail(&mnode->list, &handler->lru_list);
+
+ ret = handler->ops->insert(handler->ops_arg, mnode);
+ if (ret) {
+@@ -222,8 +222,10 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler,
+ spin_lock_irqsave(&handler->lock, flags);
+ node = __mmu_rb_search(handler, addr, len);
+ if (node) {
+- if (node->addr == addr && node->len == len)
++ if (node->addr == addr && node->len == len) {
++ list_move_tail(&node->list, &handler->lru_list);
+ goto unlock;
++ }
+ __mmu_int_rb_remove(node, &handler->root);
+ list_del(&node->list); /* remove from LRU list */
+ ret = true;
+@@ -244,8 +246,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ INIT_LIST_HEAD(&del_list);
+
+ spin_lock_irqsave(&handler->lock, flags);
+- list_for_each_entry_safe_reverse(rbnode, ptr, &handler->lru_list,
+- list) {
++ list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) {
+ if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg,
+ &stop)) {
+ __mmu_int_rb_remove(rbnode, &handler->root);
+@@ -257,9 +258,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ }
+ spin_unlock_irqrestore(&handler->lock, flags);
+
+- while (!list_empty(&del_list)) {
+- rbnode = list_first_entry(&del_list, struct mmu_rb_node, list);
+- list_del(&rbnode->list);
++ list_for_each_entry_safe(rbnode, ptr, &del_list, list) {
+ handler->ops->remove(handler->ops_arg, rbnode);
+ }
+ }
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index 7209b8a9b0dd2..87358b8c45589 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -436,9 +436,13 @@ static int set_user_sq_size(struct mlx4_ib_dev *dev,
+ struct mlx4_ib_qp *qp,
+ struct mlx4_ib_create_qp *ucmd)
+ {
++ u32 cnt;
++
+ /* Sanity check SQ size before proceeding */
+- if ((1 << ucmd->log_sq_bb_count) > dev->dev->caps.max_wqes ||
+- ucmd->log_sq_stride >
++ if (check_shl_overflow(1, ucmd->log_sq_bb_count, &cnt) ||
++ cnt > dev->dev->caps.max_wqes)
++ return -EINVAL;
++ if (ucmd->log_sq_stride >
+ ilog2(roundup_pow_of_two(dev->dev->caps.max_sq_desc_sz)) ||
+ ucmd->log_sq_stride < MLX4_IB_MIN_SQ_STRIDE)
+ return -EINVAL;
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 1520a3098f7dc..0455abfba41c2 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3350,7 +3350,7 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ return -EINVAL;
+
+ if (attr->port_num == 0 ||
+- attr->port_num > MLX5_CAP_GEN(dev->mdev, num_ports)) {
++ attr->port_num > dev->num_ports) {
+ mlx5_ib_dbg(dev, "invalid port number %d. number of ports is %d\n",
+ attr->port_num, dev->num_ports);
+ return -EINVAL;
+diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
+index fbc316775669c..c12fc2eace161 100644
+--- a/drivers/infiniband/sw/rdmavt/qp.c
++++ b/drivers/infiniband/sw/rdmavt/qp.c
+@@ -321,8 +321,6 @@ void rvt_qp_exit(struct rvt_dev_info *rdi)
+ if (qps_inuse)
+ rvt_pr_err(rdi, "QP memory leak! %u still in use\n",
+ qps_inuse);
+- if (!rdi->qp_dev)
+- return;
+
+ kfree(rdi->qp_dev->qp_table);
+ free_qpn_table(&rdi->qp_dev->qpn_table);
+diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
+index a316624742f68..c3d421c7b0cf1 100644
+--- a/drivers/macintosh/Kconfig
++++ b/drivers/macintosh/Kconfig
+@@ -83,6 +83,7 @@ config ADB_PMU_LED
+
+ config ADB_PMU_LED_DISK
+ bool "Use front LED as DISK LED by default"
++ depends on ATA
+ depends on ADB_PMU_LED
+ depends on LEDS_CLASS
+ select LEDS_TRIGGERS
+diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
+index 51ef77de41744..3d4b8c33640a8 100644
+--- a/drivers/macintosh/windfarm_smu_sat.c
++++ b/drivers/macintosh/windfarm_smu_sat.c
+@@ -172,6 +172,7 @@ static void wf_sat_release(struct kref *ref)
+
+ if (sat->nr >= 0)
+ sats[sat->nr] = NULL;
++ of_node_put(sat->node);
+ kfree(sat);
+ }
+
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index 1f1614af5e979..5116856ea81dd 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -124,9 +124,9 @@ static int parse_features(struct dm_arg_set *as, struct flakey_c *fc,
+ * Direction r or w?
+ */
+ arg_name = dm_shift_arg(as);
+- if (!strcasecmp(arg_name, "w"))
++ if (arg_name && !strcasecmp(arg_name, "w"))
+ fc->corrupt_bio_rw = WRITE;
+- else if (!strcasecmp(arg_name, "r"))
++ else if (arg_name && !strcasecmp(arg_name, "r"))
+ fc->corrupt_bio_rw = READ;
+ else {
+ ti->error = "Invalid corrupt bio direction (r or w)";
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index b054271066ace..0a4e440948f0d 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -3689,11 +3689,13 @@ int __init dm_integrity_init(void)
+ }
+
+ r = dm_register_target(&integrity_target);
+-
+- if (r < 0)
++ if (r < 0) {
+ DMERR("register failed %d", r);
++ kmem_cache_destroy(journal_io_cache);
++ return r;
++ }
+
+- return r;
++ return 0;
+ }
+
+ void dm_integrity_exit(void)
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index 0c8ddf37ef39d..e1603c17e346f 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1410,11 +1410,12 @@ static int table_clear(struct file *filp, struct dm_ioctl *param, size_t param_s
+ hc->new_map = NULL;
+ }
+
+- param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
+-
+- __dev_status(hc->md, param);
+ md = hc->md;
+ up_write(&_hash_lock);
++
++ param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
++ __dev_status(md, param);
++
+ if (old_map) {
+ dm_sync_table(md);
+ dm_table_destroy(old_map);
+diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
+index 36945030520a9..d116495a3445e 100644
+--- a/drivers/md/dm-verity-target.c
++++ b/drivers/md/dm-verity-target.c
+@@ -471,13 +471,14 @@ static int verity_verify_io(struct dm_verity_io *io)
+ struct bvec_iter start;
+ unsigned b;
+ struct crypto_wait wait;
++ struct bio *bio = dm_bio_from_per_bio_data(io, v->ti->per_io_data_size);
+
+ for (b = 0; b < io->n_blocks; b++) {
+ int r;
+ sector_t cur_block = io->block + b;
+ struct ahash_request *req = verity_io_hash_req(v, io);
+
+- if (v->validated_blocks &&
++ if (v->validated_blocks && bio->bi_status == BLK_STS_OK &&
+ likely(test_bit(cur_block, v->validated_blocks))) {
+ verity_bv_skip_block(v, io, &io->iter);
+ continue;
+@@ -525,9 +526,17 @@ static int verity_verify_io(struct dm_verity_io *io)
+ else if (verity_fec_decode(v, io, DM_VERITY_BLOCK_TYPE_DATA,
+ cur_block, NULL, &start) == 0)
+ continue;
+- else if (verity_handle_err(v, DM_VERITY_BLOCK_TYPE_DATA,
+- cur_block))
+- return -EIO;
++ else {
++ if (bio->bi_status) {
++ /*
++ * Error correction failed; Just return error
++ */
++ return -EIO;
++ }
++ if (verity_handle_err(v, DM_VERITY_BLOCK_TYPE_DATA,
++ cur_block))
++ return -EIO;
++ }
+ }
+
+ return 0;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 9f9cd2fadc1e7..f6d2be1d23864 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2266,11 +2266,22 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ {
+ struct r10conf *conf = mddev->private;
+ int d;
+- struct bio *wbio, *wbio2;
++ struct bio *wbio = r10_bio->devs[1].bio;
++ struct bio *wbio2 = r10_bio->devs[1].repl_bio;
++
++ /* Need to test wbio2->bi_end_io before we call
++ * generic_make_request as if the former is NULL,
++ * the latter is free to free wbio2.
++ */
++ if (wbio2 && !wbio2->bi_end_io)
++ wbio2 = NULL;
+
+ if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) {
+ fix_recovery_read_error(r10_bio);
+- end_sync_request(r10_bio);
++ if (wbio->bi_end_io)
++ end_sync_request(r10_bio);
++ if (wbio2)
++ end_sync_request(r10_bio);
+ return;
+ }
+
+@@ -2279,14 +2290,6 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ * and submit the write request
+ */
+ d = r10_bio->devs[1].devnum;
+- wbio = r10_bio->devs[1].bio;
+- wbio2 = r10_bio->devs[1].repl_bio;
+- /* Need to test wbio2->bi_end_io before we call
+- * generic_make_request as if the former is NULL,
+- * the latter is free to free wbio2.
+- */
+- if (wbio2 && !wbio2->bi_end_io)
+- wbio2 = NULL;
+ if (wbio->bi_end_io) {
+ atomic_inc(&conf->mirrors[d].rdev->nr_pending);
+ md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio));
+@@ -2954,10 +2957,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
+ sector_t chunk_mask = conf->geo.chunk_mask;
+ int page_idx = 0;
+
+- if (!mempool_initialized(&conf->r10buf_pool))
+- if (init_resync(conf))
+- return 0;
+-
+ /*
+ * Allow skipping a full rebuild for incremental assembly
+ * of a clean array, like RAID1 does.
+@@ -2973,6 +2972,10 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
+ return mddev->dev_sectors - sector_nr;
+ }
+
++ if (!mempool_initialized(&conf->r10buf_pool))
++ if (init_resync(conf))
++ return 0;
++
+ skipped:
+ max_sector = mddev->dev_sectors;
+ if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery) ||
+@@ -3668,6 +3671,20 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new)
+ return nc*fc;
+ }
+
++static void raid10_free_conf(struct r10conf *conf)
++{
++ if (!conf)
++ return;
++
++ mempool_exit(&conf->r10bio_pool);
++ kfree(conf->mirrors);
++ kfree(conf->mirrors_old);
++ kfree(conf->mirrors_new);
++ safe_put_page(conf->tmppage);
++ bioset_exit(&conf->bio_split);
++ kfree(conf);
++}
++
+ static struct r10conf *setup_conf(struct mddev *mddev)
+ {
+ struct r10conf *conf = NULL;
+@@ -3750,20 +3767,24 @@ static struct r10conf *setup_conf(struct mddev *mddev)
+ return conf;
+
+ out:
+- if (conf) {
+- mempool_exit(&conf->r10bio_pool);
+- kfree(conf->mirrors);
+- safe_put_page(conf->tmppage);
+- bioset_exit(&conf->bio_split);
+- kfree(conf);
+- }
++ raid10_free_conf(conf);
+ return ERR_PTR(err);
+ }
+
++static void raid10_set_io_opt(struct r10conf *conf)
++{
++ int raid_disks = conf->geo.raid_disks;
++
++ if (!(conf->geo.raid_disks % conf->geo.near_copies))
++ raid_disks /= conf->geo.near_copies;
++ blk_queue_io_opt(conf->mddev->queue, (conf->mddev->chunk_sectors << 9) *
++ raid_disks);
++}
++
+ static int raid10_run(struct mddev *mddev)
+ {
+ struct r10conf *conf;
+- int i, disk_idx, chunk_size;
++ int i, disk_idx;
+ struct raid10_info *disk;
+ struct md_rdev *rdev;
+ sector_t size;
+@@ -3784,6 +3805,9 @@ static int raid10_run(struct mddev *mddev)
+ if (!conf)
+ goto out;
+
++ mddev->thread = conf->thread;
++ conf->thread = NULL;
++
+ if (mddev_is_clustered(conf->mddev)) {
+ int fc, fo;
+
+@@ -3796,21 +3820,13 @@ static int raid10_run(struct mddev *mddev)
+ }
+ }
+
+- mddev->thread = conf->thread;
+- conf->thread = NULL;
+-
+- chunk_size = mddev->chunk_sectors << 9;
+ if (mddev->queue) {
+ blk_queue_max_discard_sectors(mddev->queue,
+ mddev->chunk_sectors);
+ blk_queue_max_write_same_sectors(mddev->queue, 0);
+ blk_queue_max_write_zeroes_sectors(mddev->queue, 0);
+- blk_queue_io_min(mddev->queue, chunk_size);
+- if (conf->geo.raid_disks % conf->geo.near_copies)
+- blk_queue_io_opt(mddev->queue, chunk_size * conf->geo.raid_disks);
+- else
+- blk_queue_io_opt(mddev->queue, chunk_size *
+- (conf->geo.raid_disks / conf->geo.near_copies));
++ blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
++ raid10_set_io_opt(conf);
+ }
+
+ rdev_for_each(rdev, mddev) {
+@@ -3970,10 +3986,7 @@ static int raid10_run(struct mddev *mddev)
+
+ out_free_conf:
+ md_unregister_thread(&mddev->thread);
+- mempool_exit(&conf->r10bio_pool);
+- safe_put_page(conf->tmppage);
+- kfree(conf->mirrors);
+- kfree(conf);
++ raid10_free_conf(conf);
+ mddev->private = NULL;
+ out:
+ return -EIO;
+@@ -3981,15 +3994,7 @@ out:
+
+ static void raid10_free(struct mddev *mddev, void *priv)
+ {
+- struct r10conf *conf = priv;
+-
+- mempool_exit(&conf->r10bio_pool);
+- safe_put_page(conf->tmppage);
+- kfree(conf->mirrors);
+- kfree(conf->mirrors_old);
+- kfree(conf->mirrors_new);
+- bioset_exit(&conf->bio_split);
+- kfree(conf);
++ raid10_free_conf(priv);
+ }
+
+ static void raid10_quiesce(struct mddev *mddev, int quiesce)
+@@ -4724,6 +4729,7 @@ static void end_reshape(struct r10conf *conf)
+ stripe /= conf->geo.near_copies;
+ if (conf->mddev->queue->backing_dev_info->ra_pages < 2 * stripe)
+ conf->mddev->queue->backing_dev_info->ra_pages = 2 * stripe;
++ raid10_set_io_opt(conf);
+ }
+ conf->fullsync = 0;
+ }
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 7fe0619c487ae..7eeae0301ccc6 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -7153,6 +7153,12 @@ static int only_parity(int raid_disk, int algo, int raid_disks, int max_degraded
+ return 0;
+ }
+
++static void raid5_set_io_opt(struct r5conf *conf)
++{
++ blk_queue_io_opt(conf->mddev->queue, (conf->chunk_sectors << 9) *
++ (conf->raid_disks - conf->max_degraded));
++}
++
+ static int raid5_run(struct mddev *mddev)
+ {
+ struct r5conf *conf;
+@@ -7442,8 +7448,7 @@ static int raid5_run(struct mddev *mddev)
+
+ chunk_size = mddev->chunk_sectors << 9;
+ blk_queue_io_min(mddev->queue, chunk_size);
+- blk_queue_io_opt(mddev->queue, chunk_size *
+- (conf->raid_disks - conf->max_degraded));
++ raid5_set_io_opt(conf);
+ mddev->queue->limits.raid_partial_stripes_expensive = 1;
+ /*
+ * We can only discard a whole stripe. It doesn't make sense to
+@@ -8037,6 +8042,7 @@ static void end_reshape(struct r5conf *conf)
+ / PAGE_SIZE);
+ if (conf->mddev->queue->backing_dev_info->ra_pages < 2 * stripe)
+ conf->mddev->queue->backing_dev_info->ra_pages = 2 * stripe;
++ raid5_set_io_opt(conf);
+ }
+ }
+ }
+diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c
+index 1ddb0576fb7b1..dc3fc69e44806 100644
+--- a/drivers/media/pci/dm1105/dm1105.c
++++ b/drivers/media/pci/dm1105/dm1105.c
+@@ -1188,6 +1188,7 @@ static void dm1105_remove(struct pci_dev *pdev)
+ struct dvb_demux *dvbdemux = &dev->demux;
+ struct dmx_demux *dmx = &dvbdemux->dmx;
+
++ cancel_work_sync(&dev->ir.work);
+ dm1105_ir_exit(dev);
+ dmx->close(dmx);
+ dvb_net_release(&dev->dvbnet);
+diff --git a/drivers/media/pci/saa7134/saa7134-ts.c b/drivers/media/pci/saa7134/saa7134-ts.c
+index 2be703617e294..e7adcd4f99623 100644
+--- a/drivers/media/pci/saa7134/saa7134-ts.c
++++ b/drivers/media/pci/saa7134/saa7134-ts.c
+@@ -309,6 +309,7 @@ int saa7134_ts_start(struct saa7134_dev *dev)
+
+ int saa7134_ts_fini(struct saa7134_dev *dev)
+ {
++ del_timer_sync(&dev->ts_q.timeout);
+ saa7134_pgtable_free(dev->pci, &dev->ts_q.pt);
+ return 0;
+ }
+diff --git a/drivers/media/pci/saa7134/saa7134-vbi.c b/drivers/media/pci/saa7134/saa7134-vbi.c
+index 57bea543c39ba..559db500b19ce 100644
+--- a/drivers/media/pci/saa7134/saa7134-vbi.c
++++ b/drivers/media/pci/saa7134/saa7134-vbi.c
+@@ -194,6 +194,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev)
+ int saa7134_vbi_fini(struct saa7134_dev *dev)
+ {
+ /* nothing */
++ del_timer_sync(&dev->vbi_q.timeout);
+ return 0;
+ }
+
+diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
+index 079219288af7b..90255ecb08ca4 100644
+--- a/drivers/media/pci/saa7134/saa7134-video.c
++++ b/drivers/media/pci/saa7134/saa7134-video.c
+@@ -2213,6 +2213,7 @@ int saa7134_video_init1(struct saa7134_dev *dev)
+
+ void saa7134_video_fini(struct saa7134_dev *dev)
+ {
++ del_timer_sync(&dev->video_q.timeout);
+ /* free stuff */
+ vb2_queue_release(&dev->video_vbq);
+ saa7134_pgtable_free(dev->pci, &dev->video_q.pt);
+diff --git a/drivers/media/pci/ttpci/av7110_av.c b/drivers/media/pci/ttpci/av7110_av.c
+index ef1bc17cdc4d3..03d1d1fba8bc8 100644
+--- a/drivers/media/pci/ttpci/av7110_av.c
++++ b/drivers/media/pci/ttpci/av7110_av.c
+@@ -836,10 +836,10 @@ static int write_ts_to_decoder(struct av7110 *av7110, int type, const u8 *buf, s
+ av7110_ipack_flush(ipack);
+
+ if (buf[3] & ADAPT_FIELD) {
++ if (buf[4] > len - 1 - 4)
++ return 0;
+ len -= buf[4] + 1;
+ buf += buf[4] + 1;
+- if (!len)
+- return 0;
+ }
+
+ av7110_ipack_instant_repack(buf + 4, len - 4, ipack);
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 2bd5898a62044..605d8188ac8c1 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2287,11 +2287,10 @@ static int fdp1_probe(struct platform_device *pdev)
+ return PTR_ERR(fdp1->regs);
+
+ /* Interrupt service routine registration */
+- fdp1->irq = ret = platform_get_irq(pdev, 0);
+- if (ret < 0) {
+- dev_err(&pdev->dev, "cannot find IRQ\n");
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
+ return ret;
+- }
++ fdp1->irq = ret;
+
+ ret = devm_request_irq(&pdev->dev, fdp1->irq, fdp1_irq_handler, 0,
+ dev_name(&pdev->dev), fdp1);
+@@ -2314,8 +2313,10 @@ static int fdp1_probe(struct platform_device *pdev)
+
+ /* Determine our clock rate */
+ clk = clk_get(&pdev->dev, NULL);
+- if (IS_ERR(clk))
+- return PTR_ERR(clk);
++ if (IS_ERR(clk)) {
++ ret = PTR_ERR(clk);
++ goto put_dev;
++ }
+
+ fdp1->clk_rate = clk_get_rate(clk);
+ clk_put(clk);
+@@ -2324,7 +2325,7 @@ static int fdp1_probe(struct platform_device *pdev)
+ ret = v4l2_device_register(&pdev->dev, &fdp1->v4l2_dev);
+ if (ret) {
+ v4l2_err(&fdp1->v4l2_dev, "Failed to register video device\n");
+- return ret;
++ goto put_dev;
+ }
+
+ /* M2M registration */
+@@ -2389,6 +2390,8 @@ release_m2m:
+ unreg_dev:
+ v4l2_device_unregister(&fdp1->v4l2_dev);
+
++put_dev:
++ rcar_fcp_put(fdp1->fcp);
+ return ret;
+ }
+
+@@ -2400,6 +2403,7 @@ static int fdp1_remove(struct platform_device *pdev)
+ video_unregister_device(&fdp1->vfd);
+ v4l2_device_unregister(&fdp1->v4l2_dev);
+ pm_runtime_disable(&pdev->dev);
++ rcar_fcp_put(fdp1->fcp);
+
+ return 0;
+ }
+diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+index 00f6e3f06dac5..7a7271f9d875a 100644
+--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+@@ -1312,6 +1312,8 @@ static int bdisp_probe(struct platform_device *pdev)
+ init_waitqueue_head(&bdisp->irq_queue);
+ INIT_DELAYED_WORK(&bdisp->timeout_work, bdisp_irq_timeout);
+ bdisp->work_queue = create_workqueue(BDISP_NAME);
++ if (!bdisp->work_queue)
++ return -ENOMEM;
+
+ spin_lock_init(&bdisp->slock);
+ mutex_init(&bdisp->lock);
+diff --git a/drivers/media/rc/gpio-ir-recv.c b/drivers/media/rc/gpio-ir-recv.c
+index 3d99b51384ac9..ed5cfde4d9e79 100644
+--- a/drivers/media/rc/gpio-ir-recv.c
++++ b/drivers/media/rc/gpio-ir-recv.c
+@@ -91,6 +91,8 @@ static int gpio_ir_recv_probe(struct platform_device *pdev)
+ rcdev->map_name = RC_MAP_EMPTY;
+
+ gpio_dev->rcdev = rcdev;
++ if (of_property_read_bool(np, "wakeup-source"))
++ device_init_wakeup(dev, true);
+
+ rc = devm_rc_register_device(dev, rcdev);
+ if (rc < 0) {
+diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
+index 83e0c95d20a47..5acbf384ffa64 100644
+--- a/drivers/misc/vmw_vmci/vmci_host.c
++++ b/drivers/misc/vmw_vmci/vmci_host.c
+@@ -169,10 +169,16 @@ static int vmci_host_close(struct inode *inode, struct file *filp)
+ static __poll_t vmci_host_poll(struct file *filp, poll_table *wait)
+ {
+ struct vmci_host_dev *vmci_host_dev = filp->private_data;
+- struct vmci_ctx *context = vmci_host_dev->context;
++ struct vmci_ctx *context;
+ __poll_t mask = 0;
+
+ if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
++ /*
++ * Read context only if ct_type == VMCIOBJ_CONTEXT to make
++ * sure that context is initialized
++ */
++ context = vmci_host_dev->context;
++
+ /* Check for VMCI calls to this VM context. */
+ if (wait)
+ poll_wait(filp, &context->host_context.wait_queue,
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index a92f531ad23a3..d5c6b91fd1139 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -80,9 +80,6 @@ struct cqspi_st {
+ dma_addr_t mmap_phys_base;
+
+ int current_cs;
+- int current_page_size;
+- int current_erase_size;
+- int current_addr_width;
+ unsigned long master_ref_clk_hz;
+ bool is_decoded_cs;
+ u32 fifo_depth;
+@@ -734,32 +731,6 @@ static void cqspi_chipselect(struct spi_nor *nor)
+ writel(reg, reg_base + CQSPI_REG_CONFIG);
+ }
+
+-static void cqspi_configure_cs_and_sizes(struct spi_nor *nor)
+-{
+- struct cqspi_flash_pdata *f_pdata = nor->priv;
+- struct cqspi_st *cqspi = f_pdata->cqspi;
+- void __iomem *iobase = cqspi->iobase;
+- unsigned int reg;
+-
+- /* configure page size and block size. */
+- reg = readl(iobase + CQSPI_REG_SIZE);
+- reg &= ~(CQSPI_REG_SIZE_PAGE_MASK << CQSPI_REG_SIZE_PAGE_LSB);
+- reg &= ~(CQSPI_REG_SIZE_BLOCK_MASK << CQSPI_REG_SIZE_BLOCK_LSB);
+- reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK;
+- reg |= (nor->page_size << CQSPI_REG_SIZE_PAGE_LSB);
+- reg |= (ilog2(nor->mtd.erasesize) << CQSPI_REG_SIZE_BLOCK_LSB);
+- reg |= (nor->addr_width - 1);
+- writel(reg, iobase + CQSPI_REG_SIZE);
+-
+- /* configure the chip select */
+- cqspi_chipselect(nor);
+-
+- /* Store the new configuration of the controller */
+- cqspi->current_page_size = nor->page_size;
+- cqspi->current_erase_size = nor->mtd.erasesize;
+- cqspi->current_addr_width = nor->addr_width;
+-}
+-
+ static unsigned int calculate_ticks_for_ns(const unsigned int ref_clk_hz,
+ const unsigned int ns_val)
+ {
+@@ -865,18 +836,13 @@ static void cqspi_configure(struct spi_nor *nor)
+ int switch_cs = (cqspi->current_cs != f_pdata->cs);
+ int switch_ck = (cqspi->sclk != sclk);
+
+- if ((cqspi->current_page_size != nor->page_size) ||
+- (cqspi->current_erase_size != nor->mtd.erasesize) ||
+- (cqspi->current_addr_width != nor->addr_width))
+- switch_cs = 1;
+-
+ if (switch_cs || switch_ck)
+ cqspi_controller_enable(cqspi, 0);
+
+ /* Switch chip select. */
+ if (switch_cs) {
+ cqspi->current_cs = f_pdata->cs;
+- cqspi_configure_cs_and_sizes(nor);
++ cqspi_chipselect(nor);
+ }
+
+ /* Setup baudrate divisor and delays */
+@@ -1196,7 +1162,7 @@ static void cqspi_controller_init(struct cqspi_st *cqspi)
+ cqspi_controller_enable(cqspi, 1);
+ }
+
+-static void cqspi_request_mmap_dma(struct cqspi_st *cqspi)
++static int cqspi_request_mmap_dma(struct cqspi_st *cqspi)
+ {
+ dma_cap_mask_t mask;
+
+@@ -1205,10 +1171,16 @@ static void cqspi_request_mmap_dma(struct cqspi_st *cqspi)
+
+ cqspi->rx_chan = dma_request_chan_by_mask(&mask);
+ if (IS_ERR(cqspi->rx_chan)) {
+- dev_err(&cqspi->pdev->dev, "No Rx DMA available\n");
++ int ret = PTR_ERR(cqspi->rx_chan);
++
++ if (ret != -EPROBE_DEFER)
++ dev_err(&cqspi->pdev->dev, "No Rx DMA available\n");
+ cqspi->rx_chan = NULL;
++ return ret;
+ }
+ init_completion(&cqspi->rx_dma_complete);
++
++ return 0;
+ }
+
+ static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np)
+@@ -1289,8 +1261,11 @@ static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np)
+ dev_dbg(nor->dev, "using direct mode for %s\n",
+ mtd->name);
+
+- if (!cqspi->rx_chan)
+- cqspi_request_mmap_dma(cqspi);
++ if (!cqspi->rx_chan) {
++ ret = cqspi_request_mmap_dma(cqspi);
++ if (ret == -EPROBE_DEFER)
++ goto err;
++ }
+ }
+ }
+
+@@ -1437,17 +1412,30 @@ static int cqspi_remove(struct platform_device *pdev)
+ static int cqspi_suspend(struct device *dev)
+ {
+ struct cqspi_st *cqspi = dev_get_drvdata(dev);
++ struct spi_master *master = dev_get_drvdata(dev);
++ int ret;
+
++ ret = spi_master_suspend(master);
+ cqspi_controller_enable(cqspi, 0);
+- return 0;
++
++ clk_disable_unprepare(cqspi->clk);
++
++ return ret;
+ }
+
+ static int cqspi_resume(struct device *dev)
+ {
+ struct cqspi_st *cqspi = dev_get_drvdata(dev);
++ struct spi_master *master = dev_get_drvdata(dev);
+
+- cqspi_controller_enable(cqspi, 1);
+- return 0;
++ clk_prepare_enable(cqspi->clk);
++ cqspi_wait_idle(cqspi);
++ cqspi_controller_init(cqspi);
++
++ cqspi->current_cs = -1;
++ cqspi->sclk = 0;
++
++ return spi_master_resume(master);
+ }
+
+ static const struct dev_pm_ops cqspi__dev_pm_ops = {
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index b98481b69314d..3e25421f22a27 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -960,7 +960,7 @@ static int try_write_vid_and_data(struct ubi_volume *vol, int lnum,
+ int offset, int len)
+ {
+ struct ubi_device *ubi = vol->ubi;
+- int pnum, opnum, err, vol_id = vol->vol_id;
++ int pnum, opnum, err, err2, vol_id = vol->vol_id;
+
+ pnum = ubi_wl_get_peb(ubi);
+ if (pnum < 0) {
+@@ -995,10 +995,19 @@ static int try_write_vid_and_data(struct ubi_volume *vol, int lnum,
+ out_put:
+ up_read(&ubi->fm_eba_sem);
+
+- if (err && pnum >= 0)
+- err = ubi_wl_put_peb(ubi, vol_id, lnum, pnum, 1);
+- else if (!err && opnum >= 0)
+- err = ubi_wl_put_peb(ubi, vol_id, lnum, opnum, 0);
++ if (err && pnum >= 0) {
++ err2 = ubi_wl_put_peb(ubi, vol_id, lnum, pnum, 1);
++ if (err2) {
++ ubi_warn(ubi, "failed to return physical eraseblock %d, error %d",
++ pnum, err2);
++ }
++ } else if (!err && opnum >= 0) {
++ err2 = ubi_wl_put_peb(ubi, vol_id, lnum, opnum, 0);
++ if (err2) {
++ ubi_warn(ubi, "failed to return physical eraseblock %d, error %d",
++ opnum, err2);
++ }
++ }
+
+ return err;
+ }
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 6b310f7235801..b593e4d85e9c0 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3601,6 +3601,7 @@ static const struct mv88e6xxx_ops mv88e6320_ops = {
+ .stats_get_stats = mv88e6320_stats_get_stats,
+ .set_cpu_port = mv88e6095_g1_set_cpu_port,
+ .set_egress_port = mv88e6095_g1_set_egress_port,
++ .watchdog_ops = &mv88e6390_watchdog_ops,
+ .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
+ .pot_clear = mv88e6xxx_g2_pot_clear,
+ .reset = mv88e6352_g1_reset,
+@@ -3643,6 +3644,8 @@ static const struct mv88e6xxx_ops mv88e6321_ops = {
+ .stats_get_stats = mv88e6320_stats_get_stats,
+ .set_cpu_port = mv88e6095_g1_set_cpu_port,
+ .set_egress_port = mv88e6095_g1_set_egress_port,
++ .watchdog_ops = &mv88e6390_watchdog_ops,
++ .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
+ .reset = mv88e6352_g1_reset,
+ .vtu_getnext = mv88e6185_g1_vtu_getnext,
+ .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge,
+diff --git a/drivers/net/ethernet/amd/nmclan_cs.c b/drivers/net/ethernet/amd/nmclan_cs.c
+index 9c152d85840d7..c9d2a6f150624 100644
+--- a/drivers/net/ethernet/amd/nmclan_cs.c
++++ b/drivers/net/ethernet/amd/nmclan_cs.c
+@@ -652,7 +652,7 @@ static int nmclan_config(struct pcmcia_device *link)
+ } else {
+ pr_notice("mace id not found: %x %x should be 0x40 0x?9\n",
+ sig[0], sig[1]);
+- return -ENODEV;
++ goto failed;
+ }
+ }
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+index 8829bd95d0d36..3d361557a63a3 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+@@ -2539,6 +2539,14 @@ static int ixgbe_get_rss_hash_opts(struct ixgbe_adapter *adapter,
+ return 0;
+ }
+
++static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter)
++{
++ if (adapter->hw.mac.type < ixgbe_mac_X550)
++ return 16;
++ else
++ return 64;
++}
++
+ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+ u32 *rule_locs)
+ {
+@@ -2547,7 +2555,8 @@ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+
+ switch (cmd->cmd) {
+ case ETHTOOL_GRXRINGS:
+- cmd->data = adapter->num_rx_queues;
++ cmd->data = min_t(int, adapter->num_rx_queues,
++ ixgbe_rss_indir_tbl_max(adapter));
+ ret = 0;
+ break;
+ case ETHTOOL_GRXCLSRLCNT:
+@@ -2949,14 +2958,6 @@ static int ixgbe_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd)
+ return ret;
+ }
+
+-static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter)
+-{
+- if (adapter->hw.mac.type < ixgbe_mac_X550)
+- return 16;
+- else
+- return 64;
+-}
+-
+ static u32 ixgbe_get_rxfh_key_size(struct net_device *netdev)
+ {
+ return IXGBE_RSS_KEY_SIZE;
+@@ -3005,8 +3006,8 @@ static int ixgbe_set_rxfh(struct net_device *netdev, const u32 *indir,
+ int i;
+ u32 reta_entries = ixgbe_rss_indir_tbl_entries(adapter);
+
+- if (hfunc)
+- return -EINVAL;
++ if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP)
++ return -EOPNOTSUPP;
+
+ /* Fill out the redirection table */
+ if (indir) {
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 0a4d093adfc93..3e35cdf0d2b76 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -114,6 +114,7 @@ MODULE_PARM_DESC(chain_mode, "To use chain instead of ring mode");
+ static irqreturn_t stmmac_interrupt(int irq, void *dev_id);
+
+ #ifdef CONFIG_DEBUG_FS
++static const struct net_device_ops stmmac_netdev_ops;
+ static int stmmac_init_fs(struct net_device *dev);
+ static void stmmac_exit_fs(struct net_device *dev);
+ #endif
+@@ -4034,6 +4035,34 @@ static const struct file_operations stmmac_dma_cap_fops = {
+ .release = single_release,
+ };
+
++/* Use network device events to rename debugfs file entries.
++ */
++static int stmmac_device_event(struct notifier_block *unused,
++ unsigned long event, void *ptr)
++{
++ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++ struct stmmac_priv *priv = netdev_priv(dev);
++
++ if (dev->netdev_ops != &stmmac_netdev_ops)
++ goto done;
++
++ switch (event) {
++ case NETDEV_CHANGENAME:
++ if (priv->dbgfs_dir)
++ priv->dbgfs_dir = debugfs_rename(stmmac_fs_dir,
++ priv->dbgfs_dir,
++ stmmac_fs_dir,
++ dev->name);
++ break;
++ }
++done:
++ return NOTIFY_DONE;
++}
++
++static struct notifier_block stmmac_notifier = {
++ .notifier_call = stmmac_device_event,
++};
++
+ static int stmmac_init_fs(struct net_device *dev)
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
+@@ -4072,6 +4101,8 @@ static int stmmac_init_fs(struct net_device *dev)
+ return -ENOMEM;
+ }
+
++ register_netdevice_notifier(&stmmac_notifier);
++
+ return 0;
+ }
+
+@@ -4079,6 +4110,7 @@ static void stmmac_exit_fs(struct net_device *dev)
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
+
++ unregister_netdevice_notifier(&stmmac_notifier);
+ debugfs_remove_recursive(priv->dbgfs_dir);
+ }
+ #endif /* CONFIG_DEBUG_FS */
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 0cd46735e3950..d45e8de79f286 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2655,6 +2655,27 @@ static void free_receive_page_frags(struct virtnet_info *vi)
+ put_page(vi->rq[i].alloc_frag.page);
+ }
+
++static void virtnet_sq_free_unused_buf(struct virtqueue *vq, void *buf)
++{
++ if (!is_xdp_frame(buf))
++ dev_kfree_skb(buf);
++ else
++ xdp_return_frame(ptr_to_xdp(buf));
++}
++
++static void virtnet_rq_free_unused_buf(struct virtqueue *vq, void *buf)
++{
++ struct virtnet_info *vi = vq->vdev->priv;
++ int i = vq2rxq(vq);
++
++ if (vi->mergeable_rx_bufs)
++ put_page(virt_to_head_page(buf));
++ else if (vi->big_packets)
++ give_pages(&vi->rq[i], buf);
++ else
++ put_page(virt_to_head_page(buf));
++}
++
+ static void free_unused_bufs(struct virtnet_info *vi)
+ {
+ void *buf;
+@@ -2662,26 +2683,16 @@ static void free_unused_bufs(struct virtnet_info *vi)
+
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+ struct virtqueue *vq = vi->sq[i].vq;
+- while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
+- if (!is_xdp_frame(buf))
+- dev_kfree_skb(buf);
+- else
+- xdp_return_frame(ptr_to_xdp(buf));
+- }
++ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL)
++ virtnet_sq_free_unused_buf(vq, buf);
++ cond_resched();
+ }
+
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+ struct virtqueue *vq = vi->rq[i].vq;
+-
+- while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
+- if (vi->mergeable_rx_bufs) {
+- put_page(virt_to_head_page(buf));
+- } else if (vi->big_packets) {
+- give_pages(&vi->rq[i], buf);
+- } else {
+- put_page(virt_to_head_page(buf));
+- }
+- }
++ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL)
++ virtnet_rq_free_unused_buf(vq, buf);
++ cond_resched();
+ }
+ }
+
+diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
+index 01163b3339451..92f5c8e830901 100644
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -529,7 +529,7 @@ ath5k_eeprom_read_freq_list(struct ath5k_hw *ah, int *offset, int max,
+ ee->ee_n_piers[mode]++;
+
+ freq2 = (val >> 8) & 0xff;
+- if (!freq2)
++ if (!freq2 || i >= max)
+ break;
+
+ pc[i++].freq = ath5k_eeprom_bin2freq(ee,
+diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c
+index bde5a10d470c8..af98e871199d3 100644
+--- a/drivers/net/wireless/ath/ath6kl/bmi.c
++++ b/drivers/net/wireless/ath/ath6kl/bmi.c
+@@ -246,7 +246,7 @@ int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param)
+ return -EACCES;
+ }
+
+- size = sizeof(cid) + sizeof(addr) + sizeof(param);
++ size = sizeof(cid) + sizeof(addr) + sizeof(*param);
+ if (size > ar->bmi.max_cmd_size) {
+ WARN_ON(1);
+ return -EINVAL;
+diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+index 434b668296466..73bf4af1f3c7c 100644
+--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
++++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+@@ -963,8 +963,8 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
+ * Thus the possibility of ar->htc_target being NULL
+ * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work.
+ */
+- if (WARN_ON_ONCE(!target)) {
+- ath6kl_err("Target not yet initialized\n");
++ if (!target) {
++ ath6kl_dbg(ATH6KL_DBG_HTC, "Target not yet initialized\n");
+ status = -EINVAL;
+ goto free_skb;
+ }
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index e23d58f83dd6f..3aa915d215545 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -534,6 +534,24 @@ static struct ath9k_htc_hif hif_usb = {
+ .send = hif_usb_send,
+ };
+
++/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream
++ * in case ath9k_hif_usb_rx_stream wasn't called next time to
++ * process the buffer and subsequently free it.
++ */
++static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&hif_dev->rx_lock, flags);
++ if (hif_dev->remain_skb) {
++ dev_kfree_skb_any(hif_dev->remain_skb);
++ hif_dev->remain_skb = NULL;
++ hif_dev->rx_remain_len = 0;
++ RX_STAT_INC(hif_dev, skb_dropped);
++ }
++ spin_unlock_irqrestore(&hif_dev->rx_lock, flags);
++}
++
+ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ struct sk_buff *skb)
+ {
+@@ -868,6 +886,7 @@ err:
+ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
+ {
+ usb_kill_anchored_urbs(&hif_dev->rx_submitted);
++ ath9k_hif_usb_free_rx_remain_skb(hif_dev);
+ }
+
+ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index 75790b13c9621..d77c1dbb5e191 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5362,6 +5362,11 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
+ (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
+ req_len = le32_to_cpu(assoc_info->req_len);
+ resp_len = le32_to_cpu(assoc_info->resp_len);
++ if (req_len > WL_EXTRA_BUF_MAX || resp_len > WL_EXTRA_BUF_MAX) {
++ brcmf_err("invalid lengths in assoc info: req %u resp %u\n",
++ req_len, resp_len);
++ return -EINVAL;
++ }
+ if (req_len) {
+ err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
+ cfg->extra_buf,
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+index 05b77419953ce..9540c874fc380 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+@@ -1835,6 +1835,11 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf,
+ if (ret < 0)
+ return ret;
+
++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
++ ret = -EIO;
++ goto out;
++ }
++
+ rsp = (void *)hcmd.resp_pkt->data;
+ if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) {
+ ret = -ENXIO;
+@@ -1912,6 +1917,11 @@ static ssize_t iwl_dbgfs_mem_write(struct file *file,
+ if (ret < 0)
+ return ret;
+
++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
++ ret = -EIO;
++ goto out;
++ }
++
+ rsp = (void *)hcmd.resp_pkt->data;
+ if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) {
+ ret = -ENXIO;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 2d2afc1758304..c69c13e762bbe 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -666,7 +666,6 @@ static int iwl_pcie_set_hw_ready(struct iwl_trans *trans)
+ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
+ {
+ int ret;
+- int t = 0;
+ int iter;
+
+ IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
+@@ -681,6 +680,8 @@ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
+ usleep_range(1000, 2000);
+
+ for (iter = 0; iter < 10; iter++) {
++ int t = 0;
++
+ /* If HW is not ready, prepare the conditions to check again */
+ iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+ CSR_HW_IF_CONFIG_REG_PREPARE);
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
+index eb8f046ae20d8..f936ad6c57284 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
+@@ -1710,6 +1710,7 @@ struct rtl8xxxu_fileops rtl8192eu_fops = {
+ .rx_desc_size = sizeof(struct rtl8xxxu_rxdesc24),
+ .has_s0s1 = 0,
+ .gen2_thermal_meter = 1,
++ .needs_full_init = 1,
+ .adda_1t_init = 0x0fc01616,
+ .adda_1t_path_on = 0x0fc01616,
+ .adda_2t_path_on_a = 0x0fc01616,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index 6d1b6a4a81502..7644d7cbcb5af 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -217,8 +217,8 @@ static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
+ } else {
+ if (get_rf_type(rtlphy) == RF_1T2R ||
+ get_rf_type(rtlphy) == RF_2T2R) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "1T2R or 2T2R\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "1T2R or 2T2R\n");
+ ht_cap->mcs.rx_mask[0] = 0xFF;
+ ht_cap->mcs.rx_mask[1] = 0xFF;
+ ht_cap->mcs.rx_mask[4] = 0x01;
+@@ -226,7 +226,7 @@ static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
+ ht_cap->mcs.rx_highest =
+ cpu_to_le16(MAX_BIT_RATE_40MHZ_MCS15);
+ } else if (get_rf_type(rtlphy) == RF_1T1R) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n");
+
+ ht_cap->mcs.rx_mask[0] = 0xFF;
+ ht_cap->mcs.rx_mask[1] = 0x00;
+@@ -1344,7 +1344,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb)
+ rtlpriv->cfg->ops->chk_switch_dmdp(hw);
+ }
+ if (ieee80211_is_auth(fc)) {
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
+
+ mac->link_state = MAC80211_LINKING;
+ /* Dul mac */
+@@ -1405,7 +1405,7 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ if (mac->act_scanning)
+ return false;
+
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+ "%s ACT_ADDBAREQ From :%pM\n",
+ is_tx ? "Tx" : "Rx", hdr->addr2);
+ RT_PRINT_DATA(rtlpriv, COMP_INIT, DBG_DMESG, "req\n",
+@@ -1420,8 +1420,8 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ rcu_read_lock();
+ sta = rtl_find_sta(hw, hdr->addr3);
+ if (sta == NULL) {
+- RT_TRACE(rtlpriv, COMP_SEND | COMP_RECV,
+- DBG_DMESG, "sta is NULL\n");
++ rtl_dbg(rtlpriv, COMP_SEND | COMP_RECV,
++ DBG_DMESG, "sta is NULL\n");
+ rcu_read_unlock();
+ return true;
+ }
+@@ -1448,13 +1448,13 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ }
+ break;
+ case ACT_ADDBARSP:
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+- "%s ACT_ADDBARSP From :%pM\n",
+- is_tx ? "Tx" : "Rx", hdr->addr2);
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ "%s ACT_ADDBARSP From :%pM\n",
++ is_tx ? "Tx" : "Rx", hdr->addr2);
+ break;
+ case ACT_DELBA:
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+- "ACT_ADDBADEL From :%pM\n", hdr->addr2);
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ "ACT_ADDBADEL From :%pM\n", hdr->addr2);
+ break;
+ }
+ break;
+@@ -1539,9 +1539,9 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx,
+ /* 68 : UDP BOOTP client
+ * 67 : UDP BOOTP server
+ */
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV),
+- DBG_DMESG, "dhcp %s !!\n",
+- (is_tx) ? "Tx" : "Rx");
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV),
++ DBG_DMESG, "dhcp %s !!\n",
++ (is_tx) ? "Tx" : "Rx");
+
+ if (is_tx)
+ setup_special_tx(rtlpriv, ppsc,
+@@ -1560,8 +1560,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx,
+ rtlpriv->btcoexist.btc_info.in_4way = true;
+ rtlpriv->btcoexist.btc_info.in_4way_ts = jiffies;
+
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+- "802.1X %s EAPOL pkt!!\n", (is_tx) ? "Tx" : "Rx");
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ "802.1X %s EAPOL pkt!!\n", (is_tx) ? "Tx" : "Rx");
+
+ if (is_tx) {
+ rtlpriv->ra.is_special_data = true;
+@@ -1603,12 +1603,12 @@ static void rtl_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
+ info = IEEE80211_SKB_CB(skb);
+ ieee80211_tx_info_clear_status(info);
+ if (ack) {
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
+- "tx report: ack\n");
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
++ "tx report: ack\n");
+ info->flags |= IEEE80211_TX_STAT_ACK;
+ } else {
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
+- "tx report: not ack\n");
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
++ "tx report: not ack\n");
+ info->flags &= ~IEEE80211_TX_STAT_ACK;
+ }
+ ieee80211_tx_status_irqsafe(hw, skb);
+@@ -1646,8 +1646,8 @@ static u16 rtl_get_tx_report_sn(struct ieee80211_hw *hw,
+ tx_report->last_sent_time = jiffies;
+ tx_info->sn = sn;
+ tx_info->send_time = tx_report->last_sent_time;
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
+- "Send TX-Report sn=0x%X\n", sn);
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
++ "Send TX-Report sn=0x%X\n", sn);
+
+ return sn;
+ }
+@@ -1694,9 +1694,9 @@ void rtl_tx_report_handler(struct ieee80211_hw *hw, u8 *tmp_buf, u8 c2h_cmd_len)
+ break;
+ }
+ }
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
+- "Recv TX-Report st=0x%02X sn=0x%X retry=0x%X\n",
+- st, sn, retry);
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
++ "Recv TX-Report st=0x%02X sn=0x%X retry=0x%X\n",
++ st, sn, retry);
+ }
+ EXPORT_SYMBOL_GPL(rtl_tx_report_handler);
+
+@@ -1709,9 +1709,9 @@ bool rtl_check_tx_report_acked(struct ieee80211_hw *hw)
+ return true;
+
+ if (time_before(tx_report->last_sent_time + 3 * HZ, jiffies)) {
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_WARNING,
+- "Check TX-Report timeout!! s_sn=0x%X r_sn=0x%X\n",
+- tx_report->last_sent_sn, tx_report->last_recv_sn);
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_WARNING,
++ "Check TX-Report timeout!! s_sn=0x%X r_sn=0x%X\n",
++ tx_report->last_sent_sn, tx_report->last_recv_sn);
+ return true; /* 3 sec. (timeout) seen as acked */
+ }
+
+@@ -1727,8 +1727,8 @@ void rtl_wait_tx_report_acked(struct ieee80211_hw *hw, u32 wait_ms)
+ if (rtl_check_tx_report_acked(hw))
+ break;
+ usleep_range(1000, 2000);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "Wait 1ms (%d/%d) to disable key.\n", i, wait_ms);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "Wait 1ms (%d/%d) to disable key.\n", i, wait_ms);
+ }
+ }
+
+@@ -1790,9 +1790,9 @@ int rtl_tx_agg_start(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ return -ENXIO;
+ tid_data = &sta_entry->tids[tid];
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d seq:%d\n", sta->addr, tid,
+- *ssn);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d seq:%d\n", sta->addr, tid,
++ *ssn);
+
+ tid_data->agg.agg_state = RTL_AGG_START;
+
+@@ -1809,8 +1809,8 @@ int rtl_tx_agg_stop(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ if (sta == NULL)
+ return -EINVAL;
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ if (unlikely(tid >= MAX_TID_COUNT))
+ return -EINVAL;
+@@ -1849,8 +1849,8 @@ int rtl_rx_agg_start(struct ieee80211_hw *hw,
+ return -ENXIO;
+ tid_data = &sta_entry->tids[tid];
+
+- RT_TRACE(rtlpriv, COMP_RECV, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_RECV, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ tid_data->agg.rx_agg_state = RTL_RX_AGG_START;
+ return 0;
+@@ -1865,8 +1865,8 @@ int rtl_rx_agg_stop(struct ieee80211_hw *hw,
+ if (sta == NULL)
+ return -EINVAL;
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ if (unlikely(tid >= MAX_TID_COUNT))
+ return -EINVAL;
+@@ -1885,8 +1885,8 @@ int rtl_tx_agg_oper(struct ieee80211_hw *hw,
+ if (sta == NULL)
+ return -EINVAL;
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ if (unlikely(tid >= MAX_TID_COUNT))
+ return -EINVAL;
+@@ -1906,9 +1906,9 @@ void rtl_rx_ampdu_apply(struct rtl_priv *rtlpriv)
+ btc_ops->btc_get_ampdu_cfg(rtlpriv, &reject_agg,
+ &ctrl_agg_size, &agg_size);
+
+- RT_TRACE(rtlpriv, COMP_BT_COEXIST, DBG_DMESG,
+- "Set RX AMPDU: coex - reject=%d, ctrl_agg_size=%d, size=%d",
+- reject_agg, ctrl_agg_size, agg_size);
++ rtl_dbg(rtlpriv, COMP_BT_COEXIST, DBG_DMESG,
++ "Set RX AMPDU: coex - reject=%d, ctrl_agg_size=%d, size=%d",
++ reject_agg, ctrl_agg_size, agg_size);
+
+ rtlpriv->hw->max_rx_aggregation_subframes =
+ (ctrl_agg_size ? agg_size : IEEE80211_MAX_AMPDU_BUF_HT);
+@@ -1996,9 +1996,9 @@ void rtl_scan_list_expire(struct ieee80211_hw *hw)
+ list_del(&entry->list);
+ rtlpriv->scan_list.num--;
+
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD,
+- "BSSID=%pM is expire in scan list (total=%d)\n",
+- entry->bssid, rtlpriv->scan_list.num);
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD,
++ "BSSID=%pM is expire in scan list (total=%d)\n",
++ entry->bssid, rtlpriv->scan_list.num);
+ kfree(entry);
+ }
+
+@@ -2032,9 +2032,9 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb)
+ if (memcmp(entry->bssid, hdr->addr3, ETH_ALEN) == 0) {
+ list_del_init(&entry->list);
+ entry_found = true;
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD,
+- "Update BSSID=%pM to scan list (total=%d)\n",
+- hdr->addr3, rtlpriv->scan_list.num);
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD,
++ "Update BSSID=%pM to scan list (total=%d)\n",
++ hdr->addr3, rtlpriv->scan_list.num);
+ break;
+ }
+ }
+@@ -2048,9 +2048,9 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb)
+ memcpy(entry->bssid, hdr->addr3, ETH_ALEN);
+ rtlpriv->scan_list.num++;
+
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD,
+- "Add BSSID=%pM to scan list (total=%d)\n",
+- hdr->addr3, rtlpriv->scan_list.num);
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD,
++ "Add BSSID=%pM to scan list (total=%d)\n",
++ hdr->addr3, rtlpriv->scan_list.num);
+ }
+
+ entry->age = jiffies;
+@@ -2213,8 +2213,8 @@ label_lps_done:
+ if ((rtlpriv->link_info.bcn_rx_inperiod +
+ rtlpriv->link_info.num_rx_inperiod) == 0) {
+ rtlpriv->link_info.roam_times++;
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+- "AP off for %d s\n",
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
++ "AP off for %d s\n",
+ (rtlpriv->link_info.roam_times * 2));
+
+ /* if we can't recv beacon for 10s,
+@@ -2325,11 +2325,11 @@ static void rtl_c2h_content_parsing(struct ieee80211_hw *hw,
+
+ switch (cmd_id) {
+ case C2H_DBG:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "[C2H], C2H_DBG!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "[C2H], C2H_DBG!!\n");
+ break;
+ case C2H_TXBF:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], C2H_TXBF!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], C2H_TXBF!!\n");
+ break;
+ case C2H_TX_REPORT:
+ rtl_tx_report_handler(hw, cmd_buf, cmd_len);
+@@ -2339,20 +2339,20 @@ static void rtl_c2h_content_parsing(struct ieee80211_hw *hw,
+ hal_ops->c2h_ra_report_handler(hw, cmd_buf, cmd_len);
+ break;
+ case C2H_BT_INFO:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], C2H_BT_INFO!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], C2H_BT_INFO!!\n");
+ if (rtlpriv->cfg->ops->get_btc_status())
+ btc_ops->btc_btinfo_notify(rtlpriv, cmd_buf, cmd_len);
+ break;
+ case C2H_BT_MP:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], C2H_BT_MP!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], C2H_BT_MP!!\n");
+ if (rtlpriv->cfg->ops->get_btc_status())
+ btc_ops->btc_btmpinfo_notify(rtlpriv, cmd_buf, cmd_len);
+ break;
+ default:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], Unknown packet!! cmd_id(%#X)!\n", cmd_id);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], Unknown packet!! cmd_id(%#X)!\n", cmd_id);
+ break;
+ }
+ }
+@@ -2376,8 +2376,8 @@ void rtl_c2hcmd_launcher(struct ieee80211_hw *hw, int exec)
+ if (!skb)
+ break;
+
+- RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG, "C2H rx_desc_shift=%d\n",
+- *((u8 *)skb->cb));
++ rtl_dbg(rtlpriv, COMP_FW, DBG_DMESG, "C2H rx_desc_shift=%d\n",
++ *((u8 *)skb->cb));
+ RT_PRINT_DATA(rtlpriv, COMP_FW, DBG_DMESG,
+ "C2H data: ", skb->data, skb->len);
+
+@@ -2721,29 +2721,29 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len)
+ (memcmp(mac->bssid, ap5_6, 3) == 0) ||
+ vendor == PEER_ATH) {
+ vendor = PEER_ATH;
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ath find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ath find\n");
+ } else if ((memcmp(mac->bssid, ap4_4, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_5, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_1, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_2, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_3, 3) == 0) ||
+ vendor == PEER_RAL) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ral find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ral find\n");
+ vendor = PEER_RAL;
+ } else if (memcmp(mac->bssid, ap6_1, 3) == 0 ||
+ vendor == PEER_CISCO) {
+ vendor = PEER_CISCO;
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>cisco find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>cisco find\n");
+ } else if ((memcmp(mac->bssid, ap3_1, 3) == 0) ||
+ (memcmp(mac->bssid, ap3_2, 3) == 0) ||
+ (memcmp(mac->bssid, ap3_3, 3) == 0) ||
+ vendor == PEER_BROAD) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>broad find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>broad find\n");
+ vendor = PEER_BROAD;
+ } else if (memcmp(mac->bssid, ap7_1, 3) == 0 ||
+ vendor == PEER_MARV) {
+ vendor = PEER_MARV;
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>marv find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>marv find\n");
+ }
+
+ mac->vendor = vendor;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/cam.c b/drivers/net/wireless/realtek/rtlwifi/cam.c
+index f7a7dcbf945ef..c631295258752 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/cam.c
++++ b/drivers/net/wireless/realtek/rtlwifi/cam.c
+@@ -64,14 +64,14 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM],
+ target_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE %x: %x\n",
+- rtlpriv->cfg->maps[WCAMI], target_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "The Key ID is %d\n", entry_no);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE %x: %x\n",
+- rtlpriv->cfg->maps[RWCAM], target_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE %x: %x\n",
++ rtlpriv->cfg->maps[WCAMI], target_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "The Key ID is %d\n", entry_no);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE %x: %x\n",
++ rtlpriv->cfg->maps[RWCAM], target_command);
+
+ } else if (entry_i == 1) {
+
+@@ -85,10 +85,10 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM],
+ target_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A4: %x\n", target_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A0: %x\n", target_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A4: %x\n", target_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A0: %x\n", target_command);
+
+ } else {
+
+@@ -104,15 +104,15 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM],
+ target_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A4: %x\n", target_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A0: %x\n", target_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A4: %x\n", target_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A0: %x\n", target_command);
+ }
+ }
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "after set key, usconfig:%x\n", us_config);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "after set key, usconfig:%x\n", us_config);
+ }
+
+ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
+@@ -122,14 +122,14 @@ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
+ u32 us_config;
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "EntryNo:%x, ulKeyId=%x, ulEncAlg=%x, ulUseDK=%x MacAddr %pM\n",
+- ul_entry_idx, ul_key_id, ul_enc_alg,
+- ul_default_key, mac_addr);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "EntryNo:%x, ulKeyId=%x, ulEncAlg=%x, ulUseDK=%x MacAddr %pM\n",
++ ul_entry_idx, ul_key_id, ul_enc_alg,
++ ul_default_key, mac_addr);
+
+ if (ul_key_id == TOTAL_CAM_ENTRY) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "ulKeyId exceed!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "ulKeyId exceed!\n");
+ return 0;
+ }
+
+@@ -141,7 +141,7 @@ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
+ rtl_cam_program_entry(hw, ul_entry_idx, mac_addr,
+ (u8 *)key_content, us_config);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "end\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "end\n");
+
+ return 1;
+
+@@ -154,7 +154,7 @@ int rtl_cam_delete_one_entry(struct ieee80211_hw *hw,
+ u32 ul_command;
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "key_idx:%d\n", ul_key_id);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "key_idx:%d\n", ul_key_id);
+
+ ul_command = ul_key_id * CAM_CONTENT_COUNT;
+ ul_command = ul_command | BIT(31) | BIT(16);
+@@ -162,10 +162,10 @@ int rtl_cam_delete_one_entry(struct ieee80211_hw *hw,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], 0);
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_delete_one_entry(): WRITE A4: %x\n", 0);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_delete_one_entry(): WRITE A0: %x\n", ul_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A4: %x\n", __func__, 0);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A0: %x\n", __func__, ul_command);
+
+ return 0;
+
+@@ -216,10 +216,10 @@ void rtl_cam_mark_invalid(struct ieee80211_hw *hw, u8 uc_index)
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], ul_content);
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_mark_invalid(): WRITE A4: %x\n", ul_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_mark_invalid(): WRITE A0: %x\n", ul_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A4: %x\n", __func__, ul_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A0: %x\n", __func__, ul_command);
+ }
+ EXPORT_SYMBOL(rtl_cam_mark_invalid);
+
+@@ -266,12 +266,10 @@ void rtl_cam_empty_entry(struct ieee80211_hw *hw, u8 uc_index)
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], ul_content);
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "rtl_cam_empty_entry(): WRITE A4: %x\n",
+- ul_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "rtl_cam_empty_entry(): WRITE A0: %x\n",
+- ul_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "%s: WRITE A4: %x\n", __func__, ul_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "%s: WRITE A0: %x\n", __func__, ul_command);
+ }
+
+ }
+@@ -334,8 +332,8 @@ void rtl_cam_del_entry(struct ieee80211_hw *hw, u8 *sta_addr)
+ /* Remove from HW Security CAM */
+ eth_zero_addr(rtlpriv->sec.hwsec_cam_sta_addr[i]);
+ rtlpriv->sec.hwsec_cam_bitmap &= ~(BIT(0) << i);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "&&&&&&&&&del entry %d\n", i);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "&&&&&&&&&del entry %d\n", i);
+ }
+ }
+ return;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
+index 4bf7967590ca7..0ad4e0f099f95 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/core.c
++++ b/drivers/net/wireless/realtek/rtlwifi/core.c
+@@ -98,8 +98,8 @@ static void rtl_fw_do_work(const struct firmware *firmware, void *context,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ int err;
+
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
+- "Firmware callback routine entered!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD,
++ "Firmware callback routine entered!\n");
+ complete(&rtlpriv->firmware_loading_complete);
+ if (!firmware) {
+ if (rtlpriv->cfg->alt_fw_name) {
+@@ -235,8 +235,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ u8 retry_limit = 0x30;
+
+ if (mac->vif) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "vif has been set!! mac->vif = 0x%p\n", mac->vif);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "vif has been set!! mac->vif = 0x%p\n", mac->vif);
+ return -EOPNOTSUPP;
+ }
+
+@@ -251,16 +251,16 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ /*fall through*/
+ case NL80211_IFTYPE_STATION:
+ if (mac->beacon_enabled == 1) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_STATION\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_STATION\n");
+ mac->beacon_enabled = 0;
+ rtlpriv->cfg->ops->update_interrupt_mask(hw, 0,
+ rtlpriv->cfg->maps[RTL_IBSS_INT_MASKS]);
+ }
+ break;
+ case NL80211_IFTYPE_ADHOC:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_ADHOC\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_ADHOC\n");
+
+ mac->link_state = MAC80211_LINKED;
+ rtlpriv->cfg->ops->set_bcn_reg(hw);
+@@ -277,8 +277,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ mac->p2p = P2P_ROLE_GO;
+ /*fall through*/
+ case NL80211_IFTYPE_AP:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_AP\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_AP\n");
+
+ mac->link_state = MAC80211_LINKED;
+ rtlpriv->cfg->ops->set_bcn_reg(hw);
+@@ -292,8 +292,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ retry_limit = 0x07;
+ break;
+ case NL80211_IFTYPE_MESH_POINT:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_MESH_POINT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_MESH_POINT\n");
+
+ mac->link_state = MAC80211_LINKED;
+ rtlpriv->cfg->ops->set_bcn_reg(hw);
+@@ -314,8 +314,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ }
+
+ if (mac->p2p) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "p2p role %x\n", vif->type);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "p2p role %x\n", vif->type);
+ mac->basic_rates = 0xff0;/*disable cck rate for p2p*/
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BASIC_RATE,
+ (u8 *)(&mac->basic_rates));
+@@ -379,8 +379,8 @@ static int rtl_op_change_interface(struct ieee80211_hw *hw,
+ vif->type = new_type;
+ vif->p2p = p2p;
+ ret = rtl_op_add_interface(hw, vif);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "p2p %x\n", p2p);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "p2p %x\n", p2p);
+ return ret;
+ }
+
+@@ -454,8 +454,8 @@ static void _rtl_add_wowlan_patterns(struct ieee80211_hw *hw,
+ memset(mask, 0, MAX_WOL_BIT_MASK_SIZE);
+ if (patterns[i].pattern_len < 0 ||
+ patterns[i].pattern_len > MAX_WOL_PATTERN_SIZE) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_WARNING,
+- "Pattern[%d] is too long\n", i);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_WARNING,
++ "Pattern[%d] is too long\n", i);
+ continue;
+ }
+ pattern_os = patterns[i].pattern;
+@@ -534,8 +534,8 @@ static void _rtl_add_wowlan_patterns(struct ieee80211_hw *hw,
+ "pattern to hw\n", content, len);
+ /* 3. calculate crc */
+ rtl_pattern.crc = _calculate_wol_pattern_crc(content, len);
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE,
+- "CRC_Remainder = 0x%x\n", rtl_pattern.crc);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE,
++ "CRC_Remainder = 0x%x\n", rtl_pattern.crc);
+
+ /* 4. write crc & mask_for_hw to hw */
+ rtlpriv->cfg->ops->add_wowlan_pattern(hw, &rtl_pattern, i);
+@@ -550,7 +550,7 @@ static int rtl_op_suspend(struct ieee80211_hw *hw,
+ struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
+ struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
+ if (WARN_ON(!wow))
+ return -EINVAL;
+
+@@ -576,7 +576,7 @@ static int rtl_op_resume(struct ieee80211_hw *hw)
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+ time64_t now;
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
+ rtlhal->driver_is_goingto_unload = false;
+ rtlhal->enter_pnp_sleep = false;
+ rtlhal->wake_from_pnp_sleep = true;
+@@ -607,8 +607,8 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed)
+
+ mutex_lock(&rtlpriv->locks.conf_mutex);
+ if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) { /* BIT(2)*/
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "IEEE80211_CONF_CHANGE_LISTEN_INTERVAL\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "IEEE80211_CONF_CHANGE_LISTEN_INTERVAL\n");
+ }
+
+ /*For IPS */
+@@ -651,9 +651,9 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed)
+ }
+
+ if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "IEEE80211_CONF_CHANGE_RETRY_LIMITS %x\n",
+- hw->conf.long_frame_max_tx_count);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "IEEE80211_CONF_CHANGE_RETRY_LIMITS %x\n",
++ hw->conf.long_frame_max_tx_count);
+ /* brought up everything changes (changed == ~0) indicates first
+ * open, so use our default value instead of that of wiphy.
+ */
+@@ -828,13 +828,13 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (*new_flags & FIF_ALLMULTI) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_AM] |
+ rtlpriv->cfg->maps[MAC_RCR_AB];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive multicast frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive multicast frame\n");
+ } else {
+ mac->rx_conf &= ~(rtlpriv->cfg->maps[MAC_RCR_AM] |
+ rtlpriv->cfg->maps[MAC_RCR_AB]);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive multicast frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive multicast frame\n");
+ }
+ update_rcr = true;
+ }
+@@ -842,12 +842,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (changed_flags & FIF_FCSFAIL) {
+ if (*new_flags & FIF_FCSFAIL) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_ACRC32];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive FCS error frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive FCS error frame\n");
+ } else {
+ mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_ACRC32];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive FCS error frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive FCS error frame\n");
+ }
+ if (!update_rcr)
+ update_rcr = true;
+@@ -874,12 +874,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (*new_flags & FIF_CONTROL) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_ACF];
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive control frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive control frame.\n");
+ } else {
+ mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_ACF];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive control frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive control frame.\n");
+ }
+ if (!update_rcr)
+ update_rcr = true;
+@@ -888,12 +888,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (changed_flags & FIF_OTHER_BSS) {
+ if (*new_flags & FIF_OTHER_BSS) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_AAP];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive other BSS's frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive other BSS's frame.\n");
+ } else {
+ mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_AAP];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive other BSS's frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive other BSS's frame.\n");
+ }
+ if (!update_rcr)
+ update_rcr = true;
+@@ -941,7 +941,7 @@ static int rtl_op_sta_add(struct ieee80211_hw *hw,
+ sta->supp_rates[0] &= 0xfffffff0;
+
+ memcpy(sta_entry->mac_addr, sta->addr, ETH_ALEN);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
+ "Add sta addr is %pM\n", sta->addr);
+ rtlpriv->cfg->ops->update_rate_tbl(hw, sta, 0, true);
+ }
+@@ -956,8 +956,8 @@ static int rtl_op_sta_remove(struct ieee80211_hw *hw,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_sta_info *sta_entry;
+ if (sta) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "Remove sta addr is %pM\n", sta->addr);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "Remove sta addr is %pM\n", sta->addr);
+ sta_entry = (struct rtl_sta_info *)sta->drv_priv;
+ sta_entry->wireless_mode = 0;
+ sta_entry->ratr_index = 0;
+@@ -1004,8 +1004,8 @@ static int rtl_op_conf_tx(struct ieee80211_hw *hw,
+ int aci;
+
+ if (queue >= AC_MAX) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "queue number %d is incorrect!\n", queue);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "queue number %d is incorrect!\n", queue);
+ return -EINVAL;
+ }
+
+@@ -1050,8 +1050,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ (changed & BSS_CHANGED_BEACON_ENABLED &&
+ bss_conf->enable_beacon)) {
+ if (mac->beacon_enabled == 0) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "BSS_CHANGED_BEACON_ENABLED\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "BSS_CHANGED_BEACON_ENABLED\n");
+
+ /*start hw beacon interrupt. */
+ /*rtlpriv->cfg->ops->set_bcn_reg(hw); */
+@@ -1068,8 +1068,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ if ((changed & BSS_CHANGED_BEACON_ENABLED &&
+ !bss_conf->enable_beacon)) {
+ if (mac->beacon_enabled == 1) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "ADHOC DISABLE BEACON\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "ADHOC DISABLE BEACON\n");
+
+ mac->beacon_enabled = 0;
+ rtlpriv->cfg->ops->update_interrupt_mask(hw, 0,
+@@ -1078,8 +1078,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ }
+ }
+ if (changed & BSS_CHANGED_BEACON_INT) {
+- RT_TRACE(rtlpriv, COMP_BEACON, DBG_TRACE,
+- "BSS_CHANGED_BEACON_INT\n");
++ rtl_dbg(rtlpriv, COMP_BEACON, DBG_TRACE,
++ "BSS_CHANGED_BEACON_INT\n");
+ mac->beacon_interval = bss_conf->beacon_int;
+ rtlpriv->cfg->ops->set_bcn_intv(hw);
+ }
+@@ -1117,8 +1117,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ rcu_read_unlock();
+ goto out;
+ }
+- RT_TRACE(rtlpriv, COMP_EASY_CONCURRENT, DBG_LOUD,
+- "send PS STATIC frame\n");
++ rtl_dbg(rtlpriv, COMP_EASY_CONCURRENT, DBG_LOUD,
++ "send PS STATIC frame\n");
+ if (rtlpriv->dm.supp_phymode_switch) {
+ if (sta->ht_cap.ht_supported)
+ rtl_send_smps_action(hw, sta,
+@@ -1158,8 +1158,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ HW_VAR_KEEP_ALIVE,
+ (u8 *)(&keep_alive));
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "BSS_CHANGED_ASSOC\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "BSS_CHANGED_ASSOC\n");
+ } else {
+ struct cfg80211_bss *bss = NULL;
+
+@@ -1176,14 +1176,14 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ IEEE80211_BSS_TYPE_ESS,
+ IEEE80211_PRIVACY_OFF);
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "bssid = %pMF\n", mac->bssid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "bssid = %pMF\n", mac->bssid);
+
+ if (bss) {
+ cfg80211_unlink_bss(hw->wiphy, bss);
+ cfg80211_put_bss(hw->wiphy, bss);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "cfg80211_unlink !!\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "cfg80211_unlink !!\n");
+ }
+
+ eth_zero_addr(mac->bssid);
+@@ -1194,8 +1194,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ if (rtlpriv->cfg->ops->chk_switch_dmdp)
+ rtlpriv->cfg->ops->chk_switch_dmdp(hw);
+ }
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "BSS_CHANGED_UN_ASSOC\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "BSS_CHANGED_UN_ASSOC\n");
+ }
+ rtlpriv->cfg->ops->set_network_type(hw, vif->type);
+ /* For FW LPS:
+@@ -1213,14 +1213,14 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ }
+
+ if (changed & BSS_CHANGED_ERP_CTS_PROT) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "BSS_CHANGED_ERP_CTS_PROT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "BSS_CHANGED_ERP_CTS_PROT\n");
+ mac->use_cts_protect = bss_conf->use_cts_prot;
+ }
+
+ if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "BSS_CHANGED_ERP_PREAMBLE use short preamble:%x\n",
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "BSS_CHANGED_ERP_PREAMBLE use short preamble:%x\n",
+ bss_conf->use_short_preamble);
+
+ mac->short_preamble = bss_conf->use_short_preamble;
+@@ -1229,8 +1229,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ }
+
+ if (changed & BSS_CHANGED_ERP_SLOT) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "BSS_CHANGED_ERP_SLOT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "BSS_CHANGED_ERP_SLOT\n");
+
+ if (bss_conf->use_short_slot)
+ mac->slot_time = RTL_SLOT_TIME_9;
+@@ -1244,8 +1244,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ if (changed & BSS_CHANGED_HT) {
+ struct ieee80211_sta *sta = NULL;
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "BSS_CHANGED_HT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "BSS_CHANGED_HT\n");
+
+ rcu_read_lock();
+ sta = ieee80211_find_sta(vif, (u8 *)bss_conf->bssid);
+@@ -1276,8 +1276,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BSSID,
+ (u8 *)bss_conf->bssid);
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "bssid: %pM\n", bss_conf->bssid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "bssid: %pM\n", bss_conf->bssid);
+
+ mac->vendor = PEER_UNKNOWN;
+ memcpy(mac->bssid, bss_conf->bssid, ETH_ALEN);
+@@ -1407,27 +1407,27 @@ static int rtl_op_ampdu_action(struct ieee80211_hw *hw,
+
+ switch (action) {
+ case IEEE80211_AMPDU_TX_START:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_TX_START: TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_TX_START: TID:%d\n", tid);
+ return rtl_tx_agg_start(hw, vif, sta, tid, ssn);
+ case IEEE80211_AMPDU_TX_STOP_CONT:
+ case IEEE80211_AMPDU_TX_STOP_FLUSH:
+ case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid);
+ return rtl_tx_agg_stop(hw, vif, sta, tid);
+ case IEEE80211_AMPDU_TX_OPERATIONAL:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid);
+ rtl_tx_agg_oper(hw, sta, tid);
+ break;
+ case IEEE80211_AMPDU_RX_START:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_RX_START:TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_RX_START:TID:%d\n", tid);
+ return rtl_rx_agg_start(hw, sta, tid);
+ case IEEE80211_AMPDU_RX_STOP:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_RX_STOP:TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_RX_STOP:TID:%d\n", tid);
+ return rtl_rx_agg_stop(hw, sta, tid);
+ default:
+ pr_err("IEEE80211_AMPDU_ERR!!!!:\n");
+@@ -1443,7 +1443,7 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
+ mac->act_scanning = true;
+ if (rtlpriv->link_info.higher_busytraffic) {
+ mac->skip_scan = true;
+@@ -1481,7 +1481,7 @@ static void rtl_op_sw_scan_complete(struct ieee80211_hw *hw,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
+ mac->act_scanning = false;
+ mac->skip_scan = false;
+
+@@ -1531,8 +1531,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ rtlpriv->btcoexist.btc_info.in_4way = false;
+
+ if (rtlpriv->cfg->mod_params->sw_crypto || rtlpriv->sec.use_sw_sec) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "not open hw encryption\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "not open hw encryption\n");
+ return -ENOSPC; /*User disabled HW-crypto */
+ }
+ /* To support IBSS, use sw-crypto for GTK */
+@@ -1540,10 +1540,10 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ vif->type == NL80211_IFTYPE_MESH_POINT) &&
+ !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+ return -ENOSPC;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "%s hardware based encryption for keyidx: %d, mac: %pM\n",
+- cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
+- sta ? sta->addr : bcast_addr);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s hardware based encryption for keyidx: %d, mac: %pM\n",
++ cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
++ sta ? sta->addr : bcast_addr);
+ rtlpriv->sec.being_setkey = true;
+ rtl_ips_nic_on(hw);
+ mutex_lock(&rtlpriv->locks.conf_mutex);
+@@ -1552,28 +1552,28 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ switch (key->cipher) {
+ case WLAN_CIPHER_SUITE_WEP40:
+ key_type = WEP40_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP40\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP40\n");
+ break;
+ case WLAN_CIPHER_SUITE_WEP104:
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP104\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP104\n");
+ key_type = WEP104_ENCRYPTION;
+ break;
+ case WLAN_CIPHER_SUITE_TKIP:
+ key_type = TKIP_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:TKIP\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:TKIP\n");
+ break;
+ case WLAN_CIPHER_SUITE_CCMP:
+ key_type = AESCCMP_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CCMP\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CCMP\n");
+ break;
+ case WLAN_CIPHER_SUITE_AES_CMAC:
+ /* HW don't support CMAC encryption,
+ * use software CMAC encryption
+ */
+ key_type = AESCMAC_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CMAC\n");
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "HW don't support CMAC encryption, use software CMAC encryption\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CMAC\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "HW don't support CMAC encryption, use software CMAC encryption\n");
+ err = -EOPNOTSUPP;
+ goto out_unlock;
+ default:
+@@ -1619,9 +1619,9 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ key_type == WEP104_ENCRYPTION))
+ wep_only = true;
+ rtlpriv->sec.pairwise_enc_algorithm = key_type;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set enable_hw_sec, key_type:%x(OPEN:0 WEP40:1 TKIP:2 AES:4 WEP104:5)\n",
+- key_type);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set enable_hw_sec, key_type:%x(OPEN:0 WEP40:1 TKIP:2 AES:4 WEP104:5)\n",
++ key_type);
+ rtlpriv->cfg->ops->enable_hw_sec(hw);
+ }
+ }
+@@ -1629,8 +1629,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ switch (cmd) {
+ case SET_KEY:
+ if (wep_only) {
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set WEP(group/pairwise) key\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set WEP(group/pairwise) key\n");
+ /* Pairwise key with an assigned MAC address. */
+ rtlpriv->sec.pairwise_enc_algorithm = key_type;
+ rtlpriv->sec.group_enc_algorithm = key_type;
+@@ -1640,8 +1640,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ rtlpriv->sec.key_len[key_idx] = key->keylen;
+ eth_zero_addr(mac_addr);
+ } else if (group_key) { /* group key */
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set group key\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set group key\n");
+ /* group key */
+ rtlpriv->sec.group_enc_algorithm = key_type;
+ /*set local buf about group key. */
+@@ -1650,8 +1650,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ rtlpriv->sec.key_len[key_idx] = key->keylen;
+ memcpy(mac_addr, bcast_addr, ETH_ALEN);
+ } else { /* pairwise key */
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set pairwise key\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set pairwise key\n");
+ if (!sta) {
+ WARN_ONCE(true,
+ "rtlwifi: pairwise key without mac_addr\n");
+@@ -1683,8 +1683,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
+ break;
+ case DISABLE_KEY:
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "disable key delete one entry\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "disable key delete one entry\n");
+ /*set local buf about wep key. */
+ if (vif->type == NL80211_IFTYPE_AP ||
+ vif->type == NL80211_IFTYPE_MESH_POINT) {
+@@ -1732,9 +1732,9 @@ static void rtl_op_rfkill_poll(struct ieee80211_hw *hw)
+ if (unlikely(radio_state != rtlpriv->rfkill.rfkill_state)) {
+ rtlpriv->rfkill.rfkill_state = radio_state;
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "wireless radio switch turned %s\n",
+- radio_state ? "on" : "off");
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "wireless radio switch turned %s\n",
++ radio_state ? "on" : "off");
+
+ blocked = (rtlpriv->rfkill.rfkill_state == 1) ? 0 : 1;
+ wiphy_rfkill_set_hw_state(hw->wiphy, blocked);
+@@ -1779,26 +1779,27 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+
+ do {
+ cfg_cmd = pwrcfgcmd[ary_idx];
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "rtl_hal_pwrseqcmdparsing(): offset(%#x),cut_msk(%#x), famsk(%#x), interface_msk(%#x), base(%#x), cmd(%#x), msk(%#x), value(%#x)\n",
+- GET_PWR_CFG_OFFSET(cfg_cmd),
+- GET_PWR_CFG_CUT_MASK(cfg_cmd),
+- GET_PWR_CFG_FAB_MASK(cfg_cmd),
+- GET_PWR_CFG_INTF_MASK(cfg_cmd),
+- GET_PWR_CFG_BASE(cfg_cmd), GET_PWR_CFG_CMD(cfg_cmd),
+- GET_PWR_CFG_MASK(cfg_cmd), GET_PWR_CFG_VALUE(cfg_cmd));
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s: offset(%#x),cut_msk(%#x), famsk(%#x), interface_msk(%#x), base(%#x), cmd(%#x), msk(%#x), value(%#x)\n",
++ __func__,
++ GET_PWR_CFG_OFFSET(cfg_cmd),
++ GET_PWR_CFG_CUT_MASK(cfg_cmd),
++ GET_PWR_CFG_FAB_MASK(cfg_cmd),
++ GET_PWR_CFG_INTF_MASK(cfg_cmd),
++ GET_PWR_CFG_BASE(cfg_cmd), GET_PWR_CFG_CMD(cfg_cmd),
++ GET_PWR_CFG_MASK(cfg_cmd), GET_PWR_CFG_VALUE(cfg_cmd));
+
+ if ((GET_PWR_CFG_FAB_MASK(cfg_cmd)&faversion) &&
+ (GET_PWR_CFG_CUT_MASK(cfg_cmd)&cut_version) &&
+ (GET_PWR_CFG_INTF_MASK(cfg_cmd)&interface_type)) {
+ switch (GET_PWR_CFG_CMD(cfg_cmd)) {
+ case PWR_CMD_READ:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
+ "rtl_hal_pwrseqcmdparsing(): PWR_CMD_READ\n");
+ break;
+ case PWR_CMD_WRITE:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "%s(): PWR_CMD_WRITE\n", __func__);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s(): PWR_CMD_WRITE\n", __func__);
+ offset = GET_PWR_CFG_OFFSET(cfg_cmd);
+
+ /*Read the value from system register*/
+@@ -1811,7 +1812,7 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+ rtl_write_byte(rtlpriv, offset, value);
+ break;
+ case PWR_CMD_POLLING:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
+ "rtl_hal_pwrseqcmdparsing(): PWR_CMD_POLLING\n");
+ polling_bit = false;
+ offset = GET_PWR_CFG_OFFSET(cfg_cmd);
+@@ -1832,8 +1833,8 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+ } while (!polling_bit);
+ break;
+ case PWR_CMD_DELAY:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "rtl_hal_pwrseqcmdparsing(): PWR_CMD_DELAY\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s: PWR_CMD_DELAY\n", __func__);
+ if (GET_PWR_CFG_VALUE(cfg_cmd) ==
+ PWRSEQ_DELAY_US)
+ udelay(GET_PWR_CFG_OFFSET(cfg_cmd));
+@@ -1841,8 +1842,8 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+ mdelay(GET_PWR_CFG_OFFSET(cfg_cmd));
+ break;
+ case PWR_CMD_END:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "rtl_hal_pwrseqcmdparsing(): PWR_CMD_END\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s: PWR_CMD_END\n", __func__);
+ return true;
+ default:
+ WARN_ONCE(true,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index 474439fc2da1f..6a0dfc6d4905e 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -319,8 +319,8 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp,
+
+ tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count);
+
+- if (!buffer || copy_from_user(tmp, buffer, tmp_len))
+- return count;
++ if (copy_from_user(tmp, buffer, tmp_len))
++ return -EFAULT;
+
+ tmp[tmp_len] = '\0';
+
+@@ -328,7 +328,7 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp,
+ num = sscanf(tmp, "%x %x %x", &addr, &val, &len);
+
+ if (num != 3)
+- return count;
++ return -EINVAL;
+
+ switch (len) {
+ case 1:
+@@ -416,8 +416,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+
+ tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count);
+
+- if (!buffer || copy_from_user(tmp, buffer, tmp_len))
+- return count;
++ if (copy_from_user(tmp, buffer, tmp_len))
++ return -EFAULT;
+
+ tmp[tmp_len] = '\0';
+
+@@ -425,9 +425,9 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+ &path, &addr, &bitmask, &data);
+
+ if (num != 4) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+- "Format is <path> <addr> <mask> <data>\n");
+- return count;
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
++ "Format is <path> <addr> <mask> <data>\n");
++ return -EINVAL;
+ }
+
+ rtl_set_rfreg(hw, path, addr, bitmask, data);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.h b/drivers/net/wireless/realtek/rtlwifi/debug.h
+index ad6834af618b4..14f822afc89ac 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.h
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.h
+@@ -181,6 +181,10 @@ void _rtl_dbg_print_data(struct rtl_priv *rtlpriv, u64 comp, int level,
+ const char *titlestring,
+ const void *hexdata, int hexdatalen);
+
++#define rtl_dbg(rtlpriv, comp, level, fmt, ...) \
++ _rtl_dbg_trace(rtlpriv, comp, level, \
++ fmt, ##__VA_ARGS__)
++
+ #define RT_TRACE(rtlpriv, comp, level, fmt, ...) \
+ _rtl_dbg_trace(rtlpriv, comp, level, \
+ fmt, ##__VA_ARGS__)
+@@ -197,6 +201,13 @@ void _rtl_dbg_print_data(struct rtl_priv *rtlpriv, u64 comp, int level,
+
+ struct rtl_priv;
+
++__printf(4, 5)
++static inline void rtl_dbg(struct rtl_priv *rtlpriv,
++ u64 comp, int level,
++ const char *fmt, ...)
++{
++}
++
+ __printf(4, 5)
+ static inline void RT_TRACE(struct rtl_priv *rtlpriv,
+ u64 comp, int level,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/efuse.c b/drivers/net/wireless/realtek/rtlwifi/efuse.c
+index 9729e51fce381..5d8995097ee79 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/efuse.c
++++ b/drivers/net/wireless/realtek/rtlwifi/efuse.c
+@@ -160,8 +160,8 @@ void efuse_write_1byte(struct ieee80211_hw *hw, u16 address, u8 value)
+ const u32 efuse_len =
+ rtlpriv->cfg->maps[EFUSE_REAL_CONTENT_SIZE];
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "Addr=%x Data =%x\n",
+- address, value);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "Addr=%x Data =%x\n",
++ address, value);
+
+ if (address < efuse_len) {
+ rtl_write_byte(rtlpriv, rtlpriv->cfg->maps[EFUSE_CTRL], value);
+@@ -251,9 +251,9 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
+ u8 efuse_usage;
+
+ if ((_offset + _size_byte) > rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]) {
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "read_efuse(): Invalid offset(%#x) with read bytes(%#x)!!\n",
+- _offset, _size_byte);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "%s: Invalid offset(%#x) with read bytes(%#x)!!\n",
++ __func__, _offset, _size_byte);
+ return;
+ }
+
+@@ -416,9 +416,9 @@ bool efuse_shadow_update_chk(struct ieee80211_hw *hw)
+ (EFUSE_MAX_SIZE - rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN]))
+ result = false;
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "efuse_shadow_update_chk(): totalbytes(%#x), hdr_num(%#x), words_need(%#x), efuse_used(%d)\n",
+- totalbytes, hdr_num, words_need, efuse_used);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "%s: totalbytes(%#x), hdr_num(%#x), words_need(%#x), efuse_used(%d)\n",
++ __func__, totalbytes, hdr_num, words_need, efuse_used);
+
+ return result;
+ }
+@@ -456,7 +456,7 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+ u8 word_en = 0x0F;
+ u8 first_pg = false;
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
+
+ if (!efuse_shadow_update_chk(hw)) {
+ efuse_read_all_map(hw, &rtlefuse->efuse_map[EFUSE_INIT_MAP][0]);
+@@ -464,8 +464,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+ &rtlefuse->efuse_map[EFUSE_INIT_MAP][0],
+ rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]);
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "efuse out of capacity!!\n");
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "efuse out of capacity!!\n");
+ return false;
+ }
+ efuse_power_switch(hw, true, true);
+@@ -503,8 +503,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+
+ if (!efuse_pg_packet_write(hw, (u8) offset, word_en,
+ tmpdata)) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "PG section(%#x) fail!!\n", offset);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "PG section(%#x) fail!!\n", offset);
+ break;
+ }
+ }
+@@ -518,7 +518,7 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+ &rtlefuse->efuse_map[EFUSE_INIT_MAP][0],
+ rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]);
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
+ return true;
+ }
+
+@@ -656,8 +656,8 @@ static int efuse_one_byte_write(struct ieee80211_hw *hw, u16 addr, u8 data)
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ u8 tmpidx = 0;
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "Addr = %x Data=%x\n", addr, data);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "Addr = %x Data=%x\n", addr, data);
+
+ rtl_write_byte(rtlpriv,
+ rtlpriv->cfg->maps[EFUSE_CTRL] + 1, (u8) (addr & 0xff));
+@@ -1036,8 +1036,8 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw,
+
+ if (efuse_addr >= (EFUSE_MAX_SIZE -
+ rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN])) {
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "efuse_addr(%#x) Out of size!!\n", efuse_addr);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "efuse_addr(%#x) Out of size!!\n", efuse_addr);
+ }
+
+ return true;
+@@ -1077,8 +1077,8 @@ static u8 enable_efuse_data_write(struct ieee80211_hw *hw,
+ u8 tmpdata[8];
+
+ memset(tmpdata, 0xff, PGPKT_DATA_SIZE);
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "word_en = %x efuse_addr=%x\n", word_en, efuse_addr);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "word_en = %x efuse_addr=%x\n", word_en, efuse_addr);
+
+ if (!(word_en & BIT(0))) {
+ tmpaddr = start_addr;
+@@ -1281,11 +1281,11 @@ int rtl_get_hwinfo(struct ieee80211_hw *hw, struct rtl_priv *rtlpriv,
+
+ eeprom_id = *((u16 *)&hwinfo[0]);
+ if (eeprom_id != params[0]) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "EEPROM ID(%#x) is invalid!!\n", eeprom_id);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "EEPROM ID(%#x) is invalid!!\n", eeprom_id);
+ rtlefuse->autoload_failflag = true;
+ } else {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
+ rtlefuse->autoload_failflag = false;
+ }
+
+@@ -1296,30 +1296,30 @@ int rtl_get_hwinfo(struct ieee80211_hw *hw, struct rtl_priv *rtlpriv,
+ rtlefuse->eeprom_did = *(u16 *)&hwinfo[params[2]];
+ rtlefuse->eeprom_svid = *(u16 *)&hwinfo[params[3]];
+ rtlefuse->eeprom_smid = *(u16 *)&hwinfo[params[4]];
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROMId = 0x%4x\n", eeprom_id);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROMId = 0x%4x\n", eeprom_id);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid);
+
+ for (i = 0; i < 6; i += 2) {
+ usvalue = *(u16 *)&hwinfo[params[5] + i];
+ *((u16 *)(&rtlefuse->dev_addr[i])) = usvalue;
+ }
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr);
+
+ rtlefuse->eeprom_channelplan = *&hwinfo[params[6]];
+ rtlefuse->eeprom_version = *(u16 *)&hwinfo[params[7]];
+ rtlefuse->txpwr_fromeprom = true;
+ rtlefuse->eeprom_oemid = *&hwinfo[params[8]];
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid);
+
+ /* set channel plan to world wide 13 */
+ rtlefuse->channel_plan = params[9];
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 83749578fa8b3..0d22bd300f049 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -226,8 +226,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw)
+ return;
+
+ if (pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE,
+- "PCI(Bridge) UNKNOWN\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE,
++ "PCI(Bridge) UNKNOWN\n");
+
+ return;
+ }
+@@ -276,8 +276,8 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
+ return;
+
+ if (pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE,
+- "PCI(Bridge) UNKNOWN\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE,
++ "PCI(Bridge) UNKNOWN\n");
+ return;
+ }
+
+@@ -293,10 +293,10 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
+ pci_write_config_byte(rtlpci->pdev, (num4bytes << 2),
+ u_pcibridge_aspmsetting);
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "PlatformEnableASPM(): Write reg[%x] = %x\n",
+- (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10),
+- u_pcibridge_aspmsetting);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "PlatformEnableASPM(): Write reg[%x] = %x\n",
++ (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10),
++ u_pcibridge_aspmsetting);
+
+ udelay(50);
+
+@@ -353,11 +353,11 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
+ list_for_each_entry(tpriv, &rtlpriv->glb_var->glb_priv_list,
+ list) {
+ tpcipriv = (struct rtl_pci_priv *)tpriv->priv;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "pcipriv->ndis_adapter.funcnumber %x\n",
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "pcipriv->ndis_adapter.funcnumber %x\n",
+ pcipriv->ndis_adapter.funcnumber);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "tpcipriv->ndis_adapter.funcnumber %x\n",
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "tpcipriv->ndis_adapter.funcnumber %x\n",
+ tpcipriv->ndis_adapter.funcnumber);
+
+ if (pcipriv->ndis_adapter.busnumber ==
+@@ -372,8 +372,8 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
+ }
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "find_buddy_priv %d\n", find_buddy_priv);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "find_buddy_priv %d\n", find_buddy_priv);
+
+ if (find_buddy_priv)
+ *buddy_priv = tpriv;
+@@ -410,8 +410,8 @@ static void rtl_pci_parse_configuration(struct pci_dev *pdev,
+ pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &linkctrl_reg);
+ pcipriv->ndis_adapter.linkctrl_reg = (u8)linkctrl_reg;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "Link Control Register =%x\n",
+- pcipriv->ndis_adapter.linkctrl_reg);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, "Link Control Register =%x\n",
++ pcipriv->ndis_adapter.linkctrl_reg);
+
+ pci_read_config_byte(pdev, 0x98, &tmp);
+ tmp |= BIT(4);
+@@ -579,11 +579,11 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
+ if (rtlpriv->rtlhal.earlymode_enable)
+ skb_pull(skb, EM_HDR_LEN);
+
+- RT_TRACE(rtlpriv, (COMP_INTR | COMP_SEND), DBG_TRACE,
+- "new ring->idx:%d, free: skb_queue_len:%d, free: seq:%x\n",
+- ring->idx,
+- skb_queue_len(&ring->queue),
+- *(u16 *)(skb->data + 22));
++ rtl_dbg(rtlpriv, (COMP_INTR | COMP_SEND), DBG_TRACE,
++ "new ring->idx:%d, free: skb_queue_len:%d, free: seq:%x\n",
++ ring->idx,
++ skb_queue_len(&ring->queue),
++ *(u16 *)(skb->data + 22));
+
+ if (prio == TXCMD_QUEUE) {
+ dev_kfree_skb(skb);
+@@ -630,10 +630,10 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
+ }
+
+ if ((ring->entries - skb_queue_len(&ring->queue)) <= 4) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+- "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n",
+- prio, ring->idx,
+- skb_queue_len(&ring->queue));
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
++ "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n",
++ prio, ring->idx,
++ skb_queue_len(&ring->queue));
+
+ ieee80211_wake_queue(hw, skb_get_queue_mapping(skb));
+ }
+@@ -823,9 +823,9 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ skb_reserve(skb, stats.rx_drvinfo_size +
+ stats.rx_bufshift);
+ } else {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "skb->end - skb->tail = %d, len is %d\n",
+- skb->end - skb->tail, len);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "skb->end - skb->tail = %d, len is %d\n",
++ skb->end - skb->tail, len);
+ dev_kfree_skb_any(skb);
+ goto new_trx_end;
+ }
+@@ -946,67 +946,67 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+
+ /*<1> beacon related */
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_TBDOK])
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "beacon ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "beacon ok interrupt!\n");
+
+ if (unlikely(intvec.inta & rtlpriv->cfg->maps[RTL_IMR_TBDER]))
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "beacon err interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "beacon err interrupt!\n");
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BDOK])
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, "beacon interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, "beacon interrupt!\n");
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BCNINT]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "prepare beacon for interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "prepare beacon for interrupt!\n");
+ tasklet_schedule(&rtlpriv->works.irq_prepare_bcn_tasklet);
+ }
+
+ /*<2> Tx related */
+ if (unlikely(intvec.intb & rtlpriv->cfg->maps[RTL_IMR_TXFOVW]))
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, "IMR_TXFOVW!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, "IMR_TXFOVW!\n");
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_MGNTDOK]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "Manage ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "Manage ok interrupt!\n");
+ _rtl_pci_tx_isr(hw, MGNT_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_HIGHDOK]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "HIGH_QUEUE ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "HIGH_QUEUE ok interrupt!\n");
+ _rtl_pci_tx_isr(hw, HIGH_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BKDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "BK Tx OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "BK Tx OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, BK_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BEDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "BE TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "BE TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, BE_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_VIDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "VI TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "VI TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, VI_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_VODOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "Vo TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "Vo TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, VO_QUEUE);
+ }
+
+@@ -1014,8 +1014,8 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+ if (intvec.intd & rtlpriv->cfg->maps[RTL_IMR_H2CDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "H2C TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "H2C TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, H2C_QUEUE);
+ }
+ }
+@@ -1024,34 +1024,34 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_COMDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "CMD TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "CMD TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, TXCMD_QUEUE);
+ }
+ }
+
+ /*<3> Rx related */
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_ROK]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, "Rx ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, "Rx ok interrupt!\n");
+ _rtl_pci_rx_interrupt(hw);
+ }
+
+ if (unlikely(intvec.inta & rtlpriv->cfg->maps[RTL_IMR_RDU])) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "rx descriptor unavailable!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "rx descriptor unavailable!\n");
+ _rtl_pci_rx_interrupt(hw);
+ }
+
+ if (unlikely(intvec.intb & rtlpriv->cfg->maps[RTL_IMR_RXFOVW])) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, "rx overflow !\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, "rx overflow !\n");
+ _rtl_pci_rx_interrupt(hw);
+ }
+
+ /*<4> fw related*/
+ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8723AE) {
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_C2HCMD]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "firmware interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "firmware interrupt!\n");
+ queue_delayed_work(rtlpriv->works.rtl_wq,
+ &rtlpriv->works.fwevt_wq, 0);
+ }
+@@ -1067,8 +1067,8 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+ rtlhal->hw_type == HARDWARE_TYPE_RTL8723BE) {
+ if (unlikely(intvec.inta &
+ rtlpriv->cfg->maps[RTL_IMR_HSISR_IND])) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "hsisr interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "hsisr interrupt!\n");
+ _rtl_pci_hs_interrupt(hw);
+ }
+ }
+@@ -1272,8 +1272,8 @@ static int _rtl_pci_init_tx_ring(struct ieee80211_hw *hw,
+ rtlpci->tx_ring[prio].entries = entries;
+ skb_queue_head_init(&rtlpci->tx_ring[prio].queue);
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "queue:%d, ring_addr:%p\n",
+- prio, desc);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "queue:%d, ring_addr:%p\n",
++ prio, desc);
+
+ /* init every desc in this ring */
+ if (!rtlpriv->use_new_trx_flow) {
+@@ -1670,10 +1670,10 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
+ true, HW_DESC_OWN);
+
+ if (own == 1 && hw_queue != BEACON_QUEUE) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "No more TX desc@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
+- hw_queue, ring->idx, idx,
+- skb_queue_len(&ring->queue));
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "No more TX desc@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
++ hw_queue, ring->idx, idx,
++ skb_queue_len(&ring->queue));
+
+ spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock,
+ flags);
+@@ -1683,8 +1683,8 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
+
+ if (rtlpriv->cfg->ops->get_available_desc &&
+ rtlpriv->cfg->ops->get_available_desc(hw, hw_queue) == 0) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "get_available_desc fail\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "get_available_desc fail\n");
+ spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
+ return skb->len;
+ }
+@@ -1707,8 +1707,8 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
+
+ if ((ring->entries - skb_queue_len(&ring->queue)) < 2 &&
+ hw_queue != BEACON_QUEUE) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
+- "less desc left, stop skb_queue@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD,
++ "less desc left, stop skb_queue@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
+ hw_queue, ring->idx, idx,
+ skb_queue_len(&ring->queue));
+
+@@ -1815,15 +1815,17 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
+
+ err = rtlpriv->cfg->ops->hw_init(hw);
+ if (err) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "Failed to config hardware!\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "Failed to config hardware!\n");
++ kfree(rtlpriv->btcoexist.btc_context);
++ kfree(rtlpriv->btcoexist.wifi_only_context);
+ return err;
+ }
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RETRY_LIMIT,
+ &rtlmac->retry_long);
+
+ rtlpriv->cfg->ops->enable_interrupt(hw);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "enable_interrupt OK\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "enable_interrupt OK\n");
+
+ rtl_init_rx_config(hw);
+
+@@ -1834,7 +1836,7 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
+
+ rtlpci->up_first_time = false;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%s OK\n", __func__);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%s OK\n", __func__);
+ return 0;
+ }
+
+@@ -1928,71 +1930,71 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ deviceid == RTL_PCI_8171_DID) {
+ switch (revisionid) {
+ case RTL_PCI_REVISION_ID_8192PCIE:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192 PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192 PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192E;
+ return false;
+ case RTL_PCI_REVISION_ID_8192SE:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192SE is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192SE is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192SE;
+ break;
+ default:
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "Err: Unknown device - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "Err: Unknown device - vid/did=%x/%x\n",
++ venderid, deviceid);
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192SE;
+ break;
+ }
+ } else if (deviceid == RTL_PCI_8723AE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8723AE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8723AE PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8723AE PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ } else if (deviceid == RTL_PCI_8192CET_DID ||
+ deviceid == RTL_PCI_8192CE_DID ||
+ deviceid == RTL_PCI_8191CE_DID ||
+ deviceid == RTL_PCI_8188CE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192CE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192C PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192C PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ } else if (deviceid == RTL_PCI_8192DE_DID ||
+ deviceid == RTL_PCI_8192DE_DID2) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192DE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192D PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192D PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ } else if (deviceid == RTL_PCI_8188EE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8188EE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8188EE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8188EE\n");
+ } else if (deviceid == RTL_PCI_8723BE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8723BE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8723BE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8723BE\n");
+ } else if (deviceid == RTL_PCI_8192EE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192EE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8192EE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8192EE\n");
+ } else if (deviceid == RTL_PCI_8821AE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8821AE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8821AE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8821AE\n");
+ } else if (deviceid == RTL_PCI_8812AE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8812AE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8812AE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8812AE\n");
+ } else if (deviceid == RTL_PCI_8822BE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8822BE;
+ rtlhal->bandset = BAND_ON_BOTH;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8822BE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8822BE\n");
+ } else {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "Err: Unknown device - vid/did=%x/%x\n",
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "Err: Unknown device - vid/did=%x/%x\n",
+ venderid, deviceid);
+
+ rtlhal->hw_type = RTL_DEFAULT_HARDWARE_TYPE;
+@@ -2001,17 +2003,17 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192DE) {
+ if (revisionid == 0 || revisionid == 1) {
+ if (revisionid == 0) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find 92DE MAC0\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find 92DE MAC0\n");
+ rtlhal->interfaceindex = 0;
+ } else if (revisionid == 1) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find 92DE MAC1\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find 92DE MAC1\n");
+ rtlhal->interfaceindex = 1;
+ }
+ } else {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Unknown device - VendorID/DeviceID=%x/%x, Revision=%x\n",
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Unknown device - VendorID/DeviceID=%x/%x, Revision=%x\n",
+ venderid, deviceid, revisionid);
+ rtlhal->interfaceindex = 0;
+ }
+@@ -2045,9 +2047,9 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) {
+ if (bridge_pdev->vendor == pcibridge_vendors[tmp]) {
+ pcipriv->ndis_adapter.pcibridge_vendor = tmp;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "Pci Bridge Vendor is found index: %d\n",
+- tmp);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "Pci Bridge Vendor is found index: %d\n",
++ tmp);
+ break;
+ }
+ }
+@@ -2075,22 +2077,22 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ }
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "pcidev busnumber:devnumber:funcnumber:vendor:link_ctl %d:%d:%d:%x:%x\n",
+- pcipriv->ndis_adapter.busnumber,
+- pcipriv->ndis_adapter.devnumber,
+- pcipriv->ndis_adapter.funcnumber,
+- pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "pcidev busnumber:devnumber:funcnumber:vendor:link_ctl %d:%d:%d:%x:%x\n",
++ pcipriv->ndis_adapter.busnumber,
++ pcipriv->ndis_adapter.devnumber,
++ pcipriv->ndis_adapter.funcnumber,
++ pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg);
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n",
+- pcipriv->ndis_adapter.pcibridge_busnum,
+- pcipriv->ndis_adapter.pcibridge_devnum,
+- pcipriv->ndis_adapter.pcibridge_funcnum,
+- pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor],
+- pcipriv->ndis_adapter.pcibridge_pciehdr_offset,
+- pcipriv->ndis_adapter.pcibridge_linkctrlreg,
+- pcipriv->ndis_adapter.amd_l1_patch);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n",
++ pcipriv->ndis_adapter.pcibridge_busnum,
++ pcipriv->ndis_adapter.pcibridge_devnum,
++ pcipriv->ndis_adapter.pcibridge_funcnum,
++ pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor],
++ pcipriv->ndis_adapter.pcibridge_pciehdr_offset,
++ pcipriv->ndis_adapter.pcibridge_linkctrlreg,
++ pcipriv->ndis_adapter.amd_l1_patch);
+
+ rtl_pci_parse_configuration(pdev, hw);
+ list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list);
+@@ -2118,8 +2120,8 @@ static int rtl_pci_intr_mode_msi(struct ieee80211_hw *hw)
+
+ rtlpci->using_msi = true;
+
+- RT_TRACE(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
+- "MSI Interrupt Mode!\n");
++ rtl_dbg(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
++ "MSI Interrupt Mode!\n");
+ return 0;
+ }
+
+@@ -2136,8 +2138,8 @@ static int rtl_pci_intr_mode_legacy(struct ieee80211_hw *hw)
+ return ret;
+
+ rtlpci->using_msi = false;
+- RT_TRACE(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
+- "Pin-based Interrupt Mode!\n");
++ rtl_dbg(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
++ "Pin-based Interrupt Mode!\n");
+ return 0;
+ }
+
+@@ -2264,10 +2266,10 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ goto fail2;
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "mem mapped space: start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n",
+- pmem_start, pmem_len, pmem_flags,
+- rtlpriv->io.pci_mem_start);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "mem mapped space: start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n",
++ pmem_start, pmem_len, pmem_flags,
++ rtlpriv->io.pci_mem_start);
+
+ /* Disable Clk Request */
+ pci_write_config_byte(pdev, 0x81, 0);
+@@ -2329,9 +2331,9 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ rtlpci = rtl_pcidev(pcipriv);
+ err = rtl_pci_intr_mode_decide(hw);
+ if (err) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "%s: failed to register IRQ handler\n",
+- wiphy_name(hw->wiphy));
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "%s: failed to register IRQ handler\n",
++ wiphy_name(hw->wiphy));
+ goto fail3;
+ }
+ rtlpci->irq_alloc = 1;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
+index 5f998ea2d5a67..102f0d0e1cd01 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
+@@ -41,8 +41,8 @@ bool rtl_ps_enable_nic(struct ieee80211_hw *hw)
+ rtlpriv->intf_ops->reset_trx_ring(hw);
+
+ if (is_hal_stop(rtlhal))
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "Driver is already down!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "Driver is already down!\n");
+
+ /*<2> Enable Adapter */
+ if (rtlpriv->cfg->ops->hw_init(hw))
+@@ -103,9 +103,9 @@ static bool rtl_ps_set_rf_state(struct ieee80211_hw *hw,
+ if (ppsc->rfchange_inprogress) {
+ spin_unlock(&rtlpriv->locks.rf_ps_lock);
+
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "RF Change in progress! Wait to set..state_toset(%d).\n",
+- state_toset);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "RF Change in progress! Wait to set..state_toset(%d).\n",
++ state_toset);
+
+ /* Set RF after the previous action is done. */
+ while (ppsc->rfchange_inprogress) {
+@@ -217,8 +217,8 @@ void rtl_ips_nic_off_wq_callback(void *data)
+ enum rf_pwrstate rtstate;
+
+ if (mac->opmode != NL80211_IFTYPE_STATION) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "not station return\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "not station return\n");
+ return;
+ }
+
+@@ -254,8 +254,8 @@ void rtl_ips_nic_off_wq_callback(void *data)
+ !ppsc->swrf_processing &&
+ (mac->link_state == MAC80211_NOLINK) &&
+ !mac->act_scanning) {
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+- "IPSEnter(): Turn off RF\n");
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
++ "IPSEnter(): Turn off RF\n");
+
+ ppsc->inactive_pwrstate = ERFOFF;
+ ppsc->in_powersavemode = true;
+@@ -333,8 +333,8 @@ static bool rtl_get_fwlps_doze(struct ieee80211_hw *hw)
+ ppsc->last_delaylps_stamp_jiffies);
+
+ if (ps_timediff < 2000) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Delay enter Fw LPS for DHCP, ARP, or EAPOL exchanging state\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Delay enter Fw LPS for DHCP, ARP, or EAPOL exchanging state\n");
+ return false;
+ }
+
+@@ -379,9 +379,9 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode)
+
+ if ((ppsc->fwctrl_lps) && ppsc->report_linked) {
+ if (ppsc->dot11_psmode == EACTIVE) {
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "FW LPS leave ps_mode:%x\n",
+- FW_PS_ACTIVE_MODE);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "FW LPS leave ps_mode:%x\n",
++ FW_PS_ACTIVE_MODE);
+ enter_fwlps = false;
+ ppsc->pwr_mode = FW_PS_ACTIVE_MODE;
+ ppsc->smart_ps = 0;
+@@ -394,9 +394,9 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode)
+ rtlpriv->btcoexist.btc_ops->btc_lps_notify(rtlpriv, rt_psmode);
+ } else {
+ if (rtl_get_fwlps_doze(hw)) {
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "FW LPS enter ps_mode:%x\n",
+- ppsc->fwctrl_psmode);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "FW LPS enter ps_mode:%x\n",
++ ppsc->fwctrl_psmode);
+ if (rtlpriv->cfg->ops->get_btc_status())
+ rtlpriv->btcoexist.btc_ops->btc_lps_notify(rtlpriv, rt_psmode);
+ enter_fwlps = true;
+@@ -446,8 +446,8 @@ static void rtl_lps_enter_core(struct ieee80211_hw *hw)
+ * bt_ccoexist may ask to enter lps.
+ * In normal case, this constraint move to rtl_lps_set_psmode().
+ */
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Enter 802.11 power save mode...\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Enter 802.11 power save mode...\n");
+ rtl_lps_set_psmode(hw, EAUTOPS);
+
+ mutex_unlock(&rtlpriv->locks.lps_mutex);
+@@ -475,8 +475,8 @@ static void rtl_lps_leave_core(struct ieee80211_hw *hw)
+ RT_CLEAR_PS_LEVEL(ppsc, RT_PS_LEVEL_ASPM);
+ }
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Busy Traffic,Leave 802.11 power save..\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Busy Traffic,Leave 802.11 power save..\n");
+
+ rtl_lps_set_psmode(hw, EACTIVE);
+ }
+@@ -560,8 +560,8 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
+ queue_delayed_work(rtlpriv->works.rtl_wq,
+ &rtlpriv->works.ps_work, MSECS(5));
+ } else {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG,
+- "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG,
++ "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
+ }
+ }
+ EXPORT_SYMBOL_GPL(rtl_swlps_beacon);
+@@ -656,9 +656,9 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw)
+ /* this print should always be dtim_conter = 0 &
+ * sleep = dtim_period, that meaons, we should
+ * awake before every dtim */
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG,
+- "dtim_counter:%x will sleep :%d beacon_intv\n",
+- rtlpriv->psc.dtim_counter, sleep_intv);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG,
++ "dtim_counter:%x will sleep :%d beacon_intv\n",
++ rtlpriv->psc.dtim_counter, sleep_intv);
+
+ /* we tested that 40ms is enough for sw & hw sw delay */
+ queue_delayed_work(rtlpriv->works.rtl_wq, &rtlpriv->works.ps_rfon_wq,
+@@ -769,9 +769,9 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
+ if (ie[0] == 12) {
+ find_p2p_ps_ie = true;
+ if ((noa_len - 2) % 13 != 0) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "P2P notice of absence: invalid length.%d\n",
+- noa_len);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "P2P notice of absence: invalid length.%d\n",
++ noa_len);
+ return;
+ } else {
+ noa_num = (noa_len - 2) / 13;
+@@ -782,8 +782,8 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
+ noa_index = ie[3];
+ if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
+ P2P_PS_NONE || noa_index != p2pinfo->noa_index) {
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "update NOA ie.\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "update NOA ie.\n");
+ p2pinfo->noa_index = noa_index;
+ p2pinfo->opp_ps = (ie[4] >> 7);
+ p2pinfo->ctwindow = ie[4] & 0x7F;
+@@ -854,7 +854,7 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
+ if (ie == NULL)
+ return;
+
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n");
+ /*to find noa ie*/
+ while (ie + 1 < end) {
+ noa_len = READEF2BYTE((__le16 *)&ie[1]);
+@@ -862,13 +862,13 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
+ return;
+
+ if (ie[0] == 12) {
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "find NOA IE.\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "find NOA IE.\n");
+ RT_PRINT_DATA(rtlpriv, COMP_FW, DBG_LOUD, "noa ie ",
+ ie, noa_len);
+ if ((noa_len - 2) % 13 != 0) {
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "P2P notice of absence: invalid length.%d\n",
+- noa_len);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "P2P notice of absence: invalid length.%d\n",
++ noa_len);
+ return;
+ } else {
+ noa_num = (noa_len - 2) / 13;
+@@ -926,7 +926,7 @@ void rtl_p2p_ps_cmd(struct ieee80211_hw *hw , u8 p2p_ps_state)
+ struct rtl_ps_ctl *rtlps = rtl_psc(rtl_priv(hw));
+ struct rtl_p2p_ps_info *p2pinfo = &(rtlpriv->psc.p2p_ps_info);
+
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, " p2p state %x\n" , p2p_ps_state);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, " p2p state %x\n", p2p_ps_state);
+ switch (p2p_ps_state) {
+ case P2P_PS_DISABLE:
+ p2pinfo->p2p_ps_state = p2p_ps_state;
+@@ -978,18 +978,18 @@ void rtl_p2p_ps_cmd(struct ieee80211_hw *hw , u8 p2p_ps_state)
+ default:
+ break;
+ }
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "ctwindow %x oppps %x\n",
+- p2pinfo->ctwindow , p2pinfo->opp_ps);
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "count %x duration %x index %x interval %x start time %x noa num %x\n",
+- p2pinfo->noa_count_type[0],
+- p2pinfo->noa_duration[0],
+- p2pinfo->noa_index,
+- p2pinfo->noa_interval[0],
+- p2pinfo->noa_start_time[0],
+- p2pinfo->noa_num);
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "end\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "ctwindow %x oppps %x\n",
++ p2pinfo->ctwindow, p2pinfo->opp_ps);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "count %x duration %x index %x interval %x start time %x noa num %x\n",
++ p2pinfo->noa_count_type[0],
++ p2pinfo->noa_duration[0],
++ p2pinfo->noa_index,
++ p2pinfo->noa_interval[0],
++ p2pinfo->noa_start_time[0],
++ p2pinfo->noa_num);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "end\n");
+ }
+
+ void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/regd.c b/drivers/net/wireless/realtek/rtlwifi/regd.c
+index 72ca370331fb4..f89f60ddfebe0 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/regd.c
++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c
+@@ -434,13 +434,13 @@ int rtl_regd_init(struct ieee80211_hw *hw,
+ rtlpriv->regd.country_code =
+ channel_plan_to_country_code(rtlpriv->efuse.channel_plan);
+
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_DMESG,
+- "rtl: EEPROM regdomain: 0x%0x country code: %d\n",
+- rtlpriv->efuse.channel_plan, rtlpriv->regd.country_code);
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_DMESG,
++ "rtl: EEPROM regdomain: 0x%0x country code: %d\n",
++ rtlpriv->efuse.channel_plan, rtlpriv->regd.country_code);
+
+ if (rtlpriv->regd.country_code >= COUNTRY_CODE_MAX) {
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_DMESG,
+- "rtl: EEPROM indicates invalid country code, world wide 13 should be used\n");
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_DMESG,
++ "rtl: EEPROM indicates invalid country code, world wide 13 should be used\n");
+
+ rtlpriv->regd.country_code = COUNTRY_CODE_WORLD_WIDE_13;
+ }
+@@ -455,9 +455,9 @@ int rtl_regd_init(struct ieee80211_hw *hw,
+ rtlpriv->regd.alpha2[1] = '0';
+ }
+
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_TRACE,
+- "rtl: Country alpha2 being used: %c%c\n",
+- rtlpriv->regd.alpha2[0], rtlpriv->regd.alpha2[1]);
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_TRACE,
++ "rtl: Country alpha2 being used: %c%c\n",
++ rtlpriv->regd.alpha2[0], rtlpriv->regd.alpha2[1]);
+
+ _rtl_regd_init_wiphy(&rtlpriv->regd, wiphy, reg_notifier);
+
+@@ -469,7 +469,7 @@ void rtl_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
+ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_LOUD, "\n");
+
+ _rtl_reg_notifier_apply(wiphy, request, &rtlpriv->regd);
+ }
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 395671383ca93..35ebbd8ca9caf 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -282,14 +282,14 @@ static int _rtl_usb_init_tx(struct ieee80211_hw *hw)
+ ? USB_HIGH_SPEED_BULK_SIZE
+ : USB_FULL_SPEED_BULK_SIZE;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "USB Max Bulk-out Size=%d\n",
+- rtlusb->max_bulk_out_size);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "USB Max Bulk-out Size=%d\n",
++ rtlusb->max_bulk_out_size);
+
+ for (i = 0; i < __RTL_TXQ_NUM; i++) {
+ u32 ep_num = rtlusb->ep_map.ep_mapping[i];
+ if (!ep_num) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "Invalid endpoint map setting!\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "Invalid endpoint map setting!\n");
+ return -EINVAL;
+ }
+ }
+@@ -358,10 +358,10 @@ static int _rtl_usb_init(struct ieee80211_hw *hw)
+ else if (usb_endpoint_dir_out(pep_desc))
+ rtlusb->out_ep_nums++;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n",
+- pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize,
+- pep_desc->bInterval);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n",
++ pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize,
++ pep_desc->bInterval);
+ }
+ if (rtlusb->in_ep_nums < rtlpriv->cfg->usb_interface_cfg->in_ep_num) {
+ pr_err("Too few input end points found\n");
+@@ -960,7 +960,7 @@ static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw,
+
+ memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
+ if (ieee80211_is_auth(fc)) {
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
+ }
+
+ if (rtlpriv->psc.sw_ps_enabled) {
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index 258742830e366..566d8af05157d 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -258,12 +258,15 @@ int of_device_request_module(struct device *dev)
+ if (size < 0)
+ return size;
+
+- str = kmalloc(size + 1, GFP_KERNEL);
++ /* Reserve an additional byte for the trailing '\0' */
++ size++;
++
++ str = kmalloc(size, GFP_KERNEL);
+ if (!str)
+ return -ENOMEM;
+
+ of_device_get_modalias(dev, str, size);
+- str[size] = '\0';
++ str[size - 1] = '\0';
+ ret = request_module(str);
+ kfree(str);
+
+diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
+index ef60718070728..522719ca1c2b0 100644
+--- a/drivers/pci/hotplug/pciehp.h
++++ b/drivers/pci/hotplug/pciehp.h
+@@ -84,6 +84,8 @@ struct slot {
+ * @reset_lock: prevents access to the Data Link Layer Link Active bit in the
+ * Link Status register and to the Presence Detect State bit in the Slot
+ * Status register during a slot reset which may cause them to flap
++ * @depth: Number of additional hotplug ports in the path to the root bus,
++ * used as lock subclass for @reset_lock
+ * @slot: pointer to the controller's slot structure
+ * @queue: wait queue to wake up on reception of a Command Completed event,
+ * used for synchronous writes to the Slot Control register
+@@ -115,6 +117,7 @@ struct controller {
+ struct mutex ctrl_lock;
+ struct pcie_device *pcie;
+ struct rw_semaphore reset_lock;
++ unsigned int depth;
+ struct slot *slot;
+ wait_queue_head_t queue;
+ u32 slot_cap;
+diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
+index 518c46f8e63b7..5ebfff9356c7f 100644
+--- a/drivers/pci/hotplug/pciehp_core.c
++++ b/drivers/pci/hotplug/pciehp_core.c
+@@ -215,7 +215,7 @@ static void pciehp_check_presence(struct controller *ctrl)
+ struct slot *slot = ctrl->slot;
+ u8 occupied;
+
+- down_read(&ctrl->reset_lock);
++ down_read_nested(&ctrl->reset_lock, ctrl->depth);
+ mutex_lock(&slot->lock);
+
+ pciehp_get_adapter_status(slot, &occupied);
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 2795445233b3b..7392b26e9f158 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -674,7 +674,7 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
+ * Disable requests have higher priority than Presence Detect Changed
+ * or Data Link Layer State Changed events.
+ */
+- down_read(&ctrl->reset_lock);
++ down_read_nested(&ctrl->reset_lock, ctrl->depth);
+ if (events & DISABLE_SLOT)
+ pciehp_handle_disable_request(slot);
+ else if (events & (PCI_EXP_SLTSTA_PDC | PCI_EXP_SLTSTA_DLLSC))
+@@ -785,7 +785,7 @@ int pciehp_reset_slot(struct slot *slot, int probe)
+ if (probe)
+ return 0;
+
+- down_write(&ctrl->reset_lock);
++ down_write_nested(&ctrl->reset_lock, ctrl->depth);
+
+ if (!ATTN_BUTTN(ctrl)) {
+ ctrl_mask |= PCI_EXP_SLTCTL_PDCE;
+@@ -872,6 +872,20 @@ static inline void dbg_ctrl(struct controller *ctrl)
+
+ #define FLAG(x, y) (((x) & (y)) ? '+' : '-')
+
++static inline int pcie_hotplug_depth(struct pci_dev *dev)
++{
++ struct pci_bus *bus = dev->bus;
++ int depth = 0;
++
++ while (bus->parent) {
++ bus = bus->parent;
++ if (bus->self && bus->self->is_hotplug_bridge)
++ depth++;
++ }
++
++ return depth;
++}
++
+ struct controller *pcie_init(struct pcie_device *dev)
+ {
+ struct controller *ctrl;
+@@ -884,6 +898,7 @@ struct controller *pcie_init(struct pcie_device *dev)
+ goto abort;
+
+ ctrl->pcie = dev;
++ ctrl->depth = pcie_hotplug_depth(dev->port);
+ pcie_capability_read_dword(pdev, PCI_EXP_SLTCAP, &slot_cap);
+
+ if (pdev->hotplug_user_indicators)
+diff --git a/drivers/pci/hotplug/pciehp_pci.c b/drivers/pci/hotplug/pciehp_pci.c
+index 5c58c22e0c084..a32023afa25bc 100644
+--- a/drivers/pci/hotplug/pciehp_pci.c
++++ b/drivers/pci/hotplug/pciehp_pci.c
+@@ -55,7 +55,14 @@ int pciehp_configure_device(struct slot *p_slot)
+
+ pci_assign_unassigned_bridge_resources(bridge);
+ pcie_bus_configure_settings(parent);
++
++ /*
++ * Release reset_lock during driver binding
++ * to avoid AB-BA deadlock with device_lock.
++ */
++ up_read(&ctrl->reset_lock);
+ pci_bus_add_devices(parent);
++ down_read_nested(&ctrl->reset_lock, ctrl->depth);
+
+ out:
+ pci_unlock_rescan_remove();
+@@ -91,7 +98,15 @@ void pciehp_unconfigure_device(struct slot *p_slot)
+ pci_walk_bus(dev->subordinate,
+ pci_dev_set_disconnected, NULL);
+ }
++
++ /*
++ * Release reset_lock during driver unbinding
++ * to avoid AB-BA deadlock with device_lock.
++ */
++ up_read(&ctrl->reset_lock);
+ pci_stop_and_remove_bus_device(dev);
++ down_read_nested(&ctrl->reset_lock, ctrl->depth);
++
+ /*
+ * Ensure that no new Requests will be generated from
+ * the device.
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index 39c01ef57d83c..17211b31e1ed4 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -583,6 +583,7 @@ static int tegra_xusb_add_usb2_port(struct tegra_xusb_padctl *padctl,
+ usb2->base.lane = usb2->base.ops->map(&usb2->base);
+ if (IS_ERR(usb2->base.lane)) {
+ err = PTR_ERR(usb2->base.lane);
++ tegra_xusb_port_unregister(&usb2->base);
+ goto out;
+ }
+
+@@ -635,6 +636,7 @@ static int tegra_xusb_add_ulpi_port(struct tegra_xusb_padctl *padctl,
+ ulpi->base.lane = ulpi->base.ops->map(&ulpi->base);
+ if (IS_ERR(ulpi->base.lane)) {
+ err = PTR_ERR(ulpi->base.lane);
++ tegra_xusb_port_unregister(&ulpi->base);
+ goto out;
+ }
+
+diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
+index f122a0263a1ba..e26e2279ba6c3 100644
+--- a/drivers/platform/x86/touchscreen_dmi.c
++++ b/drivers/platform/x86/touchscreen_dmi.c
+@@ -147,6 +147,22 @@ static const struct ts_dmi_data dexp_ursus_7w_data = {
+ .properties = dexp_ursus_7w_props,
+ };
+
++static const struct property_entry dexp_ursus_kx210i_props[] = {
++ PROPERTY_ENTRY_U32("touchscreen-min-x", 5),
++ PROPERTY_ENTRY_U32("touchscreen-min-y", 2),
++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1720),
++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1137),
++ PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-dexp-ursus-kx210i.fw"),
++ PROPERTY_ENTRY_U32("silead,max-fingers", 10),
++ PROPERTY_ENTRY_BOOL("silead,home-button"),
++ { }
++};
++
++static const struct ts_dmi_data dexp_ursus_kx210i_data = {
++ .acpi_name = "MSSL1680:00",
++ .properties = dexp_ursus_kx210i_props,
++};
++
+ static const struct property_entry digma_citi_e200_props[] = {
+ PROPERTY_ENTRY_U32("touchscreen-size-x", 1980),
+ PROPERTY_ENTRY_U32("touchscreen-size-y", 1500),
+@@ -502,6 +518,14 @@ static const struct dmi_system_id touchscreen_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "7W"),
+ },
+ },
++ {
++ /* DEXP Ursus KX210i */
++ .driver_data = (void *)&dexp_ursus_kx210i_data,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "INSYDE Corp."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "S107I"),
++ },
++ },
+ {
+ /* Digma Citi E200 */
+ .driver_data = (void *)&digma_citi_e200_data,
+diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c
+index 97b0e873e87d2..c2d6378bb897d 100644
+--- a/drivers/power/supply/generic-adc-battery.c
++++ b/drivers/power/supply/generic-adc-battery.c
+@@ -138,6 +138,9 @@ static int read_channel(struct gab *adc_bat, enum power_supply_property psp,
+ result);
+ if (ret < 0)
+ pr_err("read channel error\n");
++ else
++ *result *= 1000;
++
+ return ret;
+ }
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index e247ab632530b..90aba3091b236 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -425,7 +425,7 @@ static const struct meson_pwm_data pwm_axg_ee_data = {
+ };
+
+ static const char * const pwm_axg_ao_parent_names[] = {
+- "aoclk81", "xtal", "fclk_div4", "fclk_div5"
++ "xtal", "axg_ao_clk81", "fclk_div4", "fclk_div5"
+ };
+
+ static const struct meson_pwm_data pwm_axg_ao_data = {
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index 893940d45f0d0..c49b1e696b8c4 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -82,6 +82,19 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ u64 div, rate;
+ int err;
+
++ err = clk_prepare_enable(mdp->clk_main);
++ if (err < 0) {
++ dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err));
++ return err;
++ }
++
++ err = clk_prepare_enable(mdp->clk_mm);
++ if (err < 0) {
++ dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err));
++ clk_disable_unprepare(mdp->clk_main);
++ return err;
++ }
++
+ /*
+ * Find period, high_width and clk_div to suit duty_ns and period_ns.
+ * Calculate proper div value to keep period value in the bound.
+@@ -95,8 +108,11 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ rate = clk_get_rate(mdp->clk_main);
+ clk_div = div_u64(rate * period_ns, NSEC_PER_SEC) >>
+ PWM_PERIOD_BIT_WIDTH;
+- if (clk_div > PWM_CLKDIV_MAX)
++ if (clk_div > PWM_CLKDIV_MAX) {
++ clk_disable_unprepare(mdp->clk_mm);
++ clk_disable_unprepare(mdp->clk_main);
+ return -EINVAL;
++ }
+
+ div = NSEC_PER_SEC * (clk_div + 1);
+ period = div64_u64(rate * period_ns, div);
+@@ -106,14 +122,17 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ high_width = div64_u64(rate * duty_ns, div);
+ value = period | (high_width << PWM_HIGH_WIDTH_SHIFT);
+
+- err = clk_enable(mdp->clk_main);
+- if (err < 0)
+- return err;
+-
+- err = clk_enable(mdp->clk_mm);
+- if (err < 0) {
+- clk_disable(mdp->clk_main);
+- return err;
++ if (mdp->data->bls_debug && !mdp->data->has_commit) {
++ /*
++ * For MT2701, disable double buffer before writing register
++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
++ */
++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
++ mdp->data->bls_debug_mask,
++ mdp->data->bls_debug_mask);
++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
++ mdp->data->con0_sel,
++ mdp->data->con0_sel);
+ }
+
+ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+@@ -132,8 +151,8 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ 0x0);
+ }
+
+- clk_disable(mdp->clk_mm);
+- clk_disable(mdp->clk_main);
++ clk_disable_unprepare(mdp->clk_mm);
++ clk_disable_unprepare(mdp->clk_main);
+
+ return 0;
+ }
+@@ -143,13 +162,16 @@ static int mtk_disp_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+ struct mtk_disp_pwm *mdp = to_mtk_disp_pwm(chip);
+ int err;
+
+- err = clk_enable(mdp->clk_main);
+- if (err < 0)
++ err = clk_prepare_enable(mdp->clk_main);
++ if (err < 0) {
++ dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err));
+ return err;
++ }
+
+- err = clk_enable(mdp->clk_mm);
++ err = clk_prepare_enable(mdp->clk_mm);
+ if (err < 0) {
+- clk_disable(mdp->clk_main);
++ dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err));
++ clk_disable_unprepare(mdp->clk_main);
+ return err;
+ }
+
+@@ -166,8 +188,8 @@ static void mtk_disp_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask,
+ 0x0);
+
+- clk_disable(mdp->clk_mm);
+- clk_disable(mdp->clk_main);
++ clk_disable_unprepare(mdp->clk_mm);
++ clk_disable_unprepare(mdp->clk_main);
+ }
+
+ static const struct pwm_ops mtk_disp_pwm_ops = {
+@@ -202,14 +224,6 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev)
+ if (IS_ERR(mdp->clk_mm))
+ return PTR_ERR(mdp->clk_mm);
+
+- ret = clk_prepare(mdp->clk_main);
+- if (ret < 0)
+- return ret;
+-
+- ret = clk_prepare(mdp->clk_mm);
+- if (ret < 0)
+- goto disable_clk_main;
+-
+ mdp->chip.dev = &pdev->dev;
+ mdp->chip.ops = &mtk_disp_pwm_ops;
+ mdp->chip.base = -1;
+@@ -217,44 +231,22 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev)
+
+ ret = pwmchip_add(&mdp->chip);
+ if (ret < 0) {
+- dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret);
+- goto disable_clk_mm;
++ dev_err(&pdev->dev, "pwmchip_add() failed: %pe\n", ERR_PTR(ret));
++ return ret;
+ }
+
+ platform_set_drvdata(pdev, mdp);
+
+- /*
+- * For MT2701, disable double buffer before writing register
+- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
+- */
+- if (!mdp->data->has_commit) {
+- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
+- mdp->data->bls_debug_mask,
+- mdp->data->bls_debug_mask);
+- mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+- mdp->data->con0_sel,
+- mdp->data->con0_sel);
+- }
+-
+ return 0;
+-
+-disable_clk_mm:
+- clk_unprepare(mdp->clk_mm);
+-disable_clk_main:
+- clk_unprepare(mdp->clk_main);
+- return ret;
+ }
+
+ static int mtk_disp_pwm_remove(struct platform_device *pdev)
+ {
+ struct mtk_disp_pwm *mdp = platform_get_drvdata(pdev);
+- int ret;
+
+- ret = pwmchip_remove(&mdp->chip);
+- clk_unprepare(mdp->clk_mm);
+- clk_unprepare(mdp->clk_main);
++ pwmchip_remove(&mdp->chip);
+
+- return ret;
++ return 0;
+ }
+
+ static const struct mtk_pwm_data mt2701_pwm_data = {
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index 7beda20cf1221..c1cf277d0d89a 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -2841,7 +2841,7 @@ static int _dasd_requeue_request(struct dasd_ccw_req *cqr)
+ return 0;
+ spin_lock_irq(&cqr->dq->lock);
+ req = (struct request *) cqr->callback_data;
+- blk_mq_requeue_request(req, false);
++ blk_mq_requeue_request(req, true);
+ spin_unlock_irq(&cqr->dq->lock);
+
+ return 0;
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index 7352d46ebb093..44d648baabd87 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -1444,6 +1444,7 @@ mega_cmd_done(adapter_t *adapter, u8 completed[], int nstatus, int status)
+ */
+ if (cmdid == CMDID_INT_CMDS) {
+ scb = &adapter->int_scb;
++ cmd = scb->cmd;
+
+ list_del_init(&scb->list);
+ scb->state = SCB_FREE;
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index cd784552de7f1..479d10dc6cb84 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -205,8 +205,8 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs,
+ struct spi_device *spi,
+ int bits_per_word)
+ {
+- /* QE uses Little Endian for words > 8
+- * so transform all words > 8 into 8 bits
++ /* CPM/QE uses Little Endian for words > 8
++ * so transform 16 and 32 bits words into 8 bits
+ * Unfortnatly that doesn't work for LSB so
+ * reject these for now */
+ /* Note: 32 bits word, LSB works iff
+@@ -214,9 +214,11 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs,
+ if (spi->mode & SPI_LSB_FIRST &&
+ bits_per_word > 8)
+ return -EINVAL;
+- if (bits_per_word > 8)
++ if (bits_per_word <= 8)
++ return bits_per_word;
++ if (bits_per_word == 16 || bits_per_word == 32)
+ return 8; /* pretend its 8 bits */
+- return bits_per_word;
++ return -EINVAL;
+ }
+
+ static int fsl_spi_setup_transfer(struct spi_device *spi,
+@@ -246,7 +248,7 @@ static int fsl_spi_setup_transfer(struct spi_device *spi,
+ bits_per_word = mspi_apply_cpu_mode_quirks(cs, spi,
+ mpc8xxx_spi,
+ bits_per_word);
+- else if (mpc8xxx_spi->flags & SPI_QE)
++ else
+ bits_per_word = mspi_apply_qe_mode_quirks(cs, spi,
+ bits_per_word);
+
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index 1ca678bcb5279..defe959884dae 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1250,17 +1250,21 @@ static int spi_qup_remove(struct platform_device *pdev)
+ int ret;
+
+ ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0)
+- return ret;
+
+- ret = spi_qup_set_state(controller, QUP_STATE_RESET);
+- if (ret)
+- return ret;
++ if (ret >= 0) {
++ ret = spi_qup_set_state(controller, QUP_STATE_RESET);
++ if (ret)
++ dev_warn(&pdev->dev, "failed to reset controller (%pe)\n",
++ ERR_PTR(ret));
+
+- spi_qup_release_dma(master);
++ clk_disable_unprepare(controller->cclk);
++ clk_disable_unprepare(controller->iclk);
++ } else {
++ dev_warn(&pdev->dev, "failed to resume, skip hw disable (%pe)\n",
++ ERR_PTR(ret));
++ }
+
+- clk_disable_unprepare(controller->cclk);
+- clk_disable_unprepare(controller->iclk);
++ spi_qup_release_dma(master);
+
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c
+index aa3edabc2b0fe..55f1cad836ba2 100644
+--- a/drivers/spmi/spmi.c
++++ b/drivers/spmi/spmi.c
+@@ -356,7 +356,8 @@ static int spmi_drv_remove(struct device *dev)
+ const struct spmi_driver *sdrv = to_spmi_driver(dev->driver);
+
+ pm_runtime_get_sync(dev);
+- sdrv->remove(to_spmi_device(dev));
++ if (sdrv->remove)
++ sdrv->remove(to_spmi_device(dev));
+ pm_runtime_put_noidle(dev);
+
+ pm_runtime_disable(dev);
+diff --git a/drivers/staging/iio/resolver/ad2s1210.c b/drivers/staging/iio/resolver/ad2s1210.c
+index aca983f34f5e2..f41ee9243801e 100644
+--- a/drivers/staging/iio/resolver/ad2s1210.c
++++ b/drivers/staging/iio/resolver/ad2s1210.c
+@@ -85,7 +85,7 @@ struct ad2s1210_state {
+ static const int ad2s1210_mode_vals[4][2] = {
+ [MOD_POS] = { 0, 0 },
+ [MOD_VEL] = { 0, 1 },
+- [MOD_CONFIG] = { 1, 0 },
++ [MOD_CONFIG] = { 1, 1 },
+ };
+
+ static inline void ad2s1210_set_mode(enum ad2s1210_mode mode,
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+index da73998bc5f70..d5ef1986bde4d 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+@@ -778,6 +778,7 @@ static int _rtl92e_sta_up(struct net_device *dev, bool is_silent_reset)
+ else
+ netif_wake_queue(dev);
+
++ priv->bfirst_after_down = false;
+ return 0;
+ }
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 58ccded1be857..7738e249c4a24 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4056,9 +4056,12 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+- if (se_cmd->se_tfo != NULL) {
+- spin_lock_irq(&se_cmd->t_state_lock);
+- if (se_cmd->transport_state & CMD_T_ABORTED) {
++ if (!se_cmd->se_tfo)
++ continue;
++
++ spin_lock_irq(&se_cmd->t_state_lock);
++ if (se_cmd->transport_state & CMD_T_ABORTED) {
++ if (!(se_cmd->transport_state & CMD_T_TAS))
+ /*
+ * LIO's abort path owns the cleanup for this,
+ * so put it back on the list and let
+@@ -4066,11 +4069,10 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ */
+ list_move_tail(&cmd->i_conn_node,
+ &conn->conn_cmd_list);
+- } else {
+- se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+- }
+- spin_unlock_irq(&se_cmd->t_state_lock);
++ } else {
++ se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+ }
++ spin_unlock_irq(&se_cmd->t_state_lock);
+ }
+ spin_unlock_bh(&conn->cmd_lock);
+
+diff --git a/drivers/tty/serial/8250/8250.h b/drivers/tty/serial/8250/8250.h
+index ebfb0bd5bef59..8c8aa3b9c2989 100644
+--- a/drivers/tty/serial/8250/8250.h
++++ b/drivers/tty/serial/8250/8250.h
+@@ -217,6 +217,13 @@ extern int serial8250_rx_dma(struct uart_8250_port *);
+ extern void serial8250_rx_dma_flush(struct uart_8250_port *);
+ extern int serial8250_request_dma(struct uart_8250_port *);
+ extern void serial8250_release_dma(struct uart_8250_port *);
++
++static inline bool serial8250_tx_dma_running(struct uart_8250_port *p)
++{
++ struct uart_8250_dma *dma = p->dma;
++
++ return dma && dma->tx_running;
++}
+ #else
+ static inline int serial8250_tx_dma(struct uart_8250_port *p)
+ {
+@@ -232,6 +239,11 @@ static inline int serial8250_request_dma(struct uart_8250_port *p)
+ return -1;
+ }
+ static inline void serial8250_release_dma(struct uart_8250_port *p) { }
++
++static inline bool serial8250_tx_dma_running(struct uart_8250_port *p)
++{
++ return false;
++}
+ #endif
+
+ static inline int ns16550a_goto_highspeed(struct uart_8250_port *up)
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index ce266e10a21e0..cba4888bc4824 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -19,6 +19,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/ioport.h>
+ #include <linux/init.h>
++#include <linux/irq.h>
+ #include <linux/console.h>
+ #include <linux/sysrq.h>
+ #include <linux/delay.h>
+@@ -1885,6 +1886,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ unsigned char status;
+ unsigned long flags;
+ struct uart_8250_port *up = up_to_u8250p(port);
++ struct tty_port *tport = &port->state->port;
+ bool skip_rx = false;
+
+ if (iir & UART_IIR_NO_INT)
+@@ -1908,6 +1910,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ skip_rx = true;
+
+ if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) {
++ if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
++ pm_wakeup_event(tport->tty->dev, 0);
+ if (!up->dma || handle_rx_dma(up, iir))
+ status = serial8250_rx_chars(up, status);
+ }
+@@ -1963,19 +1967,25 @@ static int serial8250_tx_threshold_handle_irq(struct uart_port *port)
+ static unsigned int serial8250_tx_empty(struct uart_port *port)
+ {
+ struct uart_8250_port *up = up_to_u8250p(port);
++ unsigned int result = 0;
+ unsigned long flags;
+ unsigned int lsr;
+
+ serial8250_rpm_get(up);
+
+ spin_lock_irqsave(&port->lock, flags);
+- lsr = serial_port_in(port, UART_LSR);
+- up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
++ if (!serial8250_tx_dma_running(up)) {
++ lsr = serial_port_in(port, UART_LSR);
++ up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
++
++ if ((lsr & BOTH_EMPTY) == BOTH_EMPTY)
++ result = TIOCSER_TEMT;
++ }
+ spin_unlock_irqrestore(&port->lock, flags);
+
+ serial8250_rpm_put(up);
+
+- return (lsr & BOTH_EMPTY) == BOTH_EMPTY ? TIOCSER_TEMT : 0;
++ return result;
+ }
+
+ unsigned int serial8250_do_get_mctrl(struct uart_port *port)
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 6ea1d23623e51..dbfec943071d6 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -994,7 +994,7 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
+ * 10ms at any baud rate.
+ */
+ sport->rx_dma_rng_buf_len = (DMA_RX_TIMEOUT * baud / bits / 1000) * 2;
+- sport->rx_dma_rng_buf_len = (1 << (fls(sport->rx_dma_rng_buf_len) - 1));
++ sport->rx_dma_rng_buf_len = (1 << fls(sport->rx_dma_rng_buf_len));
+ if (sport->rx_dma_rng_buf_len < 16)
+ sport->rx_dma_rng_buf_len = 16;
+
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index d3e6b66155536..72091b1f56269 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -875,13 +875,13 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ return i;
+ }
+
+-static void tty_write_unlock(struct tty_struct *tty)
++void tty_write_unlock(struct tty_struct *tty)
+ {
+ mutex_unlock(&tty->atomic_write_lock);
+ wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
+ }
+
+-static int tty_write_lock(struct tty_struct *tty, int ndelay)
++int tty_write_lock(struct tty_struct *tty, int ndelay)
+ {
+ if (!mutex_trylock(&tty->atomic_write_lock)) {
+ if (ndelay)
+diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
+index d99fec44036c3..095c8780e210b 100644
+--- a/drivers/tty/tty_ioctl.c
++++ b/drivers/tty/tty_ioctl.c
+@@ -397,21 +397,42 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
+ tmp_termios.c_ispeed = tty_termios_input_baud_rate(&tmp_termios);
+ tmp_termios.c_ospeed = tty_termios_baud_rate(&tmp_termios);
+
+- ld = tty_ldisc_ref(tty);
++ if (opt & (TERMIOS_FLUSH|TERMIOS_WAIT)) {
++retry_write_wait:
++ retval = wait_event_interruptible(tty->write_wait, !tty_chars_in_buffer(tty));
++ if (retval < 0)
++ return retval;
+
+- if (ld != NULL) {
+- if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
+- ld->ops->flush_buffer(tty);
+- tty_ldisc_deref(ld);
+- }
++ if (tty_write_lock(tty, 0) < 0)
++ goto retry_write_wait;
+
+- if (opt & TERMIOS_WAIT) {
+- tty_wait_until_sent(tty, 0);
+- if (signal_pending(current))
+- return -ERESTARTSYS;
+- }
++ /* Racing writer? */
++ if (tty_chars_in_buffer(tty)) {
++ tty_write_unlock(tty);
++ goto retry_write_wait;
++ }
++
++ ld = tty_ldisc_ref(tty);
++ if (ld != NULL) {
++ if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
++ ld->ops->flush_buffer(tty);
++ tty_ldisc_deref(ld);
++ }
++
++ if ((opt & TERMIOS_WAIT) && tty->ops->wait_until_sent) {
++ tty->ops->wait_until_sent(tty, 0);
++ if (signal_pending(current)) {
++ tty_write_unlock(tty);
++ return -ERESTARTSYS;
++ }
++ }
++
++ tty_set_termios(tty, &tmp_termios);
+
+- tty_set_termios(tty, &tmp_termios);
++ tty_write_unlock(tty);
++ } else {
++ tty_set_termios(tty, &tmp_termios);
++ }
+
+ /* FIXME: Arguably if tmp_termios == tty->termios AND the
+ actual requested termios was not tmp_termios then we may
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index 3fd1073a345db..9f6a52ed038e2 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -984,7 +984,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+ ret = ci_usb_phy_init(ci);
+ if (ret) {
+ dev_err(dev, "unable to init phy: %d\n", ret);
+- return ret;
++ goto ulpi_exit;
+ }
+
+ ci->hw_bank.phys = res->start;
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 65caee589e677..81a5ca15b9c7a 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1563,6 +1563,7 @@ static int dwc3_remove(struct platform_device *pdev)
+ dwc3_core_exit(dwc);
+ dwc3_ulpi_exit(dwc);
+
++ pm_runtime_allow(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_set_suspended(&pdev->dev);
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index c17d7a71e29a3..013db752d55da 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2478,6 +2478,7 @@ static int renesas_usb3_remove(struct platform_device *pdev)
+ debugfs_remove_recursive(usb3->dentry);
+ device_remove_file(&pdev->dev, &dev_attr_role);
+
++ cancel_work_sync(&usb3->role_work);
+ usb_role_switch_unregister(usb3->role_sw);
+
+ usb_del_gadget_udc(&usb3->gadget);
+diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
+index 448d7b11dec4c..608104cdcf33b 100644
+--- a/drivers/usb/host/xhci-debugfs.c
++++ b/drivers/usb/host/xhci-debugfs.c
+@@ -132,6 +132,7 @@ static void xhci_debugfs_regset(struct xhci_hcd *xhci, u32 base,
+ regset->regs = regs;
+ regset->nregs = nregs;
+ regset->base = hcd->regs + base;
++ regset->dev = hcd->self.controller;
+
+ debugfs_create_regset32((const char *)rgs->name, 0444, parent, regset);
+ }
+diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
+index 4ebbe2c232926..4353c1948e5c6 100644
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -74,7 +74,6 @@ MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V3);
+
+ /* For soc_device_attribute */
+ #define RCAR_XHCI_FIRMWARE_V2 BIT(0) /* FIRMWARE V2 */
+-#define RCAR_XHCI_FIRMWARE_V3 BIT(1) /* FIRMWARE V3 */
+
+ static const struct soc_device_attribute rcar_quirks_match[] = {
+ {
+@@ -156,8 +155,6 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd)
+
+ if (quirks & RCAR_XHCI_FIRMWARE_V2)
+ firmware_name = XHCI_RCAR_FIRMWARE_NAME_V2;
+- else if (quirks & RCAR_XHCI_FIRMWARE_V3)
+- firmware_name = XHCI_RCAR_FIRMWARE_NAME_V3;
+ else
+ firmware_name = priv->firmware_name;
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 8dd94ce7245e1..06c5f46ff0f92 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -595,6 +595,11 @@ static void option_instat_callback(struct urb *urb);
+ #define SIERRA_VENDOR_ID 0x1199
+ #define SIERRA_PRODUCT_EM9191 0x90d3
+
++/* UNISOC (Spreadtrum) products */
++#define UNISOC_VENDOR_ID 0x1782
++/* TOZED LT70-C based on UNISOC SL8563 uses UNISOC's vendor ID */
++#define TOZED_PRODUCT_LT70C 0x4055
++
+ /* Device flags */
+
+ /* Highest interface number which can be used with NCTRL() and RSVD() */
+@@ -2225,6 +2230,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 00dc1b5c87372..34d56f0fa7501 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -5151,10 +5151,12 @@ int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ int btrfs_prev_leaf(struct btrfs_root *root, struct btrfs_path *path)
+ {
+ struct btrfs_key key;
++ struct btrfs_key orig_key;
+ struct btrfs_disk_key found_key;
+ int ret;
+
+ btrfs_item_key_to_cpu(path->nodes[0], &key, 0);
++ orig_key = key;
+
+ if (key.offset > 0) {
+ key.offset--;
+@@ -5171,8 +5173,36 @@ int btrfs_prev_leaf(struct btrfs_root *root, struct btrfs_path *path)
+
+ btrfs_release_path(path);
+ ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+- if (ret < 0)
++ if (ret <= 0)
+ return ret;
++
++ /*
++ * Previous key not found. Even if we were at slot 0 of the leaf we had
++ * before releasing the path and calling btrfs_search_slot(), we now may
++ * be in a slot pointing to the same original key - this can happen if
++ * after we released the path, one of more items were moved from a
++ * sibling leaf into the front of the leaf we had due to an insertion
++ * (see push_leaf_right()).
++ * If we hit this case and our slot is > 0 and just decrement the slot
++ * so that the caller does not process the same key again, which may or
++ * may not break the caller, depending on its logic.
++ */
++ if (path->slots[0] < btrfs_header_nritems(path->nodes[0])) {
++ btrfs_item_key(path->nodes[0], &found_key, path->slots[0]);
++ ret = comp_keys(&found_key, &orig_key);
++ if (ret == 0) {
++ if (path->slots[0] > 0) {
++ path->slots[0]--;
++ return 0;
++ }
++ /*
++ * At slot 0, same key as before, it means orig_key is
++ * the lowest, leftmost, key in the tree. We're done.
++ */
++ return 1;
++ }
++ }
++
+ btrfs_item_key(path->nodes[0], &found_key, 0);
+ ret = comp_keys(&found_key, &key);
+ /*
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 4f25133885676..f009d585e72f8 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -4722,6 +4722,11 @@ static long btrfs_ioctl_scrub(struct file *file, void __user *arg)
+ if (IS_ERR(sa))
+ return PTR_ERR(sa);
+
++ if (sa->flags & ~BTRFS_SCRUB_SUPPORTED_FLAGS) {
++ ret = -EOPNOTSUPP;
++ goto out;
++ }
++
+ if (!(sa->flags & BTRFS_SCRUB_READONLY)) {
+ ret = mnt_want_write_file(file);
+ if (ret)
+diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
+index 4b217e9a581ce..e3de0c4ecbfc0 100644
+--- a/fs/btrfs/print-tree.c
++++ b/fs/btrfs/print-tree.c
+@@ -109,10 +109,10 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
+ pr_cont("shared data backref parent %llu count %u\n",
+ offset, btrfs_shared_data_ref_count(eb, sref));
+ /*
+- * offset is supposed to be a tree block which
+- * must be aligned to nodesize.
++ * Offset is supposed to be a tree block which must be
++ * aligned to sectorsize.
+ */
+- if (!IS_ALIGNED(offset, eb->fs_info->nodesize))
++ if (!IS_ALIGNED(offset, eb->fs_info->sectorsize))
+ pr_info(
+ "\t\t\t(parent %llu not aligned to sectorsize %u)\n",
+ offset, eb->fs_info->sectorsize);
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 118bcb351af91..c07dcb2af2eb8 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1180,7 +1180,7 @@ smb2_copychunk_range(const unsigned int xid,
+ pcchunk->SourceOffset = cpu_to_le64(src_off);
+ pcchunk->TargetOffset = cpu_to_le64(dest_off);
+ pcchunk->Length =
+- cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk));
++ cpu_to_le32(min_t(u64, len, tcon->max_bytes_chunk));
+
+ /* Request server copy to target from src identified by key */
+ kfree(retbuf);
+diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
+index a57d080d2ba57..acdc802bfe9a8 100644
+--- a/fs/debugfs/file.c
++++ b/fs/debugfs/file.c
+@@ -18,6 +18,7 @@
+ #include <linux/slab.h>
+ #include <linux/atomic.h>
+ #include <linux/device.h>
++#include <linux/pm_runtime.h>
+ #include <linux/poll.h>
+
+ #include "internal.h"
+@@ -1084,7 +1085,14 @@ static int debugfs_show_regset32(struct seq_file *s, void *data)
+ {
+ struct debugfs_regset32 *regset = s->private;
+
++ if (regset->dev)
++ pm_runtime_get_sync(regset->dev);
++
+ debugfs_print_regs32(s, regset->regs, regset->nregs, regset->base, "");
++
++ if (regset->dev)
++ pm_runtime_put(regset->dev);
++
+ return 0;
+ }
+
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index f9645de9d04cc..9761aeb4b2248 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -303,6 +303,22 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
+ return desc;
+ }
+
++static ext4_fsblk_t ext4_valid_block_bitmap_padding(struct super_block *sb,
++ ext4_group_t block_group,
++ struct buffer_head *bh)
++{
++ ext4_grpblk_t next_zero_bit;
++ unsigned long bitmap_size = sb->s_blocksize * 8;
++ unsigned int offset = num_clusters_in_group(sb, block_group);
++
++ if (bitmap_size <= offset)
++ return 0;
++
++ next_zero_bit = ext4_find_next_zero_bit(bh->b_data, bitmap_size, offset);
++
++ return (next_zero_bit < bitmap_size ? next_zero_bit : 0);
++}
++
+ /*
+ * Return the block number which was discovered to be invalid, or 0 if
+ * the block bitmap is valid.
+@@ -395,6 +411,15 @@ static int ext4_validate_block_bitmap(struct super_block *sb,
+ EXT4_GROUP_INFO_BBITMAP_CORRUPT);
+ return -EFSCORRUPTED;
+ }
++ blk = ext4_valid_block_bitmap_padding(sb, block_group, bh);
++ if (unlikely(blk != 0)) {
++ ext4_unlock_group(sb, block_group);
++ ext4_error(sb, "bg %u: block %llu: padding at end of block bitmap is not set",
++ block_group, blk);
++ ext4_mark_group_bitmap_corrupted(sb, block_group,
++ EXT4_GROUP_INFO_BBITMAP_CORRUPT);
++ return -EFSCORRUPTED;
++ }
+ set_buffer_verified(bh);
+ verified:
+ ext4_unlock_group(sb, block_group);
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 72387e142e28d..71bb3cfc5933c 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -32,6 +32,7 @@ static int get_max_inline_xattr_value_size(struct inode *inode,
+ struct ext4_xattr_ibody_header *header;
+ struct ext4_xattr_entry *entry;
+ struct ext4_inode *raw_inode;
++ void *end;
+ int free, min_offs;
+
+ if (!EXT4_INODE_HAS_XATTR_SPACE(inode))
+@@ -55,14 +56,23 @@ static int get_max_inline_xattr_value_size(struct inode *inode,
+ raw_inode = ext4_raw_inode(iloc);
+ header = IHDR(inode, raw_inode);
+ entry = IFIRST(header);
++ end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
+
+ /* Compute min_offs. */
+- for (; !IS_LAST_ENTRY(entry); entry = EXT4_XATTR_NEXT(entry)) {
++ while (!IS_LAST_ENTRY(entry)) {
++ void *next = EXT4_XATTR_NEXT(entry);
++
++ if (next >= end) {
++ EXT4_ERROR_INODE(inode,
++ "corrupt xattr in inline inode");
++ return 0;
++ }
+ if (!entry->e_value_inum && entry->e_value_size) {
+ size_t offs = le16_to_cpu(entry->e_value_offs);
+ if (offs < min_offs)
+ min_offs = offs;
+ }
++ entry = next;
+ }
+ free = min_offs -
+ ((void *)entry - (void *)IFIRST(header)) - sizeof(__u32);
+@@ -348,7 +358,7 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode,
+
+ error = ext4_xattr_ibody_get(inode, i.name_index, i.name,
+ value, len);
+- if (error == -ENODATA)
++ if (error < 0)
+ goto out;
+
+ BUFFER_TRACE(is.iloc.bh, "get_write_access");
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 4ea4fe92eb8c9..70e1121d0a30c 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3893,7 +3893,11 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
+ trace_ext4_mb_release_group_pa(sb, pa);
+ BUG_ON(pa->pa_deleted == 0);
+ ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
+- BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
++ if (unlikely(group != e4b->bd_group && pa->pa_len != 0)) {
++ ext4_warning(sb, "bad group: expected %u, group %u, pa_start %llu",
++ e4b->bd_group, group, pa->pa_pstart);
++ return 0;
++ }
+ mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
+ atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
+ trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index e54a5be15636d..ce5abd25eb99c 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2423,11 +2423,9 @@ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group,
+ crc = crc16(crc, (__u8 *)gdp, offset);
+ offset += sizeof(gdp->bg_checksum); /* skip checksum */
+ /* for checksum of struct ext4_group_desc do the rest...*/
+- if (ext4_has_feature_64bit(sb) &&
+- offset < le16_to_cpu(sbi->s_es->s_desc_size))
++ if (ext4_has_feature_64bit(sb) && offset < sbi->s_desc_size)
+ crc = crc16(crc, (__u8 *)gdp + offset,
+- le16_to_cpu(sbi->s_es->s_desc_size) -
+- offset);
++ sbi->s_desc_size - offset);
+
+ out:
+ return cpu_to_le16(crc);
+@@ -5503,9 +5501,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ }
+
+ #ifdef CONFIG_QUOTA
+- /* Release old quota file names */
+- for (i = 0; i < EXT4_MAXQUOTAS; i++)
+- kfree(old_opts.s_qf_names[i]);
+ if (enable_quota) {
+ if (sb_any_quota_suspended(sb))
+ dquot_resume(sb, -1);
+@@ -5515,6 +5510,9 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ goto restore_opts;
+ }
+ }
++ /* Release old quota file names */
++ for (i = 0; i < EXT4_MAXQUOTAS; i++)
++ kfree(old_opts.s_qf_names[i]);
+ #endif
+ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks)
+ ext4_release_system_zone(sb);
+@@ -5531,6 +5529,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ return 0;
+
+ restore_opts:
++ /*
++ * If there was a failing r/w to ro transition, we may need to
++ * re-enable quota
++ */
++ if ((sb->s_flags & SB_RDONLY) && !(old_sb_flags & SB_RDONLY) &&
++ sb_any_quota_suspended(sb))
++ dquot_resume(sb, -1);
+ sb->s_flags = old_sb_flags;
+ sbi->s_mount_opt = old_opts.s_mount_opt;
+ sbi->s_mount_opt2 = old_opts.s_mount_opt2;
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 1b73a7f8189d2..700822c9851ac 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -2573,6 +2573,7 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode,
+ .in_inode = !!entry->e_value_inum,
+ };
+ struct ext4_xattr_ibody_header *header = IHDR(inode, raw_inode);
++ int needs_kvfree = 0;
+ int error;
+
+ is = kzalloc(sizeof(struct ext4_xattr_ibody_find), GFP_NOFS);
+@@ -2595,7 +2596,7 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode,
+ error = -ENOMEM;
+ goto out;
+ }
+-
++ needs_kvfree = 1;
+ error = ext4_xattr_inode_get(inode, entry, buffer, value_size);
+ if (error)
+ goto out;
+@@ -2634,7 +2635,7 @@ static int ext4_xattr_move_to_block(handle_t *handle, struct inode *inode,
+
+ out:
+ kfree(b_entry_name);
+- if (entry->e_value_inum && buffer)
++ if (needs_kvfree && buffer)
+ kvfree(buffer);
+ if (is)
+ brelse(is->iloc.bh);
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 4d687e2e23735..61dc0dc139f87 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -702,7 +702,7 @@ void wbc_detach_inode(struct writeback_control *wbc)
+ * is okay. The main goal is avoiding keeping an inode on
+ * the wrong wb for an extended period of time.
+ */
+- if (hweight32(history) > WB_FRN_HIST_THR_SLOTS)
++ if (hweight16(history) > WB_FRN_HIST_THR_SLOTS)
+ inode_switch_wbs(inode, max_id);
+ }
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index e5b4c6987c846..f0f0fb7499e3a 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -66,6 +66,8 @@
+
+ #define OPENOWNER_POOL_SIZE 8
+
++static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp);
++
+ const nfs4_stateid zero_stateid = {
+ { .data = { 0 } },
+ .type = NFS4_SPECIAL_STATEID_TYPE,
+@@ -338,6 +340,8 @@ do_confirm:
+ status = nfs4_proc_create_session(clp, cred);
+ if (status != 0)
+ goto out;
++ if (!(clp->cl_exchange_flags & EXCHGID4_FLAG_CONFIRMED_R))
++ nfs4_state_start_reclaim_reboot(clp);
+ nfs41_finish_session_reset(clp);
+ nfs_mark_client_ready(clp, NFS_CS_READY);
+ out:
+diff --git a/fs/nilfs2/bmap.c b/fs/nilfs2/bmap.c
+index fb5a9a8a13cf7..2ba57e4b4f0a6 100644
+--- a/fs/nilfs2/bmap.c
++++ b/fs/nilfs2/bmap.c
+@@ -67,20 +67,28 @@ int nilfs_bmap_lookup_at_level(struct nilfs_bmap *bmap, __u64 key, int level,
+
+ down_read(&bmap->b_sem);
+ ret = bmap->b_ops->bop_lookup(bmap, key, level, ptrp);
+- if (ret < 0) {
+- ret = nilfs_bmap_convert_error(bmap, __func__, ret);
++ if (ret < 0)
+ goto out;
+- }
++
+ if (NILFS_BMAP_USE_VBN(bmap)) {
+ ret = nilfs_dat_translate(nilfs_bmap_get_dat(bmap), *ptrp,
+ &blocknr);
+ if (!ret)
+ *ptrp = blocknr;
++ else if (ret == -ENOENT) {
++ /*
++ * If there was no valid entry in DAT for the block
++ * address obtained by b_ops->bop_lookup, then pass
++ * internal code -EINVAL to nilfs_bmap_convert_error
++ * to treat it as metadata corruption.
++ */
++ ret = -EINVAL;
++ }
+ }
+
+ out:
+ up_read(&bmap->b_sem);
+- return ret;
++ return nilfs_bmap_convert_error(bmap, __func__, ret);
+ }
+
+ int nilfs_bmap_lookup_contig(struct nilfs_bmap *bmap, __u64 key, __u64 *ptrp,
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index b23ed9a35e5e4..3091d1a3eddea 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -2039,6 +2039,9 @@ static int nilfs_segctor_do_construct(struct nilfs_sc_info *sci, int mode)
+ struct the_nilfs *nilfs = sci->sc_super->s_fs_info;
+ int err;
+
++ if (sb_rdonly(sci->sc_super))
++ return -EROFS;
++
+ nilfs_sc_cstage_set(sci, NILFS_ST_INIT);
+ sci->sc_cno = nilfs->ns_cno;
+
+@@ -2724,7 +2727,7 @@ static void nilfs_segctor_write_out(struct nilfs_sc_info *sci)
+
+ flush_work(&sci->sc_iput_work);
+
+- } while (ret && retrycount-- > 0);
++ } while (ret && ret != -EROFS && retrycount-- > 0);
+ }
+
+ /**
+diff --git a/fs/pstore/pmsg.c b/fs/pstore/pmsg.c
+index ffc13ea196d2a..24db02de17874 100644
+--- a/fs/pstore/pmsg.c
++++ b/fs/pstore/pmsg.c
+@@ -15,10 +15,9 @@
+ #include <linux/device.h>
+ #include <linux/fs.h>
+ #include <linux/uaccess.h>
+-#include <linux/rtmutex.h>
+ #include "internal.h"
+
+-static DEFINE_RT_MUTEX(pmsg_lock);
++static DEFINE_MUTEX(pmsg_lock);
+
+ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ size_t count, loff_t *ppos)
+@@ -37,9 +36,9 @@ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ if (!access_ok(VERIFY_READ, buf, count))
+ return -EFAULT;
+
+- rt_mutex_lock(&pmsg_lock);
++ mutex_lock(&pmsg_lock);
+ ret = psinfo->write_user(&record, buf);
+- rt_mutex_unlock(&pmsg_lock);
++ mutex_unlock(&pmsg_lock);
+ return ret ? ret : count;
+ }
+
+diff --git a/fs/reiserfs/xattr_security.c b/fs/reiserfs/xattr_security.c
+index 59d87f9f72fb4..159af6c26f4bd 100644
+--- a/fs/reiserfs/xattr_security.c
++++ b/fs/reiserfs/xattr_security.c
+@@ -81,11 +81,15 @@ int reiserfs_security_write(struct reiserfs_transaction_handle *th,
+ struct inode *inode,
+ struct reiserfs_security_handle *sec)
+ {
++ char xattr_name[XATTR_NAME_MAX + 1] = XATTR_SECURITY_PREFIX;
+ int error;
+- if (strlen(sec->name) < sizeof(XATTR_SECURITY_PREFIX))
++
++ if (XATTR_SECURITY_PREFIX_LEN + strlen(sec->name) > XATTR_NAME_MAX)
+ return -EINVAL;
+
+- error = reiserfs_xattr_set_handle(th, inode, sec->name, sec->value,
++ strlcat(xattr_name, sec->name, sizeof(xattr_name));
++
++ error = reiserfs_xattr_set_handle(th, inode, xattr_name, sec->value,
+ sec->length, XATTR_CREATE);
+ if (error == -ENODATA || error == -EOPNOTSUPP)
+ error = 0;
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index 3b93b14e00412..cb52aa9ea276c 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -445,6 +445,7 @@ static int do_tmpfile(struct inode *dir, struct dentry *dentry,
+ mutex_unlock(&dir_ui->ui_mutex);
+
+ ubifs_release_budget(c, &req);
++ fscrypt_free_filename(&nm);
+
+ return 0;
+
+diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
+index 4665c4d7d76ac..08ed942b76271 100644
+--- a/fs/ubifs/tnc.c
++++ b/fs/ubifs/tnc.c
+@@ -56,6 +56,33 @@ enum {
+ NOT_ON_MEDIA = 3,
+ };
+
++static void do_insert_old_idx(struct ubifs_info *c,
++ struct ubifs_old_idx *old_idx)
++{
++ struct ubifs_old_idx *o;
++ struct rb_node **p, *parent = NULL;
++
++ p = &c->old_idx.rb_node;
++ while (*p) {
++ parent = *p;
++ o = rb_entry(parent, struct ubifs_old_idx, rb);
++ if (old_idx->lnum < o->lnum)
++ p = &(*p)->rb_left;
++ else if (old_idx->lnum > o->lnum)
++ p = &(*p)->rb_right;
++ else if (old_idx->offs < o->offs)
++ p = &(*p)->rb_left;
++ else if (old_idx->offs > o->offs)
++ p = &(*p)->rb_right;
++ else {
++ ubifs_err(c, "old idx added twice!");
++ kfree(old_idx);
++ }
++ }
++ rb_link_node(&old_idx->rb, parent, p);
++ rb_insert_color(&old_idx->rb, &c->old_idx);
++}
++
+ /**
+ * insert_old_idx - record an index node obsoleted since the last commit start.
+ * @c: UBIFS file-system description object
+@@ -81,35 +108,15 @@ enum {
+ */
+ static int insert_old_idx(struct ubifs_info *c, int lnum, int offs)
+ {
+- struct ubifs_old_idx *old_idx, *o;
+- struct rb_node **p, *parent = NULL;
++ struct ubifs_old_idx *old_idx;
+
+ old_idx = kmalloc(sizeof(struct ubifs_old_idx), GFP_NOFS);
+ if (unlikely(!old_idx))
+ return -ENOMEM;
+ old_idx->lnum = lnum;
+ old_idx->offs = offs;
++ do_insert_old_idx(c, old_idx);
+
+- p = &c->old_idx.rb_node;
+- while (*p) {
+- parent = *p;
+- o = rb_entry(parent, struct ubifs_old_idx, rb);
+- if (lnum < o->lnum)
+- p = &(*p)->rb_left;
+- else if (lnum > o->lnum)
+- p = &(*p)->rb_right;
+- else if (offs < o->offs)
+- p = &(*p)->rb_left;
+- else if (offs > o->offs)
+- p = &(*p)->rb_right;
+- else {
+- ubifs_err(c, "old idx added twice!");
+- kfree(old_idx);
+- return 0;
+- }
+- }
+- rb_link_node(&old_idx->rb, parent, p);
+- rb_insert_color(&old_idx->rb, &c->old_idx);
+ return 0;
+ }
+
+@@ -211,23 +218,6 @@ static struct ubifs_znode *copy_znode(struct ubifs_info *c,
+ __set_bit(DIRTY_ZNODE, &zn->flags);
+ __clear_bit(COW_ZNODE, &zn->flags);
+
+- ubifs_assert(c, !ubifs_zn_obsolete(znode));
+- __set_bit(OBSOLETE_ZNODE, &znode->flags);
+-
+- if (znode->level != 0) {
+- int i;
+- const int n = zn->child_cnt;
+-
+- /* The children now have new parent */
+- for (i = 0; i < n; i++) {
+- struct ubifs_zbranch *zbr = &zn->zbranch[i];
+-
+- if (zbr->znode)
+- zbr->znode->parent = zn;
+- }
+- }
+-
+- atomic_long_inc(&c->dirty_zn_cnt);
+ return zn;
+ }
+
+@@ -245,6 +235,42 @@ static int add_idx_dirt(struct ubifs_info *c, int lnum, int dirt)
+ return ubifs_add_dirt(c, lnum, dirt);
+ }
+
++/**
++ * replace_znode - replace old znode with new znode.
++ * @c: UBIFS file-system description object
++ * @new_zn: new znode
++ * @old_zn: old znode
++ * @zbr: the branch of parent znode
++ *
++ * Replace old znode with new znode in TNC.
++ */
++static void replace_znode(struct ubifs_info *c, struct ubifs_znode *new_zn,
++ struct ubifs_znode *old_zn, struct ubifs_zbranch *zbr)
++{
++ ubifs_assert(c, !ubifs_zn_obsolete(old_zn));
++ __set_bit(OBSOLETE_ZNODE, &old_zn->flags);
++
++ if (old_zn->level != 0) {
++ int i;
++ const int n = new_zn->child_cnt;
++
++ /* The children now have new parent */
++ for (i = 0; i < n; i++) {
++ struct ubifs_zbranch *child = &new_zn->zbranch[i];
++
++ if (child->znode)
++ child->znode->parent = new_zn;
++ }
++ }
++
++ zbr->znode = new_zn;
++ zbr->lnum = 0;
++ zbr->offs = 0;
++ zbr->len = 0;
++
++ atomic_long_inc(&c->dirty_zn_cnt);
++}
++
+ /**
+ * dirty_cow_znode - ensure a znode is not being committed.
+ * @c: UBIFS file-system description object
+@@ -277,28 +303,32 @@ static struct ubifs_znode *dirty_cow_znode(struct ubifs_info *c,
+ return zn;
+
+ if (zbr->len) {
+- err = insert_old_idx(c, zbr->lnum, zbr->offs);
+- if (unlikely(err))
+- /*
+- * Obsolete znodes will be freed by tnc_destroy_cnext()
+- * or free_obsolete_znodes(), copied up znodes should
+- * be added back to tnc and freed by
+- * ubifs_destroy_tnc_subtree().
+- */
++ struct ubifs_old_idx *old_idx;
++
++ old_idx = kmalloc(sizeof(struct ubifs_old_idx), GFP_NOFS);
++ if (unlikely(!old_idx)) {
++ err = -ENOMEM;
+ goto out;
++ }
++ old_idx->lnum = zbr->lnum;
++ old_idx->offs = zbr->offs;
++
+ err = add_idx_dirt(c, zbr->lnum, zbr->len);
+- } else
+- err = 0;
++ if (err) {
++ kfree(old_idx);
++ goto out;
++ }
+
+-out:
+- zbr->znode = zn;
+- zbr->lnum = 0;
+- zbr->offs = 0;
+- zbr->len = 0;
++ do_insert_old_idx(c, old_idx);
++ }
++
++ replace_znode(c, zn, znode, zbr);
+
+- if (unlikely(err))
+- return ERR_PTR(err);
+ return zn;
++
++out:
++ kfree(zn);
++ return ERR_PTR(err);
+ }
+
+ /**
+diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h
+index 6ebc269e48ace..0624c9a1f01ea 100644
+--- a/include/linux/debugfs.h
++++ b/include/linux/debugfs.h
+@@ -35,6 +35,7 @@ struct debugfs_regset32 {
+ const struct debugfs_reg32 *regs;
+ int nregs;
+ void __iomem *base;
++ struct device *dev; /* Optional device for Runtime PM */
+ };
+
+ extern struct dentry *arch_debugfs_dir;
+diff --git a/include/linux/ipmi_smi.h b/include/linux/ipmi_smi.h
+index 1995ce1467890..86b119400f301 100644
+--- a/include/linux/ipmi_smi.h
++++ b/include/linux/ipmi_smi.h
+@@ -30,6 +30,17 @@ struct device;
+ /* Structure for the low-level drivers. */
+ typedef struct ipmi_smi *ipmi_smi_t;
+
++/*
++ * Flags for set_check_watch() below. Tells if the SMI should be
++ * waiting for watchdog timeouts, commands and/or messages. There is
++ * also an internal flag for the message handler, SMIs should ignore
++ * it.
++ */
++#define IPMI_WATCH_MASK_INTERNAL (1 << 0)
++#define IPMI_WATCH_MASK_CHECK_MESSAGES (1 << 1)
++#define IPMI_WATCH_MASK_CHECK_WATCHDOG (1 << 2)
++#define IPMI_WATCH_MASK_CHECK_COMMANDS (1 << 3)
++
+ /*
+ * Messages to/from the lower layer. The smi interface will take one
+ * of these to send. After the send has occurred and a response has
+@@ -55,8 +66,16 @@ struct ipmi_smi_msg {
+ int rsp_size;
+ unsigned char rsp[IPMI_MAX_MSG_LENGTH];
+
+- /* Will be called when the system is done with the message
+- (presumably to free it). */
++ /*
++ * There should be a response message coming back in the BMC
++ * message queue.
++ */
++ bool needs_response;
++
++ /*
++ * Will be called when the system is done with the message
++ * (presumably to free it).
++ */
+ void (*done)(struct ipmi_smi_msg *msg);
+ };
+
+@@ -105,12 +124,15 @@ struct ipmi_smi_handlers {
+
+ /*
+ * Called by the upper layer when some user requires that the
+- * interface watch for events, received messages, watchdog
+- * pretimeouts, or not. Used by the SMI to know if it should
+- * watch for these. This may be NULL if the SMI does not
+- * implement it.
++ * interface watch for received messages and watchdog
++ * pretimeouts (basically do a "Get Flags", or not. Used by
++ * the SMI to know if it should watch for these. This may be
++ * NULL if the SMI does not implement it. watch_mask is from
++ * IPMI_WATCH_MASK_xxx above. The interface should run slower
++ * timeouts for just watchdog checking or faster timeouts when
++ * waiting for the message queue.
+ */
+- void (*set_need_watch)(void *send_info, bool enable);
++ void (*set_need_watch)(void *send_info, unsigned int watch_mask);
+
+ /*
+ * Called when flushing all pending messages.
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index e713476ff29db..a806803fbe37a 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -32,7 +32,6 @@ struct nfnetlink_subsystem {
+ struct module *owner;
+ int (*commit)(struct net *net, struct sk_buff *skb);
+ int (*abort)(struct net *net, struct sk_buff *skb);
+- void (*cleanup)(struct net *net);
+ bool (*valid_genid)(struct net *net, u32 genid);
+ };
+
+diff --git a/include/linux/printk.h b/include/linux/printk.h
+index 6dd867e393651..f4d7e643f0105 100644
+--- a/include/linux/printk.h
++++ b/include/linux/printk.h
+@@ -525,4 +525,23 @@ static inline void print_hex_dump_debug(const char *prefix_str, int prefix_type,
+ }
+ #endif
+
++#ifdef CONFIG_PRINTK
++extern void __printk_safe_enter(void);
++extern void __printk_safe_exit(void);
++/*
++ * The printk_deferred_enter/exit macros are available only as a hack for
++ * some code paths that need to defer all printk console printing. Interrupts
++ * must be disabled for the deferred duration.
++ */
++#define printk_deferred_enter __printk_safe_enter
++#define printk_deferred_exit __printk_safe_exit
++#else
++static inline void printk_deferred_enter(void)
++{
++}
++static inline void printk_deferred_exit(void)
++{
++}
++#endif
++
+ #endif
+diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
+index ad2e243f3f032..96837ae07822b 100644
+--- a/include/linux/sunrpc/sched.h
++++ b/include/linux/sunrpc/sched.h
+@@ -88,8 +88,7 @@ struct rpc_task {
+ #endif
+ unsigned char tk_priority : 2,/* Task priority */
+ tk_garb_retry : 2,
+- tk_cred_retry : 2,
+- tk_rebind_retry : 2;
++ tk_cred_retry : 2;
+ };
+
+ typedef void (*rpc_action)(struct rpc_task *);
+diff --git a/include/linux/tick.h b/include/linux/tick.h
+index 55388ab45fd4d..443726085f6c1 100644
+--- a/include/linux/tick.h
++++ b/include/linux/tick.h
+@@ -102,7 +102,8 @@ enum tick_dep_bits {
+ TICK_DEP_BIT_POSIX_TIMER = 0,
+ TICK_DEP_BIT_PERF_EVENTS = 1,
+ TICK_DEP_BIT_SCHED = 2,
+- TICK_DEP_BIT_CLOCK_UNSTABLE = 3
++ TICK_DEP_BIT_CLOCK_UNSTABLE = 3,
++ TICK_DEP_BIT_RCU = 4
+ };
+
+ #define TICK_DEP_MASK_NONE 0
+@@ -110,6 +111,7 @@ enum tick_dep_bits {
+ #define TICK_DEP_MASK_PERF_EVENTS (1 << TICK_DEP_BIT_PERF_EVENTS)
+ #define TICK_DEP_MASK_SCHED (1 << TICK_DEP_BIT_SCHED)
+ #define TICK_DEP_MASK_CLOCK_UNSTABLE (1 << TICK_DEP_BIT_CLOCK_UNSTABLE)
++#define TICK_DEP_MASK_RCU (1 << TICK_DEP_BIT_RCU)
+
+ #ifdef CONFIG_NO_HZ_COMMON
+ extern bool tick_nohz_enabled;
+@@ -195,6 +197,7 @@ extern void tick_nohz_dep_set_signal(struct signal_struct *signal,
+ enum tick_dep_bits bit);
+ extern void tick_nohz_dep_clear_signal(struct signal_struct *signal,
+ enum tick_dep_bits bit);
++extern bool tick_nohz_cpu_hotpluggable(unsigned int cpu);
+
+ /*
+ * The below are tick_nohz_[set,clear]_dep() wrappers that optimize off-cases
+@@ -257,6 +260,10 @@ static inline bool tick_nohz_full_enabled(void) { return false; }
+ static inline bool tick_nohz_full_cpu(int cpu) { return false; }
+ static inline void tick_nohz_full_add_cpus_to(struct cpumask *mask) { }
+
++static inline void tick_nohz_dep_set_cpu(int cpu, enum tick_dep_bits bit) { }
++static inline void tick_nohz_dep_clear_cpu(int cpu, enum tick_dep_bits bit) { }
++static inline bool tick_nohz_cpu_hotpluggable(unsigned int cpu) { return true; }
++
+ static inline void tick_dep_set(enum tick_dep_bits bit) { }
+ static inline void tick_dep_clear(enum tick_dep_bits bit) { }
+ static inline void tick_dep_set_cpu(int cpu, enum tick_dep_bits bit) { }
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index d808ab9c9aff2..487ce56b88e89 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -480,6 +480,8 @@ extern void __stop_tty(struct tty_struct *tty);
+ extern void stop_tty(struct tty_struct *tty);
+ extern void __start_tty(struct tty_struct *tty);
+ extern void start_tty(struct tty_struct *tty);
++void tty_write_unlock(struct tty_struct *tty);
++int tty_write_lock(struct tty_struct *tty, int ndelay);
+ extern int tty_register_driver(struct tty_driver *driver);
+ extern int tty_unregister_driver(struct tty_driver *driver);
+ extern struct device *tty_register_device(struct tty_driver *driver,
+diff --git a/include/linux/vt_buffer.h b/include/linux/vt_buffer.h
+index 848db1b1569ff..919d999a8c1db 100644
+--- a/include/linux/vt_buffer.h
++++ b/include/linux/vt_buffer.h
+@@ -16,7 +16,7 @@
+
+ #include <linux/string.h>
+
+-#if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_MDA_CONSOLE)
++#if IS_ENABLED(CONFIG_VGA_CONSOLE) || IS_ENABLED(CONFIG_MDA_CONSOLE)
+ #include <asm/vga.h>
+ #endif
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 93253ba1eeac3..78f5f0426e6b6 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -471,6 +471,7 @@ struct nft_set_binding {
+ };
+
+ enum nft_trans_phase;
++void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set);
+ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
+ struct nft_set_binding *binding,
+ enum nft_trans_phase phase);
+diff --git a/include/net/scm.h b/include/net/scm.h
+index 1ce365f4c2560..585adc1346bd0 100644
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
+ }
+ }
+ }
++
++static inline bool scm_has_secdata(struct socket *sock)
++{
++ return test_bit(SOCK_PASSSEC, &sock->flags);
++}
+ #else
+ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
+ { }
++
++static inline bool scm_has_secdata(struct socket *sock)
++{
++ return false;
++}
+ #endif /* CONFIG_SECURITY_NETWORK */
+
+ static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
+ struct scm_cookie *scm, int flags)
+ {
+ if (!msg->msg_control) {
+- if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp)
++ if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp ||
++ scm_has_secdata(sock))
+ msg->msg_flags |= MSG_CTRUNC;
+ scm_destroy(scm);
+ return;
+diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h
+index a57e4ee989d62..350b046e7576c 100644
+--- a/include/trace/events/timer.h
++++ b/include/trace/events/timer.h
+@@ -362,7 +362,8 @@ TRACE_EVENT(itimer_expire,
+ tick_dep_name(POSIX_TIMER) \
+ tick_dep_name(PERF_EVENTS) \
+ tick_dep_name(SCHED) \
+- tick_dep_name_end(CLOCK_UNSTABLE)
++ tick_dep_name(CLOCK_UNSTABLE) \
++ tick_dep_name_end(RCU)
+
+ #undef tick_dep_name
+ #undef tick_dep_mask_name
+diff --git a/include/uapi/drm/amdgpu_drm.h b/include/uapi/drm/amdgpu_drm.h
+index 1ceec56de0157..b72aeb766fc7a 100644
+--- a/include/uapi/drm/amdgpu_drm.h
++++ b/include/uapi/drm/amdgpu_drm.h
+@@ -272,13 +272,14 @@ union drm_amdgpu_vm {
+
+ /* sched ioctl */
+ #define AMDGPU_SCHED_OP_PROCESS_PRIORITY_OVERRIDE 1
++#define AMDGPU_SCHED_OP_CONTEXT_PRIORITY_OVERRIDE 2
+
+ struct drm_amdgpu_sched_in {
+ /* AMDGPU_SCHED_OP_* */
+ __u32 op;
+ __u32 fd;
+ __s32 priority;
+- __u32 flags;
++ __u32 ctx_id;
+ };
+
+ union drm_amdgpu_sched {
+diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h
+index 5ca1d21fc4a7a..dd7a7b3e53f4b 100644
+--- a/include/uapi/linux/btrfs.h
++++ b/include/uapi/linux/btrfs.h
+@@ -162,6 +162,7 @@ struct btrfs_scrub_progress {
+ };
+
+ #define BTRFS_SCRUB_READONLY 1
++#define BTRFS_SCRUB_SUPPORTED_FLAGS (BTRFS_SCRUB_READONLY)
+ struct btrfs_ioctl_scrub_args {
+ __u64 devid; /* in */
+ __u64 start; /* in */
+diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h
+index af2a44c08683d..a429381e7ca50 100644
+--- a/include/uapi/linux/const.h
++++ b/include/uapi/linux/const.h
+@@ -28,7 +28,7 @@
+ #define _BITUL(x) (_UL(1) << (x))
+ #define _BITULL(x) (_ULL(1) << (x))
+
+-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
++#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
+ #define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask))
+
+ #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
+diff --git a/include/uapi/linux/media-bus-format.h b/include/uapi/linux/media-bus-format.h
+index d6a5a3bfe6c43..be53a8c1a2dff 100644
+--- a/include/uapi/linux/media-bus-format.h
++++ b/include/uapi/linux/media-bus-format.h
+@@ -153,4 +153,12 @@
+ /* HSV - next is 0x6002 */
+ #define MEDIA_BUS_FMT_AHSV8888_1X32 0x6001
+
++/*
++ * This format should be used when the same driver handles
++ * both sides of the link and the bus format is a fixed
++ * metadata format that is not configurable from userspace.
++ * Width and height will be set to 0 for this format.
++ */
++#define MEDIA_BUS_FMT_METADATA_FIXED 0x7001
++
+ #endif /* __LINUX_MEDIA_BUS_FORMAT_H */
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 72ed3f3d078fc..2bf4b6b109bf4 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -7843,8 +7843,8 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle)
+ hwc->interrupts = 1;
+ } else {
+ hwc->interrupts++;
+- if (unlikely(throttle
+- && hwc->interrupts >= max_samples_per_tick)) {
++ if (unlikely(throttle &&
++ hwc->interrupts > max_samples_per_tick)) {
+ __this_cpu_inc(perf_throttled_count);
+ tick_dep_set_cpu(smp_processor_id(), TICK_DEP_BIT_PERF_EVENTS);
+ hwc->interrupts = MAX_INTERRUPTS;
+diff --git a/kernel/relay.c b/kernel/relay.c
+index b7aa7df43955b..e6f70f4c41a36 100644
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -997,14 +997,14 @@ static void relay_file_read_consume(struct rchan_buf *buf,
+ /*
+ * relay_file_read_avail - boolean, are there unconsumed bytes available?
+ */
+-static int relay_file_read_avail(struct rchan_buf *buf, size_t read_pos)
++static int relay_file_read_avail(struct rchan_buf *buf)
+ {
+ size_t subbuf_size = buf->chan->subbuf_size;
+ size_t n_subbufs = buf->chan->n_subbufs;
+ size_t produced = buf->subbufs_produced;
+ size_t consumed = buf->subbufs_consumed;
+
+- relay_file_read_consume(buf, read_pos, 0);
++ relay_file_read_consume(buf, 0, 0);
+
+ consumed = buf->subbufs_consumed;
+
+@@ -1065,23 +1065,21 @@ static size_t relay_file_read_subbuf_avail(size_t read_pos,
+
+ /**
+ * relay_file_read_start_pos - find the first available byte to read
+- * @read_pos: file read position
+ * @buf: relay channel buffer
+ *
+- * If the @read_pos is in the middle of padding, return the
++ * If the read_pos is in the middle of padding, return the
+ * position of the first actually available byte, otherwise
+ * return the original value.
+ */
+-static size_t relay_file_read_start_pos(size_t read_pos,
+- struct rchan_buf *buf)
++static size_t relay_file_read_start_pos(struct rchan_buf *buf)
+ {
+ size_t read_subbuf, padding, padding_start, padding_end;
+ size_t subbuf_size = buf->chan->subbuf_size;
+ size_t n_subbufs = buf->chan->n_subbufs;
+ size_t consumed = buf->subbufs_consumed % n_subbufs;
++ size_t read_pos = (consumed * subbuf_size + buf->bytes_consumed)
++ % (n_subbufs * subbuf_size);
+
+- if (!read_pos)
+- read_pos = consumed * subbuf_size + buf->bytes_consumed;
+ read_subbuf = read_pos / subbuf_size;
+ padding = buf->padding[read_subbuf];
+ padding_start = (read_subbuf + 1) * subbuf_size - padding;
+@@ -1137,10 +1135,10 @@ static ssize_t relay_file_read(struct file *filp,
+ do {
+ void *from;
+
+- if (!relay_file_read_avail(buf, *ppos))
++ if (!relay_file_read_avail(buf))
+ break;
+
+- read_start = relay_file_read_start_pos(*ppos, buf);
++ read_start = relay_file_read_start_pos(buf);
+ avail = relay_file_read_subbuf_avail(read_start, buf);
+ if (!avail)
+ break;
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 48403fb653c2f..25c6efa2c5577 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -199,6 +199,11 @@ static bool check_tick_dependency(atomic_t *dep)
+ return true;
+ }
+
++ if (val & TICK_DEP_MASK_RCU) {
++ trace_tick_stop(0, TICK_DEP_MASK_RCU);
++ return true;
++ }
++
+ return false;
+ }
+
+@@ -325,6 +330,7 @@ void tick_nohz_dep_set_cpu(int cpu, enum tick_dep_bits bit)
+ preempt_enable();
+ }
+ }
++EXPORT_SYMBOL_GPL(tick_nohz_dep_set_cpu);
+
+ void tick_nohz_dep_clear_cpu(int cpu, enum tick_dep_bits bit)
+ {
+@@ -332,6 +338,7 @@ void tick_nohz_dep_clear_cpu(int cpu, enum tick_dep_bits bit)
+
+ atomic_andnot(BIT(bit), &ts->tick_dep_mask);
+ }
++EXPORT_SYMBOL_GPL(tick_nohz_dep_clear_cpu);
+
+ /*
+ * Set a per-task tick dependency. Posix CPU timers need this in order to elapse
+@@ -399,7 +406,7 @@ void __init tick_nohz_full_setup(cpumask_var_t cpumask)
+ tick_nohz_full_running = true;
+ }
+
+-static int tick_nohz_cpu_down(unsigned int cpu)
++bool tick_nohz_cpu_hotpluggable(unsigned int cpu)
+ {
+ /*
+ * The boot CPU handles housekeeping duty (unbound timers,
+@@ -407,8 +414,13 @@ static int tick_nohz_cpu_down(unsigned int cpu)
+ * CPUs. It must remain online when nohz full is enabled.
+ */
+ if (tick_nohz_full_running && tick_do_timer_cpu == cpu)
+- return -EBUSY;
+- return 0;
++ return false;
++ return true;
++}
++
++static int tick_nohz_cpu_down(unsigned int cpu)
++{
++ return tick_nohz_cpu_hotpluggable(cpu) ? 0 : -EBUSY;
+ }
+
+ void __init tick_nohz_init(void)
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 37fade5101ee2..ba8b72f9cdc0b 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -1326,6 +1326,8 @@ static void rb_free_cpu_buffer(struct ring_buffer_per_cpu *cpu_buffer)
+ struct list_head *head = cpu_buffer->pages;
+ struct buffer_page *bpage, *tmp;
+
++ irq_work_sync(&cpu_buffer->irq_work.work);
++
+ free_buffer_page(cpu_buffer->reader_page);
+
+ if (head) {
+@@ -1431,6 +1433,8 @@ ring_buffer_free(struct ring_buffer *buffer)
+
+ cpuhp_state_remove_instance(CPUHP_TRACE_RB_PREPARE, &buffer->node);
+
++ irq_work_sync(&buffer->irq_work.work);
++
+ for_each_buffer_cpu(buffer, cpu)
+ rb_free_cpu_buffer(buffer->buffers[cpu]);
+
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 14afeeb7d6ef5..5f23d896df55a 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -25,6 +25,7 @@
+
+ #define ODEBUG_POOL_SIZE 1024
+ #define ODEBUG_POOL_MIN_LEVEL 256
++#define ODEBUG_POOL_PERCPU_SIZE 64
+
+ #define ODEBUG_CHUNK_SHIFT PAGE_SHIFT
+ #define ODEBUG_CHUNK_SIZE (1 << ODEBUG_CHUNK_SHIFT)
+@@ -35,6 +36,17 @@ struct debug_bucket {
+ raw_spinlock_t lock;
+ };
+
++/*
++ * Debug object percpu free list
++ * Access is protected by disabling irq
++ */
++struct debug_percpu_free {
++ struct hlist_head free_objs;
++ int obj_free;
++};
++
++static DEFINE_PER_CPU(struct debug_percpu_free, percpu_obj_pool);
++
+ static struct debug_bucket obj_hash[ODEBUG_HASH_SIZE];
+
+ static struct debug_obj obj_static_pool[ODEBUG_POOL_SIZE] __initdata;
+@@ -44,13 +56,19 @@ static DEFINE_RAW_SPINLOCK(pool_lock);
+ static HLIST_HEAD(obj_pool);
+ static HLIST_HEAD(obj_to_free);
+
++/*
++ * Because of the presence of percpu free pools, obj_pool_free will
++ * under-count those in the percpu free pools. Similarly, obj_pool_used
++ * will over-count those in the percpu free pools. Adjustments will be
++ * made at debug_stats_show(). Both obj_pool_min_free and obj_pool_max_used
++ * can be off.
++ */
+ static int obj_pool_min_free = ODEBUG_POOL_SIZE;
+ static int obj_pool_free = ODEBUG_POOL_SIZE;
+ static int obj_pool_used;
+ static int obj_pool_max_used;
+ /* The number of objs on the global free list */
+ static int obj_nr_tofree;
+-static struct kmem_cache *obj_cache;
+
+ static int debug_objects_maxchain __read_mostly;
+ static int __maybe_unused debug_objects_maxchecked __read_mostly;
+@@ -63,6 +81,7 @@ static int debug_objects_pool_size __read_mostly
+ static int debug_objects_pool_min_level __read_mostly
+ = ODEBUG_POOL_MIN_LEVEL;
+ static struct debug_obj_descr *descr_test __read_mostly;
++static struct kmem_cache *obj_cache __read_mostly;
+
+ /*
+ * Track numbers of kmem_cache_alloc()/free() calls done.
+@@ -163,26 +182,38 @@ static struct debug_obj *lookup_object(void *addr, struct debug_bucket *b)
+ }
+
+ /*
+- * Allocate a new object. If the pool is empty, switch off the debugger.
+- * Must be called with interrupts disabled.
++ * Allocate a new object from the hlist
+ */
+-static struct debug_obj *
+-alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
++static struct debug_obj *__alloc_object(struct hlist_head *list)
+ {
+ struct debug_obj *obj = NULL;
+
+- raw_spin_lock(&pool_lock);
+- if (obj_pool.first) {
+- obj = hlist_entry(obj_pool.first, typeof(*obj), node);
+-
+- obj->object = addr;
+- obj->descr = descr;
+- obj->state = ODEBUG_STATE_NONE;
+- obj->astate = 0;
++ if (list->first) {
++ obj = hlist_entry(list->first, typeof(*obj), node);
+ hlist_del(&obj->node);
++ }
+
+- hlist_add_head(&obj->node, &b->list);
++ return obj;
++}
++
++static struct debug_obj *
++alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
++{
++ struct debug_percpu_free *percpu_pool;
++ struct debug_obj *obj;
++
++ if (likely(obj_cache)) {
++ percpu_pool = this_cpu_ptr(&percpu_obj_pool);
++ obj = __alloc_object(&percpu_pool->free_objs);
++ if (obj) {
++ percpu_pool->obj_free--;
++ goto init_obj;
++ }
++ }
+
++ raw_spin_lock(&pool_lock);
++ obj = __alloc_object(&obj_pool);
++ if (obj) {
+ obj_pool_used++;
+ if (obj_pool_used > obj_pool_max_used)
+ obj_pool_max_used = obj_pool_used;
+@@ -193,6 +224,14 @@ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
+ }
+ raw_spin_unlock(&pool_lock);
+
++init_obj:
++ if (obj) {
++ obj->object = addr;
++ obj->descr = descr;
++ obj->state = ODEBUG_STATE_NONE;
++ obj->astate = 0;
++ hlist_add_head(&obj->node, &b->list);
++ }
+ return obj;
+ }
+
+@@ -247,8 +286,21 @@ static bool __free_object(struct debug_obj *obj)
+ {
+ unsigned long flags;
+ bool work;
++ struct debug_percpu_free *percpu_pool;
+
+- raw_spin_lock_irqsave(&pool_lock, flags);
++ local_irq_save(flags);
++ /*
++ * Try to free it into the percpu pool first.
++ */
++ percpu_pool = this_cpu_ptr(&percpu_obj_pool);
++ if (obj_cache && percpu_pool->obj_free < ODEBUG_POOL_PERCPU_SIZE) {
++ hlist_add_head(&obj->node, &percpu_pool->free_objs);
++ percpu_pool->obj_free++;
++ local_irq_restore(flags);
++ return false;
++ }
++
++ raw_spin_lock(&pool_lock);
+ work = (obj_pool_free > debug_objects_pool_size) && obj_cache;
+ obj_pool_used--;
+
+@@ -259,7 +311,8 @@ static bool __free_object(struct debug_obj *obj)
+ obj_pool_free++;
+ hlist_add_head(&obj->node, &obj_pool);
+ }
+- raw_spin_unlock_irqrestore(&pool_lock, flags);
++ raw_spin_unlock(&pool_lock);
++ local_irq_restore(flags);
+ return work;
+ }
+
+@@ -368,6 +421,55 @@ static void debug_object_is_on_stack(void *addr, int onstack)
+ WARN_ON(1);
+ }
+
++static struct debug_obj *lookup_object_or_alloc(void *addr, struct debug_bucket *b,
++ struct debug_obj_descr *descr,
++ bool onstack, bool alloc_ifstatic)
++{
++ struct debug_obj *obj = lookup_object(addr, b);
++ enum debug_obj_state state = ODEBUG_STATE_NONE;
++
++ if (likely(obj))
++ return obj;
++
++ /*
++ * debug_object_init() unconditionally allocates untracked
++ * objects. It does not matter whether it is a static object or
++ * not.
++ *
++ * debug_object_assert_init() and debug_object_activate() allow
++ * allocation only if the descriptor callback confirms that the
++ * object is static and considered initialized. For non-static
++ * objects the allocation needs to be done from the fixup callback.
++ */
++ if (unlikely(alloc_ifstatic)) {
++ if (!descr->is_static_object || !descr->is_static_object(addr))
++ return ERR_PTR(-ENOENT);
++ /* Statically allocated objects are considered initialized */
++ state = ODEBUG_STATE_INIT;
++ }
++
++ obj = alloc_object(addr, b, descr);
++ if (likely(obj)) {
++ obj->state = state;
++ debug_object_is_on_stack(addr, onstack);
++ return obj;
++ }
++
++ /* Out of memory. Do the cleanup outside of the locked region */
++ debug_objects_enabled = 0;
++ return NULL;
++}
++
++static void debug_objects_fill_pool(void)
++{
++ /*
++ * On RT enabled kernels the pool refill must happen in preemptible
++ * context:
++ */
++ if (!IS_ENABLED(CONFIG_PREEMPT_RT) || preemptible())
++ fill_pool();
++}
++
+ static void
+ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+ {
+@@ -376,22 +478,17 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+ struct debug_obj *obj;
+ unsigned long flags;
+
+- fill_pool();
++ debug_objects_fill_pool();
+
+ db = get_bucket((unsigned long) addr);
+
+ raw_spin_lock_irqsave(&db->lock, flags);
+
+- obj = lookup_object(addr, db);
+- if (!obj) {
+- obj = alloc_object(addr, db, descr);
+- if (!obj) {
+- debug_objects_enabled = 0;
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+- debug_objects_oom();
+- return;
+- }
+- debug_object_is_on_stack(addr, onstack);
++ obj = lookup_object_or_alloc(addr, db, descr, onstack, false);
++ if (unlikely(!obj)) {
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_objects_oom();
++ return;
+ }
+
+ switch (obj->state) {
+@@ -402,15 +499,16 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+ break;
+
+ case ODEBUG_STATE_ACTIVE:
+- debug_print_object(obj, "init");
+ state = obj->state;
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_print_object(obj, "init");
+ debug_object_fixup(descr->fixup_init, addr, state);
+ return;
+
+ case ODEBUG_STATE_DESTROYED:
++ raw_spin_unlock_irqrestore(&db->lock, flags);
+ debug_print_object(obj, "init");
+- break;
++ return;
+ default:
+ break;
+ }
+@@ -455,24 +553,26 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack);
+ */
+ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+ {
++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ enum debug_obj_state state;
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+ int ret;
+- struct debug_obj o = { .object = addr,
+- .state = ODEBUG_STATE_NOTAVAILABLE,
+- .descr = descr };
+
+ if (!debug_objects_enabled)
+ return 0;
+
++ debug_objects_fill_pool();
++
+ db = get_bucket((unsigned long) addr);
+
+ raw_spin_lock_irqsave(&db->lock, flags);
+
+- obj = lookup_object(addr, db);
+- if (obj) {
++ obj = lookup_object_or_alloc(addr, db, descr, false, true);
++ if (likely(!IS_ERR_OR_NULL(obj))) {
++ bool print_object = false;
++
+ switch (obj->state) {
+ case ODEBUG_STATE_INIT:
+ case ODEBUG_STATE_INACTIVE:
+@@ -481,14 +581,14 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+ break;
+
+ case ODEBUG_STATE_ACTIVE:
+- debug_print_object(obj, "activate");
+ state = obj->state;
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_print_object(obj, "activate");
+ ret = debug_object_fixup(descr->fixup_activate, addr, state);
+ return ret ? 0 : -EINVAL;
+
+ case ODEBUG_STATE_DESTROYED:
+- debug_print_object(obj, "activate");
++ print_object = true;
+ ret = -EINVAL;
+ break;
+ default:
+@@ -496,28 +596,23 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+ break;
+ }
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (print_object)
++ debug_print_object(obj, "activate");
+ return ret;
+ }
+
+ raw_spin_unlock_irqrestore(&db->lock, flags);
+- /*
+- * We are here when a static object is activated. We
+- * let the type specific code confirm whether this is
+- * true or not. if true, we just make sure that the
+- * static object is tracked in the object tracker. If
+- * not, this must be a bug, so we try to fix it up.
+- */
+- if (descr->is_static_object && descr->is_static_object(addr)) {
+- /* track this static object */
+- debug_object_init(addr, descr);
+- debug_object_activate(addr, descr);
+- } else {
+- debug_print_object(&o, "activate");
+- ret = debug_object_fixup(descr->fixup_activate, addr,
+- ODEBUG_STATE_NOTAVAILABLE);
+- return ret ? 0 : -EINVAL;
++
++ /* If NULL the allocation has hit OOM */
++ if (!obj) {
++ debug_objects_oom();
++ return 0;
+ }
+- return 0;
++
++ /* Object is neither static nor tracked. It's not initialized */
++ debug_print_object(&o, "activate");
++ ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE);
++ return ret ? 0 : -EINVAL;
+ }
+ EXPORT_SYMBOL_GPL(debug_object_activate);
+
+@@ -531,6 +626,7 @@ void debug_object_deactivate(void *addr, struct debug_obj_descr *descr)
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
++ bool print_object = false;
+
+ if (!debug_objects_enabled)
+ return;
+@@ -548,24 +644,27 @@ void debug_object_deactivate(void *addr, struct debug_obj_descr *descr)
+ if (!obj->astate)
+ obj->state = ODEBUG_STATE_INACTIVE;
+ else
+- debug_print_object(obj, "deactivate");
++ print_object = true;
+ break;
+
+ case ODEBUG_STATE_DESTROYED:
+- debug_print_object(obj, "deactivate");
++ print_object = true;
+ break;
+ default:
+ break;
+ }
+- } else {
++ }
++
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (!obj) {
+ struct debug_obj o = { .object = addr,
+ .state = ODEBUG_STATE_NOTAVAILABLE,
+ .descr = descr };
+
+ debug_print_object(&o, "deactivate");
++ } else if (print_object) {
++ debug_print_object(obj, "deactivate");
+ }
+-
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(debug_object_deactivate);
+
+@@ -580,6 +679,7 @@ void debug_object_destroy(void *addr, struct debug_obj_descr *descr)
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
++ bool print_object = false;
+
+ if (!debug_objects_enabled)
+ return;
+@@ -599,20 +699,22 @@ void debug_object_destroy(void *addr, struct debug_obj_descr *descr)
+ obj->state = ODEBUG_STATE_DESTROYED;
+ break;
+ case ODEBUG_STATE_ACTIVE:
+- debug_print_object(obj, "destroy");
+ state = obj->state;
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_print_object(obj, "destroy");
+ debug_object_fixup(descr->fixup_destroy, addr, state);
+ return;
+
+ case ODEBUG_STATE_DESTROYED:
+- debug_print_object(obj, "destroy");
++ print_object = true;
+ break;
+ default:
+ break;
+ }
+ out_unlock:
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (print_object)
++ debug_print_object(obj, "destroy");
+ }
+ EXPORT_SYMBOL_GPL(debug_object_destroy);
+
+@@ -641,9 +743,9 @@ void debug_object_free(void *addr, struct debug_obj_descr *descr)
+
+ switch (obj->state) {
+ case ODEBUG_STATE_ACTIVE:
+- debug_print_object(obj, "free");
+ state = obj->state;
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_print_object(obj, "free");
+ debug_object_fixup(descr->fixup_free, addr, state);
+ return;
+ default:
+@@ -664,6 +766,7 @@ EXPORT_SYMBOL_GPL(debug_object_free);
+ */
+ void debug_object_assert_init(void *addr, struct debug_obj_descr *descr)
+ {
++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+@@ -671,34 +774,25 @@ void debug_object_assert_init(void *addr, struct debug_obj_descr *descr)
+ if (!debug_objects_enabled)
+ return;
+
++ debug_objects_fill_pool();
++
+ db = get_bucket((unsigned long) addr);
+
+ raw_spin_lock_irqsave(&db->lock, flags);
++ obj = lookup_object_or_alloc(addr, db, descr, false, true);
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (likely(!IS_ERR_OR_NULL(obj)))
++ return;
+
+- obj = lookup_object(addr, db);
++ /* If NULL the allocation has hit OOM */
+ if (!obj) {
+- struct debug_obj o = { .object = addr,
+- .state = ODEBUG_STATE_NOTAVAILABLE,
+- .descr = descr };
+-
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+- /*
+- * Maybe the object is static, and we let the type specific
+- * code confirm. Track this static object if true, else invoke
+- * fixup.
+- */
+- if (descr->is_static_object && descr->is_static_object(addr)) {
+- /* Track this static object */
+- debug_object_init(addr, descr);
+- } else {
+- debug_print_object(&o, "assert_init");
+- debug_object_fixup(descr->fixup_assert_init, addr,
+- ODEBUG_STATE_NOTAVAILABLE);
+- }
++ debug_objects_oom();
+ return;
+ }
+
+- raw_spin_unlock_irqrestore(&db->lock, flags);
++ /* Object is neither tracked nor static. It's not initialized. */
++ debug_print_object(&o, "assert_init");
++ debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE);
+ }
+ EXPORT_SYMBOL_GPL(debug_object_assert_init);
+
+@@ -716,6 +810,7 @@ debug_object_active_state(void *addr, struct debug_obj_descr *descr,
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
++ bool print_object = false;
+
+ if (!debug_objects_enabled)
+ return;
+@@ -731,22 +826,25 @@ debug_object_active_state(void *addr, struct debug_obj_descr *descr,
+ if (obj->astate == expect)
+ obj->astate = next;
+ else
+- debug_print_object(obj, "active_state");
++ print_object = true;
+ break;
+
+ default:
+- debug_print_object(obj, "active_state");
++ print_object = true;
+ break;
+ }
+- } else {
++ }
++
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (!obj) {
+ struct debug_obj o = { .object = addr,
+ .state = ODEBUG_STATE_NOTAVAILABLE,
+ .descr = descr };
+
+ debug_print_object(&o, "active_state");
++ } else if (print_object) {
++ debug_print_object(obj, "active_state");
+ }
+-
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(debug_object_active_state);
+
+@@ -782,10 +880,10 @@ repeat:
+
+ switch (obj->state) {
+ case ODEBUG_STATE_ACTIVE:
+- debug_print_object(obj, "free");
+ descr = obj->descr;
+ state = obj->state;
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_print_object(obj, "free");
+ debug_object_fixup(descr->fixup_free,
+ (void *) oaddr, state);
+ goto repeat;
+@@ -822,13 +920,19 @@ void debug_check_no_obj_freed(const void *address, unsigned long size)
+
+ static int debug_stats_show(struct seq_file *m, void *v)
+ {
++ int cpu, obj_percpu_free = 0;
++
++ for_each_possible_cpu(cpu)
++ obj_percpu_free += per_cpu(percpu_obj_pool.obj_free, cpu);
++
+ seq_printf(m, "max_chain :%d\n", debug_objects_maxchain);
+ seq_printf(m, "max_checked :%d\n", debug_objects_maxchecked);
+ seq_printf(m, "warnings :%d\n", debug_objects_warnings);
+ seq_printf(m, "fixups :%d\n", debug_objects_fixups);
+- seq_printf(m, "pool_free :%d\n", obj_pool_free);
++ seq_printf(m, "pool_free :%d\n", obj_pool_free + obj_percpu_free);
++ seq_printf(m, "pool_pcp_free :%d\n", obj_percpu_free);
+ seq_printf(m, "pool_min_free :%d\n", obj_pool_min_free);
+- seq_printf(m, "pool_used :%d\n", obj_pool_used);
++ seq_printf(m, "pool_used :%d\n", obj_pool_used - obj_percpu_free);
+ seq_printf(m, "pool_max_used :%d\n", obj_pool_max_used);
+ seq_printf(m, "on_free_list :%d\n", obj_nr_tofree);
+ seq_printf(m, "objs_allocated:%d\n", debug_objects_allocated);
+@@ -1177,9 +1281,20 @@ free:
+ */
+ void __init debug_objects_mem_init(void)
+ {
++ int cpu;
++
+ if (!debug_objects_enabled)
+ return;
+
++ /*
++ * Initialize the percpu object pools
++ *
++ * Initialization is not strictly necessary, but was done for
++ * completeness.
++ */
++ for_each_possible_cpu(cpu)
++ INIT_HLIST_HEAD(&per_cpu(percpu_obj_pool.free_objs, cpu));
++
+ obj_cache = kmem_cache_create("debug_objects_cache",
+ sizeof (struct debug_obj), 0,
+ SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE,
+@@ -1191,11 +1306,4 @@ void __init debug_objects_mem_init(void)
+ pr_warn("out of memory.\n");
+ } else
+ debug_objects_selftest();
+-
+- /*
+- * Increase the thresholds for allocating and freeing objects
+- * according to the number of possible CPUs available in the system.
+- */
+- debug_objects_pool_size += num_possible_cpus() * 32;
+- debug_objects_pool_min_level += num_possible_cpus() * 4;
+ }
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 1cffd4e1fd8fb..4553cc848abcf 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5425,7 +5425,21 @@ static void __build_all_zonelists(void *data)
+ int nid;
+ int __maybe_unused cpu;
+ pg_data_t *self = data;
++ unsigned long flags;
+
++ /*
++ * Explicitly disable this CPU's interrupts before taking seqlock
++ * to prevent any IRQ handler from calling into the page allocator
++ * (e.g. GFP_ATOMIC) that could hit zonelist_iter_begin and livelock.
++ */
++ local_irq_save(flags);
++ /*
++ * Explicitly disable this CPU's synchronous printk() before taking
++ * seqlock to prevent any printk() from trying to hold port->lock, for
++ * tty_insert_flip_string_and_push_buffer() on other CPU might be
++ * calling kmalloc(GFP_ATOMIC | __GFP_NOWARN) with port->lock held.
++ */
++ printk_deferred_enter();
+ write_seqlock(&zonelist_update_seq);
+
+ #ifdef CONFIG_NUMA
+@@ -5460,6 +5474,8 @@ static void __build_all_zonelists(void *data)
+ }
+
+ write_sequnlock(&zonelist_update_seq);
++ printk_deferred_exit();
++ local_irq_restore(flags);
+ }
+
+ static noinline void __init
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 84ef837721141..c80add6edf598 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -369,7 +369,7 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+
+ switch (cmd) {
+ case SIOCSHWTSTAMP:
+- if (!net_eq(dev_net(dev), &init_net))
++ if (!net_eq(dev_net(dev), dev_net(real_dev)))
+ break;
+ case SIOCGMIIPHY:
+ case SIOCGMIIREG:
+diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
+index 6908817a5a703..908a57578794e 100644
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -989,7 +989,14 @@ static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
+ if (hci_sock_gen_cookie(sk)) {
+ struct sk_buff *skb;
+
+- if (capable(CAP_NET_ADMIN))
++ /* Perform careful checks before setting the HCI_SOCK_TRUSTED
++ * flag. Make sure that not only the current task but also
++ * the socket opener has the required capability, since
++ * privileged programs can be tricked into making ioctl calls
++ * on HCI sockets, and the socket should not be marked as
++ * trusted simply because the ioctl caller is privileged.
++ */
++ if (sk_capable(sk, CAP_NET_ADMIN))
+ hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
+
+ /* Send event to monitor */
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 7f501dff4501c..5ae62d7433575 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4445,6 +4445,9 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
+ skb = alloc_skb(0, GFP_ATOMIC);
+ } else {
+ skb = skb_clone(orig_skb, GFP_ATOMIC);
++
++ if (skb_orphan_frags_rx(skb, GFP_ATOMIC))
++ return;
+ }
+ if (!skb)
+ return;
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 06a981676356c..92fa11e75a4d0 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1443,9 +1443,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
+ cork->dst = NULL;
+ skb_dst_set(skb, &rt->dst);
+
+- if (iph->protocol == IPPROTO_ICMP)
+- icmp_out_count(net, ((struct icmphdr *)
+- skb_transport_header(skb))->type);
++ if (iph->protocol == IPPROTO_ICMP) {
++ u8 icmp_type;
++
++ /* For such sockets, transhdrlen is zero when do ip_append_data(),
++ * so icmphdr does not in skb linear region and can not get icmp_type
++ * by icmp_hdr(skb)->type.
++ */
++ if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl)
++ icmp_type = fl4->fl4_icmp_type;
++ else
++ icmp_type = icmp_hdr(skb)->type;
++ icmp_out_count(net, icmp_type);
++ }
+
+ ip_cork_release(cork);
+ out:
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index df734fe64d10a..ec1de1e6b8e3c 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1053,12 +1053,13 @@ tx_err:
+
+ static void ipip6_tunnel_bind_dev(struct net_device *dev)
+ {
++ struct ip_tunnel *tunnel = netdev_priv(dev);
++ int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+ struct net_device *tdev = NULL;
+- struct ip_tunnel *tunnel;
++ int hlen = LL_MAX_HEADER;
+ const struct iphdr *iph;
+ struct flowi4 fl4;
+
+- tunnel = netdev_priv(dev);
+ iph = &tunnel->parms.iph;
+
+ if (iph->daddr) {
+@@ -1081,14 +1082,15 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
+ tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
+
+ if (tdev && !netif_is_l3_master(tdev)) {
+- int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+ int mtu;
+
+ mtu = tdev->mtu - t_hlen;
+ if (mtu < IPV6_MIN_MTU)
+ mtu = IPV6_MIN_MTU;
+ WRITE_ONCE(dev->mtu, mtu);
++ hlen = tdev->hard_header_len + tdev->needed_headroom;
+ }
++ dev->needed_headroom = t_hlen + hlen;
+ }
+
+ static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p,
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 079f768496937..e20bde9cc7b12 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3758,12 +3758,24 @@ void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
+ }
+ EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
+
++void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set)
++{
++ if (nft_set_is_anonymous(set))
++ nft_clear(ctx->net, set);
++
++ set->use++;
++}
++EXPORT_SYMBOL_GPL(nf_tables_activate_set);
++
+ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
+ struct nft_set_binding *binding,
+ enum nft_trans_phase phase)
+ {
+ switch (phase) {
+ case NFT_TRANS_PREPARE:
++ if (nft_set_is_anonymous(set))
++ nft_deactivate_next(ctx->net, set);
++
+ set->use--;
+ return;
+ case NFT_TRANS_ABORT:
+@@ -6241,6 +6253,8 @@ static int nf_tables_validate(struct net *net)
+ if (nft_table_validate(net, table) < 0)
+ return -EAGAIN;
+ }
++
++ nft_validate_state_update(net, NFT_VALIDATE_SKIP);
+ break;
+ }
+
+@@ -6767,11 +6781,6 @@ static int __nf_tables_abort(struct net *net)
+ return 0;
+ }
+
+-static void nf_tables_cleanup(struct net *net)
+-{
+- nft_validate_state_update(net, NFT_VALIDATE_SKIP);
+-}
+-
+ static int nf_tables_abort(struct net *net, struct sk_buff *skb)
+ {
+ int ret = __nf_tables_abort(net);
+@@ -6802,7 +6811,6 @@ static const struct nfnetlink_subsystem nf_tables_subsys = {
+ .cb = nf_tables_cb,
+ .commit = nf_tables_commit,
+ .abort = nf_tables_abort,
+- .cleanup = nf_tables_cleanup,
+ .valid_genid = nf_tables_valid_genid,
+ .owner = THIS_MODULE,
+ };
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index 9bacddc761ba4..39e369e18cb87 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -495,8 +495,6 @@ done:
+ } else {
+ ss->abort(net, oskb);
+ }
+- if (ss->cleanup)
+- ss->cleanup(net);
+
+ nfnl_err_deliver(&err_list, oskb);
+ kfree_skb(skb);
+diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
+index cc076d535e145..ea73130427eb8 100644
+--- a/net/netfilter/nft_dynset.c
++++ b/net/netfilter/nft_dynset.c
+@@ -248,7 +248,7 @@ static void nft_dynset_activate(const struct nft_ctx *ctx,
+ {
+ struct nft_dynset *priv = nft_expr_priv(expr);
+
+- priv->set->use++;
++ nf_tables_activate_set(ctx, priv->set);
+ }
+
+ static void nft_dynset_destroy(const struct nft_ctx *ctx,
+diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
+index 55754d9939b50..cb9e937a5ce02 100644
+--- a/net/netfilter/nft_lookup.c
++++ b/net/netfilter/nft_lookup.c
+@@ -132,7 +132,7 @@ static void nft_lookup_activate(const struct nft_ctx *ctx,
+ {
+ struct nft_lookup *priv = nft_expr_priv(expr);
+
+- priv->set->use++;
++ nf_tables_activate_set(ctx, priv->set);
+ }
+
+ static void nft_lookup_destroy(const struct nft_ctx *ctx,
+diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
+index bf92a40dd1b2d..eff2173db7e4b 100644
+--- a/net/netfilter/nft_objref.c
++++ b/net/netfilter/nft_objref.c
+@@ -182,7 +182,7 @@ static void nft_objref_map_activate(const struct nft_ctx *ctx,
+ {
+ struct nft_objref_map *priv = nft_expr_priv(expr);
+
+- priv->set->use++;
++ nf_tables_activate_set(ctx, priv->set);
+ }
+
+ static void nft_objref_map_destroy(const struct nft_ctx *ctx,
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 6a49c0aa55bda..6867158656b86 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1738,7 +1738,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ {
+ struct sock *sk = sock->sk;
+ struct netlink_sock *nlk = nlk_sk(sk);
+- int len, val, err;
++ unsigned int flag;
++ int len, val;
+
+ if (level != SOL_NETLINK)
+ return -ENOPROTOOPT;
+@@ -1750,39 +1751,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+
+ switch (optname) {
+ case NETLINK_PKTINFO:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_RECV_PKTINFO;
+ break;
+ case NETLINK_BROADCAST_ERROR:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_BROADCAST_SEND_ERROR;
+ break;
+ case NETLINK_NO_ENOBUFS:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_RECV_NO_ENOBUFS;
+ break;
+ case NETLINK_LIST_MEMBERSHIPS: {
+- int pos, idx, shift;
++ int pos, idx, shift, err = 0;
+
+- err = 0;
+ netlink_lock_table();
+ for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
+ if (len - pos < sizeof(u32))
+@@ -1799,31 +1778,29 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
+ err = -EFAULT;
+ netlink_unlock_table();
+- break;
++ return err;
+ }
+ case NETLINK_CAP_ACK:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_CAP_ACK;
+ break;
+ case NETLINK_EXT_ACK:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0;
+- if (put_user(len, optlen) || put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_EXT_ACK;
+ break;
+ default:
+- err = -ENOPROTOOPT;
++ return -ENOPROTOOPT;
+ }
+- return err;
++
++ if (len < sizeof(int))
++ return -EINVAL;
++
++ len = sizeof(int);
++ val = nlk->flags & flag ? 1 : 0;
++
++ if (put_user(len, optlen) ||
++ copy_to_user(optval, &val, len))
++ return -EFAULT;
++
++ return 0;
+ }
+
+ static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 6fa0a9a453a8b..aa12bee4133a9 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1955,7 +1955,7 @@ retry:
+ goto retry;
+ }
+
+- if (!dev_validate_header(dev, skb->data, len)) {
++ if (!dev_validate_header(dev, skb->data, len) || !skb->len) {
+ err = -EINVAL;
+ goto out_unlock;
+ }
+@@ -2105,7 +2105,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+ sll = &PACKET_SKB_CB(skb)->sa.ll;
+ sll->sll_hatype = dev->type;
+ sll->sll_pkttype = skb->pkt_type;
+- if (unlikely(po->origdev))
++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
+ sll->sll_ifindex = orig_dev->ifindex;
+ else
+ sll->sll_ifindex = dev->ifindex;
+@@ -2371,7 +2371,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ sll->sll_hatype = dev->type;
+ sll->sll_protocol = skb->protocol;
+ sll->sll_pkttype = skb->pkt_type;
+- if (unlikely(po->origdev))
++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
+ sll->sll_ifindex = orig_dev->ifindex;
+ else
+ sll->sll_ifindex = dev->ifindex;
+@@ -3444,7 +3444,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ }
+
+- if (pkt_sk(sk)->auxdata) {
++ if (packet_sock_flag(pkt_sk(sk), PACKET_SOCK_AUXDATA)) {
+ struct tpacket_auxdata aux;
+
+ aux.tp_status = TP_STATUS_USER;
+@@ -3827,9 +3827,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+- lock_sock(sk);
+- po->auxdata = !!val;
+- release_sock(sk);
++ packet_sock_flag_set(po, PACKET_SOCK_AUXDATA, val);
+ return 0;
+ }
+ case PACKET_ORIGDEV:
+@@ -3841,9 +3839,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+- lock_sock(sk);
+- po->origdev = !!val;
+- release_sock(sk);
++ packet_sock_flag_set(po, PACKET_SOCK_ORIGDEV, val);
+ return 0;
+ }
+ case PACKET_VNET_HDR:
+@@ -3973,10 +3969,10 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+
+ break;
+ case PACKET_AUXDATA:
+- val = po->auxdata;
++ val = packet_sock_flag(po, PACKET_SOCK_AUXDATA);
+ break;
+ case PACKET_ORIGDEV:
+- val = po->origdev;
++ val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV);
+ break;
+ case PACKET_VNET_HDR:
+ val = po->has_vnet_hdr;
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index 7ef1c881ae741..d9f912ad23dfa 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -22,9 +22,9 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb)
+ pinfo.pdi_flags = 0;
+ if (po->running)
+ pinfo.pdi_flags |= PDI_RUNNING;
+- if (po->auxdata)
++ if (packet_sock_flag(po, PACKET_SOCK_AUXDATA))
+ pinfo.pdi_flags |= PDI_AUXDATA;
+- if (po->origdev)
++ if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV))
+ pinfo.pdi_flags |= PDI_ORIGDEV;
+ if (po->has_vnet_hdr)
+ pinfo.pdi_flags |= PDI_VNETHDR;
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index f10294800aafb..3d871cae85b8c 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -115,10 +115,9 @@ struct packet_sock {
+ int copy_thresh;
+ spinlock_t bind_lock;
+ struct mutex pg_vec_lock;
++ unsigned long flags;
+ unsigned int running; /* bind_lock must be held */
+- unsigned int auxdata:1, /* writer must hold sock lock */
+- origdev:1,
+- has_vnet_hdr:1,
++ unsigned int has_vnet_hdr:1, /* writer must hold sock lock */
+ tp_loss:1,
+ tp_tx_has_off:1;
+ int pressure;
+@@ -142,4 +141,25 @@ static struct packet_sock *pkt_sk(struct sock *sk)
+ return (struct packet_sock *)sk;
+ }
+
++enum packet_sock_flags {
++ PACKET_SOCK_ORIGDEV,
++ PACKET_SOCK_AUXDATA,
++};
++
++static inline void packet_sock_flag_set(struct packet_sock *po,
++ enum packet_sock_flags flag,
++ bool val)
++{
++ if (val)
++ set_bit(flag, &po->flags);
++ else
++ clear_bit(flag, &po->flags);
++}
++
++static inline bool packet_sock_flag(const struct packet_sock *po,
++ enum packet_sock_flags flag)
++{
++ return test_bit(flag, &po->flags);
++}
++
+ #endif
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index a7a09eb04d93b..eaa032c498c96 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -709,7 +709,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
+ /* Fall through */
+ case 1:
+ if (p.call.timeouts.hard > 0) {
+- j = msecs_to_jiffies(p.call.timeouts.hard);
++ j = p.call.timeouts.hard * HZ;
+ now = jiffies;
+ j += now;
+ WRITE_ONCE(call->expect_term_by, j);
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index a30c17a282819..9aad86e4a0fb9 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -220,7 +220,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a,
+ goto out;
+ }
+
+- if (unlikely(!(dev->flags & IFF_UP))) {
++ if (unlikely(!(dev->flags & IFF_UP)) || !netif_carrier_ok(dev)) {
+ net_notice_ratelimited("tc mirred to Houston: device %s is down\n",
+ dev->name);
+ goto out;
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 1946bd13d5df7..e5498253ad93b 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1814,9 +1814,6 @@ call_bind_status(struct rpc_task *task)
+ status = -EOPNOTSUPP;
+ break;
+ }
+- if (task->tk_rebind_retry == 0)
+- break;
+- task->tk_rebind_retry--;
+ rpc_delay(task, 3*HZ);
+ goto retry_timeout;
+ case -ETIMEDOUT:
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index e36ae4d4b540c..9af919364a001 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -709,7 +709,6 @@ rpc_init_task_statistics(struct rpc_task *task)
+ /* Initialize retry counters */
+ task->tk_garb_retry = 2;
+ task->tk_cred_retry = 2;
+- task->tk_rebind_retry = 2;
+
+ /* starting timestamp */
+ task->tk_start = ktime_get();
+diff --git a/security/selinux/Makefile b/security/selinux/Makefile
+index c7161f8792b2d..08ba8ca81d403 100644
+--- a/security/selinux/Makefile
++++ b/security/selinux/Makefile
+@@ -19,8 +19,8 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include
+ $(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h
+
+ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h
+- cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h
++ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h
+
+ targets += flask.h av_permissions.h
+-$(obj)/flask.h: $(src)/include/classmap.h FORCE
++$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE
+ $(call if_changed,flask)
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 2001bc774c643..d27dd170bedaf 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -400,6 +400,18 @@ static int byt_rt5640_aif1_hw_params(struct snd_pcm_substream *substream,
+
+ /* Please keep this list alphabetically sorted */
+ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
++ { /* Acer Iconia One 7 B1-750 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Insyde"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "VESPA2"),
++ },
++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP |
++ BYT_RT5640_JD_SRC_JD1_IN4P |
++ BYT_RT5640_OVCD_TH_1500UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ { /* Acer Iconia Tab 8 W1-810 */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"),
+diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c
+index e883659ea6e77..19951e1dbbb01 100644
+--- a/sound/usb/caiaq/input.c
++++ b/sound/usb/caiaq/input.c
+@@ -817,6 +817,7 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev)
+
+ default:
+ /* no input methods supported on this device */
++ ret = -EINVAL;
+ goto exit_free_idev;
+ }
+
+diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c
+index c6eef76322ae9..0c38c41269bee 100644
+--- a/tools/bpf/bpftool/json_writer.c
++++ b/tools/bpf/bpftool/json_writer.c
+@@ -84,9 +84,6 @@ static void jsonw_puts(json_writer_t *self, const char *str)
+ case '"':
+ fputs("\\\"", self->out);
+ break;
+- case '\'':
+- fputs("\\\'", self->out);
+- break;
+ default:
+ putc(*str, self->out);
+ }
+diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c
+index 3284759df98ad..7f49347bf5aa4 100644
+--- a/tools/bpf/bpftool/xlated_dumper.c
++++ b/tools/bpf/bpftool/xlated_dumper.c
+@@ -336,8 +336,15 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end,
+ struct bpf_insn *insn_start = buf_start;
+ struct bpf_insn *insn_end = buf_end;
+ struct bpf_insn *cur = insn_start;
++ bool double_insn = false;
+
+ for (; cur <= insn_end; cur++) {
++ if (double_insn) {
++ double_insn = false;
++ continue;
++ }
++ double_insn = cur->code == (BPF_LD | BPF_IMM | BPF_DW);
++
+ printf("% 4d: ", (int)(cur - insn_start + start_idx));
+ print_bpf_insn(&cbs, cur, true);
+ if (cur != insn_end)
+diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
+index cbf39dab19c1a..4562e3b2f4d36 100644
+--- a/tools/perf/builtin-sched.c
++++ b/tools/perf/builtin-sched.c
+@@ -659,7 +659,7 @@ static void create_tasks(struct perf_sched *sched)
+ err = pthread_attr_init(&attr);
+ BUG_ON(err);
+ err = pthread_attr_setstacksize(&attr,
+- (size_t) max(16 * 1024, PTHREAD_STACK_MIN));
++ (size_t) max(16 * 1024, (int)PTHREAD_STACK_MIN));
+ BUG_ON(err);
+ err = pthread_mutex_lock(&sched->start_work_mutex);
+ BUG_ON(err);
+diff --git a/tools/perf/pmu-events/arch/powerpc/power9/other.json b/tools/perf/pmu-events/arch/powerpc/power9/other.json
+index 48cf4f920b3ff..064341c0df575 100644
+--- a/tools/perf/pmu-events/arch/powerpc/power9/other.json
++++ b/tools/perf/pmu-events/arch/powerpc/power9/other.json
+@@ -1417,7 +1417,7 @@
+ {,
+ "EventCode": "0x45054",
+ "EventName": "PM_FMA_CMPL",
+- "BriefDescription": "two flops operation completed (fmadd, fnmadd, fmsub, fnmsub) Scalar instructions only. "
++ "BriefDescription": "two flops operation completed (fmadd, fnmadd, fmsub, fnmsub) Scalar instructions only."
+ },
+ {,
+ "EventCode": "0x201E8",
+@@ -2017,7 +2017,7 @@
+ {,
+ "EventCode": "0xC0BC",
+ "EventName": "PM_LSU_FLUSH_OTHER",
+- "BriefDescription": "Other LSU flushes including: Sync (sync ack from L2 caused search of LRQ for oldest snooped load, This will either signal a Precise Flush of the oldest snooped loa or a Flush Next PPC); Data Valid Flush Next (several cases of this, one example is store and reload are lined up such that a store-hit-reload scenario exists and the CDF has already launched and has gotten bad/stale data); Bad Data Valid Flush Next (might be a few cases of this, one example is a larxa (D$ hit) return data and dval but can't allocate to LMQ (LMQ full or other reason). Already gave dval but can't watch it for snoop_hit_larx. Need to take the “bad dval” back and flush all younger ops)"
++ "BriefDescription": "Other LSU flushes including: Sync (sync ack from L2 caused search of LRQ for oldest snooped load, This will either signal a Precise Flush of the oldest snooped loa or a Flush Next PPC); Data Valid Flush Next (several cases of this, one example is store and reload are lined up such that a store-hit-reload scenario exists and the CDF has already launched and has gotten bad/stale data); Bad Data Valid Flush Next (might be a few cases of this, one example is a larxa (D$ hit) return data and dval but can't allocate to LMQ (LMQ full or other reason). Already gave dval but can't watch it for snoop_hit_larx. Need to take the 'bad dval' back and flush all younger ops)"
+ },
+ {,
+ "EventCode": "0x5094",
+diff --git a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
+index b4772f54a2718..e2f2ed0a35496 100644
+--- a/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
++++ b/tools/perf/pmu-events/arch/powerpc/power9/pipeline.json
+@@ -442,7 +442,7 @@
+ {,
+ "EventCode": "0x4D052",
+ "EventName": "PM_2FLOP_CMPL",
+- "BriefDescription": "DP vector version of fmul, fsub, fcmp, fsel, fabs, fnabs, fres ,fsqrte, fneg "
++ "BriefDescription": "DP vector version of fmul, fsub, fcmp, fsel, fabs, fnabs, fres ,fsqrte, fneg"
+ },
+ {,
+ "EventCode": "0x1F142",
+diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
+index 1e607403c94c1..5ae37a83dca3b 100644
+--- a/tools/perf/util/auxtrace.c
++++ b/tools/perf/util/auxtrace.c
+@@ -1793,6 +1793,7 @@ static int find_entire_kern_cb(void *arg, const char *name __maybe_unused,
+ char type, u64 start)
+ {
+ struct sym_args *args = arg;
++ u64 size;
+
+ if (!kallsyms__is_function(type))
+ return 0;
+@@ -1802,7 +1803,9 @@ static int find_entire_kern_cb(void *arg, const char *name __maybe_unused,
+ args->start = start;
+ }
+ /* Don't know exactly where the kernel ends, so we add a page */
+- args->size = round_up(start, page_size) + page_size - args->start;
++ size = round_up(start, page_size) + page_size - args->start;
++ if (size > args->size)
++ args->size = size;
+
+ return 0;
+ }
+diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
+index 85ff4f68adc00..66e11e6bb7197 100644
+--- a/tools/perf/util/sort.c
++++ b/tools/perf/util/sort.c
+@@ -735,8 +735,7 @@ static int hist_entry__dso_to_filter(struct hist_entry *he, int type,
+ static int64_t
+ sort__sym_from_cmp(struct hist_entry *left, struct hist_entry *right)
+ {
+- struct addr_map_symbol *from_l = &left->branch_info->from;
+- struct addr_map_symbol *from_r = &right->branch_info->from;
++ struct addr_map_symbol *from_l, *from_r;
+
+ if (!left->branch_info || !right->branch_info)
+ return cmp_null(left->branch_info, right->branch_info);
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 8dde4369fbcdb..227dfe33063c9 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -517,7 +517,7 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
+ size_t sz = min(size, descsz);
+ memcpy(bf, ptr, sz);
+ memset(bf + sz, 0, size - sz);
+- err = descsz;
++ err = sz;
+ break;
+ }
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-05-17 11:14 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-05-17 11:14 UTC (permalink / raw
To: gentoo-commits
commit: 962541517528f0316c76c053a09f495d204c464f
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 17 11:14:00 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 17 11:14:00 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=96254151
Remove redundant patch
Removed:
1520_fs-enable-link-security-restrictions-by-default.patch
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 -
...nf-tables-make-deleted-anon-sets-inactive.patch | 121 ---------------------
2 files changed, 125 deletions(-)
diff --git a/0000_README b/0000_README
index 6d1fb943..abe24c77 100644
--- a/0000_README
+++ b/0000_README
@@ -1183,10 +1183,6 @@ Patch: 1510_fs-enable-link-security-restrictions-by-default.patch
From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/
Desc: Enable link security restrictions by default.
-Patch: 1520_fs-enable-link-security-restrictions-by-default.patch
-From: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=c1592a89942e9678f7d9c8030efa777c0d57edab
-Desc: netfilter: nf_tables: deactivate anonymous set from preparation phase
-
Patch: 1900_fs-increase-BINPRM-BUF-SIZE-to-256.patch
From: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/exec.c?id=6eb3c3d0a52dca337e327ae8868ca1f44a712e02
Desc: exec: increase BINPRM_BUF_SIZE to 256
diff --git a/1520_nf-tables-make-deleted-anon-sets-inactive.patch b/1520_nf-tables-make-deleted-anon-sets-inactive.patch
deleted file mode 100644
index cd75de5c..00000000
--- a/1520_nf-tables-make-deleted-anon-sets-inactive.patch
+++ /dev/null
@@ -1,121 +0,0 @@
-From c1592a89942e9678f7d9c8030efa777c0d57edab Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Tue, 2 May 2023 10:25:24 +0200
-Subject: netfilter: nf_tables: deactivate anonymous set from preparation phase
-
-Toggle deleted anonymous sets as inactive in the next generation, so
-users cannot perform any update on it. Clear the generation bitmask
-in case the transaction is aborted.
-
-The following KASAN splat shows a set element deletion for a bound
-anonymous set that has been already removed in the same transaction.
-
-[ 64.921510] ==================================================================
-[ 64.923123] BUG: KASAN: wild-memory-access in nf_tables_commit+0xa24/0x1490 [nf_tables]
-[ 64.924745] Write of size 8 at addr dead000000000122 by task test/890
-[ 64.927903] CPU: 3 PID: 890 Comm: test Not tainted 6.3.0+ #253
-[ 64.931120] Call Trace:
-[ 64.932699] <TASK>
-[ 64.934292] dump_stack_lvl+0x33/0x50
-[ 64.935908] ? nf_tables_commit+0xa24/0x1490 [nf_tables]
-[ 64.937551] kasan_report+0xda/0x120
-[ 64.939186] ? nf_tables_commit+0xa24/0x1490 [nf_tables]
-[ 64.940814] nf_tables_commit+0xa24/0x1490 [nf_tables]
-[ 64.942452] ? __kasan_slab_alloc+0x2d/0x60
-[ 64.944070] ? nf_tables_setelem_notify+0x190/0x190 [nf_tables]
-[ 64.945710] ? kasan_set_track+0x21/0x30
-[ 64.947323] nfnetlink_rcv_batch+0x709/0xd90 [nfnetlink]
-[ 64.948898] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink]
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
- include/net/netfilter/nf_tables.h | 1 +
- net/netfilter/nf_tables_api.c | 12 ++++++++++++
- net/netfilter/nft_dynset.c | 2 +-
- net/netfilter/nft_lookup.c | 2 +-
- net/netfilter/nft_objref.c | 2 +-
- 5 files changed, 16 insertions(+), 3 deletions(-)
-
-diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
-index 3ed21d2d56590..2e24ea1d744c2 100644
---- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -619,6 +619,7 @@ struct nft_set_binding {
- };
-
- enum nft_trans_phase;
-+void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set);
- void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
- struct nft_set_binding *binding,
- enum nft_trans_phase phase);
-diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
-index 8b6c61a2196cb..59fb8320ab4d7 100644
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -5127,12 +5127,24 @@ static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
- }
- }
-
-+void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set)
-+{
-+ if (nft_set_is_anonymous(set))
-+ nft_clear(ctx->net, set);
-+
-+ set->use++;
-+}
-+EXPORT_SYMBOL_GPL(nf_tables_activate_set);
-+
- void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
- struct nft_set_binding *binding,
- enum nft_trans_phase phase)
- {
- switch (phase) {
- case NFT_TRANS_PREPARE:
-+ if (nft_set_is_anonymous(set))
-+ nft_deactivate_next(ctx->net, set);
-+
- set->use--;
- return;
- case NFT_TRANS_ABORT:
-diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
-index 274579b1696e0..bd19c7aec92ee 100644
---- a/net/netfilter/nft_dynset.c
-+++ b/net/netfilter/nft_dynset.c
-@@ -342,7 +342,7 @@ static void nft_dynset_activate(const struct nft_ctx *ctx,
- {
- struct nft_dynset *priv = nft_expr_priv(expr);
-
-- priv->set->use++;
-+ nf_tables_activate_set(ctx, priv->set);
- }
-
- static void nft_dynset_destroy(const struct nft_ctx *ctx,
-diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
-index cecf8ab90e58f..03ef4fdaa460b 100644
---- a/net/netfilter/nft_lookup.c
-+++ b/net/netfilter/nft_lookup.c
-@@ -167,7 +167,7 @@ static void nft_lookup_activate(const struct nft_ctx *ctx,
- {
- struct nft_lookup *priv = nft_expr_priv(expr);
-
-- priv->set->use++;
-+ nf_tables_activate_set(ctx, priv->set);
- }
-
- static void nft_lookup_destroy(const struct nft_ctx *ctx,
-diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
-index cb37169608bab..a48dd5b5d45b1 100644
---- a/net/netfilter/nft_objref.c
-+++ b/net/netfilter/nft_objref.c
-@@ -185,7 +185,7 @@ static void nft_objref_map_activate(const struct nft_ctx *ctx,
- {
- struct nft_objref_map *priv = nft_expr_priv(expr);
-
-- priv->set->use++;
-+ nf_tables_activate_set(ctx, priv->set);
- }
-
- static void nft_objref_map_destroy(const struct nft_ctx *ctx,
---
-cgit
-
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-05-30 12:57 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-05-30 12:57 UTC (permalink / raw
To: gentoo-commits
commit: f53c1c0767dda01dc5015027395842d1b82011a8
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue May 30 12:57:10 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue May 30 12:57:10 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f53c1c07
Linux patch 4.19.284
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1283_linux-4.19.284.patch | 6252 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6256 insertions(+)
diff --git a/0000_README b/0000_README
index abe24c77..e047ddc0 100644
--- a/0000_README
+++ b/0000_README
@@ -1175,6 +1175,10 @@ Patch: 1282_linux-4.19.283.patch
From: https://www.kernel.org
Desc: Linux 4.19.283
+Patch: 1283_linux-4.19.284.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.284
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1283_linux-4.19.284.patch b/1283_linux-4.19.284.patch
new file mode 100644
index 00000000..09a5ad00
--- /dev/null
+++ b/1283_linux-4.19.284.patch
@@ -0,0 +1,6252 @@
+diff --git a/Makefile b/Makefile
+index 71416fde73483..8d8803054d78c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 283
++SUBLEVEL = 284
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/m68k/kernel/signal.c b/arch/m68k/kernel/signal.c
+index c67a68b6b69d1..d08c771b59c1c 100644
+--- a/arch/m68k/kernel/signal.c
++++ b/arch/m68k/kernel/signal.c
+@@ -882,11 +882,17 @@ static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs *
+ }
+
+ static inline void __user *
+-get_sigframe(struct ksignal *ksig, size_t frame_size)
++get_sigframe(struct ksignal *ksig, struct pt_regs *tregs, size_t frame_size)
+ {
+ unsigned long usp = sigsp(rdusp(), ksig);
++ unsigned long gap = 0;
+
+- return (void __user *)((usp - frame_size) & -8UL);
++ if (CPU_IS_020_OR_030 && tregs->format == 0xb) {
++ /* USP is unreliable so use worst-case value */
++ gap = 256;
++ }
++
++ return (void __user *)((usp - gap - frame_size) & -8UL);
+ }
+
+ static int setup_frame(struct ksignal *ksig, sigset_t *set,
+@@ -904,7 +910,7 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set,
+ return -EFAULT;
+ }
+
+- frame = get_sigframe(ksig, sizeof(*frame) + fsize);
++ frame = get_sigframe(ksig, tregs, sizeof(*frame) + fsize);
+
+ if (fsize)
+ err |= copy_to_user (frame + 1, regs + 1, fsize);
+@@ -975,7 +981,7 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
+ return -EFAULT;
+ }
+
+- frame = get_sigframe(ksig, sizeof(*frame));
++ frame = get_sigframe(ksig, tregs, sizeof(*frame));
+
+ if (fsize)
+ err |= copy_to_user (&frame->uc.uc_extra, regs + 1, fsize);
+diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h
+index 0c83644bfa5cb..b4076ac51005e 100644
+--- a/arch/parisc/include/asm/cacheflush.h
++++ b/arch/parisc/include/asm/cacheflush.h
+@@ -57,6 +57,11 @@ extern void flush_dcache_page(struct page *page);
+
+ #define flush_dcache_mmap_lock(mapping) xa_lock_irq(&mapping->i_pages)
+ #define flush_dcache_mmap_unlock(mapping) xa_unlock_irq(&mapping->i_pages)
++#define flush_dcache_mmap_lock_irqsave(mapping, flags) \
++ xa_lock_irqsave(&mapping->i_pages, flags)
++#define flush_dcache_mmap_unlock_irqrestore(mapping, flags) \
++ xa_unlock_irqrestore(&mapping->i_pages, flags)
++
+
+ #define flush_icache_page(vma,page) do { \
+ flush_kernel_dcache_page(page); \
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index bddd2acebdcc8..d03a5df7589f1 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -309,6 +309,7 @@ void flush_dcache_page(struct page *page)
+ struct vm_area_struct *mpnt;
+ unsigned long offset;
+ unsigned long addr, old_addr = 0;
++ unsigned long flags;
+ pgoff_t pgoff;
+
+ if (mapping && !mapping_mapped(mapping)) {
+@@ -328,7 +329,7 @@ void flush_dcache_page(struct page *page)
+ * declared as MAP_PRIVATE or MAP_SHARED), so we only need
+ * to flush one address here for them all to become coherent */
+
+- flush_dcache_mmap_lock(mapping);
++ flush_dcache_mmap_lock_irqsave(mapping, flags);
+ vma_interval_tree_foreach(mpnt, &mapping->i_mmap, pgoff, pgoff) {
+ offset = (pgoff - mpnt->vm_pgoff) << PAGE_SHIFT;
+ addr = mpnt->vm_start + offset;
+@@ -351,7 +352,7 @@ void flush_dcache_page(struct page *page)
+ old_addr = addr;
+ }
+ }
+- flush_dcache_mmap_unlock(mapping);
++ flush_dcache_mmap_unlock_irqrestore(mapping, flags);
+ }
+ EXPORT_SYMBOL(flush_dcache_page);
+
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index 97c206734e24f..80592603caaa7 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -138,13 +138,18 @@ void machine_power_off(void)
+ /* It seems we have no way to power the system off via
+ * software. The user has to press the button himself. */
+
+- printk(KERN_EMERG "System shut down completed.\n"
+- "Please power this system off now.");
++ printk("Power off or press RETURN to reboot.\n");
+
+ /* prevent soft lockup/stalled CPU messages for endless loop. */
+ rcu_sysrq_start();
+ lockup_detector_soft_poweroff();
+- for (;;);
++ while (1) {
++ /* reboot if user presses RETURN key */
++ if (pdc_iodc_getc() == 13) {
++ printk("Rebooting...\n");
++ machine_restart(NULL);
++ }
++ }
+ }
+
+ void (*pm_power_off)(void);
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 1f2f52a340868..ccf07426a84df 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -74,6 +74,11 @@
+ #define INTEL_FAM6_LAKEFIELD 0x8A
+ #define INTEL_FAM6_ALDERLAKE 0x97
+ #define INTEL_FAM6_ALDERLAKE_L 0x9A
++#define INTEL_FAM6_ALDERLAKE_N 0xBE
++
++#define INTEL_FAM6_RAPTORLAKE 0xB7
++#define INTEL_FAM6_RAPTORLAKE_P 0xBA
++#define INTEL_FAM6_RAPTORLAKE_S 0xBF
+
+ /* "Small Core" Processors (Atom) */
+
+diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
+index 2b17a5cec0997..7e698c45760cf 100644
+--- a/arch/x86/kernel/dumpstack.c
++++ b/arch/x86/kernel/dumpstack.c
+@@ -171,7 +171,6 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
+ printk("%sCall Trace:\n", log_lvl);
+
+ unwind_start(&state, task, regs, stack);
+- stack = stack ? : get_stack_pointer(task, regs);
+ regs = unwind_get_entry_regs(&state, &partial);
+
+ /*
+@@ -190,9 +189,13 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
+ * - hardirq stack
+ * - entry stack
+ */
+- for ( ; stack; stack = PTR_ALIGN(stack_info.next_sp, sizeof(long))) {
++ for (stack = stack ?: get_stack_pointer(task, regs);
++ stack;
++ stack = stack_info.next_sp) {
+ const char *stack_name;
+
++ stack = PTR_ALIGN(stack, sizeof(long));
++
+ if (get_stack_info(stack, task, &stack_info, &visit_mask)) {
+ /*
+ * We weren't on a valid stack. It's possible that
+diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
+index b1dba0987565e..2c84c5595cf46 100644
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -9,6 +9,7 @@
+ #include <linux/kmemleak.h>
+
+ #include <asm/set_memory.h>
++#include <asm/cpu_device_id.h>
+ #include <asm/e820/api.h>
+ #include <asm/init.h>
+ #include <asm/page.h>
+@@ -207,6 +208,24 @@ static void __init probe_page_size_mask(void)
+ }
+ }
+
++#define INTEL_MATCH(_model) { .vendor = X86_VENDOR_INTEL, \
++ .family = 6, \
++ .model = _model, \
++ }
++/*
++ * INVLPG may not properly flush Global entries
++ * on these CPUs when PCIDs are enabled.
++ */
++static const struct x86_cpu_id invlpg_miss_ids[] = {
++ INTEL_MATCH(INTEL_FAM6_ALDERLAKE ),
++ INTEL_MATCH(INTEL_FAM6_ALDERLAKE_L ),
++ INTEL_MATCH(INTEL_FAM6_ALDERLAKE_N ),
++ INTEL_MATCH(INTEL_FAM6_RAPTORLAKE ),
++ INTEL_MATCH(INTEL_FAM6_RAPTORLAKE_P),
++ INTEL_MATCH(INTEL_FAM6_RAPTORLAKE_S),
++ {}
++};
++
+ static void setup_pcid(void)
+ {
+ if (!IS_ENABLED(CONFIG_X86_64))
+@@ -215,6 +234,12 @@ static void setup_pcid(void)
+ if (!boot_cpu_has(X86_FEATURE_PCID))
+ return;
+
++ if (x86_match_cpu(invlpg_miss_ids)) {
++ pr_info("Incomplete global flushes, disabling PCID");
++ setup_clear_cpu_cap(X86_FEATURE_PCID);
++ return;
++ }
++
+ if (boot_cpu_has(X86_FEATURE_PGE)) {
+ /*
+ * This can't be cr4_set_bits_and_update_boot() -- the
+diff --git a/drivers/acpi/acpica/dbnames.c b/drivers/acpi/acpica/dbnames.c
+index 992bd7b92540d..49afba8c916a7 100644
+--- a/drivers/acpi/acpica/dbnames.c
++++ b/drivers/acpi/acpica/dbnames.c
+@@ -571,6 +571,9 @@ acpi_status acpi_db_display_objects(char *obj_type_arg, char *display_count_arg)
+ object_info =
+ ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_object_info));
+
++ if (!object_info)
++ return (AE_NO_MEMORY);
++
+ /* Walk the namespace from the root */
+
+ (void)acpi_walk_namespace(ACPI_TYPE_ANY, ACPI_ROOT_OBJECT,
+diff --git a/drivers/acpi/acpica/dswstate.c b/drivers/acpi/acpica/dswstate.c
+index c879380e5ce17..ddafbf44158c8 100644
+--- a/drivers/acpi/acpica/dswstate.c
++++ b/drivers/acpi/acpica/dswstate.c
+@@ -576,9 +576,14 @@ acpi_ds_init_aml_walk(struct acpi_walk_state *walk_state,
+ ACPI_FUNCTION_TRACE(ds_init_aml_walk);
+
+ walk_state->parser_state.aml =
+- walk_state->parser_state.aml_start = aml_start;
+- walk_state->parser_state.aml_end =
+- walk_state->parser_state.pkg_end = aml_start + aml_length;
++ walk_state->parser_state.aml_start =
++ walk_state->parser_state.aml_end =
++ walk_state->parser_state.pkg_end = aml_start;
++ /* Avoid undefined behavior: applying zero offset to null pointer */
++ if (aml_length != 0) {
++ walk_state->parser_state.aml_end += aml_length;
++ walk_state->parser_state.pkg_end += aml_length;
++ }
+
+ /* The next_op of the next_walk will be the beginning of the method */
+
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 3394ec64fe95d..d2fde87e4d0d4 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -1153,6 +1153,7 @@ static void acpi_ec_remove_query_handlers(struct acpi_ec *ec,
+ void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit)
+ {
+ acpi_ec_remove_query_handlers(ec, false, query_bit);
++ flush_workqueue(ec_query_wq);
+ }
+ EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler);
+
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 349c2754eed78..2f89e618b142c 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -80,6 +80,26 @@ struct resource *platform_get_resource(struct platform_device *dev,
+ }
+ EXPORT_SYMBOL_GPL(platform_get_resource);
+
++/**
++ * devm_platform_ioremap_resource - call devm_ioremap_resource() for a platform
++ * device
++ *
++ * @pdev: platform device to use both for memory resource lookup as well as
++ * resource managemend
++ * @index: resource index
++ */
++#ifdef CONFIG_HAS_IOMEM
++void __iomem *devm_platform_ioremap_resource(struct platform_device *pdev,
++ unsigned int index)
++{
++ struct resource *res;
++
++ res = platform_get_resource(pdev, IORESOURCE_MEM, index);
++ return devm_ioremap_resource(&pdev->dev, res);
++}
++EXPORT_SYMBOL_GPL(devm_platform_ioremap_resource);
++#endif /* CONFIG_HAS_IOMEM */
++
+ /**
+ * platform_get_irq - get an IRQ for a device
+ * @dev: platform device
+diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
+index 773560348337f..b78e4b6e2c9da 100644
+--- a/drivers/base/regmap/regcache.c
++++ b/drivers/base/regmap/regcache.c
+@@ -347,6 +347,9 @@ int regcache_sync(struct regmap *map)
+ const char *name;
+ bool bypass;
+
++ if (WARN_ON(map->cache_type == REGCACHE_NONE))
++ return -EINVAL;
++
+ BUG_ON(!map->cache_ops);
+
+ map->lock(map->lock_arg);
+@@ -416,6 +419,9 @@ int regcache_sync_region(struct regmap *map, unsigned int min,
+ const char *name;
+ bool bypass;
+
++ if (WARN_ON(map->cache_type == REGCACHE_NONE))
++ return -EINVAL;
++
+ BUG_ON(!map->cache_ops);
+
+ map->lock(map->lock_arg);
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index 939dc25a78336..3abb4af80be68 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -87,6 +87,22 @@ static const struct dmi_system_id tpm_tis_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T490s"),
+ },
+ },
++ {
++ .callback = tpm_tis_disable_irq,
++ .ident = "ThinkStation P360 Tiny",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkStation P360 Tiny"),
++ },
++ },
++ {
++ .callback = tpm_tis_disable_irq,
++ .ident = "ThinkPad L490",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L490"),
++ },
++ },
+ {}
+ };
+
+diff --git a/drivers/clk/tegra/clk-tegra20.c b/drivers/clk/tegra/clk-tegra20.c
+index 5859b8ee14781..3d39a6dc23813 100644
+--- a/drivers/clk/tegra/clk-tegra20.c
++++ b/drivers/clk/tegra/clk-tegra20.c
+@@ -29,24 +29,24 @@
+ #define MISC_CLK_ENB 0x48
+
+ #define OSC_CTRL 0x50
+-#define OSC_CTRL_OSC_FREQ_MASK (3<<30)
+-#define OSC_CTRL_OSC_FREQ_13MHZ (0<<30)
+-#define OSC_CTRL_OSC_FREQ_19_2MHZ (1<<30)
+-#define OSC_CTRL_OSC_FREQ_12MHZ (2<<30)
+-#define OSC_CTRL_OSC_FREQ_26MHZ (3<<30)
+-#define OSC_CTRL_MASK (0x3f2 | OSC_CTRL_OSC_FREQ_MASK)
+-
+-#define OSC_CTRL_PLL_REF_DIV_MASK (3<<28)
+-#define OSC_CTRL_PLL_REF_DIV_1 (0<<28)
+-#define OSC_CTRL_PLL_REF_DIV_2 (1<<28)
+-#define OSC_CTRL_PLL_REF_DIV_4 (2<<28)
++#define OSC_CTRL_OSC_FREQ_MASK (3u<<30)
++#define OSC_CTRL_OSC_FREQ_13MHZ (0u<<30)
++#define OSC_CTRL_OSC_FREQ_19_2MHZ (1u<<30)
++#define OSC_CTRL_OSC_FREQ_12MHZ (2u<<30)
++#define OSC_CTRL_OSC_FREQ_26MHZ (3u<<30)
++#define OSC_CTRL_MASK (0x3f2u | OSC_CTRL_OSC_FREQ_MASK)
++
++#define OSC_CTRL_PLL_REF_DIV_MASK (3u<<28)
++#define OSC_CTRL_PLL_REF_DIV_1 (0u<<28)
++#define OSC_CTRL_PLL_REF_DIV_2 (1u<<28)
++#define OSC_CTRL_PLL_REF_DIV_4 (2u<<28)
+
+ #define OSC_FREQ_DET 0x58
+-#define OSC_FREQ_DET_TRIG (1<<31)
++#define OSC_FREQ_DET_TRIG (1u<<31)
+
+ #define OSC_FREQ_DET_STATUS 0x5c
+-#define OSC_FREQ_DET_BUSY (1<<31)
+-#define OSC_FREQ_DET_CNT_MASK 0xFFFF
++#define OSC_FREQ_DET_BUSYu (1<<31)
++#define OSC_FREQ_DET_CNT_MASK 0xFFFFu
+
+ #define TEGRA20_CLK_PERIPH_BANKS 3
+
+diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
+index e809f4d9a9e93..ea2c2bdcf4f7f 100644
+--- a/drivers/firmware/arm_sdei.c
++++ b/drivers/firmware/arm_sdei.c
+@@ -43,6 +43,8 @@ static asmlinkage void (*sdei_firmware_call)(unsigned long function_id,
+ /* entry point from firmware to arch asm code */
+ static unsigned long sdei_entry_point;
+
++static int sdei_hp_state;
++
+ struct sdei_event {
+ /* These three are protected by the sdei_list_lock */
+ struct list_head list;
+@@ -303,8 +305,6 @@ int sdei_mask_local_cpu(void)
+ {
+ int err;
+
+- WARN_ON_ONCE(preemptible());
+-
+ err = invoke_sdei_fn(SDEI_1_0_FN_SDEI_PE_MASK, 0, 0, 0, 0, 0, NULL);
+ if (err && err != -EIO) {
+ pr_warn_once("failed to mask CPU[%u]: %d\n",
+@@ -317,6 +317,7 @@ int sdei_mask_local_cpu(void)
+
+ static void _ipi_mask_cpu(void *ignored)
+ {
++ WARN_ON_ONCE(preemptible());
+ sdei_mask_local_cpu();
+ }
+
+@@ -324,8 +325,6 @@ int sdei_unmask_local_cpu(void)
+ {
+ int err;
+
+- WARN_ON_ONCE(preemptible());
+-
+ err = invoke_sdei_fn(SDEI_1_0_FN_SDEI_PE_UNMASK, 0, 0, 0, 0, 0, NULL);
+ if (err && err != -EIO) {
+ pr_warn_once("failed to unmask CPU[%u]: %d\n",
+@@ -338,6 +337,7 @@ int sdei_unmask_local_cpu(void)
+
+ static void _ipi_unmask_cpu(void *ignored)
+ {
++ WARN_ON_ONCE(preemptible());
+ sdei_unmask_local_cpu();
+ }
+
+@@ -345,6 +345,8 @@ static void _ipi_private_reset(void *ignored)
+ {
+ int err;
+
++ WARN_ON_ONCE(preemptible());
++
+ err = invoke_sdei_fn(SDEI_1_0_FN_SDEI_PRIVATE_RESET, 0, 0, 0, 0, 0,
+ NULL);
+ if (err && err != -EIO)
+@@ -391,8 +393,6 @@ static void _local_event_enable(void *data)
+ int err;
+ struct sdei_crosscall_args *arg = data;
+
+- WARN_ON_ONCE(preemptible());
+-
+ err = sdei_api_event_enable(arg->event->event_num);
+
+ sdei_cross_call_return(arg, err);
+@@ -483,8 +483,6 @@ static void _local_event_unregister(void *data)
+ int err;
+ struct sdei_crosscall_args *arg = data;
+
+- WARN_ON_ONCE(preemptible());
+-
+ err = sdei_api_event_unregister(arg->event->event_num);
+
+ sdei_cross_call_return(arg, err);
+@@ -573,8 +571,6 @@ static void _local_event_register(void *data)
+ struct sdei_registered_event *reg;
+ struct sdei_crosscall_args *arg = data;
+
+- WARN_ON(preemptible());
+-
+ reg = per_cpu_ptr(arg->event->private_registered, smp_processor_id());
+ err = sdei_api_event_register(arg->event->event_num, sdei_entry_point,
+ reg, 0, 0);
+@@ -754,6 +750,8 @@ static int sdei_pm_notifier(struct notifier_block *nb, unsigned long action,
+ {
+ int rv;
+
++ WARN_ON_ONCE(preemptible());
++
+ switch (action) {
+ case CPU_PM_ENTER:
+ rv = sdei_mask_local_cpu();
+@@ -802,7 +800,7 @@ static int sdei_device_freeze(struct device *dev)
+ int err;
+
+ /* unregister private events */
+- cpuhp_remove_state(CPUHP_AP_ARM_SDEI_STARTING);
++ cpuhp_remove_state(sdei_entry_point);
+
+ err = sdei_unregister_shared();
+ if (err)
+@@ -823,12 +821,15 @@ static int sdei_device_thaw(struct device *dev)
+ return err;
+ }
+
+- err = cpuhp_setup_state(CPUHP_AP_ARM_SDEI_STARTING, "SDEI",
++ err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "SDEI",
+ &sdei_cpuhp_up, &sdei_cpuhp_down);
+- if (err)
++ if (err < 0) {
+ pr_warn("Failed to re-register CPU hotplug notifier...\n");
++ return err;
++ }
+
+- return err;
++ sdei_hp_state = err;
++ return 0;
+ }
+
+ static int sdei_device_restore(struct device *dev)
+@@ -860,7 +861,7 @@ static int sdei_reboot_notifier(struct notifier_block *nb, unsigned long action,
+ * We are going to reset the interface, after this there is no point
+ * doing work when we take CPUs offline.
+ */
+- cpuhp_remove_state(CPUHP_AP_ARM_SDEI_STARTING);
++ cpuhp_remove_state(sdei_hp_state);
+
+ sdei_platform_reset();
+
+@@ -973,13 +974,15 @@ static int sdei_probe(struct platform_device *pdev)
+ goto remove_cpupm;
+ }
+
+- err = cpuhp_setup_state(CPUHP_AP_ARM_SDEI_STARTING, "SDEI",
++ err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "SDEI",
+ &sdei_cpuhp_up, &sdei_cpuhp_down);
+- if (err) {
++ if (err < 0) {
+ pr_warn("Failed to register CPU hotplug notifier...\n");
+ goto remove_reboot;
+ }
+
++ sdei_hp_state = err;
++
+ return 0;
+
+ remove_reboot:
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index 6fd57cfb112f5..96fdc18ecb3bf 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -778,7 +778,7 @@ static void dce_transform_set_pixel_storage_depth(
+ color_depth = COLOR_DEPTH_101010;
+ pixel_depth = 0;
+ expan_mode = 1;
+- BREAK_TO_DEBUGGER();
++ DC_LOG_DC("The pixel depth %d is not valid, set COLOR_DEPTH_101010 instead.", depth);
+ break;
+ }
+
+@@ -792,8 +792,7 @@ static void dce_transform_set_pixel_storage_depth(
+ if (!(xfm_dce->lb_pixel_depth_supported & depth)) {
+ /*we should use unsupported capabilities
+ * unless it is required by w/a*/
+- DC_LOG_WARNING("%s: Capability not supported",
+- __func__);
++ DC_LOG_DC("%s: Capability not supported", __func__);
+ }
+ }
+
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.h b/drivers/gpu/drm/exynos/exynos_drm_g2d.h
+index 287b2ed8f1782..60e420cd4caaa 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.h
++++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.h
+@@ -37,11 +37,11 @@ static inline int exynos_g2d_exec_ioctl(struct drm_device *dev, void *data,
+ return -ENODEV;
+ }
+
+-int g2d_open(struct drm_device *drm_dev, struct drm_file *file)
++static inline int g2d_open(struct drm_device *drm_dev, struct drm_file *file)
+ {
+ return 0;
+ }
+
+-void g2d_close(struct drm_device *drm_dev, struct drm_file *file)
++static inline void g2d_close(struct drm_device *drm_dev, struct drm_file *file)
+ { }
+ #endif
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index 83108e2430501..adc191ec26a99 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -829,7 +829,7 @@ static int tegra_sor_compute_config(struct tegra_sor *sor,
+ struct drm_dp_link *link)
+ {
+ const u64 f = 100000, link_rate = link->rate * 1000;
+- const u64 pclk = mode->clock * 1000;
++ const u64 pclk = (u64)mode->clock * 1000;
+ u64 input, output, watermark, num;
+ struct tegra_sor_params params;
+ u32 num_syms_per_line;
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 504e8917b06f3..5b6bb24df63e0 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -675,8 +675,7 @@ static int hidpp_unifying_init(struct hidpp_device *hidpp)
+ if (ret)
+ return ret;
+
+- snprintf(hdev->uniq, sizeof(hdev->uniq), "%04x-%4phD",
+- hdev->product, &serial);
++ snprintf(hdev->uniq, sizeof(hdev->uniq), "%4phD", &serial);
+ dbg_hid("HID++ Unifying: Got serial: %s\n", hdev->uniq);
+
+ name = hidpp_unifying_get_name(hidpp);
+@@ -777,6 +776,54 @@ static bool hidpp_is_connected(struct hidpp_device *hidpp)
+ return ret == 0;
+ }
+
++/* -------------------------------------------------------------------------- */
++/* 0x0003: Device Information */
++/* -------------------------------------------------------------------------- */
++
++#define HIDPP_PAGE_DEVICE_INFORMATION 0x0003
++
++#define CMD_GET_DEVICE_INFO 0x00
++
++static int hidpp_get_serial(struct hidpp_device *hidpp, u32 *serial)
++{
++ struct hidpp_report response;
++ u8 feature_type;
++ u8 feature_index;
++ int ret;
++
++ ret = hidpp_root_get_feature(hidpp, HIDPP_PAGE_DEVICE_INFORMATION,
++ &feature_index,
++ &feature_type);
++ if (ret)
++ return ret;
++
++ ret = hidpp_send_fap_command_sync(hidpp, feature_index,
++ CMD_GET_DEVICE_INFO,
++ NULL, 0, &response);
++ if (ret)
++ return ret;
++
++ /* See hidpp_unifying_get_serial() */
++ *serial = *((u32 *)&response.rap.params[1]);
++ return 0;
++}
++
++static int hidpp_serial_init(struct hidpp_device *hidpp)
++{
++ struct hid_device *hdev = hidpp->hid_dev;
++ u32 serial;
++ int ret;
++
++ ret = hidpp_get_serial(hidpp, &serial);
++ if (ret)
++ return ret;
++
++ snprintf(hdev->uniq, sizeof(hdev->uniq), "%4phD", &serial);
++ dbg_hid("HID++ DeviceInformation: Got serial: %s\n", hdev->uniq);
++
++ return 0;
++}
++
+ /* -------------------------------------------------------------------------- */
+ /* 0x0005: GetDeviceNameType */
+ /* -------------------------------------------------------------------------- */
+@@ -3040,6 +3087,8 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
+
+ if (hidpp->quirks & HIDPP_QUIRK_UNIFYING)
+ hidpp_unifying_init(hidpp);
++ else if (hid_is_usb(hidpp->hid_dev))
++ hidpp_serial_init(hidpp);
+
+ connected = hidpp_is_connected(hidpp);
+ atomic_set(&hidpp->connected, connected);
+diff --git a/drivers/hid/wacom.h b/drivers/hid/wacom.h
+index 9c0900c35b236..45636d82ec306 100644
+--- a/drivers/hid/wacom.h
++++ b/drivers/hid/wacom.h
+@@ -94,6 +94,7 @@
+ #include <linux/leds.h>
+ #include <linux/usb/input.h>
+ #include <linux/power_supply.h>
++#include <linux/timer.h>
+ #include <asm/unaligned.h>
+
+ /*
+@@ -170,6 +171,7 @@ struct wacom {
+ struct delayed_work init_work;
+ struct wacom_remote *remote;
+ struct work_struct mode_change_work;
++ struct timer_list idleprox_timer;
+ bool generic_has_leds;
+ struct wacom_leds {
+ struct wacom_group_leds *groups;
+@@ -242,4 +244,5 @@ struct wacom_led *wacom_led_find(struct wacom *wacom, unsigned int group,
+ struct wacom_led *wacom_led_next(struct wacom *wacom, struct wacom_led *cur);
+ int wacom_equivalent_usage(int usage);
+ int wacom_initialize_leds(struct wacom *wacom);
++void wacom_idleprox_timeout(struct timer_list *list);
+ #endif
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 8e32415e0a909..4e4a3424c1f9f 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -2754,6 +2754,7 @@ static int wacom_probe(struct hid_device *hdev,
+ INIT_WORK(&wacom->battery_work, wacom_battery_work);
+ INIT_WORK(&wacom->remote_work, wacom_remote_work);
+ INIT_WORK(&wacom->mode_change_work, wacom_mode_change_work);
++ timer_setup(&wacom->idleprox_timer, &wacom_idleprox_timeout, TIMER_DEFERRABLE);
+
+ /* ask for the report descriptor to be loaded by HID */
+ error = hid_parse(hdev);
+@@ -2802,6 +2803,7 @@ static void wacom_remove(struct hid_device *hdev)
+ cancel_work_sync(&wacom->battery_work);
+ cancel_work_sync(&wacom->remote_work);
+ cancel_work_sync(&wacom->mode_change_work);
++ del_timer_sync(&wacom->idleprox_timer);
+ if (hdev->bus == BUS_BLUETOOTH)
+ device_remove_file(&hdev->dev, &dev_attr_speed);
+
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index da6053deb954a..c3ebc0cb69b80 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -15,6 +15,7 @@
+ #include "wacom_wac.h"
+ #include "wacom.h"
+ #include <linux/input/mt.h>
++#include <linux/jiffies.h>
+
+ /* resolution for penabled devices */
+ #define WACOM_PL_RES 20
+@@ -45,6 +46,43 @@ static int wacom_numbered_button_to_key(int n);
+
+ static void wacom_update_led(struct wacom *wacom, int button_count, int mask,
+ int group);
++
++static void wacom_force_proxout(struct wacom_wac *wacom_wac)
++{
++ struct input_dev *input = wacom_wac->pen_input;
++
++ wacom_wac->shared->stylus_in_proximity = 0;
++
++ input_report_key(input, BTN_TOUCH, 0);
++ input_report_key(input, BTN_STYLUS, 0);
++ input_report_key(input, BTN_STYLUS2, 0);
++ input_report_key(input, BTN_STYLUS3, 0);
++ input_report_key(input, wacom_wac->tool[0], 0);
++ if (wacom_wac->serial[0]) {
++ input_report_abs(input, ABS_MISC, 0);
++ }
++ input_report_abs(input, ABS_PRESSURE, 0);
++
++ wacom_wac->tool[0] = 0;
++ wacom_wac->id[0] = 0;
++ wacom_wac->serial[0] = 0;
++
++ input_sync(input);
++}
++
++void wacom_idleprox_timeout(struct timer_list *list)
++{
++ struct wacom *wacom = from_timer(wacom, list, idleprox_timer);
++ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
++
++ if (!wacom_wac->hid_data.sense_state) {
++ return;
++ }
++
++ hid_warn(wacom->hdev, "%s: tool appears to be hung in-prox. forcing it out.\n", __func__);
++ wacom_force_proxout(wacom_wac);
++}
++
+ /*
+ * Percent of battery capacity for Graphire.
+ * 8th value means AC online and show 100% capacity.
+@@ -1839,18 +1877,7 @@ static void wacom_map_usage(struct input_dev *input, struct hid_usage *usage,
+ static void wacom_wac_battery_usage_mapping(struct hid_device *hdev,
+ struct hid_field *field, struct hid_usage *usage)
+ {
+- struct wacom *wacom = hid_get_drvdata(hdev);
+- struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+- struct wacom_features *features = &wacom_wac->features;
+- unsigned equivalent_usage = wacom_equivalent_usage(usage->hid);
+-
+- switch (equivalent_usage) {
+- case HID_DG_BATTERYSTRENGTH:
+- case WACOM_HID_WD_BATTERY_LEVEL:
+- case WACOM_HID_WD_BATTERY_CHARGING:
+- features->quirks |= WACOM_QUIRK_BATTERY;
+- break;
+- }
++ return;
+ }
+
+ static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *field,
+@@ -1871,18 +1898,21 @@ static void wacom_wac_battery_event(struct hid_device *hdev, struct hid_field *f
+ wacom_wac->hid_data.bat_connected = 1;
+ wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO;
+ }
++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY;
+ break;
+ case WACOM_HID_WD_BATTERY_LEVEL:
+ value = value * 100 / (field->logical_maximum - field->logical_minimum);
+ wacom_wac->hid_data.battery_capacity = value;
+ wacom_wac->hid_data.bat_connected = 1;
+ wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO;
++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY;
+ break;
+ case WACOM_HID_WD_BATTERY_CHARGING:
+ wacom_wac->hid_data.bat_charging = value;
+ wacom_wac->hid_data.ps_connected = value;
+ wacom_wac->hid_data.bat_connected = 1;
+ wacom_wac->hid_data.bat_status = WACOM_POWER_SUPPLY_STATUS_AUTO;
++ wacom_wac->features.quirks |= WACOM_QUIRK_BATTERY;
+ break;
+ }
+ }
+@@ -1898,18 +1928,15 @@ static void wacom_wac_battery_report(struct hid_device *hdev,
+ {
+ struct wacom *wacom = hid_get_drvdata(hdev);
+ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+- struct wacom_features *features = &wacom_wac->features;
+
+- if (features->quirks & WACOM_QUIRK_BATTERY) {
+- int status = wacom_wac->hid_data.bat_status;
+- int capacity = wacom_wac->hid_data.battery_capacity;
+- bool charging = wacom_wac->hid_data.bat_charging;
+- bool connected = wacom_wac->hid_data.bat_connected;
+- bool powered = wacom_wac->hid_data.ps_connected;
++ int status = wacom_wac->hid_data.bat_status;
++ int capacity = wacom_wac->hid_data.battery_capacity;
++ bool charging = wacom_wac->hid_data.bat_charging;
++ bool connected = wacom_wac->hid_data.bat_connected;
++ bool powered = wacom_wac->hid_data.ps_connected;
+
+- wacom_notify_battery(wacom_wac, status, capacity, charging,
+- connected, powered);
+- }
++ wacom_notify_battery(wacom_wac, status, capacity, charging,
++ connected, powered);
+ }
+
+ static void wacom_wac_pad_usage_mapping(struct hid_device *hdev,
+@@ -2266,6 +2293,7 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
+ value = field->logical_maximum - value;
+ break;
+ case HID_DG_INRANGE:
++ mod_timer(&wacom->idleprox_timer, jiffies + msecs_to_jiffies(100));
+ wacom_wac->hid_data.inrange_state = value;
+ if (!(features->quirks & WACOM_QUIRK_SENSE))
+ wacom_wac->hid_data.sense_state = value;
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+index 9a3cb07555e3b..8f850c22be418 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -866,7 +866,7 @@ tmc_etr_buf_insert_barrier_packet(struct etr_buf *etr_buf, u64 offset)
+
+ len = tmc_etr_buf_get_data(etr_buf, offset,
+ CORESIGHT_BARRIER_PKT_SIZE, &bufp);
+- if (WARN_ON(len < CORESIGHT_BARRIER_PKT_SIZE))
++ if (WARN_ON(len < 0 || len < CORESIGHT_BARRIER_PKT_SIZE))
+ return -EINVAL;
+ coresight_insert_barrier_packet(bufp);
+ return offset + CORESIGHT_BARRIER_PKT_SIZE;
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index c125cd42faee7..0a85f0817662a 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -503,6 +503,9 @@ struct xboxone_init_packet {
+ }
+
+
++#define GIP_WIRED_INTF_DATA 0
++#define GIP_WIRED_INTF_AUDIO 1
++
+ /*
+ * This packet is required for all Xbox One pads with 2015
+ * or later firmware installed (or present from the factory).
+@@ -1827,7 +1830,7 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
+ }
+
+ if (xpad->xtype == XTYPE_XBOXONE &&
+- intf->cur_altsetting->desc.bInterfaceNumber != 0) {
++ intf->cur_altsetting->desc.bInterfaceNumber != GIP_WIRED_INTF_DATA) {
+ /*
+ * The Xbox One controller lists three interfaces all with the
+ * same interface class, subclass and protocol. Differentiate by
+diff --git a/drivers/mcb/mcb-pci.c b/drivers/mcb/mcb-pci.c
+index c2d69e33bf2bf..63879d89c8c49 100644
+--- a/drivers/mcb/mcb-pci.c
++++ b/drivers/mcb/mcb-pci.c
+@@ -34,7 +34,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
+ struct resource *res;
+ struct priv *priv;
+- int ret;
++ int ret, table_size;
+ unsigned long flags;
+
+ priv = devm_kzalloc(&pdev->dev, sizeof(struct priv), GFP_KERNEL);
+@@ -93,7 +93,30 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ if (ret < 0)
+ goto out_mcb_bus;
+
+- dev_dbg(&pdev->dev, "Found %d cells\n", ret);
++ table_size = ret;
++
++ if (table_size < CHAM_HEADER_SIZE) {
++ /* Release the previous resources */
++ devm_iounmap(&pdev->dev, priv->base);
++ devm_release_mem_region(&pdev->dev, priv->mapbase, CHAM_HEADER_SIZE);
++
++ /* Then, allocate it again with the actual chameleon table size */
++ res = devm_request_mem_region(&pdev->dev, priv->mapbase,
++ table_size,
++ KBUILD_MODNAME);
++ if (!res) {
++ dev_err(&pdev->dev, "Failed to request PCI memory\n");
++ ret = -EBUSY;
++ goto out_mcb_bus;
++ }
++
++ priv->base = devm_ioremap(&pdev->dev, priv->mapbase, table_size);
++ if (!priv->base) {
++ dev_err(&pdev->dev, "Cannot ioremap\n");
++ ret = -ENOMEM;
++ goto out_mcb_bus;
++ }
++ }
+
+ mcb_bus_add_devices(priv->bus);
+
+diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+index de3fc62810e6c..0ead74c40a7b7 100644
+--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
++++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+@@ -706,7 +706,7 @@ static void netup_unidvb_dma_fini(struct netup_unidvb_dev *ndev, int num)
+ netup_unidvb_dma_enable(dma, 0);
+ msleep(50);
+ cancel_work_sync(&dma->work);
+- del_timer(&dma->timeout);
++ del_timer_sync(&dma->timeout);
+ }
+
+ static int netup_unidvb_dma_setup(struct netup_unidvb_dev *ndev)
+diff --git a/drivers/media/radio/radio-shark.c b/drivers/media/radio/radio-shark.c
+index 22f3466af2b18..5275180aed0b7 100644
+--- a/drivers/media/radio/radio-shark.c
++++ b/drivers/media/radio/radio-shark.c
+@@ -316,6 +316,16 @@ static int usb_shark_probe(struct usb_interface *intf,
+ {
+ struct shark_device *shark;
+ int retval = -ENOMEM;
++ static const u8 ep_addresses[] = {
++ SHARK_IN_EP | USB_DIR_IN,
++ SHARK_OUT_EP | USB_DIR_OUT,
++ 0};
++
++ /* Are the expected endpoints present? */
++ if (!usb_check_int_endpoints(intf, ep_addresses)) {
++ dev_err(&intf->dev, "Invalid radioSHARK device\n");
++ return -EINVAL;
++ }
+
+ shark = kzalloc(sizeof(struct shark_device), GFP_KERNEL);
+ if (!shark)
+diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c
+index 4d1a4b3d669cf..5356941f54aef 100644
+--- a/drivers/media/radio/radio-shark2.c
++++ b/drivers/media/radio/radio-shark2.c
+@@ -282,6 +282,16 @@ static int usb_shark_probe(struct usb_interface *intf,
+ {
+ struct shark_device *shark;
+ int retval = -ENOMEM;
++ static const u8 ep_addresses[] = {
++ SHARK_IN_EP | USB_DIR_IN,
++ SHARK_OUT_EP | USB_DIR_OUT,
++ 0};
++
++ /* Are the expected endpoints present? */
++ if (!usb_check_int_endpoints(intf, ep_addresses)) {
++ dev_err(&intf->dev, "Invalid radioSHARK2 device\n");
++ return -EINVAL;
++ }
+
+ shark = kzalloc(sizeof(struct shark_device), GFP_KERNEL);
+ if (!shark)
+diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
+index 4728a42d54b88..edb1b5588b7a0 100644
+--- a/drivers/memstick/host/r592.c
++++ b/drivers/memstick/host/r592.c
+@@ -831,7 +831,7 @@ static void r592_remove(struct pci_dev *pdev)
+ /* Stop the processing thread.
+ That ensures that we won't take any more requests */
+ kthread_stop(dev->io_thread);
+-
++ del_timer_sync(&dev->detect_timer);
+ r592_enable_device(dev, false);
+
+ while (!error && dev->req) {
+diff --git a/drivers/message/fusion/mptlan.c b/drivers/message/fusion/mptlan.c
+index ebc00d47abf52..624803a887d8f 100644
+--- a/drivers/message/fusion/mptlan.c
++++ b/drivers/message/fusion/mptlan.c
+@@ -1430,7 +1430,9 @@ mptlan_remove(struct pci_dev *pdev)
+ {
+ MPT_ADAPTER *ioc = pci_get_drvdata(pdev);
+ struct net_device *dev = ioc->netdev;
++ struct mpt_lan_priv *priv = netdev_priv(dev);
+
++ cancel_delayed_work_sync(&priv->post_buckets_task);
+ if(dev != NULL) {
+ unregister_netdev(dev);
+ free_netdev(dev);
+diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
+index fe614ba5fec90..37217e01f27c0 100644
+--- a/drivers/mfd/dln2.c
++++ b/drivers/mfd/dln2.c
+@@ -800,6 +800,7 @@ out_stop_rx:
+ dln2_stop_rx_urbs(dln2);
+
+ out_free:
++ usb_put_dev(dln2->usb_dev);
+ dln2_free(dln2);
+
+ return ret;
+diff --git a/drivers/net/ethernet/3com/3c589_cs.c b/drivers/net/ethernet/3com/3c589_cs.c
+index 2b2695311bda9..aab26dbe76ff9 100644
+--- a/drivers/net/ethernet/3com/3c589_cs.c
++++ b/drivers/net/ethernet/3com/3c589_cs.c
+@@ -196,6 +196,7 @@ static int tc589_probe(struct pcmcia_device *link)
+ {
+ struct el3_private *lp;
+ struct net_device *dev;
++ int ret;
+
+ dev_dbg(&link->dev, "3c589_attach()\n");
+
+@@ -219,7 +220,15 @@ static int tc589_probe(struct pcmcia_device *link)
+
+ dev->ethtool_ops = &netdev_ethtool_ops;
+
+- return tc589_config(link);
++ ret = tc589_config(link);
++ if (ret)
++ goto err_free_netdev;
++
++ return 0;
++
++err_free_netdev:
++ free_netdev(dev);
++ return ret;
+ }
+
+ static void tc589_detach(struct pcmcia_device *link)
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 84bcb3ce00f73..d518577313145 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2980,7 +2980,7 @@ err_clk_disable:
+ return ret;
+ }
+
+-static void bcmgenet_netif_stop(struct net_device *dev)
++static void bcmgenet_netif_stop(struct net_device *dev, bool stop_phy)
+ {
+ struct bcmgenet_priv *priv = netdev_priv(dev);
+
+@@ -2995,7 +2995,8 @@ static void bcmgenet_netif_stop(struct net_device *dev)
+ /* Disable MAC transmit. TX DMA disabled must be done before this */
+ umac_enable_set(priv, CMD_TX_EN, false);
+
+- phy_stop(dev->phydev);
++ if (stop_phy)
++ phy_stop(dev->phydev);
+ bcmgenet_disable_rx_napi(priv);
+ bcmgenet_intr_disable(priv);
+
+@@ -3021,7 +3022,7 @@ static int bcmgenet_close(struct net_device *dev)
+
+ netif_dbg(priv, ifdown, dev, "bcmgenet_close\n");
+
+- bcmgenet_netif_stop(dev);
++ bcmgenet_netif_stop(dev, false);
+
+ /* Really kill the PHY state machine and disconnect from it */
+ phy_disconnect(dev->phydev);
+@@ -3721,7 +3722,7 @@ static int bcmgenet_suspend(struct device *d)
+
+ netif_device_detach(dev);
+
+- bcmgenet_netif_stop(dev);
++ bcmgenet_netif_stop(dev, true);
+
+ if (!device_may_wakeup(d))
+ phy_suspend(dev->phydev);
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index e97ab9545a792..e4162c2271e3f 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3721,7 +3721,9 @@ fec_drv_remove(struct platform_device *pdev)
+
+ ret = pm_runtime_get_sync(&pdev->dev);
+ if (ret < 0)
+- return ret;
++ dev_err(&pdev->dev,
++ "Failed to resume device in remove callback (%pe)\n",
++ ERR_PTR(ret));
+
+ cancel_work_sync(&fep->tx_timeout_work);
+ fec_ptp_stop(pdev);
+@@ -3734,8 +3736,13 @@ fec_drv_remove(struct platform_device *pdev)
+ of_phy_deregister_fixed_link(np);
+ of_node_put(fep->phy_node);
+
+- clk_disable_unprepare(fep->clk_ahb);
+- clk_disable_unprepare(fep->clk_ipg);
++ /* After pm_runtime_get_sync() failed, the clks are still off, so skip
++ * disabling them again.
++ */
++ if (ret >= 0) {
++ clk_disable_unprepare(fep->clk_ahb);
++ clk_disable_unprepare(fep->clk_ipg);
++ }
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+
+diff --git a/drivers/net/ethernet/intel/igb/e1000_mac.c b/drivers/net/ethernet/intel/igb/e1000_mac.c
+index 79ee0a7472608..4e69cb2c025fd 100644
+--- a/drivers/net/ethernet/intel/igb/e1000_mac.c
++++ b/drivers/net/ethernet/intel/igb/e1000_mac.c
+@@ -425,7 +425,7 @@ void igb_mta_set(struct e1000_hw *hw, u32 hash_value)
+ static u32 igb_hash_mc_addr(struct e1000_hw *hw, u8 *mc_addr)
+ {
+ u32 hash_value, hash_mask;
+- u8 bit_shift = 0;
++ u8 bit_shift = 1;
+
+ /* Register count multiplied by bits per register */
+ hash_mask = (hw->mac.mta_reg_count * 32) - 1;
+@@ -433,7 +433,7 @@ static u32 igb_hash_mc_addr(struct e1000_hw *hw, u8 *mc_addr)
+ /* For a mc_filter_type of 0, bit_shift is the number of left-shifts
+ * where 0xFF would still fall within the hash mask.
+ */
+- while (hash_mask >> bit_shift != 0xFF)
++ while (hash_mask >> bit_shift != 0xFF && bit_shift < 4)
+ bit_shift++;
+
+ /* The portion of the address that is used for the hash table
+diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
+index 1d9b0d44ddb69..45be26dbdd11c 100644
+--- a/drivers/net/ethernet/nvidia/forcedeth.c
++++ b/drivers/net/ethernet/nvidia/forcedeth.c
+@@ -6061,6 +6061,7 @@ static int nv_probe(struct pci_dev *pci_dev, const struct pci_device_id *id)
+ return 0;
+
+ out_error:
++ nv_mgmt_release_sema(dev);
+ if (phystate_orig)
+ writel(phystate|NVREG_ADAPTCTL_RUNNING, base + NvRegAdapterControl);
+ out_freering:
+diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
+index e2c280913fbbb..8238a70161599 100644
+--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
+@@ -1435,7 +1435,7 @@ static void pasemi_mac_queue_csdesc(const struct sk_buff *skb,
+ write_dma_reg(PAS_DMA_TXCHAN_INCR(txring->chan.chno), 2);
+ }
+
+-static int pasemi_mac_start_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t pasemi_mac_start_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct pasemi_mac * const mac = netdev_priv(dev);
+ struct pasemi_mac_txring * const txring = tx_ring(mac);
+diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
+index d323dd9daccb0..a3a5edb8bc666 100644
+--- a/drivers/net/ethernet/sun/cassini.c
++++ b/drivers/net/ethernet/sun/cassini.c
+@@ -5138,6 +5138,8 @@ err_out_iounmap:
+ cas_shutdown(cp);
+ mutex_unlock(&cp->pm_mutex);
+
++ vfree(cp->fw_data);
++
+ pci_iounmap(pdev, cp->regs);
+
+
+diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
+index 63f0226b0a70c..eb80d277b56f5 100644
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -443,6 +443,9 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb)
+ goto err;
+ }
+ skb_dst_set(skb, &rt->dst);
++
++ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
++
+ err = ip_local_out(net, skb->sk, skb);
+ if (unlikely(net_xmit_eval(err)))
+ dev->stats.tx_errors++;
+@@ -481,6 +484,9 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
+ goto err;
+ }
+ skb_dst_set(skb, dst);
++
++ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
++
+ err = ip6_local_out(net, skb->sk, skb);
+ if (unlikely(net_xmit_eval(err)))
+ dev->stats.tx_errors++;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index d77c1dbb5e191..1827be85f115f 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1238,13 +1238,14 @@ static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
+ static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
+ {
+ struct brcmf_wsec_pmk_le pmk;
+- int i, err;
++ int err;
++
++ memset(&pmk, 0, sizeof(pmk));
+
+- /* convert to firmware key format */
+- pmk.key_len = cpu_to_le16(pmk_len << 1);
+- pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE);
+- for (i = 0; i < pmk_len; i++)
+- snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]);
++ /* pass pmk directly */
++ pmk.key_len = cpu_to_le16(pmk_len);
++ pmk.flags = cpu_to_le16(0);
++ memcpy(pmk.key, pmk_data, pmk_len);
+
+ /* store psk in firmware */
+ err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/sta.c b/drivers/net/wireless/intel/iwlwifi/dvm/sta.c
+index de6ec9b7ace45..f30bac02d32ce 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/sta.c
+@@ -1101,6 +1101,7 @@ static int iwlagn_send_sta_key(struct iwl_priv *priv,
+ {
+ __le16 key_flags;
+ struct iwl_addsta_cmd sta_cmd;
++ size_t to_copy;
+ int i;
+
+ spin_lock_bh(&priv->sta_lock);
+@@ -1120,7 +1121,9 @@ static int iwlagn_send_sta_key(struct iwl_priv *priv,
+ sta_cmd.key.tkip_rx_tsc_byte2 = tkip_iv32;
+ for (i = 0; i < 5; i++)
+ sta_cmd.key.tkip_rx_ttak[i] = cpu_to_le16(tkip_p1k[i]);
+- memcpy(sta_cmd.key.key, keyconf->key, keyconf->keylen);
++ /* keyconf may contain MIC rx/tx keys which iwl does not use */
++ to_copy = min_t(size_t, sizeof(sta_cmd.key.key), keyconf->keylen);
++ memcpy(sta_cmd.key.key, keyconf->key, to_copy);
+ break;
+ case WLAN_CIPHER_SUITE_WEP104:
+ key_flags |= STA_KEY_FLG_KEY_SIZE_MSK;
+diff --git a/drivers/phy/st/phy-miphy28lp.c b/drivers/phy/st/phy-miphy28lp.c
+index 213e2e15339c4..fe23432e5b1a6 100644
+--- a/drivers/phy/st/phy-miphy28lp.c
++++ b/drivers/phy/st/phy-miphy28lp.c
+@@ -13,6 +13,7 @@
+
+ #include <linux/platform_device.h>
+ #include <linux/io.h>
++#include <linux/iopoll.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
+@@ -488,19 +489,11 @@ static inline void miphy28lp_pcie_config_gen(struct miphy28lp_phy *miphy_phy)
+
+ static inline int miphy28lp_wait_compensation(struct miphy28lp_phy *miphy_phy)
+ {
+- unsigned long finish = jiffies + 5 * HZ;
+ u8 val;
+
+ /* Waiting for Compensation to complete */
+- do {
+- val = readb_relaxed(miphy_phy->base + MIPHY_COMP_FSM_6);
+-
+- if (time_after_eq(jiffies, finish))
+- return -EBUSY;
+- cpu_relax();
+- } while (!(val & COMP_DONE));
+-
+- return 0;
++ return readb_relaxed_poll_timeout(miphy_phy->base + MIPHY_COMP_FSM_6,
++ val, val & COMP_DONE, 1, 5 * USEC_PER_SEC);
+ }
+
+
+@@ -809,7 +802,6 @@ static inline void miphy28lp_configure_usb3(struct miphy28lp_phy *miphy_phy)
+
+ static inline int miphy_is_ready(struct miphy28lp_phy *miphy_phy)
+ {
+- unsigned long finish = jiffies + 5 * HZ;
+ u8 mask = HFC_PLL | HFC_RDY;
+ u8 val;
+
+@@ -820,21 +812,14 @@ static inline int miphy_is_ready(struct miphy28lp_phy *miphy_phy)
+ if (miphy_phy->type == PHY_TYPE_SATA)
+ mask |= PHY_RDY;
+
+- do {
+- val = readb_relaxed(miphy_phy->base + MIPHY_STATUS_1);
+- if ((val & mask) != mask)
+- cpu_relax();
+- else
+- return 0;
+- } while (!time_after_eq(jiffies, finish));
+-
+- return -EBUSY;
++ return readb_relaxed_poll_timeout(miphy_phy->base + MIPHY_STATUS_1,
++ val, (val & mask) == mask, 1,
++ 5 * USEC_PER_SEC);
+ }
+
+ static int miphy_osc_is_ready(struct miphy28lp_phy *miphy_phy)
+ {
+ struct miphy28lp_dev *miphy_dev = miphy_phy->phydev;
+- unsigned long finish = jiffies + 5 * HZ;
+ u32 val;
+
+ if (!miphy_phy->osc_rdy)
+@@ -843,17 +828,10 @@ static int miphy_osc_is_ready(struct miphy28lp_phy *miphy_phy)
+ if (!miphy_phy->syscfg_reg[SYSCFG_STATUS])
+ return -EINVAL;
+
+- do {
+- regmap_read(miphy_dev->regmap,
+- miphy_phy->syscfg_reg[SYSCFG_STATUS], &val);
+-
+- if ((val & MIPHY_OSC_RDY) != MIPHY_OSC_RDY)
+- cpu_relax();
+- else
+- return 0;
+- } while (!time_after_eq(jiffies, finish));
+-
+- return -EBUSY;
++ return regmap_read_poll_timeout(miphy_dev->regmap,
++ miphy_phy->syscfg_reg[SYSCFG_STATUS],
++ val, val & MIPHY_OSC_RDY, 1,
++ 5 * USEC_PER_SEC);
+ }
+
+ static int miphy28lp_get_resource_byname(struct device_node *child,
+diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
+index b7dc881268666..b44776bb1da82 100644
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -1551,7 +1551,7 @@ static int bq27xxx_battery_read_health(struct bq27xxx_device_info *di)
+ return POWER_SUPPLY_HEALTH_GOOD;
+ }
+
+-void bq27xxx_battery_update(struct bq27xxx_device_info *di)
++static void bq27xxx_battery_update_unlocked(struct bq27xxx_device_info *di)
+ {
+ struct bq27xxx_reg_cache cache = {0, };
+ bool has_ci_flag = di->opts & BQ27XXX_O_ZERO;
+@@ -1599,6 +1599,16 @@ void bq27xxx_battery_update(struct bq27xxx_device_info *di)
+ di->cache = cache;
+
+ di->last_update = jiffies;
++
++ if (!di->removed && poll_interval > 0)
++ mod_delayed_work(system_wq, &di->work, poll_interval * HZ);
++}
++
++void bq27xxx_battery_update(struct bq27xxx_device_info *di)
++{
++ mutex_lock(&di->lock);
++ bq27xxx_battery_update_unlocked(di);
++ mutex_unlock(&di->lock);
+ }
+ EXPORT_SYMBOL_GPL(bq27xxx_battery_update);
+
+@@ -1609,9 +1619,6 @@ static void bq27xxx_battery_poll(struct work_struct *work)
+ work.work);
+
+ bq27xxx_battery_update(di);
+-
+- if (poll_interval > 0)
+- schedule_delayed_work(&di->work, poll_interval * HZ);
+ }
+
+ /*
+@@ -1772,10 +1779,8 @@ static int bq27xxx_battery_get_property(struct power_supply *psy,
+ struct bq27xxx_device_info *di = power_supply_get_drvdata(psy);
+
+ mutex_lock(&di->lock);
+- if (time_is_before_jiffies(di->last_update + 5 * HZ)) {
+- cancel_delayed_work_sync(&di->work);
+- bq27xxx_battery_poll(&di->work.work);
+- }
++ if (time_is_before_jiffies(di->last_update + 5 * HZ))
++ bq27xxx_battery_update_unlocked(di);
+ mutex_unlock(&di->lock);
+
+ if (psp != POWER_SUPPLY_PROP_PRESENT && di->cache.flags < 0)
+@@ -1912,22 +1917,18 @@ EXPORT_SYMBOL_GPL(bq27xxx_battery_setup);
+
+ void bq27xxx_battery_teardown(struct bq27xxx_device_info *di)
+ {
+- /*
+- * power_supply_unregister call bq27xxx_battery_get_property which
+- * call bq27xxx_battery_poll.
+- * Make sure that bq27xxx_battery_poll will not call
+- * schedule_delayed_work again after unregister (which cause OOPS).
+- */
+- poll_interval = 0;
+-
+- cancel_delayed_work_sync(&di->work);
+-
+- power_supply_unregister(di->bat);
+-
+ mutex_lock(&bq27xxx_list_lock);
+ list_del(&di->list);
+ mutex_unlock(&bq27xxx_list_lock);
+
++ /* Set removed to avoid bq27xxx_battery_update() re-queuing the work */
++ mutex_lock(&di->lock);
++ di->removed = true;
++ mutex_unlock(&di->lock);
++
++ cancel_delayed_work_sync(&di->work);
++
++ power_supply_unregister(di->bat);
+ mutex_destroy(&di->lock);
+ }
+ EXPORT_SYMBOL_GPL(bq27xxx_battery_teardown);
+diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c
+index 06dd5077104cc..0fbc221ee50ef 100644
+--- a/drivers/power/supply/bq27xxx_battery_i2c.c
++++ b/drivers/power/supply/bq27xxx_battery_i2c.c
+@@ -187,7 +187,7 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client,
+ i2c_set_clientdata(client, di);
+
+ if (client->irq) {
+- ret = devm_request_threaded_irq(&client->dev, client->irq,
++ ret = request_threaded_irq(client->irq,
+ NULL, bq27xxx_battery_irq_handler_thread,
+ IRQF_ONESHOT,
+ di->name, di);
+@@ -217,6 +217,7 @@ static int bq27xxx_battery_i2c_remove(struct i2c_client *client)
+ {
+ struct bq27xxx_device_info *di = i2c_get_clientdata(client);
+
++ free_irq(client->irq, di);
+ bq27xxx_battery_teardown(di);
+
+ mutex_lock(&battery_mutex);
+diff --git a/drivers/power/supply/power_supply_leds.c b/drivers/power/supply/power_supply_leds.c
+index 2277ad9c2f682..9188b7ccdd4c7 100644
+--- a/drivers/power/supply/power_supply_leds.c
++++ b/drivers/power/supply/power_supply_leds.c
+@@ -35,8 +35,9 @@ static void power_supply_update_bat_leds(struct power_supply *psy)
+ led_trigger_event(psy->charging_full_trig, LED_FULL);
+ led_trigger_event(psy->charging_trig, LED_OFF);
+ led_trigger_event(psy->full_trig, LED_FULL);
+- led_trigger_event(psy->charging_blink_full_solid_trig,
+- LED_FULL);
++ /* Going from blink to LED on requires a LED_OFF event to stop blink */
++ led_trigger_event(psy->charging_blink_full_solid_trig, LED_OFF);
++ led_trigger_event(psy->charging_blink_full_solid_trig, LED_FULL);
+ break;
+ case POWER_SUPPLY_STATUS_CHARGING:
+ led_trigger_event(psy->charging_full_trig, LED_FULL);
+diff --git a/drivers/power/supply/sbs-charger.c b/drivers/power/supply/sbs-charger.c
+index 15947dbb511e3..0f9cc82d81618 100644
+--- a/drivers/power/supply/sbs-charger.c
++++ b/drivers/power/supply/sbs-charger.c
+@@ -29,7 +29,7 @@
+ #define SBS_CHARGER_REG_STATUS 0x13
+ #define SBS_CHARGER_REG_ALARM_WARNING 0x16
+
+-#define SBS_CHARGER_STATUS_CHARGE_INHIBITED BIT(1)
++#define SBS_CHARGER_STATUS_CHARGE_INHIBITED BIT(0)
+ #define SBS_CHARGER_STATUS_RES_COLD BIT(9)
+ #define SBS_CHARGER_STATUS_RES_HOT BIT(10)
+ #define SBS_CHARGER_STATUS_BATTERY_PRESENT BIT(14)
+diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
+index ed60b8d4efe68..f98dc3a8e3c71 100644
+--- a/drivers/s390/cio/qdio.h
++++ b/drivers/s390/cio/qdio.h
+@@ -88,15 +88,15 @@ enum qdio_irq_states {
+ static inline int do_sqbs(u64 token, unsigned char state, int queue,
+ int *start, int *count)
+ {
+- register unsigned long _ccq asm ("0") = *count;
+- register unsigned long _token asm ("1") = token;
+ unsigned long _queuestart = ((unsigned long)queue << 32) | *start;
++ unsigned long _ccq = *count;
+
+ asm volatile(
+- " .insn rsy,0xeb000000008A,%1,0,0(%2)"
+- : "+d" (_ccq), "+d" (_queuestart)
+- : "d" ((unsigned long)state), "d" (_token)
+- : "memory", "cc");
++ " lgr 1,%[token]\n"
++ " .insn rsy,0xeb000000008a,%[qs],%[ccq],0(%[state])"
++ : [ccq] "+&d" (_ccq), [qs] "+&d" (_queuestart)
++ : [state] "a" ((unsigned long)state), [token] "d" (token)
++ : "memory", "cc", "1");
+ *count = _ccq & 0xff;
+ *start = _queuestart & 0xff;
+
+@@ -106,16 +106,17 @@ static inline int do_sqbs(u64 token, unsigned char state, int queue,
+ static inline int do_eqbs(u64 token, unsigned char *state, int queue,
+ int *start, int *count, int ack)
+ {
+- register unsigned long _ccq asm ("0") = *count;
+- register unsigned long _token asm ("1") = token;
+ unsigned long _queuestart = ((unsigned long)queue << 32) | *start;
+ unsigned long _state = (unsigned long)ack << 63;
++ unsigned long _ccq = *count;
+
+ asm volatile(
+- " .insn rrf,0xB99c0000,%1,%2,0,0"
+- : "+d" (_ccq), "+d" (_queuestart), "+d" (_state)
+- : "d" (_token)
+- : "memory", "cc");
++ " lgr 1,%[token]\n"
++ " .insn rrf,0xb99c0000,%[qs],%[state],%[ccq],0"
++ : [ccq] "+&d" (_ccq), [qs] "+&d" (_queuestart),
++ [state] "+&d" (_state)
++ : [token] "d" (token)
++ : "memory", "cc", "1");
+ *count = _ccq & 0xff;
+ *start = _queuestart & 0xff;
+ *state = _state & 0xff;
+diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
+index 4b7cc8d425b1c..6100cf4df54b6 100644
+--- a/drivers/s390/cio/qdio_main.c
++++ b/drivers/s390/cio/qdio_main.c
+@@ -31,38 +31,41 @@ MODULE_DESCRIPTION("QDIO base support");
+ MODULE_LICENSE("GPL");
+
+ static inline int do_siga_sync(unsigned long schid,
+- unsigned int out_mask, unsigned int in_mask,
++ unsigned long out_mask, unsigned long in_mask,
+ unsigned int fc)
+ {
+- register unsigned long __fc asm ("0") = fc;
+- register unsigned long __schid asm ("1") = schid;
+- register unsigned long out asm ("2") = out_mask;
+- register unsigned long in asm ("3") = in_mask;
+ int cc;
+
+ asm volatile(
++ " lgr 0,%[fc]\n"
++ " lgr 1,%[schid]\n"
++ " lgr 2,%[out]\n"
++ " lgr 3,%[in]\n"
+ " siga 0\n"
+- " ipm %0\n"
+- " srl %0,28\n"
+- : "=d" (cc)
+- : "d" (__fc), "d" (__schid), "d" (out), "d" (in) : "cc");
++ " ipm %[cc]\n"
++ " srl %[cc],28\n"
++ : [cc] "=&d" (cc)
++ : [fc] "d" (fc), [schid] "d" (schid),
++ [out] "d" (out_mask), [in] "d" (in_mask)
++ : "cc", "0", "1", "2", "3");
+ return cc;
+ }
+
+-static inline int do_siga_input(unsigned long schid, unsigned int mask,
+- unsigned int fc)
++static inline int do_siga_input(unsigned long schid, unsigned long mask,
++ unsigned long fc)
+ {
+- register unsigned long __fc asm ("0") = fc;
+- register unsigned long __schid asm ("1") = schid;
+- register unsigned long __mask asm ("2") = mask;
+ int cc;
+
+ asm volatile(
++ " lgr 0,%[fc]\n"
++ " lgr 1,%[schid]\n"
++ " lgr 2,%[mask]\n"
+ " siga 0\n"
+- " ipm %0\n"
+- " srl %0,28\n"
+- : "=d" (cc)
+- : "d" (__fc), "d" (__schid), "d" (__mask) : "cc");
++ " ipm %[cc]\n"
++ " srl %[cc],28\n"
++ : [cc] "=&d" (cc)
++ : [fc] "d" (fc), [schid] "d" (schid), [mask] "d" (mask)
++ : "cc", "0", "1", "2");
+ return cc;
+ }
+
+@@ -78,23 +81,24 @@ static inline int do_siga_input(unsigned long schid, unsigned int mask,
+ * Note: For IQDC unicast queues only the highest priority queue is processed.
+ */
+ static inline int do_siga_output(unsigned long schid, unsigned long mask,
+- unsigned int *bb, unsigned int fc,
++ unsigned int *bb, unsigned long fc,
+ unsigned long aob)
+ {
+- register unsigned long __fc asm("0") = fc;
+- register unsigned long __schid asm("1") = schid;
+- register unsigned long __mask asm("2") = mask;
+- register unsigned long __aob asm("3") = aob;
+ int cc;
+
+ asm volatile(
++ " lgr 0,%[fc]\n"
++ " lgr 1,%[schid]\n"
++ " lgr 2,%[mask]\n"
++ " lgr 3,%[aob]\n"
+ " siga 0\n"
+- " ipm %0\n"
+- " srl %0,28\n"
+- : "=d" (cc), "+d" (__fc), "+d" (__aob)
+- : "d" (__schid), "d" (__mask)
+- : "cc");
+- *bb = __fc >> 31;
++ " lgr %[fc],0\n"
++ " ipm %[cc]\n"
++ " srl %[cc],28\n"
++ : [cc] "=&d" (cc), [fc] "+&d" (fc)
++ : [schid] "d" (schid), [mask] "d" (mask), [aob] "d" (aob)
++ : "cc", "0", "1", "2", "3");
++ *bb = fc >> 31;
+ return cc;
+ }
+
+diff --git a/drivers/spi/spi-fsl-cpm.c b/drivers/spi/spi-fsl-cpm.c
+index 8f7b26ec181e2..0485593dc2f5b 100644
+--- a/drivers/spi/spi-fsl-cpm.c
++++ b/drivers/spi/spi-fsl-cpm.c
+@@ -25,6 +25,7 @@
+ #include <linux/spi/spi.h>
+ #include <linux/types.h>
+ #include <linux/platform_device.h>
++#include <linux/byteorder/generic.h>
+
+ #include "spi-fsl-cpm.h"
+ #include "spi-fsl-lib.h"
+@@ -124,6 +125,21 @@ int fsl_spi_cpm_bufs(struct mpc8xxx_spi *mspi,
+ mspi->rx_dma = mspi->dma_dummy_rx;
+ mspi->map_rx_dma = 0;
+ }
++ if (t->bits_per_word == 16 && t->tx_buf) {
++ const u16 *src = t->tx_buf;
++ u16 *dst;
++ int i;
++
++ dst = kmalloc(t->len, GFP_KERNEL);
++ if (!dst)
++ return -ENOMEM;
++
++ for (i = 0; i < t->len >> 1; i++)
++ dst[i] = cpu_to_le16p(src + i);
++
++ mspi->tx = dst;
++ mspi->map_tx_dma = 1;
++ }
+
+ if (mspi->map_tx_dma) {
+ void *nonconst_tx = (void *)mspi->tx; /* shut up gcc */
+@@ -177,6 +193,13 @@ void fsl_spi_cpm_bufs_complete(struct mpc8xxx_spi *mspi)
+ if (mspi->map_rx_dma)
+ dma_unmap_single(dev, mspi->rx_dma, t->len, DMA_FROM_DEVICE);
+ mspi->xfer_in_progress = NULL;
++
++ if (t->bits_per_word == 16 && t->rx_buf) {
++ int i;
++
++ for (i = 0; i < t->len; i += 2)
++ le16_to_cpus(t->rx_buf + i);
++ }
+ }
+ EXPORT_SYMBOL_GPL(fsl_spi_cpm_bufs_complete);
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 479d10dc6cb84..5e49fed487f8a 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -201,26 +201,6 @@ static int mspi_apply_cpu_mode_quirks(struct spi_mpc8xxx_cs *cs,
+ return bits_per_word;
+ }
+
+-static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs,
+- struct spi_device *spi,
+- int bits_per_word)
+-{
+- /* CPM/QE uses Little Endian for words > 8
+- * so transform 16 and 32 bits words into 8 bits
+- * Unfortnatly that doesn't work for LSB so
+- * reject these for now */
+- /* Note: 32 bits word, LSB works iff
+- * tfcr/rfcr is set to CPMFCR_GBL */
+- if (spi->mode & SPI_LSB_FIRST &&
+- bits_per_word > 8)
+- return -EINVAL;
+- if (bits_per_word <= 8)
+- return bits_per_word;
+- if (bits_per_word == 16 || bits_per_word == 32)
+- return 8; /* pretend its 8 bits */
+- return -EINVAL;
+-}
+-
+ static int fsl_spi_setup_transfer(struct spi_device *spi,
+ struct spi_transfer *t)
+ {
+@@ -248,9 +228,6 @@ static int fsl_spi_setup_transfer(struct spi_device *spi,
+ bits_per_word = mspi_apply_cpu_mode_quirks(cs, spi,
+ mpc8xxx_spi,
+ bits_per_word);
+- else
+- bits_per_word = mspi_apply_qe_mode_quirks(cs, spi,
+- bits_per_word);
+
+ if (bits_per_word < 0)
+ return bits_per_word;
+@@ -357,12 +334,44 @@ static int fsl_spi_bufs(struct spi_device *spi, struct spi_transfer *t,
+ static int fsl_spi_do_one_msg(struct spi_master *master,
+ struct spi_message *m)
+ {
++ struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(master);
+ struct spi_device *spi = m->spi;
+ struct spi_transfer *t, *first;
+ unsigned int cs_change;
+ const int nsecs = 50;
+ int status;
+
++ /*
++ * In CPU mode, optimize large byte transfers to use larger
++ * bits_per_word values to reduce number of interrupts taken.
++ */
++ list_for_each_entry(t, &m->transfers, transfer_list) {
++ if (!(mpc8xxx_spi->flags & SPI_CPM_MODE)) {
++ if (t->len < 256 || t->bits_per_word != 8)
++ continue;
++ if ((t->len & 3) == 0)
++ t->bits_per_word = 32;
++ else if ((t->len & 1) == 0)
++ t->bits_per_word = 16;
++ } else {
++ /*
++ * CPM/QE uses Little Endian for words > 8
++ * so transform 16 and 32 bits words into 8 bits
++ * Unfortnatly that doesn't work for LSB so
++ * reject these for now
++ * Note: 32 bits word, LSB works iff
++ * tfcr/rfcr is set to CPMFCR_GBL
++ */
++ if (m->spi->mode & SPI_LSB_FIRST && t->bits_per_word > 8)
++ return -EINVAL;
++ if (t->bits_per_word == 16 || t->bits_per_word == 32)
++ t->bits_per_word = 8; /* pretend its 8 bits */
++ if (t->bits_per_word == 8 && t->len >= 256 &&
++ (mpc8xxx_spi->flags & SPI_CPM1))
++ t->bits_per_word = 16;
++ }
++ }
++
+ /* Don't allow changes if CS is active */
+ first = list_first_entry(&m->transfers, struct spi_transfer,
+ transfer_list);
+@@ -642,8 +651,14 @@ static struct spi_master * fsl_spi_probe(struct device *dev,
+ if (mpc8xxx_spi->type == TYPE_GRLIB)
+ fsl_spi_grlib_probe(dev);
+
+- master->bits_per_word_mask =
+- (SPI_BPW_RANGE_MASK(4, 16) | SPI_BPW_MASK(32)) &
++ if (mpc8xxx_spi->flags & SPI_CPM_MODE)
++ master->bits_per_word_mask =
++ (SPI_BPW_RANGE_MASK(4, 8) | SPI_BPW_MASK(16) | SPI_BPW_MASK(32));
++ else
++ master->bits_per_word_mask =
++ (SPI_BPW_RANGE_MASK(4, 16) | SPI_BPW_MASK(32));
++
++ master->bits_per_word_mask &=
+ SPI_BPW_RANGE_MASK(1, mpc8xxx_spi->max_bits_per_word);
+
+ if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE)
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index ec2296a4c44dd..1ad4b69292ad8 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -237,6 +237,18 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi,
+ return true;
+ }
+
++/*
++ * Note the number of natively supported chip selects for MX51 is 4. Some
++ * devices may have less actual SS pins but the register map supports 4. When
++ * using gpio chip selects the cs values passed into the macros below can go
++ * outside the range 0 - 3. We therefore need to limit the cs value to avoid
++ * corrupting bits outside the allocated locations.
++ *
++ * The simplest way to do this is to just mask the cs bits to 2 bits. This
++ * still allows all 4 native chip selects to work as well as gpio chip selects
++ * (which can use any of the 4 chip select configurations).
++ */
++
+ #define MX51_ECSPI_CTRL 0x08
+ #define MX51_ECSPI_CTRL_ENABLE (1 << 0)
+ #define MX51_ECSPI_CTRL_XCH (1 << 2)
+@@ -245,16 +257,16 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi,
+ #define MX51_ECSPI_CTRL_DRCTL(drctl) ((drctl) << 16)
+ #define MX51_ECSPI_CTRL_POSTDIV_OFFSET 8
+ #define MX51_ECSPI_CTRL_PREDIV_OFFSET 12
+-#define MX51_ECSPI_CTRL_CS(cs) ((cs) << 18)
++#define MX51_ECSPI_CTRL_CS(cs) ((cs & 3) << 18)
+ #define MX51_ECSPI_CTRL_BL_OFFSET 20
+ #define MX51_ECSPI_CTRL_BL_MASK (0xfff << 20)
+
+ #define MX51_ECSPI_CONFIG 0x0c
+-#define MX51_ECSPI_CONFIG_SCLKPHA(cs) (1 << ((cs) + 0))
+-#define MX51_ECSPI_CONFIG_SCLKPOL(cs) (1 << ((cs) + 4))
+-#define MX51_ECSPI_CONFIG_SBBCTRL(cs) (1 << ((cs) + 8))
+-#define MX51_ECSPI_CONFIG_SSBPOL(cs) (1 << ((cs) + 12))
+-#define MX51_ECSPI_CONFIG_SCLKCTL(cs) (1 << ((cs) + 20))
++#define MX51_ECSPI_CONFIG_SCLKPHA(cs) (1 << ((cs & 3) + 0))
++#define MX51_ECSPI_CONFIG_SCLKPOL(cs) (1 << ((cs & 3) + 4))
++#define MX51_ECSPI_CONFIG_SBBCTRL(cs) (1 << ((cs & 3) + 8))
++#define MX51_ECSPI_CONFIG_SSBPOL(cs) (1 << ((cs & 3) + 12))
++#define MX51_ECSPI_CONFIG_SCLKCTL(cs) (1 << ((cs & 3) + 20))
+
+ #define MX51_ECSPI_INT 0x10
+ #define MX51_ECSPI_INT_TEEN (1 << 0)
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+index d5ef1986bde4d..0afe4ed9ca885 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+@@ -61,9 +61,9 @@ static const struct rtl819x_ops rtl819xp_ops = {
+ };
+
+ static struct pci_device_id rtl8192_pci_id_tbl[] = {
+- {RTL_PCI_DEVICE(0x10ec, 0x8192, rtl819xp_ops)},
+- {RTL_PCI_DEVICE(0x07aa, 0x0044, rtl819xp_ops)},
+- {RTL_PCI_DEVICE(0x07aa, 0x0047, rtl819xp_ops)},
++ {PCI_DEVICE(0x10ec, 0x8192)},
++ {PCI_DEVICE(0x07aa, 0x0044)},
++ {PCI_DEVICE(0x07aa, 0x0047)},
+ {}
+ };
+
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.h b/drivers/staging/rtl8192e/rtl8192e/rtl_core.h
+index 866fe4d4cb28d..964cc5b8eb91d 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.h
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.h
+@@ -67,11 +67,6 @@
+ #define IS_HARDWARE_TYPE_8192SE(_priv) \
+ (((struct r8192_priv *)rtllib_priv(dev))->card_8192 == NIC_8192SE)
+
+-#define RTL_PCI_DEVICE(vend, dev, cfg) \
+- .vendor = (vend), .device = (dev), \
+- .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, \
+- .driver_data = (kernel_ulong_t)&(cfg)
+-
+ #define TOTAL_CAM_ENTRY 32
+ #define CAM_CONTENT_COUNT 8
+
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index d2df7d71d6667..a0325af2832a0 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -1125,6 +1125,7 @@ void serial8250_unregister_port(int line)
+ uart->port.type = PORT_UNKNOWN;
+ uart->port.dev = &serial8250_isa_devs->dev;
+ uart->capabilities = 0;
++ serial8250_init_port(uart);
+ serial8250_apply_quirks(uart);
+ uart_add_one_port(&serial8250_reg, &uart->port);
+ } else {
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index fd9dd800e1a6a..274e644f34f27 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1648,6 +1648,8 @@ pci_wch_ch38x_setup(struct serial_private *priv,
+ #define PCI_SUBDEVICE_ID_SIIG_DUAL_30 0x2530
+ #define PCI_VENDOR_ID_ADVANTECH 0x13fe
+ #define PCI_DEVICE_ID_INTEL_CE4100_UART 0x2e66
++#define PCI_DEVICE_ID_ADVANTECH_PCI1600 0x1600
++#define PCI_DEVICE_ID_ADVANTECH_PCI1600_1611 0x1611
+ #define PCI_DEVICE_ID_ADVANTECH_PCI3620 0x3620
+ #define PCI_DEVICE_ID_ADVANTECH_PCI3618 0x3618
+ #define PCI_DEVICE_ID_ADVANTECH_PCIf618 0xf618
+@@ -3840,6 +3842,9 @@ static SIMPLE_DEV_PM_OPS(pciserial_pm_ops, pciserial_suspend_one,
+ pciserial_resume_one);
+
+ static const struct pci_device_id serial_pci_tbl[] = {
++ { PCI_VENDOR_ID_ADVANTECH, PCI_DEVICE_ID_ADVANTECH_PCI1600,
++ PCI_DEVICE_ID_ADVANTECH_PCI1600_1611, PCI_ANY_ID, 0, 0,
++ pbn_b0_4_921600 },
+ /* Advantech use PCI_DEVICE_ID_ADVANTECH_PCI3620 (0x3620) as 'PCI_SUBVENDOR_ID' */
+ { PCI_VENDOR_ID_ADVANTECH, PCI_DEVICE_ID_ADVANTECH_PCI3620,
+ PCI_DEVICE_ID_ADVANTECH_PCI3620, 0x0001, 0, 0,
+diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c
+index d904a3a345e74..dd4be3c8c049c 100644
+--- a/drivers/tty/serial/arc_uart.c
++++ b/drivers/tty/serial/arc_uart.c
+@@ -613,10 +613,11 @@ static int arc_serial_probe(struct platform_device *pdev)
+ }
+ uart->baud = val;
+
+- port->membase = of_iomap(np, 0);
+- if (!port->membase)
++ port->membase = devm_platform_ioremap_resource(pdev, 0);
++ if (IS_ERR(port->membase)) {
+ /* No point of dev_err since UART itself is hosed here */
+- return -ENXIO;
++ return PTR_ERR(port->membase);
++ }
+
+ port->irq = irq_of_parse_and_map(np, 0);
+
+diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
+index 28bc9c70de3ec..78ea9b9c64501 100644
+--- a/drivers/tty/vt/vc_screen.c
++++ b/drivers/tty/vt/vc_screen.c
+@@ -182,39 +182,47 @@ vcs_vc(struct inode *inode, int *viewed)
+ return vc_cons[currcons].d;
+ }
+
+-/*
+- * Returns size for VC carried by inode.
++/**
++ * vcs_size -- return size for a VC in @vc
++ * @vc: which VC
++ * @attr: does it use attributes?
++ * @unicode: is it unicode?
++ *
+ * Must be called with console_lock.
+ */
+-static int
+-vcs_size(struct inode *inode)
++static int vcs_size(const struct vc_data *vc, bool attr, bool unicode)
+ {
+ int size;
+- struct vc_data *vc;
+
+ WARN_CONSOLE_UNLOCKED();
+
+- vc = vcs_vc(inode, NULL);
+- if (!vc)
+- return -ENXIO;
+-
+ size = vc->vc_rows * vc->vc_cols;
+
+- if (use_attributes(inode)) {
+- if (use_unicode(inode))
++ if (attr) {
++ if (unicode)
+ return -EOPNOTSUPP;
+- size = 2*size + HEADER_SIZE;
+- } else if (use_unicode(inode))
++
++ size = 2 * size + HEADER_SIZE;
++ } else if (unicode)
+ size *= 4;
++
+ return size;
+ }
+
+ static loff_t vcs_lseek(struct file *file, loff_t offset, int orig)
+ {
++ struct inode *inode = file_inode(file);
++ struct vc_data *vc;
+ int size;
+
+ console_lock();
+- size = vcs_size(file_inode(file));
++ vc = vcs_vc(inode, NULL);
++ if (!vc) {
++ console_unlock();
++ return -ENXIO;
++ }
++
++ size = vcs_size(vc, use_attributes(inode), use_unicode(inode));
+ console_unlock();
+ if (size < 0)
+ return size;
+@@ -276,7 +284,7 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+ * as copy_to_user at the end of this loop
+ * could sleep.
+ */
+- size = vcs_size(inode);
++ size = vcs_size(vc, attr, uni_mode);
+ if (size < 0) {
+ ret = size;
+ break;
+@@ -457,7 +465,11 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
+ if (!vc)
+ goto unlock_out;
+
+- size = vcs_size(inode);
++ size = vcs_size(vc, attr, false);
++ if (size < 0) {
++ ret = size;
++ goto unlock_out;
++ }
+ ret = -EINVAL;
+ if (pos < 0 || pos > size)
+ goto unlock_out;
+@@ -492,11 +504,18 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
+ }
+ }
+
+- /* The vcs_size might have changed while we slept to grab
+- * the user buffer, so recheck.
++ /* The vc might have been freed or vcs_size might have changed
++ * while we slept to grab the user buffer, so recheck.
+ * Return data written up to now on failure.
+ */
+- size = vcs_size(inode);
++ vc = vcs_vc(inode, &viewed);
++ if (!vc) {
++ if (written)
++ break;
++ ret = -ENXIO;
++ goto unlock_out;
++ }
++ size = vcs_size(vc, attr, false);
+ if (size < 0) {
+ if (written)
+ break;
+diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
+index 4ebfbd7379051..c369920b48548 100644
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -209,6 +209,82 @@ int usb_find_common_endpoints_reverse(struct usb_host_interface *alt,
+ }
+ EXPORT_SYMBOL_GPL(usb_find_common_endpoints_reverse);
+
++/**
++ * usb_find_endpoint() - Given an endpoint address, search for the endpoint's
++ * usb_host_endpoint structure in an interface's current altsetting.
++ * @intf: the interface whose current altsetting should be searched
++ * @ep_addr: the endpoint address (number and direction) to find
++ *
++ * Search the altsetting's list of endpoints for one with the specified address.
++ *
++ * Return: Pointer to the usb_host_endpoint if found, %NULL otherwise.
++ */
++static const struct usb_host_endpoint *usb_find_endpoint(
++ const struct usb_interface *intf, unsigned int ep_addr)
++{
++ int n;
++ const struct usb_host_endpoint *ep;
++
++ n = intf->cur_altsetting->desc.bNumEndpoints;
++ ep = intf->cur_altsetting->endpoint;
++ for (; n > 0; (--n, ++ep)) {
++ if (ep->desc.bEndpointAddress == ep_addr)
++ return ep;
++ }
++ return NULL;
++}
++
++/**
++ * usb_check_bulk_endpoints - Check whether an interface's current altsetting
++ * contains a set of bulk endpoints with the given addresses.
++ * @intf: the interface whose current altsetting should be searched
++ * @ep_addrs: 0-terminated array of the endpoint addresses (number and
++ * direction) to look for
++ *
++ * Search for endpoints with the specified addresses and check their types.
++ *
++ * Return: %true if all the endpoints are found and are bulk, %false otherwise.
++ */
++bool usb_check_bulk_endpoints(
++ const struct usb_interface *intf, const u8 *ep_addrs)
++{
++ const struct usb_host_endpoint *ep;
++
++ for (; *ep_addrs; ++ep_addrs) {
++ ep = usb_find_endpoint(intf, *ep_addrs);
++ if (!ep || !usb_endpoint_xfer_bulk(&ep->desc))
++ return false;
++ }
++ return true;
++}
++EXPORT_SYMBOL_GPL(usb_check_bulk_endpoints);
++
++/**
++ * usb_check_int_endpoints - Check whether an interface's current altsetting
++ * contains a set of interrupt endpoints with the given addresses.
++ * @intf: the interface whose current altsetting should be searched
++ * @ep_addrs: 0-terminated array of the endpoint addresses (number and
++ * direction) to look for
++ *
++ * Search for endpoints with the specified addresses and check their types.
++ *
++ * Return: %true if all the endpoints are found and are interrupt,
++ * %false otherwise.
++ */
++bool usb_check_int_endpoints(
++ const struct usb_interface *intf, const u8 *ep_addrs)
++{
++ const struct usb_host_endpoint *ep;
++
++ for (; *ep_addrs; ++ep_addrs) {
++ ep = usb_find_endpoint(intf, *ep_addrs);
++ if (!ep || !usb_endpoint_xfer_int(&ep->desc))
++ return false;
++ }
++ return true;
++}
++EXPORT_SYMBOL_GPL(usb_check_int_endpoints);
++
+ /**
+ * usb_find_alt_setting() - Given a configuration, find the alternate setting
+ * for the given interface.
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 2fe91f120bb1d..7d9a551c47f98 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -17,6 +17,8 @@
+ #include <linux/etherdevice.h>
+ #include <linux/ethtool.h>
+ #include <linux/if_vlan.h>
++#include <linux/string_helpers.h>
++#include <linux/usb/composite.h>
+
+ #include "u_ether.h"
+
+@@ -102,41 +104,6 @@ static inline int qlen(struct usb_gadget *gadget, unsigned qmult)
+
+ /*-------------------------------------------------------------------------*/
+
+-/* REVISIT there must be a better way than having two sets
+- * of debug calls ...
+- */
+-
+-#undef DBG
+-#undef VDBG
+-#undef ERROR
+-#undef INFO
+-
+-#define xprintk(d, level, fmt, args...) \
+- printk(level "%s: " fmt , (d)->net->name , ## args)
+-
+-#ifdef DEBUG
+-#undef DEBUG
+-#define DBG(dev, fmt, args...) \
+- xprintk(dev , KERN_DEBUG , fmt , ## args)
+-#else
+-#define DBG(dev, fmt, args...) \
+- do { } while (0)
+-#endif /* DEBUG */
+-
+-#ifdef VERBOSE_DEBUG
+-#define VDBG DBG
+-#else
+-#define VDBG(dev, fmt, args...) \
+- do { } while (0)
+-#endif /* DEBUG */
+-
+-#define ERROR(dev, fmt, args...) \
+- xprintk(dev , KERN_ERR , fmt , ## args)
+-#define INFO(dev, fmt, args...) \
+- xprintk(dev , KERN_INFO , fmt , ## args)
+-
+-/*-------------------------------------------------------------------------*/
+-
+ /* NETWORK DRIVER HOOKUP (to the layer above this driver) */
+
+ static void eth_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *p)
+@@ -974,6 +941,8 @@ int gether_get_host_addr_cdc(struct net_device *net, char *host_addr, int len)
+ dev = netdev_priv(net);
+ snprintf(host_addr, len, "%pm", dev->host_mac);
+
++ string_upper(host_addr, host_addr);
++
+ return strlen(host_addr);
+ }
+ EXPORT_SYMBOL_GPL(gether_get_host_addr_cdc);
+diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
+index 4877bf82ad395..6a68a9f8d57f0 100644
+--- a/drivers/usb/misc/sisusbvga/sisusb.c
++++ b/drivers/usb/misc/sisusbvga/sisusb.c
+@@ -3016,6 +3016,20 @@ static int sisusb_probe(struct usb_interface *intf,
+ struct usb_device *dev = interface_to_usbdev(intf);
+ struct sisusb_usb_data *sisusb;
+ int retval = 0, i;
++ static const u8 ep_addresses[] = {
++ SISUSB_EP_GFX_IN | USB_DIR_IN,
++ SISUSB_EP_GFX_OUT | USB_DIR_OUT,
++ SISUSB_EP_GFX_BULK_OUT | USB_DIR_OUT,
++ SISUSB_EP_GFX_LBULK_OUT | USB_DIR_OUT,
++ SISUSB_EP_BRIDGE_IN | USB_DIR_IN,
++ SISUSB_EP_BRIDGE_OUT | USB_DIR_OUT,
++ 0};
++
++ /* Are the expected endpoints present? */
++ if (!usb_check_bulk_endpoints(intf, ep_addresses)) {
++ dev_err(&intf->dev, "Invalid USB2VGA device\n");
++ return -EINVAL;
++ }
+
+ dev_info(&dev->dev, "USB2VGA dongle found at address %d\n",
+ dev->devnum);
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index f287ee8183df7..abeadc7c26738 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -392,22 +392,25 @@ static DEF_SCSI_QCMD(queuecommand)
+ ***********************************************************************/
+
+ /* Command timeout and abort */
+-static int command_abort(struct scsi_cmnd *srb)
++static int command_abort_matching(struct us_data *us, struct scsi_cmnd *srb_match)
+ {
+- struct us_data *us = host_to_us(srb->device->host);
+-
+- usb_stor_dbg(us, "%s called\n", __func__);
+-
+ /*
+ * us->srb together with the TIMED_OUT, RESETTING, and ABORTING
+ * bits are protected by the host lock.
+ */
+ scsi_lock(us_to_host(us));
+
+- /* Is this command still active? */
+- if (us->srb != srb) {
++ /* is there any active pending command to abort ? */
++ if (!us->srb) {
+ scsi_unlock(us_to_host(us));
+ usb_stor_dbg(us, "-- nothing to abort\n");
++ return SUCCESS;
++ }
++
++ /* Does the command match the passed srb if any ? */
++ if (srb_match && us->srb != srb_match) {
++ scsi_unlock(us_to_host(us));
++ usb_stor_dbg(us, "-- pending command mismatch\n");
+ return FAILED;
+ }
+
+@@ -430,6 +433,14 @@ static int command_abort(struct scsi_cmnd *srb)
+ return SUCCESS;
+ }
+
++static int command_abort(struct scsi_cmnd *srb)
++{
++ struct us_data *us = host_to_us(srb->device->host);
++
++ usb_stor_dbg(us, "%s called\n", __func__);
++ return command_abort_matching(us, srb);
++}
++
+ /*
+ * This invokes the transport reset mechanism to reset the state of the
+ * device
+@@ -441,6 +452,9 @@ static int device_reset(struct scsi_cmnd *srb)
+
+ usb_stor_dbg(us, "%s called\n", __func__);
+
++ /* abort any pending command before reset */
++ command_abort_matching(us, NULL);
++
+ /* lock the device pointers and do the reset */
+ mutex_lock(&(us->dev_mutex));
+ result = us->transport_reset(us);
+diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
+index 7387f52cb58d1..bc09de5ea17d2 100644
+--- a/drivers/usb/typec/altmodes/displayport.c
++++ b/drivers/usb/typec/altmodes/displayport.c
+@@ -501,6 +501,10 @@ static ssize_t pin_assignment_show(struct device *dev,
+
+ mutex_unlock(&dp->lock);
+
++ /* get_current_pin_assignments can return 0 when no matching pin assignments are found */
++ if (len == 0)
++ len++;
++
+ buf[len - 1] = '\n';
+ return len;
+ }
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index e4308f97d9739..0fdae44c9b8cf 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -1006,7 +1006,21 @@ static bool svdm_consume_svids(struct tcpm_port *port, const __le32 *payload,
+ pmdata->svids[pmdata->nsvids++] = svid;
+ tcpm_log(port, "SVID %d: 0x%x", pmdata->nsvids, svid);
+ }
+- return true;
++
++ /*
++ * PD3.0 Spec 6.4.4.3.2: The SVIDs are returned 2 per VDO (see Table
++ * 6-43), and can be returned maximum 6 VDOs per response (see Figure
++ * 6-19). If the Respondersupports 12 or more SVID then the Discover
++ * SVIDs Command Shall be executed multiple times until a Discover
++ * SVIDs VDO is returned ending either with a SVID value of 0x0000 in
++ * the last part of the last VDO or with a VDO containing two SVIDs
++ * with values of 0x0000.
++ *
++ * However, some odd dockers support SVIDs less than 12 but without
++ * 0x0000 in the last VDO, so we need to break the Discover SVIDs
++ * request and return false here.
++ */
++ return cnt == 7;
+ abort:
+ tcpm_log(port, "SVID_DISCOVERY_MAX(%d) too low!", SVID_DISCOVERY_MAX);
+ return false;
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index f94bb6034a5a8..3441371a4ab47 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -330,8 +330,10 @@ static struct sock_mapping *pvcalls_new_active_socket(
+ void *page;
+
+ map = kzalloc(sizeof(*map), GFP_KERNEL);
+- if (map == NULL)
++ if (map == NULL) {
++ sock_release(sock);
+ return NULL;
++ }
+
+ map->fedata = fedata;
+ map->sock = sock;
+@@ -423,10 +425,8 @@ static int pvcalls_back_connect(struct xenbus_device *dev,
+ req->u.connect.ref,
+ req->u.connect.evtchn,
+ sock);
+- if (!map) {
++ if (!map)
+ ret = -EFAULT;
+- sock_release(sock);
+- }
+
+ out:
+ rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
+@@ -567,7 +567,6 @@ static void __pvcalls_back_accept(struct work_struct *work)
+ sock);
+ if (!map) {
+ ret = -EFAULT;
+- sock_release(sock);
+ goto out_error;
+ }
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 98f87cc474332..437ca4691967d 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4348,7 +4348,11 @@ static void btrfs_destroy_delalloc_inodes(struct btrfs_root *root)
+ */
+ inode = igrab(&btrfs_inode->vfs_inode);
+ if (inode) {
++ unsigned int nofs_flag;
++
++ nofs_flag = memalloc_nofs_save();
+ invalidate_inode_pages2(inode->i_mapping);
++ memalloc_nofs_restore(nofs_flag);
+ iput(inode);
+ }
+ spin_lock(&root->delalloc_lock);
+@@ -4466,7 +4470,12 @@ static void btrfs_cleanup_bg_io(struct btrfs_block_group_cache *cache)
+
+ inode = cache->io_ctl.inode;
+ if (inode) {
++ unsigned int nofs_flag;
++
++ nofs_flag = memalloc_nofs_save();
+ invalidate_inode_pages2(inode->i_mapping);
++ memalloc_nofs_restore(nofs_flag);
++
+ BTRFS_I(inode)->generation = 0;
+ cache->io_ctl.inode = NULL;
+ iput(inode);
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index 6511cb71986c9..b623e9f3b4c49 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -783,15 +783,16 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
+ }
+ spin_lock(&ctl->tree_lock);
+ ret = link_free_space(ctl, e);
+- ctl->total_bitmaps++;
+- ctl->op->recalc_thresholds(ctl);
+- spin_unlock(&ctl->tree_lock);
+ if (ret) {
++ spin_unlock(&ctl->tree_lock);
+ btrfs_err(fs_info,
+ "Duplicate entries in free space cache, dumping");
+ kmem_cache_free(btrfs_free_space_cachep, e);
+ goto free_cache;
+ }
++ ctl->total_bitmaps++;
++ ctl->op->recalc_thresholds(ctl);
++ spin_unlock(&ctl->tree_lock);
+ list_add_tail(&e->list, &bitmaps);
+ }
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index f314b2c2d1487..e4a4074ef33da 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -6620,7 +6620,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
+ if (IS_ERR(trans))
+ return PTR_ERR(trans);
+
+- err = btrfs_find_free_ino(root, &objectid);
++ err = btrfs_find_free_objectid(root, &objectid);
+ if (err)
+ goto out_unlock;
+
+@@ -6684,7 +6684,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
+ if (IS_ERR(trans))
+ return PTR_ERR(trans);
+
+- err = btrfs_find_free_ino(root, &objectid);
++ err = btrfs_find_free_objectid(root, &objectid);
+ if (err)
+ goto out_unlock;
+
+@@ -6837,7 +6837,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+ if (IS_ERR(trans))
+ return PTR_ERR(trans);
+
+- err = btrfs_find_free_ino(root, &objectid);
++ err = btrfs_find_free_objectid(root, &objectid);
+ if (err)
+ goto out_fail;
+
+@@ -9819,7 +9819,7 @@ static int btrfs_whiteout_for_rename(struct btrfs_trans_handle *trans,
+ u64 objectid;
+ u64 index;
+
+- ret = btrfs_find_free_ino(root, &objectid);
++ ret = btrfs_find_free_objectid(root, &objectid);
+ if (ret)
+ return ret;
+
+@@ -10316,7 +10316,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
+ if (IS_ERR(trans))
+ return PTR_ERR(trans);
+
+- err = btrfs_find_free_ino(root, &objectid);
++ err = btrfs_find_free_objectid(root, &objectid);
+ if (err)
+ goto out_unlock;
+
+@@ -10600,7 +10600,7 @@ static int btrfs_tmpfile(struct inode *dir, struct dentry *dentry, umode_t mode)
+ if (IS_ERR(trans))
+ return PTR_ERR(trans);
+
+- ret = btrfs_find_free_ino(root, &objectid);
++ ret = btrfs_find_free_objectid(root, &objectid);
+ if (ret)
+ goto out;
+
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index a5ef8275440d5..07db34ffa7a19 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -976,6 +976,19 @@ skip_inode:
+ continue;
+ adjust_snap_realm_parent(mdsc, child, realm->ino);
+ }
++ } else {
++ /*
++ * In the non-split case both 'num_split_inos' and
++ * 'num_split_realms' should be 0, making this a no-op.
++ * However the MDS happens to populate 'split_realms' list
++ * in one of the UPDATE op cases by mistake.
++ *
++ * Skip both lists just in case to ensure that 'p' is
++ * positioned at the start of realm info, as expected by
++ * ceph_update_snap_trace().
++ */
++ p += sizeof(u64) * num_split_inos;
++ p += sizeof(u64) * num_split_realms;
+ }
+
+ /*
+diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h
+index 00e759f051619..a203a5723e2c0 100644
+--- a/fs/ext2/ext2.h
++++ b/fs/ext2/ext2.h
+@@ -177,6 +177,7 @@ static inline struct ext2_sb_info *EXT2_SB(struct super_block *sb)
+ #define EXT2_MIN_BLOCK_SIZE 1024
+ #define EXT2_MAX_BLOCK_SIZE 4096
+ #define EXT2_MIN_BLOCK_LOG_SIZE 10
++#define EXT2_MAX_BLOCK_LOG_SIZE 16
+ #define EXT2_BLOCK_SIZE(s) ((s)->s_blocksize)
+ #define EXT2_ADDR_PER_BLOCK(s) (EXT2_BLOCK_SIZE(s) / sizeof (__u32))
+ #define EXT2_BLOCK_SIZE_BITS(s) ((s)->s_blocksize_bits)
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index 44a1f356aca29..3349ce85d27cb 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -978,6 +978,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
+ goto failed_mount;
+ }
+
++ if (le32_to_cpu(es->s_log_block_size) >
++ (EXT2_MAX_BLOCK_LOG_SIZE - BLOCK_SIZE_BITS)) {
++ ext2_msg(sb, KERN_ERR,
++ "Invalid log block size: %u",
++ le32_to_cpu(es->s_log_block_size));
++ goto failed_mount;
++ }
+ blocksize = BLOCK_SIZE << le32_to_cpu(sbi->s_es->s_log_block_size);
+
+ if (sbi->s_mount_opt & EXT2_MOUNT_DAX) {
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 70e1121d0a30c..23e56c1ffc1bf 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3089,6 +3089,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
+ struct ext4_allocation_request *ar)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
++ struct ext4_super_block *es = sbi->s_es;
+ int bsbits, max;
+ ext4_lblk_t end;
+ loff_t size, start_off;
+@@ -3269,18 +3270,21 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
+ ac->ac_g_ex.fe_len = EXT4_NUM_B2C(sbi, size);
+
+ /* define goal start in order to merge */
+- if (ar->pright && (ar->lright == (start + size))) {
++ if (ar->pright && (ar->lright == (start + size)) &&
++ ar->pright >= size &&
++ ar->pright - size >= le32_to_cpu(es->s_first_data_block)) {
+ /* merge to the right */
+ ext4_get_group_no_and_offset(ac->ac_sb, ar->pright - size,
+- &ac->ac_f_ex.fe_group,
+- &ac->ac_f_ex.fe_start);
++ &ac->ac_g_ex.fe_group,
++ &ac->ac_g_ex.fe_start);
+ ac->ac_flags |= EXT4_MB_HINT_TRY_GOAL;
+ }
+- if (ar->pleft && (ar->lleft + 1 == start)) {
++ if (ar->pleft && (ar->lleft + 1 == start) &&
++ ar->pleft + 1 < ext4_blocks_count(es)) {
+ /* merge to the left */
+ ext4_get_group_no_and_offset(ac->ac_sb, ar->pleft + 1,
+- &ac->ac_f_ex.fe_group,
+- &ac->ac_f_ex.fe_start);
++ &ac->ac_g_ex.fe_group,
++ &ac->ac_g_ex.fe_start);
+ ac->ac_flags |= EXT4_MB_HINT_TRY_GOAL;
+ }
+
+@@ -3372,6 +3376,7 @@ static void ext4_mb_use_inode_pa(struct ext4_allocation_context *ac,
+ BUG_ON(start < pa->pa_pstart);
+ BUG_ON(end > pa->pa_pstart + EXT4_C2B(sbi, pa->pa_len));
+ BUG_ON(pa->pa_free < len);
++ BUG_ON(ac->ac_b_ex.fe_len <= 0);
+ pa->pa_free -= len;
+
+ mb_debug(1, "use %llu/%u from inode pa %p\n", start, len, pa);
+@@ -3676,10 +3681,8 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
+ return -ENOMEM;
+
+ if (ac->ac_b_ex.fe_len < ac->ac_g_ex.fe_len) {
+- int winl;
+- int wins;
+- int win;
+- int offs;
++ int new_bex_start;
++ int new_bex_end;
+
+ /* we can't allocate as much as normalizer wants.
+ * so, found space must get proper lstart
+@@ -3687,26 +3690,40 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
+ BUG_ON(ac->ac_g_ex.fe_logical > ac->ac_o_ex.fe_logical);
+ BUG_ON(ac->ac_g_ex.fe_len < ac->ac_o_ex.fe_len);
+
+- /* we're limited by original request in that
+- * logical block must be covered any way
+- * winl is window we can move our chunk within */
+- winl = ac->ac_o_ex.fe_logical - ac->ac_g_ex.fe_logical;
++ /*
++ * Use the below logic for adjusting best extent as it keeps
++ * fragmentation in check while ensuring logical range of best
++ * extent doesn't overflow out of goal extent:
++ *
++ * 1. Check if best ex can be kept at end of goal and still
++ * cover original start
++ * 2. Else, check if best ex can be kept at start of goal and
++ * still cover original start
++ * 3. Else, keep the best ex at start of original request.
++ */
++ new_bex_end = ac->ac_g_ex.fe_logical +
++ EXT4_C2B(sbi, ac->ac_g_ex.fe_len);
++ new_bex_start = new_bex_end - EXT4_C2B(sbi, ac->ac_b_ex.fe_len);
++ if (ac->ac_o_ex.fe_logical >= new_bex_start)
++ goto adjust_bex;
+
+- /* also, we should cover whole original request */
+- wins = EXT4_C2B(sbi, ac->ac_b_ex.fe_len - ac->ac_o_ex.fe_len);
++ new_bex_start = ac->ac_g_ex.fe_logical;
++ new_bex_end =
++ new_bex_start + EXT4_C2B(sbi, ac->ac_b_ex.fe_len);
++ if (ac->ac_o_ex.fe_logical < new_bex_end)
++ goto adjust_bex;
+
+- /* the smallest one defines real window */
+- win = min(winl, wins);
++ new_bex_start = ac->ac_o_ex.fe_logical;
++ new_bex_end =
++ new_bex_start + EXT4_C2B(sbi, ac->ac_b_ex.fe_len);
+
+- offs = ac->ac_o_ex.fe_logical %
+- EXT4_C2B(sbi, ac->ac_b_ex.fe_len);
+- if (offs && offs < win)
+- win = offs;
++adjust_bex:
++ ac->ac_b_ex.fe_logical = new_bex_start;
+
+- ac->ac_b_ex.fe_logical = ac->ac_o_ex.fe_logical -
+- EXT4_NUM_B2C(sbi, win);
+ BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical);
+ BUG_ON(ac->ac_o_ex.fe_len > ac->ac_b_ex.fe_len);
++ BUG_ON(new_bex_end > (ac->ac_g_ex.fe_logical +
++ EXT4_C2B(sbi, ac->ac_g_ex.fe_len)));
+ }
+
+ /* preallocation can change ac_b_ex, thus we store actually
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index a563de5ccd217..621e0d4f1fbf5 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -273,8 +273,15 @@ static int __f2fs_write_meta_page(struct page *page,
+
+ trace_f2fs_writepage(page, META);
+
+- if (unlikely(f2fs_cp_error(sbi)))
++ if (unlikely(f2fs_cp_error(sbi))) {
++ if (is_sbi_flag_set(sbi, SBI_IS_CLOSE)) {
++ ClearPageUptodate(page);
++ dec_page_count(sbi, F2FS_DIRTY_META);
++ unlock_page(page);
++ return 0;
++ }
+ goto redirty_out;
++ }
+ if (unlikely(is_sbi_flag_set(sbi, SBI_POR_DOING)))
+ goto redirty_out;
+ if (wbc->for_reclaim && page->index < GET_SUM_BLOCK(sbi, 0))
+@@ -1185,7 +1192,8 @@ void f2fs_wait_on_all_pages_writeback(struct f2fs_sb_info *sbi)
+ if (!get_pages(sbi, F2FS_WB_CP_DATA))
+ break;
+
+- if (unlikely(f2fs_cp_error(sbi)))
++ if (unlikely(f2fs_cp_error(sbi) &&
++ !is_sbi_flag_set(sbi, SBI_IS_CLOSE)))
+ break;
+
+ io_schedule_timeout(5*HZ);
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 56b2dadd623b2..419586809cef6 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1885,7 +1885,8 @@ static int __write_data_page(struct page *page, bool *submitted,
+ * don't drop any dirty dentry pages for keeping lastest
+ * directory structure.
+ */
+- if (S_ISDIR(inode->i_mode))
++ if (S_ISDIR(inode->i_mode) &&
++ !is_sbi_flag_set(sbi, SBI_IS_CLOSE))
+ goto redirty_out;
+ goto out;
+ }
+diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
+index a7a423adf7c8b..ff35cc365930c 100644
+--- a/fs/gfs2/glops.c
++++ b/fs/gfs2/glops.c
+@@ -339,6 +339,7 @@ static int inode_go_demote_ok(const struct gfs2_glock *gl)
+
+ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
+ {
++ struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
+ const struct gfs2_dinode *str = buf;
+ struct timespec64 atime;
+ u16 height, depth;
+@@ -378,7 +379,7 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
+ /* i_diskflags and i_eattr must be set before gfs2_set_inode_flags() */
+ gfs2_set_inode_flags(&ip->i_inode);
+ height = be16_to_cpu(str->di_height);
+- if (unlikely(height > GFS2_MAX_META_HEIGHT))
++ if (unlikely(height > sdp->sd_max_height))
+ goto corrupt;
+ ip->i_height = (u8)height;
+
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index c7073a1517d68..a1d4ad584b105 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -476,7 +476,11 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ if (type == HFSPLUS_FOLDER) {
+ struct hfsplus_cat_folder *folder = &entry.folder;
+
+- WARN_ON(fd->entrylength < sizeof(struct hfsplus_cat_folder));
++ if (fd->entrylength < sizeof(struct hfsplus_cat_folder)) {
++ pr_err("bad catalog folder entry\n");
++ res = -EIO;
++ goto out;
++ }
+ hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
+ sizeof(struct hfsplus_cat_folder));
+ hfsplus_get_perms(inode, &folder->permissions, 1);
+@@ -496,7 +500,11 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ } else if (type == HFSPLUS_FILE) {
+ struct hfsplus_cat_file *file = &entry.file;
+
+- WARN_ON(fd->entrylength < sizeof(struct hfsplus_cat_file));
++ if (fd->entrylength < sizeof(struct hfsplus_cat_file)) {
++ pr_err("bad catalog file entry\n");
++ res = -EIO;
++ goto out;
++ }
+ hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
+ sizeof(struct hfsplus_cat_file));
+
+@@ -527,6 +535,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
+ pr_err("bad catalog entry used to create inode\n");
+ res = -EIO;
+ }
++out:
+ return res;
+ }
+
+@@ -535,6 +544,7 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ struct inode *main_inode = inode;
+ struct hfs_find_data fd;
+ hfsplus_cat_entry entry;
++ int res = 0;
+
+ if (HFSPLUS_IS_RSRC(inode))
+ main_inode = HFSPLUS_I(inode)->rsrc_inode;
+@@ -553,7 +563,11 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ if (S_ISDIR(main_inode->i_mode)) {
+ struct hfsplus_cat_folder *folder = &entry.folder;
+
+- WARN_ON(fd.entrylength < sizeof(struct hfsplus_cat_folder));
++ if (fd.entrylength < sizeof(struct hfsplus_cat_folder)) {
++ pr_err("bad catalog folder entry\n");
++ res = -EIO;
++ goto out;
++ }
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ sizeof(struct hfsplus_cat_folder));
+ /* simple node checks? */
+@@ -578,7 +592,11 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ } else {
+ struct hfsplus_cat_file *file = &entry.file;
+
+- WARN_ON(fd.entrylength < sizeof(struct hfsplus_cat_file));
++ if (fd.entrylength < sizeof(struct hfsplus_cat_file)) {
++ pr_err("bad catalog file entry\n");
++ res = -EIO;
++ goto out;
++ }
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ sizeof(struct hfsplus_cat_file));
+ hfsplus_inode_write_fork(inode, &file->data_fork);
+@@ -599,5 +617,5 @@ int hfsplus_cat_write_inode(struct inode *inode)
+ set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags);
+ out:
+ hfs_find_exit(&fd);
+- return 0;
++ return res;
+ }
+diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
+index cf01aa55dd44c..53ec342eb787c 100644
+--- a/fs/nilfs2/inode.c
++++ b/fs/nilfs2/inode.c
+@@ -930,6 +930,7 @@ void nilfs_evict_inode(struct inode *inode)
+ struct nilfs_transaction_info ti;
+ struct super_block *sb = inode->i_sb;
+ struct nilfs_inode_info *ii = NILFS_I(inode);
++ struct the_nilfs *nilfs;
+ int ret;
+
+ if (inode->i_nlink || !ii->i_root || unlikely(is_bad_inode(inode))) {
+@@ -942,6 +943,23 @@ void nilfs_evict_inode(struct inode *inode)
+
+ truncate_inode_pages_final(&inode->i_data);
+
++ nilfs = sb->s_fs_info;
++ if (unlikely(sb_rdonly(sb) || !nilfs->ns_writer)) {
++ /*
++ * If this inode is about to be disposed after the file system
++ * has been degraded to read-only due to file system corruption
++ * or after the writer has been detached, do not make any
++ * changes that cause writes, just clear it.
++ * Do this check after read-locking ns_segctor_sem by
++ * nilfs_transaction_begin() in order to avoid a race with
++ * the writer detach operation.
++ */
++ clear_inode(inode);
++ nilfs_clear_inode(inode);
++ nilfs_transaction_abort(sb);
++ return;
++ }
++
+ /* TODO: some of the following operations may fail. */
+ nilfs_truncate_bmap(ii, 0);
+ nilfs_mark_inode_dirty(inode);
+diff --git a/fs/statfs.c b/fs/statfs.c
+index 56f655f757ffb..29786598c2b5d 100644
+--- a/fs/statfs.c
++++ b/fs/statfs.c
+@@ -114,6 +114,7 @@ static int do_statfs_native(struct kstatfs *st, struct statfs __user *p)
+ if (sizeof(buf) == sizeof(*st))
+ memcpy(&buf, st, sizeof(*st));
+ else {
++ memset(&buf, 0, sizeof(buf));
+ if (sizeof buf.f_blocks == 4) {
+ if ((st->f_blocks | st->f_bfree | st->f_bavail |
+ st->f_bsize | st->f_frsize) &
+@@ -142,7 +143,6 @@ static int do_statfs_native(struct kstatfs *st, struct statfs __user *p)
+ buf.f_namelen = st->f_namelen;
+ buf.f_frsize = st->f_frsize;
+ buf.f_flags = st->f_flags;
+- memset(buf.f_spare, 0, sizeof(buf.f_spare));
+ }
+ if (copy_to_user(p, &buf, sizeof(buf)))
+ return -EFAULT;
+@@ -155,6 +155,7 @@ static int do_statfs64(struct kstatfs *st, struct statfs64 __user *p)
+ if (sizeof(buf) == sizeof(*st))
+ memcpy(&buf, st, sizeof(*st));
+ else {
++ memset(&buf, 0, sizeof(buf));
+ buf.f_type = st->f_type;
+ buf.f_bsize = st->f_bsize;
+ buf.f_blocks = st->f_blocks;
+@@ -166,7 +167,6 @@ static int do_statfs64(struct kstatfs *st, struct statfs64 __user *p)
+ buf.f_namelen = st->f_namelen;
+ buf.f_frsize = st->f_frsize;
+ buf.f_flags = st->f_flags;
+- memset(buf.f_spare, 0, sizeof(buf.f_spare));
+ }
+ if (copy_to_user(p, &buf, sizeof(buf)))
+ return -EFAULT;
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index 60efd9810d536..71a0a5ffdbb1a 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -111,7 +111,6 @@ enum cpuhp_state {
+ CPUHP_AP_PERF_X86_CSTATE_STARTING,
+ CPUHP_AP_PERF_XTENSA_STARTING,
+ CPUHP_AP_MIPS_OP_LOONGSON3_STARTING,
+- CPUHP_AP_ARM_SDEI_STARTING,
+ CPUHP_AP_ARM_VFP_STARTING,
+ CPUHP_AP_ARM64_DEBUG_MONITORS_STARTING,
+ CPUHP_AP_PERF_ARM_HW_BREAKPOINT_STARTING,
+diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
+index 1a9f38f27f656..9e5c98fcea8c6 100644
+--- a/include/linux/platform_device.h
++++ b/include/linux/platform_device.h
+@@ -51,6 +51,9 @@ extern struct device platform_bus;
+ extern void arch_setup_pdev_archdata(struct platform_device *);
+ extern struct resource *platform_get_resource(struct platform_device *,
+ unsigned int, unsigned int);
++extern void __iomem *
++devm_platform_ioremap_resource(struct platform_device *pdev,
++ unsigned int index);
+ extern int platform_get_irq(struct platform_device *, unsigned int);
+ extern int platform_irq_count(struct platform_device *);
+ extern struct resource *platform_get_resource_byname(struct platform_device *,
+diff --git a/include/linux/power/bq27xxx_battery.h b/include/linux/power/bq27xxx_battery.h
+index 13d5dd4eb40b4..95a8715624ed9 100644
+--- a/include/linux/power/bq27xxx_battery.h
++++ b/include/linux/power/bq27xxx_battery.h
+@@ -63,6 +63,7 @@ struct bq27xxx_device_info {
+ struct bq27xxx_access_methods bus;
+ struct bq27xxx_reg_cache cache;
+ int charge_design_full;
++ bool removed;
+ unsigned long last_update;
+ struct delayed_work work;
+ struct power_supply *bat;
+diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h
+index 4f099d3fed3a9..f1063380e6d8a 100644
+--- a/include/linux/sched/task_stack.h
++++ b/include/linux/sched/task_stack.h
+@@ -23,7 +23,7 @@ static inline void *task_stack_page(const struct task_struct *task)
+
+ #define setup_thread_stack(new,old) do { } while(0)
+
+-static inline unsigned long *end_of_stack(const struct task_struct *task)
++static __always_inline unsigned long *end_of_stack(const struct task_struct *task)
+ {
+ #ifdef CONFIG_STACK_GROWSUP
+ return (unsigned long *)((unsigned long)task->stack + THREAD_SIZE) - 1;
+diff --git a/include/linux/string_helpers.h b/include/linux/string_helpers.h
+index d23c5030901a2..0618885b3edc7 100644
+--- a/include/linux/string_helpers.h
++++ b/include/linux/string_helpers.h
+@@ -2,6 +2,7 @@
+ #ifndef _LINUX_STRING_HELPERS_H_
+ #define _LINUX_STRING_HELPERS_H_
+
++#include <linux/ctype.h>
+ #include <linux/types.h>
+
+ struct file;
+@@ -72,6 +73,20 @@ static inline int string_escape_str_any_np(const char *src, char *dst,
+ return string_escape_str(src, dst, sz, ESCAPE_ANY_NP, only);
+ }
+
++static inline void string_upper(char *dst, const char *src)
++{
++ do {
++ *dst++ = toupper(*src);
++ } while (*src++);
++}
++
++static inline void string_lower(char *dst, const char *src)
++{
++ do {
++ *dst++ = tolower(*src);
++ } while (*src++);
++}
++
+ char *kstrdup_quotable(const char *src, gfp_t gfp);
+ char *kstrdup_quotable_cmdline(struct task_struct *task, gfp_t gfp);
+ char *kstrdup_quotable_file(struct file *file, gfp_t gfp);
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 744023c91404a..c7adccb712cd9 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -279,6 +279,11 @@ void usb_put_intf(struct usb_interface *intf);
+ #define USB_MAXINTERFACES 32
+ #define USB_MAXIADS (USB_MAXINTERFACES/2)
+
++bool usb_check_bulk_endpoints(
++ const struct usb_interface *intf, const u8 *ep_addrs);
++bool usb_check_int_endpoints(
++ const struct usb_interface *intf, const u8 *ep_addrs);
++
+ /*
+ * USB Resume Timer: Every Host controller driver should drive the resume
+ * signalling on the bus for the amount of time defined by this macro.
+diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
+index f594eb71c2746..c26b39a300000 100644
+--- a/include/net/ip6_tunnel.h
++++ b/include/net/ip6_tunnel.h
+@@ -57,7 +57,7 @@ struct ip6_tnl {
+
+ /* These fields used only by GRE */
+ __u32 i_seqno; /* The last seen seqno */
+- __u32 o_seqno; /* The last output seqno */
++ atomic_t o_seqno; /* The last output seqno */
+ int hlen; /* tun_hlen + encap_hlen */
+ int tun_hlen; /* Precalculated header length */
+ int encap_hlen; /* Encap header length (FOU,GUE) */
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index f8873c4eb003a..bc2ae8ce5bd45 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -113,7 +113,7 @@ struct ip_tunnel {
+
+ /* These four fields used only by GRE */
+ u32 i_seqno; /* The last seen seqno */
+- u32 o_seqno; /* The last output seqno */
++ atomic_t o_seqno; /* The last output seqno */
+ int tun_hlen; /* Precalculated header length */
+
+ /* These four fields used only by ERSPAN */
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 78f5f0426e6b6..1b4f47a878060 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -191,14 +191,13 @@ static inline enum nft_registers nft_type_to_reg(enum nft_data_types type)
+ }
+
+ int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest);
+-unsigned int nft_parse_register(const struct nlattr *attr);
+ int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg);
+
+-int nft_validate_register_load(enum nft_registers reg, unsigned int len);
+-int nft_validate_register_store(const struct nft_ctx *ctx,
+- enum nft_registers reg,
+- const struct nft_data *data,
+- enum nft_data_types type, unsigned int len);
++int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len);
++int nft_parse_register_store(const struct nft_ctx *ctx,
++ const struct nlattr *attr, u8 *dreg,
++ const struct nft_data *data,
++ enum nft_data_types type, unsigned int len);
+
+ /**
+ * struct nft_userdata - user defined data associated with an object
+@@ -226,6 +225,10 @@ struct nft_set_elem {
+ u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
+ struct nft_data val;
+ } key;
++ union {
++ u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
++ struct nft_data val;
++ } data;
+ void *priv;
+ };
+
+diff --git a/include/net/netfilter/nf_tables_core.h b/include/net/netfilter/nf_tables_core.h
+index 8da837d2aaf99..6a3f76e012be3 100644
+--- a/include/net/netfilter/nf_tables_core.h
++++ b/include/net/netfilter/nf_tables_core.h
+@@ -21,13 +21,14 @@ void nf_tables_core_module_exit(void);
+
+ struct nft_cmp_fast_expr {
+ u32 data;
+- enum nft_registers sreg:8;
++ u32 mask;
++ u8 sreg;
+ u8 len;
+ };
+
+ struct nft_immediate_expr {
+ struct nft_data data;
+- enum nft_registers dreg:8;
++ u8 dreg;
+ u8 dlen;
+ };
+
+@@ -47,14 +48,14 @@ struct nft_payload {
+ enum nft_payload_bases base:8;
+ u8 offset;
+ u8 len;
+- enum nft_registers dreg:8;
++ u8 dreg;
+ };
+
+ struct nft_payload_set {
+ enum nft_payload_bases base:8;
+ u8 offset;
+ u8 len;
+- enum nft_registers sreg:8;
++ u8 sreg;
+ u8 csum_type;
+ u8 csum_offset;
+ u8 csum_flags;
+diff --git a/include/net/netfilter/nft_fib.h b/include/net/netfilter/nft_fib.h
+index a88f92737308d..1f87267395291 100644
+--- a/include/net/netfilter/nft_fib.h
++++ b/include/net/netfilter/nft_fib.h
+@@ -3,7 +3,7 @@
+ #define _NFT_FIB_H_
+
+ struct nft_fib {
+- enum nft_registers dreg:8;
++ u8 dreg;
+ u8 result;
+ u32 flags;
+ };
+diff --git a/include/net/netfilter/nft_masq.h b/include/net/netfilter/nft_masq.h
+index e51ab3815797b..e69a8277b70b3 100644
+--- a/include/net/netfilter/nft_masq.h
++++ b/include/net/netfilter/nft_masq.h
+@@ -4,8 +4,8 @@
+
+ struct nft_masq {
+ u32 flags;
+- enum nft_registers sreg_proto_min:8;
+- enum nft_registers sreg_proto_max:8;
++ u8 sreg_proto_min;
++ u8 sreg_proto_max;
+ };
+
+ extern const struct nla_policy nft_masq_policy[];
+diff --git a/include/net/netfilter/nft_redir.h b/include/net/netfilter/nft_redir.h
+index 4a970737c03c8..2b4036c94cb3e 100644
+--- a/include/net/netfilter/nft_redir.h
++++ b/include/net/netfilter/nft_redir.h
+@@ -3,8 +3,8 @@
+ #define _NFT_REDIR_H_
+
+ struct nft_redir {
+- enum nft_registers sreg_proto_min:8;
+- enum nft_registers sreg_proto_max:8;
++ u8 sreg_proto_min;
++ u8 sreg_proto_max;
+ u16 flags;
+ };
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 9eb656683281f..cfbd241935a30 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1130,7 +1130,7 @@ struct proto {
+ unsigned int inuse_idx;
+ #endif
+
+- bool (*stream_memory_free)(const struct sock *sk);
++ bool (*stream_memory_free)(const struct sock *sk, int wake);
+ bool (*stream_memory_read)(const struct sock *sk);
+ /* Memory pressure */
+ void (*enter_memory_pressure)(struct sock *sk);
+@@ -1212,19 +1212,29 @@ static inline void sk_refcnt_debug_release(const struct sock *sk)
+ #define sk_refcnt_debug_release(sk) do { } while (0)
+ #endif /* SOCK_REFCNT_DEBUG */
+
+-static inline bool sk_stream_memory_free(const struct sock *sk)
++static inline bool __sk_stream_memory_free(const struct sock *sk, int wake)
+ {
+ if (sk->sk_wmem_queued >= sk->sk_sndbuf)
+ return false;
+
+ return sk->sk_prot->stream_memory_free ?
+- sk->sk_prot->stream_memory_free(sk) : true;
++ sk->sk_prot->stream_memory_free(sk, wake) : true;
+ }
+
+-static inline bool sk_stream_is_writeable(const struct sock *sk)
++static inline bool sk_stream_memory_free(const struct sock *sk)
++{
++ return __sk_stream_memory_free(sk, 0);
++}
++
++static inline bool __sk_stream_is_writeable(const struct sock *sk, int wake)
+ {
+ return sk_stream_wspace(sk) >= sk_stream_min_wspace(sk) &&
+- sk_stream_memory_free(sk);
++ __sk_stream_memory_free(sk, wake);
++}
++
++static inline bool sk_stream_is_writeable(const struct sock *sk)
++{
++ return __sk_stream_is_writeable(sk, 0);
+ }
+
+ static inline int sk_under_cgroup_hierarchy(struct sock *sk,
+@@ -2406,7 +2416,7 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+ __sock_recv_ts_and_drops(msg, sk, skb);
+ else if (unlikely(sock_flag(sk, SOCK_TIMESTAMP)))
+ sock_write_timestamp(sk, skb->tstamp);
+- else if (unlikely(sk->sk_stamp == SK_DEFAULT_STAMP))
++ else if (unlikely(sock_read_timestamp(sk) == SK_DEFAULT_STAMP))
+ sock_write_timestamp(sk, 0);
+ }
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 9a154fe06c60d..81300a04b5808 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -389,6 +389,7 @@ void tcp_update_metrics(struct sock *sk);
+ void tcp_init_metrics(struct sock *sk);
+ void tcp_metrics_init(void);
+ bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst);
++void __tcp_close(struct sock *sk, long timeout);
+ void tcp_close(struct sock *sk, long timeout);
+ void tcp_init_sock(struct sock *sk);
+ void tcp_init_transfer(struct sock *sk, int bpf_op);
+@@ -1884,12 +1885,16 @@ static inline u32 tcp_notsent_lowat(const struct tcp_sock *tp)
+ return tp->notsent_lowat ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat);
+ }
+
+-static inline bool tcp_stream_memory_free(const struct sock *sk)
++/* @wake is one when sk_stream_write_space() calls us.
++ * This sends EPOLLOUT only if notsent_bytes is half the limit.
++ * This mimics the strategy used in sock_def_write_space().
++ */
++static inline bool tcp_stream_memory_free(const struct sock *sk, int wake)
+ {
+ const struct tcp_sock *tp = tcp_sk(sk);
+ u32 notsent_bytes = READ_ONCE(tp->write_seq) - tp->snd_nxt;
+
+- return notsent_bytes < tcp_notsent_lowat(tp);
++ return (notsent_bytes << wake) < tcp_notsent_lowat(tp);
+ }
+
+ #ifdef CONFIG_PROC_FS
+diff --git a/include/uapi/sound/skl-tplg-interface.h b/include/uapi/sound/skl-tplg-interface.h
+index f39352cef3822..2783253ba4731 100644
+--- a/include/uapi/sound/skl-tplg-interface.h
++++ b/include/uapi/sound/skl-tplg-interface.h
+@@ -64,7 +64,8 @@ enum skl_ch_cfg {
+ SKL_CH_CFG_DUAL_MONO = 9,
+ SKL_CH_CFG_I2S_DUAL_STEREO_0 = 10,
+ SKL_CH_CFG_I2S_DUAL_STEREO_1 = 11,
+- SKL_CH_CFG_4_CHANNEL = 12,
++ SKL_CH_CFG_7_1 = 12,
++ SKL_CH_CFG_4_CHANNEL = SKL_CH_CFG_7_1,
+ SKL_CH_CFG_INVALID
+ };
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 61f3a31abc1ad..a48de55f5630e 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -5936,7 +5936,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
+ insn_buf[cnt++] = BPF_ALU64_IMM(BPF_RSH,
+ insn->dst_reg,
+ shift);
+- insn_buf[cnt++] = BPF_ALU64_IMM(BPF_AND, insn->dst_reg,
++ insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg,
+ (1ULL << size * 8) - 1);
+ }
+ }
+diff --git a/lib/cpu_rmap.c b/lib/cpu_rmap.c
+index f610b2a10b3ed..f52389054a24f 100644
+--- a/lib/cpu_rmap.c
++++ b/lib/cpu_rmap.c
+@@ -235,7 +235,8 @@ void free_irq_cpu_rmap(struct cpu_rmap *rmap)
+
+ for (index = 0; index < rmap->used; index++) {
+ glue = rmap->obj[index];
+- irq_set_affinity_notifier(glue->notify.irq, NULL);
++ if (glue)
++ irq_set_affinity_notifier(glue->notify.irq, NULL);
+ }
+
+ cpu_rmap_put(rmap);
+@@ -271,6 +272,7 @@ static void irq_cpu_rmap_release(struct kref *ref)
+ container_of(ref, struct irq_glue, notify.kref);
+
+ cpu_rmap_put(glue->rmap);
++ glue->rmap->obj[glue->index] = NULL;
+ kfree(glue);
+ }
+
+@@ -300,6 +302,7 @@ int irq_cpu_rmap_add(struct cpu_rmap *rmap, int irq)
+ rc = irq_set_affinity_notifier(irq, &glue->notify);
+ if (rc) {
+ cpu_rmap_put(glue->rmap);
++ rmap->obj[glue->index] = NULL;
+ kfree(glue);
+ }
+ return rc;
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index c80add6edf598..ba9b8980f100d 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -115,8 +115,8 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
+ * NOTE: THIS ASSUMES DIX ETHERNET, SPECIFICALLY NOT SUPPORTING
+ * OTHER THINGS LIKE FDDI/TokenRing/802.3 SNAPs...
+ */
+- if (veth->h_vlan_proto != vlan->vlan_proto ||
+- vlan->flags & VLAN_FLAG_REORDER_HDR) {
++ if (vlan->flags & VLAN_FLAG_REORDER_HDR ||
++ veth->h_vlan_proto != vlan->vlan_proto) {
+ u16 vlan_tci;
+ vlan_tci = vlan->vlan_id;
+ vlan_tci |= vlan_dev_get_egress_qos_mask(dev, skb->priority);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 1a68aad5737e1..94d40a20ab958 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -4392,7 +4392,6 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
+
+ chan = l2cap_get_chan_by_scid(conn, scid);
+ if (!chan) {
+- mutex_unlock(&conn->chan_lock);
+ return 0;
+ }
+
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index 865a8cb7b0bdb..6ba82eb14b465 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -837,18 +837,21 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
+ {
+ struct sock *sk = sock->sk;
+ __poll_t mask;
++ u8 shutdown;
+
+ sock_poll_wait(file, sock, wait);
+ mask = 0;
+
+ /* exceptional events? */
+- if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
++ if (READ_ONCE(sk->sk_err) ||
++ !skb_queue_empty_lockless(&sk->sk_error_queue))
+ mask |= EPOLLERR |
+ (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
+
+- if (sk->sk_shutdown & RCV_SHUTDOWN)
++ shutdown = READ_ONCE(sk->sk_shutdown);
++ if (shutdown & RCV_SHUTDOWN)
+ mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
+- if (sk->sk_shutdown == SHUTDOWN_MASK)
++ if (shutdown == SHUTDOWN_MASK)
+ mask |= EPOLLHUP;
+
+ /* readable? */
+@@ -857,10 +860,12 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
+
+ /* Connection-based need to check for termination and startup */
+ if (connection_based(sk)) {
+- if (sk->sk_state == TCP_CLOSE)
++ int state = READ_ONCE(sk->sk_state);
++
++ if (state == TCP_CLOSE)
+ mask |= EPOLLHUP;
+ /* connection hasn't started yet? */
+- if (sk->sk_state == TCP_SYN_SENT)
++ if (state == TCP_SYN_SENT)
+ return mask;
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index b778f35965433..03903d3f1d695 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2303,6 +2303,8 @@ int __netif_set_xps_queue(struct net_device *dev, const unsigned long *mask,
+ bool active = false;
+ unsigned int nr_ids;
+
++ WARN_ON_ONCE(index >= dev->num_tx_queues);
++
+ if (dev->num_tc) {
+ /* Do not allow XPS on subordinate device directly */
+ num_tc = dev->num_tc;
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 5ae62d7433575..b7314a6cf8c2c 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4446,8 +4446,10 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
+ } else {
+ skb = skb_clone(orig_skb, GFP_ATOMIC);
+
+- if (skb_orphan_frags_rx(skb, GFP_ATOMIC))
++ if (skb_orphan_frags_rx(skb, GFP_ATOMIC)) {
++ kfree_skb(skb);
+ return;
++ }
+ }
+ if (!skb)
+ return;
+diff --git a/net/core/stream.c b/net/core/stream.c
+index 23e6669d3f8d2..cd60746877b1e 100644
+--- a/net/core/stream.c
++++ b/net/core/stream.c
+@@ -32,7 +32,7 @@ void sk_stream_write_space(struct sock *sk)
+ struct socket *sock = sk->sk_socket;
+ struct socket_wq *wq;
+
+- if (sk_stream_is_writeable(sk) && sock) {
++ if (__sk_stream_is_writeable(sk, 1) && sock) {
+ clear_bit(SOCK_NOSPACE, &sock->flags);
+
+ rcu_read_lock();
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 4b26ae525d6d2..fb142ea730060 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -865,7 +865,7 @@ int inet_shutdown(struct socket *sock, int how)
+ EPOLLHUP, even on eg. unconnected UDP sockets -- RR */
+ /* fall through */
+ default:
+- sk->sk_shutdown |= how;
++ WRITE_ONCE(sk->sk_shutdown, sk->sk_shutdown | how);
+ if (sk->sk_prot->shutdown)
+ sk->sk_prot->shutdown(sk, how);
+ break;
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 898753328c171..e16373640f4c2 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -440,7 +440,7 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
+ /* Push GRE header. */
+ gre_build_header(skb, tunnel->tun_hlen,
+ flags, proto, tunnel->parms.o_key,
+- (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0);
++ (flags & TUNNEL_SEQ) ? htonl(atomic_fetch_inc(&tunnel->o_seqno)) : 0);
+
+ ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol);
+ }
+@@ -546,7 +546,7 @@ static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev,
+ (TUNNEL_CSUM | TUNNEL_KEY | TUNNEL_SEQ);
+ gre_build_header(skb, tunnel_hlen, flags, proto,
+ tunnel_id_to_key32(tun_info->key.tun_id),
+- (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0);
++ (flags & TUNNEL_SEQ) ? htonl(atomic_fetch_inc(&tunnel->o_seqno)) : 0);
+
+ df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0;
+
+@@ -635,7 +635,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
+ }
+
+ gre_build_header(skb, 8, TUNNEL_SEQ,
+- proto, 0, htonl(tunnel->o_seqno++));
++ proto, 0, htonl(atomic_fetch_inc(&tunnel->o_seqno)));
+
+ df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0;
+
+diff --git a/net/ipv4/netfilter/nft_dup_ipv4.c b/net/ipv4/netfilter/nft_dup_ipv4.c
+index 0af3d8df70dd7..157bca240edce 100644
+--- a/net/ipv4/netfilter/nft_dup_ipv4.c
++++ b/net/ipv4/netfilter/nft_dup_ipv4.c
+@@ -16,8 +16,8 @@
+ #include <net/netfilter/ipv4/nf_dup_ipv4.h>
+
+ struct nft_dup_ipv4 {
+- enum nft_registers sreg_addr:8;
+- enum nft_registers sreg_dev:8;
++ u8 sreg_addr;
++ u8 sreg_dev;
+ };
+
+ static void nft_dup_ipv4_eval(const struct nft_expr *expr,
+@@ -43,16 +43,16 @@ static int nft_dup_ipv4_init(const struct nft_ctx *ctx,
+ if (tb[NFTA_DUP_SREG_ADDR] == NULL)
+ return -EINVAL;
+
+- priv->sreg_addr = nft_parse_register(tb[NFTA_DUP_SREG_ADDR]);
+- err = nft_validate_register_load(priv->sreg_addr, sizeof(struct in_addr));
++ err = nft_parse_register_load(tb[NFTA_DUP_SREG_ADDR], &priv->sreg_addr,
++ sizeof(struct in_addr));
+ if (err < 0)
+ return err;
+
+- if (tb[NFTA_DUP_SREG_DEV] != NULL) {
+- priv->sreg_dev = nft_parse_register(tb[NFTA_DUP_SREG_DEV]);
+- return nft_validate_register_load(priv->sreg_dev, sizeof(int));
+- }
+- return 0;
++ if (tb[NFTA_DUP_SREG_DEV])
++ err = nft_parse_register_load(tb[NFTA_DUP_SREG_DEV],
++ &priv->sreg_dev, sizeof(int));
++
++ return err;
+ }
+
+ static int nft_dup_ipv4_dump(struct sk_buff *skb, const struct nft_expr *expr)
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 68f89fe7f9233..b51e0a1e15b67 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -515,6 +515,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ __poll_t mask;
+ struct sock *sk = sock->sk;
+ const struct tcp_sock *tp = tcp_sk(sk);
++ u8 shutdown;
+ int state;
+
+ sock_poll_wait(file, sock, wait);
+@@ -557,9 +558,10 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ * NOTE. Check for TCP_CLOSE is added. The goal is to prevent
+ * blocking on fresh not-connected or disconnected socket. --ANK
+ */
+- if (sk->sk_shutdown == SHUTDOWN_MASK || state == TCP_CLOSE)
++ shutdown = READ_ONCE(sk->sk_shutdown);
++ if (shutdown == SHUTDOWN_MASK || state == TCP_CLOSE)
+ mask |= EPOLLHUP;
+- if (sk->sk_shutdown & RCV_SHUTDOWN)
++ if (shutdown & RCV_SHUTDOWN)
+ mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP;
+
+ /* Connected or passive Fast Open socket? */
+@@ -575,8 +577,8 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ if (tcp_stream_is_readable(tp, target, sk))
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+- if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
+- if (sk_stream_is_writeable(sk)) {
++ if (!(shutdown & SEND_SHUTDOWN)) {
++ if (__sk_stream_is_writeable(sk, 1)) {
+ mask |= EPOLLOUT | EPOLLWRNORM;
+ } else { /* send SIGIO later */
+ sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
+@@ -588,7 +590,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ * pairs with the input side.
+ */
+ smp_mb__after_atomic();
+- if (sk_stream_is_writeable(sk))
++ if (__sk_stream_is_writeable(sk, 1))
+ mask |= EPOLLOUT | EPOLLWRNORM;
+ }
+ } else
+@@ -2338,14 +2340,13 @@ bool tcp_check_oom(struct sock *sk, int shift)
+ return too_many_orphans || out_of_socket_memory;
+ }
+
+-void tcp_close(struct sock *sk, long timeout)
++void __tcp_close(struct sock *sk, long timeout)
+ {
+ struct sk_buff *skb;
+ int data_was_unread = 0;
+ int state;
+
+- lock_sock(sk);
+- sk->sk_shutdown = SHUTDOWN_MASK;
++ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
+
+ if (sk->sk_state == TCP_LISTEN) {
+ tcp_set_state(sk, TCP_CLOSE);
+@@ -2505,6 +2506,12 @@ adjudge_to_death:
+ out:
+ bh_unlock_sock(sk);
+ local_bh_enable();
++}
++
++void tcp_close(struct sock *sk, long timeout)
++{
++ lock_sock(sk);
++ __tcp_close(sk, timeout);
+ release_sock(sk);
+ sock_put(sk);
+ }
+@@ -2593,7 +2600,7 @@ int tcp_disconnect(struct sock *sk, int flags)
+ if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
+ inet_reset_saddr(sk);
+
+- sk->sk_shutdown = 0;
++ WRITE_ONCE(sk->sk_shutdown, 0);
+ sock_reset_flag(sk, SOCK_DONE);
+ tp->srtt_us = 0;
+ tp->rcv_rtt_last_tsecr = 0;
+@@ -3802,7 +3809,7 @@ void tcp_done(struct sock *sk)
+ if (req)
+ reqsk_fastopen_remove(sk, req, false);
+
+- sk->sk_shutdown = SHUTDOWN_MASK;
++ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
+
+ if (!sock_flag(sk, SOCK_DEAD))
+ sk->sk_state_change(sk);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 11716780667c7..bd921fa7b9ab4 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4130,7 +4130,7 @@ void tcp_fin(struct sock *sk)
+
+ inet_csk_schedule_ack(sk);
+
+- sk->sk_shutdown |= RCV_SHUTDOWN;
++ WRITE_ONCE(sk->sk_shutdown, sk->sk_shutdown | RCV_SHUTDOWN);
+ sock_set_flag(sk, SOCK_DONE);
+
+ switch (sk->sk_state) {
+@@ -6209,7 +6209,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
+ break;
+
+ tcp_set_state(sk, TCP_FIN_WAIT2);
+- sk->sk_shutdown |= SEND_SHUTDOWN;
++ WRITE_ONCE(sk->sk_shutdown, sk->sk_shutdown | SEND_SHUTDOWN);
+
+ sk_dst_confirm(sk);
+
+diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
+index 6beab353bc8b2..27173549b0006 100644
+--- a/net/ipv4/udplite.c
++++ b/net/ipv4/udplite.c
+@@ -64,6 +64,8 @@ struct proto udplite_prot = {
+ .get_port = udp_v4_get_port,
+ .memory_allocated = &udp_memory_allocated,
+ .sysctl_mem = sysctl_udp_mem,
++ .sysctl_wmem_offset = offsetof(struct net, ipv4.sysctl_udp_wmem_min),
++ .sysctl_rmem_offset = offsetof(struct net, ipv4.sysctl_udp_rmem_min),
+ .obj_size = sizeof(struct udp_sock),
+ .h.udp_table = &udplite_table,
+ #ifdef CONFIG_COMPAT
+diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
+index ae365df8abf7b..f356d30491434 100644
+--- a/net/ipv6/exthdrs_core.c
++++ b/net/ipv6/exthdrs_core.c
+@@ -142,6 +142,8 @@ int ipv6_find_tlv(const struct sk_buff *skb, int offset, int type)
+ optlen = 1;
+ break;
+ default:
++ if (len < 2)
++ goto bad;
+ optlen = nh[offset + 1] + 2;
+ if (optlen > len)
+ goto bad;
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 166b7544e54a4..45c304b51b2b7 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -731,6 +731,7 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb,
+ {
+ struct ip6_tnl *tunnel = netdev_priv(dev);
+ __be16 protocol;
++ __be16 flags;
+
+ if (dev->type == ARPHRD_ETHER)
+ IPCB(skb)->flags = 0;
+@@ -740,16 +741,12 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb,
+ else
+ fl6->daddr = tunnel->parms.raddr;
+
+- if (skb_cow_head(skb, dev->needed_headroom ?: tunnel->hlen))
+- return -ENOMEM;
+-
+ /* Push GRE header. */
+ protocol = (dev->type == ARPHRD_ETHER) ? htons(ETH_P_TEB) : proto;
+
+ if (tunnel->parms.collect_md) {
+ struct ip_tunnel_info *tun_info;
+ const struct ip_tunnel_key *key;
+- __be16 flags;
+ int tun_hlen;
+
+ tun_info = skb_tunnel_info(skb);
+@@ -770,19 +767,25 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb,
+ (TUNNEL_CSUM | TUNNEL_KEY | TUNNEL_SEQ);
+ tun_hlen = gre_calc_hlen(flags);
+
++ if (skb_cow_head(skb, dev->needed_headroom ?: tun_hlen + tunnel->encap_hlen))
++ return -ENOMEM;
++
+ gre_build_header(skb, tun_hlen,
+ flags, protocol,
+ tunnel_id_to_key32(tun_info->key.tun_id),
+- (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++)
++ (flags & TUNNEL_SEQ) ? htonl(atomic_fetch_inc(&tunnel->o_seqno))
+ : 0);
+
+ } else {
+- if (tunnel->parms.o_flags & TUNNEL_SEQ)
+- tunnel->o_seqno++;
++ if (skb_cow_head(skb, dev->needed_headroom ?: tunnel->hlen))
++ return -ENOMEM;
++
++ flags = tunnel->parms.o_flags;
+
+- gre_build_header(skb, tunnel->tun_hlen, tunnel->parms.o_flags,
++ gre_build_header(skb, tunnel->tun_hlen, flags,
+ protocol, tunnel->parms.o_key,
+- htonl(tunnel->o_seqno));
++ (flags & TUNNEL_SEQ) ? htonl(atomic_fetch_inc(&tunnel->o_seqno))
++ : 0);
+ }
+
+ return ip6_tnl_xmit(skb, dev, dsfield, fl6, encap_limit, pmtu,
+@@ -1018,12 +1021,14 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ ntohl(tun_id),
+ ntohl(md->u.index), truncate,
+ false);
++ proto = htons(ETH_P_ERSPAN);
+ } else if (md->version == 2) {
+ erspan_build_header_v2(skb,
+ ntohl(tun_id),
+ md->u.md2.dir,
+ get_hwid(&md->u.md2),
+ truncate, false);
++ proto = htons(ETH_P_ERSPAN2);
+ } else {
+ goto tx_err;
+ }
+@@ -1046,25 +1051,26 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ break;
+ }
+
+- if (t->parms.erspan_ver == 1)
++ if (t->parms.erspan_ver == 1) {
+ erspan_build_header(skb, ntohl(t->parms.o_key),
+ t->parms.index,
+ truncate, false);
+- else if (t->parms.erspan_ver == 2)
++ proto = htons(ETH_P_ERSPAN);
++ } else if (t->parms.erspan_ver == 2) {
+ erspan_build_header_v2(skb, ntohl(t->parms.o_key),
+ t->parms.dir,
+ t->parms.hwid,
+ truncate, false);
+- else
++ proto = htons(ETH_P_ERSPAN2);
++ } else {
+ goto tx_err;
++ }
+
+ fl6.daddr = t->parms.raddr;
+ }
+
+ /* Push GRE header. */
+- proto = (t->parms.erspan_ver == 1) ? htons(ETH_P_ERSPAN)
+- : htons(ETH_P_ERSPAN2);
+- gre_build_header(skb, 8, TUNNEL_SEQ, proto, 0, htonl(t->o_seqno++));
++ gre_build_header(skb, 8, TUNNEL_SEQ, proto, 0, htonl(atomic_fetch_inc(&t->o_seqno)));
+
+ /* TooBig packet may have updated dst->dev's mtu */
+ if (!t->parms.collect_md && dst && dst_mtu(dst) > dst->dev->mtu)
+diff --git a/net/ipv6/netfilter/nft_dup_ipv6.c b/net/ipv6/netfilter/nft_dup_ipv6.c
+index d8b5b60b7d531..d8bb7c85287cb 100644
+--- a/net/ipv6/netfilter/nft_dup_ipv6.c
++++ b/net/ipv6/netfilter/nft_dup_ipv6.c
+@@ -16,8 +16,8 @@
+ #include <net/netfilter/ipv6/nf_dup_ipv6.h>
+
+ struct nft_dup_ipv6 {
+- enum nft_registers sreg_addr:8;
+- enum nft_registers sreg_dev:8;
++ u8 sreg_addr;
++ u8 sreg_dev;
+ };
+
+ static void nft_dup_ipv6_eval(const struct nft_expr *expr,
+@@ -41,16 +41,16 @@ static int nft_dup_ipv6_init(const struct nft_ctx *ctx,
+ if (tb[NFTA_DUP_SREG_ADDR] == NULL)
+ return -EINVAL;
+
+- priv->sreg_addr = nft_parse_register(tb[NFTA_DUP_SREG_ADDR]);
+- err = nft_validate_register_load(priv->sreg_addr, sizeof(struct in6_addr));
++ err = nft_parse_register_load(tb[NFTA_DUP_SREG_ADDR], &priv->sreg_addr,
++ sizeof(struct in6_addr));
+ if (err < 0)
+ return err;
+
+- if (tb[NFTA_DUP_SREG_DEV] != NULL) {
+- priv->sreg_dev = nft_parse_register(tb[NFTA_DUP_SREG_DEV]);
+- return nft_validate_register_load(priv->sreg_dev, sizeof(int));
+- }
+- return 0;
++ if (tb[NFTA_DUP_SREG_DEV])
++ err = nft_parse_register_load(tb[NFTA_DUP_SREG_DEV],
++ &priv->sreg_dev, sizeof(int));
++
++ return err;
+ }
+
+ static int nft_dup_ipv6_dump(struct sk_buff *skb, const struct nft_expr *expr)
+diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
+index f15b8305d87bf..a26a4b5da09c3 100644
+--- a/net/ipv6/udplite.c
++++ b/net/ipv6/udplite.c
+@@ -58,6 +58,8 @@ struct proto udplitev6_prot = {
+ .get_port = udp_v6_get_port,
+ .memory_allocated = &udp_memory_allocated,
+ .sysctl_mem = sysctl_udp_mem,
++ .sysctl_wmem_offset = offsetof(struct net, ipv4.sysctl_udp_wmem_min),
++ .sysctl_rmem_offset = offsetof(struct net, ipv4.sysctl_udp_rmem_min),
+ .obj_size = sizeof(struct udp6_sock),
+ .h.udp_table = &udplite_table,
+ #ifdef CONFIG_COMPAT
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 976b67089ac15..b8456e2f11673 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1950,7 +1950,8 @@ static u32 gen_reqid(struct net *net)
+ }
+
+ static int
+-parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
++parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_policy *pol,
++ struct sadb_x_ipsecrequest *rq)
+ {
+ struct net *net = xp_net(xp);
+ struct xfrm_tmpl *t = xp->xfrm_vec + xp->xfrm_nr;
+@@ -1968,9 +1969,12 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
+ if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0)
+ return -EINVAL;
+ t->mode = mode;
+- if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE)
++ if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE) {
++ if ((mode == XFRM_MODE_TUNNEL || mode == XFRM_MODE_BEET) &&
++ pol->sadb_x_policy_dir == IPSEC_DIR_OUTBOUND)
++ return -EINVAL;
+ t->optional = 1;
+- else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) {
++ } else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) {
+ t->reqid = rq->sadb_x_ipsecrequest_reqid;
+ if (t->reqid > IPSEC_MANUAL_REQID_MAX)
+ t->reqid = 0;
+@@ -2012,7 +2016,7 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
+ rq->sadb_x_ipsecrequest_len < sizeof(*rq))
+ return -EINVAL;
+
+- if ((err = parse_ipsecrequest(xp, rq)) < 0)
++ if ((err = parse_ipsecrequest(xp, pol, rq)) < 0)
+ return err;
+ len -= rq->sadb_x_ipsecrequest_len;
+ rq = (void*)((u8*)rq + rq->sadb_x_ipsecrequest_len);
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index e20bde9cc7b12..62bc4cd0b7bec 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2769,6 +2769,7 @@ err1:
+ }
+
+ static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
++ const struct nft_chain *chain,
+ const struct nlattr *nla)
+ {
+ u32 id = ntohl(nla_get_be32(nla));
+@@ -2778,6 +2779,7 @@ static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
+ struct nft_rule *rule = nft_trans_rule(trans);
+
+ if (trans->msg_type == NFT_MSG_NEWRULE &&
++ trans->ctx.chain == chain &&
+ id == nft_trans_rule_id(trans))
+ return rule;
+ }
+@@ -2824,7 +2826,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk,
+
+ err = nft_delrule(&ctx, rule);
+ } else if (nla[NFTA_RULE_ID]) {
+- rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
++ rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]);
+ if (IS_ERR(rule)) {
+ NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
+ return PTR_ERR(rule);
+@@ -3687,6 +3689,12 @@ static int nf_tables_delset(struct net *net, struct sock *nlsk,
+ return nft_delset(&ctx, set);
+ }
+
++static int nft_validate_register_store(const struct nft_ctx *ctx,
++ enum nft_registers reg,
++ const struct nft_data *data,
++ enum nft_data_types type,
++ unsigned int len);
++
+ static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
+ struct nft_set *set,
+ const struct nft_set_iter *iter,
+@@ -4134,11 +4142,54 @@ static int nft_setelem_parse_flags(const struct nft_set *set,
+ return 0;
+ }
+
++static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set,
++ struct nft_data *key, struct nlattr *attr)
++{
++ struct nft_data_desc desc;
++ int err;
++
++ err = nft_data_init(ctx, key, NFT_DATA_VALUE_MAXLEN, &desc, attr);
++ if (err < 0)
++ return err;
++
++ if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) {
++ nft_data_release(key, desc.type);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
++ struct nft_data_desc *desc,
++ struct nft_data *data,
++ struct nlattr *attr)
++{
++ u32 dtype;
++ int err;
++
++ err = nft_data_init(ctx, data, NFT_DATA_VALUE_MAXLEN, desc, attr);
++ if (err < 0)
++ return err;
++
++ if (set->dtype == NFT_DATA_VERDICT)
++ dtype = NFT_DATA_VERDICT;
++ else
++ dtype = NFT_DATA_VALUE;
++
++ if (dtype != desc->type ||
++ set->dlen != desc->len) {
++ nft_data_release(data, desc->type);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ const struct nlattr *attr)
+ {
+ struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
+- struct nft_data_desc desc;
+ struct nft_set_elem elem;
+ struct sk_buff *skb;
+ uint32_t flags = 0;
+@@ -4157,17 +4208,11 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ if (err < 0)
+ return err;
+
+- err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
+- nla[NFTA_SET_ELEM_KEY]);
++ err = nft_setelem_parse_key(ctx, set, &elem.key.val,
++ nla[NFTA_SET_ELEM_KEY]);
+ if (err < 0)
+ return err;
+
+- err = -EINVAL;
+- if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) {
+- nft_data_release(&elem.key.val, desc.type);
+- return err;
+- }
+-
+ priv = set->ops->get(ctx->net, set, &elem, flags);
+ if (IS_ERR(priv))
+ return PTR_ERR(priv);
+@@ -4358,14 +4403,13 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ {
+ struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
+ u8 genmask = nft_genmask_next(ctx->net);
+- struct nft_data_desc d1, d2;
+ struct nft_set_ext_tmpl tmpl;
+ struct nft_set_ext *ext, *ext2;
+ struct nft_set_elem elem;
+ struct nft_set_binding *binding;
+ struct nft_object *obj = NULL;
+ struct nft_userdata *udata;
+- struct nft_data data;
++ struct nft_data_desc desc;
+ enum nft_registers dreg;
+ struct nft_trans *trans;
+ u32 flags = 0;
+@@ -4398,6 +4442,15 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ return -EINVAL;
+ }
+
++ if (set->flags & NFT_SET_OBJECT) {
++ if (!nla[NFTA_SET_ELEM_OBJREF] &&
++ !(flags & NFT_SET_ELEM_INTERVAL_END))
++ return -EINVAL;
++ } else {
++ if (nla[NFTA_SET_ELEM_OBJREF])
++ return -EINVAL;
++ }
++
+ if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
+ (nla[NFTA_SET_ELEM_DATA] ||
+ nla[NFTA_SET_ELEM_OBJREF] ||
+@@ -4419,15 +4472,12 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ timeout = set->timeout;
+ }
+
+- err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
+- nla[NFTA_SET_ELEM_KEY]);
++ err = nft_setelem_parse_key(ctx, set, &elem.key.val,
++ nla[NFTA_SET_ELEM_KEY]);
+ if (err < 0)
+ goto err1;
+- err = -EINVAL;
+- if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
+- goto err2;
+
+- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
++ nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
+ if (timeout > 0) {
+ nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
+ if (timeout != set->timeout)
+@@ -4435,10 +4485,6 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ }
+
+ if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
+- if (!(set->flags & NFT_SET_OBJECT)) {
+- err = -EINVAL;
+- goto err2;
+- }
+ obj = nft_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
+ set->objtype, genmask);
+ if (IS_ERR(obj)) {
+@@ -4449,15 +4495,11 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ }
+
+ if (nla[NFTA_SET_ELEM_DATA] != NULL) {
+- err = nft_data_init(ctx, &data, sizeof(data), &d2,
+- nla[NFTA_SET_ELEM_DATA]);
++ err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val,
++ nla[NFTA_SET_ELEM_DATA]);
+ if (err < 0)
+ goto err2;
+
+- err = -EINVAL;
+- if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
+- goto err3;
+-
+ dreg = nft_type_to_reg(set->dtype);
+ list_for_each_entry(binding, &set->bindings, list) {
+ struct nft_ctx bind_ctx = {
+@@ -4471,19 +4513,19 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ continue;
+
+ err = nft_validate_register_store(&bind_ctx, dreg,
+- &data,
+- d2.type, d2.len);
++ &elem.data.val,
++ desc.type, desc.len);
+ if (err < 0)
+ goto err3;
+
+- if (d2.type == NFT_DATA_VERDICT &&
+- (data.verdict.code == NFT_GOTO ||
+- data.verdict.code == NFT_JUMP))
++ if (desc.type == NFT_DATA_VERDICT &&
++ (elem.data.val.verdict.code == NFT_GOTO ||
++ elem.data.val.verdict.code == NFT_JUMP))
+ nft_validate_state_update(ctx->net,
+ NFT_VALIDATE_NEED);
+ }
+
+- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
++ nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len);
+ }
+
+ /* The full maximum length of userdata can exceed the maximum
+@@ -4499,7 +4541,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ }
+
+ err = -ENOMEM;
+- elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
++ elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
++ elem.data.val.data,
+ timeout, GFP_KERNEL);
+ if (elem.priv == NULL)
+ goto err3;
+@@ -4566,9 +4609,9 @@ err4:
+ kfree(elem.priv);
+ err3:
+ if (nla[NFTA_SET_ELEM_DATA] != NULL)
+- nft_data_release(&data, d2.type);
++ nft_data_release(&elem.data.val, desc.type);
+ err2:
+- nft_data_release(&elem.key.val, d1.type);
++ nft_data_release(&elem.key.val, NFT_DATA_VALUE);
+ err1:
+ return err;
+ }
+@@ -4664,7 +4707,6 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
+ {
+ struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
+ struct nft_set_ext_tmpl tmpl;
+- struct nft_data_desc desc;
+ struct nft_set_elem elem;
+ struct nft_set_ext *ext;
+ struct nft_trans *trans;
+@@ -4675,11 +4717,10 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
+ err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
+ nft_set_elem_policy, NULL);
+ if (err < 0)
+- goto err1;
++ return err;
+
+- err = -EINVAL;
+ if (nla[NFTA_SET_ELEM_KEY] == NULL)
+- goto err1;
++ return -EINVAL;
+
+ nft_set_ext_prepare(&tmpl);
+
+@@ -4689,37 +4730,31 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
+ if (flags != 0)
+ nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
+
+- err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
+- nla[NFTA_SET_ELEM_KEY]);
++ err = nft_setelem_parse_key(ctx, set, &elem.key.val,
++ nla[NFTA_SET_ELEM_KEY]);
+ if (err < 0)
+- goto err1;
+-
+- err = -EINVAL;
+- if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
+- goto err2;
++ return err;
+
+- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
++ nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
+
+ err = -ENOMEM;
+ elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
+ GFP_KERNEL);
+ if (elem.priv == NULL)
+- goto err2;
++ goto fail_elem;
+
+ ext = nft_set_elem_ext(set, elem.priv);
+ if (flags)
+ *nft_set_ext_flags(ext) = flags;
+
+ trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
+- if (trans == NULL) {
+- err = -ENOMEM;
+- goto err3;
+- }
++ if (trans == NULL)
++ goto fail_trans;
+
+ priv = set->ops->deactivate(ctx->net, set, &elem);
+ if (priv == NULL) {
+ err = -ENOENT;
+- goto err4;
++ goto fail_ops;
+ }
+ kfree(elem.priv);
+ elem.priv = priv;
+@@ -4730,13 +4765,12 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
+ list_add_tail(&trans->list, &ctx->net->nft.commit_list);
+ return 0;
+
+-err4:
++fail_ops:
+ kfree(trans);
+-err3:
++fail_trans:
+ kfree(elem.priv);
+-err2:
+- nft_data_release(&elem.key.val, desc.type);
+-err1:
++fail_elem:
++ nft_data_release(&elem.key.val, NFT_DATA_VALUE);
+ return err;
+ }
+
+@@ -6972,28 +7006,24 @@ int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
+ }
+ EXPORT_SYMBOL_GPL(nft_parse_u32_check);
+
+-/**
+- * nft_parse_register - parse a register value from a netlink attribute
+- *
+- * @attr: netlink attribute
+- *
+- * Parse and translate a register value from a netlink attribute.
+- * Registers used to be 128 bit wide, these register numbers will be
+- * mapped to the corresponding 32 bit register numbers.
+- */
+-unsigned int nft_parse_register(const struct nlattr *attr)
++static int nft_parse_register(const struct nlattr *attr, u32 *preg)
+ {
+ unsigned int reg;
+
+ reg = ntohl(nla_get_be32(attr));
+ switch (reg) {
+ case NFT_REG_VERDICT...NFT_REG_4:
+- return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
++ *preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE;
++ break;
++ case NFT_REG32_00...NFT_REG32_15:
++ *preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
++ break;
+ default:
+- return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
++ return -ERANGE;
+ }
++
++ return 0;
+ }
+-EXPORT_SYMBOL_GPL(nft_parse_register);
+
+ /**
+ * nft_dump_register - dump a register value to a netlink attribute
+@@ -7026,7 +7056,7 @@ EXPORT_SYMBOL_GPL(nft_dump_register);
+ * Validate that the input register is one of the general purpose
+ * registers and that the length of the load is within the bounds.
+ */
+-int nft_validate_register_load(enum nft_registers reg, unsigned int len)
++static int nft_validate_register_load(enum nft_registers reg, unsigned int len)
+ {
+ if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
+ return -EINVAL;
+@@ -7037,7 +7067,24 @@ int nft_validate_register_load(enum nft_registers reg, unsigned int len)
+
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(nft_validate_register_load);
++
++int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len)
++{
++ u32 reg;
++ int err;
++
++ err = nft_parse_register(attr, ®);
++ if (err < 0)
++ return err;
++
++ err = nft_validate_register_load(reg, len);
++ if (err < 0)
++ return err;
++
++ *sreg = reg;
++ return 0;
++}
++EXPORT_SYMBOL_GPL(nft_parse_register_load);
+
+ /**
+ * nft_validate_register_store - validate an expressions' register store
+@@ -7053,10 +7100,11 @@ EXPORT_SYMBOL_GPL(nft_validate_register_load);
+ * A value of NULL for the data means that its runtime gathered
+ * data.
+ */
+-int nft_validate_register_store(const struct nft_ctx *ctx,
+- enum nft_registers reg,
+- const struct nft_data *data,
+- enum nft_data_types type, unsigned int len)
++static int nft_validate_register_store(const struct nft_ctx *ctx,
++ enum nft_registers reg,
++ const struct nft_data *data,
++ enum nft_data_types type,
++ unsigned int len)
+ {
+ int err;
+
+@@ -7088,7 +7136,27 @@ int nft_validate_register_store(const struct nft_ctx *ctx,
+ return 0;
+ }
+ }
+-EXPORT_SYMBOL_GPL(nft_validate_register_store);
++
++int nft_parse_register_store(const struct nft_ctx *ctx,
++ const struct nlattr *attr, u8 *dreg,
++ const struct nft_data *data,
++ enum nft_data_types type, unsigned int len)
++{
++ int err;
++ u32 reg;
++
++ err = nft_parse_register(attr, ®);
++ if (err < 0)
++ return err;
++
++ err = nft_validate_register_store(ctx, reg, data, type, len);
++ if (err < 0)
++ return err;
++
++ *dreg = reg;
++ return 0;
++}
++EXPORT_SYMBOL_GPL(nft_parse_register_store);
+
+ static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
+ [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
+diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
+index 058ee84ea531b..c1055251ebdeb 100644
+--- a/net/netfilter/nft_bitwise.c
++++ b/net/netfilter/nft_bitwise.c
+@@ -18,8 +18,8 @@
+ #include <net/netfilter/nf_tables.h>
+
+ struct nft_bitwise {
+- enum nft_registers sreg:8;
+- enum nft_registers dreg:8;
++ u8 sreg;
++ u8 dreg;
+ u8 len;
+ struct nft_data mask;
+ struct nft_data xor;
+@@ -68,14 +68,14 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
+
+ priv->len = len;
+
+- priv->sreg = nft_parse_register(tb[NFTA_BITWISE_SREG]);
+- err = nft_validate_register_load(priv->sreg, priv->len);
++ err = nft_parse_register_load(tb[NFTA_BITWISE_SREG], &priv->sreg,
++ priv->len);
+ if (err < 0)
+ return err;
+
+- priv->dreg = nft_parse_register(tb[NFTA_BITWISE_DREG]);
+- err = nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, priv->len);
++ err = nft_parse_register_store(ctx, tb[NFTA_BITWISE_DREG],
++ &priv->dreg, NULL, NFT_DATA_VALUE,
++ priv->len);
+ if (err < 0)
+ return err;
+
+diff --git a/net/netfilter/nft_byteorder.c b/net/netfilter/nft_byteorder.c
+index 13d4e421a6b33..5e1fbdd7b2846 100644
+--- a/net/netfilter/nft_byteorder.c
++++ b/net/netfilter/nft_byteorder.c
+@@ -19,8 +19,8 @@
+ #include <net/netfilter/nf_tables.h>
+
+ struct nft_byteorder {
+- enum nft_registers sreg:8;
+- enum nft_registers dreg:8;
++ u8 sreg;
++ u8 dreg;
+ enum nft_byteorder_ops op:8;
+ u8 len;
+ u8 size;
+@@ -133,20 +133,20 @@ static int nft_byteorder_init(const struct nft_ctx *ctx,
+ return -EINVAL;
+ }
+
+- priv->sreg = nft_parse_register(tb[NFTA_BYTEORDER_SREG]);
+ err = nft_parse_u32_check(tb[NFTA_BYTEORDER_LEN], U8_MAX, &len);
+ if (err < 0)
+ return err;
+
+ priv->len = len;
+
+- err = nft_validate_register_load(priv->sreg, priv->len);
++ err = nft_parse_register_load(tb[NFTA_BYTEORDER_SREG], &priv->sreg,
++ priv->len);
+ if (err < 0)
+ return err;
+
+- priv->dreg = nft_parse_register(tb[NFTA_BYTEORDER_DREG]);
+- return nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, priv->len);
++ return nft_parse_register_store(ctx, tb[NFTA_BYTEORDER_DREG],
++ &priv->dreg, NULL, NFT_DATA_VALUE,
++ priv->len);
+ }
+
+ static int nft_byteorder_dump(struct sk_buff *skb, const struct nft_expr *expr)
+diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
+index 7007045c08498..36bf64ebc8926 100644
+--- a/net/netfilter/nft_cmp.c
++++ b/net/netfilter/nft_cmp.c
+@@ -19,7 +19,7 @@
+
+ struct nft_cmp_expr {
+ struct nft_data data;
+- enum nft_registers sreg:8;
++ u8 sreg;
+ u8 len;
+ enum nft_cmp_ops op:8;
+ };
+@@ -88,8 +88,7 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ return err;
+ }
+
+- priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
+- err = nft_validate_register_load(priv->sreg, desc.len);
++ err = nft_parse_register_load(tb[NFTA_CMP_SREG], &priv->sreg, desc.len);
+ if (err < 0)
+ return err;
+
+@@ -139,8 +138,7 @@ static int nft_cmp_fast_init(const struct nft_ctx *ctx,
+ if (err < 0)
+ return err;
+
+- priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
+- err = nft_validate_register_load(priv->sreg, desc.len);
++ err = nft_parse_register_load(tb[NFTA_CMP_SREG], &priv->sreg, desc.len);
+ if (err < 0)
+ return err;
+
+diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
+index 5dd87748afa8a..f29f02805bcc0 100644
+--- a/net/netfilter/nft_ct.c
++++ b/net/netfilter/nft_ct.c
+@@ -29,8 +29,8 @@ struct nft_ct {
+ enum nft_ct_keys key:8;
+ enum ip_conntrack_dir dir:8;
+ union {
+- enum nft_registers dreg:8;
+- enum nft_registers sreg:8;
++ u8 dreg;
++ u8 sreg;
+ };
+ };
+
+@@ -486,9 +486,8 @@ static int nft_ct_get_init(const struct nft_ctx *ctx,
+ }
+ }
+
+- priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
+- err = nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, len);
++ err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
++ NFT_DATA_VALUE, len);
+ if (err < 0)
+ return err;
+
+@@ -581,8 +580,7 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
+ }
+ }
+
+- priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
+- err = nft_validate_register_load(priv->sreg, len);
++ err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
+ if (err < 0)
+ goto err1;
+
+diff --git a/net/netfilter/nft_dup_netdev.c b/net/netfilter/nft_dup_netdev.c
+index 2cc1e0ef56e88..e862f916efa09 100644
+--- a/net/netfilter/nft_dup_netdev.c
++++ b/net/netfilter/nft_dup_netdev.c
+@@ -16,7 +16,7 @@
+ #include <net/netfilter/nf_dup_netdev.h>
+
+ struct nft_dup_netdev {
+- enum nft_registers sreg_dev:8;
++ u8 sreg_dev;
+ };
+
+ static void nft_dup_netdev_eval(const struct nft_expr *expr,
+@@ -42,8 +42,8 @@ static int nft_dup_netdev_init(const struct nft_ctx *ctx,
+ if (tb[NFTA_DUP_SREG_DEV] == NULL)
+ return -EINVAL;
+
+- priv->sreg_dev = nft_parse_register(tb[NFTA_DUP_SREG_DEV]);
+- return nft_validate_register_load(priv->sreg_dev, sizeof(int));
++ return nft_parse_register_load(tb[NFTA_DUP_SREG_DEV], &priv->sreg_dev,
++ sizeof(int));
+ }
+
+ static const struct nft_expr_ops nft_dup_netdev_ingress_ops;
+diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
+index ea73130427eb8..c5d42e704f043 100644
+--- a/net/netfilter/nft_dynset.c
++++ b/net/netfilter/nft_dynset.c
+@@ -20,8 +20,8 @@ struct nft_dynset {
+ struct nft_set *set;
+ struct nft_set_ext_tmpl tmpl;
+ enum nft_dynset_ops op:8;
+- enum nft_registers sreg_key:8;
+- enum nft_registers sreg_data:8;
++ u8 sreg_key;
++ u8 sreg_data;
+ bool invert;
+ u64 timeout;
+ struct nft_expr *expr;
+@@ -166,8 +166,8 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
+ tb[NFTA_DYNSET_TIMEOUT])));
+ }
+
+- priv->sreg_key = nft_parse_register(tb[NFTA_DYNSET_SREG_KEY]);
+- err = nft_validate_register_load(priv->sreg_key, set->klen);
++ err = nft_parse_register_load(tb[NFTA_DYNSET_SREG_KEY], &priv->sreg_key,
++ set->klen);
+ if (err < 0)
+ return err;
+
+@@ -177,8 +177,8 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
+ if (set->dtype == NFT_DATA_VERDICT)
+ return -EOPNOTSUPP;
+
+- priv->sreg_data = nft_parse_register(tb[NFTA_DYNSET_SREG_DATA]);
+- err = nft_validate_register_load(priv->sreg_data, set->dlen);
++ err = nft_parse_register_load(tb[NFTA_DYNSET_SREG_DATA],
++ &priv->sreg_data, set->dlen);
+ if (err < 0)
+ return err;
+ } else if (set->flags & NFT_SET_MAP)
+diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
+index 93fee41060192..8d0f14cd7cc3e 100644
+--- a/net/netfilter/nft_exthdr.c
++++ b/net/netfilter/nft_exthdr.c
+@@ -22,8 +22,8 @@ struct nft_exthdr {
+ u8 offset;
+ u8 len;
+ u8 op;
+- enum nft_registers dreg:8;
+- enum nft_registers sreg:8;
++ u8 dreg;
++ u8 sreg;
+ u8 flags;
+ };
+
+@@ -258,12 +258,12 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
+ priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
+ priv->offset = offset;
+ priv->len = len;
+- priv->dreg = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
+ priv->flags = flags;
+ priv->op = op;
+
+- return nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, priv->len);
++ return nft_parse_register_store(ctx, tb[NFTA_EXTHDR_DREG],
++ &priv->dreg, NULL, NFT_DATA_VALUE,
++ priv->len);
+ }
+
+ static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
+@@ -308,11 +308,11 @@ static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx,
+ priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
+ priv->offset = offset;
+ priv->len = len;
+- priv->sreg = nft_parse_register(tb[NFTA_EXTHDR_SREG]);
+ priv->flags = flags;
+ priv->op = op;
+
+- return nft_validate_register_load(priv->sreg, priv->len);
++ return nft_parse_register_load(tb[NFTA_EXTHDR_SREG], &priv->sreg,
++ priv->len);
+ }
+
+ static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv)
+diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c
+index 21df8cccea658..ce6891337304d 100644
+--- a/net/netfilter/nft_fib.c
++++ b/net/netfilter/nft_fib.c
+@@ -88,7 +88,6 @@ int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ return -EINVAL;
+
+ priv->result = ntohl(nla_get_be32(tb[NFTA_FIB_RESULT]));
+- priv->dreg = nft_parse_register(tb[NFTA_FIB_DREG]);
+
+ switch (priv->result) {
+ case NFT_FIB_RESULT_OIF:
+@@ -108,8 +107,8 @@ int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ return -EINVAL;
+ }
+
+- err = nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, len);
++ err = nft_parse_register_store(ctx, tb[NFTA_FIB_DREG], &priv->dreg,
++ NULL, NFT_DATA_VALUE, len);
+ if (err < 0)
+ return err;
+
+diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
+index 10a12e0949299..2efbe78de3b22 100644
+--- a/net/netfilter/nft_fwd_netdev.c
++++ b/net/netfilter/nft_fwd_netdev.c
+@@ -20,7 +20,7 @@
+ #include <net/ip.h>
+
+ struct nft_fwd_netdev {
+- enum nft_registers sreg_dev:8;
++ u8 sreg_dev;
+ };
+
+ static void nft_fwd_netdev_eval(const struct nft_expr *expr,
+@@ -49,8 +49,8 @@ static int nft_fwd_netdev_init(const struct nft_ctx *ctx,
+ if (tb[NFTA_FWD_SREG_DEV] == NULL)
+ return -EINVAL;
+
+- priv->sreg_dev = nft_parse_register(tb[NFTA_FWD_SREG_DEV]);
+- return nft_validate_register_load(priv->sreg_dev, sizeof(int));
++ return nft_parse_register_load(tb[NFTA_FWD_SREG_DEV], &priv->sreg_dev,
++ sizeof(int));
+ }
+
+ static const struct nft_expr_ops nft_fwd_netdev_ingress_ops;
+@@ -69,8 +69,8 @@ nla_put_failure:
+ }
+
+ struct nft_fwd_neigh {
+- enum nft_registers sreg_dev:8;
+- enum nft_registers sreg_addr:8;
++ u8 sreg_dev;
++ u8 sreg_addr;
+ u8 nfproto;
+ };
+
+@@ -148,8 +148,6 @@ static int nft_fwd_neigh_init(const struct nft_ctx *ctx,
+ !tb[NFTA_FWD_NFPROTO])
+ return -EINVAL;
+
+- priv->sreg_dev = nft_parse_register(tb[NFTA_FWD_SREG_DEV]);
+- priv->sreg_addr = nft_parse_register(tb[NFTA_FWD_SREG_ADDR]);
+ priv->nfproto = ntohl(nla_get_be32(tb[NFTA_FWD_NFPROTO]));
+
+ switch (priv->nfproto) {
+@@ -163,11 +161,13 @@ static int nft_fwd_neigh_init(const struct nft_ctx *ctx,
+ return -EOPNOTSUPP;
+ }
+
+- err = nft_validate_register_load(priv->sreg_dev, sizeof(int));
++ err = nft_parse_register_load(tb[NFTA_FWD_SREG_DEV], &priv->sreg_dev,
++ sizeof(int));
+ if (err < 0)
+ return err;
+
+- return nft_validate_register_load(priv->sreg_addr, addr_len);
++ return nft_parse_register_load(tb[NFTA_FWD_SREG_ADDR], &priv->sreg_addr,
++ addr_len);
+ }
+
+ static const struct nft_expr_ops nft_fwd_netdev_ingress_ops;
+diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
+index b8f23f75aea6c..513419aca9c66 100644
+--- a/net/netfilter/nft_hash.c
++++ b/net/netfilter/nft_hash.c
+@@ -18,8 +18,8 @@
+ #include <linux/jhash.h>
+
+ struct nft_jhash {
+- enum nft_registers sreg:8;
+- enum nft_registers dreg:8;
++ u8 sreg;
++ u8 dreg;
+ u8 len;
+ bool autogen_seed:1;
+ u32 modulus;
+@@ -65,7 +65,7 @@ static void nft_jhash_map_eval(const struct nft_expr *expr,
+ }
+
+ struct nft_symhash {
+- enum nft_registers dreg:8;
++ u8 dreg;
+ u32 modulus;
+ u32 offset;
+ struct nft_set *map;
+@@ -136,9 +136,6 @@ static int nft_jhash_init(const struct nft_ctx *ctx,
+ if (tb[NFTA_HASH_OFFSET])
+ priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET]));
+
+- priv->sreg = nft_parse_register(tb[NFTA_HASH_SREG]);
+- priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
+-
+ err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len);
+ if (err < 0)
+ return err;
+@@ -147,6 +144,10 @@ static int nft_jhash_init(const struct nft_ctx *ctx,
+
+ priv->len = len;
+
++ err = nft_parse_register_load(tb[NFTA_HASH_SREG], &priv->sreg, len);
++ if (err < 0)
++ return err;
++
+ priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
+ if (priv->modulus < 1)
+ return -ERANGE;
+@@ -161,9 +162,8 @@ static int nft_jhash_init(const struct nft_ctx *ctx,
+ get_random_bytes(&priv->seed, sizeof(priv->seed));
+ }
+
+- return nft_validate_register_load(priv->sreg, len) &&
+- nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, sizeof(u32));
++ return nft_parse_register_store(ctx, tb[NFTA_HASH_DREG], &priv->dreg,
++ NULL, NFT_DATA_VALUE, sizeof(u32));
+ }
+
+ static int nft_jhash_map_init(const struct nft_ctx *ctx,
+@@ -193,8 +193,6 @@ static int nft_symhash_init(const struct nft_ctx *ctx,
+ if (tb[NFTA_HASH_OFFSET])
+ priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET]));
+
+- priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
+-
+ priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
+ if (priv->modulus < 1)
+ return -ERANGE;
+@@ -202,8 +200,9 @@ static int nft_symhash_init(const struct nft_ctx *ctx,
+ if (priv->offset + priv->modulus - 1 < priv->offset)
+ return -EOVERFLOW;
+
+- return nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, sizeof(u32));
++ return nft_parse_register_store(ctx, tb[NFTA_HASH_DREG],
++ &priv->dreg, NULL, NFT_DATA_VALUE,
++ sizeof(u32));
+ }
+
+ static int nft_symhash_map_init(const struct nft_ctx *ctx,
+diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
+index 3f6d1d2a62818..af4e2a4bce93e 100644
+--- a/net/netfilter/nft_immediate.c
++++ b/net/netfilter/nft_immediate.c
+@@ -50,9 +50,9 @@ static int nft_immediate_init(const struct nft_ctx *ctx,
+
+ priv->dlen = desc.len;
+
+- priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]);
+- err = nft_validate_register_store(ctx, priv->dreg, &priv->data,
+- desc.type, desc.len);
++ err = nft_parse_register_store(ctx, tb[NFTA_IMMEDIATE_DREG],
++ &priv->dreg, &priv->data, desc.type,
++ desc.len);
+ if (err < 0)
+ goto err1;
+
+diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
+index cb9e937a5ce02..3c380fb326511 100644
+--- a/net/netfilter/nft_lookup.c
++++ b/net/netfilter/nft_lookup.c
+@@ -20,8 +20,8 @@
+
+ struct nft_lookup {
+ struct nft_set *set;
+- enum nft_registers sreg:8;
+- enum nft_registers dreg:8;
++ u8 sreg;
++ u8 dreg;
+ bool invert;
+ struct nft_set_binding binding;
+ };
+@@ -76,8 +76,8 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
+ if (IS_ERR(set))
+ return PTR_ERR(set);
+
+- priv->sreg = nft_parse_register(tb[NFTA_LOOKUP_SREG]);
+- err = nft_validate_register_load(priv->sreg, set->klen);
++ err = nft_parse_register_load(tb[NFTA_LOOKUP_SREG], &priv->sreg,
++ set->klen);
+ if (err < 0)
+ return err;
+
+@@ -100,9 +100,9 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
+ if (!(set->flags & NFT_SET_MAP))
+ return -EINVAL;
+
+- priv->dreg = nft_parse_register(tb[NFTA_LOOKUP_DREG]);
+- err = nft_validate_register_store(ctx, priv->dreg, NULL,
+- set->dtype, set->dlen);
++ err = nft_parse_register_store(ctx, tb[NFTA_LOOKUP_DREG],
++ &priv->dreg, NULL, set->dtype,
++ set->dlen);
+ if (err < 0)
+ return err;
+ } else if (set->flags & NFT_SET_MAP)
+diff --git a/net/netfilter/nft_masq.c b/net/netfilter/nft_masq.c
+index 9d8655bc1bea6..4ecfebc2fdc4a 100644
+--- a/net/netfilter/nft_masq.c
++++ b/net/netfilter/nft_masq.c
+@@ -53,19 +53,15 @@ int nft_masq_init(const struct nft_ctx *ctx,
+ }
+
+ if (tb[NFTA_MASQ_REG_PROTO_MIN]) {
+- priv->sreg_proto_min =
+- nft_parse_register(tb[NFTA_MASQ_REG_PROTO_MIN]);
+-
+- err = nft_validate_register_load(priv->sreg_proto_min, plen);
++ err = nft_parse_register_load(tb[NFTA_MASQ_REG_PROTO_MIN],
++ &priv->sreg_proto_min, plen);
+ if (err < 0)
+ return err;
+
+ if (tb[NFTA_MASQ_REG_PROTO_MAX]) {
+- priv->sreg_proto_max =
+- nft_parse_register(tb[NFTA_MASQ_REG_PROTO_MAX]);
+-
+- err = nft_validate_register_load(priv->sreg_proto_max,
+- plen);
++ err = nft_parse_register_load(tb[NFTA_MASQ_REG_PROTO_MAX],
++ &priv->sreg_proto_max,
++ plen);
+ if (err < 0)
+ return err;
+ } else {
+diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
+index 297fe7d97c182..061a29bd30661 100644
+--- a/net/netfilter/nft_meta.c
++++ b/net/netfilter/nft_meta.c
+@@ -30,8 +30,8 @@
+ struct nft_meta {
+ enum nft_meta_keys key:8;
+ union {
+- enum nft_registers dreg:8;
+- enum nft_registers sreg:8;
++ u8 dreg;
++ u8 sreg;
+ };
+ };
+
+@@ -358,9 +358,8 @@ static int nft_meta_get_init(const struct nft_ctx *ctx,
+ return -EOPNOTSUPP;
+ }
+
+- priv->dreg = nft_parse_register(tb[NFTA_META_DREG]);
+- return nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, len);
++ return nft_parse_register_store(ctx, tb[NFTA_META_DREG], &priv->dreg,
++ NULL, NFT_DATA_VALUE, len);
+ }
+
+ static int nft_meta_get_validate(const struct nft_ctx *ctx,
+@@ -448,8 +447,7 @@ static int nft_meta_set_init(const struct nft_ctx *ctx,
+ return -EOPNOTSUPP;
+ }
+
+- priv->sreg = nft_parse_register(tb[NFTA_META_SREG]);
+- err = nft_validate_register_load(priv->sreg, len);
++ err = nft_parse_register_load(tb[NFTA_META_SREG], &priv->sreg, len);
+ if (err < 0)
+ return err;
+
+diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
+index 2c3d7ff6f58a7..aa6149cc8c87c 100644
+--- a/net/netfilter/nft_nat.c
++++ b/net/netfilter/nft_nat.c
+@@ -27,10 +27,10 @@
+ #include <net/ip.h>
+
+ struct nft_nat {
+- enum nft_registers sreg_addr_min:8;
+- enum nft_registers sreg_addr_max:8;
+- enum nft_registers sreg_proto_min:8;
+- enum nft_registers sreg_proto_max:8;
++ u8 sreg_addr_min;
++ u8 sreg_addr_max;
++ u8 sreg_proto_min;
++ u8 sreg_proto_max;
+ enum nf_nat_manip_type type:8;
+ u8 family;
+ u16 flags;
+@@ -160,18 +160,15 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ priv->family = family;
+
+ if (tb[NFTA_NAT_REG_ADDR_MIN]) {
+- priv->sreg_addr_min =
+- nft_parse_register(tb[NFTA_NAT_REG_ADDR_MIN]);
+- err = nft_validate_register_load(priv->sreg_addr_min, alen);
++ err = nft_parse_register_load(tb[NFTA_NAT_REG_ADDR_MIN],
++ &priv->sreg_addr_min, alen);
+ if (err < 0)
+ return err;
+
+ if (tb[NFTA_NAT_REG_ADDR_MAX]) {
+- priv->sreg_addr_max =
+- nft_parse_register(tb[NFTA_NAT_REG_ADDR_MAX]);
+-
+- err = nft_validate_register_load(priv->sreg_addr_max,
+- alen);
++ err = nft_parse_register_load(tb[NFTA_NAT_REG_ADDR_MAX],
++ &priv->sreg_addr_max,
++ alen);
+ if (err < 0)
+ return err;
+ } else {
+@@ -181,19 +178,15 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+
+ plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all);
+ if (tb[NFTA_NAT_REG_PROTO_MIN]) {
+- priv->sreg_proto_min =
+- nft_parse_register(tb[NFTA_NAT_REG_PROTO_MIN]);
+-
+- err = nft_validate_register_load(priv->sreg_proto_min, plen);
++ err = nft_parse_register_load(tb[NFTA_NAT_REG_PROTO_MIN],
++ &priv->sreg_proto_min, plen);
+ if (err < 0)
+ return err;
+
+ if (tb[NFTA_NAT_REG_PROTO_MAX]) {
+- priv->sreg_proto_max =
+- nft_parse_register(tb[NFTA_NAT_REG_PROTO_MAX]);
+-
+- err = nft_validate_register_load(priv->sreg_proto_max,
+- plen);
++ err = nft_parse_register_load(tb[NFTA_NAT_REG_PROTO_MAX],
++ &priv->sreg_proto_max,
++ plen);
+ if (err < 0)
+ return err;
+ } else {
+diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
+index 3cc1b3dc3c3cd..8ff82f17ecba9 100644
+--- a/net/netfilter/nft_numgen.c
++++ b/net/netfilter/nft_numgen.c
+@@ -20,7 +20,7 @@
+ static DEFINE_PER_CPU(struct rnd_state, nft_numgen_prandom_state);
+
+ struct nft_ng_inc {
+- enum nft_registers dreg:8;
++ u8 dreg;
+ u32 modulus;
+ atomic_t counter;
+ u32 offset;
+@@ -70,11 +70,10 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
+ if (priv->offset + priv->modulus - 1 < priv->offset)
+ return -EOVERFLOW;
+
+- priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
+ atomic_set(&priv->counter, priv->modulus - 1);
+
+- return nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, sizeof(u32));
++ return nft_parse_register_store(ctx, tb[NFTA_NG_DREG], &priv->dreg,
++ NULL, NFT_DATA_VALUE, sizeof(u32));
+ }
+
+ static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg,
+@@ -104,7 +103,7 @@ static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr)
+ }
+
+ struct nft_ng_random {
+- enum nft_registers dreg:8;
++ u8 dreg;
+ u32 modulus;
+ u32 offset;
+ };
+@@ -144,10 +143,8 @@ static int nft_ng_random_init(const struct nft_ctx *ctx,
+
+ prandom_init_once(&nft_numgen_prandom_state);
+
+- priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
+-
+- return nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, sizeof(u32));
++ return nft_parse_register_store(ctx, tb[NFTA_NG_DREG], &priv->dreg,
++ NULL, NFT_DATA_VALUE, sizeof(u32));
+ }
+
+ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr)
+diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
+index eff2173db7e4b..615f0fcf711c6 100644
+--- a/net/netfilter/nft_objref.c
++++ b/net/netfilter/nft_objref.c
+@@ -97,7 +97,7 @@ static const struct nft_expr_ops nft_objref_ops = {
+
+ struct nft_objref_map {
+ struct nft_set *set;
+- enum nft_registers sreg:8;
++ u8 sreg;
+ struct nft_set_binding binding;
+ };
+
+@@ -139,8 +139,8 @@ static int nft_objref_map_init(const struct nft_ctx *ctx,
+ if (!(set->flags & NFT_SET_OBJECT))
+ return -EINVAL;
+
+- priv->sreg = nft_parse_register(tb[NFTA_OBJREF_SET_SREG]);
+- err = nft_validate_register_load(priv->sreg, set->klen);
++ err = nft_parse_register_load(tb[NFTA_OBJREF_SET_SREG], &priv->sreg,
++ set->klen);
+ if (err < 0)
+ return err;
+
+diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
+index 4fac2d9a4b885..af2ce7a8c5877 100644
+--- a/net/netfilter/nft_osf.c
++++ b/net/netfilter/nft_osf.c
+@@ -5,7 +5,7 @@
+ #include <linux/netfilter/nfnetlink_osf.h>
+
+ struct nft_osf {
+- enum nft_registers dreg:8;
++ u8 dreg;
+ };
+
+ static const struct nla_policy nft_osf_policy[NFTA_OSF_MAX + 1] = {
+@@ -55,9 +55,9 @@ static int nft_osf_init(const struct nft_ctx *ctx,
+ if (!tb[NFTA_OSF_DREG])
+ return -EINVAL;
+
+- priv->dreg = nft_parse_register(tb[NFTA_OSF_DREG]);
+- err = nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, NFT_OSF_MAXGENRELEN);
++ err = nft_parse_register_store(ctx, tb[NFTA_OSF_DREG], &priv->dreg,
++ NULL, NFT_DATA_VALUE,
++ NFT_OSF_MAXGENRELEN);
+ if (err < 0)
+ return err;
+
+diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
+index 5732b32ab9320..77cfd5182784f 100644
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -135,10 +135,10 @@ static int nft_payload_init(const struct nft_ctx *ctx,
+ priv->base = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
+ priv->offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
+ priv->len = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
+- priv->dreg = nft_parse_register(tb[NFTA_PAYLOAD_DREG]);
+
+- return nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, priv->len);
++ return nft_parse_register_store(ctx, tb[NFTA_PAYLOAD_DREG],
++ &priv->dreg, NULL, NFT_DATA_VALUE,
++ priv->len);
+ }
+
+ static int nft_payload_dump(struct sk_buff *skb, const struct nft_expr *expr)
+@@ -338,7 +338,6 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
+ priv->base = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
+ priv->offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
+ priv->len = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
+- priv->sreg = nft_parse_register(tb[NFTA_PAYLOAD_SREG]);
+
+ if (tb[NFTA_PAYLOAD_CSUM_TYPE])
+ csum_type = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_TYPE]));
+@@ -369,7 +368,8 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
+ }
+ priv->csum_type = csum_type;
+
+- return nft_validate_register_load(priv->sreg, priv->len);
++ return nft_parse_register_load(tb[NFTA_PAYLOAD_SREG], &priv->sreg,
++ priv->len);
+ }
+
+ static int nft_payload_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
+diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c
+index 98613658d4ac5..de5f1bda9d6f1 100644
+--- a/net/netfilter/nft_queue.c
++++ b/net/netfilter/nft_queue.c
+@@ -22,10 +22,10 @@
+ static u32 jhash_initval __read_mostly;
+
+ struct nft_queue {
+- enum nft_registers sreg_qnum:8;
+- u16 queuenum;
+- u16 queues_total;
+- u16 flags;
++ u8 sreg_qnum;
++ u16 queuenum;
++ u16 queues_total;
++ u16 flags;
+ };
+
+ static void nft_queue_eval(const struct nft_expr *expr,
+@@ -114,8 +114,8 @@ static int nft_queue_sreg_init(const struct nft_ctx *ctx,
+ struct nft_queue *priv = nft_expr_priv(expr);
+ int err;
+
+- priv->sreg_qnum = nft_parse_register(tb[NFTA_QUEUE_SREG_QNUM]);
+- err = nft_validate_register_load(priv->sreg_qnum, sizeof(u32));
++ err = nft_parse_register_load(tb[NFTA_QUEUE_SREG_QNUM],
++ &priv->sreg_qnum, sizeof(u32));
+ if (err < 0)
+ return err;
+
+diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
+index 2e1d2ec2f52a4..a5f74e5b8184f 100644
+--- a/net/netfilter/nft_range.c
++++ b/net/netfilter/nft_range.c
+@@ -18,7 +18,7 @@
+ struct nft_range_expr {
+ struct nft_data data_from;
+ struct nft_data data_to;
+- enum nft_registers sreg:8;
++ u8 sreg;
+ u8 len;
+ enum nft_range_ops op:8;
+ };
+@@ -90,8 +90,8 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr
+ goto err2;
+ }
+
+- priv->sreg = nft_parse_register(tb[NFTA_RANGE_SREG]);
+- err = nft_validate_register_load(priv->sreg, desc_from.len);
++ err = nft_parse_register_load(tb[NFTA_RANGE_SREG], &priv->sreg,
++ desc_from.len);
+ if (err < 0)
+ goto err2;
+
+diff --git a/net/netfilter/nft_redir.c b/net/netfilter/nft_redir.c
+index c64cbe78dee7b..08a05bd1e8178 100644
+--- a/net/netfilter/nft_redir.c
++++ b/net/netfilter/nft_redir.c
+@@ -49,19 +49,15 @@ int nft_redir_init(const struct nft_ctx *ctx,
+
+ plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all);
+ if (tb[NFTA_REDIR_REG_PROTO_MIN]) {
+- priv->sreg_proto_min =
+- nft_parse_register(tb[NFTA_REDIR_REG_PROTO_MIN]);
+-
+- err = nft_validate_register_load(priv->sreg_proto_min, plen);
++ err = nft_parse_register_load(tb[NFTA_REDIR_REG_PROTO_MIN],
++ &priv->sreg_proto_min, plen);
+ if (err < 0)
+ return err;
+
+ if (tb[NFTA_REDIR_REG_PROTO_MAX]) {
+- priv->sreg_proto_max =
+- nft_parse_register(tb[NFTA_REDIR_REG_PROTO_MAX]);
+-
+- err = nft_validate_register_load(priv->sreg_proto_max,
+- plen);
++ err = nft_parse_register_load(tb[NFTA_REDIR_REG_PROTO_MAX],
++ &priv->sreg_proto_max,
++ plen);
+ if (err < 0)
+ return err;
+ } else {
+diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c
+index 76dba9f6b6f62..edce109ef4b01 100644
+--- a/net/netfilter/nft_rt.c
++++ b/net/netfilter/nft_rt.c
+@@ -18,7 +18,7 @@
+
+ struct nft_rt {
+ enum nft_rt_keys key:8;
+- enum nft_registers dreg:8;
++ u8 dreg;
+ };
+
+ static u16 get_tcpmss(const struct nft_pktinfo *pkt, const struct dst_entry *skbdst)
+@@ -134,9 +134,8 @@ static int nft_rt_get_init(const struct nft_ctx *ctx,
+ return -EOPNOTSUPP;
+ }
+
+- priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]);
+- return nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, len);
++ return nft_parse_register_store(ctx, tb[NFTA_RT_DREG], &priv->dreg,
++ NULL, NFT_DATA_VALUE, len);
+ }
+
+ static int nft_rt_get_dump(struct sk_buff *skb,
+diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
+index 4026ec38526f6..7e4f7063f4811 100644
+--- a/net/netfilter/nft_socket.c
++++ b/net/netfilter/nft_socket.c
+@@ -10,7 +10,7 @@
+ struct nft_socket {
+ enum nft_socket_keys key:8;
+ union {
+- enum nft_registers dreg:8;
++ u8 dreg;
+ };
+ };
+
+@@ -119,9 +119,8 @@ static int nft_socket_init(const struct nft_ctx *ctx,
+ return -EOPNOTSUPP;
+ }
+
+- priv->dreg = nft_parse_register(tb[NFTA_SOCKET_DREG]);
+- return nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, len);
++ return nft_parse_register_store(ctx, tb[NFTA_SOCKET_DREG], &priv->dreg,
++ NULL, NFT_DATA_VALUE, len);
+ }
+
+ static int nft_socket_dump(struct sk_buff *skb,
+diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c
+index a0e30bf4a845c..db780b5985abc 100644
+--- a/net/netfilter/nft_tproxy.c
++++ b/net/netfilter/nft_tproxy.c
+@@ -13,9 +13,9 @@
+ #endif
+
+ struct nft_tproxy {
+- enum nft_registers sreg_addr:8;
+- enum nft_registers sreg_port:8;
+- u8 family;
++ u8 sreg_addr;
++ u8 sreg_port;
++ u8 family;
+ };
+
+ static void nft_tproxy_eval_v4(const struct nft_expr *expr,
+@@ -254,15 +254,15 @@ static int nft_tproxy_init(const struct nft_ctx *ctx,
+ }
+
+ if (tb[NFTA_TPROXY_REG_ADDR]) {
+- priv->sreg_addr = nft_parse_register(tb[NFTA_TPROXY_REG_ADDR]);
+- err = nft_validate_register_load(priv->sreg_addr, alen);
++ err = nft_parse_register_load(tb[NFTA_TPROXY_REG_ADDR],
++ &priv->sreg_addr, alen);
+ if (err < 0)
+ return err;
+ }
+
+ if (tb[NFTA_TPROXY_REG_PORT]) {
+- priv->sreg_port = nft_parse_register(tb[NFTA_TPROXY_REG_PORT]);
+- err = nft_validate_register_load(priv->sreg_port, sizeof(u16));
++ err = nft_parse_register_load(tb[NFTA_TPROXY_REG_PORT],
++ &priv->sreg_port, sizeof(u16));
+ if (err < 0)
+ return err;
+ }
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index 3fc55c81f16ac..ab69a34210a8d 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -14,7 +14,7 @@
+
+ struct nft_tunnel {
+ enum nft_tunnel_keys key:8;
+- enum nft_registers dreg:8;
++ u8 dreg;
+ };
+
+ static void nft_tunnel_get_eval(const struct nft_expr *expr,
+@@ -72,10 +72,8 @@ static int nft_tunnel_get_init(const struct nft_ctx *ctx,
+ return -EOPNOTSUPP;
+ }
+
+- priv->dreg = nft_parse_register(tb[NFTA_TUNNEL_DREG]);
+-
+- return nft_validate_register_store(ctx, priv->dreg, NULL,
+- NFT_DATA_VALUE, len);
++ return nft_parse_register_store(ctx, tb[NFTA_TUNNEL_DREG], &priv->dreg,
++ NULL, NFT_DATA_VALUE, len);
+ }
+
+ static int nft_tunnel_get_dump(struct sk_buff *skb,
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 6867158656b86..c73784b7b67dc 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1983,7 +1983,7 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+
+ skb_free_datagram(sk, skb);
+
+- if (nlk->cb_running &&
++ if (READ_ONCE(nlk->cb_running) &&
+ atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
+ ret = netlink_dump(sk);
+ if (ret) {
+@@ -2265,7 +2265,7 @@ static int netlink_dump(struct sock *sk)
+ if (cb->done)
+ cb->done(cb);
+
+- nlk->cb_running = false;
++ WRITE_ONCE(nlk->cb_running, false);
+ module = cb->module;
+ skb = cb->skb;
+ mutex_unlock(nlk->cb_mutex);
+@@ -2325,7 +2325,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
+ goto error_put;
+ }
+
+- nlk->cb_running = true;
++ WRITE_ONCE(nlk->cb_running, true);
+ nlk->dump_done_errno = INT_MAX;
+
+ mutex_unlock(nlk->cb_mutex);
+@@ -2631,7 +2631,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
+ nlk->groups ? (u32)nlk->groups[0] : 0,
+ sk_rmem_alloc_get(s),
+ sk_wmem_alloc_get(s),
+- nlk->cb_running,
++ READ_ONCE(nlk->cb_running),
+ refcount_read(&s->sk_refcnt),
+ atomic_read(&s->sk_drops),
+ sock_i_ino(s)
+diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
+index 1a30e165eeb4f..a5fa25555d7eb 100644
+--- a/net/nsh/nsh.c
++++ b/net/nsh/nsh.c
+@@ -80,13 +80,12 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
+ netdev_features_t features)
+ {
+ struct sk_buff *segs = ERR_PTR(-EINVAL);
++ u16 mac_offset = skb->mac_header;
+ unsigned int nsh_len, mac_len;
+ __be16 proto;
+- int nhoff;
+
+ skb_reset_network_header(skb);
+
+- nhoff = skb->network_header - skb->mac_header;
+ mac_len = skb->mac_len;
+
+ if (unlikely(!pskb_may_pull(skb, NSH_BASE_HDR_LEN)))
+@@ -111,15 +110,14 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
+ segs = skb_mac_gso_segment(skb, features);
+ if (IS_ERR_OR_NULL(segs)) {
+ skb_gso_error_unwind(skb, htons(ETH_P_NSH), nsh_len,
+- skb->network_header - nhoff,
+- mac_len);
++ mac_offset, mac_len);
+ goto out;
+ }
+
+ for (skb = segs; skb; skb = skb->next) {
+ skb->protocol = htons(ETH_P_NSH);
+ __skb_push(skb, nsh_len);
+- skb_set_mac_header(skb, -nhoff);
++ skb->mac_header = mac_offset;
+ skb->network_header = skb->mac_header + mac_len;
+ skb->mac_len = mac_len;
+ }
+diff --git a/net/socket.c b/net/socket.c
+index a5167f03c31db..ce70c01eb2f3e 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2555,7 +2555,7 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
+ * error to return on the next call or if the
+ * app asks about it using getsockopt(SO_ERROR).
+ */
+- sock->sk->sk_err = -err;
++ WRITE_ONCE(sock->sk->sk_err, -err);
+ }
+ out_put:
+ fput_light(sock->file, fput_needed);
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index e79c329427964..b0dcbb08e60db 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -536,7 +536,7 @@ static void unix_release_sock(struct sock *sk, int embrion)
+ /* Clear state */
+ unix_state_lock(sk);
+ sock_orphan(sk);
+- sk->sk_shutdown = SHUTDOWN_MASK;
++ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
+ path = u->path;
+ u->path.dentry = NULL;
+ u->path.mnt = NULL;
+@@ -554,7 +554,7 @@ static void unix_release_sock(struct sock *sk, int embrion)
+ if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {
+ unix_state_lock(skpair);
+ /* No more writes */
+- skpair->sk_shutdown = SHUTDOWN_MASK;
++ WRITE_ONCE(skpair->sk_shutdown, SHUTDOWN_MASK);
+ if (!skb_queue_empty(&sk->sk_receive_queue) || embrion)
+ skpair->sk_err = ECONNRESET;
+ unix_state_unlock(skpair);
+@@ -1232,7 +1232,7 @@ static long unix_wait_for_peer(struct sock *other, long timeo)
+
+ sched = !sock_flag(other, SOCK_DEAD) &&
+ !(other->sk_shutdown & RCV_SHUTDOWN) &&
+- unix_recvq_full(other);
++ unix_recvq_full_lockless(other);
+
+ unix_state_unlock(other);
+
+@@ -2551,7 +2551,7 @@ static int unix_shutdown(struct socket *sock, int mode)
+ ++mode;
+
+ unix_state_lock(sk);
+- sk->sk_shutdown |= mode;
++ WRITE_ONCE(sk->sk_shutdown, sk->sk_shutdown | mode);
+ other = unix_peer(sk);
+ if (other)
+ sock_hold(other);
+@@ -2568,7 +2568,7 @@ static int unix_shutdown(struct socket *sock, int mode)
+ if (mode&SEND_SHUTDOWN)
+ peer_mode |= RCV_SHUTDOWN;
+ unix_state_lock(other);
+- other->sk_shutdown |= peer_mode;
++ WRITE_ONCE(other->sk_shutdown, other->sk_shutdown | peer_mode);
+ unix_state_unlock(other);
+ other->sk_state_change(other);
+ if (peer_mode == SHUTDOWN_MASK)
+@@ -2687,16 +2687,18 @@ static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wa
+ {
+ struct sock *sk = sock->sk;
+ __poll_t mask;
++ u8 shutdown;
+
+ sock_poll_wait(file, sock, wait);
+ mask = 0;
++ shutdown = READ_ONCE(sk->sk_shutdown);
+
+ /* exceptional events? */
+ if (sk->sk_err)
+ mask |= EPOLLERR;
+- if (sk->sk_shutdown == SHUTDOWN_MASK)
++ if (shutdown == SHUTDOWN_MASK)
+ mask |= EPOLLHUP;
+- if (sk->sk_shutdown & RCV_SHUTDOWN)
++ if (shutdown & RCV_SHUTDOWN)
+ mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
+
+ /* readable? */
+@@ -2724,18 +2726,20 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
+ struct sock *sk = sock->sk, *other;
+ unsigned int writable;
+ __poll_t mask;
++ u8 shutdown;
+
+ sock_poll_wait(file, sock, wait);
+ mask = 0;
++ shutdown = READ_ONCE(sk->sk_shutdown);
+
+ /* exceptional events? */
+ if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
+ mask |= EPOLLERR |
+ (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
+
+- if (sk->sk_shutdown & RCV_SHUTDOWN)
++ if (shutdown & RCV_SHUTDOWN)
+ mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
+- if (sk->sk_shutdown == SHUTDOWN_MASK)
++ if (shutdown == SHUTDOWN_MASK)
+ mask |= EPOLLHUP;
+
+ /* readable? */
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index d55a47858d6d3..0dfa2dfcb4bcb 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1240,7 +1240,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
+ vsock_transport_cancel_pkt(vsk);
+ vsock_remove_connected(vsk);
+ goto out_wait;
+- } else if (timeout == 0) {
++ } else if ((sk->sk_state != TCP_ESTABLISHED) && (timeout == 0)) {
+ err = -ETIMEDOUT;
+ sk->sk_state = TCP_CLOSE;
+ sock->state = SS_UNCONNECTED;
+diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
+index d3e61dcc61295..ae1ae7c86d0c6 100644
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -132,6 +132,7 @@ uwrite(int const fd, void const *const buf, size_t const count)
+ {
+ size_t cnt = count;
+ off_t idx = 0;
++ void *p = NULL;
+
+ file_updated = 1;
+
+@@ -139,7 +140,10 @@ uwrite(int const fd, void const *const buf, size_t const count)
+ off_t aoffset = (file_ptr + count) - file_end;
+
+ if (aoffset > file_append_size) {
+- file_append = realloc(file_append, aoffset);
++ p = realloc(file_append, aoffset);
++ if (!p)
++ free(file_append);
++ file_append = p;
+ file_append_size = aoffset;
+ }
+ if (!file_append) {
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index ff263ad19230a..f4b07dc6f1cc1 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -1159,8 +1159,8 @@ static bool path_has_mixer(struct hda_codec *codec, int path_idx, int ctl_type)
+ return path && path->ctls[ctl_type];
+ }
+
+-static const char * const channel_name[4] = {
+- "Front", "Surround", "CLFE", "Side"
++static const char * const channel_name[] = {
++ "Front", "Surround", "CLFE", "Side", "Back",
+ };
+
+ /* give some appropriate ctl name prefix for the given line out channel */
+@@ -1186,7 +1186,7 @@ static const char *get_line_out_pfx(struct hda_codec *codec, int ch,
+
+ /* multi-io channels */
+ if (ch >= cfg->line_outs)
+- return channel_name[ch];
++ goto fixed_name;
+
+ switch (cfg->line_out_type) {
+ case AUTO_PIN_SPEAKER_OUT:
+@@ -1238,6 +1238,7 @@ static const char *get_line_out_pfx(struct hda_codec *codec, int ch,
+ if (cfg->line_outs == 1 && !spec->multi_ios)
+ return "Line Out";
+
++ fixed_name:
+ if (ch >= ARRAY_SIZE(channel_name)) {
+ snd_BUG();
+ return "PCM";
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 9f0e6bbc523c3..ca3c9f1618294 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -1070,6 +1070,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = {
+ SND_PCI_QUIRK(0x1458, 0xA026, "Gigabyte G1.Sniper Z97", QUIRK_R3DI),
+ SND_PCI_QUIRK(0x1458, 0xA036, "Gigabyte GA-Z170X-Gaming 7", QUIRK_R3DI),
+ SND_PCI_QUIRK(0x3842, 0x1038, "EVGA X99 Classified", QUIRK_R3DI),
++ SND_PCI_QUIRK(0x3842, 0x104b, "EVGA X299 Dark", QUIRK_R3DI),
+ SND_PCI_QUIRK(0x3842, 0x1055, "EVGA Z390 DARK", QUIRK_R3DI),
+ SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D),
+ {}
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index be9f1c4295cde..e3f0326d81c28 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3937,6 +3937,11 @@ HDA_CODEC_ENTRY(0x10de009d, "GPU 9d HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de009e, "GPU 9e HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de009f, "GPU 9f HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de00a0, "GPU a0 HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de00a3, "GPU a3 HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de00a4, "GPU a4 HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de00a5, "GPU a5 HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de00a6, "GPU a6 HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de00a7, "GPU a7 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch),
+ HDA_CODEC_ENTRY(0x10de8067, "MCP67/68 HDMI", patch_nvhdmi_2ch),
+ HDA_CODEC_ENTRY(0x11069f80, "VX900 HDMI/DP", patch_via_hdmi),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 546872e724275..e5d85887759bd 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -956,7 +956,7 @@ struct alc_codec_rename_pci_table {
+ const char *name;
+ };
+
+-static struct alc_codec_rename_table rename_tbl[] = {
++static const struct alc_codec_rename_table rename_tbl[] = {
+ { 0x10ec0221, 0xf00f, 0x1003, "ALC231" },
+ { 0x10ec0269, 0xfff0, 0x3010, "ALC277" },
+ { 0x10ec0269, 0xf0f0, 0x2010, "ALC259" },
+@@ -977,7 +977,7 @@ static struct alc_codec_rename_table rename_tbl[] = {
+ { } /* terminator */
+ };
+
+-static struct alc_codec_rename_pci_table rename_pci_tbl[] = {
++static const struct alc_codec_rename_pci_table rename_pci_tbl[] = {
+ { 0x10ec0280, 0x1028, 0, "ALC3220" },
+ { 0x10ec0282, 0x1028, 0, "ALC3221" },
+ { 0x10ec0283, 0x1028, 0, "ALC3223" },
+@@ -3116,7 +3116,7 @@ static void alc269_shutup(struct hda_codec *codec)
+ alc_shutup_pins(codec);
+ }
+
+-static struct coef_fw alc282_coefs[] = {
++static const struct coef_fw alc282_coefs[] = {
+ WRITE_COEF(0x03, 0x0002), /* Power Down Control */
+ UPDATE_COEF(0x05, 0xff3f, 0x0700), /* FIFO and filter clock */
+ WRITE_COEF(0x07, 0x0200), /* DMIC control */
+@@ -3228,7 +3228,7 @@ static void alc282_shutup(struct hda_codec *codec)
+ alc_write_coef_idx(codec, 0x78, coef78);
+ }
+
+-static struct coef_fw alc283_coefs[] = {
++static const struct coef_fw alc283_coefs[] = {
+ WRITE_COEF(0x03, 0x0002), /* Power Down Control */
+ UPDATE_COEF(0x05, 0xff3f, 0x0700), /* FIFO and filter clock */
+ WRITE_COEF(0x07, 0x0200), /* DMIC control */
+@@ -4235,7 +4235,7 @@ static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec,
+ }
+ }
+
+-static struct coef_fw alc225_pre_hsmode[] = {
++static const struct coef_fw alc225_pre_hsmode[] = {
+ UPDATE_COEF(0x4a, 1<<8, 0),
+ UPDATE_COEFEX(0x57, 0x05, 1<<14, 0),
+ UPDATE_COEF(0x63, 3<<14, 3<<14),
+@@ -4248,7 +4248,7 @@ static struct coef_fw alc225_pre_hsmode[] = {
+
+ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ {
+- static struct coef_fw coef0255[] = {
++ static const struct coef_fw coef0255[] = {
+ WRITE_COEF(0x1b, 0x0c0b), /* LDO and MISC control */
+ WRITE_COEF(0x45, 0xd089), /* UAJ function set to menual mode */
+ UPDATE_COEFEX(0x57, 0x05, 1<<14, 0), /* Direct Drive HP Amp control(Set to verb control)*/
+@@ -4256,7 +4256,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ WRITE_COEFEX(0x57, 0x03, 0x8aa6), /* Direct Drive HP Amp control */
+ {}
+ };
+- static struct coef_fw coef0256[] = {
++ static const struct coef_fw coef0256[] = {
+ WRITE_COEF(0x1b, 0x0c4b), /* LDO and MISC control */
+ WRITE_COEF(0x45, 0xd089), /* UAJ function set to menual mode */
+ WRITE_COEF(0x06, 0x6104), /* Set MIC2 Vref gate with HP */
+@@ -4264,7 +4264,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ UPDATE_COEFEX(0x57, 0x05, 1<<14, 0), /* Direct Drive HP Amp control(Set to verb control)*/
+ {}
+ };
+- static struct coef_fw coef0233[] = {
++ static const struct coef_fw coef0233[] = {
+ WRITE_COEF(0x1b, 0x0c0b),
+ WRITE_COEF(0x45, 0xc429),
+ UPDATE_COEF(0x35, 0x4000, 0),
+@@ -4274,7 +4274,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ WRITE_COEF(0x32, 0x42a3),
+ {}
+ };
+- static struct coef_fw coef0288[] = {
++ static const struct coef_fw coef0288[] = {
+ UPDATE_COEF(0x4f, 0xfcc0, 0xc400),
+ UPDATE_COEF(0x50, 0x2000, 0x2000),
+ UPDATE_COEF(0x56, 0x0006, 0x0006),
+@@ -4282,18 +4282,18 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ UPDATE_COEF(0x67, 0x2000, 0),
+ {}
+ };
+- static struct coef_fw coef0298[] = {
++ static const struct coef_fw coef0298[] = {
+ UPDATE_COEF(0x19, 0x1300, 0x0300),
+ {}
+ };
+- static struct coef_fw coef0292[] = {
++ static const struct coef_fw coef0292[] = {
+ WRITE_COEF(0x76, 0x000e),
+ WRITE_COEF(0x6c, 0x2400),
+ WRITE_COEF(0x18, 0x7308),
+ WRITE_COEF(0x6b, 0xc429),
+ {}
+ };
+- static struct coef_fw coef0293[] = {
++ static const struct coef_fw coef0293[] = {
+ UPDATE_COEF(0x10, 7<<8, 6<<8), /* SET Line1 JD to 0 */
+ UPDATE_COEFEX(0x57, 0x05, 1<<15|1<<13, 0x0), /* SET charge pump by verb */
+ UPDATE_COEFEX(0x57, 0x03, 1<<10, 1<<10), /* SET EN_OSW to 1 */
+@@ -4302,16 +4302,16 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ UPDATE_COEF(0x4a, 0x000f, 0x000e), /* Combo Jack auto detect */
+ {}
+ };
+- static struct coef_fw coef0668[] = {
++ static const struct coef_fw coef0668[] = {
+ WRITE_COEF(0x15, 0x0d40),
+ WRITE_COEF(0xb7, 0x802b),
+ {}
+ };
+- static struct coef_fw coef0225[] = {
++ static const struct coef_fw coef0225[] = {
+ UPDATE_COEF(0x63, 3<<14, 0),
+ {}
+ };
+- static struct coef_fw coef0274[] = {
++ static const struct coef_fw coef0274[] = {
+ UPDATE_COEF(0x4a, 0x0100, 0),
+ UPDATE_COEFEX(0x57, 0x05, 0x4000, 0),
+ UPDATE_COEF(0x6b, 0xf000, 0x5000),
+@@ -4376,25 +4376,25 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ hda_nid_t mic_pin)
+ {
+- static struct coef_fw coef0255[] = {
++ static const struct coef_fw coef0255[] = {
+ WRITE_COEFEX(0x57, 0x03, 0x8aa6),
+ WRITE_COEF(0x06, 0x6100), /* Set MIC2 Vref gate to normal */
+ {}
+ };
+- static struct coef_fw coef0256[] = {
++ static const struct coef_fw coef0256[] = {
+ UPDATE_COEFEX(0x57, 0x05, 1<<14, 1<<14), /* Direct Drive HP Amp control(Set to verb control)*/
+ WRITE_COEFEX(0x57, 0x03, 0x09a3),
+ WRITE_COEF(0x06, 0x6100), /* Set MIC2 Vref gate to normal */
+ {}
+ };
+- static struct coef_fw coef0233[] = {
++ static const struct coef_fw coef0233[] = {
+ UPDATE_COEF(0x35, 0, 1<<14),
+ WRITE_COEF(0x06, 0x2100),
+ WRITE_COEF(0x1a, 0x0021),
+ WRITE_COEF(0x26, 0x008c),
+ {}
+ };
+- static struct coef_fw coef0288[] = {
++ static const struct coef_fw coef0288[] = {
+ UPDATE_COEF(0x4f, 0x00c0, 0),
+ UPDATE_COEF(0x50, 0x2000, 0),
+ UPDATE_COEF(0x56, 0x0006, 0),
+@@ -4403,30 +4403,30 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ UPDATE_COEF(0x67, 0x2000, 0x2000),
+ {}
+ };
+- static struct coef_fw coef0292[] = {
++ static const struct coef_fw coef0292[] = {
+ WRITE_COEF(0x19, 0xa208),
+ WRITE_COEF(0x2e, 0xacf0),
+ {}
+ };
+- static struct coef_fw coef0293[] = {
++ static const struct coef_fw coef0293[] = {
+ UPDATE_COEFEX(0x57, 0x05, 0, 1<<15|1<<13), /* SET charge pump by verb */
+ UPDATE_COEFEX(0x57, 0x03, 1<<10, 0), /* SET EN_OSW to 0 */
+ UPDATE_COEF(0x1a, 1<<3, 0), /* Combo JD gating without LINE1-VREFO */
+ {}
+ };
+- static struct coef_fw coef0688[] = {
++ static const struct coef_fw coef0688[] = {
+ WRITE_COEF(0xb7, 0x802b),
+ WRITE_COEF(0xb5, 0x1040),
+ UPDATE_COEF(0xc3, 0, 1<<12),
+ {}
+ };
+- static struct coef_fw coef0225[] = {
++ static const struct coef_fw coef0225[] = {
+ UPDATE_COEFEX(0x57, 0x05, 1<<14, 1<<14),
+ UPDATE_COEF(0x4a, 3<<4, 2<<4),
+ UPDATE_COEF(0x63, 3<<14, 0),
+ {}
+ };
+- static struct coef_fw coef0274[] = {
++ static const struct coef_fw coef0274[] = {
+ UPDATE_COEFEX(0x57, 0x05, 0x4000, 0x4000),
+ UPDATE_COEF(0x4a, 0x0010, 0),
+ UPDATE_COEF(0x6b, 0xf000, 0),
+@@ -4512,7 +4512,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+
+ static void alc_headset_mode_default(struct hda_codec *codec)
+ {
+- static struct coef_fw coef0225[] = {
++ static const struct coef_fw coef0225[] = {
+ UPDATE_COEF(0x45, 0x3f<<10, 0x30<<10),
+ UPDATE_COEF(0x45, 0x3f<<10, 0x31<<10),
+ UPDATE_COEF(0x49, 3<<8, 0<<8),
+@@ -4521,14 +4521,14 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ UPDATE_COEF(0x67, 0xf000, 0x3000),
+ {}
+ };
+- static struct coef_fw coef0255[] = {
++ static const struct coef_fw coef0255[] = {
+ WRITE_COEF(0x45, 0xc089),
+ WRITE_COEF(0x45, 0xc489),
+ WRITE_COEFEX(0x57, 0x03, 0x8ea6),
+ WRITE_COEF(0x49, 0x0049),
+ {}
+ };
+- static struct coef_fw coef0256[] = {
++ static const struct coef_fw coef0256[] = {
+ WRITE_COEF(0x45, 0xc489),
+ WRITE_COEFEX(0x57, 0x03, 0x0da3),
+ WRITE_COEF(0x49, 0x0049),
+@@ -4536,12 +4536,12 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ WRITE_COEF(0x06, 0x6100),
+ {}
+ };
+- static struct coef_fw coef0233[] = {
++ static const struct coef_fw coef0233[] = {
+ WRITE_COEF(0x06, 0x2100),
+ WRITE_COEF(0x32, 0x4ea3),
+ {}
+ };
+- static struct coef_fw coef0288[] = {
++ static const struct coef_fw coef0288[] = {
+ UPDATE_COEF(0x4f, 0xfcc0, 0xc400), /* Set to TRS type */
+ UPDATE_COEF(0x50, 0x2000, 0x2000),
+ UPDATE_COEF(0x56, 0x0006, 0x0006),
+@@ -4549,26 +4549,26 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ UPDATE_COEF(0x67, 0x2000, 0),
+ {}
+ };
+- static struct coef_fw coef0292[] = {
++ static const struct coef_fw coef0292[] = {
+ WRITE_COEF(0x76, 0x000e),
+ WRITE_COEF(0x6c, 0x2400),
+ WRITE_COEF(0x6b, 0xc429),
+ WRITE_COEF(0x18, 0x7308),
+ {}
+ };
+- static struct coef_fw coef0293[] = {
++ static const struct coef_fw coef0293[] = {
+ UPDATE_COEF(0x4a, 0x000f, 0x000e), /* Combo Jack auto detect */
+ WRITE_COEF(0x45, 0xC429), /* Set to TRS type */
+ UPDATE_COEF(0x1a, 1<<3, 0), /* Combo JD gating without LINE1-VREFO */
+ {}
+ };
+- static struct coef_fw coef0688[] = {
++ static const struct coef_fw coef0688[] = {
+ WRITE_COEF(0x11, 0x0041),
+ WRITE_COEF(0x15, 0x0d40),
+ WRITE_COEF(0xb7, 0x802b),
+ {}
+ };
+- static struct coef_fw coef0274[] = {
++ static const struct coef_fw coef0274[] = {
+ WRITE_COEF(0x45, 0x4289),
+ UPDATE_COEF(0x4a, 0x0010, 0x0010),
+ UPDATE_COEF(0x6b, 0x0f00, 0),
+@@ -4631,53 +4631,53 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
+ {
+ int val;
+
+- static struct coef_fw coef0255[] = {
++ static const struct coef_fw coef0255[] = {
+ WRITE_COEF(0x45, 0xd489), /* Set to CTIA type */
+ WRITE_COEF(0x1b, 0x0c2b),
+ WRITE_COEFEX(0x57, 0x03, 0x8ea6),
+ {}
+ };
+- static struct coef_fw coef0256[] = {
++ static const struct coef_fw coef0256[] = {
+ WRITE_COEF(0x45, 0xd489), /* Set to CTIA type */
+ WRITE_COEF(0x1b, 0x0e6b),
+ {}
+ };
+- static struct coef_fw coef0233[] = {
++ static const struct coef_fw coef0233[] = {
+ WRITE_COEF(0x45, 0xd429),
+ WRITE_COEF(0x1b, 0x0c2b),
+ WRITE_COEF(0x32, 0x4ea3),
+ {}
+ };
+- static struct coef_fw coef0288[] = {
++ static const struct coef_fw coef0288[] = {
+ UPDATE_COEF(0x50, 0x2000, 0x2000),
+ UPDATE_COEF(0x56, 0x0006, 0x0006),
+ UPDATE_COEF(0x66, 0x0008, 0),
+ UPDATE_COEF(0x67, 0x2000, 0),
+ {}
+ };
+- static struct coef_fw coef0292[] = {
++ static const struct coef_fw coef0292[] = {
+ WRITE_COEF(0x6b, 0xd429),
+ WRITE_COEF(0x76, 0x0008),
+ WRITE_COEF(0x18, 0x7388),
+ {}
+ };
+- static struct coef_fw coef0293[] = {
++ static const struct coef_fw coef0293[] = {
+ WRITE_COEF(0x45, 0xd429), /* Set to ctia type */
+ UPDATE_COEF(0x10, 7<<8, 7<<8), /* SET Line1 JD to 1 */
+ {}
+ };
+- static struct coef_fw coef0688[] = {
++ static const struct coef_fw coef0688[] = {
+ WRITE_COEF(0x11, 0x0001),
+ WRITE_COEF(0x15, 0x0d60),
+ WRITE_COEF(0xc3, 0x0000),
+ {}
+ };
+- static struct coef_fw coef0225_1[] = {
++ static const struct coef_fw coef0225_1[] = {
+ UPDATE_COEF(0x45, 0x3f<<10, 0x35<<10),
+ UPDATE_COEF(0x63, 3<<14, 2<<14),
+ {}
+ };
+- static struct coef_fw coef0225_2[] = {
++ static const struct coef_fw coef0225_2[] = {
+ UPDATE_COEF(0x45, 0x3f<<10, 0x35<<10),
+ UPDATE_COEF(0x63, 3<<14, 1<<14),
+ {}
+@@ -4749,48 +4749,48 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
+ /* Nokia type */
+ static void alc_headset_mode_omtp(struct hda_codec *codec)
+ {
+- static struct coef_fw coef0255[] = {
++ static const struct coef_fw coef0255[] = {
+ WRITE_COEF(0x45, 0xe489), /* Set to OMTP Type */
+ WRITE_COEF(0x1b, 0x0c2b),
+ WRITE_COEFEX(0x57, 0x03, 0x8ea6),
+ {}
+ };
+- static struct coef_fw coef0256[] = {
++ static const struct coef_fw coef0256[] = {
+ WRITE_COEF(0x45, 0xe489), /* Set to OMTP Type */
+ WRITE_COEF(0x1b, 0x0e6b),
+ {}
+ };
+- static struct coef_fw coef0233[] = {
++ static const struct coef_fw coef0233[] = {
+ WRITE_COEF(0x45, 0xe429),
+ WRITE_COEF(0x1b, 0x0c2b),
+ WRITE_COEF(0x32, 0x4ea3),
+ {}
+ };
+- static struct coef_fw coef0288[] = {
++ static const struct coef_fw coef0288[] = {
+ UPDATE_COEF(0x50, 0x2000, 0x2000),
+ UPDATE_COEF(0x56, 0x0006, 0x0006),
+ UPDATE_COEF(0x66, 0x0008, 0),
+ UPDATE_COEF(0x67, 0x2000, 0),
+ {}
+ };
+- static struct coef_fw coef0292[] = {
++ static const struct coef_fw coef0292[] = {
+ WRITE_COEF(0x6b, 0xe429),
+ WRITE_COEF(0x76, 0x0008),
+ WRITE_COEF(0x18, 0x7388),
+ {}
+ };
+- static struct coef_fw coef0293[] = {
++ static const struct coef_fw coef0293[] = {
+ WRITE_COEF(0x45, 0xe429), /* Set to omtp type */
+ UPDATE_COEF(0x10, 7<<8, 7<<8), /* SET Line1 JD to 1 */
+ {}
+ };
+- static struct coef_fw coef0688[] = {
++ static const struct coef_fw coef0688[] = {
+ WRITE_COEF(0x11, 0x0001),
+ WRITE_COEF(0x15, 0x0d50),
+ WRITE_COEF(0xc3, 0x0000),
+ {}
+ };
+- static struct coef_fw coef0225[] = {
++ static const struct coef_fw coef0225[] = {
+ UPDATE_COEF(0x45, 0x3f<<10, 0x39<<10),
+ UPDATE_COEF(0x63, 3<<14, 2<<14),
+ {}
+@@ -4850,17 +4850,17 @@ static void alc_determine_headset_type(struct hda_codec *codec)
+ int val;
+ bool is_ctia = false;
+ struct alc_spec *spec = codec->spec;
+- static struct coef_fw coef0255[] = {
++ static const struct coef_fw coef0255[] = {
+ WRITE_COEF(0x45, 0xd089), /* combo jack auto switch control(Check type)*/
+ WRITE_COEF(0x49, 0x0149), /* combo jack auto switch control(Vref
+ conteol) */
+ {}
+ };
+- static struct coef_fw coef0288[] = {
++ static const struct coef_fw coef0288[] = {
+ UPDATE_COEF(0x4f, 0xfcc0, 0xd400), /* Check Type */
+ {}
+ };
+- static struct coef_fw coef0298[] = {
++ static const struct coef_fw coef0298[] = {
+ UPDATE_COEF(0x50, 0x2000, 0x2000),
+ UPDATE_COEF(0x56, 0x0006, 0x0006),
+ UPDATE_COEF(0x66, 0x0008, 0),
+@@ -4868,19 +4868,19 @@ static void alc_determine_headset_type(struct hda_codec *codec)
+ UPDATE_COEF(0x19, 0x1300, 0x1300),
+ {}
+ };
+- static struct coef_fw coef0293[] = {
++ static const struct coef_fw coef0293[] = {
+ UPDATE_COEF(0x4a, 0x000f, 0x0008), /* Combo Jack auto detect */
+ WRITE_COEF(0x45, 0xD429), /* Set to ctia type */
+ {}
+ };
+- static struct coef_fw coef0688[] = {
++ static const struct coef_fw coef0688[] = {
+ WRITE_COEF(0x11, 0x0001),
+ WRITE_COEF(0xb7, 0x802b),
+ WRITE_COEF(0x15, 0x0d60),
+ WRITE_COEF(0xc3, 0x0c00),
+ {}
+ };
+- static struct coef_fw coef0274[] = {
++ static const struct coef_fw coef0274[] = {
+ UPDATE_COEF(0x4a, 0x0010, 0),
+ UPDATE_COEF(0x4a, 0x8000, 0),
+ WRITE_COEF(0x45, 0xd289),
+@@ -5165,7 +5165,7 @@ static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec,
+ static void alc255_set_default_jack_type(struct hda_codec *codec)
+ {
+ /* Set to iphone type */
+- static struct coef_fw alc255fw[] = {
++ static const struct coef_fw alc255fw[] = {
+ WRITE_COEF(0x1b, 0x880b),
+ WRITE_COEF(0x45, 0xd089),
+ WRITE_COEF(0x1b, 0x080b),
+@@ -5173,7 +5173,7 @@ static void alc255_set_default_jack_type(struct hda_codec *codec)
+ WRITE_COEF(0x1b, 0x0c0b),
+ {}
+ };
+- static struct coef_fw alc256fw[] = {
++ static const struct coef_fw alc256fw[] = {
+ WRITE_COEF(0x1b, 0x884b),
+ WRITE_COEF(0x45, 0xd089),
+ WRITE_COEF(0x1b, 0x084b),
+@@ -8511,7 +8511,92 @@ static void alc662_fixup_usi_headset_mic(struct hda_codec *codec,
+ }
+ }
+
+-static struct coef_fw alc668_coefs[] = {
++static void alc662_aspire_ethos_mute_speakers(struct hda_codec *codec,
++ struct hda_jack_callback *cb)
++{
++ /* surround speakers at 0x1b already get muted automatically when
++ * headphones are plugged in, but we have to mute/unmute the remaining
++ * channels manually:
++ * 0x15 - front left/front right
++ * 0x18 - front center/ LFE
++ */
++ if (snd_hda_jack_detect_state(codec, 0x1b) == HDA_JACK_PRESENT) {
++ snd_hda_set_pin_ctl_cache(codec, 0x15, 0);
++ snd_hda_set_pin_ctl_cache(codec, 0x18, 0);
++ } else {
++ snd_hda_set_pin_ctl_cache(codec, 0x15, PIN_OUT);
++ snd_hda_set_pin_ctl_cache(codec, 0x18, PIN_OUT);
++ }
++}
++
++static void alc662_fixup_aspire_ethos_hp(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ /* Pin 0x1b: shared headphones jack and surround speakers */
++ if (!is_jack_detectable(codec, 0x1b))
++ return;
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ snd_hda_jack_detect_enable_callback(codec, 0x1b,
++ alc662_aspire_ethos_mute_speakers);
++ /* subwoofer needs an extra GPIO setting to become audible */
++ alc_setup_gpio(codec, 0x02);
++ break;
++ case HDA_FIXUP_ACT_INIT:
++ /* Make sure to start in a correct state, i.e. if
++ * headphones have been plugged in before powering up the system
++ */
++ alc662_aspire_ethos_mute_speakers(codec, NULL);
++ break;
++ }
++}
++
++static void alc671_fixup_hp_headset_mic2(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++
++ static const struct hda_pintbl pincfgs[] = {
++ { 0x19, 0x02a11040 }, /* use as headset mic, with its own jack detect */
++ { 0x1b, 0x0181304f },
++ { }
++ };
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ spec->gen.mixer_nid = 0;
++ spec->parse_flags |= HDA_PINCFG_HEADSET_MIC;
++ snd_hda_apply_pincfgs(codec, pincfgs);
++ break;
++ case HDA_FIXUP_ACT_INIT:
++ alc_write_coef_idx(codec, 0x19, 0xa054);
++ break;
++ }
++}
++
++static void alc897_hp_automute_hook(struct hda_codec *codec,
++ struct hda_jack_callback *jack)
++{
++ struct alc_spec *spec = codec->spec;
++ int vref;
++
++ snd_hda_gen_hp_automute(codec, jack);
++ vref = spec->gen.hp_jack_present ? (PIN_HP | AC_PINCTL_VREF_100) : PIN_HP;
++ snd_hda_codec_write(codec, 0x1b, 0, AC_VERB_SET_PIN_WIDGET_CONTROL,
++ vref);
++}
++
++static void alc897_fixup_lenovo_headset_mic(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ spec->gen.hp_automute_hook = alc897_hp_automute_hook;
++ }
++}
++
++static const struct coef_fw alc668_coefs[] = {
+ WRITE_COEF(0x01, 0xbebe), WRITE_COEF(0x02, 0xaaaa), WRITE_COEF(0x03, 0x0),
+ WRITE_COEF(0x04, 0x0180), WRITE_COEF(0x06, 0x0), WRITE_COEF(0x07, 0x0f80),
+ WRITE_COEF(0x08, 0x0031), WRITE_COEF(0x0a, 0x0060), WRITE_COEF(0x0b, 0x0),
+@@ -8582,6 +8667,17 @@ enum {
+ ALC662_FIXUP_USI_FUNC,
+ ALC662_FIXUP_USI_HEADSET_MODE,
+ ALC662_FIXUP_LENOVO_MULTI_CODECS,
++ ALC669_FIXUP_ACER_ASPIRE_ETHOS,
++ ALC669_FIXUP_ACER_ASPIRE_ETHOS_HEADSET,
++ ALC671_FIXUP_HP_HEADSET_MIC2,
++ ALC662_FIXUP_ACER_X2660G_HEADSET_MODE,
++ ALC662_FIXUP_ACER_NITRO_HEADSET_MODE,
++ ALC668_FIXUP_ASUS_NO_HEADSET_MIC,
++ ALC668_FIXUP_HEADSET_MIC,
++ ALC668_FIXUP_MIC_DET_COEF,
++ ALC897_FIXUP_LENOVO_HEADSET_MIC,
++ ALC897_FIXUP_HEADSET_MIC_PIN,
++ ALC897_FIXUP_HP_HSMIC_VERB,
+ };
+
+ static const struct hda_fixup alc662_fixups[] = {
+@@ -8908,6 +9004,87 @@ static const struct hda_fixup alc662_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc233_alc662_fixup_lenovo_dual_codecs,
+ },
++ [ALC669_FIXUP_ACER_ASPIRE_ETHOS_HEADSET] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc662_fixup_aspire_ethos_hp,
++ },
++ [ALC669_FIXUP_ACER_ASPIRE_ETHOS] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x15, 0x92130110 }, /* front speakers */
++ { 0x18, 0x99130111 }, /* center/subwoofer */
++ { 0x1b, 0x11130012 }, /* surround plus jack for HP */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC669_FIXUP_ACER_ASPIRE_ETHOS_HEADSET
++ },
++ [ALC671_FIXUP_HP_HEADSET_MIC2] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc671_fixup_hp_headset_mic2,
++ },
++ [ALC662_FIXUP_ACER_X2660G_HEADSET_MODE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x1a, 0x02a1113c }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC662_FIXUP_USI_FUNC
++ },
++ [ALC662_FIXUP_ACER_NITRO_HEADSET_MODE] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x1a, 0x01a11140 }, /* use as headset mic, without its own jack detect */
++ { 0x1b, 0x0221144f },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC662_FIXUP_USI_FUNC
++ },
++ [ALC668_FIXUP_ASUS_NO_HEADSET_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x1b, 0x04a1112c },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC668_FIXUP_HEADSET_MIC
++ },
++ [ALC668_FIXUP_HEADSET_MIC] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc269_fixup_headset_mic,
++ .chained = true,
++ .chain_id = ALC668_FIXUP_MIC_DET_COEF
++ },
++ [ALC668_FIXUP_MIC_DET_COEF] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x15 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0d60 },
++ {}
++ },
++ },
++ [ALC897_FIXUP_LENOVO_HEADSET_MIC] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc897_fixup_lenovo_headset_mic,
++ },
++ [ALC897_FIXUP_HEADSET_MIC_PIN] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x1a, 0x03a11050 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC897_FIXUP_LENOVO_HEADSET_MIC
++ },
++ [ALC897_FIXUP_HP_HSMIC_VERB] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ },
+ };
+
+ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+@@ -8919,6 +9096,8 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x0349, "eMachines eM250", ALC662_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1025, 0x034a, "Gateway LT27", ALC662_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
++ SND_PCI_QUIRK(0x1025, 0x123c, "Acer Nitro N50-600", ALC662_FIXUP_ACER_NITRO_HEADSET_MODE),
++ SND_PCI_QUIRK(0x1025, 0x124e, "Acer 2660G", ALC662_FIXUP_ACER_X2660G_HEADSET_MODE),
+ SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x05fe, "Dell XPS 15", ALC668_FIXUP_DELL_XPS13),
+@@ -8930,6 +9109,9 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
++ SND_PCI_QUIRK(0x103c, 0x8719, "HP", ALC897_FIXUP_HP_HSMIC_VERB),
++ SND_PCI_QUIRK(0x103c, 0x872b, "HP", ALC897_FIXUP_HP_HSMIC_VERB),
++ SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2),
+ SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE),
+ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
+ SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
+@@ -8939,6 +9121,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
+ SND_PCI_QUIRK(0x1043, 0x177d, "ASUS N551", ALC668_FIXUP_ASUS_Nx51),
+ SND_PCI_QUIRK(0x1043, 0x17bd, "ASUS N751", ALC668_FIXUP_ASUS_Nx51),
++ SND_PCI_QUIRK(0x1043, 0x185d, "ASUS G551JW", ALC668_FIXUP_ASUS_NO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1963, "ASUS X71SL", ALC662_FIXUP_ASUS_MODE8),
+ SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),
+ SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
+@@ -8947,12 +9130,17 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
+ SND_PCI_QUIRK(0x14cd, 0x5003, "USI", ALC662_FIXUP_USI_HEADSET_MODE),
+ SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC662_FIXUP_LENOVO_MULTI_CODECS),
++ SND_PCI_QUIRK(0x17aa, 0x32ca, "Lenovo ThinkCentre M80", ALC897_FIXUP_HEADSET_MIC_PIN),
++ SND_PCI_QUIRK(0x17aa, 0x32cb, "Lenovo ThinkCentre M70", ALC897_FIXUP_HEADSET_MIC_PIN),
++ SND_PCI_QUIRK(0x17aa, 0x32cf, "Lenovo ThinkCentre M950", ALC897_FIXUP_HEADSET_MIC_PIN),
++ SND_PCI_QUIRK(0x17aa, 0x32f7, "Lenovo ThinkCentre M90", ALC897_FIXUP_HEADSET_MIC_PIN),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
+ SND_PCI_QUIRK(0x1849, 0x5892, "ASRock B150M", ALC892_FIXUP_ASROCK_MOBO),
+ SND_PCI_QUIRK(0x19da, 0xa130, "Zotac Z68", ALC662_FIXUP_ZOTAC_Z68),
+ SND_PCI_QUIRK(0x1b0a, 0x01b8, "ACER Veriton", ALC662_FIXUP_ACER_VERITON),
+ SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
++ SND_PCI_QUIRK(0x1025, 0x0566, "Acer Aspire Ethos 8951G", ALC669_FIXUP_ACER_ASPIRE_ETHOS),
+
+ #if 0
+ /* Below is a quirk table taken from the old code.
+@@ -9045,6 +9233,7 @@ static const struct hda_model_fixup alc662_fixup_models[] = {
+ {.id = ALC892_FIXUP_ASROCK_MOBO, .name = "asrock-mobo"},
+ {.id = ALC662_FIXUP_USI_HEADSET_MODE, .name = "usi-headset"},
+ {.id = ALC662_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"},
++ {.id = ALC669_FIXUP_ACER_ASPIRE_ETHOS, .name = "aspire-ethos"},
+ {}
+ };
+
+@@ -9087,6 +9276,23 @@ static const struct snd_hda_pin_quirk alc662_pin_fixup_tbl[] = {
+ {0x12, 0x90a60130},
+ {0x14, 0x90170110},
+ {0x15, 0x0321101f}),
++ SND_HDA_PIN_QUIRK(0x10ec0671, 0x103c, "HP cPC", ALC671_FIXUP_HP_HEADSET_MIC2,
++ {0x14, 0x01014010},
++ {0x17, 0x90170150},
++ {0x19, 0x02a11060},
++ {0x1b, 0x01813030},
++ {0x21, 0x02211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0671, 0x103c, "HP cPC", ALC671_FIXUP_HP_HEADSET_MIC2,
++ {0x14, 0x01014010},
++ {0x18, 0x01a19040},
++ {0x1b, 0x01813030},
++ {0x21, 0x02211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0671, 0x103c, "HP cPC", ALC671_FIXUP_HP_HEADSET_MIC2,
++ {0x14, 0x01014020},
++ {0x17, 0x90170110},
++ {0x18, 0x01a19050},
++ {0x1b, 0x01813040},
++ {0x21, 0x02211030}),
+ {}
+ };
+
+diff --git a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
+index d7c2a6d13dea1..2221e43c63ce0 100644
+--- a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
++++ b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
+@@ -67,8 +67,8 @@ static int max_freq_mode;
+ */
+ static unsigned long max_frequency;
+
+-static unsigned long long tsc_at_measure_start;
+-static unsigned long long tsc_at_measure_end;
++static unsigned long long *tsc_at_measure_start;
++static unsigned long long *tsc_at_measure_end;
+ static unsigned long long *mperf_previous_count;
+ static unsigned long long *aperf_previous_count;
+ static unsigned long long *mperf_current_count;
+@@ -131,7 +131,7 @@ static int mperf_get_count_percent(unsigned int id, double *percent,
+ aperf_diff = aperf_current_count[cpu] - aperf_previous_count[cpu];
+
+ if (max_freq_mode == MAX_FREQ_TSC_REF) {
+- tsc_diff = tsc_at_measure_end - tsc_at_measure_start;
++ tsc_diff = tsc_at_measure_end[cpu] - tsc_at_measure_start[cpu];
+ *percent = 100.0 * mperf_diff / tsc_diff;
+ dprint("%s: TSC Ref - mperf_diff: %llu, tsc_diff: %llu\n",
+ mperf_cstates[id].name, mperf_diff, tsc_diff);
+@@ -168,7 +168,7 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
+
+ if (max_freq_mode == MAX_FREQ_TSC_REF) {
+ /* Calculate max_freq from TSC count */
+- tsc_diff = tsc_at_measure_end - tsc_at_measure_start;
++ tsc_diff = tsc_at_measure_end[cpu] - tsc_at_measure_start[cpu];
+ time_diff = timespec_diff_us(time_start, time_end);
+ max_frequency = tsc_diff / time_diff;
+ }
+@@ -187,33 +187,27 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
+ static int mperf_start(void)
+ {
+ int cpu;
+- unsigned long long dbg;
+
+ clock_gettime(CLOCK_REALTIME, &time_start);
+- mperf_get_tsc(&tsc_at_measure_start);
+
+- for (cpu = 0; cpu < cpu_count; cpu++)
++ for (cpu = 0; cpu < cpu_count; cpu++) {
++ mperf_get_tsc(&tsc_at_measure_start[cpu]);
+ mperf_init_stats(cpu);
++ }
+
+- mperf_get_tsc(&dbg);
+- dprint("TSC diff: %llu\n", dbg - tsc_at_measure_start);
+ return 0;
+ }
+
+ static int mperf_stop(void)
+ {
+- unsigned long long dbg;
+ int cpu;
+
+- for (cpu = 0; cpu < cpu_count; cpu++)
++ for (cpu = 0; cpu < cpu_count; cpu++) {
+ mperf_measure_stats(cpu);
++ mperf_get_tsc(&tsc_at_measure_end[cpu]);
++ }
+
+- mperf_get_tsc(&tsc_at_measure_end);
+ clock_gettime(CLOCK_REALTIME, &time_end);
+-
+- mperf_get_tsc(&dbg);
+- dprint("TSC diff: %llu\n", dbg - tsc_at_measure_end);
+-
+ return 0;
+ }
+
+@@ -311,7 +305,8 @@ struct cpuidle_monitor *mperf_register(void)
+ aperf_previous_count = calloc(cpu_count, sizeof(unsigned long long));
+ mperf_current_count = calloc(cpu_count, sizeof(unsigned long long));
+ aperf_current_count = calloc(cpu_count, sizeof(unsigned long long));
+-
++ tsc_at_measure_start = calloc(cpu_count, sizeof(unsigned long long));
++ tsc_at_measure_end = calloc(cpu_count, sizeof(unsigned long long));
+ mperf_monitor.name_len = strlen(mperf_monitor.name);
+ return &mperf_monitor;
+ }
+@@ -322,6 +317,8 @@ void mperf_unregister(void)
+ free(aperf_previous_count);
+ free(mperf_current_count);
+ free(aperf_current_count);
++ free(tsc_at_measure_start);
++ free(tsc_at_measure_end);
+ free(is_valid);
+ }
+
+diff --git a/tools/testing/selftests/memfd/fuse_test.c b/tools/testing/selftests/memfd/fuse_test.c
+index b018e835737df..cda63164d9d35 100644
+--- a/tools/testing/selftests/memfd/fuse_test.c
++++ b/tools/testing/selftests/memfd/fuse_test.c
+@@ -22,6 +22,7 @@
+ #include <linux/falloc.h>
+ #include <linux/fcntl.h>
+ #include <linux/memfd.h>
++#include <linux/types.h>
+ #include <sched.h>
+ #include <stdio.h>
+ #include <stdlib.h>
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-06-09 11:32 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-06-09 11:32 UTC (permalink / raw
To: gentoo-commits
commit: 39f3d7da52725e0e9da9356333a00fccd908217c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jun 9 11:32:31 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jun 9 11:32:31 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=39f3d7da
Linux patch 4.19.285
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1284_linux-4.19.285.patch | 3633 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3637 insertions(+)
diff --git a/0000_README b/0000_README
index e047ddc0..88663e88 100644
--- a/0000_README
+++ b/0000_README
@@ -1179,6 +1179,10 @@ Patch: 1283_linux-4.19.284.patch
From: https://www.kernel.org
Desc: Linux 4.19.284
+Patch: 1284_linux-4.19.285.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.285
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1284_linux-4.19.285.patch b/1284_linux-4.19.285.patch
new file mode 100644
index 00000000..c806fbec
--- /dev/null
+++ b/1284_linux-4.19.285.patch
@@ -0,0 +1,3633 @@
+diff --git a/Makefile b/Makefile
+index 8d8803054d78c..9676c058e6536 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 284
++SUBLEVEL = 285
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+@@ -730,6 +730,10 @@ endif
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
+
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable)
++
++# These result in bogus false positives
++KBUILD_CFLAGS += $(call cc-disable-warning, dangling-pointer)
++
+ ifdef CONFIG_FRAME_POINTER
+ KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls
+ else
+diff --git a/arch/arm/boot/dts/stm32f7-pinctrl.dtsi b/arch/arm/boot/dts/stm32f7-pinctrl.dtsi
+index 9314128df1859..639a6b65749f2 100644
+--- a/arch/arm/boot/dts/stm32f7-pinctrl.dtsi
++++ b/arch/arm/boot/dts/stm32f7-pinctrl.dtsi
+@@ -284,6 +284,88 @@
+ slew-rate = <2>;
+ };
+ };
++
++ can1_pins_a: can1-0 {
++ pins1 {
++ pinmux = <STM32_PINMUX('A', 12, AF9)>; /* CAN1_TX */
++ };
++ pins2 {
++ pinmux = <STM32_PINMUX('A', 11, AF9)>; /* CAN1_RX */
++ bias-pull-up;
++ };
++ };
++
++ can1_pins_b: can1-1 {
++ pins1 {
++ pinmux = <STM32_PINMUX('B', 9, AF9)>; /* CAN1_TX */
++ };
++ pins2 {
++ pinmux = <STM32_PINMUX('B', 8, AF9)>; /* CAN1_RX */
++ bias-pull-up;
++ };
++ };
++
++ can1_pins_c: can1-2 {
++ pins1 {
++ pinmux = <STM32_PINMUX('D', 1, AF9)>; /* CAN1_TX */
++ };
++ pins2 {
++ pinmux = <STM32_PINMUX('D', 0, AF9)>; /* CAN1_RX */
++ bias-pull-up;
++
++ };
++ };
++
++ can1_pins_d: can1-3 {
++ pins1 {
++ pinmux = <STM32_PINMUX('H', 13, AF9)>; /* CAN1_TX */
++ };
++ pins2 {
++ pinmux = <STM32_PINMUX('H', 14, AF9)>; /* CAN1_RX */
++ bias-pull-up;
++
++ };
++ };
++
++ can2_pins_a: can2-0 {
++ pins1 {
++ pinmux = <STM32_PINMUX('B', 6, AF9)>; /* CAN2_TX */
++ };
++ pins2 {
++ pinmux = <STM32_PINMUX('B', 5, AF9)>; /* CAN2_RX */
++ bias-pull-up;
++ };
++ };
++
++ can2_pins_b: can2-1 {
++ pins1 {
++ pinmux = <STM32_PINMUX('B', 13, AF9)>; /* CAN2_TX */
++ };
++ pins2 {
++ pinmux = <STM32_PINMUX('B', 12, AF9)>; /* CAN2_RX */
++ bias-pull-up;
++ };
++ };
++
++ can3_pins_a: can3-0 {
++ pins1 {
++ pinmux = <STM32_PINMUX('A', 15, AF11)>; /* CAN3_TX */
++ };
++ pins2 {
++ pinmux = <STM32_PINMUX('A', 8, AF11)>; /* CAN3_RX */
++ bias-pull-up;
++ };
++ };
++
++ can3_pins_b: can3-1 {
++ pins1 {
++ pinmux = <STM32_PINMUX('B', 4, AF11)>; /* CAN3_TX */
++ };
++ pins2 {
++ pinmux = <STM32_PINMUX('B', 3, AF11)>; /* CAN3_RX */
++ bias-pull-up;
++ };
++ };
+ };
+ };
+ };
+diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
+index 314cfb232a635..f2bb090373c67 100644
+--- a/arch/arm/kernel/unwind.c
++++ b/arch/arm/kernel/unwind.c
+@@ -313,6 +313,29 @@ static int unwind_exec_pop_subset_r0_to_r3(struct unwind_ctrl_block *ctrl,
+ return URC_OK;
+ }
+
++static unsigned long unwind_decode_uleb128(struct unwind_ctrl_block *ctrl)
++{
++ unsigned long bytes = 0;
++ unsigned long insn;
++ unsigned long result = 0;
++
++ /*
++ * unwind_get_byte() will advance `ctrl` one instruction at a time, so
++ * loop until we get an instruction byte where bit 7 is not set.
++ *
++ * Note: This decodes a maximum of 4 bytes to output 28 bits data where
++ * max is 0xfffffff: that will cover a vsp increment of 1073742336, hence
++ * it is sufficient for unwinding the stack.
++ */
++ do {
++ insn = unwind_get_byte(ctrl);
++ result |= (insn & 0x7f) << (bytes * 7);
++ bytes++;
++ } while (!!(insn & 0x80) && (bytes != sizeof(result)));
++
++ return result;
++}
++
+ /*
+ * Execute the current unwind instruction.
+ */
+@@ -366,7 +389,7 @@ static int unwind_exec_insn(struct unwind_ctrl_block *ctrl)
+ if (ret)
+ goto error;
+ } else if (insn == 0xb2) {
+- unsigned long uleb128 = unwind_get_byte(ctrl);
++ unsigned long uleb128 = unwind_decode_uleb128(ctrl);
+
+ ctrl->vrs[SP] += 0x204 + (uleb128 << 2);
+ } else {
+diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
+index 0d2be8eb87ec8..c9faa5570d245 100644
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -376,8 +376,8 @@ static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *re
+ }
+ }
+
+-#define VM_FAULT_BADMAP 0x010000
+-#define VM_FAULT_BADACCESS 0x020000
++#define VM_FAULT_BADMAP ((__force vm_fault_t)0x010000)
++#define VM_FAULT_BADACCESS ((__force vm_fault_t)0x020000)
+
+ static vm_fault_t __do_page_fault(struct mm_struct *mm, unsigned long addr,
+ unsigned int mm_flags, unsigned long vm_flags,
+diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
+index ef5a9cc66fb82..a4c5fb92b1cba 100644
+--- a/arch/x86/boot/boot.h
++++ b/arch/x86/boot/boot.h
+@@ -114,66 +114,78 @@ typedef unsigned int addr_t;
+
+ static inline u8 rdfs8(addr_t addr)
+ {
++ u8 *ptr = (u8 *)absolute_pointer(addr);
+ u8 v;
+- asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr));
++ asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*ptr));
+ return v;
+ }
+ static inline u16 rdfs16(addr_t addr)
+ {
++ u16 *ptr = (u16 *)absolute_pointer(addr);
+ u16 v;
+- asm volatile("movw %%fs:%1,%0" : "=r" (v) : "m" (*(u16 *)addr));
++ asm volatile("movw %%fs:%1,%0" : "=r" (v) : "m" (*ptr));
+ return v;
+ }
+ static inline u32 rdfs32(addr_t addr)
+ {
++ u32 *ptr = (u32 *)absolute_pointer(addr);
+ u32 v;
+- asm volatile("movl %%fs:%1,%0" : "=r" (v) : "m" (*(u32 *)addr));
++ asm volatile("movl %%fs:%1,%0" : "=r" (v) : "m" (*ptr));
+ return v;
+ }
+
+ static inline void wrfs8(u8 v, addr_t addr)
+ {
+- asm volatile("movb %1,%%fs:%0" : "+m" (*(u8 *)addr) : "qi" (v));
++ u8 *ptr = (u8 *)absolute_pointer(addr);
++ asm volatile("movb %1,%%fs:%0" : "+m" (*ptr) : "qi" (v));
+ }
+ static inline void wrfs16(u16 v, addr_t addr)
+ {
+- asm volatile("movw %1,%%fs:%0" : "+m" (*(u16 *)addr) : "ri" (v));
++ u16 *ptr = (u16 *)absolute_pointer(addr);
++ asm volatile("movw %1,%%fs:%0" : "+m" (*ptr) : "ri" (v));
+ }
+ static inline void wrfs32(u32 v, addr_t addr)
+ {
+- asm volatile("movl %1,%%fs:%0" : "+m" (*(u32 *)addr) : "ri" (v));
++ u32 *ptr = (u32 *)absolute_pointer(addr);
++ asm volatile("movl %1,%%fs:%0" : "+m" (*ptr) : "ri" (v));
+ }
+
+ static inline u8 rdgs8(addr_t addr)
+ {
++ u8 *ptr = (u8 *)absolute_pointer(addr);
+ u8 v;
+- asm volatile("movb %%gs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr));
++ asm volatile("movb %%gs:%1,%0" : "=q" (v) : "m" (*ptr));
+ return v;
+ }
+ static inline u16 rdgs16(addr_t addr)
+ {
++ u16 *ptr = (u16 *)absolute_pointer(addr);
+ u16 v;
+- asm volatile("movw %%gs:%1,%0" : "=r" (v) : "m" (*(u16 *)addr));
++ asm volatile("movw %%gs:%1,%0" : "=r" (v) : "m" (*ptr));
+ return v;
+ }
+ static inline u32 rdgs32(addr_t addr)
+ {
++ u32 *ptr = (u32 *)absolute_pointer(addr);
+ u32 v;
+- asm volatile("movl %%gs:%1,%0" : "=r" (v) : "m" (*(u32 *)addr));
++ asm volatile("movl %%gs:%1,%0" : "=r" (v) : "m" (*ptr));
+ return v;
+ }
+
+ static inline void wrgs8(u8 v, addr_t addr)
+ {
+- asm volatile("movb %1,%%gs:%0" : "+m" (*(u8 *)addr) : "qi" (v));
++ u8 *ptr = (u8 *)absolute_pointer(addr);
++ asm volatile("movb %1,%%gs:%0" : "+m" (*ptr) : "qi" (v));
+ }
+ static inline void wrgs16(u16 v, addr_t addr)
+ {
+- asm volatile("movw %1,%%gs:%0" : "+m" (*(u16 *)addr) : "ri" (v));
++ u16 *ptr = (u16 *)absolute_pointer(addr);
++ asm volatile("movw %1,%%gs:%0" : "+m" (*ptr) : "ri" (v));
+ }
+ static inline void wrgs32(u32 v, addr_t addr)
+ {
+- asm volatile("movl %1,%%gs:%0" : "+m" (*(u32 *)addr) : "ri" (v));
++ u32 *ptr = (u32 *)absolute_pointer(addr);
++ asm volatile("movl %1,%%gs:%0" : "+m" (*ptr) : "ri" (v));
+ }
+
+ /* Note: these only return true/false, not a signed return value! */
+diff --git a/arch/x86/boot/main.c b/arch/x86/boot/main.c
+index 9bcea386db65e..98b4ff1c51f35 100644
+--- a/arch/x86/boot/main.c
++++ b/arch/x86/boot/main.c
+@@ -34,7 +34,7 @@ static void copy_boot_params(void)
+ u16 cl_offset;
+ };
+ const struct old_cmdline * const oldcmd =
+- (const struct old_cmdline *)OLD_CL_ADDRESS;
++ absolute_pointer(OLD_CL_ADDRESS);
+
+ BUILD_BUG_ON(sizeof boot_params != 4096);
+ memcpy(&boot_params.hdr, &hdr, sizeof hdr);
+diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
+index 3bdab6eb33bf3..cceb5ca357dee 100644
+--- a/drivers/acpi/thermal.c
++++ b/drivers/acpi/thermal.c
+@@ -1172,8 +1172,6 @@ static int acpi_thermal_resume(struct device *dev)
+ return -EINVAL;
+
+ for (i = 0; i < ACPI_THERMAL_MAX_ACTIVE; i++) {
+- if (!(&tz->trips.active[i]))
+- break;
+ if (!tz->trips.active[i].flags.valid)
+ break;
+ tz->trips.active[i].flags.enabled = 1;
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 0950d6fda89cf..957f6b28bceaa 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -3053,18 +3053,36 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
+ return 0;
+ }
+
+-static struct ata_device *ata_find_dev(struct ata_port *ap, int devno)
++static struct ata_device *ata_find_dev(struct ata_port *ap, unsigned int devno)
+ {
+- if (!sata_pmp_attached(ap)) {
+- if (likely(devno >= 0 &&
+- devno < ata_link_max_devices(&ap->link)))
++ /*
++ * For the non-PMP case, ata_link_max_devices() returns 1 (SATA case),
++ * or 2 (IDE master + slave case). However, the former case includes
++ * libsas hosted devices which are numbered per scsi host, leading
++ * to devno potentially being larger than 0 but with each struct
++ * ata_device having its own struct ata_port and struct ata_link.
++ * To accommodate these, ignore devno and always use device number 0.
++ */
++ if (likely(!sata_pmp_attached(ap))) {
++ int link_max_devices = ata_link_max_devices(&ap->link);
++
++ if (link_max_devices == 1)
++ return &ap->link.device[0];
++
++ if (devno < link_max_devices)
+ return &ap->link.device[devno];
+- } else {
+- if (likely(devno >= 0 &&
+- devno < ap->nr_pmp_links))
+- return &ap->pmp_link[devno].device[0];
++
++ return NULL;
+ }
+
++ /*
++ * For PMP-attached devices, the device number corresponds to C
++ * (channel) of SCSI [H:C:I:L], indicating the port pmp link
++ * for the device.
++ */
++ if (devno < ap->nr_pmp_links)
++ return &ap->pmp_link[devno].device[0];
++
+ return NULL;
+ }
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 330ab9c85d1b8..540c879abe52c 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1825,6 +1825,8 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+ size_t val_count = val_len / val_bytes;
+ size_t chunk_count, chunk_bytes;
+ size_t chunk_regs = val_count;
++ size_t max_data = map->max_raw_write - map->format.reg_bytes -
++ map->format.pad_bytes;
+ int ret, i;
+
+ if (!val_count)
+@@ -1832,8 +1834,8 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+
+ if (map->use_single_write)
+ chunk_regs = 1;
+- else if (map->max_raw_write && val_len > map->max_raw_write)
+- chunk_regs = map->max_raw_write / val_bytes;
++ else if (map->max_raw_write && val_len > max_data)
++ chunk_regs = max_data / val_bytes;
+
+ chunk_count = val_count / chunk_regs;
+ chunk_bytes = chunk_regs * val_bytes;
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index cc66983e8b6ab..28024248a7b53 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1547,7 +1547,7 @@ static int nbd_dev_dbg_init(struct nbd_device *nbd)
+ return -EIO;
+
+ dir = debugfs_create_dir(nbd_name(nbd), nbd_dbg_dir);
+- if (!dir) {
++ if (IS_ERR(dir)) {
+ dev_err(nbd_to_dev(nbd), "Failed to create debugfs dir for '%s'\n",
+ nbd_name(nbd));
+ return -EIO;
+@@ -1573,7 +1573,7 @@ static int nbd_dbg_init(void)
+ struct dentry *dbg_dir;
+
+ dbg_dir = debugfs_create_dir("nbd", NULL);
+- if (!dbg_dir)
++ if (IS_ERR(dbg_dir))
+ return -EIO;
+
+ nbd_dbg_dir = dbg_dir;
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 9cb1c42282051..5afdb9e31c885 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -1042,7 +1042,7 @@ static bool _trigger(struct pl330_thread *thrd)
+ return true;
+ }
+
+-static bool _start(struct pl330_thread *thrd)
++static bool pl330_start_thread(struct pl330_thread *thrd)
+ {
+ switch (_state(thrd)) {
+ case PL330_STATE_FAULT_COMPLETING:
+@@ -1690,7 +1690,7 @@ static int pl330_update(struct pl330_dmac *pl330)
+ thrd->req_running = -1;
+
+ /* Get going again ASAP */
+- _start(thrd);
++ pl330_start_thread(thrd);
+
+ /* For now, just make a list of callbacks to be done */
+ list_add_tail(&descdone->rqd, &pl330->req_done);
+@@ -2076,7 +2076,7 @@ static void pl330_tasklet(unsigned long data)
+ } else {
+ /* Make sure the PL330 Channel thread is active */
+ spin_lock(&pch->thread->dmac->lock);
+- _start(pch->thread);
++ pl330_start_thread(pch->thread);
+ spin_unlock(&pch->thread->dmac->lock);
+ }
+
+@@ -2094,7 +2094,7 @@ static void pl330_tasklet(unsigned long data)
+ if (power_down) {
+ pch->active = true;
+ spin_lock(&pch->thread->dmac->lock);
+- _start(pch->thread);
++ pl330_start_thread(pch->thread);
+ spin_unlock(&pch->thread->dmac->lock);
+ power_down = false;
+ }
+diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c
+index 51a827470157b..b36bcc26bbfe3 100644
+--- a/drivers/hid/hid-google-hammer.c
++++ b/drivers/hid/hid-google-hammer.c
+@@ -124,6 +124,8 @@ static const struct hid_device_id hammer_devices[] = {
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_EEL) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_HAMMER) },
++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_JEWEL) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MAGNEMITE) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 2c9597c8ac92d..c0ba8d6f4978f 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -480,6 +480,7 @@
+ #define USB_DEVICE_ID_GOOGLE_MOONBALL 0x5044
+ #define USB_DEVICE_ID_GOOGLE_DON 0x5050
+ #define USB_DEVICE_ID_GOOGLE_EEL 0x5057
++#define USB_DEVICE_ID_GOOGLE_JEWEL 0x5061
+
+ #define USB_VENDOR_ID_GOTOP 0x08f2
+ #define USB_DEVICE_ID_SUPER_Q2 0x007f
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index c3ebc0cb69b80..8f2de5cb2b6e9 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -781,7 +781,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
+ /* Enter report */
+ if ((data[1] & 0xfc) == 0xc0) {
+ /* serial number of the tool */
+- wacom->serial[idx] = ((data[3] & 0x0f) << 28) +
++ wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) +
+ (data[4] << 20) + (data[5] << 12) +
+ (data[6] << 4) + (data[7] >> 4);
+
+diff --git a/drivers/hwmon/scmi-hwmon.c b/drivers/hwmon/scmi-hwmon.c
+index 91bfecdb3f5ba..84880c0ff7ab8 100644
+--- a/drivers/hwmon/scmi-hwmon.c
++++ b/drivers/hwmon/scmi-hwmon.c
+@@ -56,7 +56,7 @@ scmi_hwmon_is_visible(const void *drvdata, enum hwmon_sensor_types type,
+ const struct scmi_sensors *scmi_sensors = drvdata;
+
+ sensor = *(scmi_sensors->info[type] + channel);
+- if (sensor && sensor->name)
++ if (sensor)
+ return S_IRUGO;
+
+ return 0;
+diff --git a/drivers/iio/adc/mxs-lradc-adc.c b/drivers/iio/adc/mxs-lradc-adc.c
+index fc8b70d8d64c9..10df0b26913a8 100644
+--- a/drivers/iio/adc/mxs-lradc-adc.c
++++ b/drivers/iio/adc/mxs-lradc-adc.c
+@@ -767,13 +767,13 @@ static int mxs_lradc_adc_probe(struct platform_device *pdev)
+
+ ret = mxs_lradc_adc_trigger_init(iio);
+ if (ret)
+- goto err_trig;
++ return ret;
+
+ ret = iio_triggered_buffer_setup(iio, &iio_pollfunc_store_time,
+ &mxs_lradc_adc_trigger_handler,
+ &mxs_lradc_adc_buffer_ops);
+ if (ret)
+- return ret;
++ goto err_trig;
+
+ adc->vref_mv = mxs_lradc_adc_vref_mv[lradc->soc];
+
+@@ -811,9 +811,9 @@ static int mxs_lradc_adc_probe(struct platform_device *pdev)
+
+ err_dev:
+ mxs_lradc_adc_hw_stop(adc);
+- mxs_lradc_adc_trigger_remove(iio);
+-err_trig:
+ iio_triggered_buffer_cleanup(iio);
++err_trig:
++ mxs_lradc_adc_trigger_remove(iio);
+ return ret;
+ }
+
+@@ -824,8 +824,8 @@ static int mxs_lradc_adc_remove(struct platform_device *pdev)
+
+ iio_device_unregister(iio);
+ mxs_lradc_adc_hw_stop(adc);
+- mxs_lradc_adc_trigger_remove(iio);
+ iio_triggered_buffer_cleanup(iio);
++ mxs_lradc_adc_trigger_remove(iio);
+
+ return 0;
+ }
+diff --git a/drivers/iio/dac/Makefile b/drivers/iio/dac/Makefile
+index a1b37cf994416..e859f2d974565 100644
+--- a/drivers/iio/dac/Makefile
++++ b/drivers/iio/dac/Makefile
+@@ -16,7 +16,7 @@ obj-$(CONFIG_AD5592R_BASE) += ad5592r-base.o
+ obj-$(CONFIG_AD5592R) += ad5592r.o
+ obj-$(CONFIG_AD5593R) += ad5593r.o
+ obj-$(CONFIG_AD5755) += ad5755.o
+-obj-$(CONFIG_AD5755) += ad5758.o
++obj-$(CONFIG_AD5758) += ad5758.o
+ obj-$(CONFIG_AD5761) += ad5761.o
+ obj-$(CONFIG_AD5764) += ad5764.o
+ obj-$(CONFIG_AD5791) += ad5791.o
+diff --git a/drivers/iio/dac/mcp4725.c b/drivers/iio/dac/mcp4725.c
+index 30dc2775cbfbd..f6e2e46763859 100644
+--- a/drivers/iio/dac/mcp4725.c
++++ b/drivers/iio/dac/mcp4725.c
+@@ -50,12 +50,18 @@ static int mcp4725_suspend(struct device *dev)
+ struct mcp4725_data *data = iio_priv(i2c_get_clientdata(
+ to_i2c_client(dev)));
+ u8 outbuf[2];
++ int ret;
+
+ outbuf[0] = (data->powerdown_mode + 1) << 4;
+ outbuf[1] = 0;
+ data->powerdown = true;
+
+- return i2c_master_send(data->client, outbuf, 2);
++ ret = i2c_master_send(data->client, outbuf, 2);
++ if (ret < 0)
++ return ret;
++ else if (ret != 2)
++ return -EIO;
++ return 0;
+ }
+
+ static int mcp4725_resume(struct device *dev)
+@@ -63,13 +69,19 @@ static int mcp4725_resume(struct device *dev)
+ struct mcp4725_data *data = iio_priv(i2c_get_clientdata(
+ to_i2c_client(dev)));
+ u8 outbuf[2];
++ int ret;
+
+ /* restore previous DAC value */
+ outbuf[0] = (data->dac_value >> 8) & 0xf;
+ outbuf[1] = data->dac_value & 0xff;
+ data->powerdown = false;
+
+- return i2c_master_send(data->client, outbuf, 2);
++ ret = i2c_master_send(data->client, outbuf, 2);
++ if (ret < 0)
++ return ret;
++ else if (ret != 2)
++ return -EIO;
++ return 0;
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c
+index 129b3656c453a..39236030079e0 100644
+--- a/drivers/mailbox/mailbox-test.c
++++ b/drivers/mailbox/mailbox-test.c
+@@ -16,6 +16,7 @@
+ #include <linux/kernel.h>
+ #include <linux/mailbox_client.h>
+ #include <linux/module.h>
++#include <linux/mutex.h>
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+ #include <linux/poll.h>
+@@ -43,6 +44,7 @@ struct mbox_test_device {
+ char *signal;
+ char *message;
+ spinlock_t lock;
++ struct mutex mutex;
+ wait_queue_head_t waitq;
+ struct fasync_struct *async_queue;
+ };
+@@ -99,6 +101,7 @@ static ssize_t mbox_test_message_write(struct file *filp,
+ size_t count, loff_t *ppos)
+ {
+ struct mbox_test_device *tdev = filp->private_data;
++ char *message;
+ void *data;
+ int ret;
+
+@@ -114,10 +117,13 @@ static ssize_t mbox_test_message_write(struct file *filp,
+ return -EINVAL;
+ }
+
+- tdev->message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL);
+- if (!tdev->message)
++ message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL);
++ if (!message)
+ return -ENOMEM;
+
++ mutex_lock(&tdev->mutex);
++
++ tdev->message = message;
+ ret = copy_from_user(tdev->message, userbuf, count);
+ if (ret) {
+ ret = -EFAULT;
+@@ -148,6 +154,8 @@ out:
+ kfree(tdev->message);
+ tdev->signal = NULL;
+
++ mutex_unlock(&tdev->mutex);
++
+ return ret < 0 ? ret : count;
+ }
+
+@@ -396,6 +404,7 @@ static int mbox_test_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, tdev);
+
+ spin_lock_init(&tdev->lock);
++ mutex_init(&tdev->mutex);
+
+ if (tdev->rx_channel) {
+ tdev->rx_buffer = devm_kzalloc(&pdev->dev,
+diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
+index 36afcea709a75..3647196c2f519 100644
+--- a/drivers/media/dvb-core/dvb_ca_en50221.c
++++ b/drivers/media/dvb-core/dvb_ca_en50221.c
+@@ -162,6 +162,12 @@ struct dvb_ca_private {
+
+ /* mutex serializing ioctls */
+ struct mutex ioctl_mutex;
++
++ /* A mutex used when a device is disconnected */
++ struct mutex remove_mutex;
++
++ /* Whether the device is disconnected */
++ int exit;
+ };
+
+ static void dvb_ca_private_free(struct dvb_ca_private *ca)
+@@ -198,7 +204,7 @@ static void dvb_ca_en50221_thread_wakeup(struct dvb_ca_private *ca);
+ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot,
+ u8 *ebuf, int ecount);
+ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
+- u8 *ebuf, int ecount);
++ u8 *ebuf, int ecount, int size_write_flag);
+
+ /**
+ * Safely find needle in haystack.
+@@ -381,7 +387,7 @@ static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot)
+ ret = dvb_ca_en50221_wait_if_status(ca, slot, STATUSREG_FR, HZ / 10);
+ if (ret)
+ return ret;
+- ret = dvb_ca_en50221_write_data(ca, slot, buf, 2);
++ ret = dvb_ca_en50221_write_data(ca, slot, buf, 2, CMDREG_SW);
+ if (ret != 2)
+ return -EIO;
+ ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN);
+@@ -789,11 +795,13 @@ exit:
+ * @buf: The data in this buffer is treated as a complete link-level packet to
+ * be written.
+ * @bytes_write: Size of ebuf.
++ * @size_write_flag: A flag on Command Register which says whether the link size
++ * information will be writen or not.
+ *
+ * return: Number of bytes written, or < 0 on error.
+ */
+ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
+- u8 *buf, int bytes_write)
++ u8 *buf, int bytes_write, int size_write_flag)
+ {
+ struct dvb_ca_slot *sl = &ca->slot_info[slot];
+ int status;
+@@ -828,7 +836,7 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
+
+ /* OK, set HC bit */
+ status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND,
+- IRQEN | CMDREG_HC);
++ IRQEN | CMDREG_HC | size_write_flag);
+ if (status)
+ goto exit;
+
+@@ -1516,7 +1524,7 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
+
+ mutex_lock(&sl->slot_lock);
+ status = dvb_ca_en50221_write_data(ca, slot, fragbuf,
+- fraglen + 2);
++ fraglen + 2, 0);
+ mutex_unlock(&sl->slot_lock);
+ if (status == (fraglen + 2)) {
+ written = 1;
+@@ -1717,12 +1725,22 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)
+
+ dprintk("%s\n", __func__);
+
+- if (!try_module_get(ca->pub->owner))
++ mutex_lock(&ca->remove_mutex);
++
++ if (ca->exit) {
++ mutex_unlock(&ca->remove_mutex);
++ return -ENODEV;
++ }
++
++ if (!try_module_get(ca->pub->owner)) {
++ mutex_unlock(&ca->remove_mutex);
+ return -EIO;
++ }
+
+ err = dvb_generic_open(inode, file);
+ if (err < 0) {
+ module_put(ca->pub->owner);
++ mutex_unlock(&ca->remove_mutex);
+ return err;
+ }
+
+@@ -1747,6 +1765,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)
+
+ dvb_ca_private_get(ca);
+
++ mutex_unlock(&ca->remove_mutex);
+ return 0;
+ }
+
+@@ -1766,6 +1785,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
+
+ dprintk("%s\n", __func__);
+
++ mutex_lock(&ca->remove_mutex);
++
+ /* mark the CA device as closed */
+ ca->open = 0;
+ dvb_ca_en50221_thread_update_delay(ca);
+@@ -1776,6 +1797,13 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
+
+ dvb_ca_private_put(ca);
+
++ if (dvbdev->users == 1 && ca->exit == 1) {
++ mutex_unlock(&ca->remove_mutex);
++ wake_up(&dvbdev->wait_queue);
++ } else {
++ mutex_unlock(&ca->remove_mutex);
++ }
++
+ return err;
+ }
+
+@@ -1900,6 +1928,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter,
+ }
+
+ mutex_init(&ca->ioctl_mutex);
++ mutex_init(&ca->remove_mutex);
+
+ if (signal_pending(current)) {
+ ret = -EINTR;
+@@ -1942,6 +1971,14 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca)
+
+ dprintk("%s\n", __func__);
+
++ mutex_lock(&ca->remove_mutex);
++ ca->exit = 1;
++ mutex_unlock(&ca->remove_mutex);
++
++ if (ca->dvbdev->users < 1)
++ wait_event(ca->dvbdev->wait_queue,
++ ca->dvbdev->users == 1);
++
+ /* shutdown the thread if there was one */
+ kthread_stop(ca->thread);
+
+diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c
+index 39a2c6ccf31d7..9904a170faeff 100644
+--- a/drivers/media/dvb-core/dvb_demux.c
++++ b/drivers/media/dvb-core/dvb_demux.c
+@@ -125,12 +125,12 @@ static inline int dvb_dmx_swfilter_payload(struct dvb_demux_feed *feed,
+
+ cc = buf[3] & 0x0f;
+ ccok = ((feed->cc + 1) & 0x0f) == cc;
+- feed->cc = cc;
+ if (!ccok) {
+ set_buf_flags(feed, DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED);
+ dprintk_sect_loss("missed packet: %d instead of %d!\n",
+ cc, (feed->cc + 1) & 0x0f);
+ }
++ feed->cc = cc;
+
+ if (buf[1] & 0x40) // PUSI ?
+ feed->peslen = 0xfffa;
+@@ -310,7 +310,6 @@ static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed,
+
+ cc = buf[3] & 0x0f;
+ ccok = ((feed->cc + 1) & 0x0f) == cc;
+- feed->cc = cc;
+
+ if (buf[3] & 0x20) {
+ /* adaption field present, check for discontinuity_indicator */
+@@ -346,6 +345,7 @@ static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed,
+ feed->pusi_seen = false;
+ dvb_dmx_swfilter_section_new(feed);
+ }
++ feed->cc = cc;
+
+ if (buf[1] & 0x40) {
+ /* PUSI=1 (is set), section boundary is here */
+diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
+index e0650bc2df613..90acf52cc253c 100644
+--- a/drivers/media/dvb-core/dvb_frontend.c
++++ b/drivers/media/dvb-core/dvb_frontend.c
+@@ -304,14 +304,22 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe,
+ }
+
+ if (events->eventw == events->eventr) {
+- int ret;
++ struct wait_queue_entry wait;
++ int ret = 0;
+
+ if (flags & O_NONBLOCK)
+ return -EWOULDBLOCK;
+
+- ret = wait_event_interruptible(events->wait_queue,
+- dvb_frontend_test_event(fepriv, events));
+-
++ init_waitqueue_entry(&wait, current);
++ add_wait_queue(&events->wait_queue, &wait);
++ while (!dvb_frontend_test_event(fepriv, events)) {
++ wait_woken(&wait, TASK_INTERRUPTIBLE, 0);
++ if (signal_pending(current)) {
++ ret = -ERESTARTSYS;
++ break;
++ }
++ }
++ remove_wait_queue(&events->wait_queue, &wait);
+ if (ret < 0)
+ return ret;
+ }
+diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
+index 3f154755bbc63..6c44526bb7efa 100644
+--- a/drivers/media/dvb-core/dvb_net.c
++++ b/drivers/media/dvb-core/dvb_net.c
+@@ -1575,15 +1575,43 @@ static long dvb_net_ioctl(struct file *file,
+ return dvb_usercopy(file, cmd, arg, dvb_net_do_ioctl);
+ }
+
++static int locked_dvb_net_open(struct inode *inode, struct file *file)
++{
++ struct dvb_device *dvbdev = file->private_data;
++ struct dvb_net *dvbnet = dvbdev->priv;
++ int ret;
++
++ if (mutex_lock_interruptible(&dvbnet->remove_mutex))
++ return -ERESTARTSYS;
++
++ if (dvbnet->exit) {
++ mutex_unlock(&dvbnet->remove_mutex);
++ return -ENODEV;
++ }
++
++ ret = dvb_generic_open(inode, file);
++
++ mutex_unlock(&dvbnet->remove_mutex);
++
++ return ret;
++}
++
+ static int dvb_net_close(struct inode *inode, struct file *file)
+ {
+ struct dvb_device *dvbdev = file->private_data;
+ struct dvb_net *dvbnet = dvbdev->priv;
+
++ mutex_lock(&dvbnet->remove_mutex);
++
+ dvb_generic_release(inode, file);
+
+- if(dvbdev->users == 1 && dvbnet->exit == 1)
++ if (dvbdev->users == 1 && dvbnet->exit == 1) {
++ mutex_unlock(&dvbnet->remove_mutex);
+ wake_up(&dvbdev->wait_queue);
++ } else {
++ mutex_unlock(&dvbnet->remove_mutex);
++ }
++
+ return 0;
+ }
+
+@@ -1591,7 +1619,7 @@ static int dvb_net_close(struct inode *inode, struct file *file)
+ static const struct file_operations dvb_net_fops = {
+ .owner = THIS_MODULE,
+ .unlocked_ioctl = dvb_net_ioctl,
+- .open = dvb_generic_open,
++ .open = locked_dvb_net_open,
+ .release = dvb_net_close,
+ .llseek = noop_llseek,
+ };
+@@ -1610,10 +1638,13 @@ void dvb_net_release (struct dvb_net *dvbnet)
+ {
+ int i;
+
++ mutex_lock(&dvbnet->remove_mutex);
+ dvbnet->exit = 1;
++ mutex_unlock(&dvbnet->remove_mutex);
++
+ if (dvbnet->dvbdev->users < 1)
+ wait_event(dvbnet->dvbdev->wait_queue,
+- dvbnet->dvbdev->users==1);
++ dvbnet->dvbdev->users == 1);
+
+ dvb_unregister_device(dvbnet->dvbdev);
+
+@@ -1632,6 +1663,7 @@ int dvb_net_init (struct dvb_adapter *adap, struct dvb_net *dvbnet,
+ int i;
+
+ mutex_init(&dvbnet->ioctl_mutex);
++ mutex_init(&dvbnet->remove_mutex);
+ dvbnet->demux = dmx;
+
+ for (i=0; i<DVB_NET_DEVICES_MAX; i++)
+diff --git a/drivers/media/dvb-frontends/mn88443x.c b/drivers/media/dvb-frontends/mn88443x.c
+index 53981ff9422e0..2b6732d40b917 100644
+--- a/drivers/media/dvb-frontends/mn88443x.c
++++ b/drivers/media/dvb-frontends/mn88443x.c
+@@ -800,7 +800,7 @@ MODULE_DEVICE_TABLE(i2c, mn88443x_i2c_id);
+ static struct i2c_driver mn88443x_driver = {
+ .driver = {
+ .name = "mn88443x",
+- .of_match_table = of_match_ptr(mn88443x_of_match),
++ .of_match_table = mn88443x_of_match,
+ },
+ .probe = mn88443x_probe,
+ .remove = mn88443x_remove,
+diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+index 0ead74c40a7b7..28381698f2e16 100644
+--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
++++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+@@ -896,12 +896,7 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev,
+ ndev->lmmio0, (u32)pci_resource_len(pci_dev, 0),
+ ndev->lmmio1, (u32)pci_resource_len(pci_dev, 1),
+ pci_dev->irq);
+- if (request_irq(pci_dev->irq, netup_unidvb_isr, IRQF_SHARED,
+- "netup_unidvb", pci_dev) < 0) {
+- dev_err(&pci_dev->dev,
+- "%s(): can't get IRQ %d\n", __func__, pci_dev->irq);
+- goto irq_request_err;
+- }
++
+ ndev->dma_size = 2 * 188 *
+ NETUP_DMA_BLOCKS_COUNT * NETUP_DMA_PACKETS_COUNT;
+ ndev->dma_virt = dma_alloc_coherent(&pci_dev->dev,
+@@ -942,6 +937,14 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev,
+ dev_err(&pci_dev->dev, "netup_unidvb: DMA setup failed\n");
+ goto dma_setup_err;
+ }
++
++ if (request_irq(pci_dev->irq, netup_unidvb_isr, IRQF_SHARED,
++ "netup_unidvb", pci_dev) < 0) {
++ dev_err(&pci_dev->dev,
++ "%s(): can't get IRQ %d\n", __func__, pci_dev->irq);
++ goto dma_setup_err;
++ }
++
+ dev_info(&pci_dev->dev,
+ "netup_unidvb: device has been initialized\n");
+ return 0;
+@@ -960,8 +963,6 @@ spi_setup_err:
+ dma_free_coherent(&pci_dev->dev, ndev->dma_size,
+ ndev->dma_virt, ndev->dma_phys);
+ dma_alloc_err:
+- free_irq(pci_dev->irq, pci_dev);
+-irq_request_err:
+ iounmap(ndev->lmmio1);
+ pci_bar1_error:
+ iounmap(ndev->lmmio0);
+diff --git a/drivers/media/platform/rcar-vin/rcar-dma.c b/drivers/media/platform/rcar-vin/rcar-dma.c
+index 70a8cc433a03f..cc28e2cb23f11 100644
+--- a/drivers/media/platform/rcar-vin/rcar-dma.c
++++ b/drivers/media/platform/rcar-vin/rcar-dma.c
+@@ -633,6 +633,7 @@ static int rvin_setup(struct rvin_dev *vin)
+ vnmc = VNMC_IM_FULL | VNMC_FOC;
+ break;
+ case V4L2_FIELD_NONE:
++ case V4L2_FIELD_ALTERNATE:
+ vnmc = VNMC_IM_ODD_EVEN;
+ progressive = true;
+ break;
+diff --git a/drivers/media/usb/dvb-usb-v2/ce6230.c b/drivers/media/usb/dvb-usb-v2/ce6230.c
+index e596031a708d0..80a07aab3b4b0 100644
+--- a/drivers/media/usb/dvb-usb-v2/ce6230.c
++++ b/drivers/media/usb/dvb-usb-v2/ce6230.c
+@@ -111,6 +111,10 @@ static int ce6230_i2c_master_xfer(struct i2c_adapter *adap,
+ if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
+ if (msg[i].addr ==
+ ce6230_zl10353_config.demod_address) {
++ if (msg[i].len < 1) {
++ i = -EOPNOTSUPP;
++ break;
++ }
+ req.cmd = DEMOD_READ;
+ req.value = msg[i].addr >> 1;
+ req.index = msg[i].buf[0];
+@@ -127,6 +131,10 @@ static int ce6230_i2c_master_xfer(struct i2c_adapter *adap,
+ } else {
+ if (msg[i].addr ==
+ ce6230_zl10353_config.demod_address) {
++ if (msg[i].len < 1) {
++ i = -EOPNOTSUPP;
++ break;
++ }
+ req.cmd = DEMOD_WRITE;
+ req.value = msg[i].addr >> 1;
+ req.index = msg[i].buf[0];
+diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c
+index 1db8aeef36553..19605958501e1 100644
+--- a/drivers/media/usb/dvb-usb-v2/ec168.c
++++ b/drivers/media/usb/dvb-usb-v2/ec168.c
+@@ -125,6 +125,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ while (i < num) {
+ if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
+ if (msg[i].addr == ec168_ec100_config.demod_address) {
++ if (msg[i].len < 1) {
++ i = -EOPNOTSUPP;
++ break;
++ }
+ req.cmd = READ_DEMOD;
+ req.value = 0;
+ req.index = 0xff00 + msg[i].buf[0]; /* reg */
+@@ -141,6 +145,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ }
+ } else {
+ if (msg[i].addr == ec168_ec100_config.demod_address) {
++ if (msg[i].len < 1) {
++ i = -EOPNOTSUPP;
++ break;
++ }
+ req.cmd = WRITE_DEMOD;
+ req.value = msg[i].buf[1]; /* val */
+ req.index = 0xff00 + msg[i].buf[0]; /* reg */
+@@ -149,6 +157,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ ret = ec168_ctrl_msg(d, &req);
+ i += 1;
+ } else {
++ if (msg[i].len < 1) {
++ i = -EOPNOTSUPP;
++ break;
++ }
+ req.cmd = WRITE_I2C;
+ req.value = msg[i].buf[0]; /* val */
+ req.index = 0x0100 + msg[i].addr; /* I2C addr */
+diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+index 857ef9edbc123..195b1977b6a68 100644
+--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
++++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+@@ -189,6 +189,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ ret = -EOPNOTSUPP;
+ goto err_mutex_unlock;
+ } else if (msg[0].addr == 0x10) {
++ if (msg[0].len < 1 || msg[1].len < 1) {
++ ret = -EOPNOTSUPP;
++ goto err_mutex_unlock;
++ }
+ /* method 1 - integrated demod */
+ if (msg[0].buf[0] == 0x00) {
+ /* return demod page from driver cache */
+@@ -202,6 +206,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ ret = rtl28xxu_ctrl_msg(d, &req);
+ }
+ } else if (msg[0].len < 2) {
++ if (msg[0].len < 1) {
++ ret = -EOPNOTSUPP;
++ goto err_mutex_unlock;
++ }
+ /* method 2 - old I2C */
+ req.value = (msg[0].buf[0] << 8) | (msg[0].addr << 1);
+ req.index = CMD_I2C_RD;
+@@ -230,8 +238,16 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ ret = -EOPNOTSUPP;
+ goto err_mutex_unlock;
+ } else if (msg[0].addr == 0x10) {
++ if (msg[0].len < 1) {
++ ret = -EOPNOTSUPP;
++ goto err_mutex_unlock;
++ }
+ /* method 1 - integrated demod */
+ if (msg[0].buf[0] == 0x00) {
++ if (msg[0].len < 2) {
++ ret = -EOPNOTSUPP;
++ goto err_mutex_unlock;
++ }
+ /* save demod page for later demod access */
+ dev->page = msg[0].buf[1];
+ ret = 0;
+@@ -244,6 +260,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ ret = rtl28xxu_ctrl_msg(d, &req);
+ }
+ } else if ((msg[0].len < 23) && (!dev->new_i2c_write)) {
++ if (msg[0].len < 1) {
++ ret = -EOPNOTSUPP;
++ goto err_mutex_unlock;
++ }
+ /* method 2 - old I2C */
+ req.value = (msg[0].buf[0] << 8) | (msg[0].addr << 1);
+ req.index = CMD_I2C_WR;
+diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c
+index 7d71ac7811ebd..fdd57d84cfa42 100644
+--- a/drivers/media/usb/dvb-usb/az6027.c
++++ b/drivers/media/usb/dvb-usb/az6027.c
+@@ -991,6 +991,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
+ /* write/read request */
+ if (i + 1 < num && (msg[i + 1].flags & I2C_M_RD)) {
+ req = 0xB9;
++ if (msg[i].len < 1) {
++ i = -EOPNOTSUPP;
++ break;
++ }
+ index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff));
+ value = msg[i].addr + (msg[i].len << 8);
+ length = msg[i + 1].len + 6;
+@@ -1004,6 +1008,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
+
+ /* demod 16bit addr */
+ req = 0xBD;
++ if (msg[i].len < 1) {
++ i = -EOPNOTSUPP;
++ break;
++ }
+ index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff));
+ value = msg[i].addr + (2 << 8);
+ length = msg[i].len - 2;
+@@ -1029,6 +1037,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
+ } else {
+
+ req = 0xBD;
++ if (msg[i].len < 1) {
++ i = -EOPNOTSUPP;
++ break;
++ }
+ index = msg[i].buf[0] & 0x00FF;
+ value = msg[i].addr + (1 << 8);
+ length = msg[i].len - 1;
+diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c
+index e66df4fd1a296..6e556a2a74103 100644
+--- a/drivers/media/usb/dvb-usb/digitv.c
++++ b/drivers/media/usb/dvb-usb/digitv.c
+@@ -66,6 +66,10 @@ static int digitv_i2c_xfer(struct i2c_adapter *adap,struct i2c_msg msg[],int num
+ warn("more than 2 i2c messages at a time is not handled yet. TODO.");
+
+ for (i = 0; i < num; i++) {
++ if (msg[i].len < 1) {
++ i = -EOPNOTSUPP;
++ break;
++ }
+ /* write/read request */
+ if (i+1 < num && (msg[i+1].flags & I2C_M_RD)) {
+ if (digitv_ctrl_msg(d, USB_READ_COFDM, msg[i].buf[0], NULL, 0,
+diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
+index ebb0c982a6f21..cd0566c0b3de7 100644
+--- a/drivers/media/usb/dvb-usb/dw2102.c
++++ b/drivers/media/usb/dvb-usb/dw2102.c
+@@ -949,7 +949,7 @@ static int su3000_read_mac_address(struct dvb_usb_device *d, u8 mac[6])
+ for (i = 0; i < 6; i++) {
+ obuf[1] = 0xf0 + i;
+ if (i2c_transfer(&d->i2c_adap, msg, 2) != 2)
+- break;
++ return -1;
+ else
+ mac[i] = ibuf[0];
+ }
+diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
+index f34efa7c61b40..c915e555897ba 100644
+--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
++++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
+@@ -1561,8 +1561,7 @@ static void ttusb_dec_exit_dvb(struct ttusb_dec *dec)
+ dvb_dmx_release(&dec->demux);
+ if (dec->fe) {
+ dvb_unregister_frontend(dec->fe);
+- if (dec->fe->ops.release)
+- dec->fe->ops.release(dec->fe);
++ dvb_frontend_detach(dec->fe);
+ }
+ dvb_unregister_adapter(&dec->adapter);
+ }
+diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
+index e74ab79c99cd9..5a985a0d9d85f 100644
+--- a/drivers/mmc/host/vub300.c
++++ b/drivers/mmc/host/vub300.c
+@@ -1718,6 +1718,9 @@ static void construct_request_response(struct vub300_mmc_host *vub300,
+ int bytes = 3 & less_cmd;
+ int words = less_cmd >> 2;
+ u8 *r = vub300->resp.response.command_response;
++
++ if (!resp_len)
++ return;
+ if (bytes == 3) {
+ cmd->resp[words] = (r[1 + (words << 2)] << 24)
+ | (r[2 + (words << 2)] << 16)
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index b593e4d85e9c0..792073a768ac0 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -4840,7 +4840,7 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev)
+ goto out;
+ }
+ if (chip->reset)
+- usleep_range(1000, 2000);
++ usleep_range(10000, 20000);
+
+ err = mv88e6xxx_detect(chip);
+ if (err)
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 7840eb4cdb8da..d291976d8b761 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1312,7 +1312,7 @@ static enum xgbe_mode xgbe_phy_status_aneg(struct xgbe_prv_data *pdata)
+ return pdata->phy_if.phy_impl.an_outcome(pdata);
+ }
+
+-static void xgbe_phy_status_result(struct xgbe_prv_data *pdata)
++static bool xgbe_phy_status_result(struct xgbe_prv_data *pdata)
+ {
+ struct ethtool_link_ksettings *lks = &pdata->phy.lks;
+ enum xgbe_mode mode;
+@@ -1347,8 +1347,13 @@ static void xgbe_phy_status_result(struct xgbe_prv_data *pdata)
+
+ pdata->phy.duplex = DUPLEX_FULL;
+
+- if (xgbe_set_mode(pdata, mode) && pdata->an_again)
++ if (!xgbe_set_mode(pdata, mode))
++ return false;
++
++ if (pdata->an_again)
+ xgbe_phy_reconfig_aneg(pdata);
++
++ return true;
+ }
+
+ static void xgbe_phy_status(struct xgbe_prv_data *pdata)
+@@ -1378,7 +1383,8 @@ static void xgbe_phy_status(struct xgbe_prv_data *pdata)
+ return;
+ }
+
+- xgbe_phy_status_result(pdata);
++ if (xgbe_phy_status_result(pdata))
++ return;
+
+ if (test_bit(XGBE_LINK_INIT, &pdata->dev_state))
+ clear_bit(XGBE_LINK_INIT, &pdata->dev_state);
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
+index 46ee2c01f4c51..d16b1eddbecf2 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
+@@ -296,7 +296,6 @@ static inline void bnx2x_dcb_config_qm(struct bnx2x *bp, enum cos_mode mode,
+ * possible, the driver should only write the valid vnics into the internal
+ * ram according to the appropriate port mode.
+ */
+-#define BITS_TO_BYTES(x) ((x)/8)
+
+ /* CMNG constants, as derived from system spec calculations */
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+index 5a2feadd80f08..97e6b06b1bff3 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+@@ -466,7 +466,7 @@ static void poll_trace(struct mlx5_fw_tracer *tracer,
+ (u64)timestamp_low;
+ break;
+ default:
+- if (tracer_event->event_id >= tracer->str_db.first_string_trace ||
++ if (tracer_event->event_id >= tracer->str_db.first_string_trace &&
+ tracer_event->event_id <= tracer->str_db.first_string_trace +
+ tracer->str_db.num_string_trace) {
+ tracer_event->type = TRACER_EVENT_TYPE_STRING;
+diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
+index a3a5edb8bc666..909f6d1605f7a 100644
+--- a/drivers/net/ethernet/sun/cassini.c
++++ b/drivers/net/ethernet/sun/cassini.c
+@@ -1337,7 +1337,7 @@ static void cas_init_rx_dma(struct cas *cp)
+ writel(val, cp->regs + REG_RX_PAGE_SIZE);
+
+ /* enable the header parser if desired */
+- if (CAS_HP_FIRMWARE == cas_prog_null)
++ if (&CAS_HP_FIRMWARE[0] == &cas_prog_null[0])
+ return;
+
+ val = CAS_BASE(HP_CFG_NUM_CPU, CAS_NCPUS > 63 ? 0 : CAS_NCPUS);
+@@ -3807,7 +3807,7 @@ static void cas_reset(struct cas *cp, int blkflag)
+
+ /* program header parser */
+ if ((cp->cas_flags & CAS_FLAG_TARGET_ABORT) ||
+- (CAS_HP_ALT_FIRMWARE == cas_prog_null)) {
++ (&CAS_HP_ALT_FIRMWARE[0] == &cas_prog_null[0])) {
+ cas_load_firmware(cp, CAS_HP_FIRMWARE);
+ } else {
+ cas_load_firmware(cp, CAS_HP_ALT_FIRMWARE);
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index 0e1306ded31ea..65dac36d8d4ff 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -175,10 +175,17 @@ static u32 cdc_ncm_check_tx_max(struct usbnet *dev, u32 new_tx)
+ u32 val, max, min;
+
+ /* clamp new_tx to sane values */
+- min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth16);
+- max = min_t(u32, CDC_NCM_NTB_MAX_SIZE_TX, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize));
+- if (max == 0)
++ if (ctx->is_ndp16)
++ min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth16);
++ else
++ min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth32);
++
++ if (le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) == 0)
+ max = CDC_NCM_NTB_MAX_SIZE_TX; /* dwNtbOutMaxSize not set */
++ else
++ max = clamp_t(u32, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize),
++ USB_CDC_NCM_NTB_MIN_OUT_SIZE,
++ CDC_NCM_NTB_MAX_SIZE_TX);
+
+ /* some devices set dwNtbOutMaxSize too low for the above default */
+ min = min(min, max);
+@@ -309,10 +316,17 @@ static ssize_t ndp_to_end_store(struct device *d, struct device_attribute *attr
+ if (enable == (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
+ return len;
+
+- if (enable && !ctx->delayed_ndp16) {
+- ctx->delayed_ndp16 = kzalloc(ctx->max_ndp_size, GFP_KERNEL);
+- if (!ctx->delayed_ndp16)
+- return -ENOMEM;
++ if (enable) {
++ if (ctx->is_ndp16 && !ctx->delayed_ndp16) {
++ ctx->delayed_ndp16 = kzalloc(ctx->max_ndp_size, GFP_KERNEL);
++ if (!ctx->delayed_ndp16)
++ return -ENOMEM;
++ }
++ if (!ctx->is_ndp16 && !ctx->delayed_ndp32) {
++ ctx->delayed_ndp32 = kzalloc(ctx->max_ndp_size, GFP_KERNEL);
++ if (!ctx->delayed_ndp32)
++ return -ENOMEM;
++ }
+ }
+
+ /* flush pending data before changing flag */
+@@ -514,6 +528,9 @@ static int cdc_ncm_init(struct usbnet *dev)
+ dev_err(&dev->intf->dev, "SET_CRC_MODE failed\n");
+ }
+
++ /* use ndp16 by default */
++ ctx->is_ndp16 = 1;
++
+ /* set NTB format, if both formats are supported.
+ *
+ * "The host shall only send this command while the NCM Data
+@@ -521,14 +538,27 @@ static int cdc_ncm_init(struct usbnet *dev)
+ */
+ if (le16_to_cpu(ctx->ncm_parm.bmNtbFormatsSupported) &
+ USB_CDC_NCM_NTB32_SUPPORTED) {
+- dev_dbg(&dev->intf->dev, "Setting NTB format to 16-bit\n");
+- err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT,
+- USB_TYPE_CLASS | USB_DIR_OUT
+- | USB_RECIP_INTERFACE,
+- USB_CDC_NCM_NTB16_FORMAT,
+- iface_no, NULL, 0);
+- if (err < 0)
++ if (ctx->drvflags & CDC_NCM_FLAG_PREFER_NTB32) {
++ ctx->is_ndp16 = 0;
++ dev_dbg(&dev->intf->dev, "Setting NTB format to 32-bit\n");
++ err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT,
++ USB_TYPE_CLASS | USB_DIR_OUT
++ | USB_RECIP_INTERFACE,
++ USB_CDC_NCM_NTB32_FORMAT,
++ iface_no, NULL, 0);
++ } else {
++ ctx->is_ndp16 = 1;
++ dev_dbg(&dev->intf->dev, "Setting NTB format to 16-bit\n");
++ err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT,
++ USB_TYPE_CLASS | USB_DIR_OUT
++ | USB_RECIP_INTERFACE,
++ USB_CDC_NCM_NTB16_FORMAT,
++ iface_no, NULL, 0);
++ }
++ if (err < 0) {
++ ctx->is_ndp16 = 1;
+ dev_err(&dev->intf->dev, "SET_NTB_FORMAT failed\n");
++ }
+ }
+
+ /* set initial device values */
+@@ -551,7 +581,10 @@ static int cdc_ncm_init(struct usbnet *dev)
+ ctx->tx_max_datagrams = CDC_NCM_DPT_DATAGRAMS_MAX;
+
+ /* set up maximum NDP size */
+- ctx->max_ndp_size = sizeof(struct usb_cdc_ncm_ndp16) + (ctx->tx_max_datagrams + 1) * sizeof(struct usb_cdc_ncm_dpe16);
++ if (ctx->is_ndp16)
++ ctx->max_ndp_size = sizeof(struct usb_cdc_ncm_ndp16) + (ctx->tx_max_datagrams + 1) * sizeof(struct usb_cdc_ncm_dpe16);
++ else
++ ctx->max_ndp_size = sizeof(struct usb_cdc_ncm_ndp32) + (ctx->tx_max_datagrams + 1) * sizeof(struct usb_cdc_ncm_dpe32);
+
+ /* initial coalescing timer interval */
+ ctx->timer_interval = CDC_NCM_TIMER_INTERVAL_USEC * NSEC_PER_USEC;
+@@ -736,7 +769,10 @@ static void cdc_ncm_free(struct cdc_ncm_ctx *ctx)
+ ctx->tx_curr_skb = NULL;
+ }
+
+- kfree(ctx->delayed_ndp16);
++ if (ctx->is_ndp16)
++ kfree(ctx->delayed_ndp16);
++ else
++ kfree(ctx->delayed_ndp32);
+
+ kfree(ctx);
+ }
+@@ -774,10 +810,8 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
+ u8 *buf;
+ int len;
+ int temp;
+- int err;
+ u8 iface_no;
+ struct usb_cdc_parsed_header hdr;
+- __le16 curr_ntb_format;
+
+ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+ if (!ctx)
+@@ -882,32 +916,6 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
+ goto error2;
+ }
+
+- /*
+- * Some Huawei devices have been observed to come out of reset in NDP32 mode.
+- * Let's check if this is the case, and set the device to NDP16 mode again if
+- * needed.
+- */
+- if (ctx->drvflags & CDC_NCM_FLAG_RESET_NTB16) {
+- err = usbnet_read_cmd(dev, USB_CDC_GET_NTB_FORMAT,
+- USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
+- 0, iface_no, &curr_ntb_format, 2);
+- if (err < 0) {
+- goto error2;
+- }
+-
+- if (curr_ntb_format == cpu_to_le16(USB_CDC_NCM_NTB32_FORMAT)) {
+- dev_info(&intf->dev, "resetting NTB format to 16-bit");
+- err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT,
+- USB_TYPE_CLASS | USB_DIR_OUT
+- | USB_RECIP_INTERFACE,
+- USB_CDC_NCM_NTB16_FORMAT,
+- iface_no, NULL, 0);
+-
+- if (err < 0)
+- goto error2;
+- }
+- }
+-
+ cdc_ncm_find_endpoints(dev, ctx->data);
+ cdc_ncm_find_endpoints(dev, ctx->control);
+ if (!dev->in || !dev->out || !dev->status) {
+@@ -932,9 +940,15 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
+
+ /* Allocate the delayed NDP if needed. */
+ if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
+- ctx->delayed_ndp16 = kzalloc(ctx->max_ndp_size, GFP_KERNEL);
+- if (!ctx->delayed_ndp16)
+- goto error2;
++ if (ctx->is_ndp16) {
++ ctx->delayed_ndp16 = kzalloc(ctx->max_ndp_size, GFP_KERNEL);
++ if (!ctx->delayed_ndp16)
++ goto error2;
++ } else {
++ ctx->delayed_ndp32 = kzalloc(ctx->max_ndp_size, GFP_KERNEL);
++ if (!ctx->delayed_ndp32)
++ goto error2;
++ }
+ dev_info(&intf->dev, "NDP will be placed at end of frame for this device.");
+ }
+
+@@ -1058,7 +1072,7 @@ static void cdc_ncm_align_tail(struct sk_buff *skb, size_t modulus, size_t remai
+ /* return a pointer to a valid struct usb_cdc_ncm_ndp16 of type sign, possibly
+ * allocating a new one within skb
+ */
+-static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp(struct cdc_ncm_ctx *ctx, struct sk_buff *skb, __le32 sign, size_t reserve)
++static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp16(struct cdc_ncm_ctx *ctx, struct sk_buff *skb, __le32 sign, size_t reserve)
+ {
+ struct usb_cdc_ncm_ndp16 *ndp16 = NULL;
+ struct usb_cdc_ncm_nth16 *nth16 = (void *)skb->data;
+@@ -1113,12 +1127,73 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp(struct cdc_ncm_ctx *ctx, struct sk_
+ return ndp16;
+ }
+
++static struct usb_cdc_ncm_ndp32 *cdc_ncm_ndp32(struct cdc_ncm_ctx *ctx, struct sk_buff *skb, __le32 sign, size_t reserve)
++{
++ struct usb_cdc_ncm_ndp32 *ndp32 = NULL;
++ struct usb_cdc_ncm_nth32 *nth32 = (void *)skb->data;
++ size_t ndpoffset = le32_to_cpu(nth32->dwNdpIndex);
++
++ /* If NDP should be moved to the end of the NCM package, we can't follow the
++ * NTH32 header as we would normally do. NDP isn't written to the SKB yet, and
++ * the wNdpIndex field in the header is actually not consistent with reality. It will be later.
++ */
++ if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
++ if (ctx->delayed_ndp32->dwSignature == sign)
++ return ctx->delayed_ndp32;
++
++ /* We can only push a single NDP to the end. Return
++ * NULL to send what we've already got and queue this
++ * skb for later.
++ */
++ else if (ctx->delayed_ndp32->dwSignature)
++ return NULL;
++ }
++
++ /* follow the chain of NDPs, looking for a match */
++ while (ndpoffset) {
++ ndp32 = (struct usb_cdc_ncm_ndp32 *)(skb->data + ndpoffset);
++ if (ndp32->dwSignature == sign)
++ return ndp32;
++ ndpoffset = le32_to_cpu(ndp32->dwNextNdpIndex);
++ }
++
++ /* align new NDP */
++ if (!(ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
++ cdc_ncm_align_tail(skb, ctx->tx_ndp_modulus, 0, ctx->tx_curr_size);
++
++ /* verify that there is room for the NDP and the datagram (reserve) */
++ if ((ctx->tx_curr_size - skb->len - reserve) < ctx->max_ndp_size)
++ return NULL;
++
++ /* link to it */
++ if (ndp32)
++ ndp32->dwNextNdpIndex = cpu_to_le32(skb->len);
++ else
++ nth32->dwNdpIndex = cpu_to_le32(skb->len);
++
++ /* push a new empty NDP */
++ if (!(ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
++ ndp32 = skb_put_zero(skb, ctx->max_ndp_size);
++ else
++ ndp32 = ctx->delayed_ndp32;
++
++ ndp32->dwSignature = sign;
++ ndp32->wLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_ndp32) + sizeof(struct usb_cdc_ncm_dpe32));
++ return ndp32;
++}
++
+ struct sk_buff *
+ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ {
+ struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
+- struct usb_cdc_ncm_nth16 *nth16;
+- struct usb_cdc_ncm_ndp16 *ndp16;
++ union {
++ struct usb_cdc_ncm_nth16 *nth16;
++ struct usb_cdc_ncm_nth32 *nth32;
++ } nth;
++ union {
++ struct usb_cdc_ncm_ndp16 *ndp16;
++ struct usb_cdc_ncm_ndp32 *ndp32;
++ } ndp;
+ struct sk_buff *skb_out;
+ u16 n = 0, index, ndplen;
+ u8 ready2send = 0;
+@@ -1158,6 +1233,9 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ * further.
+ */
+ if (skb_out == NULL) {
++ /* If even the smallest allocation fails, abort. */
++ if (ctx->tx_curr_size == USB_CDC_NCM_NTB_MIN_OUT_SIZE)
++ goto alloc_failed;
+ ctx->tx_low_mem_max_cnt = min(ctx->tx_low_mem_max_cnt + 1,
+ (unsigned)CDC_NCM_LOW_MEM_MAX_CNT);
+ ctx->tx_low_mem_val = ctx->tx_low_mem_max_cnt;
+@@ -1176,20 +1254,23 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ skb_out = alloc_skb(ctx->tx_curr_size, GFP_ATOMIC);
+
+ /* No allocation possible so we will abort */
+- if (skb_out == NULL) {
+- if (skb != NULL) {
+- dev_kfree_skb_any(skb);
+- dev->net->stats.tx_dropped++;
+- }
+- goto exit_no_skb;
+- }
++ if (!skb_out)
++ goto alloc_failed;
+ ctx->tx_low_mem_val--;
+ }
+- /* fill out the initial 16-bit NTB header */
+- nth16 = skb_put_zero(skb_out, sizeof(struct usb_cdc_ncm_nth16));
+- nth16->dwSignature = cpu_to_le32(USB_CDC_NCM_NTH16_SIGN);
+- nth16->wHeaderLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_nth16));
+- nth16->wSequence = cpu_to_le16(ctx->tx_seq++);
++ if (ctx->is_ndp16) {
++ /* fill out the initial 16-bit NTB header */
++ nth.nth16 = skb_put_zero(skb_out, sizeof(struct usb_cdc_ncm_nth16));
++ nth.nth16->dwSignature = cpu_to_le32(USB_CDC_NCM_NTH16_SIGN);
++ nth.nth16->wHeaderLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_nth16));
++ nth.nth16->wSequence = cpu_to_le16(ctx->tx_seq++);
++ } else {
++ /* fill out the initial 32-bit NTB header */
++ nth.nth32 = skb_put_zero(skb_out, sizeof(struct usb_cdc_ncm_nth32));
++ nth.nth32->dwSignature = cpu_to_le32(USB_CDC_NCM_NTH32_SIGN);
++ nth.nth32->wHeaderLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_nth32));
++ nth.nth32->wSequence = cpu_to_le16(ctx->tx_seq++);
++ }
+
+ /* count total number of frames in this NTB */
+ ctx->tx_curr_frame_num = 0;
+@@ -1211,13 +1292,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ }
+
+ /* get the appropriate NDP for this skb */
+- ndp16 = cdc_ncm_ndp(ctx, skb_out, sign, skb->len + ctx->tx_modulus + ctx->tx_remainder);
++ if (ctx->is_ndp16)
++ ndp.ndp16 = cdc_ncm_ndp16(ctx, skb_out, sign, skb->len + ctx->tx_modulus + ctx->tx_remainder);
++ else
++ ndp.ndp32 = cdc_ncm_ndp32(ctx, skb_out, sign, skb->len + ctx->tx_modulus + ctx->tx_remainder);
+
+ /* align beginning of next frame */
+ cdc_ncm_align_tail(skb_out, ctx->tx_modulus, ctx->tx_remainder, ctx->tx_curr_size);
+
+ /* check if we had enough room left for both NDP and frame */
+- if (!ndp16 || skb_out->len + skb->len + delayed_ndp_size > ctx->tx_curr_size) {
++ if ((ctx->is_ndp16 && !ndp.ndp16) || (!ctx->is_ndp16 && !ndp.ndp32) ||
++ skb_out->len + skb->len + delayed_ndp_size > ctx->tx_curr_size) {
+ if (n == 0) {
+ /* won't fit, MTU problem? */
+ dev_kfree_skb_any(skb);
+@@ -1239,13 +1324,22 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ }
+
+ /* calculate frame number withing this NDP */
+- ndplen = le16_to_cpu(ndp16->wLength);
+- index = (ndplen - sizeof(struct usb_cdc_ncm_ndp16)) / sizeof(struct usb_cdc_ncm_dpe16) - 1;
++ if (ctx->is_ndp16) {
++ ndplen = le16_to_cpu(ndp.ndp16->wLength);
++ index = (ndplen - sizeof(struct usb_cdc_ncm_ndp16)) / sizeof(struct usb_cdc_ncm_dpe16) - 1;
++
++ /* OK, add this skb */
++ ndp.ndp16->dpe16[index].wDatagramLength = cpu_to_le16(skb->len);
++ ndp.ndp16->dpe16[index].wDatagramIndex = cpu_to_le16(skb_out->len);
++ ndp.ndp16->wLength = cpu_to_le16(ndplen + sizeof(struct usb_cdc_ncm_dpe16));
++ } else {
++ ndplen = le16_to_cpu(ndp.ndp32->wLength);
++ index = (ndplen - sizeof(struct usb_cdc_ncm_ndp32)) / sizeof(struct usb_cdc_ncm_dpe32) - 1;
+
+- /* OK, add this skb */
+- ndp16->dpe16[index].wDatagramLength = cpu_to_le16(skb->len);
+- ndp16->dpe16[index].wDatagramIndex = cpu_to_le16(skb_out->len);
+- ndp16->wLength = cpu_to_le16(ndplen + sizeof(struct usb_cdc_ncm_dpe16));
++ ndp.ndp32->dpe32[index].dwDatagramLength = cpu_to_le32(skb->len);
++ ndp.ndp32->dpe32[index].dwDatagramIndex = cpu_to_le32(skb_out->len);
++ ndp.ndp32->wLength = cpu_to_le16(ndplen + sizeof(struct usb_cdc_ncm_dpe32));
++ }
+ skb_put_data(skb_out, skb->data, skb->len);
+ ctx->tx_curr_frame_payload += skb->len; /* count real tx payload data */
+ dev_kfree_skb_any(skb);
+@@ -1292,13 +1386,22 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+
+ /* If requested, put NDP at end of frame. */
+ if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
+- nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;
+- cdc_ncm_align_tail(skb_out, ctx->tx_ndp_modulus, 0, ctx->tx_curr_size - ctx->max_ndp_size);
+- nth16->wNdpIndex = cpu_to_le16(skb_out->len);
+- skb_put_data(skb_out, ctx->delayed_ndp16, ctx->max_ndp_size);
++ if (ctx->is_ndp16) {
++ nth.nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;
++ cdc_ncm_align_tail(skb_out, ctx->tx_ndp_modulus, 0, ctx->tx_curr_size - ctx->max_ndp_size);
++ nth.nth16->wNdpIndex = cpu_to_le16(skb_out->len);
++ skb_put_data(skb_out, ctx->delayed_ndp16, ctx->max_ndp_size);
++
++ /* Zero out delayed NDP - signature checking will naturally fail. */
++ ndp.ndp16 = memset(ctx->delayed_ndp16, 0, ctx->max_ndp_size);
++ } else {
++ nth.nth32 = (struct usb_cdc_ncm_nth32 *)skb_out->data;
++ cdc_ncm_align_tail(skb_out, ctx->tx_ndp_modulus, 0, ctx->tx_curr_size - ctx->max_ndp_size);
++ nth.nth32->dwNdpIndex = cpu_to_le32(skb_out->len);
++ skb_put_data(skb_out, ctx->delayed_ndp32, ctx->max_ndp_size);
+
+- /* Zero out delayed NDP - signature checking will naturally fail. */
+- ndp16 = memset(ctx->delayed_ndp16, 0, ctx->max_ndp_size);
++ ndp.ndp32 = memset(ctx->delayed_ndp32, 0, ctx->max_ndp_size);
++ }
+ }
+
+ /* If collected data size is less or equal ctx->min_tx_pkt
+@@ -1321,8 +1424,13 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ }
+
+ /* set final frame length */
+- nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;
+- nth16->wBlockLength = cpu_to_le16(skb_out->len);
++ if (ctx->is_ndp16) {
++ nth.nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;
++ nth.nth16->wBlockLength = cpu_to_le16(skb_out->len);
++ } else {
++ nth.nth32 = (struct usb_cdc_ncm_nth32 *)skb_out->data;
++ nth.nth32->dwBlockLength = cpu_to_le32(skb_out->len);
++ }
+
+ /* return skb */
+ ctx->tx_curr_skb = NULL;
+@@ -1340,6 +1448,11 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+
+ return skb_out;
+
++alloc_failed:
++ if (skb) {
++ dev_kfree_skb_any(skb);
++ dev->net->stats.tx_dropped++;
++ }
+ exit_no_skb:
+ /* Start timer, if there is a remaining non-empty skb */
+ if (ctx->tx_curr_skb != NULL && n > 0)
+@@ -1405,7 +1518,12 @@ cdc_ncm_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
+ goto error;
+
+ spin_lock_bh(&ctx->mtx);
+- skb_out = cdc_ncm_fill_tx_frame(dev, skb, cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN));
++
++ if (ctx->is_ndp16)
++ skb_out = cdc_ncm_fill_tx_frame(dev, skb, cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN));
++ else
++ skb_out = cdc_ncm_fill_tx_frame(dev, skb, cpu_to_le32(USB_CDC_NCM_NDP32_NOCRC_SIGN));
++
+ spin_unlock_bh(&ctx->mtx);
+ return skb_out;
+
+@@ -1466,6 +1584,54 @@ error:
+ }
+ EXPORT_SYMBOL_GPL(cdc_ncm_rx_verify_nth16);
+
++int cdc_ncm_rx_verify_nth32(struct cdc_ncm_ctx *ctx, struct sk_buff *skb_in)
++{
++ struct usbnet *dev = netdev_priv(skb_in->dev);
++ struct usb_cdc_ncm_nth32 *nth32;
++ int len;
++ int ret = -EINVAL;
++
++ if (ctx == NULL)
++ goto error;
++
++ if (skb_in->len < (sizeof(struct usb_cdc_ncm_nth32) +
++ sizeof(struct usb_cdc_ncm_ndp32))) {
++ netif_dbg(dev, rx_err, dev->net, "frame too short\n");
++ goto error;
++ }
++
++ nth32 = (struct usb_cdc_ncm_nth32 *)skb_in->data;
++
++ if (nth32->dwSignature != cpu_to_le32(USB_CDC_NCM_NTH32_SIGN)) {
++ netif_dbg(dev, rx_err, dev->net,
++ "invalid NTH32 signature <%#010x>\n",
++ le32_to_cpu(nth32->dwSignature));
++ goto error;
++ }
++
++ len = le32_to_cpu(nth32->dwBlockLength);
++ if (len > ctx->rx_max) {
++ netif_dbg(dev, rx_err, dev->net,
++ "unsupported NTB block length %u/%u\n", len,
++ ctx->rx_max);
++ goto error;
++ }
++
++ if ((ctx->rx_seq + 1) != le16_to_cpu(nth32->wSequence) &&
++ (ctx->rx_seq || le16_to_cpu(nth32->wSequence)) &&
++ !((ctx->rx_seq == 0xffff) && !le16_to_cpu(nth32->wSequence))) {
++ netif_dbg(dev, rx_err, dev->net,
++ "sequence number glitch prev=%d curr=%d\n",
++ ctx->rx_seq, le16_to_cpu(nth32->wSequence));
++ }
++ ctx->rx_seq = le16_to_cpu(nth32->wSequence);
++
++ ret = le32_to_cpu(nth32->dwNdpIndex);
++error:
++ return ret;
++}
++EXPORT_SYMBOL_GPL(cdc_ncm_rx_verify_nth32);
++
+ /* verify NDP header and return number of datagrams, or negative error */
+ int cdc_ncm_rx_verify_ndp16(struct sk_buff *skb_in, int ndpoffset)
+ {
+@@ -1502,6 +1668,42 @@ error:
+ }
+ EXPORT_SYMBOL_GPL(cdc_ncm_rx_verify_ndp16);
+
++/* verify NDP header and return number of datagrams, or negative error */
++int cdc_ncm_rx_verify_ndp32(struct sk_buff *skb_in, int ndpoffset)
++{
++ struct usbnet *dev = netdev_priv(skb_in->dev);
++ struct usb_cdc_ncm_ndp32 *ndp32;
++ int ret = -EINVAL;
++
++ if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp32)) > skb_in->len) {
++ netif_dbg(dev, rx_err, dev->net, "invalid NDP offset <%u>\n",
++ ndpoffset);
++ goto error;
++ }
++ ndp32 = (struct usb_cdc_ncm_ndp32 *)(skb_in->data + ndpoffset);
++
++ if (le16_to_cpu(ndp32->wLength) < USB_CDC_NCM_NDP32_LENGTH_MIN) {
++ netif_dbg(dev, rx_err, dev->net, "invalid DPT32 length <%u>\n",
++ le16_to_cpu(ndp32->wLength));
++ goto error;
++ }
++
++ ret = ((le16_to_cpu(ndp32->wLength) -
++ sizeof(struct usb_cdc_ncm_ndp32)) /
++ sizeof(struct usb_cdc_ncm_dpe32));
++ ret--; /* we process NDP entries except for the last one */
++
++ if ((sizeof(struct usb_cdc_ncm_ndp32) +
++ ret * (sizeof(struct usb_cdc_ncm_dpe32))) > skb_in->len) {
++ netif_dbg(dev, rx_err, dev->net, "Invalid nframes = %d\n", ret);
++ ret = -EINVAL;
++ }
++
++error:
++ return ret;
++}
++EXPORT_SYMBOL_GPL(cdc_ncm_rx_verify_ndp32);
++
+ int cdc_ncm_rx_fixup(struct usbnet *dev, struct sk_buff *skb_in)
+ {
+ struct sk_buff *skb;
+@@ -1510,34 +1712,66 @@ int cdc_ncm_rx_fixup(struct usbnet *dev, struct sk_buff *skb_in)
+ int nframes;
+ int x;
+ int offset;
+- struct usb_cdc_ncm_ndp16 *ndp16;
+- struct usb_cdc_ncm_dpe16 *dpe16;
++ union {
++ struct usb_cdc_ncm_ndp16 *ndp16;
++ struct usb_cdc_ncm_ndp32 *ndp32;
++ } ndp;
++ union {
++ struct usb_cdc_ncm_dpe16 *dpe16;
++ struct usb_cdc_ncm_dpe32 *dpe32;
++ } dpe;
++
+ int ndpoffset;
+ int loopcount = 50; /* arbitrary max preventing infinite loop */
+ u32 payload = 0;
+
+- ndpoffset = cdc_ncm_rx_verify_nth16(ctx, skb_in);
++ if (ctx->is_ndp16)
++ ndpoffset = cdc_ncm_rx_verify_nth16(ctx, skb_in);
++ else
++ ndpoffset = cdc_ncm_rx_verify_nth32(ctx, skb_in);
++
+ if (ndpoffset < 0)
+ goto error;
+
+ next_ndp:
+- nframes = cdc_ncm_rx_verify_ndp16(skb_in, ndpoffset);
+- if (nframes < 0)
+- goto error;
++ if (ctx->is_ndp16) {
++ nframes = cdc_ncm_rx_verify_ndp16(skb_in, ndpoffset);
++ if (nframes < 0)
++ goto error;
+
+- ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb_in->data + ndpoffset);
++ ndp.ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb_in->data + ndpoffset);
+
+- if (ndp16->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN)) {
+- netif_dbg(dev, rx_err, dev->net,
+- "invalid DPT16 signature <%#010x>\n",
+- le32_to_cpu(ndp16->dwSignature));
+- goto err_ndp;
++ if (ndp.ndp16->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN)) {
++ netif_dbg(dev, rx_err, dev->net,
++ "invalid DPT16 signature <%#010x>\n",
++ le32_to_cpu(ndp.ndp16->dwSignature));
++ goto err_ndp;
++ }
++ dpe.dpe16 = ndp.ndp16->dpe16;
++ } else {
++ nframes = cdc_ncm_rx_verify_ndp32(skb_in, ndpoffset);
++ if (nframes < 0)
++ goto error;
++
++ ndp.ndp32 = (struct usb_cdc_ncm_ndp32 *)(skb_in->data + ndpoffset);
++
++ if (ndp.ndp32->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP32_NOCRC_SIGN)) {
++ netif_dbg(dev, rx_err, dev->net,
++ "invalid DPT32 signature <%#010x>\n",
++ le32_to_cpu(ndp.ndp32->dwSignature));
++ goto err_ndp;
++ }
++ dpe.dpe32 = ndp.ndp32->dpe32;
+ }
+- dpe16 = ndp16->dpe16;
+
+- for (x = 0; x < nframes; x++, dpe16++) {
+- offset = le16_to_cpu(dpe16->wDatagramIndex);
+- len = le16_to_cpu(dpe16->wDatagramLength);
++ for (x = 0; x < nframes; x++) {
++ if (ctx->is_ndp16) {
++ offset = le16_to_cpu(dpe.dpe16->wDatagramIndex);
++ len = le16_to_cpu(dpe.dpe16->wDatagramLength);
++ } else {
++ offset = le32_to_cpu(dpe.dpe32->dwDatagramIndex);
++ len = le32_to_cpu(dpe.dpe32->dwDatagramLength);
++ }
+
+ /*
+ * CDC NCM ch. 3.7
+@@ -1568,10 +1802,19 @@ next_ndp:
+ usbnet_skb_return(dev, skb);
+ payload += len; /* count payload bytes in this NTB */
+ }
++
++ if (ctx->is_ndp16)
++ dpe.dpe16++;
++ else
++ dpe.dpe32++;
+ }
+ err_ndp:
+ /* are there more NDPs to process? */
+- ndpoffset = le16_to_cpu(ndp16->wNextNdpIndex);
++ if (ctx->is_ndp16)
++ ndpoffset = le16_to_cpu(ndp.ndp16->wNextNdpIndex);
++ else
++ ndpoffset = le32_to_cpu(ndp.ndp32->dwNextNdpIndex);
++
+ if (ndpoffset && loopcount--)
+ goto next_ndp;
+
+diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
+index 63f28908afda7..ac86fb0efb259 100644
+--- a/drivers/net/usb/huawei_cdc_ncm.c
++++ b/drivers/net/usb/huawei_cdc_ncm.c
+@@ -81,11 +81,11 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev,
+ */
+ drvflags |= CDC_NCM_FLAG_NDP_TO_END;
+
+- /* Additionally, it has been reported that some Huawei E3372H devices, with
+- * firmware version 21.318.01.00.541, come out of reset in NTB32 format mode, hence
+- * needing to be set to the NTB16 one again.
++ /* For many Huawei devices the NTB32 mode is the default and the best mode
++ * they work with. Huawei E5785 and E5885 devices refuse to work in NTB16 mode at all.
+ */
+- drvflags |= CDC_NCM_FLAG_RESET_NTB16;
++ drvflags |= CDC_NCM_FLAG_PREFER_NTB32;
++
+ ret = cdc_ncm_bind_common(usbnet_dev, intf, 1, drvflags);
+ if (ret)
+ goto err;
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 5417932242e77..4da9c3e1c3eb3 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1285,7 +1285,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x2001, 0x7e3d, 4)}, /* D-Link DWM-222 A2 */
+ {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */
+ {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */
+- {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */
++ {QMI_QUIRK_SET_DTR(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */
+ {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */
+ {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */
+ {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */
+diff --git a/drivers/net/wireless/broadcom/b43/b43.h b/drivers/net/wireless/broadcom/b43/b43.h
+index b77d1a904f7e6..a449561fccf28 100644
+--- a/drivers/net/wireless/broadcom/b43/b43.h
++++ b/drivers/net/wireless/broadcom/b43/b43.h
+@@ -651,7 +651,7 @@ struct b43_iv {
+ union {
+ __be16 d16;
+ __be32 d32;
+- } data __packed;
++ } __packed data;
+ } __packed;
+
+
+diff --git a/drivers/net/wireless/broadcom/b43legacy/b43legacy.h b/drivers/net/wireless/broadcom/b43legacy/b43legacy.h
+index 6b0cec467938f..f49365d14619f 100644
+--- a/drivers/net/wireless/broadcom/b43legacy/b43legacy.h
++++ b/drivers/net/wireless/broadcom/b43legacy/b43legacy.h
+@@ -379,7 +379,7 @@ struct b43legacy_iv {
+ union {
+ __be16 d16;
+ __be32 d32;
+- } data __packed;
++ } __packed data;
+ } __packed;
+
+ #define B43legacy_PHYMODE(phytype) (1 << (phytype))
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+index 921a226b18f85..08ccb49c9a2e3 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+@@ -1272,6 +1272,7 @@ struct rtl8xxxu_priv {
+ u32 rege9c;
+ u32 regeb4;
+ u32 regebc;
++ u32 regrcr;
+ int next_mbox;
+ int nr_out_eps;
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 9c811fe303584..780dab2768297 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -4051,6 +4051,7 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
+ RCR_ACCEPT_MGMT_FRAME | RCR_HTC_LOC_CTRL |
+ RCR_APPEND_PHYSTAT | RCR_APPEND_ICV | RCR_APPEND_MIC;
+ rtl8xxxu_write32(priv, REG_RCR, val32);
++ priv->regrcr = val32;
+
+ /*
+ * Accept all multicast
+@@ -5591,7 +5592,7 @@ static void rtl8xxxu_configure_filter(struct ieee80211_hw *hw,
+ unsigned int *total_flags, u64 multicast)
+ {
+ struct rtl8xxxu_priv *priv = hw->priv;
+- u32 rcr = rtl8xxxu_read32(priv, REG_RCR);
++ u32 rcr = priv->regrcr;
+
+ dev_dbg(&priv->udev->dev, "%s: changed_flags %08x, total_flags %08x\n",
+ __func__, changed_flags, *total_flags);
+@@ -5637,6 +5638,7 @@ static void rtl8xxxu_configure_filter(struct ieee80211_hw *hw,
+ */
+
+ rtl8xxxu_write32(priv, REG_RCR, rcr);
++ priv->regrcr = rcr;
+
+ *total_flags &= (FIF_ALLMULTI | FIF_FCSFAIL | FIF_BCN_PRBRESP_PROMISC |
+ FIF_CONTROL | FIF_OTHER_BSS | FIF_PSPOLL |
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+index de98d88199d6e..53734250479c5 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+@@ -2414,14 +2414,10 @@ void rtl92d_phy_reload_iqk_setting(struct ieee80211_hw *hw, u8 channel)
+ RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD,
+ "Just Read IQK Matrix reg for channel:%d....\n",
+ channel);
+- if ((rtlphy->iqk_matrix[indexforchannel].
+- value[0] != NULL)
+- /*&&(regea4 != 0) */)
++ if (rtlphy->iqk_matrix[indexforchannel].value[0][0] != 0)
+ _rtl92d_phy_patha_fill_iqk_matrix(hw, true,
+- rtlphy->iqk_matrix[
+- indexforchannel].value, 0,
+- (rtlphy->iqk_matrix[
+- indexforchannel].value[0][2] == 0));
++ rtlphy->iqk_matrix[indexforchannel].value, 0,
++ rtlphy->iqk_matrix[indexforchannel].value[0][2] == 0);
+ if (IS_92D_SINGLEPHY(rtlhal->version)) {
+ if ((rtlphy->iqk_matrix[
+ indexforchannel].value[0][4] != 0)
+diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+index 69cd2c2c30ef9..4445a53e9f0b8 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -924,7 +924,7 @@ static int rsi_hal_key_config(struct ieee80211_hw *hw,
+ if (status)
+ return status;
+
+- if (vif->type == NL80211_IFTYPE_STATION && key->key &&
++ if (vif->type == NL80211_IFTYPE_STATION &&
+ (key->cipher == WLAN_CIPHER_SUITE_WEP104 ||
+ key->cipher == WLAN_CIPHER_SUITE_WEP40)) {
+ if (!rsi_send_block_unblock_frame(adapter->priv, false))
+diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
+index c830343be61e5..1a3624141c411 100644
+--- a/drivers/power/supply/bq24190_charger.c
++++ b/drivers/power/supply/bq24190_charger.c
+@@ -1228,8 +1228,19 @@ static void bq24190_input_current_limit_work(struct work_struct *work)
+ struct bq24190_dev_info *bdi =
+ container_of(work, struct bq24190_dev_info,
+ input_current_limit_work.work);
++ union power_supply_propval val;
++ int ret;
+
+- power_supply_set_input_current_limit_from_supplier(bdi->charger);
++ ret = power_supply_get_property_from_supplier(bdi->charger,
++ POWER_SUPPLY_PROP_CURRENT_MAX,
++ &val);
++ if (ret)
++ return;
++
++ bq24190_charger_set_property(bdi->charger,
++ POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT,
++ &val);
++ power_supply_changed(bdi->charger);
+ }
+
+ /* Sync the input-current-limit with our parent supply (if we have one) */
+diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
+index b44776bb1da82..725851ca0e757 100644
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -1864,8 +1864,8 @@ static void bq27xxx_external_power_changed(struct power_supply *psy)
+ {
+ struct bq27xxx_device_info *di = power_supply_get_drvdata(psy);
+
+- cancel_delayed_work_sync(&di->work);
+- schedule_delayed_work(&di->work, 0);
++ /* After charger plug in/out wait 0.5s for things to stabilize */
++ mod_delayed_work(system_wq, &di->work, HZ / 2);
+ }
+
+ int bq27xxx_battery_setup(struct bq27xxx_device_info *di)
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index 9b98921a3b16a..6a2d157c24759 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -378,46 +378,49 @@ int power_supply_is_system_supplied(void)
+ }
+ EXPORT_SYMBOL_GPL(power_supply_is_system_supplied);
+
+-static int __power_supply_get_supplier_max_current(struct device *dev,
+- void *data)
++struct psy_get_supplier_prop_data {
++ struct power_supply *psy;
++ enum power_supply_property psp;
++ union power_supply_propval *val;
++};
++
++static int __power_supply_get_supplier_property(struct device *dev, void *_data)
+ {
+- union power_supply_propval ret = {0,};
+ struct power_supply *epsy = dev_get_drvdata(dev);
+- struct power_supply *psy = data;
++ struct psy_get_supplier_prop_data *data = _data;
+
+- if (__power_supply_is_supplied_by(epsy, psy))
+- if (!epsy->desc->get_property(epsy,
+- POWER_SUPPLY_PROP_CURRENT_MAX,
+- &ret))
+- return ret.intval;
++ if (__power_supply_is_supplied_by(epsy, data->psy))
++ if (!epsy->desc->get_property(epsy, data->psp, data->val))
++ return 1; /* Success */
+
+- return 0;
++ return 0; /* Continue iterating */
+ }
+
+-int power_supply_set_input_current_limit_from_supplier(struct power_supply *psy)
++int power_supply_get_property_from_supplier(struct power_supply *psy,
++ enum power_supply_property psp,
++ union power_supply_propval *val)
+ {
+- union power_supply_propval val = {0,};
+- int curr;
+-
+- if (!psy->desc->set_property)
+- return -EINVAL;
++ struct psy_get_supplier_prop_data data = {
++ .psy = psy,
++ .psp = psp,
++ .val = val,
++ };
++ int ret;
+
+ /*
+ * This function is not intended for use with a supply with multiple
+- * suppliers, we simply pick the first supply to report a non 0
+- * max-current.
++ * suppliers, we simply pick the first supply to report the psp.
+ */
+- curr = class_for_each_device(power_supply_class, NULL, psy,
+- __power_supply_get_supplier_max_current);
+- if (curr <= 0)
+- return (curr == 0) ? -ENODEV : curr;
+-
+- val.intval = curr;
++ ret = class_for_each_device(power_supply_class, NULL, &data,
++ __power_supply_get_supplier_property);
++ if (ret < 0)
++ return ret;
++ if (ret == 0)
++ return -ENODEV;
+
+- return psy->desc->set_property(psy,
+- POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
++ return 0;
+ }
+-EXPORT_SYMBOL_GPL(power_supply_set_input_current_limit_from_supplier);
++EXPORT_SYMBOL_GPL(power_supply_get_property_from_supplier);
+
+ int power_supply_set_battery_charged(struct power_supply *psy)
+ {
+diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c
+index bd91c95f73e0e..99713d0e9f0cf 100644
+--- a/drivers/regulator/da9052-regulator.c
++++ b/drivers/regulator/da9052-regulator.c
+@@ -421,7 +421,7 @@ static int da9052_regulator_probe(struct platform_device *pdev)
+ config.dev = &pdev->dev;
+ config.driver_data = regulator;
+ config.regmap = da9052->regmap;
+- if (pdata && pdata->regulators) {
++ if (pdata) {
+ config.init_data = pdata->regulators[cell->id];
+ } else {
+ #ifdef CONFIG_OF
+diff --git a/drivers/regulator/da9055-regulator.c b/drivers/regulator/da9055-regulator.c
+index f40c3b8644ae5..588c3d2445cf3 100644
+--- a/drivers/regulator/da9055-regulator.c
++++ b/drivers/regulator/da9055-regulator.c
+@@ -612,7 +612,7 @@ static int da9055_regulator_probe(struct platform_device *pdev)
+ config.driver_data = regulator;
+ config.regmap = da9055->regmap;
+
+- if (pdata && pdata->regulators) {
++ if (pdata) {
+ config.init_data = pdata->regulators[pdev->id];
+ } else {
+ ret = da9055_regulator_dt_init(pdev, regulator, &config,
+diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
+index 7cb6e2b9e180a..6047f0284f73a 100644
+--- a/drivers/scsi/Kconfig
++++ b/drivers/scsi/Kconfig
+@@ -473,7 +473,7 @@ config SCSI_MVUMI
+
+ config SCSI_DPT_I2O
+ tristate "Adaptec I2O RAID support "
+- depends on SCSI && PCI && VIRT_TO_BUS
++ depends on SCSI && PCI
+ help
+ This driver supports all of Adaptec's I2O based RAID controllers as
+ well as the DPT SmartRaid V cards. This is an Adaptec maintained
+diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
+index 37de8fb186d7b..3f8d1c17e9381 100644
+--- a/drivers/scsi/dpt_i2o.c
++++ b/drivers/scsi/dpt_i2o.c
+@@ -59,7 +59,7 @@ MODULE_DESCRIPTION("Adaptec I2O RAID Driver");
+
+ #include <asm/processor.h> /* for boot_cpu_data */
+ #include <asm/pgtable.h>
+-#include <asm/io.h> /* for virt_to_bus, etc. */
++#include <asm/io.h>
+
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_cmnd.h>
+@@ -628,51 +628,6 @@ static struct scsi_cmnd *
+ return NULL;
+ }
+
+-/*
+- * Turn a pointer to ioctl reply data into an u32 'context'
+- */
+-static u32 adpt_ioctl_to_context(adpt_hba * pHba, void *reply)
+-{
+-#if BITS_PER_LONG == 32
+- return (u32)(unsigned long)reply;
+-#else
+- ulong flags = 0;
+- u32 nr, i;
+-
+- spin_lock_irqsave(pHba->host->host_lock, flags);
+- nr = ARRAY_SIZE(pHba->ioctl_reply_context);
+- for (i = 0; i < nr; i++) {
+- if (pHba->ioctl_reply_context[i] == NULL) {
+- pHba->ioctl_reply_context[i] = reply;
+- break;
+- }
+- }
+- spin_unlock_irqrestore(pHba->host->host_lock, flags);
+- if (i >= nr) {
+- printk(KERN_WARNING"%s: Too many outstanding "
+- "ioctl commands\n", pHba->name);
+- return (u32)-1;
+- }
+-
+- return i;
+-#endif
+-}
+-
+-/*
+- * Go from an u32 'context' to a pointer to ioctl reply data.
+- */
+-static void *adpt_ioctl_from_context(adpt_hba *pHba, u32 context)
+-{
+-#if BITS_PER_LONG == 32
+- return (void *)(unsigned long)context;
+-#else
+- void *p = pHba->ioctl_reply_context[context];
+- pHba->ioctl_reply_context[context] = NULL;
+-
+- return p;
+-#endif
+-}
+-
+ /*===========================================================================
+ * Error Handling routines
+ *===========================================================================
+@@ -1697,208 +1652,6 @@ static int adpt_close(struct inode *inode, struct file *file)
+ return 0;
+ }
+
+-
+-static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
+-{
+- u32 msg[MAX_MESSAGE_SIZE];
+- u32* reply = NULL;
+- u32 size = 0;
+- u32 reply_size = 0;
+- u32 __user *user_msg = arg;
+- u32 __user * user_reply = NULL;
+- void **sg_list = NULL;
+- u32 sg_offset = 0;
+- u32 sg_count = 0;
+- int sg_index = 0;
+- u32 i = 0;
+- u32 rcode = 0;
+- void *p = NULL;
+- dma_addr_t addr;
+- ulong flags = 0;
+-
+- memset(&msg, 0, MAX_MESSAGE_SIZE*4);
+- // get user msg size in u32s
+- if(get_user(size, &user_msg[0])){
+- return -EFAULT;
+- }
+- size = size>>16;
+-
+- user_reply = &user_msg[size];
+- if(size > MAX_MESSAGE_SIZE){
+- return -EFAULT;
+- }
+- size *= 4; // Convert to bytes
+-
+- /* Copy in the user's I2O command */
+- if(copy_from_user(msg, user_msg, size)) {
+- return -EFAULT;
+- }
+- get_user(reply_size, &user_reply[0]);
+- reply_size = reply_size>>16;
+- if(reply_size > REPLY_FRAME_SIZE){
+- reply_size = REPLY_FRAME_SIZE;
+- }
+- reply_size *= 4;
+- reply = kzalloc(REPLY_FRAME_SIZE*4, GFP_KERNEL);
+- if(reply == NULL) {
+- printk(KERN_WARNING"%s: Could not allocate reply buffer\n",pHba->name);
+- return -ENOMEM;
+- }
+- sg_offset = (msg[0]>>4)&0xf;
+- msg[2] = 0x40000000; // IOCTL context
+- msg[3] = adpt_ioctl_to_context(pHba, reply);
+- if (msg[3] == (u32)-1) {
+- rcode = -EBUSY;
+- goto free;
+- }
+-
+- sg_list = kcalloc(pHba->sg_tablesize, sizeof(*sg_list), GFP_KERNEL);
+- if (!sg_list) {
+- rcode = -ENOMEM;
+- goto free;
+- }
+- if(sg_offset) {
+- // TODO add 64 bit API
+- struct sg_simple_element *sg = (struct sg_simple_element*) (msg+sg_offset);
+- sg_count = (size - sg_offset*4) / sizeof(struct sg_simple_element);
+- if (sg_count > pHba->sg_tablesize){
+- printk(KERN_DEBUG"%s:IOCTL SG List too large (%u)\n", pHba->name,sg_count);
+- rcode = -EINVAL;
+- goto free;
+- }
+-
+- for(i = 0; i < sg_count; i++) {
+- int sg_size;
+-
+- if (!(sg[i].flag_count & 0x10000000 /*I2O_SGL_FLAGS_SIMPLE_ADDRESS_ELEMENT*/)) {
+- printk(KERN_DEBUG"%s:Bad SG element %d - not simple (%x)\n",pHba->name,i, sg[i].flag_count);
+- rcode = -EINVAL;
+- goto cleanup;
+- }
+- sg_size = sg[i].flag_count & 0xffffff;
+- /* Allocate memory for the transfer */
+- p = dma_alloc_coherent(&pHba->pDev->dev, sg_size, &addr, GFP_KERNEL);
+- if(!p) {
+- printk(KERN_DEBUG"%s: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
+- pHba->name,sg_size,i,sg_count);
+- rcode = -ENOMEM;
+- goto cleanup;
+- }
+- sg_list[sg_index++] = p; // sglist indexed with input frame, not our internal frame.
+- /* Copy in the user's SG buffer if necessary */
+- if(sg[i].flag_count & 0x04000000 /*I2O_SGL_FLAGS_DIR*/) {
+- // sg_simple_element API is 32 bit
+- if (copy_from_user(p,(void __user *)(ulong)sg[i].addr_bus, sg_size)) {
+- printk(KERN_DEBUG"%s: Could not copy SG buf %d FROM user\n",pHba->name,i);
+- rcode = -EFAULT;
+- goto cleanup;
+- }
+- }
+- /* sg_simple_element API is 32 bit, but addr < 4GB */
+- sg[i].addr_bus = addr;
+- }
+- }
+-
+- do {
+- /*
+- * Stop any new commands from enterring the
+- * controller while processing the ioctl
+- */
+- if (pHba->host) {
+- scsi_block_requests(pHba->host);
+- spin_lock_irqsave(pHba->host->host_lock, flags);
+- }
+- rcode = adpt_i2o_post_wait(pHba, msg, size, FOREVER);
+- if (rcode != 0)
+- printk("adpt_i2o_passthru: post wait failed %d %p\n",
+- rcode, reply);
+- if (pHba->host) {
+- spin_unlock_irqrestore(pHba->host->host_lock, flags);
+- scsi_unblock_requests(pHba->host);
+- }
+- } while (rcode == -ETIMEDOUT);
+-
+- if(rcode){
+- goto cleanup;
+- }
+-
+- if(sg_offset) {
+- /* Copy back the Scatter Gather buffers back to user space */
+- u32 j;
+- // TODO add 64 bit API
+- struct sg_simple_element* sg;
+- int sg_size;
+-
+- // re-acquire the original message to handle correctly the sg copy operation
+- memset(&msg, 0, MAX_MESSAGE_SIZE*4);
+- // get user msg size in u32s
+- if(get_user(size, &user_msg[0])){
+- rcode = -EFAULT;
+- goto cleanup;
+- }
+- size = size>>16;
+- size *= 4;
+- if (size > MAX_MESSAGE_SIZE) {
+- rcode = -EINVAL;
+- goto cleanup;
+- }
+- /* Copy in the user's I2O command */
+- if (copy_from_user (msg, user_msg, size)) {
+- rcode = -EFAULT;
+- goto cleanup;
+- }
+- sg_count = (size - sg_offset*4) / sizeof(struct sg_simple_element);
+-
+- // TODO add 64 bit API
+- sg = (struct sg_simple_element*)(msg + sg_offset);
+- for (j = 0; j < sg_count; j++) {
+- /* Copy out the SG list to user's buffer if necessary */
+- if(! (sg[j].flag_count & 0x4000000 /*I2O_SGL_FLAGS_DIR*/)) {
+- sg_size = sg[j].flag_count & 0xffffff;
+- // sg_simple_element API is 32 bit
+- if (copy_to_user((void __user *)(ulong)sg[j].addr_bus,sg_list[j], sg_size)) {
+- printk(KERN_WARNING"%s: Could not copy %p TO user %x\n",pHba->name, sg_list[j], sg[j].addr_bus);
+- rcode = -EFAULT;
+- goto cleanup;
+- }
+- }
+- }
+- }
+-
+- /* Copy back the reply to user space */
+- if (reply_size) {
+- // we wrote our own values for context - now restore the user supplied ones
+- if(copy_from_user(reply+2, user_msg+2, sizeof(u32)*2)) {
+- printk(KERN_WARNING"%s: Could not copy message context FROM user\n",pHba->name);
+- rcode = -EFAULT;
+- }
+- if(copy_to_user(user_reply, reply, reply_size)) {
+- printk(KERN_WARNING"%s: Could not copy reply TO user\n",pHba->name);
+- rcode = -EFAULT;
+- }
+- }
+-
+-
+-cleanup:
+- if (rcode != -ETIME && rcode != -EINTR) {
+- struct sg_simple_element *sg =
+- (struct sg_simple_element*) (msg +sg_offset);
+- while(sg_index) {
+- if(sg_list[--sg_index]) {
+- dma_free_coherent(&pHba->pDev->dev,
+- sg[sg_index].flag_count & 0xffffff,
+- sg_list[sg_index],
+- sg[sg_index].addr_bus);
+- }
+- }
+- }
+-
+-free:
+- kfree(sg_list);
+- kfree(reply);
+- return rcode;
+-}
+-
+ #if defined __ia64__
+ static void adpt_ia64_info(sysInfo_S* si)
+ {
+@@ -2025,8 +1778,6 @@ static int adpt_ioctl(struct inode *inode, struct file *file, uint cmd, ulong ar
+ return -EFAULT;
+ }
+ break;
+- case I2OUSRCMD:
+- return adpt_i2o_passthru(pHba, argp);
+
+ case DPT_CTRLINFO:{
+ drvrHBAinfo_S HbaInfo;
+@@ -2163,7 +1914,7 @@ static irqreturn_t adpt_isr(int irq, void *dev_id)
+ } else {
+ /* Ick, we should *never* be here */
+ printk(KERN_ERR "dpti: reply frame not from pool\n");
+- reply = (u8 *)bus_to_virt(m);
++ continue;
+ }
+
+ if (readl(reply) & MSG_FAIL) {
+@@ -2183,13 +1934,6 @@ static irqreturn_t adpt_isr(int irq, void *dev_id)
+ adpt_send_nop(pHba, old_m);
+ }
+ context = readl(reply+8);
+- if(context & 0x40000000){ // IOCTL
+- void *p = adpt_ioctl_from_context(pHba, readl(reply+12));
+- if( p != NULL) {
+- memcpy_fromio(p, reply, REPLY_FRAME_SIZE * 4);
+- }
+- // All IOCTLs will also be post wait
+- }
+ if(context & 0x80000000){ // Post wait message
+ status = readl(reply+16);
+ if(status >> 24){
+@@ -2197,12 +1941,9 @@ static irqreturn_t adpt_isr(int irq, void *dev_id)
+ } else {
+ status = I2O_POST_WAIT_OK;
+ }
+- if(!(context & 0x40000000)) {
+- cmd = adpt_cmd_from_context(pHba,
+- readl(reply+12));
+- if(cmd != NULL) {
+- printk(KERN_WARNING"%s: Apparent SCSI cmd in Post Wait Context - cmd=%p context=%x\n", pHba->name, cmd, context);
+- }
++ cmd = adpt_cmd_from_context(pHba, readl(reply+12));
++ if(cmd != NULL) {
++ printk(KERN_WARNING"%s: Apparent SCSI cmd in Post Wait Context - cmd=%p context=%x\n", pHba->name, cmd, context);
+ }
+ adpt_i2o_post_wait_complete(context, status);
+ } else { // SCSI message
+diff --git a/drivers/scsi/dpti.h b/drivers/scsi/dpti.h
+index dfc8d2eaa09e4..9a313883788a2 100644
+--- a/drivers/scsi/dpti.h
++++ b/drivers/scsi/dpti.h
+@@ -251,7 +251,6 @@ typedef struct _adpt_hba {
+ void __iomem *FwDebugBLEDflag_P;// Virtual Addr Of FW Debug BLED
+ void __iomem *FwDebugBLEDvalue_P;// Virtual Addr Of FW Debug BLED
+ u32 FwDebugFlags;
+- u32 *ioctl_reply_context[4];
+ } adpt_hba;
+
+ struct sg_simple_element {
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index ace4a7230bcf2..c8a8c6c62c9c2 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1804,6 +1804,7 @@ static int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
+ */
+ SCSI_LOG_MLQUEUE(3, scmd_printk(KERN_INFO, cmd,
+ "queuecommand : device blocked\n"));
++ atomic_dec(&cmd->device->iorequest_cnt);
+ return SCSI_MLQUEUE_DEVICE_BUSY;
+ }
+
+@@ -1836,6 +1837,7 @@ static int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
+ trace_scsi_dispatch_cmd_start(cmd);
+ rtn = host->hostt->queuecommand(host, cmd);
+ if (rtn) {
++ atomic_dec(&cmd->device->iorequest_cnt);
+ trace_scsi_dispatch_cmd_error(cmd, rtn);
+ if (rtn != SCSI_MLQUEUE_DEVICE_BUSY &&
+ rtn != SCSI_MLQUEUE_TARGET_BUSY)
+diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c
+index 124a5d0ec05ca..b02f254ce40b7 100644
+--- a/drivers/scsi/stex.c
++++ b/drivers/scsi/stex.c
+@@ -114,7 +114,9 @@ enum {
+ TASK_ATTRIBUTE_HEADOFQUEUE = 0x1,
+ TASK_ATTRIBUTE_ORDERED = 0x2,
+ TASK_ATTRIBUTE_ACA = 0x4,
++};
+
++enum {
+ SS_STS_NORMAL = 0x80000000,
+ SS_STS_DONE = 0x40000000,
+ SS_STS_HANDSHAKE = 0x20000000,
+@@ -126,7 +128,9 @@ enum {
+ SS_I2H_REQUEST_RESET = 0x2000,
+
+ SS_MU_OPERATIONAL = 0x80000000,
++};
+
++enum {
+ STEX_CDB_LENGTH = 16,
+ STATUS_VAR_LEN = 128,
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index dbfec943071d6..36321d810d36f 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1195,34 +1195,36 @@ static void lpuart_break_ctl(struct uart_port *port, int break_state)
+
+ static void lpuart32_break_ctl(struct uart_port *port, int break_state)
+ {
+- unsigned long temp, modem;
+- struct tty_struct *tty;
+- unsigned int cflag = 0;
+-
+- tty = tty_port_tty_get(&port->state->port);
+- if (tty) {
+- cflag = tty->termios.c_cflag;
+- tty_kref_put(tty);
+- }
++ unsigned long temp;
+
+- temp = lpuart32_read(port, UARTCTRL) & ~UARTCTRL_SBK;
+- modem = lpuart32_read(port, UARTMODIR);
++ temp = lpuart32_read(port, UARTCTRL);
+
++ /*
++ * LPUART IP now has two known bugs, one is CTS has higher priority than the
++ * break signal, which causes the break signal sending through UARTCTRL_SBK
++ * may impacted by the CTS input if the HW flow control is enabled. It
++ * exists on all platforms we support in this driver.
++ * Another bug is i.MX8QM LPUART may have an additional break character
++ * being sent after SBK was cleared.
++ * To avoid above two bugs, we use Transmit Data Inversion function to send
++ * the break signal instead of UARTCTRL_SBK.
++ */
+ if (break_state != 0) {
+- temp |= UARTCTRL_SBK;
+ /*
+- * LPUART CTS has higher priority than SBK, need to disable CTS before
+- * asserting SBK to avoid any interference if flow control is enabled.
++ * Disable the transmitter to prevent any data from being sent out
++ * during break, then invert the TX line to send break.
+ */
+- if (cflag & CRTSCTS && modem & UARTMODIR_TXCTSE)
+- lpuart32_write(port, modem & ~UARTMODIR_TXCTSE, UARTMODIR);
++ temp &= ~UARTCTRL_TE;
++ lpuart32_write(port, temp, UARTCTRL);
++ temp |= UARTCTRL_TXINV;
++ lpuart32_write(port, temp, UARTCTRL);
+ } else {
+- /* Re-enable the CTS when break off. */
+- if (cflag & CRTSCTS && !(modem & UARTMODIR_TXCTSE))
+- lpuart32_write(port, modem | UARTMODIR_TXCTSE, UARTMODIR);
++ /* Disable the TXINV to turn off break and re-enable transmitter. */
++ temp &= ~UARTCTRL_TXINV;
++ lpuart32_write(port, temp, UARTCTRL);
++ temp |= UARTCTRL_TE;
++ lpuart32_write(port, temp, UARTCTRL);
+ }
+-
+- lpuart32_write(port, temp, UARTCTRL);
+ }
+
+ static void lpuart_setup_watermark(struct lpuart_port *sport)
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index f9f324f76a723..a8791b1406791 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -3510,6 +3510,7 @@ static void ffs_func_unbind(struct usb_configuration *c,
+ /* Drain any pending AIO completions */
+ drain_workqueue(ffs->io_completion_wq);
+
++ ffs_event_add(ffs, FUNCTIONFS_UNBIND);
+ if (!--opts->refcnt)
+ functionfs_unbind(ffs);
+
+@@ -3534,7 +3535,6 @@ static void ffs_func_unbind(struct usb_configuration *c,
+ func->function.ssp_descriptors = NULL;
+ func->interfaces_nums = NULL;
+
+- ffs_event_add(ffs, FUNCTIONFS_UNBIND);
+ }
+
+ static struct usb_function *ffs_alloc(struct usb_function_instance *fi)
+diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
+index 436365efae731..5bb2b07cbe1a0 100644
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -247,6 +247,9 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+
+ cursor.set = 0;
+
++ if (!vc->vc_font.data)
++ return;
++
+ c = scr_readw((u16 *) vc->vc_pos);
+ attribute = get_attribute(info, c);
+ src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height));
+diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c
+index 6473e0dfe1464..e78ec7f728463 100644
+--- a/drivers/video/fbdev/core/modedb.c
++++ b/drivers/video/fbdev/core/modedb.c
+@@ -257,6 +257,11 @@ static const struct fb_videomode modedb[] = {
+ { NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3, 0,
+ FB_VMODE_DOUBLE },
+
++ /* 1920x1080 @ 60 Hz, 67.3 kHz hsync */
++ { NULL, 60, 1920, 1080, 6734, 148, 88, 36, 4, 44, 5, 0,
++ FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
++ FB_VMODE_NONINTERLACED },
++
+ /* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
+ { NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
+ FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c
+index e606fc7287947..9c2be08026514 100644
+--- a/drivers/video/fbdev/stifb.c
++++ b/drivers/video/fbdev/stifb.c
+@@ -1371,6 +1371,7 @@ out_err1:
+ iounmap(info->screen_base);
+ out_err0:
+ kfree(fb);
++ sti->info = NULL;
+ return -ENXIO;
+ }
+
+diff --git a/drivers/watchdog/menz69_wdt.c b/drivers/watchdog/menz69_wdt.c
+index ed18238c54074..96a25d18ab643 100644
+--- a/drivers/watchdog/menz69_wdt.c
++++ b/drivers/watchdog/menz69_wdt.c
+@@ -98,14 +98,6 @@ static const struct watchdog_ops men_z069_ops = {
+ .set_timeout = men_z069_wdt_set_timeout,
+ };
+
+-static struct watchdog_device men_z069_wdt = {
+- .info = &men_z069_info,
+- .ops = &men_z069_ops,
+- .timeout = MEN_Z069_DEFAULT_TIMEOUT,
+- .min_timeout = 1,
+- .max_timeout = MEN_Z069_WDT_COUNTER_MAX / MEN_Z069_TIMER_FREQ,
+-};
+-
+ static int men_z069_probe(struct mcb_device *dev,
+ const struct mcb_device_id *id)
+ {
+@@ -125,15 +117,19 @@ static int men_z069_probe(struct mcb_device *dev,
+ goto release_mem;
+
+ drv->mem = mem;
++ drv->wdt.info = &men_z069_info;
++ drv->wdt.ops = &men_z069_ops;
++ drv->wdt.timeout = MEN_Z069_DEFAULT_TIMEOUT;
++ drv->wdt.min_timeout = 1;
++ drv->wdt.max_timeout = MEN_Z069_WDT_COUNTER_MAX / MEN_Z069_TIMER_FREQ;
+
+- drv->wdt = men_z069_wdt;
+ watchdog_init_timeout(&drv->wdt, 0, &dev->dev);
+ watchdog_set_nowayout(&drv->wdt, nowayout);
+ watchdog_set_drvdata(&drv->wdt, drv);
+ drv->wdt.parent = &dev->dev;
+ mcb_set_drvdata(dev, drv);
+
+- return watchdog_register_device(&men_z069_wdt);
++ return watchdog_register_device(&drv->wdt);
+
+ release_mem:
+ mcb_release_mem(mem);
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index e58b162ad5d6b..19e2a52d1e5a1 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -929,11 +929,13 @@ do { \
+ * where the second inode has larger inode number
+ * than the first
+ * I_DATA_SEM_QUOTA - Used for quota inodes only
++ * I_DATA_SEM_EA - Used for ea_inodes only
+ */
+ enum {
+ I_DATA_SEM_NORMAL = 0,
+ I_DATA_SEM_OTHER,
+ I_DATA_SEM_QUOTA,
++ I_DATA_SEM_EA
+ };
+
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 700822c9851ac..c2786bee4cb6e 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -121,7 +121,11 @@ ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
+ #ifdef CONFIG_LOCKDEP
+ void ext4_xattr_inode_set_class(struct inode *ea_inode)
+ {
++ struct ext4_inode_info *ei = EXT4_I(ea_inode);
++
+ lockdep_set_subclass(&ea_inode->i_rwsem, 1);
++ (void) ei; /* shut up clang warning if !CONFIG_LOCKDEP */
++ lockdep_set_subclass(&ei->i_data_sem, I_DATA_SEM_EA);
+ }
+ #endif
+
+diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h
+index d06e27ec4be47..fb181f6d6c064 100644
+--- a/fs/ocfs2/dlm/dlmcommon.h
++++ b/fs/ocfs2/dlm/dlmcommon.h
+@@ -704,10 +704,6 @@ struct dlm_begin_reco
+ __be32 pad2;
+ };
+
+-
+-#define BITS_PER_BYTE 8
+-#define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE)
+-
+ struct dlm_query_join_request
+ {
+ u8 node_idx;
+diff --git a/include/linux/bitops.h b/include/linux/bitops.h
+index 5c1522ed2d7c7..29ce32a2b6c3c 100644
+--- a/include/linux/bitops.h
++++ b/include/linux/bitops.h
+@@ -6,6 +6,7 @@
+
+ #define BITS_PER_TYPE(type) (sizeof(type) * BITS_PER_BYTE)
+ #define BITS_TO_LONGS(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(long))
++#define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char))
+
+ extern unsigned int __sw_hweight8(unsigned int w);
+ extern unsigned int __sw_hweight16(unsigned int w);
+diff --git a/include/linux/power_supply.h b/include/linux/power_supply.h
+index f80769175c56d..10a61d7454554 100644
+--- a/include/linux/power_supply.h
++++ b/include/linux/power_supply.h
+@@ -351,8 +351,9 @@ extern int power_supply_get_battery_info(struct power_supply *psy,
+ struct power_supply_battery_info *info);
+ extern void power_supply_changed(struct power_supply *psy);
+ extern int power_supply_am_i_supplied(struct power_supply *psy);
+-extern int power_supply_set_input_current_limit_from_supplier(
+- struct power_supply *psy);
++int power_supply_get_property_from_supplier(struct power_supply *psy,
++ enum power_supply_property psp,
++ union power_supply_propval *val);
+ extern int power_supply_set_battery_charged(struct power_supply *psy);
+
+ #ifdef CONFIG_POWER_SUPPLY
+diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
+index 1646c06989df7..0ce4377545f82 100644
+--- a/include/linux/usb/cdc_ncm.h
++++ b/include/linux/usb/cdc_ncm.h
+@@ -46,9 +46,12 @@
+ #define CDC_NCM_DATA_ALTSETTING_NCM 1
+ #define CDC_NCM_DATA_ALTSETTING_MBIM 2
+
+-/* CDC NCM subclass 3.2.1 */
++/* CDC NCM subclass 3.3.1 */
+ #define USB_CDC_NCM_NDP16_LENGTH_MIN 0x10
+
++/* CDC NCM subclass 3.3.2 */
++#define USB_CDC_NCM_NDP32_LENGTH_MIN 0x20
++
+ /* Maximum NTB length */
+ #define CDC_NCM_NTB_MAX_SIZE_TX 32768 /* bytes */
+ #define CDC_NCM_NTB_MAX_SIZE_RX 32768 /* bytes */
+@@ -84,7 +87,7 @@
+ /* Driver flags */
+ #define CDC_NCM_FLAG_NDP_TO_END 0x02 /* NDP is placed at end of frame */
+ #define CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE 0x04 /* Avoid altsetting toggle during init */
+-#define CDC_NCM_FLAG_RESET_NTB16 0x08 /* set NDP16 one more time after altsetting switch */
++#define CDC_NCM_FLAG_PREFER_NTB32 0x08 /* prefer NDP32 over NDP16 */
+
+ #define cdc_ncm_comm_intf_is_mbim(x) ((x)->desc.bInterfaceSubClass == USB_CDC_SUBCLASS_MBIM && \
+ (x)->desc.bInterfaceProtocol == USB_CDC_PROTO_NONE)
+@@ -113,7 +116,11 @@ struct cdc_ncm_ctx {
+
+ u32 timer_interval;
+ u32 max_ndp_size;
+- struct usb_cdc_ncm_ndp16 *delayed_ndp16;
++ u8 is_ndp16;
++ union {
++ struct usb_cdc_ncm_ndp16 *delayed_ndp16;
++ struct usb_cdc_ncm_ndp32 *delayed_ndp32;
++ };
+
+ u32 tx_timer_pending;
+ u32 tx_curr_frame_num;
+@@ -150,6 +157,8 @@ void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf);
+ struct sk_buff *cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign);
+ int cdc_ncm_rx_verify_nth16(struct cdc_ncm_ctx *ctx, struct sk_buff *skb_in);
+ int cdc_ncm_rx_verify_ndp16(struct sk_buff *skb_in, int ndpoffset);
++int cdc_ncm_rx_verify_nth32(struct cdc_ncm_ctx *ctx, struct sk_buff *skb_in);
++int cdc_ncm_rx_verify_ndp32(struct sk_buff *skb_in, int ndpoffset);
+ struct sk_buff *
+ cdc_ncm_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags);
+ int cdc_ncm_rx_fixup(struct usbnet *dev, struct sk_buff *skb_in);
+diff --git a/include/media/dvb_net.h b/include/media/dvb_net.h
+index 5e31d37f25fac..cc01dffcc9f35 100644
+--- a/include/media/dvb_net.h
++++ b/include/media/dvb_net.h
+@@ -41,6 +41,9 @@
+ * @exit: flag to indicate when the device is being removed.
+ * @demux: pointer to &struct dmx_demux.
+ * @ioctl_mutex: protect access to this struct.
++ * @remove_mutex: mutex that avoids a race condition between a callback
++ * called when the hardware is disconnected and the
++ * file_operations of dvb_net.
+ *
+ * Currently, the core supports up to %DVB_NET_DEVICES_MAX (10) network
+ * devices.
+@@ -53,6 +56,7 @@ struct dvb_net {
+ unsigned int exit:1;
+ struct dmx_demux *demux;
+ struct mutex ioctl_mutex;
++ struct mutex remove_mutex;
+ };
+
+ /**
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 0f820e68bd8fc..ce041dc440b4f 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -73,6 +73,7 @@ struct ipcm_cookie {
+ __be32 addr;
+ int oif;
+ struct ip_options_rcu *opt;
++ __u8 protocol;
+ __u8 ttl;
+ __s16 tos;
+ char priority;
+@@ -92,6 +93,7 @@ static inline void ipcm_init_sk(struct ipcm_cookie *ipcm,
+ ipcm->sockc.tsflags = inet->sk.sk_tsflags;
+ ipcm->oif = inet->sk.sk_bound_dev_if;
+ ipcm->addr = inet->inet_saddr;
++ ipcm->protocol = inet->inet_num;
+ }
+
+ #define IPCB(skb) ((struct inet_skb_parm*)((skb)->cb))
+diff --git a/include/net/sock.h b/include/net/sock.h
+index cfbd241935a30..c140c6f86e4b1 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -312,6 +312,7 @@ struct sock_common {
+ * @sk_cgrp_data: cgroup data for this cgroup
+ * @sk_memcg: this socket's memory cgroup association
+ * @sk_write_pending: a write to stream socket waits to start
++ * @sk_wait_pending: number of threads blocked on this socket
+ * @sk_state_change: callback to indicate change in the state of the sock
+ * @sk_data_ready: callback to indicate there is data to be processed
+ * @sk_write_space: callback to indicate there is bf sending space available
+@@ -392,6 +393,7 @@ struct sock {
+ unsigned int sk_napi_id;
+ #endif
+ int sk_rcvbuf;
++ int sk_wait_pending;
+
+ struct sk_filter __rcu *sk_filter;
+ union {
+@@ -1010,6 +1012,7 @@ static inline void sock_rps_reset_rxhash(struct sock *sk)
+
+ #define sk_wait_event(__sk, __timeo, __condition, __wait) \
+ ({ int __rc; \
++ __sk->sk_wait_pending++; \
+ release_sock(__sk); \
+ __rc = __condition; \
+ if (!__rc) { \
+@@ -1019,6 +1022,7 @@ static inline void sock_rps_reset_rxhash(struct sock *sk)
+ } \
+ sched_annotate_sleep(); \
+ lock_sock(__sk); \
++ __sk->sk_wait_pending--; \
+ __rc = __condition; \
+ __rc; \
+ })
+diff --git a/include/uapi/linux/in.h b/include/uapi/linux/in.h
+index 2a66ab49f14dd..b4f95eb8cdcd2 100644
+--- a/include/uapi/linux/in.h
++++ b/include/uapi/linux/in.h
+@@ -154,6 +154,8 @@ struct in_addr {
+ #define MCAST_MSFILTER 48
+ #define IP_MULTICAST_ALL 49
+ #define IP_UNICAST_IF 50
++#define IP_LOCAL_PORT_RANGE 51
++#define IP_PROTOCOL 52
+
+ #define MCAST_EXCLUDE 0
+ #define MCAST_INCLUDE 1
+diff --git a/kernel/extable.c b/kernel/extable.c
+index 6a5b61ebc66c9..b3ca75d6bf928 100644
+--- a/kernel/extable.c
++++ b/kernel/extable.c
+@@ -46,7 +46,8 @@ u32 __initdata __visible main_extable_sort_needed = 1;
+ /* Sort the kernel's built-in exception table */
+ void __init sort_main_extable(void)
+ {
+- if (main_extable_sort_needed && __stop___ex_table > __start___ex_table) {
++ if (main_extable_sort_needed &&
++ &__stop___ex_table > &__start___ex_table) {
+ pr_notice("Sorting __ex_table...\n");
+ sort_extable(__start___ex_table, __stop___ex_table);
+ }
+diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
+index fec610703095f..d56a78beb2794 100644
+--- a/lib/dynamic_debug.c
++++ b/lib/dynamic_debug.c
+@@ -984,7 +984,7 @@ static int __init dynamic_debug_init(void)
+ int n = 0, entries = 0, modct = 0;
+ int verbose_bytes = 0;
+
+- if (__start___verbose == __stop___verbose) {
++ if (&__start___verbose == &__stop___verbose) {
+ pr_warn("_ddebug table is empty in a CONFIG_DYNAMIC_DEBUG build\n");
+ return 1;
+ }
+diff --git a/net/atm/resources.c b/net/atm/resources.c
+index bada395ecdb18..9389080224f87 100644
+--- a/net/atm/resources.c
++++ b/net/atm/resources.c
+@@ -447,6 +447,7 @@ done:
+ return error;
+ }
+
++#ifdef CONFIG_PROC_FS
+ void *atm_dev_seq_start(struct seq_file *seq, loff_t *pos)
+ {
+ mutex_lock(&atm_dev_mutex);
+@@ -462,3 +463,4 @@ void *atm_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+ return seq_list_next(v, &atm_devs, pos);
+ }
++#endif
+diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
+index 908a57578794e..182c3c5b83858 100644
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -973,6 +973,34 @@ static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
+
+ BT_DBG("cmd %x arg %lx", cmd, arg);
+
++ /* Make sure the cmd is valid before doing anything */
++ switch (cmd) {
++ case HCIGETDEVLIST:
++ case HCIGETDEVINFO:
++ case HCIGETCONNLIST:
++ case HCIDEVUP:
++ case HCIDEVDOWN:
++ case HCIDEVRESET:
++ case HCIDEVRESTAT:
++ case HCISETSCAN:
++ case HCISETAUTH:
++ case HCISETENCRYPT:
++ case HCISETPTYPE:
++ case HCISETLINKPOL:
++ case HCISETLINKMODE:
++ case HCISETACLMTU:
++ case HCISETSCOMTU:
++ case HCIINQUIRY:
++ case HCISETRAW:
++ case HCIGETCONNINFO:
++ case HCIGETAUTHINFO:
++ case HCIBLOCKADDR:
++ case HCIUNBLOCKADDR:
++ break;
++ default:
++ return -ENOIOCTLCMD;
++ }
++
+ lock_sock(sk);
+
+ if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
+diff --git a/net/core/sock.c b/net/core/sock.c
+index cd23a8e4556ca..347a55519d0a5 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1795,7 +1795,6 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
+ {
+ u32 max_segs = 1;
+
+- sk_dst_set(sk, dst);
+ sk->sk_route_caps = dst->dev->features | sk->sk_route_forced_caps;
+ if (sk->sk_route_caps & NETIF_F_GSO)
+ sk->sk_route_caps |= NETIF_F_GSO_SOFTWARE;
+@@ -1810,6 +1809,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
+ }
+ }
+ sk->sk_gso_max_segs = max_segs;
++ sk_dst_set(sk, dst);
+ }
+ EXPORT_SYMBOL_GPL(sk_setup_caps);
+
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index fb142ea730060..7c902a1efbbf6 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -578,6 +578,7 @@ static long inet_wait_for_connect(struct sock *sk, long timeo, int writebias)
+
+ add_wait_queue(sk_sleep(sk), &wait);
+ sk->sk_write_pending += writebias;
++ sk->sk_wait_pending++;
+
+ /* Basic assumption: if someone sets sk->sk_err, he _must_
+ * change state of the socket from TCP_SYN_*.
+@@ -593,6 +594,7 @@ static long inet_wait_for_connect(struct sock *sk, long timeo, int writebias)
+ }
+ remove_wait_queue(sk_sleep(sk), &wait);
+ sk->sk_write_pending -= writebias;
++ sk->sk_wait_pending--;
+ return timeo;
+ }
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 0f9085220ecf9..7392a744c677e 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -826,6 +826,7 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
+ if (newsk) {
+ struct inet_connection_sock *newicsk = inet_csk(newsk);
+
++ newsk->sk_wait_pending = 0;
+ inet_sk_set_state(newsk, TCP_SYN_RECV);
+ newicsk->icsk_bind_hash = NULL;
+
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 82f341e84faec..fbf39077fc545 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -316,7 +316,14 @@ int ip_cmsg_send(struct sock *sk, struct msghdr *msg, struct ipcm_cookie *ipc,
+ ipc->tos = val;
+ ipc->priority = rt_tos2priority(ipc->tos);
+ break;
+-
++ case IP_PROTOCOL:
++ if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)))
++ return -EINVAL;
++ val = *(int *)CMSG_DATA(cmsg);
++ if (val < 1 || val > 255)
++ return -EINVAL;
++ ipc->protocol = val;
++ break;
+ default:
+ return -EINVAL;
+ }
+@@ -1522,6 +1529,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+ case IP_MINTTL:
+ val = inet->min_ttl;
+ break;
++ case IP_PROTOCOL:
++ val = inet_sk(sk)->inet_num;
++ break;
+ default:
+ release_sock(sk);
+ return -ENOPROTOOPT;
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index 654f586fc0d73..8ad120c070969 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -563,6 +563,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ }
+
+ ipcm_init_sk(&ipc, inet);
++ /* Keep backward compat */
++ if (hdrincl)
++ ipc.protocol = IPPROTO_RAW;
+
+ if (msg->msg_controllen) {
+ err = ip_cmsg_send(sk, msg, &ipc, false);
+@@ -630,7 +633,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+
+ flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
+ RT_SCOPE_UNIVERSE,
+- hdrincl ? IPPROTO_RAW : sk->sk_protocol,
++ hdrincl ? ipc.protocol : sk->sk_protocol,
+ inet_sk_flowi_flags(sk) |
+ (hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
+ daddr, saddr, 0, 0, sk->sk_uid);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index b51e0a1e15b67..cb96775fc86f6 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2568,6 +2568,12 @@ int tcp_disconnect(struct sock *sk, int flags)
+ int old_state = sk->sk_state;
+ u32 seq;
+
++ /* Deny disconnect if other threads are blocked in sk_wait_event()
++ * or inet_wait_for_connect().
++ */
++ if (sk->sk_wait_pending)
++ return -EBUSY;
++
+ if (old_state != TCP_CLOSE)
+ tcp_set_state(sk, TCP_CLOSE);
+
+@@ -3370,7 +3376,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
+ switch (optname) {
+ case TCP_MAXSEG:
+ val = tp->mss_cache;
+- if (!val && ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
++ if (tp->rx_opt.user_mss &&
++ ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
+ val = tp->rx_opt.user_mss;
+ if (tp->repair)
+ val = tp->rx_opt.mss_clamp;
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 8ed99732e24c9..31aad22c59fc3 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -832,7 +832,8 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+
+ if (!proto)
+ proto = inet->inet_num;
+- else if (proto != inet->inet_num)
++ else if (proto != inet->inet_num &&
++ inet->inet_num != IPPROTO_RAW)
+ return -EINVAL;
+
+ if (proto > 255)
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 58bba2e2691fa..b710889a90f6f 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -1216,9 +1216,6 @@ static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
+
+ static int ctnetlink_flush_iterate(struct nf_conn *ct, void *data)
+ {
+- if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
+- return 0;
+-
+ return ctnetlink_filter_match(ct, data);
+ }
+
+@@ -1280,11 +1277,6 @@ static int ctnetlink_del_conntrack(struct net *net, struct sock *ctnl,
+
+ ct = nf_ct_tuplehash_to_ctrack(h);
+
+- if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) {
+- nf_ct_put(ct);
+- return -EBUSY;
+- }
+-
+ if (cda[CTA_ID]) {
+ __be32 id = nla_get_be32(cda[CTA_ID]);
+
+@@ -2689,7 +2681,9 @@ nla_put_failure:
+ return -1;
+ }
+
++#if IS_ENABLED(CONFIG_NF_NAT)
+ static const union nf_inet_addr any_addr;
++#endif
+
+ static __be32 nf_expect_get_id(const struct nf_conntrack_expect *exp)
+ {
+@@ -3189,10 +3183,12 @@ ctnetlink_change_expect(struct nf_conntrack_expect *x,
+ return 0;
+ }
+
++#if IS_ENABLED(CONFIG_NF_NAT)
+ static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
+ [CTA_EXPECT_NAT_DIR] = { .type = NLA_U32 },
+ [CTA_EXPECT_NAT_TUPLE] = { .type = NLA_NESTED },
+ };
++#endif
+
+ static int
+ ctnetlink_parse_expect_nat(const struct nlattr *attr,
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index c73784b7b67dc..57fd9b7cfc75f 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1775,7 +1775,7 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ break;
+ }
+ }
+- if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
++ if (put_user(ALIGN(BITS_TO_BYTES(nlk->ngroups), sizeof(u32)), optlen))
+ err = -EFAULT;
+ netlink_unlock_table();
+ return err;
+diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c
+index 029c8bb90f4c3..a7d3a265befb9 100644
+--- a/net/netrom/nr_subr.c
++++ b/net/netrom/nr_subr.c
+@@ -126,7 +126,7 @@ void nr_write_internal(struct sock *sk, int frametype)
+ unsigned char *dptr;
+ int len, timeout;
+
+- len = NR_NETWORK_LEN + NR_TRANSPORT_LEN;
++ len = NR_TRANSPORT_LEN;
+
+ switch (frametype & 0x0F) {
+ case NR_CONNREQ:
+@@ -144,7 +144,8 @@ void nr_write_internal(struct sock *sk, int frametype)
+ return;
+ }
+
+- if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL)
++ skb = alloc_skb(NR_NETWORK_LEN + len, GFP_ATOMIC);
++ if (!skb)
+ return;
+
+ /*
+@@ -152,7 +153,7 @@ void nr_write_internal(struct sock *sk, int frametype)
+ */
+ skb_reserve(skb, NR_NETWORK_LEN);
+
+- dptr = skb_put(skb, skb_tailroom(skb));
++ dptr = skb_put(skb, len);
+
+ switch (frametype & 0x0F) {
+ case NR_CONNREQ:
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index aa12bee4133a9..fb165286e76dc 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3117,6 +3117,9 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
+
+ lock_sock(sk);
+ spin_lock(&po->bind_lock);
++ if (!proto)
++ proto = po->num;
++
+ rcu_read_lock();
+
+ if (po->fanout) {
+@@ -3219,7 +3222,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
+ memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data));
+ name[sizeof(uaddr->sa_data)] = 0;
+
+- return packet_do_bind(sk, name, 0, pkt_sk(sk)->num);
++ return packet_do_bind(sk, name, 0, 0);
+ }
+
+ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+@@ -3236,8 +3239,7 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len
+ if (sll->sll_family != AF_PACKET)
+ return -EINVAL;
+
+- return packet_do_bind(sk, NULL, sll->sll_ifindex,
+- sll->sll_protocol ? : pkt_sk(sk)->num);
++ return packet_do_bind(sk, NULL, sll->sll_ifindex, sll->sll_protocol);
+ }
+
+ static struct proto packet_proto = {
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index d9f912ad23dfa..ecabf78d29b8e 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -142,7 +142,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
+ rp = nlmsg_data(nlh);
+ rp->pdiag_family = AF_PACKET;
+ rp->pdiag_type = sk->sk_type;
+- rp->pdiag_num = ntohs(po->num);
++ rp->pdiag_num = ntohs(READ_ONCE(po->num));
+ rp->pdiag_ino = sk_ino;
+ sock_diag_save_cookie(sk, rp->pdiag_cookie);
+
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index 6163648145c19..7ffa28a98d743 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -640,6 +640,9 @@ static int fl_set_geneve_opt(const struct nlattr *nla, struct fl_flow_key *key,
+ if (option_len > sizeof(struct geneve_opt))
+ data_len = option_len - sizeof(struct geneve_opt);
+
++ if (key->enc_opts.len > FLOW_DIS_TUN_OPTS_MAX - 4)
++ return -ERANGE;
++
+ opt = (struct geneve_opt *)&key->enc_opts.data[key->enc_opts.len];
+ memset(opt, 0xff, option_len);
+ opt->length = data_len / 4;
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 41c67cfd264fb..5a0e71873e24b 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1148,7 +1148,12 @@ static struct Qdisc *qdisc_create(struct net_device *dev,
+ sch->parent = parent;
+
+ if (handle == TC_H_INGRESS) {
+- sch->flags |= TCQ_F_INGRESS;
++ if (!(sch->flags & TCQ_F_INGRESS)) {
++ NL_SET_ERR_MSG(extack,
++ "Specified parent ID is reserved for ingress and clsact Qdiscs");
++ err = -EINVAL;
++ goto err_out3;
++ }
+ handle = TC_H_MAKE(TC_H_INGRESS, 0);
+ lockdep_set_class(qdisc_lock(sch), &qdisc_rx_lock);
+ } else {
+@@ -1509,11 +1514,20 @@ replay:
+ NL_SET_ERR_MSG(extack, "Invalid qdisc name");
+ return -EINVAL;
+ }
++ if (q->flags & TCQ_F_INGRESS) {
++ NL_SET_ERR_MSG(extack,
++ "Cannot regraft ingress or clsact Qdiscs");
++ return -EINVAL;
++ }
+ if (q == p ||
+ (p && check_loop(q, p, 0))) {
+ NL_SET_ERR_MSG(extack, "Qdisc parent/child loop detected");
+ return -ELOOP;
+ }
++ if (clid == TC_H_INGRESS) {
++ NL_SET_ERR_MSG(extack, "Ingress cannot graft directly");
++ return -EINVAL;
++ }
+ qdisc_refcount_inc(q);
+ goto graft;
+ } else {
+diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
+index ce3f55259d0d1..834960cc755e2 100644
+--- a/net/sched/sch_ingress.c
++++ b/net/sched/sch_ingress.c
+@@ -83,6 +83,9 @@ static int ingress_init(struct Qdisc *sch, struct nlattr *opt,
+ struct ingress_sched_data *q = qdisc_priv(sch);
+ struct net_device *dev = qdisc_dev(sch);
+
++ if (sch->parent != TC_H_INGRESS)
++ return -EOPNOTSUPP;
++
+ net_inc_ingress_queue();
+
+ mini_qdisc_pair_init(&q->miniqp, sch, &dev->miniq_ingress);
+@@ -98,6 +101,9 @@ static void ingress_destroy(struct Qdisc *sch)
+ {
+ struct ingress_sched_data *q = qdisc_priv(sch);
+
++ if (sch->parent != TC_H_INGRESS)
++ return;
++
+ tcf_block_put_ext(q->block, sch, &q->block_info);
+ net_dec_ingress_queue();
+ }
+@@ -130,7 +136,7 @@ static struct Qdisc_ops ingress_qdisc_ops __read_mostly = {
+ .cl_ops = &ingress_class_ops,
+ .id = "ingress",
+ .priv_size = sizeof(struct ingress_sched_data),
+- .static_flags = TCQ_F_CPUSTATS,
++ .static_flags = TCQ_F_INGRESS | TCQ_F_CPUSTATS,
+ .init = ingress_init,
+ .destroy = ingress_destroy,
+ .dump = ingress_dump,
+@@ -215,6 +221,9 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt,
+ struct net_device *dev = qdisc_dev(sch);
+ int err;
+
++ if (sch->parent != TC_H_CLSACT)
++ return -EOPNOTSUPP;
++
+ net_inc_ingress_queue();
+ net_inc_egress_queue();
+
+@@ -242,6 +251,9 @@ static void clsact_destroy(struct Qdisc *sch)
+ {
+ struct clsact_sched_data *q = qdisc_priv(sch);
+
++ if (sch->parent != TC_H_CLSACT)
++ return;
++
+ tcf_block_put_ext(q->egress_block, sch, &q->egress_block_info);
+ tcf_block_put_ext(q->ingress_block, sch, &q->ingress_block_info);
+
+@@ -262,7 +274,7 @@ static struct Qdisc_ops clsact_qdisc_ops __read_mostly = {
+ .cl_ops = &clsact_class_ops,
+ .id = "clsact",
+ .priv_size = sizeof(struct clsact_sched_data),
+- .static_flags = TCQ_F_CPUSTATS,
++ .static_flags = TCQ_F_INGRESS | TCQ_F_CPUSTATS,
+ .init = clsact_init,
+ .destroy = clsact_destroy,
+ .dump = ingress_dump,
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 1cd21a8c4deac..6fe578773a51d 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -2240,7 +2240,7 @@ xfrm_secpath_reject(int idx, struct sk_buff *skb, const struct flowi *fl)
+
+ static inline int
+ xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,
+- unsigned short family)
++ unsigned short family, u32 if_id)
+ {
+ if (xfrm_state_kern(x))
+ return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family);
+@@ -2251,7 +2251,8 @@ xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,
+ (tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) ||
+ !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
+ !(x->props.mode != XFRM_MODE_TRANSPORT &&
+- xfrm_state_addr_cmp(tmpl, x, family));
++ xfrm_state_addr_cmp(tmpl, x, family)) &&
++ (if_id == 0 || if_id == x->if_id);
+ }
+
+ /*
+@@ -2263,7 +2264,7 @@ xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,
+ */
+ static inline int
+ xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int start,
+- unsigned short family)
++ unsigned short family, u32 if_id)
+ {
+ int idx = start;
+
+@@ -2273,7 +2274,7 @@ xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int star
+ } else
+ start = -1;
+ for (; idx < sp->len; idx++) {
+- if (xfrm_state_ok(tmpl, sp->xvec[idx], family))
++ if (xfrm_state_ok(tmpl, sp->xvec[idx], family, if_id))
+ return ++idx;
+ if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) {
+ if (start == -1)
+@@ -2450,7 +2451,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+ * are implied between each two transformations.
+ */
+ for (i = xfrm_nr-1, k = 0; i >= 0; i--) {
+- k = xfrm_policy_ok(tpp[i], sp, k, family);
++ k = xfrm_policy_ok(tpp[i], sp, k, family, if_id);
+ if (k < 0) {
+ if (k < -1)
+ /* "-2 - errored_index" returned */
+diff --git a/security/selinux/Makefile b/security/selinux/Makefile
+index 08ba8ca81d403..89c67a8145666 100644
+--- a/security/selinux/Makefile
++++ b/security/selinux/Makefile
+@@ -22,5 +22,9 @@ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h
+ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h
+
+ targets += flask.h av_permissions.h
+-$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE
++# once make >= 4.3 is required, we can use grouped targets in the rule below,
++# which basically involves adding both headers and a '&' before the colon, see
++# the example below:
++# $(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/...
++$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE
+ $(call if_changed,flask)
+diff --git a/sound/core/oss/pcm_plugin.h b/sound/core/oss/pcm_plugin.h
+index c9cd29d86efda..64a2057aa0610 100644
+--- a/sound/core/oss/pcm_plugin.h
++++ b/sound/core/oss/pcm_plugin.h
+@@ -156,6 +156,14 @@ int snd_pcm_area_copy(const struct snd_pcm_channel_area *src_channel,
+
+ void *snd_pcm_plug_buf_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t size);
+ void snd_pcm_plug_buf_unlock(struct snd_pcm_substream *plug, void *ptr);
++#else
++
++static inline snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t drv_size) { return drv_size; }
++static inline snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t clt_size) { return clt_size; }
++static inline int snd_pcm_plug_slave_format(int format, const struct snd_mask *format_mask) { return format; }
++
++#endif
++
+ snd_pcm_sframes_t snd_pcm_oss_write3(struct snd_pcm_substream *substream,
+ const char *ptr, snd_pcm_uframes_t size,
+ int in_kernel);
+@@ -166,14 +174,6 @@ snd_pcm_sframes_t snd_pcm_oss_writev3(struct snd_pcm_substream *substream,
+ snd_pcm_sframes_t snd_pcm_oss_readv3(struct snd_pcm_substream *substream,
+ void **bufs, snd_pcm_uframes_t frames);
+
+-#else
+-
+-static inline snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t drv_size) { return drv_size; }
+-static inline snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t clt_size) { return clt_size; }
+-static inline int snd_pcm_plug_slave_format(int format, const struct snd_mask *format_mask) { return format; }
+-
+-#endif
+-
+ #ifdef PLUGIN_DEBUG
+ #define pdprintf(fmt, args...) printk(KERN_DEBUG "plugin: " fmt, ##args)
+ #else
+diff --git a/sound/soc/codecs/ssm2602.c b/sound/soc/codecs/ssm2602.c
+index 501a4e73b185b..06f382c794b26 100644
+--- a/sound/soc/codecs/ssm2602.c
++++ b/sound/soc/codecs/ssm2602.c
+@@ -67,6 +67,18 @@ static const struct reg_default ssm2602_reg[SSM2602_CACHEREGNUM] = {
+ { .reg = 0x09, .def = 0x0000 }
+ };
+
++/*
++ * ssm2602 register patch
++ * Workaround for playback distortions after power up: activates digital
++ * core, and then powers on output, DAC, and whole chip at the same time
++ */
++
++static const struct reg_sequence ssm2602_patch[] = {
++ { SSM2602_ACTIVE, 0x01 },
++ { SSM2602_PWR, 0x07 },
++ { SSM2602_RESET, 0x00 },
++};
++
+
+ /*Appending several "None"s just for OSS mixer use*/
+ static const char *ssm2602_input_select[] = {
+@@ -577,6 +589,9 @@ static int ssm260x_component_probe(struct snd_soc_component *component)
+ return ret;
+ }
+
++ regmap_register_patch(ssm2602->regmap, ssm2602_patch,
++ ARRAY_SIZE(ssm2602_patch));
++
+ /* set the update bits */
+ regmap_update_bits(ssm2602->regmap, SSM2602_LINVOL,
+ LINVOL_LRIN_BOTH, LINVOL_LRIN_BOTH);
+diff --git a/sound/soc/dwc/dwc-i2s.c b/sound/soc/dwc/dwc-i2s.c
+index 65112b9d8588a..90b8814d7506a 100644
+--- a/sound/soc/dwc/dwc-i2s.c
++++ b/sound/soc/dwc/dwc-i2s.c
+@@ -132,13 +132,13 @@ static irqreturn_t i2s_irq_handler(int irq, void *dev_id)
+
+ /* Error Handling: TX */
+ if (isr[i] & ISR_TXFO) {
+- dev_err(dev->dev, "TX overrun (ch_id=%d)\n", i);
++ dev_err_ratelimited(dev->dev, "TX overrun (ch_id=%d)\n", i);
+ irq_valid = true;
+ }
+
+ /* Error Handling: TX */
+ if (isr[i] & ISR_RXFO) {
+- dev_err(dev->dev, "RX overrun (ch_id=%d)\n", i);
++ dev_err_ratelimited(dev->dev, "RX overrun (ch_id=%d)\n", i);
+ irq_valid = true;
+ }
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-06-14 10:21 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-06-14 10:21 UTC (permalink / raw
To: gentoo-commits
commit: 7a889d3478f558f8f79e6114ac5a4fdc42e26d82
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 14 10:21:06 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jun 14 10:21:06 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7a889d34
Linux patch 4.19.286
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1285_linux-4.19.286.patch | 621 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 625 insertions(+)
diff --git a/0000_README b/0000_README
index 88663e88..2e9c1100 100644
--- a/0000_README
+++ b/0000_README
@@ -1183,6 +1183,10 @@ Patch: 1284_linux-4.19.285.patch
From: https://www.kernel.org
Desc: Linux 4.19.285
+Patch: 1285_linux-4.19.286.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.286
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1285_linux-4.19.286.patch b/1285_linux-4.19.286.patch
new file mode 100644
index 00000000..2098b8c1
--- /dev/null
+++ b/1285_linux-4.19.286.patch
@@ -0,0 +1,621 @@
+diff --git a/Makefile b/Makefile
+index 9676c058e6536..36f6412c8c7ee 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 285
++SUBLEVEL = 286
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
+index 88b57a5e94892..e8272d4c1fc3a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vi.c
++++ b/drivers/gpu/drm/amd/amdgpu/vi.c
+@@ -328,8 +328,15 @@ static u32 vi_get_xclk(struct amdgpu_device *adev)
+ u32 reference_clock = adev->clock.spll.reference_freq;
+ u32 tmp;
+
+- if (adev->flags & AMD_IS_APU)
+- return reference_clock;
++ if (adev->flags & AMD_IS_APU) {
++ switch (adev->asic_type) {
++ case CHIP_STONEY:
++ /* vbios says 48Mhz, but the actual freq is 100Mhz */
++ return 10000;
++ default:
++ return reference_clock;
++ }
++ }
+
+ tmp = RREG32_SMC(ixCG_CLKPIN_CNTL_2);
+ if (REG_GET_FIELD(tmp, CG_CLKPIN_CNTL_2, MUX_TCLK_TO_XCLK))
+diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c
+index bb1478e781c42..6c95b809abdc4 100644
+--- a/drivers/i2c/busses/i2c-sprd.c
++++ b/drivers/i2c/busses/i2c-sprd.c
+@@ -581,10 +581,12 @@ static int sprd_i2c_remove(struct platform_device *pdev)
+
+ ret = pm_runtime_get_sync(i2c_dev->dev);
+ if (ret < 0)
+- return ret;
++ dev_err(&pdev->dev, "Failed to resume device (%pe)\n", ERR_PTR(ret));
+
+ i2c_del_adapter(&i2c_dev->adap);
+- clk_disable_unprepare(i2c_dev->clk);
++
++ if (ret >= 0)
++ clk_disable_unprepare(i2c_dev->clk);
+
+ pm_runtime_put_noidle(i2c_dev->dev);
+ pm_runtime_disable(i2c_dev->dev);
+diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
+index 2f2b4426ded77..c38381c71f772 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw.h
++++ b/drivers/infiniband/hw/i40iw/i40iw.h
+@@ -411,9 +411,8 @@ void i40iw_manage_arp_cache(struct i40iw_device *iwdev,
+ bool ipv4,
+ u32 action);
+
+-int i40iw_manage_apbvt(struct i40iw_device *iwdev,
+- u16 accel_local_port,
+- bool add_port);
++enum i40iw_status_code i40iw_manage_apbvt(struct i40iw_device *iwdev,
++ u16 accel_local_port, bool add_port);
+
+ struct i40iw_cqp_request *i40iw_get_cqp_request(struct i40iw_cqp *cqp, bool wait);
+ void i40iw_free_cqp_request(struct i40iw_cqp *cqp, struct i40iw_cqp_request *cqp_request);
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 0a85f0817662a..1537ce6272386 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -276,7 +276,6 @@ static const struct xpad_device {
+ { 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 },
+ { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
+ { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+- { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 },
+ { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
+ { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
+ { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index a18d17f7ef386..e78db2dd0348c 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -590,10 +590,11 @@ static void process_packet_head_v4(struct psmouse *psmouse)
+ struct input_dev *dev = psmouse->dev;
+ struct elantech_data *etd = psmouse->private;
+ unsigned char *packet = psmouse->packet;
+- int id = ((packet[3] & 0xe0) >> 5) - 1;
++ int id;
+ int pres, traces;
+
+- if (id < 0)
++ id = ((packet[3] & 0xe0) >> 5) - 1;
++ if (id < 0 || id >= ETP_MAX_FINGERS)
+ return;
+
+ etd->mt[id].x = ((packet[1] & 0x0f) << 8) | packet[2];
+@@ -623,7 +624,7 @@ static void process_packet_motion_v4(struct psmouse *psmouse)
+ int id, sid;
+
+ id = ((packet[0] & 0xe0) >> 5) - 1;
+- if (id < 0)
++ if (id < 0 || id >= ETP_MAX_FINGERS)
+ return;
+
+ sid = ((packet[3] & 0xe0) >> 5) - 1;
+@@ -644,7 +645,7 @@ static void process_packet_motion_v4(struct psmouse *psmouse)
+ input_report_abs(dev, ABS_MT_POSITION_X, etd->mt[id].x);
+ input_report_abs(dev, ABS_MT_POSITION_Y, etd->mt[id].y);
+
+- if (sid >= 0) {
++ if (sid >= 0 && sid < ETP_MAX_FINGERS) {
+ etd->mt[sid].x += delta_x2 * weight;
+ etd->mt[sid].y -= delta_y2 * weight;
+ input_mt_slot(dev, sid);
+diff --git a/drivers/net/dsa/lan9303-core.c b/drivers/net/dsa/lan9303-core.c
+index f976b3d64593a..80ac5efb0a7a9 100644
+--- a/drivers/net/dsa/lan9303-core.c
++++ b/drivers/net/dsa/lan9303-core.c
+@@ -1191,8 +1191,6 @@ static int lan9303_port_fdb_add(struct dsa_switch *ds, int port,
+ struct lan9303 *chip = ds->priv;
+
+ dev_dbg(chip->dev, "%s(%d, %pM, %d)\n", __func__, port, addr, vid);
+- if (vid)
+- return -EOPNOTSUPP;
+
+ return lan9303_alr_add_port(chip, addr, port, false);
+ }
+@@ -1204,8 +1202,6 @@ static int lan9303_port_fdb_del(struct dsa_switch *ds, int port,
+ struct lan9303 *chip = ds->priv;
+
+ dev_dbg(chip->dev, "%s(%d, %pM, %d)\n", __func__, port, addr, vid);
+- if (vid)
+- return -EOPNOTSUPP;
+ lan9303_alr_del_port(chip, addr, port);
+
+ return 0;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_alloc.h b/drivers/net/ethernet/intel/i40e/i40e_alloc.h
+index cb8689222c8b7..55ba6b690ab6c 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_alloc.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_alloc.h
+@@ -20,16 +20,11 @@ enum i40e_memory_type {
+ };
+
+ /* prototype for functions used for dynamic memory allocation */
+-i40e_status i40e_allocate_dma_mem(struct i40e_hw *hw,
+- struct i40e_dma_mem *mem,
+- enum i40e_memory_type type,
+- u64 size, u32 alignment);
+-i40e_status i40e_free_dma_mem(struct i40e_hw *hw,
+- struct i40e_dma_mem *mem);
+-i40e_status i40e_allocate_virt_mem(struct i40e_hw *hw,
+- struct i40e_virt_mem *mem,
+- u32 size);
+-i40e_status i40e_free_virt_mem(struct i40e_hw *hw,
+- struct i40e_virt_mem *mem);
++int i40e_allocate_dma_mem(struct i40e_hw *hw, struct i40e_dma_mem *mem,
++ enum i40e_memory_type type, u64 size, u32 alignment);
++int i40e_free_dma_mem(struct i40e_hw *hw, struct i40e_dma_mem *mem);
++int i40e_allocate_virt_mem(struct i40e_hw *hw, struct i40e_virt_mem *mem,
++ u32 size);
++int i40e_free_virt_mem(struct i40e_hw *hw, struct i40e_virt_mem *mem);
+
+ #endif /* _I40E_ALLOC_H_ */
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-axg.c b/drivers/pinctrl/meson/pinctrl-meson-axg.c
+index ad502eda4afa4..89ce65e5309f2 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-axg.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-axg.c
+@@ -400,6 +400,7 @@ static struct meson_pmx_group meson_axg_periphs_groups[] = {
+ GPIO_GROUP(GPIOA_15),
+ GPIO_GROUP(GPIOA_16),
+ GPIO_GROUP(GPIOA_17),
++ GPIO_GROUP(GPIOA_18),
+ GPIO_GROUP(GPIOA_19),
+ GPIO_GROUP(GPIOA_20),
+
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index defe959884dae..1518a8bf49be1 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1003,23 +1003,8 @@ static int spi_qup_probe(struct platform_device *pdev)
+ return -ENXIO;
+ }
+
+- ret = clk_prepare_enable(cclk);
+- if (ret) {
+- dev_err(dev, "cannot enable core clock\n");
+- return ret;
+- }
+-
+- ret = clk_prepare_enable(iclk);
+- if (ret) {
+- clk_disable_unprepare(cclk);
+- dev_err(dev, "cannot enable iface clock\n");
+- return ret;
+- }
+-
+ master = spi_alloc_master(dev, sizeof(struct spi_qup));
+ if (!master) {
+- clk_disable_unprepare(cclk);
+- clk_disable_unprepare(iclk);
+ dev_err(dev, "cannot allocate master\n");
+ return -ENOMEM;
+ }
+@@ -1065,6 +1050,19 @@ static int spi_qup_probe(struct platform_device *pdev)
+ spin_lock_init(&controller->lock);
+ init_completion(&controller->done);
+
++ ret = clk_prepare_enable(cclk);
++ if (ret) {
++ dev_err(dev, "cannot enable core clock\n");
++ goto error_dma;
++ }
++
++ ret = clk_prepare_enable(iclk);
++ if (ret) {
++ clk_disable_unprepare(cclk);
++ dev_err(dev, "cannot enable iface clock\n");
++ goto error_dma;
++ }
++
+ iomode = readl_relaxed(base + QUP_IO_M_MODES);
+
+ size = QUP_IO_M_OUTPUT_BLOCK_SIZE(iomode);
+@@ -1094,7 +1092,7 @@ static int spi_qup_probe(struct platform_device *pdev)
+ ret = spi_qup_set_state(controller, QUP_STATE_RESET);
+ if (ret) {
+ dev_err(dev, "cannot set RESET state\n");
+- goto error_dma;
++ goto error_clk;
+ }
+
+ writel_relaxed(0, base + QUP_OPERATIONAL);
+@@ -1118,7 +1116,7 @@ static int spi_qup_probe(struct platform_device *pdev)
+ ret = devm_request_irq(dev, irq, spi_qup_qup_irq,
+ IRQF_TRIGGER_HIGH, pdev->name, controller);
+ if (ret)
+- goto error_dma;
++ goto error_clk;
+
+ pm_runtime_set_autosuspend_delay(dev, MSEC_PER_SEC);
+ pm_runtime_use_autosuspend(dev);
+@@ -1133,11 +1131,12 @@ static int spi_qup_probe(struct platform_device *pdev)
+
+ disable_pm:
+ pm_runtime_disable(&pdev->dev);
++error_clk:
++ clk_disable_unprepare(cclk);
++ clk_disable_unprepare(iclk);
+ error_dma:
+ spi_qup_release_dma(master);
+ error:
+- clk_disable_unprepare(cclk);
+- clk_disable_unprepare(iclk);
+ spi_master_put(master);
+ return ret;
+ }
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+index 0afe4ed9ca885..d5ef1986bde4d 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+@@ -61,9 +61,9 @@ static const struct rtl819x_ops rtl819xp_ops = {
+ };
+
+ static struct pci_device_id rtl8192_pci_id_tbl[] = {
+- {PCI_DEVICE(0x10ec, 0x8192)},
+- {PCI_DEVICE(0x07aa, 0x0044)},
+- {PCI_DEVICE(0x07aa, 0x0047)},
++ {RTL_PCI_DEVICE(0x10ec, 0x8192, rtl819xp_ops)},
++ {RTL_PCI_DEVICE(0x07aa, 0x0044, rtl819xp_ops)},
++ {RTL_PCI_DEVICE(0x07aa, 0x0047, rtl819xp_ops)},
+ {}
+ };
+
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.h b/drivers/staging/rtl8192e/rtl8192e/rtl_core.h
+index 964cc5b8eb91d..866fe4d4cb28d 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.h
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.h
+@@ -67,6 +67,11 @@
+ #define IS_HARDWARE_TYPE_8192SE(_priv) \
+ (((struct r8192_priv *)rtllib_priv(dev))->card_8192 == NIC_8192SE)
+
++#define RTL_PCI_DEVICE(vend, dev, cfg) \
++ .vendor = (vend), .device = (dev), \
++ .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, \
++ .driver_data = (kernel_ulong_t)&(cfg)
++
+ #define TOTAL_CAM_ENTRY 32
+ #define CAM_CONTENT_COUNT 8
+
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 06c6a66a991f2..3b9318a3d421b 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -2341,7 +2341,7 @@ again:
+ list_splice(&reloc_roots, &rc->reloc_roots);
+
+ if (!err)
+- btrfs_commit_transaction(trans);
++ err = btrfs_commit_transaction(trans);
+ else
+ btrfs_end_transaction(trans);
+ return err;
+@@ -3930,8 +3930,12 @@ int prepare_to_relocate(struct reloc_control *rc)
+ */
+ return PTR_ERR(trans);
+ }
+- btrfs_commit_transaction(trans);
+- return 0;
++
++ ret = btrfs_commit_transaction(trans);
++ if (ret)
++ unset_reloc_control(rc);
++
++ return ret;
+ }
+
+ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
+@@ -4097,7 +4101,9 @@ restart:
+ err = PTR_ERR(trans);
+ goto out_free;
+ }
+- btrfs_commit_transaction(trans);
++ ret = btrfs_commit_transaction(trans);
++ if (ret && !err)
++ err = ret;
+ out_free:
+ btrfs_free_block_rsv(fs_info, rc->block_rsv);
+ btrfs_free_path(path);
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 6443ba1e60eb4..ba65b4bd7c0ac 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1554,6 +1554,7 @@ void ceph_flush_snaps(struct ceph_inode_info *ci,
+ struct inode *inode = &ci->vfs_inode;
+ struct ceph_mds_client *mdsc = ceph_inode_to_client(inode)->mdsc;
+ struct ceph_mds_session *session = NULL;
++ bool need_put = false;
+ int mds;
+
+ dout("ceph_flush_snaps %p\n", inode);
+@@ -1607,8 +1608,13 @@ out:
+ }
+ /* we flushed them all; remove this inode from the queue */
+ spin_lock(&mdsc->snap_flush_lock);
++ if (!list_empty(&ci->i_snap_flush_item))
++ need_put = true;
+ list_del_init(&ci->i_snap_flush_item);
+ spin_unlock(&mdsc->snap_flush_lock);
++
++ if (need_put)
++ iput(inode);
+ }
+
+ /*
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index 07db34ffa7a19..4f727f2c98db9 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -623,8 +623,10 @@ int __ceph_finish_cap_snap(struct ceph_inode_info *ci,
+ capsnap->size);
+
+ spin_lock(&mdsc->snap_flush_lock);
+- if (list_empty(&ci->i_snap_flush_item))
++ if (list_empty(&ci->i_snap_flush_item)) {
++ ihold(inode);
+ list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list);
++ }
+ spin_unlock(&mdsc->snap_flush_lock);
+ return 1; /* caller may want to ceph_flush_snaps */
+ }
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index c2786bee4cb6e..f8a8807c20977 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -2041,8 +2041,9 @@ inserted:
+ else {
+ u32 ref;
+
++#ifdef EXT4_XATTR_DEBUG
+ WARN_ON_ONCE(dquot_initialize_needed(inode));
+-
++#endif
+ /* The old block is released after updating
+ the inode. */
+ error = dquot_alloc_block(inode,
+@@ -2104,8 +2105,9 @@ inserted:
+ /* We need to allocate a new block */
+ ext4_fsblk_t goal, block;
+
++#ifdef EXT4_XATTR_DEBUG
+ WARN_ON_ONCE(dquot_initialize_needed(inode));
+-
++#endif
+ goal = ext4_group_first_block_no(sb,
+ EXT4_I(inode)->i_block_group);
+ block = ext4_new_meta_blocks(handle, inode, goal, 0,
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 4d0f48e74755d..64c4ff699e471 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -695,8 +695,11 @@ static inline void rps_record_sock_flow(struct rps_sock_flow_table *table,
+ /* We only give a hint, preemption can change CPU under us */
+ val |= raw_smp_processor_id();
+
+- if (table->ents[index] != val)
+- table->ents[index] = val;
++ /* The following WRITE_ONCE() is paired with the READ_ONCE()
++ * here, and another one in get_rps_cpu().
++ */
++ if (READ_ONCE(table->ents[index]) != val)
++ WRITE_ONCE(table->ents[index], val);
+ }
+ }
+
+diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
+index 1a6ac924266db..e09ea6917c061 100644
+--- a/include/net/pkt_sched.h
++++ b/include/net/pkt_sched.h
+@@ -124,6 +124,8 @@ static inline void qdisc_run(struct Qdisc *q)
+ }
+ }
+
++extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
++
+ /* Calculate maximal size of packet seen by hard_start_xmit
+ routine of this device.
+ */
+diff --git a/include/net/sock.h b/include/net/sock.h
+index c140c6f86e4b1..616e84d1670df 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -988,8 +988,12 @@ static inline void sock_rps_record_flow(const struct sock *sk)
+ * OR an additional socket flag
+ * [1] : sk_state and sk_prot are in the same cache line.
+ */
+- if (sk->sk_state == TCP_ESTABLISHED)
+- sock_rps_record_flow_hash(sk->sk_rxhash);
++ if (sk->sk_state == TCP_ESTABLISHED) {
++ /* This READ_ONCE() is paired with the WRITE_ONCE()
++ * from sock_rps_save_rxhash() and sock_rps_reset_rxhash().
++ */
++ sock_rps_record_flow_hash(READ_ONCE(sk->sk_rxhash));
++ }
+ }
+ #endif
+ }
+@@ -998,15 +1002,19 @@ static inline void sock_rps_save_rxhash(struct sock *sk,
+ const struct sk_buff *skb)
+ {
+ #ifdef CONFIG_RPS
+- if (unlikely(sk->sk_rxhash != skb->hash))
+- sk->sk_rxhash = skb->hash;
++ /* The following WRITE_ONCE() is paired with the READ_ONCE()
++ * here, and another one in sock_rps_record_flow().
++ */
++ if (unlikely(READ_ONCE(sk->sk_rxhash) != skb->hash))
++ WRITE_ONCE(sk->sk_rxhash, skb->hash);
+ #endif
+ }
+
+ static inline void sock_rps_reset_rxhash(struct sock *sk)
+ {
+ #ifdef CONFIG_RPS
+- sk->sk_rxhash = 0;
++ /* Paired with READ_ONCE() in sock_rps_record_flow() */
++ WRITE_ONCE(sk->sk_rxhash, 0);
+ #endif
+ }
+
+diff --git a/lib/cpu_rmap.c b/lib/cpu_rmap.c
+index f52389054a24f..a0de1b2579f71 100644
+--- a/lib/cpu_rmap.c
++++ b/lib/cpu_rmap.c
+@@ -271,8 +271,8 @@ static void irq_cpu_rmap_release(struct kref *ref)
+ struct irq_glue *glue =
+ container_of(ref, struct irq_glue, notify.kref);
+
+- cpu_rmap_put(glue->rmap);
+ glue->rmap->obj[glue->index] = NULL;
++ cpu_rmap_put(glue->rmap);
+ kfree(glue);
+ }
+
+diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
+index f2dc7499d2663..af380dc877e31 100644
+--- a/net/batman-adv/distributed-arp-table.c
++++ b/net/batman-adv/distributed-arp-table.c
+@@ -68,7 +68,6 @@ static void batadv_dat_purge(struct work_struct *work);
+ */
+ static void batadv_dat_start_timer(struct batadv_priv *bat_priv)
+ {
+- INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge);
+ queue_delayed_work(batadv_event_workqueue, &bat_priv->dat.work,
+ msecs_to_jiffies(10000));
+ }
+@@ -783,6 +782,7 @@ int batadv_dat_init(struct batadv_priv *bat_priv)
+ if (!bat_priv->dat.hash)
+ return -ENOMEM;
+
++ INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge);
+ batadv_dat_start_timer(bat_priv);
+
+ batadv_tvlv_handler_register(bat_priv, batadv_dat_tvlv_ogm_handler_v1,
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 497c8ac140d13..9fdc772ab32ea 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -2517,10 +2517,10 @@ int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
+
+ int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
+ {
+- struct smp_ltk *k;
++ struct smp_ltk *k, *tmp;
+ int removed = 0;
+
+- list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
++ list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
+ if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
+ continue;
+
+@@ -2536,9 +2536,9 @@ int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
+
+ void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
+ {
+- struct smp_irk *k;
++ struct smp_irk *k, *tmp;
+
+- list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
++ list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
+ if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
+ continue;
+
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 94d40a20ab958..fcc471f921895 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -4007,6 +4007,10 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
+ result = __le16_to_cpu(rsp->result);
+ status = __le16_to_cpu(rsp->status);
+
++ if (result == L2CAP_CR_SUCCESS && (dcid < L2CAP_CID_DYN_START ||
++ dcid > L2CAP_CID_DYN_END))
++ return -EPROTO;
++
+ BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
+ dcid, scid, result, status);
+
+@@ -4038,6 +4042,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
+
+ switch (result) {
+ case L2CAP_CR_SUCCESS:
++ if (__l2cap_get_chan_by_dcid(conn, dcid)) {
++ err = -EBADSLT;
++ break;
++ }
++
+ l2cap_state_change(chan, BT_CONFIG);
+ chan->ident = 0;
+ chan->dcid = dcid;
+@@ -4362,7 +4371,9 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
+
+ chan->ops->set_shutdown(chan);
+
++ l2cap_chan_unlock(chan);
+ mutex_lock(&conn->chan_lock);
++ l2cap_chan_lock(chan);
+ l2cap_chan_del(chan, ECONNRESET);
+ mutex_unlock(&conn->chan_lock);
+
+@@ -4401,7 +4412,9 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
+ return 0;
+ }
+
++ l2cap_chan_unlock(chan);
+ mutex_lock(&conn->chan_lock);
++ l2cap_chan_lock(chan);
+ l2cap_chan_del(chan, 0);
+ mutex_unlock(&conn->chan_lock);
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 03903d3f1d695..ba99adcd70878 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4064,8 +4064,10 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
+ u32 next_cpu;
+ u32 ident;
+
+- /* First check into global flow table if there is a match */
+- ident = sock_flow_table->ents[hash & sock_flow_table->mask];
++ /* First check into global flow table if there is a match.
++ * This READ_ONCE() pairs with WRITE_ONCE() from rps_record_sock_flow().
++ */
++ ident = READ_ONCE(sock_flow_table->ents[hash & sock_flow_table->mask]);
+ if ((ident ^ hash) & ~rps_cpu_mask)
+ goto try_rps;
+
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 435911dc9f16a..6166bbad97536 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -31,8 +31,6 @@
+ #include <net/pkt_sched.h>
+ #include <net/pkt_cls.h>
+
+-extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
+-
+ /* The list of all installed classifier types */
+ static LIST_HEAD(tcf_proto_base);
+
+@@ -1840,6 +1838,7 @@ static int tc_chain_tmplt_add(struct tcf_chain *chain, struct net *net,
+ return PTR_ERR(ops);
+ if (!ops->tmplt_create || !ops->tmplt_destroy || !ops->tmplt_dump) {
+ NL_SET_ERR_MSG(extack, "Chain templates are not supported with specified classifier");
++ module_put(ops->owner);
+ return -EOPNOTSUPP;
+ }
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-06-21 14:55 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2023-06-21 14:55 UTC (permalink / raw
To: gentoo-commits
commit: 3a879dc2f1486b27611dc6cb6097a3eb3fd90c49
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 21 14:55:31 2023 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Wed Jun 21 14:55:31 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3a879dc2
Linux patch 4.19.287
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1286_linux-4.19.287.patch | 13984 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 13988 insertions(+)
diff --git a/0000_README b/0000_README
index 2e9c1100..4b3f829e 100644
--- a/0000_README
+++ b/0000_README
@@ -1187,6 +1187,10 @@ Patch: 1285_linux-4.19.286.patch
From: https://www.kernel.org
Desc: Linux 4.19.286
+Patch: 1286_linux-4.19.287.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.287
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1286_linux-4.19.287.patch b/1286_linux-4.19.287.patch
new file mode 100644
index 00000000..9c5e54a0
--- /dev/null
+++ b/1286_linux-4.19.287.patch
@@ -0,0 +1,13984 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 68f31b6660323..42ddd78ea001a 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -810,10 +810,6 @@
+
+ debugpat [X86] Enable PAT debugging
+
+- decnet.addr= [HW,NET]
+- Format: <area>[,<node>]
+- See also Documentation/networking/decnet.txt.
+-
+ default_hugepagesz=
+ [same as hugepagesz=] The size of the default
+ HugeTLB page size. This is the size represented by
+diff --git a/Documentation/ioctl/ioctl-number.txt b/Documentation/ioctl/ioctl-number.txt
+index 13a7c999c04ab..7ab4d71ec83de 100644
+--- a/Documentation/ioctl/ioctl-number.txt
++++ b/Documentation/ioctl/ioctl-number.txt
+@@ -290,7 +290,6 @@ Code Seq#(hex) Include File Comments
+ 0x89 00-06 arch/x86/include/asm/sockios.h
+ 0x89 0B-DF linux/sockios.h
+ 0x89 E0-EF linux/sockios.h SIOCPROTOPRIVATE range
+-0x89 E0-EF linux/dn.h PROTOPRIVATE range
+ 0x89 F0-FF linux/sockios.h SIOCDEVPRIVATE range
+ 0x8B all linux/wireless.h
+ 0x8C 00-3F WiNRADiO driver
+diff --git a/Documentation/networking/decnet.txt b/Documentation/networking/decnet.txt
+deleted file mode 100644
+index e12a4900cf72c..0000000000000
+--- a/Documentation/networking/decnet.txt
++++ /dev/null
+@@ -1,232 +0,0 @@
+- Linux DECnet Networking Layer Information
+- ===========================================
+-
+-1) Other documentation....
+-
+- o Project Home Pages
+- http://www.chygwyn.com/ - Kernel info
+- http://linux-decnet.sourceforge.net/ - Userland tools
+- http://www.sourceforge.net/projects/linux-decnet/ - Status page
+-
+-2) Configuring the kernel
+-
+-Be sure to turn on the following options:
+-
+- CONFIG_DECNET (obviously)
+- CONFIG_PROC_FS (to see what's going on)
+- CONFIG_SYSCTL (for easy configuration)
+-
+-if you want to try out router support (not properly debugged yet)
+-you'll need the following options as well...
+-
+- CONFIG_DECNET_ROUTER (to be able to add/delete routes)
+- CONFIG_NETFILTER (will be required for the DECnet routing daemon)
+-
+- CONFIG_DECNET_ROUTE_FWMARK is optional
+-
+-Don't turn on SIOCGIFCONF support for DECnet unless you are really sure
+-that you need it, in general you won't and it can cause ifconfig to
+-malfunction.
+-
+-Run time configuration has changed slightly from the 2.4 system. If you
+-want to configure an endnode, then the simplified procedure is as follows:
+-
+- o Set the MAC address on your ethernet card before starting _any_ other
+- network protocols.
+-
+-As soon as your network card is brought into the UP state, DECnet should
+-start working. If you need something more complicated or are unsure how
+-to set the MAC address, see the next section. Also all configurations which
+-worked with 2.4 will work under 2.5 with no change.
+-
+-3) Command line options
+-
+-You can set a DECnet address on the kernel command line for compatibility
+-with the 2.4 configuration procedure, but in general it's not needed any more.
+-If you do st a DECnet address on the command line, it has only one purpose
+-which is that its added to the addresses on the loopback device.
+-
+-With 2.4 kernels, DECnet would only recognise addresses as local if they
+-were added to the loopback device. In 2.5, any local interface address
+-can be used to loop back to the local machine. Of course this does not
+-prevent you adding further addresses to the loopback device if you
+-want to.
+-
+-N.B. Since the address list of an interface determines the addresses for
+-which "hello" messages are sent, if you don't set an address on the loopback
+-interface then you won't see any entries in /proc/net/neigh for the local
+-host until such time as you start a connection. This doesn't affect the
+-operation of the local communications in any other way though.
+-
+-The kernel command line takes options looking like the following:
+-
+- decnet.addr=1,2
+-
+-the two numbers are the node address 1,2 = 1.2 For 2.2.xx kernels
+-and early 2.3.xx kernels, you must use a comma when specifying the
+-DECnet address like this. For more recent 2.3.xx kernels, you may
+-use almost any character except space, although a `.` would be the most
+-obvious choice :-)
+-
+-There used to be a third number specifying the node type. This option
+-has gone away in favour of a per interface node type. This is now set
+-using /proc/sys/net/decnet/conf/<dev>/forwarding. This file can be
+-set with a single digit, 0=EndNode, 1=L1 Router and 2=L2 Router.
+-
+-There are also equivalent options for modules. The node address can
+-also be set through the /proc/sys/net/decnet/ files, as can other system
+-parameters.
+-
+-Currently the only supported devices are ethernet and ip_gre. The
+-ethernet address of your ethernet card has to be set according to the DECnet
+-address of the node in order for it to be autoconfigured (and then appear in
+-/proc/net/decnet_dev). There is a utility available at the above
+-FTP sites called dn2ethaddr which can compute the correct ethernet
+-address to use. The address can be set by ifconfig either before or
+-at the time the device is brought up. If you are using RedHat you can
+-add the line:
+-
+- MACADDR=AA:00:04:00:03:04
+-
+-or something similar, to /etc/sysconfig/network-scripts/ifcfg-eth0 or
+-wherever your network card's configuration lives. Setting the MAC address
+-of your ethernet card to an address starting with "hi-ord" will cause a
+-DECnet address which matches to be added to the interface (which you can
+-verify with iproute2).
+-
+-The default device for routing can be set through the /proc filesystem
+-by setting /proc/sys/net/decnet/default_device to the
+-device you want DECnet to route packets out of when no specific route
+-is available. Usually this will be eth0, for example:
+-
+- echo -n "eth0" >/proc/sys/net/decnet/default_device
+-
+-If you don't set the default device, then it will default to the first
+-ethernet card which has been autoconfigured as described above. You can
+-confirm that by looking in the default_device file of course.
+-
+-There is a list of what the other files under /proc/sys/net/decnet/ do
+-on the kernel patch web site (shown above).
+-
+-4) Run time kernel configuration
+-
+-This is either done through the sysctl/proc interface (see the kernel web
+-pages for details on what the various options do) or through the iproute2
+-package in the same way as IPv4/6 configuration is performed.
+-
+-Documentation for iproute2 is included with the package, although there is
+-as yet no specific section on DECnet, most of the features apply to both
+-IP and DECnet, albeit with DECnet addresses instead of IP addresses and
+-a reduced functionality.
+-
+-If you want to configure a DECnet router you'll need the iproute2 package
+-since its the _only_ way to add and delete routes currently. Eventually
+-there will be a routing daemon to send and receive routing messages for
+-each interface and update the kernel routing tables accordingly. The
+-routing daemon will use netfilter to listen to routing packets, and
+-rtnetlink to update the kernels routing tables.
+-
+-The DECnet raw socket layer has been removed since it was there purely
+-for use by the routing daemon which will now use netfilter (a much cleaner
+-and more generic solution) instead.
+-
+-5) How can I tell if its working ?
+-
+-Here is a quick guide of what to look for in order to know if your DECnet
+-kernel subsystem is working.
+-
+- - Is the node address set (see /proc/sys/net/decnet/node_address)
+- - Is the node of the correct type
+- (see /proc/sys/net/decnet/conf/<dev>/forwarding)
+- - Is the Ethernet MAC address of each Ethernet card set to match
+- the DECnet address. If in doubt use the dn2ethaddr utility available
+- at the ftp archive.
+- - If the previous two steps are satisfied, and the Ethernet card is up,
+- you should find that it is listed in /proc/net/decnet_dev and also
+- that it appears as a directory in /proc/sys/net/decnet/conf/. The
+- loopback device (lo) should also appear and is required to communicate
+- within a node.
+- - If you have any DECnet routers on your network, they should appear
+- in /proc/net/decnet_neigh, otherwise this file will only contain the
+- entry for the node itself (if it doesn't check to see if lo is up).
+- - If you want to send to any node which is not listed in the
+- /proc/net/decnet_neigh file, you'll need to set the default device
+- to point to an Ethernet card with connection to a router. This is
+- again done with the /proc/sys/net/decnet/default_device file.
+- - Try starting a simple server and client, like the dnping/dnmirror
+- over the loopback interface. With luck they should communicate.
+- For this step and those after, you'll need the DECnet library
+- which can be obtained from the above ftp sites as well as the
+- actual utilities themselves.
+- - If this seems to work, then try talking to a node on your local
+- network, and see if you can obtain the same results.
+- - At this point you are on your own... :-)
+-
+-6) How to send a bug report
+-
+-If you've found a bug and want to report it, then there are several things
+-you can do to help me work out exactly what it is that is wrong. Useful
+-information (_most_ of which _is_ _essential_) includes:
+-
+- - What kernel version are you running ?
+- - What version of the patch are you running ?
+- - How far though the above set of tests can you get ?
+- - What is in the /proc/decnet* files and /proc/sys/net/decnet/* files ?
+- - Which services are you running ?
+- - Which client caused the problem ?
+- - How much data was being transferred ?
+- - Was the network congested ?
+- - How can the problem be reproduced ?
+- - Can you use tcpdump to get a trace ? (N.B. Most (all?) versions of
+- tcpdump don't understand how to dump DECnet properly, so including
+- the hex listing of the packet contents is _essential_, usually the -x flag.
+- You may also need to increase the length grabbed with the -s flag. The
+- -e flag also provides very useful information (ethernet MAC addresses))
+-
+-7) MAC FAQ
+-
+-A quick FAQ on ethernet MAC addresses to explain how Linux and DECnet
+-interact and how to get the best performance from your hardware.
+-
+-Ethernet cards are designed to normally only pass received network frames
+-to a host computer when they are addressed to it, or to the broadcast address.
+-
+-Linux has an interface which allows the setting of extra addresses for
+-an ethernet card to listen to. If the ethernet card supports it, the
+-filtering operation will be done in hardware, if not the extra unwanted packets
+-received will be discarded by the host computer. In the latter case,
+-significant processor time and bus bandwidth can be used up on a busy
+-network (see the NAPI documentation for a longer explanation of these
+-effects).
+-
+-DECnet makes use of this interface to allow running DECnet on an ethernet
+-card which has already been configured using TCP/IP (presumably using the
+-built in MAC address of the card, as usual) and/or to allow multiple DECnet
+-addresses on each physical interface. If you do this, be aware that if your
+-ethernet card doesn't support perfect hashing in its MAC address filter
+-then your computer will be doing more work than required. Some cards
+-will simply set themselves into promiscuous mode in order to receive
+-packets from the DECnet specified addresses. So if you have one of these
+-cards its better to set the MAC address of the card as described above
+-to gain the best efficiency. Better still is to use a card which supports
+-NAPI as well.
+-
+-
+-8) Mailing list
+-
+-If you are keen to get involved in development, or want to ask questions
+-about configuration, or even just report bugs, then there is a mailing
+-list that you can join, details are at:
+-
+-http://sourceforge.net/mail/?group_id=4993
+-
+-9) Legal Info
+-
+-The Linux DECnet project team have placed their code under the GPL. The
+-software is provided "as is" and without warranty express or implied.
+-DECnet is a trademark of Compaq. This software is not a product of
+-Compaq. We acknowledge the help of people at Compaq in providing extra
+-documentation above and beyond what was previously publicly available.
+-
+-Steve Whitehouse <SteveW@ACM.org>
+-
+diff --git a/Documentation/sysctl/net.txt b/Documentation/sysctl/net.txt
+index 2793d4eac55fd..57e08f16b4e38 100644
+--- a/Documentation/sysctl/net.txt
++++ b/Documentation/sysctl/net.txt
+@@ -25,7 +25,6 @@ Table : Subdirectories in /proc/sys/net
+ ethernet Ethernet protocol rose X.25 PLP layer
+ ipv4 IP version 4 x25 X.25 protocol
+ ipx IPX token-ring IBM token ring
+- bridge Bridging decnet DEC net
+ ipv6 IP version 6 tipc TIPC
+ ..............................................................................
+
+diff --git a/MAINTAINERS b/MAINTAINERS
+index a8015db6b37eb..3d3d7f5d1c3f1 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -4152,13 +4152,6 @@ F: include/uapi/linux/dccp.h
+ F: include/linux/tfrc.h
+ F: net/dccp/
+
+-DECnet NETWORK LAYER
+-W: http://linux-decnet.sourceforge.net
+-L: linux-decnet-user@lists.sourceforge.net
+-S: Orphan
+-F: Documentation/networking/decnet.txt
+-F: net/decnet/
+-
+ DECSTATION PLATFORM SUPPORT
+ M: "Maciej W. Rozycki" <macro@linux-mips.org>
+ L: linux-mips@linux-mips.org
+diff --git a/Makefile b/Makefile
+index 36f6412c8c7ee..756d6e997cd23 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 286
++SUBLEVEL = 287
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/vexpress-v2p-ca5s.dts b/arch/arm/boot/dts/vexpress-v2p-ca5s.dts
+index e5b4a7570a010..13a75a87d571b 100644
+--- a/arch/arm/boot/dts/vexpress-v2p-ca5s.dts
++++ b/arch/arm/boot/dts/vexpress-v2p-ca5s.dts
+@@ -118,6 +118,7 @@
+ reg = <0x2c0f0000 0x1000>;
+ interrupts = <0 84 4>;
+ cache-level = <2>;
++ cache-unified;
+ };
+
+ pmu {
+diff --git a/arch/mips/alchemy/common/dbdma.c b/arch/mips/alchemy/common/dbdma.c
+index 4ca2c28878e0f..e9ee9ab90a0c6 100644
+--- a/arch/mips/alchemy/common/dbdma.c
++++ b/arch/mips/alchemy/common/dbdma.c
+@@ -30,6 +30,7 @@
+ *
+ */
+
++#include <linux/dma-map-ops.h> /* for dma_default_coherent */
+ #include <linux/init.h>
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+@@ -623,17 +624,18 @@ u32 au1xxx_dbdma_put_source(u32 chanid, dma_addr_t buf, int nbytes, u32 flags)
+ dp->dscr_cmd0 &= ~DSCR_CMD0_IE;
+
+ /*
+- * There is an errata on the Au1200/Au1550 parts that could result
+- * in "stale" data being DMA'ed. It has to do with the snoop logic on
+- * the cache eviction buffer. DMA_NONCOHERENT is on by default for
+- * these parts. If it is fixed in the future, these dma_cache_inv will
+- * just be nothing more than empty macros. See io.h.
++ * There is an erratum on certain Au1200/Au1550 revisions that could
++ * result in "stale" data being DMA'ed. It has to do with the snoop
++ * logic on the cache eviction buffer. dma_default_coherent is set
++ * to false on these parts.
+ */
+- dma_cache_wback_inv((unsigned long)buf, nbytes);
++ if (!dma_default_coherent)
++ dma_cache_wback_inv(KSEG0ADDR(buf), nbytes);
+ dp->dscr_cmd0 |= DSCR_CMD0_V; /* Let it rip */
+ wmb(); /* drain writebuffer */
+ dma_cache_wback_inv((unsigned long)dp, sizeof(*dp));
+ ctp->chan_ptr->ddma_dbell = 0;
++ wmb(); /* force doorbell write out to dma engine */
+
+ /* Get next descriptor pointer. */
+ ctp->put_ptr = phys_to_virt(DSCR_GET_NXTPTR(dp->dscr_nxtptr));
+@@ -685,17 +687,18 @@ u32 au1xxx_dbdma_put_dest(u32 chanid, dma_addr_t buf, int nbytes, u32 flags)
+ dp->dscr_source1, dp->dscr_dest0, dp->dscr_dest1);
+ #endif
+ /*
+- * There is an errata on the Au1200/Au1550 parts that could result in
+- * "stale" data being DMA'ed. It has to do with the snoop logic on the
+- * cache eviction buffer. DMA_NONCOHERENT is on by default for these
+- * parts. If it is fixed in the future, these dma_cache_inv will just
+- * be nothing more than empty macros. See io.h.
++ * There is an erratum on certain Au1200/Au1550 revisions that could
++ * result in "stale" data being DMA'ed. It has to do with the snoop
++ * logic on the cache eviction buffer. dma_default_coherent is set
++ * to false on these parts.
+ */
+- dma_cache_inv((unsigned long)buf, nbytes);
++ if (!dma_default_coherent)
++ dma_cache_inv(KSEG0ADDR(buf), nbytes);
+ dp->dscr_cmd0 |= DSCR_CMD0_V; /* Let it rip */
+ wmb(); /* drain writebuffer */
+ dma_cache_wback_inv((unsigned long)dp, sizeof(*dp));
+ ctp->chan_ptr->ddma_dbell = 0;
++ wmb(); /* force doorbell write out to dma engine */
+
+ /* Get next descriptor pointer. */
+ ctp->put_ptr = phys_to_virt(DSCR_GET_NXTPTR(dp->dscr_nxtptr));
+diff --git a/arch/mips/configs/gpr_defconfig b/arch/mips/configs/gpr_defconfig
+index 55438fc9991ec..e5976b2972fb0 100644
+--- a/arch/mips/configs/gpr_defconfig
++++ b/arch/mips/configs/gpr_defconfig
+@@ -73,7 +73,6 @@ CONFIG_IP_NF_RAW=m
+ CONFIG_IP_NF_ARPTABLES=m
+ CONFIG_IP_NF_ARPFILTER=m
+ CONFIG_IP_NF_ARP_MANGLE=m
+-CONFIG_DECNET_NF_GRABULATOR=m
+ CONFIG_BRIDGE_NF_EBTABLES=m
+ CONFIG_BRIDGE_EBT_BROUTE=m
+ CONFIG_BRIDGE_EBT_T_FILTER=m
+@@ -104,7 +103,6 @@ CONFIG_ATM_MPOA=m
+ CONFIG_ATM_BR2684=m
+ CONFIG_BRIDGE=m
+ CONFIG_VLAN_8021Q=m
+-CONFIG_DECNET=m
+ CONFIG_LLC2=m
+ CONFIG_IPX=m
+ CONFIG_ATALK=m
+diff --git a/arch/mips/configs/jazz_defconfig b/arch/mips/configs/jazz_defconfig
+index aa101c27ed258..67620b1a0c64e 100644
+--- a/arch/mips/configs/jazz_defconfig
++++ b/arch/mips/configs/jazz_defconfig
+@@ -120,7 +120,6 @@ CONFIG_IP6_NF_FILTER=m
+ CONFIG_IP6_NF_TARGET_REJECT=m
+ CONFIG_IP6_NF_MANGLE=m
+ CONFIG_IP6_NF_RAW=m
+-CONFIG_DECNET_NF_GRABULATOR=m
+ CONFIG_BRIDGE_NF_EBTABLES=m
+ CONFIG_BRIDGE_EBT_BROUTE=m
+ CONFIG_BRIDGE_EBT_T_FILTER=m
+@@ -142,7 +141,6 @@ CONFIG_BRIDGE_EBT_SNAT=m
+ CONFIG_BRIDGE_EBT_LOG=m
+ CONFIG_BRIDGE_EBT_ULOG=m
+ CONFIG_BRIDGE=m
+-CONFIG_DECNET=m
+ CONFIG_NET_SCHED=y
+ CONFIG_NET_SCH_CBQ=m
+ CONFIG_NET_SCH_HTB=m
+diff --git a/arch/mips/configs/mtx1_defconfig b/arch/mips/configs/mtx1_defconfig
+index 6895430b5b2c4..87c0b7a349290 100644
+--- a/arch/mips/configs/mtx1_defconfig
++++ b/arch/mips/configs/mtx1_defconfig
+@@ -108,7 +108,6 @@ CONFIG_IP6_NF_FILTER=m
+ CONFIG_IP6_NF_TARGET_REJECT=m
+ CONFIG_IP6_NF_MANGLE=m
+ CONFIG_IP6_NF_RAW=m
+-CONFIG_DECNET_NF_GRABULATOR=m
+ CONFIG_BRIDGE_NF_EBTABLES=m
+ CONFIG_BRIDGE_EBT_BROUTE=m
+ CONFIG_BRIDGE_EBT_T_FILTER=m
+@@ -139,7 +138,6 @@ CONFIG_ATM_MPOA=m
+ CONFIG_ATM_BR2684=m
+ CONFIG_BRIDGE=m
+ CONFIG_VLAN_8021Q=m
+-CONFIG_DECNET=m
+ CONFIG_LLC2=m
+ CONFIG_IPX=m
+ CONFIG_ATALK=m
+diff --git a/arch/mips/configs/nlm_xlp_defconfig b/arch/mips/configs/nlm_xlp_defconfig
+index e8e1dd8e0e99c..8a13ae190245c 100644
+--- a/arch/mips/configs/nlm_xlp_defconfig
++++ b/arch/mips/configs/nlm_xlp_defconfig
+@@ -217,7 +217,6 @@ CONFIG_IP6_NF_TARGET_REJECT=m
+ CONFIG_IP6_NF_MANGLE=m
+ CONFIG_IP6_NF_RAW=m
+ CONFIG_IP6_NF_SECURITY=m
+-CONFIG_DECNET_NF_GRABULATOR=m
+ CONFIG_BRIDGE_NF_EBTABLES=m
+ CONFIG_BRIDGE_EBT_BROUTE=m
+ CONFIG_BRIDGE_EBT_T_FILTER=m
+@@ -252,7 +251,6 @@ CONFIG_ATM_BR2684=m
+ CONFIG_BRIDGE=m
+ CONFIG_VLAN_8021Q=m
+ CONFIG_VLAN_8021Q_GVRP=y
+-CONFIG_DECNET=m
+ CONFIG_LLC2=m
+ CONFIG_IPX=m
+ CONFIG_ATALK=m
+diff --git a/arch/mips/configs/nlm_xlr_defconfig b/arch/mips/configs/nlm_xlr_defconfig
+index c4477a4d40c11..be1927e157a6e 100644
+--- a/arch/mips/configs/nlm_xlr_defconfig
++++ b/arch/mips/configs/nlm_xlr_defconfig
+@@ -198,7 +198,6 @@ CONFIG_IP6_NF_TARGET_REJECT=m
+ CONFIG_IP6_NF_MANGLE=m
+ CONFIG_IP6_NF_RAW=m
+ CONFIG_IP6_NF_SECURITY=m
+-CONFIG_DECNET_NF_GRABULATOR=m
+ CONFIG_BRIDGE_NF_EBTABLES=m
+ CONFIG_BRIDGE_EBT_BROUTE=m
+ CONFIG_BRIDGE_EBT_T_FILTER=m
+@@ -233,7 +232,6 @@ CONFIG_ATM_BR2684=m
+ CONFIG_BRIDGE=m
+ CONFIG_VLAN_8021Q=m
+ CONFIG_VLAN_8021Q_GVRP=y
+-CONFIG_DECNET=m
+ CONFIG_LLC2=m
+ CONFIG_IPX=m
+ CONFIG_ATALK=m
+diff --git a/arch/mips/configs/rm200_defconfig b/arch/mips/configs/rm200_defconfig
+index 194df200daada..0004080a11c33 100644
+--- a/arch/mips/configs/rm200_defconfig
++++ b/arch/mips/configs/rm200_defconfig
+@@ -129,7 +129,6 @@ CONFIG_IP6_NF_FILTER=m
+ CONFIG_IP6_NF_TARGET_REJECT=m
+ CONFIG_IP6_NF_MANGLE=m
+ CONFIG_IP6_NF_RAW=m
+-CONFIG_DECNET_NF_GRABULATOR=m
+ CONFIG_BRIDGE_NF_EBTABLES=m
+ CONFIG_BRIDGE_EBT_BROUTE=m
+ CONFIG_BRIDGE_EBT_T_FILTER=m
+@@ -151,7 +150,6 @@ CONFIG_BRIDGE_EBT_SNAT=m
+ CONFIG_BRIDGE_EBT_LOG=m
+ CONFIG_BRIDGE_EBT_ULOG=m
+ CONFIG_BRIDGE=m
+-CONFIG_DECNET=m
+ CONFIG_NET_SCHED=y
+ CONFIG_NET_SCH_CBQ=m
+ CONFIG_NET_SCH_HTB=m
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index 2c2480be3f365..124bc842306d6 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -265,10 +265,6 @@ static unsigned long __init init_initrd(void)
+ pr_err("initrd start must be page aligned\n");
+ goto disable;
+ }
+- if (initrd_start < PAGE_OFFSET) {
+- pr_err("initrd start < PAGE_OFFSET\n");
+- goto disable;
+- }
+
+ /*
+ * Sanitize initrd addresses. For example firmware
+@@ -281,6 +277,11 @@ static unsigned long __init init_initrd(void)
+ initrd_end = (unsigned long)__va(end);
+ initrd_start = (unsigned long)__va(__pa(initrd_start));
+
++ if (initrd_start < PAGE_OFFSET) {
++ pr_err("initrd start < PAGE_OFFSET\n");
++ goto disable;
++ }
++
+ ROOT_DEV = Root_RAM0;
+ return PFN_UP(end);
+ disable:
+diff --git a/arch/nios2/boot/dts/10m50_devboard.dts b/arch/nios2/boot/dts/10m50_devboard.dts
+index 4bb4dc1b52e92..d0831daa42c25 100644
+--- a/arch/nios2/boot/dts/10m50_devboard.dts
++++ b/arch/nios2/boot/dts/10m50_devboard.dts
+@@ -108,7 +108,7 @@
+ rx-fifo-depth = <8192>;
+ tx-fifo-depth = <8192>;
+ address-bits = <48>;
+- max-frame-size = <1518>;
++ max-frame-size = <1500>;
+ local-mac-address = [00 00 00 00 00 00];
+ altr,has-supplementary-unicast;
+ altr,enable-sup-addr = <1>;
+diff --git a/arch/nios2/boot/dts/3c120_devboard.dts b/arch/nios2/boot/dts/3c120_devboard.dts
+index 56f4b5df6d650..b0b4e45c1a4c7 100644
+--- a/arch/nios2/boot/dts/3c120_devboard.dts
++++ b/arch/nios2/boot/dts/3c120_devboard.dts
+@@ -118,7 +118,7 @@
+ interrupt-names = "rx_irq", "tx_irq";
+ rx-fifo-depth = <8192>;
+ tx-fifo-depth = <8192>;
+- max-frame-size = <1518>;
++ max-frame-size = <1500>;
+ local-mac-address = [ 00 00 00 00 00 00 ];
+ phy-mode = "rgmii-id";
+ phy-handle = <&phy0>;
+diff --git a/arch/parisc/kernel/pci-dma.c b/arch/parisc/kernel/pci-dma.c
+index 04c48f1ef3fbd..20084336704fc 100644
+--- a/arch/parisc/kernel/pci-dma.c
++++ b/arch/parisc/kernel/pci-dma.c
+@@ -464,13 +464,29 @@ void arch_dma_free(struct device *dev, size_t size, void *vaddr,
+ void arch_sync_dma_for_device(struct device *dev, phys_addr_t paddr,
+ size_t size, enum dma_data_direction dir)
+ {
++ /*
++ * fdc: The data cache line is written back to memory, if and only if
++ * it is dirty, and then invalidated from the data cache.
++ */
+ flush_kernel_dcache_range((unsigned long)phys_to_virt(paddr), size);
+ }
+
+ void arch_sync_dma_for_cpu(struct device *dev, phys_addr_t paddr,
+ size_t size, enum dma_data_direction dir)
+ {
+- flush_kernel_dcache_range((unsigned long)phys_to_virt(paddr), size);
++ unsigned long addr = (unsigned long) phys_to_virt(paddr);
++
++ switch (dir) {
++ case DMA_TO_DEVICE:
++ case DMA_BIDIRECTIONAL:
++ flush_kernel_dcache_range(addr, size);
++ return;
++ case DMA_FROM_DEVICE:
++ purge_kernel_dcache_range_asm(addr, addr + size);
++ return;
++ default:
++ BUG();
++ }
+ }
+
+ void arch_dma_cache_sync(struct device *dev, void *vaddr, size_t size,
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 9b33cd4e0e177..b2e0fd8735627 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -30,11 +30,10 @@ endif
+ endif
+ endif
+
+-ifeq ($(CROSS_COMPILE),)
+-KBUILD_DEFCONFIG := $(shell uname -m)_defconfig
+-else
+-KBUILD_DEFCONFIG := ppc64_defconfig
+-endif
++# If we're on a ppc/ppc64/ppc64le machine use that defconfig, otherwise just use
++# ppc64_defconfig because we have nothing better to go on.
++uname := $(shell uname -m)
++KBUILD_DEFCONFIG := $(if $(filter ppc%,$(uname)),$(uname),ppc64)_defconfig
+
+ ifdef CONFIG_PPC64
+ new_nm := $(shell if $(NM) --help 2>&1 | grep -- '--synthetic' > /dev/null; then echo y; else echo n; fi)
+diff --git a/arch/powerpc/configs/ppc6xx_defconfig b/arch/powerpc/configs/ppc6xx_defconfig
+index e30af76f47537..673935824928a 100644
+--- a/arch/powerpc/configs/ppc6xx_defconfig
++++ b/arch/powerpc/configs/ppc6xx_defconfig
+@@ -253,8 +253,6 @@ CONFIG_ATM_LANE=m
+ CONFIG_ATM_BR2684=m
+ CONFIG_BRIDGE=m
+ CONFIG_VLAN_8021Q=m
+-CONFIG_DECNET=m
+-CONFIG_DECNET_ROUTER=y
+ CONFIG_IPX=m
+ CONFIG_ATALK=m
+ CONFIG_DEV_APPLETALK=m
+diff --git a/arch/powerpc/purgatory/Makefile b/arch/powerpc/purgatory/Makefile
+index 4314ba5baf435..f6a976e7c8777 100644
+--- a/arch/powerpc/purgatory/Makefile
++++ b/arch/powerpc/purgatory/Makefile
+@@ -1,6 +1,11 @@
+ # SPDX-License-Identifier: GPL-2.0
+ targets += trampoline.o purgatory.ro kexec-purgatory.c
+
++# When profile-guided optimization is enabled, llvm emits two different
++# overlapping text sections, which is not supported by kexec. Remove profile
++# optimization flags.
++KBUILD_CFLAGS := $(filter-out -fprofile-sample-use=% -fprofile-use=%,$(KBUILD_CFLAGS))
++
+ LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined
+
+ $(obj)/purgatory.ro: $(obj)/trampoline.o FORCE
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 7ee618ab1567b..b4807d12ef29c 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -779,7 +779,8 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri
+ ring_req->u.rw.handle = info->handle;
+ ring_req->operation = rq_data_dir(req) ?
+ BLKIF_OP_WRITE : BLKIF_OP_READ;
+- if (req_op(req) == REQ_OP_FLUSH || req->cmd_flags & REQ_FUA) {
++ if (req_op(req) == REQ_OP_FLUSH ||
++ (req_op(req) == REQ_OP_WRITE && (req->cmd_flags & REQ_FUA))) {
+ /*
+ * Ideally we can do an unordered flush-to-disk.
+ * In case the backend onlysupports barriers, use that.
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index b71afde8f115a..905ab615c7c82 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -521,6 +521,19 @@ nouveau_connector_set_encoder(struct drm_connector *connector,
+ }
+ }
+
++static void
++nouveau_connector_set_edid(struct nouveau_connector *nv_connector,
++ struct edid *edid)
++{
++ if (nv_connector->edid != edid) {
++ struct edid *old_edid = nv_connector->edid;
++
++ drm_connector_update_edid_property(&nv_connector->base, edid);
++ kfree(old_edid);
++ nv_connector->edid = edid;
++ }
++}
++
+ static enum drm_connector_status
+ nouveau_connector_detect(struct drm_connector *connector, bool force)
+ {
+@@ -534,13 +547,6 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
+ int ret;
+ enum drm_connector_status conn_status = connector_status_disconnected;
+
+- /* Cleanup the previous EDID block. */
+- if (nv_connector->edid) {
+- drm_connector_update_edid_property(connector, NULL);
+- kfree(nv_connector->edid);
+- nv_connector->edid = NULL;
+- }
+-
+ /* Outputs are only polled while runtime active, so resuming the
+ * device here is unnecessary (and would deadlock upon runtime suspend
+ * because it waits for polling to finish). We do however, want to
+@@ -553,22 +559,23 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
+ ret = pm_runtime_get_sync(dev->dev);
+ if (ret < 0 && ret != -EACCES) {
+ pm_runtime_put_autosuspend(dev->dev);
++ nouveau_connector_set_edid(nv_connector, NULL);
+ return conn_status;
+ }
+ }
+
+ nv_encoder = nouveau_connector_ddc_detect(connector);
+ if (nv_encoder && (i2c = nv_encoder->i2c) != NULL) {
++ struct edid *new_edid;
++
+ if ((vga_switcheroo_handler_flags() &
+ VGA_SWITCHEROO_CAN_SWITCH_DDC) &&
+ nv_connector->type == DCB_CONNECTOR_LVDS)
+- nv_connector->edid = drm_get_edid_switcheroo(connector,
+- i2c);
++ new_edid = drm_get_edid_switcheroo(connector, i2c);
+ else
+- nv_connector->edid = drm_get_edid(connector, i2c);
++ new_edid = drm_get_edid(connector, i2c);
+
+- drm_connector_update_edid_property(connector,
+- nv_connector->edid);
++ nouveau_connector_set_edid(nv_connector, new_edid);
+ if (!nv_connector->edid) {
+ NV_ERROR(drm, "DDC responded, but no EDID for %s\n",
+ connector->name);
+@@ -601,6 +608,8 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
+ nouveau_connector_set_encoder(connector, nv_encoder);
+ conn_status = connector_status_connected;
+ goto out;
++ } else {
++ nouveau_connector_set_edid(nv_connector, NULL);
+ }
+
+ nv_encoder = nouveau_connector_of_detect(connector);
+@@ -643,24 +652,20 @@ nouveau_connector_detect_lvds(struct drm_connector *connector, bool force)
+ struct nouveau_drm *drm = nouveau_drm(dev);
+ struct nouveau_connector *nv_connector = nouveau_connector(connector);
+ struct nouveau_encoder *nv_encoder = NULL;
++ struct edid *edid = NULL;
+ enum drm_connector_status status = connector_status_disconnected;
+
+- /* Cleanup the previous EDID block. */
+- if (nv_connector->edid) {
+- drm_connector_update_edid_property(connector, NULL);
+- kfree(nv_connector->edid);
+- nv_connector->edid = NULL;
+- }
+-
+ nv_encoder = find_encoder(connector, DCB_OUTPUT_LVDS);
+ if (!nv_encoder)
+- return connector_status_disconnected;
++ goto out;
+
+ /* Try retrieving EDID via DDC */
+ if (!drm->vbios.fp_no_ddc) {
+ status = nouveau_connector_detect(connector, force);
+- if (status == connector_status_connected)
++ if (status == connector_status_connected) {
++ edid = nv_connector->edid;
+ goto out;
++ }
+ }
+
+ /* On some laptops (Sony, i'm looking at you) there appears to
+@@ -673,7 +678,8 @@ nouveau_connector_detect_lvds(struct drm_connector *connector, bool force)
+ * valid - it's not (rh#613284)
+ */
+ if (nv_encoder->dcb->lvdsconf.use_acpi_for_edid) {
+- if ((nv_connector->edid = nouveau_acpi_edid(dev, connector))) {
++ edid = nouveau_acpi_edid(dev, connector);
++ if (edid) {
+ status = connector_status_connected;
+ goto out;
+ }
+@@ -693,12 +699,10 @@ nouveau_connector_detect_lvds(struct drm_connector *connector, bool force)
+ * stored for the panel stored in them.
+ */
+ if (!drm->vbios.fp_no_ddc) {
+- struct edid *edid =
+- (struct edid *)nouveau_bios_embedded_edid(dev);
++ edid = (struct edid *)nouveau_bios_embedded_edid(dev);
+ if (edid) {
+- nv_connector->edid =
+- kmemdup(edid, EDID_LENGTH, GFP_KERNEL);
+- if (nv_connector->edid)
++ edid = kmemdup(edid, EDID_LENGTH, GFP_KERNEL);
++ if (edid)
+ status = connector_status_connected;
+ }
+ }
+@@ -711,8 +715,9 @@ out:
+ status = connector_status_unknown;
+ #endif
+
+- drm_connector_update_edid_property(connector, nv_connector->edid);
+- nouveau_connector_set_encoder(connector, nv_encoder);
++ nouveau_connector_set_edid(nv_connector, edid);
++ if (nv_encoder)
++ nouveau_connector_set_encoder(connector, nv_encoder);
+ return status;
+ }
+
+@@ -916,7 +921,7 @@ nouveau_connector_get_modes(struct drm_connector *connector)
+ /* Determine display colour depth for everything except LVDS now,
+ * DP requires this before mode_valid() is called.
+ */
+- if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS)
++ if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS && nv_connector->native_mode)
+ nouveau_connector_detect_depth(connector);
+
+ /* Find the native mode if this is a digital panel, if we didn't
+@@ -937,7 +942,7 @@ nouveau_connector_get_modes(struct drm_connector *connector)
+ * "native" mode as some VBIOS tables require us to use the
+ * pixel clock as part of the lookup...
+ */
+- if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)
++ if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS && nv_connector->native_mode)
+ nouveau_connector_detect_depth(connector);
+
+ if (nv_encoder->dcb->type == DCB_OUTPUT_TV)
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index 81999bed1e4a5..352660120fcc6 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -120,10 +120,16 @@ nouveau_name(struct drm_device *dev)
+ static inline bool
+ nouveau_cli_work_ready(struct dma_fence *fence)
+ {
+- if (!dma_fence_is_signaled(fence))
+- return false;
+- dma_fence_put(fence);
+- return true;
++ bool ret = true;
++
++ spin_lock_irq(fence->lock);
++ if (!dma_fence_is_signaled_locked(fence))
++ ret = false;
++ spin_unlock_irq(fence->lock);
++
++ if (ret == true)
++ dma_fence_put(fence);
++ return ret;
+ }
+
+ static void
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 5e10a40fd26d3..d28e6f6ad497c 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -2041,8 +2041,13 @@ static int modify_qp(struct ib_uverbs_file *file,
+ attr->path_mtu = cmd->base.path_mtu;
+ if (cmd->base.attr_mask & IB_QP_PATH_MIG_STATE)
+ attr->path_mig_state = cmd->base.path_mig_state;
+- if (cmd->base.attr_mask & IB_QP_QKEY)
++ if (cmd->base.attr_mask & IB_QP_QKEY) {
++ if (cmd->base.qkey & IB_QP_SET_QKEY && !capable(CAP_NET_RAW)) {
++ ret = -EPERM;
++ goto release_qp;
++ }
+ attr->qkey = cmd->base.qkey;
++ }
+ if (cmd->base.attr_mask & IB_QP_RQ_PSN)
+ attr->rq_psn = cmd->base.rq_psn;
+ if (cmd->base.attr_mask & IB_QP_SQ_PSN)
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index fc4b46258c756..6d8925432d6a7 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -283,8 +283,12 @@ static ssize_t ib_uverbs_event_read(struct ib_uverbs_event_queue *ev_queue,
+ spin_lock_irq(&ev_queue->lock);
+
+ while (list_empty(&ev_queue->event_list)) {
+- spin_unlock_irq(&ev_queue->lock);
++ if (ev_queue->is_closed) {
++ spin_unlock_irq(&ev_queue->lock);
++ return -EIO;
++ }
+
++ spin_unlock_irq(&ev_queue->lock);
+ if (filp->f_flags & O_NONBLOCK)
+ return -EAGAIN;
+
+@@ -294,12 +298,6 @@ static ssize_t ib_uverbs_event_read(struct ib_uverbs_event_queue *ev_queue,
+ return -ERESTARTSYS;
+
+ spin_lock_irq(&ev_queue->lock);
+-
+- /* If device was disassociated and no event exists set an error */
+- if (list_empty(&ev_queue->event_list) && ev_queue->is_closed) {
+- spin_unlock_irq(&ev_queue->lock);
+- return -EIO;
+- }
+ }
+
+ event = list_entry(ev_queue->event_list.next, struct ib_uverbs_event, list);
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 2cae62ae6c64a..73009bf8a9c0b 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -218,6 +218,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp,
+ spin_lock_init(&qp->rq.producer_lock);
+ spin_lock_init(&qp->rq.consumer_lock);
+
++ skb_queue_head_init(&qp->req_pkts);
++ skb_queue_head_init(&qp->resp_pkts);
++
+ atomic_set(&qp->ssn, 0);
+ atomic_set(&qp->skb_out, 0);
+ }
+@@ -266,12 +269,8 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
+ qp->req.opcode = -1;
+ qp->comp.opcode = -1;
+
+- skb_queue_head_init(&qp->req_pkts);
+-
+- rxe_init_task(rxe, &qp->req.task, qp,
+- rxe_requester, "req");
+- rxe_init_task(rxe, &qp->comp.task, qp,
+- rxe_completer, "comp");
++ rxe_init_task(&qp->req.task, qp, rxe_requester);
++ rxe_init_task(&qp->comp.task, qp, rxe_completer);
+
+ qp->qp_timeout_jiffies = 0; /* Can't be set for UD/UC in modify_qp */
+ if (init->qp_type == IB_QPT_RC) {
+@@ -315,10 +314,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
+ }
+ }
+
+- skb_queue_head_init(&qp->resp_pkts);
+-
+- rxe_init_task(rxe, &qp->resp.task, qp,
+- rxe_responder, "resp");
++ rxe_init_task(&qp->resp.task, qp, rxe_responder);
+
+ qp->resp.opcode = OPCODE_NONE;
+ qp->resp.msn = 0;
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
+index 08f05ac5f5d52..39b3adda16550 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.c
++++ b/drivers/infiniband/sw/rxe/rxe_task.c
+@@ -114,13 +114,10 @@ void rxe_do_task(unsigned long data)
+ task->ret = ret;
+ }
+
+-int rxe_init_task(void *obj, struct rxe_task *task,
+- void *arg, int (*func)(void *), char *name)
++int rxe_init_task(struct rxe_task *task, void *arg, int (*func)(void *))
+ {
+- task->obj = obj;
+ task->arg = arg;
+ task->func = func;
+- snprintf(task->name, sizeof(task->name), "%s", name);
+ task->destroyed = false;
+
+ tasklet_init(&task->tasklet, rxe_do_task, (unsigned long)task);
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.h b/drivers/infiniband/sw/rxe/rxe_task.h
+index 08ff42d451c62..ecd81b1d1a8cb 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.h
++++ b/drivers/infiniband/sw/rxe/rxe_task.h
+@@ -46,14 +46,12 @@ enum {
+ * called again.
+ */
+ struct rxe_task {
+- void *obj;
+ struct tasklet_struct tasklet;
+ int state;
+ spinlock_t state_lock; /* spinlock for task state */
+ void *arg;
+ int (*func)(void *arg);
+ int ret;
+- char name[16];
+ bool destroyed;
+ };
+
+@@ -62,8 +60,7 @@ struct rxe_task {
+ * arg => parameter to pass to fcn
+ * fcn => function to call until it returns != 0
+ */
+-int rxe_init_task(void *obj, struct rxe_task *task,
+- void *arg, int (*func)(void *), char *name);
++int rxe_init_task(struct rxe_task *task, void *arg, int (*func)(void *));
+
+ /* cleanup task */
+ void rxe_cleanup_task(struct rxe_task *task);
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index f39670c5c25c5..de6fc8887c4a4 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -742,9 +742,13 @@ static int
+ isert_connect_error(struct rdma_cm_id *cma_id)
+ {
+ struct isert_conn *isert_conn = cma_id->qp->qp_context;
++ struct isert_np *isert_np = cma_id->context;
+
+ ib_drain_qp(isert_conn->qp);
++
++ mutex_lock(&isert_np->mutex);
+ list_del_init(&isert_conn->node);
++ mutex_unlock(&isert_np->mutex);
+ isert_conn->cm_id = NULL;
+ isert_put_conn(isert_conn);
+
+@@ -2515,6 +2519,7 @@ isert_free_np(struct iscsi_np *np)
+ {
+ struct isert_np *isert_np = np->np_context;
+ struct isert_conn *isert_conn, *n;
++ LIST_HEAD(drop_conn_list);
+
+ if (isert_np->cm_id)
+ rdma_destroy_id(isert_np->cm_id);
+@@ -2534,7 +2539,7 @@ isert_free_np(struct iscsi_np *np)
+ node) {
+ isert_info("cleaning isert_conn %p state (%d)\n",
+ isert_conn, isert_conn->state);
+- isert_connect_release(isert_conn);
++ list_move_tail(&isert_conn->node, &drop_conn_list);
+ }
+ }
+
+@@ -2545,11 +2550,16 @@ isert_free_np(struct iscsi_np *np)
+ node) {
+ isert_info("cleaning isert_conn %p state (%d)\n",
+ isert_conn, isert_conn->state);
+- isert_connect_release(isert_conn);
++ list_move_tail(&isert_conn->node, &drop_conn_list);
+ }
+ }
+ mutex_unlock(&isert_np->mutex);
+
++ list_for_each_entry_safe(isert_conn, n, &drop_conn_list, node) {
++ list_del_init(&isert_conn->node);
++ isert_connect_release(isert_conn);
++ }
++
+ np->np_context = NULL;
+ kfree(isert_np);
+ }
+@@ -2644,8 +2654,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
+ isert_put_unsol_pending_cmds(conn);
+ isert_wait4cmds(conn);
+ isert_wait4logout(isert_conn);
+-
+- queue_work(isert_release_wq, &isert_conn->release_work);
+ }
+
+ static void isert_free_conn(struct iscsi_conn *conn)
+diff --git a/drivers/irqchip/irq-meson-gpio.c b/drivers/irqchip/irq-meson-gpio.c
+index 7599b10ecf09d..dcb22f2539eff 100644
+--- a/drivers/irqchip/irq-meson-gpio.c
++++ b/drivers/irqchip/irq-meson-gpio.c
+@@ -67,7 +67,7 @@ static const struct meson_gpio_irq_params axg_params = {
+ .nr_hwirq = 100,
+ };
+
+-static const struct of_device_id meson_irq_gpio_matches[] = {
++static const struct of_device_id meson_irq_gpio_matches[] __maybe_unused = {
+ { .compatible = "amlogic,meson8-gpio-intc", .data = &meson8_params },
+ { .compatible = "amlogic,meson8b-gpio-intc", .data = &meson8b_params },
+ { .compatible = "amlogic,meson-gxbb-gpio-intc", .data = &gxbb_params },
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 3029886a42b6d..88114e576efb3 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -250,6 +250,7 @@ static ssize_t power_ro_lock_store(struct device *dev,
+ goto out_put;
+ }
+ req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_BOOT_WP;
++ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
+ blk_execute_rq(mq->queue, NULL, req, 0);
+ ret = req_to_mmc_queue_req(req)->drv_op_result;
+ blk_put_request(req);
+@@ -689,6 +690,7 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md,
+ idatas[0] = idata;
+ req_to_mmc_queue_req(req)->drv_op =
+ rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
++ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
+ req_to_mmc_queue_req(req)->drv_op_data = idatas;
+ req_to_mmc_queue_req(req)->ioc_count = 1;
+ blk_execute_rq(mq->queue, NULL, req, 0);
+@@ -758,6 +760,7 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md,
+ }
+ req_to_mmc_queue_req(req)->drv_op =
+ rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
++ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
+ req_to_mmc_queue_req(req)->drv_op_data = idata;
+ req_to_mmc_queue_req(req)->ioc_count = num_of_cmds;
+ blk_execute_rq(mq->queue, NULL, req, 0);
+@@ -2748,6 +2751,7 @@ static int mmc_dbg_card_status_get(void *data, u64 *val)
+ if (IS_ERR(req))
+ return PTR_ERR(req);
+ req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_CARD_STATUS;
++ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
+ blk_execute_rq(mq->queue, NULL, req, 0);
+ ret = req_to_mmc_queue_req(req)->drv_op_result;
+ if (ret >= 0) {
+@@ -2786,6 +2790,7 @@ static int mmc_ext_csd_open(struct inode *inode, struct file *filp)
+ goto out_free;
+ }
+ req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_EXT_CSD;
++ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
+ req_to_mmc_queue_req(req)->drv_op_data = &ext_csd;
+ blk_execute_rq(mq->queue, NULL, req, 0);
+ err = req_to_mmc_queue_req(req)->drv_op_result;
+diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+index d0f5b92bead73..e19fbdf2ff304 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+@@ -811,6 +811,8 @@ static int igb_set_eeprom(struct net_device *netdev,
+ */
+ ret_val = hw->nvm.ops.read(hw, last_word, 1,
+ &eeprom_buff[last_word - first_word]);
++ if (ret_val)
++ goto out;
+ }
+
+ /* Device's eeprom is always little-endian, word addressable */
+@@ -830,6 +832,7 @@ static int igb_set_eeprom(struct net_device *netdev,
+ hw->nvm.ops.update(hw);
+
+ igb_set_fw_version(adapter);
++out:
+ kfree(eeprom_buff);
+ return ret_val;
+ }
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 4da9c3e1c3eb3..c5781888f2f7b 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1181,7 +1181,9 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x05c6, 0x9080, 8)},
+ {QMI_FIXED_INTF(0x05c6, 0x9083, 3)},
+ {QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9091, 2)}, /* Compal RXM-G1 */
+ {QMI_FIXED_INTF(0x05c6, 0x90b2, 3)}, /* ublox R410M */
++ {QMI_QUIRK_SET_DTR(0x05c6, 0x90db, 2)}, /* Compal RXM-G1 */
+ {QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
+ {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
+ {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 6233805fc032c..b2ede9acb4bcf 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -344,6 +344,9 @@ static int lapbeth_new_device(struct net_device *dev)
+
+ ASSERT_RTNL();
+
++ if (dev->type != ARPHRD_ETHER)
++ return -EINVAL;
++
+ ndev = alloc_netdev(sizeof(*lapbeth), "lapb%d", NET_NAME_UNKNOWN,
+ lapbeth_setup);
+ if (!ndev)
+diff --git a/drivers/power/supply/ab8500_btemp.c b/drivers/power/supply/ab8500_btemp.c
+index 0fd24577112eb..0bec8b90667c8 100644
+--- a/drivers/power/supply/ab8500_btemp.c
++++ b/drivers/power/supply/ab8500_btemp.c
+@@ -919,10 +919,8 @@ static int ab8500_btemp_get_ext_psy_data(struct device *dev, void *data)
+ */
+ static void ab8500_btemp_external_power_changed(struct power_supply *psy)
+ {
+- struct ab8500_btemp *di = power_supply_get_drvdata(psy);
+-
+- class_for_each_device(power_supply_class, NULL,
+- di->btemp_psy, ab8500_btemp_get_ext_psy_data);
++ class_for_each_device(power_supply_class, NULL, psy,
++ ab8500_btemp_get_ext_psy_data);
+ }
+
+ /* ab8500 btemp driver interrupts and their respective isr */
+diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
+index 675f9d0e8471e..d0cbd7189a622 100644
+--- a/drivers/power/supply/ab8500_fg.c
++++ b/drivers/power/supply/ab8500_fg.c
+@@ -2380,10 +2380,8 @@ out:
+ */
+ static void ab8500_fg_external_power_changed(struct power_supply *psy)
+ {
+- struct ab8500_fg *di = power_supply_get_drvdata(psy);
+-
+- class_for_each_device(power_supply_class, NULL,
+- di->fg_psy, ab8500_fg_get_ext_psy_data);
++ class_for_each_device(power_supply_class, NULL, psy,
++ ab8500_fg_get_ext_psy_data);
+ }
+
+ /**
+diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
+index 725851ca0e757..f665553b26a2d 100644
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -877,10 +877,8 @@ static int poll_interval_param_set(const char *val, const struct kernel_param *k
+ return ret;
+
+ mutex_lock(&bq27xxx_list_lock);
+- list_for_each_entry(di, &bq27xxx_battery_devices, list) {
+- cancel_delayed_work_sync(&di->work);
+- schedule_delayed_work(&di->work, 0);
+- }
++ list_for_each_entry(di, &bq27xxx_battery_devices, list)
++ mod_delayed_work(system_wq, &di->work, 0);
+ mutex_unlock(&bq27xxx_list_lock);
+
+ return ret;
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index 6a2d157c24759..3715a6c2955b2 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -350,6 +350,10 @@ static int __power_supply_is_system_supplied(struct device *dev, void *data)
+ struct power_supply *psy = dev_get_drvdata(dev);
+ unsigned int *count = data;
+
++ if (!psy->desc->get_property(psy, POWER_SUPPLY_PROP_SCOPE, &ret))
++ if (ret.intval == POWER_SUPPLY_SCOPE_DEVICE)
++ return 0;
++
+ (*count)++;
+ if (psy->desc->type != POWER_SUPPLY_TYPE_BATTERY)
+ if (!psy->desc->get_property(psy, POWER_SUPPLY_PROP_ONLINE,
+@@ -368,8 +372,8 @@ int power_supply_is_system_supplied(void)
+ __power_supply_is_system_supplied);
+
+ /*
+- * If no power class device was found at all, most probably we are
+- * running on a desktop system, so assume we are on mains power.
++ * If no system scope power class device was found at all, most probably we
++ * are running on a desktop system, so assume we are on mains power.
+ */
+ if (count == 0)
+ return 1;
+diff --git a/drivers/power/supply/power_supply_sysfs.c b/drivers/power/supply/power_supply_sysfs.c
+index 5358a80d854f9..7b293a50452eb 100644
+--- a/drivers/power/supply/power_supply_sysfs.c
++++ b/drivers/power/supply/power_supply_sysfs.c
+@@ -128,7 +128,8 @@ static ssize_t power_supply_show_property(struct device *dev,
+
+ if (ret < 0) {
+ if (ret == -ENODATA)
+- dev_dbg(dev, "driver has no data for `%s' property\n",
++ dev_dbg_ratelimited(dev,
++ "driver has no data for `%s' property\n",
+ attr->attr.name);
+ else if (ret != -ENODEV && ret != -EAGAIN)
+ dev_err_ratelimited(dev,
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 11656b3836748..14f9977f1ec08 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4181,7 +4181,7 @@ static void rdev_init_debugfs(struct regulator_dev *rdev)
+ }
+
+ rdev->debugfs = debugfs_create_dir(rname, debugfs_root);
+- if (!rdev->debugfs) {
++ if (IS_ERR(rdev->debugfs)) {
+ rdev_warn(rdev, "Failed to create debugfs directory\n");
+ return;
+ }
+@@ -4843,7 +4843,7 @@ static int __init regulator_init(void)
+ ret = class_register(®ulator_class);
+
+ debugfs_root = debugfs_create_dir("regulator", NULL);
+- if (!debugfs_root)
++ if (IS_ERR(debugfs_root))
+ pr_warn("regulator: Failed to create debugfs directory\n");
+
+ debugfs_create_file("supply_map", 0444, debugfs_root, NULL,
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 6c82ea6d8e206..4528852fd990e 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -178,6 +178,7 @@ static void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep,
+ list_del(&req->list);
+ req->remaining = 0;
+ req->needs_extra_trb = false;
++ req->num_trbs = 0;
+
+ if (req->request.status == -EINPROGRESS)
+ req->request.status = status;
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index d01fd211566e8..5558ea5ac77af 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -23,6 +23,7 @@
+ #include "u_ether.h"
+ #include "u_ether_configfs.h"
+ #include "u_ncm.h"
++#include "configfs.h"
+
+ /*
+ * This function is a "CDC Network Control Model" (CDC NCM) Ethernet link.
+@@ -35,9 +36,7 @@
+
+ /* to trigger crc/non-crc ndp signature */
+
+-#define NCM_NDP_HDR_CRC_MASK 0x01000000
+ #define NCM_NDP_HDR_CRC 0x01000000
+-#define NCM_NDP_HDR_NOCRC 0x00000000
+
+ enum ncm_notify_state {
+ NCM_NOTIFY_NONE, /* don't notify */
+@@ -531,6 +530,7 @@ static inline void ncm_reset_values(struct f_ncm *ncm)
+ {
+ ncm->parser_opts = &ndp16_opts;
+ ncm->is_crc = false;
++ ncm->ndp_sign = ncm->parser_opts->ndp_sign;
+ ncm->port.cdc_filter = DEFAULT_FILTER;
+
+ /* doesn't make sense for ncm, fixed size used */
+@@ -813,25 +813,20 @@ static int ncm_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
+ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
+ | USB_CDC_SET_CRC_MODE:
+ {
+- int ndp_hdr_crc = 0;
+-
+ if (w_length != 0 || w_index != ncm->ctrl_id)
+ goto invalid;
+ switch (w_value) {
+ case 0x0000:
+ ncm->is_crc = false;
+- ndp_hdr_crc = NCM_NDP_HDR_NOCRC;
+ DBG(cdev, "non-CRC mode selected\n");
+ break;
+ case 0x0001:
+ ncm->is_crc = true;
+- ndp_hdr_crc = NCM_NDP_HDR_CRC;
+ DBG(cdev, "CRC mode selected\n");
+ break;
+ default:
+ goto invalid;
+ }
+- ncm->ndp_sign = ncm->parser_opts->ndp_sign | ndp_hdr_crc;
+ value = 0;
+ break;
+ }
+@@ -848,6 +843,8 @@ invalid:
+ ctrl->bRequestType, ctrl->bRequest,
+ w_value, w_index, w_length);
+ }
++ ncm->ndp_sign = ncm->parser_opts->ndp_sign |
++ (ncm->is_crc ? NCM_NDP_HDR_CRC : 0);
+
+ /* respond with data transfer or status phase? */
+ if (value >= 0) {
+@@ -1434,6 +1431,16 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ return -EINVAL;
+
+ ncm_opts = container_of(f->fi, struct f_ncm_opts, func_inst);
++
++ if (cdev->use_os_string) {
++ f->os_desc_table = kzalloc(sizeof(*f->os_desc_table),
++ GFP_KERNEL);
++ if (!f->os_desc_table)
++ return -ENOMEM;
++ f->os_desc_n = 1;
++ f->os_desc_table[0].os_desc = &ncm_opts->ncm_os_desc;
++ }
++
+ /*
+ * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
+ * configurations are bound in sequence with list_for_each_entry,
+@@ -1447,13 +1454,15 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ status = gether_register_netdev(ncm_opts->net);
+ mutex_unlock(&ncm_opts->lock);
+ if (status)
+- return status;
++ goto fail;
+ ncm_opts->bound = true;
+ }
+ us = usb_gstrings_attach(cdev, ncm_strings,
+ ARRAY_SIZE(ncm_string_defs));
+- if (IS_ERR(us))
+- return PTR_ERR(us);
++ if (IS_ERR(us)) {
++ status = PTR_ERR(us);
++ goto fail;
++ }
+ ncm_control_intf.iInterface = us[STRING_CTRL_IDX].id;
+ ncm_data_nop_intf.iInterface = us[STRING_DATA_IDX].id;
+ ncm_data_intf.iInterface = us[STRING_DATA_IDX].id;
+@@ -1470,6 +1479,10 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ ncm_control_intf.bInterfaceNumber = status;
+ ncm_union_desc.bMasterInterface0 = status;
+
++ if (cdev->use_os_string)
++ f->os_desc_table[0].if_id =
++ ncm_iad_desc.bFirstInterface;
++
+ status = usb_interface_id(c, f);
+ if (status < 0)
+ goto fail;
+@@ -1549,6 +1562,9 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ return 0;
+
+ fail:
++ kfree(f->os_desc_table);
++ f->os_desc_n = 0;
++
+ if (ncm->notify_req) {
+ kfree(ncm->notify_req->buf);
+ usb_ep_free_request(ncm->notify, ncm->notify_req);
+@@ -1603,16 +1619,22 @@ static void ncm_free_inst(struct usb_function_instance *f)
+ gether_cleanup(netdev_priv(opts->net));
+ else
+ free_netdev(opts->net);
++ kfree(opts->ncm_interf_group);
+ kfree(opts);
+ }
+
+ static struct usb_function_instance *ncm_alloc_inst(void)
+ {
+ struct f_ncm_opts *opts;
++ struct usb_os_desc *descs[1];
++ char *names[1];
++ struct config_group *ncm_interf_group;
+
+ opts = kzalloc(sizeof(*opts), GFP_KERNEL);
+ if (!opts)
+ return ERR_PTR(-ENOMEM);
++ opts->ncm_os_desc.ext_compat_id = opts->ncm_ext_compat_id;
++
+ mutex_init(&opts->lock);
+ opts->func_inst.free_func_inst = ncm_free_inst;
+ opts->net = gether_setup_default();
+@@ -1621,8 +1643,20 @@ static struct usb_function_instance *ncm_alloc_inst(void)
+ kfree(opts);
+ return ERR_CAST(net);
+ }
++ INIT_LIST_HEAD(&opts->ncm_os_desc.ext_prop);
++
++ descs[0] = &opts->ncm_os_desc;
++ names[0] = "ncm";
+
+ config_group_init_type_name(&opts->func_inst.group, "", &ncm_func_type);
++ ncm_interf_group =
++ usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
++ names, THIS_MODULE);
++ if (IS_ERR(ncm_interf_group)) {
++ ncm_free_inst(&opts->func_inst);
++ return ERR_CAST(ncm_interf_group);
++ }
++ opts->ncm_interf_group = ncm_interf_group;
+
+ return &opts->func_inst;
+ }
+@@ -1648,6 +1682,9 @@ static void ncm_unbind(struct usb_configuration *c, struct usb_function *f)
+
+ hrtimer_cancel(&ncm->task_timer);
+
++ kfree(f->os_desc_table);
++ f->os_desc_n = 0;
++
+ ncm_string_defs[0].id = 0;
+ usb_free_all_descriptors(f);
+
+diff --git a/drivers/usb/gadget/function/u_ncm.h b/drivers/usb/gadget/function/u_ncm.h
+index 67324f983343a..dfd75ad61b3f1 100644
+--- a/drivers/usb/gadget/function/u_ncm.h
++++ b/drivers/usb/gadget/function/u_ncm.h
+@@ -20,6 +20,9 @@ struct f_ncm_opts {
+ struct net_device *net;
+ bool bound;
+
++ struct config_group *ncm_interf_group;
++ struct usb_os_desc ncm_os_desc;
++ char ncm_ext_compat_id[16];
+ /*
+ * Read/write access to configfs attributes is handled by configfs.
+ *
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 06c5f46ff0f92..126e276edd2ed 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -248,6 +248,8 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_VENDOR_ID 0x2c7c
+ /* These Quectel products use Quectel's vendor ID */
+ #define QUECTEL_PRODUCT_EC21 0x0121
++#define QUECTEL_PRODUCT_EM061K_LTA 0x0123
++#define QUECTEL_PRODUCT_EM061K_LMS 0x0124
+ #define QUECTEL_PRODUCT_EC25 0x0125
+ #define QUECTEL_PRODUCT_EG91 0x0191
+ #define QUECTEL_PRODUCT_EG95 0x0195
+@@ -266,6 +268,8 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_RM520N 0x0801
+ #define QUECTEL_PRODUCT_EC200U 0x0901
+ #define QUECTEL_PRODUCT_EC200S_CN 0x6002
++#define QUECTEL_PRODUCT_EM061K_LWW 0x6008
++#define QUECTEL_PRODUCT_EM061K_LCN 0x6009
+ #define QUECTEL_PRODUCT_EC200T 0x6026
+ #define QUECTEL_PRODUCT_RM500K 0x7001
+
+@@ -1189,6 +1193,18 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LMS, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LMS, 0xff, 0x00, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LMS, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LTA, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LTA, 0xff, 0x00, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LTA, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LWW, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LWW, 0xff, 0x00, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LWW, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
+diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
+index 138ebbb7a1eef..677ff78d54fba 100644
+--- a/fs/nilfs2/btnode.c
++++ b/fs/nilfs2/btnode.c
+@@ -295,6 +295,14 @@ void nilfs_btnode_abort_change_key(struct address_space *btnc,
+ radix_tree_delete(&btnc->i_pages, newkey);
+ xa_unlock_irq(&btnc->i_pages);
+ unlock_page(ctxt->bh->b_page);
+- } else
+- brelse(nbh);
++ } else {
++ /*
++ * When canceling a buffer that a prepare operation has
++ * allocated to copy a node block to another location, use
++ * nilfs_btnode_delete() to initialize and release the buffer
++ * so that the buffer flags will not be in an inconsistent
++ * state when it is reallocated.
++ */
++ nilfs_btnode_delete(nbh);
++ }
+ }
+diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
+index 150845a432259..d85d3c758d7b9 100644
+--- a/fs/nilfs2/sufile.c
++++ b/fs/nilfs2/sufile.c
+@@ -782,6 +782,15 @@ int nilfs_sufile_resize(struct inode *sufile, __u64 newnsegs)
+ goto out_header;
+
+ sui->ncleansegs -= nsegs - newnsegs;
++
++ /*
++ * If the sufile is successfully truncated, immediately adjust
++ * the segment allocation space while locking the semaphore
++ * "mi_sem" so that nilfs_sufile_alloc() never allocates
++ * segments in the truncated space.
++ */
++ sui->allocmax = newnsegs - 1;
++ sui->allocmin = 0;
+ }
+
+ kaddr = kmap_atomic(header_bh->b_page);
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 0141298bb2e5f..c1780b14d23db 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2111,14 +2111,20 @@ static long ocfs2_fallocate(struct file *file, int mode, loff_t offset,
+ struct ocfs2_space_resv sr;
+ int change_size = 1;
+ int cmd = OCFS2_IOC_RESVSP64;
++ int ret = 0;
+
+ if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+ return -EOPNOTSUPP;
+ if (!ocfs2_writes_unwritten_extents(osb))
+ return -EOPNOTSUPP;
+
+- if (mode & FALLOC_FL_KEEP_SIZE)
++ if (mode & FALLOC_FL_KEEP_SIZE) {
+ change_size = 0;
++ } else {
++ ret = inode_newsize_ok(inode, offset + len);
++ if (ret)
++ return ret;
++ }
+
+ if (mode & FALLOC_FL_PUNCH_HOLE)
+ cmd = OCFS2_IOC_UNRESVSP64;
+diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
+index 7a08053d95c21..4fd99ef7f3342 100644
+--- a/fs/ocfs2/super.c
++++ b/fs/ocfs2/super.c
+@@ -985,8 +985,10 @@ static void ocfs2_disable_quotas(struct ocfs2_super *osb)
+ for (type = 0; type < OCFS2_MAXQUOTAS; type++) {
+ if (!sb_has_quota_loaded(sb, type))
+ continue;
+- oinfo = sb_dqinfo(sb, type)->dqi_priv;
+- cancel_delayed_work_sync(&oinfo->dqi_sync_work);
++ if (!sb_has_quota_suspended(sb, type)) {
++ oinfo = sb_dqinfo(sb, type)->dqi_priv;
++ cancel_delayed_work_sync(&oinfo->dqi_sync_work);
++ }
+ inode = igrab(sb->s_dquot.files[type]);
+ /* Turn off quotas. This will remove all dquot structures from
+ * memory and so they will be automatically synced to global
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 64c4ff699e471..90827d85265b0 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1651,7 +1651,6 @@ enum netdev_priv_flags {
+ * @tipc_ptr: TIPC specific data
+ * @atalk_ptr: AppleTalk link
+ * @ip_ptr: IPv4 specific data
+- * @dn_ptr: DECnet specific data
+ * @ip6_ptr: IPv6 specific data
+ * @ax25_ptr: AX.25 specific data
+ * @ieee80211_ptr: IEEE 802.11 specific data, assign before registering
+@@ -1895,9 +1894,6 @@ struct net_device {
+ void *atalk_ptr;
+ #endif
+ struct in_device __rcu *ip_ptr;
+-#if IS_ENABLED(CONFIG_DECNET)
+- struct dn_dev __rcu *dn_ptr;
+-#endif
+ struct inet6_dev __rcu *ip6_ptr;
+ #if IS_ENABLED(CONFIG_AX25)
+ void *ax25_ptr;
+diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
+index 9460a5635c90b..c6a3080c965df 100644
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -225,11 +225,6 @@ static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
+ hook_head = rcu_dereference(net->nf.hooks_bridge[hook]);
+ #endif
+ break;
+-#if IS_ENABLED(CONFIG_DECNET)
+- case NFPROTO_DECNET:
+- hook_head = rcu_dereference(net->nf.hooks_decnet[hook]);
+- break;
+-#endif
+ default:
+ WARN_ON_ONCE(1);
+ break;
+diff --git a/include/linux/netfilter_defs.h b/include/linux/netfilter_defs.h
+index 8dddfb151f004..a5f7bef1b3a47 100644
+--- a/include/linux/netfilter_defs.h
++++ b/include/linux/netfilter_defs.h
+@@ -7,14 +7,6 @@
+ /* in/out/forward only */
+ #define NF_ARP_NUMHOOKS 3
+
+-/* max hook is NF_DN_ROUTE (6), also see uapi/linux/netfilter_decnet.h */
+-#define NF_DN_NUMHOOKS 7
+-
+-#if IS_ENABLED(CONFIG_DECNET)
+-/* Largest hook number + 1, see uapi/linux/netfilter_decnet.h */
+-#define NF_MAX_HOOKS NF_DN_NUMHOOKS
+-#else
+ #define NF_MAX_HOOKS NF_INET_NUMHOOKS
+-#endif
+
+ #endif
+diff --git a/include/net/dn.h b/include/net/dn.h
+deleted file mode 100644
+index 56ab0726c641a..0000000000000
+--- a/include/net/dn.h
++++ /dev/null
+@@ -1,231 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _NET_DN_H
+-#define _NET_DN_H
+-
+-#include <linux/dn.h>
+-#include <net/sock.h>
+-#include <net/flow.h>
+-#include <asm/byteorder.h>
+-#include <asm/unaligned.h>
+-
+-struct dn_scp /* Session Control Port */
+-{
+- unsigned char state;
+-#define DN_O 1 /* Open */
+-#define DN_CR 2 /* Connect Receive */
+-#define DN_DR 3 /* Disconnect Reject */
+-#define DN_DRC 4 /* Discon. Rej. Complete*/
+-#define DN_CC 5 /* Connect Confirm */
+-#define DN_CI 6 /* Connect Initiate */
+-#define DN_NR 7 /* No resources */
+-#define DN_NC 8 /* No communication */
+-#define DN_CD 9 /* Connect Delivery */
+-#define DN_RJ 10 /* Rejected */
+-#define DN_RUN 11 /* Running */
+-#define DN_DI 12 /* Disconnect Initiate */
+-#define DN_DIC 13 /* Disconnect Complete */
+-#define DN_DN 14 /* Disconnect Notificat */
+-#define DN_CL 15 /* Closed */
+-#define DN_CN 16 /* Closed Notification */
+-
+- __le16 addrloc;
+- __le16 addrrem;
+- __u16 numdat;
+- __u16 numoth;
+- __u16 numoth_rcv;
+- __u16 numdat_rcv;
+- __u16 ackxmt_dat;
+- __u16 ackxmt_oth;
+- __u16 ackrcv_dat;
+- __u16 ackrcv_oth;
+- __u8 flowrem_sw;
+- __u8 flowloc_sw;
+-#define DN_SEND 2
+-#define DN_DONTSEND 1
+-#define DN_NOCHANGE 0
+- __u16 flowrem_dat;
+- __u16 flowrem_oth;
+- __u16 flowloc_dat;
+- __u16 flowloc_oth;
+- __u8 services_rem;
+- __u8 services_loc;
+- __u8 info_rem;
+- __u8 info_loc;
+-
+- __u16 segsize_rem;
+- __u16 segsize_loc;
+-
+- __u8 nonagle;
+- __u8 multi_ireq;
+- __u8 accept_mode;
+- unsigned long seg_total; /* Running total of current segment */
+-
+- struct optdata_dn conndata_in;
+- struct optdata_dn conndata_out;
+- struct optdata_dn discdata_in;
+- struct optdata_dn discdata_out;
+- struct accessdata_dn accessdata;
+-
+- struct sockaddr_dn addr; /* Local address */
+- struct sockaddr_dn peer; /* Remote address */
+-
+- /*
+- * In this case the RTT estimation is not specified in the
+- * docs, nor is any back off algorithm. Here we follow well
+- * known tcp algorithms with a few small variations.
+- *
+- * snd_window: Max number of packets we send before we wait for
+- * an ack to come back. This will become part of a
+- * more complicated scheme when we support flow
+- * control.
+- *
+- * nsp_srtt: Round-Trip-Time (x8) in jiffies. This is a rolling
+- * average.
+- * nsp_rttvar: Round-Trip-Time-Varience (x4) in jiffies. This is the
+- * varience of the smoothed average (but calculated in
+- * a simpler way than for normal statistical varience
+- * calculations).
+- *
+- * nsp_rxtshift: Backoff counter. Value is zero normally, each time
+- * a packet is lost is increases by one until an ack
+- * is received. Its used to index an array of backoff
+- * multipliers.
+- */
+-#define NSP_MIN_WINDOW 1
+-#define NSP_MAX_WINDOW (0x07fe)
+- unsigned long max_window;
+- unsigned long snd_window;
+-#define NSP_INITIAL_SRTT (HZ)
+- unsigned long nsp_srtt;
+-#define NSP_INITIAL_RTTVAR (HZ*3)
+- unsigned long nsp_rttvar;
+-#define NSP_MAXRXTSHIFT 12
+- unsigned long nsp_rxtshift;
+-
+- /*
+- * Output queues, one for data, one for otherdata/linkservice
+- */
+- struct sk_buff_head data_xmit_queue;
+- struct sk_buff_head other_xmit_queue;
+-
+- /*
+- * Input queue for other data
+- */
+- struct sk_buff_head other_receive_queue;
+- int other_report;
+-
+- /*
+- * Stuff to do with the slow timer
+- */
+- unsigned long stamp; /* time of last transmit */
+- unsigned long persist;
+- int (*persist_fxn)(struct sock *sk);
+- unsigned long keepalive;
+- void (*keepalive_fxn)(struct sock *sk);
+-
+-};
+-
+-static inline struct dn_scp *DN_SK(struct sock *sk)
+-{
+- return (struct dn_scp *)(sk + 1);
+-}
+-
+-/*
+- * src,dst : Source and Destination DECnet addresses
+- * hops : Number of hops through the network
+- * dst_port, src_port : NSP port numbers
+- * services, info : Useful data extracted from conninit messages
+- * rt_flags : Routing flags byte
+- * nsp_flags : NSP layer flags byte
+- * segsize : Size of segment
+- * segnum : Number, for data, otherdata and linkservice
+- * xmit_count : Number of times we've transmitted this skb
+- * stamp : Time stamp of most recent transmission, used in RTT calculations
+- * iif: Input interface number
+- *
+- * As a general policy, this structure keeps all addresses in network
+- * byte order, and all else in host byte order. Thus dst, src, dst_port
+- * and src_port are in network order. All else is in host order.
+- *
+- */
+-#define DN_SKB_CB(skb) ((struct dn_skb_cb *)(skb)->cb)
+-struct dn_skb_cb {
+- __le16 dst;
+- __le16 src;
+- __u16 hops;
+- __le16 dst_port;
+- __le16 src_port;
+- __u8 services;
+- __u8 info;
+- __u8 rt_flags;
+- __u8 nsp_flags;
+- __u16 segsize;
+- __u16 segnum;
+- __u16 xmit_count;
+- unsigned long stamp;
+- int iif;
+-};
+-
+-static inline __le16 dn_eth2dn(unsigned char *ethaddr)
+-{
+- return get_unaligned((__le16 *)(ethaddr + 4));
+-}
+-
+-static inline __le16 dn_saddr2dn(struct sockaddr_dn *saddr)
+-{
+- return *(__le16 *)saddr->sdn_nodeaddr;
+-}
+-
+-static inline void dn_dn2eth(unsigned char *ethaddr, __le16 addr)
+-{
+- __u16 a = le16_to_cpu(addr);
+- ethaddr[0] = 0xAA;
+- ethaddr[1] = 0x00;
+- ethaddr[2] = 0x04;
+- ethaddr[3] = 0x00;
+- ethaddr[4] = (__u8)(a & 0xff);
+- ethaddr[5] = (__u8)(a >> 8);
+-}
+-
+-static inline void dn_sk_ports_copy(struct flowidn *fld, struct dn_scp *scp)
+-{
+- fld->fld_sport = scp->addrloc;
+- fld->fld_dport = scp->addrrem;
+-}
+-
+-unsigned int dn_mss_from_pmtu(struct net_device *dev, int mtu);
+-void dn_register_sysctl(void);
+-void dn_unregister_sysctl(void);
+-
+-#define DN_MENUVER_ACC 0x01
+-#define DN_MENUVER_USR 0x02
+-#define DN_MENUVER_PRX 0x04
+-#define DN_MENUVER_UIC 0x08
+-
+-struct sock *dn_sklist_find_listener(struct sockaddr_dn *addr);
+-struct sock *dn_find_by_skb(struct sk_buff *skb);
+-#define DN_ASCBUF_LEN 9
+-char *dn_addr2asc(__u16, char *);
+-int dn_destroy_timer(struct sock *sk);
+-
+-int dn_sockaddr2username(struct sockaddr_dn *addr, unsigned char *buf,
+- unsigned char type);
+-int dn_username2sockaddr(unsigned char *data, int len, struct sockaddr_dn *addr,
+- unsigned char *type);
+-
+-void dn_start_slow_timer(struct sock *sk);
+-void dn_stop_slow_timer(struct sock *sk);
+-
+-extern __le16 decnet_address;
+-extern int decnet_debug_level;
+-extern int decnet_time_wait;
+-extern int decnet_dn_count;
+-extern int decnet_di_count;
+-extern int decnet_dr_count;
+-extern int decnet_no_fc_max_cwnd;
+-
+-extern long sysctl_decnet_mem[3];
+-extern int sysctl_decnet_wmem[3];
+-extern int sysctl_decnet_rmem[3];
+-
+-#endif /* _NET_DN_H */
+diff --git a/include/net/dn_dev.h b/include/net/dn_dev.h
+deleted file mode 100644
+index 595b4f6c1eb10..0000000000000
+--- a/include/net/dn_dev.h
++++ /dev/null
+@@ -1,199 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _NET_DN_DEV_H
+-#define _NET_DN_DEV_H
+-
+-
+-struct dn_dev;
+-
+-struct dn_ifaddr {
+- struct dn_ifaddr __rcu *ifa_next;
+- struct dn_dev *ifa_dev;
+- __le16 ifa_local;
+- __le16 ifa_address;
+- __u32 ifa_flags;
+- __u8 ifa_scope;
+- char ifa_label[IFNAMSIZ];
+- struct rcu_head rcu;
+-};
+-
+-#define DN_DEV_S_RU 0 /* Run - working normally */
+-#define DN_DEV_S_CR 1 /* Circuit Rejected */
+-#define DN_DEV_S_DS 2 /* Data Link Start */
+-#define DN_DEV_S_RI 3 /* Routing Layer Initialize */
+-#define DN_DEV_S_RV 4 /* Routing Layer Verify */
+-#define DN_DEV_S_RC 5 /* Routing Layer Complete */
+-#define DN_DEV_S_OF 6 /* Off */
+-#define DN_DEV_S_HA 7 /* Halt */
+-
+-
+-/*
+- * The dn_dev_parms structure contains the set of parameters
+- * for each device (hence inclusion in the dn_dev structure)
+- * and an array is used to store the default types of supported
+- * device (in dn_dev.c).
+- *
+- * The type field matches the ARPHRD_ constants and is used in
+- * searching the list for supported devices when new devices
+- * come up.
+- *
+- * The mode field is used to find out if a device is broadcast,
+- * multipoint, or pointopoint. Please note that DECnet thinks
+- * different ways about devices to the rest of the kernel
+- * so the normal IFF_xxx flags are invalid here. For devices
+- * which can be any combination of the previously mentioned
+- * attributes, you can set this on a per device basis by
+- * installing an up() routine.
+- *
+- * The device state field, defines the initial state in which the
+- * device will come up. In the dn_dev structure, it is the actual
+- * state.
+- *
+- * Things have changed here. I've killed timer1 since it's a user space
+- * issue for a user space routing deamon to sort out. The kernel does
+- * not need to be bothered with it.
+- *
+- * Timers:
+- * t2 - Rate limit timer, min time between routing and hello messages
+- * t3 - Hello timer, send hello messages when it expires
+- *
+- * Callbacks:
+- * up() - Called to initialize device, return value can veto use of
+- * device with DECnet.
+- * down() - Called to turn device off when it goes down
+- * timer3() - Called once for each ifaddr when timer 3 goes off
+- *
+- * sysctl - Hook for sysctl things
+- *
+- */
+-struct dn_dev_parms {
+- int type; /* ARPHRD_xxx */
+- int mode; /* Broadcast, Unicast, Mulitpoint */
+-#define DN_DEV_BCAST 1
+-#define DN_DEV_UCAST 2
+-#define DN_DEV_MPOINT 4
+- int state; /* Initial state */
+- int forwarding; /* 0=EndNode, 1=L1Router, 2=L2Router */
+- unsigned long t2; /* Default value of t2 */
+- unsigned long t3; /* Default value of t3 */
+- int priority; /* Priority to be a router */
+- char *name; /* Name for sysctl */
+- int (*up)(struct net_device *);
+- void (*down)(struct net_device *);
+- void (*timer3)(struct net_device *, struct dn_ifaddr *ifa);
+- void *sysctl;
+-};
+-
+-
+-struct dn_dev {
+- struct dn_ifaddr __rcu *ifa_list;
+- struct net_device *dev;
+- struct dn_dev_parms parms;
+- char use_long;
+- struct timer_list timer;
+- unsigned long t3;
+- struct neigh_parms *neigh_parms;
+- __u8 addr[ETH_ALEN];
+- struct neighbour *router; /* Default router on circuit */
+- struct neighbour *peer; /* Peer on pointopoint links */
+- unsigned long uptime; /* Time device went up in jiffies */
+-};
+-
+-struct dn_short_packet {
+- __u8 msgflg;
+- __le16 dstnode;
+- __le16 srcnode;
+- __u8 forward;
+-} __packed;
+-
+-struct dn_long_packet {
+- __u8 msgflg;
+- __u8 d_area;
+- __u8 d_subarea;
+- __u8 d_id[6];
+- __u8 s_area;
+- __u8 s_subarea;
+- __u8 s_id[6];
+- __u8 nl2;
+- __u8 visit_ct;
+- __u8 s_class;
+- __u8 pt;
+-} __packed;
+-
+-/*------------------------- DRP - Routing messages ---------------------*/
+-
+-struct endnode_hello_message {
+- __u8 msgflg;
+- __u8 tiver[3];
+- __u8 id[6];
+- __u8 iinfo;
+- __le16 blksize;
+- __u8 area;
+- __u8 seed[8];
+- __u8 neighbor[6];
+- __le16 timer;
+- __u8 mpd;
+- __u8 datalen;
+- __u8 data[2];
+-} __packed;
+-
+-struct rtnode_hello_message {
+- __u8 msgflg;
+- __u8 tiver[3];
+- __u8 id[6];
+- __u8 iinfo;
+- __le16 blksize;
+- __u8 priority;
+- __u8 area;
+- __le16 timer;
+- __u8 mpd;
+-} __packed;
+-
+-
+-void dn_dev_init(void);
+-void dn_dev_cleanup(void);
+-
+-int dn_dev_ioctl(unsigned int cmd, void __user *arg);
+-
+-void dn_dev_devices_off(void);
+-void dn_dev_devices_on(void);
+-
+-void dn_dev_init_pkt(struct sk_buff *skb);
+-void dn_dev_veri_pkt(struct sk_buff *skb);
+-void dn_dev_hello(struct sk_buff *skb);
+-
+-void dn_dev_up(struct net_device *);
+-void dn_dev_down(struct net_device *);
+-
+-int dn_dev_set_default(struct net_device *dev, int force);
+-struct net_device *dn_dev_get_default(void);
+-int dn_dev_bind_default(__le16 *addr);
+-
+-int register_dnaddr_notifier(struct notifier_block *nb);
+-int unregister_dnaddr_notifier(struct notifier_block *nb);
+-
+-static inline int dn_dev_islocal(struct net_device *dev, __le16 addr)
+-{
+- struct dn_dev *dn_db;
+- struct dn_ifaddr *ifa;
+- int res = 0;
+-
+- rcu_read_lock();
+- dn_db = rcu_dereference(dev->dn_ptr);
+- if (dn_db == NULL) {
+- printk(KERN_DEBUG "dn_dev_islocal: Called for non DECnet device\n");
+- goto out;
+- }
+-
+- for (ifa = rcu_dereference(dn_db->ifa_list);
+- ifa != NULL;
+- ifa = rcu_dereference(ifa->ifa_next))
+- if ((addr ^ ifa->ifa_local) == 0) {
+- res = 1;
+- break;
+- }
+-out:
+- rcu_read_unlock();
+- return res;
+-}
+-
+-#endif /* _NET_DN_DEV_H */
+diff --git a/include/net/dn_fib.h b/include/net/dn_fib.h
+deleted file mode 100644
+index 6dd2213c5eb21..0000000000000
+--- a/include/net/dn_fib.h
++++ /dev/null
+@@ -1,167 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _NET_DN_FIB_H
+-#define _NET_DN_FIB_H
+-
+-#include <linux/netlink.h>
+-#include <linux/refcount.h>
+-
+-extern const struct nla_policy rtm_dn_policy[];
+-
+-struct dn_fib_res {
+- struct fib_rule *r;
+- struct dn_fib_info *fi;
+- unsigned char prefixlen;
+- unsigned char nh_sel;
+- unsigned char type;
+- unsigned char scope;
+-};
+-
+-struct dn_fib_nh {
+- struct net_device *nh_dev;
+- unsigned int nh_flags;
+- unsigned char nh_scope;
+- int nh_weight;
+- int nh_power;
+- int nh_oif;
+- __le16 nh_gw;
+-};
+-
+-struct dn_fib_info {
+- struct dn_fib_info *fib_next;
+- struct dn_fib_info *fib_prev;
+- int fib_treeref;
+- refcount_t fib_clntref;
+- int fib_dead;
+- unsigned int fib_flags;
+- int fib_protocol;
+- __le16 fib_prefsrc;
+- __u32 fib_priority;
+- __u32 fib_metrics[RTAX_MAX];
+- int fib_nhs;
+- int fib_power;
+- struct dn_fib_nh fib_nh[0];
+-#define dn_fib_dev fib_nh[0].nh_dev
+-};
+-
+-
+-#define DN_FIB_RES_RESET(res) ((res).nh_sel = 0)
+-#define DN_FIB_RES_NH(res) ((res).fi->fib_nh[(res).nh_sel])
+-
+-#define DN_FIB_RES_PREFSRC(res) ((res).fi->fib_prefsrc ? : __dn_fib_res_prefsrc(&res))
+-#define DN_FIB_RES_GW(res) (DN_FIB_RES_NH(res).nh_gw)
+-#define DN_FIB_RES_DEV(res) (DN_FIB_RES_NH(res).nh_dev)
+-#define DN_FIB_RES_OIF(res) (DN_FIB_RES_NH(res).nh_oif)
+-
+-typedef struct {
+- __le16 datum;
+-} dn_fib_key_t;
+-
+-typedef struct {
+- __le16 datum;
+-} dn_fib_hash_t;
+-
+-typedef struct {
+- __u16 datum;
+-} dn_fib_idx_t;
+-
+-struct dn_fib_node {
+- struct dn_fib_node *fn_next;
+- struct dn_fib_info *fn_info;
+-#define DN_FIB_INFO(f) ((f)->fn_info)
+- dn_fib_key_t fn_key;
+- u8 fn_type;
+- u8 fn_scope;
+- u8 fn_state;
+-};
+-
+-
+-struct dn_fib_table {
+- struct hlist_node hlist;
+- u32 n;
+-
+- int (*insert)(struct dn_fib_table *t, struct rtmsg *r,
+- struct nlattr *attrs[], struct nlmsghdr *n,
+- struct netlink_skb_parms *req);
+- int (*delete)(struct dn_fib_table *t, struct rtmsg *r,
+- struct nlattr *attrs[], struct nlmsghdr *n,
+- struct netlink_skb_parms *req);
+- int (*lookup)(struct dn_fib_table *t, const struct flowidn *fld,
+- struct dn_fib_res *res);
+- int (*flush)(struct dn_fib_table *t);
+- int (*dump)(struct dn_fib_table *t, struct sk_buff *skb, struct netlink_callback *cb);
+-
+- unsigned char data[0];
+-};
+-
+-#ifdef CONFIG_DECNET_ROUTER
+-/*
+- * dn_fib.c
+- */
+-void dn_fib_init(void);
+-void dn_fib_cleanup(void);
+-
+-int dn_fib_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
+-struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r,
+- struct nlattr *attrs[],
+- const struct nlmsghdr *nlh, int *errp);
+-int dn_fib_semantic_match(int type, struct dn_fib_info *fi,
+- const struct flowidn *fld, struct dn_fib_res *res);
+-void dn_fib_release_info(struct dn_fib_info *fi);
+-void dn_fib_flush(void);
+-void dn_fib_select_multipath(const struct flowidn *fld, struct dn_fib_res *res);
+-
+-/*
+- * dn_tables.c
+- */
+-struct dn_fib_table *dn_fib_get_table(u32 n, int creat);
+-struct dn_fib_table *dn_fib_empty_table(void);
+-void dn_fib_table_init(void);
+-void dn_fib_table_cleanup(void);
+-
+-/*
+- * dn_rules.c
+- */
+-void dn_fib_rules_init(void);
+-void dn_fib_rules_cleanup(void);
+-unsigned int dnet_addr_type(__le16 addr);
+-int dn_fib_lookup(struct flowidn *fld, struct dn_fib_res *res);
+-
+-int dn_fib_dump(struct sk_buff *skb, struct netlink_callback *cb);
+-
+-void dn_fib_free_info(struct dn_fib_info *fi);
+-
+-static inline void dn_fib_info_put(struct dn_fib_info *fi)
+-{
+- if (refcount_dec_and_test(&fi->fib_clntref))
+- dn_fib_free_info(fi);
+-}
+-
+-static inline void dn_fib_res_put(struct dn_fib_res *res)
+-{
+- if (res->fi)
+- dn_fib_info_put(res->fi);
+- if (res->r)
+- fib_rule_put(res->r);
+-}
+-
+-#else /* Endnode */
+-
+-#define dn_fib_init() do { } while(0)
+-#define dn_fib_cleanup() do { } while(0)
+-
+-#define dn_fib_lookup(fl, res) (-ESRCH)
+-#define dn_fib_info_put(fi) do { } while(0)
+-#define dn_fib_select_multipath(fl, res) do { } while(0)
+-#define dn_fib_rules_policy(saddr,res,flags) (0)
+-#define dn_fib_res_put(res) do { } while(0)
+-
+-#endif /* CONFIG_DECNET_ROUTER */
+-
+-static inline __le16 dnet_make_mask(int n)
+-{
+- if (n)
+- return cpu_to_le16(~((1 << (16 - n)) - 1));
+- return cpu_to_le16(0);
+-}
+-
+-#endif /* _NET_DN_FIB_H */
+diff --git a/include/net/dn_neigh.h b/include/net/dn_neigh.h
+deleted file mode 100644
+index 2e3e7793973a8..0000000000000
+--- a/include/net/dn_neigh.h
++++ /dev/null
+@@ -1,30 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _NET_DN_NEIGH_H
+-#define _NET_DN_NEIGH_H
+-
+-/*
+- * The position of the first two fields of
+- * this structure are critical - SJW
+- */
+-struct dn_neigh {
+- struct neighbour n;
+- __le16 addr;
+- unsigned long flags;
+-#define DN_NDFLAG_R1 0x0001 /* Router L1 */
+-#define DN_NDFLAG_R2 0x0002 /* Router L2 */
+-#define DN_NDFLAG_P3 0x0004 /* Phase III Node */
+- unsigned long blksize;
+- __u8 priority;
+-};
+-
+-void dn_neigh_init(void);
+-void dn_neigh_cleanup(void);
+-int dn_neigh_router_hello(struct net *net, struct sock *sk, struct sk_buff *skb);
+-int dn_neigh_endnode_hello(struct net *net, struct sock *sk, struct sk_buff *skb);
+-void dn_neigh_pointopoint_hello(struct sk_buff *skb);
+-int dn_neigh_elist(struct net_device *dev, unsigned char *ptr, int n);
+-int dn_to_neigh_output(struct net *net, struct sock *sk, struct sk_buff *skb);
+-
+-extern struct neigh_table dn_neigh_table;
+-
+-#endif /* _NET_DN_NEIGH_H */
+diff --git a/include/net/dn_nsp.h b/include/net/dn_nsp.h
+deleted file mode 100644
+index 413a15e5339cb..0000000000000
+--- a/include/net/dn_nsp.h
++++ /dev/null
+@@ -1,203 +0,0 @@
+-#ifndef _NET_DN_NSP_H
+-#define _NET_DN_NSP_H
+-/******************************************************************************
+- (c) 1995-1998 E.M. Serrat emserrat@geocities.com
+-
+- This program is free software; you can redistribute it and/or modify
+- it under the terms of the GNU General Public License as published by
+- the Free Software Foundation; either version 2 of the License, or
+- any later version.
+-
+- This program is distributed in the hope that it will be useful,
+- but WITHOUT ANY WARRANTY; without even the implied warranty of
+- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- GNU General Public License for more details.
+-*******************************************************************************/
+-/* dn_nsp.c functions prototyping */
+-
+-void dn_nsp_send_data_ack(struct sock *sk);
+-void dn_nsp_send_oth_ack(struct sock *sk);
+-void dn_send_conn_ack(struct sock *sk);
+-void dn_send_conn_conf(struct sock *sk, gfp_t gfp);
+-void dn_nsp_send_disc(struct sock *sk, unsigned char type,
+- unsigned short reason, gfp_t gfp);
+-void dn_nsp_return_disc(struct sk_buff *skb, unsigned char type,
+- unsigned short reason);
+-void dn_nsp_send_link(struct sock *sk, unsigned char lsflags, char fcval);
+-void dn_nsp_send_conninit(struct sock *sk, unsigned char flags);
+-
+-void dn_nsp_output(struct sock *sk);
+-int dn_nsp_check_xmit_queue(struct sock *sk, struct sk_buff *skb,
+- struct sk_buff_head *q, unsigned short acknum);
+-void dn_nsp_queue_xmit(struct sock *sk, struct sk_buff *skb, gfp_t gfp,
+- int oob);
+-unsigned long dn_nsp_persist(struct sock *sk);
+-int dn_nsp_xmit_timeout(struct sock *sk);
+-
+-int dn_nsp_rx(struct sk_buff *);
+-int dn_nsp_backlog_rcv(struct sock *sk, struct sk_buff *skb);
+-
+-struct sk_buff *dn_alloc_skb(struct sock *sk, int size, gfp_t pri);
+-struct sk_buff *dn_alloc_send_skb(struct sock *sk, size_t *size, int noblock,
+- long timeo, int *err);
+-
+-#define NSP_REASON_OK 0 /* No error */
+-#define NSP_REASON_NR 1 /* No resources */
+-#define NSP_REASON_UN 2 /* Unrecognised node name */
+-#define NSP_REASON_SD 3 /* Node shutting down */
+-#define NSP_REASON_ID 4 /* Invalid destination end user */
+-#define NSP_REASON_ER 5 /* End user lacks resources */
+-#define NSP_REASON_OB 6 /* Object too busy */
+-#define NSP_REASON_US 7 /* Unspecified error */
+-#define NSP_REASON_TP 8 /* Third-Party abort */
+-#define NSP_REASON_EA 9 /* End user has aborted the link */
+-#define NSP_REASON_IF 10 /* Invalid node name format */
+-#define NSP_REASON_LS 11 /* Local node shutdown */
+-#define NSP_REASON_LL 32 /* Node lacks logical-link resources */
+-#define NSP_REASON_LE 33 /* End user lacks logical-link resources */
+-#define NSP_REASON_UR 34 /* Unacceptable RQSTRID or PASSWORD field */
+-#define NSP_REASON_UA 36 /* Unacceptable ACCOUNT field */
+-#define NSP_REASON_TM 38 /* End user timed out logical link */
+-#define NSP_REASON_NU 39 /* Node unreachable */
+-#define NSP_REASON_NL 41 /* No-link message */
+-#define NSP_REASON_DC 42 /* Disconnect confirm */
+-#define NSP_REASON_IO 43 /* Image data field overflow */
+-
+-#define NSP_DISCINIT 0x38
+-#define NSP_DISCCONF 0x48
+-
+-/*------------------------- NSP - messages ------------------------------*/
+-/* Data Messages */
+-/*---------------*/
+-
+-/* Data Messages (data segment/interrupt/link service) */
+-
+-struct nsp_data_seg_msg {
+- __u8 msgflg;
+- __le16 dstaddr;
+- __le16 srcaddr;
+-} __packed;
+-
+-struct nsp_data_opt_msg {
+- __le16 acknum;
+- __le16 segnum;
+- __le16 lsflgs;
+-} __packed;
+-
+-struct nsp_data_opt_msg1 {
+- __le16 acknum;
+- __le16 segnum;
+-} __packed;
+-
+-
+-/* Acknowledgment Message (data/other data) */
+-struct nsp_data_ack_msg {
+- __u8 msgflg;
+- __le16 dstaddr;
+- __le16 srcaddr;
+- __le16 acknum;
+-} __packed;
+-
+-/* Connect Acknowledgment Message */
+-struct nsp_conn_ack_msg {
+- __u8 msgflg;
+- __le16 dstaddr;
+-} __packed;
+-
+-
+-/* Connect Initiate/Retransmit Initiate/Connect Confirm */
+-struct nsp_conn_init_msg {
+- __u8 msgflg;
+-#define NSP_CI 0x18 /* Connect Initiate */
+-#define NSP_RCI 0x68 /* Retrans. Conn Init */
+- __le16 dstaddr;
+- __le16 srcaddr;
+- __u8 services;
+-#define NSP_FC_NONE 0x00 /* Flow Control None */
+-#define NSP_FC_SRC 0x04 /* Seg Req. Count */
+-#define NSP_FC_SCMC 0x08 /* Sess. Control Mess */
+-#define NSP_FC_MASK 0x0c /* FC type mask */
+- __u8 info;
+- __le16 segsize;
+-} __packed;
+-
+-/* Disconnect Initiate/Disconnect Confirm */
+-struct nsp_disconn_init_msg {
+- __u8 msgflg;
+- __le16 dstaddr;
+- __le16 srcaddr;
+- __le16 reason;
+-} __packed;
+-
+-
+-
+-struct srcobj_fmt {
+- __u8 format;
+- __u8 task;
+- __le16 grpcode;
+- __le16 usrcode;
+- __u8 dlen;
+-} __packed;
+-
+-/*
+- * A collection of functions for manipulating the sequence
+- * numbers used in NSP. Similar in operation to the functions
+- * of the same name in TCP.
+- */
+-static __inline__ int dn_before(__u16 seq1, __u16 seq2)
+-{
+- seq1 &= 0x0fff;
+- seq2 &= 0x0fff;
+-
+- return (int)((seq1 - seq2) & 0x0fff) > 2048;
+-}
+-
+-
+-static __inline__ int dn_after(__u16 seq1, __u16 seq2)
+-{
+- seq1 &= 0x0fff;
+- seq2 &= 0x0fff;
+-
+- return (int)((seq2 - seq1) & 0x0fff) > 2048;
+-}
+-
+-static __inline__ int dn_equal(__u16 seq1, __u16 seq2)
+-{
+- return ((seq1 ^ seq2) & 0x0fff) == 0;
+-}
+-
+-static __inline__ int dn_before_or_equal(__u16 seq1, __u16 seq2)
+-{
+- return (dn_before(seq1, seq2) || dn_equal(seq1, seq2));
+-}
+-
+-static __inline__ void seq_add(__u16 *seq, __u16 off)
+-{
+- (*seq) += off;
+- (*seq) &= 0x0fff;
+-}
+-
+-static __inline__ int seq_next(__u16 seq1, __u16 seq2)
+-{
+- return dn_equal(seq1 + 1, seq2);
+-}
+-
+-/*
+- * Can we delay the ack ?
+- */
+-static __inline__ int sendack(__u16 seq)
+-{
+- return (int)((seq & 0x1000) ? 0 : 1);
+-}
+-
+-/*
+- * Is socket congested ?
+- */
+-static __inline__ int dn_congested(struct sock *sk)
+-{
+- return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
+-}
+-
+-#define DN_MAX_NSP_DATA_HEADER (11)
+-
+-#endif /* _NET_DN_NSP_H */
+diff --git a/include/net/dn_route.h b/include/net/dn_route.h
+deleted file mode 100644
+index 342d2503cba5c..0000000000000
+--- a/include/net/dn_route.h
++++ /dev/null
+@@ -1,123 +0,0 @@
+-#ifndef _NET_DN_ROUTE_H
+-#define _NET_DN_ROUTE_H
+-
+-/******************************************************************************
+- (c) 1995-1998 E.M. Serrat emserrat@geocities.com
+-
+- This program is free software; you can redistribute it and/or modify
+- it under the terms of the GNU General Public License as published by
+- the Free Software Foundation; either version 2 of the License, or
+- any later version.
+-
+- This program is distributed in the hope that it will be useful,
+- but WITHOUT ANY WARRANTY; without even the implied warranty of
+- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- GNU General Public License for more details.
+-*******************************************************************************/
+-
+-struct sk_buff *dn_alloc_skb(struct sock *sk, int size, gfp_t pri);
+-int dn_route_output_sock(struct dst_entry __rcu **pprt, struct flowidn *,
+- struct sock *sk, int flags);
+-int dn_cache_dump(struct sk_buff *skb, struct netlink_callback *cb);
+-void dn_rt_cache_flush(int delay);
+-int dn_route_rcv(struct sk_buff *skb, struct net_device *dev,
+- struct packet_type *pt, struct net_device *orig_dev);
+-
+-/* Masks for flags field */
+-#define DN_RT_F_PID 0x07 /* Mask for packet type */
+-#define DN_RT_F_PF 0x80 /* Padding Follows */
+-#define DN_RT_F_VER 0x40 /* Version =0 discard packet if ==1 */
+-#define DN_RT_F_IE 0x20 /* Intra Ethernet, Reserved in short pkt */
+-#define DN_RT_F_RTS 0x10 /* Packet is being returned to sender */
+-#define DN_RT_F_RQR 0x08 /* Return packet to sender upon non-delivery */
+-
+-/* Mask for types of routing packets */
+-#define DN_RT_PKT_MSK 0x06
+-/* Types of routing packets */
+-#define DN_RT_PKT_SHORT 0x02 /* Short routing packet */
+-#define DN_RT_PKT_LONG 0x06 /* Long routing packet */
+-
+-/* Mask for control/routing selection */
+-#define DN_RT_PKT_CNTL 0x01 /* Set to 1 if a control packet */
+-/* Types of control packets */
+-#define DN_RT_CNTL_MSK 0x0f /* Mask for control packets */
+-#define DN_RT_PKT_INIT 0x01 /* Initialisation packet */
+-#define DN_RT_PKT_VERI 0x03 /* Verification Message */
+-#define DN_RT_PKT_HELO 0x05 /* Hello and Test Message */
+-#define DN_RT_PKT_L1RT 0x07 /* Level 1 Routing Message */
+-#define DN_RT_PKT_L2RT 0x09 /* Level 2 Routing Message */
+-#define DN_RT_PKT_ERTH 0x0b /* Ethernet Router Hello */
+-#define DN_RT_PKT_EEDH 0x0d /* Ethernet EndNode Hello */
+-
+-/* Values for info field in hello message */
+-#define DN_RT_INFO_TYPE 0x03 /* Type mask */
+-#define DN_RT_INFO_L1RT 0x02 /* L1 Router */
+-#define DN_RT_INFO_L2RT 0x01 /* L2 Router */
+-#define DN_RT_INFO_ENDN 0x03 /* EndNode */
+-#define DN_RT_INFO_VERI 0x04 /* Verification Reqd. */
+-#define DN_RT_INFO_RJCT 0x08 /* Reject Flag, Reserved */
+-#define DN_RT_INFO_VFLD 0x10 /* Verification Failed, Reserved */
+-#define DN_RT_INFO_NOML 0x20 /* No Multicast traffic accepted */
+-#define DN_RT_INFO_BLKR 0x40 /* Blocking Requested */
+-
+-/*
+- * The fl structure is what we used to look up the route.
+- * The rt_saddr & rt_daddr entries are the same as key.saddr & key.daddr
+- * except for local input routes, where the rt_saddr = fl.fld_dst and
+- * rt_daddr = fl.fld_src to allow the route to be used for returning
+- * packets to the originating host.
+- */
+-struct dn_route {
+- struct dst_entry dst;
+- struct dn_route __rcu *dn_next;
+-
+- struct neighbour *n;
+-
+- struct flowidn fld;
+-
+- __le16 rt_saddr;
+- __le16 rt_daddr;
+- __le16 rt_gateway;
+- __le16 rt_local_src; /* Source used for forwarding packets */
+- __le16 rt_src_map;
+- __le16 rt_dst_map;
+-
+- unsigned int rt_flags;
+- unsigned int rt_type;
+-};
+-
+-static inline bool dn_is_input_route(struct dn_route *rt)
+-{
+- return rt->fld.flowidn_iif != 0;
+-}
+-
+-static inline bool dn_is_output_route(struct dn_route *rt)
+-{
+- return rt->fld.flowidn_iif == 0;
+-}
+-
+-void dn_route_init(void);
+-void dn_route_cleanup(void);
+-
+-#include <net/sock.h>
+-#include <linux/if_arp.h>
+-
+-static inline void dn_rt_send(struct sk_buff *skb)
+-{
+- dev_queue_xmit(skb);
+-}
+-
+-static inline void dn_rt_finish_output(struct sk_buff *skb, char *dst, char *src)
+-{
+- struct net_device *dev = skb->dev;
+-
+- if ((dev->type != ARPHRD_ETHER) && (dev->type != ARPHRD_LOOPBACK))
+- dst = NULL;
+-
+- if (dev_hard_header(skb, dev, ETH_P_DNA_RT, dst, src, skb->len) >= 0)
+- dn_rt_send(skb);
+- else
+- kfree_skb(skb);
+-}
+-
+-#endif /* _NET_DN_ROUTE_H */
+diff --git a/include/net/dst.h b/include/net/dst.h
+index d2728525df5a7..50258a8131377 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -247,12 +247,6 @@ static inline void dst_use_noref(struct dst_entry *dst, unsigned long time)
+ }
+ }
+
+-static inline void dst_hold_and_use(struct dst_entry *dst, unsigned long time)
+-{
+- dst_hold(dst);
+- dst_use_noref(dst, time);
+-}
+-
+ static inline struct dst_entry *dst_clone(struct dst_entry *dst)
+ {
+ if (dst)
+diff --git a/include/net/neighbour.h b/include/net/neighbour.h
+index 5ce035984a4dd..e58ef9e338de6 100644
+--- a/include/net/neighbour.h
++++ b/include/net/neighbour.h
+@@ -251,11 +251,6 @@ static inline void *neighbour_priv(const struct neighbour *n)
+ #define NEIGH_UPDATE_F_ADMIN 0x80000000
+
+
+-static inline bool neigh_key_eq16(const struct neighbour *n, const void *pkey)
+-{
+- return *(const u16 *)n->primary_key == *(const u16 *)pkey;
+-}
+-
+ static inline bool neigh_key_eq32(const struct neighbour *n, const void *pkey)
+ {
+ return *(const u32 *)n->primary_key == *(const u32 *)pkey;
+@@ -305,8 +300,6 @@ void neigh_table_init(int index, struct neigh_table *tbl);
+ int neigh_table_clear(int index, struct neigh_table *tbl);
+ struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
+ struct net_device *dev);
+-struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
+- const void *pkey);
+ struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
+ struct net_device *dev, bool want_ref);
+ static inline struct neighbour *neigh_create(struct neigh_table *tbl,
+diff --git a/include/net/netns/netfilter.h b/include/net/netns/netfilter.h
+index ca043342c0ebe..2e57312ac5893 100644
+--- a/include/net/netns/netfilter.h
++++ b/include/net/netns/netfilter.h
+@@ -25,9 +25,6 @@ struct netns_nf {
+ #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
+ struct nf_hook_entries __rcu *hooks_bridge[NF_INET_NUMHOOKS];
+ #endif
+-#if IS_ENABLED(CONFIG_DECNET)
+- struct nf_hook_entries __rcu *hooks_decnet[NF_DN_NUMHOOKS];
+-#endif
+ #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
+ bool defrag_ipv4;
+ #endif
+diff --git a/include/uapi/linux/dn.h b/include/uapi/linux/dn.h
+deleted file mode 100644
+index 36ca71bd8bbe2..0000000000000
+--- a/include/uapi/linux/dn.h
++++ /dev/null
+@@ -1,149 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+-#ifndef _LINUX_DN_H
+-#define _LINUX_DN_H
+-
+-#include <linux/ioctl.h>
+-#include <linux/types.h>
+-#include <linux/if_ether.h>
+-
+-/*
+-
+- DECnet Data Structures and Constants
+-
+-*/
+-
+-/*
+- * DNPROTO_NSP can't be the same as SOL_SOCKET,
+- * so increment each by one (compared to ULTRIX)
+- */
+-#define DNPROTO_NSP 2 /* NSP protocol number */
+-#define DNPROTO_ROU 3 /* Routing protocol number */
+-#define DNPROTO_NML 4 /* Net mgt protocol number */
+-#define DNPROTO_EVL 5 /* Evl protocol number (usr) */
+-#define DNPROTO_EVR 6 /* Evl protocol number (evl) */
+-#define DNPROTO_NSPT 7 /* NSP trace protocol number */
+-
+-
+-#define DN_ADDL 2
+-#define DN_MAXADDL 2 /* ULTRIX headers have 20 here, but pathworks has 2 */
+-#define DN_MAXOPTL 16
+-#define DN_MAXOBJL 16
+-#define DN_MAXACCL 40
+-#define DN_MAXALIASL 128
+-#define DN_MAXNODEL 256
+-#define DNBUFSIZE 65023
+-
+-/*
+- * SET/GET Socket options - must match the DSO_ numbers below
+- */
+-#define SO_CONDATA 1
+-#define SO_CONACCESS 2
+-#define SO_PROXYUSR 3
+-#define SO_LINKINFO 7
+-
+-#define DSO_CONDATA 1 /* Set/Get connect data */
+-#define DSO_DISDATA 10 /* Set/Get disconnect data */
+-#define DSO_CONACCESS 2 /* Set/Get connect access data */
+-#define DSO_ACCEPTMODE 4 /* Set/Get accept mode */
+-#define DSO_CONACCEPT 5 /* Accept deferred connection */
+-#define DSO_CONREJECT 6 /* Reject deferred connection */
+-#define DSO_LINKINFO 7 /* Set/Get link information */
+-#define DSO_STREAM 8 /* Set socket type to stream */
+-#define DSO_SEQPACKET 9 /* Set socket type to sequenced packet */
+-#define DSO_MAXWINDOW 11 /* Maximum window size allowed */
+-#define DSO_NODELAY 12 /* Turn off nagle */
+-#define DSO_CORK 13 /* Wait for more data! */
+-#define DSO_SERVICES 14 /* NSP Services field */
+-#define DSO_INFO 15 /* NSP Info field */
+-#define DSO_MAX 15 /* Maximum option number */
+-
+-
+-/* LINK States */
+-#define LL_INACTIVE 0
+-#define LL_CONNECTING 1
+-#define LL_RUNNING 2
+-#define LL_DISCONNECTING 3
+-
+-#define ACC_IMMED 0
+-#define ACC_DEFER 1
+-
+-#define SDF_WILD 1 /* Wild card object */
+-#define SDF_PROXY 2 /* Addr eligible for proxy */
+-#define SDF_UICPROXY 4 /* Use uic-based proxy */
+-
+-/* Structures */
+-
+-
+-struct dn_naddr {
+- __le16 a_len;
+- __u8 a_addr[DN_MAXADDL]; /* Two bytes little endian */
+-};
+-
+-struct sockaddr_dn {
+- __u16 sdn_family;
+- __u8 sdn_flags;
+- __u8 sdn_objnum;
+- __le16 sdn_objnamel;
+- __u8 sdn_objname[DN_MAXOBJL];
+- struct dn_naddr sdn_add;
+-};
+-#define sdn_nodeaddrl sdn_add.a_len /* Node address length */
+-#define sdn_nodeaddr sdn_add.a_addr /* Node address */
+-
+-
+-
+-/*
+- * DECnet set/get DSO_CONDATA, DSO_DISDATA (optional data) structure
+- */
+-struct optdata_dn {
+- __le16 opt_status; /* Extended status return */
+-#define opt_sts opt_status
+- __le16 opt_optl; /* Length of user data */
+- __u8 opt_data[16]; /* User data */
+-};
+-
+-struct accessdata_dn {
+- __u8 acc_accl;
+- __u8 acc_acc[DN_MAXACCL];
+- __u8 acc_passl;
+- __u8 acc_pass[DN_MAXACCL];
+- __u8 acc_userl;
+- __u8 acc_user[DN_MAXACCL];
+-};
+-
+-/*
+- * DECnet logical link information structure
+- */
+-struct linkinfo_dn {
+- __u16 idn_segsize; /* Segment size for link */
+- __u8 idn_linkstate; /* Logical link state */
+-};
+-
+-/*
+- * Ethernet address format (for DECnet)
+- */
+-union etheraddress {
+- __u8 dne_addr[ETH_ALEN]; /* Full ethernet address */
+- struct {
+- __u8 dne_hiord[4]; /* DECnet HIORD prefix */
+- __u8 dne_nodeaddr[2]; /* DECnet node address */
+- } dne_remote;
+-};
+-
+-
+-/*
+- * DECnet physical socket address format
+- */
+-struct dn_addr {
+- __le16 dna_family; /* AF_DECnet */
+- union etheraddress dna_netaddr; /* DECnet ethernet address */
+-};
+-
+-#define DECNET_IOCTL_BASE 0x89 /* PROTOPRIVATE range */
+-
+-#define SIOCSNETADDR _IOW(DECNET_IOCTL_BASE, 0xe0, struct dn_naddr)
+-#define SIOCGNETADDR _IOR(DECNET_IOCTL_BASE, 0xe1, struct dn_naddr)
+-#define OSIOCSNETADDR _IOW(DECNET_IOCTL_BASE, 0xe0, int)
+-#define OSIOCGNETADDR _IOR(DECNET_IOCTL_BASE, 0xe1, int)
+-
+-#endif /* _LINUX_DN_H */
+diff --git a/include/uapi/linux/netfilter_decnet.h b/include/uapi/linux/netfilter_decnet.h
+deleted file mode 100644
+index 61f1c7dfd0330..0000000000000
+--- a/include/uapi/linux/netfilter_decnet.h
++++ /dev/null
+@@ -1,82 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+-#ifndef __LINUX_DECNET_NETFILTER_H
+-#define __LINUX_DECNET_NETFILTER_H
+-
+-/* DECnet-specific defines for netfilter.
+- * This file (C) Steve Whitehouse 1999 derived from the
+- * ipv4 netfilter header file which is
+- * (C)1998 Rusty Russell -- This code is GPL.
+- */
+-
+-#include <linux/netfilter.h>
+-
+-/* only for userspace compatibility */
+-#ifndef __KERNEL__
+-
+-#include <limits.h> /* for INT_MIN, INT_MAX */
+-
+-/* IP Cache bits. */
+-/* Src IP address. */
+-#define NFC_DN_SRC 0x0001
+-/* Dest IP address. */
+-#define NFC_DN_DST 0x0002
+-/* Input device. */
+-#define NFC_DN_IF_IN 0x0004
+-/* Output device. */
+-#define NFC_DN_IF_OUT 0x0008
+-
+-/* kernel define is in netfilter_defs.h */
+-#define NF_DN_NUMHOOKS 7
+-#endif /* ! __KERNEL__ */
+-
+-/* DECnet Hooks */
+-/* After promisc drops, checksum checks. */
+-#define NF_DN_PRE_ROUTING 0
+-/* If the packet is destined for this box. */
+-#define NF_DN_LOCAL_IN 1
+-/* If the packet is destined for another interface. */
+-#define NF_DN_FORWARD 2
+-/* Packets coming from a local process. */
+-#define NF_DN_LOCAL_OUT 3
+-/* Packets about to hit the wire. */
+-#define NF_DN_POST_ROUTING 4
+-/* Input Hello Packets */
+-#define NF_DN_HELLO 5
+-/* Input Routing Packets */
+-#define NF_DN_ROUTE 6
+-
+-enum nf_dn_hook_priorities {
+- NF_DN_PRI_FIRST = INT_MIN,
+- NF_DN_PRI_CONNTRACK = -200,
+- NF_DN_PRI_MANGLE = -150,
+- NF_DN_PRI_NAT_DST = -100,
+- NF_DN_PRI_FILTER = 0,
+- NF_DN_PRI_NAT_SRC = 100,
+- NF_DN_PRI_DNRTMSG = 200,
+- NF_DN_PRI_LAST = INT_MAX,
+-};
+-
+-struct nf_dn_rtmsg {
+- int nfdn_ifindex;
+-};
+-
+-#define NFDN_RTMSG(r) ((unsigned char *)(r) + NLMSG_ALIGN(sizeof(struct nf_dn_rtmsg)))
+-
+-#ifndef __KERNEL__
+-/* backwards compatibility for userspace */
+-#define DNRMG_L1_GROUP 0x01
+-#define DNRMG_L2_GROUP 0x02
+-#endif
+-
+-enum {
+- DNRNG_NLGRP_NONE,
+-#define DNRNG_NLGRP_NONE DNRNG_NLGRP_NONE
+- DNRNG_NLGRP_L1,
+-#define DNRNG_NLGRP_L1 DNRNG_NLGRP_L1
+- DNRNG_NLGRP_L2,
+-#define DNRNG_NLGRP_L2 DNRNG_NLGRP_L2
+- __DNRNG_NLGRP_MAX
+-};
+-#define DNRNG_NLGRP_MAX (__DNRNG_NLGRP_MAX - 1)
+-
+-#endif /*__LINUX_DECNET_NETFILTER_H*/
+diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h
+index 3481cde43a841..c1e0c5df3d53f 100644
+--- a/include/uapi/linux/netlink.h
++++ b/include/uapi/linux/netlink.h
+@@ -20,7 +20,7 @@
+ #define NETLINK_CONNECTOR 11
+ #define NETLINK_NETFILTER 12 /* netfilter subsystem */
+ #define NETLINK_IP6_FW 13
+-#define NETLINK_DNRTMSG 14 /* DECnet routing messages */
++#define NETLINK_DNRTMSG 14 /* DECnet routing messages (obsolete) */
+ #define NETLINK_KOBJECT_UEVENT 15 /* Kernel messages to userspace */
+ #define NETLINK_GENERIC 16
+ /* leave room for NETLINK_DM (DM Events) */
+diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
+index ab1934a2b2e6e..416c1e0fdc918 100644
+--- a/kernel/kexec_file.c
++++ b/kernel/kexec_file.c
+@@ -793,10 +793,22 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi,
+ }
+
+ offset = ALIGN(offset, align);
++
++ /*
++ * Check if the segment contains the entry point, if so,
++ * calculate the value of image->start based on it.
++ * If the compiler has produced more than one .text section
++ * (Eg: .text.hot), they are generally after the main .text
++ * section, and they shall not be used to calculate
++ * image->start. So do not re-calculate image->start if it
++ * is not set to the initial value, and warn the user so they
++ * have a chance to fix their purgatory's linker script.
++ */
+ if (sechdrs[i].sh_flags & SHF_EXECINSTR &&
+ pi->ehdr->e_entry >= sechdrs[i].sh_addr &&
+ pi->ehdr->e_entry < (sechdrs[i].sh_addr
+- + sechdrs[i].sh_size)) {
++ + sechdrs[i].sh_size) &&
++ !WARN_ON(kbuf->image->start != pi->ehdr->e_entry)) {
+ kbuf->image->start -= sechdrs[i].sh_addr;
+ kbuf->image->start += kbuf->mem + offset;
+ }
+diff --git a/net/Kconfig b/net/Kconfig
+index 228dfa382eeca..4bef62b4c8062 100644
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -197,7 +197,6 @@ config BRIDGE_NETFILTER
+ source "net/netfilter/Kconfig"
+ source "net/ipv4/netfilter/Kconfig"
+ source "net/ipv6/netfilter/Kconfig"
+-source "net/decnet/netfilter/Kconfig"
+ source "net/bridge/netfilter/Kconfig"
+
+ endif
+@@ -214,7 +213,6 @@ source "net/802/Kconfig"
+ source "net/bridge/Kconfig"
+ source "net/dsa/Kconfig"
+ source "net/8021q/Kconfig"
+-source "net/decnet/Kconfig"
+ source "net/llc/Kconfig"
+ source "drivers/net/appletalk/Kconfig"
+ source "net/x25/Kconfig"
+diff --git a/net/Makefile b/net/Makefile
+index 449fc0b221f83..177b6fbac29cb 100644
+--- a/net/Makefile
++++ b/net/Makefile
+@@ -39,7 +39,6 @@ obj-$(CONFIG_AF_KCM) += kcm/
+ obj-$(CONFIG_STREAM_PARSER) += strparser/
+ obj-$(CONFIG_ATM) += atm/
+ obj-$(CONFIG_L2TP) += l2tp/
+-obj-$(CONFIG_DECNET) += decnet/
+ obj-$(CONFIG_PHONET) += phonet/
+ ifneq ($(CONFIG_VLAN_8021Q),)
+ obj-y += 8021q/
+diff --git a/net/core/dev.c b/net/core/dev.c
+index ba99adcd70878..a9c8660a2570f 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -9010,9 +9010,7 @@ void netdev_run_todo(void)
+ BUG_ON(!list_empty(&dev->ptype_specific));
+ WARN_ON(rcu_access_pointer(dev->ip_ptr));
+ WARN_ON(rcu_access_pointer(dev->ip6_ptr));
+-#if IS_ENABLED(CONFIG_DECNET)
+- WARN_ON(dev->dn_ptr);
+-#endif
++
+ if (dev->priv_destructor)
+ dev->priv_destructor(dev);
+ if (dev->needs_free_netdev)
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 2b96e9a7fc597..5b6f3175d55b8 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -476,37 +476,6 @@ struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
+ }
+ EXPORT_SYMBOL(neigh_lookup);
+
+-struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
+- const void *pkey)
+-{
+- struct neighbour *n;
+- unsigned int key_len = tbl->key_len;
+- u32 hash_val;
+- struct neigh_hash_table *nht;
+-
+- NEIGH_CACHE_STAT_INC(tbl, lookups);
+-
+- rcu_read_lock_bh();
+- nht = rcu_dereference_bh(tbl->nht);
+- hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
+-
+- for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
+- n != NULL;
+- n = rcu_dereference_bh(n->next)) {
+- if (!memcmp(n->primary_key, pkey, key_len) &&
+- net_eq(dev_net(n->dev), net)) {
+- if (!refcount_inc_not_zero(&n->refcnt))
+- n = NULL;
+- NEIGH_CACHE_STAT_INC(tbl, hits);
+- break;
+- }
+- }
+-
+- rcu_read_unlock_bh();
+- return n;
+-}
+-EXPORT_SYMBOL(neigh_lookup_nodev);
+-
+ struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
+ struct net_device *dev, bool want_ref)
+ {
+@@ -1661,9 +1630,6 @@ static struct neigh_table *neigh_find_table(int family)
+ case AF_INET6:
+ tbl = neigh_tables[NEIGH_ND_TABLE];
+ break;
+- case AF_DECnet:
+- tbl = neigh_tables[NEIGH_DN_TABLE];
+- break;
+ }
+
+ return tbl;
+diff --git a/net/decnet/Kconfig b/net/decnet/Kconfig
+deleted file mode 100644
+index dcc74956badd9..0000000000000
+--- a/net/decnet/Kconfig
++++ /dev/null
+@@ -1,42 +0,0 @@
+-#
+-# DECnet configuration
+-#
+-config DECNET
+- tristate "DECnet Support"
+- ---help---
+- The DECnet networking protocol was used in many products made by
+- Digital (now Compaq). It provides reliable stream and sequenced
+- packet communications over which run a variety of services similar
+- to those which run over TCP/IP.
+-
+- To find some tools to use with the kernel layer support, please
+- look at Patrick Caulfield's web site:
+- <http://linux-decnet.sourceforge.net/>.
+-
+- More detailed documentation is available in
+- <file:Documentation/networking/decnet.txt>.
+-
+- Be sure to say Y to "/proc file system support" and "Sysctl support"
+- below when using DECnet, since you will need sysctl support to aid
+- in configuration at run time.
+-
+- The DECnet code is also available as a module ( = code which can be
+- inserted in and removed from the running kernel whenever you want).
+- The module is called decnet.
+-
+-config DECNET_ROUTER
+- bool "DECnet: router support"
+- depends on DECNET
+- select FIB_RULES
+- ---help---
+- Add support for turning your DECnet Endnode into a level 1 or 2
+- router. This is an experimental, but functional option. If you
+- do say Y here, then make sure that you also say Y to "Kernel/User
+- network link driver", "Routing messages" and "Network packet
+- filtering". The first two are required to allow configuration via
+- rtnetlink (you will need Alexey Kuznetsov's iproute2 package
+- from <ftp://ftp.tux.org/pub/net/ip-routing/>). The "Network packet
+- filtering" option will be required for the forthcoming routing daemon
+- to work.
+-
+- See <file:Documentation/networking/decnet.txt> for more information.
+diff --git a/net/decnet/Makefile b/net/decnet/Makefile
+deleted file mode 100644
+index 07b38e441b2d0..0000000000000
+--- a/net/decnet/Makefile
++++ /dev/null
+@@ -1,10 +0,0 @@
+-# SPDX-License-Identifier: GPL-2.0
+-
+-obj-$(CONFIG_DECNET) += decnet.o
+-
+-decnet-y := af_decnet.o dn_nsp_in.o dn_nsp_out.o \
+- dn_route.o dn_dev.o dn_neigh.o dn_timer.o
+-decnet-$(CONFIG_DECNET_ROUTER) += dn_fib.o dn_rules.o dn_table.o
+-decnet-y += sysctl_net_decnet.o
+-
+-obj-$(CONFIG_NETFILTER) += netfilter/
+diff --git a/net/decnet/README b/net/decnet/README
+deleted file mode 100644
+index 60e7ec88c81fd..0000000000000
+--- a/net/decnet/README
++++ /dev/null
+@@ -1,8 +0,0 @@
+- Linux DECnet Project
+- ======================
+-
+-The documentation for this kernel subsystem is available in the
+-Documentation/networking subdirectory of this distribution and also
+-on line at http://www.chygwyn.com/DECnet/
+-
+-Steve Whitehouse <SteveW@ACM.org>
+diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
+deleted file mode 100644
+index cc70771059698..0000000000000
+--- a/net/decnet/af_decnet.c
++++ /dev/null
+@@ -1,2408 +0,0 @@
+-
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet Socket Layer Interface
+- *
+- * Authors: Eduardo Marcelo Serrat <emserrat@geocities.com>
+- * Patrick Caulfield <patrick@pandh.demon.co.uk>
+- *
+- * Changes:
+- * Steve Whitehouse: Copied from Eduardo Serrat and Patrick Caulfield's
+- * version of the code. Original copyright preserved
+- * below.
+- * Steve Whitehouse: Some bug fixes, cleaning up some code to make it
+- * compatible with my routing layer.
+- * Steve Whitehouse: Merging changes from Eduardo Serrat and Patrick
+- * Caulfield.
+- * Steve Whitehouse: Further bug fixes, checking module code still works
+- * with new routing layer.
+- * Steve Whitehouse: Additional set/get_sockopt() calls.
+- * Steve Whitehouse: Fixed TIOCINQ ioctl to be same as Eduardo's new
+- * code.
+- * Steve Whitehouse: recvmsg() changed to try and behave in a POSIX like
+- * way. Didn't manage it entirely, but its better.
+- * Steve Whitehouse: ditto for sendmsg().
+- * Steve Whitehouse: A selection of bug fixes to various things.
+- * Steve Whitehouse: Added TIOCOUTQ ioctl.
+- * Steve Whitehouse: Fixes to username2sockaddr & sockaddr2username.
+- * Steve Whitehouse: Fixes to connect() error returns.
+- * Patrick Caulfield: Fixes to delayed acceptance logic.
+- * David S. Miller: New socket locking
+- * Steve Whitehouse: Socket list hashing/locking
+- * Arnaldo C. Melo: use capable, not suser
+- * Steve Whitehouse: Removed unused code. Fix to use sk->allocation
+- * when required.
+- * Patrick Caulfield: /proc/net/decnet now has object name/number
+- * Steve Whitehouse: Fixed local port allocation, hashed sk list
+- * Matthew Wilcox: Fixes for dn_ioctl()
+- * Steve Whitehouse: New connect/accept logic to allow timeouts and
+- * prepare for sendpage etc.
+- */
+-
+-
+-/******************************************************************************
+- (c) 1995-1998 E.M. Serrat emserrat@geocities.com
+-
+- This program is free software; you can redistribute it and/or modify
+- it under the terms of the GNU General Public License as published by
+- the Free Software Foundation; either version 2 of the License, or
+- any later version.
+-
+- This program is distributed in the hope that it will be useful,
+- but WITHOUT ANY WARRANTY; without even the implied warranty of
+- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- GNU General Public License for more details.
+-
+-HISTORY:
+-
+-Version Kernel Date Author/Comments
+-------- ------ ---- ---------------
+-Version 0.0.1 2.0.30 01-dic-97 Eduardo Marcelo Serrat
+- (emserrat@geocities.com)
+-
+- First Development of DECnet Socket La-
+- yer for Linux. Only supports outgoing
+- connections.
+-
+-Version 0.0.2 2.1.105 20-jun-98 Patrick J. Caulfield
+- (patrick@pandh.demon.co.uk)
+-
+- Port to new kernel development version.
+-
+-Version 0.0.3 2.1.106 25-jun-98 Eduardo Marcelo Serrat
+- (emserrat@geocities.com)
+- _
+- Added support for incoming connections
+- so we can start developing server apps
+- on Linux.
+- -
+- Module Support
+-Version 0.0.4 2.1.109 21-jul-98 Eduardo Marcelo Serrat
+- (emserrat@geocities.com)
+- _
+- Added support for X11R6.4. Now we can
+- use DECnet transport for X on Linux!!!
+- -
+-Version 0.0.5 2.1.110 01-aug-98 Eduardo Marcelo Serrat
+- (emserrat@geocities.com)
+- Removed bugs on flow control
+- Removed bugs on incoming accessdata
+- order
+- -
+-Version 0.0.6 2.1.110 07-aug-98 Eduardo Marcelo Serrat
+- dn_recvmsg fixes
+-
+- Patrick J. Caulfield
+- dn_bind fixes
+-*******************************************************************************/
+-
+-#include <linux/module.h>
+-#include <linux/errno.h>
+-#include <linux/types.h>
+-#include <linux/slab.h>
+-#include <linux/socket.h>
+-#include <linux/in.h>
+-#include <linux/kernel.h>
+-#include <linux/sched/signal.h>
+-#include <linux/timer.h>
+-#include <linux/string.h>
+-#include <linux/sockios.h>
+-#include <linux/net.h>
+-#include <linux/netdevice.h>
+-#include <linux/inet.h>
+-#include <linux/route.h>
+-#include <linux/netfilter.h>
+-#include <linux/seq_file.h>
+-#include <net/sock.h>
+-#include <net/tcp_states.h>
+-#include <net/flow.h>
+-#include <asm/ioctls.h>
+-#include <linux/capability.h>
+-#include <linux/mm.h>
+-#include <linux/interrupt.h>
+-#include <linux/proc_fs.h>
+-#include <linux/stat.h>
+-#include <linux/init.h>
+-#include <linux/poll.h>
+-#include <linux/jiffies.h>
+-#include <net/net_namespace.h>
+-#include <net/neighbour.h>
+-#include <net/dst.h>
+-#include <net/fib_rules.h>
+-#include <net/tcp.h>
+-#include <net/dn.h>
+-#include <net/dn_nsp.h>
+-#include <net/dn_dev.h>
+-#include <net/dn_route.h>
+-#include <net/dn_fib.h>
+-#include <net/dn_neigh.h>
+-
+-struct dn_sock {
+- struct sock sk;
+- struct dn_scp scp;
+-};
+-
+-static void dn_keepalive(struct sock *sk);
+-
+-#define DN_SK_HASH_SHIFT 8
+-#define DN_SK_HASH_SIZE (1 << DN_SK_HASH_SHIFT)
+-#define DN_SK_HASH_MASK (DN_SK_HASH_SIZE - 1)
+-
+-
+-static const struct proto_ops dn_proto_ops;
+-static DEFINE_RWLOCK(dn_hash_lock);
+-static struct hlist_head dn_sk_hash[DN_SK_HASH_SIZE];
+-static struct hlist_head dn_wild_sk;
+-static atomic_long_t decnet_memory_allocated;
+-
+-static int __dn_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen, int flags);
+-static int __dn_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen, int flags);
+-
+-static struct hlist_head *dn_find_list(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- if (scp->addr.sdn_flags & SDF_WILD)
+- return hlist_empty(&dn_wild_sk) ? &dn_wild_sk : NULL;
+-
+- return &dn_sk_hash[le16_to_cpu(scp->addrloc) & DN_SK_HASH_MASK];
+-}
+-
+-/*
+- * Valid ports are those greater than zero and not already in use.
+- */
+-static int check_port(__le16 port)
+-{
+- struct sock *sk;
+-
+- if (port == 0)
+- return -1;
+-
+- sk_for_each(sk, &dn_sk_hash[le16_to_cpu(port) & DN_SK_HASH_MASK]) {
+- struct dn_scp *scp = DN_SK(sk);
+- if (scp->addrloc == port)
+- return -1;
+- }
+- return 0;
+-}
+-
+-static unsigned short port_alloc(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-static unsigned short port = 0x2000;
+- unsigned short i_port = port;
+-
+- while(check_port(cpu_to_le16(++port)) != 0) {
+- if (port == i_port)
+- return 0;
+- }
+-
+- scp->addrloc = cpu_to_le16(port);
+-
+- return 1;
+-}
+-
+-/*
+- * Since this is only ever called from user
+- * level, we don't need a write_lock() version
+- * of this.
+- */
+-static int dn_hash_sock(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- struct hlist_head *list;
+- int rv = -EUSERS;
+-
+- BUG_ON(sk_hashed(sk));
+-
+- write_lock_bh(&dn_hash_lock);
+-
+- if (!scp->addrloc && !port_alloc(sk))
+- goto out;
+-
+- rv = -EADDRINUSE;
+- if ((list = dn_find_list(sk)) == NULL)
+- goto out;
+-
+- sk_add_node(sk, list);
+- rv = 0;
+-out:
+- write_unlock_bh(&dn_hash_lock);
+- return rv;
+-}
+-
+-static void dn_unhash_sock(struct sock *sk)
+-{
+- write_lock(&dn_hash_lock);
+- sk_del_node_init(sk);
+- write_unlock(&dn_hash_lock);
+-}
+-
+-static void dn_unhash_sock_bh(struct sock *sk)
+-{
+- write_lock_bh(&dn_hash_lock);
+- sk_del_node_init(sk);
+- write_unlock_bh(&dn_hash_lock);
+-}
+-
+-static struct hlist_head *listen_hash(struct sockaddr_dn *addr)
+-{
+- int i;
+- unsigned int hash = addr->sdn_objnum;
+-
+- if (hash == 0) {
+- hash = addr->sdn_objnamel;
+- for(i = 0; i < le16_to_cpu(addr->sdn_objnamel); i++) {
+- hash ^= addr->sdn_objname[i];
+- hash ^= (hash << 3);
+- }
+- }
+-
+- return &dn_sk_hash[hash & DN_SK_HASH_MASK];
+-}
+-
+-/*
+- * Called to transform a socket from bound (i.e. with a local address)
+- * into a listening socket (doesn't need a local port number) and rehashes
+- * based upon the object name/number.
+- */
+-static void dn_rehash_sock(struct sock *sk)
+-{
+- struct hlist_head *list;
+- struct dn_scp *scp = DN_SK(sk);
+-
+- if (scp->addr.sdn_flags & SDF_WILD)
+- return;
+-
+- write_lock_bh(&dn_hash_lock);
+- sk_del_node_init(sk);
+- DN_SK(sk)->addrloc = 0;
+- list = listen_hash(&DN_SK(sk)->addr);
+- sk_add_node(sk, list);
+- write_unlock_bh(&dn_hash_lock);
+-}
+-
+-int dn_sockaddr2username(struct sockaddr_dn *sdn, unsigned char *buf, unsigned char type)
+-{
+- int len = 2;
+-
+- *buf++ = type;
+-
+- switch (type) {
+- case 0:
+- *buf++ = sdn->sdn_objnum;
+- break;
+- case 1:
+- *buf++ = 0;
+- *buf++ = le16_to_cpu(sdn->sdn_objnamel);
+- memcpy(buf, sdn->sdn_objname, le16_to_cpu(sdn->sdn_objnamel));
+- len = 3 + le16_to_cpu(sdn->sdn_objnamel);
+- break;
+- case 2:
+- memset(buf, 0, 5);
+- buf += 5;
+- *buf++ = le16_to_cpu(sdn->sdn_objnamel);
+- memcpy(buf, sdn->sdn_objname, le16_to_cpu(sdn->sdn_objnamel));
+- len = 7 + le16_to_cpu(sdn->sdn_objnamel);
+- break;
+- }
+-
+- return len;
+-}
+-
+-/*
+- * On reception of usernames, we handle types 1 and 0 for destination
+- * addresses only. Types 2 and 4 are used for source addresses, but the
+- * UIC, GIC are ignored and they are both treated the same way. Type 3
+- * is never used as I've no idea what its purpose might be or what its
+- * format is.
+- */
+-int dn_username2sockaddr(unsigned char *data, int len, struct sockaddr_dn *sdn, unsigned char *fmt)
+-{
+- unsigned char type;
+- int size = len;
+- int namel = 12;
+-
+- sdn->sdn_objnum = 0;
+- sdn->sdn_objnamel = cpu_to_le16(0);
+- memset(sdn->sdn_objname, 0, DN_MAXOBJL);
+-
+- if (len < 2)
+- return -1;
+-
+- len -= 2;
+- *fmt = *data++;
+- type = *data++;
+-
+- switch (*fmt) {
+- case 0:
+- sdn->sdn_objnum = type;
+- return 2;
+- case 1:
+- namel = 16;
+- break;
+- case 2:
+- len -= 4;
+- data += 4;
+- break;
+- case 4:
+- len -= 8;
+- data += 8;
+- break;
+- default:
+- return -1;
+- }
+-
+- len -= 1;
+-
+- if (len < 0)
+- return -1;
+-
+- sdn->sdn_objnamel = cpu_to_le16(*data++);
+- len -= le16_to_cpu(sdn->sdn_objnamel);
+-
+- if ((len < 0) || (le16_to_cpu(sdn->sdn_objnamel) > namel))
+- return -1;
+-
+- memcpy(sdn->sdn_objname, data, le16_to_cpu(sdn->sdn_objnamel));
+-
+- return size - len;
+-}
+-
+-struct sock *dn_sklist_find_listener(struct sockaddr_dn *addr)
+-{
+- struct hlist_head *list = listen_hash(addr);
+- struct sock *sk;
+-
+- read_lock(&dn_hash_lock);
+- sk_for_each(sk, list) {
+- struct dn_scp *scp = DN_SK(sk);
+- if (sk->sk_state != TCP_LISTEN)
+- continue;
+- if (scp->addr.sdn_objnum) {
+- if (scp->addr.sdn_objnum != addr->sdn_objnum)
+- continue;
+- } else {
+- if (addr->sdn_objnum)
+- continue;
+- if (scp->addr.sdn_objnamel != addr->sdn_objnamel)
+- continue;
+- if (memcmp(scp->addr.sdn_objname, addr->sdn_objname, le16_to_cpu(addr->sdn_objnamel)) != 0)
+- continue;
+- }
+- sock_hold(sk);
+- read_unlock(&dn_hash_lock);
+- return sk;
+- }
+-
+- sk = sk_head(&dn_wild_sk);
+- if (sk) {
+- if (sk->sk_state == TCP_LISTEN)
+- sock_hold(sk);
+- else
+- sk = NULL;
+- }
+-
+- read_unlock(&dn_hash_lock);
+- return sk;
+-}
+-
+-struct sock *dn_find_by_skb(struct sk_buff *skb)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- struct sock *sk;
+- struct dn_scp *scp;
+-
+- read_lock(&dn_hash_lock);
+- sk_for_each(sk, &dn_sk_hash[le16_to_cpu(cb->dst_port) & DN_SK_HASH_MASK]) {
+- scp = DN_SK(sk);
+- if (cb->src != dn_saddr2dn(&scp->peer))
+- continue;
+- if (cb->dst_port != scp->addrloc)
+- continue;
+- if (scp->addrrem && (cb->src_port != scp->addrrem))
+- continue;
+- sock_hold(sk);
+- goto found;
+- }
+- sk = NULL;
+-found:
+- read_unlock(&dn_hash_lock);
+- return sk;
+-}
+-
+-
+-
+-static void dn_destruct(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- skb_queue_purge(&scp->data_xmit_queue);
+- skb_queue_purge(&scp->other_xmit_queue);
+- skb_queue_purge(&scp->other_receive_queue);
+-
+- dst_release(rcu_dereference_check(sk->sk_dst_cache, 1));
+-}
+-
+-static unsigned long dn_memory_pressure;
+-
+-static void dn_enter_memory_pressure(struct sock *sk)
+-{
+- if (!dn_memory_pressure) {
+- dn_memory_pressure = 1;
+- }
+-}
+-
+-static struct proto dn_proto = {
+- .name = "NSP",
+- .owner = THIS_MODULE,
+- .enter_memory_pressure = dn_enter_memory_pressure,
+- .memory_pressure = &dn_memory_pressure,
+- .memory_allocated = &decnet_memory_allocated,
+- .sysctl_mem = sysctl_decnet_mem,
+- .sysctl_wmem = sysctl_decnet_wmem,
+- .sysctl_rmem = sysctl_decnet_rmem,
+- .max_header = DN_MAX_NSP_DATA_HEADER + 64,
+- .obj_size = sizeof(struct dn_sock),
+-};
+-
+-static struct sock *dn_alloc_sock(struct net *net, struct socket *sock, gfp_t gfp, int kern)
+-{
+- struct dn_scp *scp;
+- struct sock *sk = sk_alloc(net, PF_DECnet, gfp, &dn_proto, kern);
+-
+- if (!sk)
+- goto out;
+-
+- if (sock)
+- sock->ops = &dn_proto_ops;
+- sock_init_data(sock, sk);
+-
+- sk->sk_backlog_rcv = dn_nsp_backlog_rcv;
+- sk->sk_destruct = dn_destruct;
+- sk->sk_no_check_tx = 1;
+- sk->sk_family = PF_DECnet;
+- sk->sk_protocol = 0;
+- sk->sk_allocation = gfp;
+- sk->sk_sndbuf = sysctl_decnet_wmem[1];
+- sk->sk_rcvbuf = sysctl_decnet_rmem[1];
+-
+- /* Initialization of DECnet Session Control Port */
+- scp = DN_SK(sk);
+- scp->state = DN_O; /* Open */
+- scp->numdat = 1; /* Next data seg to tx */
+- scp->numoth = 1; /* Next oth data to tx */
+- scp->ackxmt_dat = 0; /* Last data seg ack'ed */
+- scp->ackxmt_oth = 0; /* Last oth data ack'ed */
+- scp->ackrcv_dat = 0; /* Highest data ack recv*/
+- scp->ackrcv_oth = 0; /* Last oth data ack rec*/
+- scp->flowrem_sw = DN_SEND;
+- scp->flowloc_sw = DN_SEND;
+- scp->flowrem_dat = 0;
+- scp->flowrem_oth = 1;
+- scp->flowloc_dat = 0;
+- scp->flowloc_oth = 1;
+- scp->services_rem = 0;
+- scp->services_loc = 1 | NSP_FC_NONE;
+- scp->info_rem = 0;
+- scp->info_loc = 0x03; /* NSP version 4.1 */
+- scp->segsize_rem = 230 - DN_MAX_NSP_DATA_HEADER; /* Default: Updated by remote segsize */
+- scp->nonagle = 0;
+- scp->multi_ireq = 1;
+- scp->accept_mode = ACC_IMMED;
+- scp->addr.sdn_family = AF_DECnet;
+- scp->peer.sdn_family = AF_DECnet;
+- scp->accessdata.acc_accl = 5;
+- memcpy(scp->accessdata.acc_acc, "LINUX", 5);
+-
+- scp->max_window = NSP_MAX_WINDOW;
+- scp->snd_window = NSP_MIN_WINDOW;
+- scp->nsp_srtt = NSP_INITIAL_SRTT;
+- scp->nsp_rttvar = NSP_INITIAL_RTTVAR;
+- scp->nsp_rxtshift = 0;
+-
+- skb_queue_head_init(&scp->data_xmit_queue);
+- skb_queue_head_init(&scp->other_xmit_queue);
+- skb_queue_head_init(&scp->other_receive_queue);
+-
+- scp->persist = 0;
+- scp->persist_fxn = NULL;
+- scp->keepalive = 10 * HZ;
+- scp->keepalive_fxn = dn_keepalive;
+-
+- dn_start_slow_timer(sk);
+-out:
+- return sk;
+-}
+-
+-/*
+- * Keepalive timer.
+- * FIXME: Should respond to SO_KEEPALIVE etc.
+- */
+-static void dn_keepalive(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- /*
+- * By checking the other_data transmit queue is empty
+- * we are double checking that we are not sending too
+- * many of these keepalive frames.
+- */
+- if (skb_queue_empty(&scp->other_xmit_queue))
+- dn_nsp_send_link(sk, DN_NOCHANGE, 0);
+-}
+-
+-
+-/*
+- * Timer for shutdown/destroyed sockets.
+- * When socket is dead & no packets have been sent for a
+- * certain amount of time, they are removed by this
+- * routine. Also takes care of sending out DI & DC
+- * frames at correct times.
+- */
+-int dn_destroy_timer(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- scp->persist = dn_nsp_persist(sk);
+-
+- switch (scp->state) {
+- case DN_DI:
+- dn_nsp_send_disc(sk, NSP_DISCINIT, 0, GFP_ATOMIC);
+- if (scp->nsp_rxtshift >= decnet_di_count)
+- scp->state = DN_CN;
+- return 0;
+-
+- case DN_DR:
+- dn_nsp_send_disc(sk, NSP_DISCINIT, 0, GFP_ATOMIC);
+- if (scp->nsp_rxtshift >= decnet_dr_count)
+- scp->state = DN_DRC;
+- return 0;
+-
+- case DN_DN:
+- if (scp->nsp_rxtshift < decnet_dn_count) {
+- /* printk(KERN_DEBUG "dn_destroy_timer: DN\n"); */
+- dn_nsp_send_disc(sk, NSP_DISCCONF, NSP_REASON_DC,
+- GFP_ATOMIC);
+- return 0;
+- }
+- }
+-
+- scp->persist = (HZ * decnet_time_wait);
+-
+- if (sk->sk_socket)
+- return 0;
+-
+- if (time_after_eq(jiffies, scp->stamp + HZ * decnet_time_wait)) {
+- dn_unhash_sock(sk);
+- sock_put(sk);
+- return 1;
+- }
+-
+- return 0;
+-}
+-
+-static void dn_destroy_sock(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- scp->nsp_rxtshift = 0; /* reset back off */
+-
+- if (sk->sk_socket) {
+- if (sk->sk_socket->state != SS_UNCONNECTED)
+- sk->sk_socket->state = SS_DISCONNECTING;
+- }
+-
+- sk->sk_state = TCP_CLOSE;
+-
+- switch (scp->state) {
+- case DN_DN:
+- dn_nsp_send_disc(sk, NSP_DISCCONF, NSP_REASON_DC,
+- sk->sk_allocation);
+- scp->persist_fxn = dn_destroy_timer;
+- scp->persist = dn_nsp_persist(sk);
+- break;
+- case DN_CR:
+- scp->state = DN_DR;
+- goto disc_reject;
+- case DN_RUN:
+- scp->state = DN_DI;
+- /* fall through */
+- case DN_DI:
+- case DN_DR:
+-disc_reject:
+- dn_nsp_send_disc(sk, NSP_DISCINIT, 0, sk->sk_allocation);
+- /* fall through */
+- case DN_NC:
+- case DN_NR:
+- case DN_RJ:
+- case DN_DIC:
+- case DN_CN:
+- case DN_DRC:
+- case DN_CI:
+- case DN_CD:
+- scp->persist_fxn = dn_destroy_timer;
+- scp->persist = dn_nsp_persist(sk);
+- break;
+- default:
+- printk(KERN_DEBUG "DECnet: dn_destroy_sock passed socket in invalid state\n");
+- /* fall through */
+- case DN_O:
+- dn_stop_slow_timer(sk);
+-
+- dn_unhash_sock_bh(sk);
+- sock_put(sk);
+-
+- break;
+- }
+-}
+-
+-char *dn_addr2asc(__u16 addr, char *buf)
+-{
+- unsigned short node, area;
+-
+- node = addr & 0x03ff;
+- area = addr >> 10;
+- sprintf(buf, "%hd.%hd", area, node);
+-
+- return buf;
+-}
+-
+-
+-
+-static int dn_create(struct net *net, struct socket *sock, int protocol,
+- int kern)
+-{
+- struct sock *sk;
+-
+- if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
+- return -EINVAL;
+-
+- if (!net_eq(net, &init_net))
+- return -EAFNOSUPPORT;
+-
+- switch (sock->type) {
+- case SOCK_SEQPACKET:
+- if (protocol != DNPROTO_NSP)
+- return -EPROTONOSUPPORT;
+- break;
+- case SOCK_STREAM:
+- break;
+- default:
+- return -ESOCKTNOSUPPORT;
+- }
+-
+-
+- if ((sk = dn_alloc_sock(net, sock, GFP_KERNEL, kern)) == NULL)
+- return -ENOBUFS;
+-
+- sk->sk_protocol = protocol;
+-
+- return 0;
+-}
+-
+-
+-static int
+-dn_release(struct socket *sock)
+-{
+- struct sock *sk = sock->sk;
+-
+- if (sk) {
+- sock_orphan(sk);
+- sock_hold(sk);
+- lock_sock(sk);
+- dn_destroy_sock(sk);
+- release_sock(sk);
+- sock_put(sk);
+- }
+-
+- return 0;
+-}
+-
+-static int dn_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+-{
+- struct sock *sk = sock->sk;
+- struct dn_scp *scp = DN_SK(sk);
+- struct sockaddr_dn *saddr = (struct sockaddr_dn *)uaddr;
+- struct net_device *dev, *ldev;
+- int rv;
+-
+- if (addr_len != sizeof(struct sockaddr_dn))
+- return -EINVAL;
+-
+- if (saddr->sdn_family != AF_DECnet)
+- return -EINVAL;
+-
+- if (le16_to_cpu(saddr->sdn_nodeaddrl) && (le16_to_cpu(saddr->sdn_nodeaddrl) != 2))
+- return -EINVAL;
+-
+- if (le16_to_cpu(saddr->sdn_objnamel) > DN_MAXOBJL)
+- return -EINVAL;
+-
+- if (saddr->sdn_flags & ~SDF_WILD)
+- return -EINVAL;
+-
+- if (!capable(CAP_NET_BIND_SERVICE) && (saddr->sdn_objnum ||
+- (saddr->sdn_flags & SDF_WILD)))
+- return -EACCES;
+-
+- if (!(saddr->sdn_flags & SDF_WILD)) {
+- if (le16_to_cpu(saddr->sdn_nodeaddrl)) {
+- rcu_read_lock();
+- ldev = NULL;
+- for_each_netdev_rcu(&init_net, dev) {
+- if (!dev->dn_ptr)
+- continue;
+- if (dn_dev_islocal(dev, dn_saddr2dn(saddr))) {
+- ldev = dev;
+- break;
+- }
+- }
+- rcu_read_unlock();
+- if (ldev == NULL)
+- return -EADDRNOTAVAIL;
+- }
+- }
+-
+- rv = -EINVAL;
+- lock_sock(sk);
+- if (sock_flag(sk, SOCK_ZAPPED)) {
+- memcpy(&scp->addr, saddr, addr_len);
+- sock_reset_flag(sk, SOCK_ZAPPED);
+-
+- rv = dn_hash_sock(sk);
+- if (rv)
+- sock_set_flag(sk, SOCK_ZAPPED);
+- }
+- release_sock(sk);
+-
+- return rv;
+-}
+-
+-
+-static int dn_auto_bind(struct socket *sock)
+-{
+- struct sock *sk = sock->sk;
+- struct dn_scp *scp = DN_SK(sk);
+- int rv;
+-
+- sock_reset_flag(sk, SOCK_ZAPPED);
+-
+- scp->addr.sdn_flags = 0;
+- scp->addr.sdn_objnum = 0;
+-
+- /*
+- * This stuff is to keep compatibility with Eduardo's
+- * patch. I hope I can dispense with it shortly...
+- */
+- if ((scp->accessdata.acc_accl != 0) &&
+- (scp->accessdata.acc_accl <= 12)) {
+-
+- scp->addr.sdn_objnamel = cpu_to_le16(scp->accessdata.acc_accl);
+- memcpy(scp->addr.sdn_objname, scp->accessdata.acc_acc, le16_to_cpu(scp->addr.sdn_objnamel));
+-
+- scp->accessdata.acc_accl = 0;
+- memset(scp->accessdata.acc_acc, 0, 40);
+- }
+- /* End of compatibility stuff */
+-
+- scp->addr.sdn_add.a_len = cpu_to_le16(2);
+- rv = dn_dev_bind_default((__le16 *)scp->addr.sdn_add.a_addr);
+- if (rv == 0) {
+- rv = dn_hash_sock(sk);
+- if (rv)
+- sock_set_flag(sk, SOCK_ZAPPED);
+- }
+-
+- return rv;
+-}
+-
+-static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- DEFINE_WAIT_FUNC(wait, woken_wake_function);
+- int err;
+-
+- if (scp->state != DN_CR)
+- return -EINVAL;
+-
+- scp->state = DN_CC;
+- scp->segsize_loc = dst_metric_advmss(__sk_dst_get(sk));
+- dn_send_conn_conf(sk, allocation);
+-
+- add_wait_queue(sk_sleep(sk), &wait);
+- for(;;) {
+- release_sock(sk);
+- if (scp->state == DN_CC)
+- *timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, *timeo);
+- lock_sock(sk);
+- err = 0;
+- if (scp->state == DN_RUN)
+- break;
+- err = sock_error(sk);
+- if (err)
+- break;
+- err = sock_intr_errno(*timeo);
+- if (signal_pending(current))
+- break;
+- err = -EAGAIN;
+- if (!*timeo)
+- break;
+- }
+- remove_wait_queue(sk_sleep(sk), &wait);
+- if (err == 0) {
+- sk->sk_socket->state = SS_CONNECTED;
+- } else if (scp->state != DN_CC) {
+- sk->sk_socket->state = SS_UNCONNECTED;
+- }
+- return err;
+-}
+-
+-static int dn_wait_run(struct sock *sk, long *timeo)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- DEFINE_WAIT_FUNC(wait, woken_wake_function);
+- int err = 0;
+-
+- if (scp->state == DN_RUN)
+- goto out;
+-
+- if (!*timeo)
+- return -EALREADY;
+-
+- add_wait_queue(sk_sleep(sk), &wait);
+- for(;;) {
+- release_sock(sk);
+- if (scp->state == DN_CI || scp->state == DN_CC)
+- *timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, *timeo);
+- lock_sock(sk);
+- err = 0;
+- if (scp->state == DN_RUN)
+- break;
+- err = sock_error(sk);
+- if (err)
+- break;
+- err = sock_intr_errno(*timeo);
+- if (signal_pending(current))
+- break;
+- err = -ETIMEDOUT;
+- if (!*timeo)
+- break;
+- }
+- remove_wait_queue(sk_sleep(sk), &wait);
+-out:
+- if (err == 0) {
+- sk->sk_socket->state = SS_CONNECTED;
+- } else if (scp->state != DN_CI && scp->state != DN_CC) {
+- sk->sk_socket->state = SS_UNCONNECTED;
+- }
+- return err;
+-}
+-
+-static int __dn_connect(struct sock *sk, struct sockaddr_dn *addr, int addrlen, long *timeo, int flags)
+-{
+- struct socket *sock = sk->sk_socket;
+- struct dn_scp *scp = DN_SK(sk);
+- int err = -EISCONN;
+- struct flowidn fld;
+- struct dst_entry *dst;
+-
+- if (sock->state == SS_CONNECTED)
+- goto out;
+-
+- if (sock->state == SS_CONNECTING) {
+- err = 0;
+- if (scp->state == DN_RUN) {
+- sock->state = SS_CONNECTED;
+- goto out;
+- }
+- err = -ECONNREFUSED;
+- if (scp->state != DN_CI && scp->state != DN_CC) {
+- sock->state = SS_UNCONNECTED;
+- goto out;
+- }
+- return dn_wait_run(sk, timeo);
+- }
+-
+- err = -EINVAL;
+- if (scp->state != DN_O)
+- goto out;
+-
+- if (addr == NULL || addrlen != sizeof(struct sockaddr_dn))
+- goto out;
+- if (addr->sdn_family != AF_DECnet)
+- goto out;
+- if (addr->sdn_flags & SDF_WILD)
+- goto out;
+-
+- if (sock_flag(sk, SOCK_ZAPPED)) {
+- err = dn_auto_bind(sk->sk_socket);
+- if (err)
+- goto out;
+- }
+-
+- memcpy(&scp->peer, addr, sizeof(struct sockaddr_dn));
+-
+- err = -EHOSTUNREACH;
+- memset(&fld, 0, sizeof(fld));
+- fld.flowidn_oif = sk->sk_bound_dev_if;
+- fld.daddr = dn_saddr2dn(&scp->peer);
+- fld.saddr = dn_saddr2dn(&scp->addr);
+- dn_sk_ports_copy(&fld, scp);
+- fld.flowidn_proto = DNPROTO_NSP;
+- if (dn_route_output_sock(&sk->sk_dst_cache, &fld, sk, flags) < 0)
+- goto out;
+- dst = __sk_dst_get(sk);
+- sk->sk_route_caps = dst->dev->features;
+- sock->state = SS_CONNECTING;
+- scp->state = DN_CI;
+- scp->segsize_loc = dst_metric_advmss(dst);
+-
+- dn_nsp_send_conninit(sk, NSP_CI);
+- err = -EINPROGRESS;
+- if (*timeo) {
+- err = dn_wait_run(sk, timeo);
+- }
+-out:
+- return err;
+-}
+-
+-static int dn_connect(struct socket *sock, struct sockaddr *uaddr, int addrlen, int flags)
+-{
+- struct sockaddr_dn *addr = (struct sockaddr_dn *)uaddr;
+- struct sock *sk = sock->sk;
+- int err;
+- long timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
+-
+- lock_sock(sk);
+- err = __dn_connect(sk, addr, addrlen, &timeo, 0);
+- release_sock(sk);
+-
+- return err;
+-}
+-
+-static inline int dn_check_state(struct sock *sk, struct sockaddr_dn *addr, int addrlen, long *timeo, int flags)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- switch (scp->state) {
+- case DN_RUN:
+- return 0;
+- case DN_CR:
+- return dn_confirm_accept(sk, timeo, sk->sk_allocation);
+- case DN_CI:
+- case DN_CC:
+- return dn_wait_run(sk, timeo);
+- case DN_O:
+- return __dn_connect(sk, addr, addrlen, timeo, flags);
+- }
+-
+- return -EINVAL;
+-}
+-
+-
+-static void dn_access_copy(struct sk_buff *skb, struct accessdata_dn *acc)
+-{
+- unsigned char *ptr = skb->data;
+-
+- acc->acc_userl = *ptr++;
+- memcpy(&acc->acc_user, ptr, acc->acc_userl);
+- ptr += acc->acc_userl;
+-
+- acc->acc_passl = *ptr++;
+- memcpy(&acc->acc_pass, ptr, acc->acc_passl);
+- ptr += acc->acc_passl;
+-
+- acc->acc_accl = *ptr++;
+- memcpy(&acc->acc_acc, ptr, acc->acc_accl);
+-
+- skb_pull(skb, acc->acc_accl + acc->acc_passl + acc->acc_userl + 3);
+-
+-}
+-
+-static void dn_user_copy(struct sk_buff *skb, struct optdata_dn *opt)
+-{
+- unsigned char *ptr = skb->data;
+- u16 len = *ptr++; /* yes, it's 8bit on the wire */
+-
+- BUG_ON(len > 16); /* we've checked the contents earlier */
+- opt->opt_optl = cpu_to_le16(len);
+- opt->opt_status = 0;
+- memcpy(opt->opt_data, ptr, len);
+- skb_pull(skb, len + 1);
+-}
+-
+-static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo)
+-{
+- DEFINE_WAIT_FUNC(wait, woken_wake_function);
+- struct sk_buff *skb = NULL;
+- int err = 0;
+-
+- add_wait_queue(sk_sleep(sk), &wait);
+- for(;;) {
+- release_sock(sk);
+- skb = skb_dequeue(&sk->sk_receive_queue);
+- if (skb == NULL) {
+- *timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, *timeo);
+- skb = skb_dequeue(&sk->sk_receive_queue);
+- }
+- lock_sock(sk);
+- if (skb != NULL)
+- break;
+- err = -EINVAL;
+- if (sk->sk_state != TCP_LISTEN)
+- break;
+- err = sock_intr_errno(*timeo);
+- if (signal_pending(current))
+- break;
+- err = -EAGAIN;
+- if (!*timeo)
+- break;
+- }
+- remove_wait_queue(sk_sleep(sk), &wait);
+-
+- return skb == NULL ? ERR_PTR(err) : skb;
+-}
+-
+-static int dn_accept(struct socket *sock, struct socket *newsock, int flags,
+- bool kern)
+-{
+- struct sock *sk = sock->sk, *newsk;
+- struct sk_buff *skb = NULL;
+- struct dn_skb_cb *cb;
+- unsigned char menuver;
+- int err = 0;
+- unsigned char type;
+- long timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
+- struct dst_entry *dst;
+-
+- lock_sock(sk);
+-
+- if (sk->sk_state != TCP_LISTEN || DN_SK(sk)->state != DN_O) {
+- release_sock(sk);
+- return -EINVAL;
+- }
+-
+- skb = skb_dequeue(&sk->sk_receive_queue);
+- if (skb == NULL) {
+- skb = dn_wait_for_connect(sk, &timeo);
+- if (IS_ERR(skb)) {
+- release_sock(sk);
+- return PTR_ERR(skb);
+- }
+- }
+-
+- cb = DN_SKB_CB(skb);
+- sk->sk_ack_backlog--;
+- newsk = dn_alloc_sock(sock_net(sk), newsock, sk->sk_allocation, kern);
+- if (newsk == NULL) {
+- release_sock(sk);
+- kfree_skb(skb);
+- return -ENOBUFS;
+- }
+- release_sock(sk);
+-
+- dst = skb_dst(skb);
+- sk_dst_set(newsk, dst);
+- skb_dst_set(skb, NULL);
+-
+- DN_SK(newsk)->state = DN_CR;
+- DN_SK(newsk)->addrrem = cb->src_port;
+- DN_SK(newsk)->services_rem = cb->services;
+- DN_SK(newsk)->info_rem = cb->info;
+- DN_SK(newsk)->segsize_rem = cb->segsize;
+- DN_SK(newsk)->accept_mode = DN_SK(sk)->accept_mode;
+-
+- if (DN_SK(newsk)->segsize_rem < 230)
+- DN_SK(newsk)->segsize_rem = 230;
+-
+- if ((DN_SK(newsk)->services_rem & NSP_FC_MASK) == NSP_FC_NONE)
+- DN_SK(newsk)->max_window = decnet_no_fc_max_cwnd;
+-
+- newsk->sk_state = TCP_LISTEN;
+- memcpy(&(DN_SK(newsk)->addr), &(DN_SK(sk)->addr), sizeof(struct sockaddr_dn));
+-
+- /*
+- * If we are listening on a wild socket, we don't want
+- * the newly created socket on the wrong hash queue.
+- */
+- DN_SK(newsk)->addr.sdn_flags &= ~SDF_WILD;
+-
+- skb_pull(skb, dn_username2sockaddr(skb->data, skb->len, &(DN_SK(newsk)->addr), &type));
+- skb_pull(skb, dn_username2sockaddr(skb->data, skb->len, &(DN_SK(newsk)->peer), &type));
+- *(__le16 *)(DN_SK(newsk)->peer.sdn_add.a_addr) = cb->src;
+- *(__le16 *)(DN_SK(newsk)->addr.sdn_add.a_addr) = cb->dst;
+-
+- menuver = *skb->data;
+- skb_pull(skb, 1);
+-
+- if (menuver & DN_MENUVER_ACC)
+- dn_access_copy(skb, &(DN_SK(newsk)->accessdata));
+-
+- if (menuver & DN_MENUVER_USR)
+- dn_user_copy(skb, &(DN_SK(newsk)->conndata_in));
+-
+- if (menuver & DN_MENUVER_PRX)
+- DN_SK(newsk)->peer.sdn_flags |= SDF_PROXY;
+-
+- if (menuver & DN_MENUVER_UIC)
+- DN_SK(newsk)->peer.sdn_flags |= SDF_UICPROXY;
+-
+- kfree_skb(skb);
+-
+- memcpy(&(DN_SK(newsk)->conndata_out), &(DN_SK(sk)->conndata_out),
+- sizeof(struct optdata_dn));
+- memcpy(&(DN_SK(newsk)->discdata_out), &(DN_SK(sk)->discdata_out),
+- sizeof(struct optdata_dn));
+-
+- lock_sock(newsk);
+- err = dn_hash_sock(newsk);
+- if (err == 0) {
+- sock_reset_flag(newsk, SOCK_ZAPPED);
+- dn_send_conn_ack(newsk);
+-
+- /*
+- * Here we use sk->sk_allocation since although the conn conf is
+- * for the newsk, the context is the old socket.
+- */
+- if (DN_SK(newsk)->accept_mode == ACC_IMMED)
+- err = dn_confirm_accept(newsk, &timeo,
+- sk->sk_allocation);
+- }
+- release_sock(newsk);
+- return err;
+-}
+-
+-
+-static int dn_getname(struct socket *sock, struct sockaddr *uaddr,int peer)
+-{
+- struct sockaddr_dn *sa = (struct sockaddr_dn *)uaddr;
+- struct sock *sk = sock->sk;
+- struct dn_scp *scp = DN_SK(sk);
+-
+- lock_sock(sk);
+-
+- if (peer) {
+- if ((sock->state != SS_CONNECTED &&
+- sock->state != SS_CONNECTING) &&
+- scp->accept_mode == ACC_IMMED) {
+- release_sock(sk);
+- return -ENOTCONN;
+- }
+-
+- memcpy(sa, &scp->peer, sizeof(struct sockaddr_dn));
+- } else {
+- memcpy(sa, &scp->addr, sizeof(struct sockaddr_dn));
+- }
+-
+- release_sock(sk);
+-
+- return sizeof(struct sockaddr_dn);
+-}
+-
+-
+-static __poll_t dn_poll(struct file *file, struct socket *sock, poll_table *wait)
+-{
+- struct sock *sk = sock->sk;
+- struct dn_scp *scp = DN_SK(sk);
+- __poll_t mask = datagram_poll(file, sock, wait);
+-
+- if (!skb_queue_empty_lockless(&scp->other_receive_queue))
+- mask |= EPOLLRDBAND;
+-
+- return mask;
+-}
+-
+-static int dn_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+-{
+- struct sock *sk = sock->sk;
+- struct dn_scp *scp = DN_SK(sk);
+- int err = -EOPNOTSUPP;
+- long amount = 0;
+- struct sk_buff *skb;
+- int val;
+-
+- switch(cmd)
+- {
+- case SIOCGIFADDR:
+- case SIOCSIFADDR:
+- return dn_dev_ioctl(cmd, (void __user *)arg);
+-
+- case SIOCATMARK:
+- lock_sock(sk);
+- val = !skb_queue_empty(&scp->other_receive_queue);
+- if (scp->state != DN_RUN)
+- val = -ENOTCONN;
+- release_sock(sk);
+- return val;
+-
+- case TIOCOUTQ:
+- amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
+- if (amount < 0)
+- amount = 0;
+- err = put_user(amount, (int __user *)arg);
+- break;
+-
+- case TIOCINQ:
+- lock_sock(sk);
+- skb = skb_peek(&scp->other_receive_queue);
+- if (skb) {
+- amount = skb->len;
+- } else {
+- skb_queue_walk(&sk->sk_receive_queue, skb)
+- amount += skb->len;
+- }
+- release_sock(sk);
+- err = put_user(amount, (int __user *)arg);
+- break;
+-
+- default:
+- err = -ENOIOCTLCMD;
+- break;
+- }
+-
+- return err;
+-}
+-
+-static int dn_listen(struct socket *sock, int backlog)
+-{
+- struct sock *sk = sock->sk;
+- int err = -EINVAL;
+-
+- lock_sock(sk);
+-
+- if (sock_flag(sk, SOCK_ZAPPED))
+- goto out;
+-
+- if ((DN_SK(sk)->state != DN_O) || (sk->sk_state == TCP_LISTEN))
+- goto out;
+-
+- sk->sk_max_ack_backlog = backlog;
+- sk->sk_ack_backlog = 0;
+- sk->sk_state = TCP_LISTEN;
+- err = 0;
+- dn_rehash_sock(sk);
+-
+-out:
+- release_sock(sk);
+-
+- return err;
+-}
+-
+-
+-static int dn_shutdown(struct socket *sock, int how)
+-{
+- struct sock *sk = sock->sk;
+- struct dn_scp *scp = DN_SK(sk);
+- int err = -ENOTCONN;
+-
+- lock_sock(sk);
+-
+- if (sock->state == SS_UNCONNECTED)
+- goto out;
+-
+- err = 0;
+- if (sock->state == SS_DISCONNECTING)
+- goto out;
+-
+- err = -EINVAL;
+- if (scp->state == DN_O)
+- goto out;
+-
+- if (how != SHUT_RDWR)
+- goto out;
+-
+- sk->sk_shutdown = SHUTDOWN_MASK;
+- dn_destroy_sock(sk);
+- err = 0;
+-
+-out:
+- release_sock(sk);
+-
+- return err;
+-}
+-
+-static int dn_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
+-{
+- struct sock *sk = sock->sk;
+- int err;
+-
+- lock_sock(sk);
+- err = __dn_setsockopt(sock, level, optname, optval, optlen, 0);
+- release_sock(sk);
+-#ifdef CONFIG_NETFILTER
+- /* we need to exclude all possible ENOPROTOOPTs except default case */
+- if (err == -ENOPROTOOPT && optname != DSO_LINKINFO &&
+- optname != DSO_STREAM && optname != DSO_SEQPACKET)
+- err = nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
+-#endif
+-
+- return err;
+-}
+-
+-static int __dn_setsockopt(struct socket *sock, int level,int optname, char __user *optval, unsigned int optlen, int flags)
+-{
+- struct sock *sk = sock->sk;
+- struct dn_scp *scp = DN_SK(sk);
+- long timeo;
+- union {
+- struct optdata_dn opt;
+- struct accessdata_dn acc;
+- int mode;
+- unsigned long win;
+- int val;
+- unsigned char services;
+- unsigned char info;
+- } u;
+- int err;
+-
+- if (optlen && !optval)
+- return -EINVAL;
+-
+- if (optlen > sizeof(u))
+- return -EINVAL;
+-
+- if (copy_from_user(&u, optval, optlen))
+- return -EFAULT;
+-
+- switch (optname) {
+- case DSO_CONDATA:
+- if (sock->state == SS_CONNECTED)
+- return -EISCONN;
+- if ((scp->state != DN_O) && (scp->state != DN_CR))
+- return -EINVAL;
+-
+- if (optlen != sizeof(struct optdata_dn))
+- return -EINVAL;
+-
+- if (le16_to_cpu(u.opt.opt_optl) > 16)
+- return -EINVAL;
+-
+- memcpy(&scp->conndata_out, &u.opt, optlen);
+- break;
+-
+- case DSO_DISDATA:
+- if (sock->state != SS_CONNECTED &&
+- scp->accept_mode == ACC_IMMED)
+- return -ENOTCONN;
+-
+- if (optlen != sizeof(struct optdata_dn))
+- return -EINVAL;
+-
+- if (le16_to_cpu(u.opt.opt_optl) > 16)
+- return -EINVAL;
+-
+- memcpy(&scp->discdata_out, &u.opt, optlen);
+- break;
+-
+- case DSO_CONACCESS:
+- if (sock->state == SS_CONNECTED)
+- return -EISCONN;
+- if (scp->state != DN_O)
+- return -EINVAL;
+-
+- if (optlen != sizeof(struct accessdata_dn))
+- return -EINVAL;
+-
+- if ((u.acc.acc_accl > DN_MAXACCL) ||
+- (u.acc.acc_passl > DN_MAXACCL) ||
+- (u.acc.acc_userl > DN_MAXACCL))
+- return -EINVAL;
+-
+- memcpy(&scp->accessdata, &u.acc, optlen);
+- break;
+-
+- case DSO_ACCEPTMODE:
+- if (sock->state == SS_CONNECTED)
+- return -EISCONN;
+- if (scp->state != DN_O)
+- return -EINVAL;
+-
+- if (optlen != sizeof(int))
+- return -EINVAL;
+-
+- if ((u.mode != ACC_IMMED) && (u.mode != ACC_DEFER))
+- return -EINVAL;
+-
+- scp->accept_mode = (unsigned char)u.mode;
+- break;
+-
+- case DSO_CONACCEPT:
+- if (scp->state != DN_CR)
+- return -EINVAL;
+- timeo = sock_rcvtimeo(sk, 0);
+- err = dn_confirm_accept(sk, &timeo, sk->sk_allocation);
+- return err;
+-
+- case DSO_CONREJECT:
+- if (scp->state != DN_CR)
+- return -EINVAL;
+-
+- scp->state = DN_DR;
+- sk->sk_shutdown = SHUTDOWN_MASK;
+- dn_nsp_send_disc(sk, 0x38, 0, sk->sk_allocation);
+- break;
+-
+- case DSO_MAXWINDOW:
+- if (optlen != sizeof(unsigned long))
+- return -EINVAL;
+- if (u.win > NSP_MAX_WINDOW)
+- u.win = NSP_MAX_WINDOW;
+- if (u.win == 0)
+- return -EINVAL;
+- scp->max_window = u.win;
+- if (scp->snd_window > u.win)
+- scp->snd_window = u.win;
+- break;
+-
+- case DSO_NODELAY:
+- if (optlen != sizeof(int))
+- return -EINVAL;
+- if (scp->nonagle == TCP_NAGLE_CORK)
+- return -EINVAL;
+- scp->nonagle = (u.val == 0) ? 0 : TCP_NAGLE_OFF;
+- /* if (scp->nonagle == 1) { Push pending frames } */
+- break;
+-
+- case DSO_CORK:
+- if (optlen != sizeof(int))
+- return -EINVAL;
+- if (scp->nonagle == TCP_NAGLE_OFF)
+- return -EINVAL;
+- scp->nonagle = (u.val == 0) ? 0 : TCP_NAGLE_CORK;
+- /* if (scp->nonagle == 0) { Push pending frames } */
+- break;
+-
+- case DSO_SERVICES:
+- if (optlen != sizeof(unsigned char))
+- return -EINVAL;
+- if ((u.services & ~NSP_FC_MASK) != 0x01)
+- return -EINVAL;
+- if ((u.services & NSP_FC_MASK) == NSP_FC_MASK)
+- return -EINVAL;
+- scp->services_loc = u.services;
+- break;
+-
+- case DSO_INFO:
+- if (optlen != sizeof(unsigned char))
+- return -EINVAL;
+- if (u.info & 0xfc)
+- return -EINVAL;
+- scp->info_loc = u.info;
+- break;
+-
+- case DSO_LINKINFO:
+- case DSO_STREAM:
+- case DSO_SEQPACKET:
+- default:
+- return -ENOPROTOOPT;
+- }
+-
+- return 0;
+-}
+-
+-static int dn_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
+-{
+- struct sock *sk = sock->sk;
+- int err;
+-
+- lock_sock(sk);
+- err = __dn_getsockopt(sock, level, optname, optval, optlen, 0);
+- release_sock(sk);
+-#ifdef CONFIG_NETFILTER
+- if (err == -ENOPROTOOPT && optname != DSO_STREAM &&
+- optname != DSO_SEQPACKET && optname != DSO_CONACCEPT &&
+- optname != DSO_CONREJECT) {
+- int len;
+-
+- if (get_user(len, optlen))
+- return -EFAULT;
+-
+- err = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
+- if (err >= 0)
+- err = put_user(len, optlen);
+- }
+-#endif
+-
+- return err;
+-}
+-
+-static int __dn_getsockopt(struct socket *sock, int level,int optname, char __user *optval,int __user *optlen, int flags)
+-{
+- struct sock *sk = sock->sk;
+- struct dn_scp *scp = DN_SK(sk);
+- struct linkinfo_dn link;
+- unsigned int r_len;
+- void *r_data = NULL;
+- unsigned int val;
+-
+- if(get_user(r_len , optlen))
+- return -EFAULT;
+-
+- switch (optname) {
+- case DSO_CONDATA:
+- if (r_len > sizeof(struct optdata_dn))
+- r_len = sizeof(struct optdata_dn);
+- r_data = &scp->conndata_in;
+- break;
+-
+- case DSO_DISDATA:
+- if (r_len > sizeof(struct optdata_dn))
+- r_len = sizeof(struct optdata_dn);
+- r_data = &scp->discdata_in;
+- break;
+-
+- case DSO_CONACCESS:
+- if (r_len > sizeof(struct accessdata_dn))
+- r_len = sizeof(struct accessdata_dn);
+- r_data = &scp->accessdata;
+- break;
+-
+- case DSO_ACCEPTMODE:
+- if (r_len > sizeof(unsigned char))
+- r_len = sizeof(unsigned char);
+- r_data = &scp->accept_mode;
+- break;
+-
+- case DSO_LINKINFO:
+- if (r_len > sizeof(struct linkinfo_dn))
+- r_len = sizeof(struct linkinfo_dn);
+-
+- memset(&link, 0, sizeof(link));
+-
+- switch (sock->state) {
+- case SS_CONNECTING:
+- link.idn_linkstate = LL_CONNECTING;
+- break;
+- case SS_DISCONNECTING:
+- link.idn_linkstate = LL_DISCONNECTING;
+- break;
+- case SS_CONNECTED:
+- link.idn_linkstate = LL_RUNNING;
+- break;
+- default:
+- link.idn_linkstate = LL_INACTIVE;
+- }
+-
+- link.idn_segsize = scp->segsize_rem;
+- r_data = &link;
+- break;
+-
+- case DSO_MAXWINDOW:
+- if (r_len > sizeof(unsigned long))
+- r_len = sizeof(unsigned long);
+- r_data = &scp->max_window;
+- break;
+-
+- case DSO_NODELAY:
+- if (r_len > sizeof(int))
+- r_len = sizeof(int);
+- val = (scp->nonagle == TCP_NAGLE_OFF);
+- r_data = &val;
+- break;
+-
+- case DSO_CORK:
+- if (r_len > sizeof(int))
+- r_len = sizeof(int);
+- val = (scp->nonagle == TCP_NAGLE_CORK);
+- r_data = &val;
+- break;
+-
+- case DSO_SERVICES:
+- if (r_len > sizeof(unsigned char))
+- r_len = sizeof(unsigned char);
+- r_data = &scp->services_rem;
+- break;
+-
+- case DSO_INFO:
+- if (r_len > sizeof(unsigned char))
+- r_len = sizeof(unsigned char);
+- r_data = &scp->info_rem;
+- break;
+-
+- case DSO_STREAM:
+- case DSO_SEQPACKET:
+- case DSO_CONACCEPT:
+- case DSO_CONREJECT:
+- default:
+- return -ENOPROTOOPT;
+- }
+-
+- if (r_data) {
+- if (copy_to_user(optval, r_data, r_len))
+- return -EFAULT;
+- if (put_user(r_len, optlen))
+- return -EFAULT;
+- }
+-
+- return 0;
+-}
+-
+-
+-static int dn_data_ready(struct sock *sk, struct sk_buff_head *q, int flags, int target)
+-{
+- struct sk_buff *skb;
+- int len = 0;
+-
+- if (flags & MSG_OOB)
+- return !skb_queue_empty(q) ? 1 : 0;
+-
+- skb_queue_walk(q, skb) {
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- len += skb->len;
+-
+- if (cb->nsp_flags & 0x40) {
+- /* SOCK_SEQPACKET reads to EOM */
+- if (sk->sk_type == SOCK_SEQPACKET)
+- return 1;
+- /* so does SOCK_STREAM unless WAITALL is specified */
+- if (!(flags & MSG_WAITALL))
+- return 1;
+- }
+-
+- /* minimum data length for read exceeded */
+- if (len >= target)
+- return 1;
+- }
+-
+- return 0;
+-}
+-
+-
+-static int dn_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+- int flags)
+-{
+- struct sock *sk = sock->sk;
+- struct dn_scp *scp = DN_SK(sk);
+- struct sk_buff_head *queue = &sk->sk_receive_queue;
+- size_t target = size > 1 ? 1 : 0;
+- size_t copied = 0;
+- int rv = 0;
+- struct sk_buff *skb, *n;
+- struct dn_skb_cb *cb = NULL;
+- unsigned char eor = 0;
+- long timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+-
+- lock_sock(sk);
+-
+- if (sock_flag(sk, SOCK_ZAPPED)) {
+- rv = -EADDRNOTAVAIL;
+- goto out;
+- }
+-
+- if (sk->sk_shutdown & RCV_SHUTDOWN) {
+- rv = 0;
+- goto out;
+- }
+-
+- rv = dn_check_state(sk, NULL, 0, &timeo, flags);
+- if (rv)
+- goto out;
+-
+- if (flags & ~(MSG_CMSG_COMPAT|MSG_PEEK|MSG_OOB|MSG_WAITALL|MSG_DONTWAIT|MSG_NOSIGNAL)) {
+- rv = -EOPNOTSUPP;
+- goto out;
+- }
+-
+- if (flags & MSG_OOB)
+- queue = &scp->other_receive_queue;
+-
+- if (flags & MSG_WAITALL)
+- target = size;
+-
+-
+- /*
+- * See if there is data ready to read, sleep if there isn't
+- */
+- for(;;) {
+- DEFINE_WAIT_FUNC(wait, woken_wake_function);
+-
+- if (sk->sk_err)
+- goto out;
+-
+- if (!skb_queue_empty(&scp->other_receive_queue)) {
+- if (!(flags & MSG_OOB)) {
+- msg->msg_flags |= MSG_OOB;
+- if (!scp->other_report) {
+- scp->other_report = 1;
+- goto out;
+- }
+- }
+- }
+-
+- if (scp->state != DN_RUN)
+- goto out;
+-
+- if (signal_pending(current)) {
+- rv = sock_intr_errno(timeo);
+- goto out;
+- }
+-
+- if (dn_data_ready(sk, queue, flags, target))
+- break;
+-
+- if (flags & MSG_DONTWAIT) {
+- rv = -EWOULDBLOCK;
+- goto out;
+- }
+-
+- add_wait_queue(sk_sleep(sk), &wait);
+- sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+- sk_wait_event(sk, &timeo, dn_data_ready(sk, queue, flags, target), &wait);
+- sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+- remove_wait_queue(sk_sleep(sk), &wait);
+- }
+-
+- skb_queue_walk_safe(queue, skb, n) {
+- unsigned int chunk = skb->len;
+- cb = DN_SKB_CB(skb);
+-
+- if ((chunk + copied) > size)
+- chunk = size - copied;
+-
+- if (memcpy_to_msg(msg, skb->data, chunk)) {
+- rv = -EFAULT;
+- break;
+- }
+- copied += chunk;
+-
+- if (!(flags & MSG_PEEK))
+- skb_pull(skb, chunk);
+-
+- eor = cb->nsp_flags & 0x40;
+-
+- if (skb->len == 0) {
+- skb_unlink(skb, queue);
+- kfree_skb(skb);
+- /*
+- * N.B. Don't refer to skb or cb after this point
+- * in loop.
+- */
+- if ((scp->flowloc_sw == DN_DONTSEND) && !dn_congested(sk)) {
+- scp->flowloc_sw = DN_SEND;
+- dn_nsp_send_link(sk, DN_SEND, 0);
+- }
+- }
+-
+- if (eor) {
+- if (sk->sk_type == SOCK_SEQPACKET)
+- break;
+- if (!(flags & MSG_WAITALL))
+- break;
+- }
+-
+- if (flags & MSG_OOB)
+- break;
+-
+- if (copied >= target)
+- break;
+- }
+-
+- rv = copied;
+-
+-
+- if (eor && (sk->sk_type == SOCK_SEQPACKET))
+- msg->msg_flags |= MSG_EOR;
+-
+-out:
+- if (rv == 0)
+- rv = (flags & MSG_PEEK) ? -sk->sk_err : sock_error(sk);
+-
+- if ((rv >= 0) && msg->msg_name) {
+- __sockaddr_check_size(sizeof(struct sockaddr_dn));
+- memcpy(msg->msg_name, &scp->peer, sizeof(struct sockaddr_dn));
+- msg->msg_namelen = sizeof(struct sockaddr_dn);
+- }
+-
+- release_sock(sk);
+-
+- return rv;
+-}
+-
+-
+-static inline int dn_queue_too_long(struct dn_scp *scp, struct sk_buff_head *queue, int flags)
+-{
+- unsigned char fctype = scp->services_rem & NSP_FC_MASK;
+- if (skb_queue_len(queue) >= scp->snd_window)
+- return 1;
+- if (fctype != NSP_FC_NONE) {
+- if (flags & MSG_OOB) {
+- if (scp->flowrem_oth == 0)
+- return 1;
+- } else {
+- if (scp->flowrem_dat == 0)
+- return 1;
+- }
+- }
+- return 0;
+-}
+-
+-/*
+- * The DECnet spec requires that the "routing layer" accepts packets which
+- * are at least 230 bytes in size. This excludes any headers which the NSP
+- * layer might add, so we always assume that we'll be using the maximal
+- * length header on data packets. The variation in length is due to the
+- * inclusion (or not) of the two 16 bit acknowledgement fields so it doesn't
+- * make much practical difference.
+- */
+-unsigned int dn_mss_from_pmtu(struct net_device *dev, int mtu)
+-{
+- unsigned int mss = 230 - DN_MAX_NSP_DATA_HEADER;
+- if (dev) {
+- struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
+- mtu -= LL_RESERVED_SPACE(dev);
+- if (dn_db->use_long)
+- mtu -= 21;
+- else
+- mtu -= 6;
+- mtu -= DN_MAX_NSP_DATA_HEADER;
+- } else {
+- /*
+- * 21 = long header, 16 = guess at MAC header length
+- */
+- mtu -= (21 + DN_MAX_NSP_DATA_HEADER + 16);
+- }
+- if (mtu > mss)
+- mss = mtu;
+- return mss;
+-}
+-
+-static inline unsigned int dn_current_mss(struct sock *sk, int flags)
+-{
+- struct dst_entry *dst = __sk_dst_get(sk);
+- struct dn_scp *scp = DN_SK(sk);
+- int mss_now = min_t(int, scp->segsize_loc, scp->segsize_rem);
+-
+- /* Other data messages are limited to 16 bytes per packet */
+- if (flags & MSG_OOB)
+- return 16;
+-
+- /* This works out the maximum size of segment we can send out */
+- if (dst) {
+- u32 mtu = dst_mtu(dst);
+- mss_now = min_t(int, dn_mss_from_pmtu(dst->dev, mtu), mss_now);
+- }
+-
+- return mss_now;
+-}
+-
+-/*
+- * N.B. We get the timeout wrong here, but then we always did get it
+- * wrong before and this is another step along the road to correcting
+- * it. It ought to get updated each time we pass through the routine,
+- * but in practise it probably doesn't matter too much for now.
+- */
+-static inline struct sk_buff *dn_alloc_send_pskb(struct sock *sk,
+- unsigned long datalen, int noblock,
+- int *errcode)
+-{
+- struct sk_buff *skb = sock_alloc_send_skb(sk, datalen,
+- noblock, errcode);
+- if (skb) {
+- skb->protocol = htons(ETH_P_DNA_RT);
+- skb->pkt_type = PACKET_OUTGOING;
+- }
+- return skb;
+-}
+-
+-static int dn_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+-{
+- struct sock *sk = sock->sk;
+- struct dn_scp *scp = DN_SK(sk);
+- size_t mss;
+- struct sk_buff_head *queue = &scp->data_xmit_queue;
+- int flags = msg->msg_flags;
+- int err = 0;
+- size_t sent = 0;
+- int addr_len = msg->msg_namelen;
+- DECLARE_SOCKADDR(struct sockaddr_dn *, addr, msg->msg_name);
+- struct sk_buff *skb = NULL;
+- struct dn_skb_cb *cb;
+- size_t len;
+- unsigned char fctype;
+- long timeo;
+-
+- if (flags & ~(MSG_TRYHARD|MSG_OOB|MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|MSG_MORE|MSG_CMSG_COMPAT))
+- return -EOPNOTSUPP;
+-
+- if (addr_len && (addr_len != sizeof(struct sockaddr_dn)))
+- return -EINVAL;
+-
+- lock_sock(sk);
+- timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
+- /*
+- * The only difference between stream sockets and sequenced packet
+- * sockets is that the stream sockets always behave as if MSG_EOR
+- * has been set.
+- */
+- if (sock->type == SOCK_STREAM) {
+- if (flags & MSG_EOR) {
+- err = -EINVAL;
+- goto out;
+- }
+- flags |= MSG_EOR;
+- }
+-
+-
+- err = dn_check_state(sk, addr, addr_len, &timeo, flags);
+- if (err)
+- goto out_err;
+-
+- if (sk->sk_shutdown & SEND_SHUTDOWN) {
+- err = -EPIPE;
+- if (!(flags & MSG_NOSIGNAL))
+- send_sig(SIGPIPE, current, 0);
+- goto out_err;
+- }
+-
+- if ((flags & MSG_TRYHARD) && sk->sk_dst_cache)
+- dst_negative_advice(sk);
+-
+- mss = scp->segsize_rem;
+- fctype = scp->services_rem & NSP_FC_MASK;
+-
+- mss = dn_current_mss(sk, flags);
+-
+- if (flags & MSG_OOB) {
+- queue = &scp->other_xmit_queue;
+- if (size > mss) {
+- err = -EMSGSIZE;
+- goto out;
+- }
+- }
+-
+- scp->persist_fxn = dn_nsp_xmit_timeout;
+-
+- while(sent < size) {
+- err = sock_error(sk);
+- if (err)
+- goto out;
+-
+- if (signal_pending(current)) {
+- err = sock_intr_errno(timeo);
+- goto out;
+- }
+-
+- /*
+- * Calculate size that we wish to send.
+- */
+- len = size - sent;
+-
+- if (len > mss)
+- len = mss;
+-
+- /*
+- * Wait for queue size to go down below the window
+- * size.
+- */
+- if (dn_queue_too_long(scp, queue, flags)) {
+- DEFINE_WAIT_FUNC(wait, woken_wake_function);
+-
+- if (flags & MSG_DONTWAIT) {
+- err = -EWOULDBLOCK;
+- goto out;
+- }
+-
+- add_wait_queue(sk_sleep(sk), &wait);
+- sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+- sk_wait_event(sk, &timeo,
+- !dn_queue_too_long(scp, queue, flags), &wait);
+- sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+- remove_wait_queue(sk_sleep(sk), &wait);
+- continue;
+- }
+-
+- /*
+- * Get a suitably sized skb.
+- * 64 is a bit of a hack really, but its larger than any
+- * link-layer headers and has served us well as a good
+- * guess as to their real length.
+- */
+- skb = dn_alloc_send_pskb(sk, len + 64 + DN_MAX_NSP_DATA_HEADER,
+- flags & MSG_DONTWAIT, &err);
+-
+- if (err)
+- break;
+-
+- if (!skb)
+- continue;
+-
+- cb = DN_SKB_CB(skb);
+-
+- skb_reserve(skb, 64 + DN_MAX_NSP_DATA_HEADER);
+-
+- if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
+- err = -EFAULT;
+- goto out;
+- }
+-
+- if (flags & MSG_OOB) {
+- cb->nsp_flags = 0x30;
+- if (fctype != NSP_FC_NONE)
+- scp->flowrem_oth--;
+- } else {
+- cb->nsp_flags = 0x00;
+- if (scp->seg_total == 0)
+- cb->nsp_flags |= 0x20;
+-
+- scp->seg_total += len;
+-
+- if (((sent + len) == size) && (flags & MSG_EOR)) {
+- cb->nsp_flags |= 0x40;
+- scp->seg_total = 0;
+- if (fctype == NSP_FC_SCMC)
+- scp->flowrem_dat--;
+- }
+- if (fctype == NSP_FC_SRC)
+- scp->flowrem_dat--;
+- }
+-
+- sent += len;
+- dn_nsp_queue_xmit(sk, skb, sk->sk_allocation, flags & MSG_OOB);
+- skb = NULL;
+-
+- scp->persist = dn_nsp_persist(sk);
+-
+- }
+-out:
+-
+- kfree_skb(skb);
+-
+- release_sock(sk);
+-
+- return sent ? sent : err;
+-
+-out_err:
+- err = sk_stream_error(sk, flags, err);
+- release_sock(sk);
+- return err;
+-}
+-
+-static int dn_device_event(struct notifier_block *this, unsigned long event,
+- void *ptr)
+-{
+- struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+-
+- if (!net_eq(dev_net(dev), &init_net))
+- return NOTIFY_DONE;
+-
+- switch (event) {
+- case NETDEV_UP:
+- dn_dev_up(dev);
+- break;
+- case NETDEV_DOWN:
+- dn_dev_down(dev);
+- break;
+- default:
+- break;
+- }
+-
+- return NOTIFY_DONE;
+-}
+-
+-static struct notifier_block dn_dev_notifier = {
+- .notifier_call = dn_device_event,
+-};
+-
+-static struct packet_type dn_dix_packet_type __read_mostly = {
+- .type = cpu_to_be16(ETH_P_DNA_RT),
+- .func = dn_route_rcv,
+-};
+-
+-#ifdef CONFIG_PROC_FS
+-struct dn_iter_state {
+- int bucket;
+-};
+-
+-static struct sock *dn_socket_get_first(struct seq_file *seq)
+-{
+- struct dn_iter_state *state = seq->private;
+- struct sock *n = NULL;
+-
+- for(state->bucket = 0;
+- state->bucket < DN_SK_HASH_SIZE;
+- ++state->bucket) {
+- n = sk_head(&dn_sk_hash[state->bucket]);
+- if (n)
+- break;
+- }
+-
+- return n;
+-}
+-
+-static struct sock *dn_socket_get_next(struct seq_file *seq,
+- struct sock *n)
+-{
+- struct dn_iter_state *state = seq->private;
+-
+- n = sk_next(n);
+-try_again:
+- if (n)
+- goto out;
+- if (++state->bucket >= DN_SK_HASH_SIZE)
+- goto out;
+- n = sk_head(&dn_sk_hash[state->bucket]);
+- goto try_again;
+-out:
+- return n;
+-}
+-
+-static struct sock *socket_get_idx(struct seq_file *seq, loff_t *pos)
+-{
+- struct sock *sk = dn_socket_get_first(seq);
+-
+- if (sk) {
+- while(*pos && (sk = dn_socket_get_next(seq, sk)))
+- --*pos;
+- }
+- return *pos ? NULL : sk;
+-}
+-
+-static void *dn_socket_get_idx(struct seq_file *seq, loff_t pos)
+-{
+- void *rc;
+- read_lock_bh(&dn_hash_lock);
+- rc = socket_get_idx(seq, &pos);
+- if (!rc) {
+- read_unlock_bh(&dn_hash_lock);
+- }
+- return rc;
+-}
+-
+-static void *dn_socket_seq_start(struct seq_file *seq, loff_t *pos)
+-{
+- return *pos ? dn_socket_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
+-}
+-
+-static void *dn_socket_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+-{
+- void *rc;
+-
+- if (v == SEQ_START_TOKEN) {
+- rc = dn_socket_get_idx(seq, 0);
+- goto out;
+- }
+-
+- rc = dn_socket_get_next(seq, v);
+- if (rc)
+- goto out;
+- read_unlock_bh(&dn_hash_lock);
+-out:
+- ++*pos;
+- return rc;
+-}
+-
+-static void dn_socket_seq_stop(struct seq_file *seq, void *v)
+-{
+- if (v && v != SEQ_START_TOKEN)
+- read_unlock_bh(&dn_hash_lock);
+-}
+-
+-#define IS_NOT_PRINTABLE(x) ((x) < 32 || (x) > 126)
+-
+-static void dn_printable_object(struct sockaddr_dn *dn, unsigned char *buf)
+-{
+- int i;
+-
+- switch (le16_to_cpu(dn->sdn_objnamel)) {
+- case 0:
+- sprintf(buf, "%d", dn->sdn_objnum);
+- break;
+- default:
+- for (i = 0; i < le16_to_cpu(dn->sdn_objnamel); i++) {
+- buf[i] = dn->sdn_objname[i];
+- if (IS_NOT_PRINTABLE(buf[i]))
+- buf[i] = '.';
+- }
+- buf[i] = 0;
+- }
+-}
+-
+-static char *dn_state2asc(unsigned char state)
+-{
+- switch (state) {
+- case DN_O:
+- return "OPEN";
+- case DN_CR:
+- return " CR";
+- case DN_DR:
+- return " DR";
+- case DN_DRC:
+- return " DRC";
+- case DN_CC:
+- return " CC";
+- case DN_CI:
+- return " CI";
+- case DN_NR:
+- return " NR";
+- case DN_NC:
+- return " NC";
+- case DN_CD:
+- return " CD";
+- case DN_RJ:
+- return " RJ";
+- case DN_RUN:
+- return " RUN";
+- case DN_DI:
+- return " DI";
+- case DN_DIC:
+- return " DIC";
+- case DN_DN:
+- return " DN";
+- case DN_CL:
+- return " CL";
+- case DN_CN:
+- return " CN";
+- }
+-
+- return "????";
+-}
+-
+-static inline void dn_socket_format_entry(struct seq_file *seq, struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- char buf1[DN_ASCBUF_LEN];
+- char buf2[DN_ASCBUF_LEN];
+- char local_object[DN_MAXOBJL+3];
+- char remote_object[DN_MAXOBJL+3];
+-
+- dn_printable_object(&scp->addr, local_object);
+- dn_printable_object(&scp->peer, remote_object);
+-
+- seq_printf(seq,
+- "%6s/%04X %04d:%04d %04d:%04d %01d %-16s "
+- "%6s/%04X %04d:%04d %04d:%04d %01d %-16s %4s %s\n",
+- dn_addr2asc(le16_to_cpu(dn_saddr2dn(&scp->addr)), buf1),
+- scp->addrloc,
+- scp->numdat,
+- scp->numoth,
+- scp->ackxmt_dat,
+- scp->ackxmt_oth,
+- scp->flowloc_sw,
+- local_object,
+- dn_addr2asc(le16_to_cpu(dn_saddr2dn(&scp->peer)), buf2),
+- scp->addrrem,
+- scp->numdat_rcv,
+- scp->numoth_rcv,
+- scp->ackrcv_dat,
+- scp->ackrcv_oth,
+- scp->flowrem_sw,
+- remote_object,
+- dn_state2asc(scp->state),
+- ((scp->accept_mode == ACC_IMMED) ? "IMMED" : "DEFER"));
+-}
+-
+-static int dn_socket_seq_show(struct seq_file *seq, void *v)
+-{
+- if (v == SEQ_START_TOKEN) {
+- seq_puts(seq, "Local Remote\n");
+- } else {
+- dn_socket_format_entry(seq, v);
+- }
+- return 0;
+-}
+-
+-static const struct seq_operations dn_socket_seq_ops = {
+- .start = dn_socket_seq_start,
+- .next = dn_socket_seq_next,
+- .stop = dn_socket_seq_stop,
+- .show = dn_socket_seq_show,
+-};
+-#endif
+-
+-static const struct net_proto_family dn_family_ops = {
+- .family = AF_DECnet,
+- .create = dn_create,
+- .owner = THIS_MODULE,
+-};
+-
+-static const struct proto_ops dn_proto_ops = {
+- .family = AF_DECnet,
+- .owner = THIS_MODULE,
+- .release = dn_release,
+- .bind = dn_bind,
+- .connect = dn_connect,
+- .socketpair = sock_no_socketpair,
+- .accept = dn_accept,
+- .getname = dn_getname,
+- .poll = dn_poll,
+- .ioctl = dn_ioctl,
+- .listen = dn_listen,
+- .shutdown = dn_shutdown,
+- .setsockopt = dn_setsockopt,
+- .getsockopt = dn_getsockopt,
+- .sendmsg = dn_sendmsg,
+- .recvmsg = dn_recvmsg,
+- .mmap = sock_no_mmap,
+- .sendpage = sock_no_sendpage,
+-};
+-
+-MODULE_DESCRIPTION("The Linux DECnet Network Protocol");
+-MODULE_AUTHOR("Linux DECnet Project Team");
+-MODULE_LICENSE("GPL");
+-MODULE_ALIAS_NETPROTO(PF_DECnet);
+-
+-static const char banner[] __initconst = KERN_INFO
+-"NET4: DECnet for Linux: V.2.5.68s (C) 1995-2003 Linux DECnet Project Team\n";
+-
+-static int __init decnet_init(void)
+-{
+- int rc;
+-
+- printk(banner);
+-
+- rc = proto_register(&dn_proto, 1);
+- if (rc != 0)
+- goto out;
+-
+- dn_neigh_init();
+- dn_dev_init();
+- dn_route_init();
+- dn_fib_init();
+-
+- sock_register(&dn_family_ops);
+- dev_add_pack(&dn_dix_packet_type);
+- register_netdevice_notifier(&dn_dev_notifier);
+-
+- proc_create_seq_private("decnet", 0444, init_net.proc_net,
+- &dn_socket_seq_ops, sizeof(struct dn_iter_state),
+- NULL);
+- dn_register_sysctl();
+-out:
+- return rc;
+-
+-}
+-module_init(decnet_init);
+-
+-/*
+- * Prevent DECnet module unloading until its fixed properly.
+- * Requires an audit of the code to check for memory leaks and
+- * initialisation problems etc.
+- */
+-#if 0
+-static void __exit decnet_exit(void)
+-{
+- sock_unregister(AF_DECnet);
+- rtnl_unregister_all(PF_DECnet);
+- dev_remove_pack(&dn_dix_packet_type);
+-
+- dn_unregister_sysctl();
+-
+- unregister_netdevice_notifier(&dn_dev_notifier);
+-
+- dn_route_cleanup();
+- dn_dev_cleanup();
+- dn_neigh_cleanup();
+- dn_fib_cleanup();
+-
+- remove_proc_entry("decnet", init_net.proc_net);
+-
+- proto_unregister(&dn_proto);
+-
+- rcu_barrier_bh(); /* Wait for completion of call_rcu_bh()'s */
+-}
+-module_exit(decnet_exit);
+-#endif
+diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
+deleted file mode 100644
+index 3235540f6adff..0000000000000
+--- a/net/decnet/dn_dev.c
++++ /dev/null
+@@ -1,1438 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet Device Layer
+- *
+- * Authors: Steve Whitehouse <SteveW@ACM.org>
+- * Eduardo Marcelo Serrat <emserrat@geocities.com>
+- *
+- * Changes:
+- * Steve Whitehouse : Devices now see incoming frames so they
+- * can mark on who it came from.
+- * Steve Whitehouse : Fixed bug in creating neighbours. Each neighbour
+- * can now have a device specific setup func.
+- * Steve Whitehouse : Added /proc/sys/net/decnet/conf/<dev>/
+- * Steve Whitehouse : Fixed bug which sometimes killed timer
+- * Steve Whitehouse : Multiple ifaddr support
+- * Steve Whitehouse : SIOCGIFCONF is now a compile time option
+- * Steve Whitehouse : /proc/sys/net/decnet/conf/<sys>/forwarding
+- * Steve Whitehouse : Removed timer1 - it's a user space issue now
+- * Patrick Caulfield : Fixed router hello message format
+- * Steve Whitehouse : Got rid of constant sizes for blksize for
+- * devices. All mtu based now.
+- */
+-
+-#include <linux/capability.h>
+-#include <linux/module.h>
+-#include <linux/moduleparam.h>
+-#include <linux/init.h>
+-#include <linux/net.h>
+-#include <linux/netdevice.h>
+-#include <linux/proc_fs.h>
+-#include <linux/seq_file.h>
+-#include <linux/timer.h>
+-#include <linux/string.h>
+-#include <linux/if_addr.h>
+-#include <linux/if_arp.h>
+-#include <linux/if_ether.h>
+-#include <linux/skbuff.h>
+-#include <linux/sysctl.h>
+-#include <linux/notifier.h>
+-#include <linux/slab.h>
+-#include <linux/jiffies.h>
+-#include <linux/uaccess.h>
+-#include <net/net_namespace.h>
+-#include <net/neighbour.h>
+-#include <net/dst.h>
+-#include <net/flow.h>
+-#include <net/fib_rules.h>
+-#include <net/netlink.h>
+-#include <net/dn.h>
+-#include <net/dn_dev.h>
+-#include <net/dn_route.h>
+-#include <net/dn_neigh.h>
+-#include <net/dn_fib.h>
+-
+-#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn))
+-
+-static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00};
+-static char dn_rt_all_rt_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x03,0x00,0x00};
+-static char dn_hiord[ETH_ALEN] = {0xAA,0x00,0x04,0x00,0x00,0x00};
+-static unsigned char dn_eco_version[3] = {0x02,0x00,0x00};
+-
+-extern struct neigh_table dn_neigh_table;
+-
+-/*
+- * decnet_address is kept in network order.
+- */
+-__le16 decnet_address = 0;
+-
+-static DEFINE_SPINLOCK(dndev_lock);
+-static struct net_device *decnet_default_device;
+-static BLOCKING_NOTIFIER_HEAD(dnaddr_chain);
+-
+-static struct dn_dev *dn_dev_create(struct net_device *dev, int *err);
+-static void dn_dev_delete(struct net_device *dev);
+-static void dn_ifaddr_notify(int event, struct dn_ifaddr *ifa);
+-
+-static int dn_eth_up(struct net_device *);
+-static void dn_eth_down(struct net_device *);
+-static void dn_send_brd_hello(struct net_device *dev, struct dn_ifaddr *ifa);
+-static void dn_send_ptp_hello(struct net_device *dev, struct dn_ifaddr *ifa);
+-
+-static struct dn_dev_parms dn_dev_list[] = {
+-{
+- .type = ARPHRD_ETHER, /* Ethernet */
+- .mode = DN_DEV_BCAST,
+- .state = DN_DEV_S_RU,
+- .t2 = 1,
+- .t3 = 10,
+- .name = "ethernet",
+- .up = dn_eth_up,
+- .down = dn_eth_down,
+- .timer3 = dn_send_brd_hello,
+-},
+-{
+- .type = ARPHRD_IPGRE, /* DECnet tunneled over GRE in IP */
+- .mode = DN_DEV_BCAST,
+- .state = DN_DEV_S_RU,
+- .t2 = 1,
+- .t3 = 10,
+- .name = "ipgre",
+- .timer3 = dn_send_brd_hello,
+-},
+-#if 0
+-{
+- .type = ARPHRD_X25, /* Bog standard X.25 */
+- .mode = DN_DEV_UCAST,
+- .state = DN_DEV_S_DS,
+- .t2 = 1,
+- .t3 = 120,
+- .name = "x25",
+- .timer3 = dn_send_ptp_hello,
+-},
+-#endif
+-#if 0
+-{
+- .type = ARPHRD_PPP, /* DECnet over PPP */
+- .mode = DN_DEV_BCAST,
+- .state = DN_DEV_S_RU,
+- .t2 = 1,
+- .t3 = 10,
+- .name = "ppp",
+- .timer3 = dn_send_brd_hello,
+-},
+-#endif
+-{
+- .type = ARPHRD_DDCMP, /* DECnet over DDCMP */
+- .mode = DN_DEV_UCAST,
+- .state = DN_DEV_S_DS,
+- .t2 = 1,
+- .t3 = 120,
+- .name = "ddcmp",
+- .timer3 = dn_send_ptp_hello,
+-},
+-{
+- .type = ARPHRD_LOOPBACK, /* Loopback interface - always last */
+- .mode = DN_DEV_BCAST,
+- .state = DN_DEV_S_RU,
+- .t2 = 1,
+- .t3 = 10,
+- .name = "loopback",
+- .timer3 = dn_send_brd_hello,
+-}
+-};
+-
+-#define DN_DEV_LIST_SIZE ARRAY_SIZE(dn_dev_list)
+-
+-#define DN_DEV_PARMS_OFFSET(x) offsetof(struct dn_dev_parms, x)
+-
+-#ifdef CONFIG_SYSCTL
+-
+-static int min_t2[] = { 1 };
+-static int max_t2[] = { 60 }; /* No max specified, but this seems sensible */
+-static int min_t3[] = { 1 };
+-static int max_t3[] = { 8191 }; /* Must fit in 16 bits when multiplied by BCT3MULT or T3MULT */
+-
+-static int min_priority[1];
+-static int max_priority[] = { 127 }; /* From DECnet spec */
+-
+-static int dn_forwarding_proc(struct ctl_table *, int,
+- void __user *, size_t *, loff_t *);
+-static struct dn_dev_sysctl_table {
+- struct ctl_table_header *sysctl_header;
+- struct ctl_table dn_dev_vars[5];
+-} dn_dev_sysctl = {
+- NULL,
+- {
+- {
+- .procname = "forwarding",
+- .data = (void *)DN_DEV_PARMS_OFFSET(forwarding),
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = dn_forwarding_proc,
+- },
+- {
+- .procname = "priority",
+- .data = (void *)DN_DEV_PARMS_OFFSET(priority),
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &min_priority,
+- .extra2 = &max_priority
+- },
+- {
+- .procname = "t2",
+- .data = (void *)DN_DEV_PARMS_OFFSET(t2),
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &min_t2,
+- .extra2 = &max_t2
+- },
+- {
+- .procname = "t3",
+- .data = (void *)DN_DEV_PARMS_OFFSET(t3),
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &min_t3,
+- .extra2 = &max_t3
+- },
+- { }
+- },
+-};
+-
+-static void dn_dev_sysctl_register(struct net_device *dev, struct dn_dev_parms *parms)
+-{
+- struct dn_dev_sysctl_table *t;
+- int i;
+-
+- char path[sizeof("net/decnet/conf/") + IFNAMSIZ];
+-
+- t = kmemdup(&dn_dev_sysctl, sizeof(*t), GFP_KERNEL);
+- if (t == NULL)
+- return;
+-
+- for(i = 0; i < ARRAY_SIZE(t->dn_dev_vars) - 1; i++) {
+- long offset = (long)t->dn_dev_vars[i].data;
+- t->dn_dev_vars[i].data = ((char *)parms) + offset;
+- }
+-
+- snprintf(path, sizeof(path), "net/decnet/conf/%s",
+- dev? dev->name : parms->name);
+-
+- t->dn_dev_vars[0].extra1 = (void *)dev;
+-
+- t->sysctl_header = register_net_sysctl(&init_net, path, t->dn_dev_vars);
+- if (t->sysctl_header == NULL)
+- kfree(t);
+- else
+- parms->sysctl = t;
+-}
+-
+-static void dn_dev_sysctl_unregister(struct dn_dev_parms *parms)
+-{
+- if (parms->sysctl) {
+- struct dn_dev_sysctl_table *t = parms->sysctl;
+- parms->sysctl = NULL;
+- unregister_net_sysctl_table(t->sysctl_header);
+- kfree(t);
+- }
+-}
+-
+-static int dn_forwarding_proc(struct ctl_table *table, int write,
+- void __user *buffer,
+- size_t *lenp, loff_t *ppos)
+-{
+-#ifdef CONFIG_DECNET_ROUTER
+- struct net_device *dev = table->extra1;
+- struct dn_dev *dn_db;
+- int err;
+- int tmp, old;
+-
+- if (table->extra1 == NULL)
+- return -EINVAL;
+-
+- dn_db = rcu_dereference_raw(dev->dn_ptr);
+- old = dn_db->parms.forwarding;
+-
+- err = proc_dointvec(table, write, buffer, lenp, ppos);
+-
+- if ((err >= 0) && write) {
+- if (dn_db->parms.forwarding < 0)
+- dn_db->parms.forwarding = 0;
+- if (dn_db->parms.forwarding > 2)
+- dn_db->parms.forwarding = 2;
+- /*
+- * What an ugly hack this is... its works, just. It
+- * would be nice if sysctl/proc were just that little
+- * bit more flexible so I don't have to write a special
+- * routine, or suffer hacks like this - SJW
+- */
+- tmp = dn_db->parms.forwarding;
+- dn_db->parms.forwarding = old;
+- if (dn_db->parms.down)
+- dn_db->parms.down(dev);
+- dn_db->parms.forwarding = tmp;
+- if (dn_db->parms.up)
+- dn_db->parms.up(dev);
+- }
+-
+- return err;
+-#else
+- return -EINVAL;
+-#endif
+-}
+-
+-#else /* CONFIG_SYSCTL */
+-static void dn_dev_sysctl_unregister(struct dn_dev_parms *parms)
+-{
+-}
+-static void dn_dev_sysctl_register(struct net_device *dev, struct dn_dev_parms *parms)
+-{
+-}
+-
+-#endif /* CONFIG_SYSCTL */
+-
+-static inline __u16 mtu2blksize(struct net_device *dev)
+-{
+- u32 blksize = dev->mtu;
+- if (blksize > 0xffff)
+- blksize = 0xffff;
+-
+- if (dev->type == ARPHRD_ETHER ||
+- dev->type == ARPHRD_PPP ||
+- dev->type == ARPHRD_IPGRE ||
+- dev->type == ARPHRD_LOOPBACK)
+- blksize -= 2;
+-
+- return (__u16)blksize;
+-}
+-
+-static struct dn_ifaddr *dn_dev_alloc_ifa(void)
+-{
+- struct dn_ifaddr *ifa;
+-
+- ifa = kzalloc(sizeof(*ifa), GFP_KERNEL);
+-
+- return ifa;
+-}
+-
+-static void dn_dev_free_ifa(struct dn_ifaddr *ifa)
+-{
+- kfree_rcu(ifa, rcu);
+-}
+-
+-static void dn_dev_del_ifa(struct dn_dev *dn_db, struct dn_ifaddr __rcu **ifap, int destroy)
+-{
+- struct dn_ifaddr *ifa1 = rtnl_dereference(*ifap);
+- unsigned char mac_addr[6];
+- struct net_device *dev = dn_db->dev;
+-
+- ASSERT_RTNL();
+-
+- *ifap = ifa1->ifa_next;
+-
+- if (dn_db->dev->type == ARPHRD_ETHER) {
+- if (ifa1->ifa_local != dn_eth2dn(dev->dev_addr)) {
+- dn_dn2eth(mac_addr, ifa1->ifa_local);
+- dev_mc_del(dev, mac_addr);
+- }
+- }
+-
+- dn_ifaddr_notify(RTM_DELADDR, ifa1);
+- blocking_notifier_call_chain(&dnaddr_chain, NETDEV_DOWN, ifa1);
+- if (destroy) {
+- dn_dev_free_ifa(ifa1);
+-
+- if (dn_db->ifa_list == NULL)
+- dn_dev_delete(dn_db->dev);
+- }
+-}
+-
+-static int dn_dev_insert_ifa(struct dn_dev *dn_db, struct dn_ifaddr *ifa)
+-{
+- struct net_device *dev = dn_db->dev;
+- struct dn_ifaddr *ifa1;
+- unsigned char mac_addr[6];
+-
+- ASSERT_RTNL();
+-
+- /* Check for duplicates */
+- for (ifa1 = rtnl_dereference(dn_db->ifa_list);
+- ifa1 != NULL;
+- ifa1 = rtnl_dereference(ifa1->ifa_next)) {
+- if (ifa1->ifa_local == ifa->ifa_local)
+- return -EEXIST;
+- }
+-
+- if (dev->type == ARPHRD_ETHER) {
+- if (ifa->ifa_local != dn_eth2dn(dev->dev_addr)) {
+- dn_dn2eth(mac_addr, ifa->ifa_local);
+- dev_mc_add(dev, mac_addr);
+- }
+- }
+-
+- ifa->ifa_next = dn_db->ifa_list;
+- rcu_assign_pointer(dn_db->ifa_list, ifa);
+-
+- dn_ifaddr_notify(RTM_NEWADDR, ifa);
+- blocking_notifier_call_chain(&dnaddr_chain, NETDEV_UP, ifa);
+-
+- return 0;
+-}
+-
+-static int dn_dev_set_ifa(struct net_device *dev, struct dn_ifaddr *ifa)
+-{
+- struct dn_dev *dn_db = rtnl_dereference(dev->dn_ptr);
+- int rv;
+-
+- if (dn_db == NULL) {
+- int err;
+- dn_db = dn_dev_create(dev, &err);
+- if (dn_db == NULL)
+- return err;
+- }
+-
+- ifa->ifa_dev = dn_db;
+-
+- if (dev->flags & IFF_LOOPBACK)
+- ifa->ifa_scope = RT_SCOPE_HOST;
+-
+- rv = dn_dev_insert_ifa(dn_db, ifa);
+- if (rv)
+- dn_dev_free_ifa(ifa);
+- return rv;
+-}
+-
+-
+-int dn_dev_ioctl(unsigned int cmd, void __user *arg)
+-{
+- char buffer[DN_IFREQ_SIZE];
+- struct ifreq *ifr = (struct ifreq *)buffer;
+- struct sockaddr_dn *sdn = (struct sockaddr_dn *)&ifr->ifr_addr;
+- struct dn_dev *dn_db;
+- struct net_device *dev;
+- struct dn_ifaddr *ifa = NULL;
+- struct dn_ifaddr __rcu **ifap = NULL;
+- int ret = 0;
+-
+- if (copy_from_user(ifr, arg, DN_IFREQ_SIZE))
+- return -EFAULT;
+- ifr->ifr_name[IFNAMSIZ-1] = 0;
+-
+- dev_load(&init_net, ifr->ifr_name);
+-
+- switch (cmd) {
+- case SIOCGIFADDR:
+- break;
+- case SIOCSIFADDR:
+- if (!capable(CAP_NET_ADMIN))
+- return -EACCES;
+- if (sdn->sdn_family != AF_DECnet)
+- return -EINVAL;
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- rtnl_lock();
+-
+- if ((dev = __dev_get_by_name(&init_net, ifr->ifr_name)) == NULL) {
+- ret = -ENODEV;
+- goto done;
+- }
+-
+- if ((dn_db = rtnl_dereference(dev->dn_ptr)) != NULL) {
+- for (ifap = &dn_db->ifa_list;
+- (ifa = rtnl_dereference(*ifap)) != NULL;
+- ifap = &ifa->ifa_next)
+- if (strcmp(ifr->ifr_name, ifa->ifa_label) == 0)
+- break;
+- }
+-
+- if (ifa == NULL && cmd != SIOCSIFADDR) {
+- ret = -EADDRNOTAVAIL;
+- goto done;
+- }
+-
+- switch (cmd) {
+- case SIOCGIFADDR:
+- *((__le16 *)sdn->sdn_nodeaddr) = ifa->ifa_local;
+- goto rarok;
+-
+- case SIOCSIFADDR:
+- if (!ifa) {
+- if ((ifa = dn_dev_alloc_ifa()) == NULL) {
+- ret = -ENOBUFS;
+- break;
+- }
+- memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
+- } else {
+- if (ifa->ifa_local == dn_saddr2dn(sdn))
+- break;
+- dn_dev_del_ifa(dn_db, ifap, 0);
+- }
+-
+- ifa->ifa_local = ifa->ifa_address = dn_saddr2dn(sdn);
+-
+- ret = dn_dev_set_ifa(dev, ifa);
+- }
+-done:
+- rtnl_unlock();
+-
+- return ret;
+-rarok:
+- if (copy_to_user(arg, ifr, DN_IFREQ_SIZE))
+- ret = -EFAULT;
+- goto done;
+-}
+-
+-struct net_device *dn_dev_get_default(void)
+-{
+- struct net_device *dev;
+-
+- spin_lock(&dndev_lock);
+- dev = decnet_default_device;
+- if (dev) {
+- if (dev->dn_ptr)
+- dev_hold(dev);
+- else
+- dev = NULL;
+- }
+- spin_unlock(&dndev_lock);
+-
+- return dev;
+-}
+-
+-int dn_dev_set_default(struct net_device *dev, int force)
+-{
+- struct net_device *old = NULL;
+- int rv = -EBUSY;
+- if (!dev->dn_ptr)
+- return -ENODEV;
+-
+- spin_lock(&dndev_lock);
+- if (force || decnet_default_device == NULL) {
+- old = decnet_default_device;
+- decnet_default_device = dev;
+- rv = 0;
+- }
+- spin_unlock(&dndev_lock);
+-
+- if (old)
+- dev_put(old);
+- return rv;
+-}
+-
+-static void dn_dev_check_default(struct net_device *dev)
+-{
+- spin_lock(&dndev_lock);
+- if (dev == decnet_default_device) {
+- decnet_default_device = NULL;
+- } else {
+- dev = NULL;
+- }
+- spin_unlock(&dndev_lock);
+-
+- if (dev)
+- dev_put(dev);
+-}
+-
+-/*
+- * Called with RTNL
+- */
+-static struct dn_dev *dn_dev_by_index(int ifindex)
+-{
+- struct net_device *dev;
+- struct dn_dev *dn_dev = NULL;
+-
+- dev = __dev_get_by_index(&init_net, ifindex);
+- if (dev)
+- dn_dev = rtnl_dereference(dev->dn_ptr);
+-
+- return dn_dev;
+-}
+-
+-static const struct nla_policy dn_ifa_policy[IFA_MAX+1] = {
+- [IFA_ADDRESS] = { .type = NLA_U16 },
+- [IFA_LOCAL] = { .type = NLA_U16 },
+- [IFA_LABEL] = { .type = NLA_STRING,
+- .len = IFNAMSIZ - 1 },
+- [IFA_FLAGS] = { .type = NLA_U32 },
+-};
+-
+-static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh,
+- struct netlink_ext_ack *extack)
+-{
+- struct net *net = sock_net(skb->sk);
+- struct nlattr *tb[IFA_MAX+1];
+- struct dn_dev *dn_db;
+- struct ifaddrmsg *ifm;
+- struct dn_ifaddr *ifa;
+- struct dn_ifaddr __rcu **ifap;
+- int err = -EINVAL;
+-
+- if (!netlink_capable(skb, CAP_NET_ADMIN))
+- return -EPERM;
+-
+- if (!net_eq(net, &init_net))
+- goto errout;
+-
+- err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, dn_ifa_policy,
+- extack);
+- if (err < 0)
+- goto errout;
+-
+- err = -ENODEV;
+- ifm = nlmsg_data(nlh);
+- if ((dn_db = dn_dev_by_index(ifm->ifa_index)) == NULL)
+- goto errout;
+-
+- err = -EADDRNOTAVAIL;
+- for (ifap = &dn_db->ifa_list;
+- (ifa = rtnl_dereference(*ifap)) != NULL;
+- ifap = &ifa->ifa_next) {
+- if (tb[IFA_LOCAL] &&
+- nla_memcmp(tb[IFA_LOCAL], &ifa->ifa_local, 2))
+- continue;
+-
+- if (tb[IFA_LABEL] && nla_strcmp(tb[IFA_LABEL], ifa->ifa_label))
+- continue;
+-
+- dn_dev_del_ifa(dn_db, ifap, 1);
+- return 0;
+- }
+-
+-errout:
+- return err;
+-}
+-
+-static int dn_nl_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh,
+- struct netlink_ext_ack *extack)
+-{
+- struct net *net = sock_net(skb->sk);
+- struct nlattr *tb[IFA_MAX+1];
+- struct net_device *dev;
+- struct dn_dev *dn_db;
+- struct ifaddrmsg *ifm;
+- struct dn_ifaddr *ifa;
+- int err;
+-
+- if (!netlink_capable(skb, CAP_NET_ADMIN))
+- return -EPERM;
+-
+- if (!net_eq(net, &init_net))
+- return -EINVAL;
+-
+- err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, dn_ifa_policy,
+- extack);
+- if (err < 0)
+- return err;
+-
+- if (tb[IFA_LOCAL] == NULL)
+- return -EINVAL;
+-
+- ifm = nlmsg_data(nlh);
+- if ((dev = __dev_get_by_index(&init_net, ifm->ifa_index)) == NULL)
+- return -ENODEV;
+-
+- if ((dn_db = rtnl_dereference(dev->dn_ptr)) == NULL) {
+- dn_db = dn_dev_create(dev, &err);
+- if (!dn_db)
+- return err;
+- }
+-
+- if ((ifa = dn_dev_alloc_ifa()) == NULL)
+- return -ENOBUFS;
+-
+- if (tb[IFA_ADDRESS] == NULL)
+- tb[IFA_ADDRESS] = tb[IFA_LOCAL];
+-
+- ifa->ifa_local = nla_get_le16(tb[IFA_LOCAL]);
+- ifa->ifa_address = nla_get_le16(tb[IFA_ADDRESS]);
+- ifa->ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) :
+- ifm->ifa_flags;
+- ifa->ifa_scope = ifm->ifa_scope;
+- ifa->ifa_dev = dn_db;
+-
+- if (tb[IFA_LABEL])
+- nla_strlcpy(ifa->ifa_label, tb[IFA_LABEL], IFNAMSIZ);
+- else
+- memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
+-
+- err = dn_dev_insert_ifa(dn_db, ifa);
+- if (err)
+- dn_dev_free_ifa(ifa);
+-
+- return err;
+-}
+-
+-static inline size_t dn_ifaddr_nlmsg_size(void)
+-{
+- return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
+- + nla_total_size(IFNAMSIZ) /* IFA_LABEL */
+- + nla_total_size(2) /* IFA_ADDRESS */
+- + nla_total_size(2) /* IFA_LOCAL */
+- + nla_total_size(4); /* IFA_FLAGS */
+-}
+-
+-static int dn_nl_fill_ifaddr(struct sk_buff *skb, struct dn_ifaddr *ifa,
+- u32 portid, u32 seq, int event, unsigned int flags)
+-{
+- struct ifaddrmsg *ifm;
+- struct nlmsghdr *nlh;
+- u32 ifa_flags = ifa->ifa_flags | IFA_F_PERMANENT;
+-
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*ifm), flags);
+- if (nlh == NULL)
+- return -EMSGSIZE;
+-
+- ifm = nlmsg_data(nlh);
+- ifm->ifa_family = AF_DECnet;
+- ifm->ifa_prefixlen = 16;
+- ifm->ifa_flags = ifa_flags;
+- ifm->ifa_scope = ifa->ifa_scope;
+- ifm->ifa_index = ifa->ifa_dev->dev->ifindex;
+-
+- if ((ifa->ifa_address &&
+- nla_put_le16(skb, IFA_ADDRESS, ifa->ifa_address)) ||
+- (ifa->ifa_local &&
+- nla_put_le16(skb, IFA_LOCAL, ifa->ifa_local)) ||
+- (ifa->ifa_label[0] &&
+- nla_put_string(skb, IFA_LABEL, ifa->ifa_label)) ||
+- nla_put_u32(skb, IFA_FLAGS, ifa_flags))
+- goto nla_put_failure;
+- nlmsg_end(skb, nlh);
+- return 0;
+-
+-nla_put_failure:
+- nlmsg_cancel(skb, nlh);
+- return -EMSGSIZE;
+-}
+-
+-static void dn_ifaddr_notify(int event, struct dn_ifaddr *ifa)
+-{
+- struct sk_buff *skb;
+- int err = -ENOBUFS;
+-
+- skb = alloc_skb(dn_ifaddr_nlmsg_size(), GFP_KERNEL);
+- if (skb == NULL)
+- goto errout;
+-
+- err = dn_nl_fill_ifaddr(skb, ifa, 0, 0, event, 0);
+- if (err < 0) {
+- /* -EMSGSIZE implies BUG in dn_ifaddr_nlmsg_size() */
+- WARN_ON(err == -EMSGSIZE);
+- kfree_skb(skb);
+- goto errout;
+- }
+- rtnl_notify(skb, &init_net, 0, RTNLGRP_DECnet_IFADDR, NULL, GFP_KERNEL);
+- return;
+-errout:
+- if (err < 0)
+- rtnl_set_sk_err(&init_net, RTNLGRP_DECnet_IFADDR, err);
+-}
+-
+-static int dn_nl_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
+-{
+- struct net *net = sock_net(skb->sk);
+- int idx, dn_idx = 0, skip_ndevs, skip_naddr;
+- struct net_device *dev;
+- struct dn_dev *dn_db;
+- struct dn_ifaddr *ifa;
+-
+- if (!net_eq(net, &init_net))
+- return 0;
+-
+- skip_ndevs = cb->args[0];
+- skip_naddr = cb->args[1];
+-
+- idx = 0;
+- rcu_read_lock();
+- for_each_netdev_rcu(&init_net, dev) {
+- if (idx < skip_ndevs)
+- goto cont;
+- else if (idx > skip_ndevs) {
+- /* Only skip over addresses for first dev dumped
+- * in this iteration (idx == skip_ndevs) */
+- skip_naddr = 0;
+- }
+-
+- if ((dn_db = rcu_dereference(dev->dn_ptr)) == NULL)
+- goto cont;
+-
+- for (ifa = rcu_dereference(dn_db->ifa_list), dn_idx = 0; ifa;
+- ifa = rcu_dereference(ifa->ifa_next), dn_idx++) {
+- if (dn_idx < skip_naddr)
+- continue;
+-
+- if (dn_nl_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).portid,
+- cb->nlh->nlmsg_seq, RTM_NEWADDR,
+- NLM_F_MULTI) < 0)
+- goto done;
+- }
+-cont:
+- idx++;
+- }
+-done:
+- rcu_read_unlock();
+- cb->args[0] = idx;
+- cb->args[1] = dn_idx;
+-
+- return skb->len;
+-}
+-
+-static int dn_dev_get_first(struct net_device *dev, __le16 *addr)
+-{
+- struct dn_dev *dn_db;
+- struct dn_ifaddr *ifa;
+- int rv = -ENODEV;
+-
+- rcu_read_lock();
+- dn_db = rcu_dereference(dev->dn_ptr);
+- if (dn_db == NULL)
+- goto out;
+-
+- ifa = rcu_dereference(dn_db->ifa_list);
+- if (ifa != NULL) {
+- *addr = ifa->ifa_local;
+- rv = 0;
+- }
+-out:
+- rcu_read_unlock();
+- return rv;
+-}
+-
+-/*
+- * Find a default address to bind to.
+- *
+- * This is one of those areas where the initial VMS concepts don't really
+- * map onto the Linux concepts, and since we introduced multiple addresses
+- * per interface we have to cope with slightly odd ways of finding out what
+- * "our address" really is. Mostly it's not a problem; for this we just guess
+- * a sensible default. Eventually the routing code will take care of all the
+- * nasties for us I hope.
+- */
+-int dn_dev_bind_default(__le16 *addr)
+-{
+- struct net_device *dev;
+- int rv;
+- dev = dn_dev_get_default();
+-last_chance:
+- if (dev) {
+- rv = dn_dev_get_first(dev, addr);
+- dev_put(dev);
+- if (rv == 0 || dev == init_net.loopback_dev)
+- return rv;
+- }
+- dev = init_net.loopback_dev;
+- dev_hold(dev);
+- goto last_chance;
+-}
+-
+-static void dn_send_endnode_hello(struct net_device *dev, struct dn_ifaddr *ifa)
+-{
+- struct endnode_hello_message *msg;
+- struct sk_buff *skb = NULL;
+- __le16 *pktlen;
+- struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
+-
+- if ((skb = dn_alloc_skb(NULL, sizeof(*msg), GFP_ATOMIC)) == NULL)
+- return;
+-
+- skb->dev = dev;
+-
+- msg = skb_put(skb, sizeof(*msg));
+-
+- msg->msgflg = 0x0D;
+- memcpy(msg->tiver, dn_eco_version, 3);
+- dn_dn2eth(msg->id, ifa->ifa_local);
+- msg->iinfo = DN_RT_INFO_ENDN;
+- msg->blksize = cpu_to_le16(mtu2blksize(dev));
+- msg->area = 0x00;
+- memset(msg->seed, 0, 8);
+- memcpy(msg->neighbor, dn_hiord, ETH_ALEN);
+-
+- if (dn_db->router) {
+- struct dn_neigh *dn = (struct dn_neigh *)dn_db->router;
+- dn_dn2eth(msg->neighbor, dn->addr);
+- }
+-
+- msg->timer = cpu_to_le16((unsigned short)dn_db->parms.t3);
+- msg->mpd = 0x00;
+- msg->datalen = 0x02;
+- memset(msg->data, 0xAA, 2);
+-
+- pktlen = skb_push(skb, 2);
+- *pktlen = cpu_to_le16(skb->len - 2);
+-
+- skb_reset_network_header(skb);
+-
+- dn_rt_finish_output(skb, dn_rt_all_rt_mcast, msg->id);
+-}
+-
+-
+-#define DRDELAY (5 * HZ)
+-
+-static int dn_am_i_a_router(struct dn_neigh *dn, struct dn_dev *dn_db, struct dn_ifaddr *ifa)
+-{
+- /* First check time since device went up */
+- if (time_before(jiffies, dn_db->uptime + DRDELAY))
+- return 0;
+-
+- /* If there is no router, then yes... */
+- if (!dn_db->router)
+- return 1;
+-
+- /* otherwise only if we have a higher priority or.. */
+- if (dn->priority < dn_db->parms.priority)
+- return 1;
+-
+- /* if we have equal priority and a higher node number */
+- if (dn->priority != dn_db->parms.priority)
+- return 0;
+-
+- if (le16_to_cpu(dn->addr) < le16_to_cpu(ifa->ifa_local))
+- return 1;
+-
+- return 0;
+-}
+-
+-static void dn_send_router_hello(struct net_device *dev, struct dn_ifaddr *ifa)
+-{
+- int n;
+- struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
+- struct dn_neigh *dn = (struct dn_neigh *)dn_db->router;
+- struct sk_buff *skb;
+- size_t size;
+- unsigned char *ptr;
+- unsigned char *i1, *i2;
+- __le16 *pktlen;
+- char *src;
+-
+- if (mtu2blksize(dev) < (26 + 7))
+- return;
+-
+- n = mtu2blksize(dev) - 26;
+- n /= 7;
+-
+- if (n > 32)
+- n = 32;
+-
+- size = 2 + 26 + 7 * n;
+-
+- if ((skb = dn_alloc_skb(NULL, size, GFP_ATOMIC)) == NULL)
+- return;
+-
+- skb->dev = dev;
+- ptr = skb_put(skb, size);
+-
+- *ptr++ = DN_RT_PKT_CNTL | DN_RT_PKT_ERTH;
+- *ptr++ = 2; /* ECO */
+- *ptr++ = 0;
+- *ptr++ = 0;
+- dn_dn2eth(ptr, ifa->ifa_local);
+- src = ptr;
+- ptr += ETH_ALEN;
+- *ptr++ = dn_db->parms.forwarding == 1 ?
+- DN_RT_INFO_L1RT : DN_RT_INFO_L2RT;
+- *((__le16 *)ptr) = cpu_to_le16(mtu2blksize(dev));
+- ptr += 2;
+- *ptr++ = dn_db->parms.priority; /* Priority */
+- *ptr++ = 0; /* Area: Reserved */
+- *((__le16 *)ptr) = cpu_to_le16((unsigned short)dn_db->parms.t3);
+- ptr += 2;
+- *ptr++ = 0; /* MPD: Reserved */
+- i1 = ptr++;
+- memset(ptr, 0, 7); /* Name: Reserved */
+- ptr += 7;
+- i2 = ptr++;
+-
+- n = dn_neigh_elist(dev, ptr, n);
+-
+- *i2 = 7 * n;
+- *i1 = 8 + *i2;
+-
+- skb_trim(skb, (27 + *i2));
+-
+- pktlen = skb_push(skb, 2);
+- *pktlen = cpu_to_le16(skb->len - 2);
+-
+- skb_reset_network_header(skb);
+-
+- if (dn_am_i_a_router(dn, dn_db, ifa)) {
+- struct sk_buff *skb2 = skb_copy(skb, GFP_ATOMIC);
+- if (skb2) {
+- dn_rt_finish_output(skb2, dn_rt_all_end_mcast, src);
+- }
+- }
+-
+- dn_rt_finish_output(skb, dn_rt_all_rt_mcast, src);
+-}
+-
+-static void dn_send_brd_hello(struct net_device *dev, struct dn_ifaddr *ifa)
+-{
+- struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
+-
+- if (dn_db->parms.forwarding == 0)
+- dn_send_endnode_hello(dev, ifa);
+- else
+- dn_send_router_hello(dev, ifa);
+-}
+-
+-static void dn_send_ptp_hello(struct net_device *dev, struct dn_ifaddr *ifa)
+-{
+- int tdlen = 16;
+- int size = dev->hard_header_len + 2 + 4 + tdlen;
+- struct sk_buff *skb = dn_alloc_skb(NULL, size, GFP_ATOMIC);
+- int i;
+- unsigned char *ptr;
+- char src[ETH_ALEN];
+-
+- if (skb == NULL)
+- return ;
+-
+- skb->dev = dev;
+- skb_push(skb, dev->hard_header_len);
+- ptr = skb_put(skb, 2 + 4 + tdlen);
+-
+- *ptr++ = DN_RT_PKT_HELO;
+- *((__le16 *)ptr) = ifa->ifa_local;
+- ptr += 2;
+- *ptr++ = tdlen;
+-
+- for(i = 0; i < tdlen; i++)
+- *ptr++ = 0252;
+-
+- dn_dn2eth(src, ifa->ifa_local);
+- dn_rt_finish_output(skb, dn_rt_all_rt_mcast, src);
+-}
+-
+-static int dn_eth_up(struct net_device *dev)
+-{
+- struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
+-
+- if (dn_db->parms.forwarding == 0)
+- dev_mc_add(dev, dn_rt_all_end_mcast);
+- else
+- dev_mc_add(dev, dn_rt_all_rt_mcast);
+-
+- dn_db->use_long = 1;
+-
+- return 0;
+-}
+-
+-static void dn_eth_down(struct net_device *dev)
+-{
+- struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
+-
+- if (dn_db->parms.forwarding == 0)
+- dev_mc_del(dev, dn_rt_all_end_mcast);
+- else
+- dev_mc_del(dev, dn_rt_all_rt_mcast);
+-}
+-
+-static void dn_dev_set_timer(struct net_device *dev);
+-
+-static void dn_dev_timer_func(struct timer_list *t)
+-{
+- struct dn_dev *dn_db = from_timer(dn_db, t, timer);
+- struct net_device *dev;
+- struct dn_ifaddr *ifa;
+-
+- rcu_read_lock();
+- dev = dn_db->dev;
+- if (dn_db->t3 <= dn_db->parms.t2) {
+- if (dn_db->parms.timer3) {
+- for (ifa = rcu_dereference(dn_db->ifa_list);
+- ifa;
+- ifa = rcu_dereference(ifa->ifa_next)) {
+- if (!(ifa->ifa_flags & IFA_F_SECONDARY))
+- dn_db->parms.timer3(dev, ifa);
+- }
+- }
+- dn_db->t3 = dn_db->parms.t3;
+- } else {
+- dn_db->t3 -= dn_db->parms.t2;
+- }
+- rcu_read_unlock();
+- dn_dev_set_timer(dev);
+-}
+-
+-static void dn_dev_set_timer(struct net_device *dev)
+-{
+- struct dn_dev *dn_db = rcu_dereference_raw(dev->dn_ptr);
+-
+- if (dn_db->parms.t2 > dn_db->parms.t3)
+- dn_db->parms.t2 = dn_db->parms.t3;
+-
+- dn_db->timer.expires = jiffies + (dn_db->parms.t2 * HZ);
+-
+- add_timer(&dn_db->timer);
+-}
+-
+-static struct dn_dev *dn_dev_create(struct net_device *dev, int *err)
+-{
+- int i;
+- struct dn_dev_parms *p = dn_dev_list;
+- struct dn_dev *dn_db;
+-
+- for(i = 0; i < DN_DEV_LIST_SIZE; i++, p++) {
+- if (p->type == dev->type)
+- break;
+- }
+-
+- *err = -ENODEV;
+- if (i == DN_DEV_LIST_SIZE)
+- return NULL;
+-
+- *err = -ENOBUFS;
+- if ((dn_db = kzalloc(sizeof(struct dn_dev), GFP_ATOMIC)) == NULL)
+- return NULL;
+-
+- memcpy(&dn_db->parms, p, sizeof(struct dn_dev_parms));
+-
+- rcu_assign_pointer(dev->dn_ptr, dn_db);
+- dn_db->dev = dev;
+- timer_setup(&dn_db->timer, dn_dev_timer_func, 0);
+-
+- dn_db->uptime = jiffies;
+-
+- dn_db->neigh_parms = neigh_parms_alloc(dev, &dn_neigh_table);
+- if (!dn_db->neigh_parms) {
+- RCU_INIT_POINTER(dev->dn_ptr, NULL);
+- kfree(dn_db);
+- return NULL;
+- }
+-
+- if (dn_db->parms.up) {
+- if (dn_db->parms.up(dev) < 0) {
+- neigh_parms_release(&dn_neigh_table, dn_db->neigh_parms);
+- dev->dn_ptr = NULL;
+- kfree(dn_db);
+- return NULL;
+- }
+- }
+-
+- dn_dev_sysctl_register(dev, &dn_db->parms);
+-
+- dn_dev_set_timer(dev);
+-
+- *err = 0;
+- return dn_db;
+-}
+-
+-
+-/*
+- * This processes a device up event. We only start up
+- * the loopback device & ethernet devices with correct
+- * MAC addresses automatically. Others must be started
+- * specifically.
+- *
+- * FIXME: How should we configure the loopback address ? If we could dispense
+- * with using decnet_address here and for autobind, it will be one less thing
+- * for users to worry about setting up.
+- */
+-
+-void dn_dev_up(struct net_device *dev)
+-{
+- struct dn_ifaddr *ifa;
+- __le16 addr = decnet_address;
+- int maybe_default = 0;
+- struct dn_dev *dn_db = rtnl_dereference(dev->dn_ptr);
+-
+- if ((dev->type != ARPHRD_ETHER) && (dev->type != ARPHRD_LOOPBACK))
+- return;
+-
+- /*
+- * Need to ensure that loopback device has a dn_db attached to it
+- * to allow creation of neighbours against it, even though it might
+- * not have a local address of its own. Might as well do the same for
+- * all autoconfigured interfaces.
+- */
+- if (dn_db == NULL) {
+- int err;
+- dn_db = dn_dev_create(dev, &err);
+- if (dn_db == NULL)
+- return;
+- }
+-
+- if (dev->type == ARPHRD_ETHER) {
+- if (memcmp(dev->dev_addr, dn_hiord, 4) != 0)
+- return;
+- addr = dn_eth2dn(dev->dev_addr);
+- maybe_default = 1;
+- }
+-
+- if (addr == 0)
+- return;
+-
+- if ((ifa = dn_dev_alloc_ifa()) == NULL)
+- return;
+-
+- ifa->ifa_local = ifa->ifa_address = addr;
+- ifa->ifa_flags = 0;
+- ifa->ifa_scope = RT_SCOPE_UNIVERSE;
+- strcpy(ifa->ifa_label, dev->name);
+-
+- dn_dev_set_ifa(dev, ifa);
+-
+- /*
+- * Automagically set the default device to the first automatically
+- * configured ethernet card in the system.
+- */
+- if (maybe_default) {
+- dev_hold(dev);
+- if (dn_dev_set_default(dev, 0))
+- dev_put(dev);
+- }
+-}
+-
+-static void dn_dev_delete(struct net_device *dev)
+-{
+- struct dn_dev *dn_db = rtnl_dereference(dev->dn_ptr);
+-
+- if (dn_db == NULL)
+- return;
+-
+- del_timer_sync(&dn_db->timer);
+- dn_dev_sysctl_unregister(&dn_db->parms);
+- dn_dev_check_default(dev);
+- neigh_ifdown(&dn_neigh_table, dev);
+-
+- if (dn_db->parms.down)
+- dn_db->parms.down(dev);
+-
+- dev->dn_ptr = NULL;
+-
+- neigh_parms_release(&dn_neigh_table, dn_db->neigh_parms);
+- neigh_ifdown(&dn_neigh_table, dev);
+-
+- if (dn_db->router)
+- neigh_release(dn_db->router);
+- if (dn_db->peer)
+- neigh_release(dn_db->peer);
+-
+- kfree(dn_db);
+-}
+-
+-void dn_dev_down(struct net_device *dev)
+-{
+- struct dn_dev *dn_db = rtnl_dereference(dev->dn_ptr);
+- struct dn_ifaddr *ifa;
+-
+- if (dn_db == NULL)
+- return;
+-
+- while ((ifa = rtnl_dereference(dn_db->ifa_list)) != NULL) {
+- dn_dev_del_ifa(dn_db, &dn_db->ifa_list, 0);
+- dn_dev_free_ifa(ifa);
+- }
+-
+- dn_dev_delete(dev);
+-}
+-
+-void dn_dev_init_pkt(struct sk_buff *skb)
+-{
+-}
+-
+-void dn_dev_veri_pkt(struct sk_buff *skb)
+-{
+-}
+-
+-void dn_dev_hello(struct sk_buff *skb)
+-{
+-}
+-
+-void dn_dev_devices_off(void)
+-{
+- struct net_device *dev;
+-
+- rtnl_lock();
+- for_each_netdev(&init_net, dev)
+- dn_dev_down(dev);
+- rtnl_unlock();
+-
+-}
+-
+-void dn_dev_devices_on(void)
+-{
+- struct net_device *dev;
+-
+- rtnl_lock();
+- for_each_netdev(&init_net, dev) {
+- if (dev->flags & IFF_UP)
+- dn_dev_up(dev);
+- }
+- rtnl_unlock();
+-}
+-
+-int register_dnaddr_notifier(struct notifier_block *nb)
+-{
+- return blocking_notifier_chain_register(&dnaddr_chain, nb);
+-}
+-
+-int unregister_dnaddr_notifier(struct notifier_block *nb)
+-{
+- return blocking_notifier_chain_unregister(&dnaddr_chain, nb);
+-}
+-
+-#ifdef CONFIG_PROC_FS
+-static inline int is_dn_dev(struct net_device *dev)
+-{
+- return dev->dn_ptr != NULL;
+-}
+-
+-static void *dn_dev_seq_start(struct seq_file *seq, loff_t *pos)
+- __acquires(RCU)
+-{
+- int i;
+- struct net_device *dev;
+-
+- rcu_read_lock();
+-
+- if (*pos == 0)
+- return SEQ_START_TOKEN;
+-
+- i = 1;
+- for_each_netdev_rcu(&init_net, dev) {
+- if (!is_dn_dev(dev))
+- continue;
+-
+- if (i++ == *pos)
+- return dev;
+- }
+-
+- return NULL;
+-}
+-
+-static void *dn_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+-{
+- struct net_device *dev;
+-
+- ++*pos;
+-
+- dev = v;
+- if (v == SEQ_START_TOKEN)
+- dev = net_device_entry(&init_net.dev_base_head);
+-
+- for_each_netdev_continue_rcu(&init_net, dev) {
+- if (!is_dn_dev(dev))
+- continue;
+-
+- return dev;
+- }
+-
+- return NULL;
+-}
+-
+-static void dn_dev_seq_stop(struct seq_file *seq, void *v)
+- __releases(RCU)
+-{
+- rcu_read_unlock();
+-}
+-
+-static char *dn_type2asc(char type)
+-{
+- switch (type) {
+- case DN_DEV_BCAST:
+- return "B";
+- case DN_DEV_UCAST:
+- return "U";
+- case DN_DEV_MPOINT:
+- return "M";
+- }
+-
+- return "?";
+-}
+-
+-static int dn_dev_seq_show(struct seq_file *seq, void *v)
+-{
+- if (v == SEQ_START_TOKEN)
+- seq_puts(seq, "Name Flags T1 Timer1 T3 Timer3 BlkSize Pri State DevType Router Peer\n");
+- else {
+- struct net_device *dev = v;
+- char peer_buf[DN_ASCBUF_LEN];
+- char router_buf[DN_ASCBUF_LEN];
+- struct dn_dev *dn_db = rcu_dereference(dev->dn_ptr);
+-
+- seq_printf(seq, "%-8s %1s %04u %04u %04lu %04lu"
+- " %04hu %03d %02x %-10s %-7s %-7s\n",
+- dev->name ? dev->name : "???",
+- dn_type2asc(dn_db->parms.mode),
+- 0, 0,
+- dn_db->t3, dn_db->parms.t3,
+- mtu2blksize(dev),
+- dn_db->parms.priority,
+- dn_db->parms.state, dn_db->parms.name,
+- dn_db->router ? dn_addr2asc(le16_to_cpu(*(__le16 *)dn_db->router->primary_key), router_buf) : "",
+- dn_db->peer ? dn_addr2asc(le16_to_cpu(*(__le16 *)dn_db->peer->primary_key), peer_buf) : "");
+- }
+- return 0;
+-}
+-
+-static const struct seq_operations dn_dev_seq_ops = {
+- .start = dn_dev_seq_start,
+- .next = dn_dev_seq_next,
+- .stop = dn_dev_seq_stop,
+- .show = dn_dev_seq_show,
+-};
+-#endif /* CONFIG_PROC_FS */
+-
+-static int addr[2];
+-module_param_array(addr, int, NULL, 0444);
+-MODULE_PARM_DESC(addr, "The DECnet address of this machine: area,node");
+-
+-void __init dn_dev_init(void)
+-{
+- if (addr[0] > 63 || addr[0] < 0) {
+- printk(KERN_ERR "DECnet: Area must be between 0 and 63");
+- return;
+- }
+-
+- if (addr[1] > 1023 || addr[1] < 0) {
+- printk(KERN_ERR "DECnet: Node must be between 0 and 1023");
+- return;
+- }
+-
+- decnet_address = cpu_to_le16((addr[0] << 10) | addr[1]);
+-
+- dn_dev_devices_on();
+-
+- rtnl_register_module(THIS_MODULE, PF_DECnet, RTM_NEWADDR,
+- dn_nl_newaddr, NULL, 0);
+- rtnl_register_module(THIS_MODULE, PF_DECnet, RTM_DELADDR,
+- dn_nl_deladdr, NULL, 0);
+- rtnl_register_module(THIS_MODULE, PF_DECnet, RTM_GETADDR,
+- NULL, dn_nl_dump_ifaddr, 0);
+-
+- proc_create_seq("decnet_dev", 0444, init_net.proc_net, &dn_dev_seq_ops);
+-
+-#ifdef CONFIG_SYSCTL
+- {
+- int i;
+- for(i = 0; i < DN_DEV_LIST_SIZE; i++)
+- dn_dev_sysctl_register(NULL, &dn_dev_list[i]);
+- }
+-#endif /* CONFIG_SYSCTL */
+-}
+-
+-void __exit dn_dev_cleanup(void)
+-{
+-#ifdef CONFIG_SYSCTL
+- {
+- int i;
+- for(i = 0; i < DN_DEV_LIST_SIZE; i++)
+- dn_dev_sysctl_unregister(&dn_dev_list[i]);
+- }
+-#endif /* CONFIG_SYSCTL */
+-
+- remove_proc_entry("decnet_dev", init_net.proc_net);
+-
+- dn_dev_devices_off();
+-}
+diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
+deleted file mode 100644
+index f78fe58eafc82..0000000000000
+--- a/net/decnet/dn_fib.c
++++ /dev/null
+@@ -1,799 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet Routing Forwarding Information Base (Glue/Info List)
+- *
+- * Author: Steve Whitehouse <SteveW@ACM.org>
+- *
+- *
+- * Changes:
+- * Alexey Kuznetsov : SMP locking changes
+- * Steve Whitehouse : Rewrote it... Well to be more correct, I
+- * copied most of it from the ipv4 fib code.
+- * Steve Whitehouse : Updated it in style and fixed a few bugs
+- * which were fixed in the ipv4 code since
+- * this code was copied from it.
+- *
+- */
+-#include <linux/string.h>
+-#include <linux/net.h>
+-#include <linux/socket.h>
+-#include <linux/slab.h>
+-#include <linux/sockios.h>
+-#include <linux/init.h>
+-#include <linux/skbuff.h>
+-#include <linux/netlink.h>
+-#include <linux/rtnetlink.h>
+-#include <linux/proc_fs.h>
+-#include <linux/netdevice.h>
+-#include <linux/timer.h>
+-#include <linux/spinlock.h>
+-#include <linux/atomic.h>
+-#include <linux/uaccess.h>
+-#include <net/neighbour.h>
+-#include <net/dst.h>
+-#include <net/flow.h>
+-#include <net/fib_rules.h>
+-#include <net/dn.h>
+-#include <net/dn_route.h>
+-#include <net/dn_fib.h>
+-#include <net/dn_neigh.h>
+-#include <net/dn_dev.h>
+-#include <net/nexthop.h>
+-
+-#define RT_MIN_TABLE 1
+-
+-#define for_fib_info() { struct dn_fib_info *fi;\
+- for(fi = dn_fib_info_list; fi; fi = fi->fib_next)
+-#define endfor_fib_info() }
+-
+-#define for_nexthops(fi) { int nhsel; const struct dn_fib_nh *nh;\
+- for(nhsel = 0, nh = (fi)->fib_nh; nhsel < (fi)->fib_nhs; nh++, nhsel++)
+-
+-#define change_nexthops(fi) { int nhsel; struct dn_fib_nh *nh;\
+- for(nhsel = 0, nh = (struct dn_fib_nh *)((fi)->fib_nh); nhsel < (fi)->fib_nhs; nh++, nhsel++)
+-
+-#define endfor_nexthops(fi) }
+-
+-static DEFINE_SPINLOCK(dn_fib_multipath_lock);
+-static struct dn_fib_info *dn_fib_info_list;
+-static DEFINE_SPINLOCK(dn_fib_info_lock);
+-
+-static struct
+-{
+- int error;
+- u8 scope;
+-} dn_fib_props[RTN_MAX+1] = {
+- [RTN_UNSPEC] = { .error = 0, .scope = RT_SCOPE_NOWHERE },
+- [RTN_UNICAST] = { .error = 0, .scope = RT_SCOPE_UNIVERSE },
+- [RTN_LOCAL] = { .error = 0, .scope = RT_SCOPE_HOST },
+- [RTN_BROADCAST] = { .error = -EINVAL, .scope = RT_SCOPE_NOWHERE },
+- [RTN_ANYCAST] = { .error = -EINVAL, .scope = RT_SCOPE_NOWHERE },
+- [RTN_MULTICAST] = { .error = -EINVAL, .scope = RT_SCOPE_NOWHERE },
+- [RTN_BLACKHOLE] = { .error = -EINVAL, .scope = RT_SCOPE_UNIVERSE },
+- [RTN_UNREACHABLE] = { .error = -EHOSTUNREACH, .scope = RT_SCOPE_UNIVERSE },
+- [RTN_PROHIBIT] = { .error = -EACCES, .scope = RT_SCOPE_UNIVERSE },
+- [RTN_THROW] = { .error = -EAGAIN, .scope = RT_SCOPE_UNIVERSE },
+- [RTN_NAT] = { .error = 0, .scope = RT_SCOPE_NOWHERE },
+- [RTN_XRESOLVE] = { .error = -EINVAL, .scope = RT_SCOPE_NOWHERE },
+-};
+-
+-static int dn_fib_sync_down(__le16 local, struct net_device *dev, int force);
+-static int dn_fib_sync_up(struct net_device *dev);
+-
+-void dn_fib_free_info(struct dn_fib_info *fi)
+-{
+- if (fi->fib_dead == 0) {
+- printk(KERN_DEBUG "DECnet: BUG! Attempt to free alive dn_fib_info\n");
+- return;
+- }
+-
+- change_nexthops(fi) {
+- if (nh->nh_dev)
+- dev_put(nh->nh_dev);
+- nh->nh_dev = NULL;
+- } endfor_nexthops(fi);
+- kfree(fi);
+-}
+-
+-void dn_fib_release_info(struct dn_fib_info *fi)
+-{
+- spin_lock(&dn_fib_info_lock);
+- if (fi && --fi->fib_treeref == 0) {
+- if (fi->fib_next)
+- fi->fib_next->fib_prev = fi->fib_prev;
+- if (fi->fib_prev)
+- fi->fib_prev->fib_next = fi->fib_next;
+- if (fi == dn_fib_info_list)
+- dn_fib_info_list = fi->fib_next;
+- fi->fib_dead = 1;
+- dn_fib_info_put(fi);
+- }
+- spin_unlock(&dn_fib_info_lock);
+-}
+-
+-static inline int dn_fib_nh_comp(const struct dn_fib_info *fi, const struct dn_fib_info *ofi)
+-{
+- const struct dn_fib_nh *onh = ofi->fib_nh;
+-
+- for_nexthops(fi) {
+- if (nh->nh_oif != onh->nh_oif ||
+- nh->nh_gw != onh->nh_gw ||
+- nh->nh_scope != onh->nh_scope ||
+- nh->nh_weight != onh->nh_weight ||
+- ((nh->nh_flags^onh->nh_flags)&~RTNH_F_DEAD))
+- return -1;
+- onh++;
+- } endfor_nexthops(fi);
+- return 0;
+-}
+-
+-static inline struct dn_fib_info *dn_fib_find_info(const struct dn_fib_info *nfi)
+-{
+- for_fib_info() {
+- if (fi->fib_nhs != nfi->fib_nhs)
+- continue;
+- if (nfi->fib_protocol == fi->fib_protocol &&
+- nfi->fib_prefsrc == fi->fib_prefsrc &&
+- nfi->fib_priority == fi->fib_priority &&
+- memcmp(nfi->fib_metrics, fi->fib_metrics, sizeof(fi->fib_metrics)) == 0 &&
+- ((nfi->fib_flags^fi->fib_flags)&~RTNH_F_DEAD) == 0 &&
+- (nfi->fib_nhs == 0 || dn_fib_nh_comp(fi, nfi) == 0))
+- return fi;
+- } endfor_fib_info();
+- return NULL;
+-}
+-
+-static int dn_fib_count_nhs(const struct nlattr *attr)
+-{
+- struct rtnexthop *nhp = nla_data(attr);
+- int nhs = 0, nhlen = nla_len(attr);
+-
+- while (rtnh_ok(nhp, nhlen)) {
+- nhs++;
+- nhp = rtnh_next(nhp, &nhlen);
+- }
+-
+- /* leftover implies invalid nexthop configuration, discard it */
+- return nhlen > 0 ? 0 : nhs;
+-}
+-
+-static int dn_fib_get_nhs(struct dn_fib_info *fi, const struct nlattr *attr,
+- const struct rtmsg *r)
+-{
+- struct rtnexthop *nhp = nla_data(attr);
+- int nhlen = nla_len(attr);
+-
+- change_nexthops(fi) {
+- int attrlen;
+-
+- if (!rtnh_ok(nhp, nhlen))
+- return -EINVAL;
+-
+- nh->nh_flags = (r->rtm_flags&~0xFF) | nhp->rtnh_flags;
+- nh->nh_oif = nhp->rtnh_ifindex;
+- nh->nh_weight = nhp->rtnh_hops + 1;
+-
+- attrlen = rtnh_attrlen(nhp);
+- if (attrlen > 0) {
+- struct nlattr *gw_attr;
+-
+- gw_attr = nla_find((struct nlattr *) (nhp + 1), attrlen, RTA_GATEWAY);
+- nh->nh_gw = gw_attr ? nla_get_le16(gw_attr) : 0;
+- }
+-
+- nhp = rtnh_next(nhp, &nhlen);
+- } endfor_nexthops(fi);
+-
+- return 0;
+-}
+-
+-
+-static int dn_fib_check_nh(const struct rtmsg *r, struct dn_fib_info *fi, struct dn_fib_nh *nh)
+-{
+- int err;
+-
+- if (nh->nh_gw) {
+- struct flowidn fld;
+- struct dn_fib_res res;
+-
+- if (nh->nh_flags&RTNH_F_ONLINK) {
+- struct net_device *dev;
+-
+- if (r->rtm_scope >= RT_SCOPE_LINK)
+- return -EINVAL;
+- if (dnet_addr_type(nh->nh_gw) != RTN_UNICAST)
+- return -EINVAL;
+- if ((dev = __dev_get_by_index(&init_net, nh->nh_oif)) == NULL)
+- return -ENODEV;
+- if (!(dev->flags&IFF_UP))
+- return -ENETDOWN;
+- nh->nh_dev = dev;
+- dev_hold(dev);
+- nh->nh_scope = RT_SCOPE_LINK;
+- return 0;
+- }
+-
+- memset(&fld, 0, sizeof(fld));
+- fld.daddr = nh->nh_gw;
+- fld.flowidn_oif = nh->nh_oif;
+- fld.flowidn_scope = r->rtm_scope + 1;
+-
+- if (fld.flowidn_scope < RT_SCOPE_LINK)
+- fld.flowidn_scope = RT_SCOPE_LINK;
+-
+- if ((err = dn_fib_lookup(&fld, &res)) != 0)
+- return err;
+-
+- err = -EINVAL;
+- if (res.type != RTN_UNICAST && res.type != RTN_LOCAL)
+- goto out;
+- nh->nh_scope = res.scope;
+- nh->nh_oif = DN_FIB_RES_OIF(res);
+- nh->nh_dev = DN_FIB_RES_DEV(res);
+- if (nh->nh_dev == NULL)
+- goto out;
+- dev_hold(nh->nh_dev);
+- err = -ENETDOWN;
+- if (!(nh->nh_dev->flags & IFF_UP))
+- goto out;
+- err = 0;
+-out:
+- dn_fib_res_put(&res);
+- return err;
+- } else {
+- struct net_device *dev;
+-
+- if (nh->nh_flags&(RTNH_F_PERVASIVE|RTNH_F_ONLINK))
+- return -EINVAL;
+-
+- dev = __dev_get_by_index(&init_net, nh->nh_oif);
+- if (dev == NULL || dev->dn_ptr == NULL)
+- return -ENODEV;
+- if (!(dev->flags&IFF_UP))
+- return -ENETDOWN;
+- nh->nh_dev = dev;
+- dev_hold(nh->nh_dev);
+- nh->nh_scope = RT_SCOPE_HOST;
+- }
+-
+- return 0;
+-}
+-
+-
+-struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct nlattr *attrs[],
+- const struct nlmsghdr *nlh, int *errp)
+-{
+- int err;
+- struct dn_fib_info *fi = NULL;
+- struct dn_fib_info *ofi;
+- int nhs = 1;
+-
+- if (r->rtm_type > RTN_MAX)
+- goto err_inval;
+-
+- if (dn_fib_props[r->rtm_type].scope > r->rtm_scope)
+- goto err_inval;
+-
+- if (attrs[RTA_MULTIPATH] &&
+- (nhs = dn_fib_count_nhs(attrs[RTA_MULTIPATH])) == 0)
+- goto err_inval;
+-
+- fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct dn_fib_nh), GFP_KERNEL);
+- err = -ENOBUFS;
+- if (fi == NULL)
+- goto failure;
+-
+- fi->fib_protocol = r->rtm_protocol;
+- fi->fib_nhs = nhs;
+- fi->fib_flags = r->rtm_flags;
+-
+- if (attrs[RTA_PRIORITY])
+- fi->fib_priority = nla_get_u32(attrs[RTA_PRIORITY]);
+-
+- if (attrs[RTA_METRICS]) {
+- struct nlattr *attr;
+- int rem;
+-
+- nla_for_each_nested(attr, attrs[RTA_METRICS], rem) {
+- int type = nla_type(attr);
+-
+- if (type) {
+- if (type > RTAX_MAX || type == RTAX_CC_ALGO ||
+- nla_len(attr) < 4)
+- goto err_inval;
+-
+- fi->fib_metrics[type-1] = nla_get_u32(attr);
+- }
+- }
+- }
+-
+- if (attrs[RTA_PREFSRC])
+- fi->fib_prefsrc = nla_get_le16(attrs[RTA_PREFSRC]);
+-
+- if (attrs[RTA_MULTIPATH]) {
+- if ((err = dn_fib_get_nhs(fi, attrs[RTA_MULTIPATH], r)) != 0)
+- goto failure;
+-
+- if (attrs[RTA_OIF] &&
+- fi->fib_nh->nh_oif != nla_get_u32(attrs[RTA_OIF]))
+- goto err_inval;
+-
+- if (attrs[RTA_GATEWAY] &&
+- fi->fib_nh->nh_gw != nla_get_le16(attrs[RTA_GATEWAY]))
+- goto err_inval;
+- } else {
+- struct dn_fib_nh *nh = fi->fib_nh;
+-
+- if (attrs[RTA_OIF])
+- nh->nh_oif = nla_get_u32(attrs[RTA_OIF]);
+-
+- if (attrs[RTA_GATEWAY])
+- nh->nh_gw = nla_get_le16(attrs[RTA_GATEWAY]);
+-
+- nh->nh_flags = r->rtm_flags;
+- nh->nh_weight = 1;
+- }
+-
+- if (r->rtm_type == RTN_NAT) {
+- if (!attrs[RTA_GATEWAY] || nhs != 1 || attrs[RTA_OIF])
+- goto err_inval;
+-
+- fi->fib_nh->nh_gw = nla_get_le16(attrs[RTA_GATEWAY]);
+- goto link_it;
+- }
+-
+- if (dn_fib_props[r->rtm_type].error) {
+- if (attrs[RTA_GATEWAY] || attrs[RTA_OIF] || attrs[RTA_MULTIPATH])
+- goto err_inval;
+-
+- goto link_it;
+- }
+-
+- if (r->rtm_scope > RT_SCOPE_HOST)
+- goto err_inval;
+-
+- if (r->rtm_scope == RT_SCOPE_HOST) {
+- struct dn_fib_nh *nh = fi->fib_nh;
+-
+- /* Local address is added */
+- if (nhs != 1 || nh->nh_gw)
+- goto err_inval;
+- nh->nh_scope = RT_SCOPE_NOWHERE;
+- nh->nh_dev = dev_get_by_index(&init_net, fi->fib_nh->nh_oif);
+- err = -ENODEV;
+- if (nh->nh_dev == NULL)
+- goto failure;
+- } else {
+- change_nexthops(fi) {
+- if ((err = dn_fib_check_nh(r, fi, nh)) != 0)
+- goto failure;
+- } endfor_nexthops(fi)
+- }
+-
+- if (fi->fib_prefsrc) {
+- if (r->rtm_type != RTN_LOCAL || !attrs[RTA_DST] ||
+- fi->fib_prefsrc != nla_get_le16(attrs[RTA_DST]))
+- if (dnet_addr_type(fi->fib_prefsrc) != RTN_LOCAL)
+- goto err_inval;
+- }
+-
+-link_it:
+- if ((ofi = dn_fib_find_info(fi)) != NULL) {
+- fi->fib_dead = 1;
+- dn_fib_free_info(fi);
+- ofi->fib_treeref++;
+- return ofi;
+- }
+-
+- fi->fib_treeref++;
+- refcount_set(&fi->fib_clntref, 1);
+- spin_lock(&dn_fib_info_lock);
+- fi->fib_next = dn_fib_info_list;
+- fi->fib_prev = NULL;
+- if (dn_fib_info_list)
+- dn_fib_info_list->fib_prev = fi;
+- dn_fib_info_list = fi;
+- spin_unlock(&dn_fib_info_lock);
+- return fi;
+-
+-err_inval:
+- err = -EINVAL;
+-
+-failure:
+- *errp = err;
+- if (fi) {
+- fi->fib_dead = 1;
+- dn_fib_free_info(fi);
+- }
+-
+- return NULL;
+-}
+-
+-int dn_fib_semantic_match(int type, struct dn_fib_info *fi, const struct flowidn *fld, struct dn_fib_res *res)
+-{
+- int err = dn_fib_props[type].error;
+-
+- if (err == 0) {
+- if (fi->fib_flags & RTNH_F_DEAD)
+- return 1;
+-
+- res->fi = fi;
+-
+- switch (type) {
+- case RTN_NAT:
+- DN_FIB_RES_RESET(*res);
+- refcount_inc(&fi->fib_clntref);
+- return 0;
+- case RTN_UNICAST:
+- case RTN_LOCAL:
+- for_nexthops(fi) {
+- if (nh->nh_flags & RTNH_F_DEAD)
+- continue;
+- if (!fld->flowidn_oif ||
+- fld->flowidn_oif == nh->nh_oif)
+- break;
+- }
+- if (nhsel < fi->fib_nhs) {
+- res->nh_sel = nhsel;
+- refcount_inc(&fi->fib_clntref);
+- return 0;
+- }
+- endfor_nexthops(fi);
+- res->fi = NULL;
+- return 1;
+- default:
+- net_err_ratelimited("DECnet: impossible routing event : dn_fib_semantic_match type=%d\n",
+- type);
+- res->fi = NULL;
+- return -EINVAL;
+- }
+- }
+- return err;
+-}
+-
+-void dn_fib_select_multipath(const struct flowidn *fld, struct dn_fib_res *res)
+-{
+- struct dn_fib_info *fi = res->fi;
+- int w;
+-
+- spin_lock_bh(&dn_fib_multipath_lock);
+- if (fi->fib_power <= 0) {
+- int power = 0;
+- change_nexthops(fi) {
+- if (!(nh->nh_flags&RTNH_F_DEAD)) {
+- power += nh->nh_weight;
+- nh->nh_power = nh->nh_weight;
+- }
+- } endfor_nexthops(fi);
+- fi->fib_power = power;
+- if (power < 0) {
+- spin_unlock_bh(&dn_fib_multipath_lock);
+- res->nh_sel = 0;
+- return;
+- }
+- }
+-
+- w = jiffies % fi->fib_power;
+-
+- change_nexthops(fi) {
+- if (!(nh->nh_flags&RTNH_F_DEAD) && nh->nh_power) {
+- if ((w -= nh->nh_power) <= 0) {
+- nh->nh_power--;
+- fi->fib_power--;
+- res->nh_sel = nhsel;
+- spin_unlock_bh(&dn_fib_multipath_lock);
+- return;
+- }
+- }
+- } endfor_nexthops(fi);
+- res->nh_sel = 0;
+- spin_unlock_bh(&dn_fib_multipath_lock);
+-}
+-
+-static inline u32 rtm_get_table(struct nlattr *attrs[], u8 table)
+-{
+- if (attrs[RTA_TABLE])
+- table = nla_get_u32(attrs[RTA_TABLE]);
+-
+- return table;
+-}
+-
+-static int dn_fib_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh,
+- struct netlink_ext_ack *extack)
+-{
+- struct net *net = sock_net(skb->sk);
+- struct dn_fib_table *tb;
+- struct rtmsg *r = nlmsg_data(nlh);
+- struct nlattr *attrs[RTA_MAX+1];
+- int err;
+-
+- if (!netlink_capable(skb, CAP_NET_ADMIN))
+- return -EPERM;
+-
+- if (!net_eq(net, &init_net))
+- return -EINVAL;
+-
+- err = nlmsg_parse(nlh, sizeof(*r), attrs, RTA_MAX, rtm_dn_policy,
+- extack);
+- if (err < 0)
+- return err;
+-
+- tb = dn_fib_get_table(rtm_get_table(attrs, r->rtm_table), 0);
+- if (!tb)
+- return -ESRCH;
+-
+- return tb->delete(tb, r, attrs, nlh, &NETLINK_CB(skb));
+-}
+-
+-static int dn_fib_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh,
+- struct netlink_ext_ack *extack)
+-{
+- struct net *net = sock_net(skb->sk);
+- struct dn_fib_table *tb;
+- struct rtmsg *r = nlmsg_data(nlh);
+- struct nlattr *attrs[RTA_MAX+1];
+- int err;
+-
+- if (!netlink_capable(skb, CAP_NET_ADMIN))
+- return -EPERM;
+-
+- if (!net_eq(net, &init_net))
+- return -EINVAL;
+-
+- err = nlmsg_parse(nlh, sizeof(*r), attrs, RTA_MAX, rtm_dn_policy,
+- extack);
+- if (err < 0)
+- return err;
+-
+- tb = dn_fib_get_table(rtm_get_table(attrs, r->rtm_table), 1);
+- if (!tb)
+- return -ENOBUFS;
+-
+- return tb->insert(tb, r, attrs, nlh, &NETLINK_CB(skb));
+-}
+-
+-static void fib_magic(int cmd, int type, __le16 dst, int dst_len, struct dn_ifaddr *ifa)
+-{
+- struct dn_fib_table *tb;
+- struct {
+- struct nlmsghdr nlh;
+- struct rtmsg rtm;
+- } req;
+- struct {
+- struct nlattr hdr;
+- __le16 dst;
+- } dst_attr = {
+- .dst = dst,
+- };
+- struct {
+- struct nlattr hdr;
+- __le16 prefsrc;
+- } prefsrc_attr = {
+- .prefsrc = ifa->ifa_local,
+- };
+- struct {
+- struct nlattr hdr;
+- u32 oif;
+- } oif_attr = {
+- .oif = ifa->ifa_dev->dev->ifindex,
+- };
+- struct nlattr *attrs[RTA_MAX+1] = {
+- [RTA_DST] = (struct nlattr *) &dst_attr,
+- [RTA_PREFSRC] = (struct nlattr * ) &prefsrc_attr,
+- [RTA_OIF] = (struct nlattr *) &oif_attr,
+- };
+-
+- memset(&req.rtm, 0, sizeof(req.rtm));
+-
+- if (type == RTN_UNICAST)
+- tb = dn_fib_get_table(RT_MIN_TABLE, 1);
+- else
+- tb = dn_fib_get_table(RT_TABLE_LOCAL, 1);
+-
+- if (tb == NULL)
+- return;
+-
+- req.nlh.nlmsg_len = sizeof(req);
+- req.nlh.nlmsg_type = cmd;
+- req.nlh.nlmsg_flags = NLM_F_REQUEST|NLM_F_CREATE|NLM_F_APPEND;
+- req.nlh.nlmsg_pid = 0;
+- req.nlh.nlmsg_seq = 0;
+-
+- req.rtm.rtm_dst_len = dst_len;
+- req.rtm.rtm_table = tb->n;
+- req.rtm.rtm_protocol = RTPROT_KERNEL;
+- req.rtm.rtm_scope = (type != RTN_LOCAL ? RT_SCOPE_LINK : RT_SCOPE_HOST);
+- req.rtm.rtm_type = type;
+-
+- if (cmd == RTM_NEWROUTE)
+- tb->insert(tb, &req.rtm, attrs, &req.nlh, NULL);
+- else
+- tb->delete(tb, &req.rtm, attrs, &req.nlh, NULL);
+-}
+-
+-static void dn_fib_add_ifaddr(struct dn_ifaddr *ifa)
+-{
+-
+- fib_magic(RTM_NEWROUTE, RTN_LOCAL, ifa->ifa_local, 16, ifa);
+-
+-#if 0
+- if (!(dev->flags&IFF_UP))
+- return;
+- /* In the future, we will want to add default routes here */
+-
+-#endif
+-}
+-
+-static void dn_fib_del_ifaddr(struct dn_ifaddr *ifa)
+-{
+- int found_it = 0;
+- struct net_device *dev;
+- struct dn_dev *dn_db;
+- struct dn_ifaddr *ifa2;
+-
+- ASSERT_RTNL();
+-
+- /* Scan device list */
+- rcu_read_lock();
+- for_each_netdev_rcu(&init_net, dev) {
+- dn_db = rcu_dereference(dev->dn_ptr);
+- if (dn_db == NULL)
+- continue;
+- for (ifa2 = rcu_dereference(dn_db->ifa_list);
+- ifa2 != NULL;
+- ifa2 = rcu_dereference(ifa2->ifa_next)) {
+- if (ifa2->ifa_local == ifa->ifa_local) {
+- found_it = 1;
+- break;
+- }
+- }
+- }
+- rcu_read_unlock();
+-
+- if (found_it == 0) {
+- fib_magic(RTM_DELROUTE, RTN_LOCAL, ifa->ifa_local, 16, ifa);
+-
+- if (dnet_addr_type(ifa->ifa_local) != RTN_LOCAL) {
+- if (dn_fib_sync_down(ifa->ifa_local, NULL, 0))
+- dn_fib_flush();
+- }
+- }
+-}
+-
+-static void dn_fib_disable_addr(struct net_device *dev, int force)
+-{
+- if (dn_fib_sync_down(0, dev, force))
+- dn_fib_flush();
+- dn_rt_cache_flush(0);
+- neigh_ifdown(&dn_neigh_table, dev);
+-}
+-
+-static int dn_fib_dnaddr_event(struct notifier_block *this, unsigned long event, void *ptr)
+-{
+- struct dn_ifaddr *ifa = (struct dn_ifaddr *)ptr;
+-
+- switch (event) {
+- case NETDEV_UP:
+- dn_fib_add_ifaddr(ifa);
+- dn_fib_sync_up(ifa->ifa_dev->dev);
+- dn_rt_cache_flush(-1);
+- break;
+- case NETDEV_DOWN:
+- dn_fib_del_ifaddr(ifa);
+- if (ifa->ifa_dev && ifa->ifa_dev->ifa_list == NULL) {
+- dn_fib_disable_addr(ifa->ifa_dev->dev, 1);
+- } else {
+- dn_rt_cache_flush(-1);
+- }
+- break;
+- }
+- return NOTIFY_DONE;
+-}
+-
+-static int dn_fib_sync_down(__le16 local, struct net_device *dev, int force)
+-{
+- int ret = 0;
+- int scope = RT_SCOPE_NOWHERE;
+-
+- if (force)
+- scope = -1;
+-
+- for_fib_info() {
+- /*
+- * This makes no sense for DECnet.... we will almost
+- * certainly have more than one local address the same
+- * over all our interfaces. It needs thinking about
+- * some more.
+- */
+- if (local && fi->fib_prefsrc == local) {
+- fi->fib_flags |= RTNH_F_DEAD;
+- ret++;
+- } else if (dev && fi->fib_nhs) {
+- int dead = 0;
+-
+- change_nexthops(fi) {
+- if (nh->nh_flags&RTNH_F_DEAD)
+- dead++;
+- else if (nh->nh_dev == dev &&
+- nh->nh_scope != scope) {
+- spin_lock_bh(&dn_fib_multipath_lock);
+- nh->nh_flags |= RTNH_F_DEAD;
+- fi->fib_power -= nh->nh_power;
+- nh->nh_power = 0;
+- spin_unlock_bh(&dn_fib_multipath_lock);
+- dead++;
+- }
+- } endfor_nexthops(fi)
+- if (dead == fi->fib_nhs) {
+- fi->fib_flags |= RTNH_F_DEAD;
+- ret++;
+- }
+- }
+- } endfor_fib_info();
+- return ret;
+-}
+-
+-
+-static int dn_fib_sync_up(struct net_device *dev)
+-{
+- int ret = 0;
+-
+- if (!(dev->flags&IFF_UP))
+- return 0;
+-
+- for_fib_info() {
+- int alive = 0;
+-
+- change_nexthops(fi) {
+- if (!(nh->nh_flags&RTNH_F_DEAD)) {
+- alive++;
+- continue;
+- }
+- if (nh->nh_dev == NULL || !(nh->nh_dev->flags&IFF_UP))
+- continue;
+- if (nh->nh_dev != dev || dev->dn_ptr == NULL)
+- continue;
+- alive++;
+- spin_lock_bh(&dn_fib_multipath_lock);
+- nh->nh_power = 0;
+- nh->nh_flags &= ~RTNH_F_DEAD;
+- spin_unlock_bh(&dn_fib_multipath_lock);
+- } endfor_nexthops(fi);
+-
+- if (alive > 0) {
+- fi->fib_flags &= ~RTNH_F_DEAD;
+- ret++;
+- }
+- } endfor_fib_info();
+- return ret;
+-}
+-
+-static struct notifier_block dn_fib_dnaddr_notifier = {
+- .notifier_call = dn_fib_dnaddr_event,
+-};
+-
+-void __exit dn_fib_cleanup(void)
+-{
+- dn_fib_table_cleanup();
+- dn_fib_rules_cleanup();
+-
+- unregister_dnaddr_notifier(&dn_fib_dnaddr_notifier);
+-}
+-
+-
+-void __init dn_fib_init(void)
+-{
+- dn_fib_table_init();
+- dn_fib_rules_init();
+-
+- register_dnaddr_notifier(&dn_fib_dnaddr_notifier);
+-
+- rtnl_register_module(THIS_MODULE, PF_DECnet, RTM_NEWROUTE,
+- dn_fib_rtm_newroute, NULL, 0);
+- rtnl_register_module(THIS_MODULE, PF_DECnet, RTM_DELROUTE,
+- dn_fib_rtm_delroute, NULL, 0);
+-}
+diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
+deleted file mode 100644
+index 94b306f6d5511..0000000000000
+--- a/net/decnet/dn_neigh.c
++++ /dev/null
+@@ -1,605 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet Neighbour Functions (Adjacency Database and
+- * On-Ethernet Cache)
+- *
+- * Author: Steve Whitehouse <SteveW@ACM.org>
+- *
+- *
+- * Changes:
+- * Steve Whitehouse : Fixed router listing routine
+- * Steve Whitehouse : Added error_report functions
+- * Steve Whitehouse : Added default router detection
+- * Steve Whitehouse : Hop counts in outgoing messages
+- * Steve Whitehouse : Fixed src/dst in outgoing messages so
+- * forwarding now stands a good chance of
+- * working.
+- * Steve Whitehouse : Fixed neighbour states (for now anyway).
+- * Steve Whitehouse : Made error_report functions dummies. This
+- * is not the right place to return skbs.
+- * Steve Whitehouse : Convert to seq_file
+- *
+- */
+-
+-#include <linux/net.h>
+-#include <linux/module.h>
+-#include <linux/socket.h>
+-#include <linux/if_arp.h>
+-#include <linux/slab.h>
+-#include <linux/if_ether.h>
+-#include <linux/init.h>
+-#include <linux/proc_fs.h>
+-#include <linux/string.h>
+-#include <linux/netfilter_decnet.h>
+-#include <linux/spinlock.h>
+-#include <linux/seq_file.h>
+-#include <linux/rcupdate.h>
+-#include <linux/jhash.h>
+-#include <linux/atomic.h>
+-#include <net/net_namespace.h>
+-#include <net/neighbour.h>
+-#include <net/dst.h>
+-#include <net/flow.h>
+-#include <net/dn.h>
+-#include <net/dn_dev.h>
+-#include <net/dn_neigh.h>
+-#include <net/dn_route.h>
+-
+-static int dn_neigh_construct(struct neighbour *);
+-static void dn_neigh_error_report(struct neighbour *, struct sk_buff *);
+-static int dn_neigh_output(struct neighbour *neigh, struct sk_buff *skb);
+-
+-/*
+- * Operations for adding the link layer header.
+- */
+-static const struct neigh_ops dn_neigh_ops = {
+- .family = AF_DECnet,
+- .error_report = dn_neigh_error_report,
+- .output = dn_neigh_output,
+- .connected_output = dn_neigh_output,
+-};
+-
+-static u32 dn_neigh_hash(const void *pkey,
+- const struct net_device *dev,
+- __u32 *hash_rnd)
+-{
+- return jhash_2words(*(__u16 *)pkey, 0, hash_rnd[0]);
+-}
+-
+-static bool dn_key_eq(const struct neighbour *neigh, const void *pkey)
+-{
+- return neigh_key_eq16(neigh, pkey);
+-}
+-
+-struct neigh_table dn_neigh_table = {
+- .family = PF_DECnet,
+- .entry_size = NEIGH_ENTRY_SIZE(sizeof(struct dn_neigh)),
+- .key_len = sizeof(__le16),
+- .protocol = cpu_to_be16(ETH_P_DNA_RT),
+- .hash = dn_neigh_hash,
+- .key_eq = dn_key_eq,
+- .constructor = dn_neigh_construct,
+- .id = "dn_neigh_cache",
+- .parms ={
+- .tbl = &dn_neigh_table,
+- .reachable_time = 30 * HZ,
+- .data = {
+- [NEIGH_VAR_MCAST_PROBES] = 0,
+- [NEIGH_VAR_UCAST_PROBES] = 0,
+- [NEIGH_VAR_APP_PROBES] = 0,
+- [NEIGH_VAR_RETRANS_TIME] = 1 * HZ,
+- [NEIGH_VAR_BASE_REACHABLE_TIME] = 30 * HZ,
+- [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
+- [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
+- [NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
+- [NEIGH_VAR_PROXY_QLEN] = 0,
+- [NEIGH_VAR_ANYCAST_DELAY] = 0,
+- [NEIGH_VAR_PROXY_DELAY] = 0,
+- [NEIGH_VAR_LOCKTIME] = 1 * HZ,
+- },
+- },
+- .gc_interval = 30 * HZ,
+- .gc_thresh1 = 128,
+- .gc_thresh2 = 512,
+- .gc_thresh3 = 1024,
+-};
+-
+-static int dn_neigh_construct(struct neighbour *neigh)
+-{
+- struct net_device *dev = neigh->dev;
+- struct dn_neigh *dn = container_of(neigh, struct dn_neigh, n);
+- struct dn_dev *dn_db;
+- struct neigh_parms *parms;
+-
+- rcu_read_lock();
+- dn_db = rcu_dereference(dev->dn_ptr);
+- if (dn_db == NULL) {
+- rcu_read_unlock();
+- return -EINVAL;
+- }
+-
+- parms = dn_db->neigh_parms;
+- if (!parms) {
+- rcu_read_unlock();
+- return -EINVAL;
+- }
+-
+- __neigh_parms_put(neigh->parms);
+- neigh->parms = neigh_parms_clone(parms);
+- rcu_read_unlock();
+-
+- neigh->ops = &dn_neigh_ops;
+- neigh->nud_state = NUD_NOARP;
+- neigh->output = neigh->ops->connected_output;
+-
+- if ((dev->type == ARPHRD_IPGRE) || (dev->flags & IFF_POINTOPOINT))
+- memcpy(neigh->ha, dev->broadcast, dev->addr_len);
+- else if ((dev->type == ARPHRD_ETHER) || (dev->type == ARPHRD_LOOPBACK))
+- dn_dn2eth(neigh->ha, dn->addr);
+- else {
+- net_dbg_ratelimited("Trying to create neigh for hw %d\n",
+- dev->type);
+- return -EINVAL;
+- }
+-
+- /*
+- * Make an estimate of the remote block size by assuming that its
+- * two less then the device mtu, which it true for ethernet (and
+- * other things which support long format headers) since there is
+- * an extra length field (of 16 bits) which isn't part of the
+- * ethernet headers and which the DECnet specs won't admit is part
+- * of the DECnet routing headers either.
+- *
+- * If we over estimate here its no big deal, the NSP negotiations
+- * will prevent us from sending packets which are too large for the
+- * remote node to handle. In any case this figure is normally updated
+- * by a hello message in most cases.
+- */
+- dn->blksize = dev->mtu - 2;
+-
+- return 0;
+-}
+-
+-static void dn_neigh_error_report(struct neighbour *neigh, struct sk_buff *skb)
+-{
+- printk(KERN_DEBUG "dn_neigh_error_report: called\n");
+- kfree_skb(skb);
+-}
+-
+-static int dn_neigh_output(struct neighbour *neigh, struct sk_buff *skb)
+-{
+- struct dst_entry *dst = skb_dst(skb);
+- struct dn_route *rt = (struct dn_route *)dst;
+- struct net_device *dev = neigh->dev;
+- char mac_addr[ETH_ALEN];
+- unsigned int seq;
+- int err;
+-
+- dn_dn2eth(mac_addr, rt->rt_local_src);
+- do {
+- seq = read_seqbegin(&neigh->ha_lock);
+- err = dev_hard_header(skb, dev, ntohs(skb->protocol),
+- neigh->ha, mac_addr, skb->len);
+- } while (read_seqretry(&neigh->ha_lock, seq));
+-
+- if (err >= 0)
+- err = dev_queue_xmit(skb);
+- else {
+- kfree_skb(skb);
+- err = -EINVAL;
+- }
+- return err;
+-}
+-
+-static int dn_neigh_output_packet(struct net *net, struct sock *sk, struct sk_buff *skb)
+-{
+- struct dst_entry *dst = skb_dst(skb);
+- struct dn_route *rt = (struct dn_route *)dst;
+- struct neighbour *neigh = rt->n;
+-
+- return neigh->output(neigh, skb);
+-}
+-
+-/*
+- * For talking to broadcast devices: Ethernet & PPP
+- */
+-static int dn_long_output(struct neighbour *neigh, struct sock *sk,
+- struct sk_buff *skb)
+-{
+- struct net_device *dev = neigh->dev;
+- int headroom = dev->hard_header_len + sizeof(struct dn_long_packet) + 3;
+- unsigned char *data;
+- struct dn_long_packet *lp;
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+-
+-
+- if (skb_headroom(skb) < headroom) {
+- struct sk_buff *skb2 = skb_realloc_headroom(skb, headroom);
+- if (skb2 == NULL) {
+- net_crit_ratelimited("dn_long_output: no memory\n");
+- kfree_skb(skb);
+- return -ENOBUFS;
+- }
+- consume_skb(skb);
+- skb = skb2;
+- net_info_ratelimited("dn_long_output: Increasing headroom\n");
+- }
+-
+- data = skb_push(skb, sizeof(struct dn_long_packet) + 3);
+- lp = (struct dn_long_packet *)(data+3);
+-
+- *((__le16 *)data) = cpu_to_le16(skb->len - 2);
+- *(data + 2) = 1 | DN_RT_F_PF; /* Padding */
+-
+- lp->msgflg = DN_RT_PKT_LONG|(cb->rt_flags&(DN_RT_F_IE|DN_RT_F_RQR|DN_RT_F_RTS));
+- lp->d_area = lp->d_subarea = 0;
+- dn_dn2eth(lp->d_id, cb->dst);
+- lp->s_area = lp->s_subarea = 0;
+- dn_dn2eth(lp->s_id, cb->src);
+- lp->nl2 = 0;
+- lp->visit_ct = cb->hops & 0x3f;
+- lp->s_class = 0;
+- lp->pt = 0;
+-
+- skb_reset_network_header(skb);
+-
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_POST_ROUTING,
+- &init_net, sk, skb, NULL, neigh->dev,
+- dn_neigh_output_packet);
+-}
+-
+-/*
+- * For talking to pointopoint and multidrop devices: DDCMP and X.25
+- */
+-static int dn_short_output(struct neighbour *neigh, struct sock *sk,
+- struct sk_buff *skb)
+-{
+- struct net_device *dev = neigh->dev;
+- int headroom = dev->hard_header_len + sizeof(struct dn_short_packet) + 2;
+- struct dn_short_packet *sp;
+- unsigned char *data;
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+-
+-
+- if (skb_headroom(skb) < headroom) {
+- struct sk_buff *skb2 = skb_realloc_headroom(skb, headroom);
+- if (skb2 == NULL) {
+- net_crit_ratelimited("dn_short_output: no memory\n");
+- kfree_skb(skb);
+- return -ENOBUFS;
+- }
+- consume_skb(skb);
+- skb = skb2;
+- net_info_ratelimited("dn_short_output: Increasing headroom\n");
+- }
+-
+- data = skb_push(skb, sizeof(struct dn_short_packet) + 2);
+- *((__le16 *)data) = cpu_to_le16(skb->len - 2);
+- sp = (struct dn_short_packet *)(data+2);
+-
+- sp->msgflg = DN_RT_PKT_SHORT|(cb->rt_flags&(DN_RT_F_RQR|DN_RT_F_RTS));
+- sp->dstnode = cb->dst;
+- sp->srcnode = cb->src;
+- sp->forward = cb->hops & 0x3f;
+-
+- skb_reset_network_header(skb);
+-
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_POST_ROUTING,
+- &init_net, sk, skb, NULL, neigh->dev,
+- dn_neigh_output_packet);
+-}
+-
+-/*
+- * For talking to DECnet phase III nodes
+- * Phase 3 output is the same as short output, execpt that
+- * it clears the area bits before transmission.
+- */
+-static int dn_phase3_output(struct neighbour *neigh, struct sock *sk,
+- struct sk_buff *skb)
+-{
+- struct net_device *dev = neigh->dev;
+- int headroom = dev->hard_header_len + sizeof(struct dn_short_packet) + 2;
+- struct dn_short_packet *sp;
+- unsigned char *data;
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+-
+- if (skb_headroom(skb) < headroom) {
+- struct sk_buff *skb2 = skb_realloc_headroom(skb, headroom);
+- if (skb2 == NULL) {
+- net_crit_ratelimited("dn_phase3_output: no memory\n");
+- kfree_skb(skb);
+- return -ENOBUFS;
+- }
+- consume_skb(skb);
+- skb = skb2;
+- net_info_ratelimited("dn_phase3_output: Increasing headroom\n");
+- }
+-
+- data = skb_push(skb, sizeof(struct dn_short_packet) + 2);
+- *((__le16 *)data) = cpu_to_le16(skb->len - 2);
+- sp = (struct dn_short_packet *)(data + 2);
+-
+- sp->msgflg = DN_RT_PKT_SHORT|(cb->rt_flags&(DN_RT_F_RQR|DN_RT_F_RTS));
+- sp->dstnode = cb->dst & cpu_to_le16(0x03ff);
+- sp->srcnode = cb->src & cpu_to_le16(0x03ff);
+- sp->forward = cb->hops & 0x3f;
+-
+- skb_reset_network_header(skb);
+-
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_POST_ROUTING,
+- &init_net, sk, skb, NULL, neigh->dev,
+- dn_neigh_output_packet);
+-}
+-
+-int dn_to_neigh_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+-{
+- struct dst_entry *dst = skb_dst(skb);
+- struct dn_route *rt = (struct dn_route *) dst;
+- struct neighbour *neigh = rt->n;
+- struct dn_neigh *dn = container_of(neigh, struct dn_neigh, n);
+- struct dn_dev *dn_db;
+- bool use_long;
+-
+- rcu_read_lock();
+- dn_db = rcu_dereference(neigh->dev->dn_ptr);
+- if (dn_db == NULL) {
+- rcu_read_unlock();
+- return -EINVAL;
+- }
+- use_long = dn_db->use_long;
+- rcu_read_unlock();
+-
+- if (dn->flags & DN_NDFLAG_P3)
+- return dn_phase3_output(neigh, sk, skb);
+- if (use_long)
+- return dn_long_output(neigh, sk, skb);
+- else
+- return dn_short_output(neigh, sk, skb);
+-}
+-
+-/*
+- * Unfortunately, the neighbour code uses the device in its hash
+- * function, so we don't get any advantage from it. This function
+- * basically does a neigh_lookup(), but without comparing the device
+- * field. This is required for the On-Ethernet cache
+- */
+-
+-/*
+- * Pointopoint link receives a hello message
+- */
+-void dn_neigh_pointopoint_hello(struct sk_buff *skb)
+-{
+- kfree_skb(skb);
+-}
+-
+-/*
+- * Ethernet router hello message received
+- */
+-int dn_neigh_router_hello(struct net *net, struct sock *sk, struct sk_buff *skb)
+-{
+- struct rtnode_hello_message *msg = (struct rtnode_hello_message *)skb->data;
+-
+- struct neighbour *neigh;
+- struct dn_neigh *dn;
+- struct dn_dev *dn_db;
+- __le16 src;
+-
+- src = dn_eth2dn(msg->id);
+-
+- neigh = __neigh_lookup(&dn_neigh_table, &src, skb->dev, 1);
+-
+- dn = container_of(neigh, struct dn_neigh, n);
+-
+- if (neigh) {
+- write_lock(&neigh->lock);
+-
+- neigh->used = jiffies;
+- dn_db = rcu_dereference(neigh->dev->dn_ptr);
+-
+- if (!(neigh->nud_state & NUD_PERMANENT)) {
+- neigh->updated = jiffies;
+-
+- if (neigh->dev->type == ARPHRD_ETHER)
+- memcpy(neigh->ha, ð_hdr(skb)->h_source, ETH_ALEN);
+-
+- dn->blksize = le16_to_cpu(msg->blksize);
+- dn->priority = msg->priority;
+-
+- dn->flags &= ~DN_NDFLAG_P3;
+-
+- switch (msg->iinfo & DN_RT_INFO_TYPE) {
+- case DN_RT_INFO_L1RT:
+- dn->flags &=~DN_NDFLAG_R2;
+- dn->flags |= DN_NDFLAG_R1;
+- break;
+- case DN_RT_INFO_L2RT:
+- dn->flags |= DN_NDFLAG_R2;
+- }
+- }
+-
+- /* Only use routers in our area */
+- if ((le16_to_cpu(src)>>10) == (le16_to_cpu((decnet_address))>>10)) {
+- if (!dn_db->router) {
+- dn_db->router = neigh_clone(neigh);
+- } else {
+- if (msg->priority > ((struct dn_neigh *)dn_db->router)->priority)
+- neigh_release(xchg(&dn_db->router, neigh_clone(neigh)));
+- }
+- }
+- write_unlock(&neigh->lock);
+- neigh_release(neigh);
+- }
+-
+- kfree_skb(skb);
+- return 0;
+-}
+-
+-/*
+- * Endnode hello message received
+- */
+-int dn_neigh_endnode_hello(struct net *net, struct sock *sk, struct sk_buff *skb)
+-{
+- struct endnode_hello_message *msg = (struct endnode_hello_message *)skb->data;
+- struct neighbour *neigh;
+- struct dn_neigh *dn;
+- __le16 src;
+-
+- src = dn_eth2dn(msg->id);
+-
+- neigh = __neigh_lookup(&dn_neigh_table, &src, skb->dev, 1);
+-
+- dn = container_of(neigh, struct dn_neigh, n);
+-
+- if (neigh) {
+- write_lock(&neigh->lock);
+-
+- neigh->used = jiffies;
+-
+- if (!(neigh->nud_state & NUD_PERMANENT)) {
+- neigh->updated = jiffies;
+-
+- if (neigh->dev->type == ARPHRD_ETHER)
+- memcpy(neigh->ha, ð_hdr(skb)->h_source, ETH_ALEN);
+- dn->flags &= ~(DN_NDFLAG_R1 | DN_NDFLAG_R2);
+- dn->blksize = le16_to_cpu(msg->blksize);
+- dn->priority = 0;
+- }
+-
+- write_unlock(&neigh->lock);
+- neigh_release(neigh);
+- }
+-
+- kfree_skb(skb);
+- return 0;
+-}
+-
+-static char *dn_find_slot(char *base, int max, int priority)
+-{
+- int i;
+- unsigned char *min = NULL;
+-
+- base += 6; /* skip first id */
+-
+- for(i = 0; i < max; i++) {
+- if (!min || (*base < *min))
+- min = base;
+- base += 7; /* find next priority */
+- }
+-
+- if (!min)
+- return NULL;
+-
+- return (*min < priority) ? (min - 6) : NULL;
+-}
+-
+-struct elist_cb_state {
+- struct net_device *dev;
+- unsigned char *ptr;
+- unsigned char *rs;
+- int t, n;
+-};
+-
+-static void neigh_elist_cb(struct neighbour *neigh, void *_info)
+-{
+- struct elist_cb_state *s = _info;
+- struct dn_neigh *dn;
+-
+- if (neigh->dev != s->dev)
+- return;
+-
+- dn = container_of(neigh, struct dn_neigh, n);
+- if (!(dn->flags & (DN_NDFLAG_R1|DN_NDFLAG_R2)))
+- return;
+-
+- if (s->t == s->n)
+- s->rs = dn_find_slot(s->ptr, s->n, dn->priority);
+- else
+- s->t++;
+- if (s->rs == NULL)
+- return;
+-
+- dn_dn2eth(s->rs, dn->addr);
+- s->rs += 6;
+- *(s->rs) = neigh->nud_state & NUD_CONNECTED ? 0x80 : 0x0;
+- *(s->rs) |= dn->priority;
+- s->rs++;
+-}
+-
+-int dn_neigh_elist(struct net_device *dev, unsigned char *ptr, int n)
+-{
+- struct elist_cb_state state;
+-
+- state.dev = dev;
+- state.t = 0;
+- state.n = n;
+- state.ptr = ptr;
+- state.rs = ptr;
+-
+- neigh_for_each(&dn_neigh_table, neigh_elist_cb, &state);
+-
+- return state.t;
+-}
+-
+-
+-#ifdef CONFIG_PROC_FS
+-
+-static inline void dn_neigh_format_entry(struct seq_file *seq,
+- struct neighbour *n)
+-{
+- struct dn_neigh *dn = container_of(n, struct dn_neigh, n);
+- char buf[DN_ASCBUF_LEN];
+-
+- read_lock(&n->lock);
+- seq_printf(seq, "%-7s %s%s%s %02x %02d %07ld %-8s\n",
+- dn_addr2asc(le16_to_cpu(dn->addr), buf),
+- (dn->flags&DN_NDFLAG_R1) ? "1" : "-",
+- (dn->flags&DN_NDFLAG_R2) ? "2" : "-",
+- (dn->flags&DN_NDFLAG_P3) ? "3" : "-",
+- dn->n.nud_state,
+- refcount_read(&dn->n.refcnt),
+- dn->blksize,
+- (dn->n.dev) ? dn->n.dev->name : "?");
+- read_unlock(&n->lock);
+-}
+-
+-static int dn_neigh_seq_show(struct seq_file *seq, void *v)
+-{
+- if (v == SEQ_START_TOKEN) {
+- seq_puts(seq, "Addr Flags State Use Blksize Dev\n");
+- } else {
+- dn_neigh_format_entry(seq, v);
+- }
+-
+- return 0;
+-}
+-
+-static void *dn_neigh_seq_start(struct seq_file *seq, loff_t *pos)
+-{
+- return neigh_seq_start(seq, pos, &dn_neigh_table,
+- NEIGH_SEQ_NEIGH_ONLY);
+-}
+-
+-static const struct seq_operations dn_neigh_seq_ops = {
+- .start = dn_neigh_seq_start,
+- .next = neigh_seq_next,
+- .stop = neigh_seq_stop,
+- .show = dn_neigh_seq_show,
+-};
+-#endif
+-
+-void __init dn_neigh_init(void)
+-{
+- neigh_table_init(NEIGH_DN_TABLE, &dn_neigh_table);
+- proc_create_net("decnet_neigh", 0444, init_net.proc_net,
+- &dn_neigh_seq_ops, sizeof(struct neigh_seq_state));
+-}
+-
+-void __exit dn_neigh_cleanup(void)
+-{
+- remove_proc_entry("decnet_neigh", init_net.proc_net);
+- neigh_table_clear(NEIGH_DN_TABLE, &dn_neigh_table);
+-}
+diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
+deleted file mode 100644
+index 2fb5e055ba25e..0000000000000
+--- a/net/decnet/dn_nsp_in.c
++++ /dev/null
+@@ -1,914 +0,0 @@
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet Network Services Protocol (Input)
+- *
+- * Author: Eduardo Marcelo Serrat <emserrat@geocities.com>
+- *
+- * Changes:
+- *
+- * Steve Whitehouse: Split into dn_nsp_in.c and dn_nsp_out.c from
+- * original dn_nsp.c.
+- * Steve Whitehouse: Updated to work with my new routing architecture.
+- * Steve Whitehouse: Add changes from Eduardo Serrat's patches.
+- * Steve Whitehouse: Put all ack handling code in a common routine.
+- * Steve Whitehouse: Put other common bits into dn_nsp_rx()
+- * Steve Whitehouse: More checks on skb->len to catch bogus packets
+- * Fixed various race conditions and possible nasties.
+- * Steve Whitehouse: Now handles returned conninit frames.
+- * David S. Miller: New socket locking
+- * Steve Whitehouse: Fixed lockup when socket filtering was enabled.
+- * Paul Koning: Fix to push CC sockets into RUN when acks are
+- * received.
+- * Steve Whitehouse:
+- * Patrick Caulfield: Checking conninits for correctness & sending of error
+- * responses.
+- * Steve Whitehouse: Added backlog congestion level return codes.
+- * Patrick Caulfield:
+- * Steve Whitehouse: Added flow control support (outbound)
+- * Steve Whitehouse: Prepare for nonlinear skbs
+- */
+-
+-/******************************************************************************
+- (c) 1995-1998 E.M. Serrat emserrat@geocities.com
+-
+- This program is free software; you can redistribute it and/or modify
+- it under the terms of the GNU General Public License as published by
+- the Free Software Foundation; either version 2 of the License, or
+- any later version.
+-
+- This program is distributed in the hope that it will be useful,
+- but WITHOUT ANY WARRANTY; without even the implied warranty of
+- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- GNU General Public License for more details.
+-*******************************************************************************/
+-
+-#include <linux/errno.h>
+-#include <linux/types.h>
+-#include <linux/socket.h>
+-#include <linux/in.h>
+-#include <linux/kernel.h>
+-#include <linux/timer.h>
+-#include <linux/string.h>
+-#include <linux/sockios.h>
+-#include <linux/net.h>
+-#include <linux/netdevice.h>
+-#include <linux/inet.h>
+-#include <linux/route.h>
+-#include <linux/slab.h>
+-#include <net/sock.h>
+-#include <net/tcp_states.h>
+-#include <linux/fcntl.h>
+-#include <linux/mm.h>
+-#include <linux/termios.h>
+-#include <linux/interrupt.h>
+-#include <linux/proc_fs.h>
+-#include <linux/stat.h>
+-#include <linux/init.h>
+-#include <linux/poll.h>
+-#include <linux/netfilter_decnet.h>
+-#include <net/neighbour.h>
+-#include <net/dst.h>
+-#include <net/dn.h>
+-#include <net/dn_nsp.h>
+-#include <net/dn_dev.h>
+-#include <net/dn_route.h>
+-
+-extern int decnet_log_martians;
+-
+-static void dn_log_martian(struct sk_buff *skb, const char *msg)
+-{
+- if (decnet_log_martians) {
+- char *devname = skb->dev ? skb->dev->name : "???";
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- net_info_ratelimited("DECnet: Martian packet (%s) dev=%s src=0x%04hx dst=0x%04hx srcport=0x%04hx dstport=0x%04hx\n",
+- msg, devname,
+- le16_to_cpu(cb->src),
+- le16_to_cpu(cb->dst),
+- le16_to_cpu(cb->src_port),
+- le16_to_cpu(cb->dst_port));
+- }
+-}
+-
+-/*
+- * For this function we've flipped the cross-subchannel bit
+- * if the message is an otherdata or linkservice message. Thus
+- * we can use it to work out what to update.
+- */
+-static void dn_ack(struct sock *sk, struct sk_buff *skb, unsigned short ack)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- unsigned short type = ((ack >> 12) & 0x0003);
+- int wakeup = 0;
+-
+- switch (type) {
+- case 0: /* ACK - Data */
+- if (dn_after(ack, scp->ackrcv_dat)) {
+- scp->ackrcv_dat = ack & 0x0fff;
+- wakeup |= dn_nsp_check_xmit_queue(sk, skb,
+- &scp->data_xmit_queue,
+- ack);
+- }
+- break;
+- case 1: /* NAK - Data */
+- break;
+- case 2: /* ACK - OtherData */
+- if (dn_after(ack, scp->ackrcv_oth)) {
+- scp->ackrcv_oth = ack & 0x0fff;
+- wakeup |= dn_nsp_check_xmit_queue(sk, skb,
+- &scp->other_xmit_queue,
+- ack);
+- }
+- break;
+- case 3: /* NAK - OtherData */
+- break;
+- }
+-
+- if (wakeup && !sock_flag(sk, SOCK_DEAD))
+- sk->sk_state_change(sk);
+-}
+-
+-/*
+- * This function is a universal ack processor.
+- */
+-static int dn_process_ack(struct sock *sk, struct sk_buff *skb, int oth)
+-{
+- __le16 *ptr = (__le16 *)skb->data;
+- int len = 0;
+- unsigned short ack;
+-
+- if (skb->len < 2)
+- return len;
+-
+- if ((ack = le16_to_cpu(*ptr)) & 0x8000) {
+- skb_pull(skb, 2);
+- ptr++;
+- len += 2;
+- if ((ack & 0x4000) == 0) {
+- if (oth)
+- ack ^= 0x2000;
+- dn_ack(sk, skb, ack);
+- }
+- }
+-
+- if (skb->len < 2)
+- return len;
+-
+- if ((ack = le16_to_cpu(*ptr)) & 0x8000) {
+- skb_pull(skb, 2);
+- len += 2;
+- if ((ack & 0x4000) == 0) {
+- if (oth)
+- ack ^= 0x2000;
+- dn_ack(sk, skb, ack);
+- }
+- }
+-
+- return len;
+-}
+-
+-
+-/**
+- * dn_check_idf - Check an image data field format is correct.
+- * @pptr: Pointer to pointer to image data
+- * @len: Pointer to length of image data
+- * @max: The maximum allowed length of the data in the image data field
+- * @follow_on: Check that this many bytes exist beyond the end of the image data
+- *
+- * Returns: 0 if ok, -1 on error
+- */
+-static inline int dn_check_idf(unsigned char **pptr, int *len, unsigned char max, unsigned char follow_on)
+-{
+- unsigned char *ptr = *pptr;
+- unsigned char flen = *ptr++;
+-
+- (*len)--;
+- if (flen > max)
+- return -1;
+- if ((flen + follow_on) > *len)
+- return -1;
+-
+- *len -= flen;
+- *pptr = ptr + flen;
+- return 0;
+-}
+-
+-/*
+- * Table of reason codes to pass back to node which sent us a badly
+- * formed message, plus text messages for the log. A zero entry in
+- * the reason field means "don't reply" otherwise a disc init is sent with
+- * the specified reason code.
+- */
+-static struct {
+- unsigned short reason;
+- const char *text;
+-} ci_err_table[] = {
+- { 0, "CI: Truncated message" },
+- { NSP_REASON_ID, "CI: Destination username error" },
+- { NSP_REASON_ID, "CI: Destination username type" },
+- { NSP_REASON_US, "CI: Source username error" },
+- { 0, "CI: Truncated at menuver" },
+- { 0, "CI: Truncated before access or user data" },
+- { NSP_REASON_IO, "CI: Access data format error" },
+- { NSP_REASON_IO, "CI: User data format error" }
+-};
+-
+-/*
+- * This function uses a slightly different lookup method
+- * to find its sockets, since it searches on object name/number
+- * rather than port numbers. Various tests are done to ensure that
+- * the incoming data is in the correct format before it is queued to
+- * a socket.
+- */
+-static struct sock *dn_find_listener(struct sk_buff *skb, unsigned short *reason)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- struct nsp_conn_init_msg *msg = (struct nsp_conn_init_msg *)skb->data;
+- struct sockaddr_dn dstaddr;
+- struct sockaddr_dn srcaddr;
+- unsigned char type = 0;
+- int dstlen;
+- int srclen;
+- unsigned char *ptr;
+- int len;
+- int err = 0;
+- unsigned char menuver;
+-
+- memset(&dstaddr, 0, sizeof(struct sockaddr_dn));
+- memset(&srcaddr, 0, sizeof(struct sockaddr_dn));
+-
+- /*
+- * 1. Decode & remove message header
+- */
+- cb->src_port = msg->srcaddr;
+- cb->dst_port = msg->dstaddr;
+- cb->services = msg->services;
+- cb->info = msg->info;
+- cb->segsize = le16_to_cpu(msg->segsize);
+-
+- if (!pskb_may_pull(skb, sizeof(*msg)))
+- goto err_out;
+-
+- skb_pull(skb, sizeof(*msg));
+-
+- len = skb->len;
+- ptr = skb->data;
+-
+- /*
+- * 2. Check destination end username format
+- */
+- dstlen = dn_username2sockaddr(ptr, len, &dstaddr, &type);
+- err++;
+- if (dstlen < 0)
+- goto err_out;
+-
+- err++;
+- if (type > 1)
+- goto err_out;
+-
+- len -= dstlen;
+- ptr += dstlen;
+-
+- /*
+- * 3. Check source end username format
+- */
+- srclen = dn_username2sockaddr(ptr, len, &srcaddr, &type);
+- err++;
+- if (srclen < 0)
+- goto err_out;
+-
+- len -= srclen;
+- ptr += srclen;
+- err++;
+- if (len < 1)
+- goto err_out;
+-
+- menuver = *ptr;
+- ptr++;
+- len--;
+-
+- /*
+- * 4. Check that optional data actually exists if menuver says it does
+- */
+- err++;
+- if ((menuver & (DN_MENUVER_ACC | DN_MENUVER_USR)) && (len < 1))
+- goto err_out;
+-
+- /*
+- * 5. Check optional access data format
+- */
+- err++;
+- if (menuver & DN_MENUVER_ACC) {
+- if (dn_check_idf(&ptr, &len, 39, 1))
+- goto err_out;
+- if (dn_check_idf(&ptr, &len, 39, 1))
+- goto err_out;
+- if (dn_check_idf(&ptr, &len, 39, (menuver & DN_MENUVER_USR) ? 1 : 0))
+- goto err_out;
+- }
+-
+- /*
+- * 6. Check optional user data format
+- */
+- err++;
+- if (menuver & DN_MENUVER_USR) {
+- if (dn_check_idf(&ptr, &len, 16, 0))
+- goto err_out;
+- }
+-
+- /*
+- * 7. Look up socket based on destination end username
+- */
+- return dn_sklist_find_listener(&dstaddr);
+-err_out:
+- dn_log_martian(skb, ci_err_table[err].text);
+- *reason = ci_err_table[err].reason;
+- return NULL;
+-}
+-
+-
+-static void dn_nsp_conn_init(struct sock *sk, struct sk_buff *skb)
+-{
+- if (sk_acceptq_is_full(sk)) {
+- kfree_skb(skb);
+- return;
+- }
+-
+- sk->sk_ack_backlog++;
+- skb_queue_tail(&sk->sk_receive_queue, skb);
+- sk->sk_state_change(sk);
+-}
+-
+-static void dn_nsp_conn_conf(struct sock *sk, struct sk_buff *skb)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- struct dn_scp *scp = DN_SK(sk);
+- unsigned char *ptr;
+-
+- if (skb->len < 4)
+- goto out;
+-
+- ptr = skb->data;
+- cb->services = *ptr++;
+- cb->info = *ptr++;
+- cb->segsize = le16_to_cpu(*(__le16 *)ptr);
+-
+- if ((scp->state == DN_CI) || (scp->state == DN_CD)) {
+- scp->persist = 0;
+- scp->addrrem = cb->src_port;
+- sk->sk_state = TCP_ESTABLISHED;
+- scp->state = DN_RUN;
+- scp->services_rem = cb->services;
+- scp->info_rem = cb->info;
+- scp->segsize_rem = cb->segsize;
+-
+- if ((scp->services_rem & NSP_FC_MASK) == NSP_FC_NONE)
+- scp->max_window = decnet_no_fc_max_cwnd;
+-
+- if (skb->len > 0) {
+- u16 dlen = *skb->data;
+- if ((dlen <= 16) && (dlen <= skb->len)) {
+- scp->conndata_in.opt_optl = cpu_to_le16(dlen);
+- skb_copy_from_linear_data_offset(skb, 1,
+- scp->conndata_in.opt_data, dlen);
+- }
+- }
+- dn_nsp_send_link(sk, DN_NOCHANGE, 0);
+- if (!sock_flag(sk, SOCK_DEAD))
+- sk->sk_state_change(sk);
+- }
+-
+-out:
+- kfree_skb(skb);
+-}
+-
+-static void dn_nsp_conn_ack(struct sock *sk, struct sk_buff *skb)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- if (scp->state == DN_CI) {
+- scp->state = DN_CD;
+- scp->persist = 0;
+- }
+-
+- kfree_skb(skb);
+-}
+-
+-static void dn_nsp_disc_init(struct sock *sk, struct sk_buff *skb)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- unsigned short reason;
+-
+- if (skb->len < 2)
+- goto out;
+-
+- reason = le16_to_cpu(*(__le16 *)skb->data);
+- skb_pull(skb, 2);
+-
+- scp->discdata_in.opt_status = cpu_to_le16(reason);
+- scp->discdata_in.opt_optl = 0;
+- memset(scp->discdata_in.opt_data, 0, 16);
+-
+- if (skb->len > 0) {
+- u16 dlen = *skb->data;
+- if ((dlen <= 16) && (dlen <= skb->len)) {
+- scp->discdata_in.opt_optl = cpu_to_le16(dlen);
+- skb_copy_from_linear_data_offset(skb, 1, scp->discdata_in.opt_data, dlen);
+- }
+- }
+-
+- scp->addrrem = cb->src_port;
+- sk->sk_state = TCP_CLOSE;
+-
+- switch (scp->state) {
+- case DN_CI:
+- case DN_CD:
+- scp->state = DN_RJ;
+- sk->sk_err = ECONNREFUSED;
+- break;
+- case DN_RUN:
+- sk->sk_shutdown |= SHUTDOWN_MASK;
+- scp->state = DN_DN;
+- break;
+- case DN_DI:
+- scp->state = DN_DIC;
+- break;
+- }
+-
+- if (!sock_flag(sk, SOCK_DEAD)) {
+- if (sk->sk_socket->state != SS_UNCONNECTED)
+- sk->sk_socket->state = SS_DISCONNECTING;
+- sk->sk_state_change(sk);
+- }
+-
+- /*
+- * It appears that its possible for remote machines to send disc
+- * init messages with no port identifier if we are in the CI and
+- * possibly also the CD state. Obviously we shouldn't reply with
+- * a message if we don't know what the end point is.
+- */
+- if (scp->addrrem) {
+- dn_nsp_send_disc(sk, NSP_DISCCONF, NSP_REASON_DC, GFP_ATOMIC);
+- }
+- scp->persist_fxn = dn_destroy_timer;
+- scp->persist = dn_nsp_persist(sk);
+-
+-out:
+- kfree_skb(skb);
+-}
+-
+-/*
+- * disc_conf messages are also called no_resources or no_link
+- * messages depending upon the "reason" field.
+- */
+-static void dn_nsp_disc_conf(struct sock *sk, struct sk_buff *skb)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- unsigned short reason;
+-
+- if (skb->len != 2)
+- goto out;
+-
+- reason = le16_to_cpu(*(__le16 *)skb->data);
+-
+- sk->sk_state = TCP_CLOSE;
+-
+- switch (scp->state) {
+- case DN_CI:
+- scp->state = DN_NR;
+- break;
+- case DN_DR:
+- if (reason == NSP_REASON_DC)
+- scp->state = DN_DRC;
+- if (reason == NSP_REASON_NL)
+- scp->state = DN_CN;
+- break;
+- case DN_DI:
+- scp->state = DN_DIC;
+- break;
+- case DN_RUN:
+- sk->sk_shutdown |= SHUTDOWN_MASK;
+- /* fall through */
+- case DN_CC:
+- scp->state = DN_CN;
+- }
+-
+- if (!sock_flag(sk, SOCK_DEAD)) {
+- if (sk->sk_socket->state != SS_UNCONNECTED)
+- sk->sk_socket->state = SS_DISCONNECTING;
+- sk->sk_state_change(sk);
+- }
+-
+- scp->persist_fxn = dn_destroy_timer;
+- scp->persist = dn_nsp_persist(sk);
+-
+-out:
+- kfree_skb(skb);
+-}
+-
+-static void dn_nsp_linkservice(struct sock *sk, struct sk_buff *skb)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- unsigned short segnum;
+- unsigned char lsflags;
+- signed char fcval;
+- int wake_up = 0;
+- char *ptr = skb->data;
+- unsigned char fctype = scp->services_rem & NSP_FC_MASK;
+-
+- if (skb->len != 4)
+- goto out;
+-
+- segnum = le16_to_cpu(*(__le16 *)ptr);
+- ptr += 2;
+- lsflags = *(unsigned char *)ptr++;
+- fcval = *ptr;
+-
+- /*
+- * Here we ignore erronous packets which should really
+- * should cause a connection abort. It is not critical
+- * for now though.
+- */
+- if (lsflags & 0xf8)
+- goto out;
+-
+- if (seq_next(scp->numoth_rcv, segnum)) {
+- seq_add(&scp->numoth_rcv, 1);
+- switch(lsflags & 0x04) { /* FCVAL INT */
+- case 0x00: /* Normal Request */
+- switch(lsflags & 0x03) { /* FCVAL MOD */
+- case 0x00: /* Request count */
+- if (fcval < 0) {
+- unsigned char p_fcval = -fcval;
+- if ((scp->flowrem_dat > p_fcval) &&
+- (fctype == NSP_FC_SCMC)) {
+- scp->flowrem_dat -= p_fcval;
+- }
+- } else if (fcval > 0) {
+- scp->flowrem_dat += fcval;
+- wake_up = 1;
+- }
+- break;
+- case 0x01: /* Stop outgoing data */
+- scp->flowrem_sw = DN_DONTSEND;
+- break;
+- case 0x02: /* Ok to start again */
+- scp->flowrem_sw = DN_SEND;
+- dn_nsp_output(sk);
+- wake_up = 1;
+- }
+- break;
+- case 0x04: /* Interrupt Request */
+- if (fcval > 0) {
+- scp->flowrem_oth += fcval;
+- wake_up = 1;
+- }
+- break;
+- }
+- if (wake_up && !sock_flag(sk, SOCK_DEAD))
+- sk->sk_state_change(sk);
+- }
+-
+- dn_nsp_send_oth_ack(sk);
+-
+-out:
+- kfree_skb(skb);
+-}
+-
+-/*
+- * Copy of sock_queue_rcv_skb (from sock.h) without
+- * bh_lock_sock() (its already held when this is called) which
+- * also allows data and other data to be queued to a socket.
+- */
+-static __inline__ int dn_queue_skb(struct sock *sk, struct sk_buff *skb, int sig, struct sk_buff_head *queue)
+-{
+- int err;
+-
+- /* Cast skb->rcvbuf to unsigned... It's pointless, but reduces
+- number of warnings when compiling with -W --ANK
+- */
+- if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+- (unsigned int)sk->sk_rcvbuf) {
+- err = -ENOMEM;
+- goto out;
+- }
+-
+- err = sk_filter(sk, skb);
+- if (err)
+- goto out;
+-
+- skb_set_owner_r(skb, sk);
+- skb_queue_tail(queue, skb);
+-
+- if (!sock_flag(sk, SOCK_DEAD))
+- sk->sk_data_ready(sk);
+-out:
+- return err;
+-}
+-
+-static void dn_nsp_otherdata(struct sock *sk, struct sk_buff *skb)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- unsigned short segnum;
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- int queued = 0;
+-
+- if (skb->len < 2)
+- goto out;
+-
+- cb->segnum = segnum = le16_to_cpu(*(__le16 *)skb->data);
+- skb_pull(skb, 2);
+-
+- if (seq_next(scp->numoth_rcv, segnum)) {
+-
+- if (dn_queue_skb(sk, skb, SIGURG, &scp->other_receive_queue) == 0) {
+- seq_add(&scp->numoth_rcv, 1);
+- scp->other_report = 0;
+- queued = 1;
+- }
+- }
+-
+- dn_nsp_send_oth_ack(sk);
+-out:
+- if (!queued)
+- kfree_skb(skb);
+-}
+-
+-static void dn_nsp_data(struct sock *sk, struct sk_buff *skb)
+-{
+- int queued = 0;
+- unsigned short segnum;
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- struct dn_scp *scp = DN_SK(sk);
+-
+- if (skb->len < 2)
+- goto out;
+-
+- cb->segnum = segnum = le16_to_cpu(*(__le16 *)skb->data);
+- skb_pull(skb, 2);
+-
+- if (seq_next(scp->numdat_rcv, segnum)) {
+- if (dn_queue_skb(sk, skb, SIGIO, &sk->sk_receive_queue) == 0) {
+- seq_add(&scp->numdat_rcv, 1);
+- queued = 1;
+- }
+-
+- if ((scp->flowloc_sw == DN_SEND) && dn_congested(sk)) {
+- scp->flowloc_sw = DN_DONTSEND;
+- dn_nsp_send_link(sk, DN_DONTSEND, 0);
+- }
+- }
+-
+- dn_nsp_send_data_ack(sk);
+-out:
+- if (!queued)
+- kfree_skb(skb);
+-}
+-
+-/*
+- * If one of our conninit messages is returned, this function
+- * deals with it. It puts the socket into the NO_COMMUNICATION
+- * state.
+- */
+-static void dn_returned_conn_init(struct sock *sk, struct sk_buff *skb)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- if (scp->state == DN_CI) {
+- scp->state = DN_NC;
+- sk->sk_state = TCP_CLOSE;
+- if (!sock_flag(sk, SOCK_DEAD))
+- sk->sk_state_change(sk);
+- }
+-
+- kfree_skb(skb);
+-}
+-
+-static int dn_nsp_no_socket(struct sk_buff *skb, unsigned short reason)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- int ret = NET_RX_DROP;
+-
+- /* Must not reply to returned packets */
+- if (cb->rt_flags & DN_RT_F_RTS)
+- goto out;
+-
+- if ((reason != NSP_REASON_OK) && ((cb->nsp_flags & 0x0c) == 0x08)) {
+- switch (cb->nsp_flags & 0x70) {
+- case 0x10:
+- case 0x60: /* (Retransmitted) Connect Init */
+- dn_nsp_return_disc(skb, NSP_DISCINIT, reason);
+- ret = NET_RX_SUCCESS;
+- break;
+- case 0x20: /* Connect Confirm */
+- dn_nsp_return_disc(skb, NSP_DISCCONF, reason);
+- ret = NET_RX_SUCCESS;
+- break;
+- }
+- }
+-
+-out:
+- kfree_skb(skb);
+- return ret;
+-}
+-
+-static int dn_nsp_rx_packet(struct net *net, struct sock *sk2,
+- struct sk_buff *skb)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- struct sock *sk = NULL;
+- unsigned char *ptr = (unsigned char *)skb->data;
+- unsigned short reason = NSP_REASON_NL;
+-
+- if (!pskb_may_pull(skb, 2))
+- goto free_out;
+-
+- skb_reset_transport_header(skb);
+- cb->nsp_flags = *ptr++;
+-
+- if (decnet_debug_level & 2)
+- printk(KERN_DEBUG "dn_nsp_rx: Message type 0x%02x\n", (int)cb->nsp_flags);
+-
+- if (cb->nsp_flags & 0x83)
+- goto free_out;
+-
+- /*
+- * Filter out conninits and useless packet types
+- */
+- if ((cb->nsp_flags & 0x0c) == 0x08) {
+- switch (cb->nsp_flags & 0x70) {
+- case 0x00: /* NOP */
+- case 0x70: /* Reserved */
+- case 0x50: /* Reserved, Phase II node init */
+- goto free_out;
+- case 0x10:
+- case 0x60:
+- if (unlikely(cb->rt_flags & DN_RT_F_RTS))
+- goto free_out;
+- sk = dn_find_listener(skb, &reason);
+- goto got_it;
+- }
+- }
+-
+- if (!pskb_may_pull(skb, 3))
+- goto free_out;
+-
+- /*
+- * Grab the destination address.
+- */
+- cb->dst_port = *(__le16 *)ptr;
+- cb->src_port = 0;
+- ptr += 2;
+-
+- /*
+- * If not a connack, grab the source address too.
+- */
+- if (pskb_may_pull(skb, 5)) {
+- cb->src_port = *(__le16 *)ptr;
+- ptr += 2;
+- skb_pull(skb, 5);
+- }
+-
+- /*
+- * Returned packets...
+- * Swap src & dst and look up in the normal way.
+- */
+- if (unlikely(cb->rt_flags & DN_RT_F_RTS)) {
+- swap(cb->dst_port, cb->src_port);
+- swap(cb->dst, cb->src);
+- }
+-
+- /*
+- * Find the socket to which this skb is destined.
+- */
+- sk = dn_find_by_skb(skb);
+-got_it:
+- if (sk != NULL) {
+- struct dn_scp *scp = DN_SK(sk);
+-
+- /* Reset backoff */
+- scp->nsp_rxtshift = 0;
+-
+- /*
+- * We linearize everything except data segments here.
+- */
+- if (cb->nsp_flags & ~0x60) {
+- if (unlikely(skb_linearize(skb)))
+- goto free_out;
+- }
+-
+- return sk_receive_skb(sk, skb, 0);
+- }
+-
+- return dn_nsp_no_socket(skb, reason);
+-
+-free_out:
+- kfree_skb(skb);
+- return NET_RX_DROP;
+-}
+-
+-int dn_nsp_rx(struct sk_buff *skb)
+-{
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_LOCAL_IN,
+- &init_net, NULL, skb, skb->dev, NULL,
+- dn_nsp_rx_packet);
+-}
+-
+-/*
+- * This is the main receive routine for sockets. It is called
+- * from the above when the socket is not busy, and also from
+- * sock_release() when there is a backlog queued up.
+- */
+-int dn_nsp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+-
+- if (cb->rt_flags & DN_RT_F_RTS) {
+- if (cb->nsp_flags == 0x18 || cb->nsp_flags == 0x68)
+- dn_returned_conn_init(sk, skb);
+- else
+- kfree_skb(skb);
+- return NET_RX_SUCCESS;
+- }
+-
+- /*
+- * Control packet.
+- */
+- if ((cb->nsp_flags & 0x0c) == 0x08) {
+- switch (cb->nsp_flags & 0x70) {
+- case 0x10:
+- case 0x60:
+- dn_nsp_conn_init(sk, skb);
+- break;
+- case 0x20:
+- dn_nsp_conn_conf(sk, skb);
+- break;
+- case 0x30:
+- dn_nsp_disc_init(sk, skb);
+- break;
+- case 0x40:
+- dn_nsp_disc_conf(sk, skb);
+- break;
+- }
+-
+- } else if (cb->nsp_flags == 0x24) {
+- /*
+- * Special for connacks, 'cos they don't have
+- * ack data or ack otherdata info.
+- */
+- dn_nsp_conn_ack(sk, skb);
+- } else {
+- int other = 1;
+-
+- /* both data and ack frames can kick a CC socket into RUN */
+- if ((scp->state == DN_CC) && !sock_flag(sk, SOCK_DEAD)) {
+- scp->state = DN_RUN;
+- sk->sk_state = TCP_ESTABLISHED;
+- sk->sk_state_change(sk);
+- }
+-
+- if ((cb->nsp_flags & 0x1c) == 0)
+- other = 0;
+- if (cb->nsp_flags == 0x04)
+- other = 0;
+-
+- /*
+- * Read out ack data here, this applies equally
+- * to data, other data, link serivce and both
+- * ack data and ack otherdata.
+- */
+- dn_process_ack(sk, skb, other);
+-
+- /*
+- * If we've some sort of data here then call a
+- * suitable routine for dealing with it, otherwise
+- * the packet is an ack and can be discarded.
+- */
+- if ((cb->nsp_flags & 0x0c) == 0) {
+-
+- if (scp->state != DN_RUN)
+- goto free_out;
+-
+- switch (cb->nsp_flags) {
+- case 0x10: /* LS */
+- dn_nsp_linkservice(sk, skb);
+- break;
+- case 0x30: /* OD */
+- dn_nsp_otherdata(sk, skb);
+- break;
+- default:
+- dn_nsp_data(sk, skb);
+- }
+-
+- } else { /* Ack, chuck it out here */
+-free_out:
+- kfree_skb(skb);
+- }
+- }
+-
+- return NET_RX_SUCCESS;
+-}
+diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
+deleted file mode 100644
+index a1779de6bd9c3..0000000000000
+--- a/net/decnet/dn_nsp_out.c
++++ /dev/null
+@@ -1,703 +0,0 @@
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet Network Services Protocol (Output)
+- *
+- * Author: Eduardo Marcelo Serrat <emserrat@geocities.com>
+- *
+- * Changes:
+- *
+- * Steve Whitehouse: Split into dn_nsp_in.c and dn_nsp_out.c from
+- * original dn_nsp.c.
+- * Steve Whitehouse: Updated to work with my new routing architecture.
+- * Steve Whitehouse: Added changes from Eduardo Serrat's patches.
+- * Steve Whitehouse: Now conninits have the "return" bit set.
+- * Steve Whitehouse: Fixes to check alloc'd skbs are non NULL!
+- * Moved output state machine into one function
+- * Steve Whitehouse: New output state machine
+- * Paul Koning: Connect Confirm message fix.
+- * Eduardo Serrat: Fix to stop dn_nsp_do_disc() sending malformed packets.
+- * Steve Whitehouse: dn_nsp_output() and friends needed a spring clean
+- * Steve Whitehouse: Moved dn_nsp_send() in here from route.h
+- */
+-
+-/******************************************************************************
+- (c) 1995-1998 E.M. Serrat emserrat@geocities.com
+-
+- This program is free software; you can redistribute it and/or modify
+- it under the terms of the GNU General Public License as published by
+- the Free Software Foundation; either version 2 of the License, or
+- any later version.
+-
+- This program is distributed in the hope that it will be useful,
+- but WITHOUT ANY WARRANTY; without even the implied warranty of
+- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- GNU General Public License for more details.
+-*******************************************************************************/
+-
+-#include <linux/errno.h>
+-#include <linux/types.h>
+-#include <linux/socket.h>
+-#include <linux/in.h>
+-#include <linux/kernel.h>
+-#include <linux/timer.h>
+-#include <linux/string.h>
+-#include <linux/sockios.h>
+-#include <linux/net.h>
+-#include <linux/netdevice.h>
+-#include <linux/inet.h>
+-#include <linux/route.h>
+-#include <linux/slab.h>
+-#include <net/sock.h>
+-#include <linux/fcntl.h>
+-#include <linux/mm.h>
+-#include <linux/termios.h>
+-#include <linux/interrupt.h>
+-#include <linux/proc_fs.h>
+-#include <linux/stat.h>
+-#include <linux/init.h>
+-#include <linux/poll.h>
+-#include <linux/if_packet.h>
+-#include <net/neighbour.h>
+-#include <net/dst.h>
+-#include <net/flow.h>
+-#include <net/dn.h>
+-#include <net/dn_nsp.h>
+-#include <net/dn_dev.h>
+-#include <net/dn_route.h>
+-
+-
+-static int nsp_backoff[NSP_MAXRXTSHIFT + 1] = { 1, 2, 4, 8, 16, 32, 64, 64, 64, 64, 64, 64, 64 };
+-
+-static void dn_nsp_send(struct sk_buff *skb)
+-{
+- struct sock *sk = skb->sk;
+- struct dn_scp *scp = DN_SK(sk);
+- struct dst_entry *dst;
+- struct flowidn fld;
+-
+- skb_reset_transport_header(skb);
+- scp->stamp = jiffies;
+-
+- dst = sk_dst_check(sk, 0);
+- if (dst) {
+-try_again:
+- skb_dst_set(skb, dst);
+- dst_output(&init_net, skb->sk, skb);
+- return;
+- }
+-
+- memset(&fld, 0, sizeof(fld));
+- fld.flowidn_oif = sk->sk_bound_dev_if;
+- fld.saddr = dn_saddr2dn(&scp->addr);
+- fld.daddr = dn_saddr2dn(&scp->peer);
+- dn_sk_ports_copy(&fld, scp);
+- fld.flowidn_proto = DNPROTO_NSP;
+- if (dn_route_output_sock(&sk->sk_dst_cache, &fld, sk, 0) == 0) {
+- dst = sk_dst_get(sk);
+- sk->sk_route_caps = dst->dev->features;
+- goto try_again;
+- }
+-
+- sk->sk_err = EHOSTUNREACH;
+- if (!sock_flag(sk, SOCK_DEAD))
+- sk->sk_state_change(sk);
+-}
+-
+-
+-/*
+- * If sk == NULL, then we assume that we are supposed to be making
+- * a routing layer skb. If sk != NULL, then we are supposed to be
+- * creating an skb for the NSP layer.
+- *
+- * The eventual aim is for each socket to have a cached header size
+- * for its outgoing packets, and to set hdr from this when sk != NULL.
+- */
+-struct sk_buff *dn_alloc_skb(struct sock *sk, int size, gfp_t pri)
+-{
+- struct sk_buff *skb;
+- int hdr = 64;
+-
+- if ((skb = alloc_skb(size + hdr, pri)) == NULL)
+- return NULL;
+-
+- skb->protocol = htons(ETH_P_DNA_RT);
+- skb->pkt_type = PACKET_OUTGOING;
+-
+- if (sk)
+- skb_set_owner_w(skb, sk);
+-
+- skb_reserve(skb, hdr);
+-
+- return skb;
+-}
+-
+-/*
+- * Calculate persist timer based upon the smoothed round
+- * trip time and the variance. Backoff according to the
+- * nsp_backoff[] array.
+- */
+-unsigned long dn_nsp_persist(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- unsigned long t = ((scp->nsp_srtt >> 2) + scp->nsp_rttvar) >> 1;
+-
+- t *= nsp_backoff[scp->nsp_rxtshift];
+-
+- if (t < HZ) t = HZ;
+- if (t > (600*HZ)) t = (600*HZ);
+-
+- if (scp->nsp_rxtshift < NSP_MAXRXTSHIFT)
+- scp->nsp_rxtshift++;
+-
+- /* printk(KERN_DEBUG "rxtshift %lu, t=%lu\n", scp->nsp_rxtshift, t); */
+-
+- return t;
+-}
+-
+-/*
+- * This is called each time we get an estimate for the rtt
+- * on the link.
+- */
+-static void dn_nsp_rtt(struct sock *sk, long rtt)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- long srtt = (long)scp->nsp_srtt;
+- long rttvar = (long)scp->nsp_rttvar;
+- long delta;
+-
+- /*
+- * If the jiffies clock flips over in the middle of timestamp
+- * gathering this value might turn out negative, so we make sure
+- * that is it always positive here.
+- */
+- if (rtt < 0)
+- rtt = -rtt;
+- /*
+- * Add new rtt to smoothed average
+- */
+- delta = ((rtt << 3) - srtt);
+- srtt += (delta >> 3);
+- if (srtt >= 1)
+- scp->nsp_srtt = (unsigned long)srtt;
+- else
+- scp->nsp_srtt = 1;
+-
+- /*
+- * Add new rtt varience to smoothed varience
+- */
+- delta >>= 1;
+- rttvar += ((((delta>0)?(delta):(-delta)) - rttvar) >> 2);
+- if (rttvar >= 1)
+- scp->nsp_rttvar = (unsigned long)rttvar;
+- else
+- scp->nsp_rttvar = 1;
+-
+- /* printk(KERN_DEBUG "srtt=%lu rttvar=%lu\n", scp->nsp_srtt, scp->nsp_rttvar); */
+-}
+-
+-/**
+- * dn_nsp_clone_and_send - Send a data packet by cloning it
+- * @skb: The packet to clone and transmit
+- * @gfp: memory allocation flag
+- *
+- * Clone a queued data or other data packet and transmit it.
+- *
+- * Returns: The number of times the packet has been sent previously
+- */
+-static inline unsigned int dn_nsp_clone_and_send(struct sk_buff *skb,
+- gfp_t gfp)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- struct sk_buff *skb2;
+- int ret = 0;
+-
+- if ((skb2 = skb_clone(skb, gfp)) != NULL) {
+- ret = cb->xmit_count;
+- cb->xmit_count++;
+- cb->stamp = jiffies;
+- skb2->sk = skb->sk;
+- dn_nsp_send(skb2);
+- }
+-
+- return ret;
+-}
+-
+-/**
+- * dn_nsp_output - Try and send something from socket queues
+- * @sk: The socket whose queues are to be investigated
+- *
+- * Try and send the packet on the end of the data and other data queues.
+- * Other data gets priority over data, and if we retransmit a packet we
+- * reduce the window by dividing it in two.
+- *
+- */
+-void dn_nsp_output(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- struct sk_buff *skb;
+- unsigned int reduce_win = 0;
+-
+- /*
+- * First we check for otherdata/linkservice messages
+- */
+- if ((skb = skb_peek(&scp->other_xmit_queue)) != NULL)
+- reduce_win = dn_nsp_clone_and_send(skb, GFP_ATOMIC);
+-
+- /*
+- * If we may not send any data, we don't.
+- * If we are still trying to get some other data down the
+- * channel, we don't try and send any data.
+- */
+- if (reduce_win || (scp->flowrem_sw != DN_SEND))
+- goto recalc_window;
+-
+- if ((skb = skb_peek(&scp->data_xmit_queue)) != NULL)
+- reduce_win = dn_nsp_clone_and_send(skb, GFP_ATOMIC);
+-
+- /*
+- * If we've sent any frame more than once, we cut the
+- * send window size in half. There is always a minimum
+- * window size of one available.
+- */
+-recalc_window:
+- if (reduce_win) {
+- scp->snd_window >>= 1;
+- if (scp->snd_window < NSP_MIN_WINDOW)
+- scp->snd_window = NSP_MIN_WINDOW;
+- }
+-}
+-
+-int dn_nsp_xmit_timeout(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- dn_nsp_output(sk);
+-
+- if (!skb_queue_empty(&scp->data_xmit_queue) ||
+- !skb_queue_empty(&scp->other_xmit_queue))
+- scp->persist = dn_nsp_persist(sk);
+-
+- return 0;
+-}
+-
+-static inline __le16 *dn_mk_common_header(struct dn_scp *scp, struct sk_buff *skb, unsigned char msgflag, int len)
+-{
+- unsigned char *ptr = skb_push(skb, len);
+-
+- BUG_ON(len < 5);
+-
+- *ptr++ = msgflag;
+- *((__le16 *)ptr) = scp->addrrem;
+- ptr += 2;
+- *((__le16 *)ptr) = scp->addrloc;
+- ptr += 2;
+- return (__le16 __force *)ptr;
+-}
+-
+-static __le16 *dn_mk_ack_header(struct sock *sk, struct sk_buff *skb, unsigned char msgflag, int hlen, int other)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- unsigned short acknum = scp->numdat_rcv & 0x0FFF;
+- unsigned short ackcrs = scp->numoth_rcv & 0x0FFF;
+- __le16 *ptr;
+-
+- BUG_ON(hlen < 9);
+-
+- scp->ackxmt_dat = acknum;
+- scp->ackxmt_oth = ackcrs;
+- acknum |= 0x8000;
+- ackcrs |= 0x8000;
+-
+- /* If this is an "other data/ack" message, swap acknum and ackcrs */
+- if (other)
+- swap(acknum, ackcrs);
+-
+- /* Set "cross subchannel" bit in ackcrs */
+- ackcrs |= 0x2000;
+-
+- ptr = dn_mk_common_header(scp, skb, msgflag, hlen);
+-
+- *ptr++ = cpu_to_le16(acknum);
+- *ptr++ = cpu_to_le16(ackcrs);
+-
+- return ptr;
+-}
+-
+-static __le16 *dn_nsp_mk_data_header(struct sock *sk, struct sk_buff *skb, int oth)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- __le16 *ptr = dn_mk_ack_header(sk, skb, cb->nsp_flags, 11, oth);
+-
+- if (unlikely(oth)) {
+- cb->segnum = scp->numoth;
+- seq_add(&scp->numoth, 1);
+- } else {
+- cb->segnum = scp->numdat;
+- seq_add(&scp->numdat, 1);
+- }
+- *(ptr++) = cpu_to_le16(cb->segnum);
+-
+- return ptr;
+-}
+-
+-void dn_nsp_queue_xmit(struct sock *sk, struct sk_buff *skb,
+- gfp_t gfp, int oth)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- unsigned long t = ((scp->nsp_srtt >> 2) + scp->nsp_rttvar) >> 1;
+-
+- cb->xmit_count = 0;
+- dn_nsp_mk_data_header(sk, skb, oth);
+-
+- /*
+- * Slow start: If we have been idle for more than
+- * one RTT, then reset window to min size.
+- */
+- if ((jiffies - scp->stamp) > t)
+- scp->snd_window = NSP_MIN_WINDOW;
+-
+- if (oth)
+- skb_queue_tail(&scp->other_xmit_queue, skb);
+- else
+- skb_queue_tail(&scp->data_xmit_queue, skb);
+-
+- if (scp->flowrem_sw != DN_SEND)
+- return;
+-
+- dn_nsp_clone_and_send(skb, gfp);
+-}
+-
+-
+-int dn_nsp_check_xmit_queue(struct sock *sk, struct sk_buff *skb, struct sk_buff_head *q, unsigned short acknum)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- struct dn_scp *scp = DN_SK(sk);
+- struct sk_buff *skb2, *n, *ack = NULL;
+- int wakeup = 0;
+- int try_retrans = 0;
+- unsigned long reftime = cb->stamp;
+- unsigned long pkttime;
+- unsigned short xmit_count;
+- unsigned short segnum;
+-
+- skb_queue_walk_safe(q, skb2, n) {
+- struct dn_skb_cb *cb2 = DN_SKB_CB(skb2);
+-
+- if (dn_before_or_equal(cb2->segnum, acknum))
+- ack = skb2;
+-
+- /* printk(KERN_DEBUG "ack: %s %04x %04x\n", ack ? "ACK" : "SKIP", (int)cb2->segnum, (int)acknum); */
+-
+- if (ack == NULL)
+- continue;
+-
+- /* printk(KERN_DEBUG "check_xmit_queue: %04x, %d\n", acknum, cb2->xmit_count); */
+-
+- /* Does _last_ packet acked have xmit_count > 1 */
+- try_retrans = 0;
+- /* Remember to wake up the sending process */
+- wakeup = 1;
+- /* Keep various statistics */
+- pkttime = cb2->stamp;
+- xmit_count = cb2->xmit_count;
+- segnum = cb2->segnum;
+- /* Remove and drop ack'ed packet */
+- skb_unlink(ack, q);
+- kfree_skb(ack);
+- ack = NULL;
+-
+- /*
+- * We don't expect to see acknowledgements for packets we
+- * haven't sent yet.
+- */
+- WARN_ON(xmit_count == 0);
+-
+- /*
+- * If the packet has only been sent once, we can use it
+- * to calculate the RTT and also open the window a little
+- * further.
+- */
+- if (xmit_count == 1) {
+- if (dn_equal(segnum, acknum))
+- dn_nsp_rtt(sk, (long)(pkttime - reftime));
+-
+- if (scp->snd_window < scp->max_window)
+- scp->snd_window++;
+- }
+-
+- /*
+- * Packet has been sent more than once. If this is the last
+- * packet to be acknowledged then we want to send the next
+- * packet in the send queue again (assumes the remote host does
+- * go-back-N error control).
+- */
+- if (xmit_count > 1)
+- try_retrans = 1;
+- }
+-
+- if (try_retrans)
+- dn_nsp_output(sk);
+-
+- return wakeup;
+-}
+-
+-void dn_nsp_send_data_ack(struct sock *sk)
+-{
+- struct sk_buff *skb = NULL;
+-
+- if ((skb = dn_alloc_skb(sk, 9, GFP_ATOMIC)) == NULL)
+- return;
+-
+- skb_reserve(skb, 9);
+- dn_mk_ack_header(sk, skb, 0x04, 9, 0);
+- dn_nsp_send(skb);
+-}
+-
+-void dn_nsp_send_oth_ack(struct sock *sk)
+-{
+- struct sk_buff *skb = NULL;
+-
+- if ((skb = dn_alloc_skb(sk, 9, GFP_ATOMIC)) == NULL)
+- return;
+-
+- skb_reserve(skb, 9);
+- dn_mk_ack_header(sk, skb, 0x14, 9, 1);
+- dn_nsp_send(skb);
+-}
+-
+-
+-void dn_send_conn_ack (struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- struct sk_buff *skb = NULL;
+- struct nsp_conn_ack_msg *msg;
+-
+- if ((skb = dn_alloc_skb(sk, 3, sk->sk_allocation)) == NULL)
+- return;
+-
+- msg = skb_put(skb, 3);
+- msg->msgflg = 0x24;
+- msg->dstaddr = scp->addrrem;
+-
+- dn_nsp_send(skb);
+-}
+-
+-static int dn_nsp_retrans_conn_conf(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- if (scp->state == DN_CC)
+- dn_send_conn_conf(sk, GFP_ATOMIC);
+-
+- return 0;
+-}
+-
+-void dn_send_conn_conf(struct sock *sk, gfp_t gfp)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- struct sk_buff *skb = NULL;
+- struct nsp_conn_init_msg *msg;
+- __u8 len = (__u8)le16_to_cpu(scp->conndata_out.opt_optl);
+-
+- if ((skb = dn_alloc_skb(sk, 50 + len, gfp)) == NULL)
+- return;
+-
+- msg = skb_put(skb, sizeof(*msg));
+- msg->msgflg = 0x28;
+- msg->dstaddr = scp->addrrem;
+- msg->srcaddr = scp->addrloc;
+- msg->services = scp->services_loc;
+- msg->info = scp->info_loc;
+- msg->segsize = cpu_to_le16(scp->segsize_loc);
+-
+- skb_put_u8(skb, len);
+-
+- if (len > 0)
+- skb_put_data(skb, scp->conndata_out.opt_data, len);
+-
+-
+- dn_nsp_send(skb);
+-
+- scp->persist = dn_nsp_persist(sk);
+- scp->persist_fxn = dn_nsp_retrans_conn_conf;
+-}
+-
+-
+-static __inline__ void dn_nsp_do_disc(struct sock *sk, unsigned char msgflg,
+- unsigned short reason, gfp_t gfp,
+- struct dst_entry *dst,
+- int ddl, unsigned char *dd, __le16 rem, __le16 loc)
+-{
+- struct sk_buff *skb = NULL;
+- int size = 7 + ddl + ((msgflg == NSP_DISCINIT) ? 1 : 0);
+- unsigned char *msg;
+-
+- if ((dst == NULL) || (rem == 0)) {
+- net_dbg_ratelimited("DECnet: dn_nsp_do_disc: BUG! Please report this to SteveW@ACM.org rem=%u dst=%p\n",
+- le16_to_cpu(rem), dst);
+- return;
+- }
+-
+- if ((skb = dn_alloc_skb(sk, size, gfp)) == NULL)
+- return;
+-
+- msg = skb_put(skb, size);
+- *msg++ = msgflg;
+- *(__le16 *)msg = rem;
+- msg += 2;
+- *(__le16 *)msg = loc;
+- msg += 2;
+- *(__le16 *)msg = cpu_to_le16(reason);
+- msg += 2;
+- if (msgflg == NSP_DISCINIT)
+- *msg++ = ddl;
+-
+- if (ddl) {
+- memcpy(msg, dd, ddl);
+- }
+-
+- /*
+- * This doesn't go via the dn_nsp_send() function since we need
+- * to be able to send disc packets out which have no socket
+- * associations.
+- */
+- skb_dst_set(skb, dst_clone(dst));
+- dst_output(&init_net, skb->sk, skb);
+-}
+-
+-
+-void dn_nsp_send_disc(struct sock *sk, unsigned char msgflg,
+- unsigned short reason, gfp_t gfp)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- int ddl = 0;
+-
+- if (msgflg == NSP_DISCINIT)
+- ddl = le16_to_cpu(scp->discdata_out.opt_optl);
+-
+- if (reason == 0)
+- reason = le16_to_cpu(scp->discdata_out.opt_status);
+-
+- dn_nsp_do_disc(sk, msgflg, reason, gfp, __sk_dst_get(sk), ddl,
+- scp->discdata_out.opt_data, scp->addrrem, scp->addrloc);
+-}
+-
+-
+-void dn_nsp_return_disc(struct sk_buff *skb, unsigned char msgflg,
+- unsigned short reason)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- int ddl = 0;
+- gfp_t gfp = GFP_ATOMIC;
+-
+- dn_nsp_do_disc(NULL, msgflg, reason, gfp, skb_dst(skb), ddl,
+- NULL, cb->src_port, cb->dst_port);
+-}
+-
+-
+-void dn_nsp_send_link(struct sock *sk, unsigned char lsflags, char fcval)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- struct sk_buff *skb;
+- unsigned char *ptr;
+- gfp_t gfp = GFP_ATOMIC;
+-
+- if ((skb = dn_alloc_skb(sk, DN_MAX_NSP_DATA_HEADER + 2, gfp)) == NULL)
+- return;
+-
+- skb_reserve(skb, DN_MAX_NSP_DATA_HEADER);
+- ptr = skb_put(skb, 2);
+- DN_SKB_CB(skb)->nsp_flags = 0x10;
+- *ptr++ = lsflags;
+- *ptr = fcval;
+-
+- dn_nsp_queue_xmit(sk, skb, gfp, 1);
+-
+- scp->persist = dn_nsp_persist(sk);
+- scp->persist_fxn = dn_nsp_xmit_timeout;
+-}
+-
+-static int dn_nsp_retrans_conninit(struct sock *sk)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+-
+- if (scp->state == DN_CI)
+- dn_nsp_send_conninit(sk, NSP_RCI);
+-
+- return 0;
+-}
+-
+-void dn_nsp_send_conninit(struct sock *sk, unsigned char msgflg)
+-{
+- struct dn_scp *scp = DN_SK(sk);
+- struct nsp_conn_init_msg *msg;
+- unsigned char aux;
+- unsigned char menuver;
+- struct dn_skb_cb *cb;
+- unsigned char type = 1;
+- gfp_t allocation = (msgflg == NSP_CI) ? sk->sk_allocation : GFP_ATOMIC;
+- struct sk_buff *skb = dn_alloc_skb(sk, 200, allocation);
+-
+- if (!skb)
+- return;
+-
+- cb = DN_SKB_CB(skb);
+- msg = skb_put(skb, sizeof(*msg));
+-
+- msg->msgflg = msgflg;
+- msg->dstaddr = 0x0000; /* Remote Node will assign it*/
+-
+- msg->srcaddr = scp->addrloc;
+- msg->services = scp->services_loc; /* Requested flow control */
+- msg->info = scp->info_loc; /* Version Number */
+- msg->segsize = cpu_to_le16(scp->segsize_loc); /* Max segment size */
+-
+- if (scp->peer.sdn_objnum)
+- type = 0;
+-
+- skb_put(skb, dn_sockaddr2username(&scp->peer,
+- skb_tail_pointer(skb), type));
+- skb_put(skb, dn_sockaddr2username(&scp->addr,
+- skb_tail_pointer(skb), 2));
+-
+- menuver = DN_MENUVER_ACC | DN_MENUVER_USR;
+- if (scp->peer.sdn_flags & SDF_PROXY)
+- menuver |= DN_MENUVER_PRX;
+- if (scp->peer.sdn_flags & SDF_UICPROXY)
+- menuver |= DN_MENUVER_UIC;
+-
+- skb_put_u8(skb, menuver); /* Menu Version */
+-
+- aux = scp->accessdata.acc_userl;
+- skb_put_u8(skb, aux);
+- if (aux > 0)
+- skb_put_data(skb, scp->accessdata.acc_user, aux);
+-
+- aux = scp->accessdata.acc_passl;
+- skb_put_u8(skb, aux);
+- if (aux > 0)
+- skb_put_data(skb, scp->accessdata.acc_pass, aux);
+-
+- aux = scp->accessdata.acc_accl;
+- skb_put_u8(skb, aux);
+- if (aux > 0)
+- skb_put_data(skb, scp->accessdata.acc_acc, aux);
+-
+- aux = (__u8)le16_to_cpu(scp->conndata_out.opt_optl);
+- skb_put_u8(skb, aux);
+- if (aux > 0)
+- skb_put_data(skb, scp->conndata_out.opt_data, aux);
+-
+- scp->persist = dn_nsp_persist(sk);
+- scp->persist_fxn = dn_nsp_retrans_conninit;
+-
+- cb->rt_flags = DN_RT_F_RQR;
+-
+- dn_nsp_send(skb);
+-}
+diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
+deleted file mode 100644
+index 658191fba94ec..0000000000000
+--- a/net/decnet/dn_route.c
++++ /dev/null
+@@ -1,1929 +0,0 @@
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet Routing Functions (Endnode and Router)
+- *
+- * Authors: Steve Whitehouse <SteveW@ACM.org>
+- * Eduardo Marcelo Serrat <emserrat@geocities.com>
+- *
+- * Changes:
+- * Steve Whitehouse : Fixes to allow "intra-ethernet" and
+- * "return-to-sender" bits on outgoing
+- * packets.
+- * Steve Whitehouse : Timeouts for cached routes.
+- * Steve Whitehouse : Use dst cache for input routes too.
+- * Steve Whitehouse : Fixed error values in dn_send_skb.
+- * Steve Whitehouse : Rework routing functions to better fit
+- * DECnet routing design
+- * Alexey Kuznetsov : New SMP locking
+- * Steve Whitehouse : More SMP locking changes & dn_cache_dump()
+- * Steve Whitehouse : Prerouting NF hook, now really is prerouting.
+- * Fixed possible skb leak in rtnetlink funcs.
+- * Steve Whitehouse : Dave Miller's dynamic hash table sizing and
+- * Alexey Kuznetsov's finer grained locking
+- * from ipv4/route.c.
+- * Steve Whitehouse : Routing is now starting to look like a
+- * sensible set of code now, mainly due to
+- * my copying the IPv4 routing code. The
+- * hooks here are modified and will continue
+- * to evolve for a while.
+- * Steve Whitehouse : Real SMP at last :-) Also new netfilter
+- * stuff. Look out raw sockets your days
+- * are numbered!
+- * Steve Whitehouse : Added return-to-sender functions. Added
+- * backlog congestion level return codes.
+- * Steve Whitehouse : Fixed bug where routes were set up with
+- * no ref count on net devices.
+- * Steve Whitehouse : RCU for the route cache
+- * Steve Whitehouse : Preparations for the flow cache
+- * Steve Whitehouse : Prepare for nonlinear skbs
+- */
+-
+-/******************************************************************************
+- (c) 1995-1998 E.M. Serrat emserrat@geocities.com
+-
+- This program is free software; you can redistribute it and/or modify
+- it under the terms of the GNU General Public License as published by
+- the Free Software Foundation; either version 2 of the License, or
+- any later version.
+-
+- This program is distributed in the hope that it will be useful,
+- but WITHOUT ANY WARRANTY; without even the implied warranty of
+- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- GNU General Public License for more details.
+-*******************************************************************************/
+-
+-#include <linux/errno.h>
+-#include <linux/types.h>
+-#include <linux/socket.h>
+-#include <linux/in.h>
+-#include <linux/kernel.h>
+-#include <linux/sockios.h>
+-#include <linux/net.h>
+-#include <linux/netdevice.h>
+-#include <linux/inet.h>
+-#include <linux/route.h>
+-#include <linux/in_route.h>
+-#include <linux/slab.h>
+-#include <net/sock.h>
+-#include <linux/mm.h>
+-#include <linux/proc_fs.h>
+-#include <linux/seq_file.h>
+-#include <linux/init.h>
+-#include <linux/rtnetlink.h>
+-#include <linux/string.h>
+-#include <linux/netfilter_decnet.h>
+-#include <linux/rcupdate.h>
+-#include <linux/times.h>
+-#include <linux/export.h>
+-#include <asm/errno.h>
+-#include <net/net_namespace.h>
+-#include <net/netlink.h>
+-#include <net/neighbour.h>
+-#include <net/dst.h>
+-#include <net/flow.h>
+-#include <net/fib_rules.h>
+-#include <net/dn.h>
+-#include <net/dn_dev.h>
+-#include <net/dn_nsp.h>
+-#include <net/dn_route.h>
+-#include <net/dn_neigh.h>
+-#include <net/dn_fib.h>
+-
+-struct dn_rt_hash_bucket
+-{
+- struct dn_route __rcu *chain;
+- spinlock_t lock;
+-};
+-
+-extern struct neigh_table dn_neigh_table;
+-
+-
+-static unsigned char dn_hiord_addr[6] = {0xAA,0x00,0x04,0x00,0x00,0x00};
+-
+-static const int dn_rt_min_delay = 2 * HZ;
+-static const int dn_rt_max_delay = 10 * HZ;
+-static const int dn_rt_mtu_expires = 10 * 60 * HZ;
+-
+-static unsigned long dn_rt_deadline;
+-
+-static int dn_dst_gc(struct dst_ops *ops);
+-static struct dst_entry *dn_dst_check(struct dst_entry *, __u32);
+-static unsigned int dn_dst_default_advmss(const struct dst_entry *dst);
+-static unsigned int dn_dst_mtu(const struct dst_entry *dst);
+-static void dn_dst_destroy(struct dst_entry *);
+-static void dn_dst_ifdown(struct dst_entry *, struct net_device *dev, int how);
+-static struct dst_entry *dn_dst_negative_advice(struct dst_entry *);
+-static void dn_dst_link_failure(struct sk_buff *);
+-static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb , u32 mtu,
+- bool confirm_neigh);
+-static void dn_dst_redirect(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb);
+-static struct neighbour *dn_dst_neigh_lookup(const struct dst_entry *dst,
+- struct sk_buff *skb,
+- const void *daddr);
+-static int dn_route_input(struct sk_buff *);
+-static void dn_run_flush(struct timer_list *unused);
+-
+-static struct dn_rt_hash_bucket *dn_rt_hash_table;
+-static unsigned int dn_rt_hash_mask;
+-
+-static struct timer_list dn_route_timer;
+-static DEFINE_TIMER(dn_rt_flush_timer, dn_run_flush);
+-int decnet_dst_gc_interval = 2;
+-
+-static struct dst_ops dn_dst_ops = {
+- .family = PF_DECnet,
+- .gc_thresh = 128,
+- .gc = dn_dst_gc,
+- .check = dn_dst_check,
+- .default_advmss = dn_dst_default_advmss,
+- .mtu = dn_dst_mtu,
+- .cow_metrics = dst_cow_metrics_generic,
+- .destroy = dn_dst_destroy,
+- .ifdown = dn_dst_ifdown,
+- .negative_advice = dn_dst_negative_advice,
+- .link_failure = dn_dst_link_failure,
+- .update_pmtu = dn_dst_update_pmtu,
+- .redirect = dn_dst_redirect,
+- .neigh_lookup = dn_dst_neigh_lookup,
+-};
+-
+-static void dn_dst_destroy(struct dst_entry *dst)
+-{
+- struct dn_route *rt = (struct dn_route *) dst;
+-
+- if (rt->n)
+- neigh_release(rt->n);
+- dst_destroy_metrics_generic(dst);
+-}
+-
+-static void dn_dst_ifdown(struct dst_entry *dst, struct net_device *dev, int how)
+-{
+- if (how) {
+- struct dn_route *rt = (struct dn_route *) dst;
+- struct neighbour *n = rt->n;
+-
+- if (n && n->dev == dev) {
+- n->dev = dev_net(dev)->loopback_dev;
+- dev_hold(n->dev);
+- dev_put(dev);
+- }
+- }
+-}
+-
+-static __inline__ unsigned int dn_hash(__le16 src, __le16 dst)
+-{
+- __u16 tmp = (__u16 __force)(src ^ dst);
+- tmp ^= (tmp >> 3);
+- tmp ^= (tmp >> 5);
+- tmp ^= (tmp >> 10);
+- return dn_rt_hash_mask & (unsigned int)tmp;
+-}
+-
+-static void dn_dst_check_expire(struct timer_list *unused)
+-{
+- int i;
+- struct dn_route *rt;
+- struct dn_route __rcu **rtp;
+- unsigned long now = jiffies;
+- unsigned long expire = 120 * HZ;
+-
+- for (i = 0; i <= dn_rt_hash_mask; i++) {
+- rtp = &dn_rt_hash_table[i].chain;
+-
+- spin_lock(&dn_rt_hash_table[i].lock);
+- while ((rt = rcu_dereference_protected(*rtp,
+- lockdep_is_held(&dn_rt_hash_table[i].lock))) != NULL) {
+- if (atomic_read(&rt->dst.__refcnt) > 1 ||
+- (now - rt->dst.lastuse) < expire) {
+- rtp = &rt->dn_next;
+- continue;
+- }
+- *rtp = rt->dn_next;
+- rt->dn_next = NULL;
+- dst_dev_put(&rt->dst);
+- dst_release(&rt->dst);
+- }
+- spin_unlock(&dn_rt_hash_table[i].lock);
+-
+- if ((jiffies - now) > 0)
+- break;
+- }
+-
+- mod_timer(&dn_route_timer, now + decnet_dst_gc_interval * HZ);
+-}
+-
+-static int dn_dst_gc(struct dst_ops *ops)
+-{
+- struct dn_route *rt;
+- struct dn_route __rcu **rtp;
+- int i;
+- unsigned long now = jiffies;
+- unsigned long expire = 10 * HZ;
+-
+- for (i = 0; i <= dn_rt_hash_mask; i++) {
+-
+- spin_lock_bh(&dn_rt_hash_table[i].lock);
+- rtp = &dn_rt_hash_table[i].chain;
+-
+- while ((rt = rcu_dereference_protected(*rtp,
+- lockdep_is_held(&dn_rt_hash_table[i].lock))) != NULL) {
+- if (atomic_read(&rt->dst.__refcnt) > 1 ||
+- (now - rt->dst.lastuse) < expire) {
+- rtp = &rt->dn_next;
+- continue;
+- }
+- *rtp = rt->dn_next;
+- rt->dn_next = NULL;
+- dst_dev_put(&rt->dst);
+- dst_release(&rt->dst);
+- break;
+- }
+- spin_unlock_bh(&dn_rt_hash_table[i].lock);
+- }
+-
+- return 0;
+-}
+-
+-/*
+- * The decnet standards don't impose a particular minimum mtu, what they
+- * do insist on is that the routing layer accepts a datagram of at least
+- * 230 bytes long. Here we have to subtract the routing header length from
+- * 230 to get the minimum acceptable mtu. If there is no neighbour, then we
+- * assume the worst and use a long header size.
+- *
+- * We update both the mtu and the advertised mss (i.e. the segment size we
+- * advertise to the other end).
+- */
+-static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb, u32 mtu,
+- bool confirm_neigh)
+-{
+- struct dn_route *rt = (struct dn_route *) dst;
+- struct neighbour *n = rt->n;
+- u32 min_mtu = 230;
+- struct dn_dev *dn;
+-
+- dn = n ? rcu_dereference_raw(n->dev->dn_ptr) : NULL;
+-
+- if (dn && dn->use_long == 0)
+- min_mtu -= 6;
+- else
+- min_mtu -= 21;
+-
+- if (dst_metric(dst, RTAX_MTU) > mtu && mtu >= min_mtu) {
+- if (!(dst_metric_locked(dst, RTAX_MTU))) {
+- dst_metric_set(dst, RTAX_MTU, mtu);
+- dst_set_expires(dst, dn_rt_mtu_expires);
+- }
+- if (!(dst_metric_locked(dst, RTAX_ADVMSS))) {
+- u32 mss = mtu - DN_MAX_NSP_DATA_HEADER;
+- u32 existing_mss = dst_metric_raw(dst, RTAX_ADVMSS);
+- if (!existing_mss || existing_mss > mss)
+- dst_metric_set(dst, RTAX_ADVMSS, mss);
+- }
+- }
+-}
+-
+-static void dn_dst_redirect(struct dst_entry *dst, struct sock *sk,
+- struct sk_buff *skb)
+-{
+-}
+-
+-/*
+- * When a route has been marked obsolete. (e.g. routing cache flush)
+- */
+-static struct dst_entry *dn_dst_check(struct dst_entry *dst, __u32 cookie)
+-{
+- return NULL;
+-}
+-
+-static struct dst_entry *dn_dst_negative_advice(struct dst_entry *dst)
+-{
+- dst_release(dst);
+- return NULL;
+-}
+-
+-static void dn_dst_link_failure(struct sk_buff *skb)
+-{
+-}
+-
+-static inline int compare_keys(struct flowidn *fl1, struct flowidn *fl2)
+-{
+- return ((fl1->daddr ^ fl2->daddr) |
+- (fl1->saddr ^ fl2->saddr) |
+- (fl1->flowidn_mark ^ fl2->flowidn_mark) |
+- (fl1->flowidn_scope ^ fl2->flowidn_scope) |
+- (fl1->flowidn_oif ^ fl2->flowidn_oif) |
+- (fl1->flowidn_iif ^ fl2->flowidn_iif)) == 0;
+-}
+-
+-static int dn_insert_route(struct dn_route *rt, unsigned int hash, struct dn_route **rp)
+-{
+- struct dn_route *rth;
+- struct dn_route __rcu **rthp;
+- unsigned long now = jiffies;
+-
+- rthp = &dn_rt_hash_table[hash].chain;
+-
+- spin_lock_bh(&dn_rt_hash_table[hash].lock);
+- while ((rth = rcu_dereference_protected(*rthp,
+- lockdep_is_held(&dn_rt_hash_table[hash].lock))) != NULL) {
+- if (compare_keys(&rth->fld, &rt->fld)) {
+- /* Put it first */
+- *rthp = rth->dn_next;
+- rcu_assign_pointer(rth->dn_next,
+- dn_rt_hash_table[hash].chain);
+- rcu_assign_pointer(dn_rt_hash_table[hash].chain, rth);
+-
+- dst_hold_and_use(&rth->dst, now);
+- spin_unlock_bh(&dn_rt_hash_table[hash].lock);
+-
+- dst_release_immediate(&rt->dst);
+- *rp = rth;
+- return 0;
+- }
+- rthp = &rth->dn_next;
+- }
+-
+- rcu_assign_pointer(rt->dn_next, dn_rt_hash_table[hash].chain);
+- rcu_assign_pointer(dn_rt_hash_table[hash].chain, rt);
+-
+- dst_hold_and_use(&rt->dst, now);
+- spin_unlock_bh(&dn_rt_hash_table[hash].lock);
+- *rp = rt;
+- return 0;
+-}
+-
+-static void dn_run_flush(struct timer_list *unused)
+-{
+- int i;
+- struct dn_route *rt, *next;
+-
+- for (i = 0; i < dn_rt_hash_mask; i++) {
+- spin_lock_bh(&dn_rt_hash_table[i].lock);
+-
+- if ((rt = xchg((struct dn_route **)&dn_rt_hash_table[i].chain, NULL)) == NULL)
+- goto nothing_to_declare;
+-
+- for(; rt; rt = next) {
+- next = rcu_dereference_raw(rt->dn_next);
+- RCU_INIT_POINTER(rt->dn_next, NULL);
+- dst_dev_put(&rt->dst);
+- dst_release(&rt->dst);
+- }
+-
+-nothing_to_declare:
+- spin_unlock_bh(&dn_rt_hash_table[i].lock);
+- }
+-}
+-
+-static DEFINE_SPINLOCK(dn_rt_flush_lock);
+-
+-void dn_rt_cache_flush(int delay)
+-{
+- unsigned long now = jiffies;
+- int user_mode = !in_interrupt();
+-
+- if (delay < 0)
+- delay = dn_rt_min_delay;
+-
+- spin_lock_bh(&dn_rt_flush_lock);
+-
+- if (del_timer(&dn_rt_flush_timer) && delay > 0 && dn_rt_deadline) {
+- long tmo = (long)(dn_rt_deadline - now);
+-
+- if (user_mode && tmo < dn_rt_max_delay - dn_rt_min_delay)
+- tmo = 0;
+-
+- if (delay > tmo)
+- delay = tmo;
+- }
+-
+- if (delay <= 0) {
+- spin_unlock_bh(&dn_rt_flush_lock);
+- dn_run_flush(NULL);
+- return;
+- }
+-
+- if (dn_rt_deadline == 0)
+- dn_rt_deadline = now + dn_rt_max_delay;
+-
+- dn_rt_flush_timer.expires = now + delay;
+- add_timer(&dn_rt_flush_timer);
+- spin_unlock_bh(&dn_rt_flush_lock);
+-}
+-
+-/**
+- * dn_return_short - Return a short packet to its sender
+- * @skb: The packet to return
+- *
+- */
+-static int dn_return_short(struct sk_buff *skb)
+-{
+- struct dn_skb_cb *cb;
+- unsigned char *ptr;
+- __le16 *src;
+- __le16 *dst;
+-
+- /* Add back headers */
+- skb_push(skb, skb->data - skb_network_header(skb));
+-
+- if ((skb = skb_unshare(skb, GFP_ATOMIC)) == NULL)
+- return NET_RX_DROP;
+-
+- cb = DN_SKB_CB(skb);
+- /* Skip packet length and point to flags */
+- ptr = skb->data + 2;
+- *ptr++ = (cb->rt_flags & ~DN_RT_F_RQR) | DN_RT_F_RTS;
+-
+- dst = (__le16 *)ptr;
+- ptr += 2;
+- src = (__le16 *)ptr;
+- ptr += 2;
+- *ptr = 0; /* Zero hop count */
+-
+- swap(*src, *dst);
+-
+- skb->pkt_type = PACKET_OUTGOING;
+- dn_rt_finish_output(skb, NULL, NULL);
+- return NET_RX_SUCCESS;
+-}
+-
+-/**
+- * dn_return_long - Return a long packet to its sender
+- * @skb: The long format packet to return
+- *
+- */
+-static int dn_return_long(struct sk_buff *skb)
+-{
+- struct dn_skb_cb *cb;
+- unsigned char *ptr;
+- unsigned char *src_addr, *dst_addr;
+- unsigned char tmp[ETH_ALEN];
+-
+- /* Add back all headers */
+- skb_push(skb, skb->data - skb_network_header(skb));
+-
+- if ((skb = skb_unshare(skb, GFP_ATOMIC)) == NULL)
+- return NET_RX_DROP;
+-
+- cb = DN_SKB_CB(skb);
+- /* Ignore packet length and point to flags */
+- ptr = skb->data + 2;
+-
+- /* Skip padding */
+- if (*ptr & DN_RT_F_PF) {
+- char padlen = (*ptr & ~DN_RT_F_PF);
+- ptr += padlen;
+- }
+-
+- *ptr++ = (cb->rt_flags & ~DN_RT_F_RQR) | DN_RT_F_RTS;
+- ptr += 2;
+- dst_addr = ptr;
+- ptr += 8;
+- src_addr = ptr;
+- ptr += 6;
+- *ptr = 0; /* Zero hop count */
+-
+- /* Swap source and destination */
+- memcpy(tmp, src_addr, ETH_ALEN);
+- memcpy(src_addr, dst_addr, ETH_ALEN);
+- memcpy(dst_addr, tmp, ETH_ALEN);
+-
+- skb->pkt_type = PACKET_OUTGOING;
+- dn_rt_finish_output(skb, dst_addr, src_addr);
+- return NET_RX_SUCCESS;
+-}
+-
+-/**
+- * dn_route_rx_packet - Try and find a route for an incoming packet
+- * @skb: The packet to find a route for
+- *
+- * Returns: result of input function if route is found, error code otherwise
+- */
+-static int dn_route_rx_packet(struct net *net, struct sock *sk, struct sk_buff *skb)
+-{
+- struct dn_skb_cb *cb;
+- int err;
+-
+- if ((err = dn_route_input(skb)) == 0)
+- return dst_input(skb);
+-
+- cb = DN_SKB_CB(skb);
+- if (decnet_debug_level & 4) {
+- char *devname = skb->dev ? skb->dev->name : "???";
+-
+- printk(KERN_DEBUG
+- "DECnet: dn_route_rx_packet: rt_flags=0x%02x dev=%s len=%d src=0x%04hx dst=0x%04hx err=%d type=%d\n",
+- (int)cb->rt_flags, devname, skb->len,
+- le16_to_cpu(cb->src), le16_to_cpu(cb->dst),
+- err, skb->pkt_type);
+- }
+-
+- if ((skb->pkt_type == PACKET_HOST) && (cb->rt_flags & DN_RT_F_RQR)) {
+- switch (cb->rt_flags & DN_RT_PKT_MSK) {
+- case DN_RT_PKT_SHORT:
+- return dn_return_short(skb);
+- case DN_RT_PKT_LONG:
+- return dn_return_long(skb);
+- }
+- }
+-
+- kfree_skb(skb);
+- return NET_RX_DROP;
+-}
+-
+-static int dn_route_rx_long(struct sk_buff *skb)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- unsigned char *ptr = skb->data;
+-
+- if (!pskb_may_pull(skb, 21)) /* 20 for long header, 1 for shortest nsp */
+- goto drop_it;
+-
+- skb_pull(skb, 20);
+- skb_reset_transport_header(skb);
+-
+- /* Destination info */
+- ptr += 2;
+- cb->dst = dn_eth2dn(ptr);
+- if (memcmp(ptr, dn_hiord_addr, 4) != 0)
+- goto drop_it;
+- ptr += 6;
+-
+-
+- /* Source info */
+- ptr += 2;
+- cb->src = dn_eth2dn(ptr);
+- if (memcmp(ptr, dn_hiord_addr, 4) != 0)
+- goto drop_it;
+- ptr += 6;
+- /* Other junk */
+- ptr++;
+- cb->hops = *ptr++; /* Visit Count */
+-
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_PRE_ROUTING,
+- &init_net, NULL, skb, skb->dev, NULL,
+- dn_route_rx_packet);
+-
+-drop_it:
+- kfree_skb(skb);
+- return NET_RX_DROP;
+-}
+-
+-
+-
+-static int dn_route_rx_short(struct sk_buff *skb)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- unsigned char *ptr = skb->data;
+-
+- if (!pskb_may_pull(skb, 6)) /* 5 for short header + 1 for shortest nsp */
+- goto drop_it;
+-
+- skb_pull(skb, 5);
+- skb_reset_transport_header(skb);
+-
+- cb->dst = *(__le16 *)ptr;
+- ptr += 2;
+- cb->src = *(__le16 *)ptr;
+- ptr += 2;
+- cb->hops = *ptr & 0x3f;
+-
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_PRE_ROUTING,
+- &init_net, NULL, skb, skb->dev, NULL,
+- dn_route_rx_packet);
+-
+-drop_it:
+- kfree_skb(skb);
+- return NET_RX_DROP;
+-}
+-
+-static int dn_route_discard(struct net *net, struct sock *sk, struct sk_buff *skb)
+-{
+- /*
+- * I know we drop the packet here, but thats considered success in
+- * this case
+- */
+- kfree_skb(skb);
+- return NET_RX_SUCCESS;
+-}
+-
+-static int dn_route_ptp_hello(struct net *net, struct sock *sk, struct sk_buff *skb)
+-{
+- dn_dev_hello(skb);
+- dn_neigh_pointopoint_hello(skb);
+- return NET_RX_SUCCESS;
+-}
+-
+-int dn_route_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
+-{
+- struct dn_skb_cb *cb;
+- unsigned char flags = 0;
+- __u16 len = le16_to_cpu(*(__le16 *)skb->data);
+- struct dn_dev *dn = rcu_dereference(dev->dn_ptr);
+- unsigned char padlen = 0;
+-
+- if (!net_eq(dev_net(dev), &init_net))
+- goto dump_it;
+-
+- if (dn == NULL)
+- goto dump_it;
+-
+- if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
+- goto out;
+-
+- if (!pskb_may_pull(skb, 3))
+- goto dump_it;
+-
+- skb_pull(skb, 2);
+-
+- if (len > skb->len)
+- goto dump_it;
+-
+- skb_trim(skb, len);
+-
+- flags = *skb->data;
+-
+- cb = DN_SKB_CB(skb);
+- cb->stamp = jiffies;
+- cb->iif = dev->ifindex;
+-
+- /*
+- * If we have padding, remove it.
+- */
+- if (flags & DN_RT_F_PF) {
+- padlen = flags & ~DN_RT_F_PF;
+- if (!pskb_may_pull(skb, padlen + 1))
+- goto dump_it;
+- skb_pull(skb, padlen);
+- flags = *skb->data;
+- }
+-
+- skb_reset_network_header(skb);
+-
+- /*
+- * Weed out future version DECnet
+- */
+- if (flags & DN_RT_F_VER)
+- goto dump_it;
+-
+- cb->rt_flags = flags;
+-
+- if (decnet_debug_level & 1)
+- printk(KERN_DEBUG
+- "dn_route_rcv: got 0x%02x from %s [%d %d %d]\n",
+- (int)flags, (dev) ? dev->name : "???", len, skb->len,
+- padlen);
+-
+- if (flags & DN_RT_PKT_CNTL) {
+- if (unlikely(skb_linearize(skb)))
+- goto dump_it;
+-
+- switch (flags & DN_RT_CNTL_MSK) {
+- case DN_RT_PKT_INIT:
+- dn_dev_init_pkt(skb);
+- break;
+- case DN_RT_PKT_VERI:
+- dn_dev_veri_pkt(skb);
+- break;
+- }
+-
+- if (dn->parms.state != DN_DEV_S_RU)
+- goto dump_it;
+-
+- switch (flags & DN_RT_CNTL_MSK) {
+- case DN_RT_PKT_HELO:
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_HELLO,
+- &init_net, NULL, skb, skb->dev, NULL,
+- dn_route_ptp_hello);
+-
+- case DN_RT_PKT_L1RT:
+- case DN_RT_PKT_L2RT:
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_ROUTE,
+- &init_net, NULL, skb, skb->dev, NULL,
+- dn_route_discard);
+- case DN_RT_PKT_ERTH:
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_HELLO,
+- &init_net, NULL, skb, skb->dev, NULL,
+- dn_neigh_router_hello);
+-
+- case DN_RT_PKT_EEDH:
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_HELLO,
+- &init_net, NULL, skb, skb->dev, NULL,
+- dn_neigh_endnode_hello);
+- }
+- } else {
+- if (dn->parms.state != DN_DEV_S_RU)
+- goto dump_it;
+-
+- skb_pull(skb, 1); /* Pull flags */
+-
+- switch (flags & DN_RT_PKT_MSK) {
+- case DN_RT_PKT_LONG:
+- return dn_route_rx_long(skb);
+- case DN_RT_PKT_SHORT:
+- return dn_route_rx_short(skb);
+- }
+- }
+-
+-dump_it:
+- kfree_skb(skb);
+-out:
+- return NET_RX_DROP;
+-}
+-
+-static int dn_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+-{
+- struct dst_entry *dst = skb_dst(skb);
+- struct dn_route *rt = (struct dn_route *)dst;
+- struct net_device *dev = dst->dev;
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+-
+- int err = -EINVAL;
+-
+- if (rt->n == NULL)
+- goto error;
+-
+- skb->dev = dev;
+-
+- cb->src = rt->rt_saddr;
+- cb->dst = rt->rt_daddr;
+-
+- /*
+- * Always set the Intra-Ethernet bit on all outgoing packets
+- * originated on this node. Only valid flag from upper layers
+- * is return-to-sender-requested. Set hop count to 0 too.
+- */
+- cb->rt_flags &= ~DN_RT_F_RQR;
+- cb->rt_flags |= DN_RT_F_IE;
+- cb->hops = 0;
+-
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_LOCAL_OUT,
+- &init_net, sk, skb, NULL, dev,
+- dn_to_neigh_output);
+-
+-error:
+- net_dbg_ratelimited("dn_output: This should not happen\n");
+-
+- kfree_skb(skb);
+-
+- return err;
+-}
+-
+-static int dn_forward(struct sk_buff *skb)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- struct dst_entry *dst = skb_dst(skb);
+- struct dn_dev *dn_db = rcu_dereference(dst->dev->dn_ptr);
+- struct dn_route *rt;
+- int header_len;
+- struct net_device *dev = skb->dev;
+-
+- if (skb->pkt_type != PACKET_HOST)
+- goto drop;
+-
+- /* Ensure that we have enough space for headers */
+- rt = (struct dn_route *)skb_dst(skb);
+- header_len = dn_db->use_long ? 21 : 6;
+- if (skb_cow(skb, LL_RESERVED_SPACE(rt->dst.dev)+header_len))
+- goto drop;
+-
+- /*
+- * Hop count exceeded.
+- */
+- if (++cb->hops > 30)
+- goto drop;
+-
+- skb->dev = rt->dst.dev;
+-
+- /*
+- * If packet goes out same interface it came in on, then set
+- * the Intra-Ethernet bit. This has no effect for short
+- * packets, so we don't need to test for them here.
+- */
+- cb->rt_flags &= ~DN_RT_F_IE;
+- if (rt->rt_flags & RTCF_DOREDIRECT)
+- cb->rt_flags |= DN_RT_F_IE;
+-
+- return NF_HOOK(NFPROTO_DECNET, NF_DN_FORWARD,
+- &init_net, NULL, skb, dev, skb->dev,
+- dn_to_neigh_output);
+-
+-drop:
+- kfree_skb(skb);
+- return NET_RX_DROP;
+-}
+-
+-/*
+- * Used to catch bugs. This should never normally get
+- * called.
+- */
+-static int dn_rt_bug_out(struct net *net, struct sock *sk, struct sk_buff *skb)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+-
+- net_dbg_ratelimited("dn_rt_bug: skb from:%04x to:%04x\n",
+- le16_to_cpu(cb->src), le16_to_cpu(cb->dst));
+-
+- kfree_skb(skb);
+-
+- return NET_RX_DROP;
+-}
+-
+-static int dn_rt_bug(struct sk_buff *skb)
+-{
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+-
+- net_dbg_ratelimited("dn_rt_bug: skb from:%04x to:%04x\n",
+- le16_to_cpu(cb->src), le16_to_cpu(cb->dst));
+-
+- kfree_skb(skb);
+-
+- return NET_RX_DROP;
+-}
+-
+-static unsigned int dn_dst_default_advmss(const struct dst_entry *dst)
+-{
+- return dn_mss_from_pmtu(dst->dev, dst_mtu(dst));
+-}
+-
+-static unsigned int dn_dst_mtu(const struct dst_entry *dst)
+-{
+- unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+-
+- return mtu ? : dst->dev->mtu;
+-}
+-
+-static struct neighbour *dn_dst_neigh_lookup(const struct dst_entry *dst,
+- struct sk_buff *skb,
+- const void *daddr)
+-{
+- return __neigh_lookup_errno(&dn_neigh_table, daddr, dst->dev);
+-}
+-
+-static int dn_rt_set_next_hop(struct dn_route *rt, struct dn_fib_res *res)
+-{
+- struct dn_fib_info *fi = res->fi;
+- struct net_device *dev = rt->dst.dev;
+- unsigned int mss_metric;
+- struct neighbour *n;
+-
+- if (fi) {
+- if (DN_FIB_RES_GW(*res) &&
+- DN_FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
+- rt->rt_gateway = DN_FIB_RES_GW(*res);
+- dst_init_metrics(&rt->dst, fi->fib_metrics, true);
+- }
+- rt->rt_type = res->type;
+-
+- if (dev != NULL && rt->n == NULL) {
+- n = __neigh_lookup_errno(&dn_neigh_table, &rt->rt_gateway, dev);
+- if (IS_ERR(n))
+- return PTR_ERR(n);
+- rt->n = n;
+- }
+-
+- if (dst_metric(&rt->dst, RTAX_MTU) > rt->dst.dev->mtu)
+- dst_metric_set(&rt->dst, RTAX_MTU, rt->dst.dev->mtu);
+- mss_metric = dst_metric_raw(&rt->dst, RTAX_ADVMSS);
+- if (mss_metric) {
+- unsigned int mss = dn_mss_from_pmtu(dev, dst_mtu(&rt->dst));
+- if (mss_metric > mss)
+- dst_metric_set(&rt->dst, RTAX_ADVMSS, mss);
+- }
+- return 0;
+-}
+-
+-static inline int dn_match_addr(__le16 addr1, __le16 addr2)
+-{
+- __u16 tmp = le16_to_cpu(addr1) ^ le16_to_cpu(addr2);
+- int match = 16;
+- while(tmp) {
+- tmp >>= 1;
+- match--;
+- }
+- return match;
+-}
+-
+-static __le16 dnet_select_source(const struct net_device *dev, __le16 daddr, int scope)
+-{
+- __le16 saddr = 0;
+- struct dn_dev *dn_db;
+- struct dn_ifaddr *ifa;
+- int best_match = 0;
+- int ret;
+-
+- rcu_read_lock();
+- dn_db = rcu_dereference(dev->dn_ptr);
+- for (ifa = rcu_dereference(dn_db->ifa_list);
+- ifa != NULL;
+- ifa = rcu_dereference(ifa->ifa_next)) {
+- if (ifa->ifa_scope > scope)
+- continue;
+- if (!daddr) {
+- saddr = ifa->ifa_local;
+- break;
+- }
+- ret = dn_match_addr(daddr, ifa->ifa_local);
+- if (ret > best_match)
+- saddr = ifa->ifa_local;
+- if (best_match == 0)
+- saddr = ifa->ifa_local;
+- }
+- rcu_read_unlock();
+-
+- return saddr;
+-}
+-
+-static inline __le16 __dn_fib_res_prefsrc(struct dn_fib_res *res)
+-{
+- return dnet_select_source(DN_FIB_RES_DEV(*res), DN_FIB_RES_GW(*res), res->scope);
+-}
+-
+-static inline __le16 dn_fib_rules_map_destination(__le16 daddr, struct dn_fib_res *res)
+-{
+- __le16 mask = dnet_make_mask(res->prefixlen);
+- return (daddr&~mask)|res->fi->fib_nh->nh_gw;
+-}
+-
+-static int dn_route_output_slow(struct dst_entry **pprt, const struct flowidn *oldflp, int try_hard)
+-{
+- struct flowidn fld = {
+- .daddr = oldflp->daddr,
+- .saddr = oldflp->saddr,
+- .flowidn_scope = RT_SCOPE_UNIVERSE,
+- .flowidn_mark = oldflp->flowidn_mark,
+- .flowidn_iif = LOOPBACK_IFINDEX,
+- .flowidn_oif = oldflp->flowidn_oif,
+- };
+- struct dn_route *rt = NULL;
+- struct net_device *dev_out = NULL, *dev;
+- struct neighbour *neigh = NULL;
+- unsigned int hash;
+- unsigned int flags = 0;
+- struct dn_fib_res res = { .fi = NULL, .type = RTN_UNICAST };
+- int err;
+- int free_res = 0;
+- __le16 gateway = 0;
+-
+- if (decnet_debug_level & 16)
+- printk(KERN_DEBUG
+- "dn_route_output_slow: dst=%04x src=%04x mark=%d"
+- " iif=%d oif=%d\n", le16_to_cpu(oldflp->daddr),
+- le16_to_cpu(oldflp->saddr),
+- oldflp->flowidn_mark, LOOPBACK_IFINDEX,
+- oldflp->flowidn_oif);
+-
+- /* If we have an output interface, verify its a DECnet device */
+- if (oldflp->flowidn_oif) {
+- dev_out = dev_get_by_index(&init_net, oldflp->flowidn_oif);
+- err = -ENODEV;
+- if (dev_out && dev_out->dn_ptr == NULL) {
+- dev_put(dev_out);
+- dev_out = NULL;
+- }
+- if (dev_out == NULL)
+- goto out;
+- }
+-
+- /* If we have a source address, verify that its a local address */
+- if (oldflp->saddr) {
+- err = -EADDRNOTAVAIL;
+-
+- if (dev_out) {
+- if (dn_dev_islocal(dev_out, oldflp->saddr))
+- goto source_ok;
+- dev_put(dev_out);
+- goto out;
+- }
+- rcu_read_lock();
+- for_each_netdev_rcu(&init_net, dev) {
+- if (!dev->dn_ptr)
+- continue;
+- if (!dn_dev_islocal(dev, oldflp->saddr))
+- continue;
+- if ((dev->flags & IFF_LOOPBACK) &&
+- oldflp->daddr &&
+- !dn_dev_islocal(dev, oldflp->daddr))
+- continue;
+-
+- dev_out = dev;
+- break;
+- }
+- rcu_read_unlock();
+- if (dev_out == NULL)
+- goto out;
+- dev_hold(dev_out);
+-source_ok:
+- ;
+- }
+-
+- /* No destination? Assume its local */
+- if (!fld.daddr) {
+- fld.daddr = fld.saddr;
+-
+- if (dev_out)
+- dev_put(dev_out);
+- err = -EINVAL;
+- dev_out = init_net.loopback_dev;
+- if (!dev_out->dn_ptr)
+- goto out;
+- err = -EADDRNOTAVAIL;
+- dev_hold(dev_out);
+- if (!fld.daddr) {
+- fld.daddr =
+- fld.saddr = dnet_select_source(dev_out, 0,
+- RT_SCOPE_HOST);
+- if (!fld.daddr)
+- goto out;
+- }
+- fld.flowidn_oif = LOOPBACK_IFINDEX;
+- res.type = RTN_LOCAL;
+- goto make_route;
+- }
+-
+- if (decnet_debug_level & 16)
+- printk(KERN_DEBUG
+- "dn_route_output_slow: initial checks complete."
+- " dst=%04x src=%04x oif=%d try_hard=%d\n",
+- le16_to_cpu(fld.daddr), le16_to_cpu(fld.saddr),
+- fld.flowidn_oif, try_hard);
+-
+- /*
+- * N.B. If the kernel is compiled without router support then
+- * dn_fib_lookup() will evaluate to non-zero so this if () block
+- * will always be executed.
+- */
+- err = -ESRCH;
+- if (try_hard || (err = dn_fib_lookup(&fld, &res)) != 0) {
+- struct dn_dev *dn_db;
+- if (err != -ESRCH)
+- goto out;
+- /*
+- * Here the fallback is basically the standard algorithm for
+- * routing in endnodes which is described in the DECnet routing
+- * docs
+- *
+- * If we are not trying hard, look in neighbour cache.
+- * The result is tested to ensure that if a specific output
+- * device/source address was requested, then we honour that
+- * here
+- */
+- if (!try_hard) {
+- neigh = neigh_lookup_nodev(&dn_neigh_table, &init_net, &fld.daddr);
+- if (neigh) {
+- if ((oldflp->flowidn_oif &&
+- (neigh->dev->ifindex != oldflp->flowidn_oif)) ||
+- (oldflp->saddr &&
+- (!dn_dev_islocal(neigh->dev,
+- oldflp->saddr)))) {
+- neigh_release(neigh);
+- neigh = NULL;
+- } else {
+- if (dev_out)
+- dev_put(dev_out);
+- if (dn_dev_islocal(neigh->dev, fld.daddr)) {
+- dev_out = init_net.loopback_dev;
+- res.type = RTN_LOCAL;
+- } else {
+- dev_out = neigh->dev;
+- }
+- dev_hold(dev_out);
+- goto select_source;
+- }
+- }
+- }
+-
+- /* Not there? Perhaps its a local address */
+- if (dev_out == NULL)
+- dev_out = dn_dev_get_default();
+- err = -ENODEV;
+- if (dev_out == NULL)
+- goto out;
+- dn_db = rcu_dereference_raw(dev_out->dn_ptr);
+- if (!dn_db)
+- goto e_inval;
+- /* Possible improvement - check all devices for local addr */
+- if (dn_dev_islocal(dev_out, fld.daddr)) {
+- dev_put(dev_out);
+- dev_out = init_net.loopback_dev;
+- dev_hold(dev_out);
+- res.type = RTN_LOCAL;
+- goto select_source;
+- }
+- /* Not local either.... try sending it to the default router */
+- neigh = neigh_clone(dn_db->router);
+- BUG_ON(neigh && neigh->dev != dev_out);
+-
+- /* Ok then, we assume its directly connected and move on */
+-select_source:
+- if (neigh)
+- gateway = ((struct dn_neigh *)neigh)->addr;
+- if (gateway == 0)
+- gateway = fld.daddr;
+- if (fld.saddr == 0) {
+- fld.saddr = dnet_select_source(dev_out, gateway,
+- res.type == RTN_LOCAL ?
+- RT_SCOPE_HOST :
+- RT_SCOPE_LINK);
+- if (fld.saddr == 0 && res.type != RTN_LOCAL)
+- goto e_addr;
+- }
+- fld.flowidn_oif = dev_out->ifindex;
+- goto make_route;
+- }
+- free_res = 1;
+-
+- if (res.type == RTN_NAT)
+- goto e_inval;
+-
+- if (res.type == RTN_LOCAL) {
+- if (!fld.saddr)
+- fld.saddr = fld.daddr;
+- if (dev_out)
+- dev_put(dev_out);
+- dev_out = init_net.loopback_dev;
+- dev_hold(dev_out);
+- if (!dev_out->dn_ptr)
+- goto e_inval;
+- fld.flowidn_oif = dev_out->ifindex;
+- if (res.fi)
+- dn_fib_info_put(res.fi);
+- res.fi = NULL;
+- goto make_route;
+- }
+-
+- if (res.fi->fib_nhs > 1 && fld.flowidn_oif == 0)
+- dn_fib_select_multipath(&fld, &res);
+-
+- /*
+- * We could add some logic to deal with default routes here and
+- * get rid of some of the special casing above.
+- */
+-
+- if (!fld.saddr)
+- fld.saddr = DN_FIB_RES_PREFSRC(res);
+-
+- if (dev_out)
+- dev_put(dev_out);
+- dev_out = DN_FIB_RES_DEV(res);
+- dev_hold(dev_out);
+- fld.flowidn_oif = dev_out->ifindex;
+- gateway = DN_FIB_RES_GW(res);
+-
+-make_route:
+- if (dev_out->flags & IFF_LOOPBACK)
+- flags |= RTCF_LOCAL;
+-
+- rt = dst_alloc(&dn_dst_ops, dev_out, 0, DST_OBSOLETE_NONE, DST_HOST);
+- if (rt == NULL)
+- goto e_nobufs;
+-
+- rt->dn_next = NULL;
+- memset(&rt->fld, 0, sizeof(rt->fld));
+- rt->fld.saddr = oldflp->saddr;
+- rt->fld.daddr = oldflp->daddr;
+- rt->fld.flowidn_oif = oldflp->flowidn_oif;
+- rt->fld.flowidn_iif = 0;
+- rt->fld.flowidn_mark = oldflp->flowidn_mark;
+-
+- rt->rt_saddr = fld.saddr;
+- rt->rt_daddr = fld.daddr;
+- rt->rt_gateway = gateway ? gateway : fld.daddr;
+- rt->rt_local_src = fld.saddr;
+-
+- rt->rt_dst_map = fld.daddr;
+- rt->rt_src_map = fld.saddr;
+-
+- rt->n = neigh;
+- neigh = NULL;
+-
+- rt->dst.lastuse = jiffies;
+- rt->dst.output = dn_output;
+- rt->dst.input = dn_rt_bug;
+- rt->rt_flags = flags;
+- if (flags & RTCF_LOCAL)
+- rt->dst.input = dn_nsp_rx;
+-
+- err = dn_rt_set_next_hop(rt, &res);
+- if (err)
+- goto e_neighbour;
+-
+- hash = dn_hash(rt->fld.saddr, rt->fld.daddr);
+- /* dn_insert_route() increments dst->__refcnt */
+- dn_insert_route(rt, hash, (struct dn_route **)pprt);
+-
+-done:
+- if (neigh)
+- neigh_release(neigh);
+- if (free_res)
+- dn_fib_res_put(&res);
+- if (dev_out)
+- dev_put(dev_out);
+-out:
+- return err;
+-
+-e_addr:
+- err = -EADDRNOTAVAIL;
+- goto done;
+-e_inval:
+- err = -EINVAL;
+- goto done;
+-e_nobufs:
+- err = -ENOBUFS;
+- goto done;
+-e_neighbour:
+- dst_release_immediate(&rt->dst);
+- goto e_nobufs;
+-}
+-
+-
+-/*
+- * N.B. The flags may be moved into the flowi at some future stage.
+- */
+-static int __dn_route_output_key(struct dst_entry **pprt, const struct flowidn *flp, int flags)
+-{
+- unsigned int hash = dn_hash(flp->saddr, flp->daddr);
+- struct dn_route *rt = NULL;
+-
+- if (!(flags & MSG_TRYHARD)) {
+- rcu_read_lock_bh();
+- for (rt = rcu_dereference_bh(dn_rt_hash_table[hash].chain); rt;
+- rt = rcu_dereference_bh(rt->dn_next)) {
+- if ((flp->daddr == rt->fld.daddr) &&
+- (flp->saddr == rt->fld.saddr) &&
+- (flp->flowidn_mark == rt->fld.flowidn_mark) &&
+- dn_is_output_route(rt) &&
+- (rt->fld.flowidn_oif == flp->flowidn_oif)) {
+- dst_hold_and_use(&rt->dst, jiffies);
+- rcu_read_unlock_bh();
+- *pprt = &rt->dst;
+- return 0;
+- }
+- }
+- rcu_read_unlock_bh();
+- }
+-
+- return dn_route_output_slow(pprt, flp, flags);
+-}
+-
+-static int dn_route_output_key(struct dst_entry **pprt, struct flowidn *flp, int flags)
+-{
+- int err;
+-
+- err = __dn_route_output_key(pprt, flp, flags);
+- if (err == 0 && flp->flowidn_proto) {
+- *pprt = xfrm_lookup(&init_net, *pprt,
+- flowidn_to_flowi(flp), NULL, 0);
+- if (IS_ERR(*pprt)) {
+- err = PTR_ERR(*pprt);
+- *pprt = NULL;
+- }
+- }
+- return err;
+-}
+-
+-int dn_route_output_sock(struct dst_entry __rcu **pprt, struct flowidn *fl, struct sock *sk, int flags)
+-{
+- int err;
+-
+- err = __dn_route_output_key(pprt, fl, flags & MSG_TRYHARD);
+- if (err == 0 && fl->flowidn_proto) {
+- *pprt = xfrm_lookup(&init_net, *pprt,
+- flowidn_to_flowi(fl), sk, 0);
+- if (IS_ERR(*pprt)) {
+- err = PTR_ERR(*pprt);
+- *pprt = NULL;
+- }
+- }
+- return err;
+-}
+-
+-static int dn_route_input_slow(struct sk_buff *skb)
+-{
+- struct dn_route *rt = NULL;
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- struct net_device *in_dev = skb->dev;
+- struct net_device *out_dev = NULL;
+- struct dn_dev *dn_db;
+- struct neighbour *neigh = NULL;
+- unsigned int hash;
+- int flags = 0;
+- __le16 gateway = 0;
+- __le16 local_src = 0;
+- struct flowidn fld = {
+- .daddr = cb->dst,
+- .saddr = cb->src,
+- .flowidn_scope = RT_SCOPE_UNIVERSE,
+- .flowidn_mark = skb->mark,
+- .flowidn_iif = skb->dev->ifindex,
+- };
+- struct dn_fib_res res = { .fi = NULL, .type = RTN_UNREACHABLE };
+- int err = -EINVAL;
+- int free_res = 0;
+-
+- dev_hold(in_dev);
+-
+- if ((dn_db = rcu_dereference(in_dev->dn_ptr)) == NULL)
+- goto out;
+-
+- /* Zero source addresses are not allowed */
+- if (fld.saddr == 0)
+- goto out;
+-
+- /*
+- * In this case we've just received a packet from a source
+- * outside ourselves pretending to come from us. We don't
+- * allow it any further to prevent routing loops, spoofing and
+- * other nasties. Loopback packets already have the dst attached
+- * so this only affects packets which have originated elsewhere.
+- */
+- err = -ENOTUNIQ;
+- if (dn_dev_islocal(in_dev, cb->src))
+- goto out;
+-
+- err = dn_fib_lookup(&fld, &res);
+- if (err) {
+- if (err != -ESRCH)
+- goto out;
+- /*
+- * Is the destination us ?
+- */
+- if (!dn_dev_islocal(in_dev, cb->dst))
+- goto e_inval;
+-
+- res.type = RTN_LOCAL;
+- } else {
+- __le16 src_map = fld.saddr;
+- free_res = 1;
+-
+- out_dev = DN_FIB_RES_DEV(res);
+- if (out_dev == NULL) {
+- net_crit_ratelimited("Bug in dn_route_input_slow() No output device\n");
+- goto e_inval;
+- }
+- dev_hold(out_dev);
+-
+- if (res.r)
+- src_map = fld.saddr; /* no NAT support for now */
+-
+- gateway = DN_FIB_RES_GW(res);
+- if (res.type == RTN_NAT) {
+- fld.daddr = dn_fib_rules_map_destination(fld.daddr, &res);
+- dn_fib_res_put(&res);
+- free_res = 0;
+- if (dn_fib_lookup(&fld, &res))
+- goto e_inval;
+- free_res = 1;
+- if (res.type != RTN_UNICAST)
+- goto e_inval;
+- flags |= RTCF_DNAT;
+- gateway = fld.daddr;
+- }
+- fld.saddr = src_map;
+- }
+-
+- switch(res.type) {
+- case RTN_UNICAST:
+- /*
+- * Forwarding check here, we only check for forwarding
+- * being turned off, if you want to only forward intra
+- * area, its up to you to set the routing tables up
+- * correctly.
+- */
+- if (dn_db->parms.forwarding == 0)
+- goto e_inval;
+-
+- if (res.fi->fib_nhs > 1 && fld.flowidn_oif == 0)
+- dn_fib_select_multipath(&fld, &res);
+-
+- /*
+- * Check for out_dev == in_dev. We use the RTCF_DOREDIRECT
+- * flag as a hint to set the intra-ethernet bit when
+- * forwarding. If we've got NAT in operation, we don't do
+- * this optimisation.
+- */
+- if (out_dev == in_dev && !(flags & RTCF_NAT))
+- flags |= RTCF_DOREDIRECT;
+-
+- local_src = DN_FIB_RES_PREFSRC(res);
+-
+- case RTN_BLACKHOLE:
+- case RTN_UNREACHABLE:
+- break;
+- case RTN_LOCAL:
+- flags |= RTCF_LOCAL;
+- fld.saddr = cb->dst;
+- fld.daddr = cb->src;
+-
+- /* Routing tables gave us a gateway */
+- if (gateway)
+- goto make_route;
+-
+- /* Packet was intra-ethernet, so we know its on-link */
+- if (cb->rt_flags & DN_RT_F_IE) {
+- gateway = cb->src;
+- goto make_route;
+- }
+-
+- /* Use the default router if there is one */
+- neigh = neigh_clone(dn_db->router);
+- if (neigh) {
+- gateway = ((struct dn_neigh *)neigh)->addr;
+- goto make_route;
+- }
+-
+- /* Close eyes and pray */
+- gateway = cb->src;
+- goto make_route;
+- default:
+- goto e_inval;
+- }
+-
+-make_route:
+- rt = dst_alloc(&dn_dst_ops, out_dev, 1, DST_OBSOLETE_NONE, DST_HOST);
+- if (rt == NULL)
+- goto e_nobufs;
+-
+- rt->dn_next = NULL;
+- memset(&rt->fld, 0, sizeof(rt->fld));
+- rt->rt_saddr = fld.saddr;
+- rt->rt_daddr = fld.daddr;
+- rt->rt_gateway = fld.daddr;
+- if (gateway)
+- rt->rt_gateway = gateway;
+- rt->rt_local_src = local_src ? local_src : rt->rt_saddr;
+-
+- rt->rt_dst_map = fld.daddr;
+- rt->rt_src_map = fld.saddr;
+-
+- rt->fld.saddr = cb->src;
+- rt->fld.daddr = cb->dst;
+- rt->fld.flowidn_oif = 0;
+- rt->fld.flowidn_iif = in_dev->ifindex;
+- rt->fld.flowidn_mark = fld.flowidn_mark;
+-
+- rt->n = neigh;
+- rt->dst.lastuse = jiffies;
+- rt->dst.output = dn_rt_bug_out;
+- switch (res.type) {
+- case RTN_UNICAST:
+- rt->dst.input = dn_forward;
+- break;
+- case RTN_LOCAL:
+- rt->dst.output = dn_output;
+- rt->dst.input = dn_nsp_rx;
+- rt->dst.dev = in_dev;
+- flags |= RTCF_LOCAL;
+- break;
+- default:
+- case RTN_UNREACHABLE:
+- case RTN_BLACKHOLE:
+- rt->dst.input = dst_discard;
+- }
+- rt->rt_flags = flags;
+-
+- err = dn_rt_set_next_hop(rt, &res);
+- if (err)
+- goto e_neighbour;
+-
+- hash = dn_hash(rt->fld.saddr, rt->fld.daddr);
+- /* dn_insert_route() increments dst->__refcnt */
+- dn_insert_route(rt, hash, &rt);
+- skb_dst_set(skb, &rt->dst);
+-
+-done:
+- if (neigh)
+- neigh_release(neigh);
+- if (free_res)
+- dn_fib_res_put(&res);
+- dev_put(in_dev);
+- if (out_dev)
+- dev_put(out_dev);
+-out:
+- return err;
+-
+-e_inval:
+- err = -EINVAL;
+- goto done;
+-
+-e_nobufs:
+- err = -ENOBUFS;
+- goto done;
+-
+-e_neighbour:
+- dst_release_immediate(&rt->dst);
+- goto done;
+-}
+-
+-static int dn_route_input(struct sk_buff *skb)
+-{
+- struct dn_route *rt;
+- struct dn_skb_cb *cb = DN_SKB_CB(skb);
+- unsigned int hash = dn_hash(cb->src, cb->dst);
+-
+- if (skb_dst(skb))
+- return 0;
+-
+- rcu_read_lock();
+- for(rt = rcu_dereference(dn_rt_hash_table[hash].chain); rt != NULL;
+- rt = rcu_dereference(rt->dn_next)) {
+- if ((rt->fld.saddr == cb->src) &&
+- (rt->fld.daddr == cb->dst) &&
+- (rt->fld.flowidn_oif == 0) &&
+- (rt->fld.flowidn_mark == skb->mark) &&
+- (rt->fld.flowidn_iif == cb->iif)) {
+- dst_hold_and_use(&rt->dst, jiffies);
+- rcu_read_unlock();
+- skb_dst_set(skb, (struct dst_entry *)rt);
+- return 0;
+- }
+- }
+- rcu_read_unlock();
+-
+- return dn_route_input_slow(skb);
+-}
+-
+-static int dn_rt_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
+- int event, int nowait, unsigned int flags)
+-{
+- struct dn_route *rt = (struct dn_route *)skb_dst(skb);
+- struct rtmsg *r;
+- struct nlmsghdr *nlh;
+- long expires;
+-
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*r), flags);
+- if (!nlh)
+- return -EMSGSIZE;
+-
+- r = nlmsg_data(nlh);
+- r->rtm_family = AF_DECnet;
+- r->rtm_dst_len = 16;
+- r->rtm_src_len = 0;
+- r->rtm_tos = 0;
+- r->rtm_table = RT_TABLE_MAIN;
+- r->rtm_type = rt->rt_type;
+- r->rtm_flags = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
+- r->rtm_scope = RT_SCOPE_UNIVERSE;
+- r->rtm_protocol = RTPROT_UNSPEC;
+-
+- if (rt->rt_flags & RTCF_NOTIFY)
+- r->rtm_flags |= RTM_F_NOTIFY;
+-
+- if (nla_put_u32(skb, RTA_TABLE, RT_TABLE_MAIN) < 0 ||
+- nla_put_le16(skb, RTA_DST, rt->rt_daddr) < 0)
+- goto errout;
+-
+- if (rt->fld.saddr) {
+- r->rtm_src_len = 16;
+- if (nla_put_le16(skb, RTA_SRC, rt->fld.saddr) < 0)
+- goto errout;
+- }
+- if (rt->dst.dev &&
+- nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex) < 0)
+- goto errout;
+-
+- /*
+- * Note to self - change this if input routes reverse direction when
+- * they deal only with inputs and not with replies like they do
+- * currently.
+- */
+- if (nla_put_le16(skb, RTA_PREFSRC, rt->rt_local_src) < 0)
+- goto errout;
+-
+- if (rt->rt_daddr != rt->rt_gateway &&
+- nla_put_le16(skb, RTA_GATEWAY, rt->rt_gateway) < 0)
+- goto errout;
+-
+- if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
+- goto errout;
+-
+- expires = rt->dst.expires ? rt->dst.expires - jiffies : 0;
+- if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires,
+- rt->dst.error) < 0)
+- goto errout;
+-
+- if (dn_is_input_route(rt) &&
+- nla_put_u32(skb, RTA_IIF, rt->fld.flowidn_iif) < 0)
+- goto errout;
+-
+- nlmsg_end(skb, nlh);
+- return 0;
+-
+-errout:
+- nlmsg_cancel(skb, nlh);
+- return -EMSGSIZE;
+-}
+-
+-const struct nla_policy rtm_dn_policy[RTA_MAX + 1] = {
+- [RTA_DST] = { .type = NLA_U16 },
+- [RTA_SRC] = { .type = NLA_U16 },
+- [RTA_IIF] = { .type = NLA_U32 },
+- [RTA_OIF] = { .type = NLA_U32 },
+- [RTA_GATEWAY] = { .type = NLA_U16 },
+- [RTA_PRIORITY] = { .type = NLA_U32 },
+- [RTA_PREFSRC] = { .type = NLA_U16 },
+- [RTA_METRICS] = { .type = NLA_NESTED },
+- [RTA_MULTIPATH] = { .type = NLA_NESTED },
+- [RTA_TABLE] = { .type = NLA_U32 },
+- [RTA_MARK] = { .type = NLA_U32 },
+-};
+-
+-/*
+- * This is called by both endnodes and routers now.
+- */
+-static int dn_cache_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
+- struct netlink_ext_ack *extack)
+-{
+- struct net *net = sock_net(in_skb->sk);
+- struct rtmsg *rtm = nlmsg_data(nlh);
+- struct dn_route *rt = NULL;
+- struct dn_skb_cb *cb;
+- int err;
+- struct sk_buff *skb;
+- struct flowidn fld;
+- struct nlattr *tb[RTA_MAX+1];
+-
+- if (!net_eq(net, &init_net))
+- return -EINVAL;
+-
+- err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_dn_policy,
+- extack);
+- if (err < 0)
+- return err;
+-
+- memset(&fld, 0, sizeof(fld));
+- fld.flowidn_proto = DNPROTO_NSP;
+-
+- skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+- if (skb == NULL)
+- return -ENOBUFS;
+- skb_reset_mac_header(skb);
+- cb = DN_SKB_CB(skb);
+-
+- if (tb[RTA_SRC])
+- fld.saddr = nla_get_le16(tb[RTA_SRC]);
+-
+- if (tb[RTA_DST])
+- fld.daddr = nla_get_le16(tb[RTA_DST]);
+-
+- if (tb[RTA_IIF])
+- fld.flowidn_iif = nla_get_u32(tb[RTA_IIF]);
+-
+- if (fld.flowidn_iif) {
+- struct net_device *dev;
+- dev = __dev_get_by_index(&init_net, fld.flowidn_iif);
+- if (!dev || !dev->dn_ptr) {
+- kfree_skb(skb);
+- return -ENODEV;
+- }
+- skb->protocol = htons(ETH_P_DNA_RT);
+- skb->dev = dev;
+- cb->src = fld.saddr;
+- cb->dst = fld.daddr;
+- local_bh_disable();
+- err = dn_route_input(skb);
+- local_bh_enable();
+- memset(cb, 0, sizeof(struct dn_skb_cb));
+- rt = (struct dn_route *)skb_dst(skb);
+- if (!err && -rt->dst.error)
+- err = rt->dst.error;
+- } else {
+- if (tb[RTA_OIF])
+- fld.flowidn_oif = nla_get_u32(tb[RTA_OIF]);
+-
+- err = dn_route_output_key((struct dst_entry **)&rt, &fld, 0);
+- }
+-
+- skb->dev = NULL;
+- if (err)
+- goto out_free;
+- skb_dst_set(skb, &rt->dst);
+- if (rtm->rtm_flags & RTM_F_NOTIFY)
+- rt->rt_flags |= RTCF_NOTIFY;
+-
+- err = dn_rt_fill_info(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, RTM_NEWROUTE, 0, 0);
+- if (err < 0) {
+- err = -EMSGSIZE;
+- goto out_free;
+- }
+-
+- return rtnl_unicast(skb, &init_net, NETLINK_CB(in_skb).portid);
+-
+-out_free:
+- kfree_skb(skb);
+- return err;
+-}
+-
+-/*
+- * For routers, this is called from dn_fib_dump, but for endnodes its
+- * called directly from the rtnetlink dispatch table.
+- */
+-int dn_cache_dump(struct sk_buff *skb, struct netlink_callback *cb)
+-{
+- struct net *net = sock_net(skb->sk);
+- struct dn_route *rt;
+- int h, s_h;
+- int idx, s_idx;
+- struct rtmsg *rtm;
+-
+- if (!net_eq(net, &init_net))
+- return 0;
+-
+- if (nlmsg_len(cb->nlh) < sizeof(struct rtmsg))
+- return -EINVAL;
+-
+- rtm = nlmsg_data(cb->nlh);
+- if (!(rtm->rtm_flags & RTM_F_CLONED))
+- return 0;
+-
+- s_h = cb->args[0];
+- s_idx = idx = cb->args[1];
+- for(h = 0; h <= dn_rt_hash_mask; h++) {
+- if (h < s_h)
+- continue;
+- if (h > s_h)
+- s_idx = 0;
+- rcu_read_lock_bh();
+- for(rt = rcu_dereference_bh(dn_rt_hash_table[h].chain), idx = 0;
+- rt;
+- rt = rcu_dereference_bh(rt->dn_next), idx++) {
+- if (idx < s_idx)
+- continue;
+- skb_dst_set(skb, dst_clone(&rt->dst));
+- if (dn_rt_fill_info(skb, NETLINK_CB(cb->skb).portid,
+- cb->nlh->nlmsg_seq, RTM_NEWROUTE,
+- 1, NLM_F_MULTI) < 0) {
+- skb_dst_drop(skb);
+- rcu_read_unlock_bh();
+- goto done;
+- }
+- skb_dst_drop(skb);
+- }
+- rcu_read_unlock_bh();
+- }
+-
+-done:
+- cb->args[0] = h;
+- cb->args[1] = idx;
+- return skb->len;
+-}
+-
+-#ifdef CONFIG_PROC_FS
+-struct dn_rt_cache_iter_state {
+- int bucket;
+-};
+-
+-static struct dn_route *dn_rt_cache_get_first(struct seq_file *seq)
+-{
+- struct dn_route *rt = NULL;
+- struct dn_rt_cache_iter_state *s = seq->private;
+-
+- for(s->bucket = dn_rt_hash_mask; s->bucket >= 0; --s->bucket) {
+- rcu_read_lock_bh();
+- rt = rcu_dereference_bh(dn_rt_hash_table[s->bucket].chain);
+- if (rt)
+- break;
+- rcu_read_unlock_bh();
+- }
+- return rt;
+-}
+-
+-static struct dn_route *dn_rt_cache_get_next(struct seq_file *seq, struct dn_route *rt)
+-{
+- struct dn_rt_cache_iter_state *s = seq->private;
+-
+- rt = rcu_dereference_bh(rt->dn_next);
+- while (!rt) {
+- rcu_read_unlock_bh();
+- if (--s->bucket < 0)
+- break;
+- rcu_read_lock_bh();
+- rt = rcu_dereference_bh(dn_rt_hash_table[s->bucket].chain);
+- }
+- return rt;
+-}
+-
+-static void *dn_rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
+-{
+- struct dn_route *rt = dn_rt_cache_get_first(seq);
+-
+- if (rt) {
+- while(*pos && (rt = dn_rt_cache_get_next(seq, rt)))
+- --*pos;
+- }
+- return *pos ? NULL : rt;
+-}
+-
+-static void *dn_rt_cache_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+-{
+- struct dn_route *rt = dn_rt_cache_get_next(seq, v);
+- ++*pos;
+- return rt;
+-}
+-
+-static void dn_rt_cache_seq_stop(struct seq_file *seq, void *v)
+-{
+- if (v)
+- rcu_read_unlock_bh();
+-}
+-
+-static int dn_rt_cache_seq_show(struct seq_file *seq, void *v)
+-{
+- struct dn_route *rt = v;
+- char buf1[DN_ASCBUF_LEN], buf2[DN_ASCBUF_LEN];
+-
+- seq_printf(seq, "%-8s %-7s %-7s %04d %04d %04d\n",
+- rt->dst.dev ? rt->dst.dev->name : "*",
+- dn_addr2asc(le16_to_cpu(rt->rt_daddr), buf1),
+- dn_addr2asc(le16_to_cpu(rt->rt_saddr), buf2),
+- atomic_read(&rt->dst.__refcnt),
+- rt->dst.__use, 0);
+- return 0;
+-}
+-
+-static const struct seq_operations dn_rt_cache_seq_ops = {
+- .start = dn_rt_cache_seq_start,
+- .next = dn_rt_cache_seq_next,
+- .stop = dn_rt_cache_seq_stop,
+- .show = dn_rt_cache_seq_show,
+-};
+-#endif /* CONFIG_PROC_FS */
+-
+-void __init dn_route_init(void)
+-{
+- int i, goal, order;
+-
+- dn_dst_ops.kmem_cachep =
+- kmem_cache_create("dn_dst_cache", sizeof(struct dn_route), 0,
+- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+- dst_entries_init(&dn_dst_ops);
+- timer_setup(&dn_route_timer, dn_dst_check_expire, 0);
+- dn_route_timer.expires = jiffies + decnet_dst_gc_interval * HZ;
+- add_timer(&dn_route_timer);
+-
+- goal = totalram_pages >> (26 - PAGE_SHIFT);
+-
+- for(order = 0; (1UL << order) < goal; order++)
+- /* NOTHING */;
+-
+- /*
+- * Only want 1024 entries max, since the table is very, very unlikely
+- * to be larger than that.
+- */
+- while(order && ((((1UL << order) * PAGE_SIZE) /
+- sizeof(struct dn_rt_hash_bucket)) >= 2048))
+- order--;
+-
+- do {
+- dn_rt_hash_mask = (1UL << order) * PAGE_SIZE /
+- sizeof(struct dn_rt_hash_bucket);
+- while(dn_rt_hash_mask & (dn_rt_hash_mask - 1))
+- dn_rt_hash_mask--;
+- dn_rt_hash_table = (struct dn_rt_hash_bucket *)
+- __get_free_pages(GFP_ATOMIC, order);
+- } while (dn_rt_hash_table == NULL && --order > 0);
+-
+- if (!dn_rt_hash_table)
+- panic("Failed to allocate DECnet route cache hash table\n");
+-
+- printk(KERN_INFO
+- "DECnet: Routing cache hash table of %u buckets, %ldKbytes\n",
+- dn_rt_hash_mask,
+- (long)(dn_rt_hash_mask*sizeof(struct dn_rt_hash_bucket))/1024);
+-
+- dn_rt_hash_mask--;
+- for(i = 0; i <= dn_rt_hash_mask; i++) {
+- spin_lock_init(&dn_rt_hash_table[i].lock);
+- dn_rt_hash_table[i].chain = NULL;
+- }
+-
+- dn_dst_ops.gc_thresh = (dn_rt_hash_mask + 1);
+-
+- proc_create_seq_private("decnet_cache", 0444, init_net.proc_net,
+- &dn_rt_cache_seq_ops,
+- sizeof(struct dn_rt_cache_iter_state), NULL);
+-
+-#ifdef CONFIG_DECNET_ROUTER
+- rtnl_register_module(THIS_MODULE, PF_DECnet, RTM_GETROUTE,
+- dn_cache_getroute, dn_fib_dump, 0);
+-#else
+- rtnl_register_module(THIS_MODULE, PF_DECnet, RTM_GETROUTE,
+- dn_cache_getroute, dn_cache_dump, 0);
+-#endif
+-}
+-
+-void __exit dn_route_cleanup(void)
+-{
+- del_timer(&dn_route_timer);
+- dn_run_flush(NULL);
+-
+- remove_proc_entry("decnet_cache", init_net.proc_net);
+- dst_entries_destroy(&dn_dst_ops);
+-}
+diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
+deleted file mode 100644
+index 4a4e3c17740cb..0000000000000
+--- a/net/decnet/dn_rules.c
++++ /dev/null
+@@ -1,258 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet Routing Forwarding Information Base (Rules)
+- *
+- * Author: Steve Whitehouse <SteveW@ACM.org>
+- * Mostly copied from Alexey Kuznetsov's ipv4/fib_rules.c
+- *
+- *
+- * Changes:
+- * Steve Whitehouse <steve@chygwyn.com>
+- * Updated for Thomas Graf's generic rules
+- *
+- */
+-#include <linux/net.h>
+-#include <linux/init.h>
+-#include <linux/netlink.h>
+-#include <linux/rtnetlink.h>
+-#include <linux/netdevice.h>
+-#include <linux/spinlock.h>
+-#include <linux/list.h>
+-#include <linux/rcupdate.h>
+-#include <linux/export.h>
+-#include <net/neighbour.h>
+-#include <net/dst.h>
+-#include <net/flow.h>
+-#include <net/fib_rules.h>
+-#include <net/dn.h>
+-#include <net/dn_fib.h>
+-#include <net/dn_neigh.h>
+-#include <net/dn_dev.h>
+-#include <net/dn_route.h>
+-
+-static struct fib_rules_ops *dn_fib_rules_ops;
+-
+-struct dn_fib_rule
+-{
+- struct fib_rule common;
+- unsigned char dst_len;
+- unsigned char src_len;
+- __le16 src;
+- __le16 srcmask;
+- __le16 dst;
+- __le16 dstmask;
+- __le16 srcmap;
+- u8 flags;
+-};
+-
+-
+-int dn_fib_lookup(struct flowidn *flp, struct dn_fib_res *res)
+-{
+- struct fib_lookup_arg arg = {
+- .result = res,
+- };
+- int err;
+-
+- err = fib_rules_lookup(dn_fib_rules_ops,
+- flowidn_to_flowi(flp), 0, &arg);
+- res->r = arg.rule;
+-
+- return err;
+-}
+-
+-static int dn_fib_rule_action(struct fib_rule *rule, struct flowi *flp,
+- int flags, struct fib_lookup_arg *arg)
+-{
+- struct flowidn *fld = &flp->u.dn;
+- int err = -EAGAIN;
+- struct dn_fib_table *tbl;
+-
+- switch(rule->action) {
+- case FR_ACT_TO_TBL:
+- break;
+-
+- case FR_ACT_UNREACHABLE:
+- err = -ENETUNREACH;
+- goto errout;
+-
+- case FR_ACT_PROHIBIT:
+- err = -EACCES;
+- goto errout;
+-
+- case FR_ACT_BLACKHOLE:
+- default:
+- err = -EINVAL;
+- goto errout;
+- }
+-
+- tbl = dn_fib_get_table(rule->table, 0);
+- if (tbl == NULL)
+- goto errout;
+-
+- err = tbl->lookup(tbl, fld, (struct dn_fib_res *)arg->result);
+- if (err > 0)
+- err = -EAGAIN;
+-errout:
+- return err;
+-}
+-
+-static const struct nla_policy dn_fib_rule_policy[FRA_MAX+1] = {
+- FRA_GENERIC_POLICY,
+-};
+-
+-static int dn_fib_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
+-{
+- struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
+- struct flowidn *fld = &fl->u.dn;
+- __le16 daddr = fld->daddr;
+- __le16 saddr = fld->saddr;
+-
+- if (((saddr ^ r->src) & r->srcmask) ||
+- ((daddr ^ r->dst) & r->dstmask))
+- return 0;
+-
+- return 1;
+-}
+-
+-static int dn_fib_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
+- struct fib_rule_hdr *frh,
+- struct nlattr **tb,
+- struct netlink_ext_ack *extack)
+-{
+- int err = -EINVAL;
+- struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
+-
+- if (frh->tos) {
+- NL_SET_ERR_MSG(extack, "Invalid tos value");
+- goto errout;
+- }
+-
+- if (rule->table == RT_TABLE_UNSPEC) {
+- if (rule->action == FR_ACT_TO_TBL) {
+- struct dn_fib_table *table;
+-
+- table = dn_fib_empty_table();
+- if (table == NULL) {
+- err = -ENOBUFS;
+- goto errout;
+- }
+-
+- rule->table = table->n;
+- }
+- }
+-
+- if (frh->src_len)
+- r->src = nla_get_le16(tb[FRA_SRC]);
+-
+- if (frh->dst_len)
+- r->dst = nla_get_le16(tb[FRA_DST]);
+-
+- r->src_len = frh->src_len;
+- r->srcmask = dnet_make_mask(r->src_len);
+- r->dst_len = frh->dst_len;
+- r->dstmask = dnet_make_mask(r->dst_len);
+- err = 0;
+-errout:
+- return err;
+-}
+-
+-static int dn_fib_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
+- struct nlattr **tb)
+-{
+- struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
+-
+- if (frh->src_len && (r->src_len != frh->src_len))
+- return 0;
+-
+- if (frh->dst_len && (r->dst_len != frh->dst_len))
+- return 0;
+-
+- if (frh->src_len && (r->src != nla_get_le16(tb[FRA_SRC])))
+- return 0;
+-
+- if (frh->dst_len && (r->dst != nla_get_le16(tb[FRA_DST])))
+- return 0;
+-
+- return 1;
+-}
+-
+-unsigned int dnet_addr_type(__le16 addr)
+-{
+- struct flowidn fld = { .daddr = addr };
+- struct dn_fib_res res;
+- unsigned int ret = RTN_UNICAST;
+- struct dn_fib_table *tb = dn_fib_get_table(RT_TABLE_LOCAL, 0);
+-
+- res.r = NULL;
+-
+- if (tb) {
+- if (!tb->lookup(tb, &fld, &res)) {
+- ret = res.type;
+- dn_fib_res_put(&res);
+- }
+- }
+- return ret;
+-}
+-
+-static int dn_fib_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
+- struct fib_rule_hdr *frh)
+-{
+- struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
+-
+- frh->dst_len = r->dst_len;
+- frh->src_len = r->src_len;
+- frh->tos = 0;
+-
+- if ((r->dst_len &&
+- nla_put_le16(skb, FRA_DST, r->dst)) ||
+- (r->src_len &&
+- nla_put_le16(skb, FRA_SRC, r->src)))
+- goto nla_put_failure;
+- return 0;
+-
+-nla_put_failure:
+- return -ENOBUFS;
+-}
+-
+-static void dn_fib_rule_flush_cache(struct fib_rules_ops *ops)
+-{
+- dn_rt_cache_flush(-1);
+-}
+-
+-static const struct fib_rules_ops __net_initconst dn_fib_rules_ops_template = {
+- .family = AF_DECnet,
+- .rule_size = sizeof(struct dn_fib_rule),
+- .addr_size = sizeof(u16),
+- .action = dn_fib_rule_action,
+- .match = dn_fib_rule_match,
+- .configure = dn_fib_rule_configure,
+- .compare = dn_fib_rule_compare,
+- .fill = dn_fib_rule_fill,
+- .flush_cache = dn_fib_rule_flush_cache,
+- .nlgroup = RTNLGRP_DECnet_RULE,
+- .policy = dn_fib_rule_policy,
+- .owner = THIS_MODULE,
+- .fro_net = &init_net,
+-};
+-
+-void __init dn_fib_rules_init(void)
+-{
+- dn_fib_rules_ops =
+- fib_rules_register(&dn_fib_rules_ops_template, &init_net);
+- BUG_ON(IS_ERR(dn_fib_rules_ops));
+- BUG_ON(fib_default_rule_add(dn_fib_rules_ops, 0x7fff,
+- RT_TABLE_MAIN, 0));
+-}
+-
+-void __exit dn_fib_rules_cleanup(void)
+-{
+- rtnl_lock();
+- fib_rules_unregister(dn_fib_rules_ops);
+- rtnl_unlock();
+- rcu_barrier();
+-}
+diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
+deleted file mode 100644
+index f0710b5d037d0..0000000000000
+--- a/net/decnet/dn_table.c
++++ /dev/null
+@@ -1,928 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet Routing Forwarding Information Base (Routing Tables)
+- *
+- * Author: Steve Whitehouse <SteveW@ACM.org>
+- * Mostly copied from the IPv4 routing code
+- *
+- *
+- * Changes:
+- *
+- */
+-#include <linux/string.h>
+-#include <linux/net.h>
+-#include <linux/socket.h>
+-#include <linux/slab.h>
+-#include <linux/sockios.h>
+-#include <linux/init.h>
+-#include <linux/skbuff.h>
+-#include <linux/rtnetlink.h>
+-#include <linux/proc_fs.h>
+-#include <linux/netdevice.h>
+-#include <linux/timer.h>
+-#include <linux/spinlock.h>
+-#include <linux/atomic.h>
+-#include <linux/uaccess.h>
+-#include <linux/route.h> /* RTF_xxx */
+-#include <net/neighbour.h>
+-#include <net/netlink.h>
+-#include <net/tcp.h>
+-#include <net/dst.h>
+-#include <net/flow.h>
+-#include <net/fib_rules.h>
+-#include <net/dn.h>
+-#include <net/dn_route.h>
+-#include <net/dn_fib.h>
+-#include <net/dn_neigh.h>
+-#include <net/dn_dev.h>
+-
+-struct dn_zone
+-{
+- struct dn_zone *dz_next;
+- struct dn_fib_node **dz_hash;
+- int dz_nent;
+- int dz_divisor;
+- u32 dz_hashmask;
+-#define DZ_HASHMASK(dz) ((dz)->dz_hashmask)
+- int dz_order;
+- __le16 dz_mask;
+-#define DZ_MASK(dz) ((dz)->dz_mask)
+-};
+-
+-struct dn_hash
+-{
+- struct dn_zone *dh_zones[17];
+- struct dn_zone *dh_zone_list;
+-};
+-
+-#define dz_key_0(key) ((key).datum = 0)
+-
+-#define for_nexthops(fi) { int nhsel; const struct dn_fib_nh *nh;\
+- for(nhsel = 0, nh = (fi)->fib_nh; nhsel < (fi)->fib_nhs; nh++, nhsel++)
+-
+-#define endfor_nexthops(fi) }
+-
+-#define DN_MAX_DIVISOR 1024
+-#define DN_S_ZOMBIE 1
+-#define DN_S_ACCESSED 2
+-
+-#define DN_FIB_SCAN(f, fp) \
+-for( ; ((f) = *(fp)) != NULL; (fp) = &(f)->fn_next)
+-
+-#define DN_FIB_SCAN_KEY(f, fp, key) \
+-for( ; ((f) = *(fp)) != NULL && dn_key_eq((f)->fn_key, (key)); (fp) = &(f)->fn_next)
+-
+-#define RT_TABLE_MIN 1
+-#define DN_FIB_TABLE_HASHSZ 256
+-static struct hlist_head dn_fib_table_hash[DN_FIB_TABLE_HASHSZ];
+-static DEFINE_RWLOCK(dn_fib_tables_lock);
+-
+-static struct kmem_cache *dn_hash_kmem __read_mostly;
+-static int dn_fib_hash_zombies;
+-
+-static inline dn_fib_idx_t dn_hash(dn_fib_key_t key, struct dn_zone *dz)
+-{
+- u16 h = le16_to_cpu(key.datum)>>(16 - dz->dz_order);
+- h ^= (h >> 10);
+- h ^= (h >> 6);
+- h &= DZ_HASHMASK(dz);
+- return *(dn_fib_idx_t *)&h;
+-}
+-
+-static inline dn_fib_key_t dz_key(__le16 dst, struct dn_zone *dz)
+-{
+- dn_fib_key_t k;
+- k.datum = dst & DZ_MASK(dz);
+- return k;
+-}
+-
+-static inline struct dn_fib_node **dn_chain_p(dn_fib_key_t key, struct dn_zone *dz)
+-{
+- return &dz->dz_hash[dn_hash(key, dz).datum];
+-}
+-
+-static inline struct dn_fib_node *dz_chain(dn_fib_key_t key, struct dn_zone *dz)
+-{
+- return dz->dz_hash[dn_hash(key, dz).datum];
+-}
+-
+-static inline int dn_key_eq(dn_fib_key_t a, dn_fib_key_t b)
+-{
+- return a.datum == b.datum;
+-}
+-
+-static inline int dn_key_leq(dn_fib_key_t a, dn_fib_key_t b)
+-{
+- return a.datum <= b.datum;
+-}
+-
+-static inline void dn_rebuild_zone(struct dn_zone *dz,
+- struct dn_fib_node **old_ht,
+- int old_divisor)
+-{
+- struct dn_fib_node *f, **fp, *next;
+- int i;
+-
+- for(i = 0; i < old_divisor; i++) {
+- for(f = old_ht[i]; f; f = next) {
+- next = f->fn_next;
+- for(fp = dn_chain_p(f->fn_key, dz);
+- *fp && dn_key_leq((*fp)->fn_key, f->fn_key);
+- fp = &(*fp)->fn_next)
+- /* NOTHING */;
+- f->fn_next = *fp;
+- *fp = f;
+- }
+- }
+-}
+-
+-static void dn_rehash_zone(struct dn_zone *dz)
+-{
+- struct dn_fib_node **ht, **old_ht;
+- int old_divisor, new_divisor;
+- u32 new_hashmask;
+-
+- old_divisor = dz->dz_divisor;
+-
+- switch (old_divisor) {
+- case 16:
+- new_divisor = 256;
+- new_hashmask = 0xFF;
+- break;
+- default:
+- printk(KERN_DEBUG "DECnet: dn_rehash_zone: BUG! %d\n",
+- old_divisor);
+- /* fall through */
+- case 256:
+- new_divisor = 1024;
+- new_hashmask = 0x3FF;
+- break;
+- }
+-
+- ht = kcalloc(new_divisor, sizeof(struct dn_fib_node*), GFP_KERNEL);
+- if (ht == NULL)
+- return;
+-
+- write_lock_bh(&dn_fib_tables_lock);
+- old_ht = dz->dz_hash;
+- dz->dz_hash = ht;
+- dz->dz_hashmask = new_hashmask;
+- dz->dz_divisor = new_divisor;
+- dn_rebuild_zone(dz, old_ht, old_divisor);
+- write_unlock_bh(&dn_fib_tables_lock);
+- kfree(old_ht);
+-}
+-
+-static void dn_free_node(struct dn_fib_node *f)
+-{
+- dn_fib_release_info(DN_FIB_INFO(f));
+- kmem_cache_free(dn_hash_kmem, f);
+-}
+-
+-
+-static struct dn_zone *dn_new_zone(struct dn_hash *table, int z)
+-{
+- int i;
+- struct dn_zone *dz = kzalloc(sizeof(struct dn_zone), GFP_KERNEL);
+- if (!dz)
+- return NULL;
+-
+- if (z) {
+- dz->dz_divisor = 16;
+- dz->dz_hashmask = 0x0F;
+- } else {
+- dz->dz_divisor = 1;
+- dz->dz_hashmask = 0;
+- }
+-
+- dz->dz_hash = kcalloc(dz->dz_divisor, sizeof(struct dn_fib_node *), GFP_KERNEL);
+- if (!dz->dz_hash) {
+- kfree(dz);
+- return NULL;
+- }
+-
+- dz->dz_order = z;
+- dz->dz_mask = dnet_make_mask(z);
+-
+- for(i = z + 1; i <= 16; i++)
+- if (table->dh_zones[i])
+- break;
+-
+- write_lock_bh(&dn_fib_tables_lock);
+- if (i>16) {
+- dz->dz_next = table->dh_zone_list;
+- table->dh_zone_list = dz;
+- } else {
+- dz->dz_next = table->dh_zones[i]->dz_next;
+- table->dh_zones[i]->dz_next = dz;
+- }
+- table->dh_zones[z] = dz;
+- write_unlock_bh(&dn_fib_tables_lock);
+- return dz;
+-}
+-
+-
+-static int dn_fib_nh_match(struct rtmsg *r, struct nlmsghdr *nlh, struct nlattr *attrs[], struct dn_fib_info *fi)
+-{
+- struct rtnexthop *nhp;
+- int nhlen;
+-
+- if (attrs[RTA_PRIORITY] &&
+- nla_get_u32(attrs[RTA_PRIORITY]) != fi->fib_priority)
+- return 1;
+-
+- if (attrs[RTA_OIF] || attrs[RTA_GATEWAY]) {
+- if ((!attrs[RTA_OIF] || nla_get_u32(attrs[RTA_OIF]) == fi->fib_nh->nh_oif) &&
+- (!attrs[RTA_GATEWAY] || nla_get_le16(attrs[RTA_GATEWAY]) != fi->fib_nh->nh_gw))
+- return 0;
+- return 1;
+- }
+-
+- if (!attrs[RTA_MULTIPATH])
+- return 0;
+-
+- nhp = nla_data(attrs[RTA_MULTIPATH]);
+- nhlen = nla_len(attrs[RTA_MULTIPATH]);
+-
+- for_nexthops(fi) {
+- int attrlen = nhlen - sizeof(struct rtnexthop);
+- __le16 gw;
+-
+- if (attrlen < 0 || (nhlen -= nhp->rtnh_len) < 0)
+- return -EINVAL;
+- if (nhp->rtnh_ifindex && nhp->rtnh_ifindex != nh->nh_oif)
+- return 1;
+- if (attrlen) {
+- struct nlattr *gw_attr;
+-
+- gw_attr = nla_find((struct nlattr *) (nhp + 1), attrlen, RTA_GATEWAY);
+- gw = gw_attr ? nla_get_le16(gw_attr) : 0;
+-
+- if (gw && gw != nh->nh_gw)
+- return 1;
+- }
+- nhp = RTNH_NEXT(nhp);
+- } endfor_nexthops(fi);
+-
+- return 0;
+-}
+-
+-static inline size_t dn_fib_nlmsg_size(struct dn_fib_info *fi)
+-{
+- size_t payload = NLMSG_ALIGN(sizeof(struct rtmsg))
+- + nla_total_size(4) /* RTA_TABLE */
+- + nla_total_size(2) /* RTA_DST */
+- + nla_total_size(4) /* RTA_PRIORITY */
+- + nla_total_size(TCP_CA_NAME_MAX); /* RTAX_CC_ALGO */
+-
+- /* space for nested metrics */
+- payload += nla_total_size((RTAX_MAX * nla_total_size(4)));
+-
+- if (fi->fib_nhs) {
+- /* Also handles the special case fib_nhs == 1 */
+-
+- /* each nexthop is packed in an attribute */
+- size_t nhsize = nla_total_size(sizeof(struct rtnexthop));
+-
+- /* may contain a gateway attribute */
+- nhsize += nla_total_size(4);
+-
+- /* all nexthops are packed in a nested attribute */
+- payload += nla_total_size(fi->fib_nhs * nhsize);
+- }
+-
+- return payload;
+-}
+-
+-static int dn_fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
+- u32 tb_id, u8 type, u8 scope, void *dst, int dst_len,
+- struct dn_fib_info *fi, unsigned int flags)
+-{
+- struct rtmsg *rtm;
+- struct nlmsghdr *nlh;
+-
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*rtm), flags);
+- if (!nlh)
+- return -EMSGSIZE;
+-
+- rtm = nlmsg_data(nlh);
+- rtm->rtm_family = AF_DECnet;
+- rtm->rtm_dst_len = dst_len;
+- rtm->rtm_src_len = 0;
+- rtm->rtm_tos = 0;
+- rtm->rtm_table = tb_id;
+- rtm->rtm_flags = fi->fib_flags;
+- rtm->rtm_scope = scope;
+- rtm->rtm_type = type;
+- rtm->rtm_protocol = fi->fib_protocol;
+-
+- if (nla_put_u32(skb, RTA_TABLE, tb_id) < 0)
+- goto errout;
+-
+- if (rtm->rtm_dst_len &&
+- nla_put(skb, RTA_DST, 2, dst) < 0)
+- goto errout;
+-
+- if (fi->fib_priority &&
+- nla_put_u32(skb, RTA_PRIORITY, fi->fib_priority) < 0)
+- goto errout;
+-
+- if (rtnetlink_put_metrics(skb, fi->fib_metrics) < 0)
+- goto errout;
+-
+- if (fi->fib_nhs == 1) {
+- if (fi->fib_nh->nh_gw &&
+- nla_put_le16(skb, RTA_GATEWAY, fi->fib_nh->nh_gw) < 0)
+- goto errout;
+-
+- if (fi->fib_nh->nh_oif &&
+- nla_put_u32(skb, RTA_OIF, fi->fib_nh->nh_oif) < 0)
+- goto errout;
+- }
+-
+- if (fi->fib_nhs > 1) {
+- struct rtnexthop *nhp;
+- struct nlattr *mp_head;
+-
+- if (!(mp_head = nla_nest_start(skb, RTA_MULTIPATH)))
+- goto errout;
+-
+- for_nexthops(fi) {
+- if (!(nhp = nla_reserve_nohdr(skb, sizeof(*nhp))))
+- goto errout;
+-
+- nhp->rtnh_flags = nh->nh_flags & 0xFF;
+- nhp->rtnh_hops = nh->nh_weight - 1;
+- nhp->rtnh_ifindex = nh->nh_oif;
+-
+- if (nh->nh_gw &&
+- nla_put_le16(skb, RTA_GATEWAY, nh->nh_gw) < 0)
+- goto errout;
+-
+- nhp->rtnh_len = skb_tail_pointer(skb) - (unsigned char *)nhp;
+- } endfor_nexthops(fi);
+-
+- nla_nest_end(skb, mp_head);
+- }
+-
+- nlmsg_end(skb, nlh);
+- return 0;
+-
+-errout:
+- nlmsg_cancel(skb, nlh);
+- return -EMSGSIZE;
+-}
+-
+-
+-static void dn_rtmsg_fib(int event, struct dn_fib_node *f, int z, u32 tb_id,
+- struct nlmsghdr *nlh, struct netlink_skb_parms *req)
+-{
+- struct sk_buff *skb;
+- u32 portid = req ? req->portid : 0;
+- int err = -ENOBUFS;
+-
+- skb = nlmsg_new(dn_fib_nlmsg_size(DN_FIB_INFO(f)), GFP_KERNEL);
+- if (skb == NULL)
+- goto errout;
+-
+- err = dn_fib_dump_info(skb, portid, nlh->nlmsg_seq, event, tb_id,
+- f->fn_type, f->fn_scope, &f->fn_key, z,
+- DN_FIB_INFO(f), 0);
+- if (err < 0) {
+- /* -EMSGSIZE implies BUG in dn_fib_nlmsg_size() */
+- WARN_ON(err == -EMSGSIZE);
+- kfree_skb(skb);
+- goto errout;
+- }
+- rtnl_notify(skb, &init_net, portid, RTNLGRP_DECnet_ROUTE, nlh, GFP_KERNEL);
+- return;
+-errout:
+- if (err < 0)
+- rtnl_set_sk_err(&init_net, RTNLGRP_DECnet_ROUTE, err);
+-}
+-
+-static __inline__ int dn_hash_dump_bucket(struct sk_buff *skb,
+- struct netlink_callback *cb,
+- struct dn_fib_table *tb,
+- struct dn_zone *dz,
+- struct dn_fib_node *f)
+-{
+- int i, s_i;
+-
+- s_i = cb->args[4];
+- for(i = 0; f; i++, f = f->fn_next) {
+- if (i < s_i)
+- continue;
+- if (f->fn_state & DN_S_ZOMBIE)
+- continue;
+- if (dn_fib_dump_info(skb, NETLINK_CB(cb->skb).portid,
+- cb->nlh->nlmsg_seq,
+- RTM_NEWROUTE,
+- tb->n,
+- (f->fn_state & DN_S_ZOMBIE) ? 0 : f->fn_type,
+- f->fn_scope, &f->fn_key, dz->dz_order,
+- f->fn_info, NLM_F_MULTI) < 0) {
+- cb->args[4] = i;
+- return -1;
+- }
+- }
+- cb->args[4] = i;
+- return skb->len;
+-}
+-
+-static __inline__ int dn_hash_dump_zone(struct sk_buff *skb,
+- struct netlink_callback *cb,
+- struct dn_fib_table *tb,
+- struct dn_zone *dz)
+-{
+- int h, s_h;
+-
+- s_h = cb->args[3];
+- for(h = 0; h < dz->dz_divisor; h++) {
+- if (h < s_h)
+- continue;
+- if (h > s_h)
+- memset(&cb->args[4], 0, sizeof(cb->args) - 4*sizeof(cb->args[0]));
+- if (dz->dz_hash == NULL || dz->dz_hash[h] == NULL)
+- continue;
+- if (dn_hash_dump_bucket(skb, cb, tb, dz, dz->dz_hash[h]) < 0) {
+- cb->args[3] = h;
+- return -1;
+- }
+- }
+- cb->args[3] = h;
+- return skb->len;
+-}
+-
+-static int dn_fib_table_dump(struct dn_fib_table *tb, struct sk_buff *skb,
+- struct netlink_callback *cb)
+-{
+- int m, s_m;
+- struct dn_zone *dz;
+- struct dn_hash *table = (struct dn_hash *)tb->data;
+-
+- s_m = cb->args[2];
+- read_lock(&dn_fib_tables_lock);
+- for(dz = table->dh_zone_list, m = 0; dz; dz = dz->dz_next, m++) {
+- if (m < s_m)
+- continue;
+- if (m > s_m)
+- memset(&cb->args[3], 0, sizeof(cb->args) - 3*sizeof(cb->args[0]));
+-
+- if (dn_hash_dump_zone(skb, cb, tb, dz) < 0) {
+- cb->args[2] = m;
+- read_unlock(&dn_fib_tables_lock);
+- return -1;
+- }
+- }
+- read_unlock(&dn_fib_tables_lock);
+- cb->args[2] = m;
+-
+- return skb->len;
+-}
+-
+-int dn_fib_dump(struct sk_buff *skb, struct netlink_callback *cb)
+-{
+- struct net *net = sock_net(skb->sk);
+- unsigned int h, s_h;
+- unsigned int e = 0, s_e;
+- struct dn_fib_table *tb;
+- int dumped = 0;
+-
+- if (!net_eq(net, &init_net))
+- return 0;
+-
+- if (nlmsg_len(cb->nlh) >= sizeof(struct rtmsg) &&
+- ((struct rtmsg *)nlmsg_data(cb->nlh))->rtm_flags&RTM_F_CLONED)
+- return dn_cache_dump(skb, cb);
+-
+- s_h = cb->args[0];
+- s_e = cb->args[1];
+-
+- for (h = s_h; h < DN_FIB_TABLE_HASHSZ; h++, s_h = 0) {
+- e = 0;
+- hlist_for_each_entry(tb, &dn_fib_table_hash[h], hlist) {
+- if (e < s_e)
+- goto next;
+- if (dumped)
+- memset(&cb->args[2], 0, sizeof(cb->args) -
+- 2 * sizeof(cb->args[0]));
+- if (tb->dump(tb, skb, cb) < 0)
+- goto out;
+- dumped = 1;
+-next:
+- e++;
+- }
+- }
+-out:
+- cb->args[1] = e;
+- cb->args[0] = h;
+-
+- return skb->len;
+-}
+-
+-static int dn_fib_table_insert(struct dn_fib_table *tb, struct rtmsg *r, struct nlattr *attrs[],
+- struct nlmsghdr *n, struct netlink_skb_parms *req)
+-{
+- struct dn_hash *table = (struct dn_hash *)tb->data;
+- struct dn_fib_node *new_f, *f, **fp, **del_fp;
+- struct dn_zone *dz;
+- struct dn_fib_info *fi;
+- int z = r->rtm_dst_len;
+- int type = r->rtm_type;
+- dn_fib_key_t key;
+- int err;
+-
+- if (z > 16)
+- return -EINVAL;
+-
+- dz = table->dh_zones[z];
+- if (!dz && !(dz = dn_new_zone(table, z)))
+- return -ENOBUFS;
+-
+- dz_key_0(key);
+- if (attrs[RTA_DST]) {
+- __le16 dst = nla_get_le16(attrs[RTA_DST]);
+- if (dst & ~DZ_MASK(dz))
+- return -EINVAL;
+- key = dz_key(dst, dz);
+- }
+-
+- if ((fi = dn_fib_create_info(r, attrs, n, &err)) == NULL)
+- return err;
+-
+- if (dz->dz_nent > (dz->dz_divisor << 2) &&
+- dz->dz_divisor > DN_MAX_DIVISOR &&
+- (z==16 || (1<<z) > dz->dz_divisor))
+- dn_rehash_zone(dz);
+-
+- fp = dn_chain_p(key, dz);
+-
+- DN_FIB_SCAN(f, fp) {
+- if (dn_key_leq(key, f->fn_key))
+- break;
+- }
+-
+- del_fp = NULL;
+-
+- if (f && (f->fn_state & DN_S_ZOMBIE) &&
+- dn_key_eq(f->fn_key, key)) {
+- del_fp = fp;
+- fp = &f->fn_next;
+- f = *fp;
+- goto create;
+- }
+-
+- DN_FIB_SCAN_KEY(f, fp, key) {
+- if (fi->fib_priority <= DN_FIB_INFO(f)->fib_priority)
+- break;
+- }
+-
+- if (f && dn_key_eq(f->fn_key, key) &&
+- fi->fib_priority == DN_FIB_INFO(f)->fib_priority) {
+- struct dn_fib_node **ins_fp;
+-
+- err = -EEXIST;
+- if (n->nlmsg_flags & NLM_F_EXCL)
+- goto out;
+-
+- if (n->nlmsg_flags & NLM_F_REPLACE) {
+- del_fp = fp;
+- fp = &f->fn_next;
+- f = *fp;
+- goto replace;
+- }
+-
+- ins_fp = fp;
+- err = -EEXIST;
+-
+- DN_FIB_SCAN_KEY(f, fp, key) {
+- if (fi->fib_priority != DN_FIB_INFO(f)->fib_priority)
+- break;
+- if (f->fn_type == type &&
+- f->fn_scope == r->rtm_scope &&
+- DN_FIB_INFO(f) == fi)
+- goto out;
+- }
+-
+- if (!(n->nlmsg_flags & NLM_F_APPEND)) {
+- fp = ins_fp;
+- f = *fp;
+- }
+- }
+-
+-create:
+- err = -ENOENT;
+- if (!(n->nlmsg_flags & NLM_F_CREATE))
+- goto out;
+-
+-replace:
+- err = -ENOBUFS;
+- new_f = kmem_cache_zalloc(dn_hash_kmem, GFP_KERNEL);
+- if (new_f == NULL)
+- goto out;
+-
+- new_f->fn_key = key;
+- new_f->fn_type = type;
+- new_f->fn_scope = r->rtm_scope;
+- DN_FIB_INFO(new_f) = fi;
+-
+- new_f->fn_next = f;
+- write_lock_bh(&dn_fib_tables_lock);
+- *fp = new_f;
+- write_unlock_bh(&dn_fib_tables_lock);
+- dz->dz_nent++;
+-
+- if (del_fp) {
+- f = *del_fp;
+- write_lock_bh(&dn_fib_tables_lock);
+- *del_fp = f->fn_next;
+- write_unlock_bh(&dn_fib_tables_lock);
+-
+- if (!(f->fn_state & DN_S_ZOMBIE))
+- dn_rtmsg_fib(RTM_DELROUTE, f, z, tb->n, n, req);
+- if (f->fn_state & DN_S_ACCESSED)
+- dn_rt_cache_flush(-1);
+- dn_free_node(f);
+- dz->dz_nent--;
+- } else {
+- dn_rt_cache_flush(-1);
+- }
+-
+- dn_rtmsg_fib(RTM_NEWROUTE, new_f, z, tb->n, n, req);
+-
+- return 0;
+-out:
+- dn_fib_release_info(fi);
+- return err;
+-}
+-
+-
+-static int dn_fib_table_delete(struct dn_fib_table *tb, struct rtmsg *r, struct nlattr *attrs[],
+- struct nlmsghdr *n, struct netlink_skb_parms *req)
+-{
+- struct dn_hash *table = (struct dn_hash*)tb->data;
+- struct dn_fib_node **fp, **del_fp, *f;
+- int z = r->rtm_dst_len;
+- struct dn_zone *dz;
+- dn_fib_key_t key;
+- int matched;
+-
+-
+- if (z > 16)
+- return -EINVAL;
+-
+- if ((dz = table->dh_zones[z]) == NULL)
+- return -ESRCH;
+-
+- dz_key_0(key);
+- if (attrs[RTA_DST]) {
+- __le16 dst = nla_get_le16(attrs[RTA_DST]);
+- if (dst & ~DZ_MASK(dz))
+- return -EINVAL;
+- key = dz_key(dst, dz);
+- }
+-
+- fp = dn_chain_p(key, dz);
+-
+- DN_FIB_SCAN(f, fp) {
+- if (dn_key_eq(f->fn_key, key))
+- break;
+- if (dn_key_leq(key, f->fn_key))
+- return -ESRCH;
+- }
+-
+- matched = 0;
+- del_fp = NULL;
+- DN_FIB_SCAN_KEY(f, fp, key) {
+- struct dn_fib_info *fi = DN_FIB_INFO(f);
+-
+- if (f->fn_state & DN_S_ZOMBIE)
+- return -ESRCH;
+-
+- matched++;
+-
+- if (del_fp == NULL &&
+- (!r->rtm_type || f->fn_type == r->rtm_type) &&
+- (r->rtm_scope == RT_SCOPE_NOWHERE || f->fn_scope == r->rtm_scope) &&
+- (!r->rtm_protocol ||
+- fi->fib_protocol == r->rtm_protocol) &&
+- dn_fib_nh_match(r, n, attrs, fi) == 0)
+- del_fp = fp;
+- }
+-
+- if (del_fp) {
+- f = *del_fp;
+- dn_rtmsg_fib(RTM_DELROUTE, f, z, tb->n, n, req);
+-
+- if (matched != 1) {
+- write_lock_bh(&dn_fib_tables_lock);
+- *del_fp = f->fn_next;
+- write_unlock_bh(&dn_fib_tables_lock);
+-
+- if (f->fn_state & DN_S_ACCESSED)
+- dn_rt_cache_flush(-1);
+- dn_free_node(f);
+- dz->dz_nent--;
+- } else {
+- f->fn_state |= DN_S_ZOMBIE;
+- if (f->fn_state & DN_S_ACCESSED) {
+- f->fn_state &= ~DN_S_ACCESSED;
+- dn_rt_cache_flush(-1);
+- }
+- if (++dn_fib_hash_zombies > 128)
+- dn_fib_flush();
+- }
+-
+- return 0;
+- }
+-
+- return -ESRCH;
+-}
+-
+-static inline int dn_flush_list(struct dn_fib_node **fp, int z, struct dn_hash *table)
+-{
+- int found = 0;
+- struct dn_fib_node *f;
+-
+- while((f = *fp) != NULL) {
+- struct dn_fib_info *fi = DN_FIB_INFO(f);
+-
+- if (fi && ((f->fn_state & DN_S_ZOMBIE) || (fi->fib_flags & RTNH_F_DEAD))) {
+- write_lock_bh(&dn_fib_tables_lock);
+- *fp = f->fn_next;
+- write_unlock_bh(&dn_fib_tables_lock);
+-
+- dn_free_node(f);
+- found++;
+- continue;
+- }
+- fp = &f->fn_next;
+- }
+-
+- return found;
+-}
+-
+-static int dn_fib_table_flush(struct dn_fib_table *tb)
+-{
+- struct dn_hash *table = (struct dn_hash *)tb->data;
+- struct dn_zone *dz;
+- int found = 0;
+-
+- dn_fib_hash_zombies = 0;
+- for(dz = table->dh_zone_list; dz; dz = dz->dz_next) {
+- int i;
+- int tmp = 0;
+- for(i = dz->dz_divisor-1; i >= 0; i--)
+- tmp += dn_flush_list(&dz->dz_hash[i], dz->dz_order, table);
+- dz->dz_nent -= tmp;
+- found += tmp;
+- }
+-
+- return found;
+-}
+-
+-static int dn_fib_table_lookup(struct dn_fib_table *tb, const struct flowidn *flp, struct dn_fib_res *res)
+-{
+- int err;
+- struct dn_zone *dz;
+- struct dn_hash *t = (struct dn_hash *)tb->data;
+-
+- read_lock(&dn_fib_tables_lock);
+- for(dz = t->dh_zone_list; dz; dz = dz->dz_next) {
+- struct dn_fib_node *f;
+- dn_fib_key_t k = dz_key(flp->daddr, dz);
+-
+- for(f = dz_chain(k, dz); f; f = f->fn_next) {
+- if (!dn_key_eq(k, f->fn_key)) {
+- if (dn_key_leq(k, f->fn_key))
+- break;
+- else
+- continue;
+- }
+-
+- f->fn_state |= DN_S_ACCESSED;
+-
+- if (f->fn_state&DN_S_ZOMBIE)
+- continue;
+-
+- if (f->fn_scope < flp->flowidn_scope)
+- continue;
+-
+- err = dn_fib_semantic_match(f->fn_type, DN_FIB_INFO(f), flp, res);
+-
+- if (err == 0) {
+- res->type = f->fn_type;
+- res->scope = f->fn_scope;
+- res->prefixlen = dz->dz_order;
+- goto out;
+- }
+- if (err < 0)
+- goto out;
+- }
+- }
+- err = 1;
+-out:
+- read_unlock(&dn_fib_tables_lock);
+- return err;
+-}
+-
+-
+-struct dn_fib_table *dn_fib_get_table(u32 n, int create)
+-{
+- struct dn_fib_table *t;
+- unsigned int h;
+-
+- if (n < RT_TABLE_MIN)
+- return NULL;
+-
+- if (n > RT_TABLE_MAX)
+- return NULL;
+-
+- h = n & (DN_FIB_TABLE_HASHSZ - 1);
+- rcu_read_lock();
+- hlist_for_each_entry_rcu(t, &dn_fib_table_hash[h], hlist) {
+- if (t->n == n) {
+- rcu_read_unlock();
+- return t;
+- }
+- }
+- rcu_read_unlock();
+-
+- if (!create)
+- return NULL;
+-
+- if (in_interrupt()) {
+- net_dbg_ratelimited("DECnet: BUG! Attempt to create routing table from interrupt\n");
+- return NULL;
+- }
+-
+- t = kzalloc(sizeof(struct dn_fib_table) + sizeof(struct dn_hash),
+- GFP_KERNEL);
+- if (t == NULL)
+- return NULL;
+-
+- t->n = n;
+- t->insert = dn_fib_table_insert;
+- t->delete = dn_fib_table_delete;
+- t->lookup = dn_fib_table_lookup;
+- t->flush = dn_fib_table_flush;
+- t->dump = dn_fib_table_dump;
+- hlist_add_head_rcu(&t->hlist, &dn_fib_table_hash[h]);
+-
+- return t;
+-}
+-
+-struct dn_fib_table *dn_fib_empty_table(void)
+-{
+- u32 id;
+-
+- for(id = RT_TABLE_MIN; id <= RT_TABLE_MAX; id++)
+- if (dn_fib_get_table(id, 0) == NULL)
+- return dn_fib_get_table(id, 1);
+- return NULL;
+-}
+-
+-void dn_fib_flush(void)
+-{
+- int flushed = 0;
+- struct dn_fib_table *tb;
+- unsigned int h;
+-
+- for (h = 0; h < DN_FIB_TABLE_HASHSZ; h++) {
+- hlist_for_each_entry(tb, &dn_fib_table_hash[h], hlist)
+- flushed += tb->flush(tb);
+- }
+-
+- if (flushed)
+- dn_rt_cache_flush(-1);
+-}
+-
+-void __init dn_fib_table_init(void)
+-{
+- dn_hash_kmem = kmem_cache_create("dn_fib_info_cache",
+- sizeof(struct dn_fib_info),
+- 0, SLAB_HWCACHE_ALIGN,
+- NULL);
+-}
+-
+-void __exit dn_fib_table_cleanup(void)
+-{
+- struct dn_fib_table *t;
+- struct hlist_node *next;
+- unsigned int h;
+-
+- write_lock(&dn_fib_tables_lock);
+- for (h = 0; h < DN_FIB_TABLE_HASHSZ; h++) {
+- hlist_for_each_entry_safe(t, next, &dn_fib_table_hash[h],
+- hlist) {
+- hlist_del(&t->hlist);
+- kfree(t);
+- }
+- }
+- write_unlock(&dn_fib_tables_lock);
+-}
+diff --git a/net/decnet/dn_timer.c b/net/decnet/dn_timer.c
+deleted file mode 100644
+index aa4155875ca84..0000000000000
+--- a/net/decnet/dn_timer.c
++++ /dev/null
+@@ -1,104 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet Socket Timer Functions
+- *
+- * Author: Steve Whitehouse <SteveW@ACM.org>
+- *
+- *
+- * Changes:
+- * Steve Whitehouse : Made keepalive timer part of the same
+- * timer idea.
+- * Steve Whitehouse : Added checks for sk->sock_readers
+- * David S. Miller : New socket locking
+- * Steve Whitehouse : Timer grabs socket ref.
+- */
+-#include <linux/net.h>
+-#include <linux/socket.h>
+-#include <linux/skbuff.h>
+-#include <linux/netdevice.h>
+-#include <linux/timer.h>
+-#include <linux/spinlock.h>
+-#include <net/sock.h>
+-#include <linux/atomic.h>
+-#include <linux/jiffies.h>
+-#include <net/flow.h>
+-#include <net/dn.h>
+-
+-/*
+- * Slow timer is for everything else (n * 500mS)
+- */
+-
+-#define SLOW_INTERVAL (HZ/2)
+-
+-static void dn_slow_timer(struct timer_list *t);
+-
+-void dn_start_slow_timer(struct sock *sk)
+-{
+- timer_setup(&sk->sk_timer, dn_slow_timer, 0);
+- sk_reset_timer(sk, &sk->sk_timer, jiffies + SLOW_INTERVAL);
+-}
+-
+-void dn_stop_slow_timer(struct sock *sk)
+-{
+- sk_stop_timer(sk, &sk->sk_timer);
+-}
+-
+-static void dn_slow_timer(struct timer_list *t)
+-{
+- struct sock *sk = from_timer(sk, t, sk_timer);
+- struct dn_scp *scp = DN_SK(sk);
+-
+- bh_lock_sock(sk);
+-
+- if (sock_owned_by_user(sk)) {
+- sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ / 10);
+- goto out;
+- }
+-
+- /*
+- * The persist timer is the standard slow timer used for retransmits
+- * in both connection establishment and disconnection as well as
+- * in the RUN state. The different states are catered for by changing
+- * the function pointer in the socket. Setting the timer to a value
+- * of zero turns it off. We allow the persist_fxn to turn the
+- * timer off in a permant way by returning non-zero, so that
+- * timer based routines may remove sockets. This is why we have a
+- * sock_hold()/sock_put() around the timer to prevent the socket
+- * going away in the middle.
+- */
+- if (scp->persist && scp->persist_fxn) {
+- if (scp->persist <= SLOW_INTERVAL) {
+- scp->persist = 0;
+-
+- if (scp->persist_fxn(sk))
+- goto out;
+- } else {
+- scp->persist -= SLOW_INTERVAL;
+- }
+- }
+-
+- /*
+- * Check for keepalive timeout. After the other timer 'cos if
+- * the previous timer caused a retransmit, we don't need to
+- * do this. scp->stamp is the last time that we sent a packet.
+- * The keepalive function sends a link service packet to the
+- * other end. If it remains unacknowledged, the standard
+- * socket timers will eventually shut the socket down. Each
+- * time we do this, scp->stamp will be updated, thus
+- * we won't try and send another until scp->keepalive has passed
+- * since the last successful transmission.
+- */
+- if (scp->keepalive && scp->keepalive_fxn && (scp->state == DN_RUN)) {
+- if (time_after_eq(jiffies, scp->stamp + scp->keepalive))
+- scp->keepalive_fxn(sk);
+- }
+-
+- sk_reset_timer(sk, &sk->sk_timer, jiffies + SLOW_INTERVAL);
+-out:
+- bh_unlock_sock(sk);
+- sock_put(sk);
+-}
+diff --git a/net/decnet/netfilter/Kconfig b/net/decnet/netfilter/Kconfig
+deleted file mode 100644
+index 8d7c109d5109d..0000000000000
+--- a/net/decnet/netfilter/Kconfig
++++ /dev/null
+@@ -1,16 +0,0 @@
+-#
+-# DECnet netfilter configuration
+-#
+-
+-menu "DECnet: Netfilter Configuration"
+- depends on DECNET && NETFILTER
+- depends on NETFILTER_ADVANCED
+-
+-config DECNET_NF_GRABULATOR
+- tristate "Routing message grabulator (for userland routing daemon)"
+- help
+- Enable this module if you want to use the userland DECnet routing
+- daemon. You will also need to enable routing support for DECnet
+- unless you just want to monitor routing messages from other nodes.
+-
+-endmenu
+diff --git a/net/decnet/netfilter/Makefile b/net/decnet/netfilter/Makefile
+deleted file mode 100644
+index b579e52130aa0..0000000000000
+--- a/net/decnet/netfilter/Makefile
++++ /dev/null
+@@ -1,5 +0,0 @@
+-#
+-# Makefile for DECnet netfilter modules
+-#
+-
+-obj-$(CONFIG_DECNET_NF_GRABULATOR) += dn_rtmsg.o
+diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
+deleted file mode 100644
+index a4faacadd8a83..0000000000000
+--- a/net/decnet/netfilter/dn_rtmsg.c
++++ /dev/null
+@@ -1,160 +0,0 @@
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet Routing Message Grabulator
+- *
+- * (C) 2000 ChyGwyn Limited - http://www.chygwyn.com/
+- * This code may be copied under the GPL v.2 or at your option
+- * any later version.
+- *
+- * Author: Steven Whitehouse <steve@chygwyn.com>
+- *
+- */
+-#include <linux/module.h>
+-#include <linux/skbuff.h>
+-#include <linux/slab.h>
+-#include <linux/init.h>
+-#include <linux/netdevice.h>
+-#include <linux/netfilter.h>
+-#include <linux/spinlock.h>
+-#include <net/netlink.h>
+-#include <linux/netfilter_decnet.h>
+-
+-#include <net/sock.h>
+-#include <net/flow.h>
+-#include <net/dn.h>
+-#include <net/dn_route.h>
+-
+-static struct sock *dnrmg = NULL;
+-
+-
+-static struct sk_buff *dnrmg_build_message(struct sk_buff *rt_skb, int *errp)
+-{
+- struct sk_buff *skb = NULL;
+- size_t size;
+- sk_buff_data_t old_tail;
+- struct nlmsghdr *nlh;
+- unsigned char *ptr;
+- struct nf_dn_rtmsg *rtm;
+-
+- size = NLMSG_ALIGN(rt_skb->len) +
+- NLMSG_ALIGN(sizeof(struct nf_dn_rtmsg));
+- skb = nlmsg_new(size, GFP_ATOMIC);
+- if (!skb) {
+- *errp = -ENOMEM;
+- return NULL;
+- }
+- old_tail = skb->tail;
+- nlh = nlmsg_put(skb, 0, 0, 0, size, 0);
+- if (!nlh) {
+- kfree_skb(skb);
+- *errp = -ENOMEM;
+- return NULL;
+- }
+- rtm = (struct nf_dn_rtmsg *)nlmsg_data(nlh);
+- rtm->nfdn_ifindex = rt_skb->dev->ifindex;
+- ptr = NFDN_RTMSG(rtm);
+- skb_copy_from_linear_data(rt_skb, ptr, rt_skb->len);
+- nlh->nlmsg_len = skb->tail - old_tail;
+- return skb;
+-}
+-
+-static void dnrmg_send_peer(struct sk_buff *skb)
+-{
+- struct sk_buff *skb2;
+- int status = 0;
+- int group = 0;
+- unsigned char flags = *skb->data;
+-
+- switch (flags & DN_RT_CNTL_MSK) {
+- case DN_RT_PKT_L1RT:
+- group = DNRNG_NLGRP_L1;
+- break;
+- case DN_RT_PKT_L2RT:
+- group = DNRNG_NLGRP_L2;
+- break;
+- default:
+- return;
+- }
+-
+- skb2 = dnrmg_build_message(skb, &status);
+- if (skb2 == NULL)
+- return;
+- NETLINK_CB(skb2).dst_group = group;
+- netlink_broadcast(dnrmg, skb2, 0, group, GFP_ATOMIC);
+-}
+-
+-
+-static unsigned int dnrmg_hook(void *priv,
+- struct sk_buff *skb,
+- const struct nf_hook_state *state)
+-{
+- dnrmg_send_peer(skb);
+- return NF_ACCEPT;
+-}
+-
+-
+-#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err), NULL); return; } while (0)
+-
+-static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
+-{
+- struct nlmsghdr *nlh = nlmsg_hdr(skb);
+-
+- if (skb->len < sizeof(*nlh) ||
+- nlh->nlmsg_len < sizeof(*nlh) ||
+- skb->len < nlh->nlmsg_len)
+- return;
+-
+- if (!netlink_capable(skb, CAP_NET_ADMIN))
+- RCV_SKB_FAIL(-EPERM);
+-
+- /* Eventually we might send routing messages too */
+-
+- RCV_SKB_FAIL(-EINVAL);
+-}
+-
+-static const struct nf_hook_ops dnrmg_ops = {
+- .hook = dnrmg_hook,
+- .pf = NFPROTO_DECNET,
+- .hooknum = NF_DN_ROUTE,
+- .priority = NF_DN_PRI_DNRTMSG,
+-};
+-
+-static int __init dn_rtmsg_init(void)
+-{
+- int rv = 0;
+- struct netlink_kernel_cfg cfg = {
+- .groups = DNRNG_NLGRP_MAX,
+- .input = dnrmg_receive_user_skb,
+- };
+-
+- dnrmg = netlink_kernel_create(&init_net, NETLINK_DNRTMSG, &cfg);
+- if (dnrmg == NULL) {
+- printk(KERN_ERR "dn_rtmsg: Cannot create netlink socket");
+- return -ENOMEM;
+- }
+-
+- rv = nf_register_net_hook(&init_net, &dnrmg_ops);
+- if (rv) {
+- netlink_kernel_release(dnrmg);
+- }
+-
+- return rv;
+-}
+-
+-static void __exit dn_rtmsg_fini(void)
+-{
+- nf_unregister_net_hook(&init_net, &dnrmg_ops);
+- netlink_kernel_release(dnrmg);
+-}
+-
+-
+-MODULE_DESCRIPTION("DECnet Routing Message Grabulator");
+-MODULE_AUTHOR("Steven Whitehouse <steve@chygwyn.com>");
+-MODULE_LICENSE("GPL");
+-MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_DNRTMSG);
+-
+-module_init(dn_rtmsg_init);
+-module_exit(dn_rtmsg_fini);
+diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
+deleted file mode 100644
+index 55bf64a22b593..0000000000000
+--- a/net/decnet/sysctl_net_decnet.c
++++ /dev/null
+@@ -1,373 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * DECnet An implementation of the DECnet protocol suite for the LINUX
+- * operating system. DECnet is implemented using the BSD Socket
+- * interface as the means of communication with the user level.
+- *
+- * DECnet sysctl support functions
+- *
+- * Author: Steve Whitehouse <SteveW@ACM.org>
+- *
+- *
+- * Changes:
+- * Steve Whitehouse - C99 changes and default device handling
+- * Steve Whitehouse - Memory buffer settings, like the tcp ones
+- *
+- */
+-#include <linux/mm.h>
+-#include <linux/sysctl.h>
+-#include <linux/fs.h>
+-#include <linux/netdevice.h>
+-#include <linux/string.h>
+-#include <net/neighbour.h>
+-#include <net/dst.h>
+-#include <net/flow.h>
+-
+-#include <linux/uaccess.h>
+-
+-#include <net/dn.h>
+-#include <net/dn_dev.h>
+-#include <net/dn_route.h>
+-
+-
+-int decnet_debug_level;
+-int decnet_time_wait = 30;
+-int decnet_dn_count = 1;
+-int decnet_di_count = 3;
+-int decnet_dr_count = 3;
+-int decnet_log_martians = 1;
+-int decnet_no_fc_max_cwnd = NSP_MIN_WINDOW;
+-
+-/* Reasonable defaults, I hope, based on tcp's defaults */
+-long sysctl_decnet_mem[3] = { 768 << 3, 1024 << 3, 1536 << 3 };
+-int sysctl_decnet_wmem[3] = { 4 * 1024, 16 * 1024, 128 * 1024 };
+-int sysctl_decnet_rmem[3] = { 4 * 1024, 87380, 87380 * 2 };
+-
+-#ifdef CONFIG_SYSCTL
+-extern int decnet_dst_gc_interval;
+-static int min_decnet_time_wait[] = { 5 };
+-static int max_decnet_time_wait[] = { 600 };
+-static int min_state_count[] = { 1 };
+-static int max_state_count[] = { NSP_MAXRXTSHIFT };
+-static int min_decnet_dst_gc_interval[] = { 1 };
+-static int max_decnet_dst_gc_interval[] = { 60 };
+-static int min_decnet_no_fc_max_cwnd[] = { NSP_MIN_WINDOW };
+-static int max_decnet_no_fc_max_cwnd[] = { NSP_MAX_WINDOW };
+-static char node_name[7] = "???";
+-
+-static struct ctl_table_header *dn_table_header = NULL;
+-
+-/*
+- * ctype.h :-)
+- */
+-#define ISNUM(x) (((x) >= '0') && ((x) <= '9'))
+-#define ISLOWER(x) (((x) >= 'a') && ((x) <= 'z'))
+-#define ISUPPER(x) (((x) >= 'A') && ((x) <= 'Z'))
+-#define ISALPHA(x) (ISLOWER(x) || ISUPPER(x))
+-#define INVALID_END_CHAR(x) (ISNUM(x) || ISALPHA(x))
+-
+-static void strip_it(char *str)
+-{
+- for(;;) {
+- switch (*str) {
+- case ' ':
+- case '\n':
+- case '\r':
+- case ':':
+- *str = 0;
+- /* Fallthrough */
+- case 0:
+- return;
+- }
+- str++;
+- }
+-}
+-
+-/*
+- * Simple routine to parse an ascii DECnet address
+- * into a network order address.
+- */
+-static int parse_addr(__le16 *addr, char *str)
+-{
+- __u16 area, node;
+-
+- while(*str && !ISNUM(*str)) str++;
+-
+- if (*str == 0)
+- return -1;
+-
+- area = (*str++ - '0');
+- if (ISNUM(*str)) {
+- area *= 10;
+- area += (*str++ - '0');
+- }
+-
+- if (*str++ != '.')
+- return -1;
+-
+- if (!ISNUM(*str))
+- return -1;
+-
+- node = *str++ - '0';
+- if (ISNUM(*str)) {
+- node *= 10;
+- node += (*str++ - '0');
+- }
+- if (ISNUM(*str)) {
+- node *= 10;
+- node += (*str++ - '0');
+- }
+- if (ISNUM(*str)) {
+- node *= 10;
+- node += (*str++ - '0');
+- }
+-
+- if ((node > 1023) || (area > 63))
+- return -1;
+-
+- if (INVALID_END_CHAR(*str))
+- return -1;
+-
+- *addr = cpu_to_le16((area << 10) | node);
+-
+- return 0;
+-}
+-
+-static int dn_node_address_handler(struct ctl_table *table, int write,
+- void __user *buffer,
+- size_t *lenp, loff_t *ppos)
+-{
+- char addr[DN_ASCBUF_LEN];
+- size_t len;
+- __le16 dnaddr;
+-
+- if (!*lenp || (*ppos && !write)) {
+- *lenp = 0;
+- return 0;
+- }
+-
+- if (write) {
+- len = (*lenp < DN_ASCBUF_LEN) ? *lenp : (DN_ASCBUF_LEN-1);
+-
+- if (copy_from_user(addr, buffer, len))
+- return -EFAULT;
+-
+- addr[len] = 0;
+- strip_it(addr);
+-
+- if (parse_addr(&dnaddr, addr))
+- return -EINVAL;
+-
+- dn_dev_devices_off();
+-
+- decnet_address = dnaddr;
+-
+- dn_dev_devices_on();
+-
+- *ppos += len;
+-
+- return 0;
+- }
+-
+- dn_addr2asc(le16_to_cpu(decnet_address), addr);
+- len = strlen(addr);
+- addr[len++] = '\n';
+-
+- if (len > *lenp) len = *lenp;
+-
+- if (copy_to_user(buffer, addr, len))
+- return -EFAULT;
+-
+- *lenp = len;
+- *ppos += len;
+-
+- return 0;
+-}
+-
+-static int dn_def_dev_handler(struct ctl_table *table, int write,
+- void __user *buffer,
+- size_t *lenp, loff_t *ppos)
+-{
+- size_t len;
+- struct net_device *dev;
+- char devname[17];
+-
+- if (!*lenp || (*ppos && !write)) {
+- *lenp = 0;
+- return 0;
+- }
+-
+- if (write) {
+- if (*lenp > 16)
+- return -E2BIG;
+-
+- if (copy_from_user(devname, buffer, *lenp))
+- return -EFAULT;
+-
+- devname[*lenp] = 0;
+- strip_it(devname);
+-
+- dev = dev_get_by_name(&init_net, devname);
+- if (dev == NULL)
+- return -ENODEV;
+-
+- if (dev->dn_ptr == NULL) {
+- dev_put(dev);
+- return -ENODEV;
+- }
+-
+- if (dn_dev_set_default(dev, 1)) {
+- dev_put(dev);
+- return -ENODEV;
+- }
+- *ppos += *lenp;
+-
+- return 0;
+- }
+-
+- dev = dn_dev_get_default();
+- if (dev == NULL) {
+- *lenp = 0;
+- return 0;
+- }
+-
+- strcpy(devname, dev->name);
+- dev_put(dev);
+- len = strlen(devname);
+- devname[len++] = '\n';
+-
+- if (len > *lenp) len = *lenp;
+-
+- if (copy_to_user(buffer, devname, len))
+- return -EFAULT;
+-
+- *lenp = len;
+- *ppos += len;
+-
+- return 0;
+-}
+-
+-static struct ctl_table dn_table[] = {
+- {
+- .procname = "node_address",
+- .maxlen = 7,
+- .mode = 0644,
+- .proc_handler = dn_node_address_handler,
+- },
+- {
+- .procname = "node_name",
+- .data = node_name,
+- .maxlen = 7,
+- .mode = 0644,
+- .proc_handler = proc_dostring,
+- },
+- {
+- .procname = "default_device",
+- .maxlen = 16,
+- .mode = 0644,
+- .proc_handler = dn_def_dev_handler,
+- },
+- {
+- .procname = "time_wait",
+- .data = &decnet_time_wait,
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &min_decnet_time_wait,
+- .extra2 = &max_decnet_time_wait
+- },
+- {
+- .procname = "dn_count",
+- .data = &decnet_dn_count,
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &min_state_count,
+- .extra2 = &max_state_count
+- },
+- {
+- .procname = "di_count",
+- .data = &decnet_di_count,
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &min_state_count,
+- .extra2 = &max_state_count
+- },
+- {
+- .procname = "dr_count",
+- .data = &decnet_dr_count,
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &min_state_count,
+- .extra2 = &max_state_count
+- },
+- {
+- .procname = "dst_gc_interval",
+- .data = &decnet_dst_gc_interval,
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &min_decnet_dst_gc_interval,
+- .extra2 = &max_decnet_dst_gc_interval
+- },
+- {
+- .procname = "no_fc_max_cwnd",
+- .data = &decnet_no_fc_max_cwnd,
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
+- .extra1 = &min_decnet_no_fc_max_cwnd,
+- .extra2 = &max_decnet_no_fc_max_cwnd
+- },
+- {
+- .procname = "decnet_mem",
+- .data = &sysctl_decnet_mem,
+- .maxlen = sizeof(sysctl_decnet_mem),
+- .mode = 0644,
+- .proc_handler = proc_doulongvec_minmax
+- },
+- {
+- .procname = "decnet_rmem",
+- .data = &sysctl_decnet_rmem,
+- .maxlen = sizeof(sysctl_decnet_rmem),
+- .mode = 0644,
+- .proc_handler = proc_dointvec,
+- },
+- {
+- .procname = "decnet_wmem",
+- .data = &sysctl_decnet_wmem,
+- .maxlen = sizeof(sysctl_decnet_wmem),
+- .mode = 0644,
+- .proc_handler = proc_dointvec,
+- },
+- {
+- .procname = "debug",
+- .data = &decnet_debug_level,
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec,
+- },
+- { }
+-};
+-
+-void dn_register_sysctl(void)
+-{
+- dn_table_header = register_net_sysctl(&init_net, "net/decnet", dn_table);
+-}
+-
+-void dn_unregister_sysctl(void)
+-{
+- unregister_net_sysctl_table(dn_table_header);
+-}
+-
+-#else /* CONFIG_SYSCTL */
+-void dn_unregister_sysctl(void)
+-{
+-}
+-void dn_register_sysctl(void)
+-{
+-}
+-
+-#endif
+diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
+index 5c9be8594483f..e065f49a4ae38 100644
+--- a/net/ipv6/ping.c
++++ b/net/ipv6/ping.c
+@@ -101,7 +101,8 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ addr_type = ipv6_addr_type(daddr);
+ if ((__ipv6_addr_needs_scope_id(addr_type) && !oif) ||
+ (addr_type & IPV6_ADDR_MAPPED) ||
+- (oif && sk->sk_bound_dev_if && oif != sk->sk_bound_dev_if))
++ (oif && sk->sk_bound_dev_if && oif != sk->sk_bound_dev_if &&
++ l3mdev_master_ifindex_by_index(sock_net(sk), oif) != sk->sk_bound_dev_if))
+ return -EINVAL;
+
+ /* TODO: use ip6_datagram_send_ctl to get options from cmsg */
+diff --git a/net/netfilter/core.c b/net/netfilter/core.c
+index 722d1b057f616..0c6540780cb4c 100644
+--- a/net/netfilter/core.c
++++ b/net/netfilter/core.c
+@@ -289,12 +289,6 @@ nf_hook_entry_head(struct net *net, int pf, unsigned int hooknum,
+ if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= hooknum))
+ return NULL;
+ return net->nf.hooks_ipv6 + hooknum;
+-#if IS_ENABLED(CONFIG_DECNET)
+- case NFPROTO_DECNET:
+- if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= hooknum))
+- return NULL;
+- return net->nf.hooks_decnet + hooknum;
+-#endif
+ default:
+ WARN_ON_ONCE(1);
+ return NULL;
+@@ -646,10 +640,6 @@ static int __net_init netfilter_net_init(struct net *net)
+ #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
+ __netfilter_net_init(net->nf.hooks_bridge, ARRAY_SIZE(net->nf.hooks_bridge));
+ #endif
+-#if IS_ENABLED(CONFIG_DECNET)
+- __netfilter_net_init(net->nf.hooks_decnet, ARRAY_SIZE(net->nf.hooks_decnet));
+-#endif
+-
+ #ifdef CONFIG_PROC_FS
+ net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
+ net->proc_net);
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index 39e369e18cb87..0267be2e9cfe8 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -452,7 +452,8 @@ ack:
+ * processed, this avoids that the same error is
+ * reported several times when replaying the batch.
+ */
+- if (nfnl_err_add(&err_list, nlh, err, &extack) < 0) {
++ if (err == -ENOMEM ||
++ nfnl_err_add(&err_list, nlh, err, &extack) < 0) {
+ /* We failed to enqueue an error, reset the
+ * list of errors and send OOM to userspace
+ * pointing to the batch header.
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 3d52431dea9bf..8298f27e8de0d 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -4392,7 +4392,7 @@ enum sctp_disposition sctp_sf_eat_auth(struct net *net,
+ SCTP_AUTH_NEW_KEY, GFP_ATOMIC);
+
+ if (!ev)
+- return -ENOMEM;
++ return SCTP_DISPOSITION_NOMEM;
+
+ sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
+ SCTP_ULPEVENT(ev));
+diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
+index 0f970259d0d5a..4353968bc5a5c 100644
+--- a/net/tipc/bearer.c
++++ b/net/tipc/bearer.c
+@@ -1128,7 +1128,7 @@ int tipc_nl_media_get(struct sk_buff *skb, struct genl_info *info)
+ struct tipc_nl_msg msg;
+ struct tipc_media *media;
+ struct sk_buff *rep;
+- struct nlattr *attrs[TIPC_NLA_BEARER_MAX + 1];
++ struct nlattr *attrs[TIPC_NLA_MEDIA_MAX + 1];
+
+ if (!info->attrs[TIPC_NLA_MEDIA])
+ return -EINVAL;
+@@ -1177,7 +1177,7 @@ int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+ int err;
+ char *name;
+ struct tipc_media *m;
+- struct nlattr *attrs[TIPC_NLA_BEARER_MAX + 1];
++ struct nlattr *attrs[TIPC_NLA_MEDIA_MAX + 1];
+
+ if (!info->attrs[TIPC_NLA_MEDIA])
+ return -EINVAL;
+diff --git a/tools/testing/selftests/ptp/testptp.c b/tools/testing/selftests/ptp/testptp.c
+index a5d8f0ab0da00..60f0f24cee30e 100644
+--- a/tools/testing/selftests/ptp/testptp.c
++++ b/tools/testing/selftests/ptp/testptp.c
+@@ -502,11 +502,11 @@ int main(int argc, char *argv[])
+ interval = t2 - t1;
+ offset = (t2 + t1) / 2 - tp;
+
+- printf("system time: %lld.%u\n",
++ printf("system time: %lld.%09u\n",
+ (pct+2*i)->sec, (pct+2*i)->nsec);
+- printf("phc time: %lld.%u\n",
++ printf("phc time: %lld.%09u\n",
+ (pct+2*i+1)->sec, (pct+2*i+1)->nsec);
+- printf("system time: %lld.%u\n",
++ printf("system time: %lld.%09u\n",
+ (pct+2*i+2)->sec, (pct+2*i+2)->nsec);
+ printf("system/phc clock time offset is %" PRId64 " ns\n"
+ "system clock time delay is %" PRId64 " ns\n",
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-06-28 10:29 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-06-28 10:29 UTC (permalink / raw
To: gentoo-commits
commit: c9bcd80ed661f00249bf33aecd1eda50e84500de
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jun 28 10:29:09 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jun 28 10:29:09 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c9bcd80e
Linux patch 4.19.288
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1287_linux-4.19.288.patch | 1689 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1693 insertions(+)
diff --git a/0000_README b/0000_README
index 4b3f829e..47d5babb 100644
--- a/0000_README
+++ b/0000_README
@@ -1191,6 +1191,10 @@ Patch: 1286_linux-4.19.287.patch
From: https://www.kernel.org
Desc: Linux 4.19.287
+Patch: 1287_linux-4.19.288.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.288
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1287_linux-4.19.288.patch b/1287_linux-4.19.288.patch
new file mode 100644
index 00000000..7b0d397f
--- /dev/null
+++ b/1287_linux-4.19.288.patch
@@ -0,0 +1,1689 @@
+diff --git a/Makefile b/Makefile
+index 756d6e997cd23..0293da44bdcd2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 287
++SUBLEVEL = 288
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
+index e90cf51b87eca..22266c7e2cc1e 100644
+--- a/arch/arm64/include/asm/sysreg.h
++++ b/arch/arm64/include/asm/sysreg.h
+@@ -98,8 +98,14 @@
+ (!!x)<<8 | 0x1f)
+
+ #define SYS_DC_ISW sys_insn(1, 0, 7, 6, 2)
++#define SYS_DC_IGSW sys_insn(1, 0, 7, 6, 4)
++#define SYS_DC_IGDSW sys_insn(1, 0, 7, 6, 6)
+ #define SYS_DC_CSW sys_insn(1, 0, 7, 10, 2)
++#define SYS_DC_CGSW sys_insn(1, 0, 7, 10, 4)
++#define SYS_DC_CGDSW sys_insn(1, 0, 7, 10, 6)
+ #define SYS_DC_CISW sys_insn(1, 0, 7, 14, 2)
++#define SYS_DC_CIGSW sys_insn(1, 0, 7, 14, 4)
++#define SYS_DC_CIGDSW sys_insn(1, 0, 7, 14, 6)
+
+ #define SYS_OSDTRRX_EL1 sys_reg(2, 0, 0, 0, 2)
+ #define SYS_MDCCINT_EL1 sys_reg(2, 0, 0, 2, 0)
+diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
+index 8e70c2ba21b3d..fb17767552ef4 100644
+--- a/arch/x86/kernel/apic/x2apic_phys.c
++++ b/arch/x86/kernel/apic/x2apic_phys.c
+@@ -102,7 +102,10 @@ static void init_x2apic_ldr(void)
+
+ static int x2apic_phys_probe(void)
+ {
+- if (x2apic_mode && (x2apic_phys || x2apic_fadt_phys()))
++ if (!x2apic_mode)
++ return 0;
++
++ if (x2apic_phys || x2apic_fadt_phys())
+ return 1;
+
+ return apic == &apic_x2apic_phys;
+diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
+index 002f7a01af11f..00f104e341e57 100644
+--- a/arch/x86/purgatory/Makefile
++++ b/arch/x86/purgatory/Makefile
+@@ -12,6 +12,11 @@ $(obj)/string.o: $(srctree)/arch/x86/boot/compressed/string.c FORCE
+ $(obj)/sha256.o: $(srctree)/lib/sha256.c FORCE
+ $(call if_changed_rule,cc_o_c)
+
++# When profile-guided optimization is enabled, llvm emits two different
++# overlapping text sections, which is not supported by kexec. Remove profile
++# optimization flags.
++KBUILD_CFLAGS := $(filter-out -fprofile-sample-use=% -fprofile-use=%,$(KBUILD_CFLAGS))
++
+ LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined -nostdlib -z nodefaultlib
+ targets += purgatory.ro
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 31cfa47d24984..988d0e37f87fd 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -541,15 +541,20 @@ struct ipmi_smi {
+ atomic_t event_waiters;
+ unsigned int ticks_to_req_ev;
+
++ spinlock_t watch_lock; /* For dealing with watch stuff below. */
++
+ /* How many users are waiting for commands? */
+- atomic_t command_waiters;
++ unsigned int command_waiters;
+
+ /* How many users are waiting for watchdogs? */
+- atomic_t watchdog_waiters;
++ unsigned int watchdog_waiters;
++
++ /* How many users are waiting for message responses? */
++ unsigned int response_waiters;
+
+ /*
+ * Tells what the lower layer has last been asked to watch for,
+- * messages and/or watchdogs. Protected by xmit_msgs_lock.
++ * messages and/or watchdogs. Protected by watch_lock.
+ */
+ unsigned int last_watch_mask;
+
+@@ -945,6 +950,64 @@ static void deliver_err_response(struct ipmi_smi *intf,
+ deliver_local_response(intf, msg);
+ }
+
++static void smi_add_watch(struct ipmi_smi *intf, unsigned int flags)
++{
++ unsigned long iflags;
++
++ if (!intf->handlers->set_need_watch)
++ return;
++
++ spin_lock_irqsave(&intf->watch_lock, iflags);
++ if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES)
++ intf->response_waiters++;
++
++ if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG)
++ intf->watchdog_waiters++;
++
++ if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS)
++ intf->command_waiters++;
++
++ if ((intf->last_watch_mask & flags) != flags) {
++ intf->last_watch_mask |= flags;
++ intf->handlers->set_need_watch(intf->send_info,
++ intf->last_watch_mask);
++ }
++ spin_unlock_irqrestore(&intf->watch_lock, iflags);
++}
++
++static void smi_remove_watch(struct ipmi_smi *intf, unsigned int flags)
++{
++ unsigned long iflags;
++
++ if (!intf->handlers->set_need_watch)
++ return;
++
++ spin_lock_irqsave(&intf->watch_lock, iflags);
++ if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES)
++ intf->response_waiters--;
++
++ if (flags & IPMI_WATCH_MASK_CHECK_WATCHDOG)
++ intf->watchdog_waiters--;
++
++ if (flags & IPMI_WATCH_MASK_CHECK_COMMANDS)
++ intf->command_waiters--;
++
++ flags = 0;
++ if (intf->response_waiters)
++ flags |= IPMI_WATCH_MASK_CHECK_MESSAGES;
++ if (intf->watchdog_waiters)
++ flags |= IPMI_WATCH_MASK_CHECK_WATCHDOG;
++ if (intf->command_waiters)
++ flags |= IPMI_WATCH_MASK_CHECK_COMMANDS;
++
++ if (intf->last_watch_mask != flags) {
++ intf->last_watch_mask = flags;
++ intf->handlers->set_need_watch(intf->send_info,
++ intf->last_watch_mask);
++ }
++ spin_unlock_irqrestore(&intf->watch_lock, iflags);
++}
++
+ /*
+ * Find the next sequence number not being used and add the given
+ * message with the given timeout to the sequence table. This must be
+@@ -988,6 +1051,7 @@ static int intf_next_seq(struct ipmi_smi *intf,
+ *seq = i;
+ *seqid = intf->seq_table[i].seqid;
+ intf->curr_seq = (i+1)%IPMI_IPMB_NUM_SEQ;
++ smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
+ need_waiter(intf);
+ } else {
+ rv = -EAGAIN;
+@@ -1026,6 +1090,7 @@ static int intf_find_seq(struct ipmi_smi *intf,
+ && (ipmi_addr_equal(addr, &msg->addr))) {
+ *recv_msg = msg;
+ intf->seq_table[seq].inuse = 0;
++ smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
+ rv = 0;
+ }
+ }
+@@ -1087,6 +1152,7 @@ static int intf_err_seq(struct ipmi_smi *intf,
+ struct seq_table *ent = &intf->seq_table[seq];
+
+ ent->inuse = 0;
++ smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
+ msg = ent->recv_msg;
+ rv = 0;
+ }
+@@ -1098,30 +1164,6 @@ static int intf_err_seq(struct ipmi_smi *intf,
+ return rv;
+ }
+
+-/* Must be called with xmit_msgs_lock held. */
+-static void smi_tell_to_watch(struct ipmi_smi *intf,
+- unsigned int flags,
+- struct ipmi_smi_msg *smi_msg)
+-{
+- if (flags & IPMI_WATCH_MASK_CHECK_MESSAGES) {
+- if (!smi_msg)
+- return;
+-
+- if (!smi_msg->needs_response)
+- return;
+- }
+-
+- if (!intf->handlers->set_need_watch)
+- return;
+-
+- if ((intf->last_watch_mask & flags) == flags)
+- return;
+-
+- intf->last_watch_mask |= flags;
+- intf->handlers->set_need_watch(intf->send_info,
+- intf->last_watch_mask);
+-}
+-
+ static void free_user_work(struct work_struct *work)
+ {
+ struct ipmi_user *user = container_of(work, struct ipmi_user,
+@@ -1198,12 +1240,9 @@ int ipmi_create_user(unsigned int if_num,
+ spin_lock_irqsave(&intf->seq_lock, flags);
+ list_add_rcu(&new_user->link, &intf->users);
+ spin_unlock_irqrestore(&intf->seq_lock, flags);
+- if (handler->ipmi_watchdog_pretimeout) {
++ if (handler->ipmi_watchdog_pretimeout)
+ /* User wants pretimeouts, so make sure to watch for them. */
+- if (atomic_inc_return(&intf->watchdog_waiters) == 1)
+- smi_tell_to_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG,
+- NULL);
+- }
++ smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG);
+ srcu_read_unlock(&ipmi_interfaces_srcu, index);
+ *user = new_user;
+ return 0;
+@@ -1276,7 +1315,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
+ user->handler->shutdown(user->handler_data);
+
+ if (user->handler->ipmi_watchdog_pretimeout)
+- atomic_dec(&intf->watchdog_waiters);
++ smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_WATCHDOG);
+
+ if (user->gets_events)
+ atomic_dec(&intf->event_waiters);
+@@ -1289,6 +1328,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
+ if (intf->seq_table[i].inuse
+ && (intf->seq_table[i].recv_msg->user == user)) {
+ intf->seq_table[i].inuse = 0;
++ smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
+ ipmi_free_recv_msg(intf->seq_table[i].recv_msg);
+ }
+ }
+@@ -1634,8 +1674,7 @@ int ipmi_register_for_cmd(struct ipmi_user *user,
+ goto out_unlock;
+ }
+
+- if (atomic_inc_return(&intf->command_waiters) == 1)
+- smi_tell_to_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS, NULL);
++ smi_add_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS);
+
+ list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
+
+@@ -1685,7 +1724,7 @@ int ipmi_unregister_for_cmd(struct ipmi_user *user,
+ synchronize_rcu();
+ release_ipmi_user(user, index);
+ while (rcvrs) {
+- atomic_dec(&intf->command_waiters);
++ smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_COMMANDS);
+ rcvr = rcvrs;
+ rcvrs = rcvr->next;
+ kfree(rcvr);
+@@ -1813,8 +1852,6 @@ static void smi_send(struct ipmi_smi *intf,
+ spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
+ smi_msg = smi_add_send_msg(intf, smi_msg, priority);
+
+- smi_tell_to_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES, smi_msg);
+-
+ if (!run_to_completion)
+ spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
+
+@@ -2014,9 +2051,6 @@ static int i_ipmi_req_ipmb(struct ipmi_smi *intf,
+ ipmb_seq, broadcast,
+ source_address, source_lun);
+
+- /* We will be getting a response in the BMC message queue. */
+- smi_msg->needs_response = true;
+-
+ /*
+ * Copy the message into the recv message data, so we
+ * can retransmit it later if necessary.
+@@ -2204,7 +2238,6 @@ static int i_ipmi_request(struct ipmi_user *user,
+ goto out;
+ }
+ }
+- smi_msg->needs_response = false;
+
+ rcu_read_lock();
+ if (intf->in_shutdown) {
+@@ -3425,9 +3458,8 @@ int ipmi_add_smi(struct module *owner,
+ INIT_LIST_HEAD(&intf->xmit_msgs);
+ INIT_LIST_HEAD(&intf->hp_xmit_msgs);
+ spin_lock_init(&intf->events_lock);
++ spin_lock_init(&intf->watch_lock);
+ atomic_set(&intf->event_waiters, 0);
+- atomic_set(&intf->watchdog_waiters, 0);
+- atomic_set(&intf->command_waiters, 0);
+ intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
+ INIT_LIST_HEAD(&intf->waiting_events);
+ intf->waiting_events_count = 0;
+@@ -4207,7 +4239,53 @@ static int handle_one_recv_msg(struct ipmi_smi *intf,
+ int chan;
+
+ ipmi_debug_msg("Recv:", msg->rsp, msg->rsp_size);
+- if (msg->rsp_size < 2) {
++
++ if ((msg->data_size >= 2)
++ && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
++ && (msg->data[1] == IPMI_SEND_MSG_CMD)
++ && (msg->user_data == NULL)) {
++
++ if (intf->in_shutdown)
++ goto free_msg;
++
++ /*
++ * This is the local response to a command send, start
++ * the timer for these. The user_data will not be
++ * NULL if this is a response send, and we will let
++ * response sends just go through.
++ */
++
++ /*
++ * Check for errors, if we get certain errors (ones
++ * that mean basically we can try again later), we
++ * ignore them and start the timer. Otherwise we
++ * report the error immediately.
++ */
++ if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
++ && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
++ && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
++ && (msg->rsp[2] != IPMI_BUS_ERR)
++ && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
++ int ch = msg->rsp[3] & 0xf;
++ struct ipmi_channel *chans;
++
++ /* Got an error sending the message, handle it. */
++
++ chans = READ_ONCE(intf->channel_list)->c;
++ if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN)
++ || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC))
++ ipmi_inc_stat(intf, sent_lan_command_errs);
++ else
++ ipmi_inc_stat(intf, sent_ipmb_command_errs);
++ intf_err_seq(intf, msg->msgid, msg->rsp[2]);
++ } else
++ /* The message was sent, start the timer. */
++ intf_start_seq_timer(intf, msg->msgid);
++free_msg:
++ requeue = 0;
++ goto out;
++
++ } else if (msg->rsp_size < 2) {
+ /* Message is too small to be correct. */
+ dev_warn(intf->si_dev,
+ PFX "BMC returned to small a message for netfn %x cmd %x, got %d bytes\n",
+@@ -4447,8 +4525,6 @@ static void smi_recv_tasklet(unsigned long val)
+ }
+ }
+
+- smi_tell_to_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES, newmsg);
+-
+ if (!run_to_completion)
+ spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
+ if (newmsg)
+@@ -4466,62 +4542,16 @@ void ipmi_smi_msg_received(struct ipmi_smi *intf,
+ unsigned long flags = 0; /* keep us warning-free. */
+ int run_to_completion = intf->run_to_completion;
+
+- if ((msg->data_size >= 2)
+- && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
+- && (msg->data[1] == IPMI_SEND_MSG_CMD)
+- && (msg->user_data == NULL)) {
+-
+- if (intf->in_shutdown)
+- goto free_msg;
+-
+- /*
+- * This is the local response to a command send, start
+- * the timer for these. The user_data will not be
+- * NULL if this is a response send, and we will let
+- * response sends just go through.
+- */
+-
+- /*
+- * Check for errors, if we get certain errors (ones
+- * that mean basically we can try again later), we
+- * ignore them and start the timer. Otherwise we
+- * report the error immediately.
+- */
+- if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
+- && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
+- && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
+- && (msg->rsp[2] != IPMI_BUS_ERR)
+- && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
+- int ch = msg->rsp[3] & 0xf;
+- struct ipmi_channel *chans;
+-
+- /* Got an error sending the message, handle it. */
+-
+- chans = READ_ONCE(intf->channel_list)->c;
+- if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN)
+- || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC))
+- ipmi_inc_stat(intf, sent_lan_command_errs);
+- else
+- ipmi_inc_stat(intf, sent_ipmb_command_errs);
+- intf_err_seq(intf, msg->msgid, msg->rsp[2]);
+- } else
+- /* The message was sent, start the timer. */
+- intf_start_seq_timer(intf, msg->msgid);
+-
+-free_msg:
+- ipmi_free_smi_msg(msg);
+- } else {
+- /*
+- * To preserve message order, we keep a queue and deliver from
+- * a tasklet.
+- */
+- if (!run_to_completion)
+- spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
+- list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
+- if (!run_to_completion)
+- spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
+- flags);
+- }
++ /*
++ * To preserve message order, we keep a queue and deliver from
++ * a tasklet.
++ */
++ if (!run_to_completion)
++ spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
++ list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
++ if (!run_to_completion)
++ spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
++ flags);
+
+ if (!run_to_completion)
+ spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
+@@ -4576,7 +4606,7 @@ static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent,
+ struct list_head *timeouts,
+ unsigned long timeout_period,
+ int slot, unsigned long *flags,
+- unsigned int *watch_mask)
++ bool *need_timer)
+ {
+ struct ipmi_recv_msg *msg;
+
+@@ -4588,13 +4618,14 @@ static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent,
+
+ if (timeout_period < ent->timeout) {
+ ent->timeout -= timeout_period;
+- *watch_mask |= IPMI_WATCH_MASK_CHECK_MESSAGES;
++ *need_timer = true;
+ return;
+ }
+
+ if (ent->retries_left == 0) {
+ /* The message has used all its retries. */
+ ent->inuse = 0;
++ smi_remove_watch(intf, IPMI_WATCH_MASK_CHECK_MESSAGES);
+ msg = ent->recv_msg;
+ list_add_tail(&msg->link, timeouts);
+ if (ent->broadcast)
+@@ -4607,7 +4638,7 @@ static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent,
+ struct ipmi_smi_msg *smi_msg;
+ /* More retries, send again. */
+
+- *watch_mask |= IPMI_WATCH_MASK_CHECK_MESSAGES;
++ *need_timer = true;
+
+ /*
+ * Start with the max timer, set to normal timer after
+@@ -4652,20 +4683,20 @@ static void check_msg_timeout(struct ipmi_smi *intf, struct seq_table *ent,
+ }
+ }
+
+-static unsigned int ipmi_timeout_handler(struct ipmi_smi *intf,
+- unsigned long timeout_period)
++static bool ipmi_timeout_handler(struct ipmi_smi *intf,
++ unsigned long timeout_period)
+ {
+ struct list_head timeouts;
+ struct ipmi_recv_msg *msg, *msg2;
+ unsigned long flags;
+ int i;
+- unsigned int watch_mask = 0;
++ bool need_timer = false;
+
+ if (!intf->bmc_registered) {
+ kref_get(&intf->refcount);
+ if (!schedule_work(&intf->bmc_reg_work)) {
+ kref_put(&intf->refcount, intf_free);
+- watch_mask |= IPMI_WATCH_MASK_INTERNAL;
++ need_timer = true;
+ }
+ }
+
+@@ -4685,7 +4716,7 @@ static unsigned int ipmi_timeout_handler(struct ipmi_smi *intf,
+ for (i = 0; i < IPMI_IPMB_NUM_SEQ; i++)
+ check_msg_timeout(intf, &intf->seq_table[i],
+ &timeouts, timeout_period, i,
+- &flags, &watch_mask);
++ &flags, &need_timer);
+ spin_unlock_irqrestore(&intf->seq_lock, flags);
+
+ list_for_each_entry_safe(msg, msg2, &timeouts, link)
+@@ -4716,7 +4747,7 @@ static unsigned int ipmi_timeout_handler(struct ipmi_smi *intf,
+
+ tasklet_schedule(&intf->recv_tasklet);
+
+- return watch_mask;
++ return need_timer;
+ }
+
+ static void ipmi_request_event(struct ipmi_smi *intf)
+@@ -4736,9 +4767,8 @@ static atomic_t stop_operation;
+ static void ipmi_timeout(struct timer_list *unused)
+ {
+ struct ipmi_smi *intf;
+- unsigned int watch_mask = 0;
++ bool need_timer = false;
+ int index;
+- unsigned long flags;
+
+ if (atomic_read(&stop_operation))
+ return;
+@@ -4751,28 +4781,14 @@ static void ipmi_timeout(struct timer_list *unused)
+ ipmi_request_event(intf);
+ intf->ticks_to_req_ev = IPMI_REQUEST_EV_TIME;
+ }
+- watch_mask |= IPMI_WATCH_MASK_INTERNAL;
++ need_timer = true;
+ }
+
+- if (atomic_read(&intf->watchdog_waiters))
+- watch_mask |= IPMI_WATCH_MASK_CHECK_WATCHDOG;
+-
+- if (atomic_read(&intf->command_waiters))
+- watch_mask |= IPMI_WATCH_MASK_CHECK_COMMANDS;
+-
+- watch_mask |= ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
+-
+- spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
+- if (watch_mask != intf->last_watch_mask &&
+- intf->handlers->set_need_watch)
+- intf->handlers->set_need_watch(intf->send_info,
+- watch_mask);
+- intf->last_watch_mask = watch_mask;
+- spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
++ need_timer |= ipmi_timeout_handler(intf, IPMI_TIMEOUT_TIME);
+ }
+ srcu_read_unlock(&ipmi_interfaces_srcu, index);
+
+- if (watch_mask)
++ if (need_timer)
+ mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
+ }
+
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index 429fe063e33ff..8c7a1b8f96896 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -1079,7 +1079,7 @@ static void set_need_watch(void *send_info, unsigned int watch_mask)
+ unsigned long flags;
+ int enable;
+
+- enable = !!(watch_mask & ~IPMI_WATCH_MASK_INTERNAL);
++ enable = !!watch_mask;
+
+ atomic_set(&smi_info->need_watch, enable);
+ spin_lock_irqsave(&smi_info->si_lock, flags);
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 34c5b287c4125..fc4a96014161b 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -1159,7 +1159,7 @@ static void ssif_set_need_watch(void *send_info, unsigned int watch_mask)
+
+ if (watch_mask & IPMI_WATCH_MASK_CHECK_MESSAGES)
+ timeout = SSIF_WATCH_MSG_TIMEOUT;
+- else if (watch_mask & ~IPMI_WATCH_MASK_INTERNAL)
++ else if (watch_mask)
+ timeout = SSIF_WATCH_WATCHDOG_TIMEOUT;
+
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+index f2481a2014bb3..2b7ecc02b2774 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+@@ -1327,7 +1327,7 @@ int exynos_g2d_exec_ioctl(struct drm_device *drm_dev, void *data,
+ /* Let the runqueue know that there is work to do. */
+ queue_work(g2d->g2d_workq, &g2d->runqueue_work);
+
+- if (runqueue_node->async)
++ if (req->async)
+ goto out;
+
+ wait_for_completion(&runqueue_node->complete);
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+index 19697c1362d8f..947c9627c565a 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+@@ -480,8 +480,6 @@ static int vidi_remove(struct platform_device *pdev)
+ if (ctx->raw_edid != (struct edid *)fake_edid_info) {
+ kfree(ctx->raw_edid);
+ ctx->raw_edid = NULL;
+-
+- return -EINVAL;
+ }
+
+ component_del(&pdev->dev, &vidi_component_ops);
+diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
+index 27d8e7dd2d067..46f7789693ea0 100644
+--- a/drivers/gpu/drm/radeon/radeon_gem.c
++++ b/drivers/gpu/drm/radeon/radeon_gem.c
+@@ -377,7 +377,6 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data,
+ struct radeon_device *rdev = dev->dev_private;
+ struct drm_radeon_gem_set_domain *args = data;
+ struct drm_gem_object *gobj;
+- struct radeon_bo *robj;
+ int r;
+
+ /* for now if someone requests domain CPU -
+@@ -390,13 +389,12 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data,
+ up_read(&rdev->exclusive_lock);
+ return -ENOENT;
+ }
+- robj = gem_to_radeon_bo(gobj);
+
+ r = radeon_gem_set_domain(gobj, args->read_domains, args->write_domain);
+
+ drm_gem_object_put_unlocked(gobj);
+ up_read(&rdev->exclusive_lock);
+- r = radeon_gem_handle_lockup(robj->rdev, r);
++ r = radeon_gem_handle_lockup(rdev, r);
+ return r;
+ }
+
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 4e4a3424c1f9f..c50b26a9bc445 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -2390,8 +2390,13 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
+ goto fail_quirks;
+ }
+
+- if (features->device_type & WACOM_DEVICETYPE_WL_MONITOR)
++ if (features->device_type & WACOM_DEVICETYPE_WL_MONITOR) {
+ error = hid_hw_open(hdev);
++ if (error) {
++ hid_err(hdev, "hw open failed\n");
++ goto fail_quirks;
++ }
++ }
+
+ wacom_set_shared_values(wacom_wac);
+ devres_close_group(&hdev->dev, wacom);
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index ccfa5ceb43c0c..f79346de7f889 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -813,11 +813,22 @@ static void vmbus_wait_for_unload(void)
+ if (completion_done(&vmbus_connection.unload_event))
+ goto completed;
+
+- for_each_online_cpu(cpu) {
++ for_each_present_cpu(cpu) {
+ struct hv_per_cpu_context *hv_cpu
+ = per_cpu_ptr(hv_context.cpu_context, cpu);
+
++ /*
++ * In a CoCo VM the synic_message_page is not allocated
++ * in hv_synic_alloc(). Instead it is set/cleared in
++ * hv_synic_enable_regs() and hv_synic_disable_regs()
++ * such that it is set only when the CPU is online. If
++ * not all present CPUs are online, the message page
++ * might be NULL, so skip such CPUs.
++ */
+ page_addr = hv_cpu->synic_message_page;
++ if (!page_addr)
++ continue;
++
+ msg = (struct hv_message *)page_addr
+ + VMBUS_MESSAGE_SINT;
+
+@@ -851,11 +862,14 @@ completed:
+ * maybe-pending messages on all CPUs to be able to receive new
+ * messages after we reconnect.
+ */
+- for_each_online_cpu(cpu) {
++ for_each_present_cpu(cpu) {
+ struct hv_per_cpu_context *hv_cpu
+ = per_cpu_ptr(hv_context.cpu_context, cpu);
+
+ page_addr = hv_cpu->synic_message_page;
++ if (!page_addr)
++ continue;
++
+ msg = (struct hv_message *)page_addr + VMBUS_MESSAGE_SINT;
+ msg->header.message_type = HVMSG_NONE;
+ }
+diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
+index f494b27497005..a4f90796032b3 100644
+--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
+@@ -206,8 +206,8 @@ static void lpi2c_imx_stop(struct lpi2c_imx_struct *lpi2c_imx)
+ /* CLKLO = I2C_CLK_RATIO * CLKHI, SETHOLD = CLKHI, DATAVD = CLKHI/2 */
+ static int lpi2c_imx_config(struct lpi2c_imx_struct *lpi2c_imx)
+ {
+- u8 prescale, filt, sethold, clkhi, clklo, datavd;
+- unsigned int clk_rate, clk_cycle;
++ u8 prescale, filt, sethold, datavd;
++ unsigned int clk_rate, clk_cycle, clkhi, clklo;
+ enum lpi2c_imx_pincfg pincfg;
+ unsigned int temp;
+
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index a42043379d676..2f49c4db49b35 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -1032,7 +1032,8 @@ void cec_received_msg_ts(struct cec_adapter *adap,
+ mutex_lock(&adap->lock);
+ dprintk(2, "%s: %*ph\n", __func__, msg->len, msg->msg);
+
+- adap->last_initiator = 0xff;
++ if (!adap->transmit_in_progress)
++ adap->last_initiator = 0xff;
+
+ /* Check if this message was for us (directed or broadcast). */
+ if (!cec_msg_is_broadcast(msg))
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index 967e47770af67..d42c5da1a2260 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -1912,7 +1912,7 @@ static int msdc_drv_probe(struct platform_device *pdev)
+
+ host->irq = platform_get_irq(pdev, 0);
+ if (host->irq < 0) {
+- ret = -EINVAL;
++ ret = host->irq;
+ goto host_free;
+ }
+
+diff --git a/drivers/mmc/host/mvsdio.c b/drivers/mmc/host/mvsdio.c
+index e22bbff89c8d2..fff9980a3ef28 100644
+--- a/drivers/mmc/host/mvsdio.c
++++ b/drivers/mmc/host/mvsdio.c
+@@ -699,17 +699,15 @@ static int mvsd_probe(struct platform_device *pdev)
+ struct mmc_host *mmc = NULL;
+ struct mvsd_host *host = NULL;
+ const struct mbus_dram_target_info *dram;
+- struct resource *r;
+ int ret, irq;
+
+ if (!np) {
+ dev_err(&pdev->dev, "no DT node\n");
+ return -ENODEV;
+ }
+- r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ irq = platform_get_irq(pdev, 0);
+- if (!r || irq < 0)
+- return -ENXIO;
++ if (irq < 0)
++ return irq;
+
+ mmc = mmc_alloc_host(sizeof(struct mvsd_host), &pdev->dev);
+ if (!mmc) {
+@@ -761,7 +759,7 @@ static int mvsd_probe(struct platform_device *pdev)
+
+ spin_lock_init(&host->lock);
+
+- host->base = devm_ioremap_resource(&pdev->dev, r);
++ host->base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(host->base)) {
+ ret = PTR_ERR(host->base);
+ goto out;
+diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
+index b2873a2432b69..345b35483cee7 100644
+--- a/drivers/mmc/host/omap.c
++++ b/drivers/mmc/host/omap.c
+@@ -1347,7 +1347,7 @@ static int mmc_omap_probe(struct platform_device *pdev)
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0)
+- return -ENXIO;
++ return irq;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ host->virt_base = devm_ioremap_resource(&pdev->dev, res);
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 0135693afa158..881d1de4a5635 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -2006,9 +2006,11 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- irq = platform_get_irq(pdev, 0);
+- if (res == NULL || irq < 0)
++ if (!res)
+ return -ENXIO;
++ irq = platform_get_irq(pdev, 0);
++ if (irq < 0)
++ return irq;
+
+ base = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(base))
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index 6cc187ce3a329..069b9a07aca5d 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -721,7 +721,7 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
+ host->ops = &sdhci_acpi_ops_dflt;
+ host->irq = platform_get_irq(pdev, 0);
+ if (host->irq < 0) {
+- err = -EINVAL;
++ err = host->irq;
+ goto err_free;
+ }
+
+diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c
+index b88728b686e8a..e436f7e7a3ee0 100644
+--- a/drivers/mmc/host/usdhi6rol0.c
++++ b/drivers/mmc/host/usdhi6rol0.c
+@@ -1749,8 +1749,10 @@ static int usdhi6_probe(struct platform_device *pdev)
+ irq_cd = platform_get_irq_byname(pdev, "card detect");
+ irq_sd = platform_get_irq_byname(pdev, "data");
+ irq_sdio = platform_get_irq_byname(pdev, "SDIO");
+- if (irq_sd < 0 || irq_sdio < 0)
+- return -ENODEV;
++ if (irq_sd < 0)
++ return irq_sd;
++ if (irq_sdio < 0)
++ return irq_sdio;
+
+ mmc = mmc_alloc_host(sizeof(struct usdhi6_host), dev);
+ if (!mmc)
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index 05cb2f7cc35c3..8603df2ae1736 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -1136,8 +1136,8 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter,
+ eth_hdr_len = ntohs(skb->protocol) == ETH_P_8021Q ?
+ VLAN_ETH_HLEN : ETH_HLEN;
+ if (skb->len <= 60 &&
+- (lancer_chip(adapter) || skb_vlan_tag_present(skb)) &&
+- is_ipv4_pkt(skb)) {
++ (lancer_chip(adapter) || BE3_chip(adapter) ||
++ skb_vlan_tag_present(skb)) && is_ipv4_pkt(skb)) {
+ ip = (struct iphdr *)ip_hdr(skb);
+ pskb_trim(skb, eth_hdr_len + ntohs(ip->tot_len));
+ }
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index afd49c7fd87fe..3e6095f0cb5f5 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -553,8 +553,7 @@ qcaspi_spi_thread(void *data)
+ while (!kthread_should_stop()) {
+ set_current_state(TASK_INTERRUPTIBLE);
+ if ((qca->intr_req == qca->intr_svc) &&
+- (qca->txr.skb[qca->txr.head] == NULL) &&
+- (qca->sync == QCASPI_SYNC_READY))
++ !qca->txr.skb[qca->txr.head])
+ schedule();
+
+ set_current_state(TASK_RUNNING);
+diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
+index d07e5571e07ae..1ac600d186886 100644
+--- a/drivers/net/ieee802154/mac802154_hwsim.c
++++ b/drivers/net/ieee802154/mac802154_hwsim.c
+@@ -540,7 +540,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info)
+ static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info)
+ {
+ struct nlattr *edge_attrs[MAC802154_HWSIM_EDGE_ATTR_MAX + 1];
+- struct hwsim_edge_info *einfo;
++ struct hwsim_edge_info *einfo, *einfo_old;
+ struct hwsim_phy *phy_v0;
+ struct hwsim_edge *e;
+ u32 v0, v1;
+@@ -580,8 +580,10 @@ static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info)
+ list_for_each_entry_rcu(e, &phy_v0->edges, list) {
+ if (e->endpoint->idx == v1) {
+ einfo->lqi = lqi;
+- rcu_assign_pointer(e->info, einfo);
++ einfo_old = rcu_replace_pointer(e->info, einfo,
++ lockdep_is_held(&hwsim_phys_lock));
+ rcu_read_unlock();
++ kfree_rcu(einfo_old, rcu);
+ mutex_unlock(&hwsim_phys_lock);
+ return 0;
+ }
+diff --git a/drivers/nfc/nfcsim.c b/drivers/nfc/nfcsim.c
+index 533e3aa6275cd..cf07b366500e9 100644
+--- a/drivers/nfc/nfcsim.c
++++ b/drivers/nfc/nfcsim.c
+@@ -345,10 +345,6 @@ static struct dentry *nfcsim_debugfs_root;
+ static void nfcsim_debugfs_init(void)
+ {
+ nfcsim_debugfs_root = debugfs_create_dir("nfcsim", NULL);
+-
+- if (!nfcsim_debugfs_root)
+- pr_err("Could not create debugfs entry\n");
+-
+ }
+
+ static void nfcsim_debugfs_remove(void)
+diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
+index 63c79e140f1a8..f5f201bfc814d 100644
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -2445,6 +2445,24 @@ static int hv_pci_query_relations(struct hv_device *hdev)
+ if (!ret)
+ ret = wait_for_response(hdev, &comp);
+
++ /*
++ * In the case of fast device addition/removal, it's possible that
++ * vmbus_sendpacket() or wait_for_response() returns -ENODEV but we
++ * already got a PCI_BUS_RELATIONS* message from the host and the
++ * channel callback already scheduled a work to hbus->wq, which can be
++ * running pci_devices_present_work() -> survey_child_resources() ->
++ * complete(&hbus->survey_event), even after hv_pci_query_relations()
++ * exits and the stack variable 'comp' is no longer valid; as a result,
++ * a hang or a page fault may happen when the complete() calls
++ * raw_spin_lock_irqsave(). Flush hbus->wq before we exit from
++ * hv_pci_query_relations() to avoid the issues. Note: if 'ret' is
++ * -ENODEV, there can't be any more work item scheduled to hbus->wq
++ * after the flush_workqueue(): see vmbus_onoffer_rescind() ->
++ * vmbus_reset_channel_cb(), vmbus_rescind_cleanup() ->
++ * channel->rescind = true.
++ */
++ flush_workqueue(hbus->wq);
++
+ return ret;
+ }
+
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index c9bc9a6bd73b7..ee4338158ae2e 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -1353,6 +1353,7 @@ void ccw_device_set_notoper(struct ccw_device *cdev)
+ enum io_sch_action {
+ IO_SCH_UNREG,
+ IO_SCH_ORPH_UNREG,
++ IO_SCH_UNREG_CDEV,
+ IO_SCH_ATTACH,
+ IO_SCH_UNREG_ATTACH,
+ IO_SCH_ORPH_ATTACH,
+@@ -1385,7 +1386,7 @@ static enum io_sch_action sch_get_action(struct subchannel *sch)
+ }
+ if ((sch->schib.pmcw.pam & sch->opm) == 0) {
+ if (ccw_device_notify(cdev, CIO_NO_PATH) != NOTIFY_OK)
+- return IO_SCH_UNREG;
++ return IO_SCH_UNREG_CDEV;
+ return IO_SCH_DISC;
+ }
+ if (device_is_disconnected(cdev))
+@@ -1447,6 +1448,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
+ case IO_SCH_ORPH_ATTACH:
+ ccw_device_set_disconnected(cdev);
+ break;
++ case IO_SCH_UNREG_CDEV:
+ case IO_SCH_UNREG_ATTACH:
+ case IO_SCH_UNREG:
+ if (!cdev)
+@@ -1480,6 +1482,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
+ if (rc)
+ goto out;
+ break;
++ case IO_SCH_UNREG_CDEV:
+ case IO_SCH_UNREG_ATTACH:
+ spin_lock_irqsave(sch->lock, flags);
+ if (cdev->private->flags.resuming) {
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index 5db8842a80265..e39177f9fdb0a 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -1072,6 +1072,7 @@ int iscsi_target_locate_portal(
+ iscsi_target_set_sock_callbacks(conn);
+
+ login->np = np;
++ conn->tpg = NULL;
+
+ login_req = (struct iscsi_login_req *) login->req;
+ payload_length = ntoh24(login_req->dlength);
+@@ -1141,7 +1142,6 @@ int iscsi_target_locate_portal(
+ */
+ sessiontype = strncmp(s_buf, DISCOVERY, 9);
+ if (!sessiontype) {
+- conn->tpg = iscsit_global->discovery_tpg;
+ if (!login->leading_connection)
+ goto get_target;
+
+@@ -1158,9 +1158,11 @@ int iscsi_target_locate_portal(
+ * Serialize access across the discovery struct iscsi_portal_group to
+ * process login attempt.
+ */
++ conn->tpg = iscsit_global->discovery_tpg;
+ if (iscsit_access_np(np, conn->tpg) < 0) {
+ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
+ ISCSI_LOGIN_STATUS_SVC_UNAVAILABLE);
++ conn->tpg = NULL;
+ ret = -1;
+ goto out;
+ }
+diff --git a/drivers/tty/serial/lantiq.c b/drivers/tty/serial/lantiq.c
+index 044128277248b..6cd168cb673fd 100644
+--- a/drivers/tty/serial/lantiq.c
++++ b/drivers/tty/serial/lantiq.c
+@@ -113,6 +113,13 @@ struct ltq_uart_port {
+ unsigned int err_irq;
+ };
+
++static inline void asc_update_bits(u32 clear, u32 set, void __iomem *reg)
++{
++ u32 tmp = __raw_readl(reg);
++
++ __raw_writel((tmp & ~clear) | set, reg);
++}
++
+ static inline struct
+ ltq_uart_port *to_ltq_uart_port(struct uart_port *port)
+ {
+@@ -138,7 +145,7 @@ lqasc_start_tx(struct uart_port *port)
+ static void
+ lqasc_stop_rx(struct uart_port *port)
+ {
+- ltq_w32(ASCWHBSTATE_CLRREN, port->membase + LTQ_ASC_WHBSTATE);
++ __raw_writel(ASCWHBSTATE_CLRREN, port->membase + LTQ_ASC_WHBSTATE);
+ }
+
+ static int
+@@ -147,11 +154,12 @@ lqasc_rx_chars(struct uart_port *port)
+ struct tty_port *tport = &port->state->port;
+ unsigned int ch = 0, rsr = 0, fifocnt;
+
+- fifocnt = ltq_r32(port->membase + LTQ_ASC_FSTAT) & ASCFSTAT_RXFFLMASK;
++ fifocnt = __raw_readl(port->membase + LTQ_ASC_FSTAT) &
++ ASCFSTAT_RXFFLMASK;
+ while (fifocnt--) {
+ u8 flag = TTY_NORMAL;
+- ch = ltq_r8(port->membase + LTQ_ASC_RBUF);
+- rsr = (ltq_r32(port->membase + LTQ_ASC_STATE)
++ ch = readb(port->membase + LTQ_ASC_RBUF);
++ rsr = (__raw_readl(port->membase + LTQ_ASC_STATE)
+ & ASCSTATE_ANY) | UART_DUMMY_UER_RX;
+ tty_flip_buffer_push(tport);
+ port->icount.rx++;
+@@ -163,16 +171,16 @@ lqasc_rx_chars(struct uart_port *port)
+ if (rsr & ASCSTATE_ANY) {
+ if (rsr & ASCSTATE_PE) {
+ port->icount.parity++;
+- ltq_w32_mask(0, ASCWHBSTATE_CLRPE,
++ asc_update_bits(0, ASCWHBSTATE_CLRPE,
+ port->membase + LTQ_ASC_WHBSTATE);
+ } else if (rsr & ASCSTATE_FE) {
+ port->icount.frame++;
+- ltq_w32_mask(0, ASCWHBSTATE_CLRFE,
++ asc_update_bits(0, ASCWHBSTATE_CLRFE,
+ port->membase + LTQ_ASC_WHBSTATE);
+ }
+ if (rsr & ASCSTATE_ROE) {
+ port->icount.overrun++;
+- ltq_w32_mask(0, ASCWHBSTATE_CLRROE,
++ asc_update_bits(0, ASCWHBSTATE_CLRROE,
+ port->membase + LTQ_ASC_WHBSTATE);
+ }
+
+@@ -211,10 +219,10 @@ lqasc_tx_chars(struct uart_port *port)
+ return;
+ }
+
+- while (((ltq_r32(port->membase + LTQ_ASC_FSTAT) &
++ while (((__raw_readl(port->membase + LTQ_ASC_FSTAT) &
+ ASCFSTAT_TXFREEMASK) >> ASCFSTAT_TXFREEOFF) != 0) {
+ if (port->x_char) {
+- ltq_w8(port->x_char, port->membase + LTQ_ASC_TBUF);
++ writeb(port->x_char, port->membase + LTQ_ASC_TBUF);
+ port->icount.tx++;
+ port->x_char = 0;
+ continue;
+@@ -223,7 +231,7 @@ lqasc_tx_chars(struct uart_port *port)
+ if (uart_circ_empty(xmit))
+ break;
+
+- ltq_w8(port->state->xmit.buf[port->state->xmit.tail],
++ writeb(port->state->xmit.buf[port->state->xmit.tail],
+ port->membase + LTQ_ASC_TBUF);
+ xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
+ port->icount.tx++;
+@@ -239,7 +247,7 @@ lqasc_tx_int(int irq, void *_port)
+ unsigned long flags;
+ struct uart_port *port = (struct uart_port *)_port;
+ spin_lock_irqsave(<q_asc_lock, flags);
+- ltq_w32(ASC_IRNCR_TIR, port->membase + LTQ_ASC_IRNCR);
++ __raw_writel(ASC_IRNCR_TIR, port->membase + LTQ_ASC_IRNCR);
+ spin_unlock_irqrestore(<q_asc_lock, flags);
+ lqasc_start_tx(port);
+ return IRQ_HANDLED;
+@@ -251,8 +259,9 @@ lqasc_err_int(int irq, void *_port)
+ unsigned long flags;
+ struct uart_port *port = (struct uart_port *)_port;
+ spin_lock_irqsave(<q_asc_lock, flags);
++ __raw_writel(ASC_IRNCR_EIR, port->membase + LTQ_ASC_IRNCR);
+ /* clear any pending interrupts */
+- ltq_w32_mask(0, ASCWHBSTATE_CLRPE | ASCWHBSTATE_CLRFE |
++ asc_update_bits(0, ASCWHBSTATE_CLRPE | ASCWHBSTATE_CLRFE |
+ ASCWHBSTATE_CLRROE, port->membase + LTQ_ASC_WHBSTATE);
+ spin_unlock_irqrestore(<q_asc_lock, flags);
+ return IRQ_HANDLED;
+@@ -264,7 +273,7 @@ lqasc_rx_int(int irq, void *_port)
+ unsigned long flags;
+ struct uart_port *port = (struct uart_port *)_port;
+ spin_lock_irqsave(<q_asc_lock, flags);
+- ltq_w32(ASC_IRNCR_RIR, port->membase + LTQ_ASC_IRNCR);
++ __raw_writel(ASC_IRNCR_RIR, port->membase + LTQ_ASC_IRNCR);
+ lqasc_rx_chars(port);
+ spin_unlock_irqrestore(<q_asc_lock, flags);
+ return IRQ_HANDLED;
+@@ -274,7 +283,8 @@ static unsigned int
+ lqasc_tx_empty(struct uart_port *port)
+ {
+ int status;
+- status = ltq_r32(port->membase + LTQ_ASC_FSTAT) & ASCFSTAT_TXFFLMASK;
++ status = __raw_readl(port->membase + LTQ_ASC_FSTAT) &
++ ASCFSTAT_TXFFLMASK;
+ return status ? 0 : TIOCSER_TEMT;
+ }
+
+@@ -304,15 +314,15 @@ lqasc_startup(struct uart_port *port)
+ clk_enable(ltq_port->clk);
+ port->uartclk = clk_get_rate(ltq_port->fpiclk);
+
+- ltq_w32_mask(ASCCLC_DISS | ASCCLC_RMCMASK, (1 << ASCCLC_RMCOFFSET),
++ asc_update_bits(ASCCLC_DISS | ASCCLC_RMCMASK, (1 << ASCCLC_RMCOFFSET),
+ port->membase + LTQ_ASC_CLC);
+
+- ltq_w32(0, port->membase + LTQ_ASC_PISEL);
+- ltq_w32(
++ __raw_writel(0, port->membase + LTQ_ASC_PISEL);
++ __raw_writel(
+ ((TXFIFO_FL << ASCTXFCON_TXFITLOFF) & ASCTXFCON_TXFITLMASK) |
+ ASCTXFCON_TXFEN | ASCTXFCON_TXFFLU,
+ port->membase + LTQ_ASC_TXFCON);
+- ltq_w32(
++ __raw_writel(
+ ((RXFIFO_FL << ASCRXFCON_RXFITLOFF) & ASCRXFCON_RXFITLMASK)
+ | ASCRXFCON_RXFEN | ASCRXFCON_RXFFLU,
+ port->membase + LTQ_ASC_RXFCON);
+@@ -320,7 +330,7 @@ lqasc_startup(struct uart_port *port)
+ * setting enable bits
+ */
+ wmb();
+- ltq_w32_mask(0, ASCCON_M_8ASYNC | ASCCON_FEN | ASCCON_TOEN |
++ asc_update_bits(0, ASCCON_M_8ASYNC | ASCCON_FEN | ASCCON_TOEN |
+ ASCCON_ROEN, port->membase + LTQ_ASC_CON);
+
+ retval = request_irq(ltq_port->tx_irq, lqasc_tx_int,
+@@ -344,7 +354,7 @@ lqasc_startup(struct uart_port *port)
+ goto err2;
+ }
+
+- ltq_w32(ASC_IRNREN_RX | ASC_IRNREN_ERR | ASC_IRNREN_TX,
++ __raw_writel(ASC_IRNREN_RX | ASC_IRNREN_ERR | ASC_IRNREN_TX,
+ port->membase + LTQ_ASC_IRNREN);
+ return 0;
+
+@@ -363,10 +373,10 @@ lqasc_shutdown(struct uart_port *port)
+ free_irq(ltq_port->rx_irq, port);
+ free_irq(ltq_port->err_irq, port);
+
+- ltq_w32(0, port->membase + LTQ_ASC_CON);
+- ltq_w32_mask(ASCRXFCON_RXFEN, ASCRXFCON_RXFFLU,
++ __raw_writel(0, port->membase + LTQ_ASC_CON);
++ asc_update_bits(ASCRXFCON_RXFEN, ASCRXFCON_RXFFLU,
+ port->membase + LTQ_ASC_RXFCON);
+- ltq_w32_mask(ASCTXFCON_TXFEN, ASCTXFCON_TXFFLU,
++ asc_update_bits(ASCTXFCON_TXFEN, ASCTXFCON_TXFFLU,
+ port->membase + LTQ_ASC_TXFCON);
+ if (!IS_ERR(ltq_port->clk))
+ clk_disable(ltq_port->clk);
+@@ -438,7 +448,7 @@ lqasc_set_termios(struct uart_port *port,
+ spin_lock_irqsave(<q_asc_lock, flags);
+
+ /* set up CON */
+- ltq_w32_mask(0, con, port->membase + LTQ_ASC_CON);
++ asc_update_bits(0, con, port->membase + LTQ_ASC_CON);
+
+ /* Set baud rate - take a divider of 2 into account */
+ baud = uart_get_baud_rate(port, new, old, 0, port->uartclk / 16);
+@@ -446,22 +456,22 @@ lqasc_set_termios(struct uart_port *port,
+ divisor = divisor / 2 - 1;
+
+ /* disable the baudrate generator */
+- ltq_w32_mask(ASCCON_R, 0, port->membase + LTQ_ASC_CON);
++ asc_update_bits(ASCCON_R, 0, port->membase + LTQ_ASC_CON);
+
+ /* make sure the fractional divider is off */
+- ltq_w32_mask(ASCCON_FDE, 0, port->membase + LTQ_ASC_CON);
++ asc_update_bits(ASCCON_FDE, 0, port->membase + LTQ_ASC_CON);
+
+ /* set up to use divisor of 2 */
+- ltq_w32_mask(ASCCON_BRS, 0, port->membase + LTQ_ASC_CON);
++ asc_update_bits(ASCCON_BRS, 0, port->membase + LTQ_ASC_CON);
+
+ /* now we can write the new baudrate into the register */
+- ltq_w32(divisor, port->membase + LTQ_ASC_BG);
++ __raw_writel(divisor, port->membase + LTQ_ASC_BG);
+
+ /* turn the baudrate generator back on */
+- ltq_w32_mask(0, ASCCON_R, port->membase + LTQ_ASC_CON);
++ asc_update_bits(0, ASCCON_R, port->membase + LTQ_ASC_CON);
+
+ /* enable rx */
+- ltq_w32(ASCWHBSTATE_SETREN, port->membase + LTQ_ASC_WHBSTATE);
++ __raw_writel(ASCWHBSTATE_SETREN, port->membase + LTQ_ASC_WHBSTATE);
+
+ spin_unlock_irqrestore(<q_asc_lock, flags);
+
+@@ -572,10 +582,10 @@ lqasc_console_putchar(struct uart_port *port, int ch)
+ return;
+
+ do {
+- fifofree = (ltq_r32(port->membase + LTQ_ASC_FSTAT)
++ fifofree = (__raw_readl(port->membase + LTQ_ASC_FSTAT)
+ & ASCFSTAT_TXFREEMASK) >> ASCFSTAT_TXFREEOFF;
+ } while (fifofree == 0);
+- ltq_w8(ch, port->membase + LTQ_ASC_TBUF);
++ writeb(ch, port->membase + LTQ_ASC_TBUF);
+ }
+
+ static void lqasc_serial_port_write(struct uart_port *port, const char *s,
+diff --git a/drivers/usb/gadget/udc/amd5536udc_pci.c b/drivers/usb/gadget/udc/amd5536udc_pci.c
+index 362284057d307..a3d15c3fb82a9 100644
+--- a/drivers/usb/gadget/udc/amd5536udc_pci.c
++++ b/drivers/usb/gadget/udc/amd5536udc_pci.c
+@@ -171,6 +171,9 @@ static int udc_pci_probe(
+ retval = -ENODEV;
+ goto err_probe;
+ }
++
++ udc = dev;
++
+ return 0;
+
+ err_probe:
+diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
+index c726b42ca92d1..e5fee7fac9154 100644
+--- a/fs/nilfs2/page.c
++++ b/fs/nilfs2/page.c
+@@ -372,7 +372,15 @@ void nilfs_clear_dirty_pages(struct address_space *mapping, bool silent)
+ struct page *page = pvec.pages[i];
+
+ lock_page(page);
+- nilfs_clear_dirty_page(page, silent);
++
++ /*
++ * This page may have been removed from the address
++ * space by truncation or invalidation when the lock
++ * was acquired. Skip processing in that case.
++ */
++ if (likely(page->mapping == mapping))
++ nilfs_clear_dirty_page(page, silent);
++
+ unlock_page(page);
+ }
+ pagevec_release(&pvec);
+diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
+index 20c479b5e41b8..e72466fc8ca93 100644
+--- a/fs/nilfs2/segbuf.c
++++ b/fs/nilfs2/segbuf.c
+@@ -101,6 +101,12 @@ int nilfs_segbuf_extend_segsum(struct nilfs_segment_buffer *segbuf)
+ if (unlikely(!bh))
+ return -ENOMEM;
+
++ lock_buffer(bh);
++ if (!buffer_uptodate(bh)) {
++ memset(bh->b_data, 0, bh->b_size);
++ set_buffer_uptodate(bh);
++ }
++ unlock_buffer(bh);
+ nilfs_segbuf_add_segsum_buffer(segbuf, bh);
+ return 0;
+ }
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 3091d1a3eddea..d9e0b2b2b5552 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -984,10 +984,13 @@ static void nilfs_segctor_fill_in_super_root(struct nilfs_sc_info *sci,
+ unsigned int isz, srsz;
+
+ bh_sr = NILFS_LAST_SEGBUF(&sci->sc_segbufs)->sb_super_root;
++
++ lock_buffer(bh_sr);
+ raw_sr = (struct nilfs_super_root *)bh_sr->b_data;
+ isz = nilfs->ns_inode_size;
+ srsz = NILFS_SR_BYTES(isz);
+
++ raw_sr->sr_sum = 0; /* Ensure initialization within this update */
+ raw_sr->sr_bytes = cpu_to_le16(srsz);
+ raw_sr->sr_nongc_ctime
+ = cpu_to_le64(nilfs_doing_gc() ?
+@@ -1001,6 +1004,8 @@ static void nilfs_segctor_fill_in_super_root(struct nilfs_sc_info *sci,
+ nilfs_write_inode_common(nilfs->ns_sufile, (void *)raw_sr +
+ NILFS_SR_SUFILE_OFFSET(isz), 1);
+ memset((void *)raw_sr + srsz, 0, nilfs->ns_blocksize - srsz);
++ set_buffer_uptodate(bh_sr);
++ unlock_buffer(bh_sr);
+ }
+
+ static void nilfs_redirty_inodes(struct list_head *head)
+@@ -1778,6 +1783,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
+ list_for_each_entry(segbuf, logs, sb_list) {
+ list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
+ b_assoc_buffers) {
++ clear_buffer_uptodate(bh);
+ if (bh->b_page != bd_page) {
+ if (bd_page)
+ end_page_writeback(bd_page);
+@@ -1789,6 +1795,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
+ b_assoc_buffers) {
+ clear_buffer_async_write(bh);
+ if (bh == segbuf->sb_super_root) {
++ clear_buffer_uptodate(bh);
+ if (bh->b_page != bd_page) {
+ end_page_writeback(bd_page);
+ bd_page = bh->b_page;
+diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
+index 221a54faab526..99bcb4ab47a61 100644
+--- a/fs/nilfs2/super.c
++++ b/fs/nilfs2/super.c
+@@ -374,10 +374,31 @@ static int nilfs_move_2nd_super(struct super_block *sb, loff_t sb2off)
+ goto out;
+ }
+ nsbp = (void *)nsbh->b_data + offset;
+- memset(nsbp, 0, nilfs->ns_blocksize);
+
++ lock_buffer(nsbh);
+ if (sb2i >= 0) {
++ /*
++ * The position of the second superblock only changes by 4KiB,
++ * which is larger than the maximum superblock data size
++ * (= 1KiB), so there is no need to use memmove() to allow
++ * overlap between source and destination.
++ */
+ memcpy(nsbp, nilfs->ns_sbp[sb2i], nilfs->ns_sbsize);
++
++ /*
++ * Zero fill after copy to avoid overwriting in case of move
++ * within the same block.
++ */
++ memset(nsbh->b_data, 0, offset);
++ memset((void *)nsbp + nilfs->ns_sbsize, 0,
++ nsbh->b_size - offset - nilfs->ns_sbsize);
++ } else {
++ memset(nsbh->b_data, 0, nsbh->b_size);
++ }
++ set_buffer_uptodate(nsbh);
++ unlock_buffer(nsbh);
++
++ if (sb2i >= 0) {
+ brelse(nilfs->ns_sbh[sb2i]);
+ nilfs->ns_sbh[sb2i] = nsbh;
+ nilfs->ns_sbp[sb2i] = nsbp;
+diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
+index 24f626e7d012a..d550a564645e2 100644
+--- a/fs/nilfs2/the_nilfs.c
++++ b/fs/nilfs2/the_nilfs.c
+@@ -375,6 +375,18 @@ unsigned long nilfs_nrsvsegs(struct the_nilfs *nilfs, unsigned long nsegs)
+ 100));
+ }
+
++/**
++ * nilfs_max_segment_count - calculate the maximum number of segments
++ * @nilfs: nilfs object
++ */
++static u64 nilfs_max_segment_count(struct the_nilfs *nilfs)
++{
++ u64 max_count = U64_MAX;
++
++ do_div(max_count, nilfs->ns_blocks_per_segment);
++ return min_t(u64, max_count, ULONG_MAX);
++}
++
+ void nilfs_set_nsegments(struct the_nilfs *nilfs, unsigned long nsegs)
+ {
+ nilfs->ns_nsegments = nsegs;
+@@ -384,6 +396,8 @@ void nilfs_set_nsegments(struct the_nilfs *nilfs, unsigned long nsegs)
+ static int nilfs_store_disk_layout(struct the_nilfs *nilfs,
+ struct nilfs_super_block *sbp)
+ {
++ u64 nsegments, nblocks;
++
+ if (le32_to_cpu(sbp->s_rev_level) < NILFS_MIN_SUPP_REV) {
+ nilfs_msg(nilfs->ns_sb, KERN_ERR,
+ "unsupported revision (superblock rev.=%d.%d, current rev.=%d.%d). Please check the version of mkfs.nilfs(2).",
+@@ -430,7 +444,35 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs,
+ return -EINVAL;
+ }
+
+- nilfs_set_nsegments(nilfs, le64_to_cpu(sbp->s_nsegments));
++ nsegments = le64_to_cpu(sbp->s_nsegments);
++ if (nsegments > nilfs_max_segment_count(nilfs)) {
++ nilfs_msg(nilfs->ns_sb, KERN_ERR,
++ "segment count %llu exceeds upper limit (%llu segments)",
++ (unsigned long long)nsegments,
++ (unsigned long long)nilfs_max_segment_count(nilfs));
++ return -EINVAL;
++ }
++
++ nblocks = (u64)i_size_read(nilfs->ns_sb->s_bdev->bd_inode) >>
++ nilfs->ns_sb->s_blocksize_bits;
++ if (nblocks) {
++ u64 min_block_count = nsegments * nilfs->ns_blocks_per_segment;
++ /*
++ * To avoid failing to mount early device images without a
++ * second superblock, exclude that block count from the
++ * "min_block_count" calculation.
++ */
++
++ if (nblocks < min_block_count) {
++ nilfs_msg(nilfs->ns_sb, KERN_ERR,
++ "total number of segment blocks %llu exceeds device size (%llu blocks)",
++ (unsigned long long)min_block_count,
++ (unsigned long long)nblocks);
++ return -EINVAL;
++ }
++ }
++
++ nilfs_set_nsegments(nilfs, nsegments);
+ nilfs->ns_crc_seed = le32_to_cpu(sbp->s_crc_seed);
+ return 0;
+ }
+diff --git a/include/linux/ipmi_smi.h b/include/linux/ipmi_smi.h
+index 86b119400f301..75865064c70b2 100644
+--- a/include/linux/ipmi_smi.h
++++ b/include/linux/ipmi_smi.h
+@@ -32,14 +32,11 @@ typedef struct ipmi_smi *ipmi_smi_t;
+
+ /*
+ * Flags for set_check_watch() below. Tells if the SMI should be
+- * waiting for watchdog timeouts, commands and/or messages. There is
+- * also an internal flag for the message handler, SMIs should ignore
+- * it.
++ * waiting for watchdog timeouts, commands and/or messages.
+ */
+-#define IPMI_WATCH_MASK_INTERNAL (1 << 0)
+-#define IPMI_WATCH_MASK_CHECK_MESSAGES (1 << 1)
+-#define IPMI_WATCH_MASK_CHECK_WATCHDOG (1 << 2)
+-#define IPMI_WATCH_MASK_CHECK_COMMANDS (1 << 3)
++#define IPMI_WATCH_MASK_CHECK_MESSAGES (1 << 0)
++#define IPMI_WATCH_MASK_CHECK_WATCHDOG (1 << 1)
++#define IPMI_WATCH_MASK_CHECK_COMMANDS (1 << 2)
+
+ /*
+ * Messages to/from the lower layer. The smi interface will take one
+@@ -66,12 +63,6 @@ struct ipmi_smi_msg {
+ int rsp_size;
+ unsigned char rsp[IPMI_MAX_MSG_LENGTH];
+
+- /*
+- * There should be a response message coming back in the BMC
+- * message queue.
+- */
+- bool needs_response;
+-
+ /*
+ * Will be called when the system is done with the message
+ * (presumably to free it).
+diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
+index 68cbe111420bc..cf139d6e5c1d3 100644
+--- a/include/linux/rcupdate.h
++++ b/include/linux/rcupdate.h
+@@ -410,6 +410,24 @@ static inline void rcu_preempt_sleep_check(void) { }
+ _r_a_p__v; \
+ })
+
++/**
++ * rcu_replace_pointer() - replace an RCU pointer, returning its old value
++ * @rcu_ptr: RCU pointer, whose old value is returned
++ * @ptr: regular pointer
++ * @c: the lockdep conditions under which the dereference will take place
++ *
++ * Perform a replacement, where @rcu_ptr is an RCU-annotated
++ * pointer and @c is the lockdep argument that is passed to the
++ * rcu_dereference_protected() call used to read that pointer. The old
++ * value of @rcu_ptr is returned, and @rcu_ptr is set to @ptr.
++ */
++#define rcu_replace_pointer(rcu_ptr, ptr, c) \
++({ \
++ typeof(ptr) __tmp = rcu_dereference_protected((rcu_ptr), (c)); \
++ rcu_assign_pointer((rcu_ptr), (ptr)); \
++ __tmp; \
++})
++
+ /**
+ * rcu_swap_protected() - swap an RCU and a regular pointer
+ * @rcu_ptr: RCU pointer
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index a8185cdb8587b..6322b56529e91 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -1652,7 +1652,7 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
+ {
+ struct cgroup *dcgrp = &dst_root->cgrp;
+ struct cgroup_subsys *ss;
+- int ssid, i, ret;
++ int ssid, ret;
+ u16 dfl_disable_ss_mask = 0;
+
+ lockdep_assert_held(&cgroup_mutex);
+@@ -1696,7 +1696,8 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
+ struct cgroup_root *src_root = ss->root;
+ struct cgroup *scgrp = &src_root->cgrp;
+ struct cgroup_subsys_state *css = cgroup_css(scgrp, ss);
+- struct css_set *cset;
++ struct css_set *cset, *cset_pos;
++ struct css_task_iter *it;
+
+ WARN_ON(!css || cgroup_css(dcgrp, ss));
+
+@@ -1714,9 +1715,22 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
+ css->cgroup = dcgrp;
+
+ spin_lock_irq(&css_set_lock);
+- hash_for_each(css_set_table, i, cset, hlist)
++ WARN_ON(!list_empty(&dcgrp->e_csets[ss->id]));
++ list_for_each_entry_safe(cset, cset_pos, &scgrp->e_csets[ss->id],
++ e_cset_node[ss->id]) {
+ list_move_tail(&cset->e_cset_node[ss->id],
+ &dcgrp->e_csets[ss->id]);
++ /*
++ * all css_sets of scgrp together in same order to dcgrp,
++ * patch in-flight iterators to preserve correct iteration.
++ * since the iterator is always advanced right away and
++ * finished when it->cset_pos meets it->cset_head, so only
++ * update it->cset_head is enough here.
++ */
++ list_for_each_entry(it, &cset->task_iters, iters_node)
++ if (it->cset_head == &scgrp->e_csets[ss->id])
++ it->cset_head = &dcgrp->e_csets[ss->id];
++ }
+ spin_unlock_irq(&css_set_lock);
+
+ /* default hierarchy doesn't enable controllers by default */
+diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
+index 58834a10c0be7..93045373e44bd 100644
+--- a/net/ipv4/esp4_offload.c
++++ b/net/ipv4/esp4_offload.c
+@@ -237,6 +237,9 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_
+
+ secpath_reset(skb);
+
++ if (skb_needs_linearize(skb, skb->dev->features) &&
++ __skb_linearize(skb))
++ return -ENOMEM;
+ return 0;
+ }
+
+diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
+index eeee64a8a72c2..69313ec24264e 100644
+--- a/net/ipv6/esp6_offload.c
++++ b/net/ipv6/esp6_offload.c
+@@ -272,6 +272,9 @@ static int esp6_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features
+
+ secpath_reset(skb);
+
++ if (skb_needs_linearize(skb, skb->dev->features) &&
++ __skb_linearize(skb))
++ return -ENOMEM;
+ return 0;
+ }
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 62bc4cd0b7bec..2968f21915ddf 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4640,7 +4640,8 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
+ if (IS_ERR(set))
+ return PTR_ERR(set);
+
+- if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
++ if (!list_empty(&set->bindings) &&
++ (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS)))
+ return -EBUSY;
+
+ nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
+@@ -4823,7 +4824,9 @@ static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
+ set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
+ if (IS_ERR(set))
+ return PTR_ERR(set);
+- if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
++
++ if (!list_empty(&set->bindings) &&
++ (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS)))
+ return -EBUSY;
+
+ if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
+diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
+index 917f06110c823..21e4554c76955 100644
+--- a/net/netfilter/nfnetlink_osf.c
++++ b/net/netfilter/nfnetlink_osf.c
+@@ -442,3 +442,4 @@ module_init(nfnl_osf_init);
+ module_exit(nfnl_osf_fini);
+
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_OSF);
+diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
+index bf7bba80e24c1..226a317d52a0d 100644
+--- a/net/netfilter/xt_osf.c
++++ b/net/netfilter/xt_osf.c
+@@ -90,4 +90,3 @@ MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
+ MODULE_DESCRIPTION("Passive OS fingerprint matching.");
+ MODULE_ALIAS("ipt_osf");
+ MODULE_ALIAS("ip6t_osf");
+-MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_OSF);
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 31793af1a77bd..93548b9e07cf1 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -943,6 +943,7 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,
+ if (ret < 0)
+ return ret;
+
++ sch_tree_lock(sch);
+ /* backup q->clg and q->loss_model */
+ old_clg = q->clg;
+ old_loss_model = q->loss_model;
+@@ -951,7 +952,7 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,
+ ret = get_loss_clg(q, tb[TCA_NETEM_LOSS]);
+ if (ret) {
+ q->loss_model = old_loss_model;
+- return ret;
++ goto unlock;
+ }
+ } else {
+ q->loss_model = CLG_RANDOM;
+@@ -1018,6 +1019,8 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,
+ /* capping jitter to the range acceptable by tabledist() */
+ q->jitter = min_t(s64, abs(q->jitter), INT_MAX);
+
++unlock:
++ sch_tree_unlock(sch);
+ return ret;
+
+ get_table_failure:
+@@ -1027,7 +1030,8 @@ get_table_failure:
+ */
+ q->clg = old_clg;
+ q->loss_model = old_loss_model;
+- return ret;
++
++ goto unlock;
+ }
+
+ static int netem_init(struct Qdisc *sch, struct nlattr *opt,
+diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
+index 4f18bb272e929..0ecea65a80b46 100644
+--- a/sound/soc/codecs/nau8824.c
++++ b/sound/soc/codecs/nau8824.c
+@@ -1899,6 +1899,30 @@ static const struct dmi_system_id nau8824_quirk_table[] = {
+ },
+ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH),
+ },
++ {
++ /* Positivo CW14Q01P */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
++ DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P"),
++ },
++ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH),
++ },
++ {
++ /* Positivo K1424G */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
++ DMI_MATCH(DMI_BOARD_NAME, "K1424G"),
++ },
++ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH),
++ },
++ {
++ /* Positivo N14ZP74G */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
++ DMI_MATCH(DMI_BOARD_NAME, "N14ZP74G"),
++ },
++ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH),
++ },
+ {}
+ };
+
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-07-24 20:30 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-07-24 20:30 UTC (permalink / raw
To: gentoo-commits
commit: cf8ba5ccba341579127038378a7c1e4fe07ebf09
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 24 20:29:52 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Jul 24 20:29:52 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=cf8ba5cc
Linux patch 4.19.289
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1288_linux-4.19.289.patch | 323 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 327 insertions(+)
diff --git a/0000_README b/0000_README
index 47d5babb..5cf0eabf 100644
--- a/0000_README
+++ b/0000_README
@@ -1195,6 +1195,10 @@ Patch: 1287_linux-4.19.288.patch
From: https://www.kernel.org
Desc: Linux 4.19.288
+Patch: 1288_linux-4.19.289.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.289
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1288_linux-4.19.289.patch b/1288_linux-4.19.289.patch
new file mode 100644
index 00000000..3c87b60c
--- /dev/null
+++ b/1288_linux-4.19.289.patch
@@ -0,0 +1,323 @@
+diff --git a/Makefile b/Makefile
+index 0293da44bdcd2..9af8ec084269a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 288
++SUBLEVEL = 289
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
+index 8e915e3813f6a..b675db12a8ab4 100644
+--- a/arch/x86/include/asm/microcode.h
++++ b/arch/x86/include/asm/microcode.h
+@@ -5,6 +5,7 @@
+ #include <asm/cpu.h>
+ #include <linux/earlycpio.h>
+ #include <linux/initrd.h>
++#include <asm/microcode_amd.h>
+
+ struct ucode_patch {
+ struct list_head plist;
+diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h
+index a645b25ee442a..403a8e76b310c 100644
+--- a/arch/x86/include/asm/microcode_amd.h
++++ b/arch/x86/include/asm/microcode_amd.h
+@@ -48,11 +48,13 @@ extern void __init load_ucode_amd_bsp(unsigned int family);
+ extern void load_ucode_amd_ap(unsigned int family);
+ extern int __init save_microcode_in_initrd_amd(unsigned int family);
+ void reload_ucode_amd(unsigned int cpu);
++extern void amd_check_microcode(void);
+ #else
+ static inline void __init load_ucode_amd_bsp(unsigned int family) {}
+ static inline void load_ucode_amd_ap(unsigned int family) {}
+ static inline int __init
+ save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; }
+ static inline void reload_ucode_amd(unsigned int cpu) {}
++static inline void amd_check_microcode(void) {}
+ #endif
+ #endif /* _ASM_X86_MICROCODE_AMD_H */
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index 847f3f5820d21..d9c6603dcd639 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -407,6 +407,7 @@
+ #define MSR_AMD64_DE_CFG 0xc0011029
+ #define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT 1
+ #define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE BIT_ULL(MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT)
++#define MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT 9
+
+ #define MSR_AMD64_BU_CFG2 0xc001102a
+ #define MSR_AMD64_IBSFETCHCTL 0xc0011030
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index c8979f8cbce54..256f2c6120ecb 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -23,11 +23,6 @@
+
+ #include "cpu.h"
+
+-static const int amd_erratum_383[];
+-static const int amd_erratum_400[];
+-static const int amd_erratum_1054[];
+-static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum);
+-
+ /*
+ * nodes_per_socket: Stores the number of nodes per socket.
+ * Refer to Fam15h Models 00-0fh BKDG - CPUID Fn8000_001E_ECX
+@@ -35,6 +30,78 @@ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum);
+ */
+ static u32 nodes_per_socket = 1;
+
++/*
++ * AMD errata checking
++ *
++ * Errata are defined as arrays of ints using the AMD_LEGACY_ERRATUM() or
++ * AMD_OSVW_ERRATUM() macros. The latter is intended for newer errata that
++ * have an OSVW id assigned, which it takes as first argument. Both take a
++ * variable number of family-specific model-stepping ranges created by
++ * AMD_MODEL_RANGE().
++ *
++ * Example:
++ *
++ * const int amd_erratum_319[] =
++ * AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0x4, 0x2),
++ * AMD_MODEL_RANGE(0x10, 0x8, 0x0, 0x8, 0x0),
++ * AMD_MODEL_RANGE(0x10, 0x9, 0x0, 0x9, 0x0));
++ */
++
++#define AMD_LEGACY_ERRATUM(...) { -1, __VA_ARGS__, 0 }
++#define AMD_OSVW_ERRATUM(osvw_id, ...) { osvw_id, __VA_ARGS__, 0 }
++#define AMD_MODEL_RANGE(f, m_start, s_start, m_end, s_end) \
++ ((f << 24) | (m_start << 16) | (s_start << 12) | (m_end << 4) | (s_end))
++#define AMD_MODEL_RANGE_FAMILY(range) (((range) >> 24) & 0xff)
++#define AMD_MODEL_RANGE_START(range) (((range) >> 12) & 0xfff)
++#define AMD_MODEL_RANGE_END(range) ((range) & 0xfff)
++
++static const int amd_erratum_400[] =
++ AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf),
++ AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf));
++
++static const int amd_erratum_383[] =
++ AMD_OSVW_ERRATUM(3, AMD_MODEL_RANGE(0x10, 0, 0, 0xff, 0xf));
++
++/* #1054: Instructions Retired Performance Counter May Be Inaccurate */
++static const int amd_erratum_1054[] =
++ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0, 0, 0x2f, 0xf));
++
++static const int amd_zenbleed[] =
++ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0x30, 0x0, 0x4f, 0xf),
++ AMD_MODEL_RANGE(0x17, 0x60, 0x0, 0x7f, 0xf),
++ AMD_MODEL_RANGE(0x17, 0xa0, 0x0, 0xaf, 0xf));
++
++static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
++{
++ int osvw_id = *erratum++;
++ u32 range;
++ u32 ms;
++
++ if (osvw_id >= 0 && osvw_id < 65536 &&
++ cpu_has(cpu, X86_FEATURE_OSVW)) {
++ u64 osvw_len;
++
++ rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, osvw_len);
++ if (osvw_id < osvw_len) {
++ u64 osvw_bits;
++
++ rdmsrl(MSR_AMD64_OSVW_STATUS + (osvw_id >> 6),
++ osvw_bits);
++ return osvw_bits & (1ULL << (osvw_id & 0x3f));
++ }
++ }
++
++ /* OSVW unavailable or ID unknown, match family-model-stepping range */
++ ms = (cpu->x86_model << 4) | cpu->x86_stepping;
++ while ((range = *erratum++))
++ if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
++ (ms >= AMD_MODEL_RANGE_START(range)) &&
++ (ms <= AMD_MODEL_RANGE_END(range)))
++ return true;
++
++ return false;
++}
++
+ static inline int rdmsrl_amd_safe(unsigned msr, unsigned long long *p)
+ {
+ u32 gprs[8] = { 0 };
+@@ -909,6 +976,47 @@ static void init_amd_zn(struct cpuinfo_x86 *c)
+ }
+ }
+
++static bool cpu_has_zenbleed_microcode(void)
++{
++ u32 good_rev = 0;
++
++ switch (boot_cpu_data.x86_model) {
++ case 0x30 ... 0x3f: good_rev = 0x0830107a; break;
++ case 0x60 ... 0x67: good_rev = 0x0860010b; break;
++ case 0x68 ... 0x6f: good_rev = 0x08608105; break;
++ case 0x70 ... 0x7f: good_rev = 0x08701032; break;
++ case 0xa0 ... 0xaf: good_rev = 0x08a00008; break;
++
++ default:
++ return false;
++ break;
++ }
++
++ if (boot_cpu_data.microcode < good_rev)
++ return false;
++
++ return true;
++}
++
++static void zenbleed_check(struct cpuinfo_x86 *c)
++{
++ if (!cpu_has_amd_erratum(c, amd_zenbleed))
++ return;
++
++ if (cpu_has(c, X86_FEATURE_HYPERVISOR))
++ return;
++
++ if (!cpu_has(c, X86_FEATURE_AVX))
++ return;
++
++ if (!cpu_has_zenbleed_microcode()) {
++ pr_notice_once("Zenbleed: please update your microcode for the most optimal fix\n");
++ msr_set_bit(MSR_AMD64_DE_CFG, MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT);
++ } else {
++ msr_clear_bit(MSR_AMD64_DE_CFG, MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT);
++ }
++}
++
+ static void init_amd(struct cpuinfo_x86 *c)
+ {
+ early_init_amd(c);
+@@ -1011,6 +1119,8 @@ static void init_amd(struct cpuinfo_x86 *c)
+ msr_set_bit(MSR_K7_HWCR, MSR_K7_HWCR_IRPERF_EN_BIT);
+
+ check_null_seg_clears_base(c);
++
++ zenbleed_check(c);
+ }
+
+ #ifdef CONFIG_X86_32
+@@ -1106,73 +1216,6 @@ static const struct cpu_dev amd_cpu_dev = {
+
+ cpu_dev_register(amd_cpu_dev);
+
+-/*
+- * AMD errata checking
+- *
+- * Errata are defined as arrays of ints using the AMD_LEGACY_ERRATUM() or
+- * AMD_OSVW_ERRATUM() macros. The latter is intended for newer errata that
+- * have an OSVW id assigned, which it takes as first argument. Both take a
+- * variable number of family-specific model-stepping ranges created by
+- * AMD_MODEL_RANGE().
+- *
+- * Example:
+- *
+- * const int amd_erratum_319[] =
+- * AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0x4, 0x2),
+- * AMD_MODEL_RANGE(0x10, 0x8, 0x0, 0x8, 0x0),
+- * AMD_MODEL_RANGE(0x10, 0x9, 0x0, 0x9, 0x0));
+- */
+-
+-#define AMD_LEGACY_ERRATUM(...) { -1, __VA_ARGS__, 0 }
+-#define AMD_OSVW_ERRATUM(osvw_id, ...) { osvw_id, __VA_ARGS__, 0 }
+-#define AMD_MODEL_RANGE(f, m_start, s_start, m_end, s_end) \
+- ((f << 24) | (m_start << 16) | (s_start << 12) | (m_end << 4) | (s_end))
+-#define AMD_MODEL_RANGE_FAMILY(range) (((range) >> 24) & 0xff)
+-#define AMD_MODEL_RANGE_START(range) (((range) >> 12) & 0xfff)
+-#define AMD_MODEL_RANGE_END(range) ((range) & 0xfff)
+-
+-static const int amd_erratum_400[] =
+- AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf),
+- AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf));
+-
+-static const int amd_erratum_383[] =
+- AMD_OSVW_ERRATUM(3, AMD_MODEL_RANGE(0x10, 0, 0, 0xff, 0xf));
+-
+-/* #1054: Instructions Retired Performance Counter May Be Inaccurate */
+-static const int amd_erratum_1054[] =
+- AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0, 0, 0x2f, 0xf));
+-
+-static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
+-{
+- int osvw_id = *erratum++;
+- u32 range;
+- u32 ms;
+-
+- if (osvw_id >= 0 && osvw_id < 65536 &&
+- cpu_has(cpu, X86_FEATURE_OSVW)) {
+- u64 osvw_len;
+-
+- rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, osvw_len);
+- if (osvw_id < osvw_len) {
+- u64 osvw_bits;
+-
+- rdmsrl(MSR_AMD64_OSVW_STATUS + (osvw_id >> 6),
+- osvw_bits);
+- return osvw_bits & (1ULL << (osvw_id & 0x3f));
+- }
+- }
+-
+- /* OSVW unavailable or ID unknown, match family-model-stepping range */
+- ms = (cpu->x86_model << 4) | cpu->x86_stepping;
+- while ((range = *erratum++))
+- if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
+- (ms >= AMD_MODEL_RANGE_START(range)) &&
+- (ms <= AMD_MODEL_RANGE_END(range)))
+- return true;
+-
+- return false;
+-}
+-
+ void set_dr_addr_mask(unsigned long mask, int dr)
+ {
+ if (!boot_cpu_has(X86_FEATURE_BPEXT))
+@@ -1191,3 +1234,15 @@ void set_dr_addr_mask(unsigned long mask, int dr)
+ break;
+ }
+ }
++
++static void zenbleed_check_cpu(void *unused)
++{
++ struct cpuinfo_x86 *c = &cpu_data(smp_processor_id());
++
++ zenbleed_check(c);
++}
++
++void amd_check_microcode(void)
++{
++ on_each_cpu(zenbleed_check_cpu, NULL, 1);
++}
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 55293e5dcbffd..ec324be006031 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -2077,6 +2077,8 @@ void microcode_check(void)
+
+ perf_check_microcode();
+
++ amd_check_microcode();
++
+ /* Reload CPUID max function as it might've changed. */
+ info.cpuid_level = cpuid_eax(0);
+
+diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
+index b33e4fe9de197..5698e04803b59 100644
+--- a/arch/x86/kernel/cpu/microcode/amd.c
++++ b/arch/x86/kernel/cpu/microcode/amd.c
+@@ -532,7 +532,7 @@ static enum ucode_state apply_microcode_amd(int cpu)
+ rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
+
+ /* need to apply patch? */
+- if (rev >= mc_amd->hdr.patch_id) {
++ if (rev > mc_amd->hdr.patch_id) {
+ ret = UCODE_OK;
+ goto out;
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-08-08 18:43 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-08-08 18:43 UTC (permalink / raw
To: gentoo-commits
commit: d288fe3690572d081d28c1b6651166fb9055f9e7
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Aug 8 18:43:19 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Aug 8 18:43:19 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d288fe36
Linux patch 4.19.290
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1289_linux-4.19.290.patch | 1749 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1753 insertions(+)
diff --git a/0000_README b/0000_README
index 5cf0eabf..a3f10bc0 100644
--- a/0000_README
+++ b/0000_README
@@ -1199,6 +1199,10 @@ Patch: 1288_linux-4.19.289.patch
From: https://www.kernel.org
Desc: Linux 4.19.289
+Patch: 1289_linux-4.19.290.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.290
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1289_linux-4.19.290.patch b/1289_linux-4.19.290.patch
new file mode 100644
index 00000000..ee05864b
--- /dev/null
+++ b/1289_linux-4.19.290.patch
@@ -0,0 +1,1749 @@
+diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
+index dee993602c313..a531b208902f9 100644
+--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
++++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
+@@ -472,16 +472,17 @@ Description: information about CPUs heterogeneity.
+ cpu_capacity: capacity of cpu#.
+
+ What: /sys/devices/system/cpu/vulnerabilities
++ /sys/devices/system/cpu/vulnerabilities/gather_data_sampling
++ /sys/devices/system/cpu/vulnerabilities/itlb_multihit
++ /sys/devices/system/cpu/vulnerabilities/l1tf
++ /sys/devices/system/cpu/vulnerabilities/mds
+ /sys/devices/system/cpu/vulnerabilities/meltdown
++ /sys/devices/system/cpu/vulnerabilities/mmio_stale_data
++ /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
+ /sys/devices/system/cpu/vulnerabilities/spectre_v1
+ /sys/devices/system/cpu/vulnerabilities/spectre_v2
+- /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
+- /sys/devices/system/cpu/vulnerabilities/l1tf
+- /sys/devices/system/cpu/vulnerabilities/mds
+ /sys/devices/system/cpu/vulnerabilities/srbds
+ /sys/devices/system/cpu/vulnerabilities/tsx_async_abort
+- /sys/devices/system/cpu/vulnerabilities/itlb_multihit
+- /sys/devices/system/cpu/vulnerabilities/mmio_stale_data
+ Date: January 2018
+ Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>
+ Description: Information about CPU vulnerabilities
+diff --git a/Documentation/admin-guide/hw-vuln/gather_data_sampling.rst b/Documentation/admin-guide/hw-vuln/gather_data_sampling.rst
+new file mode 100644
+index 0000000000000..264bfa937f7de
+--- /dev/null
++++ b/Documentation/admin-guide/hw-vuln/gather_data_sampling.rst
+@@ -0,0 +1,109 @@
++.. SPDX-License-Identifier: GPL-2.0
++
++GDS - Gather Data Sampling
++==========================
++
++Gather Data Sampling is a hardware vulnerability which allows unprivileged
++speculative access to data which was previously stored in vector registers.
++
++Problem
++-------
++When a gather instruction performs loads from memory, different data elements
++are merged into the destination vector register. However, when a gather
++instruction that is transiently executed encounters a fault, stale data from
++architectural or internal vector registers may get transiently forwarded to the
++destination vector register instead. This will allow a malicious attacker to
++infer stale data using typical side channel techniques like cache timing
++attacks. GDS is a purely sampling-based attack.
++
++The attacker uses gather instructions to infer the stale vector register data.
++The victim does not need to do anything special other than use the vector
++registers. The victim does not need to use gather instructions to be
++vulnerable.
++
++Because the buffers are shared between Hyper-Threads cross Hyper-Thread attacks
++are possible.
++
++Attack scenarios
++----------------
++Without mitigation, GDS can infer stale data across virtually all
++permission boundaries:
++
++ Non-enclaves can infer SGX enclave data
++ Userspace can infer kernel data
++ Guests can infer data from hosts
++ Guest can infer guest from other guests
++ Users can infer data from other users
++
++Because of this, it is important to ensure that the mitigation stays enabled in
++lower-privilege contexts like guests and when running outside SGX enclaves.
++
++The hardware enforces the mitigation for SGX. Likewise, VMMs should ensure
++that guests are not allowed to disable the GDS mitigation. If a host erred and
++allowed this, a guest could theoretically disable GDS mitigation, mount an
++attack, and re-enable it.
++
++Mitigation mechanism
++--------------------
++This issue is mitigated in microcode. The microcode defines the following new
++bits:
++
++ ================================ === ============================
++ IA32_ARCH_CAPABILITIES[GDS_CTRL] R/O Enumerates GDS vulnerability
++ and mitigation support.
++ IA32_ARCH_CAPABILITIES[GDS_NO] R/O Processor is not vulnerable.
++ IA32_MCU_OPT_CTRL[GDS_MITG_DIS] R/W Disables the mitigation
++ 0 by default.
++ IA32_MCU_OPT_CTRL[GDS_MITG_LOCK] R/W Locks GDS_MITG_DIS=0. Writes
++ to GDS_MITG_DIS are ignored
++ Can't be cleared once set.
++ ================================ === ============================
++
++GDS can also be mitigated on systems that don't have updated microcode by
++disabling AVX. This can be done by setting gather_data_sampling="force" or
++"clearcpuid=avx" on the kernel command-line.
++
++If used, these options will disable AVX use by turning off XSAVE YMM support.
++However, the processor will still enumerate AVX support. Userspace that
++does not follow proper AVX enumeration to check both AVX *and* XSAVE YMM
++support will break.
++
++Mitigation control on the kernel command line
++---------------------------------------------
++The mitigation can be disabled by setting "gather_data_sampling=off" or
++"mitigations=off" on the kernel command line. Not specifying either will default
++to the mitigation being enabled. Specifying "gather_data_sampling=force" will
++use the microcode mitigation when available or disable AVX on affected systems
++where the microcode hasn't been updated to include the mitigation.
++
++GDS System Information
++------------------------
++The kernel provides vulnerability status information through sysfs. For
++GDS this can be accessed by the following sysfs file:
++
++/sys/devices/system/cpu/vulnerabilities/gather_data_sampling
++
++The possible values contained in this file are:
++
++ ============================== =============================================
++ Not affected Processor not vulnerable.
++ Vulnerable Processor vulnerable and mitigation disabled.
++ Vulnerable: No microcode Processor vulnerable and microcode is missing
++ mitigation.
++ Mitigation: AVX disabled,
++ no microcode Processor is vulnerable and microcode is missing
++ mitigation. AVX disabled as mitigation.
++ Mitigation: Microcode Processor is vulnerable and mitigation is in
++ effect.
++ Mitigation: Microcode (locked) Processor is vulnerable and mitigation is in
++ effect and cannot be disabled.
++ Unknown: Dependent on
++ hypervisor status Running on a virtual guest processor that is
++ affected but with no way to know if host
++ processor is mitigated or vulnerable.
++ ============================== =============================================
++
++GDS Default mitigation
++----------------------
++The updated microcode will enable the mitigation by default. The kernel's
++default action is to leave the mitigation enabled.
+diff --git a/Documentation/admin-guide/hw-vuln/index.rst b/Documentation/admin-guide/hw-vuln/index.rst
+index 2adec1e6520a6..245468b0f2be8 100644
+--- a/Documentation/admin-guide/hw-vuln/index.rst
++++ b/Documentation/admin-guide/hw-vuln/index.rst
+@@ -16,3 +16,4 @@ are configurable at compile, boot or run time.
+ multihit.rst
+ special-register-buffer-data-sampling.rst
+ processor_mmio_stale_data.rst
++ gather_data_sampling.rst
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 42ddd78ea001a..84c34f7e89844 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1290,6 +1290,26 @@
+ Format: off | on
+ default: on
+
++ gather_data_sampling=
++ [X86,INTEL] Control the Gather Data Sampling (GDS)
++ mitigation.
++
++ Gather Data Sampling is a hardware vulnerability which
++ allows unprivileged speculative access to data which was
++ previously stored in vector registers.
++
++ This issue is mitigated by default in updated microcode.
++ The mitigation may have a performance impact but can be
++ disabled. On systems without the microcode mitigation
++ disabling AVX serves as a mitigation.
++
++ force: Disable AVX to mitigate systems without
++ microcode mitigation. No effect if the microcode
++ mitigation is present. Known to cause crashes in
++ userspace with buggy AVX enumeration.
++
++ off: Disable GDS mitigation.
++
+ gcov_persist= [GCOV] When non-zero (default), profiling data for
+ kernel modules is saved and remains accessible via
+ debugfs, even when the module is unloaded/reloaded.
+@@ -2555,22 +2575,23 @@
+ Disable all optional CPU mitigations. This
+ improves system performance, but it may also
+ expose users to several CPU vulnerabilities.
+- Equivalent to: nopti [X86,PPC]
++ Equivalent to: gather_data_sampling=off [X86]
+ kpti=0 [ARM64]
+- nospectre_v1 [PPC]
++ kvm.nx_huge_pages=off [X86]
++ l1tf=off [X86]
++ mds=off [X86]
++ mmio_stale_data=off [X86]
++ no_entry_flush [PPC]
++ no_uaccess_flush [PPC]
+ nobp=0 [S390]
++ nopti [X86,PPC]
++ nospectre_v1 [PPC]
+ nospectre_v1 [X86]
+ nospectre_v2 [X86,PPC,S390,ARM64]
+- spectre_v2_user=off [X86]
+ spec_store_bypass_disable=off [X86,PPC]
++ spectre_v2_user=off [X86]
+ ssbd=force-off [ARM64]
+- l1tf=off [X86]
+- mds=off [X86]
+ tsx_async_abort=off [X86]
+- kvm.nx_huge_pages=off [X86]
+- no_entry_flush [PPC]
+- no_uaccess_flush [PPC]
+- mmio_stale_data=off [X86]
+
+ Exceptions:
+ This does not have any effect on
+diff --git a/Makefile b/Makefile
+index 9af8ec084269a..5cd8768fc083f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 289
++SUBLEVEL = 290
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/Kconfig b/arch/Kconfig
+index dd71b34fe4f5f..6e77e795517dc 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -249,6 +249,9 @@ config ARCH_HAS_FORTIFY_SOURCE
+ config ARCH_HAS_SET_MEMORY
+ bool
+
++config ARCH_HAS_CPU_FINALIZE_INIT
++ bool
++
+ # Select if arch init_task must go in the __init_task_data section
+ config ARCH_TASK_STRUCT_ON_STACK
+ bool
+diff --git a/arch/alpha/include/asm/bugs.h b/arch/alpha/include/asm/bugs.h
+deleted file mode 100644
+index 78030d1c7e7e0..0000000000000
+--- a/arch/alpha/include/asm/bugs.h
++++ /dev/null
+@@ -1,20 +0,0 @@
+-/*
+- * include/asm-alpha/bugs.h
+- *
+- * Copyright (C) 1994 Linus Torvalds
+- */
+-
+-/*
+- * This is included by init/main.c to check for architecture-dependent bugs.
+- *
+- * Needs:
+- * void check_bugs(void);
+- */
+-
+-/*
+- * I don't know of any alpha bugs yet.. Nice chip
+- */
+-
+-static void check_bugs(void)
+-{
+-}
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 41bde0e62e90b..9b075719a7d92 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -4,6 +4,7 @@ config ARM
+ default y
+ select ARCH_CLOCKSOURCE_DATA
+ select ARCH_DISCARD_MEMBLOCK if !HAVE_ARCH_PFN_VALID && !KEXEC
++ select ARCH_HAS_CPU_FINALIZE_INIT if MMU
+ select ARCH_HAS_DEBUG_VIRTUAL if MMU
+ select ARCH_HAS_DEVMEM_IS_ALLOWED
+ select ARCH_HAS_ELF_RANDOMIZE
+diff --git a/arch/arm/include/asm/bugs.h b/arch/arm/include/asm/bugs.h
+index 73a99c72a930a..21b6f742b3baa 100644
+--- a/arch/arm/include/asm/bugs.h
++++ b/arch/arm/include/asm/bugs.h
+@@ -1,6 +1,4 @@
+ /*
+- * arch/arm/include/asm/bugs.h
+- *
+ * Copyright (C) 1995-2003 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+@@ -13,10 +11,8 @@
+ extern void check_writebuffer_bugs(void);
+
+ #ifdef CONFIG_MMU
+-extern void check_bugs(void);
+ extern void check_other_bugs(void);
+ #else
+-#define check_bugs() do { } while (0)
+ #define check_other_bugs() do { } while (0)
+ #endif
+
+diff --git a/arch/arm/kernel/bugs.c b/arch/arm/kernel/bugs.c
+index d41d3598e5e54..e9fc25350784e 100644
+--- a/arch/arm/kernel/bugs.c
++++ b/arch/arm/kernel/bugs.c
+@@ -1,5 +1,6 @@
+ // SPDX-Identifier: GPL-2.0
+ #include <linux/init.h>
++#include <linux/cpu.h>
+ #include <asm/bugs.h>
+ #include <asm/proc-fns.h>
+
+@@ -11,7 +12,7 @@ void check_other_bugs(void)
+ #endif
+ }
+
+-void __init check_bugs(void)
++void __init arch_cpu_finalize_init(void)
+ {
+ check_writebuffer_bugs();
+ check_other_bugs();
+diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
+index 0d56b19b7511a..58f63446c6570 100644
+--- a/arch/ia64/Kconfig
++++ b/arch/ia64/Kconfig
+@@ -8,6 +8,7 @@ menu "Processor type and features"
+
+ config IA64
+ bool
++ select ARCH_HAS_CPU_FINALIZE_INIT
+ select ARCH_MIGHT_HAVE_PC_PARPORT
+ select ARCH_MIGHT_HAVE_PC_SERIO
+ select PCI if (!IA64_HP_SIM)
+diff --git a/arch/ia64/include/asm/bugs.h b/arch/ia64/include/asm/bugs.h
+deleted file mode 100644
+index 0d6b9bded56c6..0000000000000
+--- a/arch/ia64/include/asm/bugs.h
++++ /dev/null
+@@ -1,20 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/*
+- * This is included by init/main.c to check for architecture-dependent bugs.
+- *
+- * Needs:
+- * void check_bugs(void);
+- *
+- * Based on <asm-alpha/bugs.h>.
+- *
+- * Modified 1998, 1999, 2003
+- * David Mosberger-Tang <davidm@hpl.hp.com>, Hewlett-Packard Co.
+- */
+-#ifndef _ASM_IA64_BUGS_H
+-#define _ASM_IA64_BUGS_H
+-
+-#include <asm/processor.h>
+-
+-extern void check_bugs (void);
+-
+-#endif /* _ASM_IA64_BUGS_H */
+diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
+index 0e6c2d9fb4987..41af687bc1dc6 100644
+--- a/arch/ia64/kernel/setup.c
++++ b/arch/ia64/kernel/setup.c
+@@ -1050,8 +1050,7 @@ cpu_init (void)
+ platform_cpu_init();
+ }
+
+-void __init
+-check_bugs (void)
++void __init arch_cpu_finalize_init(void)
+ {
+ ia64_patch_mckinley_e9((unsigned long) __start___mckinley_e9_bundles,
+ (unsigned long) __end___mckinley_e9_bundles);
+diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
+index 070553791e977..05b7e4cbb16e0 100644
+--- a/arch/m68k/Kconfig
++++ b/arch/m68k/Kconfig
+@@ -2,6 +2,7 @@
+ config M68K
+ bool
+ default y
++ select ARCH_HAS_CPU_FINALIZE_INIT if MMU
+ select ARCH_HAS_SYNC_DMA_FOR_DEVICE if HAS_DMA
+ select ARCH_MIGHT_HAVE_PC_PARPORT if ISA
+ select ARCH_NO_COHERENT_DMA_MMAP if !MMU
+diff --git a/arch/m68k/include/asm/bugs.h b/arch/m68k/include/asm/bugs.h
+deleted file mode 100644
+index 745530651e0bf..0000000000000
+--- a/arch/m68k/include/asm/bugs.h
++++ /dev/null
+@@ -1,21 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/*
+- * include/asm-m68k/bugs.h
+- *
+- * Copyright (C) 1994 Linus Torvalds
+- */
+-
+-/*
+- * This is included by init/main.c to check for architecture-dependent bugs.
+- *
+- * Needs:
+- * void check_bugs(void);
+- */
+-
+-#ifdef CONFIG_MMU
+-extern void check_bugs(void); /* in arch/m68k/kernel/setup.c */
+-#else
+-static void check_bugs(void)
+-{
+-}
+-#endif
+diff --git a/arch/m68k/kernel/setup_mm.c b/arch/m68k/kernel/setup_mm.c
+index de44899c0e617..461e14f46cfe5 100644
+--- a/arch/m68k/kernel/setup_mm.c
++++ b/arch/m68k/kernel/setup_mm.c
+@@ -10,6 +10,7 @@
+ */
+
+ #include <linux/kernel.h>
++#include <linux/cpu.h>
+ #include <linux/mm.h>
+ #include <linux/sched.h>
+ #include <linux/delay.h>
+@@ -526,7 +527,7 @@ static int __init proc_hardware_init(void)
+ module_init(proc_hardware_init);
+ #endif
+
+-void check_bugs(void)
++void __init arch_cpu_finalize_init(void)
+ {
+ #if defined(CONFIG_FPU) && !defined(CONFIG_M68KFPU_EMU)
+ if (m68k_fputype == 0) {
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 8a227a80f6bd5..8d1d065aac35d 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -4,6 +4,7 @@ config MIPS
+ default y
+ select ARCH_BINFMT_ELF_STATE
+ select ARCH_CLOCKSOURCE_DATA
++ select ARCH_HAS_CPU_FINALIZE_INIT
+ select ARCH_DISCARD_MEMBLOCK
+ select ARCH_HAS_ELF_RANDOMIZE
+ select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
+diff --git a/arch/mips/include/asm/bugs.h b/arch/mips/include/asm/bugs.h
+index d8ab8b7129b53..6d04d7d3a8f2d 100644
+--- a/arch/mips/include/asm/bugs.h
++++ b/arch/mips/include/asm/bugs.h
+@@ -1,17 +1,11 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+ /*
+- * This is included by init/main.c to check for architecture-dependent bugs.
+- *
+ * Copyright (C) 2007 Maciej W. Rozycki
+- *
+- * Needs:
+- * void check_bugs(void);
+ */
+ #ifndef _ASM_BUGS_H
+ #define _ASM_BUGS_H
+
+ #include <linux/bug.h>
+-#include <linux/delay.h>
+ #include <linux/smp.h>
+
+ #include <asm/cpu.h>
+@@ -31,17 +25,6 @@ static inline void check_bugs_early(void)
+ #endif
+ }
+
+-static inline void check_bugs(void)
+-{
+- unsigned int cpu = smp_processor_id();
+-
+- cpu_data[cpu].udelay_val = loops_per_jiffy;
+- check_bugs32();
+-#ifdef CONFIG_64BIT
+- check_bugs64();
+-#endif
+-}
+-
+ static inline int r4k_daddiu_bug(void)
+ {
+ #ifdef CONFIG_64BIT
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index 124bc842306d6..b424f5e844871 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -11,6 +11,8 @@
+ * Copyright (C) 2000, 2001, 2002, 2007 Maciej W. Rozycki
+ */
+ #include <linux/init.h>
++#include <linux/cpu.h>
++#include <linux/delay.h>
+ #include <linux/ioport.h>
+ #include <linux/export.h>
+ #include <linux/screen_info.h>
+@@ -1108,3 +1110,14 @@ static int __init setnocoherentio(char *str)
+ }
+ early_param("nocoherentio", setnocoherentio);
+ #endif
++
++void __init arch_cpu_finalize_init(void)
++{
++ unsigned int cpu = smp_processor_id();
++
++ cpu_data[cpu].udelay_val = loops_per_jiffy;
++ check_bugs32();
++
++ if (IS_ENABLED(CONFIG_CPU_R4X00_BUGS64))
++ check_bugs64();
++}
+diff --git a/arch/parisc/include/asm/bugs.h b/arch/parisc/include/asm/bugs.h
+deleted file mode 100644
+index 0a7f9db6bd1c7..0000000000000
+--- a/arch/parisc/include/asm/bugs.h
++++ /dev/null
+@@ -1,20 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/*
+- * include/asm-parisc/bugs.h
+- *
+- * Copyright (C) 1999 Mike Shaver
+- */
+-
+-/*
+- * This is included by init/main.c to check for architecture-dependent bugs.
+- *
+- * Needs:
+- * void check_bugs(void);
+- */
+-
+-#include <asm/processor.h>
+-
+-static inline void check_bugs(void)
+-{
+-// identify_cpu(&boot_cpu_data);
+-}
+diff --git a/arch/powerpc/include/asm/bugs.h b/arch/powerpc/include/asm/bugs.h
+deleted file mode 100644
+index 42fdb73e30685..0000000000000
+--- a/arch/powerpc/include/asm/bugs.h
++++ /dev/null
+@@ -1,18 +0,0 @@
+-#ifndef _ASM_POWERPC_BUGS_H
+-#define _ASM_POWERPC_BUGS_H
+-
+-/*
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License
+- * as published by the Free Software Foundation; either version
+- * 2 of the License, or (at your option) any later version.
+- */
+-
+-/*
+- * This file is included by 'init/main.c' to check for
+- * architecture-dependent bugs.
+- */
+-
+-static inline void check_bugs(void) { }
+-
+-#endif /* _ASM_POWERPC_BUGS_H */
+diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
+index 1fb7b6d72bafc..63e00320eb3ce 100644
+--- a/arch/sh/Kconfig
++++ b/arch/sh/Kconfig
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ config SUPERH
+ def_bool y
++ select ARCH_HAS_CPU_FINALIZE_INIT
+ select ARCH_HAS_PTE_SPECIAL
+ select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
+ select ARCH_MIGHT_HAVE_PC_PARPORT
+diff --git a/arch/sh/include/asm/bugs.h b/arch/sh/include/asm/bugs.h
+deleted file mode 100644
+index 030df56bfdb20..0000000000000
+--- a/arch/sh/include/asm/bugs.h
++++ /dev/null
+@@ -1,78 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef __ASM_SH_BUGS_H
+-#define __ASM_SH_BUGS_H
+-
+-/*
+- * This is included by init/main.c to check for architecture-dependent bugs.
+- *
+- * Needs:
+- * void check_bugs(void);
+- */
+-
+-/*
+- * I don't know of any Super-H bugs yet.
+- */
+-
+-#include <asm/processor.h>
+-
+-extern void select_idle_routine(void);
+-
+-static void __init check_bugs(void)
+-{
+- extern unsigned long loops_per_jiffy;
+- char *p = &init_utsname()->machine[2]; /* "sh" */
+-
+- select_idle_routine();
+-
+- current_cpu_data.loops_per_jiffy = loops_per_jiffy;
+-
+- switch (current_cpu_data.family) {
+- case CPU_FAMILY_SH2:
+- *p++ = '2';
+- break;
+- case CPU_FAMILY_SH2A:
+- *p++ = '2';
+- *p++ = 'a';
+- break;
+- case CPU_FAMILY_SH3:
+- *p++ = '3';
+- break;
+- case CPU_FAMILY_SH4:
+- *p++ = '4';
+- break;
+- case CPU_FAMILY_SH4A:
+- *p++ = '4';
+- *p++ = 'a';
+- break;
+- case CPU_FAMILY_SH4AL_DSP:
+- *p++ = '4';
+- *p++ = 'a';
+- *p++ = 'l';
+- *p++ = '-';
+- *p++ = 'd';
+- *p++ = 's';
+- *p++ = 'p';
+- break;
+- case CPU_FAMILY_SH5:
+- *p++ = '6';
+- *p++ = '4';
+- break;
+- case CPU_FAMILY_UNKNOWN:
+- /*
+- * Specifically use CPU_FAMILY_UNKNOWN rather than
+- * default:, so we're able to have the compiler whine
+- * about unhandled enumerations.
+- */
+- break;
+- }
+-
+- printk("CPU: %s\n", get_cpu_subtype(¤t_cpu_data));
+-
+-#ifndef __LITTLE_ENDIAN__
+- /* 'eb' means 'Endian Big' */
+- *p++ = 'e';
+- *p++ = 'b';
+-#endif
+- *p = '\0';
+-}
+-#endif /* __ASM_SH_BUGS_H */
+diff --git a/arch/sh/include/asm/processor.h b/arch/sh/include/asm/processor.h
+index 6fbf8c80e4981..386786b1594ab 100644
+--- a/arch/sh/include/asm/processor.h
++++ b/arch/sh/include/asm/processor.h
+@@ -173,6 +173,8 @@ extern unsigned int instruction_size(unsigned int insn);
+ #define instruction_size(insn) (4)
+ #endif
+
++void select_idle_routine(void);
++
+ #endif /* __ASSEMBLY__ */
+
+ #ifdef CONFIG_SUPERH32
+diff --git a/arch/sh/kernel/idle.c b/arch/sh/kernel/idle.c
+index be616ee0cf879..5169309fdf98c 100644
+--- a/arch/sh/kernel/idle.c
++++ b/arch/sh/kernel/idle.c
+@@ -18,6 +18,7 @@
+ #include <linux/smp.h>
+ #include <linux/atomic.h>
+ #include <asm/pgalloc.h>
++#include <asm/processor.h>
+ #include <asm/smp.h>
+ #include <asm/bl_bit.h>
+
+diff --git a/arch/sh/kernel/setup.c b/arch/sh/kernel/setup.c
+index b2f44eb7ce19b..8ef497062350c 100644
+--- a/arch/sh/kernel/setup.c
++++ b/arch/sh/kernel/setup.c
+@@ -42,6 +42,7 @@
+ #include <asm/smp.h>
+ #include <asm/mmu_context.h>
+ #include <asm/mmzone.h>
++#include <asm/processor.h>
+ #include <asm/sparsemem.h>
+
+ /*
+@@ -361,3 +362,57 @@ int test_mode_pin(int pin)
+ {
+ return sh_mv.mv_mode_pins() & pin;
+ }
++
++void __init arch_cpu_finalize_init(void)
++{
++ char *p = &init_utsname()->machine[2]; /* "sh" */
++
++ select_idle_routine();
++
++ current_cpu_data.loops_per_jiffy = loops_per_jiffy;
++
++ switch (current_cpu_data.family) {
++ case CPU_FAMILY_SH2:
++ *p++ = '2';
++ break;
++ case CPU_FAMILY_SH2A:
++ *p++ = '2';
++ *p++ = 'a';
++ break;
++ case CPU_FAMILY_SH3:
++ *p++ = '3';
++ break;
++ case CPU_FAMILY_SH4:
++ *p++ = '4';
++ break;
++ case CPU_FAMILY_SH4A:
++ *p++ = '4';
++ *p++ = 'a';
++ break;
++ case CPU_FAMILY_SH4AL_DSP:
++ *p++ = '4';
++ *p++ = 'a';
++ *p++ = 'l';
++ *p++ = '-';
++ *p++ = 'd';
++ *p++ = 's';
++ *p++ = 'p';
++ break;
++ case CPU_FAMILY_UNKNOWN:
++ /*
++ * Specifically use CPU_FAMILY_UNKNOWN rather than
++ * default:, so we're able to have the compiler whine
++ * about unhandled enumerations.
++ */
++ break;
++ }
++
++ pr_info("CPU: %s\n", get_cpu_subtype(¤t_cpu_data));
++
++#ifndef __LITTLE_ENDIAN__
++ /* 'eb' means 'Endian Big' */
++ *p++ = 'e';
++ *p++ = 'b';
++#endif
++ *p = '\0';
++}
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index 426accab2a88b..e231779928dd4 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -12,6 +12,7 @@ config 64BIT
+ config SPARC
+ bool
+ default y
++ select ARCH_HAS_CPU_FINALIZE_INIT if !SMP
+ select ARCH_MIGHT_HAVE_PC_PARPORT if SPARC64 && PCI
+ select ARCH_MIGHT_HAVE_PC_SERIO
+ select OF
+diff --git a/arch/sparc/include/asm/bugs.h b/arch/sparc/include/asm/bugs.h
+deleted file mode 100644
+index 02fa369b9c21f..0000000000000
+--- a/arch/sparc/include/asm/bugs.h
++++ /dev/null
+@@ -1,18 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-/* include/asm/bugs.h: Sparc probes for various bugs.
+- *
+- * Copyright (C) 1996, 2007 David S. Miller (davem@davemloft.net)
+- */
+-
+-#ifdef CONFIG_SPARC32
+-#include <asm/cpudata.h>
+-#endif
+-
+-extern unsigned long loops_per_jiffy;
+-
+-static void __init check_bugs(void)
+-{
+-#if defined(CONFIG_SPARC32) && !defined(CONFIG_SMP)
+- cpu_data(0).udelay_val = loops_per_jiffy;
+-#endif
+-}
+diff --git a/arch/sparc/kernel/setup_32.c b/arch/sparc/kernel/setup_32.c
+index 13664c3771964..3ee6609e6eb53 100644
+--- a/arch/sparc/kernel/setup_32.c
++++ b/arch/sparc/kernel/setup_32.c
+@@ -422,3 +422,10 @@ static int __init topology_init(void)
+ }
+
+ subsys_initcall(topology_init);
++
++#if defined(CONFIG_SPARC32) && !defined(CONFIG_SMP)
++void __init arch_cpu_finalize_init(void)
++{
++ cpu_data(0).udelay_val = loops_per_jiffy;
++}
++#endif
+diff --git a/arch/um/Kconfig b/arch/um/Kconfig
+index 6b9938919f0ba..8f0cb28099392 100644
+--- a/arch/um/Kconfig
++++ b/arch/um/Kconfig
+@@ -5,6 +5,7 @@ menu "UML-specific options"
+ config UML
+ bool
+ default y
++ select ARCH_HAS_CPU_FINALIZE_INIT
+ select ARCH_HAS_KCOV
+ select ARCH_NO_PREEMPT
+ select HAVE_ARCH_AUDITSYSCALL
+diff --git a/arch/um/include/asm/bugs.h b/arch/um/include/asm/bugs.h
+deleted file mode 100644
+index 4473942a08397..0000000000000
+--- a/arch/um/include/asm/bugs.h
++++ /dev/null
+@@ -1,7 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef __UM_BUGS_H
+-#define __UM_BUGS_H
+-
+-void check_bugs(void);
+-
+-#endif
+diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c
+index c23f8857a798b..66390c3211553 100644
+--- a/arch/um/kernel/um_arch.c
++++ b/arch/um/kernel/um_arch.c
+@@ -3,6 +3,7 @@
+ * Licensed under the GPL
+ */
+
++#include <linux/cpu.h>
+ #include <linux/delay.h>
+ #include <linux/init.h>
+ #include <linux/mm.h>
+@@ -352,7 +353,7 @@ void __init setup_arch(char **cmdline_p)
+ setup_hostinfo(host_info, sizeof host_info);
+ }
+
+-void __init check_bugs(void)
++void __init arch_cpu_finalize_init(void)
+ {
+ arch_check_bugs();
+ os_check_bugs();
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index be4403a8e1b41..9fd2e3c2494a8 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -50,6 +50,7 @@ config X86
+ select ARCH_CLOCKSOURCE_DATA
+ select ARCH_DISCARD_MEMBLOCK
+ select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI
++ select ARCH_HAS_CPU_FINALIZE_INIT
+ select ARCH_HAS_DEBUG_VIRTUAL
+ select ARCH_HAS_DEVMEM_IS_ALLOWED
+ select ARCH_HAS_ELF_RANDOMIZE
+@@ -2437,6 +2438,25 @@ config ARCH_ENABLE_SPLIT_PMD_PTLOCK
+ def_bool y
+ depends on X86_64 || X86_PAE
+
++config GDS_FORCE_MITIGATION
++ bool "Force GDS Mitigation"
++ depends on CPU_SUP_INTEL
++ default n
++ help
++ Gather Data Sampling (GDS) is a hardware vulnerability which allows
++ unprivileged speculative access to data which was previously stored in
++ vector registers.
++
++ This option is equivalent to setting gather_data_sampling=force on the
++ command line. The microcode mitigation is used if present, otherwise
++ AVX is disabled as a mitigation. On affected systems that are missing
++ the microcode any userspace code that unconditionally uses AVX will
++ break with this option set.
++
++ Setting this option on systems not vulnerable to GDS has no effect.
++
++ If in doubt, say N.
++
+ config ARCH_ENABLE_HUGEPAGE_MIGRATION
+ def_bool y
+ depends on X86_64 && HUGETLB_PAGE && MIGRATION
+diff --git a/arch/x86/include/asm/bugs.h b/arch/x86/include/asm/bugs.h
+index 542509b53e0f5..dd8ff1ca2aef4 100644
+--- a/arch/x86/include/asm/bugs.h
++++ b/arch/x86/include/asm/bugs.h
+@@ -4,8 +4,6 @@
+
+ #include <asm/processor.h>
+
+-extern void check_bugs(void);
+-
+ #if defined(CONFIG_CPU_SUP_INTEL)
+ void check_mpx_erratum(struct cpuinfo_x86 *c);
+ #else
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index bd4374f56651b..5cf8dca571cfd 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -409,5 +409,6 @@
+ #define X86_BUG_MMIO_UNKNOWN X86_BUG(26) /* CPU is too old and its MMIO Stale Data status is unknown */
+ #define X86_BUG_RETBLEED X86_BUG(27) /* CPU is affected by RETBleed */
+ #define X86_BUG_EIBRS_PBRSB X86_BUG(28) /* EIBRS is vulnerable to Post Barrier RSB Predictions */
++#define X86_BUG_GDS X86_BUG(29) /* CPU is affected by Gather Data Sampling */
+
+ #endif /* _ASM_X86_CPUFEATURES_H */
+diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
+index 4f274d8519865..51dc8201b51eb 100644
+--- a/arch/x86/include/asm/fpu/internal.h
++++ b/arch/x86/include/asm/fpu/internal.h
+@@ -42,7 +42,7 @@ extern int dump_fpu(struct pt_regs *ptregs, struct user_i387_struct *fpstate);
+ extern void fpu__init_cpu(void);
+ extern void fpu__init_system_xstate(void);
+ extern void fpu__init_cpu_xstate(void);
+-extern void fpu__init_system(struct cpuinfo_x86 *c);
++extern void fpu__init_system(void);
+ extern void fpu__init_check_bugs(void);
+ extern void fpu__resume_cpu(void);
+ extern u64 fpu__get_supported_xfeatures_mask(void);
+diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h
+index 616f8e637bc32..b51ac6eed904e 100644
+--- a/arch/x86/include/asm/mem_encrypt.h
++++ b/arch/x86/include/asm/mem_encrypt.h
+@@ -80,6 +80,8 @@ early_set_memory_decrypted(unsigned long vaddr, unsigned long size) { return 0;
+ static inline int __init
+ early_set_memory_encrypted(unsigned long vaddr, unsigned long size) { return 0; }
+
++static inline void mem_encrypt_init(void) { }
++
+ #define __bss_decrypted
+
+ #endif /* CONFIG_AMD_MEM_ENCRYPT */
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index d9c6603dcd639..efedd16231ff4 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -138,6 +138,15 @@
+ * Not susceptible to Post-Barrier
+ * Return Stack Buffer Predictions.
+ */
++#define ARCH_CAP_GDS_CTRL BIT(25) /*
++ * CPU is vulnerable to Gather
++ * Data Sampling (GDS) and
++ * has controls for mitigation.
++ */
++#define ARCH_CAP_GDS_NO BIT(26) /*
++ * CPU is not vulnerable to Gather
++ * Data Sampling (GDS).
++ */
+
+ #define MSR_IA32_FLUSH_CMD 0x0000010b
+ #define L1D_FLUSH BIT(0) /*
+@@ -156,6 +165,8 @@
+ #define MSR_IA32_MCU_OPT_CTRL 0x00000123
+ #define RNGDS_MITG_DIS BIT(0)
+ #define FB_CLEAR_DIS BIT(3) /* CPU Fill buffer clear disable */
++#define GDS_MITG_DIS BIT(4) /* Disable GDS mitigation */
++#define GDS_MITG_LOCKED BIT(5) /* GDS mitigation locked */
+
+ #define MSR_IA32_SYSENTER_CS 0x00000174
+ #define MSR_IA32_SYSENTER_ESP 0x00000175
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 680fa070e18be..6e1acbdd27a50 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -9,7 +9,6 @@
+ * - Andrew D. Balsa (code cleanup).
+ */
+ #include <linux/init.h>
+-#include <linux/utsname.h>
+ #include <linux/cpu.h>
+ #include <linux/module.h>
+ #include <linux/nospec.h>
+@@ -25,9 +24,7 @@
+ #include <asm/msr.h>
+ #include <asm/vmx.h>
+ #include <asm/paravirt.h>
+-#include <asm/alternative.h>
+ #include <asm/pgtable.h>
+-#include <asm/set_memory.h>
+ #include <asm/intel-family.h>
+ #include <asm/e820/api.h>
+ #include <asm/hypervisor.h>
+@@ -47,6 +44,7 @@ static void __init md_clear_select_mitigation(void);
+ static void __init taa_select_mitigation(void);
+ static void __init mmio_select_mitigation(void);
+ static void __init srbds_select_mitigation(void);
++static void __init gds_select_mitigation(void);
+
+ /* The base value of the SPEC_CTRL MSR without task-specific bits set */
+ u64 x86_spec_ctrl_base;
+@@ -115,21 +113,8 @@ EXPORT_SYMBOL_GPL(mds_idle_clear);
+ DEFINE_STATIC_KEY_FALSE(mmio_stale_data_clear);
+ EXPORT_SYMBOL_GPL(mmio_stale_data_clear);
+
+-void __init check_bugs(void)
++void __init cpu_select_mitigations(void)
+ {
+- identify_boot_cpu();
+-
+- /*
+- * identify_boot_cpu() initialized SMT support information, let the
+- * core code know.
+- */
+- cpu_smt_check_topology();
+-
+- if (!IS_ENABLED(CONFIG_SMP)) {
+- pr_info("CPU: ");
+- print_cpu_info(&boot_cpu_data);
+- }
+-
+ /*
+ * Read the SPEC_CTRL MSR to account for reserved bits which may
+ * have unknown values. AMD64_LS_CFG MSR is cached in the early AMD
+@@ -165,39 +150,7 @@ void __init check_bugs(void)
+ l1tf_select_mitigation();
+ md_clear_select_mitigation();
+ srbds_select_mitigation();
+-
+- arch_smt_update();
+-
+-#ifdef CONFIG_X86_32
+- /*
+- * Check whether we are able to run this kernel safely on SMP.
+- *
+- * - i386 is no longer supported.
+- * - In order to run on anything without a TSC, we need to be
+- * compiled for a i486.
+- */
+- if (boot_cpu_data.x86 < 4)
+- panic("Kernel requires i486+ for 'invlpg' and other features");
+-
+- init_utsname()->machine[1] =
+- '0' + (boot_cpu_data.x86 > 6 ? 6 : boot_cpu_data.x86);
+- alternative_instructions();
+-
+- fpu__init_check_bugs();
+-#else /* CONFIG_X86_64 */
+- alternative_instructions();
+-
+- /*
+- * Make sure the first 2MB area is not mapped by huge pages
+- * There are typically fixed size MTRRs in there and overlapping
+- * MTRRs into large pages causes slow downs.
+- *
+- * Right now we don't do that with gbpages because there seems
+- * very little benefit for that case.
+- */
+- if (!direct_gbpages)
+- set_memory_4k((unsigned long)__va(0), 1);
+-#endif
++ gds_select_mitigation();
+ }
+
+ /*
+@@ -648,6 +601,149 @@ static int __init srbds_parse_cmdline(char *str)
+ }
+ early_param("srbds", srbds_parse_cmdline);
+
++#undef pr_fmt
++#define pr_fmt(fmt) "GDS: " fmt
++
++enum gds_mitigations {
++ GDS_MITIGATION_OFF,
++ GDS_MITIGATION_UCODE_NEEDED,
++ GDS_MITIGATION_FORCE,
++ GDS_MITIGATION_FULL,
++ GDS_MITIGATION_FULL_LOCKED,
++ GDS_MITIGATION_HYPERVISOR,
++};
++
++#if IS_ENABLED(CONFIG_GDS_FORCE_MITIGATION)
++static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FORCE;
++#else
++static enum gds_mitigations gds_mitigation __ro_after_init = GDS_MITIGATION_FULL;
++#endif
++
++static const char * const gds_strings[] = {
++ [GDS_MITIGATION_OFF] = "Vulnerable",
++ [GDS_MITIGATION_UCODE_NEEDED] = "Vulnerable: No microcode",
++ [GDS_MITIGATION_FORCE] = "Mitigation: AVX disabled, no microcode",
++ [GDS_MITIGATION_FULL] = "Mitigation: Microcode",
++ [GDS_MITIGATION_FULL_LOCKED] = "Mitigation: Microcode (locked)",
++ [GDS_MITIGATION_HYPERVISOR] = "Unknown: Dependent on hypervisor status",
++};
++
++bool gds_ucode_mitigated(void)
++{
++ return (gds_mitigation == GDS_MITIGATION_FULL ||
++ gds_mitigation == GDS_MITIGATION_FULL_LOCKED);
++}
++EXPORT_SYMBOL_GPL(gds_ucode_mitigated);
++
++void update_gds_msr(void)
++{
++ u64 mcu_ctrl_after;
++ u64 mcu_ctrl;
++
++ switch (gds_mitigation) {
++ case GDS_MITIGATION_OFF:
++ rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
++ mcu_ctrl |= GDS_MITG_DIS;
++ break;
++ case GDS_MITIGATION_FULL_LOCKED:
++ /*
++ * The LOCKED state comes from the boot CPU. APs might not have
++ * the same state. Make sure the mitigation is enabled on all
++ * CPUs.
++ */
++ case GDS_MITIGATION_FULL:
++ rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
++ mcu_ctrl &= ~GDS_MITG_DIS;
++ break;
++ case GDS_MITIGATION_FORCE:
++ case GDS_MITIGATION_UCODE_NEEDED:
++ case GDS_MITIGATION_HYPERVISOR:
++ return;
++ };
++
++ wrmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
++
++ /*
++ * Check to make sure that the WRMSR value was not ignored. Writes to
++ * GDS_MITG_DIS will be ignored if this processor is locked but the boot
++ * processor was not.
++ */
++ rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl_after);
++ WARN_ON_ONCE(mcu_ctrl != mcu_ctrl_after);
++}
++
++static void __init gds_select_mitigation(void)
++{
++ u64 mcu_ctrl;
++
++ if (!boot_cpu_has_bug(X86_BUG_GDS))
++ return;
++
++ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) {
++ gds_mitigation = GDS_MITIGATION_HYPERVISOR;
++ goto out;
++ }
++
++ if (cpu_mitigations_off())
++ gds_mitigation = GDS_MITIGATION_OFF;
++ /* Will verify below that mitigation _can_ be disabled */
++
++ /* No microcode */
++ if (!(x86_read_arch_cap_msr() & ARCH_CAP_GDS_CTRL)) {
++ if (gds_mitigation == GDS_MITIGATION_FORCE) {
++ /*
++ * This only needs to be done on the boot CPU so do it
++ * here rather than in update_gds_msr()
++ */
++ setup_clear_cpu_cap(X86_FEATURE_AVX);
++ pr_warn("Microcode update needed! Disabling AVX as mitigation.\n");
++ } else {
++ gds_mitigation = GDS_MITIGATION_UCODE_NEEDED;
++ }
++ goto out;
++ }
++
++ /* Microcode has mitigation, use it */
++ if (gds_mitigation == GDS_MITIGATION_FORCE)
++ gds_mitigation = GDS_MITIGATION_FULL;
++
++ rdmsrl(MSR_IA32_MCU_OPT_CTRL, mcu_ctrl);
++ if (mcu_ctrl & GDS_MITG_LOCKED) {
++ if (gds_mitigation == GDS_MITIGATION_OFF)
++ pr_warn("Mitigation locked. Disable failed.\n");
++
++ /*
++ * The mitigation is selected from the boot CPU. All other CPUs
++ * _should_ have the same state. If the boot CPU isn't locked
++ * but others are then update_gds_msr() will WARN() of the state
++ * mismatch. If the boot CPU is locked update_gds_msr() will
++ * ensure the other CPUs have the mitigation enabled.
++ */
++ gds_mitigation = GDS_MITIGATION_FULL_LOCKED;
++ }
++
++ update_gds_msr();
++out:
++ pr_info("%s\n", gds_strings[gds_mitigation]);
++}
++
++static int __init gds_parse_cmdline(char *str)
++{
++ if (!str)
++ return -EINVAL;
++
++ if (!boot_cpu_has_bug(X86_BUG_GDS))
++ return 0;
++
++ if (!strcmp(str, "off"))
++ gds_mitigation = GDS_MITIGATION_OFF;
++ else if (!strcmp(str, "force"))
++ gds_mitigation = GDS_MITIGATION_FORCE;
++
++ return 0;
++}
++early_param("gather_data_sampling", gds_parse_cmdline);
++
+ #undef pr_fmt
+ #define pr_fmt(fmt) "Spectre V1 : " fmt
+
+@@ -2196,6 +2292,11 @@ static ssize_t retbleed_show_state(char *buf)
+ return sprintf(buf, "%s\n", retbleed_strings[retbleed_mitigation]);
+ }
+
++static ssize_t gds_show_state(char *buf)
++{
++ return sysfs_emit(buf, "%s\n", gds_strings[gds_mitigation]);
++}
++
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+ char *buf, unsigned int bug)
+ {
+@@ -2245,6 +2346,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ case X86_BUG_RETBLEED:
+ return retbleed_show_state(buf);
+
++ case X86_BUG_GDS:
++ return gds_show_state(buf);
++
+ default:
+ break;
+ }
+@@ -2309,4 +2413,9 @@ ssize_t cpu_show_retbleed(struct device *dev, struct device_attribute *attr, cha
+ {
+ return cpu_show_common(dev, attr, buf, X86_BUG_RETBLEED);
+ }
++
++ssize_t cpu_show_gds(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ return cpu_show_common(dev, attr, buf, X86_BUG_GDS);
++}
+ #endif
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index ec324be006031..d315e928b95c0 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -13,14 +13,20 @@
+ #include <linux/sched/mm.h>
+ #include <linux/sched/clock.h>
+ #include <linux/sched/task.h>
++#include <linux/sched/smt.h>
+ #include <linux/init.h>
+ #include <linux/kprobes.h>
+ #include <linux/kgdb.h>
++#include <linux/mem_encrypt.h>
+ #include <linux/smp.h>
++#include <linux/cpu.h>
+ #include <linux/io.h>
+ #include <linux/syscore_ops.h>
+
+ #include <asm/stackprotector.h>
++#include <linux/utsname.h>
++
++#include <asm/alternative.h>
+ #include <asm/perf_event.h>
+ #include <asm/mmu_context.h>
+ #include <asm/archrandom.h>
+@@ -56,6 +62,7 @@
+ #ifdef CONFIG_X86_LOCAL_APIC
+ #include <asm/uv/uv.h>
+ #endif
++#include <asm/set_memory.h>
+
+ #include "cpu.h"
+
+@@ -1040,6 +1047,12 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
+ #define MMIO_SBDS BIT(2)
+ /* CPU is affected by RETbleed, speculating where you would not expect it */
+ #define RETBLEED BIT(3)
++/* CPU is affected by SMT (cross-thread) return predictions */
++#define SMT_RSB BIT(4)
++/* CPU is affected by SRSO */
++#define SRSO BIT(5)
++/* CPU is affected by GDS */
++#define GDS BIT(6)
+
+ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
+ VULNBL_INTEL_STEPPINGS(IVYBRIDGE, X86_STEPPING_ANY, SRBDS),
+@@ -1052,18 +1065,20 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
+ VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO),
+ VULNBL_INTEL_STEPPINGS(BROADWELL_CORE, X86_STEPPING_ANY, SRBDS),
+ VULNBL_INTEL_STEPPINGS(SKYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
+- VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED | GDS),
+ VULNBL_INTEL_STEPPINGS(SKYLAKE_DESKTOP, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
+- VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
+- VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(KABYLAKE_MOBILE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS),
++ VULNBL_INTEL_STEPPINGS(KABYLAKE_DESKTOP,X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS),
+ VULNBL_INTEL_STEPPINGS(CANNONLAKE_MOBILE,X86_STEPPING_ANY, RETBLEED),
+- VULNBL_INTEL_STEPPINGS(ICELAKE_MOBILE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
+- VULNBL_INTEL_STEPPINGS(ICELAKE_XEON_D, X86_STEPPING_ANY, MMIO),
+- VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPING_ANY, MMIO),
+- VULNBL_INTEL_STEPPINGS(COMETLAKE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
+- VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(ICELAKE_MOBILE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS),
++ VULNBL_INTEL_STEPPINGS(ICELAKE_XEON_D, X86_STEPPING_ANY, MMIO | GDS),
++ VULNBL_INTEL_STEPPINGS(ICELAKE_X, X86_STEPPING_ANY, MMIO | GDS),
++ VULNBL_INTEL_STEPPINGS(COMETLAKE, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS),
++ VULNBL_INTEL_STEPPINGS(COMETLAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS),
++ VULNBL_INTEL_STEPPINGS(TIGERLAKE_L, X86_STEPPING_ANY, GDS),
++ VULNBL_INTEL_STEPPINGS(TIGERLAKE, X86_STEPPING_ANY, GDS),
+ VULNBL_INTEL_STEPPINGS(LAKEFIELD, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED),
+- VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPING_ANY, MMIO | RETBLEED),
++ VULNBL_INTEL_STEPPINGS(ROCKETLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS),
+ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT, X86_STEPPING_ANY, MMIO | MMIO_SBDS),
+ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_X, X86_STEPPING_ANY, MMIO),
+ VULNBL_INTEL_STEPPINGS(ATOM_TREMONT_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS),
+@@ -1186,6 +1201,16 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ !(ia32_cap & ARCH_CAP_PBRSB_NO))
+ setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB);
+
++ /*
++ * Check if CPU is vulnerable to GDS. If running in a virtual machine on
++ * an affected processor, the VMM may have disabled the use of GATHER by
++ * disabling AVX2. The only way to do this in HW is to clear XCR0[2],
++ * which means that AVX will be disabled.
++ */
++ if (cpu_matches(cpu_vuln_blacklist, GDS) && !(ia32_cap & ARCH_CAP_GDS_NO) &&
++ boot_cpu_has(X86_FEATURE_AVX))
++ setup_force_cpu_bug(X86_BUG_GDS);
++
+ if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
+ return;
+
+@@ -1271,8 +1296,6 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
+
+ cpu_set_bug_bits(c);
+
+- fpu__init_system(c);
+-
+ #ifdef CONFIG_X86_32
+ /*
+ * Regardless of whether PCID is enumerated, the SDM says
+@@ -1661,6 +1684,8 @@ void identify_secondary_cpu(struct cpuinfo_x86 *c)
+ validate_apic_and_package_id(c);
+ x86_spec_ctrl_setup_ap();
+ update_srbds_msr();
++ if (boot_cpu_has_bug(X86_BUG_GDS))
++ update_gds_msr();
+ }
+
+ static __init int setup_noclflush(char *arg)
+@@ -1978,8 +2003,6 @@ void cpu_init(void)
+ clear_all_debug_regs();
+ dbg_restore_debug_regs();
+
+- fpu__init_cpu();
+-
+ if (is_uv_system())
+ uv_cpu_init();
+
+@@ -2043,8 +2066,6 @@ void cpu_init(void)
+ clear_all_debug_regs();
+ dbg_restore_debug_regs();
+
+- fpu__init_cpu();
+-
+ load_fixmap_gdt(cpu);
+ }
+ #endif
+@@ -2097,3 +2118,69 @@ void microcode_check(void)
+ pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n");
+ pr_warn("x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.\n");
+ }
++
++void __init arch_cpu_finalize_init(void)
++{
++ identify_boot_cpu();
++
++ /*
++ * identify_boot_cpu() initialized SMT support information, let the
++ * core code know.
++ */
++ cpu_smt_check_topology();
++
++ if (!IS_ENABLED(CONFIG_SMP)) {
++ pr_info("CPU: ");
++ print_cpu_info(&boot_cpu_data);
++ }
++
++ cpu_select_mitigations();
++
++ arch_smt_update();
++
++ if (IS_ENABLED(CONFIG_X86_32)) {
++ /*
++ * Check whether this is a real i386 which is not longer
++ * supported and fixup the utsname.
++ */
++ if (boot_cpu_data.x86 < 4)
++ panic("Kernel requires i486+ for 'invlpg' and other features");
++
++ init_utsname()->machine[1] =
++ '0' + (boot_cpu_data.x86 > 6 ? 6 : boot_cpu_data.x86);
++ }
++
++ /*
++ * Must be before alternatives because it might set or clear
++ * feature bits.
++ */
++ fpu__init_system();
++ fpu__init_cpu();
++
++ alternative_instructions();
++
++ if (IS_ENABLED(CONFIG_X86_64)) {
++ /*
++ * Make sure the first 2MB area is not mapped by huge pages
++ * There are typically fixed size MTRRs in there and overlapping
++ * MTRRs into large pages causes slow downs.
++ *
++ * Right now we don't do that with gbpages because there seems
++ * very little benefit for that case.
++ */
++ if (!direct_gbpages)
++ set_memory_4k((unsigned long)__va(0), 1);
++ } else {
++ fpu__init_check_bugs();
++ }
++
++ /*
++ * This needs to be called before any devices perform DMA
++ * operations that might use the SWIOTLB bounce buffers. It will
++ * mark the bounce buffers as decrypted so that their usage will
++ * not cause "plain-text" data to be decrypted when accessed. It
++ * must be called after late_time_init() so that Hyper-V x86/x64
++ * hypercalls work when the SWIOTLB bounce buffers are decrypted.
++ */
++ mem_encrypt_init();
++}
+diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
+index 4eb9bf68b1227..ca1b8bf380a2d 100644
+--- a/arch/x86/kernel/cpu/cpu.h
++++ b/arch/x86/kernel/cpu/cpu.h
+@@ -79,9 +79,11 @@ extern void detect_ht(struct cpuinfo_x86 *c);
+ extern void check_null_seg_clears_base(struct cpuinfo_x86 *c);
+
+ unsigned int aperfmperf_get_khz(int cpu);
++void cpu_select_mitigations(void);
+
+ extern void x86_spec_ctrl_setup_ap(void);
+ extern void update_srbds_msr(void);
++extern void update_gds_msr(void);
+
+ extern u64 x86_read_arch_cap_msr(void);
+
+diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
+index 9692ccc583bb3..644372a10c895 100644
+--- a/arch/x86/kernel/fpu/init.c
++++ b/arch/x86/kernel/fpu/init.c
+@@ -49,7 +49,7 @@ void fpu__init_cpu(void)
+ fpu__init_cpu_xstate();
+ }
+
+-static bool fpu__probe_without_cpuid(void)
++static bool __init fpu__probe_without_cpuid(void)
+ {
+ unsigned long cr0;
+ u16 fsw, fcw;
+@@ -67,7 +67,7 @@ static bool fpu__probe_without_cpuid(void)
+ return fsw == 0 && (fcw & 0x103f) == 0x003f;
+ }
+
+-static void fpu__init_system_early_generic(struct cpuinfo_x86 *c)
++static void __init fpu__init_system_early_generic(void)
+ {
+ if (!boot_cpu_has(X86_FEATURE_CPUID) &&
+ !test_bit(X86_FEATURE_FPU, (unsigned long *)cpu_caps_cleared)) {
+@@ -297,10 +297,10 @@ static void __init fpu__init_parse_early_param(void)
+ * Called on the boot CPU once per system bootup, to set up the initial
+ * FPU state that is later cloned into all processes:
+ */
+-void __init fpu__init_system(struct cpuinfo_x86 *c)
++void __init fpu__init_system(void)
+ {
+ fpu__init_parse_early_param();
+- fpu__init_system_early_generic(c);
++ fpu__init_system_early_generic();
+
+ /*
+ * The FPU has to be operational for some of the
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 8783d065f9276..1f1298f6cbc26 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -231,6 +231,7 @@ static void notrace start_secondary(void *unused)
+ #endif
+ load_current_idt();
+ cpu_init();
++ fpu__init_cpu();
+ x86_cpuinit.early_percpu_clock_init();
+ preempt_disable();
+ smp_callin();
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index ff7ec9b507e33..cdf2cb1eb923d 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -217,6 +217,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
+
+ u64 __read_mostly host_xcr0;
+
++extern bool gds_ucode_mitigated(void);
++
+ static int emulator_fix_hypercall(struct x86_emulate_ctxt *ctxt);
+
+ static inline void kvm_async_pf_hash_reset(struct kvm_vcpu *vcpu)
+@@ -1224,6 +1226,9 @@ u64 kvm_get_arch_capabilities(void)
+ /* Guests don't need to know "Fill buffer clear control" exists */
+ data &= ~ARCH_CAP_FB_CLEAR_CTRL;
+
++ if (!boot_cpu_has_bug(X86_BUG_GDS) || gds_ucode_mitigated())
++ data |= ARCH_CAP_GDS_NO;
++
+ return data;
+ }
+
+diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
+index 75807c2a1e175..66f83562d3295 100644
+--- a/arch/x86/xen/smp_pv.c
++++ b/arch/x86/xen/smp_pv.c
+@@ -27,6 +27,7 @@
+ #include <asm/desc.h>
+ #include <asm/pgtable.h>
+ #include <asm/cpu.h>
++#include <asm/fpu/internal.h>
+
+ #include <xen/interface/xen.h>
+ #include <xen/interface/vcpu.h>
+@@ -58,6 +59,7 @@ static void cpu_bringup(void)
+ int cpu;
+
+ cpu_init();
++ fpu__init_cpu();
+ touch_softlockup_watchdog();
+ preempt_disable();
+
+diff --git a/arch/xtensa/include/asm/bugs.h b/arch/xtensa/include/asm/bugs.h
+deleted file mode 100644
+index 69b29d1982494..0000000000000
+--- a/arch/xtensa/include/asm/bugs.h
++++ /dev/null
+@@ -1,18 +0,0 @@
+-/*
+- * include/asm-xtensa/bugs.h
+- *
+- * This is included by init/main.c to check for architecture-dependent bugs.
+- *
+- * Xtensa processors don't have any bugs. :)
+- *
+- * This file is subject to the terms and conditions of the GNU General
+- * Public License. See the file "COPYING" in the main directory of
+- * this archive for more details.
+- */
+-
+-#ifndef _XTENSA_BUGS_H
+-#define _XTENSA_BUGS_H
+-
+-static void check_bugs(void) { }
+-
+-#endif /* _XTENSA_BUGS_H */
+diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
+index 878ed43d87539..b1bb6f43f8962 100644
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -584,6 +584,12 @@ ssize_t __weak cpu_show_retbleed(struct device *dev,
+ return sysfs_emit(buf, "Not affected\n");
+ }
+
++ssize_t __weak cpu_show_gds(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ return sysfs_emit(buf, "Not affected\n");
++}
++
+ static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
+ static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
+ static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
+@@ -595,6 +601,7 @@ static DEVICE_ATTR(itlb_multihit, 0444, cpu_show_itlb_multihit, NULL);
+ static DEVICE_ATTR(srbds, 0444, cpu_show_srbds, NULL);
+ static DEVICE_ATTR(mmio_stale_data, 0444, cpu_show_mmio_stale_data, NULL);
+ static DEVICE_ATTR(retbleed, 0444, cpu_show_retbleed, NULL);
++static DEVICE_ATTR(gather_data_sampling, 0444, cpu_show_gds, NULL);
+
+ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_meltdown.attr,
+@@ -608,6 +615,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_srbds.attr,
+ &dev_attr_mmio_stale_data.attr,
+ &dev_attr_retbleed.attr,
++ &dev_attr_gather_data_sampling.attr,
+ NULL
+ };
+
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index d2b79d7c0b881..6faf36bfdeafc 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -389,7 +389,7 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
+ struct gnttab_map_grant_ref *gop = queue->tx_map_ops + *map_ops;
+ struct xen_netif_tx_request *txp = first;
+
+- nr_slots = shinfo->nr_frags + 1;
++ nr_slots = shinfo->nr_frags + frag_overflow + 1;
+
+ copy_count(skb) = 0;
+ XENVIF_TX_CB(skb)->split_mask = 0;
+@@ -455,8 +455,8 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
+ }
+ }
+
+- for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots;
+- shinfo->nr_frags++, gop++) {
++ for (shinfo->nr_frags = 0; nr_slots > 0 && shinfo->nr_frags < MAX_SKB_FRAGS;
++ shinfo->nr_frags++, gop++, nr_slots--) {
+ index = pending_index(queue->pending_cons++);
+ pending_idx = queue->pending_ring[index];
+ xenvif_tx_create_map_op(queue, pending_idx, txp,
+@@ -469,12 +469,12 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
+ txp++;
+ }
+
+- if (frag_overflow) {
++ if (nr_slots > 0) {
+
+ shinfo = skb_shinfo(nskb);
+ frags = shinfo->frags;
+
+- for (shinfo->nr_frags = 0; shinfo->nr_frags < frag_overflow;
++ for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots;
+ shinfo->nr_frags++, txp++, gop++) {
+ index = pending_index(queue->pending_cons++);
+ pending_idx = queue->pending_ring[index];
+@@ -485,6 +485,11 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
+ }
+
+ skb_shinfo(skb)->frag_list = nskb;
++ } else if (nskb) {
++ /* A frag_list skb was allocated but it is no longer needed
++ * because enough slots were converted to copy ops above.
++ */
++ kfree_skb(nskb);
+ }
+
+ (*copy_ops) = cop - queue->tx_copy_ops;
+diff --git a/include/asm-generic/bugs.h b/include/asm-generic/bugs.h
+deleted file mode 100644
+index 69021830f078d..0000000000000
+--- a/include/asm-generic/bugs.h
++++ /dev/null
+@@ -1,11 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef __ASM_GENERIC_BUGS_H
+-#define __ASM_GENERIC_BUGS_H
+-/*
+- * This file is included by 'init/main.c' to check for
+- * architecture-dependent bugs.
+- */
+-
+-static inline void check_bugs(void) { }
+-
+-#endif /* __ASM_GENERIC_BUGS_H */
+diff --git a/include/linux/cpu.h b/include/linux/cpu.h
+index 12ed4cb751dee..c376a59a3e426 100644
+--- a/include/linux/cpu.h
++++ b/include/linux/cpu.h
+@@ -170,6 +170,12 @@ void arch_cpu_idle_enter(void);
+ void arch_cpu_idle_exit(void);
+ void arch_cpu_idle_dead(void);
+
++#ifdef CONFIG_ARCH_HAS_CPU_FINALIZE_INIT
++void arch_cpu_finalize_init(void);
++#else
++static inline void arch_cpu_finalize_init(void) { }
++#endif
++
+ int cpu_report_state(int cpu);
+ int cpu_check_up_prepare(int cpu);
+ void cpu_set_state_online(int cpu);
+diff --git a/init/main.c b/init/main.c
+index 489a5aa7ba53c..08c312abbaf18 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -91,10 +91,8 @@
+ #include <linux/cache.h>
+ #include <linux/rodata_test.h>
+ #include <linux/jump_label.h>
+-#include <linux/mem_encrypt.h>
+
+ #include <asm/io.h>
+-#include <asm/bugs.h>
+ #include <asm/setup.h>
+ #include <asm/sections.h>
+ #include <asm/cacheflush.h>
+@@ -493,8 +491,6 @@ void __init __weak thread_stack_cache_init(void)
+ }
+ #endif
+
+-void __init __weak mem_encrypt_init(void) { }
+-
+ bool initcall_debug;
+ core_param(initcall_debug, initcall_debug, bool, 0644);
+
+@@ -674,14 +670,6 @@ asmlinkage __visible void __init start_kernel(void)
+ */
+ locking_selftest();
+
+- /*
+- * This needs to be called before any devices perform DMA
+- * operations that might use the SWIOTLB bounce buffers. It will
+- * mark the bounce buffers as decrypted so that their usage will
+- * not cause "plain-text" data to be decrypted when accessed.
+- */
+- mem_encrypt_init();
+-
+ #ifdef CONFIG_BLK_DEV_INITRD
+ if (initrd_start && !initrd_below_start_ok &&
+ page_to_pfn(virt_to_page((void *)initrd_start)) < min_low_pfn) {
+@@ -700,6 +688,9 @@ asmlinkage __visible void __init start_kernel(void)
+ late_time_init();
+ sched_clock_init();
+ calibrate_delay();
++
++ arch_cpu_finalize_init();
++
+ pid_idr_init();
+ anon_vma_init();
+ #ifdef CONFIG_X86
+@@ -726,7 +717,6 @@ asmlinkage __visible void __init start_kernel(void)
+ taskstats_init_early();
+ delayacct_init();
+
+- check_bugs();
+
+ acpi_subsystem_init();
+ arch_post_acpi_subsys_init();
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-08-11 11:58 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-08-11 11:58 UTC (permalink / raw
To: gentoo-commits
commit: 83969a9a6db88921f9b70e114e8aa94aea497fbb
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 11 11:57:59 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug 11 11:57:59 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=83969a9a
Linux patch 4.19.291
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1290_linux-4.19.291.patch | 22013 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 22017 insertions(+)
diff --git a/0000_README b/0000_README
index a3f10bc0..b68b9988 100644
--- a/0000_README
+++ b/0000_README
@@ -1203,6 +1203,10 @@ Patch: 1289_linux-4.19.290.patch
From: https://www.kernel.org
Desc: Linux 4.19.290
+Patch: 1290_linux-4.19.291.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.291
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1290_linux-4.19.291.patch b/1290_linux-4.19.291.patch
new file mode 100644
index 00000000..9e95eefd
--- /dev/null
+++ b/1290_linux-4.19.291.patch
@@ -0,0 +1,22013 @@
+diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst
+index 30187d49dc2c7..67161e1b0f0bd 100644
+--- a/Documentation/admin-guide/security-bugs.rst
++++ b/Documentation/admin-guide/security-bugs.rst
+@@ -56,31 +56,28 @@ information submitted to the security list and any followup discussions
+ of the report are treated confidentially even after the embargo has been
+ lifted, in perpetuity.
+
+-Coordination
+-------------
+-
+-Fixes for sensitive bugs, such as those that might lead to privilege
+-escalations, may need to be coordinated with the private
+-<linux-distros@vs.openwall.org> mailing list so that distribution vendors
+-are well prepared to issue a fixed kernel upon public disclosure of the
+-upstream fix. Distros will need some time to test the proposed patch and
+-will generally request at least a few days of embargo, and vendor update
+-publication prefers to happen Tuesday through Thursday. When appropriate,
+-the security team can assist with this coordination, or the reporter can
+-include linux-distros from the start. In this case, remember to prefix
+-the email Subject line with "[vs]" as described in the linux-distros wiki:
+-<http://oss-security.openwall.org/wiki/mailing-lists/distros#how-to-use-the-lists>
++Coordination with other groups
++------------------------------
++
++The kernel security team strongly recommends that reporters of potential
++security issues NEVER contact the "linux-distros" mailing list until
++AFTER discussing it with the kernel security team. Do not Cc: both
++lists at once. You may contact the linux-distros mailing list after a
++fix has been agreed on and you fully understand the requirements that
++doing so will impose on you and the kernel community.
++
++The different lists have different goals and the linux-distros rules do
++not contribute to actually fixing any potential security problems.
+
+ CVE assignment
+ --------------
+
+-The security team does not normally assign CVEs, nor do we require them
+-for reports or fixes, as this can needlessly complicate the process and
+-may delay the bug handling. If a reporter wishes to have a CVE identifier
+-assigned ahead of public disclosure, they will need to contact the private
+-linux-distros list, described above. When such a CVE identifier is known
+-before a patch is provided, it is desirable to mention it in the commit
+-message if the reporter agrees.
++The security team does not assign CVEs, nor do we require them for
++reports or fixes, as this can needlessly complicate the process and may
++delay the bug handling. If a reporter wishes to have a CVE identifier
++assigned, they should find one by themselves, for example by contacting
++MITRE directly. However under no circumstances will a patch inclusion
++be delayed to wait for a CVE identifier to arrive.
+
+ Non-disclosure agreements
+ -------------------------
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 3d3d7f5d1c3f1..59003315a9597 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -1180,7 +1180,7 @@ N: owl
+ F: arch/arm/mach-actions/
+ F: arch/arm/boot/dts/owl-*
+ F: arch/arm64/boot/dts/actions/
+-F: drivers/clocksource/owl-*
++F: drivers/clocksource/timer-owl*
+ F: drivers/pinctrl/actions/*
+ F: drivers/soc/actions/
+ F: include/dt-bindings/power/owl-*
+@@ -1603,7 +1603,7 @@ L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+ S: Maintained
+ F: arch/arm/boot/dts/lpc43*
+ F: drivers/clk/nxp/clk-lpc18xx*
+-F: drivers/clocksource/time-lpc32xx.c
++F: drivers/clocksource/timer-lpc32xx.c
+ F: drivers/i2c/busses/i2c-lpc2k.c
+ F: drivers/memory/pl172.c
+ F: drivers/mtd/spi-nor/nxp-spifi.c
+@@ -2219,7 +2219,7 @@ F: arch/arm/mach-vexpress/
+ F: */*/vexpress*
+ F: */*/*/vexpress*
+ F: drivers/clk/versatile/clk-vexpress-osc.c
+-F: drivers/clocksource/versatile.c
++F: drivers/clocksource/timer-versatile.c
+ N: mps2
+
+ ARM/VFP SUPPORT
+@@ -2241,7 +2241,7 @@ M: Tony Prisk <linux@prisktech.co.nz>
+ L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+ S: Maintained
+ F: arch/arm/mach-vt8500/
+-F: drivers/clocksource/vt8500_timer.c
++F: drivers/clocksource/timer-vt8500.c
+ F: drivers/i2c/busses/i2c-wmt.c
+ F: drivers/mmc/host/wmt-sdmmc.c
+ F: drivers/pwm/pwm-vt8500.c
+@@ -2306,7 +2306,7 @@ F: drivers/cpuidle/cpuidle-zynq.c
+ F: drivers/block/xsysace.c
+ N: zynq
+ N: xilinx
+-F: drivers/clocksource/cadence_ttc_timer.c
++F: drivers/clocksource/timer-cadence-ttc.c
+ F: drivers/i2c/busses/i2c-cadence.c
+ F: drivers/mmc/host/sdhci-of-arasan.c
+ F: drivers/edac/synopsys_edac.c
+diff --git a/Makefile b/Makefile
+index 5cd8768fc083f..f110fc4f127fa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 290
++SUBLEVEL = 291
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arc/include/asm/entry-arcv2.h b/arch/arc/include/asm/entry-arcv2.h
+index 225e7df2d8ed8..0733752ce7fe8 100644
+--- a/arch/arc/include/asm/entry-arcv2.h
++++ b/arch/arc/include/asm/entry-arcv2.h
+@@ -7,232 +7,252 @@
+ #include <asm/irqflags-arcv2.h>
+ #include <asm/thread_info.h> /* For THREAD_SIZE */
+
++/*
++ * Interrupt/Exception stack layout (pt_regs) for ARCv2
++ * (End of struct aligned to end of page [unless nested])
++ *
++ * INTERRUPT EXCEPTION
++ *
++ * manual --------------------- manual
++ * | orig_r0 |
++ * | event/ECR |
++ * | bta |
++ * | user_r25 |
++ * | gp |
++ * | fp |
++ * | sp |
++ * | r12 |
++ * | r30 |
++ * | r58 |
++ * | r59 |
++ * hw autosave ---------------------
++ * optional | r0 |
++ * | r1 |
++ * ~ ~
++ * | r9 |
++ * | r10 |
++ * | r11 |
++ * | blink |
++ * | lpe |
++ * | lps |
++ * | lpc |
++ * | ei base |
++ * | ldi base |
++ * | jli base |
++ * ---------------------
++ * hw autosave | pc / eret |
++ * mandatory | stat32 / erstatus |
++ * ---------------------
++ */
++
+ /*------------------------------------------------------------------------*/
+-.macro INTERRUPT_PROLOGUE called_from
++.macro INTERRUPT_PROLOGUE
+
+- ; Before jumping to Interrupt Vector, hardware micro-ops did following:
++ ; (A) Before jumping to Interrupt Vector, hardware micro-ops did following:
+ ; 1. SP auto-switched to kernel mode stack
+- ; 2. STATUS32.Z flag set to U mode at time of interrupt (U:1, K:0)
+- ; 3. Auto saved: r0-r11, blink, LPE,LPS,LPC, JLI,LDI,EI, PC, STAT32
++ ; 2. STATUS32.Z flag set if in U mode at time of interrupt (U:1,K:0)
++ ; 3. Auto save: (mandatory) Push PC and STAT32 on stack
++ ; hardware does even if CONFIG_ARC_IRQ_NO_AUTOSAVE
++ ; 4. Auto save: (optional) r0-r11, blink, LPE,LPS,LPC, JLI,LDI,EI
+ ;
+- ; Now manually save: r12, sp, fp, gp, r25
++ ; (B) Manually saved some regs: r12,r25,r30, sp,fp,gp, ACCL pair
+
+ #ifdef CONFIG_ARC_IRQ_NO_AUTOSAVE
+-.ifnc \called_from, exception
+- st.as r9, [sp, -10] ; save r9 in it's final stack slot
+- sub sp, sp, 12 ; skip JLI, LDI, EI
+-
+- PUSH lp_count
+- PUSHAX lp_start
+- PUSHAX lp_end
+- PUSH blink
+-
+- PUSH r11
+- PUSH r10
+-
+- sub sp, sp, 4 ; skip r9
+-
+- PUSH r8
+- PUSH r7
+- PUSH r6
+- PUSH r5
+- PUSH r4
+- PUSH r3
+- PUSH r2
+- PUSH r1
+- PUSH r0
+-.endif
+-#endif
++ ; carve pt_regs on stack (case #3), PC/STAT32 already on stack
++ sub sp, sp, SZ_PT_REGS - 8
+
+-#ifdef CONFIG_ARC_HAS_ACCL_REGS
+- PUSH r59
+- PUSH r58
++ __SAVE_REGFILE_HARD
++#else
++ ; carve pt_regs on stack (case #4), which grew partially already
++ sub sp, sp, PT_r0
+ #endif
+
+- PUSH r30
+- PUSH r12
++ __SAVE_REGFILE_SOFT
++.endm
++
++/*------------------------------------------------------------------------*/
++.macro EXCEPTION_PROLOGUE
++
++ ; (A) Before jumping to Exception Vector, hardware micro-ops did following:
++ ; 1. SP auto-switched to kernel mode stack
++ ; 2. STATUS32.Z flag set if in U mode at time of exception (U:1,K:0)
++ ;
++ ; (B) Manually save the complete reg file below
++
++ sub sp, sp, SZ_PT_REGS ; carve pt_regs
++
++ ; _HARD saves r10 clobbered by _SOFT as scratch hence comes first
++
++ __SAVE_REGFILE_HARD
++ __SAVE_REGFILE_SOFT
++
++ st r0, [sp] ; orig_r0
++
++ lr r10, [eret]
++ lr r11, [erstatus]
++ ST2 r10, r11, PT_ret
++
++ lr r10, [ecr]
++ lr r11, [erbta]
++ ST2 r10, r11, PT_event
++ mov r9, r10
++
++ ; OUTPUT: r9 has ECR
++.endm
++
++/*------------------------------------------------------------------------
++ * This macro saves the registers manually which would normally be autosaved
++ * by hardware on taken interrupts. It is used by
++ * - exception handlers (which don't have autosave)
++ * - interrupt autosave disabled due to CONFIG_ARC_IRQ_NO_AUTOSAVE
++ */
++.macro __SAVE_REGFILE_HARD
++
++ ST2 r0, r1, PT_r0
++ ST2 r2, r3, PT_r2
++ ST2 r4, r5, PT_r4
++ ST2 r6, r7, PT_r6
++ ST2 r8, r9, PT_r8
++ ST2 r10, r11, PT_r10
++
++ st blink, [sp, PT_blink]
++
++ lr r10, [lp_end]
++ lr r11, [lp_start]
++ ST2 r10, r11, PT_lpe
++
++ st lp_count, [sp, PT_lpc]
++
++ ; skip JLI, LDI, EI for now
++.endm
++
++/*------------------------------------------------------------------------
++ * This macros saves a bunch of other registers which can't be autosaved for
++ * various reasons:
++ * - r12: the last caller saved scratch reg since hardware saves in pairs so r0-r11
++ * - r30: free reg, used by gcc as scratch
++ * - ACCL/ACCH pair when they exist
++ */
++.macro __SAVE_REGFILE_SOFT
++
++ ST2 gp, fp, PT_r26 ; gp (r26), fp (r27)
++
++ st r12, [sp, PT_sp + 4]
++ st r30, [sp, PT_sp + 8]
+
+ ; Saving pt_regs->sp correctly requires some extra work due to the way
+ ; Auto stack switch works
+ ; - U mode: retrieve it from AUX_USER_SP
+ ; - K mode: add the offset from current SP where H/w starts auto push
+ ;
+- ; Utilize the fact that Z bit is set if Intr taken in U mode
+- mov.nz r9, sp
+- add.nz r9, r9, SZ_PT_REGS - PT_sp - 4
+- bnz 1f
++ ; 1. Utilize the fact that Z bit is set if Intr taken in U mode
++ ; 2. Upon entry SP is always saved (for any inspection, unwinding etc),
++ ; but on return, restored only if U mode
+
+- lr r9, [AUX_USER_SP]
+-1:
+- PUSH r9 ; SP
++ lr r10, [AUX_USER_SP] ; U mode SP
++
++ ; ISA requires ADD.nz to have same dest and src reg operands
++ mov.nz r10, sp
++ add.nz r10, r10, SZ_PT_REGS ; K mode SP
+
+- PUSH fp
+- PUSH gp
++ st r10, [sp, PT_sp] ; SP (pt_regs->sp)
+
+ #ifdef CONFIG_ARC_CURR_IN_REG
+- PUSH r25 ; user_r25
++ st r25, [sp, PT_user_r25]
+ GET_CURR_TASK_ON_CPU r25
+-#else
+- sub sp, sp, 4
+ #endif
+
+-.ifnc \called_from, exception
+- sub sp, sp, 12 ; BTA/ECR/orig_r0 placeholder per pt_regs
+-.endif
++#ifdef CONFIG_ARC_HAS_ACCL_REGS
++ ST2 r58, r59, PT_sp + 12
++#endif
+
+ .endm
+
+ /*------------------------------------------------------------------------*/
+-.macro INTERRUPT_EPILOGUE called_from
++.macro __RESTORE_REGFILE_SOFT
+
+-.ifnc \called_from, exception
+- add sp, sp, 12 ; skip BTA/ECR/orig_r0 placeholderss
+-.endif
++ LD2 gp, fp, PT_r26 ; gp (r26), fp (r27)
+
+-#ifdef CONFIG_ARC_CURR_IN_REG
+- POP r25
+-#else
+- add sp, sp, 4
+-#endif
++ ld r12, [sp, PT_sp + 4]
++ ld r30, [sp, PT_sp + 8]
+
+- POP gp
+- POP fp
+-
+- ; Don't touch AUX_USER_SP if returning to K mode (Z bit set)
+- ; (Z bit set on K mode is inverse of INTERRUPT_PROLOGUE)
+- add.z sp, sp, 4
++ ; Restore SP (into AUX_USER_SP) only if returning to U mode
++ ; - for K mode, it will be implicitly restored as stack is unwound
++ ; - Z flag set on K is inverse of what hardware does on interrupt entry
++ ; but that doesn't really matter
+ bz 1f
+
+- POPAX AUX_USER_SP
++ ld r10, [sp, PT_sp] ; SP (pt_regs->sp)
++ sr r10, [AUX_USER_SP]
+ 1:
+- POP r12
+- POP r30
+
+-#ifdef CONFIG_ARC_HAS_ACCL_REGS
+- POP r58
+- POP r59
++#ifdef CONFIG_ARC_CURR_IN_REG
++ ld r25, [sp, PT_user_r25]
+ #endif
+
+-#ifdef CONFIG_ARC_IRQ_NO_AUTOSAVE
+-.ifnc \called_from, exception
+- POP r0
+- POP r1
+- POP r2
+- POP r3
+- POP r4
+- POP r5
+- POP r6
+- POP r7
+- POP r8
+- POP r9
+- POP r10
+- POP r11
+-
+- POP blink
+- POPAX lp_end
+- POPAX lp_start
+-
+- POP r9
+- mov lp_count, r9
+-
+- add sp, sp, 12 ; skip JLI, LDI, EI
+- ld.as r9, [sp, -10] ; reload r9 which got clobbered
+-.endif
++#ifdef CONFIG_ARC_HAS_ACCL_REGS
++ LD2 r58, r59, PT_sp + 12
+ #endif
++.endm
+
++/*------------------------------------------------------------------------*/
++.macro __RESTORE_REGFILE_HARD
++
++ ld blink, [sp, PT_blink]
++
++ LD2 r10, r11, PT_lpe
++ sr r10, [lp_end]
++ sr r11, [lp_start]
++
++ ld r10, [sp, PT_lpc] ; lp_count can't be target of LD
++ mov lp_count, r10
++
++ LD2 r0, r1, PT_r0
++ LD2 r2, r3, PT_r2
++ LD2 r4, r5, PT_r4
++ LD2 r6, r7, PT_r6
++ LD2 r8, r9, PT_r8
++ LD2 r10, r11, PT_r10
+ .endm
+
++
+ /*------------------------------------------------------------------------*/
+-.macro EXCEPTION_PROLOGUE
++.macro INTERRUPT_EPILOGUE
+
+- ; Before jumping to Exception Vector, hardware micro-ops did following:
+- ; 1. SP auto-switched to kernel mode stack
+- ; 2. STATUS32.Z flag set to U mode at time of interrupt (U:1,K:0)
+- ;
+- ; Now manually save the complete reg file
+-
+- PUSH r9 ; freeup a register: slot of erstatus
+-
+- PUSHAX eret
+- sub sp, sp, 12 ; skip JLI, LDI, EI
+- PUSH lp_count
+- PUSHAX lp_start
+- PUSHAX lp_end
+- PUSH blink
+-
+- PUSH r11
+- PUSH r10
+-
+- ld.as r9, [sp, 10] ; load stashed r9 (status32 stack slot)
+- lr r10, [erstatus]
+- st.as r10, [sp, 10] ; save status32 at it's right stack slot
+-
+- PUSH r9
+- PUSH r8
+- PUSH r7
+- PUSH r6
+- PUSH r5
+- PUSH r4
+- PUSH r3
+- PUSH r2
+- PUSH r1
+- PUSH r0
+-
+- ; -- for interrupts, regs above are auto-saved by h/w in that order --
+- ; Now do what ISR prologue does (manually save r12, sp, fp, gp, r25)
+- ;
+- ; Set Z flag if this was from U mode (expected by INTERRUPT_PROLOGUE)
+- ; Although H/w exception micro-ops do set Z flag for U mode (just like
+- ; for interrupts), it could get clobbered in case we soft land here from
+- ; a TLB Miss exception handler (tlbex.S)
++ ; INPUT: r0 has STAT32 of calling context
++ ; INPUT: Z flag set if returning to K mode
+
+- and r10, r10, STATUS_U_MASK
+- xor.f 0, r10, STATUS_U_MASK
++ ; _SOFT clobbers r10 restored by _HARD hence the order
+
+- INTERRUPT_PROLOGUE exception
++ __RESTORE_REGFILE_SOFT
+
+- PUSHAX erbta
+- PUSHAX ecr ; r9 contains ECR, expected by EV_Trap
++#ifdef CONFIG_ARC_IRQ_NO_AUTOSAVE
++ __RESTORE_REGFILE_HARD
++ add sp, sp, SZ_PT_REGS - 8
++#else
++ add sp, sp, PT_r0
++#endif
+
+- PUSH r0 ; orig_r0
+ .endm
+
+ /*------------------------------------------------------------------------*/
+ .macro EXCEPTION_EPILOGUE
+
+- ; Assumes r0 has PT_status32
+- btst r0, STATUS_U_BIT ; Z flag set if K, used in INTERRUPT_EPILOGUE
+-
+- add sp, sp, 8 ; orig_r0/ECR don't need restoring
+- POPAX erbta
+-
+- INTERRUPT_EPILOGUE exception
++ ; INPUT: r0 has STAT32 of calling context
+
+- POP r0
+- POP r1
+- POP r2
+- POP r3
+- POP r4
+- POP r5
+- POP r6
+- POP r7
+- POP r8
+- POP r9
+- POP r10
+- POP r11
++ btst r0, STATUS_U_BIT ; Z flag set if K, used in restoring SP
+
+- POP blink
+- POPAX lp_end
+- POPAX lp_start
++ ld r10, [sp, PT_event + 4]
++ sr r10, [erbta]
+
+- POP r9
+- mov lp_count, r9
++ LD2 r10, r11, PT_ret
++ sr r10, [eret]
++ sr r11, [erstatus]
+
+- add sp, sp, 12 ; skip JLI, LDI, EI
+- POPAX eret
+- POPAX erstatus
++ __RESTORE_REGFILE_SOFT
++ __RESTORE_REGFILE_HARD
+
+- ld.as r9, [sp, -12] ; reload r9 which got clobbered
++ add sp, sp, SZ_PT_REGS
+ .endm
+
+ .macro FAKE_RET_FROM_EXCPN
+diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h
+index 07c8e1a6c56e2..b89ca8b4d5975 100644
+--- a/arch/arc/include/asm/linkage.h
++++ b/arch/arc/include/asm/linkage.h
+@@ -11,12 +11,30 @@
+
+ #include <asm/dwarf.h>
+
+-#ifdef __ASSEMBLY__
+-
+ #define ASM_NL ` /* use '`' to mark new line in macro */
+ #define __ALIGN .align 4
+ #define __ALIGN_STR __stringify(__ALIGN)
+
++#ifdef __ASSEMBLY__
++
++.macro ST2 e, o, off
++#ifdef CONFIG_ARC_HAS_LL64
++ std \e, [sp, \off]
++#else
++ st \e, [sp, \off]
++ st \o, [sp, \off+4]
++#endif
++.endm
++
++.macro LD2 e, o, off
++#ifdef CONFIG_ARC_HAS_LL64
++ ldd \e, [sp, \off]
++#else
++ ld \e, [sp, \off]
++ ld \o, [sp, \off+4]
++#endif
++.endm
++
+ /* annotation for data we want in DCCM - if enabled in .config */
+ .macro ARCFP_DATA nm
+ #ifdef CONFIG_ARC_HAS_DCCM
+diff --git a/arch/arc/kernel/asm-offsets.c b/arch/arc/kernel/asm-offsets.c
+index ecaf34e9235c2..e90dccecfd833 100644
+--- a/arch/arc/kernel/asm-offsets.c
++++ b/arch/arc/kernel/asm-offsets.c
+@@ -58,7 +58,14 @@ int main(void)
+ DEFINE(PT_r5, offsetof(struct pt_regs, r5));
+ DEFINE(PT_r6, offsetof(struct pt_regs, r6));
+ DEFINE(PT_r7, offsetof(struct pt_regs, r7));
++ DEFINE(PT_r8, offsetof(struct pt_regs, r8));
++ DEFINE(PT_r10, offsetof(struct pt_regs, r10));
++ DEFINE(PT_r26, offsetof(struct pt_regs, r26));
+ DEFINE(PT_ret, offsetof(struct pt_regs, ret));
++ DEFINE(PT_blink, offsetof(struct pt_regs, blink));
++ DEFINE(PT_lpe, offsetof(struct pt_regs, lp_end));
++ DEFINE(PT_lpc, offsetof(struct pt_regs, lp_count));
++ DEFINE(PT_user_r25, offsetof(struct pt_regs, user_r25));
+
+ DEFINE(SZ_CALLEE_REGS, sizeof(struct callee_regs));
+ DEFINE(SZ_PT_REGS, sizeof(struct pt_regs));
+diff --git a/arch/arc/kernel/entry-arcv2.S b/arch/arc/kernel/entry-arcv2.S
+index 562089d62d9d6..6cbf0ee8a20a7 100644
+--- a/arch/arc/kernel/entry-arcv2.S
++++ b/arch/arc/kernel/entry-arcv2.S
+@@ -70,7 +70,7 @@ reserved:
+
+ ENTRY(handle_interrupt)
+
+- INTERRUPT_PROLOGUE irq
++ INTERRUPT_PROLOGUE
+
+ # irq control APIs local_irq_save/restore/disable/enable fiddle with
+ # global interrupt enable bits in STATUS32 (.IE for 1 prio, .E[] for 2 prio)
+@@ -226,7 +226,7 @@ debug_marker_l1:
+ bset.nz r11, r11, AUX_IRQ_ACT_BIT_U ; NZ means U
+ sr r11, [AUX_IRQ_ACT]
+
+- INTERRUPT_EPILOGUE irq
++ INTERRUPT_EPILOGUE
+ rtie
+
+ ;####### Return from Exception / pure kernel mode #######
+diff --git a/arch/arc/mm/tlbex.S b/arch/arc/mm/tlbex.S
+index 0e1e47a67c736..e50cac799a518 100644
+--- a/arch/arc/mm/tlbex.S
++++ b/arch/arc/mm/tlbex.S
+@@ -396,6 +396,17 @@ EV_TLBMissD_fast_ret: ; additional label for VDK OS-kit instrumentation
+ ;-------- Common routine to call Linux Page Fault Handler -----------
+ do_slow_path_pf:
+
++#ifdef CONFIG_ISA_ARCV2
++ ; Set Z flag if exception in U mode. Hardware micro-ops do this on any
++ ; taken interrupt/exception, and thus is already the case at the entry
++ ; above, but ensuing code would have already clobbered.
++ ; EXCEPTION_PROLOGUE called in slow path, relies on correct Z flag set
++
++ lr r2, [erstatus]
++ and r2, r2, STATUS_U_MASK
++ bxor.f 0, r2, STATUS_U_BIT
++#endif
++
+ ; Restore the 4-scratch regs saved by fast path miss handler
+ TLBMISS_RESTORE_REGS
+
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index 6edc4bd1e7eaf..a6406a347690e 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -468,7 +468,6 @@
+ "spi_lr_session_done",
+ "spi_lr_overread";
+ clocks = <&iprocmed>;
+- clock-names = "iprocmed";
+ num-cs = <2>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
+index d91cc532d0e2c..fcd7e4dc949a1 100644
+--- a/arch/arm/boot/dts/imx6qdl.dtsi
++++ b/arch/arm/boot/dts/imx6qdl.dtsi
+@@ -46,6 +46,10 @@
+ spi1 = &ecspi2;
+ spi2 = &ecspi3;
+ spi3 = &ecspi4;
++ usb0 = &usbotg;
++ usb1 = &usbh1;
++ usb2 = &usbh2;
++ usb3 = &usbh3;
+ usbphy0 = &usbphy1;
+ usbphy1 = &usbphy2;
+ };
+diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
+index afde0ed6d71af..b00f791471c66 100644
+--- a/arch/arm/boot/dts/imx6sl.dtsi
++++ b/arch/arm/boot/dts/imx6sl.dtsi
+@@ -32,6 +32,9 @@
+ spi1 = &ecspi2;
+ spi2 = &ecspi3;
+ spi3 = &ecspi4;
++ usb0 = &usbotg1;
++ usb1 = &usbotg2;
++ usb2 = &usbh;
+ usbphy0 = &usbphy1;
+ usbphy1 = &usbphy2;
+ };
+diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi
+index d7d092a5522a3..9f0c82d79a361 100644
+--- a/arch/arm/boot/dts/imx6sll.dtsi
++++ b/arch/arm/boot/dts/imx6sll.dtsi
+@@ -36,6 +36,8 @@
+ spi1 = &ecspi2;
+ spi3 = &ecspi3;
+ spi4 = &ecspi4;
++ usb0 = &usbotg1;
++ usb1 = &usbotg2;
+ usbphy0 = &usbphy1;
+ usbphy1 = &usbphy2;
+ };
+@@ -49,20 +51,18 @@
+ device_type = "cpu";
+ reg = <0>;
+ next-level-cache = <&L2>;
+- operating-points = <
++ operating-points =
+ /* kHz uV */
+- 996000 1275000
+- 792000 1175000
+- 396000 1075000
+- 198000 975000
+- >;
+- fsl,soc-operating-points = <
++ <996000 1275000>,
++ <792000 1175000>,
++ <396000 1075000>,
++ <198000 975000>;
++ fsl,soc-operating-points =
+ /* ARM kHz SOC-PU uV */
+- 996000 1175000
+- 792000 1175000
+- 396000 1175000
+- 198000 1175000
+- >;
++ <996000 1175000>,
++ <792000 1175000>,
++ <396000 1175000>,
++ <198000 1175000>;
+ clock-latency = <61036>; /* two CLK32 periods */
+ clocks = <&clks IMX6SLL_CLK_ARM>,
+ <&clks IMX6SLL_CLK_PLL2_PFD2>,
+@@ -271,7 +271,7 @@
+ status = "disabled";
+ };
+
+- ssi1: ssi-controller@2028000 {
++ ssi1: ssi@2028000 {
+ compatible = "fsl,imx6sl-ssi", "fsl,imx51-ssi";
+ reg = <0x02028000 0x4000>;
+ interrupts = <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>;
+@@ -284,7 +284,7 @@
+ status = "disabled";
+ };
+
+- ssi2: ssi-controller@202c000 {
++ ssi2: ssi@202c000 {
+ compatible = "fsl,imx6sl-ssi", "fsl,imx51-ssi";
+ reg = <0x0202c000 0x4000>;
+ interrupts = <GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>;
+@@ -297,7 +297,7 @@
+ status = "disabled";
+ };
+
+- ssi3: ssi-controller@2030000 {
++ ssi3: ssi@2030000 {
+ compatible = "fsl,imx6sl-ssi", "fsl,imx51-ssi";
+ reg = <0x02030000 0x4000>;
+ interrupts = <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>;
+@@ -518,7 +518,7 @@
+ reg = <0x020ca000 0x1000>;
+ interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX6SLL_CLK_USBPHY2>;
+- phy-reg_3p0-supply = <®_3p0>;
++ phy-3p0-supply = <®_3p0>;
+ fsl,anatop = <&anatop>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
+index b9ab1118be30b..a0c0e631ebbe6 100644
+--- a/arch/arm/boot/dts/imx6sx.dtsi
++++ b/arch/arm/boot/dts/imx6sx.dtsi
+@@ -49,6 +49,9 @@
+ spi2 = &ecspi3;
+ spi3 = &ecspi4;
+ spi4 = &ecspi5;
++ usb0 = &usbotg1;
++ usb1 = &usbotg2;
++ usb2 = &usbh;
+ usbphy0 = &usbphy1;
+ usbphy1 = &usbphy2;
+ };
+diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
+index 334638ff50750..dcb187995f760 100644
+--- a/arch/arm/boot/dts/imx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul.dtsi
+@@ -47,6 +47,8 @@
+ spi1 = &ecspi2;
+ spi2 = &ecspi3;
+ spi3 = &ecspi4;
++ usb0 = &usbotg1;
++ usb1 = &usbotg2;
+ usbphy0 = &usbphy1;
+ usbphy1 = &usbphy2;
+ };
+diff --git a/arch/arm/boot/dts/imx7d.dtsi b/arch/arm/boot/dts/imx7d.dtsi
+index 7234e8330a576..34904f7eeb133 100644
+--- a/arch/arm/boot/dts/imx7d.dtsi
++++ b/arch/arm/boot/dts/imx7d.dtsi
+@@ -7,6 +7,12 @@
+ #include <dt-bindings/reset/imx7-reset.h>
+
+ / {
++ aliases {
++ usb0 = &usbotg1;
++ usb1 = &usbotg2;
++ usb2 = &usbh;
++ };
++
+ cpus {
+ cpu0: cpu@0 {
+ clock-frequency = <996000000>;
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index 7eaf96b425bed..8a6d698e253d2 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -46,6 +46,8 @@
+ spi1 = &ecspi2;
+ spi2 = &ecspi3;
+ spi3 = &ecspi4;
++ usb0 = &usbotg1;
++ usb1 = &usbh;
+ };
+
+ cpus {
+diff --git a/arch/arm/mach-ep93xx/timer-ep93xx.c b/arch/arm/mach-ep93xx/timer-ep93xx.c
+index de998830f534f..b07956883e165 100644
+--- a/arch/arm/mach-ep93xx/timer-ep93xx.c
++++ b/arch/arm/mach-ep93xx/timer-ep93xx.c
+@@ -9,6 +9,7 @@
+ #include <linux/io.h>
+ #include <asm/mach/time.h>
+ #include "soc.h"
++#include "platform.h"
+
+ /*************************************************************************
+ * Timer handling for EP93xx
+@@ -60,7 +61,7 @@ static u64 notrace ep93xx_read_sched_clock(void)
+ return ret;
+ }
+
+-u64 ep93xx_clocksource_read(struct clocksource *c)
++static u64 ep93xx_clocksource_read(struct clocksource *c)
+ {
+ u64 ret;
+
+diff --git a/arch/arm/mach-orion5x/board-dt.c b/arch/arm/mach-orion5x/board-dt.c
+index 3d36f1d951964..3f651df3a71cf 100644
+--- a/arch/arm/mach-orion5x/board-dt.c
++++ b/arch/arm/mach-orion5x/board-dt.c
+@@ -63,6 +63,9 @@ static void __init orion5x_dt_init(void)
+ if (of_machine_is_compatible("maxtor,shared-storage-2"))
+ mss2_init();
+
++ if (of_machine_is_compatible("lacie,d2-network"))
++ d2net_init();
++
+ of_platform_default_populate(NULL, orion5x_auxdata_lookup, NULL);
+ }
+
+diff --git a/arch/arm/mach-orion5x/common.h b/arch/arm/mach-orion5x/common.h
+index eb96009e21c4c..b9cfdb4564568 100644
+--- a/arch/arm/mach-orion5x/common.h
++++ b/arch/arm/mach-orion5x/common.h
+@@ -75,6 +75,12 @@ extern void mss2_init(void);
+ static inline void mss2_init(void) {}
+ #endif
+
++#ifdef CONFIG_MACH_D2NET_DT
++void d2net_init(void);
++#else
++static inline void d2net_init(void) {}
++#endif
++
+ /*****************************************************************************
+ * Helpers to access Orion registers
+ ****************************************************************************/
+diff --git a/arch/arm/mach-sa1100/assabet.c b/arch/arm/mach-sa1100/assabet.c
+index 575ec085cffaf..73bedccedb581 100644
+--- a/arch/arm/mach-sa1100/assabet.c
++++ b/arch/arm/mach-sa1100/assabet.c
+@@ -570,7 +570,7 @@ static void __init map_sa1100_gpio_regs( void )
+ */
+ static void __init get_assabet_scr(void)
+ {
+- unsigned long uninitialized_var(scr), i;
++ unsigned long scr, i;
+
+ GPDR |= 0x3fc; /* Configure GPIO 9:2 as outputs */
+ GPSR = 0x3fc; /* Write 0xFF to GPIO 9:2 */
+diff --git a/arch/arm/probes/kprobes/checkers-common.c b/arch/arm/probes/kprobes/checkers-common.c
+index 971119c294741..aa10e5e46ebb2 100644
+--- a/arch/arm/probes/kprobes/checkers-common.c
++++ b/arch/arm/probes/kprobes/checkers-common.c
+@@ -48,7 +48,7 @@ enum probes_insn checker_stack_use_imm_0xx(probes_opcode_t insn,
+ * Different from other insn uses imm8, the real addressing offset of
+ * STRD in T32 encoding should be imm8 * 4. See ARMARM description.
+ */
+-enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn,
++static enum probes_insn checker_stack_use_t32strd(probes_opcode_t insn,
+ struct arch_probes_insn *asi,
+ const struct decode_header *h)
+ {
+diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c
+index 62da8e2211e4b..0a7090a65bcad 100644
+--- a/arch/arm/probes/kprobes/core.c
++++ b/arch/arm/probes/kprobes/core.c
+@@ -239,7 +239,7 @@ singlestep(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *kcb)
+ * kprobe, and that level is reserved for user kprobe handlers, so we can't
+ * risk encountering a new kprobe in an interrupt handler.
+ */
+-void __kprobes kprobe_handler(struct pt_regs *regs)
++static void __kprobes kprobe_handler(struct pt_regs *regs)
+ {
+ struct kprobe *p, *cur;
+ struct kprobe_ctlblk *kcb;
+diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c
+index cf08cb7267670..1516c340a0766 100644
+--- a/arch/arm/probes/kprobes/opt-arm.c
++++ b/arch/arm/probes/kprobes/opt-arm.c
+@@ -158,8 +158,6 @@ __arch_remove_optimized_kprobe(struct optimized_kprobe *op, int dirty)
+ }
+ }
+
+-extern void kprobe_handler(struct pt_regs *regs);
+-
+ static void
+ optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs)
+ {
+diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c
+index cc237fa9b90fb..1c86c5d980c5b 100644
+--- a/arch/arm/probes/kprobes/test-core.c
++++ b/arch/arm/probes/kprobes/test-core.c
+@@ -723,7 +723,7 @@ static const char coverage_register_lookup[16] = {
+ [REG_TYPE_NOSPPCX] = COVERAGE_ANY_REG | COVERAGE_SP,
+ };
+
+-unsigned coverage_start_registers(const struct decode_header *h)
++static unsigned coverage_start_registers(const struct decode_header *h)
+ {
+ unsigned regs = 0;
+ int i;
+diff --git a/arch/arm/probes/kprobes/test-core.h b/arch/arm/probes/kprobes/test-core.h
+index 94285203e9f74..459ebda077139 100644
+--- a/arch/arm/probes/kprobes/test-core.h
++++ b/arch/arm/probes/kprobes/test-core.h
+@@ -456,3 +456,7 @@ void kprobe_thumb32_test_cases(void);
+ #else
+ void kprobe_arm_test_cases(void);
+ #endif
++
++void __kprobes_test_case_start(void);
++void __kprobes_test_case_end_16(void);
++void __kprobes_test_case_end_32(void);
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+index 636bab51de38d..40a54b55ababd 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+@@ -125,7 +125,7 @@
+ status = "okay";
+ clock-frequency = <100000>;
+ i2c-sda-falling-time-ns = <890>; /* hcnt */
+- i2c-sdl-falling-time-ns = <890>; /* lcnt */
++ i2c-scl-falling-time-ns = <890>; /* lcnt */
+
+ adc@14 {
+ compatible = "lltc,ltc2497";
+diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
+index 8bf3091a899c8..5abffdaf4077e 100644
+--- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
++++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi
+@@ -165,7 +165,7 @@
+ };
+
+ scif1_pins: scif1 {
+- groups = "scif1_data_b", "scif1_ctrl";
++ groups = "scif1_data_b";
+ function = "scif1";
+ };
+
+@@ -178,7 +178,6 @@
+ &scif1 {
+ pinctrl-0 = <&scif1_pins>;
+ pinctrl-names = "default";
+- uart-has-rtscts;
+
+ status = "okay";
+ };
+diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c
+index 968b5f33e725e..1a8e20652e7ce 100644
+--- a/arch/ia64/kernel/process.c
++++ b/arch/ia64/kernel/process.c
+@@ -444,7 +444,7 @@ static void
+ do_copy_task_regs (struct task_struct *task, struct unw_frame_info *info, void *arg)
+ {
+ unsigned long mask, sp, nat_bits = 0, ar_rnat, urbs_end, cfm;
+- unsigned long uninitialized_var(ip); /* GCC be quiet */
++ unsigned long ip;
+ elf_greg_t *dst = arg;
+ struct pt_regs *pt;
+ char nat;
+diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c
+index db3104c9fac53..33f68be018a22 100644
+--- a/arch/ia64/mm/discontig.c
++++ b/arch/ia64/mm/discontig.c
+@@ -181,7 +181,7 @@ static void *per_cpu_node_setup(void *cpu_data, int node)
+ void __init setup_per_cpu_areas(void)
+ {
+ struct pcpu_alloc_info *ai;
+- struct pcpu_group_info *uninitialized_var(gi);
++ struct pcpu_group_info *gi;
+ unsigned int *cpu_map;
+ void *base;
+ unsigned long base_offset;
+diff --git a/arch/ia64/mm/tlb.c b/arch/ia64/mm/tlb.c
+index acf10eb9da15c..02470929fb393 100644
+--- a/arch/ia64/mm/tlb.c
++++ b/arch/ia64/mm/tlb.c
+@@ -339,7 +339,7 @@ EXPORT_SYMBOL(flush_tlb_range);
+
+ void ia64_tlb_init(void)
+ {
+- ia64_ptce_info_t uninitialized_var(ptce_info); /* GCC be quiet */
++ ia64_ptce_info_t ptce_info;
+ u64 tr_pgbits;
+ long status;
+ pal_vm_info_1_u_t vm_info_1;
+diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
+index ffe0cf0f0bea2..923b3b794d13f 100644
+--- a/arch/powerpc/Kconfig.debug
++++ b/arch/powerpc/Kconfig.debug
+@@ -232,7 +232,7 @@ config PPC_EARLY_DEBUG_40x
+
+ config PPC_EARLY_DEBUG_CPM
+ bool "Early serial debugging for Freescale CPM-based serial ports"
+- depends on SERIAL_CPM
++ depends on SERIAL_CPM=y
+ help
+ Select this to enable early debugging for Freescale chips
+ using a CPM-based serial port. This assumes that the bootwrapper
+diff --git a/arch/powerpc/include/asm/word-at-a-time.h b/arch/powerpc/include/asm/word-at-a-time.h
+index f3f4710d4ff52..99129b0cd8b8a 100644
+--- a/arch/powerpc/include/asm/word-at-a-time.h
++++ b/arch/powerpc/include/asm/word-at-a-time.h
+@@ -34,7 +34,7 @@ static inline long find_zero(unsigned long mask)
+ return leading_zero_bits >> 3;
+ }
+
+-static inline bool has_zero(unsigned long val, unsigned long *data, const struct word_at_a_time *c)
++static inline unsigned long has_zero(unsigned long val, unsigned long *data, const struct word_at_a_time *c)
+ {
+ unsigned long rhs = val | c->low_bits;
+ *data = rhs;
+diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
+index a5091c0347475..aff86679af961 100644
+--- a/arch/powerpc/mm/init_64.c
++++ b/arch/powerpc/mm/init_64.c
+@@ -266,8 +266,7 @@ void __ref vmemmap_free(unsigned long start, unsigned long end,
+ start = _ALIGN_DOWN(start, page_size);
+ if (altmap) {
+ alt_start = altmap->base_pfn;
+- alt_end = altmap->base_pfn + altmap->reserve +
+- altmap->free + altmap->alloc + altmap->align;
++ alt_end = altmap->base_pfn + altmap->reserve + altmap->free;
+ }
+
+ pr_debug("vmemmap_free %lx...%lx\n", start, end);
+diff --git a/arch/powerpc/platforms/52xx/mpc52xx_pic.c b/arch/powerpc/platforms/52xx/mpc52xx_pic.c
+index fc98912f42cf6..76a8102bdb987 100644
+--- a/arch/powerpc/platforms/52xx/mpc52xx_pic.c
++++ b/arch/powerpc/platforms/52xx/mpc52xx_pic.c
+@@ -340,7 +340,7 @@ static int mpc52xx_irqhost_map(struct irq_domain *h, unsigned int virq,
+ {
+ int l1irq;
+ int l2irq;
+- struct irq_chip *uninitialized_var(irqchip);
++ struct irq_chip *irqchip;
+ void *hndlr;
+ int type;
+ u32 reg;
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index bce678c7179c8..f272b662301e4 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -145,7 +145,7 @@ static int pcpu_sigp_retry(struct pcpu *pcpu, u8 order, u32 parm)
+
+ static inline int pcpu_stopped(struct pcpu *pcpu)
+ {
+- u32 uninitialized_var(status);
++ u32 status;
+
+ if (__pcpu_sigp(pcpu->address, SIGP_SENSE,
+ 0, &status) != SIGP_CC_STATUS_STORED)
+diff --git a/arch/s390/kernel/sthyi.c b/arch/s390/kernel/sthyi.c
+index 888cc2f166db7..ce6084e28d904 100644
+--- a/arch/s390/kernel/sthyi.c
++++ b/arch/s390/kernel/sthyi.c
+@@ -460,9 +460,9 @@ static int sthyi_update_cache(u64 *rc)
+ *
+ * Fills the destination with system information returned by the STHYI
+ * instruction. The data is generated by emulation or execution of STHYI,
+- * if available. The return value is the condition code that would be
+- * returned, the rc parameter is the return code which is passed in
+- * register R2 + 1.
++ * if available. The return value is either a negative error value or
++ * the condition code that would be returned, the rc parameter is the
++ * return code which is passed in register R2 + 1.
+ */
+ int sthyi_fill(void *dst, u64 *rc)
+ {
+diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
+index a389fa85cca2d..5450d43d26ea5 100644
+--- a/arch/s390/kvm/intercept.c
++++ b/arch/s390/kvm/intercept.c
+@@ -360,8 +360,8 @@ static int handle_partial_execution(struct kvm_vcpu *vcpu)
+ */
+ int handle_sthyi(struct kvm_vcpu *vcpu)
+ {
+- int reg1, reg2, r = 0;
+- u64 code, addr, cc = 0, rc = 0;
++ int reg1, reg2, cc = 0, r = 0;
++ u64 code, addr, rc = 0;
+ struct sthyi_sctns *sctns = NULL;
+
+ if (!test_kvm_facility(vcpu->kvm, 74))
+@@ -392,7 +392,10 @@ int handle_sthyi(struct kvm_vcpu *vcpu)
+ return -ENOMEM;
+
+ cc = sthyi_fill(sctns, &rc);
+-
++ if (cc < 0) {
++ free_page((unsigned long)sctns);
++ return cc;
++ }
+ out:
+ if (!cc) {
+ r = write_guest(vcpu, addr, reg2, sctns, PAGE_SIZE);
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 3aade928c18dd..92041d442d2e6 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -1716,6 +1716,10 @@ static unsigned long kvm_s390_next_dirty_cmma(struct kvm_memslots *slots,
+ ms = slots->memslots + slotidx;
+ ofs = 0;
+ }
++
++ if (cur_gfn < ms->base_gfn)
++ ofs = 0;
++
+ ofs = find_next_bit(kvm_second_dirty_bitmap(ms), ms->npages, ofs);
+ while ((slotidx > 0) && (ofs >= ms->npages)) {
+ slotidx--;
+diff --git a/arch/sh/drivers/dma/dma-sh.c b/arch/sh/drivers/dma/dma-sh.c
+index afde2a7d3eb35..e0679d8a9b34b 100644
+--- a/arch/sh/drivers/dma/dma-sh.c
++++ b/arch/sh/drivers/dma/dma-sh.c
+@@ -21,6 +21,18 @@
+ #include <cpu/dma-register.h>
+ #include <cpu/dma.h>
+
++/*
++ * Some of the SoCs feature two DMAC modules. In such a case, the channels are
++ * distributed equally among them.
++ */
++#ifdef SH_DMAC_BASE1
++#define SH_DMAC_NR_MD_CH (CONFIG_NR_ONCHIP_DMA_CHANNELS / 2)
++#else
++#define SH_DMAC_NR_MD_CH CONFIG_NR_ONCHIP_DMA_CHANNELS
++#endif
++
++#define SH_DMAC_CH_SZ 0x10
++
+ /*
+ * Define the default configuration for dual address memory-memory transfer.
+ * The 0x400 value represents auto-request, external->external.
+@@ -32,7 +44,7 @@ static unsigned long dma_find_base(unsigned int chan)
+ unsigned long base = SH_DMAC_BASE0;
+
+ #ifdef SH_DMAC_BASE1
+- if (chan >= 6)
++ if (chan >= SH_DMAC_NR_MD_CH)
+ base = SH_DMAC_BASE1;
+ #endif
+
+@@ -43,13 +55,13 @@ static unsigned long dma_base_addr(unsigned int chan)
+ {
+ unsigned long base = dma_find_base(chan);
+
+- /* Normalize offset calculation */
+- if (chan >= 9)
+- chan -= 6;
+- if (chan >= 4)
+- base += 0x10;
++ chan = (chan % SH_DMAC_NR_MD_CH) * SH_DMAC_CH_SZ;
++
++ /* DMAOR is placed inside the channel register space. Step over it. */
++ if (chan >= DMAOR)
++ base += SH_DMAC_CH_SZ;
+
+- return base + (chan * 0x10);
++ return base + chan;
+ }
+
+ #ifdef CONFIG_SH_DMA_IRQ_MULTI
+@@ -253,12 +265,11 @@ static int sh_dmac_get_dma_residue(struct dma_channel *chan)
+ #define NR_DMAOR 1
+ #endif
+
+-/*
+- * DMAOR bases are broken out amongst channel groups. DMAOR0 manages
+- * channels 0 - 5, DMAOR1 6 - 11 (optional).
+- */
+-#define dmaor_read_reg(n) __raw_readw(dma_find_base((n)*6))
+-#define dmaor_write_reg(n, data) __raw_writew(data, dma_find_base(n)*6)
++#define dmaor_read_reg(n) __raw_readw(dma_find_base((n) * \
++ SH_DMAC_NR_MD_CH) + DMAOR)
++#define dmaor_write_reg(n, data) __raw_writew(data, \
++ dma_find_base((n) * \
++ SH_DMAC_NR_MD_CH) + DMAOR)
+
+ static inline int dmaor_reset(int no)
+ {
+diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c
+index a5bd036426789..75dcb1d6bc62f 100644
+--- a/arch/sh/kernel/cpu/sh2/probe.c
++++ b/arch/sh/kernel/cpu/sh2/probe.c
+@@ -24,7 +24,7 @@ static int __init scan_cache(unsigned long node, const char *uname,
+ if (!of_flat_dt_is_compatible(node, "jcore,cache"))
+ return 0;
+
+- j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node);
++ j2_ccr_base = ioremap(of_flat_dt_translate_address(node), 4);
+
+ return 1;
+ }
+diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
+index 736348ead4218..2ecf1dcc86b20 100644
+--- a/arch/x86/kernel/quirks.c
++++ b/arch/x86/kernel/quirks.c
+@@ -96,7 +96,7 @@ static void ich_force_hpet_resume(void)
+ static void ich_force_enable_hpet(struct pci_dev *dev)
+ {
+ u32 val;
+- u32 uninitialized_var(rcba);
++ u32 rcba;
+ int err = 0;
+
+ if (hpet_address || force_hpet_address)
+@@ -186,7 +186,7 @@ static void hpet_print_force_info(void)
+ static void old_ich_force_hpet_resume(void)
+ {
+ u32 val;
+- u32 uninitialized_var(gen_cntl);
++ u32 gen_cntl;
+
+ if (!force_hpet_address || !cached_dev)
+ return;
+@@ -208,7 +208,7 @@ static void old_ich_force_hpet_resume(void)
+ static void old_ich_force_enable_hpet(struct pci_dev *dev)
+ {
+ u32 val;
+- u32 uninitialized_var(gen_cntl);
++ u32 gen_cntl;
+
+ if (hpet_address || force_hpet_address)
+ return;
+@@ -299,7 +299,7 @@ static void vt8237_force_hpet_resume(void)
+
+ static void vt8237_force_enable_hpet(struct pci_dev *dev)
+ {
+- u32 uninitialized_var(val);
++ u32 val;
+
+ if (hpet_address || force_hpet_address)
+ return;
+@@ -430,7 +430,7 @@ static void nvidia_force_hpet_resume(void)
+
+ static void nvidia_force_enable_hpet(struct pci_dev *dev)
+ {
+- u32 uninitialized_var(val);
++ u32 val;
+
+ if (hpet_address || force_hpet_address)
+ return;
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 1f1298f6cbc26..2e4f6a1ebca56 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -96,6 +96,17 @@ DEFINE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_llc_shared_map);
+ DEFINE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info);
+ EXPORT_PER_CPU_SYMBOL(cpu_info);
+
++struct mwait_cpu_dead {
++ unsigned int control;
++ unsigned int status;
++};
++
++/*
++ * Cache line aligned data for mwait_play_dead(). Separate on purpose so
++ * that it's unlikely to be touched by other CPUs.
++ */
++static DEFINE_PER_CPU_ALIGNED(struct mwait_cpu_dead, mwait_cpu_dead);
++
+ /* Logical package management. We might want to allocate that dynamically */
+ unsigned int __max_logical_packages __read_mostly;
+ EXPORT_SYMBOL(__max_logical_packages);
+@@ -1595,10 +1606,10 @@ static bool wakeup_cpu0(void)
+ */
+ static inline void mwait_play_dead(void)
+ {
++ struct mwait_cpu_dead *md = this_cpu_ptr(&mwait_cpu_dead);
+ unsigned int eax, ebx, ecx, edx;
+ unsigned int highest_cstate = 0;
+ unsigned int highest_subcstate = 0;
+- void *mwait_ptr;
+ int i;
+
+ if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
+@@ -1632,13 +1643,6 @@ static inline void mwait_play_dead(void)
+ (highest_subcstate - 1);
+ }
+
+- /*
+- * This should be a memory location in a cache line which is
+- * unlikely to be touched by other processors. The actual
+- * content is immaterial as it is not actually modified in any way.
+- */
+- mwait_ptr = ¤t_thread_info()->flags;
+-
+ wbinvd();
+
+ while (1) {
+@@ -1650,9 +1654,9 @@ static inline void mwait_play_dead(void)
+ * case where we return around the loop.
+ */
+ mb();
+- clflush(mwait_ptr);
++ clflush(md);
+ mb();
+- __monitor(mwait_ptr, 0, 0);
++ __monitor(md, 0, 0);
+ mb();
+ __mwait(eax, 0);
+ /*
+diff --git a/arch/xtensa/platforms/iss/network.c b/arch/xtensa/platforms/iss/network.c
+index d027dddc41cad..f49329aabec80 100644
+--- a/arch/xtensa/platforms/iss/network.c
++++ b/arch/xtensa/platforms/iss/network.c
+@@ -236,7 +236,7 @@ static int tuntap_probe(struct iss_net_private *lp, int index, char *init)
+
+ init += sizeof(TRANSPORT_TUNTAP_NAME) - 1;
+ if (*init == ',') {
+- rem = split_if_spec(init + 1, &mac_str, &dev_name);
++ rem = split_if_spec(init + 1, &mac_str, &dev_name, NULL);
+ if (rem != NULL) {
+ pr_err("%s: extra garbage on specification : '%s'\n",
+ dev->name, rem);
+diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
+index 552c1f725b6cf..40188632958cd 100644
+--- a/drivers/acpi/acpi_pad.c
++++ b/drivers/acpi/acpi_pad.c
+@@ -95,7 +95,7 @@ static void round_robin_cpu(unsigned int tsk_index)
+ cpumask_var_t tmp;
+ int cpu;
+ unsigned long min_weight = -1;
+- unsigned long uninitialized_var(preferred_cpu);
++ unsigned long preferred_cpu;
+
+ if (!alloc_cpumask_var(&tmp, GFP_KERNEL))
+ return;
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 957f6b28bceaa..2295b74714e15 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -178,7 +178,7 @@ static ssize_t ata_scsi_park_show(struct device *device,
+ struct ata_link *link;
+ struct ata_device *dev;
+ unsigned long now;
+- unsigned int uninitialized_var(msecs);
++ unsigned int msecs;
+ int rc = 0;
+
+ ap = ata_shost_to_port(sdev->host);
+diff --git a/drivers/ata/pata_ns87415.c b/drivers/ata/pata_ns87415.c
+index 84c6b225b56e9..9ee4aefca8675 100644
+--- a/drivers/ata/pata_ns87415.c
++++ b/drivers/ata/pata_ns87415.c
+@@ -260,7 +260,7 @@ static u8 ns87560_check_status(struct ata_port *ap)
+ * LOCKING:
+ * Inherited from caller.
+ */
+-void ns87560_tf_read(struct ata_port *ap, struct ata_taskfile *tf)
++static void ns87560_tf_read(struct ata_port *ap, struct ata_taskfile *tf)
+ {
+ struct ata_ioports *ioaddr = &ap->ioaddr;
+
+diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
+index d5c76b50d3575..88f810745fd89 100644
+--- a/drivers/atm/zatm.c
++++ b/drivers/atm/zatm.c
+@@ -939,7 +939,7 @@ static int open_tx_first(struct atm_vcc *vcc)
+ vcc->qos.txtp.max_pcr >= ATM_OC3_PCR);
+ if (unlimited && zatm_dev->ubr != -1) zatm_vcc->shaper = zatm_dev->ubr;
+ else {
+- int uninitialized_var(pcr);
++ int pcr;
+
+ if (unlimited) vcc->qos.txtp.max_sdu = ATM_MAX_AAL5_PDU;
+ if ((zatm_vcc->shaper = alloc_shaper(vcc->dev,&pcr,
+diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c
+index e7cb0c6ade81e..d89f618231cb1 100644
+--- a/drivers/base/arch_topology.c
++++ b/drivers/base/arch_topology.c
+@@ -44,7 +44,7 @@ static ssize_t cpu_capacity_show(struct device *dev,
+ {
+ struct cpu *cpu = container_of(dev, struct cpu, dev);
+
+- return sprintf(buf, "%lu\n", topology_get_cpu_scale(NULL, cpu->dev.id));
++ return sysfs_emit(buf, "%lu\n", topology_get_cpu_scale(NULL, cpu->dev.id));
+ }
+
+ static ssize_t cpu_capacity_store(struct device *dev,
+diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
+index ce015ce2977c4..51eb403f89de6 100644
+--- a/drivers/base/cacheinfo.c
++++ b/drivers/base/cacheinfo.c
+@@ -372,7 +372,7 @@ static ssize_t size_show(struct device *dev,
+ {
+ struct cacheinfo *this_leaf = dev_get_drvdata(dev);
+
+- return sprintf(buf, "%uK\n", this_leaf->size >> 10);
++ return sysfs_emit(buf, "%uK\n", this_leaf->size >> 10);
+ }
+
+ static ssize_t shared_cpumap_show_func(struct device *dev, bool list, char *buf)
+@@ -402,11 +402,11 @@ static ssize_t type_show(struct device *dev,
+
+ switch (this_leaf->type) {
+ case CACHE_TYPE_DATA:
+- return sprintf(buf, "Data\n");
++ return sysfs_emit(buf, "Data\n");
+ case CACHE_TYPE_INST:
+- return sprintf(buf, "Instruction\n");
++ return sysfs_emit(buf, "Instruction\n");
+ case CACHE_TYPE_UNIFIED:
+- return sprintf(buf, "Unified\n");
++ return sysfs_emit(buf, "Unified\n");
+ default:
+ return -EINVAL;
+ }
+@@ -420,11 +420,11 @@ static ssize_t allocation_policy_show(struct device *dev,
+ int n = 0;
+
+ if ((ci_attr & CACHE_READ_ALLOCATE) && (ci_attr & CACHE_WRITE_ALLOCATE))
+- n = sprintf(buf, "ReadWriteAllocate\n");
++ n = sysfs_emit(buf, "ReadWriteAllocate\n");
+ else if (ci_attr & CACHE_READ_ALLOCATE)
+- n = sprintf(buf, "ReadAllocate\n");
++ n = sysfs_emit(buf, "ReadAllocate\n");
+ else if (ci_attr & CACHE_WRITE_ALLOCATE)
+- n = sprintf(buf, "WriteAllocate\n");
++ n = sysfs_emit(buf, "WriteAllocate\n");
+ return n;
+ }
+
+@@ -436,9 +436,9 @@ static ssize_t write_policy_show(struct device *dev,
+ int n = 0;
+
+ if (ci_attr & CACHE_WRITE_THROUGH)
+- n = sprintf(buf, "WriteThrough\n");
++ n = sysfs_emit(buf, "WriteThrough\n");
+ else if (ci_attr & CACHE_WRITE_BACK)
+- n = sprintf(buf, "WriteBack\n");
++ n = sysfs_emit(buf, "WriteBack\n");
+ return n;
+ }
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 6e380ad9d08ad..0332800dffd86 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -994,7 +994,7 @@ ssize_t device_show_ulong(struct device *dev,
+ char *buf)
+ {
+ struct dev_ext_attribute *ea = to_ext_attr(attr);
+- return snprintf(buf, PAGE_SIZE, "%lx\n", *(unsigned long *)(ea->var));
++ return sysfs_emit(buf, "%lx\n", *(unsigned long *)(ea->var));
+ }
+ EXPORT_SYMBOL_GPL(device_show_ulong);
+
+@@ -1019,7 +1019,7 @@ ssize_t device_show_int(struct device *dev,
+ {
+ struct dev_ext_attribute *ea = to_ext_attr(attr);
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", *(int *)(ea->var));
++ return sysfs_emit(buf, "%d\n", *(int *)(ea->var));
+ }
+ EXPORT_SYMBOL_GPL(device_show_int);
+
+@@ -1040,7 +1040,7 @@ ssize_t device_show_bool(struct device *dev, struct device_attribute *attr,
+ {
+ struct dev_ext_attribute *ea = to_ext_attr(attr);
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", *(bool *)(ea->var));
++ return sysfs_emit(buf, "%d\n", *(bool *)(ea->var));
+ }
+ EXPORT_SYMBOL_GPL(device_show_bool);
+
+@@ -1273,7 +1273,7 @@ static ssize_t online_show(struct device *dev, struct device_attribute *attr,
+ device_lock(dev);
+ val = !dev->offline;
+ device_unlock(dev);
+- return sprintf(buf, "%u\n", val);
++ return sysfs_emit(buf, "%u\n", val);
+ }
+
+ static ssize_t online_store(struct device *dev, struct device_attribute *attr,
+diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
+index b1bb6f43f8962..607fc189e57c5 100644
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -156,7 +156,7 @@ static ssize_t show_crash_notes(struct device *dev, struct device_attribute *att
+ * operation should be safe. No locking required.
+ */
+ addr = per_cpu_ptr_to_phys(per_cpu_ptr(crash_notes, cpunum));
+- rc = sprintf(buf, "%Lx\n", addr);
++ rc = sysfs_emit(buf, "%Lx\n", addr);
+ return rc;
+ }
+ static DEVICE_ATTR(crash_notes, 0400, show_crash_notes, NULL);
+@@ -167,7 +167,7 @@ static ssize_t show_crash_notes_size(struct device *dev,
+ {
+ ssize_t rc;
+
+- rc = sprintf(buf, "%zu\n", sizeof(note_buf_t));
++ rc = sysfs_emit(buf, "%zu\n", sizeof(note_buf_t));
+ return rc;
+ }
+ static DEVICE_ATTR(crash_notes_size, 0400, show_crash_notes_size, NULL);
+@@ -264,7 +264,7 @@ static ssize_t print_cpus_offline(struct device *dev,
+ nr_cpu_ids, total_cpus-1);
+ }
+
+- n += snprintf(&buf[n], len - n, "\n");
++ n += sysfs_emit(&buf[n], "\n");
+ return n;
+ }
+ static DEVICE_ATTR(offline, 0444, print_cpus_offline, NULL);
+@@ -272,7 +272,7 @@ static DEVICE_ATTR(offline, 0444, print_cpus_offline, NULL);
+ static ssize_t print_cpus_isolated(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- int n = 0, len = PAGE_SIZE-2;
++ int n = 0;
+ cpumask_var_t isolated;
+
+ if (!alloc_cpumask_var(&isolated, GFP_KERNEL))
+@@ -280,7 +280,7 @@ static ssize_t print_cpus_isolated(struct device *dev,
+
+ cpumask_andnot(isolated, cpu_possible_mask,
+ housekeeping_cpumask(HK_FLAG_DOMAIN));
+- n = scnprintf(buf, len, "%*pbl\n", cpumask_pr_args(isolated));
++ n = sysfs_emit(buf, "%*pbl\n", cpumask_pr_args(isolated));
+
+ free_cpumask_var(isolated);
+
+@@ -292,9 +292,9 @@ static DEVICE_ATTR(isolated, 0444, print_cpus_isolated, NULL);
+ static ssize_t print_cpus_nohz_full(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- int n = 0, len = PAGE_SIZE-2;
++ int n = 0;
+
+- n = scnprintf(buf, len, "%*pbl\n", cpumask_pr_args(tick_nohz_full_mask));
++ n = sysfs_emit(buf, "%*pbl\n", cpumask_pr_args(tick_nohz_full_mask));
+
+ return n;
+ }
+@@ -328,7 +328,7 @@ static ssize_t print_cpu_modalias(struct device *dev,
+ ssize_t n;
+ u32 i;
+
+- n = sprintf(buf, "cpu:type:" CPU_FEATURE_TYPEFMT ":feature:",
++ n = sysfs_emit(buf, "cpu:type:" CPU_FEATURE_TYPEFMT ":feature:",
+ CPU_FEATURE_TYPEVAL);
+
+ for (i = 0; i < MAX_CPU_FEATURES; i++)
+@@ -520,56 +520,56 @@ static void __init cpu_dev_register_generic(void)
+ ssize_t __weak cpu_show_meltdown(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- return sprintf(buf, "Not affected\n");
++ return sysfs_emit(buf, "Not affected\n");
+ }
+
+ ssize_t __weak cpu_show_spectre_v1(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- return sprintf(buf, "Not affected\n");
++ return sysfs_emit(buf, "Not affected\n");
+ }
+
+ ssize_t __weak cpu_show_spectre_v2(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- return sprintf(buf, "Not affected\n");
++ return sysfs_emit(buf, "Not affected\n");
+ }
+
+ ssize_t __weak cpu_show_spec_store_bypass(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- return sprintf(buf, "Not affected\n");
++ return sysfs_emit(buf, "Not affected\n");
+ }
+
+ ssize_t __weak cpu_show_l1tf(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- return sprintf(buf, "Not affected\n");
++ return sysfs_emit(buf, "Not affected\n");
+ }
+
+ ssize_t __weak cpu_show_mds(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- return sprintf(buf, "Not affected\n");
++ return sysfs_emit(buf, "Not affected\n");
+ }
+
+ ssize_t __weak cpu_show_tsx_async_abort(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- return sprintf(buf, "Not affected\n");
++ return sysfs_emit(buf, "Not affected\n");
+ }
+
+ ssize_t __weak cpu_show_itlb_multihit(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- return sprintf(buf, "Not affected\n");
++ return sysfs_emit(buf, "Not affected\n");
+ }
+
+ ssize_t __weak cpu_show_srbds(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- return sprintf(buf, "Not affected\n");
++ return sysfs_emit(buf, "Not affected\n");
+ }
+
+ ssize_t __weak cpu_show_mmio_stale_data(struct device *dev,
+diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
+index 821e27bda4ca2..2116926cc1d57 100644
+--- a/drivers/base/firmware_loader/fallback.c
++++ b/drivers/base/firmware_loader/fallback.c
+@@ -215,7 +215,7 @@ static ssize_t firmware_loading_show(struct device *dev,
+ loading = fw_sysfs_loading(fw_sysfs->fw_priv);
+ mutex_unlock(&fw_lock);
+
+- return sprintf(buf, "%d\n", loading);
++ return sysfs_emit(buf, "%d\n", loading);
+ }
+
+ /* one pages buffer should be mapped/unmapped only once */
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index e270abc86d468..5dbe00a5c7c14 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -121,7 +121,7 @@ static ssize_t show_mem_start_phys_index(struct device *dev,
+ unsigned long phys_index;
+
+ phys_index = mem->start_section_nr / sections_per_block;
+- return sprintf(buf, "%08lx\n", phys_index);
++ return sysfs_emit(buf, "%08lx\n", phys_index);
+ }
+
+ /*
+@@ -145,7 +145,7 @@ static ssize_t show_mem_removable(struct device *dev,
+ }
+
+ out:
+- return sprintf(buf, "%d\n", ret);
++ return sysfs_emit(buf, "%d\n", ret);
+ }
+
+ /*
+@@ -163,17 +163,17 @@ static ssize_t show_mem_state(struct device *dev,
+ */
+ switch (mem->state) {
+ case MEM_ONLINE:
+- len = sprintf(buf, "online\n");
++ len = sysfs_emit(buf, "online\n");
+ break;
+ case MEM_OFFLINE:
+- len = sprintf(buf, "offline\n");
++ len = sysfs_emit(buf, "offline\n");
+ break;
+ case MEM_GOING_OFFLINE:
+- len = sprintf(buf, "going-offline\n");
++ len = sysfs_emit(buf, "going-offline\n");
+ break;
+ default:
+- len = sprintf(buf, "ERROR-UNKNOWN-%ld\n",
+- mem->state);
++ len = sysfs_emit(buf, "ERROR-UNKNOWN-%ld\n",
++ mem->state);
+ WARN_ON(1);
+ break;
+ }
+@@ -384,7 +384,7 @@ static ssize_t show_phys_device(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ struct memory_block *mem = to_memory_block(dev);
+- return sprintf(buf, "%d\n", mem->phys_device);
++ return sysfs_emit(buf, "%d\n", mem->phys_device);
+ }
+
+ #ifdef CONFIG_MEMORY_HOTREMOVE
+@@ -422,7 +422,7 @@ static ssize_t show_valid_zones(struct device *dev,
+ */
+ if (!test_pages_in_a_zone(start_pfn, start_pfn + nr_pages,
+ &valid_start_pfn, &valid_end_pfn))
+- return sprintf(buf, "none\n");
++ return sysfs_emit(buf, "none\n");
+ start_pfn = valid_start_pfn;
+ strcat(buf, page_zone(pfn_to_page(start_pfn))->name);
+ goto out;
+@@ -456,7 +456,7 @@ static ssize_t
+ print_block_size(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+- return sprintf(buf, "%lx\n", get_memory_block_size());
++ return sysfs_emit(buf, "%lx\n", get_memory_block_size());
+ }
+
+ static DEVICE_ATTR(block_size_bytes, 0444, print_block_size, NULL);
+@@ -470,9 +470,9 @@ show_auto_online_blocks(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+ if (memhp_auto_online)
+- return sprintf(buf, "online\n");
++ return sysfs_emit(buf, "online\n");
+ else
+- return sprintf(buf, "offline\n");
++ return sysfs_emit(buf, "offline\n");
+ }
+
+ static ssize_t
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 60c2e32f9f614..8defeace001ec 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -69,7 +69,7 @@ static ssize_t node_read_meminfo(struct device *dev,
+ struct sysinfo i;
+
+ si_meminfo_node(&i, nid);
+- n = sprintf(buf,
++ n = sysfs_emit(buf,
+ "Node %d MemTotal: %8lu kB\n"
+ "Node %d MemFree: %8lu kB\n"
+ "Node %d MemUsed: %8lu kB\n"
+@@ -96,7 +96,7 @@ static ssize_t node_read_meminfo(struct device *dev,
+ nid, K(sum_zone_node_page_state(nid, NR_MLOCK)));
+
+ #ifdef CONFIG_HIGHMEM
+- n += sprintf(buf + n,
++ n += sysfs_emit(buf + n,
+ "Node %d HighTotal: %8lu kB\n"
+ "Node %d HighFree: %8lu kB\n"
+ "Node %d LowTotal: %8lu kB\n"
+@@ -106,7 +106,7 @@ static ssize_t node_read_meminfo(struct device *dev,
+ nid, K(i.totalram - i.totalhigh),
+ nid, K(i.freeram - i.freehigh));
+ #endif
+- n += sprintf(buf + n,
++ n += sysfs_emit(buf + n,
+ "Node %d Dirty: %8lu kB\n"
+ "Node %d Writeback: %8lu kB\n"
+ "Node %d FilePages: %8lu kB\n"
+@@ -162,19 +162,19 @@ static DEVICE_ATTR(meminfo, S_IRUGO, node_read_meminfo, NULL);
+ static ssize_t node_read_numastat(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- return sprintf(buf,
+- "numa_hit %lu\n"
+- "numa_miss %lu\n"
+- "numa_foreign %lu\n"
+- "interleave_hit %lu\n"
+- "local_node %lu\n"
+- "other_node %lu\n",
+- sum_zone_numa_state(dev->id, NUMA_HIT),
+- sum_zone_numa_state(dev->id, NUMA_MISS),
+- sum_zone_numa_state(dev->id, NUMA_FOREIGN),
+- sum_zone_numa_state(dev->id, NUMA_INTERLEAVE_HIT),
+- sum_zone_numa_state(dev->id, NUMA_LOCAL),
+- sum_zone_numa_state(dev->id, NUMA_OTHER));
++ return sysfs_emit(buf,
++ "numa_hit %lu\n"
++ "numa_miss %lu\n"
++ "numa_foreign %lu\n"
++ "interleave_hit %lu\n"
++ "local_node %lu\n"
++ "other_node %lu\n",
++ sum_zone_numa_state(dev->id, NUMA_HIT),
++ sum_zone_numa_state(dev->id, NUMA_MISS),
++ sum_zone_numa_state(dev->id, NUMA_FOREIGN),
++ sum_zone_numa_state(dev->id, NUMA_INTERLEAVE_HIT),
++ sum_zone_numa_state(dev->id, NUMA_LOCAL),
++ sum_zone_numa_state(dev->id, NUMA_OTHER));
+ }
+ static DEVICE_ATTR(numastat, S_IRUGO, node_read_numastat, NULL);
+
+@@ -612,7 +612,7 @@ static ssize_t print_nodes_state(enum node_states state, char *buf)
+ {
+ int n;
+
+- n = scnprintf(buf, PAGE_SIZE - 1, "%*pbl",
++ n = sysfs_emit(buf, "%*pbl",
+ nodemask_pr_args(&node_states[state]));
+ buf[n++] = '\n';
+ buf[n] = '\0';
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 2f89e618b142c..1819da6889a71 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -927,7 +927,7 @@ static ssize_t driver_override_show(struct device *dev,
+ ssize_t len;
+
+ device_lock(dev);
+- len = sprintf(buf, "%s\n", pdev->driver_override);
++ len = sysfs_emit(buf, "%s\n", pdev->driver_override);
+ device_unlock(dev);
+ return len;
+ }
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index e865aa4b25047..b32d3cf4f670d 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -2433,10 +2433,10 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state,
+
+ err = of_property_read_u32(state_node, "min-residency-us", &residency);
+ if (!err)
+- genpd_state->residency_ns = 1000 * residency;
++ genpd_state->residency_ns = 1000LL * residency;
+
+- genpd_state->power_on_latency_ns = 1000 * exit_latency;
+- genpd_state->power_off_latency_ns = 1000 * entry_latency;
++ genpd_state->power_on_latency_ns = 1000LL * exit_latency;
++ genpd_state->power_off_latency_ns = 1000LL * entry_latency;
+ genpd_state->fwnode = &state_node->fwnode;
+
+ return 0;
+diff --git a/drivers/base/power/power.h b/drivers/base/power/power.h
+index c511def48b486..3f9934bd6137d 100644
+--- a/drivers/base/power/power.h
++++ b/drivers/base/power/power.h
+@@ -24,8 +24,11 @@ extern void pm_runtime_remove(struct device *dev);
+
+ #define WAKE_IRQ_DEDICATED_ALLOCATED BIT(0)
+ #define WAKE_IRQ_DEDICATED_MANAGED BIT(1)
++#define WAKE_IRQ_DEDICATED_REVERSE BIT(2)
+ #define WAKE_IRQ_DEDICATED_MASK (WAKE_IRQ_DEDICATED_ALLOCATED | \
+- WAKE_IRQ_DEDICATED_MANAGED)
++ WAKE_IRQ_DEDICATED_MANAGED | \
++ WAKE_IRQ_DEDICATED_REVERSE)
++#define WAKE_IRQ_DEDICATED_ENABLED BIT(3)
+
+ struct wake_irq {
+ struct device *dev;
+@@ -38,7 +41,8 @@ extern void dev_pm_arm_wake_irq(struct wake_irq *wirq);
+ extern void dev_pm_disarm_wake_irq(struct wake_irq *wirq);
+ extern void dev_pm_enable_wake_irq_check(struct device *dev,
+ bool can_change_status);
+-extern void dev_pm_disable_wake_irq_check(struct device *dev);
++extern void dev_pm_disable_wake_irq_check(struct device *dev, bool cond_disable);
++extern void dev_pm_enable_wake_irq_complete(struct device *dev);
+
+ #ifdef CONFIG_PM_SLEEP
+
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 911bb8a4bf6df..ab0898c33880a 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -606,6 +606,8 @@ static int rpm_suspend(struct device *dev, int rpmflags)
+ if (retval)
+ goto fail;
+
++ dev_pm_enable_wake_irq_complete(dev);
++
+ no_callback:
+ __update_runtime_status(dev, RPM_SUSPENDED);
+ pm_runtime_deactivate_timer(dev);
+@@ -640,7 +642,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
+ return retval;
+
+ fail:
+- dev_pm_disable_wake_irq_check(dev);
++ dev_pm_disable_wake_irq_check(dev, true);
+ __update_runtime_status(dev, RPM_ACTIVE);
+ dev->power.deferred_resume = false;
+ wake_up_all(&dev->power.wait_queue);
+@@ -823,7 +825,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
+
+ callback = RPM_GET_CALLBACK(dev, runtime_resume);
+
+- dev_pm_disable_wake_irq_check(dev);
++ dev_pm_disable_wake_irq_check(dev, false);
+ retval = rpm_callback(callback, dev);
+ if (retval) {
+ __update_runtime_status(dev, RPM_SUSPENDED);
+diff --git a/drivers/base/power/sysfs.c b/drivers/base/power/sysfs.c
+index d713738ce7967..c61b50aa1d818 100644
+--- a/drivers/base/power/sysfs.c
++++ b/drivers/base/power/sysfs.c
+@@ -101,7 +101,7 @@ static const char ctrl_on[] = "on";
+ static ssize_t control_show(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+- return sprintf(buf, "%s\n",
++ return sysfs_emit(buf, "%s\n",
+ dev->power.runtime_auto ? ctrl_auto : ctrl_on);
+ }
+
+@@ -127,7 +127,7 @@ static ssize_t runtime_active_time_show(struct device *dev,
+ int ret;
+ spin_lock_irq(&dev->power.lock);
+ update_pm_runtime_accounting(dev);
+- ret = sprintf(buf, "%i\n", jiffies_to_msecs(dev->power.active_jiffies));
++ ret = sysfs_emit(buf, "%i\n", jiffies_to_msecs(dev->power.active_jiffies));
+ spin_unlock_irq(&dev->power.lock);
+ return ret;
+ }
+@@ -140,7 +140,7 @@ static ssize_t runtime_suspended_time_show(struct device *dev,
+ int ret;
+ spin_lock_irq(&dev->power.lock);
+ update_pm_runtime_accounting(dev);
+- ret = sprintf(buf, "%i\n",
++ ret = sysfs_emit(buf, "%i\n",
+ jiffies_to_msecs(dev->power.suspended_jiffies));
+ spin_unlock_irq(&dev->power.lock);
+ return ret;
+@@ -175,7 +175,7 @@ static ssize_t runtime_status_show(struct device *dev,
+ return -EIO;
+ }
+ }
+- return sprintf(buf, p);
++ return sysfs_emit(buf, p);
+ }
+
+ static DEVICE_ATTR_RO(runtime_status);
+@@ -185,7 +185,7 @@ static ssize_t autosuspend_delay_ms_show(struct device *dev,
+ {
+ if (!dev->power.use_autosuspend)
+ return -EIO;
+- return sprintf(buf, "%d\n", dev->power.autosuspend_delay);
++ return sysfs_emit(buf, "%d\n", dev->power.autosuspend_delay);
+ }
+
+ static ssize_t autosuspend_delay_ms_store(struct device *dev,
+@@ -214,11 +214,11 @@ static ssize_t pm_qos_resume_latency_us_show(struct device *dev,
+ s32 value = dev_pm_qos_requested_resume_latency(dev);
+
+ if (value == 0)
+- return sprintf(buf, "n/a\n");
++ return sysfs_emit(buf, "n/a\n");
+ if (value == PM_QOS_RESUME_LATENCY_NO_CONSTRAINT)
+ value = 0;
+
+- return sprintf(buf, "%d\n", value);
++ return sysfs_emit(buf, "%d\n", value);
+ }
+
+ static ssize_t pm_qos_resume_latency_us_store(struct device *dev,
+@@ -258,11 +258,11 @@ static ssize_t pm_qos_latency_tolerance_us_show(struct device *dev,
+ s32 value = dev_pm_qos_get_user_latency_tolerance(dev);
+
+ if (value < 0)
+- return sprintf(buf, "auto\n");
++ return sysfs_emit(buf, "auto\n");
+ if (value == PM_QOS_LATENCY_ANY)
+- return sprintf(buf, "any\n");
++ return sysfs_emit(buf, "any\n");
+
+- return sprintf(buf, "%d\n", value);
++ return sysfs_emit(buf, "%d\n", value);
+ }
+
+ static ssize_t pm_qos_latency_tolerance_us_store(struct device *dev,
+@@ -294,8 +294,8 @@ static ssize_t pm_qos_no_power_off_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- return sprintf(buf, "%d\n", !!(dev_pm_qos_requested_flags(dev)
+- & PM_QOS_FLAG_NO_POWER_OFF));
++ return sysfs_emit(buf, "%d\n", !!(dev_pm_qos_requested_flags(dev)
++ & PM_QOS_FLAG_NO_POWER_OFF));
+ }
+
+ static ssize_t pm_qos_no_power_off_store(struct device *dev,
+@@ -323,9 +323,9 @@ static const char _disabled[] = "disabled";
+ static ssize_t wakeup_show(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+- return sprintf(buf, "%s\n", device_can_wakeup(dev)
+- ? (device_may_wakeup(dev) ? _enabled : _disabled)
+- : "");
++ return sysfs_emit(buf, "%s\n", device_can_wakeup(dev)
++ ? (device_may_wakeup(dev) ? _enabled : _disabled)
++ : "");
+ }
+
+ static ssize_t wakeup_store(struct device *dev, struct device_attribute *attr,
+@@ -511,7 +511,7 @@ static DEVICE_ATTR_RO(wakeup_prevent_sleep_time_ms);
+ static ssize_t runtime_usage_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- return sprintf(buf, "%d\n", atomic_read(&dev->power.usage_count));
++ return sysfs_emit(buf, "%d\n", atomic_read(&dev->power.usage_count));
+ }
+ static DEVICE_ATTR_RO(runtime_usage);
+
+@@ -519,8 +519,8 @@ static ssize_t runtime_active_kids_show(struct device *dev,
+ struct device_attribute *attr,
+ char *buf)
+ {
+- return sprintf(buf, "%d\n", dev->power.ignore_children ?
+- 0 : atomic_read(&dev->power.child_count));
++ return sysfs_emit(buf, "%d\n", dev->power.ignore_children ?
++ 0 : atomic_read(&dev->power.child_count));
+ }
+ static DEVICE_ATTR_RO(runtime_active_kids);
+
+@@ -528,12 +528,12 @@ static ssize_t runtime_enabled_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ if (dev->power.disable_depth && (dev->power.runtime_auto == false))
+- return sprintf(buf, "disabled & forbidden\n");
++ return sysfs_emit(buf, "disabled & forbidden\n");
+ if (dev->power.disable_depth)
+- return sprintf(buf, "disabled\n");
++ return sysfs_emit(buf, "disabled\n");
+ if (dev->power.runtime_auto == false)
+- return sprintf(buf, "forbidden\n");
+- return sprintf(buf, "enabled\n");
++ return sysfs_emit(buf, "forbidden\n");
++ return sysfs_emit(buf, "enabled\n");
+ }
+ static DEVICE_ATTR_RO(runtime_enabled);
+
+@@ -541,9 +541,9 @@ static DEVICE_ATTR_RO(runtime_enabled);
+ static ssize_t async_show(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+- return sprintf(buf, "%s\n",
+- device_async_suspend_enabled(dev) ?
+- _enabled : _disabled);
++ return sysfs_emit(buf, "%s\n",
++ device_async_suspend_enabled(dev) ?
++ _enabled : _disabled);
+ }
+
+ static ssize_t async_store(struct device *dev, struct device_attribute *attr,
+diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
+index b8fa5c0f2d132..e7ba514999163 100644
+--- a/drivers/base/power/wakeirq.c
++++ b/drivers/base/power/wakeirq.c
+@@ -156,24 +156,7 @@ static irqreturn_t handle_threaded_wake_irq(int irq, void *_wirq)
+ return IRQ_HANDLED;
+ }
+
+-/**
+- * dev_pm_set_dedicated_wake_irq - Request a dedicated wake-up interrupt
+- * @dev: Device entry
+- * @irq: Device wake-up interrupt
+- *
+- * Unless your hardware has separate wake-up interrupts in addition
+- * to the device IO interrupts, you don't need this.
+- *
+- * Sets up a threaded interrupt handler for a device that has
+- * a dedicated wake-up interrupt in addition to the device IO
+- * interrupt.
+- *
+- * The interrupt starts disabled, and needs to be managed for
+- * the device by the bus code or the device driver using
+- * dev_pm_enable_wake_irq() and dev_pm_disable_wake_irq()
+- * functions.
+- */
+-int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq)
++static int __dev_pm_set_dedicated_wake_irq(struct device *dev, int irq, unsigned int flag)
+ {
+ struct wake_irq *wirq;
+ int err;
+@@ -211,7 +194,7 @@ int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq)
+ if (err)
+ goto err_free_irq;
+
+- wirq->status = WAKE_IRQ_DEDICATED_ALLOCATED;
++ wirq->status = WAKE_IRQ_DEDICATED_ALLOCATED | flag;
+
+ return err;
+
+@@ -224,8 +207,57 @@ err_free:
+
+ return err;
+ }
++
++
++/**
++ * dev_pm_set_dedicated_wake_irq - Request a dedicated wake-up interrupt
++ * @dev: Device entry
++ * @irq: Device wake-up interrupt
++ *
++ * Unless your hardware has separate wake-up interrupts in addition
++ * to the device IO interrupts, you don't need this.
++ *
++ * Sets up a threaded interrupt handler for a device that has
++ * a dedicated wake-up interrupt in addition to the device IO
++ * interrupt.
++ *
++ * The interrupt starts disabled, and needs to be managed for
++ * the device by the bus code or the device driver using
++ * dev_pm_enable_wake_irq*() and dev_pm_disable_wake_irq*()
++ * functions.
++ */
++int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq)
++{
++ return __dev_pm_set_dedicated_wake_irq(dev, irq, 0);
++}
+ EXPORT_SYMBOL_GPL(dev_pm_set_dedicated_wake_irq);
+
++/**
++ * dev_pm_set_dedicated_wake_irq_reverse - Request a dedicated wake-up interrupt
++ * with reverse enable ordering
++ * @dev: Device entry
++ * @irq: Device wake-up interrupt
++ *
++ * Unless your hardware has separate wake-up interrupts in addition
++ * to the device IO interrupts, you don't need this.
++ *
++ * Sets up a threaded interrupt handler for a device that has a dedicated
++ * wake-up interrupt in addition to the device IO interrupt. It sets
++ * the status of WAKE_IRQ_DEDICATED_REVERSE to tell rpm_suspend()
++ * to enable dedicated wake-up interrupt after running the runtime suspend
++ * callback for @dev.
++ *
++ * The interrupt starts disabled, and needs to be managed for
++ * the device by the bus code or the device driver using
++ * dev_pm_enable_wake_irq*() and dev_pm_disable_wake_irq*()
++ * functions.
++ */
++int dev_pm_set_dedicated_wake_irq_reverse(struct device *dev, int irq)
++{
++ return __dev_pm_set_dedicated_wake_irq(dev, irq, WAKE_IRQ_DEDICATED_REVERSE);
++}
++EXPORT_SYMBOL_GPL(dev_pm_set_dedicated_wake_irq_reverse);
++
+ /**
+ * dev_pm_enable_wake_irq - Enable device wake-up interrupt
+ * @dev: Device
+@@ -296,25 +328,56 @@ void dev_pm_enable_wake_irq_check(struct device *dev,
+ return;
+
+ enable:
+- enable_irq(wirq->irq);
++ if (!can_change_status || !(wirq->status & WAKE_IRQ_DEDICATED_REVERSE)) {
++ enable_irq(wirq->irq);
++ wirq->status |= WAKE_IRQ_DEDICATED_ENABLED;
++ }
+ }
+
+ /**
+ * dev_pm_disable_wake_irq_check - Checks and disables wake-up interrupt
+ * @dev: Device
++ * @cond_disable: if set, also check WAKE_IRQ_DEDICATED_REVERSE
+ *
+ * Disables wake-up interrupt conditionally based on status.
+ * Should be only called from rpm_suspend() and rpm_resume() path.
+ */
+-void dev_pm_disable_wake_irq_check(struct device *dev)
++void dev_pm_disable_wake_irq_check(struct device *dev, bool cond_disable)
+ {
+ struct wake_irq *wirq = dev->power.wakeirq;
+
+ if (!wirq || !((wirq->status & WAKE_IRQ_DEDICATED_MASK)))
+ return;
+
+- if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED)
++ if (cond_disable && (wirq->status & WAKE_IRQ_DEDICATED_REVERSE))
++ return;
++
++ if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED) {
++ wirq->status &= ~WAKE_IRQ_DEDICATED_ENABLED;
+ disable_irq_nosync(wirq->irq);
++ }
++}
++
++/**
++ * dev_pm_enable_wake_irq_complete - enable wake IRQ not enabled before
++ * @dev: Device using the wake IRQ
++ *
++ * Enable wake IRQ conditionally based on status, mainly used if want to
++ * enable wake IRQ after running ->runtime_suspend() which depends on
++ * WAKE_IRQ_DEDICATED_REVERSE.
++ *
++ * Should be only called from rpm_suspend() path.
++ */
++void dev_pm_enable_wake_irq_complete(struct device *dev)
++{
++ struct wake_irq *wirq = dev->power.wakeirq;
++
++ if (!wirq || !(wirq->status & WAKE_IRQ_DEDICATED_MASK))
++ return;
++
++ if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED &&
++ wirq->status & WAKE_IRQ_DEDICATED_REVERSE)
++ enable_irq(wirq->irq);
+ }
+
+ /**
+@@ -331,7 +394,7 @@ void dev_pm_arm_wake_irq(struct wake_irq *wirq)
+
+ if (device_may_wakeup(wirq->dev)) {
+ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED &&
+- !pm_runtime_status_suspended(wirq->dev))
++ !(wirq->status & WAKE_IRQ_DEDICATED_ENABLED))
+ enable_irq(wirq->irq);
+
+ enable_irq_wake(wirq->irq);
+@@ -354,7 +417,7 @@ void dev_pm_disarm_wake_irq(struct wake_irq *wirq)
+ disable_irq_wake(wirq->irq);
+
+ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED &&
+- !pm_runtime_status_suspended(wirq->dev))
++ !(wirq->status & WAKE_IRQ_DEDICATED_ENABLED))
+ disable_irq_nosync(wirq->irq);
+ }
+ }
+diff --git a/drivers/base/soc.c b/drivers/base/soc.c
+index 7e91894a380b5..23bc9eb794a26 100644
+--- a/drivers/base/soc.c
++++ b/drivers/base/soc.c
+@@ -72,13 +72,13 @@ static ssize_t soc_info_get(struct device *dev,
+ struct soc_device *soc_dev = container_of(dev, struct soc_device, dev);
+
+ if (attr == &dev_attr_machine)
+- return sprintf(buf, "%s\n", soc_dev->attr->machine);
++ return sysfs_emit(buf, "%s\n", soc_dev->attr->machine);
+ if (attr == &dev_attr_family)
+- return sprintf(buf, "%s\n", soc_dev->attr->family);
++ return sysfs_emit(buf, "%s\n", soc_dev->attr->family);
+ if (attr == &dev_attr_revision)
+- return sprintf(buf, "%s\n", soc_dev->attr->revision);
++ return sysfs_emit(buf, "%s\n", soc_dev->attr->revision);
+ if (attr == &dev_attr_soc_id)
+- return sprintf(buf, "%s\n", soc_dev->attr->soc_id);
++ return sysfs_emit(buf, "%s\n", soc_dev->attr->soc_id);
+
+ return -EINVAL;
+
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index 3f403aab55e1e..b4c2a2c2769bd 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -3394,7 +3394,7 @@ int drbd_adm_dump_devices(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+ struct nlattr *resource_filter;
+ struct drbd_resource *resource;
+- struct drbd_device *uninitialized_var(device);
++ struct drbd_device *device;
+ int minor, err, retcode;
+ struct drbd_genlmsghdr *dh;
+ struct device_info device_info;
+@@ -3483,7 +3483,7 @@ int drbd_adm_dump_connections(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+ struct nlattr *resource_filter;
+ struct drbd_resource *resource = NULL, *next_resource;
+- struct drbd_connection *uninitialized_var(connection);
++ struct drbd_connection *connection;
+ int err = 0, retcode;
+ struct drbd_genlmsghdr *dh;
+ struct connection_info connection_info;
+@@ -3645,7 +3645,7 @@ int drbd_adm_dump_peer_devices(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+ struct nlattr *resource_filter;
+ struct drbd_resource *resource;
+- struct drbd_device *uninitialized_var(device);
++ struct drbd_device *device;
+ struct drbd_peer_device *peer_device = NULL;
+ int minor, err, retcode;
+ struct drbd_genlmsghdr *dh;
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 12eb48980df7b..2e6c3f658894e 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1991,7 +1991,8 @@ static int loop_add(struct loop_device **l, int i)
+ lo->tag_set.queue_depth = 128;
+ lo->tag_set.numa_node = NUMA_NO_NODE;
+ lo->tag_set.cmd_size = sizeof(struct loop_cmd);
+- lo->tag_set.flags = BLK_MQ_F_SHOULD_MERGE | BLK_MQ_F_SG_MERGE;
++ lo->tag_set.flags = BLK_MQ_F_SHOULD_MERGE | BLK_MQ_F_SG_MERGE |
++ BLK_MQ_F_NO_SCHED;
+ lo->tag_set.driver_data = lo;
+
+ err = blk_mq_alloc_tag_set(&lo->tag_set);
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 28024248a7b53..5a07964a1e676 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1646,7 +1646,8 @@ static int nbd_dev_add(int index)
+ if (err == -ENOSPC)
+ err = -EEXIST;
+ } else {
+- err = idr_alloc(&nbd_index_idr, nbd, 0, 0, GFP_KERNEL);
++ err = idr_alloc(&nbd_index_idr, nbd, 0,
++ (MINORMASK >> part_shift) + 1, GFP_KERNEL);
+ if (err >= 0)
+ index = err;
+ }
+diff --git a/drivers/char/hw_random/imx-rngc.c b/drivers/char/hw_random/imx-rngc.c
+index dc9b8f377907f..084f7e4254eba 100644
+--- a/drivers/char/hw_random/imx-rngc.c
++++ b/drivers/char/hw_random/imx-rngc.c
+@@ -105,7 +105,7 @@ static int imx_rngc_self_test(struct imx_rngc *rngc)
+ cmd = readl(rngc->base + RNGC_COMMAND);
+ writel(cmd | RNGC_CMD_SELF_TEST, rngc->base + RNGC_COMMAND);
+
+- ret = wait_for_completion_timeout(&rngc->rng_op_done, RNGC_TIMEOUT);
++ ret = wait_for_completion_timeout(&rngc->rng_op_done, msecs_to_jiffies(RNGC_TIMEOUT));
+ if (!ret) {
+ imx_rngc_irq_mask_clear(rngc);
+ return -ETIMEDOUT;
+@@ -188,9 +188,7 @@ static int imx_rngc_init(struct hwrng *rng)
+ cmd = readl(rngc->base + RNGC_COMMAND);
+ writel(cmd | RNGC_CMD_SEED, rngc->base + RNGC_COMMAND);
+
+- ret = wait_for_completion_timeout(&rngc->rng_op_done,
+- RNGC_TIMEOUT);
+-
++ ret = wait_for_completion_timeout(&rngc->rng_op_done, msecs_to_jiffies(RNGC_TIMEOUT));
+ if (!ret) {
+ imx_rngc_irq_mask_clear(rngc);
+ return -ETIMEDOUT;
+diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
+index 7abd604e938c2..58884d8752011 100644
+--- a/drivers/char/hw_random/virtio-rng.c
++++ b/drivers/char/hw_random/virtio-rng.c
+@@ -17,6 +17,7 @@
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
++#include <asm/barrier.h>
+ #include <linux/err.h>
+ #include <linux/hw_random.h>
+ #include <linux/scatterlist.h>
+@@ -30,71 +31,111 @@ static DEFINE_IDA(rng_index_ida);
+ struct virtrng_info {
+ struct hwrng hwrng;
+ struct virtqueue *vq;
+- struct completion have_data;
+ char name[25];
+- unsigned int data_avail;
+ int index;
+- bool busy;
+ bool hwrng_register_done;
+ bool hwrng_removed;
++ /* data transfer */
++ struct completion have_data;
++ unsigned int data_avail;
++ unsigned int data_idx;
++ /* minimal size returned by rng_buffer_size() */
++#if SMP_CACHE_BYTES < 32
++ u8 data[32];
++#else
++ u8 data[SMP_CACHE_BYTES];
++#endif
+ };
+
+ static void random_recv_done(struct virtqueue *vq)
+ {
+ struct virtrng_info *vi = vq->vdev->priv;
++ unsigned int len;
+
+ /* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */
+- if (!virtqueue_get_buf(vi->vq, &vi->data_avail))
++ if (!virtqueue_get_buf(vi->vq, &len))
+ return;
+
++ smp_store_release(&vi->data_avail, len);
+ complete(&vi->have_data);
+ }
+
+-/* The host will fill any buffer we give it with sweet, sweet randomness. */
+-static void register_buffer(struct virtrng_info *vi, u8 *buf, size_t size)
++static void request_entropy(struct virtrng_info *vi)
+ {
+ struct scatterlist sg;
+
+- sg_init_one(&sg, buf, size);
++ reinit_completion(&vi->have_data);
++ vi->data_idx = 0;
++
++ sg_init_one(&sg, vi->data, sizeof(vi->data));
+
+ /* There should always be room for one buffer. */
+- virtqueue_add_inbuf(vi->vq, &sg, 1, buf, GFP_KERNEL);
++ virtqueue_add_inbuf(vi->vq, &sg, 1, vi->data, GFP_KERNEL);
+
+ virtqueue_kick(vi->vq);
+ }
+
++static unsigned int copy_data(struct virtrng_info *vi, void *buf,
++ unsigned int size)
++{
++ size = min_t(unsigned int, size, vi->data_avail);
++ memcpy(buf, vi->data + vi->data_idx, size);
++ vi->data_idx += size;
++ vi->data_avail -= size;
++ if (vi->data_avail == 0)
++ request_entropy(vi);
++ return size;
++}
++
+ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait)
+ {
+ int ret;
+ struct virtrng_info *vi = (struct virtrng_info *)rng->priv;
++ unsigned int chunk;
++ size_t read;
+
+ if (vi->hwrng_removed)
+ return -ENODEV;
+
+- if (!vi->busy) {
+- vi->busy = true;
+- reinit_completion(&vi->have_data);
+- register_buffer(vi, buf, size);
++ read = 0;
++
++ /* copy available data */
++ if (smp_load_acquire(&vi->data_avail)) {
++ chunk = copy_data(vi, buf, size);
++ size -= chunk;
++ read += chunk;
+ }
+
+ if (!wait)
+- return 0;
+-
+- ret = wait_for_completion_killable(&vi->have_data);
+- if (ret < 0)
+- return ret;
++ return read;
++
++ /* We have already copied available entropy,
++ * so either size is 0 or data_avail is 0
++ */
++ while (size != 0) {
++ /* data_avail is 0 but a request is pending */
++ ret = wait_for_completion_killable(&vi->have_data);
++ if (ret < 0)
++ return ret;
++ /* if vi->data_avail is 0, we have been interrupted
++ * by a cleanup, but buffer stays in the queue
++ */
++ if (vi->data_avail == 0)
++ return read;
+
+- vi->busy = false;
++ chunk = copy_data(vi, buf + read, size);
++ size -= chunk;
++ read += chunk;
++ }
+
+- return vi->data_avail;
++ return read;
+ }
+
+ static void virtio_cleanup(struct hwrng *rng)
+ {
+ struct virtrng_info *vi = (struct virtrng_info *)rng->priv;
+
+- if (vi->busy)
+- wait_for_completion(&vi->have_data);
++ complete(&vi->have_data);
+ }
+
+ static int probe_common(struct virtio_device *vdev)
+@@ -130,6 +171,9 @@ static int probe_common(struct virtio_device *vdev)
+ goto err_find;
+ }
+
++ /* we always have a pending entropy request */
++ request_entropy(vi);
++
+ return 0;
+
+ err_find:
+@@ -145,9 +189,9 @@ static void remove_common(struct virtio_device *vdev)
+
+ vi->hwrng_removed = true;
+ vi->data_avail = 0;
++ vi->data_idx = 0;
+ complete(&vi->have_data);
+ vdev->config->reset(vdev);
+- vi->busy = false;
+ if (vi->hwrng_register_done)
+ hwrng_unregister(&vi->hwrng);
+ vdev->config->del_vqs(vdev);
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index c95ce9323d77a..430a9eac67e19 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -270,6 +270,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+ int size = 0;
+ int status;
+ u32 expected;
++ int rc;
+
+ if (count < TPM_HEADER_SIZE) {
+ size = -EIO;
+@@ -289,8 +290,13 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+ goto out;
+ }
+
+- size += recv_data(chip, &buf[TPM_HEADER_SIZE],
+- expected - TPM_HEADER_SIZE);
++ rc = recv_data(chip, &buf[TPM_HEADER_SIZE],
++ expected - TPM_HEADER_SIZE);
++ if (rc < 0) {
++ size = rc;
++ goto out;
++ }
++ size += rc;
+ if (size < expected) {
+ dev_err(&chip->dev, "Unable to read remainder of result\n");
+ size = -ETIME;
+diff --git a/drivers/char/tpm/tpm_vtpm_proxy.c b/drivers/char/tpm/tpm_vtpm_proxy.c
+index ecbb63f8d2318..05c77812b6501 100644
+--- a/drivers/char/tpm/tpm_vtpm_proxy.c
++++ b/drivers/char/tpm/tpm_vtpm_proxy.c
+@@ -700,37 +700,21 @@ static struct miscdevice vtpmx_miscdev = {
+ .fops = &vtpmx_fops,
+ };
+
+-static int vtpmx_init(void)
+-{
+- return misc_register(&vtpmx_miscdev);
+-}
+-
+-static void vtpmx_cleanup(void)
+-{
+- misc_deregister(&vtpmx_miscdev);
+-}
+-
+ static int __init vtpm_module_init(void)
+ {
+ int rc;
+
+- rc = vtpmx_init();
+- if (rc) {
+- pr_err("couldn't create vtpmx device\n");
+- return rc;
+- }
+-
+ workqueue = create_workqueue("tpm-vtpm");
+ if (!workqueue) {
+ pr_err("couldn't create workqueue\n");
+- rc = -ENOMEM;
+- goto err_vtpmx_cleanup;
++ return -ENOMEM;
+ }
+
+- return 0;
+-
+-err_vtpmx_cleanup:
+- vtpmx_cleanup();
++ rc = misc_register(&vtpmx_miscdev);
++ if (rc) {
++ pr_err("couldn't create vtpmx device\n");
++ destroy_workqueue(workqueue);
++ }
+
+ return rc;
+ }
+@@ -738,7 +722,7 @@ err_vtpmx_cleanup:
+ static void __exit vtpm_module_exit(void)
+ {
+ destroy_workqueue(workqueue);
+- vtpmx_cleanup();
++ misc_deregister(&vtpmx_miscdev);
+ }
+
+ module_init(vtpm_module_init);
+diff --git a/drivers/clk/clk-gate.c b/drivers/clk/clk-gate.c
+index dd82485e09a1f..c110f5d40b588 100644
+--- a/drivers/clk/clk-gate.c
++++ b/drivers/clk/clk-gate.c
+@@ -43,7 +43,7 @@ static void clk_gate_endisable(struct clk_hw *hw, int enable)
+ {
+ struct clk_gate *gate = to_clk_gate(hw);
+ int set = gate->flags & CLK_GATE_SET_TO_DISABLE ? 1 : 0;
+- unsigned long uninitialized_var(flags);
++ unsigned long flags;
+ u32 reg;
+
+ set ^= enable;
+diff --git a/drivers/clocksource/Makefile b/drivers/clocksource/Makefile
+index db51b2427e8a6..e33b21d3f9d8b 100644
+--- a/drivers/clocksource/Makefile
++++ b/drivers/clocksource/Makefile
+@@ -23,8 +23,8 @@ obj-$(CONFIG_FTTMR010_TIMER) += timer-fttmr010.o
+ obj-$(CONFIG_ROCKCHIP_TIMER) += rockchip_timer.o
+ obj-$(CONFIG_CLKSRC_NOMADIK_MTU) += nomadik-mtu.o
+ obj-$(CONFIG_CLKSRC_DBX500_PRCMU) += clksrc-dbx500-prcmu.o
+-obj-$(CONFIG_ARMADA_370_XP_TIMER) += time-armada-370-xp.o
+-obj-$(CONFIG_ORION_TIMER) += time-orion.o
++obj-$(CONFIG_ARMADA_370_XP_TIMER) += timer-armada-370-xp.o
++obj-$(CONFIG_ORION_TIMER) += timer-orion.o
+ obj-$(CONFIG_BCM2835_TIMER) += bcm2835_timer.o
+ obj-$(CONFIG_CLPS711X_TIMER) += clps711x-timer.o
+ obj-$(CONFIG_ATLAS7_TIMER) += timer-atlas7.o
+@@ -36,25 +36,25 @@ obj-$(CONFIG_SUN4I_TIMER) += sun4i_timer.o
+ obj-$(CONFIG_SUN5I_HSTIMER) += timer-sun5i.o
+ obj-$(CONFIG_MESON6_TIMER) += meson6_timer.o
+ obj-$(CONFIG_TEGRA_TIMER) += tegra20_timer.o
+-obj-$(CONFIG_VT8500_TIMER) += vt8500_timer.o
+-obj-$(CONFIG_NSPIRE_TIMER) += zevio-timer.o
++obj-$(CONFIG_VT8500_TIMER) += timer-vt8500.o
++obj-$(CONFIG_NSPIRE_TIMER) += timer-zevio.o
+ obj-$(CONFIG_BCM_KONA_TIMER) += bcm_kona_timer.o
+-obj-$(CONFIG_CADENCE_TTC_TIMER) += cadence_ttc_timer.o
+-obj-$(CONFIG_CLKSRC_EFM32) += time-efm32.o
++obj-$(CONFIG_CADENCE_TTC_TIMER) += timer-cadence-ttc.o
++obj-$(CONFIG_CLKSRC_EFM32) += timer-efm32.o
+ obj-$(CONFIG_CLKSRC_STM32) += timer-stm32.o
+ obj-$(CONFIG_CLKSRC_EXYNOS_MCT) += exynos_mct.o
+-obj-$(CONFIG_CLKSRC_LPC32XX) += time-lpc32xx.o
++obj-$(CONFIG_CLKSRC_LPC32XX) += timer-lpc32xx.o
+ obj-$(CONFIG_CLKSRC_MPS2) += mps2-timer.o
+ obj-$(CONFIG_CLKSRC_SAMSUNG_PWM) += samsung_pwm_timer.o
+-obj-$(CONFIG_FSL_FTM_TIMER) += fsl_ftm_timer.o
+-obj-$(CONFIG_VF_PIT_TIMER) += vf_pit_timer.o
+-obj-$(CONFIG_CLKSRC_QCOM) += qcom-timer.o
++obj-$(CONFIG_FSL_FTM_TIMER) += timer-fsl-ftm.o
++obj-$(CONFIG_VF_PIT_TIMER) += timer-vf-pit.o
++obj-$(CONFIG_CLKSRC_QCOM) += timer-qcom.o
+ obj-$(CONFIG_MTK_TIMER) += timer-mediatek.o
+-obj-$(CONFIG_CLKSRC_PISTACHIO) += time-pistachio.o
++obj-$(CONFIG_CLKSRC_PISTACHIO) += timer-pistachio.o
+ obj-$(CONFIG_CLKSRC_TI_32K) += timer-ti-32k.o
+ obj-$(CONFIG_CLKSRC_NPS) += timer-nps.o
+ obj-$(CONFIG_OXNAS_RPS_TIMER) += timer-oxnas-rps.o
+-obj-$(CONFIG_OWL_TIMER) += owl-timer.o
++obj-$(CONFIG_OWL_TIMER) += timer-owl.o
+ obj-$(CONFIG_SPRD_TIMER) += timer-sprd.o
+ obj-$(CONFIG_NPCM7XX_TIMER) += timer-npcm7xx.o
+
+@@ -66,7 +66,7 @@ obj-$(CONFIG_ARM_TIMER_SP804) += timer-sp804.o
+ obj-$(CONFIG_ARCH_HAS_TICK_BROADCAST) += dummy_timer.o
+ obj-$(CONFIG_KEYSTONE_TIMER) += timer-keystone.o
+ obj-$(CONFIG_INTEGRATOR_AP_TIMER) += timer-integrator-ap.o
+-obj-$(CONFIG_CLKSRC_VERSATILE) += versatile.o
++obj-$(CONFIG_CLKSRC_VERSATILE) += timer-versatile.o
+ obj-$(CONFIG_CLKSRC_MIPS_GIC) += mips-gic-timer.o
+ obj-$(CONFIG_CLKSRC_TANGO_XTAL) += tango_xtal.o
+ obj-$(CONFIG_CLKSRC_IMX_GPT) += timer-imx-gpt.o
+diff --git a/drivers/clocksource/cadence_ttc_timer.c b/drivers/clocksource/cadence_ttc_timer.c
+deleted file mode 100644
+index a7eb858a84a0f..0000000000000
+--- a/drivers/clocksource/cadence_ttc_timer.c
++++ /dev/null
+@@ -1,543 +0,0 @@
+-/*
+- * This file contains driver for the Cadence Triple Timer Counter Rev 06
+- *
+- * Copyright (C) 2011-2013 Xilinx
+- *
+- * based on arch/mips/kernel/time.c timer driver
+- *
+- * This software is licensed under the terms of the GNU General Public
+- * License version 2, as published by the Free Software Foundation, and
+- * may be copied, distributed, and modified under those terms.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- * GNU General Public License for more details.
+- */
+-
+-#include <linux/clk.h>
+-#include <linux/interrupt.h>
+-#include <linux/clockchips.h>
+-#include <linux/clocksource.h>
+-#include <linux/of_address.h>
+-#include <linux/of_irq.h>
+-#include <linux/slab.h>
+-#include <linux/sched_clock.h>
+-
+-/*
+- * This driver configures the 2 16/32-bit count-up timers as follows:
+- *
+- * T1: Timer 1, clocksource for generic timekeeping
+- * T2: Timer 2, clockevent source for hrtimers
+- * T3: Timer 3, <unused>
+- *
+- * The input frequency to the timer module for emulation is 2.5MHz which is
+- * common to all the timer channels (T1, T2, and T3). With a pre-scaler of 32,
+- * the timers are clocked at 78.125KHz (12.8 us resolution).
+-
+- * The input frequency to the timer module in silicon is configurable and
+- * obtained from device tree. The pre-scaler of 32 is used.
+- */
+-
+-/*
+- * Timer Register Offset Definitions of Timer 1, Increment base address by 4
+- * and use same offsets for Timer 2
+- */
+-#define TTC_CLK_CNTRL_OFFSET 0x00 /* Clock Control Reg, RW */
+-#define TTC_CNT_CNTRL_OFFSET 0x0C /* Counter Control Reg, RW */
+-#define TTC_COUNT_VAL_OFFSET 0x18 /* Counter Value Reg, RO */
+-#define TTC_INTR_VAL_OFFSET 0x24 /* Interval Count Reg, RW */
+-#define TTC_ISR_OFFSET 0x54 /* Interrupt Status Reg, RO */
+-#define TTC_IER_OFFSET 0x60 /* Interrupt Enable Reg, RW */
+-
+-#define TTC_CNT_CNTRL_DISABLE_MASK 0x1
+-
+-#define TTC_CLK_CNTRL_CSRC_MASK (1 << 5) /* clock source */
+-#define TTC_CLK_CNTRL_PSV_MASK 0x1e
+-#define TTC_CLK_CNTRL_PSV_SHIFT 1
+-
+-/*
+- * Setup the timers to use pre-scaling, using a fixed value for now that will
+- * work across most input frequency, but it may need to be more dynamic
+- */
+-#define PRESCALE_EXPONENT 11 /* 2 ^ PRESCALE_EXPONENT = PRESCALE */
+-#define PRESCALE 2048 /* The exponent must match this */
+-#define CLK_CNTRL_PRESCALE ((PRESCALE_EXPONENT - 1) << 1)
+-#define CLK_CNTRL_PRESCALE_EN 1
+-#define CNT_CNTRL_RESET (1 << 4)
+-
+-#define MAX_F_ERR 50
+-
+-/**
+- * struct ttc_timer - This definition defines local timer structure
+- *
+- * @base_addr: Base address of timer
+- * @freq: Timer input clock frequency
+- * @clk: Associated clock source
+- * @clk_rate_change_nb Notifier block for clock rate changes
+- */
+-struct ttc_timer {
+- void __iomem *base_addr;
+- unsigned long freq;
+- struct clk *clk;
+- struct notifier_block clk_rate_change_nb;
+-};
+-
+-#define to_ttc_timer(x) \
+- container_of(x, struct ttc_timer, clk_rate_change_nb)
+-
+-struct ttc_timer_clocksource {
+- u32 scale_clk_ctrl_reg_old;
+- u32 scale_clk_ctrl_reg_new;
+- struct ttc_timer ttc;
+- struct clocksource cs;
+-};
+-
+-#define to_ttc_timer_clksrc(x) \
+- container_of(x, struct ttc_timer_clocksource, cs)
+-
+-struct ttc_timer_clockevent {
+- struct ttc_timer ttc;
+- struct clock_event_device ce;
+-};
+-
+-#define to_ttc_timer_clkevent(x) \
+- container_of(x, struct ttc_timer_clockevent, ce)
+-
+-static void __iomem *ttc_sched_clock_val_reg;
+-
+-/**
+- * ttc_set_interval - Set the timer interval value
+- *
+- * @timer: Pointer to the timer instance
+- * @cycles: Timer interval ticks
+- **/
+-static void ttc_set_interval(struct ttc_timer *timer,
+- unsigned long cycles)
+-{
+- u32 ctrl_reg;
+-
+- /* Disable the counter, set the counter value and re-enable counter */
+- ctrl_reg = readl_relaxed(timer->base_addr + TTC_CNT_CNTRL_OFFSET);
+- ctrl_reg |= TTC_CNT_CNTRL_DISABLE_MASK;
+- writel_relaxed(ctrl_reg, timer->base_addr + TTC_CNT_CNTRL_OFFSET);
+-
+- writel_relaxed(cycles, timer->base_addr + TTC_INTR_VAL_OFFSET);
+-
+- /*
+- * Reset the counter (0x10) so that it starts from 0, one-shot
+- * mode makes this needed for timing to be right.
+- */
+- ctrl_reg |= CNT_CNTRL_RESET;
+- ctrl_reg &= ~TTC_CNT_CNTRL_DISABLE_MASK;
+- writel_relaxed(ctrl_reg, timer->base_addr + TTC_CNT_CNTRL_OFFSET);
+-}
+-
+-/**
+- * ttc_clock_event_interrupt - Clock event timer interrupt handler
+- *
+- * @irq: IRQ number of the Timer
+- * @dev_id: void pointer to the ttc_timer instance
+- *
+- * returns: Always IRQ_HANDLED - success
+- **/
+-static irqreturn_t ttc_clock_event_interrupt(int irq, void *dev_id)
+-{
+- struct ttc_timer_clockevent *ttce = dev_id;
+- struct ttc_timer *timer = &ttce->ttc;
+-
+- /* Acknowledge the interrupt and call event handler */
+- readl_relaxed(timer->base_addr + TTC_ISR_OFFSET);
+-
+- ttce->ce.event_handler(&ttce->ce);
+-
+- return IRQ_HANDLED;
+-}
+-
+-/**
+- * __ttc_clocksource_read - Reads the timer counter register
+- *
+- * returns: Current timer counter register value
+- **/
+-static u64 __ttc_clocksource_read(struct clocksource *cs)
+-{
+- struct ttc_timer *timer = &to_ttc_timer_clksrc(cs)->ttc;
+-
+- return (u64)readl_relaxed(timer->base_addr +
+- TTC_COUNT_VAL_OFFSET);
+-}
+-
+-static u64 notrace ttc_sched_clock_read(void)
+-{
+- return readl_relaxed(ttc_sched_clock_val_reg);
+-}
+-
+-/**
+- * ttc_set_next_event - Sets the time interval for next event
+- *
+- * @cycles: Timer interval ticks
+- * @evt: Address of clock event instance
+- *
+- * returns: Always 0 - success
+- **/
+-static int ttc_set_next_event(unsigned long cycles,
+- struct clock_event_device *evt)
+-{
+- struct ttc_timer_clockevent *ttce = to_ttc_timer_clkevent(evt);
+- struct ttc_timer *timer = &ttce->ttc;
+-
+- ttc_set_interval(timer, cycles);
+- return 0;
+-}
+-
+-/**
+- * ttc_set_{shutdown|oneshot|periodic} - Sets the state of timer
+- *
+- * @evt: Address of clock event instance
+- **/
+-static int ttc_shutdown(struct clock_event_device *evt)
+-{
+- struct ttc_timer_clockevent *ttce = to_ttc_timer_clkevent(evt);
+- struct ttc_timer *timer = &ttce->ttc;
+- u32 ctrl_reg;
+-
+- ctrl_reg = readl_relaxed(timer->base_addr + TTC_CNT_CNTRL_OFFSET);
+- ctrl_reg |= TTC_CNT_CNTRL_DISABLE_MASK;
+- writel_relaxed(ctrl_reg, timer->base_addr + TTC_CNT_CNTRL_OFFSET);
+- return 0;
+-}
+-
+-static int ttc_set_periodic(struct clock_event_device *evt)
+-{
+- struct ttc_timer_clockevent *ttce = to_ttc_timer_clkevent(evt);
+- struct ttc_timer *timer = &ttce->ttc;
+-
+- ttc_set_interval(timer,
+- DIV_ROUND_CLOSEST(ttce->ttc.freq, PRESCALE * HZ));
+- return 0;
+-}
+-
+-static int ttc_resume(struct clock_event_device *evt)
+-{
+- struct ttc_timer_clockevent *ttce = to_ttc_timer_clkevent(evt);
+- struct ttc_timer *timer = &ttce->ttc;
+- u32 ctrl_reg;
+-
+- ctrl_reg = readl_relaxed(timer->base_addr + TTC_CNT_CNTRL_OFFSET);
+- ctrl_reg &= ~TTC_CNT_CNTRL_DISABLE_MASK;
+- writel_relaxed(ctrl_reg, timer->base_addr + TTC_CNT_CNTRL_OFFSET);
+- return 0;
+-}
+-
+-static int ttc_rate_change_clocksource_cb(struct notifier_block *nb,
+- unsigned long event, void *data)
+-{
+- struct clk_notifier_data *ndata = data;
+- struct ttc_timer *ttc = to_ttc_timer(nb);
+- struct ttc_timer_clocksource *ttccs = container_of(ttc,
+- struct ttc_timer_clocksource, ttc);
+-
+- switch (event) {
+- case PRE_RATE_CHANGE:
+- {
+- u32 psv;
+- unsigned long factor, rate_low, rate_high;
+-
+- if (ndata->new_rate > ndata->old_rate) {
+- factor = DIV_ROUND_CLOSEST(ndata->new_rate,
+- ndata->old_rate);
+- rate_low = ndata->old_rate;
+- rate_high = ndata->new_rate;
+- } else {
+- factor = DIV_ROUND_CLOSEST(ndata->old_rate,
+- ndata->new_rate);
+- rate_low = ndata->new_rate;
+- rate_high = ndata->old_rate;
+- }
+-
+- if (!is_power_of_2(factor))
+- return NOTIFY_BAD;
+-
+- if (abs(rate_high - (factor * rate_low)) > MAX_F_ERR)
+- return NOTIFY_BAD;
+-
+- factor = __ilog2_u32(factor);
+-
+- /*
+- * store timer clock ctrl register so we can restore it in case
+- * of an abort.
+- */
+- ttccs->scale_clk_ctrl_reg_old =
+- readl_relaxed(ttccs->ttc.base_addr +
+- TTC_CLK_CNTRL_OFFSET);
+-
+- psv = (ttccs->scale_clk_ctrl_reg_old &
+- TTC_CLK_CNTRL_PSV_MASK) >>
+- TTC_CLK_CNTRL_PSV_SHIFT;
+- if (ndata->new_rate < ndata->old_rate)
+- psv -= factor;
+- else
+- psv += factor;
+-
+- /* prescaler within legal range? */
+- if (psv & ~(TTC_CLK_CNTRL_PSV_MASK >> TTC_CLK_CNTRL_PSV_SHIFT))
+- return NOTIFY_BAD;
+-
+- ttccs->scale_clk_ctrl_reg_new = ttccs->scale_clk_ctrl_reg_old &
+- ~TTC_CLK_CNTRL_PSV_MASK;
+- ttccs->scale_clk_ctrl_reg_new |= psv << TTC_CLK_CNTRL_PSV_SHIFT;
+-
+-
+- /* scale down: adjust divider in post-change notification */
+- if (ndata->new_rate < ndata->old_rate)
+- return NOTIFY_DONE;
+-
+- /* scale up: adjust divider now - before frequency change */
+- writel_relaxed(ttccs->scale_clk_ctrl_reg_new,
+- ttccs->ttc.base_addr + TTC_CLK_CNTRL_OFFSET);
+- break;
+- }
+- case POST_RATE_CHANGE:
+- /* scale up: pre-change notification did the adjustment */
+- if (ndata->new_rate > ndata->old_rate)
+- return NOTIFY_OK;
+-
+- /* scale down: adjust divider now - after frequency change */
+- writel_relaxed(ttccs->scale_clk_ctrl_reg_new,
+- ttccs->ttc.base_addr + TTC_CLK_CNTRL_OFFSET);
+- break;
+-
+- case ABORT_RATE_CHANGE:
+- /* we have to undo the adjustment in case we scale up */
+- if (ndata->new_rate < ndata->old_rate)
+- return NOTIFY_OK;
+-
+- /* restore original register value */
+- writel_relaxed(ttccs->scale_clk_ctrl_reg_old,
+- ttccs->ttc.base_addr + TTC_CLK_CNTRL_OFFSET);
+- /* fall through */
+- default:
+- return NOTIFY_DONE;
+- }
+-
+- return NOTIFY_DONE;
+-}
+-
+-static int __init ttc_setup_clocksource(struct clk *clk, void __iomem *base,
+- u32 timer_width)
+-{
+- struct ttc_timer_clocksource *ttccs;
+- int err;
+-
+- ttccs = kzalloc(sizeof(*ttccs), GFP_KERNEL);
+- if (!ttccs)
+- return -ENOMEM;
+-
+- ttccs->ttc.clk = clk;
+-
+- err = clk_prepare_enable(ttccs->ttc.clk);
+- if (err) {
+- kfree(ttccs);
+- return err;
+- }
+-
+- ttccs->ttc.freq = clk_get_rate(ttccs->ttc.clk);
+-
+- ttccs->ttc.clk_rate_change_nb.notifier_call =
+- ttc_rate_change_clocksource_cb;
+- ttccs->ttc.clk_rate_change_nb.next = NULL;
+-
+- err = clk_notifier_register(ttccs->ttc.clk,
+- &ttccs->ttc.clk_rate_change_nb);
+- if (err)
+- pr_warn("Unable to register clock notifier.\n");
+-
+- ttccs->ttc.base_addr = base;
+- ttccs->cs.name = "ttc_clocksource";
+- ttccs->cs.rating = 200;
+- ttccs->cs.read = __ttc_clocksource_read;
+- ttccs->cs.mask = CLOCKSOURCE_MASK(timer_width);
+- ttccs->cs.flags = CLOCK_SOURCE_IS_CONTINUOUS;
+-
+- /*
+- * Setup the clock source counter to be an incrementing counter
+- * with no interrupt and it rolls over at 0xFFFF. Pre-scale
+- * it by 32 also. Let it start running now.
+- */
+- writel_relaxed(0x0, ttccs->ttc.base_addr + TTC_IER_OFFSET);
+- writel_relaxed(CLK_CNTRL_PRESCALE | CLK_CNTRL_PRESCALE_EN,
+- ttccs->ttc.base_addr + TTC_CLK_CNTRL_OFFSET);
+- writel_relaxed(CNT_CNTRL_RESET,
+- ttccs->ttc.base_addr + TTC_CNT_CNTRL_OFFSET);
+-
+- err = clocksource_register_hz(&ttccs->cs, ttccs->ttc.freq / PRESCALE);
+- if (err) {
+- kfree(ttccs);
+- return err;
+- }
+-
+- ttc_sched_clock_val_reg = base + TTC_COUNT_VAL_OFFSET;
+- sched_clock_register(ttc_sched_clock_read, timer_width,
+- ttccs->ttc.freq / PRESCALE);
+-
+- return 0;
+-}
+-
+-static int ttc_rate_change_clockevent_cb(struct notifier_block *nb,
+- unsigned long event, void *data)
+-{
+- struct clk_notifier_data *ndata = data;
+- struct ttc_timer *ttc = to_ttc_timer(nb);
+- struct ttc_timer_clockevent *ttcce = container_of(ttc,
+- struct ttc_timer_clockevent, ttc);
+-
+- switch (event) {
+- case POST_RATE_CHANGE:
+- /* update cached frequency */
+- ttc->freq = ndata->new_rate;
+-
+- clockevents_update_freq(&ttcce->ce, ndata->new_rate / PRESCALE);
+-
+- /* fall through */
+- case PRE_RATE_CHANGE:
+- case ABORT_RATE_CHANGE:
+- default:
+- return NOTIFY_DONE;
+- }
+-}
+-
+-static int __init ttc_setup_clockevent(struct clk *clk,
+- void __iomem *base, u32 irq)
+-{
+- struct ttc_timer_clockevent *ttcce;
+- int err;
+-
+- ttcce = kzalloc(sizeof(*ttcce), GFP_KERNEL);
+- if (!ttcce)
+- return -ENOMEM;
+-
+- ttcce->ttc.clk = clk;
+-
+- err = clk_prepare_enable(ttcce->ttc.clk);
+- if (err)
+- goto out_kfree;
+-
+- ttcce->ttc.clk_rate_change_nb.notifier_call =
+- ttc_rate_change_clockevent_cb;
+- ttcce->ttc.clk_rate_change_nb.next = NULL;
+-
+- err = clk_notifier_register(ttcce->ttc.clk,
+- &ttcce->ttc.clk_rate_change_nb);
+- if (err) {
+- pr_warn("Unable to register clock notifier.\n");
+- goto out_kfree;
+- }
+-
+- ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk);
+-
+- ttcce->ttc.base_addr = base;
+- ttcce->ce.name = "ttc_clockevent";
+- ttcce->ce.features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
+- ttcce->ce.set_next_event = ttc_set_next_event;
+- ttcce->ce.set_state_shutdown = ttc_shutdown;
+- ttcce->ce.set_state_periodic = ttc_set_periodic;
+- ttcce->ce.set_state_oneshot = ttc_shutdown;
+- ttcce->ce.tick_resume = ttc_resume;
+- ttcce->ce.rating = 200;
+- ttcce->ce.irq = irq;
+- ttcce->ce.cpumask = cpu_possible_mask;
+-
+- /*
+- * Setup the clock event timer to be an interval timer which
+- * is prescaled by 32 using the interval interrupt. Leave it
+- * disabled for now.
+- */
+- writel_relaxed(0x23, ttcce->ttc.base_addr + TTC_CNT_CNTRL_OFFSET);
+- writel_relaxed(CLK_CNTRL_PRESCALE | CLK_CNTRL_PRESCALE_EN,
+- ttcce->ttc.base_addr + TTC_CLK_CNTRL_OFFSET);
+- writel_relaxed(0x1, ttcce->ttc.base_addr + TTC_IER_OFFSET);
+-
+- err = request_irq(irq, ttc_clock_event_interrupt,
+- IRQF_TIMER, ttcce->ce.name, ttcce);
+- if (err)
+- goto out_kfree;
+-
+- clockevents_config_and_register(&ttcce->ce,
+- ttcce->ttc.freq / PRESCALE, 1, 0xfffe);
+-
+- return 0;
+-
+-out_kfree:
+- kfree(ttcce);
+- return err;
+-}
+-
+-/**
+- * ttc_timer_init - Initialize the timer
+- *
+- * Initializes the timer hardware and register the clock source and clock event
+- * timers with Linux kernal timer framework
+- */
+-static int __init ttc_timer_init(struct device_node *timer)
+-{
+- unsigned int irq;
+- void __iomem *timer_baseaddr;
+- struct clk *clk_cs, *clk_ce;
+- static int initialized;
+- int clksel, ret;
+- u32 timer_width = 16;
+-
+- if (initialized)
+- return 0;
+-
+- initialized = 1;
+-
+- /*
+- * Get the 1st Triple Timer Counter (TTC) block from the device tree
+- * and use it. Note that the event timer uses the interrupt and it's the
+- * 2nd TTC hence the irq_of_parse_and_map(,1)
+- */
+- timer_baseaddr = of_iomap(timer, 0);
+- if (!timer_baseaddr) {
+- pr_err("ERROR: invalid timer base address\n");
+- return -ENXIO;
+- }
+-
+- irq = irq_of_parse_and_map(timer, 1);
+- if (irq <= 0) {
+- pr_err("ERROR: invalid interrupt number\n");
+- return -EINVAL;
+- }
+-
+- of_property_read_u32(timer, "timer-width", &timer_width);
+-
+- clksel = readl_relaxed(timer_baseaddr + TTC_CLK_CNTRL_OFFSET);
+- clksel = !!(clksel & TTC_CLK_CNTRL_CSRC_MASK);
+- clk_cs = of_clk_get(timer, clksel);
+- if (IS_ERR(clk_cs)) {
+- pr_err("ERROR: timer input clock not found\n");
+- return PTR_ERR(clk_cs);
+- }
+-
+- clksel = readl_relaxed(timer_baseaddr + 4 + TTC_CLK_CNTRL_OFFSET);
+- clksel = !!(clksel & TTC_CLK_CNTRL_CSRC_MASK);
+- clk_ce = of_clk_get(timer, clksel);
+- if (IS_ERR(clk_ce)) {
+- pr_err("ERROR: timer input clock not found\n");
+- return PTR_ERR(clk_ce);
+- }
+-
+- ret = ttc_setup_clocksource(clk_cs, timer_baseaddr, timer_width);
+- if (ret)
+- return ret;
+-
+- ret = ttc_setup_clockevent(clk_ce, timer_baseaddr + 4, irq);
+- if (ret)
+- return ret;
+-
+- pr_info("%s #0 at %p, irq=%d\n", timer->name, timer_baseaddr, irq);
+-
+- return 0;
+-}
+-
+-TIMER_OF_DECLARE(ttc, "cdns,ttc", ttc_timer_init);
+diff --git a/drivers/clocksource/fsl_ftm_timer.c b/drivers/clocksource/fsl_ftm_timer.c
+deleted file mode 100644
+index 846d18daf893b..0000000000000
+--- a/drivers/clocksource/fsl_ftm_timer.c
++++ /dev/null
+@@ -1,376 +0,0 @@
+-/*
+- * Freescale FlexTimer Module (FTM) timer driver.
+- *
+- * Copyright 2014 Freescale Semiconductor, Inc.
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License
+- * as published by the Free Software Foundation; either version 2
+- * of the License, or (at your option) any later version.
+- */
+-
+-#include <linux/clk.h>
+-#include <linux/clockchips.h>
+-#include <linux/clocksource.h>
+-#include <linux/err.h>
+-#include <linux/interrupt.h>
+-#include <linux/io.h>
+-#include <linux/of_address.h>
+-#include <linux/of_irq.h>
+-#include <linux/sched_clock.h>
+-#include <linux/slab.h>
+-
+-#define FTM_SC 0x00
+-#define FTM_SC_CLK_SHIFT 3
+-#define FTM_SC_CLK_MASK (0x3 << FTM_SC_CLK_SHIFT)
+-#define FTM_SC_CLK(c) ((c) << FTM_SC_CLK_SHIFT)
+-#define FTM_SC_PS_MASK 0x7
+-#define FTM_SC_TOIE BIT(6)
+-#define FTM_SC_TOF BIT(7)
+-
+-#define FTM_CNT 0x04
+-#define FTM_MOD 0x08
+-#define FTM_CNTIN 0x4C
+-
+-#define FTM_PS_MAX 7
+-
+-struct ftm_clock_device {
+- void __iomem *clksrc_base;
+- void __iomem *clkevt_base;
+- unsigned long periodic_cyc;
+- unsigned long ps;
+- bool big_endian;
+-};
+-
+-static struct ftm_clock_device *priv;
+-
+-static inline u32 ftm_readl(void __iomem *addr)
+-{
+- if (priv->big_endian)
+- return ioread32be(addr);
+- else
+- return ioread32(addr);
+-}
+-
+-static inline void ftm_writel(u32 val, void __iomem *addr)
+-{
+- if (priv->big_endian)
+- iowrite32be(val, addr);
+- else
+- iowrite32(val, addr);
+-}
+-
+-static inline void ftm_counter_enable(void __iomem *base)
+-{
+- u32 val;
+-
+- /* select and enable counter clock source */
+- val = ftm_readl(base + FTM_SC);
+- val &= ~(FTM_SC_PS_MASK | FTM_SC_CLK_MASK);
+- val |= priv->ps | FTM_SC_CLK(1);
+- ftm_writel(val, base + FTM_SC);
+-}
+-
+-static inline void ftm_counter_disable(void __iomem *base)
+-{
+- u32 val;
+-
+- /* disable counter clock source */
+- val = ftm_readl(base + FTM_SC);
+- val &= ~(FTM_SC_PS_MASK | FTM_SC_CLK_MASK);
+- ftm_writel(val, base + FTM_SC);
+-}
+-
+-static inline void ftm_irq_acknowledge(void __iomem *base)
+-{
+- u32 val;
+-
+- val = ftm_readl(base + FTM_SC);
+- val &= ~FTM_SC_TOF;
+- ftm_writel(val, base + FTM_SC);
+-}
+-
+-static inline void ftm_irq_enable(void __iomem *base)
+-{
+- u32 val;
+-
+- val = ftm_readl(base + FTM_SC);
+- val |= FTM_SC_TOIE;
+- ftm_writel(val, base + FTM_SC);
+-}
+-
+-static inline void ftm_irq_disable(void __iomem *base)
+-{
+- u32 val;
+-
+- val = ftm_readl(base + FTM_SC);
+- val &= ~FTM_SC_TOIE;
+- ftm_writel(val, base + FTM_SC);
+-}
+-
+-static inline void ftm_reset_counter(void __iomem *base)
+-{
+- /*
+- * The CNT register contains the FTM counter value.
+- * Reset clears the CNT register. Writing any value to COUNT
+- * updates the counter with its initial value, CNTIN.
+- */
+- ftm_writel(0x00, base + FTM_CNT);
+-}
+-
+-static u64 notrace ftm_read_sched_clock(void)
+-{
+- return ftm_readl(priv->clksrc_base + FTM_CNT);
+-}
+-
+-static int ftm_set_next_event(unsigned long delta,
+- struct clock_event_device *unused)
+-{
+- /*
+- * The CNNIN and MOD are all double buffer registers, writing
+- * to the MOD register latches the value into a buffer. The MOD
+- * register is updated with the value of its write buffer with
+- * the following scenario:
+- * a, the counter source clock is diabled.
+- */
+- ftm_counter_disable(priv->clkevt_base);
+-
+- /* Force the value of CNTIN to be loaded into the FTM counter */
+- ftm_reset_counter(priv->clkevt_base);
+-
+- /*
+- * The counter increments until the value of MOD is reached,
+- * at which point the counter is reloaded with the value of CNTIN.
+- * The TOF (the overflow flag) bit is set when the FTM counter
+- * changes from MOD to CNTIN. So we should using the delta - 1.
+- */
+- ftm_writel(delta - 1, priv->clkevt_base + FTM_MOD);
+-
+- ftm_counter_enable(priv->clkevt_base);
+-
+- ftm_irq_enable(priv->clkevt_base);
+-
+- return 0;
+-}
+-
+-static int ftm_set_oneshot(struct clock_event_device *evt)
+-{
+- ftm_counter_disable(priv->clkevt_base);
+- return 0;
+-}
+-
+-static int ftm_set_periodic(struct clock_event_device *evt)
+-{
+- ftm_set_next_event(priv->periodic_cyc, evt);
+- return 0;
+-}
+-
+-static irqreturn_t ftm_evt_interrupt(int irq, void *dev_id)
+-{
+- struct clock_event_device *evt = dev_id;
+-
+- ftm_irq_acknowledge(priv->clkevt_base);
+-
+- if (likely(clockevent_state_oneshot(evt))) {
+- ftm_irq_disable(priv->clkevt_base);
+- ftm_counter_disable(priv->clkevt_base);
+- }
+-
+- evt->event_handler(evt);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static struct clock_event_device ftm_clockevent = {
+- .name = "Freescale ftm timer",
+- .features = CLOCK_EVT_FEAT_PERIODIC |
+- CLOCK_EVT_FEAT_ONESHOT,
+- .set_state_periodic = ftm_set_periodic,
+- .set_state_oneshot = ftm_set_oneshot,
+- .set_next_event = ftm_set_next_event,
+- .rating = 300,
+-};
+-
+-static struct irqaction ftm_timer_irq = {
+- .name = "Freescale ftm timer",
+- .flags = IRQF_TIMER | IRQF_IRQPOLL,
+- .handler = ftm_evt_interrupt,
+- .dev_id = &ftm_clockevent,
+-};
+-
+-static int __init ftm_clockevent_init(unsigned long freq, int irq)
+-{
+- int err;
+-
+- ftm_writel(0x00, priv->clkevt_base + FTM_CNTIN);
+- ftm_writel(~0u, priv->clkevt_base + FTM_MOD);
+-
+- ftm_reset_counter(priv->clkevt_base);
+-
+- err = setup_irq(irq, &ftm_timer_irq);
+- if (err) {
+- pr_err("ftm: setup irq failed: %d\n", err);
+- return err;
+- }
+-
+- ftm_clockevent.cpumask = cpumask_of(0);
+- ftm_clockevent.irq = irq;
+-
+- clockevents_config_and_register(&ftm_clockevent,
+- freq / (1 << priv->ps),
+- 1, 0xffff);
+-
+- ftm_counter_enable(priv->clkevt_base);
+-
+- return 0;
+-}
+-
+-static int __init ftm_clocksource_init(unsigned long freq)
+-{
+- int err;
+-
+- ftm_writel(0x00, priv->clksrc_base + FTM_CNTIN);
+- ftm_writel(~0u, priv->clksrc_base + FTM_MOD);
+-
+- ftm_reset_counter(priv->clksrc_base);
+-
+- sched_clock_register(ftm_read_sched_clock, 16, freq / (1 << priv->ps));
+- err = clocksource_mmio_init(priv->clksrc_base + FTM_CNT, "fsl-ftm",
+- freq / (1 << priv->ps), 300, 16,
+- clocksource_mmio_readl_up);
+- if (err) {
+- pr_err("ftm: init clock source mmio failed: %d\n", err);
+- return err;
+- }
+-
+- ftm_counter_enable(priv->clksrc_base);
+-
+- return 0;
+-}
+-
+-static int __init __ftm_clk_init(struct device_node *np, char *cnt_name,
+- char *ftm_name)
+-{
+- struct clk *clk;
+- int err;
+-
+- clk = of_clk_get_by_name(np, cnt_name);
+- if (IS_ERR(clk)) {
+- pr_err("ftm: Cannot get \"%s\": %ld\n", cnt_name, PTR_ERR(clk));
+- return PTR_ERR(clk);
+- }
+- err = clk_prepare_enable(clk);
+- if (err) {
+- pr_err("ftm: clock failed to prepare+enable \"%s\": %d\n",
+- cnt_name, err);
+- return err;
+- }
+-
+- clk = of_clk_get_by_name(np, ftm_name);
+- if (IS_ERR(clk)) {
+- pr_err("ftm: Cannot get \"%s\": %ld\n", ftm_name, PTR_ERR(clk));
+- return PTR_ERR(clk);
+- }
+- err = clk_prepare_enable(clk);
+- if (err)
+- pr_err("ftm: clock failed to prepare+enable \"%s\": %d\n",
+- ftm_name, err);
+-
+- return clk_get_rate(clk);
+-}
+-
+-static unsigned long __init ftm_clk_init(struct device_node *np)
+-{
+- long freq;
+-
+- freq = __ftm_clk_init(np, "ftm-evt-counter-en", "ftm-evt");
+- if (freq <= 0)
+- return 0;
+-
+- freq = __ftm_clk_init(np, "ftm-src-counter-en", "ftm-src");
+- if (freq <= 0)
+- return 0;
+-
+- return freq;
+-}
+-
+-static int __init ftm_calc_closest_round_cyc(unsigned long freq)
+-{
+- priv->ps = 0;
+-
+- /* The counter register is only using the lower 16 bits, and
+- * if the 'freq' value is to big here, then the periodic_cyc
+- * may exceed 0xFFFF.
+- */
+- do {
+- priv->periodic_cyc = DIV_ROUND_CLOSEST(freq,
+- HZ * (1 << priv->ps++));
+- } while (priv->periodic_cyc > 0xFFFF);
+-
+- if (priv->ps > FTM_PS_MAX) {
+- pr_err("ftm: the prescaler is %lu > %d\n",
+- priv->ps, FTM_PS_MAX);
+- return -EINVAL;
+- }
+-
+- return 0;
+-}
+-
+-static int __init ftm_timer_init(struct device_node *np)
+-{
+- unsigned long freq;
+- int ret, irq;
+-
+- priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+- if (!priv)
+- return -ENOMEM;
+-
+- ret = -ENXIO;
+- priv->clkevt_base = of_iomap(np, 0);
+- if (!priv->clkevt_base) {
+- pr_err("ftm: unable to map event timer registers\n");
+- goto err_clkevt;
+- }
+-
+- priv->clksrc_base = of_iomap(np, 1);
+- if (!priv->clksrc_base) {
+- pr_err("ftm: unable to map source timer registers\n");
+- goto err_clksrc;
+- }
+-
+- ret = -EINVAL;
+- irq = irq_of_parse_and_map(np, 0);
+- if (irq <= 0) {
+- pr_err("ftm: unable to get IRQ from DT, %d\n", irq);
+- goto err;
+- }
+-
+- priv->big_endian = of_property_read_bool(np, "big-endian");
+-
+- freq = ftm_clk_init(np);
+- if (!freq)
+- goto err;
+-
+- ret = ftm_calc_closest_round_cyc(freq);
+- if (ret)
+- goto err;
+-
+- ret = ftm_clocksource_init(freq);
+- if (ret)
+- goto err;
+-
+- ret = ftm_clockevent_init(freq, irq);
+- if (ret)
+- goto err;
+-
+- return 0;
+-
+-err:
+- iounmap(priv->clksrc_base);
+-err_clksrc:
+- iounmap(priv->clkevt_base);
+-err_clkevt:
+- kfree(priv);
+- return ret;
+-}
+-TIMER_OF_DECLARE(flextimer, "fsl,ftm-timer", ftm_timer_init);
+diff --git a/drivers/clocksource/owl-timer.c b/drivers/clocksource/owl-timer.c
+deleted file mode 100644
+index ea00a5e8f95d2..0000000000000
+--- a/drivers/clocksource/owl-timer.c
++++ /dev/null
+@@ -1,173 +0,0 @@
+-/*
+- * Actions Semi Owl timer
+- *
+- * Copyright 2012 Actions Semi Inc.
+- * Author: Actions Semi, Inc.
+- *
+- * Copyright (c) 2017 SUSE Linux GmbH
+- * Author: Andreas Färber
+- *
+- * This program is free software; you can redistribute it and/or modify it
+- * under the terms of the GNU General Public License as published by the
+- * Free Software Foundation; either version 2 of the License, or (at your
+- * option) any later version.
+- */
+-
+-#include <linux/clk.h>
+-#include <linux/clockchips.h>
+-#include <linux/interrupt.h>
+-#include <linux/irq.h>
+-#include <linux/irqreturn.h>
+-#include <linux/sched_clock.h>
+-#include <linux/of.h>
+-#include <linux/of_address.h>
+-#include <linux/of_irq.h>
+-
+-#define OWL_Tx_CTL 0x0
+-#define OWL_Tx_CMP 0x4
+-#define OWL_Tx_VAL 0x8
+-
+-#define OWL_Tx_CTL_PD BIT(0)
+-#define OWL_Tx_CTL_INTEN BIT(1)
+-#define OWL_Tx_CTL_EN BIT(2)
+-
+-static void __iomem *owl_timer_base;
+-static void __iomem *owl_clksrc_base;
+-static void __iomem *owl_clkevt_base;
+-
+-static inline void owl_timer_reset(void __iomem *base)
+-{
+- writel(0, base + OWL_Tx_CTL);
+- writel(0, base + OWL_Tx_VAL);
+- writel(0, base + OWL_Tx_CMP);
+-}
+-
+-static inline void owl_timer_set_enabled(void __iomem *base, bool enabled)
+-{
+- u32 ctl = readl(base + OWL_Tx_CTL);
+-
+- /* PD bit is cleared when set */
+- ctl &= ~OWL_Tx_CTL_PD;
+-
+- if (enabled)
+- ctl |= OWL_Tx_CTL_EN;
+- else
+- ctl &= ~OWL_Tx_CTL_EN;
+-
+- writel(ctl, base + OWL_Tx_CTL);
+-}
+-
+-static u64 notrace owl_timer_sched_read(void)
+-{
+- return (u64)readl(owl_clksrc_base + OWL_Tx_VAL);
+-}
+-
+-static int owl_timer_set_state_shutdown(struct clock_event_device *evt)
+-{
+- owl_timer_set_enabled(owl_clkevt_base, false);
+-
+- return 0;
+-}
+-
+-static int owl_timer_set_state_oneshot(struct clock_event_device *evt)
+-{
+- owl_timer_reset(owl_clkevt_base);
+-
+- return 0;
+-}
+-
+-static int owl_timer_tick_resume(struct clock_event_device *evt)
+-{
+- return 0;
+-}
+-
+-static int owl_timer_set_next_event(unsigned long evt,
+- struct clock_event_device *ev)
+-{
+- void __iomem *base = owl_clkevt_base;
+-
+- owl_timer_set_enabled(base, false);
+- writel(OWL_Tx_CTL_INTEN, base + OWL_Tx_CTL);
+- writel(0, base + OWL_Tx_VAL);
+- writel(evt, base + OWL_Tx_CMP);
+- owl_timer_set_enabled(base, true);
+-
+- return 0;
+-}
+-
+-static struct clock_event_device owl_clockevent = {
+- .name = "owl_tick",
+- .rating = 200,
+- .features = CLOCK_EVT_FEAT_ONESHOT |
+- CLOCK_EVT_FEAT_DYNIRQ,
+- .set_state_shutdown = owl_timer_set_state_shutdown,
+- .set_state_oneshot = owl_timer_set_state_oneshot,
+- .tick_resume = owl_timer_tick_resume,
+- .set_next_event = owl_timer_set_next_event,
+-};
+-
+-static irqreturn_t owl_timer1_interrupt(int irq, void *dev_id)
+-{
+- struct clock_event_device *evt = (struct clock_event_device *)dev_id;
+-
+- writel(OWL_Tx_CTL_PD, owl_clkevt_base + OWL_Tx_CTL);
+-
+- evt->event_handler(evt);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static int __init owl_timer_init(struct device_node *node)
+-{
+- struct clk *clk;
+- unsigned long rate;
+- int timer1_irq, ret;
+-
+- owl_timer_base = of_io_request_and_map(node, 0, "owl-timer");
+- if (IS_ERR(owl_timer_base)) {
+- pr_err("Can't map timer registers\n");
+- return PTR_ERR(owl_timer_base);
+- }
+-
+- owl_clksrc_base = owl_timer_base + 0x08;
+- owl_clkevt_base = owl_timer_base + 0x14;
+-
+- timer1_irq = of_irq_get_byname(node, "timer1");
+- if (timer1_irq <= 0) {
+- pr_err("Can't parse timer1 IRQ\n");
+- return -EINVAL;
+- }
+-
+- clk = of_clk_get(node, 0);
+- if (IS_ERR(clk))
+- return PTR_ERR(clk);
+-
+- rate = clk_get_rate(clk);
+-
+- owl_timer_reset(owl_clksrc_base);
+- owl_timer_set_enabled(owl_clksrc_base, true);
+-
+- sched_clock_register(owl_timer_sched_read, 32, rate);
+- clocksource_mmio_init(owl_clksrc_base + OWL_Tx_VAL, node->name,
+- rate, 200, 32, clocksource_mmio_readl_up);
+-
+- owl_timer_reset(owl_clkevt_base);
+-
+- ret = request_irq(timer1_irq, owl_timer1_interrupt, IRQF_TIMER,
+- "owl-timer", &owl_clockevent);
+- if (ret) {
+- pr_err("failed to request irq %d\n", timer1_irq);
+- return ret;
+- }
+-
+- owl_clockevent.cpumask = cpumask_of(0);
+- owl_clockevent.irq = timer1_irq;
+-
+- clockevents_config_and_register(&owl_clockevent, rate,
+- 0xf, 0xffffffff);
+-
+- return 0;
+-}
+-TIMER_OF_DECLARE(owl_s500, "actions,s500-timer", owl_timer_init);
+-TIMER_OF_DECLARE(owl_s700, "actions,s700-timer", owl_timer_init);
+-TIMER_OF_DECLARE(owl_s900, "actions,s900-timer", owl_timer_init);
+diff --git a/drivers/clocksource/qcom-timer.c b/drivers/clocksource/qcom-timer.c
+deleted file mode 100644
+index 89816f89ff3f4..0000000000000
+--- a/drivers/clocksource/qcom-timer.c
++++ /dev/null
+@@ -1,258 +0,0 @@
+-/*
+- *
+- * Copyright (C) 2007 Google, Inc.
+- * Copyright (c) 2009-2012,2014, The Linux Foundation. All rights reserved.
+- *
+- * This software is licensed under the terms of the GNU General Public
+- * License version 2, as published by the Free Software Foundation, and
+- * may be copied, distributed, and modified under those terms.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- * GNU General Public License for more details.
+- *
+- */
+-
+-#include <linux/clocksource.h>
+-#include <linux/clockchips.h>
+-#include <linux/cpu.h>
+-#include <linux/init.h>
+-#include <linux/interrupt.h>
+-#include <linux/irq.h>
+-#include <linux/io.h>
+-#include <linux/of.h>
+-#include <linux/of_address.h>
+-#include <linux/of_irq.h>
+-#include <linux/sched_clock.h>
+-
+-#include <asm/delay.h>
+-
+-#define TIMER_MATCH_VAL 0x0000
+-#define TIMER_COUNT_VAL 0x0004
+-#define TIMER_ENABLE 0x0008
+-#define TIMER_ENABLE_CLR_ON_MATCH_EN BIT(1)
+-#define TIMER_ENABLE_EN BIT(0)
+-#define TIMER_CLEAR 0x000C
+-#define DGT_CLK_CTL 0x10
+-#define DGT_CLK_CTL_DIV_4 0x3
+-#define TIMER_STS_GPT0_CLR_PEND BIT(10)
+-
+-#define GPT_HZ 32768
+-
+-static void __iomem *event_base;
+-static void __iomem *sts_base;
+-
+-static irqreturn_t msm_timer_interrupt(int irq, void *dev_id)
+-{
+- struct clock_event_device *evt = dev_id;
+- /* Stop the timer tick */
+- if (clockevent_state_oneshot(evt)) {
+- u32 ctrl = readl_relaxed(event_base + TIMER_ENABLE);
+- ctrl &= ~TIMER_ENABLE_EN;
+- writel_relaxed(ctrl, event_base + TIMER_ENABLE);
+- }
+- evt->event_handler(evt);
+- return IRQ_HANDLED;
+-}
+-
+-static int msm_timer_set_next_event(unsigned long cycles,
+- struct clock_event_device *evt)
+-{
+- u32 ctrl = readl_relaxed(event_base + TIMER_ENABLE);
+-
+- ctrl &= ~TIMER_ENABLE_EN;
+- writel_relaxed(ctrl, event_base + TIMER_ENABLE);
+-
+- writel_relaxed(ctrl, event_base + TIMER_CLEAR);
+- writel_relaxed(cycles, event_base + TIMER_MATCH_VAL);
+-
+- if (sts_base)
+- while (readl_relaxed(sts_base) & TIMER_STS_GPT0_CLR_PEND)
+- cpu_relax();
+-
+- writel_relaxed(ctrl | TIMER_ENABLE_EN, event_base + TIMER_ENABLE);
+- return 0;
+-}
+-
+-static int msm_timer_shutdown(struct clock_event_device *evt)
+-{
+- u32 ctrl;
+-
+- ctrl = readl_relaxed(event_base + TIMER_ENABLE);
+- ctrl &= ~(TIMER_ENABLE_EN | TIMER_ENABLE_CLR_ON_MATCH_EN);
+- writel_relaxed(ctrl, event_base + TIMER_ENABLE);
+- return 0;
+-}
+-
+-static struct clock_event_device __percpu *msm_evt;
+-
+-static void __iomem *source_base;
+-
+-static notrace u64 msm_read_timer_count(struct clocksource *cs)
+-{
+- return readl_relaxed(source_base + TIMER_COUNT_VAL);
+-}
+-
+-static struct clocksource msm_clocksource = {
+- .name = "dg_timer",
+- .rating = 300,
+- .read = msm_read_timer_count,
+- .mask = CLOCKSOURCE_MASK(32),
+- .flags = CLOCK_SOURCE_IS_CONTINUOUS,
+-};
+-
+-static int msm_timer_irq;
+-static int msm_timer_has_ppi;
+-
+-static int msm_local_timer_starting_cpu(unsigned int cpu)
+-{
+- struct clock_event_device *evt = per_cpu_ptr(msm_evt, cpu);
+- int err;
+-
+- evt->irq = msm_timer_irq;
+- evt->name = "msm_timer";
+- evt->features = CLOCK_EVT_FEAT_ONESHOT;
+- evt->rating = 200;
+- evt->set_state_shutdown = msm_timer_shutdown;
+- evt->set_state_oneshot = msm_timer_shutdown;
+- evt->tick_resume = msm_timer_shutdown;
+- evt->set_next_event = msm_timer_set_next_event;
+- evt->cpumask = cpumask_of(cpu);
+-
+- clockevents_config_and_register(evt, GPT_HZ, 4, 0xffffffff);
+-
+- if (msm_timer_has_ppi) {
+- enable_percpu_irq(evt->irq, IRQ_TYPE_EDGE_RISING);
+- } else {
+- err = request_irq(evt->irq, msm_timer_interrupt,
+- IRQF_TIMER | IRQF_NOBALANCING |
+- IRQF_TRIGGER_RISING, "gp_timer", evt);
+- if (err)
+- pr_err("request_irq failed\n");
+- }
+-
+- return 0;
+-}
+-
+-static int msm_local_timer_dying_cpu(unsigned int cpu)
+-{
+- struct clock_event_device *evt = per_cpu_ptr(msm_evt, cpu);
+-
+- evt->set_state_shutdown(evt);
+- disable_percpu_irq(evt->irq);
+- return 0;
+-}
+-
+-static u64 notrace msm_sched_clock_read(void)
+-{
+- return msm_clocksource.read(&msm_clocksource);
+-}
+-
+-static unsigned long msm_read_current_timer(void)
+-{
+- return msm_clocksource.read(&msm_clocksource);
+-}
+-
+-static struct delay_timer msm_delay_timer = {
+- .read_current_timer = msm_read_current_timer,
+-};
+-
+-static int __init msm_timer_init(u32 dgt_hz, int sched_bits, int irq,
+- bool percpu)
+-{
+- struct clocksource *cs = &msm_clocksource;
+- int res = 0;
+-
+- msm_timer_irq = irq;
+- msm_timer_has_ppi = percpu;
+-
+- msm_evt = alloc_percpu(struct clock_event_device);
+- if (!msm_evt) {
+- pr_err("memory allocation failed for clockevents\n");
+- goto err;
+- }
+-
+- if (percpu)
+- res = request_percpu_irq(irq, msm_timer_interrupt,
+- "gp_timer", msm_evt);
+-
+- if (res) {
+- pr_err("request_percpu_irq failed\n");
+- } else {
+- /* Install and invoke hotplug callbacks */
+- res = cpuhp_setup_state(CPUHP_AP_QCOM_TIMER_STARTING,
+- "clockevents/qcom/timer:starting",
+- msm_local_timer_starting_cpu,
+- msm_local_timer_dying_cpu);
+- if (res) {
+- free_percpu_irq(irq, msm_evt);
+- goto err;
+- }
+- }
+-
+-err:
+- writel_relaxed(TIMER_ENABLE_EN, source_base + TIMER_ENABLE);
+- res = clocksource_register_hz(cs, dgt_hz);
+- if (res)
+- pr_err("clocksource_register failed\n");
+- sched_clock_register(msm_sched_clock_read, sched_bits, dgt_hz);
+- msm_delay_timer.freq = dgt_hz;
+- register_current_timer_delay(&msm_delay_timer);
+-
+- return res;
+-}
+-
+-static int __init msm_dt_timer_init(struct device_node *np)
+-{
+- u32 freq;
+- int irq, ret;
+- struct resource res;
+- u32 percpu_offset;
+- void __iomem *base;
+- void __iomem *cpu0_base;
+-
+- base = of_iomap(np, 0);
+- if (!base) {
+- pr_err("Failed to map event base\n");
+- return -ENXIO;
+- }
+-
+- /* We use GPT0 for the clockevent */
+- irq = irq_of_parse_and_map(np, 1);
+- if (irq <= 0) {
+- pr_err("Can't get irq\n");
+- return -EINVAL;
+- }
+-
+- /* We use CPU0's DGT for the clocksource */
+- if (of_property_read_u32(np, "cpu-offset", &percpu_offset))
+- percpu_offset = 0;
+-
+- ret = of_address_to_resource(np, 0, &res);
+- if (ret) {
+- pr_err("Failed to parse DGT resource\n");
+- return ret;
+- }
+-
+- cpu0_base = ioremap(res.start + percpu_offset, resource_size(&res));
+- if (!cpu0_base) {
+- pr_err("Failed to map source base\n");
+- return -EINVAL;
+- }
+-
+- if (of_property_read_u32(np, "clock-frequency", &freq)) {
+- pr_err("Unknown frequency\n");
+- return -EINVAL;
+- }
+-
+- event_base = base + 0x4;
+- sts_base = base + 0x88;
+- source_base = cpu0_base + 0x24;
+- freq /= 4;
+- writel_relaxed(DGT_CLK_CTL_DIV_4, source_base + DGT_CLK_CTL);
+-
+- return msm_timer_init(freq, 32, irq, !!percpu_offset);
+-}
+-TIMER_OF_DECLARE(kpss_timer, "qcom,kpss-timer", msm_dt_timer_init);
+-TIMER_OF_DECLARE(scss_timer, "qcom,scss-timer", msm_dt_timer_init);
+diff --git a/drivers/clocksource/time-armada-370-xp.c b/drivers/clocksource/time-armada-370-xp.c
+deleted file mode 100644
+index edf1a46269f10..0000000000000
+--- a/drivers/clocksource/time-armada-370-xp.c
++++ /dev/null
+@@ -1,416 +0,0 @@
+-/*
+- * Marvell Armada 370/XP SoC timer handling.
+- *
+- * Copyright (C) 2012 Marvell
+- *
+- * Lior Amsalem <alior@marvell.com>
+- * Gregory CLEMENT <gregory.clement@free-electrons.com>
+- * Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+- *
+- * This file is licensed under the terms of the GNU General Public
+- * License version 2. This program is licensed "as is" without any
+- * warranty of any kind, whether express or implied.
+- *
+- * Timer 0 is used as free-running clocksource, while timer 1 is
+- * used as clock_event_device.
+- *
+- * ---
+- * Clocksource driver for Armada 370 and Armada XP SoC.
+- * This driver implements one compatible string for each SoC, given
+- * each has its own characteristics:
+- *
+- * * Armada 370 has no 25 MHz fixed timer.
+- *
+- * * Armada XP cannot work properly without such 25 MHz fixed timer as
+- * doing otherwise leads to using a clocksource whose frequency varies
+- * when doing cpufreq frequency changes.
+- *
+- * See Documentation/devicetree/bindings/timer/marvell,armada-370-xp-timer.txt
+- */
+-
+-#include <linux/init.h>
+-#include <linux/platform_device.h>
+-#include <linux/kernel.h>
+-#include <linux/clk.h>
+-#include <linux/cpu.h>
+-#include <linux/timer.h>
+-#include <linux/clockchips.h>
+-#include <linux/interrupt.h>
+-#include <linux/of.h>
+-#include <linux/of_irq.h>
+-#include <linux/of_address.h>
+-#include <linux/irq.h>
+-#include <linux/module.h>
+-#include <linux/sched_clock.h>
+-#include <linux/percpu.h>
+-#include <linux/syscore_ops.h>
+-
+-#include <asm/delay.h>
+-
+-/*
+- * Timer block registers.
+- */
+-#define TIMER_CTRL_OFF 0x0000
+-#define TIMER0_EN BIT(0)
+-#define TIMER0_RELOAD_EN BIT(1)
+-#define TIMER0_25MHZ BIT(11)
+-#define TIMER0_DIV(div) ((div) << 19)
+-#define TIMER1_EN BIT(2)
+-#define TIMER1_RELOAD_EN BIT(3)
+-#define TIMER1_25MHZ BIT(12)
+-#define TIMER1_DIV(div) ((div) << 22)
+-#define TIMER_EVENTS_STATUS 0x0004
+-#define TIMER0_CLR_MASK (~0x1)
+-#define TIMER1_CLR_MASK (~0x100)
+-#define TIMER0_RELOAD_OFF 0x0010
+-#define TIMER0_VAL_OFF 0x0014
+-#define TIMER1_RELOAD_OFF 0x0018
+-#define TIMER1_VAL_OFF 0x001c
+-
+-#define LCL_TIMER_EVENTS_STATUS 0x0028
+-/* Global timers are connected to the coherency fabric clock, and the
+- below divider reduces their incrementing frequency. */
+-#define TIMER_DIVIDER_SHIFT 5
+-#define TIMER_DIVIDER (1 << TIMER_DIVIDER_SHIFT)
+-
+-/*
+- * SoC-specific data.
+- */
+-static void __iomem *timer_base, *local_base;
+-static unsigned int timer_clk;
+-static bool timer25Mhz = true;
+-static u32 enable_mask;
+-
+-/*
+- * Number of timer ticks per jiffy.
+- */
+-static u32 ticks_per_jiffy;
+-
+-static struct clock_event_device __percpu *armada_370_xp_evt;
+-
+-static void local_timer_ctrl_clrset(u32 clr, u32 set)
+-{
+- writel((readl(local_base + TIMER_CTRL_OFF) & ~clr) | set,
+- local_base + TIMER_CTRL_OFF);
+-}
+-
+-static u64 notrace armada_370_xp_read_sched_clock(void)
+-{
+- return ~readl(timer_base + TIMER0_VAL_OFF);
+-}
+-
+-/*
+- * Clockevent handling.
+- */
+-static int
+-armada_370_xp_clkevt_next_event(unsigned long delta,
+- struct clock_event_device *dev)
+-{
+- /*
+- * Clear clockevent timer interrupt.
+- */
+- writel(TIMER0_CLR_MASK, local_base + LCL_TIMER_EVENTS_STATUS);
+-
+- /*
+- * Setup new clockevent timer value.
+- */
+- writel(delta, local_base + TIMER0_VAL_OFF);
+-
+- /*
+- * Enable the timer.
+- */
+- local_timer_ctrl_clrset(TIMER0_RELOAD_EN, enable_mask);
+- return 0;
+-}
+-
+-static int armada_370_xp_clkevt_shutdown(struct clock_event_device *evt)
+-{
+- /*
+- * Disable timer.
+- */
+- local_timer_ctrl_clrset(TIMER0_EN, 0);
+-
+- /*
+- * ACK pending timer interrupt.
+- */
+- writel(TIMER0_CLR_MASK, local_base + LCL_TIMER_EVENTS_STATUS);
+- return 0;
+-}
+-
+-static int armada_370_xp_clkevt_set_periodic(struct clock_event_device *evt)
+-{
+- /*
+- * Setup timer to fire at 1/HZ intervals.
+- */
+- writel(ticks_per_jiffy - 1, local_base + TIMER0_RELOAD_OFF);
+- writel(ticks_per_jiffy - 1, local_base + TIMER0_VAL_OFF);
+-
+- /*
+- * Enable timer.
+- */
+- local_timer_ctrl_clrset(0, TIMER0_RELOAD_EN | enable_mask);
+- return 0;
+-}
+-
+-static int armada_370_xp_clkevt_irq;
+-
+-static irqreturn_t armada_370_xp_timer_interrupt(int irq, void *dev_id)
+-{
+- /*
+- * ACK timer interrupt and call event handler.
+- */
+- struct clock_event_device *evt = dev_id;
+-
+- writel(TIMER0_CLR_MASK, local_base + LCL_TIMER_EVENTS_STATUS);
+- evt->event_handler(evt);
+-
+- return IRQ_HANDLED;
+-}
+-
+-/*
+- * Setup the local clock events for a CPU.
+- */
+-static int armada_370_xp_timer_starting_cpu(unsigned int cpu)
+-{
+- struct clock_event_device *evt = per_cpu_ptr(armada_370_xp_evt, cpu);
+- u32 clr = 0, set = 0;
+-
+- if (timer25Mhz)
+- set = TIMER0_25MHZ;
+- else
+- clr = TIMER0_25MHZ;
+- local_timer_ctrl_clrset(clr, set);
+-
+- evt->name = "armada_370_xp_per_cpu_tick",
+- evt->features = CLOCK_EVT_FEAT_ONESHOT |
+- CLOCK_EVT_FEAT_PERIODIC;
+- evt->shift = 32,
+- evt->rating = 300,
+- evt->set_next_event = armada_370_xp_clkevt_next_event,
+- evt->set_state_shutdown = armada_370_xp_clkevt_shutdown;
+- evt->set_state_periodic = armada_370_xp_clkevt_set_periodic;
+- evt->set_state_oneshot = armada_370_xp_clkevt_shutdown;
+- evt->tick_resume = armada_370_xp_clkevt_shutdown;
+- evt->irq = armada_370_xp_clkevt_irq;
+- evt->cpumask = cpumask_of(cpu);
+-
+- clockevents_config_and_register(evt, timer_clk, 1, 0xfffffffe);
+- enable_percpu_irq(evt->irq, 0);
+-
+- return 0;
+-}
+-
+-static int armada_370_xp_timer_dying_cpu(unsigned int cpu)
+-{
+- struct clock_event_device *evt = per_cpu_ptr(armada_370_xp_evt, cpu);
+-
+- evt->set_state_shutdown(evt);
+- disable_percpu_irq(evt->irq);
+- return 0;
+-}
+-
+-static u32 timer0_ctrl_reg, timer0_local_ctrl_reg;
+-
+-static int armada_370_xp_timer_suspend(void)
+-{
+- timer0_ctrl_reg = readl(timer_base + TIMER_CTRL_OFF);
+- timer0_local_ctrl_reg = readl(local_base + TIMER_CTRL_OFF);
+- return 0;
+-}
+-
+-static void armada_370_xp_timer_resume(void)
+-{
+- writel(0xffffffff, timer_base + TIMER0_VAL_OFF);
+- writel(0xffffffff, timer_base + TIMER0_RELOAD_OFF);
+- writel(timer0_ctrl_reg, timer_base + TIMER_CTRL_OFF);
+- writel(timer0_local_ctrl_reg, local_base + TIMER_CTRL_OFF);
+-}
+-
+-static struct syscore_ops armada_370_xp_timer_syscore_ops = {
+- .suspend = armada_370_xp_timer_suspend,
+- .resume = armada_370_xp_timer_resume,
+-};
+-
+-static unsigned long armada_370_delay_timer_read(void)
+-{
+- return ~readl(timer_base + TIMER0_VAL_OFF);
+-}
+-
+-static struct delay_timer armada_370_delay_timer = {
+- .read_current_timer = armada_370_delay_timer_read,
+-};
+-
+-static int __init armada_370_xp_timer_common_init(struct device_node *np)
+-{
+- u32 clr = 0, set = 0;
+- int res;
+-
+- timer_base = of_iomap(np, 0);
+- if (!timer_base) {
+- pr_err("Failed to iomap\n");
+- return -ENXIO;
+- }
+-
+- local_base = of_iomap(np, 1);
+- if (!local_base) {
+- pr_err("Failed to iomap\n");
+- return -ENXIO;
+- }
+-
+- if (timer25Mhz) {
+- set = TIMER0_25MHZ;
+- enable_mask = TIMER0_EN;
+- } else {
+- clr = TIMER0_25MHZ;
+- enable_mask = TIMER0_EN | TIMER0_DIV(TIMER_DIVIDER_SHIFT);
+- }
+- atomic_io_modify(timer_base + TIMER_CTRL_OFF, clr | set, set);
+- local_timer_ctrl_clrset(clr, set);
+-
+- /*
+- * We use timer 0 as clocksource, and private(local) timer 0
+- * for clockevents
+- */
+- armada_370_xp_clkevt_irq = irq_of_parse_and_map(np, 4);
+-
+- ticks_per_jiffy = (timer_clk + HZ / 2) / HZ;
+-
+- /*
+- * Setup free-running clocksource timer (interrupts
+- * disabled).
+- */
+- writel(0xffffffff, timer_base + TIMER0_VAL_OFF);
+- writel(0xffffffff, timer_base + TIMER0_RELOAD_OFF);
+-
+- atomic_io_modify(timer_base + TIMER_CTRL_OFF,
+- TIMER0_RELOAD_EN | enable_mask,
+- TIMER0_RELOAD_EN | enable_mask);
+-
+- armada_370_delay_timer.freq = timer_clk;
+- register_current_timer_delay(&armada_370_delay_timer);
+-
+- /*
+- * Set scale and timer for sched_clock.
+- */
+- sched_clock_register(armada_370_xp_read_sched_clock, 32, timer_clk);
+-
+- res = clocksource_mmio_init(timer_base + TIMER0_VAL_OFF,
+- "armada_370_xp_clocksource",
+- timer_clk, 300, 32, clocksource_mmio_readl_down);
+- if (res) {
+- pr_err("Failed to initialize clocksource mmio\n");
+- return res;
+- }
+-
+- armada_370_xp_evt = alloc_percpu(struct clock_event_device);
+- if (!armada_370_xp_evt)
+- return -ENOMEM;
+-
+- /*
+- * Setup clockevent timer (interrupt-driven).
+- */
+- res = request_percpu_irq(armada_370_xp_clkevt_irq,
+- armada_370_xp_timer_interrupt,
+- "armada_370_xp_per_cpu_tick",
+- armada_370_xp_evt);
+- /* Immediately configure the timer on the boot CPU */
+- if (res) {
+- pr_err("Failed to request percpu irq\n");
+- return res;
+- }
+-
+- res = cpuhp_setup_state(CPUHP_AP_ARMADA_TIMER_STARTING,
+- "clockevents/armada:starting",
+- armada_370_xp_timer_starting_cpu,
+- armada_370_xp_timer_dying_cpu);
+- if (res) {
+- pr_err("Failed to setup hotplug state and timer\n");
+- return res;
+- }
+-
+- register_syscore_ops(&armada_370_xp_timer_syscore_ops);
+-
+- return 0;
+-}
+-
+-static int __init armada_xp_timer_init(struct device_node *np)
+-{
+- struct clk *clk = of_clk_get_by_name(np, "fixed");
+- int ret;
+-
+- if (IS_ERR(clk)) {
+- pr_err("Failed to get clock\n");
+- return PTR_ERR(clk);
+- }
+-
+- ret = clk_prepare_enable(clk);
+- if (ret)
+- return ret;
+-
+- timer_clk = clk_get_rate(clk);
+-
+- return armada_370_xp_timer_common_init(np);
+-}
+-TIMER_OF_DECLARE(armada_xp, "marvell,armada-xp-timer",
+- armada_xp_timer_init);
+-
+-static int __init armada_375_timer_init(struct device_node *np)
+-{
+- struct clk *clk;
+- int ret;
+-
+- clk = of_clk_get_by_name(np, "fixed");
+- if (!IS_ERR(clk)) {
+- ret = clk_prepare_enable(clk);
+- if (ret)
+- return ret;
+- timer_clk = clk_get_rate(clk);
+- } else {
+-
+- /*
+- * This fallback is required in order to retain proper
+- * devicetree backwards compatibility.
+- */
+- clk = of_clk_get(np, 0);
+-
+- /* Must have at least a clock */
+- if (IS_ERR(clk)) {
+- pr_err("Failed to get clock\n");
+- return PTR_ERR(clk);
+- }
+-
+- ret = clk_prepare_enable(clk);
+- if (ret)
+- return ret;
+-
+- timer_clk = clk_get_rate(clk) / TIMER_DIVIDER;
+- timer25Mhz = false;
+- }
+-
+- return armada_370_xp_timer_common_init(np);
+-}
+-TIMER_OF_DECLARE(armada_375, "marvell,armada-375-timer",
+- armada_375_timer_init);
+-
+-static int __init armada_370_timer_init(struct device_node *np)
+-{
+- struct clk *clk;
+- int ret;
+-
+- clk = of_clk_get(np, 0);
+- if (IS_ERR(clk)) {
+- pr_err("Failed to get clock\n");
+- return PTR_ERR(clk);
+- }
+-
+- ret = clk_prepare_enable(clk);
+- if (ret)
+- return ret;
+-
+- timer_clk = clk_get_rate(clk) / TIMER_DIVIDER;
+- timer25Mhz = false;
+-
+- return armada_370_xp_timer_common_init(np);
+-}
+-TIMER_OF_DECLARE(armada_370, "marvell,armada-370-timer",
+- armada_370_timer_init);
+diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c
+deleted file mode 100644
+index 257e810ec1ad1..0000000000000
+--- a/drivers/clocksource/time-efm32.c
++++ /dev/null
+@@ -1,287 +0,0 @@
+-/*
+- * Copyright (C) 2013 Pengutronix
+- * Uwe Kleine-Koenig <u.kleine-koenig@pengutronix.de>
+- *
+- * This program is free software; you can redistribute it and/or modify it under
+- * the terms of the GNU General Public License version 2 as published by the
+- * Free Software Foundation.
+- */
+-
+-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+-
+-#include <linux/kernel.h>
+-#include <linux/clocksource.h>
+-#include <linux/clockchips.h>
+-#include <linux/irq.h>
+-#include <linux/interrupt.h>
+-#include <linux/of.h>
+-#include <linux/of_address.h>
+-#include <linux/of_irq.h>
+-#include <linux/clk.h>
+-
+-#define TIMERn_CTRL 0x00
+-#define TIMERn_CTRL_PRESC(val) (((val) & 0xf) << 24)
+-#define TIMERn_CTRL_PRESC_1024 TIMERn_CTRL_PRESC(10)
+-#define TIMERn_CTRL_CLKSEL(val) (((val) & 0x3) << 16)
+-#define TIMERn_CTRL_CLKSEL_PRESCHFPERCLK TIMERn_CTRL_CLKSEL(0)
+-#define TIMERn_CTRL_OSMEN 0x00000010
+-#define TIMERn_CTRL_MODE(val) (((val) & 0x3) << 0)
+-#define TIMERn_CTRL_MODE_UP TIMERn_CTRL_MODE(0)
+-#define TIMERn_CTRL_MODE_DOWN TIMERn_CTRL_MODE(1)
+-
+-#define TIMERn_CMD 0x04
+-#define TIMERn_CMD_START 0x00000001
+-#define TIMERn_CMD_STOP 0x00000002
+-
+-#define TIMERn_IEN 0x0c
+-#define TIMERn_IF 0x10
+-#define TIMERn_IFS 0x14
+-#define TIMERn_IFC 0x18
+-#define TIMERn_IRQ_UF 0x00000002
+-
+-#define TIMERn_TOP 0x1c
+-#define TIMERn_CNT 0x24
+-
+-struct efm32_clock_event_ddata {
+- struct clock_event_device evtdev;
+- void __iomem *base;
+- unsigned periodic_top;
+-};
+-
+-static int efm32_clock_event_shutdown(struct clock_event_device *evtdev)
+-{
+- struct efm32_clock_event_ddata *ddata =
+- container_of(evtdev, struct efm32_clock_event_ddata, evtdev);
+-
+- writel_relaxed(TIMERn_CMD_STOP, ddata->base + TIMERn_CMD);
+- return 0;
+-}
+-
+-static int efm32_clock_event_set_oneshot(struct clock_event_device *evtdev)
+-{
+- struct efm32_clock_event_ddata *ddata =
+- container_of(evtdev, struct efm32_clock_event_ddata, evtdev);
+-
+- writel_relaxed(TIMERn_CMD_STOP, ddata->base + TIMERn_CMD);
+- writel_relaxed(TIMERn_CTRL_PRESC_1024 |
+- TIMERn_CTRL_CLKSEL_PRESCHFPERCLK |
+- TIMERn_CTRL_OSMEN |
+- TIMERn_CTRL_MODE_DOWN,
+- ddata->base + TIMERn_CTRL);
+- return 0;
+-}
+-
+-static int efm32_clock_event_set_periodic(struct clock_event_device *evtdev)
+-{
+- struct efm32_clock_event_ddata *ddata =
+- container_of(evtdev, struct efm32_clock_event_ddata, evtdev);
+-
+- writel_relaxed(TIMERn_CMD_STOP, ddata->base + TIMERn_CMD);
+- writel_relaxed(ddata->periodic_top, ddata->base + TIMERn_TOP);
+- writel_relaxed(TIMERn_CTRL_PRESC_1024 |
+- TIMERn_CTRL_CLKSEL_PRESCHFPERCLK |
+- TIMERn_CTRL_MODE_DOWN,
+- ddata->base + TIMERn_CTRL);
+- writel_relaxed(TIMERn_CMD_START, ddata->base + TIMERn_CMD);
+- return 0;
+-}
+-
+-static int efm32_clock_event_set_next_event(unsigned long evt,
+- struct clock_event_device *evtdev)
+-{
+- struct efm32_clock_event_ddata *ddata =
+- container_of(evtdev, struct efm32_clock_event_ddata, evtdev);
+-
+- writel_relaxed(TIMERn_CMD_STOP, ddata->base + TIMERn_CMD);
+- writel_relaxed(evt, ddata->base + TIMERn_CNT);
+- writel_relaxed(TIMERn_CMD_START, ddata->base + TIMERn_CMD);
+-
+- return 0;
+-}
+-
+-static irqreturn_t efm32_clock_event_handler(int irq, void *dev_id)
+-{
+- struct efm32_clock_event_ddata *ddata = dev_id;
+-
+- writel_relaxed(TIMERn_IRQ_UF, ddata->base + TIMERn_IFC);
+-
+- ddata->evtdev.event_handler(&ddata->evtdev);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static struct efm32_clock_event_ddata clock_event_ddata = {
+- .evtdev = {
+- .name = "efm32 clockevent",
+- .features = CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_PERIODIC,
+- .set_state_shutdown = efm32_clock_event_shutdown,
+- .set_state_periodic = efm32_clock_event_set_periodic,
+- .set_state_oneshot = efm32_clock_event_set_oneshot,
+- .set_next_event = efm32_clock_event_set_next_event,
+- .rating = 200,
+- },
+-};
+-
+-static struct irqaction efm32_clock_event_irq = {
+- .name = "efm32 clockevent",
+- .flags = IRQF_TIMER,
+- .handler = efm32_clock_event_handler,
+- .dev_id = &clock_event_ddata,
+-};
+-
+-static int __init efm32_clocksource_init(struct device_node *np)
+-{
+- struct clk *clk;
+- void __iomem *base;
+- unsigned long rate;
+- int ret;
+-
+- clk = of_clk_get(np, 0);
+- if (IS_ERR(clk)) {
+- ret = PTR_ERR(clk);
+- pr_err("failed to get clock for clocksource (%d)\n", ret);
+- goto err_clk_get;
+- }
+-
+- ret = clk_prepare_enable(clk);
+- if (ret) {
+- pr_err("failed to enable timer clock for clocksource (%d)\n",
+- ret);
+- goto err_clk_enable;
+- }
+- rate = clk_get_rate(clk);
+-
+- base = of_iomap(np, 0);
+- if (!base) {
+- ret = -EADDRNOTAVAIL;
+- pr_err("failed to map registers for clocksource\n");
+- goto err_iomap;
+- }
+-
+- writel_relaxed(TIMERn_CTRL_PRESC_1024 |
+- TIMERn_CTRL_CLKSEL_PRESCHFPERCLK |
+- TIMERn_CTRL_MODE_UP, base + TIMERn_CTRL);
+- writel_relaxed(TIMERn_CMD_START, base + TIMERn_CMD);
+-
+- ret = clocksource_mmio_init(base + TIMERn_CNT, "efm32 timer",
+- DIV_ROUND_CLOSEST(rate, 1024), 200, 16,
+- clocksource_mmio_readl_up);
+- if (ret) {
+- pr_err("failed to init clocksource (%d)\n", ret);
+- goto err_clocksource_init;
+- }
+-
+- return 0;
+-
+-err_clocksource_init:
+-
+- iounmap(base);
+-err_iomap:
+-
+- clk_disable_unprepare(clk);
+-err_clk_enable:
+-
+- clk_put(clk);
+-err_clk_get:
+-
+- return ret;
+-}
+-
+-static int __init efm32_clockevent_init(struct device_node *np)
+-{
+- struct clk *clk;
+- void __iomem *base;
+- unsigned long rate;
+- int irq;
+- int ret;
+-
+- clk = of_clk_get(np, 0);
+- if (IS_ERR(clk)) {
+- ret = PTR_ERR(clk);
+- pr_err("failed to get clock for clockevent (%d)\n", ret);
+- goto err_clk_get;
+- }
+-
+- ret = clk_prepare_enable(clk);
+- if (ret) {
+- pr_err("failed to enable timer clock for clockevent (%d)\n",
+- ret);
+- goto err_clk_enable;
+- }
+- rate = clk_get_rate(clk);
+-
+- base = of_iomap(np, 0);
+- if (!base) {
+- ret = -EADDRNOTAVAIL;
+- pr_err("failed to map registers for clockevent\n");
+- goto err_iomap;
+- }
+-
+- irq = irq_of_parse_and_map(np, 0);
+- if (!irq) {
+- ret = -ENOENT;
+- pr_err("failed to get irq for clockevent\n");
+- goto err_get_irq;
+- }
+-
+- writel_relaxed(TIMERn_IRQ_UF, base + TIMERn_IEN);
+-
+- clock_event_ddata.base = base;
+- clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
+-
+- clockevents_config_and_register(&clock_event_ddata.evtdev,
+- DIV_ROUND_CLOSEST(rate, 1024),
+- 0xf, 0xffff);
+-
+- ret = setup_irq(irq, &efm32_clock_event_irq);
+- if (ret) {
+- pr_err("Failed setup irq\n");
+- goto err_setup_irq;
+- }
+-
+- return 0;
+-
+-err_setup_irq:
+-err_get_irq:
+-
+- iounmap(base);
+-err_iomap:
+-
+- clk_disable_unprepare(clk);
+-err_clk_enable:
+-
+- clk_put(clk);
+-err_clk_get:
+-
+- return ret;
+-}
+-
+-/*
+- * This function asserts that we have exactly one clocksource and one
+- * clock_event_device in the end.
+- */
+-static int __init efm32_timer_init(struct device_node *np)
+-{
+- static int has_clocksource, has_clockevent;
+- int ret = 0;
+-
+- if (!has_clocksource) {
+- ret = efm32_clocksource_init(np);
+- if (!ret) {
+- has_clocksource = 1;
+- return 0;
+- }
+- }
+-
+- if (!has_clockevent) {
+- ret = efm32_clockevent_init(np);
+- if (!ret) {
+- has_clockevent = 1;
+- return 0;
+- }
+- }
+-
+- return ret;
+-}
+-TIMER_OF_DECLARE(efm32compat, "efm32,timer", efm32_timer_init);
+-TIMER_OF_DECLARE(efm32, "energymicro,efm32-timer", efm32_timer_init);
+diff --git a/drivers/clocksource/time-lpc32xx.c b/drivers/clocksource/time-lpc32xx.c
+deleted file mode 100644
+index d51a62a79ef76..0000000000000
+--- a/drivers/clocksource/time-lpc32xx.c
++++ /dev/null
+@@ -1,314 +0,0 @@
+-/*
+- * Clocksource driver for NXP LPC32xx/18xx/43xx timer
+- *
+- * Copyright (C) 2015 Joachim Eastwood <manabian@gmail.com>
+- *
+- * Based on:
+- * time-efm32 Copyright (C) 2013 Pengutronix
+- * mach-lpc32xx/timer.c Copyright (C) 2009 - 2010 NXP Semiconductors
+- *
+- * This file is licensed under the terms of the GNU General Public
+- * License version 2. This program is licensed "as is" without any
+- * warranty of any kind, whether express or implied.
+- *
+- */
+-
+-#define pr_fmt(fmt) "%s: " fmt, __func__
+-
+-#include <linux/clk.h>
+-#include <linux/clockchips.h>
+-#include <linux/clocksource.h>
+-#include <linux/delay.h>
+-#include <linux/interrupt.h>
+-#include <linux/irq.h>
+-#include <linux/kernel.h>
+-#include <linux/of.h>
+-#include <linux/of_address.h>
+-#include <linux/of_irq.h>
+-#include <linux/sched_clock.h>
+-
+-#define LPC32XX_TIMER_IR 0x000
+-#define LPC32XX_TIMER_IR_MR0INT BIT(0)
+-#define LPC32XX_TIMER_TCR 0x004
+-#define LPC32XX_TIMER_TCR_CEN BIT(0)
+-#define LPC32XX_TIMER_TCR_CRST BIT(1)
+-#define LPC32XX_TIMER_TC 0x008
+-#define LPC32XX_TIMER_PR 0x00c
+-#define LPC32XX_TIMER_MCR 0x014
+-#define LPC32XX_TIMER_MCR_MR0I BIT(0)
+-#define LPC32XX_TIMER_MCR_MR0R BIT(1)
+-#define LPC32XX_TIMER_MCR_MR0S BIT(2)
+-#define LPC32XX_TIMER_MR0 0x018
+-#define LPC32XX_TIMER_CTCR 0x070
+-
+-struct lpc32xx_clock_event_ddata {
+- struct clock_event_device evtdev;
+- void __iomem *base;
+- u32 ticks_per_jiffy;
+-};
+-
+-/* Needed for the sched clock */
+-static void __iomem *clocksource_timer_counter;
+-
+-static u64 notrace lpc32xx_read_sched_clock(void)
+-{
+- return readl(clocksource_timer_counter);
+-}
+-
+-static unsigned long lpc32xx_delay_timer_read(void)
+-{
+- return readl(clocksource_timer_counter);
+-}
+-
+-static struct delay_timer lpc32xx_delay_timer = {
+- .read_current_timer = lpc32xx_delay_timer_read,
+-};
+-
+-static int lpc32xx_clkevt_next_event(unsigned long delta,
+- struct clock_event_device *evtdev)
+-{
+- struct lpc32xx_clock_event_ddata *ddata =
+- container_of(evtdev, struct lpc32xx_clock_event_ddata, evtdev);
+-
+- /*
+- * Place timer in reset and program the delta in the match
+- * channel 0 (MR0). When the timer counter matches the value
+- * in MR0 register the match will trigger an interrupt.
+- * After setup the timer is released from reset and enabled.
+- */
+- writel_relaxed(LPC32XX_TIMER_TCR_CRST, ddata->base + LPC32XX_TIMER_TCR);
+- writel_relaxed(delta, ddata->base + LPC32XX_TIMER_MR0);
+- writel_relaxed(LPC32XX_TIMER_TCR_CEN, ddata->base + LPC32XX_TIMER_TCR);
+-
+- return 0;
+-}
+-
+-static int lpc32xx_clkevt_shutdown(struct clock_event_device *evtdev)
+-{
+- struct lpc32xx_clock_event_ddata *ddata =
+- container_of(evtdev, struct lpc32xx_clock_event_ddata, evtdev);
+-
+- /* Disable the timer */
+- writel_relaxed(0, ddata->base + LPC32XX_TIMER_TCR);
+-
+- return 0;
+-}
+-
+-static int lpc32xx_clkevt_oneshot(struct clock_event_device *evtdev)
+-{
+- struct lpc32xx_clock_event_ddata *ddata =
+- container_of(evtdev, struct lpc32xx_clock_event_ddata, evtdev);
+-
+- /*
+- * When using oneshot, we must also disable the timer
+- * to wait for the first call to set_next_event().
+- */
+- writel_relaxed(0, ddata->base + LPC32XX_TIMER_TCR);
+-
+- /* Enable interrupt, reset on match and stop on match (MCR). */
+- writel_relaxed(LPC32XX_TIMER_MCR_MR0I | LPC32XX_TIMER_MCR_MR0R |
+- LPC32XX_TIMER_MCR_MR0S, ddata->base + LPC32XX_TIMER_MCR);
+- return 0;
+-}
+-
+-static int lpc32xx_clkevt_periodic(struct clock_event_device *evtdev)
+-{
+- struct lpc32xx_clock_event_ddata *ddata =
+- container_of(evtdev, struct lpc32xx_clock_event_ddata, evtdev);
+-
+- /* Enable interrupt and reset on match. */
+- writel_relaxed(LPC32XX_TIMER_MCR_MR0I | LPC32XX_TIMER_MCR_MR0R,
+- ddata->base + LPC32XX_TIMER_MCR);
+-
+- /*
+- * Place timer in reset and program the delta in the match
+- * channel 0 (MR0).
+- */
+- writel_relaxed(LPC32XX_TIMER_TCR_CRST, ddata->base + LPC32XX_TIMER_TCR);
+- writel_relaxed(ddata->ticks_per_jiffy, ddata->base + LPC32XX_TIMER_MR0);
+- writel_relaxed(LPC32XX_TIMER_TCR_CEN, ddata->base + LPC32XX_TIMER_TCR);
+-
+- return 0;
+-}
+-
+-static irqreturn_t lpc32xx_clock_event_handler(int irq, void *dev_id)
+-{
+- struct lpc32xx_clock_event_ddata *ddata = dev_id;
+-
+- /* Clear match on channel 0 */
+- writel_relaxed(LPC32XX_TIMER_IR_MR0INT, ddata->base + LPC32XX_TIMER_IR);
+-
+- ddata->evtdev.event_handler(&ddata->evtdev);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static struct lpc32xx_clock_event_ddata lpc32xx_clk_event_ddata = {
+- .evtdev = {
+- .name = "lpc3220 clockevent",
+- .features = CLOCK_EVT_FEAT_ONESHOT |
+- CLOCK_EVT_FEAT_PERIODIC,
+- .rating = 300,
+- .set_next_event = lpc32xx_clkevt_next_event,
+- .set_state_shutdown = lpc32xx_clkevt_shutdown,
+- .set_state_oneshot = lpc32xx_clkevt_oneshot,
+- .set_state_periodic = lpc32xx_clkevt_periodic,
+- },
+-};
+-
+-static int __init lpc32xx_clocksource_init(struct device_node *np)
+-{
+- void __iomem *base;
+- unsigned long rate;
+- struct clk *clk;
+- int ret;
+-
+- clk = of_clk_get_by_name(np, "timerclk");
+- if (IS_ERR(clk)) {
+- pr_err("clock get failed (%ld)\n", PTR_ERR(clk));
+- return PTR_ERR(clk);
+- }
+-
+- ret = clk_prepare_enable(clk);
+- if (ret) {
+- pr_err("clock enable failed (%d)\n", ret);
+- goto err_clk_enable;
+- }
+-
+- base = of_iomap(np, 0);
+- if (!base) {
+- pr_err("unable to map registers\n");
+- ret = -EADDRNOTAVAIL;
+- goto err_iomap;
+- }
+-
+- /*
+- * Disable and reset timer then set it to free running timer
+- * mode (CTCR) with no prescaler (PR) or match operations (MCR).
+- * After setup the timer is released from reset and enabled.
+- */
+- writel_relaxed(LPC32XX_TIMER_TCR_CRST, base + LPC32XX_TIMER_TCR);
+- writel_relaxed(0, base + LPC32XX_TIMER_PR);
+- writel_relaxed(0, base + LPC32XX_TIMER_MCR);
+- writel_relaxed(0, base + LPC32XX_TIMER_CTCR);
+- writel_relaxed(LPC32XX_TIMER_TCR_CEN, base + LPC32XX_TIMER_TCR);
+-
+- rate = clk_get_rate(clk);
+- ret = clocksource_mmio_init(base + LPC32XX_TIMER_TC, "lpc3220 timer",
+- rate, 300, 32, clocksource_mmio_readl_up);
+- if (ret) {
+- pr_err("failed to init clocksource (%d)\n", ret);
+- goto err_clocksource_init;
+- }
+-
+- clocksource_timer_counter = base + LPC32XX_TIMER_TC;
+- lpc32xx_delay_timer.freq = rate;
+- register_current_timer_delay(&lpc32xx_delay_timer);
+- sched_clock_register(lpc32xx_read_sched_clock, 32, rate);
+-
+- return 0;
+-
+-err_clocksource_init:
+- iounmap(base);
+-err_iomap:
+- clk_disable_unprepare(clk);
+-err_clk_enable:
+- clk_put(clk);
+- return ret;
+-}
+-
+-static int __init lpc32xx_clockevent_init(struct device_node *np)
+-{
+- void __iomem *base;
+- unsigned long rate;
+- struct clk *clk;
+- int ret, irq;
+-
+- clk = of_clk_get_by_name(np, "timerclk");
+- if (IS_ERR(clk)) {
+- pr_err("clock get failed (%ld)\n", PTR_ERR(clk));
+- return PTR_ERR(clk);
+- }
+-
+- ret = clk_prepare_enable(clk);
+- if (ret) {
+- pr_err("clock enable failed (%d)\n", ret);
+- goto err_clk_enable;
+- }
+-
+- base = of_iomap(np, 0);
+- if (!base) {
+- pr_err("unable to map registers\n");
+- ret = -EADDRNOTAVAIL;
+- goto err_iomap;
+- }
+-
+- irq = irq_of_parse_and_map(np, 0);
+- if (!irq) {
+- pr_err("get irq failed\n");
+- ret = -ENOENT;
+- goto err_irq;
+- }
+-
+- /*
+- * Disable timer and clear any pending interrupt (IR) on match
+- * channel 0 (MR0). Clear the prescaler as it's not used.
+- */
+- writel_relaxed(0, base + LPC32XX_TIMER_TCR);
+- writel_relaxed(0, base + LPC32XX_TIMER_PR);
+- writel_relaxed(0, base + LPC32XX_TIMER_CTCR);
+- writel_relaxed(LPC32XX_TIMER_IR_MR0INT, base + LPC32XX_TIMER_IR);
+-
+- rate = clk_get_rate(clk);
+- lpc32xx_clk_event_ddata.base = base;
+- lpc32xx_clk_event_ddata.ticks_per_jiffy = DIV_ROUND_CLOSEST(rate, HZ);
+- clockevents_config_and_register(&lpc32xx_clk_event_ddata.evtdev,
+- rate, 1, -1);
+-
+- ret = request_irq(irq, lpc32xx_clock_event_handler,
+- IRQF_TIMER | IRQF_IRQPOLL, "lpc3220 clockevent",
+- &lpc32xx_clk_event_ddata);
+- if (ret) {
+- pr_err("request irq failed\n");
+- goto err_irq;
+- }
+-
+- return 0;
+-
+-err_irq:
+- iounmap(base);
+-err_iomap:
+- clk_disable_unprepare(clk);
+-err_clk_enable:
+- clk_put(clk);
+- return ret;
+-}
+-
+-/*
+- * This function asserts that we have exactly one clocksource and one
+- * clock_event_device in the end.
+- */
+-static int __init lpc32xx_timer_init(struct device_node *np)
+-{
+- static int has_clocksource, has_clockevent;
+- int ret = 0;
+-
+- if (!has_clocksource) {
+- ret = lpc32xx_clocksource_init(np);
+- if (!ret) {
+- has_clocksource = 1;
+- return 0;
+- }
+- }
+-
+- if (!has_clockevent) {
+- ret = lpc32xx_clockevent_init(np);
+- if (!ret) {
+- has_clockevent = 1;
+- return 0;
+- }
+- }
+-
+- return ret;
+-}
+-TIMER_OF_DECLARE(lpc32xx_timer, "nxp,lpc3220-timer", lpc32xx_timer_init);
+diff --git a/drivers/clocksource/time-orion.c b/drivers/clocksource/time-orion.c
+deleted file mode 100644
+index 12202067fe4b8..0000000000000
+--- a/drivers/clocksource/time-orion.c
++++ /dev/null
+@@ -1,192 +0,0 @@
+-/*
+- * Marvell Orion SoC timer handling.
+- *
+- * Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
+- *
+- * This file is licensed under the terms of the GNU General Public
+- * License version 2. This program is licensed "as is" without any
+- * warranty of any kind, whether express or implied.
+- *
+- * Timer 0 is used as free-running clocksource, while timer 1 is
+- * used as clock_event_device.
+- */
+-
+-#include <linux/kernel.h>
+-#include <linux/bitops.h>
+-#include <linux/clk.h>
+-#include <linux/clockchips.h>
+-#include <linux/delay.h>
+-#include <linux/interrupt.h>
+-#include <linux/of_address.h>
+-#include <linux/of_irq.h>
+-#include <linux/spinlock.h>
+-#include <linux/sched_clock.h>
+-
+-#define TIMER_CTRL 0x00
+-#define TIMER0_EN BIT(0)
+-#define TIMER0_RELOAD_EN BIT(1)
+-#define TIMER1_EN BIT(2)
+-#define TIMER1_RELOAD_EN BIT(3)
+-#define TIMER0_RELOAD 0x10
+-#define TIMER0_VAL 0x14
+-#define TIMER1_RELOAD 0x18
+-#define TIMER1_VAL 0x1c
+-
+-#define ORION_ONESHOT_MIN 1
+-#define ORION_ONESHOT_MAX 0xfffffffe
+-
+-static void __iomem *timer_base;
+-
+-static unsigned long notrace orion_read_timer(void)
+-{
+- return ~readl(timer_base + TIMER0_VAL);
+-}
+-
+-static struct delay_timer orion_delay_timer = {
+- .read_current_timer = orion_read_timer,
+-};
+-
+-static void orion_delay_timer_init(unsigned long rate)
+-{
+- orion_delay_timer.freq = rate;
+- register_current_timer_delay(&orion_delay_timer);
+-}
+-
+-/*
+- * Free-running clocksource handling.
+- */
+-static u64 notrace orion_read_sched_clock(void)
+-{
+- return ~readl(timer_base + TIMER0_VAL);
+-}
+-
+-/*
+- * Clockevent handling.
+- */
+-static u32 ticks_per_jiffy;
+-
+-static int orion_clkevt_next_event(unsigned long delta,
+- struct clock_event_device *dev)
+-{
+- /* setup and enable one-shot timer */
+- writel(delta, timer_base + TIMER1_VAL);
+- atomic_io_modify(timer_base + TIMER_CTRL,
+- TIMER1_RELOAD_EN | TIMER1_EN, TIMER1_EN);
+-
+- return 0;
+-}
+-
+-static int orion_clkevt_shutdown(struct clock_event_device *dev)
+-{
+- /* disable timer */
+- atomic_io_modify(timer_base + TIMER_CTRL,
+- TIMER1_RELOAD_EN | TIMER1_EN, 0);
+- return 0;
+-}
+-
+-static int orion_clkevt_set_periodic(struct clock_event_device *dev)
+-{
+- /* setup and enable periodic timer at 1/HZ intervals */
+- writel(ticks_per_jiffy - 1, timer_base + TIMER1_RELOAD);
+- writel(ticks_per_jiffy - 1, timer_base + TIMER1_VAL);
+- atomic_io_modify(timer_base + TIMER_CTRL,
+- TIMER1_RELOAD_EN | TIMER1_EN,
+- TIMER1_RELOAD_EN | TIMER1_EN);
+- return 0;
+-}
+-
+-static struct clock_event_device orion_clkevt = {
+- .name = "orion_event",
+- .features = CLOCK_EVT_FEAT_ONESHOT |
+- CLOCK_EVT_FEAT_PERIODIC,
+- .shift = 32,
+- .rating = 300,
+- .set_next_event = orion_clkevt_next_event,
+- .set_state_shutdown = orion_clkevt_shutdown,
+- .set_state_periodic = orion_clkevt_set_periodic,
+- .set_state_oneshot = orion_clkevt_shutdown,
+- .tick_resume = orion_clkevt_shutdown,
+-};
+-
+-static irqreturn_t orion_clkevt_irq_handler(int irq, void *dev_id)
+-{
+- orion_clkevt.event_handler(&orion_clkevt);
+- return IRQ_HANDLED;
+-}
+-
+-static struct irqaction orion_clkevt_irq = {
+- .name = "orion_event",
+- .flags = IRQF_TIMER,
+- .handler = orion_clkevt_irq_handler,
+-};
+-
+-static int __init orion_timer_init(struct device_node *np)
+-{
+- unsigned long rate;
+- struct clk *clk;
+- int irq, ret;
+-
+- /* timer registers are shared with watchdog timer */
+- timer_base = of_iomap(np, 0);
+- if (!timer_base) {
+- pr_err("%s: unable to map resource\n", np->name);
+- return -ENXIO;
+- }
+-
+- clk = of_clk_get(np, 0);
+- if (IS_ERR(clk)) {
+- pr_err("%s: unable to get clk\n", np->name);
+- return PTR_ERR(clk);
+- }
+-
+- ret = clk_prepare_enable(clk);
+- if (ret) {
+- pr_err("Failed to prepare clock\n");
+- return ret;
+- }
+-
+- /* we are only interested in timer1 irq */
+- irq = irq_of_parse_and_map(np, 1);
+- if (irq <= 0) {
+- pr_err("%s: unable to parse timer1 irq\n", np->name);
+- return -EINVAL;
+- }
+-
+- rate = clk_get_rate(clk);
+-
+- /* setup timer0 as free-running clocksource */
+- writel(~0, timer_base + TIMER0_VAL);
+- writel(~0, timer_base + TIMER0_RELOAD);
+- atomic_io_modify(timer_base + TIMER_CTRL,
+- TIMER0_RELOAD_EN | TIMER0_EN,
+- TIMER0_RELOAD_EN | TIMER0_EN);
+-
+- ret = clocksource_mmio_init(timer_base + TIMER0_VAL,
+- "orion_clocksource", rate, 300, 32,
+- clocksource_mmio_readl_down);
+- if (ret) {
+- pr_err("Failed to initialize mmio timer\n");
+- return ret;
+- }
+-
+- sched_clock_register(orion_read_sched_clock, 32, rate);
+-
+- /* setup timer1 as clockevent timer */
+- ret = setup_irq(irq, &orion_clkevt_irq);
+- if (ret) {
+- pr_err("%s: unable to setup irq\n", np->name);
+- return ret;
+- }
+-
+- ticks_per_jiffy = (clk_get_rate(clk) + HZ/2) / HZ;
+- orion_clkevt.cpumask = cpumask_of(0);
+- orion_clkevt.irq = irq;
+- clockevents_config_and_register(&orion_clkevt, rate,
+- ORION_ONESHOT_MIN, ORION_ONESHOT_MAX);
+-
+-
+- orion_delay_timer_init(rate);
+-
+- return 0;
+-}
+-TIMER_OF_DECLARE(orion_timer, "marvell,orion-timer", orion_timer_init);
+diff --git a/drivers/clocksource/time-pistachio.c b/drivers/clocksource/time-pistachio.c
+deleted file mode 100644
+index a2dd85d0c1d75..0000000000000
+--- a/drivers/clocksource/time-pistachio.c
++++ /dev/null
+@@ -1,218 +0,0 @@
+-/*
+- * Pistachio clocksource based on general-purpose timers
+- *
+- * Copyright (C) 2015 Imagination Technologies
+- *
+- * This file is subject to the terms and conditions of the GNU General Public
+- * License. See the file "COPYING" in the main directory of this archive
+- * for more details.
+- */
+-
+-#define pr_fmt(fmt) "%s: " fmt, __func__
+-
+-#include <linux/clk.h>
+-#include <linux/clocksource.h>
+-#include <linux/clockchips.h>
+-#include <linux/delay.h>
+-#include <linux/err.h>
+-#include <linux/init.h>
+-#include <linux/spinlock.h>
+-#include <linux/mfd/syscon.h>
+-#include <linux/of.h>
+-#include <linux/of_address.h>
+-#include <linux/platform_device.h>
+-#include <linux/regmap.h>
+-#include <linux/sched_clock.h>
+-#include <linux/time.h>
+-
+-/* Top level reg */
+-#define CR_TIMER_CTRL_CFG 0x00
+-#define TIMER_ME_GLOBAL BIT(0)
+-#define CR_TIMER_REV 0x10
+-
+-/* Timer specific registers */
+-#define TIMER_CFG 0x20
+-#define TIMER_ME_LOCAL BIT(0)
+-#define TIMER_RELOAD_VALUE 0x24
+-#define TIMER_CURRENT_VALUE 0x28
+-#define TIMER_CURRENT_OVERFLOW_VALUE 0x2C
+-#define TIMER_IRQ_STATUS 0x30
+-#define TIMER_IRQ_CLEAR 0x34
+-#define TIMER_IRQ_MASK 0x38
+-
+-#define PERIP_TIMER_CONTROL 0x90
+-
+-/* Timer specific configuration Values */
+-#define RELOAD_VALUE 0xffffffff
+-
+-struct pistachio_clocksource {
+- void __iomem *base;
+- raw_spinlock_t lock;
+- struct clocksource cs;
+-};
+-
+-static struct pistachio_clocksource pcs_gpt;
+-
+-#define to_pistachio_clocksource(cs) \
+- container_of(cs, struct pistachio_clocksource, cs)
+-
+-static inline u32 gpt_readl(void __iomem *base, u32 offset, u32 gpt_id)
+-{
+- return readl(base + 0x20 * gpt_id + offset);
+-}
+-
+-static inline void gpt_writel(void __iomem *base, u32 value, u32 offset,
+- u32 gpt_id)
+-{
+- writel(value, base + 0x20 * gpt_id + offset);
+-}
+-
+-static u64 notrace
+-pistachio_clocksource_read_cycles(struct clocksource *cs)
+-{
+- struct pistachio_clocksource *pcs = to_pistachio_clocksource(cs);
+- u32 counter, overflw;
+- unsigned long flags;
+-
+- /*
+- * The counter value is only refreshed after the overflow value is read.
+- * And they must be read in strict order, hence raw spin lock added.
+- */
+-
+- raw_spin_lock_irqsave(&pcs->lock, flags);
+- overflw = gpt_readl(pcs->base, TIMER_CURRENT_OVERFLOW_VALUE, 0);
+- counter = gpt_readl(pcs->base, TIMER_CURRENT_VALUE, 0);
+- raw_spin_unlock_irqrestore(&pcs->lock, flags);
+-
+- return (u64)~counter;
+-}
+-
+-static u64 notrace pistachio_read_sched_clock(void)
+-{
+- return pistachio_clocksource_read_cycles(&pcs_gpt.cs);
+-}
+-
+-static void pistachio_clksrc_set_mode(struct clocksource *cs, int timeridx,
+- int enable)
+-{
+- struct pistachio_clocksource *pcs = to_pistachio_clocksource(cs);
+- u32 val;
+-
+- val = gpt_readl(pcs->base, TIMER_CFG, timeridx);
+- if (enable)
+- val |= TIMER_ME_LOCAL;
+- else
+- val &= ~TIMER_ME_LOCAL;
+-
+- gpt_writel(pcs->base, val, TIMER_CFG, timeridx);
+-}
+-
+-static void pistachio_clksrc_enable(struct clocksource *cs, int timeridx)
+-{
+- struct pistachio_clocksource *pcs = to_pistachio_clocksource(cs);
+-
+- /* Disable GPT local before loading reload value */
+- pistachio_clksrc_set_mode(cs, timeridx, false);
+- gpt_writel(pcs->base, RELOAD_VALUE, TIMER_RELOAD_VALUE, timeridx);
+- pistachio_clksrc_set_mode(cs, timeridx, true);
+-}
+-
+-static void pistachio_clksrc_disable(struct clocksource *cs, int timeridx)
+-{
+- /* Disable GPT local */
+- pistachio_clksrc_set_mode(cs, timeridx, false);
+-}
+-
+-static int pistachio_clocksource_enable(struct clocksource *cs)
+-{
+- pistachio_clksrc_enable(cs, 0);
+- return 0;
+-}
+-
+-static void pistachio_clocksource_disable(struct clocksource *cs)
+-{
+- pistachio_clksrc_disable(cs, 0);
+-}
+-
+-/* Desirable clock source for pistachio platform */
+-static struct pistachio_clocksource pcs_gpt = {
+- .cs = {
+- .name = "gptimer",
+- .rating = 300,
+- .enable = pistachio_clocksource_enable,
+- .disable = pistachio_clocksource_disable,
+- .read = pistachio_clocksource_read_cycles,
+- .mask = CLOCKSOURCE_MASK(32),
+- .flags = CLOCK_SOURCE_IS_CONTINUOUS |
+- CLOCK_SOURCE_SUSPEND_NONSTOP,
+- },
+-};
+-
+-static int __init pistachio_clksrc_of_init(struct device_node *node)
+-{
+- struct clk *sys_clk, *fast_clk;
+- struct regmap *periph_regs;
+- unsigned long rate;
+- int ret;
+-
+- pcs_gpt.base = of_iomap(node, 0);
+- if (!pcs_gpt.base) {
+- pr_err("cannot iomap\n");
+- return -ENXIO;
+- }
+-
+- periph_regs = syscon_regmap_lookup_by_phandle(node, "img,cr-periph");
+- if (IS_ERR(periph_regs)) {
+- pr_err("cannot get peripheral regmap (%ld)\n",
+- PTR_ERR(periph_regs));
+- return PTR_ERR(periph_regs);
+- }
+-
+- /* Switch to using the fast counter clock */
+- ret = regmap_update_bits(periph_regs, PERIP_TIMER_CONTROL,
+- 0xf, 0x0);
+- if (ret)
+- return ret;
+-
+- sys_clk = of_clk_get_by_name(node, "sys");
+- if (IS_ERR(sys_clk)) {
+- pr_err("clock get failed (%ld)\n", PTR_ERR(sys_clk));
+- return PTR_ERR(sys_clk);
+- }
+-
+- fast_clk = of_clk_get_by_name(node, "fast");
+- if (IS_ERR(fast_clk)) {
+- pr_err("clock get failed (%lu)\n", PTR_ERR(fast_clk));
+- return PTR_ERR(fast_clk);
+- }
+-
+- ret = clk_prepare_enable(sys_clk);
+- if (ret < 0) {
+- pr_err("failed to enable clock (%d)\n", ret);
+- return ret;
+- }
+-
+- ret = clk_prepare_enable(fast_clk);
+- if (ret < 0) {
+- pr_err("failed to enable clock (%d)\n", ret);
+- clk_disable_unprepare(sys_clk);
+- return ret;
+- }
+-
+- rate = clk_get_rate(fast_clk);
+-
+- /* Disable irq's for clocksource usage */
+- gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 0);
+- gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 1);
+- gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 2);
+- gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 3);
+-
+- /* Enable timer block */
+- writel(TIMER_ME_GLOBAL, pcs_gpt.base);
+-
+- raw_spin_lock_init(&pcs_gpt.lock);
+- sched_clock_register(pistachio_read_sched_clock, 32, rate);
+- return clocksource_register_hz(&pcs_gpt.cs, rate);
+-}
+-TIMER_OF_DECLARE(pistachio_gptimer, "img,pistachio-gptimer",
+- pistachio_clksrc_of_init);
+diff --git a/drivers/clocksource/timer-armada-370-xp.c b/drivers/clocksource/timer-armada-370-xp.c
+new file mode 100644
+index 0000000000000..edf1a46269f10
+--- /dev/null
++++ b/drivers/clocksource/timer-armada-370-xp.c
+@@ -0,0 +1,416 @@
++/*
++ * Marvell Armada 370/XP SoC timer handling.
++ *
++ * Copyright (C) 2012 Marvell
++ *
++ * Lior Amsalem <alior@marvell.com>
++ * Gregory CLEMENT <gregory.clement@free-electrons.com>
++ * Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
++ *
++ * This file is licensed under the terms of the GNU General Public
++ * License version 2. This program is licensed "as is" without any
++ * warranty of any kind, whether express or implied.
++ *
++ * Timer 0 is used as free-running clocksource, while timer 1 is
++ * used as clock_event_device.
++ *
++ * ---
++ * Clocksource driver for Armada 370 and Armada XP SoC.
++ * This driver implements one compatible string for each SoC, given
++ * each has its own characteristics:
++ *
++ * * Armada 370 has no 25 MHz fixed timer.
++ *
++ * * Armada XP cannot work properly without such 25 MHz fixed timer as
++ * doing otherwise leads to using a clocksource whose frequency varies
++ * when doing cpufreq frequency changes.
++ *
++ * See Documentation/devicetree/bindings/timer/marvell,armada-370-xp-timer.txt
++ */
++
++#include <linux/init.h>
++#include <linux/platform_device.h>
++#include <linux/kernel.h>
++#include <linux/clk.h>
++#include <linux/cpu.h>
++#include <linux/timer.h>
++#include <linux/clockchips.h>
++#include <linux/interrupt.h>
++#include <linux/of.h>
++#include <linux/of_irq.h>
++#include <linux/of_address.h>
++#include <linux/irq.h>
++#include <linux/module.h>
++#include <linux/sched_clock.h>
++#include <linux/percpu.h>
++#include <linux/syscore_ops.h>
++
++#include <asm/delay.h>
++
++/*
++ * Timer block registers.
++ */
++#define TIMER_CTRL_OFF 0x0000
++#define TIMER0_EN BIT(0)
++#define TIMER0_RELOAD_EN BIT(1)
++#define TIMER0_25MHZ BIT(11)
++#define TIMER0_DIV(div) ((div) << 19)
++#define TIMER1_EN BIT(2)
++#define TIMER1_RELOAD_EN BIT(3)
++#define TIMER1_25MHZ BIT(12)
++#define TIMER1_DIV(div) ((div) << 22)
++#define TIMER_EVENTS_STATUS 0x0004
++#define TIMER0_CLR_MASK (~0x1)
++#define TIMER1_CLR_MASK (~0x100)
++#define TIMER0_RELOAD_OFF 0x0010
++#define TIMER0_VAL_OFF 0x0014
++#define TIMER1_RELOAD_OFF 0x0018
++#define TIMER1_VAL_OFF 0x001c
++
++#define LCL_TIMER_EVENTS_STATUS 0x0028
++/* Global timers are connected to the coherency fabric clock, and the
++ below divider reduces their incrementing frequency. */
++#define TIMER_DIVIDER_SHIFT 5
++#define TIMER_DIVIDER (1 << TIMER_DIVIDER_SHIFT)
++
++/*
++ * SoC-specific data.
++ */
++static void __iomem *timer_base, *local_base;
++static unsigned int timer_clk;
++static bool timer25Mhz = true;
++static u32 enable_mask;
++
++/*
++ * Number of timer ticks per jiffy.
++ */
++static u32 ticks_per_jiffy;
++
++static struct clock_event_device __percpu *armada_370_xp_evt;
++
++static void local_timer_ctrl_clrset(u32 clr, u32 set)
++{
++ writel((readl(local_base + TIMER_CTRL_OFF) & ~clr) | set,
++ local_base + TIMER_CTRL_OFF);
++}
++
++static u64 notrace armada_370_xp_read_sched_clock(void)
++{
++ return ~readl(timer_base + TIMER0_VAL_OFF);
++}
++
++/*
++ * Clockevent handling.
++ */
++static int
++armada_370_xp_clkevt_next_event(unsigned long delta,
++ struct clock_event_device *dev)
++{
++ /*
++ * Clear clockevent timer interrupt.
++ */
++ writel(TIMER0_CLR_MASK, local_base + LCL_TIMER_EVENTS_STATUS);
++
++ /*
++ * Setup new clockevent timer value.
++ */
++ writel(delta, local_base + TIMER0_VAL_OFF);
++
++ /*
++ * Enable the timer.
++ */
++ local_timer_ctrl_clrset(TIMER0_RELOAD_EN, enable_mask);
++ return 0;
++}
++
++static int armada_370_xp_clkevt_shutdown(struct clock_event_device *evt)
++{
++ /*
++ * Disable timer.
++ */
++ local_timer_ctrl_clrset(TIMER0_EN, 0);
++
++ /*
++ * ACK pending timer interrupt.
++ */
++ writel(TIMER0_CLR_MASK, local_base + LCL_TIMER_EVENTS_STATUS);
++ return 0;
++}
++
++static int armada_370_xp_clkevt_set_periodic(struct clock_event_device *evt)
++{
++ /*
++ * Setup timer to fire at 1/HZ intervals.
++ */
++ writel(ticks_per_jiffy - 1, local_base + TIMER0_RELOAD_OFF);
++ writel(ticks_per_jiffy - 1, local_base + TIMER0_VAL_OFF);
++
++ /*
++ * Enable timer.
++ */
++ local_timer_ctrl_clrset(0, TIMER0_RELOAD_EN | enable_mask);
++ return 0;
++}
++
++static int armada_370_xp_clkevt_irq;
++
++static irqreturn_t armada_370_xp_timer_interrupt(int irq, void *dev_id)
++{
++ /*
++ * ACK timer interrupt and call event handler.
++ */
++ struct clock_event_device *evt = dev_id;
++
++ writel(TIMER0_CLR_MASK, local_base + LCL_TIMER_EVENTS_STATUS);
++ evt->event_handler(evt);
++
++ return IRQ_HANDLED;
++}
++
++/*
++ * Setup the local clock events for a CPU.
++ */
++static int armada_370_xp_timer_starting_cpu(unsigned int cpu)
++{
++ struct clock_event_device *evt = per_cpu_ptr(armada_370_xp_evt, cpu);
++ u32 clr = 0, set = 0;
++
++ if (timer25Mhz)
++ set = TIMER0_25MHZ;
++ else
++ clr = TIMER0_25MHZ;
++ local_timer_ctrl_clrset(clr, set);
++
++ evt->name = "armada_370_xp_per_cpu_tick",
++ evt->features = CLOCK_EVT_FEAT_ONESHOT |
++ CLOCK_EVT_FEAT_PERIODIC;
++ evt->shift = 32,
++ evt->rating = 300,
++ evt->set_next_event = armada_370_xp_clkevt_next_event,
++ evt->set_state_shutdown = armada_370_xp_clkevt_shutdown;
++ evt->set_state_periodic = armada_370_xp_clkevt_set_periodic;
++ evt->set_state_oneshot = armada_370_xp_clkevt_shutdown;
++ evt->tick_resume = armada_370_xp_clkevt_shutdown;
++ evt->irq = armada_370_xp_clkevt_irq;
++ evt->cpumask = cpumask_of(cpu);
++
++ clockevents_config_and_register(evt, timer_clk, 1, 0xfffffffe);
++ enable_percpu_irq(evt->irq, 0);
++
++ return 0;
++}
++
++static int armada_370_xp_timer_dying_cpu(unsigned int cpu)
++{
++ struct clock_event_device *evt = per_cpu_ptr(armada_370_xp_evt, cpu);
++
++ evt->set_state_shutdown(evt);
++ disable_percpu_irq(evt->irq);
++ return 0;
++}
++
++static u32 timer0_ctrl_reg, timer0_local_ctrl_reg;
++
++static int armada_370_xp_timer_suspend(void)
++{
++ timer0_ctrl_reg = readl(timer_base + TIMER_CTRL_OFF);
++ timer0_local_ctrl_reg = readl(local_base + TIMER_CTRL_OFF);
++ return 0;
++}
++
++static void armada_370_xp_timer_resume(void)
++{
++ writel(0xffffffff, timer_base + TIMER0_VAL_OFF);
++ writel(0xffffffff, timer_base + TIMER0_RELOAD_OFF);
++ writel(timer0_ctrl_reg, timer_base + TIMER_CTRL_OFF);
++ writel(timer0_local_ctrl_reg, local_base + TIMER_CTRL_OFF);
++}
++
++static struct syscore_ops armada_370_xp_timer_syscore_ops = {
++ .suspend = armada_370_xp_timer_suspend,
++ .resume = armada_370_xp_timer_resume,
++};
++
++static unsigned long armada_370_delay_timer_read(void)
++{
++ return ~readl(timer_base + TIMER0_VAL_OFF);
++}
++
++static struct delay_timer armada_370_delay_timer = {
++ .read_current_timer = armada_370_delay_timer_read,
++};
++
++static int __init armada_370_xp_timer_common_init(struct device_node *np)
++{
++ u32 clr = 0, set = 0;
++ int res;
++
++ timer_base = of_iomap(np, 0);
++ if (!timer_base) {
++ pr_err("Failed to iomap\n");
++ return -ENXIO;
++ }
++
++ local_base = of_iomap(np, 1);
++ if (!local_base) {
++ pr_err("Failed to iomap\n");
++ return -ENXIO;
++ }
++
++ if (timer25Mhz) {
++ set = TIMER0_25MHZ;
++ enable_mask = TIMER0_EN;
++ } else {
++ clr = TIMER0_25MHZ;
++ enable_mask = TIMER0_EN | TIMER0_DIV(TIMER_DIVIDER_SHIFT);
++ }
++ atomic_io_modify(timer_base + TIMER_CTRL_OFF, clr | set, set);
++ local_timer_ctrl_clrset(clr, set);
++
++ /*
++ * We use timer 0 as clocksource, and private(local) timer 0
++ * for clockevents
++ */
++ armada_370_xp_clkevt_irq = irq_of_parse_and_map(np, 4);
++
++ ticks_per_jiffy = (timer_clk + HZ / 2) / HZ;
++
++ /*
++ * Setup free-running clocksource timer (interrupts
++ * disabled).
++ */
++ writel(0xffffffff, timer_base + TIMER0_VAL_OFF);
++ writel(0xffffffff, timer_base + TIMER0_RELOAD_OFF);
++
++ atomic_io_modify(timer_base + TIMER_CTRL_OFF,
++ TIMER0_RELOAD_EN | enable_mask,
++ TIMER0_RELOAD_EN | enable_mask);
++
++ armada_370_delay_timer.freq = timer_clk;
++ register_current_timer_delay(&armada_370_delay_timer);
++
++ /*
++ * Set scale and timer for sched_clock.
++ */
++ sched_clock_register(armada_370_xp_read_sched_clock, 32, timer_clk);
++
++ res = clocksource_mmio_init(timer_base + TIMER0_VAL_OFF,
++ "armada_370_xp_clocksource",
++ timer_clk, 300, 32, clocksource_mmio_readl_down);
++ if (res) {
++ pr_err("Failed to initialize clocksource mmio\n");
++ return res;
++ }
++
++ armada_370_xp_evt = alloc_percpu(struct clock_event_device);
++ if (!armada_370_xp_evt)
++ return -ENOMEM;
++
++ /*
++ * Setup clockevent timer (interrupt-driven).
++ */
++ res = request_percpu_irq(armada_370_xp_clkevt_irq,
++ armada_370_xp_timer_interrupt,
++ "armada_370_xp_per_cpu_tick",
++ armada_370_xp_evt);
++ /* Immediately configure the timer on the boot CPU */
++ if (res) {
++ pr_err("Failed to request percpu irq\n");
++ return res;
++ }
++
++ res = cpuhp_setup_state(CPUHP_AP_ARMADA_TIMER_STARTING,
++ "clockevents/armada:starting",
++ armada_370_xp_timer_starting_cpu,
++ armada_370_xp_timer_dying_cpu);
++ if (res) {
++ pr_err("Failed to setup hotplug state and timer\n");
++ return res;
++ }
++
++ register_syscore_ops(&armada_370_xp_timer_syscore_ops);
++
++ return 0;
++}
++
++static int __init armada_xp_timer_init(struct device_node *np)
++{
++ struct clk *clk = of_clk_get_by_name(np, "fixed");
++ int ret;
++
++ if (IS_ERR(clk)) {
++ pr_err("Failed to get clock\n");
++ return PTR_ERR(clk);
++ }
++
++ ret = clk_prepare_enable(clk);
++ if (ret)
++ return ret;
++
++ timer_clk = clk_get_rate(clk);
++
++ return armada_370_xp_timer_common_init(np);
++}
++TIMER_OF_DECLARE(armada_xp, "marvell,armada-xp-timer",
++ armada_xp_timer_init);
++
++static int __init armada_375_timer_init(struct device_node *np)
++{
++ struct clk *clk;
++ int ret;
++
++ clk = of_clk_get_by_name(np, "fixed");
++ if (!IS_ERR(clk)) {
++ ret = clk_prepare_enable(clk);
++ if (ret)
++ return ret;
++ timer_clk = clk_get_rate(clk);
++ } else {
++
++ /*
++ * This fallback is required in order to retain proper
++ * devicetree backwards compatibility.
++ */
++ clk = of_clk_get(np, 0);
++
++ /* Must have at least a clock */
++ if (IS_ERR(clk)) {
++ pr_err("Failed to get clock\n");
++ return PTR_ERR(clk);
++ }
++
++ ret = clk_prepare_enable(clk);
++ if (ret)
++ return ret;
++
++ timer_clk = clk_get_rate(clk) / TIMER_DIVIDER;
++ timer25Mhz = false;
++ }
++
++ return armada_370_xp_timer_common_init(np);
++}
++TIMER_OF_DECLARE(armada_375, "marvell,armada-375-timer",
++ armada_375_timer_init);
++
++static int __init armada_370_timer_init(struct device_node *np)
++{
++ struct clk *clk;
++ int ret;
++
++ clk = of_clk_get(np, 0);
++ if (IS_ERR(clk)) {
++ pr_err("Failed to get clock\n");
++ return PTR_ERR(clk);
++ }
++
++ ret = clk_prepare_enable(clk);
++ if (ret)
++ return ret;
++
++ timer_clk = clk_get_rate(clk) / TIMER_DIVIDER;
++ timer25Mhz = false;
++
++ return armada_370_xp_timer_common_init(np);
++}
++TIMER_OF_DECLARE(armada_370, "marvell,armada-370-timer",
++ armada_370_timer_init);
+diff --git a/drivers/clocksource/timer-cadence-ttc.c b/drivers/clocksource/timer-cadence-ttc.c
+new file mode 100644
+index 0000000000000..16b9bfb257564
+--- /dev/null
++++ b/drivers/clocksource/timer-cadence-ttc.c
+@@ -0,0 +1,560 @@
++/*
++ * This file contains driver for the Cadence Triple Timer Counter Rev 06
++ *
++ * Copyright (C) 2011-2013 Xilinx
++ *
++ * based on arch/mips/kernel/time.c timer driver
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/clk.h>
++#include <linux/interrupt.h>
++#include <linux/clockchips.h>
++#include <linux/clocksource.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/slab.h>
++#include <linux/sched_clock.h>
++#include <linux/module.h>
++#include <linux/of_platform.h>
++
++/*
++ * This driver configures the 2 16/32-bit count-up timers as follows:
++ *
++ * T1: Timer 1, clocksource for generic timekeeping
++ * T2: Timer 2, clockevent source for hrtimers
++ * T3: Timer 3, <unused>
++ *
++ * The input frequency to the timer module for emulation is 2.5MHz which is
++ * common to all the timer channels (T1, T2, and T3). With a pre-scaler of 32,
++ * the timers are clocked at 78.125KHz (12.8 us resolution).
++
++ * The input frequency to the timer module in silicon is configurable and
++ * obtained from device tree. The pre-scaler of 32 is used.
++ */
++
++/*
++ * Timer Register Offset Definitions of Timer 1, Increment base address by 4
++ * and use same offsets for Timer 2
++ */
++#define TTC_CLK_CNTRL_OFFSET 0x00 /* Clock Control Reg, RW */
++#define TTC_CNT_CNTRL_OFFSET 0x0C /* Counter Control Reg, RW */
++#define TTC_COUNT_VAL_OFFSET 0x18 /* Counter Value Reg, RO */
++#define TTC_INTR_VAL_OFFSET 0x24 /* Interval Count Reg, RW */
++#define TTC_ISR_OFFSET 0x54 /* Interrupt Status Reg, RO */
++#define TTC_IER_OFFSET 0x60 /* Interrupt Enable Reg, RW */
++
++#define TTC_CNT_CNTRL_DISABLE_MASK 0x1
++
++#define TTC_CLK_CNTRL_CSRC_MASK (1 << 5) /* clock source */
++#define TTC_CLK_CNTRL_PSV_MASK 0x1e
++#define TTC_CLK_CNTRL_PSV_SHIFT 1
++
++/*
++ * Setup the timers to use pre-scaling, using a fixed value for now that will
++ * work across most input frequency, but it may need to be more dynamic
++ */
++#define PRESCALE_EXPONENT 11 /* 2 ^ PRESCALE_EXPONENT = PRESCALE */
++#define PRESCALE 2048 /* The exponent must match this */
++#define CLK_CNTRL_PRESCALE ((PRESCALE_EXPONENT - 1) << 1)
++#define CLK_CNTRL_PRESCALE_EN 1
++#define CNT_CNTRL_RESET (1 << 4)
++
++#define MAX_F_ERR 50
++
++/**
++ * struct ttc_timer - This definition defines local timer structure
++ *
++ * @base_addr: Base address of timer
++ * @freq: Timer input clock frequency
++ * @clk: Associated clock source
++ * @clk_rate_change_nb Notifier block for clock rate changes
++ */
++struct ttc_timer {
++ void __iomem *base_addr;
++ unsigned long freq;
++ struct clk *clk;
++ struct notifier_block clk_rate_change_nb;
++};
++
++#define to_ttc_timer(x) \
++ container_of(x, struct ttc_timer, clk_rate_change_nb)
++
++struct ttc_timer_clocksource {
++ u32 scale_clk_ctrl_reg_old;
++ u32 scale_clk_ctrl_reg_new;
++ struct ttc_timer ttc;
++ struct clocksource cs;
++};
++
++#define to_ttc_timer_clksrc(x) \
++ container_of(x, struct ttc_timer_clocksource, cs)
++
++struct ttc_timer_clockevent {
++ struct ttc_timer ttc;
++ struct clock_event_device ce;
++};
++
++#define to_ttc_timer_clkevent(x) \
++ container_of(x, struct ttc_timer_clockevent, ce)
++
++static void __iomem *ttc_sched_clock_val_reg;
++
++/**
++ * ttc_set_interval - Set the timer interval value
++ *
++ * @timer: Pointer to the timer instance
++ * @cycles: Timer interval ticks
++ **/
++static void ttc_set_interval(struct ttc_timer *timer,
++ unsigned long cycles)
++{
++ u32 ctrl_reg;
++
++ /* Disable the counter, set the counter value and re-enable counter */
++ ctrl_reg = readl_relaxed(timer->base_addr + TTC_CNT_CNTRL_OFFSET);
++ ctrl_reg |= TTC_CNT_CNTRL_DISABLE_MASK;
++ writel_relaxed(ctrl_reg, timer->base_addr + TTC_CNT_CNTRL_OFFSET);
++
++ writel_relaxed(cycles, timer->base_addr + TTC_INTR_VAL_OFFSET);
++
++ /*
++ * Reset the counter (0x10) so that it starts from 0, one-shot
++ * mode makes this needed for timing to be right.
++ */
++ ctrl_reg |= CNT_CNTRL_RESET;
++ ctrl_reg &= ~TTC_CNT_CNTRL_DISABLE_MASK;
++ writel_relaxed(ctrl_reg, timer->base_addr + TTC_CNT_CNTRL_OFFSET);
++}
++
++/**
++ * ttc_clock_event_interrupt - Clock event timer interrupt handler
++ *
++ * @irq: IRQ number of the Timer
++ * @dev_id: void pointer to the ttc_timer instance
++ *
++ * returns: Always IRQ_HANDLED - success
++ **/
++static irqreturn_t ttc_clock_event_interrupt(int irq, void *dev_id)
++{
++ struct ttc_timer_clockevent *ttce = dev_id;
++ struct ttc_timer *timer = &ttce->ttc;
++
++ /* Acknowledge the interrupt and call event handler */
++ readl_relaxed(timer->base_addr + TTC_ISR_OFFSET);
++
++ ttce->ce.event_handler(&ttce->ce);
++
++ return IRQ_HANDLED;
++}
++
++/**
++ * __ttc_clocksource_read - Reads the timer counter register
++ *
++ * returns: Current timer counter register value
++ **/
++static u64 __ttc_clocksource_read(struct clocksource *cs)
++{
++ struct ttc_timer *timer = &to_ttc_timer_clksrc(cs)->ttc;
++
++ return (u64)readl_relaxed(timer->base_addr +
++ TTC_COUNT_VAL_OFFSET);
++}
++
++static u64 notrace ttc_sched_clock_read(void)
++{
++ return readl_relaxed(ttc_sched_clock_val_reg);
++}
++
++/**
++ * ttc_set_next_event - Sets the time interval for next event
++ *
++ * @cycles: Timer interval ticks
++ * @evt: Address of clock event instance
++ *
++ * returns: Always 0 - success
++ **/
++static int ttc_set_next_event(unsigned long cycles,
++ struct clock_event_device *evt)
++{
++ struct ttc_timer_clockevent *ttce = to_ttc_timer_clkevent(evt);
++ struct ttc_timer *timer = &ttce->ttc;
++
++ ttc_set_interval(timer, cycles);
++ return 0;
++}
++
++/**
++ * ttc_set_{shutdown|oneshot|periodic} - Sets the state of timer
++ *
++ * @evt: Address of clock event instance
++ **/
++static int ttc_shutdown(struct clock_event_device *evt)
++{
++ struct ttc_timer_clockevent *ttce = to_ttc_timer_clkevent(evt);
++ struct ttc_timer *timer = &ttce->ttc;
++ u32 ctrl_reg;
++
++ ctrl_reg = readl_relaxed(timer->base_addr + TTC_CNT_CNTRL_OFFSET);
++ ctrl_reg |= TTC_CNT_CNTRL_DISABLE_MASK;
++ writel_relaxed(ctrl_reg, timer->base_addr + TTC_CNT_CNTRL_OFFSET);
++ return 0;
++}
++
++static int ttc_set_periodic(struct clock_event_device *evt)
++{
++ struct ttc_timer_clockevent *ttce = to_ttc_timer_clkevent(evt);
++ struct ttc_timer *timer = &ttce->ttc;
++
++ ttc_set_interval(timer,
++ DIV_ROUND_CLOSEST(ttce->ttc.freq, PRESCALE * HZ));
++ return 0;
++}
++
++static int ttc_resume(struct clock_event_device *evt)
++{
++ struct ttc_timer_clockevent *ttce = to_ttc_timer_clkevent(evt);
++ struct ttc_timer *timer = &ttce->ttc;
++ u32 ctrl_reg;
++
++ ctrl_reg = readl_relaxed(timer->base_addr + TTC_CNT_CNTRL_OFFSET);
++ ctrl_reg &= ~TTC_CNT_CNTRL_DISABLE_MASK;
++ writel_relaxed(ctrl_reg, timer->base_addr + TTC_CNT_CNTRL_OFFSET);
++ return 0;
++}
++
++static int ttc_rate_change_clocksource_cb(struct notifier_block *nb,
++ unsigned long event, void *data)
++{
++ struct clk_notifier_data *ndata = data;
++ struct ttc_timer *ttc = to_ttc_timer(nb);
++ struct ttc_timer_clocksource *ttccs = container_of(ttc,
++ struct ttc_timer_clocksource, ttc);
++
++ switch (event) {
++ case PRE_RATE_CHANGE:
++ {
++ u32 psv;
++ unsigned long factor, rate_low, rate_high;
++
++ if (ndata->new_rate > ndata->old_rate) {
++ factor = DIV_ROUND_CLOSEST(ndata->new_rate,
++ ndata->old_rate);
++ rate_low = ndata->old_rate;
++ rate_high = ndata->new_rate;
++ } else {
++ factor = DIV_ROUND_CLOSEST(ndata->old_rate,
++ ndata->new_rate);
++ rate_low = ndata->new_rate;
++ rate_high = ndata->old_rate;
++ }
++
++ if (!is_power_of_2(factor))
++ return NOTIFY_BAD;
++
++ if (abs(rate_high - (factor * rate_low)) > MAX_F_ERR)
++ return NOTIFY_BAD;
++
++ factor = __ilog2_u32(factor);
++
++ /*
++ * store timer clock ctrl register so we can restore it in case
++ * of an abort.
++ */
++ ttccs->scale_clk_ctrl_reg_old =
++ readl_relaxed(ttccs->ttc.base_addr +
++ TTC_CLK_CNTRL_OFFSET);
++
++ psv = (ttccs->scale_clk_ctrl_reg_old &
++ TTC_CLK_CNTRL_PSV_MASK) >>
++ TTC_CLK_CNTRL_PSV_SHIFT;
++ if (ndata->new_rate < ndata->old_rate)
++ psv -= factor;
++ else
++ psv += factor;
++
++ /* prescaler within legal range? */
++ if (psv & ~(TTC_CLK_CNTRL_PSV_MASK >> TTC_CLK_CNTRL_PSV_SHIFT))
++ return NOTIFY_BAD;
++
++ ttccs->scale_clk_ctrl_reg_new = ttccs->scale_clk_ctrl_reg_old &
++ ~TTC_CLK_CNTRL_PSV_MASK;
++ ttccs->scale_clk_ctrl_reg_new |= psv << TTC_CLK_CNTRL_PSV_SHIFT;
++
++
++ /* scale down: adjust divider in post-change notification */
++ if (ndata->new_rate < ndata->old_rate)
++ return NOTIFY_DONE;
++
++ /* scale up: adjust divider now - before frequency change */
++ writel_relaxed(ttccs->scale_clk_ctrl_reg_new,
++ ttccs->ttc.base_addr + TTC_CLK_CNTRL_OFFSET);
++ break;
++ }
++ case POST_RATE_CHANGE:
++ /* scale up: pre-change notification did the adjustment */
++ if (ndata->new_rate > ndata->old_rate)
++ return NOTIFY_OK;
++
++ /* scale down: adjust divider now - after frequency change */
++ writel_relaxed(ttccs->scale_clk_ctrl_reg_new,
++ ttccs->ttc.base_addr + TTC_CLK_CNTRL_OFFSET);
++ break;
++
++ case ABORT_RATE_CHANGE:
++ /* we have to undo the adjustment in case we scale up */
++ if (ndata->new_rate < ndata->old_rate)
++ return NOTIFY_OK;
++
++ /* restore original register value */
++ writel_relaxed(ttccs->scale_clk_ctrl_reg_old,
++ ttccs->ttc.base_addr + TTC_CLK_CNTRL_OFFSET);
++ /* fall through */
++ default:
++ return NOTIFY_DONE;
++ }
++
++ return NOTIFY_DONE;
++}
++
++static int __init ttc_setup_clocksource(struct clk *clk, void __iomem *base,
++ u32 timer_width)
++{
++ struct ttc_timer_clocksource *ttccs;
++ int err;
++
++ ttccs = kzalloc(sizeof(*ttccs), GFP_KERNEL);
++ if (!ttccs)
++ return -ENOMEM;
++
++ ttccs->ttc.clk = clk;
++
++ err = clk_prepare_enable(ttccs->ttc.clk);
++ if (err) {
++ kfree(ttccs);
++ return err;
++ }
++
++ ttccs->ttc.freq = clk_get_rate(ttccs->ttc.clk);
++
++ ttccs->ttc.clk_rate_change_nb.notifier_call =
++ ttc_rate_change_clocksource_cb;
++ ttccs->ttc.clk_rate_change_nb.next = NULL;
++
++ err = clk_notifier_register(ttccs->ttc.clk,
++ &ttccs->ttc.clk_rate_change_nb);
++ if (err)
++ pr_warn("Unable to register clock notifier.\n");
++
++ ttccs->ttc.base_addr = base;
++ ttccs->cs.name = "ttc_clocksource";
++ ttccs->cs.rating = 200;
++ ttccs->cs.read = __ttc_clocksource_read;
++ ttccs->cs.mask = CLOCKSOURCE_MASK(timer_width);
++ ttccs->cs.flags = CLOCK_SOURCE_IS_CONTINUOUS;
++
++ /*
++ * Setup the clock source counter to be an incrementing counter
++ * with no interrupt and it rolls over at 0xFFFF. Pre-scale
++ * it by 32 also. Let it start running now.
++ */
++ writel_relaxed(0x0, ttccs->ttc.base_addr + TTC_IER_OFFSET);
++ writel_relaxed(CLK_CNTRL_PRESCALE | CLK_CNTRL_PRESCALE_EN,
++ ttccs->ttc.base_addr + TTC_CLK_CNTRL_OFFSET);
++ writel_relaxed(CNT_CNTRL_RESET,
++ ttccs->ttc.base_addr + TTC_CNT_CNTRL_OFFSET);
++
++ err = clocksource_register_hz(&ttccs->cs, ttccs->ttc.freq / PRESCALE);
++ if (err) {
++ kfree(ttccs);
++ return err;
++ }
++
++ ttc_sched_clock_val_reg = base + TTC_COUNT_VAL_OFFSET;
++ sched_clock_register(ttc_sched_clock_read, timer_width,
++ ttccs->ttc.freq / PRESCALE);
++
++ return 0;
++}
++
++static int ttc_rate_change_clockevent_cb(struct notifier_block *nb,
++ unsigned long event, void *data)
++{
++ struct clk_notifier_data *ndata = data;
++ struct ttc_timer *ttc = to_ttc_timer(nb);
++ struct ttc_timer_clockevent *ttcce = container_of(ttc,
++ struct ttc_timer_clockevent, ttc);
++
++ switch (event) {
++ case POST_RATE_CHANGE:
++ /* update cached frequency */
++ ttc->freq = ndata->new_rate;
++
++ clockevents_update_freq(&ttcce->ce, ndata->new_rate / PRESCALE);
++
++ /* fall through */
++ case PRE_RATE_CHANGE:
++ case ABORT_RATE_CHANGE:
++ default:
++ return NOTIFY_DONE;
++ }
++}
++
++static int __init ttc_setup_clockevent(struct clk *clk,
++ void __iomem *base, u32 irq)
++{
++ struct ttc_timer_clockevent *ttcce;
++ int err;
++
++ ttcce = kzalloc(sizeof(*ttcce), GFP_KERNEL);
++ if (!ttcce)
++ return -ENOMEM;
++
++ ttcce->ttc.clk = clk;
++
++ err = clk_prepare_enable(ttcce->ttc.clk);
++ if (err)
++ goto out_kfree;
++
++ ttcce->ttc.clk_rate_change_nb.notifier_call =
++ ttc_rate_change_clockevent_cb;
++ ttcce->ttc.clk_rate_change_nb.next = NULL;
++
++ err = clk_notifier_register(ttcce->ttc.clk,
++ &ttcce->ttc.clk_rate_change_nb);
++ if (err) {
++ pr_warn("Unable to register clock notifier.\n");
++ goto out_kfree;
++ }
++
++ ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk);
++
++ ttcce->ttc.base_addr = base;
++ ttcce->ce.name = "ttc_clockevent";
++ ttcce->ce.features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
++ ttcce->ce.set_next_event = ttc_set_next_event;
++ ttcce->ce.set_state_shutdown = ttc_shutdown;
++ ttcce->ce.set_state_periodic = ttc_set_periodic;
++ ttcce->ce.set_state_oneshot = ttc_shutdown;
++ ttcce->ce.tick_resume = ttc_resume;
++ ttcce->ce.rating = 200;
++ ttcce->ce.irq = irq;
++ ttcce->ce.cpumask = cpu_possible_mask;
++
++ /*
++ * Setup the clock event timer to be an interval timer which
++ * is prescaled by 32 using the interval interrupt. Leave it
++ * disabled for now.
++ */
++ writel_relaxed(0x23, ttcce->ttc.base_addr + TTC_CNT_CNTRL_OFFSET);
++ writel_relaxed(CLK_CNTRL_PRESCALE | CLK_CNTRL_PRESCALE_EN,
++ ttcce->ttc.base_addr + TTC_CLK_CNTRL_OFFSET);
++ writel_relaxed(0x1, ttcce->ttc.base_addr + TTC_IER_OFFSET);
++
++ err = request_irq(irq, ttc_clock_event_interrupt,
++ IRQF_TIMER, ttcce->ce.name, ttcce);
++ if (err)
++ goto out_kfree;
++
++ clockevents_config_and_register(&ttcce->ce,
++ ttcce->ttc.freq / PRESCALE, 1, 0xfffe);
++
++ return 0;
++
++out_kfree:
++ kfree(ttcce);
++ return err;
++}
++
++static int __init ttc_timer_probe(struct platform_device *pdev)
++{
++ unsigned int irq;
++ void __iomem *timer_baseaddr;
++ struct clk *clk_cs, *clk_ce;
++ static int initialized;
++ int clksel, ret;
++ u32 timer_width = 16;
++ struct device_node *timer = pdev->dev.of_node;
++
++ if (initialized)
++ return 0;
++
++ initialized = 1;
++
++ /*
++ * Get the 1st Triple Timer Counter (TTC) block from the device tree
++ * and use it. Note that the event timer uses the interrupt and it's the
++ * 2nd TTC hence the irq_of_parse_and_map(,1)
++ */
++ timer_baseaddr = devm_of_iomap(&pdev->dev, timer, 0, NULL);
++ if (IS_ERR(timer_baseaddr)) {
++ pr_err("ERROR: invalid timer base address\n");
++ return PTR_ERR(timer_baseaddr);
++ }
++
++ irq = irq_of_parse_and_map(timer, 1);
++ if (irq <= 0) {
++ pr_err("ERROR: invalid interrupt number\n");
++ return -EINVAL;
++ }
++
++ of_property_read_u32(timer, "timer-width", &timer_width);
++
++ clksel = readl_relaxed(timer_baseaddr + TTC_CLK_CNTRL_OFFSET);
++ clksel = !!(clksel & TTC_CLK_CNTRL_CSRC_MASK);
++ clk_cs = of_clk_get(timer, clksel);
++ if (IS_ERR(clk_cs)) {
++ pr_err("ERROR: timer input clock not found\n");
++ return PTR_ERR(clk_cs);
++ }
++
++ clksel = readl_relaxed(timer_baseaddr + 4 + TTC_CLK_CNTRL_OFFSET);
++ clksel = !!(clksel & TTC_CLK_CNTRL_CSRC_MASK);
++ clk_ce = of_clk_get(timer, clksel);
++ if (IS_ERR(clk_ce)) {
++ pr_err("ERROR: timer input clock not found\n");
++ ret = PTR_ERR(clk_ce);
++ goto put_clk_cs;
++ }
++
++ ret = ttc_setup_clocksource(clk_cs, timer_baseaddr, timer_width);
++ if (ret)
++ goto put_clk_ce;
++
++ ret = ttc_setup_clockevent(clk_ce, timer_baseaddr + 4, irq);
++ if (ret)
++ goto put_clk_ce;
++
++ pr_info("%s #0 at %p, irq=%d\n", timer->name, timer_baseaddr, irq);
++
++ return 0;
++
++put_clk_ce:
++ clk_put(clk_ce);
++put_clk_cs:
++ clk_put(clk_cs);
++ return ret;
++}
++
++static const struct of_device_id ttc_timer_of_match[] = {
++ {.compatible = "cdns,ttc"},
++ {},
++};
++
++MODULE_DEVICE_TABLE(of, ttc_timer_of_match);
++
++static struct platform_driver ttc_timer_driver = {
++ .driver = {
++ .name = "cdns_ttc_timer",
++ .of_match_table = ttc_timer_of_match,
++ },
++};
++builtin_platform_driver_probe(ttc_timer_driver, ttc_timer_probe);
+diff --git a/drivers/clocksource/timer-efm32.c b/drivers/clocksource/timer-efm32.c
+new file mode 100644
+index 0000000000000..257e810ec1ad1
+--- /dev/null
++++ b/drivers/clocksource/timer-efm32.c
+@@ -0,0 +1,287 @@
++/*
++ * Copyright (C) 2013 Pengutronix
++ * Uwe Kleine-Koenig <u.kleine-koenig@pengutronix.de>
++ *
++ * This program is free software; you can redistribute it and/or modify it under
++ * the terms of the GNU General Public License version 2 as published by the
++ * Free Software Foundation.
++ */
++
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/kernel.h>
++#include <linux/clocksource.h>
++#include <linux/clockchips.h>
++#include <linux/irq.h>
++#include <linux/interrupt.h>
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/clk.h>
++
++#define TIMERn_CTRL 0x00
++#define TIMERn_CTRL_PRESC(val) (((val) & 0xf) << 24)
++#define TIMERn_CTRL_PRESC_1024 TIMERn_CTRL_PRESC(10)
++#define TIMERn_CTRL_CLKSEL(val) (((val) & 0x3) << 16)
++#define TIMERn_CTRL_CLKSEL_PRESCHFPERCLK TIMERn_CTRL_CLKSEL(0)
++#define TIMERn_CTRL_OSMEN 0x00000010
++#define TIMERn_CTRL_MODE(val) (((val) & 0x3) << 0)
++#define TIMERn_CTRL_MODE_UP TIMERn_CTRL_MODE(0)
++#define TIMERn_CTRL_MODE_DOWN TIMERn_CTRL_MODE(1)
++
++#define TIMERn_CMD 0x04
++#define TIMERn_CMD_START 0x00000001
++#define TIMERn_CMD_STOP 0x00000002
++
++#define TIMERn_IEN 0x0c
++#define TIMERn_IF 0x10
++#define TIMERn_IFS 0x14
++#define TIMERn_IFC 0x18
++#define TIMERn_IRQ_UF 0x00000002
++
++#define TIMERn_TOP 0x1c
++#define TIMERn_CNT 0x24
++
++struct efm32_clock_event_ddata {
++ struct clock_event_device evtdev;
++ void __iomem *base;
++ unsigned periodic_top;
++};
++
++static int efm32_clock_event_shutdown(struct clock_event_device *evtdev)
++{
++ struct efm32_clock_event_ddata *ddata =
++ container_of(evtdev, struct efm32_clock_event_ddata, evtdev);
++
++ writel_relaxed(TIMERn_CMD_STOP, ddata->base + TIMERn_CMD);
++ return 0;
++}
++
++static int efm32_clock_event_set_oneshot(struct clock_event_device *evtdev)
++{
++ struct efm32_clock_event_ddata *ddata =
++ container_of(evtdev, struct efm32_clock_event_ddata, evtdev);
++
++ writel_relaxed(TIMERn_CMD_STOP, ddata->base + TIMERn_CMD);
++ writel_relaxed(TIMERn_CTRL_PRESC_1024 |
++ TIMERn_CTRL_CLKSEL_PRESCHFPERCLK |
++ TIMERn_CTRL_OSMEN |
++ TIMERn_CTRL_MODE_DOWN,
++ ddata->base + TIMERn_CTRL);
++ return 0;
++}
++
++static int efm32_clock_event_set_periodic(struct clock_event_device *evtdev)
++{
++ struct efm32_clock_event_ddata *ddata =
++ container_of(evtdev, struct efm32_clock_event_ddata, evtdev);
++
++ writel_relaxed(TIMERn_CMD_STOP, ddata->base + TIMERn_CMD);
++ writel_relaxed(ddata->periodic_top, ddata->base + TIMERn_TOP);
++ writel_relaxed(TIMERn_CTRL_PRESC_1024 |
++ TIMERn_CTRL_CLKSEL_PRESCHFPERCLK |
++ TIMERn_CTRL_MODE_DOWN,
++ ddata->base + TIMERn_CTRL);
++ writel_relaxed(TIMERn_CMD_START, ddata->base + TIMERn_CMD);
++ return 0;
++}
++
++static int efm32_clock_event_set_next_event(unsigned long evt,
++ struct clock_event_device *evtdev)
++{
++ struct efm32_clock_event_ddata *ddata =
++ container_of(evtdev, struct efm32_clock_event_ddata, evtdev);
++
++ writel_relaxed(TIMERn_CMD_STOP, ddata->base + TIMERn_CMD);
++ writel_relaxed(evt, ddata->base + TIMERn_CNT);
++ writel_relaxed(TIMERn_CMD_START, ddata->base + TIMERn_CMD);
++
++ return 0;
++}
++
++static irqreturn_t efm32_clock_event_handler(int irq, void *dev_id)
++{
++ struct efm32_clock_event_ddata *ddata = dev_id;
++
++ writel_relaxed(TIMERn_IRQ_UF, ddata->base + TIMERn_IFC);
++
++ ddata->evtdev.event_handler(&ddata->evtdev);
++
++ return IRQ_HANDLED;
++}
++
++static struct efm32_clock_event_ddata clock_event_ddata = {
++ .evtdev = {
++ .name = "efm32 clockevent",
++ .features = CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_PERIODIC,
++ .set_state_shutdown = efm32_clock_event_shutdown,
++ .set_state_periodic = efm32_clock_event_set_periodic,
++ .set_state_oneshot = efm32_clock_event_set_oneshot,
++ .set_next_event = efm32_clock_event_set_next_event,
++ .rating = 200,
++ },
++};
++
++static struct irqaction efm32_clock_event_irq = {
++ .name = "efm32 clockevent",
++ .flags = IRQF_TIMER,
++ .handler = efm32_clock_event_handler,
++ .dev_id = &clock_event_ddata,
++};
++
++static int __init efm32_clocksource_init(struct device_node *np)
++{
++ struct clk *clk;
++ void __iomem *base;
++ unsigned long rate;
++ int ret;
++
++ clk = of_clk_get(np, 0);
++ if (IS_ERR(clk)) {
++ ret = PTR_ERR(clk);
++ pr_err("failed to get clock for clocksource (%d)\n", ret);
++ goto err_clk_get;
++ }
++
++ ret = clk_prepare_enable(clk);
++ if (ret) {
++ pr_err("failed to enable timer clock for clocksource (%d)\n",
++ ret);
++ goto err_clk_enable;
++ }
++ rate = clk_get_rate(clk);
++
++ base = of_iomap(np, 0);
++ if (!base) {
++ ret = -EADDRNOTAVAIL;
++ pr_err("failed to map registers for clocksource\n");
++ goto err_iomap;
++ }
++
++ writel_relaxed(TIMERn_CTRL_PRESC_1024 |
++ TIMERn_CTRL_CLKSEL_PRESCHFPERCLK |
++ TIMERn_CTRL_MODE_UP, base + TIMERn_CTRL);
++ writel_relaxed(TIMERn_CMD_START, base + TIMERn_CMD);
++
++ ret = clocksource_mmio_init(base + TIMERn_CNT, "efm32 timer",
++ DIV_ROUND_CLOSEST(rate, 1024), 200, 16,
++ clocksource_mmio_readl_up);
++ if (ret) {
++ pr_err("failed to init clocksource (%d)\n", ret);
++ goto err_clocksource_init;
++ }
++
++ return 0;
++
++err_clocksource_init:
++
++ iounmap(base);
++err_iomap:
++
++ clk_disable_unprepare(clk);
++err_clk_enable:
++
++ clk_put(clk);
++err_clk_get:
++
++ return ret;
++}
++
++static int __init efm32_clockevent_init(struct device_node *np)
++{
++ struct clk *clk;
++ void __iomem *base;
++ unsigned long rate;
++ int irq;
++ int ret;
++
++ clk = of_clk_get(np, 0);
++ if (IS_ERR(clk)) {
++ ret = PTR_ERR(clk);
++ pr_err("failed to get clock for clockevent (%d)\n", ret);
++ goto err_clk_get;
++ }
++
++ ret = clk_prepare_enable(clk);
++ if (ret) {
++ pr_err("failed to enable timer clock for clockevent (%d)\n",
++ ret);
++ goto err_clk_enable;
++ }
++ rate = clk_get_rate(clk);
++
++ base = of_iomap(np, 0);
++ if (!base) {
++ ret = -EADDRNOTAVAIL;
++ pr_err("failed to map registers for clockevent\n");
++ goto err_iomap;
++ }
++
++ irq = irq_of_parse_and_map(np, 0);
++ if (!irq) {
++ ret = -ENOENT;
++ pr_err("failed to get irq for clockevent\n");
++ goto err_get_irq;
++ }
++
++ writel_relaxed(TIMERn_IRQ_UF, base + TIMERn_IEN);
++
++ clock_event_ddata.base = base;
++ clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
++
++ clockevents_config_and_register(&clock_event_ddata.evtdev,
++ DIV_ROUND_CLOSEST(rate, 1024),
++ 0xf, 0xffff);
++
++ ret = setup_irq(irq, &efm32_clock_event_irq);
++ if (ret) {
++ pr_err("Failed setup irq\n");
++ goto err_setup_irq;
++ }
++
++ return 0;
++
++err_setup_irq:
++err_get_irq:
++
++ iounmap(base);
++err_iomap:
++
++ clk_disable_unprepare(clk);
++err_clk_enable:
++
++ clk_put(clk);
++err_clk_get:
++
++ return ret;
++}
++
++/*
++ * This function asserts that we have exactly one clocksource and one
++ * clock_event_device in the end.
++ */
++static int __init efm32_timer_init(struct device_node *np)
++{
++ static int has_clocksource, has_clockevent;
++ int ret = 0;
++
++ if (!has_clocksource) {
++ ret = efm32_clocksource_init(np);
++ if (!ret) {
++ has_clocksource = 1;
++ return 0;
++ }
++ }
++
++ if (!has_clockevent) {
++ ret = efm32_clockevent_init(np);
++ if (!ret) {
++ has_clockevent = 1;
++ return 0;
++ }
++ }
++
++ return ret;
++}
++TIMER_OF_DECLARE(efm32compat, "efm32,timer", efm32_timer_init);
++TIMER_OF_DECLARE(efm32, "energymicro,efm32-timer", efm32_timer_init);
+diff --git a/drivers/clocksource/timer-fsl-ftm.c b/drivers/clocksource/timer-fsl-ftm.c
+new file mode 100644
+index 0000000000000..846d18daf893b
+--- /dev/null
++++ b/drivers/clocksource/timer-fsl-ftm.c
+@@ -0,0 +1,376 @@
++/*
++ * Freescale FlexTimer Module (FTM) timer driver.
++ *
++ * Copyright 2014 Freescale Semiconductor, Inc.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; either version 2
++ * of the License, or (at your option) any later version.
++ */
++
++#include <linux/clk.h>
++#include <linux/clockchips.h>
++#include <linux/clocksource.h>
++#include <linux/err.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/sched_clock.h>
++#include <linux/slab.h>
++
++#define FTM_SC 0x00
++#define FTM_SC_CLK_SHIFT 3
++#define FTM_SC_CLK_MASK (0x3 << FTM_SC_CLK_SHIFT)
++#define FTM_SC_CLK(c) ((c) << FTM_SC_CLK_SHIFT)
++#define FTM_SC_PS_MASK 0x7
++#define FTM_SC_TOIE BIT(6)
++#define FTM_SC_TOF BIT(7)
++
++#define FTM_CNT 0x04
++#define FTM_MOD 0x08
++#define FTM_CNTIN 0x4C
++
++#define FTM_PS_MAX 7
++
++struct ftm_clock_device {
++ void __iomem *clksrc_base;
++ void __iomem *clkevt_base;
++ unsigned long periodic_cyc;
++ unsigned long ps;
++ bool big_endian;
++};
++
++static struct ftm_clock_device *priv;
++
++static inline u32 ftm_readl(void __iomem *addr)
++{
++ if (priv->big_endian)
++ return ioread32be(addr);
++ else
++ return ioread32(addr);
++}
++
++static inline void ftm_writel(u32 val, void __iomem *addr)
++{
++ if (priv->big_endian)
++ iowrite32be(val, addr);
++ else
++ iowrite32(val, addr);
++}
++
++static inline void ftm_counter_enable(void __iomem *base)
++{
++ u32 val;
++
++ /* select and enable counter clock source */
++ val = ftm_readl(base + FTM_SC);
++ val &= ~(FTM_SC_PS_MASK | FTM_SC_CLK_MASK);
++ val |= priv->ps | FTM_SC_CLK(1);
++ ftm_writel(val, base + FTM_SC);
++}
++
++static inline void ftm_counter_disable(void __iomem *base)
++{
++ u32 val;
++
++ /* disable counter clock source */
++ val = ftm_readl(base + FTM_SC);
++ val &= ~(FTM_SC_PS_MASK | FTM_SC_CLK_MASK);
++ ftm_writel(val, base + FTM_SC);
++}
++
++static inline void ftm_irq_acknowledge(void __iomem *base)
++{
++ u32 val;
++
++ val = ftm_readl(base + FTM_SC);
++ val &= ~FTM_SC_TOF;
++ ftm_writel(val, base + FTM_SC);
++}
++
++static inline void ftm_irq_enable(void __iomem *base)
++{
++ u32 val;
++
++ val = ftm_readl(base + FTM_SC);
++ val |= FTM_SC_TOIE;
++ ftm_writel(val, base + FTM_SC);
++}
++
++static inline void ftm_irq_disable(void __iomem *base)
++{
++ u32 val;
++
++ val = ftm_readl(base + FTM_SC);
++ val &= ~FTM_SC_TOIE;
++ ftm_writel(val, base + FTM_SC);
++}
++
++static inline void ftm_reset_counter(void __iomem *base)
++{
++ /*
++ * The CNT register contains the FTM counter value.
++ * Reset clears the CNT register. Writing any value to COUNT
++ * updates the counter with its initial value, CNTIN.
++ */
++ ftm_writel(0x00, base + FTM_CNT);
++}
++
++static u64 notrace ftm_read_sched_clock(void)
++{
++ return ftm_readl(priv->clksrc_base + FTM_CNT);
++}
++
++static int ftm_set_next_event(unsigned long delta,
++ struct clock_event_device *unused)
++{
++ /*
++ * The CNNIN and MOD are all double buffer registers, writing
++ * to the MOD register latches the value into a buffer. The MOD
++ * register is updated with the value of its write buffer with
++ * the following scenario:
++ * a, the counter source clock is diabled.
++ */
++ ftm_counter_disable(priv->clkevt_base);
++
++ /* Force the value of CNTIN to be loaded into the FTM counter */
++ ftm_reset_counter(priv->clkevt_base);
++
++ /*
++ * The counter increments until the value of MOD is reached,
++ * at which point the counter is reloaded with the value of CNTIN.
++ * The TOF (the overflow flag) bit is set when the FTM counter
++ * changes from MOD to CNTIN. So we should using the delta - 1.
++ */
++ ftm_writel(delta - 1, priv->clkevt_base + FTM_MOD);
++
++ ftm_counter_enable(priv->clkevt_base);
++
++ ftm_irq_enable(priv->clkevt_base);
++
++ return 0;
++}
++
++static int ftm_set_oneshot(struct clock_event_device *evt)
++{
++ ftm_counter_disable(priv->clkevt_base);
++ return 0;
++}
++
++static int ftm_set_periodic(struct clock_event_device *evt)
++{
++ ftm_set_next_event(priv->periodic_cyc, evt);
++ return 0;
++}
++
++static irqreturn_t ftm_evt_interrupt(int irq, void *dev_id)
++{
++ struct clock_event_device *evt = dev_id;
++
++ ftm_irq_acknowledge(priv->clkevt_base);
++
++ if (likely(clockevent_state_oneshot(evt))) {
++ ftm_irq_disable(priv->clkevt_base);
++ ftm_counter_disable(priv->clkevt_base);
++ }
++
++ evt->event_handler(evt);
++
++ return IRQ_HANDLED;
++}
++
++static struct clock_event_device ftm_clockevent = {
++ .name = "Freescale ftm timer",
++ .features = CLOCK_EVT_FEAT_PERIODIC |
++ CLOCK_EVT_FEAT_ONESHOT,
++ .set_state_periodic = ftm_set_periodic,
++ .set_state_oneshot = ftm_set_oneshot,
++ .set_next_event = ftm_set_next_event,
++ .rating = 300,
++};
++
++static struct irqaction ftm_timer_irq = {
++ .name = "Freescale ftm timer",
++ .flags = IRQF_TIMER | IRQF_IRQPOLL,
++ .handler = ftm_evt_interrupt,
++ .dev_id = &ftm_clockevent,
++};
++
++static int __init ftm_clockevent_init(unsigned long freq, int irq)
++{
++ int err;
++
++ ftm_writel(0x00, priv->clkevt_base + FTM_CNTIN);
++ ftm_writel(~0u, priv->clkevt_base + FTM_MOD);
++
++ ftm_reset_counter(priv->clkevt_base);
++
++ err = setup_irq(irq, &ftm_timer_irq);
++ if (err) {
++ pr_err("ftm: setup irq failed: %d\n", err);
++ return err;
++ }
++
++ ftm_clockevent.cpumask = cpumask_of(0);
++ ftm_clockevent.irq = irq;
++
++ clockevents_config_and_register(&ftm_clockevent,
++ freq / (1 << priv->ps),
++ 1, 0xffff);
++
++ ftm_counter_enable(priv->clkevt_base);
++
++ return 0;
++}
++
++static int __init ftm_clocksource_init(unsigned long freq)
++{
++ int err;
++
++ ftm_writel(0x00, priv->clksrc_base + FTM_CNTIN);
++ ftm_writel(~0u, priv->clksrc_base + FTM_MOD);
++
++ ftm_reset_counter(priv->clksrc_base);
++
++ sched_clock_register(ftm_read_sched_clock, 16, freq / (1 << priv->ps));
++ err = clocksource_mmio_init(priv->clksrc_base + FTM_CNT, "fsl-ftm",
++ freq / (1 << priv->ps), 300, 16,
++ clocksource_mmio_readl_up);
++ if (err) {
++ pr_err("ftm: init clock source mmio failed: %d\n", err);
++ return err;
++ }
++
++ ftm_counter_enable(priv->clksrc_base);
++
++ return 0;
++}
++
++static int __init __ftm_clk_init(struct device_node *np, char *cnt_name,
++ char *ftm_name)
++{
++ struct clk *clk;
++ int err;
++
++ clk = of_clk_get_by_name(np, cnt_name);
++ if (IS_ERR(clk)) {
++ pr_err("ftm: Cannot get \"%s\": %ld\n", cnt_name, PTR_ERR(clk));
++ return PTR_ERR(clk);
++ }
++ err = clk_prepare_enable(clk);
++ if (err) {
++ pr_err("ftm: clock failed to prepare+enable \"%s\": %d\n",
++ cnt_name, err);
++ return err;
++ }
++
++ clk = of_clk_get_by_name(np, ftm_name);
++ if (IS_ERR(clk)) {
++ pr_err("ftm: Cannot get \"%s\": %ld\n", ftm_name, PTR_ERR(clk));
++ return PTR_ERR(clk);
++ }
++ err = clk_prepare_enable(clk);
++ if (err)
++ pr_err("ftm: clock failed to prepare+enable \"%s\": %d\n",
++ ftm_name, err);
++
++ return clk_get_rate(clk);
++}
++
++static unsigned long __init ftm_clk_init(struct device_node *np)
++{
++ long freq;
++
++ freq = __ftm_clk_init(np, "ftm-evt-counter-en", "ftm-evt");
++ if (freq <= 0)
++ return 0;
++
++ freq = __ftm_clk_init(np, "ftm-src-counter-en", "ftm-src");
++ if (freq <= 0)
++ return 0;
++
++ return freq;
++}
++
++static int __init ftm_calc_closest_round_cyc(unsigned long freq)
++{
++ priv->ps = 0;
++
++ /* The counter register is only using the lower 16 bits, and
++ * if the 'freq' value is to big here, then the periodic_cyc
++ * may exceed 0xFFFF.
++ */
++ do {
++ priv->periodic_cyc = DIV_ROUND_CLOSEST(freq,
++ HZ * (1 << priv->ps++));
++ } while (priv->periodic_cyc > 0xFFFF);
++
++ if (priv->ps > FTM_PS_MAX) {
++ pr_err("ftm: the prescaler is %lu > %d\n",
++ priv->ps, FTM_PS_MAX);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++static int __init ftm_timer_init(struct device_node *np)
++{
++ unsigned long freq;
++ int ret, irq;
++
++ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++ if (!priv)
++ return -ENOMEM;
++
++ ret = -ENXIO;
++ priv->clkevt_base = of_iomap(np, 0);
++ if (!priv->clkevt_base) {
++ pr_err("ftm: unable to map event timer registers\n");
++ goto err_clkevt;
++ }
++
++ priv->clksrc_base = of_iomap(np, 1);
++ if (!priv->clksrc_base) {
++ pr_err("ftm: unable to map source timer registers\n");
++ goto err_clksrc;
++ }
++
++ ret = -EINVAL;
++ irq = irq_of_parse_and_map(np, 0);
++ if (irq <= 0) {
++ pr_err("ftm: unable to get IRQ from DT, %d\n", irq);
++ goto err;
++ }
++
++ priv->big_endian = of_property_read_bool(np, "big-endian");
++
++ freq = ftm_clk_init(np);
++ if (!freq)
++ goto err;
++
++ ret = ftm_calc_closest_round_cyc(freq);
++ if (ret)
++ goto err;
++
++ ret = ftm_clocksource_init(freq);
++ if (ret)
++ goto err;
++
++ ret = ftm_clockevent_init(freq, irq);
++ if (ret)
++ goto err;
++
++ return 0;
++
++err:
++ iounmap(priv->clksrc_base);
++err_clksrc:
++ iounmap(priv->clkevt_base);
++err_clkevt:
++ kfree(priv);
++ return ret;
++}
++TIMER_OF_DECLARE(flextimer, "fsl,ftm-timer", ftm_timer_init);
+diff --git a/drivers/clocksource/timer-lpc32xx.c b/drivers/clocksource/timer-lpc32xx.c
+new file mode 100644
+index 0000000000000..d51a62a79ef76
+--- /dev/null
++++ b/drivers/clocksource/timer-lpc32xx.c
+@@ -0,0 +1,314 @@
++/*
++ * Clocksource driver for NXP LPC32xx/18xx/43xx timer
++ *
++ * Copyright (C) 2015 Joachim Eastwood <manabian@gmail.com>
++ *
++ * Based on:
++ * time-efm32 Copyright (C) 2013 Pengutronix
++ * mach-lpc32xx/timer.c Copyright (C) 2009 - 2010 NXP Semiconductors
++ *
++ * This file is licensed under the terms of the GNU General Public
++ * License version 2. This program is licensed "as is" without any
++ * warranty of any kind, whether express or implied.
++ *
++ */
++
++#define pr_fmt(fmt) "%s: " fmt, __func__
++
++#include <linux/clk.h>
++#include <linux/clockchips.h>
++#include <linux/clocksource.h>
++#include <linux/delay.h>
++#include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/kernel.h>
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/sched_clock.h>
++
++#define LPC32XX_TIMER_IR 0x000
++#define LPC32XX_TIMER_IR_MR0INT BIT(0)
++#define LPC32XX_TIMER_TCR 0x004
++#define LPC32XX_TIMER_TCR_CEN BIT(0)
++#define LPC32XX_TIMER_TCR_CRST BIT(1)
++#define LPC32XX_TIMER_TC 0x008
++#define LPC32XX_TIMER_PR 0x00c
++#define LPC32XX_TIMER_MCR 0x014
++#define LPC32XX_TIMER_MCR_MR0I BIT(0)
++#define LPC32XX_TIMER_MCR_MR0R BIT(1)
++#define LPC32XX_TIMER_MCR_MR0S BIT(2)
++#define LPC32XX_TIMER_MR0 0x018
++#define LPC32XX_TIMER_CTCR 0x070
++
++struct lpc32xx_clock_event_ddata {
++ struct clock_event_device evtdev;
++ void __iomem *base;
++ u32 ticks_per_jiffy;
++};
++
++/* Needed for the sched clock */
++static void __iomem *clocksource_timer_counter;
++
++static u64 notrace lpc32xx_read_sched_clock(void)
++{
++ return readl(clocksource_timer_counter);
++}
++
++static unsigned long lpc32xx_delay_timer_read(void)
++{
++ return readl(clocksource_timer_counter);
++}
++
++static struct delay_timer lpc32xx_delay_timer = {
++ .read_current_timer = lpc32xx_delay_timer_read,
++};
++
++static int lpc32xx_clkevt_next_event(unsigned long delta,
++ struct clock_event_device *evtdev)
++{
++ struct lpc32xx_clock_event_ddata *ddata =
++ container_of(evtdev, struct lpc32xx_clock_event_ddata, evtdev);
++
++ /*
++ * Place timer in reset and program the delta in the match
++ * channel 0 (MR0). When the timer counter matches the value
++ * in MR0 register the match will trigger an interrupt.
++ * After setup the timer is released from reset and enabled.
++ */
++ writel_relaxed(LPC32XX_TIMER_TCR_CRST, ddata->base + LPC32XX_TIMER_TCR);
++ writel_relaxed(delta, ddata->base + LPC32XX_TIMER_MR0);
++ writel_relaxed(LPC32XX_TIMER_TCR_CEN, ddata->base + LPC32XX_TIMER_TCR);
++
++ return 0;
++}
++
++static int lpc32xx_clkevt_shutdown(struct clock_event_device *evtdev)
++{
++ struct lpc32xx_clock_event_ddata *ddata =
++ container_of(evtdev, struct lpc32xx_clock_event_ddata, evtdev);
++
++ /* Disable the timer */
++ writel_relaxed(0, ddata->base + LPC32XX_TIMER_TCR);
++
++ return 0;
++}
++
++static int lpc32xx_clkevt_oneshot(struct clock_event_device *evtdev)
++{
++ struct lpc32xx_clock_event_ddata *ddata =
++ container_of(evtdev, struct lpc32xx_clock_event_ddata, evtdev);
++
++ /*
++ * When using oneshot, we must also disable the timer
++ * to wait for the first call to set_next_event().
++ */
++ writel_relaxed(0, ddata->base + LPC32XX_TIMER_TCR);
++
++ /* Enable interrupt, reset on match and stop on match (MCR). */
++ writel_relaxed(LPC32XX_TIMER_MCR_MR0I | LPC32XX_TIMER_MCR_MR0R |
++ LPC32XX_TIMER_MCR_MR0S, ddata->base + LPC32XX_TIMER_MCR);
++ return 0;
++}
++
++static int lpc32xx_clkevt_periodic(struct clock_event_device *evtdev)
++{
++ struct lpc32xx_clock_event_ddata *ddata =
++ container_of(evtdev, struct lpc32xx_clock_event_ddata, evtdev);
++
++ /* Enable interrupt and reset on match. */
++ writel_relaxed(LPC32XX_TIMER_MCR_MR0I | LPC32XX_TIMER_MCR_MR0R,
++ ddata->base + LPC32XX_TIMER_MCR);
++
++ /*
++ * Place timer in reset and program the delta in the match
++ * channel 0 (MR0).
++ */
++ writel_relaxed(LPC32XX_TIMER_TCR_CRST, ddata->base + LPC32XX_TIMER_TCR);
++ writel_relaxed(ddata->ticks_per_jiffy, ddata->base + LPC32XX_TIMER_MR0);
++ writel_relaxed(LPC32XX_TIMER_TCR_CEN, ddata->base + LPC32XX_TIMER_TCR);
++
++ return 0;
++}
++
++static irqreturn_t lpc32xx_clock_event_handler(int irq, void *dev_id)
++{
++ struct lpc32xx_clock_event_ddata *ddata = dev_id;
++
++ /* Clear match on channel 0 */
++ writel_relaxed(LPC32XX_TIMER_IR_MR0INT, ddata->base + LPC32XX_TIMER_IR);
++
++ ddata->evtdev.event_handler(&ddata->evtdev);
++
++ return IRQ_HANDLED;
++}
++
++static struct lpc32xx_clock_event_ddata lpc32xx_clk_event_ddata = {
++ .evtdev = {
++ .name = "lpc3220 clockevent",
++ .features = CLOCK_EVT_FEAT_ONESHOT |
++ CLOCK_EVT_FEAT_PERIODIC,
++ .rating = 300,
++ .set_next_event = lpc32xx_clkevt_next_event,
++ .set_state_shutdown = lpc32xx_clkevt_shutdown,
++ .set_state_oneshot = lpc32xx_clkevt_oneshot,
++ .set_state_periodic = lpc32xx_clkevt_periodic,
++ },
++};
++
++static int __init lpc32xx_clocksource_init(struct device_node *np)
++{
++ void __iomem *base;
++ unsigned long rate;
++ struct clk *clk;
++ int ret;
++
++ clk = of_clk_get_by_name(np, "timerclk");
++ if (IS_ERR(clk)) {
++ pr_err("clock get failed (%ld)\n", PTR_ERR(clk));
++ return PTR_ERR(clk);
++ }
++
++ ret = clk_prepare_enable(clk);
++ if (ret) {
++ pr_err("clock enable failed (%d)\n", ret);
++ goto err_clk_enable;
++ }
++
++ base = of_iomap(np, 0);
++ if (!base) {
++ pr_err("unable to map registers\n");
++ ret = -EADDRNOTAVAIL;
++ goto err_iomap;
++ }
++
++ /*
++ * Disable and reset timer then set it to free running timer
++ * mode (CTCR) with no prescaler (PR) or match operations (MCR).
++ * After setup the timer is released from reset and enabled.
++ */
++ writel_relaxed(LPC32XX_TIMER_TCR_CRST, base + LPC32XX_TIMER_TCR);
++ writel_relaxed(0, base + LPC32XX_TIMER_PR);
++ writel_relaxed(0, base + LPC32XX_TIMER_MCR);
++ writel_relaxed(0, base + LPC32XX_TIMER_CTCR);
++ writel_relaxed(LPC32XX_TIMER_TCR_CEN, base + LPC32XX_TIMER_TCR);
++
++ rate = clk_get_rate(clk);
++ ret = clocksource_mmio_init(base + LPC32XX_TIMER_TC, "lpc3220 timer",
++ rate, 300, 32, clocksource_mmio_readl_up);
++ if (ret) {
++ pr_err("failed to init clocksource (%d)\n", ret);
++ goto err_clocksource_init;
++ }
++
++ clocksource_timer_counter = base + LPC32XX_TIMER_TC;
++ lpc32xx_delay_timer.freq = rate;
++ register_current_timer_delay(&lpc32xx_delay_timer);
++ sched_clock_register(lpc32xx_read_sched_clock, 32, rate);
++
++ return 0;
++
++err_clocksource_init:
++ iounmap(base);
++err_iomap:
++ clk_disable_unprepare(clk);
++err_clk_enable:
++ clk_put(clk);
++ return ret;
++}
++
++static int __init lpc32xx_clockevent_init(struct device_node *np)
++{
++ void __iomem *base;
++ unsigned long rate;
++ struct clk *clk;
++ int ret, irq;
++
++ clk = of_clk_get_by_name(np, "timerclk");
++ if (IS_ERR(clk)) {
++ pr_err("clock get failed (%ld)\n", PTR_ERR(clk));
++ return PTR_ERR(clk);
++ }
++
++ ret = clk_prepare_enable(clk);
++ if (ret) {
++ pr_err("clock enable failed (%d)\n", ret);
++ goto err_clk_enable;
++ }
++
++ base = of_iomap(np, 0);
++ if (!base) {
++ pr_err("unable to map registers\n");
++ ret = -EADDRNOTAVAIL;
++ goto err_iomap;
++ }
++
++ irq = irq_of_parse_and_map(np, 0);
++ if (!irq) {
++ pr_err("get irq failed\n");
++ ret = -ENOENT;
++ goto err_irq;
++ }
++
++ /*
++ * Disable timer and clear any pending interrupt (IR) on match
++ * channel 0 (MR0). Clear the prescaler as it's not used.
++ */
++ writel_relaxed(0, base + LPC32XX_TIMER_TCR);
++ writel_relaxed(0, base + LPC32XX_TIMER_PR);
++ writel_relaxed(0, base + LPC32XX_TIMER_CTCR);
++ writel_relaxed(LPC32XX_TIMER_IR_MR0INT, base + LPC32XX_TIMER_IR);
++
++ rate = clk_get_rate(clk);
++ lpc32xx_clk_event_ddata.base = base;
++ lpc32xx_clk_event_ddata.ticks_per_jiffy = DIV_ROUND_CLOSEST(rate, HZ);
++ clockevents_config_and_register(&lpc32xx_clk_event_ddata.evtdev,
++ rate, 1, -1);
++
++ ret = request_irq(irq, lpc32xx_clock_event_handler,
++ IRQF_TIMER | IRQF_IRQPOLL, "lpc3220 clockevent",
++ &lpc32xx_clk_event_ddata);
++ if (ret) {
++ pr_err("request irq failed\n");
++ goto err_irq;
++ }
++
++ return 0;
++
++err_irq:
++ iounmap(base);
++err_iomap:
++ clk_disable_unprepare(clk);
++err_clk_enable:
++ clk_put(clk);
++ return ret;
++}
++
++/*
++ * This function asserts that we have exactly one clocksource and one
++ * clock_event_device in the end.
++ */
++static int __init lpc32xx_timer_init(struct device_node *np)
++{
++ static int has_clocksource, has_clockevent;
++ int ret = 0;
++
++ if (!has_clocksource) {
++ ret = lpc32xx_clocksource_init(np);
++ if (!ret) {
++ has_clocksource = 1;
++ return 0;
++ }
++ }
++
++ if (!has_clockevent) {
++ ret = lpc32xx_clockevent_init(np);
++ if (!ret) {
++ has_clockevent = 1;
++ return 0;
++ }
++ }
++
++ return ret;
++}
++TIMER_OF_DECLARE(lpc32xx_timer, "nxp,lpc3220-timer", lpc32xx_timer_init);
+diff --git a/drivers/clocksource/timer-orion.c b/drivers/clocksource/timer-orion.c
+new file mode 100644
+index 0000000000000..12202067fe4b8
+--- /dev/null
++++ b/drivers/clocksource/timer-orion.c
+@@ -0,0 +1,192 @@
++/*
++ * Marvell Orion SoC timer handling.
++ *
++ * Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
++ *
++ * This file is licensed under the terms of the GNU General Public
++ * License version 2. This program is licensed "as is" without any
++ * warranty of any kind, whether express or implied.
++ *
++ * Timer 0 is used as free-running clocksource, while timer 1 is
++ * used as clock_event_device.
++ */
++
++#include <linux/kernel.h>
++#include <linux/bitops.h>
++#include <linux/clk.h>
++#include <linux/clockchips.h>
++#include <linux/delay.h>
++#include <linux/interrupt.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/spinlock.h>
++#include <linux/sched_clock.h>
++
++#define TIMER_CTRL 0x00
++#define TIMER0_EN BIT(0)
++#define TIMER0_RELOAD_EN BIT(1)
++#define TIMER1_EN BIT(2)
++#define TIMER1_RELOAD_EN BIT(3)
++#define TIMER0_RELOAD 0x10
++#define TIMER0_VAL 0x14
++#define TIMER1_RELOAD 0x18
++#define TIMER1_VAL 0x1c
++
++#define ORION_ONESHOT_MIN 1
++#define ORION_ONESHOT_MAX 0xfffffffe
++
++static void __iomem *timer_base;
++
++static unsigned long notrace orion_read_timer(void)
++{
++ return ~readl(timer_base + TIMER0_VAL);
++}
++
++static struct delay_timer orion_delay_timer = {
++ .read_current_timer = orion_read_timer,
++};
++
++static void orion_delay_timer_init(unsigned long rate)
++{
++ orion_delay_timer.freq = rate;
++ register_current_timer_delay(&orion_delay_timer);
++}
++
++/*
++ * Free-running clocksource handling.
++ */
++static u64 notrace orion_read_sched_clock(void)
++{
++ return ~readl(timer_base + TIMER0_VAL);
++}
++
++/*
++ * Clockevent handling.
++ */
++static u32 ticks_per_jiffy;
++
++static int orion_clkevt_next_event(unsigned long delta,
++ struct clock_event_device *dev)
++{
++ /* setup and enable one-shot timer */
++ writel(delta, timer_base + TIMER1_VAL);
++ atomic_io_modify(timer_base + TIMER_CTRL,
++ TIMER1_RELOAD_EN | TIMER1_EN, TIMER1_EN);
++
++ return 0;
++}
++
++static int orion_clkevt_shutdown(struct clock_event_device *dev)
++{
++ /* disable timer */
++ atomic_io_modify(timer_base + TIMER_CTRL,
++ TIMER1_RELOAD_EN | TIMER1_EN, 0);
++ return 0;
++}
++
++static int orion_clkevt_set_periodic(struct clock_event_device *dev)
++{
++ /* setup and enable periodic timer at 1/HZ intervals */
++ writel(ticks_per_jiffy - 1, timer_base + TIMER1_RELOAD);
++ writel(ticks_per_jiffy - 1, timer_base + TIMER1_VAL);
++ atomic_io_modify(timer_base + TIMER_CTRL,
++ TIMER1_RELOAD_EN | TIMER1_EN,
++ TIMER1_RELOAD_EN | TIMER1_EN);
++ return 0;
++}
++
++static struct clock_event_device orion_clkevt = {
++ .name = "orion_event",
++ .features = CLOCK_EVT_FEAT_ONESHOT |
++ CLOCK_EVT_FEAT_PERIODIC,
++ .shift = 32,
++ .rating = 300,
++ .set_next_event = orion_clkevt_next_event,
++ .set_state_shutdown = orion_clkevt_shutdown,
++ .set_state_periodic = orion_clkevt_set_periodic,
++ .set_state_oneshot = orion_clkevt_shutdown,
++ .tick_resume = orion_clkevt_shutdown,
++};
++
++static irqreturn_t orion_clkevt_irq_handler(int irq, void *dev_id)
++{
++ orion_clkevt.event_handler(&orion_clkevt);
++ return IRQ_HANDLED;
++}
++
++static struct irqaction orion_clkevt_irq = {
++ .name = "orion_event",
++ .flags = IRQF_TIMER,
++ .handler = orion_clkevt_irq_handler,
++};
++
++static int __init orion_timer_init(struct device_node *np)
++{
++ unsigned long rate;
++ struct clk *clk;
++ int irq, ret;
++
++ /* timer registers are shared with watchdog timer */
++ timer_base = of_iomap(np, 0);
++ if (!timer_base) {
++ pr_err("%s: unable to map resource\n", np->name);
++ return -ENXIO;
++ }
++
++ clk = of_clk_get(np, 0);
++ if (IS_ERR(clk)) {
++ pr_err("%s: unable to get clk\n", np->name);
++ return PTR_ERR(clk);
++ }
++
++ ret = clk_prepare_enable(clk);
++ if (ret) {
++ pr_err("Failed to prepare clock\n");
++ return ret;
++ }
++
++ /* we are only interested in timer1 irq */
++ irq = irq_of_parse_and_map(np, 1);
++ if (irq <= 0) {
++ pr_err("%s: unable to parse timer1 irq\n", np->name);
++ return -EINVAL;
++ }
++
++ rate = clk_get_rate(clk);
++
++ /* setup timer0 as free-running clocksource */
++ writel(~0, timer_base + TIMER0_VAL);
++ writel(~0, timer_base + TIMER0_RELOAD);
++ atomic_io_modify(timer_base + TIMER_CTRL,
++ TIMER0_RELOAD_EN | TIMER0_EN,
++ TIMER0_RELOAD_EN | TIMER0_EN);
++
++ ret = clocksource_mmio_init(timer_base + TIMER0_VAL,
++ "orion_clocksource", rate, 300, 32,
++ clocksource_mmio_readl_down);
++ if (ret) {
++ pr_err("Failed to initialize mmio timer\n");
++ return ret;
++ }
++
++ sched_clock_register(orion_read_sched_clock, 32, rate);
++
++ /* setup timer1 as clockevent timer */
++ ret = setup_irq(irq, &orion_clkevt_irq);
++ if (ret) {
++ pr_err("%s: unable to setup irq\n", np->name);
++ return ret;
++ }
++
++ ticks_per_jiffy = (clk_get_rate(clk) + HZ/2) / HZ;
++ orion_clkevt.cpumask = cpumask_of(0);
++ orion_clkevt.irq = irq;
++ clockevents_config_and_register(&orion_clkevt, rate,
++ ORION_ONESHOT_MIN, ORION_ONESHOT_MAX);
++
++
++ orion_delay_timer_init(rate);
++
++ return 0;
++}
++TIMER_OF_DECLARE(orion_timer, "marvell,orion-timer", orion_timer_init);
+diff --git a/drivers/clocksource/timer-owl.c b/drivers/clocksource/timer-owl.c
+new file mode 100644
+index 0000000000000..ea00a5e8f95d2
+--- /dev/null
++++ b/drivers/clocksource/timer-owl.c
+@@ -0,0 +1,173 @@
++/*
++ * Actions Semi Owl timer
++ *
++ * Copyright 2012 Actions Semi Inc.
++ * Author: Actions Semi, Inc.
++ *
++ * Copyright (c) 2017 SUSE Linux GmbH
++ * Author: Andreas Färber
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or (at your
++ * option) any later version.
++ */
++
++#include <linux/clk.h>
++#include <linux/clockchips.h>
++#include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/irqreturn.h>
++#include <linux/sched_clock.h>
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++
++#define OWL_Tx_CTL 0x0
++#define OWL_Tx_CMP 0x4
++#define OWL_Tx_VAL 0x8
++
++#define OWL_Tx_CTL_PD BIT(0)
++#define OWL_Tx_CTL_INTEN BIT(1)
++#define OWL_Tx_CTL_EN BIT(2)
++
++static void __iomem *owl_timer_base;
++static void __iomem *owl_clksrc_base;
++static void __iomem *owl_clkevt_base;
++
++static inline void owl_timer_reset(void __iomem *base)
++{
++ writel(0, base + OWL_Tx_CTL);
++ writel(0, base + OWL_Tx_VAL);
++ writel(0, base + OWL_Tx_CMP);
++}
++
++static inline void owl_timer_set_enabled(void __iomem *base, bool enabled)
++{
++ u32 ctl = readl(base + OWL_Tx_CTL);
++
++ /* PD bit is cleared when set */
++ ctl &= ~OWL_Tx_CTL_PD;
++
++ if (enabled)
++ ctl |= OWL_Tx_CTL_EN;
++ else
++ ctl &= ~OWL_Tx_CTL_EN;
++
++ writel(ctl, base + OWL_Tx_CTL);
++}
++
++static u64 notrace owl_timer_sched_read(void)
++{
++ return (u64)readl(owl_clksrc_base + OWL_Tx_VAL);
++}
++
++static int owl_timer_set_state_shutdown(struct clock_event_device *evt)
++{
++ owl_timer_set_enabled(owl_clkevt_base, false);
++
++ return 0;
++}
++
++static int owl_timer_set_state_oneshot(struct clock_event_device *evt)
++{
++ owl_timer_reset(owl_clkevt_base);
++
++ return 0;
++}
++
++static int owl_timer_tick_resume(struct clock_event_device *evt)
++{
++ return 0;
++}
++
++static int owl_timer_set_next_event(unsigned long evt,
++ struct clock_event_device *ev)
++{
++ void __iomem *base = owl_clkevt_base;
++
++ owl_timer_set_enabled(base, false);
++ writel(OWL_Tx_CTL_INTEN, base + OWL_Tx_CTL);
++ writel(0, base + OWL_Tx_VAL);
++ writel(evt, base + OWL_Tx_CMP);
++ owl_timer_set_enabled(base, true);
++
++ return 0;
++}
++
++static struct clock_event_device owl_clockevent = {
++ .name = "owl_tick",
++ .rating = 200,
++ .features = CLOCK_EVT_FEAT_ONESHOT |
++ CLOCK_EVT_FEAT_DYNIRQ,
++ .set_state_shutdown = owl_timer_set_state_shutdown,
++ .set_state_oneshot = owl_timer_set_state_oneshot,
++ .tick_resume = owl_timer_tick_resume,
++ .set_next_event = owl_timer_set_next_event,
++};
++
++static irqreturn_t owl_timer1_interrupt(int irq, void *dev_id)
++{
++ struct clock_event_device *evt = (struct clock_event_device *)dev_id;
++
++ writel(OWL_Tx_CTL_PD, owl_clkevt_base + OWL_Tx_CTL);
++
++ evt->event_handler(evt);
++
++ return IRQ_HANDLED;
++}
++
++static int __init owl_timer_init(struct device_node *node)
++{
++ struct clk *clk;
++ unsigned long rate;
++ int timer1_irq, ret;
++
++ owl_timer_base = of_io_request_and_map(node, 0, "owl-timer");
++ if (IS_ERR(owl_timer_base)) {
++ pr_err("Can't map timer registers\n");
++ return PTR_ERR(owl_timer_base);
++ }
++
++ owl_clksrc_base = owl_timer_base + 0x08;
++ owl_clkevt_base = owl_timer_base + 0x14;
++
++ timer1_irq = of_irq_get_byname(node, "timer1");
++ if (timer1_irq <= 0) {
++ pr_err("Can't parse timer1 IRQ\n");
++ return -EINVAL;
++ }
++
++ clk = of_clk_get(node, 0);
++ if (IS_ERR(clk))
++ return PTR_ERR(clk);
++
++ rate = clk_get_rate(clk);
++
++ owl_timer_reset(owl_clksrc_base);
++ owl_timer_set_enabled(owl_clksrc_base, true);
++
++ sched_clock_register(owl_timer_sched_read, 32, rate);
++ clocksource_mmio_init(owl_clksrc_base + OWL_Tx_VAL, node->name,
++ rate, 200, 32, clocksource_mmio_readl_up);
++
++ owl_timer_reset(owl_clkevt_base);
++
++ ret = request_irq(timer1_irq, owl_timer1_interrupt, IRQF_TIMER,
++ "owl-timer", &owl_clockevent);
++ if (ret) {
++ pr_err("failed to request irq %d\n", timer1_irq);
++ return ret;
++ }
++
++ owl_clockevent.cpumask = cpumask_of(0);
++ owl_clockevent.irq = timer1_irq;
++
++ clockevents_config_and_register(&owl_clockevent, rate,
++ 0xf, 0xffffffff);
++
++ return 0;
++}
++TIMER_OF_DECLARE(owl_s500, "actions,s500-timer", owl_timer_init);
++TIMER_OF_DECLARE(owl_s700, "actions,s700-timer", owl_timer_init);
++TIMER_OF_DECLARE(owl_s900, "actions,s900-timer", owl_timer_init);
+diff --git a/drivers/clocksource/timer-pistachio.c b/drivers/clocksource/timer-pistachio.c
+new file mode 100644
+index 0000000000000..a2dd85d0c1d75
+--- /dev/null
++++ b/drivers/clocksource/timer-pistachio.c
+@@ -0,0 +1,218 @@
++/*
++ * Pistachio clocksource based on general-purpose timers
++ *
++ * Copyright (C) 2015 Imagination Technologies
++ *
++ * This file is subject to the terms and conditions of the GNU General Public
++ * License. See the file "COPYING" in the main directory of this archive
++ * for more details.
++ */
++
++#define pr_fmt(fmt) "%s: " fmt, __func__
++
++#include <linux/clk.h>
++#include <linux/clocksource.h>
++#include <linux/clockchips.h>
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/spinlock.h>
++#include <linux/mfd/syscon.h>
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include <linux/platform_device.h>
++#include <linux/regmap.h>
++#include <linux/sched_clock.h>
++#include <linux/time.h>
++
++/* Top level reg */
++#define CR_TIMER_CTRL_CFG 0x00
++#define TIMER_ME_GLOBAL BIT(0)
++#define CR_TIMER_REV 0x10
++
++/* Timer specific registers */
++#define TIMER_CFG 0x20
++#define TIMER_ME_LOCAL BIT(0)
++#define TIMER_RELOAD_VALUE 0x24
++#define TIMER_CURRENT_VALUE 0x28
++#define TIMER_CURRENT_OVERFLOW_VALUE 0x2C
++#define TIMER_IRQ_STATUS 0x30
++#define TIMER_IRQ_CLEAR 0x34
++#define TIMER_IRQ_MASK 0x38
++
++#define PERIP_TIMER_CONTROL 0x90
++
++/* Timer specific configuration Values */
++#define RELOAD_VALUE 0xffffffff
++
++struct pistachio_clocksource {
++ void __iomem *base;
++ raw_spinlock_t lock;
++ struct clocksource cs;
++};
++
++static struct pistachio_clocksource pcs_gpt;
++
++#define to_pistachio_clocksource(cs) \
++ container_of(cs, struct pistachio_clocksource, cs)
++
++static inline u32 gpt_readl(void __iomem *base, u32 offset, u32 gpt_id)
++{
++ return readl(base + 0x20 * gpt_id + offset);
++}
++
++static inline void gpt_writel(void __iomem *base, u32 value, u32 offset,
++ u32 gpt_id)
++{
++ writel(value, base + 0x20 * gpt_id + offset);
++}
++
++static u64 notrace
++pistachio_clocksource_read_cycles(struct clocksource *cs)
++{
++ struct pistachio_clocksource *pcs = to_pistachio_clocksource(cs);
++ u32 counter, overflw;
++ unsigned long flags;
++
++ /*
++ * The counter value is only refreshed after the overflow value is read.
++ * And they must be read in strict order, hence raw spin lock added.
++ */
++
++ raw_spin_lock_irqsave(&pcs->lock, flags);
++ overflw = gpt_readl(pcs->base, TIMER_CURRENT_OVERFLOW_VALUE, 0);
++ counter = gpt_readl(pcs->base, TIMER_CURRENT_VALUE, 0);
++ raw_spin_unlock_irqrestore(&pcs->lock, flags);
++
++ return (u64)~counter;
++}
++
++static u64 notrace pistachio_read_sched_clock(void)
++{
++ return pistachio_clocksource_read_cycles(&pcs_gpt.cs);
++}
++
++static void pistachio_clksrc_set_mode(struct clocksource *cs, int timeridx,
++ int enable)
++{
++ struct pistachio_clocksource *pcs = to_pistachio_clocksource(cs);
++ u32 val;
++
++ val = gpt_readl(pcs->base, TIMER_CFG, timeridx);
++ if (enable)
++ val |= TIMER_ME_LOCAL;
++ else
++ val &= ~TIMER_ME_LOCAL;
++
++ gpt_writel(pcs->base, val, TIMER_CFG, timeridx);
++}
++
++static void pistachio_clksrc_enable(struct clocksource *cs, int timeridx)
++{
++ struct pistachio_clocksource *pcs = to_pistachio_clocksource(cs);
++
++ /* Disable GPT local before loading reload value */
++ pistachio_clksrc_set_mode(cs, timeridx, false);
++ gpt_writel(pcs->base, RELOAD_VALUE, TIMER_RELOAD_VALUE, timeridx);
++ pistachio_clksrc_set_mode(cs, timeridx, true);
++}
++
++static void pistachio_clksrc_disable(struct clocksource *cs, int timeridx)
++{
++ /* Disable GPT local */
++ pistachio_clksrc_set_mode(cs, timeridx, false);
++}
++
++static int pistachio_clocksource_enable(struct clocksource *cs)
++{
++ pistachio_clksrc_enable(cs, 0);
++ return 0;
++}
++
++static void pistachio_clocksource_disable(struct clocksource *cs)
++{
++ pistachio_clksrc_disable(cs, 0);
++}
++
++/* Desirable clock source for pistachio platform */
++static struct pistachio_clocksource pcs_gpt = {
++ .cs = {
++ .name = "gptimer",
++ .rating = 300,
++ .enable = pistachio_clocksource_enable,
++ .disable = pistachio_clocksource_disable,
++ .read = pistachio_clocksource_read_cycles,
++ .mask = CLOCKSOURCE_MASK(32),
++ .flags = CLOCK_SOURCE_IS_CONTINUOUS |
++ CLOCK_SOURCE_SUSPEND_NONSTOP,
++ },
++};
++
++static int __init pistachio_clksrc_of_init(struct device_node *node)
++{
++ struct clk *sys_clk, *fast_clk;
++ struct regmap *periph_regs;
++ unsigned long rate;
++ int ret;
++
++ pcs_gpt.base = of_iomap(node, 0);
++ if (!pcs_gpt.base) {
++ pr_err("cannot iomap\n");
++ return -ENXIO;
++ }
++
++ periph_regs = syscon_regmap_lookup_by_phandle(node, "img,cr-periph");
++ if (IS_ERR(periph_regs)) {
++ pr_err("cannot get peripheral regmap (%ld)\n",
++ PTR_ERR(periph_regs));
++ return PTR_ERR(periph_regs);
++ }
++
++ /* Switch to using the fast counter clock */
++ ret = regmap_update_bits(periph_regs, PERIP_TIMER_CONTROL,
++ 0xf, 0x0);
++ if (ret)
++ return ret;
++
++ sys_clk = of_clk_get_by_name(node, "sys");
++ if (IS_ERR(sys_clk)) {
++ pr_err("clock get failed (%ld)\n", PTR_ERR(sys_clk));
++ return PTR_ERR(sys_clk);
++ }
++
++ fast_clk = of_clk_get_by_name(node, "fast");
++ if (IS_ERR(fast_clk)) {
++ pr_err("clock get failed (%lu)\n", PTR_ERR(fast_clk));
++ return PTR_ERR(fast_clk);
++ }
++
++ ret = clk_prepare_enable(sys_clk);
++ if (ret < 0) {
++ pr_err("failed to enable clock (%d)\n", ret);
++ return ret;
++ }
++
++ ret = clk_prepare_enable(fast_clk);
++ if (ret < 0) {
++ pr_err("failed to enable clock (%d)\n", ret);
++ clk_disable_unprepare(sys_clk);
++ return ret;
++ }
++
++ rate = clk_get_rate(fast_clk);
++
++ /* Disable irq's for clocksource usage */
++ gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 0);
++ gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 1);
++ gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 2);
++ gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 3);
++
++ /* Enable timer block */
++ writel(TIMER_ME_GLOBAL, pcs_gpt.base);
++
++ raw_spin_lock_init(&pcs_gpt.lock);
++ sched_clock_register(pistachio_read_sched_clock, 32, rate);
++ return clocksource_register_hz(&pcs_gpt.cs, rate);
++}
++TIMER_OF_DECLARE(pistachio_gptimer, "img,pistachio-gptimer",
++ pistachio_clksrc_of_init);
+diff --git a/drivers/clocksource/timer-qcom.c b/drivers/clocksource/timer-qcom.c
+new file mode 100644
+index 0000000000000..89816f89ff3f4
+--- /dev/null
++++ b/drivers/clocksource/timer-qcom.c
+@@ -0,0 +1,258 @@
++/*
++ *
++ * Copyright (C) 2007 Google, Inc.
++ * Copyright (c) 2009-2012,2014, The Linux Foundation. All rights reserved.
++ *
++ * This software is licensed under the terms of the GNU General Public
++ * License version 2, as published by the Free Software Foundation, and
++ * may be copied, distributed, and modified under those terms.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ */
++
++#include <linux/clocksource.h>
++#include <linux/clockchips.h>
++#include <linux/cpu.h>
++#include <linux/init.h>
++#include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/io.h>
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/sched_clock.h>
++
++#include <asm/delay.h>
++
++#define TIMER_MATCH_VAL 0x0000
++#define TIMER_COUNT_VAL 0x0004
++#define TIMER_ENABLE 0x0008
++#define TIMER_ENABLE_CLR_ON_MATCH_EN BIT(1)
++#define TIMER_ENABLE_EN BIT(0)
++#define TIMER_CLEAR 0x000C
++#define DGT_CLK_CTL 0x10
++#define DGT_CLK_CTL_DIV_4 0x3
++#define TIMER_STS_GPT0_CLR_PEND BIT(10)
++
++#define GPT_HZ 32768
++
++static void __iomem *event_base;
++static void __iomem *sts_base;
++
++static irqreturn_t msm_timer_interrupt(int irq, void *dev_id)
++{
++ struct clock_event_device *evt = dev_id;
++ /* Stop the timer tick */
++ if (clockevent_state_oneshot(evt)) {
++ u32 ctrl = readl_relaxed(event_base + TIMER_ENABLE);
++ ctrl &= ~TIMER_ENABLE_EN;
++ writel_relaxed(ctrl, event_base + TIMER_ENABLE);
++ }
++ evt->event_handler(evt);
++ return IRQ_HANDLED;
++}
++
++static int msm_timer_set_next_event(unsigned long cycles,
++ struct clock_event_device *evt)
++{
++ u32 ctrl = readl_relaxed(event_base + TIMER_ENABLE);
++
++ ctrl &= ~TIMER_ENABLE_EN;
++ writel_relaxed(ctrl, event_base + TIMER_ENABLE);
++
++ writel_relaxed(ctrl, event_base + TIMER_CLEAR);
++ writel_relaxed(cycles, event_base + TIMER_MATCH_VAL);
++
++ if (sts_base)
++ while (readl_relaxed(sts_base) & TIMER_STS_GPT0_CLR_PEND)
++ cpu_relax();
++
++ writel_relaxed(ctrl | TIMER_ENABLE_EN, event_base + TIMER_ENABLE);
++ return 0;
++}
++
++static int msm_timer_shutdown(struct clock_event_device *evt)
++{
++ u32 ctrl;
++
++ ctrl = readl_relaxed(event_base + TIMER_ENABLE);
++ ctrl &= ~(TIMER_ENABLE_EN | TIMER_ENABLE_CLR_ON_MATCH_EN);
++ writel_relaxed(ctrl, event_base + TIMER_ENABLE);
++ return 0;
++}
++
++static struct clock_event_device __percpu *msm_evt;
++
++static void __iomem *source_base;
++
++static notrace u64 msm_read_timer_count(struct clocksource *cs)
++{
++ return readl_relaxed(source_base + TIMER_COUNT_VAL);
++}
++
++static struct clocksource msm_clocksource = {
++ .name = "dg_timer",
++ .rating = 300,
++ .read = msm_read_timer_count,
++ .mask = CLOCKSOURCE_MASK(32),
++ .flags = CLOCK_SOURCE_IS_CONTINUOUS,
++};
++
++static int msm_timer_irq;
++static int msm_timer_has_ppi;
++
++static int msm_local_timer_starting_cpu(unsigned int cpu)
++{
++ struct clock_event_device *evt = per_cpu_ptr(msm_evt, cpu);
++ int err;
++
++ evt->irq = msm_timer_irq;
++ evt->name = "msm_timer";
++ evt->features = CLOCK_EVT_FEAT_ONESHOT;
++ evt->rating = 200;
++ evt->set_state_shutdown = msm_timer_shutdown;
++ evt->set_state_oneshot = msm_timer_shutdown;
++ evt->tick_resume = msm_timer_shutdown;
++ evt->set_next_event = msm_timer_set_next_event;
++ evt->cpumask = cpumask_of(cpu);
++
++ clockevents_config_and_register(evt, GPT_HZ, 4, 0xffffffff);
++
++ if (msm_timer_has_ppi) {
++ enable_percpu_irq(evt->irq, IRQ_TYPE_EDGE_RISING);
++ } else {
++ err = request_irq(evt->irq, msm_timer_interrupt,
++ IRQF_TIMER | IRQF_NOBALANCING |
++ IRQF_TRIGGER_RISING, "gp_timer", evt);
++ if (err)
++ pr_err("request_irq failed\n");
++ }
++
++ return 0;
++}
++
++static int msm_local_timer_dying_cpu(unsigned int cpu)
++{
++ struct clock_event_device *evt = per_cpu_ptr(msm_evt, cpu);
++
++ evt->set_state_shutdown(evt);
++ disable_percpu_irq(evt->irq);
++ return 0;
++}
++
++static u64 notrace msm_sched_clock_read(void)
++{
++ return msm_clocksource.read(&msm_clocksource);
++}
++
++static unsigned long msm_read_current_timer(void)
++{
++ return msm_clocksource.read(&msm_clocksource);
++}
++
++static struct delay_timer msm_delay_timer = {
++ .read_current_timer = msm_read_current_timer,
++};
++
++static int __init msm_timer_init(u32 dgt_hz, int sched_bits, int irq,
++ bool percpu)
++{
++ struct clocksource *cs = &msm_clocksource;
++ int res = 0;
++
++ msm_timer_irq = irq;
++ msm_timer_has_ppi = percpu;
++
++ msm_evt = alloc_percpu(struct clock_event_device);
++ if (!msm_evt) {
++ pr_err("memory allocation failed for clockevents\n");
++ goto err;
++ }
++
++ if (percpu)
++ res = request_percpu_irq(irq, msm_timer_interrupt,
++ "gp_timer", msm_evt);
++
++ if (res) {
++ pr_err("request_percpu_irq failed\n");
++ } else {
++ /* Install and invoke hotplug callbacks */
++ res = cpuhp_setup_state(CPUHP_AP_QCOM_TIMER_STARTING,
++ "clockevents/qcom/timer:starting",
++ msm_local_timer_starting_cpu,
++ msm_local_timer_dying_cpu);
++ if (res) {
++ free_percpu_irq(irq, msm_evt);
++ goto err;
++ }
++ }
++
++err:
++ writel_relaxed(TIMER_ENABLE_EN, source_base + TIMER_ENABLE);
++ res = clocksource_register_hz(cs, dgt_hz);
++ if (res)
++ pr_err("clocksource_register failed\n");
++ sched_clock_register(msm_sched_clock_read, sched_bits, dgt_hz);
++ msm_delay_timer.freq = dgt_hz;
++ register_current_timer_delay(&msm_delay_timer);
++
++ return res;
++}
++
++static int __init msm_dt_timer_init(struct device_node *np)
++{
++ u32 freq;
++ int irq, ret;
++ struct resource res;
++ u32 percpu_offset;
++ void __iomem *base;
++ void __iomem *cpu0_base;
++
++ base = of_iomap(np, 0);
++ if (!base) {
++ pr_err("Failed to map event base\n");
++ return -ENXIO;
++ }
++
++ /* We use GPT0 for the clockevent */
++ irq = irq_of_parse_and_map(np, 1);
++ if (irq <= 0) {
++ pr_err("Can't get irq\n");
++ return -EINVAL;
++ }
++
++ /* We use CPU0's DGT for the clocksource */
++ if (of_property_read_u32(np, "cpu-offset", &percpu_offset))
++ percpu_offset = 0;
++
++ ret = of_address_to_resource(np, 0, &res);
++ if (ret) {
++ pr_err("Failed to parse DGT resource\n");
++ return ret;
++ }
++
++ cpu0_base = ioremap(res.start + percpu_offset, resource_size(&res));
++ if (!cpu0_base) {
++ pr_err("Failed to map source base\n");
++ return -EINVAL;
++ }
++
++ if (of_property_read_u32(np, "clock-frequency", &freq)) {
++ pr_err("Unknown frequency\n");
++ return -EINVAL;
++ }
++
++ event_base = base + 0x4;
++ sts_base = base + 0x88;
++ source_base = cpu0_base + 0x24;
++ freq /= 4;
++ writel_relaxed(DGT_CLK_CTL_DIV_4, source_base + DGT_CLK_CTL);
++
++ return msm_timer_init(freq, 32, irq, !!percpu_offset);
++}
++TIMER_OF_DECLARE(kpss_timer, "qcom,kpss-timer", msm_dt_timer_init);
++TIMER_OF_DECLARE(scss_timer, "qcom,scss-timer", msm_dt_timer_init);
+diff --git a/drivers/clocksource/timer-versatile.c b/drivers/clocksource/timer-versatile.c
+new file mode 100644
+index 0000000000000..39725d38aedee
+--- /dev/null
++++ b/drivers/clocksource/timer-versatile.c
+@@ -0,0 +1,44 @@
++/*
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * Copyright (C) 2014 ARM Limited
++ */
++
++#include <linux/clocksource.h>
++#include <linux/io.h>
++#include <linux/of_address.h>
++#include <linux/sched_clock.h>
++
++#define SYS_24MHZ 0x05c
++
++static void __iomem *versatile_sys_24mhz;
++
++static u64 notrace versatile_sys_24mhz_read(void)
++{
++ return readl(versatile_sys_24mhz);
++}
++
++static int __init versatile_sched_clock_init(struct device_node *node)
++{
++ void __iomem *base = of_iomap(node, 0);
++
++ if (!base)
++ return -ENXIO;
++
++ versatile_sys_24mhz = base + SYS_24MHZ;
++
++ sched_clock_register(versatile_sys_24mhz_read, 32, 24000000);
++
++ return 0;
++}
++TIMER_OF_DECLARE(vexpress, "arm,vexpress-sysreg",
++ versatile_sched_clock_init);
++TIMER_OF_DECLARE(versatile, "arm,versatile-sysreg",
++ versatile_sched_clock_init);
+diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
+new file mode 100644
+index 0000000000000..0f92089ec08c7
+--- /dev/null
++++ b/drivers/clocksource/timer-vf-pit.c
+@@ -0,0 +1,204 @@
++/*
++ * Copyright 2012-2013 Freescale Semiconductor, Inc.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; either version 2
++ * of the License, or (at your option) any later version.
++ */
++
++#include <linux/interrupt.h>
++#include <linux/clockchips.h>
++#include <linux/clk.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/sched_clock.h>
++
++/*
++ * Each pit takes 0x10 Bytes register space
++ */
++#define PITMCR 0x00
++#define PIT0_OFFSET 0x100
++#define PITn_OFFSET(n) (PIT0_OFFSET + 0x10 * (n))
++#define PITLDVAL 0x00
++#define PITCVAL 0x04
++#define PITTCTRL 0x08
++#define PITTFLG 0x0c
++
++#define PITMCR_MDIS (0x1 << 1)
++
++#define PITTCTRL_TEN (0x1 << 0)
++#define PITTCTRL_TIE (0x1 << 1)
++#define PITCTRL_CHN (0x1 << 2)
++
++#define PITTFLG_TIF 0x1
++
++static void __iomem *clksrc_base;
++static void __iomem *clkevt_base;
++static unsigned long cycle_per_jiffy;
++
++static inline void pit_timer_enable(void)
++{
++ __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
++}
++
++static inline void pit_timer_disable(void)
++{
++ __raw_writel(0, clkevt_base + PITTCTRL);
++}
++
++static inline void pit_irq_acknowledge(void)
++{
++ __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++}
++
++static u64 notrace pit_read_sched_clock(void)
++{
++ return ~__raw_readl(clksrc_base + PITCVAL);
++}
++
++static int __init pit_clocksource_init(unsigned long rate)
++{
++ /* set the max load value and start the clock source counter */
++ __raw_writel(0, clksrc_base + PITTCTRL);
++ __raw_writel(~0UL, clksrc_base + PITLDVAL);
++ __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
++
++ sched_clock_register(pit_read_sched_clock, 32, rate);
++ return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
++ 300, 32, clocksource_mmio_readl_down);
++}
++
++static int pit_set_next_event(unsigned long delta,
++ struct clock_event_device *unused)
++{
++ /*
++ * set a new value to PITLDVAL register will not restart the timer,
++ * to abort the current cycle and start a timer period with the new
++ * value, the timer must be disabled and enabled again.
++ * and the PITLAVAL should be set to delta minus one according to pit
++ * hardware requirement.
++ */
++ pit_timer_disable();
++ __raw_writel(delta - 1, clkevt_base + PITLDVAL);
++ pit_timer_enable();
++
++ return 0;
++}
++
++static int pit_shutdown(struct clock_event_device *evt)
++{
++ pit_timer_disable();
++ return 0;
++}
++
++static int pit_set_periodic(struct clock_event_device *evt)
++{
++ pit_set_next_event(cycle_per_jiffy, evt);
++ return 0;
++}
++
++static irqreturn_t pit_timer_interrupt(int irq, void *dev_id)
++{
++ struct clock_event_device *evt = dev_id;
++
++ pit_irq_acknowledge();
++
++ /*
++ * pit hardware doesn't support oneshot, it will generate an interrupt
++ * and reload the counter value from PITLDVAL when PITCVAL reach zero,
++ * and start the counter again. So software need to disable the timer
++ * to stop the counter loop in ONESHOT mode.
++ */
++ if (likely(clockevent_state_oneshot(evt)))
++ pit_timer_disable();
++
++ evt->event_handler(evt);
++
++ return IRQ_HANDLED;
++}
++
++static struct clock_event_device clockevent_pit = {
++ .name = "VF pit timer",
++ .features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT,
++ .set_state_shutdown = pit_shutdown,
++ .set_state_periodic = pit_set_periodic,
++ .set_next_event = pit_set_next_event,
++ .rating = 300,
++};
++
++static struct irqaction pit_timer_irq = {
++ .name = "VF pit timer",
++ .flags = IRQF_TIMER | IRQF_IRQPOLL,
++ .handler = pit_timer_interrupt,
++ .dev_id = &clockevent_pit,
++};
++
++static int __init pit_clockevent_init(unsigned long rate, int irq)
++{
++ __raw_writel(0, clkevt_base + PITTCTRL);
++ __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
++
++ BUG_ON(setup_irq(irq, &pit_timer_irq));
++
++ clockevent_pit.cpumask = cpumask_of(0);
++ clockevent_pit.irq = irq;
++ /*
++ * The value for the LDVAL register trigger is calculated as:
++ * LDVAL trigger = (period / clock period) - 1
++ * The pit is a 32-bit down count timer, when the conter value
++ * reaches 0, it will generate an interrupt, thus the minimal
++ * LDVAL trigger value is 1. And then the min_delta is
++ * minimal LDVAL trigger value + 1, and the max_delta is full 32-bit.
++ */
++ clockevents_config_and_register(&clockevent_pit, rate, 2, 0xffffffff);
++
++ return 0;
++}
++
++static int __init pit_timer_init(struct device_node *np)
++{
++ struct clk *pit_clk;
++ void __iomem *timer_base;
++ unsigned long clk_rate;
++ int irq, ret;
++
++ timer_base = of_iomap(np, 0);
++ if (!timer_base) {
++ pr_err("Failed to iomap\n");
++ return -ENXIO;
++ }
++
++ /*
++ * PIT0 and PIT1 can be chained to build a 64-bit timer,
++ * so choose PIT2 as clocksource, PIT3 as clockevent device,
++ * and leave PIT0 and PIT1 unused for anyone else who needs them.
++ */
++ clksrc_base = timer_base + PITn_OFFSET(2);
++ clkevt_base = timer_base + PITn_OFFSET(3);
++
++ irq = irq_of_parse_and_map(np, 0);
++ if (irq <= 0)
++ return -EINVAL;
++
++ pit_clk = of_clk_get(np, 0);
++ if (IS_ERR(pit_clk))
++ return PTR_ERR(pit_clk);
++
++ ret = clk_prepare_enable(pit_clk);
++ if (ret)
++ return ret;
++
++ clk_rate = clk_get_rate(pit_clk);
++ cycle_per_jiffy = clk_rate / (HZ);
++
++ /* enable the pit module */
++ __raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
++
++ ret = pit_clocksource_init(clk_rate);
++ if (ret)
++ return ret;
++
++ return pit_clockevent_init(clk_rate, irq);
++}
++TIMER_OF_DECLARE(vf610, "fsl,vf610-pit", pit_timer_init);
+diff --git a/drivers/clocksource/timer-vt8500.c b/drivers/clocksource/timer-vt8500.c
+new file mode 100644
+index 0000000000000..e0f7489cfc8e2
+--- /dev/null
++++ b/drivers/clocksource/timer-vt8500.c
+@@ -0,0 +1,168 @@
++/*
++ * arch/arm/mach-vt8500/timer.c
++ *
++ * Copyright (C) 2012 Tony Prisk <linux@prisktech.co.nz>
++ * Copyright (C) 2010 Alexey Charkov <alchark@gmail.com>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
++ */
++
++/*
++ * This file is copied and modified from the original timer.c provided by
++ * Alexey Charkov. Minor changes have been made for Device Tree Support.
++ */
++
++#include <linux/io.h>
++#include <linux/irq.h>
++#include <linux/interrupt.h>
++#include <linux/clocksource.h>
++#include <linux/clockchips.h>
++#include <linux/delay.h>
++
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++
++#define VT8500_TIMER_OFFSET 0x0100
++#define VT8500_TIMER_HZ 3000000
++#define TIMER_MATCH_VAL 0x0000
++#define TIMER_COUNT_VAL 0x0010
++#define TIMER_STATUS_VAL 0x0014
++#define TIMER_IER_VAL 0x001c /* interrupt enable */
++#define TIMER_CTRL_VAL 0x0020
++#define TIMER_AS_VAL 0x0024 /* access status */
++#define TIMER_COUNT_R_ACTIVE (1 << 5) /* not ready for read */
++#define TIMER_COUNT_W_ACTIVE (1 << 4) /* not ready for write */
++#define TIMER_MATCH_W_ACTIVE (1 << 0) /* not ready for write */
++
++#define msecs_to_loops(t) (loops_per_jiffy / 1000 * HZ * t)
++
++#define MIN_OSCR_DELTA 16
++
++static void __iomem *regbase;
++
++static u64 vt8500_timer_read(struct clocksource *cs)
++{
++ int loops = msecs_to_loops(10);
++ writel(3, regbase + TIMER_CTRL_VAL);
++ while ((readl((regbase + TIMER_AS_VAL)) & TIMER_COUNT_R_ACTIVE)
++ && --loops)
++ cpu_relax();
++ return readl(regbase + TIMER_COUNT_VAL);
++}
++
++static struct clocksource clocksource = {
++ .name = "vt8500_timer",
++ .rating = 200,
++ .read = vt8500_timer_read,
++ .mask = CLOCKSOURCE_MASK(32),
++ .flags = CLOCK_SOURCE_IS_CONTINUOUS,
++};
++
++static int vt8500_timer_set_next_event(unsigned long cycles,
++ struct clock_event_device *evt)
++{
++ int loops = msecs_to_loops(10);
++ u64 alarm = clocksource.read(&clocksource) + cycles;
++ while ((readl(regbase + TIMER_AS_VAL) & TIMER_MATCH_W_ACTIVE)
++ && --loops)
++ cpu_relax();
++ writel((unsigned long)alarm, regbase + TIMER_MATCH_VAL);
++
++ if ((signed)(alarm - clocksource.read(&clocksource)) <= MIN_OSCR_DELTA)
++ return -ETIME;
++
++ writel(1, regbase + TIMER_IER_VAL);
++
++ return 0;
++}
++
++static int vt8500_shutdown(struct clock_event_device *evt)
++{
++ writel(readl(regbase + TIMER_CTRL_VAL) | 1, regbase + TIMER_CTRL_VAL);
++ writel(0, regbase + TIMER_IER_VAL);
++ return 0;
++}
++
++static struct clock_event_device clockevent = {
++ .name = "vt8500_timer",
++ .features = CLOCK_EVT_FEAT_ONESHOT,
++ .rating = 200,
++ .set_next_event = vt8500_timer_set_next_event,
++ .set_state_shutdown = vt8500_shutdown,
++ .set_state_oneshot = vt8500_shutdown,
++};
++
++static irqreturn_t vt8500_timer_interrupt(int irq, void *dev_id)
++{
++ struct clock_event_device *evt = dev_id;
++ writel(0xf, regbase + TIMER_STATUS_VAL);
++ evt->event_handler(evt);
++
++ return IRQ_HANDLED;
++}
++
++static struct irqaction irq = {
++ .name = "vt8500_timer",
++ .flags = IRQF_TIMER | IRQF_IRQPOLL,
++ .handler = vt8500_timer_interrupt,
++ .dev_id = &clockevent,
++};
++
++static int __init vt8500_timer_init(struct device_node *np)
++{
++ int timer_irq, ret;
++
++ regbase = of_iomap(np, 0);
++ if (!regbase) {
++ pr_err("%s: Missing iobase description in Device Tree\n",
++ __func__);
++ return -ENXIO;
++ }
++
++ timer_irq = irq_of_parse_and_map(np, 0);
++ if (!timer_irq) {
++ pr_err("%s: Missing irq description in Device Tree\n",
++ __func__);
++ return -EINVAL;
++ }
++
++ writel(1, regbase + TIMER_CTRL_VAL);
++ writel(0xf, regbase + TIMER_STATUS_VAL);
++ writel(~0, regbase + TIMER_MATCH_VAL);
++
++ ret = clocksource_register_hz(&clocksource, VT8500_TIMER_HZ);
++ if (ret) {
++ pr_err("%s: vt8500_timer_init: clocksource_register failed for %s\n",
++ __func__, clocksource.name);
++ return ret;
++ }
++
++ clockevent.cpumask = cpumask_of(0);
++
++ ret = setup_irq(timer_irq, &irq);
++ if (ret) {
++ pr_err("%s: setup_irq failed for %s\n", __func__,
++ clockevent.name);
++ return ret;
++ }
++
++ clockevents_config_and_register(&clockevent, VT8500_TIMER_HZ,
++ MIN_OSCR_DELTA * 2, 0xf0000000);
++
++ return 0;
++}
++
++TIMER_OF_DECLARE(vt8500, "via,vt8500-timer", vt8500_timer_init);
+diff --git a/drivers/clocksource/timer-zevio.c b/drivers/clocksource/timer-zevio.c
+new file mode 100644
+index 0000000000000..f74689334f7cb
+--- /dev/null
++++ b/drivers/clocksource/timer-zevio.c
+@@ -0,0 +1,218 @@
++/*
++ * linux/drivers/clocksource/zevio-timer.c
++ *
++ * Copyright (C) 2013 Daniel Tang <tangrs@tangrs.id.au>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2, as
++ * published by the Free Software Foundation.
++ *
++ */
++
++#include <linux/io.h>
++#include <linux/irq.h>
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/clk.h>
++#include <linux/clockchips.h>
++#include <linux/cpumask.h>
++#include <linux/interrupt.h>
++#include <linux/slab.h>
++
++#define IO_CURRENT_VAL 0x00
++#define IO_DIVIDER 0x04
++#define IO_CONTROL 0x08
++
++#define IO_TIMER1 0x00
++#define IO_TIMER2 0x0C
++
++#define IO_MATCH_BEGIN 0x18
++#define IO_MATCH(x) (IO_MATCH_BEGIN + ((x) << 2))
++
++#define IO_INTR_STS 0x00
++#define IO_INTR_ACK 0x00
++#define IO_INTR_MSK 0x04
++
++#define CNTL_STOP_TIMER (1 << 4)
++#define CNTL_RUN_TIMER (0 << 4)
++
++#define CNTL_INC (1 << 3)
++#define CNTL_DEC (0 << 3)
++
++#define CNTL_TOZERO 0
++#define CNTL_MATCH(x) ((x) + 1)
++#define CNTL_FOREVER 7
++
++/* There are 6 match registers but we only use one. */
++#define TIMER_MATCH 0
++
++#define TIMER_INTR_MSK (1 << (TIMER_MATCH))
++#define TIMER_INTR_ALL 0x3F
++
++struct zevio_timer {
++ void __iomem *base;
++ void __iomem *timer1, *timer2;
++ void __iomem *interrupt_regs;
++
++ struct clk *clk;
++ struct clock_event_device clkevt;
++ struct irqaction clkevt_irq;
++
++ char clocksource_name[64];
++ char clockevent_name[64];
++};
++
++static int zevio_timer_set_event(unsigned long delta,
++ struct clock_event_device *dev)
++{
++ struct zevio_timer *timer = container_of(dev, struct zevio_timer,
++ clkevt);
++
++ writel(delta, timer->timer1 + IO_CURRENT_VAL);
++ writel(CNTL_RUN_TIMER | CNTL_DEC | CNTL_MATCH(TIMER_MATCH),
++ timer->timer1 + IO_CONTROL);
++
++ return 0;
++}
++
++static int zevio_timer_shutdown(struct clock_event_device *dev)
++{
++ struct zevio_timer *timer = container_of(dev, struct zevio_timer,
++ clkevt);
++
++ /* Disable timer interrupts */
++ writel(0, timer->interrupt_regs + IO_INTR_MSK);
++ writel(TIMER_INTR_ALL, timer->interrupt_regs + IO_INTR_ACK);
++ /* Stop timer */
++ writel(CNTL_STOP_TIMER, timer->timer1 + IO_CONTROL);
++ return 0;
++}
++
++static int zevio_timer_set_oneshot(struct clock_event_device *dev)
++{
++ struct zevio_timer *timer = container_of(dev, struct zevio_timer,
++ clkevt);
++
++ /* Enable timer interrupts */
++ writel(TIMER_INTR_MSK, timer->interrupt_regs + IO_INTR_MSK);
++ writel(TIMER_INTR_ALL, timer->interrupt_regs + IO_INTR_ACK);
++ return 0;
++}
++
++static irqreturn_t zevio_timer_interrupt(int irq, void *dev_id)
++{
++ struct zevio_timer *timer = dev_id;
++ u32 intr;
++
++ intr = readl(timer->interrupt_regs + IO_INTR_ACK);
++ if (!(intr & TIMER_INTR_MSK))
++ return IRQ_NONE;
++
++ writel(TIMER_INTR_MSK, timer->interrupt_regs + IO_INTR_ACK);
++ writel(CNTL_STOP_TIMER, timer->timer1 + IO_CONTROL);
++
++ if (timer->clkevt.event_handler)
++ timer->clkevt.event_handler(&timer->clkevt);
++
++ return IRQ_HANDLED;
++}
++
++static int __init zevio_timer_add(struct device_node *node)
++{
++ struct zevio_timer *timer;
++ struct resource res;
++ int irqnr, ret;
++
++ timer = kzalloc(sizeof(*timer), GFP_KERNEL);
++ if (!timer)
++ return -ENOMEM;
++
++ timer->base = of_iomap(node, 0);
++ if (!timer->base) {
++ ret = -EINVAL;
++ goto error_free;
++ }
++ timer->timer1 = timer->base + IO_TIMER1;
++ timer->timer2 = timer->base + IO_TIMER2;
++
++ timer->clk = of_clk_get(node, 0);
++ if (IS_ERR(timer->clk)) {
++ ret = PTR_ERR(timer->clk);
++ pr_err("Timer clock not found! (error %d)\n", ret);
++ goto error_unmap;
++ }
++
++ timer->interrupt_regs = of_iomap(node, 1);
++ irqnr = irq_of_parse_and_map(node, 0);
++
++ of_address_to_resource(node, 0, &res);
++ scnprintf(timer->clocksource_name, sizeof(timer->clocksource_name),
++ "%llx.%s_clocksource",
++ (unsigned long long)res.start, node->name);
++
++ scnprintf(timer->clockevent_name, sizeof(timer->clockevent_name),
++ "%llx.%s_clockevent",
++ (unsigned long long)res.start, node->name);
++
++ if (timer->interrupt_regs && irqnr) {
++ timer->clkevt.name = timer->clockevent_name;
++ timer->clkevt.set_next_event = zevio_timer_set_event;
++ timer->clkevt.set_state_shutdown = zevio_timer_shutdown;
++ timer->clkevt.set_state_oneshot = zevio_timer_set_oneshot;
++ timer->clkevt.tick_resume = zevio_timer_set_oneshot;
++ timer->clkevt.rating = 200;
++ timer->clkevt.cpumask = cpu_possible_mask;
++ timer->clkevt.features = CLOCK_EVT_FEAT_ONESHOT;
++ timer->clkevt.irq = irqnr;
++
++ writel(CNTL_STOP_TIMER, timer->timer1 + IO_CONTROL);
++ writel(0, timer->timer1 + IO_DIVIDER);
++
++ /* Start with timer interrupts disabled */
++ writel(0, timer->interrupt_regs + IO_INTR_MSK);
++ writel(TIMER_INTR_ALL, timer->interrupt_regs + IO_INTR_ACK);
++
++ /* Interrupt to occur when timer value matches 0 */
++ writel(0, timer->base + IO_MATCH(TIMER_MATCH));
++
++ timer->clkevt_irq.name = timer->clockevent_name;
++ timer->clkevt_irq.handler = zevio_timer_interrupt;
++ timer->clkevt_irq.dev_id = timer;
++ timer->clkevt_irq.flags = IRQF_TIMER | IRQF_IRQPOLL;
++
++ setup_irq(irqnr, &timer->clkevt_irq);
++
++ clockevents_config_and_register(&timer->clkevt,
++ clk_get_rate(timer->clk), 0x0001, 0xffff);
++ pr_info("Added %s as clockevent\n", timer->clockevent_name);
++ }
++
++ writel(CNTL_STOP_TIMER, timer->timer2 + IO_CONTROL);
++ writel(0, timer->timer2 + IO_CURRENT_VAL);
++ writel(0, timer->timer2 + IO_DIVIDER);
++ writel(CNTL_RUN_TIMER | CNTL_FOREVER | CNTL_INC,
++ timer->timer2 + IO_CONTROL);
++
++ clocksource_mmio_init(timer->timer2 + IO_CURRENT_VAL,
++ timer->clocksource_name,
++ clk_get_rate(timer->clk),
++ 200, 16,
++ clocksource_mmio_readw_up);
++
++ pr_info("Added %s as clocksource\n", timer->clocksource_name);
++
++ return 0;
++error_unmap:
++ iounmap(timer->base);
++error_free:
++ kfree(timer);
++ return ret;
++}
++
++static int __init zevio_timer_init(struct device_node *node)
++{
++ return zevio_timer_add(node);
++}
++
++TIMER_OF_DECLARE(zevio_timer, "lsi,zevio-timer", zevio_timer_init);
+diff --git a/drivers/clocksource/versatile.c b/drivers/clocksource/versatile.c
+deleted file mode 100644
+index 39725d38aedee..0000000000000
+--- a/drivers/clocksource/versatile.c
++++ /dev/null
+@@ -1,44 +0,0 @@
+-/*
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2 as
+- * published by the Free Software Foundation.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- * GNU General Public License for more details.
+- *
+- * Copyright (C) 2014 ARM Limited
+- */
+-
+-#include <linux/clocksource.h>
+-#include <linux/io.h>
+-#include <linux/of_address.h>
+-#include <linux/sched_clock.h>
+-
+-#define SYS_24MHZ 0x05c
+-
+-static void __iomem *versatile_sys_24mhz;
+-
+-static u64 notrace versatile_sys_24mhz_read(void)
+-{
+- return readl(versatile_sys_24mhz);
+-}
+-
+-static int __init versatile_sched_clock_init(struct device_node *node)
+-{
+- void __iomem *base = of_iomap(node, 0);
+-
+- if (!base)
+- return -ENXIO;
+-
+- versatile_sys_24mhz = base + SYS_24MHZ;
+-
+- sched_clock_register(versatile_sys_24mhz_read, 32, 24000000);
+-
+- return 0;
+-}
+-TIMER_OF_DECLARE(vexpress, "arm,vexpress-sysreg",
+- versatile_sched_clock_init);
+-TIMER_OF_DECLARE(versatile, "arm,versatile-sysreg",
+- versatile_sched_clock_init);
+diff --git a/drivers/clocksource/vf_pit_timer.c b/drivers/clocksource/vf_pit_timer.c
+deleted file mode 100644
+index 0f92089ec08c7..0000000000000
+--- a/drivers/clocksource/vf_pit_timer.c
++++ /dev/null
+@@ -1,204 +0,0 @@
+-/*
+- * Copyright 2012-2013 Freescale Semiconductor, Inc.
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License
+- * as published by the Free Software Foundation; either version 2
+- * of the License, or (at your option) any later version.
+- */
+-
+-#include <linux/interrupt.h>
+-#include <linux/clockchips.h>
+-#include <linux/clk.h>
+-#include <linux/of_address.h>
+-#include <linux/of_irq.h>
+-#include <linux/sched_clock.h>
+-
+-/*
+- * Each pit takes 0x10 Bytes register space
+- */
+-#define PITMCR 0x00
+-#define PIT0_OFFSET 0x100
+-#define PITn_OFFSET(n) (PIT0_OFFSET + 0x10 * (n))
+-#define PITLDVAL 0x00
+-#define PITCVAL 0x04
+-#define PITTCTRL 0x08
+-#define PITTFLG 0x0c
+-
+-#define PITMCR_MDIS (0x1 << 1)
+-
+-#define PITTCTRL_TEN (0x1 << 0)
+-#define PITTCTRL_TIE (0x1 << 1)
+-#define PITCTRL_CHN (0x1 << 2)
+-
+-#define PITTFLG_TIF 0x1
+-
+-static void __iomem *clksrc_base;
+-static void __iomem *clkevt_base;
+-static unsigned long cycle_per_jiffy;
+-
+-static inline void pit_timer_enable(void)
+-{
+- __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+-}
+-
+-static inline void pit_timer_disable(void)
+-{
+- __raw_writel(0, clkevt_base + PITTCTRL);
+-}
+-
+-static inline void pit_irq_acknowledge(void)
+-{
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+-}
+-
+-static u64 notrace pit_read_sched_clock(void)
+-{
+- return ~__raw_readl(clksrc_base + PITCVAL);
+-}
+-
+-static int __init pit_clocksource_init(unsigned long rate)
+-{
+- /* set the max load value and start the clock source counter */
+- __raw_writel(0, clksrc_base + PITTCTRL);
+- __raw_writel(~0UL, clksrc_base + PITLDVAL);
+- __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+-
+- sched_clock_register(pit_read_sched_clock, 32, rate);
+- return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
+- 300, 32, clocksource_mmio_readl_down);
+-}
+-
+-static int pit_set_next_event(unsigned long delta,
+- struct clock_event_device *unused)
+-{
+- /*
+- * set a new value to PITLDVAL register will not restart the timer,
+- * to abort the current cycle and start a timer period with the new
+- * value, the timer must be disabled and enabled again.
+- * and the PITLAVAL should be set to delta minus one according to pit
+- * hardware requirement.
+- */
+- pit_timer_disable();
+- __raw_writel(delta - 1, clkevt_base + PITLDVAL);
+- pit_timer_enable();
+-
+- return 0;
+-}
+-
+-static int pit_shutdown(struct clock_event_device *evt)
+-{
+- pit_timer_disable();
+- return 0;
+-}
+-
+-static int pit_set_periodic(struct clock_event_device *evt)
+-{
+- pit_set_next_event(cycle_per_jiffy, evt);
+- return 0;
+-}
+-
+-static irqreturn_t pit_timer_interrupt(int irq, void *dev_id)
+-{
+- struct clock_event_device *evt = dev_id;
+-
+- pit_irq_acknowledge();
+-
+- /*
+- * pit hardware doesn't support oneshot, it will generate an interrupt
+- * and reload the counter value from PITLDVAL when PITCVAL reach zero,
+- * and start the counter again. So software need to disable the timer
+- * to stop the counter loop in ONESHOT mode.
+- */
+- if (likely(clockevent_state_oneshot(evt)))
+- pit_timer_disable();
+-
+- evt->event_handler(evt);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static struct clock_event_device clockevent_pit = {
+- .name = "VF pit timer",
+- .features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT,
+- .set_state_shutdown = pit_shutdown,
+- .set_state_periodic = pit_set_periodic,
+- .set_next_event = pit_set_next_event,
+- .rating = 300,
+-};
+-
+-static struct irqaction pit_timer_irq = {
+- .name = "VF pit timer",
+- .flags = IRQF_TIMER | IRQF_IRQPOLL,
+- .handler = pit_timer_interrupt,
+- .dev_id = &clockevent_pit,
+-};
+-
+-static int __init pit_clockevent_init(unsigned long rate, int irq)
+-{
+- __raw_writel(0, clkevt_base + PITTCTRL);
+- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+-
+- BUG_ON(setup_irq(irq, &pit_timer_irq));
+-
+- clockevent_pit.cpumask = cpumask_of(0);
+- clockevent_pit.irq = irq;
+- /*
+- * The value for the LDVAL register trigger is calculated as:
+- * LDVAL trigger = (period / clock period) - 1
+- * The pit is a 32-bit down count timer, when the conter value
+- * reaches 0, it will generate an interrupt, thus the minimal
+- * LDVAL trigger value is 1. And then the min_delta is
+- * minimal LDVAL trigger value + 1, and the max_delta is full 32-bit.
+- */
+- clockevents_config_and_register(&clockevent_pit, rate, 2, 0xffffffff);
+-
+- return 0;
+-}
+-
+-static int __init pit_timer_init(struct device_node *np)
+-{
+- struct clk *pit_clk;
+- void __iomem *timer_base;
+- unsigned long clk_rate;
+- int irq, ret;
+-
+- timer_base = of_iomap(np, 0);
+- if (!timer_base) {
+- pr_err("Failed to iomap\n");
+- return -ENXIO;
+- }
+-
+- /*
+- * PIT0 and PIT1 can be chained to build a 64-bit timer,
+- * so choose PIT2 as clocksource, PIT3 as clockevent device,
+- * and leave PIT0 and PIT1 unused for anyone else who needs them.
+- */
+- clksrc_base = timer_base + PITn_OFFSET(2);
+- clkevt_base = timer_base + PITn_OFFSET(3);
+-
+- irq = irq_of_parse_and_map(np, 0);
+- if (irq <= 0)
+- return -EINVAL;
+-
+- pit_clk = of_clk_get(np, 0);
+- if (IS_ERR(pit_clk))
+- return PTR_ERR(pit_clk);
+-
+- ret = clk_prepare_enable(pit_clk);
+- if (ret)
+- return ret;
+-
+- clk_rate = clk_get_rate(pit_clk);
+- cycle_per_jiffy = clk_rate / (HZ);
+-
+- /* enable the pit module */
+- __raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
+-
+- ret = pit_clocksource_init(clk_rate);
+- if (ret)
+- return ret;
+-
+- return pit_clockevent_init(clk_rate, irq);
+-}
+-TIMER_OF_DECLARE(vf610, "fsl,vf610-pit", pit_timer_init);
+diff --git a/drivers/clocksource/vt8500_timer.c b/drivers/clocksource/vt8500_timer.c
+deleted file mode 100644
+index e0f7489cfc8e2..0000000000000
+--- a/drivers/clocksource/vt8500_timer.c
++++ /dev/null
+@@ -1,168 +0,0 @@
+-/*
+- * arch/arm/mach-vt8500/timer.c
+- *
+- * Copyright (C) 2012 Tony Prisk <linux@prisktech.co.nz>
+- * Copyright (C) 2010 Alexey Charkov <alchark@gmail.com>
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License as published by
+- * the Free Software Foundation; either version 2 of the License, or
+- * (at your option) any later version.
+- *
+- * This program is distributed in the hope that it will be useful,
+- * but WITHOUT ANY WARRANTY; without even the implied warranty of
+- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+- * GNU General Public License for more details.
+- *
+- * You should have received a copy of the GNU General Public License
+- * along with this program; if not, write to the Free Software
+- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+- */
+-
+-/*
+- * This file is copied and modified from the original timer.c provided by
+- * Alexey Charkov. Minor changes have been made for Device Tree Support.
+- */
+-
+-#include <linux/io.h>
+-#include <linux/irq.h>
+-#include <linux/interrupt.h>
+-#include <linux/clocksource.h>
+-#include <linux/clockchips.h>
+-#include <linux/delay.h>
+-
+-#include <linux/of.h>
+-#include <linux/of_address.h>
+-#include <linux/of_irq.h>
+-
+-#define VT8500_TIMER_OFFSET 0x0100
+-#define VT8500_TIMER_HZ 3000000
+-#define TIMER_MATCH_VAL 0x0000
+-#define TIMER_COUNT_VAL 0x0010
+-#define TIMER_STATUS_VAL 0x0014
+-#define TIMER_IER_VAL 0x001c /* interrupt enable */
+-#define TIMER_CTRL_VAL 0x0020
+-#define TIMER_AS_VAL 0x0024 /* access status */
+-#define TIMER_COUNT_R_ACTIVE (1 << 5) /* not ready for read */
+-#define TIMER_COUNT_W_ACTIVE (1 << 4) /* not ready for write */
+-#define TIMER_MATCH_W_ACTIVE (1 << 0) /* not ready for write */
+-
+-#define msecs_to_loops(t) (loops_per_jiffy / 1000 * HZ * t)
+-
+-#define MIN_OSCR_DELTA 16
+-
+-static void __iomem *regbase;
+-
+-static u64 vt8500_timer_read(struct clocksource *cs)
+-{
+- int loops = msecs_to_loops(10);
+- writel(3, regbase + TIMER_CTRL_VAL);
+- while ((readl((regbase + TIMER_AS_VAL)) & TIMER_COUNT_R_ACTIVE)
+- && --loops)
+- cpu_relax();
+- return readl(regbase + TIMER_COUNT_VAL);
+-}
+-
+-static struct clocksource clocksource = {
+- .name = "vt8500_timer",
+- .rating = 200,
+- .read = vt8500_timer_read,
+- .mask = CLOCKSOURCE_MASK(32),
+- .flags = CLOCK_SOURCE_IS_CONTINUOUS,
+-};
+-
+-static int vt8500_timer_set_next_event(unsigned long cycles,
+- struct clock_event_device *evt)
+-{
+- int loops = msecs_to_loops(10);
+- u64 alarm = clocksource.read(&clocksource) + cycles;
+- while ((readl(regbase + TIMER_AS_VAL) & TIMER_MATCH_W_ACTIVE)
+- && --loops)
+- cpu_relax();
+- writel((unsigned long)alarm, regbase + TIMER_MATCH_VAL);
+-
+- if ((signed)(alarm - clocksource.read(&clocksource)) <= MIN_OSCR_DELTA)
+- return -ETIME;
+-
+- writel(1, regbase + TIMER_IER_VAL);
+-
+- return 0;
+-}
+-
+-static int vt8500_shutdown(struct clock_event_device *evt)
+-{
+- writel(readl(regbase + TIMER_CTRL_VAL) | 1, regbase + TIMER_CTRL_VAL);
+- writel(0, regbase + TIMER_IER_VAL);
+- return 0;
+-}
+-
+-static struct clock_event_device clockevent = {
+- .name = "vt8500_timer",
+- .features = CLOCK_EVT_FEAT_ONESHOT,
+- .rating = 200,
+- .set_next_event = vt8500_timer_set_next_event,
+- .set_state_shutdown = vt8500_shutdown,
+- .set_state_oneshot = vt8500_shutdown,
+-};
+-
+-static irqreturn_t vt8500_timer_interrupt(int irq, void *dev_id)
+-{
+- struct clock_event_device *evt = dev_id;
+- writel(0xf, regbase + TIMER_STATUS_VAL);
+- evt->event_handler(evt);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static struct irqaction irq = {
+- .name = "vt8500_timer",
+- .flags = IRQF_TIMER | IRQF_IRQPOLL,
+- .handler = vt8500_timer_interrupt,
+- .dev_id = &clockevent,
+-};
+-
+-static int __init vt8500_timer_init(struct device_node *np)
+-{
+- int timer_irq, ret;
+-
+- regbase = of_iomap(np, 0);
+- if (!regbase) {
+- pr_err("%s: Missing iobase description in Device Tree\n",
+- __func__);
+- return -ENXIO;
+- }
+-
+- timer_irq = irq_of_parse_and_map(np, 0);
+- if (!timer_irq) {
+- pr_err("%s: Missing irq description in Device Tree\n",
+- __func__);
+- return -EINVAL;
+- }
+-
+- writel(1, regbase + TIMER_CTRL_VAL);
+- writel(0xf, regbase + TIMER_STATUS_VAL);
+- writel(~0, regbase + TIMER_MATCH_VAL);
+-
+- ret = clocksource_register_hz(&clocksource, VT8500_TIMER_HZ);
+- if (ret) {
+- pr_err("%s: vt8500_timer_init: clocksource_register failed for %s\n",
+- __func__, clocksource.name);
+- return ret;
+- }
+-
+- clockevent.cpumask = cpumask_of(0);
+-
+- ret = setup_irq(timer_irq, &irq);
+- if (ret) {
+- pr_err("%s: setup_irq failed for %s\n", __func__,
+- clockevent.name);
+- return ret;
+- }
+-
+- clockevents_config_and_register(&clockevent, VT8500_TIMER_HZ,
+- MIN_OSCR_DELTA * 2, 0xf0000000);
+-
+- return 0;
+-}
+-
+-TIMER_OF_DECLARE(vt8500, "via,vt8500-timer", vt8500_timer_init);
+diff --git a/drivers/clocksource/zevio-timer.c b/drivers/clocksource/zevio-timer.c
+deleted file mode 100644
+index f74689334f7cb..0000000000000
+--- a/drivers/clocksource/zevio-timer.c
++++ /dev/null
+@@ -1,218 +0,0 @@
+-/*
+- * linux/drivers/clocksource/zevio-timer.c
+- *
+- * Copyright (C) 2013 Daniel Tang <tangrs@tangrs.id.au>
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2, as
+- * published by the Free Software Foundation.
+- *
+- */
+-
+-#include <linux/io.h>
+-#include <linux/irq.h>
+-#include <linux/of.h>
+-#include <linux/of_address.h>
+-#include <linux/of_irq.h>
+-#include <linux/clk.h>
+-#include <linux/clockchips.h>
+-#include <linux/cpumask.h>
+-#include <linux/interrupt.h>
+-#include <linux/slab.h>
+-
+-#define IO_CURRENT_VAL 0x00
+-#define IO_DIVIDER 0x04
+-#define IO_CONTROL 0x08
+-
+-#define IO_TIMER1 0x00
+-#define IO_TIMER2 0x0C
+-
+-#define IO_MATCH_BEGIN 0x18
+-#define IO_MATCH(x) (IO_MATCH_BEGIN + ((x) << 2))
+-
+-#define IO_INTR_STS 0x00
+-#define IO_INTR_ACK 0x00
+-#define IO_INTR_MSK 0x04
+-
+-#define CNTL_STOP_TIMER (1 << 4)
+-#define CNTL_RUN_TIMER (0 << 4)
+-
+-#define CNTL_INC (1 << 3)
+-#define CNTL_DEC (0 << 3)
+-
+-#define CNTL_TOZERO 0
+-#define CNTL_MATCH(x) ((x) + 1)
+-#define CNTL_FOREVER 7
+-
+-/* There are 6 match registers but we only use one. */
+-#define TIMER_MATCH 0
+-
+-#define TIMER_INTR_MSK (1 << (TIMER_MATCH))
+-#define TIMER_INTR_ALL 0x3F
+-
+-struct zevio_timer {
+- void __iomem *base;
+- void __iomem *timer1, *timer2;
+- void __iomem *interrupt_regs;
+-
+- struct clk *clk;
+- struct clock_event_device clkevt;
+- struct irqaction clkevt_irq;
+-
+- char clocksource_name[64];
+- char clockevent_name[64];
+-};
+-
+-static int zevio_timer_set_event(unsigned long delta,
+- struct clock_event_device *dev)
+-{
+- struct zevio_timer *timer = container_of(dev, struct zevio_timer,
+- clkevt);
+-
+- writel(delta, timer->timer1 + IO_CURRENT_VAL);
+- writel(CNTL_RUN_TIMER | CNTL_DEC | CNTL_MATCH(TIMER_MATCH),
+- timer->timer1 + IO_CONTROL);
+-
+- return 0;
+-}
+-
+-static int zevio_timer_shutdown(struct clock_event_device *dev)
+-{
+- struct zevio_timer *timer = container_of(dev, struct zevio_timer,
+- clkevt);
+-
+- /* Disable timer interrupts */
+- writel(0, timer->interrupt_regs + IO_INTR_MSK);
+- writel(TIMER_INTR_ALL, timer->interrupt_regs + IO_INTR_ACK);
+- /* Stop timer */
+- writel(CNTL_STOP_TIMER, timer->timer1 + IO_CONTROL);
+- return 0;
+-}
+-
+-static int zevio_timer_set_oneshot(struct clock_event_device *dev)
+-{
+- struct zevio_timer *timer = container_of(dev, struct zevio_timer,
+- clkevt);
+-
+- /* Enable timer interrupts */
+- writel(TIMER_INTR_MSK, timer->interrupt_regs + IO_INTR_MSK);
+- writel(TIMER_INTR_ALL, timer->interrupt_regs + IO_INTR_ACK);
+- return 0;
+-}
+-
+-static irqreturn_t zevio_timer_interrupt(int irq, void *dev_id)
+-{
+- struct zevio_timer *timer = dev_id;
+- u32 intr;
+-
+- intr = readl(timer->interrupt_regs + IO_INTR_ACK);
+- if (!(intr & TIMER_INTR_MSK))
+- return IRQ_NONE;
+-
+- writel(TIMER_INTR_MSK, timer->interrupt_regs + IO_INTR_ACK);
+- writel(CNTL_STOP_TIMER, timer->timer1 + IO_CONTROL);
+-
+- if (timer->clkevt.event_handler)
+- timer->clkevt.event_handler(&timer->clkevt);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static int __init zevio_timer_add(struct device_node *node)
+-{
+- struct zevio_timer *timer;
+- struct resource res;
+- int irqnr, ret;
+-
+- timer = kzalloc(sizeof(*timer), GFP_KERNEL);
+- if (!timer)
+- return -ENOMEM;
+-
+- timer->base = of_iomap(node, 0);
+- if (!timer->base) {
+- ret = -EINVAL;
+- goto error_free;
+- }
+- timer->timer1 = timer->base + IO_TIMER1;
+- timer->timer2 = timer->base + IO_TIMER2;
+-
+- timer->clk = of_clk_get(node, 0);
+- if (IS_ERR(timer->clk)) {
+- ret = PTR_ERR(timer->clk);
+- pr_err("Timer clock not found! (error %d)\n", ret);
+- goto error_unmap;
+- }
+-
+- timer->interrupt_regs = of_iomap(node, 1);
+- irqnr = irq_of_parse_and_map(node, 0);
+-
+- of_address_to_resource(node, 0, &res);
+- scnprintf(timer->clocksource_name, sizeof(timer->clocksource_name),
+- "%llx.%s_clocksource",
+- (unsigned long long)res.start, node->name);
+-
+- scnprintf(timer->clockevent_name, sizeof(timer->clockevent_name),
+- "%llx.%s_clockevent",
+- (unsigned long long)res.start, node->name);
+-
+- if (timer->interrupt_regs && irqnr) {
+- timer->clkevt.name = timer->clockevent_name;
+- timer->clkevt.set_next_event = zevio_timer_set_event;
+- timer->clkevt.set_state_shutdown = zevio_timer_shutdown;
+- timer->clkevt.set_state_oneshot = zevio_timer_set_oneshot;
+- timer->clkevt.tick_resume = zevio_timer_set_oneshot;
+- timer->clkevt.rating = 200;
+- timer->clkevt.cpumask = cpu_possible_mask;
+- timer->clkevt.features = CLOCK_EVT_FEAT_ONESHOT;
+- timer->clkevt.irq = irqnr;
+-
+- writel(CNTL_STOP_TIMER, timer->timer1 + IO_CONTROL);
+- writel(0, timer->timer1 + IO_DIVIDER);
+-
+- /* Start with timer interrupts disabled */
+- writel(0, timer->interrupt_regs + IO_INTR_MSK);
+- writel(TIMER_INTR_ALL, timer->interrupt_regs + IO_INTR_ACK);
+-
+- /* Interrupt to occur when timer value matches 0 */
+- writel(0, timer->base + IO_MATCH(TIMER_MATCH));
+-
+- timer->clkevt_irq.name = timer->clockevent_name;
+- timer->clkevt_irq.handler = zevio_timer_interrupt;
+- timer->clkevt_irq.dev_id = timer;
+- timer->clkevt_irq.flags = IRQF_TIMER | IRQF_IRQPOLL;
+-
+- setup_irq(irqnr, &timer->clkevt_irq);
+-
+- clockevents_config_and_register(&timer->clkevt,
+- clk_get_rate(timer->clk), 0x0001, 0xffff);
+- pr_info("Added %s as clockevent\n", timer->clockevent_name);
+- }
+-
+- writel(CNTL_STOP_TIMER, timer->timer2 + IO_CONTROL);
+- writel(0, timer->timer2 + IO_CURRENT_VAL);
+- writel(0, timer->timer2 + IO_DIVIDER);
+- writel(CNTL_RUN_TIMER | CNTL_FOREVER | CNTL_INC,
+- timer->timer2 + IO_CONTROL);
+-
+- clocksource_mmio_init(timer->timer2 + IO_CURRENT_VAL,
+- timer->clocksource_name,
+- clk_get_rate(timer->clk),
+- 200, 16,
+- clocksource_mmio_readw_up);
+-
+- pr_info("Added %s as clocksource\n", timer->clocksource_name);
+-
+- return 0;
+-error_unmap:
+- iounmap(timer->base);
+-error_free:
+- kfree(timer);
+- return ret;
+-}
+-
+-static int __init zevio_timer_init(struct device_node *node)
+-{
+- return zevio_timer_add(node);
+-}
+-
+-TIMER_OF_DECLARE(zevio_timer, "lsi,zevio-timer", zevio_timer_init);
+diff --git a/drivers/crypto/nx/Makefile b/drivers/crypto/nx/Makefile
+index 015155da59c29..76139865d7fa1 100644
+--- a/drivers/crypto/nx/Makefile
++++ b/drivers/crypto/nx/Makefile
+@@ -1,7 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-$(CONFIG_CRYPTO_DEV_NX_ENCRYPT) += nx-crypto.o
+ nx-crypto-objs := nx.o \
+- nx_debugfs.o \
+ nx-aes-cbc.o \
+ nx-aes-ecb.o \
+ nx-aes-gcm.o \
+@@ -11,6 +10,7 @@ nx-crypto-objs := nx.o \
+ nx-sha256.o \
+ nx-sha512.o
+
++nx-crypto-$(CONFIG_DEBUG_FS) += nx_debugfs.o
+ obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_PSERIES) += nx-compress-pseries.o nx-compress.o
+ obj-$(CONFIG_CRYPTO_DEV_NX_COMPRESS_POWERNV) += nx-compress-powernv.o nx-compress.o
+ nx-compress-objs := nx-842.o
+diff --git a/drivers/crypto/nx/nx.h b/drivers/crypto/nx/nx.h
+index c3e54af18645c..ebad937a9545c 100644
+--- a/drivers/crypto/nx/nx.h
++++ b/drivers/crypto/nx/nx.h
+@@ -180,8 +180,8 @@ struct nx_sg *nx_walk_and_build(struct nx_sg *, unsigned int,
+ int nx_debugfs_init(struct nx_crypto_driver *);
+ void nx_debugfs_fini(struct nx_crypto_driver *);
+ #else
+-#define NX_DEBUGFS_INIT(drv) (0)
+-#define NX_DEBUGFS_FINI(drv) (0)
++#define NX_DEBUGFS_INIT(drv) do {} while (0)
++#define NX_DEBUGFS_FINI(drv) do {} while (0)
+ #endif
+
+ #define NX_PAGE_NUM(x) ((u64)(x) & 0xfffffffffffff000ULL)
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index 4c70136c7aa3c..84fc0e48bb0e8 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -204,6 +204,14 @@ static const struct __extcon_info {
+ * @attr_name: "name" sysfs entry
+ * @attr_state: "state" sysfs entry
+ * @attrs: the array pointing to attr_name and attr_state for attr_g
++ * @usb_propval: the array of USB connector properties
++ * @chg_propval: the array of charger connector properties
++ * @jack_propval: the array of jack connector properties
++ * @disp_propval: the array of display connector properties
++ * @usb_bits: the bit array of the USB connector property capabilities
++ * @chg_bits: the bit array of the charger connector property capabilities
++ * @jack_bits: the bit array of the jack connector property capabilities
++ * @disp_bits: the bit array of the display connector property capabilities
+ */
+ struct extcon_cable {
+ struct extcon_dev *edev;
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index 45c048751f3bd..9e7abc86de8c2 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -1112,7 +1112,7 @@ static void context_tasklet(unsigned long data)
+ static int context_add_buffer(struct context *ctx)
+ {
+ struct descriptor_buffer *desc;
+- dma_addr_t uninitialized_var(bus_addr);
++ dma_addr_t bus_addr;
+ int offset;
+
+ /*
+@@ -1302,7 +1302,7 @@ static int at_context_queue_packet(struct context *ctx,
+ struct fw_packet *packet)
+ {
+ struct fw_ohci *ohci = ctx->ohci;
+- dma_addr_t d_bus, uninitialized_var(payload_bus);
++ dma_addr_t d_bus, payload_bus;
+ struct driver_data *driver_data;
+ struct descriptor *d, *last;
+ __le32 *header;
+@@ -2458,7 +2458,7 @@ static int ohci_set_config_rom(struct fw_card *card,
+ {
+ struct fw_ohci *ohci;
+ __be32 *next_config_rom;
+- dma_addr_t uninitialized_var(next_config_rom_bus);
++ dma_addr_t next_config_rom_bus;
+
+ ohci = fw_ohci(card);
+
+@@ -2947,10 +2947,10 @@ static struct fw_iso_context *ohci_allocate_iso_context(struct fw_card *card,
+ int type, int channel, size_t header_size)
+ {
+ struct fw_ohci *ohci = fw_ohci(card);
+- struct iso_context *uninitialized_var(ctx);
+- descriptor_callback_t uninitialized_var(callback);
+- u64 *uninitialized_var(channels);
+- u32 *uninitialized_var(mask), uninitialized_var(regs);
++ struct iso_context *ctx;
++ descriptor_callback_t callback;
++ u64 *channels;
++ u32 *mask, regs;
+ int index, ret = -EBUSY;
+
+ spin_lock_irq(&ohci->lock);
+diff --git a/drivers/gpio/gpio-tps68470.c b/drivers/gpio/gpio-tps68470.c
+index aff6e504c6668..9704cff9b4aa3 100644
+--- a/drivers/gpio/gpio-tps68470.c
++++ b/drivers/gpio/gpio-tps68470.c
+@@ -91,13 +91,13 @@ static int tps68470_gpio_output(struct gpio_chip *gc, unsigned int offset,
+ struct tps68470_gpio_data *tps68470_gpio = gpiochip_get_data(gc);
+ struct regmap *regmap = tps68470_gpio->tps68470_regmap;
+
++ /* Set the initial value */
++ tps68470_gpio_set(gc, offset, value);
++
+ /* rest are always outputs */
+ if (offset >= TPS68470_N_REGULAR_GPIO)
+ return 0;
+
+- /* Set the initial value */
+- tps68470_gpio_set(gc, offset, value);
+-
+ return regmap_update_bits(regmap, TPS68470_GPIO_CTL_REG_A(offset),
+ TPS68470_GPIO_MODE_MASK,
+ TPS68470_GPIO_MODE_OUT_CMOS);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index 6a1f5df4bc07e..cdcf9e697c398 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -2989,6 +2989,10 @@ int amdgpu_vm_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ struct amdgpu_fpriv *fpriv = filp->driver_priv;
+ int r;
+
++ /* No valid flags defined yet */
++ if (args->in.flags)
++ return -EINVAL;
++
+ switch (args->in.op) {
+ case AMDGPU_VM_OP_RESERVE_VMID:
+ /* current, we only have requirement to reserve vmid from gfxhub */
+diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
+index c72092319a533..214cd2028cd57 100644
+--- a/drivers/gpu/drm/bridge/sil-sii8620.c
++++ b/drivers/gpu/drm/bridge/sil-sii8620.c
+@@ -988,7 +988,7 @@ static void sii8620_set_auto_zone(struct sii8620 *ctx)
+
+ static void sii8620_stop_video(struct sii8620 *ctx)
+ {
+- u8 uninitialized_var(val);
++ u8 val;
+
+ sii8620_write_seq_static(ctx,
+ REG_TPI_INTR_EN, 0,
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index 281cf9cbb44c4..70b26487de79c 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -91,6 +91,12 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state)
+ if (!state->planes)
+ goto fail;
+
++ /*
++ * Because drm_atomic_state can be committed asynchronously we need our
++ * own reference and cannot rely on the on implied by drm_file in the
++ * ioctl call.
++ */
++ drm_dev_get(dev);
+ state->dev = dev;
+
+ DRM_DEBUG_ATOMIC("Allocated atomic state %p\n", state);
+@@ -250,7 +256,8 @@ EXPORT_SYMBOL(drm_atomic_state_clear);
+ void __drm_atomic_state_free(struct kref *ref)
+ {
+ struct drm_atomic_state *state = container_of(ref, typeof(*state), ref);
+- struct drm_mode_config *config = &state->dev->mode_config;
++ struct drm_device *dev = state->dev;
++ struct drm_mode_config *config = &dev->mode_config;
+
+ drm_atomic_state_clear(state);
+
+@@ -262,6 +269,8 @@ void __drm_atomic_state_free(struct kref *ref)
+ drm_atomic_state_default_release(state);
+ kfree(state);
+ }
++
++ drm_dev_put(dev);
+ }
+ EXPORT_SYMBOL(__drm_atomic_state_free);
+
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 28ea3d260bea1..8b7b107cf2ce3 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -2778,7 +2778,7 @@ static int drm_cvt_modes(struct drm_connector *connector,
+ const u8 empty[3] = { 0, 0, 0 };
+
+ for (i = 0; i < 4; i++) {
+- int uninitialized_var(width), height;
++ int width, height;
+ cvt = &(timing->data.other_data.data.cvt[i]);
+
+ if (!memcmp(cvt->code, empty, 3))
+@@ -2786,6 +2786,8 @@ static int drm_cvt_modes(struct drm_connector *connector,
+
+ height = (cvt->code[0] + ((cvt->code[1] & 0xf0) << 4) + 1) * 2;
+ switch (cvt->code[1] & 0x0c) {
++ /* default - because compiler doesn't see that we've enumerated all cases */
++ default:
+ case 0x00:
+ width = height * 4 / 3;
+ break;
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index fbe9156c9e7c1..ee6801fa36ad1 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -2233,6 +2233,9 @@ static bool drm_target_cloned(struct drm_fb_helper *fb_helper,
+ can_clone = true;
+ dmt_mode = drm_mode_find_dmt(fb_helper->dev, 1024, 768, 60, false);
+
++ if (!dmt_mode)
++ goto fail;
++
+ drm_fb_helper_for_each_connector(fb_helper, i) {
+ if (!enabled[i])
+ continue;
+@@ -2249,11 +2252,13 @@ static bool drm_target_cloned(struct drm_fb_helper *fb_helper,
+ if (!modes[i])
+ can_clone = false;
+ }
++ kfree(dmt_mode);
+
+ if (can_clone) {
+ DRM_DEBUG_KMS("can clone using 1024x768\n");
+ return true;
+ }
++fail:
+ DRM_INFO("kms: can't enable cloning when we probably wanted to.\n");
+ return false;
+ }
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+index 8d776070913da..8610589299fc6 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+@@ -544,9 +544,9 @@ static unsigned long exynos_dsi_pll_find_pms(struct exynos_dsi *dsi,
+ unsigned long best_freq = 0;
+ u32 min_delta = 0xffffffff;
+ u8 p_min, p_max;
+- u8 _p, uninitialized_var(best_p);
+- u16 _m, uninitialized_var(best_m);
+- u8 _s, uninitialized_var(best_s);
++ u8 _p, best_p;
++ u16 _m, best_m;
++ u8 _s, best_s;
+
+ p_min = DIV_ROUND_UP(fin, (12 * MHZ));
+ p_max = fin / (6 * MHZ);
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index ba513018534e3..1bdba8cc25d3e 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -173,7 +173,7 @@ static void a5xx_submit_in_rb(struct msm_gpu *gpu, struct msm_gem_submit *submit
+ * since we've already mapped it once in
+ * submit_reloc()
+ */
+- if (WARN_ON(!ptr))
++ if (WARN_ON(IS_ERR_OR_NULL(ptr)))
+ return;
+
+ for (i = 0; i < dwords; i++) {
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index a424afdcc77a1..35771e0e69fa6 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -405,8 +405,8 @@ static const struct panel_desc ampire_am_480272h3tmqw_t01h = {
+ .num_modes = 1,
+ .bpc = 8,
+ .size = {
+- .width = 105,
+- .height = 67,
++ .width = 99,
++ .height = 58,
+ },
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X24,
+ };
+diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
+index 90c1afe498bea..ce8b14592b69b 100644
+--- a/drivers/gpu/drm/radeon/ci_dpm.c
++++ b/drivers/gpu/drm/radeon/ci_dpm.c
+@@ -5552,6 +5552,7 @@ static int ci_parse_power_table(struct radeon_device *rdev)
+ u8 frev, crev;
+ u8 *power_state_offset;
+ struct ci_ps *ps;
++ int ret;
+
+ if (!atom_parse_data_header(mode_info->atom_context, index, NULL,
+ &frev, &crev, &data_offset))
+@@ -5581,11 +5582,15 @@ static int ci_parse_power_table(struct radeon_device *rdev)
+ non_clock_array_index = power_state->v2.nonClockInfoIndex;
+ non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
+ &non_clock_info_array->nonClockInfo[non_clock_array_index];
+- if (!rdev->pm.power_state[i].clock_info)
+- return -EINVAL;
++ if (!rdev->pm.power_state[i].clock_info) {
++ ret = -EINVAL;
++ goto err_free_ps;
++ }
+ ps = kzalloc(sizeof(struct ci_ps), GFP_KERNEL);
+- if (ps == NULL)
+- return -ENOMEM;
++ if (ps == NULL) {
++ ret = -ENOMEM;
++ goto err_free_ps;
++ }
+ rdev->pm.dpm.ps[i].ps_priv = ps;
+ ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i],
+ non_clock_info,
+@@ -5625,6 +5630,12 @@ static int ci_parse_power_table(struct radeon_device *rdev)
+ }
+
+ return 0;
++
++err_free_ps:
++ for (i = 0; i < rdev->pm.dpm.num_ps; i++)
++ kfree(rdev->pm.dpm.ps[i].ps_priv);
++ kfree(rdev->pm.dpm.ps);
++ return ret;
+ }
+
+ static int ci_get_vbios_boot_values(struct radeon_device *rdev,
+@@ -5713,25 +5724,26 @@ int ci_dpm_init(struct radeon_device *rdev)
+
+ ret = ci_get_vbios_boot_values(rdev, &pi->vbios_boot_state);
+ if (ret) {
+- ci_dpm_fini(rdev);
++ kfree(rdev->pm.dpm.priv);
+ return ret;
+ }
+
+ ret = r600_get_platform_caps(rdev);
+ if (ret) {
+- ci_dpm_fini(rdev);
++ kfree(rdev->pm.dpm.priv);
+ return ret;
+ }
+
+ ret = r600_parse_extended_power_table(rdev);
+ if (ret) {
+- ci_dpm_fini(rdev);
++ kfree(rdev->pm.dpm.priv);
+ return ret;
+ }
+
+ ret = ci_parse_power_table(rdev);
+ if (ret) {
+- ci_dpm_fini(rdev);
++ kfree(rdev->pm.dpm.priv);
++ r600_free_extended_power_table(rdev);
+ return ret;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
+index 3eb7899a4035b..2c637e04dfebc 100644
+--- a/drivers/gpu/drm/radeon/cypress_dpm.c
++++ b/drivers/gpu/drm/radeon/cypress_dpm.c
+@@ -558,8 +558,12 @@ static int cypress_populate_mclk_value(struct radeon_device *rdev,
+ ASIC_INTERNAL_MEMORY_SS, vco_freq)) {
+ u32 reference_clock = rdev->clock.mpll.reference_freq;
+ u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div);
+- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
+- u32 clk_v = ss.percentage *
++ u32 clk_s, clk_v;
++
++ if (!decoded_ref)
++ return -EINVAL;
++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
++ clk_v = ss.percentage *
+ (0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625);
+
+ mpll_ss1 &= ~CLKV_MASK;
+diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
+index a7273c01de34b..2a9d415400f79 100644
+--- a/drivers/gpu/drm/radeon/ni_dpm.c
++++ b/drivers/gpu/drm/radeon/ni_dpm.c
+@@ -2239,8 +2239,12 @@ static int ni_populate_mclk_value(struct radeon_device *rdev,
+ ASIC_INTERNAL_MEMORY_SS, vco_freq)) {
+ u32 reference_clock = rdev->clock.mpll.reference_freq;
+ u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div);
+- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
+- u32 clk_v = ss.percentage *
++ u32 clk_s, clk_v;
++
++ if (!decoded_ref)
++ return -EINVAL;
++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
++ clk_v = ss.percentage *
+ (0x4000 * dividers.whole_fb_div + 0x800 * dividers.frac_fb_div) / (clk_s * 625);
+
+ mpll_ss1 &= ~CLKV_MASK;
+diff --git a/drivers/gpu/drm/radeon/rv740_dpm.c b/drivers/gpu/drm/radeon/rv740_dpm.c
+index afd597ec50858..50290e93c79dc 100644
+--- a/drivers/gpu/drm/radeon/rv740_dpm.c
++++ b/drivers/gpu/drm/radeon/rv740_dpm.c
+@@ -251,8 +251,12 @@ int rv740_populate_mclk_value(struct radeon_device *rdev,
+ ASIC_INTERNAL_MEMORY_SS, vco_freq)) {
+ u32 reference_clock = rdev->clock.mpll.reference_freq;
+ u32 decoded_ref = rv740_get_decoded_reference_divider(dividers.ref_div);
+- u32 clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
+- u32 clk_v = 0x40000 * ss.percentage *
++ u32 clk_s, clk_v;
++
++ if (!decoded_ref)
++ return -EINVAL;
++ clk_s = reference_clock * 5 / (decoded_ref * ss.rate);
++ clk_v = 0x40000 * ss.percentage *
+ (dividers.whole_fb_div + (dividers.frac_fb_div / 8)) / (clk_s * 10000);
+
+ mpll_ss1 &= ~CLKV_MASK;
+diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
+index 779ec8fdfae08..56dd2d6ba9e49 100644
+--- a/drivers/hwmon/nct7802.c
++++ b/drivers/hwmon/nct7802.c
+@@ -698,7 +698,7 @@ static umode_t nct7802_temp_is_visible(struct kobject *kobj,
+ if (index >= 38 && index < 46 && !(reg & 0x01)) /* PECI 0 */
+ return 0;
+
+- if (index >= 0x46 && (!(reg & 0x02))) /* PECI 1 */
++ if (index >= 46 && !(reg & 0x02)) /* PECI 1 */
+ return 0;
+
+ return attr->mode;
+diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
+index 61ab462fd94cf..fe7642b916cfc 100644
+--- a/drivers/i2c/busses/i2c-rk3x.c
++++ b/drivers/i2c/busses/i2c-rk3x.c
+@@ -421,7 +421,7 @@ static void rk3x_i2c_handle_read(struct rk3x_i2c *i2c, unsigned int ipd)
+ {
+ unsigned int i;
+ unsigned int len = i2c->msg->len - i2c->processed;
+- u32 uninitialized_var(val);
++ u32 val;
+ u8 byte;
+
+ /* we only care for MBRF here. */
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 03ce9b7d6456a..c1f85114ab812 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -362,6 +362,9 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ struct xiic_i2c *i2c = dev_id;
+ u32 pend, isr, ier;
+ u32 clr = 0;
++ int xfer_more = 0;
++ int wakeup_req = 0;
++ int wakeup_code = 0;
+
+ /* Get the interrupt Status from the IPIF. There is no clearing of
+ * interrupts in the IPIF. Interrupts must be cleared at the source.
+@@ -398,10 +401,16 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ */
+ xiic_reinit(i2c);
+
+- if (i2c->rx_msg)
+- xiic_wakeup(i2c, STATE_ERROR);
+- if (i2c->tx_msg)
+- xiic_wakeup(i2c, STATE_ERROR);
++ if (i2c->rx_msg) {
++ wakeup_req = 1;
++ wakeup_code = STATE_ERROR;
++ }
++ if (i2c->tx_msg) {
++ wakeup_req = 1;
++ wakeup_code = STATE_ERROR;
++ }
++ /* don't try to handle other events */
++ goto out;
+ }
+ if (pend & XIIC_INTR_RX_FULL_MASK) {
+ /* Receive register/FIFO is full */
+@@ -435,8 +444,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ i2c->tx_msg++;
+ dev_dbg(i2c->adap.dev.parent,
+ "%s will start next...\n", __func__);
+-
+- __xiic_start_xfer(i2c);
++ xfer_more = 1;
+ }
+ }
+ }
+@@ -450,11 +458,13 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ if (!i2c->tx_msg)
+ goto out;
+
+- if ((i2c->nmsgs == 1) && !i2c->rx_msg &&
+- xiic_tx_space(i2c) == 0)
+- xiic_wakeup(i2c, STATE_DONE);
++ wakeup_req = 1;
++
++ if (i2c->nmsgs == 1 && !i2c->rx_msg &&
++ xiic_tx_space(i2c) == 0)
++ wakeup_code = STATE_DONE;
+ else
+- xiic_wakeup(i2c, STATE_ERROR);
++ wakeup_code = STATE_ERROR;
+ }
+ if (pend & (XIIC_INTR_TX_EMPTY_MASK | XIIC_INTR_TX_HALF_MASK)) {
+ /* Transmit register/FIFO is empty or ½ empty */
+@@ -478,7 +488,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
+ if (i2c->nmsgs > 1) {
+ i2c->nmsgs--;
+ i2c->tx_msg++;
+- __xiic_start_xfer(i2c);
++ xfer_more = 1;
+ } else {
+ xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK);
+
+@@ -496,6 +506,13 @@ out:
+ dev_dbg(i2c->adap.dev.parent, "%s clr: 0x%x\n", __func__, clr);
+
+ xiic_setreg32(i2c, XIIC_IISR_OFFSET, clr);
++ if (xfer_more)
++ __xiic_start_xfer(i2c);
++ if (wakeup_req)
++ xiic_wakeup(i2c, wakeup_code);
++
++ WARN_ON(xfer_more && wakeup_req);
++
+ mutex_unlock(&i2c->lock);
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/ide/ide-acpi.c b/drivers/ide/ide-acpi.c
+index 7d4e5c08f133e..05e18d6581416 100644
+--- a/drivers/ide/ide-acpi.c
++++ b/drivers/ide/ide-acpi.c
+@@ -180,7 +180,7 @@ err:
+ static acpi_handle ide_acpi_hwif_get_handle(ide_hwif_t *hwif)
+ {
+ struct device *dev = hwif->gendev.parent;
+- acpi_handle uninitialized_var(dev_handle);
++ acpi_handle dev_handle;
+ u64 pcidevfn;
+ acpi_handle chan_handle;
+ int err;
+diff --git a/drivers/ide/ide-atapi.c b/drivers/ide/ide-atapi.c
+index 4224c4dd89635..9a4c094c897c3 100644
+--- a/drivers/ide/ide-atapi.c
++++ b/drivers/ide/ide-atapi.c
+@@ -591,7 +591,7 @@ static int ide_delayed_transfer_pc(ide_drive_t *drive)
+
+ static ide_startstop_t ide_transfer_pc(ide_drive_t *drive)
+ {
+- struct ide_atapi_pc *uninitialized_var(pc);
++ struct ide_atapi_pc *pc;
+ ide_hwif_t *hwif = drive->hwif;
+ struct request *rq = hwif->rq;
+ ide_expiry_t *expiry;
+diff --git a/drivers/ide/ide-io-std.c b/drivers/ide/ide-io-std.c
+index 19763977568c5..508f98ca3fe87 100644
+--- a/drivers/ide/ide-io-std.c
++++ b/drivers/ide/ide-io-std.c
+@@ -172,7 +172,7 @@ void ide_input_data(ide_drive_t *drive, struct ide_cmd *cmd, void *buf,
+ u8 mmio = (hwif->host_flags & IDE_HFLAG_MMIO) ? 1 : 0;
+
+ if (io_32bit) {
+- unsigned long uninitialized_var(flags);
++ unsigned long flags;
+
+ if ((io_32bit & 2) && !mmio) {
+ local_irq_save(flags);
+@@ -216,7 +216,7 @@ void ide_output_data(ide_drive_t *drive, struct ide_cmd *cmd, void *buf,
+ u8 mmio = (hwif->host_flags & IDE_HFLAG_MMIO) ? 1 : 0;
+
+ if (io_32bit) {
+- unsigned long uninitialized_var(flags);
++ unsigned long flags;
+
+ if ((io_32bit & 2) && !mmio) {
+ local_irq_save(flags);
+diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
+index 4381760846109..a01cc01244422 100644
+--- a/drivers/ide/ide-io.c
++++ b/drivers/ide/ide-io.c
+@@ -605,12 +605,12 @@ static int drive_is_ready(ide_drive_t *drive)
+ void ide_timer_expiry (struct timer_list *t)
+ {
+ ide_hwif_t *hwif = from_timer(hwif, t, timer);
+- ide_drive_t *uninitialized_var(drive);
++ ide_drive_t *drive;
+ ide_handler_t *handler;
+ unsigned long flags;
+ int wait = -1;
+ int plug_device = 0;
+- struct request *uninitialized_var(rq_in_flight);
++ struct request *rq_in_flight;
+
+ spin_lock_irqsave(&hwif->lock, flags);
+
+@@ -763,13 +763,13 @@ irqreturn_t ide_intr (int irq, void *dev_id)
+ {
+ ide_hwif_t *hwif = (ide_hwif_t *)dev_id;
+ struct ide_host *host = hwif->host;
+- ide_drive_t *uninitialized_var(drive);
++ ide_drive_t *drive;
+ ide_handler_t *handler;
+ unsigned long flags;
+ ide_startstop_t startstop;
+ irqreturn_t irq_ret = IRQ_NONE;
+ int plug_device = 0;
+- struct request *uninitialized_var(rq_in_flight);
++ struct request *rq_in_flight;
+
+ if (host->host_flags & IDE_HFLAG_SERIALIZE) {
+ if (hwif != host->cur_port)
+diff --git a/drivers/ide/ide-sysfs.c b/drivers/ide/ide-sysfs.c
+index b9dfeb2e8bd66..c08a8a0916e22 100644
+--- a/drivers/ide/ide-sysfs.c
++++ b/drivers/ide/ide-sysfs.c
+@@ -131,7 +131,7 @@ static struct device_attribute *ide_port_attrs[] = {
+
+ int ide_sysfs_register_port(ide_hwif_t *hwif)
+ {
+- int i, uninitialized_var(rc);
++ int i, rc;
+
+ for (i = 0; ide_port_attrs[i]; i++) {
+ rc = device_create_file(hwif->portdev, ide_port_attrs[i]);
+diff --git a/drivers/ide/umc8672.c b/drivers/ide/umc8672.c
+index 3aa0fea0f3d9c..1414caa97b401 100644
+--- a/drivers/ide/umc8672.c
++++ b/drivers/ide/umc8672.c
+@@ -107,7 +107,7 @@ static void umc_set_speeds(u8 speeds[])
+ static void umc_set_pio_mode(ide_hwif_t *hwif, ide_drive_t *drive)
+ {
+ ide_hwif_t *mate = hwif->mate;
+- unsigned long uninitialized_var(flags);
++ unsigned long flags;
+ const u8 pio = drive->pio_mode - XFER_PIO_0;
+
+ printk("%s: setting umc8672 to PIO mode%d (speed %d)\n",
+diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
+index 6e0ef9bb2497f..c448769357501 100644
+--- a/drivers/iio/adc/meson_saradc.c
++++ b/drivers/iio/adc/meson_saradc.c
+@@ -75,7 +75,7 @@
+ #define MESON_SAR_ADC_REG3_PANEL_DETECT_COUNT_MASK GENMASK(20, 18)
+ #define MESON_SAR_ADC_REG3_PANEL_DETECT_FILTER_TB_MASK GENMASK(17, 16)
+ #define MESON_SAR_ADC_REG3_ADC_CLK_DIV_SHIFT 10
+- #define MESON_SAR_ADC_REG3_ADC_CLK_DIV_WIDTH 5
++ #define MESON_SAR_ADC_REG3_ADC_CLK_DIV_WIDTH 6
+ #define MESON_SAR_ADC_REG3_BLOCK_DLY_SEL_MASK GENMASK(9, 8)
+ #define MESON_SAR_ADC_REG3_BLOCK_DLY_MASK GENMASK(7, 0)
+
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index d28e6f6ad497c..3b287a51cd626 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -1726,7 +1726,7 @@ ssize_t ib_uverbs_open_qp(struct ib_uverbs_file *file,
+ struct ib_udata udata;
+ struct ib_uqp_object *obj;
+ struct ib_xrcd *xrcd;
+- struct ib_uobject *uninitialized_var(xrcd_uobj);
++ struct ib_uobject *xrcd_uobj;
+ struct ib_qp *qp;
+ struct ib_qp_open_attr attr;
+ int ret;
+@@ -3694,7 +3694,7 @@ static int __uverbs_create_xsrq(struct ib_uverbs_file *file,
+ struct ib_usrq_object *obj;
+ struct ib_pd *pd;
+ struct ib_srq *srq;
+- struct ib_uobject *uninitialized_var(xrcd_uobj);
++ struct ib_uobject *xrcd_uobj;
+ struct ib_srq_init_attr attr;
+ int ret;
+ struct ib_device *ib_dev;
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 6c1a093b164e0..a252b13958b3b 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -3195,7 +3195,7 @@ static int get_lladdr(struct net_device *dev, struct in6_addr *addr,
+
+ static int pick_local_ip6addrs(struct c4iw_dev *dev, struct iw_cm_id *cm_id)
+ {
+- struct in6_addr uninitialized_var(addr);
++ struct in6_addr addr;
+ struct sockaddr_in6 *la6 = (struct sockaddr_in6 *)&cm_id->m_local_addr;
+ struct sockaddr_in6 *ra6 = (struct sockaddr_in6 *)&cm_id->m_remote_addr;
+
+diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
+index 43c611aa068c7..8f30d477ab769 100644
+--- a/drivers/infiniband/hw/cxgb4/cq.c
++++ b/drivers/infiniband/hw/cxgb4/cq.c
+@@ -755,7 +755,7 @@ skip_cqe:
+ static int __c4iw_poll_cq_one(struct c4iw_cq *chp, struct c4iw_qp *qhp,
+ struct ib_wc *wc, struct c4iw_srq *srq)
+ {
+- struct t4_cqe uninitialized_var(cqe);
++ struct t4_cqe cqe;
+ struct t4_wq *wq = qhp ? &qhp->wq : NULL;
+ u32 credit = 0;
+ u8 cqe_flushed;
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index 33ff9eca28f69..245f9505a9aca 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -3202,8 +3202,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ {
+ int rval = 0;
+
+- tx->num_desc++;
+- if ((unlikely(tx->num_desc == tx->desc_limit))) {
++ if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) {
+ rval = _extend_sdma_tx_descs(dd, tx);
+ if (rval) {
+ __sdma_txclean(dd, tx);
+@@ -3216,6 +3215,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ SDMA_MAP_NONE,
+ dd->sdma_pad_phys,
+ sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1)));
++ tx->num_desc++;
+ _sdma_close_tx(dd, tx);
+ return rval;
+ }
+diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h
+index 46c775f255d14..a3dd2f3d56cca 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.h
++++ b/drivers/infiniband/hw/hfi1/sdma.h
+@@ -680,14 +680,13 @@ static inline void sdma_txclean(struct hfi1_devdata *dd, struct sdma_txreq *tx)
+ static inline void _sdma_close_tx(struct hfi1_devdata *dd,
+ struct sdma_txreq *tx)
+ {
+- tx->descp[tx->num_desc].qw[0] |=
+- SDMA_DESC0_LAST_DESC_FLAG;
+- tx->descp[tx->num_desc].qw[1] |=
+- dd->default_desc1;
++ u16 last_desc = tx->num_desc - 1;
++
++ tx->descp[last_desc].qw[0] |= SDMA_DESC0_LAST_DESC_FLAG;
++ tx->descp[last_desc].qw[1] |= dd->default_desc1;
+ if (tx->flags & SDMA_TXREQ_F_URGENT)
+- tx->descp[tx->num_desc].qw[1] |=
+- (SDMA_DESC1_HEAD_TO_HOST_FLAG |
+- SDMA_DESC1_INT_REQ_FLAG);
++ tx->descp[last_desc].qw[1] |= (SDMA_DESC1_HEAD_TO_HOST_FLAG |
++ SDMA_DESC1_INT_REQ_FLAG);
+ }
+
+ static inline int _sdma_txadd_daddr(
+@@ -704,6 +703,7 @@ static inline int _sdma_txadd_daddr(
+ type,
+ addr, len);
+ WARN_ON(len > tx->tlen);
++ tx->num_desc++;
+ tx->tlen -= len;
+ /* special cases for last */
+ if (!tx->tlen) {
+@@ -715,7 +715,6 @@ static inline int _sdma_txadd_daddr(
+ _sdma_close_tx(dd, tx);
+ }
+ }
+- tx->num_desc++;
+ return rval;
+ }
+
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index 87358b8c45589..b48596e174d65 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -554,15 +554,15 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
+ return (-EOPNOTSUPP);
+ }
+
+- if (ucmd->rx_hash_fields_mask & ~(MLX4_IB_RX_HASH_SRC_IPV4 |
+- MLX4_IB_RX_HASH_DST_IPV4 |
+- MLX4_IB_RX_HASH_SRC_IPV6 |
+- MLX4_IB_RX_HASH_DST_IPV6 |
+- MLX4_IB_RX_HASH_SRC_PORT_TCP |
+- MLX4_IB_RX_HASH_DST_PORT_TCP |
+- MLX4_IB_RX_HASH_SRC_PORT_UDP |
+- MLX4_IB_RX_HASH_DST_PORT_UDP |
+- MLX4_IB_RX_HASH_INNER)) {
++ if (ucmd->rx_hash_fields_mask & ~(u64)(MLX4_IB_RX_HASH_SRC_IPV4 |
++ MLX4_IB_RX_HASH_DST_IPV4 |
++ MLX4_IB_RX_HASH_SRC_IPV6 |
++ MLX4_IB_RX_HASH_DST_IPV6 |
++ MLX4_IB_RX_HASH_SRC_PORT_TCP |
++ MLX4_IB_RX_HASH_DST_PORT_TCP |
++ MLX4_IB_RX_HASH_SRC_PORT_UDP |
++ MLX4_IB_RX_HASH_DST_PORT_UDP |
++ MLX4_IB_RX_HASH_INNER)) {
+ pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n",
+ ucmd->rx_hash_fields_mask);
+ return (-EOPNOTSUPP);
+@@ -3463,11 +3463,11 @@ static int _mlx4_ib_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ int nreq;
+ int err = 0;
+ unsigned ind;
+- int uninitialized_var(size);
+- unsigned uninitialized_var(seglen);
++ int size;
++ unsigned seglen;
+ __be32 dummy;
+ __be32 *lso_wqe;
+- __be32 uninitialized_var(lso_hdr_sz);
++ __be32 lso_hdr_sz;
+ __be32 blh;
+ int i;
+ struct mlx4_ib_dev *mdev = to_mdev(ibqp->device);
+diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
+index 872985e4eebec..c5d3fe256182f 100644
+--- a/drivers/infiniband/hw/mlx5/cq.c
++++ b/drivers/infiniband/hw/mlx5/cq.c
+@@ -1333,7 +1333,7 @@ int mlx5_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata)
+ __be64 *pas;
+ int page_shift;
+ int inlen;
+- int uninitialized_var(cqe_size);
++ int cqe_size;
+ unsigned long flags;
+
+ if (!MLX5_CAP_GEN(dev->mdev, cq_resize)) {
+diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
+index 3d37f2373d63a..a336f69c2653a 100644
+--- a/drivers/infiniband/hw/mthca/mthca_qp.c
++++ b/drivers/infiniband/hw/mthca/mthca_qp.c
+@@ -1630,8 +1630,8 @@ int mthca_tavor_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ * without initializing f0 and size0, and they are in fact
+ * never used uninitialized.
+ */
+- int uninitialized_var(size0);
+- u32 uninitialized_var(f0);
++ int size0;
++ u32 f0;
+ int ind;
+ u8 op0 = 0;
+
+@@ -1831,7 +1831,7 @@ int mthca_tavor_post_receive(struct ib_qp *ibqp, const struct ib_recv_wr *wr,
+ * without initializing size0, and it is in fact never used
+ * uninitialized.
+ */
+- int uninitialized_var(size0);
++ int size0;
+ int ind;
+ void *wqe;
+ void *prev_wqe;
+@@ -1945,8 +1945,8 @@ int mthca_arbel_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ * without initializing f0 and size0, and they are in fact
+ * never used uninitialized.
+ */
+- int uninitialized_var(size0);
+- u32 uninitialized_var(f0);
++ int size0;
++ u32 f0;
+ int ind;
+ u8 op0 = 0;
+
+diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
+index 3695dd7dbb9b4..ec0c91ec52277 100644
+--- a/drivers/input/misc/adxl34x.c
++++ b/drivers/input/misc/adxl34x.c
+@@ -811,8 +811,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
+ AC_WRITE(ac, POWER_CTL, 0);
+
+ err = request_threaded_irq(ac->irq, NULL, adxl34x_irq,
+- IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+- dev_name(dev), ac);
++ IRQF_ONESHOT, dev_name(dev), ac);
+ if (err) {
+ dev_err(dev, "irq %d busy?\n", ac->irq);
+ goto err_free_mem;
+diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c
+index 17eb84ab4c0b7..fe3fbde989be2 100644
+--- a/drivers/input/misc/drv260x.c
++++ b/drivers/input/misc/drv260x.c
+@@ -443,6 +443,7 @@ static int drv260x_init(struct drv260x_data *haptics)
+ }
+
+ do {
++ usleep_range(15000, 15500);
+ error = regmap_read(haptics->regmap, DRV260X_GO, &cal_buf);
+ if (error) {
+ dev_err(&haptics->client->dev,
+diff --git a/drivers/input/serio/serio_raw.c b/drivers/input/serio/serio_raw.c
+index 17b7fbecd9fe7..d25059672323d 100644
+--- a/drivers/input/serio/serio_raw.c
++++ b/drivers/input/serio/serio_raw.c
+@@ -162,7 +162,7 @@ static ssize_t serio_raw_read(struct file *file, char __user *buffer,
+ {
+ struct serio_raw_client *client = file->private_data;
+ struct serio_raw *serio_raw = client->serio_raw;
+- char uninitialized_var(c);
++ char c;
+ ssize_t read = 0;
+ int error;
+
+diff --git a/drivers/irqchip/irq-bcm6345-l1.c b/drivers/irqchip/irq-bcm6345-l1.c
+index 31ea6332ecb83..60dc64b4ac6d2 100644
+--- a/drivers/irqchip/irq-bcm6345-l1.c
++++ b/drivers/irqchip/irq-bcm6345-l1.c
+@@ -85,6 +85,7 @@ struct bcm6345_l1_chip {
+ };
+
+ struct bcm6345_l1_cpu {
++ struct bcm6345_l1_chip *intc;
+ void __iomem *map_base;
+ unsigned int parent_irq;
+ u32 enable_cache[];
+@@ -118,17 +119,11 @@ static inline unsigned int cpu_for_irq(struct bcm6345_l1_chip *intc,
+
+ static void bcm6345_l1_irq_handle(struct irq_desc *desc)
+ {
+- struct bcm6345_l1_chip *intc = irq_desc_get_handler_data(desc);
+- struct bcm6345_l1_cpu *cpu;
++ struct bcm6345_l1_cpu *cpu = irq_desc_get_handler_data(desc);
++ struct bcm6345_l1_chip *intc = cpu->intc;
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+ unsigned int idx;
+
+-#ifdef CONFIG_SMP
+- cpu = intc->cpus[cpu_logical_map(smp_processor_id())];
+-#else
+- cpu = intc->cpus[0];
+-#endif
+-
+ chained_irq_enter(chip, desc);
+
+ for (idx = 0; idx < intc->n_words; idx++) {
+@@ -260,6 +255,7 @@ static int __init bcm6345_l1_init_one(struct device_node *dn,
+ if (!cpu)
+ return -ENOMEM;
+
++ cpu->intc = intc;
+ cpu->map_base = ioremap(res.start, sz);
+ if (!cpu->map_base)
+ return -ENOMEM;
+@@ -275,7 +271,7 @@ static int __init bcm6345_l1_init_one(struct device_node *dn,
+ return -EINVAL;
+ }
+ irq_set_chained_handler_and_data(cpu->parent_irq,
+- bcm6345_l1_irq_handle, intc);
++ bcm6345_l1_irq_handle, cpu);
+
+ return 0;
+ }
+diff --git a/drivers/irqchip/irq-jcore-aic.c b/drivers/irqchip/irq-jcore-aic.c
+index 033bccb41455c..b9dcc8e78c750 100644
+--- a/drivers/irqchip/irq-jcore-aic.c
++++ b/drivers/irqchip/irq-jcore-aic.c
+@@ -68,6 +68,7 @@ static int __init aic_irq_of_init(struct device_node *node,
+ unsigned min_irq = JCORE_AIC2_MIN_HWIRQ;
+ unsigned dom_sz = JCORE_AIC_MAX_HWIRQ+1;
+ struct irq_domain *domain;
++ int ret;
+
+ pr_info("Initializing J-Core AIC\n");
+
+@@ -100,11 +101,17 @@ static int __init aic_irq_of_init(struct device_node *node,
+ jcore_aic.irq_unmask = noop;
+ jcore_aic.name = "AIC";
+
+- domain = irq_domain_add_linear(node, dom_sz, &jcore_aic_irqdomain_ops,
++ ret = irq_alloc_descs(-1, min_irq, dom_sz - min_irq,
++ of_node_to_nid(node));
++
++ if (ret < 0)
++ return ret;
++
++ domain = irq_domain_add_legacy(node, dom_sz - min_irq, min_irq, min_irq,
++ &jcore_aic_irqdomain_ops,
+ &jcore_aic);
+ if (!domain)
+ return -ENOMEM;
+- irq_create_strict_mappings(domain, min_irq, min_irq, dom_sz - min_irq);
+
+ return 0;
+ }
+diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c
+index 01e9e462512b7..eb1e9771037f2 100644
+--- a/drivers/mailbox/ti-msgmgr.c
++++ b/drivers/mailbox/ti-msgmgr.c
+@@ -385,14 +385,20 @@ static int ti_msgmgr_send_data(struct mbox_chan *chan, void *data)
+ /* Ensure all unused data is 0 */
+ data_trail &= 0xFFFFFFFF >> (8 * (sizeof(u32) - trail_bytes));
+ writel(data_trail, data_reg);
+- data_reg++;
++ data_reg += sizeof(u32);
+ }
++
+ /*
+ * 'data_reg' indicates next register to write. If we did not already
+ * write on tx complete reg(last reg), we must do so for transmit
++ * In addition, we also need to make sure all intermediate data
++ * registers(if any required), are reset to 0 for TISCI backward
++ * compatibility to be maintained.
+ */
+- if (data_reg <= qinst->queue_buff_end)
+- writel(0, qinst->queue_buff_end);
++ while (data_reg <= qinst->queue_buff_end) {
++ writel(0, data_reg);
++ data_reg += sizeof(u32);
++ }
+
+ return 0;
+ }
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index 46794cac167e7..5310e1f4a2826 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -49,7 +49,7 @@
+ *
+ * bch_bucket_alloc() allocates a single bucket from a specific cache.
+ *
+- * bch_bucket_alloc_set() allocates one or more buckets from different caches
++ * bch_bucket_alloc_set() allocates one bucket from different caches
+ * out of a cache set.
+ *
+ * free_some_buckets() drives all the processes described above. It's called
+@@ -488,34 +488,29 @@ void bch_bucket_free(struct cache_set *c, struct bkey *k)
+ }
+
+ int __bch_bucket_alloc_set(struct cache_set *c, unsigned int reserve,
+- struct bkey *k, int n, bool wait)
++ struct bkey *k, bool wait)
+ {
+- int i;
++ struct cache *ca;
++ long b;
+
+ /* No allocation if CACHE_SET_IO_DISABLE bit is set */
+ if (unlikely(test_bit(CACHE_SET_IO_DISABLE, &c->flags)))
+ return -1;
+
+ lockdep_assert_held(&c->bucket_lock);
+- BUG_ON(!n || n > c->caches_loaded || n > 8);
+
+ bkey_init(k);
+
+- /* sort by free space/prio of oldest data in caches */
+-
+- for (i = 0; i < n; i++) {
+- struct cache *ca = c->cache_by_alloc[i];
+- long b = bch_bucket_alloc(ca, reserve, wait);
++ ca = c->cache_by_alloc[0];
++ b = bch_bucket_alloc(ca, reserve, wait);
++ if (b == -1)
++ goto err;
+
+- if (b == -1)
+- goto err;
++ k->ptr[0] = MAKE_PTR(ca->buckets[b].gen,
++ bucket_to_sector(c, b),
++ ca->sb.nr_this_dev);
+
+- k->ptr[i] = MAKE_PTR(ca->buckets[b].gen,
+- bucket_to_sector(c, b),
+- ca->sb.nr_this_dev);
+-
+- SET_KEY_PTRS(k, i + 1);
+- }
++ SET_KEY_PTRS(k, 1);
+
+ return 0;
+ err:
+@@ -525,12 +520,12 @@ err:
+ }
+
+ int bch_bucket_alloc_set(struct cache_set *c, unsigned int reserve,
+- struct bkey *k, int n, bool wait)
++ struct bkey *k, bool wait)
+ {
+ int ret;
+
+ mutex_lock(&c->bucket_lock);
+- ret = __bch_bucket_alloc_set(c, reserve, k, n, wait);
++ ret = __bch_bucket_alloc_set(c, reserve, k, wait);
+ mutex_unlock(&c->bucket_lock);
+ return ret;
+ }
+@@ -638,7 +633,7 @@ bool bch_alloc_sectors(struct cache_set *c,
+
+ spin_unlock(&c->data_bucket_lock);
+
+- if (bch_bucket_alloc_set(c, watermark, &alloc.key, 1, wait))
++ if (bch_bucket_alloc_set(c, watermark, &alloc.key, wait))
+ return false;
+
+ spin_lock(&c->data_bucket_lock);
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index 6a380ed4919a0..e81d783109847 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -952,9 +952,9 @@ void bch_bucket_free(struct cache_set *c, struct bkey *k);
+
+ long bch_bucket_alloc(struct cache *ca, unsigned int reserve, bool wait);
+ int __bch_bucket_alloc_set(struct cache_set *c, unsigned int reserve,
+- struct bkey *k, int n, bool wait);
++ struct bkey *k, bool wait);
+ int bch_bucket_alloc_set(struct cache_set *c, unsigned int reserve,
+- struct bkey *k, int n, bool wait);
++ struct bkey *k, bool wait);
+ bool bch_alloc_sectors(struct cache_set *c, struct bkey *k,
+ unsigned int sectors, unsigned int write_point,
+ unsigned int write_prio, bool wait);
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index e388e7bb7b5db..71d670934a07e 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -1125,11 +1125,13 @@ struct btree *__bch_btree_node_alloc(struct cache_set *c, struct btree_op *op,
+ struct btree *parent)
+ {
+ BKEY_PADDED(key) k;
+- struct btree *b = ERR_PTR(-EAGAIN);
++ struct btree *b;
+
+ mutex_lock(&c->bucket_lock);
+ retry:
+- if (__bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, 1, wait))
++ /* return ERR_PTR(-EAGAIN) when it fails */
++ b = ERR_PTR(-EAGAIN);
++ if (__bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, wait))
+ goto err;
+
+ bkey_put(c, &k.key);
+@@ -1174,7 +1176,7 @@ static struct btree *btree_node_alloc_replacement(struct btree *b,
+ {
+ struct btree *n = bch_btree_node_alloc(b->c, op, b->level, b->parent);
+
+- if (!IS_ERR_OR_NULL(n)) {
++ if (!IS_ERR(n)) {
+ mutex_lock(&n->write_lock);
+ bch_btree_sort_into(&b->keys, &n->keys, &b->c->sort);
+ bkey_copy_key(&n->key, &b->key);
+@@ -1377,7 +1379,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
+ memset(new_nodes, 0, sizeof(new_nodes));
+ closure_init_stack(&cl);
+
+- while (nodes < GC_MERGE_NODES && !IS_ERR_OR_NULL(r[nodes].b))
++ while (nodes < GC_MERGE_NODES && !IS_ERR(r[nodes].b))
+ keys += r[nodes++].keys;
+
+ blocks = btree_default_blocks(b->c) * 2 / 3;
+@@ -1389,7 +1391,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
+
+ for (i = 0; i < nodes; i++) {
+ new_nodes[i] = btree_node_alloc_replacement(r[i].b, NULL);
+- if (IS_ERR_OR_NULL(new_nodes[i]))
++ if (IS_ERR(new_nodes[i]))
+ goto out_nocoalesce;
+ }
+
+@@ -1524,7 +1526,7 @@ out_nocoalesce:
+ atomic_dec(&b->c->prio_blocked);
+
+ for (i = 0; i < nodes; i++)
+- if (!IS_ERR_OR_NULL(new_nodes[i])) {
++ if (!IS_ERR(new_nodes[i])) {
+ btree_node_free(new_nodes[i]);
+ rw_unlock(true, new_nodes[i]);
+ }
+@@ -1706,7 +1708,7 @@ static int bch_btree_gc_root(struct btree *b, struct btree_op *op,
+ if (should_rewrite) {
+ n = btree_node_alloc_replacement(b, NULL);
+
+- if (!IS_ERR_OR_NULL(n)) {
++ if (!IS_ERR(n)) {
+ bch_btree_node_write_sync(n);
+
+ bch_btree_set_root(n);
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 2df75db52e917..4b076f7f184be 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -423,7 +423,7 @@ static int __uuid_write(struct cache_set *c)
+ closure_init_stack(&cl);
+ lockdep_assert_held(&bch_register_lock);
+
+- if (bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, 1, true))
++ if (bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, true))
+ return 1;
+
+ SET_KEY_SIZE(&k.key, c->sb.bucket_size);
+@@ -1576,7 +1576,7 @@ static void cache_set_flush(struct closure *cl)
+ if (!IS_ERR_OR_NULL(c->gc_thread))
+ kthread_stop(c->gc_thread);
+
+- if (!IS_ERR_OR_NULL(c->root))
++ if (!IS_ERR(c->root))
+ list_add(&c->root->list, &c->btree_cache);
+
+ /* Should skip this if we're unregistering because of an error */
+@@ -1921,7 +1921,7 @@ static int run_cache_set(struct cache_set *c)
+
+ err = "cannot allocate new btree root";
+ c->root = __bch_btree_node_alloc(c, NULL, 0, true, NULL);
+- if (IS_ERR_OR_NULL(c->root))
++ if (IS_ERR(c->root))
+ goto err;
+
+ mutex_lock(&c->root->write_lock);
+diff --git a/drivers/md/dm-cache-policy-smq.c b/drivers/md/dm-cache-policy-smq.c
+index 1b5b9ad9e492f..6030193b216eb 100644
+--- a/drivers/md/dm-cache-policy-smq.c
++++ b/drivers/md/dm-cache-policy-smq.c
+@@ -854,7 +854,13 @@ struct smq_policy {
+
+ struct background_tracker *bg_work;
+
+- bool migrations_allowed;
++ bool migrations_allowed:1;
++
++ /*
++ * If this is set the policy will try and clean the whole cache
++ * even if the device is not idle.
++ */
++ bool cleaner:1;
+ };
+
+ /*----------------------------------------------------------------*/
+@@ -1133,7 +1139,7 @@ static bool clean_target_met(struct smq_policy *mq, bool idle)
+ * Cache entries may not be populated. So we cannot rely on the
+ * size of the clean queue.
+ */
+- if (idle) {
++ if (idle || mq->cleaner) {
+ /*
+ * We'd like to clean everything.
+ */
+@@ -1716,11 +1722,9 @@ static void calc_hotspot_params(sector_t origin_size,
+ *hotspot_block_size /= 2u;
+ }
+
+-static struct dm_cache_policy *__smq_create(dm_cblock_t cache_size,
+- sector_t origin_size,
+- sector_t cache_block_size,
+- bool mimic_mq,
+- bool migrations_allowed)
++static struct dm_cache_policy *
++__smq_create(dm_cblock_t cache_size, sector_t origin_size, sector_t cache_block_size,
++ bool mimic_mq, bool migrations_allowed, bool cleaner)
+ {
+ unsigned i;
+ unsigned nr_sentinels_per_queue = 2u * NR_CACHE_LEVELS;
+@@ -1807,6 +1811,7 @@ static struct dm_cache_policy *__smq_create(dm_cblock_t cache_size,
+ goto bad_btracker;
+
+ mq->migrations_allowed = migrations_allowed;
++ mq->cleaner = cleaner;
+
+ return &mq->policy;
+
+@@ -1830,21 +1835,24 @@ static struct dm_cache_policy *smq_create(dm_cblock_t cache_size,
+ sector_t origin_size,
+ sector_t cache_block_size)
+ {
+- return __smq_create(cache_size, origin_size, cache_block_size, false, true);
++ return __smq_create(cache_size, origin_size, cache_block_size,
++ false, true, false);
+ }
+
+ static struct dm_cache_policy *mq_create(dm_cblock_t cache_size,
+ sector_t origin_size,
+ sector_t cache_block_size)
+ {
+- return __smq_create(cache_size, origin_size, cache_block_size, true, true);
++ return __smq_create(cache_size, origin_size, cache_block_size,
++ true, true, false);
+ }
+
+ static struct dm_cache_policy *cleaner_create(dm_cblock_t cache_size,
+ sector_t origin_size,
+ sector_t cache_block_size)
+ {
+- return __smq_create(cache_size, origin_size, cache_block_size, false, false);
++ return __smq_create(cache_size, origin_size, cache_block_size,
++ false, false, true);
+ }
+
+ /*----------------------------------------------------------------*/
+diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
+index 81ffc59d05c90..4312007d2d34b 100644
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -306,7 +306,7 @@ static void do_region(int op, int op_flags, unsigned region,
+ struct request_queue *q = bdev_get_queue(where->bdev);
+ unsigned short logical_block_size = queue_logical_block_size(q);
+ sector_t num_sectors;
+- unsigned int uninitialized_var(special_cmd_max_sectors);
++ unsigned int special_cmd_max_sectors;
+
+ /*
+ * Reject unsupported discard and write same requests.
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index e1603c17e346f..88e89796ccbff 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1822,7 +1822,7 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us
+ int ioctl_flags;
+ int param_flags;
+ unsigned int cmd;
+- struct dm_ioctl *uninitialized_var(param);
++ struct dm_ioctl *param;
+ ioctl_fn fn = NULL;
+ size_t input_param_size;
+ struct dm_ioctl param_kernel;
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 5c45100f6d53e..72aa5097b68ff 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -3289,15 +3289,19 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ /* Try to adjust the raid4/5/6 stripe cache size to the stripe size */
+ if (rs_is_raid456(rs)) {
+ r = rs_set_raid456_stripe_cache(rs);
+- if (r)
++ if (r) {
++ mddev_unlock(&rs->md);
+ goto bad_stripe_cache;
++ }
+ }
+
+ /* Now do an early reshape check */
+ if (test_bit(RT_FLAG_RESHAPE_RS, &rs->runtime_flags)) {
+ r = rs_check_reshape(rs);
+- if (r)
++ if (r) {
++ mddev_unlock(&rs->md);
+ goto bad_check_reshape;
++ }
+
+ /* Restore new, ctr requested layout to perform check */
+ rs_config_restore(rs, &rs_layout);
+@@ -3306,6 +3310,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ r = rs->md.pers->check_reshape(&rs->md);
+ if (r) {
+ ti->error = "Reshape check failed";
++ mddev_unlock(&rs->md);
+ goto bad_check_reshape;
+ }
+ }
+diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
+index 963d3774c93e2..247089c2be256 100644
+--- a/drivers/md/dm-snap-persistent.c
++++ b/drivers/md/dm-snap-persistent.c
+@@ -613,7 +613,7 @@ static int persistent_read_metadata(struct dm_exception_store *store,
+ chunk_t old, chunk_t new),
+ void *callback_context)
+ {
+- int r, uninitialized_var(new_snapshot);
++ int r, new_snapshot;
+ struct pstore *ps = get_info(store);
+
+ /*
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 71d3fdbce50a3..3faaf21be5b65 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -671,7 +671,7 @@ static int validate_hardware_logical_block_alignment(struct dm_table *table,
+ */
+ unsigned short remaining = 0;
+
+- struct dm_target *uninitialized_var(ti);
++ struct dm_target *ti;
+ struct queue_limits ti_limits;
+ unsigned i;
+
+diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
+index 1c4c462787198..7ca81e917aef4 100644
+--- a/drivers/md/md-bitmap.c
++++ b/drivers/md/md-bitmap.c
+@@ -53,14 +53,7 @@ __acquires(bitmap->lock)
+ {
+ unsigned char *mappage;
+
+- if (page >= bitmap->pages) {
+- /* This can happen if bitmap_start_sync goes beyond
+- * End-of-device while looking for a whole page.
+- * It is harmless.
+- */
+- return -EINVAL;
+- }
+-
++ WARN_ON_ONCE(page >= bitmap->pages);
+ if (bitmap->bp[page].hijacked) /* it's hijacked, don't try to alloc */
+ return 0;
+
+@@ -1368,6 +1361,14 @@ __acquires(bitmap->lock)
+ sector_t csize;
+ int err;
+
++ if (page >= bitmap->pages) {
++ /*
++ * This can happen if bitmap_start_sync goes beyond
++ * End-of-device while looking for a whole page or
++ * user set a huge number to sysfs bitmap_set_bits.
++ */
++ return NULL;
++ }
+ err = md_bitmap_checkpage(bitmap, page, create, 0);
+
+ if (bitmap->bp[page].hijacked ||
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index f8c111b369928..6b074c2202d5a 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -3671,8 +3671,9 @@ int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale)
+ static ssize_t
+ safe_delay_show(struct mddev *mddev, char *page)
+ {
+- int msec = (mddev->safemode_delay*1000)/HZ;
+- return sprintf(page, "%d.%03d\n", msec/1000, msec%1000);
++ unsigned int msec = ((unsigned long)mddev->safemode_delay*1000)/HZ;
++
++ return sprintf(page, "%u.%03u\n", msec/1000, msec%1000);
+ }
+ static ssize_t
+ safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len)
+@@ -3684,7 +3685,7 @@ safe_delay_store(struct mddev *mddev, const char *cbuf, size_t len)
+ return -EINVAL;
+ }
+
+- if (strict_strtoul_scaled(cbuf, &msec, 3) < 0)
++ if (strict_strtoul_scaled(cbuf, &msec, 3) < 0 || msec > UINT_MAX / HZ)
+ return -EINVAL;
+ if (msec == 0)
+ mddev->safemode_delay = 0;
+@@ -4336,6 +4337,8 @@ max_corrected_read_errors_store(struct mddev *mddev, const char *buf, size_t len
+ rv = kstrtouint(buf, 10, &n);
+ if (rv < 0)
+ return rv;
++ if (n > INT_MAX)
++ return -EINVAL;
+ atomic_set(&mddev->max_corr_read_errors, n);
+ return len;
+ }
+@@ -4636,11 +4639,21 @@ action_store(struct mddev *mddev, const char *page, size_t len)
+ return -EINVAL;
+ err = mddev_lock(mddev);
+ if (!err) {
+- if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
++ if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) {
+ err = -EBUSY;
+- else {
++ } else if (mddev->reshape_position == MaxSector ||
++ mddev->pers->check_reshape == NULL ||
++ mddev->pers->check_reshape(mddev)) {
+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+ err = mddev->pers->start_reshape(mddev);
++ } else {
++ /*
++ * If reshape is still in progress, and
++ * md_check_recovery() can continue to reshape,
++ * don't restart reshape because data can be
++ * corrupted for raid456.
++ */
++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+ }
+ mddev_unlock(mddev);
+ }
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index 252ef0eab41cb..6f5710e833c1b 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -296,6 +296,18 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ goto abort;
+ }
+
++ if (conf->layout == RAID0_ORIG_LAYOUT) {
++ for (i = 1; i < conf->nr_strip_zones; i++) {
++ sector_t first_sector = conf->strip_zone[i-1].zone_end;
++
++ sector_div(first_sector, mddev->chunk_sectors);
++ zone = conf->strip_zone + i;
++ /* disk_shift is first disk index used in the zone */
++ zone->disk_shift = sector_div(first_sector,
++ zone->nb_dev);
++ }
++ }
++
+ pr_debug("md/raid0:%s: done.\n", mdname(mddev));
+ *private_conf = conf;
+
+@@ -482,6 +494,20 @@ static inline int is_io_in_chunk_boundary(struct mddev *mddev,
+ }
+ }
+
++/*
++ * Convert disk_index to the disk order in which it is read/written.
++ * For example, if we have 4 disks, they are numbered 0,1,2,3. If we
++ * write the disks starting at disk 3, then the read/write order would
++ * be disk 3, then 0, then 1, and then disk 2 and we want map_disk_shift()
++ * to map the disks as follows 0,1,2,3 => 1,2,3,0. So disk 0 would map
++ * to 1, 1 to 2, 2 to 3, and 3 to 0. That way we can compare disks in
++ * that 'output' space to understand the read/write disk ordering.
++ */
++static int map_disk_shift(int disk_index, int num_disks, int disk_shift)
++{
++ return ((disk_index + num_disks - disk_shift) % num_disks);
++}
++
+ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio)
+ {
+ struct r0conf *conf = mddev->private;
+@@ -495,7 +521,9 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio)
+ sector_t end_disk_offset;
+ unsigned int end_disk_index;
+ unsigned int disk;
++ sector_t orig_start, orig_end;
+
++ orig_start = start;
+ zone = find_zone(conf, &start);
+
+ if (bio_end_sector(bio) > zone->zone_end) {
+@@ -509,6 +537,7 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio)
+ } else
+ end = bio_end_sector(bio);
+
++ orig_end = end;
+ if (zone != conf->strip_zone)
+ end = end - zone[-1].zone_end;
+
+@@ -520,13 +549,26 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio)
+ last_stripe_index = end;
+ sector_div(last_stripe_index, stripe_size);
+
+- start_disk_index = (int)(start - first_stripe_index * stripe_size) /
+- mddev->chunk_sectors;
++ /* In the first zone the original and alternate layouts are the same */
++ if ((conf->layout == RAID0_ORIG_LAYOUT) && (zone != conf->strip_zone)) {
++ sector_div(orig_start, mddev->chunk_sectors);
++ start_disk_index = sector_div(orig_start, zone->nb_dev);
++ start_disk_index = map_disk_shift(start_disk_index,
++ zone->nb_dev,
++ zone->disk_shift);
++ sector_div(orig_end, mddev->chunk_sectors);
++ end_disk_index = sector_div(orig_end, zone->nb_dev);
++ end_disk_index = map_disk_shift(end_disk_index,
++ zone->nb_dev, zone->disk_shift);
++ } else {
++ start_disk_index = (int)(start - first_stripe_index * stripe_size) /
++ mddev->chunk_sectors;
++ end_disk_index = (int)(end - last_stripe_index * stripe_size) /
++ mddev->chunk_sectors;
++ }
+ start_disk_offset = ((int)(start - first_stripe_index * stripe_size) %
+ mddev->chunk_sectors) +
+ first_stripe_index * mddev->chunk_sectors;
+- end_disk_index = (int)(end - last_stripe_index * stripe_size) /
+- mddev->chunk_sectors;
+ end_disk_offset = ((int)(end - last_stripe_index * stripe_size) %
+ mddev->chunk_sectors) +
+ last_stripe_index * mddev->chunk_sectors;
+@@ -535,18 +577,22 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio)
+ sector_t dev_start, dev_end;
+ struct bio *discard_bio = NULL;
+ struct md_rdev *rdev;
++ int compare_disk;
++
++ compare_disk = map_disk_shift(disk, zone->nb_dev,
++ zone->disk_shift);
+
+- if (disk < start_disk_index)
++ if (compare_disk < start_disk_index)
+ dev_start = (first_stripe_index + 1) *
+ mddev->chunk_sectors;
+- else if (disk > start_disk_index)
++ else if (compare_disk > start_disk_index)
+ dev_start = first_stripe_index * mddev->chunk_sectors;
+ else
+ dev_start = start_disk_offset;
+
+- if (disk < end_disk_index)
++ if (compare_disk < end_disk_index)
+ dev_end = (last_stripe_index + 1) * mddev->chunk_sectors;
+- else if (disk > end_disk_index)
++ else if (compare_disk > end_disk_index)
+ dev_end = last_stripe_index * mddev->chunk_sectors;
+ else
+ dev_end = end_disk_offset;
+diff --git a/drivers/md/raid0.h b/drivers/md/raid0.h
+index 3816e5477db1e..8cc761ca74230 100644
+--- a/drivers/md/raid0.h
++++ b/drivers/md/raid0.h
+@@ -6,6 +6,7 @@ struct strip_zone {
+ sector_t zone_end; /* Start of the next zone (in sectors) */
+ sector_t dev_start; /* Zone offset in real dev (in sectors) */
+ int nb_dev; /* # of devices attached to the zone */
++ int disk_shift; /* start disk for the original layout */
+ };
+
+ /* Linux 3.14 (20d0189b101) made an unintended change to
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index f6d2be1d23864..bee694be20132 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -781,8 +781,16 @@ static struct md_rdev *read_balance(struct r10conf *conf,
+ disk = r10_bio->devs[slot].devnum;
+ rdev = rcu_dereference(conf->mirrors[disk].replacement);
+ if (rdev == NULL || test_bit(Faulty, &rdev->flags) ||
+- r10_bio->devs[slot].addr + sectors > rdev->recovery_offset)
++ r10_bio->devs[slot].addr + sectors >
++ rdev->recovery_offset) {
++ /*
++ * Read replacement first to prevent reading both rdev
++ * and replacement as NULL during replacement replace
++ * rdev.
++ */
++ smp_mb();
+ rdev = rcu_dereference(conf->mirrors[disk].rdev);
++ }
+ if (rdev == NULL ||
+ test_bit(Faulty, &rdev->flags))
+ continue;
+@@ -934,6 +942,7 @@ static void flush_pending_writes(struct r10conf *conf)
+ else
+ generic_make_request(bio);
+ bio = next;
++ cond_resched();
+ }
+ blk_finish_plug(&plug);
+ } else
+@@ -1119,6 +1128,7 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
+ else
+ generic_make_request(bio);
+ bio = next;
++ cond_resched();
+ }
+ kfree(plug);
+ }
+@@ -1400,9 +1410,15 @@ retry_write:
+
+ for (i = 0; i < conf->copies; i++) {
+ int d = r10_bio->devs[i].devnum;
+- struct md_rdev *rdev = rcu_dereference(conf->mirrors[d].rdev);
+- struct md_rdev *rrdev = rcu_dereference(
+- conf->mirrors[d].replacement);
++ struct md_rdev *rdev, *rrdev;
++
++ rrdev = rcu_dereference(conf->mirrors[d].replacement);
++ /*
++ * Read replacement first to prevent reading both rdev and
++ * replacement as NULL during replacement replace rdev.
++ */
++ smp_mb();
++ rdev = rcu_dereference(conf->mirrors[d].rdev);
+ if (rdev == rrdev)
+ rrdev = NULL;
+ if (rdev && unlikely(test_bit(Blocked, &rdev->flags))) {
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 7eeae0301ccc6..b98abe927d06b 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2603,7 +2603,7 @@ static void raid5_end_write_request(struct bio *bi)
+ struct stripe_head *sh = bi->bi_private;
+ struct r5conf *conf = sh->raid_conf;
+ int disks = sh->disks, i;
+- struct md_rdev *uninitialized_var(rdev);
++ struct md_rdev *rdev;
+ sector_t first_bad;
+ int bad_sectors;
+ int replacement = 0;
+diff --git a/drivers/media/dvb-frontends/rtl2832.c b/drivers/media/dvb-frontends/rtl2832.c
+index 2f1f5cbaf03c4..7cad4e985315a 100644
+--- a/drivers/media/dvb-frontends/rtl2832.c
++++ b/drivers/media/dvb-frontends/rtl2832.c
+@@ -653,7 +653,7 @@ static int rtl2832_read_status(struct dvb_frontend *fe, enum fe_status *status)
+ struct i2c_client *client = dev->client;
+ struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+ int ret;
+- u32 uninitialized_var(tmp);
++ u32 tmp;
+ u8 u8tmp, buf[2];
+ u16 u16tmp;
+
+diff --git a/drivers/media/tuners/qt1010.c b/drivers/media/tuners/qt1010.c
+index 4565c06b16176..6d397cc85428d 100644
+--- a/drivers/media/tuners/qt1010.c
++++ b/drivers/media/tuners/qt1010.c
+@@ -224,7 +224,7 @@ static int qt1010_set_params(struct dvb_frontend *fe)
+ static int qt1010_init_meas1(struct qt1010_priv *priv,
+ u8 oper, u8 reg, u8 reg_init_val, u8 *retval)
+ {
+- u8 i, val1, uninitialized_var(val2);
++ u8 i, val1, val2;
+ int err;
+
+ qt1010_i2c_oper_t i2c_data[] = {
+@@ -259,7 +259,7 @@ static int qt1010_init_meas1(struct qt1010_priv *priv,
+ static int qt1010_init_meas2(struct qt1010_priv *priv,
+ u8 reg_init_val, u8 *retval)
+ {
+- u8 i, uninitialized_var(val);
++ u8 i, val;
+ int err;
+ qt1010_i2c_oper_t i2c_data[] = {
+ { QT1010_WR, 0x07, reg_init_val },
+diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c
+index 746926364535d..8e914be5b7c5e 100644
+--- a/drivers/media/usb/dvb-usb-v2/az6007.c
++++ b/drivers/media/usb/dvb-usb-v2/az6007.c
+@@ -210,7 +210,8 @@ static int az6007_rc_query(struct dvb_usb_device *d)
+ unsigned code;
+ enum rc_proto proto;
+
+- az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10);
++ if (az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10) < 0)
++ return -EIO;
+
+ if (st->data[1] == 0x44)
+ return 0;
+diff --git a/drivers/media/usb/gspca/vicam.c b/drivers/media/usb/gspca/vicam.c
+index 8562bda0ef886..624fdcfdc85a6 100644
+--- a/drivers/media/usb/gspca/vicam.c
++++ b/drivers/media/usb/gspca/vicam.c
+@@ -234,7 +234,7 @@ static int sd_init(struct gspca_dev *gspca_dev)
+ {
+ int ret;
+ const struct ihex_binrec *rec;
+- const struct firmware *uninitialized_var(fw);
++ const struct firmware *fw;
+ u8 *firmware_buf;
+
+ ret = request_ihex_firmware(&fw, VICAM_FIRMWARE,
+diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
+index 2df3d730ea768..cd706874899c3 100644
+--- a/drivers/media/usb/siano/smsusb.c
++++ b/drivers/media/usb/siano/smsusb.c
+@@ -190,7 +190,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev)
+
+ for (i = 0; i < MAX_URBS; i++) {
+ usb_kill_urb(&dev->surbs[i].urb);
+- cancel_work_sync(&dev->surbs[i].wq);
++ if (dev->surbs[i].wq.func)
++ cancel_work_sync(&dev->surbs[i].wq);
+
+ if (dev->surbs[i].cb) {
+ smscore_putbuffer(dev->coredev, dev->surbs[i].cb);
+diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
+index 1c0249df52566..c57bc62251bb8 100644
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -802,9 +802,9 @@ static void uvc_video_stats_decode(struct uvc_streaming *stream,
+ unsigned int header_size;
+ bool has_pts = false;
+ bool has_scr = false;
+- u16 uninitialized_var(scr_sof);
+- u32 uninitialized_var(scr_stc);
+- u32 uninitialized_var(pts);
++ u16 scr_sof;
++ u32 scr_stc;
++ u32 pts;
+
+ if (stream->stats.stream.nb_frames == 0 &&
+ stream->stats.frame.nb_packets == 0)
+@@ -1801,7 +1801,7 @@ static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags)
+ struct usb_host_endpoint *best_ep = NULL;
+ unsigned int best_psize = UINT_MAX;
+ unsigned int bandwidth;
+- unsigned int uninitialized_var(altsetting);
++ unsigned int altsetting;
+ int intfnum = stream->intfnum;
+
+ /* Isochronous endpoint, select the alternate setting. */
+diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c
+index 0610d3c9f1318..9f65db9a69b3d 100644
+--- a/drivers/memstick/host/jmb38x_ms.c
++++ b/drivers/memstick/host/jmb38x_ms.c
+@@ -316,7 +316,7 @@ static int jmb38x_ms_transfer_data(struct jmb38x_ms_host *host)
+ }
+
+ while (length) {
+- unsigned int uninitialized_var(p_off);
++ unsigned int p_off;
+
+ if (host->req->long_data) {
+ pg = nth_page(sg_page(&host->req->sg),
+diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
+index edb1b5588b7a0..6360f5c6d3958 100644
+--- a/drivers/memstick/host/r592.c
++++ b/drivers/memstick/host/r592.c
+@@ -47,12 +47,10 @@ static const char *tpc_names[] = {
+ * memstick_debug_get_tpc_name - debug helper that returns string for
+ * a TPC number
+ */
+-const char *memstick_debug_get_tpc_name(int tpc)
++static __maybe_unused const char *memstick_debug_get_tpc_name(int tpc)
+ {
+ return tpc_names[tpc-1];
+ }
+-EXPORT_SYMBOL(memstick_debug_get_tpc_name);
+-
+
+ /* Read a register*/
+ static inline u32 r592_read_reg(struct r592_device *dev, int address)
+diff --git a/drivers/memstick/host/tifm_ms.c b/drivers/memstick/host/tifm_ms.c
+index bed205849d027..ecd8d71f8a398 100644
+--- a/drivers/memstick/host/tifm_ms.c
++++ b/drivers/memstick/host/tifm_ms.c
+@@ -200,7 +200,7 @@ static unsigned int tifm_ms_transfer_data(struct tifm_ms *host)
+ host->block_pos);
+
+ while (length) {
+- unsigned int uninitialized_var(p_off);
++ unsigned int p_off;
+
+ if (host->req->long_data) {
+ pg = nth_page(sg_page(&host->req->sg),
+diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c
+index fc44fb7c595bc..281ef5f52eb55 100644
+--- a/drivers/mfd/intel-lpss-acpi.c
++++ b/drivers/mfd/intel-lpss-acpi.c
+@@ -92,6 +92,9 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!info->mem)
++ return -ENODEV;
++
+ info->irq = platform_get_irq(pdev, 0);
+
+ ret = intel_lpss_probe(&pdev->dev, info);
+diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c
+index 9bd089c563753..94cdad91c0657 100644
+--- a/drivers/mfd/rt5033.c
++++ b/drivers/mfd/rt5033.c
+@@ -44,9 +44,6 @@ static const struct mfd_cell rt5033_devs[] = {
+ {
+ .name = "rt5033-charger",
+ .of_compatible = "richtek,rt5033-charger",
+- }, {
+- .name = "rt5033-battery",
+- .of_compatible = "richtek,rt5033-battery",
+ }, {
+ .name = "rt5033-led",
+ .of_compatible = "richtek,rt5033-led",
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 722ad2c368a56..d752c56d60e42 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1428,9 +1428,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
+
+ int stmpe_remove(struct stmpe *stmpe)
+ {
+- if (!IS_ERR(stmpe->vio))
++ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
+ regulator_disable(stmpe->vio);
+- if (!IS_ERR(stmpe->vcc))
++ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
+ regulator_disable(stmpe->vcc);
+
+ mfd_remove_devices(stmpe->dev);
+diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
+index 7d166f57f6242..e5b05e11675b4 100644
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -601,6 +601,10 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd,
+ struct pci_dev *pdev = test->pdev;
+
+ mutex_lock(&test->mutex);
++
++ reinit_completion(&test->irq_raised);
++ test->last_irq = -ENODATA;
++
+ switch (cmd) {
+ case PCITEST_BAR:
+ bar = arg;
+@@ -785,6 +789,9 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev)
+ if (id < 0)
+ return;
+
++ pci_endpoint_test_release_irq(test);
++ pci_endpoint_test_free_irq_vectors(test);
++
+ misc_deregister(&test->miscdev);
+ kfree(misc_device->name);
+ ida_simple_remove(&pci_endpoint_test_ida, id);
+@@ -793,9 +800,6 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev)
+ pci_iounmap(pdev, test->bar[bar]);
+ }
+
+- pci_endpoint_test_release_irq(test);
+- pci_endpoint_test_free_irq_vectors(test);
+-
+ pci_release_regions(pdev);
+ pci_disable_device(pdev);
+ }
+diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
+index d5bbe8e544de7..e35c204cdac11 100644
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -90,6 +90,20 @@ static const struct mmc_fixup mmc_blk_fixups[] = {
+ MMC_FIXUP("VZL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+ MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+
++ /*
++ * Kingston EMMC04G-M627 advertises TRIM but it does not seems to
++ * support being used to offload WRITE_ZEROES.
++ */
++ MMC_FIXUP("M62704", CID_MANFID_KINGSTON, 0x0100, add_quirk_mmc,
++ MMC_QUIRK_TRIM_BROKEN),
++
++ /*
++ * Micron MTFC4GACAJCN-1M advertises TRIM but it does not seems to
++ * support being used to offload WRITE_ZEROES.
++ */
++ MMC_FIXUP("Q2J54A", CID_MANFID_MICRON, 0x014e, add_quirk_mmc,
++ MMC_QUIRK_TRIM_BROKEN),
++
+ /*
+ * On Some Kingston eMMCs, performing trim can result in
+ * unrecoverable data conrruption occasionally due to a firmware bug.
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 57be129fe4f33..b7afbeeca08a3 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -374,7 +374,7 @@ static void sdhci_read_block_pio(struct sdhci_host *host)
+ {
+ unsigned long flags;
+ size_t blksize, len, chunk;
+- u32 uninitialized_var(scratch);
++ u32 scratch;
+ u8 *buf;
+
+ DBG("PIO reading\n");
+diff --git a/drivers/mtd/nand/raw/nand_ecc.c b/drivers/mtd/nand/raw/nand_ecc.c
+index 8e132edbc5ce9..d1066f635e4c8 100644
+--- a/drivers/mtd/nand/raw/nand_ecc.c
++++ b/drivers/mtd/nand/raw/nand_ecc.c
+@@ -144,7 +144,7 @@ void __nand_calculate_ecc(const unsigned char *buf, unsigned int eccsize,
+ /* rp0..rp15..rp17 are the various accumulated parities (per byte) */
+ uint32_t rp0, rp1, rp2, rp3, rp4, rp5, rp6, rp7;
+ uint32_t rp8, rp9, rp10, rp11, rp12, rp13, rp14, rp15, rp16;
+- uint32_t uninitialized_var(rp17); /* to make compiler happy */
++ uint32_t rp17;
+ uint32_t par; /* the cumulative parity for all data */
+ uint32_t tmppar; /* the cumulative parity for this iteration;
+ for rp12, rp14 and rp16 at the end of the
+diff --git a/drivers/mtd/nand/raw/omap_elm.c b/drivers/mtd/nand/raw/omap_elm.c
+index 6736777a41567..02d1740383120 100644
+--- a/drivers/mtd/nand/raw/omap_elm.c
++++ b/drivers/mtd/nand/raw/omap_elm.c
+@@ -184,17 +184,17 @@ static void elm_load_syndrome(struct elm_info *info,
+ switch (info->bch_type) {
+ case BCH8_ECC:
+ /* syndrome fragment 0 = ecc[9-12B] */
+- val = cpu_to_be32(*(u32 *) &ecc[9]);
++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[9]);
+ elm_write_reg(info, offset, val);
+
+ /* syndrome fragment 1 = ecc[5-8B] */
+ offset += 4;
+- val = cpu_to_be32(*(u32 *) &ecc[5]);
++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[5]);
+ elm_write_reg(info, offset, val);
+
+ /* syndrome fragment 2 = ecc[1-4B] */
+ offset += 4;
+- val = cpu_to_be32(*(u32 *) &ecc[1]);
++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[1]);
+ elm_write_reg(info, offset, val);
+
+ /* syndrome fragment 3 = ecc[0B] */
+@@ -204,35 +204,35 @@ static void elm_load_syndrome(struct elm_info *info,
+ break;
+ case BCH4_ECC:
+ /* syndrome fragment 0 = ecc[20-52b] bits */
+- val = (cpu_to_be32(*(u32 *) &ecc[3]) >> 4) |
++ val = ((__force u32)cpu_to_be32(*(u32 *)&ecc[3]) >> 4) |
+ ((ecc[2] & 0xf) << 28);
+ elm_write_reg(info, offset, val);
+
+ /* syndrome fragment 1 = ecc[0-20b] bits */
+ offset += 4;
+- val = cpu_to_be32(*(u32 *) &ecc[0]) >> 12;
++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[0]) >> 12;
+ elm_write_reg(info, offset, val);
+ break;
+ case BCH16_ECC:
+- val = cpu_to_be32(*(u32 *) &ecc[22]);
++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[22]);
+ elm_write_reg(info, offset, val);
+ offset += 4;
+- val = cpu_to_be32(*(u32 *) &ecc[18]);
++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[18]);
+ elm_write_reg(info, offset, val);
+ offset += 4;
+- val = cpu_to_be32(*(u32 *) &ecc[14]);
++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[14]);
+ elm_write_reg(info, offset, val);
+ offset += 4;
+- val = cpu_to_be32(*(u32 *) &ecc[10]);
++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[10]);
+ elm_write_reg(info, offset, val);
+ offset += 4;
+- val = cpu_to_be32(*(u32 *) &ecc[6]);
++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[6]);
+ elm_write_reg(info, offset, val);
+ offset += 4;
+- val = cpu_to_be32(*(u32 *) &ecc[2]);
++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[2]);
+ elm_write_reg(info, offset, val);
+ offset += 4;
+- val = cpu_to_be32(*(u32 *) &ecc[0]) >> 16;
++ val = (__force u32)cpu_to_be32(*(u32 *)&ecc[0]) >> 16;
+ elm_write_reg(info, offset, val);
+ break;
+ default:
+diff --git a/drivers/mtd/nand/raw/s3c2410.c b/drivers/mtd/nand/raw/s3c2410.c
+index cf045813c160a..83d3e3cb77ded 100644
+--- a/drivers/mtd/nand/raw/s3c2410.c
++++ b/drivers/mtd/nand/raw/s3c2410.c
+@@ -304,7 +304,7 @@ static int s3c2410_nand_setrate(struct s3c2410_nand_info *info)
+ int tacls_max = (info->cpu_type == TYPE_S3C2412) ? 8 : 4;
+ int tacls, twrph0, twrph1;
+ unsigned long clkrate = clk_get_rate(info->clk);
+- unsigned long uninitialized_var(set), cfg, uninitialized_var(mask);
++ unsigned long set, cfg, mask;
+ unsigned long flags;
+
+ /* calculate the timing information for the controller */
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index 3e25421f22a27..fa6ff75459c6e 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -612,7 +612,7 @@ int ubi_eba_read_leb(struct ubi_device *ubi, struct ubi_volume *vol, int lnum,
+ int err, pnum, scrub = 0, vol_id = vol->vol_id;
+ struct ubi_vid_io_buf *vidb;
+ struct ubi_vid_hdr *vid_hdr;
+- uint32_t uninitialized_var(crc);
++ uint32_t crc;
+
+ err = leb_read_lock(ubi, vol_id, lnum);
+ if (err)
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 4e4adacb5c2c1..47e02c5342b28 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1128,6 +1128,11 @@ static void bond_setup_by_slave(struct net_device *bond_dev,
+
+ memcpy(bond_dev->broadcast, slave_dev->broadcast,
+ slave_dev->addr_len);
++
++ if (slave_dev->flags & IFF_POINTOPOINT) {
++ bond_dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST);
++ bond_dev->flags |= (IFF_POINTOPOINT | IFF_NOARP);
++ }
+ }
+
+ /* On bonding slaves other than the currently active slave, suppress
+diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
+index 02042cb09bd29..0e939a4cd9998 100644
+--- a/drivers/net/can/janz-ican3.c
++++ b/drivers/net/can/janz-ican3.c
+@@ -1455,7 +1455,7 @@ static int ican3_napi(struct napi_struct *napi, int budget)
+
+ /* process all communication messages */
+ while (true) {
+- struct ican3_msg uninitialized_var(msg);
++ struct ican3_msg msg;
+ ret = ican3_recv_msg(mod, &msg);
+ if (ret)
+ break;
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index 62ca4964a863a..b2e48c8595f0f 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -740,6 +740,8 @@ static int gs_can_close(struct net_device *netdev)
+ usb_kill_anchored_urbs(&dev->tx_submitted);
+ atomic_set(&dev->active_tx_urbs, 0);
+
++ dev->can.state = CAN_STATE_STOPPED;
++
+ /* reset the device */
+ rc = gs_cmd_reset(dev);
+ if (rc < 0)
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+index 3164aad29bcf8..e4d58c7aeaf82 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+@@ -1651,8 +1651,11 @@ static int atl1e_tso_csum(struct atl1e_adapter *adapter,
+ real_len = (((unsigned char *)ip_hdr(skb) - skb->data)
+ + ntohs(ip_hdr(skb)->tot_len));
+
+- if (real_len < skb->len)
+- pskb_trim(skb, real_len);
++ if (real_len < skb->len) {
++ err = pskb_trim(skb, real_len);
++ if (err)
++ return err;
++ }
+
+ hdr_len = (skb_transport_offset(skb) + tcp_hdrlen(skb));
+ if (unlikely(skb->len == hdr_len)) {
+diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
+index 9993f1162ac68..c69700088082d 100644
+--- a/drivers/net/ethernet/broadcom/bnx2.c
++++ b/drivers/net/ethernet/broadcom/bnx2.c
+@@ -1461,7 +1461,7 @@ bnx2_test_and_disable_2g5(struct bnx2 *bp)
+ static void
+ bnx2_enable_forced_2g5(struct bnx2 *bp)
+ {
+- u32 uninitialized_var(bmcr);
++ u32 bmcr;
+ int err;
+
+ if (!(bp->phy_flags & BNX2_PHY_FLAG_2_5G_CAPABLE))
+@@ -1505,7 +1505,7 @@ bnx2_enable_forced_2g5(struct bnx2 *bp)
+ static void
+ bnx2_disable_forced_2g5(struct bnx2 *bp)
+ {
+- u32 uninitialized_var(bmcr);
++ u32 bmcr;
+ int err;
+
+ if (!(bp->phy_flags & BNX2_PHY_FLAG_2_5G_CAPABLE))
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index 494601c39b847..9041a422dd15a 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -620,5 +620,7 @@ void bcmgenet_mii_exit(struct net_device *dev)
+ if (of_phy_is_fixed_link(dn))
+ of_phy_deregister_fixed_link(dn);
+ of_node_put(priv->phy_dn);
++ clk_prepare_enable(priv->clk);
+ platform_device_unregister(priv->mii_pdev);
++ clk_disable_unprepare(priv->clk);
+ }
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 2cf144bbef3ee..43b83a3a28049 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -235,6 +235,7 @@ MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver");
+ MODULE_LICENSE("GPL");
+ MODULE_VERSION(DRV_MODULE_VERSION);
+ MODULE_FIRMWARE(FIRMWARE_TG3);
++MODULE_FIRMWARE(FIRMWARE_TG357766);
+ MODULE_FIRMWARE(FIRMWARE_TG3TSO);
+ MODULE_FIRMWARE(FIRMWARE_TG3TSO5);
+
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index 8603df2ae1736..d0d9a420f557e 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -1139,7 +1139,8 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter,
+ (lancer_chip(adapter) || BE3_chip(adapter) ||
+ skb_vlan_tag_present(skb)) && is_ipv4_pkt(skb)) {
+ ip = (struct iphdr *)ip_hdr(skb);
+- pskb_trim(skb, eth_hdr_len + ntohs(ip->tot_len));
++ if (unlikely(pskb_trim(skb, eth_hdr_len + ntohs(ip->tot_len))))
++ goto tx_drop;
+ }
+
+ /* If vlan tag is already inlined in the packet, skip HW VLAN
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+index a66492b9403c4..5b82c89330e30 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+@@ -1798,7 +1798,7 @@ void i40e_dbg_pf_exit(struct i40e_pf *pf)
+ void i40e_dbg_init(void)
+ {
+ i40e_dbg_root = debugfs_create_dir(i40e_driver_name, NULL);
+- if (!i40e_dbg_root)
++ if (IS_ERR(i40e_dbg_root))
+ pr_info("init of debugfs failed\n");
+ }
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 6f9d563deb6ba..be51179089852 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -9059,6 +9059,11 @@ static pci_ers_result_t igb_io_error_detected(struct pci_dev *pdev,
+ struct net_device *netdev = pci_get_drvdata(pdev);
+ struct igb_adapter *adapter = netdev_priv(netdev);
+
++ if (state == pci_channel_io_normal) {
++ dev_warn(&pdev->dev, "Non-correctable non-fatal error reported.\n");
++ return PCI_ERS_RESULT_CAN_RECOVER;
++ }
++
+ netif_device_detach(netdev);
+
+ if (state == pci_channel_io_perm_failure)
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index f1a4b11ce0d19..512f9cd68070a 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -1415,7 +1415,7 @@ static void mvneta_defaults_set(struct mvneta_port *pp)
+ */
+ if (txq_number == 1)
+ txq_map = (cpu == pp->rxq_def) ?
+- MVNETA_CPU_TXQ_ACCESS(1) : 0;
++ MVNETA_CPU_TXQ_ACCESS(0) : 0;
+
+ } else {
+ txq_map = MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
+@@ -3665,7 +3665,7 @@ static void mvneta_percpu_elect(struct mvneta_port *pp)
+ */
+ if (txq_number == 1)
+ txq_map = (cpu == elected_cpu) ?
+- MVNETA_CPU_TXQ_ACCESS(1) : 0;
++ MVNETA_CPU_TXQ_ACCESS(0) : 0;
+ else
+ txq_map = mvreg_read(pp, MVNETA_CPU_MAP(cpu)) &
+ MVNETA_CPU_TXQ_ACCESS_ALL_MASK;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c
+index 128a82b1dbfc6..ad9db70eb879e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c
+@@ -121,7 +121,9 @@ static int mlx5e_ipsec_remove_trailer(struct sk_buff *skb, struct xfrm_state *x)
+
+ trailer_len = alen + plen + 2;
+
+- pskb_trim(skb, skb->len - trailer_len);
++ ret = pskb_trim(skb, skb->len - trailer_len);
++ if (unlikely(ret))
++ return ret;
+ if (skb->protocol == htons(ETH_P_IP)) {
+ ipv4hdr->tot_len = htons(ntohs(ipv4hdr->tot_len) - trailer_len);
+ ip_send_check(ipv4hdr);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index fc880c02459db..c9ba97b400fa1 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -471,8 +471,8 @@ void mlx5_core_req_pages_handler(struct mlx5_core_dev *dev, u16 func_id,
+
+ int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev, int boot)
+ {
+- u16 uninitialized_var(func_id);
+- s32 uninitialized_var(npages);
++ u16 func_id;
++ s32 npages;
+ int err;
+
+ err = mlx5_cmd_query_pages(dev, &func_id, &npages, boot);
+diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
+index e734bc5e3ceb4..112d374e71663 100644
+--- a/drivers/net/ethernet/microchip/lan743x_main.c
++++ b/drivers/net/ethernet/microchip/lan743x_main.c
+@@ -80,6 +80,18 @@ static int lan743x_csr_light_reset(struct lan743x_adapter *adapter)
+ !(data & HW_CFG_LRST_), 100000, 10000000);
+ }
+
++static int lan743x_csr_wait_for_bit_atomic(struct lan743x_adapter *adapter,
++ int offset, u32 bit_mask,
++ int target_value, int udelay_min,
++ int udelay_max, int count)
++{
++ u32 data;
++
++ return readx_poll_timeout_atomic(LAN743X_CSR_READ_OP, offset, data,
++ target_value == !!(data & bit_mask),
++ udelay_max, udelay_min * count);
++}
++
+ static int lan743x_csr_wait_for_bit(struct lan743x_adapter *adapter,
+ int offset, u32 bit_mask,
+ int target_value, int usleep_min,
+@@ -675,8 +687,8 @@ static int lan743x_dp_write(struct lan743x_adapter *adapter,
+ u32 dp_sel;
+ int i;
+
+- if (lan743x_csr_wait_for_bit(adapter, DP_SEL, DP_SEL_DPRDY_,
+- 1, 40, 100, 100))
++ if (lan743x_csr_wait_for_bit_atomic(adapter, DP_SEL, DP_SEL_DPRDY_,
++ 1, 40, 100, 100))
+ return -EIO;
+ dp_sel = lan743x_csr_read(adapter, DP_SEL);
+ dp_sel &= ~DP_SEL_MASK_;
+@@ -687,8 +699,9 @@ static int lan743x_dp_write(struct lan743x_adapter *adapter,
+ lan743x_csr_write(adapter, DP_ADDR, addr + i);
+ lan743x_csr_write(adapter, DP_DATA_0, buf[i]);
+ lan743x_csr_write(adapter, DP_CMD, DP_CMD_WRITE_);
+- if (lan743x_csr_wait_for_bit(adapter, DP_SEL, DP_SEL_DPRDY_,
+- 1, 40, 100, 100))
++ if (lan743x_csr_wait_for_bit_atomic(adapter, DP_SEL,
++ DP_SEL_DPRDY_,
++ 1, 40, 100, 100))
+ return -EIO;
+ }
+
+diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c
+index b42f81d0c6f05..f5272d2fcc7e4 100644
+--- a/drivers/net/ethernet/neterion/s2io.c
++++ b/drivers/net/ethernet/neterion/s2io.c
+@@ -7291,7 +7291,7 @@ static int rx_osm_handler(struct ring_info *ring_data, struct RxD_t * rxdp)
+ int ring_no = ring_data->ring_no;
+ u16 l3_csum, l4_csum;
+ unsigned long long err = rxdp->Control_1 & RXD_T_CODE;
+- struct lro *uninitialized_var(lro);
++ struct lro *lro;
+ u8 err_mask;
+ struct swStat *swstats = &sp->mac_control.stats_info->sw_stat;
+
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
+index 7a65a1534e41a..d545593354c63 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -3771,7 +3771,7 @@ static int ql3xxx_probe(struct pci_dev *pdev,
+ struct net_device *ndev = NULL;
+ struct ql3_adapter *qdev = NULL;
+ static int cards_found;
+- int uninitialized_var(pci_using_dac), err;
++ int pci_using_dac, err;
+
+ err = pci_enable_device(pdev);
+ if (err) {
+diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
+index 909f6d1605f7a..861d1f6d7508f 100644
+--- a/drivers/net/ethernet/sun/cassini.c
++++ b/drivers/net/ethernet/sun/cassini.c
+@@ -2291,7 +2291,7 @@ static int cas_rx_ringN(struct cas *cp, int ring, int budget)
+ drops = 0;
+ while (1) {
+ struct cas_rx_comp *rxc = rxcs + entry;
+- struct sk_buff *uninitialized_var(skb);
++ struct sk_buff *skb;
+ int type, len;
+ u64 words[4];
+ int i, dring;
+diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
+index 1693a70325c50..1c13c08c4f965 100644
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -429,7 +429,7 @@ static int serdes_init_niu_1g_serdes(struct niu *np)
+ struct niu_link_config *lp = &np->link_config;
+ u16 pll_cfg, pll_sts;
+ int max_retry = 100;
+- u64 uninitialized_var(sig), mask, val;
++ u64 sig, mask, val;
+ u32 tx_cfg, rx_cfg;
+ unsigned long i;
+ int err;
+@@ -526,7 +526,7 @@ static int serdes_init_niu_10g_serdes(struct niu *np)
+ struct niu_link_config *lp = &np->link_config;
+ u32 tx_cfg, rx_cfg, pll_cfg, pll_sts;
+ int max_retry = 100;
+- u64 uninitialized_var(sig), mask, val;
++ u64 sig, mask, val;
+ unsigned long i;
+ int err;
+
+@@ -714,7 +714,7 @@ static int esr_write_glue0(struct niu *np, unsigned long chan, u32 val)
+
+ static int esr_reset(struct niu *np)
+ {
+- u32 uninitialized_var(reset);
++ u32 reset;
+ int err;
+
+ err = mdio_write(np, np->port, NIU_ESR_DEV_ADDR,
+diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
+index c245629a38c76..6cb98760bc84e 100644
+--- a/drivers/net/ethernet/ti/cpsw_ale.c
++++ b/drivers/net/ethernet/ti/cpsw_ale.c
+@@ -67,23 +67,37 @@
+
+ static inline int cpsw_ale_get_field(u32 *ale_entry, u32 start, u32 bits)
+ {
+- int idx;
++ int idx, idx2;
++ u32 hi_val = 0;
+
+ idx = start / 32;
++ idx2 = (start + bits - 1) / 32;
++ /* Check if bits to be fetched exceed a word */
++ if (idx != idx2) {
++ idx2 = 2 - idx2; /* flip */
++ hi_val = ale_entry[idx2] << ((idx2 * 32) - start);
++ }
+ start -= idx * 32;
+ idx = 2 - idx; /* flip */
+- return (ale_entry[idx] >> start) & BITMASK(bits);
++ return (hi_val + (ale_entry[idx] >> start)) & BITMASK(bits);
+ }
+
+ static inline void cpsw_ale_set_field(u32 *ale_entry, u32 start, u32 bits,
+ u32 value)
+ {
+- int idx;
++ int idx, idx2;
+
+ value &= BITMASK(bits);
+- idx = start / 32;
++ idx = start / 32;
++ idx2 = (start + bits - 1) / 32;
++ /* Check if bits to be set exceed a word */
++ if (idx != idx2) {
++ idx2 = 2 - idx2; /* flip */
++ ale_entry[idx2] &= ~(BITMASK(bits + start - (idx2 * 32)));
++ ale_entry[idx2] |= (value >> ((idx2 * 32) - start));
++ }
+ start -= idx * 32;
+- idx = 2 - idx; /* flip */
++ idx = 2 - idx; /* flip */
+ ale_entry[idx] &= ~(BITMASK(bits) << start);
+ ale_entry[idx] |= (value << start);
+ }
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index e18d06cb2173c..2718b0507f713 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -301,7 +301,9 @@ static void __gtp_encap_destroy(struct sock *sk)
+ gtp->sk1u = NULL;
+ udp_sk(sk)->encap_type = 0;
+ rcu_assign_sk_user_data(sk, NULL);
++ release_sock(sk);
+ sock_put(sk);
++ return;
+ }
+ release_sock(sk);
+ }
+diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
+index eb80d277b56f5..6b6c5a7250a65 100644
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -592,7 +592,8 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
+ consume_skb(skb);
+ return NET_XMIT_DROP;
+ }
+- return ipvlan_rcv_frame(addr, &skb, true);
++ ipvlan_rcv_frame(addr, &skb, true);
++ return NET_XMIT_SUCCESS;
+ }
+ }
+ out:
+@@ -618,7 +619,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
+ consume_skb(skb);
+ return NET_XMIT_DROP;
+ }
+- return ipvlan_rcv_frame(addr, &skb, true);
++ ipvlan_rcv_frame(addr, &skb, true);
++ return NET_XMIT_SUCCESS;
+ }
+ }
+ skb = skb_share_check(skb, GFP_ATOMIC);
+@@ -630,7 +632,8 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
+ * the skb for the main-dev. At the RX side we just return
+ * RX_PASS for it to be processed further on the stack.
+ */
+- return dev_forward_skb(ipvlan->phy_dev, skb);
++ dev_forward_skb(ipvlan->phy_dev, skb);
++ return NET_XMIT_SUCCESS;
+
+ } else if (is_multicast_ether_addr(eth->h_dest)) {
+ skb_reset_mac_header(skb);
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 2410f08e2bb5c..d80bc5f59b3fc 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -2103,6 +2103,15 @@ static void team_setup_by_port(struct net_device *dev,
+ dev->mtu = port_dev->mtu;
+ memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len);
+ eth_hw_addr_inherit(dev, port_dev);
++
++ if (port_dev->flags & IFF_POINTOPOINT) {
++ dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST);
++ dev->flags |= (IFF_POINTOPOINT | IFF_NOARP);
++ } else if ((port_dev->flags & (IFF_BROADCAST | IFF_MULTICAST)) ==
++ (IFF_BROADCAST | IFF_MULTICAST)) {
++ dev->flags |= (IFF_BROADCAST | IFF_MULTICAST);
++ dev->flags &= ~(IFF_POINTOPOINT | IFF_NOARP);
++ }
+ }
+
+ static int team_dev_type_check_change(struct net_device *dev,
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 17b932505be0c..e2ce3c5541baa 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -618,9 +618,23 @@ static const struct usb_device_id products[] = {
+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
+ | USB_DEVICE_ID_MATCH_DEVICE,
+ .idVendor = 0x04DD,
++ .idProduct = 0x8005, /* A-300 */
++ ZAURUS_FAKE_INTERFACE,
++ .driver_info = 0,
++}, {
++ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
++ | USB_DEVICE_ID_MATCH_DEVICE,
++ .idVendor = 0x04DD,
+ .idProduct = 0x8006, /* B-500/SL-5600 */
+ ZAURUS_MASTER_INTERFACE,
+ .driver_info = 0,
++}, {
++ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
++ | USB_DEVICE_ID_MATCH_DEVICE,
++ .idVendor = 0x04DD,
++ .idProduct = 0x8006, /* B-500/SL-5600 */
++ ZAURUS_FAKE_INTERFACE,
++ .driver_info = 0,
+ }, {
+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
+ | USB_DEVICE_ID_MATCH_DEVICE,
+@@ -628,6 +642,13 @@ static const struct usb_device_id products[] = {
+ .idProduct = 0x8007, /* C-700 */
+ ZAURUS_MASTER_INTERFACE,
+ .driver_info = 0,
++}, {
++ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
++ | USB_DEVICE_ID_MATCH_DEVICE,
++ .idVendor = 0x04DD,
++ .idProduct = 0x8007, /* C-700 */
++ ZAURUS_FAKE_INTERFACE,
++ .driver_info = 0,
+ }, {
+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
+ | USB_DEVICE_ID_MATCH_DEVICE,
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 2263a66f6314e..f7f037b399a75 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1767,6 +1767,10 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
+ } else if (!info->in || !info->out)
+ status = usbnet_get_endpoints (dev, udev);
+ else {
++ u8 ep_addrs[3] = {
++ info->in + USB_DIR_IN, info->out + USB_DIR_OUT, 0
++ };
++
+ dev->in = usb_rcvbulkpipe (xdev, info->in);
+ dev->out = usb_sndbulkpipe (xdev, info->out);
+ if (!(info->flags & FLAG_NO_SETINT))
+@@ -1776,6 +1780,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
+ else
+ status = 0;
+
++ if (status == 0 && !usb_check_bulk_endpoints(udev, ep_addrs))
++ status = -EINVAL;
+ }
+ if (status >= 0 && dev->status)
+ status = init_status (dev, udev);
+diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
+index 1f19fc5e6117e..9a6ab75752e16 100644
+--- a/drivers/net/usb/zaurus.c
++++ b/drivers/net/usb/zaurus.c
+@@ -301,9 +301,23 @@ static const struct usb_device_id products [] = {
+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
+ | USB_DEVICE_ID_MATCH_DEVICE,
+ .idVendor = 0x04DD,
++ .idProduct = 0x8005, /* A-300 */
++ ZAURUS_FAKE_INTERFACE,
++ .driver_info = (unsigned long)&bogus_mdlm_info,
++}, {
++ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
++ | USB_DEVICE_ID_MATCH_DEVICE,
++ .idVendor = 0x04DD,
+ .idProduct = 0x8006, /* B-500/SL-5600 */
+ ZAURUS_MASTER_INTERFACE,
+ .driver_info = ZAURUS_PXA_INFO,
++}, {
++ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
++ | USB_DEVICE_ID_MATCH_DEVICE,
++ .idVendor = 0x04DD,
++ .idProduct = 0x8006, /* B-500/SL-5600 */
++ ZAURUS_FAKE_INTERFACE,
++ .driver_info = (unsigned long)&bogus_mdlm_info,
+ }, {
+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
+ | USB_DEVICE_ID_MATCH_DEVICE,
+@@ -311,6 +325,13 @@ static const struct usb_device_id products [] = {
+ .idProduct = 0x8007, /* C-700 */
+ ZAURUS_MASTER_INTERFACE,
+ .driver_info = ZAURUS_PXA_INFO,
++}, {
++ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
++ | USB_DEVICE_ID_MATCH_DEVICE,
++ .idVendor = 0x04DD,
++ .idProduct = 0x8007, /* C-700 */
++ ZAURUS_FAKE_INTERFACE,
++ .driver_info = (unsigned long)&bogus_mdlm_info,
+ }, {
+ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
+ | USB_DEVICE_ID_MATCH_DEVICE,
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index d45e8de79f286..03e0f8060cc2e 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -3120,6 +3120,8 @@ static int virtnet_probe(struct virtio_device *vdev)
+ }
+ }
+
++ _virtnet_set_queues(vi, vi->curr_queue_pairs);
++
+ /* serialize netdev register + virtio_device_ready() with ndo_open() */
+ rtnl_lock();
+
+@@ -3140,8 +3142,6 @@ static int virtnet_probe(struct virtio_device *vdev)
+ goto free_unregister_netdev;
+ }
+
+- virtnet_set_queues(vi, vi->curr_queue_pairs);
+-
+ /* Assume link up if device can't report link status,
+ otherwise get link status from config. */
+ netif_carrier_off(dev);
+diff --git a/drivers/net/wan/z85230.c b/drivers/net/wan/z85230.c
+index deea41e96f018..96025d42b0eea 100644
+--- a/drivers/net/wan/z85230.c
++++ b/drivers/net/wan/z85230.c
+@@ -705,7 +705,7 @@ EXPORT_SYMBOL(z8530_nop);
+ irqreturn_t z8530_interrupt(int irq, void *dev_id)
+ {
+ struct z8530_dev *dev=dev_id;
+- u8 uninitialized_var(intr);
++ u8 intr;
+ static volatile int locker=0;
+ int work=0;
+ struct z8530_irqhandler *irqs;
+diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
+index 436eac342b622..7e43d449131dd 100644
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -1891,7 +1891,7 @@ static int ath10k_init_uart(struct ath10k *ar)
+
+ static int ath10k_init_hw_params(struct ath10k *ar)
+ {
+- const struct ath10k_hw_params *uninitialized_var(hw_params);
++ const struct ath10k_hw_params *hw_params;
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(ath10k_hw_params_list); i++) {
+diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c
+index 58fb227a849f6..49b93a5b7a72a 100644
+--- a/drivers/net/wireless/ath/ath6kl/init.c
++++ b/drivers/net/wireless/ath/ath6kl/init.c
+@@ -1575,7 +1575,7 @@ static int ath6kl_init_upload(struct ath6kl *ar)
+
+ int ath6kl_init_hw_params(struct ath6kl *ar)
+ {
+- const struct ath6kl_hw *uninitialized_var(hw);
++ const struct ath6kl_hw *hw;
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(hw_list); i++) {
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+index 2fe12b0de5b4f..dea8a998fb622 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+@@ -1099,17 +1099,22 @@ static bool ath9k_hw_verify_hang(struct ath_hw *ah, unsigned int queue)
+ {
+ u32 dma_dbg_chain, dma_dbg_complete;
+ u8 dcu_chain_state, dcu_complete_state;
++ unsigned int dbg_reg, reg_offset;
+ int i;
+
+- for (i = 0; i < NUM_STATUS_READS; i++) {
+- if (queue < 6)
+- dma_dbg_chain = REG_READ(ah, AR_DMADBG_4);
+- else
+- dma_dbg_chain = REG_READ(ah, AR_DMADBG_5);
++ if (queue < 6) {
++ dbg_reg = AR_DMADBG_4;
++ reg_offset = queue * 5;
++ } else {
++ dbg_reg = AR_DMADBG_5;
++ reg_offset = (queue - 6) * 5;
++ }
+
++ for (i = 0; i < NUM_STATUS_READS; i++) {
++ dma_dbg_chain = REG_READ(ah, dbg_reg);
+ dma_dbg_complete = REG_READ(ah, AR_DMADBG_6);
+
+- dcu_chain_state = (dma_dbg_chain >> (5 * queue)) & 0x1f;
++ dcu_chain_state = (dma_dbg_chain >> reg_offset) & 0x1f;
+ dcu_complete_state = dma_dbg_complete & 0x3;
+
+ if ((dcu_chain_state != 0x6) || (dcu_complete_state != 0x1))
+@@ -1128,6 +1133,7 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah)
+ u8 dcu_chain_state, dcu_complete_state;
+ bool dcu_wait_frdone = false;
+ unsigned long chk_dcu = 0;
++ unsigned int reg_offset;
+ unsigned int i = 0;
+
+ dma_dbg_4 = REG_READ(ah, AR_DMADBG_4);
+@@ -1139,12 +1145,15 @@ static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah)
+ goto exit;
+
+ for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+- if (i < 6)
++ if (i < 6) {
+ chk_dbg = dma_dbg_4;
+- else
++ reg_offset = i * 5;
++ } else {
+ chk_dbg = dma_dbg_5;
++ reg_offset = (i - 6) * 5;
++ }
+
+- dcu_chain_state = (chk_dbg >> (5 * i)) & 0x1f;
++ dcu_chain_state = (chk_dbg >> reg_offset) & 0x1f;
+ if (dcu_chain_state == 0x6) {
+ dcu_wait_frdone = true;
+ chk_dcu |= BIT(i);
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index 6331c98088e03..d5e5f9cf4ca86 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -114,7 +114,13 @@ static void htc_process_conn_rsp(struct htc_target *target,
+
+ if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) {
+ epid = svc_rspmsg->endpoint_id;
+- if (epid < 0 || epid >= ENDPOINT_MAX)
++
++ /* Check that the received epid for the endpoint to attach
++ * a new service is valid. ENDPOINT0 can't be used here as it
++ * is already reserved for HTC_CTRL_RSVD_SVC service and thus
++ * should not be modified.
++ */
++ if (epid <= ENDPOINT0 || epid >= ENDPOINT_MAX)
+ return;
+
+ service_id = be16_to_cpu(svc_rspmsg->service_id);
+diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
+index fae572b384169..922a3f208837e 100644
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -230,7 +230,7 @@ static unsigned int ath9k_reg_rmw(void *hw_priv, u32 reg_offset, u32 set, u32 cl
+ struct ath_hw *ah = hw_priv;
+ struct ath_common *common = ath9k_hw_common(ah);
+ struct ath_softc *sc = (struct ath_softc *) common->priv;
+- unsigned long uninitialized_var(flags);
++ unsigned long flags;
+ u32 val;
+
+ if (NR_CPUS > 1 && ah->config.serialize_regmode == SER_REG_MODE_ON) {
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index ee1b9c39bad7a..2fdf9858a73d9 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -200,7 +200,7 @@ void ath_cancel_work(struct ath_softc *sc)
+ void ath_restart_work(struct ath_softc *sc)
+ {
+ ieee80211_queue_delayed_work(sc->hw, &sc->hw_check_work,
+- ATH_HW_CHECK_POLL_INT);
++ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT));
+
+ if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah))
+ ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
+@@ -847,7 +847,7 @@ static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix)
+ static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix)
+ {
+ struct ath_hw *ah = sc->sc_ah;
+- int i;
++ int i, j;
+ struct ath_txq *txq;
+ bool key_in_use = false;
+
+@@ -865,8 +865,9 @@ static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix)
+ if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+ int idx = txq->txq_tailidx;
+
+- while (!key_in_use &&
+- !list_empty(&txq->txq_fifo[idx])) {
++ for (j = 0; !key_in_use &&
++ !list_empty(&txq->txq_fifo[idx]) &&
++ j < ATH_TXFIFO_DEPTH; j++) {
+ key_in_use = ath9k_txq_list_has_key(
+ &txq->txq_fifo[idx], keyix);
+ INCR(idx, ATH_TXFIFO_DEPTH);
+@@ -2227,7 +2228,7 @@ void __ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop,
+ }
+
+ ieee80211_queue_delayed_work(hw, &sc->hw_check_work,
+- ATH_HW_CHECK_POLL_INT);
++ msecs_to_jiffies(ATH_HW_CHECK_POLL_INT));
+ }
+
+ static bool ath9k_tx_frames_pending(struct ieee80211_hw *hw)
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
+index e4ea6f5cc78ab..5e2a610df61cf 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.c
++++ b/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -218,6 +218,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
+ if (unlikely(wmi->stopped))
+ goto free_skb;
+
++ /* Validate the obtained SKB. */
++ if (unlikely(skb->len < sizeof(struct wmi_cmd_hdr)))
++ goto free_skb;
++
+ hdr = (struct wmi_cmd_hdr *) skb->data;
+ cmd_id = be16_to_cpu(hdr->command_id);
+
+diff --git a/drivers/net/wireless/atmel/atmel_cs.c b/drivers/net/wireless/atmel/atmel_cs.c
+index 7afc9c5329fb1..f5fa1a95b0c15 100644
+--- a/drivers/net/wireless/atmel/atmel_cs.c
++++ b/drivers/net/wireless/atmel/atmel_cs.c
+@@ -73,6 +73,7 @@ struct local_info {
+ static int atmel_probe(struct pcmcia_device *p_dev)
+ {
+ struct local_info *local;
++ int ret;
+
+ dev_dbg(&p_dev->dev, "atmel_attach()\n");
+
+@@ -83,8 +84,16 @@ static int atmel_probe(struct pcmcia_device *p_dev)
+
+ p_dev->priv = local;
+
+- return atmel_config(p_dev);
+-} /* atmel_attach */
++ ret = atmel_config(p_dev);
++ if (ret)
++ goto err_free_priv;
++
++ return 0;
++
++err_free_priv:
++ kfree(p_dev->priv);
++ return ret;
++}
+
+ static void atmel_detach(struct pcmcia_device *link)
+ {
+diff --git a/drivers/net/wireless/broadcom/b43/debugfs.c b/drivers/net/wireless/broadcom/b43/debugfs.c
+index 77046384dd800..70b02d6641709 100644
+--- a/drivers/net/wireless/broadcom/b43/debugfs.c
++++ b/drivers/net/wireless/broadcom/b43/debugfs.c
+@@ -506,7 +506,7 @@ static ssize_t b43_debugfs_read(struct file *file, char __user *userbuf,
+ struct b43_wldev *dev;
+ struct b43_debugfs_fops *dfops;
+ struct b43_dfs_file *dfile;
+- ssize_t uninitialized_var(ret);
++ ssize_t ret;
+ char *buf;
+ const size_t bufsize = 1024 * 16; /* 16 kiB buffer */
+ const size_t buforder = get_order(bufsize);
+diff --git a/drivers/net/wireless/broadcom/b43/dma.c b/drivers/net/wireless/broadcom/b43/dma.c
+index d46d57b989aec..06139835055fa 100644
+--- a/drivers/net/wireless/broadcom/b43/dma.c
++++ b/drivers/net/wireless/broadcom/b43/dma.c
+@@ -50,7 +50,7 @@
+ static u32 b43_dma_address(struct b43_dma *dma, dma_addr_t dmaaddr,
+ enum b43_addrtype addrtype)
+ {
+- u32 uninitialized_var(addr);
++ u32 addr;
+
+ switch (addrtype) {
+ case B43_DMA_ADDR_LOW:
+diff --git a/drivers/net/wireless/broadcom/b43/lo.c b/drivers/net/wireless/broadcom/b43/lo.c
+index a335f94c72ff7..10cc0c0d70c3a 100644
+--- a/drivers/net/wireless/broadcom/b43/lo.c
++++ b/drivers/net/wireless/broadcom/b43/lo.c
+@@ -742,7 +742,7 @@ struct b43_lo_calib *b43_calibrate_lo_setting(struct b43_wldev *dev,
+ };
+ int max_rx_gain;
+ struct b43_lo_calib *cal;
+- struct lo_g_saved_values uninitialized_var(saved_regs);
++ struct lo_g_saved_values saved_regs;
+ /* Values from the "TXCTL Register and Value Table" */
+ u16 txctl_reg;
+ u16 txctl_value;
+diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c
+index 3508a78226193..3a74e82c9fb68 100644
+--- a/drivers/net/wireless/broadcom/b43/phy_n.c
++++ b/drivers/net/wireless/broadcom/b43/phy_n.c
+@@ -5655,7 +5655,7 @@ static int b43_nphy_rev2_cal_rx_iq(struct b43_wldev *dev,
+ u8 rfctl[2];
+ u8 afectl_core;
+ u16 tmp[6];
+- u16 uninitialized_var(cur_hpf1), uninitialized_var(cur_hpf2), cur_lna;
++ u16 cur_hpf1, cur_hpf2, cur_lna;
+ u32 real, imag;
+ enum nl80211_band band;
+
+diff --git a/drivers/net/wireless/broadcom/b43/xmit.c b/drivers/net/wireless/broadcom/b43/xmit.c
+index 1b9c191e2a229..c123e22046637 100644
+--- a/drivers/net/wireless/broadcom/b43/xmit.c
++++ b/drivers/net/wireless/broadcom/b43/xmit.c
+@@ -435,10 +435,10 @@ int b43_generate_txhdr(struct b43_wldev *dev,
+ if ((rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
+ (rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)) {
+ unsigned int len;
+- struct ieee80211_hdr *uninitialized_var(hdr);
++ struct ieee80211_hdr *hdr;
+ int rts_rate, rts_rate_fb;
+ int rts_rate_ofdm, rts_rate_fb_ofdm;
+- struct b43_plcp_hdr6 *uninitialized_var(plcp);
++ struct b43_plcp_hdr6 *plcp;
+ struct ieee80211_rate *rts_cts_rate;
+
+ rts_cts_rate = ieee80211_get_rts_cts_rate(dev->wl->hw, info);
+@@ -449,7 +449,7 @@ int b43_generate_txhdr(struct b43_wldev *dev,
+ rts_rate_fb_ofdm = b43_is_ofdm_rate(rts_rate_fb);
+
+ if (rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
+- struct ieee80211_cts *uninitialized_var(cts);
++ struct ieee80211_cts *cts;
+
+ switch (dev->fw.hdr_format) {
+ case B43_FW_HDR_598:
+@@ -471,7 +471,7 @@ int b43_generate_txhdr(struct b43_wldev *dev,
+ mac_ctl |= B43_TXH_MAC_SENDCTS;
+ len = sizeof(struct ieee80211_cts);
+ } else {
+- struct ieee80211_rts *uninitialized_var(rts);
++ struct ieee80211_rts *rts;
+
+ switch (dev->fw.hdr_format) {
+ case B43_FW_HDR_598:
+@@ -663,8 +663,8 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
+ const struct b43_rxhdr_fw4 *rxhdr = _rxhdr;
+ __le16 fctl;
+ u16 phystat0, phystat3;
+- u16 uninitialized_var(chanstat), uninitialized_var(mactime);
+- u32 uninitialized_var(macstat);
++ u16 chanstat, mactime;
++ u32 macstat;
+ u16 chanid;
+ int padding, rate_idx;
+
+diff --git a/drivers/net/wireless/broadcom/b43legacy/debugfs.c b/drivers/net/wireless/broadcom/b43legacy/debugfs.c
+index 82ef56ed7ca1b..d3c9a916b44c5 100644
+--- a/drivers/net/wireless/broadcom/b43legacy/debugfs.c
++++ b/drivers/net/wireless/broadcom/b43legacy/debugfs.c
+@@ -203,7 +203,7 @@ static ssize_t b43legacy_debugfs_read(struct file *file, char __user *userbuf,
+ struct b43legacy_wldev *dev;
+ struct b43legacy_debugfs_fops *dfops;
+ struct b43legacy_dfs_file *dfile;
+- ssize_t uninitialized_var(ret);
++ ssize_t ret;
+ char *buf;
+ const size_t bufsize = 1024 * 16; /* 16 KiB buffer */
+ const size_t buforder = get_order(bufsize);
+diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c
+index ef1f1b5d63b10..a147c93583b26 100644
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -2612,7 +2612,7 @@ static void b43legacy_put_phy_into_reset(struct b43legacy_wldev *dev)
+ static int b43legacy_switch_phymode(struct b43legacy_wl *wl,
+ unsigned int new_mode)
+ {
+- struct b43legacy_wldev *uninitialized_var(up_dev);
++ struct b43legacy_wldev *up_dev;
+ struct b43legacy_wldev *down_dev;
+ int err;
+ bool gmode = false;
+diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
+index 5a6ee0b014da0..a01b42c7c07ac 100644
+--- a/drivers/net/wireless/cisco/airo.c
++++ b/drivers/net/wireless/cisco/airo.c
+@@ -6100,8 +6100,11 @@ static int airo_get_rate(struct net_device *dev,
+ {
+ struct airo_info *local = dev->ml_priv;
+ StatusRid status_rid; /* Card status info */
++ int ret;
+
+- readStatusRid(local, &status_rid, 1);
++ ret = readStatusRid(local, &status_rid, 1);
++ if (ret)
++ return -EBUSY;
+
+ vwrq->value = le16_to_cpu(status_rid.currentXmitRate) * 500000;
+ /* If more than one rate, set auto */
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945.c b/drivers/net/wireless/intel/iwlegacy/3945.c
+index 3e568ce2fb208..6703ce95e640e 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945.c
+@@ -2115,7 +2115,7 @@ il3945_txpower_set_from_eeprom(struct il_priv *il)
+
+ /* set tx power value for all OFDM rates */
+ for (rate_idx = 0; rate_idx < IL_OFDM_RATES; rate_idx++) {
+- s32 uninitialized_var(power_idx);
++ s32 power_idx;
+ int rc;
+
+ /* use channel group's clip-power table,
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index 4970c19df582e..2b60473e7bf9c 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -2784,7 +2784,7 @@ il4965_hdl_tx(struct il_priv *il, struct il_rx_buf *rxb)
+ struct ieee80211_tx_info *info;
+ struct il4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
+ u32 status = le32_to_cpu(tx_resp->u.status);
+- int uninitialized_var(tid);
++ int tid;
+ int sta_id;
+ int freed;
+ u8 *qc = NULL;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index 373ace38edab7..83883ce7f55dc 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -2237,7 +2237,7 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ }
+
+ if (iwl_mvm_has_new_rx_api(mvm) && start) {
+- u16 reorder_buf_size = buf_size * sizeof(baid_data->entries[0]);
++ u32 reorder_buf_size = buf_size * sizeof(baid_data->entries[0]);
+
+ /* sparse doesn't like the __align() so don't check */
+ #ifndef __CHECKER__
+diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c
+index a956f965a1e5e..03bfd2482656c 100644
+--- a/drivers/net/wireless/intersil/orinoco/orinoco_cs.c
++++ b/drivers/net/wireless/intersil/orinoco/orinoco_cs.c
+@@ -96,6 +96,7 @@ orinoco_cs_probe(struct pcmcia_device *link)
+ {
+ struct orinoco_private *priv;
+ struct orinoco_pccard *card;
++ int ret;
+
+ priv = alloc_orinocodev(sizeof(*card), &link->dev,
+ orinoco_cs_hard_reset, NULL);
+@@ -107,8 +108,16 @@ orinoco_cs_probe(struct pcmcia_device *link)
+ card->p_dev = link;
+ link->priv = priv;
+
+- return orinoco_cs_config(link);
+-} /* orinoco_cs_attach */
++ ret = orinoco_cs_config(link);
++ if (ret)
++ goto err_free_orinocodev;
++
++ return 0;
++
++err_free_orinocodev:
++ free_orinocodev(priv);
++ return ret;
++}
+
+ static void orinoco_cs_detach(struct pcmcia_device *link)
+ {
+diff --git a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c
+index b60048c95e0a8..011c86e55923e 100644
+--- a/drivers/net/wireless/intersil/orinoco/spectrum_cs.c
++++ b/drivers/net/wireless/intersil/orinoco/spectrum_cs.c
+@@ -157,6 +157,7 @@ spectrum_cs_probe(struct pcmcia_device *link)
+ {
+ struct orinoco_private *priv;
+ struct orinoco_pccard *card;
++ int ret;
+
+ priv = alloc_orinocodev(sizeof(*card), &link->dev,
+ spectrum_cs_hard_reset,
+@@ -169,8 +170,16 @@ spectrum_cs_probe(struct pcmcia_device *link)
+ card->p_dev = link;
+ link->priv = priv;
+
+- return spectrum_cs_config(link);
+-} /* spectrum_cs_attach */
++ ret = spectrum_cs_config(link);
++ if (ret)
++ goto err_free_orinocodev;
++
++ return 0;
++
++err_free_orinocodev:
++ free_orinocodev(priv);
++ return ret;
++}
+
+ static void spectrum_cs_detach(struct pcmcia_device *link)
+ {
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index c9f6cd2919699..4f0e78ae3dbd0 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -2208,9 +2208,9 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
+
+ if (nd_config) {
+ adapter->nd_info =
+- kzalloc(sizeof(struct cfg80211_wowlan_nd_match) +
+- sizeof(struct cfg80211_wowlan_nd_match *) *
+- scan_rsp->number_of_sets, GFP_ATOMIC);
++ kzalloc(struct_size(adapter->nd_info, matches,
++ scan_rsp->number_of_sets),
++ GFP_ATOMIC);
+
+ if (adapter->nd_info)
+ adapter->nd_info->n_matches = scan_rsp->number_of_sets;
+diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
+index 8704bae39e1bf..edc990d099789 100644
+--- a/drivers/net/wireless/ray_cs.c
++++ b/drivers/net/wireless/ray_cs.c
+@@ -282,13 +282,14 @@ static int ray_probe(struct pcmcia_device *p_dev)
+ {
+ ray_dev_t *local;
+ struct net_device *dev;
++ int ret;
+
+ dev_dbg(&p_dev->dev, "ray_attach()\n");
+
+ /* Allocate space for private device-specific data */
+ dev = alloc_etherdev(sizeof(ray_dev_t));
+ if (!dev)
+- goto fail_alloc_dev;
++ return -ENOMEM;
+
+ local = netdev_priv(dev);
+ local->finder = p_dev;
+@@ -325,11 +326,16 @@ static int ray_probe(struct pcmcia_device *p_dev)
+ timer_setup(&local->timer, NULL, 0);
+
+ this_device = p_dev;
+- return ray_config(p_dev);
++ ret = ray_config(p_dev);
++ if (ret)
++ goto err_free_dev;
++
++ return 0;
+
+-fail_alloc_dev:
+- return -ENOMEM;
+-} /* ray_attach */
++err_free_dev:
++ free_netdev(dev);
++ return ret;
++}
+
+ static void ray_detach(struct pcmcia_device *link)
+ {
+@@ -1651,38 +1657,34 @@ static void authenticate_timeout(struct timer_list *t)
+ /*===========================================================================*/
+ static int parse_addr(char *in_str, UCHAR *out)
+ {
++ int i, k;
+ int len;
+- int i, j, k;
+- int status;
+
+ if (in_str == NULL)
+ return 0;
+- if ((len = strlen(in_str)) < 2)
++ len = strnlen(in_str, ADDRLEN * 2 + 1) - 1;
++ if (len < 1)
+ return 0;
+ memset(out, 0, ADDRLEN);
+
+- status = 1;
+- j = len - 1;
+- if (j > 12)
+- j = 12;
+ i = 5;
+
+- while (j > 0) {
+- if ((k = hex_to_bin(in_str[j--])) != -1)
++ while (len > 0) {
++ if ((k = hex_to_bin(in_str[len--])) != -1)
+ out[i] = k;
+ else
+ return 0;
+
+- if (j == 0)
++ if (len == 0)
+ break;
+- if ((k = hex_to_bin(in_str[j--])) != -1)
++ if ((k = hex_to_bin(in_str[len--])) != -1)
+ out[i] += k << 4;
+ else
+ return 0;
+ if (!i--)
+ break;
+ }
+- return status;
++ return 1;
+ }
+
+ /*===========================================================================*/
+diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+index 48efe83c58d89..409a3e8305763 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -1368,9 +1368,6 @@ static void rsi_shutdown(struct device *dev)
+ if (sdev->write_fail)
+ rsi_dbg(INFO_ZONE, "###### Device is not ready #######\n");
+
+- if (rsi_set_sdio_pm_caps(adapter))
+- rsi_dbg(INFO_ZONE, "Setting power management caps failed\n");
+-
+ rsi_dbg(INFO_ZONE, "***** RSI module shut down *****\n");
+ }
+
+diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
+index cfde9b94b4b60..4380c5d8fdd27 100644
+--- a/drivers/net/wireless/wl3501_cs.c
++++ b/drivers/net/wireless/wl3501_cs.c
+@@ -133,8 +133,8 @@ static const struct {
+
+ /**
+ * iw_valid_channel - validate channel in regulatory domain
+- * @reg_comain - regulatory domain
+- * @channel - channel to validate
++ * @reg_domain: regulatory domain
++ * @channel: channel to validate
+ *
+ * Returns 0 if invalid in the specified regulatory domain, non-zero if valid.
+ */
+@@ -153,7 +153,7 @@ static int iw_valid_channel(int reg_domain, int channel)
+
+ /**
+ * iw_default_channel - get default channel for a regulatory domain
+- * @reg_comain - regulatory domain
++ * @reg_domain: regulatory domain
+ *
+ * Returns the default channel for a regulatory domain
+ */
+@@ -236,6 +236,7 @@ static int wl3501_get_flash_mac_addr(struct wl3501_card *this)
+
+ /**
+ * wl3501_set_to_wla - Move 'size' bytes from PC to card
++ * @this: Card
+ * @dest: Card addressing space
+ * @src: PC addressing space
+ * @size: Bytes to move
+@@ -258,6 +259,7 @@ static void wl3501_set_to_wla(struct wl3501_card *this, u16 dest, void *src,
+
+ /**
+ * wl3501_get_from_wla - Move 'size' bytes from card to PC
++ * @this: Card
+ * @src: Card addressing space
+ * @dest: PC addressing space
+ * @size: Bytes to move
+@@ -454,12 +456,10 @@ out:
+
+ /**
+ * wl3501_send_pkt - Send a packet.
+- * @this - card
+- *
+- * Send a packet.
+- *
+- * data = Ethernet raw frame. (e.g. data[0] - data[5] is Dest MAC Addr,
++ * @this: Card
++ * @data: Ethernet raw frame. (e.g. data[0] - data[5] is Dest MAC Addr,
+ * data[6] - data[11] is Src MAC Addr)
++ * @len: Packet length
+ * Ref: IEEE 802.11
+ */
+ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len)
+@@ -722,7 +722,7 @@ static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr)
+
+ /**
+ * wl3501_block_interrupt - Mask interrupt from SUTRO
+- * @this - card
++ * @this: Card
+ *
+ * Mask interrupt from SUTRO. (i.e. SUTRO cannot interrupt the HOST)
+ * Return: 1 if interrupt is originally enabled
+@@ -739,7 +739,7 @@ static int wl3501_block_interrupt(struct wl3501_card *this)
+
+ /**
+ * wl3501_unblock_interrupt - Enable interrupt from SUTRO
+- * @this - card
++ * @this: Card
+ *
+ * Enable interrupt from SUTRO. (i.e. SUTRO can interrupt the HOST)
+ * Return: 1 if interrupt is originally enabled
+@@ -1113,8 +1113,8 @@ static inline void wl3501_ack_interrupt(struct wl3501_card *this)
+
+ /**
+ * wl3501_interrupt - Hardware interrupt from card.
+- * @irq - Interrupt number
+- * @dev_id - net_device
++ * @irq: Interrupt number
++ * @dev_id: net_device
+ *
+ * We must acknowledge the interrupt as soon as possible, and block the
+ * interrupt from the same card immediately to prevent re-entry.
+@@ -1252,7 +1252,7 @@ static int wl3501_close(struct net_device *dev)
+
+ /**
+ * wl3501_reset - Reset the SUTRO.
+- * @dev - network device
++ * @dev: network device
+ *
+ * It is almost the same as wl3501_open(). In fact, we may just wl3501_close()
+ * and wl3501_open() again, but I wouldn't like to free_irq() when the driver
+@@ -1415,7 +1415,7 @@ static struct iw_statistics *wl3501_get_wireless_stats(struct net_device *dev)
+
+ /**
+ * wl3501_detach - deletes a driver "instance"
+- * @link - FILL_IN
++ * @link: FILL_IN
+ *
+ * This deletes a driver "instance". The device is de-registered with Card
+ * Services. If it has been released, all local data structures are freed.
+@@ -1436,9 +1436,7 @@ static void wl3501_detach(struct pcmcia_device *link)
+ wl3501_release(link);
+
+ unregister_netdev(dev);
+-
+- if (link->priv)
+- free_netdev(link->priv);
++ free_netdev(dev);
+ }
+
+ static int wl3501_get_name(struct net_device *dev, struct iw_request_info *info,
+@@ -1865,6 +1863,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
+ {
+ struct net_device *dev;
+ struct wl3501_card *this;
++ int ret;
+
+ /* The io structure describes IO port mapping */
+ p_dev->resource[0]->end = 16;
+@@ -1876,8 +1875,7 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
+
+ dev = alloc_etherdev(sizeof(struct wl3501_card));
+ if (!dev)
+- goto out_link;
+-
++ return -ENOMEM;
+
+ dev->netdev_ops = &wl3501_netdev_ops;
+ dev->watchdog_timeo = 5 * HZ;
+@@ -1890,9 +1888,15 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
+ netif_stop_queue(dev);
+ p_dev->priv = dev;
+
+- return wl3501_config(p_dev);
+-out_link:
+- return -ENOMEM;
++ ret = wl3501_config(p_dev);
++ if (ret)
++ goto out_free_etherdev;
++
++ return 0;
++
++out_free_etherdev:
++ free_netdev(dev);
++ return ret;
+ }
+
+ static int wl3501_config(struct pcmcia_device *link)
+@@ -1948,8 +1952,7 @@ static int wl3501_config(struct pcmcia_device *link)
+ goto failed;
+ }
+
+- for (i = 0; i < 6; i++)
+- dev->dev_addr[i] = ((char *)&this->mac_addr)[i];
++ eth_hw_addr_set(dev, this->mac_addr);
+
+ /* print probe information */
+ printk(KERN_INFO "%s: wl3501 @ 0x%3.3x, IRQ %d, "
+diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
+index 0b1fbb5dba9b6..7de7616803935 100644
+--- a/drivers/ntb/hw/amd/ntb_hw_amd.c
++++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
+@@ -1139,12 +1139,17 @@ static struct pci_driver amd_ntb_pci_driver = {
+
+ static int __init amd_ntb_pci_driver_init(void)
+ {
++ int ret;
+ pr_info("%s %s\n", NTB_DESC, NTB_VER);
+
+ if (debugfs_initialized())
+ debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
+
+- return pci_register_driver(&amd_ntb_pci_driver);
++ ret = pci_register_driver(&amd_ntb_pci_driver);
++ if (ret)
++ debugfs_remove_recursive(debugfs_dir);
++
++ return ret;
+ }
+ module_init(amd_ntb_pci_driver_init);
+
+diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
+index a67ef23e81bca..82e08f583980b 100644
+--- a/drivers/ntb/hw/idt/ntb_hw_idt.c
++++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
+@@ -2692,6 +2692,7 @@ static struct pci_driver idt_pci_driver = {
+
+ static int __init idt_pci_driver_init(void)
+ {
++ int ret;
+ pr_info("%s %s\n", NTB_DESC, NTB_VER);
+
+ /* Create the top DebugFS directory if the FS is initialized */
+@@ -2699,7 +2700,11 @@ static int __init idt_pci_driver_init(void)
+ dbgfs_topdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
+
+ /* Register the NTB hardware driver to handle the PCI device */
+- return pci_register_driver(&idt_pci_driver);
++ ret = pci_register_driver(&idt_pci_driver);
++ if (ret)
++ debugfs_remove_recursive(dbgfs_topdir);
++
++ return ret;
+ }
+ module_init(idt_pci_driver_init);
+
+diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c
+index 2ad263f708da7..084bd1d1ac1dc 100644
+--- a/drivers/ntb/hw/intel/ntb_hw_gen1.c
++++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c
+@@ -2052,12 +2052,17 @@ static struct pci_driver intel_ntb_pci_driver = {
+
+ static int __init intel_ntb_pci_driver_init(void)
+ {
++ int ret;
+ pr_info("%s %s\n", NTB_DESC, NTB_VER);
+
+ if (debugfs_initialized())
+ debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
+
+- return pci_register_driver(&intel_ntb_pci_driver);
++ ret = pci_register_driver(&intel_ntb_pci_driver);
++ if (ret)
++ debugfs_remove_recursive(debugfs_dir);
++
++ return ret;
+ }
+ module_init(intel_ntb_pci_driver_init);
+
+diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
+index 9398959664769..2d647a1cd0ee5 100644
+--- a/drivers/ntb/ntb_transport.c
++++ b/drivers/ntb/ntb_transport.c
+@@ -393,7 +393,7 @@ int ntb_transport_register_client_dev(char *device_name)
+
+ rc = device_register(dev);
+ if (rc) {
+- kfree(client_dev);
++ put_device(dev);
+ goto err;
+ }
+
+diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
+index 6301aa413c3b8..1f64146546221 100644
+--- a/drivers/ntb/test/ntb_tool.c
++++ b/drivers/ntb/test/ntb_tool.c
+@@ -998,6 +998,8 @@ static int tool_init_mws(struct tool_ctx *tc)
+ tc->peers[pidx].outmws =
+ devm_kcalloc(&tc->ntb->dev, tc->peers[pidx].outmw_cnt,
+ sizeof(*tc->peers[pidx].outmws), GFP_KERNEL);
++ if (tc->peers[pidx].outmws == NULL)
++ return -ENOMEM;
+
+ for (widx = 0; widx < tc->peers[pidx].outmw_cnt; widx++) {
+ tc->peers[pidx].outmws[widx].pidx = pidx;
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 133fad284c9fa..ea0cd2401d6b7 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -758,6 +758,8 @@ static int qcom_pcie_get_resources_2_4_0(struct qcom_pcie *pcie)
+ if (IS_ERR(res->phy_ahb_reset))
+ return PTR_ERR(res->phy_ahb_reset);
+
++ dw_pcie_dbi_ro_wr_dis(pci);
++
+ return 0;
+ }
+
+diff --git a/drivers/pci/controller/pcie-rockchip-ep.c b/drivers/pci/controller/pcie-rockchip-ep.c
+index 06dd2ab73b6ee..4d3a589af1296 100644
+--- a/drivers/pci/controller/pcie-rockchip-ep.c
++++ b/drivers/pci/controller/pcie-rockchip-ep.c
+@@ -124,6 +124,7 @@ static void rockchip_pcie_prog_ep_ob_atu(struct rockchip_pcie *rockchip, u8 fn,
+ static int rockchip_pcie_ep_write_header(struct pci_epc *epc, u8 fn,
+ struct pci_epf_header *hdr)
+ {
++ u32 reg;
+ struct rockchip_pcie_ep *ep = epc_get_drvdata(epc);
+ struct rockchip_pcie *rockchip = &ep->rockchip;
+
+@@ -136,8 +137,9 @@ static int rockchip_pcie_ep_write_header(struct pci_epc *epc, u8 fn,
+ PCIE_CORE_CONFIG_VENDOR);
+ }
+
+- rockchip_pcie_write(rockchip, hdr->deviceid << 16,
+- ROCKCHIP_PCIE_EP_FUNC_BASE(fn) + PCI_VENDOR_ID);
++ reg = rockchip_pcie_read(rockchip, PCIE_EP_CONFIG_DID_VID);
++ reg = (reg & 0xFFFF) | (hdr->deviceid << 16);
++ rockchip_pcie_write(rockchip, reg, PCIE_EP_CONFIG_DID_VID);
+
+ rockchip_pcie_write(rockchip,
+ hdr->revid |
+@@ -311,15 +313,15 @@ static int rockchip_pcie_ep_set_msi(struct pci_epc *epc, u8 fn,
+ {
+ struct rockchip_pcie_ep *ep = epc_get_drvdata(epc);
+ struct rockchip_pcie *rockchip = &ep->rockchip;
+- u16 flags;
++ u32 flags;
+
+ flags = rockchip_pcie_read(rockchip,
+ ROCKCHIP_PCIE_EP_FUNC_BASE(fn) +
+ ROCKCHIP_PCIE_EP_MSI_CTRL_REG);
+ flags &= ~ROCKCHIP_PCIE_EP_MSI_CTRL_MMC_MASK;
+ flags |=
+- ((multi_msg_cap << 1) << ROCKCHIP_PCIE_EP_MSI_CTRL_MMC_OFFSET) |
+- PCI_MSI_FLAGS_64BIT;
++ (multi_msg_cap << ROCKCHIP_PCIE_EP_MSI_CTRL_MMC_OFFSET) |
++ (PCI_MSI_FLAGS_64BIT << ROCKCHIP_PCIE_EP_MSI_FLAGS_OFFSET);
+ flags &= ~ROCKCHIP_PCIE_EP_MSI_CTRL_MASK_MSI_CAP;
+ rockchip_pcie_write(rockchip, flags,
+ ROCKCHIP_PCIE_EP_FUNC_BASE(fn) +
+@@ -331,7 +333,7 @@ static int rockchip_pcie_ep_get_msi(struct pci_epc *epc, u8 fn)
+ {
+ struct rockchip_pcie_ep *ep = epc_get_drvdata(epc);
+ struct rockchip_pcie *rockchip = &ep->rockchip;
+- u16 flags;
++ u32 flags;
+
+ flags = rockchip_pcie_read(rockchip,
+ ROCKCHIP_PCIE_EP_FUNC_BASE(fn) +
+@@ -344,48 +346,25 @@ static int rockchip_pcie_ep_get_msi(struct pci_epc *epc, u8 fn)
+ }
+
+ static void rockchip_pcie_ep_assert_intx(struct rockchip_pcie_ep *ep, u8 fn,
+- u8 intx, bool is_asserted)
++ u8 intx, bool do_assert)
+ {
+ struct rockchip_pcie *rockchip = &ep->rockchip;
+- u32 r = ep->max_regions - 1;
+- u32 offset;
+- u32 status;
+- u8 msg_code;
+-
+- if (unlikely(ep->irq_pci_addr != ROCKCHIP_PCIE_EP_PCI_LEGACY_IRQ_ADDR ||
+- ep->irq_pci_fn != fn)) {
+- rockchip_pcie_prog_ep_ob_atu(rockchip, fn, r,
+- AXI_WRAPPER_NOR_MSG,
+- ep->irq_phys_addr, 0, 0);
+- ep->irq_pci_addr = ROCKCHIP_PCIE_EP_PCI_LEGACY_IRQ_ADDR;
+- ep->irq_pci_fn = fn;
+- }
+
+ intx &= 3;
+- if (is_asserted) {
++
++ if (do_assert) {
+ ep->irq_pending |= BIT(intx);
+- msg_code = ROCKCHIP_PCIE_MSG_CODE_ASSERT_INTA + intx;
++ rockchip_pcie_write(rockchip,
++ PCIE_CLIENT_INT_IN_ASSERT |
++ PCIE_CLIENT_INT_PEND_ST_PEND,
++ PCIE_CLIENT_LEGACY_INT_CTRL);
+ } else {
+ ep->irq_pending &= ~BIT(intx);
+- msg_code = ROCKCHIP_PCIE_MSG_CODE_DEASSERT_INTA + intx;
++ rockchip_pcie_write(rockchip,
++ PCIE_CLIENT_INT_IN_DEASSERT |
++ PCIE_CLIENT_INT_PEND_ST_NORMAL,
++ PCIE_CLIENT_LEGACY_INT_CTRL);
+ }
+-
+- status = rockchip_pcie_read(rockchip,
+- ROCKCHIP_PCIE_EP_FUNC_BASE(fn) +
+- ROCKCHIP_PCIE_EP_CMD_STATUS);
+- status &= ROCKCHIP_PCIE_EP_CMD_STATUS_IS;
+-
+- if ((status != 0) ^ (ep->irq_pending != 0)) {
+- status ^= ROCKCHIP_PCIE_EP_CMD_STATUS_IS;
+- rockchip_pcie_write(rockchip, status,
+- ROCKCHIP_PCIE_EP_FUNC_BASE(fn) +
+- ROCKCHIP_PCIE_EP_CMD_STATUS);
+- }
+-
+- offset =
+- ROCKCHIP_PCIE_MSG_ROUTING(ROCKCHIP_PCIE_MSG_ROUTING_LOCAL_INTX) |
+- ROCKCHIP_PCIE_MSG_CODE(msg_code) | ROCKCHIP_PCIE_MSG_NO_DATA;
+- writel(0, ep->irq_cpu_addr + offset);
+ }
+
+ static int rockchip_pcie_ep_send_legacy_irq(struct rockchip_pcie_ep *ep, u8 fn,
+@@ -415,7 +394,7 @@ static int rockchip_pcie_ep_send_msi_irq(struct rockchip_pcie_ep *ep, u8 fn,
+ u8 interrupt_num)
+ {
+ struct rockchip_pcie *rockchip = &ep->rockchip;
+- u16 flags, mme, data, data_mask;
++ u32 flags, mme, data, data_mask;
+ u8 msi_count;
+ u64 pci_addr, pci_addr_mask = 0xff;
+
+@@ -620,6 +599,9 @@ static int rockchip_pcie_ep_probe(struct platform_device *pdev)
+
+ ep->irq_pci_addr = ROCKCHIP_PCIE_EP_DUMMY_IRQ_ADDR;
+
++ rockchip_pcie_write(rockchip, PCIE_CLIENT_CONF_ENABLE,
++ PCIE_CLIENT_CONFIG);
++
+ return 0;
+ err_epc_mem_exit:
+ pci_epc_mem_exit(epc);
+diff --git a/drivers/pci/controller/pcie-rockchip.c b/drivers/pci/controller/pcie-rockchip.c
+index c53d1322a3d6c..b047437605cb2 100644
+--- a/drivers/pci/controller/pcie-rockchip.c
++++ b/drivers/pci/controller/pcie-rockchip.c
+@@ -14,6 +14,7 @@
+ #include <linux/clk.h>
+ #include <linux/delay.h>
+ #include <linux/gpio/consumer.h>
++#include <linux/iopoll.h>
+ #include <linux/of_pci.h>
+ #include <linux/phy/phy.h>
+ #include <linux/platform_device.h>
+@@ -154,6 +155,12 @@ int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip)
+ }
+ EXPORT_SYMBOL_GPL(rockchip_pcie_parse_dt);
+
++#define rockchip_pcie_read_addr(addr) rockchip_pcie_read(rockchip, addr)
++/* 100 ms max wait time for PHY PLLs to lock */
++#define RK_PHY_PLL_LOCK_TIMEOUT_US 100000
++/* Sleep should be less than 20ms */
++#define RK_PHY_PLL_LOCK_SLEEP_US 1000
++
+ int rockchip_pcie_init_port(struct rockchip_pcie *rockchip)
+ {
+ struct device *dev = rockchip->dev;
+@@ -255,6 +262,16 @@ int rockchip_pcie_init_port(struct rockchip_pcie *rockchip)
+ }
+ }
+
++ err = readx_poll_timeout(rockchip_pcie_read_addr,
++ PCIE_CLIENT_SIDE_BAND_STATUS,
++ regs, !(regs & PCIE_CLIENT_PHY_ST),
++ RK_PHY_PLL_LOCK_SLEEP_US,
++ RK_PHY_PLL_LOCK_TIMEOUT_US);
++ if (err) {
++ dev_err(dev, "PHY PLLs could not lock, %d\n", err);
++ goto err_power_off_phy;
++ }
++
+ /*
+ * Please don't reorder the deassert sequence of the following
+ * four reset pins.
+diff --git a/drivers/pci/controller/pcie-rockchip.h b/drivers/pci/controller/pcie-rockchip.h
+index 8e87a059ce73d..1c45b3c32151c 100644
+--- a/drivers/pci/controller/pcie-rockchip.h
++++ b/drivers/pci/controller/pcie-rockchip.h
+@@ -37,6 +37,13 @@
+ #define PCIE_CLIENT_MODE_EP HIWORD_UPDATE(0x0040, 0)
+ #define PCIE_CLIENT_GEN_SEL_1 HIWORD_UPDATE(0x0080, 0)
+ #define PCIE_CLIENT_GEN_SEL_2 HIWORD_UPDATE_BIT(0x0080)
++#define PCIE_CLIENT_LEGACY_INT_CTRL (PCIE_CLIENT_BASE + 0x0c)
++#define PCIE_CLIENT_INT_IN_ASSERT HIWORD_UPDATE_BIT(0x0002)
++#define PCIE_CLIENT_INT_IN_DEASSERT HIWORD_UPDATE(0x0002, 0)
++#define PCIE_CLIENT_INT_PEND_ST_PEND HIWORD_UPDATE_BIT(0x0001)
++#define PCIE_CLIENT_INT_PEND_ST_NORMAL HIWORD_UPDATE(0x0001, 0)
++#define PCIE_CLIENT_SIDE_BAND_STATUS (PCIE_CLIENT_BASE + 0x20)
++#define PCIE_CLIENT_PHY_ST BIT(12)
+ #define PCIE_CLIENT_DEBUG_OUT_0 (PCIE_CLIENT_BASE + 0x3c)
+ #define PCIE_CLIENT_DEBUG_LTSSM_MASK GENMASK(5, 0)
+ #define PCIE_CLIENT_DEBUG_LTSSM_L1 0x18
+@@ -132,6 +139,8 @@
+ #define PCIE_RC_RP_ATS_BASE 0x400000
+ #define PCIE_RC_CONFIG_NORMAL_BASE 0x800000
+ #define PCIE_RC_CONFIG_BASE 0xa00000
++#define PCIE_EP_CONFIG_BASE 0xa00000
++#define PCIE_EP_CONFIG_DID_VID (PCIE_EP_CONFIG_BASE + 0x00)
+ #define PCIE_RC_CONFIG_RID_CCR (PCIE_RC_CONFIG_BASE + 0x08)
+ #define PCIE_RC_CONFIG_SCC_SHIFT 16
+ #define PCIE_RC_CONFIG_DCR (PCIE_RC_CONFIG_BASE + 0xc4)
+@@ -223,6 +232,7 @@
+ #define ROCKCHIP_PCIE_EP_CMD_STATUS 0x4
+ #define ROCKCHIP_PCIE_EP_CMD_STATUS_IS BIT(19)
+ #define ROCKCHIP_PCIE_EP_MSI_CTRL_REG 0x90
++#define ROCKCHIP_PCIE_EP_MSI_FLAGS_OFFSET 16
+ #define ROCKCHIP_PCIE_EP_MSI_CTRL_MMC_OFFSET 17
+ #define ROCKCHIP_PCIE_EP_MSI_CTRL_MMC_MASK GENMASK(19, 17)
+ #define ROCKCHIP_PCIE_EP_MSI_CTRL_MME_OFFSET 20
+@@ -230,7 +240,6 @@
+ #define ROCKCHIP_PCIE_EP_MSI_CTRL_ME BIT(16)
+ #define ROCKCHIP_PCIE_EP_MSI_CTRL_MASK_MSI_CAP BIT(24)
+ #define ROCKCHIP_PCIE_EP_DUMMY_IRQ_ADDR 0x1
+-#define ROCKCHIP_PCIE_EP_PCI_LEGACY_IRQ_ADDR 0x3
+ #define ROCKCHIP_PCIE_EP_FUNC_BASE(fn) (((fn) << 12) & GENMASK(19, 12))
+ #define ROCKCHIP_PCIE_AT_IB_EP_FUNC_BAR_ADDR0(fn, bar) \
+ (PCIE_RC_RP_ATS_BASE + 0x0840 + (fn) * 0x0040 + (bar) * 0x0008)
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 7ac6f4710908b..c8326c7b468fa 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2521,13 +2521,13 @@ static const struct dmi_system_id bridge_d3_blacklist[] = {
+ {
+ /*
+ * Downstream device is not accessible after putting a root port
+- * into D3cold and back into D0 on Elo i2.
++ * into D3cold and back into D0 on Elo Continental Z2 board
+ */
+- .ident = "Elo i2",
++ .ident = "Elo Continental Z2",
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Elo Touch Solutions"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Elo i2"),
+- DMI_MATCH(DMI_PRODUCT_VERSION, "RevB"),
++ DMI_MATCH(DMI_BOARD_VENDOR, "Elo Touch Solutions"),
++ DMI_MATCH(DMI_BOARD_NAME, "Geminilake"),
++ DMI_MATCH(DMI_BOARD_VERSION, "Continental Z2"),
+ },
+ },
+ #endif
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 279f9f0197b01..eec62f7377f48 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -203,12 +203,39 @@ static void pcie_clkpm_cap_init(struct pcie_link_state *link, int blacklist)
+ link->clkpm_disable = blacklist ? 1 : 0;
+ }
+
+-static bool pcie_retrain_link(struct pcie_link_state *link)
++static int pcie_wait_for_retrain(struct pci_dev *pdev)
++{
++ unsigned long end_jiffies;
++ u16 reg16;
++
++ /* Wait for Link Training to be cleared by hardware */
++ end_jiffies = jiffies + LINK_RETRAIN_TIMEOUT;
++ do {
++ pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, ®16);
++ if (!(reg16 & PCI_EXP_LNKSTA_LT))
++ return 0;
++ msleep(1);
++ } while (time_before(jiffies, end_jiffies));
++
++ return -ETIMEDOUT;
++}
++
++static int pcie_retrain_link(struct pcie_link_state *link)
+ {
+ struct pci_dev *parent = link->pdev;
+- unsigned long start_jiffies;
++ int rc;
+ u16 reg16;
+
++ /*
++ * Ensure the updated LNKCTL parameters are used during link
++ * training by checking that there is no ongoing link training to
++ * avoid LTSSM race as recommended in Implementation Note at the
++ * end of PCIe r6.0.1 sec 7.5.3.7.
++ */
++ rc = pcie_wait_for_retrain(parent);
++ if (rc)
++ return rc;
++
+ pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16);
+ reg16 |= PCI_EXP_LNKCTL_RL;
+ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
+@@ -222,17 +249,7 @@ static bool pcie_retrain_link(struct pcie_link_state *link)
+ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
+ }
+
+- /* Wait for link training end. Break out after waiting for timeout */
+- start_jiffies = jiffies;
+- for (;;) {
+- pcie_capability_read_word(parent, PCI_EXP_LNKSTA, ®16);
+- if (!(reg16 & PCI_EXP_LNKSTA_LT))
+- break;
+- if (time_after(jiffies, start_jiffies + LINK_RETRAIN_TIMEOUT))
+- break;
+- msleep(1);
+- }
+- return !(reg16 & PCI_EXP_LNKSTA_LT);
++ return pcie_wait_for_retrain(parent);
+ }
+
+ /*
+@@ -301,15 +318,15 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
+ reg16 &= ~PCI_EXP_LNKCTL_CCC;
+ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
+
+- if (pcie_retrain_link(link))
+- return;
++ if (pcie_retrain_link(link)) {
+
+- /* Training failed. Restore common clock configurations */
+- pci_err(parent, "ASPM: Could not configure common clock\n");
+- list_for_each_entry(child, &linkbus->devices, bus_list)
+- pcie_capability_write_word(child, PCI_EXP_LNKCTL,
++ /* Training failed. Restore common clock configurations */
++ pci_err(parent, "ASPM: Could not configure common clock\n");
++ list_for_each_entry(child, &linkbus->devices, bus_list)
++ pcie_capability_write_word(child, PCI_EXP_LNKCTL,
+ child_reg[PCI_FUNC(child->devfn)]);
+- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, parent_reg);
++ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, parent_reg);
++ }
+ }
+
+ /* Convert L0s latency encoding to ns */
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index afa6acb58eec8..fa9d6c8f1cf89 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4074,6 +4074,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9220,
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c49 */
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230,
+ quirk_dma_func1_alias);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9235,
++ quirk_dma_func1_alias);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0642,
+ quirk_dma_func1_alias);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0645,
+diff --git a/drivers/phy/hisilicon/phy-hisi-inno-usb2.c b/drivers/phy/hisilicon/phy-hisi-inno-usb2.c
+index 524381249a2b8..b51e19402ab0c 100644
+--- a/drivers/phy/hisilicon/phy-hisi-inno-usb2.c
++++ b/drivers/phy/hisilicon/phy-hisi-inno-usb2.c
+@@ -167,7 +167,7 @@ static int hisi_inno_phy_probe(struct platform_device *pdev)
+ phy_set_drvdata(phy, &priv->ports[i]);
+ i++;
+
+- if (i > INNO_PHY_PORT_NUM) {
++ if (i >= INNO_PHY_PORT_NUM) {
+ dev_warn(dev, "Support %d ports in maximum\n", i);
+ break;
+ }
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index 25932d2a71547..ef8eb42e4d383 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1032,11 +1032,6 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned pin,
+
+ break;
+
+- case PIN_CONFIG_DRIVE_OPEN_DRAIN:
+- if (!(ctrl1 & CHV_PADCTRL1_ODEN))
+- return -EINVAL;
+- break;
+-
+ case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: {
+ u32 cfg;
+
+@@ -1046,6 +1041,16 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned pin,
+ return -EINVAL;
+
+ break;
++
++ case PIN_CONFIG_DRIVE_PUSH_PULL:
++ if (ctrl1 & CHV_PADCTRL1_ODEN)
++ return -EINVAL;
++ break;
++
++ case PIN_CONFIG_DRIVE_OPEN_DRAIN:
++ if (!(ctrl1 & CHV_PADCTRL1_ODEN))
++ return -EINVAL;
++ break;
+ }
+
+ default:
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index a44902b140879..c140ee16fe7c8 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -127,6 +127,14 @@ static int amd_gpio_set_debounce(struct gpio_chip *gc, unsigned offset,
+ struct amd_gpio *gpio_dev = gpiochip_get_data(gc);
+
+ raw_spin_lock_irqsave(&gpio_dev->lock, flags);
++
++ /* Use special handling for Pin0 debounce */
++ if (offset == 0) {
++ pin_reg = readl(gpio_dev->base + WAKE_INT_MASTER_REG);
++ if (pin_reg & INTERNAL_GPIO0_DEBOUNCE)
++ debounce = 0;
++ }
++
+ pin_reg = readl(gpio_dev->base + offset * 4);
+
+ if (debounce) {
+@@ -182,18 +190,6 @@ static int amd_gpio_set_debounce(struct gpio_chip *gc, unsigned offset,
+ return ret;
+ }
+
+-static int amd_gpio_set_config(struct gpio_chip *gc, unsigned offset,
+- unsigned long config)
+-{
+- u32 debounce;
+-
+- if (pinconf_to_config_param(config) != PIN_CONFIG_INPUT_DEBOUNCE)
+- return -ENOTSUPP;
+-
+- debounce = pinconf_to_config_argument(config);
+- return amd_gpio_set_debounce(gc, offset, debounce);
+-}
+-
+ #ifdef CONFIG_DEBUG_FS
+ static void amd_gpio_dbg_show(struct seq_file *s, struct gpio_chip *gc)
+ {
+@@ -216,6 +212,7 @@ static void amd_gpio_dbg_show(struct seq_file *s, struct gpio_chip *gc)
+ char *output_value;
+ char *output_enable;
+
++ seq_printf(s, "WAKE_INT_MASTER_REG: 0x%08x\n", readl(gpio_dev->base + WAKE_INT_MASTER_REG));
+ for (bank = 0; bank < gpio_dev->hwbank_num; bank++) {
+ seq_printf(s, "GPIO bank%d\t", bank);
+
+@@ -677,7 +674,7 @@ static int amd_pinconf_get(struct pinctrl_dev *pctldev,
+ }
+
+ static int amd_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,
+- unsigned long *configs, unsigned num_configs)
++ unsigned long *configs, unsigned int num_configs)
+ {
+ int i;
+ u32 arg;
+@@ -767,6 +764,20 @@ static int amd_pinconf_group_set(struct pinctrl_dev *pctldev,
+ return 0;
+ }
+
++static int amd_gpio_set_config(struct gpio_chip *gc, unsigned int pin,
++ unsigned long config)
++{
++ struct amd_gpio *gpio_dev = gpiochip_get_data(gc);
++
++ if (pinconf_to_config_param(config) == PIN_CONFIG_INPUT_DEBOUNCE) {
++ u32 debounce = pinconf_to_config_argument(config);
++
++ return amd_gpio_set_debounce(gc, pin, debounce);
++ }
++
++ return amd_pinconf_set(gpio_dev->pctrl, pin, &config, 1);
++}
++
+ static const struct pinconf_ops amd_pinconf_ops = {
+ .pin_config_get = amd_pinconf_get,
+ .pin_config_set = amd_pinconf_set,
+@@ -794,9 +805,9 @@ static void amd_gpio_irq_init(struct amd_gpio *gpio_dev)
+
+ raw_spin_lock_irqsave(&gpio_dev->lock, flags);
+
+- pin_reg = readl(gpio_dev->base + i * 4);
++ pin_reg = readl(gpio_dev->base + pin * 4);
+ pin_reg &= ~mask;
+- writel(pin_reg, gpio_dev->base + i * 4);
++ writel(pin_reg, gpio_dev->base + pin * 4);
+
+ raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
+ }
+diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h
+index 91da7527f0020..0f7c02bc9044a 100644
+--- a/drivers/pinctrl/pinctrl-amd.h
++++ b/drivers/pinctrl/pinctrl-amd.h
+@@ -21,6 +21,7 @@
+ #define AMD_GPIO_PINS_BANK3 32
+
+ #define WAKE_INT_MASTER_REG 0xfc
++#define INTERNAL_GPIO0_DEBOUNCE (1 << 15)
+ #define EOI_MASK (1 << 29)
+
+ #define WAKE_INT_STATUS_REG0 0x2f8
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index 5b883eb49ce92..cbbda24bf6a80 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -1024,6 +1024,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
+ /* Pin naming convention: P(bank_name)(bank_pin_number). */
+ pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d",
+ bank + 'A', line);
++ if (!pin_desc[i].name)
++ return -ENOMEM;
+
+ group->name = group_names[i] = pin_desc[i].name;
+ group->pin = pin_desc[i].number;
+diff --git a/drivers/platform/x86/hdaps.c b/drivers/platform/x86/hdaps.c
+index c26baf77938ea..96cc87d123292 100644
+--- a/drivers/platform/x86/hdaps.c
++++ b/drivers/platform/x86/hdaps.c
+@@ -378,7 +378,7 @@ static ssize_t hdaps_variance_show(struct device *dev,
+ static ssize_t hdaps_temp1_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- u8 uninitialized_var(temp);
++ u8 temp;
+ int ret;
+
+ ret = hdaps_readb_one(HDAPS_PORT_TEMP1, &temp);
+@@ -391,7 +391,7 @@ static ssize_t hdaps_temp1_show(struct device *dev,
+ static ssize_t hdaps_temp2_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+- u8 uninitialized_var(temp);
++ u8 temp;
+ int ret;
+
+ ret = hdaps_readb_one(HDAPS_PORT_TEMP2, &temp);
+diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c
+index 42b31c549db00..1781e67781a55 100644
+--- a/drivers/platform/x86/msi-laptop.c
++++ b/drivers/platform/x86/msi-laptop.c
+@@ -223,7 +223,7 @@ static ssize_t set_device_state(const char *buf, size_t count, u8 mask)
+ return -EINVAL;
+
+ if (quirks->ec_read_only)
+- return -EOPNOTSUPP;
++ return 0;
+
+ /* read current device state */
+ result = ec_read(MSI_STANDARD_EC_COMMAND_ADDRESS, &rdata);
+@@ -854,15 +854,15 @@ static bool msi_laptop_i8042_filter(unsigned char data, unsigned char str,
+ static void msi_init_rfkill(struct work_struct *ignored)
+ {
+ if (rfk_wlan) {
+- rfkill_set_sw_state(rfk_wlan, !wlan_s);
++ msi_rfkill_set_state(rfk_wlan, !wlan_s);
+ rfkill_wlan_set(NULL, !wlan_s);
+ }
+ if (rfk_bluetooth) {
+- rfkill_set_sw_state(rfk_bluetooth, !bluetooth_s);
++ msi_rfkill_set_state(rfk_bluetooth, !bluetooth_s);
+ rfkill_bluetooth_set(NULL, !bluetooth_s);
+ }
+ if (rfk_threeg) {
+- rfkill_set_sw_state(rfk_threeg, !threeg_s);
++ msi_rfkill_set_state(rfk_threeg, !threeg_s);
+ rfkill_threeg_set(NULL, !threeg_s);
+ }
+ }
+diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c
+index e66439b6247a4..e8a8ca3545f00 100644
+--- a/drivers/rtc/rtc-st-lpc.c
++++ b/drivers/rtc/rtc-st-lpc.c
+@@ -239,7 +239,7 @@ static int st_rtc_probe(struct platform_device *pdev)
+ enable_irq_wake(rtc->irq);
+ disable_irq(rtc->irq);
+
+- rtc->clk = clk_get(&pdev->dev, NULL);
++ rtc->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(rtc->clk)) {
+ dev_err(&pdev->dev, "Unable to request clock\n");
+ return PTR_ERR(rtc->clk);
+diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
+index 2016e0ed58657..9f3f483137598 100644
+--- a/drivers/s390/block/dasd_ioctl.c
++++ b/drivers/s390/block/dasd_ioctl.c
+@@ -137,6 +137,7 @@ static int dasd_ioctl_resume(struct dasd_block *block)
+ spin_unlock_irqrestore(get_ccwdev_lock(base->cdev), flags);
+
+ dasd_schedule_block_bh(block);
++ dasd_schedule_device_bh(base);
+ return 0;
+ }
+
+diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
+index dc87a6b84d739..72e9e2945ee09 100644
+--- a/drivers/s390/scsi/zfcp_fc.c
++++ b/drivers/s390/scsi/zfcp_fc.c
+@@ -534,8 +534,7 @@ static void zfcp_fc_adisc_handler(void *data)
+
+ /* re-init to undo drop from zfcp_fc_adisc() */
+ port->d_id = ntoh24(adisc_resp->adisc_port_id);
+- /* port is good, unblock rport without going through erp */
+- zfcp_scsi_schedule_rport_register(port);
++ /* port is still good, nothing to do */
+ out:
+ atomic_andnot(ZFCP_STATUS_PORT_LINK_TEST, &port->status);
+ put_device(&port->dev);
+@@ -595,9 +594,6 @@ void zfcp_fc_link_test_work(struct work_struct *work)
+ int retval;
+
+ set_worker_desc("zadisc%16llx", port->wwpn); /* < WORKER_DESC_LEN=24 */
+- get_device(&port->dev);
+- port->rport_task = RPORT_DEL;
+- zfcp_scsi_rport_work(&port->rport_work);
+
+ /* only issue one test command at one time per port */
+ if (atomic_read(&port->status) & ZFCP_STATUS_PORT_LINK_TEST)
+diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
+index 471366945bd4f..8a61e832607eb 100644
+--- a/drivers/scsi/3w-xxxx.c
++++ b/drivers/scsi/3w-xxxx.c
+@@ -2303,8 +2303,10 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
+ TW_DISABLE_INTERRUPTS(tw_dev);
+
+ /* Initialize the card */
+- if (tw_reset_sequence(tw_dev))
++ if (tw_reset_sequence(tw_dev)) {
++ retval = -EINVAL;
+ goto out_release_mem_region;
++ }
+
+ /* Set host specific parameters */
+ host->max_id = TW_MAX_UNITS;
+diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
+index 8b5a07503d5f0..fdfa88e0d1d07 100644
+--- a/drivers/scsi/dc395x.c
++++ b/drivers/scsi/dc395x.c
+@@ -4275,7 +4275,7 @@ static int adapter_sg_tables_alloc(struct AdapterCtlBlk *acb)
+ const unsigned srbs_per_page = PAGE_SIZE/SEGMENTX_LEN;
+ int srb_idx = 0;
+ unsigned i = 0;
+- struct SGentry *uninitialized_var(ptr);
++ struct SGentry *ptr;
+
+ for (i = 0; i < DC395x_MAX_SRB_CNT; i++)
+ acb->srb_array[i].segment_x = NULL;
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index d532230c62f3e..69695bb99925b 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -4174,7 +4174,7 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ {
+ struct outbound_queue_table *circularQ;
+ void *pMsg1 = NULL;
+- u8 uninitialized_var(bc);
++ u8 bc;
+ u32 ret = MPI_IO_STATUS_FAIL;
+ unsigned long flags;
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index d655f72db51d5..067be417e251b 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -3811,7 +3811,7 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ {
+ struct outbound_queue_table *circularQ;
+ void *pMsg1 = NULL;
+- u8 uninitialized_var(bc);
++ u8 bc;
+ u32 ret = MPI_IO_STATUS_FAIL;
+ unsigned long flags;
+ u32 regval;
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index d46a10d24ed4b..6c9095d0aa0f4 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -1800,6 +1800,7 @@ static void
+ qla2x00_terminate_rport_io(struct fc_rport *rport)
+ {
+ fc_port_t *fcport = *(fc_port_t **)rport->dd_data;
++ scsi_qla_host_t *vha;
+
+ if (!fcport)
+ return;
+@@ -1809,9 +1810,12 @@ qla2x00_terminate_rport_io(struct fc_rport *rport)
+
+ if (test_bit(ABORT_ISP_ACTIVE, &fcport->vha->dpc_flags))
+ return;
++ vha = fcport->vha;
+
+ if (unlikely(pci_channel_offline(fcport->vha->hw->pdev))) {
+ qla2x00_abort_all_cmds(fcport->vha, DID_NO_CONNECT << 16);
++ qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24,
++ 0, WAIT_TARGET);
+ return;
+ }
+ /*
+@@ -1826,6 +1830,15 @@ qla2x00_terminate_rport_io(struct fc_rport *rport)
+ else
+ qla2x00_port_logout(fcport->vha, fcport);
+ }
++
++ /* check for any straggling io left behind */
++ if (qla2x00_eh_wait_for_pending_commands(fcport->vha, fcport->d_id.b24, 0, WAIT_TARGET)) {
++ ql_log(ql_log_warn, vha, 0x300b,
++ "IO not return. Resetting. \n");
++ set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
++ qla2xxx_wake_dpc(vha);
++ qla2x00_wait_for_chip_reset(vha);
++ }
+ }
+
+ static int
+diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
+index eae1665729643..430dfe3d5416a 100644
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -264,6 +264,10 @@ qla2x00_process_els(struct bsg_job *bsg_job)
+
+ if (bsg_request->msgcode == FC_BSG_RPT_ELS) {
+ rport = fc_bsg_to_rport(bsg_job);
++ if (!rport) {
++ rval = -ENOMEM;
++ goto done;
++ }
+ fcport = *(fc_port_t **) rport->dd_data;
+ host = rport_to_shost(rport);
+ vha = shost_priv(host);
+@@ -2484,6 +2488,8 @@ qla24xx_bsg_request(struct bsg_job *bsg_job)
+
+ if (bsg_request->msgcode == FC_BSG_RPT_ELS) {
+ rport = fc_bsg_to_rport(bsg_job);
++ if (!rport)
++ return ret;
+ host = rport_to_shost(rport);
+ vha = shost_priv(host);
+ } else {
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index 7e47321e003c8..23cd9ff824789 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -603,7 +603,8 @@ qla24xx_build_scsi_type_6_iocbs(srb_t *sp, struct cmd_type_6 *cmd_pkt,
+ *((uint32_t *)(&cmd_pkt->entry_type)) = cpu_to_le32(COMMAND_TYPE_6);
+
+ /* No data transfer */
+- if (!scsi_bufflen(cmd) || cmd->sc_data_direction == DMA_NONE) {
++ if (!scsi_bufflen(cmd) || cmd->sc_data_direction == DMA_NONE ||
++ tot_dsds == 0) {
+ cmd_pkt->byte_count = cpu_to_le32(0);
+ return 0;
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 7863ad1390f8a..4580774b2c3e7 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -4604,7 +4604,8 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht,
+ }
+ INIT_DELAYED_WORK(&vha->scan.scan_work, qla_scan_work_fn);
+
+- sprintf(vha->host_str, "%s_%ld", QLA2XXX_DRIVER_NAME, vha->host_no);
++ snprintf(vha->host_str, sizeof(vha->host_str), "%s_%lu",
++ QLA2XXX_DRIVER_NAME, vha->host_no);
+ ql_dbg(ql_dbg_init, vha, 0x0041,
+ "Allocated the host=%p hw=%p vha=%p dev_name=%s",
+ vha->host, vha->hw, vha,
+@@ -4735,7 +4736,7 @@ qla2x00_uevent_emit(struct scsi_qla_host *vha, u32 code)
+
+ switch (code) {
+ case QLA_UEVENT_CODE_FW_DUMP:
+- snprintf(event_string, sizeof(event_string), "FW_DUMP=%ld",
++ snprintf(event_string, sizeof(event_string), "FW_DUMP=%lu",
+ vha->host_no);
+ break;
+ default:
+diff --git a/drivers/soc/fsl/qe/Kconfig b/drivers/soc/fsl/qe/Kconfig
+index fabba17e9d65b..7ec158e2acf91 100644
+--- a/drivers/soc/fsl/qe/Kconfig
++++ b/drivers/soc/fsl/qe/Kconfig
+@@ -37,6 +37,7 @@ config QE_TDM
+
+ config QE_USB
+ bool
++ depends on QUICC_ENGINE
+ default y if USB_FSL_QE
+ help
+ QE USB Controller support
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 3f291db7b39a0..e3c69b6237708 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -1255,13 +1255,9 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+ "mspi");
+
+- if (res) {
+- qspi->base[MSPI] = devm_ioremap_resource(dev, res);
+- if (IS_ERR(qspi->base[MSPI]))
+- return PTR_ERR(qspi->base[MSPI]);
+- } else {
+- return 0;
+- }
++ qspi->base[MSPI] = devm_ioremap_resource(dev, res);
++ if (IS_ERR(qspi->base[MSPI]))
++ return PTR_ERR(qspi->base[MSPI]);
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
+ if (res) {
+diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
+index bfe5754768f97..cc6ec3fb5bfdf 100644
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -134,7 +134,7 @@ enum bcm63xx_regs_spi {
+ SPI_MSG_DATA_SIZE,
+ };
+
+-#define BCM63XX_SPI_MAX_PREPEND 15
++#define BCM63XX_SPI_MAX_PREPEND 7
+
+ #define BCM63XX_SPI_MAX_CS 8
+ #define BCM63XX_SPI_BUS_NUM 0
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 5e49fed487f8a..fd15b030b3815 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -339,7 +339,7 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ struct spi_transfer *t, *first;
+ unsigned int cs_change;
+ const int nsecs = 50;
+- int status;
++ int status, last_bpw;
+
+ /*
+ * In CPU mode, optimize large byte transfers to use larger
+@@ -373,26 +373,27 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ }
+
+ /* Don't allow changes if CS is active */
+- first = list_first_entry(&m->transfers, struct spi_transfer,
+- transfer_list);
++ cs_change = 1;
+ list_for_each_entry(t, &m->transfers, transfer_list) {
+- if ((first->bits_per_word != t->bits_per_word) ||
+- (first->speed_hz != t->speed_hz)) {
++ if (cs_change)
++ first = t;
++ cs_change = t->cs_change;
++ if (first->speed_hz != t->speed_hz) {
+ dev_err(&spi->dev,
+- "bits_per_word/speed_hz should be same for the same SPI transfer\n");
++ "speed_hz cannot change while CS is active\n");
+ return -EINVAL;
+ }
+ }
+
++ last_bpw = -1;
+ cs_change = 1;
+ status = -EINVAL;
+ list_for_each_entry(t, &m->transfers, transfer_list) {
+- if (t->bits_per_word || t->speed_hz) {
+- if (cs_change)
+- status = fsl_spi_setup_transfer(spi, t);
+- if (status < 0)
+- break;
+- }
++ if (cs_change || last_bpw != t->bits_per_word)
++ status = fsl_spi_setup_transfer(spi, t);
++ if (status < 0)
++ break;
++ last_bpw = t->bits_per_word;
+
+ if (cs_change) {
+ fsl_spi_chipselect(spi, BITBANG_CS_ACTIVE);
+diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c
+index 99a4656d113d5..832ee69f45f52 100644
+--- a/drivers/ssb/driver_chipcommon.c
++++ b/drivers/ssb/driver_chipcommon.c
+@@ -119,7 +119,7 @@ void ssb_chipco_set_clockmode(struct ssb_chipcommon *cc,
+ static enum ssb_clksrc chipco_pctl_get_slowclksrc(struct ssb_chipcommon *cc)
+ {
+ struct ssb_bus *bus = cc->dev->bus;
+- u32 uninitialized_var(tmp);
++ u32 tmp;
+
+ if (cc->dev->id.revision < 6) {
+ if (bus->bustype == SSB_BUSTYPE_SSB ||
+@@ -149,7 +149,7 @@ static enum ssb_clksrc chipco_pctl_get_slowclksrc(struct ssb_chipcommon *cc)
+ /* Get maximum or minimum (depending on get_max flag) slowclock frequency. */
+ static int chipco_pctl_clockfreqlimit(struct ssb_chipcommon *cc, int get_max)
+ {
+- int uninitialized_var(limit);
++ int limit;
+ enum ssb_clksrc clocksrc;
+ int divisor = 1;
+ u32 tmp;
+diff --git a/drivers/staging/ks7010/ks_wlan_net.c b/drivers/staging/ks7010/ks_wlan_net.c
+index f624d0d53a8f2..1b6226efe15eb 100644
+--- a/drivers/staging/ks7010/ks_wlan_net.c
++++ b/drivers/staging/ks7010/ks_wlan_net.c
+@@ -1584,8 +1584,10 @@ static int ks_wlan_set_encode_ext(struct net_device *dev,
+ commit |= SME_WEP_FLAG;
+ }
+ if (enc->key_len) {
+- memcpy(&key->key_val[0], &enc->key[0], enc->key_len);
+- key->key_len = enc->key_len;
++ int key_len = clamp_val(enc->key_len, 0, IW_ENCODING_TOKEN_MAX);
++
++ memcpy(&key->key_val[0], &enc->key[0], key_len);
++ key->key_len = key_len;
+ commit |= (SME_WEP_VAL1 << index);
+ }
+ break;
+diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
+index db048dbe9f785..6fec20c01ef15 100644
+--- a/drivers/tty/cyclades.c
++++ b/drivers/tty/cyclades.c
+@@ -3648,7 +3648,7 @@ static int cy_pci_probe(struct pci_dev *pdev,
+ struct cyclades_card *card;
+ void __iomem *addr0 = NULL, *addr2 = NULL;
+ char *card_name = NULL;
+- u32 uninitialized_var(mailbox);
++ u32 mailbox;
+ unsigned int device_id, nchan = 0, card_no, i, j;
+ unsigned char plx_ver;
+ int retval, irq;
+diff --git a/drivers/tty/isicom.c b/drivers/tty/isicom.c
+index 8d96e86966f1b..274480a3c4b97 100644
+--- a/drivers/tty/isicom.c
++++ b/drivers/tty/isicom.c
+@@ -1537,7 +1537,7 @@ static unsigned int card_count;
+ static int isicom_probe(struct pci_dev *pdev,
+ const struct pci_device_id *ent)
+ {
+- unsigned int uninitialized_var(signature), index;
++ unsigned int signature, index;
+ int retval = -EPERM;
+ struct isi_board *board = NULL;
+
+diff --git a/drivers/tty/serial/8250/8250.h b/drivers/tty/serial/8250/8250.h
+index 8c8aa3b9c2989..b0c5f0dba6fcc 100644
+--- a/drivers/tty/serial/8250/8250.h
++++ b/drivers/tty/serial/8250/8250.h
+@@ -85,7 +85,6 @@ struct serial8250_config {
+ #define UART_BUG_TXEN (1 << 1) /* UART has buggy TX IIR status */
+ #define UART_BUG_NOMSR (1 << 2) /* UART has buggy MSR status bits (Au1x00) */
+ #define UART_BUG_THRE (1 << 3) /* UART has buggy THRE reassertion */
+-#define UART_BUG_PARITY (1 << 4) /* UART mishandles parity if FIFO enabled */
+
+
+ #ifdef CONFIG_SERIAL_8250_SHARE_IRQ
+diff --git a/drivers/tty/serial/8250/8250_dwlib.c b/drivers/tty/serial/8250/8250_dwlib.c
+new file mode 100644
+index 0000000000000..1cf229cca5928
+--- /dev/null
++++ b/drivers/tty/serial/8250/8250_dwlib.c
+@@ -0,0 +1,128 @@
++// SPDX-License-Identifier: GPL-2.0+
++/* Synopsys DesignWare 8250 library. */
++
++#include <linux/bitops.h>
++#include <linux/device.h>
++#include <linux/io.h>
++#include <linux/kernel.h>
++#include <linux/serial_8250.h>
++#include <linux/serial_core.h>
++
++#include "8250_dwlib.h"
++
++/* Offsets for the DesignWare specific registers */
++#define DW_UART_DLF 0xc0 /* Divisor Latch Fraction Register */
++#define DW_UART_CPR 0xf4 /* Component Parameter Register */
++#define DW_UART_UCV 0xf8 /* UART Component Version */
++
++/* Component Parameter Register bits */
++#define DW_UART_CPR_ABP_DATA_WIDTH (3 << 0)
++#define DW_UART_CPR_AFCE_MODE (1 << 4)
++#define DW_UART_CPR_THRE_MODE (1 << 5)
++#define DW_UART_CPR_SIR_MODE (1 << 6)
++#define DW_UART_CPR_SIR_LP_MODE (1 << 7)
++#define DW_UART_CPR_ADDITIONAL_FEATURES (1 << 8)
++#define DW_UART_CPR_FIFO_ACCESS (1 << 9)
++#define DW_UART_CPR_FIFO_STAT (1 << 10)
++#define DW_UART_CPR_SHADOW (1 << 11)
++#define DW_UART_CPR_ENCODED_PARMS (1 << 12)
++#define DW_UART_CPR_DMA_EXTRA (1 << 13)
++#define DW_UART_CPR_FIFO_MODE (0xff << 16)
++
++/* Helper for FIFO size calculation */
++#define DW_UART_CPR_FIFO_SIZE(a) (((a >> 16) & 0xff) * 16)
++
++static inline u32 dw8250_readl_ext(struct uart_port *p, int offset)
++{
++ if (p->iotype == UPIO_MEM32BE)
++ return ioread32be(p->membase + offset);
++ return readl(p->membase + offset);
++}
++
++static inline void dw8250_writel_ext(struct uart_port *p, int offset, u32 reg)
++{
++ if (p->iotype == UPIO_MEM32BE)
++ iowrite32be(reg, p->membase + offset);
++ else
++ writel(reg, p->membase + offset);
++}
++
++/*
++ * divisor = div(I) + div(F)
++ * "I" means integer, "F" means fractional
++ * quot = div(I) = clk / (16 * baud)
++ * frac = div(F) * 2^dlf_size
++ *
++ * let rem = clk % (16 * baud)
++ * we have: div(F) * (16 * baud) = rem
++ * so frac = 2^dlf_size * rem / (16 * baud) = (rem << dlf_size) / (16 * baud)
++ */
++static unsigned int dw8250_get_divisor(struct uart_port *p, unsigned int baud,
++ unsigned int *frac)
++{
++ unsigned int quot, rem, base_baud = baud * 16;
++ struct dw8250_port_data *d = p->private_data;
++
++ quot = p->uartclk / base_baud;
++ rem = p->uartclk % base_baud;
++ *frac = DIV_ROUND_CLOSEST(rem << d->dlf_size, base_baud);
++
++ return quot;
++}
++
++static void dw8250_set_divisor(struct uart_port *p, unsigned int baud,
++ unsigned int quot, unsigned int quot_frac)
++{
++ dw8250_writel_ext(p, DW_UART_DLF, quot_frac);
++ serial8250_do_set_divisor(p, baud, quot, quot_frac);
++}
++
++void dw8250_setup_port(struct uart_port *p)
++{
++ struct uart_8250_port *up = up_to_u8250p(p);
++ u32 reg, old_dlf;
++
++ /*
++ * If the Component Version Register returns zero, we know that
++ * ADDITIONAL_FEATURES are not enabled. No need to go any further.
++ */
++ reg = dw8250_readl_ext(p, DW_UART_UCV);
++ if (!reg)
++ return;
++
++ dev_dbg(p->dev, "Designware UART version %c.%c%c\n",
++ (reg >> 24) & 0xff, (reg >> 16) & 0xff, (reg >> 8) & 0xff);
++
++ /* Preserve value written by firmware or bootloader */
++ old_dlf = dw8250_readl_ext(p, DW_UART_DLF);
++ dw8250_writel_ext(p, DW_UART_DLF, ~0U);
++ reg = dw8250_readl_ext(p, DW_UART_DLF);
++ dw8250_writel_ext(p, DW_UART_DLF, old_dlf);
++
++ if (reg) {
++ struct dw8250_port_data *d = p->private_data;
++
++ d->dlf_size = fls(reg);
++ p->get_divisor = dw8250_get_divisor;
++ p->set_divisor = dw8250_set_divisor;
++ }
++
++ reg = dw8250_readl_ext(p, DW_UART_CPR);
++ if (!reg)
++ return;
++
++ /* Select the type based on FIFO */
++ if (reg & DW_UART_CPR_FIFO_MODE) {
++ p->type = PORT_16550A;
++ p->flags |= UPF_FIXED_TYPE;
++ p->fifosize = DW_UART_CPR_FIFO_SIZE(reg);
++ up->capabilities = UART_CAP_FIFO;
++ }
++
++ if (reg & DW_UART_CPR_AFCE_MODE)
++ up->capabilities |= UART_CAP_AFE;
++
++ if (reg & DW_UART_CPR_SIR_MODE)
++ up->capabilities |= UART_CAP_IRDA;
++}
++EXPORT_SYMBOL_GPL(dw8250_setup_port);
+diff --git a/drivers/tty/serial/8250/8250_dwlib.h b/drivers/tty/serial/8250/8250_dwlib.h
+new file mode 100644
+index 0000000000000..87a4db2a8aba6
+--- /dev/null
++++ b/drivers/tty/serial/8250/8250_dwlib.h
+@@ -0,0 +1,19 @@
++// SPDX-License-Identifier: GPL-2.0+
++/* Synopsys DesignWare 8250 library header file. */
++
++#include <linux/types.h>
++
++#include "8250.h"
++
++struct dw8250_port_data {
++ /* Port properties */
++ int line;
++
++ /* DMA operations */
++ struct uart_8250_dma dma;
++
++ /* Hardware configuration */
++ u8 dlf_size;
++};
++
++void dw8250_setup_port(struct uart_port *p);
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 274e644f34f27..2c224bf70cfd0 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1049,14 +1049,6 @@ static int pci_oxsemi_tornado_init(struct pci_dev *dev)
+ return number_uarts;
+ }
+
+-static int pci_asix_setup(struct serial_private *priv,
+- const struct pciserial_board *board,
+- struct uart_8250_port *port, int idx)
+-{
+- port->bugs |= UART_BUG_PARITY;
+- return pci_default_setup(priv, board, port, idx);
+-}
+-
+ /* Quatech devices have their own extra interface features */
+
+ struct quatech_feature {
+@@ -1683,7 +1675,6 @@ pci_wch_ch38x_setup(struct serial_private *priv,
+ #define PCI_DEVICE_ID_WCH_CH355_4S 0x7173
+ #define PCI_VENDOR_ID_AGESTAR 0x5372
+ #define PCI_DEVICE_ID_AGESTAR_9375 0x6872
+-#define PCI_VENDOR_ID_ASIX 0x9710
+ #define PCI_DEVICE_ID_BROADCOM_TRUMANAGE 0x160a
+ #define PCI_DEVICE_ID_AMCC_ADDIDATA_APCI7800 0x818e
+
+@@ -2454,16 +2445,6 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
+ .subdevice = PCI_ANY_ID,
+ .setup = pci_wch_ch38x_setup,
+ },
+- /*
+- * ASIX devices with FIFO bug
+- */
+- {
+- .vendor = PCI_VENDOR_ID_ASIX,
+- .device = PCI_ANY_ID,
+- .subvendor = PCI_ANY_ID,
+- .subdevice = PCI_ANY_ID,
+- .setup = pci_asix_setup,
+- },
+ /*
+ * Broadcom TruManage (NetXtreme)
+ */
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index cba4888bc4824..66de3a59f5779 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -2617,11 +2617,8 @@ static unsigned char serial8250_compute_lcr(struct uart_8250_port *up,
+
+ if (c_cflag & CSTOPB)
+ cval |= UART_LCR_STOP;
+- if (c_cflag & PARENB) {
++ if (c_cflag & PARENB)
+ cval |= UART_LCR_PARITY;
+- if (up->bugs & UART_BUG_PARITY)
+- up->fifo_bug = true;
+- }
+ if (!(c_cflag & PARODD))
+ cval |= UART_LCR_EPAR;
+ #ifdef CMSPAR
+@@ -2735,8 +2732,7 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
+ up->lcr = cval; /* Save computed LCR */
+
+ if (up->capabilities & UART_CAP_FIFO && port->fifosize > 1) {
+- /* NOTE: If fifo_bug is not set, a user can set RX_trigger. */
+- if ((baud < 2400 && !up->dma) || up->fifo_bug) {
++ if (baud < 2400 && !up->dma) {
+ up->fcr &= ~UART_FCR_TRIGGER_MASK;
+ up->fcr |= UART_FCR_TRIGGER_1;
+ }
+@@ -3072,8 +3068,7 @@ static int do_set_rxtrig(struct tty_port *port, unsigned char bytes)
+ struct uart_8250_port *up = up_to_u8250p(uport);
+ int rxtrig;
+
+- if (!(up->capabilities & UART_CAP_FIFO) || uport->fifosize <= 1 ||
+- up->fifo_bug)
++ if (!(up->capabilities & UART_CAP_FIFO) || uport->fifosize <= 1)
+ return -EINVAL;
+
+ rxtrig = bytes_to_fcr_rxtrig(up, bytes);
+diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
+index a9ddd76d41701..733ac320938c1 100644
+--- a/drivers/tty/serial/8250/Kconfig
++++ b/drivers/tty/serial/8250/Kconfig
+@@ -312,6 +312,9 @@ config SERIAL_8250_RSA
+
+ If you don't have such card, or if unsure, say N.
+
++config SERIAL_8250_DWLIB
++ bool
++
+ config SERIAL_8250_ACORN
+ tristate "Acorn expansion card serial port support"
+ depends on ARCH_ACORN && SERIAL_8250
+diff --git a/drivers/tty/serial/8250/Makefile b/drivers/tty/serial/8250/Makefile
+index 18751bc63a848..9b451d81588b2 100644
+--- a/drivers/tty/serial/8250/Makefile
++++ b/drivers/tty/serial/8250/Makefile
+@@ -8,6 +8,7 @@ obj-$(CONFIG_SERIAL_8250) += 8250.o 8250_base.o
+ 8250-$(CONFIG_SERIAL_8250_PNP) += 8250_pnp.o
+ 8250_base-y := 8250_port.o
+ 8250_base-$(CONFIG_SERIAL_8250_DMA) += 8250_dma.o
++8250_base-$(CONFIG_SERIAL_8250_DWLIB) += 8250_dwlib.o
+ 8250_base-$(CONFIG_SERIAL_8250_FINTEK) += 8250_fintek.o
+ obj-$(CONFIG_SERIAL_8250_GSC) += 8250_gsc.o
+ obj-$(CONFIG_SERIAL_8250_PCI) += 8250_pci.o
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 50c4058a00e6a..1688c190fc7d8 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -791,11 +791,11 @@ static void atmel_complete_tx_dma(void *arg)
+
+ port->icount.tx += atmel_port->tx_len;
+
+- spin_lock_irq(&atmel_port->lock_tx);
++ spin_lock(&atmel_port->lock_tx);
+ async_tx_ack(atmel_port->desc_tx);
+ atmel_port->cookie_tx = -EINVAL;
+ atmel_port->desc_tx = NULL;
+- spin_unlock_irq(&atmel_port->lock_tx);
++ spin_unlock(&atmel_port->lock_tx);
+
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(port);
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index 964d6d33b6097..5f1f52cc63951 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1199,8 +1199,12 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport,
+ continue;
+
+ rate = clk_get_rate(clk);
+- if (!rate)
++ if (!rate) {
++ dev_err(ourport->port.dev,
++ "Failed to get clock rate for %s.\n", clkname);
++ clk_put(clk);
+ continue;
++ }
+
+ if (ourport->info->has_divslot) {
+ unsigned long div = rate / req_baud;
+@@ -1226,10 +1230,18 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport,
+ calc_deviation = -calc_deviation;
+
+ if (calc_deviation < deviation) {
++ /*
++ * If we find a better clk, release the previous one, if
++ * any.
++ */
++ if (!IS_ERR(*best_clk))
++ clk_put(*best_clk);
+ *best_clk = clk;
+ best_quot = quot;
+ *clk_num = cnt;
+ deviation = calc_deviation;
++ } else {
++ clk_put(clk);
+ }
+ }
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 1346c600ebedf..48cda9b7a8f24 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -437,6 +437,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* novation SoundControl XL */
+ { USB_DEVICE(0x1235, 0x0061), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Focusrite Scarlett Solo USB */
++ { USB_DEVICE(0x1235, 0x8211), .driver_info =
++ USB_QUIRK_DISCONNECT_SUSPEND },
++
+ /* Huawei 4G LTE module */
+ { USB_DEVICE(0x12d1, 0x15bb), .driver_info =
+ USB_QUIRK_DISCONNECT_SUSPEND },
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 81a5ca15b9c7a..d31cc8d75595d 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -242,9 +242,9 @@ static int dwc3_core_soft_reset(struct dwc3 *dwc)
+ /*
+ * We're resetting only the device side because, if we're in host mode,
+ * XHCI driver will reset the host block. If dwc3 was configured for
+- * host-only mode, then we can return early.
++ * host-only mode or current role is host, then we can return early.
+ */
+- if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
++ if (dwc->dr_mode == USB_DR_MODE_HOST || dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
+ return 0;
+
+ reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+@@ -993,22 +993,6 @@ static int dwc3_core_init(struct dwc3 *dwc)
+ dwc3_writel(dwc->regs, DWC3_GUCTL1, reg);
+ }
+
+- if (dwc->dr_mode == USB_DR_MODE_HOST ||
+- dwc->dr_mode == USB_DR_MODE_OTG) {
+- reg = dwc3_readl(dwc->regs, DWC3_GUCTL);
+-
+- /*
+- * Enable Auto retry Feature to make the controller operating in
+- * Host mode on seeing transaction errors(CRC errors or internal
+- * overrun scenerios) on IN transfers to reply to the device
+- * with a non-terminating retry ACK (i.e, an ACK transcation
+- * packet with Retry=1 & Nump != 0)
+- */
+- reg |= DWC3_GUCTL_HSTINAUTORETRY;
+-
+- dwc3_writel(dwc->regs, DWC3_GUCTL, reg);
+- }
+-
+ /*
+ * Must config both number of packets and max burst settings to enable
+ * RX and/or TX threshold.
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index 55ee41283f395..a1d65e36a4d41 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -238,9 +238,6 @@
+ #define DWC3_GCTL_GBLHIBERNATIONEN BIT(1)
+ #define DWC3_GCTL_DSBLCLKGTNG BIT(0)
+
+-/* Global User Control Register */
+-#define DWC3_GUCTL_HSTINAUTORETRY BIT(14)
+-
+ /* Global User Control 1 Register */
+ #define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17)
+ #define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS BIT(28)
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 955bf820f4102..8d4f1b13f4157 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -171,10 +171,12 @@ static int dwc3_pci_quirks(struct dwc3_pci *dwc)
+
+ /*
+ * A lot of BYT devices lack ACPI resource entries for
+- * the GPIOs, add a fallback mapping to the reference
++ * the GPIOs. If the ACPI entry for the GPIO controller
++ * is present add a fallback mapping to the reference
+ * design GPIOs which all boards seem to use.
+ */
+- gpiod_add_lookup_table(&platform_bytcr_gpios);
++ if (acpi_dev_present("INT33FC", NULL, -1))
++ gpiod_add_lookup_table(&platform_bytcr_gpios);
+
+ /*
+ * These GPIOs will turn on the USB2 PHY. Note that we have to
+diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
+index ec6739ef3129e..687aeab64e4db 100644
+--- a/drivers/usb/host/ohci-at91.c
++++ b/drivers/usb/host/ohci-at91.c
+@@ -642,7 +642,13 @@ ohci_hcd_at91_drv_resume(struct device *dev)
+
+ at91_start_clock(ohci_at91);
+
+- ohci_resume(hcd, false);
++ /*
++ * According to the comment in ohci_hcd_at91_drv_suspend()
++ * we need to do a reset if the 48Mhz clock was stopped,
++ * that is, if ohci_at91->wakeup is clear. Tell ohci_resume()
++ * to reset in this case by setting its "hibernated" flag.
++ */
++ ohci_resume(hcd, !ohci_at91->wakeup);
+
+ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 0);
+
+diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
+index f4b2e766f195b..cb22beb55f7e0 100644
+--- a/drivers/usb/host/xhci-mtk.c
++++ b/drivers/usb/host/xhci-mtk.c
+@@ -538,6 +538,7 @@ static int xhci_mtk_probe(struct platform_device *pdev)
+ }
+
+ device_init_wakeup(dev, true);
++ dma_set_max_seg_size(dev, UINT_MAX);
+
+ xhci = hcd_to_xhci(hcd);
+ xhci->main_hcd = hcd;
+diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
+index b4d6d9bb32395..c545b27ea5681 100644
+--- a/drivers/usb/musb/cppi_dma.c
++++ b/drivers/usb/musb/cppi_dma.c
+@@ -1146,7 +1146,7 @@ irqreturn_t cppi_interrupt(int irq, void *dev_id)
+ struct musb_hw_ep *hw_ep = NULL;
+ u32 rx, tx;
+ int i, index;
+- unsigned long uninitialized_var(flags);
++ unsigned long flags;
+
+ cppi = container_of(musb->dma_controller, struct cppi, controller);
+ if (cppi->irq)
+diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c
+index 60d390e28289f..2923a7f6952dc 100644
+--- a/drivers/usb/phy/phy-tahvo.c
++++ b/drivers/usb/phy/phy-tahvo.c
+@@ -398,7 +398,7 @@ static int tahvo_usb_probe(struct platform_device *pdev)
+
+ tu->irq = ret = platform_get_irq(pdev, 0);
+ if (ret < 0)
+- return ret;
++ goto err_remove_phy;
+ ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt,
+ IRQF_ONESHOT,
+ "tahvo-vbus", tu);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 126e276edd2ed..cf68a422e75e4 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -251,6 +251,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_EM061K_LTA 0x0123
+ #define QUECTEL_PRODUCT_EM061K_LMS 0x0124
+ #define QUECTEL_PRODUCT_EC25 0x0125
++#define QUECTEL_PRODUCT_EM060K_128 0x0128
+ #define QUECTEL_PRODUCT_EG91 0x0191
+ #define QUECTEL_PRODUCT_EG95 0x0195
+ #define QUECTEL_PRODUCT_BG96 0x0296
+@@ -268,6 +269,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_RM520N 0x0801
+ #define QUECTEL_PRODUCT_EC200U 0x0901
+ #define QUECTEL_PRODUCT_EC200S_CN 0x6002
++#define QUECTEL_PRODUCT_EC200A 0x6005
+ #define QUECTEL_PRODUCT_EM061K_LWW 0x6008
+ #define QUECTEL_PRODUCT_EM061K_LCN 0x6009
+ #define QUECTEL_PRODUCT_EC200T 0x6026
+@@ -1151,6 +1153,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa),
+ .driver_info = RSVD(3) },
+ /* u-blox products */
++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1311) }, /* u-blox LARA-R6 01B */
++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1312), /* u-blox LARA-R6 01B (RMNET) */
++ .driver_info = RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(UBLOX_VENDOR_ID, 0x1313, 0xff) }, /* u-blox LARA-R6 01B (ECM) */
+ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1341) }, /* u-blox LARA-L6 */
+ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1342), /* u-blox LARA-L6 (RMNET) */
+ .driver_info = RSVD(4) },
+@@ -1193,6 +1199,9 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x30) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0x00, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) },
+@@ -1221,6 +1230,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0900, 0xff, 0, 0), /* RM500U-CN */
+ .driver_info = ZLP },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200A, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
+diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
+index 4c6747889a194..24b8772a345e2 100644
+--- a/drivers/usb/serial/usb-serial-simple.c
++++ b/drivers/usb/serial/usb-serial-simple.c
+@@ -38,16 +38,6 @@ static struct usb_serial_driver vendor##_device = { \
+ { USB_DEVICE(0x0a21, 0x8001) } /* MMT-7305WW */
+ DEVICE(carelink, CARELINK_IDS);
+
+-/* ZIO Motherboard USB driver */
+-#define ZIO_IDS() \
+- { USB_DEVICE(0x1CBE, 0x0103) }
+-DEVICE(zio, ZIO_IDS);
+-
+-/* Funsoft Serial USB driver */
+-#define FUNSOFT_IDS() \
+- { USB_DEVICE(0x1404, 0xcddc) }
+-DEVICE(funsoft, FUNSOFT_IDS);
+-
+ /* Infineon Flashloader driver */
+ #define FLASHLOADER_IDS() \
+ { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
+@@ -55,6 +45,11 @@ DEVICE(funsoft, FUNSOFT_IDS);
+ { USB_DEVICE(0x8087, 0x0801) }
+ DEVICE(flashloader, FLASHLOADER_IDS);
+
++/* Funsoft Serial USB driver */
++#define FUNSOFT_IDS() \
++ { USB_DEVICE(0x1404, 0xcddc) }
++DEVICE(funsoft, FUNSOFT_IDS);
++
+ /* Google Serial USB SubClass */
+ #define GOOGLE_IDS() \
+ { USB_VENDOR_AND_INTERFACE_INFO(0x18d1, \
+@@ -63,16 +58,21 @@ DEVICE(flashloader, FLASHLOADER_IDS);
+ 0x01) }
+ DEVICE(google, GOOGLE_IDS);
+
++/* HP4x (48/49) Generic Serial driver */
++#define HP4X_IDS() \
++ { USB_DEVICE(0x03f0, 0x0121) }
++DEVICE(hp4x, HP4X_IDS);
++
++/* KAUFMANN RKS+CAN VCP */
++#define KAUFMANN_IDS() \
++ { USB_DEVICE(0x16d0, 0x0870) }
++DEVICE(kaufmann, KAUFMANN_IDS);
++
+ /* Libtransistor USB console */
+ #define LIBTRANSISTOR_IDS() \
+ { USB_DEVICE(0x1209, 0x8b00) }
+ DEVICE(libtransistor, LIBTRANSISTOR_IDS);
+
+-/* ViVOpay USB Serial Driver */
+-#define VIVOPAY_IDS() \
+- { USB_DEVICE(0x1d5f, 0x1004) } /* ViVOpay 8800 */
+-DEVICE(vivopay, VIVOPAY_IDS);
+-
+ /* Motorola USB Phone driver */
+ #define MOTO_IDS() \
+ { USB_DEVICE(0x05c6, 0x3197) }, /* unknown Motorola phone */ \
+@@ -101,10 +101,10 @@ DEVICE(nokia, NOKIA_IDS);
+ { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */
+ DEVICE_N(novatel_gps, NOVATEL_IDS, 3);
+
+-/* HP4x (48/49) Generic Serial driver */
+-#define HP4X_IDS() \
+- { USB_DEVICE(0x03f0, 0x0121) }
+-DEVICE(hp4x, HP4X_IDS);
++/* Siemens USB/MPI adapter */
++#define SIEMENS_IDS() \
++ { USB_DEVICE(0x908, 0x0004) }
++DEVICE(siemens_mpi, SIEMENS_IDS);
+
+ /* Suunto ANT+ USB Driver */
+ #define SUUNTO_IDS() \
+@@ -112,45 +112,52 @@ DEVICE(hp4x, HP4X_IDS);
+ { USB_DEVICE(0x0fcf, 0x1009) } /* Dynastream ANT USB-m Stick */
+ DEVICE(suunto, SUUNTO_IDS);
+
+-/* Siemens USB/MPI adapter */
+-#define SIEMENS_IDS() \
+- { USB_DEVICE(0x908, 0x0004) }
+-DEVICE(siemens_mpi, SIEMENS_IDS);
++/* ViVOpay USB Serial Driver */
++#define VIVOPAY_IDS() \
++ { USB_DEVICE(0x1d5f, 0x1004) } /* ViVOpay 8800 */
++DEVICE(vivopay, VIVOPAY_IDS);
++
++/* ZIO Motherboard USB driver */
++#define ZIO_IDS() \
++ { USB_DEVICE(0x1CBE, 0x0103) }
++DEVICE(zio, ZIO_IDS);
+
+ /* All of the above structures mushed into two lists */
+ static struct usb_serial_driver * const serial_drivers[] = {
+ &carelink_device,
+- &zio_device,
+- &funsoft_device,
+ &flashloader_device,
++ &funsoft_device,
+ &google_device,
++ &hp4x_device,
++ &kaufmann_device,
+ &libtransistor_device,
+- &vivopay_device,
+ &moto_modem_device,
+ &motorola_tetra_device,
+ &nokia_device,
+ &novatel_gps_device,
+- &hp4x_device,
+- &suunto_device,
+ &siemens_mpi_device,
++ &suunto_device,
++ &vivopay_device,
++ &zio_device,
+ NULL
+ };
+
+ static const struct usb_device_id id_table[] = {
+ CARELINK_IDS(),
+- ZIO_IDS(),
+- FUNSOFT_IDS(),
+ FLASHLOADER_IDS(),
++ FUNSOFT_IDS(),
+ GOOGLE_IDS(),
++ HP4X_IDS(),
++ KAUFMANN_IDS(),
+ LIBTRANSISTOR_IDS(),
+- VIVOPAY_IDS(),
+ MOTO_IDS(),
+ MOTOROLA_TETRA_IDS(),
+ NOKIA_IDS(),
+ NOVATEL_IDS(),
+- HP4X_IDS(),
+- SUUNTO_IDS(),
+ SIEMENS_IDS(),
++ SUUNTO_IDS(),
++ VIVOPAY_IDS(),
++ ZIO_IDS(),
+ { },
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c
+index b8527c55335b6..35306c0559622 100644
+--- a/drivers/usb/storage/sddr55.c
++++ b/drivers/usb/storage/sddr55.c
+@@ -553,8 +553,8 @@ static int sddr55_reset(struct us_data *us)
+
+ static unsigned long sddr55_get_capacity(struct us_data *us) {
+
+- unsigned char uninitialized_var(manufacturerID);
+- unsigned char uninitialized_var(deviceID);
++ unsigned char manufacturerID;
++ unsigned char deviceID;
+ int result;
+ struct sddr55_card_info *info = (struct sddr55_card_info *)us->extra;
+
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index 5ea7b0a94fe38..4dc1842e3e8e1 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -828,7 +828,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
+ /* len is always initialized before use since we are always called with
+ * datalen > 0.
+ */
+- u32 uninitialized_var(len);
++ u32 len;
+
+ while (datalen > 0 && headcount < quota) {
+ if (unlikely(seg >= UIO_MAXIOV)) {
+@@ -885,7 +885,7 @@ static void handle_rx(struct vhost_net *net)
+ {
+ struct vhost_net_virtqueue *nvq = &net->vqs[VHOST_NET_VQ_RX];
+ struct vhost_virtqueue *vq = &nvq->vq;
+- unsigned uninitialized_var(in), log;
++ unsigned in, log;
+ struct vhost_log *vq_log;
+ struct msghdr msg = {
+ .msg_name = NULL,
+diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c
+index f8e83a9519189..593c390e98629 100644
+--- a/drivers/video/fbdev/au1200fb.c
++++ b/drivers/video/fbdev/au1200fb.c
+@@ -1744,6 +1744,9 @@ static int au1200fb_drv_probe(struct platform_device *dev)
+
+ /* Now hook interrupt too */
+ irq = platform_get_irq(dev, 0);
++ if (irq < 0)
++ return irq;
++
+ ret = request_irq(irq, au1200fb_handle_irq,
+ IRQF_SHARED, "lcd", (void *)dev);
+ if (ret) {
+diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
+index ecdcf358ad5ea..4a3f89b223600 100644
+--- a/drivers/video/fbdev/imsttfb.c
++++ b/drivers/video/fbdev/imsttfb.c
+@@ -1348,7 +1348,7 @@ static struct fb_ops imsttfb_ops = {
+ .fb_ioctl = imsttfb_ioctl,
+ };
+
+-static void init_imstt(struct fb_info *info)
++static int init_imstt(struct fb_info *info)
+ {
+ struct imstt_par *par = info->par;
+ __u32 i, tmp, *ip, *end;
+@@ -1420,7 +1420,7 @@ static void init_imstt(struct fb_info *info)
+ || !(compute_imstt_regvals(par, info->var.xres, info->var.yres))) {
+ printk("imsttfb: %ux%ux%u not supported\n", info->var.xres, info->var.yres, info->var.bits_per_pixel);
+ framebuffer_release(info);
+- return;
++ return -ENODEV;
+ }
+
+ sprintf(info->fix.id, "IMS TT (%s)", par->ramdac == IBM ? "IBM" : "TVP");
+@@ -1456,12 +1456,13 @@ static void init_imstt(struct fb_info *info)
+
+ if (register_framebuffer(info) < 0) {
+ framebuffer_release(info);
+- return;
++ return -ENODEV;
+ }
+
+ tmp = (read_reg_le32(par->dc_regs, SSTATUS) & 0x0f00) >> 8;
+ fb_info(info, "%s frame buffer; %uMB vram; chip version %u\n",
+ info->fix.id, info->fix.smem_len >> 20, tmp);
++ return 0;
+ }
+
+ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+@@ -1470,6 +1471,7 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ struct imstt_par *par;
+ struct fb_info *info;
+ struct device_node *dp;
++ int ret = -ENOMEM;
+
+ dp = pci_device_to_OF_node(pdev);
+ if(dp)
+@@ -1508,23 +1510,37 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ default:
+ printk(KERN_INFO "imsttfb: Device 0x%x unknown, "
+ "contact maintainer.\n", pdev->device);
+- release_mem_region(addr, size);
+- framebuffer_release(info);
+- return -ENODEV;
++ ret = -ENODEV;
++ goto error;
+ }
+
+ info->fix.smem_start = addr;
+ info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ?
+ 0x400000 : 0x800000);
++ if (!info->screen_base)
++ goto error;
+ info->fix.mmio_start = addr + 0x800000;
+ par->dc_regs = ioremap(addr + 0x800000, 0x1000);
++ if (!par->dc_regs)
++ goto error;
+ par->cmap_regs_phys = addr + 0x840000;
+ par->cmap_regs = (__u8 *)ioremap(addr + 0x840000, 0x1000);
++ if (!par->cmap_regs)
++ goto error;
+ info->pseudo_palette = par->palette;
+- init_imstt(info);
+-
+- pci_set_drvdata(pdev, info);
+- return 0;
++ ret = init_imstt(info);
++ if (!ret)
++ pci_set_drvdata(pdev, info);
++ return ret;
++
++error:
++ if (par->dc_regs)
++ iounmap(par->dc_regs);
++ if (info->screen_base)
++ iounmap(info->screen_base);
++ release_mem_region(addr, size);
++ framebuffer_release(info);
++ return ret;
+ }
+
+ static void imsttfb_remove(struct pci_dev *pdev)
+diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
+index c4eb8661f7516..8ec260ed9a6f6 100644
+--- a/drivers/video/fbdev/imxfb.c
++++ b/drivers/video/fbdev/imxfb.c
+@@ -601,10 +601,10 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
+ if (var->hsync_len < 1 || var->hsync_len > 64)
+ printk(KERN_ERR "%s: invalid hsync_len %d\n",
+ info->fix.id, var->hsync_len);
+- if (var->left_margin > 255)
++ if (var->left_margin < 3 || var->left_margin > 255)
+ printk(KERN_ERR "%s: invalid left_margin %d\n",
+ info->fix.id, var->left_margin);
+- if (var->right_margin > 255)
++ if (var->right_margin < 1 || var->right_margin > 255)
+ printk(KERN_ERR "%s: invalid right_margin %d\n",
+ info->fix.id, var->right_margin);
+ if (var->yres < 1 || var->yres > ymax_mask)
+diff --git a/drivers/video/fbdev/matrox/matroxfb_maven.c b/drivers/video/fbdev/matrox/matroxfb_maven.c
+index bf5ce04f9aea5..267b31ddb02d3 100644
+--- a/drivers/video/fbdev/matrox/matroxfb_maven.c
++++ b/drivers/video/fbdev/matrox/matroxfb_maven.c
+@@ -299,7 +299,7 @@ static int matroxfb_mavenclock(const struct matrox_pll_ctl *ctl,
+ unsigned int* in, unsigned int* feed, unsigned int* post,
+ unsigned int* htotal2) {
+ unsigned int fvco;
+- unsigned int uninitialized_var(p);
++ unsigned int p;
+
+ fvco = matroxfb_PLL_mavenclock(&maven1000_pll, ctl, htotal, vtotal, in, feed, &p, htotal2);
+ if (!fvco)
+@@ -731,8 +731,8 @@ static int maven_find_exact_clocks(unsigned int ht, unsigned int vt,
+
+ for (x = 0; x < 8; x++) {
+ unsigned int c;
+- unsigned int uninitialized_var(a), uninitialized_var(b),
+- uninitialized_var(h2);
++ unsigned int a, b,
++ h2;
+ unsigned int h = ht + 2 + x;
+
+ if (!matroxfb_mavenclock((m->mode == MATROXFB_OUTPUT_MODE_PAL) ? &maven_PAL : &maven_NTSC, h, vt, &a, &b, &c, &h2)) {
+diff --git a/drivers/video/fbdev/omap/lcd_mipid.c b/drivers/video/fbdev/omap/lcd_mipid.c
+index e3a85432f9266..5730355ee5986 100644
+--- a/drivers/video/fbdev/omap/lcd_mipid.c
++++ b/drivers/video/fbdev/omap/lcd_mipid.c
+@@ -576,11 +576,15 @@ static int mipid_spi_probe(struct spi_device *spi)
+
+ r = mipid_detect(md);
+ if (r < 0)
+- return r;
++ goto free_md;
+
+ omapfb_register_panel(&md->panel);
+
+ return 0;
++
++free_md:
++ kfree(md);
++ return r;
+ }
+
+ static int mipid_spi_remove(struct spi_device *spi)
+diff --git a/drivers/video/fbdev/pm3fb.c b/drivers/video/fbdev/pm3fb.c
+index 6130aa56a1e93..7bd45334dcac4 100644
+--- a/drivers/video/fbdev/pm3fb.c
++++ b/drivers/video/fbdev/pm3fb.c
+@@ -821,9 +821,9 @@ static void pm3fb_write_mode(struct fb_info *info)
+
+ wmb();
+ {
+- unsigned char uninitialized_var(m); /* ClkPreScale */
+- unsigned char uninitialized_var(n); /* ClkFeedBackScale */
+- unsigned char uninitialized_var(p); /* ClkPostScale */
++ unsigned char m; /* ClkPreScale */
++ unsigned char n; /* ClkFeedBackScale */
++ unsigned char p; /* ClkPostScale */
+ unsigned long pixclock = PICOS2KHZ(info->var.pixclock);
+
+ (void)pm3fb_calculate_clock(pixclock, &m, &n, &p);
+diff --git a/drivers/video/fbdev/riva/riva_hw.c b/drivers/video/fbdev/riva/riva_hw.c
+index 0601c13f21050..f90b9327bae73 100644
+--- a/drivers/video/fbdev/riva/riva_hw.c
++++ b/drivers/video/fbdev/riva/riva_hw.c
+@@ -1245,8 +1245,7 @@ int CalcStateExt
+ )
+ {
+ int pixelDepth;
+- int uninitialized_var(VClk),uninitialized_var(m),
+- uninitialized_var(n), uninitialized_var(p);
++ int VClk, m, n, p;
+
+ /*
+ * Save mode parameters.
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 0cc0cfd3a3cb7..8acfbe420b5a0 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -268,7 +268,7 @@ static inline int virtqueue_add(struct virtqueue *_vq,
+ struct vring_virtqueue *vq = to_vvq(_vq);
+ struct scatterlist *sg;
+ struct vring_desc *desc;
+- unsigned int i, n, avail, descs_used, uninitialized_var(prev), err_idx;
++ unsigned int i, n, avail, descs_used, prev, err_idx;
+ int head;
+ bool indirect;
+
+diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
+index cb3650efc29cd..8db9ca241d99c 100644
+--- a/drivers/w1/w1.c
++++ b/drivers/w1/w1.c
+@@ -1237,10 +1237,10 @@ err_out_exit_init:
+
+ static void __exit w1_fini(void)
+ {
+- struct w1_master *dev;
++ struct w1_master *dev, *n;
+
+ /* Set netlink removal messages and some cleanup */
+- list_for_each_entry(dev, &w1_masters, w1_master_entry)
++ list_for_each_entry_safe(dev, n, &w1_masters, w1_master_entry)
+ __w1_remove_master_device(dev);
+
+ w1_fini_netlink();
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 59eb924840518..31055d71b7882 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -887,7 +887,7 @@ static struct dentry *afs_lookup(struct inode *dir, struct dentry *dentry,
+ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
+ {
+ struct afs_vnode *vnode, *dir;
+- struct afs_fid uninitialized_var(fid);
++ struct afs_fid fid;
+ struct dentry *parent;
+ struct inode *inode;
+ struct key *key;
+diff --git a/fs/afs/security.c b/fs/afs/security.c
+index 66042b432baa8..e12e532069eef 100644
+--- a/fs/afs/security.c
++++ b/fs/afs/security.c
+@@ -340,7 +340,7 @@ int afs_check_permit(struct afs_vnode *vnode, struct key *key,
+ int afs_permission(struct inode *inode, int mask)
+ {
+ struct afs_vnode *vnode = AFS_FS_I(inode);
+- afs_access_t uninitialized_var(access);
++ afs_access_t access;
+ struct key *key;
+ int ret;
+
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 34d56f0fa7501..e48c6d7a860f4 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -3590,6 +3590,8 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
+
+ ret = tree_mod_log_eb_copy(fs_info, split, c, 0, mid, c_nritems - mid);
+ if (ret) {
++ btrfs_tree_unlock(split);
++ free_extent_buffer(split);
+ btrfs_abort_transaction(trans, ret);
+ return ret;
+ }
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 69b43df186a89..ef95525fa6cdf 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -1115,7 +1115,9 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info)
+ goto end_trans;
+ }
+
++ spin_lock(&fs_info->trans_lock);
+ list_del("a_root->dirty_list);
++ spin_unlock(&fs_info->trans_lock);
+
+ btrfs_tree_lock(quota_root->node);
+ clean_tree_block(fs_info, quota_root->node);
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 049535115c9dc..1f31861453d9f 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -703,8 +703,13 @@ btrfs_attach_transaction_barrier(struct btrfs_root *root)
+
+ trans = start_transaction(root, 0, TRANS_ATTACH,
+ BTRFS_RESERVE_NO_FLUSH, true);
+- if (trans == ERR_PTR(-ENOENT))
+- btrfs_wait_for_commit(root->fs_info, 0);
++ if (trans == ERR_PTR(-ENOENT)) {
++ int ret;
++
++ ret = btrfs_wait_for_commit(root->fs_info, 0);
++ if (ret)
++ return ERR_PTR(ret);
++ }
+
+ return trans;
+ }
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index ba65b4bd7c0ac..fcfba2af5f98a 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -3285,6 +3285,15 @@ static void handle_cap_grant(struct inode *inode,
+ }
+ BUG_ON(cap->issued & ~cap->implemented);
+
++ /* don't let check_caps skip sending a response to MDS for revoke msgs */
++ if (le32_to_cpu(grant->op) == CEPH_CAP_OP_REVOKE) {
++ cap->mds_wanted = 0;
++ if (cap == ci->i_auth_cap)
++ check_caps = 1; /* check auth cap only */
++ else
++ check_caps = 2; /* check all caps */
++ }
++
+ if (extra_info->inline_version > 0 &&
+ extra_info->inline_version >= ci->i_inline_version) {
+ ci->i_inline_version = extra_info->inline_version;
+diff --git a/fs/dlm/netlink.c b/fs/dlm/netlink.c
+index 43a96c330570d..ea50f59610e52 100644
+--- a/fs/dlm/netlink.c
++++ b/fs/dlm/netlink.c
+@@ -115,7 +115,7 @@ static void fill_data(struct dlm_lock_data *data, struct dlm_lkb *lkb)
+
+ void dlm_timeout_warn(struct dlm_lkb *lkb)
+ {
+- struct sk_buff *uninitialized_var(send_skb);
++ struct sk_buff *send_skb;
+ struct dlm_lock_data *data;
+ size_t size;
+ int rv;
+diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c
+index e0c05e08d8bfe..9fef426ce6f41 100644
+--- a/fs/dlm/plock.c
++++ b/fs/dlm/plock.c
+@@ -22,20 +22,20 @@ static struct list_head recv_list;
+ static wait_queue_head_t send_wq;
+ static wait_queue_head_t recv_wq;
+
+-struct plock_op {
+- struct list_head list;
+- int done;
+- struct dlm_plock_info info;
+- int (*callback)(struct file_lock *fl, int result);
+-};
+-
+-struct plock_xop {
+- struct plock_op xop;
++struct plock_async_data {
+ void *fl;
+ void *file;
+ struct file_lock flc;
++ int (*callback)(struct file_lock *fl, int result);
+ };
+
++struct plock_op {
++ struct list_head list;
++ int done;
++ struct dlm_plock_info info;
++ /* if set indicates async handling */
++ struct plock_async_data *data;
++};
+
+ static inline void set_version(struct dlm_plock_info *info)
+ {
+@@ -61,6 +61,12 @@ static int check_version(struct dlm_plock_info *info)
+ return 0;
+ }
+
++static void dlm_release_plock_op(struct plock_op *op)
++{
++ kfree(op->data);
++ kfree(op);
++}
++
+ static void send_op(struct plock_op *op)
+ {
+ set_version(&op->info);
+@@ -104,22 +110,21 @@ static void do_unlock_close(struct dlm_ls *ls, u64 number,
+ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file,
+ int cmd, struct file_lock *fl)
+ {
++ struct plock_async_data *op_data;
+ struct dlm_ls *ls;
+ struct plock_op *op;
+- struct plock_xop *xop;
+ int rv;
+
+ ls = dlm_find_lockspace_local(lockspace);
+ if (!ls)
+ return -EINVAL;
+
+- xop = kzalloc(sizeof(*xop), GFP_NOFS);
+- if (!xop) {
++ op = kzalloc(sizeof(*op), GFP_NOFS);
++ if (!op) {
+ rv = -ENOMEM;
+ goto out;
+ }
+
+- op = &xop->xop;
+ op->info.optype = DLM_PLOCK_OP_LOCK;
+ op->info.pid = fl->fl_pid;
+ op->info.ex = (fl->fl_type == F_WRLCK);
+@@ -128,35 +133,44 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file,
+ op->info.number = number;
+ op->info.start = fl->fl_start;
+ op->info.end = fl->fl_end;
++ /* async handling */
+ if (fl->fl_lmops && fl->fl_lmops->lm_grant) {
++ op_data = kzalloc(sizeof(*op_data), GFP_NOFS);
++ if (!op_data) {
++ dlm_release_plock_op(op);
++ rv = -ENOMEM;
++ goto out;
++ }
++
+ /* fl_owner is lockd which doesn't distinguish
+ processes on the nfs client */
+ op->info.owner = (__u64) fl->fl_pid;
+- op->callback = fl->fl_lmops->lm_grant;
+- locks_init_lock(&xop->flc);
+- locks_copy_lock(&xop->flc, fl);
+- xop->fl = fl;
+- xop->file = file;
++ op_data->callback = fl->fl_lmops->lm_grant;
++ locks_init_lock(&op_data->flc);
++ locks_copy_lock(&op_data->flc, fl);
++ op_data->fl = fl;
++ op_data->file = file;
++
++ op->data = op_data;
++
++ send_op(op);
++ rv = FILE_LOCK_DEFERRED;
++ goto out;
+ } else {
+ op->info.owner = (__u64)(long) fl->fl_owner;
+ }
+
+ send_op(op);
+
+- if (!op->callback) {
+- rv = wait_event_interruptible(recv_wq, (op->done != 0));
+- if (rv == -ERESTARTSYS) {
+- log_debug(ls, "dlm_posix_lock: wait killed %llx",
+- (unsigned long long)number);
+- spin_lock(&ops_lock);
+- list_del(&op->list);
+- spin_unlock(&ops_lock);
+- kfree(xop);
+- do_unlock_close(ls, number, file, fl);
+- goto out;
+- }
+- } else {
+- rv = FILE_LOCK_DEFERRED;
++ rv = wait_event_killable(recv_wq, (op->done != 0));
++ if (rv == -ERESTARTSYS) {
++ log_debug(ls, "%s: wait killed %llx", __func__,
++ (unsigned long long)number);
++ spin_lock(&ops_lock);
++ list_del(&op->list);
++ spin_unlock(&ops_lock);
++ dlm_release_plock_op(op);
++ do_unlock_close(ls, number, file, fl);
+ goto out;
+ }
+
+@@ -176,7 +190,7 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file,
+ (unsigned long long)number);
+ }
+
+- kfree(xop);
++ dlm_release_plock_op(op);
+ out:
+ dlm_put_lockspace(ls);
+ return rv;
+@@ -186,11 +200,11 @@ EXPORT_SYMBOL_GPL(dlm_posix_lock);
+ /* Returns failure iff a successful lock operation should be canceled */
+ static int dlm_plock_callback(struct plock_op *op)
+ {
++ struct plock_async_data *op_data = op->data;
+ struct file *file;
+ struct file_lock *fl;
+ struct file_lock *flc;
+ int (*notify)(struct file_lock *fl, int result) = NULL;
+- struct plock_xop *xop = (struct plock_xop *)op;
+ int rv = 0;
+
+ spin_lock(&ops_lock);
+@@ -202,10 +216,10 @@ static int dlm_plock_callback(struct plock_op *op)
+ spin_unlock(&ops_lock);
+
+ /* check if the following 2 are still valid or make a copy */
+- file = xop->file;
+- flc = &xop->flc;
+- fl = xop->fl;
+- notify = op->callback;
++ file = op_data->file;
++ flc = &op_data->flc;
++ fl = op_data->fl;
++ notify = op_data->callback;
+
+ if (op->info.rv) {
+ notify(fl, op->info.rv);
+@@ -236,7 +250,7 @@ static int dlm_plock_callback(struct plock_op *op)
+ }
+
+ out:
+- kfree(xop);
++ dlm_release_plock_op(op);
+ return rv;
+ }
+
+@@ -306,7 +320,7 @@ int dlm_posix_unlock(dlm_lockspace_t *lockspace, u64 number, struct file *file,
+ rv = 0;
+
+ out_free:
+- kfree(op);
++ dlm_release_plock_op(op);
+ out:
+ dlm_put_lockspace(ls);
+ fl->fl_flags = fl_flags;
+@@ -366,13 +380,15 @@ int dlm_posix_get(dlm_lockspace_t *lockspace, u64 number, struct file *file,
+ locks_init_lock(fl);
+ fl->fl_type = (op->info.ex) ? F_WRLCK : F_RDLCK;
+ fl->fl_flags = FL_POSIX;
+- fl->fl_pid = -op->info.pid;
++ fl->fl_pid = op->info.pid;
++ if (op->info.nodeid != dlm_our_nodeid())
++ fl->fl_pid = -fl->fl_pid;
+ fl->fl_start = op->info.start;
+ fl->fl_end = op->info.end;
+ rv = 0;
+ }
+
+- kfree(op);
++ dlm_release_plock_op(op);
+ out:
+ dlm_put_lockspace(ls);
+ return rv;
+@@ -408,7 +424,7 @@ static ssize_t dev_read(struct file *file, char __user *u, size_t count,
+ (the process did not make an unlock call). */
+
+ if (op->info.flags & DLM_PLOCK_FL_CLOSE)
+- kfree(op);
++ dlm_release_plock_op(op);
+
+ if (copy_to_user(u, &info, sizeof(info)))
+ return -EFAULT;
+@@ -440,7 +456,7 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,
+ op->info.owner == info.owner) {
+ list_del_init(&op->list);
+ memcpy(&op->info, &info, sizeof(info));
+- if (op->callback)
++ if (op->data)
+ do_callback = 1;
+ else
+ op->done = 1;
+diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h
+index a203a5723e2c0..598dc28748086 100644
+--- a/fs/ext2/ext2.h
++++ b/fs/ext2/ext2.h
+@@ -68,10 +68,7 @@ struct mb_cache;
+ * second extended-fs super-block data in memory
+ */
+ struct ext2_sb_info {
+- unsigned long s_frag_size; /* Size of a fragment in bytes */
+- unsigned long s_frags_per_block;/* Number of fragments per block */
+ unsigned long s_inodes_per_block;/* Number of inodes per block */
+- unsigned long s_frags_per_group;/* Number of fragments in a group */
+ unsigned long s_blocks_per_group;/* Number of blocks in a group */
+ unsigned long s_inodes_per_group;/* Number of inodes in a group */
+ unsigned long s_itb_per_group; /* Number of inode table blocks per group */
+@@ -185,15 +182,6 @@ static inline struct ext2_sb_info *EXT2_SB(struct super_block *sb)
+ #define EXT2_INODE_SIZE(s) (EXT2_SB(s)->s_inode_size)
+ #define EXT2_FIRST_INO(s) (EXT2_SB(s)->s_first_ino)
+
+-/*
+- * Macro-instructions used to manage fragments
+- */
+-#define EXT2_MIN_FRAG_SIZE 1024
+-#define EXT2_MAX_FRAG_SIZE 4096
+-#define EXT2_MIN_FRAG_LOG_SIZE 10
+-#define EXT2_FRAG_SIZE(s) (EXT2_SB(s)->s_frag_size)
+-#define EXT2_FRAGS_PER_BLOCK(s) (EXT2_SB(s)->s_frags_per_block)
+-
+ /*
+ * Structure of a blocks group descriptor
+ */
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index 3349ce85d27cb..5c0af53f2e8fc 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -691,10 +691,9 @@ static int ext2_setup_super (struct super_block * sb,
+ es->s_max_mnt_count = cpu_to_le16(EXT2_DFL_MAX_MNT_COUNT);
+ le16_add_cpu(&es->s_mnt_count, 1);
+ if (test_opt (sb, DEBUG))
+- ext2_msg(sb, KERN_INFO, "%s, %s, bs=%lu, fs=%lu, gc=%lu, "
++ ext2_msg(sb, KERN_INFO, "%s, %s, bs=%lu, gc=%lu, "
+ "bpg=%lu, ipg=%lu, mo=%04lx]",
+ EXT2FS_VERSION, EXT2FS_DATE, sb->s_blocksize,
+- sbi->s_frag_size,
+ sbi->s_groups_count,
+ EXT2_BLOCKS_PER_GROUP(sb),
+ EXT2_INODES_PER_GROUP(sb),
+@@ -1040,14 +1039,7 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
+ }
+ }
+
+- sbi->s_frag_size = EXT2_MIN_FRAG_SIZE <<
+- le32_to_cpu(es->s_log_frag_size);
+- if (sbi->s_frag_size == 0)
+- goto cantfind_ext2;
+- sbi->s_frags_per_block = sb->s_blocksize / sbi->s_frag_size;
+-
+ sbi->s_blocks_per_group = le32_to_cpu(es->s_blocks_per_group);
+- sbi->s_frags_per_group = le32_to_cpu(es->s_frags_per_group);
+ sbi->s_inodes_per_group = le32_to_cpu(es->s_inodes_per_group);
+
+ if (EXT2_INODE_SIZE(sb) == 0)
+@@ -1075,11 +1067,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
+ goto failed_mount;
+ }
+
+- if (sb->s_blocksize != sbi->s_frag_size) {
++ if (es->s_log_frag_size != es->s_log_block_size) {
+ ext2_msg(sb, KERN_ERR,
+- "error: fragsize %lu != blocksize %lu"
+- "(not supported yet)",
+- sbi->s_frag_size, sb->s_blocksize);
++ "error: fragsize log %u != blocksize log %u",
++ le32_to_cpu(es->s_log_frag_size), sb->s_blocksize_bits);
+ goto failed_mount;
+ }
+
+@@ -1089,12 +1080,6 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
+ sbi->s_blocks_per_group);
+ goto failed_mount;
+ }
+- if (sbi->s_frags_per_group > sb->s_blocksize * 8) {
+- ext2_msg(sb, KERN_ERR,
+- "error: #fragments per group too big: %lu",
+- sbi->s_frags_per_group);
+- goto failed_mount;
+- }
+ if (sbi->s_inodes_per_group < sbi->s_inodes_per_block ||
+ sbi->s_inodes_per_group > sb->s_blocksize * 8) {
+ ext2_msg(sb, KERN_ERR,
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 19e2a52d1e5a1..909f231a387d7 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1412,7 +1412,7 @@ struct ext4_sb_info {
+ unsigned long s_commit_interval;
+ u32 s_max_batch_time;
+ u32 s_min_batch_time;
+- struct block_device *journal_bdev;
++ struct block_device *s_journal_bdev;
+ #ifdef CONFIG_QUOTA
+ /* Names of quota files with journalled quota */
+ char __rcu *s_qf_names[EXT4_MAXQUOTAS];
+diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c
+index 6b52ace1463c2..69c76327792e0 100644
+--- a/fs/ext4/fsmap.c
++++ b/fs/ext4/fsmap.c
+@@ -576,8 +576,8 @@ static bool ext4_getfsmap_is_valid_device(struct super_block *sb,
+ if (fm->fmr_device == 0 || fm->fmr_device == UINT_MAX ||
+ fm->fmr_device == new_encode_dev(sb->s_bdev->bd_dev))
+ return true;
+- if (EXT4_SB(sb)->journal_bdev &&
+- fm->fmr_device == new_encode_dev(EXT4_SB(sb)->journal_bdev->bd_dev))
++ if (EXT4_SB(sb)->s_journal_bdev &&
++ fm->fmr_device == new_encode_dev(EXT4_SB(sb)->s_journal_bdev->bd_dev))
+ return true;
+ return false;
+ }
+@@ -647,9 +647,9 @@ int ext4_getfsmap(struct super_block *sb, struct ext4_fsmap_head *head,
+ memset(handlers, 0, sizeof(handlers));
+ handlers[0].gfd_dev = new_encode_dev(sb->s_bdev->bd_dev);
+ handlers[0].gfd_fn = ext4_getfsmap_datadev;
+- if (EXT4_SB(sb)->journal_bdev) {
++ if (EXT4_SB(sb)->s_journal_bdev) {
+ handlers[1].gfd_dev = new_encode_dev(
+- EXT4_SB(sb)->journal_bdev->bd_dev);
++ EXT4_SB(sb)->s_journal_bdev->bd_dev);
+ handlers[1].gfd_fn = ext4_getfsmap_logdev;
+ }
+
+diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
+index 0cc0d22c08569..9bf711d63368c 100644
+--- a/fs/ext4/indirect.c
++++ b/fs/ext4/indirect.c
+@@ -642,6 +642,14 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
+
+ ext4_update_inode_fsync_trans(handle, inode, 1);
+ count = ar.len;
++
++ /*
++ * Update reserved blocks/metadata blocks after successful block
++ * allocation which had been deferred till now.
++ */
++ if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE)
++ ext4_da_update_reserve_space(inode, count, 1);
++
+ got_it:
+ map->m_flags |= EXT4_MAP_MAPPED;
+ map->m_pblk = le32_to_cpu(chain[depth-1].key);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 7aaf4dafd3e78..646285fbc9fc0 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -668,16 +668,6 @@ found:
+ */
+ ext4_clear_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
+ }
+-
+- /*
+- * Update reserved blocks/metadata blocks after successful
+- * block allocation which had been deferred till now. We don't
+- * support fallocate for non extent files. So we can update
+- * reserve space here.
+- */
+- if ((retval > 0) &&
+- (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE))
+- ext4_da_update_reserve_space(inode, retval, 1);
+ }
+
+ if (retval > 0) {
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index b930e8d559d41..43e036f0b661d 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -561,6 +561,7 @@ static int ext4_shutdown(struct super_block *sb, unsigned long arg)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+ __u32 flags;
++ struct super_block *ret;
+
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+@@ -579,7 +580,9 @@ static int ext4_shutdown(struct super_block *sb, unsigned long arg)
+
+ switch (flags) {
+ case EXT4_GOING_FLAGS_DEFAULT:
+- freeze_bdev(sb->s_bdev);
++ ret = freeze_bdev(sb->s_bdev);
++ if (IS_ERR(ret))
++ return PTR_ERR(ret);
+ set_bit(EXT4_FLAGS_SHUTDOWN, &sbi->s_ext4_flags);
+ thaw_bdev(sb->s_bdev, sb);
+ break;
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 23e56c1ffc1bf..7692c12b85285 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -4948,8 +4948,8 @@ do_more:
+ * them with group lock_held
+ */
+ if (test_opt(sb, DISCARD)) {
+- err = ext4_issue_discard(sb, block_group, bit, count,
+- NULL);
++ err = ext4_issue_discard(sb, block_group, bit,
++ count_clusters, NULL);
+ if (err && err != -EOPNOTSUPP)
+ ext4_msg(sb, KERN_WARNING, "discard request in"
+ " group:%d block:%d count:%lu failed"
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index ce5abd25eb99c..926063a6d2321 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -905,10 +905,16 @@ static void ext4_blkdev_put(struct block_device *bdev)
+ static void ext4_blkdev_remove(struct ext4_sb_info *sbi)
+ {
+ struct block_device *bdev;
+- bdev = sbi->journal_bdev;
++ bdev = sbi->s_journal_bdev;
+ if (bdev) {
++ /*
++ * Invalidate the journal device's buffers. We don't want them
++ * floating about in memory - the physical journal device may
++ * hotswapped, and it breaks the `ro-after' testing code.
++ */
++ invalidate_bdev(bdev);
+ ext4_blkdev_put(bdev);
+- sbi->journal_bdev = NULL;
++ sbi->s_journal_bdev = NULL;
+ }
+ }
+
+@@ -1032,14 +1038,8 @@ static void ext4_put_super(struct super_block *sb)
+
+ sync_blockdev(sb->s_bdev);
+ invalidate_bdev(sb->s_bdev);
+- if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
+- /*
+- * Invalidate the journal device's buffers. We don't want them
+- * floating about in memory - the physical journal device may
+- * hotswapped, and it breaks the `ro-after' testing code.
+- */
+- sync_blockdev(sbi->journal_bdev);
+- invalidate_bdev(sbi->journal_bdev);
++ if (sbi->s_journal_bdev && sbi->s_journal_bdev != sb->s_bdev) {
++ sync_blockdev(sbi->s_journal_bdev);
+ ext4_blkdev_remove(sbi);
+ }
+ if (sbi->s_ea_inode_cache) {
+@@ -3537,7 +3537,7 @@ int ext4_calculate_overhead(struct super_block *sb)
+ * Add the internal journal blocks whether the journal has been
+ * loaded or not
+ */
+- if (sbi->s_journal && !sbi->journal_bdev)
++ if (sbi->s_journal && !sbi->s_journal_bdev)
+ overhead += EXT4_NUM_B2C(sbi, sbi->s_journal->j_maxlen);
+ else if (ext4_has_feature_journal(sb) && !sbi->s_journal && j_inum) {
+ /* j_inum for internal journal is non-zero */
+@@ -4673,6 +4673,7 @@ failed_mount:
+ ext4_blkdev_remove(sbi);
+ brelse(bh);
+ out_fail:
++ invalidate_bdev(sb->s_bdev);
+ sb->s_fs_info = NULL;
+ kfree(sbi->s_blockgroup_lock);
+ out_free_base:
+@@ -4848,7 +4849,7 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb,
+ be32_to_cpu(journal->j_superblock->s_nr_users));
+ goto out_journal;
+ }
+- EXT4_SB(sb)->journal_bdev = bdev;
++ EXT4_SB(sb)->s_journal_bdev = bdev;
+ ext4_init_journal_params(sb, journal);
+ return journal;
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index f8a8807c20977..88bdb2714e519 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1767,6 +1767,20 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
+ memmove(here, (void *)here + size,
+ (void *)last - (void *)here + sizeof(__u32));
+ memset(last, 0, size);
++
++ /*
++ * Update i_inline_off - moved ibody region might contain
++ * system.data attribute. Handling a failure here won't
++ * cause other complications for setting an xattr.
++ */
++ if (!is_block && ext4_has_inline_data(inode)) {
++ ret = ext4_find_inline_data_nolock(inode);
++ if (ret) {
++ ext4_warning_inode(inode,
++ "unable to update i_inline_off");
++ goto out;
++ }
++ }
+ } else if (s->not_found) {
+ /* Insert new name. */
+ size_t size = EXT4_XATTR_LEN(name_len);
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 2c28f488ac2f0..9911f780e0136 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -879,8 +879,10 @@ static int truncate_dnode(struct dnode_of_data *dn)
+ dn->ofs_in_node = 0;
+ f2fs_truncate_data_blocks(dn);
+ err = truncate_node(dn);
+- if (err)
++ if (err) {
++ f2fs_put_page(page, 1);
+ return err;
++ }
+
+ return 1;
+ }
+diff --git a/fs/fat/dir.c b/fs/fat/dir.c
+index de60c05c0ca1d..10769b2e4d468 100644
+--- a/fs/fat/dir.c
++++ b/fs/fat/dir.c
+@@ -1287,7 +1287,7 @@ int fat_add_entries(struct inode *dir, void *slots, int nr_slots,
+ struct super_block *sb = dir->i_sb;
+ struct msdos_sb_info *sbi = MSDOS_SB(sb);
+ struct buffer_head *bh, *prev, *bhs[3]; /* 32*slots (672bytes) */
+- struct msdos_dir_entry *uninitialized_var(de);
++ struct msdos_dir_entry *de;
+ int err, free_slots, i, nr_bhs;
+ loff_t pos, i_pos;
+
+diff --git a/fs/fuse/control.c b/fs/fuse/control.c
+index acc35819aae64..af253127b309a 100644
+--- a/fs/fuse/control.c
++++ b/fs/fuse/control.c
+@@ -117,7 +117,7 @@ static ssize_t fuse_conn_max_background_write(struct file *file,
+ const char __user *buf,
+ size_t count, loff_t *ppos)
+ {
+- unsigned uninitialized_var(val);
++ unsigned val;
+ ssize_t ret;
+
+ ret = fuse_conn_limit_write(file, buf, count, ppos, &val,
+diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
+index e10e2b62ccf45..acd985aa2cbab 100644
+--- a/fs/fuse/cuse.c
++++ b/fs/fuse/cuse.c
+@@ -269,7 +269,7 @@ static int cuse_parse_one(char **pp, char *end, char **keyp, char **valp)
+ static int cuse_parse_devinfo(char *p, size_t len, struct cuse_devinfo *devinfo)
+ {
+ char *end = p + len;
+- char *uninitialized_var(key), *uninitialized_var(val);
++ char *key, *val;
+ int rc;
+
+ while (true) {
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 6098e0c7f87b3..0e03adbcf9423 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -232,7 +232,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
+ spin_unlock(&fc->lock);
+ }
+ kfree(forget);
+- if (ret == -ENOMEM)
++ if (ret == -ENOMEM || ret == -EINTR)
+ goto out;
+ if (ret || fuse_invalid_attr(&outarg.attr) ||
+ (outarg.attr.mode ^ inode->i_mode) & S_IFMT)
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 599a6eeed02e0..c629ccafb2b0e 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -2774,7 +2774,7 @@ static void fuse_register_polled_file(struct fuse_conn *fc,
+ {
+ spin_lock(&fc->lock);
+ if (RB_EMPTY_NODE(&ff->polled_node)) {
+- struct rb_node **link, *uninitialized_var(parent);
++ struct rb_node **link, *parent;
+
+ link = fuse_find_polled_node(fc, ff->kh, &parent);
+ BUG_ON(*link);
+diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
+index d9866d89f2fb9..910bfc39dc4b4 100644
+--- a/fs/gfs2/aops.c
++++ b/fs/gfs2/aops.c
+@@ -359,7 +359,7 @@ static int gfs2_write_cache_jdata(struct address_space *mapping,
+ int done = 0;
+ struct pagevec pvec;
+ int nr_pages;
+- pgoff_t uninitialized_var(writeback_index);
++ pgoff_t writeback_index;
+ pgoff_t index;
+ pgoff_t end;
+ pgoff_t done_index;
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index ccafd45b63f69..729f36fdced1f 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -1754,7 +1754,7 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)
+ u64 lblock = (offset + (1 << bsize_shift) - 1) >> bsize_shift;
+ __u16 start_list[GFS2_MAX_META_HEIGHT];
+ __u16 __end_list[GFS2_MAX_META_HEIGHT], *end_list = NULL;
+- unsigned int start_aligned, uninitialized_var(end_aligned);
++ unsigned int start_aligned, end_aligned;
+ unsigned int strip_h = ip->i_height - 1;
+ u32 btotal = 0;
+ int ret, state;
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index 3cc2237e58967..bb0eaa4638e3c 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -1586,6 +1586,14 @@ static void gfs2_evict_inode(struct inode *inode)
+ if (inode->i_nlink || sb_rdonly(sb))
+ goto out;
+
++ /*
++ * In case of an incomplete mount, gfs2_evict_inode() may be called for
++ * system files without having an active journal to write to. In that
++ * case, skip the filesystem evict.
++ */
++ if (!sdp->sd_jdesc)
++ goto out;
++
+ if (test_bit(GIF_ALLOC_FAILED, &ip->i_flags)) {
+ BUG_ON(!gfs2_glock_is_locked_by_me(ip->i_gl));
+ gfs2_holder_mark_uninitialized(&gh);
+diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c
+index c8d1b2be7854e..73342c925a4b6 100644
+--- a/fs/hfsplus/unicode.c
++++ b/fs/hfsplus/unicode.c
+@@ -398,7 +398,7 @@ int hfsplus_hash_dentry(const struct dentry *dentry, struct qstr *str)
+ astr = str->name;
+ len = str->len;
+ while (len > 0) {
+- int uninitialized_var(dsize);
++ int dsize;
+ size = asc2unichar(sb, astr, len, &c);
+ astr += size;
+ len -= size;
+diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c
+index 558e7c51ce0d4..58f80e1b3ac0d 100644
+--- a/fs/isofs/namei.c
++++ b/fs/isofs/namei.c
+@@ -153,8 +153,8 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
+ struct dentry *isofs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
+ {
+ int found;
+- unsigned long uninitialized_var(block);
+- unsigned long uninitialized_var(offset);
++ unsigned long block;
++ unsigned long offset;
+ struct inode *inode;
+ struct page *page;
+
+diff --git a/fs/jffs2/build.c b/fs/jffs2/build.c
+index 837cd55fd4c5e..6ae9d6fefb861 100644
+--- a/fs/jffs2/build.c
++++ b/fs/jffs2/build.c
+@@ -211,7 +211,10 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c)
+ ic->scan_dents = NULL;
+ cond_resched();
+ }
+- jffs2_build_xattr_subsystem(c);
++ ret = jffs2_build_xattr_subsystem(c);
++ if (ret)
++ goto exit;
++
+ c->flags &= ~JFFS2_SB_FLAG_BUILDING;
+
+ dbg_fsbuild("FS build complete\n");
+diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
+index 83b8f06b4a642..7e9abdb897122 100644
+--- a/fs/jffs2/erase.c
++++ b/fs/jffs2/erase.c
+@@ -401,7 +401,7 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
+ {
+ size_t retlen;
+ int ret;
+- uint32_t uninitialized_var(bad_offset);
++ uint32_t bad_offset;
+
+ switch (jffs2_block_check_erase(c, jeb, &bad_offset)) {
+ case -EAGAIN: goto refile;
+diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
+index da3e18503c658..acb4492f5970c 100644
+--- a/fs/jffs2/xattr.c
++++ b/fs/jffs2/xattr.c
+@@ -772,10 +772,10 @@ void jffs2_clear_xattr_subsystem(struct jffs2_sb_info *c)
+ }
+
+ #define XREF_TMPHASH_SIZE (128)
+-void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
++int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
+ {
+ struct jffs2_xattr_ref *ref, *_ref;
+- struct jffs2_xattr_ref *xref_tmphash[XREF_TMPHASH_SIZE];
++ struct jffs2_xattr_ref **xref_tmphash;
+ struct jffs2_xattr_datum *xd, *_xd;
+ struct jffs2_inode_cache *ic;
+ struct jffs2_raw_node_ref *raw;
+@@ -784,9 +784,12 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
+
+ BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
+
++ xref_tmphash = kcalloc(XREF_TMPHASH_SIZE,
++ sizeof(struct jffs2_xattr_ref *), GFP_KERNEL);
++ if (!xref_tmphash)
++ return -ENOMEM;
++
+ /* Phase.1 : Merge same xref */
+- for (i=0; i < XREF_TMPHASH_SIZE; i++)
+- xref_tmphash[i] = NULL;
+ for (ref=c->xref_temp; ref; ref=_ref) {
+ struct jffs2_xattr_ref *tmp;
+
+@@ -884,6 +887,8 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
+ "%u of xref (%u dead, %u orphan) found.\n",
+ xdatum_count, xdatum_unchecked_count, xdatum_orphan_count,
+ xref_count, xref_dead_count, xref_orphan_count);
++ kfree(xref_tmphash);
++ return 0;
+ }
+
+ struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,
+diff --git a/fs/jffs2/xattr.h b/fs/jffs2/xattr.h
+index 720007b2fd65d..1b5030a3349db 100644
+--- a/fs/jffs2/xattr.h
++++ b/fs/jffs2/xattr.h
+@@ -71,7 +71,7 @@ static inline int is_xattr_ref_dead(struct jffs2_xattr_ref *ref)
+ #ifdef CONFIG_JFFS2_FS_XATTR
+
+ extern void jffs2_init_xattr_subsystem(struct jffs2_sb_info *c);
+-extern void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c);
++extern int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c);
+ extern void jffs2_clear_xattr_subsystem(struct jffs2_sb_info *c);
+
+ extern struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,
+@@ -103,7 +103,7 @@ extern ssize_t jffs2_listxattr(struct dentry *, char *, size_t);
+ #else
+
+ #define jffs2_init_xattr_subsystem(c)
+-#define jffs2_build_xattr_subsystem(c)
++#define jffs2_build_xattr_subsystem(c) (0)
+ #define jffs2_clear_xattr_subsystem(c)
+
+ #define jffs2_xattr_do_crccheck_inode(c, ic)
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 3ad0a33e0443b..07b9df8938f29 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -191,7 +191,13 @@ int dbMount(struct inode *ipbmap)
+ dbmp_le = (struct dbmap_disk *) mp->data;
+ bmp->db_mapsize = le64_to_cpu(dbmp_le->dn_mapsize);
+ bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree);
++
+ bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage);
++ if (bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE) {
++ err = -EINVAL;
++ goto err_release_metapage;
++ }
++
+ bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
+ if (!bmp->db_numag) {
+ err = -EINVAL;
+diff --git a/fs/jfs/jfs_filsys.h b/fs/jfs/jfs_filsys.h
+index 415bfa90607a2..0c36ce6318d53 100644
+--- a/fs/jfs/jfs_filsys.h
++++ b/fs/jfs/jfs_filsys.h
+@@ -135,7 +135,9 @@
+ #define NUM_INODE_PER_IAG INOSPERIAG
+
+ #define MINBLOCKSIZE 512
++#define L2MINBLOCKSIZE 9
+ #define MAXBLOCKSIZE 4096
++#define L2MAXBLOCKSIZE 12
+ #define MAXFILESIZE ((s64)1 << 52)
+
+ #define JFS_LINK_MAX 0xffffffff
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index c82f898325c1c..74ab20c89e752 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -3403,7 +3403,7 @@ nfsd4_encode_open(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_op
+ p = xdr_reserve_space(xdr, 32);
+ if (!p)
+ return nfserr_resource;
+- *p++ = cpu_to_be32(0);
++ *p++ = cpu_to_be32(open->op_recall);
+
+ /*
+ * TODO: space_limit's in delegations
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index ff9899cc9913f..7af48d306f20c 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -347,7 +347,7 @@ static ssize_t write_unlock_fs(struct file *file, char *buf, size_t size)
+ static ssize_t write_filehandle(struct file *file, char *buf, size_t size)
+ {
+ char *dname, *path;
+- int uninitialized_var(maxsize);
++ int maxsize;
+ char *mesg = buf;
+ int len;
+ struct auth_domain *dom;
+diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
+index 046f5e3c9622d..c7cf0913229cb 100644
+--- a/fs/ocfs2/alloc.c
++++ b/fs/ocfs2/alloc.c
+@@ -4722,7 +4722,7 @@ int ocfs2_insert_extent(handle_t *handle,
+ struct ocfs2_alloc_context *meta_ac)
+ {
+ int status;
+- int uninitialized_var(free_records);
++ int free_records;
+ struct buffer_head *last_eb_bh = NULL;
+ struct ocfs2_insert_type insert = {0, };
+ struct ocfs2_extent_rec rec;
+@@ -7052,7 +7052,7 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
+ int need_free = 0;
+ u32 bit_off, num;
+ handle_t *handle;
+- u64 uninitialized_var(block);
++ u64 block;
+ struct ocfs2_inode_info *oi = OCFS2_I(inode);
+ struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+ struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
+diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
+index c121abbdfc7db..13f4bb4e174c4 100644
+--- a/fs/ocfs2/dir.c
++++ b/fs/ocfs2/dir.c
+@@ -866,9 +866,9 @@ static int ocfs2_dx_dir_lookup(struct inode *inode,
+ u64 *ret_phys_blkno)
+ {
+ int ret = 0;
+- unsigned int cend, uninitialized_var(clen);
+- u32 uninitialized_var(cpos);
+- u64 uninitialized_var(blkno);
++ unsigned int cend, clen;
++ u32 cpos;
++ u64 blkno;
+ u32 name_hash = hinfo->major_hash;
+
+ ret = ocfs2_dx_dir_lookup_rec(inode, el, name_hash, &cpos, &blkno,
+@@ -912,7 +912,7 @@ static int ocfs2_dx_dir_search(const char *name, int namelen,
+ struct ocfs2_dir_lookup_result *res)
+ {
+ int ret, i, found;
+- u64 uninitialized_var(phys);
++ u64 phys;
+ struct buffer_head *dx_leaf_bh = NULL;
+ struct ocfs2_dx_leaf *dx_leaf;
+ struct ocfs2_dx_entry *dx_entry = NULL;
+@@ -4420,9 +4420,9 @@ out:
+ int ocfs2_dx_dir_truncate(struct inode *dir, struct buffer_head *di_bh)
+ {
+ int ret;
+- unsigned int uninitialized_var(clen);
+- u32 major_hash = UINT_MAX, p_cpos, uninitialized_var(cpos);
+- u64 uninitialized_var(blkno);
++ unsigned int clen;
++ u32 major_hash = UINT_MAX, p_cpos, cpos;
++ u64 blkno;
+ struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
+ struct buffer_head *dx_root_bh = NULL;
+ struct ocfs2_dx_root_block *dx_root;
+diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
+index 06cb96462bf99..1f41171c14687 100644
+--- a/fs/ocfs2/extent_map.c
++++ b/fs/ocfs2/extent_map.c
+@@ -416,7 +416,7 @@ static int ocfs2_get_clusters_nocache(struct inode *inode,
+ {
+ int i, ret, tree_height, len;
+ struct ocfs2_dinode *di;
+- struct ocfs2_extent_block *uninitialized_var(eb);
++ struct ocfs2_extent_block *eb;
+ struct ocfs2_extent_list *el;
+ struct ocfs2_extent_rec *rec;
+ struct buffer_head *eb_bh = NULL;
+@@ -613,7 +613,7 @@ int ocfs2_get_clusters(struct inode *inode, u32 v_cluster,
+ unsigned int *extent_flags)
+ {
+ int ret;
+- unsigned int uninitialized_var(hole_len), flags = 0;
++ unsigned int hole_len, flags = 0;
+ struct buffer_head *di_bh = NULL;
+ struct ocfs2_extent_rec rec;
+
+diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
+index d437b21925228..bd8d742adf65a 100644
+--- a/fs/ocfs2/namei.c
++++ b/fs/ocfs2/namei.c
+@@ -2506,7 +2506,7 @@ int ocfs2_create_inode_in_orphan(struct inode *dir,
+ struct buffer_head *new_di_bh = NULL;
+ struct ocfs2_alloc_context *inode_ac = NULL;
+ struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
+- u64 uninitialized_var(di_blkno), suballoc_loc;
++ u64 di_blkno, suballoc_loc;
+ u16 suballoc_bit;
+
+ status = ocfs2_inode_lock(dir, &parent_di_bh, 1);
+diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
+index fc197e599e8ce..e184b36f8dd33 100644
+--- a/fs/ocfs2/refcounttree.c
++++ b/fs/ocfs2/refcounttree.c
+@@ -1069,7 +1069,7 @@ static int ocfs2_get_refcount_rec(struct ocfs2_caching_info *ci,
+ struct buffer_head **ret_bh)
+ {
+ int ret = 0, i, found;
+- u32 low_cpos, uninitialized_var(cpos_end);
++ u32 low_cpos, cpos_end;
+ struct ocfs2_extent_list *el;
+ struct ocfs2_extent_rec *rec = NULL;
+ struct ocfs2_extent_block *eb = NULL;
+diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
+index c146e12a8601f..54d881c9ac81e 100644
+--- a/fs/ocfs2/xattr.c
++++ b/fs/ocfs2/xattr.c
+@@ -1219,7 +1219,7 @@ static int ocfs2_xattr_block_get(struct inode *inode,
+ struct ocfs2_xattr_value_root *xv;
+ size_t size;
+ int ret = -ENODATA, name_offset, name_len, i;
+- int uninitialized_var(block_off);
++ int block_off;
+
+ xs->bucket = ocfs2_xattr_bucket_new(inode);
+ if (!xs->bucket) {
+diff --git a/fs/omfs/file.c b/fs/omfs/file.c
+index bf83e6644333f..ce59b2fb50c74 100644
+--- a/fs/omfs/file.c
++++ b/fs/omfs/file.c
+@@ -220,7 +220,7 @@ static int omfs_get_block(struct inode *inode, sector_t block,
+ struct buffer_head *bh;
+ sector_t next, offset;
+ int ret;
+- u64 uninitialized_var(new_block);
++ u64 new_block;
+ u32 max_extents;
+ int extent_count;
+ struct omfs_extent *oe;
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 30abafcd4ecce..3d7a700350c1d 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -713,7 +713,7 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c)
+ struct path upperpath, datapath;
+ int err;
+ char *capability = NULL;
+- ssize_t uninitialized_var(cap_size);
++ ssize_t cap_size;
+
+ ovl_path_upper(c->dentry, &upperpath);
+ if (WARN_ON(upperpath.dentry == NULL))
+diff --git a/fs/sysv/itree.c b/fs/sysv/itree.c
+index 31f66053e2393..e3d1673b8ec97 100644
+--- a/fs/sysv/itree.c
++++ b/fs/sysv/itree.c
+@@ -145,6 +145,10 @@ static int alloc_branch(struct inode *inode,
+ */
+ parent = block_to_cpu(SYSV_SB(inode->i_sb), branch[n-1].key);
+ bh = sb_getblk(inode->i_sb, parent);
++ if (!bh) {
++ sysv_free_block(inode->i_sb, branch[n].key);
++ break;
++ }
+ lock_buffer(bh);
+ memset(bh->b_data, 0, blocksize);
+ branch[n].bh = bh;
+diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c
+index 591f2c7a48f07..583e20787689b 100644
+--- a/fs/ubifs/commit.c
++++ b/fs/ubifs/commit.c
+@@ -564,11 +564,11 @@ out:
+ */
+ int dbg_check_old_index(struct ubifs_info *c, struct ubifs_zbranch *zroot)
+ {
+- int lnum, offs, len, err = 0, uninitialized_var(last_level), child_cnt;
++ int lnum, offs, len, err = 0, last_level, child_cnt;
+ int first = 1, iip;
+ struct ubifs_debug_info *d = c->dbg;
+- union ubifs_key uninitialized_var(lower_key), upper_key, l_key, u_key;
+- unsigned long long uninitialized_var(last_sqnum);
++ union ubifs_key lower_key, upper_key, l_key, u_key;
++ unsigned long long last_sqnum;
+ struct ubifs_idx_node *idx;
+ struct list_head list;
+ struct idx_node *i;
+diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
+index cb52aa9ea276c..39296e8012421 100644
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -1294,7 +1294,7 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
+ struct ubifs_budget_req ino_req = { .dirtied_ino = 1,
+ .dirtied_ino_d = ALIGN(old_inode_ui->data_len, 8) };
+ struct timespec64 time;
+- unsigned int uninitialized_var(saved_nlink);
++ unsigned int saved_nlink;
+ struct fscrypt_name old_nm, new_nm;
+
+ /*
+diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
+index ae836e8bb2933..fca3b7f483c79 100644
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -234,7 +234,7 @@ static int write_begin_slow(struct address_space *mapping,
+ struct ubifs_info *c = inode->i_sb->s_fs_info;
+ pgoff_t index = pos >> PAGE_SHIFT;
+ struct ubifs_budget_req req = { .new_page = 1 };
+- int uninitialized_var(err), appending = !!(pos + len > inode->i_size);
++ int err, appending = !!(pos + len > inode->i_size);
+ struct page *page;
+
+ dbg_gen("ino %lu, pos %llu, len %u, i_size %lld",
+@@ -438,7 +438,7 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping,
+ struct ubifs_info *c = inode->i_sb->s_fs_info;
+ struct ubifs_inode *ui = ubifs_inode(inode);
+ pgoff_t index = pos >> PAGE_SHIFT;
+- int uninitialized_var(err), appending = !!(pos + len > inode->i_size);
++ int err, appending = !!(pos + len > inode->i_size);
+ int skipped_read = 0;
+ struct page *page;
+
+diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
+index 802565a17733c..0a60a065c7e8b 100644
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -1355,7 +1355,7 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode,
+ union ubifs_key key, to_key;
+ struct ubifs_ino_node *ino;
+ struct ubifs_trun_node *trun;
+- struct ubifs_data_node *uninitialized_var(dn);
++ struct ubifs_data_node *dn;
+ int err, dlen, len, lnum, offs, bit, sz, sync = IS_SYNC(inode);
+ struct ubifs_inode *ui = ubifs_inode(inode);
+ ino_t inum = inode->i_ino;
+diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
+index 31393370e3348..433bfcddc497c 100644
+--- a/fs/ubifs/lpt.c
++++ b/fs/ubifs/lpt.c
+@@ -287,7 +287,7 @@ uint32_t ubifs_unpack_bits(const struct ubifs_info *c, uint8_t **addr, int *pos,
+ const int k = 32 - nrbits;
+ uint8_t *p = *addr;
+ int b = *pos;
+- uint32_t uninitialized_var(val);
++ uint32_t val;
+ const int bytes = (nrbits + b + 7) >> 3;
+
+ ubifs_assert(c, nrbits > 0);
+diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
+index 08ed942b76271..330ccf72745bb 100644
+--- a/fs/ubifs/tnc.c
++++ b/fs/ubifs/tnc.c
+@@ -936,7 +936,7 @@ static int fallible_resolve_collision(struct ubifs_info *c,
+ int adding)
+ {
+ struct ubifs_znode *o_znode = NULL, *znode = *zn;
+- int uninitialized_var(o_n), err, cmp, unsure = 0, nn = *n;
++ int o_n, err, cmp, unsure = 0, nn = *n;
+
+ cmp = fallible_matches_name(c, &znode->zbranch[nn], nm);
+ if (unlikely(cmp < 0))
+@@ -1558,8 +1558,8 @@ out:
+ */
+ int ubifs_tnc_get_bu_keys(struct ubifs_info *c, struct bu_info *bu)
+ {
+- int n, err = 0, lnum = -1, uninitialized_var(offs);
+- int uninitialized_var(len);
++ int n, err = 0, lnum = -1, offs;
++ int len;
+ unsigned int block = key_block(c, &bu->key);
+ struct ubifs_znode *znode;
+
+diff --git a/fs/ubifs/tnc_misc.c b/fs/ubifs/tnc_misc.c
+index d90ee01076a9e..fe3b52d2749b4 100644
+--- a/fs/ubifs/tnc_misc.c
++++ b/fs/ubifs/tnc_misc.c
+@@ -138,8 +138,8 @@ int ubifs_search_zbranch(const struct ubifs_info *c,
+ const struct ubifs_znode *znode,
+ const union ubifs_key *key, int *n)
+ {
+- int beg = 0, end = znode->child_cnt, uninitialized_var(mid);
+- int uninitialized_var(cmp);
++ int beg = 0, end = znode->child_cnt, mid;
++ int cmp;
+ const struct ubifs_zbranch *zbr = &znode->zbranch[0];
+
+ ubifs_assert(c, end > beg);
+diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
+index fcda0fc97b90a..4c0307f378d72 100644
+--- a/fs/udf/balloc.c
++++ b/fs/udf/balloc.c
+@@ -555,7 +555,7 @@ static udf_pblk_t udf_table_new_block(struct super_block *sb,
+ udf_pblk_t newblock = 0;
+ uint32_t adsize;
+ uint32_t elen, goal_elen = 0;
+- struct kernel_lb_addr eloc, uninitialized_var(goal_eloc);
++ struct kernel_lb_addr eloc, goal_eloc;
+ struct extent_position epos, goal_epos;
+ int8_t etype;
+ struct udf_inode_info *iinfo = UDF_I(table);
+diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
+index 3e1dd66bd6769..734b80a4220c1 100644
+--- a/fs/xfs/xfs_bmap_util.c
++++ b/fs/xfs/xfs_bmap_util.c
+@@ -130,7 +130,7 @@ xfs_bmap_rtalloc(
+ * pick an extent that will space things out in the rt area.
+ */
+ if (ap->eof && ap->offset == 0) {
+- xfs_rtblock_t uninitialized_var(rtx); /* realtime extent no */
++ xfs_rtblock_t rtx; /* realtime extent no */
+
+ error = xfs_rtpick_extent(mp, ap->tp, ralen, &rtx);
+ if (error)
+diff --git a/include/asm-generic/word-at-a-time.h b/include/asm-generic/word-at-a-time.h
+index 20c93f08c9933..95a1d214108a5 100644
+--- a/include/asm-generic/word-at-a-time.h
++++ b/include/asm-generic/word-at-a-time.h
+@@ -38,7 +38,7 @@ static inline long find_zero(unsigned long mask)
+ return (mask >> 8) ? byte : byte + 1;
+ }
+
+-static inline bool has_zero(unsigned long val, unsigned long *data, const struct word_at_a_time *c)
++static inline unsigned long has_zero(unsigned long val, unsigned long *data, const struct word_at_a_time *c)
+ {
+ unsigned long rhs = val | c->low_bits;
+ *data = rhs;
+diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
+index e1e9eff096d05..2932a40060c1d 100644
+--- a/include/linux/etherdevice.h
++++ b/include/linux/etherdevice.h
+@@ -291,6 +291,18 @@ static inline void ether_addr_copy(u8 *dst, const u8 *src)
+ #endif
+ }
+
++/**
++ * eth_hw_addr_set - Assign Ethernet address to a net_device
++ * @dev: pointer to net_device structure
++ * @addr: address to assign
++ *
++ * Assign given address to the net_device, addr_assign_type is not changed.
++ */
++static inline void eth_hw_addr_set(struct net_device *dev, const u8 *addr)
++{
++ ether_addr_copy(dev->dev_addr, addr);
++}
++
+ /**
+ * eth_hw_addr_inherit - Copy dev_addr from another net_device
+ * @dst: pointer to net_device to copy dev_addr to
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 90827d85265b0..7e9df3854420a 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -4079,6 +4079,24 @@ void __hw_addr_unsync_dev(struct netdev_hw_addr_list *list,
+ void __hw_addr_init(struct netdev_hw_addr_list *list);
+
+ /* Functions used for device addresses handling */
++static inline void
++__dev_addr_set(struct net_device *dev, const u8 *addr, size_t len)
++{
++ memcpy(dev->dev_addr, addr, len);
++}
++
++static inline void dev_addr_set(struct net_device *dev, const u8 *addr)
++{
++ __dev_addr_set(dev, addr, dev->addr_len);
++}
++
++static inline void
++dev_addr_mod(struct net_device *dev, unsigned int offset,
++ const u8 *addr, size_t len)
++{
++ memcpy(&dev->dev_addr[offset], addr, len);
++}
++
+ int dev_addr_add(struct net_device *dev, const unsigned char *addr,
+ unsigned char addr_type);
+ int dev_addr_del(struct net_device *dev, const unsigned char *addr,
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index a806803fbe37a..de206e410ee23 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -49,6 +49,33 @@ static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type)
+ return subsys << 8 | msg_type;
+ }
+
++static inline void nfnl_fill_hdr(struct nlmsghdr *nlh, u8 family, u8 version,
++ __be16 res_id)
++{
++ struct nfgenmsg *nfmsg;
++
++ nfmsg = nlmsg_data(nlh);
++ nfmsg->nfgen_family = family;
++ nfmsg->version = version;
++ nfmsg->res_id = res_id;
++}
++
++static inline struct nlmsghdr *nfnl_msg_put(struct sk_buff *skb, u32 portid,
++ u32 seq, int type, int flags,
++ u8 family, u8 version,
++ __be16 res_id)
++{
++ struct nlmsghdr *nlh;
++
++ nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
++ if (!nlh)
++ return NULL;
++
++ nfnl_fill_hdr(nlh, family, version, res_id);
++
++ return nlh;
++}
++
+ void nfnl_lock(__u8 subsys_id);
+ void nfnl_unlock(__u8 subsys_id);
+ #ifdef CONFIG_PROVE_LOCKING
+diff --git a/include/linux/nmi.h b/include/linux/nmi.h
+index e972d1ae1ee63..6cb593d9ed08a 100644
+--- a/include/linux/nmi.h
++++ b/include/linux/nmi.h
+@@ -197,7 +197,7 @@ u64 hw_nmi_get_sample_period(int watchdog_thresh);
+ #endif
+
+ #if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \
+- defined(CONFIG_HARDLOCKUP_DETECTOR)
++ defined(CONFIG_HARDLOCKUP_DETECTOR_PERF)
+ void watchdog_update_hrtimer_threshold(u64 period);
+ #else
+ static inline void watchdog_update_hrtimer_threshold(u64 period) { }
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 3e06e9790c255..1d1b0bfd51968 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1643,6 +1643,7 @@ static inline struct pci_dev *pci_get_class(unsigned int class,
+ #define pci_dev_put(dev) do { } while (0)
+
+ static inline void pci_set_master(struct pci_dev *dev) { }
++static inline void pci_clear_master(struct pci_dev *dev) { }
+ static inline int pci_enable_device(struct pci_dev *dev) { return -EIO; }
+ static inline void pci_disable_device(struct pci_dev *dev) { }
+ static inline int pci_assign_resource(struct pci_dev *dev, int i)
+diff --git a/include/linux/pm_wakeirq.h b/include/linux/pm_wakeirq.h
+index cd5b62db90845..e63a63aa47a37 100644
+--- a/include/linux/pm_wakeirq.h
++++ b/include/linux/pm_wakeirq.h
+@@ -17,8 +17,8 @@
+ #ifdef CONFIG_PM
+
+ extern int dev_pm_set_wake_irq(struct device *dev, int irq);
+-extern int dev_pm_set_dedicated_wake_irq(struct device *dev,
+- int irq);
++extern int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq);
++extern int dev_pm_set_dedicated_wake_irq_reverse(struct device *dev, int irq);
+ extern void dev_pm_clear_wake_irq(struct device *dev);
+ extern void dev_pm_enable_wake_irq(struct device *dev);
+ extern void dev_pm_disable_wake_irq(struct device *dev);
+@@ -35,6 +35,11 @@ static inline int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq)
+ return 0;
+ }
+
++static inline int dev_pm_set_dedicated_wake_irq_reverse(struct device *dev, int irq)
++{
++ return 0;
++}
++
+ static inline void dev_pm_clear_wake_irq(struct device *dev)
+ {
+ }
+diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
+index 660d78c9af6c8..6a55b30ae742b 100644
+--- a/include/linux/sched/signal.h
++++ b/include/linux/sched/signal.h
+@@ -127,7 +127,7 @@ struct signal_struct {
+ #ifdef CONFIG_POSIX_TIMERS
+
+ /* POSIX.1b Interval Timers */
+- int posix_timer_id;
++ unsigned int next_posix_timer_id;
+ struct list_head posix_timers;
+
+ /* ITIMER_REAL timer for the process */
+diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h
+index 5a655ba8d2730..bfde7f1a7674d 100644
+--- a/include/linux/serial_8250.h
++++ b/include/linux/serial_8250.h
+@@ -99,7 +99,6 @@ struct uart_8250_port {
+ struct list_head list; /* ports on this IRQ */
+ u32 capabilities; /* port capabilities */
+ unsigned short bugs; /* port bugs */
+- bool fifo_bug; /* min RX trigger if enabled */
+ unsigned int tx_loadsz; /* transmit fifo load size */
+ unsigned char acr;
+ unsigned char fcr;
+diff --git a/include/linux/tcp.h b/include/linux/tcp.h
+index 621ab5a7fb8fa..0d63a428e6f9c 100644
+--- a/include/linux/tcp.h
++++ b/include/linux/tcp.h
+@@ -460,7 +460,7 @@ static inline void fastopen_queue_tune(struct sock *sk, int backlog)
+ struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
+ int somaxconn = READ_ONCE(sock_net(sk)->core.sysctl_somaxconn);
+
+- queue->fastopenq.max_qlen = min_t(unsigned int, backlog, somaxconn);
++ WRITE_ONCE(queue->fastopenq.max_qlen, min_t(unsigned int, backlog, somaxconn));
+ }
+
+ static inline void tcp_move_syn(struct tcp_sock *tp,
+diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
+index 60d673e156321..a7224fec99a7a 100644
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -73,7 +73,6 @@ enum {
+ WORK_OFFQ_FLAG_BASE = WORK_STRUCT_COLOR_SHIFT,
+
+ __WORK_OFFQ_CANCELING = WORK_OFFQ_FLAG_BASE,
+- WORK_OFFQ_CANCELING = (1 << __WORK_OFFQ_CANCELING),
+
+ /*
+ * When a work item is off queue, its high bits point to the last
+@@ -84,12 +83,6 @@ enum {
+ WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_FLAG_BASE + WORK_OFFQ_FLAG_BITS,
+ WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT,
+ WORK_OFFQ_POOL_BITS = WORK_OFFQ_LEFT <= 31 ? WORK_OFFQ_LEFT : 31,
+- WORK_OFFQ_POOL_NONE = (1LU << WORK_OFFQ_POOL_BITS) - 1,
+-
+- /* convenience constants */
+- WORK_STRUCT_FLAG_MASK = (1UL << WORK_STRUCT_FLAG_BITS) - 1,
+- WORK_STRUCT_WQ_DATA_MASK = ~WORK_STRUCT_FLAG_MASK,
+- WORK_STRUCT_NO_POOL = (unsigned long)WORK_OFFQ_POOL_NONE << WORK_OFFQ_POOL_SHIFT,
+
+ /* bit mask for work_busy() return values */
+ WORK_BUSY_PENDING = 1 << 0,
+@@ -99,6 +92,14 @@ enum {
+ WORKER_DESC_LEN = 24,
+ };
+
++/* Convenience constants - of type 'unsigned long', not 'enum'! */
++#define WORK_OFFQ_CANCELING (1ul << __WORK_OFFQ_CANCELING)
++#define WORK_OFFQ_POOL_NONE ((1ul << WORK_OFFQ_POOL_BITS) - 1)
++#define WORK_STRUCT_NO_POOL (WORK_OFFQ_POOL_NONE << WORK_OFFQ_POOL_SHIFT)
++
++#define WORK_STRUCT_FLAG_MASK ((1ul << WORK_STRUCT_FLAG_BITS) - 1)
++#define WORK_STRUCT_WQ_DATA_MASK (~WORK_STRUCT_FLAG_MASK)
++
+ struct work_struct {
+ atomic_long_t data;
+ struct list_head entry;
+diff --git a/include/net/addrconf.h b/include/net/addrconf.h
+index db2a87981dd46..9583d3bbab039 100644
+--- a/include/net/addrconf.h
++++ b/include/net/addrconf.h
+@@ -340,6 +340,22 @@ static inline struct inet6_dev *__in6_dev_get(const struct net_device *dev)
+ return rcu_dereference_rtnl(dev->ip6_ptr);
+ }
+
++/**
++ * __in6_dev_stats_get - get inet6_dev pointer for stats
++ * @dev: network device
++ * @skb: skb for original incoming interface if neeeded
++ *
++ * Caller must hold rcu_read_lock or RTNL, because this function
++ * does not take a reference on the inet6_dev.
++ */
++static inline struct inet6_dev *__in6_dev_stats_get(const struct net_device *dev,
++ const struct sk_buff *skb)
++{
++ if (netif_is_l3_master(dev))
++ dev = dev_get_by_index_rcu(dev_net(dev), inet6_iif(skb));
++ return __in6_dev_get(dev);
++}
++
+ /**
+ * __in6_dev_get_safely - get inet6_dev pointer from netdevice
+ * @dev: network device
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 0c883249814cc..3a55a0931ed86 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -602,12 +602,8 @@ static inline u32 ipv6_addr_hash(const struct in6_addr *a)
+ /* more secured version of ipv6_addr_hash() */
+ static inline u32 __ipv6_addr_jhash(const struct in6_addr *a, const u32 initval)
+ {
+- u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1];
+-
+- return jhash_3words(v,
+- (__force u32)a->s6_addr32[2],
+- (__force u32)a->s6_addr32[3],
+- initval);
++ return jhash2((__force const u32 *)a->s6_addr32,
++ ARRAY_SIZE(a->s6_addr32), initval);
+ }
+
+ static inline bool ipv6_addr_loopback(const struct in6_addr *a)
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 1b4f47a878060..4719440873723 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -736,6 +736,7 @@ struct nft_expr_type {
+
+ enum nft_trans_phase {
+ NFT_TRANS_PREPARE,
++ NFT_TRANS_PREPARE_ERROR,
+ NFT_TRANS_ABORT,
+ NFT_TRANS_COMMIT,
+ NFT_TRANS_RELEASE
+@@ -1319,12 +1320,14 @@ static inline void nft_set_elem_clear_busy(struct nft_set_ext *ext)
+ * struct nft_trans - nf_tables object update in transaction
+ *
+ * @list: used internally
++ * @binding_list: list of objects with possible bindings
+ * @msg_type: message type
+ * @ctx: transaction context
+ * @data: internal information related to the transaction
+ */
+ struct nft_trans {
+ struct list_head list;
++ struct list_head binding_list;
+ int msg_type;
+ struct nft_ctx ctx;
+ char data[0];
+@@ -1409,4 +1412,15 @@ struct nft_trans_flowtable {
+ int __init nft_chain_filter_init(void);
+ void nft_chain_filter_fini(void);
+
++struct nftables_pernet {
++ struct list_head tables;
++ struct list_head commit_list;
++ struct list_head binding_list;
++ struct list_head module_list;
++ struct list_head notify_list;
++ struct mutex commit_mutex;
++ unsigned int base_seq;
++ u8 validate_state;
++};
++
+ #endif /* _NET_NF_TABLES_H */
+diff --git a/include/net/netns/nftables.h b/include/net/netns/nftables.h
+index 286fd960896fd..8c77832d02404 100644
+--- a/include/net/netns/nftables.h
++++ b/include/net/netns/nftables.h
+@@ -5,12 +5,7 @@
+ #include <linux/list.h>
+
+ struct netns_nftables {
+- struct list_head tables;
+- struct list_head commit_list;
+- struct mutex commit_mutex;
+- unsigned int base_seq;
+ u8 gencursor;
+- u8 validate_state;
+ };
+
+ #endif
+diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
+index bbdc73a3239df..8b86560b5cfb1 100644
+--- a/include/net/nfc/nfc.h
++++ b/include/net/nfc/nfc.h
+@@ -278,7 +278,7 @@ struct sk_buff *nfc_alloc_send_skb(struct nfc_dev *dev, struct sock *sk,
+ struct sk_buff *nfc_alloc_recv_skb(unsigned int size, gfp_t gfp);
+
+ int nfc_set_remote_general_bytes(struct nfc_dev *dev,
+- u8 *gt, u8 gt_len);
++ const u8 *gt, u8 gt_len);
+ u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, size_t *gb_len);
+
+ int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
+@@ -292,7 +292,7 @@ int nfc_dep_link_is_up(struct nfc_dev *dev, u32 target_idx,
+ u8 comm_mode, u8 rf_mode);
+
+ int nfc_tm_activated(struct nfc_dev *dev, u32 protocol, u8 comm_mode,
+- u8 *gb, size_t gb_len);
++ const u8 *gb, size_t gb_len);
+ int nfc_tm_deactivated(struct nfc_dev *dev);
+ int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb);
+
+diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
+index e09ea6917c061..83a16f3bd6e6a 100644
+--- a/include/net/pkt_sched.h
++++ b/include/net/pkt_sched.h
+@@ -131,7 +131,7 @@ extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
+ */
+ static inline unsigned int psched_mtu(const struct net_device *dev)
+ {
+- return dev->mtu + dev->hard_header_len;
++ return READ_ONCE(dev->mtu) + dev->hard_header_len;
+ }
+
+ static inline struct net *qdisc_net(struct Qdisc *q)
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 616e84d1670df..72739f72e4b90 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1840,6 +1840,7 @@ static inline void sock_graft(struct sock *sk, struct socket *parent)
+ }
+
+ kuid_t sock_i_uid(struct sock *sk);
++unsigned long __sock_i_ino(struct sock *sk);
+ unsigned long sock_i_ino(struct sock *sk);
+
+ static inline kuid_t sock_net_uid(const struct net *net, const struct sock *sk)
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 81300a04b5808..c6c48409e7b42 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -128,6 +128,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo);
+ * to combine FIN-WAIT-2 timeout with
+ * TIME-WAIT timer.
+ */
++#define TCP_FIN_TIMEOUT_MAX (120 * HZ) /* max TCP_LINGER2 value (two minutes) */
+
+ #define TCP_DELACK_MAX ((unsigned)(HZ/5)) /* maximal time to delay before sending an ACK */
+ #if HZ >= 100
+@@ -1882,7 +1883,11 @@ void __tcp_v4_send_check(struct sk_buff *skb, __be32 saddr, __be32 daddr);
+ static inline u32 tcp_notsent_lowat(const struct tcp_sock *tp)
+ {
+ struct net *net = sock_net((struct sock *)tp);
+- return tp->notsent_lowat ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat);
++ u32 val;
++
++ val = READ_ONCE(tp->notsent_lowat);
++
++ return val ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat);
+ }
+
+ /* @wake is one when sk_stream_write_space() calls us.
+diff --git a/include/uapi/linux/affs_hardblocks.h b/include/uapi/linux/affs_hardblocks.h
+index 5e2fb8481252a..a5aff2eb5f708 100644
+--- a/include/uapi/linux/affs_hardblocks.h
++++ b/include/uapi/linux/affs_hardblocks.h
+@@ -7,42 +7,42 @@
+ /* Just the needed definitions for the RDB of an Amiga HD. */
+
+ struct RigidDiskBlock {
+- __u32 rdb_ID;
++ __be32 rdb_ID;
+ __be32 rdb_SummedLongs;
+- __s32 rdb_ChkSum;
+- __u32 rdb_HostID;
++ __be32 rdb_ChkSum;
++ __be32 rdb_HostID;
+ __be32 rdb_BlockBytes;
+- __u32 rdb_Flags;
+- __u32 rdb_BadBlockList;
++ __be32 rdb_Flags;
++ __be32 rdb_BadBlockList;
+ __be32 rdb_PartitionList;
+- __u32 rdb_FileSysHeaderList;
+- __u32 rdb_DriveInit;
+- __u32 rdb_Reserved1[6];
+- __u32 rdb_Cylinders;
+- __u32 rdb_Sectors;
+- __u32 rdb_Heads;
+- __u32 rdb_Interleave;
+- __u32 rdb_Park;
+- __u32 rdb_Reserved2[3];
+- __u32 rdb_WritePreComp;
+- __u32 rdb_ReducedWrite;
+- __u32 rdb_StepRate;
+- __u32 rdb_Reserved3[5];
+- __u32 rdb_RDBBlocksLo;
+- __u32 rdb_RDBBlocksHi;
+- __u32 rdb_LoCylinder;
+- __u32 rdb_HiCylinder;
+- __u32 rdb_CylBlocks;
+- __u32 rdb_AutoParkSeconds;
+- __u32 rdb_HighRDSKBlock;
+- __u32 rdb_Reserved4;
++ __be32 rdb_FileSysHeaderList;
++ __be32 rdb_DriveInit;
++ __be32 rdb_Reserved1[6];
++ __be32 rdb_Cylinders;
++ __be32 rdb_Sectors;
++ __be32 rdb_Heads;
++ __be32 rdb_Interleave;
++ __be32 rdb_Park;
++ __be32 rdb_Reserved2[3];
++ __be32 rdb_WritePreComp;
++ __be32 rdb_ReducedWrite;
++ __be32 rdb_StepRate;
++ __be32 rdb_Reserved3[5];
++ __be32 rdb_RDBBlocksLo;
++ __be32 rdb_RDBBlocksHi;
++ __be32 rdb_LoCylinder;
++ __be32 rdb_HiCylinder;
++ __be32 rdb_CylBlocks;
++ __be32 rdb_AutoParkSeconds;
++ __be32 rdb_HighRDSKBlock;
++ __be32 rdb_Reserved4;
+ char rdb_DiskVendor[8];
+ char rdb_DiskProduct[16];
+ char rdb_DiskRevision[4];
+ char rdb_ControllerVendor[8];
+ char rdb_ControllerProduct[16];
+ char rdb_ControllerRevision[4];
+- __u32 rdb_Reserved5[10];
++ __be32 rdb_Reserved5[10];
+ };
+
+ #define IDNAME_RIGIDDISK 0x5244534B /* "RDSK" */
+@@ -50,16 +50,16 @@ struct RigidDiskBlock {
+ struct PartitionBlock {
+ __be32 pb_ID;
+ __be32 pb_SummedLongs;
+- __s32 pb_ChkSum;
+- __u32 pb_HostID;
++ __be32 pb_ChkSum;
++ __be32 pb_HostID;
+ __be32 pb_Next;
+- __u32 pb_Flags;
+- __u32 pb_Reserved1[2];
+- __u32 pb_DevFlags;
++ __be32 pb_Flags;
++ __be32 pb_Reserved1[2];
++ __be32 pb_DevFlags;
+ __u8 pb_DriveName[32];
+- __u32 pb_Reserved2[15];
++ __be32 pb_Reserved2[15];
+ __be32 pb_Environment[17];
+- __u32 pb_EReserved[15];
++ __be32 pb_EReserved[15];
+ };
+
+ #define IDNAME_PARTITION 0x50415254 /* "PART" */
+diff --git a/include/uapi/linux/blkzoned.h b/include/uapi/linux/blkzoned.h
+index ff5a5db8906a7..2f3a0cca4b78b 100644
+--- a/include/uapi/linux/blkzoned.h
++++ b/include/uapi/linux/blkzoned.h
+@@ -51,13 +51,13 @@ enum blk_zone_type {
+ *
+ * The Zone Condition state machine in the ZBC/ZAC standards maps the above
+ * deinitions as:
+- * - ZC1: Empty | BLK_ZONE_EMPTY
++ * - ZC1: Empty | BLK_ZONE_COND_EMPTY
+ * - ZC2: Implicit Open | BLK_ZONE_COND_IMP_OPEN
+ * - ZC3: Explicit Open | BLK_ZONE_COND_EXP_OPEN
+- * - ZC4: Closed | BLK_ZONE_CLOSED
+- * - ZC5: Full | BLK_ZONE_FULL
+- * - ZC6: Read Only | BLK_ZONE_READONLY
+- * - ZC7: Offline | BLK_ZONE_OFFLINE
++ * - ZC4: Closed | BLK_ZONE_COND_CLOSED
++ * - ZC5: Full | BLK_ZONE_COND_FULL
++ * - ZC6: Read Only | BLK_ZONE_COND_READONLY
++ * - ZC7: Offline | BLK_ZONE_COND_OFFLINE
+ *
+ * Conditions 0x5 to 0xC are reserved by the current ZBC/ZAC spec and should
+ * be considered invalid.
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index ad6a633f5848a..ac22e7f062399 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -1510,7 +1510,7 @@ struct v4l2_input {
+ __u8 name[32]; /* Label */
+ __u32 type; /* Type of input */
+ __u32 audioset; /* Associated audios (bitfield) */
+- __u32 tuner; /* enum v4l2_tuner_type */
++ __u32 tuner; /* Tuner index */
+ v4l2_std_id std;
+ __u32 status;
+ __u32 capabilities;
+diff --git a/kernel/async.c b/kernel/async.c
+index 4bf1b00a28d86..e59bd2240cb86 100644
+--- a/kernel/async.c
++++ b/kernel/async.c
+@@ -115,7 +115,7 @@ static void async_run_entry_fn(struct work_struct *work)
+ struct async_entry *entry =
+ container_of(work, struct async_entry, work);
+ unsigned long flags;
+- ktime_t uninitialized_var(calltime), delta, rettime;
++ ktime_t calltime, delta, rettime;
+
+ /* 1) run (and print duration) */
+ if (initcall_debug && system_state < SYSTEM_RUNNING) {
+@@ -283,7 +283,7 @@ EXPORT_SYMBOL_GPL(async_synchronize_full_domain);
+ */
+ void async_synchronize_cookie_domain(async_cookie_t cookie, struct async_domain *domain)
+ {
+- ktime_t uninitialized_var(starttime), delta, endtime;
++ ktime_t starttime, delta, endtime;
+
+ if (initcall_debug && system_state < SYSTEM_RUNNING) {
+ pr_debug("async_waiting @ %i\n", task_pid_nr(current));
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 7dc14a4d9e3cf..471d3ad910aa5 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -1796,7 +1796,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
+ {
+ struct audit_buffer *ab;
+ struct timespec64 t;
+- unsigned int uninitialized_var(serial);
++ unsigned int serial;
+
+ if (audit_initialized != AUDIT_INITIALIZED)
+ return NULL;
+diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c
+index 9b5eeff72fd37..39a0e768adc39 100644
+--- a/kernel/bpf/bpf_lru_list.c
++++ b/kernel/bpf/bpf_lru_list.c
+@@ -44,7 +44,12 @@ static struct list_head *local_pending_list(struct bpf_lru_locallist *loc_l)
+ /* bpf_lru_node helpers */
+ static bool bpf_lru_node_is_ref(const struct bpf_lru_node *node)
+ {
+- return node->ref;
++ return READ_ONCE(node->ref);
++}
++
++static void bpf_lru_node_clear_ref(struct bpf_lru_node *node)
++{
++ WRITE_ONCE(node->ref, 0);
+ }
+
+ static void bpf_lru_list_count_inc(struct bpf_lru_list *l,
+@@ -92,7 +97,7 @@ static void __bpf_lru_node_move_in(struct bpf_lru_list *l,
+
+ bpf_lru_list_count_inc(l, tgt_type);
+ node->type = tgt_type;
+- node->ref = 0;
++ bpf_lru_node_clear_ref(node);
+ list_move(&node->list, &l->lists[tgt_type]);
+ }
+
+@@ -113,7 +118,7 @@ static void __bpf_lru_node_move(struct bpf_lru_list *l,
+ bpf_lru_list_count_inc(l, tgt_type);
+ node->type = tgt_type;
+ }
+- node->ref = 0;
++ bpf_lru_node_clear_ref(node);
+
+ /* If the moving node is the next_inactive_rotation candidate,
+ * move the next_inactive_rotation pointer also.
+@@ -356,7 +361,7 @@ static void __local_list_add_pending(struct bpf_lru *lru,
+ *(u32 *)((void *)node + lru->hash_offset) = hash;
+ node->cpu = cpu;
+ node->type = BPF_LRU_LOCAL_LIST_T_PENDING;
+- node->ref = 0;
++ bpf_lru_node_clear_ref(node);
+ list_add(&node->list, local_pending_list(loc_l));
+ }
+
+@@ -422,7 +427,7 @@ static struct bpf_lru_node *bpf_percpu_lru_pop_free(struct bpf_lru *lru,
+ if (!list_empty(free_list)) {
+ node = list_first_entry(free_list, struct bpf_lru_node, list);
+ *(u32 *)((void *)node + lru->hash_offset) = hash;
+- node->ref = 0;
++ bpf_lru_node_clear_ref(node);
+ __bpf_lru_node_move(l, node, BPF_LRU_LIST_T_INACTIVE);
+ }
+
+@@ -525,7 +530,7 @@ static void bpf_common_lru_push_free(struct bpf_lru *lru,
+ }
+
+ node->type = BPF_LRU_LOCAL_LIST_T_FREE;
+- node->ref = 0;
++ bpf_lru_node_clear_ref(node);
+ list_move(&node->list, local_free_list(loc_l));
+
+ raw_spin_unlock_irqrestore(&loc_l->lock, flags);
+@@ -571,7 +576,7 @@ static void bpf_common_lru_populate(struct bpf_lru *lru, void *buf,
+
+ node = (struct bpf_lru_node *)(buf + node_offset);
+ node->type = BPF_LRU_LIST_T_FREE;
+- node->ref = 0;
++ bpf_lru_node_clear_ref(node);
+ list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]);
+ buf += elem_size;
+ }
+@@ -597,7 +602,7 @@ again:
+ node = (struct bpf_lru_node *)(buf + node_offset);
+ node->cpu = cpu;
+ node->type = BPF_LRU_LIST_T_FREE;
+- node->ref = 0;
++ bpf_lru_node_clear_ref(node);
+ list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]);
+ i++;
+ buf += elem_size;
+diff --git a/kernel/bpf/bpf_lru_list.h b/kernel/bpf/bpf_lru_list.h
+index 7d4f89b7cb841..08da78b59f0b9 100644
+--- a/kernel/bpf/bpf_lru_list.h
++++ b/kernel/bpf/bpf_lru_list.h
+@@ -66,11 +66,8 @@ struct bpf_lru {
+
+ static inline void bpf_lru_node_set_ref(struct bpf_lru_node *node)
+ {
+- /* ref is an approximation on access frequency. It does not
+- * have to be very accurate. Hence, no protection is used.
+- */
+- if (!node->ref)
+- node->ref = 1;
++ if (!READ_ONCE(node->ref))
++ WRITE_ONCE(node->ref, 1);
+ }
+
+ int bpf_lru_init(struct bpf_lru *lru, bool percpu, u32 hash_offset,
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index 7c6cd00d0fca9..c345a6e2f7b7e 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -963,7 +963,7 @@ static int device_dma_allocations(struct device *dev, struct dma_debug_entry **o
+ static int dma_debug_device_change(struct notifier_block *nb, unsigned long action, void *data)
+ {
+ struct device *dev = data;
+- struct dma_debug_entry *uninitialized_var(entry);
++ struct dma_debug_entry *entry;
+ int count;
+
+ if (dma_debug_disabled())
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 2bf4b6b109bf4..cb2b717666cee 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -1133,6 +1133,11 @@ static int perf_mux_hrtimer_restart(struct perf_cpu_context *cpuctx)
+ return 0;
+ }
+
++static int perf_mux_hrtimer_restart_ipi(void *arg)
++{
++ return perf_mux_hrtimer_restart(arg);
++}
++
+ void perf_pmu_disable(struct pmu *pmu)
+ {
+ int *count = this_cpu_ptr(pmu->pmu_disable_count);
+@@ -9644,8 +9649,7 @@ perf_event_mux_interval_ms_store(struct device *dev,
+ cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
+ cpuctx->hrtimer_interval = ns_to_ktime(NSEC_PER_MSEC * timer);
+
+- cpu_function_call(cpu,
+- (remote_function_f)perf_mux_hrtimer_restart, cpuctx);
++ cpu_function_call(cpu, perf_mux_hrtimer_restart_ipi, cpuctx);
+ }
+ cpus_read_unlock();
+ mutex_unlock(&mux_interval_mutex);
+@@ -10575,7 +10579,7 @@ SYSCALL_DEFINE5(perf_event_open,
+ struct perf_event *group_leader = NULL, *output_event = NULL;
+ struct perf_event *event, *sibling;
+ struct perf_event_attr attr;
+- struct perf_event_context *ctx, *uninitialized_var(gctx);
++ struct perf_event_context *ctx, *gctx;
+ struct file *event_file = NULL;
+ struct fd group = {NULL, 0};
+ struct task_struct *task = NULL;
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 24342bca11f2f..72ae05d650661 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1887,7 +1887,7 @@ static void handle_swbp(struct pt_regs *regs)
+ {
+ struct uprobe *uprobe;
+ unsigned long bp_vaddr;
+- int uninitialized_var(is_swbp);
++ int is_swbp;
+
+ bp_vaddr = uprobe_get_swbp_addr(regs);
+ if (bp_vaddr == get_trampoline_vaddr())
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 02360ec3b1225..0d1cca15e66fe 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -140,7 +140,7 @@ static void __exit_signal(struct task_struct *tsk)
+ struct signal_struct *sig = tsk->signal;
+ bool group_dead = thread_group_leader(tsk);
+ struct sighand_struct *sighand;
+- struct tty_struct *uninitialized_var(tty);
++ struct tty_struct *tty;
+ u64 utime, stime;
+
+ sighand = rcu_dereference_check(tsk->sighand,
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 3c67da9b84086..ca2a2a8948395 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1398,7 +1398,7 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval,
+ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval)
+ {
+ int err;
+- u32 uninitialized_var(curval);
++ u32 curval;
+
+ if (unlikely(should_fail_futex(true)))
+ return -EFAULT;
+@@ -1569,7 +1569,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
+ */
+ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_state)
+ {
+- u32 uninitialized_var(curval), newval;
++ u32 curval, newval;
+ struct task_struct *new_owner;
+ bool postunlock = false;
+ DEFINE_WAKE_Q(wake_q);
+@@ -3083,7 +3083,7 @@ uaddr_faulted:
+ */
+ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
+ {
+- u32 uninitialized_var(curval), uval, vpid = task_pid_vnr(current);
++ u32 curval, uval, vpid = task_pid_vnr(current);
+ union futex_key key = FUTEX_KEY_INIT;
+ struct futex_hash_bucket *hb;
+ struct futex_q *top_waiter;
+@@ -3558,7 +3558,7 @@ err_unlock:
+ static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr,
+ bool pi, bool pending_op)
+ {
+- u32 uval, uninitialized_var(nval), mval;
++ u32 uval, nval, mval;
+ int err;
+
+ /* Futex address must be 32bit aligned */
+@@ -3688,7 +3688,7 @@ static void exit_robust_list(struct task_struct *curr)
+ struct robust_list_head __user *head = curr->robust_list;
+ struct robust_list __user *entry, *next_entry, *pending;
+ unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
+- unsigned int uninitialized_var(next_pi);
++ unsigned int next_pi;
+ unsigned long futex_offset;
+ int rc;
+
+@@ -3987,7 +3987,7 @@ static void compat_exit_robust_list(struct task_struct *curr)
+ struct compat_robust_list_head __user *head = curr->compat_robust_list;
+ struct robust_list __user *entry, *next_entry, *pending;
+ unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
+- unsigned int uninitialized_var(next_pi);
++ unsigned int next_pi;
+ compat_uptr_t uentry, next_uentry, upending;
+ compat_long_t futex_offset;
+ int rc;
+diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
+index 6b3d7f7211dd6..3666d434a8f59 100644
+--- a/kernel/kexec_core.c
++++ b/kernel/kexec_core.c
+@@ -1020,6 +1020,7 @@ int crash_shrink_memory(unsigned long new_size)
+ start = crashk_res.start;
+ end = crashk_res.end;
+ old_size = (end == 0) ? 0 : end - start + 1;
++ new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN);
+ if (new_size >= old_size) {
+ ret = (new_size == old_size) ? 0 : -EINVAL;
+ goto unlock;
+@@ -1031,9 +1032,7 @@ int crash_shrink_memory(unsigned long new_size)
+ goto unlock;
+ }
+
+- start = roundup(start, KEXEC_CRASH_MEM_ALIGN);
+- end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN);
+-
++ end = start + new_size;
+ crash_free_reserved_phys_range(end, crashk_res.end);
+
+ if ((start == end) && (crashk_res.parent != NULL))
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 4dc79f57af827..46a6d1f7c351d 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -1246,7 +1246,7 @@ static int noop_count(struct lock_list *entry, void *data)
+ static unsigned long __lockdep_count_forward_deps(struct lock_list *this)
+ {
+ unsigned long count = 0;
+- struct lock_list *uninitialized_var(target_entry);
++ struct lock_list *target_entry;
+
+ __bfs_forwards(this, (void *)&count, noop_count, &target_entry);
+
+@@ -1274,7 +1274,7 @@ unsigned long lockdep_count_forward_deps(struct lock_class *class)
+ static unsigned long __lockdep_count_backward_deps(struct lock_list *this)
+ {
+ unsigned long count = 0;
+- struct lock_list *uninitialized_var(target_entry);
++ struct lock_list *target_entry;
+
+ __bfs_backwards(this, (void *)&count, noop_count, &target_entry);
+
+@@ -2662,7 +2662,7 @@ check_usage_backwards(struct task_struct *curr, struct held_lock *this,
+ {
+ int ret;
+ struct lock_list root;
+- struct lock_list *uninitialized_var(target_entry);
++ struct lock_list *target_entry;
+
+ root.parent = NULL;
+ root.class = hlock_class(this);
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index eb67f42fb96ba..09f82c84474b8 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -8721,7 +8721,7 @@ static int load_balance(int this_cpu, struct rq *this_rq,
+ .sd = sd,
+ .dst_cpu = this_cpu,
+ .dst_rq = this_rq,
+- .dst_grpmask = sched_group_span(sd->groups),
++ .dst_grpmask = group_balance_mask(sd->groups),
+ .idle = idle,
+ .loop_break = sched_nr_migrate_break,
+ .cpus = cpus,
+diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
+index 1234868b3b03e..8768ce2c4bf52 100644
+--- a/kernel/time/posix-timers.c
++++ b/kernel/time/posix-timers.c
+@@ -159,25 +159,30 @@ static struct k_itimer *posix_timer_by_id(timer_t id)
+ static int posix_timer_add(struct k_itimer *timer)
+ {
+ struct signal_struct *sig = current->signal;
+- int first_free_id = sig->posix_timer_id;
+ struct hlist_head *head;
+- int ret = -ENOENT;
++ unsigned int cnt, id;
+
+- do {
++ /*
++ * FIXME: Replace this by a per signal struct xarray once there is
++ * a plan to handle the resulting CRIU regression gracefully.
++ */
++ for (cnt = 0; cnt <= INT_MAX; cnt++) {
+ spin_lock(&hash_lock);
+- head = &posix_timers_hashtable[hash(sig, sig->posix_timer_id)];
+- if (!__posix_timers_find(head, sig, sig->posix_timer_id)) {
++ id = sig->next_posix_timer_id;
++
++ /* Write the next ID back. Clamp it to the positive space */
++ sig->next_posix_timer_id = (id + 1) & INT_MAX;
++
++ head = &posix_timers_hashtable[hash(sig, id)];
++ if (!__posix_timers_find(head, sig, id)) {
+ hlist_add_head_rcu(&timer->t_hash, head);
+- ret = sig->posix_timer_id;
++ spin_unlock(&hash_lock);
++ return id;
+ }
+- if (++sig->posix_timer_id < 0)
+- sig->posix_timer_id = 0;
+- if ((sig->posix_timer_id == first_free_id) && (ret == -ENOENT))
+- /* Loop over all possible ids completed */
+- ret = -EAGAIN;
+ spin_unlock(&hash_lock);
+- } while (ret == -ENOENT);
+- return ret;
++ }
++ /* POSIX return code when no timer ID could be allocated */
++ return -EAGAIN;
+ }
+
+ static inline void unlock_timer(struct k_itimer *timr, unsigned long flags)
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 5c0463dbe16ee..81f5c9c85d066 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1124,7 +1124,7 @@ struct ftrace_page {
+ struct ftrace_page *next;
+ struct dyn_ftrace *records;
+ int index;
+- int size;
++ int order;
+ };
+
+ #define ENTRY_SIZE sizeof(struct dyn_ftrace)
+@@ -2915,6 +2915,8 @@ static void ftrace_shutdown_sysctl(void)
+
+ static u64 ftrace_update_time;
+ unsigned long ftrace_update_tot_cnt;
++unsigned long ftrace_number_of_pages;
++unsigned long ftrace_number_of_groups;
+
+ static inline int ops_traces_mod(struct ftrace_ops *ops)
+ {
+@@ -3039,8 +3041,11 @@ static int ftrace_allocate_records(struct ftrace_page *pg, int count)
+ goto again;
+ }
+
++ ftrace_number_of_pages += 1 << order;
++ ftrace_number_of_groups++;
++
+ cnt = (PAGE_SIZE << order) / ENTRY_SIZE;
+- pg->size = cnt;
++ pg->order = order;
+
+ if (cnt > count)
+ cnt = count;
+@@ -3048,12 +3053,27 @@ static int ftrace_allocate_records(struct ftrace_page *pg, int count)
+ return cnt;
+ }
+
++static void ftrace_free_pages(struct ftrace_page *pages)
++{
++ struct ftrace_page *pg = pages;
++
++ while (pg) {
++ if (pg->records) {
++ free_pages((unsigned long)pg->records, pg->order);
++ ftrace_number_of_pages -= 1 << pg->order;
++ }
++ pages = pg->next;
++ kfree(pg);
++ pg = pages;
++ ftrace_number_of_groups--;
++ }
++}
++
+ static struct ftrace_page *
+ ftrace_allocate_pages(unsigned long num_to_init)
+ {
+ struct ftrace_page *start_pg;
+ struct ftrace_page *pg;
+- int order;
+ int cnt;
+
+ if (!num_to_init)
+@@ -3087,14 +3107,7 @@ ftrace_allocate_pages(unsigned long num_to_init)
+ return start_pg;
+
+ free_pages:
+- pg = start_pg;
+- while (pg) {
+- order = get_count_order(pg->size / ENTRIES_PER_PAGE);
+- free_pages((unsigned long)pg->records, order);
+- start_pg = pg->next;
+- kfree(pg);
+- pg = start_pg;
+- }
++ ftrace_free_pages(start_pg);
+ pr_info("ftrace: FAILED to allocate memory for functions\n");
+ return NULL;
+ }
+@@ -5586,9 +5599,11 @@ static int ftrace_process_locs(struct module *mod,
+ unsigned long *start,
+ unsigned long *end)
+ {
++ struct ftrace_page *pg_unuse = NULL;
+ struct ftrace_page *start_pg;
+ struct ftrace_page *pg;
+ struct dyn_ftrace *rec;
++ unsigned long skipped = 0;
+ unsigned long count;
+ unsigned long *p;
+ unsigned long addr;
+@@ -5634,6 +5649,7 @@ static int ftrace_process_locs(struct module *mod,
+ p = start;
+ pg = start_pg;
+ while (p < end) {
++ unsigned long end_offset;
+ addr = ftrace_call_adjust(*p++);
+ /*
+ * Some architecture linkers will pad between
+@@ -5641,10 +5657,13 @@ static int ftrace_process_locs(struct module *mod,
+ * object files to satisfy alignments.
+ * Skip any NULL pointers.
+ */
+- if (!addr)
++ if (!addr) {
++ skipped++;
+ continue;
++ }
+
+- if (pg->index == pg->size) {
++ end_offset = (pg->index+1) * sizeof(pg->records[0]);
++ if (end_offset > PAGE_SIZE << pg->order) {
+ /* We should have allocated enough */
+ if (WARN_ON(!pg->next))
+ break;
+@@ -5655,8 +5674,10 @@ static int ftrace_process_locs(struct module *mod,
+ rec->ip = addr;
+ }
+
+- /* We should have used all pages */
+- WARN_ON(pg->next);
++ if (pg->next) {
++ pg_unuse = pg->next;
++ pg->next = NULL;
++ }
+
+ /* Assign the last page to ftrace_pages */
+ ftrace_pages = pg;
+@@ -5678,6 +5699,11 @@ static int ftrace_process_locs(struct module *mod,
+ out:
+ mutex_unlock(&ftrace_lock);
+
++ /* We should have used all pages unless we skipped some */
++ if (pg_unuse) {
++ WARN_ON(!skipped);
++ ftrace_free_pages(pg_unuse);
++ }
+ return ret;
+ }
+
+@@ -5784,7 +5810,6 @@ void ftrace_release_mod(struct module *mod)
+ struct ftrace_page **last_pg;
+ struct ftrace_page *tmp_page = NULL;
+ struct ftrace_page *pg;
+- int order;
+
+ mutex_lock(&ftrace_lock);
+
+@@ -5835,10 +5860,13 @@ void ftrace_release_mod(struct module *mod)
+ /* Needs to be called outside of ftrace_lock */
+ clear_mod_from_hashes(pg);
+
+- order = get_count_order(pg->size / ENTRIES_PER_PAGE);
+- free_pages((unsigned long)pg->records, order);
++ if (pg->records) {
++ free_pages((unsigned long)pg->records, pg->order);
++ ftrace_number_of_pages -= 1 << pg->order;
++ }
+ tmp_page = pg->next;
+ kfree(pg);
++ ftrace_number_of_groups--;
+ }
+ }
+
+@@ -6144,7 +6172,6 @@ void ftrace_free_mem(struct module *mod, void *start_ptr, void *end_ptr)
+ struct ftrace_mod_map *mod_map = NULL;
+ struct ftrace_init_func *func, *func_next;
+ struct list_head clear_hash;
+- int order;
+
+ INIT_LIST_HEAD(&clear_hash);
+
+@@ -6182,8 +6209,11 @@ void ftrace_free_mem(struct module *mod, void *start_ptr, void *end_ptr)
+ ftrace_update_tot_cnt--;
+ if (!pg->index) {
+ *last_pg = pg->next;
+- order = get_count_order(pg->size / ENTRIES_PER_PAGE);
+- free_pages((unsigned long)pg->records, order);
++ if (pg->records) {
++ free_pages((unsigned long)pg->records, pg->order);
++ ftrace_number_of_pages -= 1 << pg->order;
++ }
++ ftrace_number_of_groups--;
+ kfree(pg);
+ pg = container_of(last_pg, struct ftrace_page, next);
+ if (!(*last_pg))
+@@ -6239,6 +6269,9 @@ void __init ftrace_init(void)
+ __start_mcount_loc,
+ __stop_mcount_loc);
+
++ pr_info("ftrace: allocated %ld pages with %ld groups\n",
++ ftrace_number_of_pages, ftrace_number_of_groups);
++
+ set_ftrace_early_filters();
+
+ return;
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index ba8b72f9cdc0b..c8a7de7a1d635 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -493,6 +493,8 @@ struct ring_buffer_per_cpu {
+ unsigned long read_bytes;
+ u64 write_stamp;
+ u64 read_stamp;
++ /* pages removed since last reset */
++ unsigned long pages_removed;
+ /* ring buffer pages to update, > 0 to add, < 0 to remove */
+ long nr_pages_to_update;
+ struct list_head new_pages; /* new pages to add */
+@@ -528,6 +530,7 @@ struct ring_buffer_iter {
+ struct buffer_page *head_page;
+ struct buffer_page *cache_reader_page;
+ unsigned long cache_read;
++ unsigned long cache_pages_removed;
+ u64 read_stamp;
+ };
+
+@@ -561,7 +564,7 @@ static void rb_wake_up_waiters(struct irq_work *work)
+ */
+ int ring_buffer_wait(struct ring_buffer *buffer, int cpu, bool full)
+ {
+- struct ring_buffer_per_cpu *uninitialized_var(cpu_buffer);
++ struct ring_buffer_per_cpu *cpu_buffer;
+ DEFINE_WAIT(wait);
+ struct rb_irq_work *work;
+ int ret = 0;
+@@ -1514,6 +1517,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)
+ to_remove = rb_list_head(to_remove)->next;
+ head_bit |= (unsigned long)to_remove & RB_PAGE_HEAD;
+ }
++ /* Read iterators need to reset themselves when some pages removed */
++ cpu_buffer->pages_removed += nr_removed;
+
+ next_page = rb_list_head(to_remove)->next;
+
+@@ -1535,12 +1540,6 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)
+ cpu_buffer->head_page = list_entry(next_page,
+ struct buffer_page, list);
+
+- /*
+- * change read pointer to make sure any read iterators reset
+- * themselves
+- */
+- cpu_buffer->read = 0;
+-
+ /* pages are removed, resume tracing and then free the pages */
+ atomic_dec(&cpu_buffer->record_disabled);
+ raw_spin_unlock_irq(&cpu_buffer->reader_lock);
+@@ -3582,6 +3581,7 @@ static void rb_iter_reset(struct ring_buffer_iter *iter)
+
+ iter->cache_reader_page = iter->head_page;
+ iter->cache_read = cpu_buffer->read;
++ iter->cache_pages_removed = cpu_buffer->pages_removed;
+
+ if (iter->head)
+ iter->read_stamp = cpu_buffer->read_stamp;
+@@ -4022,12 +4022,13 @@ rb_iter_peek(struct ring_buffer_iter *iter, u64 *ts)
+ buffer = cpu_buffer->buffer;
+
+ /*
+- * Check if someone performed a consuming read to
+- * the buffer. A consuming read invalidates the iterator
+- * and we need to reset the iterator in this case.
++ * Check if someone performed a consuming read to the buffer
++ * or removed some pages from the buffer. In these cases,
++ * iterator was invalidated and we need to reset it.
+ */
+ if (unlikely(iter->cache_read != cpu_buffer->read ||
+- iter->cache_reader_page != cpu_buffer->reader_page))
++ iter->cache_reader_page != cpu_buffer->reader_page ||
++ iter->cache_pages_removed != cpu_buffer->pages_removed))
+ rb_iter_reset(iter);
+
+ again:
+@@ -4408,28 +4409,34 @@ unsigned long ring_buffer_size(struct ring_buffer *buffer, int cpu)
+ }
+ EXPORT_SYMBOL_GPL(ring_buffer_size);
+
++static void rb_clear_buffer_page(struct buffer_page *page)
++{
++ local_set(&page->write, 0);
++ local_set(&page->entries, 0);
++ rb_init_page(page->page);
++ page->read = 0;
++}
++
+ static void
+ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
+ {
++ struct buffer_page *page;
++
+ rb_head_page_deactivate(cpu_buffer);
+
+ cpu_buffer->head_page
+ = list_entry(cpu_buffer->pages, struct buffer_page, list);
+- local_set(&cpu_buffer->head_page->write, 0);
+- local_set(&cpu_buffer->head_page->entries, 0);
+- local_set(&cpu_buffer->head_page->page->commit, 0);
+-
+- cpu_buffer->head_page->read = 0;
++ rb_clear_buffer_page(cpu_buffer->head_page);
++ list_for_each_entry(page, cpu_buffer->pages, list) {
++ rb_clear_buffer_page(page);
++ }
+
+ cpu_buffer->tail_page = cpu_buffer->head_page;
+ cpu_buffer->commit_page = cpu_buffer->head_page;
+
+ INIT_LIST_HEAD(&cpu_buffer->reader_page->list);
+ INIT_LIST_HEAD(&cpu_buffer->new_pages);
+- local_set(&cpu_buffer->reader_page->write, 0);
+- local_set(&cpu_buffer->reader_page->entries, 0);
+- local_set(&cpu_buffer->reader_page->page->commit, 0);
+- cpu_buffer->reader_page->read = 0;
++ rb_clear_buffer_page(cpu_buffer->reader_page);
+
+ local_set(&cpu_buffer->entries_bytes, 0);
+ local_set(&cpu_buffer->overrun, 0);
+@@ -4448,6 +4455,7 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
+ cpu_buffer->last_overrun = 0;
+
+ rb_head_page_activate(cpu_buffer);
++ cpu_buffer->pages_removed = 0;
+ }
+
+ /**
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 98abff0462366..9da7b10e56d23 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -7107,14 +7107,23 @@ static ssize_t
+ tracing_read_dyn_info(struct file *filp, char __user *ubuf,
+ size_t cnt, loff_t *ppos)
+ {
+- unsigned long *p = filp->private_data;
+- char buf[64]; /* Not too big for a shallow stack */
++ ssize_t ret;
++ char *buf;
+ int r;
+
+- r = scnprintf(buf, 63, "%ld", *p);
+- buf[r++] = '\n';
++ /* 256 should be plenty to hold the amount needed */
++ buf = kmalloc(256, GFP_KERNEL);
++ if (!buf)
++ return -ENOMEM;
+
+- return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
++ r = scnprintf(buf, 256, "%ld pages:%ld groups: %ld\n",
++ ftrace_update_tot_cnt,
++ ftrace_number_of_pages,
++ ftrace_number_of_groups);
++
++ ret = simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
++ kfree(buf);
++ return ret;
+ }
+
+ static const struct file_operations tracing_dyn_info_fops = {
+@@ -8246,7 +8255,7 @@ static __init int tracer_init_tracefs(void)
+
+ #ifdef CONFIG_DYNAMIC_FTRACE
+ trace_create_file("dyn_ftrace_total_info", 0444, d_tracer,
+- &ftrace_update_tot_cnt, &tracing_dyn_info_fops);
++ NULL, &tracing_dyn_info_fops);
+ #endif
+
+ create_trace_instances(d_tracer);
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 0923d1b18d1fb..f4d83b552a477 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -748,6 +748,8 @@ extern void trace_event_follow_fork(struct trace_array *tr, bool enable);
+
+ #ifdef CONFIG_DYNAMIC_FTRACE
+ extern unsigned long ftrace_update_tot_cnt;
++extern unsigned long ftrace_number_of_pages;
++extern unsigned long ftrace_number_of_groups;
+ void ftrace_init_trace_array(struct trace_array *tr);
+ #else
+ static inline void ftrace_init_trace_array(struct trace_array *tr) { }
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index d2f9146d1ad74..a3dc6c126b3ee 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -372,7 +372,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file,
+ {
+ struct trace_event_call *call = file->event_call;
+ struct trace_array *tr = file->tr;
+- unsigned long file_flags = file->flags;
+ int ret = 0;
+ int disable;
+
+@@ -396,6 +395,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file,
+ break;
+ disable = file->flags & EVENT_FILE_FL_SOFT_DISABLED;
+ clear_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags);
++ /* Disable use of trace_buffered_event */
++ trace_buffered_event_disable();
+ } else
+ disable = !(file->flags & EVENT_FILE_FL_SOFT_MODE);
+
+@@ -434,6 +435,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file,
+ if (atomic_inc_return(&file->sm_ref) > 1)
+ break;
+ set_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags);
++ /* Enable use of trace_buffered_event */
++ trace_buffered_event_enable();
+ }
+
+ if (!(file->flags & EVENT_FILE_FL_ENABLED)) {
+@@ -473,15 +476,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file,
+ break;
+ }
+
+- /* Enable or disable use of trace_buffered_event */
+- if ((file_flags & EVENT_FILE_FL_SOFT_DISABLED) !=
+- (file->flags & EVENT_FILE_FL_SOFT_DISABLED)) {
+- if (file->flags & EVENT_FILE_FL_SOFT_DISABLED)
+- trace_buffered_event_enable();
+- else
+- trace_buffered_event_disable();
+- }
+-
+ return ret;
+ }
+
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 455cf41aedbbc..e004daf8cad57 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -5787,13 +5787,16 @@ static int event_hist_trigger_func(struct event_command *cmd_ops,
+ if (get_named_trigger_data(trigger_data))
+ goto enable;
+
+- if (has_hist_vars(hist_data))
+- save_hist_vars(hist_data);
+-
+ ret = create_actions(hist_data, file);
+ if (ret)
+ goto out_unreg;
+
++ if (has_hist_vars(hist_data) || hist_data->n_var_refs) {
++ ret = save_hist_vars(hist_data);
++ if (ret)
++ goto out_unreg;
++ }
++
+ ret = tracing_map_init(hist_data->map);
+ if (ret)
+ goto out_unreg;
+diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
+index 71381168dedef..f8e460b4a59d5 100644
+--- a/kernel/watchdog_hld.c
++++ b/kernel/watchdog_hld.c
+@@ -114,14 +114,14 @@ static void watchdog_overflow_callback(struct perf_event *event,
+ /* Ensure the watchdog never gets throttled */
+ event->hw.interrupts = 0;
+
++ if (!watchdog_check_timestamp())
++ return;
++
+ if (__this_cpu_read(watchdog_nmi_touch) == true) {
+ __this_cpu_write(watchdog_nmi_touch, false);
+ return;
+ }
+
+- if (!watchdog_check_timestamp())
+- return;
+-
+ /* check for a hardlockup
+ * This is done by making sure our timer interrupt
+ * is incrementing. The timer interrupt should have
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 4ea2f7fd20ceb..5533206cb6f48 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -680,12 +680,17 @@ static void clear_work_data(struct work_struct *work)
+ set_work_data(work, WORK_STRUCT_NO_POOL, 0);
+ }
+
++static inline struct pool_workqueue *work_struct_pwq(unsigned long data)
++{
++ return (struct pool_workqueue *)(data & WORK_STRUCT_WQ_DATA_MASK);
++}
++
+ static struct pool_workqueue *get_work_pwq(struct work_struct *work)
+ {
+ unsigned long data = atomic_long_read(&work->data);
+
+ if (data & WORK_STRUCT_PWQ)
+- return (void *)(data & WORK_STRUCT_WQ_DATA_MASK);
++ return work_struct_pwq(data);
+ else
+ return NULL;
+ }
+@@ -713,8 +718,7 @@ static struct worker_pool *get_work_pool(struct work_struct *work)
+ assert_rcu_or_pool_mutex();
+
+ if (data & WORK_STRUCT_PWQ)
+- return ((struct pool_workqueue *)
+- (data & WORK_STRUCT_WQ_DATA_MASK))->pool;
++ return work_struct_pwq(data)->pool;
+
+ pool_id = data >> WORK_OFFQ_POOL_SHIFT;
+ if (pool_id == WORK_OFFQ_POOL_NONE)
+@@ -735,8 +739,7 @@ static int get_work_pool_id(struct work_struct *work)
+ unsigned long data = atomic_long_read(&work->data);
+
+ if (data & WORK_STRUCT_PWQ)
+- return ((struct pool_workqueue *)
+- (data & WORK_STRUCT_WQ_DATA_MASK))->pool->id;
++ return work_struct_pwq(data)->pool->id;
+
+ return data >> WORK_OFFQ_POOL_SHIFT;
+ }
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 5f23d896df55a..62d095fd0c52a 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -371,6 +371,15 @@ static void debug_print_object(struct debug_obj *obj, char *msg)
+ struct debug_obj_descr *descr = obj->descr;
+ static int limit;
+
++ /*
++ * Don't report if lookup_object_or_alloc() by the current thread
++ * failed because lookup_object_or_alloc()/debug_objects_oom() by a
++ * concurrent thread turned off debug_objects_enabled and cleared
++ * the hash buckets.
++ */
++ if (!debug_objects_enabled)
++ return;
++
+ if (limit < 5 && descr != descr_test) {
+ void *hint = descr->debug_hint ?
+ descr->debug_hint(obj->object) : NULL;
+diff --git a/lib/radix-tree.c b/lib/radix-tree.c
+index e5cab5c4e3830..8d29fa5b26957 100644
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -1498,7 +1498,7 @@ void *radix_tree_tag_clear(struct radix_tree_root *root,
+ {
+ struct radix_tree_node *node, *parent;
+ unsigned long maxindex;
+- int uninitialized_var(offset);
++ int offset;
+
+ radix_tree_load_root(root, &node, &maxindex);
+ if (index > maxindex)
+diff --git a/lib/test_firmware.c b/lib/test_firmware.c
+index f4cc874021da2..b5e779bcfb343 100644
+--- a/lib/test_firmware.c
++++ b/lib/test_firmware.c
+@@ -160,7 +160,7 @@ static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp)
+ {
+ *dst = kstrndup(name, count, gfp);
+ if (!*dst)
+- return -ENOSPC;
++ return -ENOMEM;
+ return count;
+ }
+
+@@ -456,7 +456,7 @@ static ssize_t trigger_request_store(struct device *dev,
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ pr_info("loading '%s'\n", name);
+
+@@ -497,7 +497,7 @@ static ssize_t trigger_async_request_store(struct device *dev,
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ pr_info("loading '%s'\n", name);
+
+@@ -540,7 +540,7 @@ static ssize_t trigger_custom_fallback_store(struct device *dev,
+
+ name = kstrndup(buf, count, GFP_KERNEL);
+ if (!name)
+- return -ENOSPC;
++ return -ENOMEM;
+
+ pr_info("loading '%s' using custom fallback mechanism\n", name);
+
+@@ -618,6 +618,11 @@ static ssize_t trigger_batched_requests_store(struct device *dev,
+
+ mutex_lock(&test_fw_mutex);
+
++ if (test_fw_config->reqs) {
++ rc = -EBUSY;
++ goto out_bail;
++ }
++
+ test_fw_config->reqs =
+ vzalloc(array3_size(sizeof(struct test_batched_req),
+ test_fw_config->num_requests, 2));
+@@ -721,6 +726,11 @@ ssize_t trigger_batched_requests_async_store(struct device *dev,
+
+ mutex_lock(&test_fw_mutex);
+
++ if (test_fw_config->reqs) {
++ rc = -EBUSY;
++ goto out_bail;
++ }
++
+ test_fw_config->reqs =
+ vzalloc(array3_size(sizeof(struct test_batched_req),
+ test_fw_config->num_requests, 2));
+diff --git a/lib/ts_bm.c b/lib/ts_bm.c
+index 9e66ee4020e90..5de382e79a45a 100644
+--- a/lib/ts_bm.c
++++ b/lib/ts_bm.c
+@@ -64,10 +64,12 @@ static unsigned int bm_find(struct ts_config *conf, struct ts_state *state)
+ struct ts_bm *bm = ts_config_priv(conf);
+ unsigned int i, text_len, consumed = state->offset;
+ const u8 *text;
+- int shift = bm->patlen - 1, bs;
++ int bs;
+ const u8 icase = conf->flags & TS_IGNORECASE;
+
+ for (;;) {
++ int shift = bm->patlen - 1;
++
+ text_len = conf->get_next_block(consumed, &text, conf, state);
+
+ if (unlikely(text_len == 0))
+diff --git a/mm/frontswap.c b/mm/frontswap.c
+index 157e5bf635042..80bf870d881a0 100644
+--- a/mm/frontswap.c
++++ b/mm/frontswap.c
+@@ -447,7 +447,7 @@ static int __frontswap_shrink(unsigned long target_pages,
+ void frontswap_shrink(unsigned long target_pages)
+ {
+ unsigned long pages_to_unuse = 0;
+- int uninitialized_var(type), ret;
++ int type, ret;
+
+ /*
+ * we don't want to hold swap_lock while doing a very
+diff --git a/mm/ksm.c b/mm/ksm.c
+index 87a541ab1474f..9693aadec6e26 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -2381,7 +2381,7 @@ next_mm:
+ static void ksm_do_scan(unsigned int scan_npages)
+ {
+ struct rmap_item *rmap_item;
+- struct page *uninitialized_var(page);
++ struct page *page;
+
+ while (scan_npages-- && likely(!freezing(current))) {
+ cond_resched();
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index bc4c61dcf95c7..5a366cf798214 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -919,7 +919,7 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
+ struct mem_cgroup *prev,
+ struct mem_cgroup_reclaim_cookie *reclaim)
+ {
+- struct mem_cgroup_reclaim_iter *uninitialized_var(iter);
++ struct mem_cgroup_reclaim_iter *iter;
+ struct cgroup_subsys_state *css = NULL;
+ struct mem_cgroup *memcg = NULL;
+ struct mem_cgroup *pos = NULL;
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 35088e830bff8..86fd6bedaff4d 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1147,7 +1147,7 @@ int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from,
+ static struct page *new_page(struct page *page, unsigned long start)
+ {
+ struct vm_area_struct *vma;
+- unsigned long uninitialized_var(address);
++ unsigned long address;
+
+ vma = find_vma(current->mm, start);
+ while (vma) {
+@@ -1545,7 +1545,7 @@ static int kernel_get_mempolicy(int __user *policy,
+ unsigned long flags)
+ {
+ int err;
+- int uninitialized_var(pval);
++ int pval;
+ nodemask_t nodes;
+
+ if (nmask != NULL && maxnode < nr_node_ids)
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 0151f276ae680..6ae4993214b4d 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -2283,7 +2283,7 @@ static struct pcpu_alloc_info * __init pcpu_build_alloc_info(
+ const size_t static_size = __per_cpu_end - __per_cpu_start;
+ int nr_groups = 1, nr_units = 0;
+ size_t size_sum, min_unit_size, alloc_size;
+- int upa, max_upa, uninitialized_var(best_upa); /* units_per_alloc */
++ int upa, max_upa, best_upa; /* units_per_alloc */
+ int last_allocs, group, unit;
+ unsigned int cpu, tcpu;
+ struct pcpu_alloc_info *ai;
+diff --git a/mm/slub.c b/mm/slub.c
+index ef730ea8263cb..edf766f1de63f 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1179,7 +1179,7 @@ static noinline int free_debug_processing(
+ struct kmem_cache_node *n = get_node(s, page_to_nid(page));
+ void *object = head;
+ int cnt = 0;
+- unsigned long uninitialized_var(flags);
++ unsigned long flags;
+ int ret = 0;
+
+ spin_lock_irqsave(&n->list_lock, flags);
+@@ -2826,7 +2826,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
+ struct page new;
+ unsigned long counters;
+ struct kmem_cache_node *n = NULL;
+- unsigned long uninitialized_var(flags);
++ unsigned long flags;
+
+ stat(s, FREE_SLOWPATH);
+
+diff --git a/mm/swap.c b/mm/swap.c
+index 45fdbfb6b2a60..ce13e428380e9 100644
+--- a/mm/swap.c
++++ b/mm/swap.c
+@@ -721,8 +721,8 @@ void release_pages(struct page **pages, int nr)
+ LIST_HEAD(pages_to_free);
+ struct pglist_data *locked_pgdat = NULL;
+ struct lruvec *lruvec;
+- unsigned long uninitialized_var(flags);
+- unsigned int uninitialized_var(lock_batch);
++ unsigned long flags;
++ unsigned int lock_batch;
+
+ for (i = 0; i < nr; i++) {
+ struct page *page = pages[i];
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index 1c6d01a27e0e8..b831e5fe3ebc1 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -45,6 +45,7 @@ static const struct proto_ops l2cap_sock_ops;
+ static void l2cap_sock_init(struct sock *sk, struct sock *parent);
+ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
+ int proto, gfp_t prio, int kern);
++static void l2cap_sock_cleanup_listen(struct sock *parent);
+
+ bool l2cap_is_socket(struct socket *sock)
+ {
+@@ -1205,6 +1206,7 @@ static int l2cap_sock_release(struct socket *sock)
+ if (!sk)
+ return 0;
+
++ l2cap_sock_cleanup_listen(sk);
+ bt_sock_unlink(&l2cap_sk_list, sk);
+
+ err = l2cap_sock_shutdown(sock, 2);
+diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
+index b5fb2b682e191..ab539551b7d39 100644
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -161,8 +161,9 @@ void br_manage_promisc(struct net_bridge *br)
+ * This lets us disable promiscuous mode and write
+ * this config to hw.
+ */
+- if (br->auto_cnt == 0 ||
+- (br->auto_cnt == 1 && br_auto_port(p)))
++ if ((p->dev->priv_flags & IFF_UNICAST_FLT) &&
++ (br->auto_cnt == 0 ||
++ (br->auto_cnt == 1 && br_auto_port(p))))
+ br_port_clear_promisc(p);
+ else
+ br_port_set_promisc(p);
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index 61269cc2fa828..1c9953c68f095 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -1520,6 +1520,12 @@ static int bcm_release(struct socket *sock)
+
+ lock_sock(sk);
+
++#if IS_ENABLED(CONFIG_PROC_FS)
++ /* remove procfs entry */
++ if (net->can.bcmproc_dir && bo->bcm_proc_read)
++ remove_proc_entry(bo->procname, net->can.bcmproc_dir);
++#endif /* CONFIG_PROC_FS */
++
+ list_for_each_entry_safe(op, next, &bo->tx_ops, list)
+ bcm_remove_op(op);
+
+@@ -1555,12 +1561,6 @@ static int bcm_release(struct socket *sock)
+ list_for_each_entry_safe(op, next, &bo->rx_ops, list)
+ bcm_remove_op(op);
+
+-#if IS_ENABLED(CONFIG_PROC_FS)
+- /* remove procfs entry */
+- if (net->can.bcmproc_dir && bo->bcm_proc_read)
+- remove_proc_entry(bo->procname, net->can.bcmproc_dir);
+-#endif /* CONFIG_PROC_FS */
+-
+ /* remove device reference */
+ if (bo->bound) {
+ bo->bound = 0;
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 713fe1fbcb181..90ebb0ba927cd 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -3137,17 +3137,24 @@ static int linger_reg_commit_wait(struct ceph_osd_linger_request *lreq)
+ int ret;
+
+ dout("%s lreq %p linger_id %llu\n", __func__, lreq, lreq->linger_id);
+- ret = wait_for_completion_interruptible(&lreq->reg_commit_wait);
++ ret = wait_for_completion_killable(&lreq->reg_commit_wait);
+ return ret ?: lreq->reg_commit_error;
+ }
+
+-static int linger_notify_finish_wait(struct ceph_osd_linger_request *lreq)
++static int linger_notify_finish_wait(struct ceph_osd_linger_request *lreq,
++ unsigned long timeout)
+ {
+- int ret;
++ long left;
+
+ dout("%s lreq %p linger_id %llu\n", __func__, lreq, lreq->linger_id);
+- ret = wait_for_completion_interruptible(&lreq->notify_finish_wait);
+- return ret ?: lreq->notify_finish_error;
++ left = wait_for_completion_killable_timeout(&lreq->notify_finish_wait,
++ ceph_timeout_jiffies(timeout));
++ if (left <= 0)
++ left = left ?: -ETIMEDOUT;
++ else
++ left = lreq->notify_finish_error; /* completed */
++
++ return left;
+ }
+
+ /*
+@@ -4760,7 +4767,8 @@ int ceph_osdc_notify(struct ceph_osd_client *osdc,
+
+ ret = linger_reg_commit_wait(lreq);
+ if (!ret)
+- ret = linger_notify_finish_wait(lreq);
++ ret = linger_notify_finish_wait(lreq,
++ msecs_to_jiffies(2 * timeout * MSEC_PER_SEC));
+ else
+ dout("lreq %p failed to initiate notify %d\n", lreq, ret);
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 2837cc03f69e2..79f62517e24a5 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -3436,7 +3436,7 @@ static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
+ ndm->ndm_ifindex = dev->ifindex;
+ ndm->ndm_state = ndm_state;
+
+- if (nla_put(skb, NDA_LLADDR, ETH_ALEN, addr))
++ if (nla_put(skb, NDA_LLADDR, dev->addr_len, addr))
+ goto nla_put_failure;
+ if (vid)
+ if (nla_put(skb, NDA_VLAN, sizeof(u16), &vid))
+@@ -3450,10 +3450,10 @@ nla_put_failure:
+ return -EMSGSIZE;
+ }
+
+-static inline size_t rtnl_fdb_nlmsg_size(void)
++static inline size_t rtnl_fdb_nlmsg_size(const struct net_device *dev)
+ {
+ return NLMSG_ALIGN(sizeof(struct ndmsg)) +
+- nla_total_size(ETH_ALEN) + /* NDA_LLADDR */
++ nla_total_size(dev->addr_len) + /* NDA_LLADDR */
+ nla_total_size(sizeof(u16)) + /* NDA_VLAN */
+ 0;
+ }
+@@ -3465,7 +3465,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, u16 vid, int type,
+ struct sk_buff *skb;
+ int err = -ENOBUFS;
+
+- skb = nlmsg_new(rtnl_fdb_nlmsg_size(), GFP_ATOMIC);
++ skb = nlmsg_new(rtnl_fdb_nlmsg_size(dev), GFP_ATOMIC);
+ if (!skb)
+ goto errout;
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 347a55519d0a5..3e6da3694a5a5 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1319,7 +1319,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+ if (!sock->ops->set_peek_off)
+ return -EOPNOTSUPP;
+
+- v.val = sk->sk_peek_off;
++ v.val = READ_ONCE(sk->sk_peek_off);
+ break;
+ case SO_NOFCS:
+ v.val = sock_flag(sk, SOCK_NOFCS);
+@@ -1349,7 +1349,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+ case SO_BUSY_POLL:
+- v.val = sk->sk_ll_usec;
++ v.val = READ_ONCE(sk->sk_ll_usec);
+ break;
+ #endif
+
+@@ -1939,13 +1939,24 @@ kuid_t sock_i_uid(struct sock *sk)
+ }
+ EXPORT_SYMBOL(sock_i_uid);
+
+-unsigned long sock_i_ino(struct sock *sk)
++unsigned long __sock_i_ino(struct sock *sk)
+ {
+ unsigned long ino;
+
+- read_lock_bh(&sk->sk_callback_lock);
++ read_lock(&sk->sk_callback_lock);
+ ino = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_ino : 0;
+- read_unlock_bh(&sk->sk_callback_lock);
++ read_unlock(&sk->sk_callback_lock);
++ return ino;
++}
++EXPORT_SYMBOL(__sock_i_ino);
++
++unsigned long sock_i_ino(struct sock *sk)
++{
++ unsigned long ino;
++
++ local_bh_disable();
++ ino = __sock_i_ino(sk);
++ local_bh_enable();
+ return ino;
+ }
+ EXPORT_SYMBOL(sock_i_ino);
+@@ -2548,7 +2559,7 @@ EXPORT_SYMBOL(__sk_mem_reclaim);
+
+ int sk_set_peek_off(struct sock *sk, int val)
+ {
+- sk->sk_peek_off = val;
++ WRITE_ONCE(sk->sk_peek_off, val);
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(sk_set_peek_off);
+diff --git a/net/dccp/options.c b/net/dccp/options.c
+index 4e40db017e198..3c464d63b0bb3 100644
+--- a/net/dccp/options.c
++++ b/net/dccp/options.c
+@@ -60,7 +60,7 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
+ (dh->dccph_doff * 4);
+ struct dccp_options_received *opt_recv = &dp->dccps_options_received;
+ unsigned char opt, len;
+- unsigned char *uninitialized_var(value);
++ unsigned char *value;
+ u32 elapsed_time;
+ __be32 opt_val;
+ int rc;
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index 5a272d09b8248..c6d670cd872f0 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -579,20 +579,8 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)
+ spin_lock(lock);
+ if (osk) {
+ WARN_ON_ONCE(sk->sk_hash != osk->sk_hash);
+- ret = sk_hashed(osk);
+- if (ret) {
+- /* Before deleting the node, we insert a new one to make
+- * sure that the look-up-sk process would not miss either
+- * of them and that at least one node would exist in ehash
+- * table all the time. Otherwise there's a tiny chance
+- * that lookup process could find nothing in ehash table.
+- */
+- __sk_nulls_add_node_tail_rcu(sk, list);
+- sk_nulls_del_node_init_rcu(osk);
+- }
+- goto unlock;
+- }
+- if (found_dup_sk) {
++ ret = sk_nulls_del_node_init_rcu(osk);
++ } else if (found_dup_sk) {
+ *found_dup_sk = inet_ehash_lookup_by_sk(sk, list);
+ if (*found_dup_sk)
+ ret = false;
+@@ -601,7 +589,6 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)
+ if (ret)
+ __sk_nulls_add_node_rcu(sk, list);
+
+-unlock:
+ spin_unlock(lock);
+
+ return ret;
+diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
+index fedd19c22b392..88c5069b5d20c 100644
+--- a/net/ipv4/inet_timewait_sock.c
++++ b/net/ipv4/inet_timewait_sock.c
+@@ -80,10 +80,10 @@ void inet_twsk_put(struct inet_timewait_sock *tw)
+ }
+ EXPORT_SYMBOL_GPL(inet_twsk_put);
+
+-static void inet_twsk_add_node_tail_rcu(struct inet_timewait_sock *tw,
+- struct hlist_nulls_head *list)
++static void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw,
++ struct hlist_nulls_head *list)
+ {
+- hlist_nulls_add_tail_rcu(&tw->tw_node, list);
++ hlist_nulls_add_head_rcu(&tw->tw_node, list);
+ }
+
+ static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw,
+@@ -119,7 +119,7 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
+
+ spin_lock(lock);
+
+- inet_twsk_add_node_tail_rcu(tw, &ehead->chain);
++ inet_twsk_add_node_rcu(tw, &ehead->chain);
+
+ /* Step 3: Remove SK from hash chain */
+ if (__sk_nulls_del_node_init_rcu(sk))
+diff --git a/net/ipv4/netfilter/nf_socket_ipv4.c b/net/ipv4/netfilter/nf_socket_ipv4.c
+index 4824b1e183a1d..bff2b85c5fd6b 100644
+--- a/net/ipv4/netfilter/nf_socket_ipv4.c
++++ b/net/ipv4/netfilter/nf_socket_ipv4.c
+@@ -96,11 +96,11 @@ nf_socket_get_sock_v4(struct net *net, struct sk_buff *skb, const int doff,
+ struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb,
+ const struct net_device *indev)
+ {
+- __be32 uninitialized_var(daddr), uninitialized_var(saddr);
+- __be16 uninitialized_var(dport), uninitialized_var(sport);
++ __be32 daddr, saddr;
++ __be16 dport, sport;
+ const struct iphdr *iph = ip_hdr(skb);
+ struct sk_buff *data_skb = NULL;
+- u8 uninitialized_var(protocol);
++ u8 protocol;
+ #if IS_ENABLED(CONFIG_NF_CONNTRACK)
+ enum ip_conntrack_info ctinfo;
+ struct nf_conn const *ct;
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index cb96775fc86f6..00648a478c6a5 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3000,18 +3000,18 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+
+ case TCP_LINGER2:
+ if (val < 0)
+- tp->linger2 = -1;
+- else if (val > net->ipv4.sysctl_tcp_fin_timeout / HZ)
+- tp->linger2 = 0;
++ WRITE_ONCE(tp->linger2, -1);
++ else if (val > TCP_FIN_TIMEOUT_MAX / HZ)
++ WRITE_ONCE(tp->linger2, TCP_FIN_TIMEOUT_MAX);
+ else
+- tp->linger2 = val * HZ;
++ WRITE_ONCE(tp->linger2, val * HZ);
+ break;
+
+ case TCP_DEFER_ACCEPT:
+ /* Translate value in seconds to number of retransmits */
+- icsk->icsk_accept_queue.rskq_defer_accept =
+- secs_to_retrans(val, TCP_TIMEOUT_INIT / HZ,
+- TCP_RTO_MAX / HZ);
++ WRITE_ONCE(icsk->icsk_accept_queue.rskq_defer_accept,
++ secs_to_retrans(val, TCP_TIMEOUT_INIT / HZ,
++ TCP_RTO_MAX / HZ));
+ break;
+
+ case TCP_WINDOW_CLAMP:
+@@ -3099,7 +3099,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ err = tcp_repair_set_window(tp, optval, optlen);
+ break;
+ case TCP_NOTSENT_LOWAT:
+- tp->notsent_lowat = val;
++ WRITE_ONCE(tp->notsent_lowat, val);
+ sk->sk_write_space(sk);
+ break;
+ case TCP_INQ:
+@@ -3401,13 +3401,14 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
+ val = icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_syn_retries;
+ break;
+ case TCP_LINGER2:
+- val = tp->linger2;
++ val = READ_ONCE(tp->linger2);
+ if (val >= 0)
+ val = (val ? : READ_ONCE(net->ipv4.sysctl_tcp_fin_timeout)) / HZ;
+ break;
+ case TCP_DEFER_ACCEPT:
+- val = retrans_to_secs(icsk->icsk_accept_queue.rskq_defer_accept,
+- TCP_TIMEOUT_INIT / HZ, TCP_RTO_MAX / HZ);
++ val = READ_ONCE(icsk->icsk_accept_queue.rskq_defer_accept);
++ val = retrans_to_secs(val, TCP_TIMEOUT_INIT / HZ,
++ TCP_RTO_MAX / HZ);
+ break;
+ case TCP_WINDOW_CLAMP:
+ val = tp->window_clamp;
+@@ -3553,7 +3554,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
+ break;
+
+ case TCP_FASTOPEN:
+- val = icsk->icsk_accept_queue.fastopenq.max_qlen;
++ val = READ_ONCE(icsk->icsk_accept_queue.fastopenq.max_qlen);
+ break;
+
+ case TCP_FASTOPEN_CONNECT:
+@@ -3568,7 +3569,7 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
+ val = tcp_time_stamp_raw() + tp->tsoffset;
+ break;
+ case TCP_NOTSENT_LOWAT:
+- val = tp->notsent_lowat;
++ val = READ_ONCE(tp->notsent_lowat);
+ break;
+ case TCP_INQ:
+ val = tp->recvmsg_inq;
+diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
+index f726591de7c7a..f7bb78b443fa9 100644
+--- a/net/ipv4/tcp_fastopen.c
++++ b/net/ipv4/tcp_fastopen.c
+@@ -276,6 +276,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
+ static bool tcp_fastopen_queue_check(struct sock *sk)
+ {
+ struct fastopen_queue *fastopenq;
++ int max_qlen;
+
+ /* Make sure the listener has enabled fastopen, and we don't
+ * exceed the max # of pending TFO requests allowed before trying
+@@ -288,10 +289,11 @@ static bool tcp_fastopen_queue_check(struct sock *sk)
+ * temporarily vs a server not supporting Fast Open at all.
+ */
+ fastopenq = &inet_csk(sk)->icsk_accept_queue.fastopenq;
+- if (fastopenq->max_qlen == 0)
++ max_qlen = READ_ONCE(fastopenq->max_qlen);
++ if (max_qlen == 0)
+ return false;
+
+- if (fastopenq->qlen >= fastopenq->max_qlen) {
++ if (fastopenq->qlen >= max_qlen) {
+ struct request_sock *req1;
+ spin_lock(&fastopenq->lock);
+ req1 = fastopenq->rskq_rst_head;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index bd921fa7b9ab4..281f7799aeafc 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3429,8 +3429,11 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32
+ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
+ u32 *last_oow_ack_time)
+ {
+- if (*last_oow_ack_time) {
+- s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time);
++ /* Paired with the WRITE_ONCE() in this function. */
++ u32 val = READ_ONCE(*last_oow_ack_time);
++
++ if (val) {
++ s32 elapsed = (s32)(tcp_jiffies32 - val);
+
+ if (0 <= elapsed &&
+ elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) {
+@@ -3439,7 +3442,10 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
+ }
+ }
+
+- *last_oow_ack_time = tcp_jiffies32;
++ /* Paired with the prior READ_ONCE() and with itself,
++ * as we might be lockless.
++ */
++ WRITE_ONCE(*last_oow_ack_time, tcp_jiffies32);
+
+ return false; /* not rate-limited: go ahead, send dupack now! */
+ }
+diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
+index 4960e2b6bd7f7..7bbd9125b5000 100644
+--- a/net/ipv4/tcp_metrics.c
++++ b/net/ipv4/tcp_metrics.c
+@@ -40,7 +40,7 @@ struct tcp_fastopen_metrics {
+
+ struct tcp_metrics_block {
+ struct tcp_metrics_block __rcu *tcpm_next;
+- possible_net_t tcpm_net;
++ struct net *tcpm_net;
+ struct inetpeer_addr tcpm_saddr;
+ struct inetpeer_addr tcpm_daddr;
+ unsigned long tcpm_stamp;
+@@ -51,34 +51,38 @@ struct tcp_metrics_block {
+ struct rcu_head rcu_head;
+ };
+
+-static inline struct net *tm_net(struct tcp_metrics_block *tm)
++static inline struct net *tm_net(const struct tcp_metrics_block *tm)
+ {
+- return read_pnet(&tm->tcpm_net);
++ /* Paired with the WRITE_ONCE() in tcpm_new() */
++ return READ_ONCE(tm->tcpm_net);
+ }
+
+ static bool tcp_metric_locked(struct tcp_metrics_block *tm,
+ enum tcp_metric_index idx)
+ {
+- return tm->tcpm_lock & (1 << idx);
++ /* Paired with WRITE_ONCE() in tcpm_suck_dst() */
++ return READ_ONCE(tm->tcpm_lock) & (1 << idx);
+ }
+
+-static u32 tcp_metric_get(struct tcp_metrics_block *tm,
++static u32 tcp_metric_get(const struct tcp_metrics_block *tm,
+ enum tcp_metric_index idx)
+ {
+- return tm->tcpm_vals[idx];
++ /* Paired with WRITE_ONCE() in tcp_metric_set() */
++ return READ_ONCE(tm->tcpm_vals[idx]);
+ }
+
+ static void tcp_metric_set(struct tcp_metrics_block *tm,
+ enum tcp_metric_index idx,
+ u32 val)
+ {
+- tm->tcpm_vals[idx] = val;
++ /* Paired with READ_ONCE() in tcp_metric_get() */
++ WRITE_ONCE(tm->tcpm_vals[idx], val);
+ }
+
+ static bool addr_same(const struct inetpeer_addr *a,
+ const struct inetpeer_addr *b)
+ {
+- return inetpeer_addr_cmp(a, b) == 0;
++ return (a->family == b->family) && !inetpeer_addr_cmp(a, b);
+ }
+
+ struct tcpm_hash_bucket {
+@@ -89,6 +93,7 @@ static struct tcpm_hash_bucket *tcp_metrics_hash __read_mostly;
+ static unsigned int tcp_metrics_hash_log __read_mostly;
+
+ static DEFINE_SPINLOCK(tcp_metrics_lock);
++static DEFINE_SEQLOCK(fastopen_seqlock);
+
+ static void tcpm_suck_dst(struct tcp_metrics_block *tm,
+ const struct dst_entry *dst,
+@@ -97,7 +102,7 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm,
+ u32 msval;
+ u32 val;
+
+- tm->tcpm_stamp = jiffies;
++ WRITE_ONCE(tm->tcpm_stamp, jiffies);
+
+ val = 0;
+ if (dst_metric_locked(dst, RTAX_RTT))
+@@ -110,30 +115,42 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm,
+ val |= 1 << TCP_METRIC_CWND;
+ if (dst_metric_locked(dst, RTAX_REORDERING))
+ val |= 1 << TCP_METRIC_REORDERING;
+- tm->tcpm_lock = val;
++ /* Paired with READ_ONCE() in tcp_metric_locked() */
++ WRITE_ONCE(tm->tcpm_lock, val);
+
+ msval = dst_metric_raw(dst, RTAX_RTT);
+- tm->tcpm_vals[TCP_METRIC_RTT] = msval * USEC_PER_MSEC;
++ tcp_metric_set(tm, TCP_METRIC_RTT, msval * USEC_PER_MSEC);
+
+ msval = dst_metric_raw(dst, RTAX_RTTVAR);
+- tm->tcpm_vals[TCP_METRIC_RTTVAR] = msval * USEC_PER_MSEC;
+- tm->tcpm_vals[TCP_METRIC_SSTHRESH] = dst_metric_raw(dst, RTAX_SSTHRESH);
+- tm->tcpm_vals[TCP_METRIC_CWND] = dst_metric_raw(dst, RTAX_CWND);
+- tm->tcpm_vals[TCP_METRIC_REORDERING] = dst_metric_raw(dst, RTAX_REORDERING);
++ tcp_metric_set(tm, TCP_METRIC_RTTVAR, msval * USEC_PER_MSEC);
++ tcp_metric_set(tm, TCP_METRIC_SSTHRESH,
++ dst_metric_raw(dst, RTAX_SSTHRESH));
++ tcp_metric_set(tm, TCP_METRIC_CWND,
++ dst_metric_raw(dst, RTAX_CWND));
++ tcp_metric_set(tm, TCP_METRIC_REORDERING,
++ dst_metric_raw(dst, RTAX_REORDERING));
+ if (fastopen_clear) {
++ write_seqlock(&fastopen_seqlock);
+ tm->tcpm_fastopen.mss = 0;
+ tm->tcpm_fastopen.syn_loss = 0;
+ tm->tcpm_fastopen.try_exp = 0;
+ tm->tcpm_fastopen.cookie.exp = false;
+ tm->tcpm_fastopen.cookie.len = 0;
++ write_sequnlock(&fastopen_seqlock);
+ }
+ }
+
+ #define TCP_METRICS_TIMEOUT (60 * 60 * HZ)
+
+-static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst)
++static void tcpm_check_stamp(struct tcp_metrics_block *tm,
++ const struct dst_entry *dst)
+ {
+- if (tm && unlikely(time_after(jiffies, tm->tcpm_stamp + TCP_METRICS_TIMEOUT)))
++ unsigned long limit;
++
++ if (!tm)
++ return;
++ limit = READ_ONCE(tm->tcpm_stamp) + TCP_METRICS_TIMEOUT;
++ if (unlikely(time_after(jiffies, limit)))
+ tcpm_suck_dst(tm, dst, false);
+ }
+
+@@ -174,20 +191,23 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
+ oldest = deref_locked(tcp_metrics_hash[hash].chain);
+ for (tm = deref_locked(oldest->tcpm_next); tm;
+ tm = deref_locked(tm->tcpm_next)) {
+- if (time_before(tm->tcpm_stamp, oldest->tcpm_stamp))
++ if (time_before(READ_ONCE(tm->tcpm_stamp),
++ READ_ONCE(oldest->tcpm_stamp)))
+ oldest = tm;
+ }
+ tm = oldest;
+ } else {
+- tm = kmalloc(sizeof(*tm), GFP_ATOMIC);
++ tm = kzalloc(sizeof(*tm), GFP_ATOMIC);
+ if (!tm)
+ goto out_unlock;
+ }
+- write_pnet(&tm->tcpm_net, net);
++ /* Paired with the READ_ONCE() in tm_net() */
++ WRITE_ONCE(tm->tcpm_net, net);
++
+ tm->tcpm_saddr = *saddr;
+ tm->tcpm_daddr = *daddr;
+
+- tcpm_suck_dst(tm, dst, true);
++ tcpm_suck_dst(tm, dst, reclaim);
+
+ if (likely(!reclaim)) {
+ tm->tcpm_next = tcp_metrics_hash[hash].chain;
+@@ -431,7 +451,7 @@ void tcp_update_metrics(struct sock *sk)
+ tp->reordering);
+ }
+ }
+- tm->tcpm_stamp = jiffies;
++ WRITE_ONCE(tm->tcpm_stamp, jiffies);
+ out_unlock:
+ rcu_read_unlock();
+ }
+@@ -544,8 +564,6 @@ bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst)
+ return ret;
+ }
+
+-static DEFINE_SEQLOCK(fastopen_seqlock);
+-
+ void tcp_fastopen_cache_get(struct sock *sk, u16 *mss,
+ struct tcp_fastopen_cookie *cookie)
+ {
+@@ -652,7 +670,7 @@ static int tcp_metrics_fill_info(struct sk_buff *msg,
+ }
+
+ if (nla_put_msecs(msg, TCP_METRICS_ATTR_AGE,
+- jiffies - tm->tcpm_stamp,
++ jiffies - READ_ONCE(tm->tcpm_stamp),
+ TCP_METRICS_ATTR_PAD) < 0)
+ goto nla_put_failure;
+
+@@ -663,7 +681,7 @@ static int tcp_metrics_fill_info(struct sk_buff *msg,
+ if (!nest)
+ goto nla_put_failure;
+ for (i = 0; i < TCP_METRIC_MAX_KERNEL + 1; i++) {
+- u32 val = tm->tcpm_vals[i];
++ u32 val = tcp_metric_get(tm, i);
+
+ if (!val)
+ continue;
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index f261c6d7f1f28..5c5c5736f6892 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -316,9 +316,8 @@ static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
+ static void addrconf_mod_rs_timer(struct inet6_dev *idev,
+ unsigned long when)
+ {
+- if (!timer_pending(&idev->rs_timer))
++ if (!mod_timer(&idev->rs_timer, jiffies + when))
+ in6_dev_hold(idev);
+- mod_timer(&idev->rs_timer, jiffies + when);
+ }
+
+ static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
+@@ -2489,12 +2488,18 @@ static void manage_tempaddrs(struct inet6_dev *idev,
+ ipv6_ifa_notify(0, ift);
+ }
+
+- if ((create || list_empty(&idev->tempaddr_list)) &&
+- idev->cnf.use_tempaddr > 0) {
++ /* Also create a temporary address if it's enabled but no temporary
++ * address currently exists.
++ * However, we get called with valid_lft == 0, prefered_lft == 0, create == false
++ * as part of cleanup (ie. deleting the mngtmpaddr).
++ * We don't want that to result in creating a new temporary ip address.
++ */
++ if (list_empty(&idev->tempaddr_list) && (valid_lft || prefered_lft))
++ create = true;
++
++ if (create && idev->cnf.use_tempaddr > 0) {
+ /* When a new public address is created as described
+ * in [ADDRCONF], also create a new temporary address.
+- * Also create a temporary address if it's enabled but
+- * no temporary address currently exists.
+ */
+ read_unlock_bh(&idev->lock);
+ ipv6_create_tempaddr(ifp, NULL, false);
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index fbc8746371b6d..bfafd7649ccb3 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -395,23 +395,31 @@ relookup_failed:
+ return ERR_PTR(err);
+ }
+
+-static int icmp6_iif(const struct sk_buff *skb)
++static struct net_device *icmp6_dev(const struct sk_buff *skb)
+ {
+- int iif = skb->dev->ifindex;
++ struct net_device *dev = skb->dev;
+
+ /* for local traffic to local address, skb dev is the loopback
+ * device. Check if there is a dst attached to the skb and if so
+ * get the real device index. Same is needed for replies to a link
+ * local address on a device enslaved to an L3 master device
+ */
+- if (unlikely(iif == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
++ if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
+ const struct rt6_info *rt6 = skb_rt6_info(skb);
+
+- if (rt6)
+- iif = rt6->rt6i_idev->dev->ifindex;
++ /* The destination could be an external IP in Ext Hdr (SRv6, RPL, etc.),
++ * and ip6_null_entry could be set to skb if no route is found.
++ */
++ if (rt6 && rt6->rt6i_idev)
++ dev = rt6->rt6i_idev->dev;
+ }
+
+- return iif;
++ return dev;
++}
++
++static int icmp6_iif(const struct sk_buff *skb)
++{
++ return icmp6_dev(skb)->ifindex;
+ }
+
+ /*
+@@ -800,7 +808,7 @@ out:
+ static int icmpv6_rcv(struct sk_buff *skb)
+ {
+ struct net *net = dev_net(skb->dev);
+- struct net_device *dev = skb->dev;
++ struct net_device *dev = icmp6_dev(skb);
+ struct inet6_dev *idev = __in6_dev_get(dev);
+ const struct in6_addr *saddr, *daddr;
+ struct icmp6hdr *hdr;
+diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
+index f994f50e15162..1858cf783a4ff 100644
+--- a/net/ipv6/ip6_flowlabel.c
++++ b/net/ipv6/ip6_flowlabel.c
+@@ -518,7 +518,7 @@ int ipv6_flowlabel_opt_get(struct sock *sk, struct in6_flowlabel_req *freq,
+
+ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
+ {
+- int uninitialized_var(err);
++ int err;
+ struct net *net = sock_net(sk);
+ struct ipv6_pinfo *np = inet6_sk(sk);
+ struct in6_flowlabel_req freq;
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index 45c304b51b2b7..aa8ada354a399 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -960,7 +960,8 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
+ goto tx_err;
+
+ if (skb->len > dev->mtu + dev->hard_header_len) {
+- pskb_trim(skb, dev->mtu + dev->hard_header_len);
++ if (pskb_trim(skb, dev->mtu + dev->hard_header_len))
++ goto tx_err;
+ truncate = true;
+ }
+
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index e9eb917342b85..329bad6cbb768 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -1064,7 +1064,7 @@ static int ip6mr_cache_report(struct mr_table *mrt, struct sk_buff *pkt,
+ And all this only to mangle msg->im6_msgtype and
+ to set msg->im6_mbz to "mbz" :-)
+ */
+- skb_push(skb, -skb_network_offset(pkt));
++ __skb_pull(skb, skb_network_offset(pkt));
+
+ skb_push(skb, sizeof(*msg));
+ skb_reset_transport_header(skb);
+diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c
+index 58e839e2ce1d3..5e5463459563f 100644
+--- a/net/ipv6/netfilter/nf_socket_ipv6.c
++++ b/net/ipv6/netfilter/nf_socket_ipv6.c
+@@ -102,7 +102,7 @@ nf_socket_get_sock_v6(struct net *net, struct sk_buff *skb, int doff,
+ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,
+ const struct net_device *indev)
+ {
+- __be16 uninitialized_var(dport), uninitialized_var(sport);
++ __be16 dport, sport;
+ const struct in6_addr *daddr = NULL, *saddr = NULL;
+ struct ipv6hdr *iph = ipv6_hdr(skb), ipv6_var;
+ struct sk_buff *data_skb = NULL;
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index 60dfd0d118512..b596727f04978 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -302,7 +302,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *skb,
+ skb_network_header_len(skb));
+
+ rcu_read_lock();
+- __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
++ __IP6_INC_STATS(net, __in6_dev_stats_get(dev, skb), IPSTATS_MIB_REASMOKS);
+ rcu_read_unlock();
+ fq->q.fragments = NULL;
+ fq->q.rb_fragments = RB_ROOT;
+@@ -317,7 +317,7 @@ out_oom:
+ net_dbg_ratelimited("ip6_frag_reasm: no memory for reassembly\n");
+ out_fail:
+ rcu_read_lock();
+- __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
++ __IP6_INC_STATS(net, __in6_dev_stats_get(dev, skb), IPSTATS_MIB_REASMFAILS);
+ rcu_read_unlock();
+ inet_frag_kill(&fq->q);
+ return -1;
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 9274603514e54..cf0bbe2e3a79f 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -99,7 +99,7 @@ static u32 udp6_ehashfn(const struct net *net,
+ fhash = __ipv6_addr_jhash(faddr, udp_ipv6_hash_secret);
+
+ return __inet6_ehashfn(lhash, lport, fhash, fport,
+- udp_ipv6_hash_secret + net_hash_mix(net));
++ udp6_ehash_secret + net_hash_mix(net));
+ }
+
+ int udp_v6_get_port(struct sock *sk, unsigned short snum)
+diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
+index 82cb93f66b9bd..f9e801cc50f5e 100644
+--- a/net/llc/llc_input.c
++++ b/net/llc/llc_input.c
+@@ -162,9 +162,6 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
+ void (*sta_handler)(struct sk_buff *skb);
+ void (*sap_handler)(struct llc_sap *sap, struct sk_buff *skb);
+
+- if (!net_eq(dev_net(dev), &init_net))
+- goto drop;
+-
+ /*
+ * When the interface is in promisc. mode, drop all the crap that it
+ * receives, do not try to analyse it.
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index 0427e66bc4786..31756d1bf83e7 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -791,20 +791,9 @@ static struct nlmsghdr *
+ start_msg(struct sk_buff *skb, u32 portid, u32 seq, unsigned int flags,
+ enum ipset_cmd cmd)
+ {
+- struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+-
+- nlh = nlmsg_put(skb, portid, seq, nfnl_msg_type(NFNL_SUBSYS_IPSET, cmd),
+- sizeof(*nfmsg), flags);
+- if (!nlh)
+- return NULL;
+-
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = NFPROTO_IPV4;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+- return nlh;
++ return nfnl_msg_put(skb, portid, seq,
++ nfnl_msg_type(NFNL_SUBSYS_IPSET, cmd), flags,
++ NFPROTO_IPV4, NFNETLINK_V0, 0);
+ }
+
+ /* Create a set */
+diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
+index efc14c7b4f8ef..c2fece0593eaa 100644
+--- a/net/netfilter/nf_conntrack_ftp.c
++++ b/net/netfilter/nf_conntrack_ftp.c
+@@ -383,7 +383,7 @@ static int help(struct sk_buff *skb,
+ int ret;
+ u32 seq;
+ int dir = CTINFO2DIR(ctinfo);
+- unsigned int uninitialized_var(matchlen), uninitialized_var(matchoff);
++ unsigned int matchlen, matchoff;
+ struct nf_ct_ftp_master *ct_ftp_info = nfct_help_data(ct);
+ struct nf_conntrack_expect *exp;
+ union nf_inet_addr *daddr;
+diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
+index e24b762ffa1d4..06c70d4584cfe 100644
+--- a/net/netfilter/nf_conntrack_helper.c
++++ b/net/netfilter/nf_conntrack_helper.c
+@@ -400,6 +400,9 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
+ BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES);
+ BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1);
+
++ if (!nf_ct_helper_hash)
++ return -ENOENT;
++
+ if (me->expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
+ return -EINVAL;
+
+@@ -570,4 +573,5 @@ void nf_conntrack_helper_fini(void)
+ {
+ nf_ct_extend_unregister(&helper_extend);
+ kvfree(nf_ct_helper_hash);
++ nf_ct_helper_hash = NULL;
+ }
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index b710889a90f6f..83e8566ec3f05 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -517,20 +517,15 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ {
+ const struct nf_conntrack_zone *zone;
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ struct nlattr *nest_parms;
+ unsigned int flags = portid ? NLM_F_MULTI : 0, event;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_NEW);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, nf_ct_l3num(ct),
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = nf_ct_l3num(ct);
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ zone = nf_ct_zone(ct);
+
+ nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
+@@ -687,7 +682,6 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
+ const struct nf_conntrack_zone *zone;
+ struct net *net;
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ struct nlattr *nest_parms;
+ struct nf_conn *ct = item->ct;
+ struct sk_buff *skb;
+@@ -717,15 +711,11 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
+ goto errout;
+
+ type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, type);
+- nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, item->portid, 0, type, flags, nf_ct_l3num(ct),
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = nf_ct_l3num(ct);
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ zone = nf_ct_zone(ct);
+
+ nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
+@@ -2170,20 +2160,15 @@ ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
+ __u16 cpu, const struct ip_conntrack_stat *st)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0, event;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK,
+ IPCTNL_MSG_CT_GET_STATS_CPU);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, htons(cpu));
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(cpu);
+-
+ if (nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) ||
+ nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) ||
+ nla_put_be32(skb, CTA_STATS_IGNORE, htonl(st->ignore)) ||
+@@ -2254,20 +2239,15 @@ ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ struct net *net)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0, event;
+ unsigned int nr_conntracks = atomic_read(&net->ct.count);
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_GET_STATS);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks)))
+ goto nla_put_failure;
+
+@@ -2780,19 +2760,14 @@ ctnetlink_exp_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
+ int event, const struct nf_conntrack_expect *exp)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags,
++ exp->tuple.src.l3num, NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = exp->tuple.src.l3num;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (ctnetlink_exp_dump_expect(skb, exp) < 0)
+ goto nla_put_failure;
+
+@@ -2812,7 +2787,6 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
+ struct nf_conntrack_expect *exp = item->exp;
+ struct net *net = nf_ct_exp_net(exp);
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ struct sk_buff *skb;
+ unsigned int type, group;
+ int flags = 0;
+@@ -2835,15 +2809,11 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
+ goto errout;
+
+ type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, type);
+- nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, item->portid, 0, type, flags,
++ exp->tuple.src.l3num, NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = exp->tuple.src.l3num;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (ctnetlink_exp_dump_expect(skb, exp) < 0)
+ goto nla_put_failure;
+
+@@ -3413,20 +3383,15 @@ ctnetlink_exp_stat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, int cpu,
+ const struct ip_conntrack_stat *st)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0, event;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK,
+ IPCTNL_MSG_EXP_GET_STATS_CPU);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, htons(cpu));
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(cpu);
+-
+ if (nla_put_be32(skb, CTA_STATS_EXP_NEW, htonl(st->expect_new)) ||
+ nla_put_be32(skb, CTA_STATS_EXP_CREATE, htonl(st->expect_create)) ||
+ nla_put_be32(skb, CTA_STATS_EXP_DELETE, htonl(st->expect_delete)))
+diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
+index 046f118dea06b..d16aa43ebd4d6 100644
+--- a/net/netfilter/nf_conntrack_sip.c
++++ b/net/netfilter/nf_conntrack_sip.c
+@@ -605,7 +605,7 @@ int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr,
+ start += strlen(name);
+ *val = simple_strtoul(start, &end, 0);
+ if (start == end)
+- return 0;
++ return -1;
+ if (matchoff && matchlen) {
+ *matchoff = start - dptr;
+ *matchlen = end - start;
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 2968f21915ddf..115bc79ec9055 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -22,10 +22,13 @@
+ #include <net/netfilter/nf_tables_core.h>
+ #include <net/netfilter/nf_tables.h>
+ #include <net/net_namespace.h>
++#include <net/netns/generic.h>
+ #include <net/sock.h>
+
+ #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
+
++unsigned int nf_tables_net_id __read_mostly;
++
+ static LIST_HEAD(nf_tables_expressions);
+ static LIST_HEAD(nf_tables_objects);
+ static LIST_HEAD(nf_tables_flowtables);
+@@ -53,7 +56,9 @@ static const struct rhashtable_params nft_chain_ht_params = {
+
+ static void nft_validate_state_update(struct net *net, u8 new_validate_state)
+ {
+- switch (net->nft.validate_state) {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
++
++ switch (nft_net->validate_state) {
+ case NFT_VALIDATE_SKIP:
+ WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
+ break;
+@@ -64,7 +69,7 @@ static void nft_validate_state_update(struct net *net, u8 new_validate_state)
+ return;
+ }
+
+- net->nft.validate_state = new_validate_state;
++ nft_net->validate_state = new_validate_state;
+ }
+
+ static void nft_ctx_init(struct nft_ctx *ctx,
+@@ -97,6 +102,7 @@ static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
+ return NULL;
+
+ INIT_LIST_HEAD(&trans->list);
++ INIT_LIST_HEAD(&trans->binding_list);
+ trans->msg_type = msg_type;
+ trans->ctx = *ctx;
+
+@@ -109,34 +115,68 @@ static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
+ return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
+ }
+
+-static void nft_trans_destroy(struct nft_trans *trans)
++static void nft_trans_list_del(struct nft_trans *trans)
+ {
+ list_del(&trans->list);
++ list_del(&trans->binding_list);
++}
++
++static void nft_trans_destroy(struct nft_trans *trans)
++{
++ nft_trans_list_del(trans);
+ kfree(trans);
+ }
+
+-static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
++static void __nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set,
++ bool bind)
+ {
++ struct nftables_pernet *nft_net;
+ struct net *net = ctx->net;
+ struct nft_trans *trans;
+
+ if (!nft_set_is_anonymous(set))
+ return;
+
+- list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
++ nft_net = net_generic(net, nf_tables_net_id);
++ list_for_each_entry_reverse(trans, &nft_net->commit_list, list) {
+ switch (trans->msg_type) {
+ case NFT_MSG_NEWSET:
+ if (nft_trans_set(trans) == set)
+- nft_trans_set_bound(trans) = true;
++ nft_trans_set_bound(trans) = bind;
+ break;
+ case NFT_MSG_NEWSETELEM:
+ if (nft_trans_elem_set(trans) == set)
+- nft_trans_elem_set_bound(trans) = true;
++ nft_trans_elem_set_bound(trans) = bind;
+ break;
+ }
+ }
+ }
+
++static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
++{
++ return __nft_set_trans_bind(ctx, set, true);
++}
++
++static void nft_set_trans_unbind(const struct nft_ctx *ctx, struct nft_set *set)
++{
++ return __nft_set_trans_bind(ctx, set, false);
++}
++
++static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trans)
++{
++ struct nftables_pernet *nft_net;
++
++ nft_net = net_generic(net, nf_tables_net_id);
++ switch (trans->msg_type) {
++ case NFT_MSG_NEWSET:
++ if (nft_set_is_anonymous(nft_trans_set(trans)))
++ list_add_tail(&trans->binding_list, &nft_net->binding_list);
++ break;
++ }
++
++ list_add_tail(&trans->list, &nft_net->commit_list);
++}
++
+ static int nf_tables_register_hook(struct net *net,
+ const struct nft_table *table,
+ struct nft_chain *chain)
+@@ -187,7 +227,7 @@ static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
+ if (msg_type == NFT_MSG_NEWTABLE)
+ nft_activate_next(ctx->net, ctx->table);
+
+- list_add_tail(&trans->list, &ctx->net->nft.commit_list);
++ nft_trans_commit_list_add_tail(ctx->net, trans);
+ return 0;
+ }
+
+@@ -214,7 +254,7 @@ static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
+ if (msg_type == NFT_MSG_NEWCHAIN)
+ nft_activate_next(ctx->net, ctx->chain);
+
+- list_add_tail(&trans->list, &ctx->net->nft.commit_list);
++ nft_trans_commit_list_add_tail(ctx->net, trans);
+ return 0;
+ }
+
+@@ -287,7 +327,7 @@ static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
+ ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
+ }
+ nft_trans_rule(trans) = rule;
+- list_add_tail(&trans->list, &ctx->net->nft.commit_list);
++ nft_trans_commit_list_add_tail(ctx->net, trans);
+
+ return trans;
+ }
+@@ -342,7 +382,7 @@ static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
+ nft_activate_next(ctx->net, set);
+ }
+ nft_trans_set(trans) = set;
+- list_add_tail(&trans->list, &ctx->net->nft.commit_list);
++ nft_trans_commit_list_add_tail(ctx->net, trans);
+
+ return 0;
+ }
+@@ -374,7 +414,7 @@ static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
+ nft_activate_next(ctx->net, obj);
+
+ nft_trans_obj(trans) = obj;
+- list_add_tail(&trans->list, &ctx->net->nft.commit_list);
++ nft_trans_commit_list_add_tail(ctx->net, trans);
+
+ return 0;
+ }
+@@ -407,7 +447,7 @@ static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
+ nft_activate_next(ctx->net, flowtable);
+
+ nft_trans_flowtable(trans) = flowtable;
+- list_add_tail(&trans->list, &ctx->net->nft.commit_list);
++ nft_trans_commit_list_add_tail(ctx->net, trans);
+
+ return 0;
+ }
+@@ -435,12 +475,14 @@ static struct nft_table *nft_table_lookup(const struct net *net,
+ const struct nlattr *nla,
+ u8 family, u8 genmask)
+ {
++ struct nftables_pernet *nft_net;
+ struct nft_table *table;
+
+ if (nla == NULL)
+ return ERR_PTR(-EINVAL);
+
+- list_for_each_entry_rcu(table, &net->nft.tables, list) {
++ nft_net = net_generic(net, nf_tables_net_id);
++ list_for_each_entry_rcu(table, &nft_net->tables, list) {
+ if (!nla_strcmp(nla, table->name) &&
+ table->family == family &&
+ nft_active_genmask(table, genmask))
+@@ -454,9 +496,11 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
+ const struct nlattr *nla,
+ u8 genmask)
+ {
++ struct nftables_pernet *nft_net;
+ struct nft_table *table;
+
+- list_for_each_entry(table, &net->nft.tables, list) {
++ nft_net = net_generic(net, nf_tables_net_id);
++ list_for_each_entry(table, &nft_net->tables, list) {
+ if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
+ nft_active_genmask(table, genmask))
+ return table;
+@@ -509,11 +553,13 @@ __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
+ static void nft_request_module(struct net *net, const char *fmt, ...)
+ {
+ char module_name[MODULE_NAME_LEN];
++ struct nftables_pernet *nft_net;
+ LIST_HEAD(commit_list);
+ va_list args;
+ int ret;
+
+- list_splice_init(&net->nft.commit_list, &commit_list);
++ nft_net = net_generic(net, nf_tables_net_id);
++ list_splice_init(&nft_net->commit_list, &commit_list);
+
+ va_start(args, fmt);
+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
+@@ -521,12 +567,12 @@ static void nft_request_module(struct net *net, const char *fmt, ...)
+ if (ret >= MODULE_NAME_LEN)
+ return;
+
+- mutex_unlock(&net->nft.commit_mutex);
++ mutex_unlock(&nft_net->commit_mutex);
+ request_module("%s", module_name);
+- mutex_lock(&net->nft.commit_mutex);
++ mutex_lock(&nft_net->commit_mutex);
+
+- WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
+- list_splice(&commit_list, &net->nft.commit_list);
++ WARN_ON_ONCE(!list_empty(&nft_net->commit_list));
++ list_splice(&commit_list, &nft_net->commit_list);
+ }
+ #endif
+
+@@ -561,6 +607,13 @@ nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
+ return ERR_PTR(-ENOENT);
+ }
+
++static __be16 nft_base_seq(const struct net *net)
++{
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
++
++ return htons(nft_net->base_seq & 0xffff);
++}
++
+ static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
+ [NFTA_TABLE_NAME] = { .type = NLA_STRING,
+ .len = NFT_TABLE_MAXNAMELEN - 1 },
+@@ -573,18 +626,13 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
+ int family, const struct nft_table *table)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
++ NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+-
+ if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
+ nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
+ nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
+@@ -631,15 +679,17 @@ static int nf_tables_dump_tables(struct sk_buff *skb,
+ struct netlink_callback *cb)
+ {
+ const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
++ struct nftables_pernet *nft_net;
+ const struct nft_table *table;
+ unsigned int idx = 0, s_idx = cb->args[0];
+ struct net *net = sock_net(skb->sk);
+ int family = nfmsg->nfgen_family;
+
+ rcu_read_lock();
+- cb->seq = net->nft.base_seq;
++ nft_net = net_generic(net, nf_tables_net_id);
++ cb->seq = nft_net->base_seq;
+
+- list_for_each_entry_rcu(table, &net->nft.tables, list) {
++ list_for_each_entry_rcu(table, &nft_net->tables, list) {
+ if (family != NFPROTO_UNSPEC && family != table->family)
+ continue;
+
+@@ -743,7 +793,7 @@ static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
+ if (cnt && i++ == cnt)
+ break;
+
+- nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
++ nf_tables_unregister_hook(net, table, chain);
+ }
+ }
+
+@@ -758,7 +808,7 @@ static int nf_tables_table_enable(struct net *net, struct nft_table *table)
+ if (!nft_is_base_chain(chain))
+ continue;
+
+- err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
++ err = nf_tables_register_hook(net, table, chain);
+ if (err < 0)
+ goto err;
+
+@@ -802,17 +852,18 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
+ nft_trans_table_enable(trans) = false;
+ } else if (!(flags & NFT_TABLE_F_DORMANT) &&
+ ctx->table->flags & NFT_TABLE_F_DORMANT) {
++ ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
+ ret = nf_tables_table_enable(ctx->net, ctx->table);
+- if (ret >= 0) {
+- ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
++ if (ret >= 0)
+ nft_trans_table_enable(trans) = true;
+- }
++ else
++ ctx->table->flags |= NFT_TABLE_F_DORMANT;
+ }
+ if (ret < 0)
+ goto err;
+
+ nft_trans_table_update(trans) = true;
+- list_add_tail(&trans->list, &ctx->net->nft.commit_list);
++ nft_trans_commit_list_add_tail(ctx->net, trans);
+ return 0;
+ err:
+ nft_trans_destroy(trans);
+@@ -847,6 +898,7 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
+ const struct nlattr * const nla[],
+ struct netlink_ext_ack *extack)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
+ u8 genmask = nft_genmask_next(net);
+ int family = nfmsg->nfgen_family;
+@@ -856,7 +908,7 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
+ struct nft_ctx ctx;
+ int err;
+
+- lockdep_assert_held(&net->nft.commit_mutex);
++ lockdep_assert_held(&nft_net->commit_mutex);
+ attr = nla[NFTA_TABLE_NAME];
+ table = nft_table_lookup(net, attr, family, genmask);
+ if (IS_ERR(table)) {
+@@ -906,7 +958,7 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
+ if (err < 0)
+ goto err_trans;
+
+- list_add_tail_rcu(&table->list, &net->nft.tables);
++ list_add_tail_rcu(&table->list, &nft_net->tables);
+ return 0;
+ err_trans:
+ rhltable_destroy(&table->chains_ht);
+@@ -986,11 +1038,12 @@ out:
+
+ static int nft_flush(struct nft_ctx *ctx, int family)
+ {
++ struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id);
+ struct nft_table *table, *nt;
+ const struct nlattr * const *nla = ctx->nla;
+ int err = 0;
+
+- list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
++ list_for_each_entry_safe(table, nt, &nft_net->tables, list) {
+ if (family != AF_UNSPEC && table->family != family)
+ continue;
+
+@@ -1104,7 +1157,9 @@ nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
+ static bool lockdep_commit_lock_is_held(struct net *net)
+ {
+ #ifdef CONFIG_PROVE_LOCKING
+- return lockdep_is_held(&net->nft.commit_mutex);
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
++
++ return lockdep_is_held(&nft_net->commit_mutex);
+ #else
+ return true;
+ #endif
+@@ -1207,18 +1262,13 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
+ const struct nft_chain *chain)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
++ NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+-
+ if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
+ goto nla_put_failure;
+ if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
+@@ -1306,11 +1356,13 @@ static int nf_tables_dump_chains(struct sk_buff *skb,
+ unsigned int idx = 0, s_idx = cb->args[0];
+ struct net *net = sock_net(skb->sk);
+ int family = nfmsg->nfgen_family;
++ struct nftables_pernet *nft_net;
+
+ rcu_read_lock();
+- cb->seq = net->nft.base_seq;
++ nft_net = net_generic(net, nf_tables_net_id);
++ cb->seq = nft_net->base_seq;
+
+- list_for_each_entry_rcu(table, &net->nft.tables, list) {
++ list_for_each_entry_rcu(table, &nft_net->tables, list) {
+ if (family != NFPROTO_UNSPEC && family != table->family)
+ continue;
+
+@@ -1503,12 +1555,13 @@ static int nft_chain_parse_hook(struct net *net,
+ struct nft_chain_hook *hook, u8 family,
+ bool autoload)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ struct nlattr *ha[NFTA_HOOK_MAX + 1];
+ const struct nft_chain_type *type;
+ struct net_device *dev;
+ int err;
+
+- lockdep_assert_held(&net->nft.commit_mutex);
++ lockdep_assert_held(&nft_net->commit_mutex);
+ lockdep_nfnl_nft_mutex_not_held();
+
+ err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
+@@ -1777,6 +1830,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy)
+
+ if (nla[NFTA_CHAIN_HANDLE] &&
+ nla[NFTA_CHAIN_NAME]) {
++ struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id);
+ struct nft_trans *tmp;
+ char *name;
+
+@@ -1786,7 +1840,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy)
+ goto err;
+
+ err = -EEXIST;
+- list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
++ list_for_each_entry(tmp, &nft_net->commit_list, list) {
+ if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
+ tmp->ctx.table == table &&
+ nft_trans_chain_update(tmp) &&
+@@ -1799,7 +1853,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy)
+
+ nft_trans_chain_name(trans) = name;
+ }
+- list_add_tail(&trans->list, &ctx->net->nft.commit_list);
++ nft_trans_commit_list_add_tail(ctx->net, trans);
+
+ return 0;
+ err:
+@@ -1813,6 +1867,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
+ const struct nlattr * const nla[],
+ struct netlink_ext_ack *extack)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
+ u8 genmask = nft_genmask_next(net);
+ int family = nfmsg->nfgen_family;
+@@ -1823,7 +1878,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
+ struct nft_ctx ctx;
+ u64 handle = 0;
+
+- lockdep_assert_held(&net->nft.commit_mutex);
++ lockdep_assert_held(&nft_net->commit_mutex);
+
+ table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
+ if (IS_ERR(table)) {
+@@ -2251,21 +2306,16 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
+ const struct nft_rule *rule)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ const struct nft_expr *expr, *next;
+ struct nlattr *list;
+ const struct nft_rule *prule;
+ u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+
+- nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0,
++ nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+-
+ if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
+ goto nla_put_failure;
+ if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
+@@ -2351,11 +2401,13 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
+ unsigned int idx = 0, s_idx = cb->args[0];
+ struct net *net = sock_net(skb->sk);
+ int family = nfmsg->nfgen_family;
++ struct nftables_pernet *nft_net;
+
+ rcu_read_lock();
+- cb->seq = net->nft.base_seq;
++ nft_net = net_generic(net, nf_tables_net_id);
++ cb->seq = nft_net->base_seq;
+
+- list_for_each_entry_rcu(table, &net->nft.tables, list) {
++ list_for_each_entry_rcu(table, &nft_net->tables, list) {
+ if (family != NFPROTO_UNSPEC && family != table->family)
+ continue;
+
+@@ -2508,7 +2560,6 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
+ {
+ struct nft_expr *expr, *next;
+
+- lockdep_assert_held(&ctx->net->nft.commit_mutex);
+ /*
+ * Careful: some expressions might not be initialized in case this
+ * is called on error from nf_tables_newrule().
+@@ -2574,6 +2625,8 @@ static int nft_table_validate(struct net *net, const struct nft_table *table)
+ err = nft_chain_validate(&ctx, chain);
+ if (err < 0)
+ return err;
++
++ cond_resched();
+ }
+
+ return 0;
+@@ -2586,6 +2639,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
+ const struct nlattr * const nla[],
+ struct netlink_ext_ack *extack)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
+ u8 genmask = nft_genmask_next(net);
+ struct nft_expr_info *info = NULL;
+@@ -2602,7 +2656,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
+ int err, rem;
+ u64 handle, pos_handle;
+
+- lockdep_assert_held(&net->nft.commit_mutex);
++ lockdep_assert_held(&nft_net->commit_mutex);
+
+ table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
+ if (IS_ERR(table)) {
+@@ -2750,12 +2804,13 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
+ kvfree(info);
+ chain->use++;
+
+- if (net->nft.validate_state == NFT_VALIDATE_DO)
++ if (nft_net->validate_state == NFT_VALIDATE_DO)
+ return nft_table_validate(net, table);
+
+ return 0;
+ err2:
+- nf_tables_rule_release(&ctx, rule);
++ nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE_ERROR);
++ nf_tables_rule_destroy(&ctx, rule);
+ err1:
+ for (i = 0; i < n; i++) {
+ if (info[i].ops) {
+@@ -2772,10 +2827,11 @@ static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
+ const struct nft_chain *chain,
+ const struct nlattr *nla)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ u32 id = ntohl(nla_get_be32(nla));
+ struct nft_trans *trans;
+
+- list_for_each_entry(trans, &net->nft.commit_list, list) {
++ list_for_each_entry(trans, &nft_net->commit_list, list) {
+ struct nft_rule *rule = nft_trans_rule(trans);
+
+ if (trans->msg_type == NFT_MSG_NEWRULE &&
+@@ -2894,12 +2950,13 @@ nft_select_set_ops(const struct nft_ctx *ctx,
+ const struct nft_set_desc *desc,
+ enum nft_set_policies policy)
+ {
++ struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id);
+ const struct nft_set_ops *ops, *bops;
+ struct nft_set_estimate est, best;
+ const struct nft_set_type *type;
+ u32 flags = 0;
+
+- lockdep_assert_held(&ctx->net->nft.commit_mutex);
++ lockdep_assert_held(&nft_net->commit_mutex);
+ lockdep_nfnl_nft_mutex_not_held();
+ #ifdef CONFIG_MODULES
+ if (list_empty(&nf_tables_set_types)) {
+@@ -3045,10 +3102,11 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net,
+ const struct nft_table *table,
+ const struct nlattr *nla, u8 genmask)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ struct nft_trans *trans;
+ u32 id = ntohl(nla_get_be32(nla));
+
+- list_for_each_entry(trans, &net->nft.commit_list, list) {
++ list_for_each_entry(trans, &nft_net->commit_list, list) {
+ if (trans->msg_type == NFT_MSG_NEWSET) {
+ struct nft_set *set = nft_trans_set(trans);
+
+@@ -3158,23 +3216,17 @@ static __be64 nf_jiffies64_to_msecs(u64 input)
+ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
+ const struct nft_set *set, u16 event, u16 flags)
+ {
+- struct nfgenmsg *nfmsg;
+ struct nlmsghdr *nlh;
+ struct nlattr *desc;
+ u32 portid = ctx->portid;
+ u32 seq = ctx->seq;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
+- flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family,
++ NFNETLINK_V0, nft_base_seq(ctx->net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = ctx->family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
+-
+ if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
+ goto nla_put_failure;
+ if (nla_put_string(skb, NFTA_SET_NAME, set->name))
+@@ -3270,14 +3322,16 @@ static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
+ struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
+ struct net *net = sock_net(skb->sk);
+ struct nft_ctx *ctx = cb->data, ctx_set;
++ struct nftables_pernet *nft_net;
+
+ if (cb->args[1])
+ return skb->len;
+
+ rcu_read_lock();
+- cb->seq = net->nft.base_seq;
++ nft_net = net_generic(net, nf_tables_net_id);
++ cb->seq = nft_net->base_seq;
+
+- list_for_each_entry_rcu(table, &net->nft.tables, list) {
++ list_for_each_entry_rcu(table, &nft_net->tables, list) {
+ if (ctx->family != NFPROTO_UNSPEC &&
+ ctx->family != table->family)
+ continue;
+@@ -3780,6 +3834,15 @@ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
+ enum nft_trans_phase phase)
+ {
+ switch (phase) {
++ case NFT_TRANS_PREPARE_ERROR:
++ nft_set_trans_unbind(ctx, set);
++ if (nft_set_is_anonymous(set))
++ nft_deactivate_next(ctx->net, set);
++ else
++ list_del_rcu(&binding->list);
++
++ set->use--;
++ break;
+ case NFT_TRANS_PREPARE:
+ if (nft_set_is_anonymous(set))
+ nft_deactivate_next(ctx->net, set);
+@@ -3984,18 +4047,19 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+ struct nft_set_dump_ctx *dump_ctx = cb->data;
+ struct net *net = sock_net(skb->sk);
++ struct nftables_pernet *nft_net;
+ struct nft_table *table;
+ struct nft_set *set;
+ struct nft_set_dump_args args;
+ bool set_found = false;
+- struct nfgenmsg *nfmsg;
+ struct nlmsghdr *nlh;
+ struct nlattr *nest;
+ u32 portid, seq;
+ int event;
+
+ rcu_read_lock();
+- list_for_each_entry_rcu(table, &net->nft.tables, list) {
++ nft_net = net_generic(net, nf_tables_net_id);
++ list_for_each_entry_rcu(table, &nft_net->tables, list) {
+ if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
+ dump_ctx->ctx.family != table->family)
+ continue;
+@@ -4021,16 +4085,11 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
+ portid = NETLINK_CB(cb->skb).portid;
+ seq = cb->nlh->nlmsg_seq;
+
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
+- NLM_F_MULTI);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI,
++ table->family, NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = table->family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+-
+ if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
+ goto nla_put_failure;
+ if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
+@@ -4087,22 +4146,16 @@ static int nf_tables_fill_setelem_info(struct sk_buff *skb,
+ const struct nft_set *set,
+ const struct nft_set_elem *elem)
+ {
+- struct nfgenmsg *nfmsg;
+ struct nlmsghdr *nlh;
+ struct nlattr *nest;
+ int err;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
+- flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family,
++ NFNETLINK_V0, nft_base_seq(ctx->net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = ctx->family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
+-
+ if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
+ goto nla_put_failure;
+ if (nla_put_string(skb, NFTA_SET_NAME, set->name))
+@@ -4596,7 +4649,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ }
+
+ nft_trans_elem(trans) = elem;
+- list_add_tail(&trans->list, &ctx->net->nft.commit_list);
++ nft_trans_commit_list_add_tail(ctx->net, trans);
+ return 0;
+
+ err6:
+@@ -4621,6 +4674,7 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
+ const struct nlattr * const nla[],
+ struct netlink_ext_ack *extack)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ u8 genmask = nft_genmask_next(net);
+ const struct nlattr *attr;
+ struct nft_set *set;
+@@ -4650,7 +4704,7 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
+ return err;
+ }
+
+- if (net->nft.validate_state == NFT_VALIDATE_DO)
++ if (nft_net->validate_state == NFT_VALIDATE_DO)
+ return nft_table_validate(net, ctx.table);
+
+ return 0;
+@@ -4763,7 +4817,7 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
+ nft_set_elem_deactivate(ctx->net, set, &elem);
+
+ nft_trans_elem(trans) = elem;
+- list_add_tail(&trans->list, &ctx->net->nft.commit_list);
++ nft_trans_commit_list_add_tail(ctx->net, trans);
+ return 0;
+
+ fail_ops:
+@@ -4797,7 +4851,7 @@ static int nft_flush_set(const struct nft_ctx *ctx,
+ nft_set_elem_deactivate(ctx->net, set, elem);
+ nft_trans_elem_set(trans) = set;
+ nft_trans_elem(trans) = *elem;
+- list_add_tail(&trans->list, &ctx->net->nft.commit_list);
++ nft_trans_commit_list_add_tail(ctx->net, trans);
+
+ return 0;
+ err1:
+@@ -5138,19 +5192,14 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
+ int family, const struct nft_table *table,
+ struct nft_object *obj, bool reset)
+ {
+- struct nfgenmsg *nfmsg;
+ struct nlmsghdr *nlh;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
++ NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+-
+ if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
+ nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
+ nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
+@@ -5181,6 +5230,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
+ struct nft_obj_filter *filter = cb->data;
+ struct net *net = sock_net(skb->sk);
+ int family = nfmsg->nfgen_family;
++ struct nftables_pernet *nft_net;
+ struct nft_object *obj;
+ bool reset = false;
+
+@@ -5188,9 +5238,10 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
+ reset = true;
+
+ rcu_read_lock();
+- cb->seq = net->nft.base_seq;
++ nft_net = net_generic(net, nf_tables_net_id);
++ cb->seq = nft_net->base_seq;
+
+- list_for_each_entry_rcu(table, &net->nft.tables, list) {
++ list_for_each_entry_rcu(table, &nft_net->tables, list) {
+ if (family != NFPROTO_UNSPEC && family != table->family)
+ continue;
+
+@@ -5798,20 +5849,15 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
+ struct nft_flowtable *flowtable)
+ {
+ struct nlattr *nest, *nest_devs;
+- struct nfgenmsg *nfmsg;
+ struct nlmsghdr *nlh;
+ int i;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
++ NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+-
+ if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
+ nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
+ nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
+@@ -5861,12 +5907,14 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb,
+ struct net *net = sock_net(skb->sk);
+ int family = nfmsg->nfgen_family;
+ struct nft_flowtable *flowtable;
++ struct nftables_pernet *nft_net;
+ const struct nft_table *table;
+
+ rcu_read_lock();
+- cb->seq = net->nft.base_seq;
++ nft_net = net_generic(net, nf_tables_net_id);
++ cb->seq = nft_net->base_seq;
+
+- list_for_each_entry_rcu(table, &net->nft.tables, list) {
++ list_for_each_entry_rcu(table, &nft_net->tables, list) {
+ if (family != NFPROTO_UNSPEC && family != table->family)
+ continue;
+
+@@ -6036,21 +6084,17 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
+ static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
+ u32 portid, u32 seq)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ char buf[TASK_COMM_LEN];
+ int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
+
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC,
++ NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
+-
+- if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
++ if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_net->base_seq)) ||
+ nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
+ nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
+ goto nla_put_failure;
+@@ -6083,6 +6127,7 @@ static int nf_tables_flowtable_event(struct notifier_block *this,
+ {
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+ struct nft_flowtable *flowtable;
++ struct nftables_pernet *nft_net;
+ struct nft_table *table;
+ struct net *net;
+
+@@ -6090,13 +6135,14 @@ static int nf_tables_flowtable_event(struct notifier_block *this,
+ return 0;
+
+ net = dev_net(dev);
+- mutex_lock(&net->nft.commit_mutex);
+- list_for_each_entry(table, &net->nft.tables, list) {
++ nft_net = net_generic(net, nf_tables_net_id);
++ mutex_lock(&nft_net->commit_mutex);
++ list_for_each_entry(table, &nft_net->tables, list) {
+ list_for_each_entry(flowtable, &table->flowtables, list) {
+ nft_flowtable_event(event, dev, flowtable);
+ }
+ }
+- mutex_unlock(&net->nft.commit_mutex);
++ mutex_unlock(&nft_net->commit_mutex);
+
+ return NOTIFY_DONE;
+ }
+@@ -6277,16 +6323,17 @@ static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
+
+ static int nf_tables_validate(struct net *net)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ struct nft_table *table;
+
+- switch (net->nft.validate_state) {
++ switch (nft_net->validate_state) {
+ case NFT_VALIDATE_SKIP:
+ break;
+ case NFT_VALIDATE_NEED:
+ nft_validate_state_update(net, NFT_VALIDATE_DO);
+ /* fall through */
+ case NFT_VALIDATE_DO:
+- list_for_each_entry(table, &net->nft.tables, list) {
++ list_for_each_entry(table, &nft_net->tables, list) {
+ if (nft_table_validate(net, table) < 0)
+ return -EAGAIN;
+ }
+@@ -6363,15 +6410,16 @@ static void nft_commit_release(struct nft_trans *trans)
+
+ static void nf_tables_commit_release(struct net *net)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ struct nft_trans *trans, *next;
+
+- if (list_empty(&net->nft.commit_list))
++ if (list_empty(&nft_net->commit_list))
+ return;
+
+ synchronize_rcu();
+
+- list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
+- list_del(&trans->list);
++ list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
++ nft_trans_list_del(trans);
+ nft_commit_release(trans);
+ }
+ }
+@@ -6409,9 +6457,10 @@ static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *cha
+
+ static void nf_tables_commit_chain_prepare_cancel(struct net *net)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ struct nft_trans *trans, *next;
+
+- list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
++ list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
+ struct nft_chain *chain = trans->ctx.chain;
+
+ if (trans->msg_type == NFT_MSG_NEWRULE ||
+@@ -6503,17 +6552,30 @@ static void nft_chain_del(struct nft_chain *chain)
+
+ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ struct nft_trans *trans, *next;
+ struct nft_trans_elem *te;
+ struct nft_chain *chain;
+ struct nft_table *table;
+
++ list_for_each_entry(trans, &nft_net->binding_list, binding_list) {
++ switch (trans->msg_type) {
++ case NFT_MSG_NEWSET:
++ if (nft_set_is_anonymous(nft_trans_set(trans)) &&
++ !nft_trans_set_bound(trans)) {
++ pr_warn_once("nftables ruleset with unbound set\n");
++ return -EINVAL;
++ }
++ break;
++ }
++ }
++
+ /* 0. Validate ruleset, otherwise roll back for error reporting. */
+ if (nf_tables_validate(net) < 0)
+ return -EAGAIN;
+
+ /* 1. Allocate space for next generation rules_gen_X[] */
+- list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
++ list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
+ int ret;
+
+ if (trans->msg_type == NFT_MSG_NEWRULE ||
+@@ -6529,7 +6591,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ }
+
+ /* step 2. Make rules_gen_X visible to packet path */
+- list_for_each_entry(table, &net->nft.tables, list) {
++ list_for_each_entry(table, &nft_net->tables, list) {
+ list_for_each_entry(chain, &table->chains, list)
+ nf_tables_commit_chain(net, chain);
+ }
+@@ -6538,12 +6600,13 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ * Bump generation counter, invalidate any dump in progress.
+ * Cannot fail after this point.
+ */
+- while (++net->nft.base_seq == 0);
++ while (++nft_net->base_seq == 0)
++ ;
+
+ /* step 3. Start new generation, rules_gen_X now in use. */
+ net->nft.gencursor = nft_gencursor_next(net);
+
+- list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
++ list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
+ switch (trans->msg_type) {
+ case NFT_MSG_NEWTABLE:
+ if (nft_trans_table_update(trans)) {
+@@ -6664,7 +6727,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+
+ nf_tables_commit_release(net);
+ nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
+- mutex_unlock(&net->nft.commit_mutex);
++ mutex_unlock(&nft_net->commit_mutex);
+
+ return 0;
+ }
+@@ -6700,10 +6763,11 @@ static void nf_tables_abort_release(struct nft_trans *trans)
+
+ static int __nf_tables_abort(struct net *net)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ struct nft_trans *trans, *next;
+ struct nft_trans_elem *te;
+
+- list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
++ list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list,
+ list) {
+ switch (trans->msg_type) {
+ case NFT_MSG_NEWTABLE:
+@@ -6810,8 +6874,8 @@ static int __nf_tables_abort(struct net *net)
+ synchronize_rcu();
+
+ list_for_each_entry_safe_reverse(trans, next,
+- &net->nft.commit_list, list) {
+- list_del(&trans->list);
++ &nft_net->commit_list, list) {
++ nft_trans_list_del(trans);
+ nf_tables_abort_release(trans);
+ }
+
+@@ -6820,22 +6884,24 @@ static int __nf_tables_abort(struct net *net)
+
+ static int nf_tables_abort(struct net *net, struct sk_buff *skb)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ int ret = __nf_tables_abort(net);
+
+- mutex_unlock(&net->nft.commit_mutex);
++ mutex_unlock(&nft_net->commit_mutex);
+
+ return ret;
+ }
+
+ static bool nf_tables_valid_genid(struct net *net, u32 genid)
+ {
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+ bool genid_ok;
+
+- mutex_lock(&net->nft.commit_mutex);
++ mutex_lock(&nft_net->commit_mutex);
+
+- genid_ok = genid == 0 || net->nft.base_seq == genid;
++ genid_ok = genid == 0 || nft_net->base_seq == genid;
+ if (!genid_ok)
+- mutex_unlock(&net->nft.commit_mutex);
++ mutex_unlock(&nft_net->commit_mutex);
+
+ /* else, commit mutex has to be released by commit or abort function */
+ return genid_ok;
+@@ -7182,6 +7248,9 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
+
+ if (!tb[NFTA_VERDICT_CODE])
+ return -EINVAL;
++
++ /* zero padding hole for memcmp */
++ memset(data, 0, sizeof(*data));
+ data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
+
+ switch (data->verdict.code) {
+@@ -7389,10 +7458,9 @@ int __nft_release_basechain(struct nft_ctx *ctx)
+ }
+ EXPORT_SYMBOL_GPL(__nft_release_basechain);
+
+-static void __nft_release_tables(struct net *net)
++static void __nft_release_table(struct net *net, struct nft_table *table)
+ {
+ struct nft_flowtable *flowtable, *nf;
+- struct nft_table *table, *nt;
+ struct nft_chain *chain, *nc;
+ struct nft_object *obj, *ne;
+ struct nft_rule *rule, *nr;
+@@ -7402,71 +7470,85 @@ static void __nft_release_tables(struct net *net)
+ .family = NFPROTO_NETDEV,
+ };
+
+- list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
+- ctx.family = table->family;
++ ctx.family = table->family;
+
+- list_for_each_entry(chain, &table->chains, list)
+- nf_tables_unregister_hook(net, table, chain);
+- /* No packets are walking on these chains anymore. */
+- ctx.table = table;
+- list_for_each_entry(chain, &table->chains, list) {
+- ctx.chain = chain;
+- list_for_each_entry_safe(rule, nr, &chain->rules, list) {
+- list_del(&rule->list);
+- chain->use--;
+- nf_tables_rule_release(&ctx, rule);
+- }
+- }
+- list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
+- list_del(&flowtable->list);
+- table->use--;
+- nf_tables_flowtable_destroy(flowtable);
+- }
+- list_for_each_entry_safe(set, ns, &table->sets, list) {
+- list_del(&set->list);
+- table->use--;
+- nft_set_destroy(set);
+- }
+- list_for_each_entry_safe(obj, ne, &table->objects, list) {
+- list_del(&obj->list);
+- table->use--;
+- nft_obj_destroy(&ctx, obj);
+- }
+- list_for_each_entry_safe(chain, nc, &table->chains, list) {
+- ctx.chain = chain;
+- nft_chain_del(chain);
+- table->use--;
+- nf_tables_chain_destroy(&ctx);
++ list_for_each_entry(chain, &table->chains, list)
++ nf_tables_unregister_hook(net, table, chain);
++ /* No packets are walking on these chains anymore. */
++ ctx.table = table;
++ list_for_each_entry(chain, &table->chains, list) {
++ ctx.chain = chain;
++ list_for_each_entry_safe(rule, nr, &chain->rules, list) {
++ list_del(&rule->list);
++ chain->use--;
++ nf_tables_rule_release(&ctx, rule);
+ }
+- list_del(&table->list);
+- nf_tables_table_destroy(&ctx);
+ }
++ list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
++ list_del(&flowtable->list);
++ table->use--;
++ nf_tables_flowtable_destroy(flowtable);
++ }
++ list_for_each_entry_safe(set, ns, &table->sets, list) {
++ list_del(&set->list);
++ table->use--;
++ nft_set_destroy(set);
++ }
++ list_for_each_entry_safe(obj, ne, &table->objects, list) {
++ list_del(&obj->list);
++ table->use--;
++ nft_obj_destroy(&ctx, obj);
++ }
++ list_for_each_entry_safe(chain, nc, &table->chains, list) {
++ ctx.chain = chain;
++ nft_chain_del(chain);
++ table->use--;
++ nf_tables_chain_destroy(&ctx);
++ }
++ list_del(&table->list);
++ nf_tables_table_destroy(&ctx);
++}
++
++static void __nft_release_tables(struct net *net)
++{
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
++ struct nft_table *table, *nt;
++
++ list_for_each_entry_safe(table, nt, &nft_net->tables, list)
++ __nft_release_table(net, table);
+ }
+
+ static int __net_init nf_tables_init_net(struct net *net)
+ {
+- INIT_LIST_HEAD(&net->nft.tables);
+- INIT_LIST_HEAD(&net->nft.commit_list);
+- mutex_init(&net->nft.commit_mutex);
+- net->nft.base_seq = 1;
+- net->nft.validate_state = NFT_VALIDATE_SKIP;
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
++
++ INIT_LIST_HEAD(&nft_net->tables);
++ INIT_LIST_HEAD(&nft_net->commit_list);
++ INIT_LIST_HEAD(&nft_net->binding_list);
++ mutex_init(&nft_net->commit_mutex);
++ nft_net->base_seq = 1;
++ nft_net->validate_state = NFT_VALIDATE_SKIP;
+
+ return 0;
+ }
+
+ static void __net_exit nf_tables_exit_net(struct net *net)
+ {
+- mutex_lock(&net->nft.commit_mutex);
+- if (!list_empty(&net->nft.commit_list))
++ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
++
++ mutex_lock(&nft_net->commit_mutex);
++ if (!list_empty(&nft_net->commit_list))
+ __nf_tables_abort(net);
+ __nft_release_tables(net);
+- mutex_unlock(&net->nft.commit_mutex);
+- WARN_ON_ONCE(!list_empty(&net->nft.tables));
++ mutex_unlock(&nft_net->commit_mutex);
++ WARN_ON_ONCE(!list_empty(&nft_net->tables));
+ }
+
+ static struct pernet_operations nf_tables_net_ops = {
+ .init = nf_tables_init_net,
+ .exit = nf_tables_exit_net,
++ .id = &nf_tables_net_id,
++ .size = sizeof(struct nftables_pernet),
+ };
+
+ static int __init nf_tables_module_init(void)
+diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c
+index e1dc527a493b8..7a19c517b1918 100644
+--- a/net/netfilter/nf_tables_trace.c
++++ b/net/netfilter/nf_tables_trace.c
+@@ -186,7 +186,6 @@ static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info)
+ void nft_trace_notify(struct nft_traceinfo *info)
+ {
+ const struct nft_pktinfo *pkt = info->pkt;
+- struct nfgenmsg *nfmsg;
+ struct nlmsghdr *nlh;
+ struct sk_buff *skb;
+ unsigned int size;
+@@ -222,15 +221,11 @@ void nft_trace_notify(struct nft_traceinfo *info)
+ return;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_TRACE);
+- nlh = nlmsg_put(skb, 0, 0, event, sizeof(struct nfgenmsg), 0);
++ nlh = nfnl_msg_put(skb, 0, 0, event, 0, info->basechain->type->family,
++ NFNETLINK_V0, 0);
+ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = info->basechain->type->family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_be32(skb, NFTA_TRACE_NFPROTO, htonl(nft_pf(pkt))))
+ goto nla_put_failure;
+
+diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
+index 8fa8bf7c48e64..7c5f428dc5c91 100644
+--- a/net/netfilter/nfnetlink_acct.c
++++ b/net/netfilter/nfnetlink_acct.c
+@@ -135,21 +135,16 @@ nfnl_acct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ int event, struct nf_acct *acct)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+ u64 pkts, bytes;
+ u32 old_flags;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_ACCT, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_string(skb, NFACCT_NAME, acct->name))
+ goto nla_put_failure;
+
+diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
+index c8b0f1122c44d..720177721e3c0 100644
+--- a/net/netfilter/nfnetlink_cthelper.c
++++ b/net/netfilter/nfnetlink_cthelper.c
+@@ -532,20 +532,15 @@ nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ int event, struct nf_conntrack_helper *helper)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+ int status;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTHELPER, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_string(skb, NFCTH_NAME, helper->name))
+ goto nla_put_failure;
+
+diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
+index 70a7382b9787c..ae01e9ad55464 100644
+--- a/net/netfilter/nfnetlink_cttimeout.c
++++ b/net/netfilter/nfnetlink_cttimeout.c
+@@ -164,20 +164,15 @@ ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ int event, struct ctnl_timeout *timeout)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+ const struct nf_conntrack_l4proto *l4proto = timeout->timeout.l4proto;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) ||
+ nla_put_be16(skb, CTA_TIMEOUT_L3PROTO,
+ htons(timeout->timeout.l3num)) ||
+@@ -396,19 +391,14 @@ cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
+ const unsigned int *timeouts)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l4proto->l3proto)) ||
+ nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto))
+ goto nla_put_failure;
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index 17ca9a681d47b..da05c4d82b944 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -404,20 +404,15 @@ __build_packet_message(struct nfnl_log_net *log,
+ {
+ struct nfulnl_msg_packet_hdr pmsg;
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ sk_buff_data_t old_tail = inst->skb->tail;
+ struct sock *sk;
+ const unsigned char *hwhdrp;
+
+- nlh = nlmsg_put(inst->skb, 0, 0,
+- nfnl_msg_type(NFNL_SUBSYS_ULOG, NFULNL_MSG_PACKET),
+- sizeof(struct nfgenmsg), 0);
++ nlh = nfnl_msg_put(inst->skb, 0, 0,
++ nfnl_msg_type(NFNL_SUBSYS_ULOG, NFULNL_MSG_PACKET),
++ 0, pf, NFNETLINK_V0, htons(inst->group_num));
+ if (!nlh)
+ return -1;
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = pf;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(inst->group_num);
+
+ memset(&pmsg, 0, sizeof(pmsg));
+ pmsg.hw_protocol = skb->protocol;
+@@ -637,7 +632,7 @@ nfulnl_log_packet(struct net *net,
+ struct nfnl_log_net *log = nfnl_log_pernet(net);
+ const struct nfnl_ct_hook *nfnl_ct = NULL;
+ struct nf_conn *ct = NULL;
+- enum ip_conntrack_info uninitialized_var(ctinfo);
++ enum ip_conntrack_info ctinfo;
+
+ if (li_user && li_user->type == NF_LOG_TYPE_ULOG)
+ li = li_user;
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index cd496b074a71b..1aacc31a6bf92 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -387,12 +387,11 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
+ struct nlattr *nla;
+ struct nfqnl_msg_packet_hdr *pmsg;
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ struct sk_buff *entskb = entry->skb;
+ struct net_device *indev;
+ struct net_device *outdev;
+ struct nf_conn *ct = NULL;
+- enum ip_conntrack_info uninitialized_var(ctinfo);
++ enum ip_conntrack_info ctinfo;
+ struct nfnl_ct_hook *nfnl_ct;
+ bool csum_verify;
+ char *secdata = NULL;
+@@ -473,18 +472,15 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
+ goto nlmsg_failure;
+ }
+
+- nlh = nlmsg_put(skb, 0, 0,
+- nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET),
+- sizeof(struct nfgenmsg), 0);
++ nlh = nfnl_msg_put(skb, 0, 0,
++ nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET),
++ 0, entry->state.pf, NFNETLINK_V0,
++ htons(queue->queue_num));
+ if (!nlh) {
+ skb_tx_error(entskb);
+ kfree_skb(skb);
+ goto nlmsg_failure;
+ }
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = entry->state.pf;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(queue->queue_num);
+
+ nla = __nla_reserve(skb, NFQA_PACKET_HDR, sizeof(*pmsg));
+ pmsg = nla_data(nla);
+@@ -1191,7 +1187,7 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
+ struct nfqnl_instance *queue;
+ unsigned int verdict;
+ struct nf_queue_entry *entry;
+- enum ip_conntrack_info uninitialized_var(ctinfo);
++ enum ip_conntrack_info ctinfo;
+ struct nfnl_ct_hook *nfnl_ct;
+ struct nf_conn *ct = NULL;
+ struct nfnl_queue_net *q = nfnl_queue_pernet(net);
+diff --git a/net/netfilter/nft_byteorder.c b/net/netfilter/nft_byteorder.c
+index 5e1fbdd7b2846..dba16126c7eec 100644
+--- a/net/netfilter/nft_byteorder.c
++++ b/net/netfilter/nft_byteorder.c
+@@ -33,11 +33,11 @@ static void nft_byteorder_eval(const struct nft_expr *expr,
+ const struct nft_byteorder *priv = nft_expr_priv(expr);
+ u32 *src = ®s->data[priv->sreg];
+ u32 *dst = ®s->data[priv->dreg];
+- union { u32 u32; u16 u16; } *s, *d;
++ u16 *s16, *d16;
+ unsigned int i;
+
+- s = (void *)src;
+- d = (void *)dst;
++ s16 = (void *)src;
++ d16 = (void *)dst;
+
+ switch (priv->size) {
+ case 8: {
+@@ -63,11 +63,11 @@ static void nft_byteorder_eval(const struct nft_expr *expr,
+ switch (priv->op) {
+ case NFT_BYTEORDER_NTOH:
+ for (i = 0; i < priv->len / 4; i++)
+- d[i].u32 = ntohl((__force __be32)s[i].u32);
++ dst[i] = ntohl((__force __be32)src[i]);
+ break;
+ case NFT_BYTEORDER_HTON:
+ for (i = 0; i < priv->len / 4; i++)
+- d[i].u32 = (__force __u32)htonl(s[i].u32);
++ dst[i] = (__force __u32)htonl(src[i]);
+ break;
+ }
+ break;
+@@ -75,11 +75,11 @@ static void nft_byteorder_eval(const struct nft_expr *expr,
+ switch (priv->op) {
+ case NFT_BYTEORDER_NTOH:
+ for (i = 0; i < priv->len / 2; i++)
+- d[i].u16 = ntohs((__force __be16)s[i].u16);
++ d16[i] = ntohs((__force __be16)s16[i]);
+ break;
+ case NFT_BYTEORDER_HTON:
+ for (i = 0; i < priv->len / 2; i++)
+- d[i].u16 = (__force __u16)htons(s[i].u16);
++ d16[i] = (__force __u16)htons(s16[i]);
+ break;
+ }
+ break;
+diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
+index 3fd540b2c6baf..a308d45ee95e1 100644
+--- a/net/netfilter/nft_chain_filter.c
++++ b/net/netfilter/nft_chain_filter.c
+@@ -2,6 +2,7 @@
+ #include <linux/kernel.h>
+ #include <linux/netdevice.h>
+ #include <net/net_namespace.h>
++#include <net/netns/generic.h>
+ #include <net/netfilter/nf_tables.h>
+ #include <linux/netfilter_ipv4.h>
+ #include <linux/netfilter_ipv6.h>
+@@ -10,6 +11,8 @@
+ #include <net/netfilter/nf_tables_ipv4.h>
+ #include <net/netfilter/nf_tables_ipv6.h>
+
++extern unsigned int nf_tables_net_id;
++
+ #ifdef CONFIG_NF_TABLES_IPV4
+ static unsigned int nft_do_chain_ipv4(void *priv,
+ struct sk_buff *skb,
+@@ -315,6 +318,7 @@ static int nf_tables_netdev_event(struct notifier_block *this,
+ unsigned long event, void *ptr)
+ {
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++ struct nftables_pernet *nft_net;
+ struct nft_table *table;
+ struct nft_chain *chain, *nr;
+ struct nft_ctx ctx = {
+@@ -325,8 +329,9 @@ static int nf_tables_netdev_event(struct notifier_block *this,
+ event != NETDEV_CHANGENAME)
+ return NOTIFY_DONE;
+
+- mutex_lock(&ctx.net->nft.commit_mutex);
+- list_for_each_entry(table, &ctx.net->nft.tables, list) {
++ nft_net = net_generic(ctx.net, nf_tables_net_id);
++ mutex_lock(&nft_net->commit_mutex);
++ list_for_each_entry(table, &nft_net->tables, list) {
+ if (table->family != NFPROTO_NETDEV)
+ continue;
+
+@@ -340,7 +345,7 @@ static int nf_tables_netdev_event(struct notifier_block *this,
+ nft_netdev_event(event, dev, &ctx);
+ }
+ }
+- mutex_unlock(&ctx.net->nft.commit_mutex);
++ mutex_unlock(&nft_net->commit_mutex);
+
+ return NOTIFY_DONE;
+ }
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 469f9da5073bf..2846d64659f2f 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -575,19 +575,14 @@ nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ int rev, int target)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_string(skb, NFTA_COMPAT_NAME, name) ||
+ nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) ||
+ nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target)))
+diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
+index c5d42e704f043..651c9784904cb 100644
+--- a/net/netfilter/nft_dynset.c
++++ b/net/netfilter/nft_dynset.c
+@@ -15,6 +15,9 @@
+ #include <linux/netfilter/nf_tables.h>
+ #include <net/netfilter/nf_tables.h>
+ #include <net/netfilter/nf_tables_core.h>
++#include <net/netns/generic.h>
++
++extern unsigned int nf_tables_net_id;
+
+ struct nft_dynset {
+ struct nft_set *set;
+@@ -112,13 +115,14 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nlattr * const tb[])
+ {
++ struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id);
+ struct nft_dynset *priv = nft_expr_priv(expr);
+ u8 genmask = nft_genmask_next(ctx->net);
+ struct nft_set *set;
+ u64 timeout;
+ int err;
+
+- lockdep_assert_held(&ctx->net->nft.commit_mutex);
++ lockdep_assert_held(&nft_net->commit_mutex);
+
+ if (tb[NFTA_DYNSET_SET_NAME] == NULL ||
+ tb[NFTA_DYNSET_OP] == NULL ||
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 57fd9b7cfc75f..35ecaa93f213a 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1603,6 +1603,7 @@ out:
+ int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
+ {
+ struct netlink_set_err_data info;
++ unsigned long flags;
+ struct sock *sk;
+ int ret = 0;
+
+@@ -1612,12 +1613,12 @@ int netlink_set_err(struct sock *ssk, u32 portid, u32 group, int code)
+ /* sk->sk_err wants a positive error value */
+ info.code = -code;
+
+- read_lock(&nl_table_lock);
++ read_lock_irqsave(&nl_table_lock, flags);
+
+ sk_for_each_bound(sk, &nl_table[ssk->sk_protocol].mc_list)
+ ret += do_one_set_err(sk, &info);
+
+- read_unlock(&nl_table_lock);
++ read_unlock_irqrestore(&nl_table_lock, flags);
+ return ret;
+ }
+ EXPORT_SYMBOL(netlink_set_err);
+diff --git a/net/netlink/diag.c b/net/netlink/diag.c
+index 7dda33b9b7849..85ee4891c2c7f 100644
+--- a/net/netlink/diag.c
++++ b/net/netlink/diag.c
+@@ -93,6 +93,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
+ struct net *net = sock_net(skb->sk);
+ struct netlink_diag_req *req;
+ struct netlink_sock *nlsk;
++ unsigned long flags;
+ struct sock *sk;
+ int num = 2;
+ int ret = 0;
+@@ -151,7 +152,7 @@ static int __netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
+ num++;
+
+ mc_list:
+- read_lock(&nl_table_lock);
++ read_lock_irqsave(&nl_table_lock, flags);
+ sk_for_each_bound(sk, &tbl->mc_list) {
+ if (sk_hashed(sk))
+ continue;
+@@ -166,13 +167,13 @@ mc_list:
+ NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq,
+ NLM_F_MULTI,
+- sock_i_ino(sk)) < 0) {
++ __sock_i_ino(sk)) < 0) {
+ ret = 1;
+ break;
+ }
+ num++;
+ }
+- read_unlock(&nl_table_lock);
++ read_unlock_irqrestore(&nl_table_lock, flags);
+
+ done:
+ cb->args[0] = num;
+diff --git a/net/nfc/core.c b/net/nfc/core.c
+index a84f824da051d..dd12ee46ac730 100644
+--- a/net/nfc/core.c
++++ b/net/nfc/core.c
+@@ -646,7 +646,7 @@ error:
+ return rc;
+ }
+
+-int nfc_set_remote_general_bytes(struct nfc_dev *dev, u8 *gb, u8 gb_len)
++int nfc_set_remote_general_bytes(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
+ {
+ pr_debug("dev_name=%s gb_len=%d\n", dev_name(&dev->dev), gb_len);
+
+@@ -675,7 +675,7 @@ int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb)
+ EXPORT_SYMBOL(nfc_tm_data_received);
+
+ int nfc_tm_activated(struct nfc_dev *dev, u32 protocol, u8 comm_mode,
+- u8 *gb, size_t gb_len)
++ const u8 *gb, size_t gb_len)
+ {
+ int rc;
+
+diff --git a/net/nfc/hci/llc_shdlc.c b/net/nfc/hci/llc_shdlc.c
+index fe988936ad923..e6863c71f566d 100644
+--- a/net/nfc/hci/llc_shdlc.c
++++ b/net/nfc/hci/llc_shdlc.c
+@@ -134,7 +134,7 @@ static bool llc_shdlc_x_lteq_y_lt_z(int x, int y, int z)
+ return ((y >= x) || (y < z)) ? true : false;
+ }
+
+-static struct sk_buff *llc_shdlc_alloc_skb(struct llc_shdlc *shdlc,
++static struct sk_buff *llc_shdlc_alloc_skb(const struct llc_shdlc *shdlc,
+ int payload_len)
+ {
+ struct sk_buff *skb;
+@@ -148,7 +148,7 @@ static struct sk_buff *llc_shdlc_alloc_skb(struct llc_shdlc *shdlc,
+ }
+
+ /* immediately sends an S frame. */
+-static int llc_shdlc_send_s_frame(struct llc_shdlc *shdlc,
++static int llc_shdlc_send_s_frame(const struct llc_shdlc *shdlc,
+ enum sframe_type sframe_type, int nr)
+ {
+ int r;
+@@ -170,7 +170,7 @@ static int llc_shdlc_send_s_frame(struct llc_shdlc *shdlc,
+ }
+
+ /* immediately sends an U frame. skb may contain optional payload */
+-static int llc_shdlc_send_u_frame(struct llc_shdlc *shdlc,
++static int llc_shdlc_send_u_frame(const struct llc_shdlc *shdlc,
+ struct sk_buff *skb,
+ enum uframe_modifier uframe_modifier)
+ {
+@@ -372,7 +372,7 @@ static void llc_shdlc_connect_complete(struct llc_shdlc *shdlc, int r)
+ wake_up(shdlc->connect_wq);
+ }
+
+-static int llc_shdlc_connect_initiate(struct llc_shdlc *shdlc)
++static int llc_shdlc_connect_initiate(const struct llc_shdlc *shdlc)
+ {
+ struct sk_buff *skb;
+
+@@ -388,7 +388,7 @@ static int llc_shdlc_connect_initiate(struct llc_shdlc *shdlc)
+ return llc_shdlc_send_u_frame(shdlc, skb, U_FRAME_RSET);
+ }
+
+-static int llc_shdlc_connect_send_ua(struct llc_shdlc *shdlc)
++static int llc_shdlc_connect_send_ua(const struct llc_shdlc *shdlc)
+ {
+ struct sk_buff *skb;
+
+diff --git a/net/nfc/llcp.h b/net/nfc/llcp.h
+index 1f68724d44d3b..a070a57fc1516 100644
+--- a/net/nfc/llcp.h
++++ b/net/nfc/llcp.h
+@@ -233,15 +233,15 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *sk, struct socket *newsock);
+
+ /* TLV API */
+ int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local,
+- u8 *tlv_array, u16 tlv_array_len);
++ const u8 *tlv_array, u16 tlv_array_len);
+ int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
+- u8 *tlv_array, u16 tlv_array_len);
++ const u8 *tlv_array, u16 tlv_array_len);
+
+ /* Commands API */
+ void nfc_llcp_recv(void *data, struct sk_buff *skb, int err);
+-u8 *nfc_llcp_build_tlv(u8 type, u8 *value, u8 value_length, u8 *tlv_length);
++u8 *nfc_llcp_build_tlv(u8 type, const u8 *value, u8 value_length, u8 *tlv_length);
+ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdres_tlv(u8 tid, u8 sap);
+-struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
++struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, const char *uri,
+ size_t uri_len);
+ void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp);
+ void nfc_llcp_free_sdp_tlv_list(struct hlist_head *sdp_head);
+diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
+index d1fc019e932e0..737c7aa384f44 100644
+--- a/net/nfc/llcp_commands.c
++++ b/net/nfc/llcp_commands.c
+@@ -27,7 +27,7 @@
+ #include "nfc.h"
+ #include "llcp.h"
+
+-static u8 llcp_tlv_length[LLCP_TLV_MAX] = {
++static const u8 llcp_tlv_length[LLCP_TLV_MAX] = {
+ 0,
+ 1, /* VERSION */
+ 2, /* MIUX */
+@@ -41,7 +41,7 @@ static u8 llcp_tlv_length[LLCP_TLV_MAX] = {
+
+ };
+
+-static u8 llcp_tlv8(u8 *tlv, u8 type)
++static u8 llcp_tlv8(const u8 *tlv, u8 type)
+ {
+ if (tlv[0] != type || tlv[1] != llcp_tlv_length[tlv[0]])
+ return 0;
+@@ -49,7 +49,7 @@ static u8 llcp_tlv8(u8 *tlv, u8 type)
+ return tlv[2];
+ }
+
+-static u16 llcp_tlv16(u8 *tlv, u8 type)
++static u16 llcp_tlv16(const u8 *tlv, u8 type)
+ {
+ if (tlv[0] != type || tlv[1] != llcp_tlv_length[tlv[0]])
+ return 0;
+@@ -58,37 +58,37 @@ static u16 llcp_tlv16(u8 *tlv, u8 type)
+ }
+
+
+-static u8 llcp_tlv_version(u8 *tlv)
++static u8 llcp_tlv_version(const u8 *tlv)
+ {
+ return llcp_tlv8(tlv, LLCP_TLV_VERSION);
+ }
+
+-static u16 llcp_tlv_miux(u8 *tlv)
++static u16 llcp_tlv_miux(const u8 *tlv)
+ {
+ return llcp_tlv16(tlv, LLCP_TLV_MIUX) & 0x7ff;
+ }
+
+-static u16 llcp_tlv_wks(u8 *tlv)
++static u16 llcp_tlv_wks(const u8 *tlv)
+ {
+ return llcp_tlv16(tlv, LLCP_TLV_WKS);
+ }
+
+-static u16 llcp_tlv_lto(u8 *tlv)
++static u16 llcp_tlv_lto(const u8 *tlv)
+ {
+ return llcp_tlv8(tlv, LLCP_TLV_LTO);
+ }
+
+-static u8 llcp_tlv_opt(u8 *tlv)
++static u8 llcp_tlv_opt(const u8 *tlv)
+ {
+ return llcp_tlv8(tlv, LLCP_TLV_OPT);
+ }
+
+-static u8 llcp_tlv_rw(u8 *tlv)
++static u8 llcp_tlv_rw(const u8 *tlv)
+ {
+ return llcp_tlv8(tlv, LLCP_TLV_RW) & 0xf;
+ }
+
+-u8 *nfc_llcp_build_tlv(u8 type, u8 *value, u8 value_length, u8 *tlv_length)
++u8 *nfc_llcp_build_tlv(u8 type, const u8 *value, u8 value_length, u8 *tlv_length)
+ {
+ u8 *tlv, length;
+
+@@ -142,7 +142,7 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdres_tlv(u8 tid, u8 sap)
+ return sdres;
+ }
+
+-struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
++struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, const char *uri,
+ size_t uri_len)
+ {
+ struct nfc_llcp_sdp_tlv *sdreq;
+@@ -202,9 +202,10 @@ void nfc_llcp_free_sdp_tlv_list(struct hlist_head *head)
+ }
+
+ int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local,
+- u8 *tlv_array, u16 tlv_array_len)
++ const u8 *tlv_array, u16 tlv_array_len)
+ {
+- u8 *tlv = tlv_array, type, length, offset = 0;
++ const u8 *tlv = tlv_array;
++ u8 type, length, offset = 0;
+
+ pr_debug("TLV array length %d\n", tlv_array_len);
+
+@@ -251,9 +252,10 @@ int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local,
+ }
+
+ int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
+- u8 *tlv_array, u16 tlv_array_len)
++ const u8 *tlv_array, u16 tlv_array_len)
+ {
+- u8 *tlv = tlv_array, type, length, offset = 0;
++ const u8 *tlv = tlv_array;
++ u8 type, length, offset = 0;
+
+ pr_debug("TLV array length %d\n", tlv_array_len);
+
+@@ -307,7 +309,7 @@ static struct sk_buff *llcp_add_header(struct sk_buff *pdu,
+ return pdu;
+ }
+
+-static struct sk_buff *llcp_add_tlv(struct sk_buff *pdu, u8 *tlv,
++static struct sk_buff *llcp_add_tlv(struct sk_buff *pdu, const u8 *tlv,
+ u8 tlv_length)
+ {
+ /* XXX Add an skb length check */
+@@ -401,9 +403,11 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
+ {
+ struct nfc_llcp_local *local;
+ struct sk_buff *skb;
+- u8 *service_name_tlv = NULL, service_name_tlv_length;
+- u8 *miux_tlv = NULL, miux_tlv_length;
+- u8 *rw_tlv = NULL, rw_tlv_length, rw;
++ const u8 *service_name_tlv = NULL;
++ const u8 *miux_tlv = NULL;
++ const u8 *rw_tlv = NULL;
++ u8 service_name_tlv_length = 0;
++ u8 miux_tlv_length, rw_tlv_length, rw;
+ int err;
+ u16 size = 0;
+ __be16 miux;
+@@ -477,8 +481,9 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
+ {
+ struct nfc_llcp_local *local;
+ struct sk_buff *skb;
+- u8 *miux_tlv = NULL, miux_tlv_length;
+- u8 *rw_tlv = NULL, rw_tlv_length, rw;
++ const u8 *miux_tlv = NULL;
++ const u8 *rw_tlv = NULL;
++ u8 miux_tlv_length, rw_tlv_length, rw;
+ int err;
+ u16 size = 0;
+ __be16 miux;
+diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
+index 3290f2275b857..bdc1a9d0965af 100644
+--- a/net/nfc/llcp_core.c
++++ b/net/nfc/llcp_core.c
+@@ -314,7 +314,7 @@ static char *wks[] = {
+ "urn:nfc:sn:snep",
+ };
+
+-static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len)
++static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len)
+ {
+ int sap, num_wks;
+
+@@ -338,7 +338,7 @@ static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len)
+
+ static
+ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
+- u8 *sn, size_t sn_len)
++ const u8 *sn, size_t sn_len)
+ {
+ struct sock *sk;
+ struct nfc_llcp_sock *llcp_sock, *tmp_sock;
+@@ -535,7 +535,7 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
+ {
+ u8 *gb_cur, version, version_length;
+ u8 lto_length, wks_length, miux_length;
+- u8 *version_tlv = NULL, *lto_tlv = NULL,
++ const u8 *version_tlv = NULL, *lto_tlv = NULL,
+ *wks_tlv = NULL, *miux_tlv = NULL;
+ __be16 wks = cpu_to_be16(local->local_wks);
+ u8 gb_len = 0;
+@@ -625,7 +625,7 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
+ return local->gb;
+ }
+
+-int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
++int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
+ {
+ struct nfc_llcp_local *local;
+
+@@ -652,27 +652,27 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
+ local->remote_gb_len - 3);
+ }
+
+-static u8 nfc_llcp_dsap(struct sk_buff *pdu)
++static u8 nfc_llcp_dsap(const struct sk_buff *pdu)
+ {
+ return (pdu->data[0] & 0xfc) >> 2;
+ }
+
+-static u8 nfc_llcp_ptype(struct sk_buff *pdu)
++static u8 nfc_llcp_ptype(const struct sk_buff *pdu)
+ {
+ return ((pdu->data[0] & 0x03) << 2) | ((pdu->data[1] & 0xc0) >> 6);
+ }
+
+-static u8 nfc_llcp_ssap(struct sk_buff *pdu)
++static u8 nfc_llcp_ssap(const struct sk_buff *pdu)
+ {
+ return pdu->data[1] & 0x3f;
+ }
+
+-static u8 nfc_llcp_ns(struct sk_buff *pdu)
++static u8 nfc_llcp_ns(const struct sk_buff *pdu)
+ {
+ return pdu->data[2] >> 4;
+ }
+
+-static u8 nfc_llcp_nr(struct sk_buff *pdu)
++static u8 nfc_llcp_nr(const struct sk_buff *pdu)
+ {
+ return pdu->data[2] & 0xf;
+ }
+@@ -814,7 +814,7 @@ out:
+ }
+
+ static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local,
+- u8 *sn, size_t sn_len)
++ const u8 *sn, size_t sn_len)
+ {
+ struct nfc_llcp_sock *llcp_sock;
+
+@@ -828,9 +828,10 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local,
+ return llcp_sock;
+ }
+
+-static u8 *nfc_llcp_connect_sn(struct sk_buff *skb, size_t *sn_len)
++static const u8 *nfc_llcp_connect_sn(const struct sk_buff *skb, size_t *sn_len)
+ {
+- u8 *tlv = &skb->data[2], type, length;
++ u8 type, length;
++ const u8 *tlv = &skb->data[2];
+ size_t tlv_array_len = skb->len - LLCP_HEADER_SIZE, offset = 0;
+
+ while (offset < tlv_array_len) {
+@@ -888,7 +889,7 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local,
+ }
+
+ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
+- struct sk_buff *skb)
++ const struct sk_buff *skb)
+ {
+ struct sock *new_sk, *parent;
+ struct nfc_llcp_sock *sock, *new_sock;
+@@ -906,7 +907,7 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
+ goto fail;
+ }
+ } else {
+- u8 *sn;
++ const u8 *sn;
+ size_t sn_len;
+
+ sn = nfc_llcp_connect_sn(skb, &sn_len);
+@@ -1125,7 +1126,7 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
+ }
+
+ static void nfc_llcp_recv_disc(struct nfc_llcp_local *local,
+- struct sk_buff *skb)
++ const struct sk_buff *skb)
+ {
+ struct nfc_llcp_sock *llcp_sock;
+ struct sock *sk;
+@@ -1168,7 +1169,8 @@ static void nfc_llcp_recv_disc(struct nfc_llcp_local *local,
+ nfc_llcp_sock_put(llcp_sock);
+ }
+
+-static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, struct sk_buff *skb)
++static void nfc_llcp_recv_cc(struct nfc_llcp_local *local,
++ const struct sk_buff *skb)
+ {
+ struct nfc_llcp_sock *llcp_sock;
+ struct sock *sk;
+@@ -1201,7 +1203,8 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, struct sk_buff *skb)
+ nfc_llcp_sock_put(llcp_sock);
+ }
+
+-static void nfc_llcp_recv_dm(struct nfc_llcp_local *local, struct sk_buff *skb)
++static void nfc_llcp_recv_dm(struct nfc_llcp_local *local,
++ const struct sk_buff *skb)
+ {
+ struct nfc_llcp_sock *llcp_sock;
+ struct sock *sk;
+@@ -1239,12 +1242,13 @@ static void nfc_llcp_recv_dm(struct nfc_llcp_local *local, struct sk_buff *skb)
+ }
+
+ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
+- struct sk_buff *skb)
++ const struct sk_buff *skb)
+ {
+ struct nfc_llcp_sock *llcp_sock;
+- u8 dsap, ssap, *tlv, type, length, tid, sap;
++ u8 dsap, ssap, type, length, tid, sap;
++ const u8 *tlv;
+ u16 tlv_len, offset;
+- char *service_name;
++ const char *service_name;
+ size_t service_name_len;
+ struct nfc_llcp_sdp_tlv *sdp;
+ HLIST_HEAD(llc_sdres_list);
+diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
+index 6c6f76b370b1e..c792165f523f1 100644
+--- a/net/nfc/nfc.h
++++ b/net/nfc/nfc.h
+@@ -60,7 +60,7 @@ void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
+ u8 comm_mode, u8 rf_mode);
+ int nfc_llcp_register_device(struct nfc_dev *dev);
+ void nfc_llcp_unregister_device(struct nfc_dev *dev);
+-int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len);
++int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len);
+ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len);
+ int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb);
+ struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev);
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index aeb8f84cbd9e2..255d4ecf62522 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -29,6 +29,7 @@ static struct tc_action_ops act_pedit_ops;
+
+ static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
+ [TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) },
++ [TCA_PEDIT_PARMS_EX] = { .len = sizeof(struct tc_pedit) },
+ [TCA_PEDIT_KEYS_EX] = { .type = NLA_NESTED },
+ };
+
+diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
+index 55bf75cb1f16b..164049d20f4d3 100644
+--- a/net/sched/cls_flow.c
++++ b/net/sched/cls_flow.c
+@@ -229,7 +229,7 @@ static u32 flow_get_skgid(const struct sk_buff *skb)
+
+ static u32 flow_get_vlan_tag(const struct sk_buff *skb)
+ {
+- u16 uninitialized_var(tag);
++ u16 tag;
+
+ if (vlan_get_tag(skb, &tag) < 0)
+ return 0;
+diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
+index cb2c62605fc76..5284a473c697f 100644
+--- a/net/sched/cls_fw.c
++++ b/net/sched/cls_fw.c
+@@ -221,11 +221,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
+ if (err < 0)
+ return err;
+
+- if (tb[TCA_FW_CLASSID]) {
+- f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
+- tcf_bind_filter(tp, &f->res, base);
+- }
+-
+ #ifdef CONFIG_NET_CLS_IND
+ if (tb[TCA_FW_INDEV]) {
+ int ret;
+@@ -244,6 +239,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp,
+ } else if (head->mask != 0xFFFFFFFF)
+ return err;
+
++ if (tb[TCA_FW_CLASSID]) {
++ f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
++ tcf_bind_filter(tp, &f->res, base);
++ }
++
+ return 0;
+ }
+
+diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
+index 4c7fa1cfd8e38..a924292623ecf 100644
+--- a/net/sched/cls_route.c
++++ b/net/sched/cls_route.c
+@@ -513,7 +513,6 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
+ if (fold) {
+ f->id = fold->id;
+ f->iif = fold->iif;
+- f->res = fold->res;
+ f->handle = fold->handle;
+
+ f->tp = fold->tp;
+diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
+index d30256ac35372..1e71ff093c91d 100644
+--- a/net/sched/cls_u32.c
++++ b/net/sched/cls_u32.c
+@@ -778,11 +778,22 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp,
+ struct netlink_ext_ack *extack)
+ {
+ int err;
++#ifdef CONFIG_NET_CLS_IND
++ int ifindex = -1;
++#endif
+
+ err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, extack);
+ if (err < 0)
+ return err;
+
++#ifdef CONFIG_NET_CLS_IND
++ if (tb[TCA_U32_INDEV]) {
++ ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack);
++ if (ifindex < 0)
++ return -EINVAL;
++ }
++#endif
++
+ if (tb[TCA_U32_LINK]) {
+ u32 handle = nla_get_u32(tb[TCA_U32_LINK]);
+ struct tc_u_hnode *ht_down = NULL, *ht_old;
+@@ -814,13 +825,8 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp,
+ }
+
+ #ifdef CONFIG_NET_CLS_IND
+- if (tb[TCA_U32_INDEV]) {
+- int ret;
+- ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack);
+- if (ret < 0)
+- return -EINVAL;
+- n->ifindex = ret;
+- }
++ if (ifindex >= 0)
++ n->ifindex = ifindex;
+ #endif
+ return 0;
+ }
+@@ -873,7 +879,6 @@ static struct tc_u_knode *u32_init_knode(struct tcf_proto *tp,
+ new->ifindex = n->ifindex;
+ #endif
+ new->fshift = n->fshift;
+- new->res = n->res;
+ new->flags = n->flags;
+ RCU_INIT_POINTER(new->ht_down, ht);
+
+@@ -1061,18 +1066,62 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
+ return -EINVAL;
+ }
+
++ /* At this point, we need to derive the new handle that will be used to
++ * uniquely map the identity of this table match entry. The
++ * identity of the entry that we need to construct is 32 bits made of:
++ * htid(12b):bucketid(8b):node/entryid(12b)
++ *
++ * At this point _we have the table(ht)_ in which we will insert this
++ * entry. We carry the table's id in variable "htid".
++ * Note that earlier code picked the ht selection either by a) the user
++ * providing the htid specified via TCA_U32_HASH attribute or b) when
++ * no such attribute is passed then the root ht, is default to at ID
++ * 0x[800][00][000]. Rule: the root table has a single bucket with ID 0.
++ * If OTOH the user passed us the htid, they may also pass a bucketid of
++ * choice. 0 is fine. For example a user htid is 0x[600][01][000] it is
++ * indicating hash bucketid of 1. Rule: the entry/node ID _cannot_ be
++ * passed via the htid, so even if it was non-zero it will be ignored.
++ *
++ * We may also have a handle, if the user passed one. The handle also
++ * carries the same addressing of htid(12b):bucketid(8b):node/entryid(12b).
++ * Rule: the bucketid on the handle is ignored even if one was passed;
++ * rather the value on "htid" is always assumed to be the bucketid.
++ */
+ if (handle) {
++ /* Rule: The htid from handle and tableid from htid must match */
+ if (TC_U32_HTID(handle) && TC_U32_HTID(handle ^ htid)) {
+ NL_SET_ERR_MSG_MOD(extack, "Handle specified hash table address mismatch");
+ return -EINVAL;
+ }
+- handle = htid | TC_U32_NODE(handle);
+- err = idr_alloc_u32(&ht->handle_idr, NULL, &handle, handle,
+- GFP_KERNEL);
+- if (err)
+- return err;
+- } else
++ /* Ok, so far we have a valid htid(12b):bucketid(8b) but we
++ * need to finalize the table entry identification with the last
++ * part - the node/entryid(12b)). Rule: Nodeid _cannot be 0_ for
++ * entries. Rule: nodeid of 0 is reserved only for tables(see
++ * earlier code which processes TC_U32_DIVISOR attribute).
++ * Rule: The nodeid can only be derived from the handle (and not
++ * htid).
++ * Rule: if the handle specified zero for the node id example
++ * 0x60000000, then pick a new nodeid from the pool of IDs
++ * this hash table has been allocating from.
++ * If OTOH it is specified (i.e for example the user passed a
++ * handle such as 0x60000123), then we use it generate our final
++ * handle which is used to uniquely identify the match entry.
++ */
++ if (!TC_U32_NODE(handle)) {
++ handle = gen_new_kid(ht, htid);
++ } else {
++ handle = htid | TC_U32_NODE(handle);
++ err = idr_alloc_u32(&ht->handle_idr, NULL, &handle,
++ handle, GFP_KERNEL);
++ if (err)
++ return err;
++ }
++ } else {
++ /* The user did not give us a handle; lets just generate one
++ * from the table's pool of nodeids.
++ */
+ handle = gen_new_kid(ht, htid);
++ }
+
+ if (tb[TCA_U32_SEL] == NULL) {
+ NL_SET_ERR_MSG_MOD(extack, "Selector not specified");
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index 01a177cfa5333..d91665ea7b14d 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -1649,7 +1649,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ {
+ struct cake_sched_data *q = qdisc_priv(sch);
+ int len = qdisc_pkt_len(skb);
+- int uninitialized_var(ret);
++ int ret;
+ struct sk_buff *ack = NULL;
+ ktime_t now = ktime_get();
+ struct cake_tin_data *b;
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index 2974f7262f882..7f0a5d22deaf6 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -365,7 +365,7 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ struct sk_buff **to_free)
+ {
+ struct cbq_sched_data *q = qdisc_priv(sch);
+- int uninitialized_var(ret);
++ int ret;
+ struct cbq_class *cl = cbq_classify(skb, sch, &ret);
+
+ #ifdef CONFIG_NET_CLS_ACT
+diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
+index e4f69c779b8cf..7a4777ee0536e 100644
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -192,7 +192,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ struct fq_codel_sched_data *q = qdisc_priv(sch);
+ unsigned int idx, prev_backlog, prev_qlen;
+ struct fq_codel_flow *flow;
+- int uninitialized_var(ret);
++ int ret;
+ unsigned int pkt_len;
+ bool memory_limited;
+
+diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
+index 64d7f876d7de2..c0ab1e38e80c6 100644
+--- a/net/sched/sch_mqprio.c
++++ b/net/sched/sch_mqprio.c
+@@ -132,6 +132,97 @@ static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla,
+ return 0;
+ }
+
++static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt,
++ struct nlattr *opt,
++ struct netlink_ext_ack *extack)
++{
++ struct mqprio_sched *priv = qdisc_priv(sch);
++ struct nlattr *tb[TCA_MQPRIO_MAX + 1];
++ struct nlattr *attr;
++ int i, rem, err;
++
++ err = parse_attr(tb, TCA_MQPRIO_MAX, opt, mqprio_policy,
++ sizeof(*qopt));
++ if (err < 0)
++ return err;
++
++ if (!qopt->hw) {
++ NL_SET_ERR_MSG(extack,
++ "mqprio TCA_OPTIONS can only contain netlink attributes in hardware mode");
++ return -EINVAL;
++ }
++
++ if (tb[TCA_MQPRIO_MODE]) {
++ priv->flags |= TC_MQPRIO_F_MODE;
++ priv->mode = *(u16 *)nla_data(tb[TCA_MQPRIO_MODE]);
++ }
++
++ if (tb[TCA_MQPRIO_SHAPER]) {
++ priv->flags |= TC_MQPRIO_F_SHAPER;
++ priv->shaper = *(u16 *)nla_data(tb[TCA_MQPRIO_SHAPER]);
++ }
++
++ if (tb[TCA_MQPRIO_MIN_RATE64]) {
++ if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) {
++ NL_SET_ERR_MSG_ATTR(extack, tb[TCA_MQPRIO_MIN_RATE64],
++ "min_rate accepted only when shaper is in bw_rlimit mode");
++ return -EINVAL;
++ }
++ i = 0;
++ nla_for_each_nested(attr, tb[TCA_MQPRIO_MIN_RATE64],
++ rem) {
++ if (nla_type(attr) != TCA_MQPRIO_MIN_RATE64) {
++ NL_SET_ERR_MSG_ATTR(extack, attr,
++ "Attribute type expected to be TCA_MQPRIO_MIN_RATE64");
++ return -EINVAL;
++ }
++
++ if (nla_len(attr) != sizeof(u64)) {
++ NL_SET_ERR_MSG_ATTR(extack, attr,
++ "Attribute TCA_MQPRIO_MIN_RATE64 expected to have 8 bytes length");
++ return -EINVAL;
++ }
++
++ if (i >= qopt->num_tc)
++ break;
++ priv->min_rate[i] = *(u64 *)nla_data(attr);
++ i++;
++ }
++ priv->flags |= TC_MQPRIO_F_MIN_RATE;
++ }
++
++ if (tb[TCA_MQPRIO_MAX_RATE64]) {
++ if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) {
++ NL_SET_ERR_MSG_ATTR(extack, tb[TCA_MQPRIO_MAX_RATE64],
++ "max_rate accepted only when shaper is in bw_rlimit mode");
++ return -EINVAL;
++ }
++ i = 0;
++ nla_for_each_nested(attr, tb[TCA_MQPRIO_MAX_RATE64],
++ rem) {
++ if (nla_type(attr) != TCA_MQPRIO_MAX_RATE64) {
++ NL_SET_ERR_MSG_ATTR(extack, attr,
++ "Attribute type expected to be TCA_MQPRIO_MAX_RATE64");
++ return -EINVAL;
++ }
++
++ if (nla_len(attr) != sizeof(u64)) {
++ NL_SET_ERR_MSG_ATTR(extack, attr,
++ "Attribute TCA_MQPRIO_MAX_RATE64 expected to have 8 bytes length");
++ return -EINVAL;
++ }
++
++ if (i >= qopt->num_tc)
++ break;
++ priv->max_rate[i] = *(u64 *)nla_data(attr);
++ i++;
++ }
++ priv->flags |= TC_MQPRIO_F_MAX_RATE;
++ }
++
++ return 0;
++}
++
+ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt,
+ struct netlink_ext_ack *extack)
+ {
+@@ -141,9 +232,6 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt,
+ struct Qdisc *qdisc;
+ int i, err = -EOPNOTSUPP;
+ struct tc_mqprio_qopt *qopt = NULL;
+- struct nlattr *tb[TCA_MQPRIO_MAX + 1];
+- struct nlattr *attr;
+- int rem;
+ int len;
+
+ BUILD_BUG_ON(TC_MAX_QUEUE != TC_QOPT_MAX_QUEUE);
+@@ -168,55 +256,9 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt,
+
+ len = nla_len(opt) - NLA_ALIGN(sizeof(*qopt));
+ if (len > 0) {
+- err = parse_attr(tb, TCA_MQPRIO_MAX, opt, mqprio_policy,
+- sizeof(*qopt));
+- if (err < 0)
++ err = mqprio_parse_nlattr(sch, qopt, opt, extack);
++ if (err)
+ return err;
+-
+- if (!qopt->hw)
+- return -EINVAL;
+-
+- if (tb[TCA_MQPRIO_MODE]) {
+- priv->flags |= TC_MQPRIO_F_MODE;
+- priv->mode = *(u16 *)nla_data(tb[TCA_MQPRIO_MODE]);
+- }
+-
+- if (tb[TCA_MQPRIO_SHAPER]) {
+- priv->flags |= TC_MQPRIO_F_SHAPER;
+- priv->shaper = *(u16 *)nla_data(tb[TCA_MQPRIO_SHAPER]);
+- }
+-
+- if (tb[TCA_MQPRIO_MIN_RATE64]) {
+- if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE)
+- return -EINVAL;
+- i = 0;
+- nla_for_each_nested(attr, tb[TCA_MQPRIO_MIN_RATE64],
+- rem) {
+- if (nla_type(attr) != TCA_MQPRIO_MIN_RATE64)
+- return -EINVAL;
+- if (i >= qopt->num_tc)
+- break;
+- priv->min_rate[i] = *(u64 *)nla_data(attr);
+- i++;
+- }
+- priv->flags |= TC_MQPRIO_F_MIN_RATE;
+- }
+-
+- if (tb[TCA_MQPRIO_MAX_RATE64]) {
+- if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE)
+- return -EINVAL;
+- i = 0;
+- nla_for_each_nested(attr, tb[TCA_MQPRIO_MAX_RATE64],
+- rem) {
+- if (nla_type(attr) != TCA_MQPRIO_MAX_RATE64)
+- return -EINVAL;
+- if (i >= qopt->num_tc)
+- break;
+- priv->max_rate[i] = *(u64 *)nla_data(attr);
+- i++;
+- }
+- priv->flags |= TC_MQPRIO_F_MAX_RATE;
+- }
+ }
+
+ /* pre-allocate qdisc, attachment can't fail */
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index c2a68f6e427ed..e9420ca261d61 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -387,8 +387,13 @@ static int qfq_change_agg(struct Qdisc *sch, struct qfq_class *cl, u32 weight,
+ u32 lmax)
+ {
+ struct qfq_sched *q = qdisc_priv(sch);
+- struct qfq_aggregate *new_agg = qfq_find_agg(q, lmax, weight);
++ struct qfq_aggregate *new_agg;
+
++ /* 'lmax' can range from [QFQ_MIN_LMAX, pktlen + stab overhead] */
++ if (lmax > (1UL << QFQ_MTU_SHIFT))
++ return -EINVAL;
++
++ new_agg = qfq_find_agg(q, lmax, weight);
+ if (new_agg == NULL) { /* create new aggregate */
+ new_agg = kzalloc(sizeof(*new_agg), GFP_ATOMIC);
+ if (new_agg == NULL)
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index 1bfdf90fa0cce..07721a1e98d8a 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -353,7 +353,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free)
+ unsigned int hash, dropped;
+ sfq_index x, qlen;
+ struct sfq_slot *slot;
+- int uninitialized_var(ret);
++ int ret;
+ struct sk_buff *head;
+ int delta;
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index a68f3d6b72335..baa825751c393 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -380,9 +380,9 @@ static void sctp_auto_asconf_init(struct sctp_sock *sp)
+ struct net *net = sock_net(&sp->inet.sk);
+
+ if (net->sctp.default_auto_asconf) {
+- spin_lock(&net->sctp.addr_wq_lock);
++ spin_lock_bh(&net->sctp.addr_wq_lock);
+ list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist);
+- spin_unlock(&net->sctp.addr_wq_lock);
++ spin_unlock_bh(&net->sctp.addr_wq_lock);
+ sp->do_auto_asconf = 1;
+ }
+ }
+diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
+index d0b5a1c47a324..b5ee21d5d1f3a 100644
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -757,12 +757,6 @@ static void svc_tcp_listen_data_ready(struct sock *sk)
+ dprintk("svc: socket %p TCP (listen) state change %d\n",
+ sk, sk->sk_state);
+
+- if (svsk) {
+- /* Refer to svc_setup_socket() for details. */
+- rmb();
+- svsk->sk_odata(sk);
+- }
+-
+ /*
+ * This callback may called twice when a new connection
+ * is established as a child socket inherits everything
+@@ -771,15 +765,20 @@ static void svc_tcp_listen_data_ready(struct sock *sk)
+ * when one of child sockets become ESTABLISHED.
+ * 2) data_ready method of the child socket may be called
+ * when it receives data before the socket is accepted.
+- * In case of 2, we should ignore it silently.
++ * In case of 2, we should ignore it silently and DO NOT
++ * dereference svsk.
+ */
+- if (sk->sk_state == TCP_LISTEN) {
+- if (svsk) {
+- set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags);
+- svc_xprt_enqueue(&svsk->sk_xprt);
+- } else
+- printk("svc: socket %p: no user data\n", sk);
+- }
++ if (sk->sk_state != TCP_LISTEN)
++ return;
++
++ if (svsk) {
++ /* Refer to svc_setup_socket() for details. */
++ rmb();
++ svsk->sk_odata(sk);
++ set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags);
++ svc_xprt_enqueue(&svsk->sk_xprt);
++ } else
++ printk("svc: socket %p: no user data\n", sk);
+ }
+
+ /*
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index b0dcbb08e60db..8971341c4f8af 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -706,7 +706,7 @@ static int unix_set_peek_off(struct sock *sk, int val)
+ if (mutex_lock_interruptible(&u->iolock))
+ return -EINTR;
+
+- sk->sk_peek_off = val;
++ WRITE_ONCE(sk->sk_peek_off, val);
+ mutex_unlock(&u->iolock);
+
+ return 0;
+diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
+index 76a80a41615be..a57f54bc0e1a7 100644
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -796,6 +796,12 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
+ }
+ }
+
++ /* Sanity-check to ensure we never end up _allocating_ zero
++ * bytes of data for extra.
++ */
++ if (extra_size <= 0)
++ return -EFAULT;
++
+ /* kzalloc() ensures NULL-termination for essid_compat. */
+ extra = kzalloc(extra_size, GFP_KERNEL);
+ if (!extra)
+diff --git a/samples/bpf/tcp_basertt_kern.c b/samples/bpf/tcp_basertt_kern.c
+index 4bf4fc597db9a..653d233714ad0 100644
+--- a/samples/bpf/tcp_basertt_kern.c
++++ b/samples/bpf/tcp_basertt_kern.c
+@@ -54,7 +54,7 @@ int bpf_basertt(struct bpf_sock_ops *skops)
+ case BPF_SOCK_OPS_BASE_RTT:
+ n = bpf_getsockopt(skops, SOL_TCP, TCP_CONGESTION,
+ cong, sizeof(cong));
+- if (!n && !__builtin_memcmp(cong, nv, sizeof(nv)+1)) {
++ if (!n && !__builtin_memcmp(cong, nv, sizeof(nv))) {
+ /* Set base_rtt to 80us */
+ rv = 80;
+ } else if (n) {
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 8c2847ef4e422..2060a3fe9691d 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1260,6 +1260,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
+ if (relsym->st_name != 0)
+ return relsym;
+
++ /*
++ * Strive to find a better symbol name, but the resulting name may not
++ * match the symbol referenced in the original code.
++ */
+ relsym_secindex = get_secindex(elf, relsym);
+ for (sym = elf->symtab_start; sym < elf->symtab_stop; sym++) {
+ if (get_secindex(elf, sym) != relsym_secindex)
+@@ -1747,19 +1751,33 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
+ #define R_ARM_THM_JUMP19 51
+ #endif
+
++static int32_t sign_extend32(int32_t value, int index)
++{
++ uint8_t shift = 31 - index;
++
++ return (int32_t)(value << shift) >> shift;
++}
++
+ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
+ {
+ unsigned int r_typ = ELF_R_TYPE(r->r_info);
++ Elf_Sym *sym = elf->symtab_start + ELF_R_SYM(r->r_info);
++ void *loc = reloc_location(elf, sechdr, r);
++ uint32_t inst;
++ int32_t offset;
+
+ switch (r_typ) {
+ case R_ARM_ABS32:
+- /* From ARM ABI: (S + A) | T */
+- r->r_addend = (int)(long)
+- (elf->symtab_start + ELF_R_SYM(r->r_info));
++ inst = TO_NATIVE(*(uint32_t *)loc);
++ r->r_addend = inst + sym->st_value;
+ break;
+ case R_ARM_PC24:
+ case R_ARM_CALL:
+ case R_ARM_JUMP24:
++ inst = TO_NATIVE(*(uint32_t *)loc);
++ offset = sign_extend32((inst & 0x00ffffff) << 2, 25);
++ r->r_addend = offset + sym->st_value + 8;
++ break;
+ case R_ARM_THM_CALL:
+ case R_ARM_THM_JUMP24:
+ case R_ARM_THM_JUMP19:
+diff --git a/scripts/tags.sh b/scripts/tags.sh
+index 26de7d5aa5c89..de02c44549f73 100755
+--- a/scripts/tags.sh
++++ b/scripts/tags.sh
+@@ -28,6 +28,13 @@ fi
+ # ignore userspace tools
+ ignore="$ignore ( -path ${tree}tools ) -prune -o"
+
++# gtags(1) refuses to index any file outside of its current working dir.
++# If gtags indexing is requested and the build output directory is not
++# the kernel source tree, index all files in absolute-path form.
++if [[ "$1" == "gtags" && -n "${tree}" ]]; then
++ tree=$(realpath "$tree")/
++fi
++
+ # Detect if ALLSOURCE_ARCHS is set. If not, we assume SRCARCH
+ if [ "${ALLSOURCE_ARCHS}" = "" ]; then
+ ALLSOURCE_ARCHS=${SRCARCH}
+@@ -136,7 +143,7 @@ docscope()
+
+ dogtags()
+ {
+- all_target_sources | gtags -i -f -
++ all_target_sources | gtags -i -C "${tree:-.}" -f - "$PWD"
+ }
+
+ # Basic regular expressions with an optional /kind-spec/ for ctags and
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index 6d1efe1359f17..9c036a41e7347 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -474,7 +474,9 @@ void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name)
+
+ /**
+ * evm_inode_setattr - prevent updating an invalid EVM extended attribute
++ * @idmap: idmap of the mount
+ * @dentry: pointer to the affected dentry
++ * @attr: iattr structure containing the new file attributes
+ *
+ * Permit update of file attributes when files have a valid EVM signature,
+ * except in the case of them having an immutable portable signature.
+diff --git a/security/integrity/iint.c b/security/integrity/iint.c
+index 5a6810041e5c0..d5b9253ebd12b 100644
+--- a/security/integrity/iint.c
++++ b/security/integrity/iint.c
+@@ -46,12 +46,10 @@ static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode)
+ else if (inode > iint->inode)
+ n = n->rb_right;
+ else
+- break;
++ return iint;
+ }
+- if (!n)
+- return NULL;
+
+- return iint;
++ return NULL;
+ }
+
+ /*
+@@ -116,10 +114,15 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode)
+ parent = *p;
+ test_iint = rb_entry(parent, struct integrity_iint_cache,
+ rb_node);
+- if (inode < test_iint->inode)
++ if (inode < test_iint->inode) {
+ p = &(*p)->rb_left;
+- else
++ } else if (inode > test_iint->inode) {
+ p = &(*p)->rb_right;
++ } else {
++ write_unlock(&integrity_iint_lock);
++ kmem_cache_free(iint_cache, iint);
++ return test_iint;
++ }
+ }
+
+ iint->inode = inode;
+diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
+index 00d826b048c4a..eb6735f16b933 100644
+--- a/sound/core/control_compat.c
++++ b/sound/core/control_compat.c
+@@ -236,7 +236,7 @@ static int copy_ctl_value_from_user(struct snd_card *card,
+ {
+ struct snd_ctl_elem_value32 __user *data32 = userdata;
+ int i, type, size;
+- int uninitialized_var(count);
++ int count;
+ unsigned int indirect;
+
+ if (copy_from_user(&data->id, &data32->id, sizeof(data->id)))
+diff --git a/sound/core/jack.c b/sound/core/jack.c
+index 074b15fcb0ac4..06e0fc7b64179 100644
+--- a/sound/core/jack.c
++++ b/sound/core/jack.c
+@@ -378,6 +378,7 @@ void snd_jack_report(struct snd_jack *jack, int status)
+ {
+ struct snd_jack_kctl *jack_kctl;
+ #ifdef CONFIG_SND_JACK_INPUT_DEV
++ struct input_dev *idev;
+ int i;
+ #endif
+
+@@ -389,30 +390,28 @@ void snd_jack_report(struct snd_jack *jack, int status)
+ status & jack_kctl->mask_bits);
+
+ #ifdef CONFIG_SND_JACK_INPUT_DEV
+- mutex_lock(&jack->input_dev_lock);
+- if (!jack->input_dev) {
+- mutex_unlock(&jack->input_dev_lock);
++ idev = input_get_device(jack->input_dev);
++ if (!idev)
+ return;
+- }
+
+ for (i = 0; i < ARRAY_SIZE(jack->key); i++) {
+ int testbit = SND_JACK_BTN_0 >> i;
+
+ if (jack->type & testbit)
+- input_report_key(jack->input_dev, jack->key[i],
++ input_report_key(idev, jack->key[i],
+ status & testbit);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(jack_switch_types); i++) {
+ int testbit = 1 << i;
+ if (jack->type & testbit)
+- input_report_switch(jack->input_dev,
++ input_report_switch(idev,
+ jack_switch_types[i],
+ status & testbit);
+ }
+
+- input_sync(jack->input_dev);
+- mutex_unlock(&jack->input_dev_lock);
++ input_sync(idev);
++ input_put_device(idev);
+ #endif /* CONFIG_SND_JACK_INPUT_DEV */
+ }
+ EXPORT_SYMBOL(snd_jack_report);
+diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
+index c16c8151160c3..970aef2cf513a 100644
+--- a/sound/isa/sb/sb16_csp.c
++++ b/sound/isa/sb/sb16_csp.c
+@@ -116,7 +116,7 @@ static void info_read(struct snd_info_entry *entry, struct snd_info_buffer *buff
+ int snd_sb_csp_new(struct snd_sb *chip, int device, struct snd_hwdep ** rhwdep)
+ {
+ struct snd_sb_csp *p;
+- int uninitialized_var(version);
++ int version;
+ int err;
+ struct snd_hwdep *hw;
+
+diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
+index a276c4283c7bb..3f13666a01904 100644
+--- a/sound/pci/ac97/ac97_codec.c
++++ b/sound/pci/ac97/ac97_codec.c
+@@ -2026,8 +2026,8 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
+ .dev_disconnect = snd_ac97_dev_disconnect,
+ };
+
+- if (rac97)
+- *rac97 = NULL;
++ if (!rac97)
++ return -EINVAL;
+ if (snd_BUG_ON(!bus || !template))
+ return -EINVAL;
+ if (snd_BUG_ON(template->num >= 4))
+diff --git a/sound/soc/codecs/cs42l51-i2c.c b/sound/soc/codecs/cs42l51-i2c.c
+index 4b5731a418762..cd93e93a59832 100644
+--- a/sound/soc/codecs/cs42l51-i2c.c
++++ b/sound/soc/codecs/cs42l51-i2c.c
+@@ -23,6 +23,12 @@ static struct i2c_device_id cs42l51_i2c_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, cs42l51_i2c_id);
+
++const struct of_device_id cs42l51_of_match[] = {
++ { .compatible = "cirrus,cs42l51", },
++ { }
++};
++MODULE_DEVICE_TABLE(of, cs42l51_of_match);
++
+ static int cs42l51_i2c_probe(struct i2c_client *i2c,
+ const struct i2c_device_id *id)
+ {
+diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c
+index 5080d7a3c2798..662f1f85ba36f 100644
+--- a/sound/soc/codecs/cs42l51.c
++++ b/sound/soc/codecs/cs42l51.c
+@@ -563,13 +563,6 @@ error:
+ }
+ EXPORT_SYMBOL_GPL(cs42l51_probe);
+
+-const struct of_device_id cs42l51_of_match[] = {
+- { .compatible = "cirrus,cs42l51", },
+- { }
+-};
+-MODULE_DEVICE_TABLE(of, cs42l51_of_match);
+-EXPORT_SYMBOL_GPL(cs42l51_of_match);
+-
+ MODULE_AUTHOR("Arnaud Patard <arnaud.patard@rtp-net.org>");
+ MODULE_DESCRIPTION("Cirrus Logic CS42L51 ALSA SoC Codec Driver");
+ MODULE_LICENSE("GPL");
+diff --git a/sound/soc/codecs/cs42l51.h b/sound/soc/codecs/cs42l51.h
+index 0ca805492ac4b..8c55bf384bc65 100644
+--- a/sound/soc/codecs/cs42l51.h
++++ b/sound/soc/codecs/cs42l51.h
+@@ -22,7 +22,6 @@ struct device;
+
+ extern const struct regmap_config cs42l51_regmap;
+ int cs42l51_probe(struct device *dev, struct regmap *regmap);
+-extern const struct of_device_id cs42l51_of_match[];
+
+ #define CS42L51_CHIP_ID 0x1B
+ #define CS42L51_CHIP_REV_A 0x00
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index 57130edaf3aba..834e542021fee 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -45,7 +45,12 @@ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(dac_vol_tlv, -9600, 50, 1);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(adc_vol_tlv, -9600, 50, 1);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_max_gain_tlv, -650, 150, 0);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_min_gain_tlv, -1200, 150, 0);
+-static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_target_tlv, -1650, 150, 0);
++
++static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(alc_target_tlv,
++ 0, 10, TLV_DB_SCALE_ITEM(-1650, 150, 0),
++ 11, 11, TLV_DB_SCALE_ITEM(-150, 0, 0),
++);
++
+ static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(hpmixer_gain_tlv,
+ 0, 4, TLV_DB_SCALE_ITEM(-1200, 150, 0),
+ 8, 11, TLV_DB_SCALE_ITEM(-450, 150, 0),
+@@ -107,7 +112,7 @@ static const struct snd_kcontrol_new es8316_snd_controls[] = {
+ alc_max_gain_tlv),
+ SOC_SINGLE_TLV("ALC Capture Min Volume", ES8316_ADC_ALC2, 0, 28, 0,
+ alc_min_gain_tlv),
+- SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 10, 0,
++ SOC_SINGLE_TLV("ALC Capture Target Volume", ES8316_ADC_ALC3, 4, 11, 0,
+ alc_target_tlv),
+ SOC_SINGLE("ALC Capture Hold Time", ES8316_ADC_ALC3, 0, 10, 0),
+ SOC_SINGLE("ALC Capture Decay Time", ES8316_ADC_ALC4, 4, 10, 0),
+diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
+index d14e851b91605..03d3b0f17f877 100644
+--- a/sound/soc/codecs/wm8904.c
++++ b/sound/soc/codecs/wm8904.c
+@@ -2264,6 +2264,9 @@ static int wm8904_i2c_probe(struct i2c_client *i2c,
+ regmap_update_bits(wm8904->regmap, WM8904_BIAS_CONTROL_0,
+ WM8904_POBCTRL, 0);
+
++ /* Fill the cache for the ADC test register */
++ regmap_read(wm8904->regmap, WM8904_ADC_TEST_0, &val);
++
+ /* Can leave the device powered off until we need it */
+ regcache_cache_only(wm8904->regmap, true);
+ regulator_bulk_disable(ARRAY_SIZE(wm8904->supplies), wm8904->supplies);
+diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c
+index 740b90df44bb5..0a1ba64ed63cf 100644
+--- a/sound/soc/fsl/fsl_spdif.c
++++ b/sound/soc/fsl/fsl_spdif.c
+@@ -614,6 +614,8 @@ static int fsl_spdif_trigger(struct snd_pcm_substream *substream,
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+ regmap_update_bits(regmap, REG_SPDIF_SCR, dmaen, 0);
+ regmap_update_bits(regmap, REG_SPDIF_SIE, intr, 0);
++ regmap_write(regmap, REG_SPDIF_STL, 0x0);
++ regmap_write(regmap, REG_SPDIF_STR, 0x0);
+ break;
+ default:
+ return -EINVAL;
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index e428d8b36c00a..56119a96d3509 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -324,7 +324,7 @@ static void queue_pending_output_urbs(struct snd_usb_endpoint *ep)
+ while (test_bit(EP_FLAG_RUNNING, &ep->flags)) {
+
+ unsigned long flags;
+- struct snd_usb_packet_info *uninitialized_var(packet);
++ struct snd_usb_packet_info *packet;
+ struct snd_urb_ctx *ctx = NULL;
+ int err, i;
+
+diff --git a/tools/perf/tests/shell/test_uprobe_from_different_cu.sh b/tools/perf/tests/shell/test_uprobe_from_different_cu.sh
+new file mode 100644
+index 0000000000000..319f36ebb9a40
+--- /dev/null
++++ b/tools/perf/tests/shell/test_uprobe_from_different_cu.sh
+@@ -0,0 +1,83 @@
++#!/bin/bash
++# test perf probe of function from different CU
++# SPDX-License-Identifier: GPL-2.0
++
++set -e
++
++# skip if there's no gcc
++if ! [ -x "$(command -v gcc)" ]; then
++ echo "failed: no gcc compiler"
++ exit 2
++fi
++
++temp_dir=$(mktemp -d /tmp/perf-uprobe-different-cu-sh.XXXXXXXXXX)
++
++cleanup()
++{
++ trap - EXIT TERM INT
++ if [[ "${temp_dir}" =~ ^/tmp/perf-uprobe-different-cu-sh.*$ ]]; then
++ echo "--- Cleaning up ---"
++ perf probe -x ${temp_dir}/testfile -d foo || true
++ rm -f "${temp_dir}/"*
++ rmdir "${temp_dir}"
++ fi
++}
++
++trap_cleanup()
++{
++ cleanup
++ exit 1
++}
++
++trap trap_cleanup EXIT TERM INT
++
++cat > ${temp_dir}/testfile-foo.h << EOF
++struct t
++{
++ int *p;
++ int c;
++};
++
++extern int foo (int i, struct t *t);
++EOF
++
++cat > ${temp_dir}/testfile-foo.c << EOF
++#include "testfile-foo.h"
++
++int
++foo (int i, struct t *t)
++{
++ int j, res = 0;
++ for (j = 0; j < i && j < t->c; j++)
++ res += t->p[j];
++
++ return res;
++}
++EOF
++
++cat > ${temp_dir}/testfile-main.c << EOF
++#include "testfile-foo.h"
++
++static struct t g;
++
++int
++main (int argc, char **argv)
++{
++ int i;
++ int j[argc];
++ g.c = argc;
++ g.p = j;
++ for (i = 0; i < argc; i++)
++ j[i] = (int) argv[i][0];
++ return foo (3, &g);
++}
++EOF
++
++gcc -g -Og -flto -c ${temp_dir}/testfile-foo.c -o ${temp_dir}/testfile-foo.o
++gcc -g -Og -c ${temp_dir}/testfile-main.c -o ${temp_dir}/testfile-main.o
++gcc -g -Og -o ${temp_dir}/testfile ${temp_dir}/testfile-foo.o ${temp_dir}/testfile-main.o
++
++perf probe -x ${temp_dir}/testfile --funcs foo
++perf probe -x ${temp_dir}/testfile foo
++
++cleanup
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 6de57d9ee7cc2..db099dc20a682 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -1020,7 +1020,7 @@ int die_get_varname(Dwarf_Die *vr_die, struct strbuf *buf)
+ ret = die_get_typename(vr_die, buf);
+ if (ret < 0) {
+ pr_debug("Failed to get type, make it unknown.\n");
+- ret = strbuf_add(buf, " (unknown_type)", 14);
++ ret = strbuf_add(buf, "(unknown_type)", 14);
+ }
+
+ return ret < 0 ? ret : strbuf_addf(buf, "\t%s", dwarf_diename(vr_die));
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index e2a6c22959f26..aabd423785520 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -1499,6 +1499,8 @@ static void intel_pt_calc_cbr(struct intel_pt_decoder *decoder)
+
+ decoder->cbr = cbr;
+ decoder->cbr_cyc_to_tsc = decoder->max_non_turbo_ratio_fp / cbr;
++ decoder->cyc_ref_timestamp = decoder->timestamp;
++ decoder->cycle_cnt = 0;
+ }
+
+ static void intel_pt_calc_cyc_timestamp(struct intel_pt_decoder *decoder)
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-08-16 16:59 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-08-16 16:59 UTC (permalink / raw
To: gentoo-commits
commit: 6095afb6dbceb19afc1312c444dda2910cb91635
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 16 16:59:13 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Aug 16 16:59:13 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6095afb6
Linux patch 4.19.292
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1291_linux-4.19.292.patch | 1678 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1682 insertions(+)
diff --git a/0000_README b/0000_README
index b68b9988..cff17d32 100644
--- a/0000_README
+++ b/0000_README
@@ -1207,6 +1207,10 @@ Patch: 1290_linux-4.19.291.patch
From: https://www.kernel.org
Desc: Linux 4.19.291
+Patch: 1291_linux-4.19.292.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.292
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1291_linux-4.19.292.patch b/1291_linux-4.19.292.patch
new file mode 100644
index 00000000..325cea40
--- /dev/null
+++ b/1291_linux-4.19.292.patch
@@ -0,0 +1,1678 @@
+diff --git a/Makefile b/Makefile
+index f110fc4f127fa..fcd6a9b173018 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 291
++SUBLEVEL = 292
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
+index 5576f7646fb6b..60f7e45d3aa89 100644
+--- a/arch/alpha/kernel/setup.c
++++ b/arch/alpha/kernel/setup.c
+@@ -469,8 +469,7 @@ setup_memory(void *kernel_end)
+ extern void setup_memory(void *);
+ #endif /* !CONFIG_DISCONTIGMEM */
+
+-int __init
+-page_is_ram(unsigned long pfn)
++int page_is_ram(unsigned long pfn)
+ {
+ struct memclust_struct * cluster;
+ struct memdesc_struct * memdesc;
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index e231779928dd4..8a0bb7c48e9a5 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -12,7 +12,6 @@ config 64BIT
+ config SPARC
+ bool
+ default y
+- select ARCH_HAS_CPU_FINALIZE_INIT if !SMP
+ select ARCH_MIGHT_HAVE_PC_PARPORT if SPARC64 && PCI
+ select ARCH_MIGHT_HAVE_PC_SERIO
+ select OF
+@@ -51,6 +50,7 @@ config SPARC
+
+ config SPARC32
+ def_bool !64BIT
++ select ARCH_HAS_CPU_FINALIZE_INIT if !SMP
+ select ARCH_HAS_SYNC_DMA_FOR_CPU
+ select DMA_NONCOHERENT_OPS
+ select GENERIC_ATOMIC64
+diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c
+index a1c31bb23170c..a3cd828359f8b 100644
+--- a/arch/x86/entry/vdso/vma.c
++++ b/arch/x86/entry/vdso/vma.c
+@@ -228,8 +228,8 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
+
+ /* Round the lowest possible end address up to a PMD boundary. */
+ end = (start + len + PMD_SIZE - 1) & PMD_MASK;
+- if (end >= TASK_SIZE_MAX)
+- end = TASK_SIZE_MAX;
++ if (end >= DEFAULT_MAP_WINDOW)
++ end = DEFAULT_MAP_WINDOW;
+ end -= len;
+
+ if (end > start) {
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index cc4bb218f1c60..f3049d55c522e 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -1001,4 +1001,6 @@ enum taa_mitigations {
+ TAA_MITIGATION_TSX_DISABLED,
+ };
+
++extern bool gds_ucode_mitigated(void);
++
+ #endif /* _ASM_X86_PROCESSOR_H */
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 256f2c6120ecb..69eb6a804d1d6 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -69,6 +69,7 @@ static const int amd_erratum_1054[] =
+ static const int amd_zenbleed[] =
+ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0x30, 0x0, 0x4f, 0xf),
+ AMD_MODEL_RANGE(0x17, 0x60, 0x0, 0x7f, 0xf),
++ AMD_MODEL_RANGE(0x17, 0x90, 0x0, 0x91, 0xf),
+ AMD_MODEL_RANGE(0x17, 0xa0, 0x0, 0xaf, 0xf));
+
+ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index cdf2cb1eb923d..d7a9b07ce0b89 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -217,8 +217,6 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
+
+ u64 __read_mostly host_xcr0;
+
+-extern bool gds_ucode_mitigated(void);
+-
+ static int emulator_fix_hypercall(struct x86_emulate_ctxt *ctxt);
+
+ static inline void kvm_async_pf_hash_reset(struct kvm_vcpu *vcpu)
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 3e57d5682b693..c5cf4f651ab49 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -5742,6 +5742,7 @@ err_init_binder_device_failed:
+
+ err_alloc_device_names_failed:
+ debugfs_remove_recursive(binder_debugfs_dir_entry_root);
++ binder_alloc_shrinker_exit();
+
+ return ret;
+ }
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index cd845afc48809..a6e4f4858ca24 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -1033,6 +1033,12 @@ static struct shrinker binder_shrinker = {
+ .seeks = DEFAULT_SEEKS,
+ };
+
++void binder_alloc_shrinker_exit(void)
++{
++ unregister_shrinker(&binder_shrinker);
++ list_lru_destroy(&binder_alloc_lru);
++}
++
+ /**
+ * binder_alloc_init() - called by binder_open() for per-proc initialization
+ * @alloc: binder_alloc for this proc
+diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
+index fb3238c74c8a8..78bb12eea6340 100644
+--- a/drivers/android/binder_alloc.h
++++ b/drivers/android/binder_alloc.h
+@@ -130,6 +130,7 @@ extern struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
+ int is_async);
+ extern void binder_alloc_init(struct binder_alloc *alloc);
+ extern int binder_alloc_shrinker_init(void);
++extern void binder_alloc_shrinker_exit(void);
+ extern void binder_alloc_vma_close(struct binder_alloc *alloc);
+ extern struct binder_buffer *
+ binder_alloc_prepare_to_free(struct binder_alloc *alloc,
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 5afdb9e31c885..1bba1fa3a8096 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -404,6 +404,12 @@ enum desc_status {
+ * of a channel can be BUSY at any time.
+ */
+ BUSY,
++ /*
++ * Pause was called while descriptor was BUSY. Due to hardware
++ * limitations, only termination is possible for descriptors
++ * that have been paused.
++ */
++ PAUSED,
+ /*
+ * Sitting on the channel work_list but xfer done
+ * by PL330 core
+@@ -2028,7 +2034,7 @@ static inline void fill_queue(struct dma_pl330_chan *pch)
+ list_for_each_entry(desc, &pch->work_list, node) {
+
+ /* If already submitted */
+- if (desc->status == BUSY)
++ if (desc->status == BUSY || desc->status == PAUSED)
+ continue;
+
+ ret = pl330_submit_req(pch->thread, desc);
+@@ -2305,6 +2311,7 @@ static int pl330_pause(struct dma_chan *chan)
+ {
+ struct dma_pl330_chan *pch = to_pchan(chan);
+ struct pl330_dmac *pl330 = pch->dmac;
++ struct dma_pl330_desc *desc;
+ unsigned long flags;
+
+ pm_runtime_get_sync(pl330->ddma.dev);
+@@ -2314,6 +2321,10 @@ static int pl330_pause(struct dma_chan *chan)
+ _stop(pch->thread);
+ spin_unlock(&pl330->lock);
+
++ list_for_each_entry(desc, &pch->work_list, node) {
++ if (desc->status == BUSY)
++ desc->status = PAUSED;
++ }
+ spin_unlock_irqrestore(&pch->lock, flags);
+ pm_runtime_mark_last_busy(pl330->ddma.dev);
+ pm_runtime_put_autosuspend(pl330->ddma.dev);
+@@ -2404,7 +2415,7 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
+ else if (running && desc == running)
+ transferred =
+ pl330_get_current_xferred_count(pch, desc);
+- else if (desc->status == BUSY)
++ else if (desc->status == BUSY || desc->status == PAUSED)
+ /*
+ * Busy but not running means either just enqueued,
+ * or finished and not yet marked done
+@@ -2421,6 +2432,9 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
+ case DONE:
+ ret = DMA_COMPLETE;
+ break;
++ case PAUSED:
++ ret = DMA_PAUSED;
++ break;
+ case PREP:
+ case BUSY:
+ ret = DMA_IN_PROGRESS;
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index 905ab615c7c82..6e6568101963b 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -921,7 +921,7 @@ nouveau_connector_get_modes(struct drm_connector *connector)
+ /* Determine display colour depth for everything except LVDS now,
+ * DP requires this before mode_valid() is called.
+ */
+- if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS && nv_connector->native_mode)
++ if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS)
+ nouveau_connector_detect_depth(connector);
+
+ /* Find the native mode if this is a digital panel, if we didn't
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h
+index 33e932bd73b16..378635e6e87a8 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h
+@@ -121,6 +121,7 @@ void gk104_grctx_generate_r418800(struct gf100_gr *);
+
+ extern const struct gf100_grctx_func gk110_grctx;
+ void gk110_grctx_generate_r419eb0(struct gf100_gr *);
++void gk110_grctx_generate_r419f78(struct gf100_gr *);
+
+ extern const struct gf100_grctx_func gk110b_grctx;
+ extern const struct gf100_grctx_func gk208_grctx;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
+index 304e9d268bad4..f894f82548242 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
+@@ -916,7 +916,9 @@ static void
+ gk104_grctx_generate_r419f78(struct gf100_gr *gr)
+ {
+ struct nvkm_device *device = gr->base.engine.subdev.device;
+- nvkm_mask(device, 0x419f78, 0x00000001, 0x00000000);
++
++ /* bit 3 set disables loads in fp helper invocations, we need it enabled */
++ nvkm_mask(device, 0x419f78, 0x00000009, 0x00000000);
+ }
+
+ void
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c
+index 86547cfc38dce..e88740d4e54d4 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c
+@@ -820,6 +820,15 @@ gk110_grctx_generate_r419eb0(struct gf100_gr *gr)
+ nvkm_mask(device, 0x419eb0, 0x00001000, 0x00001000);
+ }
+
++void
++gk110_grctx_generate_r419f78(struct gf100_gr *gr)
++{
++ struct nvkm_device *device = gr->base.engine.subdev.device;
++
++ /* bit 3 set disables loads in fp helper invocations, we need it enabled */
++ nvkm_mask(device, 0x419f78, 0x00000008, 0x00000000);
++}
++
+ const struct gf100_grctx_func
+ gk110_grctx = {
+ .main = gf100_grctx_generate_main,
+@@ -852,4 +861,5 @@ gk110_grctx = {
+ .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
+ .r418800 = gk104_grctx_generate_r418800,
+ .r419eb0 = gk110_grctx_generate_r419eb0,
++ .r419f78 = gk110_grctx_generate_r419f78,
+ };
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c
+index ebb947bd1446b..086e4d49e1121 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c
+@@ -101,4 +101,5 @@ gk110b_grctx = {
+ .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
+ .r418800 = gk104_grctx_generate_r418800,
+ .r419eb0 = gk110_grctx_generate_r419eb0,
++ .r419f78 = gk110_grctx_generate_r419f78,
+ };
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c
+index 4d40512b5c998..0bf438c3f7cbc 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c
+@@ -566,4 +566,5 @@ gk208_grctx = {
+ .dist_skip_table = gf117_grctx_generate_dist_skip_table,
+ .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
+ .r418800 = gk104_grctx_generate_r418800,
++ .r419f78 = gk110_grctx_generate_r419f78,
+ };
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
+index 0b3964e6b36e2..acdf0932a99e1 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
+@@ -991,4 +991,5 @@ gm107_grctx = {
+ .r406500 = gm107_grctx_generate_r406500,
+ .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr,
+ .r419e00 = gm107_grctx_generate_r419e00,
++ .r419f78 = gk110_grctx_generate_r419f78,
+ };
+diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
+index 414cc43c287eb..66991fd4b10a0 100644
+--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
++++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
+@@ -46,7 +46,7 @@ int cros_ec_sensors_core_init(struct platform_device *pdev,
+ platform_set_drvdata(pdev, indio_dev);
+
+ state->ec = ec->ec_dev;
+- state->msg = devm_kzalloc(&pdev->dev,
++ state->msg = devm_kzalloc(&pdev->dev, sizeof(*state->msg) +
+ max((u16)sizeof(struct ec_params_motion_sense),
+ state->ec->max_response), GFP_KERNEL);
+ if (!state->msg)
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 1221faea75a68..54a65db2443e7 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -12178,6 +12178,7 @@ static void free_cntrs(struct hfi1_devdata *dd)
+
+ if (dd->synth_stats_timer.function)
+ del_timer_sync(&dd->synth_stats_timer);
++ cancel_work_sync(&dd->update_cntr_work);
+ ppd = (struct hfi1_pportdata *)(dd + 1);
+ for (i = 0; i < dd->num_pports; i++, ppd++) {
+ kfree(ppd->cntrs);
+diff --git a/drivers/isdn/mISDN/dsp.h b/drivers/isdn/mISDN/dsp.h
+index fa09d511a8eda..baf31258f5c90 100644
+--- a/drivers/isdn/mISDN/dsp.h
++++ b/drivers/isdn/mISDN/dsp.h
+@@ -247,7 +247,7 @@ extern void dsp_cmx_hardware(struct dsp_conf *conf, struct dsp *dsp);
+ extern int dsp_cmx_conf(struct dsp *dsp, u32 conf_id);
+ extern void dsp_cmx_receive(struct dsp *dsp, struct sk_buff *skb);
+ extern void dsp_cmx_hdlc(struct dsp *dsp, struct sk_buff *skb);
+-extern void dsp_cmx_send(void *arg);
++extern void dsp_cmx_send(struct timer_list *arg);
+ extern void dsp_cmx_transmit(struct dsp *dsp, struct sk_buff *skb);
+ extern int dsp_cmx_del_conf_member(struct dsp *dsp);
+ extern int dsp_cmx_del_conf(struct dsp_conf *conf);
+diff --git a/drivers/isdn/mISDN/dsp_cmx.c b/drivers/isdn/mISDN/dsp_cmx.c
+index d4b6f01a3f0ea..23a8e93d26c03 100644
+--- a/drivers/isdn/mISDN/dsp_cmx.c
++++ b/drivers/isdn/mISDN/dsp_cmx.c
+@@ -1625,7 +1625,7 @@ static u16 dsp_count; /* last sample count */
+ static int dsp_count_valid; /* if we have last sample count */
+
+ void
+-dsp_cmx_send(void *arg)
++dsp_cmx_send(struct timer_list *arg)
+ {
+ struct dsp_conf *conf;
+ struct dsp_conf_member *member;
+diff --git a/drivers/isdn/mISDN/dsp_core.c b/drivers/isdn/mISDN/dsp_core.c
+index cd036e87335a6..c3f8bf82f78eb 100644
+--- a/drivers/isdn/mISDN/dsp_core.c
++++ b/drivers/isdn/mISDN/dsp_core.c
+@@ -1202,7 +1202,7 @@ static int __init dsp_init(void)
+ }
+
+ /* set sample timer */
+- timer_setup(&dsp_spl_tl, (void *)dsp_cmx_send, 0);
++ timer_setup(&dsp_spl_tl, dsp_cmx_send, 0);
+ dsp_spl_tl.expires = jiffies + dsp_tics;
+ dsp_spl_jiffies = dsp_spl_tl.expires;
+ add_timer(&dsp_spl_tl);
+diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
+index 52307dce08ba8..0c392b41a858a 100644
+--- a/drivers/mmc/host/moxart-mmc.c
++++ b/drivers/mmc/host/moxart-mmc.c
+@@ -339,13 +339,7 @@ static void moxart_transfer_pio(struct moxart_host *host)
+ return;
+ }
+ for (len = 0; len < remain && len < host->fifo_width;) {
+- /* SCR data must be read in big endian. */
+- if (data->mrq->cmd->opcode == SD_APP_SEND_SCR)
+- *sgp = ioread32be(host->base +
+- REG_DATA_WINDOW);
+- else
+- *sgp = ioread32(host->base +
+- REG_DATA_WINDOW);
++ *sgp = ioread32(host->base + REG_DATA_WINDOW);
+ sgp++;
+ len += 4;
+ }
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 47e02c5342b28..79b36f1c50aec 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4395,7 +4395,9 @@ void bond_setup(struct net_device *bond_dev)
+
+ bond_dev->hw_features = BOND_VLAN_FEATURES |
+ NETIF_F_HW_VLAN_CTAG_RX |
+- NETIF_F_HW_VLAN_CTAG_FILTER;
++ NETIF_F_HW_VLAN_CTAG_FILTER |
++ NETIF_F_HW_VLAN_STAG_RX |
++ NETIF_F_HW_VLAN_STAG_FILTER;
+
+ bond_dev->hw_features |= NETIF_F_GSO_ENCAP_ALL | NETIF_F_GSO_UDP_L4;
+ bond_dev->features |= bond_dev->hw_features;
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 1463cf4321a83..646f14a9bd961 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -884,12 +884,22 @@ static int ibmvnic_login(struct net_device *netdev)
+
+ static void release_login_buffer(struct ibmvnic_adapter *adapter)
+ {
++ if (!adapter->login_buf)
++ return;
++
++ dma_unmap_single(&adapter->vdev->dev, adapter->login_buf_token,
++ adapter->login_buf_sz, DMA_TO_DEVICE);
+ kfree(adapter->login_buf);
+ adapter->login_buf = NULL;
+ }
+
+ static void release_login_rsp_buffer(struct ibmvnic_adapter *adapter)
+ {
++ if (!adapter->login_rsp_buf)
++ return;
++
++ dma_unmap_single(&adapter->vdev->dev, adapter->login_rsp_buf_token,
++ adapter->login_rsp_buf_sz, DMA_FROM_DEVICE);
+ kfree(adapter->login_rsp_buf);
+ adapter->login_rsp_buf = NULL;
+ }
+@@ -4061,11 +4071,6 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
+ struct ibmvnic_login_buffer *login = adapter->login_buf;
+ int i;
+
+- dma_unmap_single(dev, adapter->login_buf_token, adapter->login_buf_sz,
+- DMA_TO_DEVICE);
+- dma_unmap_single(dev, adapter->login_rsp_buf_token,
+- adapter->login_rsp_buf_sz, DMA_FROM_DEVICE);
+-
+ /* If the number of queues requested can't be allocated by the
+ * server, the login response will return with code 1. We will need
+ * to resend the login buffer with fewer queues requested.
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index e61f02f7642ce..055664a26f7a8 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1654,7 +1654,7 @@ static bool tun_can_build_skb(struct tun_struct *tun, struct tun_file *tfile,
+ if (zerocopy)
+ return false;
+
+- if (SKB_DATA_ALIGN(len + TUN_RX_PAD) +
++ if (SKB_DATA_ALIGN(len + TUN_RX_PAD + XDP_PACKET_HEADROOM) +
+ SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) > PAGE_SIZE)
+ return false;
+
+diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
+index ac79f2088b316..480fc9bb4c903 100644
+--- a/drivers/scsi/53c700.c
++++ b/drivers/scsi/53c700.c
+@@ -1594,7 +1594,7 @@ NCR_700_intr(int irq, void *dev_id)
+ printk("scsi%d (%d:%d) PHASE MISMATCH IN SEND MESSAGE %d remain, return %p[%04x], phase %s\n", host->host_no, pun, lun, count, (void *)temp, temp - hostdata->pScript, sbcl_to_string(NCR_700_readb(host, SBCL_REG)));
+ #endif
+ resume_offset = hostdata->pScript + Ent_SendMessagePhaseMismatch;
+- } else if(dsp >= to32bit(&slot->pSG[0].ins) &&
++ } else if (slot && dsp >= to32bit(&slot->pSG[0].ins) &&
+ dsp <= to32bit(&slot->pSG[NCR_700_SG_SEGMENTS].ins)) {
+ int data_transfer = NCR_700_readl(host, DBC_REG) & 0xffffff;
+ int SGcount = (dsp - to32bit(&slot->pSG[0].ins))/sizeof(struct NCR_700_SG_List);
+diff --git a/drivers/scsi/raid_class.c b/drivers/scsi/raid_class.c
+index 5c3d6e1e0145e..cd0aba0d58b21 100644
+--- a/drivers/scsi/raid_class.c
++++ b/drivers/scsi/raid_class.c
+@@ -249,6 +249,7 @@ int raid_component_add(struct raid_template *r,struct device *raid_dev,
+ return 0;
+
+ err_out:
++ put_device(&rc->dev);
+ list_del(&rc->node);
+ rd->component_count--;
+ put_device(component_dev);
+diff --git a/drivers/scsi/scsi_proc.c b/drivers/scsi/scsi_proc.c
+index 7f0ceb65c3f39..99f472bb9f7e5 100644
+--- a/drivers/scsi/scsi_proc.c
++++ b/drivers/scsi/scsi_proc.c
+@@ -311,7 +311,7 @@ static ssize_t proc_scsi_write(struct file *file, const char __user *buf,
+ size_t length, loff_t *ppos)
+ {
+ int host, channel, id, lun;
+- char *buffer, *p;
++ char *buffer, *end, *p;
+ int err;
+
+ if (!buf || length > PAGE_SIZE)
+@@ -326,10 +326,14 @@ static ssize_t proc_scsi_write(struct file *file, const char __user *buf,
+ goto out;
+
+ err = -EINVAL;
+- if (length < PAGE_SIZE)
+- buffer[length] = '\0';
+- else if (buffer[PAGE_SIZE-1])
+- goto out;
++ if (length < PAGE_SIZE) {
++ end = buffer + length;
++ *end = '\0';
++ } else {
++ end = buffer + PAGE_SIZE - 1;
++ if (*end)
++ goto out;
++ }
+
+ /*
+ * Usage: echo "scsi add-single-device 0 1 2 3" >/proc/scsi/scsi
+@@ -338,10 +342,10 @@ static ssize_t proc_scsi_write(struct file *file, const char __user *buf,
+ if (!strncmp("scsi add-single-device", buffer, 22)) {
+ p = buffer + 23;
+
+- host = simple_strtoul(p, &p, 0);
+- channel = simple_strtoul(p + 1, &p, 0);
+- id = simple_strtoul(p + 1, &p, 0);
+- lun = simple_strtoul(p + 1, &p, 0);
++ host = (p < end) ? simple_strtoul(p, &p, 0) : 0;
++ channel = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
++ id = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
++ lun = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
+
+ err = scsi_add_single_device(host, channel, id, lun);
+
+@@ -352,10 +356,10 @@ static ssize_t proc_scsi_write(struct file *file, const char __user *buf,
+ } else if (!strncmp("scsi remove-single-device", buffer, 25)) {
+ p = buffer + 26;
+
+- host = simple_strtoul(p, &p, 0);
+- channel = simple_strtoul(p + 1, &p, 0);
+- id = simple_strtoul(p + 1, &p, 0);
+- lun = simple_strtoul(p + 1, &p, 0);
++ host = (p < end) ? simple_strtoul(p, &p, 0) : 0;
++ channel = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
++ id = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
++ lun = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0;
+
+ err = scsi_remove_single_device(host, channel, id, lun);
+ }
+diff --git a/drivers/scsi/snic/snic_disc.c b/drivers/scsi/snic/snic_disc.c
+index 69c5e26a9d5b3..388ba2ebcce52 100644
+--- a/drivers/scsi/snic/snic_disc.c
++++ b/drivers/scsi/snic/snic_disc.c
+@@ -316,6 +316,7 @@ snic_tgt_create(struct snic *snic, struct snic_tgt_id *tgtid)
+ "Snic Tgt: device_add, with err = %d\n",
+ ret);
+
++ put_device(&tgt->dev);
+ put_device(&snic->shost->shost_gendev);
+ spin_lock_irqsave(snic->shost->host_lock, flags);
+ list_del(&tgt->list);
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index f3701b4e374b6..a28eb91dc2f3a 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1540,10 +1540,6 @@ static int storvsc_host_reset_handler(struct scsi_cmnd *scmnd)
+ */
+ static enum blk_eh_timer_return storvsc_eh_timed_out(struct scsi_cmnd *scmnd)
+ {
+-#if IS_ENABLED(CONFIG_SCSI_FC_ATTRS)
+- if (scmnd->device->host->transportt == fc_transport_template)
+- return fc_eh_timed_out(scmnd);
+-#endif
+ return BLK_EH_RESET_TIMER;
+ }
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 4528852fd990e..e617a28aca436 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3234,9 +3234,14 @@ static irqreturn_t dwc3_check_event_buf(struct dwc3_event_buffer *evt)
+ u32 reg;
+
+ if (pm_runtime_suspended(dwc->dev)) {
++ dwc->pending_events = true;
++ /*
++ * Trigger runtime resume. The get() function will be balanced
++ * after processing the pending events in dwc3_process_pending
++ * events().
++ */
+ pm_runtime_get(dwc->dev);
+ disable_irq_nosync(dwc->irq_gadget);
+- dwc->pending_events = true;
+ return IRQ_HANDLED;
+ }
+
+@@ -3474,6 +3479,8 @@ void dwc3_gadget_process_pending_events(struct dwc3 *dwc)
+ {
+ if (dwc->pending_events) {
+ dwc3_interrupt(dwc->irq_gadget, dwc->ev_buf);
++ dwc3_thread_interrupt(dwc->irq_gadget, dwc->ev_buf);
++ pm_runtime_put(dwc->dev);
+ dwc->pending_events = false;
+ enable_irq(dwc->irq_gadget);
+ }
+diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
+index 6fcf5fd2ff987..50c8bd7cbfddb 100644
+--- a/drivers/usb/storage/alauda.c
++++ b/drivers/usb/storage/alauda.c
+@@ -317,7 +317,8 @@ static int alauda_get_media_status(struct us_data *us, unsigned char *data)
+ rc = usb_stor_ctrl_transfer(us, us->recv_ctrl_pipe,
+ command, 0xc0, 0, 1, data, 2);
+
+- usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
++ if (rc == USB_STOR_XFER_GOOD)
++ usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
+
+ return rc;
+ }
+@@ -453,10 +454,14 @@ static int alauda_init_media(struct us_data *us)
+ static int alauda_check_media(struct us_data *us)
+ {
+ struct alauda_info *info = (struct alauda_info *) us->extra;
+- unsigned char status[2];
++ unsigned char *status = us->iobuf;
+ int rc;
+
+ rc = alauda_get_media_status(us, status);
++ if (rc != USB_STOR_XFER_GOOD) {
++ status[0] = 0xF0; /* Pretend there's no media */
++ status[1] = 0;
++ }
+
+ /* Check for no media or door open */
+ if ((status[0] & 0x80) || ((status[0] & 0x1F) == 0x10)
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index dabf153843e90..504d63fb81fa1 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -3928,11 +3928,12 @@ retry:
+ free_extent_buffer(eb);
+
+ /*
+- * the filesystem may choose to bump up nr_to_write.
++ * The filesystem may choose to bump up nr_to_write.
+ * We have to make sure to honor the new nr_to_write
+- * at any time
++ * at any time.
+ */
+- nr_to_write_done = wbc->nr_to_write <= 0;
++ nr_to_write_done = (wbc->sync_mode == WB_SYNC_NONE &&
++ wbc->nr_to_write <= 0);
+ }
+ pagevec_release(&pvec);
+ cond_resched();
+diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
+index 53ec342eb787c..4eed9500f33a7 100644
+--- a/fs/nilfs2/inode.c
++++ b/fs/nilfs2/inode.c
+@@ -1112,9 +1112,17 @@ int nilfs_set_file_dirty(struct inode *inode, unsigned int nr_dirty)
+
+ int __nilfs_mark_inode_dirty(struct inode *inode, int flags)
+ {
++ struct the_nilfs *nilfs = inode->i_sb->s_fs_info;
+ struct buffer_head *ibh;
+ int err;
+
++ /*
++ * Do not dirty inodes after the log writer has been detached
++ * and its nilfs_root struct has been freed.
++ */
++ if (unlikely(nilfs_purging(nilfs)))
++ return 0;
++
+ err = nilfs_load_inode_block(inode, &ibh);
+ if (unlikely(err)) {
+ nilfs_msg(inode->i_sb, KERN_WARNING,
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index d9e0b2b2b5552..04e1e671b6134 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -2845,6 +2845,7 @@ void nilfs_detach_log_writer(struct super_block *sb)
+ nilfs_segctor_destroy(nilfs->ns_writer);
+ nilfs->ns_writer = NULL;
+ }
++ set_nilfs_purging(nilfs);
+
+ /* Force to free the list of dirty files */
+ spin_lock(&nilfs->ns_inode_lock);
+@@ -2857,4 +2858,5 @@ void nilfs_detach_log_writer(struct super_block *sb)
+ up_write(&nilfs->ns_segctor_sem);
+
+ nilfs_dispose_list(nilfs, &garbage_list, 1);
++ clear_nilfs_purging(nilfs);
+ }
+diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h
+index 380a543c5b19b..de6e24d80eb65 100644
+--- a/fs/nilfs2/the_nilfs.h
++++ b/fs/nilfs2/the_nilfs.h
+@@ -29,6 +29,7 @@ enum {
+ THE_NILFS_DISCONTINUED, /* 'next' pointer chain has broken */
+ THE_NILFS_GC_RUNNING, /* gc process is running */
+ THE_NILFS_SB_DIRTY, /* super block is dirty */
++ THE_NILFS_PURGING, /* disposing dirty files for cleanup */
+ };
+
+ /**
+@@ -208,6 +209,7 @@ THE_NILFS_FNS(INIT, init)
+ THE_NILFS_FNS(DISCONTINUED, discontinued)
+ THE_NILFS_FNS(GC_RUNNING, gc_running)
+ THE_NILFS_FNS(SB_DIRTY, sb_dirty)
++THE_NILFS_FNS(PURGING, purging)
+
+ /*
+ * Mount option operations
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index b96debd18e142..157b74fab8989 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -370,6 +370,9 @@ ieee80211_get_sband_iftype_data(const struct ieee80211_supported_band *sband,
+ if (WARN_ON(iftype >= NL80211_IFTYPE_MAX))
+ return NULL;
+
++ if (iftype == NL80211_IFTYPE_AP_VLAN)
++ iftype = NL80211_IFTYPE_AP;
++
+ for (i = 0; i < sband->n_iftype_data; i++) {
+ const struct ieee80211_sband_iftype_data *data =
+ &sband->iftype_data[i];
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 4719440873723..fd85286482c1e 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -992,6 +992,29 @@ int __nft_release_basechain(struct nft_ctx *ctx);
+
+ unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
+
++static inline bool nft_use_inc(u32 *use)
++{
++ if (*use == UINT_MAX)
++ return false;
++
++ (*use)++;
++
++ return true;
++}
++
++static inline void nft_use_dec(u32 *use)
++{
++ WARN_ON_ONCE((*use)-- == 0);
++}
++
++/* For error and abort path: restore use counter to previous state. */
++static inline void nft_use_inc_restore(u32 *use)
++{
++ WARN_ON_ONCE(!nft_use_inc(use));
++}
++
++#define nft_use_dec_restore nft_use_dec
++
+ /**
+ * struct nft_table - nf_tables table
+ *
+@@ -1050,8 +1073,8 @@ struct nft_object {
+ struct list_head list;
+ char *name;
+ struct nft_table *table;
+- u32 genmask:2,
+- use:30;
++ u32 genmask:2;
++ u32 use;
+ u64 handle;
+ /* runtime data below here */
+ const struct nft_object_ops *ops ____cacheline_aligned;
+@@ -1149,8 +1172,8 @@ struct nft_flowtable {
+ int hooknum;
+ int priority;
+ int ops_len;
+- u32 genmask:2,
+- use:30;
++ u32 genmask:2;
++ u32 use;
+ u64 handle;
+ /* runtime data below here */
+ struct nf_hook_ops *ops ____cacheline_aligned;
+@@ -1161,6 +1184,10 @@ struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
+ const struct nlattr *nla,
+ u8 genmask);
+
++void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
++ struct nft_flowtable *flowtable,
++ enum nft_trans_phase phase);
++
+ void nft_register_flowtable_type(struct nf_flowtable_type *type);
+ void nft_unregister_flowtable_type(struct nf_flowtable_type *type);
+
+diff --git a/net/dccp/output.c b/net/dccp/output.c
+index 91a15b3c4915a..d872dd1cfb5e0 100644
+--- a/net/dccp/output.c
++++ b/net/dccp/output.c
+@@ -189,7 +189,7 @@ unsigned int dccp_sync_mss(struct sock *sk, u32 pmtu)
+
+ /* And store cached results */
+ icsk->icsk_pmtu_cookie = pmtu;
+- dp->dccps_mss_cache = cur_mps;
++ WRITE_ONCE(dp->dccps_mss_cache, cur_mps);
+
+ return cur_mps;
+ }
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c
+index 673502779933c..27de4dc1ff512 100644
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -648,7 +648,7 @@ static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
+ return dccp_getsockopt_service(sk, len,
+ (__be32 __user *)optval, optlen);
+ case DCCP_SOCKOPT_GET_CUR_MPS:
+- val = dp->dccps_mss_cache;
++ val = READ_ONCE(dp->dccps_mss_cache);
+ break;
+ case DCCP_SOCKOPT_AVAILABLE_CCIDS:
+ return ccid_getsockopt_builtin_ccids(sk, len, optval, optlen);
+@@ -770,7 +770,7 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+
+ trace_dccp_probe(sk, len);
+
+- if (len > dp->dccps_mss_cache)
++ if (len > READ_ONCE(dp->dccps_mss_cache))
+ return -EMSGSIZE;
+
+ lock_sock(sk);
+@@ -803,6 +803,12 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ goto out_discard;
+ }
+
++ /* We need to check dccps_mss_cache after socket is locked. */
++ if (len > dp->dccps_mss_cache) {
++ rc = -EMSGSIZE;
++ goto out_discard;
++ }
++
+ skb_reserve(skb, sk->sk_prot->max_header);
+ rc = memcpy_from_msg(skb_put(skb, len), msg, len);
+ if (rc != 0)
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index 673a4a932f2a3..a640deb9ab14d 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -195,7 +195,8 @@ static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
+ static inline int ndisc_is_useropt(const struct net_device *dev,
+ struct nd_opt_hdr *opt)
+ {
+- return opt->nd_opt_type == ND_OPT_RDNSS ||
++ return opt->nd_opt_type == ND_OPT_PREFIX_INFO ||
++ opt->nd_opt_type == ND_OPT_RDNSS ||
+ opt->nd_opt_type == ND_OPT_DNSSL ||
+ ndisc_ops_is_useropt(dev, opt->nd_opt_type);
+ }
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 115bc79ec9055..eeadb638f4483 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -266,7 +266,7 @@ static int nft_delchain(struct nft_ctx *ctx)
+ if (err < 0)
+ return err;
+
+- ctx->table->use--;
++ nft_use_dec(&ctx->table->use);
+ nft_deactivate_next(ctx->net, ctx->chain);
+
+ return err;
+@@ -307,7 +307,7 @@ nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
+ /* You cannot delete the same rule twice */
+ if (nft_is_active_next(ctx->net, rule)) {
+ nft_deactivate_next(ctx->net, rule);
+- ctx->chain->use--;
++ nft_use_dec(&ctx->chain->use);
+ return 0;
+ }
+ return -ENOENT;
+@@ -396,7 +396,7 @@ static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
+ return err;
+
+ nft_deactivate_next(ctx->net, set);
+- ctx->table->use--;
++ nft_use_dec(&ctx->table->use);
+
+ return err;
+ }
+@@ -428,7 +428,7 @@ static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
+ return err;
+
+ nft_deactivate_next(ctx->net, obj);
+- ctx->table->use--;
++ nft_use_dec(&ctx->table->use);
+
+ return err;
+ }
+@@ -462,7 +462,7 @@ static int nft_delflowtable(struct nft_ctx *ctx,
+ return err;
+
+ nft_deactivate_next(ctx->net, flowtable);
+- ctx->table->use--;
++ nft_use_dec(&ctx->table->use);
+
+ return err;
+ }
+@@ -1660,9 +1660,6 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
+ struct nft_rule **rules;
+ int err;
+
+- if (table->use == UINT_MAX)
+- return -EOVERFLOW;
+-
+ if (nla[NFTA_CHAIN_HOOK]) {
+ struct nft_chain_hook hook;
+ struct nf_hook_ops *ops;
+@@ -1734,6 +1731,11 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
+ if (err < 0)
+ goto err1;
+
++ if (!nft_use_inc(&table->use)) {
++ err = -EMFILE;
++ goto err_use;
++ }
++
+ err = rhltable_insert_key(&table->chains_ht, chain->name,
+ &chain->rhlhead, nft_chain_ht_params);
+ if (err)
+@@ -1746,11 +1748,12 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
+ goto err2;
+ }
+
+- table->use++;
+ list_add_tail_rcu(&chain->list, &table->chains);
+
+ return 0;
+ err2:
++ nft_use_dec_restore(&table->use);
++err_use:
+ nf_tables_unregister_hook(net, table, chain);
+ err1:
+ nf_tables_chain_destroy(ctx);
+@@ -2692,9 +2695,6 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
+ return -EINVAL;
+ handle = nf_tables_alloc_handle(table);
+
+- if (chain->use == UINT_MAX)
+- return -EOVERFLOW;
+-
+ if (nla[NFTA_RULE_POSITION]) {
+ pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
+ old_rule = __nft_rule_lookup(chain, pos_handle);
+@@ -2770,23 +2770,28 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
+ expr = nft_expr_next(expr);
+ }
+
++ if (!nft_use_inc(&chain->use)) {
++ err = -EMFILE;
++ goto err2;
++ }
++
+ if (nlh->nlmsg_flags & NLM_F_REPLACE) {
+ trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
+ if (trans == NULL) {
+ err = -ENOMEM;
+- goto err2;
++ goto err_destroy_flow_rule;
+ }
+ err = nft_delrule(&ctx, old_rule);
+ if (err < 0) {
+ nft_trans_destroy(trans);
+- goto err2;
++ goto err_destroy_flow_rule;
+ }
+
+ list_add_tail_rcu(&rule->list, &old_rule->list);
+ } else {
+ if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
+ err = -ENOMEM;
+- goto err2;
++ goto err_destroy_flow_rule;
+ }
+
+ if (nlh->nlmsg_flags & NLM_F_APPEND) {
+@@ -2802,12 +2807,14 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
+ }
+ }
+ kvfree(info);
+- chain->use++;
+
+ if (nft_net->validate_state == NFT_VALIDATE_DO)
+ return nft_table_validate(net, table);
+
+ return 0;
++
++err_destroy_flow_rule:
++ nft_use_dec_restore(&chain->use);
+ err2:
+ nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE_ERROR);
+ nf_tables_rule_destroy(&ctx, rule);
+@@ -3625,10 +3632,15 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
+ if (ops->privsize != NULL)
+ size = ops->privsize(nla, &desc);
+
++ if (!nft_use_inc(&table->use)) {
++ err = -EMFILE;
++ goto err1;
++ }
++
+ set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
+ if (!set) {
+ err = -ENOMEM;
+- goto err1;
++ goto err_alloc;
+ }
+
+ name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
+@@ -3675,7 +3687,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
+ goto err4;
+
+ list_add_tail_rcu(&set->list, &table->sets);
+- table->use++;
++
+ return 0;
+
+ err4:
+@@ -3684,6 +3696,8 @@ err3:
+ kfree(set->name);
+ err2:
+ kvfree(set);
++err_alloc:
++ nft_use_dec_restore(&table->use);
+ err1:
+ module_put(to_set_type(ops)->owner);
+ return err;
+@@ -3770,9 +3784,6 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
+ struct nft_set_binding *i;
+ struct nft_set_iter iter;
+
+- if (set->use == UINT_MAX)
+- return -EOVERFLOW;
+-
+ if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
+ return -EBUSY;
+
+@@ -3797,10 +3808,12 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
+ return iter.err;
+ }
+ bind:
++ if (!nft_use_inc(&set->use))
++ return -EMFILE;
++
+ binding->chain = ctx->chain;
+ list_add_tail_rcu(&binding->list, &set->bindings);
+ nft_set_trans_bind(ctx, set);
+- set->use++;
+
+ return 0;
+ }
+@@ -3825,7 +3838,7 @@ void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set)
+ if (nft_set_is_anonymous(set))
+ nft_clear(ctx->net, set);
+
+- set->use++;
++ nft_use_inc_restore(&set->use);
+ }
+ EXPORT_SYMBOL_GPL(nf_tables_activate_set);
+
+@@ -3841,17 +3854,17 @@ void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
+ else
+ list_del_rcu(&binding->list);
+
+- set->use--;
++ nft_use_dec(&set->use);
+ break;
+ case NFT_TRANS_PREPARE:
+ if (nft_set_is_anonymous(set))
+ nft_deactivate_next(ctx->net, set);
+
+- set->use--;
++ nft_use_dec(&set->use);
+ return;
+ case NFT_TRANS_ABORT:
+ case NFT_TRANS_RELEASE:
+- set->use--;
++ nft_use_dec(&set->use);
+ /* fall through */
+ default:
+ nf_tables_unbind_set(ctx, set, binding,
+@@ -4433,7 +4446,7 @@ void nft_set_elem_destroy(const struct nft_set *set, void *elem,
+ }
+ }
+ if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
+- (*nft_set_ext_obj(ext))->use--;
++ nft_use_dec(&(*nft_set_ext_obj(ext))->use);
+ kfree(elem);
+ }
+ EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
+@@ -4542,8 +4555,16 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ set->objtype, genmask);
+ if (IS_ERR(obj)) {
+ err = PTR_ERR(obj);
++ obj = NULL;
++ goto err2;
++ }
++
++ if (!nft_use_inc(&obj->use)) {
++ err = -EMFILE;
++ obj = NULL;
+ goto err2;
+ }
++
+ nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
+ }
+
+@@ -4608,10 +4629,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ udata->len = ulen - 1;
+ nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
+ }
+- if (obj) {
++ if (obj)
+ *nft_set_ext_obj(ext) = obj;
+- obj->use++;
+- }
+
+ trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
+ if (trans == NULL)
+@@ -4657,13 +4676,14 @@ err6:
+ err5:
+ kfree(trans);
+ err4:
+- if (obj)
+- obj->use--;
+ kfree(elem.priv);
+ err3:
+ if (nla[NFTA_SET_ELEM_DATA] != NULL)
+ nft_data_release(&elem.data.val, desc.type);
+ err2:
++ if (obj)
++ nft_use_dec_restore(&obj->use);
++
+ nft_data_release(&elem.key.val, NFT_DATA_VALUE);
+ err1:
+ return err;
+@@ -4723,11 +4743,14 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
+ */
+ void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
+ {
++ struct nft_chain *chain;
++
+ if (type == NFT_DATA_VERDICT) {
+ switch (data->verdict.code) {
+ case NFT_JUMP:
+ case NFT_GOTO:
+- data->verdict.chain->use++;
++ chain = data->verdict.chain;
++ nft_use_inc_restore(&chain->use);
+ break;
+ }
+ }
+@@ -4742,7 +4765,7 @@ static void nft_set_elem_activate(const struct net *net,
+ if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
+ nft_data_hold(nft_set_ext_data(ext), set->dtype);
+ if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
+- (*nft_set_ext_obj(ext))->use++;
++ nft_use_inc_restore(&(*nft_set_ext_obj(ext))->use);
+ }
+
+ static void nft_set_elem_deactivate(const struct net *net,
+@@ -4754,7 +4777,7 @@ static void nft_set_elem_deactivate(const struct net *net,
+ if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
+ nft_data_release(nft_set_ext_data(ext), set->dtype);
+ if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
+- (*nft_set_ext_obj(ext))->use--;
++ nft_use_dec(&(*nft_set_ext_obj(ext))->use);
+ }
+
+ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
+@@ -5151,9 +5174,14 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
+
+ nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
+
++ if (!nft_use_inc(&table->use))
++ return -EMFILE;
++
+ type = nft_obj_type_get(net, objtype);
+- if (IS_ERR(type))
+- return PTR_ERR(type);
++ if (IS_ERR(type)) {
++ err = PTR_ERR(type);
++ goto err_type;
++ }
+
+ obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
+ if (IS_ERR(obj)) {
+@@ -5174,7 +5202,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
+ goto err3;
+
+ list_add_tail_rcu(&obj->list, &table->objects);
+- table->use++;
++
+ return 0;
+ err3:
+ kfree(obj->name);
+@@ -5184,6 +5212,9 @@ err2:
+ kfree(obj);
+ err1:
+ module_put(type->owner);
++err_type:
++ nft_use_dec_restore(&table->use);
++
+ return err;
+ }
+
+@@ -5519,6 +5550,22 @@ struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
+ }
+ EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
+
++void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
++ struct nft_flowtable *flowtable,
++ enum nft_trans_phase phase)
++{
++ switch (phase) {
++ case NFT_TRANS_PREPARE:
++ case NFT_TRANS_ABORT:
++ case NFT_TRANS_RELEASE:
++ nft_use_dec(&flowtable->use);
++ /* fall through */
++ default:
++ return;
++ }
++}
++EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable);
++
+ static struct nft_flowtable *
+ nft_flowtable_lookup_byhandle(const struct nft_table *table,
+ const struct nlattr *nla, u8 genmask)
+@@ -5718,9 +5765,14 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
+
+ nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
+
++ if (!nft_use_inc(&table->use))
++ return -EMFILE;
++
+ flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
+- if (!flowtable)
+- return -ENOMEM;
++ if (!flowtable) {
++ err = -ENOMEM;
++ goto flowtable_alloc;
++ }
+
+ flowtable->table = table;
+ flowtable->handle = nf_tables_alloc_handle(table);
+@@ -5774,7 +5826,6 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
+ goto err6;
+
+ list_add_tail_rcu(&flowtable->list, &table->flowtables);
+- table->use++;
+
+ return 0;
+ err6:
+@@ -5792,6 +5843,9 @@ err2:
+ kfree(flowtable->name);
+ err1:
+ kfree(flowtable);
++flowtable_alloc:
++ nft_use_dec_restore(&table->use);
++
+ return err;
+ }
+
+@@ -6666,7 +6720,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ */
+ if (nft_set_is_anonymous(nft_trans_set(trans)) &&
+ !list_empty(&nft_trans_set(trans)->bindings))
+- trans->ctx.table->use--;
++ nft_use_dec(&trans->ctx.table->use);
+
+ nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
+ NFT_MSG_NEWSET, GFP_KERNEL);
+@@ -6792,7 +6846,7 @@ static int __nf_tables_abort(struct net *net)
+ kfree(nft_trans_chain_name(trans));
+ nft_trans_destroy(trans);
+ } else {
+- trans->ctx.table->use--;
++ nft_use_dec_restore(&trans->ctx.table->use);
+ nft_chain_del(trans->ctx.chain);
+ nf_tables_unregister_hook(trans->ctx.net,
+ trans->ctx.table,
+@@ -6800,25 +6854,25 @@ static int __nf_tables_abort(struct net *net)
+ }
+ break;
+ case NFT_MSG_DELCHAIN:
+- trans->ctx.table->use++;
++ nft_use_inc_restore(&trans->ctx.table->use);
+ nft_clear(trans->ctx.net, trans->ctx.chain);
+ nft_trans_destroy(trans);
+ break;
+ case NFT_MSG_NEWRULE:
+- trans->ctx.chain->use--;
++ nft_use_dec_restore(&trans->ctx.chain->use);
+ list_del_rcu(&nft_trans_rule(trans)->list);
+ nft_rule_expr_deactivate(&trans->ctx,
+ nft_trans_rule(trans),
+ NFT_TRANS_ABORT);
+ break;
+ case NFT_MSG_DELRULE:
+- trans->ctx.chain->use++;
++ nft_use_inc_restore(&trans->ctx.chain->use);
+ nft_clear(trans->ctx.net, nft_trans_rule(trans));
+ nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
+ nft_trans_destroy(trans);
+ break;
+ case NFT_MSG_NEWSET:
+- trans->ctx.table->use--;
++ nft_use_dec_restore(&trans->ctx.table->use);
+ if (nft_trans_set_bound(trans)) {
+ nft_trans_destroy(trans);
+ break;
+@@ -6826,7 +6880,7 @@ static int __nf_tables_abort(struct net *net)
+ list_del_rcu(&nft_trans_set(trans)->list);
+ break;
+ case NFT_MSG_DELSET:
+- trans->ctx.table->use++;
++ nft_use_inc_restore(&trans->ctx.table->use);
+ nft_clear(trans->ctx.net, nft_trans_set(trans));
+ nft_trans_destroy(trans);
+ break;
+@@ -6849,22 +6903,22 @@ static int __nf_tables_abort(struct net *net)
+ nft_trans_destroy(trans);
+ break;
+ case NFT_MSG_NEWOBJ:
+- trans->ctx.table->use--;
++ nft_use_dec_restore(&trans->ctx.table->use);
+ list_del_rcu(&nft_trans_obj(trans)->list);
+ break;
+ case NFT_MSG_DELOBJ:
+- trans->ctx.table->use++;
++ nft_use_inc_restore(&trans->ctx.table->use);
+ nft_clear(trans->ctx.net, nft_trans_obj(trans));
+ nft_trans_destroy(trans);
+ break;
+ case NFT_MSG_NEWFLOWTABLE:
+- trans->ctx.table->use--;
++ nft_use_dec_restore(&trans->ctx.table->use);
+ list_del_rcu(&nft_trans_flowtable(trans)->list);
+ nft_unregister_flowtable_net_hooks(net,
+ nft_trans_flowtable(trans));
+ break;
+ case NFT_MSG_DELFLOWTABLE:
+- trans->ctx.table->use++;
++ nft_use_inc_restore(&trans->ctx.table->use);
+ nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
+ nft_trans_destroy(trans);
+ break;
+@@ -7278,8 +7332,9 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
+ return PTR_ERR(chain);
+ if (nft_is_base_chain(chain))
+ return -EOPNOTSUPP;
++ if (!nft_use_inc(&chain->use))
++ return -EMFILE;
+
+- chain->use++;
+ data->verdict.chain = chain;
+ break;
+ }
+@@ -7291,10 +7346,13 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
+
+ static void nft_verdict_uninit(const struct nft_data *data)
+ {
++ struct nft_chain *chain;
++
+ switch (data->verdict.code) {
+ case NFT_JUMP:
+ case NFT_GOTO:
+- data->verdict.chain->use--;
++ chain = data->verdict.chain;
++ nft_use_dec(&chain->use);
+ break;
+ }
+ }
+@@ -7447,11 +7505,11 @@ int __nft_release_basechain(struct nft_ctx *ctx)
+ nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
+ list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
+ list_del(&rule->list);
+- ctx->chain->use--;
++ nft_use_dec(&ctx->chain->use);
+ nf_tables_rule_release(ctx, rule);
+ }
+ nft_chain_del(ctx->chain);
+- ctx->table->use--;
++ nft_use_dec(&ctx->table->use);
+ nf_tables_chain_destroy(ctx);
+
+ return 0;
+@@ -7480,29 +7538,29 @@ static void __nft_release_table(struct net *net, struct nft_table *table)
+ ctx.chain = chain;
+ list_for_each_entry_safe(rule, nr, &chain->rules, list) {
+ list_del(&rule->list);
+- chain->use--;
++ nft_use_dec(&chain->use);
+ nf_tables_rule_release(&ctx, rule);
+ }
+ }
+ list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
+ list_del(&flowtable->list);
+- table->use--;
++ nft_use_dec(&table->use);
+ nf_tables_flowtable_destroy(flowtable);
+ }
+ list_for_each_entry_safe(set, ns, &table->sets, list) {
+ list_del(&set->list);
+- table->use--;
++ nft_use_dec(&table->use);
+ nft_set_destroy(set);
+ }
+ list_for_each_entry_safe(obj, ne, &table->objects, list) {
+ list_del(&obj->list);
+- table->use--;
++ nft_use_dec(&table->use);
+ nft_obj_destroy(&ctx, obj);
+ }
+ list_for_each_entry_safe(chain, nc, &table->chains, list) {
+ ctx.chain = chain;
+ nft_chain_del(chain);
+- table->use--;
++ nft_use_dec(&table->use);
+ nf_tables_chain_destroy(&ctx);
+ }
+ list_del(&table->list);
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 166edea0e4527..7055088e91c29 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -169,12 +169,31 @@ static int nft_flow_offload_init(const struct nft_ctx *ctx,
+ if (IS_ERR(flowtable))
+ return PTR_ERR(flowtable);
+
++ if (!nft_use_inc(&flowtable->use))
++ return -EMFILE;
++
+ priv->flowtable = flowtable;
+- flowtable->use++;
+
+ return nf_ct_netns_get(ctx->net, ctx->family);
+ }
+
++static void nft_flow_offload_deactivate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr,
++ enum nft_trans_phase phase)
++{
++ struct nft_flow_offload *priv = nft_expr_priv(expr);
++
++ nf_tables_deactivate_flowtable(ctx, priv->flowtable, phase);
++}
++
++static void nft_flow_offload_activate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ struct nft_flow_offload *priv = nft_expr_priv(expr);
++
++ nft_use_inc_restore(&priv->flowtable->use);
++}
++
+ static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
+ const struct nft_expr *expr)
+ {
+@@ -203,6 +222,8 @@ static const struct nft_expr_ops nft_flow_offload_ops = {
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_flow_offload)),
+ .eval = nft_flow_offload_eval,
+ .init = nft_flow_offload_init,
++ .activate = nft_flow_offload_activate,
++ .deactivate = nft_flow_offload_deactivate,
+ .destroy = nft_flow_offload_destroy,
+ .validate = nft_flow_offload_validate,
+ .dump = nft_flow_offload_dump,
+diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
+index 615f0fcf711c6..2401e9fa17c4f 100644
+--- a/net/netfilter/nft_objref.c
++++ b/net/netfilter/nft_objref.c
+@@ -43,8 +43,10 @@ static int nft_objref_init(const struct nft_ctx *ctx,
+ if (IS_ERR(obj))
+ return -ENOENT;
+
++ if (!nft_use_inc(&obj->use))
++ return -EMFILE;
++
+ nft_objref_priv(expr) = obj;
+- obj->use++;
+
+ return 0;
+ }
+@@ -73,7 +75,7 @@ static void nft_objref_deactivate(const struct nft_ctx *ctx,
+ if (phase == NFT_TRANS_COMMIT)
+ return;
+
+- obj->use--;
++ nft_use_dec(&obj->use);
+ }
+
+ static void nft_objref_activate(const struct nft_ctx *ctx,
+@@ -81,7 +83,7 @@ static void nft_objref_activate(const struct nft_ctx *ctx,
+ {
+ struct nft_object *obj = nft_objref_priv(expr);
+
+- obj->use++;
++ nft_use_inc_restore(&obj->use);
+ }
+
+ static struct nft_expr_type nft_objref_type;
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index fb165286e76dc..39ddfbda804eb 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -370,18 +370,20 @@ static void __packet_set_status(struct packet_sock *po, void *frame, int status)
+ {
+ union tpacket_uhdr h;
+
++ /* WRITE_ONCE() are paired with READ_ONCE() in __packet_get_status */
++
+ h.raw = frame;
+ switch (po->tp_version) {
+ case TPACKET_V1:
+- h.h1->tp_status = status;
++ WRITE_ONCE(h.h1->tp_status, status);
+ flush_dcache_page(pgv_to_page(&h.h1->tp_status));
+ break;
+ case TPACKET_V2:
+- h.h2->tp_status = status;
++ WRITE_ONCE(h.h2->tp_status, status);
+ flush_dcache_page(pgv_to_page(&h.h2->tp_status));
+ break;
+ case TPACKET_V3:
+- h.h3->tp_status = status;
++ WRITE_ONCE(h.h3->tp_status, status);
+ flush_dcache_page(pgv_to_page(&h.h3->tp_status));
+ break;
+ default:
+@@ -398,17 +400,19 @@ static int __packet_get_status(struct packet_sock *po, void *frame)
+
+ smp_rmb();
+
++ /* READ_ONCE() are paired with WRITE_ONCE() in __packet_set_status */
++
+ h.raw = frame;
+ switch (po->tp_version) {
+ case TPACKET_V1:
+ flush_dcache_page(pgv_to_page(&h.h1->tp_status));
+- return h.h1->tp_status;
++ return READ_ONCE(h.h1->tp_status);
+ case TPACKET_V2:
+ flush_dcache_page(pgv_to_page(&h.h2->tp_status));
+- return h.h2->tp_status;
++ return READ_ONCE(h.h2->tp_status);
+ case TPACKET_V3:
+ flush_dcache_page(pgv_to_page(&h.h3->tp_status));
+- return h.h3->tp_status;
++ return READ_ONCE(h.h3->tp_status);
+ default:
+ WARN(1, "TPACKET version not supported.\n");
+ BUG();
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 93548b9e07cf1..cf93dbe3d040c 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -748,12 +748,10 @@ static void dist_free(struct disttable *d)
+ * signed 16 bit values.
+ */
+
+-static int get_dist_table(struct Qdisc *sch, struct disttable **tbl,
+- const struct nlattr *attr)
++static int get_dist_table(struct disttable **tbl, const struct nlattr *attr)
+ {
+ size_t n = nla_len(attr)/sizeof(__s16);
+ const __s16 *data = nla_data(attr);
+- spinlock_t *root_lock;
+ struct disttable *d;
+ int i;
+
+@@ -768,13 +766,7 @@ static int get_dist_table(struct Qdisc *sch, struct disttable **tbl,
+ for (i = 0; i < n; i++)
+ d->table[i] = data[i];
+
+- root_lock = qdisc_root_sleeping_lock(sch);
+-
+- spin_lock_bh(root_lock);
+- swap(*tbl, d);
+- spin_unlock_bh(root_lock);
+-
+- dist_free(d);
++ *tbl = d;
+ return 0;
+ }
+
+@@ -930,6 +922,8 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,
+ {
+ struct netem_sched_data *q = qdisc_priv(sch);
+ struct nlattr *tb[TCA_NETEM_MAX + 1];
++ struct disttable *delay_dist = NULL;
++ struct disttable *slot_dist = NULL;
+ struct tc_netem_qopt *qopt;
+ struct clgstate old_clg;
+ int old_loss_model = CLG_RANDOM;
+@@ -943,6 +937,18 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,
+ if (ret < 0)
+ return ret;
+
++ if (tb[TCA_NETEM_DELAY_DIST]) {
++ ret = get_dist_table(&delay_dist, tb[TCA_NETEM_DELAY_DIST]);
++ if (ret)
++ goto table_free;
++ }
++
++ if (tb[TCA_NETEM_SLOT_DIST]) {
++ ret = get_dist_table(&slot_dist, tb[TCA_NETEM_SLOT_DIST]);
++ if (ret)
++ goto table_free;
++ }
++
+ sch_tree_lock(sch);
+ /* backup q->clg and q->loss_model */
+ old_clg = q->clg;
+@@ -952,26 +958,17 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,
+ ret = get_loss_clg(q, tb[TCA_NETEM_LOSS]);
+ if (ret) {
+ q->loss_model = old_loss_model;
++ q->clg = old_clg;
+ goto unlock;
+ }
+ } else {
+ q->loss_model = CLG_RANDOM;
+ }
+
+- if (tb[TCA_NETEM_DELAY_DIST]) {
+- ret = get_dist_table(sch, &q->delay_dist,
+- tb[TCA_NETEM_DELAY_DIST]);
+- if (ret)
+- goto get_table_failure;
+- }
+-
+- if (tb[TCA_NETEM_SLOT_DIST]) {
+- ret = get_dist_table(sch, &q->slot_dist,
+- tb[TCA_NETEM_SLOT_DIST]);
+- if (ret)
+- goto get_table_failure;
+- }
+-
++ if (delay_dist)
++ swap(q->delay_dist, delay_dist);
++ if (slot_dist)
++ swap(q->slot_dist, slot_dist);
+ sch->limit = qopt->limit;
+
+ q->latency = PSCHED_TICKS2NS(qopt->latency);
+@@ -1021,17 +1018,11 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,
+
+ unlock:
+ sch_tree_unlock(sch);
+- return ret;
+
+-get_table_failure:
+- /* recover clg and loss_model, in case of
+- * q->clg and q->loss_model were modified
+- * in get_loss_clg()
+- */
+- q->clg = old_clg;
+- q->loss_model = old_loss_model;
+-
+- goto unlock;
++table_free:
++ dist_free(delay_dist);
++ dist_free(slot_dist);
++ return ret;
+ }
+
+ static int netem_init(struct Qdisc *sch, struct nlattr *opt,
+diff --git a/tools/testing/radix-tree/regression1.c b/tools/testing/radix-tree/regression1.c
+index 0aece092f40eb..a247026042d44 100644
+--- a/tools/testing/radix-tree/regression1.c
++++ b/tools/testing/radix-tree/regression1.c
+@@ -198,7 +198,7 @@ void regression1_test(void)
+ nr_threads = 2;
+ pthread_barrier_init(&worker_barrier, NULL, nr_threads);
+
+- threads = malloc(nr_threads * sizeof(pthread_t *));
++ threads = malloc(nr_threads * sizeof(*threads));
+
+ for (i = 0; i < nr_threads; i++) {
+ arg = i;
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-08-30 15:00 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-08-30 15:00 UTC (permalink / raw
To: gentoo-commits
commit: 3cd4ba429f47b781ce5cd8d3e632fd2559a93374
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 30 15:00:40 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Aug 30 15:00:40 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3cd4ba42
Linux patch 4.19.292
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1292_linux-4.19.293.patch | 10805 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 10809 insertions(+)
diff --git a/0000_README b/0000_README
index cff17d32..a211d53c 100644
--- a/0000_README
+++ b/0000_README
@@ -1211,6 +1211,10 @@ Patch: 1291_linux-4.19.292.patch
From: https://www.kernel.org
Desc: Linux 4.19.292
+Patch: 1292_linux-4.19.293.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.293
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1292_linux-4.19.293.patch b/1292_linux-4.19.293.patch
new file mode 100644
index 00000000..3a139a99
--- /dev/null
+++ b/1292_linux-4.19.293.patch
@@ -0,0 +1,10805 @@
+diff --git a/Makefile b/Makefile
+index fcd6a9b173018..5965df0393fd3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 292
++SUBLEVEL = 293
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
+index 4e2ee743088fd..51faee4207454 100644
+--- a/arch/mips/include/asm/cpu-features.h
++++ b/arch/mips/include/asm/cpu-features.h
+@@ -111,7 +111,24 @@
+ #define cpu_has_tx39_cache __opt(MIPS_CPU_TX39_CACHE)
+ #endif
+ #ifndef cpu_has_octeon_cache
+-#define cpu_has_octeon_cache 0
++#define cpu_has_octeon_cache \
++({ \
++ int __res; \
++ \
++ switch (boot_cpu_type()) { \
++ case CPU_CAVIUM_OCTEON: \
++ case CPU_CAVIUM_OCTEON_PLUS: \
++ case CPU_CAVIUM_OCTEON2: \
++ case CPU_CAVIUM_OCTEON3: \
++ __res = 1; \
++ break; \
++ \
++ default: \
++ __res = 0; \
++ } \
++ \
++ __res; \
++})
+ #endif
+ /* Don't override `cpu_has_fpu' to 1 or the "nofpu" option won't work. */
+ #ifndef cpu_has_fpu
+@@ -332,7 +349,7 @@
+ ({ \
+ int __res; \
+ \
+- switch (current_cpu_type()) { \
++ switch (boot_cpu_type()) { \
+ case CPU_M14KC: \
+ case CPU_74K: \
+ case CPU_1074K: \
+diff --git a/arch/mips/include/asm/dec/prom.h b/arch/mips/include/asm/dec/prom.h
+index 09538ff5e9245..6f0405ba27d6d 100644
+--- a/arch/mips/include/asm/dec/prom.h
++++ b/arch/mips/include/asm/dec/prom.h
+@@ -74,7 +74,7 @@ static inline bool prom_is_rex(u32 magic)
+ */
+ typedef struct {
+ int pagesize;
+- unsigned char bitmap[0];
++ unsigned char bitmap[];
+ } memmap;
+
+
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index f0e09d5f0bedd..3be56d857d57f 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -181,6 +181,7 @@ config PPC
+ select HAVE_ARCH_SECCOMP_FILTER
+ select HAVE_ARCH_TRACEHOOK
+ select HAVE_CBPF_JIT if !PPC64
++ select HAVE_STACKPROTECTOR if $(cc-option,-mstack-protector-guard=tls) && PPC32
+ select HAVE_CONTEXT_TRACKING if PPC64
+ select HAVE_DEBUG_KMEMLEAK
+ select HAVE_DEBUG_STACKOVERFLOW
+diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
+index 923b3b794d13f..1f54bb93b5cc7 100644
+--- a/arch/powerpc/Kconfig.debug
++++ b/arch/powerpc/Kconfig.debug
+@@ -368,10 +368,6 @@ config PPC_PTDUMP
+
+ If you are unsure, say N.
+
+-config PPC_HTDUMP
+- def_bool y
+- depends on PPC_PTDUMP && PPC_BOOK3S_64
+-
+ config PPC_FAST_ENDIAN_SWITCH
+ bool "Deprecated fast endian-switch syscall"
+ depends on DEBUG_KERNEL && PPC_BOOK3S_64
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index b2e0fd8735627..daddada1a3902 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -113,6 +113,9 @@ KBUILD_LDFLAGS += -m elf$(BITS)$(LDEMULATION)
+ KBUILD_ARFLAGS += --target=elf$(BITS)-$(GNUTARGET)
+ endif
+
++cflags-$(CONFIG_STACKPROTECTOR) += -mstack-protector-guard=tls
++cflags-$(CONFIG_STACKPROTECTOR) += -mstack-protector-guard-reg=r2
++
+ LDFLAGS_vmlinux-y := -Bstatic
+ LDFLAGS_vmlinux-$(CONFIG_RELOCATABLE) := -pie
+ LDFLAGS_vmlinux := $(LDFLAGS_vmlinux-y)
+@@ -419,9 +422,12 @@ archclean:
+
+ archprepare: checkbin
+
+-# Use the file '.tmp_gas_check' for binutils tests, as gas won't output
+-# to stdout and these checks are run even on install targets.
+-TOUT := .tmp_gas_check
++ifdef CONFIG_STACKPROTECTOR
++prepare: stack_protector_prepare
++
++stack_protector_prepare: prepare0
++ $(eval KBUILD_CFLAGS += -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "TASK_CANARY") print $$3;}' include/generated/asm-offsets.h))
++endif
+
+ # Check toolchain versions:
+ # - gcc-4.6 is the minimum kernel-wide version so nothing required.
+@@ -433,7 +439,11 @@ checkbin:
+ echo -n '*** Please use a different binutils version.' ; \
+ false ; \
+ fi
+-
+-
+-CLEAN_FILES += $(TOUT)
+-
++ @if test "x${CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT}" = "xy" -a \
++ "x${CONFIG_LD_IS_BFD}" = "xy" -a \
++ "${CONFIG_LD_VERSION}" = "23700" ; then \
++ echo -n '*** binutils 2.37 drops unused section symbols, which recordmcount ' ; \
++ echo 'is unable to handle.' ; \
++ echo '*** Please use a different binutils version.' ; \
++ false ; \
++ fi
+diff --git a/arch/powerpc/include/asm/book3s/32/mmu-hash.h b/arch/powerpc/include/asm/book3s/32/mmu-hash.h
+index e38c91388c40f..958b18cecc96a 100644
+--- a/arch/powerpc/include/asm/book3s/32/mmu-hash.h
++++ b/arch/powerpc/include/asm/book3s/32/mmu-hash.h
+@@ -34,14 +34,20 @@
+ #define BAT_PHYS_ADDR(x) ((u32)((x & 0x00000000fffe0000ULL) | \
+ ((x & 0x0000000e00000000ULL) >> 24) | \
+ ((x & 0x0000000100000000ULL) >> 30)))
++#define PHYS_BAT_ADDR(x) (((u64)(x) & 0x00000000fffe0000ULL) | \
++ (((u64)(x) << 24) & 0x0000000e00000000ULL) | \
++ (((u64)(x) << 30) & 0x0000000100000000ULL))
+ #else
+ #define BAT_PHYS_ADDR(x) (x)
++#define PHYS_BAT_ADDR(x) ((x) & 0xfffe0000)
+ #endif
+
+ struct ppc_bat {
+ u32 batu;
+ u32 batl;
+ };
++
++typedef struct page *pgtable_t;
+ #endif /* !__ASSEMBLY__ */
+
+ /*
+diff --git a/arch/powerpc/include/asm/book3s/64/mmu.h b/arch/powerpc/include/asm/book3s/64/mmu.h
+index 9c8c669a6b6a3..488e7ed07e967 100644
+--- a/arch/powerpc/include/asm/book3s/64/mmu.h
++++ b/arch/powerpc/include/asm/book3s/64/mmu.h
+@@ -2,6 +2,8 @@
+ #ifndef _ASM_POWERPC_BOOK3S_64_MMU_H_
+ #define _ASM_POWERPC_BOOK3S_64_MMU_H_
+
++#include <asm/page.h>
++
+ #ifndef __ASSEMBLY__
+ /*
+ * Page size definition
+@@ -24,6 +26,13 @@ struct mmu_psize_def {
+ };
+ extern struct mmu_psize_def mmu_psize_defs[MMU_PAGE_COUNT];
+
++/*
++ * For BOOK3s 64 with 4k and 64K linux page size
++ * we want to use pointers, because the page table
++ * actually store pfn
++ */
++typedef pte_t *pgtable_t;
++
+ #endif /* __ASSEMBLY__ */
+
+ /* 64-bit classic hash table MMU */
+diff --git a/arch/powerpc/include/asm/mmu-40x.h b/arch/powerpc/include/asm/mmu-40x.h
+deleted file mode 100644
+index 74f4edb5916e4..0000000000000
+--- a/arch/powerpc/include/asm/mmu-40x.h
++++ /dev/null
+@@ -1,68 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _ASM_POWERPC_MMU_40X_H_
+-#define _ASM_POWERPC_MMU_40X_H_
+-
+-/*
+- * PPC40x support
+- */
+-
+-#define PPC40X_TLB_SIZE 64
+-
+-/*
+- * TLB entries are defined by a "high" tag portion and a "low" data
+- * portion. On all architectures, the data portion is 32-bits.
+- *
+- * TLB entries are managed entirely under software control by reading,
+- * writing, and searchoing using the 4xx-specific tlbre, tlbwr, and tlbsx
+- * instructions.
+- */
+-
+-#define TLB_LO 1
+-#define TLB_HI 0
+-
+-#define TLB_DATA TLB_LO
+-#define TLB_TAG TLB_HI
+-
+-/* Tag portion */
+-
+-#define TLB_EPN_MASK 0xFFFFFC00 /* Effective Page Number */
+-#define TLB_PAGESZ_MASK 0x00000380
+-#define TLB_PAGESZ(x) (((x) & 0x7) << 7)
+-#define PAGESZ_1K 0
+-#define PAGESZ_4K 1
+-#define PAGESZ_16K 2
+-#define PAGESZ_64K 3
+-#define PAGESZ_256K 4
+-#define PAGESZ_1M 5
+-#define PAGESZ_4M 6
+-#define PAGESZ_16M 7
+-#define TLB_VALID 0x00000040 /* Entry is valid */
+-
+-/* Data portion */
+-
+-#define TLB_RPN_MASK 0xFFFFFC00 /* Real Page Number */
+-#define TLB_PERM_MASK 0x00000300
+-#define TLB_EX 0x00000200 /* Instruction execution allowed */
+-#define TLB_WR 0x00000100 /* Writes permitted */
+-#define TLB_ZSEL_MASK 0x000000F0
+-#define TLB_ZSEL(x) (((x) & 0xF) << 4)
+-#define TLB_ATTR_MASK 0x0000000F
+-#define TLB_W 0x00000008 /* Caching is write-through */
+-#define TLB_I 0x00000004 /* Caching is inhibited */
+-#define TLB_M 0x00000002 /* Memory is coherent */
+-#define TLB_G 0x00000001 /* Memory is guarded from prefetch */
+-
+-#ifndef __ASSEMBLY__
+-
+-typedef struct {
+- unsigned int id;
+- unsigned int active;
+- unsigned long vdso_base;
+-} mm_context_t;
+-
+-#endif /* !__ASSEMBLY__ */
+-
+-#define mmu_virtual_psize MMU_PAGE_4K
+-#define mmu_linear_psize MMU_PAGE_256M
+-
+-#endif /* _ASM_POWERPC_MMU_40X_H_ */
+diff --git a/arch/powerpc/include/asm/mmu-44x.h b/arch/powerpc/include/asm/mmu-44x.h
+deleted file mode 100644
+index 295b3dbb2698b..0000000000000
+--- a/arch/powerpc/include/asm/mmu-44x.h
++++ /dev/null
+@@ -1,153 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _ASM_POWERPC_MMU_44X_H_
+-#define _ASM_POWERPC_MMU_44X_H_
+-/*
+- * PPC440 support
+- */
+-
+-#include <asm/asm-const.h>
+-
+-#define PPC44x_MMUCR_TID 0x000000ff
+-#define PPC44x_MMUCR_STS 0x00010000
+-
+-#define PPC44x_TLB_PAGEID 0
+-#define PPC44x_TLB_XLAT 1
+-#define PPC44x_TLB_ATTRIB 2
+-
+-/* Page identification fields */
+-#define PPC44x_TLB_EPN_MASK 0xfffffc00 /* Effective Page Number */
+-#define PPC44x_TLB_VALID 0x00000200 /* Valid flag */
+-#define PPC44x_TLB_TS 0x00000100 /* Translation address space */
+-#define PPC44x_TLB_1K 0x00000000 /* Page sizes */
+-#define PPC44x_TLB_4K 0x00000010
+-#define PPC44x_TLB_16K 0x00000020
+-#define PPC44x_TLB_64K 0x00000030
+-#define PPC44x_TLB_256K 0x00000040
+-#define PPC44x_TLB_1M 0x00000050
+-#define PPC44x_TLB_16M 0x00000070
+-#define PPC44x_TLB_256M 0x00000090
+-
+-/* Translation fields */
+-#define PPC44x_TLB_RPN_MASK 0xfffffc00 /* Real Page Number */
+-#define PPC44x_TLB_ERPN_MASK 0x0000000f
+-
+-/* Storage attribute and access control fields */
+-#define PPC44x_TLB_ATTR_MASK 0x0000ff80
+-#define PPC44x_TLB_U0 0x00008000 /* User 0 */
+-#define PPC44x_TLB_U1 0x00004000 /* User 1 */
+-#define PPC44x_TLB_U2 0x00002000 /* User 2 */
+-#define PPC44x_TLB_U3 0x00001000 /* User 3 */
+-#define PPC44x_TLB_W 0x00000800 /* Caching is write-through */
+-#define PPC44x_TLB_I 0x00000400 /* Caching is inhibited */
+-#define PPC44x_TLB_M 0x00000200 /* Memory is coherent */
+-#define PPC44x_TLB_G 0x00000100 /* Memory is guarded */
+-#define PPC44x_TLB_E 0x00000080 /* Memory is little endian */
+-
+-#define PPC44x_TLB_PERM_MASK 0x0000003f
+-#define PPC44x_TLB_UX 0x00000020 /* User execution */
+-#define PPC44x_TLB_UW 0x00000010 /* User write */
+-#define PPC44x_TLB_UR 0x00000008 /* User read */
+-#define PPC44x_TLB_SX 0x00000004 /* Super execution */
+-#define PPC44x_TLB_SW 0x00000002 /* Super write */
+-#define PPC44x_TLB_SR 0x00000001 /* Super read */
+-
+-/* Number of TLB entries */
+-#define PPC44x_TLB_SIZE 64
+-
+-/* 47x bits */
+-#define PPC47x_MMUCR_TID 0x0000ffff
+-#define PPC47x_MMUCR_STS 0x00010000
+-
+-/* Page identification fields */
+-#define PPC47x_TLB0_EPN_MASK 0xfffff000 /* Effective Page Number */
+-#define PPC47x_TLB0_VALID 0x00000800 /* Valid flag */
+-#define PPC47x_TLB0_TS 0x00000400 /* Translation address space */
+-#define PPC47x_TLB0_4K 0x00000000
+-#define PPC47x_TLB0_16K 0x00000010
+-#define PPC47x_TLB0_64K 0x00000030
+-#define PPC47x_TLB0_1M 0x00000070
+-#define PPC47x_TLB0_16M 0x000000f0
+-#define PPC47x_TLB0_256M 0x000001f0
+-#define PPC47x_TLB0_1G 0x000003f0
+-#define PPC47x_TLB0_BOLTED_R 0x00000008 /* tlbre only */
+-
+-/* Translation fields */
+-#define PPC47x_TLB1_RPN_MASK 0xfffff000 /* Real Page Number */
+-#define PPC47x_TLB1_ERPN_MASK 0x000003ff
+-
+-/* Storage attribute and access control fields */
+-#define PPC47x_TLB2_ATTR_MASK 0x0003ff80
+-#define PPC47x_TLB2_IL1I 0x00020000 /* Memory is guarded */
+-#define PPC47x_TLB2_IL1D 0x00010000 /* Memory is guarded */
+-#define PPC47x_TLB2_U0 0x00008000 /* User 0 */
+-#define PPC47x_TLB2_U1 0x00004000 /* User 1 */
+-#define PPC47x_TLB2_U2 0x00002000 /* User 2 */
+-#define PPC47x_TLB2_U3 0x00001000 /* User 3 */
+-#define PPC47x_TLB2_W 0x00000800 /* Caching is write-through */
+-#define PPC47x_TLB2_I 0x00000400 /* Caching is inhibited */
+-#define PPC47x_TLB2_M 0x00000200 /* Memory is coherent */
+-#define PPC47x_TLB2_G 0x00000100 /* Memory is guarded */
+-#define PPC47x_TLB2_E 0x00000080 /* Memory is little endian */
+-#define PPC47x_TLB2_PERM_MASK 0x0000003f
+-#define PPC47x_TLB2_UX 0x00000020 /* User execution */
+-#define PPC47x_TLB2_UW 0x00000010 /* User write */
+-#define PPC47x_TLB2_UR 0x00000008 /* User read */
+-#define PPC47x_TLB2_SX 0x00000004 /* Super execution */
+-#define PPC47x_TLB2_SW 0x00000002 /* Super write */
+-#define PPC47x_TLB2_SR 0x00000001 /* Super read */
+-#define PPC47x_TLB2_U_RWX (PPC47x_TLB2_UX|PPC47x_TLB2_UW|PPC47x_TLB2_UR)
+-#define PPC47x_TLB2_S_RWX (PPC47x_TLB2_SX|PPC47x_TLB2_SW|PPC47x_TLB2_SR)
+-#define PPC47x_TLB2_S_RW (PPC47x_TLB2_SW | PPC47x_TLB2_SR)
+-#define PPC47x_TLB2_IMG (PPC47x_TLB2_I | PPC47x_TLB2_M | PPC47x_TLB2_G)
+-
+-#ifndef __ASSEMBLY__
+-
+-extern unsigned int tlb_44x_hwater;
+-extern unsigned int tlb_44x_index;
+-
+-typedef struct {
+- unsigned int id;
+- unsigned int active;
+- unsigned long vdso_base;
+-} mm_context_t;
+-
+-#endif /* !__ASSEMBLY__ */
+-
+-#ifndef CONFIG_PPC_EARLY_DEBUG_44x
+-#define PPC44x_EARLY_TLBS 1
+-#else
+-#define PPC44x_EARLY_TLBS 2
+-#define PPC44x_EARLY_DEBUG_VIRTADDR (ASM_CONST(0xf0000000) \
+- | (ASM_CONST(CONFIG_PPC_EARLY_DEBUG_44x_PHYSLOW) & 0xffff))
+-#endif
+-
+-/* Size of the TLBs used for pinning in lowmem */
+-#define PPC_PIN_SIZE (1 << 28) /* 256M */
+-
+-#if defined(CONFIG_PPC_4K_PAGES)
+-#define PPC44x_TLBE_SIZE PPC44x_TLB_4K
+-#define PPC47x_TLBE_SIZE PPC47x_TLB0_4K
+-#define mmu_virtual_psize MMU_PAGE_4K
+-#elif defined(CONFIG_PPC_16K_PAGES)
+-#define PPC44x_TLBE_SIZE PPC44x_TLB_16K
+-#define PPC47x_TLBE_SIZE PPC47x_TLB0_16K
+-#define mmu_virtual_psize MMU_PAGE_16K
+-#elif defined(CONFIG_PPC_64K_PAGES)
+-#define PPC44x_TLBE_SIZE PPC44x_TLB_64K
+-#define PPC47x_TLBE_SIZE PPC47x_TLB0_64K
+-#define mmu_virtual_psize MMU_PAGE_64K
+-#elif defined(CONFIG_PPC_256K_PAGES)
+-#define PPC44x_TLBE_SIZE PPC44x_TLB_256K
+-#define mmu_virtual_psize MMU_PAGE_256K
+-#else
+-#error "Unsupported PAGE_SIZE"
+-#endif
+-
+-#define mmu_linear_psize MMU_PAGE_256M
+-
+-#define PPC44x_PGD_OFF_SHIFT (32 - PGDIR_SHIFT + PGD_T_LOG2)
+-#define PPC44x_PGD_OFF_MASK_BIT (PGDIR_SHIFT - PGD_T_LOG2)
+-#define PPC44x_PTE_ADD_SHIFT (32 - PGDIR_SHIFT + PTE_SHIFT + PTE_T_LOG2)
+-#define PPC44x_PTE_ADD_MASK_BIT (32 - PTE_T_LOG2 - PTE_SHIFT)
+-
+-#endif /* _ASM_POWERPC_MMU_44X_H_ */
+diff --git a/arch/powerpc/include/asm/mmu-8xx.h b/arch/powerpc/include/asm/mmu-8xx.h
+deleted file mode 100644
+index 193f53116c7ae..0000000000000
+--- a/arch/powerpc/include/asm/mmu-8xx.h
++++ /dev/null
+@@ -1,244 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _ASM_POWERPC_MMU_8XX_H_
+-#define _ASM_POWERPC_MMU_8XX_H_
+-/*
+- * PPC8xx support
+- */
+-
+-/* Control/status registers for the MPC8xx.
+- * A write operation to these registers causes serialized access.
+- * During software tablewalk, the registers used perform mask/shift-add
+- * operations when written/read. A TLB entry is created when the Mx_RPN
+- * is written, and the contents of several registers are used to
+- * create the entry.
+- */
+-#define SPRN_MI_CTR 784 /* Instruction TLB control register */
+-#define MI_GPM 0x80000000 /* Set domain manager mode */
+-#define MI_PPM 0x40000000 /* Set subpage protection */
+-#define MI_CIDEF 0x20000000 /* Set cache inhibit when MMU dis */
+-#define MI_RSV4I 0x08000000 /* Reserve 4 TLB entries */
+-#define MI_PPCS 0x02000000 /* Use MI_RPN prob/priv state */
+-#define MI_IDXMASK 0x00001f00 /* TLB index to be loaded */
+-#define MI_RESETVAL 0x00000000 /* Value of register at reset */
+-
+-/* These are the Ks and Kp from the PowerPC books. For proper operation,
+- * Ks = 0, Kp = 1.
+- */
+-#define SPRN_MI_AP 786
+-#define MI_Ks 0x80000000 /* Should not be set */
+-#define MI_Kp 0x40000000 /* Should always be set */
+-
+-/*
+- * All pages' PP data bits are set to either 001 or 011 by copying _PAGE_EXEC
+- * into bit 21 in the ITLBmiss handler (bit 21 is the middle bit), which means
+- * respectively NA for All or X for Supervisor and no access for User.
+- * Then we use the APG to say whether accesses are according to Page rules or
+- * "all Supervisor" rules (Access to all)
+- * Therefore, we define 2 APG groups. lsb is _PMD_USER
+- * 0 => No user => 01 (all accesses performed according to page definition)
+- * 1 => User => 00 (all accesses performed as supervisor iaw page definition)
+- * We define all 16 groups so that all other bits of APG can take any value
+- */
+-#define MI_APG_INIT 0x44444444
+-
+-/* The effective page number register. When read, contains the information
+- * about the last instruction TLB miss. When MI_RPN is written, bits in
+- * this register are used to create the TLB entry.
+- */
+-#define SPRN_MI_EPN 787
+-#define MI_EPNMASK 0xfffff000 /* Effective page number for entry */
+-#define MI_EVALID 0x00000200 /* Entry is valid */
+-#define MI_ASIDMASK 0x0000000f /* ASID match value */
+- /* Reset value is undefined */
+-
+-/* A "level 1" or "segment" or whatever you want to call it register.
+- * For the instruction TLB, it contains bits that get loaded into the
+- * TLB entry when the MI_RPN is written.
+- */
+-#define SPRN_MI_TWC 789
+-#define MI_APG 0x000001e0 /* Access protection group (0) */
+-#define MI_GUARDED 0x00000010 /* Guarded storage */
+-#define MI_PSMASK 0x0000000c /* Mask of page size bits */
+-#define MI_PS8MEG 0x0000000c /* 8M page size */
+-#define MI_PS512K 0x00000004 /* 512K page size */
+-#define MI_PS4K_16K 0x00000000 /* 4K or 16K page size */
+-#define MI_SVALID 0x00000001 /* Segment entry is valid */
+- /* Reset value is undefined */
+-
+-/* Real page number. Defined by the pte. Writing this register
+- * causes a TLB entry to be created for the instruction TLB, using
+- * additional information from the MI_EPN, and MI_TWC registers.
+- */
+-#define SPRN_MI_RPN 790
+-#define MI_SPS16K 0x00000008 /* Small page size (0 = 4k, 1 = 16k) */
+-
+-/* Define an RPN value for mapping kernel memory to large virtual
+- * pages for boot initialization. This has real page number of 0,
+- * large page size, shared page, cache enabled, and valid.
+- * Also mark all subpages valid and write access.
+- */
+-#define MI_BOOTINIT 0x000001fd
+-
+-#define SPRN_MD_CTR 792 /* Data TLB control register */
+-#define MD_GPM 0x80000000 /* Set domain manager mode */
+-#define MD_PPM 0x40000000 /* Set subpage protection */
+-#define MD_CIDEF 0x20000000 /* Set cache inhibit when MMU dis */
+-#define MD_WTDEF 0x10000000 /* Set writethrough when MMU dis */
+-#define MD_RSV4I 0x08000000 /* Reserve 4 TLB entries */
+-#define MD_TWAM 0x04000000 /* Use 4K page hardware assist */
+-#define MD_PPCS 0x02000000 /* Use MI_RPN prob/priv state */
+-#define MD_IDXMASK 0x00001f00 /* TLB index to be loaded */
+-#define MD_RESETVAL 0x04000000 /* Value of register at reset */
+-
+-#define SPRN_M_CASID 793 /* Address space ID (context) to match */
+-#define MC_ASIDMASK 0x0000000f /* Bits used for ASID value */
+-
+-
+-/* These are the Ks and Kp from the PowerPC books. For proper operation,
+- * Ks = 0, Kp = 1.
+- */
+-#define SPRN_MD_AP 794
+-#define MD_Ks 0x80000000 /* Should not be set */
+-#define MD_Kp 0x40000000 /* Should always be set */
+-
+-/*
+- * All pages' PP data bits are set to either 000 or 011 or 001, which means
+- * respectively RW for Supervisor and no access for User, or RO for
+- * Supervisor and no access for user and NA for ALL.
+- * Then we use the APG to say whether accesses are according to Page rules or
+- * "all Supervisor" rules (Access to all)
+- * Therefore, we define 2 APG groups. lsb is _PMD_USER
+- * 0 => No user => 01 (all accesses performed according to page definition)
+- * 1 => User => 00 (all accesses performed as supervisor iaw page definition)
+- * We define all 16 groups so that all other bits of APG can take any value
+- */
+-#define MD_APG_INIT 0x44444444
+-
+-/* The effective page number register. When read, contains the information
+- * about the last instruction TLB miss. When MD_RPN is written, bits in
+- * this register are used to create the TLB entry.
+- */
+-#define SPRN_MD_EPN 795
+-#define MD_EPNMASK 0xfffff000 /* Effective page number for entry */
+-#define MD_EVALID 0x00000200 /* Entry is valid */
+-#define MD_ASIDMASK 0x0000000f /* ASID match value */
+- /* Reset value is undefined */
+-
+-/* The pointer to the base address of the first level page table.
+- * During a software tablewalk, reading this register provides the address
+- * of the entry associated with MD_EPN.
+- */
+-#define SPRN_M_TWB 796
+-#define M_L1TB 0xfffff000 /* Level 1 table base address */
+-#define M_L1INDX 0x00000ffc /* Level 1 index, when read */
+- /* Reset value is undefined */
+-
+-/* A "level 1" or "segment" or whatever you want to call it register.
+- * For the data TLB, it contains bits that get loaded into the TLB entry
+- * when the MD_RPN is written. It is also provides the hardware assist
+- * for finding the PTE address during software tablewalk.
+- */
+-#define SPRN_MD_TWC 797
+-#define MD_L2TB 0xfffff000 /* Level 2 table base address */
+-#define MD_L2INDX 0xfffffe00 /* Level 2 index (*pte), when read */
+-#define MD_APG 0x000001e0 /* Access protection group (0) */
+-#define MD_GUARDED 0x00000010 /* Guarded storage */
+-#define MD_PSMASK 0x0000000c /* Mask of page size bits */
+-#define MD_PS8MEG 0x0000000c /* 8M page size */
+-#define MD_PS512K 0x00000004 /* 512K page size */
+-#define MD_PS4K_16K 0x00000000 /* 4K or 16K page size */
+-#define MD_WT 0x00000002 /* Use writethrough page attribute */
+-#define MD_SVALID 0x00000001 /* Segment entry is valid */
+- /* Reset value is undefined */
+-
+-
+-/* Real page number. Defined by the pte. Writing this register
+- * causes a TLB entry to be created for the data TLB, using
+- * additional information from the MD_EPN, and MD_TWC registers.
+- */
+-#define SPRN_MD_RPN 798
+-#define MD_SPS16K 0x00000008 /* Small page size (0 = 4k, 1 = 16k) */
+-
+-/* This is a temporary storage register that could be used to save
+- * a processor working register during a tablewalk.
+- */
+-#define SPRN_M_TW 799
+-
+-#ifdef CONFIG_PPC_MM_SLICES
+-#include <asm/nohash/32/slice.h>
+-#define SLICE_ARRAY_SIZE (1 << (32 - SLICE_LOW_SHIFT - 1))
+-#endif
+-
+-#ifndef __ASSEMBLY__
+-struct slice_mask {
+- u64 low_slices;
+- DECLARE_BITMAP(high_slices, 0);
+-};
+-
+-typedef struct {
+- unsigned int id;
+- unsigned int active;
+- unsigned long vdso_base;
+-#ifdef CONFIG_PPC_MM_SLICES
+- u16 user_psize; /* page size index */
+- unsigned char low_slices_psize[SLICE_ARRAY_SIZE];
+- unsigned char high_slices_psize[0];
+- unsigned long slb_addr_limit;
+- struct slice_mask mask_base_psize; /* 4k or 16k */
+-# ifdef CONFIG_HUGETLB_PAGE
+- struct slice_mask mask_512k;
+- struct slice_mask mask_8m;
+-# endif
+-#endif
+-} mm_context_t;
+-
+-#define PHYS_IMMR_BASE (mfspr(SPRN_IMMR) & 0xfff80000)
+-#define VIRT_IMMR_BASE (__fix_to_virt(FIX_IMMR_BASE))
+-
+-/* Page size definitions, common between 32 and 64-bit
+- *
+- * shift : is the "PAGE_SHIFT" value for that page size
+- * penc : is the pte encoding mask
+- *
+- */
+-struct mmu_psize_def {
+- unsigned int shift; /* number of bits */
+- unsigned int enc; /* PTE encoding */
+- unsigned int ind; /* Corresponding indirect page size shift */
+- unsigned int flags;
+-#define MMU_PAGE_SIZE_DIRECT 0x1 /* Supported as a direct size */
+-#define MMU_PAGE_SIZE_INDIRECT 0x2 /* Supported as an indirect size */
+-};
+-
+-extern struct mmu_psize_def mmu_psize_defs[MMU_PAGE_COUNT];
+-
+-static inline int shift_to_mmu_psize(unsigned int shift)
+-{
+- int psize;
+-
+- for (psize = 0; psize < MMU_PAGE_COUNT; ++psize)
+- if (mmu_psize_defs[psize].shift == shift)
+- return psize;
+- return -1;
+-}
+-
+-static inline unsigned int mmu_psize_to_shift(unsigned int mmu_psize)
+-{
+- if (mmu_psize_defs[mmu_psize].shift)
+- return mmu_psize_defs[mmu_psize].shift;
+- BUG();
+-}
+-
+-#endif /* !__ASSEMBLY__ */
+-
+-#if defined(CONFIG_PPC_4K_PAGES)
+-#define mmu_virtual_psize MMU_PAGE_4K
+-#elif defined(CONFIG_PPC_16K_PAGES)
+-#define mmu_virtual_psize MMU_PAGE_16K
+-#else
+-#error "Unsupported PAGE_SIZE"
+-#endif
+-
+-#define mmu_linear_psize MMU_PAGE_8M
+-
+-#endif /* _ASM_POWERPC_MMU_8XX_H_ */
+diff --git a/arch/powerpc/include/asm/mmu-book3e.h b/arch/powerpc/include/asm/mmu-book3e.h
+deleted file mode 100644
+index e20072972e359..0000000000000
+--- a/arch/powerpc/include/asm/mmu-book3e.h
++++ /dev/null
+@@ -1,313 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef _ASM_POWERPC_MMU_BOOK3E_H_
+-#define _ASM_POWERPC_MMU_BOOK3E_H_
+-/*
+- * Freescale Book-E/Book-3e (ISA 2.06+) MMU support
+- */
+-
+-/* Book-3e defined page sizes */
+-#define BOOK3E_PAGESZ_1K 0
+-#define BOOK3E_PAGESZ_2K 1
+-#define BOOK3E_PAGESZ_4K 2
+-#define BOOK3E_PAGESZ_8K 3
+-#define BOOK3E_PAGESZ_16K 4
+-#define BOOK3E_PAGESZ_32K 5
+-#define BOOK3E_PAGESZ_64K 6
+-#define BOOK3E_PAGESZ_128K 7
+-#define BOOK3E_PAGESZ_256K 8
+-#define BOOK3E_PAGESZ_512K 9
+-#define BOOK3E_PAGESZ_1M 10
+-#define BOOK3E_PAGESZ_2M 11
+-#define BOOK3E_PAGESZ_4M 12
+-#define BOOK3E_PAGESZ_8M 13
+-#define BOOK3E_PAGESZ_16M 14
+-#define BOOK3E_PAGESZ_32M 15
+-#define BOOK3E_PAGESZ_64M 16
+-#define BOOK3E_PAGESZ_128M 17
+-#define BOOK3E_PAGESZ_256M 18
+-#define BOOK3E_PAGESZ_512M 19
+-#define BOOK3E_PAGESZ_1GB 20
+-#define BOOK3E_PAGESZ_2GB 21
+-#define BOOK3E_PAGESZ_4GB 22
+-#define BOOK3E_PAGESZ_8GB 23
+-#define BOOK3E_PAGESZ_16GB 24
+-#define BOOK3E_PAGESZ_32GB 25
+-#define BOOK3E_PAGESZ_64GB 26
+-#define BOOK3E_PAGESZ_128GB 27
+-#define BOOK3E_PAGESZ_256GB 28
+-#define BOOK3E_PAGESZ_512GB 29
+-#define BOOK3E_PAGESZ_1TB 30
+-#define BOOK3E_PAGESZ_2TB 31
+-
+-/* MAS registers bit definitions */
+-
+-#define MAS0_TLBSEL_MASK 0x30000000
+-#define MAS0_TLBSEL_SHIFT 28
+-#define MAS0_TLBSEL(x) (((x) << MAS0_TLBSEL_SHIFT) & MAS0_TLBSEL_MASK)
+-#define MAS0_GET_TLBSEL(mas0) (((mas0) & MAS0_TLBSEL_MASK) >> \
+- MAS0_TLBSEL_SHIFT)
+-#define MAS0_ESEL_MASK 0x0FFF0000
+-#define MAS0_ESEL_SHIFT 16
+-#define MAS0_ESEL(x) (((x) << MAS0_ESEL_SHIFT) & MAS0_ESEL_MASK)
+-#define MAS0_NV(x) ((x) & 0x00000FFF)
+-#define MAS0_HES 0x00004000
+-#define MAS0_WQ_ALLWAYS 0x00000000
+-#define MAS0_WQ_COND 0x00001000
+-#define MAS0_WQ_CLR_RSRV 0x00002000
+-
+-#define MAS1_VALID 0x80000000
+-#define MAS1_IPROT 0x40000000
+-#define MAS1_TID(x) (((x) << 16) & 0x3FFF0000)
+-#define MAS1_IND 0x00002000
+-#define MAS1_TS 0x00001000
+-#define MAS1_TSIZE_MASK 0x00000f80
+-#define MAS1_TSIZE_SHIFT 7
+-#define MAS1_TSIZE(x) (((x) << MAS1_TSIZE_SHIFT) & MAS1_TSIZE_MASK)
+-#define MAS1_GET_TSIZE(mas1) (((mas1) & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT)
+-
+-#define MAS2_EPN (~0xFFFUL)
+-#define MAS2_X0 0x00000040
+-#define MAS2_X1 0x00000020
+-#define MAS2_W 0x00000010
+-#define MAS2_I 0x00000008
+-#define MAS2_M 0x00000004
+-#define MAS2_G 0x00000002
+-#define MAS2_E 0x00000001
+-#define MAS2_WIMGE_MASK 0x0000001f
+-#define MAS2_EPN_MASK(size) (~0 << (size + 10))
+-#define MAS2_VAL(addr, size, flags) ((addr) & MAS2_EPN_MASK(size) | (flags))
+-
+-#define MAS3_RPN 0xFFFFF000
+-#define MAS3_U0 0x00000200
+-#define MAS3_U1 0x00000100
+-#define MAS3_U2 0x00000080
+-#define MAS3_U3 0x00000040
+-#define MAS3_UX 0x00000020
+-#define MAS3_SX 0x00000010
+-#define MAS3_UW 0x00000008
+-#define MAS3_SW 0x00000004
+-#define MAS3_UR 0x00000002
+-#define MAS3_SR 0x00000001
+-#define MAS3_BAP_MASK 0x0000003f
+-#define MAS3_SPSIZE 0x0000003e
+-#define MAS3_SPSIZE_SHIFT 1
+-
+-#define MAS4_TLBSEL_MASK MAS0_TLBSEL_MASK
+-#define MAS4_TLBSELD(x) MAS0_TLBSEL(x)
+-#define MAS4_INDD 0x00008000 /* Default IND */
+-#define MAS4_TSIZED(x) MAS1_TSIZE(x)
+-#define MAS4_X0D 0x00000040
+-#define MAS4_X1D 0x00000020
+-#define MAS4_WD 0x00000010
+-#define MAS4_ID 0x00000008
+-#define MAS4_MD 0x00000004
+-#define MAS4_GD 0x00000002
+-#define MAS4_ED 0x00000001
+-#define MAS4_WIMGED_MASK 0x0000001f /* Default WIMGE */
+-#define MAS4_WIMGED_SHIFT 0
+-#define MAS4_VLED MAS4_X1D /* Default VLE */
+-#define MAS4_ACMD 0x000000c0 /* Default ACM */
+-#define MAS4_ACMD_SHIFT 6
+-#define MAS4_TSIZED_MASK 0x00000f80 /* Default TSIZE */
+-#define MAS4_TSIZED_SHIFT 7
+-
+-#define MAS5_SGS 0x80000000
+-
+-#define MAS6_SPID0 0x3FFF0000
+-#define MAS6_SPID1 0x00007FFE
+-#define MAS6_ISIZE(x) MAS1_TSIZE(x)
+-#define MAS6_SAS 0x00000001
+-#define MAS6_SPID MAS6_SPID0
+-#define MAS6_SIND 0x00000002 /* Indirect page */
+-#define MAS6_SIND_SHIFT 1
+-#define MAS6_SPID_MASK 0x3fff0000
+-#define MAS6_SPID_SHIFT 16
+-#define MAS6_ISIZE_MASK 0x00000f80
+-#define MAS6_ISIZE_SHIFT 7
+-
+-#define MAS7_RPN 0xFFFFFFFF
+-
+-#define MAS8_TGS 0x80000000 /* Guest space */
+-#define MAS8_VF 0x40000000 /* Virtualization Fault */
+-#define MAS8_TLPID 0x000000ff
+-
+-/* Bit definitions for MMUCFG */
+-#define MMUCFG_MAVN 0x00000003 /* MMU Architecture Version Number */
+-#define MMUCFG_MAVN_V1 0x00000000 /* v1.0 */
+-#define MMUCFG_MAVN_V2 0x00000001 /* v2.0 */
+-#define MMUCFG_NTLBS 0x0000000c /* Number of TLBs */
+-#define MMUCFG_PIDSIZE 0x000007c0 /* PID Reg Size */
+-#define MMUCFG_TWC 0x00008000 /* TLB Write Conditional (v2.0) */
+-#define MMUCFG_LRAT 0x00010000 /* LRAT Supported (v2.0) */
+-#define MMUCFG_RASIZE 0x00fe0000 /* Real Addr Size */
+-#define MMUCFG_LPIDSIZE 0x0f000000 /* LPID Reg Size */
+-
+-/* Bit definitions for MMUCSR0 */
+-#define MMUCSR0_TLB1FI 0x00000002 /* TLB1 Flash invalidate */
+-#define MMUCSR0_TLB0FI 0x00000004 /* TLB0 Flash invalidate */
+-#define MMUCSR0_TLB2FI 0x00000040 /* TLB2 Flash invalidate */
+-#define MMUCSR0_TLB3FI 0x00000020 /* TLB3 Flash invalidate */
+-#define MMUCSR0_TLBFI (MMUCSR0_TLB0FI | MMUCSR0_TLB1FI | \
+- MMUCSR0_TLB2FI | MMUCSR0_TLB3FI)
+-#define MMUCSR0_TLB0PS 0x00000780 /* TLB0 Page Size */
+-#define MMUCSR0_TLB1PS 0x00007800 /* TLB1 Page Size */
+-#define MMUCSR0_TLB2PS 0x00078000 /* TLB2 Page Size */
+-#define MMUCSR0_TLB3PS 0x00780000 /* TLB3 Page Size */
+-
+-/* MMUCFG bits */
+-#define MMUCFG_MAVN_NASK 0x00000003
+-#define MMUCFG_MAVN_V1_0 0x00000000
+-#define MMUCFG_MAVN_V2_0 0x00000001
+-#define MMUCFG_NTLB_MASK 0x0000000c
+-#define MMUCFG_NTLB_SHIFT 2
+-#define MMUCFG_PIDSIZE_MASK 0x000007c0
+-#define MMUCFG_PIDSIZE_SHIFT 6
+-#define MMUCFG_TWC 0x00008000
+-#define MMUCFG_LRAT 0x00010000
+-#define MMUCFG_RASIZE_MASK 0x00fe0000
+-#define MMUCFG_RASIZE_SHIFT 17
+-#define MMUCFG_LPIDSIZE_MASK 0x0f000000
+-#define MMUCFG_LPIDSIZE_SHIFT 24
+-
+-/* TLBnCFG encoding */
+-#define TLBnCFG_N_ENTRY 0x00000fff /* number of entries */
+-#define TLBnCFG_HES 0x00002000 /* HW select supported */
+-#define TLBnCFG_IPROT 0x00008000 /* IPROT supported */
+-#define TLBnCFG_GTWE 0x00010000 /* Guest can write */
+-#define TLBnCFG_IND 0x00020000 /* IND entries supported */
+-#define TLBnCFG_PT 0x00040000 /* Can load from page table */
+-#define TLBnCFG_MINSIZE 0x00f00000 /* Minimum Page Size (v1.0) */
+-#define TLBnCFG_MINSIZE_SHIFT 20
+-#define TLBnCFG_MAXSIZE 0x000f0000 /* Maximum Page Size (v1.0) */
+-#define TLBnCFG_MAXSIZE_SHIFT 16
+-#define TLBnCFG_ASSOC 0xff000000 /* Associativity */
+-#define TLBnCFG_ASSOC_SHIFT 24
+-
+-/* TLBnPS encoding */
+-#define TLBnPS_4K 0x00000004
+-#define TLBnPS_8K 0x00000008
+-#define TLBnPS_16K 0x00000010
+-#define TLBnPS_32K 0x00000020
+-#define TLBnPS_64K 0x00000040
+-#define TLBnPS_128K 0x00000080
+-#define TLBnPS_256K 0x00000100
+-#define TLBnPS_512K 0x00000200
+-#define TLBnPS_1M 0x00000400
+-#define TLBnPS_2M 0x00000800
+-#define TLBnPS_4M 0x00001000
+-#define TLBnPS_8M 0x00002000
+-#define TLBnPS_16M 0x00004000
+-#define TLBnPS_32M 0x00008000
+-#define TLBnPS_64M 0x00010000
+-#define TLBnPS_128M 0x00020000
+-#define TLBnPS_256M 0x00040000
+-#define TLBnPS_512M 0x00080000
+-#define TLBnPS_1G 0x00100000
+-#define TLBnPS_2G 0x00200000
+-#define TLBnPS_4G 0x00400000
+-#define TLBnPS_8G 0x00800000
+-#define TLBnPS_16G 0x01000000
+-#define TLBnPS_32G 0x02000000
+-#define TLBnPS_64G 0x04000000
+-#define TLBnPS_128G 0x08000000
+-#define TLBnPS_256G 0x10000000
+-
+-/* tlbilx action encoding */
+-#define TLBILX_T_ALL 0
+-#define TLBILX_T_TID 1
+-#define TLBILX_T_FULLMATCH 3
+-#define TLBILX_T_CLASS0 4
+-#define TLBILX_T_CLASS1 5
+-#define TLBILX_T_CLASS2 6
+-#define TLBILX_T_CLASS3 7
+-
+-#ifndef __ASSEMBLY__
+-#include <asm/bug.h>
+-
+-extern unsigned int tlbcam_index;
+-
+-typedef struct {
+- unsigned int id;
+- unsigned int active;
+- unsigned long vdso_base;
+-} mm_context_t;
+-
+-/* Page size definitions, common between 32 and 64-bit
+- *
+- * shift : is the "PAGE_SHIFT" value for that page size
+- * penc : is the pte encoding mask
+- *
+- */
+-struct mmu_psize_def
+-{
+- unsigned int shift; /* number of bits */
+- unsigned int enc; /* PTE encoding */
+- unsigned int ind; /* Corresponding indirect page size shift */
+- unsigned int flags;
+-#define MMU_PAGE_SIZE_DIRECT 0x1 /* Supported as a direct size */
+-#define MMU_PAGE_SIZE_INDIRECT 0x2 /* Supported as an indirect size */
+-};
+-extern struct mmu_psize_def mmu_psize_defs[MMU_PAGE_COUNT];
+-
+-static inline int shift_to_mmu_psize(unsigned int shift)
+-{
+- int psize;
+-
+- for (psize = 0; psize < MMU_PAGE_COUNT; ++psize)
+- if (mmu_psize_defs[psize].shift == shift)
+- return psize;
+- return -1;
+-}
+-
+-static inline unsigned int mmu_psize_to_shift(unsigned int mmu_psize)
+-{
+- if (mmu_psize_defs[mmu_psize].shift)
+- return mmu_psize_defs[mmu_psize].shift;
+- BUG();
+-}
+-
+-/* The page sizes use the same names as 64-bit hash but are
+- * constants
+- */
+-#if defined(CONFIG_PPC_4K_PAGES)
+-#define mmu_virtual_psize MMU_PAGE_4K
+-#else
+-#error Unsupported page size
+-#endif
+-
+-extern int mmu_linear_psize;
+-extern int mmu_vmemmap_psize;
+-
+-struct tlb_core_data {
+- /*
+- * Per-core spinlock for e6500 TLB handlers (no tlbsrx.)
+- * Must be the first struct element.
+- */
+- u8 lock;
+-
+- /* For software way selection, as on Freescale TLB1 */
+- u8 esel_next, esel_max, esel_first;
+-};
+-
+-#ifdef CONFIG_PPC64
+-extern unsigned long linear_map_top;
+-extern int book3e_htw_mode;
+-
+-#define PPC_HTW_NONE 0
+-#define PPC_HTW_IBM 1
+-#define PPC_HTW_E6500 2
+-
+-/*
+- * 64-bit booke platforms don't load the tlb in the tlb miss handler code.
+- * HUGETLB_NEED_PRELOAD handles this - it causes huge_ptep_set_access_flags to
+- * return 1, indicating that the tlb requires preloading.
+- */
+-#define HUGETLB_NEED_PRELOAD
+-
+-#define mmu_cleanup_all NULL
+-
+-#endif
+-
+-#endif /* !__ASSEMBLY__ */
+-
+-#endif /* _ASM_POWERPC_MMU_BOOK3E_H_ */
+diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
+index 13ea441ac5319..2b396de45e9ec 100644
+--- a/arch/powerpc/include/asm/mmu.h
++++ b/arch/powerpc/include/asm/mmu.h
+@@ -326,18 +326,8 @@ static inline void mmu_early_init_devtree(void) { }
+ #if defined(CONFIG_PPC_STD_MMU_32)
+ /* 32-bit classic hash table MMU */
+ #include <asm/book3s/32/mmu-hash.h>
+-#elif defined(CONFIG_40x)
+-/* 40x-style software loaded TLB */
+-# include <asm/mmu-40x.h>
+-#elif defined(CONFIG_44x)
+-/* 44x-style software loaded TLB */
+-# include <asm/mmu-44x.h>
+-#elif defined(CONFIG_PPC_BOOK3E_MMU)
+-/* Freescale Book-E software loaded TLB or Book-3e (ISA 2.06+) MMU */
+-# include <asm/mmu-book3e.h>
+-#elif defined (CONFIG_PPC_8xx)
+-/* Motorola/Freescale 8xx software loaded TLB */
+-# include <asm/mmu-8xx.h>
++#elif defined(CONFIG_PPC_MMU_NOHASH)
++#include <asm/nohash/mmu.h>
+ #endif
+
+ #endif /* __KERNEL__ */
+diff --git a/arch/powerpc/include/asm/nohash/32/mmu-40x.h b/arch/powerpc/include/asm/nohash/32/mmu-40x.h
+new file mode 100644
+index 0000000000000..74f4edb5916e4
+--- /dev/null
++++ b/arch/powerpc/include/asm/nohash/32/mmu-40x.h
+@@ -0,0 +1,68 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_POWERPC_MMU_40X_H_
++#define _ASM_POWERPC_MMU_40X_H_
++
++/*
++ * PPC40x support
++ */
++
++#define PPC40X_TLB_SIZE 64
++
++/*
++ * TLB entries are defined by a "high" tag portion and a "low" data
++ * portion. On all architectures, the data portion is 32-bits.
++ *
++ * TLB entries are managed entirely under software control by reading,
++ * writing, and searchoing using the 4xx-specific tlbre, tlbwr, and tlbsx
++ * instructions.
++ */
++
++#define TLB_LO 1
++#define TLB_HI 0
++
++#define TLB_DATA TLB_LO
++#define TLB_TAG TLB_HI
++
++/* Tag portion */
++
++#define TLB_EPN_MASK 0xFFFFFC00 /* Effective Page Number */
++#define TLB_PAGESZ_MASK 0x00000380
++#define TLB_PAGESZ(x) (((x) & 0x7) << 7)
++#define PAGESZ_1K 0
++#define PAGESZ_4K 1
++#define PAGESZ_16K 2
++#define PAGESZ_64K 3
++#define PAGESZ_256K 4
++#define PAGESZ_1M 5
++#define PAGESZ_4M 6
++#define PAGESZ_16M 7
++#define TLB_VALID 0x00000040 /* Entry is valid */
++
++/* Data portion */
++
++#define TLB_RPN_MASK 0xFFFFFC00 /* Real Page Number */
++#define TLB_PERM_MASK 0x00000300
++#define TLB_EX 0x00000200 /* Instruction execution allowed */
++#define TLB_WR 0x00000100 /* Writes permitted */
++#define TLB_ZSEL_MASK 0x000000F0
++#define TLB_ZSEL(x) (((x) & 0xF) << 4)
++#define TLB_ATTR_MASK 0x0000000F
++#define TLB_W 0x00000008 /* Caching is write-through */
++#define TLB_I 0x00000004 /* Caching is inhibited */
++#define TLB_M 0x00000002 /* Memory is coherent */
++#define TLB_G 0x00000001 /* Memory is guarded from prefetch */
++
++#ifndef __ASSEMBLY__
++
++typedef struct {
++ unsigned int id;
++ unsigned int active;
++ unsigned long vdso_base;
++} mm_context_t;
++
++#endif /* !__ASSEMBLY__ */
++
++#define mmu_virtual_psize MMU_PAGE_4K
++#define mmu_linear_psize MMU_PAGE_256M
++
++#endif /* _ASM_POWERPC_MMU_40X_H_ */
+diff --git a/arch/powerpc/include/asm/nohash/32/mmu-44x.h b/arch/powerpc/include/asm/nohash/32/mmu-44x.h
+new file mode 100644
+index 0000000000000..295b3dbb2698b
+--- /dev/null
++++ b/arch/powerpc/include/asm/nohash/32/mmu-44x.h
+@@ -0,0 +1,153 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_POWERPC_MMU_44X_H_
++#define _ASM_POWERPC_MMU_44X_H_
++/*
++ * PPC440 support
++ */
++
++#include <asm/asm-const.h>
++
++#define PPC44x_MMUCR_TID 0x000000ff
++#define PPC44x_MMUCR_STS 0x00010000
++
++#define PPC44x_TLB_PAGEID 0
++#define PPC44x_TLB_XLAT 1
++#define PPC44x_TLB_ATTRIB 2
++
++/* Page identification fields */
++#define PPC44x_TLB_EPN_MASK 0xfffffc00 /* Effective Page Number */
++#define PPC44x_TLB_VALID 0x00000200 /* Valid flag */
++#define PPC44x_TLB_TS 0x00000100 /* Translation address space */
++#define PPC44x_TLB_1K 0x00000000 /* Page sizes */
++#define PPC44x_TLB_4K 0x00000010
++#define PPC44x_TLB_16K 0x00000020
++#define PPC44x_TLB_64K 0x00000030
++#define PPC44x_TLB_256K 0x00000040
++#define PPC44x_TLB_1M 0x00000050
++#define PPC44x_TLB_16M 0x00000070
++#define PPC44x_TLB_256M 0x00000090
++
++/* Translation fields */
++#define PPC44x_TLB_RPN_MASK 0xfffffc00 /* Real Page Number */
++#define PPC44x_TLB_ERPN_MASK 0x0000000f
++
++/* Storage attribute and access control fields */
++#define PPC44x_TLB_ATTR_MASK 0x0000ff80
++#define PPC44x_TLB_U0 0x00008000 /* User 0 */
++#define PPC44x_TLB_U1 0x00004000 /* User 1 */
++#define PPC44x_TLB_U2 0x00002000 /* User 2 */
++#define PPC44x_TLB_U3 0x00001000 /* User 3 */
++#define PPC44x_TLB_W 0x00000800 /* Caching is write-through */
++#define PPC44x_TLB_I 0x00000400 /* Caching is inhibited */
++#define PPC44x_TLB_M 0x00000200 /* Memory is coherent */
++#define PPC44x_TLB_G 0x00000100 /* Memory is guarded */
++#define PPC44x_TLB_E 0x00000080 /* Memory is little endian */
++
++#define PPC44x_TLB_PERM_MASK 0x0000003f
++#define PPC44x_TLB_UX 0x00000020 /* User execution */
++#define PPC44x_TLB_UW 0x00000010 /* User write */
++#define PPC44x_TLB_UR 0x00000008 /* User read */
++#define PPC44x_TLB_SX 0x00000004 /* Super execution */
++#define PPC44x_TLB_SW 0x00000002 /* Super write */
++#define PPC44x_TLB_SR 0x00000001 /* Super read */
++
++/* Number of TLB entries */
++#define PPC44x_TLB_SIZE 64
++
++/* 47x bits */
++#define PPC47x_MMUCR_TID 0x0000ffff
++#define PPC47x_MMUCR_STS 0x00010000
++
++/* Page identification fields */
++#define PPC47x_TLB0_EPN_MASK 0xfffff000 /* Effective Page Number */
++#define PPC47x_TLB0_VALID 0x00000800 /* Valid flag */
++#define PPC47x_TLB0_TS 0x00000400 /* Translation address space */
++#define PPC47x_TLB0_4K 0x00000000
++#define PPC47x_TLB0_16K 0x00000010
++#define PPC47x_TLB0_64K 0x00000030
++#define PPC47x_TLB0_1M 0x00000070
++#define PPC47x_TLB0_16M 0x000000f0
++#define PPC47x_TLB0_256M 0x000001f0
++#define PPC47x_TLB0_1G 0x000003f0
++#define PPC47x_TLB0_BOLTED_R 0x00000008 /* tlbre only */
++
++/* Translation fields */
++#define PPC47x_TLB1_RPN_MASK 0xfffff000 /* Real Page Number */
++#define PPC47x_TLB1_ERPN_MASK 0x000003ff
++
++/* Storage attribute and access control fields */
++#define PPC47x_TLB2_ATTR_MASK 0x0003ff80
++#define PPC47x_TLB2_IL1I 0x00020000 /* Memory is guarded */
++#define PPC47x_TLB2_IL1D 0x00010000 /* Memory is guarded */
++#define PPC47x_TLB2_U0 0x00008000 /* User 0 */
++#define PPC47x_TLB2_U1 0x00004000 /* User 1 */
++#define PPC47x_TLB2_U2 0x00002000 /* User 2 */
++#define PPC47x_TLB2_U3 0x00001000 /* User 3 */
++#define PPC47x_TLB2_W 0x00000800 /* Caching is write-through */
++#define PPC47x_TLB2_I 0x00000400 /* Caching is inhibited */
++#define PPC47x_TLB2_M 0x00000200 /* Memory is coherent */
++#define PPC47x_TLB2_G 0x00000100 /* Memory is guarded */
++#define PPC47x_TLB2_E 0x00000080 /* Memory is little endian */
++#define PPC47x_TLB2_PERM_MASK 0x0000003f
++#define PPC47x_TLB2_UX 0x00000020 /* User execution */
++#define PPC47x_TLB2_UW 0x00000010 /* User write */
++#define PPC47x_TLB2_UR 0x00000008 /* User read */
++#define PPC47x_TLB2_SX 0x00000004 /* Super execution */
++#define PPC47x_TLB2_SW 0x00000002 /* Super write */
++#define PPC47x_TLB2_SR 0x00000001 /* Super read */
++#define PPC47x_TLB2_U_RWX (PPC47x_TLB2_UX|PPC47x_TLB2_UW|PPC47x_TLB2_UR)
++#define PPC47x_TLB2_S_RWX (PPC47x_TLB2_SX|PPC47x_TLB2_SW|PPC47x_TLB2_SR)
++#define PPC47x_TLB2_S_RW (PPC47x_TLB2_SW | PPC47x_TLB2_SR)
++#define PPC47x_TLB2_IMG (PPC47x_TLB2_I | PPC47x_TLB2_M | PPC47x_TLB2_G)
++
++#ifndef __ASSEMBLY__
++
++extern unsigned int tlb_44x_hwater;
++extern unsigned int tlb_44x_index;
++
++typedef struct {
++ unsigned int id;
++ unsigned int active;
++ unsigned long vdso_base;
++} mm_context_t;
++
++#endif /* !__ASSEMBLY__ */
++
++#ifndef CONFIG_PPC_EARLY_DEBUG_44x
++#define PPC44x_EARLY_TLBS 1
++#else
++#define PPC44x_EARLY_TLBS 2
++#define PPC44x_EARLY_DEBUG_VIRTADDR (ASM_CONST(0xf0000000) \
++ | (ASM_CONST(CONFIG_PPC_EARLY_DEBUG_44x_PHYSLOW) & 0xffff))
++#endif
++
++/* Size of the TLBs used for pinning in lowmem */
++#define PPC_PIN_SIZE (1 << 28) /* 256M */
++
++#if defined(CONFIG_PPC_4K_PAGES)
++#define PPC44x_TLBE_SIZE PPC44x_TLB_4K
++#define PPC47x_TLBE_SIZE PPC47x_TLB0_4K
++#define mmu_virtual_psize MMU_PAGE_4K
++#elif defined(CONFIG_PPC_16K_PAGES)
++#define PPC44x_TLBE_SIZE PPC44x_TLB_16K
++#define PPC47x_TLBE_SIZE PPC47x_TLB0_16K
++#define mmu_virtual_psize MMU_PAGE_16K
++#elif defined(CONFIG_PPC_64K_PAGES)
++#define PPC44x_TLBE_SIZE PPC44x_TLB_64K
++#define PPC47x_TLBE_SIZE PPC47x_TLB0_64K
++#define mmu_virtual_psize MMU_PAGE_64K
++#elif defined(CONFIG_PPC_256K_PAGES)
++#define PPC44x_TLBE_SIZE PPC44x_TLB_256K
++#define mmu_virtual_psize MMU_PAGE_256K
++#else
++#error "Unsupported PAGE_SIZE"
++#endif
++
++#define mmu_linear_psize MMU_PAGE_256M
++
++#define PPC44x_PGD_OFF_SHIFT (32 - PGDIR_SHIFT + PGD_T_LOG2)
++#define PPC44x_PGD_OFF_MASK_BIT (PGDIR_SHIFT - PGD_T_LOG2)
++#define PPC44x_PTE_ADD_SHIFT (32 - PGDIR_SHIFT + PTE_SHIFT + PTE_T_LOG2)
++#define PPC44x_PTE_ADD_MASK_BIT (32 - PTE_T_LOG2 - PTE_SHIFT)
++
++#endif /* _ASM_POWERPC_MMU_44X_H_ */
+diff --git a/arch/powerpc/include/asm/nohash/32/mmu-8xx.h b/arch/powerpc/include/asm/nohash/32/mmu-8xx.h
+new file mode 100644
+index 0000000000000..193f53116c7ae
+--- /dev/null
++++ b/arch/powerpc/include/asm/nohash/32/mmu-8xx.h
+@@ -0,0 +1,244 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_POWERPC_MMU_8XX_H_
++#define _ASM_POWERPC_MMU_8XX_H_
++/*
++ * PPC8xx support
++ */
++
++/* Control/status registers for the MPC8xx.
++ * A write operation to these registers causes serialized access.
++ * During software tablewalk, the registers used perform mask/shift-add
++ * operations when written/read. A TLB entry is created when the Mx_RPN
++ * is written, and the contents of several registers are used to
++ * create the entry.
++ */
++#define SPRN_MI_CTR 784 /* Instruction TLB control register */
++#define MI_GPM 0x80000000 /* Set domain manager mode */
++#define MI_PPM 0x40000000 /* Set subpage protection */
++#define MI_CIDEF 0x20000000 /* Set cache inhibit when MMU dis */
++#define MI_RSV4I 0x08000000 /* Reserve 4 TLB entries */
++#define MI_PPCS 0x02000000 /* Use MI_RPN prob/priv state */
++#define MI_IDXMASK 0x00001f00 /* TLB index to be loaded */
++#define MI_RESETVAL 0x00000000 /* Value of register at reset */
++
++/* These are the Ks and Kp from the PowerPC books. For proper operation,
++ * Ks = 0, Kp = 1.
++ */
++#define SPRN_MI_AP 786
++#define MI_Ks 0x80000000 /* Should not be set */
++#define MI_Kp 0x40000000 /* Should always be set */
++
++/*
++ * All pages' PP data bits are set to either 001 or 011 by copying _PAGE_EXEC
++ * into bit 21 in the ITLBmiss handler (bit 21 is the middle bit), which means
++ * respectively NA for All or X for Supervisor and no access for User.
++ * Then we use the APG to say whether accesses are according to Page rules or
++ * "all Supervisor" rules (Access to all)
++ * Therefore, we define 2 APG groups. lsb is _PMD_USER
++ * 0 => No user => 01 (all accesses performed according to page definition)
++ * 1 => User => 00 (all accesses performed as supervisor iaw page definition)
++ * We define all 16 groups so that all other bits of APG can take any value
++ */
++#define MI_APG_INIT 0x44444444
++
++/* The effective page number register. When read, contains the information
++ * about the last instruction TLB miss. When MI_RPN is written, bits in
++ * this register are used to create the TLB entry.
++ */
++#define SPRN_MI_EPN 787
++#define MI_EPNMASK 0xfffff000 /* Effective page number for entry */
++#define MI_EVALID 0x00000200 /* Entry is valid */
++#define MI_ASIDMASK 0x0000000f /* ASID match value */
++ /* Reset value is undefined */
++
++/* A "level 1" or "segment" or whatever you want to call it register.
++ * For the instruction TLB, it contains bits that get loaded into the
++ * TLB entry when the MI_RPN is written.
++ */
++#define SPRN_MI_TWC 789
++#define MI_APG 0x000001e0 /* Access protection group (0) */
++#define MI_GUARDED 0x00000010 /* Guarded storage */
++#define MI_PSMASK 0x0000000c /* Mask of page size bits */
++#define MI_PS8MEG 0x0000000c /* 8M page size */
++#define MI_PS512K 0x00000004 /* 512K page size */
++#define MI_PS4K_16K 0x00000000 /* 4K or 16K page size */
++#define MI_SVALID 0x00000001 /* Segment entry is valid */
++ /* Reset value is undefined */
++
++/* Real page number. Defined by the pte. Writing this register
++ * causes a TLB entry to be created for the instruction TLB, using
++ * additional information from the MI_EPN, and MI_TWC registers.
++ */
++#define SPRN_MI_RPN 790
++#define MI_SPS16K 0x00000008 /* Small page size (0 = 4k, 1 = 16k) */
++
++/* Define an RPN value for mapping kernel memory to large virtual
++ * pages for boot initialization. This has real page number of 0,
++ * large page size, shared page, cache enabled, and valid.
++ * Also mark all subpages valid and write access.
++ */
++#define MI_BOOTINIT 0x000001fd
++
++#define SPRN_MD_CTR 792 /* Data TLB control register */
++#define MD_GPM 0x80000000 /* Set domain manager mode */
++#define MD_PPM 0x40000000 /* Set subpage protection */
++#define MD_CIDEF 0x20000000 /* Set cache inhibit when MMU dis */
++#define MD_WTDEF 0x10000000 /* Set writethrough when MMU dis */
++#define MD_RSV4I 0x08000000 /* Reserve 4 TLB entries */
++#define MD_TWAM 0x04000000 /* Use 4K page hardware assist */
++#define MD_PPCS 0x02000000 /* Use MI_RPN prob/priv state */
++#define MD_IDXMASK 0x00001f00 /* TLB index to be loaded */
++#define MD_RESETVAL 0x04000000 /* Value of register at reset */
++
++#define SPRN_M_CASID 793 /* Address space ID (context) to match */
++#define MC_ASIDMASK 0x0000000f /* Bits used for ASID value */
++
++
++/* These are the Ks and Kp from the PowerPC books. For proper operation,
++ * Ks = 0, Kp = 1.
++ */
++#define SPRN_MD_AP 794
++#define MD_Ks 0x80000000 /* Should not be set */
++#define MD_Kp 0x40000000 /* Should always be set */
++
++/*
++ * All pages' PP data bits are set to either 000 or 011 or 001, which means
++ * respectively RW for Supervisor and no access for User, or RO for
++ * Supervisor and no access for user and NA for ALL.
++ * Then we use the APG to say whether accesses are according to Page rules or
++ * "all Supervisor" rules (Access to all)
++ * Therefore, we define 2 APG groups. lsb is _PMD_USER
++ * 0 => No user => 01 (all accesses performed according to page definition)
++ * 1 => User => 00 (all accesses performed as supervisor iaw page definition)
++ * We define all 16 groups so that all other bits of APG can take any value
++ */
++#define MD_APG_INIT 0x44444444
++
++/* The effective page number register. When read, contains the information
++ * about the last instruction TLB miss. When MD_RPN is written, bits in
++ * this register are used to create the TLB entry.
++ */
++#define SPRN_MD_EPN 795
++#define MD_EPNMASK 0xfffff000 /* Effective page number for entry */
++#define MD_EVALID 0x00000200 /* Entry is valid */
++#define MD_ASIDMASK 0x0000000f /* ASID match value */
++ /* Reset value is undefined */
++
++/* The pointer to the base address of the first level page table.
++ * During a software tablewalk, reading this register provides the address
++ * of the entry associated with MD_EPN.
++ */
++#define SPRN_M_TWB 796
++#define M_L1TB 0xfffff000 /* Level 1 table base address */
++#define M_L1INDX 0x00000ffc /* Level 1 index, when read */
++ /* Reset value is undefined */
++
++/* A "level 1" or "segment" or whatever you want to call it register.
++ * For the data TLB, it contains bits that get loaded into the TLB entry
++ * when the MD_RPN is written. It is also provides the hardware assist
++ * for finding the PTE address during software tablewalk.
++ */
++#define SPRN_MD_TWC 797
++#define MD_L2TB 0xfffff000 /* Level 2 table base address */
++#define MD_L2INDX 0xfffffe00 /* Level 2 index (*pte), when read */
++#define MD_APG 0x000001e0 /* Access protection group (0) */
++#define MD_GUARDED 0x00000010 /* Guarded storage */
++#define MD_PSMASK 0x0000000c /* Mask of page size bits */
++#define MD_PS8MEG 0x0000000c /* 8M page size */
++#define MD_PS512K 0x00000004 /* 512K page size */
++#define MD_PS4K_16K 0x00000000 /* 4K or 16K page size */
++#define MD_WT 0x00000002 /* Use writethrough page attribute */
++#define MD_SVALID 0x00000001 /* Segment entry is valid */
++ /* Reset value is undefined */
++
++
++/* Real page number. Defined by the pte. Writing this register
++ * causes a TLB entry to be created for the data TLB, using
++ * additional information from the MD_EPN, and MD_TWC registers.
++ */
++#define SPRN_MD_RPN 798
++#define MD_SPS16K 0x00000008 /* Small page size (0 = 4k, 1 = 16k) */
++
++/* This is a temporary storage register that could be used to save
++ * a processor working register during a tablewalk.
++ */
++#define SPRN_M_TW 799
++
++#ifdef CONFIG_PPC_MM_SLICES
++#include <asm/nohash/32/slice.h>
++#define SLICE_ARRAY_SIZE (1 << (32 - SLICE_LOW_SHIFT - 1))
++#endif
++
++#ifndef __ASSEMBLY__
++struct slice_mask {
++ u64 low_slices;
++ DECLARE_BITMAP(high_slices, 0);
++};
++
++typedef struct {
++ unsigned int id;
++ unsigned int active;
++ unsigned long vdso_base;
++#ifdef CONFIG_PPC_MM_SLICES
++ u16 user_psize; /* page size index */
++ unsigned char low_slices_psize[SLICE_ARRAY_SIZE];
++ unsigned char high_slices_psize[0];
++ unsigned long slb_addr_limit;
++ struct slice_mask mask_base_psize; /* 4k or 16k */
++# ifdef CONFIG_HUGETLB_PAGE
++ struct slice_mask mask_512k;
++ struct slice_mask mask_8m;
++# endif
++#endif
++} mm_context_t;
++
++#define PHYS_IMMR_BASE (mfspr(SPRN_IMMR) & 0xfff80000)
++#define VIRT_IMMR_BASE (__fix_to_virt(FIX_IMMR_BASE))
++
++/* Page size definitions, common between 32 and 64-bit
++ *
++ * shift : is the "PAGE_SHIFT" value for that page size
++ * penc : is the pte encoding mask
++ *
++ */
++struct mmu_psize_def {
++ unsigned int shift; /* number of bits */
++ unsigned int enc; /* PTE encoding */
++ unsigned int ind; /* Corresponding indirect page size shift */
++ unsigned int flags;
++#define MMU_PAGE_SIZE_DIRECT 0x1 /* Supported as a direct size */
++#define MMU_PAGE_SIZE_INDIRECT 0x2 /* Supported as an indirect size */
++};
++
++extern struct mmu_psize_def mmu_psize_defs[MMU_PAGE_COUNT];
++
++static inline int shift_to_mmu_psize(unsigned int shift)
++{
++ int psize;
++
++ for (psize = 0; psize < MMU_PAGE_COUNT; ++psize)
++ if (mmu_psize_defs[psize].shift == shift)
++ return psize;
++ return -1;
++}
++
++static inline unsigned int mmu_psize_to_shift(unsigned int mmu_psize)
++{
++ if (mmu_psize_defs[mmu_psize].shift)
++ return mmu_psize_defs[mmu_psize].shift;
++ BUG();
++}
++
++#endif /* !__ASSEMBLY__ */
++
++#if defined(CONFIG_PPC_4K_PAGES)
++#define mmu_virtual_psize MMU_PAGE_4K
++#elif defined(CONFIG_PPC_16K_PAGES)
++#define mmu_virtual_psize MMU_PAGE_16K
++#else
++#error "Unsupported PAGE_SIZE"
++#endif
++
++#define mmu_linear_psize MMU_PAGE_8M
++
++#endif /* _ASM_POWERPC_MMU_8XX_H_ */
+diff --git a/arch/powerpc/include/asm/nohash/32/mmu.h b/arch/powerpc/include/asm/nohash/32/mmu.h
+new file mode 100644
+index 0000000000000..f61f933a4cd8c
+--- /dev/null
++++ b/arch/powerpc/include/asm/nohash/32/mmu.h
+@@ -0,0 +1,23 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_POWERPC_NOHASH_32_MMU_H_
++#define _ASM_POWERPC_NOHASH_32_MMU_H_
++
++#if defined(CONFIG_40x)
++/* 40x-style software loaded TLB */
++#include <asm/nohash/32/mmu-40x.h>
++#elif defined(CONFIG_44x)
++/* 44x-style software loaded TLB */
++#include <asm/nohash/32/mmu-44x.h>
++#elif defined(CONFIG_PPC_BOOK3E_MMU)
++/* Freescale Book-E software loaded TLB or Book-3e (ISA 2.06+) MMU */
++#include <asm/nohash/mmu-book3e.h>
++#elif defined (CONFIG_PPC_8xx)
++/* Motorola/Freescale 8xx software loaded TLB */
++#include <asm/nohash/32/mmu-8xx.h>
++#endif
++
++#ifndef __ASSEMBLY__
++typedef struct page *pgtable_t;
++#endif
++
++#endif /* _ASM_POWERPC_NOHASH_32_MMU_H_ */
+diff --git a/arch/powerpc/include/asm/nohash/64/mmu.h b/arch/powerpc/include/asm/nohash/64/mmu.h
+new file mode 100644
+index 0000000000000..e6585480dfc40
+--- /dev/null
++++ b/arch/powerpc/include/asm/nohash/64/mmu.h
+@@ -0,0 +1,12 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_POWERPC_NOHASH_64_MMU_H_
++#define _ASM_POWERPC_NOHASH_64_MMU_H_
++
++/* Freescale Book-E software loaded TLB or Book-3e (ISA 2.06+) MMU */
++#include <asm/nohash/mmu-book3e.h>
++
++#ifndef __ASSEMBLY__
++typedef struct page *pgtable_t;
++#endif
++
++#endif /* _ASM_POWERPC_NOHASH_64_MMU_H_ */
+diff --git a/arch/powerpc/include/asm/nohash/mmu-book3e.h b/arch/powerpc/include/asm/nohash/mmu-book3e.h
+new file mode 100644
+index 0000000000000..e20072972e359
+--- /dev/null
++++ b/arch/powerpc/include/asm/nohash/mmu-book3e.h
+@@ -0,0 +1,313 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_POWERPC_MMU_BOOK3E_H_
++#define _ASM_POWERPC_MMU_BOOK3E_H_
++/*
++ * Freescale Book-E/Book-3e (ISA 2.06+) MMU support
++ */
++
++/* Book-3e defined page sizes */
++#define BOOK3E_PAGESZ_1K 0
++#define BOOK3E_PAGESZ_2K 1
++#define BOOK3E_PAGESZ_4K 2
++#define BOOK3E_PAGESZ_8K 3
++#define BOOK3E_PAGESZ_16K 4
++#define BOOK3E_PAGESZ_32K 5
++#define BOOK3E_PAGESZ_64K 6
++#define BOOK3E_PAGESZ_128K 7
++#define BOOK3E_PAGESZ_256K 8
++#define BOOK3E_PAGESZ_512K 9
++#define BOOK3E_PAGESZ_1M 10
++#define BOOK3E_PAGESZ_2M 11
++#define BOOK3E_PAGESZ_4M 12
++#define BOOK3E_PAGESZ_8M 13
++#define BOOK3E_PAGESZ_16M 14
++#define BOOK3E_PAGESZ_32M 15
++#define BOOK3E_PAGESZ_64M 16
++#define BOOK3E_PAGESZ_128M 17
++#define BOOK3E_PAGESZ_256M 18
++#define BOOK3E_PAGESZ_512M 19
++#define BOOK3E_PAGESZ_1GB 20
++#define BOOK3E_PAGESZ_2GB 21
++#define BOOK3E_PAGESZ_4GB 22
++#define BOOK3E_PAGESZ_8GB 23
++#define BOOK3E_PAGESZ_16GB 24
++#define BOOK3E_PAGESZ_32GB 25
++#define BOOK3E_PAGESZ_64GB 26
++#define BOOK3E_PAGESZ_128GB 27
++#define BOOK3E_PAGESZ_256GB 28
++#define BOOK3E_PAGESZ_512GB 29
++#define BOOK3E_PAGESZ_1TB 30
++#define BOOK3E_PAGESZ_2TB 31
++
++/* MAS registers bit definitions */
++
++#define MAS0_TLBSEL_MASK 0x30000000
++#define MAS0_TLBSEL_SHIFT 28
++#define MAS0_TLBSEL(x) (((x) << MAS0_TLBSEL_SHIFT) & MAS0_TLBSEL_MASK)
++#define MAS0_GET_TLBSEL(mas0) (((mas0) & MAS0_TLBSEL_MASK) >> \
++ MAS0_TLBSEL_SHIFT)
++#define MAS0_ESEL_MASK 0x0FFF0000
++#define MAS0_ESEL_SHIFT 16
++#define MAS0_ESEL(x) (((x) << MAS0_ESEL_SHIFT) & MAS0_ESEL_MASK)
++#define MAS0_NV(x) ((x) & 0x00000FFF)
++#define MAS0_HES 0x00004000
++#define MAS0_WQ_ALLWAYS 0x00000000
++#define MAS0_WQ_COND 0x00001000
++#define MAS0_WQ_CLR_RSRV 0x00002000
++
++#define MAS1_VALID 0x80000000
++#define MAS1_IPROT 0x40000000
++#define MAS1_TID(x) (((x) << 16) & 0x3FFF0000)
++#define MAS1_IND 0x00002000
++#define MAS1_TS 0x00001000
++#define MAS1_TSIZE_MASK 0x00000f80
++#define MAS1_TSIZE_SHIFT 7
++#define MAS1_TSIZE(x) (((x) << MAS1_TSIZE_SHIFT) & MAS1_TSIZE_MASK)
++#define MAS1_GET_TSIZE(mas1) (((mas1) & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT)
++
++#define MAS2_EPN (~0xFFFUL)
++#define MAS2_X0 0x00000040
++#define MAS2_X1 0x00000020
++#define MAS2_W 0x00000010
++#define MAS2_I 0x00000008
++#define MAS2_M 0x00000004
++#define MAS2_G 0x00000002
++#define MAS2_E 0x00000001
++#define MAS2_WIMGE_MASK 0x0000001f
++#define MAS2_EPN_MASK(size) (~0 << (size + 10))
++#define MAS2_VAL(addr, size, flags) ((addr) & MAS2_EPN_MASK(size) | (flags))
++
++#define MAS3_RPN 0xFFFFF000
++#define MAS3_U0 0x00000200
++#define MAS3_U1 0x00000100
++#define MAS3_U2 0x00000080
++#define MAS3_U3 0x00000040
++#define MAS3_UX 0x00000020
++#define MAS3_SX 0x00000010
++#define MAS3_UW 0x00000008
++#define MAS3_SW 0x00000004
++#define MAS3_UR 0x00000002
++#define MAS3_SR 0x00000001
++#define MAS3_BAP_MASK 0x0000003f
++#define MAS3_SPSIZE 0x0000003e
++#define MAS3_SPSIZE_SHIFT 1
++
++#define MAS4_TLBSEL_MASK MAS0_TLBSEL_MASK
++#define MAS4_TLBSELD(x) MAS0_TLBSEL(x)
++#define MAS4_INDD 0x00008000 /* Default IND */
++#define MAS4_TSIZED(x) MAS1_TSIZE(x)
++#define MAS4_X0D 0x00000040
++#define MAS4_X1D 0x00000020
++#define MAS4_WD 0x00000010
++#define MAS4_ID 0x00000008
++#define MAS4_MD 0x00000004
++#define MAS4_GD 0x00000002
++#define MAS4_ED 0x00000001
++#define MAS4_WIMGED_MASK 0x0000001f /* Default WIMGE */
++#define MAS4_WIMGED_SHIFT 0
++#define MAS4_VLED MAS4_X1D /* Default VLE */
++#define MAS4_ACMD 0x000000c0 /* Default ACM */
++#define MAS4_ACMD_SHIFT 6
++#define MAS4_TSIZED_MASK 0x00000f80 /* Default TSIZE */
++#define MAS4_TSIZED_SHIFT 7
++
++#define MAS5_SGS 0x80000000
++
++#define MAS6_SPID0 0x3FFF0000
++#define MAS6_SPID1 0x00007FFE
++#define MAS6_ISIZE(x) MAS1_TSIZE(x)
++#define MAS6_SAS 0x00000001
++#define MAS6_SPID MAS6_SPID0
++#define MAS6_SIND 0x00000002 /* Indirect page */
++#define MAS6_SIND_SHIFT 1
++#define MAS6_SPID_MASK 0x3fff0000
++#define MAS6_SPID_SHIFT 16
++#define MAS6_ISIZE_MASK 0x00000f80
++#define MAS6_ISIZE_SHIFT 7
++
++#define MAS7_RPN 0xFFFFFFFF
++
++#define MAS8_TGS 0x80000000 /* Guest space */
++#define MAS8_VF 0x40000000 /* Virtualization Fault */
++#define MAS8_TLPID 0x000000ff
++
++/* Bit definitions for MMUCFG */
++#define MMUCFG_MAVN 0x00000003 /* MMU Architecture Version Number */
++#define MMUCFG_MAVN_V1 0x00000000 /* v1.0 */
++#define MMUCFG_MAVN_V2 0x00000001 /* v2.0 */
++#define MMUCFG_NTLBS 0x0000000c /* Number of TLBs */
++#define MMUCFG_PIDSIZE 0x000007c0 /* PID Reg Size */
++#define MMUCFG_TWC 0x00008000 /* TLB Write Conditional (v2.0) */
++#define MMUCFG_LRAT 0x00010000 /* LRAT Supported (v2.0) */
++#define MMUCFG_RASIZE 0x00fe0000 /* Real Addr Size */
++#define MMUCFG_LPIDSIZE 0x0f000000 /* LPID Reg Size */
++
++/* Bit definitions for MMUCSR0 */
++#define MMUCSR0_TLB1FI 0x00000002 /* TLB1 Flash invalidate */
++#define MMUCSR0_TLB0FI 0x00000004 /* TLB0 Flash invalidate */
++#define MMUCSR0_TLB2FI 0x00000040 /* TLB2 Flash invalidate */
++#define MMUCSR0_TLB3FI 0x00000020 /* TLB3 Flash invalidate */
++#define MMUCSR0_TLBFI (MMUCSR0_TLB0FI | MMUCSR0_TLB1FI | \
++ MMUCSR0_TLB2FI | MMUCSR0_TLB3FI)
++#define MMUCSR0_TLB0PS 0x00000780 /* TLB0 Page Size */
++#define MMUCSR0_TLB1PS 0x00007800 /* TLB1 Page Size */
++#define MMUCSR0_TLB2PS 0x00078000 /* TLB2 Page Size */
++#define MMUCSR0_TLB3PS 0x00780000 /* TLB3 Page Size */
++
++/* MMUCFG bits */
++#define MMUCFG_MAVN_NASK 0x00000003
++#define MMUCFG_MAVN_V1_0 0x00000000
++#define MMUCFG_MAVN_V2_0 0x00000001
++#define MMUCFG_NTLB_MASK 0x0000000c
++#define MMUCFG_NTLB_SHIFT 2
++#define MMUCFG_PIDSIZE_MASK 0x000007c0
++#define MMUCFG_PIDSIZE_SHIFT 6
++#define MMUCFG_TWC 0x00008000
++#define MMUCFG_LRAT 0x00010000
++#define MMUCFG_RASIZE_MASK 0x00fe0000
++#define MMUCFG_RASIZE_SHIFT 17
++#define MMUCFG_LPIDSIZE_MASK 0x0f000000
++#define MMUCFG_LPIDSIZE_SHIFT 24
++
++/* TLBnCFG encoding */
++#define TLBnCFG_N_ENTRY 0x00000fff /* number of entries */
++#define TLBnCFG_HES 0x00002000 /* HW select supported */
++#define TLBnCFG_IPROT 0x00008000 /* IPROT supported */
++#define TLBnCFG_GTWE 0x00010000 /* Guest can write */
++#define TLBnCFG_IND 0x00020000 /* IND entries supported */
++#define TLBnCFG_PT 0x00040000 /* Can load from page table */
++#define TLBnCFG_MINSIZE 0x00f00000 /* Minimum Page Size (v1.0) */
++#define TLBnCFG_MINSIZE_SHIFT 20
++#define TLBnCFG_MAXSIZE 0x000f0000 /* Maximum Page Size (v1.0) */
++#define TLBnCFG_MAXSIZE_SHIFT 16
++#define TLBnCFG_ASSOC 0xff000000 /* Associativity */
++#define TLBnCFG_ASSOC_SHIFT 24
++
++/* TLBnPS encoding */
++#define TLBnPS_4K 0x00000004
++#define TLBnPS_8K 0x00000008
++#define TLBnPS_16K 0x00000010
++#define TLBnPS_32K 0x00000020
++#define TLBnPS_64K 0x00000040
++#define TLBnPS_128K 0x00000080
++#define TLBnPS_256K 0x00000100
++#define TLBnPS_512K 0x00000200
++#define TLBnPS_1M 0x00000400
++#define TLBnPS_2M 0x00000800
++#define TLBnPS_4M 0x00001000
++#define TLBnPS_8M 0x00002000
++#define TLBnPS_16M 0x00004000
++#define TLBnPS_32M 0x00008000
++#define TLBnPS_64M 0x00010000
++#define TLBnPS_128M 0x00020000
++#define TLBnPS_256M 0x00040000
++#define TLBnPS_512M 0x00080000
++#define TLBnPS_1G 0x00100000
++#define TLBnPS_2G 0x00200000
++#define TLBnPS_4G 0x00400000
++#define TLBnPS_8G 0x00800000
++#define TLBnPS_16G 0x01000000
++#define TLBnPS_32G 0x02000000
++#define TLBnPS_64G 0x04000000
++#define TLBnPS_128G 0x08000000
++#define TLBnPS_256G 0x10000000
++
++/* tlbilx action encoding */
++#define TLBILX_T_ALL 0
++#define TLBILX_T_TID 1
++#define TLBILX_T_FULLMATCH 3
++#define TLBILX_T_CLASS0 4
++#define TLBILX_T_CLASS1 5
++#define TLBILX_T_CLASS2 6
++#define TLBILX_T_CLASS3 7
++
++#ifndef __ASSEMBLY__
++#include <asm/bug.h>
++
++extern unsigned int tlbcam_index;
++
++typedef struct {
++ unsigned int id;
++ unsigned int active;
++ unsigned long vdso_base;
++} mm_context_t;
++
++/* Page size definitions, common between 32 and 64-bit
++ *
++ * shift : is the "PAGE_SHIFT" value for that page size
++ * penc : is the pte encoding mask
++ *
++ */
++struct mmu_psize_def
++{
++ unsigned int shift; /* number of bits */
++ unsigned int enc; /* PTE encoding */
++ unsigned int ind; /* Corresponding indirect page size shift */
++ unsigned int flags;
++#define MMU_PAGE_SIZE_DIRECT 0x1 /* Supported as a direct size */
++#define MMU_PAGE_SIZE_INDIRECT 0x2 /* Supported as an indirect size */
++};
++extern struct mmu_psize_def mmu_psize_defs[MMU_PAGE_COUNT];
++
++static inline int shift_to_mmu_psize(unsigned int shift)
++{
++ int psize;
++
++ for (psize = 0; psize < MMU_PAGE_COUNT; ++psize)
++ if (mmu_psize_defs[psize].shift == shift)
++ return psize;
++ return -1;
++}
++
++static inline unsigned int mmu_psize_to_shift(unsigned int mmu_psize)
++{
++ if (mmu_psize_defs[mmu_psize].shift)
++ return mmu_psize_defs[mmu_psize].shift;
++ BUG();
++}
++
++/* The page sizes use the same names as 64-bit hash but are
++ * constants
++ */
++#if defined(CONFIG_PPC_4K_PAGES)
++#define mmu_virtual_psize MMU_PAGE_4K
++#else
++#error Unsupported page size
++#endif
++
++extern int mmu_linear_psize;
++extern int mmu_vmemmap_psize;
++
++struct tlb_core_data {
++ /*
++ * Per-core spinlock for e6500 TLB handlers (no tlbsrx.)
++ * Must be the first struct element.
++ */
++ u8 lock;
++
++ /* For software way selection, as on Freescale TLB1 */
++ u8 esel_next, esel_max, esel_first;
++};
++
++#ifdef CONFIG_PPC64
++extern unsigned long linear_map_top;
++extern int book3e_htw_mode;
++
++#define PPC_HTW_NONE 0
++#define PPC_HTW_IBM 1
++#define PPC_HTW_E6500 2
++
++/*
++ * 64-bit booke platforms don't load the tlb in the tlb miss handler code.
++ * HUGETLB_NEED_PRELOAD handles this - it causes huge_ptep_set_access_flags to
++ * return 1, indicating that the tlb requires preloading.
++ */
++#define HUGETLB_NEED_PRELOAD
++
++#define mmu_cleanup_all NULL
++
++#endif
++
++#endif /* !__ASSEMBLY__ */
++
++#endif /* _ASM_POWERPC_MMU_BOOK3E_H_ */
+diff --git a/arch/powerpc/include/asm/nohash/mmu.h b/arch/powerpc/include/asm/nohash/mmu.h
+new file mode 100644
+index 0000000000000..a037cb1efb57e
+--- /dev/null
++++ b/arch/powerpc/include/asm/nohash/mmu.h
+@@ -0,0 +1,11 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_POWERPC_NOHASH_MMU_H_
++#define _ASM_POWERPC_NOHASH_MMU_H_
++
++#ifdef CONFIG_PPC64
++#include <asm/nohash/64/mmu.h>
++#else
++#include <asm/nohash/32/mmu.h>
++#endif
++
++#endif /* _ASM_POWERPC_NOHASH_MMU_H_ */
+diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
+index f6a1265face29..ddfb4b965e5bd 100644
+--- a/arch/powerpc/include/asm/page.h
++++ b/arch/powerpc/include/asm/page.h
+@@ -335,20 +335,6 @@ void arch_free_page(struct page *page, int order);
+ #endif
+
+ struct vm_area_struct;
+-#ifdef CONFIG_PPC_BOOK3S_64
+-/*
+- * For BOOK3s 64 with 4k and 64K linux page size
+- * we want to use pointers, because the page table
+- * actually store pfn
+- */
+-typedef pte_t *pgtable_t;
+-#else
+-#if defined(CONFIG_PPC_64K_PAGES) && defined(CONFIG_PPC64)
+-typedef pte_t *pgtable_t;
+-#else
+-typedef struct page *pgtable_t;
+-#endif
+-#endif
+
+ #include <asm-generic/memory_model.h>
+ #endif /* __ASSEMBLY__ */
+diff --git a/arch/powerpc/include/asm/stackprotector.h b/arch/powerpc/include/asm/stackprotector.h
+new file mode 100644
+index 0000000000000..d05d969c98c21
+--- /dev/null
++++ b/arch/powerpc/include/asm/stackprotector.h
+@@ -0,0 +1,34 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * GCC stack protector support.
++ *
++ */
++
++#ifndef _ASM_STACKPROTECTOR_H
++#define _ASM_STACKPROTECTOR_H
++
++#include <linux/random.h>
++#include <linux/version.h>
++#include <asm/reg.h>
++#include <asm/current.h>
++
++/*
++ * Initialize the stackprotector canary value.
++ *
++ * NOTE: this must only be called from functions that never return,
++ * and it must always be inlined.
++ */
++static __always_inline void boot_init_stack_canary(void)
++{
++ unsigned long canary;
++
++ /* Try to get a semi random initial value. */
++ canary = get_random_canary();
++ canary ^= mftb();
++ canary ^= LINUX_VERSION_CODE;
++ canary &= CANARY_MASK;
++
++ current->stack_canary = canary;
++}
++
++#endif /* _ASM_STACKPROTECTOR_H */
+diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
+index bf19c5514d6c2..cccea292af683 100644
+--- a/arch/powerpc/kernel/Makefile
++++ b/arch/powerpc/kernel/Makefile
+@@ -21,6 +21,8 @@ CFLAGS_prom_init.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+ CFLAGS_btext.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+ CFLAGS_prom.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
+
++CFLAGS_prom_init.o += $(call cc-option, -fno-stack-protector)
++
+ ifdef CONFIG_FUNCTION_TRACER
+ # Do not trace early boot code
+ CFLAGS_REMOVE_cputable.o = $(CC_FLAGS_FTRACE)
+diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
+index 50400f213bbf2..c2288c73d56d1 100644
+--- a/arch/powerpc/kernel/asm-offsets.c
++++ b/arch/powerpc/kernel/asm-offsets.c
+@@ -79,6 +79,9 @@ int main(void)
+ {
+ OFFSET(THREAD, task_struct, thread);
+ OFFSET(MM, task_struct, mm);
++#ifdef CONFIG_STACKPROTECTOR
++ OFFSET(TASK_CANARY, task_struct, stack_canary);
++#endif
+ OFFSET(MMCONTEXTID, mm_struct, context.id);
+ #ifdef CONFIG_PPC64
+ DEFINE(SIGSEGV, SIGSEGV);
+diff --git a/arch/powerpc/kernel/cpu_setup_fsl_booke.S b/arch/powerpc/kernel/cpu_setup_fsl_booke.S
+index 8d142e5d84cd0..5fbc890d10943 100644
+--- a/arch/powerpc/kernel/cpu_setup_fsl_booke.S
++++ b/arch/powerpc/kernel/cpu_setup_fsl_booke.S
+@@ -17,7 +17,7 @@
+ #include <asm/processor.h>
+ #include <asm/cputable.h>
+ #include <asm/ppc_asm.h>
+-#include <asm/mmu-book3e.h>
++#include <asm/nohash/mmu-book3e.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/mpc85xx.h>
+
+diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
+index 10fabae2574d5..ddab3488cadbf 100644
+--- a/arch/powerpc/kernel/rtas_flash.c
++++ b/arch/powerpc/kernel/rtas_flash.c
+@@ -714,9 +714,9 @@ static int __init rtas_flash_init(void)
+ if (!rtas_validate_flash_data.buf)
+ return -ENOMEM;
+
+- flash_block_cache = kmem_cache_create("rtas_flash_cache",
+- RTAS_BLK_SIZE, RTAS_BLK_SIZE, 0,
+- NULL);
++ flash_block_cache = kmem_cache_create_usercopy("rtas_flash_cache",
++ RTAS_BLK_SIZE, RTAS_BLK_SIZE,
++ 0, 0, RTAS_BLK_SIZE, NULL);
+ if (!flash_block_cache) {
+ printk(KERN_ERR "%s: failed to create block cache\n",
+ __func__);
+diff --git a/arch/powerpc/kvm/e500.h b/arch/powerpc/kvm/e500.h
+index 94f04fcb373e1..962ee90a0dfea 100644
+--- a/arch/powerpc/kvm/e500.h
++++ b/arch/powerpc/kvm/e500.h
+@@ -20,7 +20,7 @@
+ #define KVM_E500_H
+
+ #include <linux/kvm_host.h>
+-#include <asm/mmu-book3e.h>
++#include <asm/nohash/mmu-book3e.h>
+ #include <asm/tlb.h>
+ #include <asm/cputhreads.h>
+
+diff --git a/arch/powerpc/mm/Makefile b/arch/powerpc/mm/Makefile
+index 3c844bdd16c4e..d4648a1e6e6c1 100644
+--- a/arch/powerpc/mm/Makefile
++++ b/arch/powerpc/mm/Makefile
+@@ -42,13 +42,5 @@ obj-$(CONFIG_NOT_COHERENT_CACHE) += dma-noncoherent.o
+ obj-$(CONFIG_HIGHMEM) += highmem.o
+ obj-$(CONFIG_PPC_COPRO_BASE) += copro_fault.o
+ obj-$(CONFIG_SPAPR_TCE_IOMMU) += mmu_context_iommu.o
+-obj-$(CONFIG_PPC_PTDUMP) += dump_linuxpagetables.o
+-ifdef CONFIG_PPC_PTDUMP
+-obj-$(CONFIG_4xx) += dump_linuxpagetables-generic.o
+-obj-$(CONFIG_PPC_8xx) += dump_linuxpagetables-8xx.o
+-obj-$(CONFIG_PPC_BOOK3E_MMU) += dump_linuxpagetables-generic.o
+-obj-$(CONFIG_PPC_BOOK3S_32) += dump_linuxpagetables-generic.o
+-obj-$(CONFIG_PPC_BOOK3S_64) += dump_linuxpagetables-book3s64.o
+-endif
+-obj-$(CONFIG_PPC_HTDUMP) += dump_hashpagetable.o
++obj-$(CONFIG_PPC_PTDUMP) += ptdump/
+ obj-$(CONFIG_PPC_MEM_KEYS) += pkeys.o
+diff --git a/arch/powerpc/mm/dump_hashpagetable.c b/arch/powerpc/mm/dump_hashpagetable.c
+deleted file mode 100644
+index b430e4e08af69..0000000000000
+--- a/arch/powerpc/mm/dump_hashpagetable.c
++++ /dev/null
+@@ -1,550 +0,0 @@
+-/*
+- * Copyright 2016, Rashmica Gupta, IBM Corp.
+- *
+- * This traverses the kernel virtual memory and dumps the pages that are in
+- * the hash pagetable, along with their flags to
+- * /sys/kernel/debug/kernel_hash_pagetable.
+- *
+- * If radix is enabled then there is no hash page table and so no debugfs file
+- * is generated.
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License
+- * as published by the Free Software Foundation; version 2
+- * of the License.
+- */
+-#include <linux/debugfs.h>
+-#include <linux/fs.h>
+-#include <linux/io.h>
+-#include <linux/mm.h>
+-#include <linux/sched.h>
+-#include <linux/seq_file.h>
+-#include <asm/pgtable.h>
+-#include <linux/const.h>
+-#include <asm/page.h>
+-#include <asm/pgalloc.h>
+-#include <asm/plpar_wrappers.h>
+-#include <linux/memblock.h>
+-#include <asm/firmware.h>
+-
+-struct pg_state {
+- struct seq_file *seq;
+- const struct addr_marker *marker;
+- unsigned long start_address;
+- unsigned int level;
+- u64 current_flags;
+-};
+-
+-struct addr_marker {
+- unsigned long start_address;
+- const char *name;
+-};
+-
+-static struct addr_marker address_markers[] = {
+- { 0, "Start of kernel VM" },
+- { 0, "vmalloc() Area" },
+- { 0, "vmalloc() End" },
+- { 0, "isa I/O start" },
+- { 0, "isa I/O end" },
+- { 0, "phb I/O start" },
+- { 0, "phb I/O end" },
+- { 0, "I/O remap start" },
+- { 0, "I/O remap end" },
+- { 0, "vmemmap start" },
+- { -1, NULL },
+-};
+-
+-struct flag_info {
+- u64 mask;
+- u64 val;
+- const char *set;
+- const char *clear;
+- bool is_val;
+- int shift;
+-};
+-
+-static const struct flag_info v_flag_array[] = {
+- {
+- .mask = SLB_VSID_B,
+- .val = SLB_VSID_B_256M,
+- .set = "ssize: 256M",
+- .clear = "ssize: 1T ",
+- }, {
+- .mask = HPTE_V_SECONDARY,
+- .val = HPTE_V_SECONDARY,
+- .set = "secondary",
+- .clear = "primary ",
+- }, {
+- .mask = HPTE_V_VALID,
+- .val = HPTE_V_VALID,
+- .set = "valid ",
+- .clear = "invalid",
+- }, {
+- .mask = HPTE_V_BOLTED,
+- .val = HPTE_V_BOLTED,
+- .set = "bolted",
+- .clear = "",
+- }
+-};
+-
+-static const struct flag_info r_flag_array[] = {
+- {
+- .mask = HPTE_R_PP0 | HPTE_R_PP,
+- .val = PP_RWXX,
+- .set = "prot:RW--",
+- }, {
+- .mask = HPTE_R_PP0 | HPTE_R_PP,
+- .val = PP_RWRX,
+- .set = "prot:RWR-",
+- }, {
+- .mask = HPTE_R_PP0 | HPTE_R_PP,
+- .val = PP_RWRW,
+- .set = "prot:RWRW",
+- }, {
+- .mask = HPTE_R_PP0 | HPTE_R_PP,
+- .val = PP_RXRX,
+- .set = "prot:R-R-",
+- }, {
+- .mask = HPTE_R_PP0 | HPTE_R_PP,
+- .val = PP_RXXX,
+- .set = "prot:R---",
+- }, {
+- .mask = HPTE_R_KEY_HI | HPTE_R_KEY_LO,
+- .val = HPTE_R_KEY_HI | HPTE_R_KEY_LO,
+- .set = "key",
+- .clear = "",
+- .is_val = true,
+- }, {
+- .mask = HPTE_R_R,
+- .val = HPTE_R_R,
+- .set = "ref",
+- .clear = " ",
+- }, {
+- .mask = HPTE_R_C,
+- .val = HPTE_R_C,
+- .set = "changed",
+- .clear = " ",
+- }, {
+- .mask = HPTE_R_N,
+- .val = HPTE_R_N,
+- .set = "no execute",
+- }, {
+- .mask = HPTE_R_WIMG,
+- .val = HPTE_R_W,
+- .set = "writethru",
+- }, {
+- .mask = HPTE_R_WIMG,
+- .val = HPTE_R_I,
+- .set = "no cache",
+- }, {
+- .mask = HPTE_R_WIMG,
+- .val = HPTE_R_G,
+- .set = "guarded",
+- }
+-};
+-
+-static int calculate_pagesize(struct pg_state *st, int ps, char s[])
+-{
+- static const char units[] = "BKMGTPE";
+- const char *unit = units;
+-
+- while (ps > 9 && unit[1]) {
+- ps -= 10;
+- unit++;
+- }
+- seq_printf(st->seq, " %s_ps: %i%c\t", s, 1<<ps, *unit);
+- return ps;
+-}
+-
+-static void dump_flag_info(struct pg_state *st, const struct flag_info
+- *flag, u64 pte, int num)
+-{
+- unsigned int i;
+-
+- for (i = 0; i < num; i++, flag++) {
+- const char *s = NULL;
+- u64 val;
+-
+- /* flag not defined so don't check it */
+- if (flag->mask == 0)
+- continue;
+- /* Some 'flags' are actually values */
+- if (flag->is_val) {
+- val = pte & flag->val;
+- if (flag->shift)
+- val = val >> flag->shift;
+- seq_printf(st->seq, " %s:%llx", flag->set, val);
+- } else {
+- if ((pte & flag->mask) == flag->val)
+- s = flag->set;
+- else
+- s = flag->clear;
+- if (s)
+- seq_printf(st->seq, " %s", s);
+- }
+- }
+-}
+-
+-static void dump_hpte_info(struct pg_state *st, unsigned long ea, u64 v, u64 r,
+- unsigned long rpn, int bps, int aps, unsigned long lp)
+-{
+- int aps_index;
+-
+- while (ea >= st->marker[1].start_address) {
+- st->marker++;
+- seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
+- }
+- seq_printf(st->seq, "0x%lx:\t", ea);
+- seq_printf(st->seq, "AVPN:%llx\t", HPTE_V_AVPN_VAL(v));
+- dump_flag_info(st, v_flag_array, v, ARRAY_SIZE(v_flag_array));
+- seq_printf(st->seq, " rpn: %lx\t", rpn);
+- dump_flag_info(st, r_flag_array, r, ARRAY_SIZE(r_flag_array));
+-
+- calculate_pagesize(st, bps, "base");
+- aps_index = calculate_pagesize(st, aps, "actual");
+- if (aps_index != 2)
+- seq_printf(st->seq, "LP enc: %lx", lp);
+- seq_putc(st->seq, '\n');
+-}
+-
+-
+-static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64
+- *r)
+-{
+- struct hash_pte *hptep;
+- unsigned long hash, vsid, vpn, hpte_group, want_v, hpte_v;
+- int i, ssize = mmu_kernel_ssize;
+- unsigned long shift = mmu_psize_defs[psize].shift;
+-
+- /* calculate hash */
+- vsid = get_kernel_vsid(ea, ssize);
+- vpn = hpt_vpn(ea, vsid, ssize);
+- hash = hpt_hash(vpn, shift, ssize);
+- want_v = hpte_encode_avpn(vpn, psize, ssize);
+-
+- /* to check in the secondary hash table, we invert the hash */
+- if (!primary)
+- hash = ~hash;
+- hpte_group = (hash & htab_hash_mask) * HPTES_PER_GROUP;
+- for (i = 0; i < HPTES_PER_GROUP; i++) {
+- hptep = htab_address + hpte_group;
+- hpte_v = be64_to_cpu(hptep->v);
+-
+- if (HPTE_V_COMPARE(hpte_v, want_v) && (hpte_v & HPTE_V_VALID)) {
+- /* HPTE matches */
+- *v = be64_to_cpu(hptep->v);
+- *r = be64_to_cpu(hptep->r);
+- return 0;
+- }
+- ++hpte_group;
+- }
+- return -1;
+-}
+-
+-#ifdef CONFIG_PPC_PSERIES
+-static int pseries_find(unsigned long ea, int psize, bool primary, u64 *v, u64 *r)
+-{
+- struct hash_pte ptes[4];
+- unsigned long vsid, vpn, hash, hpte_group, want_v;
+- int i, j, ssize = mmu_kernel_ssize;
+- long lpar_rc = 0;
+- unsigned long shift = mmu_psize_defs[psize].shift;
+-
+- /* calculate hash */
+- vsid = get_kernel_vsid(ea, ssize);
+- vpn = hpt_vpn(ea, vsid, ssize);
+- hash = hpt_hash(vpn, shift, ssize);
+- want_v = hpte_encode_avpn(vpn, psize, ssize);
+-
+- /* to check in the secondary hash table, we invert the hash */
+- if (!primary)
+- hash = ~hash;
+- hpte_group = (hash & htab_hash_mask) * HPTES_PER_GROUP;
+- /* see if we can find an entry in the hpte with this hash */
+- for (i = 0; i < HPTES_PER_GROUP; i += 4, hpte_group += 4) {
+- lpar_rc = plpar_pte_read_4(0, hpte_group, (void *)ptes);
+-
+- if (lpar_rc != H_SUCCESS)
+- continue;
+- for (j = 0; j < 4; j++) {
+- if (HPTE_V_COMPARE(ptes[j].v, want_v) &&
+- (ptes[j].v & HPTE_V_VALID)) {
+- /* HPTE matches */
+- *v = ptes[j].v;
+- *r = ptes[j].r;
+- return 0;
+- }
+- }
+- }
+- return -1;
+-}
+-#endif
+-
+-static void decode_r(int bps, unsigned long r, unsigned long *rpn, int *aps,
+- unsigned long *lp_bits)
+-{
+- struct mmu_psize_def entry;
+- unsigned long arpn, mask, lp;
+- int penc = -2, idx = 0, shift;
+-
+- /*.
+- * The LP field has 8 bits. Depending on the actual page size, some of
+- * these bits are concatenated with the APRN to get the RPN. The rest
+- * of the bits in the LP field is the LP value and is an encoding for
+- * the base page size and the actual page size.
+- *
+- * - find the mmu entry for our base page size
+- * - go through all page encodings and use the associated mask to
+- * find an encoding that matches our encoding in the LP field.
+- */
+- arpn = (r & HPTE_R_RPN) >> HPTE_R_RPN_SHIFT;
+- lp = arpn & 0xff;
+-
+- entry = mmu_psize_defs[bps];
+- while (idx < MMU_PAGE_COUNT) {
+- penc = entry.penc[idx];
+- if ((penc != -1) && (mmu_psize_defs[idx].shift)) {
+- shift = mmu_psize_defs[idx].shift - HPTE_R_RPN_SHIFT;
+- mask = (0x1 << (shift)) - 1;
+- if ((lp & mask) == penc) {
+- *aps = mmu_psize_to_shift(idx);
+- *lp_bits = lp & mask;
+- *rpn = arpn >> shift;
+- return;
+- }
+- }
+- idx++;
+- }
+-}
+-
+-static int base_hpte_find(unsigned long ea, int psize, bool primary, u64 *v,
+- u64 *r)
+-{
+-#ifdef CONFIG_PPC_PSERIES
+- if (firmware_has_feature(FW_FEATURE_LPAR))
+- return pseries_find(ea, psize, primary, v, r);
+-#endif
+- return native_find(ea, psize, primary, v, r);
+-}
+-
+-static unsigned long hpte_find(struct pg_state *st, unsigned long ea, int psize)
+-{
+- unsigned long slot;
+- u64 v = 0, r = 0;
+- unsigned long rpn, lp_bits;
+- int base_psize = 0, actual_psize = 0;
+-
+- if (ea < PAGE_OFFSET)
+- return -1;
+-
+- /* Look in primary table */
+- slot = base_hpte_find(ea, psize, true, &v, &r);
+-
+- /* Look in secondary table */
+- if (slot == -1)
+- slot = base_hpte_find(ea, psize, false, &v, &r);
+-
+- /* No entry found */
+- if (slot == -1)
+- return -1;
+-
+- /*
+- * We found an entry in the hash page table:
+- * - check that this has the same base page
+- * - find the actual page size
+- * - find the RPN
+- */
+- base_psize = mmu_psize_to_shift(psize);
+-
+- if ((v & HPTE_V_LARGE) == HPTE_V_LARGE) {
+- decode_r(psize, r, &rpn, &actual_psize, &lp_bits);
+- } else {
+- /* 4K actual page size */
+- actual_psize = 12;
+- rpn = (r & HPTE_R_RPN) >> HPTE_R_RPN_SHIFT;
+- /* In this case there are no LP bits */
+- lp_bits = -1;
+- }
+- /*
+- * We didn't find a matching encoding, so the PTE we found isn't for
+- * this address.
+- */
+- if (actual_psize == -1)
+- return -1;
+-
+- dump_hpte_info(st, ea, v, r, rpn, base_psize, actual_psize, lp_bits);
+- return 0;
+-}
+-
+-static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
+-{
+- pte_t *pte = pte_offset_kernel(pmd, 0);
+- unsigned long addr, pteval, psize;
+- int i, status;
+-
+- for (i = 0; i < PTRS_PER_PTE; i++, pte++) {
+- addr = start + i * PAGE_SIZE;
+- pteval = pte_val(*pte);
+-
+- if (addr < VMALLOC_END)
+- psize = mmu_vmalloc_psize;
+- else
+- psize = mmu_io_psize;
+-#ifdef CONFIG_PPC_64K_PAGES
+- /* check for secret 4K mappings */
+- if (((pteval & H_PAGE_COMBO) == H_PAGE_COMBO) ||
+- ((pteval & H_PAGE_4K_PFN) == H_PAGE_4K_PFN))
+- psize = mmu_io_psize;
+-#endif
+- /* check for hashpte */
+- status = hpte_find(st, addr, psize);
+-
+- if (((pteval & H_PAGE_HASHPTE) != H_PAGE_HASHPTE)
+- && (status != -1)) {
+- /* found a hpte that is not in the linux page tables */
+- seq_printf(st->seq, "page probably bolted before linux"
+- " pagetables were set: addr:%lx, pteval:%lx\n",
+- addr, pteval);
+- }
+- }
+-}
+-
+-static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
+-{
+- pmd_t *pmd = pmd_offset(pud, 0);
+- unsigned long addr;
+- unsigned int i;
+-
+- for (i = 0; i < PTRS_PER_PMD; i++, pmd++) {
+- addr = start + i * PMD_SIZE;
+- if (!pmd_none(*pmd))
+- /* pmd exists */
+- walk_pte(st, pmd, addr);
+- }
+-}
+-
+-static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
+-{
+- pud_t *pud = pud_offset(pgd, 0);
+- unsigned long addr;
+- unsigned int i;
+-
+- for (i = 0; i < PTRS_PER_PUD; i++, pud++) {
+- addr = start + i * PUD_SIZE;
+- if (!pud_none(*pud))
+- /* pud exists */
+- walk_pmd(st, pud, addr);
+- }
+-}
+-
+-static void walk_pagetables(struct pg_state *st)
+-{
+- pgd_t *pgd = pgd_offset_k(0UL);
+- unsigned int i;
+- unsigned long addr;
+-
+- /*
+- * Traverse the linux pagetable structure and dump pages that are in
+- * the hash pagetable.
+- */
+- for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
+- addr = KERN_VIRT_START + i * PGDIR_SIZE;
+- if (!pgd_none(*pgd))
+- /* pgd exists */
+- walk_pud(st, pgd, addr);
+- }
+-}
+-
+-
+-static void walk_linearmapping(struct pg_state *st)
+-{
+- unsigned long addr;
+-
+- /*
+- * Traverse the linear mapping section of virtual memory and dump pages
+- * that are in the hash pagetable.
+- */
+- unsigned long psize = 1 << mmu_psize_defs[mmu_linear_psize].shift;
+-
+- for (addr = PAGE_OFFSET; addr < PAGE_OFFSET +
+- memblock_end_of_DRAM(); addr += psize)
+- hpte_find(st, addr, mmu_linear_psize);
+-}
+-
+-static void walk_vmemmap(struct pg_state *st)
+-{
+-#ifdef CONFIG_SPARSEMEM_VMEMMAP
+- struct vmemmap_backing *ptr = vmemmap_list;
+-
+- /*
+- * Traverse the vmemmaped memory and dump pages that are in the hash
+- * pagetable.
+- */
+- while (ptr->list) {
+- hpte_find(st, ptr->virt_addr, mmu_vmemmap_psize);
+- ptr = ptr->list;
+- }
+- seq_puts(st->seq, "---[ vmemmap end ]---\n");
+-#endif
+-}
+-
+-static void populate_markers(void)
+-{
+- address_markers[0].start_address = PAGE_OFFSET;
+- address_markers[1].start_address = VMALLOC_START;
+- address_markers[2].start_address = VMALLOC_END;
+- address_markers[3].start_address = ISA_IO_BASE;
+- address_markers[4].start_address = ISA_IO_END;
+- address_markers[5].start_address = PHB_IO_BASE;
+- address_markers[6].start_address = PHB_IO_END;
+- address_markers[7].start_address = IOREMAP_BASE;
+- address_markers[8].start_address = IOREMAP_END;
+-#ifdef CONFIG_PPC_BOOK3S_64
+- address_markers[9].start_address = H_VMEMMAP_BASE;
+-#else
+- address_markers[9].start_address = VMEMMAP_BASE;
+-#endif
+-}
+-
+-static int ptdump_show(struct seq_file *m, void *v)
+-{
+- struct pg_state st = {
+- .seq = m,
+- .start_address = PAGE_OFFSET,
+- .marker = address_markers,
+- };
+- /*
+- * Traverse the 0xc, 0xd and 0xf areas of the kernel virtual memory and
+- * dump pages that are in the hash pagetable.
+- */
+- walk_linearmapping(&st);
+- walk_pagetables(&st);
+- walk_vmemmap(&st);
+- return 0;
+-}
+-
+-static int ptdump_open(struct inode *inode, struct file *file)
+-{
+- return single_open(file, ptdump_show, NULL);
+-}
+-
+-static const struct file_operations ptdump_fops = {
+- .open = ptdump_open,
+- .read = seq_read,
+- .llseek = seq_lseek,
+- .release = single_release,
+-};
+-
+-static int ptdump_init(void)
+-{
+- struct dentry *debugfs_file;
+-
+- if (!radix_enabled()) {
+- populate_markers();
+- debugfs_file = debugfs_create_file("kernel_hash_pagetable",
+- 0400, NULL, NULL, &ptdump_fops);
+- return debugfs_file ? 0 : -ENOMEM;
+- }
+- return 0;
+-}
+-device_initcall(ptdump_init);
+diff --git a/arch/powerpc/mm/dump_linuxpagetables-8xx.c b/arch/powerpc/mm/dump_linuxpagetables-8xx.c
+deleted file mode 100644
+index 33f52a97975b4..0000000000000
+--- a/arch/powerpc/mm/dump_linuxpagetables-8xx.c
++++ /dev/null
+@@ -1,82 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * From split of dump_linuxpagetables.c
+- * Copyright 2016, Rashmica Gupta, IBM Corp.
+- *
+- */
+-#include <linux/kernel.h>
+-#include <asm/pgtable.h>
+-
+-#include "dump_linuxpagetables.h"
+-
+-static const struct flag_info flag_array[] = {
+- {
+- .mask = _PAGE_PRIVILEGED,
+- .val = 0,
+- .set = "user",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_RO | _PAGE_NA,
+- .val = 0,
+- .set = "rw",
+- }, {
+- .mask = _PAGE_RO | _PAGE_NA,
+- .val = _PAGE_RO,
+- .set = "r ",
+- }, {
+- .mask = _PAGE_RO | _PAGE_NA,
+- .val = _PAGE_NA,
+- .set = " ",
+- }, {
+- .mask = _PAGE_EXEC,
+- .val = _PAGE_EXEC,
+- .set = " X ",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_PRESENT,
+- .val = _PAGE_PRESENT,
+- .set = "present",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_GUARDED,
+- .val = _PAGE_GUARDED,
+- .set = "guarded",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_DIRTY,
+- .val = _PAGE_DIRTY,
+- .set = "dirty",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_ACCESSED,
+- .val = _PAGE_ACCESSED,
+- .set = "accessed",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_NO_CACHE,
+- .val = _PAGE_NO_CACHE,
+- .set = "no cache",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_SPECIAL,
+- .val = _PAGE_SPECIAL,
+- .set = "special",
+- }
+-};
+-
+-struct pgtable_level pg_level[5] = {
+- {
+- }, { /* pgd */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pud */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pmd */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pte */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- },
+-};
+diff --git a/arch/powerpc/mm/dump_linuxpagetables-book3s64.c b/arch/powerpc/mm/dump_linuxpagetables-book3s64.c
+deleted file mode 100644
+index a637e612b2055..0000000000000
+--- a/arch/powerpc/mm/dump_linuxpagetables-book3s64.c
++++ /dev/null
+@@ -1,115 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * From split of dump_linuxpagetables.c
+- * Copyright 2016, Rashmica Gupta, IBM Corp.
+- *
+- */
+-#include <linux/kernel.h>
+-#include <asm/pgtable.h>
+-
+-#include "dump_linuxpagetables.h"
+-
+-static const struct flag_info flag_array[] = {
+- {
+- .mask = _PAGE_PRIVILEGED,
+- .val = 0,
+- .set = "user",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_READ,
+- .val = _PAGE_READ,
+- .set = "r",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_WRITE,
+- .val = _PAGE_WRITE,
+- .set = "w",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_EXEC,
+- .val = _PAGE_EXEC,
+- .set = " X ",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_PTE,
+- .val = _PAGE_PTE,
+- .set = "pte",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_PRESENT,
+- .val = _PAGE_PRESENT,
+- .set = "present",
+- .clear = " ",
+- }, {
+- .mask = H_PAGE_HASHPTE,
+- .val = H_PAGE_HASHPTE,
+- .set = "hpte",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_DIRTY,
+- .val = _PAGE_DIRTY,
+- .set = "dirty",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_ACCESSED,
+- .val = _PAGE_ACCESSED,
+- .set = "accessed",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_NON_IDEMPOTENT,
+- .val = _PAGE_NON_IDEMPOTENT,
+- .set = "non-idempotent",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_TOLERANT,
+- .val = _PAGE_TOLERANT,
+- .set = "tolerant",
+- .clear = " ",
+- }, {
+- .mask = H_PAGE_BUSY,
+- .val = H_PAGE_BUSY,
+- .set = "busy",
+- }, {
+-#ifdef CONFIG_PPC_64K_PAGES
+- .mask = H_PAGE_COMBO,
+- .val = H_PAGE_COMBO,
+- .set = "combo",
+- }, {
+- .mask = H_PAGE_4K_PFN,
+- .val = H_PAGE_4K_PFN,
+- .set = "4K_pfn",
+- }, {
+-#else /* CONFIG_PPC_64K_PAGES */
+- .mask = H_PAGE_F_GIX,
+- .val = H_PAGE_F_GIX,
+- .set = "f_gix",
+- .is_val = true,
+- .shift = H_PAGE_F_GIX_SHIFT,
+- }, {
+- .mask = H_PAGE_F_SECOND,
+- .val = H_PAGE_F_SECOND,
+- .set = "f_second",
+- }, {
+-#endif /* CONFIG_PPC_64K_PAGES */
+- .mask = _PAGE_SPECIAL,
+- .val = _PAGE_SPECIAL,
+- .set = "special",
+- }
+-};
+-
+-struct pgtable_level pg_level[5] = {
+- {
+- }, { /* pgd */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pud */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pmd */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pte */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- },
+-};
+diff --git a/arch/powerpc/mm/dump_linuxpagetables-generic.c b/arch/powerpc/mm/dump_linuxpagetables-generic.c
+deleted file mode 100644
+index fed6923bcb46e..0000000000000
+--- a/arch/powerpc/mm/dump_linuxpagetables-generic.c
++++ /dev/null
+@@ -1,82 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * From split of dump_linuxpagetables.c
+- * Copyright 2016, Rashmica Gupta, IBM Corp.
+- *
+- */
+-#include <linux/kernel.h>
+-#include <asm/pgtable.h>
+-
+-#include "dump_linuxpagetables.h"
+-
+-static const struct flag_info flag_array[] = {
+- {
+- .mask = _PAGE_USER,
+- .val = _PAGE_USER,
+- .set = "user",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_RW,
+- .val = 0,
+- .set = "r ",
+- .clear = "rw",
+- }, {
+-#ifndef CONFIG_PPC_BOOK3S_32
+- .mask = _PAGE_EXEC,
+- .val = _PAGE_EXEC,
+- .set = " X ",
+- .clear = " ",
+- }, {
+-#endif
+- .mask = _PAGE_PRESENT,
+- .val = _PAGE_PRESENT,
+- .set = "present",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_GUARDED,
+- .val = _PAGE_GUARDED,
+- .set = "guarded",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_DIRTY,
+- .val = _PAGE_DIRTY,
+- .set = "dirty",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_ACCESSED,
+- .val = _PAGE_ACCESSED,
+- .set = "accessed",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_WRITETHRU,
+- .val = _PAGE_WRITETHRU,
+- .set = "write through",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_NO_CACHE,
+- .val = _PAGE_NO_CACHE,
+- .set = "no cache",
+- .clear = " ",
+- }, {
+- .mask = _PAGE_SPECIAL,
+- .val = _PAGE_SPECIAL,
+- .set = "special",
+- }
+-};
+-
+-struct pgtable_level pg_level[5] = {
+- {
+- }, { /* pgd */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pud */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pmd */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- }, { /* pte */
+- .flag = flag_array,
+- .num = ARRAY_SIZE(flag_array),
+- },
+-};
+diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c
+deleted file mode 100644
+index 6aa41669ac1ae..0000000000000
+--- a/arch/powerpc/mm/dump_linuxpagetables.c
++++ /dev/null
+@@ -1,373 +0,0 @@
+-/*
+- * Copyright 2016, Rashmica Gupta, IBM Corp.
+- *
+- * This traverses the kernel pagetables and dumps the
+- * information about the used sections of memory to
+- * /sys/kernel/debug/kernel_pagetables.
+- *
+- * Derived from the arm64 implementation:
+- * Copyright (c) 2014, The Linux Foundation, Laura Abbott.
+- * (C) Copyright 2008 Intel Corporation, Arjan van de Ven.
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License
+- * as published by the Free Software Foundation; version 2
+- * of the License.
+- */
+-#include <linux/debugfs.h>
+-#include <linux/fs.h>
+-#include <linux/hugetlb.h>
+-#include <linux/io.h>
+-#include <linux/mm.h>
+-#include <linux/highmem.h>
+-#include <linux/sched.h>
+-#include <linux/seq_file.h>
+-#include <asm/fixmap.h>
+-#include <asm/pgtable.h>
+-#include <linux/const.h>
+-#include <asm/page.h>
+-#include <asm/pgalloc.h>
+-
+-#include "dump_linuxpagetables.h"
+-
+-#ifdef CONFIG_PPC32
+-#define KERN_VIRT_START 0
+-#endif
+-
+-/*
+- * To visualise what is happening,
+- *
+- * - PTRS_PER_P** = how many entries there are in the corresponding P**
+- * - P**_SHIFT = how many bits of the address we use to index into the
+- * corresponding P**
+- * - P**_SIZE is how much memory we can access through the table - not the
+- * size of the table itself.
+- * P**={PGD, PUD, PMD, PTE}
+- *
+- *
+- * Each entry of the PGD points to a PUD. Each entry of a PUD points to a
+- * PMD. Each entry of a PMD points to a PTE. And every PTE entry points to
+- * a page.
+- *
+- * In the case where there are only 3 levels, the PUD is folded into the
+- * PGD: every PUD has only one entry which points to the PMD.
+- *
+- * The page dumper groups page table entries of the same type into a single
+- * description. It uses pg_state to track the range information while
+- * iterating over the PTE entries. When the continuity is broken it then
+- * dumps out a description of the range - ie PTEs that are virtually contiguous
+- * with the same PTE flags are chunked together. This is to make it clear how
+- * different areas of the kernel virtual memory are used.
+- *
+- */
+-struct pg_state {
+- struct seq_file *seq;
+- const struct addr_marker *marker;
+- unsigned long start_address;
+- unsigned long start_pa;
+- unsigned long last_pa;
+- unsigned int level;
+- u64 current_flags;
+-};
+-
+-struct addr_marker {
+- unsigned long start_address;
+- const char *name;
+-};
+-
+-static struct addr_marker address_markers[] = {
+- { 0, "Start of kernel VM" },
+- { 0, "vmalloc() Area" },
+- { 0, "vmalloc() End" },
+-#ifdef CONFIG_PPC64
+- { 0, "isa I/O start" },
+- { 0, "isa I/O end" },
+- { 0, "phb I/O start" },
+- { 0, "phb I/O end" },
+- { 0, "I/O remap start" },
+- { 0, "I/O remap end" },
+- { 0, "vmemmap start" },
+-#else
+- { 0, "Early I/O remap start" },
+- { 0, "Early I/O remap end" },
+-#ifdef CONFIG_NOT_COHERENT_CACHE
+- { 0, "Consistent mem start" },
+- { 0, "Consistent mem end" },
+-#endif
+-#ifdef CONFIG_HIGHMEM
+- { 0, "Highmem PTEs start" },
+- { 0, "Highmem PTEs end" },
+-#endif
+- { 0, "Fixmap start" },
+- { 0, "Fixmap end" },
+-#endif
+- { -1, NULL },
+-};
+-
+-static void dump_flag_info(struct pg_state *st, const struct flag_info
+- *flag, u64 pte, int num)
+-{
+- unsigned int i;
+-
+- for (i = 0; i < num; i++, flag++) {
+- const char *s = NULL;
+- u64 val;
+-
+- /* flag not defined so don't check it */
+- if (flag->mask == 0)
+- continue;
+- /* Some 'flags' are actually values */
+- if (flag->is_val) {
+- val = pte & flag->val;
+- if (flag->shift)
+- val = val >> flag->shift;
+- seq_printf(st->seq, " %s:%llx", flag->set, val);
+- } else {
+- if ((pte & flag->mask) == flag->val)
+- s = flag->set;
+- else
+- s = flag->clear;
+- if (s)
+- seq_printf(st->seq, " %s", s);
+- }
+- st->current_flags &= ~flag->mask;
+- }
+- if (st->current_flags != 0)
+- seq_printf(st->seq, " unknown flags:%llx", st->current_flags);
+-}
+-
+-static void dump_addr(struct pg_state *st, unsigned long addr)
+-{
+- static const char units[] = "KMGTPE";
+- const char *unit = units;
+- unsigned long delta;
+-
+-#ifdef CONFIG_PPC64
+- seq_printf(st->seq, "0x%016lx-0x%016lx ", st->start_address, addr-1);
+- seq_printf(st->seq, "0x%016lx ", st->start_pa);
+-#else
+- seq_printf(st->seq, "0x%08lx-0x%08lx ", st->start_address, addr - 1);
+- seq_printf(st->seq, "0x%08lx ", st->start_pa);
+-#endif
+-
+- delta = (addr - st->start_address) >> 10;
+- /* Work out what appropriate unit to use */
+- while (!(delta & 1023) && unit[1]) {
+- delta >>= 10;
+- unit++;
+- }
+- seq_printf(st->seq, "%9lu%c", delta, *unit);
+-
+-}
+-
+-static void note_page(struct pg_state *st, unsigned long addr,
+- unsigned int level, u64 val)
+-{
+- u64 flag = val & pg_level[level].mask;
+- u64 pa = val & PTE_RPN_MASK;
+-
+- /* At first no level is set */
+- if (!st->level) {
+- st->level = level;
+- st->current_flags = flag;
+- st->start_address = addr;
+- st->start_pa = pa;
+- st->last_pa = pa;
+- seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
+- /*
+- * Dump the section of virtual memory when:
+- * - the PTE flags from one entry to the next differs.
+- * - we change levels in the tree.
+- * - the address is in a different section of memory and is thus
+- * used for a different purpose, regardless of the flags.
+- * - the pa of this page is not adjacent to the last inspected page
+- */
+- } else if (flag != st->current_flags || level != st->level ||
+- addr >= st->marker[1].start_address ||
+- pa != st->last_pa + PAGE_SIZE) {
+-
+- /* Check the PTE flags */
+- if (st->current_flags) {
+- dump_addr(st, addr);
+-
+- /* Dump all the flags */
+- if (pg_level[st->level].flag)
+- dump_flag_info(st, pg_level[st->level].flag,
+- st->current_flags,
+- pg_level[st->level].num);
+-
+- seq_putc(st->seq, '\n');
+- }
+-
+- /*
+- * Address indicates we have passed the end of the
+- * current section of virtual memory
+- */
+- while (addr >= st->marker[1].start_address) {
+- st->marker++;
+- seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
+- }
+- st->start_address = addr;
+- st->start_pa = pa;
+- st->last_pa = pa;
+- st->current_flags = flag;
+- st->level = level;
+- } else {
+- st->last_pa = pa;
+- }
+-}
+-
+-static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
+-{
+- pte_t *pte = pte_offset_kernel(pmd, 0);
+- unsigned long addr;
+- unsigned int i;
+-
+- for (i = 0; i < PTRS_PER_PTE; i++, pte++) {
+- addr = start + i * PAGE_SIZE;
+- note_page(st, addr, 4, pte_val(*pte));
+-
+- }
+-}
+-
+-static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
+-{
+- pmd_t *pmd = pmd_offset(pud, 0);
+- unsigned long addr;
+- unsigned int i;
+-
+- for (i = 0; i < PTRS_PER_PMD; i++, pmd++) {
+- addr = start + i * PMD_SIZE;
+- if (!pmd_none(*pmd) && !pmd_huge(*pmd))
+- /* pmd exists */
+- walk_pte(st, pmd, addr);
+- else
+- note_page(st, addr, 3, pmd_val(*pmd));
+- }
+-}
+-
+-static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
+-{
+- pud_t *pud = pud_offset(pgd, 0);
+- unsigned long addr;
+- unsigned int i;
+-
+- for (i = 0; i < PTRS_PER_PUD; i++, pud++) {
+- addr = start + i * PUD_SIZE;
+- if (!pud_none(*pud) && !pud_huge(*pud))
+- /* pud exists */
+- walk_pmd(st, pud, addr);
+- else
+- note_page(st, addr, 2, pud_val(*pud));
+- }
+-}
+-
+-static void walk_pagetables(struct pg_state *st)
+-{
+- pgd_t *pgd = pgd_offset_k(0UL);
+- unsigned int i;
+- unsigned long addr;
+-
+- addr = st->start_address;
+-
+- /*
+- * Traverse the linux pagetable structure and dump pages that are in
+- * the hash pagetable.
+- */
+- for (i = 0; i < PTRS_PER_PGD; i++, pgd++, addr += PGDIR_SIZE) {
+- if (!pgd_none(*pgd) && !pgd_huge(*pgd))
+- /* pgd exists */
+- walk_pud(st, pgd, addr);
+- else
+- note_page(st, addr, 1, pgd_val(*pgd));
+- }
+-}
+-
+-static void populate_markers(void)
+-{
+- int i = 0;
+-
+- address_markers[i++].start_address = PAGE_OFFSET;
+- address_markers[i++].start_address = VMALLOC_START;
+- address_markers[i++].start_address = VMALLOC_END;
+-#ifdef CONFIG_PPC64
+- address_markers[i++].start_address = ISA_IO_BASE;
+- address_markers[i++].start_address = ISA_IO_END;
+- address_markers[i++].start_address = PHB_IO_BASE;
+- address_markers[i++].start_address = PHB_IO_END;
+- address_markers[i++].start_address = IOREMAP_BASE;
+- address_markers[i++].start_address = IOREMAP_END;
+-#ifdef CONFIG_PPC_BOOK3S_64
+- address_markers[i++].start_address = H_VMEMMAP_BASE;
+-#else
+- address_markers[i++].start_address = VMEMMAP_BASE;
+-#endif
+-#else /* !CONFIG_PPC64 */
+- address_markers[i++].start_address = ioremap_bot;
+- address_markers[i++].start_address = IOREMAP_TOP;
+-#ifdef CONFIG_NOT_COHERENT_CACHE
+- address_markers[i++].start_address = IOREMAP_TOP;
+- address_markers[i++].start_address = IOREMAP_TOP +
+- CONFIG_CONSISTENT_SIZE;
+-#endif
+-#ifdef CONFIG_HIGHMEM
+- address_markers[i++].start_address = PKMAP_BASE;
+- address_markers[i++].start_address = PKMAP_ADDR(LAST_PKMAP);
+-#endif
+- address_markers[i++].start_address = FIXADDR_START;
+- address_markers[i++].start_address = FIXADDR_TOP;
+-#endif /* CONFIG_PPC64 */
+-}
+-
+-static int ptdump_show(struct seq_file *m, void *v)
+-{
+- struct pg_state st = {
+- .seq = m,
+- .marker = address_markers,
+- };
+-
+- if (radix_enabled())
+- st.start_address = PAGE_OFFSET;
+- else
+- st.start_address = KERN_VIRT_START;
+-
+- /* Traverse kernel page tables */
+- walk_pagetables(&st);
+- note_page(&st, 0, 0, 0);
+- return 0;
+-}
+-
+-
+-static int ptdump_open(struct inode *inode, struct file *file)
+-{
+- return single_open(file, ptdump_show, NULL);
+-}
+-
+-static const struct file_operations ptdump_fops = {
+- .open = ptdump_open,
+- .read = seq_read,
+- .llseek = seq_lseek,
+- .release = single_release,
+-};
+-
+-static void build_pgtable_complete_mask(void)
+-{
+- unsigned int i, j;
+-
+- for (i = 0; i < ARRAY_SIZE(pg_level); i++)
+- if (pg_level[i].flag)
+- for (j = 0; j < pg_level[i].num; j++)
+- pg_level[i].mask |= pg_level[i].flag[j].mask;
+-}
+-
+-static int ptdump_init(void)
+-{
+- struct dentry *debugfs_file;
+-
+- populate_markers();
+- build_pgtable_complete_mask();
+- debugfs_file = debugfs_create_file("kernel_page_tables", 0400, NULL,
+- NULL, &ptdump_fops);
+- return debugfs_file ? 0 : -ENOMEM;
+-}
+-device_initcall(ptdump_init);
+diff --git a/arch/powerpc/mm/dump_linuxpagetables.h b/arch/powerpc/mm/dump_linuxpagetables.h
+deleted file mode 100644
+index 5d513636de73a..0000000000000
+--- a/arch/powerpc/mm/dump_linuxpagetables.h
++++ /dev/null
+@@ -1,19 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#include <linux/types.h>
+-
+-struct flag_info {
+- u64 mask;
+- u64 val;
+- const char *set;
+- const char *clear;
+- bool is_val;
+- int shift;
+-};
+-
+-struct pgtable_level {
+- const struct flag_info *flag;
+- size_t num;
+- u64 mask;
+-};
+-
+-extern struct pgtable_level pg_level[5];
+diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
+index 9ee235fca4278..75cbedaac5d26 100644
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -1041,8 +1041,8 @@ void radix__ptep_set_access_flags(struct vm_area_struct *vma, pte_t *ptep,
+ pte_t entry, unsigned long address, int psize)
+ {
+ struct mm_struct *mm = vma->vm_mm;
+- unsigned long set = pte_val(entry) & (_PAGE_DIRTY | _PAGE_ACCESSED |
+- _PAGE_RW | _PAGE_EXEC);
++ unsigned long set = pte_val(entry) & (_PAGE_DIRTY | _PAGE_SOFT_DIRTY |
++ _PAGE_ACCESSED | _PAGE_RW | _PAGE_EXEC);
+
+ unsigned long change = pte_val(entry) ^ pte_val(*ptep);
+ /*
+diff --git a/arch/powerpc/mm/ptdump/8xx.c b/arch/powerpc/mm/ptdump/8xx.c
+new file mode 100644
+index 0000000000000..80b4f73f7fdc2
+--- /dev/null
++++ b/arch/powerpc/mm/ptdump/8xx.c
+@@ -0,0 +1,82 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * From split of dump_linuxpagetables.c
++ * Copyright 2016, Rashmica Gupta, IBM Corp.
++ *
++ */
++#include <linux/kernel.h>
++#include <asm/pgtable.h>
++
++#include "ptdump.h"
++
++static const struct flag_info flag_array[] = {
++ {
++ .mask = _PAGE_PRIVILEGED,
++ .val = 0,
++ .set = "user",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_RO | _PAGE_NA,
++ .val = 0,
++ .set = "rw",
++ }, {
++ .mask = _PAGE_RO | _PAGE_NA,
++ .val = _PAGE_RO,
++ .set = "r ",
++ }, {
++ .mask = _PAGE_RO | _PAGE_NA,
++ .val = _PAGE_NA,
++ .set = " ",
++ }, {
++ .mask = _PAGE_EXEC,
++ .val = _PAGE_EXEC,
++ .set = " X ",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_PRESENT,
++ .val = _PAGE_PRESENT,
++ .set = "present",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_GUARDED,
++ .val = _PAGE_GUARDED,
++ .set = "guarded",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_DIRTY,
++ .val = _PAGE_DIRTY,
++ .set = "dirty",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_ACCESSED,
++ .val = _PAGE_ACCESSED,
++ .set = "accessed",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_NO_CACHE,
++ .val = _PAGE_NO_CACHE,
++ .set = "no cache",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_SPECIAL,
++ .val = _PAGE_SPECIAL,
++ .set = "special",
++ }
++};
++
++struct pgtable_level pg_level[5] = {
++ {
++ }, { /* pgd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pud */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pmd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pte */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ },
++};
+diff --git a/arch/powerpc/mm/ptdump/Makefile b/arch/powerpc/mm/ptdump/Makefile
+new file mode 100644
+index 0000000000000..712762be3cb11
+--- /dev/null
++++ b/arch/powerpc/mm/ptdump/Makefile
+@@ -0,0 +1,9 @@
++# SPDX-License-Identifier: GPL-2.0
++
++obj-y += ptdump.o
++
++obj-$(CONFIG_4xx) += shared.o
++obj-$(CONFIG_PPC_8xx) += 8xx.o
++obj-$(CONFIG_PPC_BOOK3E_MMU) += shared.o
++obj-$(CONFIG_PPC_BOOK3S_32) += shared.o bats.o segment_regs.o
++obj-$(CONFIG_PPC_BOOK3S_64) += book3s64.o hashpagetable.o
+diff --git a/arch/powerpc/mm/ptdump/bats.c b/arch/powerpc/mm/ptdump/bats.c
+new file mode 100644
+index 0000000000000..a0d23e96e841a
+--- /dev/null
++++ b/arch/powerpc/mm/ptdump/bats.c
+@@ -0,0 +1,173 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2018, Christophe Leroy CS S.I.
++ * <christophe.leroy@c-s.fr>
++ *
++ * This dumps the content of BATS
++ */
++
++#include <asm/debugfs.h>
++#include <asm/pgtable.h>
++#include <asm/cpu_has_feature.h>
++
++static char *pp_601(int k, int pp)
++{
++ if (pp == 0)
++ return k ? "NA" : "RWX";
++ if (pp == 1)
++ return k ? "ROX" : "RWX";
++ if (pp == 2)
++ return k ? "RWX" : "RWX";
++ return k ? "ROX" : "ROX";
++}
++
++static void bat_show_601(struct seq_file *m, int idx, u32 lower, u32 upper)
++{
++ u32 blpi = upper & 0xfffe0000;
++ u32 k = (upper >> 2) & 3;
++ u32 pp = upper & 3;
++ phys_addr_t pbn = PHYS_BAT_ADDR(lower);
++ u32 bsm = lower & 0x3ff;
++ u32 size = (bsm + 1) << 17;
++
++ seq_printf(m, "%d: ", idx);
++ if (!(lower & 0x40)) {
++ seq_puts(m, " -\n");
++ return;
++ }
++
++ seq_printf(m, "0x%08x-0x%08x ", blpi, blpi + size - 1);
++#ifdef CONFIG_PHYS_64BIT
++ seq_printf(m, "0x%016llx ", pbn);
++#else
++ seq_printf(m, "0x%08x ", pbn);
++#endif
++
++ seq_printf(m, "Kernel %s User %s", pp_601(k & 2, pp), pp_601(k & 1, pp));
++
++ if (lower & _PAGE_WRITETHRU)
++ seq_puts(m, "write through ");
++ if (lower & _PAGE_NO_CACHE)
++ seq_puts(m, "no cache ");
++ if (lower & _PAGE_COHERENT)
++ seq_puts(m, "coherent ");
++ seq_puts(m, "\n");
++}
++
++#define BAT_SHOW_601(_m, _n, _l, _u) bat_show_601(_m, _n, mfspr(_l), mfspr(_u))
++
++static int bats_show_601(struct seq_file *m, void *v)
++{
++ seq_puts(m, "---[ Block Address Translation ]---\n");
++
++ BAT_SHOW_601(m, 0, SPRN_IBAT0L, SPRN_IBAT0U);
++ BAT_SHOW_601(m, 1, SPRN_IBAT1L, SPRN_IBAT1U);
++ BAT_SHOW_601(m, 2, SPRN_IBAT2L, SPRN_IBAT2U);
++ BAT_SHOW_601(m, 3, SPRN_IBAT3L, SPRN_IBAT3U);
++
++ return 0;
++}
++
++static void bat_show_603(struct seq_file *m, int idx, u32 lower, u32 upper, bool is_d)
++{
++ u32 bepi = upper & 0xfffe0000;
++ u32 bl = (upper >> 2) & 0x7ff;
++ u32 k = upper & 3;
++ phys_addr_t brpn = PHYS_BAT_ADDR(lower);
++ u32 size = (bl + 1) << 17;
++
++ seq_printf(m, "%d: ", idx);
++ if (k == 0) {
++ seq_puts(m, " -\n");
++ return;
++ }
++
++ seq_printf(m, "0x%08x-0x%08x ", bepi, bepi + size - 1);
++#ifdef CONFIG_PHYS_64BIT
++ seq_printf(m, "0x%016llx ", brpn);
++#else
++ seq_printf(m, "0x%08x ", brpn);
++#endif
++
++ if (k == 1)
++ seq_puts(m, "User ");
++ else if (k == 2)
++ seq_puts(m, "Kernel ");
++ else
++ seq_puts(m, "Kernel/User ");
++
++ if (lower & BPP_RX)
++ seq_puts(m, is_d ? "RO " : "EXEC ");
++ else if (lower & BPP_RW)
++ seq_puts(m, is_d ? "RW " : "EXEC ");
++ else
++ seq_puts(m, is_d ? "NA " : "NX ");
++
++ if (lower & _PAGE_WRITETHRU)
++ seq_puts(m, "write through ");
++ if (lower & _PAGE_NO_CACHE)
++ seq_puts(m, "no cache ");
++ if (lower & _PAGE_COHERENT)
++ seq_puts(m, "coherent ");
++ if (lower & _PAGE_GUARDED)
++ seq_puts(m, "guarded ");
++ seq_puts(m, "\n");
++}
++
++#define BAT_SHOW_603(_m, _n, _l, _u, _d) bat_show_603(_m, _n, mfspr(_l), mfspr(_u), _d)
++
++static int bats_show_603(struct seq_file *m, void *v)
++{
++ seq_puts(m, "---[ Instruction Block Address Translation ]---\n");
++
++ BAT_SHOW_603(m, 0, SPRN_IBAT0L, SPRN_IBAT0U, false);
++ BAT_SHOW_603(m, 1, SPRN_IBAT1L, SPRN_IBAT1U, false);
++ BAT_SHOW_603(m, 2, SPRN_IBAT2L, SPRN_IBAT2U, false);
++ BAT_SHOW_603(m, 3, SPRN_IBAT3L, SPRN_IBAT3U, false);
++ if (mmu_has_feature(MMU_FTR_USE_HIGH_BATS)) {
++ BAT_SHOW_603(m, 4, SPRN_IBAT4L, SPRN_IBAT4U, false);
++ BAT_SHOW_603(m, 5, SPRN_IBAT5L, SPRN_IBAT5U, false);
++ BAT_SHOW_603(m, 6, SPRN_IBAT6L, SPRN_IBAT6U, false);
++ BAT_SHOW_603(m, 7, SPRN_IBAT7L, SPRN_IBAT7U, false);
++ }
++
++ seq_puts(m, "\n---[ Data Block Address Translation ]---\n");
++
++ BAT_SHOW_603(m, 0, SPRN_DBAT0L, SPRN_DBAT0U, true);
++ BAT_SHOW_603(m, 1, SPRN_DBAT1L, SPRN_DBAT1U, true);
++ BAT_SHOW_603(m, 2, SPRN_DBAT2L, SPRN_DBAT2U, true);
++ BAT_SHOW_603(m, 3, SPRN_DBAT3L, SPRN_DBAT3U, true);
++ if (mmu_has_feature(MMU_FTR_USE_HIGH_BATS)) {
++ BAT_SHOW_603(m, 4, SPRN_DBAT4L, SPRN_DBAT4U, true);
++ BAT_SHOW_603(m, 5, SPRN_DBAT5L, SPRN_DBAT5U, true);
++ BAT_SHOW_603(m, 6, SPRN_DBAT6L, SPRN_DBAT6U, true);
++ BAT_SHOW_603(m, 7, SPRN_DBAT7L, SPRN_DBAT7U, true);
++ }
++
++ return 0;
++}
++
++static int bats_open(struct inode *inode, struct file *file)
++{
++ if (cpu_has_feature(CPU_FTR_601))
++ return single_open(file, bats_show_601, NULL);
++
++ return single_open(file, bats_show_603, NULL);
++}
++
++static const struct file_operations bats_fops = {
++ .open = bats_open,
++ .read = seq_read,
++ .llseek = seq_lseek,
++ .release = single_release,
++};
++
++static int __init bats_init(void)
++{
++ struct dentry *debugfs_file;
++
++ debugfs_file = debugfs_create_file("block_address_translation", 0400,
++ powerpc_debugfs_root, NULL, &bats_fops);
++ return debugfs_file ? 0 : -ENOMEM;
++}
++device_initcall(bats_init);
+diff --git a/arch/powerpc/mm/ptdump/book3s64.c b/arch/powerpc/mm/ptdump/book3s64.c
+new file mode 100644
+index 0000000000000..0bce5b85d0112
+--- /dev/null
++++ b/arch/powerpc/mm/ptdump/book3s64.c
+@@ -0,0 +1,115 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * From split of dump_linuxpagetables.c
++ * Copyright 2016, Rashmica Gupta, IBM Corp.
++ *
++ */
++#include <linux/kernel.h>
++#include <asm/pgtable.h>
++
++#include "ptdump.h"
++
++static const struct flag_info flag_array[] = {
++ {
++ .mask = _PAGE_PRIVILEGED,
++ .val = 0,
++ .set = "user",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_READ,
++ .val = _PAGE_READ,
++ .set = "r",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_WRITE,
++ .val = _PAGE_WRITE,
++ .set = "w",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_EXEC,
++ .val = _PAGE_EXEC,
++ .set = " X ",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_PTE,
++ .val = _PAGE_PTE,
++ .set = "pte",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_PRESENT,
++ .val = _PAGE_PRESENT,
++ .set = "present",
++ .clear = " ",
++ }, {
++ .mask = H_PAGE_HASHPTE,
++ .val = H_PAGE_HASHPTE,
++ .set = "hpte",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_DIRTY,
++ .val = _PAGE_DIRTY,
++ .set = "dirty",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_ACCESSED,
++ .val = _PAGE_ACCESSED,
++ .set = "accessed",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_NON_IDEMPOTENT,
++ .val = _PAGE_NON_IDEMPOTENT,
++ .set = "non-idempotent",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_TOLERANT,
++ .val = _PAGE_TOLERANT,
++ .set = "tolerant",
++ .clear = " ",
++ }, {
++ .mask = H_PAGE_BUSY,
++ .val = H_PAGE_BUSY,
++ .set = "busy",
++ }, {
++#ifdef CONFIG_PPC_64K_PAGES
++ .mask = H_PAGE_COMBO,
++ .val = H_PAGE_COMBO,
++ .set = "combo",
++ }, {
++ .mask = H_PAGE_4K_PFN,
++ .val = H_PAGE_4K_PFN,
++ .set = "4K_pfn",
++ }, {
++#else /* CONFIG_PPC_64K_PAGES */
++ .mask = H_PAGE_F_GIX,
++ .val = H_PAGE_F_GIX,
++ .set = "f_gix",
++ .is_val = true,
++ .shift = H_PAGE_F_GIX_SHIFT,
++ }, {
++ .mask = H_PAGE_F_SECOND,
++ .val = H_PAGE_F_SECOND,
++ .set = "f_second",
++ }, {
++#endif /* CONFIG_PPC_64K_PAGES */
++ .mask = _PAGE_SPECIAL,
++ .val = _PAGE_SPECIAL,
++ .set = "special",
++ }
++};
++
++struct pgtable_level pg_level[5] = {
++ {
++ }, { /* pgd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pud */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pmd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pte */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ },
++};
+diff --git a/arch/powerpc/mm/ptdump/hashpagetable.c b/arch/powerpc/mm/ptdump/hashpagetable.c
+new file mode 100644
+index 0000000000000..b430e4e08af69
+--- /dev/null
++++ b/arch/powerpc/mm/ptdump/hashpagetable.c
+@@ -0,0 +1,550 @@
++/*
++ * Copyright 2016, Rashmica Gupta, IBM Corp.
++ *
++ * This traverses the kernel virtual memory and dumps the pages that are in
++ * the hash pagetable, along with their flags to
++ * /sys/kernel/debug/kernel_hash_pagetable.
++ *
++ * If radix is enabled then there is no hash page table and so no debugfs file
++ * is generated.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; version 2
++ * of the License.
++ */
++#include <linux/debugfs.h>
++#include <linux/fs.h>
++#include <linux/io.h>
++#include <linux/mm.h>
++#include <linux/sched.h>
++#include <linux/seq_file.h>
++#include <asm/pgtable.h>
++#include <linux/const.h>
++#include <asm/page.h>
++#include <asm/pgalloc.h>
++#include <asm/plpar_wrappers.h>
++#include <linux/memblock.h>
++#include <asm/firmware.h>
++
++struct pg_state {
++ struct seq_file *seq;
++ const struct addr_marker *marker;
++ unsigned long start_address;
++ unsigned int level;
++ u64 current_flags;
++};
++
++struct addr_marker {
++ unsigned long start_address;
++ const char *name;
++};
++
++static struct addr_marker address_markers[] = {
++ { 0, "Start of kernel VM" },
++ { 0, "vmalloc() Area" },
++ { 0, "vmalloc() End" },
++ { 0, "isa I/O start" },
++ { 0, "isa I/O end" },
++ { 0, "phb I/O start" },
++ { 0, "phb I/O end" },
++ { 0, "I/O remap start" },
++ { 0, "I/O remap end" },
++ { 0, "vmemmap start" },
++ { -1, NULL },
++};
++
++struct flag_info {
++ u64 mask;
++ u64 val;
++ const char *set;
++ const char *clear;
++ bool is_val;
++ int shift;
++};
++
++static const struct flag_info v_flag_array[] = {
++ {
++ .mask = SLB_VSID_B,
++ .val = SLB_VSID_B_256M,
++ .set = "ssize: 256M",
++ .clear = "ssize: 1T ",
++ }, {
++ .mask = HPTE_V_SECONDARY,
++ .val = HPTE_V_SECONDARY,
++ .set = "secondary",
++ .clear = "primary ",
++ }, {
++ .mask = HPTE_V_VALID,
++ .val = HPTE_V_VALID,
++ .set = "valid ",
++ .clear = "invalid",
++ }, {
++ .mask = HPTE_V_BOLTED,
++ .val = HPTE_V_BOLTED,
++ .set = "bolted",
++ .clear = "",
++ }
++};
++
++static const struct flag_info r_flag_array[] = {
++ {
++ .mask = HPTE_R_PP0 | HPTE_R_PP,
++ .val = PP_RWXX,
++ .set = "prot:RW--",
++ }, {
++ .mask = HPTE_R_PP0 | HPTE_R_PP,
++ .val = PP_RWRX,
++ .set = "prot:RWR-",
++ }, {
++ .mask = HPTE_R_PP0 | HPTE_R_PP,
++ .val = PP_RWRW,
++ .set = "prot:RWRW",
++ }, {
++ .mask = HPTE_R_PP0 | HPTE_R_PP,
++ .val = PP_RXRX,
++ .set = "prot:R-R-",
++ }, {
++ .mask = HPTE_R_PP0 | HPTE_R_PP,
++ .val = PP_RXXX,
++ .set = "prot:R---",
++ }, {
++ .mask = HPTE_R_KEY_HI | HPTE_R_KEY_LO,
++ .val = HPTE_R_KEY_HI | HPTE_R_KEY_LO,
++ .set = "key",
++ .clear = "",
++ .is_val = true,
++ }, {
++ .mask = HPTE_R_R,
++ .val = HPTE_R_R,
++ .set = "ref",
++ .clear = " ",
++ }, {
++ .mask = HPTE_R_C,
++ .val = HPTE_R_C,
++ .set = "changed",
++ .clear = " ",
++ }, {
++ .mask = HPTE_R_N,
++ .val = HPTE_R_N,
++ .set = "no execute",
++ }, {
++ .mask = HPTE_R_WIMG,
++ .val = HPTE_R_W,
++ .set = "writethru",
++ }, {
++ .mask = HPTE_R_WIMG,
++ .val = HPTE_R_I,
++ .set = "no cache",
++ }, {
++ .mask = HPTE_R_WIMG,
++ .val = HPTE_R_G,
++ .set = "guarded",
++ }
++};
++
++static int calculate_pagesize(struct pg_state *st, int ps, char s[])
++{
++ static const char units[] = "BKMGTPE";
++ const char *unit = units;
++
++ while (ps > 9 && unit[1]) {
++ ps -= 10;
++ unit++;
++ }
++ seq_printf(st->seq, " %s_ps: %i%c\t", s, 1<<ps, *unit);
++ return ps;
++}
++
++static void dump_flag_info(struct pg_state *st, const struct flag_info
++ *flag, u64 pte, int num)
++{
++ unsigned int i;
++
++ for (i = 0; i < num; i++, flag++) {
++ const char *s = NULL;
++ u64 val;
++
++ /* flag not defined so don't check it */
++ if (flag->mask == 0)
++ continue;
++ /* Some 'flags' are actually values */
++ if (flag->is_val) {
++ val = pte & flag->val;
++ if (flag->shift)
++ val = val >> flag->shift;
++ seq_printf(st->seq, " %s:%llx", flag->set, val);
++ } else {
++ if ((pte & flag->mask) == flag->val)
++ s = flag->set;
++ else
++ s = flag->clear;
++ if (s)
++ seq_printf(st->seq, " %s", s);
++ }
++ }
++}
++
++static void dump_hpte_info(struct pg_state *st, unsigned long ea, u64 v, u64 r,
++ unsigned long rpn, int bps, int aps, unsigned long lp)
++{
++ int aps_index;
++
++ while (ea >= st->marker[1].start_address) {
++ st->marker++;
++ seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
++ }
++ seq_printf(st->seq, "0x%lx:\t", ea);
++ seq_printf(st->seq, "AVPN:%llx\t", HPTE_V_AVPN_VAL(v));
++ dump_flag_info(st, v_flag_array, v, ARRAY_SIZE(v_flag_array));
++ seq_printf(st->seq, " rpn: %lx\t", rpn);
++ dump_flag_info(st, r_flag_array, r, ARRAY_SIZE(r_flag_array));
++
++ calculate_pagesize(st, bps, "base");
++ aps_index = calculate_pagesize(st, aps, "actual");
++ if (aps_index != 2)
++ seq_printf(st->seq, "LP enc: %lx", lp);
++ seq_putc(st->seq, '\n');
++}
++
++
++static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64
++ *r)
++{
++ struct hash_pte *hptep;
++ unsigned long hash, vsid, vpn, hpte_group, want_v, hpte_v;
++ int i, ssize = mmu_kernel_ssize;
++ unsigned long shift = mmu_psize_defs[psize].shift;
++
++ /* calculate hash */
++ vsid = get_kernel_vsid(ea, ssize);
++ vpn = hpt_vpn(ea, vsid, ssize);
++ hash = hpt_hash(vpn, shift, ssize);
++ want_v = hpte_encode_avpn(vpn, psize, ssize);
++
++ /* to check in the secondary hash table, we invert the hash */
++ if (!primary)
++ hash = ~hash;
++ hpte_group = (hash & htab_hash_mask) * HPTES_PER_GROUP;
++ for (i = 0; i < HPTES_PER_GROUP; i++) {
++ hptep = htab_address + hpte_group;
++ hpte_v = be64_to_cpu(hptep->v);
++
++ if (HPTE_V_COMPARE(hpte_v, want_v) && (hpte_v & HPTE_V_VALID)) {
++ /* HPTE matches */
++ *v = be64_to_cpu(hptep->v);
++ *r = be64_to_cpu(hptep->r);
++ return 0;
++ }
++ ++hpte_group;
++ }
++ return -1;
++}
++
++#ifdef CONFIG_PPC_PSERIES
++static int pseries_find(unsigned long ea, int psize, bool primary, u64 *v, u64 *r)
++{
++ struct hash_pte ptes[4];
++ unsigned long vsid, vpn, hash, hpte_group, want_v;
++ int i, j, ssize = mmu_kernel_ssize;
++ long lpar_rc = 0;
++ unsigned long shift = mmu_psize_defs[psize].shift;
++
++ /* calculate hash */
++ vsid = get_kernel_vsid(ea, ssize);
++ vpn = hpt_vpn(ea, vsid, ssize);
++ hash = hpt_hash(vpn, shift, ssize);
++ want_v = hpte_encode_avpn(vpn, psize, ssize);
++
++ /* to check in the secondary hash table, we invert the hash */
++ if (!primary)
++ hash = ~hash;
++ hpte_group = (hash & htab_hash_mask) * HPTES_PER_GROUP;
++ /* see if we can find an entry in the hpte with this hash */
++ for (i = 0; i < HPTES_PER_GROUP; i += 4, hpte_group += 4) {
++ lpar_rc = plpar_pte_read_4(0, hpte_group, (void *)ptes);
++
++ if (lpar_rc != H_SUCCESS)
++ continue;
++ for (j = 0; j < 4; j++) {
++ if (HPTE_V_COMPARE(ptes[j].v, want_v) &&
++ (ptes[j].v & HPTE_V_VALID)) {
++ /* HPTE matches */
++ *v = ptes[j].v;
++ *r = ptes[j].r;
++ return 0;
++ }
++ }
++ }
++ return -1;
++}
++#endif
++
++static void decode_r(int bps, unsigned long r, unsigned long *rpn, int *aps,
++ unsigned long *lp_bits)
++{
++ struct mmu_psize_def entry;
++ unsigned long arpn, mask, lp;
++ int penc = -2, idx = 0, shift;
++
++ /*.
++ * The LP field has 8 bits. Depending on the actual page size, some of
++ * these bits are concatenated with the APRN to get the RPN. The rest
++ * of the bits in the LP field is the LP value and is an encoding for
++ * the base page size and the actual page size.
++ *
++ * - find the mmu entry for our base page size
++ * - go through all page encodings and use the associated mask to
++ * find an encoding that matches our encoding in the LP field.
++ */
++ arpn = (r & HPTE_R_RPN) >> HPTE_R_RPN_SHIFT;
++ lp = arpn & 0xff;
++
++ entry = mmu_psize_defs[bps];
++ while (idx < MMU_PAGE_COUNT) {
++ penc = entry.penc[idx];
++ if ((penc != -1) && (mmu_psize_defs[idx].shift)) {
++ shift = mmu_psize_defs[idx].shift - HPTE_R_RPN_SHIFT;
++ mask = (0x1 << (shift)) - 1;
++ if ((lp & mask) == penc) {
++ *aps = mmu_psize_to_shift(idx);
++ *lp_bits = lp & mask;
++ *rpn = arpn >> shift;
++ return;
++ }
++ }
++ idx++;
++ }
++}
++
++static int base_hpte_find(unsigned long ea, int psize, bool primary, u64 *v,
++ u64 *r)
++{
++#ifdef CONFIG_PPC_PSERIES
++ if (firmware_has_feature(FW_FEATURE_LPAR))
++ return pseries_find(ea, psize, primary, v, r);
++#endif
++ return native_find(ea, psize, primary, v, r);
++}
++
++static unsigned long hpte_find(struct pg_state *st, unsigned long ea, int psize)
++{
++ unsigned long slot;
++ u64 v = 0, r = 0;
++ unsigned long rpn, lp_bits;
++ int base_psize = 0, actual_psize = 0;
++
++ if (ea < PAGE_OFFSET)
++ return -1;
++
++ /* Look in primary table */
++ slot = base_hpte_find(ea, psize, true, &v, &r);
++
++ /* Look in secondary table */
++ if (slot == -1)
++ slot = base_hpte_find(ea, psize, false, &v, &r);
++
++ /* No entry found */
++ if (slot == -1)
++ return -1;
++
++ /*
++ * We found an entry in the hash page table:
++ * - check that this has the same base page
++ * - find the actual page size
++ * - find the RPN
++ */
++ base_psize = mmu_psize_to_shift(psize);
++
++ if ((v & HPTE_V_LARGE) == HPTE_V_LARGE) {
++ decode_r(psize, r, &rpn, &actual_psize, &lp_bits);
++ } else {
++ /* 4K actual page size */
++ actual_psize = 12;
++ rpn = (r & HPTE_R_RPN) >> HPTE_R_RPN_SHIFT;
++ /* In this case there are no LP bits */
++ lp_bits = -1;
++ }
++ /*
++ * We didn't find a matching encoding, so the PTE we found isn't for
++ * this address.
++ */
++ if (actual_psize == -1)
++ return -1;
++
++ dump_hpte_info(st, ea, v, r, rpn, base_psize, actual_psize, lp_bits);
++ return 0;
++}
++
++static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
++{
++ pte_t *pte = pte_offset_kernel(pmd, 0);
++ unsigned long addr, pteval, psize;
++ int i, status;
++
++ for (i = 0; i < PTRS_PER_PTE; i++, pte++) {
++ addr = start + i * PAGE_SIZE;
++ pteval = pte_val(*pte);
++
++ if (addr < VMALLOC_END)
++ psize = mmu_vmalloc_psize;
++ else
++ psize = mmu_io_psize;
++#ifdef CONFIG_PPC_64K_PAGES
++ /* check for secret 4K mappings */
++ if (((pteval & H_PAGE_COMBO) == H_PAGE_COMBO) ||
++ ((pteval & H_PAGE_4K_PFN) == H_PAGE_4K_PFN))
++ psize = mmu_io_psize;
++#endif
++ /* check for hashpte */
++ status = hpte_find(st, addr, psize);
++
++ if (((pteval & H_PAGE_HASHPTE) != H_PAGE_HASHPTE)
++ && (status != -1)) {
++ /* found a hpte that is not in the linux page tables */
++ seq_printf(st->seq, "page probably bolted before linux"
++ " pagetables were set: addr:%lx, pteval:%lx\n",
++ addr, pteval);
++ }
++ }
++}
++
++static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
++{
++ pmd_t *pmd = pmd_offset(pud, 0);
++ unsigned long addr;
++ unsigned int i;
++
++ for (i = 0; i < PTRS_PER_PMD; i++, pmd++) {
++ addr = start + i * PMD_SIZE;
++ if (!pmd_none(*pmd))
++ /* pmd exists */
++ walk_pte(st, pmd, addr);
++ }
++}
++
++static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
++{
++ pud_t *pud = pud_offset(pgd, 0);
++ unsigned long addr;
++ unsigned int i;
++
++ for (i = 0; i < PTRS_PER_PUD; i++, pud++) {
++ addr = start + i * PUD_SIZE;
++ if (!pud_none(*pud))
++ /* pud exists */
++ walk_pmd(st, pud, addr);
++ }
++}
++
++static void walk_pagetables(struct pg_state *st)
++{
++ pgd_t *pgd = pgd_offset_k(0UL);
++ unsigned int i;
++ unsigned long addr;
++
++ /*
++ * Traverse the linux pagetable structure and dump pages that are in
++ * the hash pagetable.
++ */
++ for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
++ addr = KERN_VIRT_START + i * PGDIR_SIZE;
++ if (!pgd_none(*pgd))
++ /* pgd exists */
++ walk_pud(st, pgd, addr);
++ }
++}
++
++
++static void walk_linearmapping(struct pg_state *st)
++{
++ unsigned long addr;
++
++ /*
++ * Traverse the linear mapping section of virtual memory and dump pages
++ * that are in the hash pagetable.
++ */
++ unsigned long psize = 1 << mmu_psize_defs[mmu_linear_psize].shift;
++
++ for (addr = PAGE_OFFSET; addr < PAGE_OFFSET +
++ memblock_end_of_DRAM(); addr += psize)
++ hpte_find(st, addr, mmu_linear_psize);
++}
++
++static void walk_vmemmap(struct pg_state *st)
++{
++#ifdef CONFIG_SPARSEMEM_VMEMMAP
++ struct vmemmap_backing *ptr = vmemmap_list;
++
++ /*
++ * Traverse the vmemmaped memory and dump pages that are in the hash
++ * pagetable.
++ */
++ while (ptr->list) {
++ hpte_find(st, ptr->virt_addr, mmu_vmemmap_psize);
++ ptr = ptr->list;
++ }
++ seq_puts(st->seq, "---[ vmemmap end ]---\n");
++#endif
++}
++
++static void populate_markers(void)
++{
++ address_markers[0].start_address = PAGE_OFFSET;
++ address_markers[1].start_address = VMALLOC_START;
++ address_markers[2].start_address = VMALLOC_END;
++ address_markers[3].start_address = ISA_IO_BASE;
++ address_markers[4].start_address = ISA_IO_END;
++ address_markers[5].start_address = PHB_IO_BASE;
++ address_markers[6].start_address = PHB_IO_END;
++ address_markers[7].start_address = IOREMAP_BASE;
++ address_markers[8].start_address = IOREMAP_END;
++#ifdef CONFIG_PPC_BOOK3S_64
++ address_markers[9].start_address = H_VMEMMAP_BASE;
++#else
++ address_markers[9].start_address = VMEMMAP_BASE;
++#endif
++}
++
++static int ptdump_show(struct seq_file *m, void *v)
++{
++ struct pg_state st = {
++ .seq = m,
++ .start_address = PAGE_OFFSET,
++ .marker = address_markers,
++ };
++ /*
++ * Traverse the 0xc, 0xd and 0xf areas of the kernel virtual memory and
++ * dump pages that are in the hash pagetable.
++ */
++ walk_linearmapping(&st);
++ walk_pagetables(&st);
++ walk_vmemmap(&st);
++ return 0;
++}
++
++static int ptdump_open(struct inode *inode, struct file *file)
++{
++ return single_open(file, ptdump_show, NULL);
++}
++
++static const struct file_operations ptdump_fops = {
++ .open = ptdump_open,
++ .read = seq_read,
++ .llseek = seq_lseek,
++ .release = single_release,
++};
++
++static int ptdump_init(void)
++{
++ struct dentry *debugfs_file;
++
++ if (!radix_enabled()) {
++ populate_markers();
++ debugfs_file = debugfs_create_file("kernel_hash_pagetable",
++ 0400, NULL, NULL, &ptdump_fops);
++ return debugfs_file ? 0 : -ENOMEM;
++ }
++ return 0;
++}
++device_initcall(ptdump_init);
+diff --git a/arch/powerpc/mm/ptdump/ptdump.c b/arch/powerpc/mm/ptdump/ptdump.c
+new file mode 100644
+index 0000000000000..76be98988578d
+--- /dev/null
++++ b/arch/powerpc/mm/ptdump/ptdump.c
+@@ -0,0 +1,373 @@
++/*
++ * Copyright 2016, Rashmica Gupta, IBM Corp.
++ *
++ * This traverses the kernel pagetables and dumps the
++ * information about the used sections of memory to
++ * /sys/kernel/debug/kernel_pagetables.
++ *
++ * Derived from the arm64 implementation:
++ * Copyright (c) 2014, The Linux Foundation, Laura Abbott.
++ * (C) Copyright 2008 Intel Corporation, Arjan van de Ven.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; version 2
++ * of the License.
++ */
++#include <linux/debugfs.h>
++#include <linux/fs.h>
++#include <linux/hugetlb.h>
++#include <linux/io.h>
++#include <linux/mm.h>
++#include <linux/highmem.h>
++#include <linux/sched.h>
++#include <linux/seq_file.h>
++#include <asm/fixmap.h>
++#include <asm/pgtable.h>
++#include <linux/const.h>
++#include <asm/page.h>
++#include <asm/pgalloc.h>
++
++#include "ptdump.h"
++
++#ifdef CONFIG_PPC32
++#define KERN_VIRT_START 0
++#endif
++
++/*
++ * To visualise what is happening,
++ *
++ * - PTRS_PER_P** = how many entries there are in the corresponding P**
++ * - P**_SHIFT = how many bits of the address we use to index into the
++ * corresponding P**
++ * - P**_SIZE is how much memory we can access through the table - not the
++ * size of the table itself.
++ * P**={PGD, PUD, PMD, PTE}
++ *
++ *
++ * Each entry of the PGD points to a PUD. Each entry of a PUD points to a
++ * PMD. Each entry of a PMD points to a PTE. And every PTE entry points to
++ * a page.
++ *
++ * In the case where there are only 3 levels, the PUD is folded into the
++ * PGD: every PUD has only one entry which points to the PMD.
++ *
++ * The page dumper groups page table entries of the same type into a single
++ * description. It uses pg_state to track the range information while
++ * iterating over the PTE entries. When the continuity is broken it then
++ * dumps out a description of the range - ie PTEs that are virtually contiguous
++ * with the same PTE flags are chunked together. This is to make it clear how
++ * different areas of the kernel virtual memory are used.
++ *
++ */
++struct pg_state {
++ struct seq_file *seq;
++ const struct addr_marker *marker;
++ unsigned long start_address;
++ unsigned long start_pa;
++ unsigned long last_pa;
++ unsigned int level;
++ u64 current_flags;
++};
++
++struct addr_marker {
++ unsigned long start_address;
++ const char *name;
++};
++
++static struct addr_marker address_markers[] = {
++ { 0, "Start of kernel VM" },
++ { 0, "vmalloc() Area" },
++ { 0, "vmalloc() End" },
++#ifdef CONFIG_PPC64
++ { 0, "isa I/O start" },
++ { 0, "isa I/O end" },
++ { 0, "phb I/O start" },
++ { 0, "phb I/O end" },
++ { 0, "I/O remap start" },
++ { 0, "I/O remap end" },
++ { 0, "vmemmap start" },
++#else
++ { 0, "Early I/O remap start" },
++ { 0, "Early I/O remap end" },
++#ifdef CONFIG_NOT_COHERENT_CACHE
++ { 0, "Consistent mem start" },
++ { 0, "Consistent mem end" },
++#endif
++#ifdef CONFIG_HIGHMEM
++ { 0, "Highmem PTEs start" },
++ { 0, "Highmem PTEs end" },
++#endif
++ { 0, "Fixmap start" },
++ { 0, "Fixmap end" },
++#endif
++ { -1, NULL },
++};
++
++static void dump_flag_info(struct pg_state *st, const struct flag_info
++ *flag, u64 pte, int num)
++{
++ unsigned int i;
++
++ for (i = 0; i < num; i++, flag++) {
++ const char *s = NULL;
++ u64 val;
++
++ /* flag not defined so don't check it */
++ if (flag->mask == 0)
++ continue;
++ /* Some 'flags' are actually values */
++ if (flag->is_val) {
++ val = pte & flag->val;
++ if (flag->shift)
++ val = val >> flag->shift;
++ seq_printf(st->seq, " %s:%llx", flag->set, val);
++ } else {
++ if ((pte & flag->mask) == flag->val)
++ s = flag->set;
++ else
++ s = flag->clear;
++ if (s)
++ seq_printf(st->seq, " %s", s);
++ }
++ st->current_flags &= ~flag->mask;
++ }
++ if (st->current_flags != 0)
++ seq_printf(st->seq, " unknown flags:%llx", st->current_flags);
++}
++
++static void dump_addr(struct pg_state *st, unsigned long addr)
++{
++ static const char units[] = "KMGTPE";
++ const char *unit = units;
++ unsigned long delta;
++
++#ifdef CONFIG_PPC64
++ seq_printf(st->seq, "0x%016lx-0x%016lx ", st->start_address, addr-1);
++ seq_printf(st->seq, "0x%016lx ", st->start_pa);
++#else
++ seq_printf(st->seq, "0x%08lx-0x%08lx ", st->start_address, addr - 1);
++ seq_printf(st->seq, "0x%08lx ", st->start_pa);
++#endif
++
++ delta = (addr - st->start_address) >> 10;
++ /* Work out what appropriate unit to use */
++ while (!(delta & 1023) && unit[1]) {
++ delta >>= 10;
++ unit++;
++ }
++ seq_printf(st->seq, "%9lu%c", delta, *unit);
++
++}
++
++static void note_page(struct pg_state *st, unsigned long addr,
++ unsigned int level, u64 val)
++{
++ u64 flag = val & pg_level[level].mask;
++ u64 pa = val & PTE_RPN_MASK;
++
++ /* At first no level is set */
++ if (!st->level) {
++ st->level = level;
++ st->current_flags = flag;
++ st->start_address = addr;
++ st->start_pa = pa;
++ st->last_pa = pa;
++ seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
++ /*
++ * Dump the section of virtual memory when:
++ * - the PTE flags from one entry to the next differs.
++ * - we change levels in the tree.
++ * - the address is in a different section of memory and is thus
++ * used for a different purpose, regardless of the flags.
++ * - the pa of this page is not adjacent to the last inspected page
++ */
++ } else if (flag != st->current_flags || level != st->level ||
++ addr >= st->marker[1].start_address ||
++ pa != st->last_pa + PAGE_SIZE) {
++
++ /* Check the PTE flags */
++ if (st->current_flags) {
++ dump_addr(st, addr);
++
++ /* Dump all the flags */
++ if (pg_level[st->level].flag)
++ dump_flag_info(st, pg_level[st->level].flag,
++ st->current_flags,
++ pg_level[st->level].num);
++
++ seq_putc(st->seq, '\n');
++ }
++
++ /*
++ * Address indicates we have passed the end of the
++ * current section of virtual memory
++ */
++ while (addr >= st->marker[1].start_address) {
++ st->marker++;
++ seq_printf(st->seq, "---[ %s ]---\n", st->marker->name);
++ }
++ st->start_address = addr;
++ st->start_pa = pa;
++ st->last_pa = pa;
++ st->current_flags = flag;
++ st->level = level;
++ } else {
++ st->last_pa = pa;
++ }
++}
++
++static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
++{
++ pte_t *pte = pte_offset_kernel(pmd, 0);
++ unsigned long addr;
++ unsigned int i;
++
++ for (i = 0; i < PTRS_PER_PTE; i++, pte++) {
++ addr = start + i * PAGE_SIZE;
++ note_page(st, addr, 4, pte_val(*pte));
++
++ }
++}
++
++static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
++{
++ pmd_t *pmd = pmd_offset(pud, 0);
++ unsigned long addr;
++ unsigned int i;
++
++ for (i = 0; i < PTRS_PER_PMD; i++, pmd++) {
++ addr = start + i * PMD_SIZE;
++ if (!pmd_none(*pmd) && !pmd_huge(*pmd))
++ /* pmd exists */
++ walk_pte(st, pmd, addr);
++ else
++ note_page(st, addr, 3, pmd_val(*pmd));
++ }
++}
++
++static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
++{
++ pud_t *pud = pud_offset(pgd, 0);
++ unsigned long addr;
++ unsigned int i;
++
++ for (i = 0; i < PTRS_PER_PUD; i++, pud++) {
++ addr = start + i * PUD_SIZE;
++ if (!pud_none(*pud) && !pud_huge(*pud))
++ /* pud exists */
++ walk_pmd(st, pud, addr);
++ else
++ note_page(st, addr, 2, pud_val(*pud));
++ }
++}
++
++static void walk_pagetables(struct pg_state *st)
++{
++ pgd_t *pgd = pgd_offset_k(0UL);
++ unsigned int i;
++ unsigned long addr;
++
++ addr = st->start_address;
++
++ /*
++ * Traverse the linux pagetable structure and dump pages that are in
++ * the hash pagetable.
++ */
++ for (i = 0; i < PTRS_PER_PGD; i++, pgd++, addr += PGDIR_SIZE) {
++ if (!pgd_none(*pgd) && !pgd_huge(*pgd))
++ /* pgd exists */
++ walk_pud(st, pgd, addr);
++ else
++ note_page(st, addr, 1, pgd_val(*pgd));
++ }
++}
++
++static void populate_markers(void)
++{
++ int i = 0;
++
++ address_markers[i++].start_address = PAGE_OFFSET;
++ address_markers[i++].start_address = VMALLOC_START;
++ address_markers[i++].start_address = VMALLOC_END;
++#ifdef CONFIG_PPC64
++ address_markers[i++].start_address = ISA_IO_BASE;
++ address_markers[i++].start_address = ISA_IO_END;
++ address_markers[i++].start_address = PHB_IO_BASE;
++ address_markers[i++].start_address = PHB_IO_END;
++ address_markers[i++].start_address = IOREMAP_BASE;
++ address_markers[i++].start_address = IOREMAP_END;
++#ifdef CONFIG_PPC_BOOK3S_64
++ address_markers[i++].start_address = H_VMEMMAP_BASE;
++#else
++ address_markers[i++].start_address = VMEMMAP_BASE;
++#endif
++#else /* !CONFIG_PPC64 */
++ address_markers[i++].start_address = ioremap_bot;
++ address_markers[i++].start_address = IOREMAP_TOP;
++#ifdef CONFIG_NOT_COHERENT_CACHE
++ address_markers[i++].start_address = IOREMAP_TOP;
++ address_markers[i++].start_address = IOREMAP_TOP +
++ CONFIG_CONSISTENT_SIZE;
++#endif
++#ifdef CONFIG_HIGHMEM
++ address_markers[i++].start_address = PKMAP_BASE;
++ address_markers[i++].start_address = PKMAP_ADDR(LAST_PKMAP);
++#endif
++ address_markers[i++].start_address = FIXADDR_START;
++ address_markers[i++].start_address = FIXADDR_TOP;
++#endif /* CONFIG_PPC64 */
++}
++
++static int ptdump_show(struct seq_file *m, void *v)
++{
++ struct pg_state st = {
++ .seq = m,
++ .marker = address_markers,
++ };
++
++ if (radix_enabled())
++ st.start_address = PAGE_OFFSET;
++ else
++ st.start_address = KERN_VIRT_START;
++
++ /* Traverse kernel page tables */
++ walk_pagetables(&st);
++ note_page(&st, 0, 0, 0);
++ return 0;
++}
++
++
++static int ptdump_open(struct inode *inode, struct file *file)
++{
++ return single_open(file, ptdump_show, NULL);
++}
++
++static const struct file_operations ptdump_fops = {
++ .open = ptdump_open,
++ .read = seq_read,
++ .llseek = seq_lseek,
++ .release = single_release,
++};
++
++static void build_pgtable_complete_mask(void)
++{
++ unsigned int i, j;
++
++ for (i = 0; i < ARRAY_SIZE(pg_level); i++)
++ if (pg_level[i].flag)
++ for (j = 0; j < pg_level[i].num; j++)
++ pg_level[i].mask |= pg_level[i].flag[j].mask;
++}
++
++static int ptdump_init(void)
++{
++ struct dentry *debugfs_file;
++
++ populate_markers();
++ build_pgtable_complete_mask();
++ debugfs_file = debugfs_create_file("kernel_page_tables", 0400, NULL,
++ NULL, &ptdump_fops);
++ return debugfs_file ? 0 : -ENOMEM;
++}
++device_initcall(ptdump_init);
+diff --git a/arch/powerpc/mm/ptdump/ptdump.h b/arch/powerpc/mm/ptdump/ptdump.h
+new file mode 100644
+index 0000000000000..5d513636de73a
+--- /dev/null
++++ b/arch/powerpc/mm/ptdump/ptdump.h
+@@ -0,0 +1,19 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#include <linux/types.h>
++
++struct flag_info {
++ u64 mask;
++ u64 val;
++ const char *set;
++ const char *clear;
++ bool is_val;
++ int shift;
++};
++
++struct pgtable_level {
++ const struct flag_info *flag;
++ size_t num;
++ u64 mask;
++};
++
++extern struct pgtable_level pg_level[5];
+diff --git a/arch/powerpc/mm/ptdump/segment_regs.c b/arch/powerpc/mm/ptdump/segment_regs.c
+new file mode 100644
+index 0000000000000..501843664bb91
+--- /dev/null
++++ b/arch/powerpc/mm/ptdump/segment_regs.c
+@@ -0,0 +1,64 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright 2018, Christophe Leroy CS S.I.
++ * <christophe.leroy@c-s.fr>
++ *
++ * This dumps the content of Segment Registers
++ */
++
++#include <asm/debugfs.h>
++
++static void seg_show(struct seq_file *m, int i)
++{
++ u32 val = mfsrin(i << 28);
++
++ seq_printf(m, "0x%01x0000000-0x%01xfffffff ", i, i);
++ seq_printf(m, "Kern key %d ", (val >> 30) & 1);
++ seq_printf(m, "User key %d ", (val >> 29) & 1);
++ if (val & 0x80000000) {
++ seq_printf(m, "Device 0x%03x", (val >> 20) & 0x1ff);
++ seq_printf(m, "-0x%05x", val & 0xfffff);
++ } else {
++ if (val & 0x10000000)
++ seq_puts(m, "No Exec ");
++ seq_printf(m, "VSID 0x%06x", val & 0xffffff);
++ }
++ seq_puts(m, "\n");
++}
++
++static int sr_show(struct seq_file *m, void *v)
++{
++ int i;
++
++ seq_puts(m, "---[ User Segments ]---\n");
++ for (i = 0; i < TASK_SIZE >> 28; i++)
++ seg_show(m, i);
++
++ seq_puts(m, "\n---[ Kernel Segments ]---\n");
++ for (; i < 16; i++)
++ seg_show(m, i);
++
++ return 0;
++}
++
++static int sr_open(struct inode *inode, struct file *file)
++{
++ return single_open(file, sr_show, NULL);
++}
++
++static const struct file_operations sr_fops = {
++ .open = sr_open,
++ .read = seq_read,
++ .llseek = seq_lseek,
++ .release = single_release,
++};
++
++static int __init sr_init(void)
++{
++ struct dentry *debugfs_file;
++
++ debugfs_file = debugfs_create_file("segment_registers", 0400,
++ powerpc_debugfs_root, NULL, &sr_fops);
++ return debugfs_file ? 0 : -ENOMEM;
++}
++device_initcall(sr_init);
+diff --git a/arch/powerpc/mm/ptdump/shared.c b/arch/powerpc/mm/ptdump/shared.c
+new file mode 100644
+index 0000000000000..1cda3d91c6c26
+--- /dev/null
++++ b/arch/powerpc/mm/ptdump/shared.c
+@@ -0,0 +1,82 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * From split of dump_linuxpagetables.c
++ * Copyright 2016, Rashmica Gupta, IBM Corp.
++ *
++ */
++#include <linux/kernel.h>
++#include <asm/pgtable.h>
++
++#include "ptdump.h"
++
++static const struct flag_info flag_array[] = {
++ {
++ .mask = _PAGE_USER,
++ .val = _PAGE_USER,
++ .set = "user",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_RW,
++ .val = 0,
++ .set = "r ",
++ .clear = "rw",
++ }, {
++#ifndef CONFIG_PPC_BOOK3S_32
++ .mask = _PAGE_EXEC,
++ .val = _PAGE_EXEC,
++ .set = " X ",
++ .clear = " ",
++ }, {
++#endif
++ .mask = _PAGE_PRESENT,
++ .val = _PAGE_PRESENT,
++ .set = "present",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_GUARDED,
++ .val = _PAGE_GUARDED,
++ .set = "guarded",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_DIRTY,
++ .val = _PAGE_DIRTY,
++ .set = "dirty",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_ACCESSED,
++ .val = _PAGE_ACCESSED,
++ .set = "accessed",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_WRITETHRU,
++ .val = _PAGE_WRITETHRU,
++ .set = "write through",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_NO_CACHE,
++ .val = _PAGE_NO_CACHE,
++ .set = "no cache",
++ .clear = " ",
++ }, {
++ .mask = _PAGE_SPECIAL,
++ .val = _PAGE_SPECIAL,
++ .set = "special",
++ }
++};
++
++struct pgtable_level pg_level[5] = {
++ {
++ }, { /* pgd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pud */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pmd */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ }, { /* pte */
++ .flag = flag_array,
++ .num = ARRAY_SIZE(flag_array),
++ },
++};
+diff --git a/arch/powerpc/platforms/powermac/Makefile b/arch/powerpc/platforms/powermac/Makefile
+index 561a67d65e4d4..923bfb3404333 100644
+--- a/arch/powerpc/platforms/powermac/Makefile
++++ b/arch/powerpc/platforms/powermac/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ CFLAGS_bootx_init.o += -fPIC
++CFLAGS_bootx_init.o += $(call cc-option, -fno-stack-protector)
+
+ ifdef CONFIG_FUNCTION_TRACER
+ # Do not trace early boot code
+diff --git a/arch/x86/kernel/cpu/topology.c b/arch/x86/kernel/cpu/topology.c
+index 71ca064e37948..31fe56a90cbf8 100644
+--- a/arch/x86/kernel/cpu/topology.c
++++ b/arch/x86/kernel/cpu/topology.c
+@@ -44,7 +44,7 @@ int detect_extended_topology_early(struct cpuinfo_x86 *c)
+ * initial apic id, which also represents 32-bit extended x2apic id.
+ */
+ c->initial_apicid = edx;
+- smp_num_siblings = LEVEL_MAX_SIBLINGS(ebx);
++ smp_num_siblings = max_t(int, smp_num_siblings, LEVEL_MAX_SIBLINGS(ebx));
+ #endif
+ return 0;
+ }
+@@ -68,7 +68,8 @@ int detect_extended_topology(struct cpuinfo_x86 *c)
+ * Populate HT related information from sub-leaf level 0.
+ */
+ cpuid_count(0xb, SMT_LEVEL, &eax, &ebx, &ecx, &edx);
+- core_level_siblings = smp_num_siblings = LEVEL_MAX_SIBLINGS(ebx);
++ core_level_siblings = LEVEL_MAX_SIBLINGS(ebx);
++ smp_num_siblings = max_t(int, smp_num_siblings, LEVEL_MAX_SIBLINGS(ebx));
+ core_plus_mask_width = ht_mask_width = BITS_SHIFT_NEXT_LEVEL(eax);
+
+ sub_index = 1;
+diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
+index 7d372db8bee11..e33b732ad3376 100644
+--- a/arch/x86/kernel/fpu/xstate.c
++++ b/arch/x86/kernel/fpu/xstate.c
+@@ -811,6 +811,14 @@ void __init fpu__init_system_xstate(void)
+ fpu__init_prepare_fx_sw_frame();
+ setup_init_fpu_buf();
+ setup_xstate_comp();
++
++ /*
++ * CPU capabilities initialization runs before FPU init. So
++ * X86_FEATURE_OSXSAVE is not set. Now that XSAVE is completely
++ * functional, set the feature bit so depending code works.
++ */
++ setup_force_cpu_cap(X86_FEATURE_OSXSAVE);
++
+ print_xstate_offset_size();
+
+ pr_info("x86/fpu: Enabled xstate features 0x%llx, context size is %d bytes, using '%s' format.\n",
+diff --git a/block/partitions/amiga.c b/block/partitions/amiga.c
+index 560936617d9c1..4a4160221183b 100644
+--- a/block/partitions/amiga.c
++++ b/block/partitions/amiga.c
+@@ -32,7 +32,8 @@ int amiga_partition(struct parsed_partitions *state)
+ unsigned char *data;
+ struct RigidDiskBlock *rdb;
+ struct PartitionBlock *pb;
+- int start_sect, nr_sects, blk, part, res = 0;
++ sector_t start_sect, nr_sects;
++ int blk, part, res = 0;
+ int blksize = 1; /* Multiplier for disk block size */
+ int slot = 1;
+ char b[BDEVNAME_SIZE];
+@@ -100,14 +101,14 @@ int amiga_partition(struct parsed_partitions *state)
+
+ /* Tell Kernel about it */
+
+- nr_sects = (be32_to_cpu(pb->pb_Environment[10]) + 1 -
+- be32_to_cpu(pb->pb_Environment[9])) *
++ nr_sects = ((sector_t)be32_to_cpu(pb->pb_Environment[10]) + 1 -
++ be32_to_cpu(pb->pb_Environment[9])) *
+ be32_to_cpu(pb->pb_Environment[3]) *
+ be32_to_cpu(pb->pb_Environment[5]) *
+ blksize;
+ if (!nr_sects)
+ continue;
+- start_sect = be32_to_cpu(pb->pb_Environment[9]) *
++ start_sect = (sector_t)be32_to_cpu(pb->pb_Environment[9]) *
+ be32_to_cpu(pb->pb_Environment[3]) *
+ be32_to_cpu(pb->pb_Environment[5]) *
+ blksize;
+diff --git a/drivers/base/regmap/regmap-i2c.c b/drivers/base/regmap/regmap-i2c.c
+index 056acde5e7d34..4b9d68af090b2 100644
+--- a/drivers/base/regmap/regmap-i2c.c
++++ b/drivers/base/regmap/regmap-i2c.c
+@@ -246,8 +246,8 @@ static int regmap_i2c_smbus_i2c_read(void *context, const void *reg,
+ static struct regmap_bus regmap_i2c_smbus_i2c_block = {
+ .write = regmap_i2c_smbus_i2c_write,
+ .read = regmap_i2c_smbus_i2c_read,
+- .max_raw_read = I2C_SMBUS_BLOCK_MAX,
+- .max_raw_write = I2C_SMBUS_BLOCK_MAX,
++ .max_raw_read = I2C_SMBUS_BLOCK_MAX - 1,
++ .max_raw_write = I2C_SMBUS_BLOCK_MAX - 1,
+ };
+
+ static const struct regmap_bus *regmap_get_i2c_bus(struct i2c_client *i2c,
+diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
+index 81ba4eb348909..09d369306ee36 100644
+--- a/drivers/dma-buf/sw_sync.c
++++ b/drivers/dma-buf/sw_sync.c
+@@ -200,6 +200,7 @@ static const struct dma_fence_ops timeline_fence_ops = {
+ */
+ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
+ {
++ LIST_HEAD(signalled);
+ struct sync_pt *pt, *next;
+
+ trace_sync_timeline(obj);
+@@ -212,21 +213,20 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)
+ if (!timeline_fence_signaled(&pt->base))
+ break;
+
+- list_del_init(&pt->link);
++ dma_fence_get(&pt->base);
++
++ list_move_tail(&pt->link, &signalled);
+ rb_erase(&pt->node, &obj->pt_tree);
+
+- /*
+- * A signal callback may release the last reference to this
+- * fence, causing it to be freed. That operation has to be
+- * last to avoid a use after free inside this loop, and must
+- * be after we remove the fence from the timeline in order to
+- * prevent deadlocking on timeline->lock inside
+- * timeline_fence_release().
+- */
+ dma_fence_signal_locked(&pt->base);
+ }
+
+ spin_unlock_irq(&obj->lock);
++
++ list_for_each_entry_safe(pt, next, &signalled, link) {
++ list_del_init(&pt->link);
++ dma_fence_put(&pt->base);
++ }
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index e667bcf64bc7f..70e446c2acf82 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -1502,15 +1502,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev,
+ continue;
+
+ r = dma_fence_wait_timeout(fence, true, timeout);
++ if (r > 0 && fence->error)
++ r = fence->error;
++
+ dma_fence_put(fence);
+ if (r < 0)
+ return r;
+
+ if (r == 0)
+ break;
+-
+- if (fence->error)
+- return fence->error;
+ }
+
+ memset(wait, 0, sizeof(*wait));
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+index ead221ccb93e0..ddec675ba690a 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+@@ -2529,7 +2529,9 @@ static void dcn10_wait_for_mpcc_disconnect(
+ if (pipe_ctx->stream_res.opp->mpcc_disconnect_pending[mpcc_inst]) {
+ struct hubp *hubp = get_hubp_by_inst(res_pool, mpcc_inst);
+
+- res_pool->mpc->funcs->wait_for_idle(res_pool->mpc, mpcc_inst);
++ if (pipe_ctx->stream_res.tg &&
++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg))
++ res_pool->mpc->funcs->wait_for_idle(res_pool->mpc, mpcc_inst);
+ pipe_ctx->stream_res.opp->mpcc_disconnect_pending[mpcc_inst] = false;
+ hubp->funcs->set_blank(hubp, true);
+ /*DC_LOG_ERROR(dc->ctx->logger,
+diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
+index 1ae31dbc61c64..5e61abb3dce5c 100644
+--- a/drivers/gpu/drm/radeon/radeon_cs.c
++++ b/drivers/gpu/drm/radeon/radeon_cs.c
+@@ -265,7 +265,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
+ {
+ struct drm_radeon_cs *cs = data;
+ uint64_t *chunk_array_ptr;
+- unsigned size, i;
++ u64 size;
++ unsigned i;
+ u32 ring = RADEON_CS_RING_GFX;
+ s32 priority = 0;
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index c0ba8d6f4978f..a9d6f8acf70b5 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -571,6 +571,7 @@
+ #define USB_DEVICE_ID_UGCI_FIGHTING 0x0030
+
+ #define USB_VENDOR_ID_HP 0x03f0
++#define USB_PRODUCT_ID_HP_ELITE_PRESENTER_MOUSE_464A 0x464a
+ #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A 0x0a4a
+ #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 8de294aa3184a..a2ab338166e61 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -98,6 +98,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A), HID_QUIRK_ALWAYS_POLL },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_ELITE_PRESENTER_MOUSE_464A), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL },
+diff --git a/drivers/iio/Kconfig b/drivers/iio/Kconfig
+index d08aeb41cd078..810e72e4e8b7d 100644
+--- a/drivers/iio/Kconfig
++++ b/drivers/iio/Kconfig
+@@ -70,6 +70,7 @@ config IIO_TRIGGERED_EVENT
+
+ source "drivers/iio/accel/Kconfig"
+ source "drivers/iio/adc/Kconfig"
++source "drivers/iio/addac/Kconfig"
+ source "drivers/iio/afe/Kconfig"
+ source "drivers/iio/amplifiers/Kconfig"
+ source "drivers/iio/chemical/Kconfig"
+diff --git a/drivers/iio/Makefile b/drivers/iio/Makefile
+index cb5993251381e..a60d0cbfe4cd2 100644
+--- a/drivers/iio/Makefile
++++ b/drivers/iio/Makefile
+@@ -15,6 +15,7 @@ obj-$(CONFIG_IIO_TRIGGERED_EVENT) += industrialio-triggered-event.o
+
+ obj-y += accel/
+ obj-y += adc/
++obj-y += addac/
+ obj-y += afe/
+ obj-y += amplifiers/
+ obj-y += buffer/
+diff --git a/drivers/iio/adc/stx104.c b/drivers/iio/adc/stx104.c
+index 0662ca199eb0b..49aeb76212fd0 100644
+--- a/drivers/iio/adc/stx104.c
++++ b/drivers/iio/adc/stx104.c
+@@ -23,7 +23,9 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
++#include <linux/mutex.h>
+ #include <linux/spinlock.h>
++#include <linux/types.h>
+
+ #define STX104_OUT_CHAN(chan) { \
+ .type = IIO_VOLTAGE, \
+@@ -52,14 +54,38 @@ static unsigned int num_stx104;
+ module_param_hw_array(base, uint, ioport, &num_stx104, 0);
+ MODULE_PARM_DESC(base, "Apex Embedded Systems STX104 base addresses");
+
++/**
++ * struct stx104_reg - device register structure
++ * @ssr_ad: Software Strobe Register and ADC Data
++ * @achan: ADC Channel
++ * @dio: Digital I/O
++ * @dac: DAC Channels
++ * @cir_asr: Clear Interrupts and ADC Status
++ * @acr: ADC Control
++ * @pccr_fsh: Pacer Clock Control and FIFO Status MSB
++ * @acfg: ADC Configuration
++ */
++struct stx104_reg {
++ u16 ssr_ad;
++ u8 achan;
++ u8 dio;
++ u16 dac[2];
++ u8 cir_asr;
++ u8 acr;
++ u8 pccr_fsh;
++ u8 acfg;
++};
++
+ /**
+ * struct stx104_iio - IIO device private data structure
++ * @lock: synchronization lock to prevent I/O race conditions
+ * @chan_out_states: channels' output states
+- * @base: base port address of the IIO device
++ * @reg: I/O address offset for the device registers
+ */
+ struct stx104_iio {
++ struct mutex lock;
+ unsigned int chan_out_states[STX104_NUM_OUT_CHAN];
+- unsigned int base;
++ struct stx104_reg __iomem *reg;
+ };
+
+ /**
+@@ -72,7 +98,7 @@ struct stx104_iio {
+ struct stx104_gpio {
+ struct gpio_chip chip;
+ spinlock_t lock;
+- unsigned int base;
++ u8 __iomem *base;
+ unsigned int out_state;
+ };
+
+@@ -80,6 +106,7 @@ static int stx104_read_raw(struct iio_dev *indio_dev,
+ struct iio_chan_spec const *chan, int *val, int *val2, long mask)
+ {
+ struct stx104_iio *const priv = iio_priv(indio_dev);
++ struct stx104_reg __iomem *const reg = priv->reg;
+ unsigned int adc_config;
+ int adbu;
+ int gain;
+@@ -87,7 +114,7 @@ static int stx104_read_raw(struct iio_dev *indio_dev,
+ switch (mask) {
+ case IIO_CHAN_INFO_HARDWAREGAIN:
+ /* get gain configuration */
+- adc_config = inb(priv->base + 11);
++ adc_config = ioread8(®->acfg);
+ gain = adc_config & 0x3;
+
+ *val = 1 << gain;
+@@ -98,25 +125,31 @@ static int stx104_read_raw(struct iio_dev *indio_dev,
+ return IIO_VAL_INT;
+ }
+
++ mutex_lock(&priv->lock);
++
+ /* select ADC channel */
+- outb(chan->channel | (chan->channel << 4), priv->base + 2);
++ iowrite8(chan->channel | (chan->channel << 4), ®->achan);
++
++ /* trigger ADC sample capture by writing to the 8-bit
++ * Software Strobe Register and wait for completion
++ */
++ iowrite8(0, ®->ssr_ad);
++ while (ioread8(®->cir_asr) & BIT(7));
+
+- /* trigger ADC sample capture and wait for completion */
+- outb(0, priv->base);
+- while (inb(priv->base + 8) & BIT(7));
++ *val = ioread16(®->ssr_ad);
+
+- *val = inw(priv->base);
++ mutex_unlock(&priv->lock);
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_OFFSET:
+ /* get ADC bipolar/unipolar configuration */
+- adc_config = inb(priv->base + 11);
++ adc_config = ioread8(®->acfg);
+ adbu = !(adc_config & BIT(2));
+
+ *val = -32768 * adbu;
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_SCALE:
+ /* get ADC bipolar/unipolar and gain configuration */
+- adc_config = inb(priv->base + 11);
++ adc_config = ioread8(®->acfg);
+ adbu = !(adc_config & BIT(2));
+ gain = adc_config & 0x3;
+
+@@ -138,16 +171,16 @@ static int stx104_write_raw(struct iio_dev *indio_dev,
+ /* Only four gain states (x1, x2, x4, x8) */
+ switch (val) {
+ case 1:
+- outb(0, priv->base + 11);
++ iowrite8(0, &priv->reg->acfg);
+ break;
+ case 2:
+- outb(1, priv->base + 11);
++ iowrite8(1, &priv->reg->acfg);
+ break;
+ case 4:
+- outb(2, priv->base + 11);
++ iowrite8(2, &priv->reg->acfg);
+ break;
+ case 8:
+- outb(3, priv->base + 11);
++ iowrite8(3, &priv->reg->acfg);
+ break;
+ default:
+ return -EINVAL;
+@@ -160,9 +193,12 @@ static int stx104_write_raw(struct iio_dev *indio_dev,
+ if ((unsigned int)val > 65535)
+ return -EINVAL;
+
++ mutex_lock(&priv->lock);
++
+ priv->chan_out_states[chan->channel] = val;
+- outw(val, priv->base + 4 + 2 * chan->channel);
++ iowrite16(val, &priv->reg->dac[chan->channel]);
+
++ mutex_unlock(&priv->lock);
+ return 0;
+ }
+ return -EINVAL;
+@@ -230,7 +266,7 @@ static int stx104_gpio_get(struct gpio_chip *chip, unsigned int offset)
+ if (offset >= 4)
+ return -EINVAL;
+
+- return !!(inb(stx104gpio->base) & BIT(offset));
++ return !!(ioread8(stx104gpio->base) & BIT(offset));
+ }
+
+ static int stx104_gpio_get_multiple(struct gpio_chip *chip, unsigned long *mask,
+@@ -238,7 +274,7 @@ static int stx104_gpio_get_multiple(struct gpio_chip *chip, unsigned long *mask,
+ {
+ struct stx104_gpio *const stx104gpio = gpiochip_get_data(chip);
+
+- *bits = inb(stx104gpio->base);
++ *bits = ioread8(stx104gpio->base);
+
+ return 0;
+ }
+@@ -260,7 +296,7 @@ static void stx104_gpio_set(struct gpio_chip *chip, unsigned int offset,
+ else
+ stx104gpio->out_state &= ~mask;
+
+- outb(stx104gpio->out_state, stx104gpio->base);
++ iowrite8(stx104gpio->out_state, stx104gpio->base);
+
+ spin_unlock_irqrestore(&stx104gpio->lock, flags);
+ }
+@@ -287,7 +323,7 @@ static void stx104_gpio_set_multiple(struct gpio_chip *chip,
+
+ stx104gpio->out_state &= ~*mask;
+ stx104gpio->out_state |= *mask & *bits;
+- outb(stx104gpio->out_state, stx104gpio->base);
++ iowrite8(stx104gpio->out_state, stx104gpio->base);
+
+ spin_unlock_irqrestore(&stx104gpio->lock, flags);
+ }
+@@ -314,11 +350,16 @@ static int stx104_probe(struct device *dev, unsigned int id)
+ return -EBUSY;
+ }
+
++ priv = iio_priv(indio_dev);
++ priv->reg = devm_ioport_map(dev, base[id], STX104_EXTENT);
++ if (!priv->reg)
++ return -ENOMEM;
++
+ indio_dev->info = &stx104_info;
+ indio_dev->modes = INDIO_DIRECT_MODE;
+
+ /* determine if differential inputs */
+- if (inb(base[id] + 8) & BIT(5)) {
++ if (ioread8(&priv->reg->cir_asr) & BIT(5)) {
+ indio_dev->num_channels = ARRAY_SIZE(stx104_channels_diff);
+ indio_dev->channels = stx104_channels_diff;
+ } else {
+@@ -329,18 +370,17 @@ static int stx104_probe(struct device *dev, unsigned int id)
+ indio_dev->name = dev_name(dev);
+ indio_dev->dev.parent = dev;
+
+- priv = iio_priv(indio_dev);
+- priv->base = base[id];
++ mutex_init(&priv->lock);
+
+ /* configure device for software trigger operation */
+- outb(0, base[id] + 9);
++ iowrite8(0, &priv->reg->acr);
+
+ /* initialize gain setting to x1 */
+- outb(0, base[id] + 11);
++ iowrite8(0, &priv->reg->acfg);
+
+ /* initialize DAC output to 0V */
+- outw(0, base[id] + 4);
+- outw(0, base[id] + 6);
++ iowrite16(0, &priv->reg->dac[0]);
++ iowrite16(0, &priv->reg->dac[1]);
+
+ stx104gpio->chip.label = dev_name(dev);
+ stx104gpio->chip.parent = dev;
+@@ -355,7 +395,7 @@ static int stx104_probe(struct device *dev, unsigned int id)
+ stx104gpio->chip.get_multiple = stx104_gpio_get_multiple;
+ stx104gpio->chip.set = stx104_gpio_set;
+ stx104gpio->chip.set_multiple = stx104_gpio_set_multiple;
+- stx104gpio->base = base[id] + 3;
++ stx104gpio->base = &priv->reg->dio;
+ stx104gpio->out_state = 0x0;
+
+ spin_lock_init(&stx104gpio->lock);
+diff --git a/drivers/iio/addac/Kconfig b/drivers/iio/addac/Kconfig
+new file mode 100644
+index 0000000000000..2e64d7755d5ea
+--- /dev/null
++++ b/drivers/iio/addac/Kconfig
+@@ -0,0 +1,8 @@
++#
++# ADC DAC drivers
++#
++# When adding new entries keep the list in alphabetical order
++
++menu "Analog to digital and digital to analog converters"
++
++endmenu
+diff --git a/drivers/iio/addac/Makefile b/drivers/iio/addac/Makefile
+new file mode 100644
+index 0000000000000..b888b9ee12da0
+--- /dev/null
++++ b/drivers/iio/addac/Makefile
+@@ -0,0 +1,6 @@
++# SPDX-License-Identifier: GPL-2.0
++#
++# Makefile for industrial I/O ADDAC drivers
++#
++
++# When adding new entries keep the list in alphabetical order
+diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
+index f3985469c2211..caebafed49bb4 100644
+--- a/drivers/irqchip/irq-mips-gic.c
++++ b/drivers/irqchip/irq-mips-gic.c
+@@ -48,7 +48,7 @@ void __iomem *mips_gic_base;
+
+ DEFINE_PER_CPU_READ_MOSTLY(unsigned long[GIC_MAX_LONGS], pcpu_masks);
+
+-static DEFINE_SPINLOCK(gic_lock);
++static DEFINE_RAW_SPINLOCK(gic_lock);
+ static struct irq_domain *gic_irq_domain;
+ static struct irq_domain *gic_ipi_domain;
+ static int gic_shared_intrs;
+@@ -207,7 +207,7 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
+
+ irq = GIC_HWIRQ_TO_SHARED(d->hwirq);
+
+- spin_lock_irqsave(&gic_lock, flags);
++ raw_spin_lock_irqsave(&gic_lock, flags);
+ switch (type & IRQ_TYPE_SENSE_MASK) {
+ case IRQ_TYPE_EDGE_FALLING:
+ pol = GIC_POL_FALLING_EDGE;
+@@ -247,7 +247,7 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
+ else
+ irq_set_chip_handler_name_locked(d, &gic_level_irq_controller,
+ handle_level_irq, NULL);
+- spin_unlock_irqrestore(&gic_lock, flags);
++ raw_spin_unlock_irqrestore(&gic_lock, flags);
+
+ return 0;
+ }
+@@ -265,7 +265,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *cpumask,
+ return -EINVAL;
+
+ /* Assumption : cpumask refers to a single CPU */
+- spin_lock_irqsave(&gic_lock, flags);
++ raw_spin_lock_irqsave(&gic_lock, flags);
+
+ /* Re-route this IRQ */
+ write_gic_map_vp(irq, BIT(mips_cm_vp_id(cpu)));
+@@ -276,7 +276,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *cpumask,
+ set_bit(irq, per_cpu_ptr(pcpu_masks, cpu));
+
+ irq_data_update_effective_affinity(d, cpumask_of(cpu));
+- spin_unlock_irqrestore(&gic_lock, flags);
++ raw_spin_unlock_irqrestore(&gic_lock, flags);
+
+ return IRQ_SET_MASK_OK;
+ }
+@@ -354,12 +354,12 @@ static void gic_mask_local_irq_all_vpes(struct irq_data *d)
+ cd = irq_data_get_irq_chip_data(d);
+ cd->mask = false;
+
+- spin_lock_irqsave(&gic_lock, flags);
++ raw_spin_lock_irqsave(&gic_lock, flags);
+ for_each_online_cpu(cpu) {
+ write_gic_vl_other(mips_cm_vp_id(cpu));
+ write_gic_vo_rmask(BIT(intr));
+ }
+- spin_unlock_irqrestore(&gic_lock, flags);
++ raw_spin_unlock_irqrestore(&gic_lock, flags);
+ }
+
+ static void gic_unmask_local_irq_all_vpes(struct irq_data *d)
+@@ -372,32 +372,45 @@ static void gic_unmask_local_irq_all_vpes(struct irq_data *d)
+ cd = irq_data_get_irq_chip_data(d);
+ cd->mask = true;
+
+- spin_lock_irqsave(&gic_lock, flags);
++ raw_spin_lock_irqsave(&gic_lock, flags);
+ for_each_online_cpu(cpu) {
+ write_gic_vl_other(mips_cm_vp_id(cpu));
+ write_gic_vo_smask(BIT(intr));
+ }
+- spin_unlock_irqrestore(&gic_lock, flags);
++ raw_spin_unlock_irqrestore(&gic_lock, flags);
+ }
+
+-static void gic_all_vpes_irq_cpu_online(struct irq_data *d)
++static void gic_all_vpes_irq_cpu_online(void)
+ {
+- struct gic_all_vpes_chip_data *cd;
+- unsigned int intr;
++ static const unsigned int local_intrs[] = {
++ GIC_LOCAL_INT_TIMER,
++ GIC_LOCAL_INT_PERFCTR,
++ GIC_LOCAL_INT_FDC,
++ };
++ unsigned long flags;
++ int i;
+
+- intr = GIC_HWIRQ_TO_LOCAL(d->hwirq);
+- cd = irq_data_get_irq_chip_data(d);
++ raw_spin_lock_irqsave(&gic_lock, flags);
+
+- write_gic_vl_map(mips_gic_vx_map_reg(intr), cd->map);
+- if (cd->mask)
+- write_gic_vl_smask(BIT(intr));
++ for (i = 0; i < ARRAY_SIZE(local_intrs); i++) {
++ unsigned int intr = local_intrs[i];
++ struct gic_all_vpes_chip_data *cd;
++
++ if (!gic_local_irq_is_routable(intr))
++ continue;
++ cd = &gic_all_vpes_chip_data[intr];
++ write_gic_vl_map(mips_gic_vx_map_reg(intr), cd->map);
++ if (cd->mask)
++ write_gic_vl_smask(BIT(intr));
++ }
++
++ raw_spin_unlock_irqrestore(&gic_lock, flags);
+ }
+
+ static struct irq_chip gic_all_vpes_local_irq_controller = {
+ .name = "MIPS GIC Local",
+ .irq_mask = gic_mask_local_irq_all_vpes,
+ .irq_unmask = gic_unmask_local_irq_all_vpes,
+- .irq_cpu_online = gic_all_vpes_irq_cpu_online,
+ };
+
+ static void __gic_irq_dispatch(void)
+@@ -421,11 +434,11 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
+
+ data = irq_get_irq_data(virq);
+
+- spin_lock_irqsave(&gic_lock, flags);
++ raw_spin_lock_irqsave(&gic_lock, flags);
+ write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin);
+ write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu)));
+ irq_data_update_effective_affinity(data, cpumask_of(cpu));
+- spin_unlock_irqrestore(&gic_lock, flags);
++ raw_spin_unlock_irqrestore(&gic_lock, flags);
+
+ return 0;
+ }
+@@ -476,6 +489,10 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
+ intr = GIC_HWIRQ_TO_LOCAL(hwirq);
+ map = GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin;
+
++ /*
++ * If adding support for more per-cpu interrupts, keep the the
++ * array in gic_all_vpes_irq_cpu_online() in sync.
++ */
+ switch (intr) {
+ case GIC_LOCAL_INT_TIMER:
+ /* CONFIG_MIPS_CMP workaround (see __gic_init) */
+@@ -514,12 +531,12 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
+ if (!gic_local_irq_is_routable(intr))
+ return -EPERM;
+
+- spin_lock_irqsave(&gic_lock, flags);
++ raw_spin_lock_irqsave(&gic_lock, flags);
+ for_each_online_cpu(cpu) {
+ write_gic_vl_other(mips_cm_vp_id(cpu));
+ write_gic_vo_map(mips_gic_vx_map_reg(intr), map);
+ }
+- spin_unlock_irqrestore(&gic_lock, flags);
++ raw_spin_unlock_irqrestore(&gic_lock, flags);
+
+ return 0;
+ }
+@@ -662,8 +679,8 @@ static int gic_cpu_startup(unsigned int cpu)
+ /* Clear all local IRQ masks (ie. disable all local interrupts) */
+ write_gic_vl_rmask(~0);
+
+- /* Invoke irq_cpu_online callbacks to enable desired interrupts */
+- irq_cpu_online();
++ /* Enable desired interrupts */
++ gic_all_vpes_irq_cpu_online();
+
+ return 0;
+ }
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 0a4e440948f0d..234464c1c050e 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -29,11 +29,11 @@
+ #define DEFAULT_BUFFER_SECTORS 128
+ #define DEFAULT_JOURNAL_WATERMARK 50
+ #define DEFAULT_SYNC_MSEC 10000
+-#define DEFAULT_MAX_JOURNAL_SECTORS 131072
++#define DEFAULT_MAX_JOURNAL_SECTORS (IS_ENABLED(CONFIG_64BIT) ? 131072 : 8192)
+ #define MIN_LOG2_INTERLEAVE_SECTORS 3
+ #define MAX_LOG2_INTERLEAVE_SECTORS 31
+ #define METADATA_WORKQUEUE_MAX_ACTIVE 16
+-#define RECALC_SECTORS 8192
++#define RECALC_SECTORS (IS_ENABLED(CONFIG_64BIT) ? 32768 : 2048)
+ #define RECALC_WRITE_SUPER 16
+
+ /*
+diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c
+index 6ad408514a998..193a1f800a223 100644
+--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c
++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c
+@@ -766,6 +766,8 @@ static int vb2ops_venc_queue_setup(struct vb2_queue *vq,
+ return -EINVAL;
+
+ if (*nplanes) {
++ if (*nplanes != q_data->fmt->num_planes)
++ return -EINVAL;
+ for (i = 0; i < *nplanes; i++)
+ if (sizes[i] < q_data->sizeimage[i])
+ return -EINVAL;
+diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c
+index 9b57fb2857285..46ec1f2699aa7 100644
+--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c
++++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c
+@@ -537,16 +537,18 @@ static int load_requested_vpu(struct mtk_vpu *vpu,
+ int vpu_load_firmware(struct platform_device *pdev)
+ {
+ struct mtk_vpu *vpu;
+- struct device *dev = &pdev->dev;
++ struct device *dev;
+ struct vpu_run *run;
+ const struct firmware *vpu_fw = NULL;
+ int ret;
+
+ if (!pdev) {
+- dev_err(dev, "VPU platform device is invalid\n");
++ pr_err("VPU platform device is invalid\n");
+ return -EINVAL;
+ }
+
++ dev = &pdev->dev;
++
+ vpu = platform_get_drvdata(pdev);
+ run = &vpu->run;
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 88114e576efb3..039058fe6a41a 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -1976,15 +1976,16 @@ static void mmc_blk_mq_poll_completion(struct mmc_queue *mq,
+ mmc_blk_urgent_bkops(mq, mqrq);
+ }
+
+-static void mmc_blk_mq_dec_in_flight(struct mmc_queue *mq, struct request *req)
++static void mmc_blk_mq_dec_in_flight(struct mmc_queue *mq,
++ struct request_queue *q,
++ enum mmc_issue_type issue_type)
+ {
+- struct request_queue *q = req->q;
+ unsigned long flags;
+ bool put_card;
+
+ spin_lock_irqsave(q->queue_lock, flags);
+
+- mq->in_flight[mmc_issue_type(mq, req)] -= 1;
++ mq->in_flight[issue_type] -= 1;
+
+ put_card = (mmc_tot_in_flight(mq) == 0);
+
+@@ -1996,9 +1997,11 @@ static void mmc_blk_mq_dec_in_flight(struct mmc_queue *mq, struct request *req)
+
+ static void mmc_blk_mq_post_req(struct mmc_queue *mq, struct request *req)
+ {
++ enum mmc_issue_type issue_type = mmc_issue_type(mq, req);
+ struct mmc_queue_req *mqrq = req_to_mmc_queue_req(req);
+ struct mmc_request *mrq = &mqrq->brq.mrq;
+ struct mmc_host *host = mq->card->host;
++ struct request_queue *q = req->q;
+
+ mmc_post_req(host, mrq, 0);
+
+@@ -2011,7 +2014,7 @@ static void mmc_blk_mq_post_req(struct mmc_queue *mq, struct request *req)
+ else
+ blk_mq_complete_request(req);
+
+- mmc_blk_mq_dec_in_flight(mq, req);
++ mmc_blk_mq_dec_in_flight(mq, q, issue_type);
+ }
+
+ void mmc_blk_mq_recovery(struct mmc_queue *mq)
+diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
+index 5301302fb5310..2b3ff4be7ae07 100644
+--- a/drivers/mmc/host/bcm2835.c
++++ b/drivers/mmc/host/bcm2835.c
+@@ -1417,9 +1417,8 @@ static int bcm2835_probe(struct platform_device *pdev)
+ host->max_clk = clk_get_rate(clk);
+
+ host->irq = platform_get_irq(pdev, 0);
+- if (host->irq <= 0) {
+- dev_err(dev, "get IRQ failed\n");
+- ret = -EINVAL;
++ if (host->irq < 0) {
++ ret = host->irq;
+ goto err;
+ }
+
+diff --git a/drivers/mmc/host/jz4740_mmc.c b/drivers/mmc/host/jz4740_mmc.c
+index 864338e308e2b..b8fb518c6db01 100644
+--- a/drivers/mmc/host/jz4740_mmc.c
++++ b/drivers/mmc/host/jz4740_mmc.c
+@@ -1060,7 +1060,6 @@ static int jz4740_mmc_probe(struct platform_device* pdev)
+ host->irq = platform_get_irq(pdev, 0);
+ if (host->irq < 0) {
+ ret = host->irq;
+- dev_err(&pdev->dev, "Failed to get platform irq: %d\n", ret);
+ goto err_free_host;
+ }
+
+diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
+index dba98c2886f26..28f07d4100433 100644
+--- a/drivers/mmc/host/meson-gx-mmc.c
++++ b/drivers/mmc/host/meson-gx-mmc.c
+@@ -26,7 +26,6 @@
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/ioport.h>
+-#include <linux/spinlock.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/mmc/host.h>
+ #include <linux/mmc/mmc.h>
+@@ -159,7 +158,6 @@ struct meson_host {
+ struct mmc_host *mmc;
+ struct mmc_command *cmd;
+
+- spinlock_t lock;
+ void __iomem *regs;
+ struct clk *core_clk;
+ struct clk *mmc_clk;
+@@ -1042,8 +1040,6 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)
+ if (WARN_ON(!host) || WARN_ON(!host->cmd))
+ return IRQ_NONE;
+
+- spin_lock(&host->lock);
+-
+ cmd = host->cmd;
+ data = cmd->data;
+ cmd->error = 0;
+@@ -1071,11 +1067,8 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)
+ if (status & (IRQ_END_OF_CHAIN | IRQ_RESP_STATUS)) {
+ if (data && !cmd->error)
+ data->bytes_xfered = data->blksz * data->blocks;
+- if (meson_mmc_bounce_buf_read(data) ||
+- meson_mmc_get_next_command(cmd))
+- ret = IRQ_WAKE_THREAD;
+- else
+- ret = IRQ_HANDLED;
++
++ return IRQ_WAKE_THREAD;
+ }
+
+ out:
+@@ -1090,10 +1083,6 @@ out:
+ writel(start, host->regs + SD_EMMC_START);
+ }
+
+- if (ret == IRQ_HANDLED)
+- meson_mmc_request_done(host->mmc, cmd->mrq);
+-
+- spin_unlock(&host->lock);
+ return ret;
+ }
+
+@@ -1246,8 +1235,6 @@ static int meson_mmc_probe(struct platform_device *pdev)
+ host->dev = &pdev->dev;
+ dev_set_drvdata(&pdev->dev, host);
+
+- spin_lock_init(&host->lock);
+-
+ /* Get regulators and the supported OCR mask */
+ host->vqmmc_enabled = false;
+ ret = mmc_regulator_get_supply(mmc);
+@@ -1285,7 +1272,6 @@ static int meson_mmc_probe(struct platform_device *pdev)
+
+ host->irq = platform_get_irq(pdev, 0);
+ if (host->irq <= 0) {
+- dev_err(&pdev->dev, "failed to get interrupt resource.\n");
+ ret = -EINVAL;
+ goto free_host;
+ }
+diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
+index 6215feb976e32..a0e8ac9124455 100644
+--- a/drivers/mmc/host/mxcmmc.c
++++ b/drivers/mmc/host/mxcmmc.c
+@@ -1017,10 +1017,8 @@ static int mxcmci_probe(struct platform_device *pdev)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ irq = platform_get_irq(pdev, 0);
+- if (irq < 0) {
+- dev_err(&pdev->dev, "failed to get IRQ: %d\n", irq);
++ if (irq < 0)
+ return irq;
+- }
+
+ mmc = mmc_alloc_host(sizeof(*host), &pdev->dev);
+ if (!mmc)
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index eabfcb5bbafff..a2c44cc8e2e7c 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -155,6 +155,66 @@ static unsigned int renesas_sdhi_clk_update(struct tmio_mmc_host *host,
+ return ret == 0 ? best_freq : clk_get_rate(priv->clk);
+ }
+
++static void renesas_sdhi_clk_start(struct tmio_mmc_host *host)
++{
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, CLK_CTL_SCLKEN |
++ sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL));
++
++ /* HW engineers overrode docs: no sleep needed on R-Car2+ */
++ if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
++ usleep_range(10000, 11000);
++}
++
++static void renesas_sdhi_clk_stop(struct tmio_mmc_host *host)
++{
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, ~CLK_CTL_SCLKEN &
++ sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL));
++
++ /* HW engineers overrode docs: no sleep needed on R-Car2+ */
++ if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
++ usleep_range(10000, 11000);
++}
++
++static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
++ unsigned int new_clock)
++{
++ u32 clk = 0, clock;
++
++ if (new_clock == 0) {
++ renesas_sdhi_clk_stop(host);
++ return;
++ }
++ /*
++ * Both HS400 and HS200/SD104 set 200MHz, but some devices need to
++ * set 400MHz to distinguish the CPG settings in HS400.
++ */
++ if (host->mmc->ios.timing == MMC_TIMING_MMC_HS400 &&
++ host->pdata->flags & TMIO_MMC_HAVE_4TAP_HS400 &&
++ new_clock == 200000000)
++ new_clock = 400000000;
++
++ clock = renesas_sdhi_clk_update(host, new_clock) / 512;
++
++ for (clk = 0x80000080; new_clock >= (clock << 1); clk >>= 1)
++ clock <<= 1;
++
++ /* 1/1 clock is option */
++ if ((host->pdata->flags & TMIO_MMC_CLK_ACTUAL) && ((clk >> 22) & 0x1)) {
++ if (!(host->mmc->ios.timing == MMC_TIMING_MMC_HS400))
++ clk |= 0xff;
++ else
++ clk &= ~0xff;
++ }
++
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, ~CLK_CTL_SCLKEN &
++ sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL));
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++ if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
++ usleep_range(10000, 11000);
++
++ renesas_sdhi_clk_start(host);
++}
++
+ static void renesas_sdhi_clk_disable(struct tmio_mmc_host *host)
+ {
+ struct renesas_sdhi *priv = host_to_priv(host);
+@@ -621,8 +681,8 @@ int renesas_sdhi_probe(struct platform_device *pdev,
+
+ host->write16_hook = renesas_sdhi_write16_hook;
+ host->clk_enable = renesas_sdhi_clk_enable;
+- host->clk_update = renesas_sdhi_clk_update;
+ host->clk_disable = renesas_sdhi_clk_disable;
++ host->set_clock = renesas_sdhi_set_clock;
+ host->multi_io_quirk = renesas_sdhi_multi_io_quirk;
+ host->dma_ops = dma_ops;
+
+diff --git a/drivers/mmc/host/s3cmci.c b/drivers/mmc/host/s3cmci.c
+index f774936043129..ca2239ea6d96d 100644
+--- a/drivers/mmc/host/s3cmci.c
++++ b/drivers/mmc/host/s3cmci.c
+@@ -1661,7 +1661,6 @@ static int s3cmci_probe(struct platform_device *pdev)
+
+ host->irq = platform_get_irq(pdev, 0);
+ if (host->irq <= 0) {
+- dev_err(&pdev->dev, "failed to get interrupt resource.\n");
+ ret = -EINVAL;
+ goto probe_iounmap;
+ }
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 4970cd40813b2..feede31fab47d 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -1914,8 +1914,6 @@ static int sdhci_msm_probe(struct platform_device *pdev)
+ /* Setup IRQ for handling power/voltage tasks with PMIC */
+ msm_host->pwr_irq = platform_get_irq_byname(pdev, "pwr_irq");
+ if (msm_host->pwr_irq < 0) {
+- dev_err(&pdev->dev, "Get pwr_irq failed (%d)\n",
+- msm_host->pwr_irq);
+ ret = msm_host->pwr_irq;
+ goto clk_disable;
+ }
+diff --git a/drivers/mmc/host/sdhci-pltfm.c b/drivers/mmc/host/sdhci-pltfm.c
+index 02bea6159d792..ac380c54bd170 100644
+--- a/drivers/mmc/host/sdhci-pltfm.c
++++ b/drivers/mmc/host/sdhci-pltfm.c
+@@ -131,7 +131,6 @@ struct sdhci_host *sdhci_pltfm_init(struct platform_device *pdev,
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0) {
+- dev_err(&pdev->dev, "failed to get IRQ number\n");
+ ret = irq;
+ goto err;
+ }
+diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
+index 9ef89d00970e1..936d88a33a675 100644
+--- a/drivers/mmc/host/sdhci-s3c.c
++++ b/drivers/mmc/host/sdhci-s3c.c
+@@ -493,10 +493,8 @@ static int sdhci_s3c_probe(struct platform_device *pdev)
+ }
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq < 0) {
+- dev_err(dev, "no irq specified\n");
++ if (irq < 0)
+ return irq;
+- }
+
+ host = sdhci_alloc_host(dev, sizeof(struct sdhci_s3c));
+ if (IS_ERR(host)) {
+diff --git a/drivers/mmc/host/sdhci_f_sdh30.c b/drivers/mmc/host/sdhci_f_sdh30.c
+index ca9e05440da1d..ee8160d6015ea 100644
+--- a/drivers/mmc/host/sdhci_f_sdh30.c
++++ b/drivers/mmc/host/sdhci_f_sdh30.c
+@@ -122,10 +122,8 @@ static int sdhci_f_sdh30_probe(struct platform_device *pdev)
+ u32 reg = 0;
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq < 0) {
+- dev_err(dev, "%s: no irq specified\n", __func__);
++ if (irq < 0)
+ return irq;
+- }
+
+ host = sdhci_alloc_host(dev, sizeof(struct f_sdhost_priv));
+ if (IS_ERR(host))
+diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c
+index 757eb175611fb..bc3f8a1df10cc 100644
+--- a/drivers/mmc/host/sunxi-mmc.c
++++ b/drivers/mmc/host/sunxi-mmc.c
+@@ -1308,8 +1308,8 @@ static int sunxi_mmc_resource_request(struct sunxi_mmc_host *host,
+ return ret;
+
+ host->irq = platform_get_irq(pdev, 0);
+- if (host->irq <= 0) {
+- ret = -EINVAL;
++ if (host->irq < 0) {
++ ret = host->irq;
+ goto error_disable_mmc;
+ }
+
+diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c
+index 43a2ea5cff24f..b031a776c12e0 100644
+--- a/drivers/mmc/host/tmio_mmc.c
++++ b/drivers/mmc/host/tmio_mmc.c
+@@ -13,6 +13,7 @@
+ * published by the Free Software Foundation.
+ */
+
++#include <linux/delay.h>
+ #include <linux/device.h>
+ #include <linux/mfd/core.h>
+ #include <linux/mfd/tmio.h>
+@@ -23,6 +24,52 @@
+
+ #include "tmio_mmc.h"
+
++static void tmio_mmc_clk_start(struct tmio_mmc_host *host)
++{
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, CLK_CTL_SCLKEN |
++ sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL));
++
++ usleep_range(10000, 11000);
++ sd_ctrl_write16(host, CTL_CLK_AND_WAIT_CTL, 0x0100);
++ usleep_range(10000, 11000);
++}
++
++static void tmio_mmc_clk_stop(struct tmio_mmc_host *host)
++{
++ sd_ctrl_write16(host, CTL_CLK_AND_WAIT_CTL, 0x0000);
++ usleep_range(10000, 11000);
++
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, ~CLK_CTL_SCLKEN &
++ sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL));
++
++ usleep_range(10000, 11000);
++}
++
++static void tmio_mmc_set_clock(struct tmio_mmc_host *host,
++ unsigned int new_clock)
++{
++ u32 clk = 0, clock;
++
++ if (new_clock == 0) {
++ tmio_mmc_clk_stop(host);
++ return;
++ }
++
++ clock = host->mmc->f_min;
++
++ for (clk = 0x80000080; new_clock >= (clock << 1); clk >>= 1)
++ clock <<= 1;
++
++ host->pdata->set_clk_div(host->pdev, (clk >> 22) & 1);
++
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, ~CLK_CTL_SCLKEN &
++ sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL));
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
++ usleep_range(10000, 11000);
++
++ tmio_mmc_clk_start(host);
++}
++
+ #ifdef CONFIG_PM_SLEEP
+ static int tmio_mmc_suspend(struct device *dev)
+ {
+@@ -100,6 +147,7 @@ static int tmio_mmc_probe(struct platform_device *pdev)
+
+ /* SD control register space size is 0x200, 0x400 for bus_shift=1 */
+ host->bus_shift = resource_size(res) >> 10;
++ host->set_clock = tmio_mmc_set_clock;
+
+ host->mmc->f_max = pdata->hclk;
+ host->mmc->f_min = pdata->hclk / 512;
+diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h
+index 7c40a7e1fea1c..358aa258cb159 100644
+--- a/drivers/mmc/host/tmio_mmc.h
++++ b/drivers/mmc/host/tmio_mmc.h
+@@ -133,7 +133,6 @@ struct tmio_mmc_host {
+
+ /* Callbacks for clock / power control */
+ void (*set_pwr)(struct platform_device *host, int state);
+- void (*set_clk_div)(struct platform_device *host, int state);
+
+ /* pio related stuff */
+ struct scatterlist *sg_ptr;
+@@ -170,10 +169,9 @@ struct tmio_mmc_host {
+
+ /* Mandatory callback */
+ int (*clk_enable)(struct tmio_mmc_host *host);
++ void (*set_clock)(struct tmio_mmc_host *host, unsigned int clock);
+
+ /* Optional callbacks */
+- unsigned int (*clk_update)(struct tmio_mmc_host *host,
+- unsigned int new_clock);
+ void (*clk_disable)(struct tmio_mmc_host *host);
+ int (*multi_io_quirk)(struct mmc_card *card,
+ unsigned int direction, int blk_size);
+diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
+index 33c9ca8f14a97..f819757e125e0 100644
+--- a/drivers/mmc/host/tmio_mmc_core.c
++++ b/drivers/mmc/host/tmio_mmc_core.c
+@@ -161,83 +161,6 @@ static void tmio_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
+ }
+ }
+
+-static void tmio_mmc_clk_start(struct tmio_mmc_host *host)
+-{
+- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, CLK_CTL_SCLKEN |
+- sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL));
+-
+- /* HW engineers overrode docs: no sleep needed on R-Car2+ */
+- if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+- usleep_range(10000, 11000);
+-
+- if (host->pdata->flags & TMIO_MMC_HAVE_HIGH_REG) {
+- sd_ctrl_write16(host, CTL_CLK_AND_WAIT_CTL, 0x0100);
+- usleep_range(10000, 11000);
+- }
+-}
+-
+-static void tmio_mmc_clk_stop(struct tmio_mmc_host *host)
+-{
+- if (host->pdata->flags & TMIO_MMC_HAVE_HIGH_REG) {
+- sd_ctrl_write16(host, CTL_CLK_AND_WAIT_CTL, 0x0000);
+- usleep_range(10000, 11000);
+- }
+-
+- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, ~CLK_CTL_SCLKEN &
+- sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL));
+-
+- /* HW engineers overrode docs: no sleep needed on R-Car2+ */
+- if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+- usleep_range(10000, 11000);
+-}
+-
+-static void tmio_mmc_set_clock(struct tmio_mmc_host *host,
+- unsigned int new_clock)
+-{
+- u32 clk = 0, clock;
+-
+- if (new_clock == 0) {
+- tmio_mmc_clk_stop(host);
+- return;
+- }
+- /*
+- * Both HS400 and HS200/SD104 set 200MHz, but some devices need to
+- * set 400MHz to distinguish the CPG settings in HS400.
+- */
+- if (host->mmc->ios.timing == MMC_TIMING_MMC_HS400 &&
+- host->pdata->flags & TMIO_MMC_HAVE_4TAP_HS400 &&
+- new_clock == 200000000)
+- new_clock = 400000000;
+-
+- if (host->clk_update)
+- clock = host->clk_update(host, new_clock) / 512;
+- else
+- clock = host->mmc->f_min;
+-
+- for (clk = 0x80000080; new_clock >= (clock << 1); clk >>= 1)
+- clock <<= 1;
+-
+- /* 1/1 clock is option */
+- if ((host->pdata->flags & TMIO_MMC_CLK_ACTUAL) &&
+- ((clk >> 22) & 0x1)) {
+- if (!(host->mmc->ios.timing == MMC_TIMING_MMC_HS400))
+- clk |= 0xff;
+- else
+- clk &= ~0xff;
+- }
+-
+- if (host->set_clk_div)
+- host->set_clk_div(host->pdev, (clk >> 22) & 1);
+-
+- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, ~CLK_CTL_SCLKEN &
+- sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL));
+- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
+- if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
+- usleep_range(10000, 11000);
+-
+- tmio_mmc_clk_start(host);
+-}
+-
+ static void tmio_mmc_reset(struct tmio_mmc_host *host)
+ {
+ /* FIXME - should we set stop clock reg here */
+@@ -1051,15 +974,15 @@ static void tmio_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ switch (ios->power_mode) {
+ case MMC_POWER_OFF:
+ tmio_mmc_power_off(host);
+- tmio_mmc_clk_stop(host);
++ host->set_clock(host, 0);
+ break;
+ case MMC_POWER_UP:
+ tmio_mmc_power_on(host, ios->vdd);
+- tmio_mmc_set_clock(host, ios->clock);
++ host->set_clock(host, ios->clock);
+ tmio_mmc_set_bus_width(host, ios->bus_width);
+ break;
+ case MMC_POWER_ON:
+- tmio_mmc_set_clock(host, ios->clock);
++ host->set_clock(host, ios->clock);
+ tmio_mmc_set_bus_width(host, ios->bus_width);
+ break;
+ }
+@@ -1245,7 +1168,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host)
+ int ret;
+
+ /*
+- * Check the sanity of mmc->f_min to prevent tmio_mmc_set_clock() from
++ * Check the sanity of mmc->f_min to prevent host->set_clock() from
+ * looping forever...
+ */
+ if (mmc->f_min == 0)
+@@ -1255,7 +1178,6 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host)
+ _host->write16_hook = NULL;
+
+ _host->set_pwr = pdata->set_pwr;
+- _host->set_clk_div = pdata->set_clk_div;
+
+ ret = tmio_mmc_init_ocr(_host);
+ if (ret < 0)
+@@ -1318,7 +1240,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host)
+ if (pdata->flags & TMIO_MMC_SDIO_IRQ)
+ _host->sdio_irq_mask = TMIO_SDIO_MASK_ALL;
+
+- tmio_mmc_clk_stop(_host);
++ _host->set_clock(_host, 0);
+ tmio_mmc_reset(_host);
+
+ _host->sdcard_irq_mask = sd_ctrl_read16_and_16_as_32(_host, CTL_IRQ_MASK);
+@@ -1402,7 +1324,7 @@ int tmio_mmc_host_runtime_suspend(struct device *dev)
+ tmio_mmc_disable_mmc_irqs(host, TMIO_MASK_ALL);
+
+ if (host->clk_cache)
+- tmio_mmc_clk_stop(host);
++ host->set_clock(host, 0);
+
+ tmio_mmc_clk_disable(host);
+
+@@ -1423,7 +1345,7 @@ int tmio_mmc_host_runtime_resume(struct device *dev)
+ tmio_mmc_clk_enable(host);
+
+ if (host->clk_cache)
+- tmio_mmc_set_clock(host, host->clk_cache);
++ host->set_clock(host, host->clk_cache);
+
+ if (host->native_hotplug)
+ tmio_mmc_enable_mmc_irqs(host,
+diff --git a/drivers/mmc/host/wbsd.c b/drivers/mmc/host/wbsd.c
+index 9b15431d961ce..1df3ea9e5d6f1 100644
+--- a/drivers/mmc/host/wbsd.c
++++ b/drivers/mmc/host/wbsd.c
+@@ -1713,8 +1713,6 @@ static int wbsd_init(struct device *dev, int base, int irq, int dma,
+
+ wbsd_release_resources(host);
+ wbsd_free_mmc(dev);
+-
+- mmc_free_host(mmc);
+ return ret;
+ }
+
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index 3fc439d924451..e03f4883858ac 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -671,10 +671,10 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond)
+ return NULL;
+ arp = (struct arp_pkt *)skb_network_header(skb);
+
+- /* Don't modify or load balance ARPs that do not originate locally
+- * (e.g.,arrive via a bridge).
++ /* Don't modify or load balance ARPs that do not originate
++ * from the bond itself or a VLAN directly above the bond.
+ */
+- if (!bond_slave_has_mac_rx(bond, arp->mac_src))
++ if (!bond_slave_has_mac_rcu(bond, arp->mac_src))
+ return NULL;
+
+ if (arp->op_code == htons(ARPOP_REPLY)) {
+diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
+index 75a1915d95aa8..23997f1c2619f 100644
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -209,7 +209,7 @@ static inline void ibmveth_flush_buffer(void *addr, unsigned long length)
+ unsigned long offset;
+
+ for (offset = 0; offset < length; offset += SMP_CACHE_BYTES)
+- asm("dcbfl %0,%1" :: "b" (addr), "r" (offset));
++ asm("dcbf %0,%1,1" :: "b" (addr), "r" (offset));
+ }
+
+ /* replenish the buffers for a pool. note that we don't need to
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+index 0299e5bbb9022..10e9e60f6cf77 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+@@ -210,11 +210,11 @@ read_nvm_exit:
+ * @hw: pointer to the HW structure.
+ * @module_pointer: module pointer location in words from the NVM beginning
+ * @offset: offset in words from module start
+- * @words: number of words to write
+- * @data: buffer with words to write to the Shadow RAM
++ * @words: number of words to read
++ * @data: buffer with words to read to the Shadow RAM
+ * @last_command: tells the AdminQ that this is the last command
+ *
+- * Writes a 16 bit words buffer to the Shadow RAM using the admin command.
++ * Reads a 16 bit words buffer to the Shadow RAM using the admin command.
+ **/
+ static i40e_status i40e_read_nvm_aq(struct i40e_hw *hw,
+ u8 module_pointer, u32 offset,
+@@ -234,18 +234,18 @@ static i40e_status i40e_read_nvm_aq(struct i40e_hw *hw,
+ */
+ if ((offset + words) > hw->nvm.sr_size)
+ i40e_debug(hw, I40E_DEBUG_NVM,
+- "NVM write error: offset %d beyond Shadow RAM limit %d\n",
++ "NVM read error: offset %d beyond Shadow RAM limit %d\n",
+ (offset + words), hw->nvm.sr_size);
+ else if (words > I40E_SR_SECTOR_SIZE_IN_WORDS)
+- /* We can write only up to 4KB (one sector), in one AQ write */
++ /* We can read only up to 4KB (one sector), in one AQ write */
+ i40e_debug(hw, I40E_DEBUG_NVM,
+- "NVM write fail error: tried to write %d words, limit is %d.\n",
++ "NVM read fail error: tried to read %d words, limit is %d.\n",
+ words, I40E_SR_SECTOR_SIZE_IN_WORDS);
+ else if (((offset + (words - 1)) / I40E_SR_SECTOR_SIZE_IN_WORDS)
+ != (offset / I40E_SR_SECTOR_SIZE_IN_WORDS))
+- /* A single write cannot spread over two sectors */
++ /* A single read cannot spread over two sectors */
+ i40e_debug(hw, I40E_DEBUG_NVM,
+- "NVM write error: cannot spread over two sectors in a single write offset=%d words=%d\n",
++ "NVM read error: cannot spread over two sectors in a single read offset=%d words=%d\n",
+ offset, words);
+ else
+ ret_code = i40e_aq_read_nvm(hw, module_pointer,
+diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
+index 29ced6b74d364..be2e743e65de9 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
+@@ -1181,18 +1181,6 @@ void igb_ptp_init(struct igb_adapter *adapter)
+ return;
+ }
+
+- spin_lock_init(&adapter->tmreg_lock);
+- INIT_WORK(&adapter->ptp_tx_work, igb_ptp_tx_work);
+-
+- if (adapter->ptp_flags & IGB_PTP_OVERFLOW_CHECK)
+- INIT_DELAYED_WORK(&adapter->ptp_overflow_work,
+- igb_ptp_overflow_check);
+-
+- adapter->tstamp_config.rx_filter = HWTSTAMP_FILTER_NONE;
+- adapter->tstamp_config.tx_type = HWTSTAMP_TX_OFF;
+-
+- igb_ptp_reset(adapter);
+-
+ adapter->ptp_clock = ptp_clock_register(&adapter->ptp_caps,
+ &adapter->pdev->dev);
+ if (IS_ERR(adapter->ptp_clock)) {
+@@ -1202,6 +1190,18 @@ void igb_ptp_init(struct igb_adapter *adapter)
+ dev_info(&adapter->pdev->dev, "added PHC on %s\n",
+ adapter->netdev->name);
+ adapter->ptp_flags |= IGB_PTP_ENABLED;
++
++ spin_lock_init(&adapter->tmreg_lock);
++ INIT_WORK(&adapter->ptp_tx_work, igb_ptp_tx_work);
++
++ if (adapter->ptp_flags & IGB_PTP_OVERFLOW_CHECK)
++ INIT_DELAYED_WORK(&adapter->ptp_overflow_work,
++ igb_ptp_overflow_check);
++
++ adapter->tstamp_config.rx_filter = HWTSTAMP_FILTER_NONE;
++ adapter->tstamp_config.tx_type = HWTSTAMP_TX_OFF;
++
++ igb_ptp_reset(adapter);
+ }
+ }
+
+diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
+index 94622d119abce..49fb62d02a76d 100644
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -421,6 +421,17 @@ static int bcm5482_read_status(struct phy_device *phydev)
+ return err;
+ }
+
++static int bcm54810_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
++{
++ return -EOPNOTSUPP;
++}
++
++static int bcm54810_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,
++ u16 val)
++{
++ return -EOPNOTSUPP;
++}
++
+ static int bcm5481_config_aneg(struct phy_device *phydev)
+ {
+ struct device_node *np = phydev->mdio.dev.of_node;
+@@ -684,6 +695,8 @@ static struct phy_driver broadcom_drivers[] = {
+ .name = "Broadcom BCM54810",
+ .features = PHY_GBIT_FEATURES,
+ .flags = PHY_HAS_INTERRUPT,
++ .read_mmd = bcm54810_read_mmd,
++ .write_mmd = bcm54810_write_mmd,
+ .config_init = bcm54xx_config_init,
+ .config_aneg = bcm5481_config_aneg,
+ .ack_interrupt = bcm_phy_ack_intr,
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index d80bc5f59b3fc..8b5e1ec6aabfb 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -2168,7 +2168,9 @@ static void team_setup(struct net_device *dev)
+
+ dev->hw_features = TEAM_VLAN_FEATURES |
+ NETIF_F_HW_VLAN_CTAG_RX |
+- NETIF_F_HW_VLAN_CTAG_FILTER;
++ NETIF_F_HW_VLAN_CTAG_FILTER |
++ NETIF_F_HW_VLAN_STAG_RX |
++ NETIF_F_HW_VLAN_STAG_FILTER;
+
+ dev->hw_features |= NETIF_F_GSO_ENCAP_ALL | NETIF_F_GSO_UDP_L4;
+ dev->features |= dev->hw_features;
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 03e0f8060cc2e..331d74f9281b6 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -3120,8 +3120,6 @@ static int virtnet_probe(struct virtio_device *vdev)
+ }
+ }
+
+- _virtnet_set_queues(vi, vi->curr_queue_pairs);
+-
+ /* serialize netdev register + virtio_device_ready() with ndo_open() */
+ rtnl_lock();
+
+@@ -3134,6 +3132,8 @@ static int virtnet_probe(struct virtio_device *vdev)
+
+ virtio_device_ready(vdev);
+
++ _virtnet_set_queues(vi, vi->curr_queue_pairs);
++
+ rtnl_unlock();
+
+ err = virtnet_cpu_notif_add(vi);
+diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
+index 3d8844e7090a8..72a289d73dfc8 100644
+--- a/drivers/pci/hotplug/acpiphp_glue.c
++++ b/drivers/pci/hotplug/acpiphp_glue.c
+@@ -510,12 +510,15 @@ static void enable_slot(struct acpiphp_slot *slot, bool bridge)
+ if (pass && dev->subordinate) {
+ check_hotplug_bridge(slot, dev);
+ pcibios_resource_survey_bus(dev->subordinate);
+- __pci_bus_size_bridges(dev->subordinate,
+- &add_list);
++ if (pci_is_root_bus(bus))
++ __pci_bus_size_bridges(dev->subordinate, &add_list);
+ }
+ }
+ }
+- __pci_bus_assign_resources(bus, &add_list, NULL);
++ if (pci_is_root_bus(bus))
++ __pci_bus_assign_resources(bus, &add_list, NULL);
++ else
++ pci_assign_unassigned_bridge_resources(bus->self);
+ }
+
+ acpiphp_sanitize_bus(bus);
+diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
+index 123420cac6b54..b75b12c2c702d 100644
+--- a/drivers/pcmcia/rsrc_nonstatic.c
++++ b/drivers/pcmcia/rsrc_nonstatic.c
+@@ -1056,6 +1056,8 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s)
+ q = p->next;
+ kfree(p);
+ }
++
++ kfree(data);
+ }
+
+
+diff --git a/drivers/scsi/raid_class.c b/drivers/scsi/raid_class.c
+index cd0aba0d58b21..cd7912e34dcd6 100644
+--- a/drivers/scsi/raid_class.c
++++ b/drivers/scsi/raid_class.c
+@@ -210,54 +210,6 @@ raid_attr_ro_state(level);
+ raid_attr_ro_fn(resync);
+ raid_attr_ro_state_fn(state);
+
+-static void raid_component_release(struct device *dev)
+-{
+- struct raid_component *rc =
+- container_of(dev, struct raid_component, dev);
+- dev_printk(KERN_ERR, rc->dev.parent, "COMPONENT RELEASE\n");
+- put_device(rc->dev.parent);
+- kfree(rc);
+-}
+-
+-int raid_component_add(struct raid_template *r,struct device *raid_dev,
+- struct device *component_dev)
+-{
+- struct device *cdev =
+- attribute_container_find_class_device(&r->raid_attrs.ac,
+- raid_dev);
+- struct raid_component *rc;
+- struct raid_data *rd = dev_get_drvdata(cdev);
+- int err;
+-
+- rc = kzalloc(sizeof(*rc), GFP_KERNEL);
+- if (!rc)
+- return -ENOMEM;
+-
+- INIT_LIST_HEAD(&rc->node);
+- device_initialize(&rc->dev);
+- rc->dev.release = raid_component_release;
+- rc->dev.parent = get_device(component_dev);
+- rc->num = rd->component_count++;
+-
+- dev_set_name(&rc->dev, "component-%d", rc->num);
+- list_add_tail(&rc->node, &rd->component_list);
+- rc->dev.class = &raid_class.class;
+- err = device_add(&rc->dev);
+- if (err)
+- goto err_out;
+-
+- return 0;
+-
+-err_out:
+- put_device(&rc->dev);
+- list_del(&rc->node);
+- rd->component_count--;
+- put_device(component_dev);
+- kfree(rc);
+- return err;
+-}
+-EXPORT_SYMBOL(raid_component_add);
+-
+ struct raid_template *
+ raid_class_attach(struct raid_function_template *ft)
+ {
+diff --git a/drivers/scsi/snic/snic_disc.c b/drivers/scsi/snic/snic_disc.c
+index 388ba2ebcce52..02b80291c1360 100644
+--- a/drivers/scsi/snic/snic_disc.c
++++ b/drivers/scsi/snic/snic_disc.c
+@@ -316,12 +316,11 @@ snic_tgt_create(struct snic *snic, struct snic_tgt_id *tgtid)
+ "Snic Tgt: device_add, with err = %d\n",
+ ret);
+
+- put_device(&tgt->dev);
+ put_device(&snic->shost->shost_gendev);
+ spin_lock_irqsave(snic->shost->host_lock, flags);
+ list_del(&tgt->list);
+ spin_unlock_irqrestore(snic->shost->host_lock, flags);
+- kfree(tgt);
++ put_device(&tgt->dev);
+ tgt = NULL;
+
+ return tgt;
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 66de3a59f5779..d3161be35b1b2 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -3224,6 +3224,7 @@ void serial8250_init_port(struct uart_8250_port *up)
+ struct uart_port *port = &up->port;
+
+ spin_lock_init(&port->lock);
++ port->pm = NULL;
+ port->ops = &serial8250_pops;
+
+ up->cur_iotype = 0xFF;
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 36321d810d36f..af23d41b98438 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -2136,6 +2136,8 @@ static int __init lpuart32_imx_early_console_setup(struct earlycon_device *devic
+ OF_EARLYCON_DECLARE(lpuart, "fsl,vf610-lpuart", lpuart_early_console_setup);
+ OF_EARLYCON_DECLARE(lpuart32, "fsl,ls1021a-lpuart", lpuart32_early_console_setup);
+ OF_EARLYCON_DECLARE(lpuart32, "fsl,imx7ulp-lpuart", lpuart32_imx_early_console_setup);
++OF_EARLYCON_DECLARE(lpuart32, "fsl,imx8ulp-lpuart", lpuart32_imx_early_console_setup);
++OF_EARLYCON_DECLARE(lpuart32, "fsl,imx8qxp-lpuart", lpuart32_imx_early_console_setup);
+ EARLYCON_DECLARE(lpuart, lpuart_early_console_setup);
+ EARLYCON_DECLARE(lpuart32, lpuart32_early_console_setup);
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 58e1bc3a77d80..0f090188e265b 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -176,55 +176,58 @@ static int dwc3_qcom_register_extcon(struct dwc3_qcom *qcom)
+ /* Only usable in contexts where the role can not change. */
+ static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom)
+ {
+- struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3);
++ struct dwc3 *dwc;
++
++ /*
++ * FIXME: Fix this layering violation.
++ */
++ dwc = platform_get_drvdata(qcom->dwc3);
++
++ /* Core driver may not have probed yet. */
++ if (!dwc)
++ return false;
+
+ return dwc->xhci;
+ }
+
++static void dwc3_qcom_enable_wakeup_irq(int irq)
++{
++ if (!irq)
++ return;
++
++ enable_irq(irq);
++ enable_irq_wake(irq);
++}
++
++static void dwc3_qcom_disable_wakeup_irq(int irq)
++{
++ if (!irq)
++ return;
++
++ disable_irq_wake(irq);
++ disable_irq_nosync(irq);
++}
++
+ static void dwc3_qcom_disable_interrupts(struct dwc3_qcom *qcom)
+ {
+- if (qcom->hs_phy_irq) {
+- disable_irq_wake(qcom->hs_phy_irq);
+- disable_irq_nosync(qcom->hs_phy_irq);
+- }
++ dwc3_qcom_disable_wakeup_irq(qcom->hs_phy_irq);
+
+- if (qcom->dp_hs_phy_irq) {
+- disable_irq_wake(qcom->dp_hs_phy_irq);
+- disable_irq_nosync(qcom->dp_hs_phy_irq);
+- }
++ dwc3_qcom_disable_wakeup_irq(qcom->dp_hs_phy_irq);
+
+- if (qcom->dm_hs_phy_irq) {
+- disable_irq_wake(qcom->dm_hs_phy_irq);
+- disable_irq_nosync(qcom->dm_hs_phy_irq);
+- }
++ dwc3_qcom_disable_wakeup_irq(qcom->dm_hs_phy_irq);
+
+- if (qcom->ss_phy_irq) {
+- disable_irq_wake(qcom->ss_phy_irq);
+- disable_irq_nosync(qcom->ss_phy_irq);
+- }
++ dwc3_qcom_disable_wakeup_irq(qcom->ss_phy_irq);
+ }
+
+ static void dwc3_qcom_enable_interrupts(struct dwc3_qcom *qcom)
+ {
+- if (qcom->hs_phy_irq) {
+- enable_irq(qcom->hs_phy_irq);
+- enable_irq_wake(qcom->hs_phy_irq);
+- }
++ dwc3_qcom_enable_wakeup_irq(qcom->hs_phy_irq);
+
+- if (qcom->dp_hs_phy_irq) {
+- enable_irq(qcom->dp_hs_phy_irq);
+- enable_irq_wake(qcom->dp_hs_phy_irq);
+- }
++ dwc3_qcom_enable_wakeup_irq(qcom->dp_hs_phy_irq);
+
+- if (qcom->dm_hs_phy_irq) {
+- enable_irq(qcom->dm_hs_phy_irq);
+- enable_irq_wake(qcom->dm_hs_phy_irq);
+- }
++ dwc3_qcom_enable_wakeup_irq(qcom->dm_hs_phy_irq);
+
+- if (qcom->ss_phy_irq) {
+- enable_irq(qcom->ss_phy_irq);
+- enable_irq_wake(qcom->ss_phy_irq);
+- }
++ dwc3_qcom_enable_wakeup_irq(qcom->ss_phy_irq);
+ }
+
+ static int dwc3_qcom_suspend(struct dwc3_qcom *qcom)
+diff --git a/drivers/video/fbdev/core/sysimgblt.c b/drivers/video/fbdev/core/sysimgblt.c
+index a4d05b1b17d7d..665ef7a0a2495 100644
+--- a/drivers/video/fbdev/core/sysimgblt.c
++++ b/drivers/video/fbdev/core/sysimgblt.c
+@@ -188,23 +188,29 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p,
+ {
+ u32 fgx = fgcolor, bgx = bgcolor, bpp = p->var.bits_per_pixel;
+ u32 ppw = 32/bpp, spitch = (image->width + 7)/8;
+- u32 bit_mask, end_mask, eorx, shift;
+- const char *s = image->data, *src;
++ u32 bit_mask, eorx, shift;
++ const u8 *s = image->data, *src;
+ u32 *dst;
+- const u32 *tab = NULL;
++ const u32 *tab;
++ size_t tablen;
++ u32 colortab[16];
+ int i, j, k;
+
+ switch (bpp) {
+ case 8:
+ tab = fb_be_math(p) ? cfb_tab8_be : cfb_tab8_le;
++ tablen = 16;
+ break;
+ case 16:
+ tab = fb_be_math(p) ? cfb_tab16_be : cfb_tab16_le;
++ tablen = 4;
+ break;
+ case 32:
+- default:
+ tab = cfb_tab32;
++ tablen = 2;
+ break;
++ default:
++ return;
+ }
+
+ for (i = ppw-1; i--; ) {
+@@ -218,20 +224,62 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p,
+ eorx = fgx ^ bgx;
+ k = image->width/ppw;
+
++ for (i = 0; i < tablen; ++i)
++ colortab[i] = (tab[i] & eorx) ^ bgx;
++
+ for (i = image->height; i--; ) {
+ dst = dst1;
+ shift = 8;
+ src = s;
+
+- for (j = k; j--; ) {
++ /*
++ * Manually unroll the per-line copying loop for better
++ * performance. This works until we processed the last
++ * completely filled source byte (inclusive).
++ */
++ switch (ppw) {
++ case 4: /* 8 bpp */
++ for (j = k; j >= 2; j -= 2, ++src) {
++ *dst++ = colortab[(*src >> 4) & bit_mask];
++ *dst++ = colortab[(*src >> 0) & bit_mask];
++ }
++ break;
++ case 2: /* 16 bpp */
++ for (j = k; j >= 4; j -= 4, ++src) {
++ *dst++ = colortab[(*src >> 6) & bit_mask];
++ *dst++ = colortab[(*src >> 4) & bit_mask];
++ *dst++ = colortab[(*src >> 2) & bit_mask];
++ *dst++ = colortab[(*src >> 0) & bit_mask];
++ }
++ break;
++ case 1: /* 32 bpp */
++ for (j = k; j >= 8; j -= 8, ++src) {
++ *dst++ = colortab[(*src >> 7) & bit_mask];
++ *dst++ = colortab[(*src >> 6) & bit_mask];
++ *dst++ = colortab[(*src >> 5) & bit_mask];
++ *dst++ = colortab[(*src >> 4) & bit_mask];
++ *dst++ = colortab[(*src >> 3) & bit_mask];
++ *dst++ = colortab[(*src >> 2) & bit_mask];
++ *dst++ = colortab[(*src >> 1) & bit_mask];
++ *dst++ = colortab[(*src >> 0) & bit_mask];
++ }
++ break;
++ }
++
++ /*
++ * For image widths that are not a multiple of 8, there
++ * are trailing pixels left on the current line. Print
++ * them as well.
++ */
++ for (; j--; ) {
+ shift -= ppw;
+- end_mask = tab[(*src >> shift) & bit_mask];
+- *dst++ = (end_mask & eorx) ^ bgx;
++ *dst++ = colortab[(*src >> shift) & bit_mask];
+ if (!shift) {
+ shift = 8;
+- src++;
++ ++src;
+ }
+ }
++
+ dst1 += p->fix.line_length;
+ s += spitch;
+ }
+diff --git a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
+index fcdbb2df137f8..2277d64310abf 100644
+--- a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
++++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
+@@ -523,7 +523,9 @@ static int mmphw_probe(struct platform_device *pdev)
+ ret = -ENOENT;
+ goto failed;
+ }
+- clk_prepare_enable(ctrl->clk);
++ ret = clk_prepare_enable(ctrl->clk);
++ if (ret)
++ goto failed;
+
+ /* init global regs */
+ ctrl_set_default(ctrl);
+diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
+index 17cd682acc22b..07be3a374efbb 100644
+--- a/drivers/virtio/virtio_mmio.c
++++ b/drivers/virtio/virtio_mmio.c
+@@ -536,11 +536,9 @@ static void virtio_mmio_release_dev(struct device *_d)
+ {
+ struct virtio_device *vdev =
+ container_of(_d, struct virtio_device, dev);
+- struct virtio_mmio_device *vm_dev =
+- container_of(vdev, struct virtio_mmio_device, vdev);
+- struct platform_device *pdev = vm_dev->pdev;
++ struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
+
+- devm_kfree(&pdev->dev, vm_dev);
++ kfree(vm_dev);
+ }
+
+ /* Platform device */
+@@ -548,19 +546,10 @@ static void virtio_mmio_release_dev(struct device *_d)
+ static int virtio_mmio_probe(struct platform_device *pdev)
+ {
+ struct virtio_mmio_device *vm_dev;
+- struct resource *mem;
+ unsigned long magic;
+ int rc;
+
+- mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- if (!mem)
+- return -EINVAL;
+-
+- if (!devm_request_mem_region(&pdev->dev, mem->start,
+- resource_size(mem), pdev->name))
+- return -EBUSY;
+-
+- vm_dev = devm_kzalloc(&pdev->dev, sizeof(*vm_dev), GFP_KERNEL);
++ vm_dev = kzalloc(sizeof(*vm_dev), GFP_KERNEL);
+ if (!vm_dev)
+ return -ENOMEM;
+
+@@ -571,9 +560,9 @@ static int virtio_mmio_probe(struct platform_device *pdev)
+ INIT_LIST_HEAD(&vm_dev->virtqueues);
+ spin_lock_init(&vm_dev->lock);
+
+- vm_dev->base = devm_ioremap(&pdev->dev, mem->start, resource_size(mem));
+- if (vm_dev->base == NULL)
+- return -EFAULT;
++ vm_dev->base = devm_platform_ioremap_resource(pdev, 0);
++ if (IS_ERR(vm_dev->base))
++ return PTR_ERR(vm_dev->base);
+
+ /* Check magic value */
+ magic = readl(vm_dev->base + VIRTIO_MMIO_MAGIC_VALUE);
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 0294f519c29ee..b69d6f7012f44 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4106,8 +4106,7 @@ int btrfs_cancel_balance(struct btrfs_fs_info *fs_info)
+ }
+ }
+
+- BUG_ON(fs_info->balance_ctl ||
+- test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags));
++ ASSERT(!test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags));
+ atomic_dec(&fs_info->balance_cancel_req);
+ mutex_unlock(&fs_info->balance_mutex);
+ return 0;
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 7b482489bd227..0613b86cc3fd0 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -3991,9 +3991,9 @@ static int cifs_readpage_worker(struct file *file, struct page *page,
+
+ io_error:
+ kunmap(page);
+- unlock_page(page);
+
+ read_complete:
++ unlock_page(page);
+ return rc;
+ }
+
+diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
+index d4e204473e76b..0864481d8551c 100644
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -1858,7 +1858,7 @@ static void del_timeout(struct dlm_lkb *lkb)
+ void dlm_scan_timeout(struct dlm_ls *ls)
+ {
+ struct dlm_rsb *r;
+- struct dlm_lkb *lkb;
++ struct dlm_lkb *lkb = NULL, *iter;
+ int do_cancel, do_warn;
+ s64 wait_us;
+
+@@ -1869,27 +1869,28 @@ void dlm_scan_timeout(struct dlm_ls *ls)
+ do_cancel = 0;
+ do_warn = 0;
+ mutex_lock(&ls->ls_timeout_mutex);
+- list_for_each_entry(lkb, &ls->ls_timeout, lkb_time_list) {
++ list_for_each_entry(iter, &ls->ls_timeout, lkb_time_list) {
+
+ wait_us = ktime_to_us(ktime_sub(ktime_get(),
+- lkb->lkb_timestamp));
++ iter->lkb_timestamp));
+
+- if ((lkb->lkb_exflags & DLM_LKF_TIMEOUT) &&
+- wait_us >= (lkb->lkb_timeout_cs * 10000))
++ if ((iter->lkb_exflags & DLM_LKF_TIMEOUT) &&
++ wait_us >= (iter->lkb_timeout_cs * 10000))
+ do_cancel = 1;
+
+- if ((lkb->lkb_flags & DLM_IFL_WATCH_TIMEWARN) &&
++ if ((iter->lkb_flags & DLM_IFL_WATCH_TIMEWARN) &&
+ wait_us >= dlm_config.ci_timewarn_cs * 10000)
+ do_warn = 1;
+
+ if (!do_cancel && !do_warn)
+ continue;
+- hold_lkb(lkb);
++ hold_lkb(iter);
++ lkb = iter;
+ break;
+ }
+ mutex_unlock(&ls->ls_timeout_mutex);
+
+- if (!do_cancel && !do_warn)
++ if (!lkb)
+ break;
+
+ r = lkb->lkb_resource;
+@@ -5243,21 +5244,18 @@ void dlm_recover_waiters_pre(struct dlm_ls *ls)
+
+ static struct dlm_lkb *find_resend_waiter(struct dlm_ls *ls)
+ {
+- struct dlm_lkb *lkb;
+- int found = 0;
++ struct dlm_lkb *lkb = NULL, *iter;
+
+ mutex_lock(&ls->ls_waiters_mutex);
+- list_for_each_entry(lkb, &ls->ls_waiters, lkb_wait_reply) {
+- if (lkb->lkb_flags & DLM_IFL_RESEND) {
+- hold_lkb(lkb);
+- found = 1;
++ list_for_each_entry(iter, &ls->ls_waiters, lkb_wait_reply) {
++ if (iter->lkb_flags & DLM_IFL_RESEND) {
++ hold_lkb(iter);
++ lkb = iter;
+ break;
+ }
+ }
+ mutex_unlock(&ls->ls_waiters_mutex);
+
+- if (!found)
+- lkb = NULL;
+ return lkb;
+ }
+
+@@ -5916,37 +5914,36 @@ int dlm_user_adopt_orphan(struct dlm_ls *ls, struct dlm_user_args *ua_tmp,
+ int mode, uint32_t flags, void *name, unsigned int namelen,
+ unsigned long timeout_cs, uint32_t *lkid)
+ {
+- struct dlm_lkb *lkb;
++ struct dlm_lkb *lkb = NULL, *iter;
+ struct dlm_user_args *ua;
+ int found_other_mode = 0;
+- int found = 0;
+ int rv = 0;
+
+ mutex_lock(&ls->ls_orphans_mutex);
+- list_for_each_entry(lkb, &ls->ls_orphans, lkb_ownqueue) {
+- if (lkb->lkb_resource->res_length != namelen)
++ list_for_each_entry(iter, &ls->ls_orphans, lkb_ownqueue) {
++ if (iter->lkb_resource->res_length != namelen)
+ continue;
+- if (memcmp(lkb->lkb_resource->res_name, name, namelen))
++ if (memcmp(iter->lkb_resource->res_name, name, namelen))
+ continue;
+- if (lkb->lkb_grmode != mode) {
++ if (iter->lkb_grmode != mode) {
+ found_other_mode = 1;
+ continue;
+ }
+
+- found = 1;
+- list_del_init(&lkb->lkb_ownqueue);
+- lkb->lkb_flags &= ~DLM_IFL_ORPHAN;
+- *lkid = lkb->lkb_id;
++ lkb = iter;
++ list_del_init(&iter->lkb_ownqueue);
++ iter->lkb_flags &= ~DLM_IFL_ORPHAN;
++ *lkid = iter->lkb_id;
+ break;
+ }
+ mutex_unlock(&ls->ls_orphans_mutex);
+
+- if (!found && found_other_mode) {
++ if (!lkb && found_other_mode) {
+ rv = -EAGAIN;
+ goto out;
+ }
+
+- if (!found) {
++ if (!lkb) {
+ rv = -ENOENT;
+ goto out;
+ }
+diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c
+index 9fef426ce6f41..0501821182b1e 100644
+--- a/fs/dlm/plock.c
++++ b/fs/dlm/plock.c
+@@ -83,8 +83,7 @@ static void send_op(struct plock_op *op)
+ abandoned waiter. So, we have to insert the unlock-close when the
+ lock call is interrupted. */
+
+-static void do_unlock_close(struct dlm_ls *ls, u64 number,
+- struct file *file, struct file_lock *fl)
++static void do_unlock_close(const struct dlm_plock_info *info)
+ {
+ struct plock_op *op;
+
+@@ -93,15 +92,12 @@ static void do_unlock_close(struct dlm_ls *ls, u64 number,
+ return;
+
+ op->info.optype = DLM_PLOCK_OP_UNLOCK;
+- op->info.pid = fl->fl_pid;
+- op->info.fsid = ls->ls_global_id;
+- op->info.number = number;
++ op->info.pid = info->pid;
++ op->info.fsid = info->fsid;
++ op->info.number = info->number;
+ op->info.start = 0;
+ op->info.end = OFFSET_MAX;
+- if (fl->fl_lmops && fl->fl_lmops->lm_grant)
+- op->info.owner = (__u64) fl->fl_pid;
+- else
+- op->info.owner = (__u64)(long) fl->fl_owner;
++ op->info.owner = info->owner;
+
+ op->info.flags |= DLM_PLOCK_FL_CLOSE;
+ send_op(op);
+@@ -164,13 +160,14 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file,
+
+ rv = wait_event_killable(recv_wq, (op->done != 0));
+ if (rv == -ERESTARTSYS) {
+- log_debug(ls, "%s: wait killed %llx", __func__,
+- (unsigned long long)number);
+ spin_lock(&ops_lock);
+ list_del(&op->list);
+ spin_unlock(&ops_lock);
++ log_debug(ls, "%s: wait interrupted %x %llx pid %d",
++ __func__, ls->ls_global_id,
++ (unsigned long long)number, op->info.pid);
+ dlm_release_plock_op(op);
+- do_unlock_close(ls, number, file, fl);
++ do_unlock_close(&op->info);
+ goto out;
+ }
+
+@@ -411,7 +408,7 @@ static ssize_t dev_read(struct file *file, char __user *u, size_t count,
+ if (op->info.flags & DLM_PLOCK_FL_CLOSE)
+ list_del(&op->list);
+ else
+- list_move(&op->list, &recv_list);
++ list_move_tail(&op->list, &recv_list);
+ memcpy(&info, &op->info, sizeof(info));
+ }
+ spin_unlock(&ops_lock);
+@@ -436,9 +433,9 @@ static ssize_t dev_read(struct file *file, char __user *u, size_t count,
+ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,
+ loff_t *ppos)
+ {
++ struct plock_op *op = NULL, *iter;
+ struct dlm_plock_info info;
+- struct plock_op *op;
+- int found = 0, do_callback = 0;
++ int do_callback = 0;
+
+ if (count != sizeof(info))
+ return -EINVAL;
+@@ -449,31 +446,63 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,
+ if (check_version(&info))
+ return -EINVAL;
+
++ /*
++ * The results for waiting ops (SETLKW) can be returned in any
++ * order, so match all fields to find the op. The results for
++ * non-waiting ops are returned in the order that they were sent
++ * to userspace, so match the result with the first non-waiting op.
++ */
+ spin_lock(&ops_lock);
+- list_for_each_entry(op, &recv_list, list) {
+- if (op->info.fsid == info.fsid &&
+- op->info.number == info.number &&
+- op->info.owner == info.owner) {
+- list_del_init(&op->list);
+- memcpy(&op->info, &info, sizeof(info));
+- if (op->data)
+- do_callback = 1;
+- else
+- op->done = 1;
+- found = 1;
+- break;
++ if (info.wait) {
++ list_for_each_entry(iter, &recv_list, list) {
++ if (iter->info.fsid == info.fsid &&
++ iter->info.number == info.number &&
++ iter->info.owner == info.owner &&
++ iter->info.pid == info.pid &&
++ iter->info.start == info.start &&
++ iter->info.end == info.end &&
++ iter->info.ex == info.ex &&
++ iter->info.wait) {
++ op = iter;
++ break;
++ }
++ }
++ } else {
++ list_for_each_entry(iter, &recv_list, list) {
++ if (!iter->info.wait) {
++ op = iter;
++ break;
++ }
+ }
+ }
++
++ if (op) {
++ /* Sanity check that op and info match. */
++ if (info.wait)
++ WARN_ON(op->info.optype != DLM_PLOCK_OP_LOCK);
++ else
++ WARN_ON(op->info.fsid != info.fsid ||
++ op->info.number != info.number ||
++ op->info.owner != info.owner ||
++ op->info.optype != info.optype);
++
++ list_del_init(&op->list);
++ memcpy(&op->info, &info, sizeof(info));
++ if (op->data)
++ do_callback = 1;
++ else
++ op->done = 1;
++ }
+ spin_unlock(&ops_lock);
+
+- if (found) {
++ if (op) {
+ if (do_callback)
+ dlm_plock_callback(op);
+ else
+ wake_up(&recv_wq);
+ } else
+- log_print("dev_write no op %x %llx", info.fsid,
+- (unsigned long long)info.number);
++ log_print("%s: no op %x %llx", __func__,
++ info.fsid, (unsigned long long)info.number);
+ return count;
+ }
+
+diff --git a/fs/dlm/recover.c b/fs/dlm/recover.c
+index ce2aa54ca2e24..98b710cc9cf30 100644
+--- a/fs/dlm/recover.c
++++ b/fs/dlm/recover.c
+@@ -734,10 +734,9 @@ void dlm_recovered_lock(struct dlm_rsb *r)
+
+ static void recover_lvb(struct dlm_rsb *r)
+ {
+- struct dlm_lkb *lkb, *high_lkb = NULL;
++ struct dlm_lkb *big_lkb = NULL, *iter, *high_lkb = NULL;
+ uint32_t high_seq = 0;
+ int lock_lvb_exists = 0;
+- int big_lock_exists = 0;
+ int lvblen = r->res_ls->ls_lvblen;
+
+ if (!rsb_flag(r, RSB_NEW_MASTER2) &&
+@@ -753,37 +752,37 @@ static void recover_lvb(struct dlm_rsb *r)
+ /* we are the new master, so figure out if VALNOTVALID should
+ be set, and set the rsb lvb from the best lkb available. */
+
+- list_for_each_entry(lkb, &r->res_grantqueue, lkb_statequeue) {
+- if (!(lkb->lkb_exflags & DLM_LKF_VALBLK))
++ list_for_each_entry(iter, &r->res_grantqueue, lkb_statequeue) {
++ if (!(iter->lkb_exflags & DLM_LKF_VALBLK))
+ continue;
+
+ lock_lvb_exists = 1;
+
+- if (lkb->lkb_grmode > DLM_LOCK_CR) {
+- big_lock_exists = 1;
++ if (iter->lkb_grmode > DLM_LOCK_CR) {
++ big_lkb = iter;
+ goto setflag;
+ }
+
+- if (((int)lkb->lkb_lvbseq - (int)high_seq) >= 0) {
+- high_lkb = lkb;
+- high_seq = lkb->lkb_lvbseq;
++ if (((int)iter->lkb_lvbseq - (int)high_seq) >= 0) {
++ high_lkb = iter;
++ high_seq = iter->lkb_lvbseq;
+ }
+ }
+
+- list_for_each_entry(lkb, &r->res_convertqueue, lkb_statequeue) {
+- if (!(lkb->lkb_exflags & DLM_LKF_VALBLK))
++ list_for_each_entry(iter, &r->res_convertqueue, lkb_statequeue) {
++ if (!(iter->lkb_exflags & DLM_LKF_VALBLK))
+ continue;
+
+ lock_lvb_exists = 1;
+
+- if (lkb->lkb_grmode > DLM_LOCK_CR) {
+- big_lock_exists = 1;
++ if (iter->lkb_grmode > DLM_LOCK_CR) {
++ big_lkb = iter;
+ goto setflag;
+ }
+
+- if (((int)lkb->lkb_lvbseq - (int)high_seq) >= 0) {
+- high_lkb = lkb;
+- high_seq = lkb->lkb_lvbseq;
++ if (((int)iter->lkb_lvbseq - (int)high_seq) >= 0) {
++ high_lkb = iter;
++ high_seq = iter->lkb_lvbseq;
+ }
+ }
+
+@@ -792,7 +791,7 @@ static void recover_lvb(struct dlm_rsb *r)
+ goto out;
+
+ /* lvb is invalidated if only NL/CR locks remain */
+- if (!big_lock_exists)
++ if (!big_lkb)
+ rsb_set_flag(r, RSB_VALNOTVALID);
+
+ if (!r->res_lvbptr) {
+@@ -801,9 +800,9 @@ static void recover_lvb(struct dlm_rsb *r)
+ goto out;
+ }
+
+- if (big_lock_exists) {
+- r->res_lvbseq = lkb->lkb_lvbseq;
+- memcpy(r->res_lvbptr, lkb->lkb_lvbptr, lvblen);
++ if (big_lkb) {
++ r->res_lvbseq = big_lkb->lkb_lvbseq;
++ memcpy(r->res_lvbptr, big_lkb->lkb_lvbptr, lvblen);
+ } else if (high_lkb) {
+ r->res_lvbseq = high_lkb->lkb_lvbseq;
+ memcpy(r->res_lvbptr, high_lkb->lkb_lvbptr, lvblen);
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index bb0eaa4638e3c..29157f7d9663d 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -1374,7 +1374,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root)
+ {
+ struct gfs2_sbd *sdp = root->d_sb->s_fs_info;
+ struct gfs2_args *args = &sdp->sd_args;
+- int val;
++ unsigned int logd_secs, statfs_slow, statfs_quantum, quota_quantum;
++
++ spin_lock(&sdp->sd_tune.gt_spin);
++ logd_secs = sdp->sd_tune.gt_logd_secs;
++ quota_quantum = sdp->sd_tune.gt_quota_quantum;
++ statfs_quantum = sdp->sd_tune.gt_statfs_quantum;
++ statfs_slow = sdp->sd_tune.gt_statfs_slow;
++ spin_unlock(&sdp->sd_tune.gt_spin);
+
+ if (is_ancestor(root, sdp->sd_master_dir))
+ seq_puts(s, ",meta");
+@@ -1429,17 +1436,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root)
+ }
+ if (args->ar_discard)
+ seq_puts(s, ",discard");
+- val = sdp->sd_tune.gt_logd_secs;
+- if (val != 30)
+- seq_printf(s, ",commit=%d", val);
+- val = sdp->sd_tune.gt_statfs_quantum;
+- if (val != 30)
+- seq_printf(s, ",statfs_quantum=%d", val);
+- else if (sdp->sd_tune.gt_statfs_slow)
++ if (logd_secs != 30)
++ seq_printf(s, ",commit=%d", logd_secs);
++ if (statfs_quantum != 30)
++ seq_printf(s, ",statfs_quantum=%d", statfs_quantum);
++ else if (statfs_slow)
+ seq_puts(s, ",statfs_quantum=0");
+- val = sdp->sd_tune.gt_quota_quantum;
+- if (val != 60)
+- seq_printf(s, ",quota_quantum=%d", val);
++ if (quota_quantum != 60)
++ seq_printf(s, ",quota_quantum=%d", quota_quantum);
+ if (args->ar_statfs_percent)
+ seq_printf(s, ",statfs_percent=%d", args->ar_statfs_percent);
+ if (args->ar_errors != GFS2_ERRORS_DEFAULT) {
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 07b9df8938f29..63ad6b1d575a5 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -2040,6 +2040,9 @@ dbAllocDmapLev(struct bmap * bmp,
+ if (dbFindLeaf((dmtree_t *) & dp->tree, l2nb, &leafidx))
+ return -ENOSPC;
+
++ if (leafidx < 0)
++ return -EIO;
++
+ /* determine the block number within the file system corresponding
+ * to the leaf at which free space was found.
+ */
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index 78789c5ed36b0..e10db01f253b8 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -367,6 +367,11 @@ tid_t txBegin(struct super_block *sb, int flag)
+ jfs_info("txBegin: flag = 0x%x", flag);
+ log = JFS_SBI(sb)->log;
+
++ if (!log) {
++ jfs_error(sb, "read-only filesystem\n");
++ return 0;
++ }
++
+ TXN_LOCK();
+
+ INCREMENT(TxStat.txBegin);
+diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
+index 14528c0ffe635..c2c439acbb780 100644
+--- a/fs/jfs/namei.c
++++ b/fs/jfs/namei.c
+@@ -811,6 +811,11 @@ static int jfs_link(struct dentry *old_dentry,
+ if (rc)
+ goto out;
+
++ if (isReadOnly(ip)) {
++ jfs_error(ip->i_sb, "read-only filesystem\n");
++ return -EROFS;
++ }
++
+ tid = txBegin(ip->i_sb, 0);
+
+ mutex_lock_nested(&JFS_IP(dir)->commit_mutex, COMMIT_MUTEX_PARENT);
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 78191320f8e21..e958181b73618 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -1019,9 +1019,9 @@ static void revoke_delegation(struct nfs4_delegation *dp)
+ WARN_ON(!list_empty(&dp->dl_recall_lru));
+
+ if (clp->cl_minorversion) {
++ spin_lock(&clp->cl_lock);
+ dp->dl_stid.sc_type = NFS4_REVOKED_DELEG_STID;
+ refcount_inc(&dp->dl_stid.sc_count);
+- spin_lock(&clp->cl_lock);
+ list_add(&dp->dl_recall_lru, &clp->cl_revoked);
+ spin_unlock(&clp->cl_lock);
+ }
+@@ -4998,15 +4998,6 @@ static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) ||
+ CLOSE_STATEID(stateid))
+ return status;
+- /* Client debugging aid. */
+- if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) {
+- char addr_str[INET6_ADDRSTRLEN];
+- rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str,
+- sizeof(addr_str));
+- pr_warn_ratelimited("NFSD: client %s testing state ID "
+- "with incorrect client ID\n", addr_str);
+- return status;
+- }
+ spin_lock(&cl->cl_lock);
+ s = find_stateid_locked(cl, stateid);
+ if (!s)
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 770a2b1434856..303987d29b9c9 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -540,7 +540,7 @@ restart:
+ continue;
+ /* Wait for dquot users */
+ if (atomic_read(&dquot->dq_count)) {
+- dqgrab(dquot);
++ atomic_inc(&dquot->dq_count);
+ spin_unlock(&dq_list_lock);
+ /*
+ * Once dqput() wakes us up, we know it's time to free
+@@ -2407,7 +2407,8 @@ int dquot_load_quota_sb(struct super_block *sb, int type, int format_id,
+
+ error = add_dquot_ref(sb, type);
+ if (error)
+- dquot_disable(sb, type, flags);
++ dquot_disable(sb, type,
++ DQUOT_USAGE_ENABLED | DQUOT_LIMITS_ENABLED);
+
+ return error;
+ out_fmt:
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index 5fcfa96463ebb..85521d6b02370 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -247,7 +247,7 @@ static int udf_name_from_CS0(struct super_block *sb,
+ }
+
+ if (translate) {
+- if (str_o_len <= 2 && str_o[0] == '.' &&
++ if (str_o_len > 0 && str_o_len <= 2 && str_o[0] == '.' &&
+ (str_o_len == 1 || str_o[1] == '.'))
+ needsCRC = 1;
+ if (needsCRC) {
+diff --git a/include/linux/clk.h b/include/linux/clk.h
+index 4f750c481b82b..0a2382d3f68c8 100644
+--- a/include/linux/clk.h
++++ b/include/linux/clk.h
+@@ -175,6 +175,39 @@ int clk_get_scaled_duty_cycle(struct clk *clk, unsigned int scale);
+ */
+ bool clk_is_match(const struct clk *p, const struct clk *q);
+
++/**
++ * clk_rate_exclusive_get - get exclusivity over the rate control of a
++ * producer
++ * @clk: clock source
++ *
++ * This function allows drivers to get exclusive control over the rate of a
++ * provider. It prevents any other consumer to execute, even indirectly,
++ * opereation which could alter the rate of the provider or cause glitches
++ *
++ * If exlusivity is claimed more than once on clock, even by the same driver,
++ * the rate effectively gets locked as exclusivity can't be preempted.
++ *
++ * Must not be called from within atomic context.
++ *
++ * Returns success (0) or negative errno.
++ */
++int clk_rate_exclusive_get(struct clk *clk);
++
++/**
++ * clk_rate_exclusive_put - release exclusivity over the rate control of a
++ * producer
++ * @clk: clock source
++ *
++ * This function allows drivers to release the exclusivity it previously got
++ * from clk_rate_exclusive_get()
++ *
++ * The caller must balance the number of clk_rate_exclusive_get() and
++ * clk_rate_exclusive_put() calls.
++ *
++ * Must not be called from within atomic context.
++ */
++void clk_rate_exclusive_put(struct clk *clk);
++
+ #else
+
+ static inline int clk_notifier_register(struct clk *clk,
+@@ -221,6 +254,13 @@ static inline bool clk_is_match(const struct clk *p, const struct clk *q)
+ return p == q;
+ }
+
++static inline int clk_rate_exclusive_get(struct clk *clk)
++{
++ return 0;
++}
++
++static inline void clk_rate_exclusive_put(struct clk *clk) {}
++
+ #endif
+
+ /**
+@@ -364,38 +404,6 @@ struct clk *devm_clk_get(struct device *dev, const char *id);
+ */
+ struct clk *devm_get_clk_from_child(struct device *dev,
+ struct device_node *np, const char *con_id);
+-/**
+- * clk_rate_exclusive_get - get exclusivity over the rate control of a
+- * producer
+- * @clk: clock source
+- *
+- * This function allows drivers to get exclusive control over the rate of a
+- * provider. It prevents any other consumer to execute, even indirectly,
+- * opereation which could alter the rate of the provider or cause glitches
+- *
+- * If exlusivity is claimed more than once on clock, even by the same driver,
+- * the rate effectively gets locked as exclusivity can't be preempted.
+- *
+- * Must not be called from within atomic context.
+- *
+- * Returns success (0) or negative errno.
+- */
+-int clk_rate_exclusive_get(struct clk *clk);
+-
+-/**
+- * clk_rate_exclusive_put - release exclusivity over the rate control of a
+- * producer
+- * @clk: clock source
+- *
+- * This function allows drivers to release the exclusivity it previously got
+- * from clk_rate_exclusive_get()
+- *
+- * The caller must balance the number of clk_rate_exclusive_get() and
+- * clk_rate_exclusive_put() calls.
+- *
+- * Must not be called from within atomic context.
+- */
+-void clk_rate_exclusive_put(struct clk *clk);
+
+ /**
+ * clk_enable - inform the system when the clock source should be running.
+@@ -665,14 +673,6 @@ static inline void clk_bulk_put(int num_clks, struct clk_bulk_data *clks) {}
+
+ static inline void devm_clk_put(struct device *dev, struct clk *clk) {}
+
+-
+-static inline int clk_rate_exclusive_get(struct clk *clk)
+-{
+- return 0;
+-}
+-
+-static inline void clk_rate_exclusive_put(struct clk *clk) {}
+-
+ static inline int clk_enable(struct clk *clk)
+ {
+ return 0;
+diff --git a/include/linux/raid_class.h b/include/linux/raid_class.h
+index ec8655514283e..c868bb927c3d7 100644
+--- a/include/linux/raid_class.h
++++ b/include/linux/raid_class.h
+@@ -78,7 +78,3 @@ DEFINE_RAID_ATTRIBUTE(enum raid_state, state)
+
+ struct raid_template *raid_class_attach(struct raid_function_template *);
+ void raid_class_release(struct raid_template *);
+-
+-int __must_check raid_component_add(struct raid_template *, struct device *,
+- struct device *);
+-
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index faee73c084d49..d49c1aad24643 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -148,6 +148,10 @@ retry:
+ if (gso_type & SKB_GSO_UDP)
+ nh_off -= thlen;
+
++ /* Kernel has a special handling for GSO_BY_FRAGS. */
++ if (gso_size == GSO_BY_FRAGS)
++ return -EINVAL;
++
+ /* Too small packets are not really GSO ones. */
+ if (skb->len - nh_off > gso_size) {
+ shinfo->gso_size = gso_size;
+diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h
+index d655720e16a15..62c67e9e190c0 100644
+--- a/include/media/v4l2-mem2mem.h
++++ b/include/media/v4l2-mem2mem.h
+@@ -405,7 +405,14 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx,
+ static inline
+ unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)
+ {
+- return m2m_ctx->out_q_ctx.num_rdy;
++ unsigned int num_buf_rdy;
++ unsigned long flags;
++
++ spin_lock_irqsave(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
++ num_buf_rdy = m2m_ctx->out_q_ctx.num_rdy;
++ spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
++
++ return num_buf_rdy;
+ }
+
+ /**
+@@ -417,7 +424,14 @@ unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)
+ static inline
+ unsigned int v4l2_m2m_num_dst_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)
+ {
+- return m2m_ctx->cap_q_ctx.num_rdy;
++ unsigned int num_buf_rdy;
++ unsigned long flags;
++
++ spin_lock_irqsave(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
++ num_buf_rdy = m2m_ctx->cap_q_ctx.num_rdy;
++ spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
++
++ return num_buf_rdy;
+ }
+
+ /**
+diff --git a/include/net/bonding.h b/include/net/bonding.h
+index c458f084f7bb9..7d317434e3d13 100644
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -675,37 +675,14 @@ static inline struct slave *bond_slave_has_mac(struct bonding *bond,
+ }
+
+ /* Caller must hold rcu_read_lock() for read */
+-static inline struct slave *bond_slave_has_mac_rcu(struct bonding *bond,
+- const u8 *mac)
++static inline bool bond_slave_has_mac_rcu(struct bonding *bond, const u8 *mac)
+ {
+ struct list_head *iter;
+ struct slave *tmp;
+
+- bond_for_each_slave_rcu(bond, tmp, iter)
+- if (ether_addr_equal_64bits(mac, tmp->dev->dev_addr))
+- return tmp;
+-
+- return NULL;
+-}
+-
+-/* Caller must hold rcu_read_lock() for read */
+-static inline bool bond_slave_has_mac_rx(struct bonding *bond, const u8 *mac)
+-{
+- struct list_head *iter;
+- struct slave *tmp;
+- struct netdev_hw_addr *ha;
+-
+ bond_for_each_slave_rcu(bond, tmp, iter)
+ if (ether_addr_equal_64bits(mac, tmp->dev->dev_addr))
+ return true;
+-
+- if (netdev_uc_empty(bond->dev))
+- return false;
+-
+- netdev_for_each_uc_addr(ha, bond->dev)
+- if (ether_addr_equal_64bits(mac, ha->addr))
+- return true;
+-
+ return false;
+ }
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 72739f72e4b90..373e34b46a3c9 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1152,6 +1152,7 @@ struct proto {
+ /*
+ * Pressure flag: try to collapse.
+ * Technical note: it is used by multiple contexts non atomically.
++ * Make sure to use READ_ONCE()/WRITE_ONCE() for all reads/writes.
+ * All the __sk_mem_schedule() is of this nature: accounting
+ * is strict, actions are advisory and have some latency.
+ */
+@@ -1265,6 +1266,12 @@ static inline bool sk_has_memory_pressure(const struct sock *sk)
+ return sk->sk_prot->memory_pressure != NULL;
+ }
+
++static inline bool sk_under_global_memory_pressure(const struct sock *sk)
++{
++ return sk->sk_prot->memory_pressure &&
++ !!READ_ONCE(*sk->sk_prot->memory_pressure);
++}
++
+ static inline bool sk_under_memory_pressure(const struct sock *sk)
+ {
+ if (!sk->sk_prot->memory_pressure)
+@@ -1274,7 +1281,7 @@ static inline bool sk_under_memory_pressure(const struct sock *sk)
+ mem_cgroup_under_socket_pressure(sk->sk_memcg))
+ return true;
+
+- return !!*sk->sk_prot->memory_pressure;
++ return !!READ_ONCE(*sk->sk_prot->memory_pressure);
+ }
+
+ static inline long
+@@ -1328,7 +1335,7 @@ proto_memory_pressure(struct proto *prot)
+ {
+ if (!prot->memory_pressure)
+ return false;
+- return !!*prot->memory_pressure;
++ return !!READ_ONCE(*prot->memory_pressure);
+ }
+
+
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index 9c6c3572b1312..394c66442cfff 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -1522,6 +1522,8 @@ static struct sched_rt_entity *pick_next_rt_entity(struct rq *rq,
+ BUG_ON(idx >= MAX_RT_PRIO);
+
+ queue = array->queue + idx;
++ if (SCHED_WARN_ON(list_empty(queue)))
++ return NULL;
+ next = list_entry(queue->next, struct sched_rt_entity, run_list);
+
+ return next;
+@@ -1535,7 +1537,8 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq)
+
+ do {
+ rt_se = pick_next_rt_entity(rq, rt_rq);
+- BUG_ON(!rt_se);
++ if (unlikely(!rt_se))
++ return NULL;
+ rt_rq = group_rt_rq(rt_se);
+ } while (rt_rq);
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 9da7b10e56d23..f44c8f1fd3ec5 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -3277,8 +3277,15 @@ static void *s_start(struct seq_file *m, loff_t *pos)
+ * will point to the same string as current_trace->name.
+ */
+ mutex_lock(&trace_types_lock);
+- if (unlikely(tr->current_trace && iter->trace->name != tr->current_trace->name))
++ if (unlikely(tr->current_trace && iter->trace->name != tr->current_trace->name)) {
++ /* Close iter->trace before switching to the new current tracer */
++ if (iter->trace->close)
++ iter->trace->close(iter);
+ *iter->trace = *tr->current_trace;
++ /* Reopen the new current tracer */
++ if (iter->trace->open)
++ iter->trace->open(iter);
++ }
+ mutex_unlock(&trace_types_lock);
+
+ #ifdef CONFIG_TRACER_MAX_TRACE
+diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
+index 98ea6d28df15d..0f36bb59970df 100644
+--- a/kernel/trace/trace_irqsoff.c
++++ b/kernel/trace/trace_irqsoff.c
+@@ -222,7 +222,8 @@ static void irqsoff_trace_open(struct trace_iterator *iter)
+ {
+ if (is_graph(iter->tr))
+ graph_trace_open(iter);
+-
++ else
++ iter->private = NULL;
+ }
+
+ static void irqsoff_trace_close(struct trace_iterator *iter)
+diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
+index 11f4dbd9526b6..8041bd5e42624 100644
+--- a/kernel/trace/trace_sched_wakeup.c
++++ b/kernel/trace/trace_sched_wakeup.c
+@@ -287,6 +287,8 @@ static void wakeup_trace_open(struct trace_iterator *iter)
+ {
+ if (is_graph(iter->tr))
+ graph_trace_open(iter);
++ else
++ iter->private = NULL;
+ }
+
+ static void wakeup_trace_close(struct trace_iterator *iter)
+diff --git a/lib/clz_ctz.c b/lib/clz_ctz.c
+index 2e11e48446abf..ca0582d33532f 100644
+--- a/lib/clz_ctz.c
++++ b/lib/clz_ctz.c
+@@ -30,36 +30,16 @@ int __weak __clzsi2(int val)
+ }
+ EXPORT_SYMBOL(__clzsi2);
+
+-int __weak __clzdi2(long val);
+-int __weak __ctzdi2(long val);
+-#if BITS_PER_LONG == 32
+-
+-int __weak __clzdi2(long val)
++int __weak __clzdi2(u64 val);
++int __weak __clzdi2(u64 val)
+ {
+- return 32 - fls((int)val);
++ return 64 - fls64(val);
+ }
+ EXPORT_SYMBOL(__clzdi2);
+
+-int __weak __ctzdi2(long val)
++int __weak __ctzdi2(u64 val);
++int __weak __ctzdi2(u64 val)
+ {
+- return __ffs((u32)val);
++ return __ffs64(val);
+ }
+ EXPORT_SYMBOL(__ctzdi2);
+-
+-#elif BITS_PER_LONG == 64
+-
+-int __weak __clzdi2(long val)
+-{
+- return 64 - fls64((u64)val);
+-}
+-EXPORT_SYMBOL(__clzdi2);
+-
+-int __weak __ctzdi2(long val)
+-{
+- return __ffs64((u64)val);
+-}
+-EXPORT_SYMBOL(__ctzdi2);
+-
+-#else
+-#error BITS_PER_LONG not 32 or 64
+-#endif
+diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
+index 6c5229f98c9eb..cac4e5aee7395 100644
+--- a/lib/mpi/longlong.h
++++ b/lib/mpi/longlong.h
+@@ -639,30 +639,12 @@ do { \
+ ************** MIPS *****************
+ ***************************************/
+ #if defined(__mips__) && W_TYPE_SIZE == 32
+-#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
+ #define umul_ppmm(w1, w0, u, v) \
+ do { \
+ UDItype __ll = (UDItype)(u) * (v); \
+ w1 = __ll >> 32; \
+ w0 = __ll; \
+ } while (0)
+-#elif __GNUC__ > 2 || __GNUC_MINOR__ >= 7
+-#define umul_ppmm(w1, w0, u, v) \
+- __asm__ ("multu %2,%3" \
+- : "=l" ((USItype)(w0)), \
+- "=h" ((USItype)(w1)) \
+- : "d" ((USItype)(u)), \
+- "d" ((USItype)(v)))
+-#else
+-#define umul_ppmm(w1, w0, u, v) \
+- __asm__ ("multu %2,%3\n" \
+- "mflo %0\n" \
+- "mfhi %1" \
+- : "=d" ((USItype)(w0)), \
+- "=d" ((USItype)(w1)) \
+- : "d" ((USItype)(u)), \
+- "d" ((USItype)(v)))
+-#endif
+ #define UMUL_TIME 10
+ #define UDIV_TIME 100
+ #endif /* __mips__ */
+@@ -687,7 +669,7 @@ do { \
+ : "d" ((UDItype)(u)), \
+ "d" ((UDItype)(v))); \
+ } while (0)
+-#elif (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
++#else
+ #define umul_ppmm(w1, w0, u, v) \
+ do { \
+ typedef unsigned int __ll_UTItype __attribute__((mode(TI))); \
+@@ -695,22 +677,6 @@ do { \
+ w1 = __ll >> 64; \
+ w0 = __ll; \
+ } while (0)
+-#elif __GNUC__ > 2 || __GNUC_MINOR__ >= 7
+-#define umul_ppmm(w1, w0, u, v) \
+- __asm__ ("dmultu %2,%3" \
+- : "=l" ((UDItype)(w0)), \
+- "=h" ((UDItype)(w1)) \
+- : "d" ((UDItype)(u)), \
+- "d" ((UDItype)(v)))
+-#else
+-#define umul_ppmm(w1, w0, u, v) \
+- __asm__ ("dmultu %2,%3\n" \
+- "mflo %0\n" \
+- "mfhi %1" \
+- : "=d" ((UDItype)(w0)), \
+- "=d" ((UDItype)(w1)) \
+- : "d" ((UDItype)(u)), \
+- "d" ((UDItype)(v)))
+ #endif
+ #define UMUL_TIME 20
+ #define UDIV_TIME 140
+diff --git a/lib/test_firmware.c b/lib/test_firmware.c
+index b5e779bcfb343..be3baea88b61d 100644
+--- a/lib/test_firmware.c
++++ b/lib/test_firmware.c
+@@ -284,16 +284,26 @@ static ssize_t config_test_show_str(char *dst,
+ return len;
+ }
+
+-static int test_dev_config_update_bool(const char *buf, size_t size,
+- bool *cfg)
++static inline int __test_dev_config_update_bool(const char *buf, size_t size,
++ bool *cfg)
+ {
+ int ret;
+
+- mutex_lock(&test_fw_mutex);
+ if (strtobool(buf, cfg) < 0)
+ ret = -EINVAL;
+ else
+ ret = size;
++
++ return ret;
++}
++
++static int test_dev_config_update_bool(const char *buf, size_t size,
++ bool *cfg)
++{
++ int ret;
++
++ mutex_lock(&test_fw_mutex);
++ ret = __test_dev_config_update_bool(buf, size, cfg);
+ mutex_unlock(&test_fw_mutex);
+
+ return ret;
+@@ -323,7 +333,7 @@ static ssize_t test_dev_config_show_int(char *buf, int cfg)
+ return snprintf(buf, PAGE_SIZE, "%d\n", val);
+ }
+
+-static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
++static inline int __test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
+ {
+ int ret;
+ long new;
+@@ -335,14 +345,23 @@ static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
+ if (new > U8_MAX)
+ return -EINVAL;
+
+- mutex_lock(&test_fw_mutex);
+ *(u8 *)cfg = new;
+- mutex_unlock(&test_fw_mutex);
+
+ /* Always return full write size even if we didn't consume all */
+ return size;
+ }
+
++static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
++{
++ int ret;
++
++ mutex_lock(&test_fw_mutex);
++ ret = __test_dev_config_update_u8(buf, size, cfg);
++ mutex_unlock(&test_fw_mutex);
++
++ return ret;
++}
++
+ static ssize_t test_dev_config_show_u8(char *buf, u8 cfg)
+ {
+ u8 val;
+@@ -375,10 +394,10 @@ static ssize_t config_num_requests_store(struct device *dev,
+ mutex_unlock(&test_fw_mutex);
+ goto out;
+ }
+- mutex_unlock(&test_fw_mutex);
+
+- rc = test_dev_config_update_u8(buf, count,
+- &test_fw_config->num_requests);
++ rc = __test_dev_config_update_u8(buf, count,
++ &test_fw_config->num_requests);
++ mutex_unlock(&test_fw_mutex);
+
+ out:
+ return rc;
+diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
+index af3da6cdfc798..17100d9ceaf0b 100644
+--- a/net/batman-adv/bat_v_elp.c
++++ b/net/batman-adv/bat_v_elp.c
+@@ -513,7 +513,7 @@ int batadv_v_elp_packet_recv(struct sk_buff *skb,
+ struct batadv_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
+ struct batadv_elp_packet *elp_packet;
+ struct batadv_hard_iface *primary_if;
+- struct ethhdr *ethhdr = (struct ethhdr *)skb_mac_header(skb);
++ struct ethhdr *ethhdr;
+ bool res;
+ int ret = NET_RX_DROP;
+
+@@ -521,6 +521,7 @@ int batadv_v_elp_packet_recv(struct sk_buff *skb,
+ if (!res)
+ goto free_skb;
+
++ ethhdr = eth_hdr(skb);
+ if (batadv_is_my_mac(bat_priv, ethhdr->h_source))
+ goto free_skb;
+
+diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
+index 04a620fd13014..5d4232d8d6511 100644
+--- a/net/batman-adv/bat_v_ogm.c
++++ b/net/batman-adv/bat_v_ogm.c
+@@ -119,8 +119,10 @@ static void batadv_v_ogm_send_to_if(struct sk_buff *skb,
+ {
+ struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
+
+- if (hard_iface->if_status != BATADV_IF_ACTIVE)
++ if (hard_iface->if_status != BATADV_IF_ACTIVE) {
++ kfree_skb(skb);
+ return;
++ }
+
+ batadv_inc_counter(bat_priv, BATADV_CNT_MGMT_TX);
+ batadv_add_counter(bat_priv, BATADV_CNT_MGMT_TX_BYTES,
+@@ -832,7 +834,7 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb,
+ {
+ struct batadv_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
+ struct batadv_ogm2_packet *ogm_packet;
+- struct ethhdr *ethhdr = eth_hdr(skb);
++ struct ethhdr *ethhdr;
+ int ogm_offset;
+ u8 *packet_pos;
+ int ret = NET_RX_DROP;
+@@ -846,6 +848,7 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb,
+ if (!batadv_check_management_packet(skb, if_incoming, BATADV_OGM2_HLEN))
+ goto free_skb;
+
++ ethhdr = eth_hdr(skb);
+ if (batadv_is_my_mac(bat_priv, ethhdr->h_source))
+ goto free_skb;
+
+diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
+index 6d68cdb9dd773..0d5519fcb4388 100644
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -643,7 +643,19 @@ out:
+ */
+ void batadv_update_min_mtu(struct net_device *soft_iface)
+ {
+- soft_iface->mtu = batadv_hardif_min_mtu(soft_iface);
++ struct batadv_priv *bat_priv = netdev_priv(soft_iface);
++ int limit_mtu;
++ int mtu;
++
++ mtu = batadv_hardif_min_mtu(soft_iface);
++
++ if (bat_priv->mtu_set_by_user)
++ limit_mtu = bat_priv->mtu_set_by_user;
++ else
++ limit_mtu = ETH_DATA_LEN;
++
++ mtu = min(mtu, limit_mtu);
++ dev_set_mtu(soft_iface, mtu);
+
+ /* Check if the local translate table should be cleaned up to match a
+ * new (and smaller) MTU.
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 1003abb8cc35e..7447dbd305fc1 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -167,11 +167,14 @@ static int batadv_interface_set_mac_addr(struct net_device *dev, void *p)
+
+ static int batadv_interface_change_mtu(struct net_device *dev, int new_mtu)
+ {
++ struct batadv_priv *bat_priv = netdev_priv(dev);
++
+ /* check ranges */
+ if (new_mtu < 68 || new_mtu > batadv_hardif_min_mtu(dev))
+ return -EINVAL;
+
+ dev->mtu = new_mtu;
++ bat_priv->mtu_set_by_user = new_mtu;
+
+ return 0;
+ }
+diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
+index 6bdb70c93e3fb..c64d58c1b724f 100644
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -793,7 +793,6 @@ check_roaming:
+ if (roamed_back) {
+ batadv_tt_global_free(bat_priv, tt_global,
+ "Roaming canceled");
+- tt_global = NULL;
+ } else {
+ /* The global entry has to be marked as ROAMING and
+ * has to be kept for consistency purpose
+diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
+index 37598ae1d3f7a..34c18f72a41ba 100644
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -1514,6 +1514,12 @@ struct batadv_priv {
+ /** @soft_iface: net device which holds this struct as private data */
+ struct net_device *soft_iface;
+
++ /**
++ * @mtu_set_by_user: MTU was set once by user
++ * protected by rtnl_lock
++ */
++ int mtu_set_by_user;
++
+ /**
+ * @bat_counters: mesh internal traffic statistic counters (see
+ * batadv_counters)
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index fcc471f921895..9346fae5d664b 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -5705,9 +5705,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
+ if (!chan)
+ goto done;
+
++ chan = l2cap_chan_hold_unless_zero(chan);
++ if (!chan)
++ goto done;
++
+ l2cap_chan_lock(chan);
+ l2cap_chan_del(chan, ECONNREFUSED);
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+
+ done:
+ mutex_unlock(&conn->chan_lock);
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 79f62517e24a5..794db633f1c90 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2702,7 +2702,10 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh,
+ ifm = nlmsg_data(nlh);
+ if (ifm->ifi_index > 0)
+ dev = __dev_get_by_index(net, ifm->ifi_index);
+- else if (tb[IFLA_IFNAME])
++ else if (ifm->ifi_index < 0) {
++ NL_SET_ERR_MSG(extack, "ifindex can't be negative");
++ return -EINVAL;
++ } else if (tb[IFLA_IFNAME])
+ dev = __dev_get_by_name(net, ifname);
+ else
+ goto errout;
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 3e6da3694a5a5..4e3ed80a68ceb 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2538,7 +2538,7 @@ void __sk_mem_reduce_allocated(struct sock *sk, int amount)
+ if (mem_cgroup_sockets_enabled && sk->sk_memcg)
+ mem_cgroup_uncharge_skmem(sk->sk_memcg, amount);
+
+- if (sk_under_memory_pressure(sk) &&
++ if (sk_under_global_memory_pressure(sk) &&
+ (sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)))
+ sk_leave_memory_pressure(sk);
+ }
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c
+index 27de4dc1ff512..c4ea0159ce2e8 100644
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -328,11 +328,15 @@ EXPORT_SYMBOL_GPL(dccp_disconnect);
+ __poll_t dccp_poll(struct file *file, struct socket *sock,
+ poll_table *wait)
+ {
+- __poll_t mask;
+ struct sock *sk = sock->sk;
++ __poll_t mask;
++ u8 shutdown;
++ int state;
+
+ sock_poll_wait(file, sock, wait);
+- if (sk->sk_state == DCCP_LISTEN)
++
++ state = inet_sk_state_load(sk);
++ if (state == DCCP_LISTEN)
+ return inet_csk_listen_poll(sk);
+
+ /* Socket is not locked. We are protected from async events
+@@ -341,20 +345,21 @@ __poll_t dccp_poll(struct file *file, struct socket *sock,
+ */
+
+ mask = 0;
+- if (sk->sk_err)
++ if (READ_ONCE(sk->sk_err))
+ mask = EPOLLERR;
++ shutdown = READ_ONCE(sk->sk_shutdown);
+
+- if (sk->sk_shutdown == SHUTDOWN_MASK || sk->sk_state == DCCP_CLOSED)
++ if (shutdown == SHUTDOWN_MASK || state == DCCP_CLOSED)
+ mask |= EPOLLHUP;
+- if (sk->sk_shutdown & RCV_SHUTDOWN)
++ if (shutdown & RCV_SHUTDOWN)
+ mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP;
+
+ /* Connected? */
+- if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_RESPOND)) {
++ if ((1 << state) & ~(DCCPF_REQUESTING | DCCPF_RESPOND)) {
+ if (atomic_read(&sk->sk_rmem_alloc) > 0)
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+- if (!(sk->sk_shutdown & SEND_SHUTDOWN)) {
++ if (!(shutdown & SEND_SHUTDOWN)) {
+ if (sk_stream_is_writeable(sk)) {
+ mask |= EPOLLOUT | EPOLLWRNORM;
+ } else { /* send SIGIO later */
+@@ -372,7 +377,6 @@ __poll_t dccp_poll(struct file *file, struct socket *sock,
+ }
+ return mask;
+ }
+-
+ EXPORT_SYMBOL_GPL(dccp_poll);
+
+ int dccp_ioctl(struct sock *sk, int cmd, unsigned long arg)
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index 15c71b08c2df4..a3536dfe9b16b 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -319,12 +319,12 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ switch (skb->protocol) {
+ case htons(ETH_P_IP):
+- xfrm_decode_session(skb, &fl, AF_INET);
+ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET);
+ break;
+ case htons(ETH_P_IPV6):
+- xfrm_decode_session(skb, &fl, AF_INET6);
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET6);
+ break;
+ default:
+ goto tx_err;
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 84069db0423a2..d8d28ba169b4d 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -549,7 +549,9 @@ out_reset_timer:
+ tcp_stream_is_thin(tp) &&
+ icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) {
+ icsk->icsk_backoff = 0;
+- icsk->icsk_rto = min(__tcp_set_rto(tp), TCP_RTO_MAX);
++ icsk->icsk_rto = clamp(__tcp_set_rto(tp),
++ tcp_rto_min(sk),
++ TCP_RTO_MAX);
+ } else {
+ /* Use normal (exponential) backoff */
+ icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 866ce815625e5..a64050e775882 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -562,12 +562,12 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
+ vti6_addr_conflict(t, ipv6_hdr(skb)))
+ goto tx_err;
+
+- xfrm_decode_session(skb, &fl, AF_INET6);
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET6);
+ break;
+ case htons(ETH_P_IP):
+- xfrm_decode_session(skb, &fl, AF_INET);
+ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET);
+ break;
+ default:
+ goto tx_err;
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index b8456e2f11673..47ffa69ca6f67 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1858,9 +1858,9 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
+ if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
+ struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
+
+- if ((xfilter->sadb_x_filter_splen >=
++ if ((xfilter->sadb_x_filter_splen >
+ (sizeof(xfrm_address_t) << 3)) ||
+- (xfilter->sadb_x_filter_dplen >=
++ (xfilter->sadb_x_filter_dplen >
+ (sizeof(xfrm_address_t) << 3))) {
+ mutex_unlock(&pfk->dump_lock);
+ return -EINVAL;
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 3bf8d7f3cdc32..0909f32eabfd1 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -1656,6 +1656,7 @@ static int ip_vs_zero_all(struct netns_ipvs *ipvs)
+ #ifdef CONFIG_SYSCTL
+
+ static int zero;
++static int one = 1;
+ static int three = 3;
+
+ static int
+@@ -1667,12 +1668,18 @@ proc_do_defense_mode(struct ctl_table *table, int write,
+ int val = *valp;
+ int rc;
+
+- rc = proc_dointvec(table, write, buffer, lenp, ppos);
++ struct ctl_table tmp = {
++ .data = &val,
++ .maxlen = sizeof(int),
++ .mode = table->mode,
++ };
++
++ rc = proc_dointvec(&tmp, write, buffer, lenp, ppos);
+ if (write && (*valp != val)) {
+- if ((*valp < 0) || (*valp > 3)) {
+- /* Restore the correct value */
+- *valp = val;
++ if (val < 0 || val > 3) {
++ rc = -EINVAL;
+ } else {
++ *valp = val;
+ update_defense_level(ipvs);
+ }
+ }
+@@ -1683,37 +1690,27 @@ static int
+ proc_do_sync_threshold(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
++ struct netns_ipvs *ipvs = table->extra2;
+ int *valp = table->data;
+ int val[2];
+ int rc;
++ struct ctl_table tmp = {
++ .data = &val,
++ .maxlen = table->maxlen,
++ .mode = table->mode,
++ };
+
+- /* backup the value first */
++ mutex_lock(&ipvs->sync_mutex);
+ memcpy(val, valp, sizeof(val));
+-
+- rc = proc_dointvec(table, write, buffer, lenp, ppos);
+- if (write && (valp[0] < 0 || valp[1] < 0 ||
+- (valp[0] >= valp[1] && valp[1]))) {
+- /* Restore the correct value */
+- memcpy(valp, val, sizeof(val));
+- }
+- return rc;
+-}
+-
+-static int
+-proc_do_sync_mode(struct ctl_table *table, int write,
+- void __user *buffer, size_t *lenp, loff_t *ppos)
+-{
+- int *valp = table->data;
+- int val = *valp;
+- int rc;
+-
+- rc = proc_dointvec(table, write, buffer, lenp, ppos);
+- if (write && (*valp != val)) {
+- if ((*valp < 0) || (*valp > 1)) {
+- /* Restore the correct value */
+- *valp = val;
+- }
++ rc = proc_dointvec(&tmp, write, buffer, lenp, ppos);
++ if (write) {
++ if (val[0] < 0 || val[1] < 0 ||
++ (val[0] >= val[1] && val[1]))
++ rc = -EINVAL;
++ else
++ memcpy(valp, val, sizeof(val));
+ }
++ mutex_unlock(&ipvs->sync_mutex);
+ return rc;
+ }
+
+@@ -1725,12 +1722,18 @@ proc_do_sync_ports(struct ctl_table *table, int write,
+ int val = *valp;
+ int rc;
+
+- rc = proc_dointvec(table, write, buffer, lenp, ppos);
++ struct ctl_table tmp = {
++ .data = &val,
++ .maxlen = sizeof(int),
++ .mode = table->mode,
++ };
++
++ rc = proc_dointvec(&tmp, write, buffer, lenp, ppos);
+ if (write && (*valp != val)) {
+- if (*valp < 1 || !is_power_of_2(*valp)) {
+- /* Restore the correct value */
++ if (val < 1 || !is_power_of_2(val))
++ rc = -EINVAL;
++ else
+ *valp = val;
+- }
+ }
+ return rc;
+ }
+@@ -1790,7 +1793,9 @@ static struct ctl_table vs_vars[] = {
+ .procname = "sync_version",
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_do_sync_mode,
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &zero,
++ .extra2 = &one,
+ },
+ {
+ .procname = "sync_ports",
+@@ -3942,6 +3947,7 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
+ ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
+ ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
+ tbl[idx].data = &ipvs->sysctl_sync_threshold;
++ tbl[idx].extra2 = ipvs;
+ tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
+ ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
+ tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
+diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
+index cadeb22a48f23..8453e92936ac9 100644
+--- a/net/netfilter/nf_conntrack_proto_sctp.c
++++ b/net/netfilter/nf_conntrack_proto_sctp.c
+@@ -58,8 +58,8 @@ static const unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] = {
+ [SCTP_CONNTRACK_COOKIE_WAIT] = 3 SECS,
+ [SCTP_CONNTRACK_COOKIE_ECHOED] = 3 SECS,
+ [SCTP_CONNTRACK_ESTABLISHED] = 5 DAYS,
+- [SCTP_CONNTRACK_SHUTDOWN_SENT] = 300 SECS / 1000,
+- [SCTP_CONNTRACK_SHUTDOWN_RECD] = 300 SECS / 1000,
++ [SCTP_CONNTRACK_SHUTDOWN_SENT] = 3 SECS,
++ [SCTP_CONNTRACK_SHUTDOWN_RECD] = 3 SECS,
+ [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = 3 SECS,
+ [SCTP_CONNTRACK_HEARTBEAT_SENT] = 30 SECS,
+ [SCTP_CONNTRACK_HEARTBEAT_ACKED] = 210 SECS,
+@@ -119,7 +119,7 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = {
+ {
+ /* ORIGINAL */
+ /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */
+-/* init */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA},
++/* init */ {sCW, sCW, sCW, sCE, sES, sCL, sCL, sSA, sCW, sHA},
+ /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},
+ /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
+ /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL, sSS},
+diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
+index 84c59de278822..b3a0385290a15 100644
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -93,8 +93,6 @@ bool nf_queue_entry_get_refs(struct nf_queue_entry *entry)
+ dev_hold(state->in);
+ if (state->out)
+ dev_hold(state->out);
+- if (state->sk)
+- sock_hold(state->sk);
+ #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
+ if (entry->skb->nf_bridge) {
+ struct net_device *physdev;
+diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
+index 651c9784904cb..a4c6aba7da7ee 100644
+--- a/net/netfilter/nft_dynset.c
++++ b/net/netfilter/nft_dynset.c
+@@ -144,6 +144,9 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
+ if (IS_ERR(set))
+ return PTR_ERR(set);
+
++ if (set->flags & NFT_SET_OBJECT)
++ return -EOPNOTSUPP;
++
+ if (set->ops->update == NULL)
+ return -EOPNOTSUPP;
+
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 5a0e71873e24b..8105563593b6f 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1438,10 +1438,28 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
+ return 0;
+ }
+
++static bool req_create_or_replace(struct nlmsghdr *n)
++{
++ return (n->nlmsg_flags & NLM_F_CREATE &&
++ n->nlmsg_flags & NLM_F_REPLACE);
++}
++
++static bool req_create_exclusive(struct nlmsghdr *n)
++{
++ return (n->nlmsg_flags & NLM_F_CREATE &&
++ n->nlmsg_flags & NLM_F_EXCL);
++}
++
++static bool req_change(struct nlmsghdr *n)
++{
++ return (!(n->nlmsg_flags & NLM_F_CREATE) &&
++ !(n->nlmsg_flags & NLM_F_REPLACE) &&
++ !(n->nlmsg_flags & NLM_F_EXCL));
++}
++
+ /*
+ * Create/change qdisc.
+ */
+-
+ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
+ struct netlink_ext_ack *extack)
+ {
+@@ -1538,27 +1556,35 @@ replay:
+ *
+ * We know, that some child q is already
+ * attached to this parent and have choice:
+- * either to change it or to create/graft new one.
++ * 1) change it or 2) create/graft new one.
++ * If the requested qdisc kind is different
++ * than the existing one, then we choose graft.
++ * If they are the same then this is "change"
++ * operation - just let it fallthrough..
+ *
+ * 1. We are allowed to create/graft only
+- * if CREATE and REPLACE flags are set.
++ * if the request is explicitly stating
++ * "please create if it doesn't exist".
+ *
+- * 2. If EXCL is set, requestor wanted to say,
+- * that qdisc tcm_handle is not expected
++ * 2. If the request is to exclusive create
++ * then the qdisc tcm_handle is not expected
+ * to exist, so that we choose create/graft too.
+ *
+ * 3. The last case is when no flags are set.
++ * This will happen when for example tc
++ * utility issues a "change" command.
+ * Alas, it is sort of hole in API, we
+ * cannot decide what to do unambiguously.
+- * For now we select create/graft, if
+- * user gave KIND, which does not match existing.
++ * For now we select create/graft.
+ */
+- if ((n->nlmsg_flags & NLM_F_CREATE) &&
+- (n->nlmsg_flags & NLM_F_REPLACE) &&
+- ((n->nlmsg_flags & NLM_F_EXCL) ||
+- (tca[TCA_KIND] &&
+- nla_strcmp(tca[TCA_KIND], q->ops->id))))
+- goto create_n_graft;
++ if (tca[TCA_KIND] &&
++ nla_strcmp(tca[TCA_KIND], q->ops->id)) {
++ if (req_create_or_replace(n) ||
++ req_create_exclusive(n))
++ goto create_n_graft;
++ else if (req_change(n))
++ goto create_n_graft2;
++ }
+ }
+ }
+ } else {
+@@ -1592,6 +1618,7 @@ create_n_graft:
+ NL_SET_ERR_MSG(extack, "Qdisc not found. To create specify NLM_F_CREATE flag");
+ return -ENOENT;
+ }
++create_n_graft2:
+ if (clid == TC_H_INGRESS) {
+ if (dev_ingress_queue(dev)) {
+ q = qdisc_create(dev, dev_ingress_queue(dev), p,
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index baa825751c393..432dccd375064 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -112,7 +112,7 @@ struct percpu_counter sctp_sockets_allocated;
+
+ static void sctp_enter_memory_pressure(struct sock *sk)
+ {
+- sctp_memory_pressure = 1;
++ WRITE_ONCE(sctp_memory_pressure, 1);
+ }
+
+
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 8971341c4f8af..402060cf3198c 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1984,6 +1984,7 @@ static ssize_t unix_stream_sendpage(struct socket *socket, struct page *page,
+
+ if (false) {
+ alloc_skb:
++ spin_unlock(&other->sk_receive_queue.lock);
+ unix_state_unlock(other);
+ mutex_unlock(&unix_sk(other)->iolock);
+ newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
+@@ -2023,6 +2024,7 @@ alloc_skb:
+ init_scm = false;
+ }
+
++ spin_lock(&other->sk_receive_queue.lock);
+ skb = skb_peek_tail(&other->sk_receive_queue);
+ if (tail && tail == skb) {
+ skb = newskb;
+@@ -2053,14 +2055,11 @@ alloc_skb:
+ refcount_add(size, &sk->sk_wmem_alloc);
+
+ if (newskb) {
+- err = unix_scm_to_skb(&scm, skb, false);
+- if (err)
+- goto err_state_unlock;
+- spin_lock(&other->sk_receive_queue.lock);
++ unix_scm_to_skb(&scm, skb, false);
+ __skb_queue_tail(&other->sk_receive_queue, newskb);
+- spin_unlock(&other->sk_receive_queue.lock);
+ }
+
++ spin_unlock(&other->sk_receive_queue.lock);
+ unix_state_unlock(other);
+ mutex_unlock(&unix_sk(other)->iolock);
+
+diff --git a/net/xfrm/Makefile b/net/xfrm/Makefile
+index fbc4552d17b85..6e5e307f985e4 100644
+--- a/net/xfrm/Makefile
++++ b/net/xfrm/Makefile
+@@ -3,6 +3,8 @@
+ # Makefile for the XFRM subsystem.
+ #
+
++xfrm_interface-$(CONFIG_XFRM_INTERFACE) += xfrm_interface_core.o
++
+ obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_hash.o \
+ xfrm_input.o xfrm_output.o \
+ xfrm_sysctl.o xfrm_replay.o xfrm_device.o
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+deleted file mode 100644
+index 3c642328a117c..0000000000000
+--- a/net/xfrm/xfrm_interface.c
++++ /dev/null
+@@ -1,996 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * XFRM virtual interface
+- *
+- * Copyright (C) 2018 secunet Security Networks AG
+- *
+- * Author:
+- * Steffen Klassert <steffen.klassert@secunet.com>
+- */
+-
+-#include <linux/module.h>
+-#include <linux/capability.h>
+-#include <linux/errno.h>
+-#include <linux/types.h>
+-#include <linux/sockios.h>
+-#include <linux/icmp.h>
+-#include <linux/if.h>
+-#include <linux/in.h>
+-#include <linux/ip.h>
+-#include <linux/net.h>
+-#include <linux/in6.h>
+-#include <linux/netdevice.h>
+-#include <linux/if_link.h>
+-#include <linux/if_arp.h>
+-#include <linux/icmpv6.h>
+-#include <linux/init.h>
+-#include <linux/route.h>
+-#include <linux/rtnetlink.h>
+-#include <linux/netfilter_ipv6.h>
+-#include <linux/slab.h>
+-#include <linux/hash.h>
+-
+-#include <linux/uaccess.h>
+-#include <linux/atomic.h>
+-
+-#include <net/icmp.h>
+-#include <net/ip.h>
+-#include <net/ipv6.h>
+-#include <net/ip6_route.h>
+-#include <net/addrconf.h>
+-#include <net/xfrm.h>
+-#include <net/net_namespace.h>
+-#include <net/netns/generic.h>
+-#include <linux/etherdevice.h>
+-
+-static int xfrmi_dev_init(struct net_device *dev);
+-static void xfrmi_dev_setup(struct net_device *dev);
+-static struct rtnl_link_ops xfrmi_link_ops __read_mostly;
+-static unsigned int xfrmi_net_id __read_mostly;
+-
+-struct xfrmi_net {
+- /* lists for storing interfaces in use */
+- struct xfrm_if __rcu *xfrmi[1];
+-};
+-
+-#define for_each_xfrmi_rcu(start, xi) \
+- for (xi = rcu_dereference(start); xi; xi = rcu_dereference(xi->next))
+-
+-static struct xfrm_if *xfrmi_lookup(struct net *net, struct xfrm_state *x)
+-{
+- struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
+- struct xfrm_if *xi;
+-
+- for_each_xfrmi_rcu(xfrmn->xfrmi[0], xi) {
+- if (x->if_id == xi->p.if_id &&
+- (xi->dev->flags & IFF_UP))
+- return xi;
+- }
+-
+- return NULL;
+-}
+-
+-static struct xfrm_if *xfrmi_decode_session(struct sk_buff *skb,
+- unsigned short family)
+-{
+- struct xfrmi_net *xfrmn;
+- struct xfrm_if *xi;
+- int ifindex = 0;
+-
+- if (!secpath_exists(skb) || !skb->dev)
+- return NULL;
+-
+- switch (family) {
+- case AF_INET6:
+- ifindex = inet6_sdif(skb);
+- break;
+- case AF_INET:
+- ifindex = inet_sdif(skb);
+- break;
+- }
+- if (!ifindex)
+- ifindex = skb->dev->ifindex;
+-
+- xfrmn = net_generic(xs_net(xfrm_input_state(skb)), xfrmi_net_id);
+-
+- for_each_xfrmi_rcu(xfrmn->xfrmi[0], xi) {
+- if (ifindex == xi->dev->ifindex &&
+- (xi->dev->flags & IFF_UP))
+- return xi;
+- }
+-
+- return NULL;
+-}
+-
+-static void xfrmi_link(struct xfrmi_net *xfrmn, struct xfrm_if *xi)
+-{
+- struct xfrm_if __rcu **xip = &xfrmn->xfrmi[0];
+-
+- rcu_assign_pointer(xi->next , rtnl_dereference(*xip));
+- rcu_assign_pointer(*xip, xi);
+-}
+-
+-static void xfrmi_unlink(struct xfrmi_net *xfrmn, struct xfrm_if *xi)
+-{
+- struct xfrm_if __rcu **xip;
+- struct xfrm_if *iter;
+-
+- for (xip = &xfrmn->xfrmi[0];
+- (iter = rtnl_dereference(*xip)) != NULL;
+- xip = &iter->next) {
+- if (xi == iter) {
+- rcu_assign_pointer(*xip, xi->next);
+- break;
+- }
+- }
+-}
+-
+-static void xfrmi_dev_free(struct net_device *dev)
+-{
+- struct xfrm_if *xi = netdev_priv(dev);
+-
+- gro_cells_destroy(&xi->gro_cells);
+- free_percpu(dev->tstats);
+-}
+-
+-static int xfrmi_create(struct net_device *dev)
+-{
+- struct xfrm_if *xi = netdev_priv(dev);
+- struct net *net = dev_net(dev);
+- struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
+- int err;
+-
+- dev->rtnl_link_ops = &xfrmi_link_ops;
+- err = register_netdevice(dev);
+- if (err < 0)
+- goto out;
+-
+- dev_hold(dev);
+- xfrmi_link(xfrmn, xi);
+-
+- return 0;
+-
+-out:
+- return err;
+-}
+-
+-static struct xfrm_if *xfrmi_locate(struct net *net, struct xfrm_if_parms *p)
+-{
+- struct xfrm_if __rcu **xip;
+- struct xfrm_if *xi;
+- struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
+-
+- for (xip = &xfrmn->xfrmi[0];
+- (xi = rtnl_dereference(*xip)) != NULL;
+- xip = &xi->next)
+- if (xi->p.if_id == p->if_id)
+- return xi;
+-
+- return NULL;
+-}
+-
+-static void xfrmi_dev_uninit(struct net_device *dev)
+-{
+- struct xfrm_if *xi = netdev_priv(dev);
+- struct xfrmi_net *xfrmn = net_generic(xi->net, xfrmi_net_id);
+-
+- xfrmi_unlink(xfrmn, xi);
+- dev_put(dev);
+-}
+-
+-static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet)
+-{
+- skb->tstamp = 0;
+- skb->pkt_type = PACKET_HOST;
+- skb->skb_iif = 0;
+- skb->ignore_df = 0;
+- skb_dst_drop(skb);
+- nf_reset(skb);
+- nf_reset_trace(skb);
+-
+- if (!xnet)
+- return;
+-
+- ipvs_reset(skb);
+- secpath_reset(skb);
+- skb_orphan(skb);
+- skb->mark = 0;
+-}
+-
+-static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
+-{
+- struct pcpu_sw_netstats *tstats;
+- struct xfrm_mode *inner_mode;
+- struct net_device *dev;
+- struct xfrm_state *x;
+- struct xfrm_if *xi;
+- bool xnet;
+-
+- if (err && !skb->sp)
+- return 0;
+-
+- x = xfrm_input_state(skb);
+-
+- xi = xfrmi_lookup(xs_net(x), x);
+- if (!xi)
+- return 1;
+-
+- dev = xi->dev;
+- skb->dev = dev;
+-
+- if (err) {
+- dev->stats.rx_errors++;
+- dev->stats.rx_dropped++;
+-
+- return 0;
+- }
+-
+- xnet = !net_eq(xi->net, dev_net(skb->dev));
+-
+- if (xnet) {
+- inner_mode = x->inner_mode;
+-
+- if (x->sel.family == AF_UNSPEC) {
+- inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
+- if (inner_mode == NULL) {
+- XFRM_INC_STATS(dev_net(skb->dev),
+- LINUX_MIB_XFRMINSTATEMODEERROR);
+- return -EINVAL;
+- }
+- }
+-
+- if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb,
+- inner_mode->afinfo->family))
+- return -EPERM;
+- }
+-
+- xfrmi_scrub_packet(skb, xnet);
+-
+- tstats = this_cpu_ptr(dev->tstats);
+-
+- u64_stats_update_begin(&tstats->syncp);
+- tstats->rx_packets++;
+- tstats->rx_bytes += skb->len;
+- u64_stats_update_end(&tstats->syncp);
+-
+- return 0;
+-}
+-
+-static int
+-xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+-{
+- struct xfrm_if *xi = netdev_priv(dev);
+- struct net_device_stats *stats = &xi->dev->stats;
+- struct dst_entry *dst = skb_dst(skb);
+- unsigned int length = skb->len;
+- struct net_device *tdev;
+- struct xfrm_state *x;
+- int err = -1;
+- int mtu;
+-
+- dst_hold(dst);
+- dst = xfrm_lookup_with_ifid(xi->net, dst, fl, NULL, 0, xi->p.if_id);
+- if (IS_ERR(dst)) {
+- err = PTR_ERR(dst);
+- dst = NULL;
+- goto tx_err_link_failure;
+- }
+-
+- x = dst->xfrm;
+- if (!x)
+- goto tx_err_link_failure;
+-
+- if (x->if_id != xi->p.if_id)
+- goto tx_err_link_failure;
+-
+- tdev = dst->dev;
+-
+- if (tdev == dev) {
+- stats->collisions++;
+- net_warn_ratelimited("%s: Local routing loop detected!\n",
+- dev->name);
+- goto tx_err_dst_release;
+- }
+-
+- mtu = dst_mtu(dst);
+- if (skb->len > mtu) {
+- skb_dst_update_pmtu_no_confirm(skb, mtu);
+-
+- if (skb->protocol == htons(ETH_P_IPV6)) {
+- if (mtu < IPV6_MIN_MTU)
+- mtu = IPV6_MIN_MTU;
+-
+- if (skb->len > 1280)
+- icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+- else
+- goto xmit;
+- } else {
+- if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
+- goto xmit;
+- icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+- htonl(mtu));
+- }
+-
+- dst_release(dst);
+- return -EMSGSIZE;
+- }
+-
+-xmit:
+- xfrmi_scrub_packet(skb, !net_eq(xi->net, dev_net(dev)));
+- skb_dst_set(skb, dst);
+- skb->dev = tdev;
+-
+- err = dst_output(xi->net, skb->sk, skb);
+- if (net_xmit_eval(err) == 0) {
+- struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
+-
+- u64_stats_update_begin(&tstats->syncp);
+- tstats->tx_bytes += length;
+- tstats->tx_packets++;
+- u64_stats_update_end(&tstats->syncp);
+- } else {
+- stats->tx_errors++;
+- stats->tx_aborted_errors++;
+- }
+-
+- return 0;
+-tx_err_link_failure:
+- stats->tx_carrier_errors++;
+- dst_link_failure(skb);
+-tx_err_dst_release:
+- dst_release(dst);
+- return err;
+-}
+-
+-static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
+-{
+- struct xfrm_if *xi = netdev_priv(dev);
+- struct net_device_stats *stats = &xi->dev->stats;
+- struct dst_entry *dst = skb_dst(skb);
+- struct flowi fl;
+- int ret;
+-
+- memset(&fl, 0, sizeof(fl));
+-
+- switch (skb->protocol) {
+- case htons(ETH_P_IPV6):
+- xfrm_decode_session(skb, &fl, AF_INET6);
+- memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+- if (!dst) {
+- fl.u.ip6.flowi6_oif = dev->ifindex;
+- fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
+- dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
+- if (dst->error) {
+- dst_release(dst);
+- stats->tx_carrier_errors++;
+- goto tx_err;
+- }
+- skb_dst_set(skb, dst);
+- }
+- break;
+- case htons(ETH_P_IP):
+- xfrm_decode_session(skb, &fl, AF_INET);
+- memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+- if (!dst) {
+- struct rtable *rt;
+-
+- fl.u.ip4.flowi4_oif = dev->ifindex;
+- fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
+- rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
+- if (IS_ERR(rt)) {
+- stats->tx_carrier_errors++;
+- goto tx_err;
+- }
+- skb_dst_set(skb, &rt->dst);
+- }
+- break;
+- default:
+- goto tx_err;
+- }
+-
+- fl.flowi_oif = xi->p.link;
+-
+- ret = xfrmi_xmit2(skb, dev, &fl);
+- if (ret < 0)
+- goto tx_err;
+-
+- return NETDEV_TX_OK;
+-
+-tx_err:
+- stats->tx_errors++;
+- stats->tx_dropped++;
+- kfree_skb(skb);
+- return NETDEV_TX_OK;
+-}
+-
+-static int xfrmi4_err(struct sk_buff *skb, u32 info)
+-{
+- const struct iphdr *iph = (const struct iphdr *)skb->data;
+- struct net *net = dev_net(skb->dev);
+- int protocol = iph->protocol;
+- struct ip_comp_hdr *ipch;
+- struct ip_esp_hdr *esph;
+- struct ip_auth_hdr *ah ;
+- struct xfrm_state *x;
+- struct xfrm_if *xi;
+- __be32 spi;
+-
+- switch (protocol) {
+- case IPPROTO_ESP:
+- esph = (struct ip_esp_hdr *)(skb->data+(iph->ihl<<2));
+- spi = esph->spi;
+- break;
+- case IPPROTO_AH:
+- ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2));
+- spi = ah->spi;
+- break;
+- case IPPROTO_COMP:
+- ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
+- spi = htonl(ntohs(ipch->cpi));
+- break;
+- default:
+- return 0;
+- }
+-
+- switch (icmp_hdr(skb)->type) {
+- case ICMP_DEST_UNREACH:
+- if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
+- return 0;
+- case ICMP_REDIRECT:
+- break;
+- default:
+- return 0;
+- }
+-
+- x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
+- spi, protocol, AF_INET);
+- if (!x)
+- return 0;
+-
+- xi = xfrmi_lookup(net, x);
+- if (!xi) {
+- xfrm_state_put(x);
+- return -1;
+- }
+-
+- if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
+- ipv4_update_pmtu(skb, net, info, 0, 0, protocol, 0);
+- else
+- ipv4_redirect(skb, net, 0, 0, protocol, 0);
+- xfrm_state_put(x);
+-
+- return 0;
+-}
+-
+-static int xfrmi6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+- u8 type, u8 code, int offset, __be32 info)
+-{
+- const struct ipv6hdr *iph = (const struct ipv6hdr *)skb->data;
+- struct net *net = dev_net(skb->dev);
+- int protocol = iph->nexthdr;
+- struct ip_comp_hdr *ipch;
+- struct ip_esp_hdr *esph;
+- struct ip_auth_hdr *ah;
+- struct xfrm_state *x;
+- struct xfrm_if *xi;
+- __be32 spi;
+-
+- switch (protocol) {
+- case IPPROTO_ESP:
+- esph = (struct ip_esp_hdr *)(skb->data + offset);
+- spi = esph->spi;
+- break;
+- case IPPROTO_AH:
+- ah = (struct ip_auth_hdr *)(skb->data + offset);
+- spi = ah->spi;
+- break;
+- case IPPROTO_COMP:
+- ipch = (struct ip_comp_hdr *)(skb->data + offset);
+- spi = htonl(ntohs(ipch->cpi));
+- break;
+- default:
+- return 0;
+- }
+-
+- if (type != ICMPV6_PKT_TOOBIG &&
+- type != NDISC_REDIRECT)
+- return 0;
+-
+- x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
+- spi, protocol, AF_INET6);
+- if (!x)
+- return 0;
+-
+- xi = xfrmi_lookup(net, x);
+- if (!xi) {
+- xfrm_state_put(x);
+- return -1;
+- }
+-
+- if (type == NDISC_REDIRECT)
+- ip6_redirect(skb, net, skb->dev->ifindex, 0,
+- sock_net_uid(net, NULL));
+- else
+- ip6_update_pmtu(skb, net, info, 0, 0, sock_net_uid(net, NULL));
+- xfrm_state_put(x);
+-
+- return 0;
+-}
+-
+-static int xfrmi_change(struct xfrm_if *xi, const struct xfrm_if_parms *p)
+-{
+- if (xi->p.link != p->link)
+- return -EINVAL;
+-
+- xi->p.if_id = p->if_id;
+-
+- return 0;
+-}
+-
+-static int xfrmi_update(struct xfrm_if *xi, struct xfrm_if_parms *p)
+-{
+- struct net *net = xi->net;
+- struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
+- int err;
+-
+- xfrmi_unlink(xfrmn, xi);
+- synchronize_net();
+- err = xfrmi_change(xi, p);
+- xfrmi_link(xfrmn, xi);
+- netdev_state_change(xi->dev);
+- return err;
+-}
+-
+-static void xfrmi_get_stats64(struct net_device *dev,
+- struct rtnl_link_stats64 *s)
+-{
+- int cpu;
+-
+- if (!dev->tstats)
+- return;
+-
+- for_each_possible_cpu(cpu) {
+- struct pcpu_sw_netstats *stats;
+- struct pcpu_sw_netstats tmp;
+- int start;
+-
+- stats = per_cpu_ptr(dev->tstats, cpu);
+- do {
+- start = u64_stats_fetch_begin_irq(&stats->syncp);
+- tmp.rx_packets = stats->rx_packets;
+- tmp.rx_bytes = stats->rx_bytes;
+- tmp.tx_packets = stats->tx_packets;
+- tmp.tx_bytes = stats->tx_bytes;
+- } while (u64_stats_fetch_retry_irq(&stats->syncp, start));
+-
+- s->rx_packets += tmp.rx_packets;
+- s->rx_bytes += tmp.rx_bytes;
+- s->tx_packets += tmp.tx_packets;
+- s->tx_bytes += tmp.tx_bytes;
+- }
+-
+- s->rx_dropped = dev->stats.rx_dropped;
+- s->tx_dropped = dev->stats.tx_dropped;
+-}
+-
+-static int xfrmi_get_iflink(const struct net_device *dev)
+-{
+- struct xfrm_if *xi = netdev_priv(dev);
+-
+- return xi->p.link;
+-}
+-
+-
+-static const struct net_device_ops xfrmi_netdev_ops = {
+- .ndo_init = xfrmi_dev_init,
+- .ndo_uninit = xfrmi_dev_uninit,
+- .ndo_start_xmit = xfrmi_xmit,
+- .ndo_get_stats64 = xfrmi_get_stats64,
+- .ndo_get_iflink = xfrmi_get_iflink,
+-};
+-
+-static void xfrmi_dev_setup(struct net_device *dev)
+-{
+- dev->netdev_ops = &xfrmi_netdev_ops;
+- dev->type = ARPHRD_NONE;
+- dev->mtu = ETH_DATA_LEN;
+- dev->min_mtu = ETH_MIN_MTU;
+- dev->max_mtu = IP_MAX_MTU;
+- dev->flags = IFF_NOARP;
+- dev->needs_free_netdev = true;
+- dev->priv_destructor = xfrmi_dev_free;
+- netif_keep_dst(dev);
+-
+- eth_broadcast_addr(dev->broadcast);
+-}
+-
+-static int xfrmi_dev_init(struct net_device *dev)
+-{
+- struct xfrm_if *xi = netdev_priv(dev);
+- struct net_device *phydev = __dev_get_by_index(xi->net, xi->p.link);
+- int err;
+-
+- dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+- if (!dev->tstats)
+- return -ENOMEM;
+-
+- err = gro_cells_init(&xi->gro_cells, dev);
+- if (err) {
+- free_percpu(dev->tstats);
+- return err;
+- }
+-
+- dev->features |= NETIF_F_LLTX;
+-
+- if (phydev) {
+- dev->needed_headroom = phydev->needed_headroom;
+- dev->needed_tailroom = phydev->needed_tailroom;
+-
+- if (is_zero_ether_addr(dev->dev_addr))
+- eth_hw_addr_inherit(dev, phydev);
+- if (is_zero_ether_addr(dev->broadcast))
+- memcpy(dev->broadcast, phydev->broadcast,
+- dev->addr_len);
+- } else {
+- eth_hw_addr_random(dev);
+- eth_broadcast_addr(dev->broadcast);
+- }
+-
+- return 0;
+-}
+-
+-static int xfrmi_validate(struct nlattr *tb[], struct nlattr *data[],
+- struct netlink_ext_ack *extack)
+-{
+- return 0;
+-}
+-
+-static void xfrmi_netlink_parms(struct nlattr *data[],
+- struct xfrm_if_parms *parms)
+-{
+- memset(parms, 0, sizeof(*parms));
+-
+- if (!data)
+- return;
+-
+- if (data[IFLA_XFRM_LINK])
+- parms->link = nla_get_u32(data[IFLA_XFRM_LINK]);
+-
+- if (data[IFLA_XFRM_IF_ID])
+- parms->if_id = nla_get_u32(data[IFLA_XFRM_IF_ID]);
+-}
+-
+-static int xfrmi_newlink(struct net *src_net, struct net_device *dev,
+- struct nlattr *tb[], struct nlattr *data[],
+- struct netlink_ext_ack *extack)
+-{
+- struct net *net = dev_net(dev);
+- struct xfrm_if_parms p = {};
+- struct xfrm_if *xi;
+- int err;
+-
+- xfrmi_netlink_parms(data, &p);
+- if (!p.if_id) {
+- NL_SET_ERR_MSG(extack, "if_id must be non zero");
+- return -EINVAL;
+- }
+-
+- xi = xfrmi_locate(net, &p);
+- if (xi)
+- return -EEXIST;
+-
+- xi = netdev_priv(dev);
+- xi->p = p;
+- xi->net = net;
+- xi->dev = dev;
+-
+- err = xfrmi_create(dev);
+- return err;
+-}
+-
+-static void xfrmi_dellink(struct net_device *dev, struct list_head *head)
+-{
+- unregister_netdevice_queue(dev, head);
+-}
+-
+-static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[],
+- struct nlattr *data[],
+- struct netlink_ext_ack *extack)
+-{
+- struct xfrm_if *xi = netdev_priv(dev);
+- struct net *net = xi->net;
+- struct xfrm_if_parms p = {};
+-
+- xfrmi_netlink_parms(data, &p);
+- if (!p.if_id) {
+- NL_SET_ERR_MSG(extack, "if_id must be non zero");
+- return -EINVAL;
+- }
+-
+- xi = xfrmi_locate(net, &p);
+- if (!xi) {
+- xi = netdev_priv(dev);
+- } else {
+- if (xi->dev != dev)
+- return -EEXIST;
+- }
+-
+- return xfrmi_update(xi, &p);
+-}
+-
+-static size_t xfrmi_get_size(const struct net_device *dev)
+-{
+- return
+- /* IFLA_XFRM_LINK */
+- nla_total_size(4) +
+- /* IFLA_XFRM_IF_ID */
+- nla_total_size(4) +
+- 0;
+-}
+-
+-static int xfrmi_fill_info(struct sk_buff *skb, const struct net_device *dev)
+-{
+- struct xfrm_if *xi = netdev_priv(dev);
+- struct xfrm_if_parms *parm = &xi->p;
+-
+- if (nla_put_u32(skb, IFLA_XFRM_LINK, parm->link) ||
+- nla_put_u32(skb, IFLA_XFRM_IF_ID, parm->if_id))
+- goto nla_put_failure;
+- return 0;
+-
+-nla_put_failure:
+- return -EMSGSIZE;
+-}
+-
+-struct net *xfrmi_get_link_net(const struct net_device *dev)
+-{
+- struct xfrm_if *xi = netdev_priv(dev);
+-
+- return xi->net;
+-}
+-
+-static const struct nla_policy xfrmi_policy[IFLA_XFRM_MAX + 1] = {
+- [IFLA_XFRM_LINK] = { .type = NLA_U32 },
+- [IFLA_XFRM_IF_ID] = { .type = NLA_U32 },
+-};
+-
+-static struct rtnl_link_ops xfrmi_link_ops __read_mostly = {
+- .kind = "xfrm",
+- .maxtype = IFLA_XFRM_MAX,
+- .policy = xfrmi_policy,
+- .priv_size = sizeof(struct xfrm_if),
+- .setup = xfrmi_dev_setup,
+- .validate = xfrmi_validate,
+- .newlink = xfrmi_newlink,
+- .dellink = xfrmi_dellink,
+- .changelink = xfrmi_changelink,
+- .get_size = xfrmi_get_size,
+- .fill_info = xfrmi_fill_info,
+- .get_link_net = xfrmi_get_link_net,
+-};
+-
+-static void __net_exit xfrmi_destroy_interfaces(struct xfrmi_net *xfrmn)
+-{
+- struct xfrm_if *xi;
+- LIST_HEAD(list);
+-
+- xi = rtnl_dereference(xfrmn->xfrmi[0]);
+- if (!xi)
+- return;
+-
+- unregister_netdevice_queue(xi->dev, &list);
+- unregister_netdevice_many(&list);
+-}
+-
+-static int __net_init xfrmi_init_net(struct net *net)
+-{
+- return 0;
+-}
+-
+-static void __net_exit xfrmi_exit_net(struct net *net)
+-{
+- struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
+-
+- rtnl_lock();
+- xfrmi_destroy_interfaces(xfrmn);
+- rtnl_unlock();
+-}
+-
+-static void __net_exit xfrmi_exit_batch_net(struct list_head *net_exit_list)
+-{
+- struct net *net;
+- LIST_HEAD(list);
+-
+- rtnl_lock();
+- list_for_each_entry(net, net_exit_list, exit_list) {
+- struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
+- struct xfrm_if __rcu **xip;
+- struct xfrm_if *xi;
+-
+- for (xip = &xfrmn->xfrmi[0];
+- (xi = rtnl_dereference(*xip)) != NULL;
+- xip = &xi->next)
+- unregister_netdevice_queue(xi->dev, &list);
+- }
+- unregister_netdevice_many(&list);
+- rtnl_unlock();
+-}
+-
+-static struct pernet_operations xfrmi_net_ops = {
+- .exit_batch = xfrmi_exit_batch_net,
+- .init = xfrmi_init_net,
+- .exit = xfrmi_exit_net,
+- .id = &xfrmi_net_id,
+- .size = sizeof(struct xfrmi_net),
+-};
+-
+-static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = {
+- .handler = xfrm6_rcv,
+- .cb_handler = xfrmi_rcv_cb,
+- .err_handler = xfrmi6_err,
+- .priority = 10,
+-};
+-
+-static struct xfrm6_protocol xfrmi_ah6_protocol __read_mostly = {
+- .handler = xfrm6_rcv,
+- .cb_handler = xfrmi_rcv_cb,
+- .err_handler = xfrmi6_err,
+- .priority = 10,
+-};
+-
+-static struct xfrm6_protocol xfrmi_ipcomp6_protocol __read_mostly = {
+- .handler = xfrm6_rcv,
+- .cb_handler = xfrmi_rcv_cb,
+- .err_handler = xfrmi6_err,
+- .priority = 10,
+-};
+-
+-static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = {
+- .handler = xfrm4_rcv,
+- .input_handler = xfrm_input,
+- .cb_handler = xfrmi_rcv_cb,
+- .err_handler = xfrmi4_err,
+- .priority = 10,
+-};
+-
+-static struct xfrm4_protocol xfrmi_ah4_protocol __read_mostly = {
+- .handler = xfrm4_rcv,
+- .input_handler = xfrm_input,
+- .cb_handler = xfrmi_rcv_cb,
+- .err_handler = xfrmi4_err,
+- .priority = 10,
+-};
+-
+-static struct xfrm4_protocol xfrmi_ipcomp4_protocol __read_mostly = {
+- .handler = xfrm4_rcv,
+- .input_handler = xfrm_input,
+- .cb_handler = xfrmi_rcv_cb,
+- .err_handler = xfrmi4_err,
+- .priority = 10,
+-};
+-
+-static int __init xfrmi4_init(void)
+-{
+- int err;
+-
+- err = xfrm4_protocol_register(&xfrmi_esp4_protocol, IPPROTO_ESP);
+- if (err < 0)
+- goto xfrm_proto_esp_failed;
+- err = xfrm4_protocol_register(&xfrmi_ah4_protocol, IPPROTO_AH);
+- if (err < 0)
+- goto xfrm_proto_ah_failed;
+- err = xfrm4_protocol_register(&xfrmi_ipcomp4_protocol, IPPROTO_COMP);
+- if (err < 0)
+- goto xfrm_proto_comp_failed;
+-
+- return 0;
+-
+-xfrm_proto_comp_failed:
+- xfrm4_protocol_deregister(&xfrmi_ah4_protocol, IPPROTO_AH);
+-xfrm_proto_ah_failed:
+- xfrm4_protocol_deregister(&xfrmi_esp4_protocol, IPPROTO_ESP);
+-xfrm_proto_esp_failed:
+- return err;
+-}
+-
+-static void xfrmi4_fini(void)
+-{
+- xfrm4_protocol_deregister(&xfrmi_ipcomp4_protocol, IPPROTO_COMP);
+- xfrm4_protocol_deregister(&xfrmi_ah4_protocol, IPPROTO_AH);
+- xfrm4_protocol_deregister(&xfrmi_esp4_protocol, IPPROTO_ESP);
+-}
+-
+-static int __init xfrmi6_init(void)
+-{
+- int err;
+-
+- err = xfrm6_protocol_register(&xfrmi_esp6_protocol, IPPROTO_ESP);
+- if (err < 0)
+- goto xfrm_proto_esp_failed;
+- err = xfrm6_protocol_register(&xfrmi_ah6_protocol, IPPROTO_AH);
+- if (err < 0)
+- goto xfrm_proto_ah_failed;
+- err = xfrm6_protocol_register(&xfrmi_ipcomp6_protocol, IPPROTO_COMP);
+- if (err < 0)
+- goto xfrm_proto_comp_failed;
+-
+- return 0;
+-
+-xfrm_proto_comp_failed:
+- xfrm6_protocol_deregister(&xfrmi_ah6_protocol, IPPROTO_AH);
+-xfrm_proto_ah_failed:
+- xfrm6_protocol_deregister(&xfrmi_esp6_protocol, IPPROTO_ESP);
+-xfrm_proto_esp_failed:
+- return err;
+-}
+-
+-static void xfrmi6_fini(void)
+-{
+- xfrm6_protocol_deregister(&xfrmi_ipcomp6_protocol, IPPROTO_COMP);
+- xfrm6_protocol_deregister(&xfrmi_ah6_protocol, IPPROTO_AH);
+- xfrm6_protocol_deregister(&xfrmi_esp6_protocol, IPPROTO_ESP);
+-}
+-
+-static const struct xfrm_if_cb xfrm_if_cb = {
+- .decode_session = xfrmi_decode_session,
+-};
+-
+-static int __init xfrmi_init(void)
+-{
+- const char *msg;
+- int err;
+-
+- pr_info("IPsec XFRM device driver\n");
+-
+- msg = "tunnel device";
+- err = register_pernet_device(&xfrmi_net_ops);
+- if (err < 0)
+- goto pernet_dev_failed;
+-
+- msg = "xfrm4 protocols";
+- err = xfrmi4_init();
+- if (err < 0)
+- goto xfrmi4_failed;
+-
+- msg = "xfrm6 protocols";
+- err = xfrmi6_init();
+- if (err < 0)
+- goto xfrmi6_failed;
+-
+-
+- msg = "netlink interface";
+- err = rtnl_link_register(&xfrmi_link_ops);
+- if (err < 0)
+- goto rtnl_link_failed;
+-
+- xfrm_if_register_cb(&xfrm_if_cb);
+-
+- return err;
+-
+-rtnl_link_failed:
+- xfrmi6_fini();
+-xfrmi6_failed:
+- xfrmi4_fini();
+-xfrmi4_failed:
+- unregister_pernet_device(&xfrmi_net_ops);
+-pernet_dev_failed:
+- pr_err("xfrmi init: failed to register %s\n", msg);
+- return err;
+-}
+-
+-static void __exit xfrmi_fini(void)
+-{
+- xfrm_if_unregister_cb();
+- rtnl_link_unregister(&xfrmi_link_ops);
+- xfrmi4_fini();
+- xfrmi6_fini();
+- unregister_pernet_device(&xfrmi_net_ops);
+-}
+-
+-module_init(xfrmi_init);
+-module_exit(xfrmi_fini);
+-MODULE_LICENSE("GPL");
+-MODULE_ALIAS_RTNL_LINK("xfrm");
+-MODULE_ALIAS_NETDEV("xfrm0");
+-MODULE_AUTHOR("Steffen Klassert");
+-MODULE_DESCRIPTION("XFRM virtual interface");
+diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c
+new file mode 100644
+index 0000000000000..40081af62b68f
+--- /dev/null
++++ b/net/xfrm/xfrm_interface_core.c
+@@ -0,0 +1,996 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * XFRM virtual interface
++ *
++ * Copyright (C) 2018 secunet Security Networks AG
++ *
++ * Author:
++ * Steffen Klassert <steffen.klassert@secunet.com>
++ */
++
++#include <linux/module.h>
++#include <linux/capability.h>
++#include <linux/errno.h>
++#include <linux/types.h>
++#include <linux/sockios.h>
++#include <linux/icmp.h>
++#include <linux/if.h>
++#include <linux/in.h>
++#include <linux/ip.h>
++#include <linux/net.h>
++#include <linux/in6.h>
++#include <linux/netdevice.h>
++#include <linux/if_link.h>
++#include <linux/if_arp.h>
++#include <linux/icmpv6.h>
++#include <linux/init.h>
++#include <linux/route.h>
++#include <linux/rtnetlink.h>
++#include <linux/netfilter_ipv6.h>
++#include <linux/slab.h>
++#include <linux/hash.h>
++
++#include <linux/uaccess.h>
++#include <linux/atomic.h>
++
++#include <net/icmp.h>
++#include <net/ip.h>
++#include <net/ipv6.h>
++#include <net/ip6_route.h>
++#include <net/addrconf.h>
++#include <net/xfrm.h>
++#include <net/net_namespace.h>
++#include <net/netns/generic.h>
++#include <linux/etherdevice.h>
++
++static int xfrmi_dev_init(struct net_device *dev);
++static void xfrmi_dev_setup(struct net_device *dev);
++static struct rtnl_link_ops xfrmi_link_ops __read_mostly;
++static unsigned int xfrmi_net_id __read_mostly;
++
++struct xfrmi_net {
++ /* lists for storing interfaces in use */
++ struct xfrm_if __rcu *xfrmi[1];
++};
++
++#define for_each_xfrmi_rcu(start, xi) \
++ for (xi = rcu_dereference(start); xi; xi = rcu_dereference(xi->next))
++
++static struct xfrm_if *xfrmi_lookup(struct net *net, struct xfrm_state *x)
++{
++ struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
++ struct xfrm_if *xi;
++
++ for_each_xfrmi_rcu(xfrmn->xfrmi[0], xi) {
++ if (x->if_id == xi->p.if_id &&
++ (xi->dev->flags & IFF_UP))
++ return xi;
++ }
++
++ return NULL;
++}
++
++static struct xfrm_if *xfrmi_decode_session(struct sk_buff *skb,
++ unsigned short family)
++{
++ struct xfrmi_net *xfrmn;
++ struct xfrm_if *xi;
++ int ifindex = 0;
++
++ if (!secpath_exists(skb) || !skb->dev)
++ return NULL;
++
++ switch (family) {
++ case AF_INET6:
++ ifindex = inet6_sdif(skb);
++ break;
++ case AF_INET:
++ ifindex = inet_sdif(skb);
++ break;
++ }
++ if (!ifindex)
++ ifindex = skb->dev->ifindex;
++
++ xfrmn = net_generic(xs_net(xfrm_input_state(skb)), xfrmi_net_id);
++
++ for_each_xfrmi_rcu(xfrmn->xfrmi[0], xi) {
++ if (ifindex == xi->dev->ifindex &&
++ (xi->dev->flags & IFF_UP))
++ return xi;
++ }
++
++ return NULL;
++}
++
++static void xfrmi_link(struct xfrmi_net *xfrmn, struct xfrm_if *xi)
++{
++ struct xfrm_if __rcu **xip = &xfrmn->xfrmi[0];
++
++ rcu_assign_pointer(xi->next , rtnl_dereference(*xip));
++ rcu_assign_pointer(*xip, xi);
++}
++
++static void xfrmi_unlink(struct xfrmi_net *xfrmn, struct xfrm_if *xi)
++{
++ struct xfrm_if __rcu **xip;
++ struct xfrm_if *iter;
++
++ for (xip = &xfrmn->xfrmi[0];
++ (iter = rtnl_dereference(*xip)) != NULL;
++ xip = &iter->next) {
++ if (xi == iter) {
++ rcu_assign_pointer(*xip, xi->next);
++ break;
++ }
++ }
++}
++
++static void xfrmi_dev_free(struct net_device *dev)
++{
++ struct xfrm_if *xi = netdev_priv(dev);
++
++ gro_cells_destroy(&xi->gro_cells);
++ free_percpu(dev->tstats);
++}
++
++static int xfrmi_create(struct net_device *dev)
++{
++ struct xfrm_if *xi = netdev_priv(dev);
++ struct net *net = dev_net(dev);
++ struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
++ int err;
++
++ dev->rtnl_link_ops = &xfrmi_link_ops;
++ err = register_netdevice(dev);
++ if (err < 0)
++ goto out;
++
++ dev_hold(dev);
++ xfrmi_link(xfrmn, xi);
++
++ return 0;
++
++out:
++ return err;
++}
++
++static struct xfrm_if *xfrmi_locate(struct net *net, struct xfrm_if_parms *p)
++{
++ struct xfrm_if __rcu **xip;
++ struct xfrm_if *xi;
++ struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
++
++ for (xip = &xfrmn->xfrmi[0];
++ (xi = rtnl_dereference(*xip)) != NULL;
++ xip = &xi->next)
++ if (xi->p.if_id == p->if_id)
++ return xi;
++
++ return NULL;
++}
++
++static void xfrmi_dev_uninit(struct net_device *dev)
++{
++ struct xfrm_if *xi = netdev_priv(dev);
++ struct xfrmi_net *xfrmn = net_generic(xi->net, xfrmi_net_id);
++
++ xfrmi_unlink(xfrmn, xi);
++ dev_put(dev);
++}
++
++static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet)
++{
++ skb->tstamp = 0;
++ skb->pkt_type = PACKET_HOST;
++ skb->skb_iif = 0;
++ skb->ignore_df = 0;
++ skb_dst_drop(skb);
++ nf_reset(skb);
++ nf_reset_trace(skb);
++
++ if (!xnet)
++ return;
++
++ ipvs_reset(skb);
++ secpath_reset(skb);
++ skb_orphan(skb);
++ skb->mark = 0;
++}
++
++static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
++{
++ struct pcpu_sw_netstats *tstats;
++ struct xfrm_mode *inner_mode;
++ struct net_device *dev;
++ struct xfrm_state *x;
++ struct xfrm_if *xi;
++ bool xnet;
++
++ if (err && !skb->sp)
++ return 0;
++
++ x = xfrm_input_state(skb);
++
++ xi = xfrmi_lookup(xs_net(x), x);
++ if (!xi)
++ return 1;
++
++ dev = xi->dev;
++ skb->dev = dev;
++
++ if (err) {
++ dev->stats.rx_errors++;
++ dev->stats.rx_dropped++;
++
++ return 0;
++ }
++
++ xnet = !net_eq(xi->net, dev_net(skb->dev));
++
++ if (xnet) {
++ inner_mode = x->inner_mode;
++
++ if (x->sel.family == AF_UNSPEC) {
++ inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
++ if (inner_mode == NULL) {
++ XFRM_INC_STATS(dev_net(skb->dev),
++ LINUX_MIB_XFRMINSTATEMODEERROR);
++ return -EINVAL;
++ }
++ }
++
++ if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb,
++ inner_mode->afinfo->family))
++ return -EPERM;
++ }
++
++ xfrmi_scrub_packet(skb, xnet);
++
++ tstats = this_cpu_ptr(dev->tstats);
++
++ u64_stats_update_begin(&tstats->syncp);
++ tstats->rx_packets++;
++ tstats->rx_bytes += skb->len;
++ u64_stats_update_end(&tstats->syncp);
++
++ return 0;
++}
++
++static int
++xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
++{
++ struct xfrm_if *xi = netdev_priv(dev);
++ struct net_device_stats *stats = &xi->dev->stats;
++ struct dst_entry *dst = skb_dst(skb);
++ unsigned int length = skb->len;
++ struct net_device *tdev;
++ struct xfrm_state *x;
++ int err = -1;
++ int mtu;
++
++ dst_hold(dst);
++ dst = xfrm_lookup_with_ifid(xi->net, dst, fl, NULL, 0, xi->p.if_id);
++ if (IS_ERR(dst)) {
++ err = PTR_ERR(dst);
++ dst = NULL;
++ goto tx_err_link_failure;
++ }
++
++ x = dst->xfrm;
++ if (!x)
++ goto tx_err_link_failure;
++
++ if (x->if_id != xi->p.if_id)
++ goto tx_err_link_failure;
++
++ tdev = dst->dev;
++
++ if (tdev == dev) {
++ stats->collisions++;
++ net_warn_ratelimited("%s: Local routing loop detected!\n",
++ dev->name);
++ goto tx_err_dst_release;
++ }
++
++ mtu = dst_mtu(dst);
++ if (skb->len > mtu) {
++ skb_dst_update_pmtu_no_confirm(skb, mtu);
++
++ if (skb->protocol == htons(ETH_P_IPV6)) {
++ if (mtu < IPV6_MIN_MTU)
++ mtu = IPV6_MIN_MTU;
++
++ if (skb->len > 1280)
++ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
++ else
++ goto xmit;
++ } else {
++ if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
++ goto xmit;
++ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
++ htonl(mtu));
++ }
++
++ dst_release(dst);
++ return -EMSGSIZE;
++ }
++
++xmit:
++ xfrmi_scrub_packet(skb, !net_eq(xi->net, dev_net(dev)));
++ skb_dst_set(skb, dst);
++ skb->dev = tdev;
++
++ err = dst_output(xi->net, skb->sk, skb);
++ if (net_xmit_eval(err) == 0) {
++ struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
++
++ u64_stats_update_begin(&tstats->syncp);
++ tstats->tx_bytes += length;
++ tstats->tx_packets++;
++ u64_stats_update_end(&tstats->syncp);
++ } else {
++ stats->tx_errors++;
++ stats->tx_aborted_errors++;
++ }
++
++ return 0;
++tx_err_link_failure:
++ stats->tx_carrier_errors++;
++ dst_link_failure(skb);
++tx_err_dst_release:
++ dst_release(dst);
++ return err;
++}
++
++static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
++{
++ struct xfrm_if *xi = netdev_priv(dev);
++ struct net_device_stats *stats = &xi->dev->stats;
++ struct dst_entry *dst = skb_dst(skb);
++ struct flowi fl;
++ int ret;
++
++ memset(&fl, 0, sizeof(fl));
++
++ switch (skb->protocol) {
++ case htons(ETH_P_IPV6):
++ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET6);
++ if (!dst) {
++ fl.u.ip6.flowi6_oif = dev->ifindex;
++ fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++ dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
++ if (dst->error) {
++ dst_release(dst);
++ stats->tx_carrier_errors++;
++ goto tx_err;
++ }
++ skb_dst_set(skb, dst);
++ }
++ break;
++ case htons(ETH_P_IP):
++ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
++ xfrm_decode_session(skb, &fl, AF_INET);
++ if (!dst) {
++ struct rtable *rt;
++
++ fl.u.ip4.flowi4_oif = dev->ifindex;
++ fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++ rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
++ if (IS_ERR(rt)) {
++ stats->tx_carrier_errors++;
++ goto tx_err;
++ }
++ skb_dst_set(skb, &rt->dst);
++ }
++ break;
++ default:
++ goto tx_err;
++ }
++
++ fl.flowi_oif = xi->p.link;
++
++ ret = xfrmi_xmit2(skb, dev, &fl);
++ if (ret < 0)
++ goto tx_err;
++
++ return NETDEV_TX_OK;
++
++tx_err:
++ stats->tx_errors++;
++ stats->tx_dropped++;
++ kfree_skb(skb);
++ return NETDEV_TX_OK;
++}
++
++static int xfrmi4_err(struct sk_buff *skb, u32 info)
++{
++ const struct iphdr *iph = (const struct iphdr *)skb->data;
++ struct net *net = dev_net(skb->dev);
++ int protocol = iph->protocol;
++ struct ip_comp_hdr *ipch;
++ struct ip_esp_hdr *esph;
++ struct ip_auth_hdr *ah ;
++ struct xfrm_state *x;
++ struct xfrm_if *xi;
++ __be32 spi;
++
++ switch (protocol) {
++ case IPPROTO_ESP:
++ esph = (struct ip_esp_hdr *)(skb->data+(iph->ihl<<2));
++ spi = esph->spi;
++ break;
++ case IPPROTO_AH:
++ ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2));
++ spi = ah->spi;
++ break;
++ case IPPROTO_COMP:
++ ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
++ spi = htonl(ntohs(ipch->cpi));
++ break;
++ default:
++ return 0;
++ }
++
++ switch (icmp_hdr(skb)->type) {
++ case ICMP_DEST_UNREACH:
++ if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
++ return 0;
++ case ICMP_REDIRECT:
++ break;
++ default:
++ return 0;
++ }
++
++ x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
++ spi, protocol, AF_INET);
++ if (!x)
++ return 0;
++
++ xi = xfrmi_lookup(net, x);
++ if (!xi) {
++ xfrm_state_put(x);
++ return -1;
++ }
++
++ if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
++ ipv4_update_pmtu(skb, net, info, 0, 0, protocol, 0);
++ else
++ ipv4_redirect(skb, net, 0, 0, protocol, 0);
++ xfrm_state_put(x);
++
++ return 0;
++}
++
++static int xfrmi6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
++ u8 type, u8 code, int offset, __be32 info)
++{
++ const struct ipv6hdr *iph = (const struct ipv6hdr *)skb->data;
++ struct net *net = dev_net(skb->dev);
++ int protocol = iph->nexthdr;
++ struct ip_comp_hdr *ipch;
++ struct ip_esp_hdr *esph;
++ struct ip_auth_hdr *ah;
++ struct xfrm_state *x;
++ struct xfrm_if *xi;
++ __be32 spi;
++
++ switch (protocol) {
++ case IPPROTO_ESP:
++ esph = (struct ip_esp_hdr *)(skb->data + offset);
++ spi = esph->spi;
++ break;
++ case IPPROTO_AH:
++ ah = (struct ip_auth_hdr *)(skb->data + offset);
++ spi = ah->spi;
++ break;
++ case IPPROTO_COMP:
++ ipch = (struct ip_comp_hdr *)(skb->data + offset);
++ spi = htonl(ntohs(ipch->cpi));
++ break;
++ default:
++ return 0;
++ }
++
++ if (type != ICMPV6_PKT_TOOBIG &&
++ type != NDISC_REDIRECT)
++ return 0;
++
++ x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
++ spi, protocol, AF_INET6);
++ if (!x)
++ return 0;
++
++ xi = xfrmi_lookup(net, x);
++ if (!xi) {
++ xfrm_state_put(x);
++ return -1;
++ }
++
++ if (type == NDISC_REDIRECT)
++ ip6_redirect(skb, net, skb->dev->ifindex, 0,
++ sock_net_uid(net, NULL));
++ else
++ ip6_update_pmtu(skb, net, info, 0, 0, sock_net_uid(net, NULL));
++ xfrm_state_put(x);
++
++ return 0;
++}
++
++static int xfrmi_change(struct xfrm_if *xi, const struct xfrm_if_parms *p)
++{
++ if (xi->p.link != p->link)
++ return -EINVAL;
++
++ xi->p.if_id = p->if_id;
++
++ return 0;
++}
++
++static int xfrmi_update(struct xfrm_if *xi, struct xfrm_if_parms *p)
++{
++ struct net *net = xi->net;
++ struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
++ int err;
++
++ xfrmi_unlink(xfrmn, xi);
++ synchronize_net();
++ err = xfrmi_change(xi, p);
++ xfrmi_link(xfrmn, xi);
++ netdev_state_change(xi->dev);
++ return err;
++}
++
++static void xfrmi_get_stats64(struct net_device *dev,
++ struct rtnl_link_stats64 *s)
++{
++ int cpu;
++
++ if (!dev->tstats)
++ return;
++
++ for_each_possible_cpu(cpu) {
++ struct pcpu_sw_netstats *stats;
++ struct pcpu_sw_netstats tmp;
++ int start;
++
++ stats = per_cpu_ptr(dev->tstats, cpu);
++ do {
++ start = u64_stats_fetch_begin_irq(&stats->syncp);
++ tmp.rx_packets = stats->rx_packets;
++ tmp.rx_bytes = stats->rx_bytes;
++ tmp.tx_packets = stats->tx_packets;
++ tmp.tx_bytes = stats->tx_bytes;
++ } while (u64_stats_fetch_retry_irq(&stats->syncp, start));
++
++ s->rx_packets += tmp.rx_packets;
++ s->rx_bytes += tmp.rx_bytes;
++ s->tx_packets += tmp.tx_packets;
++ s->tx_bytes += tmp.tx_bytes;
++ }
++
++ s->rx_dropped = dev->stats.rx_dropped;
++ s->tx_dropped = dev->stats.tx_dropped;
++}
++
++static int xfrmi_get_iflink(const struct net_device *dev)
++{
++ struct xfrm_if *xi = netdev_priv(dev);
++
++ return xi->p.link;
++}
++
++
++static const struct net_device_ops xfrmi_netdev_ops = {
++ .ndo_init = xfrmi_dev_init,
++ .ndo_uninit = xfrmi_dev_uninit,
++ .ndo_start_xmit = xfrmi_xmit,
++ .ndo_get_stats64 = xfrmi_get_stats64,
++ .ndo_get_iflink = xfrmi_get_iflink,
++};
++
++static void xfrmi_dev_setup(struct net_device *dev)
++{
++ dev->netdev_ops = &xfrmi_netdev_ops;
++ dev->type = ARPHRD_NONE;
++ dev->mtu = ETH_DATA_LEN;
++ dev->min_mtu = ETH_MIN_MTU;
++ dev->max_mtu = IP_MAX_MTU;
++ dev->flags = IFF_NOARP;
++ dev->needs_free_netdev = true;
++ dev->priv_destructor = xfrmi_dev_free;
++ netif_keep_dst(dev);
++
++ eth_broadcast_addr(dev->broadcast);
++}
++
++static int xfrmi_dev_init(struct net_device *dev)
++{
++ struct xfrm_if *xi = netdev_priv(dev);
++ struct net_device *phydev = __dev_get_by_index(xi->net, xi->p.link);
++ int err;
++
++ dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
++ if (!dev->tstats)
++ return -ENOMEM;
++
++ err = gro_cells_init(&xi->gro_cells, dev);
++ if (err) {
++ free_percpu(dev->tstats);
++ return err;
++ }
++
++ dev->features |= NETIF_F_LLTX;
++
++ if (phydev) {
++ dev->needed_headroom = phydev->needed_headroom;
++ dev->needed_tailroom = phydev->needed_tailroom;
++
++ if (is_zero_ether_addr(dev->dev_addr))
++ eth_hw_addr_inherit(dev, phydev);
++ if (is_zero_ether_addr(dev->broadcast))
++ memcpy(dev->broadcast, phydev->broadcast,
++ dev->addr_len);
++ } else {
++ eth_hw_addr_random(dev);
++ eth_broadcast_addr(dev->broadcast);
++ }
++
++ return 0;
++}
++
++static int xfrmi_validate(struct nlattr *tb[], struct nlattr *data[],
++ struct netlink_ext_ack *extack)
++{
++ return 0;
++}
++
++static void xfrmi_netlink_parms(struct nlattr *data[],
++ struct xfrm_if_parms *parms)
++{
++ memset(parms, 0, sizeof(*parms));
++
++ if (!data)
++ return;
++
++ if (data[IFLA_XFRM_LINK])
++ parms->link = nla_get_u32(data[IFLA_XFRM_LINK]);
++
++ if (data[IFLA_XFRM_IF_ID])
++ parms->if_id = nla_get_u32(data[IFLA_XFRM_IF_ID]);
++}
++
++static int xfrmi_newlink(struct net *src_net, struct net_device *dev,
++ struct nlattr *tb[], struct nlattr *data[],
++ struct netlink_ext_ack *extack)
++{
++ struct net *net = dev_net(dev);
++ struct xfrm_if_parms p = {};
++ struct xfrm_if *xi;
++ int err;
++
++ xfrmi_netlink_parms(data, &p);
++ if (!p.if_id) {
++ NL_SET_ERR_MSG(extack, "if_id must be non zero");
++ return -EINVAL;
++ }
++
++ xi = xfrmi_locate(net, &p);
++ if (xi)
++ return -EEXIST;
++
++ xi = netdev_priv(dev);
++ xi->p = p;
++ xi->net = net;
++ xi->dev = dev;
++
++ err = xfrmi_create(dev);
++ return err;
++}
++
++static void xfrmi_dellink(struct net_device *dev, struct list_head *head)
++{
++ unregister_netdevice_queue(dev, head);
++}
++
++static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[],
++ struct nlattr *data[],
++ struct netlink_ext_ack *extack)
++{
++ struct xfrm_if *xi = netdev_priv(dev);
++ struct net *net = xi->net;
++ struct xfrm_if_parms p = {};
++
++ xfrmi_netlink_parms(data, &p);
++ if (!p.if_id) {
++ NL_SET_ERR_MSG(extack, "if_id must be non zero");
++ return -EINVAL;
++ }
++
++ xi = xfrmi_locate(net, &p);
++ if (!xi) {
++ xi = netdev_priv(dev);
++ } else {
++ if (xi->dev != dev)
++ return -EEXIST;
++ }
++
++ return xfrmi_update(xi, &p);
++}
++
++static size_t xfrmi_get_size(const struct net_device *dev)
++{
++ return
++ /* IFLA_XFRM_LINK */
++ nla_total_size(4) +
++ /* IFLA_XFRM_IF_ID */
++ nla_total_size(4) +
++ 0;
++}
++
++static int xfrmi_fill_info(struct sk_buff *skb, const struct net_device *dev)
++{
++ struct xfrm_if *xi = netdev_priv(dev);
++ struct xfrm_if_parms *parm = &xi->p;
++
++ if (nla_put_u32(skb, IFLA_XFRM_LINK, parm->link) ||
++ nla_put_u32(skb, IFLA_XFRM_IF_ID, parm->if_id))
++ goto nla_put_failure;
++ return 0;
++
++nla_put_failure:
++ return -EMSGSIZE;
++}
++
++struct net *xfrmi_get_link_net(const struct net_device *dev)
++{
++ struct xfrm_if *xi = netdev_priv(dev);
++
++ return xi->net;
++}
++
++static const struct nla_policy xfrmi_policy[IFLA_XFRM_MAX + 1] = {
++ [IFLA_XFRM_LINK] = { .type = NLA_U32 },
++ [IFLA_XFRM_IF_ID] = { .type = NLA_U32 },
++};
++
++static struct rtnl_link_ops xfrmi_link_ops __read_mostly = {
++ .kind = "xfrm",
++ .maxtype = IFLA_XFRM_MAX,
++ .policy = xfrmi_policy,
++ .priv_size = sizeof(struct xfrm_if),
++ .setup = xfrmi_dev_setup,
++ .validate = xfrmi_validate,
++ .newlink = xfrmi_newlink,
++ .dellink = xfrmi_dellink,
++ .changelink = xfrmi_changelink,
++ .get_size = xfrmi_get_size,
++ .fill_info = xfrmi_fill_info,
++ .get_link_net = xfrmi_get_link_net,
++};
++
++static void __net_exit xfrmi_destroy_interfaces(struct xfrmi_net *xfrmn)
++{
++ struct xfrm_if *xi;
++ LIST_HEAD(list);
++
++ xi = rtnl_dereference(xfrmn->xfrmi[0]);
++ if (!xi)
++ return;
++
++ unregister_netdevice_queue(xi->dev, &list);
++ unregister_netdevice_many(&list);
++}
++
++static int __net_init xfrmi_init_net(struct net *net)
++{
++ return 0;
++}
++
++static void __net_exit xfrmi_exit_net(struct net *net)
++{
++ struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
++
++ rtnl_lock();
++ xfrmi_destroy_interfaces(xfrmn);
++ rtnl_unlock();
++}
++
++static void __net_exit xfrmi_exit_batch_net(struct list_head *net_exit_list)
++{
++ struct net *net;
++ LIST_HEAD(list);
++
++ rtnl_lock();
++ list_for_each_entry(net, net_exit_list, exit_list) {
++ struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
++ struct xfrm_if __rcu **xip;
++ struct xfrm_if *xi;
++
++ for (xip = &xfrmn->xfrmi[0];
++ (xi = rtnl_dereference(*xip)) != NULL;
++ xip = &xi->next)
++ unregister_netdevice_queue(xi->dev, &list);
++ }
++ unregister_netdevice_many(&list);
++ rtnl_unlock();
++}
++
++static struct pernet_operations xfrmi_net_ops = {
++ .exit_batch = xfrmi_exit_batch_net,
++ .init = xfrmi_init_net,
++ .exit = xfrmi_exit_net,
++ .id = &xfrmi_net_id,
++ .size = sizeof(struct xfrmi_net),
++};
++
++static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = {
++ .handler = xfrm6_rcv,
++ .cb_handler = xfrmi_rcv_cb,
++ .err_handler = xfrmi6_err,
++ .priority = 10,
++};
++
++static struct xfrm6_protocol xfrmi_ah6_protocol __read_mostly = {
++ .handler = xfrm6_rcv,
++ .cb_handler = xfrmi_rcv_cb,
++ .err_handler = xfrmi6_err,
++ .priority = 10,
++};
++
++static struct xfrm6_protocol xfrmi_ipcomp6_protocol __read_mostly = {
++ .handler = xfrm6_rcv,
++ .cb_handler = xfrmi_rcv_cb,
++ .err_handler = xfrmi6_err,
++ .priority = 10,
++};
++
++static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = {
++ .handler = xfrm4_rcv,
++ .input_handler = xfrm_input,
++ .cb_handler = xfrmi_rcv_cb,
++ .err_handler = xfrmi4_err,
++ .priority = 10,
++};
++
++static struct xfrm4_protocol xfrmi_ah4_protocol __read_mostly = {
++ .handler = xfrm4_rcv,
++ .input_handler = xfrm_input,
++ .cb_handler = xfrmi_rcv_cb,
++ .err_handler = xfrmi4_err,
++ .priority = 10,
++};
++
++static struct xfrm4_protocol xfrmi_ipcomp4_protocol __read_mostly = {
++ .handler = xfrm4_rcv,
++ .input_handler = xfrm_input,
++ .cb_handler = xfrmi_rcv_cb,
++ .err_handler = xfrmi4_err,
++ .priority = 10,
++};
++
++static int __init xfrmi4_init(void)
++{
++ int err;
++
++ err = xfrm4_protocol_register(&xfrmi_esp4_protocol, IPPROTO_ESP);
++ if (err < 0)
++ goto xfrm_proto_esp_failed;
++ err = xfrm4_protocol_register(&xfrmi_ah4_protocol, IPPROTO_AH);
++ if (err < 0)
++ goto xfrm_proto_ah_failed;
++ err = xfrm4_protocol_register(&xfrmi_ipcomp4_protocol, IPPROTO_COMP);
++ if (err < 0)
++ goto xfrm_proto_comp_failed;
++
++ return 0;
++
++xfrm_proto_comp_failed:
++ xfrm4_protocol_deregister(&xfrmi_ah4_protocol, IPPROTO_AH);
++xfrm_proto_ah_failed:
++ xfrm4_protocol_deregister(&xfrmi_esp4_protocol, IPPROTO_ESP);
++xfrm_proto_esp_failed:
++ return err;
++}
++
++static void xfrmi4_fini(void)
++{
++ xfrm4_protocol_deregister(&xfrmi_ipcomp4_protocol, IPPROTO_COMP);
++ xfrm4_protocol_deregister(&xfrmi_ah4_protocol, IPPROTO_AH);
++ xfrm4_protocol_deregister(&xfrmi_esp4_protocol, IPPROTO_ESP);
++}
++
++static int __init xfrmi6_init(void)
++{
++ int err;
++
++ err = xfrm6_protocol_register(&xfrmi_esp6_protocol, IPPROTO_ESP);
++ if (err < 0)
++ goto xfrm_proto_esp_failed;
++ err = xfrm6_protocol_register(&xfrmi_ah6_protocol, IPPROTO_AH);
++ if (err < 0)
++ goto xfrm_proto_ah_failed;
++ err = xfrm6_protocol_register(&xfrmi_ipcomp6_protocol, IPPROTO_COMP);
++ if (err < 0)
++ goto xfrm_proto_comp_failed;
++
++ return 0;
++
++xfrm_proto_comp_failed:
++ xfrm6_protocol_deregister(&xfrmi_ah6_protocol, IPPROTO_AH);
++xfrm_proto_ah_failed:
++ xfrm6_protocol_deregister(&xfrmi_esp6_protocol, IPPROTO_ESP);
++xfrm_proto_esp_failed:
++ return err;
++}
++
++static void xfrmi6_fini(void)
++{
++ xfrm6_protocol_deregister(&xfrmi_ipcomp6_protocol, IPPROTO_COMP);
++ xfrm6_protocol_deregister(&xfrmi_ah6_protocol, IPPROTO_AH);
++ xfrm6_protocol_deregister(&xfrmi_esp6_protocol, IPPROTO_ESP);
++}
++
++static const struct xfrm_if_cb xfrm_if_cb = {
++ .decode_session = xfrmi_decode_session,
++};
++
++static int __init xfrmi_init(void)
++{
++ const char *msg;
++ int err;
++
++ pr_info("IPsec XFRM device driver\n");
++
++ msg = "tunnel device";
++ err = register_pernet_device(&xfrmi_net_ops);
++ if (err < 0)
++ goto pernet_dev_failed;
++
++ msg = "xfrm4 protocols";
++ err = xfrmi4_init();
++ if (err < 0)
++ goto xfrmi4_failed;
++
++ msg = "xfrm6 protocols";
++ err = xfrmi6_init();
++ if (err < 0)
++ goto xfrmi6_failed;
++
++
++ msg = "netlink interface";
++ err = rtnl_link_register(&xfrmi_link_ops);
++ if (err < 0)
++ goto rtnl_link_failed;
++
++ xfrm_if_register_cb(&xfrm_if_cb);
++
++ return err;
++
++rtnl_link_failed:
++ xfrmi6_fini();
++xfrmi6_failed:
++ xfrmi4_fini();
++xfrmi4_failed:
++ unregister_pernet_device(&xfrmi_net_ops);
++pernet_dev_failed:
++ pr_err("xfrmi init: failed to register %s\n", msg);
++ return err;
++}
++
++static void __exit xfrmi_fini(void)
++{
++ xfrm_if_unregister_cb();
++ rtnl_link_unregister(&xfrmi_link_ops);
++ xfrmi4_fini();
++ xfrmi6_fini();
++ unregister_pernet_device(&xfrmi_net_ops);
++}
++
++module_init(xfrmi_init);
++module_exit(xfrmi_fini);
++MODULE_LICENSE("GPL");
++MODULE_ALIAS_RTNL_LINK("xfrm");
++MODULE_ALIAS_NETDEV("xfrm0");
++MODULE_AUTHOR("Steffen Klassert");
++MODULE_DESCRIPTION("XFRM virtual interface");
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 94c7ebc26c48e..699e544b4bfd6 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -521,7 +521,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
+ struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
+ struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
+
+- if (re) {
++ if (re && x->replay_esn && x->preplay_esn) {
+ struct xfrm_replay_state_esn *replay_esn;
+ replay_esn = nla_data(re);
+ memcpy(x->replay_esn, replay_esn,
+@@ -1036,6 +1036,15 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
+ sizeof(*filter), GFP_KERNEL);
+ if (filter == NULL)
+ return -ENOMEM;
++
++ /* see addr_match(), (prefix length >> 5) << 2
++ * will be used to compare xfrm_address_t
++ */
++ if (filter->splen > (sizeof(xfrm_address_t) << 3) ||
++ filter->dplen > (sizeof(xfrm_address_t) << 3)) {
++ kfree(filter);
++ return -EINVAL;
++ }
+ }
+
+ if (attrs[XFRMA_PROTO])
+@@ -2573,7 +2582,7 @@ static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
+ [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) },
+ [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) },
+ [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) },
+- [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) },
++ [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) },
+ [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) },
+ [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) },
+ [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
+diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
+index 3ec45028a8c54..cd32fe3311afe 100644
+--- a/security/integrity/ima/Kconfig
++++ b/security/integrity/ima/Kconfig
+@@ -7,7 +7,7 @@ config IMA
+ select CRYPTO_HMAC
+ select CRYPTO_SHA1
+ select CRYPTO_HASH_INFO
+- select TCG_TPM if HAS_IOMEM && !UML
++ select TCG_TPM if HAS_IOMEM
+ select TCG_TIS if TCG_TPM && X86
+ select TCG_CRB if TCG_TPM && ACPI
+ select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES
+diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
+index 1f25e6d029d82..84d98c098b744 100644
+--- a/sound/pci/emu10k1/emufx.c
++++ b/sound/pci/emu10k1/emufx.c
+@@ -1550,14 +1550,8 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input))
+ gpr += 2;
+
+ /* Master volume (will be renamed later) */
+- A_OP(icode, &ptr, iMAC0, A_GPR(playback+0+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+0+SND_EMU10K1_PLAYBACK_CHANNELS));
+- A_OP(icode, &ptr, iMAC0, A_GPR(playback+1+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+1+SND_EMU10K1_PLAYBACK_CHANNELS));
+- A_OP(icode, &ptr, iMAC0, A_GPR(playback+2+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+2+SND_EMU10K1_PLAYBACK_CHANNELS));
+- A_OP(icode, &ptr, iMAC0, A_GPR(playback+3+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+3+SND_EMU10K1_PLAYBACK_CHANNELS));
+- A_OP(icode, &ptr, iMAC0, A_GPR(playback+4+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+4+SND_EMU10K1_PLAYBACK_CHANNELS));
+- A_OP(icode, &ptr, iMAC0, A_GPR(playback+5+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+5+SND_EMU10K1_PLAYBACK_CHANNELS));
+- A_OP(icode, &ptr, iMAC0, A_GPR(playback+6+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+6+SND_EMU10K1_PLAYBACK_CHANNELS));
+- A_OP(icode, &ptr, iMAC0, A_GPR(playback+7+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+7+SND_EMU10K1_PLAYBACK_CHANNELS));
++ for (z = 0; z < 8; z++)
++ A_OP(icode, &ptr, iMAC0, A_GPR(playback+z+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+z+SND_EMU10K1_PLAYBACK_CHANNELS));
+ snd_emu10k1_init_mono_control(&controls[nctl++], "Wave Master Playback Volume", gpr, 0);
+ gpr += 2;
+
+@@ -1641,102 +1635,14 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input))
+ dev_dbg(emu->card->dev, "emufx.c: gpr=0x%x, tmp=0x%x\n",
+ gpr, tmp);
+ */
+- /* For the EMU1010: How to get 32bit values from the DSP. High 16bits into L, low 16bits into R. */
+- /* A_P16VIN(0) is delayed by one sample,
+- * so all other A_P16VIN channels will need to also be delayed
+- */
+- /* Left ADC in. 1 of 2 */
+ snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_P16VIN(0x0), A_FXBUS2(0) );
+- /* Right ADC in 1 of 2 */
+- gpr_map[gpr++] = 0x00000000;
+- /* Delaying by one sample: instead of copying the input
+- * value A_P16VIN to output A_FXBUS2 as in the first channel,
+- * we use an auxiliary register, delaying the value by one
+- * sample
+- */
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(2) );
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x1), A_C_00000000, A_C_00000000);
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(4) );
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x2), A_C_00000000, A_C_00000000);
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(6) );
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x3), A_C_00000000, A_C_00000000);
+- /* For 96kHz mode */
+- /* Left ADC in. 2 of 2 */
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0x8) );
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x4), A_C_00000000, A_C_00000000);
+- /* Right ADC in 2 of 2 */
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0xa) );
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x5), A_C_00000000, A_C_00000000);
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0xc) );
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x6), A_C_00000000, A_C_00000000);
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0xe) );
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x7), A_C_00000000, A_C_00000000);
+- /* Pavel Hofman - we still have voices, A_FXBUS2s, and
+- * A_P16VINs available -
+- * let's add 8 more capture channels - total of 16
+- */
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp,
+- bit_shifter16,
+- A_GPR(gpr - 1),
+- A_FXBUS2(0x10));
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x8),
+- A_C_00000000, A_C_00000000);
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp,
+- bit_shifter16,
+- A_GPR(gpr - 1),
+- A_FXBUS2(0x12));
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x9),
+- A_C_00000000, A_C_00000000);
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp,
+- bit_shifter16,
+- A_GPR(gpr - 1),
+- A_FXBUS2(0x14));
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xa),
+- A_C_00000000, A_C_00000000);
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp,
+- bit_shifter16,
+- A_GPR(gpr - 1),
+- A_FXBUS2(0x16));
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xb),
+- A_C_00000000, A_C_00000000);
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp,
+- bit_shifter16,
+- A_GPR(gpr - 1),
+- A_FXBUS2(0x18));
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xc),
+- A_C_00000000, A_C_00000000);
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp,
+- bit_shifter16,
+- A_GPR(gpr - 1),
+- A_FXBUS2(0x1a));
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xd),
+- A_C_00000000, A_C_00000000);
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp,
+- bit_shifter16,
+- A_GPR(gpr - 1),
+- A_FXBUS2(0x1c));
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xe),
+- A_C_00000000, A_C_00000000);
+- gpr_map[gpr++] = 0x00000000;
+- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp,
+- bit_shifter16,
+- A_GPR(gpr - 1),
+- A_FXBUS2(0x1e));
+- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xf),
+- A_C_00000000, A_C_00000000);
++ /* A_P16VIN(0) is delayed by one sample, so all other A_P16VIN channels
++ * will need to also be delayed; we use an auxiliary register for that. */
++ for (z = 1; z < 0x10; z++) {
++ snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr), A_FXBUS2(z * 2) );
++ A_OP(icode, &ptr, iACC3, A_GPR(gpr), A_P16VIN(z), A_C_00000000, A_C_00000000);
++ gpr_map[gpr++] = 0x00000000;
++ }
+ }
+
+ #if 0
+diff --git a/sound/soc/codecs/rt5665.c b/sound/soc/codecs/rt5665.c
+index 6ba99f5ed3f42..a7ed2a19c3ec2 100644
+--- a/sound/soc/codecs/rt5665.c
++++ b/sound/soc/codecs/rt5665.c
+@@ -4475,6 +4475,8 @@ static void rt5665_remove(struct snd_soc_component *component)
+ struct rt5665_priv *rt5665 = snd_soc_component_get_drvdata(component);
+
+ regmap_write(rt5665->regmap, RT5665_RESET, 0);
++
++ regulator_bulk_disable(ARRAY_SIZE(rt5665->supplies), rt5665->supplies);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/sound/soc/meson/axg-tdm-formatter.c b/sound/soc/meson/axg-tdm-formatter.c
+index 43e390f9358a4..a195160b68208 100644
+--- a/sound/soc/meson/axg-tdm-formatter.c
++++ b/sound/soc/meson/axg-tdm-formatter.c
+@@ -28,27 +28,32 @@ int axg_tdm_formatter_set_channel_masks(struct regmap *map,
+ struct axg_tdm_stream *ts,
+ unsigned int offset)
+ {
+- unsigned int val, ch = ts->channels;
+- unsigned long mask;
+- int i, j;
++ unsigned int ch = ts->channels;
++ u32 val[AXG_TDM_NUM_LANES];
++ int i, j, k;
++
++ /*
++ * We need to mimick the slot distribution used by the HW to keep the
++ * channel placement consistent regardless of the number of channel
++ * in the stream. This is why the odd algorithm below is used.
++ */
++ memset(val, 0, sizeof(*val) * AXG_TDM_NUM_LANES);
+
+ /*
+ * Distribute the channels of the stream over the available slots
+- * of each TDM lane
++ * of each TDM lane. We need to go over the 32 slots ...
+ */
+- for (i = 0; i < AXG_TDM_NUM_LANES; i++) {
+- val = 0;
+- mask = ts->mask[i];
+-
+- for (j = find_first_bit(&mask, 32);
+- (j < 32) && ch;
+- j = find_next_bit(&mask, 32, j + 1)) {
+- val |= 1 << j;
+- ch -= 1;
++ for (i = 0; (i < 32) && ch; i += 2) {
++ /* ... of all the lanes ... */
++ for (j = 0; j < AXG_TDM_NUM_LANES; j++) {
++ /* ... then distribute the channels in pairs */
++ for (k = 0; k < 2; k++) {
++ if ((BIT(i + k) & ts->mask[j]) && ch) {
++ val[j] |= BIT(i + k);
++ ch -= 1;
++ }
++ }
+ }
+-
+- regmap_write(map, offset, val);
+- offset += regmap_get_reg_stride(map);
+ }
+
+ /*
+@@ -61,6 +66,11 @@ int axg_tdm_formatter_set_channel_masks(struct regmap *map,
+ return -EINVAL;
+ }
+
++ for (i = 0; i < AXG_TDM_NUM_LANES; i++) {
++ regmap_write(map, offset, val[i]);
++ offset += regmap_get_reg_stride(map);
++ }
++
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(axg_tdm_formatter_set_channel_masks);
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index e72f744bc305d..6c546f520f994 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3677,5 +3677,34 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */
+ }
+ }
+ },
++{
++ /* Advanced modes of the Mythware XA001AU.
++ * For the standard mode, Mythware XA001AU has ID ffad:a001
++ */
++ USB_DEVICE_VENDOR_SPEC(0xffad, 0xa001),
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .vendor_name = "Mythware",
++ .product_name = "XA001AU",
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_IGNORE_INTERFACE,
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE,
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE,
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
+
+ #undef USB_DEVICE_VENDOR_SPEC
+diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh b/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh
+index 135902aa8b114..a372863c9efdb 100755
+--- a/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh
+@@ -72,7 +72,8 @@ test_span_gre_ttl()
+
+ RET=0
+
+- mirror_install $swp1 ingress $tundev "matchall $tcflags"
++ mirror_install $swp1 ingress $tundev \
++ "prot ip flower $tcflags ip_prot icmp"
+ tc filter add dev $h3 ingress pref 77 prot $prot \
+ flower ip_ttl 50 action pass
+
+diff --git a/tools/testing/selftests/net/forwarding/tc_flower.sh b/tools/testing/selftests/net/forwarding/tc_flower.sh
+index 20d1077e5a3de..85faef980887a 100755
+--- a/tools/testing/selftests/net/forwarding/tc_flower.sh
++++ b/tools/testing/selftests/net/forwarding/tc_flower.sh
+@@ -48,8 +48,8 @@ match_dst_mac_test()
+ tc_check_packets "dev $h2 ingress" 101 1
+ check_fail $? "Matched on a wrong filter"
+
+- tc_check_packets "dev $h2 ingress" 102 1
+- check_err $? "Did not match on correct filter"
++ tc_check_packets "dev $h2 ingress" 102 0
++ check_fail $? "Did not match on correct filter"
+
+ tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
+ tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
+@@ -74,8 +74,8 @@ match_src_mac_test()
+ tc_check_packets "dev $h2 ingress" 101 1
+ check_fail $? "Matched on a wrong filter"
+
+- tc_check_packets "dev $h2 ingress" 102 1
+- check_err $? "Did not match on correct filter"
++ tc_check_packets "dev $h2 ingress" 102 0
++ check_fail $? "Did not match on correct filter"
+
+ tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower
+ tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2023-09-02 9:59 Mike Pagano
0 siblings, 0 replies; 332+ messages in thread
From: Mike Pagano @ 2023-09-02 9:59 UTC (permalink / raw
To: gentoo-commits
commit: 3b0058d27fa91793251fe5e8091e73c15de9cf84
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 2 09:59:28 2023 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Sep 2 09:59:28 2023 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3b0058d2
Linux patch 4.19.294
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 ++
1293_linux-4.19.294.patch | 96 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 100 insertions(+)
diff --git a/0000_README b/0000_README
index a211d53c..49895006 100644
--- a/0000_README
+++ b/0000_README
@@ -1215,6 +1215,10 @@ Patch: 1292_linux-4.19.293.patch
From: https://www.kernel.org
Desc: Linux 4.19.293
+Patch: 1293_linux-4.19.294.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.294
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1293_linux-4.19.294.patch b/1293_linux-4.19.294.patch
new file mode 100644
index 00000000..e2074dd8
--- /dev/null
+++ b/1293_linux-4.19.294.patch
@@ -0,0 +1,96 @@
+diff --git a/Makefile b/Makefile
+index 5965df0393fd3..4f8f98c7227a4 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 293
++SUBLEVEL = 294
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/mach-ep93xx/timer-ep93xx.c b/arch/arm/mach-ep93xx/timer-ep93xx.c
+index b07956883e165..de998830f534f 100644
+--- a/arch/arm/mach-ep93xx/timer-ep93xx.c
++++ b/arch/arm/mach-ep93xx/timer-ep93xx.c
+@@ -9,7 +9,6 @@
+ #include <linux/io.h>
+ #include <asm/mach/time.h>
+ #include "soc.h"
+-#include "platform.h"
+
+ /*************************************************************************
+ * Timer handling for EP93xx
+@@ -61,7 +60,7 @@ static u64 notrace ep93xx_read_sched_clock(void)
+ return ret;
+ }
+
+-static u64 ep93xx_clocksource_read(struct clocksource *c)
++u64 ep93xx_clocksource_read(struct clocksource *c)
+ {
+ u64 ret;
+
+diff --git a/arch/mips/alchemy/common/dbdma.c b/arch/mips/alchemy/common/dbdma.c
+index e9ee9ab90a0c6..4ca2c28878e0f 100644
+--- a/arch/mips/alchemy/common/dbdma.c
++++ b/arch/mips/alchemy/common/dbdma.c
+@@ -30,7 +30,6 @@
+ *
+ */
+
+-#include <linux/dma-map-ops.h> /* for dma_default_coherent */
+ #include <linux/init.h>
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+@@ -624,18 +623,17 @@ u32 au1xxx_dbdma_put_source(u32 chanid, dma_addr_t buf, int nbytes, u32 flags)
+ dp->dscr_cmd0 &= ~DSCR_CMD0_IE;
+
+ /*
+- * There is an erratum on certain Au1200/Au1550 revisions that could
+- * result in "stale" data being DMA'ed. It has to do with the snoop
+- * logic on the cache eviction buffer. dma_default_coherent is set
+- * to false on these parts.
++ * There is an errata on the Au1200/Au1550 parts that could result
++ * in "stale" data being DMA'ed. It has to do with the snoop logic on
++ * the cache eviction buffer. DMA_NONCOHERENT is on by default for
++ * these parts. If it is fixed in the future, these dma_cache_inv will
++ * just be nothing more than empty macros. See io.h.
+ */
+- if (!dma_default_coherent)
+- dma_cache_wback_inv(KSEG0ADDR(buf), nbytes);
++ dma_cache_wback_inv((unsigned long)buf, nbytes);
+ dp->dscr_cmd0 |= DSCR_CMD0_V; /* Let it rip */
+ wmb(); /* drain writebuffer */
+ dma_cache_wback_inv((unsigned long)dp, sizeof(*dp));
+ ctp->chan_ptr->ddma_dbell = 0;
+- wmb(); /* force doorbell write out to dma engine */
+
+ /* Get next descriptor pointer. */
+ ctp->put_ptr = phys_to_virt(DSCR_GET_NXTPTR(dp->dscr_nxtptr));
+@@ -687,18 +685,17 @@ u32 au1xxx_dbdma_put_dest(u32 chanid, dma_addr_t buf, int nbytes, u32 flags)
+ dp->dscr_source1, dp->dscr_dest0, dp->dscr_dest1);
+ #endif
+ /*
+- * There is an erratum on certain Au1200/Au1550 revisions that could
+- * result in "stale" data being DMA'ed. It has to do with the snoop
+- * logic on the cache eviction buffer. dma_default_coherent is set
+- * to false on these parts.
++ * There is an errata on the Au1200/Au1550 parts that could result in
++ * "stale" data being DMA'ed. It has to do with the snoop logic on the
++ * cache eviction buffer. DMA_NONCOHERENT is on by default for these
++ * parts. If it is fixed in the future, these dma_cache_inv will just
++ * be nothing more than empty macros. See io.h.
+ */
+- if (!dma_default_coherent)
+- dma_cache_inv(KSEG0ADDR(buf), nbytes);
++ dma_cache_inv((unsigned long)buf, nbytes);
+ dp->dscr_cmd0 |= DSCR_CMD0_V; /* Let it rip */
+ wmb(); /* drain writebuffer */
+ dma_cache_wback_inv((unsigned long)dp, sizeof(*dp));
+ ctp->chan_ptr->ddma_dbell = 0;
+- wmb(); /* force doorbell write out to dma engine */
+
+ /* Get next descriptor pointer. */
+ ctp->put_ptr = phys_to_virt(DSCR_GET_NXTPTR(dp->dscr_nxtptr));
^ permalink raw reply related [flat|nested] 332+ messages in thread
* [gentoo-commits] proj/linux-patches:4.19 commit in: /
@ 2024-04-18 3:06 Alice Ferrazzi
0 siblings, 0 replies; 332+ messages in thread
From: Alice Ferrazzi @ 2024-04-18 3:06 UTC (permalink / raw
To: gentoo-commits
commit: c664a0882dbe64e2e4592a80c2ebcdb9bf91f8a2
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Thu Apr 18 03:06:33 2024 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Thu Apr 18 03:06:33 2024 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c664a088
Linux patch 4.19.295
Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>
0000_README | 4 +
1294_linux-4.19.295.patch | 12273 ++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 12277 insertions(+)
diff --git a/0000_README b/0000_README
index 49895006..8d476631 100644
--- a/0000_README
+++ b/0000_README
@@ -1219,6 +1219,10 @@ Patch: 1293_linux-4.19.294.patch
From: https://www.kernel.org
Desc: Linux 4.19.294
+Patch: 1294_linux-4.19.295.patch
+From: https://www.kernel.org
+Desc: Linux 4.19.295
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1294_linux-4.19.295.patch b/1294_linux-4.19.295.patch
new file mode 100644
index 00000000..a74880ea
--- /dev/null
+++ b/1294_linux-4.19.295.patch
@@ -0,0 +1,12273 @@
+diff --git a/Makefile b/Makefile
+index 4f8f98c7227a4..6eb08388fa154 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 294
++SUBLEVEL = 295
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
+index 74c83b0ca54e0..bb7dc00a71e06 100644
+--- a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
+@@ -48,3 +48,16 @@
+ };
+ };
+ };
++
++&gmac0 {
++ phy-mode = "rgmii";
++ phy-handle = <&bcm54210e>;
++
++ mdio {
++ /delete-node/ switch@1e;
++
++ bcm54210e: ethernet-phy@0 {
++ reg = <0>;
++ };
++ };
++};
+diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
+index 214df18f3a754..6561e3b81b606 100644
+--- a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
+@@ -85,3 +85,16 @@
+ };
+ };
+ };
++
++&gmac0 {
++ phy-mode = "rgmii";
++ phy-handle = <&bcm54210e>;
++
++ mdio {
++ /delete-node/ switch@1e;
++
++ bcm54210e: ethernet-phy@0 {
++ reg = <0>;
++ };
++ };
++};
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index a6406a347690e..c331217ce21b3 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -260,7 +260,7 @@
+
+ interrupt-parent = <&gic>;
+
+- ehci: ehci@21000 {
++ ehci: usb@21000 {
+ #usb-cells = <0>;
+
+ compatible = "generic-ehci";
+@@ -282,7 +282,7 @@
+ };
+ };
+
+- ohci: ohci@22000 {
++ ohci: usb@22000 {
+ #usb-cells = <0>;
+
+ compatible = "generic-ohci";
+diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
+index 453a2a37dabd3..e44694800052d 100644
+--- a/arch/arm/boot/dts/bcm53573.dtsi
++++ b/arch/arm/boot/dts/bcm53573.dtsi
+@@ -127,6 +127,9 @@
+
+ pcie0: pcie@2000 {
+ reg = <0x00002000 0x1000>;
++
++ #address-cells = <3>;
++ #size-cells = <2>;
+ };
+
+ usb2: usb2@4000 {
+@@ -135,7 +138,7 @@
+ #address-cells = <1>;
+ #size-cells = <1>;
+
+- ehci: ehci@4000 {
++ ehci: usb@4000 {
+ compatible = "generic-ehci";
+ reg = <0x4000 0x1000>;
+ interrupt-parent = <&gic>;
+@@ -155,9 +158,7 @@
+ };
+ };
+
+- ohci: ohci@d000 {
+- #usb-cells = <0>;
+-
++ ohci: usb@d000 {
+ compatible = "generic-ohci";
+ reg = <0xd000 0x1000>;
+ interrupt-parent = <&gic>;
+@@ -180,6 +181,24 @@
+
+ gmac0: ethernet@5000 {
+ reg = <0x5000 0x1000>;
++
++ mdio {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ switch: switch@1e {
++ compatible = "brcm,bcm53125";
++ reg = <0x1e>;
++
++ status = "disabled";
++
++ /* ports are defined in board DTS */
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++ };
++ };
++ };
+ };
+
+ gmac1: ethernet@b000 {
+diff --git a/arch/arm/boot/dts/bcm947189acdbmr.dts b/arch/arm/boot/dts/bcm947189acdbmr.dts
+index ef263412fea51..02c916bedd281 100644
+--- a/arch/arm/boot/dts/bcm947189acdbmr.dts
++++ b/arch/arm/boot/dts/bcm947189acdbmr.dts
+@@ -61,9 +61,9 @@
+ spi {
+ compatible = "spi-gpio";
+ num-chipselects = <1>;
+- gpio-sck = <&chipcommon 21 0>;
+- gpio-miso = <&chipcommon 22 0>;
+- gpio-mosi = <&chipcommon 23 0>;
++ sck-gpios = <&chipcommon 21 0>;
++ miso-gpios = <&chipcommon 22 0>;
++ mosi-gpios = <&chipcommon 23 0>;
+ cs-gpios = <&chipcommon 24 0>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts
+index 1aeac33b0d341..0b07b3c319604 100644
+--- a/arch/arm/boot/dts/s3c6410-mini6410.dts
++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts
+@@ -28,29 +28,21 @@
+ bootargs = "console=ttySAC0,115200n8 earlyprintk rootwait root=/dev/mmcblk0p1";
+ };
+
+- clocks {
+- compatible = "simple-bus";
+- #address-cells = <1>;
+- #size-cells = <0>;
+-
+- fin_pll: oscillator@0 {
+- compatible = "fixed-clock";
+- reg = <0>;
+- clock-frequency = <12000000>;
+- clock-output-names = "fin_pll";
+- #clock-cells = <0>;
+- };
++ fin_pll: oscillator-0 {
++ compatible = "fixed-clock";
++ clock-frequency = <12000000>;
++ clock-output-names = "fin_pll";
++ #clock-cells = <0>;
++ };
+
+- xusbxti: oscillator@1 {
+- compatible = "fixed-clock";
+- reg = <1>;
+- clock-output-names = "xusbxti";
+- clock-frequency = <48000000>;
+- #clock-cells = <0>;
+- };
++ xusbxti: oscillator-1 {
++ compatible = "fixed-clock";
++ clock-output-names = "xusbxti";
++ clock-frequency = <48000000>;
++ #clock-cells = <0>;
+ };
+
+- srom-cs1@18000000 {
++ srom-cs1-bus@18000000 {
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+@@ -59,7 +51,7 @@
+
+ ethernet@18000000 {
+ compatible = "davicom,dm9000";
+- reg = <0x18000000 0x2 0x18000004 0x2>;
++ reg = <0x18000000 0x2>, <0x18000004 0x2>;
+ interrupt-parent = <&gpn>;
+ interrupts = <7 IRQ_TYPE_LEVEL_HIGH>;
+ davicom,no-eeprom;
+@@ -201,12 +193,12 @@
+ };
+
+ &pinctrl0 {
+- gpio_leds: gpio-leds {
++ gpio_leds: gpio-leds-pins {
+ samsung,pins = "gpk-4", "gpk-5", "gpk-6", "gpk-7";
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- gpio_keys: gpio-keys {
++ gpio_keys: gpio-keys-pins {
+ samsung,pins = "gpn-0", "gpn-1", "gpn-2", "gpn-3",
+ "gpn-4", "gpn-5", "gpl-11", "gpl-12";
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+diff --git a/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi b/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi
+index 8e9594d64b579..0a3186d57cb56 100644
+--- a/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi
++++ b/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi
+@@ -16,111 +16,111 @@
+ * Pin banks
+ */
+
+- gpa: gpa {
++ gpa: gpa-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpb: gpb {
++ gpb: gpb-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpc: gpc {
++ gpc: gpc-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpd: gpd {
++ gpd: gpd-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpe: gpe {
++ gpe: gpe-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ };
+
+- gpf: gpf {
++ gpf: gpf-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpg: gpg {
++ gpg: gpg-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gph: gph {
++ gph: gph-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpi: gpi {
++ gpi: gpi-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ };
+
+- gpj: gpj {
++ gpj: gpj-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ };
+
+- gpk: gpk {
++ gpk: gpk-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ };
+
+- gpl: gpl {
++ gpl: gpl-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpm: gpm {
++ gpm: gpm-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpn: gpn {
++ gpn: gpn-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpo: gpo {
++ gpo: gpo-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpp: gpp {
++ gpp: gpp-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ };
+
+- gpq: gpq {
++ gpq: gpq-gpio-bank {
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+@@ -131,225 +131,225 @@
+ * Pin groups
+ */
+
+- uart0_data: uart0-data {
++ uart0_data: uart0-data-pins {
+ samsung,pins = "gpa-0", "gpa-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- uart0_fctl: uart0-fctl {
++ uart0_fctl: uart0-fctl-pins {
+ samsung,pins = "gpa-2", "gpa-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- uart1_data: uart1-data {
++ uart1_data: uart1-data-pins {
+ samsung,pins = "gpa-4", "gpa-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- uart1_fctl: uart1-fctl {
++ uart1_fctl: uart1-fctl-pins {
+ samsung,pins = "gpa-6", "gpa-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- uart2_data: uart2-data {
++ uart2_data: uart2-data-pins {
+ samsung,pins = "gpb-0", "gpb-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- uart3_data: uart3-data {
++ uart3_data: uart3-data-pins {
+ samsung,pins = "gpb-2", "gpb-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- ext_dma_0: ext-dma-0 {
++ ext_dma_0: ext-dma-0-pins {
+ samsung,pins = "gpb-0", "gpb-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- ext_dma_1: ext-dma-1 {
++ ext_dma_1: ext-dma-1-pins {
+ samsung,pins = "gpb-2", "gpb-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- irda_data_0: irda-data-0 {
++ irda_data_0: irda-data-0-pins {
+ samsung,pins = "gpb-0", "gpb-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- irda_data_1: irda-data-1 {
++ irda_data_1: irda-data-1-pins {
+ samsung,pins = "gpb-2", "gpb-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- irda_sdbw: irda-sdbw {
++ irda_sdbw: irda-sdbw-pins {
+ samsung,pins = "gpb-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2c0_bus: i2c0-bus {
++ i2c0_bus: i2c0-bus-pins {
+ samsung,pins = "gpb-5", "gpb-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- i2c1_bus: i2c1-bus {
++ i2c1_bus: i2c1-bus-pins {
+ /* S3C6410-only */
+ samsung,pins = "gpb-2", "gpb-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_6>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- spi0_bus: spi0-bus {
++ spi0_bus: spi0-bus-pins {
+ samsung,pins = "gpc-0", "gpc-1", "gpc-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- spi0_cs: spi0-cs {
++ spi0_cs: spi0-cs-pins {
+ samsung,pins = "gpc-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- spi1_bus: spi1-bus {
++ spi1_bus: spi1-bus-pins {
+ samsung,pins = "gpc-4", "gpc-5", "gpc-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- spi1_cs: spi1-cs {
++ spi1_cs: spi1-cs-pins {
+ samsung,pins = "gpc-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd0_cmd: sd0-cmd {
++ sd0_cmd: sd0-cmd-pins {
+ samsung,pins = "gpg-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd0_clk: sd0-clk {
++ sd0_clk: sd0-clk-pins {
+ samsung,pins = "gpg-0";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd0_bus1: sd0-bus1 {
++ sd0_bus1: sd0-bus1-pins {
+ samsung,pins = "gpg-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd0_bus4: sd0-bus4 {
++ sd0_bus4: sd0-bus4-pins {
+ samsung,pins = "gpg-2", "gpg-3", "gpg-4", "gpg-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd0_cd: sd0-cd {
++ sd0_cd: sd0-cd-pins {
+ samsung,pins = "gpg-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- sd1_cmd: sd1-cmd {
++ sd1_cmd: sd1-cmd-pins {
+ samsung,pins = "gph-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd1_clk: sd1-clk {
++ sd1_clk: sd1-clk-pins {
+ samsung,pins = "gph-0";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd1_bus1: sd1-bus1 {
++ sd1_bus1: sd1-bus1-pins {
+ samsung,pins = "gph-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd1_bus4: sd1-bus4 {
++ sd1_bus4: sd1-bus4-pins {
+ samsung,pins = "gph-2", "gph-3", "gph-4", "gph-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd1_bus8: sd1-bus8 {
++ sd1_bus8: sd1-bus8-pins {
+ samsung,pins = "gph-2", "gph-3", "gph-4", "gph-5",
+ "gph-6", "gph-7", "gph-8", "gph-9";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd1_cd: sd1-cd {
++ sd1_cd: sd1-cd-pins {
+ samsung,pins = "gpg-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
+ };
+
+- sd2_cmd: sd2-cmd {
++ sd2_cmd: sd2-cmd-pins {
+ samsung,pins = "gpc-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd2_clk: sd2-clk {
++ sd2_clk: sd2-clk-pins {
+ samsung,pins = "gpc-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd2_bus1: sd2-bus1 {
++ sd2_bus1: sd2-bus1-pins {
+ samsung,pins = "gph-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- sd2_bus4: sd2-bus4 {
++ sd2_bus4: sd2-bus4-pins {
+ samsung,pins = "gph-6", "gph-7", "gph-8", "gph-9";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s0_bus: i2s0-bus {
++ i2s0_bus: i2s0-bus-pins {
+ samsung,pins = "gpd-0", "gpd-2", "gpd-3", "gpd-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s0_cdclk: i2s0-cdclk {
++ i2s0_cdclk: i2s0-cdclk-pins {
+ samsung,pins = "gpd-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s1_bus: i2s1-bus {
++ i2s1_bus: i2s1-bus-pins {
+ samsung,pins = "gpe-0", "gpe-2", "gpe-3", "gpe-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s1_cdclk: i2s1-cdclk {
++ i2s1_cdclk: i2s1-cdclk-pins {
+ samsung,pins = "gpe-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s2_bus: i2s2-bus {
++ i2s2_bus: i2s2-bus-pins {
+ /* S3C6410-only */
+ samsung,pins = "gpc-4", "gpc-5", "gpc-6", "gph-6",
+ "gph-8", "gph-9";
+@@ -357,50 +357,50 @@
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- i2s2_cdclk: i2s2-cdclk {
++ i2s2_cdclk: i2s2-cdclk-pins {
+ /* S3C6410-only */
+ samsung,pins = "gph-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_5>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pcm0_bus: pcm0-bus {
++ pcm0_bus: pcm0-bus-pins {
+ samsung,pins = "gpd-0", "gpd-2", "gpd-3", "gpd-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pcm0_extclk: pcm0-extclk {
++ pcm0_extclk: pcm0-extclk-pins {
+ samsung,pins = "gpd-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pcm1_bus: pcm1-bus {
++ pcm1_bus: pcm1-bus-pins {
+ samsung,pins = "gpe-0", "gpe-2", "gpe-3", "gpe-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pcm1_extclk: pcm1-extclk {
++ pcm1_extclk: pcm1-extclk-pins {
+ samsung,pins = "gpe-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- ac97_bus_0: ac97-bus-0 {
++ ac97_bus_0: ac97-bus-0-pins {
+ samsung,pins = "gpd-0", "gpd-1", "gpd-2", "gpd-3", "gpd-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- ac97_bus_1: ac97-bus-1 {
++ ac97_bus_1: ac97-bus-1-pins {
+ samsung,pins = "gpe-0", "gpe-1", "gpe-2", "gpe-3", "gpe-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- cam_port: cam-port {
++ cam_port: cam-port-pins {
+ samsung,pins = "gpf-0", "gpf-1", "gpf-2", "gpf-4",
+ "gpf-5", "gpf-6", "gpf-7", "gpf-8",
+ "gpf-9", "gpf-10", "gpf-11", "gpf-12";
+@@ -408,242 +408,242 @@
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- cam_rst: cam-rst {
++ cam_rst: cam-rst-pins {
+ samsung,pins = "gpf-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- cam_field: cam-field {
++ cam_field: cam-field-pins {
+ /* S3C6410-only */
+ samsung,pins = "gpb-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pwm_extclk: pwm-extclk {
++ pwm_extclk: pwm-extclk-pins {
+ samsung,pins = "gpf-13";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pwm0_out: pwm0-out {
++ pwm0_out: pwm0-out-pins {
+ samsung,pins = "gpf-14";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- pwm1_out: pwm1-out {
++ pwm1_out: pwm1-out-pins {
+ samsung,pins = "gpf-15";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- clkout0: clkout-0 {
++ clkout0: clkout-0-pins {
+ samsung,pins = "gpf-14";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col0_0: keypad-col0-0 {
++ keypad_col0_0: keypad-col0-0-pins {
+ samsung,pins = "gph-0";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col1_0: keypad-col1-0 {
++ keypad_col1_0: keypad-col1-0-pins {
+ samsung,pins = "gph-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col2_0: keypad-col2-0 {
++ keypad_col2_0: keypad-col2-0-pins {
+ samsung,pins = "gph-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col3_0: keypad-col3-0 {
++ keypad_col3_0: keypad-col3-0-pins {
+ samsung,pins = "gph-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col4_0: keypad-col4-0 {
++ keypad_col4_0: keypad-col4-0-pins {
+ samsung,pins = "gph-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col5_0: keypad-col5-0 {
++ keypad_col5_0: keypad-col5-0-pins {
+ samsung,pins = "gph-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col6_0: keypad-col6-0 {
++ keypad_col6_0: keypad-col6-0-pins {
+ samsung,pins = "gph-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col7_0: keypad-col7-0 {
++ keypad_col7_0: keypad-col7-0-pins {
+ samsung,pins = "gph-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col0_1: keypad-col0-1 {
++ keypad_col0_1: keypad-col0-1-pins {
+ samsung,pins = "gpl-0";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col1_1: keypad-col1-1 {
++ keypad_col1_1: keypad-col1-1-pins {
+ samsung,pins = "gpl-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col2_1: keypad-col2-1 {
++ keypad_col2_1: keypad-col2-1-pins {
+ samsung,pins = "gpl-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col3_1: keypad-col3-1 {
++ keypad_col3_1: keypad-col3-1-pins {
+ samsung,pins = "gpl-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col4_1: keypad-col4-1 {
++ keypad_col4_1: keypad-col4-1-pins {
+ samsung,pins = "gpl-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col5_1: keypad-col5-1 {
++ keypad_col5_1: keypad-col5-1-pins {
+ samsung,pins = "gpl-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col6_1: keypad-col6-1 {
++ keypad_col6_1: keypad-col6-1-pins {
+ samsung,pins = "gpl-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_col7_1: keypad-col7-1 {
++ keypad_col7_1: keypad-col7-1-pins {
+ samsung,pins = "gpl-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row0_0: keypad-row0-0 {
++ keypad_row0_0: keypad-row0-0-pins {
+ samsung,pins = "gpk-8";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row1_0: keypad-row1-0 {
++ keypad_row1_0: keypad-row1-0-pins {
+ samsung,pins = "gpk-9";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row2_0: keypad-row2-0 {
++ keypad_row2_0: keypad-row2-0-pins {
+ samsung,pins = "gpk-10";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row3_0: keypad-row3-0 {
++ keypad_row3_0: keypad-row3-0-pins {
+ samsung,pins = "gpk-11";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row4_0: keypad-row4-0 {
++ keypad_row4_0: keypad-row4-0-pins {
+ samsung,pins = "gpk-12";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row5_0: keypad-row5-0 {
++ keypad_row5_0: keypad-row5-0-pins {
+ samsung,pins = "gpk-13";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row6_0: keypad-row6-0 {
++ keypad_row6_0: keypad-row6-0-pins {
+ samsung,pins = "gpk-14";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row7_0: keypad-row7-0 {
++ keypad_row7_0: keypad-row7-0-pins {
+ samsung,pins = "gpk-15";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row0_1: keypad-row0-1 {
++ keypad_row0_1: keypad-row0-1-pins {
+ samsung,pins = "gpn-0";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row1_1: keypad-row1-1 {
++ keypad_row1_1: keypad-row1-1-pins {
+ samsung,pins = "gpn-1";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row2_1: keypad-row2-1 {
++ keypad_row2_1: keypad-row2-1-pins {
+ samsung,pins = "gpn-2";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row3_1: keypad-row3-1 {
++ keypad_row3_1: keypad-row3-1-pins {
+ samsung,pins = "gpn-3";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row4_1: keypad-row4-1 {
++ keypad_row4_1: keypad-row4-1-pins {
+ samsung,pins = "gpn-4";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row5_1: keypad-row5-1 {
++ keypad_row5_1: keypad-row5-1-pins {
+ samsung,pins = "gpn-5";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row6_1: keypad-row6-1 {
++ keypad_row6_1: keypad-row6-1-pins {
+ samsung,pins = "gpn-6";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- keypad_row7_1: keypad-row7-1 {
++ keypad_row7_1: keypad-row7-1-pins {
+ samsung,pins = "gpn-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- lcd_ctrl: lcd-ctrl {
++ lcd_ctrl: lcd-ctrl-pins {
+ samsung,pins = "gpj-8", "gpj-9", "gpj-10", "gpj-11";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- lcd_data16: lcd-data-width16 {
++ lcd_data16: lcd-data-width16-pins {
+ samsung,pins = "gpi-3", "gpi-4", "gpi-5", "gpi-6",
+ "gpi-7", "gpi-10", "gpi-11", "gpi-12",
+ "gpi-13", "gpi-14", "gpi-15", "gpj-3",
+@@ -652,7 +652,7 @@
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- lcd_data18: lcd-data-width18 {
++ lcd_data18: lcd-data-width18-pins {
+ samsung,pins = "gpi-2", "gpi-3", "gpi-4", "gpi-5",
+ "gpi-6", "gpi-7", "gpi-10", "gpi-11",
+ "gpi-12", "gpi-13", "gpi-14", "gpi-15",
+@@ -662,7 +662,7 @@
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- lcd_data24: lcd-data-width24 {
++ lcd_data24: lcd-data-width24-pins {
+ samsung,pins = "gpi-0", "gpi-1", "gpi-2", "gpi-3",
+ "gpi-4", "gpi-5", "gpi-6", "gpi-7",
+ "gpi-8", "gpi-9", "gpi-10", "gpi-11",
+@@ -673,7 +673,7 @@
+ samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
+ };
+
+- hsi_bus: hsi-bus {
++ hsi_bus: hsi-bus-pins {
+ samsung,pins = "gpk-0", "gpk-1", "gpk-2", "gpk-3",
+ "gpk-4", "gpk-5", "gpk-6", "gpk-7";
+ samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
+diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+index 84b38f1851991..53a841ecf7a44 100644
+--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts
++++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts
+@@ -15,6 +15,7 @@
+ */
+
+ /dts-v1/;
++#include <dt-bindings/interrupt-controller/irq.h>
+ #include <dt-bindings/input/input.h>
+ #include "s5pv210.dtsi"
+
+@@ -31,11 +32,18 @@
+ reg = <0x20000000 0x40000000>;
+ };
+
+- ethernet@18000000 {
++ pmic_ap_clk: clock-0 {
++ /* Workaround for missing PMIC and its clock */
++ compatible = "fixed-clock";
++ #clock-cells = <0>;
++ clock-frequency = <32768>;
++ };
++
++ ethernet@a8000000 {
+ compatible = "davicom,dm9000";
+- reg = <0xA8000000 0x2 0xA8000002 0x2>;
++ reg = <0xa8000000 0x2>, <0xa8000002 0x2>;
+ interrupt-parent = <&gph1>;
+- interrupts = <1 4>;
++ interrupts = <1 IRQ_TYPE_LEVEL_HIGH>;
+ local-mac-address = [00 00 de ad be ef];
+ davicom,no-eeprom;
+ };
+@@ -47,6 +55,14 @@
+ default-brightness-level = <6>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pwm3_out>;
++ power-supply = <&dc5v_reg>;
++ };
++
++ dc5v_reg: regulator-0 {
++ compatible = "regulator-fixed";
++ regulator-name = "DC5V";
++ regulator-min-microvolt = <5000000>;
++ regulator-max-microvolt = <5000000>;
+ };
+ };
+
+@@ -147,6 +163,8 @@
+
+ &rtc {
+ status = "okay";
++ clocks = <&clocks CLK_RTC>, <&pmic_ap_clk>;
++ clock-names = "rtc", "rtc_src";
+ };
+
+ &sdhci0 {
+diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
+index 2ee5b7f5e7ad0..c71ecd06131ca 100644
+--- a/arch/arm/kernel/hw_breakpoint.c
++++ b/arch/arm/kernel/hw_breakpoint.c
+@@ -631,7 +631,7 @@ int hw_breakpoint_arch_parse(struct perf_event *bp,
+ hw->address &= ~alignment_mask;
+ hw->ctrl.len <<= offset;
+
+- if (is_default_overflow_handler(bp)) {
++ if (uses_default_overflow_handler(bp)) {
+ /*
+ * Mismatch breakpoints are required for single-stepping
+ * breakpoints.
+@@ -803,7 +803,7 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
+ * Otherwise, insert a temporary mismatch breakpoint so that
+ * we can single-step over the watchpoint trigger.
+ */
+- if (!is_default_overflow_handler(wp))
++ if (!uses_default_overflow_handler(wp))
+ continue;
+ step:
+ enable_single_step(wp, instruction_pointer(regs));
+@@ -816,7 +816,7 @@ step:
+ info->trigger = addr;
+ pr_debug("watchpoint fired: address = 0x%x\n", info->trigger);
+ perf_bp_event(wp, regs);
+- if (is_default_overflow_handler(wp))
++ if (uses_default_overflow_handler(wp))
+ enable_single_step(wp, instruction_pointer(regs));
+ }
+
+@@ -891,7 +891,7 @@ static void breakpoint_handler(unsigned long unknown, struct pt_regs *regs)
+ info->trigger = addr;
+ pr_debug("breakpoint fired: address = 0x%x\n", addr);
+ perf_bp_event(bp, regs);
+- if (is_default_overflow_handler(bp))
++ if (uses_default_overflow_handler(bp))
+ enable_single_step(bp, addr);
+ goto unlock;
+ }
+diff --git a/arch/arm/mach-omap2/powerdomain.c b/arch/arm/mach-omap2/powerdomain.c
+index 1a0f69c0a3763..27c652eaa1755 100644
+--- a/arch/arm/mach-omap2/powerdomain.c
++++ b/arch/arm/mach-omap2/powerdomain.c
+@@ -177,7 +177,7 @@ static int _pwrdm_state_switch(struct powerdomain *pwrdm, int flag)
+ break;
+ case PWRDM_STATE_PREV:
+ prev = pwrdm_read_prev_pwrst(pwrdm);
+- if (pwrdm->state != prev)
++ if (prev >= 0 && pwrdm->state != prev)
+ pwrdm->state_counter[prev]++;
+ if (prev == PWRDM_POWER_RET)
+ _update_logic_membank_counters(pwrdm);
+diff --git a/arch/arm/mach-pxa/sharpsl_pm.c b/arch/arm/mach-pxa/sharpsl_pm.c
+index ef9fd9b759cbd..34dc870857245 100644
+--- a/arch/arm/mach-pxa/sharpsl_pm.c
++++ b/arch/arm/mach-pxa/sharpsl_pm.c
+@@ -224,8 +224,6 @@ void sharpsl_battery_kick(void)
+ {
+ schedule_delayed_work(&sharpsl_bat, msecs_to_jiffies(125));
+ }
+-EXPORT_SYMBOL(sharpsl_battery_kick);
+-
+
+ static void sharpsl_battery_thread(struct work_struct *private_)
+ {
+diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
+index 5d50025492b7f..af35a0ba2dca3 100644
+--- a/arch/arm/mach-pxa/spitz.c
++++ b/arch/arm/mach-pxa/spitz.c
+@@ -13,7 +13,6 @@
+ */
+
+ #include <linux/kernel.h>
+-#include <linux/module.h> /* symbol_get ; symbol_put */
+ #include <linux/platform_device.h>
+ #include <linux/delay.h>
+ #include <linux/gpio_keys.h>
+@@ -517,17 +516,6 @@ static struct pxa2xx_spi_chip spitz_ads7846_chip = {
+ .gpio_cs = SPITZ_GPIO_ADS7846_CS,
+ };
+
+-static void spitz_bl_kick_battery(void)
+-{
+- void (*kick_batt)(void);
+-
+- kick_batt = symbol_get(sharpsl_battery_kick);
+- if (kick_batt) {
+- kick_batt();
+- symbol_put(sharpsl_battery_kick);
+- }
+-}
+-
+ static struct corgi_lcd_platform_data spitz_lcdcon_info = {
+ .init_mode = CORGI_LCD_MODE_VGA,
+ .max_intensity = 0x2f,
+@@ -535,7 +523,7 @@ static struct corgi_lcd_platform_data spitz_lcdcon_info = {
+ .limit_mask = 0x0b,
+ .gpio_backlight_cont = SPITZ_GPIO_BACKLIGHT_CONT,
+ .gpio_backlight_on = SPITZ_GPIO_BACKLIGHT_ON,
+- .kick_battery = spitz_bl_kick_battery,
++ .kick_battery = sharpsl_battery_kick,
+ };
+
+ static struct pxa2xx_spi_chip spitz_lcdcon_chip = {
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 3e7baabf64507..4ee32583dc7c5 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -382,6 +382,8 @@
+ reg = <0x4a9000 0x1000>, /* TM */
+ <0x4a8000 0x1000>; /* SROT */
+ #qcom,sensors = <13>;
++ interrupts = <GIC_SPI 458 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "uplow";
+ #thermal-sensor-cells = <1>;
+ };
+
+@@ -390,6 +392,8 @@
+ reg = <0x4ad000 0x1000>, /* TM */
+ <0x4ac000 0x1000>; /* SROT */
+ #qcom,sensors = <8>;
++ interrupts = <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "uplow";
+ #thermal-sensor-cells = <1>;
+ };
+
+@@ -899,6 +903,9 @@
+ #size-cells = <1>;
+ ranges;
+
++ interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "hs_phy_irq";
++
+ clocks = <&gcc GCC_PERIPH_NOC_USB20_AHB_CLK>,
+ <&gcc GCC_USB20_MASTER_CLK>,
+ <&gcc GCC_USB20_MOCK_UTMI_CLK>,
+diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
+index 9f105fe58595d..5d120e39bf61a 100644
+--- a/arch/arm64/kernel/hw_breakpoint.c
++++ b/arch/arm64/kernel/hw_breakpoint.c
+@@ -661,7 +661,7 @@ static int breakpoint_handler(unsigned long unused, unsigned int esr,
+ perf_bp_event(bp, regs);
+
+ /* Do we need to handle the stepping? */
+- if (is_default_overflow_handler(bp))
++ if (uses_default_overflow_handler(bp))
+ step = 1;
+ unlock:
+ rcu_read_unlock();
+@@ -740,7 +740,7 @@ static u64 get_distance_from_watchpoint(unsigned long addr, u64 val,
+ static int watchpoint_report(struct perf_event *wp, unsigned long addr,
+ struct pt_regs *regs)
+ {
+- int step = is_default_overflow_handler(wp);
++ int step = uses_default_overflow_handler(wp);
+ struct arch_hw_breakpoint *info = counter_arch_bp(wp);
+
+ info->trigger = addr;
+diff --git a/arch/m68k/fpsp040/skeleton.S b/arch/m68k/fpsp040/skeleton.S
+index a8f41615d94a7..31a9c634c81ed 100644
+--- a/arch/m68k/fpsp040/skeleton.S
++++ b/arch/m68k/fpsp040/skeleton.S
+@@ -499,12 +499,12 @@ in_ea:
+ dbf %d0,morein
+ rts
+
+- .section .fixup,#alloc,#execinstr
++ .section .fixup,"ax"
+ .even
+ 1:
+ jbra fpsp040_die
+
+- .section __ex_table,#alloc
++ .section __ex_table,"a"
+ .align 4
+
+ .long in_ea,1b
+diff --git a/arch/m68k/ifpsp060/os.S b/arch/m68k/ifpsp060/os.S
+index 7a0d6e4280665..89e2ec224ab6c 100644
+--- a/arch/m68k/ifpsp060/os.S
++++ b/arch/m68k/ifpsp060/os.S
+@@ -379,11 +379,11 @@ _060_real_access:
+
+
+ | Execption handling for movs access to illegal memory
+- .section .fixup,#alloc,#execinstr
++ .section .fixup,"ax"
+ .even
+ 1: moveq #-1,%d1
+ rts
+-.section __ex_table,#alloc
++.section __ex_table,"a"
+ .align 4
+ .long dmrbuae,1b
+ .long dmrwuae,1b
+diff --git a/arch/m68k/kernel/relocate_kernel.S b/arch/m68k/kernel/relocate_kernel.S
+index ab0f1e7d46535..f7667079e08e9 100644
+--- a/arch/m68k/kernel/relocate_kernel.S
++++ b/arch/m68k/kernel/relocate_kernel.S
+@@ -26,7 +26,7 @@ ENTRY(relocate_new_kernel)
+ lea %pc@(.Lcopy),%a4
+ 2: addl #0x00000000,%a4 /* virt_to_phys() */
+
+- .section ".m68k_fixup","aw"
++ .section .m68k_fixup,"aw"
+ .long M68K_FIXUP_MEMOFFSET, 2b+2
+ .previous
+
+@@ -49,7 +49,7 @@ ENTRY(relocate_new_kernel)
+ lea %pc@(.Lcont040),%a4
+ 5: addl #0x00000000,%a4 /* virt_to_phys() */
+
+- .section ".m68k_fixup","aw"
++ .section .m68k_fixup,"aw"
+ .long M68K_FIXUP_MEMOFFSET, 5b+2
+ .previous
+
+diff --git a/arch/mips/alchemy/devboards/db1000.c b/arch/mips/alchemy/devboards/db1000.c
+index 13e3c84859fe7..6fe0f0f95ed7c 100644
+--- a/arch/mips/alchemy/devboards/db1000.c
++++ b/arch/mips/alchemy/devboards/db1000.c
+@@ -27,7 +27,6 @@
+ #include <linux/interrupt.h>
+ #include <linux/leds.h>
+ #include <linux/mmc/host.h>
+-#include <linux/module.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm.h>
+ #include <linux/spi/spi.h>
+@@ -176,12 +175,7 @@ static struct platform_device db1x00_audio_dev = {
+
+ static irqreturn_t db1100_mmc_cd(int irq, void *ptr)
+ {
+- void (*mmc_cd)(struct mmc_host *, unsigned long);
+- /* link against CONFIG_MMC=m */
+- mmc_cd = symbol_get(mmc_detect_change);
+- mmc_cd(ptr, msecs_to_jiffies(500));
+- symbol_put(mmc_detect_change);
+-
++ mmc_detect_change(ptr, msecs_to_jiffies(500));
+ return IRQ_HANDLED;
+ }
+
+diff --git a/arch/mips/alchemy/devboards/db1200.c b/arch/mips/alchemy/devboards/db1200.c
+index da76637704253..ae81e05fcb2c9 100644
+--- a/arch/mips/alchemy/devboards/db1200.c
++++ b/arch/mips/alchemy/devboards/db1200.c
+@@ -23,7 +23,6 @@
+ #include <linux/gpio.h>
+ #include <linux/i2c.h>
+ #include <linux/init.h>
+-#include <linux/module.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+ #include <linux/leds.h>
+@@ -355,14 +354,7 @@ static irqreturn_t db1200_mmc_cd(int irq, void *ptr)
+
+ static irqreturn_t db1200_mmc_cdfn(int irq, void *ptr)
+ {
+- void (*mmc_cd)(struct mmc_host *, unsigned long);
+-
+- /* link against CONFIG_MMC=m */
+- mmc_cd = symbol_get(mmc_detect_change);
+- if (mmc_cd) {
+- mmc_cd(ptr, msecs_to_jiffies(200));
+- symbol_put(mmc_detect_change);
+- }
++ mmc_detect_change(ptr, msecs_to_jiffies(200));
+
+ msleep(100); /* debounce */
+ if (irq == DB1200_SD0_INSERT_INT)
+@@ -446,14 +438,7 @@ static irqreturn_t pb1200_mmc1_cd(int irq, void *ptr)
+
+ static irqreturn_t pb1200_mmc1_cdfn(int irq, void *ptr)
+ {
+- void (*mmc_cd)(struct mmc_host *, unsigned long);
+-
+- /* link against CONFIG_MMC=m */
+- mmc_cd = symbol_get(mmc_detect_change);
+- if (mmc_cd) {
+- mmc_cd(ptr, msecs_to_jiffies(200));
+- symbol_put(mmc_detect_change);
+- }
++ mmc_detect_change(ptr, msecs_to_jiffies(200));
+
+ msleep(100); /* debounce */
+ if (irq == PB1200_SD1_INSERT_INT)
+diff --git a/arch/mips/alchemy/devboards/db1300.c b/arch/mips/alchemy/devboards/db1300.c
+index efb318e03e0a3..0c12fbc07117a 100644
+--- a/arch/mips/alchemy/devboards/db1300.c
++++ b/arch/mips/alchemy/devboards/db1300.c
+@@ -17,7 +17,6 @@
+ #include <linux/interrupt.h>
+ #include <linux/ata_platform.h>
+ #include <linux/mmc/host.h>
+-#include <linux/module.h>
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/rawnand.h>
+ #include <linux/mtd/partitions.h>
+@@ -457,14 +456,7 @@ static irqreturn_t db1300_mmc_cd(int irq, void *ptr)
+
+ static irqreturn_t db1300_mmc_cdfn(int irq, void *ptr)
+ {
+- void (*mmc_cd)(struct mmc_host *, unsigned long);
+-
+- /* link against CONFIG_MMC=m. We can only be called once MMC core has
+- * initialized the controller, so symbol_get() should always succeed.
+- */
+- mmc_cd = symbol_get(mmc_detect_change);
+- mmc_cd(ptr, msecs_to_jiffies(200));
+- symbol_put(mmc_detect_change);
++ mmc_detect_change(ptr, msecs_to_jiffies(200));
+
+ msleep(100); /* debounce */
+ if (irq == DB1300_SD1_INSERT_INT)
+diff --git a/arch/parisc/include/asm/led.h b/arch/parisc/include/asm/led.h
+index 6de13d08a3886..b70b9094fb7cd 100644
+--- a/arch/parisc/include/asm/led.h
++++ b/arch/parisc/include/asm/led.h
+@@ -11,8 +11,8 @@
+ #define LED1 0x02
+ #define LED0 0x01 /* bottom (or furthest left) LED */
+
+-#define LED_LAN_TX LED0 /* for LAN transmit activity */
+-#define LED_LAN_RCV LED1 /* for LAN receive activity */
++#define LED_LAN_RCV LED0 /* for LAN receive activity */
++#define LED_LAN_TX LED1 /* for LAN transmit activity */
+ #define LED_DISK_IO LED2 /* for disk activity */
+ #define LED_HEARTBEAT LED3 /* heartbeat */
+
+diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h
+index 2bd5e695bdadd..0e6cac0ece5cd 100644
+--- a/arch/parisc/include/asm/processor.h
++++ b/arch/parisc/include/asm/processor.h
+@@ -108,7 +108,6 @@ struct cpuinfo_parisc {
+ unsigned long cpu_loc; /* CPU location from PAT firmware */
+ unsigned int state;
+ struct parisc_device *dev;
+- unsigned long loops_per_jiffy;
+ };
+
+ extern struct system_cpuinfo_parisc boot_cpu_data;
+diff --git a/arch/parisc/kernel/processor.c b/arch/parisc/kernel/processor.c
+index 0b0194150b682..be3618b2c67b3 100644
+--- a/arch/parisc/kernel/processor.c
++++ b/arch/parisc/kernel/processor.c
+@@ -177,7 +177,6 @@ static int __init processor_probe(struct parisc_device *dev)
+ if (cpuid)
+ memset(p, 0, sizeof(struct cpuinfo_parisc));
+
+- p->loops_per_jiffy = loops_per_jiffy;
+ p->dev = dev; /* Save IODC data in case we need it */
+ p->hpa = dev->hpa.start; /* save CPU hpa */
+ p->cpuid = cpuid; /* save CPU id */
+@@ -377,10 +376,18 @@ int
+ show_cpuinfo (struct seq_file *m, void *v)
+ {
+ unsigned long cpu;
++ char cpu_name[60], *p;
++
++ /* strip PA path from CPU name to not confuse lscpu */
++ strlcpy(cpu_name, per_cpu(cpu_data, 0).dev->name, sizeof(cpu_name));
++ p = strrchr(cpu_name, '[');
++ if (p)
++ *(--p) = 0;
+
+ for_each_online_cpu(cpu) {
+- const struct cpuinfo_parisc *cpuinfo = &per_cpu(cpu_data, cpu);
+ #ifdef CONFIG_SMP
++ const struct cpuinfo_parisc *cpuinfo = &per_cpu(cpu_data, cpu);
++
+ if (0 == cpuinfo->hpa)
+ continue;
+ #endif
+@@ -425,8 +432,7 @@ show_cpuinfo (struct seq_file *m, void *v)
+
+ seq_printf(m, "model\t\t: %s - %s\n",
+ boot_cpu_data.pdc.sys_model_name,
+- cpuinfo->dev ?
+- cpuinfo->dev->name : "Unknown");
++ cpu_name);
+
+ seq_printf(m, "hversion\t: 0x%08x\n"
+ "sversion\t: 0x%08x\n",
+@@ -437,8 +443,8 @@ show_cpuinfo (struct seq_file *m, void *v)
+ show_cache_info(m);
+
+ seq_printf(m, "bogomips\t: %lu.%02lu\n",
+- cpuinfo->loops_per_jiffy / (500000 / HZ),
+- (cpuinfo->loops_per_jiffy / (5000 / HZ)) % 100);
++ loops_per_jiffy / (500000 / HZ),
++ loops_per_jiffy / (5000 / HZ) % 100);
+
+ seq_printf(m, "software id\t: %ld\n\n",
+ boot_cpu_data.pdc.model.sw_id);
+diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S
+index 61ca27929355a..53a379da17e97 100644
+--- a/arch/powerpc/kernel/head_32.S
++++ b/arch/powerpc/kernel/head_32.S
+@@ -987,7 +987,7 @@ start_here:
+ */
+ lis r5, abatron_pteptrs@h
+ ori r5, r5, abatron_pteptrs@l
+- stw r5, 0xf0(r0) /* This much match your Abatron config */
++ stw r5, 0xf0(0) /* This much match your Abatron config */
+ lis r6, swapper_pg_dir@h
+ ori r6, r6, swapper_pg_dir@l
+ tophys(r5, r5)
+diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
+index c3d2d5cd7c10c..af1a2bf758c5c 100644
+--- a/arch/powerpc/kernel/iommu.c
++++ b/arch/powerpc/kernel/iommu.c
+@@ -145,17 +145,28 @@ static int fail_iommu_bus_notify(struct notifier_block *nb,
+ return 0;
+ }
+
+-static struct notifier_block fail_iommu_bus_notifier = {
++/*
++ * PCI and VIO buses need separate notifier_block structs, since they're linked
++ * list nodes. Sharing a notifier_block would mean that any notifiers later
++ * registered for PCI buses would also get called by VIO buses and vice versa.
++ */
++static struct notifier_block fail_iommu_pci_bus_notifier = {
+ .notifier_call = fail_iommu_bus_notify
+ };
+
++#ifdef CONFIG_IBMVIO
++static struct notifier_block fail_iommu_vio_bus_notifier = {
++ .notifier_call = fail_iommu_bus_notify
++};
++#endif
++
+ static int __init fail_iommu_setup(void)
+ {
+ #ifdef CONFIG_PCI
+- bus_register_notifier(&pci_bus_type, &fail_iommu_bus_notifier);
++ bus_register_notifier(&pci_bus_type, &fail_iommu_pci_bus_notifier);
+ #endif
+ #ifdef CONFIG_IBMVIO
+- bus_register_notifier(&vio_bus_type, &fail_iommu_bus_notifier);
++ bus_register_notifier(&vio_bus_type, &fail_iommu_vio_bus_notifier);
+ #endif
+
+ return 0;
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 9b346f3d2814c..737a4698bd5e7 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -328,6 +328,7 @@ SECTIONS
+ *(.sdata2)
+ *(.got.plt) *(.got)
+ *(.plt)
++ *(.branch_lt)
+ }
+ #else
+ .data : AT(ADDR(.data) - LOAD_OFFSET) {
+diff --git a/arch/powerpc/platforms/pseries/ibmebus.c b/arch/powerpc/platforms/pseries/ibmebus.c
+index c7c1140c13b6c..3fce7508a4fc6 100644
+--- a/arch/powerpc/platforms/pseries/ibmebus.c
++++ b/arch/powerpc/platforms/pseries/ibmebus.c
+@@ -452,6 +452,7 @@ static int __init ibmebus_bus_init(void)
+ if (err) {
+ printk(KERN_WARNING "%s: device_register returned %i\n",
+ __func__, err);
++ put_device(&ibmebus_bus_device);
+ bus_unregister(&ibmebus_bus_type);
+
+ return err;
+diff --git a/arch/um/configs/i386_defconfig b/arch/um/configs/i386_defconfig
+index 8f114e3b0a7a3..8d06b799a0e4e 100644
+--- a/arch/um/configs/i386_defconfig
++++ b/arch/um/configs/i386_defconfig
+@@ -35,6 +35,7 @@ CONFIG_TTY_CHAN=y
+ CONFIG_XTERM_CHAN=y
+ CONFIG_CON_CHAN="pts"
+ CONFIG_SSL_CHAN="pts"
++CONFIG_SOUND=m
+ CONFIG_UML_SOUND=m
+ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+ CONFIG_DEVTMPFS=y
+diff --git a/arch/um/configs/x86_64_defconfig b/arch/um/configs/x86_64_defconfig
+index 5d0875fc0db25..446bdda4cbfb6 100644
+--- a/arch/um/configs/x86_64_defconfig
++++ b/arch/um/configs/x86_64_defconfig
+@@ -33,6 +33,7 @@ CONFIG_TTY_CHAN=y
+ CONFIG_XTERM_CHAN=y
+ CONFIG_CON_CHAN="pts"
+ CONFIG_SSL_CHAN="pts"
++CONFIG_SOUND=m
+ CONFIG_UML_SOUND=m
+ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+ CONFIG_DEVTMPFS=y
+diff --git a/arch/um/drivers/Kconfig b/arch/um/drivers/Kconfig
+index 2b1aaf7755aac..494f7c27056e3 100644
+--- a/arch/um/drivers/Kconfig
++++ b/arch/um/drivers/Kconfig
+@@ -11,58 +11,58 @@ config STDERR_CONSOLE
+ config SSL
+ bool "Virtual serial line"
+ help
+- The User-Mode Linux environment allows you to create virtual serial
+- lines on the UML that are usually made to show up on the host as
+- ttys or ptys.
++ The User-Mode Linux environment allows you to create virtual serial
++ lines on the UML that are usually made to show up on the host as
++ ttys or ptys.
+
+- See <http://user-mode-linux.sourceforge.net/old/input.html> for more
+- information and command line examples of how to use this facility.
++ See <http://user-mode-linux.sourceforge.net/old/input.html> for more
++ information and command line examples of how to use this facility.
+
+- Unless you have a specific reason for disabling this, say Y.
++ Unless you have a specific reason for disabling this, say Y.
+
+ config NULL_CHAN
+ bool "null channel support"
+ help
+- This option enables support for attaching UML consoles and serial
+- lines to a device similar to /dev/null. Data written to it disappears
+- and there is never any data to be read.
++ This option enables support for attaching UML consoles and serial
++ lines to a device similar to /dev/null. Data written to it disappears
++ and there is never any data to be read.
+
+ config PORT_CHAN
+ bool "port channel support"
+ help
+- This option enables support for attaching UML consoles and serial
+- lines to host portals. They may be accessed with 'telnet <host>
+- <port number>'. Any number of consoles and serial lines may be
+- attached to a single portal, although what UML device you get when
+- you telnet to that portal will be unpredictable.
+- It is safe to say 'Y' here.
++ This option enables support for attaching UML consoles and serial
++ lines to host portals. They may be accessed with 'telnet <host>
++ <port number>'. Any number of consoles and serial lines may be
++ attached to a single portal, although what UML device you get when
++ you telnet to that portal will be unpredictable.
++ It is safe to say 'Y' here.
+
+ config PTY_CHAN
+ bool "pty channel support"
+ help
+- This option enables support for attaching UML consoles and serial
+- lines to host pseudo-terminals. Access to both traditional
+- pseudo-terminals (/dev/pty*) and pts pseudo-terminals are controlled
+- with this option. The assignment of UML devices to host devices
+- will be announced in the kernel message log.
+- It is safe to say 'Y' here.
++ This option enables support for attaching UML consoles and serial
++ lines to host pseudo-terminals. Access to both traditional
++ pseudo-terminals (/dev/pty*) and pts pseudo-terminals are controlled
++ with this option. The assignment of UML devices to host devices
++ will be announced in the kernel message log.
++ It is safe to say 'Y' here.
+
+ config TTY_CHAN
+ bool "tty channel support"
+ help
+- This option enables support for attaching UML consoles and serial
+- lines to host terminals. Access to both virtual consoles
+- (/dev/tty*) and the slave side of pseudo-terminals (/dev/ttyp* and
+- /dev/pts/*) are controlled by this option.
+- It is safe to say 'Y' here.
++ This option enables support for attaching UML consoles and serial
++ lines to host terminals. Access to both virtual consoles
++ (/dev/tty*) and the slave side of pseudo-terminals (/dev/ttyp* and
++ /dev/pts/*) are controlled by this option.
++ It is safe to say 'Y' here.
+
+ config XTERM_CHAN
+ bool "xterm channel support"
+ help
+- This option enables support for attaching UML consoles and serial
+- lines to xterms. Each UML device so assigned will be brought up in
+- its own xterm.
+- It is safe to say 'Y' here.
++ This option enables support for attaching UML consoles and serial
++ lines to xterms. Each UML device so assigned will be brought up in
++ its own xterm.
++ It is safe to say 'Y' here.
+
+ config NOCONFIG_CHAN
+ bool
+@@ -72,55 +72,45 @@ config CON_ZERO_CHAN
+ string "Default main console channel initialization"
+ default "fd:0,fd:1"
+ help
+- This is the string describing the channel to which the main console
+- will be attached by default. This value can be overridden from the
+- command line. The default value is "fd:0,fd:1", which attaches the
+- main console to stdin and stdout.
+- It is safe to leave this unchanged.
++ This is the string describing the channel to which the main console
++ will be attached by default. This value can be overridden from the
++ command line. The default value is "fd:0,fd:1", which attaches the
++ main console to stdin and stdout.
++ It is safe to leave this unchanged.
+
+ config CON_CHAN
+ string "Default console channel initialization"
+ default "xterm"
+ help
+- This is the string describing the channel to which all consoles
+- except the main console will be attached by default. This value can
+- be overridden from the command line. The default value is "xterm",
+- which brings them up in xterms.
+- It is safe to leave this unchanged, although you may wish to change
+- this if you expect the UML that you build to be run in environments
+- which don't have X or xterm available.
++ This is the string describing the channel to which all consoles
++ except the main console will be attached by default. This value can
++ be overridden from the command line. The default value is "xterm",
++ which brings them up in xterms.
++ It is safe to leave this unchanged, although you may wish to change
++ this if you expect the UML that you build to be run in environments
++ which don't have X or xterm available.
+
+ config SSL_CHAN
+ string "Default serial line channel initialization"
+ default "pty"
+ help
+- This is the string describing the channel to which the serial lines
+- will be attached by default. This value can be overridden from the
+- command line. The default value is "pty", which attaches them to
+- traditional pseudo-terminals.
+- It is safe to leave this unchanged, although you may wish to change
+- this if you expect the UML that you build to be run in environments
+- which don't have a set of /dev/pty* devices.
++ This is the string describing the channel to which the serial lines
++ will be attached by default. This value can be overridden from the
++ command line. The default value is "pty", which attaches them to
++ traditional pseudo-terminals.
++ It is safe to leave this unchanged, although you may wish to change
++ this if you expect the UML that you build to be run in environments
++ which don't have a set of /dev/pty* devices.
+
+ config UML_SOUND
+ tristate "Sound support"
++ depends on SOUND
++ select SOUND_OSS_CORE
+ help
+- This option enables UML sound support. If enabled, it will pull in
+- soundcore and the UML hostaudio relay, which acts as a intermediary
+- between the host's dsp and mixer devices and the UML sound system.
+- It is safe to say 'Y' here.
+-
+-config SOUND
+- tristate
+- default UML_SOUND
+-
+-config SOUND_OSS_CORE
+- bool
+- default UML_SOUND
+-
+-config HOSTAUDIO
+- tristate
+- default UML_SOUND
++ This option enables UML sound support. If enabled, it will pull in
++ the UML hostaudio relay, which acts as a intermediary
++ between the host's dsp and mixer devices and the UML sound system.
++ It is safe to say 'Y' here.
+
+ endmenu
+
+@@ -131,107 +121,107 @@ menu "UML Network Devices"
+ config UML_NET
+ bool "Virtual network device"
+ help
+- While the User-Mode port cannot directly talk to any physical
+- hardware devices, this choice and the following transport options
+- provide one or more virtual network devices through which the UML
+- kernels can talk to each other, the host, and with the host's help,
+- machines on the outside world.
++ While the User-Mode port cannot directly talk to any physical
++ hardware devices, this choice and the following transport options
++ provide one or more virtual network devices through which the UML
++ kernels can talk to each other, the host, and with the host's help,
++ machines on the outside world.
+
+- For more information, including explanations of the networking and
+- sample configurations, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html>.
++ For more information, including explanations of the networking and
++ sample configurations, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html>.
+
+- If you'd like to be able to enable networking in the User-Mode
+- linux environment, say Y; otherwise say N. Note that you must
+- enable at least one of the following transport options to actually
+- make use of UML networking.
++ If you'd like to be able to enable networking in the User-Mode
++ linux environment, say Y; otherwise say N. Note that you must
++ enable at least one of the following transport options to actually
++ make use of UML networking.
+
+ config UML_NET_ETHERTAP
+ bool "Ethertap transport"
+ depends on UML_NET
+ help
+- The Ethertap User-Mode Linux network transport allows a single
+- running UML to exchange packets with its host over one of the
+- host's Ethertap devices, such as /dev/tap0. Additional running
+- UMLs can use additional Ethertap devices, one per running UML.
+- While the UML believes it's on a (multi-device, broadcast) virtual
+- Ethernet network, it's in fact communicating over a point-to-point
+- link with the host.
+-
+- To use this, your host kernel must have support for Ethertap
+- devices. Also, if your host kernel is 2.4.x, it must have
+- CONFIG_NETLINK_DEV configured as Y or M.
+-
+- For more information, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html> That site
+- has examples of the UML command line to use to enable Ethertap
+- networking.
+-
+- If you'd like to set up an IP network with the host and/or the
+- outside world, say Y to this, the Daemon Transport and/or the
+- Slip Transport. You'll need at least one of them, but may choose
+- more than one without conflict. If you don't need UML networking,
+- say N.
++ The Ethertap User-Mode Linux network transport allows a single
++ running UML to exchange packets with its host over one of the
++ host's Ethertap devices, such as /dev/tap0. Additional running
++ UMLs can use additional Ethertap devices, one per running UML.
++ While the UML believes it's on a (multi-device, broadcast) virtual
++ Ethernet network, it's in fact communicating over a point-to-point
++ link with the host.
++
++ To use this, your host kernel must have support for Ethertap
++ devices. Also, if your host kernel is 2.4.x, it must have
++ CONFIG_NETLINK_DEV configured as Y or M.
++
++ For more information, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html> That site
++ has examples of the UML command line to use to enable Ethertap
++ networking.
++
++ If you'd like to set up an IP network with the host and/or the
++ outside world, say Y to this, the Daemon Transport and/or the
++ Slip Transport. You'll need at least one of them, but may choose
++ more than one without conflict. If you don't need UML networking,
++ say N.
+
+ config UML_NET_TUNTAP
+ bool "TUN/TAP transport"
+ depends on UML_NET
+ help
+- The UML TUN/TAP network transport allows a UML instance to exchange
+- packets with the host over a TUN/TAP device. This option will only
+- work with a 2.4 host, unless you've applied the TUN/TAP patch to
+- your 2.2 host kernel.
++ The UML TUN/TAP network transport allows a UML instance to exchange
++ packets with the host over a TUN/TAP device. This option will only
++ work with a 2.4 host, unless you've applied the TUN/TAP patch to
++ your 2.2 host kernel.
+
+- To use this transport, your host kernel must have support for TUN/TAP
+- devices, either built-in or as a module.
++ To use this transport, your host kernel must have support for TUN/TAP
++ devices, either built-in or as a module.
+
+ config UML_NET_SLIP
+ bool "SLIP transport"
+ depends on UML_NET
+ help
+- The slip User-Mode Linux network transport allows a running UML to
+- network with its host over a point-to-point link. Unlike Ethertap,
+- which can carry any Ethernet frame (and hence even non-IP packets),
+- the slip transport can only carry IP packets.
+-
+- To use this, your host must support slip devices.
+-
+- For more information, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html>.
+- has examples of the UML command line to use to enable slip
+- networking, and details of a few quirks with it.
+-
+- The Ethertap Transport is preferred over slip because of its
+- limitations. If you prefer slip, however, say Y here. Otherwise
+- choose the Multicast transport (to network multiple UMLs on
+- multiple hosts), Ethertap (to network with the host and the
+- outside world), and/or the Daemon transport (to network multiple
+- UMLs on a single host). You may choose more than one without
+- conflict. If you don't need UML networking, say N.
++ The slip User-Mode Linux network transport allows a running UML to
++ network with its host over a point-to-point link. Unlike Ethertap,
++ which can carry any Ethernet frame (and hence even non-IP packets),
++ the slip transport can only carry IP packets.
++
++ To use this, your host must support slip devices.
++
++ For more information, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html>.
++ has examples of the UML command line to use to enable slip
++ networking, and details of a few quirks with it.
++
++ The Ethertap Transport is preferred over slip because of its
++ limitations. If you prefer slip, however, say Y here. Otherwise
++ choose the Multicast transport (to network multiple UMLs on
++ multiple hosts), Ethertap (to network with the host and the
++ outside world), and/or the Daemon transport (to network multiple
++ UMLs on a single host). You may choose more than one without
++ conflict. If you don't need UML networking, say N.
+
+ config UML_NET_DAEMON
+ bool "Daemon transport"
+ depends on UML_NET
+ help
+- This User-Mode Linux network transport allows one or more running
+- UMLs on a single host to communicate with each other, but not to
+- the host.
+-
+- To use this form of networking, you'll need to run the UML
+- networking daemon on the host.
+-
+- For more information, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html> That site
+- has examples of the UML command line to use to enable Daemon
+- networking.
+-
+- If you'd like to set up a network with other UMLs on a single host,
+- say Y. If you need a network between UMLs on multiple physical
+- hosts, choose the Multicast Transport. To set up a network with
+- the host and/or other IP machines, say Y to the Ethertap or Slip
+- transports. You'll need at least one of them, but may choose
+- more than one without conflict. If you don't need UML networking,
+- say N.
++ This User-Mode Linux network transport allows one or more running
++ UMLs on a single host to communicate with each other, but not to
++ the host.
++
++ To use this form of networking, you'll need to run the UML
++ networking daemon on the host.
++
++ For more information, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html> That site
++ has examples of the UML command line to use to enable Daemon
++ networking.
++
++ If you'd like to set up a network with other UMLs on a single host,
++ say Y. If you need a network between UMLs on multiple physical
++ hosts, choose the Multicast Transport. To set up a network with
++ the host and/or other IP machines, say Y to the Ethertap or Slip
++ transports. You'll need at least one of them, but may choose
++ more than one without conflict. If you don't need UML networking,
++ say N.
+
+ config UML_NET_VECTOR
+ bool "Vector I/O high performance network devices"
+@@ -270,26 +260,26 @@ config UML_NET_MCAST
+ bool "Multicast transport"
+ depends on UML_NET
+ help
+- This Multicast User-Mode Linux network transport allows multiple
+- UMLs (even ones running on different host machines!) to talk to
+- each other over a virtual ethernet network. However, it requires
+- at least one UML with one of the other transports to act as a
+- bridge if any of them need to be able to talk to their hosts or any
+- other IP machines.
+-
+- To use this, your host kernel(s) must support IP Multicasting.
+-
+- For more information, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html> That site
+- has examples of the UML command line to use to enable Multicast
+- networking, and notes about the security of this approach.
+-
+- If you need UMLs on multiple physical hosts to communicate as if
+- they shared an Ethernet network, say Y. If you need to communicate
+- with other IP machines, make sure you select one of the other
+- transports (possibly in addition to Multicast; they're not
+- exclusive). If you don't need to network UMLs say N to each of
+- the transports.
++ This Multicast User-Mode Linux network transport allows multiple
++ UMLs (even ones running on different host machines!) to talk to
++ each other over a virtual ethernet network. However, it requires
++ at least one UML with one of the other transports to act as a
++ bridge if any of them need to be able to talk to their hosts or any
++ other IP machines.
++
++ To use this, your host kernel(s) must support IP Multicasting.
++
++ For more information, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html> That site
++ has examples of the UML command line to use to enable Multicast
++ networking, and notes about the security of this approach.
++
++ If you need UMLs on multiple physical hosts to communicate as if
++ they shared an Ethernet network, say Y. If you need to communicate
++ with other IP machines, make sure you select one of the other
++ transports (possibly in addition to Multicast; they're not
++ exclusive). If you don't need to network UMLs say N to each of
++ the transports.
+
+ config UML_NET_PCAP
+ bool "pcap transport"
+@@ -300,9 +290,9 @@ config UML_NET_PCAP
+ UML act as a network monitor for the host. You must have libcap
+ installed in order to build the pcap transport into UML.
+
+- For more information, see
+- <http://user-mode-linux.sourceforge.net/old/networking.html> That site
+- has examples of the UML command line to use to enable this option.
++ For more information, see
++ <http://user-mode-linux.sourceforge.net/old/networking.html> That site
++ has examples of the UML command line to use to enable this option.
+
+ If you intend to use UML as a network monitor for the host, say
+ Y here. Otherwise, say N.
+@@ -311,27 +301,27 @@ config UML_NET_SLIRP
+ bool "SLiRP transport"
+ depends on UML_NET
+ help
+- The SLiRP User-Mode Linux network transport allows a running UML
+- to network by invoking a program that can handle SLIP encapsulated
+- packets. This is commonly (but not limited to) the application
+- known as SLiRP, a program that can re-socket IP packets back onto
+- the host on which it is run. Only IP packets are supported,
+- unlike other network transports that can handle all Ethernet
+- frames. In general, slirp allows the UML the same IP connectivity
+- to the outside world that the host user is permitted, and unlike
+- other transports, SLiRP works without the need of root level
+- privleges, setuid binaries, or SLIP devices on the host. This
+- also means not every type of connection is possible, but most
+- situations can be accommodated with carefully crafted slirp
+- commands that can be passed along as part of the network device's
+- setup string. The effect of this transport on the UML is similar
+- that of a host behind a firewall that masquerades all network
+- connections passing through it (but is less secure).
+-
+- To use this you should first have slirp compiled somewhere
+- accessible on the host, and have read its documentation. If you
+- don't need UML networking, say N.
+-
+- Startup example: "eth0=slirp,FE:FD:01:02:03:04,/usr/local/bin/slirp"
++ The SLiRP User-Mode Linux network transport allows a running UML
++ to network by invoking a program that can handle SLIP encapsulated
++ packets. This is commonly (but not limited to) the application
++ known as SLiRP, a program that can re-socket IP packets back onto
++ he host on which it is run. Only IP packets are supported,
++ unlike other network transports that can handle all Ethernet
++ frames. In general, slirp allows the UML the same IP connectivity
++ to the outside world that the host user is permitted, and unlike
++ other transports, SLiRP works without the need of root level
++ privleges, setuid binaries, or SLIP devices on the host. This
++ also means not every type of connection is possible, but most
++ situations can be accommodated with carefully crafted slirp
++ commands that can be passed along as part of the network device's
++ setup string. The effect of this transport on the UML is similar
++ that of a host behind a firewall that masquerades all network
++ connections passing through it (but is less secure).
++
++ To use this you should first have slirp compiled somewhere
++ accessible on the host, and have read its documentation. If you
++ don't need UML networking, say N.
++
++ Startup example: "eth0=slirp,FE:FD:01:02:03:04,/usr/local/bin/slirp"
+
+ endmenu
+diff --git a/arch/um/drivers/Makefile b/arch/um/drivers/Makefile
+index 693319839f69e..d945abf90c319 100644
+--- a/arch/um/drivers/Makefile
++++ b/arch/um/drivers/Makefile
+@@ -52,7 +52,7 @@ obj-$(CONFIG_UML_NET) += net.o
+ obj-$(CONFIG_MCONSOLE) += mconsole.o
+ obj-$(CONFIG_MMAPPER) += mmapper_kern.o
+ obj-$(CONFIG_BLK_DEV_UBD) += ubd.o
+-obj-$(CONFIG_HOSTAUDIO) += hostaudio.o
++obj-$(CONFIG_UML_SOUND) += hostaudio.o
+ obj-$(CONFIG_NULL_CHAN) += null.o
+ obj-$(CONFIG_PORT_CHAN) += port.o
+ obj-$(CONFIG_PTY_CHAN) += pty.o
+diff --git a/arch/x86/include/asm/virtext.h b/arch/x86/include/asm/virtext.h
+index 4699acd602af4..62810550024d3 100644
+--- a/arch/x86/include/asm/virtext.h
++++ b/arch/x86/include/asm/virtext.h
+@@ -89,12 +89,6 @@ static inline int cpu_has_svm(const char **msg)
+ return 0;
+ }
+
+- if (boot_cpu_data.extended_cpuid_level < SVM_CPUID_FUNC) {
+- if (msg)
+- *msg = "can't execute cpuid_8000000a";
+- return 0;
+- }
+-
+ if (!boot_cpu_has(X86_FEATURE_SVM)) {
+ if (msg)
+ *msg = "svm not available";
+diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
+index f7151cd03cb08..3d7a8049f6376 100644
+--- a/arch/x86/kernel/apm_32.c
++++ b/arch/x86/kernel/apm_32.c
+@@ -246,12 +246,6 @@
+ extern int (*console_blank_hook)(int);
+ #endif
+
+-/*
+- * The apm_bios device is one of the misc char devices.
+- * This is its minor number.
+- */
+-#define APM_MINOR_DEV 134
+-
+ /*
+ * Various options can be changed at boot time as follows:
+ * (We allow underscores for compatibility with the modules code)
+diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
+index 9338b4558cdc5..1d25ba3775da7 100644
+--- a/crypto/asymmetric_keys/x509_public_key.c
++++ b/crypto/asymmetric_keys/x509_public_key.c
+@@ -134,6 +134,11 @@ int x509_check_for_self_signed(struct x509_certificate *cert)
+ if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0)
+ goto out;
+
++ if (cert->unsupported_sig) {
++ ret = 0;
++ goto out;
++ }
++
+ ret = public_key_verify_signature(cert->pub, cert->sig);
+ if (ret < 0) {
+ if (ret == -ENOPKG) {
+diff --git a/drivers/acpi/acpica/psopcode.c b/drivers/acpi/acpica/psopcode.c
+index 8d7dc98bad17b..ca01e02af9cba 100644
+--- a/drivers/acpi/acpica/psopcode.c
++++ b/drivers/acpi/acpica/psopcode.c
+@@ -603,7 +603,7 @@ const struct acpi_opcode_info acpi_gbl_aml_op_info[AML_NUM_OPCODES] = {
+
+ /* 7E */ ACPI_OP("Timer", ARGP_TIMER_OP, ARGI_TIMER_OP, ACPI_TYPE_ANY,
+ AML_CLASS_EXECUTE, AML_TYPE_EXEC_0A_0T_1R,
+- AML_FLAGS_EXEC_0A_0T_1R),
++ AML_FLAGS_EXEC_0A_0T_1R | AML_NO_OPERAND_RESOLVE),
+
+ /* ACPI 5.0 opcodes */
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index b4f16073ef432..866bc20c82397 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -294,6 +294,15 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "Lenovo IdeaPad S405"),
+ },
+ },
++ {
++ /* https://bugzilla.suse.com/show_bug.cgi?id=1208724 */
++ .callback = video_detect_force_native,
++ /* Lenovo Ideapad Z470 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "IdeaPad Z470"),
++ },
++ },
+ {
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1187004 */
+ .callback = video_detect_force_native,
+diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
+index e1992f361c9a6..2aaec96f83849 100644
+--- a/drivers/amba/bus.c
++++ b/drivers/amba/bus.c
+@@ -349,6 +349,7 @@ static void amba_device_release(struct device *dev)
+ {
+ struct amba_device *d = to_amba_device(dev);
+
++ of_node_put(d->dev.of_node);
+ if (d->res.parent)
+ release_resource(&d->res);
+ kfree(d);
+diff --git a/drivers/ata/pata_ftide010.c b/drivers/ata/pata_ftide010.c
+index 569a4a662dcd4..9da2e14a01080 100644
+--- a/drivers/ata/pata_ftide010.c
++++ b/drivers/ata/pata_ftide010.c
+@@ -569,6 +569,7 @@ static struct platform_driver pata_ftide010_driver = {
+ };
+ module_platform_driver(pata_ftide010_driver);
+
++MODULE_DESCRIPTION("low level driver for Faraday Technology FTIDE010");
+ MODULE_AUTHOR("Linus Walleij <linus.walleij@linaro.org>");
+ MODULE_LICENSE("GPL");
+ MODULE_ALIAS("platform:" DRV_NAME);
+diff --git a/drivers/ata/sata_gemini.c b/drivers/ata/sata_gemini.c
+index 46950e0267e0d..64b43943f6502 100644
+--- a/drivers/ata/sata_gemini.c
++++ b/drivers/ata/sata_gemini.c
+@@ -434,6 +434,7 @@ static struct platform_driver gemini_sata_driver = {
+ };
+ module_platform_driver(gemini_sata_driver);
+
++MODULE_DESCRIPTION("low level driver for Cortina Systems Gemini SATA bridge");
+ MODULE_AUTHOR("Linus Walleij <linus.walleij@linaro.org>");
+ MODULE_LICENSE("GPL");
+ MODULE_ALIAS("platform:" DRV_NAME);
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index e9b7ce8c272c6..7353c55270874 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -291,7 +291,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+
+ blk = krealloc(rbnode->block,
+ blklen * map->cache_word_size,
+- GFP_KERNEL);
++ map->alloc_flags);
+ if (!blk)
+ return -ENOMEM;
+
+@@ -300,7 +300,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+ if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
+ present = krealloc(rbnode->cache_present,
+ BITS_TO_LONGS(blklen) * sizeof(*present),
+- GFP_KERNEL);
++ map->alloc_flags);
+ if (!present)
+ return -ENOMEM;
+
+@@ -334,7 +334,7 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg)
+ const struct regmap_range *range;
+ int i;
+
+- rbnode = kzalloc(sizeof(*rbnode), GFP_KERNEL);
++ rbnode = kzalloc(sizeof(*rbnode), map->alloc_flags);
+ if (!rbnode)
+ return NULL;
+
+@@ -360,13 +360,13 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg)
+ }
+
+ rbnode->block = kmalloc_array(rbnode->blklen, map->cache_word_size,
+- GFP_KERNEL);
++ map->alloc_flags);
+ if (!rbnode->block)
+ goto err_free;
+
+ rbnode->cache_present = kcalloc(BITS_TO_LONGS(rbnode->blklen),
+ sizeof(*rbnode->cache_present),
+- GFP_KERNEL);
++ map->alloc_flags);
+ if (!rbnode->cache_present)
+ goto err_free_block;
+
+diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
+index 20142bc77554c..1325b1df4a8ed 100644
+--- a/drivers/bluetooth/btsdio.c
++++ b/drivers/bluetooth/btsdio.c
+@@ -356,6 +356,7 @@ static void btsdio_remove(struct sdio_func *func)
+ if (!data)
+ return;
+
++ cancel_work_sync(&data->work);
+ hdev = data->hdev;
+
+ sdio_set_drvdata(func, NULL);
+diff --git a/drivers/bluetooth/hci_nokia.c b/drivers/bluetooth/hci_nokia.c
+index 2dc33e65d2d0c..5f6c6930b5bdf 100644
+--- a/drivers/bluetooth/hci_nokia.c
++++ b/drivers/bluetooth/hci_nokia.c
+@@ -743,7 +743,11 @@ static int nokia_bluetooth_serdev_probe(struct serdev_device *serdev)
+ return err;
+ }
+
+- clk_prepare_enable(sysclk);
++ err = clk_prepare_enable(sysclk);
++ if (err) {
++ dev_err(dev, "could not enable sysclk: %d", err);
++ return err;
++ }
+ btdev->sysclk_speed = clk_get_rate(sysclk);
+ clk_disable_unprepare(sysclk);
+
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index 8c7a1b8f96896..3eb2269409488 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -2119,6 +2119,11 @@ static int try_smi_init(struct smi_info *new_smi)
+ new_smi->io.io_cleanup = NULL;
+ }
+
++ if (rv && new_smi->si_sm) {
++ kfree(new_smi->si_sm);
++ new_smi->si_sm = NULL;
++ }
++
+ kfree(init_name);
+ return rv;
+ }
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 430a9eac67e19..d1869b9a2ffd3 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -425,10 +425,17 @@ static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len)
+ int rc;
+ u32 ordinal;
+ unsigned long dur;
+-
+- rc = tpm_tis_send_data(chip, buf, len);
+- if (rc < 0)
+- return rc;
++ unsigned int try;
++
++ for (try = 0; try < TPM_RETRY; try++) {
++ rc = tpm_tis_send_data(chip, buf, len);
++ if (rc >= 0)
++ /* Data transfer done successfully */
++ break;
++ else if (rc != -EIO)
++ /* Data transfer failed, not recoverable */
++ return rc;
++ }
+
+ /* go and do it */
+ rc = tpm_tis_write8(priv, TPM_STS(priv->locality), TPM_STS_GO);
+diff --git a/drivers/clk/keystone/pll.c b/drivers/clk/keystone/pll.c
+index e7e840fb74eaf..526694c2a6c97 100644
+--- a/drivers/clk/keystone/pll.c
++++ b/drivers/clk/keystone/pll.c
+@@ -213,7 +213,7 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl)
+ }
+
+ clk = clk_register_pll(NULL, node->name, parent_name, pll_data);
+- if (clk) {
++ if (!IS_ERR_OR_NULL(clk)) {
+ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ return;
+ }
+diff --git a/drivers/clk/qcom/gcc-mdm9615.c b/drivers/clk/qcom/gcc-mdm9615.c
+index 849046fbed6d4..3df830cdfd010 100644
+--- a/drivers/clk/qcom/gcc-mdm9615.c
++++ b/drivers/clk/qcom/gcc-mdm9615.c
+@@ -66,7 +66,7 @@ static struct clk_regmap pll0_vote = {
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "pll0_vote",
+- .parent_names = (const char *[]){ "pll8" },
++ .parent_names = (const char *[]){ "pll0" },
+ .num_parents = 1,
+ .ops = &clk_pll_vote_ops,
+ },
+diff --git a/drivers/clk/sunxi-ng/ccu_mmc_timing.c b/drivers/clk/sunxi-ng/ccu_mmc_timing.c
+index f9869f7353c01..9356dc1571561 100644
+--- a/drivers/clk/sunxi-ng/ccu_mmc_timing.c
++++ b/drivers/clk/sunxi-ng/ccu_mmc_timing.c
+@@ -50,7 +50,7 @@ int sunxi_ccu_set_mmc_timing_mode(struct clk *clk, bool new_mode)
+ EXPORT_SYMBOL_GPL(sunxi_ccu_set_mmc_timing_mode);
+
+ /**
+- * sunxi_ccu_set_mmc_timing_mode: Get the current MMC clock timing mode
++ * sunxi_ccu_get_mmc_timing_mode: Get the current MMC clock timing mode
+ * @clk: clock to query
+ *
+ * Returns 0 if the clock is in old timing mode, > 0 if it is in
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index a3c82f530d608..541486217984b 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -410,7 +410,11 @@ brcm_avs_get_freq_table(struct device *dev, struct private_data *priv)
+ if (ret)
+ return ERR_PTR(ret);
+
+- table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1, sizeof(*table),
++ /*
++ * We allocate space for the 5 different P-STATES AVS,
++ * plus extra space for a terminating element.
++ */
++ table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1 + 1, sizeof(*table),
+ GFP_KERNEL);
+ if (!table)
+ return ERR_PTR(-ENOMEM);
+diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
+index 818f92798fb9b..55743d78016b0 100644
+--- a/drivers/cpufreq/powernow-k8.c
++++ b/drivers/cpufreq/powernow-k8.c
+@@ -1104,7 +1104,8 @@ static int powernowk8_cpu_exit(struct cpufreq_policy *pol)
+
+ kfree(data->powernow_table);
+ kfree(data);
+- for_each_cpu(cpu, pol->cpus)
++ /* pol->cpus will be empty here, use related_cpus instead. */
++ for_each_cpu(cpu, pol->related_cpus)
+ per_cpu(powernow_data, cpu) = NULL;
+
+ return 0;
+diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
+index f26d62e5533a7..701e4ad8077b4 100644
+--- a/drivers/crypto/caam/caampkc.c
++++ b/drivers/crypto/caam/caampkc.c
+@@ -194,7 +194,9 @@ static int caam_rsa_count_leading_zeros(struct scatterlist *sgl,
+ if (len && *buff)
+ break;
+
+- sg_miter_next(&miter);
++ if (!sg_miter_next(&miter))
++ break;
++
+ buff = miter.addr;
+ len = miter.length;
+
+diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c
+index 641b11077f479..015f349bf66bb 100644
+--- a/drivers/crypto/stm32/stm32-hash.c
++++ b/drivers/crypto/stm32/stm32-hash.c
+@@ -578,9 +578,9 @@ static int stm32_hash_dma_send(struct stm32_hash_dev *hdev)
+ }
+
+ for_each_sg(rctx->sg, tsg, rctx->nents, i) {
++ sg[0] = *tsg;
+ len = sg->length;
+
+- sg[0] = *tsg;
+ if (sg_is_last(sg)) {
+ if (hdev->dma_mode == 1) {
+ len = (ALIGN(sg->length, 16) - 16);
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 06a981c722463..91e8b248e8158 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -582,6 +582,7 @@ static void devfreq_dev_release(struct device *dev)
+ devfreq->profile->exit(devfreq->dev.parent);
+
+ mutex_destroy(&devfreq->lock);
++ srcu_cleanup_notifier_head(&devfreq->transition_notifier_list);
+ kfree(devfreq);
+ }
+
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
+index e5f31af65aabf..00e1ffa4fcf1c 100644
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -212,6 +212,7 @@ config FSL_DMA
+ config FSL_EDMA
+ tristate "Freescale eDMA engine support"
+ depends on OF
++ depends on HAS_IOMEM
+ select DMA_ENGINE
+ select DMA_VIRTUAL_CHANNELS
+ help
+@@ -258,6 +259,7 @@ config IMX_SDMA
+
+ config INTEL_IDMA64
+ tristate "Intel integrated DMA 64-bit support"
++ depends on HAS_IOMEM
+ select DMA_ENGINE
+ select DMA_VIRTUAL_CHANNELS
+ help
+diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
+index e588dc5daaa80..e9d76113c9e95 100644
+--- a/drivers/dma/ste_dma40.c
++++ b/drivers/dma/ste_dma40.c
+@@ -3584,6 +3584,10 @@ static int __init d40_probe(struct platform_device *pdev)
+ spin_lock_init(&base->lcla_pool.lock);
+
+ base->irq = platform_get_irq(pdev, 0);
++ if (base->irq < 0) {
++ ret = base->irq;
++ goto destroy_cache;
++ }
+
+ ret = request_irq(base->irq, d40_handle_interrupt, 0, D40_NAME, base);
+ if (ret) {
+diff --git a/drivers/fsi/fsi-master-ast-cf.c b/drivers/fsi/fsi-master-ast-cf.c
+index 04d10ea8d343b..a7fc04bf6550a 100644
+--- a/drivers/fsi/fsi-master-ast-cf.c
++++ b/drivers/fsi/fsi-master-ast-cf.c
+@@ -1438,3 +1438,4 @@ static struct platform_driver fsi_master_acf = {
+
+ module_platform_driver(fsi_master_acf);
+ MODULE_LICENSE("GPL");
++MODULE_FIRMWARE(FW_FILE_NAME);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 787cbeea8dc55..c84f475d4f136 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -735,6 +735,9 @@ int amdgpu_device_resize_fb_bar(struct amdgpu_device *adev)
+ u16 cmd;
+ int r;
+
++ if (!IS_ENABLED(CONFIG_PHYS_ADDR_T_64BIT))
++ return 0;
++
+ /* Bypass for VF */
+ if (amdgpu_sriov_vf(adev))
+ return 0;
+diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
+index 78ab939ae5d86..7ff16edcda266 100644
+--- a/drivers/gpu/drm/amd/amdgpu/cik.c
++++ b/drivers/gpu/drm/amd/amdgpu/cik.c
+@@ -1377,7 +1377,6 @@ static int cik_set_vce_clocks(struct amdgpu_device *adev, u32 evclk, u32 ecclk)
+ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ {
+ struct pci_dev *root = adev->pdev->bus->self;
+- int bridge_pos, gpu_pos;
+ u32 speed_cntl, current_data_rate;
+ int i;
+ u16 tmp16;
+@@ -1412,12 +1411,7 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ DRM_INFO("enabling PCIE gen 2 link speeds, disable with amdgpu.pcie_gen2=0\n");
+ }
+
+- bridge_pos = pci_pcie_cap(root);
+- if (!bridge_pos)
+- return;
+-
+- gpu_pos = pci_pcie_cap(adev->pdev);
+- if (!gpu_pos)
++ if (!pci_is_pcie(root) || !pci_is_pcie(adev->pdev))
+ return;
+
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
+@@ -1427,14 +1421,8 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
+-
+- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
+-
+- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+
+ tmp = RREG32_PCIE(ixPCIE_LC_STATUS1);
+ max_lw = (tmp & PCIE_LC_STATUS1__LC_DETECTED_LINK_WIDTH_MASK) >>
+@@ -1458,15 +1446,23 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+
+ for (i = 0; i < 10; i++) {
+ /* check status */
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_DEVSTA,
++ &tmp16);
+ if (tmp16 & PCI_EXP_DEVSTA_TRPND)
+ break;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &bridge_cfg2);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ &gpu_cfg2);
+
+ tmp = RREG32_PCIE(ixPCIE_LC_CNTL4);
+ tmp |= PCIE_LC_CNTL4__LC_SET_QUIESCE_MASK;
+@@ -1479,26 +1475,38 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ msleep(100);
+
+ /* linkctl */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
+-
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ bridge_cfg &
++ PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ gpu_cfg &
++ PCI_EXP_LNKCTL_HAWD);
+
+ /* linkctl2 */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9)));
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+-
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9)));
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &tmp16);
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (bridge_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
++ pcie_capability_write_word(root,
++ PCI_EXP_LNKCTL2,
++ tmp16);
++
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ &tmp16);
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (gpu_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
++ pcie_capability_write_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+ tmp = RREG32_PCIE(ixPCIE_LC_CNTL4);
+ tmp &= ~PCIE_LC_CNTL4__LC_SET_QUIESCE_MASK;
+@@ -1513,15 +1521,16 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
+ speed_cntl &= ~PCIE_LC_SPEED_CNTL__LC_FORCE_DIS_SW_SPEED_CHANGE_MASK;
+ WREG32_PCIE(ixPCIE_LC_SPEED_CNTL, speed_cntl);
+
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~0xf;
++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL2, &tmp16);
++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
++
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
+- tmp16 |= 3; /* gen3 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
+- tmp16 |= 2; /* gen2 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+- tmp16 |= 1; /* gen1 */
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE(ixPCIE_LC_SPEED_CNTL);
+ speed_cntl |= PCIE_LC_SPEED_CNTL__LC_INITIATE_LINK_SPEED_CHANGE_MASK;
+diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
+index 77c9f4d8668ad..580d74f26b69f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si.c
++++ b/drivers/gpu/drm/amd/amdgpu/si.c
+@@ -1558,7 +1558,6 @@ static void si_init_golden_registers(struct amdgpu_device *adev)
+ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ {
+ struct pci_dev *root = adev->pdev->bus->self;
+- int bridge_pos, gpu_pos;
+ u32 speed_cntl, current_data_rate;
+ int i;
+ u16 tmp16;
+@@ -1593,12 +1592,7 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ DRM_INFO("enabling PCIE gen 2 link speeds, disable with amdgpu.pcie_gen2=0\n");
+ }
+
+- bridge_pos = pci_pcie_cap(root);
+- if (!bridge_pos)
+- return;
+-
+- gpu_pos = pci_pcie_cap(adev->pdev);
+- if (!gpu_pos)
++ if (!pci_is_pcie(root) || !pci_is_pcie(adev->pdev))
+ return;
+
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) {
+@@ -1607,14 +1601,8 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
+-
+- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
+-
+- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+
+ tmp = RREG32_PCIE(PCIE_LC_STATUS1);
+ max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
+@@ -1631,15 +1619,23 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ }
+
+ for (i = 0; i < 10; i++) {
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_DEVSTA,
++ &tmp16);
+ if (tmp16 & PCI_EXP_DEVSTA_TRPND)
+ break;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2);
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &bridge_cfg2);
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ &gpu_cfg2);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp |= LC_SET_QUIESCE;
+@@ -1651,25 +1647,37 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+
+ mdelay(100);
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
+-
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
+-
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9)));
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+-
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9)));
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ bridge_cfg &
++ PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ gpu_cfg &
++ PCI_EXP_LNKCTL_HAWD);
++
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &tmp16);
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (bridge_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
++ pcie_capability_write_word(root,
++ PCI_EXP_LNKCTL2,
++ tmp16);
++
++ pcie_capability_read_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ &tmp16);
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (gpu_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
++ pcie_capability_write_word(adev->pdev,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp &= ~LC_SET_QUIESCE;
+@@ -1682,15 +1690,16 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
+ speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE;
+ WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl);
+
+- pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~0xf;
++ pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL2, &tmp16);
++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
++
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
+- tmp16 |= 3;
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
+- tmp16 |= 2;
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+- tmp16 |= 1;
+- pci_write_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
++ pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
+ speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c
+index 958994edf2c49..12d043521c070 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c
+@@ -193,8 +193,9 @@ struct mpcc *mpc1_insert_plane(
+ /* check insert_above_mpcc exist in tree->opp_list */
+ struct mpcc *temp_mpcc = tree->opp_list;
+
+- while (temp_mpcc && temp_mpcc->mpcc_bot != insert_above_mpcc)
+- temp_mpcc = temp_mpcc->mpcc_bot;
++ if (temp_mpcc != insert_above_mpcc)
++ while (temp_mpcc && temp_mpcc->mpcc_bot != insert_above_mpcc)
++ temp_mpcc = temp_mpcc->mpcc_bot;
+ if (temp_mpcc == NULL)
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
+index c1d1ac51d1c20..1f09cb9691f8b 100644
+--- a/drivers/gpu/drm/ast/ast_post.c
++++ b/drivers/gpu/drm/ast/ast_post.c
+@@ -291,7 +291,7 @@ static void ast_init_dram_reg(struct drm_device *dev)
+ ;
+ } while (ast_read32(ast, 0x10100) != 0xa8);
+ } else {/* AST2100/1100 */
+- if (ast->chip == AST2100 || ast->chip == 2200)
++ if (ast->chip == AST2100 || ast->chip == AST2200)
+ dram_reg_info = ast2100_dram_table_data;
+ else
+ dram_reg_info = ast1100_dram_table_data;
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 31b75d3ca6e90..85aba4c38dc00 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -756,8 +756,13 @@ static void adv7511_mode_set(struct adv7511 *adv7511,
+ else
+ low_refresh_rate = ADV7511_LOW_REFRESH_RATE_NONE;
+
+- regmap_update_bits(adv7511->regmap, 0xfb,
+- 0x6, low_refresh_rate << 1);
++ if (adv7511->type == ADV7511)
++ regmap_update_bits(adv7511->regmap, 0xfb,
++ 0x6, low_refresh_rate << 1);
++ else
++ regmap_update_bits(adv7511->regmap, 0x4a,
++ 0xc, low_refresh_rate << 2);
++
+ regmap_update_bits(adv7511->regmap, 0x17,
+ 0x60, (vsync_polarity << 6) | (hsync_polarity << 5));
+
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+index 2696289ecc78f..b3e23ace5869c 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+@@ -43,13 +43,12 @@ static void exynos_drm_crtc_atomic_disable(struct drm_crtc *crtc,
+ if (exynos_crtc->ops->disable)
+ exynos_crtc->ops->disable(exynos_crtc);
+
++ spin_lock_irq(&crtc->dev->event_lock);
+ if (crtc->state->event && !crtc->state->active) {
+- spin_lock_irq(&crtc->dev->event_lock);
+ drm_crtc_send_vblank_event(crtc, crtc->state->event);
+- spin_unlock_irq(&crtc->dev->event_lock);
+-
+ crtc->state->event = NULL;
+ }
++ spin_unlock_irq(&crtc->dev->event_lock);
+ }
+
+ static int exynos_crtc_atomic_check(struct drm_crtc *crtc,
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+index 501d7989b9a5f..cd5b9ee22a5bb 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+@@ -185,7 +185,7 @@ static void mdp5_plane_reset(struct drm_plane *plane)
+ struct mdp5_plane_state *mdp5_state;
+
+ if (plane->state && plane->state->fb)
+- drm_framebuffer_unreference(plane->state->fb);
++ drm_framebuffer_put(plane->state->fb);
+
+ kfree(to_mdp5_plane_state(plane->state));
+ plane->state = NULL;
+@@ -230,8 +230,7 @@ static void mdp5_plane_destroy_state(struct drm_plane *plane,
+ {
+ struct mdp5_plane_state *pstate = to_mdp5_plane_state(state);
+
+- if (state->fb)
+- drm_framebuffer_unreference(state->fb);
++ __drm_atomic_helper_plane_destroy_state(state);
+
+ kfree(pstate);
+ }
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 827d551962d98..643f74c231c5d 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -9500,7 +9500,6 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ {
+ struct pci_dev *root = rdev->pdev->bus->self;
+ enum pci_bus_speed speed_cap;
+- int bridge_pos, gpu_pos;
+ u32 speed_cntl, current_data_rate;
+ int i;
+ u16 tmp16;
+@@ -9542,12 +9541,7 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n");
+ }
+
+- bridge_pos = pci_pcie_cap(root);
+- if (!bridge_pos)
+- return;
+-
+- gpu_pos = pci_pcie_cap(rdev->pdev);
+- if (!gpu_pos)
++ if (!pci_is_pcie(root) || !pci_is_pcie(rdev->pdev))
+ return;
+
+ if (speed_cap == PCIE_SPEED_8_0GT) {
+@@ -9557,14 +9551,8 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
+-
+- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
+-
+- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_STATUS1);
+ max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
+@@ -9582,15 +9570,23 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+
+ for (i = 0; i < 10; i++) {
+ /* check status */
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_DEVSTA,
++ &tmp16);
+ if (tmp16 & PCI_EXP_DEVSTA_TRPND)
+ break;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &bridge_cfg2);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ &gpu_cfg2);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp |= LC_SET_QUIESCE;
+@@ -9603,26 +9599,38 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ mdelay(100);
+
+ /* linkctl */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
+-
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ bridge_cfg &
++ PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ gpu_cfg &
++ PCI_EXP_LNKCTL_HAWD);
+
+ /* linkctl2 */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9)));
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+-
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9)));
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &tmp16);
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (bridge_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
++ pcie_capability_write_word(root,
++ PCI_EXP_LNKCTL2,
++ tmp16);
++
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ &tmp16);
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (gpu_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
++ pcie_capability_write_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp &= ~LC_SET_QUIESCE;
+@@ -9636,15 +9644,15 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
+ speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE;
+ WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl);
+
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~0xf;
++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL2, &tmp16);
++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
+ if (speed_cap == PCIE_SPEED_8_0GT)
+- tmp16 |= 3; /* gen3 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+ else if (speed_cap == PCIE_SPEED_5_0GT)
+- tmp16 |= 2; /* gen2 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+- tmp16 |= 1; /* gen1 */
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
+ speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE;
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 639f0698f961c..644ddd8d65ad5 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -3253,7 +3253,7 @@ static void si_gpu_init(struct radeon_device *rdev)
+ /* XXX what about 12? */
+ rdev->config.si.tile_config |= (3 << 0);
+ break;
+- }
++ }
+ switch ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) {
+ case 0: /* four banks */
+ rdev->config.si.tile_config |= 0 << 4;
+@@ -7083,7 +7083,6 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ {
+ struct pci_dev *root = rdev->pdev->bus->self;
+ enum pci_bus_speed speed_cap;
+- int bridge_pos, gpu_pos;
+ u32 speed_cntl, current_data_rate;
+ int i;
+ u16 tmp16;
+@@ -7125,12 +7124,7 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ DRM_INFO("enabling PCIE gen 2 link speeds, disable with radeon.pcie_gen2=0\n");
+ }
+
+- bridge_pos = pci_pcie_cap(root);
+- if (!bridge_pos)
+- return;
+-
+- gpu_pos = pci_pcie_cap(rdev->pdev);
+- if (!gpu_pos)
++ if (!pci_is_pcie(root) || !pci_is_pcie(rdev->pdev))
+ return;
+
+ if (speed_cap == PCIE_SPEED_8_0GT) {
+@@ -7140,14 +7134,8 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ u16 bridge_cfg2, gpu_cfg2;
+ u32 max_lw, current_lw, tmp;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
+-
+- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
+-
+- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+
+ tmp = RREG32_PCIE(PCIE_LC_STATUS1);
+ max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
+@@ -7165,15 +7153,23 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+
+ for (i = 0; i < 10; i++) {
+ /* check status */
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_DEVSTA, &tmp16);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_DEVSTA,
++ &tmp16);
+ if (tmp16 & PCI_EXP_DEVSTA_TRPND)
+ break;
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &bridge_cfg);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &gpu_cfg);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL,
++ &bridge_cfg);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL,
++ &gpu_cfg);
+
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &bridge_cfg2);
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &gpu_cfg2);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &bridge_cfg2);
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ &gpu_cfg2);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp |= LC_SET_QUIESCE;
+@@ -7186,26 +7182,38 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ mdelay(100);
+
+ /* linkctl */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL, &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL, tmp16);
+-
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, &tmp16);
+- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
+- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL, tmp16);
++ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ bridge_cfg &
++ PCI_EXP_LNKCTL_HAWD);
++ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_HAWD,
++ gpu_cfg &
++ PCI_EXP_LNKCTL_HAWD);
+
+ /* linkctl2 */
+- pci_read_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (bridge_cfg2 & ((1 << 4) | (7 << 9)));
+- pci_write_config_word(root, bridge_pos + PCI_EXP_LNKCTL2, tmp16);
+-
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~((1 << 4) | (7 << 9));
+- tmp16 |= (gpu_cfg2 & ((1 << 4) | (7 << 9)));
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
++ &tmp16);
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (bridge_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
++ pcie_capability_write_word(root,
++ PCI_EXP_LNKCTL2,
++ tmp16);
++
++ pcie_capability_read_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ &tmp16);
++ tmp16 &= ~(PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN);
++ tmp16 |= (gpu_cfg2 &
++ (PCI_EXP_LNKCTL2_ENTER_COMP |
++ PCI_EXP_LNKCTL2_TX_MARGIN));
++ pcie_capability_write_word(rdev->pdev,
++ PCI_EXP_LNKCTL2,
++ tmp16);
+
+ tmp = RREG32_PCIE_PORT(PCIE_LC_CNTL4);
+ tmp &= ~LC_SET_QUIESCE;
+@@ -7219,15 +7227,15 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
+ speed_cntl &= ~LC_FORCE_DIS_SW_SPEED_CHANGE;
+ WREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL, speed_cntl);
+
+- pci_read_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16);
+- tmp16 &= ~0xf;
++ pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL2, &tmp16);
++ tmp16 &= ~PCI_EXP_LNKCTL2_TLS;
+ if (speed_cap == PCIE_SPEED_8_0GT)
+- tmp16 |= 3; /* gen3 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_8_0GT; /* gen3 */
+ else if (speed_cap == PCIE_SPEED_5_0GT)
+- tmp16 |= 2; /* gen2 */
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_5_0GT; /* gen2 */
+ else
+- tmp16 |= 1; /* gen1 */
+- pci_write_config_word(rdev->pdev, gpu_pos + PCI_EXP_LNKCTL2, tmp16);
++ tmp16 |= PCI_EXP_LNKCTL2_TLS_2_5GT; /* gen1 */
++ pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL2, tmp16);
+
+ speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL);
+ speed_cntl |= LC_INITIATE_LINK_SPEED_CHANGE;
+diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
+index d84e81ff36ad0..7d9be2f56ab1e 100644
+--- a/drivers/gpu/drm/tegra/dpaux.c
++++ b/drivers/gpu/drm/tegra/dpaux.c
+@@ -449,10 +449,8 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+ return PTR_ERR(dpaux->regs);
+
+ dpaux->irq = platform_get_irq(pdev, 0);
+- if (dpaux->irq < 0) {
+- dev_err(&pdev->dev, "failed to get IRQ\n");
+- return -ENXIO;
+- }
++ if (dpaux->irq < 0)
++ return dpaux->irq;
+
+ if (!pdev->dev.pm_domain) {
+ dpaux->rst = devm_reset_control_get(&pdev->dev, "dpaux");
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 4b1c223be9933..6411ee12c7a30 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1540,7 +1540,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app)
+ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ {
+ struct mt_device *td = hid_get_drvdata(hdev);
+- char *name;
+ const char *suffix = NULL;
+ struct mt_report_data *rdata;
+ struct mt_application *mt_application = NULL;
+@@ -1594,15 +1593,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ break;
+ }
+
+- if (suffix) {
+- name = devm_kzalloc(&hi->input->dev,
+- strlen(hdev->name) + strlen(suffix) + 2,
+- GFP_KERNEL);
+- if (name) {
+- sprintf(name, "%s %s", hdev->name, suffix);
+- hi->input->name = name;
+- }
+- }
++ if (suffix)
++ hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
++ "%s %s", hdev->name, suffix);
+
+ return 0;
+ }
+diff --git a/drivers/hid/wacom.h b/drivers/hid/wacom.h
+index 45636d82ec306..0ee71ce943607 100644
+--- a/drivers/hid/wacom.h
++++ b/drivers/hid/wacom.h
+@@ -156,6 +156,7 @@ struct wacom_remote {
+ struct input_dev *input;
+ bool registered;
+ struct wacom_battery battery;
++ ktime_t active_time;
+ } remotes[WACOM_MAX_REMOTES];
+ };
+
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index c50b26a9bc445..8255010b03d09 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -2500,6 +2500,18 @@ fail:
+ return;
+ }
+
++static void wacom_remote_destroy_battery(struct wacom *wacom, int index)
++{
++ struct wacom_remote *remote = wacom->remote;
++
++ if (remote->remotes[index].battery.battery) {
++ devres_release_group(&wacom->hdev->dev,
++ &remote->remotes[index].battery.bat_desc);
++ remote->remotes[index].battery.battery = NULL;
++ remote->remotes[index].active_time = 0;
++ }
++}
++
+ static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index)
+ {
+ struct wacom_remote *remote = wacom->remote;
+@@ -2514,9 +2526,7 @@ static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index)
+ remote->remotes[i].registered = false;
+ spin_unlock_irqrestore(&remote->remote_lock, flags);
+
+- if (remote->remotes[i].battery.battery)
+- devres_release_group(&wacom->hdev->dev,
+- &remote->remotes[i].battery.bat_desc);
++ wacom_remote_destroy_battery(wacom, i);
+
+ if (remote->remotes[i].group.name)
+ devres_release_group(&wacom->hdev->dev,
+@@ -2524,7 +2534,6 @@ static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index)
+
+ remote->remotes[i].serial = 0;
+ remote->remotes[i].group.name = NULL;
+- remote->remotes[i].battery.battery = NULL;
+ wacom->led.groups[i].select = WACOM_STATUS_UNKNOWN;
+ }
+ }
+@@ -2609,6 +2618,9 @@ static int wacom_remote_attach_battery(struct wacom *wacom, int index)
+ if (remote->remotes[index].battery.battery)
+ return 0;
+
++ if (!remote->remotes[index].active_time)
++ return 0;
++
+ if (wacom->led.groups[index].select == WACOM_STATUS_UNKNOWN)
+ return 0;
+
+@@ -2624,6 +2636,7 @@ static void wacom_remote_work(struct work_struct *work)
+ {
+ struct wacom *wacom = container_of(work, struct wacom, remote_work);
+ struct wacom_remote *remote = wacom->remote;
++ ktime_t kt = ktime_get();
+ struct wacom_remote_data data;
+ unsigned long flags;
+ unsigned int count;
+@@ -2650,6 +2663,10 @@ static void wacom_remote_work(struct work_struct *work)
+ serial = data.remote[i].serial;
+ if (data.remote[i].connected) {
+
++ if (kt - remote->remotes[i].active_time > WACOM_REMOTE_BATTERY_TIMEOUT
++ && remote->remotes[i].active_time != 0)
++ wacom_remote_destroy_battery(wacom, i);
++
+ if (remote->remotes[i].serial == serial) {
+ wacom_remote_attach_battery(wacom, i);
+ continue;
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 8f2de5cb2b6e9..eb5f52e6f19dd 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -1077,6 +1077,7 @@ static int wacom_remote_irq(struct wacom_wac *wacom_wac, size_t len)
+ if (index < 0 || !remote->remotes[index].registered)
+ goto out;
+
++ remote->remotes[i].active_time = ktime_get();
+ input = remote->remotes[index].input;
+
+ input_report_key(input, BTN_0, (data[9] & 0x01));
+diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
+index fbdbb74f9f1fd..8ff5e4de60f4c 100644
+--- a/drivers/hid/wacom_wac.h
++++ b/drivers/hid/wacom_wac.h
+@@ -19,6 +19,7 @@
+ #define WACOM_NAME_MAX 64
+ #define WACOM_MAX_REMOTES 5
+ #define WACOM_STATUS_UNKNOWN 255
++#define WACOM_REMOTE_BATTERY_TIMEOUT 21000000000ll
+
+ /* packet length for individual models */
+ #define WACOM_PKGLEN_BBFUN 9
+diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
+index 49d4b4f1a4574..ad9bd2001fbd2 100644
+--- a/drivers/iio/industrialio-core.c
++++ b/drivers/iio/industrialio-core.c
+@@ -323,7 +323,7 @@ static ssize_t iio_debugfs_write_reg(struct file *file,
+ char buf[80];
+ int ret;
+
+- count = min_t(size_t, count, (sizeof(buf)-1));
++ count = min(count, sizeof(buf) - 1);
+ if (copy_from_user(buf, userbuf, count))
+ return -EFAULT;
+
+diff --git a/drivers/infiniband/core/uverbs_std_types_counters.c b/drivers/infiniband/core/uverbs_std_types_counters.c
+index a0ffdcf9a51cd..bb3a03cdc9742 100644
+--- a/drivers/infiniband/core/uverbs_std_types_counters.c
++++ b/drivers/infiniband/core/uverbs_std_types_counters.c
+@@ -103,6 +103,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_COUNTERS_READ)(
+ return ret;
+
+ uattr = uverbs_attr_get(attrs, UVERBS_ATTR_READ_COUNTERS_BUFF);
++ if (IS_ERR(uattr))
++ return PTR_ERR(uattr);
+ read_attr.ncounters = uattr->ptr_attr.len / sizeof(u64);
+ read_attr.counters_buff = uverbs_zalloc(
+ attrs, array_size(read_attr.ncounters, sizeof(u64)));
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index de6fc8887c4a4..60594dad55455 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -2654,6 +2654,8 @@ static void isert_wait_conn(struct iscsi_conn *conn)
+ isert_put_unsol_pending_cmds(conn);
+ isert_wait4cmds(conn);
+ isert_wait4logout(isert_conn);
++
++ queue_work(isert_release_wq, &isert_conn->release_work);
+ }
+
+ static void isert_free_conn(struct iscsi_conn *conn)
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 0f8b1fb3d0517..5ff06fbcfabf5 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1785,6 +1785,9 @@ static int raid1_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
+ int number = rdev->raid_disk;
+ struct raid1_info *p = conf->mirrors + number;
+
++ if (unlikely(number >= conf->raid_disks))
++ goto abort;
++
+ if (rdev != p->rdev)
+ p = conf->mirrors + conf->raid_disks + number;
+
+diff --git a/drivers/media/dvb-frontends/ascot2e.c b/drivers/media/dvb-frontends/ascot2e.c
+index 52ce0e6e2a150..7b0f6eeb383df 100644
+--- a/drivers/media/dvb-frontends/ascot2e.c
++++ b/drivers/media/dvb-frontends/ascot2e.c
+@@ -542,7 +542,7 @@ struct dvb_frontend *ascot2e_attach(struct dvb_frontend *fe,
+ priv->i2c_address, priv->i2c);
+ return fe;
+ }
+-EXPORT_SYMBOL(ascot2e_attach);
++EXPORT_SYMBOL_GPL(ascot2e_attach);
+
+ MODULE_DESCRIPTION("Sony ASCOT2E terr/cab tuner driver");
+ MODULE_AUTHOR("info@netup.ru");
+diff --git a/drivers/media/dvb-frontends/atbm8830.c b/drivers/media/dvb-frontends/atbm8830.c
+index cbcc65dc9d540..af5ada9f8f455 100644
+--- a/drivers/media/dvb-frontends/atbm8830.c
++++ b/drivers/media/dvb-frontends/atbm8830.c
+@@ -498,7 +498,7 @@ error_out:
+ return NULL;
+
+ }
+-EXPORT_SYMBOL(atbm8830_attach);
++EXPORT_SYMBOL_GPL(atbm8830_attach);
+
+ MODULE_DESCRIPTION("AltoBeam ATBM8830/8831 GB20600 demodulator driver");
+ MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>");
+diff --git a/drivers/media/dvb-frontends/au8522_dig.c b/drivers/media/dvb-frontends/au8522_dig.c
+index 076f737aa8c06..ee9bacc481121 100644
+--- a/drivers/media/dvb-frontends/au8522_dig.c
++++ b/drivers/media/dvb-frontends/au8522_dig.c
+@@ -891,7 +891,7 @@ error:
+ au8522_release_state(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(au8522_attach);
++EXPORT_SYMBOL_GPL(au8522_attach);
+
+ static const struct dvb_frontend_ops au8522_ops = {
+ .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
+diff --git a/drivers/media/dvb-frontends/bcm3510.c b/drivers/media/dvb-frontends/bcm3510.c
+index 6457b0912d14d..bc4cc8c24e1a2 100644
+--- a/drivers/media/dvb-frontends/bcm3510.c
++++ b/drivers/media/dvb-frontends/bcm3510.c
+@@ -835,7 +835,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(bcm3510_attach);
++EXPORT_SYMBOL_GPL(bcm3510_attach);
+
+ static const struct dvb_frontend_ops bcm3510_ops = {
+ .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
+diff --git a/drivers/media/dvb-frontends/cx22700.c b/drivers/media/dvb-frontends/cx22700.c
+index 961380162cdda..43968d02a6641 100644
+--- a/drivers/media/dvb-frontends/cx22700.c
++++ b/drivers/media/dvb-frontends/cx22700.c
+@@ -444,4 +444,4 @@ MODULE_DESCRIPTION("Conexant CX22700 DVB-T Demodulator driver");
+ MODULE_AUTHOR("Holger Waechtler");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(cx22700_attach);
++EXPORT_SYMBOL_GPL(cx22700_attach);
+diff --git a/drivers/media/dvb-frontends/cx22702.c b/drivers/media/dvb-frontends/cx22702.c
+index ab9b2924bcca3..0954e646836c0 100644
+--- a/drivers/media/dvb-frontends/cx22702.c
++++ b/drivers/media/dvb-frontends/cx22702.c
+@@ -616,7 +616,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(cx22702_attach);
++EXPORT_SYMBOL_GPL(cx22702_attach);
+
+ static const struct dvb_frontend_ops cx22702_ops = {
+ .delsys = { SYS_DVBT },
+diff --git a/drivers/media/dvb-frontends/cx24110.c b/drivers/media/dvb-frontends/cx24110.c
+index 9441bdc73097c..ad3291d6aafb8 100644
+--- a/drivers/media/dvb-frontends/cx24110.c
++++ b/drivers/media/dvb-frontends/cx24110.c
+@@ -666,4 +666,4 @@ MODULE_DESCRIPTION("Conexant CX24110 DVB-S Demodulator driver");
+ MODULE_AUTHOR("Peter Hettkamp");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(cx24110_attach);
++EXPORT_SYMBOL_GPL(cx24110_attach);
+diff --git a/drivers/media/dvb-frontends/cx24113.c b/drivers/media/dvb-frontends/cx24113.c
+index 91a5033b6bd75..6e486a0d4d207 100644
+--- a/drivers/media/dvb-frontends/cx24113.c
++++ b/drivers/media/dvb-frontends/cx24113.c
+@@ -600,7 +600,7 @@ error:
+
+ return NULL;
+ }
+-EXPORT_SYMBOL(cx24113_attach);
++EXPORT_SYMBOL_GPL(cx24113_attach);
+
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Activates frontend debugging (default:0)");
+diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c
+index 220f266636472..cb82998619c82 100644
+--- a/drivers/media/dvb-frontends/cx24116.c
++++ b/drivers/media/dvb-frontends/cx24116.c
+@@ -1145,7 +1145,7 @@ struct dvb_frontend *cx24116_attach(const struct cx24116_config *config,
+ state->frontend.demodulator_priv = state;
+ return &state->frontend;
+ }
+-EXPORT_SYMBOL(cx24116_attach);
++EXPORT_SYMBOL_GPL(cx24116_attach);
+
+ /*
+ * Initialise or wake up device
+diff --git a/drivers/media/dvb-frontends/cx24120.c b/drivers/media/dvb-frontends/cx24120.c
+index dd3ec316e7c2a..a6cf5a02ce5b1 100644
+--- a/drivers/media/dvb-frontends/cx24120.c
++++ b/drivers/media/dvb-frontends/cx24120.c
+@@ -313,7 +313,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(cx24120_attach);
++EXPORT_SYMBOL_GPL(cx24120_attach);
+
+ static int cx24120_test_rom(struct cx24120_state *state)
+ {
+@@ -980,7 +980,9 @@ static void cx24120_set_clock_ratios(struct dvb_frontend *fe)
+ cmd.arg[8] = (clock_ratios_table[idx].rate >> 8) & 0xff;
+ cmd.arg[9] = (clock_ratios_table[idx].rate >> 0) & 0xff;
+
+- cx24120_message_send(state, &cmd);
++ ret = cx24120_message_send(state, &cmd);
++ if (ret != 0)
++ return;
+
+ /* Calculate ber window rates for stat work */
+ cx24120_calculate_ber_window(state, clock_ratios_table[idx].rate);
+diff --git a/drivers/media/dvb-frontends/cx24123.c b/drivers/media/dvb-frontends/cx24123.c
+index e49215020a937..faf1c7e5f2e8b 100644
+--- a/drivers/media/dvb-frontends/cx24123.c
++++ b/drivers/media/dvb-frontends/cx24123.c
+@@ -1105,7 +1105,7 @@ error:
+
+ return NULL;
+ }
+-EXPORT_SYMBOL(cx24123_attach);
++EXPORT_SYMBOL_GPL(cx24123_attach);
+
+ static const struct dvb_frontend_ops cx24123_ops = {
+ .delsys = { SYS_DVBS },
+diff --git a/drivers/media/dvb-frontends/cxd2820r_core.c b/drivers/media/dvb-frontends/cxd2820r_core.c
+index 3e0d8cbd76da3..9b81f1651ad0d 100644
+--- a/drivers/media/dvb-frontends/cxd2820r_core.c
++++ b/drivers/media/dvb-frontends/cxd2820r_core.c
+@@ -549,7 +549,7 @@ struct dvb_frontend *cxd2820r_attach(const struct cxd2820r_config *config,
+
+ return pdata.get_dvb_frontend(client);
+ }
+-EXPORT_SYMBOL(cxd2820r_attach);
++EXPORT_SYMBOL_GPL(cxd2820r_attach);
+
+ static struct dvb_frontend *cxd2820r_get_dvb_frontend(struct i2c_client *client)
+ {
+diff --git a/drivers/media/dvb-frontends/cxd2841er.c b/drivers/media/dvb-frontends/cxd2841er.c
+index c98093ed3dd76..f7cb001288104 100644
+--- a/drivers/media/dvb-frontends/cxd2841er.c
++++ b/drivers/media/dvb-frontends/cxd2841er.c
+@@ -3929,14 +3929,14 @@ struct dvb_frontend *cxd2841er_attach_s(struct cxd2841er_config *cfg,
+ {
+ return cxd2841er_attach(cfg, i2c, SYS_DVBS);
+ }
+-EXPORT_SYMBOL(cxd2841er_attach_s);
++EXPORT_SYMBOL_GPL(cxd2841er_attach_s);
+
+ struct dvb_frontend *cxd2841er_attach_t_c(struct cxd2841er_config *cfg,
+ struct i2c_adapter *i2c)
+ {
+ return cxd2841er_attach(cfg, i2c, 0);
+ }
+-EXPORT_SYMBOL(cxd2841er_attach_t_c);
++EXPORT_SYMBOL_GPL(cxd2841er_attach_t_c);
+
+ static const struct dvb_frontend_ops cxd2841er_dvbs_s2_ops = {
+ .delsys = { SYS_DVBS, SYS_DVBS2 },
+diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c
+index f87e27481ea7b..ea1bc9a35618e 100644
+--- a/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c
++++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c
+@@ -1950,7 +1950,7 @@ struct dvb_frontend *cxd2880_attach(struct dvb_frontend *fe,
+
+ return fe;
+ }
+-EXPORT_SYMBOL(cxd2880_attach);
++EXPORT_SYMBOL_GPL(cxd2880_attach);
+
+ MODULE_DESCRIPTION("Sony CXD2880 DVB-T2/T tuner + demod driver");
+ MODULE_AUTHOR("Sony Semiconductor Solutions Corporation");
+diff --git a/drivers/media/dvb-frontends/dib0070.c b/drivers/media/dvb-frontends/dib0070.c
+index 37ebd5af8fd46..81e041ff3dd56 100644
+--- a/drivers/media/dvb-frontends/dib0070.c
++++ b/drivers/media/dvb-frontends/dib0070.c
+@@ -767,7 +767,7 @@ free_mem:
+ fe->tuner_priv = NULL;
+ return NULL;
+ }
+-EXPORT_SYMBOL(dib0070_attach);
++EXPORT_SYMBOL_GPL(dib0070_attach);
+
+ MODULE_AUTHOR("Patrick Boettcher <patrick.boettcher@posteo.de>");
+ MODULE_DESCRIPTION("Driver for the DiBcom 0070 base-band RF Tuner");
+diff --git a/drivers/media/dvb-frontends/dib0090.c b/drivers/media/dvb-frontends/dib0090.c
+index 44a074261e698..c1942d24e0901 100644
+--- a/drivers/media/dvb-frontends/dib0090.c
++++ b/drivers/media/dvb-frontends/dib0090.c
+@@ -2643,7 +2643,7 @@ struct dvb_frontend *dib0090_register(struct dvb_frontend *fe, struct i2c_adapte
+ return NULL;
+ }
+
+-EXPORT_SYMBOL(dib0090_register);
++EXPORT_SYMBOL_GPL(dib0090_register);
+
+ struct dvb_frontend *dib0090_fw_register(struct dvb_frontend *fe, struct i2c_adapter *i2c, const struct dib0090_config *config)
+ {
+@@ -2669,7 +2669,7 @@ free_mem:
+ fe->tuner_priv = NULL;
+ return NULL;
+ }
+-EXPORT_SYMBOL(dib0090_fw_register);
++EXPORT_SYMBOL_GPL(dib0090_fw_register);
+
+ MODULE_AUTHOR("Patrick Boettcher <patrick.boettcher@posteo.de>");
+ MODULE_AUTHOR("Olivier Grenie <olivier.grenie@parrot.com>");
+diff --git a/drivers/media/dvb-frontends/dib3000mb.c b/drivers/media/dvb-frontends/dib3000mb.c
+index bbbd532804774..8df51730d8703 100644
+--- a/drivers/media/dvb-frontends/dib3000mb.c
++++ b/drivers/media/dvb-frontends/dib3000mb.c
+@@ -819,4 +819,4 @@ MODULE_AUTHOR(DRIVER_AUTHOR);
+ MODULE_DESCRIPTION(DRIVER_DESC);
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(dib3000mb_attach);
++EXPORT_SYMBOL_GPL(dib3000mb_attach);
+diff --git a/drivers/media/dvb-frontends/dib3000mc.c b/drivers/media/dvb-frontends/dib3000mc.c
+index c9e1db2517232..040602e8ad743 100644
+--- a/drivers/media/dvb-frontends/dib3000mc.c
++++ b/drivers/media/dvb-frontends/dib3000mc.c
+@@ -938,7 +938,7 @@ error:
+ kfree(st);
+ return NULL;
+ }
+-EXPORT_SYMBOL(dib3000mc_attach);
++EXPORT_SYMBOL_GPL(dib3000mc_attach);
+
+ static const struct dvb_frontend_ops dib3000mc_ops = {
+ .delsys = { SYS_DVBT },
+diff --git a/drivers/media/dvb-frontends/dib7000m.c b/drivers/media/dvb-frontends/dib7000m.c
+index b79358d09de68..9684559fc6700 100644
+--- a/drivers/media/dvb-frontends/dib7000m.c
++++ b/drivers/media/dvb-frontends/dib7000m.c
+@@ -1437,7 +1437,7 @@ error:
+ kfree(st);
+ return NULL;
+ }
+-EXPORT_SYMBOL(dib7000m_attach);
++EXPORT_SYMBOL_GPL(dib7000m_attach);
+
+ static const struct dvb_frontend_ops dib7000m_ops = {
+ .delsys = { SYS_DVBT },
+diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
+index 58387860b62dc..6399cbc968c47 100644
+--- a/drivers/media/dvb-frontends/dib7000p.c
++++ b/drivers/media/dvb-frontends/dib7000p.c
+@@ -500,7 +500,7 @@ static int dib7000p_update_pll(struct dvb_frontend *fe, struct dibx000_bandwidth
+ prediv = reg_1856 & 0x3f;
+ loopdiv = (reg_1856 >> 6) & 0x3f;
+
+- if ((bw != NULL) && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) {
++ if (loopdiv && bw && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) {
+ dprintk("Updating pll (prediv: old = %d new = %d ; loopdiv : old = %d new = %d)\n", prediv, bw->pll_prediv, loopdiv, bw->pll_ratio);
+ reg_1856 &= 0xf000;
+ reg_1857 = dib7000p_read_word(state, 1857);
+@@ -2818,7 +2818,7 @@ void *dib7000p_attach(struct dib7000p_ops *ops)
+
+ return ops;
+ }
+-EXPORT_SYMBOL(dib7000p_attach);
++EXPORT_SYMBOL_GPL(dib7000p_attach);
+
+ static const struct dvb_frontend_ops dib7000p_ops = {
+ .delsys = { SYS_DVBT },
+diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c
+index 4b9e4afa4c61f..ca3c219df3c5e 100644
+--- a/drivers/media/dvb-frontends/dib8000.c
++++ b/drivers/media/dvb-frontends/dib8000.c
+@@ -4530,7 +4530,7 @@ void *dib8000_attach(struct dib8000_ops *ops)
+
+ return ops;
+ }
+-EXPORT_SYMBOL(dib8000_attach);
++EXPORT_SYMBOL_GPL(dib8000_attach);
+
+ MODULE_AUTHOR("Olivier Grenie <Olivier.Grenie@parrot.com, Patrick Boettcher <patrick.boettcher@posteo.de>");
+ MODULE_DESCRIPTION("Driver for the DiBcom 8000 ISDB-T demodulator");
+diff --git a/drivers/media/dvb-frontends/dib9000.c b/drivers/media/dvb-frontends/dib9000.c
+index 0183fb1346efc..ebe693bf92567 100644
+--- a/drivers/media/dvb-frontends/dib9000.c
++++ b/drivers/media/dvb-frontends/dib9000.c
+@@ -2547,7 +2547,7 @@ error:
+ kfree(st);
+ return NULL;
+ }
+-EXPORT_SYMBOL(dib9000_attach);
++EXPORT_SYMBOL_GPL(dib9000_attach);
+
+ static const struct dvb_frontend_ops dib9000_ops = {
+ .delsys = { SYS_DVBT },
+diff --git a/drivers/media/dvb-frontends/drx39xyj/drxj.c b/drivers/media/dvb-frontends/drx39xyj/drxj.c
+index 9628d4067fe19..9670bc98b45a9 100644
+--- a/drivers/media/dvb-frontends/drx39xyj/drxj.c
++++ b/drivers/media/dvb-frontends/drx39xyj/drxj.c
+@@ -12367,7 +12367,7 @@ error:
+
+ return NULL;
+ }
+-EXPORT_SYMBOL(drx39xxj_attach);
++EXPORT_SYMBOL_GPL(drx39xxj_attach);
+
+ static const struct dvb_frontend_ops drx39xxj_ops = {
+ .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
+diff --git a/drivers/media/dvb-frontends/drxd_hard.c b/drivers/media/dvb-frontends/drxd_hard.c
+index 684d428efb0dc..f9038c495ece3 100644
+--- a/drivers/media/dvb-frontends/drxd_hard.c
++++ b/drivers/media/dvb-frontends/drxd_hard.c
+@@ -2972,7 +2972,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(drxd_attach);
++EXPORT_SYMBOL_GPL(drxd_attach);
+
+ MODULE_DESCRIPTION("DRXD driver");
+ MODULE_AUTHOR("Micronas");
+diff --git a/drivers/media/dvb-frontends/drxk_hard.c b/drivers/media/dvb-frontends/drxk_hard.c
+index 100a3a0b2db37..ad18c8ba1da03 100644
+--- a/drivers/media/dvb-frontends/drxk_hard.c
++++ b/drivers/media/dvb-frontends/drxk_hard.c
+@@ -6867,7 +6867,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(drxk_attach);
++EXPORT_SYMBOL_GPL(drxk_attach);
+
+ MODULE_DESCRIPTION("DRX-K driver");
+ MODULE_AUTHOR("Ralph Metzler");
+diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
+index 46a55146cb075..adc00f291921a 100644
+--- a/drivers/media/dvb-frontends/ds3000.c
++++ b/drivers/media/dvb-frontends/ds3000.c
+@@ -871,7 +871,7 @@ struct dvb_frontend *ds3000_attach(const struct ds3000_config *config,
+ ds3000_set_voltage(&state->frontend, SEC_VOLTAGE_OFF);
+ return &state->frontend;
+ }
+-EXPORT_SYMBOL(ds3000_attach);
++EXPORT_SYMBOL_GPL(ds3000_attach);
+
+ static int ds3000_set_carrier_offset(struct dvb_frontend *fe,
+ s32 carrier_offset_khz)
+diff --git a/drivers/media/dvb-frontends/dvb-pll.c b/drivers/media/dvb-frontends/dvb-pll.c
+index ee830c76e4b30..bd7576e633880 100644
+--- a/drivers/media/dvb-frontends/dvb-pll.c
++++ b/drivers/media/dvb-frontends/dvb-pll.c
+@@ -875,7 +875,7 @@ out:
+
+ return NULL;
+ }
+-EXPORT_SYMBOL(dvb_pll_attach);
++EXPORT_SYMBOL_GPL(dvb_pll_attach);
+
+
+ static int
+diff --git a/drivers/media/dvb-frontends/ec100.c b/drivers/media/dvb-frontends/ec100.c
+index c2575fdcc8113..121699e414750 100644
+--- a/drivers/media/dvb-frontends/ec100.c
++++ b/drivers/media/dvb-frontends/ec100.c
+@@ -309,7 +309,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(ec100_attach);
++EXPORT_SYMBOL_GPL(ec100_attach);
+
+ static const struct dvb_frontend_ops ec100_ops = {
+ .delsys = { SYS_DVBT },
+diff --git a/drivers/media/dvb-frontends/helene.c b/drivers/media/dvb-frontends/helene.c
+index d7790cb98a0c7..2945124cb7ae1 100644
+--- a/drivers/media/dvb-frontends/helene.c
++++ b/drivers/media/dvb-frontends/helene.c
+@@ -1034,7 +1034,7 @@ struct dvb_frontend *helene_attach_s(struct dvb_frontend *fe,
+ priv->i2c_address, priv->i2c);
+ return fe;
+ }
+-EXPORT_SYMBOL(helene_attach_s);
++EXPORT_SYMBOL_GPL(helene_attach_s);
+
+ struct dvb_frontend *helene_attach(struct dvb_frontend *fe,
+ const struct helene_config *config,
+@@ -1070,7 +1070,7 @@ struct dvb_frontend *helene_attach(struct dvb_frontend *fe,
+ priv->i2c_address, priv->i2c);
+ return fe;
+ }
+-EXPORT_SYMBOL(helene_attach);
++EXPORT_SYMBOL_GPL(helene_attach);
+
+ static int helene_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+diff --git a/drivers/media/dvb-frontends/horus3a.c b/drivers/media/dvb-frontends/horus3a.c
+index 02bc080819717..b748b351e161d 100644
+--- a/drivers/media/dvb-frontends/horus3a.c
++++ b/drivers/media/dvb-frontends/horus3a.c
+@@ -404,7 +404,7 @@ struct dvb_frontend *horus3a_attach(struct dvb_frontend *fe,
+ priv->i2c_address, priv->i2c);
+ return fe;
+ }
+-EXPORT_SYMBOL(horus3a_attach);
++EXPORT_SYMBOL_GPL(horus3a_attach);
+
+ MODULE_DESCRIPTION("Sony HORUS3A satellite tuner driver");
+ MODULE_AUTHOR("Sergey Kozlov <serjk@netup.ru>");
+diff --git a/drivers/media/dvb-frontends/isl6405.c b/drivers/media/dvb-frontends/isl6405.c
+index 3bc78f8ffc00e..9ca4a354a3926 100644
+--- a/drivers/media/dvb-frontends/isl6405.c
++++ b/drivers/media/dvb-frontends/isl6405.c
+@@ -155,7 +155,7 @@ struct dvb_frontend *isl6405_attach(struct dvb_frontend *fe, struct i2c_adapter
+
+ return fe;
+ }
+-EXPORT_SYMBOL(isl6405_attach);
++EXPORT_SYMBOL_GPL(isl6405_attach);
+
+ MODULE_DESCRIPTION("Driver for lnb supply and control ic isl6405");
+ MODULE_AUTHOR("Hartmut Hackmann & Oliver Endriss");
+diff --git a/drivers/media/dvb-frontends/isl6421.c b/drivers/media/dvb-frontends/isl6421.c
+index ae8ec59b665cc..a3515dbf1017d 100644
+--- a/drivers/media/dvb-frontends/isl6421.c
++++ b/drivers/media/dvb-frontends/isl6421.c
+@@ -227,7 +227,7 @@ struct dvb_frontend *isl6421_attach(struct dvb_frontend *fe, struct i2c_adapter
+
+ return fe;
+ }
+-EXPORT_SYMBOL(isl6421_attach);
++EXPORT_SYMBOL_GPL(isl6421_attach);
+
+ MODULE_DESCRIPTION("Driver for lnb supply and control ic isl6421");
+ MODULE_AUTHOR("Andrew de Quincey & Oliver Endriss");
+diff --git a/drivers/media/dvb-frontends/isl6423.c b/drivers/media/dvb-frontends/isl6423.c
+index 3dd2465d17cf6..ea029df731cc5 100644
+--- a/drivers/media/dvb-frontends/isl6423.c
++++ b/drivers/media/dvb-frontends/isl6423.c
+@@ -301,7 +301,7 @@ exit:
+ fe->sec_priv = NULL;
+ return NULL;
+ }
+-EXPORT_SYMBOL(isl6423_attach);
++EXPORT_SYMBOL_GPL(isl6423_attach);
+
+ MODULE_DESCRIPTION("ISL6423 SEC");
+ MODULE_AUTHOR("Manu Abraham");
+diff --git a/drivers/media/dvb-frontends/itd1000.c b/drivers/media/dvb-frontends/itd1000.c
+index c3a6e81ae87f8..9d87ef92f60a7 100644
+--- a/drivers/media/dvb-frontends/itd1000.c
++++ b/drivers/media/dvb-frontends/itd1000.c
+@@ -399,7 +399,7 @@ struct dvb_frontend *itd1000_attach(struct dvb_frontend *fe, struct i2c_adapter
+
+ return fe;
+ }
+-EXPORT_SYMBOL(itd1000_attach);
++EXPORT_SYMBOL_GPL(itd1000_attach);
+
+ MODULE_AUTHOR("Patrick Boettcher <pb@linuxtv.org>");
+ MODULE_DESCRIPTION("Integrant ITD1000 driver");
+diff --git a/drivers/media/dvb-frontends/ix2505v.c b/drivers/media/dvb-frontends/ix2505v.c
+index a30707b61b1fb..577491354c5fd 100644
+--- a/drivers/media/dvb-frontends/ix2505v.c
++++ b/drivers/media/dvb-frontends/ix2505v.c
+@@ -311,7 +311,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(ix2505v_attach);
++EXPORT_SYMBOL_GPL(ix2505v_attach);
+
+ module_param_named(debug, ix2505v_debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+diff --git a/drivers/media/dvb-frontends/l64781.c b/drivers/media/dvb-frontends/l64781.c
+index 9afb5bf6424bf..6a19d4d0d4ade 100644
+--- a/drivers/media/dvb-frontends/l64781.c
++++ b/drivers/media/dvb-frontends/l64781.c
+@@ -605,4 +605,4 @@ MODULE_DESCRIPTION("LSI L64781 DVB-T Demodulator driver");
+ MODULE_AUTHOR("Holger Waechtler, Marko Kohtala");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(l64781_attach);
++EXPORT_SYMBOL_GPL(l64781_attach);
+diff --git a/drivers/media/dvb-frontends/lg2160.c b/drivers/media/dvb-frontends/lg2160.c
+index 408151e33fa7f..96b271a8247db 100644
+--- a/drivers/media/dvb-frontends/lg2160.c
++++ b/drivers/media/dvb-frontends/lg2160.c
+@@ -1436,7 +1436,7 @@ struct dvb_frontend *lg2160_attach(const struct lg2160_config *config,
+
+ return &state->frontend;
+ }
+-EXPORT_SYMBOL(lg2160_attach);
++EXPORT_SYMBOL_GPL(lg2160_attach);
+
+ MODULE_DESCRIPTION("LG Electronics LG216x ATSC/MH Demodulator Driver");
+ MODULE_AUTHOR("Michael Krufky <mkrufky@linuxtv.org>");
+diff --git a/drivers/media/dvb-frontends/lgdt3305.c b/drivers/media/dvb-frontends/lgdt3305.c
+index 857e9b4d69b44..7592e9e75bfbb 100644
+--- a/drivers/media/dvb-frontends/lgdt3305.c
++++ b/drivers/media/dvb-frontends/lgdt3305.c
+@@ -1158,7 +1158,7 @@ fail:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(lgdt3305_attach);
++EXPORT_SYMBOL_GPL(lgdt3305_attach);
+
+ static const struct dvb_frontend_ops lgdt3304_ops = {
+ .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
+diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c
+index 0e1f5daaf20cd..567bf0dc92063 100644
+--- a/drivers/media/dvb-frontends/lgdt3306a.c
++++ b/drivers/media/dvb-frontends/lgdt3306a.c
+@@ -1887,7 +1887,7 @@ fail:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(lgdt3306a_attach);
++EXPORT_SYMBOL_GPL(lgdt3306a_attach);
+
+ #ifdef DBG_DUMP
+
+diff --git a/drivers/media/dvb-frontends/lgdt330x.c b/drivers/media/dvb-frontends/lgdt330x.c
+index 9ee1c1360ab84..b9ae8c8385017 100644
+--- a/drivers/media/dvb-frontends/lgdt330x.c
++++ b/drivers/media/dvb-frontends/lgdt330x.c
+@@ -938,7 +938,7 @@ struct dvb_frontend *lgdt330x_attach(const struct lgdt330x_config *_config,
+
+ return lgdt330x_get_dvb_frontend(client);
+ }
+-EXPORT_SYMBOL(lgdt330x_attach);
++EXPORT_SYMBOL_GPL(lgdt330x_attach);
+
+ static const struct dvb_frontend_ops lgdt3302_ops = {
+ .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
+diff --git a/drivers/media/dvb-frontends/lgs8gxx.c b/drivers/media/dvb-frontends/lgs8gxx.c
+index a6bcf1571d10f..f9c1493e80e88 100644
+--- a/drivers/media/dvb-frontends/lgs8gxx.c
++++ b/drivers/media/dvb-frontends/lgs8gxx.c
+@@ -1053,7 +1053,7 @@ error_out:
+ return NULL;
+
+ }
+-EXPORT_SYMBOL(lgs8gxx_attach);
++EXPORT_SYMBOL_GPL(lgs8gxx_attach);
+
+ MODULE_DESCRIPTION("Legend Silicon LGS8913/LGS8GXX DMB-TH demodulator driver");
+ MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>");
+diff --git a/drivers/media/dvb-frontends/lnbh25.c b/drivers/media/dvb-frontends/lnbh25.c
+index 0b388502c2980..bf1c961a64d00 100644
+--- a/drivers/media/dvb-frontends/lnbh25.c
++++ b/drivers/media/dvb-frontends/lnbh25.c
+@@ -182,7 +182,7 @@ struct dvb_frontend *lnbh25_attach(struct dvb_frontend *fe,
+ __func__, priv->i2c_address);
+ return fe;
+ }
+-EXPORT_SYMBOL(lnbh25_attach);
++EXPORT_SYMBOL_GPL(lnbh25_attach);
+
+ MODULE_DESCRIPTION("ST LNBH25 driver");
+ MODULE_AUTHOR("info@netup.ru");
+diff --git a/drivers/media/dvb-frontends/lnbp21.c b/drivers/media/dvb-frontends/lnbp21.c
+index d9966a338a724..84067d27a8719 100644
+--- a/drivers/media/dvb-frontends/lnbp21.c
++++ b/drivers/media/dvb-frontends/lnbp21.c
+@@ -169,7 +169,7 @@ struct dvb_frontend *lnbh24_attach(struct dvb_frontend *fe,
+ return lnbx2x_attach(fe, i2c, override_set, override_clear,
+ i2c_addr, LNBH24_TTX);
+ }
+-EXPORT_SYMBOL(lnbh24_attach);
++EXPORT_SYMBOL_GPL(lnbh24_attach);
+
+ struct dvb_frontend *lnbp21_attach(struct dvb_frontend *fe,
+ struct i2c_adapter *i2c, u8 override_set,
+@@ -178,7 +178,7 @@ struct dvb_frontend *lnbp21_attach(struct dvb_frontend *fe,
+ return lnbx2x_attach(fe, i2c, override_set, override_clear,
+ 0x08, LNBP21_ISEL);
+ }
+-EXPORT_SYMBOL(lnbp21_attach);
++EXPORT_SYMBOL_GPL(lnbp21_attach);
+
+ MODULE_DESCRIPTION("Driver for lnb supply and control ic lnbp21, lnbh24");
+ MODULE_AUTHOR("Oliver Endriss, Igor M. Liplianin");
+diff --git a/drivers/media/dvb-frontends/lnbp22.c b/drivers/media/dvb-frontends/lnbp22.c
+index a62e82bf46f5b..a4257e07eb7b5 100644
+--- a/drivers/media/dvb-frontends/lnbp22.c
++++ b/drivers/media/dvb-frontends/lnbp22.c
+@@ -139,7 +139,7 @@ struct dvb_frontend *lnbp22_attach(struct dvb_frontend *fe,
+
+ return fe;
+ }
+-EXPORT_SYMBOL(lnbp22_attach);
++EXPORT_SYMBOL_GPL(lnbp22_attach);
+
+ MODULE_DESCRIPTION("Driver for lnb supply and control ic lnbp22");
+ MODULE_AUTHOR("Dominik Kuhlen");
+diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c
+index c25c927974089..ed4076f1c6e0e 100644
+--- a/drivers/media/dvb-frontends/m88ds3103.c
++++ b/drivers/media/dvb-frontends/m88ds3103.c
+@@ -1293,7 +1293,7 @@ struct dvb_frontend *m88ds3103_attach(const struct m88ds3103_config *cfg,
+ *tuner_i2c_adapter = pdata.get_i2c_adapter(client);
+ return pdata.get_dvb_frontend(client);
+ }
+-EXPORT_SYMBOL(m88ds3103_attach);
++EXPORT_SYMBOL_GPL(m88ds3103_attach);
+
+ static const struct dvb_frontend_ops m88ds3103_ops = {
+ .delsys = {SYS_DVBS, SYS_DVBS2},
+diff --git a/drivers/media/dvb-frontends/m88rs2000.c b/drivers/media/dvb-frontends/m88rs2000.c
+index d5bc85501f9ec..6338b64e6adb4 100644
+--- a/drivers/media/dvb-frontends/m88rs2000.c
++++ b/drivers/media/dvb-frontends/m88rs2000.c
+@@ -819,7 +819,7 @@ error:
+
+ return NULL;
+ }
+-EXPORT_SYMBOL(m88rs2000_attach);
++EXPORT_SYMBOL_GPL(m88rs2000_attach);
+
+ MODULE_DESCRIPTION("M88RS2000 DVB-S Demodulator driver");
+ MODULE_AUTHOR("Malcolm Priestley tvboxspy@gmail.com");
+diff --git a/drivers/media/dvb-frontends/mb86a16.c b/drivers/media/dvb-frontends/mb86a16.c
+index da505a5d035f3..ece2c12155761 100644
+--- a/drivers/media/dvb-frontends/mb86a16.c
++++ b/drivers/media/dvb-frontends/mb86a16.c
+@@ -1863,6 +1863,6 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(mb86a16_attach);
++EXPORT_SYMBOL_GPL(mb86a16_attach);
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Manu Abraham");
+diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c
+index 66fc77db0e759..84f7e9d043986 100644
+--- a/drivers/media/dvb-frontends/mb86a20s.c
++++ b/drivers/media/dvb-frontends/mb86a20s.c
+@@ -2097,7 +2097,7 @@ struct dvb_frontend *mb86a20s_attach(const struct mb86a20s_config *config,
+ dev_info(&i2c->dev, "Detected a Fujitsu mb86a20s frontend\n");
+ return &state->frontend;
+ }
+-EXPORT_SYMBOL(mb86a20s_attach);
++EXPORT_SYMBOL_GPL(mb86a20s_attach);
+
+ static const struct dvb_frontend_ops mb86a20s_ops = {
+ .delsys = { SYS_ISDBT },
+diff --git a/drivers/media/dvb-frontends/mt312.c b/drivers/media/dvb-frontends/mt312.c
+index aad07adda37df..208f5d0c083a0 100644
+--- a/drivers/media/dvb-frontends/mt312.c
++++ b/drivers/media/dvb-frontends/mt312.c
+@@ -840,7 +840,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(mt312_attach);
++EXPORT_SYMBOL_GPL(mt312_attach);
+
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+diff --git a/drivers/media/dvb-frontends/mt352.c b/drivers/media/dvb-frontends/mt352.c
+index da3e466d50e2e..2d3c6a5ef4930 100644
+--- a/drivers/media/dvb-frontends/mt352.c
++++ b/drivers/media/dvb-frontends/mt352.c
+@@ -603,4 +603,4 @@ MODULE_DESCRIPTION("Zarlink MT352 DVB-T Demodulator driver");
+ MODULE_AUTHOR("Holger Waechtler, Daniel Mack, Antonio Mancuso");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(mt352_attach);
++EXPORT_SYMBOL_GPL(mt352_attach);
+diff --git a/drivers/media/dvb-frontends/nxt200x.c b/drivers/media/dvb-frontends/nxt200x.c
+index 0961e686ff689..01d517922e7b2 100644
+--- a/drivers/media/dvb-frontends/nxt200x.c
++++ b/drivers/media/dvb-frontends/nxt200x.c
+@@ -1242,5 +1242,5 @@ MODULE_DESCRIPTION("NXT200X (ATSC 8VSB & ITU-T J.83 AnnexB 64/256 QAM) Demodulat
+ MODULE_AUTHOR("Kirk Lapray, Michael Krufky, Jean-Francois Thibert, and Taylor Jacob");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(nxt200x_attach);
++EXPORT_SYMBOL_GPL(nxt200x_attach);
+
+diff --git a/drivers/media/dvb-frontends/nxt6000.c b/drivers/media/dvb-frontends/nxt6000.c
+index 72e447e8ba649..4fc817f64be43 100644
+--- a/drivers/media/dvb-frontends/nxt6000.c
++++ b/drivers/media/dvb-frontends/nxt6000.c
+@@ -633,4 +633,4 @@ MODULE_DESCRIPTION("NxtWave NXT6000 DVB-T demodulator driver");
+ MODULE_AUTHOR("Florian Schirmer");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(nxt6000_attach);
++EXPORT_SYMBOL_GPL(nxt6000_attach);
+diff --git a/drivers/media/dvb-frontends/or51132.c b/drivers/media/dvb-frontends/or51132.c
+index fc35f37eb3c07..fee54db955322 100644
+--- a/drivers/media/dvb-frontends/or51132.c
++++ b/drivers/media/dvb-frontends/or51132.c
+@@ -616,4 +616,4 @@ MODULE_AUTHOR("Kirk Lapray");
+ MODULE_AUTHOR("Trent Piepho");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(or51132_attach);
++EXPORT_SYMBOL_GPL(or51132_attach);
+diff --git a/drivers/media/dvb-frontends/or51211.c b/drivers/media/dvb-frontends/or51211.c
+index a39bbd8ff1f0d..fbf2ccf60de66 100644
+--- a/drivers/media/dvb-frontends/or51211.c
++++ b/drivers/media/dvb-frontends/or51211.c
+@@ -561,5 +561,5 @@ MODULE_DESCRIPTION("Oren OR51211 VSB [pcHDTV HD-2000] Demodulator Driver");
+ MODULE_AUTHOR("Kirk Lapray");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(or51211_attach);
++EXPORT_SYMBOL_GPL(or51211_attach);
+
+diff --git a/drivers/media/dvb-frontends/s5h1409.c b/drivers/media/dvb-frontends/s5h1409.c
+index ceeb0c3551cee..47e388faac4a5 100644
+--- a/drivers/media/dvb-frontends/s5h1409.c
++++ b/drivers/media/dvb-frontends/s5h1409.c
+@@ -993,7 +993,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(s5h1409_attach);
++EXPORT_SYMBOL_GPL(s5h1409_attach);
+
+ static const struct dvb_frontend_ops s5h1409_ops = {
+ .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
+diff --git a/drivers/media/dvb-frontends/s5h1411.c b/drivers/media/dvb-frontends/s5h1411.c
+index 98aeed1d2284d..d900874044b2e 100644
+--- a/drivers/media/dvb-frontends/s5h1411.c
++++ b/drivers/media/dvb-frontends/s5h1411.c
+@@ -912,7 +912,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(s5h1411_attach);
++EXPORT_SYMBOL_GPL(s5h1411_attach);
+
+ static const struct dvb_frontend_ops s5h1411_ops = {
+ .delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
+diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
+index a65cdf8e8cd9a..085f08427a6d5 100644
+--- a/drivers/media/dvb-frontends/s5h1420.c
++++ b/drivers/media/dvb-frontends/s5h1420.c
+@@ -928,7 +928,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(s5h1420_attach);
++EXPORT_SYMBOL_GPL(s5h1420_attach);
+
+ static const struct dvb_frontend_ops s5h1420_ops = {
+ .delsys = { SYS_DVBS },
+diff --git a/drivers/media/dvb-frontends/s5h1432.c b/drivers/media/dvb-frontends/s5h1432.c
+index 4dc3febc0e12c..f4d6304ed2cef 100644
+--- a/drivers/media/dvb-frontends/s5h1432.c
++++ b/drivers/media/dvb-frontends/s5h1432.c
+@@ -364,7 +364,7 @@ struct dvb_frontend *s5h1432_attach(const struct s5h1432_config *config,
+
+ return &state->frontend;
+ }
+-EXPORT_SYMBOL(s5h1432_attach);
++EXPORT_SYMBOL_GPL(s5h1432_attach);
+
+ static const struct dvb_frontend_ops s5h1432_ops = {
+ .delsys = { SYS_DVBT },
+diff --git a/drivers/media/dvb-frontends/s921.c b/drivers/media/dvb-frontends/s921.c
+index 79276871112a7..4a492445efd79 100644
+--- a/drivers/media/dvb-frontends/s921.c
++++ b/drivers/media/dvb-frontends/s921.c
+@@ -503,7 +503,7 @@ struct dvb_frontend *s921_attach(const struct s921_config *config,
+
+ return &state->frontend;
+ }
+-EXPORT_SYMBOL(s921_attach);
++EXPORT_SYMBOL_GPL(s921_attach);
+
+ static const struct dvb_frontend_ops s921_ops = {
+ .delsys = { SYS_ISDBT },
+diff --git a/drivers/media/dvb-frontends/si21xx.c b/drivers/media/dvb-frontends/si21xx.c
+index 8546a236d4521..fe0b94d3c8b10 100644
+--- a/drivers/media/dvb-frontends/si21xx.c
++++ b/drivers/media/dvb-frontends/si21xx.c
+@@ -943,7 +943,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(si21xx_attach);
++EXPORT_SYMBOL_GPL(si21xx_attach);
+
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+diff --git a/drivers/media/dvb-frontends/sp887x.c b/drivers/media/dvb-frontends/sp887x.c
+index c02f50995df4d..070c74b67ec6a 100644
+--- a/drivers/media/dvb-frontends/sp887x.c
++++ b/drivers/media/dvb-frontends/sp887x.c
+@@ -625,4 +625,4 @@ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+ MODULE_DESCRIPTION("Spase sp887x DVB-T demodulator driver");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(sp887x_attach);
++EXPORT_SYMBOL_GPL(sp887x_attach);
+diff --git a/drivers/media/dvb-frontends/stb0899_drv.c b/drivers/media/dvb-frontends/stb0899_drv.c
+index 874e9c9125d62..6dbc9d890d9c5 100644
+--- a/drivers/media/dvb-frontends/stb0899_drv.c
++++ b/drivers/media/dvb-frontends/stb0899_drv.c
+@@ -1650,7 +1650,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(stb0899_attach);
++EXPORT_SYMBOL_GPL(stb0899_attach);
+ MODULE_PARM_DESC(verbose, "Set Verbosity level");
+ MODULE_AUTHOR("Manu Abraham");
+ MODULE_DESCRIPTION("STB0899 Multi-Std frontend");
+diff --git a/drivers/media/dvb-frontends/stb6000.c b/drivers/media/dvb-frontends/stb6000.c
+index 786b9eccde009..c5e6ddb0ae88f 100644
+--- a/drivers/media/dvb-frontends/stb6000.c
++++ b/drivers/media/dvb-frontends/stb6000.c
+@@ -245,7 +245,7 @@ struct dvb_frontend *stb6000_attach(struct dvb_frontend *fe, int addr,
+
+ return fe;
+ }
+-EXPORT_SYMBOL(stb6000_attach);
++EXPORT_SYMBOL_GPL(stb6000_attach);
+
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+diff --git a/drivers/media/dvb-frontends/stb6100.c b/drivers/media/dvb-frontends/stb6100.c
+index 30ac584dfab33..3ea6da8d847d0 100644
+--- a/drivers/media/dvb-frontends/stb6100.c
++++ b/drivers/media/dvb-frontends/stb6100.c
+@@ -569,7 +569,7 @@ static void stb6100_release(struct dvb_frontend *fe)
+ kfree(state);
+ }
+
+-EXPORT_SYMBOL(stb6100_attach);
++EXPORT_SYMBOL_GPL(stb6100_attach);
+ MODULE_PARM_DESC(verbose, "Set Verbosity level");
+
+ MODULE_AUTHOR("Manu Abraham");
+diff --git a/drivers/media/dvb-frontends/stv0288.c b/drivers/media/dvb-frontends/stv0288.c
+index ca5d8e41c114f..b2b01fcbbfc81 100644
+--- a/drivers/media/dvb-frontends/stv0288.c
++++ b/drivers/media/dvb-frontends/stv0288.c
+@@ -602,7 +602,7 @@ error:
+
+ return NULL;
+ }
+-EXPORT_SYMBOL(stv0288_attach);
++EXPORT_SYMBOL_GPL(stv0288_attach);
+
+ module_param(debug_legacy_dish_switch, int, 0444);
+ MODULE_PARM_DESC(debug_legacy_dish_switch,
+diff --git a/drivers/media/dvb-frontends/stv0297.c b/drivers/media/dvb-frontends/stv0297.c
+index 3ef31a3a27ffb..f90f97b9216f3 100644
+--- a/drivers/media/dvb-frontends/stv0297.c
++++ b/drivers/media/dvb-frontends/stv0297.c
+@@ -722,4 +722,4 @@ MODULE_DESCRIPTION("ST STV0297 DVB-C Demodulator driver");
+ MODULE_AUTHOR("Dennis Noermann and Andrew de Quincey");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(stv0297_attach);
++EXPORT_SYMBOL_GPL(stv0297_attach);
+diff --git a/drivers/media/dvb-frontends/stv0299.c b/drivers/media/dvb-frontends/stv0299.c
+index 4f466394a16c0..822d9add1ecc9 100644
+--- a/drivers/media/dvb-frontends/stv0299.c
++++ b/drivers/media/dvb-frontends/stv0299.c
+@@ -763,4 +763,4 @@ MODULE_DESCRIPTION("ST STV0299 DVB Demodulator driver");
+ MODULE_AUTHOR("Ralph Metzler, Holger Waechtler, Peter Schildmann, Felix Domke, Andreas Oberritter, Andrew de Quincey, Kenneth Aafly");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(stv0299_attach);
++EXPORT_SYMBOL_GPL(stv0299_attach);
+diff --git a/drivers/media/dvb-frontends/stv0367.c b/drivers/media/dvb-frontends/stv0367.c
+index 5b91e740e1358..49f4472f09fa8 100644
+--- a/drivers/media/dvb-frontends/stv0367.c
++++ b/drivers/media/dvb-frontends/stv0367.c
+@@ -1760,7 +1760,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(stv0367ter_attach);
++EXPORT_SYMBOL_GPL(stv0367ter_attach);
+
+ static int stv0367cab_gate_ctrl(struct dvb_frontend *fe, int enable)
+ {
+@@ -2933,7 +2933,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(stv0367cab_attach);
++EXPORT_SYMBOL_GPL(stv0367cab_attach);
+
+ /*
+ * Functions for operation on Digital Devices hardware
+@@ -3354,7 +3354,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(stv0367ddb_attach);
++EXPORT_SYMBOL_GPL(stv0367ddb_attach);
+
+ MODULE_PARM_DESC(debug, "Set debug");
+ MODULE_PARM_DESC(i2c_debug, "Set i2c debug");
+diff --git a/drivers/media/dvb-frontends/stv0900_core.c b/drivers/media/dvb-frontends/stv0900_core.c
+index 254618a06140a..272a408dadc64 100644
+--- a/drivers/media/dvb-frontends/stv0900_core.c
++++ b/drivers/media/dvb-frontends/stv0900_core.c
+@@ -1967,7 +1967,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(stv0900_attach);
++EXPORT_SYMBOL_GPL(stv0900_attach);
+
+ MODULE_PARM_DESC(debug, "Set debug");
+
+diff --git a/drivers/media/dvb-frontends/stv6110.c b/drivers/media/dvb-frontends/stv6110.c
+index 7db9a5bceccc5..adb881c77acb4 100644
+--- a/drivers/media/dvb-frontends/stv6110.c
++++ b/drivers/media/dvb-frontends/stv6110.c
+@@ -437,7 +437,7 @@ struct dvb_frontend *stv6110_attach(struct dvb_frontend *fe,
+
+ return fe;
+ }
+-EXPORT_SYMBOL(stv6110_attach);
++EXPORT_SYMBOL_GPL(stv6110_attach);
+
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+diff --git a/drivers/media/dvb-frontends/stv6110x.c b/drivers/media/dvb-frontends/stv6110x.c
+index 82c002d3833a9..6d87e271ff58f 100644
+--- a/drivers/media/dvb-frontends/stv6110x.c
++++ b/drivers/media/dvb-frontends/stv6110x.c
+@@ -408,7 +408,7 @@ const struct stv6110x_devctl *stv6110x_attach(struct dvb_frontend *fe,
+ printk(KERN_INFO "%s: Attaching STV6110x\n", __func__);
+ return stv6110x->devctl;
+ }
+-EXPORT_SYMBOL(stv6110x_attach);
++EXPORT_SYMBOL_GPL(stv6110x_attach);
+
+ MODULE_AUTHOR("Manu Abraham");
+ MODULE_DESCRIPTION("STV6110x Silicon tuner");
+diff --git a/drivers/media/dvb-frontends/tda10021.c b/drivers/media/dvb-frontends/tda10021.c
+index 5cd885d4ea04f..d765b72928ef9 100644
+--- a/drivers/media/dvb-frontends/tda10021.c
++++ b/drivers/media/dvb-frontends/tda10021.c
+@@ -525,4 +525,4 @@ MODULE_DESCRIPTION("Philips TDA10021 DVB-C demodulator driver");
+ MODULE_AUTHOR("Ralph Metzler, Holger Waechtler, Markus Schulz");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(tda10021_attach);
++EXPORT_SYMBOL_GPL(tda10021_attach);
+diff --git a/drivers/media/dvb-frontends/tda10023.c b/drivers/media/dvb-frontends/tda10023.c
+index 0a9a54563ebef..c3d0e50573363 100644
+--- a/drivers/media/dvb-frontends/tda10023.c
++++ b/drivers/media/dvb-frontends/tda10023.c
+@@ -606,4 +606,4 @@ MODULE_DESCRIPTION("Philips TDA10023 DVB-C demodulator driver");
+ MODULE_AUTHOR("Georg Acher, Hartmut Birr");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(tda10023_attach);
++EXPORT_SYMBOL_GPL(tda10023_attach);
+diff --git a/drivers/media/dvb-frontends/tda10048.c b/drivers/media/dvb-frontends/tda10048.c
+index c01d60a88af29..6ca1b25542c5c 100644
+--- a/drivers/media/dvb-frontends/tda10048.c
++++ b/drivers/media/dvb-frontends/tda10048.c
+@@ -1150,7 +1150,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(tda10048_attach);
++EXPORT_SYMBOL_GPL(tda10048_attach);
+
+ static const struct dvb_frontend_ops tda10048_ops = {
+ .delsys = { SYS_DVBT },
+diff --git a/drivers/media/dvb-frontends/tda1004x.c b/drivers/media/dvb-frontends/tda1004x.c
+index e506f66657bbf..57bb83e4d4c71 100644
+--- a/drivers/media/dvb-frontends/tda1004x.c
++++ b/drivers/media/dvb-frontends/tda1004x.c
+@@ -1391,5 +1391,5 @@ MODULE_DESCRIPTION("Philips TDA10045H & TDA10046H DVB-T Demodulator");
+ MODULE_AUTHOR("Andrew de Quincey & Robert Schlabbach");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(tda10045_attach);
+-EXPORT_SYMBOL(tda10046_attach);
++EXPORT_SYMBOL_GPL(tda10045_attach);
++EXPORT_SYMBOL_GPL(tda10046_attach);
+diff --git a/drivers/media/dvb-frontends/tda10086.c b/drivers/media/dvb-frontends/tda10086.c
+index 8323e4e53d661..a3457a915dc8f 100644
+--- a/drivers/media/dvb-frontends/tda10086.c
++++ b/drivers/media/dvb-frontends/tda10086.c
+@@ -777,4 +777,4 @@ MODULE_DESCRIPTION("Philips TDA10086 DVB-S Demodulator");
+ MODULE_AUTHOR("Andrew de Quincey");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(tda10086_attach);
++EXPORT_SYMBOL_GPL(tda10086_attach);
+diff --git a/drivers/media/dvb-frontends/tda665x.c b/drivers/media/dvb-frontends/tda665x.c
+index 8766c9ff6680a..d1ccdf19a146e 100644
+--- a/drivers/media/dvb-frontends/tda665x.c
++++ b/drivers/media/dvb-frontends/tda665x.c
+@@ -239,7 +239,7 @@ struct dvb_frontend *tda665x_attach(struct dvb_frontend *fe,
+
+ return fe;
+ }
+-EXPORT_SYMBOL(tda665x_attach);
++EXPORT_SYMBOL_GPL(tda665x_attach);
+
+ MODULE_DESCRIPTION("TDA665x driver");
+ MODULE_AUTHOR("Manu Abraham");
+diff --git a/drivers/media/dvb-frontends/tda8083.c b/drivers/media/dvb-frontends/tda8083.c
+index 53b26060db7e2..721513ecdbe88 100644
+--- a/drivers/media/dvb-frontends/tda8083.c
++++ b/drivers/media/dvb-frontends/tda8083.c
+@@ -493,4 +493,4 @@ MODULE_DESCRIPTION("Philips TDA8083 DVB-S Demodulator");
+ MODULE_AUTHOR("Ralph Metzler, Holger Waechtler");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(tda8083_attach);
++EXPORT_SYMBOL_GPL(tda8083_attach);
+diff --git a/drivers/media/dvb-frontends/tda8261.c b/drivers/media/dvb-frontends/tda8261.c
+index 500f50b81b668..50e25ded30849 100644
+--- a/drivers/media/dvb-frontends/tda8261.c
++++ b/drivers/media/dvb-frontends/tda8261.c
+@@ -200,7 +200,7 @@ exit:
+ return NULL;
+ }
+
+-EXPORT_SYMBOL(tda8261_attach);
++EXPORT_SYMBOL_GPL(tda8261_attach);
+
+ MODULE_AUTHOR("Manu Abraham");
+ MODULE_DESCRIPTION("TDA8261 8PSK/QPSK Tuner");
+diff --git a/drivers/media/dvb-frontends/tda826x.c b/drivers/media/dvb-frontends/tda826x.c
+index 100da5d5fdc5c..c5dd1e6a358d3 100644
+--- a/drivers/media/dvb-frontends/tda826x.c
++++ b/drivers/media/dvb-frontends/tda826x.c
+@@ -177,7 +177,7 @@ struct dvb_frontend *tda826x_attach(struct dvb_frontend *fe, int addr, struct i2
+
+ return fe;
+ }
+-EXPORT_SYMBOL(tda826x_attach);
++EXPORT_SYMBOL_GPL(tda826x_attach);
+
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+diff --git a/drivers/media/dvb-frontends/ts2020.c b/drivers/media/dvb-frontends/ts2020.c
+index 3e3e408786332..1bcf822078ebe 100644
+--- a/drivers/media/dvb-frontends/ts2020.c
++++ b/drivers/media/dvb-frontends/ts2020.c
+@@ -534,7 +534,7 @@ struct dvb_frontend *ts2020_attach(struct dvb_frontend *fe,
+
+ return fe;
+ }
+-EXPORT_SYMBOL(ts2020_attach);
++EXPORT_SYMBOL_GPL(ts2020_attach);
+
+ /*
+ * We implement own regmap locking due to legacy DVB attach which uses frontend
+diff --git a/drivers/media/dvb-frontends/tua6100.c b/drivers/media/dvb-frontends/tua6100.c
+index e6aaf4973aef4..647182eb5fa4f 100644
+--- a/drivers/media/dvb-frontends/tua6100.c
++++ b/drivers/media/dvb-frontends/tua6100.c
+@@ -194,7 +194,7 @@ struct dvb_frontend *tua6100_attach(struct dvb_frontend *fe, int addr, struct i2
+ fe->tuner_priv = priv;
+ return fe;
+ }
+-EXPORT_SYMBOL(tua6100_attach);
++EXPORT_SYMBOL_GPL(tua6100_attach);
+
+ MODULE_DESCRIPTION("DVB tua6100 driver");
+ MODULE_AUTHOR("Andrew de Quincey");
+diff --git a/drivers/media/dvb-frontends/ves1820.c b/drivers/media/dvb-frontends/ves1820.c
+index eb1249d81310a..56e71e780fdd9 100644
+--- a/drivers/media/dvb-frontends/ves1820.c
++++ b/drivers/media/dvb-frontends/ves1820.c
+@@ -446,4 +446,4 @@ MODULE_DESCRIPTION("VLSI VES1820 DVB-C Demodulator driver");
+ MODULE_AUTHOR("Ralph Metzler, Holger Waechtler");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(ves1820_attach);
++EXPORT_SYMBOL_GPL(ves1820_attach);
+diff --git a/drivers/media/dvb-frontends/ves1x93.c b/drivers/media/dvb-frontends/ves1x93.c
+index ddc5bfd84cd58..071c59057e6dd 100644
+--- a/drivers/media/dvb-frontends/ves1x93.c
++++ b/drivers/media/dvb-frontends/ves1x93.c
+@@ -553,4 +553,4 @@ MODULE_DESCRIPTION("VLSI VES1x93 DVB-S Demodulator driver");
+ MODULE_AUTHOR("Ralph Metzler");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(ves1x93_attach);
++EXPORT_SYMBOL_GPL(ves1x93_attach);
+diff --git a/drivers/media/dvb-frontends/zl10036.c b/drivers/media/dvb-frontends/zl10036.c
+index f1c92338015d1..cd1156c18a8bf 100644
+--- a/drivers/media/dvb-frontends/zl10036.c
++++ b/drivers/media/dvb-frontends/zl10036.c
+@@ -504,7 +504,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(zl10036_attach);
++EXPORT_SYMBOL_GPL(zl10036_attach);
+
+ module_param_named(debug, zl10036_debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+diff --git a/drivers/media/dvb-frontends/zl10039.c b/drivers/media/dvb-frontends/zl10039.c
+index 6293bd920fa61..b3a76c00fe886 100644
+--- a/drivers/media/dvb-frontends/zl10039.c
++++ b/drivers/media/dvb-frontends/zl10039.c
+@@ -304,7 +304,7 @@ error:
+ kfree(state);
+ return NULL;
+ }
+-EXPORT_SYMBOL(zl10039_attach);
++EXPORT_SYMBOL_GPL(zl10039_attach);
+
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+diff --git a/drivers/media/dvb-frontends/zl10353.c b/drivers/media/dvb-frontends/zl10353.c
+index 42e63a3fa121c..e2a5dfe937324 100644
+--- a/drivers/media/dvb-frontends/zl10353.c
++++ b/drivers/media/dvb-frontends/zl10353.c
+@@ -675,4 +675,4 @@ MODULE_DESCRIPTION("Zarlink ZL10353 DVB-T demodulator driver");
+ MODULE_AUTHOR("Chris Pascoe");
+ MODULE_LICENSE("GPL");
+
+-EXPORT_SYMBOL(zl10353_attach);
++EXPORT_SYMBOL_GPL(zl10353_attach);
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index d8798fb714ba8..40d583a972a41 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -85,15 +85,8 @@ struct ov2680_mode_info {
+
+ struct ov2680_ctrls {
+ struct v4l2_ctrl_handler handler;
+- struct {
+- struct v4l2_ctrl *auto_exp;
+- struct v4l2_ctrl *exposure;
+- };
+- struct {
+- struct v4l2_ctrl *auto_gain;
+- struct v4l2_ctrl *gain;
+- };
+-
++ struct v4l2_ctrl *exposure;
++ struct v4l2_ctrl *gain;
+ struct v4l2_ctrl *hflip;
+ struct v4l2_ctrl *vflip;
+ struct v4l2_ctrl *test_pattern;
+@@ -143,6 +136,7 @@ static const struct reg_value ov2680_setting_30fps_QUXGA_800_600[] = {
+ {0x380e, 0x02}, {0x380f, 0x84}, {0x3811, 0x04}, {0x3813, 0x04},
+ {0x3814, 0x31}, {0x3815, 0x31}, {0x3820, 0xc0}, {0x4008, 0x00},
+ {0x4009, 0x03}, {0x4837, 0x1e}, {0x3501, 0x4e}, {0x3502, 0xe0},
++ {0x3503, 0x03},
+ };
+
+ static const struct reg_value ov2680_setting_30fps_720P_1280_720[] = {
+@@ -321,70 +315,49 @@ static void ov2680_power_down(struct ov2680_dev *sensor)
+ usleep_range(5000, 10000);
+ }
+
+-static int ov2680_bayer_order(struct ov2680_dev *sensor)
++static void ov2680_set_bayer_order(struct ov2680_dev *sensor)
+ {
+- u32 format1;
+- u32 format2;
+- u32 hv_flip;
+- int ret;
+-
+- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT1, &format1);
+- if (ret < 0)
+- return ret;
++ int hv_flip = 0;
+
+- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT2, &format2);
+- if (ret < 0)
+- return ret;
++ if (sensor->ctrls.vflip && sensor->ctrls.vflip->val)
++ hv_flip += 1;
+
+- hv_flip = (format2 & BIT(2) << 1) | (format1 & BIT(2));
++ if (sensor->ctrls.hflip && sensor->ctrls.hflip->val)
++ hv_flip += 2;
+
+ sensor->fmt.code = ov2680_hv_flip_bayer_order[hv_flip];
+-
+- return 0;
+ }
+
+-static int ov2680_vflip_enable(struct ov2680_dev *sensor)
++static int ov2680_set_vflip(struct ov2680_dev *sensor, s32 val)
+ {
+ int ret;
+
+- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(2));
+- if (ret < 0)
+- return ret;
+-
+- return ov2680_bayer_order(sensor);
+-}
+-
+-static int ov2680_vflip_disable(struct ov2680_dev *sensor)
+-{
+- int ret;
++ if (sensor->is_streaming)
++ return -EBUSY;
+
+- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(0));
++ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1,
++ BIT(2), val ? BIT(2) : 0);
+ if (ret < 0)
+ return ret;
+
+- return ov2680_bayer_order(sensor);
++ ov2680_set_bayer_order(sensor);
++ return 0;
+ }
+
+-static int ov2680_hflip_enable(struct ov2680_dev *sensor)
++static int ov2680_set_hflip(struct ov2680_dev *sensor, s32 val)
+ {
+ int ret;
+
+- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(2));
+- if (ret < 0)
+- return ret;
+-
+- return ov2680_bayer_order(sensor);
+-}
+-
+-static int ov2680_hflip_disable(struct ov2680_dev *sensor)
+-{
+- int ret;
++ if (sensor->is_streaming)
++ return -EBUSY;
+
+- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(0));
++ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2,
++ BIT(2), val ? BIT(2) : 0);
+ if (ret < 0)
+ return ret;
+
+- return ov2680_bayer_order(sensor);
++ ov2680_set_bayer_order(sensor);
++ return 0;
+ }
+
+ static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value)
+@@ -405,69 +378,15 @@ static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value)
+ return 0;
+ }
+
+-static int ov2680_gain_set(struct ov2680_dev *sensor, bool auto_gain)
++static int ov2680_gain_set(struct ov2680_dev *sensor, u32 gain)
+ {
+- struct ov2680_ctrls *ctrls = &sensor->ctrls;
+- u32 gain;
+- int ret;
+-
+- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(1),
+- auto_gain ? 0 : BIT(1));
+- if (ret < 0)
+- return ret;
+-
+- if (auto_gain || !ctrls->gain->is_new)
+- return 0;
+-
+- gain = ctrls->gain->val;
+-
+- ret = ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain);
+-
+- return 0;
++ return ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain);
+ }
+
+-static int ov2680_gain_get(struct ov2680_dev *sensor)
++static int ov2680_exposure_set(struct ov2680_dev *sensor, u32 exp)
+ {
+- u32 gain;
+- int ret;
+-
+- ret = ov2680_read_reg16(sensor, OV2680_REG_GAIN_PK, &gain);
+- if (ret)
+- return ret;
+-
+- return gain;
+-}
+-
+-static int ov2680_exposure_set(struct ov2680_dev *sensor, bool auto_exp)
+-{
+- struct ov2680_ctrls *ctrls = &sensor->ctrls;
+- u32 exp;
+- int ret;
+-
+- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(0),
+- auto_exp ? 0 : BIT(0));
+- if (ret < 0)
+- return ret;
+-
+- if (auto_exp || !ctrls->exposure->is_new)
+- return 0;
+-
+- exp = (u32)ctrls->exposure->val;
+- exp <<= 4;
+-
+- return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, exp);
+-}
+-
+-static int ov2680_exposure_get(struct ov2680_dev *sensor)
+-{
+- int ret;
+- u32 exp;
+-
+- ret = ov2680_read_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, &exp);
+- if (ret)
+- return ret;
+-
+- return exp >> 4;
++ return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH,
++ exp << 4);
+ }
+
+ static int ov2680_stream_enable(struct ov2680_dev *sensor)
+@@ -482,33 +401,17 @@ static int ov2680_stream_disable(struct ov2680_dev *sensor)
+
+ static int ov2680_mode_set(struct ov2680_dev *sensor)
+ {
+- struct ov2680_ctrls *ctrls = &sensor->ctrls;
+ int ret;
+
+- ret = ov2680_gain_set(sensor, false);
++ ret = ov2680_load_regs(sensor, sensor->current_mode);
+ if (ret < 0)
+ return ret;
+
+- ret = ov2680_exposure_set(sensor, false);
++ /* Restore value of all ctrls */
++ ret = __v4l2_ctrl_handler_setup(&sensor->ctrls.handler);
+ if (ret < 0)
+ return ret;
+
+- ret = ov2680_load_regs(sensor, sensor->current_mode);
+- if (ret < 0)
+- return ret;
+-
+- if (ctrls->auto_gain->val) {
+- ret = ov2680_gain_set(sensor, true);
+- if (ret < 0)
+- return ret;
+- }
+-
+- if (ctrls->auto_exp->val == V4L2_EXPOSURE_AUTO) {
+- ret = ov2680_exposure_set(sensor, true);
+- if (ret < 0)
+- return ret;
+- }
+-
+ sensor->mode_pending_changes = false;
+
+ return 0;
+@@ -556,7 +459,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
+ ret = ov2680_write_reg(sensor, OV2680_REG_SOFT_RESET, 0x01);
+ if (ret != 0) {
+ dev_err(dev, "sensor soft reset failed\n");
+- return ret;
++ goto err_disable_regulators;
+ }
+ usleep_range(1000, 2000);
+ } else {
+@@ -566,7 +469,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
+
+ ret = clk_prepare_enable(sensor->xvclk);
+ if (ret < 0)
+- return ret;
++ goto err_disable_regulators;
+
+ sensor->is_enabled = true;
+
+@@ -576,6 +479,10 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
+ ov2680_stream_disable(sensor);
+
+ return 0;
++
++err_disable_regulators:
++ regulator_bulk_disable(OV2680_NUM_SUPPLIES, sensor->supplies);
++ return ret;
+ }
+
+ static int ov2680_s_power(struct v4l2_subdev *sd, int on)
+@@ -590,15 +497,10 @@ static int ov2680_s_power(struct v4l2_subdev *sd, int on)
+ else
+ ret = ov2680_power_off(sensor);
+
+- mutex_unlock(&sensor->lock);
+-
+- if (on && ret == 0) {
+- ret = v4l2_ctrl_handler_setup(&sensor->ctrls.handler);
+- if (ret < 0)
+- return ret;
+-
++ if (on && ret == 0)
+ ret = ov2680_mode_restore(sensor);
+- }
++
++ mutex_unlock(&sensor->lock);
+
+ return ret;
+ }
+@@ -796,66 +698,23 @@ static int ov2680_enum_frame_interval(struct v4l2_subdev *sd,
+ return 0;
+ }
+
+-static int ov2680_g_volatile_ctrl(struct v4l2_ctrl *ctrl)
+-{
+- struct v4l2_subdev *sd = ctrl_to_sd(ctrl);
+- struct ov2680_dev *sensor = to_ov2680_dev(sd);
+- struct ov2680_ctrls *ctrls = &sensor->ctrls;
+- int val;
+-
+- if (!sensor->is_enabled)
+- return 0;
+-
+- switch (ctrl->id) {
+- case V4L2_CID_GAIN:
+- val = ov2680_gain_get(sensor);
+- if (val < 0)
+- return val;
+- ctrls->gain->val = val;
+- break;
+- case V4L2_CID_EXPOSURE:
+- val = ov2680_exposure_get(sensor);
+- if (val < 0)
+- return val;
+- ctrls->exposure->val = val;
+- break;
+- }
+-
+- return 0;
+-}
+-
+ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ struct v4l2_subdev *sd = ctrl_to_sd(ctrl);
+ struct ov2680_dev *sensor = to_ov2680_dev(sd);
+- struct ov2680_ctrls *ctrls = &sensor->ctrls;
+
+ if (!sensor->is_enabled)
+ return 0;
+
+ switch (ctrl->id) {
+- case V4L2_CID_AUTOGAIN:
+- return ov2680_gain_set(sensor, !!ctrl->val);
+ case V4L2_CID_GAIN:
+- return ov2680_gain_set(sensor, !!ctrls->auto_gain->val);
+- case V4L2_CID_EXPOSURE_AUTO:
+- return ov2680_exposure_set(sensor, !!ctrl->val);
++ return ov2680_gain_set(sensor, ctrl->val);
+ case V4L2_CID_EXPOSURE:
+- return ov2680_exposure_set(sensor, !!ctrls->auto_exp->val);
++ return ov2680_exposure_set(sensor, ctrl->val);
+ case V4L2_CID_VFLIP:
+- if (sensor->is_streaming)
+- return -EBUSY;
+- if (ctrl->val)
+- return ov2680_vflip_enable(sensor);
+- else
+- return ov2680_vflip_disable(sensor);
++ return ov2680_set_vflip(sensor, ctrl->val);
+ case V4L2_CID_HFLIP:
+- if (sensor->is_streaming)
+- return -EBUSY;
+- if (ctrl->val)
+- return ov2680_hflip_enable(sensor);
+- else
+- return ov2680_hflip_disable(sensor);
++ return ov2680_set_hflip(sensor, ctrl->val);
+ case V4L2_CID_TEST_PATTERN:
+ return ov2680_test_pattern_set(sensor, ctrl->val);
+ default:
+@@ -866,7 +725,6 @@ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl)
+ }
+
+ static const struct v4l2_ctrl_ops ov2680_ctrl_ops = {
+- .g_volatile_ctrl = ov2680_g_volatile_ctrl,
+ .s_ctrl = ov2680_s_ctrl,
+ };
+
+@@ -938,7 +796,7 @@ static int ov2680_v4l2_init(struct ov2680_dev *sensor)
+ if (ret < 0)
+ return ret;
+
+- v4l2_ctrl_handler_init(hdl, 7);
++ v4l2_ctrl_handler_init(hdl, 5);
+
+ hdl->lock = &sensor->lock;
+
+@@ -950,16 +808,9 @@ static int ov2680_v4l2_init(struct ov2680_dev *sensor)
+ ARRAY_SIZE(test_pattern_menu) - 1,
+ 0, 0, test_pattern_menu);
+
+- ctrls->auto_exp = v4l2_ctrl_new_std_menu(hdl, ops,
+- V4L2_CID_EXPOSURE_AUTO,
+- V4L2_EXPOSURE_MANUAL, 0,
+- V4L2_EXPOSURE_AUTO);
+-
+ ctrls->exposure = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_EXPOSURE,
+ 0, 32767, 1, 0);
+
+- ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_AUTOGAIN,
+- 0, 1, 1, 1);
+ ctrls->gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_GAIN, 0, 2047, 1, 0);
+
+ if (hdl->error) {
+@@ -967,11 +818,8 @@ static int ov2680_v4l2_init(struct ov2680_dev *sensor)
+ goto cleanup_entity;
+ }
+
+- ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
+- ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
+-
+- v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
+- v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true);
++ ctrls->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
++ ctrls->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
+
+ sensor->sd.ctrl_handler = hdl;
+
+diff --git a/drivers/media/pci/bt8xx/dst.c b/drivers/media/pci/bt8xx/dst.c
+index b98de2a22f78a..0e52a8be03eb3 100644
+--- a/drivers/media/pci/bt8xx/dst.c
++++ b/drivers/media/pci/bt8xx/dst.c
+@@ -1733,7 +1733,7 @@ struct dst_state *dst_attach(struct dst_state *state, struct dvb_adapter *dvb_ad
+ return state; /* Manu (DST is a card not a frontend) */
+ }
+
+-EXPORT_SYMBOL(dst_attach);
++EXPORT_SYMBOL_GPL(dst_attach);
+
+ static const struct dvb_frontend_ops dst_dvbt_ops = {
+ .delsys = { SYS_DVBT },
+diff --git a/drivers/media/pci/bt8xx/dst_ca.c b/drivers/media/pci/bt8xx/dst_ca.c
+index 0a7623c0fc8ef..d4c5fe2c186ba 100644
+--- a/drivers/media/pci/bt8xx/dst_ca.c
++++ b/drivers/media/pci/bt8xx/dst_ca.c
+@@ -680,7 +680,7 @@ struct dvb_device *dst_ca_attach(struct dst_state *dst, struct dvb_adapter *dvb_
+ return NULL;
+ }
+
+-EXPORT_SYMBOL(dst_ca_attach);
++EXPORT_SYMBOL_GPL(dst_ca_attach);
+
+ MODULE_DESCRIPTION("DST DVB-S/T/C Combo CA driver");
+ MODULE_AUTHOR("Manu Abraham");
+diff --git a/drivers/media/pci/cx23885/cx23885-video.c b/drivers/media/pci/cx23885/cx23885-video.c
+index 2a20c7165e1e8..16564899f1141 100644
+--- a/drivers/media/pci/cx23885/cx23885-video.c
++++ b/drivers/media/pci/cx23885/cx23885-video.c
+@@ -420,7 +420,7 @@ static int buffer_prepare(struct vb2_buffer *vb)
+ dev->height >> 1);
+ break;
+ default:
+- BUG();
++ return -EINVAL; /* should not happen */
+ }
+ dprintk(2, "[%p/%d] buffer_init - %dx%d %dbpp \"%s\" - dma=0x%08lx\n",
+ buf, buf->vb.vb2_buf.index,
+diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+index 070ddb52c8231..2c037538c7d8f 100644
+--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
++++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+@@ -361,7 +361,7 @@ static int cio2_hw_init(struct cio2_device *cio2, struct cio2_queue *q)
+ void __iomem *const base = cio2->base;
+ u8 lanes, csi2bus = q->csi2.port;
+ u8 sensor_vc = SENSOR_VIR_CH_DFLT;
+- struct cio2_csi2_timing timing;
++ struct cio2_csi2_timing timing = { 0 };
+ int i, r;
+
+ fmt = cio2_find_format(NULL, &q->subdev_fmt.code);
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index 03171f2cf2968..5f50ea283a04f 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -445,7 +445,7 @@ static int fimc_md_parse_port_node(struct fimc_md *fmd,
+ */
+ np = of_get_parent(rem);
+
+- if (np && !of_node_cmp(np->name, "i2c-isp"))
++ if (of_node_name_eq(np, "i2c-isp"))
+ pd->fimc_bus_type = FIMC_BUS_TYPE_ISP_WRITEBACK;
+ else
+ pd->fimc_bus_type = pd->sensor_bus_type;
+@@ -492,7 +492,7 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd)
+ for_each_available_child_of_node(parent, node) {
+ struct device_node *port;
+
+- if (of_node_cmp(node->name, "csis"))
++ if (!of_node_name_eq(node, "csis"))
+ continue;
+ /* The csis node can have only port subnode. */
+ port = of_get_next_child(node, NULL);
+@@ -713,13 +713,13 @@ static int fimc_md_register_platform_entities(struct fimc_md *fmd,
+ continue;
+
+ /* If driver of any entity isn't ready try all again later. */
+- if (!strcmp(node->name, CSIS_OF_NODE_NAME))
++ if (of_node_name_eq(node, CSIS_OF_NODE_NAME))
+ plat_entity = IDX_CSIS;
+- else if (!strcmp(node->name, FIMC_IS_OF_NODE_NAME))
++ else if (of_node_name_eq(node, FIMC_IS_OF_NODE_NAME))
+ plat_entity = IDX_IS_ISP;
+- else if (!strcmp(node->name, FIMC_LITE_OF_NODE_NAME))
++ else if (of_node_name_eq(node, FIMC_LITE_OF_NODE_NAME))
+ plat_entity = IDX_FLITE;
+- else if (!strcmp(node->name, FIMC_OF_NODE_NAME) &&
++ else if (of_node_name_eq(node, FIMC_OF_NODE_NAME) &&
+ !of_property_read_bool(node, "samsung,lcd-wb"))
+ plat_entity = IDX_FIMC;
+
+diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+index bc8349bc2e80c..2c0d89a46410a 100644
+--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
++++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+@@ -230,10 +230,11 @@ static struct vdec_fb *vp9_rm_from_fb_use_list(struct vdec_vp9_inst
+ if (fb->base_y.va == addr) {
+ list_move_tail(&node->list,
+ &inst->available_fb_node_list);
+- break;
++ return fb;
+ }
+ }
+- return fb;
++
++ return NULL;
+ }
+
+ static void vp9_add_to_fb_free_list(struct vdec_vp9_inst *inst,
+diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
+index d945323fc437d..f9488e01a36f0 100644
+--- a/drivers/media/platform/ti-vpe/cal.c
++++ b/drivers/media/platform/ti-vpe/cal.c
+@@ -1618,7 +1618,7 @@ of_get_next_port(const struct device_node *parent,
+ return NULL;
+ }
+ prev = port;
+- } while (of_node_cmp(port->name, "port") != 0);
++ } while (!of_node_name_eq(port, "port"));
+ }
+
+ return port;
+@@ -1638,7 +1638,7 @@ of_get_next_endpoint(const struct device_node *parent,
+ if (!ep)
+ return NULL;
+ prev = ep;
+- } while (of_node_cmp(ep->name, "endpoint") != 0);
++ } while (!of_node_name_eq(ep, "endpoint"));
+
+ return ep;
+ }
+diff --git a/drivers/media/platform/xilinx/xilinx-tpg.c b/drivers/media/platform/xilinx/xilinx-tpg.c
+index 9c49d1d10bee5..06d25e5fafbf2 100644
+--- a/drivers/media/platform/xilinx/xilinx-tpg.c
++++ b/drivers/media/platform/xilinx/xilinx-tpg.c
+@@ -725,7 +725,7 @@ static int xtpg_parse_of(struct xtpg_device *xtpg)
+ const struct xvip_video_format *format;
+ struct device_node *endpoint;
+
+- if (!port->name || of_node_cmp(port->name, "port"))
++ if (!of_node_name_eq(port, "port"))
+ continue;
+
+ format = xvip_of_get_format(port);
+diff --git a/drivers/media/tuners/fc0011.c b/drivers/media/tuners/fc0011.c
+index a983899c6b0be..b407e1965f8ad 100644
+--- a/drivers/media/tuners/fc0011.c
++++ b/drivers/media/tuners/fc0011.c
+@@ -508,7 +508,7 @@ struct dvb_frontend *fc0011_attach(struct dvb_frontend *fe,
+
+ return fe;
+ }
+-EXPORT_SYMBOL(fc0011_attach);
++EXPORT_SYMBOL_GPL(fc0011_attach);
+
+ MODULE_DESCRIPTION("Fitipower FC0011 silicon tuner driver");
+ MODULE_AUTHOR("Michael Buesch <m@bues.ch>");
+diff --git a/drivers/media/tuners/fc0012.c b/drivers/media/tuners/fc0012.c
+index e992b98ae5bcc..6789a85b618b5 100644
+--- a/drivers/media/tuners/fc0012.c
++++ b/drivers/media/tuners/fc0012.c
+@@ -504,7 +504,7 @@ err:
+
+ return fe;
+ }
+-EXPORT_SYMBOL(fc0012_attach);
++EXPORT_SYMBOL_GPL(fc0012_attach);
+
+ MODULE_DESCRIPTION("Fitipower FC0012 silicon tuner driver");
+ MODULE_AUTHOR("Hans-Frieder Vogt <hfvogt@gmx.net>");
+diff --git a/drivers/media/tuners/fc0013.c b/drivers/media/tuners/fc0013.c
+index fc62afb1450d0..0b7ff74a7936a 100644
+--- a/drivers/media/tuners/fc0013.c
++++ b/drivers/media/tuners/fc0013.c
+@@ -618,7 +618,7 @@ struct dvb_frontend *fc0013_attach(struct dvb_frontend *fe,
+
+ return fe;
+ }
+-EXPORT_SYMBOL(fc0013_attach);
++EXPORT_SYMBOL_GPL(fc0013_attach);
+
+ MODULE_DESCRIPTION("Fitipower FC0013 silicon tuner driver");
+ MODULE_AUTHOR("Hans-Frieder Vogt <hfvogt@gmx.net>");
+diff --git a/drivers/media/tuners/max2165.c b/drivers/media/tuners/max2165.c
+index 721d8f722efb4..9600989eea5f7 100644
+--- a/drivers/media/tuners/max2165.c
++++ b/drivers/media/tuners/max2165.c
+@@ -420,7 +420,7 @@ struct dvb_frontend *max2165_attach(struct dvb_frontend *fe,
+
+ return fe;
+ }
+-EXPORT_SYMBOL(max2165_attach);
++EXPORT_SYMBOL_GPL(max2165_attach);
+
+ MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>");
+ MODULE_DESCRIPTION("Maxim MAX2165 silicon tuner driver");
+diff --git a/drivers/media/tuners/mc44s803.c b/drivers/media/tuners/mc44s803.c
+index 2023e081d9adc..7f6d54910f226 100644
+--- a/drivers/media/tuners/mc44s803.c
++++ b/drivers/media/tuners/mc44s803.c
+@@ -366,7 +366,7 @@ error:
+ kfree(priv);
+ return NULL;
+ }
+-EXPORT_SYMBOL(mc44s803_attach);
++EXPORT_SYMBOL_GPL(mc44s803_attach);
+
+ MODULE_AUTHOR("Jochen Friedrich");
+ MODULE_DESCRIPTION("Freescale MC44S803 silicon tuner driver");
+diff --git a/drivers/media/tuners/mt2060.c b/drivers/media/tuners/mt2060.c
+index 4ace77cfe2857..a7fbd4ab2298d 100644
+--- a/drivers/media/tuners/mt2060.c
++++ b/drivers/media/tuners/mt2060.c
+@@ -450,7 +450,7 @@ struct dvb_frontend * mt2060_attach(struct dvb_frontend *fe, struct i2c_adapter
+
+ return fe;
+ }
+-EXPORT_SYMBOL(mt2060_attach);
++EXPORT_SYMBOL_GPL(mt2060_attach);
+
+ static int mt2060_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+diff --git a/drivers/media/tuners/mt2131.c b/drivers/media/tuners/mt2131.c
+index 086a7b7cf6348..8db33cf31c405 100644
+--- a/drivers/media/tuners/mt2131.c
++++ b/drivers/media/tuners/mt2131.c
+@@ -284,7 +284,7 @@ struct dvb_frontend * mt2131_attach(struct dvb_frontend *fe,
+ fe->tuner_priv = priv;
+ return fe;
+ }
+-EXPORT_SYMBOL(mt2131_attach);
++EXPORT_SYMBOL_GPL(mt2131_attach);
+
+ MODULE_AUTHOR("Steven Toth");
+ MODULE_DESCRIPTION("Microtune MT2131 silicon tuner driver");
+diff --git a/drivers/media/tuners/mt2266.c b/drivers/media/tuners/mt2266.c
+index e6cc78720de4d..5300f71b8fe5e 100644
+--- a/drivers/media/tuners/mt2266.c
++++ b/drivers/media/tuners/mt2266.c
+@@ -345,7 +345,7 @@ struct dvb_frontend * mt2266_attach(struct dvb_frontend *fe, struct i2c_adapter
+ mt2266_calibrate(priv);
+ return fe;
+ }
+-EXPORT_SYMBOL(mt2266_attach);
++EXPORT_SYMBOL_GPL(mt2266_attach);
+
+ MODULE_AUTHOR("Olivier DANET");
+ MODULE_DESCRIPTION("Microtune MT2266 silicon tuner driver");
+diff --git a/drivers/media/tuners/mxl5005s.c b/drivers/media/tuners/mxl5005s.c
+index ec584316c812d..2c540653e12e1 100644
+--- a/drivers/media/tuners/mxl5005s.c
++++ b/drivers/media/tuners/mxl5005s.c
+@@ -4114,7 +4114,7 @@ struct dvb_frontend *mxl5005s_attach(struct dvb_frontend *fe,
+ fe->tuner_priv = state;
+ return fe;
+ }
+-EXPORT_SYMBOL(mxl5005s_attach);
++EXPORT_SYMBOL_GPL(mxl5005s_attach);
+
+ MODULE_DESCRIPTION("MaxLinear MXL5005S silicon tuner driver");
+ MODULE_AUTHOR("Steven Toth");
+diff --git a/drivers/media/tuners/qt1010.c b/drivers/media/tuners/qt1010.c
+index 6d397cc85428d..3236e2277ab33 100644
+--- a/drivers/media/tuners/qt1010.c
++++ b/drivers/media/tuners/qt1010.c
+@@ -351,11 +351,12 @@ static int qt1010_init(struct dvb_frontend *fe)
+ else
+ valptr = &tmpval;
+
+- BUG_ON(i >= ARRAY_SIZE(i2c_data) - 1);
+-
+- err = qt1010_init_meas1(priv, i2c_data[i+1].reg,
+- i2c_data[i].reg,
+- i2c_data[i].val, valptr);
++ if (i >= ARRAY_SIZE(i2c_data) - 1)
++ err = -EIO;
++ else
++ err = qt1010_init_meas1(priv, i2c_data[i + 1].reg,
++ i2c_data[i].reg,
++ i2c_data[i].val, valptr);
+ i++;
+ break;
+ }
+@@ -446,7 +447,7 @@ struct dvb_frontend * qt1010_attach(struct dvb_frontend *fe,
+ fe->tuner_priv = priv;
+ return fe;
+ }
+-EXPORT_SYMBOL(qt1010_attach);
++EXPORT_SYMBOL_GPL(qt1010_attach);
+
+ MODULE_DESCRIPTION("Quantek QT1010 silicon tuner driver");
+ MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
+diff --git a/drivers/media/tuners/tda18218.c b/drivers/media/tuners/tda18218.c
+index cbbd4d5e15da7..16716b557ade2 100644
+--- a/drivers/media/tuners/tda18218.c
++++ b/drivers/media/tuners/tda18218.c
+@@ -345,7 +345,7 @@ struct dvb_frontend *tda18218_attach(struct dvb_frontend *fe,
+
+ return fe;
+ }
+-EXPORT_SYMBOL(tda18218_attach);
++EXPORT_SYMBOL_GPL(tda18218_attach);
+
+ MODULE_DESCRIPTION("NXP TDA18218HN silicon tuner driver");
+ MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
+diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
+index eb6d65dae7486..0ef8f054a7950 100644
+--- a/drivers/media/tuners/xc4000.c
++++ b/drivers/media/tuners/xc4000.c
+@@ -1754,7 +1754,7 @@ fail2:
+ xc4000_release(fe);
+ return NULL;
+ }
+-EXPORT_SYMBOL(xc4000_attach);
++EXPORT_SYMBOL_GPL(xc4000_attach);
+
+ MODULE_AUTHOR("Steven Toth, Davide Ferri");
+ MODULE_DESCRIPTION("Xceive xc4000 silicon tuner driver");
+diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
+index f6b65278e5029..1175531a6b9b7 100644
+--- a/drivers/media/tuners/xc5000.c
++++ b/drivers/media/tuners/xc5000.c
+@@ -1470,7 +1470,7 @@ fail:
+ xc5000_release(fe);
+ return NULL;
+ }
+-EXPORT_SYMBOL(xc5000_attach);
++EXPORT_SYMBOL_GPL(xc5000_attach);
+
+ MODULE_AUTHOR("Steven Toth");
+ MODULE_DESCRIPTION("Xceive xc5000 silicon tuner driver");
+diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
+index 1f6c1eefe3892..8a83f27875ec9 100644
+--- a/drivers/media/usb/dvb-usb-v2/af9035.c
++++ b/drivers/media/usb/dvb-usb-v2/af9035.c
+@@ -284,6 +284,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
+ struct dvb_usb_device *d = i2c_get_adapdata(adap);
+ struct state *state = d_to_priv(d);
+ int ret;
++ u32 reg;
+
+ if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
+ return -EAGAIN;
+@@ -336,8 +337,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
+ ret = -EOPNOTSUPP;
+ } else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
+ (msg[0].addr == state->af9033_i2c_addr[1])) {
++ if (msg[0].len < 3 || msg[1].len < 1)
++ return -EOPNOTSUPP;
+ /* demod access via firmware interface */
+- u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
++ reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
+ msg[0].buf[2];
+
+ if (msg[0].addr == state->af9033_i2c_addr[1])
+@@ -395,17 +398,16 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
+ ret = -EOPNOTSUPP;
+ } else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
+ (msg[0].addr == state->af9033_i2c_addr[1])) {
++ if (msg[0].len < 3)
++ return -EOPNOTSUPP;
+ /* demod access via firmware interface */
+- u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
++ reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
+ msg[0].buf[2];
+
+ if (msg[0].addr == state->af9033_i2c_addr[1])
+ reg |= 0x100000;
+
+- ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg,
+- &msg[0].buf[3],
+- msg[0].len - 3)
+- : -EOPNOTSUPP;
++ ret = af9035_wr_regs(d, reg, &msg[0].buf[3], msg[0].len - 3);
+ } else {
+ /* I2C write */
+ u8 buf[MAX_XFER_SIZE];
+diff --git a/drivers/media/usb/dvb-usb-v2/anysee.c b/drivers/media/usb/dvb-usb-v2/anysee.c
+index 20ee7eea2a91e..83af86505363b 100644
+--- a/drivers/media/usb/dvb-usb-v2/anysee.c
++++ b/drivers/media/usb/dvb-usb-v2/anysee.c
+@@ -211,7 +211,7 @@ static int anysee_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msg,
+
+ while (i < num) {
+ if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
+- if (msg[i].len > 2 || msg[i+1].len > 60) {
++ if (msg[i].len != 2 || msg[i + 1].len > 60) {
+ ret = -EOPNOTSUPP;
+ break;
+ }
+diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c
+index 8e914be5b7c5e..2f40eb6bdbb83 100644
+--- a/drivers/media/usb/dvb-usb-v2/az6007.c
++++ b/drivers/media/usb/dvb-usb-v2/az6007.c
+@@ -796,6 +796,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
+ if (az6007_xfer_debug)
+ printk(KERN_DEBUG "az6007: I2C W addr=0x%x len=%d\n",
+ addr, msgs[i].len);
++ if (msgs[i].len < 1) {
++ ret = -EIO;
++ goto err;
++ }
+ req = AZ6007_I2C_WR;
+ index = msgs[i].buf[0];
+ value = addr | (1 << 8);
+@@ -810,6 +814,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
+ if (az6007_xfer_debug)
+ printk(KERN_DEBUG "az6007: I2C R addr=0x%x len=%d\n",
+ addr, msgs[i].len);
++ if (msgs[i].len < 1) {
++ ret = -EIO;
++ goto err;
++ }
+ req = AZ6007_I2C_RD;
+ index = msgs[i].buf[0];
+ value = addr;
+diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
+index d2737460c9d3b..60acaaf8b892f 100644
+--- a/drivers/media/usb/dvb-usb/af9005.c
++++ b/drivers/media/usb/dvb-usb/af9005.c
+@@ -431,6 +431,10 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ if (ret == 0)
+ ret = 2;
+ } else {
++ if (msg[0].len < 2) {
++ ret = -EOPNOTSUPP;
++ goto unlock;
++ }
+ /* write one or more registers */
+ reg = msg[0].buf[0];
+ addr = msg[0].addr;
+@@ -440,6 +444,7 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ ret = 1;
+ }
+
++unlock:
+ mutex_unlock(&d->i2c_mutex);
+ return ret;
+ }
+diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
+index cd0566c0b3de7..a3c5261f9aa41 100644
+--- a/drivers/media/usb/dvb-usb/dw2102.c
++++ b/drivers/media/usb/dvb-usb/dw2102.c
+@@ -131,6 +131,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+
+ switch (num) {
+ case 2:
++ if (msg[0].len < 1) {
++ num = -EOPNOTSUPP;
++ break;
++ }
+ /* read stv0299 register */
+ value = msg[0].buf[0];/* register */
+ for (i = 0; i < msg[1].len; i++) {
+@@ -142,6 +146,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ case 1:
+ switch (msg[0].addr) {
+ case 0x68:
++ if (msg[0].len < 2) {
++ num = -EOPNOTSUPP;
++ break;
++ }
+ /* write to stv0299 register */
+ buf6[0] = 0x2a;
+ buf6[1] = msg[0].buf[0];
+@@ -151,6 +159,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ break;
+ case 0x60:
+ if (msg[0].flags == 0) {
++ if (msg[0].len < 4) {
++ num = -EOPNOTSUPP;
++ break;
++ }
+ /* write to tuner pll */
+ buf6[0] = 0x2c;
+ buf6[1] = 5;
+@@ -162,6 +174,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ dw210x_op_rw(d->udev, 0xb2, 0, 0,
+ buf6, 7, DW210X_WRITE_MSG);
+ } else {
++ if (msg[0].len < 1) {
++ num = -EOPNOTSUPP;
++ break;
++ }
+ /* read from tuner */
+ dw210x_op_rw(d->udev, 0xb5, 0, 0,
+ buf6, 1, DW210X_READ_MSG);
+@@ -169,12 +185,20 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+ }
+ break;
+ case (DW2102_RC_QUERY):
++ if (msg[0].len < 2) {
++ num = -EOPNOTSUPP;
++ break;
++ }
+ dw210x_op_rw(d->udev, 0xb8, 0, 0,
+ buf6, 2, DW210X_READ_MSG);
+ msg[0].buf[0] = buf6[0];
+ msg[0].buf[1] = buf6[1];
+ break;
+ case (DW2102_VOLTAGE_CTRL):
++ if (msg[0].len < 1) {
++ num = -EOPNOTSUPP;
++ break;
++ }
+ buf6[0] = 0x30;
+ buf6[1] = msg[0].buf[0];
+ dw210x_op_rw(d->udev, 0xb2, 0, 0,
+diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/m920x.c
+index 3b2a0f36fc38e..e5491b9b8825c 100644
+--- a/drivers/media/usb/dvb-usb/m920x.c
++++ b/drivers/media/usb/dvb-usb/m920x.c
+@@ -280,7 +280,6 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu
+ char *read = kmalloc(1, GFP_KERNEL);
+ if (!read) {
+ ret = -ENOMEM;
+- kfree(read);
+ goto unlock;
+ }
+
+@@ -291,8 +290,10 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu
+
+ if ((ret = m920x_read(d->udev, M9206_I2C, 0x0,
+ 0x20 | stop,
+- read, 1)) != 0)
++ read, 1)) != 0) {
++ kfree(read);
+ goto unlock;
++ }
+ msg[i].buf[j] = read[0];
+ }
+
+diff --git a/drivers/media/usb/go7007/go7007-i2c.c b/drivers/media/usb/go7007/go7007-i2c.c
+index c084bf794b567..64f25d4e52b20 100644
+--- a/drivers/media/usb/go7007/go7007-i2c.c
++++ b/drivers/media/usb/go7007/go7007-i2c.c
+@@ -173,8 +173,6 @@ static int go7007_i2c_master_xfer(struct i2c_adapter *adapter,
+ } else if (msgs[i].len == 3) {
+ if (msgs[i].flags & I2C_M_RD)
+ return -EIO;
+- if (msgs[i].len != 3)
+- return -EIO;
+ if (go7007_i2c_xfer(go, msgs[i].addr, 0,
+ (msgs[i].buf[0] << 8) | msgs[i].buf[1],
+ 0x01, &msgs[i].buf[2]) < 0)
+diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
+index cd706874899c3..62e4fecc57d9c 100644
+--- a/drivers/media/usb/siano/smsusb.c
++++ b/drivers/media/usb/siano/smsusb.c
+@@ -467,12 +467,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
+ rc = smscore_register_device(¶ms, &dev->coredev, 0, mdev);
+ if (rc < 0) {
+ pr_err("smscore_register_device(...) failed, rc %d\n", rc);
+- smsusb_term_device(intf);
+-#ifdef CONFIG_MEDIA_CONTROLLER_DVB
+- media_device_unregister(mdev);
+-#endif
+- kfree(mdev);
+- return rc;
++ goto err_unregister_device;
+ }
+
+ smscore_set_board_id(dev->coredev, board_id);
+@@ -489,8 +484,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
+ rc = smsusb_start_streaming(dev);
+ if (rc < 0) {
+ pr_err("smsusb_start_streaming(...) failed\n");
+- smsusb_term_device(intf);
+- return rc;
++ goto err_unregister_device;
+ }
+
+ dev->state = SMSUSB_ACTIVE;
+@@ -498,13 +492,20 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
+ rc = smscore_start_device(dev->coredev);
+ if (rc < 0) {
+ pr_err("smscore_start_device(...) failed\n");
+- smsusb_term_device(intf);
+- return rc;
++ goto err_unregister_device;
+ }
+
+ pr_debug("device 0x%p created\n", dev);
+
+ return rc;
++
++err_unregister_device:
++ smsusb_term_device(intf);
++#ifdef CONFIG_MEDIA_CONTROLLER_DVB
++ media_device_unregister(mdev);
++#endif
++ kfree(mdev);
++ return rc;
+ }
+
+ static int smsusb_probe(struct usb_interface *intf,
+diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
+index 169bdbb1f61a5..95079229a772b 100644
+--- a/drivers/media/v4l2-core/v4l2-fwnode.c
++++ b/drivers/media/v4l2-core/v4l2-fwnode.c
+@@ -279,37 +279,38 @@ out_err:
+ }
+ EXPORT_SYMBOL_GPL(v4l2_fwnode_endpoint_alloc_parse);
+
+-int v4l2_fwnode_parse_link(struct fwnode_handle *__fwnode,
++int v4l2_fwnode_parse_link(struct fwnode_handle *fwnode,
+ struct v4l2_fwnode_link *link)
+ {
+- const char *port_prop = is_of_node(__fwnode) ? "reg" : "port";
+- struct fwnode_handle *fwnode;
++ struct fwnode_endpoint fwep;
+
+ memset(link, 0, sizeof(*link));
+
+- fwnode = fwnode_get_parent(__fwnode);
+- fwnode_property_read_u32(fwnode, port_prop, &link->local_port);
+- fwnode = fwnode_get_next_parent(fwnode);
+- if (is_of_node(fwnode) &&
+- of_node_cmp(to_of_node(fwnode)->name, "ports") == 0)
+- fwnode = fwnode_get_next_parent(fwnode);
+- link->local_node = fwnode;
+-
+- fwnode = fwnode_graph_get_remote_endpoint(__fwnode);
+- if (!fwnode) {
+- fwnode_handle_put(fwnode);
++ fwnode_graph_parse_endpoint(fwnode, &fwep);
++ link->local_port = fwep.port;
++ link->local_node = fwnode_graph_get_port_parent(fwnode);
++ if (!link->local_node)
+ return -ENOLINK;
+- }
+
+- fwnode = fwnode_get_parent(fwnode);
+- fwnode_property_read_u32(fwnode, port_prop, &link->remote_port);
+- fwnode = fwnode_get_next_parent(fwnode);
+- if (is_of_node(fwnode) &&
+- of_node_cmp(to_of_node(fwnode)->name, "ports") == 0)
+- fwnode = fwnode_get_next_parent(fwnode);
+- link->remote_node = fwnode;
++ fwnode = fwnode_graph_get_remote_endpoint(fwnode);
++ if (!fwnode)
++ goto err_put_local_node;
++
++ fwnode_graph_parse_endpoint(fwnode, &fwep);
++ link->remote_port = fwep.port;
++ link->remote_node = fwnode_graph_get_port_parent(fwnode);
++ if (!link->remote_node)
++ goto err_put_remote_endpoint;
+
+ return 0;
++
++err_put_remote_endpoint:
++ fwnode_handle_put(fwnode);
++
++err_put_local_node:
++ fwnode_handle_put(link->local_node);
++
++ return -ENOLINK;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_fwnode_parse_link);
+
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index 2c11944686cf9..d50c9079c0361 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -431,11 +431,12 @@ config MMC_WBSD
+ If unsure, say N.
+
+ config MMC_AU1X
+- tristate "Alchemy AU1XX0 MMC Card Interface support"
++ bool "Alchemy AU1XX0 MMC Card Interface support"
+ depends on MIPS_ALCHEMY
++ depends on MMC=y
+ help
+ This selects the AMD Alchemy(R) Multimedia card interface.
+- If you have a Alchemy platform with a MMC slot, say Y or M here.
++ If you have a Alchemy platform with a MMC slot, say Y here.
+
+ If unsure, say N.
+
+diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+index 27bafb8fc35af..0e14892ff9266 100644
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -152,6 +152,7 @@ struct brcmnand_controller {
+ unsigned int max_page_size;
+ const unsigned int *page_sizes;
+ unsigned int max_oob;
++ u32 ecc_level_shift;
+ u32 features;
+
+ /* for low-power standby/resume only */
+@@ -441,6 +442,34 @@ enum {
+ INTFC_CTLR_READY = BIT(31),
+ };
+
++/***********************************************************************
++ * NAND ACC CONTROL bitfield
++ *
++ * Some bits have remained constant throughout hardware revision, while
++ * others have shifted around.
++ ***********************************************************************/
++
++/* Constant for all versions (where supported) */
++enum {
++ /* See BRCMNAND_HAS_CACHE_MODE */
++ ACC_CONTROL_CACHE_MODE = BIT(22),
++
++ /* See BRCMNAND_HAS_PREFETCH */
++ ACC_CONTROL_PREFETCH = BIT(23),
++
++ ACC_CONTROL_PAGE_HIT = BIT(24),
++ ACC_CONTROL_WR_PREEMPT = BIT(25),
++ ACC_CONTROL_PARTIAL_PAGE = BIT(26),
++ ACC_CONTROL_RD_ERASED = BIT(27),
++ ACC_CONTROL_FAST_PGM_RDIN = BIT(28),
++ ACC_CONTROL_WR_ECC = BIT(30),
++ ACC_CONTROL_RD_ECC = BIT(31),
++};
++
++#define ACC_CONTROL_ECC_SHIFT 16
++/* Only for v7.2 */
++#define ACC_CONTROL_ECC_EXT_SHIFT 13
++
+ static inline u32 nand_readreg(struct brcmnand_controller *ctrl, u32 offs)
+ {
+ return brcmnand_readl(ctrl->nand_base + offs);
+@@ -544,6 +573,12 @@ static int brcmnand_revision_init(struct brcmnand_controller *ctrl)
+ else if (of_property_read_bool(ctrl->dev->of_node, "brcm,nand-has-wp"))
+ ctrl->features |= BRCMNAND_HAS_WP;
+
++ /* v7.2 has different ecc level shift in the acc register */
++ if (ctrl->nand_version == 0x0702)
++ ctrl->ecc_level_shift = ACC_CONTROL_ECC_EXT_SHIFT;
++ else
++ ctrl->ecc_level_shift = ACC_CONTROL_ECC_SHIFT;
++
+ return 0;
+ }
+
+@@ -697,30 +732,6 @@ static inline int brcmnand_cmd_shift(struct brcmnand_controller *ctrl)
+ return 0;
+ }
+
+-/***********************************************************************
+- * NAND ACC CONTROL bitfield
+- *
+- * Some bits have remained constant throughout hardware revision, while
+- * others have shifted around.
+- ***********************************************************************/
+-
+-/* Constant for all versions (where supported) */
+-enum {
+- /* See BRCMNAND_HAS_CACHE_MODE */
+- ACC_CONTROL_CACHE_MODE = BIT(22),
+-
+- /* See BRCMNAND_HAS_PREFETCH */
+- ACC_CONTROL_PREFETCH = BIT(23),
+-
+- ACC_CONTROL_PAGE_HIT = BIT(24),
+- ACC_CONTROL_WR_PREEMPT = BIT(25),
+- ACC_CONTROL_PARTIAL_PAGE = BIT(26),
+- ACC_CONTROL_RD_ERASED = BIT(27),
+- ACC_CONTROL_FAST_PGM_RDIN = BIT(28),
+- ACC_CONTROL_WR_ECC = BIT(30),
+- ACC_CONTROL_RD_ECC = BIT(31),
+-};
+-
+ static inline u32 brcmnand_spare_area_mask(struct brcmnand_controller *ctrl)
+ {
+ if (ctrl->nand_version >= 0x0702)
+@@ -731,18 +742,15 @@ static inline u32 brcmnand_spare_area_mask(struct brcmnand_controller *ctrl)
+ return GENMASK(5, 0);
+ }
+
+-#define NAND_ACC_CONTROL_ECC_SHIFT 16
+-#define NAND_ACC_CONTROL_ECC_EXT_SHIFT 13
+-
+ static inline u32 brcmnand_ecc_level_mask(struct brcmnand_controller *ctrl)
+ {
+ u32 mask = (ctrl->nand_version >= 0x0600) ? 0x1f : 0x0f;
+
+- mask <<= NAND_ACC_CONTROL_ECC_SHIFT;
++ mask <<= ACC_CONTROL_ECC_SHIFT;
+
+ /* v7.2 includes additional ECC levels */
+- if (ctrl->nand_version >= 0x0702)
+- mask |= 0x7 << NAND_ACC_CONTROL_ECC_EXT_SHIFT;
++ if (ctrl->nand_version == 0x0702)
++ mask |= 0x7 << ACC_CONTROL_ECC_EXT_SHIFT;
+
+ return mask;
+ }
+@@ -756,8 +764,8 @@ static void brcmnand_set_ecc_enabled(struct brcmnand_host *host, int en)
+
+ if (en) {
+ acc_control |= ecc_flags; /* enable RD/WR ECC */
+- acc_control |= host->hwcfg.ecc_level
+- << NAND_ACC_CONTROL_ECC_SHIFT;
++ acc_control &= ~brcmnand_ecc_level_mask(ctrl);
++ acc_control |= host->hwcfg.ecc_level << ctrl->ecc_level_shift;
+ } else {
+ acc_control &= ~ecc_flags; /* disable RD/WR ECC */
+ acc_control &= ~brcmnand_ecc_level_mask(ctrl);
+@@ -836,6 +844,14 @@ static int bcmnand_ctrl_poll_status(struct brcmnand_controller *ctrl,
+ cpu_relax();
+ } while (time_after(limit, jiffies));
+
++ /*
++ * do a final check after time out in case the CPU was busy and the driver
++ * did not get enough time to perform the polling to avoid false alarms
++ */
++ val = brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS);
++ if ((val & mask) == expected_val)
++ return 0;
++
+ dev_warn(ctrl->dev, "timeout on status poll (expected %x got %x)\n",
+ expected_val, val & mask);
+
+@@ -1213,19 +1229,33 @@ static int write_oob_to_regs(struct brcmnand_controller *ctrl, int i,
+ const u8 *oob, int sas, int sector_1k)
+ {
+ int tbytes = sas << sector_1k;
+- int j;
++ int j, k = 0;
++ u32 last = 0xffffffff;
++ u8 *plast = (u8 *)&last;
+
+ /* Adjust OOB values for 1K sector size */
+ if (sector_1k && (i & 0x01))
+ tbytes = max(0, tbytes - (int)ctrl->max_oob);
+ tbytes = min_t(int, tbytes, ctrl->max_oob);
+
+- for (j = 0; j < tbytes; j += 4)
++ /*
++ * tbytes may not be multiple of words. Make sure we don't read out of
++ * the boundary and stop at last word.
++ */
++ for (j = 0; (j + 3) < tbytes; j += 4)
+ oob_reg_write(ctrl, j,
+ (oob[j + 0] << 24) |
+ (oob[j + 1] << 16) |
+ (oob[j + 2] << 8) |
+ (oob[j + 3] << 0));
++
++ /* handle the remaing bytes */
++ while (j < tbytes)
++ plast[k++] = oob[j++];
++
++ if (tbytes & 0x3)
++ oob_reg_write(ctrl, (tbytes & ~0x3), (__force u32)cpu_to_be32(last));
++
+ return tbytes;
+ }
+
+@@ -1271,7 +1301,17 @@ static void brcmnand_send_cmd(struct brcmnand_host *host, int cmd)
+
+ dev_dbg(ctrl->dev, "send native cmd %d addr 0x%llx\n", cmd, cmd_addr);
+
+- BUG_ON(ctrl->cmd_pending != 0);
++ /*
++ * If we came here through _panic_write and there is a pending
++ * command, try to wait for it. If it times out, rather than
++ * hitting BUG_ON, just return so we don't crash while crashing.
++ */
++ if (oops_in_progress) {
++ if (ctrl->cmd_pending &&
++ bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0))
++ return;
++ } else
++ BUG_ON(ctrl->cmd_pending != 0);
+ ctrl->cmd_pending = cmd;
+
+ ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0);
+@@ -2071,9 +2111,10 @@ static int brcmnand_set_cfg(struct brcmnand_host *host,
+
+ tmp = nand_readreg(ctrl, acc_control_offs);
+ tmp &= ~brcmnand_ecc_level_mask(ctrl);
+- tmp |= cfg->ecc_level << NAND_ACC_CONTROL_ECC_SHIFT;
++ tmp |= cfg->ecc_level << ctrl->ecc_level_shift;
+ tmp &= ~brcmnand_spare_area_mask(ctrl);
+ tmp |= cfg->spare_area_size;
++
+ nand_writereg(ctrl, acc_control_offs, tmp);
+
+ brcmnand_set_sector_size_1k(host, cfg->sector_size_1k);
+diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
+index 553776cc1d29d..2b112d3d85409 100644
+--- a/drivers/net/arcnet/arcnet.c
++++ b/drivers/net/arcnet/arcnet.c
+@@ -434,7 +434,7 @@ static void arcnet_reply_tasklet(unsigned long data)
+
+ ret = sock_queue_err_skb(sk, ackskb);
+ if (ret)
+- kfree_skb(ackskb);
++ dev_kfree_skb_irq(ackskb);
+
+ local_irq_enable();
+ };
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index b2e48c8595f0f..fd80af775ec75 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -389,6 +389,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
+ }
+
+ if (hf->flags & GS_CAN_FLAG_OVERFLOW) {
++ stats->rx_over_errors++;
++ stats->rx_errors++;
++
+ skb = alloc_can_err_skb(netdev, &cf);
+ if (!skb)
+ goto resubmit_urb;
+@@ -396,8 +399,6 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
+ cf->can_id |= CAN_ERR_CRTL;
+ cf->can_dlc = CAN_ERR_DLC;
+ cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
+- stats->rx_over_errors++;
+- stats->rx_errors++;
+ netif_rx(skb);
+ }
+
+diff --git a/drivers/net/ethernet/atheros/alx/ethtool.c b/drivers/net/ethernet/atheros/alx/ethtool.c
+index 2f4eabf652e80..51e5aa2c74b34 100644
+--- a/drivers/net/ethernet/atheros/alx/ethtool.c
++++ b/drivers/net/ethernet/atheros/alx/ethtool.c
+@@ -281,9 +281,8 @@ static void alx_get_ethtool_stats(struct net_device *netdev,
+ spin_lock(&alx->stats_lock);
+
+ alx_update_hw_stats(hw);
+- BUILD_BUG_ON(sizeof(hw->stats) - offsetof(struct alx_hw_stats, rx_ok) <
+- ALX_NUM_STATS * sizeof(u64));
+- memcpy(data, &hw->stats.rx_ok, ALX_NUM_STATS * sizeof(u64));
++ BUILD_BUG_ON(sizeof(hw->stats) != ALX_NUM_STATS * sizeof(u64));
++ memcpy(data, &hw->stats, sizeof(hw->stats));
+
+ spin_unlock(&alx->stats_lock);
+ }
+diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+index 7087b88550db5..98cc2bd5adc45 100644
+--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
++++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+@@ -2002,8 +2002,11 @@ static int atl1c_tso_csum(struct atl1c_adapter *adapter,
+ real_len = (((unsigned char *)ip_hdr(skb) - skb->data)
+ + ntohs(ip_hdr(skb)->tot_len));
+
+- if (real_len < skb->len)
+- pskb_trim(skb, real_len);
++ if (real_len < skb->len) {
++ err = pskb_trim(skb, real_len);
++ if (err)
++ return err;
++ }
+
+ hdr_len = (skb_transport_offset(skb) + tcp_hdrlen(skb));
+ if (unlikely(skb->len == hdr_len)) {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 91ddde4d647c6..d21b22ed0b60a 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -14464,11 +14464,16 @@ static void bnx2x_io_resume(struct pci_dev *pdev)
+ bp->fw_seq = SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) &
+ DRV_MSG_SEQ_NUMBER_MASK;
+
+- if (netif_running(dev))
+- bnx2x_nic_load(bp, LOAD_NORMAL);
++ if (netif_running(dev)) {
++ if (bnx2x_nic_load(bp, LOAD_NORMAL)) {
++ netdev_err(bp->dev, "Error during driver initialization, try unloading/reloading the driver\n");
++ goto done;
++ }
++ }
+
+ netif_device_attach(dev);
+
++done:
+ rtnl_unlock();
+ }
+
+diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
+index 33cbe4f70d590..e6d99759d95a1 100644
+--- a/drivers/net/ethernet/intel/igb/igb.h
++++ b/drivers/net/ethernet/intel/igb/igb.h
+@@ -32,11 +32,11 @@ struct igb_adapter;
+ /* TX/RX descriptor defines */
+ #define IGB_DEFAULT_TXD 256
+ #define IGB_DEFAULT_TX_WORK 128
+-#define IGB_MIN_TXD 80
++#define IGB_MIN_TXD 64
+ #define IGB_MAX_TXD 4096
+
+ #define IGB_DEFAULT_RXD 256
+-#define IGB_MIN_RXD 80
++#define IGB_MIN_RXD 64
+ #define IGB_MAX_RXD 4096
+
+ #define IGB_DEFAULT_ITR 3 /* dynamic */
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index be51179089852..00d8f1e8177e7 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -3736,8 +3736,9 @@ static void igb_probe_vfs(struct igb_adapter *adapter)
+ struct pci_dev *pdev = adapter->pdev;
+ struct e1000_hw *hw = &adapter->hw;
+
+- /* Virtualization features not supported on i210 family. */
+- if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211))
++ /* Virtualization features not supported on i210 and 82580 family. */
++ if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211) ||
++ (hw->mac.type == e1000_82580))
+ return;
+
+ /* Of the below we really only want the effect of getting
+@@ -4579,6 +4580,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter,
+ static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
+ struct igb_ring *rx_ring)
+ {
++#if (PAGE_SIZE < 8192)
++ struct e1000_hw *hw = &adapter->hw;
++#endif
++
+ /* set build_skb and buffer size flags */
+ clear_ring_build_skb_enabled(rx_ring);
+ clear_ring_uses_large_buffer(rx_ring);
+@@ -4589,10 +4594,9 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
+ set_ring_build_skb_enabled(rx_ring);
+
+ #if (PAGE_SIZE < 8192)
+- if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB)
+- return;
+-
+- set_ring_uses_large_buffer(rx_ring);
++ if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB ||
++ rd32(E1000_RCTL) & E1000_RCTL_SBP)
++ set_ring_uses_large_buffer(rx_ring);
+ #endif
+ }
+
+diff --git a/drivers/net/ethernet/intel/igbvf/igbvf.h b/drivers/net/ethernet/intel/igbvf/igbvf.h
+index eee26a3be90ba..52545cb25d058 100644
+--- a/drivers/net/ethernet/intel/igbvf/igbvf.h
++++ b/drivers/net/ethernet/intel/igbvf/igbvf.h
+@@ -39,11 +39,11 @@ enum latency_range {
+ /* Tx/Rx descriptor defines */
+ #define IGBVF_DEFAULT_TXD 256
+ #define IGBVF_MAX_TXD 4096
+-#define IGBVF_MIN_TXD 80
++#define IGBVF_MIN_TXD 64
+
+ #define IGBVF_DEFAULT_RXD 256
+ #define IGBVF_MAX_RXD 4096
+-#define IGBVF_MIN_RXD 80
++#define IGBVF_MIN_RXD 64
+
+ #define IGBVF_MIN_ITR_USECS 10 /* 100000 irq/sec */
+ #define IGBVF_MAX_ITR_USECS 10000 /* 100 irq/sec */
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+index eec68cc9288c8..9c0e0ccbbe3cf 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+@@ -844,6 +844,7 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
+ u32 tsync_tx_ctl = IXGBE_TSYNCTXCTL_ENABLED;
+ u32 tsync_rx_ctl = IXGBE_TSYNCRXCTL_ENABLED;
+ u32 tsync_rx_mtrl = PTP_EV_PORT << 16;
++ u32 aflags = adapter->flags;
+ bool is_l2 = false;
+ u32 regval;
+
+@@ -864,20 +865,20 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
+ case HWTSTAMP_FILTER_NONE:
+ tsync_rx_ctl = 0;
+ tsync_rx_mtrl = 0;
+- adapter->flags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
++ aflags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
++ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+ break;
+ case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
+ tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
+ tsync_rx_mtrl |= IXGBE_RXMTRL_V1_SYNC_MSG;
+- adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
++ aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
++ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+ break;
+ case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
+ tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
+ tsync_rx_mtrl |= IXGBE_RXMTRL_V1_DELAY_REQ_MSG;
+- adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
++ aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
++ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+ break;
+ case HWTSTAMP_FILTER_PTP_V2_EVENT:
+ case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
+@@ -891,8 +892,8 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
+ tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_EVENT_V2;
+ is_l2 = true;
+ config->rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+- adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
++ aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
++ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+ break;
+ case HWTSTAMP_FILTER_PTP_V1_L4_EVENT:
+ case HWTSTAMP_FILTER_NTP_ALL:
+@@ -903,7 +904,7 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
+ if (hw->mac.type >= ixgbe_mac_X550) {
+ tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_ALL;
+ config->rx_filter = HWTSTAMP_FILTER_ALL;
+- adapter->flags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
++ aflags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
+ break;
+ }
+ /* fall through */
+@@ -914,8 +915,6 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
+ * Delay_Req messages and hardware does not support
+ * timestamping all packets => return error
+ */
+- adapter->flags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+ config->rx_filter = HWTSTAMP_FILTER_NONE;
+ return -ERANGE;
+ }
+@@ -947,8 +946,8 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
+ IXGBE_TSYNCRXCTL_TYPE_ALL |
+ IXGBE_TSYNCRXCTL_TSIP_UT_EN;
+ config->rx_filter = HWTSTAMP_FILTER_ALL;
+- adapter->flags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
+- adapter->flags &= ~IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER;
++ aflags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
++ aflags &= ~IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER;
+ is_l2 = true;
+ break;
+ default:
+@@ -981,6 +980,9 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
+
+ IXGBE_WRITE_FLUSH(hw);
+
++ /* configure adapter flags only when HW is actually configured */
++ adapter->flags = aflags;
++
+ /* clear TX/RX time stamp registers, just to be sure */
+ ixgbe_ptp_clear_tx_timestamp(adapter);
+ IXGBE_READ_REG(hw, IXGBE_RXSTMPH);
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 53cff913abf0b..1a4f96894cd70 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1621,6 +1621,9 @@ static int mtk_hwlro_get_fdir_all(struct net_device *dev,
+ int i;
+
+ for (i = 0; i < MTK_MAX_LRO_IP_CNT; i++) {
++ if (cnt == cmd->rule_cnt)
++ return -EMSGSIZE;
++
+ if (mac->hwlro_ip[i]) {
+ rule_locs[cnt] = i;
+ cnt++;
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 6c0f80bea8161..a913ba87209a2 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -1315,8 +1315,7 @@ static struct crypto_aead *macsec_alloc_tfm(char *key, int key_len, int icv_len)
+ struct crypto_aead *tfm;
+ int ret;
+
+- /* Pick a sync gcm(aes) cipher to ensure order is preserved. */
+- tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
++ tfm = crypto_alloc_aead("gcm(aes)", 0, 0);
+
+ if (IS_ERR(tfm))
+ return tfm;
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index c5781888f2f7b..aefa57e726954 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1376,6 +1376,7 @@ static const struct usb_device_id products[] = {
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */
+ {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */
++ {QMI_QUIRK_SET_DTR(0x2c7c, 0x030e, 4)}, /* Quectel EM05GV2 */
+ {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */
+ {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */
+ {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c
+index ea999a6639330..8006a7716168f 100644
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -181,6 +181,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct veth_priv *rcv_priv, *priv = netdev_priv(dev);
+ struct veth_rq *rq = NULL;
++ int ret = NETDEV_TX_OK;
+ struct net_device *rcv;
+ int length = skb->len;
+ bool rcv_xdp = false;
+@@ -210,6 +211,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
+ } else {
+ drop:
+ atomic64_inc(&priv->dropped);
++ ret = NET_XMIT_DROP;
+ }
+
+ if (rcv_xdp)
+@@ -217,7 +219,7 @@ drop:
+
+ rcu_read_unlock();
+
+- return NETDEV_TX_OK;
++ return ret;
+ }
+
+ static u64 veth_stats_one(struct pcpu_vstats *result, struct net_device *dev)
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 1b98a888a168e..d5c8d0d54b33d 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -542,6 +542,32 @@ static int vxlan_fdb_append(struct vxlan_fdb *f,
+ return 1;
+ }
+
++static bool vxlan_parse_gpe_proto(struct vxlanhdr *hdr, __be16 *protocol)
++{
++ struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)hdr;
++
++ /* Need to have Next Protocol set for interfaces in GPE mode. */
++ if (!gpe->np_applied)
++ return false;
++ /* "The initial version is 0. If a receiver does not support the
++ * version indicated it MUST drop the packet.
++ */
++ if (gpe->version != 0)
++ return false;
++ /* "When the O bit is set to 1, the packet is an OAM packet and OAM
++ * processing MUST occur." However, we don't implement OAM
++ * processing, thus drop the packet.
++ */
++ if (gpe->oam_flag)
++ return false;
++
++ *protocol = tun_p_to_eth_p(gpe->next_protocol);
++ if (!*protocol)
++ return false;
++
++ return true;
++}
++
+ static struct vxlanhdr *vxlan_gro_remcsum(struct sk_buff *skb,
+ unsigned int off,
+ struct vxlanhdr *vh, size_t hdrlen,
+@@ -1279,35 +1305,6 @@ out:
+ unparsed->vx_flags &= ~VXLAN_GBP_USED_BITS;
+ }
+
+-static bool vxlan_parse_gpe_hdr(struct vxlanhdr *unparsed,
+- __be16 *protocol,
+- struct sk_buff *skb, u32 vxflags)
+-{
+- struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)unparsed;
+-
+- /* Need to have Next Protocol set for interfaces in GPE mode. */
+- if (!gpe->np_applied)
+- return false;
+- /* "The initial version is 0. If a receiver does not support the
+- * version indicated it MUST drop the packet.
+- */
+- if (gpe->version != 0)
+- return false;
+- /* "When the O bit is set to 1, the packet is an OAM packet and OAM
+- * processing MUST occur." However, we don't implement OAM
+- * processing, thus drop the packet.
+- */
+- if (gpe->oam_flag)
+- return false;
+-
+- *protocol = tun_p_to_eth_p(gpe->next_protocol);
+- if (!*protocol)
+- return false;
+-
+- unparsed->vx_flags &= ~VXLAN_GPE_USED_BITS;
+- return true;
+-}
+-
+ static bool vxlan_set_mac(struct vxlan_dev *vxlan,
+ struct vxlan_sock *vs,
+ struct sk_buff *skb, __be32 vni)
+@@ -1409,8 +1406,9 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
+ * used by VXLAN extensions if explicitly requested.
+ */
+ if (vs->flags & VXLAN_F_GPE) {
+- if (!vxlan_parse_gpe_hdr(&unparsed, &protocol, skb, vs->flags))
++ if (!vxlan_parse_gpe_proto(&unparsed, &protocol))
+ goto drop;
++ unparsed.vx_flags &= ~VXLAN_GPE_USED_BITS;
+ raw_proto = true;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index 92757495c73b6..c929a62c722ad 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -1957,8 +1957,9 @@ static int ath10k_pci_hif_start(struct ath10k *ar)
+ ath10k_pci_irq_enable(ar);
+ ath10k_pci_rx_post(ar);
+
+- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL,
+- ar_pci->link_ctl);
++ pcie_capability_clear_and_set_word(ar_pci->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_ASPMC,
++ ar_pci->link_ctl & PCI_EXP_LNKCTL_ASPMC);
+
+ return 0;
+ }
+@@ -2813,8 +2814,8 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar)
+
+ pcie_capability_read_word(ar_pci->pdev, PCI_EXP_LNKCTL,
+ &ar_pci->link_ctl);
+- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL,
+- ar_pci->link_ctl & ~PCI_EXP_LNKCTL_ASPMC);
++ pcie_capability_clear_word(ar_pci->pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_ASPMC);
+
+ /*
+ * Bring the target up cleanly.
+diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
+index 63019c3de034d..26023e3b4b9df 100644
+--- a/drivers/net/wireless/ath/ath9k/ahb.c
++++ b/drivers/net/wireless/ath/ath9k/ahb.c
+@@ -136,8 +136,8 @@ static int ath_ahb_probe(struct platform_device *pdev)
+
+ ah = sc->sc_ah;
+ ath9k_hw_name(ah, hw_name, sizeof(hw_name));
+- wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
+- hw_name, (unsigned long)mem, irq);
++ wiphy_info(hw->wiphy, "%s mem=0x%p, irq=%d\n",
++ hw_name, mem, irq);
+
+ return 0;
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+index b3ed65e5c4da8..c55aab01fff5d 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+@@ -491,7 +491,7 @@ int ath9k_htc_init_debug(struct ath_hw *ah)
+
+ priv->debug.debugfs_phy = debugfs_create_dir(KBUILD_MODNAME,
+ priv->hw->wiphy->debugfsdir);
+- if (!priv->debug.debugfs_phy)
++ if (IS_ERR(priv->debug.debugfs_phy))
+ return -ENOMEM;
+
+ ath9k_cmn_spectral_init_debug(&priv->spec_priv, priv->debug.debugfs_phy);
+diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
+index 92b2dd396436a..cb3318bd3cad2 100644
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -993,8 +993,8 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ sc->sc_ah->msi_reg = 0;
+
+ ath9k_hw_name(sc->sc_ah, hw_name, sizeof(hw_name));
+- wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
+- hw_name, (unsigned long)sc->mem, pdev->irq);
++ wiphy_info(hw->wiphy, "%s mem=0x%p, irq=%d\n",
++ hw_name, sc->mem, pdev->irq);
+
+ return 0;
+
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
+index 5e2a610df61cf..78ce349a48f7e 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.c
++++ b/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -239,10 +239,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
+ spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+ goto free_skb;
+ }
+- spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+
+ /* WMI command response */
+ ath9k_wmi_rsp_callback(wmi, skb);
++ spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+
+ free_skb:
+ kfree_skb(skb);
+@@ -280,7 +280,8 @@ int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi,
+
+ static int ath9k_wmi_cmd_issue(struct wmi *wmi,
+ struct sk_buff *skb,
+- enum wmi_cmd_id cmd, u16 len)
++ enum wmi_cmd_id cmd, u16 len,
++ u8 *rsp_buf, u32 rsp_len)
+ {
+ struct wmi_cmd_hdr *hdr;
+ unsigned long flags;
+@@ -290,6 +291,11 @@ static int ath9k_wmi_cmd_issue(struct wmi *wmi,
+ hdr->seq_no = cpu_to_be16(++wmi->tx_seq_id);
+
+ spin_lock_irqsave(&wmi->wmi_lock, flags);
++
++ /* record the rsp buffer and length */
++ wmi->cmd_rsp_buf = rsp_buf;
++ wmi->cmd_rsp_len = rsp_len;
++
+ wmi->last_seq_id = wmi->tx_seq_id;
+ spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+
+@@ -305,8 +311,8 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+ struct ath_common *common = ath9k_hw_common(ah);
+ u16 headroom = sizeof(struct htc_frame_hdr) +
+ sizeof(struct wmi_cmd_hdr);
++ unsigned long time_left, flags;
+ struct sk_buff *skb;
+- unsigned long time_left;
+ int ret = 0;
+
+ if (ah->ah_flags & AH_UNPLUGGED)
+@@ -330,11 +336,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+ goto out;
+ }
+
+- /* record the rsp buffer and length */
+- wmi->cmd_rsp_buf = rsp_buf;
+- wmi->cmd_rsp_len = rsp_len;
+-
+- ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len);
++ ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len, rsp_buf, rsp_len);
+ if (ret)
+ goto out;
+
+@@ -342,7 +344,9 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+ if (!time_left) {
+ ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
+ wmi_cmd_to_name(cmd_id));
++ spin_lock_irqsave(&wmi->wmi_lock, flags);
+ wmi->last_seq_id = 0;
++ spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+ mutex_unlock(&wmi->op_mutex);
+ kfree_skb(skb);
+ return -ETIMEDOUT;
+diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+index cbe4493b32664..0f62da50e11a2 100644
+--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c
++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+@@ -265,8 +265,11 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ if (!p)
+ return -ENOMEM;
+
+- if (!priv || !priv->hist_data)
+- return -EFAULT;
++ if (!priv || !priv->hist_data) {
++ ret = -EFAULT;
++ goto free_and_exit;
++ }
++
+ phist_data = priv->hist_data;
+
+ p += sprintf(p, "\n"
+@@ -321,6 +324,8 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ ret = simple_read_from_buffer(ubuf, count, ppos, (char *)page,
+ (unsigned long)p - page);
+
++free_and_exit:
++ free_page(page);
+ return ret;
+ }
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
+index aea79fd54c311..7e9111965b233 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -50,6 +50,8 @@ static int mwifiex_pcie_probe_of(struct device *dev)
+ }
+
+ static void mwifiex_pcie_work(struct work_struct *work);
++static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter);
++static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter);
+
+ static int
+ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
+@@ -58,8 +60,8 @@ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
+ struct pcie_service_card *card = adapter->card;
+ struct mwifiex_dma_mapping mapping;
+
+- mapping.addr = pci_map_single(card->dev, skb->data, size, flags);
+- if (pci_dma_mapping_error(card->dev, mapping.addr)) {
++ mapping.addr = dma_map_single(&card->dev->dev, skb->data, size, flags);
++ if (dma_mapping_error(&card->dev->dev, mapping.addr)) {
+ mwifiex_dbg(adapter, ERROR, "failed to map pci memory!\n");
+ return -1;
+ }
+@@ -75,7 +77,7 @@ static void mwifiex_unmap_pci_memory(struct mwifiex_adapter *adapter,
+ struct mwifiex_dma_mapping mapping;
+
+ mwifiex_get_mapping(skb, &mapping);
+- pci_unmap_single(card->dev, mapping.addr, mapping.len, flags);
++ dma_unmap_single(&card->dev->dev, mapping.addr, mapping.len, flags);
+ }
+
+ /*
+@@ -469,10 +471,9 @@ static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter,
+ struct sk_buff *cmdrsp = card->cmdrsp_buf;
+
+ for (count = 0; count < max_delay_loop_cnt; count++) {
+- pci_dma_sync_single_for_cpu(card->dev,
+- MWIFIEX_SKB_DMA_ADDR(cmdrsp),
+- sizeof(sleep_cookie),
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_cpu(&card->dev->dev,
++ MWIFIEX_SKB_DMA_ADDR(cmdrsp),
++ sizeof(sleep_cookie), DMA_FROM_DEVICE);
+ buffer = cmdrsp->data;
+ sleep_cookie = get_unaligned_le32(buffer);
+
+@@ -481,10 +482,10 @@ static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter,
+ "sleep cookie found at count %d\n", count);
+ break;
+ }
+- pci_dma_sync_single_for_device(card->dev,
+- MWIFIEX_SKB_DMA_ADDR(cmdrsp),
+- sizeof(sleep_cookie),
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_device(&card->dev->dev,
++ MWIFIEX_SKB_DMA_ADDR(cmdrsp),
++ sizeof(sleep_cookie),
++ DMA_FROM_DEVICE);
+ usleep_range(20, 30);
+ }
+
+@@ -632,14 +633,15 @@ static int mwifiex_init_rxq_ring(struct mwifiex_adapter *adapter)
+ if (!skb) {
+ mwifiex_dbg(adapter, ERROR,
+ "Unable to allocate skb for RX ring.\n");
+- kfree(card->rxbd_ring_vbase);
+ return -ENOMEM;
+ }
+
+ if (mwifiex_map_pci_memory(adapter, skb,
+ MWIFIEX_RX_DATA_BUF_SIZE,
+- PCI_DMA_FROMDEVICE))
+- return -1;
++ DMA_FROM_DEVICE)) {
++ kfree_skb(skb);
++ return -ENOMEM;
++ }
+
+ buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
+
+@@ -689,16 +691,14 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)
+ if (!skb) {
+ mwifiex_dbg(adapter, ERROR,
+ "Unable to allocate skb for EVENT buf.\n");
+- kfree(card->evtbd_ring_vbase);
+ return -ENOMEM;
+ }
+ skb_put(skb, MAX_EVENT_SIZE);
+
+ if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE,
+- PCI_DMA_FROMDEVICE)) {
++ DMA_FROM_DEVICE)) {
+ kfree_skb(skb);
+- kfree(card->evtbd_ring_vbase);
+- return -1;
++ return -ENOMEM;
+ }
+
+ buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
+@@ -738,7 +738,7 @@ static void mwifiex_cleanup_txq_ring(struct mwifiex_adapter *adapter)
+ if (card->tx_buf_list[i]) {
+ skb = card->tx_buf_list[i];
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ dev_kfree_skb_any(skb);
+ }
+ memset(desc2, 0, sizeof(*desc2));
+@@ -747,7 +747,7 @@ static void mwifiex_cleanup_txq_ring(struct mwifiex_adapter *adapter)
+ if (card->tx_buf_list[i]) {
+ skb = card->tx_buf_list[i];
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ dev_kfree_skb_any(skb);
+ }
+ memset(desc, 0, sizeof(*desc));
+@@ -777,7 +777,7 @@ static void mwifiex_cleanup_rxq_ring(struct mwifiex_adapter *adapter)
+ if (card->rx_buf_list[i]) {
+ skb = card->rx_buf_list[i];
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ dev_kfree_skb_any(skb);
+ }
+ memset(desc2, 0, sizeof(*desc2));
+@@ -786,7 +786,7 @@ static void mwifiex_cleanup_rxq_ring(struct mwifiex_adapter *adapter)
+ if (card->rx_buf_list[i]) {
+ skb = card->rx_buf_list[i];
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ dev_kfree_skb_any(skb);
+ }
+ memset(desc, 0, sizeof(*desc));
+@@ -812,7 +812,7 @@ static void mwifiex_cleanup_evt_ring(struct mwifiex_adapter *adapter)
+ if (card->evt_buf_list[i]) {
+ skb = card->evt_buf_list[i];
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ dev_kfree_skb_any(skb);
+ }
+ card->evt_buf_list[i] = NULL;
+@@ -853,9 +853,10 @@ static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_dbg(adapter, INFO,
+ "info: txbd_ring: Allocating %d bytes\n",
+ card->txbd_ring_size);
+- card->txbd_ring_vbase = pci_alloc_consistent(card->dev,
+- card->txbd_ring_size,
+- &card->txbd_ring_pbase);
++ card->txbd_ring_vbase = dma_alloc_coherent(&card->dev->dev,
++ card->txbd_ring_size,
++ &card->txbd_ring_pbase,
++ GFP_KERNEL);
+ if (!card->txbd_ring_vbase) {
+ mwifiex_dbg(adapter, ERROR,
+ "allocate consistent memory (%d bytes) failed!\n",
+@@ -879,9 +880,9 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_cleanup_txq_ring(adapter);
+
+ if (card->txbd_ring_vbase)
+- pci_free_consistent(card->dev, card->txbd_ring_size,
+- card->txbd_ring_vbase,
+- card->txbd_ring_pbase);
++ dma_free_coherent(&card->dev->dev, card->txbd_ring_size,
++ card->txbd_ring_vbase,
++ card->txbd_ring_pbase);
+ card->txbd_ring_size = 0;
+ card->txbd_wrptr = 0;
+ card->txbd_rdptr = 0 | reg->tx_rollover_ind;
+@@ -896,6 +897,7 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)
+ */
+ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
+ {
++ int ret;
+ struct pcie_service_card *card = adapter->card;
+ const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
+@@ -917,9 +919,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_dbg(adapter, INFO,
+ "info: rxbd_ring: Allocating %d bytes\n",
+ card->rxbd_ring_size);
+- card->rxbd_ring_vbase = pci_alloc_consistent(card->dev,
+- card->rxbd_ring_size,
+- &card->rxbd_ring_pbase);
++ card->rxbd_ring_vbase = dma_alloc_coherent(&card->dev->dev,
++ card->rxbd_ring_size,
++ &card->rxbd_ring_pbase,
++ GFP_KERNEL);
+ if (!card->rxbd_ring_vbase) {
+ mwifiex_dbg(adapter, ERROR,
+ "allocate consistent memory (%d bytes) failed!\n",
+@@ -933,7 +936,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
+ (u32)((u64)card->rxbd_ring_pbase >> 32),
+ card->rxbd_ring_size);
+
+- return mwifiex_init_rxq_ring(adapter);
++ ret = mwifiex_init_rxq_ring(adapter);
++ if (ret)
++ mwifiex_pcie_delete_rxbd_ring(adapter);
++ return ret;
+ }
+
+ /*
+@@ -947,9 +953,9 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_cleanup_rxq_ring(adapter);
+
+ if (card->rxbd_ring_vbase)
+- pci_free_consistent(card->dev, card->rxbd_ring_size,
+- card->rxbd_ring_vbase,
+- card->rxbd_ring_pbase);
++ dma_free_coherent(&card->dev->dev, card->rxbd_ring_size,
++ card->rxbd_ring_vbase,
++ card->rxbd_ring_pbase);
+ card->rxbd_ring_size = 0;
+ card->rxbd_wrptr = 0;
+ card->rxbd_rdptr = 0 | reg->rx_rollover_ind;
+@@ -964,6 +970,7 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)
+ */
+ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
+ {
++ int ret;
+ struct pcie_service_card *card = adapter->card;
+ const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
+@@ -981,9 +988,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_dbg(adapter, INFO,
+ "info: evtbd_ring: Allocating %d bytes\n",
+ card->evtbd_ring_size);
+- card->evtbd_ring_vbase = pci_alloc_consistent(card->dev,
+- card->evtbd_ring_size,
+- &card->evtbd_ring_pbase);
++ card->evtbd_ring_vbase = dma_alloc_coherent(&card->dev->dev,
++ card->evtbd_ring_size,
++ &card->evtbd_ring_pbase,
++ GFP_KERNEL);
+ if (!card->evtbd_ring_vbase) {
+ mwifiex_dbg(adapter, ERROR,
+ "allocate consistent memory (%d bytes) failed!\n",
+@@ -997,7 +1005,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
+ (u32)((u64)card->evtbd_ring_pbase >> 32),
+ card->evtbd_ring_size);
+
+- return mwifiex_pcie_init_evt_ring(adapter);
++ ret = mwifiex_pcie_init_evt_ring(adapter);
++ if (ret)
++ mwifiex_pcie_delete_evtbd_ring(adapter);
++ return ret;
+ }
+
+ /*
+@@ -1011,9 +1022,9 @@ static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter)
+ mwifiex_cleanup_evt_ring(adapter);
+
+ if (card->evtbd_ring_vbase)
+- pci_free_consistent(card->dev, card->evtbd_ring_size,
+- card->evtbd_ring_vbase,
+- card->evtbd_ring_pbase);
++ dma_free_coherent(&card->dev->dev, card->evtbd_ring_size,
++ card->evtbd_ring_vbase,
++ card->evtbd_ring_pbase);
+ card->evtbd_wrptr = 0;
+ card->evtbd_rdptr = 0 | reg->evt_rollover_ind;
+ card->evtbd_ring_size = 0;
+@@ -1040,7 +1051,7 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter)
+ }
+ skb_put(skb, MWIFIEX_UPLD_SIZE);
+ if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
+- PCI_DMA_FROMDEVICE)) {
++ DMA_FROM_DEVICE)) {
+ kfree_skb(skb);
+ return -1;
+ }
+@@ -1064,14 +1075,14 @@ static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifiex_adapter *adapter)
+
+ if (card && card->cmdrsp_buf) {
+ mwifiex_unmap_pci_memory(adapter, card->cmdrsp_buf,
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ dev_kfree_skb_any(card->cmdrsp_buf);
+ card->cmdrsp_buf = NULL;
+ }
+
+ if (card && card->cmd_buf) {
+ mwifiex_unmap_pci_memory(adapter, card->cmd_buf,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ dev_kfree_skb_any(card->cmd_buf);
+ card->cmd_buf = NULL;
+ }
+@@ -1086,8 +1097,10 @@ static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter)
+ struct pcie_service_card *card = adapter->card;
+ u32 *cookie;
+
+- card->sleep_cookie_vbase = pci_alloc_consistent(card->dev, sizeof(u32),
+- &card->sleep_cookie_pbase);
++ card->sleep_cookie_vbase = dma_alloc_coherent(&card->dev->dev,
++ sizeof(u32),
++ &card->sleep_cookie_pbase,
++ GFP_KERNEL);
+ if (!card->sleep_cookie_vbase) {
+ mwifiex_dbg(adapter, ERROR,
+ "pci_alloc_consistent failed!\n");
+@@ -1115,9 +1128,9 @@ static int mwifiex_pcie_delete_sleep_cookie_buf(struct mwifiex_adapter *adapter)
+ card = adapter->card;
+
+ if (card && card->sleep_cookie_vbase) {
+- pci_free_consistent(card->dev, sizeof(u32),
+- card->sleep_cookie_vbase,
+- card->sleep_cookie_pbase);
++ dma_free_coherent(&card->dev->dev, sizeof(u32),
++ card->sleep_cookie_vbase,
++ card->sleep_cookie_pbase);
+ card->sleep_cookie_vbase = NULL;
+ }
+
+@@ -1189,7 +1202,7 @@ static int mwifiex_pcie_send_data_complete(struct mwifiex_adapter *adapter)
+ "SEND COMP: Detach skb %p at txbd_rdidx=%d\n",
+ skb, wrdoneidx);
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+
+ unmap_count++;
+
+@@ -1282,7 +1295,7 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
+ put_unaligned_le16(MWIFIEX_TYPE_DATA, payload + 2);
+
+ if (mwifiex_map_pci_memory(adapter, skb, skb->len,
+- PCI_DMA_TODEVICE))
++ DMA_TO_DEVICE))
+ return -1;
+
+ wrindx = (card->txbd_wrptr & reg->tx_mask) >> reg->tx_start_ptr;
+@@ -1372,7 +1385,7 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
+
+ return -EINPROGRESS;
+ done_unmap:
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+ card->tx_buf_list[wrindx] = NULL;
+ atomic_dec(&adapter->tx_hw_pending);
+ if (reg->pfu_enabled)
+@@ -1426,7 +1439,7 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
+ if (!skb_data)
+ return -ENOMEM;
+
+- mwifiex_unmap_pci_memory(adapter, skb_data, PCI_DMA_FROMDEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb_data, DMA_FROM_DEVICE);
+ card->rx_buf_list[rd_index] = NULL;
+
+ /* Get data length from interface header -
+@@ -1464,7 +1477,7 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
+
+ if (mwifiex_map_pci_memory(adapter, skb_tmp,
+ MWIFIEX_RX_DATA_BUF_SIZE,
+- PCI_DMA_FROMDEVICE))
++ DMA_FROM_DEVICE))
+ return -1;
+
+ buf_pa = MWIFIEX_SKB_DMA_ADDR(skb_tmp);
+@@ -1541,7 +1554,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ return -1;
+ }
+
+- if (mwifiex_map_pci_memory(adapter, skb, skb->len, PCI_DMA_TODEVICE))
++ if (mwifiex_map_pci_memory(adapter, skb, skb->len, DMA_TO_DEVICE))
+ return -1;
+
+ buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
+@@ -1553,7 +1566,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ mwifiex_dbg(adapter, ERROR,
+ "%s: failed to write download command to boot code.\n",
+ __func__);
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+ return -1;
+ }
+
+@@ -1565,7 +1578,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ mwifiex_dbg(adapter, ERROR,
+ "%s: failed to write download command to boot code.\n",
+ __func__);
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+ return -1;
+ }
+
+@@ -1574,7 +1587,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ mwifiex_dbg(adapter, ERROR,
+ "%s: failed to write command len to cmd_size scratch reg\n",
+ __func__);
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+ return -1;
+ }
+
+@@ -1583,7 +1596,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ CPU_INTR_DOOR_BELL)) {
+ mwifiex_dbg(adapter, ERROR,
+ "%s: failed to assert door-bell intr\n", __func__);
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+ return -1;
+ }
+
+@@ -1642,7 +1655,7 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+ put_unaligned_le16((u16)skb->len, &payload[0]);
+ put_unaligned_le16(MWIFIEX_TYPE_CMD, &payload[2]);
+
+- if (mwifiex_map_pci_memory(adapter, skb, skb->len, PCI_DMA_TODEVICE))
++ if (mwifiex_map_pci_memory(adapter, skb, skb->len, DMA_TO_DEVICE))
+ return -1;
+
+ card->cmd_buf = skb;
+@@ -1742,17 +1755,16 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
+ "info: Rx CMD Response\n");
+
+ if (adapter->curr_cmd)
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_FROMDEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_FROM_DEVICE);
+ else
+- pci_dma_sync_single_for_cpu(card->dev,
+- MWIFIEX_SKB_DMA_ADDR(skb),
+- MWIFIEX_UPLD_SIZE,
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_cpu(&card->dev->dev,
++ MWIFIEX_SKB_DMA_ADDR(skb),
++ MWIFIEX_UPLD_SIZE, DMA_FROM_DEVICE);
+
+ /* Unmap the command as a response has been received. */
+ if (card->cmd_buf) {
+ mwifiex_unmap_pci_memory(adapter, card->cmd_buf,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ dev_kfree_skb_any(card->cmd_buf);
+ card->cmd_buf = NULL;
+ }
+@@ -1763,10 +1775,10 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
+
+ if (!adapter->curr_cmd) {
+ if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
+- pci_dma_sync_single_for_device(card->dev,
+- MWIFIEX_SKB_DMA_ADDR(skb),
+- MWIFIEX_SLEEP_COOKIE_SIZE,
+- PCI_DMA_FROMDEVICE);
++ dma_sync_single_for_device(&card->dev->dev,
++ MWIFIEX_SKB_DMA_ADDR(skb),
++ MWIFIEX_SLEEP_COOKIE_SIZE,
++ DMA_FROM_DEVICE);
+ if (mwifiex_write_reg(adapter,
+ PCIE_CPU_INT_EVENT,
+ CPU_INTR_SLEEP_CFM_DONE)) {
+@@ -1777,7 +1789,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
+ mwifiex_delay_for_sleep_cookie(adapter,
+ MWIFIEX_MAX_DELAY_COUNT);
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_FROMDEVICE);
++ DMA_FROM_DEVICE);
+ skb_pull(skb, adapter->intf_hdr_len);
+ while (reg->sleep_cookie && (count++ < 10) &&
+ mwifiex_pcie_ok_to_access_hw(adapter))
+@@ -1793,7 +1805,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
+ min_t(u32, MWIFIEX_SIZE_OF_CMD_BUFFER, skb->len));
+ skb_push(skb, adapter->intf_hdr_len);
+ if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
+- PCI_DMA_FROMDEVICE))
++ DMA_FROM_DEVICE))
+ return -1;
+ } else if (mwifiex_pcie_ok_to_access_hw(adapter)) {
+ skb_pull(skb, adapter->intf_hdr_len);
+@@ -1835,7 +1847,7 @@ static int mwifiex_pcie_cmdrsp_complete(struct mwifiex_adapter *adapter,
+ card->cmdrsp_buf = skb;
+ skb_push(card->cmdrsp_buf, adapter->intf_hdr_len);
+ if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
+- PCI_DMA_FROMDEVICE))
++ DMA_FROM_DEVICE))
+ return -1;
+ }
+
+@@ -1890,7 +1902,7 @@ static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter)
+ mwifiex_dbg(adapter, INFO,
+ "info: Read Index: %d\n", rdptr);
+ skb_cmd = card->evt_buf_list[rdptr];
+- mwifiex_unmap_pci_memory(adapter, skb_cmd, PCI_DMA_FROMDEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb_cmd, DMA_FROM_DEVICE);
+
+ /* Take the pointer and set it to event pointer in adapter
+ and will return back after event handling callback */
+@@ -1970,7 +1982,7 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter,
+ skb_put(skb, MAX_EVENT_SIZE - skb->len);
+ if (mwifiex_map_pci_memory(adapter, skb,
+ MAX_EVENT_SIZE,
+- PCI_DMA_FROMDEVICE))
++ DMA_FROM_DEVICE))
+ return -1;
+ card->evt_buf_list[rdptr] = skb;
+ desc = card->evtbd_ring[rdptr];
+@@ -2252,7 +2264,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
+ "interrupt status during fw dnld.\n",
+ __func__);
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ ret = -1;
+ goto done;
+ }
+@@ -2264,12 +2276,12 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
+ mwifiex_dbg(adapter, ERROR, "%s: Card failed to ACK download\n",
+ __func__);
+ mwifiex_unmap_pci_memory(adapter, skb,
+- PCI_DMA_TODEVICE);
++ DMA_TO_DEVICE);
+ ret = -1;
+ goto done;
+ }
+
+- mwifiex_unmap_pci_memory(adapter, skb, PCI_DMA_TODEVICE);
++ mwifiex_unmap_pci_memory(adapter, skb, DMA_TO_DEVICE);
+
+ offset += txlen;
+ } while (true);
+@@ -2939,14 +2951,13 @@ static int mwifiex_init_pcie(struct mwifiex_adapter *adapter)
+
+ pci_set_master(pdev);
+
+- pr_notice("try set_consistent_dma_mask(32)\n");
+- ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
++ ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+ if (ret) {
+- pr_err("set_dma_mask(32) failed\n");
++ pr_err("set_dma_mask(32) failed: %d\n", ret);
+ goto err_set_dma_mask;
+ }
+
+- ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
++ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+ if (ret) {
+ pr_err("set_consistent_dma_mask(64) failed\n");
+ goto err_set_dma_mask;
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
+index 00fcbda09349e..f3c6daeba1b85 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
+@@ -98,6 +98,15 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
+ rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length);
+ rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off;
+
++ if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) {
++ mwifiex_dbg(priv->adapter, ERROR,
++ "wrong rx packet offset: len=%d, rx_pkt_off=%d\n",
++ skb->len, rx_pkt_off);
++ priv->stats.rx_dropped++;
++ dev_kfree_skb_any(skb);
++ return -1;
++ }
++
+ if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
+ sizeof(bridge_tunnel_header))) ||
+ (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
+@@ -203,7 +212,8 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
+
+ rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_offset;
+
+- if ((rx_pkt_offset + rx_pkt_length) > (u16) skb->len) {
++ if ((rx_pkt_offset + rx_pkt_length) > skb->len ||
++ sizeof(rx_pkt_hdr->eth803_hdr) + rx_pkt_offset > skb->len) {
+ mwifiex_dbg(adapter, ERROR,
+ "wrong rx packet: len=%d, rx_pkt_offset=%d, rx_pkt_length=%d\n",
+ skb->len, rx_pkt_offset, rx_pkt_length);
+diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c
+index b6b7bbe168ebc..12cfc95f02598 100644
+--- a/drivers/net/wireless/marvell/mwifiex/tdls.c
++++ b/drivers/net/wireless/marvell/mwifiex/tdls.c
+@@ -737,6 +737,7 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
+ int ret;
+ u16 capab;
+ struct ieee80211_ht_cap *ht_cap;
++ unsigned int extra;
+ u8 radio, *pos;
+
+ capab = priv->curr_bss_params.bss_descriptor.cap_info_bitmap;
+@@ -755,7 +756,10 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
+
+ switch (action_code) {
+ case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
+- skb_put(skb, sizeof(mgmt->u.action.u.tdls_discover_resp) + 1);
++ /* See the layout of 'struct ieee80211_mgmt'. */
++ extra = sizeof(mgmt->u.action.u.tdls_discover_resp) +
++ sizeof(mgmt->u.action.category);
++ skb_put(skb, extra);
+ mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
+ mgmt->u.action.u.tdls_discover_resp.action_code =
+ WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
+@@ -764,8 +768,7 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
+ mgmt->u.action.u.tdls_discover_resp.capability =
+ cpu_to_le16(capab);
+ /* move back for addr4 */
+- memmove(pos + ETH_ALEN, &mgmt->u.action.category,
+- sizeof(mgmt->u.action.u.tdls_discover_resp));
++ memmove(pos + ETH_ALEN, &mgmt->u.action, extra);
+ /* init address 4 */
+ memcpy(pos, bc_addr, ETH_ALEN);
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+index 5ce85d5727e4b..987057af00fb3 100644
+--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+@@ -116,6 +116,16 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
+ return;
+ }
+
++ if (sizeof(*rx_pkt_hdr) +
++ le16_to_cpu(uap_rx_pd->rx_pkt_offset) > skb->len) {
++ mwifiex_dbg(adapter, ERROR,
++ "wrong rx packet offset: len=%d,rx_pkt_offset=%d\n",
++ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
++ priv->stats.rx_dropped++;
++ dev_kfree_skb_any(skb);
++ return;
++ }
++
+ if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
+ sizeof(bridge_tunnel_header))) ||
+ (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
+@@ -256,7 +266,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv,
+
+ if (is_multicast_ether_addr(ra)) {
+ skb_uap = skb_copy(skb, GFP_ATOMIC);
+- mwifiex_uap_queue_bridged_pkt(priv, skb_uap);
++ if (likely(skb_uap)) {
++ mwifiex_uap_queue_bridged_pkt(priv, skb_uap);
++ } else {
++ mwifiex_dbg(adapter, ERROR,
++ "failed to copy skb for uAP\n");
++ priv->stats.rx_dropped++;
++ dev_kfree_skb_any(skb);
++ return -1;
++ }
+ } else {
+ if (mwifiex_get_sta_entry(priv, ra)) {
+ /* Requeue Intra-BSS packet */
+@@ -385,6 +403,16 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv,
+ rx_pkt_type = le16_to_cpu(uap_rx_pd->rx_pkt_type);
+ rx_pkt_hdr = (void *)uap_rx_pd + le16_to_cpu(uap_rx_pd->rx_pkt_offset);
+
++ if (le16_to_cpu(uap_rx_pd->rx_pkt_offset) +
++ sizeof(rx_pkt_hdr->eth803_hdr) > skb->len) {
++ mwifiex_dbg(adapter, ERROR,
++ "wrong rx packet for struct ethhdr: len=%d, offset=%d\n",
++ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
++ priv->stats.rx_dropped++;
++ dev_kfree_skb_any(skb);
++ return 0;
++ }
++
+ ether_addr_copy(ta, rx_pkt_hdr->eth803_hdr.h_source);
+
+ if ((le16_to_cpu(uap_rx_pd->rx_pkt_offset) +
+diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c
+index f9b71539d33e6..c45f72779d08a 100644
+--- a/drivers/net/wireless/marvell/mwifiex/util.c
++++ b/drivers/net/wireless/marvell/mwifiex/util.c
+@@ -405,11 +405,15 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
+ }
+
+ rx_pd = (struct rxpd *)skb->data;
++ pkt_len = le16_to_cpu(rx_pd->rx_pkt_length);
++ if (pkt_len < sizeof(struct ieee80211_hdr) + sizeof(pkt_len)) {
++ mwifiex_dbg(priv->adapter, ERROR, "invalid rx_pkt_length");
++ return -1;
++ }
+
+ skb_pull(skb, le16_to_cpu(rx_pd->rx_pkt_offset));
+ skb_pull(skb, sizeof(pkt_len));
+-
+- pkt_len = le16_to_cpu(rx_pd->rx_pkt_length);
++ pkt_len -= sizeof(pkt_len);
+
+ ieee_hdr = (void *)skb->data;
+ if (ieee80211_is_mgmt(ieee_hdr->frame_control)) {
+@@ -422,7 +426,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
+ skb->data + sizeof(struct ieee80211_hdr),
+ pkt_len - sizeof(struct ieee80211_hdr));
+
+- pkt_len -= ETH_ALEN + sizeof(pkt_len);
++ pkt_len -= ETH_ALEN;
+ rx_pd->rx_pkt_length = cpu_to_le16(pkt_len);
+
+ cfg80211_rx_mgmt(&priv->wdev, priv->roc_cfg.chan.center_freq,
+diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
+index 2d647a1cd0ee5..9ac97d560c1c3 100644
+--- a/drivers/ntb/ntb_transport.c
++++ b/drivers/ntb/ntb_transport.c
+@@ -746,7 +746,7 @@ static int ntb_set_mw(struct ntb_transport_ctx *nt, int num_mw,
+ return 0;
+ }
+
+-static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp)
++static void ntb_qp_link_context_reset(struct ntb_transport_qp *qp)
+ {
+ qp->link_is_up = false;
+ qp->active = false;
+@@ -769,6 +769,13 @@ static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp)
+ qp->tx_async = 0;
+ }
+
++static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp)
++{
++ ntb_qp_link_context_reset(qp);
++ if (qp->remote_rx_info)
++ qp->remote_rx_info->entry = qp->rx_max_entry - 1;
++}
++
+ static void ntb_qp_link_cleanup(struct ntb_transport_qp *qp)
+ {
+ struct ntb_transport_ctx *nt = qp->transport;
+@@ -993,7 +1000,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
+ qp->ndev = nt->ndev;
+ qp->client_ready = false;
+ qp->event_handler = NULL;
+- ntb_qp_link_down_reset(qp);
++ ntb_qp_link_context_reset(qp);
+
+ if (mw_num < qp_count % mw_count)
+ num_qps_mw = qp_count / mw_count + 1;
+@@ -2046,9 +2053,13 @@ int ntb_transport_tx_enqueue(struct ntb_transport_qp *qp, void *cb, void *data,
+ struct ntb_queue_entry *entry;
+ int rc;
+
+- if (!qp || !qp->link_is_up || !len)
++ if (!qp || !len)
+ return -EINVAL;
+
++ /* If the qp link is down already, just ignore. */
++ if (!qp->link_is_up)
++ return 0;
++
+ entry = ntb_list_rm(&qp->ntb_tx_free_q_lock, &qp->tx_free_q);
+ if (!entry) {
+ qp->tx_err_no_buf++;
+@@ -2188,7 +2199,7 @@ unsigned int ntb_transport_tx_free_entry(struct ntb_transport_qp *qp)
+ unsigned int head = qp->tx_index;
+ unsigned int tail = qp->remote_rx_info->entry;
+
+- return tail > head ? tail - head : qp->tx_max_entry + tail - head;
++ return tail >= head ? tail - head : qp->tx_max_entry + tail - head;
+ }
+ EXPORT_SYMBOL_GPL(ntb_transport_tx_free_entry);
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 29f17c3449aa4..2515ce3930059 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -52,7 +52,7 @@ static void __init of_unittest_find_node_by_name(void)
+
+ np = of_find_node_by_path("/testcase-data");
+ name = kasprintf(GFP_KERNEL, "%pOF", np);
+- unittest(np && !strcmp("/testcase-data", name),
++ unittest(np && name && !strcmp("/testcase-data", name),
+ "find /testcase-data failed\n");
+ of_node_put(np);
+ kfree(name);
+@@ -63,14 +63,14 @@ static void __init of_unittest_find_node_by_name(void)
+
+ np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a");
+ name = kasprintf(GFP_KERNEL, "%pOF", np);
+- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
++ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
+ "find /testcase-data/phandle-tests/consumer-a failed\n");
+ of_node_put(np);
+ kfree(name);
+
+ np = of_find_node_by_path("testcase-alias");
+ name = kasprintf(GFP_KERNEL, "%pOF", np);
+- unittest(np && !strcmp("/testcase-data", name),
++ unittest(np && name && !strcmp("/testcase-data", name),
+ "find testcase-alias failed\n");
+ of_node_put(np);
+ kfree(name);
+@@ -81,7 +81,7 @@ static void __init of_unittest_find_node_by_name(void)
+
+ np = of_find_node_by_path("testcase-alias/phandle-tests/consumer-a");
+ name = kasprintf(GFP_KERNEL, "%pOF", np);
+- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
++ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
+ "find testcase-alias/phandle-tests/consumer-a failed\n");
+ of_node_put(np);
+ kfree(name);
+@@ -1138,6 +1138,8 @@ static void attach_node_and_children(struct device_node *np)
+ const char *full_name;
+
+ full_name = kasprintf(GFP_KERNEL, "%pOF", np);
++ if (!full_name)
++ return;
+
+ if (!strcmp(full_name, "/__local_fixups__") ||
+ !strcmp(full_name, "/__fixups__")) {
+@@ -1571,7 +1573,7 @@ static int __init of_unittest_apply_revert_overlay_check(int overlay_nr,
+ }
+
+ /* unittest device must be again in before state */
+- if (of_unittest_device_exists(unittest_nr, PDEV_OVERLAY) != before) {
++ if (of_unittest_device_exists(unittest_nr, ovtype) != before) {
+ unittest(0, "%s with device @\"%s\" %s\n",
+ overlay_name_from_nr(overlay_nr),
+ unittest_path(unittest_nr, ovtype),
+diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
+index 6a0833f5923c1..8a5a73d754006 100644
+--- a/drivers/parisc/led.c
++++ b/drivers/parisc/led.c
+@@ -60,8 +60,8 @@
+ static int led_type __read_mostly = -1;
+ static unsigned char lastleds; /* LED state from most recent update */
+ static unsigned int led_heartbeat __read_mostly = 1;
+-static unsigned int led_diskio __read_mostly = 1;
+-static unsigned int led_lanrxtx __read_mostly = 1;
++static unsigned int led_diskio __read_mostly;
++static unsigned int led_lanrxtx __read_mostly;
+ static char lcd_text[32] __read_mostly;
+ static char lcd_text_default[32] __read_mostly;
+ static int lcd_no_led_support __read_mostly = 0; /* KittyHawk doesn't support LED on its LCD */
+diff --git a/drivers/pci/ats.c b/drivers/pci/ats.c
+index 5b78f3b1b918a..420cd0a578d07 100644
+--- a/drivers/pci/ats.c
++++ b/drivers/pci/ats.c
+@@ -368,6 +368,36 @@ int pci_pasid_features(struct pci_dev *pdev)
+ }
+ EXPORT_SYMBOL_GPL(pci_pasid_features);
+
++/**
++ * pci_prg_resp_pasid_required - Return PRG Response PASID Required bit
++ * status.
++ * @pdev: PCI device structure
++ *
++ * Returns 1 if PASID is required in PRG Response Message, 0 otherwise.
++ *
++ * Even though the PRG response PASID status is read from PRI Status
++ * Register, since this API will mainly be used by PASID users, this
++ * function is defined within #ifdef CONFIG_PCI_PASID instead of
++ * CONFIG_PCI_PRI.
++ */
++int pci_prg_resp_pasid_required(struct pci_dev *pdev)
++{
++ u16 status;
++ int pos;
++
++ pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_PRI);
++ if (!pos)
++ return 0;
++
++ pci_read_config_word(pdev, pos + PCI_PRI_STATUS, &status);
++
++ if (status & PCI_PRI_STATUS_PASID)
++ return 1;
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(pci_prg_resp_pasid_required);
++
+ #define PASID_NUMBER_SHIFT 8
+ #define PASID_NUMBER_MASK (0x1f << PASID_NUMBER_SHIFT)
+ /**
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 7392b26e9f158..04630106269af 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -298,17 +298,11 @@ int pciehp_check_link_status(struct controller *ctrl)
+ static int __pciehp_link_set(struct controller *ctrl, bool enable)
+ {
+ struct pci_dev *pdev = ctrl_dev(ctrl);
+- u16 lnk_ctrl;
+
+- pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &lnk_ctrl);
++ pcie_capability_clear_and_set_word(pdev, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_LD,
++ enable ? 0 : PCI_EXP_LNKCTL_LD);
+
+- if (enable)
+- lnk_ctrl &= ~PCI_EXP_LNKCTL_LD;
+- else
+- lnk_ctrl |= PCI_EXP_LNKCTL_LD;
+-
+- pcie_capability_write_word(pdev, PCI_EXP_LNKCTL, lnk_ctrl);
+- ctrl_dbg(ctrl, "%s: lnk_ctrl = %x\n", __func__, lnk_ctrl);
+ return 0;
+ }
+
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index 34a7b3c137bb0..7d3fb70568e3d 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -182,6 +182,9 @@ static ssize_t current_link_speed_show(struct device *dev,
+ return -EINVAL;
+
+ switch (linkstat & PCI_EXP_LNKSTA_CLS) {
++ case PCI_EXP_LNKSTA_CLS_32_0GB:
++ speed = "32 GT/s";
++ break;
+ case PCI_EXP_LNKSTA_CLS_16_0GB:
+ speed = "16 GT/s";
+ break;
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index c8326c7b468fa..2ac400adaee11 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5575,7 +5575,9 @@ enum pci_bus_speed pcie_get_speed_cap(struct pci_dev *dev)
+ */
+ pcie_capability_read_dword(dev, PCI_EXP_LNKCAP2, &lnkcap2);
+ if (lnkcap2) { /* PCIe r3.0-compliant */
+- if (lnkcap2 & PCI_EXP_LNKCAP2_SLS_16_0GB)
++ if (lnkcap2 & PCI_EXP_LNKCAP2_SLS_32_0GB)
++ return PCIE_SPEED_32_0GT;
++ else if (lnkcap2 & PCI_EXP_LNKCAP2_SLS_16_0GB)
+ return PCIE_SPEED_16_0GT;
+ else if (lnkcap2 & PCI_EXP_LNKCAP2_SLS_8_0GB)
+ return PCIE_SPEED_8_0GT;
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index eec62f7377f48..118c91586798d 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -260,7 +260,7 @@ static int pcie_retrain_link(struct pcie_link_state *link)
+ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
+ {
+ int same_clock = 1;
+- u16 reg16, parent_reg, child_reg[8];
++ u16 reg16, ccc, parent_old_ccc, child_old_ccc[8];
+ struct pci_dev *child, *parent = link->pdev;
+ struct pci_bus *linkbus = parent->subordinate;
+ /*
+@@ -282,6 +282,7 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
+
+ /* Port might be already in common clock mode */
+ pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16);
++ parent_old_ccc = reg16 & PCI_EXP_LNKCTL_CCC;
+ if (same_clock && (reg16 & PCI_EXP_LNKCTL_CCC)) {
+ bool consistent = true;
+
+@@ -298,34 +299,29 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
+ pci_warn(parent, "ASPM: current common clock configuration is broken, reconfiguring\n");
+ }
+
++ ccc = same_clock ? PCI_EXP_LNKCTL_CCC : 0;
+ /* Configure downstream component, all functions */
+ list_for_each_entry(child, &linkbus->devices, bus_list) {
+ pcie_capability_read_word(child, PCI_EXP_LNKCTL, ®16);
+- child_reg[PCI_FUNC(child->devfn)] = reg16;
+- if (same_clock)
+- reg16 |= PCI_EXP_LNKCTL_CCC;
+- else
+- reg16 &= ~PCI_EXP_LNKCTL_CCC;
+- pcie_capability_write_word(child, PCI_EXP_LNKCTL, reg16);
++ child_old_ccc[PCI_FUNC(child->devfn)] = reg16 & PCI_EXP_LNKCTL_CCC;
++ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_CCC, ccc);
+ }
+
+ /* Configure upstream component */
+- pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16);
+- parent_reg = reg16;
+- if (same_clock)
+- reg16 |= PCI_EXP_LNKCTL_CCC;
+- else
+- reg16 &= ~PCI_EXP_LNKCTL_CCC;
+- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
++ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_CCC, ccc);
+
+ if (pcie_retrain_link(link)) {
+
+ /* Training failed. Restore common clock configurations */
+ pci_err(parent, "ASPM: Could not configure common clock\n");
+ list_for_each_entry(child, &linkbus->devices, bus_list)
+- pcie_capability_write_word(child, PCI_EXP_LNKCTL,
+- child_reg[PCI_FUNC(child->devfn)]);
+- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, parent_reg);
++ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_CCC,
++ child_old_ccc[PCI_FUNC(child->devfn)]);
++ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL,
++ PCI_EXP_LNKCTL_CCC, parent_old_ccc);
+ }
+ }
+
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 113b7bdf86dd9..5a609848452f2 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -667,7 +667,7 @@ const unsigned char pcie_link_speed[] = {
+ PCIE_SPEED_5_0GT, /* 2 */
+ PCIE_SPEED_8_0GT, /* 3 */
+ PCIE_SPEED_16_0GT, /* 4 */
+- PCI_SPEED_UNKNOWN, /* 5 */
++ PCIE_SPEED_32_0GT, /* 5 */
+ PCI_SPEED_UNKNOWN, /* 6 */
+ PCI_SPEED_UNKNOWN, /* 7 */
+ PCI_SPEED_UNKNOWN, /* 8 */
+diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
+index dfbe9cbf292c0..d575583e49c2c 100644
+--- a/drivers/pci/slot.c
++++ b/drivers/pci/slot.c
+@@ -75,6 +75,7 @@ static const char *pci_bus_speed_strings[] = {
+ "5.0 GT/s PCIe", /* 0x15 */
+ "8.0 GT/s PCIe", /* 0x16 */
+ "16.0 GT/s PCIe", /* 0x17 */
++ "32.0 GT/s PCIe", /* 0x18 */
+ };
+
+ static ssize_t bus_speed_read(enum pci_bus_speed speed, char *buf)
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index c140ee16fe7c8..ee25edecc2e1d 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -663,7 +663,7 @@ static int amd_pinconf_get(struct pinctrl_dev *pctldev,
+ break;
+
+ default:
+- dev_err(&gpio_dev->pdev->dev, "Invalid config param %04x\n",
++ dev_dbg(&gpio_dev->pdev->dev, "Invalid config param %04x\n",
+ param);
+ return -ENOTSUPP;
+ }
+@@ -716,7 +716,7 @@ static int amd_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,
+ break;
+
+ default:
+- dev_err(&gpio_dev->pdev->dev,
++ dev_dbg(&gpio_dev->pdev->dev,
+ "Invalid config param %04x\n", param);
+ ret = -ENOTSUPP;
+ }
+diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
+index fa3cda69cec96..159284bfdd7f2 100644
+--- a/drivers/platform/x86/intel-hid.c
++++ b/drivers/platform/x86/intel-hid.c
+@@ -449,7 +449,7 @@ static bool button_array_present(struct platform_device *device)
+ static int intel_hid_probe(struct platform_device *device)
+ {
+ acpi_handle handle = ACPI_HANDLE(&device->dev);
+- unsigned long long mode;
++ unsigned long long mode, dummy;
+ struct intel_hid_priv *priv;
+ acpi_status status;
+ int err;
+@@ -501,18 +501,15 @@ static int intel_hid_probe(struct platform_device *device)
+ if (err)
+ goto err_remove_notify;
+
+- if (priv->array) {
+- unsigned long long dummy;
++ intel_button_array_enable(&device->dev, true);
+
+- intel_button_array_enable(&device->dev, true);
+-
+- /* Call button load method to enable HID power button */
+- if (!intel_hid_evaluate_method(handle, INTEL_HID_DSM_BTNL_FN,
+- &dummy)) {
+- dev_warn(&device->dev,
+- "failed to enable HID power button\n");
+- }
+- }
++ /*
++ * Call button load method to enable HID power button
++ * Always do this since it activates events on some devices without
++ * a button array too.
++ */
++ if (!intel_hid_evaluate_method(handle, INTEL_HID_DSM_BTNL_FN, &dummy))
++ dev_warn(&device->dev, "failed to enable HID power button\n");
+
+ device_init_wakeup(&device->dev, true);
+ return 0;
+diff --git a/drivers/pwm/pwm-lpc32xx.c b/drivers/pwm/pwm-lpc32xx.c
+index ed8e9406b4af2..b5f8b86b328af 100644
+--- a/drivers/pwm/pwm-lpc32xx.c
++++ b/drivers/pwm/pwm-lpc32xx.c
+@@ -55,10 +55,10 @@ static int lpc32xx_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ if (duty_cycles > 255)
+ duty_cycles = 255;
+
+- val = readl(lpc32xx->base + (pwm->hwpwm << 2));
++ val = readl(lpc32xx->base);
+ val &= ~0xFFFF;
+ val |= (period_cycles << 8) | duty_cycles;
+- writel(val, lpc32xx->base + (pwm->hwpwm << 2));
++ writel(val, lpc32xx->base);
+
+ return 0;
+ }
+@@ -73,9 +73,9 @@ static int lpc32xx_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+ if (ret)
+ return ret;
+
+- val = readl(lpc32xx->base + (pwm->hwpwm << 2));
++ val = readl(lpc32xx->base);
+ val |= PWM_ENABLE;
+- writel(val, lpc32xx->base + (pwm->hwpwm << 2));
++ writel(val, lpc32xx->base);
+
+ return 0;
+ }
+@@ -85,9 +85,9 @@ static void lpc32xx_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ struct lpc32xx_pwm_chip *lpc32xx = to_lpc32xx_pwm_chip(chip);
+ u32 val;
+
+- val = readl(lpc32xx->base + (pwm->hwpwm << 2));
++ val = readl(lpc32xx->base);
+ val &= ~PWM_ENABLE;
+- writel(val, lpc32xx->base + (pwm->hwpwm << 2));
++ writel(val, lpc32xx->base);
+
+ clk_disable_unprepare(lpc32xx->clk);
+ }
+@@ -125,9 +125,9 @@ static int lpc32xx_pwm_probe(struct platform_device *pdev)
+ lpc32xx->chip.base = -1;
+
+ /* If PWM is disabled, configure the output to the default value */
+- val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
++ val = readl(lpc32xx->base);
+ val &= ~PWM_PIN_LEVEL;
+- writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
++ writel(val, lpc32xx->base);
+
+ ret = pwmchip_add(&lpc32xx->chip);
+ if (ret < 0) {
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index 940f099c2092f..02e39778d3c6b 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -222,6 +222,10 @@ static struct glink_channel *qcom_glink_alloc_channel(struct qcom_glink *glink,
+
+ channel->glink = glink;
+ channel->name = kstrdup(name, GFP_KERNEL);
++ if (!channel->name) {
++ kfree(channel);
++ return ERR_PTR(-ENOMEM);
++ }
+
+ init_completion(&channel->open_req);
+ init_completion(&channel->open_ack);
+diff --git a/drivers/rtc/rtc-ds1685.c b/drivers/rtc/rtc-ds1685.c
+index 6f39f683a98c6..83926cd4753bd 100644
+--- a/drivers/rtc/rtc-ds1685.c
++++ b/drivers/rtc/rtc-ds1685.c
+@@ -1630,7 +1630,7 @@ ds1685_rtc_poweroff(struct platform_device *pdev)
+ unreachable();
+ }
+ }
+-EXPORT_SYMBOL(ds1685_rtc_poweroff);
++EXPORT_SYMBOL_GPL(ds1685_rtc_poweroff);
+ /* ----------------------------------------------------------------------- */
+
+
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index c1cf277d0d89a..c0eee7b00442e 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -2826,41 +2826,32 @@ static void _dasd_wake_block_flush_cb(struct dasd_ccw_req *cqr, void *data)
+ * Requeue a request back to the block request queue
+ * only works for block requests
+ */
+-static int _dasd_requeue_request(struct dasd_ccw_req *cqr)
++static void _dasd_requeue_request(struct dasd_ccw_req *cqr)
+ {
+- struct dasd_block *block = cqr->block;
+ struct request *req;
+
+- if (!block)
+- return -EINVAL;
+ /*
+ * If the request is an ERP request there is nothing to requeue.
+ * This will be done with the remaining original request.
+ */
+ if (cqr->refers)
+- return 0;
++ return;
+ spin_lock_irq(&cqr->dq->lock);
+ req = (struct request *) cqr->callback_data;
+ blk_mq_requeue_request(req, true);
+ spin_unlock_irq(&cqr->dq->lock);
+
+- return 0;
++ return;
+ }
+
+-/*
+- * Go through all request on the dasd_block request queue, cancel them
+- * on the respective dasd_device, and return them to the generic
+- * block layer.
+- */
+-static int dasd_flush_block_queue(struct dasd_block *block)
++static int _dasd_requests_to_flushqueue(struct dasd_block *block,
++ struct list_head *flush_queue)
+ {
+ struct dasd_ccw_req *cqr, *n;
+- int rc, i;
+- struct list_head flush_queue;
+ unsigned long flags;
++ int rc, i;
+
+- INIT_LIST_HEAD(&flush_queue);
+- spin_lock_bh(&block->queue_lock);
++ spin_lock_irqsave(&block->queue_lock, flags);
+ rc = 0;
+ restart:
+ list_for_each_entry_safe(cqr, n, &block->ccw_queue, blocklist) {
+@@ -2875,13 +2866,32 @@ restart:
+ * is returned from the dasd_device layer.
+ */
+ cqr->callback = _dasd_wake_block_flush_cb;
+- for (i = 0; cqr != NULL; cqr = cqr->refers, i++)
+- list_move_tail(&cqr->blocklist, &flush_queue);
++ for (i = 0; cqr; cqr = cqr->refers, i++)
++ list_move_tail(&cqr->blocklist, flush_queue);
+ if (i > 1)
+ /* moved more than one request - need to restart */
+ goto restart;
+ }
+- spin_unlock_bh(&block->queue_lock);
++ spin_unlock_irqrestore(&block->queue_lock, flags);
++
++ return rc;
++}
++
++/*
++ * Go through all request on the dasd_block request queue, cancel them
++ * on the respective dasd_device, and return them to the generic
++ * block layer.
++ */
++static int dasd_flush_block_queue(struct dasd_block *block)
++{
++ struct dasd_ccw_req *cqr, *n;
++ struct list_head flush_queue;
++ unsigned long flags;
++ int rc;
++
++ INIT_LIST_HEAD(&flush_queue);
++ rc = _dasd_requests_to_flushqueue(block, &flush_queue);
++
+ /* Now call the callback function of flushed requests */
+ restart_cb:
+ list_for_each_entry_safe(cqr, n, &flush_queue, blocklist) {
+@@ -3832,75 +3842,36 @@ EXPORT_SYMBOL_GPL(dasd_generic_verify_path);
+ */
+ static int dasd_generic_requeue_all_requests(struct dasd_device *device)
+ {
++ struct dasd_block *block = device->block;
+ struct list_head requeue_queue;
+ struct dasd_ccw_req *cqr, *n;
+- struct dasd_ccw_req *refers;
+ int rc;
+
+- INIT_LIST_HEAD(&requeue_queue);
+- spin_lock_irq(get_ccwdev_lock(device->cdev));
+- rc = 0;
+- list_for_each_entry_safe(cqr, n, &device->ccw_queue, devlist) {
+- /* Check status and move request to flush_queue */
+- if (cqr->status == DASD_CQR_IN_IO) {
+- rc = device->discipline->term_IO(cqr);
+- if (rc) {
+- /* unable to terminate requeust */
+- dev_err(&device->cdev->dev,
+- "Unable to terminate request %p "
+- "on suspend\n", cqr);
+- spin_unlock_irq(get_ccwdev_lock(device->cdev));
+- dasd_put_device(device);
+- return rc;
+- }
+- }
+- list_move_tail(&cqr->devlist, &requeue_queue);
+- }
+- spin_unlock_irq(get_ccwdev_lock(device->cdev));
+-
+- list_for_each_entry_safe(cqr, n, &requeue_queue, devlist) {
+- wait_event(dasd_flush_wq,
+- (cqr->status != DASD_CQR_CLEAR_PENDING));
++ if (!block)
++ return 0;
+
+- /*
+- * requeue requests to blocklayer will only work
+- * for block device requests
+- */
+- if (_dasd_requeue_request(cqr))
+- continue;
++ INIT_LIST_HEAD(&requeue_queue);
++ rc = _dasd_requests_to_flushqueue(block, &requeue_queue);
+
+- /* remove requests from device and block queue */
+- list_del_init(&cqr->devlist);
+- while (cqr->refers != NULL) {
+- refers = cqr->refers;
+- /* remove the request from the block queue */
+- list_del(&cqr->blocklist);
+- /* free the finished erp request */
+- dasd_free_erp_request(cqr, cqr->memdev);
+- cqr = refers;
++ /* Now call the callback function of flushed requests */
++restart_cb:
++ list_for_each_entry_safe(cqr, n, &requeue_queue, blocklist) {
++ wait_event(dasd_flush_wq, (cqr->status < DASD_CQR_QUEUED));
++ /* Process finished ERP request. */
++ if (cqr->refers) {
++ spin_lock_bh(&block->queue_lock);
++ __dasd_process_erp(block->base, cqr);
++ spin_unlock_bh(&block->queue_lock);
++ /* restart list_for_xx loop since dasd_process_erp
++ * might remove multiple elements
++ */
++ goto restart_cb;
+ }
+-
+- /*
+- * _dasd_requeue_request already checked for a valid
+- * blockdevice, no need to check again
+- * all erp requests (cqr->refers) have a cqr->block
+- * pointer copy from the original cqr
+- */
++ _dasd_requeue_request(cqr);
+ list_del_init(&cqr->blocklist);
+ cqr->block->base->discipline->free_cp(
+ cqr, (struct request *) cqr->callback_data);
+ }
+-
+- /*
+- * if requests remain then they are internal request
+- * and go back to the device queue
+- */
+- if (!list_empty(&requeue_queue)) {
+- /* move freeze_queue to start of the ccw_queue */
+- spin_lock_irq(get_ccwdev_lock(device->cdev));
+- list_splice_tail(&requeue_queue, &device->ccw_queue);
+- spin_unlock_irq(get_ccwdev_lock(device->cdev));
+- }
+ dasd_schedule_device_bh(device);
+ return rc;
+ }
+diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
+index ee73b0607e47c..8598c792ded30 100644
+--- a/drivers/s390/block/dasd_3990_erp.c
++++ b/drivers/s390/block/dasd_3990_erp.c
+@@ -2436,7 +2436,7 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr)
+ erp->block = cqr->block;
+ erp->magic = cqr->magic;
+ erp->expires = cqr->expires;
+- erp->retries = 256;
++ erp->retries = device->default_retries;
+ erp->buildclk = get_tod_clock();
+ erp->status = DASD_CQR_FILLED;
+
+diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c
+index c8f0a2144b443..818a690771e05 100644
+--- a/drivers/scsi/be2iscsi/be_iscsi.c
++++ b/drivers/scsi/be2iscsi/be_iscsi.c
+@@ -445,6 +445,10 @@ int beiscsi_iface_set_param(struct Scsi_Host *shost,
+ }
+
+ nla_for_each_attr(attrib, data, dt_len, rm_len) {
++ /* ignore nla_type as it is never used */
++ if (nla_len(attrib) < sizeof(*iface_param))
++ return -EINVAL;
++
+ iface_param = nla_data(attrib);
+
+ if (iface_param->param_type != ISCSI_NET_PARAM)
+diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
+index 1e087a206f48e..c49986eba47b6 100644
+--- a/drivers/scsi/fcoe/fcoe_ctlr.c
++++ b/drivers/scsi/fcoe/fcoe_ctlr.c
+@@ -330,16 +330,17 @@ static void fcoe_ctlr_announce(struct fcoe_ctlr *fip)
+ {
+ struct fcoe_fcf *sel;
+ struct fcoe_fcf *fcf;
++ unsigned long flags;
+
+ mutex_lock(&fip->ctlr_mutex);
+- spin_lock_bh(&fip->ctlr_lock);
++ spin_lock_irqsave(&fip->ctlr_lock, flags);
+
+ kfree_skb(fip->flogi_req);
+ fip->flogi_req = NULL;
+ list_for_each_entry(fcf, &fip->fcfs, list)
+ fcf->flogi_sent = 0;
+
+- spin_unlock_bh(&fip->ctlr_lock);
++ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+ sel = fip->sel_fcf;
+
+ if (sel && ether_addr_equal(sel->fcf_mac, fip->dest_addr))
+@@ -709,6 +710,7 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
+ {
+ struct fc_frame *fp;
+ struct fc_frame_header *fh;
++ unsigned long flags;
+ u16 old_xid;
+ u8 op;
+ u8 mac[ETH_ALEN];
+@@ -742,11 +744,11 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
+ op = FIP_DT_FLOGI;
+ if (fip->mode == FIP_MODE_VN2VN)
+ break;
+- spin_lock_bh(&fip->ctlr_lock);
++ spin_lock_irqsave(&fip->ctlr_lock, flags);
+ kfree_skb(fip->flogi_req);
+ fip->flogi_req = skb;
+ fip->flogi_req_send = 1;
+- spin_unlock_bh(&fip->ctlr_lock);
++ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+ schedule_work(&fip->timer_work);
+ return -EINPROGRESS;
+ case ELS_FDISC:
+@@ -1723,10 +1725,11 @@ static int fcoe_ctlr_flogi_send_locked(struct fcoe_ctlr *fip)
+ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
+ {
+ struct fcoe_fcf *fcf;
++ unsigned long flags;
+ int error;
+
+ mutex_lock(&fip->ctlr_mutex);
+- spin_lock_bh(&fip->ctlr_lock);
++ spin_lock_irqsave(&fip->ctlr_lock, flags);
+ LIBFCOE_FIP_DBG(fip, "re-sending FLOGI - reselect\n");
+ fcf = fcoe_ctlr_select(fip);
+ if (!fcf || fcf->flogi_sent) {
+@@ -1737,7 +1740,7 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
+ fcoe_ctlr_solicit(fip, NULL);
+ error = fcoe_ctlr_flogi_send_locked(fip);
+ }
+- spin_unlock_bh(&fip->ctlr_lock);
++ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+ mutex_unlock(&fip->ctlr_mutex);
+ return error;
+ }
+@@ -1754,8 +1757,9 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
+ static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
+ {
+ struct fcoe_fcf *fcf;
++ unsigned long flags;
+
+- spin_lock_bh(&fip->ctlr_lock);
++ spin_lock_irqsave(&fip->ctlr_lock, flags);
+ fcf = fip->sel_fcf;
+ if (!fcf || !fip->flogi_req_send)
+ goto unlock;
+@@ -1782,7 +1786,7 @@ static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
+ } else /* XXX */
+ LIBFCOE_FIP_DBG(fip, "No FCF selected - defer send\n");
+ unlock:
+- spin_unlock_bh(&fip->ctlr_lock);
++ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
+ }
+
+ /**
+diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
+index 2ffc2e15d822b..c5a0ef6f67c0f 100644
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -532,7 +532,7 @@ EXPORT_SYMBOL(scsi_host_alloc);
+ static int __scsi_host_match(struct device *dev, const void *data)
+ {
+ struct Scsi_Host *p;
+- const unsigned short *hostnum = data;
++ const unsigned int *hostnum = data;
+
+ p = class_to_shost(dev);
+ return p->host_no == *hostnum;
+@@ -549,7 +549,7 @@ static int __scsi_host_match(struct device *dev, const void *data)
+ * that scsi_host_get() took. The put_device() below dropped
+ * the reference from class_find_device().
+ **/
+-struct Scsi_Host *scsi_host_lookup(unsigned short hostnum)
++struct Scsi_Host *scsi_host_lookup(unsigned int hostnum)
+ {
+ struct device *cdev;
+ struct Scsi_Host *shost = NULL;
+diff --git a/drivers/scsi/qedf/qedf_dbg.h b/drivers/scsi/qedf/qedf_dbg.h
+index dd0109653aa32..9c7f7b444daa7 100644
+--- a/drivers/scsi/qedf/qedf_dbg.h
++++ b/drivers/scsi/qedf/qedf_dbg.h
+@@ -63,6 +63,8 @@ extern uint qedf_debug;
+ #define QEDF_LOG_NOTICE 0x40000000 /* Notice logs */
+ #define QEDF_LOG_WARN 0x80000000 /* Warning logs */
+
++#define QEDF_DEBUGFS_LOG_LEN (2 * PAGE_SIZE)
++
+ /* Debug context structure */
+ struct qedf_dbg_ctx {
+ unsigned int host_no;
+diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c
+index c29c162a494ff..84f1ddcfbb218 100644
+--- a/drivers/scsi/qedf/qedf_debugfs.c
++++ b/drivers/scsi/qedf/qedf_debugfs.c
+@@ -11,6 +11,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/debugfs.h>
+ #include <linux/module.h>
++#include <linux/vmalloc.h>
+
+ #include "qedf.h"
+ #include "qedf_dbg.h"
+@@ -117,7 +118,9 @@ static ssize_t
+ qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,
+ loff_t *ppos)
+ {
++ ssize_t ret;
+ size_t cnt = 0;
++ char *cbuf;
+ int id;
+ struct qedf_fastpath *fp = NULL;
+ struct qedf_dbg_ctx *qedf_dbg =
+@@ -127,19 +130,25 @@ qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,
+
+ QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n");
+
+- cnt = sprintf(buffer, "\nFastpath I/O completions\n\n");
++ cbuf = vmalloc(QEDF_DEBUGFS_LOG_LEN);
++ if (!cbuf)
++ return 0;
++
++ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt, "\nFastpath I/O completions\n\n");
+
+ for (id = 0; id < qedf->num_queues; id++) {
+ fp = &(qedf->fp_array[id]);
+ if (fp->sb_id == QEDF_SB_ID_NULL)
+ continue;
+- cnt += sprintf((buffer + cnt), "#%d: %lu\n", id,
+- fp->completions);
++ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt,
++ "#%d: %lu\n", id, fp->completions);
+ }
+
+- cnt = min_t(int, count, cnt - *ppos);
+- *ppos += cnt;
+- return cnt;
++ ret = simple_read_from_buffer(buffer, count, ppos, cbuf, cnt);
++
++ vfree(cbuf);
++
++ return ret;
+ }
+
+ static ssize_t
+@@ -204,18 +213,17 @@ qedf_dbg_stop_io_on_error_cmd_read(struct file *filp, char __user *buffer,
+ size_t count, loff_t *ppos)
+ {
+ int cnt;
++ char cbuf[7];
+ struct qedf_dbg_ctx *qedf_dbg =
+ (struct qedf_dbg_ctx *)filp->private_data;
+ struct qedf_ctx *qedf = container_of(qedf_dbg,
+ struct qedf_ctx, dbg_ctx);
+
+ QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n");
+- cnt = sprintf(buffer, "%s\n",
++ cnt = scnprintf(cbuf, sizeof(cbuf), "%s\n",
+ qedf->stop_io_on_error ? "true" : "false");
+
+- cnt = min_t(int, count, cnt - *ppos);
+- *ppos += cnt;
+- return cnt;
++ return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt);
+ }
+
+ static ssize_t
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index ab66e1f0fdfa3..7a179cfc01ed2 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -1864,8 +1864,9 @@ static int qedi_cpu_offline(unsigned int cpu)
+ struct qedi_percpu_s *p = this_cpu_ptr(&qedi_percpu);
+ struct qedi_work *work, *tmp;
+ struct task_struct *thread;
++ unsigned long flags;
+
+- spin_lock_bh(&p->p_work_lock);
++ spin_lock_irqsave(&p->p_work_lock, flags);
+ thread = p->iothread;
+ p->iothread = NULL;
+
+@@ -1876,7 +1877,7 @@ static int qedi_cpu_offline(unsigned int cpu)
+ kfree(work);
+ }
+
+- spin_unlock_bh(&p->p_work_lock);
++ spin_unlock_irqrestore(&p->p_work_lock, flags);
+ if (thread)
+ kthread_stop(thread);
+ return 0;
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 9c7af5e1dfb07..ca2bc3f36ff6a 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -2673,7 +2673,6 @@ check_scsi_status:
+ case CS_PORT_BUSY:
+ case CS_INCOMPLETE:
+ case CS_PORT_UNAVAILABLE:
+- case CS_TIMEOUT:
+ case CS_RESET:
+
+ /*
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index dcd0f058f23e0..35762d29b04ba 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -518,7 +518,7 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
+
+ rval = qla2x00_start_nvme_mq(sp);
+ if (rval != QLA_SUCCESS) {
+- ql_log(ql_log_warn, vha, 0x212d,
++ ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x212d,
+ "qla2x00_start_nvme_mq failed = %d\n", rval);
+ atomic_dec(&sp->ref_count);
+ wake_up(&sp->nvme_ls_waitq);
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index 4ba9f46fcf748..21cc9e2797a28 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -940,6 +940,11 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host *shost, void *data, int len)
+ memset(&chap_rec, 0, sizeof(chap_rec));
+
+ nla_for_each_attr(attr, data, len, rem) {
++ if (nla_len(attr) < sizeof(*param_info)) {
++ rc = -EINVAL;
++ goto exit_set_chap;
++ }
++
+ param_info = nla_data(attr);
+
+ switch (param_info->param) {
+@@ -2724,6 +2729,11 @@ qla4xxx_iface_set_param(struct Scsi_Host *shost, void *data, uint32_t len)
+ }
+
+ nla_for_each_attr(attr, data, len, rem) {
++ if (nla_len(attr) < sizeof(*iface_param)) {
++ rval = -EINVAL;
++ goto exit_init_fw_cb;
++ }
++
+ iface_param = nla_data(attr);
+
+ if (iface_param->param_type == ISCSI_NET_PARAM) {
+@@ -8098,6 +8108,11 @@ qla4xxx_sysfs_ddb_set_param(struct iscsi_bus_flash_session *fnode_sess,
+
+ memset((void *)&chap_tbl, 0, sizeof(chap_tbl));
+ nla_for_each_attr(attr, data, len, rem) {
++ if (nla_len(attr) < sizeof(*fnode_param)) {
++ rc = -EINVAL;
++ goto exit_set_param;
++ }
++
+ fnode_param = nla_data(attr);
+
+ switch (fnode_param->param) {
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 79581771e6f61..b13d1be1b0f10 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2765,6 +2765,10 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+ if (!conn || !session)
+ return -EINVAL;
+
++ /* data will be regarded as NULL-ended string, do length check */
++ if (strlen(data) > ev->u.set_param.len)
++ return -EINVAL;
++
+ switch (ev->u.set_param.param) {
+ case ISCSI_PARAM_SESS_RECOVERY_TMO:
+ sscanf(data, "%d", &value);
+@@ -2917,6 +2921,10 @@ iscsi_set_host_param(struct iscsi_transport *transport,
+ return -ENODEV;
+ }
+
++ /* see similar check in iscsi_if_set_param() */
++ if (strlen(data) > ev->u.set_host_param.len)
++ return -EINVAL;
++
+ err = transport->set_host_param(shost, ev->u.set_host_param.param,
+ data, ev->u.set_host_param.len);
+ scsi_host_put(shost);
+diff --git a/drivers/soc/qcom/qmi_encdec.c b/drivers/soc/qcom/qmi_encdec.c
+index 3aaab71d1b2c1..dbc8b4c931903 100644
+--- a/drivers/soc/qcom/qmi_encdec.c
++++ b/drivers/soc/qcom/qmi_encdec.c
+@@ -534,8 +534,8 @@ static int qmi_decode_string_elem(struct qmi_elem_info *ei_array,
+ decoded_bytes += rc;
+ }
+
+- if (string_len > temp_ei->elem_len) {
+- pr_err("%s: String len %d > Max Len %d\n",
++ if (string_len >= temp_ei->elem_len) {
++ pr_err("%s: String len %d >= Max Len %d\n",
+ __func__, string_len, temp_ei->elem_len);
+ return -ETOOSMALL;
+ } else if (string_len > tlv_len) {
+diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
+index 749288310c36c..2989795272a16 100644
+--- a/drivers/spi/spi-tegra20-sflash.c
++++ b/drivers/spi/spi-tegra20-sflash.c
+@@ -469,7 +469,11 @@ static int tegra_sflash_probe(struct platform_device *pdev)
+ goto exit_free_master;
+ }
+
+- tsd->irq = platform_get_irq(pdev, 0);
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto exit_free_master;
++ tsd->irq = ret;
++
+ ret = request_irq(tsd->irq, tegra_sflash_isr, 0,
+ dev_name(&pdev->dev), tsd);
+ if (ret < 0) {
+diff --git a/drivers/staging/erofs/unzip_vle.c b/drivers/staging/erofs/unzip_vle.c
+index 83e4d9384bd2d..7ccc4a18a9006 100644
+--- a/drivers/staging/erofs/unzip_vle.c
++++ b/drivers/staging/erofs/unzip_vle.c
+@@ -675,6 +675,8 @@ hitted:
+ cur = end - min_t(unsigned, offset + end - map->m_la, end);
+ if (unlikely(!(map->m_flags & EROFS_MAP_MAPPED))) {
+ zero_user_segment(page, cur, end);
++ ++spiltted;
++ tight = false;
+ goto next_part;
+ }
+
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index d25cadc4f4f11..ac071abae7e90 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -516,102 +516,102 @@ static ssize_t lio_target_nacl_info_show(struct config_item *item, char *page)
+ spin_lock_bh(&se_nacl->nacl_sess_lock);
+ se_sess = se_nacl->nacl_sess;
+ if (!se_sess) {
+- rb += sprintf(page+rb, "No active iSCSI Session for Initiator"
++ rb += sysfs_emit_at(page, rb, "No active iSCSI Session for Initiator"
+ " Endpoint: %s\n", se_nacl->initiatorname);
+ } else {
+ sess = se_sess->fabric_sess_ptr;
+
+- rb += sprintf(page+rb, "InitiatorName: %s\n",
++ rb += sysfs_emit_at(page, rb, "InitiatorName: %s\n",
+ sess->sess_ops->InitiatorName);
+- rb += sprintf(page+rb, "InitiatorAlias: %s\n",
++ rb += sysfs_emit_at(page, rb, "InitiatorAlias: %s\n",
+ sess->sess_ops->InitiatorAlias);
+
+- rb += sprintf(page+rb,
++ rb += sysfs_emit_at(page, rb,
+ "LIO Session ID: %u ISID: 0x%6ph TSIH: %hu ",
+ sess->sid, sess->isid, sess->tsih);
+- rb += sprintf(page+rb, "SessionType: %s\n",
++ rb += sysfs_emit_at(page, rb, "SessionType: %s\n",
+ (sess->sess_ops->SessionType) ?
+ "Discovery" : "Normal");
+- rb += sprintf(page+rb, "Session State: ");
++ rb += sysfs_emit_at(page, rb, "Session State: ");
+ switch (sess->session_state) {
+ case TARG_SESS_STATE_FREE:
+- rb += sprintf(page+rb, "TARG_SESS_FREE\n");
++ rb += sysfs_emit_at(page, rb, "TARG_SESS_FREE\n");
+ break;
+ case TARG_SESS_STATE_ACTIVE:
+- rb += sprintf(page+rb, "TARG_SESS_STATE_ACTIVE\n");
++ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_ACTIVE\n");
+ break;
+ case TARG_SESS_STATE_LOGGED_IN:
+- rb += sprintf(page+rb, "TARG_SESS_STATE_LOGGED_IN\n");
++ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_LOGGED_IN\n");
+ break;
+ case TARG_SESS_STATE_FAILED:
+- rb += sprintf(page+rb, "TARG_SESS_STATE_FAILED\n");
++ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_FAILED\n");
+ break;
+ case TARG_SESS_STATE_IN_CONTINUE:
+- rb += sprintf(page+rb, "TARG_SESS_STATE_IN_CONTINUE\n");
++ rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_IN_CONTINUE\n");
+ break;
+ default:
+- rb += sprintf(page+rb, "ERROR: Unknown Session"
++ rb += sysfs_emit_at(page, rb, "ERROR: Unknown Session"
+ " State!\n");
+ break;
+ }
+
+- rb += sprintf(page+rb, "---------------------[iSCSI Session"
++ rb += sysfs_emit_at(page, rb, "---------------------[iSCSI Session"
+ " Values]-----------------------\n");
+- rb += sprintf(page+rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN"
++ rb += sysfs_emit_at(page, rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN"
+ " : MaxCmdSN : ITT : TTT\n");
+ max_cmd_sn = (u32) atomic_read(&sess->max_cmd_sn);
+- rb += sprintf(page+rb, " 0x%08x 0x%08x 0x%08x 0x%08x"
++ rb += sysfs_emit_at(page, rb, " 0x%08x 0x%08x 0x%08x 0x%08x"
+ " 0x%08x 0x%08x\n",
+ sess->cmdsn_window,
+ (max_cmd_sn - sess->exp_cmd_sn) + 1,
+ sess->exp_cmd_sn, max_cmd_sn,
+ sess->init_task_tag, sess->targ_xfer_tag);
+- rb += sprintf(page+rb, "----------------------[iSCSI"
++ rb += sysfs_emit_at(page, rb, "----------------------[iSCSI"
+ " Connections]-------------------------\n");
+
+ spin_lock(&sess->conn_lock);
+ list_for_each_entry(conn, &sess->sess_conn_list, conn_list) {
+- rb += sprintf(page+rb, "CID: %hu Connection"
++ rb += sysfs_emit_at(page, rb, "CID: %hu Connection"
+ " State: ", conn->cid);
+ switch (conn->conn_state) {
+ case TARG_CONN_STATE_FREE:
+- rb += sprintf(page+rb,
++ rb += sysfs_emit_at(page, rb,
+ "TARG_CONN_STATE_FREE\n");
+ break;
+ case TARG_CONN_STATE_XPT_UP:
+- rb += sprintf(page+rb,
++ rb += sysfs_emit_at(page, rb,
+ "TARG_CONN_STATE_XPT_UP\n");
+ break;
+ case TARG_CONN_STATE_IN_LOGIN:
+- rb += sprintf(page+rb,
++ rb += sysfs_emit_at(page, rb,
+ "TARG_CONN_STATE_IN_LOGIN\n");
+ break;
+ case TARG_CONN_STATE_LOGGED_IN:
+- rb += sprintf(page+rb,
++ rb += sysfs_emit_at(page, rb,
+ "TARG_CONN_STATE_LOGGED_IN\n");
+ break;
+ case TARG_CONN_STATE_IN_LOGOUT:
+- rb += sprintf(page+rb,
++ rb += sysfs_emit_at(page, rb,
+ "TARG_CONN_STATE_IN_LOGOUT\n");
+ break;
+ case TARG_CONN_STATE_LOGOUT_REQUESTED:
+- rb += sprintf(page+rb,
++ rb += sysfs_emit_at(page, rb,
+ "TARG_CONN_STATE_LOGOUT_REQUESTED\n");
+ break;
+ case TARG_CONN_STATE_CLEANUP_WAIT:
+- rb += sprintf(page+rb,
++ rb += sysfs_emit_at(page, rb,
+ "TARG_CONN_STATE_CLEANUP_WAIT\n");
+ break;
+ default:
+- rb += sprintf(page+rb,
++ rb += sysfs_emit_at(page, rb,
+ "ERROR: Unknown Connection State!\n");
+ break;
+ }
+
+- rb += sprintf(page+rb, " Address %pISc %s", &conn->login_sockaddr,
++ rb += sysfs_emit_at(page, rb, " Address %pISc %s", &conn->login_sockaddr,
+ (conn->network_transport == ISCSI_TCP) ?
+ "TCP" : "SCTP");
+- rb += sprintf(page+rb, " StatSN: 0x%08x\n",
++ rb += sysfs_emit_at(page, rb, " StatSN: 0x%08x\n",
+ conn->stat_sn);
+ }
+ spin_unlock(&sess->conn_lock);
+diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+index ad40c75bb58f8..375d4790e058b 100644
+--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c
++++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+@@ -1269,19 +1269,14 @@ static void cpm_uart_console_write(struct console *co, const char *s,
+ {
+ struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index];
+ unsigned long flags;
+- int nolock = oops_in_progress;
+
+- if (unlikely(nolock)) {
++ if (unlikely(oops_in_progress)) {
+ local_irq_save(flags);
+- } else {
+- spin_lock_irqsave(&pinfo->port.lock, flags);
+- }
+-
+- cpm_uart_early_write(pinfo, s, count, true);
+-
+- if (unlikely(nolock)) {
++ cpm_uart_early_write(pinfo, s, count, true);
+ local_irq_restore(flags);
+ } else {
++ spin_lock_irqsave(&pinfo->port.lock, flags);
++ cpm_uart_early_write(pinfo, s, count, true);
+ spin_unlock_irqrestore(&pinfo->port.lock, flags);
+ }
+ }
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index ebea4a9d8e694..d4496a44abdfe 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1166,9 +1166,18 @@ static int sc16is7xx_gpio_direction_output(struct gpio_chip *chip,
+ state |= BIT(offset);
+ else
+ state &= ~BIT(offset);
+- sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
++
++ /*
++ * If we write IOSTATE first, and then IODIR, the output value is not
++ * transferred to the corresponding I/O pin.
++ * The datasheet states that each register bit will be transferred to
++ * the corresponding I/O pin programmed as output when writing to
++ * IOSTATE. Therefore, configure direction first with IODIR, and then
++ * set value after with IOSTATE.
++ */
+ sc16is7xx_port_update(port, SC16IS7XX_IODIR_REG, BIT(offset),
+ BIT(offset));
++ sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
+
+ return 0;
+ }
+@@ -1255,6 +1264,13 @@ static int sc16is7xx_probe(struct device *dev,
+ s->p[i].port.type = PORT_SC16IS7XX;
+ s->p[i].port.fifosize = SC16IS7XX_FIFO_SIZE;
+ s->p[i].port.flags = UPF_FIXED_TYPE | UPF_LOW_LATENCY;
++ s->p[i].port.iobase = i;
++ /*
++ * Use all ones as membase to make sure uart_configure_port() in
++ * serial_core.c does not abort for SPI/I2C devices where the
++ * membase address is not applicable.
++ */
++ s->p[i].port.membase = (void __iomem *)~0;
+ s->p[i].port.iotype = UPIO_PORT;
+ s->p[i].port.uartclk = freq;
+ s->p[i].port.rs485_config = sc16is7xx_config_rs485;
+diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
+index 41fe45f2349ef..a30f7ed123469 100644
+--- a/drivers/tty/serial/serial-tegra.c
++++ b/drivers/tty/serial/serial-tegra.c
+@@ -944,7 +944,11 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup)
+ tup->ier_shadow = 0;
+ tup->current_baud = 0;
+
+- clk_prepare_enable(tup->uart_clk);
++ ret = clk_prepare_enable(tup->uart_clk);
++ if (ret) {
++ dev_err(tup->uport.dev, "could not enable clk\n");
++ return ret;
++ }
+
+ /* Reset the UART controller to clear all previous status.*/
+ reset_control_assert(tup->rst);
+diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
+index 0b7b4d09785b6..4f221ca7aad15 100644
+--- a/drivers/usb/gadget/function/f_mass_storage.c
++++ b/drivers/usb/gadget/function/f_mass_storage.c
+@@ -950,7 +950,7 @@ static void invalidate_sub(struct fsg_lun *curlun)
+ {
+ struct file *filp = curlun->filp;
+ struct inode *inode = file_inode(filp);
+- unsigned long rc;
++ unsigned long __maybe_unused rc;
+
+ rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
+ VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
+diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
+index 2707be6282988..cbd8d6c74c938 100644
+--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
++++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
+@@ -1950,9 +1950,13 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
+ } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
+ /* Get endpoint status */
+ int pipe = index & USB_ENDPOINT_NUMBER_MASK;
+- struct qe_ep *target_ep = &udc->eps[pipe];
++ struct qe_ep *target_ep;
+ u16 usep;
+
++ if (pipe >= USB_MAX_ENDPOINTS)
++ goto stall;
++ target_ep = &udc->eps[pipe];
++
+ /* stall if endpoint doesn't exist */
+ if (!target_ep->ep.desc)
+ goto stall;
+diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
+index e5aa24c1e4fd7..8af2ee3713b6d 100644
+--- a/drivers/usb/phy/phy-mxs-usb.c
++++ b/drivers/usb/phy/phy-mxs-usb.c
+@@ -312,14 +312,8 @@ static void __mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool disconnect)
+
+ static bool mxs_phy_is_otg_host(struct mxs_phy *mxs_phy)
+ {
+- void __iomem *base = mxs_phy->phy.io_priv;
+- u32 phyctrl = readl(base + HW_USBPHY_CTRL);
+-
+- if (IS_ENABLED(CONFIG_USB_OTG) &&
+- !(phyctrl & BM_USBPHY_CTRL_OTG_ID_VALUE))
+- return true;
+-
+- return false;
++ return IS_ENABLED(CONFIG_USB_OTG) &&
++ mxs_phy->phy.last_event == USB_EVENT_ID;
+ }
+
+ static void mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool on)
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index cf68a422e75e4..a4787fcf6ba9c 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -259,6 +259,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_EM05G 0x030a
+ #define QUECTEL_PRODUCT_EM060K 0x030b
+ #define QUECTEL_PRODUCT_EM05G_CS 0x030c
++#define QUECTEL_PRODUCT_EM05GV2 0x030e
+ #define QUECTEL_PRODUCT_EM05CN_SG 0x0310
+ #define QUECTEL_PRODUCT_EM05G_SG 0x0311
+ #define QUECTEL_PRODUCT_EM05CN 0x0312
+@@ -1190,6 +1191,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(6) | ZLP },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff),
+ .driver_info = RSVD(6) | ZLP },
++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05GV2, 0xff),
++ .driver_info = RSVD(4) | ZLP },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff),
+ .driver_info = RSVD(6) | ZLP },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_RS, 0xff),
+@@ -2232,6 +2235,10 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */
+ .driver_info = RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0ee, 0xff), /* Foxconn T99W368 MBIM */
++ .driver_info = RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */
++ .driver_info = RSVD(3) },
+ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */
+ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+ { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */
+diff --git a/drivers/usb/typec/tcpci.c b/drivers/usb/typec/tcpci.c
+index 9f98376d9bef4..d1393371b6b0a 100644
+--- a/drivers/usb/typec/tcpci.c
++++ b/drivers/usb/typec/tcpci.c
+@@ -379,6 +379,10 @@ static int tcpci_init(struct tcpc_dev *tcpc)
+ if (time_after(jiffies, timeout))
+ return -ETIMEDOUT;
+
++ ret = tcpci_write16(tcpci, TCPC_FAULT_STATUS, TCPC_FAULT_STATUS_ALL_REG_RST_TO_DEFAULT);
++ if (ret < 0)
++ return ret;
++
+ /* Handle vendor init */
+ if (tcpci->data->init) {
+ ret = tcpci->data->init(tcpci, tcpci->data);
+diff --git a/drivers/usb/typec/tcpci.h b/drivers/usb/typec/tcpci.h
+index 303ebde265465..dcf60399f161f 100644
+--- a/drivers/usb/typec/tcpci.h
++++ b/drivers/usb/typec/tcpci.h
+@@ -72,6 +72,7 @@
+ #define TCPC_POWER_STATUS_VBUS_PRES BIT(2)
+
+ #define TCPC_FAULT_STATUS 0x1f
++#define TCPC_FAULT_STATUS_ALL_REG_RST_TO_DEFAULT BIT(7)
+
+ #define TCPC_COMMAND 0x23
+ #define TCPC_CMD_WAKE_I2C 0x11
+diff --git a/drivers/video/backlight/bd6107.c b/drivers/video/backlight/bd6107.c
+index fdb2f7e2c6b5d..3eaa250f10de2 100644
+--- a/drivers/video/backlight/bd6107.c
++++ b/drivers/video/backlight/bd6107.c
+@@ -110,7 +110,7 @@ static int bd6107_backlight_check_fb(struct backlight_device *backlight,
+ {
+ struct bd6107 *bd = bl_get_data(backlight);
+
+- return bd->pdata->fbdev == NULL || bd->pdata->fbdev == info->dev;
++ return bd->pdata->fbdev == NULL || bd->pdata->fbdev == info->device;
+ }
+
+ static const struct backlight_ops bd6107_backlight_ops = {
+diff --git a/drivers/video/backlight/gpio_backlight.c b/drivers/video/backlight/gpio_backlight.c
+index 51c49f03ed835..c2b8b6bf4fcb2 100644
+--- a/drivers/video/backlight/gpio_backlight.c
++++ b/drivers/video/backlight/gpio_backlight.c
+@@ -48,7 +48,7 @@ static int gpio_backlight_check_fb(struct backlight_device *bl,
+ {
+ struct gpio_backlight *gbl = bl_get_data(bl);
+
+- return gbl->fbdev == NULL || gbl->fbdev == info->dev;
++ return gbl->fbdev == NULL || gbl->fbdev == info->device;
+ }
+
+ static const struct backlight_ops gpio_backlight_ops = {
+diff --git a/drivers/video/backlight/lv5207lp.c b/drivers/video/backlight/lv5207lp.c
+index 8ab7297b118ae..08aa615cb2a97 100644
+--- a/drivers/video/backlight/lv5207lp.c
++++ b/drivers/video/backlight/lv5207lp.c
+@@ -75,7 +75,7 @@ static int lv5207lp_backlight_check_fb(struct backlight_device *backlight,
+ {
+ struct lv5207lp *lv = bl_get_data(backlight);
+
+- return lv->pdata->fbdev == NULL || lv->pdata->fbdev == info->dev;
++ return lv->pdata->fbdev == NULL || lv->pdata->fbdev == info->device;
+ }
+
+ static const struct backlight_ops lv5207lp_backlight_ops = {
+diff --git a/drivers/video/fbdev/ep93xx-fb.c b/drivers/video/fbdev/ep93xx-fb.c
+index 75f0db25d19fe..e81593a93d23e 100644
+--- a/drivers/video/fbdev/ep93xx-fb.c
++++ b/drivers/video/fbdev/ep93xx-fb.c
+@@ -478,7 +478,6 @@ static int ep93xxfb_probe(struct platform_device *pdev)
+ if (!info)
+ return -ENOMEM;
+
+- info->dev = &pdev->dev;
+ platform_set_drvdata(pdev, info);
+ fbi = info->par;
+ fbi->mach_info = mach_info;
+diff --git a/drivers/watchdog/intel-mid_wdt.c b/drivers/watchdog/intel-mid_wdt.c
+index 72c108a12c19d..0dec3fba02b99 100644
+--- a/drivers/watchdog/intel-mid_wdt.c
++++ b/drivers/watchdog/intel-mid_wdt.c
+@@ -186,3 +186,4 @@ module_platform_driver(mid_wdt_driver);
+ MODULE_AUTHOR("David Cohen <david.a.cohen@linux.intel.com>");
+ MODULE_DESCRIPTION("Watchdog Driver for Intel MID platform");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:intel_mid_wdt");
+diff --git a/fs/attr.c b/fs/attr.c
+index 4d2541c1e68c3..f064f08f51941 100644
+--- a/fs/attr.c
++++ b/fs/attr.c
+@@ -256,9 +256,25 @@ int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **de
+ }
+
+ if ((ia_valid & ATTR_MODE)) {
+- umode_t amode = attr->ia_mode;
++ /*
++ * Don't allow changing the mode of symlinks:
++ *
++ * (1) The vfs doesn't take the mode of symlinks into account
++ * during permission checking.
++ * (2) This has never worked correctly. Most major filesystems
++ * did return EOPNOTSUPP due to interactions with POSIX ACLs
++ * but did still updated the mode of the symlink.
++ * This inconsistency led system call wrapper providers such
++ * as libc to block changing the mode of symlinks with
++ * EOPNOTSUPP already.
++ * (3) To even do this in the first place one would have to use
++ * specific file descriptors and quite some effort.
++ */
++ if (S_ISLNK(inode->i_mode))
++ return -EOPNOTSUPP;
++
+ /* Flag setting protected by i_mutex */
+- if (is_sxid(amode))
++ if (is_sxid(attr->ia_mode))
+ inode->i_flags &= ~S_NOSEC;
+ }
+
+diff --git a/fs/autofs/waitq.c b/fs/autofs/waitq.c
+index f6385c6ef0a56..44ba0cd4ebc4f 100644
+--- a/fs/autofs/waitq.c
++++ b/fs/autofs/waitq.c
+@@ -35,8 +35,9 @@ void autofs_catatonic_mode(struct autofs_sb_info *sbi)
+ wq->status = -ENOENT; /* Magic is gone - report failure */
+ kfree(wq->name.name);
+ wq->name.name = NULL;
+- wq->wait_ctr--;
+ wake_up_interruptible(&wq->queue);
++ if (!--wq->wait_ctr)
++ kfree(wq);
+ wq = nwq;
+ }
+ fput(sbi->pipe); /* Close the pipe */
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index 1fbe2dee1e705..469a90b07d3f0 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -1171,20 +1171,33 @@ static int __btrfs_run_delayed_items(struct btrfs_trans_handle *trans, int nr)
+ ret = __btrfs_commit_inode_delayed_items(trans, path,
+ curr_node);
+ if (ret) {
+- btrfs_release_delayed_node(curr_node);
+- curr_node = NULL;
+ btrfs_abort_transaction(trans, ret);
+ break;
+ }
+
+ prev_node = curr_node;
+ curr_node = btrfs_next_delayed_node(curr_node);
++ /*
++ * See the comment below about releasing path before releasing
++ * node. If the commit of delayed items was successful the path
++ * should always be released, but in case of an error, it may
++ * point to locked extent buffers (a leaf at the very least).
++ */
++ ASSERT(path->nodes[0] == NULL);
+ btrfs_release_delayed_node(prev_node);
+ }
+
++ /*
++ * Release the path to avoid a potential deadlock and lockdep splat when
++ * releasing the delayed node, as that requires taking the delayed node's
++ * mutex. If another task starts running delayed items before we take
++ * the mutex, it will first lock the mutex and then it may try to lock
++ * the same btree path (leaf).
++ */
++ btrfs_free_path(path);
++
+ if (curr_node)
+ btrfs_release_delayed_node(curr_node);
+- btrfs_free_path(path);
+ trans->block_rsv = block_rsv;
+
+ return ret;
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index d71f800e8bf60..bb05b0a82c8ba 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1549,6 +1549,11 @@ again:
+ err = -ENOENT;
+ goto out;
+ } else if (WARN_ON(ret)) {
++ btrfs_print_leaf(path->nodes[0]);
++ btrfs_err(fs_info,
++"extent item not found for insert, bytenr %llu num_bytes %llu parent %llu root_objectid %llu owner %llu offset %llu",
++ bytenr, num_bytes, parent, root_objectid, owner,
++ offset);
+ err = -EIO;
+ goto out;
+ }
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 1f31861453d9f..a34c0436ebb1d 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -200,10 +200,11 @@ loop:
+ spin_unlock(&fs_info->trans_lock);
+
+ /*
+- * If we are ATTACH, we just want to catch the current transaction,
+- * and commit it. If there is no transaction, just return ENOENT.
++ * If we are ATTACH or TRANS_JOIN_NOSTART, we just want to catch the
++ * current transaction, and commit it. If there is no transaction, just
++ * return ENOENT.
+ */
+- if (type == TRANS_ATTACH)
++ if (type == TRANS_ATTACH || type == TRANS_JOIN_NOSTART)
+ return -ENOENT;
+
+ /*
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 52b1524b40cdc..ef1a43f4bd663 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -663,11 +663,6 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
+ struct inode *dir = d_inode(dentry);
+ struct dentry *child;
+
+- if (!dir) {
+- dput(dentry);
+- dentry = ERR_PTR(-ENOENT);
+- break;
+- }
+ if (!S_ISDIR(dir->i_mode)) {
+ dput(dentry);
+ dentry = ERR_PTR(-ENOTDIR);
+@@ -684,7 +679,7 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
+ while (*s && *s != sep)
+ s++;
+
+- child = lookup_one_len_unlocked(p, dentry, s - p);
++ child = lookup_positive_unlocked(p, dentry, s - p);
+ dput(dentry);
+ dentry = child;
+ } while (!IS_ERR(dentry));
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index c07dcb2af2eb8..01ab4496cb897 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -79,6 +79,7 @@ smb2_add_credits(struct TCP_Server_Info *server, const unsigned int add,
+ *val = 65000; /* Don't get near 64K credits, avoid srv bugs */
+ printk_once(KERN_WARNING "server overflowed SMB3 credits\n");
+ }
++ WARN_ON_ONCE(server->in_flight == 0);
+ server->in_flight--;
+ if (server->in_flight == 0 && (optype & CIFS_OP_MASK) != CIFS_NEG_OP)
+ rc = change_conf(server);
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 4661ecaf6741c..1e4ae78f64a8f 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -275,13 +275,9 @@ struct dentry *debugfs_lookup(const char *name, struct dentry *parent)
+ if (!parent)
+ parent = debugfs_mount->mnt_root;
+
+- dentry = lookup_one_len_unlocked(name, parent, strlen(name));
++ dentry = lookup_positive_unlocked(name, parent, strlen(name));
+ if (IS_ERR(dentry))
+ return NULL;
+- if (!d_really_is_positive(dentry)) {
+- dput(dentry);
+- return NULL;
+- }
+ return dentry;
+ }
+ EXPORT_SYMBOL_GPL(debugfs_lookup);
+diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c
+index 0501821182b1e..c6079f6c6a798 100644
+--- a/fs/dlm/plock.c
++++ b/fs/dlm/plock.c
+@@ -469,7 +469,8 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,
+ }
+ } else {
+ list_for_each_entry(iter, &recv_list, list) {
+- if (!iter->info.wait) {
++ if (!iter->info.wait &&
++ iter->info.fsid == info.fsid) {
+ op = iter;
+ break;
+ }
+@@ -481,8 +482,7 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,
+ if (info.wait)
+ WARN_ON(op->info.optype != DLM_PLOCK_OP_LOCK);
+ else
+- WARN_ON(op->info.fsid != info.fsid ||
+- op->info.number != info.number ||
++ WARN_ON(op->info.number != info.number ||
+ op->info.owner != info.owner ||
+ op->info.optype != info.optype);
+
+diff --git a/fs/eventfd.c b/fs/eventfd.c
+index ce1d1711fbbaf..66864100b823c 100644
+--- a/fs/eventfd.c
++++ b/fs/eventfd.c
+@@ -174,11 +174,14 @@ static __poll_t eventfd_poll(struct file *file, poll_table *wait)
+ return events;
+ }
+
+-static void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
++void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
+ {
+- *cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count;
++ lockdep_assert_held(&ctx->wqh.lock);
++
++ *cnt = ((ctx->flags & EFD_SEMAPHORE) && ctx->count) ? 1 : ctx->count;
+ ctx->count -= *cnt;
+ }
++EXPORT_SYMBOL_GPL(eventfd_ctx_do_read);
+
+ /**
+ * eventfd_ctx_remove_wait_queue - Read the current counter and removes wait queue.
+diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
+index bd1d68ff3a9f8..437175bce22e8 100644
+--- a/fs/ext2/xattr.c
++++ b/fs/ext2/xattr.c
+@@ -664,10 +664,10 @@ ext2_xattr_set2(struct inode *inode, struct buffer_head *old_bh,
+ /* We need to allocate a new block */
+ ext2_fsblk_t goal = ext2_group_first_block_no(sb,
+ EXT2_I(inode)->i_block_group);
+- int block = ext2_new_block(inode, goal, &error);
++ ext2_fsblk_t block = ext2_new_block(inode, goal, &error);
+ if (error)
+ goto cleanup;
+- ea_idebug(inode, "creating block %d", block);
++ ea_idebug(inode, "creating block %lu", block);
+
+ new_bh = sb_getblk(sb, block);
+ if (unlikely(!new_bh)) {
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 63ad6b1d575a5..b20fffc8b4c13 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -282,6 +282,7 @@ int dbUnmount(struct inode *ipbmap, int mounterror)
+
+ /* free the memory for the in-memory bmap. */
+ kfree(bmp);
++ JFS_SBI(ipbmap->i_sb)->bmap = NULL;
+
+ return (0);
+ }
+diff --git a/fs/jfs/jfs_extent.c b/fs/jfs/jfs_extent.c
+index 2ae7d59ab10a5..c971e8a6525de 100644
+--- a/fs/jfs/jfs_extent.c
++++ b/fs/jfs/jfs_extent.c
+@@ -521,6 +521,11 @@ extBalloc(struct inode *ip, s64 hint, s64 * nblocks, s64 * blkno)
+ * blocks in the map. in that case, we'll start off with the
+ * maximum free.
+ */
++
++ /* give up if no space left */
++ if (bmp->db_maxfreebud == -1)
++ return -ENOSPC;
++
+ max = (s64) 1 << bmp->db_maxfreebud;
+ if (*nblocks >= max && *nblocks > nbperpage)
+ nb = nblks = (max > nbperpage) ? max : nbperpage;
+diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
+index 93e8c590ff5c0..7565e00e88182 100644
+--- a/fs/jfs/jfs_imap.c
++++ b/fs/jfs/jfs_imap.c
+@@ -208,6 +208,7 @@ int diUnmount(struct inode *ipimap, int mounterror)
+ * free in-memory control structure
+ */
+ kfree(imap);
++ JFS_IP(ipimap)->i_imap = NULL;
+
+ return (0);
+ }
+diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c
+index 0b22c39dad477..b2a126a947e31 100644
+--- a/fs/kernfs/mount.c
++++ b/fs/kernfs/mount.c
+@@ -212,7 +212,7 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn,
+ dput(dentry);
+ return ERR_PTR(-EINVAL);
+ }
+- dtmp = lookup_one_len_unlocked(kntmp->name, dentry,
++ dtmp = lookup_positive_unlocked(kntmp->name, dentry,
+ strlen(kntmp->name));
+ dput(dentry);
+ if (IS_ERR(dtmp))
+diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
+index 654594ef4f945..68a2eac548c3c 100644
+--- a/fs/lockd/mon.c
++++ b/fs/lockd/mon.c
+@@ -275,6 +275,9 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap,
+ {
+ struct nsm_handle *new;
+
++ if (!hostname)
++ return NULL;
++
+ new = kzalloc(sizeof(*new) + hostname_len + 1, GFP_KERNEL);
+ if (unlikely(new == NULL))
+ return NULL;
+diff --git a/fs/namei.c b/fs/namei.c
+index 9e8fca598acc5..60b57e0bc1742 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -2575,6 +2575,26 @@ struct dentry *lookup_one_len_unlocked(const char *name,
+ }
+ EXPORT_SYMBOL(lookup_one_len_unlocked);
+
++/*
++ * Like lookup_one_len_unlocked(), except that it yields ERR_PTR(-ENOENT)
++ * on negatives. Returns known positive or ERR_PTR(); that's what
++ * most of the users want. Note that pinned negative with unlocked parent
++ * _can_ become positive at any time, so callers of lookup_one_len_unlocked()
++ * need to be very careful; pinned positives have ->d_inode stable, so
++ * this one avoids such problems.
++ */
++struct dentry *lookup_positive_unlocked(const char *name,
++ struct dentry *base, int len)
++{
++ struct dentry *ret = lookup_one_len_unlocked(name, base, len);
++ if (!IS_ERR(ret) && d_is_negative(ret)) {
++ dput(ret);
++ ret = ERR_PTR(-ENOENT);
++ }
++ return ret;
++}
++EXPORT_SYMBOL(lookup_positive_unlocked);
++
+ #ifdef CONFIG_UNIX98_PTYS
+ int path_pts(struct path *path)
+ {
+@@ -2593,7 +2613,7 @@ int path_pts(struct path *path)
+ this.name = "pts";
+ this.len = 3;
+ child = d_hash_and_lookup(parent, &this);
+- if (!child)
++ if (IS_ERR_OR_NULL(child))
+ return -ENOENT;
+
+ path->dentry = child;
+diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c
+index dec5880ac6de2..6e3a14fdff9c8 100644
+--- a/fs/nfs/blocklayout/dev.c
++++ b/fs/nfs/blocklayout/dev.c
+@@ -422,7 +422,7 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_block_dev *d,
+ int ret, i;
+
+ d->children = kcalloc(v->concat.volumes_count,
+- sizeof(struct pnfs_block_dev), GFP_KERNEL);
++ sizeof(struct pnfs_block_dev), gfp_mask);
+ if (!d->children)
+ return -ENOMEM;
+
+@@ -451,7 +451,7 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_block_dev *d,
+ int ret, i;
+
+ d->children = kcalloc(v->stripe.volumes_count,
+- sizeof(struct pnfs_block_dev), GFP_KERNEL);
++ sizeof(struct pnfs_block_dev), gfp_mask);
+ if (!d->children)
+ return -ENOMEM;
+
+diff --git a/fs/nfs/pnfs_dev.c b/fs/nfs/pnfs_dev.c
+index e8a07b3f9aaaf..ba67906d6b2c0 100644
+--- a/fs/nfs/pnfs_dev.c
++++ b/fs/nfs/pnfs_dev.c
+@@ -152,7 +152,7 @@ nfs4_get_device_info(struct nfs_server *server,
+ set_bit(NFS_DEVICEID_NOCACHE, &d->flags);
+
+ out_free_pages:
+- for (i = 0; i < max_pages; i++)
++ while (--i >= 0)
+ __free_page(pages[i]);
+ kfree(pages);
+ out_free_pdev:
+diff --git a/fs/nfsd/blocklayoutxdr.c b/fs/nfsd/blocklayoutxdr.c
+index 442543304930b..2455dc8be18a8 100644
+--- a/fs/nfsd/blocklayoutxdr.c
++++ b/fs/nfsd/blocklayoutxdr.c
+@@ -82,6 +82,15 @@ nfsd4_block_encode_getdeviceinfo(struct xdr_stream *xdr,
+ int len = sizeof(__be32), ret, i;
+ __be32 *p;
+
++ /*
++ * See paragraph 5 of RFC 8881 S18.40.3.
++ */
++ if (!gdp->gd_maxcount) {
++ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT)
++ return nfserr_resource;
++ return nfs_ok;
++ }
++
+ p = xdr_reserve_space(xdr, len + sizeof(__be32));
+ if (!p)
+ return nfserr_resource;
+diff --git a/fs/nfsd/flexfilelayoutxdr.c b/fs/nfsd/flexfilelayoutxdr.c
+index e81d2a5cf381e..bb205328e043d 100644
+--- a/fs/nfsd/flexfilelayoutxdr.c
++++ b/fs/nfsd/flexfilelayoutxdr.c
+@@ -85,6 +85,15 @@ nfsd4_ff_encode_getdeviceinfo(struct xdr_stream *xdr,
+ int addr_len;
+ __be32 *p;
+
++ /*
++ * See paragraph 5 of RFC 8881 S18.40.3.
++ */
++ if (!gdp->gd_maxcount) {
++ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT)
++ return nfserr_resource;
++ return nfs_ok;
++ }
++
+ /* len + padding for two strings */
+ addr_len = 16 + da->netaddr.netid_len + da->netaddr.addr_len;
+ ver_len = 20;
+diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
+index b90bea1c434eb..9f537decdd9c7 100644
+--- a/fs/nfsd/nfs3xdr.c
++++ b/fs/nfsd/nfs3xdr.c
+@@ -855,13 +855,11 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
+ } else
+ dchild = dget(dparent);
+ } else
+- dchild = lookup_one_len_unlocked(name, dparent, namlen);
++ dchild = lookup_positive_unlocked(name, dparent, namlen);
+ if (IS_ERR(dchild))
+ return rv;
+ if (d_mountpoint(dchild))
+ goto out;
+- if (d_really_is_negative(dchild))
+- goto out;
+ if (dchild->d_inode->i_ino != ino)
+ goto out;
+ rv = fh_compose(fhp, exp, dchild, &cd->fh);
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index a696a9b907865..5ec90b252b6a5 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -870,8 +870,8 @@ nfsd4_rename(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ rename->rn_tname, rename->rn_tnamelen);
+ if (status)
+ return status;
+- set_change_info(&rename->rn_sinfo, &cstate->current_fh);
+- set_change_info(&rename->rn_tinfo, &cstate->save_fh);
++ set_change_info(&rename->rn_sinfo, &cstate->save_fh);
++ set_change_info(&rename->rn_tinfo, &cstate->current_fh);
+ return nfs_ok;
+ }
+
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 74ab20c89e752..33827cdd8066f 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -2984,18 +2984,9 @@ nfsd4_encode_dirent_fattr(struct xdr_stream *xdr, struct nfsd4_readdir *cd,
+ __be32 nfserr;
+ int ignore_crossmnt = 0;
+
+- dentry = lookup_one_len_unlocked(name, cd->rd_fhp->fh_dentry, namlen);
++ dentry = lookup_positive_unlocked(name, cd->rd_fhp->fh_dentry, namlen);
+ if (IS_ERR(dentry))
+ return nfserrno(PTR_ERR(dentry));
+- if (d_really_is_negative(dentry)) {
+- /*
+- * we're not holding the i_mutex here, so there's
+- * a window where this directory entry could have gone
+- * away.
+- */
+- dput(dentry);
+- return nfserr_noent;
+- }
+
+ exp_get(exp);
+ /*
+@@ -4135,20 +4126,17 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
+
+ *p++ = cpu_to_be32(gdev->gd_layout_type);
+
+- /* If maxcount is 0 then just update notifications */
+- if (gdev->gd_maxcount != 0) {
+- ops = nfsd4_layout_ops[gdev->gd_layout_type];
+- nfserr = ops->encode_getdeviceinfo(xdr, gdev);
+- if (nfserr) {
+- /*
+- * We don't bother to burden the layout drivers with
+- * enforcing gd_maxcount, just tell the client to
+- * come back with a bigger buffer if it's not enough.
+- */
+- if (xdr->buf->len + 4 > gdev->gd_maxcount)
+- goto toosmall;
+- return nfserr;
+- }
++ ops = nfsd4_layout_ops[gdev->gd_layout_type];
++ nfserr = ops->encode_getdeviceinfo(xdr, gdev);
++ if (nfserr) {
++ /*
++ * We don't bother to burden the layout drivers with
++ * enforcing gd_maxcount, just tell the client to
++ * come back with a bigger buffer if it's not enough.
++ */
++ if (xdr->buf->len + 4 > gdev->gd_maxcount)
++ goto toosmall;
++ return nfserr;
+ }
+
+ if (gdev->gd_notify_types) {
+diff --git a/fs/nilfs2/alloc.c b/fs/nilfs2/alloc.c
+index 235b959fc2b3a..bbd82f650e93e 100644
+--- a/fs/nilfs2/alloc.c
++++ b/fs/nilfs2/alloc.c
+@@ -205,7 +205,8 @@ static int nilfs_palloc_get_block(struct inode *inode, unsigned long blkoff,
+ int ret;
+
+ spin_lock(lock);
+- if (prev->bh && blkoff == prev->blkoff) {
++ if (prev->bh && blkoff == prev->blkoff &&
++ likely(buffer_uptodate(prev->bh))) {
+ get_bh(prev->bh);
+ *bhp = prev->bh;
+ spin_unlock(lock);
+diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
+index 4eed9500f33a7..ea94dc21af0c9 100644
+--- a/fs/nilfs2/inode.c
++++ b/fs/nilfs2/inode.c
+@@ -1036,7 +1036,7 @@ int nilfs_load_inode_block(struct inode *inode, struct buffer_head **pbh)
+ int err;
+
+ spin_lock(&nilfs->ns_inode_lock);
+- if (ii->i_bh == NULL) {
++ if (ii->i_bh == NULL || unlikely(!buffer_uptodate(ii->i_bh))) {
+ spin_unlock(&nilfs->ns_inode_lock);
+ err = nilfs_ifile_get_inode_block(ii->i_root->ifile,
+ inode->i_ino, pbh);
+@@ -1045,7 +1045,10 @@ int nilfs_load_inode_block(struct inode *inode, struct buffer_head **pbh)
+ spin_lock(&nilfs->ns_inode_lock);
+ if (ii->i_bh == NULL)
+ ii->i_bh = *pbh;
+- else {
++ else if (unlikely(!buffer_uptodate(ii->i_bh))) {
++ __brelse(ii->i_bh);
++ ii->i_bh = *pbh;
++ } else {
+ brelse(*pbh);
+ *pbh = ii->i_bh;
+ }
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index 04e1e671b6134..fdcbed6ee8326 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -730,6 +730,11 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode,
+ struct page *page = pvec.pages[i];
+
+ lock_page(page);
++ if (unlikely(page->mapping != mapping)) {
++ /* Exclude pages removed from the address space */
++ unlock_page(page);
++ continue;
++ }
+ if (!page_has_buffers(page))
+ create_empty_buffers(page, i_blocksize(inode), 0);
+ unlock_page(page);
+diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c
+index 52ccd34b1e792..a026dbd3593f6 100644
+--- a/fs/nls/nls_base.c
++++ b/fs/nls/nls_base.c
+@@ -272,7 +272,7 @@ int unregister_nls(struct nls_table * nls)
+ return -EINVAL;
+ }
+
+-static struct nls_table *find_nls(char *charset)
++static struct nls_table *find_nls(const char *charset)
+ {
+ struct nls_table *nls;
+ spin_lock(&nls_lock);
+@@ -288,7 +288,7 @@ static struct nls_table *find_nls(char *charset)
+ return nls;
+ }
+
+-struct nls_table *load_nls(char *charset)
++struct nls_table *load_nls(const char *charset)
+ {
+ return try_then_request_module(find_nls(charset), "nls_%s", charset);
+ }
+diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
+index bd8d742adf65a..bb8483510327f 100644
+--- a/fs/ocfs2/namei.c
++++ b/fs/ocfs2/namei.c
+@@ -1538,6 +1538,10 @@ static int ocfs2_rename(struct inode *old_dir,
+ status = ocfs2_add_entry(handle, new_dentry, old_inode,
+ OCFS2_I(old_inode)->ip_blkno,
+ new_dir_bh, &target_insert);
++ if (status < 0) {
++ mlog_errno(status);
++ goto bail;
++ }
+ }
+
+ old_inode->i_ctime = current_time(old_inode);
+diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
+index badf039267a2f..e51dc7f16596c 100644
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -203,7 +203,7 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
+ int err;
+ bool last_element = !post[0];
+
+- this = lookup_one_len_unlocked(name, base, namelen);
++ this = lookup_positive_unlocked(name, base, namelen);
+ if (IS_ERR(this)) {
+ err = PTR_ERR(this);
+ this = NULL;
+@@ -211,8 +211,6 @@ static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
+ goto out;
+ goto out_err;
+ }
+- if (!this->d_inode)
+- goto put_and_out;
+
+ if (ovl_dentry_weird(this)) {
+ /* Don't support traversing automounts and other weirdness */
+@@ -654,7 +652,7 @@ struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh)
+ if (err)
+ return ERR_PTR(err);
+
+- index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len);
++ index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len);
+ kfree(name.name);
+ if (IS_ERR(index)) {
+ if (PTR_ERR(index) == -ENOENT)
+@@ -662,9 +660,7 @@ struct dentry *ovl_get_index_fh(struct ovl_fs *ofs, struct ovl_fh *fh)
+ return index;
+ }
+
+- if (d_is_negative(index))
+- err = 0;
+- else if (ovl_is_whiteout(index))
++ if (ovl_is_whiteout(index))
+ err = -ESTALE;
+ else if (ovl_dentry_weird(index))
+ err = -EIO;
+@@ -688,7 +684,7 @@ struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper,
+ if (err)
+ return ERR_PTR(err);
+
+- index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len);
++ index = lookup_positive_unlocked(name.name, ofs->indexdir, name.len);
+ if (IS_ERR(index)) {
+ err = PTR_ERR(index);
+ if (err == -ENOENT) {
+@@ -703,9 +699,7 @@ struct dentry *ovl_lookup_index(struct ovl_fs *ofs, struct dentry *upper,
+ }
+
+ inode = d_inode(index);
+- if (d_is_negative(index)) {
+- goto out_dput;
+- } else if (ovl_is_whiteout(index) && !verify) {
++ if (ovl_is_whiteout(index) && !verify) {
+ /*
+ * When index lookup is called with !verify for decoding an
+ * overlay file handle, a whiteout index implies that decode
+@@ -1134,7 +1128,7 @@ bool ovl_lower_positive(struct dentry *dentry)
+ struct dentry *this;
+ struct dentry *lowerdir = poe->lowerstack[i].dentry;
+
+- this = lookup_one_len_unlocked(name->name, lowerdir,
++ this = lookup_positive_unlocked(name->name, lowerdir,
+ name->len);
+ if (IS_ERR(this)) {
+ switch (PTR_ERR(this)) {
+@@ -1151,10 +1145,8 @@ bool ovl_lower_positive(struct dentry *dentry)
+ break;
+ }
+ } else {
+- if (this->d_inode) {
+- positive = !ovl_is_whiteout(this);
+- done = true;
+- }
++ positive = !ovl_is_whiteout(this);
++ done = true;
+ dput(this);
+ }
+ }
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index e3f10c110b74e..69f48794b5509 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -3338,7 +3338,8 @@ static int proc_tid_comm_permission(struct inode *inode, int mask)
+ }
+
+ static const struct inode_operations proc_tid_comm_inode_operations = {
+- .permission = proc_tid_comm_permission,
++ .setattr = proc_setattr,
++ .permission = proc_tid_comm_permission,
+ };
+
+ /*
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 60dff71804120..efb765b8466f8 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -500,7 +500,7 @@ static int persistent_ram_post_init(struct persistent_ram_zone *prz, u32 sig,
+ sig ^= PERSISTENT_RAM_SIG;
+
+ if (prz->buffer->sig == sig) {
+- if (buffer_size(prz) == 0) {
++ if (buffer_size(prz) == 0 && buffer_start(prz) == 0) {
+ pr_debug("found existing empty buffer\n");
+ return 0;
+ }
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 303987d29b9c9..25bd1fdaebac3 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -223,19 +223,33 @@ static void put_quota_format(struct quota_format_type *fmt)
+
+ /*
+ * Dquot List Management:
+- * The quota code uses three lists for dquot management: the inuse_list,
+- * free_dquots, and dquot_hash[] array. A single dquot structure may be
+- * on all three lists, depending on its current state.
++ * The quota code uses five lists for dquot management: the inuse_list,
++ * releasing_dquots, free_dquots, dqi_dirty_list, and dquot_hash[] array.
++ * A single dquot structure may be on some of those lists, depending on
++ * its current state.
+ *
+ * All dquots are placed to the end of inuse_list when first created, and this
+ * list is used for invalidate operation, which must look at every dquot.
+ *
++ * When the last reference of a dquot will be dropped, the dquot will be
++ * added to releasing_dquots. We'd then queue work item which would call
++ * synchronize_srcu() and after that perform the final cleanup of all the
++ * dquots on the list. Both releasing_dquots and free_dquots use the
++ * dq_free list_head in the dquot struct. When a dquot is removed from
++ * releasing_dquots, a reference count is always subtracted, and if
++ * dq_count == 0 at that point, the dquot will be added to the free_dquots.
++ *
+ * Unused dquots (dq_count == 0) are added to the free_dquots list when freed,
+ * and this list is searched whenever we need an available dquot. Dquots are
+ * removed from the list as soon as they are used again, and
+ * dqstats.free_dquots gives the number of dquots on the list. When
+ * dquot is invalidated it's completely released from memory.
+ *
++ * Dirty dquots are added to the dqi_dirty_list of quota_info when mark
++ * dirtied, and this list is searched when writing dirty dquots back to
++ * quota file. Note that some filesystems do dirty dquot tracking on their
++ * own (e.g. in a journal) and thus don't use dqi_dirty_list.
++ *
+ * Dquots with a specific identity (device, type and id) are placed on
+ * one of the dquot_hash[] hash chains. The provides an efficient search
+ * mechanism to locate a specific dquot.
+@@ -243,6 +257,7 @@ static void put_quota_format(struct quota_format_type *fmt)
+
+ static LIST_HEAD(inuse_list);
+ static LIST_HEAD(free_dquots);
++static LIST_HEAD(releasing_dquots);
+ static unsigned int dq_hash_bits, dq_hash_mask;
+ static struct hlist_head *dquot_hash;
+
+@@ -253,6 +268,9 @@ static qsize_t inode_get_rsv_space(struct inode *inode);
+ static qsize_t __inode_get_rsv_space(struct inode *inode);
+ static int __dquot_initialize(struct inode *inode, int type);
+
++static void quota_release_workfn(struct work_struct *work);
++static DECLARE_DELAYED_WORK(quota_release_work, quota_release_workfn);
++
+ static inline unsigned int
+ hashfn(const struct super_block *sb, struct kqid qid)
+ {
+@@ -300,12 +318,18 @@ static inline void put_dquot_last(struct dquot *dquot)
+ dqstats_inc(DQST_FREE_DQUOTS);
+ }
+
++static inline void put_releasing_dquots(struct dquot *dquot)
++{
++ list_add_tail(&dquot->dq_free, &releasing_dquots);
++}
++
+ static inline void remove_free_dquot(struct dquot *dquot)
+ {
+ if (list_empty(&dquot->dq_free))
+ return;
+ list_del_init(&dquot->dq_free);
+- dqstats_dec(DQST_FREE_DQUOTS);
++ if (!atomic_read(&dquot->dq_count))
++ dqstats_dec(DQST_FREE_DQUOTS);
+ }
+
+ static inline void put_inuse(struct dquot *dquot)
+@@ -331,6 +355,11 @@ static void wait_on_dquot(struct dquot *dquot)
+ mutex_unlock(&dquot->dq_lock);
+ }
+
++static inline int dquot_active(struct dquot *dquot)
++{
++ return test_bit(DQ_ACTIVE_B, &dquot->dq_flags);
++}
++
+ static inline int dquot_dirty(struct dquot *dquot)
+ {
+ return test_bit(DQ_MOD_B, &dquot->dq_flags);
+@@ -346,14 +375,14 @@ int dquot_mark_dquot_dirty(struct dquot *dquot)
+ {
+ int ret = 1;
+
+- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
++ if (!dquot_active(dquot))
+ return 0;
+
+ if (sb_dqopt(dquot->dq_sb)->flags & DQUOT_NOLIST_DIRTY)
+ return test_and_set_bit(DQ_MOD_B, &dquot->dq_flags);
+
+ /* If quota is dirty already, we don't have to acquire dq_list_lock */
+- if (test_bit(DQ_MOD_B, &dquot->dq_flags))
++ if (dquot_dirty(dquot))
+ return 1;
+
+ spin_lock(&dq_list_lock);
+@@ -432,7 +461,7 @@ int dquot_acquire(struct dquot *dquot)
+ smp_mb__before_atomic();
+ set_bit(DQ_READ_B, &dquot->dq_flags);
+ /* Instantiate dquot if needed */
+- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags) && !dquot->dq_off) {
++ if (!dquot_active(dquot) && !dquot->dq_off) {
+ ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot);
+ /* Write the info if needed */
+ if (info_dirty(&dqopt->info[dquot->dq_id.type])) {
+@@ -471,7 +500,7 @@ int dquot_commit(struct dquot *dquot)
+ goto out_lock;
+ /* Inactive dquot can be only if there was error during read/init
+ * => we have better not writing it */
+- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
++ if (dquot_active(dquot))
+ ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot);
+ else
+ ret = -EIO;
+@@ -532,6 +561,8 @@ static void invalidate_dquots(struct super_block *sb, int type)
+ struct dquot *dquot, *tmp;
+
+ restart:
++ flush_delayed_work("a_release_work);
++
+ spin_lock(&dq_list_lock);
+ list_for_each_entry_safe(dquot, tmp, &inuse_list, dq_inuse) {
+ if (dquot->dq_sb != sb)
+@@ -540,6 +571,12 @@ restart:
+ continue;
+ /* Wait for dquot users */
+ if (atomic_read(&dquot->dq_count)) {
++ /* dquot in releasing_dquots, flush and retry */
++ if (!list_empty(&dquot->dq_free)) {
++ spin_unlock(&dq_list_lock);
++ goto restart;
++ }
++
+ atomic_inc(&dquot->dq_count);
+ spin_unlock(&dq_list_lock);
+ /*
+@@ -582,14 +619,13 @@ int dquot_scan_active(struct super_block *sb,
+
+ spin_lock(&dq_list_lock);
+ list_for_each_entry(dquot, &inuse_list, dq_inuse) {
+- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
++ if (!dquot_active(dquot))
+ continue;
+ if (dquot->dq_sb != sb)
+ continue;
+ /* Now we have active dquot so we can just increase use count */
+ atomic_inc(&dquot->dq_count);
+ spin_unlock(&dq_list_lock);
+- dqstats_inc(DQST_LOOKUPS);
+ dqput(old_dquot);
+ old_dquot = dquot;
+ /*
+@@ -598,7 +634,7 @@ int dquot_scan_active(struct super_block *sb,
+ * outstanding call and recheck the DQ_ACTIVE_B after that.
+ */
+ wait_on_dquot(dquot);
+- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
++ if (dquot_active(dquot)) {
+ ret = fn(dquot, priv);
+ if (ret < 0)
+ goto out;
+@@ -614,6 +650,18 @@ out:
+ }
+ EXPORT_SYMBOL(dquot_scan_active);
+
++static inline int dquot_write_dquot(struct dquot *dquot)
++{
++ int ret = dquot->dq_sb->dq_op->write_dquot(dquot);
++ if (ret < 0) {
++ quota_error(dquot->dq_sb, "Can't write quota structure "
++ "(error %d). Quota may get out of sync!", ret);
++ /* Clear dirty bit anyway to avoid infinite loop. */
++ clear_dquot_dirty(dquot);
++ }
++ return ret;
++}
++
+ /* Write all dquot structures to quota files */
+ int dquot_writeback_dquots(struct super_block *sb, int type)
+ {
+@@ -637,24 +685,16 @@ int dquot_writeback_dquots(struct super_block *sb, int type)
+ dquot = list_first_entry(&dirty, struct dquot,
+ dq_dirty);
+
+- WARN_ON(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags));
++ WARN_ON(!dquot_active(dquot));
+
+ /* Now we have active dquot from which someone is
+ * holding reference so we can safely just increase
+ * use count */
+ dqgrab(dquot);
+ spin_unlock(&dq_list_lock);
+- dqstats_inc(DQST_LOOKUPS);
+- err = sb->dq_op->write_dquot(dquot);
+- if (err) {
+- /*
+- * Clear dirty bit anyway to avoid infinite
+- * loop here.
+- */
+- clear_dquot_dirty(dquot);
+- if (!ret)
+- ret = err;
+- }
++ err = dquot_write_dquot(dquot);
++ if (err && !ret)
++ ret = err;
+ dqput(dquot);
+ spin_lock(&dq_list_lock);
+ }
+@@ -747,13 +787,54 @@ static struct shrinker dqcache_shrinker = {
+ .seeks = DEFAULT_SEEKS,
+ };
+
++/*
++ * Safely release dquot and put reference to dquot.
++ */
++static void quota_release_workfn(struct work_struct *work)
++{
++ struct dquot *dquot;
++ struct list_head rls_head;
++
++ spin_lock(&dq_list_lock);
++ /* Exchange the list head to avoid livelock. */
++ list_replace_init(&releasing_dquots, &rls_head);
++ spin_unlock(&dq_list_lock);
++
++restart:
++ synchronize_srcu(&dquot_srcu);
++ spin_lock(&dq_list_lock);
++ while (!list_empty(&rls_head)) {
++ dquot = list_first_entry(&rls_head, struct dquot, dq_free);
++ /* Dquot got used again? */
++ if (atomic_read(&dquot->dq_count) > 1) {
++ remove_free_dquot(dquot);
++ atomic_dec(&dquot->dq_count);
++ continue;
++ }
++ if (dquot_dirty(dquot)) {
++ spin_unlock(&dq_list_lock);
++ /* Commit dquot before releasing */
++ dquot_write_dquot(dquot);
++ goto restart;
++ }
++ if (dquot_active(dquot)) {
++ spin_unlock(&dq_list_lock);
++ dquot->dq_sb->dq_op->release_dquot(dquot);
++ goto restart;
++ }
++ /* Dquot is inactive and clean, now move it to free list */
++ remove_free_dquot(dquot);
++ atomic_dec(&dquot->dq_count);
++ put_dquot_last(dquot);
++ }
++ spin_unlock(&dq_list_lock);
++}
++
+ /*
+ * Put reference to dquot
+ */
+ void dqput(struct dquot *dquot)
+ {
+- int ret;
+-
+ if (!dquot)
+ return;
+ #ifdef CONFIG_QUOTA_DEBUG
+@@ -765,7 +846,7 @@ void dqput(struct dquot *dquot)
+ }
+ #endif
+ dqstats_inc(DQST_DROPS);
+-we_slept:
++
+ spin_lock(&dq_list_lock);
+ if (atomic_read(&dquot->dq_count) > 1) {
+ /* We have more than one user... nothing to do */
+@@ -777,35 +858,15 @@ we_slept:
+ spin_unlock(&dq_list_lock);
+ return;
+ }
++
+ /* Need to release dquot? */
+- if (dquot_dirty(dquot)) {
+- spin_unlock(&dq_list_lock);
+- /* Commit dquot before releasing */
+- ret = dquot->dq_sb->dq_op->write_dquot(dquot);
+- if (ret < 0) {
+- quota_error(dquot->dq_sb, "Can't write quota structure"
+- " (error %d). Quota may get out of sync!",
+- ret);
+- /*
+- * We clear dirty bit anyway, so that we avoid
+- * infinite loop here
+- */
+- clear_dquot_dirty(dquot);
+- }
+- goto we_slept;
+- }
+- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
+- spin_unlock(&dq_list_lock);
+- dquot->dq_sb->dq_op->release_dquot(dquot);
+- goto we_slept;
+- }
+- atomic_dec(&dquot->dq_count);
+ #ifdef CONFIG_QUOTA_DEBUG
+ /* sanity check */
+ BUG_ON(!list_empty(&dquot->dq_free));
+ #endif
+- put_dquot_last(dquot);
++ put_releasing_dquots(dquot);
+ spin_unlock(&dq_list_lock);
++ queue_delayed_work(system_unbound_wq, "a_release_work, 1);
+ }
+ EXPORT_SYMBOL(dqput);
+
+@@ -895,7 +956,7 @@ we_slept:
+ * already finished or it will be canceled due to dq_count > 1 test */
+ wait_on_dquot(dquot);
+ /* Read the dquot / allocate space in quota file */
+- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
++ if (!dquot_active(dquot)) {
+ int err;
+
+ err = sb->dq_op->acquire_dquot(dquot);
+@@ -1408,7 +1469,7 @@ static int info_bdq_free(struct dquot *dquot, qsize_t space)
+ return QUOTA_NL_NOWARN;
+ }
+
+-static int dquot_active(const struct inode *inode)
++static int inode_quota_active(const struct inode *inode)
+ {
+ struct super_block *sb = inode->i_sb;
+
+@@ -1431,7 +1492,7 @@ static int __dquot_initialize(struct inode *inode, int type)
+ qsize_t rsv;
+ int ret = 0;
+
+- if (!dquot_active(inode))
++ if (!inode_quota_active(inode))
+ return 0;
+
+ dquots = i_dquot(inode);
+@@ -1539,7 +1600,7 @@ bool dquot_initialize_needed(struct inode *inode)
+ struct dquot **dquots;
+ int i;
+
+- if (!dquot_active(inode))
++ if (!inode_quota_active(inode))
+ return false;
+
+ dquots = i_dquot(inode);
+@@ -1650,7 +1711,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
+ int reserve = flags & DQUOT_SPACE_RESERVE;
+ struct dquot **dquots;
+
+- if (!dquot_active(inode)) {
++ if (!inode_quota_active(inode)) {
+ if (reserve) {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) += number;
+@@ -1722,7 +1783,7 @@ int dquot_alloc_inode(struct inode *inode)
+ struct dquot_warn warn[MAXQUOTAS];
+ struct dquot * const *dquots;
+
+- if (!dquot_active(inode))
++ if (!inode_quota_active(inode))
+ return 0;
+ for (cnt = 0; cnt < MAXQUOTAS; cnt++)
+ warn[cnt].w_type = QUOTA_NL_NOWARN;
+@@ -1765,7 +1826,7 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
+ struct dquot **dquots;
+ int cnt, index;
+
+- if (!dquot_active(inode)) {
++ if (!inode_quota_active(inode)) {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) -= number;
+ __inode_add_bytes(inode, number);
+@@ -1807,7 +1868,7 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)
+ struct dquot **dquots;
+ int cnt, index;
+
+- if (!dquot_active(inode)) {
++ if (!inode_quota_active(inode)) {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) += number;
+ __inode_sub_bytes(inode, number);
+@@ -1851,7 +1912,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags)
+ struct dquot **dquots;
+ int reserve = flags & DQUOT_SPACE_RESERVE, index;
+
+- if (!dquot_active(inode)) {
++ if (!inode_quota_active(inode)) {
+ if (reserve) {
+ spin_lock(&inode->i_lock);
+ *inode_reserved_space(inode) -= number;
+@@ -1906,7 +1967,7 @@ void dquot_free_inode(struct inode *inode)
+ struct dquot * const *dquots;
+ int index;
+
+- if (!dquot_active(inode))
++ if (!inode_quota_active(inode))
+ return;
+
+ dquots = i_dquot(inode);
+@@ -2077,7 +2138,7 @@ int dquot_transfer(struct inode *inode, struct iattr *iattr)
+ struct super_block *sb = inode->i_sb;
+ int ret;
+
+- if (!dquot_active(inode))
++ if (!inode_quota_active(inode))
+ return 0;
+
+ if (iattr->ia_valid & ATTR_UID && !uid_eq(iattr->ia_uid, inode->i_uid)){
+@@ -2535,21 +2596,15 @@ int dquot_quota_on_mount(struct super_block *sb, char *qf_name,
+ struct dentry *dentry;
+ int error;
+
+- dentry = lookup_one_len_unlocked(qf_name, sb->s_root, strlen(qf_name));
++ dentry = lookup_positive_unlocked(qf_name, sb->s_root, strlen(qf_name));
+ if (IS_ERR(dentry))
+ return PTR_ERR(dentry);
+
+- if (d_really_is_negative(dentry)) {
+- error = -ENOENT;
+- goto out;
+- }
+-
+ error = security_quota_on(dentry);
+ if (!error)
+ error = vfs_load_quota_inode(d_inode(dentry), type, format_id,
+ DQUOT_USAGE_ENABLED | DQUOT_LIMITS_ENABLED);
+
+-out:
+ dput(dentry);
+ return error;
+ }
+diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
+index 78be6dbcd7627..3425a04bc8a01 100644
+--- a/fs/reiserfs/journal.c
++++ b/fs/reiserfs/journal.c
+@@ -2336,7 +2336,7 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
+ int i, j;
+
+ bh = __getblk(dev, block, bufsize);
+- if (buffer_uptodate(bh))
++ if (!bh || buffer_uptodate(bh))
+ return (bh);
+
+ if (block + BUFNR > max_block) {
+@@ -2346,6 +2346,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
+ j = 1;
+ for (i = 1; i < blocks; i++) {
+ bh = __getblk(dev, block + i, bufsize);
++ if (!bh)
++ break;
+ if (buffer_uptodate(bh)) {
+ brelse(bh);
+ break;
+diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
+index 4c0307f378d72..0dc98bbad9c46 100644
+--- a/fs/udf/balloc.c
++++ b/fs/udf/balloc.c
+@@ -36,18 +36,41 @@ static int read_block_bitmap(struct super_block *sb,
+ unsigned long bitmap_nr)
+ {
+ struct buffer_head *bh = NULL;
+- int retval = 0;
++ int i;
++ int max_bits, off, count;
+ struct kernel_lb_addr loc;
+
+ loc.logicalBlockNum = bitmap->s_extPosition;
+ loc.partitionReferenceNum = UDF_SB(sb)->s_partition;
+
+ bh = udf_tread(sb, udf_get_lb_pblock(sb, &loc, block));
++ bitmap->s_block_bitmap[bitmap_nr] = bh;
+ if (!bh)
+- retval = -EIO;
++ return -EIO;
+
+- bitmap->s_block_bitmap[bitmap_nr] = bh;
+- return retval;
++ /* Check consistency of Space Bitmap buffer. */
++ max_bits = sb->s_blocksize * 8;
++ if (!bitmap_nr) {
++ off = sizeof(struct spaceBitmapDesc) << 3;
++ count = min(max_bits - off, bitmap->s_nr_groups);
++ } else {
++ /*
++ * Rough check if bitmap number is too big to have any bitmap
++ * blocks reserved.
++ */
++ if (bitmap_nr >
++ (bitmap->s_nr_groups >> (sb->s_blocksize_bits + 3)) + 2)
++ return 0;
++ off = 0;
++ count = bitmap->s_nr_groups - bitmap_nr * max_bits +
++ (sizeof(struct spaceBitmapDesc) << 3);
++ count = min(count, max_bits);
++ }
++
++ for (i = 0; i < count; i++)
++ if (udf_test_bit(i + off, bh->b_data))
++ return -EFSCORRUPTED;
++ return 0;
+ }
+
+ static int __load_block_bitmap(struct super_block *sb,
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 77421e65623a1..08d7208eb7b75 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -50,15 +50,15 @@ static int udf_update_inode(struct inode *, int);
+ static int udf_sync_inode(struct inode *inode);
+ static int udf_alloc_i_data(struct inode *inode, size_t size);
+ static sector_t inode_getblk(struct inode *, sector_t, int *, int *);
+-static int8_t udf_insert_aext(struct inode *, struct extent_position,
+- struct kernel_lb_addr, uint32_t);
++static int udf_insert_aext(struct inode *, struct extent_position,
++ struct kernel_lb_addr, uint32_t);
+ static void udf_split_extents(struct inode *, int *, int, udf_pblk_t,
+ struct kernel_long_ad *, int *);
+ static void udf_prealloc_extents(struct inode *, int, int,
+ struct kernel_long_ad *, int *);
+ static void udf_merge_extents(struct inode *, struct kernel_long_ad *, int *);
+-static void udf_update_extents(struct inode *, struct kernel_long_ad *, int,
+- int, struct extent_position *);
++static int udf_update_extents(struct inode *, struct kernel_long_ad *, int,
++ int, struct extent_position *);
+ static int udf_get_block(struct inode *, sector_t, struct buffer_head *, int);
+
+ static void __udf_clear_extent_cache(struct inode *inode)
+@@ -689,7 +689,7 @@ static sector_t inode_getblk(struct inode *inode, sector_t block,
+ struct kernel_lb_addr eloc, tmpeloc;
+ int c = 1;
+ loff_t lbcount = 0, b_off = 0;
+- udf_pblk_t newblocknum, newblock;
++ udf_pblk_t newblocknum, newblock = 0;
+ sector_t offset = 0;
+ int8_t etype;
+ struct udf_inode_info *iinfo = UDF_I(inode);
+@@ -792,7 +792,6 @@ static sector_t inode_getblk(struct inode *inode, sector_t block,
+ ret = udf_do_extend_file(inode, &prev_epos, laarr, hole_len);
+ if (ret < 0) {
+ *err = ret;
+- newblock = 0;
+ goto out_free;
+ }
+ c = 0;
+@@ -855,7 +854,6 @@ static sector_t inode_getblk(struct inode *inode, sector_t block,
+ goal, err);
+ if (!newblocknum) {
+ *err = -ENOSPC;
+- newblock = 0;
+ goto out_free;
+ }
+ if (isBeyondEOF)
+@@ -881,7 +879,9 @@ static sector_t inode_getblk(struct inode *inode, sector_t block,
+ /* write back the new extents, inserting new extents if the new number
+ * of extents is greater than the old number, and deleting extents if
+ * the new number of extents is less than the old number */
+- udf_update_extents(inode, laarr, startnum, endnum, &prev_epos);
++ *err = udf_update_extents(inode, laarr, startnum, endnum, &prev_epos);
++ if (*err < 0)
++ goto out_free;
+
+ newblock = udf_get_pblock(inode->i_sb, newblocknum,
+ iinfo->i_location.partitionReferenceNum, 0);
+@@ -1149,21 +1149,30 @@ static void udf_merge_extents(struct inode *inode, struct kernel_long_ad *laarr,
+ }
+ }
+
+-static void udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr,
+- int startnum, int endnum,
+- struct extent_position *epos)
++static int udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr,
++ int startnum, int endnum,
++ struct extent_position *epos)
+ {
+ int start = 0, i;
+ struct kernel_lb_addr tmploc;
+ uint32_t tmplen;
++ int err;
+
+ if (startnum > endnum) {
+ for (i = 0; i < (startnum - endnum); i++)
+ udf_delete_aext(inode, *epos);
+ } else if (startnum < endnum) {
+ for (i = 0; i < (endnum - startnum); i++) {
+- udf_insert_aext(inode, *epos, laarr[i].extLocation,
+- laarr[i].extLength);
++ err = udf_insert_aext(inode, *epos,
++ laarr[i].extLocation,
++ laarr[i].extLength);
++ /*
++ * If we fail here, we are likely corrupting the extent
++ * list and leaking blocks. At least stop early to
++ * limit the damage.
++ */
++ if (err < 0)
++ return err;
+ udf_next_aext(inode, epos, &laarr[i].extLocation,
+ &laarr[i].extLength, 1);
+ start++;
+@@ -1175,6 +1184,7 @@ static void udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr
+ udf_write_aext(inode, epos, &laarr[i].extLocation,
+ laarr[i].extLength, 1);
+ }
++ return 0;
+ }
+
+ struct buffer_head *udf_bread(struct inode *inode, udf_pblk_t block,
+@@ -2191,12 +2201,13 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos,
+ return etype;
+ }
+
+-static int8_t udf_insert_aext(struct inode *inode, struct extent_position epos,
+- struct kernel_lb_addr neloc, uint32_t nelen)
++static int udf_insert_aext(struct inode *inode, struct extent_position epos,
++ struct kernel_lb_addr neloc, uint32_t nelen)
+ {
+ struct kernel_lb_addr oeloc;
+ uint32_t oelen;
+ int8_t etype;
++ int err;
+
+ if (epos.bh)
+ get_bh(epos.bh);
+@@ -2206,10 +2217,10 @@ static int8_t udf_insert_aext(struct inode *inode, struct extent_position epos,
+ neloc = oeloc;
+ nelen = (etype << 30) | oelen;
+ }
+- udf_add_aext(inode, &epos, &neloc, nelen, 1);
++ err = udf_add_aext(inode, &epos, &neloc, nelen, 1);
+ brelse(epos.bh);
+
+- return (nelen >> 30);
++ return err;
+ }
+
+ int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
+diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
+index 3482f9365a4db..de0ad39d4281f 100644
+--- a/include/linux/eventfd.h
++++ b/include/linux/eventfd.h
+@@ -41,6 +41,7 @@ struct eventfd_ctx *eventfd_ctx_fileget(struct file *file);
+ __u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n);
+ int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_entry_t *wait,
+ __u64 *cnt);
++void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt);
+
+ DECLARE_PER_CPU(int, eventfd_wake_count);
+
+@@ -82,6 +83,11 @@ static inline bool eventfd_signal_count(void)
+ return false;
+ }
+
++static inline void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
++{
++
++}
++
+ #endif
+
+ #endif /* _LINUX_EVENTFD_H */
+diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
+index c697a05242735..a6f14d8e4e810 100644
+--- a/include/linux/if_arp.h
++++ b/include/linux/if_arp.h
+@@ -56,6 +56,10 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev)
+ case ARPHRD_NONE:
+ case ARPHRD_RAWIP:
+ case ARPHRD_PIMREG:
++ /* PPP adds its l2 header automatically in ppp_start_xmit().
++ * This makes it look like an l3 device to __bpf_redirect() and tcf_mirred_init().
++ */
++ case ARPHRD_PPP:
+ return false;
+ default:
+ return true;
+diff --git a/include/linux/namei.h b/include/linux/namei.h
+index a78606e8e3df7..4632f4ca33426 100644
+--- a/include/linux/namei.h
++++ b/include/linux/namei.h
+@@ -84,6 +84,7 @@ extern int kern_path_mountpoint(int, const char *, struct path *, unsigned int);
+ extern struct dentry *try_lookup_one_len(const char *, struct dentry *, int);
+ extern struct dentry *lookup_one_len(const char *, struct dentry *, int);
+ extern struct dentry *lookup_one_len_unlocked(const char *, struct dentry *, int);
++extern struct dentry *lookup_positive_unlocked(const char *, struct dentry *, int);
+
+ extern int follow_down_one(struct path *);
+ extern int follow_down(struct path *);
+diff --git a/include/linux/nls.h b/include/linux/nls.h
+index 499e486b3722d..e0bf8367b274a 100644
+--- a/include/linux/nls.h
++++ b/include/linux/nls.h
+@@ -47,7 +47,7 @@ enum utf16_endian {
+ /* nls_base.c */
+ extern int __register_nls(struct nls_table *, struct module *);
+ extern int unregister_nls(struct nls_table *);
+-extern struct nls_table *load_nls(char *);
++extern struct nls_table *load_nls(const char *charset);
+ extern void unload_nls(struct nls_table *);
+ extern struct nls_table *load_nls_default(void);
+ #define register_nls(nls) __register_nls((nls), THIS_MODULE)
+diff --git a/include/linux/pci-ats.h b/include/linux/pci-ats.h
+index 7c4b8e27268c7..1ebb88e7c184c 100644
+--- a/include/linux/pci-ats.h
++++ b/include/linux/pci-ats.h
+@@ -40,6 +40,7 @@ void pci_disable_pasid(struct pci_dev *pdev);
+ void pci_restore_pasid_state(struct pci_dev *pdev);
+ int pci_pasid_features(struct pci_dev *pdev);
+ int pci_max_pasids(struct pci_dev *pdev);
++int pci_prg_resp_pasid_required(struct pci_dev *pdev);
+
+ #else /* CONFIG_PCI_PASID */
+
+@@ -66,6 +67,10 @@ static inline int pci_max_pasids(struct pci_dev *pdev)
+ return -EINVAL;
+ }
+
++static inline int pci_prg_resp_pasid_required(struct pci_dev *pdev)
++{
++ return 0;
++}
+ #endif /* CONFIG_PCI_PASID */
+
+
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 1d1b0bfd51968..2636990e0cccf 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -260,6 +260,7 @@ enum pci_bus_speed {
+ PCIE_SPEED_5_0GT = 0x15,
+ PCIE_SPEED_8_0GT = 0x16,
+ PCIE_SPEED_16_0GT = 0x17,
++ PCIE_SPEED_32_0GT = 0x18,
+ PCI_SPEED_UNKNOWN = 0xff,
+ };
+
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index efe30b9b11908..f17e08bd294c2 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -998,15 +998,31 @@ extern void perf_event_output(struct perf_event *event,
+ struct pt_regs *regs);
+
+ static inline bool
+-is_default_overflow_handler(struct perf_event *event)
++__is_default_overflow_handler(perf_overflow_handler_t overflow_handler)
+ {
+- if (likely(event->overflow_handler == perf_event_output_forward))
++ if (likely(overflow_handler == perf_event_output_forward))
+ return true;
+- if (unlikely(event->overflow_handler == perf_event_output_backward))
++ if (unlikely(overflow_handler == perf_event_output_backward))
+ return true;
+ return false;
+ }
+
++#define is_default_overflow_handler(event) \
++ __is_default_overflow_handler((event)->overflow_handler)
++
++#ifdef CONFIG_BPF_SYSCALL
++static inline bool uses_default_overflow_handler(struct perf_event *event)
++{
++ if (likely(is_default_overflow_handler(event)))
++ return true;
++
++ return __is_default_overflow_handler(event->orig_overflow_handler);
++}
++#else
++#define uses_default_overflow_handler(event) \
++ is_default_overflow_handler(event)
++#endif
++
+ extern void
+ perf_event_header__init_id(struct perf_event_header *header,
+ struct perf_sample_data *data,
+diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
+index 0643c083ed862..93a1b5497bdf1 100644
+--- a/include/linux/trace_events.h
++++ b/include/linux/trace_events.h
+@@ -581,7 +581,8 @@ extern int perf_uprobe_init(struct perf_event *event, bool is_retprobe);
+ extern void perf_uprobe_destroy(struct perf_event *event);
+ extern int bpf_get_uprobe_info(const struct perf_event *event,
+ u32 *fd_type, const char **filename,
+- u64 *probe_offset, bool perf_type_tracepoint);
++ u64 *probe_offset, u64 *probe_addr,
++ bool perf_type_tracepoint);
+ #endif
+ extern int ftrace_profile_set_filter(struct perf_event *event, int event_id,
+ char *filter_str);
+diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
+index 33fd9ba7e0e5a..ec75c0a1c529f 100644
+--- a/include/net/lwtunnel.h
++++ b/include/net/lwtunnel.h
+@@ -16,9 +16,12 @@
+ #define LWTUNNEL_STATE_INPUT_REDIRECT BIT(1)
+ #define LWTUNNEL_STATE_XMIT_REDIRECT BIT(2)
+
++/* LWTUNNEL_XMIT_CONTINUE should be distinguishable from dst_output return
++ * values (NET_XMIT_xxx and NETDEV_TX_xxx in linux/netdevice.h) for safety.
++ */
+ enum {
+ LWTUNNEL_XMIT_DONE,
+- LWTUNNEL_XMIT_CONTINUE,
++ LWTUNNEL_XMIT_CONTINUE = 0x100,
+ };
+
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index c6c48409e7b42..9c43299ff8708 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -346,7 +346,6 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos,
+ struct pipe_inode_info *pipe, size_t len,
+ unsigned int flags);
+
+-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks);
+ static inline void tcp_dec_quickack_mode(struct sock *sk,
+ const unsigned int pkts)
+ {
+diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
+index 5ea06d310a256..c4e38448507de 100644
+--- a/include/scsi/scsi_host.h
++++ b/include/scsi/scsi_host.h
+@@ -760,7 +760,7 @@ extern void scsi_remove_host(struct Scsi_Host *);
+ extern struct Scsi_Host *scsi_host_get(struct Scsi_Host *);
+ extern int scsi_host_busy(struct Scsi_Host *shost);
+ extern void scsi_host_put(struct Scsi_Host *t);
+-extern struct Scsi_Host *scsi_host_lookup(unsigned short);
++extern struct Scsi_Host *scsi_host_lookup(unsigned int hostnum);
+ extern const char *scsi_host_state_name(enum scsi_host_state);
+ extern void scsi_cmd_get_serial(struct Scsi_Host *, struct scsi_cmnd *);
+
+diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
+index 8d2767140798b..39c69235a3843 100644
+--- a/include/uapi/linux/pci_regs.h
++++ b/include/uapi/linux/pci_regs.h
+@@ -1,7 +1,5 @@
+ /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+ /*
+- * pci_regs.h
+- *
+ * PCI standard defines
+ * Copyright 1994, Drew Eckhardt
+ * Copyright 1997--1999 Martin Mares <mj@ucw.cz>
+@@ -15,7 +13,7 @@
+ * PCI System Design Guide
+ *
+ * For HyperTransport information, please consult the following manuals
+- * from http://www.hypertransport.org
++ * from http://www.hypertransport.org :
+ *
+ * The HyperTransport I/O Link Specification
+ */
+@@ -300,7 +298,7 @@
+ #define PCI_SID_ESR_FIC 0x20 /* First In Chassis Flag */
+ #define PCI_SID_CHASSIS_NR 3 /* Chassis Number */
+
+-/* Message Signalled Interrupts registers */
++/* Message Signalled Interrupt registers */
+
+ #define PCI_MSI_FLAGS 2 /* Message Control */
+ #define PCI_MSI_FLAGS_ENABLE 0x0001 /* MSI feature enabled */
+@@ -318,7 +316,7 @@
+ #define PCI_MSI_MASK_64 16 /* Mask bits register for 64-bit devices */
+ #define PCI_MSI_PENDING_64 20 /* Pending intrs for 64-bit devices */
+
+-/* MSI-X registers */
++/* MSI-X registers (in MSI-X capability) */
+ #define PCI_MSIX_FLAGS 2 /* Message Control */
+ #define PCI_MSIX_FLAGS_QSIZE 0x07FF /* Table size */
+ #define PCI_MSIX_FLAGS_MASKALL 0x4000 /* Mask all vectors for this function */
+@@ -332,13 +330,13 @@
+ #define PCI_MSIX_FLAGS_BIRMASK PCI_MSIX_PBA_BIR /* deprecated */
+ #define PCI_CAP_MSIX_SIZEOF 12 /* size of MSIX registers */
+
+-/* MSI-X Table entry format */
++/* MSI-X Table entry format (in memory mapped by a BAR) */
+ #define PCI_MSIX_ENTRY_SIZE 16
+-#define PCI_MSIX_ENTRY_LOWER_ADDR 0
+-#define PCI_MSIX_ENTRY_UPPER_ADDR 4
+-#define PCI_MSIX_ENTRY_DATA 8
+-#define PCI_MSIX_ENTRY_VECTOR_CTRL 12
+-#define PCI_MSIX_ENTRY_CTRL_MASKBIT 1
++#define PCI_MSIX_ENTRY_LOWER_ADDR 0 /* Message Address */
++#define PCI_MSIX_ENTRY_UPPER_ADDR 4 /* Message Upper Address */
++#define PCI_MSIX_ENTRY_DATA 8 /* Message Data */
++#define PCI_MSIX_ENTRY_VECTOR_CTRL 12 /* Vector Control */
++#define PCI_MSIX_ENTRY_CTRL_MASKBIT 0x00000001
+
+ /* CompactPCI Hotswap Register */
+
+@@ -464,19 +462,19 @@
+ /* PCI Express capability registers */
+
+ #define PCI_EXP_FLAGS 2 /* Capabilities register */
+-#define PCI_EXP_FLAGS_VERS 0x000f /* Capability version */
+-#define PCI_EXP_FLAGS_TYPE 0x00f0 /* Device/Port type */
+-#define PCI_EXP_TYPE_ENDPOINT 0x0 /* Express Endpoint */
+-#define PCI_EXP_TYPE_LEG_END 0x1 /* Legacy Endpoint */
+-#define PCI_EXP_TYPE_ROOT_PORT 0x4 /* Root Port */
+-#define PCI_EXP_TYPE_UPSTREAM 0x5 /* Upstream Port */
+-#define PCI_EXP_TYPE_DOWNSTREAM 0x6 /* Downstream Port */
+-#define PCI_EXP_TYPE_PCI_BRIDGE 0x7 /* PCIe to PCI/PCI-X Bridge */
+-#define PCI_EXP_TYPE_PCIE_BRIDGE 0x8 /* PCI/PCI-X to PCIe Bridge */
+-#define PCI_EXP_TYPE_RC_END 0x9 /* Root Complex Integrated Endpoint */
+-#define PCI_EXP_TYPE_RC_EC 0xa /* Root Complex Event Collector */
+-#define PCI_EXP_FLAGS_SLOT 0x0100 /* Slot implemented */
+-#define PCI_EXP_FLAGS_IRQ 0x3e00 /* Interrupt message number */
++#define PCI_EXP_FLAGS_VERS 0x000f /* Capability version */
++#define PCI_EXP_FLAGS_TYPE 0x00f0 /* Device/Port type */
++#define PCI_EXP_TYPE_ENDPOINT 0x0 /* Express Endpoint */
++#define PCI_EXP_TYPE_LEG_END 0x1 /* Legacy Endpoint */
++#define PCI_EXP_TYPE_ROOT_PORT 0x4 /* Root Port */
++#define PCI_EXP_TYPE_UPSTREAM 0x5 /* Upstream Port */
++#define PCI_EXP_TYPE_DOWNSTREAM 0x6 /* Downstream Port */
++#define PCI_EXP_TYPE_PCI_BRIDGE 0x7 /* PCIe to PCI/PCI-X Bridge */
++#define PCI_EXP_TYPE_PCIE_BRIDGE 0x8 /* PCI/PCI-X to PCIe Bridge */
++#define PCI_EXP_TYPE_RC_END 0x9 /* Root Complex Integrated Endpoint */
++#define PCI_EXP_TYPE_RC_EC 0xa /* Root Complex Event Collector */
++#define PCI_EXP_FLAGS_SLOT 0x0100 /* Slot implemented */
++#define PCI_EXP_FLAGS_IRQ 0x3e00 /* Interrupt message number */
+ #define PCI_EXP_DEVCAP 4 /* Device capabilities */
+ #define PCI_EXP_DEVCAP_PAYLOAD 0x00000007 /* Max_Payload_Size */
+ #define PCI_EXP_DEVCAP_PHANTOM 0x00000018 /* Phantom functions */
+@@ -529,6 +527,7 @@
+ #define PCI_EXP_LNKCAP_SLS_5_0GB 0x00000002 /* LNKCAP2 SLS Vector bit 1 */
+ #define PCI_EXP_LNKCAP_SLS_8_0GB 0x00000003 /* LNKCAP2 SLS Vector bit 2 */
+ #define PCI_EXP_LNKCAP_SLS_16_0GB 0x00000004 /* LNKCAP2 SLS Vector bit 3 */
++#define PCI_EXP_LNKCAP_SLS_32_0GB 0x00000005 /* LNKCAP2 SLS Vector bit 4 */
+ #define PCI_EXP_LNKCAP_MLW 0x000003f0 /* Maximum Link Width */
+ #define PCI_EXP_LNKCAP_ASPMS 0x00000c00 /* ASPM Support */
+ #define PCI_EXP_LNKCAP_L0SEL 0x00007000 /* L0s Exit Latency */
+@@ -557,6 +556,7 @@
+ #define PCI_EXP_LNKSTA_CLS_5_0GB 0x0002 /* Current Link Speed 5.0GT/s */
+ #define PCI_EXP_LNKSTA_CLS_8_0GB 0x0003 /* Current Link Speed 8.0GT/s */
+ #define PCI_EXP_LNKSTA_CLS_16_0GB 0x0004 /* Current Link Speed 16.0GT/s */
++#define PCI_EXP_LNKSTA_CLS_32_0GB 0x0005 /* Current Link Speed 32.0GT/s */
+ #define PCI_EXP_LNKSTA_NLW 0x03f0 /* Negotiated Link Width */
+ #define PCI_EXP_LNKSTA_NLW_X1 0x0010 /* Current Link Width x1 */
+ #define PCI_EXP_LNKSTA_NLW_X2 0x0020 /* Current Link Width x2 */
+@@ -621,8 +621,8 @@
+ #define PCI_EXP_RTCAP 30 /* Root Capabilities */
+ #define PCI_EXP_RTCAP_CRSVIS 0x0001 /* CRS Software Visibility capability */
+ #define PCI_EXP_RTSTA 32 /* Root Status */
+-#define PCI_EXP_RTSTA_PME 0x00010000 /* PME status */
+-#define PCI_EXP_RTSTA_PENDING 0x00020000 /* PME pending */
++#define PCI_EXP_RTSTA_PME 0x00010000 /* PME status */
++#define PCI_EXP_RTSTA_PENDING 0x00020000 /* PME pending */
+ /*
+ * The Device Capabilities 2, Device Status 2, Device Control 2,
+ * Link Capabilities 2, Link Status 2, Link Control 2,
+@@ -642,13 +642,13 @@
+ #define PCI_EXP_DEVCAP2_OBFF_MASK 0x000c0000 /* OBFF support mechanism */
+ #define PCI_EXP_DEVCAP2_OBFF_MSG 0x00040000 /* New message signaling */
+ #define PCI_EXP_DEVCAP2_OBFF_WAKE 0x00080000 /* Re-use WAKE# for OBFF */
+-#define PCI_EXP_DEVCAP2_EE_PREFIX 0x00200000 /* End-End TLP Prefix */
++#define PCI_EXP_DEVCAP2_EE_PREFIX 0x00200000 /* End-End TLP Prefix */
+ #define PCI_EXP_DEVCTL2 40 /* Device Control 2 */
+ #define PCI_EXP_DEVCTL2_COMP_TIMEOUT 0x000f /* Completion Timeout Value */
+ #define PCI_EXP_DEVCTL2_COMP_TMOUT_DIS 0x0010 /* Completion Timeout Disable */
+ #define PCI_EXP_DEVCTL2_ARI 0x0020 /* Alternative Routing-ID */
+-#define PCI_EXP_DEVCTL2_ATOMIC_REQ 0x0040 /* Set Atomic requests */
+-#define PCI_EXP_DEVCTL2_ATOMIC_EGRESS_BLOCK 0x0080 /* Block atomic egress */
++#define PCI_EXP_DEVCTL2_ATOMIC_REQ 0x0040 /* Set Atomic requests */
++#define PCI_EXP_DEVCTL2_ATOMIC_EGRESS_BLOCK 0x0080 /* Block atomic egress */
+ #define PCI_EXP_DEVCTL2_IDO_REQ_EN 0x0100 /* Allow IDO for requests */
+ #define PCI_EXP_DEVCTL2_IDO_CMP_EN 0x0200 /* Allow IDO for completions */
+ #define PCI_EXP_DEVCTL2_LTR_EN 0x0400 /* Enable LTR mechanism */
+@@ -662,13 +662,17 @@
+ #define PCI_EXP_LNKCAP2_SLS_5_0GB 0x00000004 /* Supported Speed 5GT/s */
+ #define PCI_EXP_LNKCAP2_SLS_8_0GB 0x00000008 /* Supported Speed 8GT/s */
+ #define PCI_EXP_LNKCAP2_SLS_16_0GB 0x00000010 /* Supported Speed 16GT/s */
++#define PCI_EXP_LNKCAP2_SLS_32_0GB 0x00000020 /* Supported Speed 32GT/s */
+ #define PCI_EXP_LNKCAP2_CROSSLINK 0x00000100 /* Crosslink supported */
+ #define PCI_EXP_LNKCTL2 48 /* Link Control 2 */
+-#define PCI_EXP_LNKCTL2_TLS 0x000f
+-#define PCI_EXP_LNKCTL2_TLS_2_5GT 0x0001 /* Supported Speed 2.5GT/s */
+-#define PCI_EXP_LNKCTL2_TLS_5_0GT 0x0002 /* Supported Speed 5GT/s */
+-#define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003 /* Supported Speed 8GT/s */
+-#define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004 /* Supported Speed 16GT/s */
++#define PCI_EXP_LNKCTL2_TLS 0x000f
++#define PCI_EXP_LNKCTL2_TLS_2_5GT 0x0001 /* Supported Speed 2.5GT/s */
++#define PCI_EXP_LNKCTL2_TLS_5_0GT 0x0002 /* Supported Speed 5GT/s */
++#define PCI_EXP_LNKCTL2_TLS_8_0GT 0x0003 /* Supported Speed 8GT/s */
++#define PCI_EXP_LNKCTL2_TLS_16_0GT 0x0004 /* Supported Speed 16GT/s */
++#define PCI_EXP_LNKCTL2_TLS_32_0GT 0x0005 /* Supported Speed 32GT/s */
++#define PCI_EXP_LNKCTL2_ENTER_COMP 0x0010 /* Enter Compliance */
++#define PCI_EXP_LNKCTL2_TX_MARGIN 0x0380 /* Transmit Margin */
+ #define PCI_EXP_LNKSTA2 50 /* Link Status 2 */
+ #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 52 /* v2 endpoints with link end here */
+ #define PCI_EXP_SLTCAP2 52 /* Slot Capabilities 2 */
+@@ -757,18 +761,18 @@
+ #define PCI_ERR_CAP_ECRC_CHKE 0x00000100 /* ECRC Check Enable */
+ #define PCI_ERR_HEADER_LOG 28 /* Header Log Register (16 bytes) */
+ #define PCI_ERR_ROOT_COMMAND 44 /* Root Error Command */
+-#define PCI_ERR_ROOT_CMD_COR_EN 0x00000001 /* Correctable Err Reporting Enable */
+-#define PCI_ERR_ROOT_CMD_NONFATAL_EN 0x00000002 /* Non-Fatal Err Reporting Enable */
+-#define PCI_ERR_ROOT_CMD_FATAL_EN 0x00000004 /* Fatal Err Reporting Enable */
++#define PCI_ERR_ROOT_CMD_COR_EN 0x00000001 /* Correctable Err Reporting Enable */
++#define PCI_ERR_ROOT_CMD_NONFATAL_EN 0x00000002 /* Non-Fatal Err Reporting Enable */
++#define PCI_ERR_ROOT_CMD_FATAL_EN 0x00000004 /* Fatal Err Reporting Enable */
+ #define PCI_ERR_ROOT_STATUS 48
+-#define PCI_ERR_ROOT_COR_RCV 0x00000001 /* ERR_COR Received */
+-#define PCI_ERR_ROOT_MULTI_COR_RCV 0x00000002 /* Multiple ERR_COR */
+-#define PCI_ERR_ROOT_UNCOR_RCV 0x00000004 /* ERR_FATAL/NONFATAL */
+-#define PCI_ERR_ROOT_MULTI_UNCOR_RCV 0x00000008 /* Multiple FATAL/NONFATAL */
+-#define PCI_ERR_ROOT_FIRST_FATAL 0x00000010 /* First UNC is Fatal */
+-#define PCI_ERR_ROOT_NONFATAL_RCV 0x00000020 /* Non-Fatal Received */
+-#define PCI_ERR_ROOT_FATAL_RCV 0x00000040 /* Fatal Received */
+-#define PCI_ERR_ROOT_AER_IRQ 0xf8000000 /* Advanced Error Interrupt Message Number */
++#define PCI_ERR_ROOT_COR_RCV 0x00000001 /* ERR_COR Received */
++#define PCI_ERR_ROOT_MULTI_COR_RCV 0x00000002 /* Multiple ERR_COR */
++#define PCI_ERR_ROOT_UNCOR_RCV 0x00000004 /* ERR_FATAL/NONFATAL */
++#define PCI_ERR_ROOT_MULTI_UNCOR_RCV 0x00000008 /* Multiple FATAL/NONFATAL */
++#define PCI_ERR_ROOT_FIRST_FATAL 0x00000010 /* First UNC is Fatal */
++#define PCI_ERR_ROOT_NONFATAL_RCV 0x00000020 /* Non-Fatal Received */
++#define PCI_ERR_ROOT_FATAL_RCV 0x00000040 /* Fatal Received */
++#define PCI_ERR_ROOT_AER_IRQ 0xf8000000 /* Advanced Error Interrupt Message Number */
+ #define PCI_ERR_ROOT_ERR_SRC 52 /* Error Source Identification */
+
+ /* Virtual Channel */
+@@ -879,12 +883,13 @@
+
+ /* Page Request Interface */
+ #define PCI_PRI_CTRL 0x04 /* PRI control register */
+-#define PCI_PRI_CTRL_ENABLE 0x01 /* Enable */
+-#define PCI_PRI_CTRL_RESET 0x02 /* Reset */
++#define PCI_PRI_CTRL_ENABLE 0x0001 /* Enable */
++#define PCI_PRI_CTRL_RESET 0x0002 /* Reset */
+ #define PCI_PRI_STATUS 0x06 /* PRI status register */
+-#define PCI_PRI_STATUS_RF 0x001 /* Response Failure */
+-#define PCI_PRI_STATUS_UPRGI 0x002 /* Unexpected PRG index */
+-#define PCI_PRI_STATUS_STOPPED 0x100 /* PRI Stopped */
++#define PCI_PRI_STATUS_RF 0x0001 /* Response Failure */
++#define PCI_PRI_STATUS_UPRGI 0x0002 /* Unexpected PRG index */
++#define PCI_PRI_STATUS_STOPPED 0x0100 /* PRI Stopped */
++#define PCI_PRI_STATUS_PASID 0x8000 /* PRG Response PASID Required */
+ #define PCI_PRI_MAX_REQ 0x08 /* PRI max reqs supported */
+ #define PCI_PRI_ALLOC_REQ 0x0c /* PRI max reqs allowed */
+ #define PCI_EXT_CAP_PRI_SIZEOF 16
+@@ -901,16 +906,16 @@
+
+ /* Single Root I/O Virtualization */
+ #define PCI_SRIOV_CAP 0x04 /* SR-IOV Capabilities */
+-#define PCI_SRIOV_CAP_VFM 0x01 /* VF Migration Capable */
++#define PCI_SRIOV_CAP_VFM 0x00000001 /* VF Migration Capable */
+ #define PCI_SRIOV_CAP_INTR(x) ((x) >> 21) /* Interrupt Message Number */
+ #define PCI_SRIOV_CTRL 0x08 /* SR-IOV Control */
+-#define PCI_SRIOV_CTRL_VFE 0x01 /* VF Enable */
+-#define PCI_SRIOV_CTRL_VFM 0x02 /* VF Migration Enable */
+-#define PCI_SRIOV_CTRL_INTR 0x04 /* VF Migration Interrupt Enable */
+-#define PCI_SRIOV_CTRL_MSE 0x08 /* VF Memory Space Enable */
+-#define PCI_SRIOV_CTRL_ARI 0x10 /* ARI Capable Hierarchy */
++#define PCI_SRIOV_CTRL_VFE 0x0001 /* VF Enable */
++#define PCI_SRIOV_CTRL_VFM 0x0002 /* VF Migration Enable */
++#define PCI_SRIOV_CTRL_INTR 0x0004 /* VF Migration Interrupt Enable */
++#define PCI_SRIOV_CTRL_MSE 0x0008 /* VF Memory Space Enable */
++#define PCI_SRIOV_CTRL_ARI 0x0010 /* ARI Capable Hierarchy */
+ #define PCI_SRIOV_STATUS 0x0a /* SR-IOV Status */
+-#define PCI_SRIOV_STATUS_VFM 0x01 /* VF Migration Status */
++#define PCI_SRIOV_STATUS_VFM 0x0001 /* VF Migration Status */
+ #define PCI_SRIOV_INITIAL_VF 0x0c /* Initial VFs */
+ #define PCI_SRIOV_TOTAL_VF 0x0e /* Total VFs */
+ #define PCI_SRIOV_NUM_VF 0x10 /* Number of VFs */
+@@ -940,13 +945,13 @@
+
+ /* Access Control Service */
+ #define PCI_ACS_CAP 0x04 /* ACS Capability Register */
+-#define PCI_ACS_SV 0x01 /* Source Validation */
+-#define PCI_ACS_TB 0x02 /* Translation Blocking */
+-#define PCI_ACS_RR 0x04 /* P2P Request Redirect */
+-#define PCI_ACS_CR 0x08 /* P2P Completion Redirect */
+-#define PCI_ACS_UF 0x10 /* Upstream Forwarding */
+-#define PCI_ACS_EC 0x20 /* P2P Egress Control */
+-#define PCI_ACS_DT 0x40 /* Direct Translated P2P */
++#define PCI_ACS_SV 0x0001 /* Source Validation */
++#define PCI_ACS_TB 0x0002 /* Translation Blocking */
++#define PCI_ACS_RR 0x0004 /* P2P Request Redirect */
++#define PCI_ACS_CR 0x0008 /* P2P Completion Redirect */
++#define PCI_ACS_UF 0x0010 /* Upstream Forwarding */
++#define PCI_ACS_EC 0x0020 /* P2P Egress Control */
++#define PCI_ACS_DT 0x0040 /* Direct Translated P2P */
+ #define PCI_ACS_EGRESS_BITS 0x05 /* ACS Egress Control Vector Size */
+ #define PCI_ACS_CTRL 0x06 /* ACS Control Register */
+ #define PCI_ACS_EGRESS_CTL_V 0x08 /* ACS Egress Control Vector */
+@@ -996,9 +1001,9 @@
+ #define PCI_EXP_DPC_CAP_DL_ACTIVE 0x1000 /* ERR_COR signal on DL_Active supported */
+
+ #define PCI_EXP_DPC_CTL 6 /* DPC control */
+-#define PCI_EXP_DPC_CTL_EN_FATAL 0x0001 /* Enable trigger on ERR_FATAL message */
+-#define PCI_EXP_DPC_CTL_EN_NONFATAL 0x0002 /* Enable trigger on ERR_NONFATAL message */
+-#define PCI_EXP_DPC_CTL_INT_EN 0x0008 /* DPC Interrupt Enable */
++#define PCI_EXP_DPC_CTL_EN_FATAL 0x0001 /* Enable trigger on ERR_FATAL message */
++#define PCI_EXP_DPC_CTL_EN_NONFATAL 0x0002 /* Enable trigger on ERR_NONFATAL message */
++#define PCI_EXP_DPC_CTL_INT_EN 0x0008 /* DPC Interrupt Enable */
+
+ #define PCI_EXP_DPC_STATUS 8 /* DPC Status */
+ #define PCI_EXP_DPC_STATUS_TRIGGER 0x0001 /* Trigger Status */
+diff --git a/include/uapi/linux/sync_file.h b/include/uapi/linux/sync_file.h
+index ee2dcfb3d6602..d7f7c04a6e0c1 100644
+--- a/include/uapi/linux/sync_file.h
++++ b/include/uapi/linux/sync_file.h
+@@ -52,7 +52,7 @@ struct sync_fence_info {
+ * @name: name of fence
+ * @status: status of fence. 1: signaled 0:active <0:error
+ * @flags: sync_file_info flags
+- * @num_fences number of fences in the sync_file
++ * @num_fences: number of fences in the sync_file
+ * @pad: padding for 64-bit alignment, should always be zero
+ * @sync_fence_info: pointer to array of structs sync_fence_info with all
+ * fences in the sync_file
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index 1513873e23bd1..e4de5b9d5d3f1 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -1923,6 +1923,8 @@ void __audit_inode_child(struct inode *parent,
+ }
+ }
+
++ cond_resched();
++
+ /* is there a matching child entry? */
+ list_for_each_entry(n, &context->names_list, list) {
+ /* can only match entries that have a name */
+diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c
+index b05f1dd58a622..313e66b8c6622 100644
+--- a/kernel/cgroup/namespace.c
++++ b/kernel/cgroup/namespace.c
+@@ -148,9 +148,3 @@ const struct proc_ns_operations cgroupns_operations = {
+ .install = cgroupns_install,
+ .owner = cgroupns_owner,
+ };
+-
+-static __init int cgroup_namespaces_init(void)
+-{
+- return 0;
+-}
+-subsys_initcall(cgroup_namespaces_init);
+diff --git a/kernel/module.c b/kernel/module.c
+index 6ec0b2e0f01f5..2ec961945fa8b 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2261,15 +2261,26 @@ static void free_module(struct module *mod)
+ void *__symbol_get(const char *symbol)
+ {
+ struct module *owner;
++ enum mod_license license;
+ const struct kernel_symbol *sym;
+
+ preempt_disable();
+- sym = find_symbol(symbol, &owner, NULL, NULL, true, true);
+- if (sym && strong_try_module_get(owner))
++ sym = find_symbol(symbol, &owner, NULL, &license, true, true);
++ if (!sym)
++ goto fail;
++ if (license != GPL_ONLY) {
++ pr_warn("failing symbol_get of non-GPLONLY symbol %s.\n",
++ symbol);
++ goto fail;
++ }
++ if (strong_try_module_get(owner))
+ sym = NULL;
+ preempt_enable();
+
+ return sym ? (void *)kernel_symbol_value(sym) : NULL;
++fail:
++ preempt_enable();
++ return NULL;
+ }
+ EXPORT_SYMBOL_GPL(__symbol_get);
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 1cb13d6368f3f..b794470bb42ed 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -1274,7 +1274,7 @@ int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id,
+ #ifdef CONFIG_UPROBE_EVENTS
+ if (flags & TRACE_EVENT_FL_UPROBE)
+ err = bpf_get_uprobe_info(event, fd_type, buf,
+- probe_offset,
++ probe_offset, probe_addr,
+ event->attr.type == PERF_TYPE_TRACEPOINT);
+ #endif
+ }
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index 0da379b902492..0e3bdd69fa2d6 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -1159,7 +1159,7 @@ static void uretprobe_perf_func(struct trace_uprobe *tu, unsigned long func,
+
+ int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type,
+ const char **filename, u64 *probe_offset,
+- bool perf_type_tracepoint)
++ u64 *probe_addr, bool perf_type_tracepoint)
+ {
+ const char *pevent = trace_event_name(event->tp_event);
+ const char *group = event->tp_event->class->system;
+@@ -1176,6 +1176,7 @@ int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type,
+ : BPF_FD_TYPE_UPROBE;
+ *filename = tu->filename;
+ *probe_offset = tu->offset;
++ *probe_addr = 0;
+ return 0;
+ }
+ #endif /* CONFIG_PERF_EVENTS */
+diff --git a/lib/idr.c b/lib/idr.c
+index 82c24a417dc65..432a985bf7727 100644
+--- a/lib/idr.c
++++ b/lib/idr.c
+@@ -103,7 +103,7 @@ EXPORT_SYMBOL_GPL(idr_alloc);
+ * @end: The maximum ID (exclusive).
+ * @gfp: Memory allocation flags.
+ *
+- * Allocates an unused ID in the range specified by @nextid and @end. If
++ * Allocates an unused ID in the range specified by @start and @end. If
+ * @end is <= 0, it is treated as one larger than %INT_MAX. This allows
+ * callers to use @start + N as @end as long as N is within integer range.
+ * The search for an unused ID will start at the last ID allocated and will
+diff --git a/lib/kobject.c b/lib/kobject.c
+index 97d86dc17c42b..2bab65232925a 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -829,6 +829,11 @@ int kset_register(struct kset *k)
+ if (!k)
+ return -EINVAL;
+
++ if (!k->kobj.ktype) {
++ pr_err("must have a ktype to be initialized properly!\n");
++ return -EINVAL;
++ }
++
+ kset_init(k);
+ err = kobject_add_internal(&k->kobj);
+ if (err)
+diff --git a/lib/mpi/mpi-cmp.c b/lib/mpi/mpi-cmp.c
+index d25e9e96c310f..ceaebe181cd70 100644
+--- a/lib/mpi/mpi-cmp.c
++++ b/lib/mpi/mpi-cmp.c
+@@ -25,8 +25,12 @@ int mpi_cmp_ui(MPI u, unsigned long v)
+ mpi_limb_t limb = v;
+
+ mpi_normalize(u);
+- if (!u->nlimbs && !limb)
+- return 0;
++ if (u->nlimbs == 0) {
++ if (v == 0)
++ return 0;
++ else
++ return -1;
++ }
+ if (u->sign)
+ return -1;
+ if (u->nlimbs > 1)
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index f7cd8e018bde0..6b3357a77d992 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -409,7 +409,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
+ struct page **in_pages = NULL, **out_pages = NULL;
+ struct virtio_chan *chan = client->trans;
+ struct scatterlist *sgs[4];
+- size_t offs;
++ size_t offs = 0;
+ int need_drop = 0;
+ int kicked = 0;
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index b7314a6cf8c2c..e03cd719b86b7 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3546,21 +3546,20 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
+ struct sk_buff *segs = NULL;
+ struct sk_buff *tail = NULL;
+ struct sk_buff *list_skb = skb_shinfo(head_skb)->frag_list;
+- skb_frag_t *frag = skb_shinfo(head_skb)->frags;
+ unsigned int mss = skb_shinfo(head_skb)->gso_size;
+ unsigned int doffset = head_skb->data - skb_mac_header(head_skb);
+- struct sk_buff *frag_skb = head_skb;
+ unsigned int offset = doffset;
+ unsigned int tnl_hlen = skb_tnl_header_len(head_skb);
+ unsigned int partial_segs = 0;
+ unsigned int headroom;
+ unsigned int len = head_skb->len;
++ struct sk_buff *frag_skb;
++ skb_frag_t *frag;
+ __be16 proto;
+ bool csum, sg;
+- int nfrags = skb_shinfo(head_skb)->nr_frags;
+ int err = -ENOMEM;
+ int i = 0;
+- int pos;
++ int nfrags, pos;
+ int dummy;
+
+ if ((skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY) &&
+@@ -3638,6 +3637,13 @@ normal:
+ headroom = skb_headroom(head_skb);
+ pos = skb_headlen(head_skb);
+
++ if (skb_orphan_frags(head_skb, GFP_ATOMIC))
++ return ERR_PTR(-ENOMEM);
++
++ nfrags = skb_shinfo(head_skb)->nr_frags;
++ frag = skb_shinfo(head_skb)->frags;
++ frag_skb = head_skb;
++
+ do {
+ struct sk_buff *nskb;
+ skb_frag_t *nskb_frag;
+@@ -3662,6 +3668,10 @@ normal:
+ (skb_headlen(list_skb) == len || sg)) {
+ BUG_ON(skb_headlen(list_skb) > len);
+
++ nskb = skb_clone(list_skb, GFP_ATOMIC);
++ if (unlikely(!nskb))
++ goto err;
++
+ i = 0;
+ nfrags = skb_shinfo(list_skb)->nr_frags;
+ frag = skb_shinfo(list_skb)->frags;
+@@ -3680,12 +3690,8 @@ normal:
+ frag++;
+ }
+
+- nskb = skb_clone(list_skb, GFP_ATOMIC);
+ list_skb = list_skb->next;
+
+- if (unlikely(!nskb))
+- goto err;
+-
+ if (unlikely(pskb_trim(nskb, len))) {
+ kfree_skb(nskb);
+ goto err;
+@@ -3750,12 +3756,16 @@ normal:
+ skb_shinfo(nskb)->tx_flags |= skb_shinfo(head_skb)->tx_flags &
+ SKBTX_SHARED_FRAG;
+
+- if (skb_orphan_frags(frag_skb, GFP_ATOMIC) ||
+- skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC))
++ if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC))
+ goto err;
+
+ while (pos < offset + len) {
+ if (i >= nfrags) {
++ if (skb_orphan_frags(list_skb, GFP_ATOMIC) ||
++ skb_zerocopy_clone(nskb, list_skb,
++ GFP_ATOMIC))
++ goto err;
++
+ i = 0;
+ nfrags = skb_shinfo(list_skb)->nr_frags;
+ frag = skb_shinfo(list_skb)->frags;
+@@ -3769,10 +3779,6 @@ normal:
+ i--;
+ frag--;
+ }
+- if (skb_orphan_frags(frag_skb, GFP_ATOMIC) ||
+- skb_zerocopy_clone(nskb, frag_skb,
+- GFP_ATOMIC))
+- goto err;
+
+ list_skb = list_skb->next;
+ }
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 4e3ed80a68ceb..e1d0c8c715b87 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -632,7 +632,8 @@ bool sk_mc_loop(struct sock *sk)
+ return false;
+ if (!sk)
+ return true;
+- switch (sk->sk_family) {
++ /* IPV6_ADDRFORM can change sk->sk_family under us. */
++ switch (READ_ONCE(sk->sk_family)) {
+ case AF_INET:
+ return inet_sk(sk)->mc_loop;
+ #if IS_ENABLED(CONFIG_IPV6)
+@@ -2071,9 +2072,9 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo)
+ prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+ if (refcount_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf)
+ break;
+- if (sk->sk_shutdown & SEND_SHUTDOWN)
++ if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
+ break;
+- if (sk->sk_err)
++ if (READ_ONCE(sk->sk_err))
+ break;
+ timeo = schedule_timeout(timeo);
+ }
+@@ -2101,7 +2102,7 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
+ goto failure;
+
+ err = -EPIPE;
+- if (sk->sk_shutdown & SEND_SHUTDOWN)
++ if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
+ goto failure;
+
+ if (sk_wmem_alloc_get(sk) < sk->sk_sndbuf)
+diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
+index c021d5dde8f72..b2fc9ef7708f2 100644
+--- a/net/dccp/ipv4.c
++++ b/net/dccp/ipv4.c
+@@ -247,12 +247,17 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
+ int err;
+ struct net *net = dev_net(skb->dev);
+
+- /* Only need dccph_dport & dccph_sport which are the first
+- * 4 bytes in dccp header.
++ /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x,
++ * which is in byte 7 of the dccp header.
+ * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us.
++ *
++ * Later on, we want to access the sequence number fields, which are
++ * beyond 8 bytes, so we have to pskb_may_pull() ourselves.
+ */
+- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
+- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
++ dh = (struct dccp_hdr *)(skb->data + offset);
++ if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh)))
++ return;
++ iph = (struct iphdr *)skb->data;
+ dh = (struct dccp_hdr *)(skb->data + offset);
+
+ sk = __inet_lookup_established(net, &dccp_hashinfo,
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 88732ab4887c6..f8d8caa967b11 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -71,7 +71,7 @@ static inline __u64 dccp_v6_init_sequence(struct sk_buff *skb)
+ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ u8 type, u8 code, int offset, __be32 info)
+ {
+- const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
++ const struct ipv6hdr *hdr;
+ const struct dccp_hdr *dh;
+ struct dccp_sock *dp;
+ struct ipv6_pinfo *np;
+@@ -80,12 +80,17 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ __u64 seq;
+ struct net *net = dev_net(skb->dev);
+
+- /* Only need dccph_dport & dccph_sport which are the first
+- * 4 bytes in dccp header.
++ /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x,
++ * which is in byte 7 of the dccp header.
+ * Our caller (icmpv6_notify()) already pulled 8 bytes for us.
++ *
++ * Later on, we want to access the sequence number fields, which are
++ * beyond 8 bytes, so we have to pskb_may_pull() ourselves.
+ */
+- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
+- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
++ dh = (struct dccp_hdr *)(skb->data + offset);
++ if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh)))
++ return;
++ hdr = (const struct ipv6hdr *)skb->data;
+ dh = (struct dccp_hdr *)(skb->data + offset);
+
+ sk = __inet6_lookup_established(net, &dccp_hashinfo,
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index a08acb54b6b00..7d82818b711ea 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -357,8 +357,9 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
+ struct flowi4 fl4;
+ int hlen = LL_RESERVED_SPACE(dev);
+ int tlen = dev->needed_tailroom;
+- unsigned int size = mtu;
++ unsigned int size;
+
++ size = min(mtu, IP_MAX_MTU);
+ while (1) {
+ skb = alloc_skb(size + hlen + tlen,
+ GFP_ATOMIC | __GFP_NOWARN);
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 92fa11e75a4d0..6936f703758bb 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -221,7 +221,7 @@ static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *s
+ if (lwtunnel_xmit_redirect(dst->lwtstate)) {
+ int res = lwtunnel_xmit(skb);
+
+- if (res < 0 || res == LWTUNNEL_XMIT_DONE)
++ if (res != LWTUNNEL_XMIT_CONTINUE)
+ return res;
+ }
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 281f7799aeafc..9e1ec69fe5b46 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -216,7 +216,7 @@ static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks)
+ icsk->icsk_ack.quick = quickacks;
+ }
+
+-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
++static void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
+ {
+ struct inet_connection_sock *icsk = inet_csk(sk);
+
+@@ -224,7 +224,6 @@ void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
+ icsk->icsk_ack.pingpong = 0;
+ icsk->icsk_ack.ato = TCP_ATO_MIN;
+ }
+-EXPORT_SYMBOL(tcp_enter_quickack_mode);
+
+ /* Send ACKs quickly, if "quick" count is not exhausted
+ * and the session is not interactive.
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 5c5c5736f6892..5ffa8777ab098 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1321,7 +1321,7 @@ retry:
+ * idev->desync_factor if it's larger
+ */
+ cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft);
+- max_desync_factor = min_t(__u32,
++ max_desync_factor = min_t(long,
+ idev->cnf.max_desync_factor,
+ cnf_temp_preferred_lft - regen_advance);
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 4f31a781ab370..ff4d349e13f78 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -106,7 +106,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
+ if (lwtunnel_xmit_redirect(dst->lwtstate)) {
+ int res = lwtunnel_xmit(skb);
+
+- if (res < 0 || res == LWTUNNEL_XMIT_DONE)
++ if (res != LWTUNNEL_XMIT_CONTINUE)
+ return res;
+ }
+
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
+index c0034546a9edf..a82892c288600 100644
+--- a/net/kcm/kcmsock.c
++++ b/net/kcm/kcmsock.c
+@@ -1065,15 +1065,18 @@ partial_message:
+ out_error:
+ kcm_push(kcm);
+
+- if (copied && sock->type == SOCK_SEQPACKET) {
++ if (sock->type == SOCK_SEQPACKET) {
+ /* Wrote some bytes before encountering an
+ * error, return partial success.
+ */
+- goto partial_message;
+- }
+-
+- if (head != kcm->seq_skb)
++ if (copied)
++ goto partial_message;
++ if (head != kcm->seq_skb)
++ kfree_skb(head);
++ } else {
+ kfree_skb(head);
++ kcm->seq_skb = NULL;
++ }
+
+ err = sk_stream_error(sk, msg->msg_flags, err);
+
+@@ -1983,6 +1986,8 @@ static __net_exit void kcm_exit_net(struct net *net)
+ * that all multiplexors and psocks have been destroyed.
+ */
+ WARN_ON(!list_empty(&knet->mux_list));
++
++ mutex_destroy(&knet->mutex);
+ }
+
+ static struct pernet_operations kcm_net_ops = {
+diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
+index 613e18e720a44..9290a4d7b862a 100644
+--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
++++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
+@@ -39,6 +39,7 @@ MODULE_ALIAS("ip_set_hash:net,port,net");
+ #define IP_SET_HASH_WITH_PROTO
+ #define IP_SET_HASH_WITH_NETS
+ #define IPSET_NET_COUNT 2
++#define IP_SET_HASH_WITH_NET0
+
+ /* IPv4 variant */
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index eeadb638f4483..0ff8f1006c6b9 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -5555,6 +5555,7 @@ void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
+ enum nft_trans_phase phase)
+ {
+ switch (phase) {
++ case NFT_TRANS_PREPARE_ERROR:
+ case NFT_TRANS_PREPARE:
+ case NFT_TRANS_ABORT:
+ case NFT_TRANS_RELEASE:
+diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
+index 21e4554c76955..f3676238e64f2 100644
+--- a/net/netfilter/nfnetlink_osf.c
++++ b/net/netfilter/nfnetlink_osf.c
+@@ -318,6 +318,14 @@ static int nfnl_osf_add_callback(struct net *net, struct sock *ctnl,
+
+ f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
+
++ if (f->opt_num > ARRAY_SIZE(f->opt))
++ return -EINVAL;
++
++ if (!memchr(f->genre, 0, MAXGENRELEN) ||
++ !memchr(f->subtype, 0, MAXGENRELEN) ||
++ !memchr(f->version, 0, MAXGENRELEN))
++ return -EINVAL;
++
+ kf = kmalloc(sizeof(struct nf_osf_finger), GFP_KERNEL);
+ if (!kf)
+ return -ENOMEM;
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 7055088e91c29..ec35a41c72624 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -197,9 +197,6 @@ static void nft_flow_offload_activate(const struct nft_ctx *ctx,
+ static void nft_flow_offload_destroy(const struct nft_ctx *ctx,
+ const struct nft_expr *expr)
+ {
+- struct nft_flow_offload *priv = nft_expr_priv(expr);
+-
+- priv->flowtable->use--;
+ nf_ct_netns_put(ctx->net, ctx->family);
+ }
+
+diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
+index 2d2fa1d53ea6b..05495d3f47b87 100644
+--- a/net/netfilter/xt_sctp.c
++++ b/net/netfilter/xt_sctp.c
+@@ -149,6 +149,8 @@ static int sctp_mt_check(const struct xt_mtchk_param *par)
+ {
+ const struct xt_sctp_info *info = par->matchinfo;
+
++ if (info->flag_count > ARRAY_SIZE(info->flag_info))
++ return -EINVAL;
+ if (info->flags & ~XT_SCTP_VALID_FLAGS)
+ return -EINVAL;
+ if (info->invflags & ~XT_SCTP_VALID_FLAGS)
+diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c
+index a95b50342dbb1..58ba402bc0b0a 100644
+--- a/net/netfilter/xt_u32.c
++++ b/net/netfilter/xt_u32.c
+@@ -95,11 +95,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par)
+ return ret ^ data->invert;
+ }
+
++static int u32_mt_checkentry(const struct xt_mtchk_param *par)
++{
++ const struct xt_u32 *data = par->matchinfo;
++ const struct xt_u32_test *ct;
++ unsigned int i;
++
++ if (data->ntests > ARRAY_SIZE(data->tests))
++ return -EINVAL;
++
++ for (i = 0; i < data->ntests; ++i) {
++ ct = &data->tests[i];
++
++ if (ct->nnums > ARRAY_SIZE(ct->location) ||
++ ct->nvalues > ARRAY_SIZE(ct->value))
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ static struct xt_match xt_u32_mt_reg __read_mostly = {
+ .name = "u32",
+ .revision = 0,
+ .family = NFPROTO_UNSPEC,
+ .match = u32_mt,
++ .checkentry = u32_mt_checkentry,
+ .matchsize = sizeof(struct xt_u32),
+ .me = THIS_MODULE,
+ };
+diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
+index 15fe2120b3109..14c3d640f94b9 100644
+--- a/net/netlabel/netlabel_kapi.c
++++ b/net/netlabel/netlabel_kapi.c
+@@ -871,7 +871,8 @@ int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap,
+
+ offset -= iter->startbit;
+ idx = offset / NETLBL_CATMAP_MAPSIZE;
+- iter->bitmap[idx] |= bitmap << (offset % NETLBL_CATMAP_MAPSIZE);
++ iter->bitmap[idx] |= (NETLBL_CATMAP_MAPTYPE)bitmap
++ << (offset % NETLBL_CATMAP_MAPSIZE);
+
+ return 0;
+ }
+diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
+index a5d819fa7c899..146550ce0ac6f 100644
+--- a/net/netrom/af_netrom.c
++++ b/net/netrom/af_netrom.c
+@@ -663,6 +663,11 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
+ goto out_release;
+ }
+
++ if (sock->state == SS_CONNECTING) {
++ err = -EALREADY;
++ goto out_release;
++ }
++
+ sk->sk_state = TCP_CLOSE;
+ sock->state = SS_UNCONNECTED;
+
+diff --git a/net/sched/Kconfig b/net/sched/Kconfig
+index 4547022ed7f4e..7698a8974a477 100644
+--- a/net/sched/Kconfig
++++ b/net/sched/Kconfig
+@@ -503,34 +503,6 @@ config CLS_U32_MARK
+ ---help---
+ Say Y here to be able to use netfilter marks as u32 key.
+
+-config NET_CLS_RSVP
+- tristate "IPv4 Resource Reservation Protocol (RSVP)"
+- select NET_CLS
+- ---help---
+- The Resource Reservation Protocol (RSVP) permits end systems to
+- request a minimum and maximum data flow rate for a connection; this
+- is important for real time data such as streaming sound or video.
+-
+- Say Y here if you want to be able to classify outgoing packets based
+- on their RSVP requests.
+-
+- To compile this code as a module, choose M here: the
+- module will be called cls_rsvp.
+-
+-config NET_CLS_RSVP6
+- tristate "IPv6 Resource Reservation Protocol (RSVP6)"
+- select NET_CLS
+- ---help---
+- The Resource Reservation Protocol (RSVP) permits end systems to
+- request a minimum and maximum data flow rate for a connection; this
+- is important for real time data such as streaming sound or video.
+-
+- Say Y here if you want to be able to classify outgoing packets based
+- on their RSVP requests and you are using the IPv6 protocol.
+-
+- To compile this code as a module, choose M here: the
+- module will be called cls_rsvp6.
+-
+ config NET_CLS_FLOW
+ tristate "Flow classifier"
+ select NET_CLS
+diff --git a/net/sched/Makefile b/net/sched/Makefile
+index 5eed580cdb422..3139c32e19478 100644
+--- a/net/sched/Makefile
++++ b/net/sched/Makefile
+@@ -61,8 +61,6 @@ obj-$(CONFIG_NET_SCH_ETF) += sch_etf.o
+ obj-$(CONFIG_NET_CLS_U32) += cls_u32.o
+ obj-$(CONFIG_NET_CLS_ROUTE4) += cls_route.o
+ obj-$(CONFIG_NET_CLS_FW) += cls_fw.o
+-obj-$(CONFIG_NET_CLS_RSVP) += cls_rsvp.o
+-obj-$(CONFIG_NET_CLS_RSVP6) += cls_rsvp6.o
+ obj-$(CONFIG_NET_CLS_BASIC) += cls_basic.o
+ obj-$(CONFIG_NET_CLS_FLOW) += cls_flow.o
+ obj-$(CONFIG_NET_CLS_CGROUP) += cls_cgroup.o
+diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
+index 5284a473c697f..f15089c24a32d 100644
+--- a/net/sched/cls_fw.c
++++ b/net/sched/cls_fw.c
+@@ -277,7 +277,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
+ return -ENOBUFS;
+
+ fnew->id = f->id;
+- fnew->res = f->res;
+ #ifdef CONFIG_NET_CLS_IND
+ fnew->ifindex = f->ifindex;
+ #endif /* CONFIG_NET_CLS_IND */
+diff --git a/net/sched/cls_rsvp.c b/net/sched/cls_rsvp.c
+deleted file mode 100644
+index cbb5e0d600f32..0000000000000
+--- a/net/sched/cls_rsvp.c
++++ /dev/null
+@@ -1,28 +0,0 @@
+-/*
+- * net/sched/cls_rsvp.c Special RSVP packet classifier for IPv4.
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License
+- * as published by the Free Software Foundation; either version
+- * 2 of the License, or (at your option) any later version.
+- *
+- * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
+- */
+-
+-#include <linux/module.h>
+-#include <linux/types.h>
+-#include <linux/kernel.h>
+-#include <linux/string.h>
+-#include <linux/errno.h>
+-#include <linux/skbuff.h>
+-#include <net/ip.h>
+-#include <net/netlink.h>
+-#include <net/act_api.h>
+-#include <net/pkt_cls.h>
+-
+-#define RSVP_DST_LEN 1
+-#define RSVP_ID "rsvp"
+-#define RSVP_OPS cls_rsvp_ops
+-
+-#include "cls_rsvp.h"
+-MODULE_LICENSE("GPL");
+diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
+deleted file mode 100644
+index eb1dd2afc5a12..0000000000000
+--- a/net/sched/cls_rsvp.h
++++ /dev/null
+@@ -1,775 +0,0 @@
+-/*
+- * net/sched/cls_rsvp.h Template file for RSVPv[46] classifiers.
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License
+- * as published by the Free Software Foundation; either version
+- * 2 of the License, or (at your option) any later version.
+- *
+- * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
+- */
+-
+-/*
+- Comparing to general packet classification problem,
+- RSVP needs only sevaral relatively simple rules:
+-
+- * (dst, protocol) are always specified,
+- so that we are able to hash them.
+- * src may be exact, or may be wildcard, so that
+- we can keep a hash table plus one wildcard entry.
+- * source port (or flow label) is important only if src is given.
+-
+- IMPLEMENTATION.
+-
+- We use a two level hash table: The top level is keyed by
+- destination address and protocol ID, every bucket contains a list
+- of "rsvp sessions", identified by destination address, protocol and
+- DPI(="Destination Port ID"): triple (key, mask, offset).
+-
+- Every bucket has a smaller hash table keyed by source address
+- (cf. RSVP flowspec) and one wildcard entry for wildcard reservations.
+- Every bucket is again a list of "RSVP flows", selected by
+- source address and SPI(="Source Port ID" here rather than
+- "security parameter index"): triple (key, mask, offset).
+-
+-
+- NOTE 1. All the packets with IPv6 extension headers (but AH and ESP)
+- and all fragmented packets go to the best-effort traffic class.
+-
+-
+- NOTE 2. Two "port id"'s seems to be redundant, rfc2207 requires
+- only one "Generalized Port Identifier". So that for classic
+- ah, esp (and udp,tcp) both *pi should coincide or one of them
+- should be wildcard.
+-
+- At first sight, this redundancy is just a waste of CPU
+- resources. But DPI and SPI add the possibility to assign different
+- priorities to GPIs. Look also at note 4 about tunnels below.
+-
+-
+- NOTE 3. One complication is the case of tunneled packets.
+- We implement it as following: if the first lookup
+- matches a special session with "tunnelhdr" value not zero,
+- flowid doesn't contain the true flow ID, but the tunnel ID (1...255).
+- In this case, we pull tunnelhdr bytes and restart lookup
+- with tunnel ID added to the list of keys. Simple and stupid 8)8)
+- It's enough for PIMREG and IPIP.
+-
+-
+- NOTE 4. Two GPIs make it possible to parse even GRE packets.
+- F.e. DPI can select ETH_P_IP (and necessary flags to make
+- tunnelhdr correct) in GRE protocol field and SPI matches
+- GRE key. Is it not nice? 8)8)
+-
+-
+- Well, as result, despite its simplicity, we get a pretty
+- powerful classification engine. */
+-
+-
+-struct rsvp_head {
+- u32 tmap[256/32];
+- u32 hgenerator;
+- u8 tgenerator;
+- struct rsvp_session __rcu *ht[256];
+- struct rcu_head rcu;
+-};
+-
+-struct rsvp_session {
+- struct rsvp_session __rcu *next;
+- __be32 dst[RSVP_DST_LEN];
+- struct tc_rsvp_gpi dpi;
+- u8 protocol;
+- u8 tunnelid;
+- /* 16 (src,sport) hash slots, and one wildcard source slot */
+- struct rsvp_filter __rcu *ht[16 + 1];
+- struct rcu_head rcu;
+-};
+-
+-
+-struct rsvp_filter {
+- struct rsvp_filter __rcu *next;
+- __be32 src[RSVP_DST_LEN];
+- struct tc_rsvp_gpi spi;
+- u8 tunnelhdr;
+-
+- struct tcf_result res;
+- struct tcf_exts exts;
+-
+- u32 handle;
+- struct rsvp_session *sess;
+- struct rcu_work rwork;
+-};
+-
+-static inline unsigned int hash_dst(__be32 *dst, u8 protocol, u8 tunnelid)
+-{
+- unsigned int h = (__force __u32)dst[RSVP_DST_LEN - 1];
+-
+- h ^= h>>16;
+- h ^= h>>8;
+- return (h ^ protocol ^ tunnelid) & 0xFF;
+-}
+-
+-static inline unsigned int hash_src(__be32 *src)
+-{
+- unsigned int h = (__force __u32)src[RSVP_DST_LEN-1];
+-
+- h ^= h>>16;
+- h ^= h>>8;
+- h ^= h>>4;
+- return h & 0xF;
+-}
+-
+-#define RSVP_APPLY_RESULT() \
+-{ \
+- int r = tcf_exts_exec(skb, &f->exts, res); \
+- if (r < 0) \
+- continue; \
+- else if (r > 0) \
+- return r; \
+-}
+-
+-static int rsvp_classify(struct sk_buff *skb, const struct tcf_proto *tp,
+- struct tcf_result *res)
+-{
+- struct rsvp_head *head = rcu_dereference_bh(tp->root);
+- struct rsvp_session *s;
+- struct rsvp_filter *f;
+- unsigned int h1, h2;
+- __be32 *dst, *src;
+- u8 protocol;
+- u8 tunnelid = 0;
+- u8 *xprt;
+-#if RSVP_DST_LEN == 4
+- struct ipv6hdr *nhptr;
+-
+- if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
+- return -1;
+- nhptr = ipv6_hdr(skb);
+-#else
+- struct iphdr *nhptr;
+-
+- if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
+- return -1;
+- nhptr = ip_hdr(skb);
+-#endif
+-restart:
+-
+-#if RSVP_DST_LEN == 4
+- src = &nhptr->saddr.s6_addr32[0];
+- dst = &nhptr->daddr.s6_addr32[0];
+- protocol = nhptr->nexthdr;
+- xprt = ((u8 *)nhptr) + sizeof(struct ipv6hdr);
+-#else
+- src = &nhptr->saddr;
+- dst = &nhptr->daddr;
+- protocol = nhptr->protocol;
+- xprt = ((u8 *)nhptr) + (nhptr->ihl<<2);
+- if (ip_is_fragment(nhptr))
+- return -1;
+-#endif
+-
+- h1 = hash_dst(dst, protocol, tunnelid);
+- h2 = hash_src(src);
+-
+- for (s = rcu_dereference_bh(head->ht[h1]); s;
+- s = rcu_dereference_bh(s->next)) {
+- if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN - 1] &&
+- protocol == s->protocol &&
+- !(s->dpi.mask &
+- (*(u32 *)(xprt + s->dpi.offset) ^ s->dpi.key)) &&
+-#if RSVP_DST_LEN == 4
+- dst[0] == s->dst[0] &&
+- dst[1] == s->dst[1] &&
+- dst[2] == s->dst[2] &&
+-#endif
+- tunnelid == s->tunnelid) {
+-
+- for (f = rcu_dereference_bh(s->ht[h2]); f;
+- f = rcu_dereference_bh(f->next)) {
+- if (src[RSVP_DST_LEN-1] == f->src[RSVP_DST_LEN - 1] &&
+- !(f->spi.mask & (*(u32 *)(xprt + f->spi.offset) ^ f->spi.key))
+-#if RSVP_DST_LEN == 4
+- &&
+- src[0] == f->src[0] &&
+- src[1] == f->src[1] &&
+- src[2] == f->src[2]
+-#endif
+- ) {
+- *res = f->res;
+- RSVP_APPLY_RESULT();
+-
+-matched:
+- if (f->tunnelhdr == 0)
+- return 0;
+-
+- tunnelid = f->res.classid;
+- nhptr = (void *)(xprt + f->tunnelhdr - sizeof(*nhptr));
+- goto restart;
+- }
+- }
+-
+- /* And wildcard bucket... */
+- for (f = rcu_dereference_bh(s->ht[16]); f;
+- f = rcu_dereference_bh(f->next)) {
+- *res = f->res;
+- RSVP_APPLY_RESULT();
+- goto matched;
+- }
+- return -1;
+- }
+- }
+- return -1;
+-}
+-
+-static void rsvp_replace(struct tcf_proto *tp, struct rsvp_filter *n, u32 h)
+-{
+- struct rsvp_head *head = rtnl_dereference(tp->root);
+- struct rsvp_session *s;
+- struct rsvp_filter __rcu **ins;
+- struct rsvp_filter *pins;
+- unsigned int h1 = h & 0xFF;
+- unsigned int h2 = (h >> 8) & 0xFF;
+-
+- for (s = rtnl_dereference(head->ht[h1]); s;
+- s = rtnl_dereference(s->next)) {
+- for (ins = &s->ht[h2], pins = rtnl_dereference(*ins); ;
+- ins = &pins->next, pins = rtnl_dereference(*ins)) {
+- if (pins->handle == h) {
+- RCU_INIT_POINTER(n->next, pins->next);
+- rcu_assign_pointer(*ins, n);
+- return;
+- }
+- }
+- }
+-
+- /* Something went wrong if we are trying to replace a non-existant
+- * node. Mind as well halt instead of silently failing.
+- */
+- BUG_ON(1);
+-}
+-
+-static void *rsvp_get(struct tcf_proto *tp, u32 handle)
+-{
+- struct rsvp_head *head = rtnl_dereference(tp->root);
+- struct rsvp_session *s;
+- struct rsvp_filter *f;
+- unsigned int h1 = handle & 0xFF;
+- unsigned int h2 = (handle >> 8) & 0xFF;
+-
+- if (h2 > 16)
+- return NULL;
+-
+- for (s = rtnl_dereference(head->ht[h1]); s;
+- s = rtnl_dereference(s->next)) {
+- for (f = rtnl_dereference(s->ht[h2]); f;
+- f = rtnl_dereference(f->next)) {
+- if (f->handle == handle)
+- return f;
+- }
+- }
+- return NULL;
+-}
+-
+-static int rsvp_init(struct tcf_proto *tp)
+-{
+- struct rsvp_head *data;
+-
+- data = kzalloc(sizeof(struct rsvp_head), GFP_KERNEL);
+- if (data) {
+- rcu_assign_pointer(tp->root, data);
+- return 0;
+- }
+- return -ENOBUFS;
+-}
+-
+-static void __rsvp_delete_filter(struct rsvp_filter *f)
+-{
+- tcf_exts_destroy(&f->exts);
+- tcf_exts_put_net(&f->exts);
+- kfree(f);
+-}
+-
+-static void rsvp_delete_filter_work(struct work_struct *work)
+-{
+- struct rsvp_filter *f = container_of(to_rcu_work(work),
+- struct rsvp_filter,
+- rwork);
+- rtnl_lock();
+- __rsvp_delete_filter(f);
+- rtnl_unlock();
+-}
+-
+-static void rsvp_delete_filter(struct tcf_proto *tp, struct rsvp_filter *f)
+-{
+- tcf_unbind_filter(tp, &f->res);
+- /* all classifiers are required to call tcf_exts_destroy() after rcu
+- * grace period, since converted-to-rcu actions are relying on that
+- * in cleanup() callback
+- */
+- if (tcf_exts_get_net(&f->exts))
+- tcf_queue_work(&f->rwork, rsvp_delete_filter_work);
+- else
+- __rsvp_delete_filter(f);
+-}
+-
+-static void rsvp_destroy(struct tcf_proto *tp, struct netlink_ext_ack *extack)
+-{
+- struct rsvp_head *data = rtnl_dereference(tp->root);
+- int h1, h2;
+-
+- if (data == NULL)
+- return;
+-
+- for (h1 = 0; h1 < 256; h1++) {
+- struct rsvp_session *s;
+-
+- while ((s = rtnl_dereference(data->ht[h1])) != NULL) {
+- RCU_INIT_POINTER(data->ht[h1], s->next);
+-
+- for (h2 = 0; h2 <= 16; h2++) {
+- struct rsvp_filter *f;
+-
+- while ((f = rtnl_dereference(s->ht[h2])) != NULL) {
+- rcu_assign_pointer(s->ht[h2], f->next);
+- rsvp_delete_filter(tp, f);
+- }
+- }
+- kfree_rcu(s, rcu);
+- }
+- }
+- kfree_rcu(data, rcu);
+-}
+-
+-static int rsvp_delete(struct tcf_proto *tp, void *arg, bool *last,
+- struct netlink_ext_ack *extack)
+-{
+- struct rsvp_head *head = rtnl_dereference(tp->root);
+- struct rsvp_filter *nfp, *f = arg;
+- struct rsvp_filter __rcu **fp;
+- unsigned int h = f->handle;
+- struct rsvp_session __rcu **sp;
+- struct rsvp_session *nsp, *s = f->sess;
+- int i, h1;
+-
+- fp = &s->ht[(h >> 8) & 0xFF];
+- for (nfp = rtnl_dereference(*fp); nfp;
+- fp = &nfp->next, nfp = rtnl_dereference(*fp)) {
+- if (nfp == f) {
+- RCU_INIT_POINTER(*fp, f->next);
+- rsvp_delete_filter(tp, f);
+-
+- /* Strip tree */
+-
+- for (i = 0; i <= 16; i++)
+- if (s->ht[i])
+- goto out;
+-
+- /* OK, session has no flows */
+- sp = &head->ht[h & 0xFF];
+- for (nsp = rtnl_dereference(*sp); nsp;
+- sp = &nsp->next, nsp = rtnl_dereference(*sp)) {
+- if (nsp == s) {
+- RCU_INIT_POINTER(*sp, s->next);
+- kfree_rcu(s, rcu);
+- goto out;
+- }
+- }
+-
+- break;
+- }
+- }
+-
+-out:
+- *last = true;
+- for (h1 = 0; h1 < 256; h1++) {
+- if (rcu_access_pointer(head->ht[h1])) {
+- *last = false;
+- break;
+- }
+- }
+-
+- return 0;
+-}
+-
+-static unsigned int gen_handle(struct tcf_proto *tp, unsigned salt)
+-{
+- struct rsvp_head *data = rtnl_dereference(tp->root);
+- int i = 0xFFFF;
+-
+- while (i-- > 0) {
+- u32 h;
+-
+- if ((data->hgenerator += 0x10000) == 0)
+- data->hgenerator = 0x10000;
+- h = data->hgenerator|salt;
+- if (!rsvp_get(tp, h))
+- return h;
+- }
+- return 0;
+-}
+-
+-static int tunnel_bts(struct rsvp_head *data)
+-{
+- int n = data->tgenerator >> 5;
+- u32 b = 1 << (data->tgenerator & 0x1F);
+-
+- if (data->tmap[n] & b)
+- return 0;
+- data->tmap[n] |= b;
+- return 1;
+-}
+-
+-static void tunnel_recycle(struct rsvp_head *data)
+-{
+- struct rsvp_session __rcu **sht = data->ht;
+- u32 tmap[256/32];
+- int h1, h2;
+-
+- memset(tmap, 0, sizeof(tmap));
+-
+- for (h1 = 0; h1 < 256; h1++) {
+- struct rsvp_session *s;
+- for (s = rtnl_dereference(sht[h1]); s;
+- s = rtnl_dereference(s->next)) {
+- for (h2 = 0; h2 <= 16; h2++) {
+- struct rsvp_filter *f;
+-
+- for (f = rtnl_dereference(s->ht[h2]); f;
+- f = rtnl_dereference(f->next)) {
+- if (f->tunnelhdr == 0)
+- continue;
+- data->tgenerator = f->res.classid;
+- tunnel_bts(data);
+- }
+- }
+- }
+- }
+-
+- memcpy(data->tmap, tmap, sizeof(tmap));
+-}
+-
+-static u32 gen_tunnel(struct rsvp_head *data)
+-{
+- int i, k;
+-
+- for (k = 0; k < 2; k++) {
+- for (i = 255; i > 0; i--) {
+- if (++data->tgenerator == 0)
+- data->tgenerator = 1;
+- if (tunnel_bts(data))
+- return data->tgenerator;
+- }
+- tunnel_recycle(data);
+- }
+- return 0;
+-}
+-
+-static const struct nla_policy rsvp_policy[TCA_RSVP_MAX + 1] = {
+- [TCA_RSVP_CLASSID] = { .type = NLA_U32 },
+- [TCA_RSVP_DST] = { .len = RSVP_DST_LEN * sizeof(u32) },
+- [TCA_RSVP_SRC] = { .len = RSVP_DST_LEN * sizeof(u32) },
+- [TCA_RSVP_PINFO] = { .len = sizeof(struct tc_rsvp_pinfo) },
+-};
+-
+-static int rsvp_change(struct net *net, struct sk_buff *in_skb,
+- struct tcf_proto *tp, unsigned long base,
+- u32 handle,
+- struct nlattr **tca,
+- void **arg, bool ovr, struct netlink_ext_ack *extack)
+-{
+- struct rsvp_head *data = rtnl_dereference(tp->root);
+- struct rsvp_filter *f, *nfp;
+- struct rsvp_filter __rcu **fp;
+- struct rsvp_session *nsp, *s;
+- struct rsvp_session __rcu **sp;
+- struct tc_rsvp_pinfo *pinfo = NULL;
+- struct nlattr *opt = tca[TCA_OPTIONS];
+- struct nlattr *tb[TCA_RSVP_MAX + 1];
+- struct tcf_exts e;
+- unsigned int h1, h2;
+- __be32 *dst;
+- int err;
+-
+- if (opt == NULL)
+- return handle ? -EINVAL : 0;
+-
+- err = nla_parse_nested(tb, TCA_RSVP_MAX, opt, rsvp_policy, NULL);
+- if (err < 0)
+- return err;
+-
+- err = tcf_exts_init(&e, TCA_RSVP_ACT, TCA_RSVP_POLICE);
+- if (err < 0)
+- return err;
+- err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, ovr, extack);
+- if (err < 0)
+- goto errout2;
+-
+- f = *arg;
+- if (f) {
+- /* Node exists: adjust only classid */
+- struct rsvp_filter *n;
+-
+- if (f->handle != handle && handle)
+- goto errout2;
+-
+- n = kmemdup(f, sizeof(*f), GFP_KERNEL);
+- if (!n) {
+- err = -ENOMEM;
+- goto errout2;
+- }
+-
+- err = tcf_exts_init(&n->exts, TCA_RSVP_ACT, TCA_RSVP_POLICE);
+- if (err < 0) {
+- kfree(n);
+- goto errout2;
+- }
+-
+- if (tb[TCA_RSVP_CLASSID]) {
+- n->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]);
+- tcf_bind_filter(tp, &n->res, base);
+- }
+-
+- tcf_exts_change(&n->exts, &e);
+- rsvp_replace(tp, n, handle);
+- return 0;
+- }
+-
+- /* Now more serious part... */
+- err = -EINVAL;
+- if (handle)
+- goto errout2;
+- if (tb[TCA_RSVP_DST] == NULL)
+- goto errout2;
+-
+- err = -ENOBUFS;
+- f = kzalloc(sizeof(struct rsvp_filter), GFP_KERNEL);
+- if (f == NULL)
+- goto errout2;
+-
+- err = tcf_exts_init(&f->exts, TCA_RSVP_ACT, TCA_RSVP_POLICE);
+- if (err < 0)
+- goto errout;
+- h2 = 16;
+- if (tb[TCA_RSVP_SRC]) {
+- memcpy(f->src, nla_data(tb[TCA_RSVP_SRC]), sizeof(f->src));
+- h2 = hash_src(f->src);
+- }
+- if (tb[TCA_RSVP_PINFO]) {
+- pinfo = nla_data(tb[TCA_RSVP_PINFO]);
+- f->spi = pinfo->spi;
+- f->tunnelhdr = pinfo->tunnelhdr;
+- }
+- if (tb[TCA_RSVP_CLASSID])
+- f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID]);
+-
+- dst = nla_data(tb[TCA_RSVP_DST]);
+- h1 = hash_dst(dst, pinfo ? pinfo->protocol : 0, pinfo ? pinfo->tunnelid : 0);
+-
+- err = -ENOMEM;
+- if ((f->handle = gen_handle(tp, h1 | (h2<<8))) == 0)
+- goto errout;
+-
+- if (f->tunnelhdr) {
+- err = -EINVAL;
+- if (f->res.classid > 255)
+- goto errout;
+-
+- err = -ENOMEM;
+- if (f->res.classid == 0 &&
+- (f->res.classid = gen_tunnel(data)) == 0)
+- goto errout;
+- }
+-
+- for (sp = &data->ht[h1];
+- (s = rtnl_dereference(*sp)) != NULL;
+- sp = &s->next) {
+- if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] &&
+- pinfo && pinfo->protocol == s->protocol &&
+- memcmp(&pinfo->dpi, &s->dpi, sizeof(s->dpi)) == 0 &&
+-#if RSVP_DST_LEN == 4
+- dst[0] == s->dst[0] &&
+- dst[1] == s->dst[1] &&
+- dst[2] == s->dst[2] &&
+-#endif
+- pinfo->tunnelid == s->tunnelid) {
+-
+-insert:
+- /* OK, we found appropriate session */
+-
+- fp = &s->ht[h2];
+-
+- f->sess = s;
+- if (f->tunnelhdr == 0)
+- tcf_bind_filter(tp, &f->res, base);
+-
+- tcf_exts_change(&f->exts, &e);
+-
+- fp = &s->ht[h2];
+- for (nfp = rtnl_dereference(*fp); nfp;
+- fp = &nfp->next, nfp = rtnl_dereference(*fp)) {
+- __u32 mask = nfp->spi.mask & f->spi.mask;
+-
+- if (mask != f->spi.mask)
+- break;
+- }
+- RCU_INIT_POINTER(f->next, nfp);
+- rcu_assign_pointer(*fp, f);
+-
+- *arg = f;
+- return 0;
+- }
+- }
+-
+- /* No session found. Create new one. */
+-
+- err = -ENOBUFS;
+- s = kzalloc(sizeof(struct rsvp_session), GFP_KERNEL);
+- if (s == NULL)
+- goto errout;
+- memcpy(s->dst, dst, sizeof(s->dst));
+-
+- if (pinfo) {
+- s->dpi = pinfo->dpi;
+- s->protocol = pinfo->protocol;
+- s->tunnelid = pinfo->tunnelid;
+- }
+- sp = &data->ht[h1];
+- for (nsp = rtnl_dereference(*sp); nsp;
+- sp = &nsp->next, nsp = rtnl_dereference(*sp)) {
+- if ((nsp->dpi.mask & s->dpi.mask) != s->dpi.mask)
+- break;
+- }
+- RCU_INIT_POINTER(s->next, nsp);
+- rcu_assign_pointer(*sp, s);
+-
+- goto insert;
+-
+-errout:
+- tcf_exts_destroy(&f->exts);
+- kfree(f);
+-errout2:
+- tcf_exts_destroy(&e);
+- return err;
+-}
+-
+-static void rsvp_walk(struct tcf_proto *tp, struct tcf_walker *arg)
+-{
+- struct rsvp_head *head = rtnl_dereference(tp->root);
+- unsigned int h, h1;
+-
+- if (arg->stop)
+- return;
+-
+- for (h = 0; h < 256; h++) {
+- struct rsvp_session *s;
+-
+- for (s = rtnl_dereference(head->ht[h]); s;
+- s = rtnl_dereference(s->next)) {
+- for (h1 = 0; h1 <= 16; h1++) {
+- struct rsvp_filter *f;
+-
+- for (f = rtnl_dereference(s->ht[h1]); f;
+- f = rtnl_dereference(f->next)) {
+- if (arg->count < arg->skip) {
+- arg->count++;
+- continue;
+- }
+- if (arg->fn(tp, f, arg) < 0) {
+- arg->stop = 1;
+- return;
+- }
+- arg->count++;
+- }
+- }
+- }
+- }
+-}
+-
+-static int rsvp_dump(struct net *net, struct tcf_proto *tp, void *fh,
+- struct sk_buff *skb, struct tcmsg *t)
+-{
+- struct rsvp_filter *f = fh;
+- struct rsvp_session *s;
+- struct nlattr *nest;
+- struct tc_rsvp_pinfo pinfo;
+-
+- if (f == NULL)
+- return skb->len;
+- s = f->sess;
+-
+- t->tcm_handle = f->handle;
+-
+- nest = nla_nest_start(skb, TCA_OPTIONS);
+- if (nest == NULL)
+- goto nla_put_failure;
+-
+- if (nla_put(skb, TCA_RSVP_DST, sizeof(s->dst), &s->dst))
+- goto nla_put_failure;
+- pinfo.dpi = s->dpi;
+- pinfo.spi = f->spi;
+- pinfo.protocol = s->protocol;
+- pinfo.tunnelid = s->tunnelid;
+- pinfo.tunnelhdr = f->tunnelhdr;
+- pinfo.pad = 0;
+- if (nla_put(skb, TCA_RSVP_PINFO, sizeof(pinfo), &pinfo))
+- goto nla_put_failure;
+- if (f->res.classid &&
+- nla_put_u32(skb, TCA_RSVP_CLASSID, f->res.classid))
+- goto nla_put_failure;
+- if (((f->handle >> 8) & 0xFF) != 16 &&
+- nla_put(skb, TCA_RSVP_SRC, sizeof(f->src), f->src))
+- goto nla_put_failure;
+-
+- if (tcf_exts_dump(skb, &f->exts) < 0)
+- goto nla_put_failure;
+-
+- nla_nest_end(skb, nest);
+-
+- if (tcf_exts_dump_stats(skb, &f->exts) < 0)
+- goto nla_put_failure;
+- return skb->len;
+-
+-nla_put_failure:
+- nla_nest_cancel(skb, nest);
+- return -1;
+-}
+-
+-static void rsvp_bind_class(void *fh, u32 classid, unsigned long cl, void *q,
+- unsigned long base)
+-{
+- struct rsvp_filter *f = fh;
+-
+- if (f && f->res.classid == classid) {
+- if (cl)
+- __tcf_bind_filter(q, &f->res, base);
+- else
+- __tcf_unbind_filter(q, &f->res);
+- }
+-}
+-
+-static struct tcf_proto_ops RSVP_OPS __read_mostly = {
+- .kind = RSVP_ID,
+- .classify = rsvp_classify,
+- .init = rsvp_init,
+- .destroy = rsvp_destroy,
+- .get = rsvp_get,
+- .change = rsvp_change,
+- .delete = rsvp_delete,
+- .walk = rsvp_walk,
+- .dump = rsvp_dump,
+- .bind_class = rsvp_bind_class,
+- .owner = THIS_MODULE,
+-};
+-
+-static int __init init_rsvp(void)
+-{
+- return register_tcf_proto_ops(&RSVP_OPS);
+-}
+-
+-static void __exit exit_rsvp(void)
+-{
+- unregister_tcf_proto_ops(&RSVP_OPS);
+-}
+-
+-module_init(init_rsvp)
+-module_exit(exit_rsvp)
+diff --git a/net/sched/cls_rsvp6.c b/net/sched/cls_rsvp6.c
+deleted file mode 100644
+index dd08aea2aee52..0000000000000
+--- a/net/sched/cls_rsvp6.c
++++ /dev/null
+@@ -1,28 +0,0 @@
+-/*
+- * net/sched/cls_rsvp6.c Special RSVP packet classifier for IPv6.
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public License
+- * as published by the Free Software Foundation; either version
+- * 2 of the License, or (at your option) any later version.
+- *
+- * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
+- */
+-
+-#include <linux/module.h>
+-#include <linux/types.h>
+-#include <linux/kernel.h>
+-#include <linux/string.h>
+-#include <linux/errno.h>
+-#include <linux/ipv6.h>
+-#include <linux/skbuff.h>
+-#include <net/act_api.h>
+-#include <net/pkt_cls.h>
+-#include <net/netlink.h>
+-
+-#define RSVP_DST_LEN 4
+-#define RSVP_ID "rsvp6"
+-#define RSVP_OPS cls_rsvp6_ops
+-
+-#include "cls_rsvp.h"
+-MODULE_LICENSE("GPL");
+diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
+index b18ec1f6de60c..fa3d2fd4990ce 100644
+--- a/net/sched/sch_hfsc.c
++++ b/net/sched/sch_hfsc.c
+@@ -1021,6 +1021,10 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
+ if (parent == NULL)
+ return -ENOENT;
+ }
++ if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) {
++ NL_SET_ERR_MSG(extack, "Invalid parent - parent class must have FSC");
++ return -EINVAL;
++ }
+
+ if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0)
+ return -EINVAL;
+diff --git a/net/sched/sch_plug.c b/net/sched/sch_plug.c
+index 5619d2eb17b69..4ddb4af61d103 100644
+--- a/net/sched/sch_plug.c
++++ b/net/sched/sch_plug.c
+@@ -214,7 +214,7 @@ static struct Qdisc_ops plug_qdisc_ops __read_mostly = {
+ .priv_size = sizeof(struct plug_sched_data),
+ .enqueue = plug_enqueue,
+ .dequeue = plug_dequeue,
+- .peek = qdisc_peek_head,
++ .peek = qdisc_peek_dequeued,
+ .init = plug_init,
+ .change = plug_change,
+ .reset = qdisc_reset_queue,
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index e9420ca261d61..4f246599734eb 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -988,10 +988,13 @@ static void qfq_update_eligible(struct qfq_sched *q)
+ }
+
+ /* Dequeue head packet of the head class in the DRR queue of the aggregate. */
+-static void agg_dequeue(struct qfq_aggregate *agg,
+- struct qfq_class *cl, unsigned int len)
++static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg,
++ struct qfq_class *cl, unsigned int len)
+ {
+- qdisc_dequeue_peeked(cl->qdisc);
++ struct sk_buff *skb = qdisc_dequeue_peeked(cl->qdisc);
++
++ if (!skb)
++ return NULL;
+
+ cl->deficit -= (int) len;
+
+@@ -1001,6 +1004,8 @@ static void agg_dequeue(struct qfq_aggregate *agg,
+ cl->deficit += agg->lmax;
+ list_move_tail(&cl->alist, &agg->active);
+ }
++
++ return skb;
+ }
+
+ static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg,
+@@ -1146,11 +1151,18 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
+ if (!skb)
+ return NULL;
+
+- qdisc_qstats_backlog_dec(sch, skb);
+ sch->q.qlen--;
++
++ skb = agg_dequeue(in_serv_agg, cl, len);
++
++ if (!skb) {
++ sch->q.qlen++;
++ return NULL;
++ }
++
++ qdisc_qstats_backlog_dec(sch, skb);
+ qdisc_bstats_update(sch, skb);
+
+- agg_dequeue(in_serv_agg, cl, len);
+ /* If lmax is lowered, through qfq_change_class, for a class
+ * owning pending packets with larger size than the new value
+ * of lmax, then the following condition may hold.
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 82d96441e64d6..c4a2d647e6cc7 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -1255,7 +1255,10 @@ static int sctp_side_effects(enum sctp_event event_type,
+ default:
+ pr_err("impossible disposition %d in state %d, event_type %d, event_id %d\n",
+ status, state, event_type, subtype.chunk);
+- BUG();
++ error = status;
++ if (error >= 0)
++ error = -EINVAL;
++ WARN_ON_ONCE(1);
+ break;
+ }
+
+diff --git a/net/socket.c b/net/socket.c
+index ce70c01eb2f3e..db9d908198f21 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -3468,7 +3468,11 @@ EXPORT_SYMBOL(kernel_accept);
+ int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
+ int flags)
+ {
+- return sock->ops->connect(sock, addr, addrlen, flags);
++ struct sockaddr_storage address;
++
++ memcpy(&address, addr, addrlen);
++
++ return sock->ops->connect(sock, (struct sockaddr *)&address, addrlen, flags);
+ }
+ EXPORT_SYMBOL(kernel_connect);
+
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 402060cf3198c..0632b494d329b 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -594,7 +594,7 @@ static void unix_release_sock(struct sock *sk, int embrion)
+ * What the above comment does talk about? --ANK(980817)
+ */
+
+- if (unix_tot_inflight)
++ if (READ_ONCE(unix_tot_inflight))
+ unix_gc(); /* Garbage collect fds */
+ }
+
+diff --git a/net/unix/scm.c b/net/unix/scm.c
+index a07b2efbf8b5e..ac206bfdbbe3c 100644
+--- a/net/unix/scm.c
++++ b/net/unix/scm.c
+@@ -59,7 +59,7 @@ void unix_inflight(struct user_struct *user, struct file *fp)
+ /* Paired with READ_ONCE() in wait_for_unix_gc() */
+ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1);
+ }
+- user->unix_inflight++;
++ WRITE_ONCE(user->unix_inflight, user->unix_inflight + 1);
+ spin_unlock(&unix_gc_lock);
+ }
+
+@@ -80,7 +80,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp)
+ /* Paired with READ_ONCE() in wait_for_unix_gc() */
+ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1);
+ }
+- user->unix_inflight--;
++ WRITE_ONCE(user->unix_inflight, user->unix_inflight - 1);
+ spin_unlock(&unix_gc_lock);
+ }
+
+@@ -94,7 +94,7 @@ static inline bool too_many_unix_fds(struct task_struct *p)
+ {
+ struct user_struct *user = current_user();
+
+- if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
++ if (unlikely(READ_ONCE(user->unix_inflight) > task_rlimit(p, RLIMIT_NOFILE)))
+ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
+ return false;
+ }
+diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
+index 8c7e51a6273cc..0b0d6ed3eeb91 100644
+--- a/scripts/kconfig/preprocess.c
++++ b/scripts/kconfig/preprocess.c
+@@ -393,6 +393,9 @@ static char *eval_clause(const char *str, size_t len, int argc, char *argv[])
+
+ p++;
+ }
++
++ if (new_argc >= FUNCTION_MAX_ARGS)
++ pperror("too many function arguments");
+ new_argv[new_argc++] = prev;
+
+ /*
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index 9394d72a77e80..9e52a3e0fc672 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -922,14 +922,19 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group)
+ ret = -EACCES;
+ down_write(&key->sem);
+
+- if (!capable(CAP_SYS_ADMIN)) {
++ {
++ bool is_privileged_op = false;
++
+ /* only the sysadmin can chown a key to some other UID */
+ if (user != (uid_t) -1 && !uid_eq(key->uid, uid))
+- goto error_put;
++ is_privileged_op = true;
+
+ /* only the sysadmin can set the key's GID to a group other
+ * than one of those that the current process subscribes to */
+ if (group != (gid_t) -1 && !gid_eq(gid, key->gid) && !in_group_p(gid))
++ is_privileged_op = true;
++
++ if (is_privileged_op && !capable(CAP_SYS_ADMIN))
+ goto error_put;
+ }
+
+@@ -1029,7 +1034,7 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
+ down_write(&key->sem);
+
+ /* if we're not the sysadmin, we can only change a key that we own */
+- if (capable(CAP_SYS_ADMIN) || uid_eq(key->uid, current_fsuid())) {
++ if (uid_eq(key->uid, current_fsuid()) || capable(CAP_SYS_ADMIN)) {
+ key->perm = perm;
+ ret = 0;
+ }
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index a9c516362170a..61e734baa332a 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -923,7 +923,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
+ }
+
+ ret = sscanf(rule, "%d", &catlen);
+- if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
++ if (ret != 1 || catlen < 0 || catlen > SMACK_CIPSO_MAXCATNUM)
+ goto out;
+
+ if (format == SMK_FIXED24_FMT &&
+diff --git a/sound/Kconfig b/sound/Kconfig
+index 1140e9988fc50..76febc37862de 100644
+--- a/sound/Kconfig
++++ b/sound/Kconfig
+@@ -1,6 +1,6 @@
+ menuconfig SOUND
+ tristate "Sound card support"
+- depends on HAS_IOMEM
++ depends on HAS_IOMEM || UML
+ help
+ If you have a sound card in your computer, i.e. if it can say more
+ than an occasional beep, say Y.
+diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
+index 946ab080ac003..7c5799fecfa14 100644
+--- a/sound/core/pcm_compat.c
++++ b/sound/core/pcm_compat.c
+@@ -329,10 +329,14 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream,
+ goto error;
+ }
+
+- if (refine)
++ if (refine) {
+ err = snd_pcm_hw_refine(substream, data);
+- else
++ if (err < 0)
++ goto error;
++ err = fixup_unreferenced_params(substream, data);
++ } else {
+ err = snd_pcm_hw_params(substream, data);
++ }
+ if (err < 0)
+ goto error;
+ if (copy_to_user(data32, data, sizeof(*data32)) ||
+diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
+index 838c3c8b403cb..2ddfd6fed122e 100644
+--- a/sound/core/seq/oss/seq_oss_midi.c
++++ b/sound/core/seq/oss/seq_oss_midi.c
+@@ -50,6 +50,7 @@ struct seq_oss_midi {
+ struct snd_midi_event *coder; /* MIDI event coder */
+ struct seq_oss_devinfo *devinfo; /* assigned OSSseq device */
+ snd_use_lock_t use_lock;
++ struct mutex open_mutex;
+ };
+
+
+@@ -184,6 +185,7 @@ snd_seq_oss_midi_check_new_port(struct snd_seq_port_info *pinfo)
+ mdev->flags = pinfo->capability;
+ mdev->opened = 0;
+ snd_use_lock_init(&mdev->use_lock);
++ mutex_init(&mdev->open_mutex);
+
+ /* copy and truncate the name of synth device */
+ strlcpy(mdev->name, pinfo->name, sizeof(mdev->name));
+@@ -332,14 +334,16 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
+ int perm;
+ struct seq_oss_midi *mdev;
+ struct snd_seq_port_subscribe subs;
++ int err;
+
+ if ((mdev = get_mididev(dp, dev)) == NULL)
+ return -ENODEV;
+
++ mutex_lock(&mdev->open_mutex);
+ /* already used? */
+ if (mdev->opened && mdev->devinfo != dp) {
+- snd_use_lock_free(&mdev->use_lock);
+- return -EBUSY;
++ err = -EBUSY;
++ goto unlock;
+ }
+
+ perm = 0;
+@@ -349,14 +353,14 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
+ perm |= PERM_READ;
+ perm &= mdev->flags;
+ if (perm == 0) {
+- snd_use_lock_free(&mdev->use_lock);
+- return -ENXIO;
++ err = -ENXIO;
++ goto unlock;
+ }
+
+ /* already opened? */
+ if ((mdev->opened & perm) == perm) {
+- snd_use_lock_free(&mdev->use_lock);
+- return 0;
++ err = 0;
++ goto unlock;
+ }
+
+ perm &= ~mdev->opened;
+@@ -381,13 +385,17 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
+ }
+
+ if (! mdev->opened) {
+- snd_use_lock_free(&mdev->use_lock);
+- return -ENXIO;
++ err = -ENXIO;
++ goto unlock;
+ }
+
+ mdev->devinfo = dp;
++ err = 0;
++
++ unlock:
++ mutex_unlock(&mdev->open_mutex);
+ snd_use_lock_free(&mdev->use_lock);
+- return 0;
++ return err;
+ }
+
+ /*
+@@ -401,10 +409,9 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
+
+ if ((mdev = get_mididev(dp, dev)) == NULL)
+ return -ENODEV;
+- if (! mdev->opened || mdev->devinfo != dp) {
+- snd_use_lock_free(&mdev->use_lock);
+- return 0;
+- }
++ mutex_lock(&mdev->open_mutex);
++ if (!mdev->opened || mdev->devinfo != dp)
++ goto unlock;
+
+ memset(&subs, 0, sizeof(subs));
+ if (mdev->opened & PERM_WRITE) {
+@@ -423,6 +430,8 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
+ mdev->opened = 0;
+ mdev->devinfo = NULL;
+
++ unlock:
++ mutex_unlock(&mdev->open_mutex);
+ snd_use_lock_free(&mdev->use_lock);
+ return 0;
+ }
+diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
+index 3f13666a01904..64a1bd4206379 100644
+--- a/sound/pci/ac97/ac97_codec.c
++++ b/sound/pci/ac97/ac97_codec.c
+@@ -2026,10 +2026,9 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
+ .dev_disconnect = snd_ac97_dev_disconnect,
+ };
+
+- if (!rac97)
+- return -EINVAL;
+- if (snd_BUG_ON(!bus || !template))
++ if (snd_BUG_ON(!bus || !template || !rac97))
+ return -EINVAL;
++ *rac97 = NULL;
+ if (snd_BUG_ON(template->num >= 4))
+ return -EINVAL;
+ if (bus->codec[template->num])
+diff --git a/sound/soc/atmel/atmel-i2s.c b/sound/soc/atmel/atmel-i2s.c
+index 99cc731505769..ab7f761174742 100644
+--- a/sound/soc/atmel/atmel-i2s.c
++++ b/sound/soc/atmel/atmel-i2s.c
+@@ -174,11 +174,14 @@ struct atmel_i2s_gck_param {
+
+ #define I2S_MCK_12M288 12288000UL
+ #define I2S_MCK_11M2896 11289600UL
++#define I2S_MCK_6M144 6144000UL
+
+ /* mck = (32 * (imckfs+1) / (imckdiv+1)) * fs */
+ static const struct atmel_i2s_gck_param gck_params[] = {
++ /* mck = 6.144Mhz */
++ { 8000, I2S_MCK_6M144, 1, 47}, /* mck = 768 fs */
++
+ /* mck = 12.288MHz */
+- { 8000, I2S_MCK_12M288, 0, 47}, /* mck = 1536 fs */
+ { 16000, I2S_MCK_12M288, 1, 47}, /* mck = 768 fs */
+ { 24000, I2S_MCK_12M288, 3, 63}, /* mck = 512 fs */
+ { 32000, I2S_MCK_12M288, 3, 47}, /* mck = 384 fs */
+diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c
+index 2c7d5088e6f27..7e18e007a639f 100644
+--- a/sound/soc/codecs/da7219-aad.c
++++ b/sound/soc/codecs/da7219-aad.c
+@@ -351,11 +351,15 @@ static irqreturn_t da7219_aad_irq_thread(int irq, void *data)
+ struct da7219_priv *da7219 = snd_soc_component_get_drvdata(component);
+ u8 events[DA7219_AAD_IRQ_REG_MAX];
+ u8 statusa;
+- int i, report = 0, mask = 0;
++ int i, ret, report = 0, mask = 0;
+
+ /* Read current IRQ events */
+- regmap_bulk_read(da7219->regmap, DA7219_ACCDET_IRQ_EVENT_A,
+- events, DA7219_AAD_IRQ_REG_MAX);
++ ret = regmap_bulk_read(da7219->regmap, DA7219_ACCDET_IRQ_EVENT_A,
++ events, DA7219_AAD_IRQ_REG_MAX);
++ if (ret) {
++ dev_warn_ratelimited(component->dev, "Failed to read IRQ events: %d\n", ret);
++ return IRQ_NONE;
++ }
+
+ if (!events[DA7219_AAD_IRQ_REG_A] && !events[DA7219_AAD_IRQ_REG_B])
+ return IRQ_NONE;
+@@ -859,6 +863,8 @@ void da7219_aad_suspend(struct snd_soc_component *component)
+ }
+ }
+ }
++
++ synchronize_irq(da7219_aad->irq);
+ }
+
+ void da7219_aad_resume(struct snd_soc_component *component)
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index 834e542021fee..0fc4755fd0d9d 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -145,7 +145,7 @@ static const char * const es8316_dmic_txt[] = {
+ "dmic data at high level",
+ "dmic data at low level",
+ };
+-static const unsigned int es8316_dmic_values[] = { 0, 1, 2 };
++static const unsigned int es8316_dmic_values[] = { 0, 2, 3 };
+ static const struct soc_enum es8316_dmic_src_enum =
+ SOC_VALUE_ENUM_SINGLE(ES8316_ADC_DMIC, 0, 3,
+ ARRAY_SIZE(es8316_dmic_txt),
+diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
+index ed34902022c1f..31e07e4b54111 100644
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -1704,7 +1704,7 @@ static void hists_browser__hierarchy_headers(struct hist_browser *browser)
+ hists_browser__scnprintf_hierarchy_headers(browser, headers,
+ sizeof(headers));
+
+- ui_browser__gotorc(&browser->b, 0, 0);
++ ui_browser__gotorc_title(&browser->b, 0, 0);
+ ui_browser__set_color(&browser->b, HE_COLORSET_ROOT);
+ ui_browser__write_nstring(&browser->b, headers, browser->b.width + 1);
+ }
^ permalink raw reply related [flat|nested] 332+ messages in thread
end of thread, other threads:[~2024-04-18 3:06 UTC | newest]
Thread overview: 332+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-02-23 11:35 [gentoo-commits] proj/linux-patches:4.19 commit in: / Mike Pagano
-- strict thread matches above, loose matches on Subject: below --
2024-04-18 3:06 Alice Ferrazzi
2023-09-02 9:59 Mike Pagano
2023-08-30 15:00 Mike Pagano
2023-08-16 16:59 Mike Pagano
2023-08-11 11:58 Mike Pagano
2023-08-08 18:43 Mike Pagano
2023-07-24 20:30 Mike Pagano
2023-06-28 10:29 Mike Pagano
2023-06-21 14:55 Alice Ferrazzi
2023-06-14 10:21 Mike Pagano
2023-06-09 11:32 Mike Pagano
2023-05-30 12:57 Mike Pagano
2023-05-17 11:14 Mike Pagano
2023-05-17 11:01 Mike Pagano
2023-05-10 17:59 Mike Pagano
2023-04-26 9:35 Alice Ferrazzi
2023-04-20 11:17 Alice Ferrazzi
2023-04-05 11:41 Mike Pagano
2023-03-22 14:16 Alice Ferrazzi
2023-03-17 10:46 Mike Pagano
2023-03-13 11:35 Alice Ferrazzi
2023-03-11 16:01 Mike Pagano
2023-03-03 12:31 Mike Pagano
2023-02-25 11:41 Mike Pagano
2023-02-24 3:19 Alice Ferrazzi
2023-02-24 3:15 Alice Ferrazzi
2023-02-22 14:51 Alice Ferrazzi
2023-02-06 12:49 Mike Pagano
2023-01-24 7:16 Alice Ferrazzi
2023-01-18 11:11 Mike Pagano
2022-12-14 12:15 Mike Pagano
2022-12-08 12:14 Alice Ferrazzi
2022-11-25 17:04 Mike Pagano
2022-11-23 9:39 Alice Ferrazzi
2022-11-10 17:58 Mike Pagano
2022-11-03 15:11 Mike Pagano
2022-11-01 19:48 Mike Pagano
2022-10-26 11:41 Mike Pagano
2022-10-05 11:59 Mike Pagano
2022-09-28 9:18 Mike Pagano
2022-09-20 12:03 Mike Pagano
2022-09-15 11:09 Mike Pagano
2022-09-05 12:06 Mike Pagano
2022-08-25 10:35 Mike Pagano
2022-08-11 12:36 Mike Pagano
2022-07-29 15:28 Mike Pagano
2022-07-21 20:12 Mike Pagano
2022-07-12 16:01 Mike Pagano
2022-07-07 16:18 Mike Pagano
2022-07-02 16:07 Mike Pagano
2022-06-25 10:22 Mike Pagano
2022-06-16 11:40 Mike Pagano
2022-06-14 16:02 Mike Pagano
2022-06-06 11:05 Mike Pagano
2022-05-27 12:24 Mike Pagano
2022-05-25 11:55 Mike Pagano
2022-05-18 9:50 Mike Pagano
2022-05-15 22:12 Mike Pagano
2022-05-12 11:30 Mike Pagano
2022-05-01 17:04 Mike Pagano
2022-04-27 12:03 Mike Pagano
2022-04-20 12:09 Mike Pagano
2022-04-15 13:11 Mike Pagano
2022-04-12 19:24 Mike Pagano
2022-03-28 10:59 Mike Pagano
2022-03-23 11:57 Mike Pagano
2022-03-16 13:27 Mike Pagano
2022-03-11 10:56 Mike Pagano
2022-03-08 18:30 Mike Pagano
2022-03-02 13:08 Mike Pagano
2022-02-26 21:14 Mike Pagano
2022-02-23 12:39 Mike Pagano
2022-02-16 12:47 Mike Pagano
2022-02-11 12:53 Mike Pagano
2022-02-11 12:46 Mike Pagano
2022-02-11 12:45 Mike Pagano
2022-02-11 12:37 Mike Pagano
2022-02-08 17:56 Mike Pagano
2022-01-29 17:45 Mike Pagano
2022-01-27 11:39 Mike Pagano
2022-01-11 13:14 Mike Pagano
2022-01-05 12:55 Mike Pagano
2021-12-29 13:11 Mike Pagano
2021-12-22 14:07 Mike Pagano
2021-12-14 10:36 Mike Pagano
2021-12-08 12:55 Mike Pagano
2021-12-01 12:51 Mike Pagano
2021-11-26 11:59 Mike Pagano
2021-11-12 14:16 Mike Pagano
2021-11-06 13:26 Mike Pagano
2021-11-02 19:32 Mike Pagano
2021-10-27 11:59 Mike Pagano
2021-10-20 13:26 Mike Pagano
2021-10-17 13:12 Mike Pagano
2021-10-13 15:00 Alice Ferrazzi
2021-10-09 21:33 Mike Pagano
2021-10-06 14:06 Mike Pagano
2021-09-26 14:13 Mike Pagano
2021-09-22 11:40 Mike Pagano
2021-09-20 22:05 Mike Pagano
2021-09-03 11:22 Mike Pagano
2021-09-03 10:08 Alice Ferrazzi
2021-08-26 14:06 Mike Pagano
2021-08-25 22:45 Mike Pagano
2021-08-25 20:41 Mike Pagano
2021-08-15 20:07 Mike Pagano
2021-08-12 11:51 Mike Pagano
2021-08-08 13:39 Mike Pagano
2021-08-04 11:54 Mike Pagano
2021-08-03 12:26 Mike Pagano
2021-07-31 10:34 Alice Ferrazzi
2021-07-28 12:37 Mike Pagano
2021-07-20 15:35 Alice Ferrazzi
2021-07-13 12:38 Mike Pagano
2021-07-11 14:45 Mike Pagano
2021-06-30 14:25 Mike Pagano
2021-06-16 12:22 Mike Pagano
2021-06-10 11:46 Mike Pagano
2021-06-03 10:32 Alice Ferrazzi
2021-05-26 12:05 Mike Pagano
2021-05-22 10:03 Mike Pagano
2021-05-07 11:40 Alice Ferrazzi
2021-04-30 19:02 Mike Pagano
2021-04-28 18:31 Mike Pagano
2021-04-28 11:44 Alice Ferrazzi
2021-04-16 11:15 Alice Ferrazzi
2021-04-14 11:22 Alice Ferrazzi
2021-04-10 13:24 Mike Pagano
2021-04-07 12:21 Mike Pagano
2021-03-30 14:17 Mike Pagano
2021-03-24 12:08 Mike Pagano
2021-03-22 15:50 Mike Pagano
2021-03-20 14:26 Mike Pagano
2021-03-17 16:21 Mike Pagano
2021-03-11 14:05 Mike Pagano
2021-03-07 15:15 Mike Pagano
2021-03-04 12:08 Mike Pagano
2021-02-23 14:31 Alice Ferrazzi
2021-02-13 15:28 Alice Ferrazzi
2021-02-10 10:03 Alice Ferrazzi
2021-02-07 14:40 Alice Ferrazzi
2021-02-03 23:43 Mike Pagano
2021-01-30 13:34 Alice Ferrazzi
2021-01-27 11:15 Mike Pagano
2021-01-23 16:36 Mike Pagano
2021-01-19 20:34 Mike Pagano
2021-01-17 16:20 Mike Pagano
2021-01-12 20:06 Mike Pagano
2021-01-09 12:57 Mike Pagano
2021-01-06 14:15 Mike Pagano
2020-12-30 12:52 Mike Pagano
2020-12-11 12:56 Mike Pagano
2020-12-08 12:06 Mike Pagano
2020-12-02 12:49 Mike Pagano
2020-11-24 14:40 Mike Pagano
2020-11-22 19:26 Mike Pagano
2020-11-18 19:56 Mike Pagano
2020-11-11 15:43 Mike Pagano
2020-11-10 13:56 Mike Pagano
2020-11-05 12:35 Mike Pagano
2020-11-01 20:29 Mike Pagano
2020-10-29 11:18 Mike Pagano
2020-10-17 10:17 Mike Pagano
2020-10-14 20:36 Mike Pagano
2020-10-07 12:50 Mike Pagano
2020-10-01 12:45 Mike Pagano
2020-09-26 22:07 Mike Pagano
2020-09-26 22:00 Mike Pagano
2020-09-24 15:58 Mike Pagano
2020-09-23 12:07 Mike Pagano
2020-09-17 15:01 Mike Pagano
2020-09-17 14:55 Mike Pagano
2020-09-12 17:59 Mike Pagano
2020-09-09 17:59 Mike Pagano
2020-09-03 11:37 Mike Pagano
2020-08-26 11:15 Mike Pagano
2020-08-21 10:49 Alice Ferrazzi
2020-08-19 9:36 Alice Ferrazzi
2020-08-12 23:36 Alice Ferrazzi
2020-08-07 19:16 Mike Pagano
2020-08-05 14:51 Thomas Deutschmann
2020-07-31 18:00 Mike Pagano
2020-07-29 12:33 Mike Pagano
2020-07-22 12:42 Mike Pagano
2020-07-16 11:17 Mike Pagano
2020-07-09 12:12 Mike Pagano
2020-07-01 12:14 Mike Pagano
2020-06-29 17:41 Mike Pagano
2020-06-25 15:07 Mike Pagano
2020-06-22 14:47 Mike Pagano
2020-06-10 21:27 Mike Pagano
2020-06-07 21:52 Mike Pagano
2020-06-03 11:41 Mike Pagano
2020-05-27 16:25 Mike Pagano
2020-05-20 11:30 Mike Pagano
2020-05-20 11:27 Mike Pagano
2020-05-14 11:30 Mike Pagano
2020-05-13 12:33 Mike Pagano
2020-05-11 22:50 Mike Pagano
2020-05-09 22:20 Mike Pagano
2020-05-06 11:46 Mike Pagano
2020-05-02 19:24 Mike Pagano
2020-04-29 17:57 Mike Pagano
2020-04-23 11:44 Mike Pagano
2020-04-21 11:15 Mike Pagano
2020-04-17 11:45 Mike Pagano
2020-04-15 17:09 Mike Pagano
2020-04-13 11:34 Mike Pagano
2020-04-02 15:24 Mike Pagano
2020-03-25 14:58 Mike Pagano
2020-03-20 11:57 Mike Pagano
2020-03-18 14:21 Mike Pagano
2020-03-16 12:23 Mike Pagano
2020-03-11 17:20 Mike Pagano
2020-03-05 16:23 Mike Pagano
2020-02-28 16:38 Mike Pagano
2020-02-24 11:06 Mike Pagano
2020-02-19 23:45 Mike Pagano
2020-02-14 23:52 Mike Pagano
2020-02-11 16:20 Mike Pagano
2020-02-05 17:05 Mike Pagano
2020-02-01 10:37 Mike Pagano
2020-02-01 10:30 Mike Pagano
2020-01-29 16:16 Mike Pagano
2020-01-27 14:25 Mike Pagano
2020-01-23 11:07 Mike Pagano
2020-01-17 19:56 Mike Pagano
2020-01-14 22:30 Mike Pagano
2020-01-12 15:00 Mike Pagano
2020-01-09 11:15 Mike Pagano
2020-01-04 19:50 Mike Pagano
2019-12-31 17:46 Mike Pagano
2019-12-21 15:03 Mike Pagano
2019-12-17 21:56 Mike Pagano
2019-12-13 12:35 Mike Pagano
2019-12-05 12:03 Alice Ferrazzi
2019-12-01 14:06 Thomas Deutschmann
2019-11-24 15:44 Mike Pagano
2019-11-20 19:36 Mike Pagano
2019-11-12 21:00 Mike Pagano
2019-11-10 16:20 Mike Pagano
2019-11-06 14:26 Mike Pagano
2019-10-29 12:04 Mike Pagano
2019-10-17 22:27 Mike Pagano
2019-10-11 17:04 Mike Pagano
2019-10-07 17:42 Mike Pagano
2019-10-05 11:42 Mike Pagano
2019-10-01 10:10 Mike Pagano
2019-09-21 17:11 Mike Pagano
2019-09-19 12:34 Mike Pagano
2019-09-19 10:04 Mike Pagano
2019-09-16 12:26 Mike Pagano
2019-09-10 11:12 Mike Pagano
2019-09-06 17:25 Mike Pagano
2019-08-29 14:15 Mike Pagano
2019-08-25 17:37 Mike Pagano
2019-08-23 22:18 Mike Pagano
2019-08-16 12:26 Mike Pagano
2019-08-16 12:13 Mike Pagano
2019-08-09 17:45 Mike Pagano
2019-08-06 19:19 Mike Pagano
2019-08-04 16:15 Mike Pagano
2019-07-31 15:09 Mike Pagano
2019-07-31 10:22 Mike Pagano
2019-07-28 16:27 Mike Pagano
2019-07-26 11:35 Mike Pagano
2019-07-21 14:41 Mike Pagano
2019-07-14 15:44 Mike Pagano
2019-07-10 11:05 Mike Pagano
2019-07-03 11:34 Mike Pagano
2019-06-25 10:53 Mike Pagano
2019-06-22 19:06 Mike Pagano
2019-06-19 17:17 Thomas Deutschmann
2019-06-17 19:22 Mike Pagano
2019-06-15 15:07 Mike Pagano
2019-06-11 12:42 Mike Pagano
2019-06-10 19:43 Mike Pagano
2019-06-09 16:19 Mike Pagano
2019-06-04 11:11 Mike Pagano
2019-05-31 15:02 Mike Pagano
2019-05-26 17:10 Mike Pagano
2019-05-22 11:02 Mike Pagano
2019-05-16 23:03 Mike Pagano
2019-05-14 21:00 Mike Pagano
2019-05-10 19:40 Mike Pagano
2019-05-08 10:06 Mike Pagano
2019-05-05 13:42 Mike Pagano
2019-05-04 18:28 Mike Pagano
2019-05-02 10:13 Mike Pagano
2019-04-27 17:36 Mike Pagano
2019-04-20 11:09 Mike Pagano
2019-04-19 19:51 Mike Pagano
2019-04-05 21:46 Mike Pagano
2019-04-03 10:59 Mike Pagano
2019-03-27 10:22 Mike Pagano
2019-03-23 20:23 Mike Pagano
2019-03-19 16:58 Mike Pagano
2019-03-13 22:08 Mike Pagano
2019-03-10 14:15 Mike Pagano
2019-03-06 19:06 Mike Pagano
2019-03-05 18:04 Mike Pagano
2019-02-27 11:23 Mike Pagano
2019-02-23 0:46 Mike Pagano
2019-02-20 11:19 Mike Pagano
2019-02-16 0:42 Mike Pagano
2019-02-15 12:39 Mike Pagano
2019-02-12 20:53 Mike Pagano
2019-02-06 17:08 Mike Pagano
2019-01-31 11:28 Mike Pagano
2019-01-26 15:09 Mike Pagano
2019-01-22 23:06 Mike Pagano
2019-01-16 23:32 Mike Pagano
2019-01-13 19:29 Mike Pagano
2019-01-09 17:54 Mike Pagano
2018-12-29 18:55 Mike Pagano
2018-12-29 1:08 Mike Pagano
2018-12-21 14:58 Mike Pagano
2018-12-19 19:09 Mike Pagano
2018-12-17 11:42 Mike Pagano
2018-12-13 11:40 Mike Pagano
2018-12-08 13:17 Mike Pagano
2018-12-08 13:17 Mike Pagano
2018-12-05 20:16 Mike Pagano
2018-12-01 15:08 Mike Pagano
2018-11-27 16:16 Mike Pagano
2018-11-23 12:42 Mike Pagano
2018-11-21 12:30 Mike Pagano
2018-11-14 0:47 Mike Pagano
2018-11-14 0:47 Mike Pagano
2018-11-13 20:44 Mike Pagano
2018-11-04 16:22 Alice Ferrazzi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox